diff options
author | Internet Software Consortium, Inc <@isc.org> | 2007-09-07 14:16:24 -0600 |
---|---|---|
committer | LaMont Jones <lamont@debian.org> | 2007-09-07 14:16:24 -0600 |
commit | 8dc48682f6d0e38c23f5832207823849031cfc00 (patch) | |
tree | d86262a64fffd2c7c4a9fc0948f0444c60477be9 | |
parent | 7abf1450dc7b32fe2d15bbafa0a307ffc27142a6 (diff) | |
download | bind9-8dc48682f6d0e38c23f5832207823849031cfc00.tar.gz |
9.4.2b1
175 files changed, 22909 insertions, 10120 deletions
@@ -1,4 +1,193 @@ + --- 9.4.2b1 released --- + +2206. [security] "allow-query-cache" and "allow-recursion" now + cross inherit from each other. + + If allow-query-cache is not set in named.conf then + allow-recursion is used if set, otherwise allow-query + is used if set, otherwise the default (localnets; + localhost;) is used. + + If allow-recursion is not set in named.conf then + allow-query-cache is used if set, otherwise allow-query + is used if set, otherwise the default (localnets; + localhost;) is used. + + [RT #16987] + +2205. [bug] libbind: change #2119 broke thread support. [RT #16982] + +2203. [security] Query id generation was cryptographically weak. + [RT # 16915] + +2202. [security] The default acls for allow-query-cache and + allow-recursion were not being applied. [RT #16960] + +2200. [bug] The search for cached NSEC records was stopping to + early leading to excessive DLV queries. [RT #16930] + +2199. [bug] win32: don't call WSAStartup() while loading dlls. + [RT #16911] + +2198. [bug] win32: RegCloseKey() could be called when + RegOpenKeyEx() failed. [RT #16911] + +2197. [bug] Add INSIST to catch negative responses which are + not setting the event result code appropriately. + [RT #16909] + +2196. [port] win32: yield processor while waiting for once to + to complete. [RT #16958] + +2194. [bug] Close journal before calling 'done' in xfrin.c. + +2193. [port] win32: BINDInstall.exe is now linked statically. + [RT #16906] + +2192. [port] win32: use vcredist_x86.exe to install Visual + Studio's redistributable dlls if building with + Visual Stdio 2005 or later. + +2189. [bug] Handle socket() returning EINTR. [RT #15949] + +2188. [contrib] queryperf: autoconf changes to make the search for + libresolv or libbind more robust. [RT #16299] + +2187. [bug] query_addds(), query_addwildcardproof() and + query_addnxrrsetnsec() should take a version + arguement. [RT #16368] + +2186. [port] cygwin: libbind: check for struct sockaddr_storage + independently of IPv6. [RT #16482] + +2185. [port] sunos: libbind: check for ssize_t, memmove() and + memchr(). [RT #16463] + +2183. [bug] dnssec-signzone didn't handle offline private keys + well. [RT #16832] + +2182. [bug] dns_dispatch_createtcp() and dispatch_createudp() + could return ISC_R_SUCCESS when they ran out of + memory. [RT #16365] + +2181. [port] sunos: libbind: add paths.h from BIND 8. [RT #16462] + +2180. [cleanup] Remove bit test from 'compress_test' as they + are no longer needed. [RT #16497] + +2178. [bug] 'rndc reload' of a slave or stub zone resulted in + a reference leak. [RT #16867] + +2177. [bug] Array bounds overrun on read (rcodetext) at + debug level 10+. [RT #16798] + +2176. [contrib] dbus update to handle race condition during + initialisation (Bugzilla 235809). [RT #16842] + +2175. [bug] win32: windows broadcast condition variable support + was broken. [RT #16592] + +2174. [bug] I/O errors should always be fatal when reading + master files. [RT #16825] + +2173. [port] win32: When compiling with MSVS 2005 SP1 we also + need to ship Microsoft.VC80.MFCLOC. + +2171. [bug] Handle breaks in DNSSEC trust chains where the parent + servers are not DS aware (DS queries to the parent + return a referral to the child). + +2170. [func] Add acache processing to test suite. [RT #16711] + +2169. [bug] host, nslookup: when reporting NXDOMAIN report the + given name and not the last name searched for. + [RT #16763] + +2168. [bug] nsupdate: in non-interactive mode treat syntax errors + as fatal errors. [RT #16785] + +2167. [bug] When re-using a automatic zone named failed to + attach it to the new view. [RT #16786] + +2166. [bug] When running in batch mode, dig could misinterpret + a server address as a name to be looked up, causing + unexpected output. [RT #16743] + +2164. [bug] The code to determine how named-checkzone / + named-compilezone was called failed under windows. + [RT #16764] + +2162. [func] Allow "rrset-order fixed" to be disabled at compile + time. [RT #16665] + +2161. [bug] 'rndc flush' could report a false success. [RT #16698] + +2160. [bug] libisc wasn't handling NULL ifa_addr pointers returned + from getifaddrs(). [RT #16708] + +2159. [bug] Array bounds overrun in acache processing. [RT #16710] + +2158. [bug] ns_client_isself() failed to initialise key + leading to a REQUIRE failure. [RT #16688] + +2156. [bug] Fix node reference leaks in lookup.c:lookup_find(), + resolver.c:validated() and resolver.c:cache_name(). + Fix a memory leak in rbtdb.c:free_noqname(). + Make lookup.c:lookup_find() robust against + event leaks. [RT #16685] + +2155. [contrib] SQLite sdb module from jaboydjr@netwalk.com. + [RT #16694] + +2153. [bug] nsupdate could leak memory. [RT #16691] + +2152. [cleanup] Use sizeof(buf) instead of fixed number in + dighost.c:get_trusted_key(). [RT #16678] + +2151. [bug] Missing newline in usage message for journalprint. + [RT #16679] + +2150. [bug] 'rrset-order cyclic' uniformly distribute the + starting point for the first response for a given + RRset. [RT #16655] + +2149. [bug] isc_mem_checkdestroyed() failed to abort on + if there were still active memory contexts. + [RT #16672] + +2147. [bug] libbind: remove potential buffer overflow from + hmac_link.c. [RT #16437] + +2146. [cleanup] Silence Linux's spurious "obsolete setsockopt + SO_BSDCOMPAT" message. [RT #16641] + +2145. [bug] Check DS/DLV digest lengths for known digests. + [RT #16622] + +2144. [cleanup] Suppress logging of SERVFAIL from forwarders. + [RT #16619] + +2143. [bug] We failed to restart the IPv6 client when the + kernel failed to return the destination the + packet was sent to. [RT #16613] + +2142. [bug] Handle master files with a modification time that + matches the epoch. [RT# 16612] + +2141. [bug] dig/host should not be setting IDN_ASCCHECK (IDN + equivalent of LDH checks). [RT #16609] + +2140. [bug] libbind: missing unlock on pthread_key_create() + failures. [RT #16654] + +2139. [bug] dns_view_find() was being called with wrong type + in adb.c. [RT #16670] + +2119. [compat] libbind: allow res_init() to succeed enough to + return the default domain even if it was unable + to allocate memory. + --- 9.4.1 released --- 2172. [bug] query_addsoa() was being called with a non zone db. @@ -494,7 +683,7 @@ hex strings with comments. [RT #15814] 1974. [doc] List each of the zone types and associated zone - options seperately in the ARM. + options separately in the ARM. 1973. [func] TSIG HMACSHA1, HMACSHA224, HMACSHA256, HMACSHA384 and HMACSHA512 support. [RT #13606] @@ -521,7 +710,7 @@ 1965. [func] Suppress spurious "recusion requested but not available" warning with 'dig +qr'. [RT #15780]. -1964. [func] Seperate out MX and SRV to CNAME checks. [RT #15723] +1964. [func] Separate out MX and SRV to CNAME checks. [RT #15723] 1963. [port] Tru64 4.0E doesn't support send() and recv(). [RT #15586] @@ -741,7 +930,7 @@ 1898. [bug] Extend ISC_SOCKADDR_FORMATSIZE and ISC_NETADDR_FORMATSIZE to allow for scope details. -1897. [func] x86 and x86_64 now have seperate atomic locking +1897. [func] x86 and x86_64 now have separate atomic locking implementations. 1896. [bug] Recursive clients soft quota support wasn't working @@ -795,7 +984,7 @@ [RT #14892] 1878. [func] Detect duplicates of UDP queries we are recursing on - and drop them. New stats category "duplicates". + and drop them. New stats category "duplicate". [RT #2471] 1877. [bug] Fix unreasonably low quantum on call to @@ -1739,7 +1928,7 @@ [RT #6427] 1555. [func] 'rrset-order cyclic' no longer has a random starting - point. [RT #7572] + point per query. [RT #7572] 1554. [bug] dig, host, nslookup failed when no nameservers were specified in /etc/resolv.conf. [RT #8232] @@ -6220,7 +6409,7 @@ and has been removed. 170. [cleanup] Remove inter server consistancy checks from zone, - these should return as a seperate module in 9.1. + these should return as a separate module in 9.1. dns_zone_checkservers(), dns_zone_checkparents(), dns_zone_checkchildren(), dns_zone_checkglue(). @@ -43,11 +43,16 @@ BIND 9 Nominum, Inc. +BIND 9.4.2 + + BIND 9.4.2 is a maintenance release, containing fixes for + a number of bugs in 9.4.1. + BIND 9.4.1 - BIND 9.4.1 is a security release, containing a fix for a - security bug in 9.4.0. - + BIND 9.4.1 is a security release, containing a fix for + a security bugs in 9.4.0. + BIND 9.4.0 BIND 9.4.0 has a number of new features over 9.3, @@ -413,7 +418,7 @@ Building We've had successful builds and tests on the following systems: COMPAQ Tru64 UNIX 5.1B - FreeBSD 4.10, 5.2.1 + FreeBSD 4.10, 5.2.1, 6.2 HP-UX 11.11 NetBSD 1.5 Slackware Linux 8.1 @@ -470,6 +475,8 @@ Building -DDIG_SIGCHASE_BU=1) Disable dropping queries from particular well known ports. -DNS_CLIENT_DROPPORT=0 + Disable support for "rrset-order fixed". + -DDNS_RDATASET_FIXED=0 LDFLAGS Linker flags. Defaults to empty string. @@ -582,9 +589,8 @@ Bug Reports and Mailing Lists http://www.isc.org/ops/lists/ If you're planning on making changes to the BIND 9 source - code, you might want to join the BIND Workers mailing list. - Send mail to - - bind-workers-request@isc.org - + code, you might want to join the BIND Forum as a Worker. + This gives you access to the bind-workers@isc.org mailing + list and pre-release access to the code. + http://www.isc.org/sw/guild/bf/ diff --git a/bin/check/named-checkconf.8 b/bin/check/named-checkconf.8 index 9fb900e3..364e6b97 100644 --- a/bin/check/named-checkconf.8 +++ b/bin/check/named-checkconf.8 @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: named-checkconf.8,v 1.16.18.11 2007/01/30 00:23:44 marka Exp $ +.\" $Id: named-checkconf.8,v 1.16.18.13 2007/06/20 02:26:58 marka Exp $ .\" .hy 0 .ad l @@ -42,7 +42,7 @@ checks the syntax, but not the semantics, of a named configuration file. .PP \-t \fIdirectory\fR .RS 4 -chroot to +Chroot to \fIdirectory\fR so that include directives in the configuration file are processed as if run by a similarly chrooted named. .RE @@ -56,7 +56,7 @@ program and exit. .PP \-z .RS 4 -Perform a check load the master zonefiles found in +Perform a test load of all master zones found in \fInamed.conf\fR. .RE .PP @@ -77,6 +77,7 @@ returns an exit status of 1 if errors were detected and 0 otherwise. .SH "SEE ALSO" .PP \fBnamed\fR(8), +\fBnamed\-checkzone\fR(8), BIND 9 Administrator Reference Manual. .SH "AUTHOR" .PP diff --git a/bin/check/named-checkconf.docbook b/bin/check/named-checkconf.docbook index afeb8d5b..c3052165 100644 --- a/bin/check/named-checkconf.docbook +++ b/bin/check/named-checkconf.docbook @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: named-checkconf.docbook,v 1.8.18.7 2007/01/29 23:57:20 marka Exp $ --> +<!-- $Id: named-checkconf.docbook,v 1.8.18.9 2007/06/19 06:59:09 marka Exp $ --> <refentry id="man.named-checkconf"> <refentryinfo> <date>June 14, 2000</date> @@ -77,7 +77,7 @@ <term>-t <replaceable class="parameter">directory</replaceable></term> <listitem> <para> - chroot to <filename>directory</filename> so that + Chroot to <filename>directory</filename> so that include directives in the configuration file are processed as if run by a similarly chrooted named. @@ -99,8 +99,8 @@ <term>-z</term> <listitem> <para> - Perform a check load the master zonefiles found in - <filename>named.conf</filename>. + Perform a test load of all master zones found in + <filename>named.conf</filename>. </para> </listitem> </varlistentry> @@ -141,6 +141,9 @@ <para><citerefentry> <refentrytitle>named</refentrytitle><manvolnum>8</manvolnum> </citerefentry>, + <citerefentry> + <refentrytitle>named-checkzone</refentrytitle><manvolnum>8</manvolnum> + </citerefentry>, <citetitle>BIND 9 Administrator Reference Manual</citetitle>. </para> </refsect1> diff --git a/bin/check/named-checkconf.html b/bin/check/named-checkconf.html index f099645e..910df0d1 100644 --- a/bin/check/named-checkconf.html +++ b/bin/check/named-checkconf.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: named-checkconf.html,v 1.9.18.18 2007/01/30 00:23:44 marka Exp $ --> +<!-- $Id: named-checkconf.html,v 1.9.18.20 2007/06/20 02:26:58 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -43,7 +43,7 @@ <div class="variablelist"><dl> <dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt> <dd><p> - chroot to <code class="filename">directory</code> so that + Chroot to <code class="filename">directory</code> so that include directives in the configuration file are processed as if run by a similarly chrooted named. @@ -55,8 +55,8 @@ </p></dd> <dt><span class="term">-z</span></dt> <dd><p> - Perform a check load the master zonefiles found in - <code class="filename">named.conf</code>. + Perform a test load of all master zones found in + <code class="filename">named.conf</code>. </p></dd> <dt><span class="term">-j</span></dt> <dd><p> @@ -70,20 +70,21 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2543488"></a><h2>RETURN VALUES</h2> +<a name="id2543489"></a><h2>RETURN VALUES</h2> <p><span><strong class="command">named-checkconf</strong></span> returns an exit status of 1 if errors were detected and 0 otherwise. </p> </div> <div class="refsect1" lang="en"> -<a name="id2543499"></a><h2>SEE ALSO</h2> +<a name="id2543500"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, + <span class="citerefentry"><span class="refentrytitle">named-checkzone</span>(8)</span>, <em class="citetitle">BIND 9 Administrator Reference Manual</em>. </p> </div> <div class="refsect1" lang="en"> -<a name="id2543521"></a><h2>AUTHOR</h2> +<a name="id2543530"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/bin/check/named-checkzone.8 b/bin/check/named-checkzone.8 index ecd389c2..bd538ac6 100644 --- a/bin/check/named-checkzone.8 +++ b/bin/check/named-checkzone.8 @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: named-checkzone.8,v 1.18.18.20 2007/01/30 00:23:44 marka Exp $ +.\" $Id: named-checkzone.8,v 1.18.18.23 2007/06/20 02:26:58 marka Exp $ .\" .hy 0 .ad l @@ -48,7 +48,7 @@ useful for checking zone files before configuring them into a name server. \fBnamed\-compilezone\fR is similar to \fBnamed\-checkzone\fR, but it always dumps the zone contents to a specified file in a specified format. Additionally, it applies stricter check levels by default, since the dump output will be used as an actual zone file loaded by -\fBnamed\fR. When manaully specified otherwise, the check levels must at least be as strict as those specified in the +\fBnamed\fR. When manually specified otherwise, the check levels must at least be as strict as those specified in the \fBnamed\fR configuration file. .SH "OPTIONS" @@ -82,7 +82,7 @@ Specify the class of the zone. If not specified "IN" is assumed. .PP \-i \fImode\fR .RS 4 -Perform post load zone integrity checks. Possible modes are +Perform post\-load zone integrity checks. Possible modes are \fB"full"\fR (default), \fB"full\-sibling"\fR, @@ -105,7 +105,7 @@ only checks SRV records which refer to in\-zone hostnames. .sp Mode \fB"full"\fR -checks that delegation NS records refer to A or AAAA record (both in\-zone and out\-of\-zone hostnames). It also checks that glue addresses records in the zone match those advertised by the child. Mode +checks that delegation NS records refer to A or AAAA record (both in\-zone and out\-of\-zone hostnames). It also checks that glue address records in the zone match those advertised by the child. Mode \fB"local"\fR only checks NS records which refer to in\-zone hostnames or that some required glue exists, that is when the nameserver is in a child zone. .sp @@ -213,7 +213,7 @@ Check if a SRV record refers to a CNAME. Possible modes are .PP \-t \fIdirectory\fR .RS 4 -chroot to +Chroot to \fIdirectory\fR so that include directives in the configuration file are processed as if run by a similarly chrooted named. .RE @@ -256,6 +256,7 @@ returns an exit status of 1 if errors were detected and 0 otherwise. .SH "SEE ALSO" .PP \fBnamed\fR(8), +\fBnamed\-checkconf\fR(8), RFC 1035, BIND 9 Administrator Reference Manual. .SH "AUTHOR" diff --git a/bin/check/named-checkzone.c b/bin/check/named-checkzone.c index aa94b8c5..2e4cd55c 100644 --- a/bin/check/named-checkzone.c +++ b/bin/check/named-checkzone.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: named-checkzone.c,v 1.29.18.16 2006/10/05 05:24:35 marka Exp $ */ +/* $Id: named-checkzone.c,v 1.29.18.18 2007/03/29 23:46:34 tbox Exp $ */ /*! \file */ @@ -109,6 +109,8 @@ main(int argc, char **argv) { outputstyle = &dns_master_style_full; prog_name = strrchr(argv[0], '/'); + if (prog_name == NULL) + prog_name = strrchr(argv[0], '\\'); if (prog_name != NULL) prog_name++; else diff --git a/bin/check/named-checkzone.docbook b/bin/check/named-checkzone.docbook index 70e18782..cbe087a3 100644 --- a/bin/check/named-checkzone.docbook +++ b/bin/check/named-checkzone.docbook @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: named-checkzone.docbook,v 1.11.18.17 2007/01/29 23:57:20 marka Exp $ --> +<!-- $Id: named-checkzone.docbook,v 1.11.18.20 2007/06/19 06:59:09 marka Exp $ --> <refentry id="man.named-checkzone"> <refentryinfo> <date>June 13, 2000</date> @@ -117,7 +117,7 @@ Additionally, it applies stricter check levels by default, since the dump output will be used as an actual zone file loaded by <command>named</command>. - When manaully specified otherwise, the check levels must at + When manually specified otherwise, the check levels must at least be as strict as those specified in the <command>named</command> configuration file. </para> @@ -177,7 +177,7 @@ <term>-i <replaceable class="parameter">mode</replaceable></term> <listitem> <para> - Perform post load zone integrity checks. Possible modes are + Perform post-load zone integrity checks. Possible modes are <command>"full"</command> (default), <command>"full-sibling"</command>, <command>"local"</command>, @@ -199,7 +199,7 @@ <para> Mode <command>"full"</command> checks that delegation NS records refer to A or AAAA record (both in-zone and out-of-zone - hostnames). It also checks that glue addresses records + hostnames). It also checks that glue address records in the zone match those advertised by the child. Mode <command>"local"</command> only checks NS records which refer to in-zone hostnames or that some required glue exists, @@ -342,7 +342,7 @@ <term>-t <replaceable class="parameter">directory</replaceable></term> <listitem> <para> - chroot to <filename>directory</filename> so that + Chroot to <filename>directory</filename> so that include directives in the configuration file are processed as if run by a similarly chrooted named. @@ -422,6 +422,9 @@ <para><citerefentry> <refentrytitle>named</refentrytitle><manvolnum>8</manvolnum> </citerefentry>, + <citerefentry> + <refentrytitle>named-checkconf</refentrytitle><manvolnum>8</manvolnum> + </citerefentry>, <citetitle>RFC 1035</citetitle>, <citetitle>BIND 9 Administrator Reference Manual</citetitle>. </para> diff --git a/bin/check/named-checkzone.html b/bin/check/named-checkzone.html index be2f589e..0e1015d3 100644 --- a/bin/check/named-checkzone.html +++ b/bin/check/named-checkzone.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: named-checkzone.html,v 1.11.18.27 2007/01/30 00:23:44 marka Exp $ --> +<!-- $Id: named-checkzone.html,v 1.11.18.30 2007/06/20 02:26:58 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -47,7 +47,7 @@ Additionally, it applies stricter check levels by default, since the dump output will be used as an actual zone file loaded by <span><strong class="command">named</strong></span>. - When manaully specified otherwise, the check levels must at + When manually specified otherwise, the check levels must at least be as strict as those specified in the <span><strong class="command">named</strong></span> configuration file. </p> @@ -79,7 +79,7 @@ <dt><span class="term">-i <em class="replaceable"><code>mode</code></em></span></dt> <dd> <p> - Perform post load zone integrity checks. Possible modes are + Perform post-load zone integrity checks. Possible modes are <span><strong class="command">"full"</strong></span> (default), <span><strong class="command">"full-sibling"</strong></span>, <span><strong class="command">"local"</strong></span>, @@ -101,7 +101,7 @@ <p> Mode <span><strong class="command">"full"</strong></span> checks that delegation NS records refer to A or AAAA record (both in-zone and out-of-zone - hostnames). It also checks that glue addresses records + hostnames). It also checks that glue address records in the zone match those advertised by the child. Mode <span><strong class="command">"local"</strong></span> only checks NS records which refer to in-zone hostnames or that some required glue exists, @@ -195,7 +195,7 @@ </p></dd> <dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt> <dd><p> - chroot to <code class="filename">directory</code> so that + Chroot to <code class="filename">directory</code> so that include directives in the configuration file are processed as if run by a similarly chrooted named. @@ -242,12 +242,13 @@ <div class="refsect1" lang="en"> <a name="id2544311"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, + <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>, <em class="citetitle">RFC 1035</em>, <em class="citetitle">BIND 9 Administrator Reference Manual</em>. </p> </div> <div class="refsect1" lang="en"> -<a name="id2544336"></a><h2>AUTHOR</h2> +<a name="id2544344"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/bin/dig/dig.1 b/bin/dig/dig.1 index 240b732c..bf532807 100644 --- a/bin/dig/dig.1 +++ b/bin/dig/dig.1 @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dig.1,v 1.23.18.19 2007/01/30 00:23:44 marka Exp $ +.\" $Id: dig.1,v 1.23.18.22 2007/05/16 06:11:27 marka Exp $ .\" .hy 0 .ad l @@ -50,7 +50,7 @@ Although \fBdig\fR is normally used with command\-line arguments, it also has a batch mode of operation for reading lookup requests from a file. A brief summary of its command\-line arguments and options is printed when the \fB\-h\fR -option is given. Unlike earlier versions, the BIND9 implementation of +option is given. Unlike earlier versions, the BIND 9 implementation of \fBdig\fR allows multiple lookups to be issued from the command line. .PP @@ -128,14 +128,14 @@ The default query class (IN for internet) is overridden by the \fB\-c\fR option. \fIclass\fR -is any valid class, such as HS for Hesiod records or CH for CHAOSNET records. +is any valid class, such as HS for Hesiod records or CH for Chaosnet records. .PP The \fB\-f\fR option makes \fBdig \fR operate in batch mode by reading a list of lookup requests to process from the file -\fIfilename\fR. The file contains a number of queries, one per line. Each entry in the file should be organised in the same way they would be presented as queries to +\fIfilename\fR. The file contains a number of queries, one per line. Each entry in the file should be organized in the same way they would be presented as queries to \fBdig\fR using the command\-line interface. .PP @@ -160,7 +160,7 @@ to only use IPv6 query transport. The \fB\-t\fR option sets the query type to -\fItype\fR. It can be any valid query type which is supported in BIND9. The default query type "A", unless the +\fItype\fR. It can be any valid query type which is supported in BIND 9. The default query type is "A", unless the \fB\-x\fR option is supplied to indicate a reverse lookup. A zone transfer can be requested by specifying a type of AXFR. When an incremental zone transfer (IXFR) is required, \fItype\fR @@ -171,11 +171,11 @@ ixfr=N. The incremental zone transfer will contain the changes made to the zone The \fB\-q\fR option sets the query name to -\fIname\fR. This useful do distingish the +\fIname\fR. This useful do distinguish the \fIname\fR from other arguments. .PP -Reverse lookups \- mapping addresses to names \- are simplified by the +Reverse lookups \(em mapping addresses to names \(em are simplified by the \fB\-x\fR option. \fIaddr\fR @@ -228,7 +228,7 @@ to negate the meaning of that keyword. Other keywords assign values to options l .PP \fB+[no]tcp\fR .RS 4 -Use [do not use] TCP when querying name servers. The default behaviour is to use UDP unless an AXFR or IXFR query is requested, in which case a TCP connection is used. +Use [do not use] TCP when querying name servers. The default behavior is to use UDP unless an AXFR or IXFR query is requested, in which case a TCP connection is used. .RE .PP \fB+[no]vc\fR @@ -330,7 +330,7 @@ makes iterative queries to resolve the name being looked up. It will follow refe .PP \fB+[no]cmd\fR .RS 4 -toggles the printing of the initial comment in the output identifying the version of +Toggles the printing of the initial comment in the output identifying the version of \fBdig\fR and the query options that have been applied. This comment is printed by default. .RE @@ -354,7 +354,7 @@ Toggle the display of comment lines in the output. The default is to print comme .PP \fB+[no]stats\fR .RS 4 -This query option toggles the printing of statistics: when the query was made, the size of the reply and so on. The default behaviour is to print the query statistics. +This query option toggles the printing of statistics: when the query was made, the size of the reply and so on. The default behavior is to print the query statistics. .RE .PP \fB+[no]qr\fR @@ -391,7 +391,7 @@ Set or clear all display flags. .RS 4 Sets the timeout for a query to \fIT\fR -seconds. The default time out is 5 seconds. An attempt to set +seconds. The default timeout is 5 seconds. An attempt to set \fIT\fR to less than 1 will result in a query timeout of 1 second being applied. .RE @@ -451,7 +451,7 @@ output. .PP \fB+[no]fail\fR .RS 4 -Do not try the next server if you receive a SERVFAIL. The default is to not try the next server which is the reverse of normal stub resolver behaviour. +Do not try the next server if you receive a SERVFAIL. The default is to not try the next server which is the reverse of normal stub resolver behavior. .RE .PP \fB+[no]besteffort\fR @@ -487,7 +487,7 @@ Requires dig be compiled with \-DDIG_SIGCHASE. .PP \fB+[no]topdown\fR .RS 4 -When chasing DNSSEC signature chains perform a top down validation. Requires dig be compiled with \-DDIG_SIGCHASE. +When chasing DNSSEC signature chains perform a top\-down validation. Requires dig be compiled with \-DDIG_SIGCHASE. .RE .SH "MULTIPLE QUERIES" .PP diff --git a/bin/dig/dig.c b/bin/dig/dig.c index dd801995..fffd9944 100644 --- a/bin/dig/dig.c +++ b/bin/dig/dig.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000-2003 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dig.c,v 1.186.18.26 2006/07/21 23:52:21 marka Exp $ */ +/* $Id: dig.c,v 1.186.18.28 2007/04/24 23:46:25 tbox Exp $ */ /*! \file */ @@ -650,42 +650,6 @@ printgreeting(int argc, char **argv, dig_lookup_t *lookup) { } } -/*% - * Reorder an argument list so that server names all come at the end. - * This is a bit of a hack, to allow batch-mode processing to properly - * handle the server options. - */ -static void -reorder_args(int argc, char *argv[]) { - int i, j; - char *ptr; - int end; - - debug("reorder_args()"); - end = argc - 1; - while (argv[end][0] == '@') { - end--; - if (end == 0) - return; - } - debug("arg[end]=%s", argv[end]); - for (i = 1; i < end - 1; i++) { - if (argv[i][0] == '@') { - debug("arg[%d]=%s", i, argv[i]); - ptr = argv[i]; - for (j = i + 1; j < end; j++) { - debug("Moving %s to %d", argv[j], j - 1); - argv[j - 1] = argv[j]; - } - debug("moving %s to end, %d", ptr, end - 1); - argv[end - 1] = ptr; - end--; - if (end < 1) - return; - } - } -} - static isc_uint32_t parse_uint(char *arg, const char *desc, isc_uint32_t max) { isc_result_t result; @@ -1104,7 +1068,9 @@ static const char *single_dash_opts = "46dhimnv"; static const char *dash_opts = "46bcdfhikmnptvyx"; static isc_boolean_t dash_option(char *option, char *next, dig_lookup_t **lookup, - isc_boolean_t *open_type_class, isc_boolean_t config_only) + isc_boolean_t *open_type_class, isc_boolean_t *need_clone, + isc_boolean_t config_only, int argc, char **argv, + isc_boolean_t *firstarg) { char opt, *value, *ptr, *ptr2, *ptr3; isc_result_t result; @@ -1241,14 +1207,20 @@ dash_option(char *option, char *next, dig_lookup_t **lookup, return (value_from_next); case 'q': if (!config_only) { - (*lookup) = clone_lookup(default_lookup, - ISC_TRUE); + if (*need_clone) + (*lookup) = clone_lookup(default_lookup, + ISC_TRUE); + *need_clone = ISC_TRUE; strncpy((*lookup)->textname, value, sizeof((*lookup)->textname)); (*lookup)->textname[sizeof((*lookup)->textname)-1]=0; (*lookup)->trace_root = ISC_TF((*lookup)->trace || (*lookup)->ns_search_only); (*lookup)->new_search = ISC_TRUE; + if (*firstarg) { + printgreeting(argc, argv, *lookup); + *firstarg = ISC_FALSE; + } ISC_LIST_APPEND(lookup_list, (*lookup), link); debug("looking up %s", (*lookup)->textname); } @@ -1376,7 +1348,9 @@ dash_option(char *option, char *next, dig_lookup_t **lookup, keysecret[sizeof(keysecret)-1]=0; return (value_from_next); case 'x': - *lookup = clone_lookup(default_lookup, ISC_TRUE); + if (*need_clone) + *lookup = clone_lookup(default_lookup, ISC_TRUE); + *need_clone = ISC_TRUE; if (get_reverse(textname, sizeof(textname), value, ip6_int, ISC_FALSE) == ISC_R_SUCCESS) { strncpy((*lookup)->textname, textname, @@ -1390,6 +1364,10 @@ dash_option(char *option, char *next, dig_lookup_t **lookup, if (!(*lookup)->rdclassset) (*lookup)->rdclass = dns_rdataclass_in; (*lookup)->new_search = ISC_TRUE; + if (*firstarg) { + printgreeting(argc, argv, *lookup); + *firstarg = ISC_FALSE; + } ISC_LIST_APPEND(lookup_list, *lookup, link); } else { fprintf(stderr, "Invalid IP address %s\n", value); @@ -1481,6 +1459,8 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, char rcfile[256]; #endif char *input; + int i; + isc_boolean_t need_clone = ISC_TRUE; /* * The semantics for parsing the args is a bit complex; if @@ -1528,7 +1508,9 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, bargv[0] = argv[0]; argv0 = argv[0]; - reorder_args(bargc, (char **)bargv); + for(i = 0; i < bargc; i++) + debug(".digrc argv %d: %s", + i, bargv[i]); parse_args(ISC_TRUE, ISC_TRUE, bargc, (char **)bargv); } @@ -1537,7 +1519,12 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, #endif } - lookup = default_lookup; + if (is_batchfile && !config_only) { + /* Processing '-f batchfile'. */ + lookup = clone_lookup(default_lookup, ISC_TRUE); + need_clone = ISC_FALSE; + } else + lookup = default_lookup; rc = argc; rv = argv; @@ -1554,14 +1541,16 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, if (rc <= 1) { if (dash_option(&rv[0][1], NULL, &lookup, &open_type_class, - config_only)) { + &need_clone, config_only, + argc, argv, &firstarg)) { rc--; rv++; } } else { if (dash_option(&rv[0][1], rv[1], &lookup, &open_type_class, - config_only)) { + &need_clone, config_only, + argc, argv, &firstarg)) { rc--; rv++; } @@ -1629,21 +1618,29 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, continue; } } + if (!config_only) { - lookup = clone_lookup(default_lookup, - ISC_TRUE); + if (need_clone) + lookup = clone_lookup(default_lookup, + ISC_TRUE); + need_clone = ISC_TRUE; strncpy(lookup->textname, rv[0], sizeof(lookup->textname)); lookup->textname[sizeof(lookup->textname)-1]=0; lookup->trace_root = ISC_TF(lookup->trace || lookup->ns_search_only); lookup->new_search = ISC_TRUE; + if (firstarg) { + printgreeting(argc, argv, lookup); + firstarg = ISC_FALSE; + } ISC_LIST_APPEND(lookup_list, lookup, link); debug("looking up %s", lookup->textname); } /* XXX Error message */ } } + /* * If we have a batchfile, seed the lookup list with the * first entry, then trust the callback in dighost_shutdown @@ -1678,15 +1675,20 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, bargv[0] = argv[0]; argv0 = argv[0]; - reorder_args(bargc, (char **)bargv); + for(i = 0; i < bargc; i++) + debug("batch argv %d: %s", i, bargv[i]); parse_args(ISC_TRUE, ISC_FALSE, bargc, (char **)bargv); + return; } + return; } /* * If no lookup specified, search for root */ if ((lookup_list.head == NULL) && !config_only) { - lookup = clone_lookup(default_lookup, ISC_TRUE); + if (need_clone) + lookup = clone_lookup(default_lookup, ISC_TRUE); + need_clone = ISC_TRUE; lookup->trace_root = ISC_TF(lookup->trace || lookup->ns_search_only); lookup->new_search = ISC_TRUE; @@ -1698,10 +1700,9 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, firstarg = ISC_FALSE; } ISC_LIST_APPEND(lookup_list, lookup, link); - } else if (!config_only && firstarg) { - printgreeting(argc, argv, lookup); - firstarg = ISC_FALSE; } + if (!need_clone) + destroy_lookup(lookup); } /* @@ -1715,7 +1716,7 @@ dighost_shutdown(void) { int bargc; char *bargv[16]; char *input; - + int i; if (batchname == NULL) { isc_app_shutdown(); @@ -1743,7 +1744,8 @@ dighost_shutdown(void) { bargv[0] = argv0; - reorder_args(bargc, (char **)bargv); + for(i = 0; i < bargc; i++) + debug("batch argv %d: %s", i, bargv[i]); parse_args(ISC_TRUE, ISC_FALSE, bargc, (char **)bargv); start_lookup(); } else { @@ -1759,7 +1761,6 @@ dighost_shutdown(void) { int main(int argc, char **argv) { isc_result_t result; - dig_server_t *s, *s2; ISC_LIST_INIT(lookup_list); ISC_LIST_INIT(server_list); @@ -1780,16 +1781,7 @@ main(int argc, char **argv) { result = isc_app_onrun(mctx, global_task, onrun_callback, NULL); check_result(result, "isc_app_onrun"); isc_app_run(); - s = ISC_LIST_HEAD(default_lookup->my_server_list); - while (s != NULL) { - debug("freeing server %p belonging to %p", - s, default_lookup); - s2 = s; - s = ISC_LIST_NEXT(s, link); - ISC_LIST_DEQUEUE(default_lookup->my_server_list, s2, link); - isc_mem_free(mctx, s2); - } - isc_mem_free(mctx, default_lookup); + destroy_lookup(default_lookup); if (batchname != NULL) { if (batchfp != stdin) fclose(batchfp); diff --git a/bin/dig/dig.docbook b/bin/dig/dig.docbook index be01a860..cce45f29 100644 --- a/bin/dig/dig.docbook +++ b/bin/dig/dig.docbook @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: dig.docbook,v 1.17.18.17 2007/01/29 23:57:20 marka Exp $ --> +<!-- $Id: dig.docbook,v 1.17.18.20 2007/05/16 01:45:30 marka Exp $ --> <refentry id="man.dig"> <refentryinfo> @@ -104,7 +104,7 @@ arguments, it also has a batch mode of operation for reading lookup requests from a file. A brief summary of its command-line arguments and options is printed when the <option>-h</option> option is given. - Unlike earlier versions, the BIND9 implementation of + Unlike earlier versions, the BIND 9 implementation of <command>dig</command> allows multiple lookups to be issued from the command line. @@ -216,7 +216,7 @@ The default query class (IN for internet) is overridden by the <option>-c</option> option. <parameter>class</parameter> is any valid - class, such as HS for Hesiod records or CH for CHAOSNET records. + class, such as HS for Hesiod records or CH for Chaosnet records. </para> <para> @@ -225,7 +225,7 @@ in batch mode by reading a list of lookup requests to process from the file <parameter>filename</parameter>. The file contains a number of - queries, one per line. Each entry in the file should be organised in + queries, one per line. Each entry in the file should be organized in the same way they would be presented as queries to <command>dig</command> using the command-line interface. </para> @@ -251,7 +251,7 @@ The <option>-t</option> option sets the query type to <parameter>type</parameter>. It can be any valid query type which is - supported in BIND9. The default query type "A", unless the + supported in BIND 9. The default query type is "A", unless the <option>-x</option> option is supplied to indicate a reverse lookup. A zone transfer can be requested by specifying a type of AXFR. When an incremental zone transfer (IXFR) is required, @@ -263,12 +263,12 @@ <para> The <option>-q</option> option sets the query name to - <parameter>name</parameter>. This useful do distingish the + <parameter>name</parameter>. This useful do distinguish the <parameter>name</parameter> from other arguments. </para> <para> - Reverse lookups - mapping addresses to names - are simplified by the + Reverse lookups — mapping addresses to names — are simplified by the <option>-x</option> option. <parameter>addr</parameter> is an IPv4 address in dotted-decimal notation, or a colon-delimited IPv6 address. @@ -343,7 +343,7 @@ <listitem> <para> Use [do not use] TCP when querying name servers. The default - behaviour is to use UDP unless an AXFR or IXFR query is + behavior is to use UDP unless an AXFR or IXFR query is requested, in which case a TCP connection is used. </para> @@ -536,7 +536,7 @@ <term><option>+[no]cmd</option></term> <listitem> <para> - toggles the printing of the initial comment in the output + Toggles the printing of the initial comment in the output identifying the version of <command>dig</command> and the query options that have @@ -588,7 +588,7 @@ This query option toggles the printing of statistics: when the query was made, the size of the reply and so on. The default - behaviour is + behavior is to print the query statistics. </para> </listitem> @@ -662,8 +662,8 @@ <para> Sets the timeout for a query to - <parameter>T</parameter> seconds. The default time - out is 5 seconds. + <parameter>T</parameter> seconds. The default + timeout is 5 seconds. An attempt to set <parameter>T</parameter> to less than 1 will result in a query timeout of 1 second being applied. @@ -763,7 +763,7 @@ default is to not try the next server which is the reverse of normal stub resolver - behaviour. + behavior. </para> </listitem> </varlistentry> @@ -822,7 +822,7 @@ <term><option>+[no]topdown</option></term> <listitem> <para> - When chasing DNSSEC signature chains perform a top down + When chasing DNSSEC signature chains perform a top-down validation. Requires dig be compiled with -DDIG_SIGCHASE. </para> diff --git a/bin/dig/dig.html b/bin/dig/dig.html index 945a8967..afdaa4f9 100644 --- a/bin/dig/dig.html +++ b/bin/dig/dig.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: dig.html,v 1.13.18.25 2007/01/30 00:23:44 marka Exp $ --> +<!-- $Id: dig.html,v 1.13.18.28 2007/05/16 06:11:27 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -50,7 +50,7 @@ arguments, it also has a batch mode of operation for reading lookup requests from a file. A brief summary of its command-line arguments and options is printed when the <code class="option">-h</code> option is given. - Unlike earlier versions, the BIND9 implementation of + Unlike earlier versions, the BIND 9 implementation of <span><strong class="command">dig</strong></span> allows multiple lookups to be issued from the command line. @@ -139,7 +139,7 @@ The default query class (IN for internet) is overridden by the <code class="option">-c</code> option. <em class="parameter"><code>class</code></em> is any valid - class, such as HS for Hesiod records or CH for CHAOSNET records. + class, such as HS for Hesiod records or CH for Chaosnet records. </p> <p> The <code class="option">-f</code> option makes <span><strong class="command">dig </strong></span> @@ -147,7 +147,7 @@ in batch mode by reading a list of lookup requests to process from the file <em class="parameter"><code>filename</code></em>. The file contains a number of - queries, one per line. Each entry in the file should be organised in + queries, one per line. Each entry in the file should be organized in the same way they would be presented as queries to <span><strong class="command">dig</strong></span> using the command-line interface. </p> @@ -170,7 +170,7 @@ The <code class="option">-t</code> option sets the query type to <em class="parameter"><code>type</code></em>. It can be any valid query type which is - supported in BIND9. The default query type "A", unless the + supported in BIND 9. The default query type is "A", unless the <code class="option">-x</code> option is supplied to indicate a reverse lookup. A zone transfer can be requested by specifying a type of AXFR. When an incremental zone transfer (IXFR) is required, @@ -181,11 +181,11 @@ </p> <p> The <code class="option">-q</code> option sets the query name to - <em class="parameter"><code>name</code></em>. This useful do distingish the + <em class="parameter"><code>name</code></em>. This useful do distinguish the <em class="parameter"><code>name</code></em> from other arguments. </p> <p> - Reverse lookups - mapping addresses to names - are simplified by the + Reverse lookups — mapping addresses to names — are simplified by the <code class="option">-x</code> option. <em class="parameter"><code>addr</code></em> is an IPv4 address in dotted-decimal notation, or a colon-delimited IPv6 address. @@ -249,7 +249,7 @@ <dt><span class="term"><code class="option">+[no]tcp</code></span></dt> <dd><p> Use [do not use] TCP when querying name servers. The default - behaviour is to use UDP unless an AXFR or IXFR query is + behavior is to use UDP unless an AXFR or IXFR query is requested, in which case a TCP connection is used. </p></dd> @@ -362,7 +362,7 @@ </p></dd> <dt><span class="term"><code class="option">+[no]cmd</code></span></dt> <dd><p> - toggles the printing of the initial comment in the output + Toggles the printing of the initial comment in the output identifying the version of <span><strong class="command">dig</strong></span> and the query options that have @@ -394,7 +394,7 @@ This query option toggles the printing of statistics: when the query was made, the size of the reply and so on. The default - behaviour is + behavior is to print the query statistics. </p></dd> <dt><span class="term"><code class="option">+[no]qr</code></span></dt> @@ -433,8 +433,8 @@ <dd><p> Sets the timeout for a query to - <em class="parameter"><code>T</code></em> seconds. The default time - out is 5 seconds. + <em class="parameter"><code>T</code></em> seconds. The default + timeout is 5 seconds. An attempt to set <em class="parameter"><code>T</code></em> to less than 1 will result in a query timeout of 1 second being applied. @@ -499,7 +499,7 @@ default is to not try the next server which is the reverse of normal stub resolver - behaviour. + behavior. </p></dd> <dt><span class="term"><code class="option">+[no]besteffort</code></span></dt> <dd><p> @@ -535,7 +535,7 @@ </dd> <dt><span class="term"><code class="option">+[no]topdown</code></span></dt> <dd><p> - When chasing DNSSEC signature chains perform a top down + When chasing DNSSEC signature chains perform a top-down validation. Requires dig be compiled with -DDIG_SIGCHASE. </p></dd> diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c index 2e950a4f..78bfda0c 100644 --- a/bin/dig/dighost.c +++ b/bin/dig/dighost.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dighost.c,v 1.259.18.39 2007/02/14 23:45:43 marka Exp $ */ +/* $Id: dighost.c,v 1.259.18.42 2007/04/24 06:49:52 each Exp $ */ /*! \file * \note @@ -144,6 +144,7 @@ static idn_result_t append_textname(char *name, const char *origin, static void idn_check_result(idn_result_t r, const char *msg); #define MAXDLEN 256 +int idnoptions = 0; #endif /*% @@ -1275,9 +1276,7 @@ clear_query(dig_query_t *query) { */ static isc_boolean_t try_clear_lookup(dig_lookup_t *lookup) { - dig_server_t *s; dig_query_t *q; - void *ptr; REQUIRE(lookup != NULL); @@ -1298,7 +1297,16 @@ try_clear_lookup(dig_lookup_t *lookup) { * At this point, we know there are no queries on the lookup, * so can make it go away also. */ - debug("cleared"); + destroy_lookup(lookup); + return (ISC_TRUE); +} + +void +destroy_lookup(dig_lookup_t *lookup) { + dig_server_t *s; + void *ptr; + + debug("destroy"); s = ISC_LIST_HEAD(lookup->my_server_list); while (s != NULL) { debug("freeing server %p belonging to %p", s, lookup); @@ -1323,7 +1331,6 @@ try_clear_lookup(dig_lookup_t *lookup) { dst_context_destroy(&lookup->tsigctx); isc_mem_free(mctx, lookup); - return (ISC_TRUE); } /*% @@ -1816,7 +1823,7 @@ setup_lookup(dig_lookup_t *lookup) { sizeof(utf8_textname)); idn_check_result(mr, "append origin to textname"); } - mr = idn_encodename(IDN_LOCALMAP | IDN_NAMEPREP | IDN_ASCCHECK | + mr = idn_encodename(idnoptions | IDN_LOCALMAP | IDN_NAMEPREP | IDN_IDNCONV | IDN_LENCHECK, utf8_textname, idn_textname, sizeof(idn_textname)); idn_check_result(mr, "convert UTF-8 textname to IDN encoding"); @@ -3891,7 +3898,7 @@ get_trusted_key(isc_mem_t *mctx) filename); return (ISC_R_FAILURE); } - while (fgets(buf, 1500, fp) != NULL) { + while (fgets(buf, sizeof(buf), fp) != NULL) { result = opentmpkey(mctx,"tmp_file", &filetemp, &fptemp); if (result != ISC_R_SUCCESS) { fclose(fp); diff --git a/bin/dig/host.1 b/bin/dig/host.1 index 3149fc64..ee537bd4 100644 --- a/bin/dig/host.1 +++ b/bin/dig/host.1 @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: host.1,v 1.14.18.13 2007/01/30 00:23:44 marka Exp $ +.\" $Id: host.1,v 1.14.18.14 2007/05/09 03:33:12 marka Exp $ .\" .hy 0 .ad l @@ -130,7 +130,7 @@ makes. This should mean that the name server receiving the query will not attemp \fB\-r\fR option enables \fBhost\fR -to mimic the behaviour of a name server by making non\-recursive queries and expecting to receive answers to those queries that are usually referrals to other name servers. +to mimic the behavior of a name server by making non\-recursive queries and expecting to receive answers to those queries that are usually referrals to other name servers. .PP By default \fBhost\fR @@ -152,7 +152,7 @@ The \fB\-t\fR option is used to select the query type. \fItype\fR -can be any recognised query type: CNAME, NS, SOA, SIG, KEY, AXFR, etc. When no query type is specified, +can be any recognized query type: CNAME, NS, SOA, SIG, KEY, AXFR, etc. When no query type is specified, \fBhost\fR automatically selects an appropriate query type. By default it looks for A records, but if the \fB\-C\fR @@ -185,7 +185,7 @@ The option tells \fBhost\fR \fInot\fR -to send the query to the next nameserver if any server responds with a SERVFAIL response, which is the reverse of normal stub resolver behaviour. +to send the query to the next nameserver if any server responds with a SERVFAIL response, which is the reverse of normal stub resolver behavior. .PP The \fB\-m\fR diff --git a/bin/dig/host.c b/bin/dig/host.c index f73145c3..12d2b36f 100644 --- a/bin/dig/host.c +++ b/bin/dig/host.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000-2003 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,13 +15,25 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: host.c,v 1.94.18.14 2006/05/23 04:40:42 marka Exp $ */ +/* $Id: host.c,v 1.94.18.17 2007/04/24 07:36:36 marka Exp $ */ /*! \file */ #include <config.h> +#include <stdlib.h> #include <limits.h> +#ifdef HAVE_LOCALE_H +#include <locale.h> +#endif + +#ifdef WITH_IDN +#include <idn/result.h> +#include <idn/log.h> +#include <idn/resconf.h> +#include <idn/api.h> +#endif + #include <isc/app.h> #include <isc/commandline.h> #include <isc/netaddr.h> @@ -414,8 +426,10 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) { if (msg->rcode != 0) { char namestr[DNS_NAME_FORMATSIZE]; dns_name_format(query->lookup->name, namestr, sizeof(namestr)); - printf("Host %s not found: %d(%s)\n", namestr, - msg->rcode, rcodetext[msg->rcode]); + printf("Host %s not found: %d(%s)\n", + (msg->rcode != dns_rcode_nxdomain) ? namestr : + query->lookup->textname, msg->rcode, + rcodetext[msg->rcode]); return (ISC_R_SUCCESS); } @@ -664,6 +678,9 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { lookup->rdtype != dns_rdatatype_axfr) lookup->rdtype = rdtype; lookup->rdtypeset = ISC_TRUE; +#ifdef WITH_IDN + idnoptions = 0; +#endif if (rdtype == dns_rdatatype_axfr) { /* -l -t any -v */ list_type = dns_rdatatype_any; @@ -672,6 +689,13 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { } else if (rdtype == dns_rdatatype_ixfr) { lookup->ixfr_serial = serial; list_type = rdtype; +#ifdef WITH_IDN + } else if (rdtype == dns_rdatatype_a || + rdtype == dns_rdatatype_aaaa || + rdtype == dns_rdatatype_mx) { + idnoptions = IDN_ASCCHECK; + list_type = rdtype; +#endif } else list_type = rdtype; list_addresses = ISC_FALSE; @@ -814,6 +838,9 @@ main(int argc, char **argv) { ISC_LIST_INIT(search_list); fatalexit = 1; +#ifdef WITH_IDN + idnoptions = IDN_ASCCHECK; +#endif debug("main()"); progname = argv[0]; diff --git a/bin/dig/host.docbook b/bin/dig/host.docbook index 09a306c3..1b4b62b4 100644 --- a/bin/dig/host.docbook +++ b/bin/dig/host.docbook @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: host.docbook,v 1.5.18.9 2007/01/29 23:57:20 marka Exp $ --> +<!-- $Id: host.docbook,v 1.5.18.10 2007/05/09 01:38:19 marka Exp $ --> <refentry id="man.host"> <refentryinfo> @@ -173,7 +173,7 @@ attempt to resolve <parameter>name</parameter>. The <option>-r</option> option enables <command>host</command> to mimic - the behaviour of a name server by making non-recursive queries and + the behavior of a name server by making non-recursive queries and expecting to receive answers to those queries that are usually referrals to other name servers. </para> @@ -194,7 +194,7 @@ <para> The <option>-t</option> option is used to select the query type. - <parameter>type</parameter> can be any recognised query + <parameter>type</parameter> can be any recognized query type: CNAME, NS, SOA, SIG, KEY, AXFR, etc. When no query type is specified, <command>host</command> automatically selects an appropriate @@ -227,7 +227,7 @@ The <option>-s</option> option tells <command>host</command> <emphasis>not</emphasis> to send the query to the next nameserver if any server responds with a SERVFAIL response, which is the - reverse of normal stub resolver behaviour. + reverse of normal stub resolver behavior. </para> <para> diff --git a/bin/dig/host.html b/bin/dig/host.html index b370769b..adc9883a 100644 --- a/bin/dig/host.html +++ b/bin/dig/host.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: host.html,v 1.7.18.19 2007/01/30 00:23:44 marka Exp $ --> +<!-- $Id: host.html,v 1.7.18.20 2007/05/09 03:33:12 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -125,7 +125,7 @@ attempt to resolve <em class="parameter"><code>name</code></em>. The <code class="option">-r</code> option enables <span><strong class="command">host</strong></span> to mimic - the behaviour of a name server by making non-recursive queries and + the behavior of a name server by making non-recursive queries and expecting to receive answers to those queries that are usually referrals to other name servers. </p> @@ -143,7 +143,7 @@ </p> <p> The <code class="option">-t</code> option is used to select the query type. - <em class="parameter"><code>type</code></em> can be any recognised query + <em class="parameter"><code>type</code></em> can be any recognized query type: CNAME, NS, SOA, SIG, KEY, AXFR, etc. When no query type is specified, <span><strong class="command">host</strong></span> automatically selects an appropriate @@ -174,7 +174,7 @@ The <code class="option">-s</code> option tells <span><strong class="command">host</strong></span> <span class="emphasis"><em>not</em></span> to send the query to the next nameserver if any server responds with a SERVFAIL response, which is the - reverse of normal stub resolver behaviour. + reverse of normal stub resolver behavior. </p> <p> The <code class="option">-m</code> can be used to set the memory usage debugging diff --git a/bin/dig/include/dig/dig.h b/bin/dig/include/dig/dig.h index 675bb155..9afa42bf 100644 --- a/bin/dig/include/dig/dig.h +++ b/bin/dig/include/dig/dig.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000-2003 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dig.h,v 1.82.18.19 2006/12/07 06:08:02 marka Exp $ */ +/* $Id: dig.h,v 1.82.18.22 2007/04/24 06:49:52 each Exp $ */ #ifndef DIG_H #define DIG_H @@ -277,6 +277,9 @@ extern isc_boolean_t debugging, memdebugging; extern char *progname; extern int tries; extern int fatalexit; +#ifdef WITH_IDN +extern int idnoptions; +#endif /* * Routines in dighost.c. @@ -301,6 +304,9 @@ void setup_lookup(dig_lookup_t *lookup); void +destroy_lookup(dig_lookup_t *lookup); + +void do_lookup(dig_lookup_t *lookup); void diff --git a/bin/dig/nslookup.1 b/bin/dig/nslookup.1 index f941e9b6..a453c2fd 100644 --- a/bin/dig/nslookup.1 +++ b/bin/dig/nslookup.1 @@ -12,7 +12,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: nslookup.1,v 1.1.10.12 2007/01/30 00:23:44 marka Exp $ +.\" $Id: nslookup.1,v 1.1.10.14 2007/05/16 06:11:27 marka Exp $ .\" .hy 0 .ad l @@ -158,7 +158,7 @@ The class specifies the protocol group of the information. .PP \fB \fR\fB\fI[no]\fR\fR\fBdebug\fR .RS 4 -Turn debugging mode on. A lot more information is printed about the packet sent to the server and the resulting answer. +Turn on or off the display of the full response packet and any intermediate response packets when searching. .sp (Default = nodebug; abbreviation = [no]deb) @@ -166,7 +166,7 @@ Turn debugging mode on. A lot more information is printed about the packet sent .PP \fB \fR\fB\fI[no]\fR\fR\fBd2\fR .RS 4 -Turn debugging mode on. A lot more information is printed about the packet sent to the server and the resulting answer. +Turn debugging mode on or off. This displays more about what nslookup is doing. .sp (Default = nod2) .RE diff --git a/bin/dig/nslookup.c b/bin/dig/nslookup.c index e2310af0..6a4f8459 100644 --- a/bin/dig/nslookup.c +++ b/bin/dig/nslookup.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000-2003 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: nslookup.c,v 1.101.18.12 2006/12/07 06:08:02 marka Exp $ */ +/* $Id: nslookup.c,v 1.101.18.14 2007/04/24 23:46:25 tbox Exp $ */ #include <config.h> @@ -410,8 +410,9 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) { char nametext[DNS_NAME_FORMATSIZE]; dns_name_format(query->lookup->name, nametext, sizeof(nametext)); - printf("** server can't find %s: %s\n", nametext, - rcodetext[msg->rcode]); + printf("** server can't find %s: %s\n", + (msg->rcode != dns_rcode_nxdomain) ? nametext : + query->lookup->textname, rcodetext[msg->rcode]); debug("returning with rcode == 0"); return (ISC_R_SUCCESS); } diff --git a/bin/dig/nslookup.docbook b/bin/dig/nslookup.docbook index c989b73b..075ec0e4 100644 --- a/bin/dig/nslookup.docbook +++ b/bin/dig/nslookup.docbook @@ -17,7 +17,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: nslookup.docbook,v 1.4.2.10 2007/01/29 23:57:20 marka Exp $ --> +<!-- $Id: nslookup.docbook,v 1.4.2.12 2007/05/16 01:45:30 marka Exp $ --> <!-- - Copyright (c) 1985, 1989 - The Regents of the University of California. All rights reserved. @@ -314,9 +314,8 @@ nslookup -query=hinfo -timeout=10 <replaceable><optional>no</optional></replaceable>debug</constant></term> <listitem> <para> - Turn debugging mode on. A lot more information is - printed about the packet sent to the server and the - resulting answer. + Turn on or off the display of the full response packet and + any intermediate response packets when searching. </para> <para> (Default = nodebug; abbreviation = <optional>no</optional>deb) @@ -329,9 +328,8 @@ nslookup -query=hinfo -timeout=10 <replaceable><optional>no</optional></replaceable>d2</constant></term> <listitem> <para> - Turn debugging mode on. A lot more information is - printed about the packet sent to the server and the - resulting answer. + Turn debugging mode on or off. This displays more about + what nslookup is doing. </para> <para> (Default = nod2) diff --git a/bin/dig/nslookup.html b/bin/dig/nslookup.html index 07f8c3e4..46ae43cc 100644 --- a/bin/dig/nslookup.html +++ b/bin/dig/nslookup.html @@ -13,7 +13,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: nslookup.html,v 1.1.10.19 2007/01/30 00:23:44 marka Exp $ --> +<!-- $Id: nslookup.html,v 1.1.10.21 2007/05/16 06:11:27 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -180,9 +180,8 @@ nslookup -query=hinfo -timeout=10 <em class="replaceable"><code>[<span class="optional">no</span>]</code></em>debug</code></span></dt> <dd> <p> - Turn debugging mode on. A lot more information is - printed about the packet sent to the server and the - resulting answer. + Turn on or off the display of the full response packet and + any intermediate response packets when searching. </p> <p> (Default = nodebug; abbreviation = [<span class="optional">no</span>]deb) @@ -192,9 +191,8 @@ nslookup -query=hinfo -timeout=10 <em class="replaceable"><code>[<span class="optional">no</span>]</code></em>d2</code></span></dt> <dd> <p> - Turn debugging mode on. A lot more information is - printed about the packet sent to the server and the - resulting answer. + Turn debugging mode on or off. This displays more about + what nslookup is doing. </p> <p> (Default = nod2) diff --git a/bin/dnssec/dnssec-keygen.8 b/bin/dnssec/dnssec-keygen.8 index 39762fd8..542190b9 100644 --- a/bin/dnssec/dnssec-keygen.8 +++ b/bin/dnssec/dnssec-keygen.8 @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dnssec-keygen.8,v 1.23.18.13 2007/01/30 00:23:44 marka Exp $ +.\" $Id: dnssec-keygen.8,v 1.23.18.14 2007/05/09 03:33:12 marka Exp $ .\" .hy 0 .ad l @@ -37,7 +37,7 @@ dnssec\-keygen \- DNSSEC key generation tool .SH "DESCRIPTION" .PP \fBdnssec\-keygen\fR -generates keys for DNSSEC (Secure DNS), as defined in RFC 2535 and RFC <TBA\\>. It can also generate keys for use with TSIG (Transaction Signatures), as defined in RFC 2845. +generates keys for DNSSEC (Secure DNS), as defined in RFC 2535 and RFC 4034. It can also generate keys for use with TSIG (Transaction Signatures), as defined in RFC 2845. .SH "OPTIONS" .PP \-a \fIalgorithm\fR @@ -147,7 +147,7 @@ is the numeric representation of the algorithm. is the key identifier (or footprint). .PP \fBdnssec\-keygen\fR -creates two file, with names based on the printed string. +creates two files, with names based on the printed string. \fIKnnnn.+aaa+iiiii.key\fR contains the public key, and \fIKnnnn.+aaa+iiiii.private\fR @@ -159,13 +159,13 @@ file contains a DNS KEY record that can be inserted into a zone file (directly o .PP The \fI.private\fR -file contains algorithm specific fields. For obvious security reasons, this file does not have general read permission. +file contains algorithm\-specific fields. For obvious security reasons, this file does not have general read permission. .PP Both \fI.key\fR and \fI.private\fR -files are generated for symmetric encryption algorithm such as HMAC\-MD5, even though the public and private key are equivalent. +files are generated for symmetric encryption algorithms such as HMAC\-MD5, even though the public and private key are equivalent. .SH "EXAMPLE" .PP To generate a 768\-bit DSA key for the domain @@ -182,7 +182,7 @@ In this example, creates the files \fIKexample.com.+003+26160.key\fR and -\fIKexample.com.+003+26160.private\fR +\fIKexample.com.+003+26160.private\fR. .SH "SEE ALSO" .PP \fBdnssec\-signzone\fR(8), diff --git a/bin/dnssec/dnssec-keygen.docbook b/bin/dnssec/dnssec-keygen.docbook index cc5f1e77..ec04eb78 100644 --- a/bin/dnssec/dnssec-keygen.docbook +++ b/bin/dnssec/dnssec-keygen.docbook @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: dnssec-keygen.docbook,v 1.7.18.9 2007/01/29 23:57:20 marka Exp $ --> +<!-- $Id: dnssec-keygen.docbook,v 1.7.18.10 2007/05/09 01:38:19 marka Exp $ --> <refentry id="man.dnssec-keygen"> <refentryinfo> <date>June 30, 2000</date> @@ -76,7 +76,7 @@ <title>DESCRIPTION</title> <para><command>dnssec-keygen</command> generates keys for DNSSEC (Secure DNS), as defined in RFC 2535 - and RFC <TBA\>. It can also generate keys for use with + and RFC 4034. It can also generate keys for use with TSIG (Transaction Signatures), as defined in RFC 2845. </para> </refsect1> @@ -286,7 +286,7 @@ </listitem> </itemizedlist> <para><command>dnssec-keygen</command> - creates two file, with names based + creates two files, with names based on the printed string. <filename>Knnnn.+aaa+iiiii.key</filename> contains the public key, and <filename>Knnnn.+aaa+iiiii.private</filename> contains the @@ -300,14 +300,14 @@ statement). </para> <para> - The <filename>.private</filename> file contains algorithm - specific + The <filename>.private</filename> file contains + algorithm-specific fields. For obvious security reasons, this file does not have general read permission. </para> <para> Both <filename>.key</filename> and <filename>.private</filename> - files are generated for symmetric encryption algorithm such as + files are generated for symmetric encryption algorithms such as HMAC-MD5, even though the public and private key are equivalent. </para> </refsect1> @@ -330,7 +330,7 @@ In this example, <command>dnssec-keygen</command> creates the files <filename>Kexample.com.+003+26160.key</filename> and - <filename>Kexample.com.+003+26160.private</filename> + <filename>Kexample.com.+003+26160.private</filename>. </para> </refsect1> diff --git a/bin/dnssec/dnssec-keygen.html b/bin/dnssec/dnssec-keygen.html index 52298689..7ad747f2 100644 --- a/bin/dnssec/dnssec-keygen.html +++ b/bin/dnssec/dnssec-keygen.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: dnssec-keygen.html,v 1.9.18.19 2007/01/30 00:23:44 marka Exp $ --> +<!-- $Id: dnssec-keygen.html,v 1.9.18.20 2007/05/09 03:33:12 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -35,7 +35,7 @@ <a name="id2543474"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">dnssec-keygen</strong></span> generates keys for DNSSEC (Secure DNS), as defined in RFC 2535 - and RFC <TBA\>. It can also generate keys for use with + and RFC 4034. It can also generate keys for use with TSIG (Transaction Signatures), as defined in RFC 2845. </p> </div> @@ -168,7 +168,7 @@ </p></li> </ul></div> <p><span><strong class="command">dnssec-keygen</strong></span> - creates two file, with names based + creates two files, with names based on the printed string. <code class="filename">Knnnn.+aaa+iiiii.key</code> contains the public key, and <code class="filename">Knnnn.+aaa+iiiii.private</code> contains the @@ -182,14 +182,14 @@ statement). </p> <p> - The <code class="filename">.private</code> file contains algorithm - specific + The <code class="filename">.private</code> file contains + algorithm-specific fields. For obvious security reasons, this file does not have general read permission. </p> <p> Both <code class="filename">.key</code> and <code class="filename">.private</code> - files are generated for symmetric encryption algorithm such as + files are generated for symmetric encryption algorithms such as HMAC-MD5, even though the public and private key are equivalent. </p> </div> @@ -211,7 +211,7 @@ In this example, <span><strong class="command">dnssec-keygen</strong></span> creates the files <code class="filename">Kexample.com.+003+26160.key</code> and - <code class="filename">Kexample.com.+003+26160.private</code> + <code class="filename">Kexample.com.+003+26160.private</code>. </p> </div> <div class="refsect1" lang="en"> diff --git a/bin/dnssec/dnssec-signzone.8 b/bin/dnssec/dnssec-signzone.8 index 86347b1f..d150c3fc 100644 --- a/bin/dnssec/dnssec-signzone.8 +++ b/bin/dnssec/dnssec-signzone.8 @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dnssec-signzone.8,v 1.28.18.16 2007/01/30 00:23:44 marka Exp $ +.\" $Id: dnssec-signzone.8,v 1.28.18.17 2007/05/09 03:33:12 marka Exp $ .\" .hy 0 .ad l @@ -95,7 +95,7 @@ is specified, 30 days from the start time is used as a default. .RS 4 The name of the output file containing the signed zone. The default is to append \fI.signed\fR -to the input file. +to the input filename. .RE .PP \-h @@ -106,7 +106,7 @@ Prints a short summary of the options and arguments to .PP \-i \fIinterval\fR .RS 4 -When a previously signed zone is passed as input, records may be resigned. The +When a previously\-signed zone is passed as input, records may be resigned. The \fBinterval\fR option specifies the cycle interval as an offset from the current time (in seconds). If a RRSIG record expires after the cycle interval, it is retained. Otherwise, it is considered to be expiring soon, and it will be replaced. .sp @@ -129,7 +129,7 @@ The format of the input zone file. Possible formats are .PP \-j \fIjitter\fR .RS 4 -When signing a zone with a fixed signature lifetime, all RRSIG records issued at the time of signing expires simultaneously. If the zone is incrementally signed, i.e. a previously signed zone is passed as input to the signer, all expired signatures has to be regenerated at about the same time. The +When signing a zone with a fixed signature lifetime, all RRSIG records issued at the time of signing expires simultaneously. If the zone is incrementally signed, i.e. a previously\-signed zone is passed as input to the signer, all expired signatures have to be regenerated at about the same time. The \fBjitter\fR option specifies a jitter window that will be used to randomize the signature expire time, thus spreading incremental signature regeneration over time. .sp @@ -219,29 +219,44 @@ The file containing the zone to be signed. .PP key .RS 4 -The keys used to sign the zone. If no keys are specified, the default all zone keys that have private key files in the current directory. +Specify which keys should be used to sign the zone. If no keys are specified, then the zone will be examined for DNSKEY records at the zone apex. If these are found and there are matching private keys, in the current directory, then these will be used for signing. .RE .SH "EXAMPLE" .PP The following command signs the \fBexample.com\fR -zone with the DSA key generated in the +zone with the DSA key generated by \fBdnssec\-keygen\fR -man page. The zone's keys must be in the zone. If there are +(Kexample.com.+003+17247). The zone's keys must be in the master file (\fIdb.example.com\fR). This invocation looks for \fIkeyset\fR -files associated with child zones, they must be in the current directory. -\fBexample.com\fR, the following command would be issued: -.PP -\fBdnssec\-signzone \-o example.com db.example.com Kexample.com.+003+26160\fR -.PP -The command would print a string of the form: +files, in the current directory, so that DS records can be generated from them (\fB\-g\fR). +.sp +.RS 4 +.nf +% dnssec\-signzone \-g \-o example.com db.example.com \\ +Kexample.com.+003+17247 +db.example.com.signed +% +.fi +.RE .PP -In this example, +In the above example, \fBdnssec\-signzone\fR creates the file \fIdb.example.com.signed\fR. This file should be referenced in a zone statement in a \fInamed.conf\fR file. +.PP +This example re\-signs a previously signed zone with default parameters. The private keys are assumed to be in the current directory. +.sp +.RS 4 +.nf +% cp db.example.com.signed db.example.com +% dnssec\-signzone \-o example.com db.example.com +db.example.com.signed +% +.fi +.RE .SH "SEE ALSO" .PP \fBdnssec\-keygen\fR(8), diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c index 1f5b5384..cea6719e 100644 --- a/bin/dnssec/dnssec-signzone.c +++ b/bin/dnssec/dnssec-signzone.c @@ -1,5 +1,5 @@ /* - * Portions Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Portions Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Portions Copyright (C) 1999-2003 Internet Software Consortium. * Portions Copyright (C) 1995-2000 by Network Associates, Inc. * @@ -16,7 +16,7 @@ * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dnssec-signzone.c,v 1.177.18.21 2006/08/30 23:01:54 marka Exp $ */ +/* $Id: dnssec-signzone.c,v 1.177.18.23 2007/05/18 23:46:28 tbox Exp $ */ /*! \file */ @@ -1481,7 +1481,7 @@ loadzonekeys(dns_db_t *db) { for (i = 0; i < nkeys; i++) { signer_key_t *key; - key = newkeystruct(keys[i], ISC_TRUE); + key = newkeystruct(keys[i], dst_key_isprivate(keys[i])); ISC_LIST_APPEND(keylist, key, link); } dns_db_detachnode(db, &node); diff --git a/bin/dnssec/dnssec-signzone.docbook b/bin/dnssec/dnssec-signzone.docbook index 371d72bd..59a73073 100644 --- a/bin/dnssec/dnssec-signzone.docbook +++ b/bin/dnssec/dnssec-signzone.docbook @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: dnssec-signzone.docbook,v 1.10.18.15 2007/01/29 23:57:20 marka Exp $ --> +<!-- $Id: dnssec-signzone.docbook,v 1.10.18.16 2007/05/09 01:38:19 marka Exp $ --> <refentry id="man.dnssec-signzone"> <refentryinfo> <date>June 30, 2000</date> @@ -193,7 +193,7 @@ The name of the output file containing the signed zone. The default is to append <filename>.signed</filename> to the - input file. + input filename. </para> </listitem> </varlistentry> @@ -212,7 +212,7 @@ <term>-i <replaceable class="parameter">interval</replaceable></term> <listitem> <para> - When a previously signed zone is passed as input, records + When a previously-signed zone is passed as input, records may be resigned. The <option>interval</option> option specifies the cycle interval as an offset from the current time (in seconds). If a RRSIG record expires after the @@ -256,8 +256,8 @@ When signing a zone with a fixed signature lifetime, all RRSIG records issued at the time of signing expires simultaneously. If the zone is incrementally signed, i.e. - a previously signed zone is passed as input to the signer, - all expired signatures has to be regenerated at about the + a previously-signed zone is passed as input to the signer, + all expired signatures have to be regenerated at about the same time. The <option>jitter</option> option specifies a jitter window that will be used to randomize the signature expire time, thus spreading incremental signature @@ -411,9 +411,11 @@ <term>key</term> <listitem> <para> - The keys used to sign the zone. If no keys are specified, the - default all zone keys that have private key files in the - current directory. + Specify which keys should be used to sign the zone. If + no keys are specified, then the zone will be examined + for DNSKEY records at the zone apex. If these are found and + there are matching private keys, in the current directory, + then these will be used for signing. </para> </listitem> </varlistentry> @@ -425,27 +427,30 @@ <title>EXAMPLE</title> <para> The following command signs the <userinput>example.com</userinput> - zone with the DSA key generated in the <command>dnssec-keygen</command> - man page. The zone's keys must be in the zone. If there are - <filename>keyset</filename> files associated with child - zones, - they must be in the current directory. - <userinput>example.com</userinput>, the following command would be - issued: - </para> - <para><userinput>dnssec-signzone -o example.com db.example.com - Kexample.com.+003+26160</userinput> - </para> - <para> - The command would print a string of the form: + zone with the DSA key generated by <command>dnssec-keygen</command> + (Kexample.com.+003+17247). The zone's keys must be in the master + file (<filename>db.example.com</filename>). This invocation looks + for <filename>keyset</filename> files, in the current directory, + so that DS records can be generated from them (<command>-g</command>). </para> +<programlisting>% dnssec-signzone -g -o example.com db.example.com \ +Kexample.com.+003+17247 +db.example.com.signed +%</programlisting> <para> - In this example, <command>dnssec-signzone</command> creates + In the above example, <command>dnssec-signzone</command> creates the file <filename>db.example.com.signed</filename>. This - file - should be referenced in a zone statement in a + file should be referenced in a zone statement in a <filename>named.conf</filename> file. </para> + <para> + This example re-signs a previously signed zone with default parameters. + The private keys are assumed to be in the current directory. + </para> +<programlisting>% cp db.example.com.signed db.example.com +% dnssec-signzone -o example.com db.example.com +db.example.com.signed +%</programlisting> </refsect1> <refsect1> diff --git a/bin/dnssec/dnssec-signzone.html b/bin/dnssec/dnssec-signzone.html index da1e058c..e794d4c6 100644 --- a/bin/dnssec/dnssec-signzone.html +++ b/bin/dnssec/dnssec-signzone.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: dnssec-signzone.html,v 1.8.18.22 2007/01/30 00:23:44 marka Exp $ --> +<!-- $Id: dnssec-signzone.html,v 1.8.18.23 2007/05/09 03:33:12 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -99,7 +99,7 @@ The name of the output file containing the signed zone. The default is to append <code class="filename">.signed</code> to the - input file. + input filename. </p></dd> <dt><span class="term">-h</span></dt> <dd><p> @@ -109,7 +109,7 @@ <dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt> <dd> <p> - When a previously signed zone is passed as input, records + When a previously-signed zone is passed as input, records may be resigned. The <code class="option">interval</code> option specifies the cycle interval as an offset from the current time (in seconds). If a RRSIG record expires after the @@ -145,8 +145,8 @@ When signing a zone with a fixed signature lifetime, all RRSIG records issued at the time of signing expires simultaneously. If the zone is incrementally signed, i.e. - a previously signed zone is passed as input to the signer, - all expired signatures has to be regenerated at about the + a previously-signed zone is passed as input to the signer, + all expired signatures have to be regenerated at about the same time. The <code class="option">jitter</code> option specifies a jitter window that will be used to randomize the signature expire time, thus spreading incremental signature @@ -232,9 +232,11 @@ </p></dd> <dt><span class="term">key</span></dt> <dd><p> - The keys used to sign the zone. If no keys are specified, the - default all zone keys that have private key files in the - current directory. + Specify which keys should be used to sign the zone. If + no keys are specified, then the zone will be examined + for DNSKEY records at the zone apex. If these are found and + there are matching private keys, in the current directory, + then these will be used for signing. </p></dd> </dl></div> </div> @@ -242,37 +244,40 @@ <a name="id2544327"></a><h2>EXAMPLE</h2> <p> The following command signs the <strong class="userinput"><code>example.com</code></strong> - zone with the DSA key generated in the <span><strong class="command">dnssec-keygen</strong></span> - man page. The zone's keys must be in the zone. If there are - <code class="filename">keyset</code> files associated with child - zones, - they must be in the current directory. - <strong class="userinput"><code>example.com</code></strong>, the following command would be - issued: - </p> -<p><strong class="userinput"><code>dnssec-signzone -o example.com db.example.com - Kexample.com.+003+26160</code></strong> - </p> -<p> - The command would print a string of the form: + zone with the DSA key generated by <span><strong class="command">dnssec-keygen</strong></span> + (Kexample.com.+003+17247). The zone's keys must be in the master + file (<code class="filename">db.example.com</code>). This invocation looks + for <code class="filename">keyset</code> files, in the current directory, + so that DS records can be generated from them (<span><strong class="command">-g</strong></span>). </p> +<pre class="programlisting">% dnssec-signzone -g -o example.com db.example.com \ +Kexample.com.+003+17247 +db.example.com.signed +%</pre> <p> - In this example, <span><strong class="command">dnssec-signzone</strong></span> creates + In the above example, <span><strong class="command">dnssec-signzone</strong></span> creates the file <code class="filename">db.example.com.signed</code>. This - file - should be referenced in a zone statement in a + file should be referenced in a zone statement in a <code class="filename">named.conf</code> file. </p> +<p> + This example re-signs a previously signed zone with default parameters. + The private keys are assumed to be in the current directory. + </p> +<pre class="programlisting">% cp db.example.com.signed db.example.com +% dnssec-signzone -o example.com db.example.com +db.example.com.signed +%</pre> </div> <div class="refsect1" lang="en"> -<a name="id2544375"></a><h2>SEE ALSO</h2> +<a name="id2544378"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>, <em class="citetitle">BIND 9 Administrator Reference Manual</em>, <em class="citetitle">RFC 2535</em>. </p> </div> <div class="refsect1" lang="en"> -<a name="id2544400"></a><h2>AUTHOR</h2> +<a name="id2544403"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/bin/named/client.c b/bin/named/client.c index d69e44b8..c4dadad8 100644 --- a/bin/named/client.c +++ b/bin/named/client.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: client.c,v 1.219.18.20 2006/07/22 01:02:36 marka Exp $ */ +/* $Id: client.c,v 1.219.18.26 2007/06/26 02:56:59 marka Exp $ */ #include <config.h> @@ -1180,7 +1180,7 @@ client_addopt(ns_client_t *client) { rdatalist->ttl = (client->extflags & DNS_MESSAGEEXTFLAG_REPLYPRESERVE); /* - * No ENDS options in the default case. + * No EDNS options in the default case. */ rdata->data = NULL; rdata->length = 0; @@ -1226,7 +1226,8 @@ ns_client_isself(dns_view_t *myview, dns_tsigkey_t *mykey, dns_rdataclass_t rdclass, void *arg) { dns_view_t *view; - dns_tsigkey_t *key; + dns_tsigkey_t *key = NULL; + dns_name_t *tsig = NULL; isc_netaddr_t netsrc; isc_netaddr_t netdst; @@ -1241,7 +1242,6 @@ ns_client_isself(dns_view_t *myview, dns_tsigkey_t *mykey, for (view = ISC_LIST_HEAD(ns_g_server->viewlist); view != NULL; view = ISC_LIST_NEXT(view, link)) { - dns_name_t *tsig = NULL; if (view->matchrecursiveonly) continue; @@ -1440,6 +1440,14 @@ client_request(isc_task_t *task, isc_event_t *event) { } /* + * Hash the incoming request here as it is after + * dns_dispatch_importrecv(). + */ + dns_dispatch_hash(&client->now, sizeof(client->now)); + dns_dispatch_hash(isc_buffer_base(buffer), + isc_buffer_usedlength(buffer)); + + /* * It's a request. Parse it. */ result = dns_message_parse(client->message, buffer, 0); @@ -1576,6 +1584,7 @@ client_request(isc_task_t *task, isc_event_t *event) { "failed to get request's " "destination: %s", isc_result_totext(result)); + ns_client_next(client, ISC_R_SUCCESS); goto cleanup; } } diff --git a/bin/named/config.c b/bin/named/config.c index 6a6d5e3e..0d3a5dfb 100644 --- a/bin/named/config.c +++ b/bin/named/config.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2001-2003 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: config.c,v 1.47.18.28 2006/05/03 01:46:40 marka Exp $ */ +/* $Id: config.c,v 1.47.18.30 2007/06/18 23:46:32 tbox Exp $ */ /*! \file */ @@ -182,7 +182,7 @@ options {\n\ " "#\n\ -# Zones in the \"_bind\" view are NOT counted is the count of zones.\n\ +# Zones in the \"_bind\" view are NOT counted in the count of zones.\n\ #\n\ view \"_bind\" chaos {\n\ recursion no;\n\ diff --git a/bin/named/lwresd.8 b/bin/named/lwresd.8 index 7275d292..825645aa 100644 --- a/bin/named/lwresd.8 +++ b/bin/named/lwresd.8 @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: lwresd.8,v 1.15.18.10 2007/01/30 00:23:44 marka Exp $ +.\" $Id: lwresd.8,v 1.15.18.12 2007/05/16 06:11:27 marka Exp $ .