freeradius-server-3.0.21-lp152.2.9.1<>,`|8/=„o\$wWݿ95ɈkM?ŅJ]٦#$q4,`TqF=hs@=+Qxh3k;{D.c%B4 m"!a.nH $jvJo4iȿ>9ry|;oګŏ`86~ h 'W?OK%ch*@O6?6d ' 5HLX\ox  |  >  h (  o<l 66ѹ6,8d(g8p'9 ':g'=> ?@B!F,GDHIXYZ\[`\h]ϼ^d*bcd.e3f6l8uLvEw$x'xy/z66(6,66686<6B6Cfreeradius-server3.0.21lp152.2.9.1RADIUS ServerRemote Authentication Dial-In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA or Triple A) management for users who connect and use a network service. FreeRADIUS is a modular RADIUS implementation.`|8armbuild24. openSUSE Leap 15.2openSUSEGPL-2.0-only AND LGPL-2.1-onlyhttp://bugs.opensuse.orgProductivity/Networking/Radius/Servershttp://www.freeradius.org/linuxarmv7hlgetent group radiusd >/dev/null || /usr/sbin/groupadd -r radiusd getent passwd radiusd >/dev/null || /usr/sbin/useradd -r -g radiusd \ -s /bin/false -c "Radius daemon" -d /var/lib/radiusd \ radiusd # boo#912714: add radiusd to winbind group for ntlm_auth # add winbind group and fail silently if it already exists /usr/bin/getent group winbind >/dev/null \ || /usr/sbin/groupadd -r winbind # add radiusd to winbind group /usr/bin/gpasswd -a radiusd winbind if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : for service in radiusd.service ; do sysv_service=${service%.*} if [ ! -e /usr/lib/systemd/system/$service ] && [ ! -e /etc/init.d/$sysv_service ]; then mkdir -p /run/systemd/rpm/needs-preset touch /run/systemd/rpm/needs-preset/$service elif [ -e /etc/init.d/$sysv_service ] && [ ! -e /var/lib/systemd/migrated/$sysv_service ]; then /usr/sbin/systemd-sysv-convert --save $sysv_service || : mkdir -p /run/systemd/rpm/needs-sysv-convert touch /run/systemd/rpm/needs-sysv-convert/$service fi done fi if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : if [ "$YAST_IS_RUNNING" != "instsys" ]; then /usr/bin/systemctl daemon-reload || : fi for service in radiusd.service ; do sysv_service=${service%.*} if [ -e /run/systemd/rpm/needs-preset/$service ]; then /usr/bin/systemctl preset $service || : rm "/run/systemd/rpm/needs-preset/$service" || : elif [ -e /run/systemd/rpm/needs-sysv-convert/$service ]; then /usr/sbin/systemd-sysv-convert --apply $sysv_service || : rm "/run/systemd/rpm/needs-sysv-convert/$service" || : touch /var/lib/systemd/migrated/$sysv_service || : fi done fi systemd-tmpfiles --create /usr/lib/tmpfiles.d/radiusd.conf test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ "$FIRST_ARG" -eq 0 -a -x /usr/bin/systemctl ]; then # Package removal, not upgrade /usr/bin/systemctl --no-reload disable radiusd.service || : ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_STOP_ON_REMOVAL" && . /etc/sysconfig/services test "$DISABLE_STOP_ON_REMOVAL" = yes -o \ "$DISABLE_STOP_ON_REMOVAL" = 1 && exit 0 /usr/bin/systemctl stop radiusd.service ) || : fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ $1 -eq 0 ]; then # Package removal for service in radiusd.service ; do sysv_service="${service%.*}" rm "/var/lib/systemd/migrated/$sysv_service" || : done fi if [ -x /usr/bin/systemctl ]; then /usr/bin/systemctl daemon-reload || : fi if [ "$FIRST_ARG" -ge 1 ]; then # Package upgrade, not uninstall if [ -x /usr/bin/systemctl ]; then ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_RESTART_ON_UPDATE" && . /etc/sysconfig/services test "$DISABLE_RESTART_ON_UPDATE" = yes -o \ "$DISABLE_RESTART_ON_UPDATE" = 1 && exit 0 /usr/bin/systemctl try-restart radiusd.service ) || : fi finQG!" Ok[ 4 e!%hE ` No<w_6jCd "004 L' 8z # t!( _ 6+ lfD .w Wb!4 j E( +JmVz!_ ]O6 F r$N  60O4Dm  !X646T(&G6&$&F&L&@7&6\&< &HF8%6hg`w6&,W`&&w&pF&6g&DV6666&8&D,FP&46;P&86&46`6h&*TWTBl&17 *' j) E3 p.&!]M }O .=O)Eu "#B:J+&<FF7\n;{2=%F BuQDSk?wXV $F@VRxTkrSL kR "'YL61 emh/1kc_hn  aA5f /n 3AE)lva VmL?J] &!g9 U" S L1<aZ [ 'F[5 xxawwH' [ XYA聠A聠聠A聠A聠A聠A聠A聠AAAAAA聠A聠AAAAAA聠AA聠A聠AAA큤A큤A큤A큤AAA`|`|`|`{`|`{`{`|`{`{`{`{`{`{`{`{`{`|`|`|`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`{`{`{`|`|`|`|`|`|`|`|`{`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`{`|`|`|`|`|`|`|`|`|`|`|`|`|`{`|`|`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`|`|`|`{`{`|`|`| `|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`|`{`{`|`|`|`|`|^zM^zM`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`|^zM^zM`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`{`|`|`|`|8a5aabbd908cf07b0f2e622477e2027f97cca4e54c2d651f6cceef1e0245abb9537dc913ca617dd3b64e0a0d6726a8d60661b44afd2836ca2e3362f5232c1af76877cf91d3f456bbbfede10b2104aef6f0543fb75c4fd1c77ed5eeb817362fd0a049f99bb80f2f16b953d5c5011fdbf98a3bfe2cefd963cab58546f17da83f60eb3e83e984887067ae91e3ef36553a3503292296c8d12d3b1d0d10c34b263ffe8ae096c15cc0e12c19fc104579a775b111be461dfc954d5067a0cc568f53f14612cab60855fcbae684e860277611de20ba736e8ade46571791d6def116d5ba4e9d4b49900dc46af19ace46878a20367408156166199dc83015c0c6c48c5323e11b686b70fb8cbd7c831698dd8ec6f8f53dbee942b683268aa7c0a19c408bf3947bb0950fd01b446eebd65c3e7eac66ffdf8a7067c006a034460cb78f3d3ed36fb863be3a8ece46366d50969cf71feaf2ae5ab38fe39d7021a63b679d16b2cbeca02caeb6df36f4ef5fa8e34b8b3e860968b7704d208fa59a06daecaa83ad33714f5007a8604c6e1e9ae0052713a65890c016d93dd2fd4de16cccf8ff8ce1a6728d792eb7d1b50d9da5ed3c89ba6e2fe415c37a918a687888d9b348af4ecaff9edc2d3545e0192a82d1ec1ea7d7c2e2c3a534cff700e1f6d6c0878fec2e0a3e9c1f2b05ce22abe7428bbc6094677ac16b00c86dc4e249aef6203742b277a2cb78bb5c7433891120096e7465aa5aae8662ddb72a3dd56676d523243d38319613ae90b2c361152d097cd025bcac246037ef28a422a801710d03e0bbf4618c61f7bea8537208372c09c8326b062b8a23b5cf08ac85ca77dac25d9739326c1d0a5a0d11e947a770316146f27e90e6164e2cd6d4bbb25fbf29b2219bff150fc58e05d4c8bfd9dc1f0588467ee2fe948f7ca3da2bda2ac55559e269c48c6276f58256d7aaf7dc46c2291470b6648fc7313e849a7db0730b25064529d19fe3c4612f0367113b3f0ce376e4acc454ded908f11fc5d73ce9145b8862aff6820bbbd5cf3dddca598d0b56b147c7b6633627643041391eb33b57af2173f1278c47be5a8b35960ce1875e81f35963033a71b46cd13ac21738e608fe3006e0af9e9cbdba2a17a72797aab1fcc7e66f306e48d3de55832d7886a071c5f9f941a1a871f2679b30314c4cedf0e7889e79bd3d4f23ca80f6cbe491aa486e7dd4d3e3359e05b5ec7e1f2fc4b9e7144988b03445c239d9d4b2e3c650048c0823dedc70d1378854eed596a0aa6e073400498c189d2b34f8ff4d1c3e0d05587256fadf737b53f780c8b4caca010f402df850d5c9190872d7df1dbbd2d57203bcf6ed127d0d012f1022221d51154149c83562329f1ee5b308d2f7990253770b325827a575a4f342b72b209cded3bc6435fe032dbfbddd12b60507a9de63ca436350d21f77fa901c8d0230a775c48be55250620694124e9582b09268b01406a8b1794adf8648c4488bfd709ee04ee744db5d7a30c1e9e6f5512c487a0e364580ac9c2c155306eae5fb2911c5852792cd6172b70305150d428e48b71de06bc0a2aeb212f735128735e0ba2e5be5a7ea54c6e3e1743154525f36265eeabd68dd929dea521f126426cb4cf442d73acc0ab0e1aaa5e97f39ef896a9eba5273df312212ba68abddbf497ed5244e5f624311fb4e4427558c8ac2db869bec2ab1118a5affa190ad23ebc39834dd22274bbe02303d7ec84e3ac96ffef1e4fa4942f60259acb64acddcec78ae4b961f49eb32e433ec3f9fe04530b8212d98ce0031a0c04c94e594941691d8c27f07c7d38cb1f1f46fe063a18d6acacde6eb155332e9004c935ac861b16b0c19b0f5fa237defcd03bf00824e13dbc54143ec4e2a6a9b1733a57f02b80f47967c47612f8eafcb5dec8a34f46c350b21224d0cd0d59d246e5f09fa120d74dd8af1c885af12e25c83cfc8520c2557e57d4e5a6ac740725a7a79fb9bda736a4336f0186044036b8837273ff2e4715ecd66ea703276208d9f35348541bc6c6a1f5a72b05542d6e5ca46374e11b94d501e1d803be1e311ecda722c5baeb89bbdf0e932ac460748c060b1ee65a84b81e75d13810894cddabaf7b3cd40ec218ad90d14b0edec0abd0f4c3e7346abcc30d1ef0e2cb8f38cfbff2b5161c1edd98253b9940dc539e8fa9967ff175fe1d2f72b48df94cde8484d1667b935326f51839c002f59163af879307334ca6079afdc06b31b2337657270ea117f2d0408ea93f7e40607ff55b8817e3348dbe9cb662b83d8797b5658ad0b6f31cc4daba7f5b54f261de25be6958f728b44070859c5564db0b1c2a02091f7ca30656a845bc01d2ecfd326c1454d6e9023aafcaa93905a86701ae696b4dfec480abc9e11042aab9aa7f2015b43b17b93bf4b9752e10d32ef5aef8192f95a52e736dcfe6914ae49e5e2b70b5ea578c9d0cef6642d68af6836c7cbc4e4f2c017969227754ebfd82e55ff169140b5553c2760436c3fe44d81376fc4729607735f711230e7b3584f2dc5bdba4a41240c1234467dd2a4e5a6d727ae10c7cd2e4c700e224e94bd4b89e7cad944e638d5357225a469797a11b727ade2666a29553b7e12ed204c88235ef4e36cf025b9830c9af1d01fce17419695b6622019af2e9753b53e6bb8f3317936202a51b848e6303dfdc082d0719875a82133ebe9001296d20f3304980c838313f41cbbdd4fe25e87efb91090ea0e40023b1f6c78a3999752c2f5829bf40f1baffaa2172ee6b27252aa3bb0e14ccdb88ba65fe5a00967b2e29b25e7320a8f43386cd1edab1781174cc8d3fb50e37632e1a296ef791f94e6f78efd6221f8984d19dbb21a231e1b340f061ab9e90b76c03faa5876c04526f383fd5ed6fdbe2c09475af49596d9ef244dc391de752a6ab6500853e680e32789b8cce3b47bb057fe5a828ed3b1ef3c512d47ace6ef63feff73d84a1efe4f7cef0951ba73ccd175eca9193bd344948545039237b3c7a260d9789c298a10d55ddef8cae92655565da9c62308e70717122f1ee89183ae518f56adf30263e6b491f8d24d51d6cb253ae62f5e362346328a6dd9cd929e48488830cc24259842f13e362b227ed79c6999e5882e3e9a9bf3991deba824dcfb1c532e6d2f0b142741544636f6ec2ad3a12b4257c9f88f2bfe5f1c8db1aeb5478b03597419591ebf4633a0253b448d5b2c66a9b6eaf94e0b2d14a395e5bf8d3b6ba14995a46195739d5b9f213e2dd236b4e25c04d940fbda7bf6a271843c644bf85bef7cdb3d7bab661395b7e076b424e07263e344f270dc0000468adf57142e94726ff9d1be37236c8b100047c811864b0b55920c1ebac2222a26cae07e0dcb4c58a23f1d349de31a5181903866fd9af6cb18f32eea957be776ae3eeae96e9efc73f8a894f3942ebe3b8a6925abdd3c56add0e58cf4ba1cfb1384dc276f515bb218c810640770c3a00d6d8bf069e3a02145e4961db39e3c7a71be428d19246828d2427457805e758300ce6f0fb67136812b0c6f55a117bedabb6073df5f1adc98f67f9f67a965d3e4d85372a1a4904b87e5217c904770adbba65b3bf0207b821cfb5d139f857d846c6070fcff545ec965dc1198895e37601b9ab056f1820dcec7ef2f5e13345e91761fdf454a38b09a4da70039f0a30ca7236827b364d95b8a591ea6ed66f2d3e971b66570dcd5a3fd9e479a81fe52b0141fa700bba14374f347b6b43b6f4a8800a12adfdb29a8fcc0f4484c4261fed88a6d5c377b1f2dd83f954dd9cea1345e05ce40438f5b045f4d92db6be31f22a160ed38126cd736d360be66c53e14548722bb10cb002e2a0c9ecb3fdd1893b4e97952222040f5ae2a745e8e22f5653bbeca416506f850783083598e0758a5c0385c22b71a465eddab5ce281b400caefcb14c09a2e50e14b2d872bd168b846edc1d5250d1add9dd6eb4e9b4de2e13c271e8a13f472ee5f0cc80d6897af8c5b2e0ae90fb92f20b9cc1104b65f8097a9c194369f06c51f67173f82423ba2ee84a2cc9522d40cfdc99e68b752a6d41e960263a373ccb0e9349323527b861ba030703a02da680b764976c7e6090504cb23aad5a3defe69d8f23baa1dfc3a571ff3b6efe294d00440ae45769a537f47a00cde9a92d21f0d3c474dd65b69272046cdc4d4750bb0449c3b014abf7848b1fa3fdb21cafff9efadd1226e408ec45ced777523581ce2bd68e0c5fe7b61b745268821681001e6fea4dedacc29a103317afa86619b88b32c317955cfd9717864940adee017d5205ab68298c82d348e3ba017cc908430b5e0ca77257083eda9e428d66bf4f60c76e0ab118e567d30cbe0e65bcb869f1daf94fcbf00f18291304e553a9b3bf5e8ba73a031af3ed70cf495926c798c1998a429071c6a9a9c12d5301262f28efc78e9871bb29bf1cc19d82ef20dcef84b0c8f2ad854ddd6608005e806ca2703a776759f81dd64cbca323e5f3e1623cbfc279abcbafbad59f44b6e7303b6590b0c818afb57f68c7a97ccb608c072542d5dadc3b83299f8115154851851da96240ed8a57ed750b659b18794e90ef897602df3dd83a57df4ed17c8553a5377d39d17a8fabca93890e91b4a4c411098c685b41f89be0b307c11130506b594b822535e760c058d305a61c3aac7d758e0d7033c95945a892c5df13cc423e4febdd8050175d6afca21467af23c8b55c1f2008d4dc16bf81b0c2cc2de4726a5088127c9f60f9741aeb82cae1d99e5e70a7e29072ab68099e69484c4b7c9d01bc9837ab4650e83f55ba466c9af4292068d5c9767849dfae027be2c73d68e98fac5361294f8c46195fd2a49dc43c04544ba86a6bba75937d6758de5dd79d2017d345d502346788a8da5225bc316be774c1971c97fd3d5f1f0f2ae4dcc1920bebeee6d15f99706a309ea843028bb7c2777179c8a7f4700b8587967def9561c0a8a86a416cfa8ea2061e699ef1a2fd9ac80c05cf6c71cf8e53f576069714247cd4a9736e72e1104dfcaba8be8ccf6f8d57abeed18d584f184d6bd5d8680b76b3c6720c814e59531bfba2f2c83c8e099a4da92887fcca7ef8e67dfa0f6b3fc8ef21c8f70d61c331f51e705c8c11bb8c4a6fe1cd09e26d27a1cd29e99bb4d89b880002eb54d99d5567b553ce5a6e681e06048ac884a5789f9f121ad73d86f617df48b9ed955d669b216af18d3e770b6fd079dfb3760a1e1f8976dbf64dbcf3b80c295287e5ebe6a345120ac11f9752835f382fa6150ed4d3a5daa53f41b355e72b4dc2e6f8e7da53562fb4191369933b08ed25a8b7d117a09ae6d59d09c24e0ed65eb73128f866312cec1941b0d5222d8fa9bd842a55e079efdd6e287086bcaf6182fa41d96bade16e6d6f4bc0e7e117a2b87b16ef1c9a34ba79bd4491663fa6c23eedc86f7e81068c4eba56cd09a9bab6398289a50750c75e17fce9fb803ed2faa99d7c9a8687e4bd76d90441fa77920a99fc72e92e42869a9919e8381f4e8959577d4b2153370271d085e8c4488d1dcd0f92f177182b4593c0b68c89896d899bc2cbd37197efcbe8d16566928eb0cc1e86e71149a98358bde939a6e918fd6fe63eb3fc9632699fd99f2a80eeb6d48897f6daf8c718a63eec6c986a54eee2596a803436931a06efcd32ff8e9fc9338ffade69ce3c22dd65255a00f890938fea9918fe2ee1d3814d28e2414cb2a6e81d74acd62d8f6efe54ec38ef622c8580c205f4fe64daf2a46ec96819cd6ca8c1de3ffbedab5042908b909f86681c242a5868135643bc4b18cbc36af83ba9cccbe321e6c522ae1ebc2609a5fb751e91116f2cc9d11fcdf8ce687ce333c1a6d63f052cb47fac5f6ba1d744b3c08519d4f288e9938aa8da1700341f33e93ac4af48a8e3837ac6d21ddec906bf99e84d99d6e63a5dea16812ff583cb38a4e6577a0b18a809f98c34c3f7ba2d05d1995556d06d37e6ad241018f7f4d1e73fab24d534eb12765d5aefb877bcb5fa4e99240189ef8b716bce2fcc264fa228bd2b5d610f22adc261a9c37aca78ac3d23292c80f8014c53e10de98ebb40d6f302a316959c8301feb7cf29fd9ee9239afbed35417b76625d41c7ec1ccd3556fecd9ec9375b74a8ea403faddd7825a3f76fc9e3415cdafa98c5d62d432eb59c04498f3e8a46e9a7aa2d151be36072df097e8b9d2d423e7a6baf10cb408106e0a26ca1f4427a061b57dd9a2199e15d5a63e8c33f281a49fa3adf09b0d66e0aeed09cde6bb7880c91fed6e20881bdada310b6171e1977ea3d5672bd3dbc2dfe64b91cfb53bd3c9f46dd7fbe3584b9fafe5d323fc989054819dd3a3eb45accd795f7b323cab2a210f28e5c12fc4f1c5b7678f984846315d3d028e6e0244cc9f7604b63cc831cce72fcee373bd8ed34b06248e727eb4e38b6c40d652ab064e0042c9418f91903776068dda34d00c801dcee912c8e3f10238dd911537cfa3d624f030e1a54b082c672cf9ad31205d06b9ff5ef61c9351fb27167ac47343df20f10d033aca7528b29b1db4db0afc3fb2ffa57a64f9aa3e59285630b75fe59f95b71296a8abb41320436236df573e9c9ffc08629cab54b1a8e44a4a286f286bed3893bf4f18610ad9f93115d869ec5a2f09039e6e3df1db65ed100551ac1465f4f01d05cb9b6ced96820af0f78b2188409f8449cf68be371a1c778a03d9d32cde7584e1db42254bec8ec1379923e697d6470ad770c3ac7bbc21342178d3655f6d0775aa7d9ef9a230d451e5590a74b256c2e8338b3699768350c409df5fa8b1ec4ac1109794f49124426458ecd2c805493a1b22780b7e54d6c0a0977fab7ba497e0db0672c107ccf18ee2017cd863444b4726ecf99830dfd5b1f12ec6d62daec4febe5903c2462bf1b742b2e613a547874db0d583636f4cccb4570c47e485ef5ebf299ef19f154a480605fffcd1f1a86d20c18bfef686fcab88d4024365fa9ce956506034814e31435d29ed2bb4525f7495106b813b6a3ab7d1711f073f26f15afc92571271961922bb2f6120dad0815e28593a21b90f7a76c9e4fa56ef579e8d44fa3c0d6ba53edf795859891be1e09b581f086f321116cb81986dce2fb0840195f765b8803ff769fd0829b6d1976848182e9d1d1ebf4ff64953e84a0eb7d91917d177f0084e3852f9bc822eabfdb7551c2b06d9990146e66c3330837e7c0aabd0549b83cb55182b8d222599137b85af51f48f2d6e6d94279cdab515882c155e426b9564ea4ad09479354d82b9123ef6baf3f826044c7ac32a7e0574551c032a76a01b277908beff0a04f9257dfc13410ca9b01a57e11c1566ceefe22c1c5c602599b7057b0521423762d2537335fb34ef3d3bb9a6d33fdc02a4fccaff5f2c2f7cc288897dd888512103e328bc47da11e41489cca366f9b479a291020680af7b26b00074d3ba284fd69437e987fbdd93f5a56f433aa1c009e1ef5c936f1bbc29cdba6a242c36c0ba1a3ecb4fff3f6889cfbfc8f5329c78b8e385806e587e0d249895cf7b0d4e636a9f89aceb18e58b9aae0056182e68531a6e12bf380de1b29b2fe48ec8bce9424d15263a31a0fb795656ff74c3a712808c9ef54fd8000eaf4120754e1feb48b41ee940f67173223340342e1b0f9d4db3e02b5ce02437d8c9db50f85313f9547e97a1b4cfde8de25cda2cc78b356c45d9ada1c9204c30086e7f81ad93bc32a21a08a853a7727208e6fd4496beac73c971585b1d248d18c03e9bab6008233a735cfdb2864bd9240de76a4c8ca59042c3ef7f8d230c4fc7d1bcfb9e70d22a3e45c520655e0a96deb2f1b36669c9c9e6006c3336098319fd474961c407b518dc69977f41262319548cca19e064662b9d5eaf5e5a1bfe3e66df6abdc924d540473ee0012e35577bb8f3e0b083b802650e4b1ce64fb19773e4446fb85da6dbca68ecfc6fc5aabc178e33cb10db394e6e2455f5a651ef5e82a26049045aab96873735f785afd0922b1c35cd916f011388ca1bc4b5b0a2b37f5c63f7a21a9160533b25c724bf5a1d02a8e2ff3fc8f09459f679a39f738b71ab65f1fb5ff6d8de0eed7e1615da27b0759260c4d8b0f3d566bd1b91478d27a44abc6b42f9cde1f2fe8503900c2a56dd650b4105022e73df9d69df59813dfeb706f3b3a55fb5215f045746c25a14f552a0230229c3f06699a673002fb42e3dcdb54796d50b0e42aade554669306a7837839b7575f13b33761282b752a21f06885194daf3dbb8e6c9a8027198e5d93e37f4c34f834429af27198d39a249b146f20fddcbcb0d0b06b072ab5daff60c9058d98bd21e6c9c2b12fce893dc4b908fea998846a1fb4bdb15845e6391f0bed1c552045501cd07d3f3fd750d1edc7ff4ce04432b279c40d2564ce62fe7344af5dd1d1f18dd13b91a31b3e43bb8e6d4d35f245298056660fa621ca3bf2763aa9fc99217023d44150910f6f8c6c8300a87d18db30353fbe716b9b1a2e207d692894bd6c0bcf7fc5b7b6f1e10d4edf1edd6ec8e70706c3d6c30171e3d7ad61e5faf115e811456c22026680ca614ca4219c2e6146c5aa7681ce154bda397c848ddcb33d4f11ed59794cf424884fc8cce1158da0e924f942597fd897ae1cb0f4b0cf5258060ff521b1f3cf766ae5b3a989de853d50ff7a8ce5d33da3bb2b9ef1b0feb0538292c2c114ed0a516136908d778ebd46f958fb2cf7a07126794b229eccf5896d5e5c238fcdab8dd287b9e7f48be448d24316d5fb1ef6409da4e160837058b37acedf332f8937d83a8aeb376e0a87c9b5805954c29831ddf68b49ad0638cf461f37029c54875ceab5424e296a13c8dfaf1e6bad45486b3d012c1f7f392b88409227b64f23375e400df1d98c7762808f87cba0684e0ea1c1870ea92b412c21b829554d5fc48a7f825799f125b30adfdee54a4ae3865e7a75ad71b91c1385190a2d3fb876cf20cfc923a08253a0c4fec6404ee299f04f97f2009998611b845a4ceebd62d954dd964fc70ce0bed6d9d976be005dd4bbcbd395535e9fab9176172cf6c90625060b4507e682b51a13b8d8e6e4fab6727b44e692dd2c565ef16b92052f3f455048293ab288b757050697ba7a0b8af0f6d3d8a8e4a62651522c02f2c27753db957c023ec3b08f651a13b8d8e6e4fab6727b44e692dd2c565ef16b92052f3f455048293ab288b75d1e3ae7c32562723ae3a56b9153f7a6dbf2518ee7844d513b5fd02043d61f4eb8170a326d03bfd275ad0787ea81ab210092be7259498aa31fa0d1d654dfe86f58f223390cadb812db96c2d8de2411e785cde5e3f074c41478c7da963a7ad459136529c207f3d537a22f865916c81b611e404a31bf7dc59de44f111fc09b1c2fa79659ba31d6e74751a223e7ff36a2d784cae1d91e965ce9af08513a80ededdd740809687105eb0164d0a52928630628505b0b1f5f75d27ebf11bf20f25dfcce04d8bbd652f45cd366b79e185fb9589bfb98b6793455893767759e68e231938f855b9cd33c20d7f953921174