keepalived-2.2.2-150500.8.5.1<>,dg p9|n.ir&-4$/}4;Bxl3mVnQ+uEݒ?S:3'ZpGLp2t ^_;3UkHљ3K=PLo?{a#򔨊jt脈ۿzU>L?|d   ? $=^o dm66 6 h6 @6 "v6 "6#6$6%%6&&*'*+*(+8+09,0:090=>?@FG6H6I6XY\6]6^,bc4deflu6v w6xh6y@)z#(06xCkeepalived2.2.2150500.8.5.1A keepalive facility for LinuxThis project provides facilities for load balancing and high-availability to Linux system and Linux-based infrastructures. The load-balancing framework relies on the Linux Virtual Server (IPVS) kernel module providing Layer4 load balancing. Keepalived implements a set of checkers to dynamically and adaptively maintain and manage loadbalanced server pool according their health. High-availability is achieved by the VRRP protocol, a fundamental brick for router failover. In addition, Keepalived implements a set of hooks to the VRRP finite state machine, providing low-level and high-speed protocol interactions. Keepalived frameworks can be used independently or all together to provide resilient infrastructures.g h02-armsrv3/%SUSE Linux Enterprise 15SUSE LLC GPL-2.0-or-laterhttps://www.suse.com/Productivity/Networking/Routinghttp://www.keepalived.org/linuxaarch64getent group keepalived >/dev/null || /usr/sbin/groupadd -r keepalived getent passwd keepalived >/dev/null || \ /usr/sbin/useradd -g keepalived -s /bin/false -r -c "Keepalived" \ -d /var/lib/keepalived keepalived if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : for service in keepalived.service ; do sysv_service=${service%.*} if [ ! -e /usr/lib/systemd/system/$service ] && [ ! -e /etc/init.d/$sysv_service ]; then mkdir -p /run/systemd/rpm/needs-preset touch /run/systemd/rpm/needs-preset/$service elif [ -e /etc/init.d/$sysv_service ] && [ ! -e /var/lib/systemd/migrated/$sysv_service ]; then /usr/sbin/systemd-sysv-convert --save $sysv_service || : mkdir -p /run/systemd/rpm/needs-sysv-convert touch /run/systemd/rpm/needs-sysv-convert/$service fi done fi PNAME=keepalived SUBPNAME= SYSC_TEMPLATE=/usr/share/fillup-templates/sysconfig.$PNAME$SUBPNAME # If template not in new /usr/share/fillup-templates, fallback to old TEMPLATE_DIR if [ ! -f $SYSC_TEMPLATE ] ; then TEMPLATE_DIR=/var/adm/fillup-templates SYSC_TEMPLATE=$TEMPLATE_DIR/sysconfig.$PNAME$SUBPNAME fi SD_NAME="" if [ -x /bin/fillup ] ; then if [ -f $SYSC_TEMPLATE ] ; then echo "Updating /etc/sysconfig/$SD_NAME$PNAME ..." mkdir -p /etc/sysconfig/$SD_NAME touch /etc/sysconfig/$SD_NAME$PNAME /bin/fillup -q /etc/sysconfig/$SD_NAME$PNAME $SYSC_TEMPLATE fi else echo "ERROR: fillup not found. This should not happen. Please compare" echo "/etc/sysconfig/$PNAME and $TEMPLATE_DIR/sysconfig.$PNAME and" echo "update by hand." fi if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : if [ "$YAST_IS_RUNNING" != "instsys" ]; then /usr/bin/systemctl daemon-reload || : fi for service in keepalived.service ; do sysv_service=${service%.*} if [ -e /run/systemd/rpm/needs-preset/$service ]; then /usr/bin/systemctl preset $service || : rm "/run/systemd/rpm/needs-preset/$service" || : elif [ -e /run/systemd/rpm/needs-sysv-convert/$service ]; then /usr/sbin/systemd-sysv-convert --apply $sysv_service || : rm "/run/systemd/rpm/needs-sysv-convert/$service" || : touch /var/lib/systemd/migrated/$sysv_service || : fi done fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ "$FIRST_ARG" -eq 0 -a -x /usr/bin/systemctl ]; then # Package removal, not upgrade /usr/bin/systemctl --no-reload disable keepalived.service || : ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_STOP_ON_REMOVAL" && . /etc/sysconfig/services test "$DISABLE_STOP_ON_REMOVAL" = yes -o \ "$DISABLE_STOP_ON_REMOVAL" = 1 && exit 0 /usr/bin/systemctl stop keepalived.service ) || : fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ $1 -eq 0 ]; then # Package removal for service in keepalived.service ; do sysv_service="${service%.*}" rm -f "/var/lib/systemd/migrated/$sysv_service" || : done fi if [ -x /usr/bin/systemctl ]; then /usr/bin/systemctl daemon-reload || : fi if [ "$FIRST_ARG" -ge 1 ]; then # Package upgrade, not uninstall if [ -x /usr/bin/systemctl ]; then ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_RESTART_ON_UPDATE" && . /etc/sysconfig/services test "$DISABLE_RESTART_ON_UPDATE" = yes -o \ "$DISABLE_RESTART_ON_UPDATE" = 1 && exit 0 /usr/bin/systemctl try-restart keepalived.service ) || : fi fi  X )7 L QS .m  ByO"B UF955hEA聠큤A큤A큤A큤Ag g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g P^8g g g g g g g df06c5e6ff9bd41dd935a1d4796a72113094d21811eea811cdb0c8cf9664477767e1f54ef3f87a542815f09f3c0a99b7f934ab6bf95be23c2f5ff9beea2c9e3a6b9d2d910050c05b88dfbd8ad2672d9899e8c370aa304f9814ba5dabf646c61a961e98de44f47d636bcd8cfcc0e01ea496b632ac4b4198878b39468f9211dba3f9ba728871aa41b906e9e52b669d511851d61e3e7b31fb48181bef60838d2974dd8bb82b8b7fc4e5b5be208d4a9168668272bed8b62a2a10ec8eac679c329508c889939ce5fc1f059df9353fc415e41e1eeb717e1c2a529d0c556f5aced8e122a70dcaa71e46c8967f03d1435eb680af3023748a08d5d27acd514602cb8a310b4fe7f01e71566dbb4150a4856c4b06729de751ca4065e8d544dd4f42e916829ef709b6dfc0600e1ee9c9cfdadb3aff0671f92ce6a200b2af04396e8f73bbfdd4437a2e3fbb956e81c6318ccff04a7d445f156dc9115bf844d062056509a7755df9a760c893bd730986e8a8a276914917a4133036a5bbc327b12f5035578c1bdd14ccaa7938d3f410e8d69a688cc6fd80cfbc39b24a8f4875c6cffa2291d9afe505db90c4c67ee0dea04018e6eb2ab2a61de0f389234d3c80310f6bba1fca1e91a70e4a8847588a37385ed803f257ab27ee06806fbb290280a8032b24924d360cfc0e437a734af99d337ed68f3d550516d6ca64e7ee1bf144efa0f7d1d6217b81bf675636d2c20b63e894c26665dc7e064c6e076117df394e3d21e0e5c1b2a2f11ee451c9f94aac4ce9845a798c4507136aac5ecbf64326c4e373c10e4fc96a2bd12b54e447debdbd66e743793aade27df048317d1fd2ab011e76793262a5b5b42019b779c100b38b274ef5b78d1abbcced0ccc965e8b1120b4599070ef191efc325829df2687e02aba617a6a74d2b1dcad0602735294d2b96e67dac8890287b6240bcf116dd602d2f8d8afd61e539dea71a84486c5b7a821891db39058f2375b3dfe9d778389969bcf1f20cfb6bba1dc1ea7574aff76da889e3c7d6053d1e79da8e16497ca56d5891d54ae4793909e292b3e6145f4ca9aede07b2e6c631bd3c0e05688d5a40fe528724a2eb6bd2fdc7051a25548099a9d3ccb01a02f76431c2e5ecaaab8e8e12e749394f57fb7e93ea8de43cac8dbb63ed686d62b0ab9bcdf460dd19e51080f8b0643f0d33f568726063ab5a8165eef1242e5d91083ac15b3bf12a7809fc283d2253c31b6b8e22f6bebddb728828c9fa0a5a0f8273187989dfa1623c8045a915d4d4edaf5046c04dc5299bffe728546bf748e1f199914b5c31ba0b9a8bf4d7036a2a372fd550a74093c5da73d7f4796603d48ace15af3ea5d79eddfc8049af30fad0b7b841d1c13d7453f53245fe1697716486c5779c8cd94041b819ed16e36b3745ede64b3708eafff560cb77cdab6772aaad4688d7b5004237092df06322f8d5216d34be00d756f8b1f8d5f88e251d3a2a472eb5216732a6fee9f0134c5e760aa8171c406f1a2b9428a4c70c669f3140965413b60239a91a2c1967b4327d03f319e29b2860cc7d9e84b262e58d31e42628b2b1550cca6400796b5848bb0a8cd7cececaa149e1e1583ccbf3c096082cd4c11a86a45764b6bf4fc61a5b4b7fb7957c02a31c4bba7559239521654245fea3548bb45b588b72b549bffe2e9df9cdfeb082331e9d4891f38678822bd7ba0adce19918d3c4a1168b2da3b3f7a036a8119ddfe37a38838cdf36c6e6648a5ec796df055e0d03d2e6416f2c1b00b0d9d021b60e868fe242a114acfea5537682e71934ea82a63600ac71d706583f4155bfb5888e58bfa0d0cd95011a16a30581a6ff275f84b6dca188a1c8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643290ee8ee73d84de842961afde128ce5077227038ac8c9704c7cb6fa240eb9907c413754621d02ce451aa3b13de4d35bff212b27359f17600519ad6cb2410b8ef8a89b2fbc20673be89683ee28401ab64b6be72f743cd6470b2aa43dbb4a838f413bbecc5a5e2aa213c79f0030c523e0fe27b401dec40f52bd53676580355455de4c940e5917a2193be4147dd8db3b5d238581f5d425c5b459894bbeb5ba4eb36dc74456120702bfaabdcc02f29e80bc87619446682fd91a6d1821f59e7eb36a3/sbin/servicerootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootkeepalivedrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootkeepalivedkeepalived-2.2.2-150500.8.5.1.src.rpmconfig(keepalived)keepalivedkeepalived(aarch-64) @@@@@@@@@@@@@@@@@@@@@@@@@@@@    /bin/sh/bin/sh/bin/sh/bin/shconfig(keepalived)coreutilsdiffutilsfillupgrepld-linux-aarch64.so.1()(64bit)ld-linux-aarch64.so.1(GLIBC_2.17)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.17)(64bit)libc.so.6(GLIBC_2.27)(64bit)libc.so.6(GLIBC_2.28)(64bit)libcrypto.so.1.1()(64bit)libcrypto.so.1.1(OPENSSL_1_1_0)(64bit)libip4tc.so.2()(64bit)libip6tc.so.2()(64bit)libipset.so.13()(64bit)libipset.so.13(LIBIPSET_1.0)(64bit)libipset.so.13(LIBIPSET_2.0)(64bit)libipset.so.13(LIBIPSET_4.8)(64bit)libmagic.so.1()(64bit)libnetsnmp.so.40()(64bit)libnetsnmpagent.so.40()(64bit)libnetsnmpmibs.so.40()(64bit)libnl-3.so.200()(64bit)libnl-3.so.200(libnl_3)(64bit)libnl-3.so.200(libnl_3_2_27)(64bit)libnl-genl-3.so.200()(64bit)libnl-genl-3.so.200(libnl_3)(64bit)libpcre2-8.so.0()(64bit)libssl.so.1.1()(64bit)libssl.so.1.1(OPENSSL_1_1_0)(64bit)libsystemd.so.0()(64bit)libsystemd.so.0(LIBSYSTEMD_209)(64bit)pwdutilsrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)2.2.2-150500.8.5.13.0.4-14.6.0-14.0-15.2-14.14.3fJc @baQ@` @`F`D@`.V`@^ku]@]@]6\\\@\@\+@\C@\A[@[@[v[%@[Q@[Q@Z@ZZ_@Ze@ZX@Z@Z@Z@X@XBXN@XN@WgWVwVVV @V @U.@TfT_W@varkoly@suse.comvarkoly@suse.comvarkoly@suse.comjsegitz@suse.comdmueller@suse.commrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.dedakechi@suse.commrueckert@suse.demrueckert@suse.dechris@computersalat.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.decrrodriguez@opensuse.orgdmueller@suse.comdmueller@suse.commrueckert@suse.delars@linux-schulserver.dejengelh@inai.deigarcia@suse.comrbrown@suse.commrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demichael@stroeder.commrueckert@suse.delars@linux-schulserver.demrueckert@suse.demrueckert@suse.dedimstar@opensuse.orgmrueckert@suse.dedimstar@opensuse.orgcrrodriguez@opensuse.orgledest@gmail.com- VUL-0: CVE-2024-41184: keepalived: integer overflow in vrrp_ipsets_handler (bsc#1228123) Apply upstream patches: bsc-1228123.patch- FATAL: Module ip_vs not found in directory /lib/modules/5.14.21-150400.24.18-default (bsc#1202808) Set ProtectKernelModules to false in service file- VUL-0: CVE-2021-44225: keepalived: possible privilege escalation due to insufficient control in the D-Bus policy (bsc#1193115) apply upstream patch: * 0001-dbus-fix-policy-to-not-be-overly-broad.patch- Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_keepalived.service.patch- add 1915.patch to fix build on tumbleweed- drop linux-4.15.patch: No longer needed as it was a backport from upstream - Cleanup configure options after consultation with upstream: - --enable-regex-timers is for debugging purposes - --enable-snmp-checker and --enable-snmp-vrrp are enabled by - -enable-snmp - --enable-snmp-rfcv2 and --enable-snmp-rfcv3 anre enabled by - -enable-snmp-rfc - --enable-stacktrace is definitely a debugging option - on systems where we have nftables support we will only ship with nftables support (>= 15.0) and use iptables support only on older distributions.- Update to 2.2.2 https://www.keepalived.org/release-notes/Release-2.2.2.html - change how we install documentation to avoid duplicated files - Link all the files for ipset, iptables, libnl instead of dlopen. Drop the previous workaround for generating requires for the dlopen-ed libaries. - remove unsupported configure option: --enable-libiptc- Make sure we pull in the libraries we need for dlopen, by following the symlinks from the .so symlinks with the requires_file macro.- Update to 2.2.1 https://www.keepalived.org/release-notes/Release-2.2.1.html https://www.keepalived.org/release-notes/Release-2.2.0.html https://www.keepalived.org/release-notes/Release-2.1.5.html https://www.keepalived.org/release-notes/Release-2.1.4.html https://www.keepalived.org/release-notes/Release-2.1.3.html https://www.keepalived.org/release-notes/Release-2.1.2.html https://www.keepalived.org/release-notes/Release-2.1.1.html https://www.keepalived.org/release-notes/Release-2.1.0.html - enable systemd integration via libsystemd (new BR: libsystemd) - switch to systemd_ordering instead of systemd_requires - sync configure options with the configure script- Inclusion into SLE as ACC supported packages (bsc#1158280, ECO#223)- new BR pkgconfig(libnftnl) to fix nftables support- update to 2.0.19 Fix minor IPVS features support. Extend BFD to support more than one BFD instance with a neighnour. Extend nftable support. Script timeout extension. Properly filter IGMP/MLD packets on VMAC interface. Refer to ChangeLog for more infos. https://keepalived.org/changelog.html - changes from 2.0.18 Add support to IPVS new GUE tunnel type. New feature 'weight reverse' available in all trackers. Resolve all outstanding coverity issues. Some fixes and performance extensions. Refer to ChangeLog for more infos. https://keepalived.org/changelog.html- Update to 2.0.17 (2019-06-25) * https://www.keepalived.org/changelog.html - remove obsolete patch * systemd-after-snmp.patch - rebase patch * linux-4.15.patch- added systemd-after-snmp.patch: If you want to use the snmp support the masterx socket needs be available otherwise the snmp support is broken strictly speaking we would need to use BindsTo= here but that would require that add a Requires for net-snmp to the keepalived package. to be discussed.- update to 2.0.15 - Fix uninitialised variable. - Fix rpmbuild on CentOS7, and rely on auto-requires. - Add option to flush lvs on shutdown. Currently all known virtual servers and their real servers are removed one at a time at shutdown. With large configurations on a busy system, this can take some time. Add an option just like the existing 'lvs_flush' which operates on shutdown. Typical environments with a single keepalived instance can take advantage of this option to achieve a faster shutdown or restart cycle. - Make alpha mode checkers on new real servers start down on reload. Patch #1180 identified that new real servers with alpha mode checkers were being added online immediately, and if the checker then failed were being removed. This commit makes real servers that didn't exist before the reload start in down state if they have alpha mode checkers. - Remove duplicate config dump entry. - Make new real servers at reload start down if have alpha mode checkers. - Close checker and smtp_alert sockets on reload. Issue #1177 identified that sockets were being left open (lost) after a reload. It transpired that these were sockets opened by TCP_CHECK, HTTP_GET, SSL_GET, DNS_CHECK and SMTP_CHECK checkers, and by smtp_alerts in the process of being sent. This commit adds an extra parameter to thread_add_read() and thread_add_write() to allow indicating that the scheduler should close the socket when destroying threads. - Send vrrp group backup notifies at startup. - Make inhibit_on_failure be inherited by real server from virtual server. - Allow real and sorry servers to be configured with port 0 This is to maintain backwards compatibility with keepalived prior to commit d87f07c - "Ensure always check return from inet_stosockaddr when parsing config". The proper way to configure this is to omit the port, which requires the next commit. - Don't setup IPVS config with real and virtual servers ports different. If the real server is using DR or TUN, the port of the real server must be the same as the port of the virtual server. This commit uses the virtual server port for the real server when configuring IPVS. - Log warnings if real server and virtual server ports don't match This commit adds logging warnings if virtual and real server ports, when using TUN or DR, don't match. It also sets the real server ports to be the same as the virtual server ports. Although listing the IPVS configuration with ipvsadm will look different, the kernel ignored the port of a real server when using DR or TUN, so the behaviour isn't changed, but when looking at the configuration it now shows what is actually happening. - Fix warning when protocol specified for virtual server with fwmark. - Add log message that nb_get_retry is deprecated. - Fix whitespace in configure.ac. - Fix configure error when systemd not installed configure was trying to execute pkg-config --variable=systemdsystemunitdir systemd even if systemd was not available. This commit makes configure only execute the above if it has determined that systemd is the correct init package to use. - Correct references to RFC6527 (VRRPv3 SNMP RFC). - nsure checker->has_run is always set once a checker has run. - Fix some indentation in configure.ac. - Update fopen_safe() to open temporary file in destination directory rename() in fopen_safe() was failing if the file being created was not on the same filesystem as /tmp. - Add ${_RANDOM} configuration keyword. It might seem strange to introduce random elements to configuration files, but it can be useful for testing. - Fix using ~SEQ() in multiline configuration definitions. - Make blank lines terminate a multiline definition. - Minor updates for lvs_flush_on_stop. - Add option to skip deleting real servers on shutdown or reload If a virtual server is removed, the kernel will remove its real servers, so keepalived doesn't explicitly need to do so. The lvs_flush_onstop option removes all LVS configuration, whereas this new option will only remove the virtual servers managed by keepalived. - Correct error message re checker_log_all_failures. - Fix syntax error in configure.ac. - Fix track_process initialisation for processes with PIDs starting 9. - Remove debugging log message. - Remove inappropriate function const attributes They were causing iptables/ipsets not to be initialised. - Stop warning: function might be candidate for attribute "const" Depending on what configure options are selected, gcc can output the above warning for initialise_debug_options(). This commit ensures that the warning is not produced. - Enable strict-config-checks option in keepalived.spec RPM file. - vrrp: relax attribute 'const' warning at iptables helpers. - Propagate libm to KA_LIBS. - Fix building on Alpine Linux. Alpine (musl) doesn't have a definition of __GNU_PREREQ, so create a dummy definition.