\" .hy 0 .ad l @@ -33,7 +33,7 @@ lwresd \- lightweight resolver daemon .SH "SYNOPSIS" .HP 7 -\fBlwresd\fR [\fB\-C\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-d\ \fR\fB\fIdebug\-level\fR\fR] [\fB\-f\fR] [\fB\-g\fR] [\fB\-i\ \fR\fB\fIpid\-file\fR\fR] [\fB\-n\ \fR\fB\fI#cpus\fR\fR] [\fB\-P\ \fR\fB\fIport\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR] [\fB\-v\fR] +\fBlwresd\fR [\fB\-c\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-C\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-d\ \fR\fB\fIdebug\-level\fR\fR] [\fB\-f\fR] [\fB\-g\fR] [\fB\-i\ \fR\fB\fIpid\-file\fR\fR] [\fB\-m\ \fR\fB\fIflag\fR\fR] [\fB\-n\ \fR\fB\fI#cpus\fR\fR] [\fB\-P\ \fR\fB\fIport\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR] [\fB\-v\fR] [\fB\-4\fR] [\fB\-6\fR] .SH "DESCRIPTION" .PP \fBlwresd\fR @@ -61,12 +61,44 @@ entries are present, or if forwarding fails, resolves the queries autonomously starting at the root name servers, using a built\-in list of root server hints. .SH "OPTIONS" .PP +\-4 +.RS 4 +Use IPv4 only even if the host machine is capable of IPv6. +\fB\-4\fR +and +\fB\-6\fR +are mutually exclusive. +.RE +.PP +\-6 +.RS 4 +Use IPv6 only even if the host machine is capable of IPv4. +\fB\-4\fR +and +\fB\-6\fR +are mutually exclusive. +.RE +.PP +\-c \fIconfig\-file\fR +.RS 4 +Use +\fIconfig\-file\fR +as the configuration file instead of the default, +\fI/etc/lwresd.conf\fR. +<term>\-c</term> +can not be used with +<term>\-C</term>. +.RE +.PP \-C \fIconfig\-file\fR .RS 4 Use \fIconfig\-file\fR as the configuration file instead of the default, \fI/etc/resolv.conf\fR. +<term>\-C</term> +can not be used with +<term>\-c</term>. .RE .PP \-d \fIdebug\-level\fR @@ -88,6 +120,25 @@ Run the server in the foreground and force all logging to \fIstderr\fR. .RE .PP +\-i \fIpid\-file\fR +.RS 4 +Use +\fIpid\-file\fR +as the PID file instead of the default, +\fI/var/run/lwresd.pid\fR. +.RE +.PP +\-m \fIflag\fR +.RS 4 +Turn on memory usage debugging flags. Possible flags are +\fIusage\fR, +\fItrace\fR, +\fIrecord\fR, +\fIsize\fR, and +\fImctx\fR. These correspond to the ISC_MEM_DEBUGXXXX flags described in +\fI<isc/mem.h>\fR. +.RE +.PP \-n \fI#cpus\fR .RS 4 Create @@ -122,8 +173,7 @@ This option is mainly of interest to BIND 9 developers and may be removed or cha .PP \-t \fIdirectory\fR .RS 4 -\fBchroot()\fR -to +Chroot to \fIdirectory\fR after processing the command line arguments, but before reading the configuration file. .RS @@ -131,15 +181,14 @@ after processing the command line arguments, but before reading the configuratio This option should be used in conjunction with the \fB\-u\fR option, as chrooting a process running as root doesn't enhance security on most systems; the way -\fBchroot()\fR +\fBchroot(2)\fR is defined allows a process with root privileges to escape a chroot jail. .RE .RE .PP \-u \fIuser\fR .RS 4 -\fBsetuid()\fR -to +Setuid to \fIuser\fR after completing privileged operations, such as creating sockets that listen on privileged ports. .RE diff --git a/bin/named/lwresd.docbook b/bin/named/lwresd.docbook index d1eabfa0..9a6b893b 100644 --- a/bin/named/lwresd.docbook +++ b/bin/named/lwresd.docbook @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: lwresd.docbook,v 1.7.18.5 2007/01/29 23:57:20 marka Exp $ --> +<!-- $Id: lwresd.docbook,v 1.7.18.7 2007/05/16 01:45:31 marka Exp $ --> <refentry> <refentryinfo> <date>June 30, 2000</date> @@ -52,11 +52,13 @@ <refsynopsisdiv> <cmdsynopsis> <command>lwresd</command> + <arg><option>-c <replaceable class="parameter">config-file</replaceable></option></arg> <arg><option>-C <replaceable class="parameter">config-file</replaceable></option></arg> <arg><option>-d <replaceable class="parameter">debug-level</replaceable></option></arg> <arg><option>-f</option></arg> <arg><option>-g</option></arg> <arg><option>-i <replaceable class="parameter">pid-file</replaceable></option></arg> + <arg><option>-m <replaceable class="parameter">flag</replaceable></option></arg> <arg><option>-n <replaceable class="parameter">#cpus</replaceable></option></arg> <arg><option>-P <replaceable class="parameter">port</replaceable></option></arg> <arg><option>-p <replaceable class="parameter">port</replaceable></option></arg> @@ -64,6 +66,8 @@ <arg><option>-t <replaceable class="parameter">directory</replaceable></option></arg> <arg><option>-u <replaceable class="parameter">user</replaceable></option></arg> <arg><option>-v</option></arg> + <arg><option>-4</option></arg> + <arg><option>-6</option></arg> </cmdsynopsis> </refsynopsisdiv> @@ -109,6 +113,43 @@ <title>OPTIONS</title> <variablelist> + + <varlistentry> + <term>-4</term> + <listitem> + <para> + Use IPv4 only even if the host machine is capable of IPv6. + <option>-4</option> and <option>-6</option> are mutually + exclusive. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term>-6</term> + <listitem> + <para> + Use IPv6 only even if the host machine is capable of IPv4. + <option>-4</option> and <option>-6</option> are mutually + exclusive. + </para> + </listitem> + </varlistentry> + + <!-- this is in source but not mentioned? does this matter? --> + <varlistentry> + <term>-c <replaceable class="parameter">config-file</replaceable></term> + <listitem> + <para> + Use <replaceable class="parameter">config-file</replaceable> as the + configuration file instead of the default, + <filename>/etc/lwresd.conf</filename>. + <!-- Should this be an absolute path name? --> + <term>-c</term> can not be used with <term>-C</term>. + </para> + </listitem> + </varlistentry> + <varlistentry> <term>-C <replaceable class="parameter">config-file</replaceable></term> <listitem> @@ -116,6 +157,7 @@ Use <replaceable class="parameter">config-file</replaceable> as the configuration file instead of the default, <filename>/etc/resolv.conf</filename>. + <term>-C</term> can not be used with <term>-c</term>. </para> </listitem> </varlistentry> @@ -151,6 +193,33 @@ </varlistentry> <varlistentry> + <term>-i <replaceable class="parameter">pid-file</replaceable></term> + <listitem> + <para> + Use <replaceable class="parameter">pid-file</replaceable> as the + PID file instead of the default, + <filename>/var/run/lwresd.pid</filename>. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term>-m <replaceable class="parameter">flag</replaceable></term> + <listitem> + <para> + Turn on memory usage debugging flags. Possible flags are + <replaceable class="parameter">usage</replaceable>, + <replaceable class="parameter">trace</replaceable>, + <replaceable class="parameter">record</replaceable>, + <replaceable class="parameter">size</replaceable>, and + <replaceable class="parameter">mctx</replaceable>. + These correspond to the ISC_MEM_DEBUGXXXX flags described in + <filename><isc/mem.h></filename>. + </para> + </listitem> + </varlistentry> + + <varlistentry> <term>-n <replaceable class="parameter">#cpus</replaceable></term> <listitem> <para> @@ -207,7 +276,7 @@ <varlistentry> <term>-t <replaceable class="parameter">directory</replaceable></term> <listitem> - <para><function>chroot()</function> + <para>Chroot to <replaceable class="parameter">directory</replaceable> after processing the command line arguments, but before reading the configuration file. @@ -217,7 +286,7 @@ This option should be used in conjunction with the <option>-u</option> option, as chrooting a process running as root doesn't enhance security on most - systems; the way <function>chroot()</function> is + systems; the way <function>chroot(2)</function> is defined allows a process with root privileges to escape a chroot jail. </para> @@ -228,7 +297,7 @@ <varlistentry> <term>-u <replaceable class="parameter">user</replaceable></term> <listitem> - <para><function>setuid()</function> + <para>Setuid to <replaceable class="parameter">user</replaceable> after completing privileged operations, such as creating sockets that listen on privileged ports. diff --git a/bin/named/lwresd.html b/bin/named/lwresd.html index e25dfcf7..b59a7cc7 100644 --- a/bin/named/lwresd.html +++ b/bin/named/lwresd.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: lwresd.html,v 1.5.18.16 2007/01/30 00:23:44 marka Exp $ --> +<!-- $Id: lwresd.html,v 1.5.18.18 2007/05/16 06:11:27 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -29,10 +29,10 @@ </div> <div class="refsynopsisdiv"> <h2>Synopsis</h2> -<div class="cmdsynopsis"><p><code class="command">lwresd</code> [<code class="option">-C <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-i <em class="replaceable"><code>pid-file</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-P <em class="replaceable"><code>port</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>]</p></div> +<div class="cmdsynopsis"><p><code class="command">lwresd</code> [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-C <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-i <em class="replaceable"><code>pid-file</code></em></code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-P <em class="replaceable"><code>port</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-4</code>] [<code class="option">-6</code>]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543435"></a><h2>DESCRIPTION</h2> +<a name="id2543461"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">lwresd</strong></span> is the daemon providing name lookup services to clients that use the BIND 9 lightweight resolver @@ -67,13 +67,34 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543482"></a><h2>OPTIONS</h2> +<a name="id2543508"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> +<dt><span class="term">-4</span></dt> +<dd><p> + Use IPv4 only even if the host machine is capable of IPv6. + <code class="option">-4</code> and <code class="option">-6</code> are mutually + exclusive. + </p></dd> +<dt><span class="term">-6</span></dt> +<dd><p> + Use IPv6 only even if the host machine is capable of IPv4. + <code class="option">-4</code> and <code class="option">-6</code> are mutually + exclusive. + </p></dd> +<dt><span class="term">-c <em class="replaceable"><code>config-file</code></em></span></dt> +<dd><p> + Use <em class="replaceable"><code>config-file</code></em> as the + configuration file instead of the default, + <code class="filename">/etc/lwresd.conf</code>. + + <font color="red"><term>-c</term></font> can not be used with <font color="red"><term>-C</term></font>. + </p></dd> <dt><span class="term">-C <em class="replaceable"><code>config-file</code></em></span></dt> <dd><p> Use <em class="replaceable"><code>config-file</code></em> as the configuration file instead of the default, <code class="filename">/etc/resolv.conf</code>. + <font color="red"><term>-C</term></font> can not be used with <font color="red"><term>-c</term></font>. </p></dd> <dt><span class="term">-d <em class="replaceable"><code>debug-level</code></em></span></dt> <dd><p> @@ -90,6 +111,23 @@ Run the server in the foreground and force all logging to <code class="filename">stderr</code>. </p></dd> +<dt><span class="term">-i <em class="replaceable"><code>pid-file</code></em></span></dt> +<dd><p> + Use <em class="replaceable"><code>pid-file</code></em> as the + PID file instead of the default, + <code class="filename">/var/run/lwresd.pid</code>. + </p></dd> +<dt><span class="term">-m <em class="replaceable"><code>flag</code></em></span></dt> +<dd><p> + Turn on memory usage debugging flags. Possible flags are + <em class="replaceable"><code>usage</code></em>, + <em class="replaceable"><code>trace</code></em>, + <em class="replaceable"><code>record</code></em>, + <em class="replaceable"><code>size</code></em>, and + <em class="replaceable"><code>mctx</code></em>. + These correspond to the ISC_MEM_DEBUGXXXX flags described in + <code class="filename"><isc/mem.h></code>. + </p></dd> <dt><span class="term">-n <em class="replaceable"><code>#cpus</code></em></span></dt> <dd><p> Create <em class="replaceable"><code>#cpus</code></em> worker threads @@ -129,7 +167,7 @@ </dd> <dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt> <dd> -<p><code class="function">chroot()</code> +<p>Chroot to <em class="replaceable"><code>directory</code></em> after processing the command line arguments, but before reading the configuration file. @@ -140,14 +178,14 @@ This option should be used in conjunction with the <code class="option">-u</code> option, as chrooting a process running as root doesn't enhance security on most - systems; the way <code class="function">chroot()</code> is + systems; the way <code class="function">chroot(2)</code> is defined allows a process with root privileges to escape a chroot jail. </p> </div> </dd> <dt><span class="term">-u <em class="replaceable"><code>user</code></em></span></dt> -<dd><p><code class="function">setuid()</code> +<dd><p>Setuid to <em class="replaceable"><code>user</code></em> after completing privileged operations, such as creating sockets that listen on privileged ports. @@ -159,7 +197,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2543746"></a><h2>FILES</h2> +<a name="id2543925"></a><h2>FILES</h2> <div class="variablelist"><dl> <dt><span class="term"><code class="filename">/etc/resolv.conf</code></span></dt> <dd><p> @@ -172,14 +210,14 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2543785"></a><h2>SEE ALSO</h2> +<a name="id2543964"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">lwres</span>(3)</span>, <span class="citerefentry"><span class="refentrytitle">resolver</span>(5)</span>. </p> </div> <div class="refsect1" lang="en"> -<a name="id2543819"></a><h2>AUTHOR</h2> +<a name="id2543998"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/bin/named/named.8 b/bin/named/named.8 index 5b39e2a1..f5e82303 100644 --- a/bin/named/named.8 +++ b/bin/named/named.8 @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: named.8,v 1.20.18.12 2007/01/30 00:23:44 marka Exp $ +.\" $Id: named.8,v 1.20.18.15 2007/06/20 02:26:58 marka Exp $ .\" .hy 0 .ad l @@ -33,7 +33,7 @@ named \- Internet domain name server .SH "SYNOPSIS" .HP 6 -\fBnamed\fR [\fB\-4\fR] [\fB\-6\fR] [\fB\-c\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-d\ \fR\fB\fIdebug\-level\fR\fR] [\fB\-f\fR] [\fB\-g\fR] [\fB\-n\ \fR\fB\fI#cpus\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR] [\fB\-v\fR] [\fB\-x\ \fR\fB\fIcache\-file\fR\fR] +\fBnamed\fR [\fB\-4\fR] [\fB\-6\fR] [\fB\-c\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-d\ \fR\fB\fIdebug\-level\fR\fR] [\fB\-f\fR] [\fB\-g\fR] [\fB\-m\ \fR\fB\fIflag\fR\fR] [\fB\-n\ \fR\fB\fI#cpus\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR] [\fB\-v\fR] [\fB\-x\ \fR\fB\fIcache\-file\fR\fR] .SH "DESCRIPTION" .PP \fBnamed\fR @@ -94,6 +94,17 @@ Run the server in the foreground and force all logging to \fIstderr\fR. .RE .PP +\-m \fIflag\fR +.RS 4 +Turn on memory usage debugging flags. Possible flags are +\fIusage\fR, +\fItrace\fR, +\fIrecord\fR, +\fIsize\fR, and +\fImctx\fR. These correspond to the ISC_MEM_DEBUGXXXX flags described in +\fI<isc/mem.h>\fR. +.RE +.PP \-n \fI#cpus\fR .RS 4 Create @@ -122,8 +133,7 @@ This option is mainly of interest to BIND 9 developers and may be removed or cha .PP \-t \fIdirectory\fR .RS 4 -\fBchroot()\fR -to +Chroot to \fIdirectory\fR after processing the command line arguments, but before reading the configuration file. .RS @@ -131,15 +141,14 @@ after processing the command line arguments, but before reading the configuratio This option should be used in conjunction with the \fB\-u\fR option, as chrooting a process running as root doesn't enhance security on most systems; the way -\fBchroot()\fR +\fBchroot(2)\fR is defined allows a process with root privileges to escape a chroot jail. .RE .RE .PP \-u \fIuser\fR .RS 4 -\fBsetuid()\fR -to +Setuid to \fIuser\fR after completing privileged operations, such as creating sockets that listen on privileged ports. .RS @@ -147,13 +156,13 @@ after completing privileged operations, such as creating sockets that listen on On Linux, \fBnamed\fR uses the kernel's capability mechanism to drop all root privileges except the ability to -\fBbind()\fR +\fBbind(2)\fR to a privileged port and set process resource limits. Unfortunately, this means that the \fB\-u\fR option only works when \fBnamed\fR is run on kernel 2.2.18 or later, or kernel 2.3.99\-pre3 or later, since previous kernels did not allow privileges to be retained after -\fBsetuid()\fR. +\fBsetuid(2)\fR. .RE .RE .PP @@ -211,6 +220,8 @@ The default process\-id file. RFC 1033, RFC 1034, RFC 1035, +\fBnamed\-checkconf\fR(8), +\fBnamed\-checkzone\fR(8), \fBrndc\fR(8), \fBlwresd\fR(8), \fBnamed.conf\fR(5), diff --git a/bin/named/named.conf.5 b/bin/named/named.conf.5 index 75b1bb59..9ae967db 100644 --- a/bin/named/named.conf.5 +++ b/bin/named/named.conf.5 @@ -12,7 +12,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: named.conf.5,v 1.1.2.23 2007/01/30 00:23:44 marka Exp $ +.\" $Id: named.conf.5,v 1.1.2.25 2007/06/20 02:26:58 marka Exp $ .\" .hy 0 .ad l @@ -509,8 +509,9 @@ zone \fIstring\fR \fIoptional_class\fR { .SH "SEE ALSO" .PP \fBnamed\fR(8), +\fBnamed\-checkconf\fR(8), \fBrndc\fR(8), -\fBBIND 9 Administrator Reference Manual\fR(). +BIND 9 Administrator Reference Manual. .SH "COPYRIGHT" Copyright \(co 2004\-2007 Internet Systems Consortium, Inc. ("ISC") .br diff --git a/bin/named/named.conf.docbook b/bin/named/named.conf.docbook index 5d5f52f3..e8ea4599 100644 --- a/bin/named/named.conf.docbook +++ b/bin/named/named.conf.docbook @@ -17,7 +17,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: named.conf.docbook,v 1.1.2.25 2007/01/29 23:57:20 marka Exp $ --> +<!-- $Id: named.conf.docbook,v 1.1.2.27 2007/06/19 06:59:09 marka Exp $ --> <refentry> <refentryinfo> <date>Aug 13, 2004</date> @@ -578,11 +578,12 @@ zone <replaceable>string</replaceable> <replaceable>optional_class</replaceable> <refentrytitle>named</refentrytitle><manvolnum>8</manvolnum> </citerefentry>, <citerefentry> - <refentrytitle>rndc</refentrytitle><manvolnum>8</manvolnum> + <refentrytitle>named-checkconf</refentrytitle><manvolnum>8</manvolnum> </citerefentry>, <citerefentry> - <refentrytitle>BIND 9 Administrator Reference Manual</refentrytitle> - </citerefentry>. + <refentrytitle>rndc</refentrytitle><manvolnum>8</manvolnum> + </citerefentry>, + <citetitle>BIND 9 Administrator Reference Manual</citetitle>. </para> </refsect1> diff --git a/bin/named/named.conf.html b/bin/named/named.conf.html index 5cd449e7..0c23fb2f 100644 --- a/bin/named/named.conf.html +++ b/bin/named/named.conf.html @@ -13,7 +13,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: named.conf.html,v 1.1.2.32 2007/01/30 00:23:44 marka Exp $ --> +<!-- $Id: named.conf.html,v 1.1.2.34 2007/06/20 02:26:58 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -542,8 +542,9 @@ zone <em class="replaceable"><code>string</code></em> <em class="replaceable"><c <div class="refsect1" lang="en"> <a name="id2545328"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, + <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>, - <span class="citerefentry"><span class="refentrytitle">BIND 9 Administrator Reference Manual</span></span>. + <em class="citetitle">BIND 9 Administrator Reference Manual</em>. </p> </div> </div></body> diff --git a/bin/named/named.docbook b/bin/named/named.docbook index f648b9d8..89ca959b 100644 --- a/bin/named/named.docbook +++ b/bin/named/named.docbook @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: named.docbook,v 1.7.18.8 2007/01/29 23:57:20 marka Exp $ --> +<!-- $Id: named.docbook,v 1.7.18.11 2007/06/19 06:59:09 marka Exp $ --> <refentry id="man.named"> <refentryinfo> <date>June 30, 2000</date> @@ -60,6 +60,7 @@ <arg><option>-d <replaceable class="parameter">debug-level</replaceable></option></arg> <arg><option>-f</option></arg> <arg><option>-g</option></arg> + <arg><option>-m <replaceable class="parameter">flag</replaceable></option></arg> <arg><option>-n <replaceable class="parameter">#cpus</replaceable></option></arg> <arg><option>-p <replaceable class="parameter">port</replaceable></option></arg> <arg><option>-s</option></arg> @@ -159,6 +160,22 @@ </varlistentry> <varlistentry> + <term>-m <replaceable class="parameter">flag</replaceable></term> + <listitem> + <para> + Turn on memory usage debugging flags. Possible flags are + <replaceable class="parameter">usage</replaceable>, + <replaceable class="parameter">trace</replaceable>, + <replaceable class="parameter">record</replaceable>, + <replaceable class="parameter">size</replaceable>, and + <replaceable class="parameter">mctx</replaceable>. + These correspond to the ISC_MEM_DEBUGXXXX flags described in + <filename><isc/mem.h></filename>. + </para> + </listitem> + </varlistentry> + + <varlistentry> <term>-n <replaceable class="parameter">#cpus</replaceable></term> <listitem> <para> @@ -200,7 +217,7 @@ <varlistentry> <term>-t <replaceable class="parameter">directory</replaceable></term> <listitem> - <para><function>chroot()</function> + <para>Chroot to <replaceable class="parameter">directory</replaceable> after processing the command line arguments, but before reading the configuration file. @@ -210,7 +227,7 @@ This option should be used in conjunction with the <option>-u</option> option, as chrooting a process running as root doesn't enhance security on most - systems; the way <function>chroot()</function> is + systems; the way <function>chroot(2)</function> is defined allows a process with root privileges to escape a chroot jail. </para> @@ -221,7 +238,7 @@ <varlistentry> <term>-u <replaceable class="parameter">user</replaceable></term> <listitem> - <para><function>setuid()</function> + <para>Setuid to <replaceable class="parameter">user</replaceable> after completing privileged operations, such as creating sockets that listen on privileged ports. @@ -230,7 +247,7 @@ <para> On Linux, <command>named</command> uses the kernel's capability mechanism to drop all root privileges - except the ability to <function>bind()</function> to + except the ability to <function>bind(2)</function> to a privileged port and set process resource limits. Unfortunately, this means that the <option>-u</option> @@ -238,7 +255,7 @@ run on kernel 2.2.18 or later, or kernel 2.3.99-pre3 or later, since previous kernels did not allow privileges - to be retained after <function>setuid()</function>. + to be retained after <function>setuid(2)</function>. </para> </note> </listitem> @@ -353,6 +370,14 @@ <citetitle>RFC 1034</citetitle>, <citetitle>RFC 1035</citetitle>, <citerefentry> + <refentrytitle>named-checkconf</refentrytitle> + <manvolnum>8</manvolnum> + </citerefentry>, + <citerefentry> + <refentrytitle>named-checkzone</refentrytitle> + <manvolnum>8</manvolnum> + </citerefentry>, + <citerefentry> <refentrytitle>rndc</refentrytitle> <manvolnum>8</manvolnum> </citerefentry>, diff --git a/bin/named/named.html b/bin/named/named.html index 1839e4a7..294ecce4 100644 --- a/bin/named/named.html +++ b/bin/named/named.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: named.html,v 1.6.18.18 2007/01/30 00:23:44 marka Exp $ --> +<!-- $Id: named.html,v 1.6.18.21 2007/06/20 02:26:58 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -29,10 +29,10 @@ </div> <div class="refsynopsisdiv"> <h2>Synopsis</h2> -<div class="cmdsynopsis"><p><code class="command">named</code> [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div> +<div class="cmdsynopsis"><p><code class="command">named</code> [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543444"></a><h2>DESCRIPTION</h2> +<a name="id2543452"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">named</strong></span> is a Domain Name System (DNS) server, part of the BIND 9 distribution from ISC. For more @@ -47,7 +47,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543468"></a><h2>OPTIONS</h2> +<a name="id2543477"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-4</span></dt> <dd><p> @@ -88,6 +88,17 @@ Run the server in the foreground and force all logging to <code class="filename">stderr</code>. </p></dd> +<dt><span class="term">-m <em class="replaceable"><code>flag</code></em></span></dt> +<dd><p> + Turn on memory usage debugging flags. Possible flags are + <em class="replaceable"><code>usage</code></em>, + <em class="replaceable"><code>trace</code></em>, + <em class="replaceable"><code>record</code></em>, + <em class="replaceable"><code>size</code></em>, and + <em class="replaceable"><code>mctx</code></em>. + These correspond to the ISC_MEM_DEBUGXXXX flags described in + <code class="filename"><isc/mem.h></code>. + </p></dd> <dt><span class="term">-n <em class="replaceable"><code>#cpus</code></em></span></dt> <dd><p> Create <em class="replaceable"><code>#cpus</code></em> worker threads @@ -117,7 +128,7 @@ </dd> <dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt> <dd> -<p><code class="function">chroot()</code> +<p>Chroot to <em class="replaceable"><code>directory</code></em> after processing the command line arguments, but before reading the configuration file. @@ -128,7 +139,7 @@ This option should be used in conjunction with the <code class="option">-u</code> option, as chrooting a process running as root doesn't enhance security on most - systems; the way <code class="function">chroot()</code> is + systems; the way <code class="function">chroot(2)</code> is defined allows a process with root privileges to escape a chroot jail. </p> @@ -136,7 +147,7 @@ </dd> <dt><span class="term">-u <em class="replaceable"><code>user</code></em></span></dt> <dd> -<p><code class="function">setuid()</code> +<p>Setuid to <em class="replaceable"><code>user</code></em> after completing privileged operations, such as creating sockets that listen on privileged ports. @@ -146,7 +157,7 @@ <p> On Linux, <span><strong class="command">named</strong></span> uses the kernel's capability mechanism to drop all root privileges - except the ability to <code class="function">bind()</code> to + except the ability to <code class="function">bind(2)</code> to a privileged port and set process resource limits. Unfortunately, this means that the <code class="option">-u</code> @@ -154,7 +165,7 @@ run on kernel 2.2.18 or later, or kernel 2.3.99-pre3 or later, since previous kernels did not allow privileges - to be retained after <code class="function">setuid()</code>. + to be retained after <code class="function">setuid(2)</code>. </p> </div> </dd> @@ -180,7 +191,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2543813"></a><h2>SIGNALS</h2> +<a name="id2543864"></a><h2>SIGNALS</h2> <p> In routine operation, signals should not be used to control the nameserver; <span><strong class="command">rndc</strong></span> should be used @@ -201,7 +212,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543861"></a><h2>CONFIGURATION</h2> +<a name="id2543912"></a><h2>CONFIGURATION</h2> <p> The <span><strong class="command">named</strong></span> configuration file is too complex to describe in detail here. A complete description is provided @@ -210,7 +221,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543878"></a><h2>FILES</h2> +<a name="id2543929"></a><h2>FILES</h2> <div class="variablelist"><dl> <dt><span class="term"><code class="filename">/etc/named.conf</code></span></dt> <dd><p> @@ -223,10 +234,12 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2543917"></a><h2>SEE ALSO</h2> +<a name="id2543969"></a><h2>SEE ALSO</h2> <p><em class="citetitle">RFC 1033</em>, <em class="citetitle">RFC 1034</em>, <em class="citetitle">RFC 1035</em>, + <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>, + <span class="citerefentry"><span class="refentrytitle">named-checkzone</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">lwresd</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>, @@ -234,7 +247,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543969"></a><h2>AUTHOR</h2> +<a name="id2544039"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/bin/named/query.c b/bin/named/query.c index f30c07c9..c8f219f8 100644 --- a/bin/named/query.c +++ b/bin/named/query.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: query.c,v 1.257.18.36.12.1 2007/04/30 01:10:19 marka Exp $ */ +/* $Id: query.c,v 1.257.18.38 2007/05/18 06:55:27 marka Exp $ */ /*! \file */ @@ -2592,7 +2592,9 @@ query_addbestns(ns_client_t *client) { } static void -query_addds(ns_client_t *client, dns_db_t *db, dns_dbnode_t *node) { +query_addds(ns_client_t *client, dns_db_t *db, dns_dbnode_t *node, + dns_dbversion_t *version) +{ dns_name_t *rname; dns_rdataset_t *rdataset, *sigrdataset; isc_result_t result; @@ -2613,12 +2615,12 @@ query_addds(ns_client_t *client, dns_db_t *db, dns_dbnode_t *node) { /* * Look for the DS record, which may or may not be present. */ - result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_ds, 0, + result = dns_db_findrdataset(db, node, version, dns_rdatatype_ds, 0, client->now, rdataset, sigrdataset); /* * If we didn't find it, look for an NSEC. */ if (result == ISC_R_NOTFOUND) - result = dns_db_findrdataset(db, node, NULL, + result = dns_db_findrdataset(db, node, version, dns_rdatatype_nsec, 0, client->now, rdataset, sigrdataset); if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) @@ -2657,7 +2659,8 @@ query_addds(ns_client_t *client, dns_db_t *db, dns_dbnode_t *node) { static void query_addwildcardproof(ns_client_t *client, dns_db_t *db, - dns_name_t *name, isc_boolean_t ispositive) + dns_dbversion_t *version, dns_name_t *name, + isc_boolean_t ispositive) { isc_buffer_t *dbuf, b; dns_name_t *fname; @@ -2738,7 +2741,7 @@ query_addwildcardproof(ns_client_t *client, dns_db_t *db, if (fname == NULL || rdataset == NULL || sigrdataset == NULL) goto cleanup; - result = dns_db_find(db, name, NULL, dns_rdatatype_nsec, options, + result = dns_db_find(db, name, version, dns_rdatatype_nsec, options, 0, &node, fname, rdataset, sigrdataset); if (node != NULL) dns_db_detachnode(db, &node); @@ -2790,8 +2793,9 @@ query_addwildcardproof(ns_client_t *client, dns_db_t *db, } static void -query_addnxrrsetnsec(ns_client_t *client, dns_db_t *db, dns_name_t **namep, - dns_rdataset_t **rdatasetp, dns_rdataset_t **sigrdatasetp) +query_addnxrrsetnsec(ns_client_t *client, dns_db_t *db, + dns_dbversion_t *version, dns_name_t **namep, + dns_rdataset_t **rdatasetp, dns_rdataset_t **sigrdatasetp) { dns_name_t *name; dns_rdataset_t *sigrdataset; @@ -2828,8 +2832,7 @@ query_addnxrrsetnsec(ns_client_t *client, dns_db_t *db, dns_name_t **namep, return; /* XXX */ - query_addwildcardproof(client, db, - client->query.qname, + query_addwildcardproof(client, db, version, client->query.qname, ISC_TRUE); /* @@ -3705,7 +3708,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) dbuf, DNS_SECTION_AUTHORITY); client->query.gluedb = NULL; if (WANTDNSSEC(client) && dns_db_issecure(db)) - query_addds(client, db, node); + query_addds(client, db, node, version); } else { /* * We might have a better answer or delegation @@ -3809,7 +3812,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) client->query.attributes &= ~NS_QUERYATTR_CACHEGLUEOK; if (WANTDNSSEC(client)) - query_addds(client, db, node); + query_addds(client, db, node, version); } } goto cleanup; @@ -3846,8 +3849,9 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) */ if (WANTDNSSEC(client)) { if (dns_rdataset_isassociated(rdataset)) - query_addnxrrsetnsec(client, db, &fname, - &rdataset, &sigrdataset); + query_addnxrrsetnsec(client, db, version, + &fname, &rdataset, + &sigrdataset); } goto cleanup; case DNS_R_EMPTYWILD: @@ -3896,7 +3900,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) query_addrrset(client, &fname, &rdataset, &sigrdataset, NULL, DNS_SECTION_AUTHORITY); - query_addwildcardproof(client, db, + query_addwildcardproof(client, db, version, client->query.qname, ISC_FALSE); } @@ -4305,7 +4309,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) * DNSSEC wildcard proofs. */ if (need_wildcardproof && dns_db_issecure(db)) - query_addwildcardproof(client, db, + query_addwildcardproof(client, db, version, dns_fixedname_name(&wildcardname), ISC_TRUE); cleanup: diff --git a/bin/named/server.c b/bin/named/server.c index 6ae31cb6..5f085309 100644 --- a/bin/named/server.c +++ b/bin/named/server.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: server.c,v 1.419.18.49 2006/12/07 05:24:19 marka Exp $ */ +/* $Id: server.c,v 1.419.18.56 2007/07/09 02:18:49 marka Exp $ */ /*! \file */ @@ -1435,12 +1435,12 @@ configure_view(dns_view_t *view, const cfg_obj_t *config, view->additionalfromcache = ISC_TRUE; } + /* + * Set "allow-query-cache" and "allow-recursion" acls if + * configured in named.conf. + */ CHECK(configure_view_acl(vconfig, config, "allow-query-cache", actx, ns_g_mctx, &view->queryacl)); - if (view->queryacl == NULL) - CHECK(configure_view_acl(NULL, ns_g_defaults, - "allow-query-cache", actx, - ns_g_mctx, &view->queryacl)); if (strcmp(view->name, "_bind") != 0) CHECK(configure_view_acl(vconfig, config, "allow-recursion", @@ -1460,11 +1460,29 @@ configure_view(dns_view_t *view, const cfg_obj_t *config, "active%s%s", forview, viewname); /* - * Set default "allow-recursion" acl. + * "allow-query-cache" inherits from "allow-recursion" if set, + * otherwise from "allow-query" if set. + * "allow-recursion" inherits from "allow-query-cache" if set, + * otherwise from "allow-query" if set. + */ + if (view->queryacl == NULL && view->recursionacl != NULL) + dns_acl_attach(view->recursionacl, &view->queryacl); + if (view->queryacl == NULL) + CHECK(configure_view_acl(vconfig, config, "allow-query", + actx, ns_g_mctx, &view->queryacl)); + if (view->recursionacl == NULL && view->queryacl != NULL) + dns_acl_attach(view->queryacl, &view->recursionacl); + + /* + * Set default "allow-recursion" and "allow-query-cache" acls. */ if (view->recursionacl == NULL && view->recursion) - CHECK(configure_view_acl(NULL, ns_g_defaults, "allow-recursion", + CHECK(configure_view_acl(NULL, ns_g_config, "allow-recursion", actx, ns_g_mctx, &view->recursionacl)); + if (view->queryacl == NULL) + CHECK(configure_view_acl(NULL, ns_g_config, + "allow-query-cache", actx, + ns_g_mctx, &view->queryacl)); CHECK(configure_view_acl(vconfig, config, "sortlist", actx, ns_g_mctx, &view->sortlist)); @@ -1755,6 +1773,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config, empty_dbtype, mctx); if (zone != NULL) { dns_zone_setview(zone, view); + CHECK(dns_view_addzone(view, zone)); dns_zone_detach(&zone); continue; } @@ -3959,6 +3978,7 @@ ns_server_reloadcommand(ns_server_t *server, char *args, isc_buffer_t *text) { type = dns_zone_gettype(zone); if (type == dns_zone_slave || type == dns_zone_stub) { dns_zone_refresh(zone); + dns_zone_detach(&zone); msg = "zone refresh queued"; } else { result = dns_zone_load(zone); @@ -4575,7 +4595,8 @@ isc_result_t ns_server_flushcache(ns_server_t *server, char *args) { char *ptr, *viewname; dns_view_t *view; - isc_boolean_t flushed = ISC_FALSE; + isc_boolean_t flushed; + isc_boolean_t found; isc_result_t result; /* Skip the command name. */ @@ -4588,22 +4609,27 @@ ns_server_flushcache(ns_server_t *server, char *args) { result = isc_task_beginexclusive(server->task); RUNTIME_CHECK(result == ISC_R_SUCCESS); + flushed = ISC_TRUE; + found = ISC_FALSE; for (view = ISC_LIST_HEAD(server->viewlist); view != NULL; view = ISC_LIST_NEXT(view, link)) { if (viewname != NULL && strcasecmp(viewname, view->name) != 0) continue; + found = ISC_TRUE; result = dns_view_flushcache(view); if (result != ISC_R_SUCCESS) - goto out; - flushed = ISC_TRUE; + flushed = ISC_FALSE; } - if (flushed) + if (flushed && found) { result = ISC_R_SUCCESS; - else - result = ISC_R_FAILURE; - out: + } else { + if (!found) + result = ISC_R_NOTFOUND; + else + result = ISC_R_FAILURE; + } isc_task_endexclusive(server->task); return (result); } @@ -4612,7 +4638,8 @@ isc_result_t ns_server_flushname(ns_server_t *server, char *args) { char *ptr, *target, *viewname; dns_view_t *view; - isc_boolean_t flushed = ISC_FALSE; + isc_boolean_t flushed; + isc_boolean_t found; isc_result_t result; isc_buffer_t b; dns_fixedname_t fixed; @@ -4642,18 +4669,22 @@ ns_server_flushname(ns_server_t *server, char *args) { result = isc_task_beginexclusive(server->task); RUNTIME_CHECK(result == ISC_R_SUCCESS); flushed = ISC_TRUE; + found = ISC_FALSE; for (view = ISC_LIST_HEAD(server->viewlist); view != NULL; view = ISC_LIST_NEXT(view, link)) { if (viewname != NULL && strcasecmp(viewname, view->name) != 0) continue; + found = ISC_TRUE; result = dns_view_flushname(view, name); if (result != ISC_R_SUCCESS) flushed = ISC_FALSE; } - if (flushed) + if (flushed && found) result = ISC_R_SUCCESS; + else if (!found) + result = ISC_R_NOTFOUND; else result = ISC_R_FAILURE; isc_task_endexclusive(server->task); diff --git a/bin/named/update.c b/bin/named/update.c index 05477610..3f01d60f 100644 --- a/bin/named/update.c +++ b/bin/named/update.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: update.c,v 1.109.18.19 2006/03/06 01:38:00 marka Exp $ */ +/* $Id: update.c,v 1.109.18.21 2007/05/18 23:46:28 tbox Exp $ */ #include <config.h> @@ -1675,6 +1675,9 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, if (check_ksk && type != dns_rdatatype_dnskey && (dst_key_flags(keys[i]) & DNS_KEYFLAG_KSK) != 0) continue; + + if (!dst_key_isprivate(keys[i])) + continue; /* Calculate the signature, creating a RRSIG RDATA. */ CHECK(dns_dnssec_sign(name, &rdataset, keys[i], diff --git a/bin/nsupdate/nsupdate.8 b/bin/nsupdate/nsupdate.8 index 5b9f2474..8e3963ac 100644 --- a/bin/nsupdate/nsupdate.8 +++ b/bin/nsupdate/nsupdate.8 @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: nsupdate.8,v 1.30.18.13 2007/01/30 00:23:44 marka Exp $ +.\" $Id: nsupdate.8,v 1.30.18.14 2007/05/09 03:33:13 marka Exp $ .\" .hy 0 .ad l @@ -55,7 +55,7 @@ operate in debug mode. This provides tracing information about the update reques .PP Transaction signatures can be used to authenticate the Dynamic DNS updates. These use the TSIG resource record type described in RFC2845 or the SIG(0) record described in RFC3535 and RFC2931. TSIG relies on a shared secret that should only be known to \fBnsupdate\fR -and the name server. Currently, the only supported encryption algorithm for TSIG is HMAC\-MD5, which is defined in RFC 2104. Once other algorithms are defined for TSIG, applications will need to ensure they select the appropriate algorithm as well as the key when authenticating each other. For instance suitable +and the name server. Currently, the only supported encryption algorithm for TSIG is HMAC\-MD5, which is defined in RFC 2104. Once other algorithms are defined for TSIG, applications will need to ensure they select the appropriate algorithm as well as the key when authenticating each other. For instance, suitable \fBkey\fR and \fBserver\fR @@ -106,15 +106,15 @@ use a TCP connection. This may be preferable when a batch of update requests is .PP The \fB\-t\fR -option sets the maximum time a update request can take before it is aborted. The default is 300 seconds. Zero can be used to disable the timeout. +option sets the maximum time an update request can take before it is aborted. The default is 300 seconds. Zero can be used to disable the timeout. .PP The \fB\-u\fR -option sets the UDP retry interval. The default is 3 seconds. If zero the interval will be computed from the timeout interval and number of UDP retries. +option sets the UDP retry interval. The default is 3 seconds. If zero, the interval will be computed from the timeout interval and number of UDP retries. .PP The \fB\-r\fR -option sets the number of UDP retries. The default is 3. If zero only one update request will be made. +option sets the number of UDP retries. The default is 3. If zero, only one update request will be made. .SH "INPUT FORMAT" .PP \fBnsupdate\fR @@ -164,13 +164,13 @@ will attempt determine the correct zone to update based on the rest of the input .RS 4 Specify the default class. If no \fIclass\fR -is specified the default class is +is specified, the default class is \fIIN\fR. .RE .PP \fBkey\fR {name} {secret} .RS 4 -Specifies that all updates are to be TSIG signed using the +Specifies that all updates are to be TSIG\-signed using the \fIkeyname\fR \fIkeysecret\fR pair. The @@ -293,9 +293,9 @@ zone. Notice that the input in each example contains a trailing blank line so th .PP Any A records for \fBoldhost.example.com\fR -are deleted. and an A record for +are deleted. And an A record for \fBnewhost.example.com\fR -it IP address 172.16.1.1 is added. The newly\-added record has a 1 day TTL (86400 seconds) +with IP address 172.16.1.1 is added. The newly\-added record has a 1 day TTL (86400 seconds). .sp .RS 4 .nf diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c index 412505e4..4044f711 100644 --- a/bin/nsupdate/nsupdate.c +++ b/bin/nsupdate/nsupdate.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000-2003 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: nsupdate.c,v 1.130.18.15 2006/12/07 05:39:45 marka Exp $ */ +/* $Id: nsupdate.c,v 1.130.18.18 2007/04/24 07:10:22 marka Exp $ */ /*! \file */ @@ -1565,8 +1565,11 @@ user_interaction(void) { isc_uint16_t result = STATUS_MORE; ddebug("user_interaction()"); - while ((result == STATUS_MORE) || (result == STATUS_SYNTAX)) + while ((result == STATUS_MORE) || (result == STATUS_SYNTAX)) { result = get_next_command(); + if (!interactive && result == STATUS_SYNTAX) + fatal("syntax error"); + } if (result == STATUS_SEND) return (ISC_TRUE); return (ISC_FALSE); @@ -2063,6 +2066,10 @@ start_update(void) { result = dns_message_firstname(updatemsg, section); } if (result != ISC_R_SUCCESS) { + dns_message_puttempname(soaquery, &name); + dns_rdataset_disassociate(rdataset); + dns_message_puttemprdataset(soaquery, &rdataset); + dns_message_destroy(&soaquery); done_update(); return; } diff --git a/bin/nsupdate/nsupdate.docbook b/bin/nsupdate/nsupdate.docbook index 77eff655..df293343 100644 --- a/bin/nsupdate/nsupdate.docbook +++ b/bin/nsupdate/nsupdate.docbook @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: nsupdate.docbook,v 1.18.18.8 2007/01/29 23:57:20 marka Exp $ --> +<!-- $Id: nsupdate.docbook,v 1.18.18.9 2007/05/09 01:38:19 marka Exp $ --> <refentry> <refentryinfo> <date>Jun 30, 2000</date> @@ -112,7 +112,7 @@ Once other algorithms are defined for TSIG, applications will need to ensure they select the appropriate algorithm as well as the key when authenticating each other. - For instance suitable + For instance, suitable <type>key</type> and <type>server</type> @@ -170,7 +170,7 @@ This may be preferable when a batch of update requests is made. </para> <para> - The <option>-t</option> option sets the maximum time a update request + The <option>-t</option> option sets the maximum time an update request can take before it is aborted. The default is 300 seconds. Zero can be used @@ -179,14 +179,14 @@ <para> The <option>-u</option> option sets the UDP retry interval. The default is - 3 seconds. If zero the interval will be computed from the timeout + 3 seconds. If zero, the interval will be computed from the timeout interval and number of UDP retries. </para> <para> The <option>-r</option> option sets the number of UDP retries. The default is - 3. If zero only one update request will be made. + 3. If zero, only one update request will be made. </para> </refsect1> @@ -297,7 +297,7 @@ <listitem> <para> Specify the default class. - If no <parameter>class</parameter> is specified the + If no <parameter>class</parameter> is specified, the default class is <parameter>IN</parameter>. </para> @@ -312,7 +312,7 @@ </term> <listitem> <para> - Specifies that all updates are to be TSIG signed using the + Specifies that all updates are to be TSIG-signed using the <parameter>keyname</parameter> <parameter>keysecret</parameter> pair. The <command>key</command> command overrides any key specified on the command line via @@ -543,10 +543,10 @@ Any A records for <type>oldhost.example.com</type> are deleted. - and an A record for + And an A record for <type>newhost.example.com</type> - it IP address 172.16.1.1 is added. - The newly-added record has a 1 day TTL (86400 seconds) + with IP address 172.16.1.1 is added. + The newly-added record has a 1 day TTL (86400 seconds). <programlisting> # nsupdate > prereq nxdomain nickname.example.com diff --git a/bin/nsupdate/nsupdate.html b/bin/nsupdate/nsupdate.html index ecf52ab6..d11b57ea 100644 --- a/bin/nsupdate/nsupdate.html +++ b/bin/nsupdate/nsupdate.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: nsupdate.html,v 1.14.18.21 2007/01/30 00:23:44 marka Exp $ --> +<!-- $Id: nsupdate.html,v 1.14.18.22 2007/05/09 03:33:13 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -77,7 +77,7 @@ Once other algorithms are defined for TSIG, applications will need to ensure they select the appropriate algorithm as well as the key when authenticating each other. - For instance suitable + For instance, suitable <span class="type">key</span> and <span class="type">server</span> @@ -133,7 +133,7 @@ This may be preferable when a batch of update requests is made. </p> <p> - The <code class="option">-t</code> option sets the maximum time a update request + The <code class="option">-t</code> option sets the maximum time an update request can take before it is aborted. The default is 300 seconds. Zero can be used @@ -142,14 +142,14 @@ <p> The <code class="option">-u</code> option sets the UDP retry interval. The default is - 3 seconds. If zero the interval will be computed from the timeout + 3 seconds. If zero, the interval will be computed from the timeout interval and number of UDP retries. </p> <p> The <code class="option">-r</code> option sets the number of UDP retries. The default is - 3. If zero only one update request will be made. + 3. If zero, only one update request will be made. </p> </div> <div class="refsect1" lang="en"> @@ -242,7 +242,7 @@ </span></dt> <dd><p> Specify the default class. - If no <em class="parameter"><code>class</code></em> is specified the + If no <em class="parameter"><code>class</code></em> is specified, the default class is <em class="parameter"><code>IN</code></em>. </p></dd> @@ -252,7 +252,7 @@ {secret} </span></dt> <dd><p> - Specifies that all updates are to be TSIG signed using the + Specifies that all updates are to be TSIG-signed using the <em class="parameter"><code>keyname</code></em> <em class="parameter"><code>keysecret</code></em> pair. The <span><strong class="command">key</strong></span> command overrides any key specified on the command line via @@ -402,7 +402,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2544649"></a><h2>EXAMPLES</h2> +<a name="id2544648"></a><h2>EXAMPLES</h2> <p> The examples below show how <span><strong class="command">nsupdate</strong></span> @@ -428,10 +428,10 @@ Any A records for <span class="type">oldhost.example.com</span> are deleted. - and an A record for + And an A record for <span class="type">newhost.example.com</span> - it IP address 172.16.1.1 is added. - The newly-added record has a 1 day TTL (86400 seconds) + with IP address 172.16.1.1 is added. + The newly-added record has a 1 day TTL (86400 seconds). </p> <pre class="programlisting"> # nsupdate @@ -456,7 +456,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2544693"></a><h2>FILES</h2> +<a name="id2544692"></a><h2>FILES</h2> <div class="variablelist"><dl> <dt><span class="term"><code class="constant">/etc/resolv.conf</code></span></dt> <dd><p> @@ -475,7 +475,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2544830"></a><h2>SEE ALSO</h2> +<a name="id2544829"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">RFC2136</span></span>, <span class="citerefentry"><span class="refentrytitle">RFC3007</span></span>, <span class="citerefentry"><span class="refentrytitle">RFC2104</span></span>, @@ -488,7 +488,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2544901"></a><h2>BUGS</h2> +<a name="id2544900"></a><h2>BUGS</h2> <p> The TSIG key is redundantly stored in two separate files. This is a consequence of nsupdate using the DST library diff --git a/bin/rndc/rndc.8 b/bin/rndc/rndc.8 index 11e0c2da..14a51b3c 100644 --- a/bin/rndc/rndc.8 +++ b/bin/rndc/rndc.8 @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: rndc.8,v 1.26.18.12 2007/01/30 00:23:44 marka Exp $ +.\" $Id: rndc.8,v 1.26.18.15 2007/06/20 02:26:58 marka Exp $ .\" .hy 0 .ad l @@ -47,8 +47,7 @@ is invoked with no command line options or arguments, it prints a short summary communicates with the name server over a TCP connection, sending commands authenticated with digital signatures. In the current versions of \fBrndc\fR and -\fBnamed\fR -named the only supported authentication algorithm is HMAC\-MD5, which uses a shared secret on each end of the connection. This provides TSIG\-style authentication for the command request and the name server's response. All commands sent over the channel must be signed by a key_id known to the server. +\fBnamed\fR, the only supported authentication algorithm is HMAC\-MD5, which uses a shared secret on each end of the connection. This provides TSIG\-style authentication for the command request and the name server's response. All commands sent over the channel must be signed by a key_id known to the server. .PP \fBrndc\fR reads a configuration file to determine how to contact the name server and decide what algorithm and key it should use. @@ -85,7 +84,9 @@ does not exist. .RS 4 \fIserver\fR is the name or address of the server which matches a server statement in the configuration file for -\fBrndc\fR. If no server is supplied on the command line, the host named by the default\-server clause in the option statement of the configuration file will be used. +\fBrndc\fR. If no server is supplied on the command line, the host named by the default\-server clause in the options statement of the +\fBrndc\fR +configuration file will be used. .RE .PP \-p \fIport\fR @@ -100,14 +101,14 @@ instead of BIND 9's default control channel port, 953. Enable verbose logging. .RE .PP -\-y \fIkeyid\fR +\-y \fIkey_id\fR .RS 4 Use the key -\fIkeyid\fR +\fIkey_id\fR from the configuration file. -\fIkeyid\fR +\fIkey_id\fR must be known by named with the same algorithm and secret string in order for control message validation to succeed. If no -\fIkeyid\fR +\fIkey_id\fR is specified, \fBrndc\fR will first look for a key clause in the server statement of the server being used, or if no server statement is present for that host, then the default\-key clause of the options statement. Note that the configuration file contains shared secrets which are used to send authenticated control commands to name servers. It should therefore not have general read or write access. @@ -133,7 +134,7 @@ Several error messages could be clearer. .PP \fBrndc.conf\fR(5), \fBnamed\fR(8), -\fBnamed.conf\fR(5) +\fBnamed.conf\fR(5), \fBndc\fR(8), BIND 9 Administrator Reference Manual. .SH "AUTHOR" diff --git a/bin/rndc/rndc.conf.5 b/bin/rndc/rndc.conf.5 index ce12151f..dbeb7071 100644 --- a/bin/rndc/rndc.conf.5 +++ b/bin/rndc/rndc.conf.5 @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: rndc.conf.5,v 1.23.18.13 2007/01/30 00:23:44 marka Exp $ +.\" $Id: rndc.conf.5,v 1.23.18.15 2007/05/09 13:35:47 marka Exp $ .\" .hy 0 .ad l @@ -88,7 +88,7 @@ keyword, the server statement includes a string which is the hostname or address and \fBaddresses\fR. The key name must match the name of a key statement in the file. The port number specifies the port to connect to. If an \fBaddresses\fR -clause is supplied these addresses will be used instead of the server name. Each address can take a optional port. If an +clause is supplied these addresses will be used instead of the server name. Each address can take an optional port. If an \fBsource\-address\fR or \fBsource\-address\-v6\fR @@ -156,7 +156,7 @@ does not ship with BIND 9 but is available on many systems. See the EXAMPLE sect key testkey { algorithm hmac\-md5; secret "R3HI8P6BKw9ZwXwN3VZKuQ=="; - } + }; .fi .RE .sp @@ -178,7 +178,7 @@ To generate a random secret with .PP A complete \fIrndc.conf\fR -file, including the randomly generated key, will be written to the standard output. Commented out +file, including the randomly generated key, will be written to the standard output. Commented\-out \fBkey\fR and \fBcontrols\fR diff --git a/bin/rndc/rndc.conf.docbook b/bin/rndc/rndc.conf.docbook index 624a2356..d624727e 100644 --- a/bin/rndc/rndc.conf.docbook +++ b/bin/rndc/rndc.conf.docbook @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: rndc.conf.docbook,v 1.5.18.9 2007/01/29 23:57:20 marka Exp $ --> +<!-- $Id: rndc.conf.docbook,v 1.5.18.11 2007/05/09 06:19:49 marka Exp $ --> <refentry id="man.rndc.conf"> <refentryinfo> <date>June 30, 2000</date> @@ -111,7 +111,7 @@ name of a key statement in the file. The port number specifies the port to connect to. If an <option>addresses</option> clause is supplied these addresses will be used instead of - the server name. Each address can take a optional port. + the server name. Each address can take an optional port. If an <option>source-address</option> or <option>source-address-v6</option> of supplied then these will be used to specify the IPv4 and IPv6 source addresses respectively. @@ -175,7 +175,7 @@ key testkey { algorithm hmac-md5; secret "R3HI8P6BKw9ZwXwN3VZKuQ=="; - } + }; </programlisting> </para> @@ -202,7 +202,7 @@ A complete <filename>rndc.conf</filename> file, including the randomly generated key, will be written to the standard - output. Commented out <option>key</option> and + output. Commented-out <option>key</option> and <option>controls</option> statements for <filename>named.conf</filename> are also printed. </para> diff --git a/bin/rndc/rndc.conf.html b/bin/rndc/rndc.conf.html index 8e510bd6..d11f9df6 100644 --- a/bin/rndc/rndc.conf.html +++ b/bin/rndc/rndc.conf.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: rndc.conf.html,v 1.6.18.21 2007/01/30 00:23:44 marka Exp $ --> +<!-- $Id: rndc.conf.html,v 1.6.18.23 2007/05/09 13:35:47 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -87,7 +87,7 @@ name of a key statement in the file. The port number specifies the port to connect to. If an <code class="option">addresses</code> clause is supplied these addresses will be used instead of - the server name. Each address can take a optional port. + the server name. Each address can take an optional port. If an <code class="option">source-address</code> or <code class="option">source-address-v6</code> of supplied then these will be used to specify the IPv4 and IPv6 source addresses respectively. @@ -153,7 +153,7 @@ key testkey { algorithm hmac-md5; secret "R3HI8P6BKw9ZwXwN3VZKuQ=="; - } + }; </pre> <p> </p> @@ -180,7 +180,7 @@ A complete <code class="filename">rndc.conf</code> file, including the randomly generated key, will be written to the standard - output. Commented out <code class="option">key</code> and + output. Commented-out <code class="option">key</code> and <code class="option">controls</code> statements for <code class="filename">named.conf</code> are also printed. </p> diff --git a/bin/rndc/rndc.docbook b/bin/rndc/rndc.docbook index 5dd26062..0dc21560 100644 --- a/bin/rndc/rndc.docbook +++ b/bin/rndc/rndc.docbook @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: rndc.docbook,v 1.8.18.8 2007/01/29 23:57:20 marka Exp $ --> +<!-- $Id: rndc.docbook,v 1.8.18.11 2007/06/19 06:59:09 marka Exp $ --> <refentry id="man.rndc"> <refentryinfo> <date>June 30, 2000</date> @@ -78,7 +78,7 @@ communicates with the name server over a TCP connection, sending commands authenticated with digital signatures. In the current versions of - <command>rndc</command> and <command>named</command> named + <command>rndc</command> and <command>named</command>, the only supported authentication algorithm is HMAC-MD5, which uses a shared secret on each end of the connection. This provides TSIG-style authentication for the command @@ -139,13 +139,12 @@ <term>-s <replaceable class="parameter">server</replaceable></term> <listitem> <para><replaceable class="parameter">server</replaceable> is - the name or address of the server which matches a + the name or address of the server which matches a server statement in the configuration file for - <command>rndc</command>. If no server is supplied on - the + <command>rndc</command>. If no server is supplied on the command line, the host named by the default-server clause - in the option statement of the configuration file will be - used. + in the options statement of the <command>rndc</command> + configuration file will be used. </para> </listitem> </varlistentry> @@ -172,16 +171,16 @@ </varlistentry> <varlistentry> - <term>-y <replaceable class="parameter">keyid</replaceable></term> + <term>-y <replaceable class="parameter">key_id</replaceable></term> <listitem> <para> - Use the key <replaceable class="parameter">keyid</replaceable> + Use the key <replaceable class="parameter">key_id</replaceable> from the configuration file. - <replaceable class="parameter">keyid</replaceable> + <replaceable class="parameter">key_id</replaceable> must be known by named with the same algorithm and secret string in order for control message validation to succeed. - If no <replaceable class="parameter">keyid</replaceable> + If no <replaceable class="parameter">key_id</replaceable> is specified, <command>rndc</command> will first look for a key clause in the server statement of the server being used, or if no server statement is present for that @@ -230,7 +229,7 @@ </citerefentry>, <citerefentry> <refentrytitle>named.conf</refentrytitle><manvolnum>5</manvolnum> - </citerefentry> + </citerefentry>, <citerefentry> <refentrytitle>ndc</refentrytitle><manvolnum>8</manvolnum> </citerefentry>, diff --git a/bin/rndc/rndc.html b/bin/rndc/rndc.html index 35e949af..d4d0ebb6 100644 --- a/bin/rndc/rndc.html +++ b/bin/rndc/rndc.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: rndc.html,v 1.8.18.19 2007/01/30 00:23:44 marka Exp $ --> +<!-- $Id: rndc.html,v 1.8.18.22 2007/06/20 02:26:58 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -46,7 +46,7 @@ communicates with the name server over a TCP connection, sending commands authenticated with digital signatures. In the current versions of - <span><strong class="command">rndc</strong></span> and <span><strong class="command">named</strong></span> named + <span><strong class="command">rndc</strong></span> and <span><strong class="command">named</strong></span>, the only supported authentication algorithm is HMAC-MD5, which uses a shared secret on each end of the connection. This provides TSIG-style authentication for the command @@ -88,13 +88,12 @@ </p></dd> <dt><span class="term">-s <em class="replaceable"><code>server</code></em></span></dt> <dd><p><em class="replaceable"><code>server</code></em> is - the name or address of the server which matches a + the name or address of the server which matches a server statement in the configuration file for - <span><strong class="command">rndc</strong></span>. If no server is supplied on - the + <span><strong class="command">rndc</strong></span>. If no server is supplied on the command line, the host named by the default-server clause - in the option statement of the configuration file will be - used. + in the options statement of the <span><strong class="command">rndc</strong></span> + configuration file will be used. </p></dd> <dt><span class="term">-p <em class="replaceable"><code>port</code></em></span></dt> <dd><p> @@ -107,15 +106,15 @@ <dd><p> Enable verbose logging. </p></dd> -<dt><span class="term">-y <em class="replaceable"><code>keyid</code></em></span></dt> +<dt><span class="term">-y <em class="replaceable"><code>key_id</code></em></span></dt> <dd><p> - Use the key <em class="replaceable"><code>keyid</code></em> + Use the key <em class="replaceable"><code>key_id</code></em> from the configuration file. - <em class="replaceable"><code>keyid</code></em> + <em class="replaceable"><code>key_id</code></em> must be known by named with the same algorithm and secret string in order for control message validation to succeed. - If no <em class="replaceable"><code>keyid</code></em> + If no <em class="replaceable"><code>key_id</code></em> is specified, <span><strong class="command">rndc</strong></span> will first look for a key clause in the server statement of the server being used, or if no server statement is present for that @@ -134,7 +133,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543652"></a><h2>LIMITATIONS</h2> +<a name="id2543656"></a><h2>LIMITATIONS</h2> <p><span><strong class="command">rndc</strong></span> does not yet support all the commands of the BIND 8 <span><strong class="command">ndc</strong></span> utility. @@ -148,16 +147,16 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543678"></a><h2>SEE ALSO</h2> +<a name="id2543683"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>, <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, - <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span> + <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>, <span class="citerefentry"><span class="refentrytitle">ndc</span>(8)</span>, <em class="citetitle">BIND 9 Administrator Reference Manual</em>. </p> </div> <div class="refsect1" lang="en"> -<a name="id2543725"></a><h2>AUTHOR</h2> +<a name="id2543730"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/bin/tests/compress_test.c b/bin/tests/compress_test.c index 60c033a2..92a06527 100644 --- a/bin/tests/compress_test.c +++ b/bin/tests/compress_test.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2001 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: compress_test.c,v 1.27.18.4 2006/02/26 23:49:49 marka Exp $ */ +/* $Id: compress_test.c,v 1.27.18.6 2007/05/15 23:46:28 tbox Exp $ */ /*! \file */ @@ -41,11 +41,6 @@ unsigned char plain[] = "\003yyy\003foo\0\003bar\003yyy\003foo\0\003" /* * Result concatenate (plain1, plain2, plain2, plain3). */ -unsigned char bit1[] = "\101\010b"; -unsigned char bit2[] = "\101\014b\260"; -unsigned char bit3[] = "\101\020b\264"; -unsigned char bit[] = "\101\010b\0\101\014b\260\0\101\014b\260\0\101\020b\264"; - int raw = 0; int verbose = 0; @@ -92,25 +87,6 @@ main(int argc, char *argv[]) { sizeof(plain)); test(DNS_COMPRESS_ALL, &name1, &name2, &name3, plain, sizeof(plain)); - dns_name_init(&name1, NULL); - region.base = bit1; - region.length = sizeof(bit1); - dns_name_fromregion(&name1, ®ion); - - dns_name_init(&name2, NULL); - region.base = bit2; - region.length = sizeof(bit2); - dns_name_fromregion(&name2, ®ion); - - dns_name_init(&name3, NULL); - region.base = bit3; - region.length = sizeof(bit3); - dns_name_fromregion(&name3, ®ion); - - test(DNS_COMPRESS_NONE, &name1, &name2, &name3, bit, sizeof(bit)); - test(DNS_COMPRESS_GLOBAL14, &name1, &name2, &name3, bit, sizeof(bit)); - test(DNS_COMPRESS_ALL, &name1, &name2, &name3, bit, sizeof(bit)); - return (0); } diff --git a/bin/tests/journalprint.c b/bin/tests/journalprint.c index db7fb99a..839f7bb9 100644 --- a/bin/tests/journalprint.c +++ b/bin/tests/journalprint.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: journalprint.c,v 1.4.18.5 2006/08/25 05:25:51 marka Exp $ */ +/* $Id: journalprint.c,v 1.4.18.7 2007/02/27 23:46:18 tbox Exp $ */ /*! \file */ #include <config.h> @@ -34,7 +34,7 @@ main(int argc, char **argv) { isc_mem_t *mctx = NULL; if (argc != 2) { - printf("usage: %s journal", argv[0]); + printf("usage: %s journal\n", argv[0]); return(1); } diff --git a/bin/tests/system/checknames/ns2/named.conf b/bin/tests/system/checknames/ns2/named.conf index c167d3ad..235da980 100644 --- a/bin/tests/system/checknames/ns2/named.conf +++ b/bin/tests/system/checknames/ns2/named.conf @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -14,7 +14,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: named.conf,v 1.4 2004/03/05 04:59:41 marka Exp $ */ +/* $Id: named.conf,v 1.4.18.2 2007/04/26 23:46:19 tbox Exp $ */ controls { /* empty */ }; @@ -27,6 +27,7 @@ options { listen-on { 10.53.0.2; }; listen-on-v6 { none; }; recursion yes; + acache-enable yes; check-names response warn; notify yes; }; diff --git a/bin/tests/system/checknames/ns3/named.conf b/bin/tests/system/checknames/ns3/named.conf index 601368c1..1d25f540 100644 --- a/bin/tests/system/checknames/ns3/named.conf +++ b/bin/tests/system/checknames/ns3/named.conf @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -14,7 +14,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: named.conf,v 1.4 2004/03/05 04:59:45 marka Exp $ */ +/* $Id: named.conf,v 1.4.18.2 2007/04/26 23:46:19 tbox Exp $ */ controls { /* empty */ }; @@ -27,6 +27,7 @@ options { listen-on { 10.53.0.3; }; listen-on-v6 { none; }; recursion yes; + acache-enable yes; check-names response fail; notify yes; }; diff --git a/bin/tests/system/dlv/ns5/named.conf b/bin/tests/system/dlv/ns5/named.conf index 71e56951..7de3cdca 100644 --- a/bin/tests/system/dlv/ns5/named.conf +++ b/bin/tests/system/dlv/ns5/named.conf @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2006, 2007 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -14,7 +14,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: named.conf,v 1.2.2.4 2006/03/10 00:23:20 marka Exp $ */ +/* $Id: named.conf,v 1.2.2.6 2007/04/26 23:46:19 tbox Exp $ */ /* * Choose a keyname that is unlikely to clash with any real key names. @@ -56,6 +56,7 @@ options { listen-on { 10.53.0.5; }; listen-on-v6 { none; }; recursion yes; + acache-enable yes; notify yes; dnssec-enable yes; dnssec-validation yes; diff --git a/bin/tests/system/dnssec/ns4/named.conf b/bin/tests/system/dnssec/ns4/named.conf index 07cccc81..bc1645cc 100644 --- a/bin/tests/system/dnssec/ns4/named.conf +++ b/bin/tests/system/dnssec/ns4/named.conf @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2006, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: named.conf,v 1.22.18.3 2006/03/10 00:23:20 marka Exp $ */ +/* $Id: named.conf,v 1.22.18.5 2007/04/26 23:46:19 tbox Exp $ */ // NS4 @@ -30,6 +30,7 @@ options { listen-on { 10.53.0.4; }; listen-on-v6 { none; }; recursion yes; + acache-enable yes; dnssec-enable yes; dnssec-validation yes; dnssec-must-be-secure mustbesecure.example yes; diff --git a/bin/tests/system/dnssec/ns5/named.conf b/bin/tests/system/dnssec/ns5/named.conf index d5f27e0a..fffa37e3 100644 --- a/bin/tests/system/dnssec/ns5/named.conf +++ b/bin/tests/system/dnssec/ns5/named.conf @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2006, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: named.conf,v 1.20.18.2 2006/03/10 00:23:20 marka Exp $ */ +/* $Id: named.conf,v 1.20.18.4 2007/04/26 23:46:19 tbox Exp $ */ // NS5 @@ -30,6 +30,7 @@ options { listen-on { 10.53.0.5; }; listen-on-v6 { none; }; recursion yes; + acache-enable yes; dnssec-enable yes; dnssec-validation yes; }; diff --git a/bin/tests/system/dnssec/ns6/named.conf b/bin/tests/system/dnssec/ns6/named.conf index 31ae011f..fb6b3497 100644 --- a/bin/tests/system/dnssec/ns6/named.conf +++ b/bin/tests/system/dnssec/ns6/named.conf @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2006, 2007 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -14,7 +14,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: named.conf,v 1.6.18.3 2006/03/10 00:23:20 marka Exp $ */ +/* $Id: named.conf,v 1.6.18.5 2007/04/26 23:46:19 tbox Exp $ */ // NS6 @@ -29,6 +29,7 @@ options { listen-on { 10.53.0.6; }; listen-on-v6 { none; }; recursion yes; + acache-enable yes; notify yes; disable-algorithms . { DSA; }; dnssec-enable yes; diff --git a/bin/tests/system/lwresd/tests.sh b/bin/tests/system/lwresd/tests.sh index ceb8ca8b..f4a21147 100644 --- a/bin/tests/system/lwresd/tests.sh +++ b/bin/tests/system/lwresd/tests.sh @@ -1,6 +1,6 @@ #!/bin/sh # -# Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 2000, 2001 Internet Software Consortium. # # Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: tests.sh,v 1.15 2004/03/05 05:01:20 marka Exp $ +# $Id: tests.sh,v 1.15.18.2 2007/03/06 02:12:08 tbox Exp $ SYSTEMTESTTOP=.. . $SYSTEMTESTTOP/conf.sh @@ -32,7 +32,7 @@ status=`expr $status + $ret` $PERL $SYSTEMTESTTOP/stop.pl . lwresd1 -$PERL $SYSTEMTESTTOP/start.pl . lwresd1 -- "-c lwresd.conf -d 99 -g" +$PERL $SYSTEMTESTTOP/start.pl . lwresd1 -- "-m record,size,mctx -c lwresd.conf -d 99 -g" echo "I:using lwresd.conf" ret=0 diff --git a/bin/tests/system/notify/ns3/named.conf b/bin/tests/system/notify/ns3/named.conf index 63b51b71..c831c9dc 100644 --- a/bin/tests/system/notify/ns3/named.conf +++ b/bin/tests/system/notify/ns3/named.conf @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: named.conf,v 1.21 2004/03/05 05:01:51 marka Exp $ */ +/* $Id: named.conf,v 1.21.18.2 2007/04/26 23:46:19 tbox Exp $ */ controls { /* empty */ }; @@ -28,6 +28,7 @@ options { listen-on { 10.53.0.3; }; listen-on-v6 { none; }; recursion yes; + acache-enable yes; notify yes; }; diff --git a/bin/tests/system/nsupdate/ns2/named.conf b/bin/tests/system/nsupdate/ns2/named.conf index d48809ae..f3d5a651 100644 --- a/bin/tests/system/nsupdate/ns2/named.conf +++ b/bin/tests/system/nsupdate/ns2/named.conf @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: named.conf,v 1.11 2004/03/05 05:02:05 marka Exp $ */ +/* $Id: named.conf,v 1.11.18.2 2007/04/26 23:46:19 tbox Exp $ */ controls { /* empty */ }; @@ -28,6 +28,7 @@ options { listen-on { 10.53.0.2; }; listen-on-v6 { none; }; recursion yes; + acache-enable yes; notify yes; }; diff --git a/bin/tests/system/resolver/ns1/named.conf b/bin/tests/system/resolver/ns1/named.conf index c930fc38..b7e50f8c 100644 --- a/bin/tests/system/resolver/ns1/named.conf +++ b/bin/tests/system/resolver/ns1/named.conf @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: named.conf,v 1.10 2004/03/05 05:02:39 marka Exp $ */ +/* $Id: named.conf,v 1.10.18.2 2007/04/26 23:46:19 tbox Exp $ */ controls { /* empty */ }; @@ -28,6 +28,7 @@ options { listen-on { 10.53.0.1; }; listen-on-v6 { none; }; recursion yes; + acache-enable yes; }; zone "." { diff --git a/bin/tests/system/rrsetorder/ns3/named.conf b/bin/tests/system/rrsetorder/ns3/named.conf index 5df9a86b..c0b3e39c 100644 --- a/bin/tests/system/rrsetorder/ns3/named.conf +++ b/bin/tests/system/rrsetorder/ns3/named.conf @@ -1,5 +1,5 @@ /* - * Copyright (C) 2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2006, 2007 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -14,7 +14,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: named.conf,v 1.2.2.1 2006/03/03 00:56:53 marka Exp $ */ +/* $Id: named.conf,v 1.2.2.3 2007/04/26 23:46:19 tbox Exp $ */ controls { /* empty */ }; @@ -27,6 +27,7 @@ options { listen-on { 10.53.0.3; }; listen-on-v6 { none; }; recursion yes; + acache-enable yes; notify yes; rrset-order { name "fixed.example" order fixed; diff --git a/bin/tests/system/stress/ns3/named.conf b/bin/tests/system/stress/ns3/named.conf index ceaa839b..a81126ee 100644 --- a/bin/tests/system/stress/ns3/named.conf +++ b/bin/tests/system/stress/ns3/named.conf @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: named.conf,v 1.5 2004/03/05 05:02:55 marka Exp $ */ +/* $Id: named.conf,v 1.5.18.2 2007/04/26 23:46:19 tbox Exp $ */ controls { /* empty */ }; @@ -28,6 +28,7 @@ options { listen-on { 10.53.0.3; }; listen-on-v6 { none; }; recursion yes; + acache-enable yes; notify yes; }; diff --git a/bin/tests/system/stress/ns4/named.conf b/bin/tests/system/stress/ns4/named.conf index c805a449..aa1b1a37 100644 --- a/bin/tests/system/stress/ns4/named.conf +++ b/bin/tests/system/stress/ns4/named.conf @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: named.conf,v 1.5 2004/03/05 05:02:57 marka Exp $ */ +/* $Id: named.conf,v 1.5.18.2 2007/04/26 23:46:19 tbox Exp $ */ controls { /* empty */ }; @@ -28,6 +28,7 @@ options { listen-on { 10.53.0.4; }; listen-on-v6 { none; }; recursion yes; + acache-enable yes; notify yes; }; diff --git a/bin/tests/system/stub/ns3/named.conf b/bin/tests/system/stub/ns3/named.conf index f272780d..ddbc85f6 100644 --- a/bin/tests/system/stub/ns3/named.conf +++ b/bin/tests/system/stub/ns3/named.conf @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: named.conf,v 1.13 2004/03/05 05:03:08 marka Exp $ */ +/* $Id: named.conf,v 1.13.18.2 2007/04/26 23:46:20 tbox Exp $ */ controls { /* empty */ }; @@ -28,6 +28,7 @@ options { listen-on { 10.53.0.3; }; listen-on-v6 { none; }; recursion yes; + acache-enable yes; notify yes; }; diff --git a/bin/tests/system/upforwd/ns1/named.conf b/bin/tests/system/upforwd/ns1/named.conf index b58db015..5fe7d62a 100644 --- a/bin/tests/system/upforwd/ns1/named.conf +++ b/bin/tests/system/upforwd/ns1/named.conf @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: named.conf,v 1.8 2004/03/05 05:03:26 marka Exp $ */ +/* $Id: named.conf,v 1.8.18.2 2007/04/26 23:46:20 tbox Exp $ */ key "update.example." { algorithm "hmac-md5"; @@ -33,6 +33,7 @@ options { listen-on { 10.53.0.1; }; listen-on-v6 { none; }; recursion yes; + acache-enable yes; notify yes; }; diff --git a/bin/tests/system/upforwd/ns2/named.conf b/bin/tests/system/upforwd/ns2/named.conf index 18160f29..118a19b2 100644 --- a/bin/tests/system/upforwd/ns2/named.conf +++ b/bin/tests/system/upforwd/ns2/named.conf @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: named.conf,v 1.7 2004/03/05 05:03:28 marka Exp $ */ +/* $Id: named.conf,v 1.7.18.2 2007/04/26 23:46:20 tbox Exp $ */ controls { /* empty */ }; @@ -28,6 +28,7 @@ options { listen-on { 10.53.0.2; }; listen-on-v6 { none; }; recursion yes; + acache-enable yes; notify yes; }; diff --git a/bin/tests/system/upforwd/ns3/named.conf b/bin/tests/system/upforwd/ns3/named.conf index a678d589..404dbbcb 100644 --- a/bin/tests/system/upforwd/ns3/named.conf +++ b/bin/tests/system/upforwd/ns3/named.conf @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: named.conf,v 1.7 2004/03/05 05:03:31 marka Exp $ */ +/* $Id: named.conf,v 1.7.18.2 2007/04/26 23:46:20 tbox Exp $ */ controls { /* empty */ }; @@ -28,6 +28,7 @@ options { listen-on { 10.53.0.3; }; listen-on-v6 { none; }; recursion yes; + acache-enable yes; notify yes; }; diff --git a/bin/tests/system/v6synth/ns2/named.conf b/bin/tests/system/v6synth/ns2/named.conf index 6df9bb1e..1f6da0e0 100644 --- a/bin/tests/system/v6synth/ns2/named.conf +++ b/bin/tests/system/v6synth/ns2/named.conf @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2001 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: named.conf,v 1.3 2004/03/05 05:03:38 marka Exp $ */ +/* $Id: named.conf,v 1.3.18.2 2007/04/26 23:46:20 tbox Exp $ */ controls { /* empty */ }; @@ -28,6 +28,7 @@ options { listen-on { 10.53.0.2; }; listen-on-v6 { none; }; recursion yes; + acache-enable yes; notify yes; }; diff --git a/bin/tests/system/v6synth/ns3/named.conf b/bin/tests/system/v6synth/ns3/named.conf index 11856794..ade5adcf 100644 --- a/bin/tests/system/v6synth/ns3/named.conf +++ b/bin/tests/system/v6synth/ns3/named.conf @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2001 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: named.conf,v 1.3 2004/03/05 05:03:40 marka Exp $ */ +/* $Id: named.conf,v 1.3.18.2 2007/04/26 23:46:20 tbox Exp $ */ controls { /* empty */ }; @@ -28,6 +28,7 @@ options { listen-on { 10.53.0.3; }; listen-on-v6 { none; }; recursion yes; + acache-enable yes; notify yes; allow-v6-synthesis { any; }; }; diff --git a/bin/tests/system/xfer/ns3/named.conf b/bin/tests/system/xfer/ns3/named.conf index 181dece4..2988a370 100644 --- a/bin/tests/system/xfer/ns3/named.conf +++ b/bin/tests/system/xfer/ns3/named.conf @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: named.conf,v 1.18 2004/03/05 05:04:01 marka Exp $ */ +/* $Id: named.conf,v 1.18.18.2 2007/04/26 23:46:20 tbox Exp $ */ controls { /* empty */ }; @@ -28,6 +28,7 @@ options { listen-on { 10.53.0.3; }; listen-on-v6 { none; }; recursion yes; + acache-enable yes; notify yes; }; diff --git a/bin/win32/BINDInstall/BINDInstall.dsp b/bin/win32/BINDInstall/BINDInstall.dsp index 02d9bcfc..6585d511 100644 --- a/bin/win32/BINDInstall/BINDInstall.dsp +++ b/bin/win32/BINDInstall/BINDInstall.dsp @@ -43,11 +43,11 @@ RSC=rc.exe # PROP Ignore_Export_Lib 0
# PROP Target_Dir ""
# ADD BASE CPP /nologo /MT /W3 /GX /O2 /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /Yu"stdafx.h" /FD /c
-# ADD CPP /nologo /MD /W3 /GX /O2 /I "..\include" /I "..\..\..\include" /I "..\..\named\win32\include" /I "..\..\..\lib\isc\win32\include" /I "..\..\..\lib\isc\include" /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /D "_MBCS" /D "_AFXDLL" /Yu"stdafx.h" /FD /TP /c
+# ADD CPP /nologo /MT /W3 /GX /O2 /I "..\include" /I "..\..\..\include" /I "..\..\named\win32\include" /I "..\..\..\lib\isc\win32\include" /I "..\..\..\lib\isc\include" /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /D "_MBCS" /Yu"stdafx.h" /FD /TP /c
# ADD BASE MTL /nologo /D "NDEBUG" /mktyplib203 /win32
# ADD MTL /nologo /D "NDEBUG" /mktyplib203 /win32
# ADD BASE RSC /l 0x409 /d "NDEBUG"
-# ADD RSC /l 0x409 /d "NDEBUG" /d "_AFXDLL"
+# ADD RSC /l 0x409 /d "NDEBUG"
BSC32=bscmake.exe
# ADD BASE BSC32 /nologo
# ADD BSC32 /nologo
@@ -69,11 +69,11 @@ LINK32=link.exe # PROP Ignore_Export_Lib 0
# PROP Target_Dir ""
# ADD BASE CPP /nologo /MTd /W3 /Gm /GX /ZI /Od /D "WIN32" /D "_DEBUG" /D "_WINDOWS" /Yu"stdafx.h" /FD /GZ /c
-# ADD CPP /nologo /MDd /W3 /Gm /GX /Zi /Od /I "..\include" /I "..\..\..\include" /I "..\..\named\win32\include" /I "..\..\..\lib\isc\win32\include" /I "..\..\..\lib\isc\include" /D "WIN32" /D "_DEBUG" /D "_WINDOWS" /D "_MBCS" /D "_AFXDLL" /FR /Yu"stdafx.h" /FD /TP /GZ /c
+# ADD CPP /nologo /MTd /W3 /Gm /GX /Zi /Od /I "..\include" /I "..\..\..\include" /I "..\..\named\win32\include" /I "..\..\..\lib\isc\win32\include" /I "..\..\..\lib\isc\include" /D "WIN32" /D "_DEBUG" /D "_WINDOWS" /D "_MBCS" /FR /Yu"stdafx.h" /FD /TP /GZ /c
# ADD BASE MTL /nologo /D "_DEBUG" /mktyplib203 /win32
# ADD MTL /nologo /D "_DEBUG" /mktyplib203 /win32
# ADD BASE RSC /l 0x409 /d "_DEBUG"
-# ADD RSC /l 0x409 /d "_DEBUG" /d "_AFXDLL"
+# ADD RSC /l 0x409 /d "_DEBUG"
BSC32=bscmake.exe
# ADD BASE BSC32 /nologo
# ADD BSC32 /nologo
diff --git a/bin/win32/BINDInstall/BINDInstall.mak b/bin/win32/BINDInstall/BINDInstall.mak index e10ae552..3393a57e 100644 --- a/bin/win32/BINDInstall/BINDInstall.mak +++ b/bin/win32/BINDInstall/BINDInstall.mak @@ -130,9 +130,9 @@ CLEAN : "$(OUTDIR)" :
if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
-CPP_PROJ=/nologo /MD /W3 /GX /O2 /I "..\include" /I "..\..\..\include" /I "..\..\named\win32\include" /I "..\..\..\lib\isc\win32\include" /I "..\..\..\lib\isc\include" /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /D "_MBCS" /D "_AFXDLL" /Fp"$(INTDIR)\BINDInstall.pch" /Yu"stdafx.h" /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /TP /c
+CPP_PROJ=/nologo /MT /W3 /GX /O2 /I "..\include" /I "..\..\..\include" /I "..\..\named\win32\include" /I "..\..\..\lib\isc\win32\include" /I "..\..\..\lib\isc\include" /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /D "_MBCS" /Fp"$(INTDIR)\BINDInstall.pch" /Yu"stdafx.h" /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /TP /c
MTL_PROJ=/nologo /D "NDEBUG" /mktyplib203 /win32
-RSC_PROJ=/l 0x409 /fo"$(INTDIR)\BINDInstall.res" /d "NDEBUG" /d "_AFXDLL"
+RSC_PROJ=/l 0x409 /fo"$(INTDIR)\BINDInstall.res" /d "NDEBUG"
BSC32=bscmake.exe
BSC32_FLAGS=/nologo /o"$(OUTDIR)\BINDInstall.bsc"
BSC32_SBRS= \
@@ -192,9 +192,9 @@ CLEAN : "$(OUTDIR)" :
if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
-CPP_PROJ=/nologo /MDd /W3 /Gm /GX /Zi /Od /I "..\include" /I "..\..\..\include" /I "..\..\named\win32\include" /I "..\..\..\lib\isc\win32\include" /I "..\..\..\lib\isc\include" /D "WIN32" /D "_DEBUG" /D "_WINDOWS" /D "_MBCS" /D "_AFXDLL" /FR"$(INTDIR)\\" /Fp"$(INTDIR)\BINDInstall.pch" /Yu"stdafx.h" /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /TP /GZ /c
+CPP_PROJ=/nologo /MTd /W3 /Gm /GX /Zi /Od /I "..\include" /I "..\..\..\include" /I "..\..\named\win32\include" /I "..\..\..\lib\isc\win32\include" /I "..\..\..\lib\isc\include" /D "WIN32" /D "_DEBUG" /D "_WINDOWS" /D "_MBCS" /FR"$(INTDIR)\\" /Fp"$(INTDIR)\BINDInstall.pch" /Yu"stdafx.h" /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /TP /GZ /c
MTL_PROJ=/nologo /D "_DEBUG" /mktyplib203 /win32
-RSC_PROJ=/l 0x409 /fo"$(INTDIR)\BINDInstall.res" /d "_DEBUG" /d "_AFXDLL"
+RSC_PROJ=/l 0x409 /fo"$(INTDIR)\BINDInstall.res" /d "_DEBUG"
BSC32=bscmake.exe