fc221b4d72eb8178282186728199d0d1bcc52313f4d01b99f4c42ce9148858d22db6fe001745019a74b9c42c65c533f6454f751f2b0628cac686194c463c75a008032456f96dece439e82a96bc3c3da57189828c0d4b66d923f517f383164b55fea7b67f35e77208e72bf6f8d04fe07f6a36807d342f084c9d385869142e0d4cb034eda19eec8ff0b1ed1a8082848d253c05a4f28c5cbdf119e0c504a7ea2e70fc954bb50513f2d2973f8711e239ac63be25b39ccb30fcf48340a899b72da408c56b01f8c8889ea8d70032bd8333ddd8431f58166dd6dc3c0b0ac79139f42b5bc5e2b5bd9028b65fc5b82083b61e8a4d28c8522b5caa62ed22349968a1eb4dda74ecfcc3eb54443bd8affa43a8a3667042078daae3161b357940f91ce8e38b7861e18b06bc5e628078381a2914221b1986222ec9e8fd32ca89e0068dfb7127550fcf123183cc3ae270a926105d7acfb2d3d0e890324ecab633e2021387dc97dca3cfad1c5b8887dc7dcd5a558b39e48099d860b05f15f493c5a6ab75614ad25c3573bdac3be378b21108c185a64b803b16f2a93ed4114dab3f5600b28eb4efb2b0647eaf1039d8be35c21bca13f67177ba29ce8dc68b368d67808bb073da54ebe4d41da5dea5503236c671899d28f9ea98d13079c42f07c0f1fd67abf34b7ea6ac58c950e9f4eeaf5fcda2078bd318d6598b5e9cfa4480610a941518388343cced47c80ca9348297e4a3e1d61f9a964e480d0dc7ff6f8d200a428066a2166a96da5865cc1521ed618259112cc26df867378dd8f6588a3915fef12973d8b67ab54e8c513fb7057efaaf513477ce4bbab4f1a227f069506b441b95d327dd5e268b9df1b2a8958395a3f8fd70472824a1a4572540dca3a9982bba40164dbde4085753eb058587c8f01f123324b621612a2193e9d518d9c9c5a529efca8369a5935bd95f5b2334a5ec8da7dce0f62fcd0f318bd3421f45889aac6b21f7bddf11add045a69dfbfa9f3e5e83c56fca3c659b72bc835697d2c194a7882904e6be48d1122c737d73b99ebcf30aa657c3287ae0c5000cdf0a049af584d275a6e5081841a9b7db2c4d2d7c2ddda1d9c05808382a7d50bb0b9f69244697a934dd9f7418787a18faa4ec90ebe6b83d50587f2cd99899cea23300ab2a53ac4995bc2b9450f2cbf9f835e1092678d5ceae054fc600cf647a2a793d9b6aaad7b3e770b7f840ced8f169e094246663adccdd98870bee4494ccd5f6538ce2dc320d338da3259a7f0276b0daf3358d3448579a8efa1365d6319989b303e5e463c7ff4d2024f2694b5f302ca301dbefdb9efc1eae6247df9a00028f7fe3acba40290743cc857ee6e0ee36289a7ec69292c0fa22ef4c16cb324d34f16fca9ae7a0a1415667033a29a41d2d3e47a71ef126690cec11bc3909eebc068f35a0e2dc1e8203bf0dad4a4dfa49490916fff4dc9fef87bf8d3b74c2d8cac018298e7bd4c6ba57ede9bd447603a078d7f32415925a6f60316508cd65aec8152ea0851821a5e9f306c31556f8b9d1997d8135080beb2a518e8944f547d6b89ca5a66508c9f1d4609ceaee0f4f2df85cac13f8bcbae5b1b28b1bb9beb2dadcf9b1900239670bb360d1f7ff155c27beb48162bd407c148f5bcecbda471160ad0c206e1ab4c74ce545e69eab1bd8f39f6fd138d5d3d75e1ac0cc6ff9da4601cee0b43cb516ba9b5468d392811851dceb8b538a532a595fb4c668ef39f8e9a6ea27420b2b4dc412afd1e91d149fe4b1c8224b4e148d990b9e5a70202aed37beb6fff679928eb5e4a9c7dab3a43ed30efbeb42b6014f3ff7d2832f5c4c5408701d6dff6c7114417fe3e4da7fe146a14dba2aceb1677a110ef1196122df112453a1c1cdbc2dfa293ba65126e25891f5a1e8de5cfb8c18dc2f75837ff39ec5ace9021667fde13f9d543199b01338eddc82d5ee57d480376fc548ef8ed0845a66396d60f42a822d5e43be41e47c8c5961fc2dd33678d3f15e805f97f9f7e1a67b8a2fe70f418ded8078dd9c1368475fce3d81e336031d7a3e74931bba8b8b80abf1f623f4719ec41ce860c42f28aa44029cbb1b69bc7ce335777b4cdc7814f3480fd4281c57a72e663c2e34bfd9ae2a12c8e9ed9cabcc081d650ffc52aefbb10620bf8408fbf648840019a1a6b7656fe30253cd05a5b934de6037130161a2a045296e9336c7f12b7bf2e7b3ebfc0f476a1e1e4b2111afeaa05a460a9d84f6b79033c1fae23b65490455d95204c45d23d84cfb3a6984d916bd874b8a4342f7a6839fe56ad9d4aebe7c58ab264d5225cafebd632cc5a41afc086c618fa08461a054b1e50d2d40554f6bbe38d099f899171969e8974ef6d217e90d063f5854cf4d14a1518010f323f0596daf60225db8dce8de83b7b9fc889cf301b494865e500cb5fab0febbce9fffc073a1bf235c34e44c71d1c7375c4e4a6efb3b6789523143110c313ca11e15089cd429a7b059cdc621ec20be865e51f0c0c9a539f871a00e8014f679c32b35cc946d134b81410f9ca6b4a4d1a03659ef693ae91af5f40b922aad5bcf238337a3186c72ec7d7e9f49bf7595ce351c374303ba82f6140066dbdb713032ee64925af1a1ba36ce97e55121e84abd525e300ac7bb3ec031b42e7aa289e8d18f2c7d74b23393ea0abc3c5d1e2d66446ed84c8b5c7dbb1863e42f6626b708e91e8f4bb7454bdd7de70107b720ea2fd6585475cdb33350d9178463437e48e4f9b353057beb000a2557458f63d4179238bf28f2e0ef2545612b0e7e895eefb0715fe5dca032e9f0c69d235f5bfc86bfbde1a2fb5e896117b6412511375620bc0d9a5a52d28d6bf054079093672d136a4a4e24ac4930bc80be39f07b700ed47600e5e258558bcf04476b59da329892db70fa8d46f9a5fdbf0e7d3a32b2f7819427486b6aa77741f1b08331661e3d78c9294360b4df4013aa64bade84d8526941435842381259708ed6b05892ca6001e8c3f2a95035750e35d0ec8cad9fab977061d86d530c57818f37c94978fb1a51cff91731273347681a489f424ebb0dee0ec83765a0ccec9a8258a5bd89a32b47b4576e29f716e9bee1a7ecdc6771a28673afe4ceca4d354119c913bd8ac4a97ac43a666acecfdd41a615af9fc2abcd8f47ff35c337317610efc619eb3a391e87bfe18a721cf39e7c57e78467237d7c1cf4316221cbaa71c778da7d0831a1bd5c1142f92d9d325da962d4772be7958e83576c95150baeb88adaf9184b23868ad1ebb2e7a9051b549afee519dca76e7d3ba1d0e66430a129091a82db0436c025cbfcd74fb839ac7eb538b709a64bd1468c9cd79b8b4338115e64f1a097bc524f57e1990c913ae87e8173133be67b6c58cdc913c37e394651daa9e519e1ce409ef86504ffc850490cae8b498f21a6784fa84d375443483812272a35decc7ec6b807ca3126521f0fc11fa2df6dde6dbb4ae6962a01a4d08fe78f1d243e73d5b272c863681b8d9b727cead04cfb6652b74166429147837d9d38ebc51f2f83c339793c1b9f3567df34683290de24fbf7b357b5cfb8db15f05ed1acb10820b9d9b24e36330c0337c394a8491494c4ab9cd877af60ff24c1f107efcfba8a140b3d9e6de66f995b0b0c550934a129ae045544a21b6e89e42437a4df641d15a24ac9a8cd987a2ad9a8df1fa333caf87f9c8b402f9a4a474a079cb2d78ef89c22e497a5a7dabf539bc17af6f516fb3c3302cf8cc5776318b31cb859dc696a2702c18505af6796f35dbcf6cee29f17e409546db7b7546f6d10947093d6ae0bec924623261c3e49420826bb73f3b6d7d423eb1b0f6569eced0ff1637d54db5c968b71c6ee9e7aeca25047ac769cc072b5dfc65fcee22378553e98c9f2282d8fc8bec44ad5d85f636021d98dc9709d8d384a0621a65cb20eb7a09175325d641c15b3234c758120063a46e065fc96f4100e8f9543583a58784c69f6424ff4bed69d893c08b1e19121691932d09f6ed15e9bd277e13ed2a14ba99d82b2cfcb3568de59e9fbe932ab7ef6446f804ce42b693c36aa04e85749eef29761e5f4562cdf284555844409bb277e39eb0ac7ae9892f0cb8eb94abf7f296bcc6a4ee5fee74eda72b26c8040bf7277289c1887e19b37611eb8e62727949012d132d953559f4fb050d716777ee8510a363214101f2401b4754dacbbce9d8a4f4e39b79397cbe376d218c8620ae1ceaa0b74f7a2cfc184ac660ae15aa11a4b2659662152fac731f47deaa8f93def96477ea22326667d165c4e6015b630c19c46e83e70b7782cc93f47a380a3aa412915314db98ff3a9135bf646c8dceb9b77e74415e86f57704a66005bd4c0d93e2e9514244bf5e7767f0d68ee2b112148ca1b1d4c6357391d79046bb3f576838dd6c5667bd69ef2e05ab580d2b5867d6df09062b1623fc0f41cf482353f7c6922debd93be9b9dcdc8cf9434d1882346e570f7dba5a45fbeef5a8d4927fe4d7532bff7f2360789f1290b4a3e6e9907d091b4061c9c87a1c46d4bb13d60519b0a70211acfb84fa3fd31ebdbed10779844440f86cff0c1cb8188c7e549d44a175c2805e5474a624301405ca8b5969963f6ef956da0f0c4b8eefd2a9cd9eaf1825540eea76eae03337701581d0ca366b2a4a8fb6b8c3f52f5858a2ca6d3bcfec005c3183b634810735a0f6e470dce8d9da8b96ddb8f86a67a39a70d955a37918f81499016af8f44b73a26683674457d206905df84cde6f859aa24ff1c95a23047c79da4eda1e52951c90059c80896b0885e79ae7bf7e0351b707f62d4c7b40b5ea9038563242ead18b7cbe64ccb07984c9e9fd8e822c5bea73e80d25cf99301df72d341892c709454f16c115068f93d7b036de7922cd996fcd5a67f69be99c7e16af06065dc6876167833c9ede293b7d9582266b12f360dbc3a8686a6b47989c717c8d8589ff99195e7f186aafab1327c4c0424d0a8fc73aaee79a97a7cc9df952b1d5c06ea145d113ebf98bc9619411f56fae726e785e346e27d1ae96e58b102470a42000ea9222d58a03d014c5431701a918216e87c433a929ed7f5d37097dfa721da22466689dc5fcd6572f2e1c14421a3b9865233375622ecacda1badc94b913172289f03a895a12df94ab3608e13c2d60a702706de6c341227e5e1288e5759dce4bf687e96be18953722fe8c80902be281129de0cdf44ff1893654c367541192eddbafc71f12a1c60461c87a085ea00f64a35f84cef22126bbf1905c81d5e32dc47df07094c3a4340b9b10874a0a1872b61a600b26d516a7af040451e3027b0592b7299538362366bf0a064c2c4ec067bb4d2e0dc46314e8e13cf78460e84b2ab294ab0b5db4a0186f9423ce6d8a70e22493d4538fd68b48b1ffe29f07d5e34a597830827d4c3d63bb6ee0b9e554d898624ebd81266d1c93fec58153c0881c9b6a4f1df10c4111ec26d8b849096c5945d427fc3a918ed7a650907e0ef50ce646c11819a90cbf32c1d6abe1591d26dbd93773ea20ac7f037a6cd62c87cd0bee1d15fbe7f18f8a829ee91267b432b09b40bd7b93a2aed3f8e59d9c1ebc92e6ba99da540d0f87bfa088c976df1dafdcaaf2ccc747f2c8f14b277d23abf2e0fcc8e48ba16f37e352fc65ef294f77da9d6c8fe88d1e59c23ac76c95cba97f29a890becd784b9f1c97f368e71d3ae696fcf5ca48f3ffa6f6297caea69bbc158e67debd10315d960ad09f3c9df7d367efd0c3e086a33883abddbda1636add0b8d16328f22595f915f1c05d766b68cd5017763afe39836623bb42618ffbcacda10fca203ce60fecb779a282cc3e35f5cea39092acc5f58300c20d13aebe76f9d47d29d4ce2081a9f2d93d4d749f051d206e5d44833515f014798a4d41e00f053f22e435148e91abe57d39619b61c3bfd2730650e5c9139eccfba965f36704a4f24bda33d2f4ff034434eec035e74e99e3aa117c3359b217261a254c50f544209076643c740e44284598809cd52554617db667b3339c8424dafcaf6b10269f8c9548a9ec05e9f6fbca2f59c2ddb8f6cca9a2820872a9ef0f122d8af0381919e4bfd290795d0dd5c9ba9c9cb582c22b007f088ce8522f5db7ecfa6e2237a307b14c10bd074ae9a7377c03672ccc5cf1d9c5baa9e4b39fba6ecba8c1b51b3d2e24f277c4d3cde2b5651ffa524c562e4e0b0607768f46c2505a0f5d6c6bf92b94cdc5864bd4d11a4f274001bbc7c7793bafcadd81f9422dc7123aa683402c8598f1dadc571b8f4ae971caf143f2418f2e07df0beebe2f40a7379dd9f0b0ca21b0c814669db768174f402824bc02d6206629abf2728bdae843bb26588ba4f42c5c6fe479084b28e220cd99ee0552b59ac168eeb1948776d31e48a0eeb07cd08f629c1492af6e304346369d5a140f13696bdf242cc57ea9c66f6ddf3f926398c89b782f3ab9c8fc0a21a9026ec029482d2892562e6728f4dc272b8d3d5a7483dead57f34c1927635398a84eec66faf227785d31d72127ca81713e2b6bd5752edf23dcd2f6be74884441f4d9dc464e03919adcc201e8316efaf2e488e82900a80b71ca1fc19a8dab4d95667e4f2d3ca8da770cc445ac2b8cb05efe24060f7fe5084e1bbe2a563042ef4b6edcdc462035ba31e84cbc0f3021dfee90ca78c4acbf46a3ec15312171494e558c51d56b8976c26a668d1d488bbe1280283f12c63ef3be148c38c204ff8aed77aead4d5cac3077d2ed454cbf03ccd675fd5006d9593edd68ff013c674e4169fdad21b938bd952efb4f13c2d1ab30db54ad55ce92743ea57dd8202dc3c1e2647832c5578c3ad4358cf37dd01522e3de358a16268ccf19eea0f55378b2596a9012496fce0475b962ac92d79e684c4fbc3887f23693781a9b31c65e3a2790d09fba56de41ea7a7bdf7dcc879e716e5eb61f15a1332ed64bc104516dcff6afb7679676fd329d77ef24eb1c91628025bc24001f7ea543a706418bf9a9c40c9df6c8b8632289efd17b70846e0acd5957531e01d43b0338df9d9414042bb4700abf1efef4e8b699e254b80e580009ae9247a2230a2ad5aecd5989c4014a4e45eb7c1c7090872674ef7edaf5a38eebf41e0bc917c5b3d215266a8ea8449d2a0dc840e83b7e1d28475e165bda6dece67683d363255447c415427ca66cc867332c888a52672190ee3cdefe9a55da83168f7d72fbee804d37695f6462c05a9090eede29499e915625ed99154da68806b963b3dcf6834b114925691fa293f5674a0498684045dd0cb071cb0daf49e557fcb2bb268a4da75d99d0f86f38cce76c2204cc961514f13af0a42e253f3cf1f04320316b59e1b11b16f0d930041cb9202e21a50f4fab2cb3bf35d682675dbf21c508b378748cbc422bca98cc777eb617ab0306af768ccd551d49807ac6937cfa740141fcadd448a2e3c71a9ba7c50d49d5d31281f8881c97e06a3e572ad4a1389bb21731230ed55e225fc4d84ce1cf61d357708ebddb518def97ed92db88a57fb4cdcc2698626703f1807bb5c019f713cd56247cd9de2a90ca80f802d9b73e3fdf55ede5dbc072953af560bcc542580ed663e3f10970fbe8d3dcaba0650c72da430faac7afd05964185d1a319ab86dfccb7507bf534c047b1059f6aa3db50328b69fefbd58b8d3d19d5be859732717fc59edb68b9b1ba500c3f12487935ab61f93c2efd9a1680d8b04f9c5a8213ef8b6a9b139ba23cbd39da287be88c98386e030f293343d94ebfb2c0587d2615d8088ab1193fcf0b15f7c313d10a7f73c04e82ca8c28888fda26b3d3a80145db0db4fefab54cf4d5b52050c5fc2a2d212c52634c1760bbb31b203675b1341fa8def79f23c2645411a6ca1936cc62b79f4a8de023ea2eb287b09d9638fac3718bed52b0ecd1ce2a8382d0ade43d08230aac937146cfddec8d7329c0cc7bafaac12bf430741c36596d7b64eef081c4421d6d54128e1be0638bd85a6349f000ad4e83ecd61eb57cda7c391fa54a265739ab927356e1a2135bf25f304b914c83e87a1fee3884d2cd374f12b5ed1ca5790857cc4bbcc8f1087f4517fb605403ac7de1d6830b4b49271668dca9cfc9169959a6b2c782c1f5db080ca19e013ac99592d690d90c5be986072b705dcb583e1ea8300f1fa67c2cc5fcc3857b5bd856499279357b340def18a8c6d05a52d546d8f3b6727634998e610e08f695a6e20bb756d636db2a2e719ff80ea03e88aee9208741d0e242b2096fc417a9b2beab03d93f30717458b034d2bd2eaed668754bf959e0ecfe98e17ec88de7eb2ad3ddd37845f736183b7d3b5bee00a0f784f0864dae6d092e1fe8af993c108928fd679b27a5f3b043e84a1fb5dd23f14b47b5d65ae7e127eed1763b39cf7127c4edfa9161810c013c999bb8a3a49ffc34e2f3cad2c9989f660c5846180443560de3181a5bd2679477edfb92da913cc67c845ea42b87a117243479add7b27dc743172481072fc0847829075a4ffa8e1779c016519afd7591030d85f9b9605f481895fa43b1a8ff73bdbbdb8862b178ddf8969a70d14419af5b6fa871feab87c4f808b68f13ce1ad05444137266619827ca199b37ba4c7a8c80ec46b7d2a4d9b390a94967abeaaba0608a5edad8c419e17977dd96625adcb7bc9cb92ad2e6fcddb1334cec48960a185682f133fec1040f3f1b0e93180da657792b1134e038658710c249a3981a4c781cbeb6ca000585fb242836a099fec8707d836678e8f7495ebbc296874c0a9409b00776303228ad61bd5b997d7229cf4780e528d5ac69401316c9638f163a15bdad8694e628406112d4a9e5f277ab88b23cb7c68bcc688381d1b659953534f26a589244b3872459577a6522364d86e864a32d85fa99a44ec146d1ad6923a6fb7a796760f31b2e28d584ab813f0e0ae8b5e6e5ec7e7ec93d469d8090ef4467190b68ac7f0c8cd986962efdd0808a7390469b6276b7258d16d883879240f8e598fd8ff5f0badea9775fb31a932e232dfb212c223a27322758c1908703881b384576158e28bf2e0afdc7a59504b146f31936e4633555bb63c7033746d602f3b87f201aa5d064848777271d8035b2dd1523f41ce7f219aab232bb5fb5e1632f47c3221360cd090d35b0c7bb84a069439d0f27727117e8a59d06d348051a746f2432e129f60b66dbc82089d54e5bc064a7629d666303afb1f732689f7e74a7457a01655a50c18a2bd32d9573f861343be4693d7a3bb1f4001ef0713e8dfee0f45f254e10349c416207199bd38f9fb8763fc39f323cc0a4c45fa1046da746f0ccab220f5dd456220cf4698f3c38d701b1eb2ccc6f8b394c29df366f6050f3bee46b9a4bc5a2a8ee50fa860fe5a9b947bde6b1ae6a1bc94be707d72866e9da7f9c84e42348fd8919b75f70a43e1e9810f5b5c93f9b7c2ac661d8b6bd97976a71cbf00c7ee2b36b5385a270d268e3a168343b852345eab5fde4fcb902f47b87f3b1f840d57a5afbc92fbb737e6201ff5102f8ad71fa86b92798adb25daf49733ddf5da69c940d962bb9f714868a40ed2318c7b3dcf918f9c008144e521a1b939306b6e2ef7d478f7746a434722086533484651c4a69b5956f3ec0c4da8fe96e0669548125ae6382f23bc0a83ae7af31c7271ed1dd2b7c792026772411d5deabacee58ce335f7f368cc1342b70a933c2871fc71a07a6bd181e132a674d31736d6bb2cba7c35f491001b32bb4ce9a157f40f696cbcca1bf5de9ce95042f7088a3fd35ff777065d9f9ad09860784a990f7d2fd2fcd2b30ef219ae3cdb8e92fb843c64abe619db490d19230a1fea6b851fc079265eccce108402512a0ba02cf0fc0f3e64d0aae5bee23aaa53dae89ca0d86c930520bfbfd20873b0b79e08e0e405a5592947cbb7808b340b7889530a3819c21071d8ccbe1a60c8ec30049a4552ca4b0e790edb73337ae152883141cf198660d45e69cd12ed571753ba639c1e8c3889c41eac7179c5e574d9d95e78a2923fb576b0635b47f5b615a0e492c806d42884c2fdf477f2ee6b2b2a9d281dc3ff11563b6f86b697a8494f9ac3ba90e8ac4f8b9cc1e5d41938be45a368f126a6d1fda03d60a3d622dc75e776be4e90c2d2c6e6d6a009505e345fe949e1310334fcb0747f28dae2856759de102ab66b722cb490c3b6a0d586bb9dfc845b236cd88877065f84483e3bea2153b4b831c34c3055a449d1cc40adc7e874d81fae1ab82c35ce2a0a84cae7141a582eca2b26e94fce81b0f8d115921fdaeee8ed6c5f2f8ba09da74658bc3f1cabeccfc908a891b04354b2d9bafdf8fea757bab853b1cac4c7df00b2256460e95c7193a028e1917dce5a517d0766fad40dd7abb8dfc75b687bf505cea3bf4a099a14f67ed23b18b15d94ab6def9ab2eafab299f858750ada144f1ad8aa9e42828bbe7dd063003eee8189bda802c3e35623236807dc79ef77f294376add03f2970d4fa96ea0fdd4fa12235fe0f36703db6976777df545a48790a918cb27dc48e3017e5baae6c4a0917794cb58892c0b0361499056ffefb9a7a4a3de3b3044d3618f9c277719126154309e80944c93f907bff96183db70e139d0887c167d4ed6047f8c24a4e703ec34feb912fcc11dd1f8b605914b19fd67e4bf66a19b57b1785b1b0664b81a6cd2946d6d975091465cef959e073fb2ebed32d043b06727f31d316ff152731ab8d7b39d0cb8b225676c8487997f15132b44256786f2b0cb73950832080a884d31c1a66b6afa1792e427bac44a074273293fb9a1c9f7eafb75ceec91121930cf0e5e58ee17eb0afb848744651f08d895e5ea0eea2ec6e692cd11e988fd8ceb24c996fc3fe2244f9a8c0a9e09b39ea53083ba528ddb4c7d4366aead52621621b03d9c037bb0e302a80bc4bd241b4c28ed1fe72a0e4738e9c2da636b9bda1be63f446cea1e158a6010210a214b120e06fd3e478982c43f588917d1d0fbd902af162b0d096b8d0de22cfe0d0e9e28f8defb07ed3ea9566aa218619912817b9c48f2876de538f9e8914d01ed80e90541a91004b6b5cb86dc9855fc5930f1580a7878088be094b0146a1cd7b177d7b250c265e27a65b154e24f193a7ef85682f7ebc62a0bbe64aea8322d23b9784eb36af0b639c9738ad35cd71f5cb79b3acea344a48ae19f0321a8f2c8863fdc7c7efb652cd25eb62a3120ebe02c0450c30735b839c813427a20da414c79a46a3304f60b896a6b3da0bb0b63c590d16593e70f0e13cc70b7bb6cbb927fa47699e24841fb7c297355fd24f40c835d42c2fe873f8eec453cf784f32af74f6596f6f832397eab7f15c793af1a06a2dfed2910533b65a78a78a422cee268c7c30e91e3b88333dc55b86c9c472d007f86d5762f6f461117dca84de98d76fbf811c4179dfd9775d3aa635e005f4d8fa251cdd4c8b50987f5eb15bf1653b6cb7dab9742ddf9b1faaebf1ceadf760731dcb3e3028f9e89c156fad6cdc22f91501b7eb343884cd47243de731000d4628ec0620458e4bd2226e25fc922e8e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855mods-config/preprocess/hintsmods-config/preprocess/huntgroups../mods-available/always../mods-available/attr_filter../mods-available/cache_eap../mods-available/chap../mods-available/date../mods-available/detail../mods-available/detail.log../mods-available/digest../mods-available/dynamic_clients../mods-available/eap../mods-available/echo../mods-available/exec../mods-available/expiration../mods-available/expr../mods-available/files../mods-available/linelog../mods-available/logintime../mods-available/mschap../mods-available/ntlm_auth../mods-available/pap../mods-available/passwd../mods-available/preprocess../mods-available/radutmp../mods-available/realm../mods-available/replicate../mods-available/soh../mods-available/sradutmp../mods-available/unix../mods-available/unpack../mods-available/utf8../sites-available/default../sites-available/inner-tunnelmods-config/files/authorizeservice  @rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootradiusdrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootradiusdradiusdradiusdradiusdradiusdrootrootradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootradiusdradiusdrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootradiusdradiusdradiusdradiusdradiusdfreeradius-server-3.0.21-lp152.2.9.1.src.rpmconfig(freeradius-server)freeradiusfreeradius-serverfreeradius-server(armv7hl-32)radiusd @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@     /bin/sh/bin/sh/bin/sh/bin/sh/bin/sh/usr/bin/perlconfig(freeradius-server)coreutilsfreeradius-server-libsld-linux-armhf.so.3ld-linux-armhf.so.3(GLIBC_2.4)libc.so.6libc.so.6(GLIBC_2.4)libcrypt.so.1libcrypt.so.1(GLIBC_2.4)libcrypto.so.1.1libcrypto.so.1.1(OPENSSL_1_1_0)libct.so.4libdl.so.2libdl.so.2(GLIBC_2.4)libfreeradius-dhcp.solibfreeradius-eap.solibfreeradius-radius.solibfreeradius-server.solibgcc_s.so.1libgcc_s.so.1(GCC_3.5)libgdbm.so.4libmemcached.so.11libodbc.so.2libpam.so.0libpam.so.0(LIBPAM_1.0)libpthread.so.0libpthread.so.0(GLIBC_2.4)libssl.so.1.1libssl.so.1.1(OPENSSL_1_1_0)libssl.so.1.1(OPENSSL_1_1_1)libtalloc.so.2libtalloc.so.2(TALLOC_2.0.2)libwbclient.so.0libwbclient.so.0(WBCLIENT_0.12)libwbclient.so.0(WBCLIENT_0.9)opensslperlperlpwdutilsrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PartialHardlinkSets)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)systemdsystemdsystemdsystemd3.0.21-lp152.2.9.13.0.215.26.13.0.4-14.6.0-14.0.4-14.0-15.2-1icradiusradiusd-cistronradiusd-livingston4.14.1`@_@_FN^y@^p^h^@\\v{\u*@[<[2*ZZWQYY@YlY, @XO@X@X*Xh@X.