- add buildrequires for file-devel - used in the checker to verify scripts- update to 2.0.14 - Add compiler warning -Wfloat-conversion and fix new warnings. It was discovered that passing 0.000001 as a parameter specified as uint32_t to a function did not generate any warning of type mismatch, or loss of precision. This commit adds -Wfloat-conversion and fixes 3 instances of new warnings that were generated. - For non systemd enviroment, it occurs syntax error 'fi'. To avoid syntax error, modify keepalived.spec.in. - When uninstall keepalived with init upstart, stop keepalived process. - Fix type re LOG_INGO should be LOG_INFO - 6git stash --cached. The code was actualy in a #ifdef INCLUDE_UNUSED_CODE block, and so isn't currently compiled. - Register missing thread function for thread debugging. - Fix reutrn value of notify_script_compare misusing issue. - Fix typo in keepalived.conf man page re BFD min_rx. - Fix segfault when bfd process reloads config. Issue #1145 reported the bdf process was segfaulting when reloading. The bfd process was freeing and allocating a new thread_master_t when reloading, which doesn't work. This commit changes the bfd process to clean and reinitialise the thread_master_t. - Fix segfault in handle_proc_ev(). On Linux 3.10 the ack bit can be set in a connector message, and the CPU number is set to UINT32_MAX. This commit skips acks, and also checks that CPU number is within range of the number of CPUs on the system. - Fix OpenSSL init failure with OpenSSL v1.1.1. OpenSSL v1.1.1, but not v1.1.0h or v1.1.1b failed in SSL_CTX_new() if OPENSSL_init_crypto(OPENSSL_INIT_NO_LOAD_CONFIG) had previously been called. This commit doesn't call OPENSSL_init_crypto() if doing so causes SSL_CTX_new() to fail. - Remove all references to libnfnetlink. Commit 2899da6 (Stop using linbl for mcast group membership and setting rx buf sizes) stopped using libnfnetlink, but INSTALL and keepalived.spec.in were not updated accordingly. - Fix genhash re OPENSSL_init_crypto bug and improve configure.ac. Commit fe6d6ac (Fix OpenSSL init failure with OpenSSL v1.1.1) didn't update the identical code in genhash/ssl.c. Also, an improvement for the test in configure.ac was suggested. - Fix log output when real server removed. FMT_VS() and FMT_RS() both call inet_sockaddrtotrio which uses a static buffer to return the formatted string, but since FMT_VS(), wheich simply calls format_vs() copies the returned string to its own static buffer, if FMT_VS() was called before FMT_RS() then the returned strings from both could be used. The problem occurs when both FMT_VS() and FMT_RS() are used as parameters to log_message() (or printf etc). It appeared to work fine on x86_64, but was writing the same IP address for both the real server and virtual server on ARM architectures. This is due to the compiler evaluating parameters to the log_message() function call in a different order on the different architectures. This commit adds inet_sockaddrtotrio_r() which allows the output to be in a buffer specified by the caller, and so FMT_VS() and FMT_RS() can now be called in either order without one overwriting a buffer used by the other. - Streamline some string formatting with FMT_RS() and FMR_VS(). Following commit 9fe353d (Fix log output when real server removed) some code can be streamlined now that the order of calling FMT_VS() and FMT_RS() does not matter. - Replace FMT_HTTP_RS(), FMT_TCP_RS() and FMT_DNS_RS() with FMT_CHK(). They were all simply defined to be FMT_CHK() so just replace them with that. This made it much simpler to find all used of FMT_CHK(). - Fix building with gcc 4.4.7 (Centos 6.5). gcc v4.4.7 doesn't support -Wfloat-conversion, so check for it at configure time. - Add dumping checker config/status when receive SIGUSR1. - Don't put alpha mode checkers into failed state at reload If a new checker is added at a reload, unless the real server aleady has failed checkers, then ignore the alpha mode of the checker. This means that the real server, if up, won't be taken down and then brought back up again almost straight away. If the real server already has failed checkers, then setting an alpha mode checker down initially won't take down the real server, so we can allow the alpha mode setting to apply. - Handle alpha mode checkers initial failure at startup better. - Fix compile failure discovered by Travis-CI. - Fix calling syslog when not using signalfd(). Pull request [#1149] identified that syslog is AS-Unsafe (see signal-safety man page), and that therefore signals should be blocked when calling it. This commit blocks signals when calling syslog()/vsyslog() when signalfd() is not being used. - Rationalise function attributes. - Fix enable-optimise configure option. - Use AS_HELP_STRING for all options in configure.ac. - Streamline genhash -h option. - Make genhash -v version match keepalived. - Fix config check of virtual server quorum against weights of real servers. - Fix some configure tested checks for OPENSSL_init_crypto. - Add infrastructure for adding additional compiler warnings. - Add standard and extra compiler warnings. - Add and resolve missing-declarations and missing-prototypes warnings Approximately 16 additional functions are now declared static. - Add and resolve old-style-definitions warnings - Add and resolve redundant-decls warnings - Add and resolve jump-misses-init warnings - Add and resolve shadow warnings - Add and resolve unsuffixed-float-constants warnings - Add and resolve suggest-attribute=const warnings - Add and resolve suggest-attribute=format warnings - Add and resolve suggest-attribute=malloc warnings - Add and resolve suggest-attribute=noreturn warnings - Add and resolve suggest-attribute=pure warnings - Add and resolve unused-macros warnings - Add and resolve null-dereference warnings - Add and resolve float-equal warnings - Add and resolve stack-protector warnings - Add and resolve strict-overflow=4 warnings - Add and resolve pointer-arith warnings This particularly includes adding a number of bytes to a void -. - Add and resolve cast-qual warnings - Resolve additional warnings identified on Centos 6.5/gcc 4.4.7 - Remove static from zalloc() - Fix some compiler warnings on Ubuntu Xenial, and add comments re others. - Rename LIST parameters to lst in list_head.h to avoid upper case. - Fix real server checkers moving from failed to OK on reload. - add rs judgement in migrate_checkers. - Detect connection failure in genhash and exit rather than loop. - Add another function pure attribute. - Fix sending notifies for vrrp instances at startup when in sync group Issue #1155 idenfified that notify scripts for vrrp instance transition to backup state when keepalived started up were not being sent if the vrrp instance was in a sync group. It was also the case that SNMP traps, SMTP alerts and FIFO notifies were not being sent either. This commit make keepalived send the initial notifies when the vrrp instance is in a sync group. - Fix building keepalived RPM on Fedora 26. For some reason - fPIC is needed when testing for the presence of setns(). - Add vrrp_startup_delay configuration option. Some systems that start keepalived at boot time need to delay the startup of the vrrp instances, due to network interfaces taking time to properly come up. This commit adds a global configuration option vrrp_startup_delay that delays the vrrp instances starting up, for the specified number of seconds. - Handle checkers properly when reload immediately after startup. - Streamline some of the SMTP checker code. - Create separate checker for each host in SMTP_CHECK block Having multiple host entries in an SMTP_CHECK block is deprecated. This commit streamlines the SMTP_CHECK code by creating a separate SMTP checker for each host declared in the SMTP_CHECK block, so that apart from parsing the configuration, the code no longer handles multiple hosts per checker. The support for parsing configuration with multiple hosts is only enabled if WITH_HOST_ENTRIES is defined in check_smtp.c. It is currently enabled, but when support for multiple hosts in the SMTP_CHECK block is finally removed, it will simply be a matter of deleting all code in the WITH_HOST_ENTRIES conditional blocks. - Make checker fail if ENETUNREACH returned by connect(). The connect() call can return some immediate errors such as ENETUNREACH. These were not being treated as a failure of the checker, since the code used to assume that any non success return by connect() meant that the connection was in progress. keepalived will now treat ENETUNREACH, EHOSTUNREACH, ECONNREFUSED, EHOSTDOWN, ENETDOWN, ECONNRESET, ECONNABORTED, ETIMEDOUT, when returned by connect(), as meaning that the checker has failed. - Don't set SO_LINGER with a timeout of 0 SO_LINGER with a timeout of 0 causes a TCP connection to be reset rather than cleanly closed. Instead of specifying a timeout of 0, use 5 seconds, so that there is an orderly shutdown of the TCP connection, but the close socket doesn't remain in TIMED_WAIT state for more than a short time. - nftables: fix build with kernel lower than 4.1. - Remove dead code and cosmectics. Remove code marked as UNUSED where things simply go nowhere even if define is set. We keep for the moment UNUSED code related to debug helpers used during coding process.- update to 2.0.13 - Add BFD build option to keepalived.spec rpm file Issue #1114 identified that the keepalived.spec file was not being generated to build BFD support even if keepalived had been configured to support it. - Copy tarball to rpmbuild/SOURCES when building in place It seems that even when building in place, rpmbuild expects the tarball to be in the rpmbuild/SOURCES directory. - Fix configure check for __always_inline - Handle interface MAC addresses changing When an interface is added to a bond interface, if it is the first interface added, the MAC address of the bond interface is changed to the MAC address of the added interface. When subsequent interfaces are added, their MAC addresses are changed to that of the bond interface. Issue #1112 identified that if a bond interface is deleted and recreated, the gratuitous ARPs were sent with the wrong source MAC address. This commit now updates interface MAC addresses from the netlink RTM_NEWLINK messages, so that the correct MAC address is always used. - Minor tidying up of opening gratuitous ARP socket. - Streamline setting SOCK_NONBLOCK on vrrp sockets. - Use netlink reported hardware address length for unsolicited NAs ETH_ALEN is correct for Ethernet type interaces, but is not right for Infiniband interfaces. - Minor tidying up of opening gratuitous NA socket. - Make gratuitous ARP/NA sockets non blocking keepalived shouldn't block when sending gratutious ARP/NA messages. It is better to lose the messages than for keepalived to block, so set the sockets non blocking. - Use netlink provided broadcast address for gratuitous ARP If an interface has a non-standard broadcast address, we should honour it. - Fix building on pre 3.10 kernels re track_process Issue #1119 reported that keepalived wouldn't build on CentOS 6. Various PROC_EVENT_- declarations were assumed to exist, some of which were not introduced until Linux v3.10. Most of them are not needed, but PROC_EVENT_COMM is used by the track_process code. This commit now checks for the existence of the PROC_EVENT_- declarations, but since keepalived uses PROC_EVENT_COMM, track_process is not supported prior to Linux v3.2. - Make track_process work prior to Linux 3.2, but with limitations Prior to Linux 3.2 the PROC_EVENT_COMM event did not exist, which means that keepalived is unable to detect changes to process name (/proc/PID/comm) prior to Linux 3.2. most processes do not change their process name, and so using track_process prior to Linux 3.2 is safe so long as the monitored processes are known not to change their process name. - Stop configure failing when nftables is not supported. - Streamline socket use with linkbeat. Previously the socket used for ioctls was opened and closed twice per poll if using MII or ETHTOOL polling, and once per poll if using ioctl polling. This commit opens the socket once at startup, uses that socket for all linkbeat polls, and closes it on termination. - Enable linkbeat polling to work with dynamic interfaces. - Add linkbeat_interfaces configuration block It was not possible to indicate that an interface that wasn't used as the interface of a vrrp instance, but was used either as a track interface, or for virtual/static ip addresses or routes should use linkbeat. This commit adds that capability. - Add ability to specify linkbeat type in linkbeat_interfaces block. - Add --disable-linkbeat configure option Does anyone use linkbeat anymore? This commit enables keepalived to be build without the linkbeat code. - Don't remove link local IPv6 address from VMAC that isn't keepalived's If IFLA_INET6_ADDR_GEN_MODE isn't supported and a macvlan interface already had a (non-default) link local addresss and the link local address that matched the interface's MAC address was added, keepalived was removing it as soon as it was added. This commit stop keepalived removing the address when we shouldn't. - Set configure init type correctly in keepalived.spec file. - Fix handling of VMACs with multiple reloads If a configuration is loaded that has a VRRP instance using a VMAC, then the configuration is updated to remove that VRRP instance and keepalived reloads its configuration, then the configuration is updated again to reinstate the VRRP instance and the configuration is again reloaded, keepalived thought the VMAC interface still existed, whereas it was deleted following the first reload. This commit ensures that keepalived properly detects whether an interface exists following a reload. - Remember more than one interface local address per interface Keepalived needs a local address for each interface it sends adverts on. If the address keepalived is using is deleted and another address is configured on the interface, then keepalived should start using that address. To do this, a list of configured address on each interfaces needs to be maintained. - Don't consider VIPs as local addresses when restart after crash Keepalived maintains a list of addresses per interface that can be used as source adddresses for adverts. To build the list, keepalived reads the addresses configured on interfaces when it starts. However, if keepalived crashed it will have left VIPs configured on interfaces, and we don't want to use them as advert source addresses. This commit makes keepalived compare the addresses on interfaces to VIPs, and ignores any addresses that are VIPs. - Fix removing left over VIPs at startup. - Use read_timer() when parsing config where appropriate. - Allow fractional warmup, delay_loop and delay_before_retry for checkers To shorten the real server monitoring interval, make it possible to specify decimal value for following items: warmup delay_loop delay_before_retry - Update connect_timeout configuration options Based on the patch submitted by tamu.0.0.tamu@gmail.com this patch allows setting the connect_timeout to a resolution of micro-seconds. The patch also adds the ability to set a default value at the virtual server and real server levels. - Fix unused variable warning when building only with RFC compliant SNMP. - It enable to set zero value as mintime for delay_loop and connect_timeout. - Add option not to check for EINTR if using signalfd() If keepalived is using signalfd(), there are no asynchronous signal handlers, and therefore EINTR cannot be returned. Currently the check for EINTR is enabled by default, and configure option --disable-eintr-debug disables the check, while - -enable-eintr-debug enables writing log entries if EINTR is returned. Once sufficient testing has been performed, the default will be changed not to test for EINTR if signalfd() is supported. - Make checking for EAGAIN/EWOULDBLOCK consistent The code in some places checked errno for EAGAIN and EWOULDBLOCK and in other places only checked EAGAIN. On Linux EAGAIN == EWOULDBLOCK, so the check is not necessary, but EAGAIN is not guaranteed to be the same value