BSC32_FLAGS=/nologo /o"$(OUTDIR)\BINDInstall.bsc"
BSC32_SBRS= \
@@ -340,7 +340,7 @@ SOURCE=..\..\..\lib\isc\win32\ntgroups.c !IF "$(CFG)" == "BINDInstall - Win32 Release"
-CPP_SWITCHES=/nologo /MD /W3 /GX /O2 /I "..\include" /I "..\..\..\include" /I "..\..\named\win32\include" /I "..\..\..\lib\isc\win32\include" /I "..\..\..\lib\isc\include" /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /D "_MBCS" /D "_AFXDLL" /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /TP /c
+CPP_SWITCHES=/nologo /MT /W3 /GX /O2 /I "..\include" /I "..\..\..\include" /I "..\..\named\win32\include" /I "..\..\..\lib\isc\win32\include" /I "..\..\..\lib\isc\include" /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /D "_MBCS" /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /TP /c
"$(INTDIR)\ntgroups.obj" : $(SOURCE) "$(INTDIR)"
$(CPP) @<<
@@ -350,7 +350,7 @@ CPP_SWITCHES=/nologo /MD /W3 /GX /O2 /I "..\include" /I "..\..\..\include" /I ". !ELSEIF "$(CFG)" == "BINDInstall - Win32 Debug"
-CPP_SWITCHES=/nologo /MDd /W3 /Gm /GX /Zi /Od /I "..\include" /I "..\..\..\include" /I "..\..\named\win32\include" /I "..\..\..\lib\isc\win32\include" /I "..\..\..\lib\isc\include" /D "WIN32" /D "_DEBUG" /D "_WINDOWS" /D "_MBCS" /D "_AFXDLL" /FR"$(INTDIR)\\" /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /TP /GZ /c
+CPP_SWITCHES=/nologo /MTd /W3 /Gm /GX /Zi /Od /I "..\include" /I "..\..\..\include" /I "..\..\named\win32\include" /I "..\..\..\lib\isc\win32\include" /I "..\..\..\lib\isc\include" /D "WIN32" /D "_DEBUG" /D "_WINDOWS" /D "_MBCS" /FR"$(INTDIR)\\" /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /TP /GZ /c
"$(INTDIR)\ntgroups.obj" "$(INTDIR)\ntgroups.sbr" : $(SOURCE) "$(INTDIR)"
$(CPP) @<<
@@ -364,7 +364,7 @@ SOURCE=.\StdAfx.cpp !IF "$(CFG)" == "BINDInstall - Win32 Release"
-CPP_SWITCHES=/nologo /MD /W3 /GX /O2 /I "..\include" /I "..\..\..\include" /I "..\..\named\win32\include" /I "..\..\..\lib\isc\win32\include" /I "..\..\..\lib\isc\include" /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /D "_MBCS" /D "_AFXDLL" /Fp"$(INTDIR)\BINDInstall.pch" /Yc"stdafx.h" /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /TP /c
+CPP_SWITCHES=/nologo /MT /W3 /GX /O2 /I "..\include" /I "..\..\..\include" /I "..\..\named\win32\include" /I "..\..\..\lib\isc\win32\include" /I "..\..\..\lib\isc\include" /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /D "_MBCS" /Fp"$(INTDIR)\BINDInstall.pch" /Yc"stdafx.h" /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /TP /c
"$(INTDIR)\StdAfx.obj" "$(INTDIR)\BINDInstall.pch" : $(SOURCE) "$(INTDIR)"
$(CPP) @<<
@@ -374,7 +374,7 @@ CPP_SWITCHES=/nologo /MD /W3 /GX /O2 /I "..\include" /I "..\..\..\include" /I ". !ELSEIF "$(CFG)" == "BINDInstall - Win32 Debug"
-CPP_SWITCHES=/nologo /MDd /W3 /Gm /GX /Zi /Od /I "..\include" /I "..\..\..\include" /I "..\..\named\win32\include" /I "..\..\..\lib\isc\win32\include" /I "..\..\..\lib\isc\include" /D "WIN32" /D "_DEBUG" /D "_WINDOWS" /D "_MBCS" /D "_AFXDLL" /FR"$(INTDIR)\\" /Fp"$(INTDIR)\BINDInstall.pch" /Yc"stdafx.h" /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /TP /GZ /c
+CPP_SWITCHES=/nologo /MTd /W3 /Gm /GX /Zi /Od /I "..\include" /I "..\..\..\include" /I "..\..\named\win32\include" /I "..\..\..\lib\isc\win32\include" /I "..\..\..\lib\isc\include" /D "WIN32" /D "_DEBUG" /D "_WINDOWS" /D "_MBCS" /FR"$(INTDIR)\\" /Fp"$(INTDIR)\BINDInstall.pch" /Yc"stdafx.h" /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /TP /GZ /c
"$(INTDIR)\StdAfx.obj" "$(INTDIR)\StdAfx.sbr" "$(INTDIR)\BINDInstall.pch" : $(SOURCE) "$(INTDIR)"
$(CPP) @<<
diff --git a/bin/win32/BINDInstall/BINDInstallDlg.cpp b/bin/win32/BINDInstall/BINDInstallDlg.cpp index ab16eeef..f5d48397 100644 --- a/bin/win32/BINDInstall/BINDInstallDlg.cpp +++ b/bin/win32/BINDInstall/BINDInstallDlg.cpp @@ -1,5 +1,5 @@ /* - * Portions Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Portions Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Portions Copyright (C) 2001, 2003 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: BINDInstallDlg.cpp,v 1.15.18.10 2006/11/08 01:51:10 marka Exp $ */ +/* $Id: BINDInstallDlg.cpp,v 1.15.18.14 2007/06/27 01:12:17 marka Exp $ */ /* * Copyright (c) 1999-2000 by Nortel Networks Corporation @@ -113,23 +113,15 @@ const FileData installFiles[] = {"msvcrt.dll", FileData::WinSystem, FileData::Critical, TRUE}, # endif #endif -#if _MSC_VER >= 1400 - {"mfc80.dll", FileData::BinDir, FileData::Critical, FALSE}, - {"mfc80u.dll", FileData::BinDir, FileData::Critical, FALSE}, - {"mfcm80.dll", FileData::BinDir, FileData::Critical, FALSE}, - {"mfcm80u.dll", FileData::BinDir, FileData::Critical, FALSE}, - {"Microsoft.VC80.MFC.manifest", FileData::BinDir, FileData::Critical, FALSE}, - {"msvcm80.dll", FileData::BinDir, FileData::Critical, FALSE}, - {"msvcp80.dll", FileData::BinDir, FileData::Critical, FALSE}, - {"msvcr80.dll", FileData::BinDir, FileData::Critical, FALSE}, - {"Microsoft.VC80.CRT.manifest", FileData::BinDir, FileData::Critical, FALSE}, -#elif _MSC_VER >= 1310 +#if _MSC_VER < 1400 +#if _MSC_VER >= 1310 {"mfc71.dll", FileData::WinSystem, FileData::Critical, TRUE}, {"msvcr71.dll", FileData::WinSystem, FileData::Critical, TRUE}, -#elif _MSC_VER > 1200 +#elif _MSC_VER > 1200 && _MSC_VER < 1310 {"mfc70.dll", FileData::WinSystem, FileData::Critical, TRUE}, {"msvcr70.dll", FileData::WinSystem, FileData::Critical, TRUE}, #endif +#endif {"bindevt.dll", FileData::BinDir, FileData::Normal, FALSE}, {"libbind9.dll", FileData::BinDir, FileData::Critical, FALSE}, {"libisc.dll", FileData::BinDir, FileData::Critical, FALSE}, @@ -481,6 +473,16 @@ void CBINDInstallDlg::OnInstall() { ProgramGroup(FALSE); +#if _MSC_VER >= 1400 + /* + * Install Visual Studio libraries. As per: + * http://blogs.msdn.com/astebner/archive/2006/08/23/715755.aspx + * + * Vcredist_x86.exe /q:a /c:"msiexec /i vcredist.msi /qn /l*v %temp%\vcredist_x86.log" + */ + /*system(".\\Vcredist_x86.exe /q:a /c:\"msiexec /i vcredist.msi /qn /l*v %temp%\vcredist_x86.log\"");*/ + system(".\\Vcredist_x86.exe"); +#endif try { CreateDirs(); CopyFiles(); diff --git a/contrib/dbus/dbus_mgr.c b/contrib/dbus/dbus_mgr.c index 832c0cac..71e1eacd 100644 --- a/contrib/dbus/dbus_mgr.c +++ b/contrib/dbus/dbus_mgr.c @@ -4,6 +4,7 @@ * response to D-BUS dhcp events or commands. * * Copyright(C) Jason Vas Dias, Red Hat Inc., 2005 + * Modified by Adam Tkac, Red Hat Inc., 2007 * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -281,6 +282,7 @@ static isc_result_t dbus_mgr_init_dbus(ns_dbus_mgr_t * mgr) { char destination[]=DBUSMGR_DESTINATION; + isc_result_t result; if( mgr->sockets != 0L ) { @@ -296,14 +298,11 @@ dbus_mgr_init_dbus(ns_dbus_mgr_t * mgr) mgr->dbus = 0L; } - mgr->dbus = - dbus_svc_init - ( DBUS_PRIVATE_SYSTEM, - destination, - dbus_mgr_watch_handler, - 0L, 0L, - mgr - ); + result = dbus_svc_init(DBUS_PRIVATE_SYSTEM, destination, &mgr->dbus, + dbus_mgr_watch_handler, 0L, 0L, mgr); + + if(result != ISC_R_SUCCESS) + goto cleanup; if( mgr->dbus == 0L ) { diff --git a/contrib/dbus/dbus_service.c b/contrib/dbus/dbus_service.c index bb9dabaf..0ed903d0 100644 --- a/contrib/dbus/dbus_service.c +++ b/contrib/dbus/dbus_service.c @@ -5,6 +5,7 @@ * Provides MINIMAL utilities for construction of D-BUS "Services". * * Copyright(C) Jason Vas Dias, Red Hat Inc., 2005 + * Modified by Adam Tkac, Red Hat Inc., 2007 * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -50,6 +51,7 @@ extern void tdestroy (void *__root, __free_fn_t __freefct); #include <dbus/dbus.h> #include <named/dbus_service.h> +#include <isc/result.h> typedef struct dbcs_s { @@ -914,38 +916,39 @@ dbus_svc_quit( DBusConnectionState *cs ) cs->status = SHUTDOWN; } -static DBusConnectionState * +static isc_result_t connection_setup -( DBusConnection *connection, +( DBusConnection *connection, + DBUS_SVC *dbus, dbus_svc_WatchHandler wh, dbus_svc_ErrorHandler eh, dbus_svc_ErrorHandler dh, void *wh_arg ) { - DBusConnectionState *cs = dbcs_new( connection ); + *dbus = dbcs_new( connection ); - if ( cs == 0L ) + if ( *dbus == 0L ) { if(eh)(*(eh))("connection_setup: out of memory"); goto fail; } - cs->wh = wh; - cs->wh_arg = wh_arg; - cs->eh = eh; - cs->dh = dh; + (*dbus)->wh = wh; + (*dbus)->wh_arg = wh_arg; + (*dbus)->eh = eh; + (*dbus)->dh = dh; if (!dbus_connection_set_watch_functions - ( cs->connection, + ( (*dbus)->connection, add_watch, remove_watch, toggle_watch, - cs, + *dbus, no_free ) ) { - if( cs->eh != 0L ) (*(cs->eh))("connection_setup: dbus_connection_set_watch_functions failed"); + if( (*dbus)->eh != 0L ) (*((*dbus)->eh))("connection_setup: dbus_connection_set_watch_functions failed"); goto fail; } @@ -954,43 +957,44 @@ connection_setup add_timeout, remove_timeout, toggle_timeout, - cs, + *dbus, no_free ) ) { - if( cs->eh != 0L ) (*(cs->eh))("connection_setup: dbus_connection_set_timeout_functions failed"); + if( (*dbus)->eh != 0L ) (*((*dbus)->eh))("connection_setup: dbus_connection_set_timeout_functions failed"); goto fail; } dbus_connection_set_dispatch_status_function ( connection, dispatch_status, - cs, + *dbus, no_free ); if (dbus_connection_get_dispatch_status (connection) != DBUS_DISPATCH_COMPLETE) dbus_connection_ref(connection); - return cs; + return ISC_R_SUCCESS; fail: - if( cs != 0L ) - free(cs); + if( *dbus != 0L ) + free(*dbus); dbus_connection_set_dispatch_status_function (connection, NULL, NULL, NULL); dbus_connection_set_watch_functions (connection, NULL, NULL, NULL, NULL, NULL); dbus_connection_set_timeout_functions (connection, NULL, NULL, NULL, NULL, NULL); - return 0L; + return ISC_R_FAILURE; } -DBusConnectionState * +isc_result_t dbus_svc_init ( dbus_svc_DBUS_TYPE bus, char *name, + DBUS_SVC *dbus, dbus_svc_WatchHandler wh , dbus_svc_ErrorHandler eh , dbus_svc_ErrorHandler dh , @@ -999,7 +1003,6 @@ dbus_svc_init { DBusConnection *connection; DBusError error; - DBusConnectionState *cs; char *session_bus_address=0L; memset(&error,'\0',sizeof(DBusError)); @@ -1015,7 +1018,7 @@ dbus_svc_init if ( (connection = dbus_connection_open_private("unix:path=/var/run/dbus/system_bus_socket", &error)) == 0L ) { if(eh)(*eh)("dbus_svc_init failed: %s %s",error.name, error.message); - return ( 0L ); + return ISC_R_FAILURE; } if ( ! dbus_bus_register(connection,&error) ) @@ -1023,7 +1026,7 @@ dbus_svc_init if(eh)(*eh)("dbus_bus_register failed: %s %s", error.name, error.message); dbus_connection_close(connection); free(connection); - return ( 0L ); + return ISC_R_FAILURE; } break; @@ -1033,13 +1036,13 @@ dbus_svc_init if ( session_bus_address == 0L ) { if(eh)(*eh)("dbus_svc_init failed: DBUS_SESSION_BUS_ADDRESS environment variable not set"); - return ( 0L ); + return ISC_R_FAILURE; } if ( (connection = dbus_connection_open_private(session_bus_address, &error)) == 0L ) { if(eh)(*eh)("dbus_svc_init failed: %s %s",error.name, error.message); - return ( 0L ); + return ISC_R_FAILURE; } if ( ! dbus_bus_register(connection,&error) ) @@ -1047,7 +1050,7 @@ dbus_svc_init if(eh)(*eh)("dbus_bus_register failed: %s %s", error.name, error.message); dbus_connection_close(connection); free(connection); - return ( 0L ); + return ISC_R_FAILURE; } break; @@ -1057,27 +1060,27 @@ dbus_svc_init if ( (connection = dbus_bus_get (bus, &error)) == 0L ) { if(eh)(*eh)("dbus_svc_init failed: %s %s",error.name, error.message); - return ( 0L ); + return ISC_R_FAILURE; } break; default: if(eh)(*eh)("dbus_svc_init failed: unknown bus type %d", bus); - return ( 0L ); + return ISC_R_FAILURE; } dbus_connection_set_exit_on_disconnect(connection, FALSE); - if ( (cs = connection_setup(connection, wh, eh, dh, wh_arg)) == 0L ) + if ( (connection_setup(connection, dbus, wh, eh, dh, wh_arg)) != ISC_R_SUCCESS) { if(eh)(*eh)("dbus_svc_init failed: connection_setup failed"); - return( 0L ); + return ISC_R_FAILURE; } if( name == 0L ) - return( cs ); + return ISC_R_SUCCESS; - cs->unique_name = dbus_bus_get_unique_name(connection); + (*dbus)->unique_name = dbus_bus_get_unique_name(connection); switch ( dbus_bus_request_name @@ -1102,19 +1105,19 @@ dbus_svc_init if(eh)(*eh)("dbus_svc_init: dbus_bus_request_name failed: %s %s", error.name, error.message); goto give_up; } - return ( cs ); + return ISC_R_SUCCESS; give_up: dbus_connection_close( connection ); dbus_connection_unref( connection ); - if( cs ) + if( *dbus ) { dbus_connection_set_dispatch_status_function (connection, NULL, NULL, NULL); dbus_connection_set_watch_functions (connection, NULL, NULL, NULL, NULL, NULL); dbus_connection_set_timeout_functions (connection, NULL, NULL, NULL, NULL, NULL); - free(cs); + free(*dbus); } - return ( 0L ); + return ISC_R_FAILURE; } const char *dbus_svc_unique_name(DBusConnectionState *cs) diff --git a/contrib/dbus/dbus_service.h b/contrib/dbus/dbus_service.h index 69e7faca..d8a21f18 100644 --- a/contrib/dbus/dbus_service.h +++ b/contrib/dbus/dbus_service.h @@ -3,6 +3,7 @@ * Provides utilities for construction of D-BUS "Services" * * Copyright(C) Jason Vas Dias, Red Hat Inc., 2005 + * Modified by Adam Tkac, Red Hat Inc., 2007 * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -22,6 +23,7 @@ #include <stdint.h> #include <stdarg.h> +#include <isc/types.h> typedef struct dbcs_s* DBUS_SVC; @@ -124,9 +126,10 @@ typedef dbus_svc_HandlerResult #define SHUTDOWN 255 -extern DBUS_SVC dbus_svc_init +extern isc_result_t dbus_svc_init ( dbus_svc_DBUS_TYPE bus, char *name, /* name to register with D-BUS */ + DBUS_SVC *dbus, /* dbus handle */ dbus_svc_WatchHandler wh, /* optional handler for watch events */ dbus_svc_ErrorHandler eh, /* optional error log message handler */ dbus_svc_ErrorHandler dh, /* optional debug / info log message handler */ diff --git a/contrib/queryperf/configure b/contrib/queryperf/configure index 89f56978..ed226629 100755 --- a/contrib/queryperf/configure +++ b/contrib/queryperf/configure @@ -1,19 +1,10 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.53. +# Generated by GNU Autoconf 2.59. # -# Copyright 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001, 2002 -# Free Software Foundation, Inc. +# Copyright (C) 2003 Free Software Foundation, Inc. # This configure script is free software; the Free Software Foundation # gives unlimited permission to copy, distribute and modify it. - -if expr a : '\(a\)' >/dev/null 2>&1; then - as_expr=expr -else - as_expr=false -fi - - ## --------------------- ## ## M4sh Initialization. ## ## --------------------- ## @@ -22,46 +13,57 @@ fi if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then emulate sh NULLCMD=: + # Zsh 3.x and 4.x performs word splitting on ${1+"$@"}, which + # is contrary to our usage. Disable this feature. + alias -g '${1+"$@"}'='"$@"' elif test -n "${BASH_VERSION+set}" && (set -o posix) >/dev/null 2>&1; then set -o posix fi +DUALCASE=1; export DUALCASE # for MKS sh -# NLS nuisances. # Support unset when possible. -if (FOO=FOO; unset FOO) >/dev/null 2>&1; then +if ( (MAIL=60; unset MAIL) || exit) >/dev/null 2>&1; then as_unset=unset else as_unset=false fi -(set +x; test -n "`(LANG=C; export LANG) 2>&1`") && - { $as_unset LANG || test "${LANG+set}" != set; } || - { LANG=C; export LANG; } -(set +x; test -n "`(LC_ALL=C; export LC_ALL) 2>&1`") && - { $as_unset LC_ALL || test "${LC_ALL+set}" != set; } || - { LC_ALL=C; export LC_ALL; } -(set +x; test -n "`(LC_TIME=C; export LC_TIME) 2>&1`") && - { $as_unset LC_TIME || test "${LC_TIME+set}" != set; } || - { LC_TIME=C; export LC_TIME; } -(set +x; test -n "`(LC_CTYPE=C; export LC_CTYPE) 2>&1`") && - { $as_unset LC_CTYPE || test "${LC_CTYPE+set}" != set; } || - { LC_CTYPE=C; export LC_CTYPE; } -(set +x; test -n "`(LANGUAGE=C; export LANGUAGE) 2>&1`") && - { $as_unset LANGUAGE || test "${LANGUAGE+set}" != set; } || - { LANGUAGE=C; export LANGUAGE; } -(set +x; test -n "`(LC_COLLATE=C; export LC_COLLATE) 2>&1`") && - { $as_unset LC_COLLATE || test "${LC_COLLATE+set}" != set; } || - { LC_COLLATE=C; export LC_COLLATE; } -(set +x; test -n "`(LC_NUMERIC=C; export LC_NUMERIC) 2>&1`") && - { $as_unset LC_NUMERIC || test "${LC_NUMERIC+set}" != set; } || - { LC_NUMERIC=C; export LC_NUMERIC; } -(set +x; test -n "`(LC_MESSAGES=C; export LC_MESSAGES) 2>&1`") && - { $as_unset LC_MESSAGES || test "${LC_MESSAGES+set}" != set; } || - { LC_MESSAGES=C; export LC_MESSAGES; } + +# Work around bugs in pre-3.0 UWIN ksh. +$as_unset ENV MAIL MAILPATH +PS1='$ ' +PS2='> ' +PS4='+ ' + +# NLS nuisances. +for as_var in \ + LANG LANGUAGE LC_ADDRESS LC_ALL LC_COLLATE LC_CTYPE LC_IDENTIFICATION \ + LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER \ + LC_TELEPHONE LC_TIME +do + if (set +x; test -z "`(eval $as_var=C; export $as_var) 2>&1`"); then + eval $as_var=C; export $as_var + else + $as_unset $as_var + fi +done + +# Required to use basename. +if expr a : '\(a\)' >/dev/null 2>&1; then + as_expr=expr +else + as_expr=false +fi + +if (basename /) >/dev/null 2>&1 && test "X`basename / 2>&1`" = "X/"; then + as_basename=basename +else + as_basename=false +fi # Name of the executable. -as_me=`(basename "$0") 2>/dev/null || +as_me=`$as_basename "$0" || $as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \ X"$0" : 'X\(//\)$' \| \ X"$0" : 'X\(/\)$' \| \ @@ -72,6 +74,7 @@ echo X/"$0" | /^X\/\(\/\).*/{ s//\1/; q; } s/.*/./; q'` + # PATH needs CR, and LINENO needs CR and PATH. # Avoid depending upon Character Ranges. as_cr_letters='abcdefghijklmnopqrstuvwxyz' @@ -82,15 +85,15 @@ as_cr_alnum=$as_cr_Letters$as_cr_digits # The user is always right. if test "${PATH_SEPARATOR+set}" != set; then - echo "#! /bin/sh" >conftest.sh - echo "exit 0" >>conftest.sh - chmod +x conftest.sh - if (PATH=".;."; conftest.sh) >/dev/null 2>&1; then + echo "#! /bin/sh" >conf$$.sh + echo "exit 0" >>conf$$.sh + chmod +x conf$$.sh + if (PATH="/nonexistent;."; conf$$.sh) >/dev/null 2>&1; then PATH_SEPARATOR=';' else PATH_SEPARATOR=: fi - rm -f conftest.sh + rm -f conf$$.sh fi @@ -138,6 +141,8 @@ do as_lineno_3=`(expr $as_lineno_1 + 1) 2>/dev/null` test "x$as_lineno_1" != "x$as_lineno_2" && test "x$as_lineno_3" = "x$as_lineno_2" ') 2>/dev/null; then + $as_unset BASH_ENV || test "${BASH_ENV+set}" != set || { BASH_ENV=; export BASH_ENV; } + $as_unset ENV || test "${ENV+set}" != set || { ENV=; export ENV; } CONFIG_SHELL=$as_dir/$as_base export CONFIG_SHELL exec "$CONFIG_SHELL" "$0" ${1+"$@"} @@ -210,13 +215,20 @@ else fi rm -f conf$$ conf$$.exe conf$$.file +if mkdir -p . 2>/dev/null; then + as_mkdir_p=: +else + test -d ./-p && rmdir ./-p + as_mkdir_p=false +fi + as_executable_p="test -f" # Sed expression to map a string onto a valid CPP name. -as_tr_cpp="sed y%*$as_cr_letters%P$as_cr_LETTERS%;s%[^_$as_cr_alnum]%_%g" +as_tr_cpp="eval sed 'y%*$as_cr_letters%P$as_cr_LETTERS%;s%[^_$as_cr_alnum]%_%g'" # Sed expression to map a string onto a valid variable name. -as_tr_sh="sed y%*+%pp%;s%[^_$as_cr_alnum]%_%g" +as_tr_sh="eval sed 'y%*+%pp%;s%[^_$as_cr_alnum]%_%g'" # IFS @@ -226,7 +238,7 @@ as_nl=' IFS=" $as_nl" # CDPATH. -$as_unset CDPATH || test "${CDPATH+set}" != set || { CDPATH=$PATH_SEPARATOR; export CDPATH; } +$as_unset CDPATH # Name of the host. @@ -240,6 +252,7 @@ exec 6>&1 # Initializations. # ac_default_prefix=/usr/local +ac_config_libobj_dir=. cross_compiling=no subdirs= MFLAGS= @@ -259,6 +272,8 @@ PACKAGE_STRING= PACKAGE_BUGREPORT= ac_unique_file="queryperf.c" +ac_subst_vars='SHELL PATH_SEPARATOR PACKAGE_NAME PACKAGE_TARNAME PACKAGE_VERSION PACKAGE_STRING PACKAGE_BUGREPORT exec_prefix prefix program_transform_name bindir sbindir libexecdir datadir sysconfdir sharedstatedir localstatedir libdir includedir oldincludedir infodir mandir build_alias host_alias target_alias DEFS ECHO_C ECHO_N ECHO_T LIBS CC CFLAGS LDFLAGS CPPFLAGS ac_ct_CC EXEEXT OBJEXT LIBOBJS LTLIBOBJS' +ac_subst_files='' # Initialize some variables set by options. ac_init_help= @@ -616,7 +631,7 @@ done # Be sure to have absolute paths. for ac_var in bindir sbindir libexecdir datadir sysconfdir sharedstatedir \ - localstatedir libdir includedir oldincludedir infodir mandir + localstatedir libdir includedir oldincludedir infodir mandir do eval ac_val=$`echo $ac_var` case $ac_val in @@ -656,10 +671,10 @@ if test -z "$srcdir"; then # Try the directory containing this script, then its parent. ac_confdir=`(dirname "$0") 2>/dev/null || $as_expr X"$0" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ - X"$0" : 'X\(//\)[^/]' \| \ - X"$0" : 'X\(//\)$' \| \ - X"$0" : 'X\(/\)' \| \ - . : '\(.\)' 2>/dev/null || + X"$0" : 'X\(//\)[^/]' \| \ + X"$0" : 'X\(//\)$' \| \ + X"$0" : 'X\(/\)' \| \ + . : '\(.\)' 2>/dev/null || echo X"$0" | sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/; q; } /^X\(\/\/\)[^/].*/{ s//\1/; q; } @@ -682,6 +697,9 @@ if test ! -r $srcdir/$ac_unique_file; then { (exit 1); exit 1; }; } fi fi +(cd $srcdir && test -r ./$ac_unique_file) 2>/dev/null || + { echo "$as_me: error: sources are in $srcdir, but \`cd $srcdir' does not work" >&2 + { (exit 1); exit 1; }; } srcdir=`echo "$srcdir" | sed 's%\([^\\/]\)[\\/]*$%\1%'` ac_env_build_alias_set=${build_alias+set} ac_env_build_alias_value=$build_alias @@ -744,9 +762,9 @@ _ACEOF cat <<_ACEOF Installation directories: --prefix=PREFIX install architecture-independent files in PREFIX - [$ac_default_prefix] + [$ac_default_prefix] --exec-prefix=EPREFIX install architecture-dependent files in EPREFIX - [PREFIX] + [PREFIX] By default, \`make install' will install all the files in \`$ac_default_prefix/bin', \`$ac_default_prefix/lib' etc. You can specify @@ -822,12 +840,45 @@ case $srcdir in ac_srcdir=$ac_top_builddir$srcdir$ac_dir_suffix ac_top_srcdir=$ac_top_builddir$srcdir ;; esac -# Don't blindly perform a `cd "$ac_dir"/$ac_foo && pwd` since $ac_foo can be -# absolute. -ac_abs_builddir=`cd "$ac_dir" && cd $ac_builddir && pwd` -ac_abs_top_builddir=`cd "$ac_dir" && cd $ac_top_builddir && pwd` -ac_abs_srcdir=`cd "$ac_dir" && cd $ac_srcdir && pwd` -ac_abs_top_srcdir=`cd "$ac_dir" && cd $ac_top_srcdir && pwd` + +# Do not use `cd foo && pwd` to compute absolute paths, because +# the directories may not exist. +case `pwd` in +.) ac_abs_builddir="$ac_dir";; +*) + case "$ac_dir" in + .) ac_abs_builddir=`pwd`;; + [\\/]* | ?:[\\/]* ) ac_abs_builddir="$ac_dir";; + *) ac_abs_builddir=`pwd`/"$ac_dir";; + esac;; +esac +case $ac_abs_builddir in +.) ac_abs_top_builddir=${ac_top_builddir}.;; +*) + case ${ac_top_builddir}. in + .) ac_abs_top_builddir=$ac_abs_builddir;; + [\\/]* | ?:[\\/]* ) ac_abs_top_builddir=${ac_top_builddir}.;; + *) ac_abs_top_builddir=$ac_abs_builddir/${ac_top_builddir}.;; + esac;; +esac +case $ac_abs_builddir in +.) ac_abs_srcdir=$ac_srcdir;; +*) + case $ac_srcdir in + .) ac_abs_srcdir=$ac_abs_builddir;; + [\\/]* | ?:[\\/]* ) ac_abs_srcdir=$ac_srcdir;; + *) ac_abs_srcdir=$ac_abs_builddir/$ac_srcdir;; + esac;; +esac +case $ac_abs_builddir in +.) ac_abs_top_srcdir=$ac_top_srcdir;; +*) + case $ac_top_srcdir in + .) ac_abs_top_srcdir=$ac_abs_builddir;; + [\\/]* | ?:[\\/]* ) ac_abs_top_srcdir=$ac_top_srcdir;; + *) ac_abs_top_srcdir=$ac_abs_builddir/$ac_top_srcdir;; + esac;; +esac cd $ac_dir # Check for guested configure; otherwise get Cygnus style configure. @@ -838,7 +889,7 @@ ac_abs_top_srcdir=`cd "$ac_dir" && cd $ac_top_srcdir && pwd` echo $SHELL $ac_srcdir/configure --help=recursive elif test -f $ac_srcdir/configure.ac || - test -f $ac_srcdir/configure.in; then + test -f $ac_srcdir/configure.in; then echo $ac_configure --help else @@ -852,8 +903,7 @@ test -n "$ac_init_help" && exit 0 if $ac_init_version; then cat <<\_ACEOF -Copyright 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001, 2002 -Free Software Foundation, Inc. +Copyright (C) 2003 Free Software Foundation, Inc. This configure script is free software; the Free Software Foundation gives unlimited permission to copy, distribute and modify it. _ACEOF @@ -865,7 +915,7 @@ This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. It was created by $as_me, which was -generated by GNU Autoconf 2.53. Invocation command line was +generated by GNU Autoconf 2.59. Invocation command line was $ $0 $@ @@ -917,27 +967,54 @@ _ACEOF # Keep a trace of the command line. # Strip out --no-create and --no-recursion so they do not pile up. +# Strip out --silent because we don't want to record it for future runs. # Also quote any args containing shell meta-characters. +# Make two passes to allow for proper duplicate-argument suppression. ac_configure_args= +ac_configure_args0= +ac_configure_args1= ac_sep= -for ac_arg +ac_must_keep_next=false +for ac_pass in 1 2 do - case $ac_arg in - -no-create | --no-create | --no-creat | --no-crea | --no-cre \ - | --no-cr | --no-c | -n ) continue ;; - -no-recursion | --no-recursion | --no-recursio | --no-recursi \ - | --no-recurs | --no-recur | --no-recu | --no-rec | --no-re | --no-r) - continue ;; - *" "*|*" "*|*[\[\]\~\#\$\^\&\*\(\)\{\}\\\|\;\<\>\?\"\']*) - ac_arg=`echo "$ac_arg" | sed "s/'/'\\\\\\\\''/g"` ;; - esac - case " $ac_configure_args " in - *" '$ac_arg' "*) ;; # Avoid dups. Use of quotes ensures accuracy. - *) ac_configure_args="$ac_configure_args$ac_sep'$ac_arg'" - ac_sep=" " ;; - esac - # Get rid of the leading space. + for ac_arg + do + case $ac_arg in + -no-create | --no-c* | -n | -no-recursion | --no-r*) continue ;; + -q | -quiet | --quiet | --quie | --qui | --qu | --q \ + | -silent | --silent | --silen | --sile | --sil) + continue ;; + *" "*|*" "*|*[\[\]\~\#\$\^\&\*\(\)\{\}\\\|\;\<\>\?\"\']*) + ac_arg=`echo "$ac_arg" | sed "s/'/'\\\\\\\\''/g"` ;; + esac + case $ac_pass in + 1) ac_configure_args0="$ac_configure_args0 '$ac_arg'" ;; + 2) + ac_configure_args1="$ac_configure_args1 '$ac_arg'" + if test $ac_must_keep_next = true; then + ac_must_keep_next=false # Got value, back to normal. + else + case $ac_arg in + *=* | --config-cache | -C | -disable-* | --disable-* \ + | -enable-* | --enable-* | -gas | --g* | -nfp | --nf* \ + | -q | -quiet | --q* | -silent | --sil* | -v | -verb* \ + | -with-* | --with-* | -without-* | --without-* | --x) + case "$ac_configure_args0 " in + "$ac_configure_args1"*" '$ac_arg' "* ) continue ;; + esac + ;; + -* ) ac_must_keep_next=true ;; + esac + fi + ac_configure_args="$ac_configure_args$ac_sep'$ac_arg'" + # Get rid of the leading space. + ac_sep=" " + ;; + esac + done done +$as_unset ac_configure_args0 || test "${ac_configure_args0+set}" != set || { ac_configure_args0=; export ac_configure_args0; } +$as_unset ac_configure_args1 || test "${ac_configure_args1+set}" != set || { ac_configure_args1=; export ac_configure_args1; } # When interrupted or exit'd, cleanup temporary files, and complete # config.log. We remove comments because anyway the quotes in there @@ -948,6 +1025,7 @@ trap 'exit_status=$? # Save into config.log some information that might help in debugging. { echo + cat <<\_ASBOX ## ---------------- ## ## Cache variables. ## @@ -960,16 +1038,45 @@ _ASBOX case `(ac_space='"'"' '"'"'; set | grep ac_space) 2>&1` in *ac_space=\ *) sed -n \ - "s/'"'"'/'"'"'\\\\'"'"''"'"'/g; - s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1='"'"'\\2'"'"'/p" + "s/'"'"'/'"'"'\\\\'"'"''"'"'/g; + s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1='"'"'\\2'"'"'/p" ;; *) sed -n \ - "s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1=\\2/p" + "s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1=\\2/p" ;; esac; } echo + + cat <<\_ASBOX +## ----------------- ## +## Output variables. ## +## ----------------- ## +_ASBOX + echo + for ac_var in $ac_subst_vars + do + eval ac_val=$`echo $ac_var` + echo "$ac_var='"'"'$ac_val'"'"'" + done | sort + echo + + if test -n "$ac_subst_files"; then + cat <<\_ASBOX +## ------------- ## +## Output files. ## +## ------------- ## +_ASBOX + echo + for ac_var in $ac_subst_files + do + eval ac_val=$`echo $ac_var` + echo "$ac_var='"'"'$ac_val'"'"'" + done | sort + echo + fi + if test -s confdefs.h; then cat <<\_ASBOX ## ----------- ## @@ -977,14 +1084,14 @@ _ASBOX ## ----------- ## _ASBOX echo - sed "/^$/d" confdefs.h + sed "/^$/d" confdefs.h | sort echo fi test "$ac_signal" != 0 && echo "$as_me: caught signal $ac_signal" echo "$as_me: exit $exit_status" } >&5 - rm -f core core.* *.core && + rm -f core *.core && rm -rf conftest* confdefs* conf$$* $ac_clean_files && exit $exit_status ' 0 @@ -1064,7 +1171,7 @@ fi # value. ac_cache_corrupted=false for ac_var in `(set) 2>&1 | - sed -n 's/^ac_env_\([a-zA-Z_0-9]*\)_set=.*/\1/p'`; do + sed -n 's/^ac_env_\([a-zA-Z_0-9]*\)_set=.*/\1/p'`; do eval ac_old_set=\$ac_cv_env_${ac_var}_set eval ac_new_set=\$ac_env_${ac_var}_set eval ac_old_val="\$ac_cv_env_${ac_var}_value" @@ -1081,13 +1188,13 @@ echo "$as_me: error: \`$ac_var' was not set in the previous run" >&2;} ,);; *) if test "x$ac_old_val" != "x$ac_new_val"; then - { echo "$as_me:$LINENO: error: \`$ac_var' has changed since the previous run:" >&5 + { echo "$as_me:$LINENO: error: \`$ac_var' has changed since the previous run:" >&5 echo "$as_me: error: \`$ac_var' has changed since the previous run:" >&2;} - { echo "$as_me:$LINENO: former value: $ac_old_val" >&5 + { echo "$as_me:$LINENO: former value: $ac_old_val" >&5 echo "$as_me: former value: $ac_old_val" >&2;} - { echo "$as_me:$LINENO: current value: $ac_new_val" >&5 + { echo "$as_me:$LINENO: current value: $ac_new_val" >&5 echo "$as_me: current value: $ac_new_val" >&2;} - ac_cache_corrupted=: + ac_cache_corrupted=: fi;; esac # Pass precious variables to config.status. @@ -1137,6 +1244,7 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu + ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' @@ -1341,9 +1449,7 @@ if test $ac_prog_rejected = yes; then # However, it has the same basename, so the bogon will be chosen # first if we set CC to just the basename; use the full file name. shift - set dummy "$as_dir/$ac_word" ${1+"$@"} - shift - ac_cv_prog_CC="$@" + ac_cv_prog_CC="$as_dir/$ac_word${1+' '}$@" fi fi fi @@ -1448,8 +1554,10 @@ fi fi -test -z "$CC" && { { echo "$as_me:$LINENO: error: no acceptable C compiler found in \$PATH" >&5 -echo "$as_me: error: no acceptable C compiler found in \$PATH" >&2;} +test -z "$CC" && { { echo "$as_me:$LINENO: error: no acceptable C compiler found in \$PATH +See \`config.log' for more details." >&5 +echo "$as_me: error: no acceptable C compiler found in \$PATH +See \`config.log' for more details." >&2;} { (exit 1); exit 1; }; } # Provide some information about the compiler. @@ -1473,15 +1581,12 @@ ac_compiler=`set X $ac_compile; echo $2` (exit $ac_status); } cat >conftest.$ac_ext <<_ACEOF -#line $LINENO "configure" -#include "confdefs.h" - -#ifdef F77_DUMMY_MAIN -# ifdef __cplusplus - extern "C" -# endif - int F77_DUMMY_MAIN() { return 1; } -#endif +/* confdefs.h. */ +_ACEOF +cat confdefs.h >>conftest.$ac_ext +cat >>conftest.$ac_ext <<_ACEOF +/* end confdefs.h. */ + int main () { @@ -1491,12 +1596,12 @@ main () } _ACEOF ac_clean_files_save=$ac_clean_files -ac_clean_files="$ac_clean_files a.out a.exe" +ac_clean_files="$ac_clean_files a.out a.exe b.out" # Try to create an executable without -o first, disregard a.out. # It will help us diagnose broken compilers, and finding out an intuition # of exeext. -echo "$as_me:$LINENO: checking for C compiler default output" >&5 -echo $ECHO_N "checking for C compiler default output... $ECHO_C" >&6 +echo "$as_me:$LINENO: checking for C compiler default output file name" >&5 +echo $ECHO_N "checking for C compiler default output file name... $ECHO_C" >&6 ac_link_default=`echo "$ac_link" | sed 's/ -o *conftest[^ ]*//'` if { (eval echo "$as_me:$LINENO: \"$ac_link_default\"") >&5 (eval $ac_link_default) 2>&5 @@ -1510,26 +1615,39 @@ if { (eval echo "$as_me:$LINENO: \"$ac_link_default\"") >&5 # Be careful to initialize this variable, since it used to be cached. # Otherwise an old cache value of `no' led to `EXEEXT = no' in a Makefile. ac_cv_exeext= -for ac_file in `ls a_out.exe a.exe conftest.exe 2>/dev/null; - ls a.out conftest 2>/dev/null; - ls a.* conftest.* 2>/dev/null`; do +# b.out is created by i960 compilers. +for ac_file in a_out.exe a.exe conftest.exe a.out conftest a.* conftest.* b.out +do + test -f "$ac_file" || continue case $ac_file in - *.$ac_ext | *.o | *.obj | *.xcoff | *.tds | *.d | *.pdb | *.xSYM ) ;; - a.out ) # We found the default executable, but exeext='' is most - # certainly right. - break;; - *.* ) ac_cv_exeext=`expr "$ac_file" : '[^.]*\(\..*\)'` - # FIXME: I believe we export ac_cv_exeext for Libtool --akim. - export ac_cv_exeext - break;; - * ) break;; + *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.o | *.obj ) + ;; + conftest.$ac_ext ) + # This is the source file. + ;; + [ab].out ) + # We found the default executable, but exeext='' is most + # certainly right. + break;; + *.* ) + ac_cv_exeext=`expr "$ac_file" : '[^.]*\(\..*\)'` + # FIXME: I believe we export ac_cv_exeext for Libtool, + # but it would be cool to find out if it's true. Does anybody + # maintain Libtool? --akim. + export ac_cv_exeext + break;; + * ) + break;; esac done else echo "$as_me: failed program was:" >&5 -cat conftest.$ac_ext >&5 -{ { echo "$as_me:$LINENO: error: C compiler cannot create executables" >&5 -echo "$as_me: error: C compiler cannot create executables" >&2;} +sed 's/^/| /' conftest.$ac_ext >&5 + +{ { echo "$as_me:$LINENO: error: C compiler cannot create executables +See \`config.log' for more details." >&5 +echo "$as_me: error: C compiler cannot create executables +See \`config.log' for more details." >&2;} { (exit 77); exit 77; }; } fi @@ -1556,9 +1674,11 @@ if test "$cross_compiling" != yes; then cross_compiling=yes else { { echo "$as_me:$LINENO: error: cannot run C compiled programs. -If you meant to cross compile, use \`--host'." >&5 +If you meant to cross compile, use \`--host'. +See \`config.log' for more details." >&5 echo "$as_me: error: cannot run C compiled programs. -If you meant to cross compile, use \`--host'." >&2;} +If you meant to cross compile, use \`--host'. +See \`config.log' for more details." >&2;} { (exit 1); exit 1; }; } fi fi @@ -1566,7 +1686,7 @@ fi echo "$as_me:$LINENO: result: yes" >&5 echo "${ECHO_T}yes" >&6 -rm -f a.out a.exe conftest$ac_cv_exeext +rm -f a.out a.exe conftest$ac_cv_exeext b.out ac_clean_files=$ac_clean_files_save # Check the compiler produces executables we can run. If not, either # the compiler is broken, or we cross compile. @@ -1586,18 +1706,21 @@ if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5 # catch `conftest.exe'. For instance with Cygwin, `ls conftest' will # work properly (i.e., refer to `conftest.exe'), while it won't with # `rm'. -for ac_file in `(ls conftest.exe; ls conftest; ls conftest.*) 2>/dev/null`; do +for ac_file in conftest.exe conftest conftest.*; do + test -f "$ac_file" || continue case $ac_file in - *.$ac_ext | *.o | *.obj | *.xcoff | *.tds | *.d | *.pdb ) ;; + *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.o | *.obj ) ;; *.* ) ac_cv_exeext=`expr "$ac_file" : '[^.]*\(\..*\)'` - export ac_cv_exeext - break;; + export ac_cv_exeext + break;; * ) break;; esac done else - { { echo "$as_me:$LINENO: error: cannot compute suffix of executables: cannot compile and link" >&5 -echo "$as_me: error: cannot compute suffix of executables: cannot compile and link" >&2;} + { { echo "$as_me:$LINENO: error: cannot compute suffix of executables: cannot compile and link +See \`config.log' for more details." >&5 +echo "$as_me: error: cannot compute suffix of executables: cannot compile and link +See \`config.log' for more details." >&2;} { (exit 1); exit 1; }; } fi @@ -1614,15 +1737,12 @@ if test "${ac_cv_objext+set}" = set; then echo $ECHO_N "(cached) $ECHO_C" >&6 else cat >conftest.$ac_ext <<_ACEOF -#line $LINENO "configure" -#include "confdefs.h" - -#ifdef F77_DUMMY_MAIN -# ifdef __cplusplus - extern "C" -# endif - int F77_DUMMY_MAIN() { return 1; } -#endif +/* confdefs.h. */ +_ACEOF +cat confdefs.h >>conftest.$ac_ext +cat >>conftest.$ac_ext <<_ACEOF +/* end confdefs.h. */ + int main () { @@ -1639,16 +1759,19 @@ if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5 (exit $ac_status); }; then for ac_file in `(ls conftest.o conftest.obj; ls conftest.*) 2>/dev/null`; do case $ac_file in - *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb ) ;; + *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg ) ;; *) ac_cv_objext=`expr "$ac_file" : '.*\.\(.*\)'` break;; esac done else echo "$as_me: failed program was:" >&5 -cat conftest.$ac_ext >&5 -{ { echo "$as_me:$LINENO: error: cannot compute suffix of object files: cannot compile" >&5 -echo "$as_me: error: cannot compute suffix of object files: cannot compile" >&2;} +sed 's/^/| /' conftest.$ac_ext >&5 + +{ { echo "$as_me:$LINENO: error: cannot compute suffix of object files: cannot compile +See \`config.log' for more details." >&5 +echo "$as_me: error: cannot compute suffix of object files: cannot compile +See \`config.log' for more details." >&2;} { (exit 1); exit 1; }; } fi @@ -1664,15 +1787,12 @@ if test "${ac_cv_c_compiler_gnu+set}" = set; then echo $ECHO_N "(cached) $ECHO_C" >&6 else cat >conftest.$ac_ext <<_ACEOF -#line $LINENO "configure" -#include "confdefs.h" - -#ifdef F77_DUMMY_MAIN -# ifdef __cplusplus - extern "C" -# endif - int F77_DUMMY_MAIN() { return 1; } -#endif +/* confdefs.h. */ +_ACEOF +cat confdefs.h >>conftest.$ac_ext +cat >>conftest.$ac_ext <<_ACEOF +/* end confdefs.h. */ + int main () { @@ -1686,11 +1806,21 @@ main () _ACEOF rm -f conftest.$ac_objext if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5 - (eval $ac_compile) 2>&5 + (eval $ac_compile) 2>conftest.er1 ac_status=$? + grep -v '^ *+' conftest.er1 >conftest.err + rm -f conftest.er1 + cat conftest.err >&5 echo "$as_me:$LINENO: \$? = $ac_status" >&5 (exit $ac_status); } && - { ac_try='test -s conftest.$ac_objext' + { ac_try='test -z "$ac_c_werror_flag" + || test ! -s conftest.err' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; } && + { ac_try='test -s conftest.$ac_objext' { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 (eval $ac_try) 2>&5 ac_status=$? @@ -1699,10 +1829,11 @@ if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5 ac_compiler_gnu=yes else echo "$as_me: failed program was:" >&5 -cat conftest.$ac_ext >&5 +sed 's/^/| /' conftest.$ac_ext >&5 + ac_compiler_gnu=no fi -rm -f conftest.$ac_objext conftest.$ac_ext +rm -f conftest.err conftest.$ac_objext conftest.$ac_ext ac_cv_c_compiler_gnu=$ac_compiler_gnu fi @@ -1718,15 +1849,12 @@ if test "${ac_cv_prog_cc_g+set}" = set; then echo $ECHO_N "(cached) $ECHO_C" >&6 else cat >conftest.$ac_ext <<_ACEOF -#line $LINENO "configure" -#include "confdefs.h" - -#ifdef F77_DUMMY_MAIN -# ifdef __cplusplus - extern "C" -# endif - int F77_DUMMY_MAIN() { return 1; } -#endif +/* confdefs.h. */ +_ACEOF +cat confdefs.h >>conftest.$ac_ext +cat >>conftest.$ac_ext <<_ACEOF +/* end confdefs.h. */ + int main () { @@ -1737,11 +1865,21 @@ main () _ACEOF rm -f conftest.$ac_objext if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5 - (eval $ac_compile) 2>&5 + (eval $ac_compile) 2>conftest.er1 ac_status=$? + grep -v '^ *+' conftest.er1 >conftest.err + rm -f conftest.er1 + cat conftest.err >&5 echo "$as_me:$LINENO: \$? = $ac_status" >&5 (exit $ac_status); } && - { ac_try='test -s conftest.$ac_objext' + { ac_try='test -z "$ac_c_werror_flag" + || test ! -s conftest.err' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; } && + { ac_try='test -s conftest.$ac_objext' { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 (eval $ac_try) 2>&5 ac_status=$? @@ -1750,10 +1888,11 @@ if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5 ac_cv_prog_cc_g=yes else echo "$as_me: failed program was:" >&5 -cat conftest.$ac_ext >&5 +sed 's/^/| /' conftest.$ac_ext >&5 + ac_cv_prog_cc_g=no fi -rm -f conftest.$ac_objext conftest.$ac_ext +rm -f conftest.err conftest.$ac_objext conftest.$ac_ext fi echo "$as_me:$LINENO: result: $ac_cv_prog_cc_g" >&5 echo "${ECHO_T}$ac_cv_prog_cc_g" >&6 @@ -1772,6 +1911,121 @@ else CFLAGS= fi fi +echo "$as_me:$LINENO: checking for $CC option to accept ANSI C" >&5 +echo $ECHO_N "checking for $CC option to accept ANSI C... $ECHO_C" >&6 +if test "${ac_cv_prog_cc_stdc+set}" = set; then + echo $ECHO_N "(cached) $ECHO_C" >&6 +else + ac_cv_prog_cc_stdc=no +ac_save_CC=$CC +cat >conftest.$ac_ext <<_ACEOF +/* confdefs.h. */ +_ACEOF +cat confdefs.h >>conftest.$ac_ext +cat >>conftest.$ac_ext <<_ACEOF +/* end confdefs.h. */ +#include <stdarg.h> +#include <stdio.h> +#include <sys/types.h> +#include <sys/stat.h> +/* Most of the following tests are stolen from RCS 5.7's src/conf.sh. */ +struct buf { int x; }; +FILE * (*rcsopen) (struct buf *, struct stat *, int); +static char *e (p, i) + char **p; + int i; +{ + return p[i]; +} +static char *f (char * (*g) (char **, int), char **p, ...) +{ + char *s; + va_list v; + va_start (v,p); + s = g (p, va_arg (v,int)); + va_end (v); + return s; +} + +/* OSF 4.0 Compaq cc is some sort of almost-ANSI by default. It has + function prototypes and stuff, but not '\xHH' hex character constants. + These don't provoke an error unfortunately, instead are silently treated + as 'x'. The following induces an error, until -std1 is added to get + proper ANSI mode. Curiously '\x00'!='x' always comes out true, for an + array size at least. It's necessary to write '\x00'==0 to get something + that's true only with -std1. */ +int osf4_cc_array ['\x00' == 0 ? 1 : -1]; + +int test (int i, double x); +struct s1 {int (*f) (int a);}; +struct s2 {int (*f) (double a);}; +int pairnames (int, char **, FILE *(*)(struct buf *, struct stat *, int), int, int); +int argc; +char **argv; +int +main () +{ +return f (e, argv, 0) != argv[0] || f (e, argv, 1) != argv[1]; + ; + return 0; +} +_ACEOF +# Don't try gcc -ansi; that turns off useful extensions and +# breaks some systems' header files. +# AIX -qlanglvl=ansi +# Ultrix and OSF/1 -std1 +# HP-UX 10.20 and later -Ae +# HP-UX older versions -Aa -D_HPUX_SOURCE +# SVR4 -Xc -D__EXTENSIONS__ +for ac_arg in "" -qlanglvl=ansi -std1 -Ae "-Aa -D_HPUX_SOURCE" "-Xc -D__EXTENSIONS__" +do + CC="$ac_save_CC $ac_arg" + rm -f conftest.$ac_objext +if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5 + (eval $ac_compile) 2>conftest.er1 + ac_status=$? + grep -v '^ *+' conftest.er1 >conftest.err + rm -f conftest.er1 + cat conftest.err >&5 + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); } && + { ac_try='test -z "$ac_c_werror_flag" + || test ! -s conftest.err' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; } && + { ac_try='test -s conftest.$ac_objext' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; }; then + ac_cv_prog_cc_stdc=$ac_arg +break +else + echo "$as_me: failed program was:" >&5 +sed 's/^/| /' conftest.$ac_ext >&5 + +fi +rm -f conftest.err conftest.$ac_objext +done +rm -f conftest.$ac_ext conftest.$ac_objext +CC=$ac_save_CC + +fi + +case "x$ac_cv_prog_cc_stdc" in + x|xno) + echo "$as_me:$LINENO: result: none needed" >&5 +echo "${ECHO_T}none needed" >&6 ;; + *) + echo "$as_me:$LINENO: result: $ac_cv_prog_cc_stdc" >&5 +echo "${ECHO_T}$ac_cv_prog_cc_stdc" >&6 + CC="$CC $ac_cv_prog_cc_stdc" ;; +esac + # Some people use a C++ compiler to compile C. Since we use `exit', # in C++ we need to declare it. In case someone uses the same compiler # for both compiling C and C++ we need to have the C++ compiler decide @@ -1783,19 +2037,28 @@ cat >conftest.$ac_ext <<_ACEOF _ACEOF rm -f conftest.$ac_objext if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5 - (eval $ac_compile) 2>&5 + (eval $ac_compile) 2>conftest.er1 ac_status=$? + grep -v '^ *+' conftest.er1 >conftest.err + rm -f conftest.er1 + cat conftest.err >&5 echo "$as_me:$LINENO: \$? = $ac_status" >&5 (exit $ac_status); } && - { ac_try='test -s conftest.$ac_objext' + { ac_try='test -z "$ac_c_werror_flag" + || test ! -s conftest.err' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; } && + { ac_try='test -s conftest.$ac_objext' { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 (eval $ac_try) 2>&5 ac_status=$? echo "$as_me:$LINENO: \$? = $ac_status" >&5 (exit $ac_status); }; }; then for ac_declaration in \ - ''\ - '#include <stdlib.h>' \ + '' \ 'extern "C" void std::exit (int) throw (); using std::exit;' \ 'extern "C" void std::exit (int); using std::exit;' \ 'extern "C" void exit (int) throw ();' \ @@ -1803,16 +2066,13 @@ if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5 'void exit (int);' do cat >conftest.$ac_ext <<_ACEOF -#line $LINENO "configure" -#include "confdefs.h" -#include <stdlib.h> +/* confdefs.h. */ +_ACEOF +cat confdefs.h >>conftest.$ac_ext +cat >>conftest.$ac_ext <<_ACEOF +/* end confdefs.h. */ $ac_declaration -#ifdef F77_DUMMY_MAIN -# ifdef __cplusplus - extern "C" -# endif - int F77_DUMMY_MAIN() { return 1; } -#endif +#include <stdlib.h> int main () { @@ -1823,11 +2083,21 @@ exit (42); _ACEOF rm -f conftest.$ac_objext if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5 - (eval $ac_compile) 2>&5 + (eval $ac_compile) 2>conftest.er1 ac_status=$? + grep -v '^ *+' conftest.er1 >conftest.err + rm -f conftest.er1 + cat conftest.err >&5 echo "$as_me:$LINENO: \$? = $ac_status" >&5 (exit $ac_status); } && - { ac_try='test -s conftest.$ac_objext' + { ac_try='test -z "$ac_c_werror_flag" + || test ! -s conftest.err' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; } && + { ac_try='test -s conftest.$ac_objext' { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 (eval $ac_try) 2>&5 ac_status=$? @@ -1836,20 +2106,18 @@ if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5 : else echo "$as_me: failed program was:" >&5 -cat conftest.$ac_ext >&5 +sed 's/^/| /' conftest.$ac_ext >&5 + continue fi -rm -f conftest.$ac_objext conftest.$ac_ext +rm -f conftest.err conftest.$ac_objext conftest.$ac_ext cat >conftest.$ac_ext <<_ACEOF -#line $LINENO "configure" -#include "confdefs.h" +/* confdefs.h. */ +_ACEOF +cat confdefs.h >>conftest.$ac_ext +cat >>conftest.$ac_ext <<_ACEOF +/* end confdefs.h. */ $ac_declaration -#ifdef F77_DUMMY_MAIN -# ifdef __cplusplus - extern "C" -# endif - int F77_DUMMY_MAIN() { return 1; } -#endif int main () { @@ -1860,11 +2128,21 @@ exit (42); _ACEOF rm -f conftest.$ac_objext if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5 - (eval $ac_compile) 2>&5 + (eval $ac_compile) 2>conftest.er1 ac_status=$? + grep -v '^ *+' conftest.er1 >conftest.err + rm -f conftest.er1 + cat conftest.err >&5 echo "$as_me:$LINENO: \$? = $ac_status" >&5 (exit $ac_status); } && - { ac_try='test -s conftest.$ac_objext' + { ac_try='test -z "$ac_c_werror_flag" + || test ! -s conftest.err' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; } && + { ac_try='test -s conftest.$ac_objext' { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 (eval $ac_try) 2>&5 ac_status=$? @@ -1873,9 +2151,10 @@ if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5 break else echo "$as_me: failed program was:" >&5 -cat conftest.$ac_ext >&5 +sed 's/^/| /' conftest.$ac_ext >&5 + fi -rm -f conftest.$ac_objext conftest.$ac_ext +rm -f conftest.err conftest.$ac_objext conftest.$ac_ext done rm -f conftest* if test -n "$ac_declaration"; then @@ -1886,9 +2165,10 @@ fi else echo "$as_me: failed program was:" >&5 -cat conftest.$ac_ext >&5 +sed 's/^/| /' conftest.$ac_ext >&5 + fi -rm -f conftest.$ac_objext conftest.$ac_ext +rm -f conftest.err conftest.$ac_objext conftest.$ac_ext ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' @@ -1900,6 +2180,8 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu + ac_config_headers="$ac_config_headers config.h" + echo "$as_me:$LINENO: checking for library containing res_mkquery" >&5 echo $ECHO_N "checking for library containing res_mkquery... $ECHO_C" >&6 @@ -1909,8 +2191,11 @@ else ac_func_search_save_LIBS=$LIBS ac_cv_search_res_mkquery=no cat >conftest.$ac_ext <<_ACEOF -#line $LINENO "configure" -#include "confdefs.h" +/* confdefs.h. */ +_ACEOF +cat confdefs.h >>conftest.$ac_ext +cat >>conftest.$ac_ext <<_ACEOF +/* end confdefs.h. */ /* Override any gcc2 internal prototype to avoid an error. */ #ifdef __cplusplus @@ -1919,12 +2204,6 @@ extern "C" /* We use char because int might match the return type of a gcc2 builtin and then its argument prototype would still apply. */ char res_mkquery (); -#ifdef F77_DUMMY_MAIN -# ifdef __cplusplus - extern "C" -# endif - int F77_DUMMY_MAIN() { return 1; } -#endif int main () { @@ -1935,11 +2214,21 @@ res_mkquery (); _ACEOF rm -f conftest.$ac_objext conftest$ac_exeext if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5 - (eval $ac_link) 2>&5 + (eval $ac_link) 2>conftest.er1 ac_status=$? + grep -v '^ *+' conftest.er1 >conftest.err + rm -f conftest.er1 + cat conftest.err >&5 echo "$as_me:$LINENO: \$? = $ac_status" >&5 (exit $ac_status); } && - { ac_try='test -s conftest$ac_exeext' + { ac_try='test -z "$ac_c_werror_flag" + || test ! -s conftest.err' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; } && + { ac_try='test -s conftest$ac_exeext' { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 (eval $ac_try) 2>&5 ac_status=$? @@ -1948,15 +2237,20 @@ if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5 ac_cv_search_res_mkquery="none required" else echo "$as_me: failed program was:" >&5 -cat conftest.$ac_ext >&5 +sed 's/^/| /' conftest.$ac_ext >&5 + fi -rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext +rm -f conftest.err conftest.$ac_objext \ + conftest$ac_exeext conftest.$ac_ext if test "$ac_cv_search_res_mkquery" = no; then for ac_lib in resolv bind; do LIBS="-l$ac_lib $ac_func_search_save_LIBS" cat >conftest.$ac_ext <<_ACEOF -#line $LINENO "configure" -#include "confdefs.h" +/* confdefs.h. */ +_ACEOF +cat confdefs.h >>conftest.$ac_ext +cat >>conftest.$ac_ext <<_ACEOF +/* end confdefs.h. */ /* Override any gcc2 internal prototype to avoid an error. */ #ifdef __cplusplus @@ -1965,12 +2259,6 @@ extern "C" /* We use char because int might match the return type of a gcc2 builtin and then its argument prototype would still apply. */ char res_mkquery (); -#ifdef F77_DUMMY_MAIN -# ifdef __cplusplus - extern "C" -# endif - int F77_DUMMY_MAIN() { return 1; } -#endif int main () { @@ -1981,11 +2269,21 @@ res_mkquery (); _ACEOF rm -f conftest.$ac_objext conftest$ac_exeext if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5 - (eval $ac_link) 2>&5 + (eval $ac_link) 2>conftest.er1 ac_status=$? + grep -v '^ *+' conftest.er1 >conftest.err + rm -f conftest.er1 + cat conftest.err >&5 echo "$as_me:$LINENO: \$? = $ac_status" >&5 (exit $ac_status); } && - { ac_try='test -s conftest$ac_exeext' + { ac_try='test -z "$ac_c_werror_flag" + || test ! -s conftest.err' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; } && + { ac_try='test -s conftest$ac_exeext' { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 (eval $ac_try) 2>&5 ac_status=$? @@ -1995,9 +2293,11 @@ if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5 break else echo "$as_me: failed program was:" >&5 -cat conftest.$ac_ext >&5 +sed 's/^/| /' conftest.$ac_ext >&5 + fi -rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext +rm -f conftest.err conftest.$ac_objext \ + conftest$ac_exeext conftest.$ac_ext done fi LIBS=$ac_func_search_save_LIBS @@ -2009,6 +2309,132 @@ if test "$ac_cv_search_res_mkquery" != no; then fi +echo "$as_me:$LINENO: checking for library containing __res_mkquery" >&5 +echo $ECHO_N "checking for library containing __res_mkquery... $ECHO_C" >&6 +if test "${ac_cv_search___res_mkquery+set}" = set; then + echo $ECHO_N "(cached) $ECHO_C" >&6 +else + ac_func_search_save_LIBS=$LIBS +ac_cv_search___res_mkquery=no +cat >conftest.$ac_ext <<_ACEOF +/* confdefs.h. */ +_ACEOF +cat confdefs.h >>conftest.$ac_ext +cat >>conftest.$ac_ext <<_ACEOF +/* end confdefs.h. */ + +/* Override any gcc2 internal prototype to avoid an error. */ +#ifdef __cplusplus +extern "C" +#endif +/* We use char because int might match the return type of a gcc2 + builtin and then its argument prototype would still apply. */ +char __res_mkquery (); +int +main () +{ +__res_mkquery (); + ; + return 0; +} +_ACEOF +rm -f conftest.$ac_objext conftest$ac_exeext +if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5 + (eval $ac_link) 2>conftest.er1 + ac_status=$? + grep -v '^ *+' conftest.er1 >conftest.err + rm -f conftest.er1 + cat conftest.err >&5 + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); } && + { ac_try='test -z "$ac_c_werror_flag" + || test ! -s conftest.err' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; } && + { ac_try='test -s conftest$ac_exeext' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; }; then + ac_cv_search___res_mkquery="none required" +else + echo "$as_me: failed program was:" >&5 +sed 's/^/| /' conftest.$ac_ext >&5 + +fi +rm -f conftest.err conftest.$ac_objext \ + conftest$ac_exeext conftest.$ac_ext +if test "$ac_cv_search___res_mkquery" = no; then + for ac_lib in resolv bind; do + LIBS="-l$ac_lib $ac_func_search_save_LIBS" + cat >conftest.$ac_ext <<_ACEOF +/* confdefs.h. */ +_ACEOF +cat confdefs.h >>conftest.$ac_ext +cat >>conftest.$ac_ext <<_ACEOF +/* end confdefs.h. */ + +/* Override any gcc2 internal prototype to avoid an error. */ +#ifdef __cplusplus +extern "C" +#endif +/* We use char because int might match the return type of a gcc2 + builtin and then its argument prototype would still apply. */ +char __res_mkquery (); +int +main () +{ +__res_mkquery (); + ; + return 0; +} +_ACEOF +rm -f conftest.$ac_objext conftest$ac_exeext +if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5 + (eval $ac_link) 2>conftest.er1 + ac_status=$? + grep -v '^ *+' conftest.er1 >conftest.err + rm -f conftest.er1 + cat conftest.err >&5 + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); } && + { ac_try='test -z "$ac_c_werror_flag" + || test ! -s conftest.err' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; } && + { ac_try='test -s conftest$ac_exeext' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; }; then + ac_cv_search___res_mkquery="-l$ac_lib" +break +else + echo "$as_me: failed program was:" >&5 +sed 's/^/| /' conftest.$ac_ext >&5 + +fi +rm -f conftest.err conftest.$ac_objext \ + conftest$ac_exeext conftest.$ac_ext + done +fi +LIBS=$ac_func_search_save_LIBS +fi +echo "$as_me:$LINENO: result: $ac_cv_search___res_mkquery" >&5 +echo "${ECHO_T}$ac_cv_search___res_mkquery" >&6 +if test "$ac_cv_search___res_mkquery" != no; then + test "$ac_cv_search___res_mkquery" = "none required" || LIBS="$ac_cv_search___res_mkquery $LIBS" + +fi + echo "$as_me:$LINENO: checking for socket in -lsocket" >&5 echo $ECHO_N "checking for socket in -lsocket... $ECHO_C" >&6 @@ -2018,8 +2444,11 @@ else ac_check_lib_save_LIBS=$LIBS LIBS="-lsocket $LIBS" cat >conftest.$ac_ext <<_ACEOF -#line $LINENO "configure" -#include "confdefs.h" +/* confdefs.h. */ +_ACEOF +cat confdefs.h >>conftest.$ac_ext +cat >>conftest.$ac_ext <<_ACEOF +/* end confdefs.h. */ /* Override any gcc2 internal prototype to avoid an error. */ #ifdef __cplusplus @@ -2028,12 +2457,6 @@ extern "C" /* We use char because int might match the return type of a gcc2 builtin and then its argument prototype would still apply. */ char socket (); -#ifdef F77_DUMMY_MAIN -# ifdef __cplusplus - extern "C" -# endif - int F77_DUMMY_MAIN() { return 1; } -#endif int main () { @@ -2044,11 +2467,21 @@ socket (); _ACEOF rm -f conftest.$ac_objext conftest$ac_exeext if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5 - (eval $ac_link) 2>&5 + (eval $ac_link) 2>conftest.er1 ac_status=$? + grep -v '^ *+' conftest.er1 >conftest.err + rm -f conftest.er1 + cat conftest.err >&5 echo "$as_me:$LINENO: \$? = $ac_status" >&5 (exit $ac_status); } && - { ac_try='test -s conftest$ac_exeext' + { ac_try='test -z "$ac_c_werror_flag" + || test ! -s conftest.err' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; } && + { ac_try='test -s conftest$ac_exeext' { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 (eval $ac_try) 2>&5 ac_status=$? @@ -2057,10 +2490,12 @@ if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5 ac_cv_lib_socket_socket=yes else echo "$as_me: failed program was:" >&5 -cat conftest.$ac_ext >&5 +sed 's/^/| /' conftest.$ac_ext >&5 + ac_cv_lib_socket_socket=no fi -rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext +rm -f conftest.err conftest.$ac_objext \ + conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi echo "$as_me:$LINENO: result: $ac_cv_lib_socket_socket" >&5 @@ -2083,8 +2518,11 @@ else ac_check_lib_save_LIBS=$LIBS LIBS="-lnsl $LIBS" cat >conftest.$ac_ext <<_ACEOF -#line $LINENO "configure" -#include "confdefs.h" +/* confdefs.h. */ +_ACEOF +cat confdefs.h >>conftest.$ac_ext +cat >>conftest.$ac_ext <<_ACEOF +/* end confdefs.h. */ /* Override any gcc2 internal prototype to avoid an error. */ #ifdef __cplusplus @@ -2093,12 +2531,6 @@ extern "C" /* We use char because int might match the return type of a gcc2 builtin and then its argument prototype would still apply. */ char inet_ntoa (); -#ifdef F77_DUMMY_MAIN -# ifdef __cplusplus - extern "C" -# endif - int F77_DUMMY_MAIN() { return 1; } -#endif int main () { @@ -2109,11 +2541,21 @@ inet_ntoa (); _ACEOF rm -f conftest.$ac_objext conftest$ac_exeext if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5 - (eval $ac_link) 2>&5 + (eval $ac_link) 2>conftest.er1 ac_status=$? + grep -v '^ *+' conftest.er1 >conftest.err + rm -f conftest.er1 + cat conftest.err >&5 echo "$as_me:$LINENO: \$? = $ac_status" >&5 (exit $ac_status); } && - { ac_try='test -s conftest$ac_exeext' + { ac_try='test -z "$ac_c_werror_flag" + || test ! -s conftest.err' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; } && + { ac_try='test -s conftest$ac_exeext' { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 (eval $ac_try) 2>&5 ac_status=$? @@ -2122,10 +2564,12 @@ if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5 ac_cv_lib_nsl_inet_ntoa=yes else echo "$as_me: failed program was:" >&5 -cat conftest.$ac_ext >&5 +sed 's/^/| /' conftest.$ac_ext >&5 + ac_cv_lib_nsl_inet_ntoa=no fi -rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext +rm -f conftest.err conftest.$ac_objext \ + conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi echo "$as_me:$LINENO: result: $ac_cv_lib_nsl_inet_ntoa" >&5 @@ -2149,49 +2593,73 @@ if eval "test \"\${$as_ac_var+set}\" = set"; then echo $ECHO_N "(cached) $ECHO_C" >&6 else cat >conftest.$ac_ext <<_ACEOF -#line $LINENO "configure" -#include "confdefs.h" +/* confdefs.h. */ +_ACEOF +cat confdefs.h >>conftest.$ac_ext +cat >>conftest.$ac_ext <<_ACEOF +/* end confdefs.h. */ +/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func. + For example, HP-UX 11i <limits.h> declares gettimeofday. */ +#define $ac_func innocuous_$ac_func + /* System header to define __stub macros and hopefully few prototypes, - which can conflict with char $ac_func (); below. */ -#include <assert.h> + which can conflict with char $ac_func (); below. + Prefer <limits.h> to <assert.h> if __STDC__ is defined, since + <limits.h> exists even on freestanding compilers. */ + +#ifdef __STDC__ +# include <limits.h> +#else +# include <assert.h> +#endif + +#undef $ac_func + /* Override any gcc2 internal prototype to avoid an error. */ #ifdef __cplusplus extern "C" +{ #endif /* We use char because int might match the return type of a gcc2 builtin and then its argument prototype would still apply. */ char $ac_func (); -char (*f) (); - -#ifdef F77_DUMMY_MAIN -# ifdef __cplusplus - extern "C" -# endif - int F77_DUMMY_MAIN() { return 1; } -#endif -int -main () -{ /* The GNU C library defines this for functions which it implements to always fail with ENOSYS. Some functions are actually named something starting with __ and the normal name is an alias. */ #if defined (__stub_$ac_func) || defined (__stub___$ac_func) choke me #else -f = $ac_func; +char (*f) () = $ac_func; +#endif +#ifdef __cplusplus +} #endif +int +main () +{ +return f != $ac_func; ; return 0; } _ACEOF rm -f conftest.$ac_objext conftest$ac_exeext if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5 - (eval $ac_link) 2>&5 + (eval $ac_link) 2>conftest.er1 ac_status=$? + grep -v '^ *+' conftest.er1 >conftest.err + rm -f conftest.er1 + cat conftest.err >&5 echo "$as_me:$LINENO: \$? = $ac_status" >&5 (exit $ac_status); } && - { ac_try='test -s conftest$ac_exeext' + { ac_try='test -z "$ac_c_werror_flag" + || test ! -s conftest.err' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; } && + { ac_try='test -s conftest$ac_exeext' { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 (eval $ac_try) 2>&5 ac_status=$? @@ -2200,10 +2668,12 @@ if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5 eval "$as_ac_var=yes" else echo "$as_me: failed program was:" >&5 -cat conftest.$ac_ext >&5 +sed 's/^/| /' conftest.$ac_ext >&5 + eval "$as_ac_var=no" fi -rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext +rm -f conftest.err conftest.$ac_objext \ + conftest$ac_exeext conftest.$ac_ext fi echo "$as_me:$LINENO: result: `eval echo '${'$as_ac_var'}'`" >&5 echo "${ECHO_T}`eval echo '${'$as_ac_var'}'`" >&6 @@ -2221,49 +2691,73 @@ if test "${ac_cv_func_getaddrinfo+set}" = set; then echo $ECHO_N "(cached) $ECHO_C" >&6 else cat >conftest.$ac_ext <<_ACEOF -#line $LINENO "configure" -#include "confdefs.h" +/* confdefs.h. */ +_ACEOF +cat confdefs.h >>conftest.$ac_ext +cat >>conftest.$ac_ext <<_ACEOF +/* end confdefs.h. */ +/* Define getaddrinfo to an innocuous variant, in case <limits.h> declares getaddrinfo. + For example, HP-UX 11i <limits.h> declares gettimeofday. */ +#define getaddrinfo innocuous_getaddrinfo + /* System header to define __stub macros and hopefully few prototypes, - which can conflict with char getaddrinfo (); below. */ -#include <assert.h> + which can conflict with char getaddrinfo (); below. + Prefer <limits.h> to <assert.h> if __STDC__ is defined, since + <limits.h> exists even on freestanding compilers. */ + +#ifdef __STDC__ +# include <limits.h> +#else +# include <assert.h> +#endif + +#undef getaddrinfo + /* Override any gcc2 internal prototype to avoid an error. */ #ifdef __cplusplus extern "C" +{ #endif /* We use char because int might match the return type of a gcc2 builtin and then its argument prototype would still apply. */ char getaddrinfo (); -char (*f) (); - -#ifdef F77_DUMMY_MAIN -# ifdef __cplusplus - extern "C" -# endif - int F77_DUMMY_MAIN() { return 1; } -#endif -int -main () -{ /* The GNU C library defines this for functions which it implements to always fail with ENOSYS. Some functions are actually named something starting with __ and the normal name is an alias. */ #if defined (__stub_getaddrinfo) || defined (__stub___getaddrinfo) choke me #else -f = getaddrinfo; +char (*f) () = getaddrinfo; +#endif +#ifdef __cplusplus +} #endif +int +main () +{ +return f != getaddrinfo; ; return 0; } _ACEOF rm -f conftest.$ac_objext conftest$ac_exeext if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5 - (eval $ac_link) 2>&5 + (eval $ac_link) 2>conftest.er1 ac_status=$? + grep -v '^ *+' conftest.er1 >conftest.err + rm -f conftest.er1 + cat conftest.err >&5 echo "$as_me:$LINENO: \$? = $ac_status" >&5 (exit $ac_status); } && - { ac_try='test -s conftest$ac_exeext' + { ac_try='test -z "$ac_c_werror_flag" + || test ! -s conftest.err' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; } && + { ac_try='test -s conftest$ac_exeext' { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 (eval $ac_try) 2>&5 ac_status=$? @@ -2272,20 +2766,30 @@ if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5 ac_cv_func_getaddrinfo=yes else echo "$as_me: failed program was:" >&5 -cat conftest.$ac_ext >&5 +sed 's/^/| /' conftest.$ac_ext >&5 + ac_cv_func_getaddrinfo=no fi -rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext +rm -f conftest.err conftest.$ac_objext \ + conftest$ac_exeext conftest.$ac_ext fi echo "$as_me:$LINENO: result: $ac_cv_func_getaddrinfo" >&5 echo "${ECHO_T}$ac_cv_func_getaddrinfo" >&6 if test $ac_cv_func_getaddrinfo = yes; then - cat >>confdefs.h <<\_ACEOF + +cat >>confdefs.h <<\_ACEOF #define HAVE_GETADDRINFO 1 _ACEOF else - LIBOBJS="$LIBOBJS getaddrinfo.$ac_objext" + case $LIBOBJS in + "getaddrinfo.$ac_objext" | \ + *" getaddrinfo.$ac_objext" | \ + "getaddrinfo.$ac_objext "* | \ + *" getaddrinfo.$ac_objext "* ) ;; + *) LIBOBJS="$LIBOBJS getaddrinfo.$ac_objext" ;; +esac + fi echo "$as_me:$LINENO: checking for getnameinfo" >&5 @@ -2294,49 +2798,73 @@ if test "${ac_cv_func_getnameinfo+set}" = set; then echo $ECHO_N "(cached) $ECHO_C" >&6 else cat >conftest.$ac_ext <<_ACEOF -#line $LINENO "configure" -#include "confdefs.h" +/* confdefs.h. */ +_ACEOF +cat confdefs.h >>conftest.$ac_ext +cat >>conftest.$ac_ext <<_ACEOF +/* end confdefs.h. */ +/* Define getnameinfo to an innocuous variant, in case <limits.h> declares getnameinfo. + For example, HP-UX 11i <limits.h> declares gettimeofday. */ +#define getnameinfo innocuous_getnameinfo + /* System header to define __stub macros and hopefully few prototypes, - which can conflict with char getnameinfo (); below. */ -#include <assert.h> + which can conflict with char getnameinfo (); below. + Prefer <limits.h> to <assert.h> if __STDC__ is defined, since + <limits.h> exists even on freestanding compilers. */ + +#ifdef __STDC__ +# include <limits.h> +#else +# include <assert.h> +#endif + +#undef getnameinfo + /* Override any gcc2 internal prototype to avoid an error. */ #ifdef __cplusplus extern "C" +{ #endif /* We use char because int might match the return type of a gcc2 builtin and then its argument prototype would still apply. */ char getnameinfo (); -char (*f) (); - -#ifdef F77_DUMMY_MAIN -# ifdef __cplusplus - extern "C" -# endif - int F77_DUMMY_MAIN() { return 1; } -#endif -int -main () -{ /* The GNU C library defines this for functions which it implements to always fail with ENOSYS. Some functions are actually named something starting with __ and the normal name is an alias. */ #if defined (__stub_getnameinfo) || defined (__stub___getnameinfo) choke me #else -f = getnameinfo; +char (*f) () = getnameinfo; +#endif +#ifdef __cplusplus +} #endif +int +main () +{ +return f != getnameinfo; ; return 0; } _ACEOF rm -f conftest.$ac_objext conftest$ac_exeext if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5 - (eval $ac_link) 2>&5 + (eval $ac_link) 2>conftest.er1 ac_status=$? + grep -v '^ *+' conftest.er1 >conftest.err + rm -f conftest.er1 + cat conftest.err >&5 echo "$as_me:$LINENO: \$? = $ac_status" >&5 (exit $ac_status); } && - { ac_try='test -s conftest$ac_exeext' + { ac_try='test -z "$ac_c_werror_flag" + || test ! -s conftest.err' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; } && + { ac_try='test -s conftest$ac_exeext' { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 (eval $ac_try) 2>&5 ac_status=$? @@ -2345,20 +2873,30 @@ if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5 ac_cv_func_getnameinfo=yes else echo "$as_me: failed program was:" >&5 -cat conftest.$ac_ext >&5 +sed 's/^/| /' conftest.$ac_ext >&5 + ac_cv_func_getnameinfo=no fi -rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext +rm -f conftest.err conftest.$ac_objext \ + conftest$ac_exeext conftest.$ac_ext fi echo "$as_me:$LINENO: result: $ac_cv_func_getnameinfo" >&5 echo "${ECHO_T}$ac_cv_func_getnameinfo" >&6 if test $ac_cv_func_getnameinfo = yes; then - cat >>confdefs.h <<\_ACEOF + +cat >>confdefs.h <<\_ACEOF #define HAVE_GETNAMEINFO 1 _ACEOF else - LIBOBJS="$LIBOBJS getnameinfo.$ac_objext" + case $LIBOBJS in + "getnameinfo.$ac_objext" | \ + *" getnameinfo.$ac_objext" | \ + "getnameinfo.$ac_objext "* | \ + *" getnameinfo.$ac_objext "* ) ;; + *) LIBOBJS="$LIBOBJS getnameinfo.$ac_objext" ;; +esac + fi @@ -2369,16 +2907,13 @@ if test "${ac_cv_type_socklen_t+set}" = set; then else cat >conftest.$ac_ext <<_ACEOF -#line $LINENO "configure" -#include "confdefs.h" +/* confdefs.h. */ +_ACEOF +cat confdefs.h >>conftest.$ac_ext +cat >>conftest.$ac_ext <<_ACEOF +/* end confdefs.h. */ #include <sys/types.h> #include <sys/socket.h> -#ifdef F77_DUMMY_MAIN -# ifdef __cplusplus - extern "C" -# endif - int F77_DUMMY_MAIN() { return 1; } -#endif int main () { @@ -2389,11 +2924,21 @@ socklen_t len = 42; return len; _ACEOF rm -f conftest.$ac_objext if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5 - (eval $ac_compile) 2>&5 + (eval $ac_compile) 2>conftest.er1 ac_status=$? + grep -v '^ *+' conftest.er1 >conftest.err + rm -f conftest.er1 + cat conftest.err >&5 echo "$as_me:$LINENO: \$? = $ac_status" >&5 (exit $ac_status); } && - { ac_try='test -s conftest.$ac_objext' + { ac_try='test -z "$ac_c_werror_flag" + || test ! -s conftest.err' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; } && + { ac_try='test -s conftest.$ac_objext' { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 (eval $ac_try) 2>&5 ac_status=$? @@ -2402,16 +2947,18 @@ if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5 ac_cv_type_socklen_t=yes else echo "$as_me: failed program was:" >&5 -cat conftest.$ac_ext >&5 +sed 's/^/| /' conftest.$ac_ext >&5 + ac_cv_type_socklen_t=no fi -rm -f conftest.$ac_objext conftest.$ac_ext +rm -f conftest.err conftest.$ac_objext conftest.$ac_ext fi echo "$as_me:$LINENO: result: $ac_cv_type_socklen_t" >&5 echo "${ECHO_T}$ac_cv_type_socklen_t" >&6 if test $ac_cv_type_socklen_t != yes; then - cat >>confdefs.h <<\_ACEOF + +cat >>confdefs.h <<\_ACEOF #define socklen_t int _ACEOF @@ -2424,16 +2971,13 @@ if test "${ac_cv_sa_len+set}" = set; then else cat >conftest.$ac_ext <<_ACEOF -#line $LINENO "configure" -#include "confdefs.h" +/* confdefs.h. */ +_ACEOF +cat confdefs.h >>conftest.$ac_ext +cat >>conftest.$ac_ext <<_ACEOF +/* end confdefs.h. */ #include <sys/types.h> #include <sys/socket.h> -#ifdef F77_DUMMY_MAIN -# ifdef __cplusplus - extern "C" -# endif - int F77_DUMMY_MAIN() { return 1; } -#endif int main () { @@ -2444,11 +2988,21 @@ struct sockaddr sa; sa.sa_len = 0; _ACEOF rm -f conftest.$ac_objext if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5 - (eval $ac_compile) 2>&5 + (eval $ac_compile) 2>conftest.er1 ac_status=$? + grep -v '^ *+' conftest.er1 >conftest.err + rm -f conftest.er1 + cat conftest.err >&5 echo "$as_me:$LINENO: \$? = $ac_status" >&5 (exit $ac_status); } && - { ac_try='test -s conftest.$ac_objext' + { ac_try='test -z "$ac_c_werror_flag" + || test ! -s conftest.err' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; } && + { ac_try='test -s conftest.$ac_objext' { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 (eval $ac_try) 2>&5 ac_status=$? @@ -2457,23 +3011,25 @@ if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5 ac_cv_sa_len=yes else echo "$as_me: failed program was:" >&5 -cat conftest.$ac_ext >&5 +sed 's/^/| /' conftest.$ac_ext >&5 + ac_cv_sa_len=no fi -rm -f conftest.$ac_objext conftest.$ac_ext +rm -f conftest.err conftest.$ac_objext conftest.$ac_ext fi echo "$as_me:$LINENO: result: $ac_cv_sa_len" >&5 echo "${ECHO_T}$ac_cv_sa_len" >&6 if test $ac_cv_sa_len = yes; then - cat >>confdefs.h <<\_ACEOF + +cat >>confdefs.h <<\_ACEOF #define HAVE_SA_LEN 1 _ACEOF fi -ac_config_files="$ac_config_files Makefile" + ac_config_files="$ac_config_files Makefile" cat >confcache <<\_ACEOF # This file is a shell script that caches the results of configure # tests run on this system so they can be shared between configure @@ -2484,7 +3040,7 @@ cat >confcache <<\_ACEOF # config.status only pays attention to the cache file if you give it # the --recheck option to rerun configure. # -# `ac_cv_env_foo' variables (set or unset) will be overriden when +# `ac_cv_env_foo' variables (set or unset) will be overridden when # loading this file, other *unset* `ac_cv_foo' will be assigned the # following values. @@ -2502,13 +3058,13 @@ _ACEOF # `set' does not quote correctly, so add quotes (double-quote # substitution turns \\\\ into \\, and sed turns \\ into \). sed -n \ - "s/'/'\\\\''/g; - s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1='\\2'/p" + "s/'/'\\\\''/g; + s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1='\\2'/p" ;; *) # `set' quotes correctly as required by POSIX, so do not add quotes. sed -n \ - "s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1=\\2/p" + "s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1=\\2/p" ;; esac; } | @@ -2519,7 +3075,7 @@ _ACEOF t end /^ac_cv_env/!s/^\([^=]*\)=\(.*\)$/\1=${\1=\2}/ : end' >>confcache -if cmp -s $cache_file confcache; then :; else +if diff $cache_file confcache >/dev/null 2>&1; then :; else if test -w $cache_file; then test "x$cache_file" != "x/dev/null" && echo "updating cache $cache_file" cat confcache >$cache_file @@ -2538,47 +3094,31 @@ test "x$exec_prefix" = xNONE && exec_prefix='${prefix}' # trailing colons and then remove the whole line if VPATH becomes empty # (actually we leave an empty line to preserve line numbers). if test "x$srcdir" = x.; then - ac_vpsub='/^[ ]*VPATH[ ]*=/{ + ac_vpsub='/^[ ]*VPATH[ ]*=/{ s/:*\$(srcdir):*/:/; s/:*\${srcdir}:*/:/; s/:*@srcdir@:*/:/; -s/^\([^=]*=[ ]*\):*/\1/; +s/^\([^=]*=[ ]*\):*/\1/; s/:*$//; -s/^[^=]*=[ ]*$//; +s/^[^=]*=[ ]*$//; }' fi -# Transform confdefs.h into DEFS. -# Protect against shell expansion while executing Makefile rules. -# Protect against Makefile macro expansion. -# -# If the first sed substitution is executed (which looks for macros that -# take arguments), then we branch to the quote section. Otherwise, -# look for a macro that doesn't take arguments. -cat >confdef2opt.sed <<\_ACEOF -t clear -: clear -s,^[ ]*#[ ]*define[ ][ ]*\([^ (][^ (]*([^)]*)\)[ ]*\(.*\),-D\1=\2,g -t quote -s,^[ ]*#[ ]*define[ ][ ]*\([^ ][^ ]*\)[ ]*\(.*\),-D\1=\2,g -t quote -d -: quote -s,[ `~#$^&*(){}\\|;'"<>?],\\&,g -s,\[,\\&,g -s,\],\\&,g -s,\$,$$,g -p -_ACEOF -# We use echo to avoid assuming a particular line-breaking character. -# The extra dot is to prevent the shell from consuming trailing -# line-breaks from the sub-command output. A line-break within -# single-quotes doesn't work because, if this script is created in a -# platform that uses two characters for line-breaks (e.g., DOS), tr -# would break. -ac_LF_and_DOT=`echo; echo .` -DEFS=`sed -n -f confdef2opt.sed confdefs.h | tr "$ac_LF_and_DOT" ' .'` -rm -f confdef2opt.sed +DEFS=-DHAVE_CONFIG_H + +ac_libobjs= +ac_ltlibobjs= +for ac_i in : $LIBOBJS; do test "x$ac_i" = x: && continue + # 1. Remove the extension, and $U if already installed. + ac_i=`echo "$ac_i" | + sed 's/\$U\././;s/\.o$//;s/\.obj$//'` + # 2. Add them. + ac_libobjs="$ac_libobjs $ac_i\$U.$ac_objext" + ac_ltlibobjs="$ac_ltlibobjs $ac_i"'$U.lo' +done +LIBOBJS=$ac_libobjs + +LTLIBOBJS=$ac_ltlibobjs @@ -2595,11 +3135,12 @@ cat >$CONFIG_STATUS <<_ACEOF # configure, is in config.log if it exists. debug=false +ac_cs_recheck=false +ac_cs_silent=false SHELL=\${CONFIG_SHELL-$SHELL} _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF - ## --------------------- ## ## M4sh Initialization. ## ## --------------------- ## @@ -2608,46 +3149,57 @@ cat >>$CONFIG_STATUS <<\_ACEOF if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then emulate sh NULLCMD=: + # Zsh 3.x and 4.x performs word splitting on ${1+"$@"}, which + # is contrary to our usage. Disable this feature. + alias -g '${1+"$@"}'='"$@"' elif test -n "${BASH_VERSION+set}" && (set -o posix) >/dev/null 2>&1; then set -o posix fi +DUALCASE=1; export DUALCASE # for MKS sh -# NLS nuisances. # Support unset when possible. -if (FOO=FOO; unset FOO) >/dev/null 2>&1; then +if ( (MAIL=60; unset MAIL) || exit) >/dev/null 2>&1; then as_unset=unset else as_unset=false fi -(set +x; test -n "`(LANG=C; export LANG) 2>&1`") && - { $as_unset LANG || test "${LANG+set}" != set; } || - { LANG=C; export LANG; } -(set +x; test -n "`(LC_ALL=C; export LC_ALL) 2>&1`") && - { $as_unset LC_ALL || test "${LC_ALL+set}" != set; } || - { LC_ALL=C; export LC_ALL; } -(set +x; test -n "`(LC_TIME=C; export LC_TIME) 2>&1`") && - { $as_unset LC_TIME || test "${LC_TIME+set}" != set; } || - { LC_TIME=C; export LC_TIME; } -(set +x; test -n "`(LC_CTYPE=C; export LC_CTYPE) 2>&1`") && - { $as_unset LC_CTYPE || test "${LC_CTYPE+set}" != set; } || - { LC_CTYPE=C; export LC_CTYPE; } -(set +x; test -n "`(LANGUAGE=C; export LANGUAGE) 2>&1`") && - { $as_unset LANGUAGE || test "${LANGUAGE+set}" != set; } || - { LANGUAGE=C; export LANGUAGE; } -(set +x; test -n "`(LC_COLLATE=C; export LC_COLLATE) 2>&1`") && - { $as_unset LC_COLLATE || test "${LC_COLLATE+set}" != set; } || - { LC_COLLATE=C; export LC_COLLATE; } -(set +x; test -n "`(LC_NUMERIC=C; export LC_NUMERIC) 2>&1`") && - { $as_unset LC_NUMERIC || test "${LC_NUMERIC+set}" != set; } || - { LC_NUMERIC=C; export LC_NUMERIC; } -(set +x; test -n "`(LC_MESSAGES=C; export LC_MESSAGES) 2>&1`") && - { $as_unset LC_MESSAGES || test "${LC_MESSAGES+set}" != set; } || - { LC_MESSAGES=C; export LC_MESSAGES; } + +# Work around bugs in pre-3.0 UWIN ksh. +$as_unset ENV MAIL MAILPATH +PS1='$ ' +PS2='> ' +PS4='+ ' + +# NLS nuisances. +for as_var in \ + LANG LANGUAGE LC_ADDRESS LC_ALL LC_COLLATE LC_CTYPE LC_IDENTIFICATION \ + LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER \ + LC_TELEPHONE LC_TIME +do + if (set +x; test -z "`(eval $as_var=C; export $as_var) 2>&1`"); then + eval $as_var=C; export $as_var + else + $as_unset $as_var + fi +done + +# Required to use basename. +if expr a : '\(a\)' >/dev/null 2>&1; then + as_expr=expr +else + as_expr=false +fi + +if (basename /) >/dev/null 2>&1 && test "X`basename / 2>&1`" = "X/"; then + as_basename=basename +else + as_basename=false +fi # Name of the executable. -as_me=`(basename "$0") 2>/dev/null || +as_me=`$as_basename "$0" || $as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \ X"$0" : 'X\(//\)$' \| \ X"$0" : 'X\(/\)$' \| \ @@ -2658,6 +3210,7 @@ echo X/"$0" | /^X\/\(\/\).*/{ s//\1/; q; } s/.*/./; q'` + # PATH needs CR, and LINENO needs CR and PATH. # Avoid depending upon Character Ranges. as_cr_letters='abcdefghijklmnopqrstuvwxyz' @@ -2668,15 +3221,15 @@ as_cr_alnum=$as_cr_Letters$as_cr_digits # The user is always right. if test "${PATH_SEPARATOR+set}" != set; then - echo "#! /bin/sh" >conftest.sh - echo "exit 0" >>conftest.sh - chmod +x conftest.sh - if (PATH=".;."; conftest.sh) >/dev/null 2>&1; then + echo "#! /bin/sh" >conf$$.sh + echo "exit 0" >>conf$$.sh + chmod +x conf$$.sh + if (PATH="/nonexistent;."; conf$$.sh) >/dev/null 2>&1; then PATH_SEPARATOR=';' else PATH_SEPARATOR=: fi - rm -f conftest.sh + rm -f conf$$.sh fi @@ -2725,6 +3278,8 @@ do as_lineno_3=`(expr $as_lineno_1 + 1) 2>/dev/null` test "x$as_lineno_1" != "x$as_lineno_2" && test "x$as_lineno_3" = "x$as_lineno_2" ') 2>/dev/null; then + $as_unset BASH_ENV || test "${BASH_ENV+set}" != set || { BASH_ENV=; export BASH_ENV; } + $as_unset ENV || test "${ENV+set}" != set || { ENV=; export ENV; } CONFIG_SHELL=$as_dir/$as_base export CONFIG_SHELL exec "$CONFIG_SHELL" "$0" ${1+"$@"} @@ -2798,13 +3353,20 @@ else fi rm -f conf$$ conf$$.exe conf$$.file +if mkdir -p . 2>/dev/null; then + as_mkdir_p=: +else + test -d ./-p && rmdir ./-p + as_mkdir_p=false +fi + as_executable_p="test -f" # Sed expression to map a string onto a valid CPP name. -as_tr_cpp="sed y%*$as_cr_letters%P$as_cr_LETTERS%;s%[^_$as_cr_alnum]%_%g" +as_tr_cpp="eval sed 'y%*$as_cr_letters%P$as_cr_LETTERS%;s%[^_$as_cr_alnum]%_%g'" # Sed expression to map a string onto a valid variable name. -as_tr_sh="sed y%*+%pp%;s%[^_$as_cr_alnum]%_%g" +as_tr_sh="eval sed 'y%*+%pp%;s%[^_$as_cr_alnum]%_%g'" # IFS @@ -2814,7 +3376,7 @@ as_nl=' IFS=" $as_nl" # CDPATH. -$as_unset CDPATH || test "${CDPATH+set}" != set || { CDPATH=$PATH_SEPARATOR; export CDPATH; } +$as_unset CDPATH exec 6>&1 @@ -2831,7 +3393,7 @@ _ASBOX cat >&5 <<_CSEOF This file was extended by $as_me, which was -generated by GNU Autoconf 2.53. Invocation command line was +generated by GNU Autoconf 2.59. Invocation command line was CONFIG_FILES = $CONFIG_FILES CONFIG_HEADERS = $CONFIG_HEADERS @@ -2871,25 +3433,30 @@ Usage: $0 [OPTIONS] [FILE]... -h, --help print this help, then exit -V, --version print version number, then exit + -q, --quiet do not print progress messages -d, --debug don't remove temporary files --recheck update $as_me by reconfiguring in the same conditions --file=FILE[:TEMPLATE] - instantiate the configuration file FILE + instantiate the configuration file FILE + --header=FILE[:TEMPLATE] + instantiate the configuration header FILE Configuration files: $config_files +Configuration headers: +$config_headers + Report bugs to <bug-autoconf@gnu.org>." _ACEOF cat >>$CONFIG_STATUS <<_ACEOF ac_cs_version="\\ config.status -configured by $0, generated by GNU Autoconf 2.53, +configured by $0, generated by GNU Autoconf 2.59, with options \\"`echo "$ac_configure_args" | sed 's/[\\""\`\$]/\\\\&/g'`\\" -Copyright 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001 -Free Software Foundation, Inc. +Copyright (C) 2003 Free Software Foundation, Inc. This config.status script is free software; the Free Software Foundation gives unlimited permission to copy, distribute and modify it." srcdir=$srcdir @@ -2905,25 +3472,25 @@ do --*=*) ac_option=`expr "x$1" : 'x\([^=]*\)='` ac_optarg=`expr "x$1" : 'x[^=]*=\(.