@W@WiV@V.Vf@UĝU@U@UU8U7@TZ@TTT~@T|X@Adam Majer Adam Majer Adam Majer Adam Majer Adam Majer Adam Majer Johannes Engel Michael Ströder adam.majer@suse.deMichael Ströder adam.majer@suse.demichael@stroeder.commichael@stroeder.commichael@stroeder.comadam.majer@suse.devarkoly@suse.commichael@stroeder.comadam.majer@suse.demichael@stroeder.comkukuk@suse.deadam.majer@suse.dejengelh@inai.deadam.majer@suse.demichael@stroeder.comadam.majer@suse.demichael@stroeder.comjkeil@suse.demichael@stroeder.comjkeil@suse.dejkeil@suse.dejkeil@suse.demichael@stroeder.comvcizek@suse.commichael@stroeder.comtchvatal@suse.comvcizek@suse.comdimstar@opensuse.orgvcizek@suse.commeissner@suse.com- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)- freeradius-server-radiusd-logrotate.patch: move logrotate options into specific parts for each log as "global" options will persist past and clobber global options in the main logrotate config (bsc#1180525)- freeradius-server-radiusd-logrotate.patch: fix permissions in logrotate global section (bsc#1170505, bsc#1174905)- update to 3.0.21 (jsc#SLE-11896) Feature Improvements * New stored procedure for allocating IPs with PostgreSQL Rates of 1500 IPs per second are now possible See raddb/mods-config/sql/ippool/postgresql/procedure.sql * Add SQL IP pool support for Microsoft SQL Server See raddb/mods-config/sql/ippool/mssql/ * Added RCNTEC dictionary. Closes #3168. * Added Pica8 dictionary. Closes #3179. * Add TLS-Client-Cert-Valid-Since attribute holding not Before date Patch from Boris Lytochkin. Fixes #3157. * Generate attributes containing unknown OIDs See raddb/sites-available/tls * Update the WiMAX dictionary. * Added ability to rlm_python(Python2) show a stacktrace from errors. #2979. * Add WiFi Alliance Policy OIDs. See raddb/certs/xpextensions * radmin now shows coa stats, too. * Sample schema extensions for summarizing data in SQL See mods-config/sql/main/*/process-radacct.sql * Update dictionary.aerohive, dictionary.fortinet, dictionary.arista and dictionary.erx. * Added VAS Experts dictionary. * Many updates to RPM and jenkins builds from Matthew Newton. * Added %C (time now in seconds) and %c (microsecond component of now) back-ported from the "master" branch. * Add reload capability to systemd unit file in Debian and RedHat. * Increase timestamp precision in postauth to maximum supported by each database and simplify (and make more consistent between drivers) the timestamps in SQL queries by using expansions. * Option to set dictionary path in raduat script. Bug Fixes * Various fixes found by PVS-Studio. * Set permissions of certificates in bootstrap shell script Fixes #3132. * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141. * Skip processing proxy reply if there are no home servers available. * Update SQLite IPPool queries. Fixes #3177 * rlm_sql_unixodbc fixes. Fixes #2822. * Fixes when building with LibreSSL. * Fix the rlm_python3 build. Note that this module is experimental. #3183. * The rlm_python should append the 'python_path' paths in 'sys.path'. It fixes the expected behavior to use the existing Python modules Fixes #3180. * Fix rlm_python to print the script errors properly. * Bound total query time for PostgreSQL. Fixes #3253. * Many fixes to Oracle sqlippool. It now does 500 IPs per second without any tuning. Fixes #3270. * Reference sqlippool by it's correct name. Fixes #3272. * Revert 3.0.20 patch which caused crashes on duplicate clients. * Update WiMAX-MSK attribute. Fixes #3280. * Fix crash when trying to access non-existant regex capture group. * Use timestamps (request or server) rather than SQL NOW() in accounting queries so that these are stable when replayed from a file buffer. - freeradius-python3_patches.patch: upstreamed- update to 3.0.20 (bsc#1146848) Feature Improvements * Added Force10 dictionary. * Update dictionary.hp with new attributes. #2690. * Update dictionary.aruba with new attributes. #2696. * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456) * Relax OpenSSL version checks, now that their API is both public, and stable. * Note that tls_min_version/tls_max_version also support "1.3" Since there is no standard yet for EAP with TLS 1.3, it will not work. * Added tripplite dictionary from #2760. * Switch to the async interface for rlm_sql_postgresql so that we can enforce query_timeout. * Added new LDAP option 'allow_dangling_group_ref'. * Updated documentation and functionality for EAP session caching See "cache" section of mods-available/eap. * Tighten systemd unit file security. Fixes #2637. * Disable TLS 1.0 and TLS 1.1 support in the default configuration We STRONGLY recommend doing this for all installations. * Add expansions for *outgoing* Radsec connections "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and TLS-Cert-* attributes. Fixes #2839. * Add %{listen:tls} which returns "yes" or "no" for TLS or non-TLS connections. * Update dictionary.lancom with new attributes. #2847. * Added rlm_sql_mongo. See raddb/mods-available/sql. Note that this module is experimental. * Added more documentation in sites-available/robust-proxy-accounting. * sqlippool now re-allocates unexpired leases, to prevent IP pool exhaustion when clients perform multiple reauthentication attempts * Add support to radmin keep the history in ~/.radmin_history. * Add support for ENV and LD_PRELOAD in radiusd.conf. See the new ENV sub-section of radiusd.conf. * Update dictionary.aptilo. #3002. * Update dictionary.airespace. #3039. * Add sites-available/coa-relay, which makes CoA easier #3045. * Add example stored procedure for IP Pools in MySQL See mods-config/sql/ippool/mysql/procedure.sql * Update dictionary.dhcp dictionary with the recent hardware types. * Add experimental rlm_python3. This should largely work the same as rlm_python, which was Python2 only. * Add Dockerfiles for Debian10 and CentOS8. * Add RPM spec file compatibility for RHEL/CentOS 8. * Notes on certificate constraints. See raddb/certs/server.cnf. * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585. Bug Fixes * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627 * ERX-Acct-Request-Reason is "integer". Closes #2635. * Fix a slow memory leak in the file management code. * Try to fix file permissions if they get modified while the server is running * Fix slow memory leak with clients. * Fix request and connection timeouts in rlm_rest. * Fix systemd issues. * Fixes from clang analyzer. * Fix missing include for the dictionaries: alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn, audiocodes,avaya,bristol, columbia_university,freedhcp,garderos, infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus. * Fix internal sanity check when running with "-Xx". * Allow "inner-tunnel" virtual servers to work better with "accept" and "reject" policies. * Fix dictionary.huawei data types for Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address. * Framed-Interface-ID in postgresql/queries.conf is string, not inet Fixes #2817. * Fix rlm_cache to complain on unknown attributes in the "update" section of its configuration. * Add configure checks for -latomic. This helps on armel, mips and mipsel. Fixes #2828. * Add support to Oracle 19 and 18. Via #2857. * Add support for decoding tags in rlm_rest. Fixes #2848. * Use correct passwords when updating CRLs in raddb/certs/. * Properly separate "originate-coa" packets when accounting packets are read from the detail file reader. * Use the correct virtual server for pre/post-proxy. * radsqlrelay fixes backported from "master" branch * Fix DoS issues due to multithreaded BN_CTX access (bsc#1166847, CVE-2019-17185) - disable python2 for SLE15 and Factory - freeradius-server-enable-python3.patch: enable Python3 module - freeradius-python3_patches.patch: backport python3 fixes from upstream - freeradius-server-opensslversion.patch: updated- Enable memcached driver on SLE15- Add missing BuildRequire on samba-core-devel required for windbind support in rlm_mschap.- update to 3.0.19 (jira#SLE-5890) Feature improvements * Update dictionary.cisco * Update sqlippool to allow for stored procedures with PostgreSQL. This increases performance substantially. Patch from Nathan Ward. Fixes #2540. * Re-added "show client config" command to radmin. * Cleaned up mods-available/sql example so that it is easier to understand. * Added pfSense dictionary. Closes #2581 * Update dictionary.h3c Closes #2592 * Update elasticsearch/logstash config for v6.7.0. * EAP-PWD security fixes from Mathy Vanhoef. See http://freeradius.org/security/ (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664) Bug fixes * Update dynamic_client module and server core so that the functionality works. This has been broken since at least v2. * Fix crash in sqlippool due to escaping changes. Patch from Nathan Ward. Fixes #2532, #2533. * Fix systemd notify, watchdog and unit files. Fixes #2541, #2499. * Fix erroneous length check in EAP-FAST. * Update documentation to remove old "ignore_null" configuration. Fixes #2578. * Fix default POD port. Should be 3799. Fixes #2591 * Correctly encode vendor-specific "encrypted" attributes. Fixes #2600- reformat changelog mostly by wrapping lines - add missing bug numbers for security fixes- update to 3.0.18 * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss. * Do-Not-Respond policies can now be set in the "post-auth" section. * Encode / Decode ADSL Forum DHCP options. * Fix module ordering issues. e.g. when "sqlippool" needs "sql". See the "instantiate" section of radiusd.conf. * Add Big Switch dictionary. Fixes #2252. * Add sql_session_start policy (raddb/policy.d/accounting) This minimizes race conditions when using Simultaneous-Use (#2257). * For rlm_perl, all variables are now tainted by default. See raddb/mods-available/perl, and the "perl_flags" configuration item. This change should only affect people who are using variables in insecure ways. * Allow "sqlcounter" module to be listed in "post-auth". * Add support for IPv6 attributes in SQL. Fixes #2280 * The server is better at handling fail-over for outbound RadSec and TCP connections. Fixes #2284. * The server is now more aggressive about retrying failed outbound RadSec and TCP connections. Fixes #2284. * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list. * Add expansion for Radsec connections. "%{listen:TLS-...}" for TLS-Client-Cert-* and TLS-Cert-* attributes. * Add notes on running "ldapsearch" using the parameters from the LDAP module. * "ipaddr" attributes can now be cast to "integer" type attributes in an "update" section. * Move main thread queue to using atomic queues. This should help with contention in high load scenarios. * Add "recv_buff" setting to listeners. For more details, see sites-available/default. * The sqlippool module can now use attributes other than "Pool-Name" to assign IP pools. The "Pool-Name" attribute is still the default. * The "unpack" expansion can now unpack substrings. See mods-available/unpack for documentation and examples. * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE. * Allow for -LDAP-UserDN. See mods-available/ldap for more information. * Add sanitizing of control list for moonshot. Fixes #2318. * Update rlm_sql_mysql to be compatible with MySQL 8 Fixes https://bugs.launchpad.net/bugs/1795310. * Allow logging of only Access-Accept or Access-Reject messages See radiusd.conf, "auth_accept" and "auth_reject". * Removed Connect-Rate comparison. It was unused and broken. * Add dictionary.infinera. * Use OpenSSL HMAC functions instead of local ones. * Some SQL modules can now use "auto_escape" to escape unsafe strings See mods-config/sql/main/mysql/queries.conf. * Add wispr2date conversion in mods-available/date. * Implement dictionary-based handling in rlm_python. Fixes #2334 See mods-available/python for details. * Add support for SKIP LOCKED in sqlippool. This can improve performance by an order of magnitude or more. See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383 * Allow PSK and certificates at the same time Except for TLS 1.3 which does not support that. * Update docker scripts. Fixes #2306 Patch from Matthew Newton. * Add crypt xlat. * MySQL connections can now skip verifying the server certificate. Fixes #2481. See mods-available/sql. * Add better mechanism to detect MariaDB (Old MySQL). * Add RFC 7532 "bang path" support for realms Fixes #2492. * Update dictionary.ukerna documentation. Fixes #2493. * Add support for systemd service and watchdogs Fixes #2499. * Check for openss/rand.h, and allow building without OpenSSL engine. Patch from Eneas U de Queiroz Fixes #2517. * The default PosgtreSQL queries now use "ON CONFLICT" to better deal with issues. This requires PostgreSQL 9.5 or later. Please use a recent version of PostgreSQL, or edit the default queries to remove "ON CONFLICT". BUG FIXES * The session-state list is no longer cleaned in the inner-tunnel. This lets the outer Access-Reject section access session-state. * Fix typo in lock initialization for TLS sockets Found by Sergio NNX. * Add check for crash when home server down Fixes #2233. * Add username key for postauth table. * Better libpcap checks, when the header files or libraries are missing. Fixes #2245. * Allow building with old versions of OpenSSL Fixes #2247. * Allow non-FreeRADIUS State attributes to be used with the "session-state" list. i.e. State length != 16. * Be more aggressive about cleaning up zombie children when running in debug mode. * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries exporting LDAP API functions. * unlock files when asked to unlock them. * return error instead of asserting in map code. * Don't write 0 bytes to SSL. Fixes #2270. * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262. * Various dictionary cleanups and consistency checks Fixes #2281. * rlm_python has stronger thread locking to prevent reported issues. Performance may be affected. * Don't allow Message-Authenticator to overflow past the end of a large packet. * Fix crash in sqlippool when SQL server goes away Fixes #2300. * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303. * Fix crash with CoA packets/ Fixes #2304. * Fix crash in rlm_exec with CoA. Fixes #2328. * Print errors while parsing the log config, and don't quit when deprecated log settings are found. * Fix DHCP encoder xlat so that it can be used with a list of attributes. It previously only encoded the first member of the list, and now encodes all members. * The "expr" module now skips more whitespace. * Remove internal FreeRADIUS-Response-Delay attributes from attr_filter Access-Reject. * Don't send junk to redis when maximum args reached. * Small updates to IPv6 for accounting schema Fixes #2364. * Fix OpenDirectory integration in rlm_mschap. * Fix slow memory leak with dynamic clients. * Don't artificially truncate debug output for long strings. * Fix memory leak in EAP-PWD. * Fix crash in "hints" file with Fall-Through = yes. * Fix crash / timer issues with many CoA packets. * Fix attr_filter so that it does not treat vendor attributes of number 26 as Vendor-Specific. * Fix reconnect correctly in rlm_sql_mysql. * Fix rlm_cache to properly use Cache-TTL < 0 Fixes #2485. * Fix rare occurance of bad xlat expansion. * Check for rare race condition when a proxy reply arrives too late.- install license as %license instead of documentation- also fix ownership of /var/log/radius in systemd unit- update to 3.0.17 Feature Improvements * Add CURLOPT_CAINFO. Patch from Nicolas C #2167. * "stats home server" now supports "src IPADDR", to specify home server also by source IP. Fixes #2169. * Add Dockerfiles for a selection of common systems. * Increase number of permitted file descriptors, for systems with many home servers. * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs Patch from Isaac Boukris. Fixes #2205. * Update main READMEs. Patches from Matthew Newton. * Added dictionary.mimosa. Bug Fixes * Don't call post-proxy twice when proxying to a virtual server. Matthew Newton, #2161. * Use "raw" string value for shared secrets and dynamic clients It now parses strings with backslashes and "special characters" correctly. Fixes #2168. * Fix RuntimeDirectory for RedHat, from Alan Buxey. * Relax checks in 'if' parser from Isaac Bourkis. * Minor cleanups for %{debug_attr:&request} from Isaac Boukris. * Be more aggressive about cleaning up cached certificate attributes, due to deficiencies in OpenSSL. Reported by Nicolas Reich. * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall. * Fix double free in rlm_sql. Fixes #2180. * rlm_detail now writes empty Access-Accept packets. * rlm_python can now create tagged attributes. * Don't crash on duplicate realm + authhost / accthost * Allow partial certificate chain to trusted CA. Fixes #2162. * Treat SSL_read() returning zero as error. Fixes #2164. * detail writer now checks if the file was renamed or deleted. * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name. * RedHat Systemd updates. Fixes #2184. * Use correct API for State variable in rlm_securid. * Remove broken radclient option "-i". * Fix "users" file (and hints, etc). So that it does not get confused about entry ordering with multiple $INCLUDEs. * Fix rlm_sql to expand the un-escaped string, not the raw string. * Link default and inner-tunnel only if they exist. Fixes #2206. * Don't use both IP_PKTINFO and IP_SENDSRCADDR. * Always install signal handler for SIGINT (needed by Docker). * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs which are not self-signed will now be checked. * sqlippool now returns "fail" if it fails IP allocation. * Fix rlm_yubikey to look for correct attribute in replay attack check.