as EWOULDBLOCK, so define check_EAGAIN that only checks EAGAIN if they are the same value, but checks both if they are different. - Ensure default connection timeout for smtp checker hosts set. - Set default connection timeout if no smtp check host specified. - Fix min timer value, zero to 0.000001Sec. - Add fixing min time for vs_co_timeout_handler() and rs_co_timeout_handler(). - Fix parameter of read_timer(), it treat Mintime and Maxtime as microseconds. - vrrp: vrrp_dispatcher_read() performance extension We took time with Quentin to simulate and rework this code. We introduced 2 imbricated while loop: (1) First one is catching recvfrom EINTR (this code trig only on kernel older than 2.6.22 where signalfd was firstly introduced). Newer kernel will immediately break the loop (hey guys: if you are running older than 2.6.22 it is worth considering upgrading). (2) Second loop will continue reading from socket until same VRID advert has been received during the same cycle. After simulating, it appears that during contention with a lot of VRRP instances (around 1500), this design is needed to relax socket recvq from growing. This can be viewed as a Poll-Mode activation during contention and fallback to regular I/O MUX during normal operations. This loop breaks immediately and re-submit opration to I/O MUX when there is no more to be read. - Fix conversion from long for double in read_timer(). - Remove variable timer of unsigned long cast in read_timer(). When Double type variable timer is cast to long type, it's scale falls. - changes from2.0.12 - Documentation related. Remove keepalived.conf.SYNOPSIS content to make a pointer to manpage. Update README manifest to reflect actual Keepalived goal and features. - Improve error message if process events connector not enabled in kernel. - Add option to disable track-process functionality Issue #1099 reported that their kernel did not support the proc events connector, and it would therefore be helpful to have an option to build keepalived without the track-process functionality. This commit adds the --disable-track-process configure option. - Fix vrrp instances going to fault state when have virtual routes If an interface going down caused a vrrp instance to go to fault state, and the vrrp instance also had virtual routes, the state of the vrrp instance would be set to backup when the deletion of the virtual route was detected. This commit ensures that the vrrp instance stays in fault state until the interface is brought up again. - Remove Red Hat Linux 9 and RH Enterprise Linux 3 from spec file. Red Hat Linux 9 and Red Hat Enterprise Linux 3 are both based on Linux 2.4, which is no longer supported by keepalived. The options in the spec file for Reh Hat Linux 9 have twice caused people to specify wrong options to configure when trying to build keepalived, so the options are removed to i) avoid confusion and ii) they are not longer relevant. - Add global option vrrp_min_garp. By default keepalived sends 5 gratuitous ARP/NA messages after transitioning to master, and 5 more 5 seconds later. This isn't necessary with modern switches, and so if the vrrp_min_garp option is set, only one gratuitious ARP/NA message is sent after transition to master, and no repeat messages are sent 4 seconds later. - Standardise definition of _INCLUDE_UNUSED_CODE_ - Remove out of date comment re VRRP over IPv6. - Correct typo in keepalived.conf.5. - Directly use structure sizes for packet header lengths. - vrrp_state_fault_rx() is not used. Wrap the function in conditional compilation so it is not compiled - Convert so list loops to use LIST_FOREACH. - Don't recalculate vrrp packet header address. vrrp_get_header() calculates the address of the vrrp header in a received packet, but it was being recalculated in vrrp_in_chk(). This commit passes the already calculated address to vrrp_in_chk(). - Ensure a received packet has an AH header if and only if AH auth. Ensure that a received packet has an AH header if we expect AH authentication, and doesn't have an AH header if we don't expect AH authentication. - Ensure all protocol headers received before return pointer to vrrp header vrrp_get_header() returns a pointer to the vrrp header, but it now returns NULL if insufficient data has been received to include all the (IP, possibly AH, and VRRP) headers (this does not include the VIPs in the VRRP packet). This means that when a pointer to the VRRP header is returned, all fields in all protocol headers can safely be accessed. - Add check of received IPv6 hop count in multicast adverts The VRRP RFC requires that IPv6 hop count MUST be checked to be 255, just as the TTL for IPv6 must be 255. Previously that wasn't being checked, since IPv6 raw sockets don't provide access to the IPv6 header. Using recvmsg() rather than recvfrom(), and setting socket option IPV6_RECVHOPLIMIT allows keepalived to receive the hop count as ancillary data, and that can now be checked. - Improve reading from vrrp receive sockets. Previously no check was made of the return value from recvfrom()/ recvmsg(). This meant than an error could occur (e.g. EINTR), or no data might be returned, and keepalived would still attempt to process the receive buffer as though data had been received. - Enhance and streamline checking of validity of received VRRP packet This includes checking that a packet is multicast, unless unicast is expected in which case it is checked for unicast, ensuring that if AH authentication is used, the next header protocol is VRRP. The sequence of some checks is revised to ensure that the fields being checked are valid to be accessed prior to accessing them, e.g. check that the packet is VRRP version 2 before checking the authentication. - Stop clearing receive buffer before receiving VRRP packets. This is no longer necessary now that the appropriate checks are made of the return status of recvmsg(), and also that the checks of received packet length and packet headers now do all necessary checks. - Add compile time checks for IPV6_RECVHOPLIMIT/IPV6_RECVPKTINFO support. - Update keepalived.spec.in build-requires. The kernel package required for building keepalived is kernel-headers not kernel-devel. Also, it is superfluous to have package kernel in the build-requires! - Add missing file (build.setup) to tarball. - Fix calculating print format to rlim_t in configure.ac. - Fix compiler warnings on 32 bit systems re HASH_UPDATE. Removing all the casts stopped the warnings. - Use PRI_rlim_t when printing rlim_t types. - Use %zd/%zu for ssize_t/size_t to avoid warnings on 32 bit systems. - Fix some space/tab formatting. - Stop declaring some timer definitions unsigned to stop compiler warnings. TIMER_HZ, TIMER_CENTI_HZ, NSEC_PER_SEC were causing some compiler warnings on some systems due to being defined with a 'U' unsigned suffix. Removing the unsigned specifier stopped the compiler warnings. - Fix compiler warning due to incorrect format specifier. An int64_t should use % PRIi64 and not %ld - Stop an uninitialized variable compiler warning. - Fix MEM_CHECK debugging on processors without unaligned memory access. - Don't attempt to use unopened socket for getting ipset version. - Tidy up an error message. - vrrp: make vrrp_dispatcher_read() async while catching error. During investigations we decided to update previous patch to resubmit into I/O MUX on read error. It will make read procedure I/O MUX freindly by removing potential sync operation potentially leading to a global I/O MUX desync. We aggreed, the situation is really and very exceptionnal but could happen. - vrrp: vrrp_arp_thread split. Split the function for maintainability purpose.- fix build on 42.3/sle12 by disabling http regexp check support - add nftables to the BR - cleanup BR support for sle11, moved almost all BR to pkgconfig style - disable dbus instance creation support as it is marked as dangerous- update to 2.0.11 - Fix segfault while shutting down when SNMP activity occurs. Issue #1061 identified that keepalived could segfault when it shut down. It appears that this was caused by data being received on the file descriptors that the snmp agent requests keepalived to monitor with epoll(). Since the read threads weren't being processed during a shutdown, the first time an snmp fd was ready, keepalived discarded the read thread. The second time that fd became ready there was no thread to handle the fd, and, since the assert() statement was not compiled in, non existant data was queued to the thread ready queue. This commit changes the assert() calls to continue, so that non existant data is no longer queued to the thread ready queue. - While shutting down, continue to handle snmp agent fds. Since we don't shutdown the snmp connection until the very end of the shutdown process (we need to be able to send snmp traps), we should continue to handle the snmp fds on behalf of the snmp agent while shutting down. - Ensure snmp agent is in correct state when initialising/closing Make sure the snmp agent is not already initialised before initialising it, and make sure it has been initialised before closing it. - Disable asserts in bfd code by default and add --enable-asserts Asserts were enabled by default in the bfd code, which shouldn't be the case. Add --enable-asserts configure option so that the asserts tests can be enabled while debugging. - Remove debugging log message accidently left in. - Update receive buffers when interface is created. The receive buffer size used by keepalived is based on the largest MTU of any interface that keepalived uses. If dynamic interfaces are being used and an interface is created after keepalived has started, the MTU of the new interface may be larger than the previous largest, so the receive buffer may need to be increased in size. Further, if vrrp_rx_bufs_policy is MTU, then the kernel receive buffers on the receive socket may need to be increased. - Handle MTU sizes being changed. Issue #1068 identified that the MTU size wasn't being updated in keepalived if it changed. This commit now updates the MTU size and adjusts receive buffer sizes accordingly. - Fix syntax error in configure.ac. - Fix double free when global data smtp_helo_name copied from local_name Issue #1071 identified a double free fault. It occurred when smtp_helo_name was not set, in which case it was set to point to the same malloc'd memory as local_name. At termination keepalived freed both local_name and smtp_helo_name. If keepalived needs to use local_name for smtp_helo_name it now malloc's additional memory to copy the string into. - Rename TIMER_MAX to TIMER_MAXIMUM. ulibC defines TIMER_MAX, so to avoid naming conflict rename it. This issue was reported by Paul Gildea who also provided the patch. - Fix segfault when smtp alerts configured. - First working version of nftables. - Restructed code around how iptables/nftables are called This commit also allows building keepalived without iptables support, thereby allowing only nftables support. Adding any other mechanism to handle no_accept mode, i.e. blocking receiving and sending to/from VIPs should be added to vrrp_firewall.c, in a similar way to how nftables/iptables are used. - Update doc files re nftables. - Make nftables handle dont_track_primary appropriately. - Fix config reload with nftables. - Set base chain priorities from configuration. - Use iptables by default if neither iptables or nftables configured. But if the build of keepalived does not include iptables, then use nftables default. - Stop dumping keywords - left turned on after debugging. - Make umask configuration apply to created file. - Add libmnl and libnftnl to travis file. - Fix compilation failure when NFTNL_EXPR_LOOKUP_FLAGS not defined. - Fix compilation failure when build with nftables but without iptables. - Fix order of include files in configure COLLISION test. Since Linux 4.4.11 (commit 1575c09) including linux/if.h after net/if.h works, whereas until glibc fix their headers including net/if.h after linux/if.h causes compiler redefinition errors. Unfortunately the test for the collision was done the wrong way round, as identified in issue #1079. The patch included in the issue report corrects the order of inclusion of the header files. What we should do is ensure that glibc header files are included before Linux header files, so that at least if kernel headers from 4.4.11 onwards are used, the conflict will not occur. - Set CLOEXEC on netlink sockets. - Correct error message for invalid route metric. - Add track_process for vrrp to monitor if another process is running. Configurations frequently include a track_script to check that a process is running, often haproxy or nginx. Using any of pgrep, pkill, killall, pidof, etc, has an overhead of reading all /proc/[1-9]*/status and/or /proc/[1-9]*/cmdline files. In particular reading the cmdline files has a significant overhead on a system that is swapping, since the cmdline files provide access to part of the address space of each process, which may need to be fetched from the swap space. This commit reads the /proc/[1-9]*/stat and/or the /proc/[1-9]*/cmdline files only when keepalived starts, and after that uses the process events connector to track process creation and termination. keepalived will ignore zombie processes, whereas pgrep etc include them. A minimum number of instances of a process can be specified, and also a delay so that if a process is restarted, it won't cause monitoring vrrp instances to immediately transition to fault state but to wait the configured time and it the monitored process starts again it won't transition to fault state. There are potential difficulties with the process event connector if a large number of process events occur very rapidly, since there can be a receive buffer overrun on the netlink socket. This code will detect that happening, increase the receive buffer size, and reread the processes from /proc. - Add missing #include to track_process.c. - Fix number of elements of fd_set read for snmp select info. - Remove thread_event_t when EPOLL_CTL_DEL fails. If snmpd closes a file descriptor, when keepalived attempts to unregister the fd from epoll an error is returned. However, we still need to remove the thread_event_t from the io_events rbtree. - Fix connection to snmpd after it has to reconnect. Issue #1080 identified that keepalived wasn't handling a connection failure and reconnect to snmpd properly. The problem was created when the change from select() to epoll() was made. This commit makes keepalived unregister and reregister the snmp file descriptors after snmpd reconnects. - Fix retry count for SMTP_CHECK checker. The checker was doing one too few retries. - Make healthchecker failure reporting consistent Some healthcheckers were reporting all failures, and others only when the retries expired. This commit by default makes the checkers only report failure when the retries expire, unless the global keyword checker_log_all_failures or log_all_failures on the specific checker is configured. - After reload, reinitialise current track processes state. - Remove unused variable in track_process.c. - Add configure checks re --with-kernel-dir. - Convert remaining select() to epoll_wait(). keepalived was using select() for handling the termination of child processes, but the main scheduling loop now uses epoll_wait(), so convert the select() to epoll_wait() from consistency. - Stop keepalived leaving zombie child processes. keepalived wasn't reaping the termination of its child processes, so this commit adds waitpid() calls once it knows the processes have terminated. - Fix make distclean and make distcheck. - Also skip route not configured with down interface. Otherwise, if keepalived has virtual_routes configured, we create a virtual interface and bring it up and down, current code will bring VRRP state to FAULT and never return. - Stop vrrp process entering infinite loop when track script times out Issue #1093 identified that the vrrp process was entering an infinite loop after a track script timed out. This was due to a child process thread having an RB tree for PIDs as well as for the timeout, and if a child process timed out, the thread wasn't being removed from the PID RB tree. This commit now ensures it is removed. - Fix the abbreviation of Shortest Expected Delay. - Don't free unallocated memory if not tracking processes. - vrrp: Rewrote JSON code Remove dependency to json-c extralib by using a simple streaming JSON writter. Refactored code to make it simple to maintain. - vrrp: Fix JSON handling for v{route;rule}. - autoconf: fix nftables selection We need to inhibit nftable compilation if compiling system has kernel header file nf_tables.h but not libnftnl nor libmnl.