*\)'` - shift - set dummy "$ac_option" "$ac_optarg" ${1+"$@"} - shift + ac_shift=: + ;; + -*) + ac_option=$1 + ac_optarg=$2 + ac_shift=shift ;; - -*);; *) # This is not an option, so the user has probably given explicit # arguments. + ac_option=$1 ac_need_defaults=false;; esac - case $1 in + case $ac_option in # Handling of the options. _ACEOF -cat >>$CONFIG_STATUS <<_ACEOF - -recheck | --recheck | --rechec | --reche | --rech | --rec | --re | --r) - echo "running $SHELL $0 " $ac_configure_args " --no-create --no-recursion" - exec $SHELL $0 $ac_configure_args --no-create --no-recursion ;; -_ACEOF cat >>$CONFIG_STATUS <<\_ACEOF + -recheck | --recheck | --rechec | --reche | --rech | --rec | --re | --r) + ac_cs_recheck=: ;; --version | --vers* | -V ) echo "$ac_cs_version"; exit 0 ;; --he | --h) @@ -2938,13 +3505,16 @@ Try \`$0 --help' for more information." >&2;} --debug | --d* | -d ) debug=: ;; --file | --fil | --fi | --f ) - shift - CONFIG_FILES="$CONFIG_FILES $1" + $ac_shift + CONFIG_FILES="$CONFIG_FILES $ac_optarg" ac_need_defaults=false;; --header | --heade | --head | --hea ) - shift - CONFIG_HEADERS="$CONFIG_HEADERS $1" + $ac_shift + CONFIG_HEADERS="$CONFIG_HEADERS $ac_optarg" ac_need_defaults=false;; + -q | -quiet | --quiet | --quie | --qui | --qu | --q \ + | -silent | --silent | --silen | --sile | --sil | --si | --s) + ac_cs_silent=: ;; # This is an error. -*) { { echo "$as_me:$LINENO: error: unrecognized option: $1 @@ -2959,6 +3529,20 @@ Try \`$0 --help' for more information." >&2;} shift done +ac_configure_extra_args= + +if $ac_cs_silent; then + exec 6>/dev/null + ac_configure_extra_args="$ac_configure_extra_args --silent" +fi + +_ACEOF +cat >>$CONFIG_STATUS <<_ACEOF +if \$ac_cs_recheck; then + echo "running $SHELL $0 " $ac_configure_args \$ac_configure_extra_args " --no-create --no-recursion" >&6 + exec $SHELL $0 $ac_configure_args \$ac_configure_extra_args --no-create --no-recursion +fi + _ACEOF @@ -2971,6 +3555,7 @@ do case "$ac_config_target" in # Handling of arguments. "Makefile" ) CONFIG_FILES="$CONFIG_FILES Makefile" ;; + "config.h" ) CONFIG_HEADERS="$CONFIG_HEADERS config.h" ;; *) { { echo "$as_me:$LINENO: error: invalid argument: $ac_config_target" >&5 echo "$as_me: error: invalid argument: $ac_config_target" >&2;} { (exit 1); exit 1; }; };; @@ -2983,8 +3568,12 @@ done # bizarre bug on SunOS 4.1.3. if $ac_need_defaults; then test "${CONFIG_FILES+set}" = set || CONFIG_FILES=$config_files + test "${CONFIG_HEADERS+set}" = set || CONFIG_HEADERS=$config_headers fi +# Have a temporary directory for convenience. Make it in the build tree +# simply because there is no reason to put it here, and in addition, +# creating and moving files from /tmp can sometimes cause problems. # Create a temporary directory, and hook for its removal unless debugging. $debug || { @@ -2993,17 +3582,17 @@ $debug || } # Create a (secure) tmp directory for tmp files. -: ${TMPDIR=/tmp} + { - tmp=`(umask 077 && mktemp -d -q "$TMPDIR/csXXXXXX") 2>/dev/null` && + tmp=`(umask 077 && mktemp -d -q "./confstatXXXXXX") 2>/dev/null` && test -n "$tmp" && test -d "$tmp" } || { - tmp=$TMPDIR/cs$$-$RANDOM + tmp=./confstat$$-$RANDOM (umask 077 && mkdir $tmp) } || { - echo "$me: cannot create a temporary directory in $TMPDIR" >&2 + echo "$me: cannot create a temporary directory in ." >&2 { (exit 1); exit 1; } } @@ -3059,6 +3648,7 @@ s,@ac_ct_CC@,$ac_ct_CC,;t t s,@EXEEXT@,$EXEEXT,;t t s,@OBJEXT@,$OBJEXT,;t t s,@LIBOBJS@,$LIBOBJS,;t t +s,@LTLIBOBJS@,$LTLIBOBJS,;t t CEOF _ACEOF @@ -3088,9 +3678,9 @@ _ACEOF (echo ':t /@[a-zA-Z_][a-zA-Z_0-9]*@/!b' && cat $tmp/subs.frag) >$tmp/subs-$ac_sed_frag.sed if test -z "$ac_sed_cmds"; then - ac_sed_cmds="sed -f $tmp/subs-$ac_sed_frag.sed" + ac_sed_cmds="sed -f $tmp/subs-$ac_sed_frag.sed" else - ac_sed_cmds="$ac_sed_cmds | sed -f $tmp/subs-$ac_sed_frag.sed" + ac_sed_cmds="$ac_sed_cmds | sed -f $tmp/subs-$ac_sed_frag.sed" fi ac_sed_frag=`expr $ac_sed_frag + 1` ac_beg=$ac_end @@ -3108,46 +3698,51 @@ for ac_file in : $CONFIG_FILES; do test "x$ac_file" = x: && continue # Support "outfile[:infile[:infile...]]", defaulting infile="outfile.in". case $ac_file in - | *:- | *:-:* ) # input from stdin - cat >$tmp/stdin - ac_file_in=`echo "$ac_file" | sed 's,[^:]*:,,'` - ac_file=`echo "$ac_file" | sed 's,:.*,,'` ;; + cat >$tmp/stdin + ac_file_in=`echo "$ac_file" | sed 's,[^:]*:,,'` + ac_file=`echo "$ac_file" | sed 's,:.*,,'` ;; *:* ) ac_file_in=`echo "$ac_file" | sed 's,[^:]*:,,'` - ac_file=`echo "$ac_file" | sed 's,:.*,,'` ;; + ac_file=`echo "$ac_file" | sed 's,:.*,,'` ;; * ) ac_file_in=$ac_file.in ;; esac # Compute @srcdir@, @top_srcdir@, and @INSTALL@ for subdirectories. ac_dir=`(dirname "$ac_file") 2>/dev/null || $as_expr X"$ac_file" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ - X"$ac_file" : 'X\(//\)[^/]' \| \ - X"$ac_file" : 'X\(//\)$' \| \ - X"$ac_file" : 'X\(/\)' \| \ - . : '\(.\)' 2>/dev/null || + X"$ac_file" : 'X\(//\)[^/]' \| \ + X"$ac_file" : 'X\(//\)$' \| \ + X"$ac_file" : 'X\(/\)' \| \ + . : '\(.\)' 2>/dev/null || echo X"$ac_file" | sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/; q; } /^X\(\/\/\)[^/].*/{ s//\1/; q; } /^X\(\/\/\)$/{ s//\1/; q; } /^X\(\/\).*/{ s//\1/; q; } s/.*/./; q'` - { case "$ac_dir" in - [\\/]* | ?:[\\/]* ) as_incr_dir=;; - *) as_incr_dir=.;; -esac -as_dummy="$ac_dir" -for as_mkdir_dir in `IFS='/\\'; set X $as_dummy; shift; echo "$@"`; do - case $as_mkdir_dir in - # Skip DOS drivespec - ?:) as_incr_dir=$as_mkdir_dir ;; - *) - as_incr_dir=$as_incr_dir/$as_mkdir_dir - test -d "$as_incr_dir" || - mkdir "$as_incr_dir" || - { { echo "$as_me:$LINENO: error: cannot create \"$ac_dir\"" >&5 -echo "$as_me: error: cannot create \"$ac_dir\"" >&2;} - { (exit 1); exit 1; }; } - ;; - esac -done; } + { if $as_mkdir_p; then + mkdir -p "$ac_dir" + else + as_dir="$ac_dir" + as_dirs= + while test ! -d "$as_dir"; do + as_dirs="$as_dir $as_dirs" + as_dir=`(dirname "$as_dir") 2>/dev/null || +$as_expr X"$as_dir" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ + X"$as_dir" : 'X\(//\)[^/]' \| \ + X"$as_dir" : 'X\(//\)$' \| \ + X"$as_dir" : 'X\(/\)' \| \ + . : '\(.\)' 2>/dev/null || +echo X"$as_dir" | + sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/; q; } + /^X\(\/\/\)[^/].*/{ s//\1/; q; } + /^X\(\/\/\)$/{ s//\1/; q; } + /^X\(\/\).*/{ s//\1/; q; } + s/.*/./; q'` + done + test ! -n "$as_dirs" || mkdir $as_dirs + fi || { { echo "$as_me:$LINENO: error: cannot create directory \"$ac_dir\"" >&5 +echo "$as_me: error: cannot create directory \"$ac_dir\"" >&2;} + { (exit 1); exit 1; }; }; } ac_builddir=. @@ -3174,12 +3769,45 @@ case $srcdir in ac_srcdir=$ac_top_builddir$srcdir$ac_dir_suffix ac_top_srcdir=$ac_top_builddir$srcdir ;; esac -# Don't blindly perform a `cd "$ac_dir"/$ac_foo && pwd` since $ac_foo can be -# absolute. -ac_abs_builddir=`cd "$ac_dir" && cd $ac_builddir && pwd` -ac_abs_top_builddir=`cd "$ac_dir" && cd $ac_top_builddir && pwd` -ac_abs_srcdir=`cd "$ac_dir" && cd $ac_srcdir && pwd` -ac_abs_top_srcdir=`cd "$ac_dir" && cd $ac_top_srcdir && pwd` + +# Do not use `cd foo && pwd` to compute absolute paths, because +# the directories may not exist. +case `pwd` in +.) ac_abs_builddir="$ac_dir";; +*) + case "$ac_dir" in + .) ac_abs_builddir=`pwd`;; + [\\/]* | ?:[\\/]* ) ac_abs_builddir="$ac_dir";; + *) ac_abs_builddir=`pwd`/"$ac_dir";; + esac;; +esac +case $ac_abs_builddir in +.) ac_abs_top_builddir=${ac_top_builddir}.;; +*) + case ${ac_top_builddir}. in + .) ac_abs_top_builddir=$ac_abs_builddir;; + [\\/]* | ?:[\\/]* ) ac_abs_top_builddir=${ac_top_builddir}.;; + *) ac_abs_top_builddir=$ac_abs_builddir/${ac_top_builddir}.;; + esac;; +esac +case $ac_abs_builddir in +.) ac_abs_srcdir=$ac_srcdir;; +*) + case $ac_srcdir in + .) ac_abs_srcdir=$ac_abs_builddir;; + [\\/]* | ?:[\\/]* ) ac_abs_srcdir=$ac_srcdir;; + *) ac_abs_srcdir=$ac_abs_builddir/$ac_srcdir;; + esac;; +esac +case $ac_abs_builddir in +.) ac_abs_top_srcdir=$ac_top_srcdir;; +*) + case $ac_top_srcdir in + .) ac_abs_top_srcdir=$ac_abs_builddir;; + [\\/]* | ?:[\\/]* ) ac_abs_top_srcdir=$ac_top_srcdir;; + *) ac_abs_top_srcdir=$ac_abs_builddir/$ac_top_srcdir;; + esac;; +esac @@ -3197,7 +3825,7 @@ echo "$as_me: creating $ac_file" >&6;} configure_input="$ac_file. " fi configure_input=$configure_input"Generated from `echo $ac_file_in | - sed 's,.*/,,'` by configure." + sed 's,.*/,,'` by configure." # First look for the input files in the build tree, otherwise in the # src tree. @@ -3206,24 +3834,24 @@ echo "$as_me: creating $ac_file" >&6;} case $f in -) echo $tmp/stdin ;; [\\/$]*) - # Absolute (can't be DOS-style, as IFS=:) - test -f "$f" || { { echo "$as_me:$LINENO: error: cannot find input file: $f" >&5 + # Absolute (can't be DOS-style, as IFS=:) + test -f "$f" || { { echo "$as_me:$LINENO: error: cannot find input file: $f" >&5 echo "$as_me: error: cannot find input file: $f" >&2;} { (exit 1); exit 1; }; } - echo $f;; + echo "$f";; *) # Relative - if test -f "$f"; then - # Build tree - echo $f - elif test -f "$srcdir/$f"; then - # Source tree - echo $srcdir/$f - else - # /dev/null tree - { { echo "$as_me:$LINENO: error: cannot find input file: $f" >&5 + if test -f "$f"; then + # Build tree + echo "$f" + elif test -f "$srcdir/$f"; then + # Source tree + echo "$srcdir/$f" + else + # /dev/null tree + { { echo "$as_me:$LINENO: error: cannot find input file: $f" >&5 echo "$as_me: error: cannot find input file: $f" >&2;} { (exit 1); exit 1; }; } - fi;; + fi;; esac done` || { (exit 1); exit 1; } _ACEOF @@ -3254,6 +3882,229 @@ s,@abs_top_builddir@,$ac_abs_top_builddir,;t t done _ACEOF +cat >>$CONFIG_STATUS <<\_ACEOF + +# +# CONFIG_HEADER section. +# + +# These sed commands are passed to sed as "A NAME B NAME C VALUE D", where +# NAME is the cpp macro being defined and VALUE is the value it is being given. +# +# ac_d sets the value in "#define NAME VALUE" lines. +ac_dA='s,^\([ ]*\)#\([ ]*define[ ][ ]*\)' +ac_dB='[ ].*$,\1#\2' +ac_dC=' ' +ac_dD=',;t' +# ac_u turns "#undef NAME" without trailing blanks into "#define NAME VALUE". +ac_uA='s,^\([ ]*\)#\([ ]*\)undef\([ ][ ]*\)' +ac_uB='$,\1#\2define\3' +ac_uC=' ' +ac_uD=',;t' + +for ac_file in : $CONFIG_HEADERS; do test "x$ac_file" = x: && continue + # Support "outfile[:infile[:infile...]]", defaulting infile="outfile.in". + case $ac_file in + - | *:- | *:-:* ) # input from stdin + cat >$tmp/stdin + ac_file_in=`echo "$ac_file" | sed 's,[^:]*:,,'` + ac_file=`echo "$ac_file" | sed 's,:.*,,'` ;; + *:* ) ac_file_in=`echo "$ac_file" | sed 's,[^:]*:,,'` + ac_file=`echo "$ac_file" | sed 's,:.*,,'` ;; + * ) ac_file_in=$ac_file.in ;; + esac + + test x"$ac_file" != x- && { echo "$as_me:$LINENO: creating $ac_file" >&5 +echo "$as_me: creating $ac_file" >&6;} + + # First look for the input files in the build tree, otherwise in the + # src tree. + ac_file_inputs=`IFS=: + for f in $ac_file_in; do + case $f in + -) echo $tmp/stdin ;; + [\\/$]*) + # Absolute (can't be DOS-style, as IFS=:) + test -f "$f" || { { echo "$as_me:$LINENO: error: cannot find input file: $f" >&5 +echo "$as_me: error: cannot find input file: $f" >&2;} + { (exit 1); exit 1; }; } + # Do quote $f, to prevent DOS paths from being IFS'd. + echo "$f";; + *) # Relative + if test -f "$f"; then + # Build tree + echo "$f" + elif test -f "$srcdir/$f"; then + # Source tree + echo "$srcdir/$f" + else + # /dev/null tree + { { echo "$as_me:$LINENO: error: cannot find input file: $f" >&5 +echo "$as_me: error: cannot find input file: $f" >&2;} + { (exit 1); exit 1; }; } + fi;; + esac + done` || { (exit 1); exit 1; } + # Remove the trailing spaces. + sed 's/[ ]*$//' $ac_file_inputs >$tmp/in + +_ACEOF + +# Transform confdefs.h into two sed scripts, `conftest.defines' and +# `conftest.undefs', that substitutes the proper values into +# config.h.in to produce config.h. The first handles `#define' +# templates, and the second `#undef' templates. +# And first: Protect against being on the right side of a sed subst in +# config.status. Protect against being in an unquoted here document +# in config.status. +rm -f conftest.defines conftest.undefs +# Using a here document instead of a string reduces the quoting nightmare. +# Putting comments in sed scripts is not portable. +# +# `end' is used to avoid that the second main sed command (meant for +# 0-ary CPP macros) applies to n-ary macro definitions. +# See the Autoconf documentation for `clear'. +cat >confdef2sed.sed <<\_ACEOF +s/[\\&,]/\\&/g +s,[\\$`],\\&,g +t clear +: clear +s,^[ ]*#[ ]*define[ ][ ]*\([^ (][^ (]*\)\(([^)]*)\)[ ]*\(.*\)$,${ac_dA}\1${ac_dB}\1\2${ac_dC}\3${ac_dD},gp +t end +s,^[ ]*#[ ]*define[ ][ ]*\([^ ][^ ]*\)[ ]*\(.*\)$,${ac_dA}\1${ac_dB}\1${ac_dC}\2${ac_dD},gp +: end +_ACEOF +# If some macros were called several times there might be several times +# the same #defines, which is useless. Nevertheless, we may not want to +# sort them, since we want the *last* AC-DEFINE to be honored. +uniq confdefs.h | sed -n -f confdef2sed.sed >conftest.defines +sed 's/ac_d/ac_u/g' conftest.defines >conftest.undefs +rm -f confdef2sed.sed + +# This sed command replaces #undef with comments. This is necessary, for +# example, in the case of _POSIX_SOURCE, which is predefined and required +# on some systems where configure will not decide to define it. +cat >>conftest.undefs <<\_ACEOF +s,^[ ]*#[ ]*undef[ ][ ]*[a-zA-Z_][a-zA-Z_0-9]*,/* & */, +_ACEOF + +# Break up conftest.defines because some shells have a limit on the size +# of here documents, and old seds have small limits too (100 cmds). +echo ' # Handle all the #define templates only if necessary.' >>$CONFIG_STATUS +echo ' if grep "^[ ]*#[ ]*define" $tmp/in >/dev/null; then' >>$CONFIG_STATUS +echo ' # If there are no defines, we may have an empty if/fi' >>$CONFIG_STATUS +echo ' :' >>$CONFIG_STATUS +rm -f conftest.tail +while grep . conftest.defines >/dev/null +do + # Write a limited-size here document to $tmp/defines.sed. + echo ' cat >$tmp/defines.sed <<CEOF' >>$CONFIG_STATUS + # Speed up: don't consider the non `#define' lines. + echo '/^[ ]*#[ ]*define/!b' >>$CONFIG_STATUS + # Work around the forget-to-reset-the-flag bug. + echo 't clr' >>$CONFIG_STATUS + echo ': clr' >>$CONFIG_STATUS + sed ${ac_max_here_lines}q conftest.defines >>$CONFIG_STATUS + echo 'CEOF + sed -f $tmp/defines.sed $tmp/in >$tmp/out + rm -f $tmp/in + mv $tmp/out $tmp/in +' >>$CONFIG_STATUS + sed 1,${ac_max_here_lines}d conftest.defines >conftest.tail + rm -f conftest.defines + mv conftest.tail conftest.defines +done +rm -f conftest.defines +echo ' fi # grep' >>$CONFIG_STATUS +echo >>$CONFIG_STATUS + +# Break up conftest.undefs because some shells have a limit on the size +# of here documents, and old seds have small limits too (100 cmds). +echo ' # Handle all the #undef templates' >>$CONFIG_STATUS +rm -f conftest.tail +while grep . conftest.undefs >/dev/null +do + # Write a limited-size here document to $tmp/undefs.sed. + echo ' cat >$tmp/undefs.sed <<CEOF' >>$CONFIG_STATUS + # Speed up: don't consider the non `#undef' + echo '/^[ ]*#[ ]*undef/!b' >>$CONFIG_STATUS + # Work around the forget-to-reset-the-flag bug. + echo 't clr' >>$CONFIG_STATUS + echo ': clr' >>$CONFIG_STATUS + sed ${ac_max_here_lines}q conftest.undefs >>$CONFIG_STATUS + echo 'CEOF + sed -f $tmp/undefs.sed $tmp/in >$tmp/out + rm -f $tmp/in + mv $tmp/out $tmp/in +' >>$CONFIG_STATUS + sed 1,${ac_max_here_lines}d conftest.undefs >conftest.tail + rm -f conftest.undefs + mv conftest.tail conftest.undefs +done +rm -f conftest.undefs + +cat >>$CONFIG_STATUS <<\_ACEOF + # Let's still pretend it is `configure' which instantiates (i.e., don't + # use $as_me), people would be surprised to read: + # /* config.h. Generated by config.status. */ + if test x"$ac_file" = x-; then + echo "/* Generated by configure. */" >$tmp/config.h + else + echo "/* $ac_file. Generated by configure. */" >$tmp/config.h + fi + cat $tmp/in >>$tmp/config.h + rm -f $tmp/in + if test x"$ac_file" != x-; then + if diff $ac_file $tmp/config.h >/dev/null 2>&1; then + { echo "$as_me:$LINENO: $ac_file is unchanged" >&5 +echo "$as_me: $ac_file is unchanged" >&6;} + else + ac_dir=`(dirname "$ac_file") 2>/dev/null || +$as_expr X"$ac_file" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ + X"$ac_file" : 'X\(//\)[^/]' \| \ + X"$ac_file" : 'X\(//\)$' \| \ + X"$ac_file" : 'X\(/\)' \| \ + . : '\(.\)' 2>/dev/null || +echo X"$ac_file" | + sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/; q; } + /^X\(\/\/\)[^/].*/{ s//\1/; q; } + /^X\(\/\/\)$/{ s//\1/; q; } + /^X\(\/\).*/{ s//\1/; q; } + s/.*/./; q'` + { if $as_mkdir_p; then + mkdir -p "$ac_dir" + else + as_dir="$ac_dir" + as_dirs= + while test ! -d "$as_dir"; do + as_dirs="$as_dir $as_dirs" + as_dir=`(dirname "$as_dir") 2>/dev/null || +$as_expr X"$as_dir" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ + X"$as_dir" : 'X\(//\)[^/]' \| \ + X"$as_dir" : 'X\(//\)$' \| \ + X"$as_dir" : 'X\(/\)' \| \ + . : '\(.\)' 2>/dev/null || +echo X"$as_dir" | + sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/; q; } + /^X\(\/\/\)[^/].*/{ s//\1/; q; } + /^X\(\/\/\)$/{ s//\1/; q; } + /^X\(\/\).*/{ s//\1/; q; } + s/.*/./; q'` + done + test ! -n "$as_dirs" || mkdir $as_dirs + fi || { { echo "$as_me:$LINENO: error: cannot create directory \"$ac_dir\"" >&5 +echo "$as_me: error: cannot create directory \"$ac_dir\"" >&2;} + { (exit 1); exit 1; }; }; } + + rm -f $ac_file + mv $tmp/config.h $ac_file + fi + else + cat $tmp/config.h + rm -f $tmp/config.h + fi +done +_ACEOF cat >>$CONFIG_STATUS <<\_ACEOF @@ -3273,8 +4124,11 @@ ac_clean_files=$ac_clean_files_save # need to make the FD available again. if test "$no_create" != yes; then ac_cs_success=: + ac_config_status_args= + test "$silent" = yes && + ac_config_status_args="$ac_config_status_args --quiet" exec 5>/dev/null - $SHELL $CONFIG_STATUS || ac_cs_success=false + $SHELL $CONFIG_STATUS $ac_config_status_args || ac_cs_success=false exec 5>>config.log # Use ||, not &&, to avoid exiting from the if with $? = 1, which # would make configure fail if this is the last instruction. diff --git a/contrib/queryperf/configure.in b/contrib/queryperf/configure.in index efbd9462..2f0f7af8 100644 --- a/contrib/queryperf/configure.in +++ b/contrib/queryperf/configure.in @@ -32,7 +32,7 @@ AC_DEFUN(AC_TYPE_SOCKLEN_T, ac_cv_type_socklen_t=no) ]) if test $ac_cv_type_socklen_t != yes; then - AC_DEFINE(socklen_t, int) + AC_DEFINE(socklen_t, int, [Define to `int' if `socklen_t' does not exist.]) fi ]) @@ -47,18 +47,22 @@ AC_DEFUN(AC_SA_LEN, ac_cv_sa_len=no) ]) if test $ac_cv_sa_len = yes; then - AC_DEFINE(HAVE_SA_LEN) + AC_DEFINE(HAVE_SA_LEN, 1, [Define to 1 if `struct sockaddr' has element `sa_len'.]) fi ]) +AC_CONFIG_HEADERS(config.h) AC_SEARCH_LIBS(res_mkquery, resolv bind) +AC_SEARCH_LIBS(__res_mkquery, resolv bind) AC_CHECK_LIB(socket, socket) AC_CHECK_LIB(nsl, inet_ntoa) AC_CHECK_FUNCS(gethostbyname2) AC_CHECK_FUNC(getaddrinfo, - AC_DEFINE(HAVE_GETADDRINFO), AC_LIBOBJ(getaddrinfo)) + AC_DEFINE(HAVE_GETADDRINFO, 1, [Define to 1 if you have the `getaddrinfo' function.]), + [AC_LIBOBJ(getaddrinfo)]) AC_CHECK_FUNC(getnameinfo, - AC_DEFINE(HAVE_GETNAMEINFO), AC_LIBOBJ(getnameinfo)) + AC_DEFINE(HAVE_GETNAMEINFO, 1, [Define to 1 if you have the `getnameinfo' function.]), + [AC_LIBOBJ(getnameinfo)]) AC_TYPE_SOCKLEN_T AC_SA_LEN diff --git a/contrib/sdb/sqlite/README.sdb_sqlite b/contrib/sdb/sqlite/README.sdb_sqlite new file mode 100644 index 00000000..36128e19 --- /dev/null +++ b/contrib/sdb/sqlite/README.sdb_sqlite @@ -0,0 +1,67 @@ + SQLite BIND SDB driver + +The SQLite BIND SDB "driver" is intended as an alternative both to the +pgsqldb and dirdb drivers, for situations that would like the management +simplicity and convenience of single filesystem files, with the additional +capability of SQL databases. It is also intended as an alternative to +the standard dynamic DNS update capability in bind, which effectively +requires use of DNSSEC keys for authorization and is limited to 'nsupdate' +for updates. An sqlite database, by contrast, uses and requires only +normal filesystem permissions, and may be updated however a typical SQLite +database might be updated, e.g., via a web service with an SQLite backend. + +This driver is not considered suitable for very high volume public +nameserver use, while likely useful for smaller private nameserver +applications, whether or not in a production environment. It should +generally be suitable wherever SQLite is preferable over larger database +engines, and not suitable where SQLite is not preferable. + +Usage: + +o Use the named_sdb process ( put ENABLE_SDB=yes in /etc/sysconfig/named ) + +o Edit your named.conf to contain a database zone, eg.: + +zone "mydomain.net." IN { + type master; + database "sqlite /etc/named.d/mydomain.db mydomain"; + # ^- DB file ^-Table +}; + +o Create the database zone table + The table must contain the columns "name", "rdtype", and "rdata", and + is expected to contain a properly constructed zone. The program + "zone2sqlite" creates such a table. + + zone2sqlite usage: + + zone2sqlite origin zonefile dbfile dbtable + + where + origin : zone origin, eg "mydomain.net." + zonefile : master zone database file, eg. mydomain.net.zone + dbfile : name of SQLite database file + dbtable : name of table in database + +--- +# mydomain.net.zone: +$TTL 1H +@ SOA localhost. root.localhost. ( 1 + 3H + 1H + 1W + 1H ) + NS localhost. +host1 A 192.168.2.1 +host2 A 192.168.2.2 +host3 A 192.168.2.3 +host4 A 192.168.2.4 +host5 A 192.168.2.5 +host6 A 192.168.2.6 +host7 A 192.168.2.7 +--- + +# zone2sqlite mydomain.net. mydomain.net.zone mydomain.net.db mydomain + +will create/update the 'mydomain' table in database file 'mydomain.net.db'. + diff --git a/contrib/sdb/sqlite/sqlitedb.c b/contrib/sdb/sqlite/sqlitedb.c new file mode 100644 index 00000000..19c03d39 --- /dev/null +++ b/contrib/sdb/sqlite/sqlitedb.c @@ -0,0 +1,324 @@ +/* + * Copyright (C) 2007 Internet Software Consortium. + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM + * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL + * INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING + * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, + * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION + * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +/* $Id: sqlitedb.c,v 1.1.2.1 2007/03/05 05:34:02 marka Exp $ */ + +#include <config.h> + +#include <stdio.h> +#include <string.h> +#include <stdlib.h> +#include <unistd.h> + +#include <sqlite3.h> + +#include <isc/mem.h> +#include <isc/print.h> +#include <isc/result.h> +#include <isc/util.h> + +#include <dns/sdb.h> +#include <dns/result.h> + +#include <named/globals.h> + +#include "sqlitedb.h" + +/* + * A simple database driver that interfaces to a SQLite database. + * + * The table must contain the fields "name", "rdtype", and "rdata", and + * is expected to contain a properly constructed zone. The program "zonetodb" + * creates such a table. + */ + +static dns_sdbimplementation_t *sqlitedb = NULL; + +typedef struct _dbinfo { + sqlite3 *db; + char *filename; + char *table; +} dbinfo_t; + + +static isc_result_t +db_connect(dbinfo_t *dbi) +{ + if (sqlite3_open(dbi->filename, &dbi->db) == SQLITE_OK) { + return (ISC_R_SUCCESS); + } else { + /* a connection is returned even if the open fails */ + sqlite3_close(dbi->db); + dbi->db = NULL; + return (ISC_R_FAILURE); + } +} + + +typedef struct _lookup_parm_t { + int i; + dns_sdblookup_t *lookup; + isc_result_t result; +} lookup_parm_t; + + +static int +sqlitedb_lookup_cb(void *p, int cc, char **cv, char **cn) +{ + lookup_parm_t *parm = p; + dns_ttl_t ttl; + char *endp; + + /* FIXME - check these(num/names); I'm assuming a mapping for now */ + char *ttlstr = cv[0]; + char *type = cv[1]; + char *data = cv[2]; + + UNUSED(cc); + UNUSED(cn); + + ttl = strtol(ttlstr, &endp, 10); + if (*endp) { + parm->result = DNS_R_BADTTL; + return 1; + } + + parm->result = dns_sdb_putrr(parm->lookup, type, ttl, data); + + if (parm->result != ISC_R_SUCCESS) + return 1; + + (parm->i)++; + + return 0; +} + + +static isc_result_t +sqlitedb_lookup(const char *zone, + const char *name, void *dbdata, + dns_sdblookup_t *lookup) +/* + * synchronous absolute name lookup + */ +{ + dbinfo_t *dbi = (dbinfo_t *) dbdata; + char *sql; + lookup_parm_t parm = { 0, lookup, ISC_R_SUCCESS }; + char *errmsg = NULL; + int result; + + UNUSED(zone); + + sql = sqlite3_mprintf( + "SELECT TTL,RDTYPE,RDATA FROM \"%q\" WHERE " + "lower(NAME) = lower('%q')", + dbi->table, name); + + result = sqlite3_exec(dbi->db, sql, + &sqlitedb_lookup_cb, &parm, + &errmsg); + sqlite3_free(sql); + + if (result != SQLITE_OK) + return (ISC_R_FAILURE); + if (parm.i == 0) + return (ISC_R_NOTFOUND); + + return (ISC_R_SUCCESS); +} + + +typedef struct _allnodes_parm_t { + int i; + dns_sdballnodes_t *allnodes; + isc_result_t result; +} allnodes_parm_t; + + +static int +sqlitedb_allnodes_cb(void *p, int cc, char **cv, char **cn) +{ + allnodes_parm_t *parm = p; + dns_ttl_t ttl; + char *endp; + + /* FIXME - check these(num/names); I'm assuming a mapping for now */ + char *ttlstr = cv[0]; + char *name = cv[1]; + char *type = cv[2]; + char *data = cv[3]; + + UNUSED(cc); + UNUSED(cn); + + ttl = strtol(ttlstr, &endp, 10); + if (*endp) { + parm->result = DNS_R_BADTTL; + return 1; + } + + parm->result = dns_sdb_putnamedrr(parm->allnodes, name, type, ttl, data); + + if (parm->result != ISC_R_SUCCESS) + return 1; + + (parm->i)++; + + return 0; +} + + +static isc_result_t +sqlitedb_allnodes(const char *zone, + void *dbdata, + dns_sdballnodes_t *allnodes) +{ + dbinfo_t *dbi = (dbinfo_t *) dbdata; + char *sql; + allnodes_parm_t parm = { 0, allnodes, ISC_R_SUCCESS }; + char *errmsg = NULL; + int result; + + UNUSED(zone); + + sql = sqlite3_mprintf( + "SELECT TTL,NAME,RDTYPE,RDATA FROM \"%q\" ORDER BY NAME", + dbi->table); + + result = sqlite3_exec(dbi->db, sql, + &sqlitedb_allnodes_cb, &parm, + &errmsg); + sqlite3_free(sql); + + if (result != SQLITE_OK) + return (ISC_R_FAILURE); + if (parm.i == 0) + return (ISC_R_NOTFOUND); + + return (ISC_R_SUCCESS); +} + + +static void +sqlitedb_destroy(const char *zone, void *driverdata, void **dbdata) +{ + dbinfo_t *dbi = *dbdata; + + UNUSED(zone); + UNUSED(driverdata); + + if (dbi->db != NULL) + sqlite3_close(dbi->db); + if (dbi->table != NULL) + isc_mem_free(ns_g_mctx, dbi->table); + if (dbi->filename != NULL) + isc_mem_free(ns_g_mctx, dbi->filename); + + isc_mem_put(ns_g_mctx, dbi, sizeof(dbinfo_t)); +} + + +#define STRDUP_OR_FAIL(target, source) \ + do { \ + target = isc_mem_strdup(ns_g_mctx, source); \ + if (target == NULL) { \ + result = ISC_R_NOMEMORY; \ + goto cleanup; \ + } \ + } while (0); + +/* + * Create a connection to the database and save any necessary information + * in dbdata. + * + * argv[0] is the name of the database file + * argv[1] is the name of the table + */ +static isc_result_t +sqlitedb_create(const char *zone, + int argc, char **argv, + void *driverdata, void **dbdata) +{ + dbinfo_t *dbi; + isc_result_t result; + + UNUSED(zone); + UNUSED(driverdata); + + if (argc < 2) + return (ISC_R_FAILURE); + + dbi = isc_mem_get(ns_g_mctx, sizeof(dbinfo_t)); + if (dbi == NULL) + return (ISC_R_NOMEMORY); + dbi->db = NULL; + dbi->filename = NULL; + dbi->table = NULL; + + STRDUP_OR_FAIL(dbi->filename, argv[0]); + STRDUP_OR_FAIL(dbi->table, argv[1]); + + result = db_connect(dbi); + if (result != ISC_R_SUCCESS) + goto cleanup; + + *dbdata = dbi; + return (ISC_R_SUCCESS); + +cleanup: + sqlitedb_destroy(zone, driverdata, (void **)&dbi); + return (result); +} + + +/* + * Since the SQL database corresponds to a zone, the authority data should + * be returned by the lookup() function. Therefore the authority() function + * is NULL. + */ +static dns_sdbmethods_t sqlitedb_methods = { + sqlitedb_lookup, + NULL, /* authority */ + sqlitedb_allnodes, + sqlitedb_create, + sqlitedb_destroy +}; + + +/* + * Wrapper around dns_sdb_register(). + */ +isc_result_t +sqlitedb_init(void) +{ + unsigned int flags; + flags = 0; + return (dns_sdb_register("sqlite", &sqlitedb_methods, NULL, flags, + ns_g_mctx, &sqlitedb)); +} + + +/* + * Wrapper around dns_sdb_unregister(). + */ +void +sqlitedb_clear(void) +{ + if (sqlitedb != NULL) + dns_sdb_unregister(&sqlitedb); +} diff --git a/contrib/sdb/sqlite/sqlitedb.h b/contrib/sdb/sqlite/sqlitedb.h new file mode 100644 index 00000000..19686c66 --- /dev/null +++ b/contrib/sdb/sqlite/sqlitedb.h @@ -0,0 +1,25 @@ +/* + * Copyright (C) 2000-2002 Internet Software Consortium. + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM + * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL + * INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING + * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, + * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION + * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +/* $Id: sqlitedb.h,v 1.1.2.1 2007/03/05 05:34:02 marka Exp $ */ + +#include <isc/types.h> + +isc_result_t sqlitedb_init(void); + +void sqlitedb_clear(void); + diff --git a/contrib/sdb/sqlite/zone2sqlite.c b/contrib/sdb/sqlite/zone2sqlite.c new file mode 100644 index 00000000..618816c6 --- /dev/null +++ b/contrib/sdb/sqlite/zone2sqlite.c @@ -0,0 +1,301 @@ +/* + * Copyright (C) 2007 Internet Software Consortium. + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM + * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL + * INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING + * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, + * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION + * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +/* $Id: zone2sqlite.c,v 1.1.2.1 2007/03/05 05:34:02 marka Exp $ */ + +#include <stdlib.h> +#include <string.h> + +#include <isc/buffer.h> +#include <isc/mem.h> +#include <isc/print.h> +#include <isc/result.h> + +#include <dns/db.h> +#include <dns/dbiterator.h> +#include <dns/fixedname.h> +#include <dns/name.h> +#include <dns/rdata.h> +#include <dns/rdataset.h> +#include <dns/rdatasetiter.h> +#include <dns/rdatatype.h> +#include <dns/result.h> + +#include <sqlite3.h> + +#ifndef UNUSED +#define UNUSED(x) (x) = (x) +#endif + +/* + * Generate an SQLite table from a zone. + */ + +typedef struct _dbinfo { + sqlite3 *db; + char *filename; + char *table; +} dbinfo_t; + +dbinfo_t dbi = { NULL, NULL, NULL }; + + +static void +closeandexit(int status) +{ + if (dbi.db) { + sqlite3_close(dbi.db); + dbi.db = NULL; + } + exit(status); +} + +static void +check_result(isc_result_t result, const char *message) +{ + if (result != ISC_R_SUCCESS) { + fprintf(stderr, "%s: %s\n", message, + isc_result_totext(result)); + closeandexit(1); + } +} + +static isc_result_t +db_connect(dbinfo_t *dbi) +{ + if (sqlite3_open(dbi->filename, &dbi->db) == SQLITE_OK) { + return (ISC_R_SUCCESS); + } else { + /* a connection is returned even if the open fails */ + sqlite3_close(dbi->db); + dbi->db = NULL; + return (ISC_R_FAILURE); + } +} + +static int +add_rdata_cb(void *parm, int cc, char **cv, char **cn) +{ + UNUSED(parm); + UNUSED(cc); + UNUSED(cv); + UNUSED(cn); + + return 0; +} + + +static void +addrdata(dns_name_t *name, dns_ttl_t ttl, dns_rdata_t *rdata) +{ + unsigned char namearray[DNS_NAME_MAXTEXT + 1]; + unsigned char typearray[20]; + unsigned char dataarray[2048]; + isc_buffer_t b; + isc_result_t result; + char *sql; + char *errmsg = NULL; + int res; + + isc_buffer_init(&b, namearray, sizeof(namearray) - 1); + result = dns_name_totext(name, ISC_TRUE, &b); + check_result(result, "dns_name_totext"); + namearray[isc_buffer_usedlength(&b)] = 0; + + isc_buffer_init(&b, typearray, sizeof(typearray) - 1); + result = dns_rdatatype_totext(rdata->type, &b); + check_result(result, "dns_rdatatype_totext"); + typearray[isc_buffer_usedlength(&b)] = 0; + + isc_buffer_init(&b, dataarray, sizeof(dataarray) - 1); + result = dns_rdata_totext(rdata, NULL, &b); + check_result(result, "dns_rdata_totext"); + dataarray[isc_buffer_usedlength(&b)] = 0; + + sql = sqlite3_mprintf( + "INSERT INTO %q (NAME, TTL, RDTYPE, RDATA)" + " VALUES ('%q', %d, '%q', '%q') ", + dbi.table, + namearray, ttl, typearray, dataarray); + printf("%s\n", sql); + res = sqlite3_exec(dbi.db, sql, add_rdata_cb, NULL, &errmsg); + sqlite3_free(sql); + + if (result != SQLITE_OK) { + fprintf(stderr, "INSERT failed: %s\n", errmsg); + closeandexit(1); + } +} + +int +main(int argc, char *argv[]) +{ + char *sql; + int res; + char *errmsg = NULL; + char *porigin, *zonefile; + dns_fixedname_t forigin, fname; + dns_name_t *origin, *name; + dns_db_t *db = NULL; + dns_dbiterator_t *dbiter; + dns_dbnode_t *node; + dns_rdatasetiter_t *rdsiter; + dns_rdataset_t rdataset; + dns_rdata_t rdata = DNS_RDATA_INIT; + isc_mem_t *mctx = NULL; + isc_buffer_t b; + isc_result_t result; + + if (argc != 5) { + printf("usage: %s <zone> <zonefile> <dbfile> <dbtable>\n", argv[0]); + exit(1); + } + + porigin = argv[1]; + zonefile = argv[2]; + + dbi.filename = argv[3]; + dbi.table = argv[4]; + + dns_result_register(); + + mctx = NULL; + result = isc_mem_create(0, 0, &mctx); + check_result(result, "isc_mem_create"); + + isc_buffer_init(&b, porigin, strlen(porigin)); + isc_buffer_add(&b, strlen(porigin)); + dns_fixedname_init(&forigin); + origin = dns_fixedname_name(&forigin); + result = dns_name_fromtext(origin, &b, dns_rootname, ISC_FALSE, NULL); + check_result(result, "dns_name_fromtext"); + + db = NULL; + result = dns_db_create(mctx, "rbt", origin, dns_dbtype_zone, + dns_rdataclass_in, 0, NULL, &db); + check_result(result, "dns_db_create"); + + result = dns_db_load(db, zonefile); + if (result == DNS_R_SEENINCLUDE) + result = ISC_R_SUCCESS; + check_result(result, "dns_db_load"); + + printf("Connecting to '%s'\n", dbi.filename); + + if ((result = db_connect(&dbi)) != ISC_R_SUCCESS) { + fprintf(stderr, "Connection to database '%s' failed\n", + dbi.filename); + closeandexit(1); + } + + sql = sqlite3_mprintf("DROP TABLE %q ", dbi.table); + printf("%s\n", sql); + res = sqlite3_exec(dbi.db, sql, NULL, NULL, &errmsg); + sqlite3_free(sql); +#if 0 + if (res != SQLITE_OK) { + fprintf(stderr, "DROP TABLE %s failed: %s\n", + dbi.table, errmsg); + } +#endif + +#if 0 + sql = sqlite3_mprintf(sql, "BEGIN TRANSACTION"); + printf("%s\n", sql); + res = sqlite3_exec(dbi.db, sql, NULL, NULL, &errmsg); + sqlite3_free(sql); + if (res != SQLITE_OK) { + fprintf(stderr, "BEGIN TRANSACTION failed: %s\n", errmsg); + closeandexit(1); + } +#endif + + sql = sqlite3_mprintf( + "CREATE TABLE %q " + "(NAME TEXT, TTL INTEGER, RDTYPE TEXT, RDATA TEXT) ", + dbi.table); + printf("%s\n", sql); + res = sqlite3_exec(dbi.db, sql, NULL, NULL, &errmsg); + sqlite3_free(sql); + if (res != SQLITE_OK) { + fprintf(stderr, "CREATE TABLE %s failed: %s\n", + dbi.table, errmsg); + closeandexit(1); + } + + dbiter = NULL; + result = dns_db_createiterator(db, ISC_FALSE, &dbiter); + check_result(result, "dns_db_createiterator()"); + + result = dns_dbiterator_first(dbiter); + check_result(result, "dns_dbiterator_first"); + + dns_fixedname_init(&fname); + name = dns_fixedname_name(&fname); + dns_rdataset_init(&rdataset); + dns_rdata_init(&rdata); + + while (result == ISC_R_SUCCESS) { + node = NULL; + result = dns_dbiterator_current(dbiter, &node, name); + if (result == ISC_R_NOMORE) + break; + check_result(result, "dns_dbiterator_current"); + + rdsiter = NULL; + result = dns_db_allrdatasets(db, node, NULL, 0, &rdsiter); + check_result(result, "dns_db_allrdatasets"); + + result = dns_rdatasetiter_first(rdsiter); + + while (result == ISC_R_SUCCESS) { + dns_rdatasetiter_current(rdsiter, &rdataset); + result = dns_rdataset_first(&rdataset); + check_result(result, "dns_rdataset_first"); + while (result == ISC_R_SUCCESS) { + dns_rdataset_current(&rdataset, &rdata); + addrdata(name, rdataset.ttl, &rdata); + dns_rdata_reset(&rdata); + result = dns_rdataset_next(&rdataset); + } + dns_rdataset_disassociate(&rdataset); + result = dns_rdatasetiter_next(rdsiter); + } + dns_rdatasetiter_destroy(&rdsiter); + dns_db_detachnode(db, &node); + result = dns_dbiterator_next(dbiter); + } + +#if 0 + sql = sqlite3_mprintf(sql, "COMMIT TRANSACTION "); + printf("%s\n", sql); + res = sqlite3_exec(dbi.db, sql, NULL, NULL, &errmsg); + sqlite3_free(sql); + if (res != SQLITE_OK) { + fprintf(stderr, "COMMIT TRANSACTION failed: %s\n", errmsg); + closeandexit(1); + } +#endif + + dns_dbiterator_destroy(&dbiter); + dns_db_detach(&db); + isc_mem_destroy(&mctx); + + closeandexit(0); + + exit(0); +} diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml index 17e778d5..22cd07de 100644 --- a/doc/arm/Bv9ARM-book.xml +++ b/doc/arm/Bv9ARM-book.xml @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- File: $Id: Bv9ARM-book.xml,v 1.241.18.66 2007/01/29 23:57:20 marka Exp $ --> +<!-- File: $Id: Bv9ARM-book.xml,v 1.241.18.78 2007/07/09 02:18:49 marka Exp $ --> <book xmlns:xi="http://www.w3.org/2001/XInclude"> <title>BIND 9 Administrator Reference Manual</title> @@ -91,8 +91,8 @@ security considerations, and <emphasis>Section 8</emphasis> contains troubleshooting help. The main body of the document is followed by several - <emphasis>Appendices</emphasis> which contain useful reference - information, such as a <emphasis>Bibliography</emphasis> and + <emphasis>appendices</emphasis> which contain useful reference + information, such as a <emphasis>bibliography</emphasis> and historic information related to <acronym>BIND</acronym> and the Domain Name System. @@ -229,8 +229,8 @@ <title>The Domain Name System (<acronym>DNS</acronym>)</title> <para> The purpose of this document is to explain the installation - and upkeep of the <acronym>BIND</acronym> software - package, and we + and upkeep of the <acronym>BIND</acronym> (Berkeley Internet + Name Domain) software package, and we begin by reviewing the fundamentals of the Domain Name System (<acronym>DNS</acronym>) as they relate to <acronym>BIND</acronym>. </para> @@ -464,7 +464,7 @@ <title>Caching Name Servers</title> <!-- - - Terminology here is inconsistant. Probably ought to + - Terminology here is inconsistent. Probably ought to - convert to using "recursive name server" everywhere - with just a note about "caching" terminology. --> @@ -600,7 +600,7 @@ traffic. Additionally, if additional section caching (<xref linkend="acache"/>) is enabled, - the <command>max-acache-size</command> can be used to + the <command>max-acache-size</command> option can be used to limit the amount of memory used by the mechanism. It is still good practice to have enough memory to load @@ -741,8 +741,8 @@ zone "eng.example.com" { <para> A primitive form of load balancing can be achieved in - the <acronym>DNS</acronym> by using multiple A records for - one name. + the <acronym>DNS</acronym> by using multiple records + (such as multiple A records) for one name. </para> <para> @@ -955,12 +955,15 @@ zone "eng.example.com" { </para> <cmdsynopsis label="Usage"> <command>host</command> - <arg>-aCdlrTwv</arg> + <arg>-aCdlnrsTwv</arg> <arg>-c <replaceable>class</replaceable></arg> <arg>-N <replaceable>ndots</replaceable></arg> <arg>-t <replaceable>type</replaceable></arg> <arg>-W <replaceable>timeout</replaceable></arg> <arg>-R <replaceable>retries</replaceable></arg> + <arg>-m <replaceable>flag</replaceable></arg> + <arg>-4</arg> + <arg>-6</arg> <arg choice="plain"><replaceable>hostname</replaceable></arg> <arg><replaceable>server</replaceable></arg> </cmdsynopsis> @@ -1085,6 +1088,12 @@ zone "eng.example.com" { (<command>rndc</command>) program allows the system administrator to control the operation of a name server. + Since <acronym>BIND</acronym> 9.2, <command>rndc</command> + supports all the commands of the BIND 8 <command>ndc</command> + utility except <command>ndc start</command> and + <command>ndc restart</command>, which were also + not supported in <command>ndc</command>'s + channel mode. If you run <command>rndc</command> without any options it will display a usage message as follows: @@ -1357,15 +1366,6 @@ zone "eng.example.com" { </variablelist> <para> - In <acronym>BIND</acronym> 9.2, <command>rndc</command> - supports all the commands of the BIND 8 <command>ndc</command> - utility except <command>ndc start</command> and - <command>ndc restart</command>, which were also - not supported in <command>ndc</command>'s - channel mode. - </para> - - <para> A configuration file is required, since all communication with the server is authenticated with digital signatures that rely on a shared secret, and @@ -1743,7 +1743,7 @@ controls { However, since listing addresses of internal servers that external clients cannot possibly reach can result in connection delays and other annoyances, an organization may - choose to use a Split DNS to present a consistant view of itself + choose to use a Split DNS to present a consistent view of itself to the outside world. </para> <para> @@ -1753,9 +1753,8 @@ controls { on the Internet. Split DNS can also be used to allow mail from outside back in to the internal network. </para> - <para> - Here is an example of a split DNS setup: - </para> + <sect2> + <title>Example split DNS setup</title> <para> Let's say a company named <emphasis>Example, Inc.</emphasis> (<literal>example.com</literal>) @@ -1990,6 +1989,7 @@ nameserver 172.16.72.3 nameserver 172.16.72.4 </programlisting> + </sect2> </sect1> <sect1 id="tsig"> <title>TSIG</title> @@ -2187,7 +2187,7 @@ allow-update { key host1-host2. ;}; outside of the allowed range, the response will be signed with the TSIG extended error code set to BADTIME, and the time values will be adjusted so that the response can be successfully - verified. In any of these cases, the message's rcode is set to + verified. In any of these cases, the message's rcode (response code) is set to NOTAUTH (not authenticated). </para> @@ -2266,7 +2266,7 @@ allow-update { key host1-host2. ;}; <para> Cryptographic authentication of DNS information is possible through the DNS Security (<emphasis>DNSSEC-bis</emphasis>) extensions, - defined in RFC 4033, RFC 4034 and RFC 4035. + defined in RFC 4033, RFC 4034, and RFC 4035. This section describes the creation and use of DNSSEC signed zones. </para> @@ -2334,7 +2334,7 @@ allow-update { key host1-host2. ;}; <filename>Kchild.example.+005+12345.key</filename> and <filename>Kchild.example.+005+12345.private</filename> (where - 12345 is an example of a key tag). The key file names contain + 12345 is an example of a key tag). The key filenames contain the key name (<filename>child.example.</filename>), algorithm (3 is DSA, 1 is RSAMD5, 5 is RSASHA1, etc.), and the key tag (12345 in @@ -2402,7 +2402,7 @@ allow-update { key host1-host2. ;}; <para><command>dnssec-signzone</command> will also produce a keyset and dsset files and optionally a dlvset file. These are used to provide the parent zone - administators with the <literal>DNSKEYs</literal> (or their + administrators with the <literal>DNSKEYs</literal> (or their corresponding <literal>DS</literal> records) that are the secure entry point to the zone. </para> @@ -2421,7 +2421,7 @@ allow-update { key host1-host2. ;}; <para> To enable <command>named</command> to validate answers from other servers both <command>dnssec-enable</command> and - <command>dnssec-validate</command> must be set and some + <command>dnssec-validation</command> must be set and some <command>trusted-keys</command> must be configured into <filename>named.conf</filename>. </para> @@ -2840,7 +2840,7 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa. <entry colname="2"> <para> An IP port <varname>number</varname>. - <varname>number</varname> is limited to 0 + The <varname>number</varname> is limited to 0 through 65535, with values below 1024 typically restricted to use by processes running as root. @@ -3109,7 +3109,7 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa. <para> The <acronym>BIND</acronym> 9 comment syntax allows for comments to appear - anywhere that white space may appear in a <acronym>BIND</acronym> configuration + anywhere that whitespace may appear in a <acronym>BIND</acronym> configuration file. To appeal to programmers of all kinds, they can be written in the C, C++, or shell/perl style. </para> @@ -3126,7 +3126,7 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa. <sect3> <title>Definition and Usage</title> <para> - Comments may appear anywhere that white space may appear in + Comments may appear anywhere that whitespace may appear in a <acronym>BIND</acronym> configuration file. </para> <para> @@ -3649,7 +3649,7 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa. <literal>hmac-sha256</literal>, <literal>hmac-sha384</literal> and <literal>hmac-sha512</literal> TSIG authentication. Truncated hashes are supported by appending the minimum - number of required bits preceeded by a dash, e.g. + number of required bits preceded by a dash, e.g. <literal>hmac-sha1-80</literal>. The <replaceable>secret_string</replaceable> is the secret to be used by the algorithm, and is treated as a base-64 @@ -4289,7 +4289,7 @@ category notify { null; }; The <command>lwres</command> statement configures the name server to also act as a lightweight resolver server. (See - <xref linkend="lwresd"/>.) There may be be multiple + <xref linkend="lwresd"/>.) There may be multiple <command>lwres</command> statements configuring lightweight resolver servers with different properties. </para> @@ -4376,6 +4376,7 @@ category notify { null; }; <optional> dump-file <replaceable>path_name</replaceable>; </optional> <optional> memstatistics-file <replaceable>path_name</replaceable>; </optional> <optional> pid-file <replaceable>path_name</replaceable>; </optional> + <optional> recursing-file <replaceable>path_name</replaceable>; </optional> <optional> statistics-file <replaceable>path_name</replaceable>; </optional> <optional> zone-statistics <replaceable>yes_or_no</replaceable>; </optional> <optional> auth-nxdomain <replaceable>yes_or_no</replaceable>; </optional> @@ -4453,6 +4454,7 @@ category notify { null; }; <optional> alt-transfer-source (<replaceable>ip4_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> ; </optional> <optional> alt-transfer-source-v6 (<replaceable>ip6_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> ; </optional> <optional> use-alt-transfer-source <replaceable>yes_or_no</replaceable>; </optional> + <optional> notify-delay <replaceable>seconds</replaceable> ; </optional> <optional> notify-source (<replaceable>ip4_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> ; </optional> <optional> notify-source-v6 (<replaceable>ip6_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> ; </optional> <optional> also-notify { <replaceable>ip_addr</replaceable> <optional>port <replaceable>ip_port</replaceable></optional> ; <optional> <replaceable>ip_addr</replaceable> <optional>port <replaceable>ip_port</replaceable></optional> ; ... </optional> }; </optional> @@ -4657,7 +4659,7 @@ digits</varname>" + "<varname>tkey-domain</varname>". In most cases, name server. Specifying <command>pid-file none</command> disables the use of a PID file — no file will be written and any existing one will be removed. Note that <command>none</command> - is a keyword, not a file name, and therefore is not enclosed + is a keyword, not a filename, and therefore is not enclosed in double quotes. </para> @@ -4665,6 +4667,18 @@ digits</varname>" + "<varname>tkey-domain</varname>". In most cases, </varlistentry> <varlistentry> + <term><command>recursing-file</command></term> + <listitem> + <para> + The pathname of the file the server dumps + the queries that are currently recursing when instructed + to do so with <command>rndc recursing</command>. + If not specified, the default is <filename>named.recursing</filename>. + </para> + </listitem> + </varlistentry> + + <varlistentry> <term><command>statistics-file</command></term> <listitem> <para> @@ -5286,7 +5300,7 @@ options { <para> <emphasis>This option is obsolete</emphasis>. If you need to disable IXFR to a particular server or - servers see + servers, see the information on the <command>provide-ixfr</command> option in <xref linkend="server_statement_definition_and_usage"/>. See also @@ -5520,6 +5534,7 @@ options { <para> Accept expired signatures when verifying DNSSEC signatures. The default is <userinput>no</userinput>. + Setting this option to "yes" leaves named vulnerable to replay attacks. </para> </listitem> </varlistentry> @@ -5563,7 +5578,7 @@ options { and MX records. It also applies to the RDATA of PTR records where the owner name indicated that it is a reverse lookup of a hostname - (the owner name ends in IN-ADDR.ARPA, IP6.ARPA or IP6.INT). + (the owner name ends in IN-ADDR.ARPA, IP6.ARPA, or IP6.INT). </para> </listitem> </varlistentry> @@ -5606,7 +5621,7 @@ options { MX and SRV records only in-zone hostnames are checked (for out-of-zone hostnames use named-checkzone). For NS records only names below top of zone are - checked (for out-of-zone names and glue consistancy + checked (for out-of-zone names and glue consistency checks use named-checkzone). The default is <command>yes</command>. </para> @@ -5827,15 +5842,12 @@ options { <listitem> <para> Specifies which hosts are allowed to get answers - from the cache. The default is the builtin acls - <command>localnets</command> and - <command>localhost</command>. - </para> - <para> - The way to set query access to the cache is now - via <command>allow-query-cache</command>. - This differs from earlier versions which used - <command>allow-query</command>. + from the cache. If <command>allow-query-cache</command> + is not set then <command>allow-recursion</command> + is used if set, otherwise <command>allow-query</command> + is used if set, otherwise the default + (<command>localnets;</command> + <command>localhost;</command>) is used. </para> </listitem> </varlistentry> @@ -5843,16 +5855,16 @@ options { <varlistentry> <term><command>allow-recursion</command></term> <listitem> - <para> + <para> Specifies which hosts are allowed to make recursive - queries through this server. If not specified, - the default is to allow recursive queries from - the builtin acls <command>localnets</command> and - <command>localhost</command>. - Note that disallowing recursive queries for a - host does not prevent the host from retrieving - data that is already in the server's cache. - </para> + queries through this server. If + <command>allow-recursion</command> is not set + then <command>allow-query-cache</command> is + used if set, otherwise <command>allow-query</command> + is used if set, otherwise the default + (<command>localnets;</command> + <command>localhost;</command>) is used. + </para> </listitem> </varlistentry> @@ -6683,7 +6695,7 @@ query-source-v6 address * port *; </para><note> <simpara> Not yet implemented in - <acronym>BIND</acronym>9. + <acronym>BIND</acronym> 9. </simpara> </note> </listitem> @@ -7070,7 +7082,7 @@ query-source-v6 address * port *; values are 512 to 4096 (values outside this range will be silently adjusted). The default value is 4096. The usual reason for setting edns-udp-size to - a non-default value it to get UDP answers to pass + a non-default value is to get UDP answers to pass through broken firewalls that block fragmented packets and/or block UDP packets that are greater than 512 bytes. @@ -7090,6 +7102,8 @@ query-source-v6 address * port *; answers to pass through broken firewalls that block fragmented packets and/or block UDP packets that are greater than 512 bytes. + This is independent of the advertised receive + buffer (<command>edns-udp-size</command>). </para> </listitem> </varlistentry> @@ -7158,6 +7172,16 @@ query-source-v6 address * port *; </para> </listitem> </varlistentry> + + <varlistentry> + <term><command>notify-delay</command></term> + <listitem> + <para> + The delay, in seconds, between sending sets of notify + messages for a zone. The default is zero. + </para> + </listitem> + </varlistentry> </variablelist> </sect3> @@ -7248,7 +7272,7 @@ query-source-v6 address * port *; Named has some built-in empty zones (SOA and NS records only). These are for zones that should normally be answered locally and which queries should not be sent to the Internet's root - servers. The offical servers which cover these namespaces + servers. The official servers which cover these namespaces return NXDOMAIN responses to these queries. In particular, these cover the reverse namespace for addresses from RFC 1918 and RFC 3330. They also include the reverse namespace for IPv6 local @@ -7307,10 +7331,10 @@ query-source-v6 address * port *; If you are using the address ranges covered here, you should already have reverse zones covering the addresses you use. In practice this appears to not be the case with many queries - being made to the infrustructure servers for names in these + being made to the infrastructure servers for names in these spaces. So many in fact that sacrificial servers were needed to be deployed to channel the query load away from the - infrustructure servers. + infrastructure servers. </para> <note> The real parent servers for these zones should disable all @@ -7475,6 +7499,32 @@ query-source-v6 address * port *; </para> </entry> </row> + <row rowsep="0"> + <entry colname="1"> + <para><command>duplicate</command></para> + </entry> + <entry colname="2"> + <para> + The number of queries which the server attempted to + recurse but discover a existing query with the same + IP address, port, query id, name, type and class + already being processed. + </para> + </entry> + </row> + <row rowsep="0"> + <entry colname="1"> + <para><command>dropped</command></para> + </entry> + <entry colname="2"> + <para> + The number of queries for which the server + discovered a excessive number of existing + recursive queries for the same name, type and + class and were subsequently dropped. + </para> + </entry> + </row> </tbody> </tgroup> </informaltable> @@ -8031,6 +8081,7 @@ view "external" { <optional> max-transfer-idle-out <replaceable>number</replaceable> ; </optional> <optional> max-transfer-time-out <replaceable>number</replaceable> ; </optional> <optional> notify <replaceable>yes_or_no</replaceable> | <replaceable>explicit</replaceable> | <replaceable>master-only</replaceable> ; </optional> + <optional> notify-delay <replaceable>seconds</replaceable> ; </optional> <optional> pubkey <replaceable>number</replaceable> <replaceable>number</replaceable> <replaceable>number</replaceable> <replaceable>string</replaceable> ; </optional> <optional> notify-source (<replaceable>ip4_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> ; </optional> <optional> notify-source-v6 (<replaceable>ip6_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> ; </optional> @@ -8197,7 +8248,7 @@ zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replacea numbers (in the tens or hundreds of thousands) of zones per server, it is best to - use a two-level naming scheme for zone file names. For + use a two-level naming scheme for zone filenames. For example, a slave server for the zone <literal>example.com</literal> might place the zone contents into a file called @@ -8367,7 +8418,7 @@ zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replacea a synonym for hesiod. </para> <para> - Another MIT development is CHAOSnet, a LAN protocol created + Another MIT development is Chaosnet, a LAN protocol created in the mid-1970s. Zone data for it can be specified with the <literal>CHAOS</literal> class. </para> </sect3> @@ -8643,8 +8694,8 @@ zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replacea <term><command>journal</command></term> <listitem> <para> - Allow the default journal's file name to be overridden. - The default is the zone's file with "<filename>.jnl</filename>" appended. + Allow the default journal's filename to be overridden. + The default is the zone's filename with "<filename>.jnl</filename>" appended. This is applicable to <command>master</command> and <command>slave</command> zones. </para> </listitem> @@ -8701,6 +8752,16 @@ zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replacea </varlistentry> <varlistentry> + <term><command>notify-delay</command></term> + <listitem> + <para> + See the description of + <command>notify-delay</command> in <xref linkend="tuning"/>. + </para> + </listitem> + </varlistentry> + + <varlistentry> <term><command>pubkey</command></term> <listitem> <para> @@ -8935,7 +8996,7 @@ zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replacea wildcard name, it is subject to DNS wildcard expansion, so the rule will apply to multiple identities. The <replaceable>identity</replaceable> field must - contain a fully qualified domain name. + contain a fully-qualified domain name. </para> <para> @@ -9049,7 +9110,7 @@ zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replacea <para> In all cases, the <replaceable>name</replaceable> field must - specify a fully qualified domain name. + specify a fully-qualified domain name. </para> <para> @@ -9662,7 +9723,7 @@ zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replacea </entry> <entry colname="2"> <para> - CHAOSnet, a LAN protocol created at MIT in the + Chaosnet, a LAN protocol created at MIT in the mid-1970s. Rarely used for its historical purpose, but reused for BIND's @@ -10242,7 +10303,7 @@ zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replacea <note> <para> The <command>$ORIGIN</command> lines in the examples - are for providing context to the examples only-they do not + are for providing context to the examples only — they do not necessarily appear in the actual usage. They are only used here to indicate that the example is relative to the listed origin. @@ -10406,14 +10467,14 @@ $GENERATE 1-127 $ CNAME $.0</programlisting> <para><command>lhs</command></para> </entry> <entry colname="2"> - <para><command>lhs</command> + <para>This describes the owner name of the resource records to be created. Any single <command>$</command> (dollar sign) symbols within the <command>lhs</command> side are replaced by the iterator value. - To get a $ in the output you need to escape the + To get a $ in the output, you need to escape the <command>$</command> using a backslash <command>\</command>, e.g. <command>\$</command>. The @@ -10422,7 +10483,7 @@ $GENERATE 1-127 $ CNAME $.0</programlisting> iterator, field width and base. Modifiers are introduced by a - <command>{</command> immediately following the + <command>{</command> (left brace) immediately following the <command>$</command> as <command>${offset[,width[,base]]}</command>. For example, <command>${-20,3,d}</command> @@ -10495,7 +10556,7 @@ $GENERATE 1-127 $ CNAME $.0</programlisting> </entry> <entry colname="2"> <para> - A domain name. It is processed + <command>rhs</command> is a domain name. It is processed similarly to lhs. </para> </entry> @@ -10622,7 +10683,7 @@ zone "example.com" { </para> </sect1> <sect1> - <title><command>chroot</command> and <command>setuid</command></title> + <title><command>Chroot</command> and <command>Setuid</command></title> <para> On UNIX servers, it is possible to run <acronym>BIND</acronym> in a <emphasis>chrooted</emphasis> environment (using the <command>chroot()</command> function) by specifying the "<option>-t</option>" @@ -10661,7 +10722,7 @@ zone "example.com" { for this. </para> <para> - Unlike with earlier versions of BIND, you will typically + Unlike with earlier versions of BIND, you typically will <emphasis>not</emphasis> need to compile <command>named</command> statically nor install shared libraries under the new root. However, depending on your operating system, you may need @@ -10762,12 +10823,12 @@ zone "example.com" { <title>Incrementing and Changing the Serial Number</title> <para> - Zone serial numbers are just numbers-they aren't date + Zone serial numbers are just numbers — they aren't date related. A lot of people set them to a number that represents a - date, usually of the form YYYYMMDDRR. A number of people have been - testing these numbers for Y2K compliance and have set the number - to the year 2000 to see if it will work. They then try to restore - the old serial number. This will cause problems because serial + date, usually of the form YYYYMMDDRR. A number of people + tested these numbers for Y2K compliance and set the number + to the year 2000 to see if it would work. They then tried to restore + the old serial number. This caused problems because serial numbers are used to indicate that a zone has been updated. If the serial number on the slave server is lower than the serial number on the master, the slave server will attempt to update its copy of @@ -10869,7 +10930,7 @@ zone "example.com" { during that time: Doug Kingston, Craig Partridge, Smoot Carl-Mitchell, Mike Muuss, Jim Bloom and Mike Schwartz. <acronym>BIND</acronym> maintenance was subsequently - handled by Mike Karels and O. Kure. + handled by Mike Karels and Øivind Kure. </para> <para> <acronym>BIND</acronym> versions 4.9 and 4.9.1 were @@ -10884,7 +10945,7 @@ zone "example.com" { Wolfhugel, and others. </para> <para> - <acronym>BIND</acronym> version 4.9.2 was sponsored by + In 1994, <acronym>BIND</acronym> version 4.9.2 was sponsored by Vixie Enterprises. Paul Vixie became <acronym>BIND</acronym>'s principal architect/programmer. @@ -10894,10 +10955,25 @@ zone "example.com" { have been developed and maintained by the Internet Systems Consortium and its predecessor, the Internet Software Consortium, with support being provided - by ISC's sponsors. As co-architects/programmers, Bob Halley and + by ISC's sponsors. + </para> + <para> + As co-architects/programmers, Bob Halley and Paul Vixie released the first production-ready version of <acronym>BIND</acronym> version 8 in May 1997. </para> + <para> + BIND version 9 was released in September 2000 and is a + major rewrite of nearly all aspects of the underlying + BIND architecture. + </para> + <para> + BIND version 4 is officially deprecated and BIND version + 8 development is considered maintenance-only in favor + of BIND version 9. No additional development is done + on BIND version 4 or BIND version 8 other than for + security-related patches. + </para> <para> <acronym>BIND</acronym> development work is made possible today by the sponsorship @@ -10918,7 +10994,8 @@ zone "example.com" { <emphasis>Anycast</emphasis>, an identifier for a set of interfaces; and <emphasis>Multicast</emphasis>, an identifier for a set of interfaces. Here we describe the global - Unicast address scheme. For more information, see RFC 3587. + Unicast address scheme. For more information, see RFC 3587, + "Global Unicast Address Format." </para> <para> IPv6 unicast addresses consist of a diff --git a/doc/arm/Bv9ARM.ch01.html b/doc/arm/Bv9ARM.ch01.html index a6446282..008236b2 100644 --- a/doc/arm/Bv9ARM.ch01.html +++ b/doc/arm/Bv9ARM.ch01.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: Bv9ARM.ch01.html,v 1.16.18.19 2007/01/30 00:23:45 marka Exp $ --> +<!-- $Id: Bv9ARM.ch01.html,v 1.16.18.20 2007/05/08 02:30:10 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -107,8 +107,8 @@ security considerations, and <span class="emphasis"><em>Section 8</em></span> contains troubleshooting help. The main body of the document is followed by several - <span class="emphasis"><em>Appendices</em></span> which contain useful reference - information, such as a <span class="emphasis"><em>Bibliography</em></span> and + <span class="emphasis"><em>appendices</em></span> which contain useful reference + information, such as a <span class="emphasis"><em>bibliography</em></span> and historic information related to <acronym class="acronym">BIND</acronym> and the Domain Name System. @@ -246,8 +246,8 @@ <a name="id2564746"></a>The Domain Name System (<acronym class="acronym">DNS</acronym>)</h2></div></div></div> <p> The purpose of this document is to explain the installation - and upkeep of the <acronym class="acronym">BIND</acronym> software - package, and we + and upkeep of the <acronym class="acronym">BIND</acronym> (Berkeley Internet + Name Domain) software package, and we begin by reviewing the fundamentals of the Domain Name System (<acronym class="acronym">DNS</acronym>) as they relate to <acronym class="acronym">BIND</acronym>. </p> diff --git a/doc/arm/Bv9ARM.ch02.html b/doc/arm/Bv9ARM.ch02.html index 60985405..0d7fe7bf 100644 --- a/doc/arm/Bv9ARM.ch02.html +++ b/doc/arm/Bv9ARM.ch02.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: Bv9ARM.ch02.html,v 1.13.18.18 2007/01/30 00:23:45 marka Exp $ --> +<!-- $Id: Bv9ARM.ch02.html,v 1.13.18.20 2007/05/30 02:29:44 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -46,10 +46,10 @@ <p><b>Table of Contents</b></p> <dl> <dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567621">Hardware requirements</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567648">CPU Requirements</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567660">Memory Requirements</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567687">Name Server Intensive Environment Issues</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567698">Supported Operating Systems</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567716">CPU Requirements</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567729">Memory Requirements</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567755">Name Server Intensive Environment Issues</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567766">Supported Operating Systems</a></span></dt> </dl> </div> <div class="sect1" lang="en"> @@ -73,7 +73,7 @@ </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2567648"></a>CPU Requirements</h2></div></div></div> +<a name="id2567716"></a>CPU Requirements</h2></div></div></div> <p> CPU requirements for <acronym class="acronym">BIND</acronym> 9 range from i486-class machines @@ -84,7 +84,7 @@ </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2567660"></a>Memory Requirements</h2></div></div></div> +<a name="id2567729"></a>Memory Requirements</h2></div></div></div> <p> The memory of the server has to be large enough to fit the cache and zones loaded off disk. The <span><strong class="command">max-cache-size</strong></span> @@ -93,7 +93,7 @@ traffic. Additionally, if additional section caching (<a href="Bv9ARM.ch06.html#acache" title="Additional Section Caching">the section called “Additional Section Caching”</a>) is enabled, - the <span><strong class="command">max-acache-size</strong></span> can be used to + the <span><strong class="command">max-acache-size</strong></span> option can be used to limit the amount of memory used by the mechanism. It is still good practice to have enough memory to load @@ -107,7 +107,7 @@ </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2567687"></a>Name Server Intensive Environment Issues</h2></div></div></div> +<a name="id2567755"></a>Name Server Intensive Environment Issues</h2></div></div></div> <p> For name server intensive environments, there are two alternative configurations that may be used. The first is where clients and @@ -124,7 +124,7 @@ </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2567698"></a>Supported Operating Systems</h2></div></div></div> +<a name="id2567766"></a>Supported Operating Systems</h2></div></div></div> <p> ISC <acronym class="acronym">BIND</acronym> 9 compiles and runs on a large number diff --git a/doc/arm/Bv9ARM.ch03.html b/doc/arm/Bv9ARM.ch03.html index 4c2f9f39..24d54a4d 100644 --- a/doc/arm/Bv9ARM.ch03.html +++ b/doc/arm/Bv9ARM.ch03.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: Bv9ARM.ch03.html,v 1.35.18.26 2007/01/30 00:23:45 marka Exp $ --> +<!-- $Id: Bv9ARM.ch03.html,v 1.35.18.30 2007/06/20 02:26:58 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -51,10 +51,10 @@ <dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568019">An Authoritative-only Name Server</a></span></dt> </dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2568041">Load Balancing</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2568465">Name Server Operations</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2568464">Name Server Operations</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568470">Tools for Use With the Name Server Daemon</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2569972">Signals</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568469">Tools for Use With the Name Server Daemon</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2570251">Signals</a></span></dt> </dl></dd> </dl> </div> @@ -140,8 +140,8 @@ zone "eng.example.com" { <a name="id2568041"></a>Load Balancing</h2></div></div></div> <p> A primitive form of load balancing can be achieved in - the <acronym class="acronym">DNS</acronym> by using multiple A records for - one name. + the <acronym class="acronym">DNS</acronym> by using multiple records + (such as multiple A records) for one name. </p> <p> For example, if you have three WWW servers with network addresses @@ -280,10 +280,10 @@ zone "eng.example.com" { </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2568465"></a>Name Server Operations</h2></div></div></div> +<a name="id2568464"></a>Name Server Operations</h2></div></div></div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2568470"></a>Tools for Use With the Name Server Daemon</h3></div></div></div> +<a name="id2568469"></a>Tools for Use With the Name Server Daemon</h3></div></div></div> <p> This section describes several indispensable diagnostic, administrative and monitoring tools available to the system @@ -336,7 +336,7 @@ zone "eng.example.com" { functionality can be extended with the use of options. </p> -<div class="cmdsynopsis"><p><code class="command">host</code> [-aCdlrTwv] [-c <em class="replaceable"><code>class</code></em>] [-N <em class="replaceable"><code>ndots</code></em>] [-t <em class="replaceable"><code>type</code></em>] [-W <em class="replaceable"><code>timeout</code></em>] [-R <em class="replaceable"><code>retries</code></em>] <em class="replaceable"><code>hostname</code></em> [<em class="replaceable"><code>server</code></em>]</p></div> +<div class="cmdsynopsis"><p><code class="command">host</code> [-aCdlnrsTwv] [-c <em class="replaceable"><code>class</code></em>] [-N <em class="replaceable"><code>ndots</code></em>] [-t <em class="replaceable"><code>type</code></em>] [-W <em class="replaceable"><code>timeout</code></em>] [-R <em class="replaceable"><code>retries</code></em>] [-m <em class="replaceable"><code>flag</code></em>] [-4] [-6] <em class="replaceable"><code>hostname</code></em> [<em class="replaceable"><code>server</code></em>]</p></div> <p> For more information and a list of available commands and options, see the <span><strong class="command">host</strong></span> man @@ -425,6 +425,12 @@ zone "eng.example.com" { (<span><strong class="command">rndc</strong></span>) program allows the system administrator to control the operation of a name server. + Since <acronym class="acronym">BIND</acronym> 9.2, <span><strong class="command">rndc</strong></span> + supports all the commands of the BIND 8 <span><strong class="command">ndc</strong></span> + utility except <span><strong class="command">ndc start</strong></span> and + <span><strong class="command">ndc restart</strong></span>, which were also + not supported in <span><strong class="command">ndc</strong></span>'s + channel mode. If you run <span><strong class="command">rndc</strong></span> without any options it will display a usage message as follows: @@ -585,14 +591,6 @@ zone "eng.example.com" { </p></dd> </dl></div> <p> - In <acronym class="acronym">BIND</acronym> 9.2, <span><strong class="command">rndc</strong></span> - supports all the commands of the BIND 8 <span><strong class="command">ndc</strong></span> - utility except <span><strong class="command">ndc start</strong></span> and - <span><strong class="command">ndc restart</strong></span>, which were also - not supported in <span><strong class="command">ndc</strong></span>'s - channel mode. - </p> -<p> A configuration file is required, since all communication with the server is authenticated with digital signatures that rely on a shared secret, and @@ -741,7 +739,7 @@ controls { </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2569972"></a>Signals</h3></div></div></div> +<a name="id2570251"></a>Signals</h3></div></div></div> <p> Certain UNIX signals cause the name server to take specific actions, as described in the following table. These signals can diff --git a/doc/arm/Bv9ARM.ch04.html b/doc/arm/Bv9ARM.ch04.html index a316b1f5..3e2319d6 100644 --- a/doc/arm/Bv9ARM.ch04.html +++ b/doc/arm/Bv9ARM.ch04.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: Bv9ARM.ch04.html,v 1.40.18.34 2007/01/30 00:23:45 marka Exp $ --> +<!-- $Id: Bv9ARM.ch04.html,v 1.40.18.40 2007/06/20 02:26:58 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -49,28 +49,29 @@ <dt><span class="sect1"><a href="Bv9ARM.ch04.html#dynamic_update">Dynamic Update</a></span></dt> <dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch04.html#journal">The journal file</a></span></dt></dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch04.html#incremental_zone_transfers">Incremental Zone Transfers (IXFR)</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2570429">Split DNS</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2570641">Split DNS</a></span></dt> +<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2570659">Example split DNS setup</a></span></dt></dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch04.html#tsig">TSIG</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2570949">Generate Shared Keys for Each Pair of Hosts</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571022">Copying the Shared Secret to Both Machines</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571033">Informing the Servers of the Key's Existence</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571141">Instructing the Server to Use the Key</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571198">TSIG Key Based Access Control</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571243">Errors</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571094">Generate Shared Keys for Each Pair of Hosts</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571168">Copying the Shared Secret to Both Machines</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571178">Informing the Servers of the Key's Existence</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571218">Instructing the Server to Use the Key</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571412">TSIG Key Based Access Control</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571457">Errors</a></span></dt> </dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571257">TKEY</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571306">SIG(0)</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571470">TKEY</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571520">SIG(0)</a></span></dt> <dt><span class="sect1"><a href="Bv9ARM.ch04.html#DNSSEC">DNSSEC</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571579">Generating Keys</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571649">Signing the Zone</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571728">Configuring Servers</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571724">Generating Keys</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571794">Signing the Zone</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571873">Configuring Servers</a></span></dt> </dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571802">IPv6 Support in <acronym class="acronym">BIND</acronym> 9</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2572152">IPv6 Support in <acronym class="acronym">BIND</acronym> 9</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572001">Address Lookups Using AAAA Records</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572022">Address to Name Lookups Using Nibble Format</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572214">Address Lookups Using AAAA Records</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572235">Address to Name Lookups Using Nibble Format</a></span></dt> </dl></dd> </dl> </div> @@ -204,7 +205,7 @@ </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2570429"></a>Split DNS</h2></div></div></div> +<a name="id2570641"></a>Split DNS</h2></div></div></div> <p> Setting up different views, or visibility, of the DNS space to internal and external resolvers is usually referred to as a @@ -222,7 +223,7 @@ However, since listing addresses of internal servers that external clients cannot possibly reach can result in connection delays and other annoyances, an organization may - choose to use a Split DNS to present a consistant view of itself + choose to use a Split DNS to present a consistent view of itself to the outside world. </p> <p> @@ -232,9 +233,9 @@ on the Internet. Split DNS can also be used to allow mail from outside back in to the internal network. </p> -<p> - Here is an example of a split DNS setup: - </p> +<div class="sect2" lang="en"> +<div class="titlepage"><div><div><h3 class="title"> +<a name="id2570659"></a>Example split DNS setup</h3></div></div></div> <p> Let's say a company named <span class="emphasis"><em>Example, Inc.