- update to 3.0.16 Feature improvements * rlm_python now supports multiple lists. From #2031. * Add trust router re-keying. From #2007. * Add support for Samba / AD LDAP schema. See doc/schemas/ldap/samba/README.txt and doc/schemas/ldap/samba/ * Add "tls_min_version" and "tls_max_version" to EAP module for Debian OpenSSL issues. * Better documentation for client certificates in PEAP and TTLS: it usually doesn't work. Fixes #2068. * Distinguish login failure from AD unavailable. Fixes #2069. * Update RH spec files. Fixes #2070. * Run Post-Proxy-Type if all home servers are dead. Fixes #2072. * Print offending IP addresses when EAP sessions come from two upstream home servers, and rate-limit the messages. * Minor packaging updates. * Better documentation for rlm_rest. * EAP-FAST now has it's own "cipher_list", so that it is easier to configure. * EAP-FAST now forcibly disables TLS1.2, until such time as we implement the new keying mechanism from TLS1.2. * Add documentation for allow_expired_crl. * Update Debian logrotation. #2093 and #2101. * DHCP relay can now drop responses. #2095. * rlm_sqlippool can now assign Delegated-IPv6-Prefix. It also now can assign any IPv4 or IPv6 address. Based on patches from maximumG. #2094. See raddb/mods-available/sqlippool for changes. * radeapclient can now use EAP-SIM-Ki to dynamically create the necessary triplets. * Explain why many LDAP connections are closed. Fixes #1969. * Debian build / package issues fixed by Matthew Newton. * dictionary.patton updates from Brice Schaffner. Fixes #2137. * Added scripts to build "inner-server.pem", and updated mods-config/inner-eap and certs/README to match. * Added provisions for using an external CA. See raddb/certs/ * Include dhcpclient binary in freeradius-dhcp debian packge. Bug fixes * Bind the lifetime of program name and python path to the module FR-AD-002 (redone) * Pass correct statement length into sqlite3_prepare[_v2] FR-AD-003 (redone) * Allow 100-Continue responses with additional headers in rlm_rest. * fix corner case where detail files were not being locked correctly. * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group. Fixes #1947 * Clean up exfile code. Which should help to avoid issues with reading / writing 100's of detail files. * Fix build for winbind. Patch from Alex Clouter. * Fix checkrad for Mikrotik. Patch from Muchael Ducharme. * Fix home server stats lookup. Patch from Phil Mayers. * Add libjson-c3 as an optional dependency. * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking against NSS, which breaks the server. Fixes #2040. * rlm_python fixes. Fixes #2041 * Typos in "man" pages. Fixes #2045 * Expand "next" in %{%{...}:-%{...}}. Fixes #2048 * Don't add TLS attributes twice. Fixes #2050. * Fix memory allocation in rlm_rest. Fixes #2051. * Update trustrouter for new API. Fixes #2059. * Fix SQLite issues on FreeBSD. Fixes #2060 * Don't do debug logging of bad passwords. Fixes #2064. (bsc#1099802) * More graceful handling of "die" in rlm_perl. Fixes #2073. * Fix occasional crash when using cisco_accounting_username_bug = yes * EAP-FAST fixes from Isaac Boukris. [#2078], #2076, and #2082, #2126. * DHCP fixes, relay, #2092, add run-time check, #2028 * Decode multiple RADIUS packets at a time in highly loaded RadSec connections. Patch from Jan Tomasek. #2106. * TunnelPassword is not "single value" in LDAP schema. Fixes #2061. * sql log now opens the expanded filename, not the input one. This was a regression introduced in 3.0.15. * Remove unnecessary UNIQUE constrain in Oracle schemas. * Fix SSL thread and locking issues when modules also use SSL. Fixes #2125 and #2129. * Re-add dhcpclient "raw packet" changes. Patches from Nicolas Chaigne and Matthew Newton. Fixes #2155.- Fix permissions of radiusd.service (bnc#1053654)- bsc#1055679 - freeradius-server does not provide winbind/AD auth Added libwbclient-devel as buildrequires- update to 3.0.15 with security fixes for issues found via fuzzing by Guido Vranken (bsc#1049086) https://freeradius.org/security/fuzzer-2017.html * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret() * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63 * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax() * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp() * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions() * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly * FR-AD-002 (v3) String lifetime issues in rlm_python * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare- update to 3.0.14 (still FATE#322416) Feature improvements * Enforce TLS client certificate expiration on session resumption, and Session-Timeout. See CVE-2017-9148 (bnc#1041445) * Updated dictionary.cisco.vpn3000, dictionary.patton * Added dictionary.dellemc * Lowered the log output for failed PEAP sessions. * ALlow utc in rlm_date. * The internal OpenSSL session cache has been disabled. Please see mods-available/eap * Update detail reader documentation. * Make outgoing RadSec connections non-blocking. * Add SQL backing to Moonshot-*-TargetedId generation. Bug Fixes * radtest uses Cleartext-Password for EAP, not User-Password. * Update documentation for mods-enabled/ linking. * Enhanced checks for moonshot salt. * Allow session resumption for RadSec connections. * Update "huntgroups" file to note that port ranges are not supported * Fix OpenSSL permissions issues on default key files. * Certificates are not required when PSK is used. * Allow SubjectAltName as first extension in cert. * Fixed talloc issue with TLS session resumption. * "&Attr-26 := 0x01" now produces useful error messages. * Handle connection error in rlm_ldap_cacheable_groupobj. * Fix endian issues in DHCP. * Multiple minor fixes for Coverity complaints. * Handle unexpected regex. * Fix minor issues in dictionaries. * Fix typos and grammar. Patches from Alan Buxey. * Fix erroneous VP creation in rlm_preproces. * Fix MIB. Patch from Jeff Gehlbach. * Trust router updates from Alejandro Perez. * Allow build with LibreSSL. * Use correct packet for channel bindings. * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us a test license. Please see the git commit history for more info. * Fix incorrect length check in EAP-PWD. This may be exploitable. * Stop rotating session database files (radutmp, radwtmp) since these are not logfiles. - freeradius-server-radiusd-logrotate.patch: updated- removed obsolete freeradius-server-fix-cert-bootstrap.patch because recent /etc/raddb/certs/bootstrap simply works - update to 3.0.13 (still FATE#322416) Feature improvements * Add dictionary.rfc7930. Note that we do not implement the RFC. * Added 'cipher_server_preference' to mods-available/eap Patch from #1797. * OpenSSL 1.1.0 compatibility fixes. * rlm_perl: radiusd::xlat to evaluate xlat string within perl script * Allow authentication retry in winbind. Patch from Herwin Weststrate. See raddb/mods-available/mschap. * Added "recv-coa" method to rlm_rest. It behaves the same as "authorize". * Document Trust Router tr_port option. Patch from Stefan Paetow. * Update elasticsearch/logstash examples so that they work with elastic stack v5. Patch from Matthew Newton. * Print information about packets, replies, and contents in the detail file reader. * Update abfab-tr policy. Pull request #1893 from Stefan Paetow. * Reject packets which contain User-Password and EAP-Message. * Add example for filtering Access-Challenge. See sites-enabled/default. * Pull symlink fixes from v4.0.x. Fixes #1859. * Add systemd reload. Not everything is reloaded, but some is. Fixes #1662. * Better documentation for listen "ipaddr". Fixes #1921 * Add dictionary.cnergee, updated dictionary.nomadix. * radclient no longer needs -x to print statistics with -s. Bug fixes * Minor typos. Fixes #1763 * Fix typo in RPM build. Closes #1767. * rlm_mschap check for password expiry only if password was correct. Fixes #1762. * Update debian build. * update rlm_counter "man" page. Fixes #1775. * Remove erroneous assert. Fixes #1778. * fix mschap password change test. Fixes #1792. * Cleanup config file on data remove. Fixes #1795. * passwd module returns "notfound" if not found. * Check for old OpenSSL, and don't build rlm_eap_fast if it necessary. Fixes #1803 * Cleanup memory better after ldap version query. Patch from Aleksey Katargin. * Rename lt_* functions to avoid linker issues with libtool. Fixes #1277 * Many miscellaneous fixes and typos. * Allow long strings in %{%{foo} bar:-%{baz} blah". Fixes #1866 * Fix filtering operators, along with more documentation and more tests for them. * Fix OpenSSL fixes. Fixes #1876. * Finish SQL select queries even when SELECT returns no rows. Fixes #1879. * Set Module-Failure-Message for more EAP errors. * Correct typo in dictionary.rfc5580. Fixes #1882 * Remove obselete systemd syslog.target. * Client-Port-Balance load-balancing now uses client port. * Radrelay examples fixed from Alex Clouter. * Update systemd target. Pull request #1896. * Trim starting whitespace in xlat strings. * Get MySQL result lengths using normal API. * suid down after fchown(). Fixes #1914. * Fix cases of comparing pointer to NUL character. Fixes #1915. * OpenSSL v1.1 fixes. Pull request #1921. * Better Handle v4/v6 host names. Pull request #1919. * Remove "Auth-Type = System" from docs and examples. * Don't crash on malformed %{home_server}. Fixes #1922 * fix erroneous use of talloc destructor in rlm_eap * Issue trigger modules.sql.fail. Fixes #1923 * Document python_path gotcha's. Fixes #1845 * dlopen() the specific version of Python. Fixes #1592- Don't require insserv if we use systemd - Remove require for unused fillup- Merge changes from SLE to openSUSE (FATE#322416): * freeradius-server-radclient-init-error-buffer.patch - make sure we initialize error buffer. bsc#911886: radclient error free() invalid pointer * freeradius-server-opensslversion.patch: remove OpenSSL version check and assume we know what we are doing. (bnc#1013311) * merge .changes file, mostly. - do not attempt to detect "vulnerable" OpenSSL versions. SUSE security fixes do not necessarily bump version numbers as does upstream OpenSSL (bnc#1021375) - do not generate certificates in %post. End-user needs to do this manually. - keep FreeTDS disabled on SLE12 - we never shipped it enabled - require OpenSSL 1.0+ - use pkgconfig(systemd) instead of plain systemd as BuildRequires - don't list manual pages as %doc- Remove --with-pic which is for static libs only. - Use SUSE RPM group names. Trim filler words from description. - Do not hide errors from groupadd/useradd.- Add upstream keyring - 2 new modules: rlm_sql_freetds and rlm_eap_fast- update to 3.0.12 - still fate#320481 The focus of this release is stability. * Feature improvements + Add support for =~ and !~ in update sections. See "man unlang" + Add dictionary.checkpoint. + Simultaneous-Use prints out more information. + Print WARNING in debug mode when packets may be truncated. + Added expansions %{home_server:state} and %{home_server_pool:state}, which show the state of the server / pool. + Mark rlm_sql_freetds as stable. + Make rlm_perl less fragile. Patch from Herwin Weststrate. + Allow extended attributes to have "encrypt=2" + Update dictionary.aruba. + Add support for EAP-FAST. This is an isolated feature which does not affect anything else. + Update OpenSSL vulnerability list. Use a version of OpenSSL released after September 20, 2016. + EAP certificate verification is now done when "verify" is enabled and "ocsp" is disabled. + New dhcpclient and rlm_rad_counter man pages. + Minor abfab and moonshot additions. + Pass CFLAGS through from environment in RPM builds. Allows more custom builds. + Build with Heimdal in addtion to libkrb5. * Bug Fixes + Use correct typedef for older versions of sqlite. + Update mssql schema to add priority + don't complain on /dev/urandom in ldap + fix == operator in update sections + Don't create DHCP strings with many trailing zeros. + Allow MS-CHAP change passwords instead of complaining on large buffer. + Allow assignment or equality operator on SQL. + Update aclocal tests for FreeBSD 10. + Remove occasional hang in rlm_linelog. + Copy VSAs to inner tunnel for TTLS and PEAP. Fixes #1544 + A few minor bugfixes caught in v3.1.x cleanup, and back-ported to v3.0.x. + do_not_respond again works in post-proxy + Allow realm "~^.*$" {} and User-Name with no realm. + Fix leak when creating unknown attributes + Fix Debian / logrotate. + Make OpenSSL error functions thread-safe. + Fix crash with rlm_sql and updating SQL-User-Name. + Debian build updates. + Allow regular expression comparisons in radclient. + Fix memory leak on unknown attributes in detail file reader. + Update example paths in "man" pages when installing them + Build fixes for rlm_mschap. Fixes #1489. + BSD build fixes. Patch from issue #1583. + Be more careful about /lib/ when building. Fixes #1585. + Correct ifdef placement error. Fixes #1572. + Allow for more files in internal "exfile" API So it will be possible to open more than 64 "detail" files at the same time. + Remove support for statically built EAP modules. Fixes #1591. + Many fixes to rlm_python from Guillaume Pannatier. + Use correct week adjustment in SQLcounter. Fixes #1608 + Minor fixes to allow compilation without DHCP, VMPS, or TCP. + Fix checks for module / config file change on HUP. + Compile regex comparisons when sent via "debug condition". + Update filenames in documentation and examples. + Don't crash if SQL connection becomes unavailable. + Disallow originate_coa when proxy_requests = no. + Free rad_perlconf_hv in correct perl context. + Multiple fixes for Debian builds. #1510, among others. + Set OpenSSL FIPS compatibility flag when necessary. + Pulled fixes for the build system over from other branches. + Fix OCSP for RADIUS over TLS. + Fix skip_if_ocsp_ok behavior. + Better fixes for systems without closefrom() but which have /proc. + Minor build fixes back-ported from v4.0.x. + build --whout-ascend-binary. Fixes #1761. + Be more aggressive about not opening new connections in debug mode after CTRL-C. Address #1604.- use %{with} macro for conditional inclusions instead of hardcoding version numbers - improved package descriptions - fixed builds on SLE12 and SLE11SP4- removed installation of experimental module rlm_sqlhpwippool.so - update to 3.0.11 (fate#320481, bsc#961479, CVE-2015-8763, bsc#935573, CVE-2015-4680) * Changes of version 3.0.11 + Feature improvements - "unlang" comparisons of IP addresses to IP prefixes are now detected, and types automatically cast. - Allow shorthand form of ipv4prefix values e.g. 127/8. - Add "auto_chain" to raddb/mods-available/eap, tls subsection. This allows the disabling of OpenSSL auto-chaining of certificates. Which might be wrong. - Added printing of coa and disconnect stats (radmin). - radclient defaults to expecting Access-Accept responses to Status-Server. - Updated dictionary.lancom, dictionary.starent. - Portability fixes for Solaris. - More errors from ntlm_auth gets passed to MS-CHAP. - Update abfab-tr-idp virtual server. - Added "filter_password" in policy.d/filter. This removes embedded zero bytes in User-Password, for compatibility with broken clients. - The server now issues a WARNING message if duplicate configuration items are found. - TLS can skip the "verify" section if OCSP returns OK. See raddb/mods-available/eap, "skip_if_ocsp_ok". - Set TLS-OCSP-Cert-Valid = yes / no / skipped, which is the result from the OCSP check. - Interoperate with AD and "LmCompatibiltyLevel = 5", by always setting WBC_MSV1_0_ALLOW_MSVCHAPV2 for native winbind in rlm_mschap. - TTLS and PEAP now require "virtual_server" to be a real server. - Print WARNING when TTLS or PEAP identities are spoofed or not properly anonymized. See RFC 7542 for requirements. - Various rlm_python fixes from Herwin Weststrate. - Allow setting Response-Packet-Type in "Post-Proxy-Type Fail", which is useful when the home server does not respond. - elasticsearch updates from Matthew Newton + Bug Fixes - Fix issue where field nas_type would not be accessible via the %{client:} xlat, for clients loaded from SQL. - Fix compatiblity issues with OpenSSL 1.0.2. Ignore calls to msg_callback with 'pseudo' content types. - Data type "ipv4prefix" is parsed correctly. - Use correct talloc context in rlm_exec. Fixes #1338. - Complain in unlang if "else" is used with no previous "if" or "elsif". - Send accounting status packets to the accounting port. Fixes #1364. - Print out CFLAGS when doing "radiusd -Xxv" - Fixed bug with coa/acct stats value #1339. Based on patch from Jorge Pereira. - Fixes for LEAP proxying. Don't use LEAP! - Fix issue with "directory already exists" seen when doing "make install". - Fixed bug with radmin related to the option "stats detail " - Complain if the detail file reader does not have permission to read the "detail.work" file. Fixes #1398 - Fixed SoH. Attributes were not being copied to the virtual server. - Used a wrong list to global statistics in "stats". - Create EAP-PWD identity correctly. Prevents segfaults. - Dynamically validate authentication types for PEAP and EAP-MSCHAPv2. - Fix includes in installed headers. - OpenSSL 1.0.1f and 1.0.1g do NOT calculate TLS 1.2 keys correctly. See raddb/mods-available/eap, "disable_tlsv1_2" - Allow password change to work for MS-CHAP. This requires 'r=0', because password changes are not retries. - Fix home server fail-over for home servers using TCP and/or RadSec. - Special characters in expanded regexes are now escaped e.g. User-Name containing '.', and comparing /%{User-Name}/, the '.' will now be escaped. See src/tests/keywords/regex-escape. - Use correct authentication vector when sending Access-Reject replies for RadSec. - Set FreeRADIUS-Proxied-To in TTLS again. You should use the "inner-tunnel" virtual server, instead of relying on this attribute. - Fix debugging constants in rlm_perl. Patch from Herwin Weststrate. - Add samba-dev / samba4-dev to debian builds so that rlm_mschap can automatically use the new winbind API. - Automatically skip zero-length attributes when sending packets, instead of erroring out.