- update to 2.0.10 - Fix compiling on Alpine Linux. - Stop printf compiler warning on Alpine Linux due to rlim_t. - manpage cosmetic. - Fix removing snmpd read threads when snmpd becomes unavailable. - Update to support libipset version 7. - Use ipset_printf for ipset messages so can go to log. - When opening files for write, ensure files can only be read by root. Issue #1048 referred to CVE-2018-19046 regarding files used for debugging purposes could potentially be read by non root users. This commit ensures that such log files cannot be opened by non root users. - Disable fopen_safe() append mode by default If a non privileged user creates /tmp/keepalived.log and has it open for read (e.g. tail -f), then even though keepalived will change the owner to root and remove all read/write permissions from non owners, the application which already has the file open will be able to read the added log entries. Accordingly, opening a file in append mode is disabled by default, and only enabled if - -enable-smtp-alert-debug or --enable-log-file (which are debugging options and unset by default) are enabled. This should further alleviate security concerns related to CVE-2018-19046. - vrrp: add support to constant time memcmp. Just an update to use best practise security design pattern. While comparing password or hmac you need to ensure comparison function is time constant in order to figth against any timing attacks. We turn off potential compiler optimizations for this particular function to avoid any short circuit. - Make sure a non privileged user cannot read keepalived file output Ensure that when a file such as /tmp/keepalived.data is written, no non privileged can have a previous version of that file already open, thereby allowing them to read the data. This should fully resolve CVE-2018-19046. - drop b7a98f9265ffb5927c4d54c9a30726c76e65bb52.patch: included in update- added b7a98f9265ffb5927c4d54c9a30726c76e65bb52.patch to fix building with libipset >= 7- update to 2.0.9 - Fix updating a timer thread's timeout. Issue #1042 identified that the BFD process could segfault. This was tracked down to a timer thread which had already expired having its timeout updated by timer_thread_update_timeout(). The sands timer should only be updated if the thread is on a waiting queue, and not if it has already timed out or it is unused. - Don't requeue read thread if it is not waiting. This update matches commit 09a2a37 - Fix updating a timer thread's timeout should. - Allow BFD instance to recover after send error. If sendto failed in bfd_send_packet(), the bfd instance was put into admin down state, but there was no means for the bfd instance to transition out of admin down state. This commit makes keepalived log the first instance of a sequence of failures to send a bfd packet, but does not bring the bfd instance down in case the error is a transient error. If the error is longer lasting, the remote system will timeout, transition to down state, and send a message saying it is down. Once the bfd instance can start sending again the bfd instance can now transition again to up state. - Make DGB definition use log_message() rather than syslog(). - Fix building with --enable-debug configure option. - Start list of required kernel features in INSTALL file. Issue [#1024] asked what kernel features are needed to support keepalived. The simple answer was that it isn't recorded anywhere, so this is a start of making a list of the features required. - Make list_remove() call list free function and add list_transfer(). If an element is being removed from a list, the free function should be called. list_transfer() allows a list element to be moved from one list to another without freeing and reallocating the list element control information. - Add mem_check diagnostics re calling functions of list functions. When using mem_check, mallocs and frees were recorded against the list functions, and the originating functions weren't identified. This patch adds recording of the functions calling the list functions so that the originating function is identified. - Simplify the processing of comments in configuration files. This commit moves the handling (and removal) of comments to a single function (called from read_line()) which simplifies the processing of config files. - Add ~SEQ(start, step, end) config functionality Where a configuration has repeated blocks of configuration where the only thing that changes is a numeric value (e.g. for VRIDs from 1 to 255) this allows the block to be defined once, and a single line using ~SEQ can then generate all the blocks. - Use REALLOC when building a multiline definition. The code used to use MALLOC, strcpy() and FREE, but REALLOC can do all this for us. - Improve mem-check diagnostics. When using an allocation list of over 50,000 entries, it was quite slow searching thtough all the entries to find the matching memory allocation, and to find free entries. This commit changes to using malloc() to create entries, and a red-black tree to hold the entries. It also has a separate list of free entries. This commit also adds 4 more types of memory allocation error, and improves the consistency of the entries in the log files. - Don't attempt to delete VMAC when underlying interface is deleted. If the underlying interface of one of our vmacs is deleted, and we know the vmac has been deleted, don't attempt to delete it again. - Include master state in determining if vmacs are up or down Netlink doesn't send messages for a state change of a macvlan when the master device changes state, so we have to track that for ourselves. - Turn off parser debugging. - Make test/mk_if create iptables chains. - Handle interfaces not existing when keepalived terminates. If the underlying interface of a vmac we created has been deleted, the vmac will not exist so don't attempt to delete it again. Also, don't attempt to reset the configuration of the underlying interface. - Handle the underlying interface of a macvlan interface going up/down. The kernel doesn't send netlink messages for macvlans going up or down when the underlying interface transitions (it doesn't even update their status to say they are up/down), but the interfaces don't work. We need to track the state of the underlying interfaces and propagate that to the macvlan interfaces. - Fix duplicate value in track_t enum. - Fix check for matching track types. - Treat macvtap interfaces in the same way as macvlan interfaces. - Improve handling of interfaces not existing when keepalived starts. - Fix handling interface deletion and creation of vmacs on macvlan i/fs. - When interface created, open sockets on it if used by VRRP directly If an interface is created that has vrrp instances configured on it that don't use VMACs, or use vmac_xmit_base, then the raw sockets must be opened. - Force seeing a transition to up state when an interface is created. - Fix netlink remnant data error. - Add command line and configuration option to set umask. Issue [#1048] identified that files created by keepalived are created with mode 0666. This commit changes the default to 0644, and also allows the umask to be specified in the configuration or as a command line option. - Fix compile warning introduced in commit c6247a9. Commit c6247a9 - "Add command line and configuration option to set umask" introduced a compile warning, although the code would have worked OK. - When opening files for write, ensure they aren't symbolic links. Issue #1048 identified that if, for example, a non privileged user created a symbolic link from /etc/keepalvied.data to /etc/passwd, writing to /etc/keepalived.data (which could be invoked via DBus) would cause /etc/passwd to be overwritten. This commit stops keepalived writing to pathnames where the ultimate component is a symbolic link, by setting O_NOFOLLOW whenever opening a file for writing. This might break some setups, where, for example, /etc/keepalived.data was a symbolic link to /home/fred/keepalived.data. If this was the case, instead create a symbolic link from /home/fred/keepalived.data to /tmp/keepalived.data, so that the file is still accessible via /home/fred/keepalived.data. There doesn't appear to be a way around this backward incompatibility, since even checking if the pathname is a symbolic link prior to opening for writing would create a race condition. - Make netlink error messages more meaningful. - Fix compiling without support for macvlans. - fix uninitialized structure. The linkinfo and linkattr structures were not initialized, so we should not expect that unexistant attributes are set to NULL. Add the missing memset(). - fix socket allocation with dynamic interfaces. When there are several vrrp instance binding different interfaces that don't exist at startup, their ifindex is set to 0 in the sock. The function already_exist_sock() that lookup for an existing socket will always return the first sock because the ifindex is the same. Later, when an interface appears, the fd will be created for one instance, and all instances will wrongly use this fd to send the advertisments. Fix this by using the interface structure pointer instead of the ifindex as the key for sock lookup. The problem was identified by Olivier Matz who also provided a patch fixing the problem. This patch is a slight rework of Olivier's patch, better using the existing data structures that keepalived already holds. - When creating a macvlan interface, use AF_UNSPEC rather than AF_INET. - Stop using libnl for configuring interfaces. Since there is code to configure the interfaces using netlink without using libnl, there is no point in having code to do it using libnl. - Fix building on Centos 6.5. - Stop including some files not needed after libnl removal for i/fs. - Fix some compilation issues when building without vrrp support. - Stop using linbl for mcast group membership and setting rx buf sizes. Since there is code to handle multicast group membership and setting kernel netlink receive buffer sizes without using libnl, there is no point in having code to do it using libnl. This now means that the vrrp functionality no longer uses libnl. - Add some sanity checking of configure options. Certain invalid combinations of configure options could cause compile errors, e.g. --disable-vrrp --enable-vrrp-fd-debug. This commit ensures that invalid combinations aren't allowed, in order to stop the compile errors. - Fix invalid configuration combination caught by previous commit. - Use netlink to set/clear rp_filter on interfaces. - Fix configure for building without vrrp. - Actually update the .travis.yml file to fix the problem. - Fix conditional compilation re epoll-thread-dump debugging. - Update INSTALL file now no longer use libnl-route-3. - Stop cast to incompatible function type warnings from gcc 8.1. - Update snapcraft.yaml not to include libnl-route-3. - keepalived exit with non-zero exit code if config file not readable. - Allow specifying default config file at configure time. - Use keepalived define for exit code when malloc failure. - Fix configuring fixed interface type. - Add configuring keepalived default configuration file. - Fix return value in get_time_rtt() error path. - Update generation of git-commit.h. - snapcraft.yaml: Enable all sensible build options. Preserve build time version in the snap version. Expose genhash. - snapcraft.yaml: Build keepalived with Linux 3.13 headers. - snap: Add an install hook to make sure a keepalived configuration exists. - snap: Move the hooks to the correct location. - snap: Make sure /etc/keepalived exists. - Fix building with IP_MULTICAST_ALL in linux/in.h but not netinet/in.h Issue #1054 identified that configure was checking the definition of IP_MULTICAST_ALL in linux/in.h but including netinet/in.h, which also has the definition, but only from glibc 2.17. This commit creates a local definition (in lib/config.h) of IP_MULTICAST_ALL if it is defined in linux/in.h but not in netinet/in.h. The reason for this is that compiles using linux/in.h fail due to conflicting definitions. - Fix creating iptables tables in mk_if. - Update .travis.yml to use xenial. - Update .travis.yml to add --enable-regex option. - Tidy up .travis.yml file. - snap: Build multiple keepalived binaries. - Updated snapcraft builds to support multiple kernel versions. - drop patches: - 5241e4d7b177d0b6f073cfc9ed5444bf51ec89d6.patch - c6247a9ef2c7b33244ab1d3aa5d629ec49f0a067.patch - 04f2d32871bb3b11d7dc024039952f2fe2750306.patch - refreshed patch: linux-4.15.patch- update to 2.0.8 - Improve identifing interface as macvlan when reading interface details - Enslave a VMAC to the VRF master of the underlying interface. - Use addattr32 rather than addattr_l for if_index. - Only include VRF support if kernel headers support it. - Fix --enable-timer-debug configure option. - Fix some configure.ac enable option tests. - Include stdbool.h in process.c. - Fix diagnostic message re ignoring weight of tracked interface. - Fix track_bfds with weights. - Correct conditional compilation definition name. - Fix memory leak in HTTP_GET/SSL_GET. - Fix two memory leaks in DNS_CHECK. - Don't consider retries for BFD_CHECK. The BFD_CHECKer doesn't support retries, and the check was causing the checker not to transition to down state. - Fix memory leak with BFD_CHECK. - Restart global notify FIFO handler after reload. - modify @WITH_REGEX@ to @WITH_REGEX_TRUE@ - Fix compiling without BFD support. - Stop bfd process sending double the number of packets. If a bfd process received an initial bfd packet, it scheduled a second bfd_sender_thread thereby causing two packets to be sent in every interval. - Use timerfd for select timeouts rather than select timeout parameter This is a precursor to moving to using epoll. - Use epoll rather than select. epoll is both more efficient than select and also doesn't have a file descriptor limit of 1024, which limited the number of vrrp instances that could be managed. This commit also introduces read-black trees and the list_head list type. - Add --enable-timer-check option for logging calls for getting time Calls to update the current time from the kernel are made too frequently, and this patch logs when the calls are made, and how long since the previous call, so unnecessary calls can be removed. - Add debug option for monitoring epoll queues. This is enabled by --enable-epoll-debug and replaces --enable-timer-debug. - Use system monotonic clock to generate a monotonic clock. Rather than have our own code for creating a monotonic clock, use the kernel's monotonic clock. - Make some functions in timer.c inline. The functions had one line of code so inlining them is more efficient. - Fix requeueing read and write threads after read/write timeouts. - Fix initial allocating and final freeing of thread_master epoll_events. - When cleaning up threads, also clean up their thread_events. - Add thread_close_fd() function to release thread_event_t on close When a file descriptor that has been monitored by epoll is closed the thread_event_t structure used for managing epoll for that fd has to be release. Therefore calls to close() and replace by calls to thread_close_fd(). - Make parent process write log entry when it is reloading. - Move checking for thread timeouts to timerfd_handler There is no point in checking for thread timeouts if the timerfd isn't readable; in other words only check for thread timeouts if the timer has expired. - Make bfd reschuling timer threads more efficient. - Streamline DNS_CHECK code. - Fix buffer overrun with track file path names. - Add timestamp when writing mem_check entries to file. - Ensure thread_event_t released for ready threads at termination. - Increase open file limit if large number of VRRP instances. Each VRRP instance can use up to 2 file descriptors, and so if there are more than 500 ish VRRP instances the number of open files can exceed the default per process limit (1024 on my system). The commit allows 2 file descriptors per vrrp instance plus a few more, and if the RLIMIT_NOFILE value returned by getrlimit isn't high enough, keepalived will increase the limit. - Ensure that child processes run with standard priorities/limits. When child processes such as notify scripts, track_scripts and MISC_CHECK scripts are run, they should not inherit any elevated priorities, system limits etc from the parent keepalived process. - Change multiple spaces to tabs in scheduler.h. - Add family to sockpool listing. - Fix a multiline definition expansion issue. - Free allocated cache when closing/freeing netlink socket. When running on a system with 500+ interfaces configured and adding 1000 VMAC interfaces, the heap was growing by 340Mb due the netlink cahce not being freed after creating each VMAC interface. With this patch the heap only grow by 3.7Mb (if creating 1000 VMAC interfaces the heap grep by 905Mb now reduced to 6.1Mb). - Stop using netlink cache when adding and configuring VMAC interfaces. When running on a system with 500+ interfaces configured and adding 1000 VMAC interfaces, it was taking 2.3 seconds to add the interfaces. Without populating a netlink cache each time a VMAC interface is created it now takes 0.38 seconds to add