</em></span> (<code class="literal">example.com</code>) @@ -450,6 +451,7 @@ nameserver 172.16.72.3 nameserver 172.16.72.4 </pre> </div> +</div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> <a name="tsig"></a>TSIG</h2></div></div></div> @@ -479,7 +481,7 @@ nameserver 172.16.72.4 </p> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2570949"></a>Generate Shared Keys for Each Pair of Hosts</h3></div></div></div> +<a name="id2571094"></a>Generate Shared Keys for Each Pair of Hosts</h3></div></div></div> <p> A shared secret is generated to be shared between <span class="emphasis"><em>host1</em></span> and <span class="emphasis"><em>host2</em></span>. An arbitrary key name is chosen: "host1-host2.". The key name must @@ -487,7 +489,7 @@ nameserver 172.16.72.4 </p> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2570966"></a>Automatic Generation</h4></div></div></div> +<a name="id2571111"></a>Automatic Generation</h4></div></div></div> <p> The following command will generate a 128-bit (16 byte) HMAC-MD5 key as described above. Longer keys are better, but shorter keys @@ -512,7 +514,7 @@ nameserver 172.16.72.4 </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2571004"></a>Manual Generation</h4></div></div></div> +<a name="id2571149"></a>Manual Generation</h4></div></div></div> <p> The shared secret is simply a random sequence of bits, encoded in base-64. Most ASCII strings are valid base-64 strings (assuming @@ -527,7 +529,7 @@ nameserver 172.16.72.4 </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2571022"></a>Copying the Shared Secret to Both Machines</h3></div></div></div> +<a name="id2571168"></a>Copying the Shared Secret to Both Machines</h3></div></div></div> <p> This is beyond the scope of DNS. A secure transport mechanism should be used. This could be secure FTP, ssh, telephone, etc. @@ -535,7 +537,7 @@ nameserver 172.16.72.4 </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2571033"></a>Informing the Servers of the Key's Existence</h3></div></div></div> +<a name="id2571178"></a>Informing the Servers of the Key's Existence</h3></div></div></div> <p> Imagine <span class="emphasis"><em>host1</em></span> and <span class="emphasis"><em>host 2</em></span> are @@ -564,7 +566,7 @@ key host1-host2. { </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2571141"></a>Instructing the Server to Use the Key</h3></div></div></div> +<a name="id2571218"></a>Instructing the Server to Use the Key</h3></div></div></div> <p> Since keys are shared between two hosts only, the server must be told when keys are to be used. The following is added to the <code class="filename">named.conf</code> file @@ -596,7 +598,7 @@ server 10.1.2.3 { </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2571198"></a>TSIG Key Based Access Control</h3></div></div></div> +<a name="id2571412"></a>TSIG Key Based Access Control</h3></div></div></div> <p> <acronym class="acronym">BIND</acronym> allows IP addresses and ranges to be specified in ACL @@ -624,7 +626,7 @@ allow-update { key host1-host2. ;}; </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2571243"></a>Errors</h3></div></div></div> +<a name="id2571457"></a>Errors</h3></div></div></div> <p> The processing of TSIG signed messages can result in several errors. If a signed message is sent to a non-TSIG aware @@ -643,14 +645,14 @@ allow-update { key host1-host2. ;}; outside of the allowed range, the response will be signed with the TSIG extended error code set to BADTIME, and the time values will be adjusted so that the response can be successfully - verified. In any of these cases, the message's rcode is set to + verified. In any of these cases, the message's rcode (response code) is set to NOTAUTH (not authenticated). </p> </div> </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2571257"></a>TKEY</h2></div></div></div> +<a name="id2571470"></a>TKEY</h2></div></div></div> <p><span><strong class="command">TKEY</strong></span> is a mechanism for automatically generating a shared secret between two hosts. There are several "modes" of @@ -686,7 +688,7 @@ allow-update { key host1-host2. ;}; </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2571306"></a>SIG(0)</h2></div></div></div> +<a name="id2571520"></a>SIG(0)</h2></div></div></div> <p> <acronym class="acronym">BIND</acronym> 9 partially supports DNSSEC SIG(0) transaction signatures as specified in RFC 2535 and RFC2931. @@ -715,7 +717,7 @@ allow-update { key host1-host2. ;}; <p> Cryptographic authentication of DNS information is possible through the DNS Security (<span class="emphasis"><em>DNSSEC-bis</em></span>) extensions, - defined in RFC 4033, RFC 4034 and RFC 4035. + defined in RFC 4033, RFC 4034, and RFC 4035. This section describes the creation and use of DNSSEC signed zones. </p> <p> @@ -747,7 +749,7 @@ allow-update { key host1-host2. ;}; </p> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2571579"></a>Generating Keys</h3></div></div></div> +<a name="id2571724"></a>Generating Keys</h3></div></div></div> <p> The <span><strong class="command">dnssec-keygen</strong></span> program is used to generate keys. @@ -775,7 +777,7 @@ allow-update { key host1-host2. ;}; <code class="filename">Kchild.example.+005+12345.key</code> and <code class="filename">Kchild.example.+005+12345.private</code> (where - 12345 is an example of a key tag). The key file names contain + 12345 is an example of a key tag). The key filenames contain the key name (<code class="filename">child.example.</code>), algorithm (3 is DSA, 1 is RSAMD5, 5 is RSASHA1, etc.), and the key tag (12345 in @@ -798,7 +800,7 @@ allow-update { key host1-host2. ;}; </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2571649"></a>Signing the Zone</h3></div></div></div> +<a name="id2571794"></a>Signing the Zone</h3></div></div></div> <p> The <span><strong class="command">dnssec-signzone</strong></span> program is used to @@ -835,14 +837,14 @@ allow-update { key host1-host2. ;}; <p><span><strong class="command">dnssec-signzone</strong></span> will also produce a keyset and dsset files and optionally a dlvset file. These are used to provide the parent zone - administators with the <code class="literal">DNSKEYs</code> (or their + administrators with the <code class="literal">DNSKEYs</code> (or their corresponding <code class="literal">DS</code> records) that are the secure entry point to the zone. </p> </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2571728"></a>Configuring Servers</h3></div></div></div> +<a name="id2571873"></a>Configuring Servers</h3></div></div></div> <p> To enable <span><strong class="command">named</strong></span> to respond appropriately to DNS requests from DNSSEC aware clients, @@ -851,7 +853,7 @@ allow-update { key host1-host2. ;}; <p> To enable <span><strong class="command">named</strong></span> to validate answers from other servers both <span><strong class="command">dnssec-enable</strong></span> and - <span><strong class="command">dnssec-validate</strong></span> must be set and some + <span><strong class="command">dnssec-validation</strong></span> must be set and some <span><strong class="command">trusted-keys</strong></span> must be configured into <code class="filename">named.conf</code>. </p> @@ -930,7 +932,7 @@ options { </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2571802"></a>IPv6 Support in <acronym class="acronym">BIND</acronym> 9</h2></div></div></div> +<a name="id2572152"></a>IPv6 Support in <acronym class="acronym">BIND</acronym> 9</h2></div></div></div> <p> <acronym class="acronym">BIND</acronym> 9 fully supports all currently defined forms of IPv6 @@ -969,7 +971,7 @@ options { </p> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2572001"></a>Address Lookups Using AAAA Records</h3></div></div></div> +<a name="id2572214"></a>Address Lookups Using AAAA Records</h3></div></div></div> <p> The IPv6 AAAA record is a parallel to the IPv4 A record, and, unlike the deprecated A6 record, specifies the entire @@ -988,7 +990,7 @@ host 3600 IN AAAA 2001:db8::1 </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2572022"></a>Address to Name Lookups Using Nibble Format</h3></div></div></div> +<a name="id2572235"></a>Address to Name Lookups Using Nibble Format</h3></div></div></div> <p> When looking up an address in nibble format, the address components are simply reversed, just as in IPv4, and diff --git a/doc/arm/Bv9ARM.ch05.html b/doc/arm/Bv9ARM.ch05.html index 7d06e91f..4c1313e5 100644 --- a/doc/arm/Bv9ARM.ch05.html +++ b/doc/arm/Bv9ARM.ch05.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: Bv9ARM.ch05.html,v 1.33.18.28 2007/01/30 00:23:45 marka Exp $ --> +<!-- $Id: Bv9ARM.ch05.html,v 1.33.18.32 2007/06/20 02:26:58 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -45,13 +45,13 @@ <div class="toc"> <p><b>Table of Contents</b></p> <dl> -<dt><span class="sect1"><a href="Bv9ARM.ch05.html#id2572055">The Lightweight Resolver Library</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch05.html#id2572268">The Lightweight Resolver Library</a></span></dt> <dt><span class="sect1"><a href="Bv9ARM.ch05.html#lwresd">Running a Resolver Daemon</a></span></dt> </dl> </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2572055"></a>The Lightweight Resolver Library</h2></div></div></div> +<a name="id2572268"></a>The Lightweight Resolver Library</h2></div></div></div> <p> Traditionally applications have been linked with a stub resolver library that sends recursive DNS queries to a local caching name diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html index cb17489f..eceff408 100644 --- a/doc/arm/Bv9ARM.ch06.html +++ b/doc/arm/Bv9ARM.ch06.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: Bv9ARM.ch06.html,v 1.82.18.63 2007/01/30 00:23:45 marka Exp $ --> +<!-- $Id: Bv9ARM.ch06.html,v 1.82.18.71 2007/07/09 06:51:11 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -48,52 +48,52 @@ <dt><span class="sect1"><a href="Bv9ARM.ch06.html#configuration_file_elements">Configuration File Elements</a></span></dt> <dd><dl> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#address_match_lists">Address Match Lists</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573470">Comment Syntax</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573479">Comment Syntax</a></span></dt> </dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch06.html#Configuration_File_Grammar">Configuration File Grammar</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574151"><span><strong class="command">acl</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574091"><span><strong class="command">acl</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#acl"><span><strong class="command">acl</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574341"><span><strong class="command">controls</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574281"><span><strong class="command">controls</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage"><span><strong class="command">controls</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574770"><span><strong class="command">include</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574785"><span><strong class="command">include</strong></span> Statement Definition and +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574710"><span><strong class="command">include</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574725"><span><strong class="command">include</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574808"><span><strong class="command">key</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574829"><span><strong class="command">key</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574920"><span><strong class="command">logging</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575046"><span><strong class="command">logging</strong></span> Statement Definition and +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574748"><span><strong class="command">key</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574770"><span><strong class="command">key</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574929"><span><strong class="command">logging</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575054"><span><strong class="command">logging</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576396"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576470"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576534"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576578"><span><strong class="command">masters</strong></span> Statement Definition and +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576405"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576478"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576542"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576586"><span><strong class="command">masters</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576593"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576601"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#options"><span><strong class="command">options</strong></span> Statement Definition and Usage</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_grammar"><span><strong class="command">server</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_definition_and_usage"><span><strong class="command">server</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585018"><span><strong class="command">trusted-keys</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585136"><span><strong class="command">trusted-keys</strong></span> Statement Definition +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585275"><span><strong class="command">trusted-keys</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585324"><span><strong class="command">trusted-keys</strong></span> Statement Definition and Usage</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#view_statement_grammar"><span><strong class="command">view</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585216"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585404"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#zone_statement_grammar"><span><strong class="command">zone</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2586586"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2586713"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt> </dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2588846">Zone File</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2588995">Zone File</a></span></dt> <dd><dl> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#types_of_resource_records_and_when_to_use_them">Types of Resource Records and When to Use Them</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2590800">Discussion of MX Records</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591016">Discussion of MX Records</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#Setting_TTLs">Setting TTLs</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591419">Inverse Mapping in IPv4</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591546">Other Zone File Directives</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591803"><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591568">Inverse Mapping in IPv4</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591694">Other Zone File Directives</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2592088"><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#zonefile_format">Additional File Formats</a></span></dt> </dl></dd> </dl> @@ -266,7 +266,7 @@ <td> <p> An IP port <code class="varname">number</code>. - <code class="varname">number</code> is limited to 0 + The <code class="varname">number</code> is limited to 0 through 65535, with values below 1024 typically restricted to use by processes running as root. @@ -428,7 +428,7 @@ <a name="address_match_lists"></a>Address Match Lists</h3></div></div></div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2573336"></a>Syntax</h4></div></div></div> +<a name="id2573276"></a>Syntax</h4></div></div></div> <pre class="programlisting"><code class="varname">address_match_list</code> = address_match_list_element ; [<span class="optional"> address_match_list_element; ... </span>] <code class="varname">address_match_list_element</code> = [<span class="optional"> ! </span>] (ip_address [<span class="optional">/length</span>] | @@ -437,7 +437,7 @@ </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2573364"></a>Definition and Usage</h4></div></div></div> +<a name="id2573304"></a>Definition and Usage</h4></div></div></div> <p> Address match lists are primarily used to determine access control for various server operations. They are also used in @@ -515,17 +515,17 @@ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2573470"></a>Comment Syntax</h3></div></div></div> +<a name="id2573479"></a>Comment Syntax</h3></div></div></div> <p> The <acronym class="acronym">BIND</acronym> 9 comment syntax allows for comments to appear - anywhere that white space may appear in a <acronym class="acronym">BIND</acronym> configuration + anywhere that whitespace may appear in a <acronym class="acronym">BIND</acronym> configuration file. To appeal to programmers of all kinds, they can be written in the C, C++, or shell/perl style. </p> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2573485"></a>Syntax</h4></div></div></div> +<a name="id2573494"></a>Syntax</h4></div></div></div> <p> </p> <pre class="programlisting">/* This is a <acronym class="acronym">BIND</acronym> comment as in C */</pre> @@ -540,9 +540,9 @@ </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2573515"></a>Definition and Usage</h4></div></div></div> +<a name="id2573524"></a>Definition and Usage</h4></div></div></div> <p> - Comments may appear anywhere that white space may appear in + Comments may appear anywhere that whitespace may appear in a <acronym class="acronym">BIND</acronym> configuration file. </p> <p> @@ -774,7 +774,7 @@ </p> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2574151"></a><span><strong class="command">acl</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2574091"></a><span><strong class="command">acl</strong></span> Statement Grammar</h3></div></div></div> <pre class="programlisting"><span><strong class="command">acl</strong></span> acl-name { address_match_list }; @@ -857,7 +857,7 @@ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2574341"></a><span><strong class="command">controls</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2574281"></a><span><strong class="command">controls</strong></span> Statement Grammar</h3></div></div></div> <pre class="programlisting"><span><strong class="command">controls</strong></span> { [ inet ( ip_addr | * ) [ port ip_port ] allow { <em class="replaceable"><code> address_match_list </code></em> } keys { <em class="replaceable"><code>key_list</code></em> }; ] @@ -979,12 +979,12 @@ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2574770"></a><span><strong class="command">include</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2574710"></a><span><strong class="command">include</strong></span> Statement Grammar</h3></div></div></div> <pre class="programlisting">include <em class="replaceable"><code>filename</code></em>;</pre> </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2574785"></a><span><strong class="command">include</strong></span> Statement Definition and +<a name="id2574725"></a><span><strong class="command">include</strong></span> Statement Definition and Usage</h3></div></div></div> <p> The <span><strong class="command">include</strong></span> statement inserts the @@ -999,7 +999,7 @@ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2574808"></a><span><strong class="command">key</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2574748"></a><span><strong class="command">key</strong></span> Statement Grammar</h3></div></div></div> <pre class="programlisting">key <em class="replaceable"><code>key_id</code></em> { algorithm <em class="replaceable"><code>string</code></em>; secret <em class="replaceable"><code>string</code></em>; @@ -1008,7 +1008,7 @@ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2574829"></a><span><strong class="command">key</strong></span> Statement Definition and Usage</h3></div></div></div> +<a name="id2574770"></a><span><strong class="command">key</strong></span> Statement Definition and Usage</h3></div></div></div> <p> The <span><strong class="command">key</strong></span> statement defines a shared secret key for use with TSIG (see <a href="Bv9ARM.ch04.html#tsig" title="TSIG">the section called “TSIG”</a>) @@ -1046,7 +1046,7 @@ <code class="literal">hmac-sha256</code>, <code class="literal">hmac-sha384</code> and <code class="literal">hmac-sha512</code> TSIG authentication. Truncated hashes are supported by appending the minimum - number of required bits preceeded by a dash, e.g. + number of required bits preceded by a dash, e.g. <code class="literal">hmac-sha1-80</code>. The <em class="replaceable"><code>secret_string</code></em> is the secret to be used by the algorithm, and is treated as a base-64 @@ -1055,7 +1055,7 @@ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2574920"></a><span><strong class="command">logging</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2574929"></a><span><strong class="command">logging</strong></span> Statement Grammar</h3></div></div></div> <pre class="programlisting"><span><strong class="command">logging</strong></span> { [ <span><strong class="command">channel</strong></span> <em class="replaceable"><code>channel_name</code></em> { ( <span><strong class="command">file</strong></span> <em class="replaceable"><code>path name</code></em> @@ -1079,7 +1079,7 @@ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2575046"></a><span><strong class="command">logging</strong></span> Statement Definition and +<a name="id2575054"></a><span><strong class="command">logging</strong></span> Statement Definition and Usage</h3></div></div></div> <p> The <span><strong class="command">logging</strong></span> statement configures a @@ -1113,7 +1113,7 @@ </p> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2575098"></a>The <span><strong class="command">channel</strong></span> Phrase</h4></div></div></div> +<a name="id2575107"></a>The <span><strong class="command">channel</strong></span> Phrase</h4></div></div></div> <p> All log output goes to one or more <span class="emphasis"><em>channels</em></span>; you can make as many of them as you want. @@ -1632,7 +1632,7 @@ category notify { null; }; </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2576396"></a><span><strong class="command">lwres</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2576405"></a><span><strong class="command">lwres</strong></span> Statement Grammar</h3></div></div></div> <p> This is the grammar of the <span><strong class="command">lwres</strong></span> statement in the <code class="filename">named.conf</code> file: @@ -1647,12 +1647,12 @@ category notify { null; }; </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2576470"></a><span><strong class="command">lwres</strong></span> Statement Definition and Usage</h3></div></div></div> +<a name="id2576478"></a><span><strong class="command">lwres</strong></span> Statement Definition and Usage</h3></div></div></div> <p> The <span><strong class="command">lwres</strong></span> statement configures the name server to also act as a lightweight resolver server. (See - <a href="Bv9ARM.ch05.html#lwresd" title="Running a Resolver Daemon">the section called “Running a Resolver Daemon”</a>.) There may be be multiple + <a href="Bv9ARM.ch05.html#lwresd" title="Running a Resolver Daemon">the section called “Running a Resolver Daemon”</a>.) There may be multiple <span><strong class="command">lwres</strong></span> statements configuring lightweight resolver servers with different properties. </p> @@ -1698,14 +1698,14 @@ category notify { null; }; </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2576534"></a><span><strong class="command">masters</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2576542"></a><span><strong class="command">masters</strong></span> Statement Grammar</h3></div></div></div> <pre class="programlisting"> <span><strong class="command">masters</strong></span> <em class="replaceable"><code>name</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] }; </pre> </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2576578"></a><span><strong class="command">masters</strong></span> Statement Definition and +<a name="id2576586"></a><span><strong class="command">masters</strong></span> Statement Definition and Usage</h3></div></div></div> <p><span><strong class="command">masters</strong></span> lists allow for a common set of masters to be easily used by @@ -1714,7 +1714,7 @@ category notify { null; }; </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2576593"></a><span><strong class="command">options</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2576601"></a><span><strong class="command">options</strong></span> Statement Grammar</h3></div></div></div> <p> This is the grammar of the <span><strong class="command">options</strong></span> statement in the <code class="filename">named.conf</code> file: @@ -1732,6 +1732,7 @@ category notify { null; }; [<span class="optional"> dump-file <em class="replaceable"><code>path_name</code></em>; </span>] [<span class="optional"> memstatistics-file <em class="replaceable"><code>path_name</code></em>; </span>] [<span class="optional"> pid-file <em class="replaceable"><code>path_name</code></em>; </span>] + [<span class="optional"> recursing-file <em class="replaceable"><code>path_name</code></em>; </span>] [<span class="optional"> statistics-file <em class="replaceable"><code>path_name</code></em>; </span>] [<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em>; </span>] [<span class="optional"> auth-nxdomain <em class="replaceable"><code>yes_or_no</code></em>; </span>] @@ -1809,6 +1810,7 @@ category notify { null; }; [<span class="optional"> alt-transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>] [<span class="optional"> alt-transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>] [<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>] + [<span class="optional"> notify-delay <em class="replaceable"><code>seconds</code></em> ; </span>] [<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>] [<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>] [<span class="optional"> also-notify { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>] @@ -1966,10 +1968,17 @@ digits</code>" + "<code class="varname">tkey-domain</code>". In most cases, name server. Specifying <span><strong class="command">pid-file none</strong></span> disables the use of a PID file — no file will be written and any existing one will be removed. Note that <span><strong class="command">none</strong></span> - is a keyword, not a file name, and therefore is not enclosed + is a keyword, not a filename, and therefore is not enclosed in double quotes. </p></dd> +<dt><span class="term"><span><strong class="command">recursing-file</strong></span></span></dt> +<dd><p> + The pathname of the file the server dumps + the queries that are currently recursing when instructed + to do so with <span><strong class="command">rndc recursing</strong></span>. + If not specified, the default is <code class="filename">named.recursing</code>. + </p></dd> <dt><span class="term"><span><strong class="command">statistics-file</strong></span></span></dt> <dd><p> The pathname of the file the server appends statistics @@ -2472,7 +2481,7 @@ options { <dd><p> <span class="emphasis"><em>This option is obsolete</em></span>. If you need to disable IXFR to a particular server or - servers see + servers, see the information on the <span><strong class="command">provide-ixfr</strong></span> option in <a href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and Usage">the section called “<span><strong class="command">server</strong></span> Statement Definition and @@ -2660,6 +2669,7 @@ options { <dd><p> Accept expired signatures when verifying DNSSEC signatures. The default is <strong class="userinput"><code>no</code></strong>. + Setting this option to "yes" leaves named vulnerable to replay attacks. </p></dd> <dt><span class="term"><span><strong class="command">querylog</strong></span></span></dt> <dd><p> @@ -2694,7 +2704,7 @@ options { and MX records. It also applies to the RDATA of PTR records where the owner name indicated that it is a reverse lookup of a hostname - (the owner name ends in IN-ADDR.ARPA, IP6.ARPA or IP6.INT). + (the owner name ends in IN-ADDR.ARPA, IP6.ARPA, or IP6.INT). </p> </dd> <dt><span class="term"><span><strong class="command">check-mx</strong></span></span></dt> @@ -2723,7 +2733,7 @@ options { MX and SRV records only in-zone hostnames are checked (for out-of-zone hostnames use named-checkzone). For NS records only names below top of zone are - checked (for out-of-zone names and glue consistancy + checked (for out-of-zone names and glue consistency checks use named-checkzone). The default is <span><strong class="command">yes</strong></span>. </p></dd> @@ -2771,7 +2781,7 @@ options { </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2580408"></a>Forwarding</h4></div></div></div> +<a name="id2580519"></a>Forwarding</h4></div></div></div> <p> The forwarding facility can be used to create a large site-wide cache on a few servers, reducing traffic over links to external @@ -2815,7 +2825,7 @@ options { </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2580467"></a>Dual-stack Servers</h4></div></div></div> +<a name="id2580578"></a>Dual-stack Servers</h4></div></div></div> <p> Dual-stack servers are used as servers of last resort to work around @@ -2881,30 +2891,25 @@ options { </div> </dd> <dt><span class="term"><span><strong class="command">allow-query-cache</strong></span></span></dt> -<dd> -<p> +<dd><p> Specifies which hosts are allowed to get answers - from the cache. The default is the builtin acls - <span><strong class="command">localnets</strong></span> and - <span><strong class="command">localhost</strong></span>. - </p> -<p> - The way to set query access to the cache is now - via <span><strong class="command">allow-query-cache</strong></span>. - This differs from earlier versions which used - <span><strong class="command">allow-query</strong></span>. - </p> -</dd> + from the cache. If <span><strong class="command">allow-query-cache</strong></span> + is not set then <span><strong class="command">allow-recursion</strong></span> + is used if set, otherwise <span><strong class="command">allow-query</strong></span> + is used if set, otherwise the default + (<span><strong class="command">localnets;</strong></span> + <span><strong class="command">localhost;</strong></span>) is used. + </p></dd> <dt><span class="term"><span><strong class="command">allow-recursion</strong></span></span></dt> <dd><p> Specifies which hosts are allowed to make recursive - queries through this server. If not specified, - the default is to allow recursive queries from - the builtin acls <span><strong class="command">localnets</strong></span> and - <span><strong class="command">localhost</strong></span>. - Note that disallowing recursive queries for a - host does not prevent the host from retrieving - data that is already in the server's cache. + queries through this server. If + <span><strong class="command">allow-recursion</strong></span> is not set + then <span><strong class="command">allow-query-cache</strong></span> is + used if set, otherwise <span><strong class="command">allow-query</strong></span> + is used if set, otherwise the default + (<span><strong class="command">localnets;</strong></span> + <span><strong class="command">localhost;</strong></span>) is used. </p></dd> <dt><span class="term"><span><strong class="command">allow-update</strong></span></span></dt> <dd><p> @@ -2975,7 +2980,7 @@ options { </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2580942"></a>Interfaces</h4></div></div></div> +<a name="id2581136"></a>Interfaces</h4></div></div></div> <p> The interfaces and ports that the server will answer queries from may be specified using the <span><strong class="command">listen-on</strong></span> option. <span><strong class="command">listen-on</strong></span> takes @@ -3055,7 +3060,7 @@ listen-on-v6 port 1234 { !2001:db8::/32; any; }; </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2581099"></a>Query Address</h4></div></div></div> +<a name="id2581224"></a>Query Address</h4></div></div></div> <p> If the server doesn't know the answer to a question, it will query other name servers. <span><strong class="command">query-source</strong></span> specifies @@ -3335,7 +3340,7 @@ query-source-v6 address * port *; </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2581778"></a>Bad UDP Port Lists</h4></div></div></div> +<a name="id2581971"></a>Bad UDP Port Lists</h4></div></div></div> <p><span><strong class="command">avoid-v4-udp-ports</strong></span> and <span><strong class="command">avoid-v6-udp-ports</strong></span> specify a list of IPv4 and IPv6 UDP ports that will not be used as system @@ -3349,7 +3354,7 @@ query-source-v6 address * port *; </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2581793"></a>Operating System Resource Limits</h4></div></div></div> +<a name="id2581986"></a>Operating System Resource Limits</h4></div></div></div> <p> The server's usage of many system resources can be limited. Scaled values are allowed when specifying resource limits. For @@ -3408,7 +3413,7 @@ query-source-v6 address * port *; </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2581976"></a>Server Resource Limits</h4></div></div></div> +<a name="id2582101"></a>Server Resource Limits</h4></div></div></div> <p> The following options set limits on the server's resource consumption that are enforced internally by the @@ -3486,7 +3491,7 @@ query-source-v6 address * port *; </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2582178"></a>Periodic Task Intervals</h4></div></div></div> +<a name="id2582234"></a>Periodic Task Intervals</h4></div></div></div> <div class="variablelist"><dl> <dt><span class="term"><span><strong class="command">cleaning-interval</strong></span></span></dt> <dd><p> @@ -3534,7 +3539,7 @@ query-source-v6 address * port *; <h3 class="title">Note</h3> <p> Not yet implemented in - <acronym class="acronym">BIND</acronym>9. + <acronym class="acronym">BIND</acronym> 9. </p> </div> </dd> @@ -3874,7 +3879,7 @@ query-source-v6 address * port *; values are 512 to 4096 (values outside this range will be silently adjusted). The default value is 4096. The usual reason for setting edns-udp-size to - a non-default value it to get UDP answers to pass + a non-default value is to get UDP answers to pass through broken firewalls that block fragmented packets and/or block UDP packets that are greater than 512 bytes. @@ -3889,6 +3894,8 @@ query-source-v6 address * port *; answers to pass through broken firewalls that block fragmented packets and/or block UDP packets that are greater than 512 bytes. + This is independent of the advertised receive + buffer (<span><strong class="command">edns-udp-size</strong></span>). </p></dd> <dt><span class="term"><span><strong class="command">masterfile-format</strong></span></span></dt> <dd><p>Specifies @@ -3948,6 +3955,11 @@ query-source-v6 address * port *; <span><strong class="command">recursive-clients</strong></span>. </p> </dd> +<dt><span class="term"><span><strong class="command">notify-delay</strong></span></span></dt> +<dd><p> + The delay, in seconds, between sending sets of notify + messages for a zone. The default is zero. + </p></dd> </dl></div> </div> <div class="sect3" lang="en"> @@ -4018,7 +4030,7 @@ query-source-v6 address * port *; Named has some built-in empty zones (SOA and NS records only). These are for zones that should normally be answered locally and which queries should not be sent to the Internet's root - servers. The offical servers which cover these namespaces + servers. The official servers which cover these namespaces return NXDOMAIN responses to these queries. In particular, these cover the reverse namespace for addresses from RFC 1918 and RFC 3330. They also include the reverse namespace for IPv6 local @@ -4081,10 +4093,10 @@ query-source-v6 address * port *; If you are using the address ranges covered here, you should already have reverse zones covering the addresses you use. In practice this appears to not be the case with many queries - being made to the infrustructure servers for names in these + being made to the infrastructure servers for names in these spaces. So many in fact that sacrificial servers were needed to be deployed to channel the query load away from the - infrustructure servers. + infrastructure servers. </p> <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"> <h3 class="title">Note</h3> @@ -4231,6 +4243,32 @@ query-source-v6 address * port *; </p> </td> </tr> +<tr> +<td> + <p><span><strong class="command">duplicate</strong></span></p> + </td> +<td> + <p> + The number of queries which the server attempted to + recurse but discover a existing query with the same + IP address, port, query id, name, type and class + already being processed. + </p> + </td> +</tr> +<tr> +<td> + <p><span><strong class="command">dropped</strong></span></p> + </td> +<td> + <p> + The number of queries for which the server + discovered a excessive number of existing + recursive queries for the same name, type and + class and were subsequently dropped. + </p> + </td> +</tr> </tbody> </table></div> <p> @@ -4533,7 +4571,7 @@ query-source-v6 address * port *; </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2585018"></a><span><strong class="command">trusted-keys</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2585275"></a><span><strong class="command">trusted-keys</strong></span> Statement Grammar</h3></div></div></div> <pre class="programlisting">trusted-keys { <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; [<span class="optional"> <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; [<span class="optional">...</span>]</span>] @@ -4542,7 +4580,7 @@ query-source-v6 address * port *; </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2585136"></a><span><strong class="command">trusted-keys</strong></span> Statement Definition +<a name="id2585324"></a><span><strong class="command">trusted-keys</strong></span> Statement Definition and Usage</h3></div></div></div> <p> The <span><strong class="command">trusted-keys</strong></span> statement defines @@ -4585,7 +4623,7 @@ query-source-v6 address * port *; </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2585216"></a><span><strong class="command">view</strong></span> Statement Definition and Usage</h3></div></div></div> +<a name="id2585404"></a><span><strong class="command">view</strong></span> Statement Definition and Usage</h3></div></div></div> <p> The <span><strong class="command">view</strong></span> statement is a powerful feature @@ -4729,6 +4767,7 @@ view "external" { [<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em> ; </span>] [<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em> ; </span>] [<span class="optional"> notify <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>explicit</code></em> | <em class="replaceable"><code>master-only</code></em> ; </span>] + [<span class="optional"> notify-delay <em class="replaceable"><code>seconds</code></em> ; </span>] [<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>] [<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>] [<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>] @@ -4836,10 +4875,10 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2586586"></a><span><strong class="command">zone</strong></span> Statement Definition and Usage</h3></div></div></div> +<a name="id2586713"></a><span><strong class="command">zone</strong></span> Statement Definition and Usage</h3></div></div></div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2586594"></a>Zone Types</h4></div></div></div> +<a name="id2586721"></a>Zone Types</h4></div></div></div> <div class="informaltable"><table border="1"> <colgroup> <col> @@ -4895,7 +4934,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" numbers (in the tens or hundreds of thousands) of zones per server, it is best to - use a two-level naming scheme for zone file names. For + use a two-level naming scheme for zone filenames. For example, a slave server for the zone <code class="literal">example.com</code> might place the zone contents into a file called @@ -5048,7 +5087,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2587013"></a>Class</h4></div></div></div> +<a name="id2587345"></a>Class</h4></div></div></div> <p> The zone's name may optionally be followed by a class. If a class is not specified, class <code class="literal">IN</code> (for <code class="varname">Internet</code>), @@ -5064,13 +5103,13 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" a synonym for hesiod. </p> <p> - Another MIT development is CHAOSnet, a LAN protocol created + Another MIT development is Chaosnet, a LAN protocol created in the mid-1970s. Zone data for it can be specified with the <code class="literal">CHAOS</code> class. </p> </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2587046"></a>Zone Options</h4></div></div></div> +<a name="id2587378"></a>Zone Options</h4></div></div></div> <div class="variablelist"><dl> <dt><span class="term"><span><strong class="command">allow-notify</strong></span></span></dt> <dd><p> @@ -5233,8 +5272,8 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" </p></dd> <dt><span class="term"><span><strong class="command">journal</strong></span></span></dt> <dd><p> - Allow the default journal's file name to be overridden. - The default is the zone's file with "<code class="filename">.jnl</code>" appended. + Allow the default journal's filename to be overridden. + The default is the zone's filename with "<code class="filename">.jnl</code>" appended. This is applicable to <span><strong class="command">master</strong></span> and <span><strong class="command">slave</strong></span> zones. </p></dd> <dt><span class="term"><span><strong class="command">max-transfer-time-in</strong></span></span></dt> @@ -5262,6 +5301,11 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" See the description of <span><strong class="command">notify</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>. </p></dd> +<dt><span class="term"><span><strong class="command">notify-delay</strong></span></span></dt> +<dd><p> + See the description of + <span><strong class="command">notify-delay</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>. + </p></dd> <dt><span class="term"><span><strong class="command">pubkey</strong></span></span></dt> <dd><p> In <acronym class="acronym">BIND</acronym> 8, this option was @@ -5419,7 +5463,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" wildcard name, it is subject to DNS wildcard expansion, so the rule will apply to multiple identities. The <em class="replaceable"><code>identity</code></em> field must - contain a fully qualified domain name. + contain a fully-qualified domain name. </p> <p> The <em class="replaceable"><code>nametype</code></em> field has 6 @@ -5536,7 +5580,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" <p> In all cases, the <em class="replaceable"><code>name</code></em> field must - specify a fully qualified domain name. + specify a fully-qualified domain name. </p> <p> If no types are explicitly specified, this rule matches all @@ -5553,7 +5597,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2588846"></a>Zone File</h2></div></div></div> +<a name="id2588995"></a>Zone File</h2></div></div></div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> <a name="types_of_resource_records_and_when_to_use_them"></a>Types of Resource Records and When to Use Them</h3></div></div></div> @@ -5566,7 +5610,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" </p> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2588865"></a>Resource Records</h4></div></div></div> +<a name="id2589081"></a>Resource Records</h4></div></div></div> <p> A domain name identifies a node. Each node has a set of resource information, which may be empty. The set of resource @@ -6149,7 +6193,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" </td> <td> <p> - CHAOSnet, a LAN protocol created at MIT in the + Chaosnet, a LAN protocol created at MIT in the mid-1970s. Rarely used for its historical purpose, but reused for BIND's @@ -6217,7 +6261,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2590279"></a>Textual expression of RRs</h4></div></div></div> +<a name="id2590496"></a>Textual expression of RRs</h4></div></div></div> <p> RRs are represented in binary form in the packets of the DNS protocol, and are usually represented in highly encoded form @@ -6420,7 +6464,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2590800"></a>Discussion of MX Records</h3></div></div></div> +<a name="id2591016"></a>Discussion of MX Records</h3></div></div></div> <p> As described above, domain servers store information as a series of resource records, each of which contains a particular @@ -6678,7 +6722,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2591419"></a>Inverse Mapping in IPv4</h3></div></div></div> +<a name="id2591568"></a>Inverse Mapping in IPv4</h3></div></div></div> <p> Reverse name resolution (that is, translation from IP address to name) is achieved by means of the <span class="emphasis"><em>in-addr.arpa</em></span> domain @@ -6730,7 +6774,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" <h3 class="title">Note</h3> <p> The <span><strong class="command">$ORIGIN</strong></span> lines in the examples - are for providing context to the examples only-they do not + are for providing context to the examples only — they do not necessarily appear in the actual usage. They are only used here to indicate that the example is relative to the listed origin. @@ -6739,7 +6783,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2591546"></a>Other Zone File Directives</h3></div></div></div> +<a name="id2591694"></a>Other Zone File Directives</h3></div></div></div> <p> The Master File Format was initially defined in RFC 1035 and has subsequently been extended. While the Master File Format @@ -6754,7 +6798,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" </p> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2591569"></a>The <span><strong class="command">$ORIGIN</strong></span> Directive</h4></div></div></div> +<a name="id2591717"></a>The <span><strong class="command">$ORIGIN</strong></span> Directive</h4></div></div></div> <p> Syntax: <span><strong class="command">$ORIGIN</strong></span> <em class="replaceable"><code>domain-name</code></em> @@ -6782,7 +6826,7 @@ WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM. </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2591629"></a>The <span><strong class="command">$INCLUDE</strong></span> Directive</h4></div></div></div> +<a name="id2591914"></a>The <span><strong class="command">$INCLUDE</strong></span> Directive</h4></div></div></div> <p> Syntax: <span><strong class="command">$INCLUDE</strong></span> <em class="replaceable"><code>filename</code></em> @@ -6818,7 +6862,7 @@ WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM. </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2591767"></a>The <span><strong class="command">$TTL</strong></span> Directive</h4></div></div></div> +<a name="id2591984"></a>The <span><strong class="command">$TTL</strong></span> Directive</h4></div></div></div> <p> Syntax: <span><strong class="command">$TTL</strong></span> <em class="replaceable"><code>default-ttl</code></em> @@ -6837,7 +6881,7 @@ WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM. </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2591803"></a><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</h3></div></div></div> +<a name="id2592088"></a><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</h3></div></div></div> <p> Syntax: <span><strong class="command">$GENERATE</strong></span> <em class="replaceable"><code>range</code></em> @@ -6893,14 +6937,14 @@ $GENERATE 1-127 $ CNAME $.0</pre> <p><span><strong class="command">lhs</strong></span></p> </td> <td> - <p><span><strong class="command">lhs</strong></span> + <p>This describes the owner name of the resource records to be created. Any single <span><strong class="command">$</strong></span> (dollar sign) symbols within the <span><strong class="command">lhs</strong></span> side are replaced by the iterator value. - To get a $ in the output you need to escape the + To get a $ in the output, you need to escape the <span><strong class="command">$</strong></span> using a backslash <span><strong class="command">\</strong></span>, e.g. <span><strong class="command">\$</strong></span>. The @@ -6909,7 +6953,7 @@ $GENERATE 1-127 $ CNAME $.0</pre> iterator, field width and base. Modifiers are introduced by a - <span><strong class="command">{</strong></span> immediately following the + <span><strong class="command">{</strong></span> (left brace) immediately following the <span><strong class="command">$</strong></span> as <span><strong class="command">${offset[,width[,base]]}</strong></span>. For example, <span><strong class="command">${-20,3,d}</strong></span> @@ -6982,7 +7026,7 @@ $GENERATE 1-127 $ CNAME $.0</pre> </td> <td> <p> - A domain name. It is processed + <span><strong class="command">rhs</strong></span> is a domain name. It is processed similarly to lhs. </p> </td> diff --git a/doc/arm/Bv9ARM.ch07.html b/doc/arm/Bv9ARM.ch07.html index 7286dc91..265de698 100644 --- a/doc/arm/Bv9ARM.ch07.html +++ b/doc/arm/Bv9ARM.ch07.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: Bv9ARM.ch07.html,v 1.75.18.54 2007/01/30 00:23:46 marka Exp $ --> +<!-- $Id: Bv9ARM.ch07.html,v 1.75.18.61 2007/07/09 06:51:13 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -46,10 +46,10 @@ <p><b>Table of Contents</b></p> <dl> <dt><span class="sect1"><a href="Bv9ARM.ch07.html#Access_Control_Lists">Access Control Lists</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch07.html#id2592480"><span><strong class="command">chroot</strong></span> and <span><strong class="command">setuid</strong></span></a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch07.html#id2592629"><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span></a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2592625">The <span><strong class="command">chroot</strong></span> Environment</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2592684">Using the <span><strong class="command">setuid</strong></span> Function</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2592774">The <span><strong class="command">chroot</strong></span> Environment</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2592834">Using the <span><strong class="command">setuid</strong></span> Function</a></span></dt> </dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch07.html#dynamic_update_security">Dynamic Update Security</a></span></dt> </dl> @@ -118,7 +118,7 @@ zone "example.com" { </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2592480"></a><span><strong class="command">chroot</strong></span> and <span><strong class="command">setuid</strong></span> +<a name="id2592629"></a><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span> </h2></div></div></div> <p> On UNIX servers, it is possible to run <acronym class="acronym">BIND</acronym> in a <span class="emphasis"><em>chrooted</em></span> environment @@ -142,7 +142,7 @@ zone "example.com" { </p> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2592625"></a>The <span><strong class="command">chroot</strong></span> Environment</h3></div></div></div> +<a name="id2592774"></a>The <span><strong class="command">chroot</strong></span> Environment</h3></div></div></div> <p> In order for a <span><strong class="command">chroot</strong></span> environment to @@ -157,7 +157,7 @@ zone "example.com" { for this. </p> <p> - Unlike with earlier versions of BIND, you will typically + Unlike with earlier versions of BIND, you typically will <span class="emphasis"><em>not</em></span> need to compile <span><strong class="command">named</strong></span> statically nor install shared libraries under the new root. However, depending on your operating system, you may need @@ -170,7 +170,7 @@ zone "example.com" { </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2592684"></a>Using the <span><strong class="command">setuid</strong></span> Function</h3></div></div></div> +<a name="id2592834"></a>Using the <span><strong class="command">setuid</strong></span> Function</h3></div></div></div> <p> Prior to running the <span><strong class="command">named</strong></span> daemon, use diff --git a/doc/arm/Bv9ARM.ch08.html b/doc/arm/Bv9ARM.ch08.html index c2a48271..155c06bb 100644 --- a/doc/arm/Bv9ARM.ch08.html +++ b/doc/arm/Bv9ARM.ch08.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: Bv9ARM.ch08.html,v 1.75.18.53 2007/01/30 00:23:46 marka Exp $ --> +<!-- $Id: Bv9ARM.ch08.html,v 1.75.18.61 2007/07/09 06:51:13 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -45,18 +45,18 @@ <div class="toc"> <p><b>Table of Contents</b></p> <dl> -<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2592764">Common Problems</a></span></dt> -<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch08.html#id2592838">It's not working; how can I figure out what's wrong?</a></span></dt></dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2592850">Incrementing and Changing the Serial Number</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2592867">Where Can I Get Help?</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2593118">Common Problems</a></span></dt> +<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch08.html#id2593124">It's not working; how can I figure out what's wrong?</a></span></dt></dl></dd> +<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2593136">Incrementing and Changing the Serial Number</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2593153">Where Can I Get Help?</a></span></dt> </dl> </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2592764"></a>Common Problems</h2></div></div></div> +<a name="id2593118"></a>Common Problems</h2></div></div></div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2592838"></a>It's not working; how can I figure out what's wrong?</h3></div></div></div> +<a name="id2593124"></a>It's not working; how can I figure out what's wrong?</h3></div></div></div> <p> The best solution to solving installation and configuration issues is to take preventative measures by setting @@ -68,14 +68,14 @@ </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2592850"></a>Incrementing and Changing the Serial Number</h2></div></div></div> +<a name="id2593136"></a>Incrementing and Changing the Serial Number</h2></div></div></div> <p> - Zone serial numbers are just numbers-they aren't date + Zone serial numbers are just numbers — they aren't date related. A lot of people set them to a number that represents a - date, usually of the form YYYYMMDDRR. A number of people have been - testing these numbers for Y2K compliance and have set the number - to the year 2000 to see if it will work. They then try to restore - the old serial number. This will cause problems because serial + date, usually of the form YYYYMMDDRR. A number of people + tested these numbers for Y2K compliance and set the number + to the year 2000 to see if it would work. They then tried to restore + the old serial number. This caused problems because serial numbers are used to indicate that a zone has been updated. If the serial number on the slave server is lower than the serial number on the master, the slave server will attempt to update its copy of @@ -95,7 +95,7 @@ </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2592867"></a>Where Can I Get Help?</h2></div></div></div> +<a name="id2593153"></a>Where Can I Get Help?</h2></div></div></div> <p> The Internet Systems Consortium (<acronym class="acronym">ISC</acronym>) offers a wide range diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html index e8bbea85..f60cf5b4 100644 --- a/doc/arm/Bv9ARM.ch09.html +++ b/doc/arm/Bv9ARM.ch09.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: Bv9ARM.ch09.html,v 1.75.18.56 2007/01/30 00:23:46 marka Exp $ --> +<!-- $Id: Bv9ARM.ch09.html,v 1.75.18.63 2007/07/09 06:51:13 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -45,21 +45,21 @@ <div class="toc"> <p><b>Table of Contents</b></p> <dl> -<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2592997">Acknowledgments</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2593283">Acknowledgments</a></span></dt> <dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch09.html#historical_dns_information">A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym></a></span></dt></dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2593159">General <acronym class="acronym">DNS</acronym> Reference Information</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2593454">General <acronym class="acronym">DNS</acronym> Reference Information</a></span></dt> <dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch09.html#ipv6addresses">IPv6 addresses (AAAA)</a></span></dt></dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch09.html#bibliography">Bibliography (and Suggested Reading)</a></span></dt> <dd><dl> <dt><span class="sect2"><a href="Bv9ARM.ch09.html#rfcs">Request for Comments (RFCs)</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch09.html#internet_drafts">Internet Drafts</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2596326">Other Documents About <acronym class="acronym">BIND</acronym></a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2596690">Other Documents About <acronym class="acronym">BIND</acronym></a></span></dt> </dl></dd> </dl> </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2592997"></a>Acknowledgments</h2></div></div></div> +<a name="id2593283"></a>Acknowledgments</h2></div></div></div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> <a name="historical_dns_information"></a>A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym> @@ -110,7 +110,7 @@ during that time: Doug Kingston, Craig Partridge, Smoot Carl-Mitchell, Mike Muuss, Jim Bloom and Mike Schwartz. <acronym class="acronym">BIND</acronym> maintenance was subsequently - handled by Mike Karels and O. Kure. + handled by Mike Karels and Øivind Kure. </p> <p> <acronym class="acronym">BIND</acronym> versions 4.9 and 4.9.1 were @@ -125,7 +125,7 @@ Wolfhugel, and others. </p> <p> - <acronym class="acronym">BIND</acronym> version 4.9.2 was sponsored by + In 1994, <acronym class="acronym">BIND</acronym> version 4.9.2 was sponsored by Vixie Enterprises. Paul Vixie became <acronym class="acronym">BIND</acronym>'s principal architect/programmer. @@ -135,11 +135,26 @@ have been developed and maintained by the Internet Systems Consortium and its predecessor, the Internet Software Consortium, with support being provided - by ISC's sponsors. As co-architects/programmers, Bob Halley and + by ISC's sponsors. + </p> +<p> + As co-architects/programmers, Bob Halley and Paul Vixie released the first production-ready version of <acronym class="acronym">BIND</acronym> version 8 in May 1997. </p> <p> + BIND version 9 was released in September 2000 and is a + major rewrite of nearly all aspects of the underlying + BIND architecture. + </p> +<p> + BIND version 4 is officially deprecated and BIND version + 8 development is considered maintenance-only in favor + of BIND version 9. No additional development is done + on BIND version 4 or BIND version 8 other than for + security-related patches. + </p> +<p> <acronym class="acronym">BIND</acronym> development work is made possible today by the sponsorship of several corporations, and by the tireless work efforts of @@ -149,7 +164,7 @@ </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2593159"></a>General <acronym class="acronym">DNS</acronym> Reference Information</h2></div></div></div> +<a name="id2593454"></a>General <acronym class="acronym">DNS</acronym> Reference Information</h2></div></div></div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> <a name="ipv6addresses"></a>IPv6 addresses (AAAA)</h3></div></div></div> @@ -161,7 +176,8 @@ <span class="emphasis"><em>Anycast</em></span>, an identifier for a set of interfaces; and <span class="emphasis"><em>Multicast</em></span>, an identifier for a set of interfaces. Here we describe the global - Unicast address scheme. For more information, see RFC 3587. + Unicast address scheme. For more information, see RFC 3587, + "Global Unicast Address Format." </p> <p> IPv6 unicast addresses consist of a @@ -236,17 +252,17 @@ </p> <div class="bibliography"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2593347"></a>Bibliography</h4></div></div></div> +<a name="id2593642"></a>Bibliography</h4></div></div></div> <div class="bibliodiv"> <h3 class="title">Standards</h3> <div class="biblioentry"> -<a name="id2593357"></a><p>[<abbr class="abbrev">RFC974</abbr>] <span class="author"><span class="firstname">C.</span> <span class="surname">Partridge</span>. </span><span class="title"><i>Mail Routing and the Domain System</i>. </span><span class="pubdate">January 1986. </span></p> +<a name="id2593653"></a><p>[<abbr class="abbrev">RFC974</abbr>] <span class="author"><span class="firstname">C.</span> <span class="surname">Partridge</span>. </span><span class="title"><i>Mail Routing and the Domain System</i>. </span><span class="pubdate">January 1986. </span></p> </div> <div class="biblioentry"> -<a name="id2593381"></a><p>[<abbr class="abbrev">RFC1034</abbr>] <span class="author"><span class="firstname">P.V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>Domain Names — Concepts and Facilities</i>. </span><span class="pubdate">November 1987. </span></p> +<a name="id2593676"></a><p>[<abbr class="abbrev">RFC1034</abbr>] <span class="author"><span class="firstname">P.V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>Domain Names — Concepts and Facilities</i>. </span><span class="pubdate">November 1987. </span></p> </div> <div class="biblioentry"> -<a name="id2593404"></a><p>[<abbr class="abbrev">RFC1035</abbr>] <span class="author"><span class="firstname">P. V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>Domain Names — Implementation and +<a name="id2593700"></a><p>[<abbr class="abbrev">RFC1035</abbr>] <span class="author"><span class="firstname">P. V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>Domain Names — Implementation and Specification</i>. </span><span class="pubdate">November 1987. </span></p> </div> </div> @@ -254,42 +270,42 @@ <h3 class="title"> <a name="proposed_standards"></a>Proposed Standards</h3> <div class="biblioentry"> -<a name="id2593441"></a><p>[<abbr class="abbrev">RFC2181</abbr>] <span class="author"><span class="firstname">R., R. Bush</span> <span class="surname">Elz</span>. </span><span class="title"><i>Clarifications to the <acronym class="acronym">DNS</acronym> +<a name="id2593736"></a><p>[<abbr class="abbrev">RFC2181</abbr>] <span class="author"><span class="firstname">R., R. Bush</span> <span class="surname">Elz</span>. </span><span class="title"><i>Clarifications to the <acronym class="acronym">DNS</acronym> Specification</i>. </span><span class="pubdate">July 1997. </span></p> </div> <div class="biblioentry"> -<a name="id2593467"></a><p>[<abbr class="abbrev">RFC2308</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Andrews</span>. </span><span class="title"><i>Negative Caching of <acronym class="acronym">DNS</acronym> +<a name="id2593763"></a><p>[<abbr class="abbrev">RFC2308</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Andrews</span>. </span><span class="title"><i>Negative Caching of <acronym class="acronym">DNS</acronym> Queries</i>. </span><span class="pubdate">March 1998. </span></p> </div> <div class="biblioentry"> -<a name="id2593493"></a><p>[<abbr class="abbrev">RFC1995</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Ohta</span>. </span><span class="title"><i>Incremental Zone Transfer in <acronym class="acronym">DNS</acronym></i>. </span><span class="pubdate">August 1996. </span></p> +<a name="id2593788"></a><p>[<abbr class="abbrev">RFC1995</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Ohta</span>. </span><span class="title"><i>Incremental Zone Transfer in <acronym class="acronym">DNS</acronym></i>. </span><span class="pubdate">August 1996. </span></p> </div> <div class="biblioentry"> -<a name="id2593517"></a><p>[<abbr class="abbrev">RFC1996</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>A Mechanism for Prompt Notification of Zone Changes</i>. </span><span class="pubdate">August 1996. </span></p> +<a name="id2593813"></a><p>[<abbr class="abbrev">RFC1996</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>A Mechanism for Prompt Notification of Zone Changes</i>. </span><span class="pubdate">August 1996. </span></p> </div> <div class="biblioentry"> -<a name="id2593541"></a><p>[<abbr class="abbrev">RFC2136</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">S.</span> <span class="surname">Thomson</span>, <span class="firstname">Y.</span> <span class="surname">Rekhter</span>, and <span class="firstname">J.</span> <span class="surname">Bound</span>. </span><span class="title"><i>Dynamic Updates in the Domain Name System</i>. </span><span class="pubdate">April 1997. </span></p> +<a name="id2593836"></a><p>[<abbr class="abbrev">RFC2136</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">S.</span> <span class="surname">Thomson</span>, <span class="firstname">Y.</span> <span class="surname">Rekhter</span>, and <span class="firstname">J.</span> <span class="surname">Bound</span>. </span><span class="title"><i>Dynamic Updates in the Domain Name System</i>. </span><span class="pubdate">April 1997. </span></p> </div> <div class="biblioentry"> -<a name="id2593596"></a><p>[<abbr class="abbrev">RFC2671</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Extension Mechanisms for DNS (EDNS0)</i>. </span><span class="pubdate">August 1997. </span></p> +<a name="id2593892"></a><p>[<abbr class="abbrev">RFC2671</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Extension Mechanisms for DNS (EDNS0)</i>. </span><span class="pubdate">August 1997. </span></p> </div> <div class="biblioentry"> -<a name="id2593623"></a><p>[<abbr class="abbrev">RFC2672</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Crawford</span>. </span><span class="title"><i>Non-Terminal DNS Name Redirection</i>. </span><span class="pubdate">August 1999. </span></p> +<a name="id2593918"></a><p>[<abbr class="abbrev">RFC2672</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Crawford</span>. </span><span class="title"><i>Non-Terminal DNS Name Redirection</i>. </span><span class="pubdate">August 1999. </span></p> </div> <div class="biblioentry"> -<a name="id2593650"></a><p>[<abbr class="abbrev">RFC2845</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">O.</span> <span class="surname">Gudmundsson</span>, <span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>, and <span class="firstname">B.</span> <span class="surname">Wellington</span>. </span><span class="title"><i>Secret Key Transaction Authentication for <acronym class="acronym">DNS</acronym> (TSIG)</i>. </span><span class="pubdate">May 2000. </span></p> +<a name="id2593945"></a><p>[<abbr class="abbrev">RFC2845</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">O.</span> <span class="surname">Gudmundsson</span>, <span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>, and <span class="firstname">B.</span> <span class="surname">Wellington</span>. </span><span class="title"><i>Secret Key Transaction Authentication for <acronym class="acronym">DNS</acronym> (TSIG)</i>. </span><span class="pubdate">May 2000. </span></p> </div> <div class="biblioentry"> -<a name="id2593712"></a><p>[<abbr class="abbrev">RFC2930</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Secret Key Establishment for DNS (TKEY RR)</i>. </span><span class="pubdate">September 2000. </span></p> +<a name="id2594007"></a><p>[<abbr class="abbrev">RFC2930</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Secret Key Establishment for DNS (TKEY RR)</i>. </span><span class="pubdate">September 2000. </span></p> </div> <div class="biblioentry"> -<a name="id2593741"></a><p>[<abbr class="abbrev">RFC2931</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>DNS Request and Transaction Signatures (SIG(0)s)</i>. </span><span class="pubdate">September 2000. </span></p> +<a name="id2594037"></a><p>[<abbr class="abbrev">RFC2931</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>DNS Request and Transaction Signatures (SIG(0)s)</i>. </span><span class="pubdate">September 2000. </span></p> </div> <div class="biblioentry"> -<a name="id2593771"></a><p>[<abbr class="abbrev">RFC3007</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Wellington</span>. </span><span class="title"><i>Secure Domain Name System (DNS) Dynamic Update</i>. </span><span class="pubdate">November 2000. </span></p> +<a name="id2594067"></a><p>[<abbr class="abbrev">RFC3007</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Wellington</span>. </span><span class="title"><i>Secure Domain Name System (DNS) Dynamic Update</i>. </span><span class="pubdate">November 2000. </span></p> </div> <div class="biblioentry"> -<a name="id2593798"></a><p>[<abbr class="abbrev">RFC3645</abbr>] <span class="authorgroup"><span class="firstname">S.</span> <span class="surname">Kwan</span>, <span class="firstname">P.</span> <span class="surname">Garg</span>, <span class="firstname">J.</span> <span class="surname">Gilroy</span>, <span class="firstname">L.</span> <span class="surname">Esibov</span>, <span class="firstname">J.</span> <span class="surname">Westhead</span>, and <span class="firstname">R.</span> <span class="surname">Hall</span>. </span><span class="title"><i>Generic Security Service Algorithm for Secret +<a name="id2594093"></a><p>[<abbr class="abbrev">RFC3645</abbr>] <span class="authorgroup"><span class="firstname">S.</span> <span class="surname">Kwan</span>, <span class="firstname">P.</span> <span class="surname">Garg</span>, <span class="firstname">J.</span> <span class="surname">Gilroy</span>, <span class="firstname">L.</span> <span class="surname">Esibov</span>, <span class="firstname">J.</span> <span class="surname">Westhead</span>, and <span class="firstname">R.</span> <span class="surname">Hall</span>. </span><span class="title"><i>Generic Security Service Algorithm for Secret Key Transaction Authentication for DNS (GSS-TSIG)</i>. </span><span class="pubdate">October 2003. </span></p> </div> @@ -298,19 +314,19 @@ <h3 class="title"> <acronym class="acronym">DNS</acronym> Security Proposed Standards</h3> <div class="biblioentry"> -<a name="id2593880"></a><p>[<abbr class="abbrev">RFC3225</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Conrad</span>. </span><span class="title"><i>Indicating Resolver Support of DNSSEC</i>. </span><span class="pubdate">December 2001. </span></p> +<a name="id2594176"></a><p>[<abbr class="abbrev">RFC3225</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Conrad</span>. </span><span class="title"><i>Indicating Resolver Support of DNSSEC</i>. </span><span class="pubdate">December 2001. </span></p> </div> <div class="biblioentry"> -<a name="id2593907"></a><p>[<abbr class="abbrev">RFC3833</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Atkins</span> and <span class="firstname">R.</span> <span class="surname">Austein</span>. </span><span class="title"><i>Threat Analysis of the Domain Name System (DNS)</i>. </span><span class="pubdate">August 2004. </span></p> +<a name="id2594270"></a><p>[<abbr class="abbrev">RFC3833</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Atkins</span> and <span class="firstname">R.</span> <span class="surname">Austein</span>. </span><span class="title"><i>Threat Analysis of the Domain Name System (DNS)</i>. </span><span class="pubdate">August 2004. </span></p> </div> <div class="biblioentry"> -<a name="id2593943"></a><p>[<abbr class="abbrev">RFC4033</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Arends</span>, <span class="firstname">R.</span> <span class="surname">Austein</span>, <span class="firstname">M.</span> <span class="surname">Larson</span>, <span class="firstname">D.</span> <span class="surname">Massey</span>, and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>DNS Security Introduction and Requirements</i>. </span><span class="pubdate">March 2005. </span></p> +<a name="id2594307"></a><p>[<abbr class="abbrev">RFC4033</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Arends</span>, <span class="firstname">R.</span> <span class="surname">Austein</span>, <span class="firstname">M.</span> <span class="surname">Larson</span>, <span class="firstname">D.</span> <span class="surname">Massey</span>, and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>DNS Security Introduction and Requirements</i>. </span><span class="pubdate">March 2005. </span></p> </div> <div class="biblioentry"> -<a name="id2594008"></a><p>[<abbr class="abbrev">RFC4044</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Arends</span>, <span class="firstname">R.</span> <span class="surname">Austein</span>, <span class="firstname">M.</span> <span class="surname">Larson</span>, <span class="firstname">D.</span> <span class="surname">Massey</span>, and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>Resource Records for the DNS Security Extensions</i>. </span><span class="pubdate">March 2005. </span></p> +<a name="id2594372"></a><p>[<abbr class="abbrev">RFC4044</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Arends</span>, <span class="firstname">R.</span> <span class="surname">Austein</span>, <span class="firstname">M.</span> <span class="surname">Larson</span>, <span class="firstname">D.</span> <span class="surname">Massey</span>, and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>Resource Records for the DNS Security Extensions</i>. </span><span class="pubdate">March 2005. </span></p> </div> <div class="biblioentry"> -<a name="id2594073"></a><p>[<abbr class="abbrev">RFC4035</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Arends</span>, <span class="firstname">R.</span> <span class="surname">Austein</span>, <span class="firstname">M.</span> <span class="surname">Larson</span>, <span class="firstname">D.</span> <span class="surname">Massey</span>, and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>Protocol Modifications for the DNS +<a name="id2594437"></a><p>[<abbr class="abbrev">RFC4035</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Arends</span>, <span class="firstname">R.</span> <span class="surname">Austein</span>, <span class="firstname">M.</span> <span class="surname">Larson</span>, <span class="firstname">D.</span> <span class="surname">Massey</span>, and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>Protocol Modifications for the DNS Security Extensions</i>. </span><span class="pubdate">March 2005. </span></p> </div> </div> @@ -318,146 +334,146 @@ <h3 class="title">Other Important RFCs About <acronym class="acronym">DNS</acronym> Implementation</h3> <div class="biblioentry"> -<a name="id2594147"></a><p>[<abbr class="abbrev">RFC1535</abbr>] <span class="author"><span class="firstname">E.</span> <span class="surname">Gavron</span>. </span><span class="title"><i>A Security Problem and Proposed Correction With Widely +<a name="id2594510"></a><p>[<abbr class="abbrev">RFC1535</abbr>] <span class="author"><span class="firstname">E.</span> <span class="surname">Gavron</span>. </span><span class="title"><i>A Security Problem and Proposed Correction With Widely Deployed <acronym class="acronym">DNS</acronym> Software.</i>. </span><span class="pubdate">October 1993. </span></p> </div> <div class="biblioentry"> -<a name="id2594172"></a><p>[<abbr class="abbrev">RFC1536</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Kumar</span>, <span class="firstname">J.</span> <span class="surname">Postel</span>, <span class="firstname">C.</span> <span class="surname">Neuman</span>, <span class="firstname">P.</span> <span class="surname">Danzig</span>, and <span class="firstname">S.</span> <span class="surname">Miller</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Implementation +<a name="id2594536"></a><p>[<abbr class="abbrev">RFC1536</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Kumar</span>, <span class="firstname">J.</span> <span class="surname">Postel</span>, <span class="firstname">C.</span> <span class="surname">Neuman</span>, <span class="firstname">P.</span> <span class="surname">Danzig</span>, and <span class="firstname">S.</span> <span class="surname">Miller</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Implementation Errors and Suggested Fixes</i>. </span><span class="pubdate">October 1993. </span></p> </div> <div class="biblioentry"> -<a name="id2594241"></a><p>[<abbr class="abbrev">RFC1982</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Elz</span> and <span class="firstname">R.</span> <span class="surname">Bush</span>. </span><span class="title"><i>Serial Number Arithmetic</i>. </span><span class="pubdate">August 1996. </span></p> +<a name="id2594673"></a><p>[<abbr class="abbrev">RFC1982</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Elz</span> and <span class="firstname">R.</span> <span class="surname">Bush</span>. </span><span class="title"><i>Serial Number Arithmetic</i>. </span><span class="pubdate">August 1996. </span></p> </div> <div class="biblioentry"> -<a name="id2594276"></a><p>[<abbr class="abbrev">RFC4074</abbr>] <span class="authorgroup"><span class="firstname">Y.</span> <span class="surname">Morishita</span> and <span class="firstname">T.</span> <span class="surname">Jinmei</span>. </span><span class="title"><i>Common Misbehaviour Against <acronym class="acronym">DNS</acronym> +<a name="id2594708"></a><p>[<abbr class="abbrev">RFC4074</abbr>] <span class="authorgroup"><span class="firstname">Y.</span> <span class="surname">Morishita</span> and <span class="firstname">T.</span> <span class="surname">Jinmei</span>. </span><span class="title"><i>Common Misbehaviour Against <acronym class="acronym">DNS</acronym> Queries for IPv6 Addresses</i>. </span><span class="pubdate">May 2005. </span></p> </div> </div> <div class="bibliodiv"> <h3 class="title">Resource Record Types</h3> <div class="biblioentry"> -<a name="id2594322"></a><p>[<abbr class="abbrev">RFC1183</abbr>] <span class="authorgroup"><span class="firstname">C.F.</span> <span class="surname">Everhart</span>, <span class="firstname">L. A.</span> <span class="surname">Mamakos</span>, <span class="firstname">R.</span> <span class="surname">Ullmann</span>, and <span class="firstname">P.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>New <acronym class="acronym">DNS</acronym> RR Definitions</i>. </span><span class="pubdate">October 1990. </span></p> +<a name="id2594754"></a><p>[<abbr class="abbrev">RFC1183</abbr>] <span class="authorgroup"><span class="firstname">C.F.</span> <span class="surname">Everhart</span>, <span class="firstname">L. A.</span> <span class="surname">Mamakos</span>, <span class="firstname">R.</span> <span class="surname">Ullmann</span>, and <span class="firstname">P.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>New <acronym class="acronym">DNS</acronym> RR Definitions</i>. </span><span class="pubdate">October 1990. </span></p> </div> <div class="biblioentry"> -<a name="id2594448"></a><p>[<abbr class="abbrev">RFC1706</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Manning</span> and <span class="firstname">R.</span> <span class="surname">Colella</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> NSAP Resource Records</i>. </span><span class="pubdate">October 1994. </span></p> +<a name="id2594811"></a><p>[<abbr class="abbrev">RFC1706</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Manning</span> and <span class="firstname">R.</span> <span class="surname">Colella</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> NSAP Resource Records</i>. </span><span class="pubdate">October 1994. </span></p> </div> <div class="biblioentry"> -<a name="id2594485"></a><p>[<abbr class="abbrev">RFC2168</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Daniel</span> and <span class="firstname">M.</span> <span class="surname">Mealling</span>. </span><span class="title"><i>Resolution of Uniform Resource Identifiers using +<a name="id2594849"></a><p>[<abbr class="abbrev">RFC2168</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Daniel</span> and <span class="firstname">M.</span> <span class="surname">Mealling</span>. </span><span class="title"><i>Resolution of Uniform Resource Identifiers using the Domain Name System</i>. </span><span class="pubdate">June 1997. </span></p> </div> <div class="biblioentry"> -<a name="id2594520"></a><p>[<abbr class="abbrev">RFC1876</abbr>] <span class="authorgroup"><span class="firstname">C.