- fix bsc#951404 * Rebuild of freeradius-server package fails * fix source url - ftp://ftp.freeradius.org/pub/freeradius/ + ftp://ftp.freeradius.org/pub/freeradius/old/- update to 3.0.10 * Changes of version 3.0.10 + Feature improvements - Do more optimization of unlang policies. This makes run-time a bit faster. - Re-name most of the functions in src/lib. Third-party module authors will have to do the same. - More documentation on contributing and how to write modules. - Update radiusd.service for systemd. - Open IPv6 proxy socket if the server is listening on IPV6 auth / acct / coa packets. - Create debian packages for DHCP. Fixes #1125. - Add more tests for "update" section parsing. - Update "man" pages. - Update attributes for Alcatel 7750 - Add dictionary for Boingo Wi-Fi - Add support for DHCP lease queries. See raddb/sites-available/dhcp - On HUP, check all modules for config files which have changed. And only re-load those modules. - Allow FreeRADIUS-Response-Delay(-USec) to be set for RADIUS packets. Patch from Herwin Weststrate. - Documentation fixes from Alan Buxey and Matthew Newton. - Update "logrotate" script. - Added more RFCs to doc/rfc for new standards implemented by FreeRADIUS. - Don't crash when doing "radmin -e "help hup". Patch from Matthew Newton. - The dictionary parser now does more sanity checks, which prevents run-time problems with invalid attributes. - Update debian packages. Patches from Christopher Hoskin. - Many other debian packaging fixes from Matthew Netwon and Herwin Weststrate. - Add "session-state" to Perl. Patch from Herwin Weststrate. + Bug Fixes - Fix rlm_files so that there are no collisions when loading 10's of 1000's of users. - Fix radclient to use our internal v4/v6 parsing functions. v6 addresses with ports now work correctly. - Fix sending/receiving packet messages to wrap v6 addresses in square brackets '[]'. - Check for sasl/sasl.h when building rlm_ldap, and disable SASL functionality if unavailable. - Fix issue which caused a non \0 terminated buffer to be assigned to attributes if the value being assigned contained an invalid escape sequence. - Fix deadlock when reconnecting connections in the connection pool. - Fix potential overrun in functions that used fr_utf8_char with a non nul terminated buffer. - Fix decoding issue for Tunnel-Password type attributes which were very long. Found by Denis Andzakovic. - Fix radclient issue with TCP sockets on FreeBSD. - The server now creates ${run_dir} and ${logdir} directories in daemon mode, when running as "root". - Handle tags when using maps. Fixes #1191. - Fix crash when CoA packets time out. - Fix parse error in rediswho - Fix regex support in SQL radcheck the "users" file and radsniff. - Register listen xlat earlier, so that it's available when the virtual servers are being parsed. - Parse Ascend-Data-Filter when given as "0x..." - Print Ascend-Data-Filter correctly. Add test cases for both. - Allow old-style clients again. They will be disallowed for 3.1.0 and following. - Complain instead of crash when "else" and "elsif" are in the wrong place. - Clean up memory more aggressively. This lowers the maximum memory used, most typically for TLS based EAP methods. - Prevent the server from unlinking the control socket of an already running instance. - Fallback to using the configured OCSP URL if one exists, and no URL is provided in the certificate. - Return CoA-NAK if proxying CoA fails. Based on patch from Jorge Pereira. - Lower peak memory usage by decreasing size of internal memory pools. - The control socket is now left in place if a second copy of the server is accidentally started. - Allow virtual attributes in "switch", "case", etc. Fixes [#1240] and #1265. - Many spell check / typo fixes in comments and example configuration files. - Better handle multiple DHCP listeners. - Don't print secrets for old-style realms. Fixes #1267. - Don't fall through in empty "case" statements. Fixes #1274. - Update EAP-TTLS so that MPPE keys are correctly calculated with TLSv1.2. - Always delete MS-MPPE-* from the TTLS inner tunnel. This allows TTLS / EAP-MSCHAPv2 to work. Fixes #1206. - Fix off by one error that caused some MSCHAP-Error messages to be sent without the password change version (V=3) and the textual message component (M=). - Always include C= V= and M= in MSCHAPv2 errors. RFC 2759 does not say that any of these fields are optional, and not including V= caused errors with wpa_supplicant. - Do not include M= in MSCHAPv1 errors. It's not supported.- Fix boo#912714: freeradius can't use ntlm_auth * Create winbind group * Add radiusd to winbind group- Remove gpg signature file * The gpg signature checking is broken and doesn't work- Fix bsc#935573: Insufficent CRL application for intermediate certificates * CVE-2015-4680 * freeradius-server-CVE-2015-4680.patch based on https://github.com/FreeRADIUS/freeradius-server/commit/a03814af310bb3bee74ea012546d99c48b0ea5c3- update to 3.0.9 * Changes of version 3.0.9 + Feature improvements - Make "pool" configurations more consistent, and update documentation for them. - Move connection pool logic to "most recently started", instead of MRU. This should help with pool stability. - More VSAs for 3GPP2 - Added examples of multi-value attributes to rlm_perl. - LDAP-Group and SQL-Group attributes are now dynamically allocated. - Only the "sql" module registers SQL-Group. Other instances register "instance-name-SQL-Group", similarly to "ldap". - Unknown attributes are now complained about more often when used in unlang statements. e.g. if (Foo-Bar == 3) used to be a string to string comparison. It is now a parse error. - Rename RLM_COMPONENT_* to MOD_* in the code. This makes many things easier. - Move to C99 initializers for modules. - Load modules in raddb/mods-enabled. This allows attributes like "LDAP-Group" to be used in the "files" module, without explicit ordering or listing in "instantiate". - Added 'bootstrap' section to modules. Third-party modules will need to be updated. - When adding clients from a DB, add them to a virtual server if that virtual server has a "listen" section. Otherwise, add the clients to the global list. - When reading dynamic clients from a file, don't expire them if the underlying file is unchanged. - Allow the server to originate CoA requests from the post-auth stage. - The server creates ${run_dir} and ${logdir} in daemon mode, if they do not already exist. - Add dictionary for Wi-Fi Alliance Hotspot 2.0. The server now supports all mandatory and optional attributes for this specification. - HUP now re-loads the configuration only if the files have changed. If all files are unchanged, HUP re-opens the log file, and does nothing else. - Much better debug messages for EAP-TLS, including which attributes are cached, and when they are retrieved. - Increase default max_requests to 16384. Memory is cheap now. - Added "stats memory" commands to radmin. Debug build only. - Aptilo controller dictionary updates. - SQL modules now use Acct-Unique-Session-Id everywhere. - The redis modules are now stable. - The LDAP module now supports SASL "interactive bind" method. This allows Kerberos based administrator and user binds. - DHCP code is now in libfreeradius-dhcp. - More DHCP encoding / decoding unit tests. - rlm_replicate can now be listed in the "accounting" section. - Better sqlite debugging output. - Remove "required" option from many sql_ippool directives. - Set default CA "basic constraints" to "critical". Fixes #1073 - Updates to help / man pages from Jorge Pereira. - Added more tests. + Bug Fixes - Be more careful about unused config item warnings when using -Xx. - Move more defines to be auto-generated. - Allow virtual servers in proxy fallback. - Allow %{module:} to work. - Don't crash in RadSec. Closes #980. - Return better errors when a unix group / user is not found. - Re-enable detail module "locking" parameter. - Don't crash when logging replies from Status-Server packets. - The couchbase module now uses "update" instead of "map", for consistent with the rest of the server. See raddb/mods-available/couchbase - Don't require NT-Password for MS-CHAP password changes. - Be a bit more careful about decrypting MS-CHAP-MPPE-Key attributes. Closes #1013. There is no perfect fix, tho. - Fix security issues with EAP-PWD. See http://freeradius.org/security.html#eap-pwd-2015 - Fix dynamic clients read from SQL in non-debug mode - MS-CHAP now allows retries (i.e. password change) when passwords are expired. - Allow "user=radiusd" when the server is already user "radiusd" - suid up/down works on non-Linux systems. This means that the control socket should have the correct ownership. - Fix issue which caused the server to sometimes have problems when a home server was marked zombie. - Fix format.pl because Perl is now more picky. - Fix proxy to Packet-Dst-IP-Address, so that it uses the correct destination port. - Fix corner case with cursor functions and removal. - OpenDirectory fixes and documentation. - Fix leaks in rlm_redis. - RFC 6929 "evs" attributes are now encoded / decoded properly. - Fix talloc pool leaks when receiving malformed or retransmitted Accounting/CoA requests. - Printed attributes again use double quotes instead of single quotes. - Set X509_V_FLAG_CRL_CHECK_ALL, and add "check_all_crl" to eap.conf. Fixes oCert CVE-2015-4680. - rlm_expr now errors out correctly on malformed attribute references instead of triggering an assert. - Make "break" work in "foreach" loops - Allow dynamic expansions to work again in the "hints" file. - Correct minor typos in comments and examples from Alan Buxy. - Re-urlencode the path portion of ldapi:// urls before passing it to ldap_initialise. - freeradius-server-rlm_sql_unixodbc-configure.patch removes hard-coded directory in configure script of rlm_sql_unixodbc - install new module rlm_sqlhpwippool.so- minor adjustments/cleanup of spec and changes- update to 3.0.8 * Changes of version 3.0.8 + Feature improvements - Allow syslog_severity to be set in rlm_linelog. - Allow defaults to be set for bulk clients in LDAP and couchbase. - Updates to dhcpclient. Patches from Nicolas C. - rlm_mschap now supports direct connections to winbind, which is faster than ntlm_auth. See raddb/mods-available/mschap. Patch from Matthew Newton. - Recommend /dev/urandom for TLS randomness, instead of ${certdir}/random - Allow TLSv1 to be disabled via "disable_tlsv1" in tls{}. - Allow Expanded EAP types where vendor is 0 (IETF) and type is normal EAP type. Supplicants sending Expanded EAP types like this are broken. - Add support for server side sort controls when searching for user objects in rlm_ldap. + Bug Fixes - Don't complain about "authorize" in "server {}" blocks, but only if there's no "server" block. - Fix cosmetic issue where debug from the first packet read by a detail reader thread would be emited during config parsing. - Fix ASSERT on truncated detail packets. - Don't use main server log functions from within panic_action, as in the case of syslog this would cause deadlocks if the fault was triggered from within a malloc. - Fix issue in "switch" when "correct_escapes = false". Fixes #911. - Fix sqlcounter configuration to use "%%b" instead of "%b", otherwise the new syntax validation will fail. - Allow forward references in configuration items. Modules aren't always loaded in a sane order. - Fix more escaping issues. Closes #912. - Decode MAC addresses correctly for VMPS. - Fix memory leak with TLS connections. - Fix state machine threading issues for conflicting packets. - Fix copy_request_to_tunnel issues for tagged attributes. - Allow "ok" to over-ride "updated" inside of Auth-Type sections. - Update state machine so that post-proxy is run though child threads for performance, instead of blocking the main thread. - Allow "netmask" to work again in client definitions. - Relax restrictions on SQL group queries. - track outgoing proxy sockets and clean them up more aggressively. - track proxy statistics, including CoA and Disconnect. - If radmin has a connection failure when running a command, it re-connects and runs the command again. - mark home servers "unknown" less aggressively. - Fix potential SEGV in PostgreSQL driver on error. - Fix issue where fields like nas_type would not be accessible via the %{client:} xlat, for dynamic clients. - Set default busy_timeout (of 200ms) in the sqlite driver, so writes don't cause selects to fail in multithreaded mode. This is user configurable, and may be increased if required. - Convert Password-With-Header attributes to binary (from hex or base64), in the authorize method of rlm_pap. - Fix invalid assert in state.c, that could cause abort in post-auth. - Fix double free when -m flag is used, and connection pools are referenced by multiple modules. - RADIUS over TLS accounting uses the same port as authentication. - Regularized return codes from radmin commands. - Fix RHEL spec file so it works correctly for Centos7 which uses systemd, and didn't like the SystemV init script. - radwho and radlast now have a -D option to load dictionaries - DHCP packets are no longer checked for duplicates. - Don't crash in sql module group comparisons in corner case. - Calculate MPPE keys correctly when using TLS 1.2. - Fix load-balance sections. Closes #945 - TLS certificates are available again in the post-auth section. They are not available for session resumption. - radclient encodes CHAP-Password properly when using -c Closes #955. - Fix issue in rlm_cache_memcached driver that caused variable length values to be truncated. - Fix track functionality in detail reader, so it no longer fails with a "Failed marking detail request as done: Bad file descriptor" error. - Actually add the peer identity (as User-Name) to the inner tunnel in EAP-PWD requests, so it's available for lookups. - Fixes to PostgreSQL queries. Patches from Santiago Gimeno. - new set of consolidated patch files: deleted: * freeradius-server-2.1.1-logrotate_su.patch * freeradius-server-2.1.6-rcradiusd.patch * freeradius-server-initscript-pidfile.patch * freeradius-server-radius-reload-logrotate.patch * freeradius-server-var_run.patch added: * freeradius-server-radiusd-logrotate.patch * freeradius-server-rcradiusd.patch * freeradius-server-tmpfiles.patch- Do not disable as-needed build - Remove the with_sysconfig switch and just stick with versions- update to 3.0.6 - fixes a segmentation fault in PEAP module (bnc#912588) Feature improvements: * radmin / raddebug conditional errors are printed to the output, instead of being discarded. * raddebug will exit if condition set with -c was invalid. * radmin auto-reconnects if the connection to the server has gone away. * rlm_cache now has submodule support. See raddb/mods-available/cache * New memcached driver for rlm_cache. See raddb/mods-available/cache * Add support for &Attribute-Name[*] in conditions. See "man unlang" for details. * Add &Attribute-Name[n] which gets the last instance of an attribute e.g. Module-Failure-Message[n]. * Allow for redundant string expansions. See the "instantiate" section of radiusd.conf. * When checking IP addresses in conditions, make the right side be parsed as an IP prefix. * Support JIT compilation of compiled regular expressions when built with libpcre. * Support named capture groups with "%{regex:}" when built with libpcre. * Increase regular expression capture groups from 8 to 32. * Emit error markers for badly formed regular expressions. * Allow 'm' flag to enable multiline mode in regular expressions. * Support limited implicit attribute conversion in update sections. * Support casting between IPv6 and IPv4 where the IPv6 address has the v4/v6 mapping prefix (::ffff:).- Drop .keyring and .sig file: freeradius-server still uses MD5 signatures, which are no longer validated/accepted by GPG 2.1.