the interfaces (if creating 1000 VMAC interfaces it was taking 6.1 seconds, now reduced to 0.89 seconds, and the heap growth is reduced from 6.1Mb to 3.9Mb). - Add function rtnk_link_get_kernel for dynamic linking. - Fix compiling without JSON support. - Add support for recording perf profiling data for vrrp process. - Add comment re usage of MAX_ALLOC_LIST. - Some streamlining of scheduler.c. - Merge --enable-epoll-debug and --enable-dump-threads functionality. - Let thread_add_unuse() set thread type, and use thread_add_unuse() more. - Use break rather than return in process_threads(). - Fix segfault when reloading with HTTP_GET and no regex configured. - Merge the next-generation scheduler. - Make all debug options need enabling at runtime. Previously if configure enabled a debug option its output was always recorded, which meant that if one didn't want the output, configure/ compile was needed. This commit adds command line options that need to be set in order to turn the debugging on. - Remove unwanted debug message. - Fix parsing --debug options. - Fix rb tree insertion with timers. - Add missing functions for thread debugging. - Add vrrp instance VMAC flags when dumping configuration. - Ensure parent thread terminates if child has permanant config error. - Ensure don't delete VMAC interface if keepalived didn't create it. and sundry fixes. - If receive lower priority advert, send GARP messages for sync group. A recent update to issue #542 identified that following recovery from a split brain situation, GARP messages weren't being sent. It transpired that, if a member of a sync group in master state received a lower priority advert and vrrp_higher_prio_send_advert is set, a further (lower priority) advert is sent, and the instance and all the members of the sync group transition to backup (the other members of the sync group don't send a further advert since they haven't received a higher priority advert). This meant that the other members of the sync group on the keepalived instance that remained master didn't receive a lower priority advert, and so didn't send further GARP messages. This commit changes keepalived's behaviour, so that if a vrrp instance is sending GARP messages due to receiving a lower priority advert and it is a member of a sync group, keepalived will also send GARP messages for any other member of the sync group that have garp_lower_prio_rep set. - Allow 0.0.0.0 and default/default6 for rule/route to/from addresses. - Check return value of SSL_CTX_new(). - Check return values of SSL_new() and BIO_new_socket(). - Only allow subnet masks with routes or virtual IP addresses. For example, if specifying a via address or preferred source address for a route, it isn't valid to specify a subnet mask. - Add inet/inet6 to specify ip route/rule family if ambiguous. - Remove superfluous parameter from parse_route(). - Add "any" and "all" as synonyms for "default". - Fix memory leak if route destination address is wrong address family. - Add ttl-propagate route option. - Fix checking return status of kill(). - Fix building with --enable-debug configure option. - Stop delay in reload when using network namespaces. If running in a network namespace, getaddrinfo() could take over 30 seconds before timing out while trying to contact a name server. To alleviate this, the hostname is remembered from when keepalived started. - Fix spelling of propagate in propagate_signal(). - Fix effective_priority after reload if tracked interface down. - Cosmetic grammatical changes. - Add debug option for dumping vrrp fd lists. - Fix calculation for vrrp fd timers. Starting or reloading keepalived when an interface that was tracked interface was failed was stopping other vrrp instances that were on the same interface but not using VMACs coming up. - Move code for initialising tracking priorities to vrrp_track.c. - Don't overwrite track file on reload. - Don't attempt to write track file if path not specified. - Fix compiling when not using --enable-vrrp-fd-debug. - Fix compiling with configure --enable-vrrp-fd-debug. - Add sync group track_bfds and track file status to config dump. - Move initialisation of track_files. - Don't alter effective_priority if track_file take vrrp instance down. - Don't log vrrp instance in fault state at reload if already fault. - Fix calculating fd timer if all vrrp sands are set to TIMER_DISABLED. - Don't make all sync groups transition to backup on reload If a sync group was in master state, and can still be after a reload then allow it to stay in master state. - Don't have track_bfd list in vrrp_sgroup_t in BFD not enabled. - Fix memory leak re vrrp_sgroup_t track lists. - Tidy up some freeing of MALLOC'd memory. Use FREE_PTR if it is not known if the pointer is valid, and don't clear the pointer afterr FREE/FREE_PTR since FREE does it anyway. - Add memory.c list size definition and move definition from memory.h. - Increase size of checksum value for MEM_CHECK. - Don't store checksum of memory allocation block. It can be calculated from the size, so do so. - Make the checksum for memory allocation blocks unsigned. - Use an enum for memory allocation block types. - Update comment re debug bit for memory detect error. - In memory alloc debug code report free or realloc for not alloc'd. - Allow for PIDs up to 2^22 (7 decimal digits). - Add function for dumping memory allocation while running. - Fix max memory allocation size calculations. - Fix reporting original and new file/line/func for realloc. - Check matching block for realloc is allocated. The same memory block may have been previously allocated and freed, so we need to make sure that the block we find is currently marked as allocated. - Use a new MEMCHECK struct for realloc overrun detected It was marking the allocated block as an overrun block, whereas it needs to be an allocated block, so use a new block to mark the overrun. - Tidy up working of a couple of memory allocation messages. - Use for loops rather than while blocks in memory allocation code. - Report number of mallocs and reallocs with MEMCHECK. - Attempt to log first free after double free in MEMCHECK. - Streamline use of buf/buffer in memory.c. - Always use first free entry in alloc_list for MEMCHECK. - Define MEMCHECK alloc_list size via configure. - Align keepalived_free() and keepalived_realloc(). - Make char * const where possible for MEMCHECK. - Merge MEMCHECK keepalived_free() and keepalived_realloc(). Most of the code was common between the two (or should have been), so it makes sense for them to use common code. - Ensure only relevant thread types run during shutdown. - Fix building without --enable-mem-check. - Use rbtree search for finding child thread on child termination. It was doing a linear search of the rbtree in timeout order. This commit adds another rbtree for child processes (vrrp track scripts and check_misc scripts), sorted by PID, to make the search by PID more efficient. - Make rbtree compare function thread_timer_cmp() more efficient. - Remove child_remover functionality - it was superfluous. - Fix checking that there are no duplicate vrrp instances configured The tuple {interface, family, vrid} must be unique. The check for this was being made completely incorrectly. - Delay creating vrrp notify FIFO. - Remove struct sockaddr_storage saddr from sock_t. - Use an rbtree for finding vrrp instance for received advert. Previously the code search a list of pointers to vrrp instances and looked for a matching fd and vrid. In order to optimise this, it was implemented using an mlist whose index was a hash of the fd and vrid. This commit changes the approach and uses an rbtree for each sock_t. Since the sock_t that the advert was received on is known, the rbtree search is only searching for a match on the vrid. Not only is this more efficient, but it is simpler, uses standard code, and reduces the code by over 60 lines. - Use an rbtree for finding vrrp instance for socket timeout. Previously the code search a list of pointers to vrrp instances and looked for matching file descriptor and sands < time_now. In order to optimise this, it was implemented using an mlist whose index was a hash of the fd. This commit changes the approach and uses a second rbtree for each sock_t. Since the sock_t that the timeout occurred on is known, the rbtree search is only searching for a match of the sands. Not only is this more efficient, but it is simpler, uses standard code, and reduces the code by over 220 lines. - Remove superfluous checks of rbtree node != NULL in rb_move(). - Remove superfluous check of node != NULL in rb_next(). - Update rbtree code to Linux 4.18.10. - Fix debug logging of sands timers before time_now. - Update rb_for_each_entry etc and rb_move to use rb_entry_safe. With the added definition of rb_entry_safe in the rbtree code updated to Linux 4.18.10, the refinition of rb_entry was reverted to the kernel definition. That meant that rb_for_each_entry, rb_for_eacn_entry_safe and rb_move neded to be updated to use rb_entry_safe rather than rb_entry. - Add support functions for rbtree rb_root_cached. This is in preparation for the use of rb_root_cached in the next patch. - Use cached rbtrees where the key is a timeval_t sands When the key of an rbtree is a timeval_t sands keepalived will frequently need to access the first node of the tree in order to calculate the next timeout. This applies to the read, write, child and timer threads queues, and also the vrrp queues on a sock_t. The use of cached rbtrees for these is ideal since it gives direct access to the first node of the queue. - Add thread_add_read_sands to avoid introducing timer errors. When using thread_add_read and the timeout was held as timeval_t, it was converted to and offset from time_now, and then converted back to a timeval_t, but time_now was updated, resulting in a slightly different value being used as the timeout. Using thread_add_read_sands() avoids the double conversion and results in the timeout being more accurate. - Replace NETLINK_TIMER with TIMER_NEVER. It makes the code easier to read, and since NETLINK_TIMER was defined to be TIMER_NEVER it doesn't change the functionality. - Handle preempt delays not expiring at same time on sync group If different vrrp instances in a sync group had preempt delays that expired at different times keepalived looped with very small to epoll_wait() until all preempt delays had expired, causing high CPU utilisation. Keepalived now reschedules vrrp instances with a delay of 3 * advert_int + skew time while waiting for all vrrp instances in the sync group to expire their preempt delays. - Fix segfault when receive netlink message for default route added. - Move vrf_master_index into conditional compilation block. - Store interface macvlan type. - Make vrp_master_ifp point to self for VRF master interfaces. - Log if cannot create a VMAC due to existing interface with same name. - Handle delete/create of macvlan i/fs which aren't keepalived's. - Tidying up keepalived_netlink.c. - Handle VRFs changing on macvlan i/fs which have VMACs configured on them. - Fix recreating our VMACs if they are deleted. - Fix detecting address add/deletion from underlying i/f of our vmacs. - Don't use configured_ifp or base_ifp if not _HAVE_VRRP_VMAC_. - Distinguish between VMAC on real i/f and no VMAC on macvlan i/f If keepalived is configured to have a non VMAC interface on a macvlan interface, we want to use the macvlan interface rather than the underlying interface, whereas if we have a VMAC interface on a macvlan interface, we create the VMAC on the underlying interface of the macvlan. - Update duplicate VRID check where vrrp instance configured on macvlan. If a VRRP instance is configured on a macvlan interface, the duplicate VRID check needs to be done on the underlying interface. - Check for VRID conflicts when changeable interfaces are added For example, a vrrp instance could be configured on a macvlan, and that macvlan could be deleted and recreated with another base interface. The VRIDs in this case need to be checked for duplicates against the base interface, and so the VRID check needs to be done dynamically. In order to allow VRID conflicts to produce config errors at startup, by default keepalived assumes that there won't be interface movements as described above, and will only handle it if the global_defs option 'dynamic_interfaces' is used along with the option 'allow_if_changes'. - Remove some comments inserted for tracking changes to code. - Fix building with --enable-debug configure option. - Check that '{'s and '}'s are balanced in the configuration file. - Allow more flexibility re placing of { and }. - Improve reporting additional '}'s in configuration. - Minor improvements re thread handling and cancellation. - Remove unused THREAD_IF_UP and THREAD_IF_DOWN. - Replace getpagesize() with sysconf(_SC_PAGESIZE). - Increase netlink receive buffer for dumps to 16KiB. - Dynamically set the netlink receive buffer size. - Sort out setting netlink receive buffer size. - added patches for changes found during the review of the dbus code: (boo#1015141) CVE-2018-19044 for https://github.com/acassen/keepalived/commit/04f2d32871bb3b11d7dc024039952f2fe2750306.patch CVE-2018-19045 for https://github.com/acassen/keepalived/commit/c6247a9ef2c7b33244ab1d3aa5d629ec49f0a067.patch https://github.com/acassen/keepalived/commit/5241e4d7b177d0b6f073cfc9ed5444bf51ec89d6.patch - enable dbus support on TW by default (boo#1015141) - enable json stats dump support- use %license- update to 2.0.7 see /usr/share/doc/packages/keepalived/ChangeLog - refreshed keepalive-init.patch: - reduced patch to minimal changes - made sure it actually reads our sysconfig file - refreshed linux-4.15.patch - enable http regexp support: new BR pcre2-devel - update rpmlintrc to actually match the error message: glob vs regexp- Only Require insserv on distributions without systemd. - Fix systemd related requires/buildRequires - Do not run scriptlets that use insserv when using systemd- add linux-4.15.patch- update to 1.4.1: * Improve and fix use of getopt_long(). We musn't use a long option val of 1, since getopt_long() can return that value. getopt_long() also returns longindex == 0 when there is no matching long option, and there needs to be careful checking if there is an error to work out whether a long or short option was used, which is needed for meaningful error messages. * Write assert() messages to syslog. assert()s are nasty things, but at least let's get the benefit of them, and write the messages to syslog, rather than losing them down stderr. * Enable sorry server at startup if quorum down due to alpha mode If alpha mode is configured on sufficient checkers so that a virtual server doesn't have a quorum, we need to add the sorry server at startup, otherwise it won't be added until a quorum has been achieved and subsequently lost again. In the case where some of the checkers remain in the down state at startup, this would have meant that the sorry server never got added. * For virtual servers, ensure quorum <= number of real servers If the quorum were gigher than the number of real servers, the quorum for the real server to come up could never be achieved, so if the quorum is greater than the number of real servers, reduce it to the number of real servers. * Fix some SNMP keepalived checker integer types and default values. Some virtual server and real server values were being sent to SNMP with a signed type whereas the value is unsigned, so set the type field correctly. Some virtual server and real server values that apply to checkers are set to nonsense default values in order to determine if a value has been specified. Handle these values when reporting them to SNMP replying with 0 rather than a nonsense value. * Fix some MALLOC/FREE issues with notify FIFOs. * Add instance_name/config_id to alert emails' subjects if configured. If multiple instances of keepalived are running, either different instance_names and/or config_ids, it is useful to know which keepalived instance the email relates to. * Ensure that email body string isn't unterminated. Using strncpy() needs to ensure that there is a nul termination byte, so this commits adds always writing a nul byte to the end of the buffer. * Remove duplicate fault notification. * Fix problem with scripts found via PATH with a '/' in parameters. Recent discussions on issue #101 led to discovering that if an executable without a fully qualified name was specified as a script and there was a '/' character in the parameters, then the path resolution would not work. * Send SNMP traps when go from backup to fault due to sync group. Commit 020a9ab added executing notify_fault for vrrp instances transitioning from backup to fault state due to another instance in the sync group going to fault state. This commit adds sending SNMP traps in the same circumstance. * Revert "Add instance_name/config_id to alert emails' subjects if configured". This should be handled by setting router_id * Add config option to send smtp-alerts to file rather than send emails This is useful for debugging purposes. * Add additional entry to Travis-CI build matrix. * Fix segfault if no sorry server configured for a virtual server.