</span> <span class="surname">Davis</span>, <span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">T.</span>, and <span class="firstname">I.</span> <span class="surname">Dickinson</span>. </span><span class="title"><i>A Means for Expressing Location Information in the +<a name="id2594884"></a><p>[<abbr class="abbrev">RFC1876</abbr>] <span class="authorgroup"><span class="firstname">C.</span> <span class="surname">Davis</span>, <span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">T.</span>, and <span class="firstname">I.</span> <span class="surname">Dickinson</span>. </span><span class="title"><i>A Means for Expressing Location Information in the Domain Name System</i>. </span><span class="pubdate">January 1996. </span></p> </div> <div class="biblioentry"> -<a name="id2594574"></a><p>[<abbr class="abbrev">RFC2052</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Gulbrandsen</span> and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>A <acronym class="acronym">DNS</acronym> RR for Specifying the +<a name="id2594938"></a><p>[<abbr class="abbrev">RFC2052</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Gulbrandsen</span> and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>A <acronym class="acronym">DNS</acronym> RR for Specifying the Location of Services.</i>. </span><span class="pubdate">October 1996. </span></p> </div> <div class="biblioentry"> -<a name="id2594613"></a><p>[<abbr class="abbrev">RFC2163</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Allocchio</span>. </span><span class="title"><i>Using the Internet <acronym class="acronym">DNS</acronym> to +<a name="id2594977"></a><p>[<abbr class="abbrev">RFC2163</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Allocchio</span>. </span><span class="title"><i>Using the Internet <acronym class="acronym">DNS</acronym> to Distribute MIXER Conformant Global Address Mapping</i>. </span><span class="pubdate">January 1998. </span></p> </div> <div class="biblioentry"> -<a name="id2594638"></a><p>[<abbr class="abbrev">RFC2230</abbr>] <span class="author"><span class="firstname">R.</span> <span class="surname">Atkinson</span>. </span><span class="title"><i>Key Exchange Delegation Record for the <acronym class="acronym">DNS</acronym></i>. </span><span class="pubdate">October 1997. </span></p> +<a name="id2595002"></a><p>[<abbr class="abbrev">RFC2230</abbr>] <span class="author"><span class="firstname">R.</span> <span class="surname">Atkinson</span>. </span><span class="title"><i>Key Exchange Delegation Record for the <acronym class="acronym">DNS</acronym></i>. </span><span class="pubdate">October 1997. </span></p> </div> <div class="biblioentry"> -<a name="id2594664"></a><p>[<abbr class="abbrev">RFC2536</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>DSA KEYs and SIGs in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p> +<a name="id2595028"></a><p>[<abbr class="abbrev">RFC2536</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>DSA KEYs and SIGs in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p> </div> <div class="biblioentry"> -<a name="id2594691"></a><p>[<abbr class="abbrev">RFC2537</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>RSA/MD5 KEYs and SIGs in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p> +<a name="id2595054"></a><p>[<abbr class="abbrev">RFC2537</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>RSA/MD5 KEYs and SIGs in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p> </div> <div class="biblioentry"> -<a name="id2594717"></a><p>[<abbr class="abbrev">RFC2538</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span> and <span class="firstname">O.</span> <span class="surname">Gudmundsson</span>. </span><span class="title"><i>Storing Certificates in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p> +<a name="id2595081"></a><p>[<abbr class="abbrev">RFC2538</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span> and <span class="firstname">O.</span> <span class="surname">Gudmundsson</span>. </span><span class="title"><i>Storing Certificates in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p> </div> <div class="biblioentry"> -<a name="id2594757"></a><p>[<abbr class="abbrev">RFC2539</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Storage of Diffie-Hellman Keys in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p> +<a name="id2595121"></a><p>[<abbr class="abbrev">RFC2539</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Storage of Diffie-Hellman Keys in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p> </div> <div class="biblioentry"> -<a name="id2594787"></a><p>[<abbr class="abbrev">RFC2540</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Detached Domain Name System (DNS) Information</i>. </span><span class="pubdate">March 1999. </span></p> +<a name="id2595150"></a><p>[<abbr class="abbrev">RFC2540</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Detached Domain Name System (DNS) Information</i>. </span><span class="pubdate">March 1999. </span></p> </div> <div class="biblioentry"> -<a name="id2594817"></a><p>[<abbr class="abbrev">RFC2782</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Gulbrandsen</span>. </span><span class="author"><span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="author"><span class="firstname">L.</span> <span class="surname">Esibov</span>. </span><span class="title"><i>A DNS RR for specifying the location of services (DNS SRV)</i>. </span><span class="pubdate">February 2000. </span></p> +<a name="id2595180"></a><p>[<abbr class="abbrev">RFC2782</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Gulbrandsen</span>. </span><span class="author"><span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="author"><span class="firstname">L.</span> <span class="surname">Esibov</span>. </span><span class="title"><i>A DNS RR for specifying the location of services (DNS SRV)</i>. </span><span class="pubdate">February 2000. </span></p> </div> <div class="biblioentry"> -<a name="id2594859"></a><p>[<abbr class="abbrev">RFC2915</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Mealling</span>. </span><span class="author"><span class="firstname">R.</span> <span class="surname">Daniel</span>. </span><span class="title"><i>The Naming Authority Pointer (NAPTR) DNS Resource Record</i>. </span><span class="pubdate">September 2000. </span></p> +<a name="id2595223"></a><p>[<abbr class="abbrev">RFC2915</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Mealling</span>. </span><span class="author"><span class="firstname">R.</span> <span class="surname">Daniel</span>. </span><span class="title"><i>The Naming Authority Pointer (NAPTR) DNS Resource Record</i>. </span><span class="pubdate">September 2000. </span></p> </div> <div class="biblioentry"> -<a name="id2594892"></a><p>[<abbr class="abbrev">RFC3110</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS)</i>. </span><span class="pubdate">May 2001. </span></p> +<a name="id2595256"></a><p>[<abbr class="abbrev">RFC3110</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS)</i>. </span><span class="pubdate">May 2001. </span></p> </div> <div class="biblioentry"> -<a name="id2594919"></a><p>[<abbr class="abbrev">RFC3123</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Koch</span>. </span><span class="title"><i>A DNS RR Type for Lists of Address Prefixes (APL RR)</i>. </span><span class="pubdate">June 2001. </span></p> +<a name="id2595283"></a><p>[<abbr class="abbrev">RFC3123</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Koch</span>. </span><span class="title"><i>A DNS RR Type for Lists of Address Prefixes (APL RR)</i>. </span><span class="pubdate">June 2001. </span></p> </div> <div class="biblioentry"> -<a name="id2594942"></a><p>[<abbr class="abbrev">RFC3596</abbr>] <span class="authorgroup"><span class="firstname">S.</span> <span class="surname">Thomson</span>, <span class="firstname">C.</span> <span class="surname">Huitema</span>, <span class="firstname">V.</span> <span class="surname">Ksinant</span>, and <span class="firstname">M.</span> <span class="surname">Souissi</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Extensions to support IP +<a name="id2595306"></a><p>[<abbr class="abbrev">RFC3596</abbr>] <span class="authorgroup"><span class="firstname">S.</span> <span class="surname">Thomson</span>, <span class="firstname">C.</span> <span class="surname">Huitema</span>, <span class="firstname">V.</span> <span class="surname">Ksinant</span>, and <span class="firstname">M.</span> <span class="surname">Souissi</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Extensions to support IP version 6</i>. </span><span class="pubdate">October 2003. </span></p> </div> <div class="biblioentry"> -<a name="id2595000"></a><p>[<abbr class="abbrev">RFC3597</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Gustafsson</span>. </span><span class="title"><i>Handling of Unknown DNS Resource Record (RR) Types</i>. </span><span class="pubdate">September 2003. </span></p> +<a name="id2595364"></a><p>[<abbr class="abbrev">RFC3597</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Gustafsson</span>. </span><span class="title"><i>Handling of Unknown DNS Resource Record (RR) Types</i>. </span><span class="pubdate">September 2003. </span></p> </div> </div> <div class="bibliodiv"> <h3 class="title"> <acronym class="acronym">DNS</acronym> and the Internet</h3> <div class="biblioentry"> -<a name="id2595032"></a><p>[<abbr class="abbrev">RFC1101</abbr>] <span class="author"><span class="firstname">P. V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Encoding of Network Names +<a name="id2595396"></a><p>[<abbr class="abbrev">RFC1101</abbr>] <span class="author"><span class="firstname">P. V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Encoding of Network Names and Other Types</i>. </span><span class="pubdate">April 1989. </span></p> </div> <div class="biblioentry"> -<a name="id2595058"></a><p>[<abbr class="abbrev">RFC1123</abbr>] <span class="author"><span class="surname">Braden</span>. </span><span class="title"><i>Requirements for Internet Hosts - Application and +<a name="id2595421"></a><p>[<abbr class="abbrev">RFC1123</abbr>] <span class="author"><span class="surname">Braden</span>. </span><span class="title"><i>Requirements for Internet Hosts - Application and Support</i>. </span><span class="pubdate">October 1989. </span></p> </div> <div class="biblioentry"> -<a name="id2595080"></a><p>[<abbr class="abbrev">RFC1591</abbr>] <span class="author"><span class="firstname">J.</span> <span class="surname">Postel</span>. </span><span class="title"><i>Domain Name System Structure and Delegation</i>. </span><span class="pubdate">March 1994. </span></p> +<a name="id2595444"></a><p>[<abbr class="abbrev">RFC1591</abbr>] <span class="author"><span class="firstname">J.</span> <span class="surname">Postel</span>. </span><span class="title"><i>Domain Name System Structure and Delegation</i>. </span><span class="pubdate">March 1994. </span></p> </div> <div class="biblioentry"> -<a name="id2595104"></a><p>[<abbr class="abbrev">RFC2317</abbr>] <span class="authorgroup"><span class="firstname">H.</span> <span class="surname">Eidnes</span>, <span class="firstname">G.</span> <span class="surname">de Groot</span>, and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Classless IN-ADDR.ARPA Delegation</i>. </span><span class="pubdate">March 1998. </span></p> +<a name="id2595467"></a><p>[<abbr class="abbrev">RFC2317</abbr>] <span class="authorgroup"><span class="firstname">H.</span> <span class="surname">Eidnes</span>, <span class="firstname">G.</span> <span class="surname">de Groot</span>, and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Classless IN-ADDR.ARPA Delegation</i>. </span><span class="pubdate">March 1998. </span></p> </div> <div class="biblioentry"> -<a name="id2595149"></a><p>[<abbr class="abbrev">RFC2826</abbr>] <span class="authorgroup"><span class="surname">Internet Architecture Board</span>. </span><span class="title"><i>IAB Technical Comment on the Unique DNS Root</i>. </span><span class="pubdate">May 2000. </span></p> +<a name="id2595513"></a><p>[<abbr class="abbrev">RFC2826</abbr>] <span class="authorgroup"><span class="surname">Internet Architecture Board</span>. </span><span class="title"><i>IAB Technical Comment on the Unique DNS Root</i>. </span><span class="pubdate">May 2000. </span></p> </div> <div class="biblioentry"> -<a name="id2595173"></a><p>[<abbr class="abbrev">RFC2929</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>, <span class="firstname">E.</span> <span class="surname">Brunner-Williams</span>, and <span class="firstname">B.</span> <span class="surname">Manning</span>. </span><span class="title"><i>Domain Name System (DNS) IANA Considerations</i>. </span><span class="pubdate">September 2000. </span></p> +<a name="id2595537"></a><p>[<abbr class="abbrev">RFC2929</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>, <span class="firstname">E.</span> <span class="surname">Brunner-Williams</span>, and <span class="firstname">B.</span> <span class="surname">Manning</span>. </span><span class="title"><i>Domain Name System (DNS) IANA Considerations</i>. </span><span class="pubdate">September 2000. </span></p> </div> </div> <div class="bibliodiv"> <h3 class="title"> <acronym class="acronym">DNS</acronym> Operations</h3> <div class="biblioentry"> -<a name="id2595230"></a><p>[<abbr class="abbrev">RFC1033</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Lottor</span>. </span><span class="title"><i>Domain administrators operations guide.</i>. </span><span class="pubdate">November 1987. </span></p> +<a name="id2595594"></a><p>[<abbr class="abbrev">RFC1033</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Lottor</span>. </span><span class="title"><i>Domain administrators operations guide.</i>. </span><span class="pubdate">November 1987. </span></p> </div> <div class="biblioentry"> -<a name="id2595254"></a><p>[<abbr class="abbrev">RFC1537</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Beertema</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Data File +<a name="id2595618"></a><p>[<abbr class="abbrev">RFC1537</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Beertema</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Data File Configuration Errors</i>. </span><span class="pubdate">October 1993. </span></p> </div> <div class="biblioentry"> -<a name="id2595281"></a><p>[<abbr class="abbrev">RFC1912</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Barr</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Operational and +<a name="id2595644"></a><p>[<abbr class="abbrev">RFC1912</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Barr</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Operational and Configuration Errors</i>. </span><span class="pubdate">February 1996. </span></p> </div> <div class="biblioentry"> -<a name="id2595307"></a><p>[<abbr class="abbrev">RFC2010</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Manning</span> and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Operational Criteria for Root Name Servers.</i>. </span><span class="pubdate">October 1996. </span></p> +<a name="id2595671"></a><p>[<abbr class="abbrev">RFC2010</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Manning</span> and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Operational Criteria for Root Name Servers.</i>. </span><span class="pubdate">October 1996. </span></p> </div> <div class="biblioentry"> -<a name="id2595344"></a><p>[<abbr class="abbrev">RFC2219</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Hamilton</span> and <span class="firstname">R.</span> <span class="surname">Wright</span>. </span><span class="title"><i>Use of <acronym class="acronym">DNS</acronym> Aliases for +<a name="id2595707"></a><p>[<abbr class="abbrev">RFC2219</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Hamilton</span> and <span class="firstname">R.</span> <span class="surname">Wright</span>. </span><span class="title"><i>Use of <acronym class="acronym">DNS</acronym> Aliases for Network Services.</i>. </span><span class="pubdate">October 1997. </span></p> </div> </div> <div class="bibliodiv"> <h3 class="title">Internationalized Domain Names</h3> <div class="biblioentry"> -<a name="id2595389"></a><p>[<abbr class="abbrev">RFC2825</abbr>] <span class="authorgroup"><span class="surname">IAB</span> and <span class="firstname">R.</span> <span class="surname">Daigle</span>. </span><span class="title"><i>A Tangled Web: Issues of I18N, Domain Names, +<a name="id2595753"></a><p>[<abbr class="abbrev">RFC2825</abbr>] <span class="authorgroup"><span class="surname">IAB</span> and <span class="firstname">R.</span> <span class="surname">Daigle</span>. </span><span class="title"><i>A Tangled Web: Issues of I18N, Domain Names, and the Other Internet protocols</i>. </span><span class="pubdate">May 2000. </span></p> </div> <div class="biblioentry"> -<a name="id2595421"></a><p>[<abbr class="abbrev">RFC3490</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Faltstrom</span>, <span class="firstname">P.</span> <span class="surname">Hoffman</span>, and <span class="firstname">A.</span> <span class="surname">Costello</span>. </span><span class="title"><i>Internationalizing Domain Names in Applications (IDNA)</i>. </span><span class="pubdate">March 2003. </span></p> +<a name="id2595785"></a><p>[<abbr class="abbrev">RFC3490</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Faltstrom</span>, <span class="firstname">P.</span> <span class="surname">Hoffman</span>, and <span class="firstname">A.</span> <span class="surname">Costello</span>. </span><span class="title"><i>Internationalizing Domain Names in Applications (IDNA)</i>. </span><span class="pubdate">March 2003. </span></p> </div> <div class="biblioentry"> -<a name="id2595467"></a><p>[<abbr class="abbrev">RFC3491</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Hoffman</span> and <span class="firstname">M.</span> <span class="surname">Blanchet</span>. </span><span class="title"><i>Nameprep: A Stringprep Profile for Internationalized Domain Names</i>. </span><span class="pubdate">March 2003. </span></p> +<a name="id2595831"></a><p>[<abbr class="abbrev">RFC3491</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Hoffman</span> and <span class="firstname">M.</span> <span class="surname">Blanchet</span>. </span><span class="title"><i>Nameprep: A Stringprep Profile for Internationalized Domain Names</i>. </span><span class="pubdate">March 2003. </span></p> </div> <div class="biblioentry"> -<a name="id2595502"></a><p>[<abbr class="abbrev">RFC3492</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Costello</span>. </span><span class="title"><i>Punycode: A Bootstring encoding of Unicode +<a name="id2595866"></a><p>[<abbr class="abbrev">RFC3492</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Costello</span>. </span><span class="title"><i>Punycode: A Bootstring encoding of Unicode for Internationalized Domain Names in Applications (IDNA)</i>. </span><span class="pubdate">March 2003. </span></p> </div> @@ -473,50 +489,50 @@ </p> </div> <div class="biblioentry"> -<a name="id2595547"></a><p>[<abbr class="abbrev">RFC1464</abbr>] <span class="author"><span class="firstname">R.</span> <span class="surname">Rosenbaum</span>. </span><span class="title"><i>Using the Domain Name System To Store Arbitrary String +<a name="id2595911"></a><p>[<abbr class="abbrev">RFC1464</abbr>] <span class="author"><span class="firstname">R.</span> <span class="surname">Rosenbaum</span>. </span><span class="title"><i>Using the Domain Name System To Store Arbitrary String Attributes</i>. </span><span class="pubdate">May 1993. </span></p> </div> <div class="biblioentry"> -<a name="id2595570"></a><p>[<abbr class="abbrev">RFC1713</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Romao</span>. </span><span class="title"><i>Tools for <acronym class="acronym">DNS</acronym> Debugging</i>. </span><span class="pubdate">November 1994. </span></p> +<a name="id2595933"></a><p>[<abbr class="abbrev">RFC1713</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Romao</span>. </span><span class="title"><i>Tools for <acronym class="acronym">DNS</acronym> Debugging</i>. </span><span class="pubdate">November 1994. </span></p> </div> <div class="biblioentry"> -<a name="id2595595"></a><p>[<abbr class="abbrev">RFC1794</abbr>] <span class="author"><span class="firstname">T.</span> <span class="surname">Brisco</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Support for Load +<a name="id2595959"></a><p>[<abbr class="abbrev">RFC1794</abbr>] <span class="author"><span class="firstname">T.</span> <span class="surname">Brisco</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Support for Load Balancing</i>. </span><span class="pubdate">April 1995. </span></p> </div> <div class="biblioentry"> -<a name="id2595621"></a><p>[<abbr class="abbrev">RFC2240</abbr>] <span class="author"><span class="firstname">O.</span> <span class="surname">Vaughan</span>. </span><span class="title"><i>A Legal Basis for Domain Name Allocation</i>. </span><span class="pubdate">November 1997. </span></p> +<a name="id2595985"></a><p>[<abbr class="abbrev">RFC2240</abbr>] <span class="author"><span class="firstname">O.</span> <span class="surname">Vaughan</span>. </span><span class="title"><i>A Legal Basis for Domain Name Allocation</i>. </span><span class="pubdate">November 1997. </span></p> </div> <div class="biblioentry"> -<a name="id2595644"></a><p>[<abbr class="abbrev">RFC2345</abbr>] <span class="authorgroup"><span class="firstname">J.</span> <span class="surname">Klensin</span>, <span class="firstname">T.</span> <span class="surname">Wolf</span>, and <span class="firstname">G.</span> <span class="surname">Oglesby</span>. </span><span class="title"><i>Domain Names and Company Name Retrieval</i>. </span><span class="pubdate">May 1998. </span></p> +<a name="id2596008"></a><p>[<abbr class="abbrev">RFC2345</abbr>] <span class="authorgroup"><span class="firstname">J.</span> <span class="surname">Klensin</span>, <span class="firstname">T.</span> <span class="surname">Wolf</span>, and <span class="firstname">G.</span> <span class="surname">Oglesby</span>. </span><span class="title"><i>Domain Names and Company Name Retrieval</i>. </span><span class="pubdate">May 1998. </span></p> </div> <div class="biblioentry"> -<a name="id2595690"></a><p>[<abbr class="abbrev">RFC2352</abbr>] <span class="author"><span class="firstname">O.</span> <span class="surname">Vaughan</span>. </span><span class="title"><i>A Convention For Using Legal Names as Domain Names</i>. </span><span class="pubdate">May 1998. </span></p> +<a name="id2596054"></a><p>[<abbr class="abbrev">RFC2352</abbr>] <span class="author"><span class="firstname">O.</span> <span class="surname">Vaughan</span>. </span><span class="title"><i>A Convention For Using Legal Names as Domain Names</i>. </span><span class="pubdate">May 1998. </span></p> </div> <div class="biblioentry"> -<a name="id2595714"></a><p>[<abbr class="abbrev">RFC3071</abbr>] <span class="authorgroup"><span class="firstname">J.</span> <span class="surname">Klensin</span>. </span><span class="title"><i>Reflections on the DNS, RFC 1591, and Categories of Domains</i>. </span><span class="pubdate">February 2001. </span></p> +<a name="id2596077"></a><p>[<abbr class="abbrev">RFC3071</abbr>] <span class="authorgroup"><span class="firstname">J.</span> <span class="surname">Klensin</span>. </span><span class="title"><i>Reflections on the DNS, RFC 1591, and Categories of Domains</i>. </span><span class="pubdate">February 2001. </span></p> </div> <div class="biblioentry"> -<a name="id2595740"></a><p>[<abbr class="abbrev">RFC3258</abbr>] <span class="authorgroup"><span class="firstname">T.</span> <span class="surname">Hardie</span>. </span><span class="title"><i>Distributing Authoritative Name Servers via +<a name="id2596104"></a><p>[<abbr class="abbrev">RFC3258</abbr>] <span class="authorgroup"><span class="firstname">T.</span> <span class="surname">Hardie</span>. </span><span class="title"><i>Distributing Authoritative Name Servers via Shared Unicast Addresses</i>. </span><span class="pubdate">April 2002. </span></p> </div> <div class="biblioentry"> -<a name="id2595766"></a><p>[<abbr class="abbrev">RFC3901</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Durand</span> and <span class="firstname">J.</span> <span class="surname">Ihren</span>. </span><span class="title"><i>DNS IPv6 Transport Operational Guidelines</i>. </span><span class="pubdate">September 2004. </span></p> +<a name="id2596130"></a><p>[<abbr class="abbrev">RFC3901</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Durand</span> and <span class="firstname">J.</span> <span class="surname">Ihren</span>. </span><span class="title"><i>DNS IPv6 Transport Operational Guidelines</i>. </span><span class="pubdate">September 2004. </span></p> </div> <div class="biblioentry"> -<a name="id2595802"></a><p>[<abbr class="abbrev">RFC2352</abbr>] <span class="author"><span class="firstname">O.</span> <span class="surname">Vaughan</span>. </span><span class="title"><i>A Convention For Using Legal Names as Domain Names</i>. </span><span class="pubdate">May 1998. </span></p> +<a name="id2596166"></a><p>[<abbr class="abbrev">RFC2352</abbr>] <span class="author"><span class="firstname">O.</span> <span class="surname">Vaughan</span>. </span><span class="title"><i>A Convention For Using Legal Names as Domain Names</i>. </span><span class="pubdate">May 1998. </span></p> </div> </div> <div class="bibliodiv"> <h3 class="title">Obsolete and Unimplemented Experimental RFC</h3> <div class="biblioentry"> -<a name="id2595833"></a><p>[<abbr class="abbrev">RFC1712</abbr>] <span class="authorgroup"><span class="firstname">C.</span> <span class="surname">Farrell</span>, <span class="firstname">M.</span> <span class="surname">Schulze</span>, <span class="firstname">S.</span> <span class="surname">Pleitner</span>, and <span class="firstname">D.</span> <span class="surname">Baldoni</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Encoding of Geographical +<a name="id2596197"></a><p>[<abbr class="abbrev">RFC1712</abbr>] <span class="authorgroup"><span class="firstname">C.</span> <span class="surname">Farrell</span>, <span class="firstname">M.</span> <span class="surname">Schulze</span>, <span class="firstname">S.</span> <span class="surname">Pleitner</span>, and <span class="firstname">D.</span> <span class="surname">Baldoni</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Encoding of Geographical Location</i>. </span><span class="pubdate">November 1994. </span></p> </div> <div class="biblioentry"> -<a name="id2595891"></a><p>[<abbr class="abbrev">RFC2673</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Crawford</span>. </span><span class="title"><i>Binary Labels in the Domain Name System</i>. </span><span class="pubdate">August 1999. </span></p> +<a name="id2596254"></a><p>[<abbr class="abbrev">RFC2673</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Crawford</span>. </span><span class="title"><i>Binary Labels in the Domain Name System</i>. </span><span class="pubdate">August 1999. </span></p> </div> <div class="biblioentry"> -<a name="id2595917"></a><p>[<abbr class="abbrev">RFC2874</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Crawford</span> and <span class="firstname">C.</span> <span class="surname">Huitema</span>. </span><span class="title"><i>DNS Extensions to Support IPv6 Address Aggregation +<a name="id2596281"></a><p>[<abbr class="abbrev">RFC2874</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Crawford</span> and <span class="firstname">C.</span> <span class="surname">Huitema</span>. </span><span class="title"><i>DNS Extensions to Support IPv6 Address Aggregation and Renumbering</i>. </span><span class="pubdate">July 2000. </span></p> </div> </div> @@ -530,39 +546,39 @@ </p> </div> <div class="biblioentry"> -<a name="id2595965"></a><p>[<abbr class="abbrev">RFC2065</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span> and <span class="firstname">C.</span> <span class="surname">Kaufman</span>. </span><span class="title"><i>Domain Name System Security Extensions</i>. </span><span class="pubdate">January 1997. </span></p> +<a name="id2596329"></a><p>[<abbr class="abbrev">RFC2065</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span> and <span class="firstname">C.</span> <span class="surname">Kaufman</span>. </span><span class="title"><i>Domain Name System Security Extensions</i>. </span><span class="pubdate">January 1997. </span></p> </div> <div class="biblioentry"> -<a name="id2596005"></a><p>[<abbr class="abbrev">RFC2137</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Secure Domain Name System Dynamic Update</i>. </span><span class="pubdate">April 1997. </span></p> +<a name="id2596369"></a><p>[<abbr class="abbrev">RFC2137</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Secure Domain Name System Dynamic Update</i>. </span><span class="pubdate">April 1997. </span></p> </div> <div class="biblioentry"> -<a name="id2596032"></a><p>[<abbr class="abbrev">RFC2535</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Domain Name System Security Extensions</i>. </span><span class="pubdate">March 1999. </span></p> +<a name="id2596395"></a><p>[<abbr class="abbrev">RFC2535</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Domain Name System Security Extensions</i>. </span><span class="pubdate">March 1999. </span></p> </div> <div class="biblioentry"> -<a name="id2596061"></a><p>[<abbr class="abbrev">RFC3008</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Wellington</span>. </span><span class="title"><i>Domain Name System Security (DNSSEC) +<a name="id2596425"></a><p>[<abbr class="abbrev">RFC3008</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Wellington</span>. </span><span class="title"><i>Domain Name System Security (DNSSEC) Signing Authority</i>. </span><span class="pubdate">November 2000. </span></p> </div> <div class="biblioentry"> -<a name="id2596087"></a><p>[<abbr class="abbrev">RFC3090</abbr>] <span class="authorgroup"><span class="firstname">E.</span> <span class="surname">Lewis</span>. </span><span class="title"><i>DNS Security Extension Clarification on Zone Status</i>. </span><span class="pubdate">March 2001. </span></p> +<a name="id2596451"></a><p>[<abbr class="abbrev">RFC3090</abbr>] <span class="authorgroup"><span class="firstname">E.</span> <span class="surname">Lewis</span>. </span><span class="title"><i>DNS Security Extension Clarification on Zone Status</i>. </span><span class="pubdate">March 2001. </span></p> </div> <div class="biblioentry"> -<a name="id2596114"></a><p>[<abbr class="abbrev">RFC3445</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Massey</span> and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>Limiting the Scope of the KEY Resource Record (RR)</i>. </span><span class="pubdate">December 2002. </span></p> +<a name="id2596477"></a><p>[<abbr class="abbrev">RFC3445</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Massey</span> and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>Limiting the Scope of the KEY Resource Record (RR)</i>. </span><span class="pubdate">December 2002. </span></p> </div> <div class="biblioentry"> -<a name="id2596150"></a><p>[<abbr class="abbrev">RFC3655</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Wellington</span> and <span class="firstname">O.</span> <span class="surname">Gudmundsson</span>. </span><span class="title"><i>Redefinition of DNS Authenticated Data (AD) bit</i>. </span><span class="pubdate">November 2003. </span></p> +<a name="id2596514"></a><p>[<abbr class="abbrev">RFC3655</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Wellington</span> and <span class="firstname">O.</span> <span class="surname">Gudmundsson</span>. </span><span class="title"><i>Redefinition of DNS Authenticated Data (AD) bit</i>. </span><span class="pubdate">November 2003. </span></p> </div> <div class="biblioentry"> -<a name="id2596186"></a><p>[<abbr class="abbrev">RFC3658</abbr>] <span class="authorgroup"><span class="firstname">O.</span> <span class="surname">Gudmundsson</span>. </span><span class="title"><i>Delegation Signer (DS) Resource Record (RR)</i>. </span><span class="pubdate">December 2003. </span></p> +<a name="id2596550"></a><p>[<abbr class="abbrev">RFC3658</abbr>] <span class="authorgroup"><span class="firstname">O.</span> <span class="surname">Gudmundsson</span>. </span><span class="title"><i>Delegation Signer (DS) Resource Record (RR)</i>. </span><span class="pubdate">December 2003. </span></p> </div> <div class="biblioentry"> -<a name="id2596213"></a><p>[<abbr class="abbrev">RFC3755</abbr>] <span class="authorgroup"><span class="firstname">S.</span> <span class="surname">Weiler</span>. </span><span class="title"><i>Legacy Resolver Compatibility for Delegation Signer (DS)</i>. </span><span class="pubdate">May 2004. </span></p> +<a name="id2596577"></a><p>[<abbr class="abbrev">RFC3755</abbr>] <span class="authorgroup"><span class="firstname">S.</span> <span class="surname">Weiler</span>. </span><span class="title"><i>Legacy Resolver Compatibility for Delegation Signer (DS)</i>. </span><span class="pubdate">May 2004. </span></p> </div> <div class="biblioentry"> -<a name="id2596240"></a><p>[<abbr class="abbrev">RFC3757</abbr>] <span class="authorgroup"><span class="firstname">O.</span> <span class="surname">Kolkman</span>, <span class="firstname">J.</span> <span class="surname">Schlyter</span>, and <span class="firstname">E.</span> <span class="surname">Lewis</span>. </span><span class="title"><i>Domain Name System KEY (DNSKEY) Resource Record +<a name="id2596603"></a><p>[<abbr class="abbrev">RFC3757</abbr>] <span class="authorgroup"><span class="firstname">O.</span> <span class="surname">Kolkman</span>, <span class="firstname">J.</span> <span class="surname">Schlyter</span>, and <span class="firstname">E.</span> <span class="surname">Lewis</span>. </span><span class="title"><i>Domain Name System KEY (DNSKEY) Resource Record (RR) Secure Entry Point (SEP) Flag</i>. </span><span class="pubdate">April 2004. </span></p> </div> <div class="biblioentry"> -<a name="id2596284"></a><p>[<abbr class="abbrev">RFC3845</abbr>] <span class="authorgroup"><span class="firstname">J.</span> <span class="surname">Schlyter</span>. </span><span class="title"><i>DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format</i>. </span><span class="pubdate">August 2004. </span></p> +<a name="id2596648"></a><p>[<abbr class="abbrev">RFC3845</abbr>] <span class="authorgroup"><span class="firstname">J.</span> <span class="surname">Schlyter</span>. </span><span class="title"><i>DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format</i>. </span><span class="pubdate">August 2004. </span></p> </div> </div> </div> @@ -583,14 +599,14 @@ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2596326"></a>Other Documents About <acronym class="acronym">BIND</acronym> +<a name="id2596690"></a>Other Documents About <acronym class="acronym">BIND</acronym> </h3></div></div></div> <p></p> <div class="bibliography"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2596336"></a>Bibliography</h4></div></div></div> +<a name="id2596699"></a>Bibliography</h4></div></div></div> <div class="biblioentry"> -<a name="id2596338"></a><p><span class="authorgroup"><span class="firstname">Paul</span> <span class="surname">Albitz</span> and <span class="firstname">Cricket</span> <span class="surname">Liu</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym></i>. </span><span class="copyright">Copyright © 1998 Sebastopol, CA: O'Reilly and Associates. </span></p> +<a name="id2596701"></a><p><span class="authorgroup"><span class="firstname">Paul</span> <span class="surname">Albitz</span> and <span class="firstname">Cricket</span> <span class="surname">Liu</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym></i>. </span><span class="copyright">Copyright © 1998 Sebastopol, CA: O'Reilly and Associates. </span></p> </div> </div> </div> diff --git a/doc/arm/Bv9ARM.html b/doc/arm/Bv9ARM.html index bf70423c..803e4a01 100644 --- a/doc/arm/Bv9ARM.html +++ b/doc/arm/Bv9ARM.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: Bv9ARM.html,v 1.85.18.57 2007/01/30 00:23:46 marka Exp $ --> +<!-- $Id: Bv9ARM.html,v 1.85.18.65 2007/07/09 06:51:14 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -40,7 +40,7 @@ <div class="titlepage"> <div> <div><h1 class="title"> -<a name="id2563153"></a>BIND 9 Administrator Reference Manual</h1></div> +<a name="id2563412"></a>BIND 9 Administrator Reference Manual</h1></div> <div><p class="copyright">Copyright © 2004-2007 Internet Systems Consortium, Inc. ("ISC")</p></div> <div><p class="copyright">Copyright © 2000-2003 Internet Software Consortium.</p></div> </div> @@ -67,10 +67,10 @@ <dt><span class="chapter"><a href="Bv9ARM.ch02.html">2. <acronym class="acronym">BIND</acronym> Resource Requirements</a></span></dt> <dd><dl> <dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567621">Hardware requirements</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567648">CPU Requirements</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567660">Memory Requirements</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567687">Name Server Intensive Environment Issues</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567698">Supported Operating Systems</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567716">CPU Requirements</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567729">Memory Requirements</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567755">Name Server Intensive Environment Issues</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567766">Supported Operating Systems</a></span></dt> </dl></dd> <dt><span class="chapter"><a href="Bv9ARM.ch03.html">3. Name Server Configuration</a></span></dt> <dd><dl> @@ -80,10 +80,10 @@ <dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568019">An Authoritative-only Name Server</a></span></dt> </dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2568041">Load Balancing</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2568465">Name Server Operations</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2568464">Name Server Operations</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568470">Tools for Use With the Name Server Daemon</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2569972">Signals</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568469">Tools for Use With the Name Server Daemon</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2570251">Signals</a></span></dt> </dl></dd> </dl></dd> <dt><span class="chapter"><a href="Bv9ARM.ch04.html">4. Advanced DNS Features</a></span></dt> @@ -92,33 +92,34 @@ <dt><span class="sect1"><a href="Bv9ARM.ch04.html#dynamic_update">Dynamic Update</a></span></dt> <dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch04.html#journal">The journal file</a></span></dt></dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch04.html#incremental_zone_transfers">Incremental Zone Transfers (IXFR)</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2570429">Split DNS</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2570641">Split DNS</a></span></dt> +<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2570659">Example split DNS setup</a></span></dt></dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch04.html#tsig">TSIG</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2570949">Generate Shared Keys for Each Pair of Hosts</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571022">Copying the Shared Secret to Both Machines</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571033">Informing the Servers of the Key's Existence</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571141">Instructing the Server to Use the Key</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571198">TSIG Key Based Access Control</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571243">Errors</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571094">Generate Shared Keys for Each Pair of Hosts</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571168">Copying the Shared Secret to Both Machines</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571178">Informing the Servers of the Key's Existence</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571218">Instructing the Server to Use the Key</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571412">TSIG Key Based Access Control</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571457">Errors</a></span></dt> </dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571257">TKEY</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571306">SIG(0)</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571470">TKEY</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571520">SIG(0)</a></span></dt> <dt><span class="sect1"><a href="Bv9ARM.ch04.html#DNSSEC">DNSSEC</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571579">Generating Keys</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571649">Signing the Zone</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571728">Configuring Servers</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571724">Generating Keys</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571794">Signing the Zone</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571873">Configuring Servers</a></span></dt> </dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571802">IPv6 Support in <acronym class="acronym">BIND</acronym> 9</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2572152">IPv6 Support in <acronym class="acronym">BIND</acronym> 9</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572001">Address Lookups Using AAAA Records</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572022">Address to Name Lookups Using Nibble Format</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572214">Address Lookups Using AAAA Records</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572235">Address to Name Lookups Using Nibble Format</a></span></dt> </dl></dd> </dl></dd> <dt><span class="chapter"><a href="Bv9ARM.ch05.html">5. The <acronym class="acronym">BIND</acronym> 9 Lightweight Resolver</a></span></dt> <dd><dl> -<dt><span class="sect1"><a href="Bv9ARM.ch05.html#id2572055">The Lightweight Resolver Library</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch05.html#id2572268">The Lightweight Resolver Library</a></span></dt> <dt><span class="sect1"><a href="Bv9ARM.ch05.html#lwresd">Running a Resolver Daemon</a></span></dt> </dl></dd> <dt><span class="chapter"><a href="Bv9ARM.ch06.html">6. <acronym class="acronym">BIND</acronym> 9 Configuration Reference</a></span></dt> @@ -126,83 +127,83 @@ <dt><span class="sect1"><a href="Bv9ARM.ch06.html#configuration_file_elements">Configuration File Elements</a></span></dt> <dd><dl> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#address_match_lists">Address Match Lists</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573470">Comment Syntax</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573479">Comment Syntax</a></span></dt> </dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch06.html#Configuration_File_Grammar">Configuration File Grammar</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574151"><span><strong class="command">acl</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574091"><span><strong class="command">acl</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#acl"><span><strong class="command">acl</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574341"><span><strong class="command">controls</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574281"><span><strong class="command">controls</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage"><span><strong class="command">controls</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574770"><span><strong class="command">include</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574785"><span><strong class="command">include</strong></span> Statement Definition and +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574710"><span><strong class="command">include</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574725"><span><strong class="command">include</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574808"><span><strong class="command">key</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574829"><span><strong class="command">key</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574920"><span><strong class="command">logging</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575046"><span><strong class="command">logging</strong></span> Statement Definition and +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574748"><span><strong class="command">key</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574770"><span><strong class="command">key</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574929"><span><strong class="command">logging</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575054"><span><strong class="command">logging</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576396"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576470"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576534"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576578"><span><strong class="command">masters</strong></span> Statement Definition and +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576405"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576478"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576542"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576586"><span><strong class="command">masters</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576593"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576601"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#options"><span><strong class="command">options</strong></span> Statement Definition and Usage</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_grammar"><span><strong class="command">server</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_definition_and_usage"><span><strong class="command">server</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585018"><span><strong class="command">trusted-keys</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585136"><span><strong class="command">trusted-keys</strong></span> Statement Definition +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585275"><span><strong class="command">trusted-keys</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585324"><span><strong class="command">trusted-keys</strong></span> Statement Definition and Usage</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#view_statement_grammar"><span><strong class="command">view</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585216"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585404"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#zone_statement_grammar"><span><strong class="command">zone</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2586586"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2586713"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt> </dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2588846">Zone File</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2588995">Zone File</a></span></dt> <dd><dl> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#types_of_resource_records_and_when_to_use_them">Types of Resource Records and When to Use Them</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2590800">Discussion of MX Records</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591016">Discussion of MX Records</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#Setting_TTLs">Setting TTLs</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591419">Inverse Mapping in IPv4</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591546">Other Zone File Directives</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591803"><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591568">Inverse Mapping in IPv4</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591694">Other Zone File Directives</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2592088"><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#zonefile_format">Additional File Formats</a></span></dt> </dl></dd> </dl></dd> <dt><span class="chapter"><a href="Bv9ARM.ch07.html">7. <acronym class="acronym">BIND</acronym> 9 Security Considerations</a></span></dt> <dd><dl> <dt><span class="sect1"><a href="Bv9ARM.ch07.html#Access_Control_Lists">Access Control Lists</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch07.html#id2592480"><span><strong class="command">chroot</strong></span> and <span><strong class="command">setuid</strong></span></a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch07.html#id2592629"><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span></a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2592625">The <span><strong class="command">chroot</strong></span> Environment</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2592684">Using the <span><strong class="command">setuid</strong></span> Function</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2592774">The <span><strong class="command">chroot</strong></span> Environment</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2592834">Using the <span><strong class="command">setuid</strong></span> Function</a></span></dt> </dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch07.html#dynamic_update_security">Dynamic Update Security</a></span></dt> </dl></dd> <dt><span class="chapter"><a href="Bv9ARM.ch08.html">8. Troubleshooting</a></span></dt> <dd><dl> -<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2592764">Common Problems</a></span></dt> -<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch08.html#id2592838">It's not working; how can I figure out what's wrong?</a></span></dt></dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2592850">Incrementing and Changing the Serial Number</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2592867">Where Can I Get Help?</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2593118">Common Problems</a></span></dt> +<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch08.html#id2593124">It's not working; how can I figure out what's wrong?</a></span></dt></dl></dd> +<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2593136">Incrementing and Changing the Serial Number</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2593153">Where Can I Get Help?</a></span></dt> </dl></dd> <dt><span class="appendix"><a href="Bv9ARM.ch09.html">A. Appendices</a></span></dt> <dd><dl> -<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2592997">Acknowledgments</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2593283">Acknowledgments</a></span></dt> <dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch09.html#historical_dns_information">A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym></a></span></dt></dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2593159">General <acronym class="acronym">DNS</acronym> Reference Information</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2593454">General <acronym class="acronym">DNS</acronym> Reference Information</a></span></dt> <dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch09.html#ipv6addresses">IPv6 addresses (AAAA)</a></span></dt></dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch09.html#bibliography">Bibliography (and Suggested Reading)</a></span></dt> <dd><dl> <dt><span class="sect2"><a href="Bv9ARM.ch09.html#rfcs">Request for Comments (RFCs)</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch09.html#internet_drafts">Internet Drafts</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2596326">Other Documents About <acronym class="acronym">BIND</acronym></a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2596690">Other Documents About <acronym class="acronym">BIND</acronym></a></span></dt> </dl></dd> </dl></dd> <dt><span class="reference"><a href="Bv9ARM.ch10.html">I. Manual pages</a></span></dt> diff --git a/doc/arm/Bv9ARM.pdf b/doc/arm/Bv9ARM.pdf index ea25edd9..043bdd94 100755 --- a/doc/arm/Bv9ARM.pdf +++ b/doc/arm/Bv9ARM.pdf @@ -222,782 +222,788 @@ endobj (4.4 Split DNS) endobj 153 0 obj -<< /S /GoTo /D (section.4.5) >> +<< /S /GoTo /D (subsection.4.4.1) >> endobj 156 0 obj -(4.5 TSIG) +(4.4.1 Example split DNS setup) endobj 157 0 obj -<< /S /GoTo /D (subsection.4.5.1) >> +<< /S /GoTo /D (section.4.5) >> endobj 160 0 obj -(4.5.1 Generate Shared Keys for Each Pair of Hosts) +(4.5 TSIG) endobj 161 0 obj -<< /S /GoTo /D (subsubsection.4.5.1.1) >> +<< /S /GoTo /D (subsection.4.5.1) >> endobj 164 0 obj -(4.5.1.1 Automatic Generation) +(4.5.1 Generate Shared Keys for Each Pair of Hosts) endobj 165 0 obj -<< /S /GoTo /D (subsubsection.4.5.1.2) >> +<< /S /GoTo /D (subsubsection.4.5.1.1) >> endobj 168 0 obj -(4.5.1.2 Manual Generation) +(4.5.1.1 Automatic Generation) endobj 169 0 obj -<< /S /GoTo /D (subsection.4.5.2) >> +<< /S /GoTo /D (subsubsection.4.5.1.2) >> endobj 172 0 obj -(4.5.2 Copying the Shared Secret to Both Machines) +(4.5.1.2 Manual Generation) endobj 173 0 obj -<< /S /GoTo /D (subsection.4.5.3) >> +<< /S /GoTo /D (subsection.4.5.2) >> endobj 176 0 obj -(4.5.3 Informing the Servers of the Key's Existence) +(4.5.2 Copying the Shared Secret to Both Machines) endobj 177 0 obj -<< /S /GoTo /D (subsection.4.5.4) >> +<< /S /GoTo /D (subsection.4.5.3) >> endobj 180 0 obj -(4.5.4 Instructing the Server to Use the Key) +(4.5.3 Informing the Servers of the Key's Existence) endobj 181 0 obj -<< /S /GoTo /D (subsection.4.5.5) >> +<< /S /GoTo /D (subsection.4.5.4) >> endobj 184 0 obj -(4.5.5 TSIG Key Based Access Control) +(4.5.4 Instructing the Server to Use the Key) endobj 185 0 obj -<< /S /GoTo /D (subsection.4.5.6) >> +<< /S /GoTo /D (subsection.4.5.5) >> endobj 188 0 obj -(4.5.6 Errors) +(4.5.5 TSIG Key Based Access Control) endobj 189 0 obj -<< /S /GoTo /D (section.4.6) >> +<< /S /GoTo /D (subsection.4.5.6) >> endobj 192 0 obj -(4.6 TKEY) +(4.5.6 Errors) endobj 193 0 obj -<< /S /GoTo /D (section.4.7) >> +<< /S /GoTo /D (section.4.6) >> endobj 196 0 obj -(4.7 SIG\(0\)) +(4.6 TKEY) endobj 197 0 obj -<< /S /GoTo /D (section.4.8) >> +<< /S /GoTo /D (section.4.7) >> endobj 200 0 obj -(4.8 DNSSEC) +(4.7 SIG\(0\)) endobj 201 0 obj -<< /S /GoTo /D (subsection.4.8.1) >> +<< /S /GoTo /D (section.4.8) >> endobj 204 0 obj -(4.8.1 Generating Keys) +(4.8 DNSSEC) endobj 205 0 obj -<< /S /GoTo /D (subsection.4.8.2) >> +<< /S /GoTo /D (subsection.4.8.1) >> endobj 208 0 obj -(4.8.2 Signing the Zone) +(4.8.1 Generating Keys) endobj 209 0 obj -<< /S /GoTo /D (subsection.4.8.3) >> +<< /S /GoTo /D (subsection.4.8.2) >> endobj 212 0 obj -(4.8.3 Configuring Servers) +(4.8.2 Signing the Zone) endobj 213 0 obj -<< /S /GoTo /D (section.4.9) >> +<< /S /GoTo /D (subsection.4.8.3) >> endobj 216 0 obj -(4.9 IPv6 Support in BIND 9) +(4.8.3 Configuring Servers) endobj 217 0 obj -<< /S /GoTo /D (subsection.4.9.1) >> +<< /S /GoTo /D (section.4.9) >> endobj 220 0 obj -(4.9.1 Address Lookups Using AAAA Records) +(4.9 IPv6 Support in BIND 9) endobj 221 0 obj -<< /S /GoTo /D (subsection.4.9.2) >> +<< /S /GoTo /D (subsection.4.9.1) >> endobj 224 0 obj -(4.9.2 Address to Name Lookups Using Nibble Format) +(4.9.1 Address Lookups Using AAAA Records) endobj 225 0 obj -<< /S /GoTo /D (chapter.5) >> +<< /S /GoTo /D (subsection.4.9.2) >> endobj 228 0 obj -(5 The BIND 9 Lightweight Resolver) +(4.9.2 Address to Name Lookups Using Nibble Format) endobj 229 0 obj -<< /S /GoTo /D (section.5.1) >> +<< /S /GoTo /D (chapter.5) >> endobj 232 0 obj -(5.1 The Lightweight Resolver Library) +(5 The BIND 9 Lightweight Resolver) endobj 233 0 obj -<< /S /GoTo /D (section.5.2) >> +<< /S /GoTo /D (section.5.1) >> endobj 236 0 obj -(5.2 Running a Resolver Daemon) +(5.1 The Lightweight Resolver Library) endobj 237 0 obj -<< /S /GoTo /D (chapter.6) >> +<< /S /GoTo /D (section.5.2) >> endobj 240 0 obj -(6 BIND 9 Configuration Reference) +(5.2 Running a Resolver Daemon) endobj 241 0 obj -<< /S /GoTo /D (section.6.1) >> +<< /S /GoTo /D (chapter.6) >> endobj 244 0 obj -(6.1 Configuration File Elements) +(6 BIND 9 Configuration Reference) endobj 245 0 obj -<< /S /GoTo /D (subsection.6.1.1) >> +<< /S /GoTo /D (section.6.1) >> endobj 248 0 obj -(6.1.1 Address Match Lists) +(6.1 Configuration File Elements) endobj 249 0 obj -<< /S /GoTo /D (subsubsection.6.1.1.1) >> +<< /S /GoTo /D (subsection.6.1.1) >> endobj 252 0 obj -(6.1.1.1 Syntax) +(6.1.1 Address Match Lists) endobj 253 0 obj -<< /S /GoTo /D (subsubsection.6.1.1.2) >> +<< /S /GoTo /D (subsubsection.6.1.1.1) >> endobj 256 0 obj -(6.1.1.2 Definition and Usage) +(6.1.1.1 Syntax) endobj 257 0 obj -<< /S /GoTo /D (subsection.6.1.2) >> +<< /S /GoTo /D (subsubsection.6.1.1.2) >> endobj 260 0 obj -(6.1.2 Comment Syntax) +(6.1.1.2 Definition and Usage) endobj 261 0 obj -<< /S /GoTo /D (subsubsection.6.1.2.1) >> +<< /S /GoTo /D (subsection.6.1.2) >> endobj 264 0 obj -(6.1.2.1 Syntax) +(6.1.2 Comment Syntax) endobj 265 0 obj -<< /S /GoTo /D (subsubsection.6.1.2.2) >> +<< /S /GoTo /D (subsubsection.6.1.2.1) >> endobj 268 0 obj -(6.1.2.2 Definition and Usage) +(6.1.2.1 Syntax) endobj 269 0 obj -<< /S /GoTo /D (section.6.2) >> +<< /S /GoTo /D (subsubsection.6.1.2.2) >> endobj 272 0 obj -(6.2 Configuration File Grammar) +(6.1.2.2 Definition and Usage) endobj 273 0 obj -<< /S /GoTo /D (subsection.6.2.1) >> +<< /S /GoTo /D (section.6.2) >> endobj 276 0 obj -(6.2.1 acl Statement Grammar) +(6.2 Configuration File Grammar) endobj 277 0 obj -<< /S /GoTo /D (subsection.6.2.2) >> +<< /S /GoTo /D (subsection.6.2.1) >> endobj 280 0 obj -(6.2.2 acl Statement Definition and Usage) +(6.2.1 acl Statement Grammar) endobj 281 0 obj -<< /S /GoTo /D (subsection.6.2.3) >> +<< /S /GoTo /D (subsection.6.2.2) >> endobj 284 0 obj -(6.2.3 controls Statement Grammar) +(6.2.2 acl Statement Definition and Usage) endobj 285 0 obj -<< /S /GoTo /D (subsection.6.2.4) >> +<< /S /GoTo /D (subsection.6.2.3) >> endobj 288 0 obj -(6.2.4 controls Statement Definition and Usage) +(6.2.3 controls Statement Grammar) endobj 289 0 obj -<< /S /GoTo /D (subsection.6.2.5) >> +<< /S /GoTo /D (subsection.6.2.4) >> endobj 292 0 obj -(6.2.5 include Statement Grammar) +(6.2.4 controls Statement Definition and Usage) endobj 293 0 obj -<< /S /GoTo /D (subsection.6.2.6) >> +<< /S /GoTo /D (subsection.6.2.5) >> endobj 296 0 obj -(6.2.6 include Statement Definition and Usage) +(6.2.5 include Statement Grammar) endobj 297 0 obj -<< /S /GoTo /D (subsection.6.2.7) >> +<< /S /GoTo /D (subsection.6.2.6) >> endobj 300 0 obj -(6.2.7 key Statement Grammar) +(6.2.6 include Statement Definition and Usage) endobj 301 0 obj -<< /S /GoTo /D (subsection.6.2.8) >> +<< /S /GoTo /D (subsection.6.2.7) >> endobj 304 0 obj -(6.2.8 key Statement Definition and Usage) +(6.2.7 key Statement Grammar) endobj 305 0 obj -<< /S /GoTo /D (subsection.6.2.9) >> +<< /S /GoTo /D (subsection.6.2.8) >> endobj 308 0 obj -(6.2.9 logging Statement Grammar) +(6.2.8 key Statement Definition and Usage) endobj 309 0 obj -<< /S /GoTo /D (subsection.6.2.10) >> +<< /S /GoTo /D (subsection.6.2.9) >> endobj 312 0 obj -(6.2.10 logging Statement Definition and Usage) +(6.2.9 logging Statement Grammar) endobj 313 0 obj -<< /S /GoTo /D (subsubsection.6.2.10.1) >> +<< /S /GoTo /D (subsection.6.2.10) >> endobj 316 0 obj -(6.2.10.1 The channel Phrase) +(6.2.10 logging Statement Definition and Usage) endobj 317 0 obj -<< /S /GoTo /D (subsubsection.6.2.10.2) >> +<< /S /GoTo /D (subsubsection.6.2.10.1) >> endobj 320 0 obj -(6.2.10.2 The category Phrase) +(6.2.10.1 The channel Phrase) endobj 321 0 obj -<< /S /GoTo /D (subsection.6.2.11) >> +<< /S /GoTo /D (subsubsection.6.2.10.2) >> endobj 324 0 obj -(6.2.11 lwres Statement Grammar) +(6.2.10.2 The category Phrase) endobj 325 0 obj -<< /S /GoTo /D (subsection.6.2.12) >> +<< /S /GoTo /D (subsection.6.2.11) >> endobj 328 0 obj -(6.2.12 lwres Statement Definition and Usage) +(6.2.11 lwres Statement Grammar) endobj 329 0 obj -<< /S /GoTo /D (subsection.6.2.13) >> +<< /S /GoTo /D (subsection.6.2.12) >> endobj 332 0 obj -(6.2.13 masters Statement Grammar) +(6.2.12 lwres Statement Definition and Usage) endobj 333 0 obj -<< /S /GoTo /D (subsection.6.2.14) >> +<< /S /GoTo /D (subsection.6.2.13) >> endobj 336 0 obj -(6.2.14 masters Statement Definition and Usage) +(6.2.13 masters Statement Grammar) endobj 337 0 obj -<< /S /GoTo /D (subsection.6.2.15) >> +<< /S /GoTo /D (subsection.6.2.14) >> endobj 340 0 obj -(6.2.15 options Statement Grammar) +(6.2.14 masters Statement Definition and Usage) endobj 341 0 obj -<< /S /GoTo /D (subsection.6.2.16) >> +<< /S /GoTo /D (subsection.6.2.15) >> endobj 344 0 obj -(6.2.16 options Statement Definition and Usage) +(6.2.15 options Statement Grammar) endobj 345 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.1) >> +<< /S /GoTo /D (subsection.6.2.16) >> endobj 348 0 obj -(6.2.16.1 Boolean Options) +(6.2.16 options Statement Definition and Usage) endobj 349 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.2) >> +<< /S /GoTo /D (subsubsection.6.2.16.1) >> endobj 352 0 obj -(6.2.16.2 Forwarding) +(6.2.16.1 Boolean Options) endobj 353 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.3) >> +<< /S /GoTo /D (subsubsection.6.2.16.2) >> endobj 356 0 obj -(6.2.16.3 Dual-stack Servers) +(6.2.16.2 Forwarding) endobj 357 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.4) >> +<< /S /GoTo /D (subsubsection.6.2.16.3) >> endobj 360 0 obj -(6.2.16.4 Access Control) +(6.2.16.3 Dual-stack Servers) endobj 361 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.5) >> +<< /S /GoTo /D (subsubsection.6.2.16.4) >> endobj 364 0 obj -(6.2.16.5 Interfaces) +(6.2.16.4 Access Control) endobj 365 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.6) >> +<< /S /GoTo /D (subsubsection.6.2.16.5) >> endobj 368 0 obj -(6.2.16.6 Query Address) +(6.2.16.5 Interfaces) endobj 369 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.7) >> +<< /S /GoTo /D (subsubsection.6.2.16.6) >> endobj 372 0 obj -(6.2.16.7 Zone Transfers) +(6.2.16.6 Query Address) endobj 373 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.8) >> +<< /S /GoTo /D (subsubsection.6.2.16.7) >> endobj 376 0 obj -(6.2.16.8 Bad UDP Port Lists) +(6.2.16.7 Zone Transfers) endobj 377 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.9) >> +<< /S /GoTo /D (subsubsection.6.2.16.8) >> endobj 380 0 obj -(6.2.16.9 Operating System Resource Limits) +(6.2.16.8 Bad UDP Port Lists) endobj 381 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.10) >> +<< /S /GoTo /D (subsubsection.6.2.16.9) >> endobj 384 0 obj -(6.2.16.10 Server Resource Limits) +(6.2.16.9 Operating System Resource Limits) endobj 385 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.11) >> +<< /S /GoTo /D (subsubsection.6.2.16.10) >> endobj 388 0 obj -(6.2.16.11 Periodic Task Intervals) +(6.2.16.10 Server Resource Limits) endobj 389 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.12) >> +<< /S /GoTo /D (subsubsection.6.2.16.11) >> endobj 392 0 obj -(6.2.16.12 Topology) +(6.2.16.11 Periodic Task Intervals) endobj 393 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.13) >> +<< /S /GoTo /D (subsubsection.6.2.16.12) >> endobj 396 0 obj -(6.2.16.13 The sortlist Statement) +(6.2.16.12 Topology) endobj 397 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.14) >> +<< /S /GoTo /D (subsubsection.6.2.16.13) >> endobj 400 0 obj -(6.2.16.14 RRset Ordering) +(6.2.16.13 The sortlist Statement) endobj 401 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.15) >> +<< /S /GoTo /D (subsubsection.6.2.16.14) >> endobj 404 0 obj -(6.2.16.15 Tuning) +(6.2.16.14 RRset Ordering) endobj 405 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.16) >> +<< /S /GoTo /D (subsubsection.6.2.16.15) >> endobj 408 0 obj -(6.2.16.16 Built-in server information zones) +(6.2.16.15 Tuning) endobj 409 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.17) >> +<< /S /GoTo /D (subsubsection.6.2.16.16) >> endobj 412 0 obj -(6.2.16.17 Built-in Empty Zones) +(6.2.16.16 Built-in server information zones) endobj 413 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.18) >> +<< /S /GoTo /D (subsubsection.6.2.16.17) >> endobj 416 0 obj -(6.2.16.18 The Statistics File) +(6.2.16.17 Built-in Empty Zones) endobj 417 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.19) >> +<< /S /GoTo /D (subsubsection.6.2.16.18) >> endobj 420 0 obj -(6.2.16.19 Additional Section Caching) +(6.2.16.18 The Statistics File) endobj 421 0 obj -<< /S /GoTo /D (subsection.6.2.17) >> +<< /S /GoTo /D (subsubsection.6.2.16.19) >> endobj 424 0 obj -(6.2.17 server Statement Grammar) +(6.2.16.19 Additional Section Caching) endobj 425 0 obj -<< /S /GoTo /D (subsection.6.2.18) >> +<< /S /GoTo /D (subsection.6.2.17) >> endobj 428 0 obj -(6.2.18 server Statement Definition and Usage) +(6.2.17 server Statement Grammar) endobj 429 0 obj -<< /S /GoTo /D (subsection.6.2.19) >> +<< /S /GoTo /D (subsection.6.2.18) >> endobj 432 0 obj -(6.2.19 trusted-keys Statement Grammar) +(6.2.18 server Statement Definition and Usage) endobj 433 0 obj -<< /S /GoTo /D (subsection.6.2.20) >> +<< /S /GoTo /D (subsection.6.2.19) >> endobj 436 0 obj -(6.2.20 trusted-keys Statement Definition and Usage) +(6.2.19 trusted-keys Statement Grammar) endobj 437 0 obj -<< /S /GoTo /D (subsection.6.2.21) >> +<< /S /GoTo /D (subsection.6.2.20) >> endobj 440 0 obj -(6.2.21 view Statement Grammar) +(6.2.20 trusted-keys Statement Definition and Usage) endobj 441 0 obj -<< /S /GoTo /D (subsection.6.2.22) >> +<< /S /GoTo /D (subsection.6.2.21) >> endobj 444 0 obj -(6.2.22 view Statement Definition and Usage) +(6.2.21 view Statement Grammar) endobj 445 0 obj -<< /S /GoTo /D (subsection.6.2.23) >> +<< /S /GoTo /D (subsection.6.2.22) >> endobj 448 0 obj -(6.2.23 zone Statement Grammar) +(6.2.22 view Statement Definition and Usage) endobj 449 0 obj -<< /S /GoTo /D (subsection.6.2.24) >> +<< /S /GoTo /D (subsection.6.2.23) >> endobj 452 0 obj -(6.2.24 zone Statement Definition and Usage) +(6.2.23 zone Statement Grammar) endobj 453 0 obj -<< /S /GoTo /D (subsubsection.6.2.24.1) >> +<< /S /GoTo /D (subsection.6.2.24) >> endobj 456 0 obj -(6.2.24.1 Zone Types) +(6.2.24 zone Statement Definition and Usage) endobj 457 0 obj -<< /S /GoTo /D (subsubsection.6.2.24.2) >> +<< /S /GoTo /D (subsubsection.6.2.24.1) >> endobj 460 0 obj -(6.2.24.2 Class) +(6.2.24.1 Zone Types) endobj 461 0 obj -<< /S /GoTo /D (subsubsection.6.2.24.3) >> +<< /S /GoTo /D (subsubsection.6.2.24.2) >> endobj 464 0 obj -(6.2.24.3 Zone Options) +(6.2.24.2 Class) endobj 465 0 obj -<< /S /GoTo /D (subsubsection.6.2.24.4) >> +<< /S /GoTo /D (subsubsection.6.2.24.3) >> endobj 468 0 obj -(6.2.24.4 Dynamic Update Policies) +(6.2.24.3 Zone Options) endobj 469 0 obj -<< /S /GoTo /D (section.6.3) >> +<< /S /GoTo /D (subsubsection.6.2.24.4) >> endobj 472 0 obj -(6.3 Zone File) +(6.2.24.4 Dynamic Update Policies) endobj 473 0 obj -<< /S /GoTo /D (subsection.6.3.1) >> +<< /S /GoTo /D (section.6.3) >> endobj 476 0 obj -(6.3.1 Types of Resource Records and When to Use Them) +(6.3 Zone File) endobj 477 0 obj -<< /S /GoTo /D (subsubsection.6.3.1.1) >> +<< /S /GoTo /D (subsection.6.3.1) >> endobj 480 0 obj -(6.3.1.1 Resource Records) +(6.3.1 Types of Resource Records and When to Use Them) endobj 481 0 obj -<< /S /GoTo /D (subsubsection.6.3.1.2) >> +<< /S /GoTo /D (subsubsection.6.3.1.1) >> endobj 484 0 obj -(6.3.1.2 Textual expression of RRs) +(6.3.1.1 Resource Records) endobj 485 0 obj -<< /S /GoTo /D (subsection.6.3.2) >> +<< /S /GoTo /D (subsubsection.6.3.1.2) >> endobj 488 0 obj -(6.3.2 Discussion of MX Records) +(6.3.1.2 Textual expression of RRs) endobj 489 0 obj -<< /S /GoTo /D (subsection.6.3.3) >> +<< /S /GoTo /D (subsection.6.3.2) >> endobj 492 0 obj -(6.3.3 Setting TTLs) +(6.3.2 Discussion of MX Records) endobj 493 0 obj -<< /S /GoTo /D (subsection.6.3.4) >> +<< /S /GoTo /D (subsection.6.3.3) >> endobj 496 0 obj -(6.3.4 Inverse Mapping in IPv4) +(6.3.3 Setting TTLs) endobj 497 0 obj -<< /S /GoTo /D (subsection.6.3.5) >> +<< /S /GoTo /D (subsection.6.3.4) >> endobj 500 0 obj -(6.3.5 Other Zone File Directives) +(6.3.4 Inverse Mapping in IPv4) endobj 501 0 obj -<< /S /GoTo /D (subsubsection.6.3.5.1) >> +<< /S /GoTo /D (subsection.6.3.5) >> endobj 504 0 obj -(6.3.5.1 The \044ORIGIN Directive) +(6.3.5 Other Zone File Directives) endobj 505 0 obj -<< /S /GoTo /D (subsubsection.6.3.5.2) >> +<< /S /GoTo /D (subsubsection.6.3.5.1) >> endobj 508 0 obj -(6.3.5.2 The \044INCLUDE Directive) +(6.3.5.1 The \044ORIGIN Directive) endobj 509 0 obj -<< /S /GoTo /D (subsubsection.6.3.5.3) >> +<< /S /GoTo /D (subsubsection.6.3.5.2) >> endobj 512 0 obj -(6.3.5.3 The \044TTL Directive) +(6.3.5.2 The \044INCLUDE Directive) endobj 513 0 obj -<< /S /GoTo /D (subsection.6.3.6) >> +<< /S /GoTo /D (subsubsection.6.3.5.3) >> endobj 516 0 obj -(6.3.6 BIND Master File Extension: the \044GENERATE Directive) +(6.3.5.3 The \044TTL Directive) endobj 517 0 obj -<< /S /GoTo /D (subsection.6.3.7) >> +<< /S /GoTo /D (subsection.6.3.6) >> endobj 520 0 obj -(6.3.7 Additional File Formats) +(6.3.6 BIND Master File Extension: the \044GENERATE Directive) endobj 521 0 obj -<< /S /GoTo /D (chapter.7) >> +<< /S /GoTo /D (subsection.6.3.7) >> endobj 524 0 obj -(7 BIND 9 Security Considerations) +(6.3.7 Additional File Formats) endobj 525 0 obj -<< /S /GoTo /D (section.7.1) >> +<< /S /GoTo /D (chapter.7) >> endobj 528 0 obj -(7.1 Access Control Lists) +(7 BIND 9 Security Considerations) endobj 529 0 obj -<< /S /GoTo /D (section.7.2) >> +<< /S /GoTo /D (section.7.1) >> endobj 532 0 obj -(7.2 chroot and setuid) +(7.1 Access Control Lists) endobj 533 0 obj -<< /S /GoTo /D (subsection.7.2.1) >> +<< /S /GoTo /D (section.7.2) >> endobj 536 0 obj -(7.2.1 The chroot Environment) +(7.2 Chroot and Setuid) endobj 537 0 obj -<< /S /GoTo /D (subsection.7.2.2) >> +<< /S /GoTo /D (subsection.7.2.1) >> endobj 540 0 obj -(7.2.2 Using the setuid Function) +(7.2.1 The chroot Environment) endobj 541 0 obj -<< /S /GoTo /D (section.7.3) >> +<< /S /GoTo /D (subsection.7.2.2) >> endobj 544 0 obj -(7.3 Dynamic Update Security) +(7.2.2 Using the setuid Function) endobj 545 0 obj -<< /S /GoTo /D (chapter.8) >> +<< /S /GoTo /D (section.7.3) >> endobj 548 0 obj -(8 Troubleshooting) +(7.3 Dynamic Update Security) endobj 549 0 obj -<< /S /GoTo /D (section.8.1) >> +<< /S /GoTo /D (chapter.8) >> endobj 552 0 obj -(8.1 Common Problems) +(8 Troubleshooting) endobj 553 0 obj -<< /S /GoTo /D (subsection.8.1.1) >> +<< /S /GoTo /D (section.8.1) >> endobj 556 0 obj -(8.1.1 It's not working; how can I figure out what's wrong?) +(8.1 Common Problems) endobj 557 0 obj -<< /S /GoTo /D (section.8.2) >> +<< /S /GoTo /D (subsection.8.1.1) >> endobj 560 0 obj -(8.2 Incrementing and Changing the Serial Number) +(8.1.1 It's not working; how can I figure out what's wrong?) endobj 561 0 obj -<< /S /GoTo /D (section.8.3) >> +<< /S /GoTo /D (section.8.2) >> endobj 564 0 obj -(8.3 Where Can I Get Help?) +(8.2 Incrementing and Changing the Serial Number) endobj 565 0 obj -<< /S /GoTo /D (appendix.A) >> +<< /S /GoTo /D (section.8.3) >> endobj 568 0 obj -(A Appendices) +(8.3 Where Can I Get Help?) endobj 569 0 obj -<< /S /GoTo /D (section.A.1) >> +<< /S /GoTo /D (appendix.A) >> endobj 572 0 obj -(A.1 Acknowledgments) +(A Appendices) endobj 573 0 obj -<< /S /GoTo /D (subsection.A.1.1) >> +<< /S /GoTo /D (section.A.1) >> endobj 576 0 obj -(A.1.1 A Brief History of the DNS and BIND) +(A.1 Acknowledgments) endobj 577 0 obj -<< /S /GoTo /D (section.A.2) >> +<< /S /GoTo /D (subsection.A.1.1) >> endobj 580 0 obj -(A.2 General DNS Reference Information) +(A.1.1 A Brief History of the DNS and BIND) endobj 581 0 obj -<< /S /GoTo /D (subsection.A.2.1) >> +<< /S /GoTo /D (section.A.2) >> endobj 584 0 obj -(A.2.1 IPv6 addresses \(AAAA\)) +(A.2 General DNS Reference Information) endobj 585 0 obj -<< /S /GoTo /D (section.A.3) >> +<< /S /GoTo /D (subsection.A.2.1) >> endobj 588 0 obj -(A.3 Bibliography \(and Suggested Reading\)) +(A.2.1 IPv6 addresses \(AAAA\)) endobj 589 0 obj -<< /S /GoTo /D (subsection.A.3.1) >> +<< /S /GoTo /D (section.A.3) >> endobj 592 0 obj -(A.3.1 Request for Comments \(RFCs\)) +(A.3 Bibliography \(and Suggested Reading\)) endobj 593 0 obj -<< /S /GoTo /D (subsection.A.3.2) >> +<< /S /GoTo /D (subsection.A.3.1) >> endobj 596 0 obj -(A.3.2 Internet Drafts) +(A.3.1 Request for Comments \(RFCs\)) endobj 597 0 obj -<< /S /GoTo /D (subsection.A.3.3) >> +<< /S /GoTo /D (subsection.A.3.2) >> endobj 600 0 obj -(A.3.3 Other Documents About BIND) +(A.3.2 Internet Drafts) endobj 601 0 obj -<< /S /GoTo /D (appendix.B) >> +<< /S /GoTo /D (subsection.A.3.3) >> endobj 604 0 obj -(B Manual pages) +(A.3.3 Other Documents About BIND) endobj 605 0 obj -<< /S /GoTo /D (section.B.1) >> +<< /S /GoTo /D (appendix.B) >> endobj 608 0 obj -(B.1 dig) +(B Manual pages) endobj 609 0 obj -<< /S /GoTo /D (section.B.2) >> +<< /S /GoTo /D (section.B.1) >> endobj 612 0 obj -(B.2 host) +(B.1 dig) endobj 613 0 obj -<< /S /GoTo /D (section.B.3) >> +<< /S /GoTo /D (section.B.2) >> endobj 616 0 obj -(B.3 dnssec-keygen) +(B.2 host) endobj 617 0 obj -<< /S /GoTo /D (section.B.4) >> +<< /S /GoTo /D (section.B.3) >> endobj 620 0 obj -(B.4 dnssec-signzone) +(B.3 dnssec-keygen) endobj 621 0 obj -<< /S /GoTo /D (section.B.5) >> +<< /S /GoTo /D (section.B.4) >> endobj 624 0 obj -(B.5 named-checkconf) +(B.4 dnssec-signzone) endobj 625 0 obj -<< /S /GoTo /D (section.B.6) >> +<< /S /GoTo /D (section.B.5) >> endobj 628 0 obj -(B.6 named-checkzone) +(B.5 named-checkconf) endobj 629 0 obj -<< /S /GoTo /D (section.B.7) >> +<< /S /GoTo /D (section.B.6) >> endobj 632 0 obj -(B.7 named) +(B.6 named-checkzone) endobj 633 0 obj -<< /S /GoTo /D (section.B.8) >> +<< /S /GoTo /D (section.B.7) >> endobj 636 0 obj -(B.8 rndc) +(B.7 named) endobj 637 0 obj -<< /S /GoTo /D (section.B.9) >> +<< /S /GoTo /D (section.B.8) >> endobj 640 0 obj -(B.9 rndc.conf) +(B.8 rndc) endobj 641 0 obj -<< /S /GoTo /D (section.B.10) >> +<< /S /GoTo /D (section.B.9) >> endobj 644 0 obj -(B.10 rndc-confgen) +(B.9 rndc.conf) endobj 645 0 obj -<< /S /GoTo /D [646 0 R /FitH ] >> +<< /S /GoTo /D (section.B.10) >> +endobj +648 0 obj +(B.10 rndc-confgen) endobj -649 0 obj << +649 0 obj +<< /S /GoTo /D [650 0 R /FitH ] >> +endobj +653 0 obj << /Length 236 /Filter /FlateDecode >> stream xÚÁJA†ïó9¶‡M'™d2s´T¥‚Beoâai·Rp·tïïÔÕ*êArÉÿ‘ü /A}ȖՓºsžŠvíèƒ
¨B)þP+!ÃlQ¡bJÕÂwìNì1úÈP©)&>áóÚÍ®˜€-A½bEM¦pæêÍÃd¾¼[L+V?ÉcºØt»~÷ršã~[÷í¶Ú~ÝNë a¤(±ø˘’å÷9·MÿÚ<Ÿ endobj -646 0 obj << +650 0 obj << /Type /Page -/Contents 649 0 R -/Resources 648 0 R +/Contents 653 0 R +/Resources 652 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 655 0 R +/Parent 659 0 R >> endobj -647 0 obj << +651 0 obj << /Type /XObject /Subtype /Form /FormType 1 /PTEX.FileName (./isc-logo.pdf) /PTEX.PageNumber 1 -/PTEX.InfoDict 656 0 R +/PTEX.InfoDict 660 0 R /Matrix [1.00000000 0.00000000 0.00000000 1.00000000 0.00000000 0.00000000] /BBox [0.00000000 0.00000000 255.00000000 149.00000000] /Resources << /ProcSet [ /PDF /Text ] /ColorSpace << -/R15 657 0 R -/R9 658 0 R -/R11 659 0 R -/R13 660 0 R +/R15 661 0 R +/R9 662 0 R +/R11 663 0 R +/R13 664 0 R >>/ExtGState << -/R17 661 0 R -/R8 662 0 R ->>/Font << /R19 663 0 R >> +/R17 665 0 R +/R8 666 0 R +>>/Font << /R19 667 0 R >> >> -/Length 664 0 R +/Length 668 0 R /Filter /FlateDecode >> stream @@ -1013,7 +1019,7 @@ xœu˜;“d9…ýû+®Ùe´R©—lG`XËkz#†10gwÙ~6ßÉ[53}+ˆ}tI%åóäÉT½ßs*{Ö?·¿××í'¿ûŸ? FÑÞIcaÇ0Ú) ¹A¿+ÇÀº
¸|-Tuùa>‚s:½¯•~K“ÒÞV׋„OÒAŠI…
ɪÁr2Q“°Ø¨Á>.z ÏÆ狼eÇNdæÌdï"gK2cëÉ—GoOá8GëÏϦ:B
Àht[ endobj -656 0 obj +660 0 obj << /Producer (AFPL Ghostscript 8.51) /CreationDate (D:20050606145621) @@ -1023,46 +1029,46 @@ endobj /Author (Douglas E. Appelt) >> endobj -657 0 obj -[/Separation/PANTONE#201805#20C/DeviceCMYK 665 0 R] +661 0 obj +[/Separation/PANTONE#201805#20C/DeviceCMYK 669 0 R] endobj -658 0 obj -[/Separation/PANTONE#207506#20C/DeviceCMYK 666 0 R] +662 0 obj +[/Separation/PANTONE#207506#20C/DeviceCMYK 670 0 R] endobj -659 0 obj -[/Separation/PANTONE#20301#20C/DeviceCMYK 667 0 R] +663 0 obj +[/Separation/PANTONE#20301#20C/DeviceCMYK 671 0 R] endobj -660 0 obj -[/Separation/PANTONE#20871#20C/DeviceCMYK 668 0 R] +664 0 obj +[/Separation/PANTONE#20871#20C/DeviceCMYK 672 0 R] endobj -661 0 obj +665 0 obj << /Type /ExtGState /SA true >> endobj -662 0 obj +666 0 obj << /Type /ExtGState /OPM 1 >> endobj -663 0 obj +667 0 obj << /BaseFont /NVXWCK#2BTrajanPro-Bold -/FontDescriptor 669 0 R +/FontDescriptor 673 0 R /Type /Font /FirstChar 67 /LastChar 136 /Widths [ 800 0 0 0 0 0 452 0 0 0 0 0 0 0 0 0 582 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 841 633 576 686 590 540 923 827 407 760] -/Encoding 670 0 R +/Encoding 674 0 R /Subtype /Type1 >> endobj -664 0 obj +668 0 obj 2362 endobj -665 0 obj +669 0 obj << /Filter /FlateDecode /FunctionType 4 @@ -1073,7 +1079,7 @@ endobj stream xœ«N)-P0PÈ-ÍQHHÎP endobj -666 0 obj +670 0 obj << /Filter /FlateDecode /FunctionType 4 @@ -1084,7 +1090,7 @@ endobj stream xœ«N)-P0PÈ-ÍQHHÎP endobj -667 0 obj +671 0 obj << /Filter /FlateDecode /FunctionType 4 @@ -1095,7 +1101,7 @@ endobj stream xœ«N)-P0TÈ-ÍQHHÎP endobj -668 0 obj +672 0 obj << /Filter /FlateDecode /FunctionType 4 @@ -1106,7 +1112,7 @@ endobj stream xœ«N)-P0Ð365³TÈ-ÍQHHÎP€Š™X ‹™›#Äô-,ŒÀüZ endobj -669 0 obj +673 0 obj << /Type /FontDescriptor /FontName /NVXWCK#2BTrajanPro-Bold @@ -1119,17 +1125,17 @@ endobj /StemV 138 /MissingWidth 500 /CharSet (/Msmall/C/Ysmall/Nsmall/Osmall/Esmall/Rsmall/S/Ssmall/I/Tsmall/Ismall/Usmall) -/FontFile3 671 0 R +/FontFile3 675 0 R >> endobj -670 0 obj +674 0 obj << /Type /Encoding /BaseEncoding /WinAnsiEncoding /Differences [ 127/Nsmall/Tsmall/Esmall/Rsmall/Ysmall/Ssmall/Msmall/Osmall/Ismall/Usmall] >> endobj -671 0 obj +675 0 obj << /Filter /FlateDecode /Subtype /Type1C @@ -1152,18 +1158,18 @@ x¸
\3§gA34–ITž-‹R8õ-ǵÛö2ªWuÉ~Á!"(0Š*FÂ͢ùĨ¸SˆˆoÊQPˆ0¦šåiFäݸVN^_!Ô‚–b ȼLçÇ<;—*X³«¥×ÛGâ_Y1ETïƒ4ˆÒ-U…_>´üØ¢æ}õï÷v¼
§ádù#¹rÛŸå¥@ÔÁ\5l…hð<8Ús· »O·Øèv61Bá5*È<6ÞÍ,‡bh‘˜¶ž\Î]Çé#¹#ØÔÍ1Oúñ°Ï¤5oÂ]цÆß4}h˜î0$å,6ü¼”A,¯?/å;Rôcy6Ò½UJ¿§Y½X^é¶ÙÉŸ‡‹º–2¸K|o½Ø”/Ȩ/ƒ(Â2Ð#žNMKðrˆ
rœÛf9ËyZ¸Ú}$«Ö õ–©) h`iÎGàAç÷´€H+Šˆ…Õ&*áX$žèìVŽhª”—›¾÷‡A1Ý£¤œÏ0‰÷—Hi éƒw~I(Áö2;à]¸L ™x4[¡OÜ,¾®ÆûÂQQ°”FdQ“ƒ¢¬„%\î¢Åâ:Ó;ÈÑ”ÌEb1ž’¡ˆÿ§=$¸¥?Iš¿CÐõ3¾C=VÐ'>·¯ôÌÒ+Ü~8 ç#;úÁ_£×á*qň+ô 8®‚ãÆpêŒ_YR”¾d%a ç¡H\eÄõãDf£Ñ¨ŽR[kφG¸ù/WT®ò•A5”H¥ÛVoo8hnû)¼ÞÃDn…ñëqÌzfåhý&þcQbµXÇß‚çLŽúõ;{²Ðñðué¿ÊÛÙ†-©[SÄ-Û¼ÔyubÜñhüm´œ4^Ë™ ääšLÿQ‹¡endstream endobj -650 0 obj << -/D [646 0 R /XYZ 85.0394 794.5015 null] +654 0 obj << +/D [650 0 R /XYZ 85.0394 794.5015 null] >> endobj -651 0 obj << -/D [646 0 R /XYZ 85.0394 769.5949 null] +655 0 obj << +/D [650 0 R /XYZ 85.0394 769.5949 null] >> endobj -648 0 obj << -/Font << /F21 654 0 R >> -/XObject << /Im1 647 0 R >> +652 0 obj << +/Font << /F21 658 0 R >> +/XObject << /Im1 651 0 R >> /ProcSet [ /PDF /Text ] >> endobj -674 0 obj << +678 0 obj << /Length 994 /Filter /FlateDecode >> @@ -1173,1577 +1179,1619 @@ Qm]»ÀÒíÏ¡[?NùËk5ú~ÕŒ,ÌrÀ¦v|™ý*Ô˜"ËäV£ŠÂýí´›•"("6 Š±þ0SצњfkZÂòUv:d ±žËLÖ³yG„¡Üï‹m¾ëœ¬[aló²:åÏçJX½æršÊ›âwÅIýûCÇóéX”ÒýžW¯ÂR¸ú¤8K1w™ÄA‚ºëpßAÜ0hSÚk&ò=Ëø/§54d+Igñ'ßf[Åv])KF_?²V1eÍöPTù&ëÕßÖ{ìÉÚÙZ•Kÿúí©ƒpšTß„ëJ wž•ÍÀàbŽ˜Îêb-ĵH:÷ä˜EÓôiÄéЉ剟ˆuGßý‰7»úæ:‰BÔ;a;áDºÂ˜€8þB‚ †Ì;aê{Òùä§saÅÞ̉'âJÂó•‘nIi~$ é\Q¼C>tƒÕÄg½äþbøª–{L¢©X^ìÎÁ1²ô¡óè~ú£-´fg"®Û–bGvS?