- update to 3.0.5 Some of the new features: * Allow LDAP to specify arbitrary attributes for dynamic clients. * Allow one level of backslashes (finally). See radiusd.conf, "correct_escapes" setting. * When supported by OpenSSL, allow TLS 1.1 and TLS 1.2 in EAP methods. * Allow multiple new connections to be spawned simultaneously in the connection pool, to cope with spikes in traffic. * Use kqueue on systems which support it. This allows for better scaling when using many sockets. * Home server "response_window" can now take fractions of a second. See proxy.conf. * radmin now supports "show module status", as thee counterpart to "set module status" * "ipaddr" will now use v6 if no v4 address is present. You should use "ipv4addr" or "ipv6addr" to force v4/v6 addresses. * "client" sections will allow "ipaddr = 192.192.0/24". The old "netmask" is still accepted, but the new format is preferred. * Allow custom HTTP headers to be set for rlm_rest requests using control:REST-HTTP-Header (attributes consumed after use). * Extend format of %{rest:} expansion to allow HTTP method and POST data to be specified and urlquoting. * Add support for aliases in rlm_ldap. * Add support for connection pool sharing to all modules that use the connection pool (pool = ). * "tls" sections now have a "psk_query" configuration item, for dynamic queries to discover a key from a PSK identity. * Preliminary support for EAP channel bindings. * Foundational work for dynamic home servers. They do not yet work, but this is now only a matter of updating the "realm" module in a future release. * Support &attr[*] syntax to copy all instances of an attribute when used with the += operator in an update section. May be qualified with a tag. * The logintime and expiration modules can now be listed in the post-auth section. This makes some configurations simpler. * rlm_sqlippool is now IPV6 capable. Set "ipv6 = yes" to get Framed-IPv6-Prefix returned. The SQL queries have NOT been updated. Please submit patches. and numerous; bugfixes - remove gpg-offline - create /run/radiusd after install - drop freeradius-server-opensslversion.patch (upstream)- freeradius-server-opensslversion.patch: do not check the minor version of openssl, minor versions are supposed to be compatible. bnc#906682/bin/sh/bin/sh/bin/sh/bin/shfreeradiusarmbuild24 1624472632  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~     3.0.21-lp152.2.9.13.0.213.0.21-lp152.2.9.13.0.21-lp152.2.9.13.0.21    !"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""#$$%%%%%%%%%%%%%%%%%%%%%%&&&&&&&&'()))radiusdradiusdraddbREADME.rstcertsMakefileREADMEbootstrapca.cnfclient.cnfinner-server.cnfpasswords.mkserver.cnfxpextensionsclients.confdictionaryexperimental.confhintshuntgroupsmods-availableREADME.rstabfab_psk_sqlalwaysattr_filtercachecache_eapchapcouchbasecountercuidatedetaildetail.example.comdetail.logdhcpdhcp_sqlippooldigestdynamic_clientseapechoetc_groupexecexpirationexprfilesidninner-eapippoollineloglogintimemac2ipmac2vlanmoonshot-targeted-idsmschapntlm_authopendirectoryotppampappasswdpreprocesspython3radutmprealmredisrediswhoreplicatesmbpasswdsmsotpsohsometimessqlsqlcountersqlippoolsradutmpunboundunixunpackutf8wimaxyubikeymods-configREADME.rstattr_filteraccess_challengeaccess_rejectaccounting_responsepost-proxypre-proxyfilesaccountingauthorizepre-proxypreprocesshintshuntgroupssqlcountercuiippoolippool-dhcpmysqlschema.sqlschema.sqlpostgresqlprocedure.sqlmainmoonshot-targeted-idsmysqlqueries.confschema.sqlpostgresqlqueries.confschema.sqlsqlitequeries.confschema.sqlunbounddefault.confmods-enabledalwaysattr_filtercache_eapchapdatedetaildetail.logdigestdynamic_clientseapechoexecexpirationexprfileslineloglogintimemschapntlm_authpappasswdpreprocessradutmprealmreplicatesohsradutmpunixunpackutf8panic.gdbpolicy.dabfab-traccountingcanonicalizationcontrolcuidebugdhcpeapfiltermoonshot-targeted-idsoperator-namerfc7542proxy.confradiusd.confsites-availableREADMEabfab-tlsabfab-tr-idpbuffered-sqlchallengechannel_bindingscheck-eap-tlscoacontrol-socketcopy-acct-to-home-serverdecoupled-accountingdefaultdhcpdhcp.relaydynamic-clientsexampleinner-tunneloriginate-coaproxy-inner-tunnelrobust-proxy-accountingsohstatustlsvirtual.example.comvmpssites-enableddefaultinner-tunneltemplates.conftrigger.confusersradiusdfreeradiusproto_dhcp.soproto_vmps.sorlm_always.sorlm_attr_filter.sorlm_cache.sorlm_cache_memcached.sorlm_cache_rbtree.sorlm_chap.sorlm_counter.sorlm_cram.sorlm_date.sorlm_detail.sorlm_dhcp.sorlm_digest.sorlm_dynamic_clients.sorlm_eap.sorlm_eap_fast.sorlm_eap_gtc.sorlm_eap_leap.sorlm_eap_md5.sorlm_eap_mschapv2.sorlm_eap_peap.sorlm_eap_pwd.sorlm_eap_sim.sorlm_eap_tls.sorlm_eap_ttls.sorlm_exec.sorlm_expiration.sorlm_expr.sorlm_files.sorlm_ippool.sorlm_linelog.sorlm_logintime.sorlm_mschap.sorlm_otp.sorlm_pam.sorlm_pap.sorlm_passwd.sorlm_preprocess.sorlm_radutmp.sorlm_realm.sorlm_replicate.sorlm_soh.sorlm_sometimes.sorlm_sql.sorlm_sql_freetds.sorlm_sql_null.sorlm_sql_unixodbc.sorlm_sqlcounter.sorlm_sqlippool.sorlm_test.sorlm_unix.sorlm_unpack.sorlm_utf8.sorlm_wimax.sorlm_yubikey.soradiusd.serviceradiusd.confcheckradraddebugradiusdradminradrelayrcradiusdfreeradius-serverCREDITSChangeLogfreeradiusdictionarydictionary.3comdictionary.3gppdictionary.3gpp2dictionary.accdictionary.acmedictionary.actelisdictionary.adtrandictionary.aerohivedictionary.airespacedictionary.alcateldictionary.alcatel-lucent.aaadictionary.alcatel.esamdictionary.alcatel.srdictionary.alteondictionary.altigadictionary.alvariondictionary.alvarion.wimax.v2_2dictionary.apcdictionary.aptilodictionary.aptisdictionary.arbordictionary.aristadictionary.arubadictionary.ascenddictionary.ascend.illegaldictionary.asndictionary.audiocodesdictionary.avayadictionary.azairedictionary.baydictionary.bigswitchdictionary.bintecdictionary.bluecoatdictionary.boingodictionary.bristoldictionary.broadsoftdictionary.brocadedictionary.bskybdictionary.btdictionary.cablelabsdictionary.cabletrondictionary.camiantdictionary.checkpointdictionary.chillispotdictionary.ciscodictionary.cisco.asadictionary.cisco.bbsmdictionary.cisco.vpn3000dictionary.cisco.vpn5000dictionary.citrixdictionary.clavisterdictionary.cnergeedictionary.colubrisdictionary.columbia_universitydictionary.compatdictionary.compatibledictionary.cosinedictionary.dantedictionary.dellemcdictionary.dhcpdictionary.digiumdictionary.dlinkdictionary.dragonwavedictionary.efficientipdictionary.eltexdictionary.epygidictionary.equallogicdictionary.ericssondictionary.ericsson.abdictionary.ericsson.packet.core.networksdictionary.erxdictionary.extremedictionary.f5dictionary.fdxtendeddictionary.force10dictionary.fortinetdictionary.foundrydictionary.freedhcpdictionary.freeradiusdictionary.freeradius.internaldictionary.freeswitchdictionary.gandalfdictionary.garderosdictionary.gemtekdictionary.h3cdictionary.hillstonedictionary.hpdictionary.huaweidictionary.ianadictionary.ieadictionary.infineradictionary.infobloxdictionary.infonetdictionary.ipunpluggeddictionary.issannidictionary.itkdictionary.juniperdictionary.karlnetdictionary.kinetodictionary.lancomdictionary.lantronixdictionary.livingstondictionary.localwebdictionary.lucentdictionary.manzaradictionary.meinbergdictionary.merakidictionary.meritdictionary.merudictionary.microsemidictionary.microsoftdictionary.mikrotikdictionary.mimosadictionary.motoroladictionary.motorola.illegaldictionary.motorola.wimaxdictionary.navinidictionary.netdictionary.netscreendictionary.networkphysicsdictionary.nexansdictionary.nokiadictionary.nokia.conflictdictionary.nomadixdictionary.norteldictionary.ntuadictionary.openserdictionary.packeteerdictionary.paloaltodictionary.pattondictionary.perledictionary.pfsensedictionary.pica8dictionary.propeldictionary.prosoftdictionary.proximdictionary.purewavedictionary.quiconnectdictionary.quintumdictionary.rcntecdictionary.redcreekdictionary.rfc2865dictionary.rfc2866dictionary.rfc2867dictionary.rfc2868dictionary.rfc2869dictionary.rfc3162dictionary.rfc3576dictionary.rfc3580dictionary.rfc4072dictionary.rfc4372dictionary.rfc4603dictionary.rfc4675dictionary.rfc4679dictionary.rfc4818dictionary.rfc4849dictionary.rfc5090dictionary.rfc5176dictionary.rfc5447dictionary.rfc5580dictionary.rfc5607dictionary.rfc5904dictionary.rfc6519dictionary.rfc6572dictionary.rfc6677dictionary.rfc6911dictionary.rfc6929dictionary.rfc6930dictionary.rfc7055dictionary.rfc7155dictionary.rfc7268dictionary.rfc7499dictionary.rfc7930dictionary.rfc8045dictionary.rfc8559dictionary.riverbeddictionary.riverstonedictionary.roaringpenguindictionary.ruckusdictionary.ruggedcomdictionary.sangomadictionary.sgdictionary.shastadictionary.shivadictionary.siemensdictionary.slipstreamdictionary.sofawaredictionary.softbankdictionary.sonicwalldictionary.springtidedictionary.starentdictionary.starent.vsa1dictionary.surfnetdictionary.symboldictionary.t_systems_novadictionary.telebitdictionary.telkomdictionary.terenadictionary.trapezedictionary.travelpingdictionary.tripplitedictionary.troposdictionary.ukernadictionary.unixdictionary.usrdictionary.usr.illegaldictionary.utstarcomdictionary.valemountdictionary.vasexpertsdictionary.verizondictionary.versanetdictionary.vqpdictionary.walabidictionary.waveriderdictionary.wichorusdictionary.wifialliancedictionary.wimaxdictionary.wimax.alvariondictionary.wimax.wichorusdictionary.wisprdictionary.xediadictionary.xylandictionary.yubicodictionary.zeusdictionary.ztedictionary.zyxelfreeradius-serverCOPYRIGHTLICENSEcheckrad.5.gzclients.conf.5.gzdictionary.5.gzradiusd.conf.5.gzradrelay.conf.5.gzrlm_always.5.gzrlm_attr_filter.5.gzrlm_chap.5.gzrlm_counter.5.gzrlm_detail.5.gzrlm_digest.5.gzrlm_expr.5.gzrlm_files.5.gzrlm_idn.5.gzrlm_mschap.5.gzrlm_pap.5.gzrlm_passwd.5.gzrlm_realm.5.gzrlm_sql.5.gzrlm_unix.5.gzunlang.5.gzusers.5.gzradcrypt.8.gzraddebug.8.gzradiusd.8.gzradmin.8.gzradrelay.8.gzradsniff.8.gzradsqlrelay.8.gzrlm_ippool_tool.8.gzradiusdradiusradacctradius.logradutmp/etc/logrotate.d//etc/pam.d//etc//etc/raddb//etc/raddb/certs//etc/raddb/mods-available//etc/raddb/mods-config//etc/raddb/mods-config/attr_filter//etc/raddb/mods-config/files//etc/raddb/mods-config/preprocess//etc/raddb/mods-config/sql//etc/raddb/mods-config/sql/ippool-dhcp//etc/raddb/mods-config/sql/ippool-dhcp/mysql//etc/raddb/mods-config/sql/ippool-dhcp/sqlite//etc/raddb/mods-config/sql/ippool//etc/raddb/mods-config/sql/ippool/postgresql//etc/raddb/mods-config/sql/moonshot-targeted-ids//etc/raddb/mods-config/sql/moonshot-targeted-ids/mysql//etc/raddb/mods-config/sql/moonshot-targeted-ids/postgresql//etc/raddb/mods-config/sql/moonshot-targeted-ids/sqlite//etc/raddb/mods-config/unbound//etc/raddb/mods-enabled//etc/raddb/policy.d//etc/raddb/sites-available//etc/raddb/sites-enabled//run//usr/lib//usr/lib/freeradius//usr/lib/systemd/system//usr/lib/tmpfiles.d//usr/sbin//usr/share/doc/packages//usr/share/doc/packages/freeradius-server//usr/share//usr/share/freeradius//usr/share/licenses//usr/share/licenses/freeradius-server//usr/share/man/man5//usr/share/man/man8//var/lib//var/log//var/log/radius/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.opensuse.org/openSUSE:Maintenance:16593/openSUSE_Leap_15.2_Update_ports/01d40a48b058f57394a1ecc1551a3e1b-freeradius-server.openSUSE_Leap_15.2_Updatedrpmxz5armv7hl-suse-linux  !"#$%&'()*+,-./0123456789:;<=>?@?AABBBBBBBBBBBBBCBBBBBBBBBBBBBBBBDDASCII textdirectorymakefile script, ASCII textPOSIX shell script, ASCII text executableUTF-8 Unicode textELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=02a32f762da7bedfd1e17314621befc42b7da714, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=769a042e91b46244bfc100cb956f67be144f3596, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=2263b2d4b428cca65ab1b0416e31dbf19c3d389c, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=3616411bbc51a00f8de848203ce0e05f15983676, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=f6a88dc032f395412dfff7c7af0c46f796f1d352, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=967cd4392c03286dddbd4751b7154655bf884b2a, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=182339ee36cb824abcae3e7ec487ac2ecbda866b, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=c357bfb88b2563161cdc91985cba712f3881ee2e, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=d9071bca2ebd7bdfaf51b8ef9cfc013e2d559588, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=fd4b5d1d0a3057dcf8f5a0c1bba30c79f0adfe0d, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=cc08617ac65b0a6db585e460f2e4e0dfab07ab28, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=2ee20f0c38ca57e110198eb7ca0ff24314208a92, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=490f0e64e4d50e9f54e61dc8607cb115f4c58e3e, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=d91c6c7a0df167c9177fa334c2fb2ece1060f087, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=31b937146ee442ffa7189debfdde6d011419ffe8, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=2a45efc7d62d41d411b9797fef7e67e654178974, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=f2a8262a84aad82a1bd0e9961d28d2f5513b2551, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=e11ad26dc4fba0532df09441101c0dcf74501f4d, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=3a862bc934236cc6f067c70f36777a4bb138ca6d, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=2e985ba1ec2ad6e0ab580f021ef8eb937606d3e9, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=421bd683280660db7dee53c07f39e951d5cff9a1, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=4163d21d82046b9be0c83a7433de4fa704057781, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=c4e14ee52e376e01f89d6f9c2f2dfa712528ee41, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=fff11cd2c88881c58f5c932dbb823052dafad33e, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=6832460d77e32afe0734a214fd31ba784e35188d, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=7909df90bedead001784ef45dcf05c6129bd1c20, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=9d2000a0a4e4dabc6b723a5ac41e1a0f997cad1b, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=4fe72b73a9aff88c679b88edfdd87a47dc0dd8c5, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=1c7c3969377182d58a01f6c8ded1d9c36961a756, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=b3c7dd1b563014fe43cb164b7fa749e7a8426854, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=0e2438d545d46a01986adb84b54004a7126d2807, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=d6f1d6a7617b247cd660b3526f793a91db0f9656, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=9571e93bb955aa1b746827a4602def1d71038aad, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=f805536871f847b68a4ef95a71f67ec0914b1673, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=01d54edd02d2f45ca8284613a46c475cd7061422, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=44ef36e3bc80e304869b953d6d0c2eef79614bb8, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=a7cf7824538f58b95244d144a6bc9748e07acfa0, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=548a83af640a8fb134a4ac9487541fe0240def64, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=6ab375bf7ced5af59757750fad5fbd7eb79278a5, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=861e1d833d9942432afa1f5e5295bf201c6d7286, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=b3697b7fdba8918734daae81f3be003757171aac, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=4c058044514663cd264c40fb9117d993e8d84080, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=016fdb6bb792911182008cadbe320e6e2292b5fd, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=9846156056ed2264982b7ff61a4f0ea1df61bd11, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=1cb3774ce23d5728f7519ea32db39d2bfd9b8735, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=1833258e141d154a9e07cceea03468ae581261b2, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=f415c945df3834619bf676e45337492c90fbf183, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=e32baef8ca4dd76b06c507d89eb124949848ca4b, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=567117fc95c2cf30614e4b870da2c5b159285901, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=b2c38660f0efbeb897e9e10267d08c18523711bd, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=497efc2ba07f7e9f093806b8d14464e16270c141, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=0dac9fedafced8df0753176950d7f25722c7a9e8, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=83ec09841677a600cc0532e6778a98035de48c4e, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=8c285e563d7816486ccb4d63e71c1cfe12d5ccb1, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=7c30351cb9017a69ee9c0292ac056beead73c922, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=2771fb2986edf1c846367fefc4e0dbab64d9becc, strippedPerl script text executableELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-armhf.so.3, BuildID[sha1]=128f3b578f8082589b3cbf34d8efa7e98ceab62f, for GNU/Linux 3.2.0, strippedELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-armhf.so.3, BuildID[sha1]=d1555d47a8b91b61648388ec28820acc9f911eb4, for GNU/Linux 3.2.0, strippedAlgol 68 source, ASCII texttroff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix)troff or preprocessor input, UTF-8 Unicode text (gzip compressed data, max compression, from Unix)empty !(06=CGMTZ`gntz $(/5;?EKOW[\]r~   RR RRRR R R RRR R R RRR R R RRR R R%RR R RR$RRRR R R R RRRR R R%R RR R$RRR R R RRR R R RR RRR R R R RRR R R RRR R R RRR R R R RRRR R R R RRR R R R RRR R R RR RRR R R R RRRR R R R RRR R R R RRR R R R RRR R R R RRR R R R RRRR R R R RRRR R R R RRRR R R RRRR R R RRRR R R R RRR R R R RRR R R R RRR R R R RRR R R RR RRR R R R RRR R R R RRR R R R(R'R RR&RR R R R%RR R RRR$RRR R R RRRRR R R RRR R R R RRR R R R RRR R R R RRR R R R RRR R R RRR R RRR R RRR R R RRR R R R RRRR R R RRR R R RRRR R R R RRR R R R RRR R R RRR R R RRR R R R RRR R R RRR R R RRRRR R R RRR RRRRR RR#R"R RR%R RRRR!R$RRR RR R RR%R R R RRR$RRR R RRR RR#R"R RR%R RRRR!R$RRR RR R &z,ƓHlogrotateutf-8862949d99be452f1989877836ff9ef1ea0ecce0514f3fa02f97fa09cbb15dda6?7zXZ !t/]"k%Yfm?1 1N8[xIBsT'ũwX;ffگ rٳFd5_/m$j0=.