- enable json stats and config dump support new BR: pkgconfig(json-c) - disable dynamic loading of libipset and link it instead - enable stacktrace support - turn on snmp-rfcv2 and snmp-rfcv3 support - do not reference the keepalived.socket in the rpm scriptlets- update to 1.4.0 * Add Linux build and runtime versions to -v output. * Log kernel version and build kernel version to log at startup. * Don't sleep for 1 send when exiting vrrp process if no vrrp instances. * With large configurations the syslog can get flooded and drop output. This commit adds options to not log to syslog, and also to log all output to files. * Add option to only flush log files before forking. * Don't poll netlink for all interfaces each time add a VMAC. We can poll for the individual interface details which significantly reduces what we have to process. * Print interface details in keepalived.data output. * Add high performace child finder code. The code to find the relevant thread to execute afer a child process (either a vrrp track script or a misc_check healthchecker) was doing a linear search for the matching pid, which if there are a large number of child processes running could become time consuming. The code now will enable high performance child finding, based on using mlists hashed by the pid, if there are 32 or more vrrp track scripts or misc check healthcheckers. The size of the mlist is based on the number of scripts, with a limit of 256. * Improve high performance child termination timeout code. * Preserve filename in script path name resolution. Some executables change their behaviour depending on the name by which they are invoked (e.g. /usr/sbin/pidof when it is a link to /usr/sbin/killall5). Using realpath() changes the file name part if it is a symbolic link. This commit resolves all symbolic links to directories, but leaves the file name part unaltered. It then checks the security of both the path to the link and the path to the real file. * Handle scripts names that are symbolic links properly. * Fix some RFC SNMP issues. * Fix removing left-over addresses if keepalived aborts. * Update openssl use to stop using deprecated functions openssl from version 1.1 deprecated certain functions that keepalived was using. This commit ceases using those functions if the version of openssl is >= 1.1. * Allow sync groups with only 1 member, but issue a warning. * Add replaceable parameters in configuration files. * Add multiline configuration definitions. * Fix keepalived.conf(5) man page. * Suppress error message when removing leftover addresses at startup. => find more changes at /usr/share/doc/packages/keepalived/ - rebase keepalive-init.patch - use upstream systemd service file instead providing an own one => removed keepalived.service - remove executable bit from samples in docdir - check that LVS support is enabled - optionally enable dump configuration and stats as JSON (via bcond) => BuildRequire libjson-c-devel - restrict /etc/keepalived permissions to root- Do not suppress errors from useradd. - Ensure neutrality of description.- update to 1.3.9: Revert using github tarball and use original source again. Too many fixes and features to list, refer to /usr/share/doc/packages/keepalived/ChangeLog for a detailed list.- Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468)- use tarball from https://github.com/acassen/keepalived/issues/524 the original tarball did not build. This has the necessary fix applied. for the 1.3.4 update see the TODO entry in the preamble.- update to 1.3.3 Some minor fix, extensions and updates. snapcraft support. Refer to /usr/share/doc/packages/keepalived/ChangeLog for more infos.- fix building with libnfnetlink. the additional include path needs to be in CPPFLAGS instead of CFLAGS now. - enabled a few more features: - enhanced snmp support (V2/V3 RFC) - make sure we build with ipset/libiptc and routes support - prepared dbus support: waiting for boo#1015141- update 1.3.2 - Security focused on notify heplers. Some minor fix and extensions. - changes from 1.3.1 - Quick script fix for regression brought by last release. - changes from 1.3.0 - New MAJOR release with stabilization fixes. Support to DBus. Conf extensions. Parser error log. Security extensions to run scripts more secure. - changes from 1.2.24 - MAJOR release with stabilization fixes and new features like support to network namespace. Refer to /usr/share/doc/packages/keepalived/ChangeLog for more infos.- update to 1.2.23 Some VRRP fixes. Some Healthcheckers fixes. Refer to ChangeLog for more infos.- update to 1.2.22 Some VRRP fixes. Refer to ChangeLog for more infos. - update to 1.2.21 Some fixes for last major release 1.2.20. Extensions on vrrp framework. Refer to ChangeLog for more infos. - update to 1.2.20 BUNCH of extensions, fixes, cleanup & production considerations. Distro packages maintainers are strongly encouraged to upgrade. - new BR libnfnetlink-devel - we no longer ship the VRRP-MIB- enhanced keepalive-init.patch : + replace tabs with spaces + read /etc/sysconfig/keepalived, if exists and use the settings there instead of the default KEEPALIVED_OPTIONS in case the user changed them- use package name buildrequires on sle11 to fix building- enable snmp for better monitoring - enable sha1 support- Update to version 1.2.19: + vrrp: fix checksum computation in vrrp v2 for socket family AF_INET. + Some cosmetics at Makefile stuff. - Changes from version 1.2.18: + some cosmetics changes (in memory and parser). + remove dead/not used code. + revert notify script brought by last release. + revert VRRP preemption speed up extension. + vrrp: ix vrrp removes incorrect IPv4 address when VIPs are removed. + vrrp: Re-enable VRRPv2 checksum on inbound pkts. - Changes from version 1.2.17: + zalloc use xalloc for consistency. + memory: fix wrong size calculation in zfree. + Fix keepalived snmp configuration. + Change comments to match kernel style. + smtp: Fix wrong algorithm in RCPT-TO building. + Lots of vrrp fixes. - Changes from version 1.2.16: + Properly close netlink channel to avoid fd leak. + Use getaddrinfo instead of gethostbyname to workaround glibc gethostbyname function buffer overflow (boo#949238). + Lots of ipvs fixes.- no longer install the init script on systemd systems- Update to version 1.2.15: + Bugfixes. - Changes from version 1.2.14: + VRRP bugfixes and extensions. IPVS bugfixes and code code cleanup. - Changes from version 1.2.13: + VRRP fixes and extensions. Extrend and unify checker framework.- Build with -DOPENSSL_NO_SSL_INTERN, if package starts accessing the SSL library internals it must fail to build now, in upcoming openSSL versions structures are opaque. - BuildRequire libnl3 - Do not strip binaries, fix -debuginfo packages.- fix bashisms in pre script/bin/sh/bin/sh/bin/sh/bin/shh02-armsrv3 1728645808  !"#$%&'()*+,-./01234562.2.2-150500.8.5.12.2.2-150500.8.5.12.2.2-150500.8.5.1 keepalivedkeepalived.confgenhashkeepalived.servicekeepalivedrckeepalivedkeepalivedAUTHORCONTRIBUTORSChangeLogNOTE_vrrp_vmac.txtREADMEkeepalived.conf.SYNOPSISsamplesclient.pemdh1024.pemkeepalived.conf.HTTP_GET.portkeepalived.conf.IPv6keepalived.conf.PING_CHECKkeepalived.conf.SMTP_CHECKkeepalived.conf.SSL_GETkeepalived.conf.UDP_CHECKkeepalived.conf.conditional_confkeepalived.conf.fwmarkkeepalived.conf.inhibitkeepalived.conf.misc_checkkeepalived.conf.misc_check_argkeepalived.conf.quorumkeepalived.conf.samplekeepalived.conf.status_codekeepalived.conf.track_interfacekeepalived.conf.virtual_server_groupkeepalived.conf.virtualhostkeepalived.conf.vrrpkeepalived.conf.vrrp.localcheckkeepalived.conf.vrrp.lvs_syncdkeepalived.conf.vrrp.routeskeepalived.conf.vrrp.ruleskeepalived.conf.vrrp.scriptskeepalived.conf.vrrp.static_ipaddresskeepalived.conf.vrrp.syncroot.pemsample.misccheck.smbcheck.shsample_notify_fifo.shsysconfig.keepalivedkeepalivedCOPYINGgenhash.1.gzkeepalived.conf.5.gzkeepalived.8.gzKEEPALIVED-MIB.txtVRRP-MIB.txtVRRPv3-MIB.txtkeepalived/etc//etc/keepalived//usr/bin//usr/lib/systemd/system//usr/sbin//usr/share/doc/packages//usr/share/doc/packages/keepalived//usr/share/doc/packages/keepalived/samples//usr/share/fillup-templates//usr/share/licenses//usr/share/licenses/keepalived//usr/share/man/man1//usr/share/man/man5//usr/share/man/man8//usr/share/snmp/mibs//var/lib/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:35326/SUSE_SLE-15-SP5_Update/b7a552aa00033f7b87b246c2a5164051-keepalived.SUSE_SLE-15-SP5_Updatedrpmxz5aarch64-suse-linux directoryASCII textELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, BuildID[sha1]=f77911022b314fd82dad17e725319043c18084b9, for GNU/Linux 3.7.0, strippedELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, BuildID[sha1]=5ed58d8f8c2779010fc3a684297dfc9786ed7099, for GNU/Linux 3.7.0, strippedUTF-8 Unicode textPOSIX shell script, ASCII text executableBourne-Again shell script, ASCII text executabletroff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix)troff or preprocessor input, UTF-8 Unicode text (gzip compressed data, max compression, from Unix) R RRR R R"RR!RRRR R RR$RRRR RRRRR R R"RR!RRRRRRR RRRR#R R idر4R%ysystemdsystemdsystemd-sysvcompatutf-83b347d43e638b6751b4b5c3a02d7b4e22e7e15231bc4361a9215366de41ada2b?@7zXZ !t/]"k%{SKښuwtǿ瓦\ܩLݻ5 hj(`7A=0)x2+2ɒl| ︬@G,'7 dOۀYlFy3Բ&lw37tA BvLZC!9%9fMwf,~ҽdo/LCBZȮma\T_&C n4/fAb b'O;/=W{uCq~i+ ,WG5 (+Ft &,WP~Dz!I2͜ Vzi1iϞX$)QyYmk`[J3HP.hc!tO MKSSsĢſWʾڕ;6Tg凖p;d)Im֤`OAE?MA'Ҩ Q Wv)Чu)~ql] )L!.sPaA88;Km |ytca-E[Jt. }k˩S;³5ӫA-wPՇp  >cC+q1˹WR};ªY)RAXBƙrE>)$~Vn(g!C2Y hq7̾z@]iӒvf6\t6٦ݧ sS%Vϩ`&:"8=8Ihn<*VX%,)$)g= kFB`R:MK=:ѿYxeR-#צ>,FwBi .;)1C5\vw"Bhjըs8YHɶ-5A"o%޼W(%;Ax^\Bdd ^svRZ a'P }~,BUVk&Igz[rsm(iG'rlE*\Ldu5ۛJl9գ!$WBax&s5 47c%_8T>D\$Sqh{Q: kꟾ@'lw.(18aUO82KldjYyTg*TK䶐<|<ĞLg|RWJ2FJ@DT8! F-}3"Pi&Ŀ`(/# 4$z$9AHFxO3ܖ.AoGłWo܇8j'A$|9`͠4-B#c(d/5-8L+o:qsBŪyjB  "DH^T[! %LF`N#7ADp,1O8|d*zʙ3~l# ko:L4,`K[bzі @WV/^Gnc&C;U֓3C0R2o|qK[Ƌ6 qzdJ?lt]r&)( |YL*_h8?ImּKPh 8hv_3؟caĘeG2MVUjvYxv<m#4Kn._R)=O -]K/׈ H#YDթtEK#*۱6 ڗT`ΦvYㄻ*wJՔ _=WFf z␤Eg٩h:@\` ?(e+GUą\ 'ќQ*I:u'>mN:ƒ3:%%1@@kWvJFc-7O'tk/5J=Wd"T2vX-KD҂Ѓ+G8"0khmt,hg&݂ٗ Cb3+ig:[_9ĽvB?Fa޽B 2c~PįE!dWs0 iZ΁8DZEH z N&W'sŜ hB5m*=M^# vV%r8L૎&VC4_emTh &046$N;VUjl]",8EJe> a=a; 8&+5yEbdH4,:hdj &Gq8z7ca/]\'xڢ 29+"Kzo|ohbyJZ9=E*~_*zT02e9@n D-) hAl@bop:\H.5Y!7ʂl3 K:v?(D Iyx{flPBdwqJڥlr79)@)r!P1(a0wE(Ƙ;[Ǫq:ɧJ3n"Ma8PE<(cGC3LLy,} R=f 'e1WG{6̆=r8U"J Ƞ{n(;Al6< 8Z g> {c43.UNdhnZ&jU?C VL7ut,<51RcJsmCyiǼ]*yA׀Zpnʌ^(s>_5wZ";q!_`33F-3M^*@eJ֏M3EDovI'M7[saܴteQs}Ja3\Joɒ6^EX~{!ݬɃe`X5ϻ"e_@j \j=꺄?P\%UOR ?Ҙ0=.?df[僶 -Q$w'[~bH~A"Q˙5Iwz`q?z"݃8|Ɗ} jԬ+"B-:s]k./N)?'|BnS, ծ/Oj;!)#aU4W+Zv568B|٫ǚ o(Zg̙xC_qiuGb-x+X]exϤg# x:]SQ\:xv~[{~f>}0z2mXUMX9o~ܾpWBB0I j 4gXDdm}K"2X5p "pK-OjEԷs)y>λL>b-=[8CfT_ !^%{_0* z?mNw-Eyxd@їY=<9|^X2=߶vx4VW"Ede%Ϡ=^Zaar HZz^N`”ɰova JPA d!O1J -_1*kf4Mfbm_7"Iag&zB?X]W"S2=B 8 V1 zpܛxkb[.b-ߚЭ 4,a&KR &<-'uZieB ž;A0E->FEqݯqƯ`$֭Edne]NͳxxBrAa:^E ACO1}ӱIoh5$O #\璵C)JR{ ^[ܨ/mz7ls8ɭBqZ)GO[KvgA%!n+莨#, jΏ E[ng'C!"Zz2ר D뤘:fAJ)RI^FuyC N>'KxC4 ٲs\`e0F+:ZSKKϖy{% 3堭x7Ԓ֒43R6uأlZŷ(-r(1J`C*Y]Xr)v)|LYv_G}rȒU&2. ^Ge{kϱM^@bW '+hK?qJƺzj0*}vߔ  ԇ,R 6ڏ,2@BPg-p9(rf3$_/NxHLR/Wv2fYnۍ)f0JZ:i5Uph;I4z㟨 Z'+=VFĖ?бmI 9PM>H]V|Q+#~ˆrfug59*ޫjnpa_>713+ (/zcs',燈_-J2?j i'"!l7pm>ߨ9bQ*d""'lZϱ*B,ȻV>k9$<"4s z-B+sǔ\]uN0rp;x#Q7j^lYc~S a]=E,r?/ j뎯ܡĨS2Z[mriQdyezPYv(:}^lu{*o 6 _.'Kx і Jgy{6F'У%)r PP2mH@N@_a{h;O2+:%uZ90u*[J4Pr;&?,MC g83"U(QiDW1qkp$g>I$(%\a%UJE^06BDgH?-gh/EElh=KeDJEV[E9`M p- -B¹F ɌE* z`^Zկ -xgr6C BnjGD%~#ˍ^M0@ިc9 ݨljq `k6偨TЧ‹5ѪUkJ* +}G2,1Zdnl7UܳP>֔&+Kة(utߍA̵GaS / z\KeI^p\zJ14.$`U &0Ƽ4 idR .Ȧ_E6x &`d*&ӆ![jZ5ez)tU5<ڐ]z _7 gFwDW*˙SJ 晤 M"y(M.+CCSq&-Rݥ }?sQxʄ3,X'ɡֽBԌpGXs"fsA?LQv<*J?׉ l/YЏE=Z34.4DdW)zz<Dzi!'e23$'$W36|xûuU =a8YK;|%ƴsG'*?ilrX( Ɉ~t:Pԁ_(5{7[;j5 Fg`h G+)_V`a~nSCܟz^Cb'}?W-%o;*UnKIXry~=s/:pfVKkH,"*IN<7[=Y mB#K$+~g&|*: 36o^($B=H,%_66ۚ0Sc ,Lk|4B"7r*ߞRgD4f EN<[xС,A7a|𧷳1&_*˄ mP(e-&tK+!UYVudbJ=1=n_,?MA*̞b߻ƀʷbEj92BN"/TI޾T/\r{"Vb 8iSKQ:33bp򜪈dj JaDLjKCpf0vNG֫36DQK,nAsпw5MFT24l5f fyV!7T0EaN꼉Tm0]8n13:ͥ2G} dzJ% Of!c:^&ױIsX1ֳض=nVj}ٷȠ+=;5zF]HA,Frx:sTdv 0gHpǢ 3x[0)g|lq qY) K\z-֕xnLW?Q*VO!=m(d]o:%J~H9ޫQvGk &ᵠԇ+žAYo\V`b#c SG~1P~RyK+O%80إ81R.M򝘮Bܲe:{A/nkU1 g״scc!-Ju܌X^}E>-txOeng+ AwvazVPϫhEY՝',)ЙIs~r(.@q=-~Մp71fۓґkNޯЊ35c-7?"L5xòf8eaekHՁg6h@,) FJvё%. , by7a⠼%j|MD֎&\"TzEomo0t70rx8릃, lG7!ao|#c7dZہ0"P;b3({x=@ի#̨:h-)LF2Y-b7/Ti6wo_cs0^ji1$]RP}F>Nz?H>=mSEmo^ouo %>I)dEӏ޽[ϙ/;GVIȑ&:x`ES;B̏gSMc]鬮HܽK) 54v~bt%x9!eZȕ=]Vgg'XTTi/XyMa]^əYF}OW,Hͤ{ޞYBylpYNeYiOL<|2!4KhwW #b;>m6GN\ƬӒz\OE ~M^/!E8 qߊ)LEB[ @Y7,Xi6ϡ-Y2íyB Ĺo$bpp2\*:_OiXL| "Zi)mSy? n3a>U↧.z;FV+ǡjHnZ-0 wtl1L=qj D{W;S-+}OeV%lSZHޔ89ak,"k$xV@LG&D>pe3X(v#w,u o}U2LO-s,3\K>WΩQ4t܀|Kj7oZnH)FR.ުU0Ȇ4%JJZA, ^dOK!OH&F/*@34X;l|ugb$ D1,{g}SRy^JOZm\e/ nb64a mI 0Bjz v[]濠6 q궸-pAr&PxάR"ЇŚ^Rq3dvRL@ Y/z-VvzW@"\`w[Yp@w 8x/*!Y>5%1J za=U5U3* r_gte$0EqЛϒGÞ\7t?~& +T{ C?dN%"[=neSR&`p`W(L%6)2#I (x3F|NÅF X 8jʺn@ICC5ycd #=ENI"+ -J`IXƇC׫LT&]@^ޮ_rks{Gp xYs. G{]Ť]^dj 75XnnH2i9I? vT20^EsnŎF |ÎK5RpH_;2W {|3* 0ꎡ[Xd*AyA:ncwxH\B 2iD }!SN 5y@]\|TcM9”,Xk XV&MO( >=5ط<>x~!t<7Q/\8jֆcYȪ?2"א/ vX9ȸƕg%aYn&{b!!\OehU~R{qG5-k tnVG7h UvMR+L|sb 7X|řZڴL596k/ۿ2^{TݢkUEH_g_ጿkhB]U4TphO ¤>S!6W9Dci\I6Dټuڳͧ T+jAK+q^vWix lrDbrslw \3ʾ}/V'=XX=1l(^ױ6*@G*ehO#9`.Wa,;F iV$%'dc0m]H]pZ3} iEώ5Ss.SI {5A/@SAS0ߩfC_GͮOg؎mVC0BOՖ(4yjjlyH[+D٘()zS8<5o6) q/F ըp!*$Իd-R=6;kX@YoǬ=TQ&'gj"k& aZCD 1$SO 6V4%e\^iW o|iZx{0ghb|/k yeqw=*vB|7j|xCoQmB=uuO"l T:z8R5Y ehX q,A WcHԎ2è_ZAYDjY\٥?+5GK8Cf02839(^$Ib.[;V?E|=y"u6T֯:v6Ť:dh-lkoQȧDiR"$0P@iBn.@2C_ Rn.${g(wq]!%O%~,{35Y)oL):ky1VkD-)"DS Z=vV@Z +G5wª| 7轏RylYmO3n_4vḮB`{p@!mz"zV\Cvm[چ:R&j70@Cx N˖XHL2*'j(I>ۘ)9v_83 &хg|eLpbÔUTۼq|1(e3A9\`9?yy|iHJpQ{FP. &錴U>>dN`SIM"-˹,ur4Bߔ6}1JEauHz.vdB$}7|WEg;NpE |FZJo/Y!W(@uLG!`YV)A=;A\d3M`kc#L-:@?щO_w[G?BXۣl7q g)*0'k%hڭ﭂*P4_@0>J6ʒуeHdy6k1+cxYFhڧ8 ILL@V'ZxjL]r@-!q?ha])KoێuPp5`ԯb>Vc6GBxDb9mY*`RH9wa-3W8ǞI܅'Z˨+zE@ֻAds:8l%@NӰc`#_F[mM> ,14ژrmxEx9Ȫ=x)q4j91OEmVk/x{.srT•aludfq:TF![DyԯQrΫpQ_☚b[J|-Oཹ(ˍDʀ'~ZFp @ȝ! a{{OL UU.Sw8# %:;a>u 5'G8. H@{5%uCAkM}j􏤬YdF6l^*"vq@( ͎fsAKMF P~CU|9JM" 7yGM!;ޭ^P1AɁ//&3f:\2fK#~OHa$ V=s aE6nGޮm ij+0,8SߒV5$b@xJœcħdzڢeXn>'v.k6/@Y)Ue)ּkzzij2x.* TzAS-#TJuU,Y/BJ=6GEU؍.wk ;?j:H!~%(H.{pdRJ^*P$O VNõG?ƞRf,3O"p lX3&i_xÒ+Qɾ4'E^ =չ=q.E/),\1K*mVc/DK+DlpS|^5b+#d8ՀK0k3 vZ5ݿO B g"svFBM>s# p-p&E 3u:8pDHYnZȓi`t?Pҷ=vFUjSI 3qKyD gvԟ;]b#<3YAQEg sv \cf#ޚ4y Д+Q}c;*0u85-a1huh] 姕k$/jtQv8@n/jN)SuS<6unXDžd.[(9`4ʽ)&mVФ{:#&kUU tyq gUI>M$b@v2Otø䱽 :IJMk#pzNQ@wN{# R";pր)֌+T#8 @4Kl-JW{o)t>G_ٗawd؎/4mǁr%_I̺W)%{H×]bϒ %GQ.ب3Lqګr} !既BD);m:s~g6ZeYp.7YsV=4liK%RD@%U̟q*tjz\4g$VYֽFA*aD.sX*Ԧ^:q [#,φ/;x6FccfCav}2aK>@V!sJ…gRU&%j9S2:4h_;7SOv߇#Ǫ(9Gb]_Em0DFZM*=LWˤ4G,(tkqIYu G);DCpFmH&23XRNq|>,y?oB#e\R}w-'Pjؑ̆~ ݆;ݞw 6 Xc pc@I:DRDwuL)/;y't!)AJ5臺xf/.W5SK"mr@AE/|H0bOŬ+4x$wx_Rc>!2h jBpVۃI|vSQ0ƱQ  u[vx?JSS Mo51R nC3pCGR(0I_IaRO;1G3Q\X{ TW1ȫsCj2F$A7OZIm3-Nz͞;vWmLM̋Y/H.ҫg=%@mSrG@(::^ '/*\P4QYt) UyߐSR׺(Dޫ4l-yj:l- 5_tōa7*< ՝SA%4E)=3g=K&*2/Y$MQ Q@U3+ba]%SKTm0 h8yaO>bf`ll(d6>~.IT:#}U2Gv IkPɨpㆶFIN~~} Y67*"߭ }sV[)g:C<1*A_XP()E?fb ֔pv¯q^q#~=S qБFF3 )0lq]"% ur䝴vi1h~"A^xǿw[Q66jEU18U j^:s^K-9|r WFeewqn{"%!1^)Kv} +>\A{O^~JdK*1)[_"Am(%!Q'B3׏PlHpݑ='flM3n|C Ɋ05GSݼtq3FIoʴt> pjRHUz INՙʼW:V*~淰zvR\6-B H(#٧#D<=9qNn5v)DEe61!Y̞ xsOvjq.'`\NU(feZİK-3kņYw[k<fq*v-vءv{9/53.i3DC7PkR}ӄ (L;5搩ZH&|OHoRLAJv*@,{zMj :Ⱦ&|$Ddotⱜ*sJZ&PAM#BYް_ f%]5ÖPj-_wh L(T:5I& DE΂2'h {m$2V =%Vs_f,1er^ +vW1âfr.9_ƯöjWCВvR\[7-2@YƉR犇 cz~'r NbQC; l`#b5>K~ ,l;t5KR&~֛ ȞA&Jٽx9e@Yt~R ʖC]ШHWs" 7c*;\cF9C%T'D? U@N3We銘x(UF@* b@#-ne">Lmv={݈Qe = ( Mty[Hz4-f9 +U#o~!aesZn8DfpI7kp7T ﳬ}|6ñS5fz p'D-+?6L˟7%|['C[K Aw(%4KqIrճxN!N@|u Uy\PC[gl 0-r``91gsd9'QHCE7S: }z5Y; a].kgg2OfxNJVW2Pr 2{jDDA$ Nb%oex v@qێTUEf^Bּ`=-[&G9iu2D.˵ z4೨c[1`V?*[NŢϓŸp2W7̶f1!H𠋰cI\Oh豾j^w( Q̲wC_wӬxS΁)657;1W Ҍ# w&P9x"E䎎gXnn{U6uT*iqț_5휐TDf.He+@R4S+%IKظ >m%@Z3sd ^xWX-p0_kZMYp7(H=]v5=,t EZ Qz Lq+ݜ% 6Q87“ FuMurcrl)a˗h1\r#/I3Jԗ4>t5L(0@k\݀?`(s +ኀ0W'Zv `ee#^e+2 -xAc:cK`b= _ǂ jQ6.Zj9Cpa+z`y$ F ֚Y䴌 0ftk^XHhiE'й.Q1aT "7v[Gp/` 2gK_ %w-=/;d`͙NSi4APMmDDUƉLz7GiMZ#qy&5!δ.C!3#V]@)8}R ?k\͎ת#A1=cp l/ɾ/D{!+Gɂf*%ҥ8NB auvJ~fN:>+V;[ܷ-aT" %_̓ߎ -2<ѽ|ANlڨ_P#<<#iKc4#ˍP'o3q &C,_9|Ѷ! oe]&DheC & LLM1"e65I`EъK O󋨵  ۅ6+xQO=w{c9hfB';&ᘷH,Ӌ2NE;}ݗi.k^F>ԵqLan}~0t)' =Xv7$87)2_Cp W=m5vw8a~ENƈGMm-))~ 2oI5Ent~nh lٴ+z%ַ* FkrK^ {뎤/)[.|B Ak) g'غ( EYVA'rH멚U?ٴTnA6as{;:F?D%njvP,y<.CSBE.aqwi9`FEڞ*: !\7سkG%r&Q*;t1kMdܸx0hdk6#+n; 8ze < iam̊S&ï1 =A`ߧ`1-5FH ƪZn9`n I#NO{Kf”Tc%^Ϸ='byEKoIS20ɩ3NTJ{[aD ٳT˧Bo=G1( DAǝ-l,Cit7(-n#R{]}nvB:t^a_f6!J}\}@q]Pxw"4]URJϨ+ܸF <leLR") /,O/빘X\y#hB ab8K`oթo'ʤ봵nHßtxJ 8 E#lq|=|jk<$)20%blU B1h笊V3O(7Jx^sL^(0"m1hԑ۠lEAqaiMP.N 7a2fk(׊6L*,lǤR-AMϧr  C`@o9oEtgtD:˪C74+; /7;X鲧M,8M4TRY{71Eݖ 7Vljz|'.'O2qj\Exj,O[*nOړ#VWq8KIat:r (le -%~81 llp{$9l:& ѱsC%0r`cusjX|cġ>Hg!"FSMs0p#3PոqR;ЮO&pA9\fVl Hz4yWLd]ѭi*x*o6N#O4D` Z@ws]ѷ[2x"P1˷xLʈI]Rz :6f\Ӄ_jj"]99A7~`!UOGx᩷2rǽ9+/r\R8F1ͧ5 F~rrvԵj?.ξ+Ԭi[ 7ר~OnrJpTM b'¥|sφU{wڬ%Zy-״B_ Ph  n]<1O[PrڏPpYdl}^[x3-Q! fr3WXL;7`>'HkϷzUT/)lђ)_ ~:B{xZݑT$z  O2 :$/ѹtr@GFxnuR"}nn`=8m`{|g + {5ZrnRKv.K?&Rz[YxomP虤!}PTm|Y_0&DV%Ps< N}QrO@Z*Wݾye~@261٤EJ8''^g]Џ#|g R(/p]Zݒ-Ѷz;|3m$-(o'0D0;q[e#SF-_"&FZ W՞(jFcl Tǽ7!qiUYM%ao* m#"pt͛JB9SupmR30㽛; ΣI<]*%'G9APPp,Ĝ rᢌmUXfNZV’t5?) 