½$AŠƒXCÉ×ûîA<AxÞ2Rz=Jêï<ÒžF±Ê*Ó'KÏõàAi{nÃQ=mÛ#Ñ ½YàϼÐõº™¢&ró°Ðµ é¶\d<b’ëœ2²ûÉE‹h•v©D=Ú@-ô®(·WãrWA NkëË—^ópÚz¦ŸÝš›7‰úôbª¿ˆî~x©|ýá5VÙƺ…˜mÓûo"jÃËbRÍ{õ†8Ì9e&½Ãü_®…dµendstream endobj -673 0 obj << +677 0 obj << /Type /Page -/Contents 674 0 R -/Resources 672 0 R +/Contents 678 0 R +/Resources 676 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 655 0 R +/Parent 659 0 R >> endobj -675 0 obj << -/D [673 0 R /XYZ 56.6929 794.5015 null] +679 0 obj << +/D [677 0 R /XYZ 56.6929 794.5015 null] >> endobj -672 0 obj << -/Font << /F23 678 0 R /F14 681 0 R >> +676 0 obj << +/Font << /F23 682 0 R /F14 685 0 R >> /ProcSet [ /PDF /Text ] >> endobj -684 0 obj << -/Length 2884 -/Filter /FlateDecode ->> -stream -xÚí]wÛ¸†ïó+tWûB(¾ ^:Ž“u·ÉæÄÎé×ö‚GflõX¤KQÞº¿¾ €#œÍ&»±tra9Òp&ó>ÀPa3jÿ°™Q„Š\β\E™š-V/èìÚ¾÷æsŸ‘J%…°¿DÞ+aˆ2<›ÍáE^^¾øãkÎf\’Ìdlvùiô¥8á\ä³Ë«ÖU[VíúøŸ—ê
r’k®»ÏÓÙ\s"0ý'ÙñœQJΫ¶©¯6‹vYWÕ‹³ËŒ‚hÊäL›œd’².”áÍæz6¼ø°»ûüøØÇPv¯ÛE”íºw©€WC¶ëT -ËLƒ uÎ8'&Ϭsž.¯Yd_µp›+þ@ÂëMuUtCDqÛFì]òDL|&“1†&P)“H&¨ó–¦¨˜pI?’¸É¤¨®âã‹}_hù,©˜ÄÁg,`ˆá -P £ -jŠ×uóKÑï°_õ¬Èïdó
&” Ï^2ÀccK„H¨÷qøà”-ÇJC»á#¶Þ -9>¹Éä -€°'u^-Æ6N÷(eXRУ¦¨ÖŸBûi÷xþù__žÏ×yöœÁ™DÅg3`ˆ¡ÕâÓM¨±80TPï;Þ¨ÜøŠÈw©\ÜÝ.[X*}¨…¾æpäeHfbŒA™1Æ"q`Œ¡ÞcŒ›½Ü1æû_./ÎßÏí‡Åö7[÷)’9†gPj>}®‹ãõj&–")ó5“ -5Ó›²ê^üþøëw‹áˇǛígÅÂí¯¿/–Íö—`ýP¯ÛþY?ý}õØ…ì¤j
í·²h‹Ñ÷öO™ÑDP¡FíÃŽúɦWEØPw0_n¦÷äÆéIbâÃôcâGâÀÄG½âgv…DâûÍó·Eµñµ.T>3j¯Fþ¢d -ad7‚DÂ4ç91±¯$ï†C×”8v±.&º^Í7*gîCÃÐÓdø+yoÿ)X¯öendstream +688 0 obj << +/Length 2891 +/Filter /FlateDecode +>> +stream +xÚíMsÛȆïþ¼E:p2ß +–˜•U~}Àô )ÚB¼k¯E–¢$6ºÝž™%fÜý³Ô0®2=K2Íf¶X½à³k÷»7/„6Š”û&òÛ¹Q)3©Lfs|‘——/þøZŠ™Ô,I1»ü4ø2’I©²ÙåÕ?ŽN«²)Êf}üÏË?uˬ´íûùln%Ó©J»wŠã¹àœ—M]]mͲ*[«g—!£³\è™M3–h.ÚPú_Ö׳þŇØýûçØ +W±ïëå*¯úoÞæ®x]Δܫ!$j2È¢ +¤§àâ6¿<™îÏLñ9. u“¹@†X‚‹H¤óc™5™B\(à¢)òÛææ–g‡"dm2ÈB«B ƒB‚t>ÔZ3cÅPC_Cœæ‹›ey=Z=¨Tì]±ùX™2+¹’øDBÀnŽ
#„ì\¿‰#‰ƒB„ô>ŒJ2måPS˜PS¼®êÿäÝûUÇŠþN0_aB ÚAö&³)6¶Ô!؈ÄA±Az†É™²z¨4¬>bë
´“þvsÛ,ïný[>T·íò7Sö™®=‚X®É0 C +†-9"qP0ìxLJÇp%ÊMhséO³_ž¿{åE.ÖÕ¦^€äÅ¿7˺XÁÙx4]ኟ9åi‘Sîëvi£i—#Ò³ë5v¸ ]ž¬Rý .Ã1÷~üôã¨OOÿºMQ÷¢OÓ<U‡Íòþ +9žzaCâþÚÒ'é= +5ž't9*?;^£·w÷O“>?Cßk¾ +ãGyiKnSñSî,Hîä;Rw"&Eé=l»¨Œ3-¸tBûщç¦ß¼WåíC|×åÝf{EDÈÙT"°!AÄ–&±8"hïIÊ”û.F'~Çm«'€Ãhõlú™ƒ8žÉâ#CJ|œ~JüH”ø¤w˜H\éΤ𜨰1ðç*÷¥ØËü6/])–Jsè-úR˜ ß“aB†LXO¡ÇaŠÄAÁDz0Í„0P•(r™çkü®2ÑÏç‘œßh‚ÌNÆRØ`å(l"qPØÞ‡ HKÆE%‰ +%Éåq&ªêÖŸ +¥ï±D™*ÆÓ¬ŸÚ´ßH<¹ºwkØl»*òfSã=ábOÝBÄÄâVb¼_ŽÈÌ®×X±.βLôC¼[ˆïªfùÉïݺGÏ“|ëeacê=ˆ
‰{pKlŠ°Hi¤÷@šIÝ°®<h°Åðê¡ÌWPØ}¼»Ê7§‰9@ôCäó<™¡ÁŽB©H´å:”R[–d:‚†õ!,øþUmjWÀƒÔ\¶§ 雧qé2¤ÈÁòQèDâ Ø!½‡ÁGif3뀰'u^.†6 +2¤PÁjÉñ&ÔX*¤÷€ŠoL–BE]*w·Ë—Š©=ÔB¿åp2LfRŒa™)Æ"qPŒ‘Þ‡¹LpæÒ—da.;ûÞ¯3×þ¬h6wm‰¤öHßd8!–‡‚#é ‘¥Lsu4G]^œ¿9ž»7Vb_mS$H1•3lHp¶%µ?ôÅApF{ƒH-S\ +øƒÿÝÙ/ËuS”탙‰0ß™æ•Éš#CJsœuJóH”æ¤÷AsiX +M…æ:h¾nêãô¨ýèá·oðÐkƒh—#öùlk…lMfR,`5("qP,Þ„b‰Ðø˜Ž~]í»=Ãמ,Åzž%húg°º +ÁîGÓäm2ƒÅR…Bb7ŠÊõ +RDaYåxÏN,Š)Ò;ì]¥3"ÃÂÖÕgk›uÔaëê«m‘‚S)CvdXg‚±Hb¤k ,I˜†–D·œ…Ó™ó7íÉïå4ψ}µ
™J²#HÃz¤E‚ þåzø”¦¤ð ¥Ð¯òîââìÔ-töã)˜o•OþT¦3)$¬´ÄßxÁPáïþÌeÆÒØ'·ªïAœ+·üR#M.ŠgÎ×3ÿ¦þçñç/àJàí”s®Aendstream endobj -683 0 obj << +687 0 obj << /Type /Page -/Contents 684 0 R -/Resources 682 0 R +/Contents 688 0 R +/Resources 686 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 655 0 R -/Annots [ 687 0 R 688 0 R 689 0 R 690 0 R 691 0 R 692 0 R 693 0 R 694 0 R 695 0 R 696 0 R 697 0 R 698 0 R 699 0 R 700 0 R 701 0 R 702 0 R 703 0 R 704 0 R 705 0 R 706 0 R 707 0 R 708 0 R 709 0 R 710 0 R 711 0 R 712 0 R 713 0 R 714 0 R 715 0 R 716 0 R 717 0 R 718 0 R 719 0 R 720 0 R 721 0 R 722 0 R 723 0 R 724 0 R 725 0 R 726 0 R 727 0 R 728 0 R 729 0 R 730 0 R 731 0 R 732 0 R 733 0 R 734 0 R 735 0 R 736 0 R ] +/Parent 659 0 R +/Annots [ 691 0 R 692 0 R 693 0 R 694 0 R 695 0 R 696 0 R 697 0 R 698 0 R 699 0 R 700 0 R 701 0 R 702 0 R 703 0 R 704 0 R 705 0 R 706 0 R 707 0 R 708 0 R 709 0 R 710 0 R 711 0 R 712 0 R 713 0 R 714 0 R 715 0 R 716 0 R 717 0 R 718 0 R 719 0 R 720 0 R 721 0 R 722 0 R 723 0 R 724 0 R 725 0 R 726 0 R 727 0 R 728 0 R 729 0 R 730 0 R 731 0 R 732 0 R 733 0 R 734 0 R 735 0 R 736 0 R 737 0 R 738 0 R 739 0 R 740 0 R ] >> endobj -687 0 obj << +691 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 688.709 539.579 697.2967] /Subtype /Link /A << /S /GoTo /D (chapter.1) >> >> endobj -688 0 obj << +692 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 676.5858 539.579 685.4425] /Subtype /Link /A << /S /GoTo /D (section.1.1) >> >> endobj -689 0 obj << +693 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 664.4876 539.579 673.3442] /Subtype /Link /A << /S /GoTo /D (section.1.2) >> >> endobj -690 0 obj << +694 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 652.3894 539.579 661.246] /Subtype /Link /A << /S /GoTo /D (section.1.3) >> >> endobj -691 0 obj << +695 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 640.1914 539.579 649.1477] /Subtype /Link /A << /S /GoTo /D (section.1.4) >> >> endobj -692 0 obj << +696 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 628.0932 539.579 637.0495] /Subtype /Link /A << /S /GoTo /D (subsection.1.4.1) >> >> endobj -693 0 obj << +697 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 615.995 539.579 624.9512] /Subtype /Link /A << /S /GoTo /D (subsection.1.4.2) >> >> endobj -694 0 obj << +698 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 603.8967 539.579 612.853] /Subtype /Link /A << /S /GoTo /D (subsection.1.4.3) >> >> endobj -695 0 obj << +699 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 591.7985 539.579 600.7547] /Subtype /Link /A << /S /GoTo /D (subsection.1.4.4) >> >> endobj -696 0 obj << +700 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 579.7002 539.579 588.6565] /Subtype /Link /A << /S /GoTo /D (subsubsection.1.4.4.1) >> >> endobj -697 0 obj << +701 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 567.6019 539.579 576.5582] /Subtype /Link /A << /S /GoTo /D (subsubsection.1.4.4.2) >> >> endobj -698 0 obj << +702 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 555.5037 539.579 564.46] /Subtype /Link /A << /S /GoTo /D (subsubsection.1.4.4.3) >> >> endobj -699 0 obj << +703 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 543.4055 539.579 552.5112] /Subtype /Link /A << /S /GoTo /D (subsection.1.4.5) >> >> endobj -700 0 obj << +704 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 531.3072 539.579 540.413] /Subtype /Link /A << /S /GoTo /D (subsubsection.1.4.5.1) >> >> endobj -701 0 obj << +705 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 519.209 539.579 528.3147] /Subtype /Link /A << /S /GoTo /D (subsection.1.4.6) >> >> endobj -702 0 obj << +706 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 496.7003 539.579 505.4125] /Subtype /Link /A << /S /GoTo /D (chapter.2) >> >> endobj -703 0 obj << +707 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 484.5772 539.579 493.5832] /Subtype /Link /A << /S /GoTo /D (section.2.1) >> >> endobj -704 0 obj << +708 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 472.4789 539.579 481.485] /Subtype /Link /A << /S /GoTo /D (section.2.2) >> >> endobj -705 0 obj << +709 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 460.3806 539.579 469.3867] /Subtype /Link /A << /S /GoTo /D (section.2.3) >> >> endobj -706 0 obj << +710 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 448.2824 539.579 457.2885] /Subtype /Link /A << /S /GoTo /D (section.2.4) >> >> endobj -707 0 obj << +711 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 436.1841 539.579 445.1902] /Subtype /Link /A << /S /GoTo /D (section.2.5) >> >> endobj -708 0 obj << +712 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 413.4314 539.579 422.288] /Subtype /Link /A << /S /GoTo /D (chapter.3) >> >> endobj -709 0 obj << +713 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 401.353 539.579 410.4588] /Subtype /Link /A << /S /GoTo /D (section.3.1) >> >> endobj -710 0 obj << +714 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 389.2548 539.579 398.3605] /Subtype /Link /A << /S /GoTo /D (subsection.3.1.1) >> >> endobj -711 0 obj << +715 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 377.1565 539.579 386.2623] /Subtype /Link /A << /S /GoTo /D (subsection.3.1.2) >> >> endobj -712 0 obj << +716 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 365.1579 539.579 374.164] /Subtype /Link /A << /S /GoTo /D (section.3.2) >> >> endobj -713 0 obj << +717 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 353.0597 539.579 362.0658] /Subtype /Link /A << /S /GoTo /D (section.3.3) >> >> endobj -714 0 obj << +718 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 340.9614 539.579 349.9675] /Subtype /Link /A << /S /GoTo /D (subsection.3.3.1) >> >> endobj -715 0 obj << +719 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 328.7635 539.579 337.8693] /Subtype /Link /A << /S /GoTo /D (subsubsection.3.3.1.1) >> >> endobj -716 0 obj << +720 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 316.6653 539.579 325.771] /Subtype /Link /A << /S /GoTo /D (subsubsection.3.3.1.2) >> >> endobj -717 0 obj << +721 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 304.567 539.579 313.6728] /Subtype /Link /A << /S /GoTo /D (subsection.3.3.2) >> >> endobj -718 0 obj << +722 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 281.9139 539.579 290.7706] /Subtype /Link /A << /S /GoTo /D (chapter.4) >> >> endobj -719 0 obj << +723 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 269.8356 539.579 278.9413] /Subtype /Link /A << /S /GoTo /D (section.4.1) >> >> endobj -720 0 obj << +724 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 257.7373 539.579 266.8431] /Subtype /Link /A << /S /GoTo /D (section.4.2) >> >> endobj -721 0 obj << +725 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 245.6391 539.579 254.7448] /Subtype /Link /A << /S /GoTo /D (subsection.4.2.1) >> >> endobj -722 0 obj << +726 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 233.5408 539.579 242.4971] /Subtype /Link /A << /S /GoTo /D (section.4.3) >> >> endobj -723 0 obj << +727 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 221.4426 539.579 230.3988] /Subtype /Link /A << /S /GoTo /D (section.4.4) >> >> endobj -724 0 obj << +728 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 209.3443 539.579 218.3006] /Subtype /Link -/A << /S /GoTo /D (section.4.5) >> +/A << /S /GoTo /D (subsection.4.4.1) >> >> endobj -725 0 obj << +729 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 197.2461 539.579 206.2023] /Subtype /Link -/A << /S /GoTo /D (subsection.4.5.1) >> +/A << /S /GoTo /D (section.4.5) >> >> endobj -726 0 obj << +730 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 185.1478 539.579 194.1041] /Subtype /Link -/A << /S /GoTo /D (subsubsection.4.5.1.1) >> +/A << /S /GoTo /D (subsection.4.5.1) >> >> endobj -727 0 obj << +731 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 173.1492 539.579 182.1553] +/Rect [527.6238 173.0496 539.579 182.0058] /Subtype /Link -/A << /S /GoTo /D (subsubsection.4.5.1.2) >> +/A << /S /GoTo /D (subsubsection.4.5.1.1) >> >> endobj -728 0 obj << +732 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 161.051 539.579 170.0571] /Subtype /Link -/A << /S /GoTo /D (subsection.4.5.2) >> +/A << /S /GoTo /D (subsubsection.4.5.1.2) >> >> endobj -729 0 obj << +733 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 148.9527 539.579 157.9588] /Subtype /Link -/A << /S /GoTo /D (subsection.4.5.3) >> +/A << /S /GoTo /D (subsection.4.5.2) >> >> endobj -730 0 obj << +734 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 136.8545 539.579 145.8606] /Subtype /Link -/A << /S /GoTo /D (subsection.4.5.4) >> +/A << /S /GoTo /D (subsection.4.5.3) >> >> endobj -731 0 obj << +735 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 124.7562 539.579 133.7623] /Subtype /Link -/A << /S /GoTo /D (subsection.4.5.5) >> +/A << /S /GoTo /D (subsection.4.5.4) >> >> endobj -732 0 obj << +736 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 112.5583 539.579 121.5146] +/Rect [527.6238 112.658 539.579 121.6641] /Subtype /Link -/A << /S /GoTo /D (subsection.4.5.6) >> +/A << /S /GoTo /D (subsection.4.5.5) >> >> endobj -733 0 obj << +737 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 100.4601 539.579 109.4163] /Subtype /Link -/A << /S /GoTo /D (section.4.6) >> +/A << /S /GoTo /D (subsection.4.5.6) >> >> endobj -734 0 obj << +738 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 88.3618 539.579 97.3181] /Subtype /Link -/A << /S /GoTo /D (section.4.7) >> +/A << /S /GoTo /D (section.4.6) >> >> endobj -735 0 obj << +739 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 76.2636 539.579 85.2199] /Subtype /Link -/A << /S /GoTo /D (section.4.8) >> +/A << /S /GoTo /D (section.4.7) >> >> endobj -736 0 obj << +740 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 64.1653 539.579 73.1216] /Subtype /Link -/A << /S /GoTo /D (subsection.4.8.1) >> +/A << /S /GoTo /D (section.4.8) >> >> endobj -685 0 obj << -/D [683 0 R /XYZ 85.0394 794.5015 null] +689 0 obj << +/D [687 0 R /XYZ 85.0394 794.5015 null] >> endobj -686 0 obj << -/D [683 0 R /XYZ 85.0394 711.9273 null] +690 0 obj << +/D [687 0 R /XYZ 85.0394 711.9273 null] >> endobj -682 0 obj << -/Font << /F21 654 0 R /F23 678 0 R >> +686 0 obj << +/Font << /F21 658 0 R /F23 682 0 R >> /ProcSet [ /PDF /Text ] >> endobj -739 0 obj << -/Length 3160 +743 0 obj << +/Length 3152 /Filter /FlateDecode >> stream -xÚí[wÛ¸Çßý)ôh?Åýò˜ëžìi“lâ¾t»ŒÌØ:‘DW’“z?}A‘ -0ÄHba¤$âÀHÙñžls%'V²SÝ·¹;MíPÁUëi³ä|®—õbRç3N~ïö`í-Z°|ÆÀé°LíxM~§%–ºN&ÛÛdj^OÃØâÕ¬ž×‹µ€(fµ^ÉòRZü͆Ø7J†q’ˆãõÞZ5³Ä˜~"Ðã’/TþV'W¡S^µ¨hÃ5íTB:‹Q†*P.Áó¨$âÀPA½3®‰LŽ4ÕÄHX6¸ˆv>äv±®þ}6N§VïJHe1(ÀJ…’ˆõAQ¾u1LZ -ïAyY·ýÐb:ôBÕâ"Ô½Õe;;ÿ3ŒôÄ,{ÌR)Ða`K„T¸÷¾_Q–mÅЯð8Ë>oGý,jßj(kŽŠJHg1*ÀCÊ%D•D*¨÷¡¹0”håßDXŽýÊJHe1(ÀJ…’ˆõ>€¢,ÑÌ -ý¢Ý`׶ͬí4Ž×=‰+ÆbX@a0,q`X Þ,´#V¹¾CuX¼YøösåÙ8kÊŽ—/¦ñ ,Æbx@T¾IÅázðP†Xn¶ºÝáñÛMÝÞ¼hsC7xCaÌ‘Š˜·b*€!FÔEå¯SKÅQz¨Š§¤ÂtTtw¡m¡8?sôtY-VŸ7ƒ -eØ‹˜¸b,€!†Ã"†ê}ÀBbôvbû¢´ -“/ßwoÞÇ[Œö·\±\![Å, +xÚí[wÛÆÇßõ)ø(=p»÷Ë£¯9I[Û±Õ—¦y€)Xæ I¨$×ýô]ØݸjÛȵD&'‘la0£ùÿ¸³³X +
÷ÕÚ?«×{qõsq`¬ Þ+ÒM©Ž¬ðž•óëUeû¹î¾ù{³òߪOÄ Ä„¬1b j1™80bPÒÖEbDOÌ‹fõJùõí:ró¡^ÿ^¯Û1†‰cEe”‘ÇbF€!ÆÔ‰›qF2q`Œ Þ
óCŽöå‘ûª&ï!qêyøñÝïº'ãöæ¦Yo»?ÌWÝ×ç?¾yÙ}ç
gwù& +&ŒŸ{L¡¸ŒrrYÌ 0Ä8ZaœdâÀ8A½NŒl7`GLÔALæ«ÙâöªÎQ¢‰qìÐdÇ2~Tóäábx’ÆÐOŒïˆÍ‘ƒ¹àh_“´NsýPä_¾õõü?x³FLe1"ÀcJ…A’‰£õ0Q”:)s“ß꯹©¯/AΊƒ‹ö´ês^Ì0Äx‚šb<eâÀxB½ž„%‚¦QÇ>N‡GEŸ^'R[LM²Ã ÂaÌì!ƒ¹Äpωa w™Es}Ýî$Ë*ã‡<§ç(yT»
cŠ‹Ñ†;PB1~OG.ŒÔ{À‡I¸Ói)>?÷˜èüvYýa
wÈe1'Àãj…q’‰ãõ¯2IÊ §ÆRÚ둶߶¼¦¾«–aÖ;û\VunÕÏrR)Ý÷îóºÚx´àÇ5« é-†bð@ùÄø͹80xPïá<,´Sí +àñÉu³ÎÍt$%Úš;ðHjªBÅô–Â
xòI: +O.Ü{_¡„±„I *Ôá«U‹/ë:·ÐÇ}}Š°ŒMo¸ÒG|Ý3¦»%`ˆ¡å”ãÛzsq`(¡ÞJZ{z8(aüAP:<Ó‘Ì=¡Ñ'¤µ`ˆ!eÃÉÄ!ƒzÈ(I¨e<!søJÕ²ÚlÛûãóócéôÁþJWõ +9.æbü@
åøŽÏ\?¨÷Àä„J§?ò¡ø¹OåssYÌ 0Ä8ZaœdâÀ8A½ND;á…ÝÕáKUÍM+õ&ÁÁú³¼TÅŽkjr\Ì0ÄøbüdâÀøA½~˜!ÎjP§ôCñsŸVòQ×£ËbN€!Æ ÔJŽoýËÅq‚zO8UÄ) *’ë8Ï›fQW½¨o{:¦J¸#¾ÚÓU0Ä`€rÈñ+¹80Pïîqœ[C¿.óºY©º'¬ìn;—”Ÿn+²³WÊ4Dب£Æ—]rq làÞÖW[Ý>¬eãåmµ˜n¶Õì·;Oßß-Kßbˆ©*b @)Ôxœ‹õž@ÐŽXåCv <›ÍâÐ/Ú
víxÑ,Ú¢qºï9%®`ˆa…Á°ÈÄazOX(C,7ƒÚ¡:,~\ùöSåÙ¸˜jÊN·/æñ ,Æbx@Ôx?’‹ÃõžðŠ§ÄCwxü|[·/Ú=Ð
>PAs¢"æ˜ +`ˆQuQã÷©åâÀ¨@½'*„ F»ÓQÑ=…¶…âòÂÑóuµÚ|ÚM*”a',b⊱ +‹/ßuß¼‹í¹b¹:.B¶ŠY +‡ëXx{3xÒù‡¯›m½LB»Ý•’Y|†Þr¾£CªÇµNP,/0Ää… VãK¹80yQïQ^æÑÚÉÁúõÅ?ö‘‡5L?ñÆ!樔 endobj -738 0 obj << +742 0 obj << /Type /Page -/Contents 739 0 R -/Resources 737 0 R +/Contents 743 0 R +/Resources 741 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 655 0 R -/Annots [ 744 0 R 745 0 R 746 0 R 747 0 R 748 0 R 749 0 R 750 0 R 751 0 R 752 0 R 753 0 R 754 0 R 755 0 R 756 0 R 757 0 R 758 0 R 759 0 R 760 0 R 761 0 R 762 0 R 763 0 R 764 0 R 765 0 R 766 0 R 767 0 R 768 0 R 769 0 R 770 0 R 771 0 R 772 0 R 773 0 R 774 0 R 775 0 R 776 0 R 777 0 R 778 0 R 779 0 R 780 0 R 781 0 R 782 0 R 783 0 R 784 0 R 785 0 R 786 0 R 787 0 R 788 0 R 789 0 R 790 0 R 791 0 R 792 0 R 793 0 R 794 0 R 795 0 R 796 0 R 797 0 R 798 0 R 799 0 R 800 0 R ] +/Parent 659 0 R +/Annots [ 748 0 R 749 0 R 750 0 R 751 0 R 752 0 R 753 0 R 754 0 R 755 0 R 756 0 R 757 0 R 758 0 R 759 0 R 760 0 R 761 0 R 762 0 R 763 0 R 764 0 R 765 0 R 766 0 R 767 0 R 768 0 R 769 0 R 770 0 R 771 0 R 772 0 R 773 0 R 774 0 R 775 0 R 776 0 R 777 0 R 778 0 R 779 0 R 780 0 R 781 0 R 782 0 R 783 0 R 784 0 R 785 0 R 786 0 R 787 0 R 788 0 R 789 0 R 790 0 R 791 0 R 792 0 R 793 0 R 794 0 R 795 0 R 796 0 R 797 0 R 798 0 R 799 0 R 800 0 R 801 0 R 802 0 R 803 0 R 804 0 R ] >> endobj -744 0 obj << +748 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 758.4766 511.2325 767.4329] /Subtype /Link +/A << /S /GoTo /D (subsection.4.8.1) >> +>> endobj +749 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.2773 746.445 511.2325 755.4012] +/Subtype /Link /A << /S /GoTo /D (subsection.4.8.2) >> >> endobj -745 0 obj << +750 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 746.5446 511.2325 755.4012] +/Rect [499.2773 734.5129 511.2325 743.3696] /Subtype /Link /A << /S /GoTo /D (subsection.4.8.3) >> >> endobj -746 0 obj << +751 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 734.4133 511.2325 743.3696] +/Rect [499.2773 722.3816 511.2325 731.3379] /Subtype /Link /A << /S /GoTo /D (section.4.9) >> >> endobj -747 0 obj << +752 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 722.3816 511.2325 731.3379] +/Rect [499.2773 710.3499 511.2325 719.3062] /Subtype /Link /A << /S /GoTo /D (subsection.4.9.1) >> >> endobj -748 0 obj << +753 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 710.3499 511.2325 719.3062] +/Rect [499.2773 698.3182 511.2325 707.2745] /Subtype /Link /A << /S /GoTo /D (subsection.4.9.2) >> >> endobj -749 0 obj << +754 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 688.0297 511.2325 696.7618] +/Rect [499.2773 675.998 511.2325 684.7301] /Subtype /Link /A << /S /GoTo /D (chapter.5) >> >> endobj -750 0 obj << +755 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 676.0179 511.2325 684.9742] +/Rect [499.2773 663.9862 511.2325 672.9425] /Subtype /Link /A << /S /GoTo /D (section.5.1) >> >> endobj -751 0 obj << +756 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 663.9862 511.2325 672.9425] +/Rect [499.2773 651.9545 511.2325 660.9108] /Subtype /Link /A << /S /GoTo /D (section.5.2) >> >> endobj -752 0 obj << +757 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 641.666 511.2325 650.5226] +/Rect [499.2773 629.6343 511.2325 638.4909] /Subtype /Link /A << /S /GoTo /D (chapter.6) >> >> endobj -753 0 obj << +758 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 629.6542 511.2325 638.7599] +/Rect [499.2773 617.6225 511.2325 626.7282] /Subtype /Link /A << /S /GoTo /D (section.6.1) >> >> endobj -754 0 obj << +759 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 617.6225 511.2325 626.5788] +/Rect [499.2773 605.5908 511.2325 614.5471] /Subtype /Link /A << /S /GoTo /D (subsection.6.1.1) >> >> endobj -755 0 obj << +760 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 605.5908 511.2325 614.5471] +/Rect [499.2773 593.5591 511.2325 602.5154] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.1.1.1) >> >> endobj -756 0 obj << +761 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 593.5591 511.2325 602.5154] +/Rect [499.2773 581.5275 511.2325 590.4837] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.1.1.2) >> >> endobj -757 0 obj << +762 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 581.5275 511.2325 590.4837] +/Rect [499.2773 569.4958 511.2325 578.4521] /Subtype /Link /A << /S /GoTo /D (subsection.6.1.2) >> >> endobj -758 0 obj << +763 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 569.4958 511.2325 578.4521] +/Rect [499.2773 557.4641 511.2325 566.4204] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.1.2.1) >> >> endobj -759 0 obj << +764 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 557.4641 511.2325 566.4204] +/Rect [499.2773 545.4324 511.2325 554.3887] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.1.2.2) >> >> endobj -760 0 obj << +765 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 545.4324 511.2325 554.5382] +/Rect [499.2773 533.4007 511.2325 542.5065] /Subtype /Link /A << /S /GoTo /D (section.6.2) >> >> endobj -761 0 obj << +766 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 533.4007 511.2325 542.357] +/Rect [499.2773 521.3691 511.2325 530.3254] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.1) >> >> endobj -762 0 obj << +767 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 521.3691 511.2325 530.3254] +/Rect [499.2773 509.3374 511.2325 518.2937] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.2) >> >> endobj -763 0 obj << +768 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 509.3374 511.2325 518.2937] +/Rect [499.2773 497.3057 511.2325 506.262] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.3) >> >> endobj -764 0 obj << +769 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 497.3057 511.2325 506.262] +/Rect [499.2773 485.274 511.2325 494.2303] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.4) >> >> endobj -765 0 obj << +770 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 485.274 511.2325 494.2303] +/Rect [499.2773 473.2424 511.2325 482.1986] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.5) >> >> endobj -766 0 obj << +771 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 473.2424 511.2325 482.1986] +/Rect [499.2773 461.2107 511.2325 470.167] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.6) >> >> endobj -767 0 obj << +772 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 461.2107 511.2325 470.167] +/Rect [499.2773 449.179 511.2325 458.1353] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.7) >> >> endobj -768 0 obj << +773 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 449.179 511.2325 458.1353] +/Rect [499.2773 437.1473 511.2325 446.1036] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.8) >> >> endobj -769 0 obj << +774 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 437.1473 511.2325 446.1036] +/Rect [499.2773 425.1157 511.2325 434.0719] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.9) >> >> endobj -770 0 obj << +775 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 425.1157 511.2325 434.0719] +/Rect [499.2773 413.084 511.2325 422.0403] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.10) >> >> endobj -771 0 obj << +776 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 413.084 511.2325 422.0403] +/Rect [499.2773 401.0523 511.2325 410.0086] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.10.1) >> >> endobj -772 0 obj << +777 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 401.0523 511.2325 410.158] +/Rect [499.2773 389.0206 511.2325 398.1264] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.10.2) >> >> endobj -773 0 obj << +778 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 389.1203 511.2325 398.1264] +/Rect [499.2773 377.0886 511.2325 386.0947] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.11) >> >> endobj -774 0 obj << +779 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 377.0886 511.2325 386.0947] +/Rect [499.2773 365.0569 511.2325 374.063] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.12) >> >> endobj -775 0 obj << +780 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 365.0569 511.2325 374.063] +/Rect [499.2773 353.0252 511.2325 362.0313] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.13) >> >> endobj -776 0 obj << +781 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 353.0252 511.2325 362.0313] +/Rect [499.2773 340.9936 511.2325 349.9997] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.14) >> >> endobj -777 0 obj << +782 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 340.9936 511.2325 349.9997] +/Rect [499.2773 328.9619 511.2325 337.968] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.15) >> >> endobj -778 0 obj << +783 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 328.9619 511.2325 337.968] +/Rect [499.2773 316.9302 511.2325 325.9363] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.16) >> >> endobj -779 0 obj << +784 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 316.8305 511.2325 325.9363] +/Rect [499.2773 304.7989 511.2325 313.9046] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.1) >> >> endobj -780 0 obj << +785 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 304.7989 511.2325 313.7552] +/Rect [499.2773 292.7672 511.2325 301.7235] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.2) >> >> endobj -781 0 obj << +786 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 292.7672 511.2325 301.873] +/Rect [499.2773 280.7355 511.2325 289.8413] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.3) >> >> endobj -782 0 obj << +787 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 280.7355 511.2325 289.8413] +/Rect [499.2773 268.7038 511.2325 277.8096] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.4) >> >> endobj -783 0 obj << +788 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 268.7038 511.2325 277.6601] +/Rect [499.2773 256.6722 511.2325 265.6285] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.5) >> >> endobj -784 0 obj << +789 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 256.6722 511.2325 265.6285] +/Rect [499.2773 244.6405 511.2325 253.5968] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.6) >> >> endobj -785 0 obj << +790 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 244.6405 511.2325 253.5968] +/Rect [499.2773 232.6088 511.2325 241.5651] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.7) >> >> endobj -786 0 obj << +791 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 232.6088 511.2325 241.5651] +/Rect [499.2773 220.5771 511.2325 229.5334] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.8) >> >> endobj -787 0 obj << +792 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 220.5771 511.2325 229.5334] +/Rect [499.2773 208.5455 511.2325 217.5017] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.9) >> >> endobj -788 0 obj << +793 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 208.5455 511.2325 217.5017] +/Rect [499.2773 196.5138 511.2325 205.4701] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.10) >> >> endobj -789 0 obj << +794 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 196.5138 511.2325 205.4701] +/Rect [499.2773 184.4821 511.2325 193.4384] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.11) >> >> endobj -790 0 obj << +795 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 184.4821 511.2325 193.4384] +/Rect [499.2773 172.4504 511.2325 181.4067] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.12) >> >> endobj -791 0 obj << +796 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 172.4504 511.2325 181.4067] +/Rect [499.2773 160.4187 511.2325 169.375] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.13) >> >> endobj -792 0 obj << +797 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 160.4187 511.2325 169.375] +/Rect [499.2773 148.3871 511.2325 157.3433] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.14) >> >> endobj -793 0 obj << +798 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 148.3871 511.2325 157.3433] +/Rect [499.2773 136.3554 511.2325 145.3117] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.15) >> >> endobj -794 0 obj << +799 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 136.3554 511.2325 145.4611] +/Rect [499.2773 124.3237 511.2325 133.4295] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.16) >> >> endobj -795 0 obj << +800 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 124.3237 511.2325 133.4295] +/Rect [499.2773 112.292 511.2325 121.3978] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.17) >> >> endobj -796 0 obj << +801 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 112.292 511.2325 121.2483] +/Rect [499.2773 100.2604 511.2325 109.2166] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.18) >> >> endobj -797 0 obj << +802 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 100.2604 511.2325 109.3661] +/Rect [499.2773 88.2287 511.2325 97.3344] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.19) >> >> endobj -798 0 obj << +803 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 88.2287 511.2325 97.3344] +/Rect [499.2773 76.197 511.2325 85.3027] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.17) >> >> endobj -799 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 76.197 511.2325 85.1533] -/Subtype /Link -/A << /S /GoTo /D (subsection.6.2.18) >> ->> endobj -800 0 obj << +804 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 64.1653 511.2325 73.1216] /Subtype /Link -/A << /S /GoTo /D (subsection.6.2.19) >> +/A << /S /GoTo /D (subsection.6.2.18) >> >> endobj -740 0 obj << -/D [738 0 R /XYZ 56.6929 794.5015 null] +744 0 obj << +/D [742 0 R /XYZ 56.6929 794.5015 null] >> endobj -737 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F21 654 0 R >> +741 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R >> /ProcSet [ /PDF /Text ] >> endobj -803 0 obj << -/Length 3296 -/Filter /FlateDecode ->> -stream -xÚíYs7€ßõ+øª•„Å}ì>lé²£”-{%¹²µIhrL±,>ö×/†3À4ELKHbÙ–èTJ”4=ÝìþÐè0ëQÿëYE¨p²gœ$Š2ÕLvhoä÷|‡5×쇋öáU‡—;&Lϧ¹î]¾÷²„ZËz—Ã_v^]žœ]^ìývùÓÎÉe¼)T̨¨îøûÎ/¿ÑÞÐëÿi‡á¬ê}ôßPÂœã½ÉŽT‚()DøÉõÎÅοã
ÁoW¢©7¢„%Êr“x'\€wÂ8'ÖorDÿ»êh §Õñ—3p¹`ÄZ*½Žê²Ål9_Ãý÷Åçys1¼·²Äq«›‹/ýE1)ÊÅÞ>Wt÷¸ø•R^ŽãiYÿ¤_ëoæýQQ½»do_Qú…¿Hç²nÅWqK4§¬uáF@f£^ýâ†(ÈíCÁÍmÞ"½aGyÊT{ˆ4DÃZ@Ø€|`péßQi0žÏú“Iæ-(þÅMLÁÝÙ0A¦µp"0%ìÀ`Bµ·0 Eg®…‰˜îÎ2ÚéïNh‚[³¡‚4kaC IØAƒjo¡á‚m¸šÿMË"
5ÎÜ•¬}Ì©ç.˜‚»³a‚Lká4Ý0%ìÀ`Bµ·01Ï cº…I~˜îÎ@F±G4m·fC1h`Øí†&a
ª)IŒ1®§#Vi !lÏw
t÷¿«°^î9ºûù¦˜{_Éo¼„yø¬]˜D -`L÷âWÊŒT{; Pß–2Å"¼™ŽÇóÁ2î—ÿI$ùUÃÿµ×Ú£³ ‚!0FÆv’°#Õ QÎ7ʹHˆh¹(‹q9jfõË+䶾Ìæ'z8—(ˆð³A„Ÿ”?¸ö–K‰ 2ö2Uûºâç´üPÌBUø²sa79çôõ1·bÛŠD/f31F`”Œëf$aƪ½eD["¤k[Õ0òjqUÌjn7¿«-•q]–ãU»"${ÂóPôb6#@cF c$aƪ=Ö«Jy0œlÛÛßR&vì´ïŠ˜›q?¼:?}~z–Ø´“†ObsÝR{ûN±ïšN\‚C³q‚.0`. ;0\Pí-.R)¸ð\NÏŽ^¼9>IfS„jÑÅ/¯Wfƒ1P`¨0Pv` Ú[P'ÒJ@9 øÊ7u@+]$æë,˽â%¸8 ˆCh»wzSv` -ÇÚ~x~rvr~PÐ\¦²“„R!ÓàéêÓ;A®Êb ÀP` $ìÀ@@µ· P/`„‰ ˜„ƒápuê',§µ<›Î&ý…¯\µÑÛ&':0 ˆád»·rSv`xlhg‰'¤ÕD+ÕtáÕŽÞZŠpõ—‹b°œŸë>?‹Y¿Þ÷ïò[¼µ7à^þ‚›oÞwå/Ñé/x;ÄO›ZS{ŸÒø‰™Ò¦]ÕøÕÞçÁ`PÌçÑ-‹U^›6êÅx¾XýNn÷<³G]tx‚Ȩ[(FQÂŒ&T{¤Isb¤jzV’:[îÓ·c’53æàj6.«`„&Öj§31W;"|&h®™‹åx˜º•/2Ã<ñü?nˆm6¸@²c»€¤ìÀÀEµÇjB*JŒ£2ÛnÏ'ËDÅ•VäQ|R~¨ÄiYŸSZ<¼ØÉUð|6W@ã -Fã*aƪ½åÊX¡Dä*ìø½™Çøt'âë»3»y3hìŸ-ËA}â]š§0çvBÜž
Ä ‚aÅ JØA…j³lµÜai³CÏ«užPl«\£ôß#ì&ø4 ˆc†“°fC{²¢²úYCkÓ]î1ÆvgÓåÛëb~åç¯*uº'ÜáÞ=Àzž5˺cÀÛaîØК?ÂU«6Í#˜6ö<GÓÉ$œ¿x]ÏÓÞ5“j¹@Êm‹“=¤¢›s‡D†Ôz»ÙIÙ0„k»°¾T<0ëÅÓÅßš¾¹œ6¢}œÎÞûÁõÏú»«éÇúÅ 6Þë/Õój£ú\`“¸§Ëp‡«~¼íǦ„ýËçsf¿¡I7¸$;Þnèp$Ú›F`ÁÆTÇ|¡¡®y`Ò®*¸*_œ–ƒ:XU1‹¹x(÷èª_ŽÖj¼f2žÃÊäÙrò¶Z¨ö -A!Ý” ˆ°„€„¨öÈ€2„ÉæùGk®Ÿ«í€=º5¤ŸÍ -"`¬ÅÆuŸ
HÙ€k9‚[C$,rÄéëºôÃaxÆ&<y÷«/èü?ÿÕ_®…Ùˆ~̦b”À8a”$ìÀ(AµÇôa‘Í샪¢¯²Çáøíõx:šõo®>·XÄ)âb9Õgï…¬Òú¯&FpþDrGã¸l(Z9Œ ‰M#0"0ÕmÚЂHÇ#!mœ¿/}Ôë˜ûI#œ‹˜4ejÀäüÙѼfÁ -þ4jÍè²l€ F †CÂŒT{„bD £#¼™GÊE1+Cs<ë¿«0pŽo“û0¼šÍĘQsÝ{-);0fPí-3ÂU*2#jfÀÃ5ÇÓÁ¤Žƒ·q¡·nA{*Ù#ø*› ˆ‘ -Œ!LwDHbý¿†!U3Tö'ÅppUަ廽ês˶ðüax‚³é‚>0†ŒvïP§Á +807 0 obj << +/Length 3353 +/Filter /FlateDecode +>> +stream +xÚíKs7€ïú<¤j¥ƒ°x€ÝÖ^v”rd¯$W¶6É&ÇËâPáÃŽ÷×/†`š"¦%8~ÈJ‘’¦§›Ýß4ºÌõ¨ûõŒ"TXÙÓVE™ê
&;´7r{¾Ãü1ûá }xÔáåÎߟ ݳļè]¾ç2„Ãz—Ã_w^ž]žœ]^ìý~ùÓÎÉe<)T̨¨ÏøÇί¿ÓÞÐéÿi‡aê}p?P¬å½ÉŽT‚()DøÍõÎÅοã Á_W¢©¢„!Êpø$\€OÂ8'Æjg²¤îoõG)wŠëâgàpÁˆ1T:õa‹Ùr¾(‡ûïÊs0<·2ÄrSøƒ/ýE9)«ÅÞ>Wt÷ù¬?™ôg{ûFÒ]²·¯èx‘Ö~ŠÜ€+nHÁ)k}º¡Ù¨×¼9‡1rûPp3f›ç_Ŭذ#0²#ÕÞ#5)´f‘N¿(1Çåo”òj¼O«æ7ýjؼy=ïÊúx˜œt\˜
Ä +[|ìtBÜš
Ä Y›î†&a
ª½…†9+ZhÄÐüoZ•ih¨¶ú®dÌcN=wÁÜ
Ä`Z§é†)aª=ÂTXKŒ*d“ü"0Ý´bgØŠnÍ… +"Ь…MÓNhRv ÐàÚ™’Dkm{…ÑÄR& +PíqPÖ•”ÊÚH÷ƒÀñx>X&Âýó B~Óðë¹öèÃ\B BÈZŒt÷ôhÊ„\{Kˆ¡DPi"!ÂrQ.ãjäGõË+䶾Ìç'x8› ˆñ#¨m7? ;0~Pí-?…!BÚØËÔí늟Óê}9UáÏý››ÓØçœÓWïÝÁ܈m+½˜ÍÄQÂIØ1‚joQ+ÛVDyF^.®ÊYÃíæwµ¤2nÊ’Ábü¾nW„dOy +^ÌfbŒÀ(aŒ$ìÀAµÇzUII¤°¼e$¶/®¥L¬Ø®f2,ÆýðòüôùéYbÑNj"‰þ¸5¤ööbu[th6.@ÃÌt¯¿¤ìÀpAµ·¸N¤‘àÂsp9=;zñúø$µ™MZˆ.^¸x|y%¸2 ˆC…’°ÕÞ‚Â)q¦X +"x¬Èt/ñ§ì@ðØÔÎ÷”HíJ}^¯è¥Û¼\”ƒål¼øØüt4uùaXÎúͺ§ß©÷óØ´xó¼+‰nÓa~ÚКZû”'Z*߉®jüzíó`0(çóè–Å*¯Mýõb<_¬þ&·kžùW]pxöU±«£(aFª=Ò¤(Ñ–úž•¤ö–»ôm™d~Ä<ºšM§‹ÄÀ*$¡’‡Ãê•ÎÄXm‰pEØÿY.–ãaêT†8T?쉯à +±!¨ÙÄAŒXéÞû‘²#ÕÞ–NÀ%²íº|²>TÌqisƒN|ᚇºð¤zßT†ÓªÙ , +ñtb'WÁóÙ\AŒ+YŒ«„W¨ö–«º'5”E®ÂRßëyœyO· ®1–…Ô7ïLkoãgËjÐlu—ú)¶P·gC1¨`X1¨v`P¡ÚãðÊ$±\ú¥É¸Qskb[ÞjU<ñÅÁN`‚O³‚00f0 ;0`6´§º aëù çªñ]Ðåclw6]¾¹.çWnüªóQ—{âîÛì@¤ÙY·¬{<âŽM©ëG7z+?E{£édö]¼j†iç™I=M 嶵ɾ¢‚—s/( ‡\Ok1D¸Ù4ÃS‡tQXB¿Óø
}«µõÅß|¯\Mýíg¦³wîºúgóÓÕôCófЋíÍK}Ú¨ÙèsötÎpÕ§ýà«ÇÑ¿\*gæ·Ñ'ÙÑ‚X¸×|ŽÄ;apT{ÌJ׫ú^zUÁÕ ã´4«‹ùXÌÅݸGWýj´VãùÁx6S’gËÉ›z†Ú™ñ +ùè¦l€ ÆÀZv` Ú#Rfü&Ö\¿Ô;%Ú«öèÖuý¼ôWñåõ»h¥ÜŽ÷B)x;% ˆ¡´M¥„JÚ“Õ„~BüÀerÎwnnÊj8”ÝóÍQìÞ%ÀJ0hŽéÞ`O‡ù`CkòrbŒ&TãƒzÕÚyað®š~¸.‡£:¥Ö{à¹ÝV^ùWOpnöÕ±«#&aFª=–_ÜÖó½Ftjxl} 5™öp6.ý®éÇóÅtöq}+uˆÏ.nØͺPAÙãA!:+(ˆ °…” +¸öD¸ÑDRÁ< ¼I"Ï˪œ… ++ù¼|ëGê*ÜmsZ½]-¯¦Ë +û´ÖŸ¢ï²Á + Ó=kVÙîûßáé0WlhM\Ì +¢•lâp¸V…ÝŽG*i~?7¿Æxä^wP¹îÖâ@–²
×a3Œhk™‡7°]MëNé-m_6A +atûÒæåö¡`Š¶Ûç¯Îhw‘˜2Ã
Uq+,1þþÌÃÕ`_§¶j>/õ“ÙGõ3y¤T[¦>LÞÝÙ,µrJ ˜Œv?w.a¦;r¤41îŸI®4ªÕãoJbËÐ_e(¸:" ˆQCÉhwÝ™2ãUA’ŠX! +’j@ªú“r¸?¸*ïÓêí^ýP¼-AŸLPðq6A@#ÆÑîê”!A¨úHÄjã;—úÖÊ[ùT¤¶9èÓ +>Î&bÁ2Úý endobj -802 0 obj << +806 0 obj << /Type /Page -/Contents 803 0 R -/Resources 801 0 R +/Contents 807 0 R +/Resources 805 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 655 0 R -/Annots [ 805 0 R 806 0 R 807 0 R 808 0 R 809 0 R 810 0 R 811 0 R 812 0 R 813 0 R 814 0 R 815 0 R 816 0 R 817 0 R 818 0 R 819 0 R 820 0 R 821 0 R 822 0 R 823 0 R 824 0 R 825 0 R 826 0 R 827 0 R 828 0 R 829 0 R 830 0 R 831 0 R 832 0 R 833 0 R 834 0 R 835 0 R 836 0 R 837 0 R 838 0 R 839 0 R 840 0 R 841 0 R 842 0 R 843 0 R 844 0 R 845 0 R 846 0 R 847 0 R 848 0 R 849 0 R 850 0 R 851 0 R 852 0 R 853 0 R 854 0 R 855 0 R 859 0 R 860 0 R ] +/Parent 659 0 R +/Annots [ 809 0 R 810 0 R 811 0 R 812 0 R 813 0 R 814 0 R 815 0 R 816 0 R 817 0 R 818 0 R 819 0 R 820 0 R 821 0 R 822 0 R 823 0 R 824 0 R 825 0 R 826 0 R 827 0 R 828 0 R 829 0 R 830 0 R 831 0 R 832 0 R 833 0 R 834 0 R 835 0 R 836 0 R 837 0 R 838 0 R 839 0 R 840 0 R 841 0 R 842 0 R 843 0 R 844 0 R 845 0 R 846 0 R 847 0 R 848 0 R 849 0 R 850 0 R 851 0 R 852 0 R 853 0 R 854 0 R 855 0 R 856 0 R 857 0 R 858 0 R 859 0 R 860 0 R 864 0 R 865 0 R ] >> endobj -805 0 obj << +809 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 758.4766 539.579 767.4329] /Subtype /Link -/A << /S /GoTo /D (subsection.6.2.20) >> +/A << /S /GoTo /D (subsection.6.2.19) >> >> endobj -806 0 obj << +810 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 746.5215 539.579 755.4777] /Subtype /Link -/A << /S /GoTo /D (subsection.6.2.21) >> +/A << /S /GoTo /D (subsection.6.2.20) >> >> endobj -807 0 obj << +811 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 734.5663 539.579 743.5226] /Subtype /Link -/A << /S /GoTo /D (subsection.6.2.22) >> +/A << /S /GoTo /D (subsection.6.2.21) >> >> endobj -808 0 obj << +812 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 722.6111 539.579 731.5674] /Subtype /Link -/A << /S /GoTo /D (subsection.6.2.23) >> +/A << /S /GoTo /D (subsection.6.2.22) >> >> endobj -809 0 obj << +813 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 710.656 539.579 719.6122] /Subtype /Link -/A << /S /GoTo /D (subsection.6.2.24) >> +/A << /S /GoTo /D (subsection.6.2.23) >> >> endobj -810 0 obj << +814 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 698.7008 539.579 707.6571] /Subtype /Link +/A << /S /GoTo /D (subsection.6.2.24) >> +>> endobj +815 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [527.6238 686.7456 539.579 695.7019] +/Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.24.1) >> >> endobj -811 0 obj << +816 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 686.8453 539.579 695.8514] +/Rect [527.6238 674.8901 539.579 683.8962] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.24.2) >> >> endobj -812 0 obj << +817 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 674.8901 539.579 683.8962] +/Rect [527.6238 662.935 539.579 671.7916] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.24.3) >> >> endobj -813 0 obj << +818 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 662.935 539.579 671.941] +/Rect [527.6238 650.9798 539.579 659.9859] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.24.4) >> >> endobj -814 0 obj << +819 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 650.8801 539.579 659.8364] +/Rect [527.6238 638.925 539.579 647.8812] /Subtype /Link /A << /S /GoTo /D (section.6.3) >> >> endobj -815 0 obj << +820 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 638.925 539.579 647.8812] +/Rect [527.6238 626.9698 539.579 635.9261] /Subtype /Link /A << /S /GoTo /D (subsection.6.3.1) >> >> endobj -816 0 obj << +821 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 626.9698 539.579 635.9261] +/Rect [527.6238 615.0146 539.579 623.9709] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.3.1.1) >> >> endobj -817 0 obj << +822 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 615.1143 539.579 623.9709] +/Rect [527.6238 603.1591 539.579 612.0157] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.3.1.2) >> >> endobj -818 0 obj << +823 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 603.0594 539.579 612.0157] +/Rect [527.6238 591.1043 539.579 600.0606] /Subtype /Link /A << /S /GoTo /D (subsection.6.3.2) >> >> endobj -819 0 obj << +824 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 591.1043 539.579 600.0606] +/Rect [527.6238 579.1491 539.579 588.1054] /Subtype /Link /A << /S /GoTo /D (subsection.6.3.3) >> >> endobj -820 0 obj << +825 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 579.1491 539.579 588.1054] +/Rect [527.6238 567.1939 539.579 576.1502] /Subtype /Link /A << /S /GoTo /D (subsection.6.3.4) >> >> endobj -821 0 obj << +826 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 567.1939 539.579 576.1502] +/Rect [527.6238 555.2388 539.579 564.1951] /Subtype /Link /A << /S /GoTo /D (subsection.6.3.5) >> >> endobj -822 0 obj << +827 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 555.2388 539.579 564.1951] +/Rect [527.6238 543.2836 539.579 552.2399] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.3.5.1) >> >> endobj -823 0 obj << +828 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 543.2836 539.579 552.2399] +/Rect [527.6238 531.3284 539.579 540.2847] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.3.5.2) >> >> endobj -824 0 obj << +829 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 531.3284 539.579 540.2847] +/Rect [527.6238 519.3733 539.579 528.3296] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.3.5.3) >> >> endobj -825 0 obj << +830 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 519.3733 539.579 528.3296] +/Rect [527.6238 507.4181 539.579 516.3744] /Subtype /Link /A << /S /GoTo /D (subsection.6.3.6) >> >> endobj -826 0 obj << +831 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 507.4181 539.579 516.5239] +/Rect [527.6238 495.4629 539.579 504.5687] /Subtype /Link /A << /S /GoTo /D (subsection.6.3.7) >> >> endobj -827 0 obj << +832 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 485.4804 539.579 494.2126] +/Rect [527.6238 473.5253 539.579 482.2574] /Subtype /Link /A << /S /GoTo /D (chapter.7) >> >> endobj -828 0 obj << +833 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 473.5451 539.579 482.5014] +/Rect [527.6238 461.59 539.579 470.5462] /Subtype /Link /A << /S /GoTo /D (section.7.1) >> >> endobj -829 0 obj << +834 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 461.59 539.579 470.6957] +/Rect [527.6238 449.6348 539.579 458.7405] /Subtype /Link /A << /S /GoTo /D (section.7.2) >> >> endobj -830 0 obj << +835 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 449.6348 539.579 458.7405] +/Rect [527.6238 437.6796 539.579 446.7854] /Subtype /Link /A << /S /GoTo /D (subsection.7.2.1) >> >> endobj -831 0 obj << +836 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 437.6796 539.579 446.7854] +/Rect [527.6238 425.7245 539.579 434.8302] /Subtype /Link /A << /S /GoTo /D (subsection.7.2.2) >> >> endobj -832 0 obj << +837 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 425.7245 539.579 434.8302] +/Rect [527.6238 413.7693 539.579 422.875] /Subtype /Link /A << /S /GoTo /D (section.7.3) >> >> endobj -833 0 obj << +838 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 403.7868 539.579 412.5189] +/Rect [527.6238 391.8316 539.579 400.5637] /Subtype /Link /A << /S /GoTo /D (chapter.8) >> >> endobj -834 0 obj << +839 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 391.8515 539.579 400.8078] +/Rect [527.6238 379.8963 539.579 388.8526] /Subtype /Link /A << /S /GoTo /D (section.8.1) >> >> endobj -835 0 obj << +840 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 379.8963 539.579 388.8526] +/Rect [527.6238 367.9411 539.579 376.8974] /Subtype /Link /A << /S /GoTo /D (subsection.8.1.1) >> >> endobj -836 0 obj << +841 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 367.9411 539.579 376.8974] +/Rect [527.6238 355.986 539.579 364.9423] /Subtype /Link /A << /S /GoTo /D (section.8.2) >> >> endobj -837 0 obj << +842 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 355.986 539.579 364.9423] +/Rect [527.6238 344.0308 539.579 352.9871] /Subtype /Link /A << /S /GoTo /D (section.8.3) >> >> endobj -838 0 obj << +843 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 334.0483 539.579 342.7804] +/Rect [527.6238 322.0931 539.579 330.8253] /Subtype /Link /A << /S /GoTo /D (appendix.A) >> >> endobj -839 0 obj << +844 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 322.113 539.579 331.0693] +/Rect [527.6238 310.1578 539.579 319.1141] /Subtype /Link /A << /S /GoTo /D (section.A.1) >> >> endobj -840 0 obj << +845 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 310.1578 539.579 319.1141] +/Rect [527.6238 298.2027 539.579 307.1589] /Subtype /Link /A << /S /GoTo /D (subsection.A.1.1) >> >> endobj -841 0 obj << +846 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 298.2027 539.579 307.1589] +/Rect [527.6238 286.2475 539.579 295.2038] /Subtype /Link /A << /S /GoTo /D (section.A.2) >> >> endobj -842 0 obj << +847 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 286.2475 539.579 295.2038] +/Rect [527.6238 274.2923 539.579 283.2486] /Subtype /Link /A << /S /GoTo /D (subsection.A.2.1) >> >> endobj -843 0 obj << +848 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 274.2923 539.579 283.2486] +/Rect [527.6238 262.3372 539.579 271.2934] /Subtype /Link /A << /S /GoTo /D (section.A.3) >> >> endobj -844 0 obj << +849 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 262.3372 539.579 271.2934] +/Rect [527.6238 250.382 539.579 259.3383] /Subtype /Link /A << /S /GoTo /D (subsection.A.3.1) >> >> endobj -845 0 obj << +850 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 250.382 539.579 259.4877] +/Rect [527.6238 238.4268 539.579 247.5326] /Subtype /Link /A << /S /GoTo /D (subsection.A.3.2) >> >> endobj -846 0 obj << +851 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 238.4268 539.579 247.5326] +/Rect [527.6238 226.4717 539.579 235.5774] /Subtype /Link /A << /S /GoTo /D (subsection.A.3.3) >> >> endobj -847 0 obj << +852 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 216.4891 539.579 225.2213] +/Rect [527.6238 204.534 539.579 213.2661] /Subtype /Link /A << /S /GoTo /D (appendix.B) >> >> endobj -848 0 obj << +853 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 204.5538 539.579 213.5101] +/Rect [527.6238 192.5987 539.579 201.555] /Subtype /Link /A << /S /GoTo /D (section.B.1) >> >> endobj -849 0 obj << +854 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [522.6425 192.5987 539.579 201.7044] +/Rect [522.6425 180.6435 539.579 189.7493] /Subtype /Link /A << /S /GoTo /D (section.B.2) >> >> endobj -850 0 obj << +855 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [522.6425 180.6435 539.579 189.7493] +/Rect [522.6425 168.6883 539.579 177.7941] /Subtype /Link /A << /S /GoTo /D (section.B.3) >> >> endobj -851 0 obj << +856 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [522.6425 168.6883 539.579 177.7941] +/Rect [522.6425 156.7332 539.579 165.8389] /Subtype /Link /A << /S /GoTo /D (section.B.4) >> >> endobj -852 0 obj << +857 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [522.6425 156.7332 539.579 165.8389] +/Rect [522.6425 144.778 539.579 153.8838] /Subtype /Link /A << /S /GoTo /D (section.B.5) >> >> endobj -853 0 obj << +858 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [522.6425 144.778 539.579 153.8838] +/Rect [522.6425 132.8228 539.579 141.9286] /Subtype /Link /A << /S /GoTo /D (section.B.6) >> >> endobj -854 0 obj << +859 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [522.6425 132.8228 539.579 141.9286] +/Rect [522.6425 120.8677 539.579 129.9734] /Subtype /Link /A << /S /GoTo /D (section.B.7) >> >> endobj -855 0 obj << +860 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [522.6425 120.8677 539.579 129.9734] +/Rect [522.6425 108.9125 539.579 118.0182] /Subtype /Link /A << /S /GoTo /D (section.B.8) >> >> endobj -859 0 obj << +864 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [522.6425 109.0122 539.579 118.0182] +/Rect [522.6425 97.057 539.579 106.0631] /Subtype /Link /A << /S /GoTo /D (section.B.9) >> >> endobj -860 0 obj << +865 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [522.6425 96.9573 539.579 106.0631] +/Rect [522.6425 85.0022 539.579 94.1079] /Subtype /Link /A << /S /GoTo /D (section.B.10) >> >> endobj -804 0 obj << -/D [802 0 R /XYZ 85.0394 794.5015 null] +808 0 obj << +/D [806 0 R /XYZ 85.0394 794.5015 null] >> endobj -801 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F21 654 0 R /F39 858 0 R >> +805 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -863 0 obj << +868 0 obj << /Length 69 /Filter /FlateDecode >> stream xÚ3T0 endobj -862 0 obj << +867 0 obj << /Type /Page -/Contents 863 0 R -/Resources 861 0 R +/Contents 868 0 R +/Resources 866 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 655 0 R +/Parent 659 0 R >> endobj -864 0 obj << -/D [862 0 R /XYZ 56.6929 794.5015 null] +869 0 obj << +/D [867 0 R /XYZ 56.6929 794.5015 null] >> endobj -861 0 obj << +866 0 obj << /ProcSet [ /PDF ] >> endobj -867 0 obj << -/Length 2199 +872 0 obj << +/Length 2197 /Filter /FlateDecode >> stream -xÚÝYÝã¶÷_áG-pVù-2o½»¦¸ ¸¢Ý