( í7K\:[~7}w(}#+`|mؠ4m/t+?pףitj5ă~\AA?_G~sQiie.E֌~aeV~Iu:mZ!3GٸsjDϪkVIFe,#jI]:q[RFyeUK dvTEHJHC5Ohksf\JWAs)i{xu.OupL,-c1ѹÌ'諪*nfa94TvzO0oF|SS',WTMγxP+{X#/n"8㆞w3[!u6{#kFew fb` u 0PGITh:PZb1eP!"?RTs`v&v1^:B2\A`LWza &9v<]꡵R7ټI1tRH`)jbn$Mba[2k %dFJmz{I<+W[%# G@@d*n?61P7B_]!"xЖ Y9Q߫ɚQrO(G:_<{_g";s|o9M3Z$Bsgl:vdܩ;R{SR._M|d<5Qj9Lg2ZIjLȋp$ζPh2Ajgjxp'RXuCai )R+",6s{&EMZFiG6i^,ʂ=ҵ?|(AM=,6nCa,MEJB_/kE!>ּ9b>/{``0>hnVZ`1?xGd`2A_V1K:pMs >fTf b \;KbdIV'<F áXPgT=:#F"M۬WZn gtrf/u;%duDE93/MlxPo.K&,ے>f(^Z! A[._=5OayiȯςD}A\03}5=ľ<߹UC9ίZ?u^ _e}sX07 aÒ<'j#'ᆳ8ځ*qSwBPE`C; ؎״r`ȆJ`Hz{6_nLtk {g\a`(>G\0&Z1d%c4bl"E DT/.^DT,+3ѪPXlӘ!9P Ls+Zt1'_xDҊߠji훊}hfU %~ d n<د:Pij202ܫu[AkJ'~!w*#>zjI8хb|y!Ǚic -YCYhf5j"]ⲒcF`<' M;&bTFW@Q' +Tl*/K4B>3MӑxKoϾ dO #ےcDS/w$I?Sz/n8󁁊|J/ `*Z)C<4!Mʽ>&kHBd,hCIc3\@B2"_ϨR"E"i/A0^^|5߀5iRگLօ<2Jl?Q:GNOMy4)'44V@A\V{]=c#{)#@2;j)y@A^y Q}@[o, 4y#[~N[fJLH-e,cx&Ի(IɂϤÓBydE) vS e[v.>.;M,6?x SBuuIw5" K[7 4le4/ &_v_mOIs7N|Yv<X"KО,&#֑Ba='ŵyAj~agGXNL+~R_gJaۃ(nԪ!\ xbGQ DIs43:rC8bnBq .וHHYW`,Aj[\W t TuuCpC_IC;o=d9Aտjb@Yj%:Y3 *ì)!yAhY\^i}!I)Lђm-5RU{ErǪۦtr8ZI me54E"6Od/8kC>g"vJ̾nTRXǺ$u4esyaWKy. &JASX8dРx{`͒h!s'8 mZ^^d0ea"蟓ӥrz dx/g*cܾIw! ~fsoxm0;mn,Sz0><<:$ )rqs+ʪ}h¦aۗq , CPV0vidpE¤g뗖R[MP+ְK7᮫\AڷIVY `uBq;Iu\EhU܂,E-2,Ť;>yP`@ Ufw^&e\80mLl񳜲kSpI]:K .NEdG||54%'II> }l}ู^aOf&z.uj%sp.b\S@1I7ܒ!@bE L@}%p4Wi^zNkYwh !#t+ɒt}VWFCMېe9b(su-T!V-.U7@MׯZ;ᶾ^Sv vYRKDH<İ{`i75]DEXu7bV6nt_Fן׿09$:DaO (ku)H#XU7Y){HxD6!&Ő0Rb)}\1Tv =6pЄ/UƪIZ`h%"Si F n)]O fbӑUŁh}!B4W76!!iP4LeP5(*j>ieD>;i^"\V2YxمJ[c+]0kgZpzk| CʆFBTԁ@*N5f*p3"[5w2GU.7FI'TwI) >u:f.#E[W7Anң't RUNǭo=kiQaKegD0s3i#{#1o"rt,*#e A2g3 SA&~Ey|N\ʟv\+6FŬh"D_aOԋ^;1!Mew_ 9E2nRL%FP(dur>q]Ggj9/59Aw Wks*n.Pq5@2Ϣ%|9I^n@DI,J>ǓʒL@!PrNZ2hģ e{>*ђx/&:=p%n(EMFXv5Ju.ȴ^78(T>q;[_9~ 'ez$ƭy+ohkV擪ZFa\Vf m> hAI+}_zǂ-g/KqN^;^;KQ%2 >es[S1|8jYhp{~Ki foЮ,a =0<ݾ^})^u]`BԱClCaXIu_C 2D9 7S}7#_"o_c MB&.Z8x$| RKދdX QE/U}jm:8IKqq+ E&M X]t(f<Kו,u-ܼ&L ;q޻@rTai.J)__T8`C6aUqE5L10?=˿Ikk*AJ$ K22ˆ=8cs35@ŵa`daQ(4FۢuR?{(~im* b.yjmɄ!Ӄ%. &n.xw}sעs_cS b6t[k&۟^ n}I U,UsQ%!Sr{6vf[h8¨:j7R"z8\v-/%Q.FDW^%IJOUTpi\O׎1}klTv(O,@bc%D;q@&67x=: 6 _k(9x/Qq#YX;8 Q"9<;0*7QX)+|( ȋD'aDytdgmEOwpvN iEy_K[I"Y?,$Yz%)Rsz1BYH'o25c5$֛zVo6_wy5EW!$P =$1g@WuͪEt<: 'ߞs=T"Y2} 5C({?'F"W)ʈ뱧w6 t>Se8>^SpWAa}cQ 4R?l2S=% ve\ce ^lNxazcYD޺Z0gl´PŨADwܰ,rak1x4Tve/JhVFd:5vkIәpl&85?pռ\dS3%[GA̛[کZLXQRѸXV1y#+51@-E&[ {E3)ǚ>k>]j*ŕJI < cњid%UT}Ji'"ib:n҇p5E(ĕE8}8<*UW=8F 9{oeF ^,!q><;Szx17m{*}%rnT~s !cԱ@\5;̝mMګ 9 ^o^0H WNv6qa;\ۗ_atҼbҘ5 q]A'ىCpXJ։3~1-)XJ|8q٪jjVoT7OiN“!Ձe*01$;"nOpztMh g[pD(1hV@L[GWzɻip[W0ѐwtI+*GcV8e[Qmh ~d TD)j+' vtHD)RѣOd󭚗]cx(.G=  IPr- 9H ck(- ۸V؍4iAS`Ӧfo/„i˜A_; lLh |7ne`Jxu*|d#UU\:fD Q.8ēZٹRdd~'j-{>Qk׿[sB\N2`a6Ce#-:gq( n6b|υ˚8㞫 8; l"f;AiU6*K.mwg0a s'w{g/U>F:/q\ǻC@8],@ Oܲ}`eY/yz1!Kfr0ay`H/փh99&nlmY]DK,K=7"⚡9k5^Ya)dqZX_2d ?B7lTNBuJ> e =Iuq(e@pHTEQJT}[sW8E9!hqÌ&L#Q.$9LH1?^7/B1mfTʍ؄QlYKB%p: ^tçD K.EG :@kvV{젏_a>S󝅶%IYD?o(tHT\*cځ]Z(틆'HeI5MM.3'n{gpRB_V3KwGJ[{X-wLˈ8yz0҉)o3O3蹋F:p잽]J17Q^]eAC]6v2"#z8[`N~WbZt~ӣ޽Q:%7ta Qh6Z0i;dj%z{d_K!=6>fjy[ɉz'!Dfr\Qa#ޣnJy0+om{ާ~ન>¥6&#c䵅oj"Пl?LR:jh+Þ(%n'@Y9<$}`s~ SN}y`/Ѽ4#G,;vo#м9??,xZ1 _ܵǤdjfwHW` -m{=wM &nfu}=n/xT$u$^"0å2[K_{]/*Y6W &BWm6eLu*f ;֡yD:F)^OlqWhNi$Cfb*|ͳ.?%/) FO'\qK)':UbRU) v2SР1ڣ%I/ fY*3+z8yhJ{55&C'0Y݌iLik.^>aR=o01s`*y?816`F0By1Q8T>4٩2_ :HNA:sm*jE[gWxGh4c9-\ rR̒`n&R-*qW1>(![LhڽDFmv)>L,cxֳQLr1rAl}K> -dsphi I_+' N.Y%rX .gcA3.S6s[V(wl5uPWǨDUK=zP/v9$ Q4Cة[s(P?wL\)Mtd(-胟="DrH$,I9istDU=$aʝ.M\ n^iN";+:Qyw(I;q,2J È Np)[N\x°cNc6ak׺#@ʭwwə᷽`2|dtg; wwX K73?MW heeT =ƿgZ`lpMv"ebGpQd1 g/lG㒫Sw섮 ׁicWgq4~I M2ʠ Fr˿P D ;+ cAPYઁ(Ys(aJ]}2`/uI?hda.cFE LWc-JnO>|E'B86= iSyv`SA97{6SmxvS[TFhU vb>Kmz=\$Er* T˔B[)6cdMιٽvWh 8L󘗅Ԏ/! #M똶15980ģZ"E]? \B!uS(E _lC6Ƀ_s5.)_@GXI8"0'FfGgz]F,?CEV}!<){-v.=blH'm4fD{ ks'?`ʩ˪͹wa|VDbM905οV1!awڷP"OlUS仸n (xx z _PQt;ԭ֥%QF88zn d?1x[P8~A7b͑ ]b '\uّOo54=E{jYfq$p *ǟҋyO~!( 3sj> 9vntPhe.7}ZžTO 3j/s7)2s(t#2pn/]eg5x ^Nmȳ xr~||3=vIΟ6ʃVt7Zύp\VPgS!RH{Iyj_1] QK |r-wS87Gc/$sxU巖RIk$uC% aڪP ^3tb$݃:fAx2H: {YJ̀yIy9I/`Hbyըi8QagaI6^M&b EUxw$]dgF 75~h`a`_W8^ǩg )pKy `ޝhTB5ʎkht9W}͟LJ9q_;."L{br$2OwU8$ϩPoMnv }_6"8=;ztqj N"ީ)[dOG׵7" cʱU0JC[(LؤD"Y2Ȳd\THI=c"gh-m8lM>VŵV lNK9j@ӯP)Ф&9'-,ImJe| /a=WxݥSvc4_qŗH3xgQ JưB+֕>lL/z * 8ܜgA@):-*im2?Wk~ąjYc\(SQt0v"y ]i|T^쳋Ii^JyֶIz`%zIџL,3WH&޲_YwFۭfY#"Jo'*Vf1pEo{'+r+#g8iTfXqSQ͸74a= ~G *mu[p.8ƭ 0,f7n]!K؃nDﾟ#Kxn:NZ]ZUj}s*ƣf$79N>k5e_37PCէ3/qjݹJ_‚F:{v:O9{^L6"FS<$g0W24@S V{=ufV \^uoC*K뾋J/Dl',\+`ei@1s4nץm}# gfVACMt)Lh.tj< G-$($d$X|]M,WQPyS-\xs@>˚C {ZdOdw%CgERR V^圿c=oRKwKa*$xJ,LJ{jFDdG,=2_#Sg( 8 mmvF^KIu i%#9(pm M.3"j-D2ŢU& PV^.㠝A|Ay4A~U&AdlyU Mϯb4&Iڿ j7܉U\sB==ʆK`As D7( }:C|z.){9A~/0y&3OgG aUmI?6鴝dNVܬS.dFd! Qz1_ׯ䶕ElQ֊jˈAvY%?'8LX!}Y1%]t@[\xHΞ>Gʡs K? ӊ ZѕpL:qhsڌo_kuDJ`%ӜZuPė]y v-gQtX@B굣JǢ8B$X bgEb@65rmZ)q+©|2:⸣$?YI|vUE|htjv@^I̪L:bK ﻃǂ/)ۼ%fP;:\z "[Vx\0[Iw'(O_(GZMo<&7#s3DͯLN;Zwt/&YѠ޻ Wu<,̴9)KNcqNڛ7_0Bu&L B|[~V~SXI7[ؿ0g;Lc3%K4|O?/fg/BԔ?F 0n$QE>t7]R\aF [s5v)ωBF7F,lq1ZK,vW,>Br{2 szt GG0 g,6:b%]+ TX^"w.6hVQmAGHy[Sqt4k3h(k#4S>Pj~dN#e nCԷp5` ^ԛ2EXbJ/ JU0rj\( P_멊{OVe2_L+|"?8Ѹ˷ul#cΖm˺n`U`b@X9RmOd$X^B@ċ}g6K?xJMk BXUt13 kBq υH< T4x>9@ĝ ~Fq0*\!qWX+ɴeG&Y~1kV>1WWJ \ 99jbEcClKG'Y3Ef*= *6qM؁-1AX2<a[A#%Js5u:KޞK\[x!q#.?4 ]R,Z܈CV6K_?_H2%j?Κxs;'`.Vg+`a.ԥ/]:H}b&eeHQ}Et8Qxx!IQ/\f'Q \y}<|JDM\77Za[>(G{9RǪ8J}5Z 3c$ԭ&weד,P )I]E524kW6w#"B{ ~߱hC6 ԴB OL{IU{d0iuzCfU}vbwLb>#݁׽2e`&$ R]q%>NY)P,Ū~ ]Ld.?c63O+ AV:I}[ftlp3-=wez/ fcbL:n\05W@y Ɵ@Cc^errQrTEqwP0`CVr?% u+ğkY+IgX~ٖ-C]wn&μq&9 LFrbU;]VZg@_&bD !'. k{9 zKP sT;m+>qu}ieoEqCf^~YmaQg+u^ksax,f%*~H;(='Kذ;?WT=s{flpGRpkkuacwlz'%f c ļcV Mc,Y#"ɺB2q遍'ϏȜVqۡ 0uEo_Kמ!;ut,_H=4AۉIQouYSgz8Dy'o#X d75J7 TK4;*T&iR,# Kpv5@ke&f=ӅtFW u^Ab$ "|>Jb䓇W{?q?j{$*?*xH`W"/ɫZCwF$> ?LlYq*B闅Z`. SGykNG[N;Z/^:a }|粸7a8)<3憴Ÿ+ O~0W7Z7fs/[ZS)q!$b +x+(E8Kpv,#m/+ ❙\Kv(9ُ$'b:Ϋ9>T@5Ϩ`Ag^8ol9Q~9]+z1 (y3ghՒ΁ƽHXxV䠣'@%BnLQL@7Buk⠛cS 1uE]Z l?h)B)K*0{B <ҝ_'!Zޠz%z+J(y)FLJxQa:)'R7V`]wpmSė}͖ h5:Q$wif44ؑeBLlfk{J,%" p C`g ?F4d+ӏ I5c,rdV/1Vƚ3d NLPhs@ u'cO G! 62312탧lhK^:Wb]I1;fd 'W(pÍ!ZX?ݻ~K?k[#hh`Hp=j]C/h-kп˘z,`¹UomTK?It} ^wq@VYՂ 73UןNQ!'N]asWGqؠntZXD#$$J@޳䠩OOYggj^֒űɶr C1}\y/Z(P 'L8<1 Qڝ{CO &~GS>y8?vb/@ɗXΜzJ&lX]: 9#0{ЃT};u ɽD'knQ薚q^应K᠁o\9A}- uRDriU hvuJ^Xm0i*}9St=RոyA'n˶:(aუа 3JO(IlF+zoW8:jr  !Gh b|sY$ elT^?`6vk%&WLEbqK+(nOU D {RMT Ea(`A)8 uf*TX%@8'@"fۡ#^aԉe k> ;<{ҍwJ@N9iB-N} +a-:iQ=t.h \eSCOA]Fw'S:<'K̛b5"jsj$SyG.8&"'N1䳵'hW!"W,imvCCU@6uBPYjix#ԖAduGYIc֗?uϚȔ0{zF3pfR.!).˫6o9S)8oؖ Y-ƈ@Ǣ)Дm[z:G.`5-sX*[׍Q &:J`A۞y|ӗ<; ۡIbe3S685*p]눛!wK#o]~_KXo#4K_{Q]D5C]bYް` =1IǑ.fcsrZzLeAdk>(в8Ge]乙Ą@E3=#d ƨ%#hPڞo#J['u*0Ӫ?ܩUMp2u'q%"vح[A?05VOhj>0wHhMm9PdLhyB<5=Qcd6 Xqp 44 sUM)J)! fG)9jk] ɨt[/7fP׍i|D0~Jd9xskV W)["X_3.yŎT6jNw}ߏ\U>;csv kܽD6U/>)P[\1RkwFq+O;n~޾l}c WqSG.$Z  s(b^ܥ'faT})Ú:enywN'[\yC;7-9׿]Z]->'81 G{HT-~a5 S$!nw]X1Ara5FEWI C0{,sU8ܽ͏ =6@)k_,-rê:|cmtvW5֕`Į1N)ޕZ` CwaPk~%/Nۓ~u=k} 05|@c_[؂H) y&m3whmP|3̷/ݸ"8t =aOړ;qKCn\z:vi=nռN5|HLLkTO w1i#Sy[ u!1qc2 tOuul̇8KɴDg9*\%b<AM0Y2Pu'.0'uij΃0bMT%+- uVl.iz݇f[QDǠ17Q=@*Wp#3rRР^O茘1/g+ZQFdOcqs=^ؔD*k"*u,߱R̩xR[yva"Uyy>Y}45?/@he[4Ь&t5!x;n=0 U/<7*fy5{n͂j_ĪaP6р=4r=VBht t_>r/ =[?91Jnӌ ]"1*% }"aN6u%9*uw`wy3-$uRXThA0Pt_<}C|j͂fU69zk7Cmd.!Ԍcˀe*ZLl.*dC{ TcJ!ab8MYc!ï1aR\"G}Q=гߓ -0魌.0XMbCEm 8#F8h?G BGt y}fqd_.w}.B.=ha}Gla᝿[zȨu4CN{vHR`*XW~<i|[RjC|`Ȗ>9FrYƧ=0Hofӡ|UV# 6+Cai) r;vSޒd>AGPjmʕ#A `Hs-]tm  vbSIo_ӦEiٚNB3/}Sr mi-Ll-T5qٖF|L1SNFk~G۩' ʈ>$<g N1,eJ(RF]AS#z'Ljl '//ck̡oDa$wlbu؊/Mk"ncF3?'RAuKumsEg?49<~NMzqӊAW|t/5TqE`m>ٌ8-SK7Ef琉o޳GjQnr}ᄗQ1}-CL>^qZ!S362TʐH)RL Y˻а3_7XDK 꽐hE'Y/u*2Mi(%XBSOR|<|s,z:!CKJ/+GњD( :0@E7o,jJYZ{L 3hl 'm\:k|j[t‹wʓwZ6(jF^o|M}69C$>I(:18El hQ>q!j^:ͮ¬ɏzgsbGG0x,?6߃)Ԝ3\qZeYtme7h9^zWs7;-u`vgz!}ںɋ4b(āhO/cdch,8s] Еp囸M&g>;"N1QBb85eQryVCP݆T{X/9ۮaGy-2\) 1PoVk gI#QGcNor OWۍ, ]Rb0oUzOԭ¯B5 h6nLY+3W5+/f<|]xhhy4]ۚwg50^{1܈6 }L:w e̙#EUnOJ6h\茓:4g#<\bt?3"oVO~b0*<2jJ.yqD_R_bUWhk K8F8plc3/IUGn KMb{Ej3TWz g".I0UD`eR:ySŢ'h!Gy,rJP ?)~.> sHqb6SF`^&j8Mdxu5-QLMbT}c$_Y2C+f%_u5OfOXf}Ikw-91*VDhp9 ~=(r1SjQ"bkaexNk+VGR{s$ؓ~bRpl9t~;@-E5l!iUߐ^l-*6Xkpo kaųEe-+n/<>trlnW:/=U=ͣ(ss ip6T x`qb|s@ E䤯X6WqJ%&(BL-a~!xz4L&SPu 1kOF/h<8-\2|Yő/}F+,! An|xP.@E#jjTwΜ~ E39;ӷyIpJ^G,1(^Wk޿ (='X)zLiˈ( NQbg_ʇo9'M b퉇ōyrIRlM$/]*glnBBA:g+G1#uG/#?GQٜ QX_. ťW8 {[jS4Xu 9{MUt'?9(8$GY+? V_Ɓ[7T`xy<噅.)u|P_)p_a-j' v͐>[DŽ'›]e*Te {t[`o";)BCyX})+f8G~'?uL 5 X?X %d &\.R]&5wQ/pIBe93Ǫ5"Iq;Ă8ms^yHFv\ޖg 4g Z>*.6-R#׬DyImc3W30=;zğ`"]P`܃8Xz%JHEyLWྶZWT"ź?kw$sMIxhaw4x@V&UkK쐾9]F҈ӞffyFABXzHbL8޵Ծ \F >gP_K%K uՈF&˼1OePP/wVu/ K%≮SMYoy~"4e6Czc`q]?5=b}]Xf>?"%mB}E"q_=.+3zIg$3оWȓ; vH>hPvAJ\(nRT w,/&@{.]ӾB2.*m5AjFߛb][PH Q MLr!fSUPBM), ik=)R/GK[e ;a 4x}e܀L`t,CN&dn| }?3 *r V6! a+'4>4$(m|E޾koJ@T"VM./\T!n"XmǛ7VMx&hy>@ICgz _\] [Qp,c4M¢AƺCD.+xyWp<eaA^c?OQTZ4dpj*UqrCS2CnlF6wI!%Uhp27|߾Oz۠Yz&s$)ͦ#plȵsEO@8+'y3T=-9:m66u F1;;}P_.͵ h*X-:P9S+"t*UNbV}C\7j?|O>&#B&'D2PooHu\I,)w{;MB$?0PYwÞ kXp_lF޹im*(KڕQ`S^>S4L%[ZD};8tY{٨zEb"mH0͗.rX3G#ZBvS?_ VchADRu-OG 8?BWеb}L HK"MbDdz Rr4 $_ €t VWklQ'V<$(Ϭs!ĕ.."6gRuOa7@QW},R6/Zܗy4P{H>F)lo5!HܭNuCeRdPU|ڤ;how/A!7a6c}ϯ'Ѷ-$! =p5ѐK.[We]=BhUCaۿ337uF$ϝ716jLω8_6o<5gS3X-ilY&td(pFL2G,Xb?AlJx3u^^XDbvuHQgwritoe~"PO} lŶ nU :w-/Y{1wkfh/`9(wn:">Ԣø0EVh#XJ@ \ R Տ .i()C۹k85{Y6#*%hp}VcW:.!>rY2b8L^;Xd5aeVH3*K؄[ussۆ]S-{"*;_'/ltHfj諸NCKa*IДHM4L#O|n~+h __<ߪԲxzoT3^!0m8c 7zE8ŲHA*kxp :%V}aXO;hD!URͼP|8gI8ވs[?M[vWREINP<{:>xTVa^w1̷?vmщerPTHhL59g5>az.J1!jv(52zV< Mq iR^q%x[.(pl覗3jM]ME]UR֫[JǍL1ߍNjX# 9vS LǼ\{:9Rp$*Ό>7'*o=0@ +'ߡT/I ܨg_,"3;=QBw38_"7'&\ 8pf8uqst"L\NcGdzFOJg@uNUe&9i۸(D٨cyO)V]pgZuA?&3CKz)Ӈ49 c"9wd[zȎLmZdl\`XQҸcoMpV!SIZ j׸|zV_fHeT*5KM? {uvct*=aʏLOrg'!v|`Aq, 1Lu?.qwSWےYi$B3#xH5j>ߧ~*j§p xZS|Bt e#PTM#*jc%Yٱ5!c6S+!J9.P__h(ԬkII8[* co4/4es -M.n7N7r eGq3ݮ[%b^=A<#~s][Hq^QB]n*~% (3Q鱣$:lz5 VTD=H)[Z])HPVJe f֞'_{b;gYO7aH5'3s{^Iso% ?^By'kBރx=s5hZ4 0Ο[M0VuXҼW:BM" /;Ux QFw#y;Tqsh&ZWp kY3{1BƭAm4J(t揄G;Ou|Q[ctnʱYa o6iT4bU))#c+{[@R|=4ٝS1I,W`57sY3͍˟D}ykB_Zq϶Mabn(Iy=$TaNFWBy$>|[-LU6%??7hqmRb7MmNᔬn]sf>>&B6]rӎʏu\ l)tEb M̊ʃ[\J sV-~jδSJAWH0 )}V~DcNOid#w'}.ccw0d;-V@I?wdM/5f0F8'fZ_Kgk 4Ej@7vf-{o-J[u‘yeek% -J0ɺ*T'VtvN2źl8 gW徵ʐ+Rl#ٸ7}}J͉9|Ź}iu\ K5DYj!eeɑ3p>4q_3?j+4]KOwO`,jqꟙ.빂fj*k{tlҩX}(s1J?Yk, Hvah*f'&1%&Р>dZCȂQ=}Og^YJ %n6}mƂ#9EH+v[IrՉX7] vwJkm] m#ԲGydx"6,EoEEʐNSop" Y~AǎkTVHfp㭜ļwzo)t;5GOEuEI%Gji87kzv s'XZ|dijn`k:5O"GRm,&-LHZzdR/Qv l6֤?nW~Z<QY! IR~  Dh0zN}(k;* $+.}Yq2TW<.iրzNxr!xlcN2Dd 8j OzvɝOxS 0>@F6g^*$p.wWvN;oR*uĻ j]AV; &e+- ϔJ~mEYjFzUTY7>=%`8cIWwK$yEԎŚ64|ֻ (5{Gz?'.iQ>of hZY}lhIbqA]p(.i5XԘ?U .*t8L^X.ؾb\m ׳fA+hG`AM8>|祰粼\%bE~#>oLVXzn#iJwϻҕ{IEOB>\&TȲ{!A?Fqz3@sx`"pL)Ӕ_ &sqamVh U>jAXֹ6OzLEb͓dz` 8Saf i,+4+5mnWO*%>|*# W,&W_1oWBҼorϘڸJtw\s͛ޟ2rzz!"I{w].7M )iW1 $5VŃ! /vIک-5B۹M#؊!r=+:e}=X K*m/yj:*.̓9CȊ5CLlBʙaVT U16`fFdRܜ9*>S(M/p1=9BgF "OW羅Y&9\,TfJ,x'ꔼ jӺd¾oojN wFq;fXr3z]憇UՃ+iaxgKΫaN9dhD:?;cdPE滬VleQ7ByTS&lkNZ,eՇR}3QNp*&tԣ<>)]zV柚,h8}pR. 0TiRSUE4բ uo!?I'iΎTR)~r9bV#*@MX+\F&9a{"|sLوG h:ׇ/&e@;ǐo5¾0wG'MhEcu ߠmT5P@uvp)U1$ e'Mx:vY$ z|憹C4q -{M0mՉ<=6Xqg6`5~^K <felj2gL )Uz_8;0BaSh\#72IhI+`SڰiFX ѿ+.~n7=<!uqwKx5-SsgB%Yu r  Exlޮ]ms!3 uWMkZaz:9q?,9vT49g:;ieFE|ma  37m Y>7EzrǰsYYiAJ(a#𴎺2J; zabj7D0p#0&";.,7=%ޔ&#??y<[Ѱ).#=Ih[{h2q!׺5r ŭ! 2>r\dYxU) K?xF3W 5Ei+'MvU pTnv;q~)Taᑶ㝑tkn=Bt;jW0IeCԙHR$Zu_[E1Da`$<\voa8^upq4S>]3h6*) lOQp:9!@B`Q&FQ҆q-MiFZ(7U^Z@NW=])vJt9U3X{Za>:]NrFY$8 /E1D/ @}wIW#ա+З -ڣyT/Poc$O^@Z7:)9q t=Ȗsfv爊]ɚ (EmÕ6 -}z^㓟:INJ x.(%qhBy!p^IO$(WLB)ctr-6<`CJT]W=% a)C@." y zrQ@{Y|Rt$St˛¯BI/Lq4e\.qoݟt+<3Mͼ&#"e󄎑w1/*H~}__7u|]`̓7L]QJSFBOu5YbS R jo;/_BIf1,#Bĥ}z~Pt"! 7em+~nwxߙj^cLx|`0CfL (>Mԇ/>cgxpI8lp fC> Q-2WJe:ϿN3V\k^x>\ W#k!·$~\2Yqa5Qc8o'.RnQJDTK R|Jyk͡%!X:I姕 C(ouomE.?+7{eIU~s?]$C5ɠ~mf?ʯ霑DfX3͌U7G]]7"`;(|wlj= .R">wC2 w'ϜΠ Zht<=Ĺֳv㴂cnOHƺV2]j{mƔy+tb"+-P~>FP| ^is G2C6s }Mtz|)j}ZΉGc|D Npr@$r+s`ik8l,7l_MS"Gcj XXYvq3"Υ0 eki 瘦Tm1fAX/]:BqFMO_k]bq6_9z'|7uV2 W<"\+ԿU.b:"8TH\ oW*sekJaJ]3P),v`^. NE9#m Y=|}龑 q>1*~OM]< сf-^+5uMӨ奘B,s(LYBI+èҹ=`9)FCtgcx60w r+~p9B!% A5f,/Z8Ҽ6LoPQ5+ ~l>+z"3咝;/lL6Pߧ nN艹M @ATd9khɕˌ\D,Cg_@މ.Rjq[8^Wtm##J1q{Bs󟰁e麸 ņĚL5A74N߳qwXCEl\lFLQ=d |Yӱ$G~,# YnNJLU MIvpR&s,${f+sNDk"9ASilxFx'xBy 6-OW]+A߷sE(ϢMV&R^B(92~O@,Yn=YѮ0=+֌V̕7-=}vU1hI DDx09Skޭ .ϢЁaFZЖ>X Ӹs~q 1Ŵͻ"?3zu}0\L~G" 5ἐsig66T$70h3*#aR谐:l z RNXf r3};JFᅙWrO4HjBR+3Jn}];>&D+^Kk] 6^B2Hwl͍g"OKe2ߖX͆6eA7Iކێ4[mRђ;,+eE\[+pfF OTgk'/z vkg+yrb}Zˋ*BФpECJϙVv_!Z)*j%m>pGS _nGrkmӟ6#"A%X#cꉢ7eOI)pJPbKkjC˅p?>1:Q0 L%_K9XɿJ6+g~ !iRTh:v N;ΥQiTt3DaG SҴ{_JHo"f oR5k^XDV\H ]n^ 8pIWn|H*W-iR+\4Bd8]f Vx\bbE{R=3 3>rN9O㻘,OM 7dSAKD`e*!'TNSuIa.dz;كD1wȳ#r̫/́>z@.}҅ʈ[ ?Tckq F@=;&?ר]I@k)rKmǒlRȘPÓ8e֋o^7ht6#}+ AGS }e|ⵡ.WtQlrn I@pGR;|L薿l2\d71 G=kUC9͛+WeGZy[&j &8=X!ұ=(YXC>A7LAZպfo}l4E?VyE נb.+DZ]Wbʘl~.ޡ(^,DJdgTMhvL*86LY01FH&Kz XQ=>;MxOU |YG$~{%Z>S*eV~ Aܩ-a-`up*0 _ַ۹!xDJWG8ŝ:7Z%T:b([wBf|}joN+'+3f13\pcݩ.j\i[M;a W-YJх%4PI/#3λJc#2laurh)$a>C>ރ9Ϧ{;~ M0:+2CșxÆ{NǙ )6#%[3 QlK+:̉61_Er7l3);н#Z[pg]KnJehz$՘M"/r:}?Ͷv9B8gPZE)ifLNTL-fp~d"> ;jLǞϔ!}.P!v{yǚOdv1O <V ($/ T4a5Ϣ<8&;xd,8g]r|B)>(BU@O4v>|a~%Y+=Gl0UoہAA&(p(~tf\G/ 3n*{{v$eG{jY@\wܤ.A?q>GPvtHz 1Юqzpuz Xj7o7jiVMHRny[>=2\SPL\}qoG{4 L~0-i.t(qJca8⥹aQC+u6M Ե3 tׁ6D[ ~qB6PL] $,.O&o*n]ը N2 E@tJ\fd>~Q'e3f֪v ˶rpQ\V;4wU8 {k+Rblqk8֚kFҏlLʟGHؠ{3ò#K&(xsۅ?`$ v$6#_rF@Y9y6ԞYE"\]&)+A"gIWD[L -b[#~b"Jr; P+!vbNQbkf-WM IT'lJʻqGUOF@=CR~&S|-[.6Sm҃[B:YFHJ*%(hѻ&p7phgA(?>i9ɢ|F}uNB[1<ͺӳ)ud`jr/M o;yʎGmÍC J^!׽|`8]ɕ/bG٬W;\SĎnK_ICC23تҡ_UcnYX5ۧbD$+^*}H^f鳗d=h_mjq&d}=l^bq(3H*W@ɼթ ۚ,\i{(-rʹ+%fӿ.MV=tEyU#aŕٗ}1oW>n_RbhN´ M/sYㅫ=Bf rw!OF}62"ffھ7K>7p~wh \i t(?6u/FGhߦ9z^cUm HZ2[T?zhՠ7d0S-=6"tm,po+9tyq<͊rŸn},DejFdvcYXM0] ! &]f_N 4Ϭ֎\`Br!~쇨[-KB(pZVHV, UnAs^9*#H\B܏y:` ,mlz Y##.a d'79NH VcI*.r#tVTWi2f Z+c{5SJdz&He SyH7P9ief`-8m ~M>Nm-0Jk ˡ$QW!ͯ<;+?gk 5]ԛ^Ca7H,(|TCEJHhJaZSqmiXS%~u]?*~)=X2דԫ 2[2L>M+D]_.R}݂\7G(ERap(j8V?wZYf*KPx%X"kI\l,<  ^_20("8R%Y˂DOe.Ÿ4 2 f"p(/BM `k=֋;5~!9 5-UK@$2Q]zRILR{ Q%0=bNd <8L1Fq*@:\y4%_qď3/>Bṵ* ˴ݏ?ˠG$k<|b-y҇Uc}2>2Dmiim "ZnE]^MYJmS0&>n8Sg9λ%!jV>oL?^+*:PI& T$tj\ k ^3Ӆ*ZDSi0;JV x`ܸKUR2YlBKhS->%fxϹוF6kX`JMyBk"2 8<77TۚR=-s㢧)Sy(V +N7YԙǸY\dxВ_ ,Tc_ZW۱{L#*K@5b5ulpUח؀=qR@3|K|X~8Da$&a,p\T[ZqKSqqHݤ]_j h5{YE֢tk*[oc+-st2/ʢ~ye/>a_v ӸOOE$blN ݤȄzgcf|]JV'4m\s!c$4;7IŽ;ϺMcӈC JxC)Ѧ7JoJ1BIV\<E6|k /3цMEjֶoEOy{ԋbjJ&D3khV?:8HjRsJABǧSՉq\>KhK,RG kM48XaFxTp@!HV8:wd:&ʗ, ΌC^\Z)Aqs6@=m9c2# Bjie(3y`K;"rt:U&^U<=GP7g__t+ A0o`/Ԭ @_&ZVm0)o}VX$or$9<"&\?XT>\i3ɫy>v0[=<6KxKtCե뛚YwǬ'g& Nԝ`k,른?xɚS06 }/R'8s6m޼ ~mRfTO0ޑKb.]ԝvD܂ُI qPГ6:lNtsЬ)]J} =xvud49X)M d'r]g~pȖSߛ]LbekDH葷02r7f,sp| >jVrG!"\KLM{)`B3.lqMP_hA7'v 7f Ȩ4[0RE\P;e؊hYm<"Ӥ51[&ղ\x_Y֟cH TeI1B!Cf_z]o_niB)?T챈nk\;/70gj֒[ֻH_* ?lU\'e^HGIVV5ȴ3Tۼ9fGr\e}&*^:I ~84"W cՈGD I7$}iQEXb{{(M0n{y\1P31Лܽr,<~)1;ʜ.a,I5QF^f 7Xɋ5!`a!`C-%.ywmqt͜eG0zK̴%аKB[:6J˙*}t|Xf H"+1ɋoY̮ax2)8-1KX#5iDbG9L`]Qrf)>)M4g6{xɼ&Y-sˤgFAS>z237@:ի=!Q B&קSt&lOޢywOcFYkȍOdnE߳$uy>_dd;Ǿ:3I۬GA(D -P7\J;o 7' ˊo H2?SljJ+5& Ԋs5~Q|~B哑&DhYRH:0tdOX&7+="N :ˍ`h <9a@۱@}Yg,P(1+14rZR=Z"Uv>IpOmUJ')W!.l>"kgB@!7eѠ/HBspPhpaT$KΉI؍4UaJ5E 68gx@Sbb?MOw$nKBgje`INWpSfY*+ >0ךȀ{=T: m/VwY #5auwO?ZFMclߥk/@iM;!(pvrtkTߍx?*sPot$'MRWz10,yn,qCpiyDu8cfQ Ϯɲb2"q"b=a\L#OewV!Cj6io$x xR8P*2pbctF+$1;?׮HiJ? Ƃ\xn*qFYTvvǚb:h w&*5rA%>\1L|?$|ΛWg,XMxwpU:h{9Jés e^ 0#n7rrj15h?,Ue@acn7`dW(4/ȄkAMF=p0>n8dU0Pǯ*&ef|8M>ګC̫b p9QY;X?& Xa=/xnVc XsW`rݕQGJZFabvFqa&r4 c~T+7.?e0!*&(w{2HQSF0znHUJ348R\ۿ@ ˡ WEPJWL< Xʳ)zSqlZQiM08Ef5yȕHV+%E³27Ђ萳ˌtV>XP^ v'> t^-bEr:>bG`VVe5 $FxP>G;SB/% gE*) u1D}H+^<¬XĚQ+Ze$K*Vn:x5)K\Z=ugyǧU>RѶ%Hy˪qds˜~'1l*f7mV k,@([>zZICOy|\rD1a%R6HQbl9'}@>;Brhs҂+,{ȳ{$ON[gc;%.?/FJt-¤dqh+>Wa1=+ϝu"!OrssԞ뛑P"ni6ek?8SMK)o&vzZn  Si-X묐;]v UkنI[]P \R=m߸ۨPΪ䝖=EkYCvoc"UNeEsuF ^`1Dai"IT9#I9c hL+X D"%=_Vޕ3V22 2]"$% H JxSڽ(qftWhcvg4sc-+@_|%Zd}Dp԰5߂Khvςʁ,.xlD;A$iFݰ!OU:A,~k~:j1c9Hɑ_ (P#KYӽ-cUpQ=*8oBֹs6#%{:-C^6LE)b՟(shMBhJ;= 8CDYRteeC1i|_154+#G&2f M P͉ yڹӈC]^#1&ÞNR".pn7RZKjZc^C -9(1uq 1;rDGx0%t%f)-Rw5:DVG: acCb`18BH'F\&7 T-4n"g?ޓ[N:8 g-(-~]+|á x~$@~OM7i^` FʫSnh"_~mhxGQ&n/;e#{dK@eDx/S9DreOދTYq.k3p, kRB (1є%(C{Y^Yzơ-66Y['M@A ғAEqBc[,b&(H7ZZw&˷p *AM0=!P>_>ZΝP,7@k3^a# i1 Py(]}u(9\8QOX'!#`Q֓TI迖EܥJG&*7R-8]I@,i^nDB앋ᶻWlg><+048?inlH~SR:0݄>x@W%X0Ep֣O$ ҵ#-Ռ@;l@>e5#KAS~KꗘE|m2KOYLf)i==XtGp嫮Fv~m?ޓB?"dѐeTmg4`eHy>f?$5E >C8}qR(ouߘΨh~@`.Y;1Fci55* sx n>[ҒJơGem ) /#qԐ HzgUgi]n"8qrMHj.2DMIp2fB:ckANKF PO+_uһQj&jRu&pm5Ó1-+q/񰸝{U^PUn&yµǫ=ky6܈*}=-(XtCoNZ]R &5A t)B2 \/ v;B^]_0%_RbV q F̬aLFRຨc ͘OY@.c[串RLx`ZS!07AB{&'dvf?H!Փ"ё3KվZ\JV|!!琰0 s*q+qG+,$`E;ܘ0-a鏁&xz.lIG׬m7i k{@t"wL3.7*Muj(d%Tg?e)e20A@юu y!sbQ\kv$e.T<<յ/K6n&Kn E}2-oְ X8uhY5v6|7>jQW]#bYE]Krx1D0j g15v\ԓ 6ʟ# q.ՑߡIGomFoꖌԙ>ȃk`%^ˆXaV"Bu2DS:w"7ڋT1? aϭWMoR] ։q5C A2ڏI8]֯Zn0 6 l),{R-L'`a$4, wPY Z鵀@/I۞f( E5x:y.={QG#_)9 n2.awnLK #bxfD.fdWe@w70=v},Tb -%=v' Ooklqԕ(S9QH :L"|ENƶaH:q aR xT9YNdg@s` ڭl y5R]vYc6߃s,^7[=z܇wyQd~]su+ޛē(/'0H:l;Mb 7ra`>(8C]QADH8 3O12*iYqTҵCI;,VPv+c.TlwxNMH?kj; G{Cxjs'3i>D<%`d۵KtA8e7|́H'1k?}sp( laU6h1-A-CUVԜJ~0-WV 8\:vث xsŷS /q$eܓF: >Gu5]P?X.]_{E.յN2b^-xhv$[U-}:DfD TN sskk!|x "7aL=4+oOSϵu&?̞UkxHCJ@nsR`l0m1_PLg}' X"|Bl}Ҳ褔v>l恫5F EQRڈ.v+l, 6? +[i͙<3("~z1tZ_` ;FY՚Ŀn-bJXnH83kmgA3<fxsTTꄞg!-A(VYM{sڗEr+suMnF@}~m7ܨJ!zMVR gE;_Ȓ#|z% Yi{B)F ڭܿuFM$ЌJw0iy;Q@4xa |=Kq|ٽYORYOqZß,=?( C]F0Ú.Q!GMh  `.7l_G졋lVu[݊^[+=HSAKȌx1eSon{1>d]D6]&-'@7 hltg]w4Ujy@vOLيɓavEDJr(/t+^OJu'?0b~/|7{lGUQ4W۲WKu:1c޾P;0F@_9&tۭīE*7I#eVw $:< SLMkT+U{v^`cIHtIL9fam +M.vÊ'])-ME_u/E'7E~u_Y0C>&"Eʆ0@ⲾF?L5X+m*ֶ$QӞ/+1Š1 o"5JiD^5O7o& YKJ H$}-GSpB$k¨@ =d cu^f A%j"H#!rZ\dzNB8Cm. .>cPydVmO$t%w(sƸ.܌XR9[)<)gcS:9)TΥZ]XE2DoWXpdѱM'lѕ"1\(bl2EcWbv8&|T1\MZT[]ޕ =qW؉qG D[TO@K7 ^`swiί'w4$C~KO]أ,\uQ^*8MqU /7gxh`Muƌ*6#^9E@{@#00ڻLcV蚣? F޷ѠDLG%%b1`QGA~m+4\l`w$nÈ1[: -kr3߱LAJOV벝qIW\ @UHjZ9jn9TI\sz7-Lb=ѳgfh+{yeݛ{-Mb^ז0ǔ'TJGjYW̤nslv Ⱦb A .q0VpdA6=Qo41ƥ@aM4_xT<ϓpi,g0I8BĴ2kA@+X̔1">eHBhX/v+z9tN~z?t1>wk3TqP7?j}*=b $5/\] fu]ȧ0{X _Cp'HO1gT,;`|(&Qyr *4`/ܳyf4w2w.wœVIf]i J|HRښR+֯XnݣS .ߘǵ%Ha=fͅ,DЅAxNe/ȹwEM 05NCˑ/U*)HD͉߉in7Jr3 o I痋8ڋy˵ک6zي^;X Gb'5<K!a;Of_YcB/ DU%3a0!p9ð,Zy}@PӂXr-*5Y[ef_,;,dʩxz (?lf~bJ^DGaD-x?YsR4E,Z!L RfJk!_ R԰n;-Nfev5t'bw.e@ J*ïL@~NћdMۼӦ,D+P3; A;7;\4 ?R| ~nb gلB23qI]s 43)O# _N3GSZ-Ȟ [E2ܣTO{| ^G3RW(s=# 6;) }+b9WwOC-k?vL?{uR:W\A`bl油B4Wڎ4l6|ş]E5Y\YbЋ\Xl܋h O:nn" 5x0;w"! ˓|[}?57# }Y<{F;?Ta-I,N"tٰ@~&XWln~IHnz .]ef1ϖ] ⴖAy% _lZ~()PfCn{%_.߽, (B.pRo$Pmk@w{1I\{}jOY\5\D7}Uү(ÕK^+:qN.u8&Ϋd|CCz#ʴhhI(-OQ{oQFoyzGkm8_/G"Hi1䚅2h* y7W׋ iK NjVT3Z!\N%S=&_k[=-=j˂3.D*̥Y=A*+^J}`K:)!