8Qķ8>Y<? %aO^Ձч};*@OX^_zG B-qpp?=O(>YsS̫ cCү|]6zr9AẊ-Ak٬5DSw[ʰPG;W\預68}^ה?$s<-Ij1Ea9]nuc3*%ZZ!3?i"YlS6Hhf{O)0T-,?<2[q%";T' nBLȘ:7/px:9b?0ReUb-aծ)"ʭL ?; ̢ Eϔ,m)f7ʭ&MZ:$C;ED$ډ9tR6)]wg\1YD+Ү]n\tJ`CgW8CF Nq̡Ak-E}+/A9%co`L\@ qK iQ_(mq6?.lBye;P a 띴  jؔo#yZ"X]nA "1veURt{`CB|Xr=ܬChGrb ,A{$xXm5fh~ڗJNoB1 ]GNd8[5bg@>dw_+1T6k]N%jh N@a`ij6N[Mŀ* F7O[ R8l죜l1G[f(hUb[gKgsOO~JnYn2fK GSO J&]}~1(3%41* B3*K',Pd+3Iz|l8\Mv'2(x:73= HDeڗPL@ -SſMNߒ|(]4MI[$/Eo }xM_YOFum'nZ:ʏbG JoF3;Rmbn=}%{5&T1s_#rtd?Qu^ Urzs~rxdj*?~D?2GLٷ߂M oFMKߕ1d?)Zi<+XKHf|11`Tj${Z=9*hP X1^jS}j7nԹMӻwvyGX"s$Rݰ!o5LW6C8Wor2^;C}Jip 6 CPm~K̕#x?Wyk"_kH3LW4rWFOFHMrsl&t ޲Zm0;m0\~Q۔1Cy@ǨQ]*.]jy;>Yl,E%ƂT%p}wV˸ePRe'8A߰^L ~x ü!vÁ=7EE7bt;w Yam٪y-/M8e%U;?JN+zEզlGguCλF_$V8 3=7&OE!d\$, g/l\y`,! R Ԧb&gJnt<>\+z*: Ss9mA.lM-^Q h 08)"{q}qSvNy5^|w/8y0Nˈ&Q8,zh|9@ݬn߰LRCv=SiM,@й{RhDˊ4ȃ#R M Vݾg?K3F/řT+ׄ] RBwBaVxjh h{e$6`Fl<{n^l?io#X[RIO`_űe] YEDۍ}jʓӕLY"[Qh )z (H!֏Gr^:1z=.n9Ä$9Չin?ne5QY}N$=Nvz' : 3xaf8ѫxѼXT0 ˧83*eMahupV.*qPx4{ykEccn/joYYtIھ9 =0Wѣ;krzl!5m}L.4}MƊj/A^t4rCD|{3zdc:gRXv8o? 1~t'8(hbv2I"vȅT6q0~2S 柟 KLjuݍYX ֬8A`RlFo9WfvZAn4>jI|쾗i@zZHhr{6p_u=b kPqe5~~ ]SzVo >jF 9㡓5=:?С/@Ǟ0yޖZq;(TB>خ&[mMAdU 8#$FffS:πͥ!v#jKQ2(6ʏvvwNniQ񩛣}9~ !gz6 _Ӹr& ߣΙw9Eqb~a`= ~Km1͆F`u2Cg>[7ӿSh]CsjxLLx%{E#y8i.ƪ9iO3k7'T|RVl VQQ[j="^d ?xW9(N #)XRW}tN.aA$:C^0 f[E>TPS9;7Zf:Lli~݆FXjS#mcq@st*58]?`p&VLf]hT#PzMފ"Tr FXLx!O,%zHxӮ|ٿWqkGظ$F7"Yk&?} } eJF~eG4CWeR5/=]7E*..(OݕN#R*KzYzn:GsSw|49&&S` k شo+>?UugT̸(`-9Wwe~Sm$^t='&;Uˢ@8ki 6JA1]FP#;X\G['p;Ro~\tm)R}XȘ4ۗ+˅1$e]]DqEۆiW9Ahm7xvk*GD*s3L/ȎC,<<Ğ|=ZrMĉEe%h'fvk3*w :.k{׼! ?0  f[C;4\xb5j٤Xkv3xNnn⋻ߗEk.ydp+OPۑ)t=o`F [\"%,=7}x5DveV6O#s: a3zIፒ /*qqIF|kxT?9 TWab=uFPw<͇̅^ڜݵm~M 1+2S9So zK/ui>sX10Y]xLQ~{x6!&o"\V<<>nXҞ_)9Nyb {mMFe(De"+9% <]vQnMUNٽٜVw9M21w ODfHMDrHQaZ5I9lij"'\9]`K[L(mܾnhe~#5!j^mz5z 3Ø/|F  1qs*4?W`ȼ'3A-)ضN6L1 | BNxdmEg v V6\Y3]_uDUVVRP 8yQD}+G?rBk,G'e4` i@"MRkl 7VB+B<X[xM+m,SpA[n CۭQʛc M:Qܲ,Mh Iǰa8cKժ?&.R`0nM9%8kIRvIז޴Lť"k ɋG )DXgC Σ2TR}T-)/i=Q(Ҏ t !&#Sjgm.|n\Ur",5Dz9vd]H@V*M/Yr=Bu$\|K7 }hfVȋFnq5/Cwrs2}hu譙݇SỜݝVNr[s: O8~>Χ/r/FL!jeVRj5rekKom+=Qɮ+~\ٹCQ؏9!eϴkN|AXFc>âcGXQ#<ʶȍ`,\us_dsVKtG]D|i=q +ĴҖ؟09ĊHq<3B!t⏏~RĮ _҃aVe'm /jb.{[80~3x/_Ēvng>4!`50m:?QsWK(ݵ@( Vm@D uh)+16ԁJ&\L<承E2Gc\I,2}SH}DXso= mSrE(̧2>"u*yثGTL1C^;)8o<*>Vw= ۅ οS H q3$oi't`ZjܔK|qц%97y`NKT۷5"AAGc//7+k~im{KspI 0Xi'|2GC|y5E+ njý 'aV茟͘^ȥ}v$}H#Uqٮq_GLlDŖ%,i6cd 9& Lnb'1ӊ ʗE49'n]1ݝ# \hPbzE}[jYuـC թoT@YΆ*/I'e,5-u>]HپMq^6lw>Ղx|K͠.y4B/.\xJM62$`V3c;pS+X=NB&3$-M^tNeC с4t<~:­,L悈:DH8]UQ&oƟ% yQmCǣAF"/?>k ;[ qt` 3ꣳP]9Nfy:jWb*½~мVGx̠Y0ʝiQ(; @-g4;੣mX]׉c.IhՄ0NYCP ͐M~y)<ɫCs¼DŽ^I8ΐ?('iQ/}.N@^;pIhF:5wj%pK@ =:Ӄ%)N)@ػ*f-}7/`iQrwlK!uISusK7!V#+ Mn*-!:[:sSd'V*ҁ~Qa1"DŽz!&*8a&ޜqGH (2HL_WO h莥柟.oV &BT7v)wa f|t\\{weoTwk5$X${/n/(׵`>ݳEc͠ŗ:E>6J-hl] =}q_6ȔU|UsWy `[ [BLeDZ'^D5n-ɔzG"a7渊ڐΥοjlSfXm2n߯/OvW~̬ӂ6n{H!Y OuOgJ}HQYI82ZH#xp /q ZnNv~f`C ,Z5DJ&nrM;kuw^xߪ$(ﻻv5֥"LGɬy<@)^{*)rKRD@J,eP剧O{f >im11_mmp9MH@CV^Eֱ60nJcR2 ΍sW.s&Lڳ"Nl@ґJf<>5)~-]h+HzYhCWIe&dilS{4a6m>.=lްv9&Ǹ<7@|HbP5X?,>zgr; B#zg: E-1WXIe7wV 0Xv\h1.FS%fx ^:3RUr%t(I'P8*kR49' /qDl {.:P6('~!N >1:o19kc#/:@M:j5F*OGdnMÔ.<7m"@Q 8Sqd{y>'Kcc:8$CCdXɥl09{ޏV@L_w<9-HMz{g2%zNOƺ;si44>l>1.zT?fe!y|-WK&#*ﴖ#Àb->V" Lj5VL-*׳NYiv9oJS~3F݌y ҵkal*,tB܎ج5{rtxUR; mbCWc^+Q9IM%' ^oM:@lscɠL5̊Au JN%3?lmdڴyz0 Wj\1b@Ky$XQz+վ@&@]KCkOX.k_Ň$0 ,J9)ɽӿfͬ˝YIez.xab] Cf_lTd:QK\V~r d8Gu{kO@O*_>fIvhգyxyNJXvui(/a,:QCa:\E+,whHo"<;;^@!ǪhuQ !1η_"F2 :*HŹq}qC|){.lj@t>@ Rt0y^EYLc@a8tӰZ 7cX{,W*t w0YEmE/pٖ`(H\"e(,N)Dwwu~NN}k)q/q18+%=$G>_ o">tb9>rCNazh_( ~-iWލ4(pt0i?Jrk6d )ۈ~^p*Yoterrn{8brrh@_b7t#-60}8FT-b9c5v~-7fT^23ϝLx>yxʶk̐7Rse2"-٪PՈ6C:j(Ș*gSL$S4^_T7xU@!*1v4p1o AKh^USÏ""WZk'ŋ([UX}ҟ|p;)e}_?0͞>2T<smuouORƇр+ s H*60RwW]Ղ0Qb/QY;{H\I2 ӊgAC0\d" ~ٲI*3jlZ{\)~ ŸO*}e:1 2p^A>VsMJtߊS{>5g+W|.(3oledNNA o755FiFsیN c)lY\sr6(o}lJ]^-rQce.~A† 8$j&>(@#c#/ĽSN0L}R(+]cbDXO1%EHBF,ke͑T1N i, %AFFEfFirfZKש/o8!)vqY=R41˟@£ ~'R}FIKF/v9ZZ-M6X 9mv8a=jf*Hj{}ΐU ~8I-5Q(&{l* on 1XL!0t-Jbb2_ 1poOWc'Mk=^AHjk©,!/r-nw{bSFֵ`z9+lL\Qh"Bw5U>BE&L< dSp=C.jCI}Hf~jo6H3>pl7khj}BXz>8wuߓf5/R<#JԄAZE)?sW&!]!NZ,9M,xqnj^$>: #֧Qm^B+@uQ:H'ps4Z.k(b}D{-΋Y};>ٙLﾝ}jHŊ%y0vp&Az7TTٔ&RI?4́ɝ3(C']J3lEn"x!0w*Rs<uΣy;ӣek7ù*c(^U/ݳOR/*RJmONrtVUD4]㢪`&U˘I ySˢ=twHK?2Ԭ{Ȇ}Aq6Buݵq"vqZ~Ne%~UY ;2tp%[U_w q&} ̮OEU*$ࠡw} ~iy< qZC?r+Q\gljNbdj_Slf9 cZAj@ٞSykAJJ үLK?rߘ\0q%bI 8,w&VbdcoaJr%܍j?b` 7K,h\&4d_)c?˝/f"ɏ nJY˦QL !XhU/6(LHf &CL ?UvR1|D2ȅ;Δ0˗b E_1YgEnz:iLaS| datfWk$}\z9~P?,<Ҿ'C2a,IZJMG,.ÍKm~~A qo͕ O]f[5s(ɃfYPTaBԒk̕Ѝd&i_u^K3踈S\䏾ӽBm̼'!?iK#N]񢯌>"q4۹g)Op~̐Y'˅痀\( = erO^P6iPeSx _X c$?'_h%9LV4ʈI>]Li#B{EިcW-鬋hQvwGOn˶ H,2q _Vz2VrYJ2`gMK|J`4>ْA*Wمf¿ۤs!jW&w)sF͇ڔ3+[#v:Bo=ڍ5T0 nW6C,k  QEY#VRzV1B:Ϸ{SqaRi漢|j~  t?XWbC촂߸VYF.TA$paTrTkt =ۭJli mocWA Cntr@UD".RQ/PF||KzHqԫuL_s։'FaC{ɻ#UJ5%9CmHvr39|Q,4#.s"c%oˢ:xsf{*k0hi=;t(dP06G]L8;%5s|$0Xzuc@ES=>לG񑠊nݧiIl?Zh$*D) ~H5IBR5yֹšNrf&J.F_L*^3V8; k 6g$p,s b{kZSC~)GTM"~F^G;3\E2îz<~*S&OMB}#JNUw :3]q!\ml?SuWAW5V0-N+tuF4-\xtn2H; {1ZxUHM8~0(Gjk# ߇Ŷc}![}`)qƪ\|`&3 VBȋubNt'4#S!R= b87\.qx5Rm(ѭ˲x5X+:OXϹSPrfY KH}0oubOv3/MP!^\c}nue -J_gf11 R hȓKT2)D8,^b!  l?<+ 5|F;KR? 59Y~_EKƂ+}Dӯ"Nw8pM0Gc|n"hE1W<חFPG ̃Njn9*LSEvq '5J'} GSdDNfv(JNLiJ -tmHىmTF9i'NiB+ܾl2bK\(o?'\DSpSwߎHC+wJ [7I DjXv(}mejh}IS8`،!Rf~qa/o 8/e/6~㐰'wH˰>zy*9JU:=[9ъA v[؜&yop D9 )Mgg d {t~Y@ޞ|)_qr4M'0ii;Q-gؖ@/ݛ$1)el@LG>Uc\êP1pq=:*R-&VnGK0_NA<*K9fl'gO1\HOe.1v4Gڴ\͐MIhj}!)*)J܆8<6]eGrXL CM!hYk12m3 ê%bNh(`B5I5aڂ+k(R}KU zSZoJR?T3.£ m 0jbɸd6.S;P1lVѠ\Q5LW鎇!nhh;6&2➈xj3~qskv s($V vkRWs׉bὑm˪!]ell\o;ؿ#q'\lEr=yu?Gj9e|m{dNQstN[m9?d>RKS{UL@G+Er杓:*Q٪Iù#KGFJ΂B6~L*8q`0\6)Nl!d+@/BE:S ^`h{ass2Ff%*R[]ؘ3X]s Um^~܂5D zǑ"GKbD0-#7~rJ?ͧ#pn}ˠsmYwouӈJ}sYcJ‹]F&@Ç`lnBMxL2@ }Ιod*vX[z);._M4zc7HэuH10^|^K-πw~1 Lq>w% ]a˿Qը{O=uzr)1*_F׌׈1~>,qJ!u^a!H;XS•qaXfBd/ 34+iqˀ|1O0 ap㶂 ™#esQ /wޫYm@''vb~:/-p'9?G,8εN=,q[MB@q?^ѱIM>{ˢ&KFpbKuU >ȩ1ۋ~Ҏiv ״A2*19I8_ZlH ޾@̇bdLm=*&t Q `RLkJbw)p2Prs78])%(m+!rnBysmF[fgHsŏ-g$K*AQ .ךZBo&_ENǿ P0Tj3YU^;1"_d?M;OCFSjNC}dH2ɳ p)+)ކkD|ak /|%6ߋ4̪?*AZ0N p@s*=]L:K159P$~?zoRҏ7IkxP7æ`*jA9+#9.6sQPE+27"r'GϿPTyR1\O+aZ`IL+$^"c9(LgU0WIaMQ7@㊆U&bnϽK]PRdI# |MaЍTgv[2+(F)7Q:+fœR+ 씕v]sGwꬱ4;ulB&K9dr' (m g rȠӈ={ڀ_驏OC%dv=Zd.'| 'UǕ@6雗F&5q ݀aHbM2#=&s/ fг Mb]jskTW Mp$CJPQkT)ڔxTۀn_:hp.)6wQ?2h\ۛ| BDr1\vl&ƶ8:^&ЊmV_t#2E1Nbck9&O"+9̶ZhZjELs!eRA-Q<8+s:)$c /6 , x)6iuNMBV_ 6'A:!2,Щ]Oj--āu9#8lSzlActtFH vC(4T2ӆA@/6E7-:\M(~[s%Ԏijrn,%%}7[ ~b|X'b>nB\%6q`_aˤy[O8 3 ʐP`sVKGa 9e*+D@.+Ys)ynw% 90e؇/`Hi()HQȨth 3: ! 2n:GXV=tF8%_yOg@ l|q.EW(^&S ȸhSse4?"~7o6*4G$,DhʓJNx,{ojv :.Ɏ',c],9Y\_9%o ݄M[IP?׿w֫ői0TĠSJcU Fm#5aPXgP ͮÙXw^SO{62JPV7OEϥZ^spN)ڥ=$1n&U/)Y"jg~״DS#v. 'S%g,ݑtZl+4]6Y+S]8+j$|՝A]:$A!ol |05YZ[1h4x>HMR;%n75|0z%CmEa"ăGѺ̦ZXmK}tci큃 ͡6qO1d 82 oŬvjiG,KZ,"\4PzwY)x1XubH7 ZqukCw*y{KkZ<ˏ B?1c=I6luDX䘗EFɶ~25ьvDSy&!5%y-3 W};oAR.n P̷f08\(mֈq>N3㢘X]@T@7T/[.JS<>[;NZsF-Evj%BOʽPSbȩ{kkdUn>ks% V ba @F D'&YTtb@s-aE팅N;\qiqغ]%H@%{wx:fDY3fYLр;A9NVmI~Vn-ǁ|'B'YҎ7ku-,ф)~vyFܼ,9( {07^:d3D8fN4̶339#[b!BG1iYο?S4kG7u-fiHvŦo 7PG4?Ʉ)ۅ)/֧kkrN /8ԸՄ^bI+3/x&$.q2h|J߆E4:bؾ 8",6_dgeI> @ᯑ( fQO)?+f{DӢLj_}qo¯5 q\jF$ß\=hl>PE%`d]/m?y}ͭCV2L;fM9>k*p?5gn##ZJ7wǕ1_5~lRUc a5`?|cAvmMn fmX1ɻ -bIȇɰ6R2V ]W*LHڣ j; 7jg\w;$$7b H|H~/zkKC.{@#2\u̼*k#@hWDDg,GnMIHo}@HMZE,c`嫴hC-̧`N$<'>Y0d?Qr(UG^iw#xy>N17.Vlf,muH$`aGSnGW"q^^f8:*iJu"۰+\hS[N.V#y }BN{r]b9Ht=VRPaA^= Sdkf/0Bxt0*>]$jɯc*Ƣr="^$]Iv[x{q8+SYvMzVwJƮ}Ƣ43(^:P :T9HgjW Z]( t:Laˤ`c/2ԋ {E?IA'7!WCdz\fFČT6P.I+1W-WgZͳ"!FH诎qH:H&Y ZkӡQ=8rYW2r`N,J 2%pA.2~K:=?vQŽ31>ѢC@. WH#!=OC Zk[_eJ+sK>gϓr WBK%jWU8dDARl8غMDIԩ/Xn`%OUԁ;@6d&fO"J'F?${ Bx ,}_|c*nqu:O|D(pHY%iq,yD\Kai;78Co "M2]}˹vP|`u>Lɉ 1Q6S}Ʈ Tpq N/^@w;0Ccn,+ GI2x[ݜƕJӓYȠ-) 4m !|BQڂec&XCm6߾! +{ۓ;{6ͤ䄹"`nҐ.OO 0-Wd-+."[ WS9ڟ֛mG'{x:+zmaM䊛6ֺZ-?6K<{JOgRXىdӓx4}QxYP_vF!&̒ iQ-Ǐ2=T=}[2Y!, FMTN]\]s"`mLߤ(`AlASuJr9mQ/$^JOYE.R"XSC O|n۟ru-;RFG)+Fjn,iiO{X0(8S]qK ,>s[TgRްS$-:zt^[Nb#MotٓtV LAC-<;[:2:+#NkD>RRUT;~hY'`&HF?_PPXŐ 3ΣÄqUjr aZC^v  7RXu~NR֠>{C>{ZPfL/K.ss; "f0H8?Ȱx1==PFR| E[iOh l}4CoSf$F*E=UxxJ%`l5O|9}N.D+%?>xx  ozXeYq@zKDCP~0sAzUR*ry[27tG+ no6OnC4r-G˕zrr]XFwjQ*qP\S) gfͭyEbQw]bd1|ZM4 t36_G!F#3pKv퍅n2E+thYxETPL_l^`Di*ڌloLۥENe #(e=?<ϙp.J%|୷(sHSI:[Nj怌i?\nsa3И,Г8`rNQP!2{,?'es!?MHy_U O?, an{|JC`n(tZ*tK:>Xq_i]^̒:%jUբ^bU{)nCc |K%Qv#EO]ff"0F[d[ YÏ<<'ߙ[oRh*xFp' X޹pK Ά sa&7*@C~< Y'}XXh*Z#I0`ώ*`A eG wb͇v6=_`n/)dà1.GI쯀4J9lՠjig WHm+:g{3>] P1En`$ZC"v2bZJ:tnZ |>хD8#m$xYKoNPǘnn \S"`NiY4rlwI-L'`%?&2_;{սWW BhN {f*.pIWRHgm̆($T2es̾B>ԃ%Pxogl?ۇK S`[9@@ߐ13 Rp Y(f&>[fШ6$q2)bʆ%cKQr3 -Sox"n[۸r Lfk BىXwY>+Vc)(;l"/s{XgLl+w ɕ(wDŽR y9%w(?DzghF- =wv\@ڈ=ET;9,@t5b$']EDG< (B}G& DgAT##%o" kph˸A|ETOͣG#6Nj}m27MF~>Zcʐ'rG.7su1'[R-(w7~PE YCs}m2JG~rzoAB_N酸' WY7- %052'x< W1XaӚ2HqIޔ땈zrgma]+*t%0;=>r)1"W_<:I,>=l+'x^t. CϜ:y9Gy A&#t`7GY)FSjF܎ȻthHՍAΰS: jq.{e%o JIU`I}{8]kb نRr38A`4.Ʃ>j! ˔ IѸoK*s Ѐ g}gTC pD׆CnsmY2%(}Ҳ#zylr[Ks0.$㾛lёA-ڍg,̋U]13v;#Z}8m K5q$s')JH*1mz < Yƥ8(g.aFf8|Qb | 8ɗr yِl Y(G8Wǵ(XL1F:fgFq"-{ zDXY uT5O/@<(y33'aywt~M,jRꋭΚF`0nkCapD6Oߩܮ25>x#2A`QGs"8m7%nXZCl.?[i;+O3Ǩ|3PD+ގCYY|`0?18%Eսt4PmIU z4#dMdCkx4"3r|]CfT mq6qsF `ÎCB])ƍR癥giʋY|ft&ה%#ysG-*aa"GY_@ˇpBx:ozײgaJ69q!)jD+0MRx,aqȉtr+)d9TuH&@2 unlK"|a^9Ċa5C4{zk#CN.ڰ F;0oH{-}X, 7_AՉvZ q 4"䩖,R5nu[B>:? jWME9q4`x8&1lD(1YUD́ \?d|v;T]5ΙYKb=EQA(nX#J 9«Uz 䟺ttDX#6^5⏂2Y~C-0cWq8&FəqA28[/G<RCtI|2MyCɬiS뜆NLZ1 ylW4(WDBF.`eWUl._0'ބ]w7sTKQ:k݅9d~?{ ۨD[EJ.Iefn=@Ab˶tu8s)-]%Se4aW>H/ڼώ BAkdgT66 ·C~2<{IJt,9##q=>*7iz7FxWE/ u^x8`}swqjZO2rG,o0j~1c9^'E=4XjS{ 4|򳢥=Z1!ܷ=կhE]K$^Lg-Z֋\ҝ{`\_z⃽~2+w.nKhsXZ?-9M$ [{D.xӛbAlL~ ZU~XK3ߴ $tãr] Q[u-7 @F/oc`eh^WAp?}cOpܜ{>hhQݞxJCӢ;}ѫ̒&I|=0 *U ygB۲3Ǻ8[сP 8{>*iU3-0iʕ0tO_{:%|s0k&q$7ĪU-5W} Yז&*g9/&` FeIJp씇w (9;i T*jGF2&24kdӀ1GVI{;/6j'|!AמCe/T!4mc%vr3`U%0@>e뇏%-0&B}_lqa҂cl0\-iH\R|ttnMf2sD=h 0 D=D/ç+r$M4&Q):̙r$ސn`_\i63k6z/N>2LE|`'+TQX7dHޝ NV$(ZzZEJ m֔x;O8SK]Soh( #B{u-C⩓^Gw e(]]kc'?_ h2f=縎9.yš~>䷱` ^PzB ykHz3x6_fq-qiP,.;Mck8: P H>!*r`KMzcҌS`:{+.wwE~`}Myu"dK=܍$`L"B[(aY`UXWfy c\&~;y06pkמaY v>%}`i``b6 13*WZf ˛!%!%_7O&-Ed :hAY, qe A+oX'n&Lߕ/-LC_Sky3Q (-7^ Vi(So I\0K,|`N,/ESĞY0#6߾ߦ$Lכ&&@W]fKiM):J0#Tَ6 ; Q 2Nj®3x-^ɇr I@{6AIڱۺ+MʉƪI)y"`ðNڡgWX^Xy)WC8ofLԗ ǘUJ=R7dZupUi'UṮIFP Ÿh"s}$Z-vCt7c0s^ɗV`G|&x ;a= ʟȐ;Y*Ŝ]^Wx ?K[Ԣ\D `sHh;3b׷*Tȗ`s.wO 6ŁTcJbۡbV _y\k_k/X ~>{OJgewwRm;\+*_{ ǥh$͵_*2b'=YX>Y;MfIfx%}N_4Á`2L&"N7xFiO/w%:ѺbS#m0M #kE2'(SNx'6X!DFr!a?kOP눼DŽMgo?G9.Г$K" 8?:XvJcy.~EݎE1]v-$תu6Œ5?U佥L1q3mԐSUW@Wx B%/Q{ߋk gyb2X$-E1wLd2l(c -oWHio ׁ3߄!=F0ADP:5MÏ keP]F. { IX}Rn?v1D4Y5 YWљz1O@i6XAI>ּ/>zl&i+(BN+Z=+β~kŠ3̜!yB)# Q'0]*}RnfɏDE~qcnޔn{{2O"tCA.xztE͛}.y*;<Yh39;VuFsa)cNM)!Vwg)Ǒ=TYB]g>mI#mʖ.xn_[~8o'Ġ y_.-Ԋ#)\vH61Qc]VL=ڈ!zm@kgXVrix+|:Bi5SLBe N>RZ.6&=/t5pѥ^ޑ0Ո~QDZ]}yT8$"e"sv5L)TF{(O-5 BMxZt9{a@'c%y;> Ы GK #?zc<5Q^,C9ٽ#+BΎȁ_8uźSY5 z_)VP(Ov%(nR jX*ިmDH5@R qtUR~Dw J|:ZNsVJS g8I.߄:UrHw!ktD?jתwwUCܯ].:6,E)]yuo{c=yH`3MtIR^ =Y, hXSѹh 笈o)]t0}9:EV @M/;We;:O|#@f`[A?ܔz\\~a8]=lvÏpc.D*!E&=9jb,]nBXS6%[dr-G?F5MyM\ gD5`c*pvҌZ9cgYVi*Ƥe Bj2)طaiQ>b]*Nn5}܅1#@@DVׅ{v"ɥd74=fDxV7:k7nk68"nl iؒg* j^_zr}a^;|:rvr;fsv0[q*K >:mnyyPsN`Չ[lp8ߓmP%>x='n4DuIrE+w l,=u|%rl ʀ5(Z1?? KUۍs'6:7?Xtjb }|7E> Q Vlߩ,HjyG+$m]LMG,@i|g6D]u)+^& \u8i+1p9s0Cg+ћˬ" l|հq{./򴪐& ؇/?tpp5OzEs]|}iUGD1=֌%AePr_OS#T d~ 2XP!f#k_\Q[I4E2:v,OXwOWٕ4Cl[h0h#:?RTi5S ⒤&uy%8WA^Go>v1=X V]-h&IeLɥʦlvhֵvqJcӳMȹ =.q:[ :"ץ"ڭu0 ɓ|cMKw})L'&dS䴶H4rߒjqS "U׹^taˠpҜpHj,#2T3'wh2h-R{/HgR⪏7{B!:?{c>CN\=@Ʌ񹭒XA޻pp.tWbyrm+CKvp/=cn[ez*QQ݋¾V~}}AϠÁCk~a;!ҵT~$fP jZ cJكȡiʚ6춷\CUy'L?ͽb'@1|gö#mAh[#̑"$ڱ{O1r(,"vJ֊0: ͎FK yo9GNO֘!ͮ@`P,arfkyC~ BC}:PL` 3#9V6?@ 5!:c- 0zzKG^j FGt䠐՝&$jW`}o=gOտUk]tlLTϠ­w7aR 9 24ɀ~%>Z{n Va_ w#~/fe#D~ADviyAfED7 P6E#14Uh2s2*tյaOrmQ1kJnPgkGcһ_X5N:M:? JLo{4,?YMI7?wJ)iV$3zX r?|z-rDCAM=0lsѤVxÍqJ@sO67 h j -!I 3.zip-G=~o}=^*)~fޫÄ+JtҬ[9j%N2- Jќd E{Gkҷi'jw tL4 k"qSWÌZZ-JA1i>}s RLЬݗ=m Նl-NEY@% am=-2LgL9$%p0VHiAiV tMj\"{9rq$`xpF״%ynw~XGBΪtz4wZ!w=&M'dk@ڕ# K9!@w]*4Ʋ<¿e"X /v2+g@iO/~ɣ}Qkqjr iO}R3>N:5_4] )V8^m:\D_έ wbze{0s]G SkPmFݓN .c<!wOW3\`R"A"5G:V-G{Q"p 2l +"3R{zSp-Op{#\N۲Q$ .㜧ɻwΈ_چ빋mȴF뮷e-Sv!eв22zfBmOfm?7wso)ABӻ˲]=Mjo}p},4YF&x=cO YtD 06ubpJjSd&0ן|'7H!;A{No'wH$+xu}NۈN?s2y%7i\YOxg>U9ɟݛBdm?@ d c"ZDEL|L+7;{OTA} _vr&*z%W2&Pxƶҹuw>,?~U~ZNrXXהԡbE*ޤY<RviIbTVװh8Iל}4"W%+բ:z%< 'tuREK0rT aXou:&&ej™ /]¾5 Nl8ኝ$!==B h }`d, ('YZ!4a=eܻ(bG&]VzϷRcrb{NXHbFpF9B5/y}gX6'pQ=WY4pdkpQ情T'+OHJ\$Qy:HnړX"r wM@+:w oDž$U Nk^]%C2؉LP&n1@<%ƭܢI^qBS|$mU mgh+7k% h +ʼT@92)b>wՄD}@m Ejw[ k y<}R j 0.Ic66]\r۷Qi\ @xb- !tpRA2wbtlQ9]GZX .L(G(f ].pV+Pf&AxX"eag۩r, 2cR6h XgkeQ,Qפ#.5Rxѧpw5p;En7"ִV9'}Zzf$ }5 MHq$Zg5Zw z8~+bfNr,,9\';!Kys$?QfXMD-[۔tʚPޭAs18(9P|n~W9_pt7hhNY/0Z7zIjv,eij@n ?$ڞ9X ß~! 뮨EKvYjB#)1u=B]`SsV{켎e\zɟ0w@%"Yxesʹ"}_=! v ;vykbv>ɷe-,FÙj7a] Eh PU,ex/?qzf7:"He æPm,n}J] {@8}Ga, Rfc0hnW/U,{Z 3ե%4vn %\ńȨ/b=֏ãj8ŭyVC(yr5;Ӯ{pJ/<w*7-1/GZ:Wbű92焜^[휫?FOGR92ɰ+#a3vT!m bsJqfFה}-djpsɸqu/m-ҿIė?AV]vBJQy1,HyUyjm)ڪ`f<;pE*;Pͧ,c{&EN)]Ri[nMQ> z(Ωes )d- Xi)@f,,iI PCiʫ|^]<*؉m?y`'gFOqmӵ9X$nK.i`KM+ŗQ{JIoQt >*ѿXˉyky7ݹDv'`::GΤB=sfґIU6 fǪV%H$(EhuSM+|]WMAXsSXjߗ]L -XDT [egUxX!~jq):*QQ; k:߳?db*K'4m{X:7uUl3#iSRmm9(m|C*H&w/ǵ=\|Qow=J`|Cib\A d+p4DaxL5 n>nnU4)H(9 .rH݊nʢ@KCʘhK; xte!F%8b&%x&x~#"\6]or5G2|re4- ;ς;Pg6KG8r&m?O ڎT :nmGu>5R07MMnj@ Ŵ|37oנY9?BCc0"kA:Ȧn>CLggXY{Soܻ> 4PAV;ʯԇ2vo[,b.{HK=zvME3Re c&CC/ˁ@.mG,Uݔ=?@Whe6>pkdQܯJof2Eg!d$'~[@AY2*fmȄ= Y_-FB湱eeɾ0g_\Us箛4BߒzR)£eF;-Z])ٮeb݌`Y|)#A#gioGߡOwt\xǚgvFԢ~ Y8?#zS_# ܼ l.{*KV.Wȑ&!~M?h l|qnx8{Hsȵoyd2uzcy  iYμy|c (Do'2)!\) .D_#A]@f$-H6[DV)C(pN|hnjGףJ'EuôL (?x*k^I<8'7VK G]q}@CY(T?=?`eC4ѳJF%::P/meyV:j&HVoؙ:+tÉ,v6Tfxs 3Ԍ}.,{cɚ d1 շSť᪗4ZEM>L^2Ezzw`>INN5U8jpR޴bvYLEmn~*yGґ u$h@{-I̋!TLdLjy& o7(ĉ$({]hS KcoLkxJz|e!ms'jdv}- =hތpl7VW"/߿ rٴr),<, A&v(nĔ3]TR8)!/.?YZkGSHJKq&Kԗ>mDG &Dzʱ(IF4"5NTxJД0"ՍbQ۹P㉮G;x4hz -R? Ѕ]BρT>p^?6XM%HIX$tAMD$ajkUUWԿpjL@CJvrւ6b.~5AFGRyS<9h2]h dF|j{C?g 1&8K:W_#@EJMg_פ qIƓTx1Y Lvzc;)dXE>7B )II( ylp"g[Z?i?""]: %Ys|d*P6~͐-TO9QA;+9L^YYh%qGIUϺʞM浝I̜o[%"ޏJ*5D*<`lRFU"|aw9U$HHv7Og2Ғx oy ,BeBb7\*+u,ɮs0y\`~KFW*J_L.mHqD8 <l"JKìehoG>A.67<Uat{4@R,?L5*Ap1öKmiog^&NPY:$m.1VNK6]l [ˮ_K#|2i7d4*TZl9ӓ'u*fztLH/!gRF'Xc. (#KncDiO4pP]X+`C'' 55q*x E!" Ez#E袣3*ǥdiV4[#Q+-߃sִwO#= *\ZA uZAT({x^5ִ*$$d״ۄ9{O[TFx1OLv܃ >l] z4#$OZg+dyN]3[^y*IHEҐνV4TI2 9p tD!Yrؚ[S S#[c _=xV4W婔~O=@#WMz-p'9')mo{aVZH)Hțeㄼk %DerTu`5`]Au+Y1F?[d.bCw.:z=[03+GR66Ho͈p hRKh%:?PmwmzTȪ\yioNQϘPOQkIZVpP@"66Ӻ]!Q05sgv{oVI[Uo~؅.L(7ok'\WoZ]X>ZfOq,3dOX߁O-R lV0wQ? =>-'3ٵv,ka Mz@ǧ{GdS~{IQˍ"m',KrLތkK&գ,QIm("#^3 YƻLBߡlf/[GJCͫcA}![OLJG;||tCHlKVp%dŗa@H\}`WO~G9N&NqC|tVܤG^Ojk-N1Xo0y'; mcwƺd~I1L19@\G.U^h/%1<4{R:9پG մ( /zPb,cYOLTZb-ka ֒ȻtbF2kUFh:!H%MKQ݌ܝ-z<1&[HTIhda>n-I)H?eDD#bOJeZ~Q7Q'yXzƝOAzűŞWm!^,/ }*?r$eWܠ?ߖn,5W&h• \ =ÖHYO.ʊL`>m&jDa.YtfF$8P4 8DTm0Ll_7iݜcOFbPD&^q'T,͎ƃ= i.o%.v i17Z4t-?VQDwJV'E$3H~ a-sfɣH?HV%_uDbZ%kӥJBAmL1w"؊tFr1rFr-bS)m1r`3 ׋x4ڀ MmCZoKȘA="(e0U8d֡7o &? qE"ˍ~> iUu9x_[!>EU=[cBWg=: ܑ s"7,I 1nswұ xfZ{O젪P !6sW]<ψ'ʓ[8W*Rgm_kŊykNmp kWGEaUKt┒#dx]q١ q9Z]UO.) EoYLw@n7O/o󉑜GD7SgDQKaSl6ΘχfM0aŃl;v. ĭ%," fFm=gw>Ey<񟁱%Wk*4@fD#02!gAH)Ց'nƭzf_rda,@'>%T0eiқAۆA i4qQuJ!XwB Uk.[yׅsD\WǤ A1oPhXP|Ykxg,愋0֔ࣁ0w"ӱRb{A9kՔr;9U87C9!1B>{-\017oZpf=B:k9S01g=LƐK_] QZ4x㡍/u'-n-[7"ѱbIG m(4Ѕ:BXuBFC1cI7Qb`IN;}0]~*"4#e Br!,C۔ u<'1ӊGl"^״v_6 9+A;IWCwU~GHu;6,.!B8qgld`mAr_ĦɒZxkANIq1)0* | ^]V"O@4&6P-~gcKA )œxD4"rY;S\c z ^ ptz3NuNˆh穀/?>JqVM"z{(2-U<㧾E?>9.%XuS9sGUR!@? ȇFWL V!ƭ~f^d}eDoA\aԿG) 58K`kgebif Vـi$YY+ e)r'.I|3vBHZmnGkt͑!?w <#̕[r rtyy(nmq|hdXe@KkԲ0M+ш-z?~ 3f>)B0Ajfm;2.enͮdX%9vcIqIӍmn([m˽aEʧ>6Au|ڼ`+t ORQS휊U_35jc[s HVk赀-܎^Ƶl3L[s塣N3X@4R >o'xš0" XKC%?lp`?|Ӭ!*xפv=hء2/$X[hP~aʴͼ\ @ykԑߺ08^% J{-&÷fsچ6\ B;MXX-T9o{\n/!t3Q+շw+7"Wgwė#.0k*IQ>Χl\2yH [ΔQ@xkdȲMYWj޿ec+Lc&ˬk5[V WA J o^lN2?|r]5S@3rsU%sQPUt+9ؽJ~fl퓓21r*&_Twt㢙L 3 Sh<(^ AQeT) 붽BY%0_vՏ)"!<@hΧQǤzH+ʎa`oɋsZ$Kx5+5gW]uLq][pv3(ٲ>-BG9]|fm}1҈3p)pPb~MA!,zπp{MWU5a;`̀` oy*?mY9oytb=Y }`& aUiG(h}31? !< ;qpwQVOmH94(~{1 [:gK8|/a} mԳG|8̾m,~'߯N}L>EJkHz>;(rbwfY/U[ @پSx3zegFRJ:pZkP"4 <8Y[7SJ_𭰰 s"rt)r0G WۦQQ.8?rNOYC\l<@v|臄9ͮ@/5Mؼ tZ ~M㋂CvŠH~{c*֟qv",~d¡3j)н]5JBoȼ"pl w\?PgG۵^PM1ZQPܩudNIB'$9 /RÍТJdyTG#Y?8 [ploP 3 utŊ ?"i JYϸ5.'9o2 Q"Yn3͉#~ 3t| "^K#sU}.HaqƒHBO]1"lȴ>l1xwf?X*_Kr_=B&1!΢X?h[sp1XFsz}v"~[f>wCJϛb$0#L4yO,sEk@$&.ı#lOhHK% Tؾ6\:sad7 J(DuK1F4Ê-F3G?J2SXړ}xzW s.`z+B(m)2OD[jVqϏ{^ښ,跷FQ h %7{&Ft2wM GkiD;LR dg ?Ղjݩk$襃rLFD~#I` 0< b8~k)Z„`mKI:Fkcr+8^a`ԍCƢ+fp[K-3r*ƀNʁGFxnъ49rj ƤVJ7񥢣\K!vdE>`WP."r_?썽ǍdݽDM j?&: F|ڃfz~Ճ_z]>,"wo^.L;<hz zhVHq1~`y!eF3!%eWq>`'`̥epfqӣ1$S¸Hmw.cP06  n2ysYK6‘9IV3HcG; _g1Xhwk-8&Bj9YYM!"eZIy D#lIؚ+?qhh!Tk7fߕ<X5_[o&m"v'[>HBMV1IA5tlRs|P|aŴ5i<chkY6hi'Pcx ic^?o&=!BED\~vD!n֮]` B"Tc!'$ YWm:EP7!e,֘ 0%ؽdg;7[Zw96k԰hb תވa;^wRɌޖ;0ć{ |C@Lb0iOB^+1 ]#$۪!QT8 -'J\~5U8F3g ?cJE{\k(m rI (C)zJ1}IvUA @۳*裭{&^ɘG gP̉dpnLpqyA>+c|s&Pr:$NťH\g7C#[QhP1i)QUu7T'~3Ȓ3xwQ)ˁ WbȨe%!7悹fi@7$}"$D(c\5og3Τl6^JtsHwW >Ƅ+,j?tѱ_3(RpIonN[2Q߸4wDi;^gV~A)EE<^|&.l.1}_;X4KpNu=O>(>¾1~ lb ]%nYhM(qۻH^zQ Vq?|v-Ջ1&PNS)V_\@:-g''R^[ɋthƽ˴Vcpgd]6*:̤}g̟ QM5jut :.&A_lz {\glP;آӄQyυ*\RoAQRB)qBg'[ϰ_|i"+ OnXm>1L oaX="VN5]"$9bͺҬJhp3,O5KӢqpⰨCs +'>q;wB`ނA*3A3:N$LM[Z>ћ5/B˵#s|I74ܸ': lͥ['5a~&yW.O{~U{qi' te>xjdE^R27ˇrݹ;) G/|n5$Wĺ]pֈhR(! CդV7$U./$ NGYÿˍ|yѲ]VqHѻkGp8v8 v5pgV 0&ܴ3[X֬&KsTHW…~59p蛘?$w$M~y#,zdf-:h:r ӊׇljU0%V*U:i(J_*#K_F4?,_S<csٜn&)Z1Cf' @Q/r = 283SUdЇ$ ~<u|Ą/?y3J:#{+%J6e]DЁ+ jd*(e) mrCѰTP+і~yU` 87&A5.q~?=hrs |c$2dsu\xNLu0 MPn Vhj~VhMdVq&|@r u{뀤DN0wIJ}꣕[ "MGIjMhX+IW߻ԈeAx̸rLI[$PE=RM9A5_cVD5o64 k*!Lʀxm௲Sɑj]Gh~Cy1U_ȥU8/h~cinWˈ\|m cY<0Zƃe X.QԮtyD!Yf(!{kb",;uQuyDXlT}qnx"]r'Tk><vE~) ̰gncde2:wT2Φ*pąN] Qˠ;X`4F߽1B_ߜ8S7r8AW7s {-8AU2rRm҂"Np"NLKTV_4\KL3;FR*cÏ7>ZM.k[D~4޷JG;z02Gc/LFQr_q|_)rg۹ΝAsK2tKўvp%65űǝ9"$a`MdD\~%053)K)m}>cv-A69/P)l֭Gʑcߐ|vdHIsբ/cm8}.du44܍ғ&ۍd>4Rm4їd_w.s6T턜?:#8,@dM JԪR!@o* I*l|_G{3R冥6_ i y_d0Z^}NopaJH!"CH|9YFNxr|L¦[F@V 6vU{ $a8%cOގBxj&L?~fC 3qug AfJ-fmo2.澦ȓHrxR,C_]X? d {Cfmp "2S|3&nIp]0me54{}w< mm0So'QQ.Ɋ鯒,Dxd&hq.IZ[iYt#9!^(qg>ftHt1qM$Y.6ITn7Z) V_nyY힑=OwO<𗍰V@Z9 W7 Q"^\FifXk@G<\݀/92c"PT{ A1V 4,sjnI{%Z|O9gǢ׾ i齑H"cWniK^Q($t}uvW_d68Iыk{!n )өk}4F;6fSE+ ?K(9I7&܀6-ywXA oPib0 1%Ow'J{*ɩe=ewȃ$.w}a foXN,!>R6*5:NwA:$Rlwܺ-*'Lsg\"JCM9?ȡ' ϸ_覕ʗq-O Zcy!Z;%@ S܁4Ze@s<*Ld> wðMЯ^dX]Zrb5vC/; \K2=0}LEl͍ÂJ$؎xb\ :Q״jk2&?