/INZ+H5)BhpzEI9d04[:SueKzMpsJhD+fG 9j[ʐa1-XCZ 3~U1sJ`n('^|+/| nFع9c(rThoq'fK  2IZq꫁kt"yRM7Zi;^j{NTt$z8c6ZFiGwG̛+d˲F],?8y X%P)*FO!T9r"uHs[F!L$LLsI[ab;h~^1Ŧ[޼S& ӠAXX./unqK#~K'8] -em6R*29mX\c ڨMHʿ6^}[IZ"ʂqU8yϱY!]w0<}ڙKvNU`ۘl]e"'vrCb\/`x27rmÐg\+{hhue+Vhqt^Ud2F۔45R(XmNvz kTus&} Ê0cӵ; 0OF̆&q]14ZXt{w(VjkP@KY0֏9|O;Jv0/M$ ~?9npYoY@~=4h(Em]~/#WStWP#mY)OIVxYEtZ3UnrUkndg˶oAyT de ϪOz$ 2tu[,fqͫ(X-.fi:3P0ʲ؋x _kDSЙI24jĤ F+՟7MWZ"Oė4IJVTVhsLU kAF$ϟ8o~Az1(onp'Shd]qk2-.;? nKpx&#jP0\¬~^?բv4ſ7Afo1>!jjxzgf'"a:I}-.NpȘv}]f ʃ QE5$U4575%XJkኛ ?H&ᕔ? kSzAD{lG&EM`YeO m.mrW(s}' X7~R>>_j5$]-<i AA:XQՠnek{ ߻Y{#y`]>7e]LpZ nBc/'2_kP_DDr*n:O6N1 @^6?ҿ,a4nM^ ~V4'K;&=L۩qTݷv3`WTːAϟEːN?fe6p/ZZրajzlp{aC o"3nKy`~ҿ<"$']{NB>o"=kHCH1/ 6 }N mjojɏy \n&ל̣I;o;|:=2rx5py?~5+fwrERpwC90gU\ $ ~}&XO=[dSzp’1& )o@7d pC'C&Y&+fiQ %Hc. X\i:fF΀{w)v]6#S9jJ{u?h{[Vq h^n%s&Ī_p]Y8٥Gza/̹ 9Cd_j 0frgkg\, !V*7:VAl~@ CgrV`R zƹ$IiNSِ,?"H͚n)Xɩk/׷A;\U# as䠅&l!qt61h^yL&"&爋K4 AwDm}xH<欲hM(ꡝ#&3Xtmc|Y%r٘Dv=ܡ\se3D^Pш.o._1*N:'n/1ܴ'5]c20(%2N(qu:G֛eKRb]U{nְaMkl^C4?@UBX GFF$QA=@ůT xZscN-A6]vBSn{{W.gLIGw+>ǐr:&֩&caL ths]5 [seŌgr 'I5?ߕ%aF pыJ-E܋, ԫi[0)daa3Vrʛtbi8TĞAlB0s)\_YNd>,ŧ~riNubjSNmdZvΏnhiMFb}p0sge5@L P$K^6㭿@lL@yA-DKlVaQ N$J?5 C[Hzh38_Fb>|}_8Z{g-tt%nR爵i§1#-3W/jr|)|c 082$KZĥ@nUzjztSjǕ`VaCiܑo.NǢm8q^* Îz3jS3j맕$J(G%6!?"_$cضOE?Һ&x^d*Nu(ݡ<״K Eist9vCd)c_&U4s,VQiģD3 <:Ӏ̂ʘK=U3ZE0/1#\[Z eԂX6^3ʆiOLk8+ h`[1:8s}q}KrV.XmCyJN,@ FXl=nps g]y#>Ն0 䧀Q0E){/cCކK cS>i6hQ?gm#3p+ǵjt\; V\!`4 |GM^RV%u}~:x?Z){Ͼ'Ds`%WgzPi@^ςFQmxO7oe i?]Rp^kEVt5[VT vQKygDjKHOlnۘ\@Jn~:(#%&g޷BH3N`M;bi ѣam$W_/S^Zr]X=8v{xnE*i-?r|2Ze˿&Oh%UWwu̥J"Ь7 p͓D#.UmܥFVf%hŗGP0|f 9iw*3]FvW O.HnߛЩzOF(*rbD+x?d`ͤrAaJl*įsw! MX>H>ti4~r[Kn^:EH1~#iz'N&r7L: !QZvnذ:4r\($,ICh7ݙ*Ӎ-/WҰ!::̼#R۰#bX$J4!HF}R z VR>q]*&##Ct(U1e_ߑmQl S_'sP. (~+2hC>&o:&YZWf|a4o5Q=EDu8a RurkAv*3CC@ 7G7F PN}O>7Fg"4ʩ2:2D׊N$v`g:Jgj34 6D ~+aP@Q%2SwG.G9mQO /Ǘ75;Q"%5^[7&"T lHfwUw4 I"&7>l4![+)-DCLSLo4J۶RU,Fxү[y0ߙ:8N9f!C^Yw#9m u,,.6ADA*^;8G ` 3C!7k ]3aɥZ |@g ؔdw}E*ŗe4SأlKSs&WO _sr${H% f9L>o38 c=2tc[s@/)P6[9͂ҎsPe#v};p6`yt-˻e֪XlO L0m>t6_IR:y(W'kε0"Csoa2QfDv2o!WG?L|Z}#kp$\_^%5«:U]_(jqw`g9GhqlA{!yn]G.L|%YCic4jҟPӅ*YjRSߟzꣃDչm/ (mbͽw ]!Po!&5Ă$&(D8gdt>>t7ܹdwҩ$E;ARX$ piOfɎ:&$]lqD p@yA >hn1Q;^N(qB ׁ#&XN[a砘 I>2;G&P4R hYc*H rу#q]%|9=V}j;r3+'awv3@UMkA_ o/r]k ޻ B3J'|u!R@^v(̇ӪaMzM(?au'I,)>/vco&=4A\BDpbM[ "P YuIfu[҃1lnlD6l X8TO7!$cy3ͳKR, 9oHsm!D^ $ }:F.ˤ^ž"pӋh`[QsJYmEkʞbr{RX[#%L!ڥ X@\=P3jgI>/6Ƚ#BvBEL77 k1OK^Zʮa 6WBɆ GR/Yۭv p6Z{|i1ivZgǝi=1?Kw~Yk׍Z]4f 9XvjSv>YJ;<ߥ=McLYMo0Ѡ˛x_igfo&Ž0 md2~L| %?{fYZI[ؚ15EWXOlSs]8ɠLJ`SZ;۶F/$O4@",M,/m K61 s.N`fUJt!呤LԘ{K쒲1YE^e0&/J(Up@HmY pO(ocȷn/n7 62x((j\* To=}a`,=&_a99)":wA(Eɦ9;ucԎW9(E&-~* 0ڐ?띍z YBTjNe7bwv%jތ*+^[ ۮ +"AurF#sDe–3urFf2(L>6LloqbG9ݍ:9jwp헔ΥֺOI.rKEȣtҬb=8 H6 3cL7*&TS^.01B;U3_yJ&3}3)&SS U 'MTdI4]$7ͶءHr9vd|Ӱ SxE~3ipĤF` 6jDڙwnew=cS]C:2M>*cKԟ&:.X۽0*#gwjđeJ.WF鴲N깓74BX,Li.i65Qx|&\@݅hco$-`{ĢUϤ vYxyBv{lWyܩ?xF/NO κ1x6`?rݱ4׃x]ՐCbrgL䑈,&u~9aV4?}㹇MkE091l7QD[+Ha4nX1bWe}c(f&^$cHH)zA*OI s-FзGf5V#pcJmP_| pj8[pO),  rV׷xWx.RT%Z((u l0[/xǓT~z%ަlmF/)M*f?($s, 19{K~!1~@ Q,N Oj\V֚ 59h+ڋF^ 3фƍkdS%`}_R}Pl@!cGש$ iĮ!,ye İu,7Znye$]`WF# ˶ՍDWog= )c[v>TCyQ exif6ʤ<$K*;5kFgn &m9<@?etgP4@c[.NFilMVu F0̱![ $Pr! VT#蛖|(d+.QCevfk`?VOZ#*d"tgL!^pz*eL% oLňu6P.Y< '>zB1YAq]AXM.bxF!/e =1ԋ}$]9ע昳u=d5<(v6dLg4ؘdmf^꯵)@?heمI}`8`rjY !l7z(H˦:o\$7ج3x$dܘZ| %=( y[$řS̪*J&v]~Bsm#." 1" I|aRI<IS !A2nפ&;DCϒT l A$5&l]J,ⶮjbxֻE]sGNcC) ~GME;Go>hј|71WJ,E63蛼I4n0%EU |Zflz,KصXni,ONc <)")㬢'@^atg(*;\/Iy|b8lΟOyb.W ۮwۧFguh$3Hj 8C3$^/Uᥪ@f!I0>ٶg`IMY])NeOҬ'F1n e;A@5,rG hNN"ri[Z. n+"Pbg :xvv@:GLd%z"ɰCQ_4ffNGQ5`,zY9\7挽UcDxº1=k$@]!~kɅ;QRa)~vsT'SeNx}s(e\+_1Tr6OnZ#}y/V5G=#rWYUt$"OMۣ!['&|_K~=^q_Ǧ nm^f.Y1I5DVަv- 3?=QP/sma9WY٪/-b0OD_J֢?-?-ܦz|]i X_A1ja=lݍyG[:f]lʮW,I}GC]m'1,ZHDC(^YoqxN FrZ2|a:F k]{%y#&jSFǟ\K]M sa^<#A2.v6k]5fTʞ׋ؕZu,Y=XƖh=Wp O\@W&G{8T4WJ9N[E-Okpwn}J7{@b\cܓ9v& YbgE7|qGEh̪=9ckG|r][>.6[…Kb84`Fޣ >@RK*TbnPING Ŋ-NE}^#-; Hpx`09^Zasҽ{}r;P;у&gk͚5SG/E=hᐭZxS~،fz_=~Te;X>ݒƚ.?K%{X9bd^`8'<$>ޅR3C~wU7M֘2qОA%UbB:rHKx0Ң}|Z#V5t &EdNi_Be[dF>#GI{RW[ٕ\D`׊%xKw;ս97։Т%ԌU)稀3MJػIN cr+)Z\'~|w mXVJr}#=t7Ul툓bzӟreR3̳M1LDḀ(;j?@-oY\:11h4u0+]:`9ؘ-Ys-3Ay/?pqe$VLyy9@4 (4ǟSlݬafӿi[VOI*-"oy6)# /W&I {W]=A|q8 yJ5Xm4vriYDȁ({oqxwKrZ"j&`De&W0[7GkeU'JB|`OK3MED.',"r0$k}7%7/SLW2 aC%bjQozQo!D- p&ZHBpO^]> gYĘcfjJCK\x䰔p͛VJ9aUϖ ̼fҤ#)ߡ\/1L&Sz x&{\xW `,Ce\8P,=USI? 0e}Jm`k7܂'-i i6t68.ʦkR\~qdʩ+WN^T#poJ E4S.MMW[#Y<{j- 9SI9U nlLEXgM&k8 eDYH]蟶"A&8:9$ϒp}vXh&R{eMWLm^#u@|d@Qs*aҪv_vmMUo"n;l9vX{(ϵcA:wY5ek|l1ԋ5vM[7Mq@:er~Is@Dឤeݛ[$.gřڋ a&?yCY/+ $_UO?8jsRt7Cg'3ٮ?>tV x\G@&oW=Ƽ DFH:KND}9j/e;s~C5 $Wi0ynKf5[h!^nksE =3KVevo8-#?2RUh6b&xcʇB21ċ0mT.~0KS?j=5ձJ!M(qL5 <5։ꢌp=LS%hk#~jIŲdIIp1SWQV0b5 SȐ`47Zf6"!:뼪˝pVJ.' FɽΎBv)VuROf`ISIbOWuiIБe)Mn#OSi ,t WOi R–*G$(h0^= +{b<nN4UhLh{Qr\0vwC%=gvCv܍?ZH!*',봛{=g%,}8* j&q]n|8p:,/n ʻe B!j}nF(kb}[P[r)uȎYę5GT O+M~aرR|}l^ 5A=93"} G0kJ2xϤMr5}vk }\1HJNT ƯCaڰԤ0ٟ3dzV.M y}i3a%7] ?AZc\( s#\#Ar|;.]{X$!)t̷~C_8e@#i._1=۩_ 2$? `lehj[LrĨ4jQ ƫӏ؂euh {o%OlrMN}i*z]C_ww]+3 {8 ^flSY! Ԩ"gWGei.|v lk S ;VD%^NXfSBѼEBĕ22qby捸*ߨ H7^6KgBL3\e^C91.yA9?x5Lĵ5*+̖rWSn58ieQ\Ab!`'cb܉}I&Gq! ֆ25*1dۭj) o\{CTMz?9+?-8cʴDiu4GWO96EO[]& ^t+F1DμwI0O*Yr)ĿnٌHTt/ctyVT`Yg@ 0l 0~V~ lXI3Il(Z }YF-ݜ8h)o?DANyPNAǗ`sM65EڪrdG8GY?Z!2m1{ߞDF5zPXrKG~[`W_YHL[kX=-3/{u6ߎ{@R:ONuЗ4$_>zI <؇::g>2T^ 1d cIaVۨ0⣬zo9PAL  0 LY_I|O{3V><qne΁jyW_8ByR_{nTӯ.,={1^;MP`(or0ȷHߍѽ}>wxs$`&U ae[R0lbxwY)581=z r=ᙔ`Ae=r0`:8=/*n2 BE.sqFjP4JuN!ODЕ.*gזCų8p|_aL׋rۡfHNBv_| +jA S*\b]?BIY1n*FP^mզ{P&d.6)'8۵ F+ %⮎y5AYW̕6NuKdPtoldtXU$yʧ}Q2Q\ڦr<;$E×0:PBB}d.I_H4w5P)뜓6cv)$ԫ#&J0b74U6/PH*x(y*\Y!o)\@vA~Qҁ4r haNW"a=CEx?7X WX)VRF}6 {xSbIKm,rYQlfȟlb0L%t:Ґ_pq}-C*c6V%ݙ&S>fy6[.)fpZ 'd ;l-a ?#Ж4Y"5GÓCu|͍ȳ!o Se7)_|M"G|HPL/+HٝH`Ik,AU X9o2jV6;L fStY 23߮ [P5'Aۨil oLb1p+9kܢi=CՠUm Z[NߎŘL?#2aḘ٣ᨖ 99th&`d]5D/bV1=&q0,OXwےD)(mнikʬ22E2 u$1E6JX&QX J"&A4DD숍ybgJGq.# 4nC4ay6 ؈b ;ߢDCt̎el}I$f1{MlUu52$/9^S^e=Gfz%ntQkZw-_&uLu=mO M`:_` CuW _'NC:SmDuM?kptǓXҾ:hжR73Jw6D24AuZV4khNI&}r<e@ϡ5:lO(@jyΥ%HMFO!H)Ŭ ʖYDz5mSReyі}80;R{1=_ ߛ ]Nu={.fsE!'Zx#WF&IsKua%5, /UȤ.Zx=e{u7ߠ(;ɧ,V鲦ʹFS ߮<\5SgnfV&OsppVVf*&= ɐ._܊ښxʜ6kv[MqcRH6kOc >94O%1Ӗlܼv@S/v,h+Ėٷbbe(q>Px YƮ N!; c֭m+8:뭹qʣ~7OY.r_^2Hu9p'u&iQ.g;='JFHcPu27+ MN0ܦl;{4&hv5ӡ8.T=׆a᣷@^COphv\+i'nd8R@|7NLG#~ } c+5o]Ϧ yu% }Ej XxQ&A2l%}Gcs7~~SǀlDkgܪY_|A(VhQE>5QNv:pD$Fs]2 E9p]ˆ~peݯl(s=O'CQsqȆ7&o~YT)^Δ8ppKn۶<8PEHw\p?}ަ Y"uqUs<&HFsYu28ĊCb x8DJ/Nq:Ta[f-jK@kss (S̓yH˕㣍ì&+lJ!+i˩"E@Pni?[I~f$u9)v)1Xutv6Z~ѩ]@k'YbZȝT Ʋӈ+Qл[{T$-HgL9'?wQSj)r*ϳ$fIJK)jl@ZA6^6WD䣛E .t(%tɏ[|1J4"-\lUp=praXZpBOyɔ8ֻpL2!_pѿ"ec)/XQ(ZJygp‡<±@#k_D&ť}AA2@̄C:G%T֔&TZDk~t=7pQObtnƷx95/h 2s!Ĺc|IGhl.AEh}\З!ƚs,oBC1m歰u}Kӏ?9rt~d0֋9g6NYRF$Ehb($6a(k9\zR;`SL gIM6QZA[KHBoYh#ȉ8=*ͼlBgVȣ%%Z;}8N7@p΍_^60<(&*_b}7Z:4\H#=tQJ= 'V ( :Aՠ.^s17P= ȴƇx.dاC~jC)VVK\,&Kv>h&D!OEXjg`z740"&;msWzVx ͝DZN>3{`hQg(~<\P_D&1Dcw sDrDrndAOmjIj5n(\c? " Ã2q\IHTu~8X%>zqG+-I"/' `M=V[Y;[wꟗC73PH Coor-|ӓXZ!-ILvA @̔2Ą햔'*GGzq^͚d[7Y"-e{=fzOb.A/I·,Փ6l;f]:^ކ 6:8:j9f^4c6֢¹ mrrwyQ%e:Ȇ1+ yES,bXSXjagp-\7zH2r.(s50p`,ѐ&5 X18Pw@8@-nĶ[pۑr8G:ȫ'>]Z{۴z)SH0]NR;0O4o|#NysGpb-R狗1]=]|29~ve 1!XM诲5JW3=˾,aux5Fp-FEUZǸe0M݈rK+ߏl }mCxmsgE&*͙$/@}| #*K*-@ؓv[2VFy">79hHq|5*3z,(8XPј˘Ps"5B점1[nXq/<705gIGL1K؀_&'360@\U_}/dNyN@!#b jzCEiD=LN{ 5Uh̗;,`W\tN\Lur'tf08;JY4jD K۩o #u-bv-83ހHI34kkB}PZMù#-خZ@h=DK(*4U˾n]OZ!̭$r%V`QҎЃ0t9.|jRyO=*Þ:R>q~uBI!,+U'V(C? /9Ԉ+1&{˜s|`W3z:>?XMעݨN4w;?݅Ka{aPӊm~@S0tT,V[b wk){Ck|,@n%>nw6C'i`,iHdOo/? .ih7hV!超L@G󩹰T`'DX+͙aZpEuI u)ْw('Ҋpdb{e8 F4U((a>M1NCZٱbzX:y"p UQc)rvX.h4UO%'6=?PħPbJ=pSI:e}Ie$6vd~,"+H7I^Bzڹ.4*yvb~->J9k Z~/SmY ܧY@@?KYIJ…KC6Tr ˴*>m/LX&qasz)[(GuПFKϚ%A}4q1kֻ$rr* {8Ny%2=&d&ƒ dWփa§LjCh1?3XIBΌBs#I&OhZRLxl-6Η&5:k۵5A2P Q5ɑtPonNʽ}93-` }]TЏEyhtR |ݍbfQ1$C ZM&md?_fQUL'ncMœ#xMl9@j# 0ɗJ>+wn4!;<@8X+aHWõ tl ڣB07@(5߄ %MSzU90ձe%Zg*6)jNa^BZ }e4ǕZV'eJZׅ_b,Z!?x] eqI#{\ý Sa(h|@%NVcMѡoO"3ř&؇^sK̯hvekYydr\cJ=´\lnB'tz)?N{y]%eG1GMj7#"Շcgz: ۷)UN%_Mgr30g{ٜ9ܦdCt|H+!wS-(ܧ

"NEl8'@\)-ef[3:vg=܂[NCpV 'KAϪ@i2YV~ EKO`:gQz#ȄxޟnDR SmKūB{[,NC'0Dab&C71}#>=5m {ǘ(TjKv@o^A)F Sfv_;n&3vO H8:g_lZsg YW*跷MGDVe.ߴ,C:n!d,dk/|^.n-[v.՗Ɗ-+YKv_fͽ-FG[1JW{OSqz\K_quE_&XDN(<6&9g*#|ԏWVD29gfJwmSL_gF‗'{*fY&A)}BB߼#jQiz9$!#wFa8233g:e Hi*}`IYUH* ZvQZgdd9MxdJ|OIwEy2.Jo %?[L~*Is.lwPGEH\ SP آb0⋝I)2`(Me`&0+ ;pu 8Q/(dA{emC5ĈrTuT˄R}.A *f#> p[2^iFjaX3[52ëXe6OldDD}ohngmYd?Nf xdWS,ˇ !1`~f<]6fU̮ п N{S;X qL+{"{ %$ ^K%lS8< b v̀4(b"iEU7vLp*ٓmƇ|.즥lP2hئ"d:;<]#L4͸Aw ?)2Sk6O3q埒y#i-W;a,}4rv`K.R1pXp^Gvj _{%k!] `R~{v eҸqϟWC3CT ʕYR_Y@y㠐+`#9[So7C :[Wza-}%Ts .H^p f/o*7z^t>?]${xov@b`[NAUm9-4\m( 8t'^A^Ccf#~}F($+Ӵv4+14ř TV xP`a@qT q(>`,=&%"p̸1)nz>}p5r}A0A9o ʆOܾ.*~z0b8ã(:AFh9 Wn[I9ҕcmȆaxqK-C5Z.\m Ț>(:i?mQ`=J(A&WH*iqPb.O4X0KBKhR81ɻH?+a>!bwA9Z.M(Qsx&zʄMוSrg೜Z~v Mlۋ(8 ,BR`]ݪI|}-:WjէI0y%(RhE4Qh%Y| ~5_ C+ ֒q ܯ36gZeaPI+o̾b?/@ipUꂛ,>YTg~ `޿rQݠ,FlNob)kK,_w8`q Q3.^(IAQrK @lb6CB-"3yCxaJ0QU[ҲAEz;yG` 34~Hm dhLF[3;t(!cu:xƠ#E*;2L/7 kD~|ҿ͌<%vK6=EpKRXME*y ɩ?e 4JCA׫pPӬqU6ĺd;rSv!U(*?e:CtY]/F~RF &J4@&/`ɀG, KoGVq)I I JV)*-DЛ{hX:ȝoQ夆o\G)3>[l@[u"I8MBz*dz D!Y*\粝N μ--_@ݷr%ĥYKJHY1xL{@{Ufɐm]^zN:,*7DpH_^:5iYZg:^oO2fwzĄ'v^Ӄ䣈`pظh~VOPSNsLzVz>/~ đ:@AhAQ&uB<$[' ;}7u\6)[!5,Cz fηd6bK^:<īzCpʎ ~ꑽMOB [wm-A.ƴ'=`ҧCJ;Fmar96d`2JJj/i+MUfD`Ahuj͢ g 'fdD srŠg+rf.KjTn#T%?H&gz|f9w.8 '7w^Ք. ϊV4.)oGG DZnめBL lSrgZg+Ӫ! N#bW=5ZP(X'ßh~?8pD^Rd6')w\:<7u p|F}ُ]}#eBPHW0Oxd9dWQAJ437"0 ?WVg<^e8X Rz2o,C pzFb˼UNRm2f Q"WP"S7 vTF]OTWLhssy/?@'Ew'R5ܘ I?i_9̈?X6ʭ CS]h3`3/_\(1xm2LijKk2vMr 3+Ww_&o`_6F17vrLطvW*[I诃kt7NyoӶm"75&Ilt#`j,ɑk7꼫Gb ׸E_e┷>7?`ϭ`:wd|׼ aƥ ÌԹ@g Z:36d dϖwo*o~[8 X `]vRn撛Ҁwlah*{Eß)*ߦ7)a O Ogy7#QUUhP+WZS7>8cw|@ >&|t7P"a.`WN\t(;8q %C5xMaˎGHXinO?Bfwc$({Kr>~ s~Go\-O>p_ޒ&Xyg*-4mǑaPիی&T?>na)ѹي{VbeN!rbj!.gϋqn*\}rJoѷuи t@UnZaL 3FgB[6O*x&m1Ya@\M4{zh05{cfQ/`Qc.L/svG'ASWe$YDU,kB,t)=pš̈́ AUNhBP_nIP k2[ `faK gtmX75J )C?4@%ggzf8M2fJI-SdžW'q"F^~wVC[Od.>R[^ZW.qFA|AaAaSk~Y订OByNDvV eɳ*Q·uJ;5Eqgot\7bu%m|?s]0bSz+B;]ԋsYY0z4!ڐo2Y4Z& YʹIJ*8.~n]DF+*-gA>g0띚;kKKICO+r2^0u2|~Xx K@u _̟`@)-G$:qǍgYˆg-Q+p,G MZz<r o:7(ŅV vk`[:׍g"_/#{vAtީB|*ب'<SZW\H8pN*[Js5,ϧ#Q+Ѱ#oo6acO ͨ* 1s Tس7O {"nhWj|rФݓoU#c|UC{Djs۬Hyկ?NRKë5f{աd1>\dآ^^Q:b}̾N]{ pj&҇Xf^*s 3O>] /h4m37pmr{z8$-K{ЏwǾ|?$m- 91Ai3*- z1 -=+XT9Ul6 k,%DFMTTˌd"B|4A]OKRx9oJ-\_& Гkr(D}{np&HD$ X5me4m'y x]Z4+۔z/T.7Y!ƒU*gϰ\g ܭs:ySeO@lS_z cZbjsxO 27'oqXwEp f2I qO$?, sU~߇"_Oƽ!J l{C>ӲWcndw?=mr3gKO[&>ok0#\89yhYA5]Ο҆wj]:\nf};cp\X2Dc#MVSZ#Llk|>5d݊y8 Њqm'M|^k'miH[aR䇇[lv3 6GRGq$ZǼG,q/l`wBي>nT`#_!襱>܉C.$m8r6"ZՁ> `ceKhmY|bbCD@mC`I1ߞx$f٩4Ǵy Ubdןrjr񇰋)&۳1u'<_D$Aouz>ttj*mXׅv%/Աw']JJ~q7KIf/ytܭE~' rG< 5hrĭ$TO zyiVl1 Qԋ+CbP8z\.7&a!IA/C爸蟙Hj7-HE/-|;q暼/JmԨ$fJNO)2 A_-uzؕ" uF=\04o-7Aw\8ل+_H1_ۖ!UD3XO'5/g̐d_k4<]BQ`BHNփźKmu `̺mth3fYNۦVObSJOljN&R t4,1r~cީG2Ii7y4 gYbLphX 8N4{Y#HEQ<~r*aDҏNj:w\eC~8v{ గʲVU1ɐŸY#BjM mMx<;mGZBcFK*P, y0ULrH*D'$T ! Jԓ 6\fR>76Zv\4t~VAZã"N6 f!?F8.} XcfY(jYpEk@Ğ-@8zЉ Μk\ qzRM 4p%"p[NL/1e}Jɕt5LM789)\Tҝ.:]ơ_Jj=},Os{DtdUJ7Z)0/C,]NCywj-S^QJ `iFܔ5(ALg>'vc7D#3 hmj䖢?fu۩&U(Ij2ROEwE‘|.S6Cl<#sqq+kjR*[{E2mLYꃿnG9{ 9#$,i}wSB+:%tɡ~A`SU- @J c~N"J.p@o}_IOdi^GА7I8yF7G ́F/LۛnAIdxUX:o37dZ5l+u&WiK2Ʊ$XV&ɭ /s,9˖$h~^D`;S@D٫8_0(g 1zP" k/L[6% Ujcm55v ^uI :#gBE;9`8H}hg9X#]fa&0?u_)PMAJ#y 816b`s c.,=bhNHvZRO*=݈u# Tԅa As*Qe`:tb>Q|v_$ tkidQiYƅ`TJDE 'ܼ^1,E uyKrDpfE Ds.Cw;;3fŎ#LGioZ< Rc^`7Ϥ8ݽC eMV^ʈB)f}`Tŷ]I烚VDjIu|Pկ+%&Б6Tz4gh-[8F#u7/A)ֺ]\J:Ԗŷcƿu"{,}'IxUb1ˈwS~ \9ݐ!V-/_F'E/o er" _YB䍀'=TEЛg1-=7ȟf`Y_H5paEڴʖpճYuJ6_,*[m>QF;eJ>Uk}Cfw1W铠Hr0ɔ}7Rn8|A- N*cͨl.-PM f9"Io[(뉳h(@#::*QwN!*HrĨ.v!&-T 8}~NTUd򁭆D 8rR-"݆Ԓ+ RSy |dV(Ȕy: (VpaeJF>]xJ|:H y4DJĦFֽzH.!.'펡>^$@,^jo ?L`A\>}dW138xO-- tbb7<O 0CD/ 6(p3YE[Oxo/Ymb}+躵k~=JotJĢ|4Cu3$|-:mKmnP9m{sV hH Qb*{XڍF6'q*Zo'&Œ6d&3^ܧdwxp.18Bh}Gl X\LtVp8ϒ%#H?!C' tqnbqx.ʦ{6)ÉP:5%ɲ!)`|)'LF 39lu)(IG8;Cs;_?i/z̡a-v&N]{m[H~ }iǨ1Twvkf[V1=+žWw9%S2۔vrA<2Y/?ܩ.s:h(ŝ0Js$[̹ȿOrS{L$h$&؟"G2k Db(/ozgHmAQL{;倾 օ# sE543=Sqo3&!({粐 ۀJĠXh&[jv{^%hKԭ?|;Й+XRUK .Wٲ E}ޘz`YQU"Ơ=s3VHz!u3R*s'xy ^=LJ/-::xO9z)0J/jgc~0j9{ 11bŲ#Σ#~w/!^wBE*P b&xK@ /8Cwe*Ę` yf#?*WiL " gD.p8,e䯫vrb: #2(f%;<Ǥgm _j RNHGiH7Q9 yHXd;ڡ/&v'Ӌq ٵ0{`w<%g._\j]Bd^<KNvaGcV &:LJv+~/Ӈ&oT,P9^W!ph\ف / _bJHx;)(r+pBmUBGefүq3eOffgQ%HE u>fes˷%vT+T!Q55Arn]=<<Npȷob'eLrHkdCe>_!}J ?/D'u}I++D]+,`GthDq|ɯUA_ 2-|vQİ85TNdȒdB7Ud5Tx] <05ࠂ\W8te0*sTsuy(D ! ިSԥ<~[ /5֠xr 7@s]f>t{ 9-xd(? gVPX(^3N뵒H_Aֳ]m#&39԰6N߭&&n`  .Wm\DL&YK<"*d @O`gDzyI<5e2Ytzo5nRmSh[cLu@1su1j2?Ҽ _ L42KkrWlkWbϛ \xd jRIȅ24ݯЌQ@Ii[3OW;.Rɢ @7M̓ArQtYDpLe!%zT  a18l蛯hDJ(` XҢhosQGCxT+a;A-]̉ɾml1ԮPRۣ:FR%(Tn׾_ & $ơJYR*dO9D!<=c;M ,XS4\N >D~z1XWQ-t3A_3" PJ$bo3m|`dia$ |sKQ!lb]1▏Fhyr6%ht߸UVZ +2G__k%fLW> v|*5R )Sl͸ϧc4ȕHTrl7:P[!V&gvaܜ\ =zm&8.mdYLY}Z xIT?1 :j%ȼ ~ Z aq;\Gݵ6K:B71]%.Tz̍}\Fml~ hDEXee3&[__Zks k7Fwƿ`6KxZg˯6qRj,KNSqF H|wNɲvKpڶ/f-JG(,F/@ːե)xuַED:FȖҊe'Ұ=v3z#*k![p}xd }r 0d;k]sfI>p\ZK[Va {m^aL[,jy%l'/DBc>ƙ]>\(pВ6"IN^%,Eޅu\b[2[ʳJ_/,dtD)DJ8F޿IBт0YLcrA9pc 'G7WJsd?>]QvQ!0P\d^3qXsN8Njeby֏p y.W QVe tw`;ojD47Ԋ{'/dc70Ox7ڶ V}Sa= SBM0A G茕b}DD1H+.hKaQF\ iʌ=Qg(}$Щfo5`\4ҼP v8+vazJWTPV8yMv׻pxvSȘdy]+~8$8K؋~@{WC~%*sI E5Jv".oidImWЦ# L gϋSm)%;(}s8LguP8o\@.N֑Kz;TrD"hJ_Sy,:TiLF b 'xN:w ¢qL2|gX.ʴoiA$SЮ,x&* iԿ]xҋ/N:Pp]=jΑ-B ,Hf8OZ|@Y,J 8BW7" *?jE;YsӫG CybM.`?4tì\ \߶1HmauQvJ4UVW *%;K+ &!kW=|a?)N\:-USUd {*<$zM2(D3r2+~6S]wCEmV_ Ɔ IrNhFS՝b _y$;}}ukc~ńzy5 &kNLv8tMלi9}:票_ h-~M*tQ(R=# @\<7-ؚxTĤbQ\-;t +JTt/u;UT_ցpK?JAfpWr 7a ֤C([\k* q;Nn~ n5ts$g:,aK0'k_}¬ *UHi~ro#p@r[3"efu * e %~pkGv8FX8fׇL 3Z1T_%E:cgY.RvB ,B)|(Htb%~{H99mRr3`d=:]缮ӯ%-MSSuG@n J/SD"B˩6KH;Dž廼"PiD/ 8KTK1Z ߓ[sGrcQwz_n0fvR- R DY*Oo2>ǙߒQ7c!b Ű̡M'^ОPA >o5N$Ta\5.p'!?.%eB~-*HF<2s/`;h)zmΟN^B/dM-7JGֻ^B`FCAõih1esv)HGJ-q$wG_EwKOց:: #IÎr-6lEW7uUhyZp鄗?V VXQy on`n߫Gty &|nγ‚qdq"ꥹUqRun0&;W(B0$6.HsBnp$TӹC#/ӡ:m9o =YKPiɈmƧO o&|&[Sʌ;⦊58FfhߟzyM{x1!f{a 2T6+R}Wj* XȔA8=j8[|<4nigηn.םO Qr6Xz5i]ԱYP^U d]IZv40BPX飼܀" vsvU=s WS\-.c}c!_P+|;`CU>Ij&xlXd7z.l!*mzG|.)PT1QMͩ0~>9pPIHhg .~Ȼwޞ5SQ@rk|1f|!J8o9{U$KKHj/{udtMq Q>[;A6:2À/A7jg}\^z֬teABr{,WzR(|E@ʮ&H*u{_;#<Afݷgrh 1=ܢ$M# Y@hn%K 0R Yh Cc s*iV]"#ż*dp`$JfiS{p8І  rd83~% 5>o[r%|wj4׿ RX\ s$IG+oLjaZˌ{Z;3bUǘeh 9A >铂`4.0?mGøl!;tjjBס[F?!Ċ`smOcy !Vxש 7ĶtgKso; r2j3QiG: o$aF.! lj\Y I(I.^􃒦Ӻ}S5P 'UAk/:G IRM#.sg9̻]J, C σ8NdVS0=_А~  { &c~Q55Բm!鼑esG{ $*B"7}νŢvo l;MDs?V'r ԾyCA@/dI8(=l5t@7@% fFʽK ?qe",w x. WH^.ǒ2׽ޥa;߯ /"iK[L(ehY}- QskSsLej'͗v)V, mzQ}AƱ h8v5%}-Dž Lu! Qk?IEXRԠR1ƻGO6qFGz⽃ hO/37vv آRy8SP[ S="!njv?rZjN ]AGc\1`# t᧊,y"i" rMwn5F 2_~"^ K܂.Y<˄H4nzݪ^^5b薞l葤ZnweUFLYRKx|""OߒQOm,i1 ]][ G?3p?e@8&l6mѦh,'5S ֣BLi4؆b' 5ejͳ@5=b?2dD!>$: Nz ӟtgp|:-frvmy >o< sO;UC f""s!<(@4 Kv}y.lCmfODBH8A~3'yl'( Kn/ 8W~_55ģUm}%mO M\"zћRx0L?:fGF/ٰ=0Ӑ̘M茐#3BG)n(+s,KJTUdަ!3 `lxq3^K{j0.e }J:%^ =U|ji||/$?GXQ>ԣTﾛʥtYE5g6h@JΩߪ7|fL^P1A^}@ӏ9RL߼&,ɝ@]ڒ4<g ,`H҃L-".?c"J?fGK4w?=^\v-!P+f&~ o A9WDeT?n0o%R9(c ;kzҾwʈkG~A,U`ju'ӱNl}p ǥ Fq;h܉l,6vމH )[q>SH.$j\_{<1T#j@~iZԅ5Ւ\DZ L;%ܤJ%E-0|dZ%==SkqBShaC@^krIb+#cn*UV,a̷Jٽ6 6^**N .y`謙Wc x]rt\EvUJ^Xz -kx7Yjni(NZ& Rjn8y0|Mi/b/s?Hn4 D+ƛ{rCVtٚآy݃0VX87 %V0sGuR v_D?|+W $& O9٢)eڻkPGsO윤-~peb>B@u Q tƚLF^ `$ mov"> d N4tJJ1{o,I(+ES+&OFJ gf`lց_h;@Zng؍"`͕,yvwt6H}wƉrfYAaBT qv'GD-U-y oi!RN)}* o]G'x}f,=7> 1yѧIўR`@A'| yKs%>ˮ]Zy=Yb63h IkJ=L1=!f1om95WF60 IjG^<"|$;Igm{ 8wӏ ۊW$cbw70_/nFyi9'? "Sc?3n@`jO}_DqDSdW >ngvځ qnccYs0!}E1|R~)en{+3{ڑ|.1ϻFR["|a/i5 3YN拘Ա?]eklH[" @ ȧw8Vic PB|Wơ<ԃn!E[>r%q?2-: _bo̽ow@X+5xB-CTuvQ&e. "[y|I'yÊoV_]<0ur%W)+x=#`|9t2 aF-ꖤ-Q=rxeɻU0\8b^&eõ˔8z^}Dy IOt<-öΒe]=f*84S~}bDX $gLj(5UW R^.|(khu؏|tAG-!j!FD;Wl /qIf>сyi0jL`ft4ҭGwrPWٍ\U16񖈏&jw+Rx}f ;hr{fGZq0' f&-Ki&*1I@2Ie;܁嵺 \Gh0QY8]tQİln ~5D s D(ɇy״һ\F(;T 3T Ė5m%c^9,_GT?$C$+R;|) L\ :6ԱDۯ#â5Bs~A@6Cp* 5ƒF* ^E} ]B?"luOzua4#K\p+yçeeO@p laʹȋh,A)e}5}7TpfS`5$)RgEWe xNa]"-el1:lRdM*Q5>[ .LBYL6 HO2Q,c+s 38/(Q>5˅%=%.J&%-} u62F ,?+ew 'CY%s6;F8?C  G/s;X.')^0h:"<'YQ|)xYa]Z f yyMs-?>ޏbL*yM)?x}S^g^8o *bގk˟Q˔?lcA0j!cbnô4:dYVRU =%n/1x; 4pMH( o\G|LM~ fϷm!IMd?Nk;-2Ftr p='>^ ϔ &H`26ۘm<̼ #gL$ٲ˪ha.v=7Kq\R0gh),G'y4)Sgs|inv9=G84$ *X5_b6Å׭#_9l]04/QCUI+π]I<ɔEx*=B N n7'{7j[Vi"%m`׼DN)JMs<8\4eQE3Um؄R;Q# kܫ3L @RWF1CeF/3O#8Z>p@=E%4>T_%qGOD-5"XU7uXճ;u :Yι/O ҤZ2=ď ͤ%5hO@t9 )X(}QIdN/n.fzn$uY@I=2Z+ fK)2%F+lȚK`'٩ (i=CɺC;ϓϴ7{pKSK隙I Yӿ#nqK% ׶+`ܸfw/c5Tiq+JBdQYPÝމXwwP.e5g퉊o4əx2# {REHbVV #x2ɷOEyo>BB/iZxf#xϯ$QTzèr=*jݪJ u{jF[,]pG>ڢi7PT|3~:8h,NLsGR?tÿԶ%VǦux;ܪ@r@gR``Xa^X*S 1xjOgrzWPċ |Sz`PBZع0.0M_( >ÁA|O.I E.=_hmr{e>Iw|s%DZl(# PI$gu H0gT~PN*OSo> =a:˚"G`ש]am| nECיRL"+W^ې$OBd;&٘65@e`4e\F:J1y0BC~wv̀vbg(#– ҅SRK*D?p<5)nҚTב2:t $7 p纽5WQH4&`u a>% 8䊘a8&Mp_;Oh(FEɄ|v,:;!sG"^ۻOj^E4g͸"k4+`/XLd pI<Ic^N'|.R̓9صl`Xl4j8>" hP iZSZܟ^} /a H ԭ:Q2( xܤ.h>ñ8/j;?77G*F.py!_%D%ޟffv9^ߞUN5ݦ>WJ~ -u&Ao_.nJֲF;]0F HJIzJvagY{3\2~hiT5VFɛbx ~ٰSy?Bwkw.O]r(ԓ䦷{T`}Z;D]Bqڻ3دM}7^i|dPvum͓ @!2e™Buk[{TB~xWoK~y}lj+~恞cQ,*x:>f πfizF5Qxx$UC5>A@\ܬ3[B 8{2nsޭb2B0߫rK9  fNk'$2Js3VAxiA(*rz#Q&nz0x759%&i{->:T-Bш9M>AƸ)XQ'ɱE)L9Z̟p=iּ%"%!<΋)i3䵎es0r)o=P#Qyๅ`XFz 3tn6'/ 8)IMWL[`![4טU)6:^C.ƕ*?}7Ef詵V xM+{ܧ#jn Xۼw3*d.AȹdJVw:LQՍQXΊP/5*W۬R>lt!a(ّ°W-죕BFN|yCVkҐּyuz05f=xl3ޜV(+14)@W/Ƴ5_Ji#RB1nf\1Z5۔{o2>5pҝuW'R0|.2~o~cs:{肁+~2Z~PCX/b 5&W:]DғX 4/Tz;5<99F0BN!n<,&)'_7:fgm\dLyrfjR/<~NnxIvpH"u"߭5rvѸ8 * /3!4m%,}_ࠟ##3{u DDB>ygKҒDR/ksB5& +8)!@ʴl[ O&M&:/U^ |H%P#xiڔR#hK36w׼]BL{ŋ@j+oh5 3 4SP*,טE(;RUlTz>cgi͊7 KJ^fرЊ7wO54l 4yZIWu Pk#4Lܯ]v]O@>&OSiDI}B(-\5\Qpu3lwֱD9~"快āt@KDMp씄\0b^+ACy.>V|'H 1 $ol<̍u7k"X ^jLch*+c2@@0`qFl\7|y< A93 |Gorz atrKV;r5ϿP <զg.4:kːKrHp#bŬ [{wͬ`z8R>bMyFHfʜ)v̥,Y\njʨ :O !6nHyzڲac=2/ۏ2>%Dq'@ vK-a2 Nwi1v0Jxc ,S~֥˅HGtѨ|6=e{~.as{&.tI/"ְY7nCv O'#̌mGtlHFTGs3)OSޏR-sӑ. %mp]I{a*ǣk Āi8gD5o֧Ugb)v71U#5?ONh^ͬ ty& :&vRekLj =LTÝwvRy)+E@6)}a%)nI&6̱8V':ǹ|H}C,*==r!Ӈv8I13W;&H<=;: x [mfC#֎ K ~km%Ĺ/:)nRKOP+IN6h}%onII& ,-P+~ )Ns a6-o@O8],bJCg e'Nvxd Z)~/ z_@H3A)j5bz !1oȆ#UYN Edd- b/tIr%IYoQL {RUQ#v%lo 6=be&0mʴSt㍠b("6 Q>܋^ϟvj%GPK mw5tQHiBӱ̽"i9J+D{`T  5s**%k-o]32[?J#h)ʍ ?g:%0oJ?[TgyƃF73U>W[uT 8VRIXb`H#?AV,>!4@r 8}戽=3LgD l"JBJ C?.efA|U~b!{SIл%M5cPpj.>ֈ:D#2:5ӑJ@bk\D4q6^a#F&b[~#B’%G]`>U<]m?a!.&-7LqA$ B[h%9G7;hctЎ7-,m}Mf|EZQ.\XяV҂ 05#X#I/@0T!;Siz0LIwӷw"O<)xѼFhu3e*SX6EhpD,v9̒ n (AJv?XZ,# qbaZC#3%vlXWb`U4tPq~c)X)ѭ8 Z]b!؋a&\PzvN))Z' 10Ž1"N/36m)y92'5$3X-|E]Kbmm-^W2B"t 1M9; P<.oRޛJ}Cx]J>ryynF%tRO#a xxh. آϼܺE8nbq0V$yI9!͟aHF`v1_G&:yxvf q֡><.QqwGhƪ3~wŤԶ)=c(a~r50땂ǦĘ! ߿nHl$.}R9=p?!⻽a'P$P Gc2Bv#]C cbJ;d `8KN{LaO*LwcgIDӞ3P퇲[Kٽ}W mԜ"sb )T7KYդf5 H@e N[F7bc)Qxvki+x;VW]06 b 0YMhBv< 1_uبT "]rպNJdxx`t>sA]z&eqf݈GYF_(SEHzlΔ%N? #P/ ۏE6G9o"nk a,4sr,:pp:.ɞ2kiV>k( 8P[LC0q4r6#VBȜR)8#i-%ޞ;'4mf4#=p)5M܅T$ Efgl0NlOY&,o:CZdk)1ϗoF}?RG'uO_M=7,7mj((;l8"%>>t7 R`4,a8l_XcF@/f=`g`+&y4{ė)(h_pGAE/; 8vrޞ@x"{Lޔ q%(CC]ݰ8ы~*bL?ȹI *pq(J% ICwI* w^8/n6J|T!nhV$ }sl׾ Jru[}<6R/A#*q K{&@wSqB!YX(/ph@\z?uҝ]`%gP-$yMh~j Prv~|Ӟ|.f t6IQMicp)>qW:p*`H9 q/?h̟XkE`ΐJWry?qYV)*Y*@nС&{RG?^)9}bsCJPwIV6g'ӊ|Kݿfg{[NL8kuS=}`q?d%n.펭.BB3]ׄWPD9MM6@AIRH*(,3AxӶtKx *^];twh^ oa'n|X|4W)DŽt*o=<͑g-V"6j6= =;[τ5%n@С, pǗW&g+ܹdX^U‚dA,U 6edk (