\hB iHіamxd˰/ob55w䣪RSՁY6gEFb#e`*y}zx{~#uoe Dxo S$ ֡8e 4fh.^lV ]pRWC]?ʞ&. E%z-ZP \[W ɮgsUc{͹\5?Wj'LJdm|cdBK߶C6l=! 3-!ՆgVA֝]>QhB`ݲy~i%s߽ 7Tϭf'h \oxV5 |iE?yf;Vp-;>h-GpE@Wa-V$\0y޺o(o];Ҭ_ʩ?j˜s~]-Ư3&Ӄ2}5G6 }`s/E8ւA%2ŌtPtXl眺 Z d:؈'X RFب(Ԋ ~BX#ȡXbm1R˪XQӾ3aWݯnvJ^Bx}FՓ.WO~kF.;sFwX!W9ï׹&J| )i65؈B4PP dy~v^_=dAƸU@9<}s:H ? 9"RJ Apb(Kל ,0$!yRló+ү \ےOtn-Ƅt)RuH}(#2+1ꃦ"jXة ^G] a,?cikd|v? ?ݓ hɤQ$F{t!*~xՄHUЙ'MB枆7.dn;4 uƟ^@@9]}3 ?9OM'ȴk5iz~ V5uXyZi00^y+<8]Se|{LEjWJJݴgϺ!4^BeFGBw g\8i4={V s5tc/o6ǯQIdE#8XRĚD/P/f}{_y65I3*KBy 7$;WuŒjQ`8rV~QtI-xS&4!JYJסW"@{TDZ̪Fxjd "JS$2M<di{UߑZzIC d3fi Ӻfԓa?a :])Qdʹ`sITHL#D67BdP+U jr'd _\bHOE,o8Jp0Οl#FF 703᥇ phCu5OI6GawuLlN_ǧv7zEsܢGbj3%+ :"] Ľxhj܀X xUAR,>vu[3萉Y`[Sg%9vΞC'4S:빇o֠@KtF5Z&ƃZ2S":`㘺q%ȣ]x C`L*QƊ3"K&kVc˸p}.9KSN=+ulv8jcIяƬ/u1nq$ȵ/AkVd(iP`H}; c 9ׄ?8 mL'v4؊,A:#om=TCMSe¸:ѫ|5jfn;٩ @uoJt,A\]&չRdc.&)ʯN9dNR'͛p\=mA?d&/ɔҖ"x,p˻=*[ %=@ՆG2F &Ѷt0go} =YYvj؃3 ' ]Nπ>LR*oA7Q}+JrvҡTb"DI~DߧOlXג寂(TXRX{~eO^e^ʙ&y3;̭y*?@o钜$!pp(7Dw7$Y ?,$ ,Q|YZzS<j[฾7gt53b3ÒWΓ@h%렧ogםsn92)jBMDB^~|#+8gLUQE;k.ͧ,5~ڜ \aXKVF%Y9)E}QRNm:8Unw4z87,^XK4f>%&]3Yq۩i0GOT%uH13}'.E‰R˒x35T}BBŒ۾>5H~Q(}02(|W'6/sKP!6rc5qM<:J}\ /=|k|%l3 }ooK ĝN!Gk+~yU. 8\lyO{{mISDIT<dub.La쨸 ߕV6깬.ʞ{cUؒw ).m[8kP;]{M{qH?F0?05~N{MJ[ʄZkXn5a[r).U.A*0}K\띐1Ңn~:͞ Fu/u"DLe {$&Ai-^f+#WC/99Wxo솫/H}iC^~X*bXNU5NDY٦"T@;f:˘?wgm>6wWyֵK>댈wA SrֆHĄ83=93ouVjܙqj`otJ!U$U%uroS>c ~OZ2H#Ұ:QZh}qG|?XnЍ!2$mT!!]Z ϏP*$8fT.4t=hTYNm2$#?MkY^PbYꂭ;>@~x 0Dhm`J;Su+6cdY4f7[sᕃ4Yf?0fsLt Hwt8aĆA- F[p|t^VSɼWقsQZ)Adv6U+N Bu7q&7F\!Ce7ee:5kF@K\~Akˬ0P`"_ؕ<ӝ8/:쟨}`%[0gj5%Fr#pON\\;kX24iйS-}>}kfCʷ?X2gCMH>$@ iFB?fot@RDɛǻĽ7V~,pŒYoSe: oݵi\6Cba}'p_ L̽Zҫn<ˆUPVU]ÃN<7cB-o2֗BRK}x'O ~gvDG_<TƐ<3dĭtֈE%=[2**VpV7O}<ĎڳC mDP|K;ǀ$ڍG5~~lsiYbcuKEȭ4}o4ː5ZeWfLQDeϬ tw$AR0c.qSM^5sE2قٳ˘3 6 ڝ (@}{g̡ PFGϽ8_[Wo婱Hw36bƪs&}g֡Ń8yR7֟T@:DCf_ǼV,1e_vY tYv|9"n$Mz&;Qpy|a%]RzXl,~HB+Yx|eմs`>Ní|Ao*!:}GREٗ1 (uI@Q'Prz//2ߴ?!M@,҉~aq"=C$A;8!kGQǑtRQס*/*Yx'm$ή;&:d<*vgR?۫"Z/^X/ 1!C~g-+8*V(/ !6ː 'xLrx 9j }p#*P͡hf4-ɳBWsI/]U\@$O"r[ZD#XERp,M`9 U H |Z.`A06yfF,s=ј3N0k>fWu/_(z@v<ֵ9ƶ[v p:Tn&Bж0IynW|~R8DD 3=~u+n5cS$v^e`RĸvcyZ}멕uR$ /C rrI&.f<;[<)[&;8u⃅R$M]Z XlmXp"-wS4CWޯC ,17y5J%[A1 1*gi&ƀ8#̑Il _2"V-CӛC<?~W_eոsRZ4䊋A}i+s?|fL)Jbi 93?4d ?N)9`w?CfK]L6 N2$zlZ 3; "`{S75*m4d`KI;$Юn7le,nvҝ;[`w&΢ #Q@5AߘP"\v #[uV"n9l.ܬ^^ߺYeh%{TOZ焸_#|@!&Gg Rk}n&2Qk] QVC63FB4W4Wiڏx:$Vr T|SHi@܎ir=qv<I@g!vڞ:]]i,iԱÇ/"'$hJٝK%wVv:g:yxnFFρ_哲C`Pjlc]Y@##CoF?ĵ{!rڐ٢p!*MK&.[(ǍVVNl^aot{m}*Ryyd@܌V\h8Otq'&s~6eߢe₞B?cs*!Iܣ Aʼn/=;  ?&w#U])ozיF68 U-.}0MDxxOIt׸PzFcecA%+Ocs!ADaD_]_e0ėQAMj+619g#=wC$51dkDƁmkL_5Hzr_Z` ,S4XbnME>9e~'(PWX pkP; kP)I}eS|>mg/o #UU#CxJB%Ԏ)ˍ@yE..hOHe"V/q"SwhjC\V D?lvXq}r~O3|YFV݄jGg^ p`{ruK_5:]{35ZrD] (m>P`03KW{gY` T*Kd>@e3R: E9 <9BR䨇515!3.1ONz"d1̦I#t7gӥ%c`Q}qp2wk' 7>r $\t|P49+W<ӏAXAК9ٚ%-]Ty(F;Er"fhxB#?>`b/Ԅ`߷%<(eSF+QbJq9\V6JiVV :zNXQMi#ⷐ͏$Bhnp/3?aN#W2c炈.H: k݀6W_%Z B&D6}YC\sxN$k&@p *Y F^]YS] 55GqUpǵNzW蟳eH%sœ-QX<#@=)ҭ}M HʠG!ʪo  7͋G~Ɲ"*2UAz ˪dAg537cz.:nCܼPٌyŠT .R$1Ḳ{H]wK)-Ω> {̷\sSK6ݣZP#)!-V "kWC|;+jo㨲'ƋX쮔"9$JQ;➄a".eAaQ&v' { = ;S֟WU ?ݿ)QO%rhT\}?oL}c|VpueR?[zjoR..] iu1|,ӄo~C0s5_&ȭ#TK; Ii85'OZ2HĒ4Ϻ" &dR1o7&Χ Yª_N0 wz\HTr C(q`=+"YJ#.-4>tXx4a(WHF-Ո|>/kF\7b};t?s3ء|sqLkА7 q(^] o'F3z6Z*R*ڎ!yiR;)n1،*-"6>X2xiī"#nQ\xmGoҸܛR}Y]TO|1Es;fkME!a] I:,@?Zydj:_f&b1; L#`DZ}+όDw޴Q,mP/Aރ޺0鯽`f]WK^3"\E 􋲁^0BAhM`ٕLw0W> )k4HEpȓ>47,lH$8:)1ںi>:T, KѶaR9!1E:4,7]2Դ`x"$c֔; ?⛯m+pA| s6$oF qңu}=wqVـ2RG )fEK, D4Ě^;ffLΈXJKݭUgudxkwv?6@cs:80^׫ _΄UpdWK7pm kӥmJnxP4n~77Y;?5-x-?d2E CILRڳҦ09]G8i;jص֠(g,{ "}Ի "# {iH5QKzuZx(&3~=YY %4Y;WAL6؅#TSBS C4Q <{Ks0|4duo8ޣ_&ǔz؇$j^zUI? h-՟Ǚ]o0ҳ6t4u3zikD Tk N{v L̽E}slPpGt|nhs~\d9IУDsdTZw&Ʋ?=L}x(M-̘hcߓV*#q!5|_( y:1t!_K5𒯰4l|A mά=KLKmDKřY;񠃄JқJ>4M9^IInU\eAR_A! 2 B׉ղ+aHn<O4[ȄtB8GR4$Rj {a,<:hYL󐍣c([o-,MHņsu 6˭%67[x]hNa[ h @i-:o*|\)`Qw6bT=r&Qo%- miңvECtyPޥ$߄:oBC<+֟[l3sʾ(dbK"bt~ZƋyzw$A*RzSgOv#tƓO`X! 8a]{꽌 (tT;Bdu!n6uRKN\KV{n)i2t]2N d>9qUdZy:f{O)ڏ 5>9c*}!} 9Uu 3_7{v<|U_b{NPRЉ]z)9]ü>ϣ ׿?=P#TBUh,+yݩJ.B)ͅs@Ju֚5q+ ш2-p*MWڦl$B" >}ab,'NcMî-&*Q2Kt{i(DXga7GHL;*i b5 Har@+riEyp[#]O;w[̎`zx;zn=C]Ȟi3%{:Є>:$y hcajm=ȳfjbk3 y̌Uǂe&1pBcCؚkkJy<9ʐS]i>內cNQ\hIR :XU{0^zp?|EK2# ,:ƥKvqoV]5>A5fzLq(4\bi@ef,M_w=Iˇ >`8'Jf0Cu7R&2Gj55nj"s%S29ʉ5g;p9Uj=}:V?q3zb'Nާ$k&kcˊᢁ"-H愛BLDƺ:x^ϯYJFc@Qax% uU}w:.'GVI L0>e ֻv\2k-0!n@'T0N=/j1s]k,}NCY]蜣Te:{=@"'.2ޣ{LI{?:ϐ >lyDqV3k㼜 簱]AI(xn_ W_waQ=C'd\ _j뒅FoE }q)ϩ Цm;k 4OB6$ 1&-aW=ݛ)HS#Cʊ&{]Lks uzEcfgRff! HT@1\42⋙e?NLzv1&dM=%6:+]7JC-&Xyw;aUa4 ﬊ 1 WF,y%I$$;?ߜw,5Et.JˑvTa=*1wib"&3MXqu֢ܿp _Q~M "L-}}7|+C)fcLc_2 pF7m;gq͓ I;u6G`+^כ]k`˼L=hTb|Yh\~`".zo+NҘ!@yk%MjERx:Inn3\`.S>V2߷{=rCdA@Bx2oډg(A}#6J W6R4Eii5(^X M /g5tnz:fWvzoyW2Fkݔ16f럨VK'dcm-/؛wWKBqYaXU:^"ϲTvn%gCL&^)IeoG*祁vJ<`SFfl_UJ)?1+4YXup(FS}` aRH")RDMdNv|z:)l$횵fO{T;dg} [uG`4]*&VVV0=|b٘cqJ"@Im$S甖c݈}L=:LjEGQ_A0fնOtSmNW ޺=p)bv6iA4D5A^hsW#@HzSb04):OT.H?8RΟG(ƴi;XvۥDI%D*AymڹUsMRoܓMpϛR#㼹9T?Qzj"&1ڗgddո]a.~8q$rЯa e 1R0f*Y rez]~tH ?^=VZ`RVF =XEwǰNv! y[fy7ibXX Hl8`,T6awg0ڥ}kKM-ʼnT~`*ֳi„rŃP㹴ySP^TG^Ն"OXe-'䎂t|6sCpDޙo25_j1ޅEWo"]IV7x 56SNAWa}{ xg/݆`#TOp9hr OTҘ]S(a%,2=R%HEFπbA 輓#y1>XTOO Vĩ zBL(aV3bN8n&EXKܙ3dTa\:3+ [w쀈&yzy@At@UBX\nbJQ鰀xFO\|ykyɽCciZ~vDz~j呇CkDw '{kA5$-˿ GX>X1$Ԛk}gD1#R/@-Q+ZŹ9cb+S?qwv66C3;mف?Xgiۺ}Us|~~$s'T6u=eU{3-:,3 & +ҕTvCqc5T26Q!+RlHQ b`<`8/IOڏQ&bnRWm0%84՞!pHni˲@K9aGhH+!\-\4#[Bvʖ:L*1#Guα5+ldDÐag>L~JcJ" ܪؒKRBmtE]TVG+ v]#F8kEl/}hإ' yL۸zrREJQo.̭'K!"劾LaR4p!fȻ*y_Q:l S!ƍuu= B<8{Ϥ+\]x.9Gzh~l"JyFarBYD2K-uk/ME@OVD KW!'5:1?vw?H*^N!嵹q*A/갭d ,z_g0(N ꫕a~p&JJ٘+ZoAAEZOn|'i< iN7HrVJh&UPw:xp8^[:{5OW70Z-bVSwxJPз[r<$ikFKcHvk5d[ ><oKԑ\1dD`Dv2CL0FqD"D-UoX>fa&$.:jwz! =#,6ѓͼG8ݛ^0oZwU+Rf~IbfSjn/ilylj¬^q.S3mY>mZTk3Al +q%|.H~> n3o{#>.7BZ-|Dļb9Lo|&P4ugrSI(̥&a}C!jG`lOIKmGIc4S& 4PZƱ@ .+@k8D4!$E^iGto}7@b! O#El5Gl)iX"!~ QRwUbVkd ep{D^ef_8/0\^;_Fw/]hc ??qJ3"\"hx, <&˷?)(C>]蒝'e]i?s-4UFLA&-AB)$Y{GD^*zdB<gE,P۞mCv,gܾ+ͯ,t!OdS 7!\uK uOZKY N H}]pzO<E%?Pߘw"[ -X{:B a$j!3YbC)tS)wu xQWϋ%pe ƈ?ԪX\0*_3ҜKZ \dQu1Qb<qCf ̀l~Pa,p-fuBUtҥeo`9_UFpX'gvINExFRR_roǬpW~ FTg=[|G)- qz ͅJ:R]>:J1E!RHB #HǗ"~oM^`(kȁPm7"n )6e]@mӎ3(&P$>Q*}MRk] s^9XZGf}LQy) '>d|3XSJfǃ]U'ڄG{~tփ Rʃ!}Pzk62|O]\ '/rWCɪ/RO_Ku[6WN>.~DgJqRX?&/͇\GL7ch]σ%Ij/D9|>֞(k@cQ] "Dk+LE@b_cmk]{Tr!=rEANbn XqlMm[#yKm3bKd yU1'ٻy} 2gٍp4 +m-%tlattӿiCIiA MeaonjZ |6VЄBgŵdg07Vbm8h[,Ldv5 ^A*Inz!~^&<^@:{btH$j3Yhg6`QM?4TQI9Rޤ?F%YggC?N!l ?^K2CBeBpm#`+ősS<2bl`MaAaeK>m='=hPI5*2yeT(ʭuf;4@ÔqR)"@˅}Ӈ]b*ޡs*l=uƘg= yCec~ˣWR|:~n7̠+ifN~)lEȅad\ۀEEZGZ ,7В_Z}A%vh!~3*9wΠ7tEETϷKӊU~y!o>@޶` x`=F$ˊ&Q<>O!᷒/Lm{> -x>}- |_QmGCT)!}}L3gVtضa ‘gMt)X-!JӡjؒSRߨ=K9D=]* MJcdjSX Xȹhkj7< 2l2la _ 8r .NAocɳ{]7^F-ԝº^U8Abc&}Da?q:7GYԭ_%1KϜu+98ΈGe,7u('2~[o}]؛lWH\ 72F 3p q93W[J֨-E z-=nACE=KfM|Ak%ԩ_ۍYz#o?Lt.yr`H\nz+^xʝzP \9梸 h#[j##*?08*d<^(V$$k.l9)I^Pbm(ڄMw+3ű +2d"+Q3פWnM [icBɆf`}Ev&PH? Y#CdXXBI~p `?7Ν_Osi7: '籞-mNd .u bDZmv)"l]X_R]1$7R,J>}vGgO<ųSKk|K'{@,ZK B:ŭzjQ@TzTPd1oA+7+Yic w~k}>||z@ځ68W1ɝ-2 R8y`CY?7 Y7WO#(@ VfAV4+8` sT;wW'8ZӹԖY33"h+CPͽhյN3{UBPJB6?v Rl7o^Mn+!1l0O]%ܸ#9xUWДKYL9ɤ-RLUU - nA^FLs*VafyC6;xdg#pxOUz9DmfY&$KnB8  g*V}A؊̸7B4F|yǴ/ڻtAčxZ-Kyr,W[ւ+\A >_6A-P {MU?p3?jRR^@X7["sl =N B;T >^%NXurtLq m4zƏ{ ":Ŭ/LNIi"JzkXoH4닑6h8e&9ÖS6 kͬRJ3q٢D>:ES~n&p SK ;<0t`3sn'8~ƥR {xܕf/qL4L/[ڐ#;-,L넁"@uq\]ӄ}W?" eEeIfpE |#'"b>"͆8`T>?;<_UUb_S~gs?=IсD @}>~=eU79)ygp$5fcA][p݉oZ\ZYox\!&!R6䠍8 9FWAЊ B{IXhr6 FiM9tc5%؁`NUabwݿOc֝;'ƙ,iMf;̅vNN};3=kq 7YcLM F[NYZe笕֢:J;R*D5ԝW\i74=4ע<\k~hL1Edݵu줟Q GT9]Ț5&b=5|T>7\;N|UdoHe?KfiuJN2g0"j_)/%Eۘ9Jqw4 o<+DG;/9AUtt lT-$A:x&٦g7_\&'CR7Z4~u}_"\&_=6 XGJ|[D⢀ us;1![%!-K27JrKo*bvN.tH.HM^jCl$tez̘M1J6t!c-[8ؕ 1۰xI͌7J/Hg)rvQR*飻j/I(S0woIz{s rDץ$ ψkͺߛ1_?<[vrc-f:d"=v?QyY ,'c1EGkܲkh>/ggkC` Tc ƪ|uH1RDmsU^'j^\\r6bw^Engn3 3isy%L1|U=@|*N֓庋w޺J!3"fN͖bҒΝ<ARcV{ Ā[gɲ]oW@B7kia͋UHZv%ަY  Z!QKmbc/N;E?6dms2E^֧oᝂqK֛Ҍ^=s|lݤ>V/>Mg#AI|f_Lra"d E[v/E^!`uN08~=u!]L+|zpww#$ku@al2 L '' RtAGL;?{o&ckvlDډk3.5xa5v:E#)40ȀpiV1SL]= qVQ]S+*CnEs9Aç`<"Vw^fWl&ߟGeO7,QPҌ:̒rz[.8,ŋN! @۽j>aLF0YGR9b,Bk9ؑ eW+c&N"(Kȡ3зw̟;\` %`#b@9! K5mqM aƄ*yL1y1֍׳h>+muȥ3)ّL$, oZj'yJIwgД`JMַ{h(=E>"HBڼx `/囕2RN/w/L作N[֏88_RXqXSXzᾭSf{Vy[k< bʩ*eܲA<?wwB~-Tm)"gt|LP &?졸07~o tu̚ZzΝ+_gpjdAm)4FxO# OR ^R(5y&ˮѤ!Ezg`d쩱,A愭ȹ 1lyem3^ n f[f8*> +m2Δ_8hY@! %]]e|AT&:& *1`Fxv<{dNƉqx@9W:Ɍe`,#t96&.)o,?<7Pib 4VGc+f9"me@/l;Sh/;A>;EskSq߬m+G-%s$! Lg7o4D})`}}9p턲e8U|ūմxx@帟H-_m6Y[#dǨH;%gԝ78)1% LU.JZF )sFz 3351A1V=󉻤F E 0U:178=4D@ ZhA&5ؔڻpNv?5jk<کcDƩU˛6,t8V ֝ӎ$')s%:tOD?bJ0df|bfrپKm笇Ze BZ3 RM,>xu] dmwX8JNsr# I L1L 2L8%N#4_3o8Sn[QϏפ}2y(}.ԳϱoV*y}fRsPNל딑Vd}j{m.dx7oEW(4>âU&zg*׋sYe-/@^ E]63Lqٹ[9FcSI]l75<&DvuY+;[YqaoGx4u f&(³,s<{FªhsQA}ZSe2V:y$1ã:Xg4sSH6'1{ΙY `AR>}">0K`IfJ(}`XCG%Sy>.TΦ5X \[ǀ66fޭfsE-q$nvf0=# 0"#Qfsޓ݃&pt$aLw[RJ8VVtQ>Io曈/zr5UBux< ~v`7{{vֿ!@%X֪K)`]1n#jQyè4Q|͈#>2sFEqj_Pz?@p'Ý=E%ET+TD4f (S1ޒ ӯ +JcFVd$ND 9=_FXv /*o4˻yFw A X]E\dP;=ۍd]8sfPtڛ`/,lwwMu@)jc 8mJ9Cxv `{֯{8[:u8͗~GpiSuœfLt@wkr~[zBCg|I*)#~o'taòK@RgƲu& ]C 4'[SBٌ+9xqQ=v;QN#nU22ynfpOy ~G,C>ǻ'?8ꨎ U,0.4=sA]Ȇȕ:{%A>CW_^1YP69z9#Xčߎu P gj1Po,ZM&= 2XoL?+MWơ=L&%Q8 ak[IT'<<ʮ1V̷& GP# q}" g!N#,8@o/O$AGfLo &/g!hF1չN.Ȝ p*qd>DIOz'Mfܜ'] ž *$~#xZ{1u؉+DU ֯,aFˋf#lLXQZ^F-зH~\5gLlh|CBji: 3ϫ]'76ē QHVl=O)- 8_t i(mC9H6&`(/0 hh~z7(/Tc̀ȍ*|f#=Xh>]3|x .Ga[P#C(TNbCt7x; 74ݡ[3Z[>+‹uC !M`psvxxA̬ D y8ִPOH-IPyFpA 誰q2uKu_Pk{#j48!AJV[n17'zMc&M !)i^w[ F`io0:ɾ-#im|~2Fkpz?Jb/`Ǘ_^S %";#ˤfLm瘻kF\$0Fp44 o f-&A_HQ) 5sՒlRDH%Yzl) Otxy/Ŵ"[V)ߖ8׎/if+i"Du'w9S汸:DHE@C`|Õ6j뷩T*E\k mѤab]+\lR'4r'.rs5@b5b|sOP^) B%G* rxL?Gxš[K/ 7hb 1QAޮ U,#;d`Z/׻]"v蚬p;FQ Q1jƑm Xr~s k@ e| yyle>]OfeIhٵ^=!T4|m*IJn=^+jTNА쩠ӶP_w[O"-B&; hܿo?g( uGe$"X"{ 2GL?HOrVV8p5{{ )Y)5w(yl4(ˊ>RiajpUJ=DyG'\pL*N$4z 5 zGR3\c*ܥ \"Jݵ`C#@UchŤQE?~P L3PԌߑ jR)Y@^QB{ƹ g }hx:TkYF1 ߉C.*\ךQؘOHz&>?:w9Z kJΙ+wwPwdd*ϔM%D=?S{S N ^*b2x%y[dkM됹ÿE7{8VlD1W}Y3u>w?,kyvv5 `0C# ӕej$B f(V >{nUcV:Hv /jŴVDlC2C5;> _دg RWhl >ۢr'D*zxsJVx Pecʈ$:HN u3'·x|ǸKX{;[z d҃Q,&WzLSM%5o^=QREGȒ)AyFR T·C33yXwkuE$wA^Q'5g9%DK4j&3>&6~8[~RUFnT?Fж9W!G១q`/Axk5c b;(f4%zty>ԫfb\x!}/6U}NjO 2jCr뮼@ƭ $e`:ϐ obuZG!u`RdF>Zv2`8-jDҿeVPZa+3ncWln4Gp ]P|EPnWaE`^7ȳ>mhۮEΆ)u\#cӖ率N+3eXz'AlEjWTFD`;H0fϫ<-tdާ[t&L&7&AN )?]d5pDܵ(^2UajUyq@nHu\/V=F꧊j ?ЉL3Y<ŕٖԿ Ä-~QI·.A2o+7#4mvwH/tDYeWͥl4 |)ӵZpJ]J'7_'LSeB,㿀ۊxɢ]Wr+¸b݇ݪ^If P Nᨨ ϖDlL) AJ]9gw)fdZ!.ZB&@yEVVb\3m"y`{![I&:nu,uʦc'H˔ӌ ᱽqPmAkdˏ%'MdqP݀tC .ksCi?8`YƪwOU3~..KJ㵇T|X>"P9>Q@ fmӞ WV86}NF,+Nw, ,g-`QS'ZNh-3R`.h8:[kV7-|a)wO=`[k5[2gĕÌ:cD QSѪwGt ~P3:z"O!Gduh!qq 3$1y yDɭP ۭayY1"th3?|C& {1>)N1́PV(L:J I%Wz&UEr&,C5A i&-4."wH`pBS$~1xFs/8:nD/&-Eb5W+ۉGDm'߫4 $._]2kgxX#7pMU]u߅t%eӾiFXGa EM#rdnN̰F %i,qpoҸ68]3WP O봷]o6rN:B6Th>7FzZ5ޱBE A: $m ;cu&ef<މHLda?TBݮL//wuju+e{5m74c;]֬1wsV$̡o<0@Rj  Ѱ!z!K`y‡5hISTCYVSfhlX`̼qhd5TPC<=ӰhۜϏ_Mbv{"b*ûW,;E.!닗w#F*/*?CmE+m* m,Pw R,ÏĹ#j$.c?6fj{2|8O[Vks@`m/z̉|a Q'90#MHU M rK,dج}$2Ymj(on׭7:5w( KRwBY#Q`l N&>,B#S[`V,; yʰ˗<ƾ2Mg Vs8-蘃,Q0AseC$'hbN#>RX |X )'|%Фw1a=ՖӲ[k 'ѸW4Oݰ@F/~j$Oq}wgJIO+K|)i@)ɬqxtl0m3KF^QAR/Mk7&Ryj/ߘ6\Z60F2jGWi#;yiHWYmM1j:HmF"_d̘vL) 5w j| PTߨ` u;+U)}T/Mde!:~N*R:S#6T(?}5NFt~XN\ene}F6Sgm\jNQpTHF MU|O7Ela.-6.hSvq*~YHnVx VU>MTw]̯fIl.G.K q+`[\npDd[w 0? Ph٘s"HݳoQI4K)9 wZ"BWj@iP ~`-v#(sfX4I:S?x^~6S堓Kܭ7,+Ch }swnQROof7 oPw͌}@z64Ij N~9LX1뫉Ix'fTRpHxx†AB-s5GZ`T51VL\I f:"'q @ LN8H=r021?o$1t7p^ܮHd>!3,H.4COu֊[e)Q 4 ΁٢ء,kǞ uAkbx8R agkLAJ^^D9iQYObXF㩁AP'8͙cbhLZ%׵9C@;eC`%c܆W10ނIr0K0[Z7_lg=]1 Vko ѣDNuϭս1NQ0lNlDt/Mǻ qhO?_{PM磮3/ n-zFwä.lfgq̦|&qwYݿ10O7l[ݧ{b߅ _L9$[7434#/^eήD.VF6Q2C0Y^͆wItS9/~5~Zh\8d0܃W3mӇQBл?䕆4y( Ke$I~n@򌘂e85KHfq|ņn*/9߫e{FI\ׁu9B*nY5kaO,~&Td?@R}UZJ0v[<ТE?;@2_DU=v5N qtVWf祺{SzIgyqiNӱ$2Yl} Β5̓wم0nуZ6{͒m(W[~W-mM U$^qnt yh{H4;vi`TP^/q'ϖ (%U[4xgc䒚R_SBN$l1FL>dF+ `JP_() #"EbRg"L ! ^#Cňws2E\ZWvec`6/V\j.63tKN3,G/FQe~-πZ7M(Ĝ襤9q6)Q2J: eQ隐%aP*H[ R5vy(]: !}''AZLRz=SaQg:N3䂙0/´ .xaU7jy~z fWJ\(OfQ\0d.j(w[S\pƔUXty;VV.pD \w2eJevMDo ;K@V_, R' E(k8Ơyƻf9JG9gOw9tZ+TX/S`{ f}^zlh+}[P˩Q3_ͬrʳ3 t pK,+%I2kSI3W1U%Rk:e$=V0,rljQ@UNaPNs.pmҭċkr.z'(@ "X#+yBvDV$1;6v}c2V}mA@TFm7iռمa~E*릌Q @FY"4Aa-[˥U1K"b;pfh7OM&8O+PkGc;A,D^dG6Ai+HH}᳦.K~Wv)]c3w#!u5sUxu6Wς`{c\, 'DC,NqIm,FG$6!%u|A:bMmc$Vҡ<<pkpV$vmٌ$i!9xD8rMi&ec~濫 c:)ek( j+Y#HT丣cIPMz\Hj `@ 7/s/EHmњHM6's$ԋKϼڀ!`X?g9Qi1|WA9J.EU'eb-7@,MMiKK"KԷ13s&jZY}JY6^\:,FY "uS}#ZJU`\7bQB0~tT ;Љ4!`bk`'7"r*Mnɑ}Sܪ WҩRwl%Oء[);A81@.H>/ ٠Գv8w/&z acee~lj8@rď}eQд2~tpIP1G3I%:wG= $-Aio~4%&Nyz2z/ryJE]b댽`ܓ~3a :HJJD [%!Zr mpBWLaDۏ p[KGH0bݧ|K7.1(Fr[.RN4Ɨl7PMƈ`: p'/E.Q%D܊1C 4`?_8x\yQ$2a&\⠴规5{m\sjka$faqu`qot Swߴ<v+yɪGD\)b3Tpk&$tҙ(gՙ28V49^2>s-=D1]Lmqk!r9p$ҞtEs˄(ؤ, $ykD[2^h7{a}f1s>$UfCǷ/p '%]I" L_^ Ol`eeqr_T~[jָ1l6.+h`|\ԥlܶH`gtǧ7ܠޘzdp}],Yp4x2\TLh$ðVwc赓n0 1GȊKz7>N9'k fez9Hć,E2<`\&mVJqa_=9  0))[ _PUܞ̯]y  _JcSv{ː2iR'Z֡U?f@X5 v?qĸ,=ٜ7CDggQ Ju,-=X}b֚?u .}p"N\X+c;Y77p_l)]od+_?3J~MszrY W-#[ Cۧ^œ|[Q\i14_eizsmz |oc IpfkeNԣ~ q|/':׌ihoY.Xz@Q hĭ<WSᢈ^b1\?M7RYB 0ԬUAIZ@ j) `(4jdHψ x2e~=kKfxB'~d-lt/ylalIҏ 2r[mߧ IaΞo,%TsY{֓y?OٹE=R v`R @ANu}uSZgGV_KAm|@ mN-_׃P^)6B %ozm6%c?(| vfZ|rܥN`vHX(0uٺ+2T`PQU<MUNJxiu،4ϸ +%PL6|mGdɄ!n!&\&ĉ%=LKv #>؃RĸF2KfৎE@faP?5۪"zbk6eOF/8=琞*wȞ2Kt.V 1}I*1p +hq1W!-wmknw:_؅!4ra#mMDW4~T!awLO{~"~W Ea\T*/w1SvPDɄz)%y-9[oՄتDn0*$0_r<[fInLc$ķ)dzjkľnr;~ZCOyvԅ0>ڌ5 M8K)%P[v_r$^,`!:XB;.TyӺt8)lo!VU)`'y"^5oq0<Er'׬'hcb4LKUS͙S񴜫V6% *Ig_ '=ռ~\h}.I'y]-hO̚~qjNΚ y a.N0݋ݿǘq\0775`1 0}?U Φ$D|l 1i>8#H)Yʊ ]RYܖi^pP!ՠyH b{ 4-< y4EK1CWrQ+5~'|msUSA,t|TAxݶk#hGǩ%Ž箘2:w}XZEKmf@3 5iy67"Z4ήMP4BMp=R )Gee`d1ձZ_`Yi:77٥P%\ޙNʼn1Sk(?eZx| jh[aU:"Rc-YX+~0\abgkls}?YTk9b-T@ꀽ+<]fz8lٕG~oQ-ԥc!;,-9>HbS˹$tID><`ZsW?oy}1*5@RA]E0WzN鄼5 e!cxr&^nEޫ*j7E "[]r^b P{4*"*0I~}F?Z49M"% H}mgʸ-,0 VT9-v{/@`C[RVGgti$gN%:je:zPכtt!<8ns{nW6]Lq{@A}&^0`2?MnwúQ?S*eCzXw0Bɒv!N+ׅO Zf"H}/;mĕM̞\2&f\*?JP耳7{? {PTx֥Az'_};$@N騘}t}nYwVo{g'QkQ cÕ2$ zAiGt& ;t\e{~^<kp\j:1-}UyWb إ1W= {곳ߪw%X%Gjz˟.ѕb׉.*6ul>KjFL37~olv~l_ 'A󥏪hh' aҶ_EJ=v`M ꛅ6_O\fHW;[nSܲB_>hrA^igPU+oVFq%cS`=ϗCX+# PA I=QUbW>zcGR`Ō:Abgً Yl@bت TtVg(L?2 -!))=I]1zzX*EU%8aZf\"Ql*k{ys8GH&lFSX`Vz\Q(LB<ϫrSeI}#CrC1:@A2qOQlUc"PLZak qV,TVL,fdUCC5 w@Y|So ft^w_r9VuTܚdwZr>T3\16}ooZ;\jfx#4Ӥ&x_0NYnMH1cf!x>w jn7ֺ"cGo] 3AdvTݛM. ۀ'Spe[v|.z^.eCa*nΛȉZ_q5M95(թJz1` @q.-eX e]/*^ֵx`hmb(VjH ]i%  rfd~h:" ^MBDb (BI>V])Ȅfd҆4`=L258=p+w4WPpy3?) 2įmgC^Pd:DP \)Ӗ\^\삨݊IB8 lv 9 g=ؙs_﵅ 1)ZEy8Mlq/ Bz; ?"*/Ox nZP OU,e'KEq).IX/퓧&tAzsRdWMuE~IhO2K`A}l~OLt51Ƭ4ΨJYh1'7Gcrb1 q$ɔMOCd\FuAo0\$ Afݞ>|OUiG^Rfu/iZ\::HH;"T; Ʒi:M nCQK᎗Zbz)ɃҔަvoW ٧T53 KzO4vzA(}m}|x? !Zo[ȱOE?Wh65S}u (ՄSh%IH1-*#W3 @o/িZRsvKҍGA[d֦ČSS65,M"ˎ0~o"%E~}쿡S8Qv &?ϧ(x;8G1{OSo٫PAjѽ@}s,+x)H㥸TyӶSLSJX'ٯ`-; "! m|3IDHR`2;U3j#`q3V6leݞyrǁg3\Ӯ֙ S%2@&`=_`?1;=hwAAoN|][W g^0{ep>t圚*ǭjG9)'iҍ-P!,RkIk4,v rBZWچ|݈$*q#kFÚgaouځךs2 o乽2JL+ٙش=t=%&Պuo  \ 46:t)4>j7QBO\:S)Kq[Ta;^$F^-/!L)u!3ahHo 1[+|A2Ȟ{rPZI_Uw/K*g15_D$J`U #vZ6SC6adOɣ/k"yZR&Q~2_7e)o T K֫iytW$=us=覟4PrFq s|θX Vao!fsLz9*үpsgD,5Z'c ?Q^zM XVXlF2^MhOOR`׍fBf]u0Z ̝5{gF.Geż#"aҗ[P Q}5'w'x_^ͼ^%sBy; A47Oԟg#E#("Tb5Dƀ0i,ZNELӔ]#nգ/f{N2 BI[M(SW18pq^iGv΀]`I?+PQ40l%`H_&l96Y@~ ^ޟ`fNG2>|\*Ц:C:3.dIRx5*\# v{Gu繜&c8-yMb>Ƅ79sl!^Urګ_OWIT 6t:>k㿣|UT:hXHBpWG(bYT*b ܘ͌8ޛwO=cNw;(J{Ir |Hd5 GcCKW^l0I]–pk #'{OZⱣ.ZHTam<9=kXCaIryy7^[ g!b&Ny \+iqBd9u3#2/sJR6ɠ\PT\o@NJΰBk kc3sӾNAA()MN[bd19´2hzmxˣ]'AK3 @4I4,SWOkgzE魯}>iZ;G=c4ʛ9쭁H*R)Uq$[k#"KkDrkiXIv:Ny ɓBh#16K>o-x{A!_v[~8R,S+]XjI΍N)![^03R薜75ٸ\ED>Wt2Mps35oƷ2d'<`\_7wh צ42=:/+^Tp 蒦 J 电F˳±'QR:D '9AwHo-tޜ2~,KdL$ ۃ>@OQ~(4ͽzXFS;O/D,\1JBXUi&D4 B2C#@ͫez|t*1jvPlH݂<攔 >=5xIj=`;lҁoGnkR8xϭP j!d޼X-gT5bI}l5 0@ FGMorCnN~OY]G:8a .De@CfBoY9 qĢ|{?^2N`f7J3b[a1/~ORY}&Lv/2瀻w^:-A`4E?gcǏT$%MPn-l:c|lMXWpΡ^6.xj<]-97=(N鯽&¥dkuI s"RҁGQ𸵊?^M@ί+,\B#1c0EA%h6:K bM[yrlCW`QDwU.ڐƋ?\ 3حG"pgm[)|{ɢ #6k)(9} F]U>FV5HVk&BV:B㤶RO=!mI,K! 0z8[Ɣ}b@GDYx@JnJJ\L -9˜|},e: bqd9P/3Jx4ϥO//H"E5EN!>U|6LD^55=pp]D\c 0bX44QWJ'Cps}Е }/Oft3LZkW@Icl_qS'rF3 )D 샢{ZO$ʿE N(ب{X=^DlUf? $cŚ2"Ǜ|`0 6NuKh:3luy,=^__ I9¼R"PH/n.<s۷S[BɋN뒦X*Ƅ&kRqpOřՉ)jC^+F _fgѨZ£PhQ%o]w%2 d`lBr9,bڧ45%c&ȌbՁg|m6& ٨̹R= edye]ڏP&:vV-d)q"ۍƒtw/(dGmWnzz'^*ݴ;UZ, tIt+tR53}dkw)9 L\7U% \ڭ)јV 6OKd)7x]?$GAX8 ЙwJg ޒޫAb$SA1 m-0W*Gl CvQ=xƲ8ulBk,WqN[Xtc.O  БTe2oCyuj8OufFt wL+ NW$7xJ1/LSxnؔTlvXu4Xg5Svɔ0ðAeަ! m Qʶ;'Wjo(j"SƼ+SQ5J_COL3]V#La ۪c$-ImLwsE6!cD'I7\lzr:ɧN=#Mlq] m7OiOM?}d#.~ʯ^[mSƨR>jWu_9Ccȁr1[U] [p-Q#t *Oi<;4kȅ1UuSxTsԕ.p?ջi,1C c1hP澪[)o={bK)ْհ=[WlܐmQv0j)366}EKO8o_GC19ù\ji2vqM VTLJ7!%sd]ZR8Z"4Nqf~fNzd*f\k.P6[5vW e@q-++NB9hJ:Æ[A}lpS -O3n؛Imt8 ՘lj[,F\W0D'y.ijLEZߵc([DF;hiv39GSKV8!3by}=7D1Rx%J 5J, P Z%Jik#zp *\bZkZSJqMwMG׼:W!fIH26p߫ea=\;jݷ\A?XMN:~zy4(f;{~S4 1hN]4,.mXh2~|[kul;i\z "t[6/> 5])cr?XE$NH̽HrP!5b2((\`"!-D}5AurƍIcIØ컽lh^fdt4Ұ'TmD[ _]ho5R[&ݼkDIL6,;%cD_aL&*-iuO$u(KK5eoB+< U7Zjr㎈ƁsU@ЉHvyC(N(iF¶S9g|b8J iJeEo+f5nXu iT@0CrT<6rmmQp,Qj4("{'L=Ď Z-ޱ:IPA|AK{-'year^Mᓴ뭘mF5f§!Ї%Q_˲X(k{ AeleC\#$]Ctm *?~ ۀjIH_Hz'PtVCnKcqkg# npiچӭ&` LA\D4YN|2aVwQnvAOaf:yQ"C|*QWȣZ~K0?ȥ%Ju(guMIƥ XOfX!|Y 1zhWa[[Y.(= \E&p샌Jpk<݂-Cƈh\Dt×P׫fgTǣ,=݂(HZZPh^o'!mH_elfGPޭ%S˿J UbIH H퓩rEy7BڗE/|R{WU[oR-j~|SDQT|"4޸\b nмb/6c>r ;M6Ԑ ɨxִeX ^84ůߝ}ؗT2@97xAˇpVچ "{Nr.g#+[p(5y(͌.HQ DOȊT0g{??A.QO-ܳ Ƌ-(<no;g?"#_`d7tmi³5z +V{ViR*ћ|WZ< y{d WYt h{02[ TϱnҞ\Ɯ ^;Nq 1'5ꇝo52~ ϱ+=D22e\O OL79ZW5}vzlF%SO?Iz1'ע_IY1vm*E%ZVEԼ,Oai K>:jLrjϑHȽ@p=M?sAQ(=9+dSA~bQIXx5dv"EX O&w/é,:F%UOk탁u\qI+TY.tqEmʬBvҪ)wj6sfcߞ`+Q:8by=]GlQ:k="stK4d)ڿ&L^[/޸f;[e^ػL¥.ތuiV>ֲ"B>\ٽW z>!̘{j1\QVغ F!6ꕈ\5|n^(a#[sݞͦҔjx_tl ۓ`{u*\Ú7RtcLP8mܖWXhlwllC;w.ZڈBm} 1-g}9V40qp_(Zx|{IKRu ?#6|['eEBR ,}*tݾΒqG7vWZV&WW+c~s 7HAꉵCo3"pl%W`,%U@iΎz)tR2!r4\"iU514 GiM?ka?(Q!.Y (َ}6L5gnKj{Ô!5Gq"Tް0YWfI6Dwe0aL:+ڜiQ9 1T6A÷lH_=jPлjuӴuQw"m͜<VqJ/$$ N;N:.\,\و!G(Ծ.De߽5p"Tg8fO+e.9U#xjy1h͎-?t0zcgD9tnXJ-d+y-)^t#@n ^ 6ʵc/z7$aZqUҰ]Sec! 0Ye O 7bD67Ҥ3S*3O"X9\ޢ!#VYkM͐gWM`{"!z[¾/7;(d+d,k zFE8TX0Yk߸*2# 82ip>N?<xYSQ#yHS[/ =G~,<}kKʥ{.i*Z7#gЭ,6 e/g렐-6f?^˱οJ:nDx-a;G?T gG**Yᆨ0[ɟߡ _TҔRDA'QY!8]397*QtE7ЦW}8>SBɧb 3& $l*{xgUd0B2^|-H #j7&J;'zoz{RvXaF|6/?7r֮#GZoX#_N>rF4=lV" du>D{LTZ˧ȉqǼۿ(DDU?mtobxzBW awe]i%䦿"rpP3@.J!E/^)}˃ E cg iê Mq霗Ÿ&P !m*x~\ PNRlx%Y :ț=gn}//Mj cz 0p=?^׌X<**u:n%\cD|jfutfh;"?{LnVIsJ;& ?^KuAb;81z՗Ѭp`!e:e?Eg&A%E~pRZX^x U-`3TcggCLJJ+ Q2DHcd٭(9B갔#7dNX:;YI9~/iQxaj;4.әvԕWIgq@=D߸sڨÄ'Sc_"H<\Z9GutrzahʗKٜy gVce Fe2zJh* YtciAoV|YKm)x9*^[ÿ#?U(J & wH{LnjԥРܔ xz{[}NҷY Q#[C?:|)ad oGz% =IiQyP-Y,+sϤinDAyBbHc}k4rO?eo<2#s` A/Čeqܚ$;w>w YZ