òäA+qmádIÑÇnœ¿¾Ci˶|wè-Ð X`M†äpæ7¿ÚtMவL 7b‘JBåºØ¯Èzïþ¾¢AGHžJÁ9<,¼ÝH®S©Y¶ÞÌyû°úË÷Œ®I•brýðtÜKe:5\˜õCùsòn—w£íï6L’„ÞýúðNi¦3ê¦ØB¦™!ÚOøÐŒ}[NÅXµMPçk“ÅTÔÎ`.˜ë´v–ÖÊM³}cG|zßîóªÁñÇ|tîÃh÷8þ…Hòþã=|P'È’¢m†j|Ý>áç×͘ÿ„mu¶¨žš
ìw±ŠmÆj¬Pš%ÕMºIpFw*JS#%‹>‡áŒ$î œÑ$ÇÇ]eû¼¿£:)vU‘×(ÝçMnÎDò\£=îM§“©v›»E¦Á–(j{”¶¶Û|¬šmØgwm_`æ%í³
ºþpa‡¼ +…(8É;øìDÔŸ¨ÚwµÝƒr×
CÇ]î•É$/Æ)¯ëÊ÷y7à(ºT¼ÏA4‹³›X–Þvì‚š'UT-ó1Gµjˆ+W`AÕ8¸g·>nýZíÔ¡¢·›@ÒWÓè‘KñpR·ùc§"åB±€bAR¦8bž¦ -ôœA)*l7Fê8³“fDÖ±›Ö± R -+úF…ÓŸ°3± -šD
n:% -Z¹b¿úmõó¯d]®Èú‡I¹Ð¾ÀxÓ¶Þ¯‡!‘:JêÕýê_ÿå¬hǬ=¸iÎ#°VFPŸ/µ‰gÚP¡`KM_C]À™§”XF˜Tî9¾i -w”Xó®ÜÆ™LAO¯ç[|›ÕÇ%¿`6‡†QèÌœ›ýÓ#ÉM¸ã¡¾>„t±’ò!\:”ŽM˜û¿ƒãPé¡Kÿú3Å7áÄ(ðŸá§o5ù"œ\ƒ)mrǯnàãÎ}âèVp¸ÑVÛ£€%?þûoPs×ãLxŽuíâ;ƒˆ£ôýÕ7\îû `ûýù«Ð±ÞFôì”ß渢/=÷¡%DÏ<÷}õ»ãXôûR•ãî6x_ÍÞ?xc _‘‰I…êKà¥<%œEˆ§²¬ÒÇš×MŸÁÏl£WcÄKã…^ÄÏÜø€~ò -B·€ójæþYpÃÜW\Uî -7&æ?ø]ýðÇ<¡nÀ|õ⯃ñG¿
—©û
q=23"ÖAÉE!»r{üñ´RÜí?q7{endstream +xÚÝYÝã¶÷_áG-pfù)‘y¼»¦¸ ¸¢Ý
òæA+qmádÉÑÇnœ¿¾C)˶|wé-Ð X`M†äpæ7¿ÚlMáµ"T¹ÎŒ$Š2µ.ö+ºÞ»¿XБJ%…€‡…·%4QšgëÍ|‘·«¿|ÏÙšS’¦\ž¦½ÒL#¤Y?”?'ïvùa°Ý݆+š°»_~Ài’d:cn…-ÉÕ~‡fèÚr,†ªm‚ºXbRžFí悹Nûagaiºi¶kì€OïÛ}^58þ˜ïƒÎý±ìÇÿ¦Š¾ÿxÌ ²¤h›¾ê‡_·Oø9Äõûc3ä¿ad[TOÇÍö»XÅ6C5T(Í’êŽ%
Ý$8£;cÄ(Å£Âa§‰;ˆà,ÉñqWÙ.ïî˜NŠ]Uä5J÷yÓ€›3™¼Ðh{ÓÝéd¬Ýæn‘±·%ÊŸÚ¥í6ªfö‡]ÛU˜yDIûlƒ®?\Ø!oÂJa+Nò>;ó'ªö‡ÚîÁ¹ë†ƒ¡Ã.wáÊT’Ø×õåûüÐã(ºT¼ÏA4‹³›X–Þ¶ïmOÀ-ˆ*ª–ù£ZÕÇ•+° jœÜ³‡ˆ[·~v< ¢·›@ÒUãàQKñpR·ùcg’™ò€bI Obž +ôœA)*ìaˆÔqf§†d +DÖñ›Öñ R +}å7A,û+£c”ú…%%”Æ8yÿiU¢¿^OI¢0SÔƒ©C>”‚e”<÷á!8|V5T•ËãWóø·áÕÓØøú*ÉsUž›vð>¯Jœ‹–D‚A G +OyùœCÖ•“¦Ï@´64* >2óNgÃŒ&ÌõÀçUlN¾.ÝR Ñ#ë›0Hõ§øn*·Ø†¤°ÝàK{hîôËŒB/-RvÍi¢n0‚b‰ÒHUéŒ +êj»^¬ûh‚*"¸‘K4Ñ·õ3v£®tgihM2îc`ˆŠw.°Ëº>,)…¼â`7!] +>YÉàT&³ëdQ¶®ÂŠ¾QaÁô'ìL, +¸×S^ÛIÀ“ÿõ÷7¨¹kûa¦ ¼VÇêvñÍA
DŠÑ
úþ®ø} °ÝþüUè[o#zvÊosÜÑ—žƒ[Ñ¢gžû¾úÍql +ôûR•Ãî6x_ÍÞ?xc _‘©!RªôKàe‚PÁ#ĆSYVébÍ;ŒŸÁÏl£WcÄK㡪/ágnü@?y +š[}¡[Ày5sÿ,¸áî‹®Œ¥î +ADÆåüg¿«Ÿÿ¸§` Ô
˜¯µ^ü0þô·Š¸_Ñ# §r”\²+·Ç_O+ÅÝþ-Õ«endstream endobj -866 0 obj << +871 0 obj << /Type /Page -/Contents 867 0 R -/Resources 865 0 R +/Contents 872 0 R +/Resources 870 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 881 0 R +/Parent 886 0 R >> endobj -868 0 obj << -/D [866 0 R /XYZ 85.0394 794.5015 null] +873 0 obj << +/D [871 0 R /XYZ 85.0394 794.5015 null] >> endobj 6 0 obj << -/D [866 0 R /XYZ 85.0394 769.5949 null] +/D [871 0 R /XYZ 85.0394 769.5949 null] >> endobj -869 0 obj << -/D [866 0 R /XYZ 85.0394 582.8476 null] +874 0 obj << +/D [871 0 R /XYZ 85.0394 582.8476 null] >> endobj 10 0 obj << -/D [866 0 R /XYZ 85.0394 512.9824 null] +/D [871 0 R /XYZ 85.0394 512.9824 null] >> endobj -870 0 obj << -/D [866 0 R /XYZ 85.0394 474.7837 null] +875 0 obj << +/D [871 0 R /XYZ 85.0394 474.7837 null] >> endobj 14 0 obj << -/D [866 0 R /XYZ 85.0394 399.5462 null] +/D [871 0 R /XYZ 85.0394 399.5462 null] >> endobj -871 0 obj << -/D [866 0 R /XYZ 85.0394 363.8828 null] +876 0 obj << +/D [871 0 R /XYZ 85.0394 363.8828 null] >> endobj 18 0 obj << -/D [866 0 R /XYZ 85.0394 223.0066 null] +/D [871 0 R /XYZ 85.0394 223.0066 null] >> endobj -875 0 obj << -/D [866 0 R /XYZ 85.0394 190.9009 null] +880 0 obj << +/D [871 0 R /XYZ 85.0394 190.9009 null] >> endobj -876 0 obj << -/D [866 0 R /XYZ 85.0394 170.4169 null] +881 0 obj << +/D [871 0 R /XYZ 85.0394 170.4169 null] >> endobj -877 0 obj << -/D [866 0 R /XYZ 85.0394 158.4617 null] +882 0 obj << +/D [871 0 R /XYZ 85.0394 158.4617 null] >> endobj -865 0 obj << -/Font << /F21 654 0 R /F23 678 0 R /F47 874 0 R /F39 858 0 R /F48 880 0 R >> +870 0 obj << +/Font << /F21 658 0 R /F23 682 0 R /F47 879 0 R /F39 863 0 R /F48 885 0 R >> /ProcSet [ /PDF /Text ] >> endobj -884 0 obj << -/Length 3270 -/Filter /FlateDecode ->> -stream -xÚÍZK“Ûƾï¯à‘[%NægnkKŠå*l-S®ÄÖ$†$J -“&áì?¤Piªgû› 4"Œñ3åÍÃÍÏý†ƒU÷ꤦ”ÚDzBUÚL©*LEd` UµÜYoS—e}*ª-ý\×Õ£º¢®ZšÈ·*™3ñ±µ9ŠŠž¹mׇ¢¼PoèÙù¾{sÿ²ßü7)õöxÈð¯©Kû×K•F‰ˆ”®ƒ@ÀÿïÒ©NE,ãþgoy>äœB¤aøè= {ñп1ÞjáeZÄF‹P½½‚¡kÇH“x›|IFd®[¥Ô¼ê|:[¨D3ÿåVˉ.ôßvOú
ÒX¤*Åsz^þ;éPîâÿDaZŠ0„½'=ÜkLÃíÂÀiì£}:ÕÎwóe‡ø‘^Ñ:¦¥£~]|FÏŽ¤œÿRäÝîym#éŸ\]FæWÕ¥4ì&)<f‡"[•öÕÕ€‹?¯®¢âc„_וÄXRšyçÂ]VúHØ;¸‰‘‘áü×åmªçösÇkmµ.ë«ØÙ~:Ž¢ëê?Ú®ýð¬F‡¼þQ=g˜ÿGxÕ2I*_ “c†©î*åé8Ab åE`?Éúl55S0äÃA΋`W™‚æ€$ømŸý^ÖûÌ›ã>ÛóìÃSÛÙý5<pWcä@<™Æé «&zÞMí"q¢(#Âd·sþ -`{<gV‘¼z†ÕH‰(¼ªº]ÖýÙ/âv›UÅ|ÆŒ±D‘3ûÙzÍ!N´šž4O””©%
/§;'ë‘kbè¢Ã3Ë÷E…wV-ÍjÌ€èpá™Î_e.ÀRUçLDXÃx¬az~ÑÏSå¢KXxÈ„^NDŒUÝH±×Ú„˜˜$q8¸D°9¡&3ßÏ•?Ã=ÊleKfÝÄ)Å€R¢ 2ãkëm©•æû¯Ë¥<†R½ÈŠ±Úp B d[ùL -âNœªa©ënB· -`wù -!A=]Ĺ%aØ€<Éä»!ÉDA‚Šž§CÑu–`Ò¤QÆïgôÀícÀ@ž¥×ŽÁAýÎå Åv×ÑÐ)‰í†g(Ààþ¶ÉÀÁýÀ3¯;ôp(…æwcð@·Æ±@a©²¾€««’1ÅÊw]ª’*O -Ý€+ë}“USaNC²0&ò×ñÕèø7ÕZL¥óX$‘ñ¡q]ËœŽYÙ‰N‚I…†¼ÅÔõñ€| -–S -L.ß»Çeð¨ï³gLÉ©s"gÀÒ&ñÂØk -€ -¾ -ŠÆáîW}ÞžêL\ï6pTCÙ©R=ÔÐôí
WiåÖÅ¢¤J,÷w\õEWpTP‚î‹mÅÕÜfºÚŒ¸Ë¡â‰¥áÄ m €`Ù2q¸±‡aµ÷.và bÍÆß¼fR£¹õM…¶{ÞQT -U+”3-›Ä|ÃSzúÅð…k+]ï{å+wS¾¢!^F‘R#~®¿ xªopq½Ûó]ä8}ÝÅ0ÜÅøç3ywÜ£ÀAh3Ó‡ÚÆ°vÀ»®µÑ©+øMŒõ xÅR‚–€7Š=Æ‘¬âéŽÏ²RHG>g8]à /6ÈÁ†3kµæ“W¶;Y,Ïh*Í2Œ¯Í +889 0 obj << +/Length 3125 +/Filter /FlateDecode +>> +stream +xÚÍ]“Û¶ñý~…u3‹~öíÛ3“sb«“i<P"¤ã˜"’:ùò뻋]P¤„³Ý6fî+`ìö'þä"Šƒ8SÙ"É 2Zl7b±‡¹¿ÝHÆY9¤Õë›õÍ_^ëd‘Y¬âÅz7Ù+
DšÊźø°”AÜÂb¹þîÕíJEbùòíwoî ¾¿ûGßÿãýúÕÿ""ñòþ=|äíJÊ8Ëo¿»ûqýêÍKÞòÍýúÝÛ—ÿvýæíýí¯ëïo^Gª§œI¡‘äßn>ü*0øýt–F‹üÌ2µ8Ü„‘¢Pk7Rݼ¿ùiÜp2k—z%%E t¬<¢RÚ'ª(b
S(ªõƒ!övMU5§²ÞÓÏmS?šz(›º§¼»•é’‘½)*kú¦ßve;YÐìè;¸¾ysÿrÜü!ÔþØå¸ÀÉ_¨ÊüõR¤qÄR +h€½t+æ[O«D« ’ᨯpjÚIdi²Ht¶$bR×”rÙLe¾™dª´^þ|«ÄDEòï‡'|Ã, 2™á9#-ÿw(G
wñ"0%‚(‚½½î$¦àö…Qh%öÑ<k»E¼ƒÿÈ&K”JèDa±_—ŸÐ²c!–?—Åðð¼´ˆìO.. +3o»Ë+ç Ûã +Ë~€Ìá8XWèE>䛼7ãêìa á~ ÐizÚ®¬wMwp¦ð“fy»ò ¿%µbÞìl~ÉåCÓ4^c=VÔˆú#!åEÁÇ÷…l +€ÇrkëÑt}nS@FYѨ]؇ñü íYŸ÷j@û(ÚÀæ¸3ŽÈ{lØN&ü µm¶ùo0.ƒØŠÔ.û¶*AÿÖÚ¢eÕ4 :¶ôKÖЗӷÈ\[¹|"4ZqÊÊeÍrH…î=CÙ,ͦ™yìPk/Z2rUB êžlÆù‚Î;=Ði½©ææ·£éJ« @¡ëWµfº…À÷À¦ä¡µ¨,‹æ¶S[“×ö°µì!| +‘(¶ +ÕVx ›–ÎC™k'HX-hÊ€®V±ŠèÊá$yI„2>zæäpd¼<VW8õÌ +| „S»P +B×ó9õÅ|›4´£xx qFPB¬ßæ©kɆO’ÉiišÁ#[ %J;…ûS8„J#E9%óhº¦\8ä̾¤rvÞe(GA„š¾§®Ã?0j”óúœ>è£mdØ +¾•“Â` nç‰p€rÿ0h…‚ÈfÇ#äbpÓæ`àn›À·h´p(©–w¾|È’@Ž©6®lꊓŠëÞÔ%DU‚O%ìÌÊ]]Ë7¿æüƒÏ›y¼¶÷2ŸòC[ÙËD.G‹˜-R÷[ÃXœ®áÀ@dB0°mm^ûÜœ‚h¡uì®ã«Ùñoêmà‹çIÆÚ¹Æms¬ +:fc<
µ".ÆnŽÒ0ŸPæ3P©ƒ( åxûÉ:#ˆ0fÚ:a^xNZæÝ̬T2Rê=@‘:Gƒ.³”D50˜WK#•yD«@ÐéÃ"6„Gi×5 Ò +Xÿ»üGAfn˜cSï]Z0—.zSá8ä]}IR™f\æD{Üœý0¸Í4 ’0Œæ^ +b5:”ÀyÈ,º¸+¤€$u9@yß7Û’C.üƸH«#™D³dŒf +Î +J}¹¯¹šÛù«Í˜Û2ñLM/ :i
5 +÷&M¾d)#þjºàZK×û^ÙÊÏVøË8–rFÏõÛ‚Ãú×»=ßÆ@Š³8UWmÍmŒ>v/›øª„JÓ£¯mM‡ÅŽ lÛÖZe¶â×cú ŬÕ+Ö4a“ XQБä5|ÔíC2:Íñ¢Ü!;õ–OÞ˜ád°>C$_œEI¾Ò“”×qHHS9kí=³¡-¡:½Åø—êw½ypv»ï¸) +S™ýä-ç깇bë¤Âˆ;=Ÿµmê®c?Ý*؇ñù »”åþèmÓ+ô‚¥ÿ±%:W€Ï$üE‰ endobj -883 0 obj << +888 0 obj << /Type /Page -/Contents 884 0 R -/Resources 882 0 R +/Contents 889 0 R +/Resources 887 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 881 0 R -/Annots [ 891 0 R 892 0 R ] +/Parent 886 0 R +/Annots [ 896 0 R 897 0 R ] >> endobj -891 0 obj << +896 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [272.8897 231.1055 329.1084 243.1651] +/Rect [272.8897 210.0781 329.1084 222.1378] /Subtype /Link /A << /S /GoTo /D (types_of_resource_records_and_when_to_use_them) >> >> endobj -892 0 obj << +897 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [190.6691 203.5826 249.6573 212.9922] +/Rect [190.6691 182.1322 249.6573 191.5418] /Subtype /Link /A << /S /GoTo /D (rfcs) >> >> endobj -885 0 obj << -/D [883 0 R /XYZ 56.6929 794.5015 null] +890 0 obj << +/D [888 0 R /XYZ 56.6929 794.5015 null] >> endobj -886 0 obj << -/D [883 0 R /XYZ 56.6929 756.8229 null] +891 0 obj << +/D [888 0 R /XYZ 56.6929 756.8229 null] >> endobj -887 0 obj << -/D [883 0 R /XYZ 56.6929 744.8677 null] +892 0 obj << +/D [888 0 R /XYZ 56.6929 744.8677 null] >> endobj 22 0 obj << -/D [883 0 R /XYZ 56.6929 651.295 null] +/D [888 0 R /XYZ 56.6929 649.0335 null] >> endobj -888 0 obj << -/D [883 0 R /XYZ 56.6929 612.4036 null] +893 0 obj << +/D [888 0 R /XYZ 56.6929 609.5205 null] >> endobj 26 0 obj << -/D [883 0 R /XYZ 56.6929 567.3837 null] +/D [888 0 R /XYZ 56.6929 551.1302 null] >> endobj -889 0 obj << -/D [883 0 R /XYZ 56.6929 542.6255 null] +894 0 obj << +/D [888 0 R /XYZ 56.6929 525.7505 null] >> endobj 30 0 obj << -/D [883 0 R /XYZ 56.6929 441.1968 null] +/D [888 0 R /XYZ 56.6929 422.4834 null] >> endobj -890 0 obj << -/D [883 0 R /XYZ 56.6929 415.1634 null] +895 0 obj << +/D [888 0 R /XYZ 56.6929 395.8284 null] >> endobj 34 0 obj << -/D [883 0 R /XYZ 56.6929 188.7253 null] +/D [888 0 R /XYZ 56.6929 166.2827 null] >> endobj -893 0 obj << -/D [883 0 R /XYZ 56.6929 161.3171 null] +898 0 obj << +/D [888 0 R /XYZ 56.6929 138.253 null] >> endobj -882 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F47 874 0 R /F39 858 0 R /F21 654 0 R >> +887 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F47 879 0 R /F39 863 0 R /F21 658 0 R >> /ProcSet [ /PDF /Text ] >> endobj -898 0 obj << -/Length 3430 -/Filter /FlateDecode ->> -stream -xÚ¥ZÝsÛ6÷_¡·È35@>ºMrMg’ôwn:m(‰²8¦HHÅõýõ·‹]€”'íÜøAà\,»¿ý åBÀŸ\&ºÌ®Ì3#¤Y¬÷Wbqsÿ¼’¼æ&,º™¯úþîêoµ[”Yi•]Ümg¼ŠL…\Üm~[þðãíÏwo>]ß(#–2»¾1V,ß}¸ûôñõ/?ܽûøáúFJëp.çÙ»ßÐò×ßß¾û@ã·ï™úù×ÏwoÞÓøwaÄëŸáG^ÿq÷ÓÕ›»(õüdRhù?W¿ý!8àOW"Óeað 2Y–j±¿ÊÎL®u ´WŸ¯þÎfý«)M]d¦P.¡*¥Sª2ef5L¡ªÞöG8•Ê—M7ŒU·®¿ƒG-–뾚Mí'ÍrÜÕxTÐ}9c(¥ÎÊ6žUýgµ?´u¶î÷´ølwë²²’×nú}Õt´óã®YïhŸ¦[·§M=ÐDWíih–É–äËjHIba\JËÜwý0fUUeA$|eq£ÌJ•ƒMI£üâ´¸JdÊšVÝ&µk™)¡Ô|ÓÕj•}]Rɬ(\x«þR£t:îO÷xHý’¾Î¬2QÝè%/ýoßÕ´ÉLÁ°MßµODßÔm}_
Ü:MmÁ.HiBg©¥½`&+Jk‚Òf²”™ËÕ7”\€™ ®oë÷œ'ž| -ýÄ
¿W¾ñx-‹e=\¼Âþ„ÃÙÞ+~‡oºfòÈõÀôHCt;
õñK}È}Ĺ¼¯(Ã/(a—Þ¥Ù¯ -Ææï"î„¢ly«1nù|/@We]Î<Æú¸oºªMl¦s¸YaÏ7wÕÈ›
LÚU|²®Olgm&TpÊá´¢³
‰ýr—¹°Ð›¯™+<¾Ê.ê :X)Ï/ÈëX;o¾ÚNˆ‹$ð4?¨™'§yn°®#Ñé*aà/°ïGZ¹{“Žû¸I6[ƒ¬wá}Ònßö÷¼#±° *ÞªéÆS36_êIÊ3Ã#zDãN÷÷dûàœtH~êOD"ƒ«6Dþôö‡F—µw¤‡9½FxÖ0Ëž(÷^-š€ -ÔXCõ@ÏMÛ’ia’ÐÑ£9<Wô”ºM"c÷Dñ˜‚ZÈ -¸{|*./ðÎ4ÏçR!`à -ÖëÓè‚9„ó÷?ÄTvODp„'¦õDò³ ’úHxôM½‚ÐO¸Þtp -üÈ4vÕ'îëbq„Ç}½ÞU]<PfâÁ‹‡)Äa†QR‡^˜¡ô£ð†Òü%13JP=°&¢ÔÄW0³©0ðÅEò‚¡–´6?où¦§g–¸h“ÉÜËê“i¦›1gp©¯rÍef¤6Ñ~øÊJ@^(€Î*¡wˆoÒ5C¾®J …ÙõõÌÖ•dã’f^‰ºòô'"Ra*)ÛöÝ…pHãEÑb€æÛ@%óöØ:gŠ}V_•ÎG™8²¾P#öÛ´vUîbÿù`³&õž -L8éí”_éü%›•VfBä¡ -¥BÒ=ó8°k„Óâ²sÍ€¨µ!Žö“ S=szJ†€\…îÐ|€Å>[@ú®ëw:AöC`ñ\5ª<0…9\<BV?l“ÁÉÀ½Ø\NÁÂØò2XèЊB^dQŽÚ¤¥û¯Àó\K¼1ôµ„醹ÛëÎÒmR]çb„óŒŒ%EÎî
ë}ÎÌÁ¹-†úahV[÷”1àmÐ[cJ†x‹8åmʨw] -îcpËGªd6¡*©¸T™¼4TF04a‡ºåZêxg<æèí3cZñ¾M‡°óž ½Ìˆ¾è€/ -#qÙÜ#â¬kƒ\E‰YÒ&g‹œ¥=r–íHV‰¤L—Ekº|‡×õÛ±fH€³üRrj$9{¢ÏøøˆÚÚ5›MÌàXlV)8ÂÅ¡îM¾üHñ,GK¦iÛþâ˜x•ˆ4i¸—ªl(<4©¨Qe³wVõ®ñwr|$átêG4•¯}ÔÃMmûùퟺÉþ‚M¯ûýþ„í”B^äê˜ß6!ŒæÕŸFü¥˜ÿ¶›ì¥ÎÒ&Ãÿ¨J´9EüfôÿãÖôÿk¹Ã¬V¥û¥Z”øQ(TZù¬þÁë¹äÿ2/I¾endstream +903 0 obj << +/Length 3414 +/Filter /FlateDecode +>> +stream +xÚ¥ZKsã6¾ûWè¹jÍàA +a²¢´á¦f²”™ËÕW„\€Ž™ ®¯Ë÷tÎ +Bƒc34ÏõÈå‰â‘=½ r‚
öÇÇGÒ}0N: +$¿vG"‘ÂUk"þð}O-ˆÂ´7¤›9½D¸×ð”Q½X4 +Ú½¢¤bü²êÿr…û€º–Èuüç˜âÙKŠy{„°ëÐÆáäÍ0Å#÷—Ì‚² _Xy‡«4Øòǧǚh>½§Ç*x¶uÕs¿KÁ¶ÑOuÊ-~Çf->øDÄ)Ày•ZNŽ/£øLeð~È¿QtœOpÈëj¨¨EçÄ#é˜,¬`ÎÊ9ntáæ‹ëRÍÑO8Xð„òuÇ ‰¢¤tm}¨|Bd®@
*4‚I îêá¥;<õ¡jÚ#GCè‰c?ÐH¯4nã5ϯôÒQ£ã‰c†é©,é›RM•…#$΃B2Ü?Ô§ù"³Ü'ýsÝïï(áqór·[|+ÎðÊÔÏûRÁ]Cñüâ3ttý=FÜÞúÊ…ï_úxÉÏÏ
JÓŠqf–³ç–ºöÕê))ªz@¸4ºW@áüù÷1Ýá•iQ ùÜ
È@}!´úº^‚ã'T¯:Ø +n±=*‚«wzŒÐx¢KìÏñ¸‹¨i{ +˜0¸†¥^!ž¥ð +ÍÈ)´c‘Â|Fææ¡f63 +O=°& wœWðdcZ*…—™¤µùiÙȸýd‰ƒ6™Ì]Ь.dJÐæ&õÅYs™©MÔ>²W˜S·ùñMš fHÁWUOA +fD +_tÀ€ÌvØüM„ù¹…S &cÃQðføˆ‘€:úMϣΠ+4´â9§îåÌüváâ}Ï1[,ò\\ÔG S=Ÿ^ÌÉ:ÐmZc´“1àp¨/÷‚ã~¤Fñ_ [€ƒUÁÁÒß.¨rlõØpŸ…Ô8èm¨þ°·ì§_Såþpäœþå‘óß-¦ëE*ýCŸ«g¶ÌŒÖgeŽÑAè)èpÅÔ%_*{ Ðå7‚¤§ºÞûÀ(Þb1AÓ!ñG¢·Âñ¦+ܪ³_Ç¥÷uÍ7kÇ=uU+ +¢ü
XÇÃÕXT
p~ÅCê,x^®¤zç;š›ˆ|¦„§¹`õ\5mµ)"_œâ€´íÙ$X5ìÆ‹¬¦j¹Ž8Bé…D›^¿šr +¡‚—†HÙ[‚ÿï”(L‰Xãÿ¿ÿV5þ»,w™. +•®piQâEpd +£¼( endobj -897 0 obj << +902 0 obj << /Type /Page -/Contents 898 0 R -/Resources 896 0 R +/Contents 903 0 R +/Resources 901 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 881 0 R -/Annots [ 901 0 R 902 0 R ] +/Parent 886 0 R +/Annots [ 906 0 R 907 0 R ] >> endobj -901 0 obj << +906 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [519.8432 497.8292 539.579 509.8889] +/Rect [519.8432 463.1122 539.579 475.1718] /Subtype /Link /A << /S /GoTo /D (diagnostic_tools) >> >> endobj -902 0 obj << +907 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.0431 486.5416 133.308 497.9337] +/Rect [84.0431 451.8246 133.308 463.2167] /Subtype /Link /A << /S /GoTo /D (diagnostic_tools) >> >> endobj -899 0 obj << -/D [897 0 R /XYZ 85.0394 794.5015 null] +904 0 obj << +/D [902 0 R /XYZ 85.0394 794.5015 null] >> endobj 38 0 obj << -/D [897 0 R /XYZ 85.0394 603.5324 null] +/D [902 0 R /XYZ 85.0394 570.5252 null] >> endobj -900 0 obj << -/D [897 0 R /XYZ 85.0394 575.1064 null] +905 0 obj << +/D [902 0 R /XYZ 85.0394 541.3751 null] >> endobj 42 0 obj << -/D [897 0 R /XYZ 85.0394 470.0596 null] +/D [902 0 R /XYZ 85.0394 434.1868 null] >> endobj -903 0 obj << -/D [897 0 R /XYZ 85.0394 443.1738 null] +908 0 obj << +/D [902 0 R /XYZ 85.0394 406.5769 null] >> endobj 46 0 obj << -/D [897 0 R /XYZ 85.0394 339.8943 null] +/D [902 0 R /XYZ 85.0394 301.1559 null] >> endobj -904 0 obj << -/D [897 0 R /XYZ 85.0394 316.1468 null] +909 0 obj << +/D [902 0 R /XYZ 85.0394 276.6843 null] >> endobj 50 0 obj << -/D [897 0 R /XYZ 85.0394 241.2623 null] +/D [902 0 R /XYZ 85.0394 200.1512 null] >> endobj -905 0 obj << -/D [897 0 R /XYZ 85.0394 217.5147 null] +910 0 obj << +/D [902 0 R /XYZ 85.0394 175.6796 null] >> endobj -896 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F39 858 0 R /F47 874 0 R /F21 654 0 R >> +901 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F47 879 0 R /F39 863 0 R /F21 658 0 R >> /ProcSet [ /PDF /Text ] >> endobj -909 0 obj << -/Length 2282 +914 0 obj << +/Length 2458 /Filter /FlateDecode >> stream -xÚ¥Ërã¸ñî¯Ð-tÕŠK -¾÷\*TÐݎ؃¶~eX\/ˆÛ´E«µR*L£XÖ£úf©_õ¶FÜ^·§_xä¾;6Ä$u¤i±êšVà•´Ÿ0تkù>i²4}O -â’°Û1îˆóŸ™µ¥_~w¿ÀU@"H¥*ÙºËu×}^—¼?Çû›ÀÀã“5ðÉueZ¶%â0ÎcÈ>"%sŠÿûB`•æAÕø7(¼àº-
¸d³kñVÏ©ÆÝ(!1ܘ -x¨mO'Gx`=ª£¿w¾`6OÓ$x®@Œéâ‚kÏâÊE*(dãh.·ó-8ÒíŽÎÊ1…"tL°©Z[5Ú’ã#f׶wÆH,؇áÀšeó*/ÊÔ;Öì©·ÆM“Ê™·.ʺà<E(áq.žñ.]°bE’_Îølð›noMKË¡÷1ÓŸÛ®=7ÝЃ6„A8šÀ¹S6+'"jӾ؀<(“OÉ[aq:T%ciúa%uîwG°FŸ‰ÂÖÌ‘¬®ZÃ(UK¿ÖÀžˆ·ˆÿÈaRl8ta5&
¤ÖÓM0¸%§rÉc!ã¸
ê!¾°ØÜ'IP5ãŽÂ׿Œ1}Ëfóõ-ˆ¤©}vêû®¬Àíxªœ"aetÉ+Ÿ4·(Íêu²ùÅeõ‡:'ĬëJBÁ½ÄOÝñ¤;ÔÍíÞÈERʹéL«°ñ 1¥â,Øu.,ñ¼³¼0Ðe¸ÀT#`ÃJâ]óZË»›,™r¡ue¡†ºJ!‹©¢-Øó³R >Ý.u%Øfñ”_Q7K¥ -s;Þ1~e1½¨”û1¤4"ÏIŒ¼¥»ó·Ic¦ñk¢'(u~ê½öq²Ô|†€ü÷'Nf~ñeu6§c]…B*¢l¬«)WÕÛ¡œ†î°>C_\½ÖŒòµ«Íÿ<µgQðÃãÓGZùÑk6ýd«UŒtk¨ƒ1¢Ã]¶Æ_úi4¤#&@è<ýA*Å9Ž€pXë7suËÎÍv·¤ü©`ð´6û¬íÒEÍŸ§ù¤7Ž@ãh}?ûŸG£è²’|êNfª|±„9™G‚[~U -¿õûëÙ꽫bþ)åZu÷2æ÷¯½ê#´’ø!©µÈ¹td…ïô¤woºµú„ .‘d8¿å`v0
ºö’áz{àIãÞe\®- -—kóèÃEúRîlý§†ÙG'ç£éµ‚ç_ÒIKF·Yîì" -©üw£ŠkÇ{aØNÂ,/2ßå¹G°+³tÔ¹oÏÒ›éwU)›SÄ‚.R^MeÓ@NM¸"‰©ô¶ª+{& ¹:*2A0
hëÒ:ê]Nd{MX9G€_*ñHêÊäâŠØ0?ÏW¬Éf¸º°Ù‚‹^·ïE<³[¡¨’Ów% -ejѪ€Ç*EF ½ÍRqÕâqÖª)Ê_¸2PyL|Jwåˆ?/ÕºôýwÕö ö‹4xÝ=¼óýÊ~´^øZ…îÿþ6>ý‹ ÎB•çrúì®>Ç9a¡\In$÷ÑoEÿ7>“endstream +xڥ˒ã¶ñ>_¡[4Uš +Yþýî×ßÂU üù.TžÅ«LÂ@ä¹\5wQ¬‚8RÊCê»ç»Œg«n뢤DH•ÈQIµ$ª8K(ªwp9®‹®ý†òe8j[u-O{s¼ÙÚÐÔîyp8V>žiÒèÞš÷æøêÇ•íM½ãqO_ÍhÖèÚîö0^·³†y væHƒ’Yé˜ Û <á¯RFûª,a3(¤zò8–îªÌ6"z]_ô«âhý¹5´<ô<ØuÈ_ƒ‡·[ H‹1Ê!$2 +ëÖòT„ +‚>a·£ßÑÉå£-}ùÞý©àÓA"U¾x¬Û\wÝ·á°dý)^Üï¤`êðIxåº2í6ð0 +¢,‚Ì&Ò W2%ÿ¿Ïåô£’l]5ÞÇ
rϸn&™òšAÜÕs¨q; +G·{¦Â +jÛÓ +ú.Xêïè÷/Ž'·Ÿ+`cÚ¸˜‰F¿r¤rrÙ(œóíl–(ÊG¡ã™¼¡cp€IÕZÈ/–?r鼿3ÎA"Á6wÕ«€½0UohN`K½UnP*yí"¯Æ“2çâoÒ-ÆAžÇÙ•ãÌó›¯0ÕõÞgúsÛµç¦z†€â U07'*fÒumÚªERRaò*Y+Nûª`,M%Ü’`>…™#Y]µ†Qª–¾Ö3À–ˆ»èüñ„IP0a×…ÑT1¥\1e¨pKFå‚Ç‚ÍmÏW)}sÇëªgä^8þeôi¬‰7›_¨&&@(Mí£SßwEfW^×
F<òAspƒÂÌ¡^vS)q‘ý!Ï 1«è¡°àZâ§îxÒÇeó?놯d" ÅÜd&U˜ø€˜ÌBqº.;ç–¸ÞYôV¨2¨HJf9&,Ô««Cm,Ïn¢d„ÆT"c¦ù”Ñt‡ñY)Ÿn—ªì|ÒhŠ¯(›¥T +iâ;.Pw…°s7¨ì@Va$ê÷´DF…Þ˜óY€GZF£éKõê‰÷•]ÌÝÎ\‰)ZˆÂÒì²ÖEC•(_=HyrZ~DŠáefkŠ(Å6Ýá’P£0-$æçÔ
—‰µWìDh¢‰‰vh¶d¹×"oèB#®bê<‰&dg°¬[Ìx†ÙeÇêÞKÔØá¹}¾#Elr|¨¶uÏ«]|3–ϲ{ŠÃËÞ¡ýQcLÖÇÂJÍý’<_±Z0F~tmŒ0Öºå’ñ+‹áE%\!¥yNb<[:·;_6IÁÔ~Lô¥ÊO½U>Nšš÷ÿþÂÁÌ· ®CO8«Þ6åÔp…õ êâêàŸ¾tµùÓ]{®x|zO#ßzͺŸ4dq#°jà Ý*à MïD7ÃESzHJgoO0¦J
tžþ ”b„[@X¬õ«¹ÚÀiçfG»XGM ƒ»µÙ³–K9*œæÞØ] õõì·FW5ìÇîd¦ÌI蓹õȹäW9œ6´6¬=M»Ã:·Þ¾ËÆ%ÒŽÛªà 9=lá»~Ý[½µUÌŸR®åXw/c|ÏpÛA¡”Ä‹I¥EÆ©#Í}¥ ]¾êÖê4‚¸@’bÿ–A€aØÞ44êÚË×ëWw/ãbmž»X›…ÎÓ—bgëŸfNÎF“kÏ_’IJF³Y®ìB©ü»ÑÅwöB³i–§¾Ês—`3„£ØÍ’QVäº=MnºOX,«C6¦ˆU¤Ì.ãíÔSѦÈ/1•ÞVueÏ$SBCÅCL
ÚCaå.§DãZFÎàK)I]Ù/€œ_Ñ1|žóç«£Ig8ºÐÙ‚v¯Ë÷<šé-W”Iòé] @ì®wz]ª+chft¶ýð[ +ä4 Õ’BánUàhjU +e*Ѳ€Ç,EJ¡¼Mq 9jÕäå/œÆGi²5—Žøy©Ö…¯¿«vzOÖSo9¯ÞøoÒþ!²ðOH8&ºÿû—éï§(
T–Éå¿TðA8Ê€3åRjxùÿƒæ–õÿ÷Å:êendstream endobj -908 0 obj << +913 0 obj << /Type /Page -/Contents 909 0 R -/Resources 907 0 R +/Contents 914 0 R +/Resources 912 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 881 0 R +/Parent 886 0 R >> endobj -910 0 obj << -/D [908 0 R /XYZ 56.6929 794.5015 null] +915 0 obj << +/D [913 0 R /XYZ 56.6929 794.5015 null] >> endobj 54 0 obj << -/D [908 0 R /XYZ 56.6929 769.5949 null] +/D [913 0 R /XYZ 56.6929 717.7272 null] >> endobj -911 0 obj << -/D [908 0 R /XYZ 56.6929 749.4437 null] +916 0 obj << +/D [913 0 R /XYZ 56.6929 690.4227 null] >> endobj 58 0 obj << -/D [908 0 R /XYZ 56.6929 609.0996 null] +/D [913 0 R /XYZ 56.6929 550.0786 null] >> endobj -912 0 obj << -/D [908 0 R /XYZ 56.6929 584.3177 null] +917 0 obj << +/D [913 0 R /XYZ 56.6929 525.2967 null] >> endobj 62 0 obj << -/D [908 0 R /XYZ 56.6929 452.0712 null] +/D [913 0 R /XYZ 56.6929 393.0502 null] >> endobj -913 0 obj << -/D [908 0 R /XYZ 56.6929 422.2123 null] +918 0 obj << +/D [913 0 R /XYZ 56.6929 363.1913 null] >> endobj -907 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F47 874 0 R >> +912 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F47 879 0 R >> /ProcSet [ /PDF /Text ] >> endobj -916 0 obj << +921 0 obj << /Length 2095 /Filter /FlateDecode >> stream -xÚ•XK“Û8¾çWø¨®jkõ~g2™ÝlÕ¦¶&½§ÉØm±ZHÙq~ý -´ -}ˆM“¸HÚl&Ñ(£ÆAtÝXÏRDÁnÃâú±‘Ú„û4+ƒ_ljôbàMjÐD¥‘—ZN9ñ‘¦B3â8¬ó<±f°*`>ŸÔYäȆ†ãM8Òàhí{‰ƒQn3›Q‹Ì³œŽãÔ;I¢éÕ$ž;^'4ýÓUÁ‡^Ñ:L¢š¼öÔ‚Ì4Jqõçï‰>JafºaMPÖþS¨ UÓ_/nDœÉ‚‹3#ý?ó˜/É÷ÿýj0x%nK;^%èùPf\u—f!£•}ƒúF®à3¾sù½x±U—‘³fÞx¤ÓBäHÇÝšŒkW¥[Þ2ÒÿTP
¥Xt¡'7Ö7mdo¥äÁqœÜqþ,q>wê@–`ì%•OÁïÿ”ÞZ[ËŽsç¼ÜÏQ¦%•E#›Gö~×W5œ8®`Q³Q_Ÿ¿E{ï µ9VfDÎŒh›Ä²n°Ô ]H*~12 -€—% -4±NãØó<aÿi÷<0ÏÝ'p<ªEK¾â -ZYX¸"J8áfÌ¢ÊRú4A0>Žß)0_’¤$ÏÍÔb3œK*QcÈ -w
ÑÜ9’®^6qѾ‹´&LÅ/,Ãßr¯ô˜WÛ†…+9Ü›íŽû -Ñižü+ -×Ûöçé-Ä3‹B¼ ï9‘Z¦’ -Ûdƒºkú_GF ™Þ)jÇqŽòß7"¨ÙÛwðöëXÎ`ççNI¡o¶‰eaóÈBýõB
÷vùWeRå ž‚ ¿ûh×ÔWY„Ãvâu_èÚ8@–YuÜ’1Nlz?îélsÁu)–O?r'çà» |“zÓoÂpSWÕÖ¡¿fèG%¿ò-ÝÁŽ-æn_泶XR»V·æK§%›8ÁI¥i‚ÞðØš˜ÏŽ±vr#½×±h°|/ N$=Ñ‘r/€;þPC#¡k zßÑŒ8…\$O2hC|ÚtE•_MsWj3”.ª™m”ÁÄêe³øÕ¼c$×?à^ÔÏÖ‡¸ù»ÅÊ&ûòÍ# ÎãÕ¦:B»Ï 46îSŒO*€‚ïÎAöÃ4ijq•Žœ•Pðúâ‡xˆæ"#Nrý?p½XŒ¤8ù¾‡Eþß…ûìq‹Ç|Û«×ÇóÁCê
8h7È
ËÕ´* +xÚ•XÉ’Û6½û+täTîË1Þ§*®T<9Å9`DHD
… +wQàgY”îŽÓYYžûYš»‡êoïM-ÎFwû(
¼èßh[âçEⶠ+JòÚC
2ã ÆÕŸÞ½!ú(…Éš8 ¬ýR¨ UÒ§7"Îtƒ‹3=}yÌFGòÍ¡:ƒ&q[êþ*AÏ»<ñÀÔq˜{š…ôVöItê+¹‚Ïø†ñ[ñd
•yµ—‘£f^¤¯©!r¤ã®¯Œ{3$®J×¼¥§ïTP¥Xæ5¡'7Ö7mdk¥¤Þ±ÜqÓYâ|nÔn‚±S +fhWü(½¾YhovçåvlŒ25©,*Yݳ÷›¦¿ªîÄqˆjØ|SüÍ‚Ø{©uÏ•cqÀ]#Xg±¬,ÕI’Êøߨ ´8͸dD\2lL|£ælV‹„JnË`«.hš±š#A&Fªä=¢;I^4¥ŽTRdûC#4‹hÅ¡V|.ÓÊhMË4`šÑ_ûiÓ\Õ†+ït¿åab\rc8JK§ rgM¢ ÷Ô‘¸·~$Â&TE´´ð¬“a«ì¯nhQYdçJÉk„“âªÒZ¨xm¯v¿•|“UllÑY6HúQƒX½¾G9(©§²æ +dXõcsý.Û~¸ý¿ Šç•‰×:%<ä7IE”èÚ–Ø’ª2yÑT +hZvýxªY/ý‘áÝN6“dy 8xp]Óc~{î0¨”~‚’$¡½„3×|Ó$ý$ÈR¸2Æ/{ë³ý4±òÕc¯ÕW¹aµ¤ôó,ÎXT¦JP¶Ø¶ÖVDÙ6 +^AÁ³"r +DŽ49œvDü¹„šný~¹ æÒû/å¢õ>ÉÃP©_¬MËZç¹—ù +ÜѸU‚>Gy%â*哦tð–RW8 +Ÿ¤IhsÜ]W‰y +Õmíš™Q‘‚z +â~ó
¯ fÙ"‡èâ9Lt¨ž¹£j¡ mK(ÈÏbµ endobj -915 0 obj << +920 0 obj << /Type /Page -/Contents 916 0 R -/Resources 914 0 R +/Contents 921 0 R +/Resources 919 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 881 0 R -/Annots [ 922 0 R 923 0 R ] +/Parent 886 0 R +/Annots [ 927 0 R 928 0 R ] >> endobj -922 0 obj << +927 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [519.8432 268.1131 539.579 280.1727] /Subtype /Link /A << /S /GoTo /D (acache) >> >> endobj -923 0 obj << +928 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.0431 256.1579 143.605 268.2175] +/Rect [84.0431 256.1579 143.5361 268.2175] /Subtype /Link /A << /S /GoTo /D (acache) >> >> endobj -917 0 obj << -/D [915 0 R /XYZ 85.0394 794.5015 null] +922 0 obj << +/D [920 0 R /XYZ 85.0394 794.5015 null] >> endobj 66 0 obj << -/D [915 0 R /XYZ 85.0394 769.5949 null] +/D [920 0 R /XYZ 85.0394 769.5949 null] >> endobj -918 0 obj << -/D [915 0 R /XYZ 85.0394 574.3444 null] +923 0 obj << +/D [920 0 R /XYZ 85.0394 574.3444 null] >> endobj 70 0 obj << -/D [915 0 R /XYZ 85.0394 574.3444 null] +/D [920 0 R /XYZ 85.0394 574.3444 null] >> endobj -919 0 obj << -/D [915 0 R /XYZ 85.0394 540.5052 null] +924 0 obj << +/D [920 0 R /XYZ 85.0394 540.5052 null] >> endobj 74 0 obj << -/D [915 0 R /XYZ 85.0394 447.7637 null] +/D [920 0 R /XYZ 85.0394 447.7637 null] >> endobj -920 0 obj << -/D [915 0 R /XYZ 85.0394 410.3389 null] +925 0 obj << +/D [920 0 R /XYZ 85.0394 410.3389 null] >> endobj 78 0 obj << -/D [915 0 R /XYZ 85.0394 348.7624 null] +/D [920 0 R /XYZ 85.0394 348.7624 null] >> endobj -921 0 obj << -/D [915 0 R /XYZ 85.0394 311.223 null] +926 0 obj << +/D [920 0 R /XYZ 85.0394 311.223 null] >> endobj 82 0 obj << -/D [915 0 R /XYZ 85.0394 189.9853 null] +/D [920 0 R /XYZ 85.0394 189.9853 null] >> endobj -924 0 obj << -/D [915 0 R /XYZ 85.0394 156.0037 null] +929 0 obj << +/D [920 0 R /XYZ 85.0394 156.0037 null] >> endobj -914 0 obj << -/Font << /F21 654 0 R /F23 678 0 R >> +919 0 obj << +/Font << /F21 658 0 R /F23 682 0 R >> /ProcSet [ /PDF /Text ] >> endobj -928 0 obj << +933 0 obj << /Length 611 /Filter /FlateDecode >> @@ -2751,27 +2799,27 @@ stream xÚ¥TMs›0½ó+t3EÕtÌI;ŽÁÓvÒ£$šbp$Í¿¯@Â&Mzêx<ˆ÷vŸvßzM ˆ,}Q7c‚}vû ƒbÓJP*ݾ-Wfü¦=»DÖ+ýÉ\Kií“ù'çs·?0¦¥ÃUõW`[ïí¡”Ï²´ÇB
>Ém[7¯ŠšæWN¸ênÈÚÊQD·ºïZ3ô¯åcõóÁª˜¯›æ/æñß*ŒKzܹénÐ8AabD\Q½Í„¾«|Üà÷¥ÿ¦œ@šendstream endobj -927 0 obj << +932 0 obj << /Type /Page -/Contents 928 0 R -/Resources 926 0 R +/Contents 933 0 R +/Resources 931 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 881 0 R +/Parent 886 0 R >> endobj -929 0 obj << -/D [927 0 R /XYZ 56.6929 794.5015 null] +934 0 obj << +/D [932 0 R /XYZ 56.6929 794.5015 null] >> endobj 86 0 obj << -/D [927 0 R /XYZ 56.6929 769.5949 null] +/D [932 0 R /XYZ 56.6929 769.5949 null] >> endobj -930 0 obj << -/D [927 0 R /XYZ 56.6929 744.7247 null] +935 0 obj << +/D [932 0 R /XYZ 56.6929 744.7247 null] >> endobj -926 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R >> +931 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R >> /ProcSet [ /PDF /Text ] >> endobj -933 0 obj << +938 0 obj << /Length 1222 /Filter /FlateDecode >> @@ -2781,268 +2829,274 @@ xÚÍWIãD¾÷¯ˆúäH¸âZ¼©OÍ°‰Hs`8TìrbSeìrBƒæ¿ójs6sà ÿ¨2ûù@[ –¤('ðVt„(þ° F—7¯€ÑK‚sTRRx;Ö›#<鹎{žëøIÜý7¸Pé´«Õqþ›ð™˜1t6Ihb–{â^Ž(áÏ!½Žm‰CÁe 5€B=—âÿëÄæ/n¸GÂä^xÞ`W>¾QAF?°9¯ª™Ù;ëƒû9âãòíÊwÁ®|»0«ðœIª
Ÿ:½äÊ0
£•0ö1¦ÿ˜SM™^ÿ^r0m%©ßÑ1¡¨Ä ûOèøéÛíü•¾]hŠÌ—ÐÒwP‰/2î#èñ4ÉPAÊ<2yazïmþ¤zt÷7¯Ì™øendstream endobj -932 0 obj << +937 0 obj << /Type /Page -/Contents 933 0 R -/Resources 931 0 R +/Contents 938 0 R +/Resources 936 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 939 0 R +/Parent 944 0 R >> endobj -934 0 obj << -/D [932 0 R /XYZ 85.0394 794.5015 null] +939 0 obj << +/D [937 0 R /XYZ 85.0394 794.5015 null] >> endobj 90 0 obj << -/D [932 0 R /XYZ 85.0394 769.5949 null] +/D [937 0 R /XYZ 85.0394 769.5949 null] >> endobj -935 0 obj << -/D [932 0 R /XYZ 85.0394 575.896 null] +940 0 obj << +/D [937 0 R /XYZ 85.0394 575.896 null] >> endobj 94 0 obj << -/D [932 0 R /XYZ 85.0394 529.2011 null] +/D [937 0 R /XYZ 85.0394 529.2011 null] >> endobj -936 0 obj << -/D [932 0 R /XYZ 85.0394 492.9468 null] +941 0 obj << +/D [937 0 R /XYZ 85.0394 492.9468 null] >> endobj 98 0 obj << -/D [932 0 R /XYZ 85.0394 492.9468 null] +/D [937 0 R /XYZ 85.0394 492.9468 null] >> endobj -937 0 obj << -/D [932 0 R /XYZ 85.0394 466.0581 null] +942 0 obj << +/D [937 0 R /XYZ 85.0394 466.0581 null] >> endobj 102 0 obj << -/D [932 0 R /XYZ 85.0394 237.1121 null] +/D [937 0 R /XYZ 85.0394 237.1121 null] >> endobj -938 0 obj << -/D [932 0 R /XYZ 85.0394 206.4074 null] +943 0 obj << +/D [937 0 R /XYZ 85.0394 206.4074 null] >> endobj -931 0 obj << -/Font << /F21 654 0 R /F23 678 0 R /F39 858 0 R >> +936 0 obj << +/Font << /F21 658 0 R /F23 682 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -942 0 obj << -/Length 1842 +947 0 obj << +/Length 1859 /Filter /FlateDecode >> stream -xÚÍXYoÛF~ׯ üDÑf/^Í“s8u8®¢Ô(Ò<ÐäÚ"ÂC!)«nÑÿÞÙ%EÉ”í¶Z÷˜ùvvŽe…s<Ÿøœ ’Ä£Ìs’bBk˜{;a–fÖ͆T/“ç'"p"ùÜwW^!¡aÈœEúÅD)p îÙñ‡7Ó÷¨ûéÍ|êyîÏð1ýçoæÇÓ@º‹ÓgŸ¦³€FÒ}õãñù¢£x˜Ç«g'§o?oùL¿.ÞMÞ,z-†š2*´ -ß'_¾R'…ßM(Qè9èP¢ˆ;ÅDz‚xRˆn$Ÿ|šüÔ3Ìš¥£È1J¸ðùtÑt^D|Á…î÷ªTÓ™O©{D ˆÀ’•³8Mk׫øçþЊ:<"aÀ1F"Ïã†A{»²Š¸iUýÂÒ]¢«,ïvÉ«$ΗUÓ’ZÝíQãq–U›]Ý"}Y!Éltó?Gw{þ×^Ø=ãÚ6Ú厨ØnT}Óµ¯*ÛP¿ÅÅ*W$©Š1 ¨
(Ÿ¬s’^Ž£Õi{znµ…³SM£ìVWVÍ<¾QCí|œçÕF¥ Ê~ë¸l®ÔC` ¼†ÃlwÉ=°ˆæ‡nˆU¨#ðˆ'qø³v¿eÄ@Ú7‹òš<€ÆÐ4v©ÿŽyAFUZÇ.rùíèÞû°g!»ö±¯Ú¡{2©šN=óœ2C΋
Îëù g“DHpgà²`#Î"ëæùtÆ(°z_Å)ºä—q—IV^Ûåbàð`5‰Dèꎧ3!¥»ª³"k3}κg[è–gÐ#¹a®[—=sÓMâÒŽ+\'ËLÝ(KÙYãet㵎3†þé×MÏ«Xçm¶Ê-¥ž²ÐUIe¾iÓhåÃA¿ŒEú‰€D‚fâD/ä¡èîï3èEÜÍ®ô¨to«)s×Ø^³×´í…P8qqqã½ÏÐMÖ.q¾Tí¦ª¿á°¶+³½ž¯®pŠéàáÅÊ`»Ü®+S¤¶ÃâÙ¨›¨AZl˜ã¢c iªu²ÄVlF<{*Tã©ýt~›í2¶¼“<Sek‡7YžÛáª,Ubi´¯Ô_w[ÚJ»MÕ5Úe†¢¡ØZž-Û¬P?ì§Dî€rGøŒ_²Gå2‡0w󊶪“càŠJ€ë(ð²ÍN»]V³N'0íˆHõ9ËΡҎ -yÌêŠC—N! Å5 -r›ZWéPÓÃ9º§v±G7lNdY^V7&= -ƒmè׈nAu“VE~k{( 2Yä``\â~ÓN¸ee£yfŸ#^à·ïÛ/³ã˜5
'ì—ku?@‘#[ cu‚Öº±!4±òº[µ«Óp¬]×¥J÷ÄH³&‰‡´=WkmŸ¥rHcd²T°…7RØKUg9¶+£ä[øLòÆwÌ2N>¤ÉÉR~ò
)¬…™Âb{©8óÀ1„1öVCV9«êë›ýH‰ç‡ÂÒ6ëËF_…M¶0Ç|p«*Ê¥]]Ú„ÙEø$´“¨ßÂ(¥³^uè‰E’ø&àL}í`c>öº¶¥>ìj,–c>7ù¶y@¢¿'ƒ'<„¹ãðzš{eØ礅 c¥áŠKßg¡~ÿ"~ðî%Жˆ˜$šW<[É%VªŽ‡GÀú¨‚£ð€Yè÷ϊ̲[LcnUåöªŸ»Kt1‹…ÑÐøÇåx«Ìz¼f…žg_6ËÌT!X@¢åÆNªš¤Î.{§!Ìã8ǹ¬„›¸Re_šòR“gñu Þ K´—çºR+²2kZÅ%B_
,k«ÚVHà¾PkCs—Òð+]ª=՛ۦՑ¸‰íŽr=„PVµcò¯öŽ_Q—ëëë~¼ç^öÀ6`S,9tYàx¥£J“ªÇ¾Ún¯›ˆÃ¡½O:©Ìë—¼#{÷¾;"ü_Gƒž†endstream +xÚÍËrÛ6ð®¯àøDÍD0^$ÁæäÄvêL⸲RO'Í"!‹>’²êvúï]<HQ2e»gÚá`±Ø]ì“ÄÁðÇó‘ÒÐ BŽ<L<'ÎGع…½w#bq&-Ò¤õf6:>g¢Ð§¾3[ôh „… Î,ùâ2ÄÐ(`÷òäãÙxB=ì^ŸMÇžçþƒžº:›žŒîÎ.>]^'¹ûöÇ“«Y‹ñ4·Ÿ.Ï/Þ}ÞÒ½Í:)ú’Ì”ßG_¾b'ß0b¡ðœ
L0"aH|Ä=†<ÎX»’®G?u{»úè æF”ùtHuáê¼ùŒ2ºßËBŽ'>ÆîFÀ
PZL¢$©PT¢#³÷‡Ô¡!"€'"…žG5æ~e äQÝÈêµFÅ»H‹4koÉÊ8Ê–eÝ JÞía›ç,Ê&]Üü¢4(“ÁËÿ¼íøØœ½±wF•šå«®eu׋Òò·(_eÅe>ÄaOk=Ì—WV8JæÃÚj¥½¸²ÒÂÛɺ–µ™–+fÝɾÄv?ʲr#« ÒŽUTÔù”2¿šÂd÷È#: !EÄ<„ +Ô"xÈcÏxüçYyÜ2¢JÚ7‹â=¡¾iìbÿóÐŒŠÐ·Ž]úhþíèQس]ûØíŸÐ7Xu+žz¯L_›¥ïEzïu|N‰C8b„,¸È£ˆ’Іy:ž¤>”QbBò›(‹Š8-níqÖxpš +ä¡ u'ã ž»ªÒ<mRõÎj +o›HiB™&® yG\O㨰ëöl/Sy'-vjwu”QÀ©Ê3ÿތ뺣•¯³&]e³áʸÔcR›Å_±‡ëu¼´wÕƒªïÈ(eœ˜aÐ!fCÛ±´* ˆr‰: +
4ás*Xëü¯`R7]¨UîÞ—câ®
¼Ô>£p›¥¹Zš››³Þ5Ù¤ÍÒì²Ù”Õ7³¬ŒR6¡Kí—³ETf‚Üdy°SjωÁ¶ËìÕ`Œ%bŒ4Ðo
ãCÅ+,£t€"½Ò>),,JìÌ+Â4—ôØ,#K;ÎRY4vy“f™].‹BÆGZ5ʨ½*WÆTØkÊh–©aÍðѲø²IsùÃ~M@Ú0u˜Oó9yVQB ìBì%ÿìTËG/ŽäÀœÃ@Ë‚t»¤&LÆCÄqØ<;þ/ÂÜgƒ†ž¯ut ?žpÁˆ;›}PøîÛ'×ÊWy@ÝÙ/WPþqB}w*ërõ[™v¶bæÊG§Ó‡FM´ÿ +ß× +ÞƲƒZéÝ÷²ZyQ7$ºMñžÒ +dŠx¦VØaôî{)l;¬ÿ":RL 8b ¸À¸AÛê=hùh +€¬SËþ‘.oBff¾ï¾¹¸<5û6íµ˜e5²#’ÛÛUæîÝ¿*Û
î–Ÿû–²*ÚÝùAJ§A¨k35FfH Ž]Õ®(ä¢Q%”E挄ڦR->‚‹Bá^ØÚؚȒœ—wº<Á6õ«
£Ak””yvog†A©KÐÞÂ0ÇÝ¥-s•á•Ö9ô•ý—ñÚŒÝÜŽÄ®›ª©¿aGªd&ØýºYÙÊ+@ëÚ¦Dà ΅˜Ví©]™úkͺ*d²ÇF’ÖqÔÇí¨Zãhº*•BÃÑ«RÁrs‘4³D6Qš¸Tzät«>]¼Ñ³ƒŠS‰Ï¡Ä_ªÇ¿kaº+Ù:%D!â3ÚÞ*¨*'e•˜æhß1ò|Á,n½ž×Êrcrp…~æƒW h_0åöt¹jR`và检ᖣî +-”ªzå¡U$äÈ×™ÀìT·Ž¦C¿æ¶Ø‡CÅQ|L§ºÞÖßúÚßã…@ŠczÌ<xΣ<ìSRL ¡¾r©ï¡~ž!_´ýhûKS$ê_€ö7€b%«¨ÿ¤Ë*¦Ûd~÷O’Xr³1!Ä-ˬÞëÃ>·Nt3fk£¾ñóqÉÌz¸á…™g‹Î–©îBB°€Xñm&‰¬ã*ëðŽìá(3{iž¸’EÍuoªÐÓ趀hÆ*ÊSÕ©åi‘ÖÒÅE2± endobj -941 0 obj << +946 0 obj << /Type /Page -/Contents 942 0 R -/Resources 940 0 R +/Contents 947 0 R +/Resources 945 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 939 0 R -/Annots [ 947 0 R ] +/Parent 944 0 R +/Annots [ 952 0 R ] >> endobj -947 0 obj << +952 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [55.6967 190.8043 126.3509 202.8639] /Subtype /Link /A << /S /GoTo /D (rrset_ordering) >> >> endobj -943 0 obj << -/D [941 0 R /XYZ 56.6929 794.5015 null] +948 0 obj << +/D [946 0 R /XYZ 56.6929 794.5015 null] >> endobj 106 0 obj << -/D [941 0 R /XYZ 56.6929 480.2651 null] +/D [946 0 R /XYZ 56.6929 480.2651 null] >> endobj -944 0 obj << -/D [941 0 R /XYZ 56.6929 441.7923 null] +949 0 obj << +/D [946 0 R /XYZ 56.6929 441.7923 null] >> endobj -945 0 obj << -/D [941 0 R /XYZ 56.6929 373.7178 null] +950 0 obj << +/D [946 0 R /XYZ 56.6929 373.7178 null] >> endobj -946 0 obj << -/D [941 0 R /XYZ 56.6929 361.7627 null] +951 0 obj << +/D [946 0 R /XYZ 56.6929 361.7627 null] >> endobj 110 0 obj << -/D [941 0 R /XYZ 56.6929 167.4388 null] +/D [946 0 R /XYZ 56.6929 167.4388 null] >> endobj -948 0 obj << -/D [941 0 R /XYZ 56.6929 126.8733 null] +953 0 obj << +/D [946 0 R /XYZ 56.6929 126.8733 null] >> endobj 114 0 obj << -/D [941 0 R /XYZ 56.6929 126.8733 null] +/D [946 0 R /XYZ 56.6929 126.8733 null] >> endobj -949 0 obj << -/D [941 0 R /XYZ 56.6929 98.4089 null] +954 0 obj << +/D [946 0 R /XYZ 56.6929 98.4089 null] >> endobj -940 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F21 654 0 R /F23 678 0 R >> +945 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F21 658 0 R /F23 682 0 R >> /ProcSet [ /PDF /Text ] >> endobj -953 0 obj << -/Length 2679 -/Filter /FlateDecode ->> -stream -xÚÕZÝsÛ¸÷_¡—N¥éÅA°O—Ë%×ÜÌ%×ÄiÒÌ”– ‹w©);ÎôïÀ$EJÎø©ãàò·ËÅ~f3 -l¦SBE.gY.IJY:[î®èìžýtÅ<Mˆ’.Õ×W}-²YNrÅÕìzÝÁÒ„jÍf׫Oó—ñëõ«÷‹„§t.È"I¿}ñË+\ù -›öakpˆÒÁ >¶ûc‹cjW´äĦ)ì 8šÒ9WÎƽ×%]ªiŒT£èòÌá-øyžh„gÏ.(˜—’iŸ©µÖ„Ól¾ªw…ÓÕ )ÔAYWøðw|ïT óÓ”Ž¹”¬M|ƒ•C̲AæmhgíÛ즃4n×€w
ÖÁÀö[Ózúz¿ä
ÚÙA\㹚¿ñÀ›¢ñ¶”‚äT¨¾-µ÷õ"”(+Óüm‘HÆçMi™âzYµæP,ÛòÎ<âÈ™¶€XRà¼{¯9ûv!ÜS0‰_dŸÜír3„ºß”aÑ|1Ëckœ]8û´/?º˜´),@× -üÙ–·z§=ë´]lq‚Èž²2V}‚Ñù‹íéózoÍ¥ñè1ØÉriš¦¼ N·FcÚá·ÑÂs;õ@Hu\ƒ7HEƒt8â
"±P)ŒÇ\Åû -c©9Ym~lŠ[3)“D¤Z=K¦fü|L¦@\,Q`eŸ¾GWK»®&R¢UšzWÃè‰d=d¡·õdŸG€‚Qy¿ÆPq -$ÑR O#@)ɳLyg=Iû°7#Xœ³,ÕQ(üÊ1Ù ®{˜ËmÑ4# *%Y*ä -²u•i:7»=Ôå‚Í¿š—œÕ—ËHâ+^ I×ù -›Ai:ÿÁ¯Ìº8n[»ùJ W—ufÝ6øÖiï©ðÑ‹"X¶e±¯^$ôLŠòkPÑÀÞØ"¥2Þ8‹Õ -ͺiL0º›Pú–·Îõ±ZZ³,ü§[ó
vtã-Ô|iMµ2«àÖífàÌ'1À›údbO)'TÁN>#‰v1¦{¤º˜ØeÊ….é92u1¦{¤Š¦‰á=)^®¶‡ëû»ï“åXáУñ<Fü‰Èónß^¬ªUÝ~`{p"ïcâ¦èä_—ñÊ6î 9ÎC¾LC™ÈD?oL{(MóÔüy&½Û}u
íHr$Ë5jõômåÜ ¥ÛŠ…©ÿÛ¼7¸umñi‰OòÌžÉó‰¯K5ø"Õð8¥—ü¸†V3ãç9Gª¬ä<¦a'yŸåh‡£Û -î7®hÍ)D\Ác¡Û£íE›î’‡ºø -‡ö„í&¾JƉ7fŽƒ=3ì*aäÊÓÜUŸ+wº8b¸h®QD‹V˘òšu_`¤CÌ÷Âtó°GˆEþOòg¢iiœ³uÁ¥ýê6’[ô:<8GÑU§ª 1™ñ' Ñ ÂLÎIr»Ž@'ñHð4LÂÈ -l1Ù*ÔŽÜG®<3»äNDá÷±!±³ž°ŽlÝC=[ªñ÷Æ?±.X[W²üÊѨLKÃQÍ0xÜrû´³-®YÓþ¬ž¡ºã˜ÅͼåŸîͲ´ÈfÈÎï*Œü>HT
—j°sÒ·Ž–Á˜?aÝG«/†éÂþº>ÏPnhíÏÈHb7i],ý›xB
ƒuÌUkïk4Ñ@ -t_oWn̦¸+k'‘=ãæz~ï‘V^†ªö´ˆGT+ÃÃïí6”#·Yšd2–ˆçJ (™TNÑü™öÇÆŒßi ý†ã(ZS¬ÈXÂDn»Ne“Q’ÉÎÕ#÷W/V»²UŠP<õúDZ÷Û…·ÅC(ÄCßšÛxâ¿/mÿ¦ ¶óPOCõ~T&8Vk3™ªÕ…Z»K5]kGªà«d¹1ËßÁ×'%·J Ôdùy"Õˆýý¦"1ï‹0yÞÄTìHFÄ`kN2žóÓ‹VßJÙW›Á¾4U[|îÉi=à¬OÆ›a'™Cq•Jã%åÛéû{«)Ï© ºÓU]¤ºXÕ1}Ž-•ž#Scºª‹Tc;ì‹»ß=aŠ0jãÌÁ,Û/õ†§’(ž²o½Y—[3qî -=Ï‚PVx–%ÿEt*úÿ +958 0 obj << +/Length 2706 +/Filter /FlateDecode +>> +stream +xÚÕZÝsÛ¸÷_¡—NåéÅA°O—Ë%×ÜÌ%×ÄiÒÌ”– ‰w©);ÎôïÀ$EJÎø©ãàò·ËÅ~f3 +l¦SBE.gY.IJY:[ì®èl
Ï~ºbž& DI—ꇛ«¿¾Ù,'¹âjv³ê`iBµf³›å§ùË¿¿øõæÕû넧t.Èu’*:ûâ—W¸ò¥éüŸâå»·¯ßüôñý‹ëLÎoÞ¼{{d4—ðæåwßýúêñ½×Ÿo~¾zu¿¢û¥Œ +û \}úLgKøàŸ¯(¹Ng÷0¡„å9Ÿí®d*H*…+Û«Wÿˆ€§îÕ1Í¥B“TólDuœ©.͉\8ÕÙof„]'ŒR:ÿ±,ÖUÝ´å¿öæš16¯ëmc¿ðDήHγÜ!ÝlŒ'ê2e9¡)³²Zše¹b’äRhOóÝŠ$Z$Ø€€c(9*ã%á’Í‹j9Çaw¸–ž´j¶uýûq?‚)SÐ>Ë<áþpÍô¼^Š]ðBÏ·bì$ŸÛ-®.êÝÎ2v“mYµNŽtUp
èŽðÞÎþ8šÃCYqV;ܘÃ94ÄJ8KÏ@ëvž1’§)êÀM[–++ÕÊp^VøÛ´[ƒC”õ±Ý[ƒP»¢%'6MaÁÑ”ÎÁ¸r6(éRM›`¤êE—g¯hÁÏóD#<{vAÁ¼”LûLµ&œfóe½+œ†¨M¡ÊºÂ‡kÜñ½S%ÌÿMS:fäR°6ñ
VH1Ë™·A¢µo7²›Ò¸] +Ü5XÛoMëéëUhü’7h7vfqçjþÆoŠÆÛR +’S¡ú¶ÔÞ×׉ DYšæo׉d|Þ”–)®—UkÅ¢-ïÌ#!Žœiˆ%ΰçðš³oRÀ=“øEöÉmÑ.6C¨ûMͳ8¶¦ÁYÑ…³ßAûò£{I›Ât ÀŸmÙx«wÚ³Þa@ÛÅ'ˆì)+cÕ'¿Øž>¯÷Ö\ã,¦iÊÛàt+4¦Îp»að-<·S„TÇ5xƒTD0H‡#ÞÀ •ÂxÌU¼@Šèbœú'£0–ê‘“ÕæǦX›I™„$"ÕêY2u00ãçc2ªàb‰+ûô=ºZÚu5‘ÒÔ»FO$ë!E8¸'û<ŒÊû5†ŠS Ɉ–" +Üx"âÂ×dU“ +¨€©¾PÕt©¦«šHÕR»LmÈ“T©ó\#Õ[1ŒÂ–Å=¾Óe8“ü|ÍÁiŒ‡G(<ÊÖU¦éÜìöP3”×lþÕ4¸ä¬¾\D_ñJHºÎ`ɬ€SØJÓùžxiVÅqÛÚÍPµ¸º¨+0ë¶Á·nM{oL…6XÁ²-‹}õ"¡gR”‡Xƒ +ˆöÆ)•ñÆY,—hÖMc‚Ñ݆ҷl½u®ŽÕšeá?Ýšo°£[o¡æKkª¥Y·n7g>‰ÞÔ'{J9¡ +vòI´‹1Ø#ÕÅÄ.sP.tIÏ‘©‹1Ø#U4MïIñr¹ÍÍý]ˆøÉb,ð{-Cv›Ê<‡&r˜B’·Ë‡jY·“x±)€íEÀ‰ÄßÏ\ï_—ñÊ>î IÎC¾„¼‰Ê¹ì'îƒi¥ižŽ½»(îj[¬Ç>‚^¦ùOÆ‘+Ðzˆµ×4‚dyD¿X¡}[ÉØ/xšð¹ÿ¯Éu:;è4ÚûÓ²«ä™=j’ç³k—j:»Fªá™M/Ãr
ýlÆÏsŽTX3H¬LÃNò>=/Ò:çE¶ËNx&°Ÿ¶ƒÐO‹4ë÷Ðö!nªºJ:OmêÔ>ué±Qvon·õ}àµñ‹…˜&UN˜à|Ðã;‘2["BVwÝ,Ìü™Œ¼@s쩳ìÑfá™3[X+nk—JaxËÅ¡¬þ=kM~è?Pù’Õ¯"®Šíðí¸TàŠwXpNA{?&,„9ºðŒ\÷žÍßöÕŠ„^‰@ëÎa`ô¶Ä‘“ž‰`é·cãG>Û‹ 2˽OÌÑÅA³@ÌæƯœ‡c +Ø¿±C_ñXgîUú“U„È8äAö¬*¢‹1]EDª‹U„P”¤\=ëÈ¢‹1]EDªž‹úÜáÙ„ñ©†Z +"U·FNÚ:Y•á¹ßújÂhpôÿ"ŸÄ³C×ù<ž Œ¦*ï%‡¾gë<%ŒœQ¯±$Ϊ–¸p¿q•qN!Zà +ž=¶ámºKj
ðí1&Ú/L|)ŽoÌ:œ9{fغÂÈÕÀ¹+q—îsÄpÑ\£ˆ*VÆ–1å4ë¾ÀH‡.˜;ï…éæa)ŠüŸäÏþØÔÒ8gë‚7ú‡å%l$·èu$xpŽ¢«Në0b:Ä 3ãO@£A…™œ“ävNâ‘ài8ý„‘Øþb<²#T¨¹\yfvÉ»Âïc×cg=aÙª‡+·Tãïb](°¶®dù•£Q7˜–†
þ¢šað¸åöig[\G¨ý +<Cug*0‹›9xË?Ý›Ei‘ÍßUù}¨.Õ`ç¤ïO-ƒ13~Â>:ºV_Ó…ýuͤ ÜÐ?:Ÿ‘‘ÄnÒªXø7ñ«˜9ªÖ^ +!-h¢è¾Þ®ÜšMqWÖN"{ÎõüÞ#-½UíiÏÁ–(†/‡ßÛíZG®Ì4Éd,Ï•@P2©,ôYþàüccƯá4Ð~Ù
)–d,a"·²IŒ(Édç~“ûûÍË]Y*E¨ +=Ï‚PVx–%ÿªt*úÿ endobj -952 0 obj << +957 0 obj << /Type /Page -/Contents 953 0 R -/Resources 951 0 R +/Contents 958 0 R +/Resources 956 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 939 0 R +/Parent 944 0 R >> endobj -954 0 obj << -/D [952 0 R /XYZ 85.0394 794.5015 null] +959 0 obj << +/D [957 0 R /XYZ 85.0394 794.5015 null] >> endobj 118 0 obj << -/D [952 0 R /XYZ 85.0394 769.5949 null] +/D [957 0 R /XYZ 85.0394 769.5949 null] >> endobj -906 0 obj << -/D [952 0 R /XYZ 85.0394 749.3395 null] +911 0 obj << +/D [957 0 R /XYZ 85.0394 749.3395 null] >> endobj 122 0 obj << -/D [952 0 R /XYZ 85.0394 221.8894 null] +/D [957 0 R /XYZ 85.0394 221.8894 null] >> endobj -958 0 obj << -/D [952 0 R /XYZ 85.0394 197.4323 null] +963 0 obj << +/D [957 0 R /XYZ 85.0394 197.4323 null] >> endobj -951 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R /F53 957 0 R >> +956 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F53 962 0 R >> /ProcSet [ /PDF /Text ] >> endobj -961 0 obj << -/Length 3210 -/Filter /FlateDecode ->> -stream -xÚåZY“Û6~Ÿ_¡·PU‚ƒà±ûäMì¬S;ñL6»åø#RÆ)‹ÔLäÊßn\ÅC®d«v+[z -?¶‰Rž.â4$’2¹XïoèbϾ¹a†fe‰V>Õßîn¾|)âEJÒˆG‹»Ç+!4IØâ."È8Ðàõóï^,W\ÒàöÅÛ¥”Á?àOõß|ÿâíóew¯Þ¼¾]®bš†ÁWþý¥¸Îã«7¯_¾úæÇŽÏòýÝ·7/îÜ*ü•2*p oÞ½§‹üí
%"Mäâ :”°4å‹ýM(‘¡vdws{óƒcè=U¯Ži.””HÊÅJ„$ùǨXDRIh±ˆAn–phÈ”D‚‹Nù©§ü„™¦rá¨PùU¶/òÕú¡XøTWÅrQ¼[å¿||üú½íQS_¾”ÂãÆbØ7”¹¬wYÓh¢Þ”<%I§†Êñ«Gø «—–a}j§v„cŸÌql¯rÌËc±nëãy„©IÄ%»dú4Âv ÷”Å‹c$•’ÿ^ü3•´ÜVõ±Ð¤,ôHCF’PX®¿Œ0ã$ŽâÐ<eÇj„$ESÿL.›¬ÜTlj«“ËEVÂEíù§QCá ‰iö
å?½ÜÏtäü¡4…:û×ؼa#IÇ‘Õ\¹+PF8…1I8}zÐËHÌX´ˆ©$”§É¸“1D+ŸJágcNÆRy8Wï £]/S˜ŒçEpT#2ô´‡ž¦1ëq[îË]vw$dÐìÉ5eVáàü̼àO”D`N¯÷€™Šy©þà Û=eçFå§ý¡ÑÃíC¡Ç4æãк®Ú¢jlúuÝmźü™R^ä(ÂbÅiHxD™µmfl›ò]¡-Úy{>”ël·;롲Òÿ™þËËÍ’%Á¦8⟞†7õqŸµhÖdÊH¢ˆ‘Àúgħš6G…8VùúrÒ8&,’éü¤–hdÒÞfqÂÂXô'½S{‘ð@ëa_·¦¯N´Xg0\éQÜ'EYïô -ÚèNiž>•»nåesØeçÞNM¶U+ Á¾hl7F))%‰ -€S„¾{r¸"€.@=«Æ
™T ¸ƒkjò¨fÔd©újK”“w÷XöR›w#\”=äÂ=.ýC8ÉƋDzx“¥ê4àRÁÊçu騆Êì{@ÐOš&¬¯MëÝ!Ø–EÕmòä‡)@?Ì<»ÅÑô["½Á›cÑ<Œíp/ñ˜ÛáAž3¹7ÿå-9l - -"ð†q˜^1jÆ,•6A«fc]pOû‘çŠV -[ˆ(I9x¿Y…:ª¡FûÖ -J±dÑSéÛN¥³›mlB‡úûÚ}¹‚ Ö§lT&ž\± jÆ&,•ŠEñÉ–6ÿ”1‚ °aé¼RÕP«}»€ 9•‚÷Õz{j:v!Âàtȳ¶ht3?¡Ëø—Ÿ!i+׺£aa%#®ò5ªêî‘n•†‘*<¬L^$!W—É¢®J<#KZ›Ê’%æ«ØÐ<3¦lÝi´ðE²„,„ˆQÅyI襺¬¶:e†S‘—Ö™îýhŸå…ÿDNW^V…e
,…àZh
Zw¨H0Ðû3þ3TÚ’B7èk"”6bÁ«Vg»¦Öuvj”ú±ýU[Ýaªê‚ƒê$bã—út¬pQرAR¶†Õ½!lÎ -^ÿW`ËÆ¥3ºìb×eŽG®ž6_TÙ½2¼(éðŠG©¶BÌt·Ûk=ÜY<4ø%¢H×›àyUwôHi#~Yø zñݨôð+vø[üŠû²@ßáYìãÖOqm -ÍÀÂ-š%ðS¸‹mBÖšP33½Ol1,ö];¼—͇gcP Ž?$ІåJ‹†pÄ™ç€ sÐÉ6 -@„Å
Óâ`ë!3°„¿+ZµTÉeðܾƕ»?ãF€¶4¬ñ)%‹qd5vöíKêÙ†tx-µÍð¿«]M,to`ÂØI|à)%’ñp!|ªiŒpTJôº-7çÿ«ìvV—B”9Ž=m¾-šÂ–+^¿¹{õò_&‚ÕÅÚf*õ™Íw¸L1ÆWöÞ£šÙ{K¥ó®„Ù+Á¶†œ^™ÙQ
§î—€DHB¼ÕÑ›ÛÕDd¿(E#µ t.Ú::€F÷rÆ -ÝEj¿eEA^ªÚô -úůeÓ–Õ¶ãáÏjÊê‚‚™‡¼U…N`Ò4(ËÓ×qÖ#Ùc¡Çt<¥°UF[ñF?ßØØÆ -±LËû(hÝ‹‚6å;Ld¾Îeu™7–_…ˆ,~4µ!T—Ö¹òwk¯JØ–{;á ®ê c¶rú|Q «‰¯Ô|ª™óe©T9¿ÍÚfX_eàËc9?£ÎÛ?\,S -ö½ú_bj“z¿Ÿ¶z ËÅiâ*jØ®{@¹}|õÏ—x¡šù¦ƒícÓê'
ÄιWVÈl=\¥m„®¨øϧtuQ5_ŽU<«lVýLYNk-tfßSø…!0÷šÖEÓL]þ†ÅÛ#»MÝ
ˆ?|1¼»/w
’„O$¨1ÖŒ€‰ -ÕÏ¢áµ8 -§?â#¢ÿÐü#endstream +966 0 obj << +/Length 3396 +/Filter /FlateDecode +>> +stream +xÚå[Ý“Û¶¿¿BoáÍX>‚lŸœÄN™Ú‰ïÒ´ãø'RwŒ%R©;Ë“?¾»ø"!’’'éL;é܃Àår±X,~Ø]àØ‚Â[È„$Ï*‹‰¤L.VÛ+º¸‡wß^1˳tLË!×W·W_¾j‘‘,áÉâv=•š¦lq[¼‹ä$Ðèõ󿿸^rI£›o¯¥Œþ?úùÍ÷/Þ>¿VqtûêÍë›ë¥¢Y}ý·çßß:ŽË2¾~óúå«oìå\¿¿ýîêÅÅp¤Œ +¯WïÞÓEþ¥rñ”°,ã‹íU,‘±Ž²¹º¹úÁ¼ÕŸNY.–”HËÅRÄ$…þ§¸XB2‘HhO‰P 7K94dFÁEoül`ü”™erá¹Ðøu¾-‹åê¡\}øÔÔåõ2¡4z·,~ùõñ›÷îi…–úò¥iLÁ¼¡F(eµÉÛÖ0]òŒ¤©Ê,——×LÈF/ÀæÐíÝ„ÄÍKì.J,ª}¹êšýqB¨ŒIÂ%;ú4!f 甩Œ1’IɯôUþ™JZÝ×;4¬,°ÆŒ¤±pR™Æ‰JTlžò}=!…’¡«¦”u^m@+67Õéé ë?á ÇþüÓ¤£ð”(šÆ¡£ü§‡û™ŠN¬_«”áÐkÿ’˜wb$É”JœåªM‰€2!)V$åT
+ —ÅX²PT¥Ôôcy–&rœMm1–i +º¡»gqF“êlÿži¬@`XXï4S,Ðà¦ÚV›|‘Qgñ/Ð;–„RæL}ËÏìÃ~Ò|Á[ôÐR¯ôo囧üØZqØîZCîJC3h¤USweÝyÝÌçæ±Ý•«êgJyY +‹%§1á eΫ™õjÊ7¥ÙfÑûã®Zå›ÍѪÚüæ槨Ö×,ÖåL×@^7ûmÞ¡C“9÷HAÒKî1`šwÇ„ÚïëbuÚ£R„%2;Û£ã÷Ì',V"èñVÏBÊ#cmÓÙg½z Å¢"rm¨8Cš³ÙÚx‡ŒŽÆ~Q»q(Ä)A}<ü2#sgz¸ßç[C€ùkžZ£MçnmW:†b[ÕUÛísØùI»Ï”Æ(@;«Qmµ!,6»¤T8`Aã¨Y›ßÜü«*¢¶Ü?‚Û@ +uÖ˜HËÌïW_´Füê!¯ërc„o›¢çàõ¯ÖÆg1æK™„ wl¸ö×it˜RI(ˆüRyÁß84…Sû©êšƒEļ¶ +½Ñ +ÓxÞB®3&r\¡À ålöÖgTÈ M~7!E»òD]%®¿Y1nE<VåÓ”.á‚%eö/ +þ}Þ–žklÌpŸÃè"KYhÍáÔ{÷¿¯ËºŸäÙ9Ž3J +sÏ\Çð6ü½¾ +bXvÞ¨žklÕÐ/ j†¤‡f½9´»·w!âè°+ò®lÍÖ„)KáOq¬ómµ2–2ᘰiRÝô¯L«²‚tAkiK‚Äâ´aª]˜§f½M×`¤Iýyjd¶–æÓVxhòe• CĨã¼4R$xm}Ȥ²¨:K6uÝ•æÕ6/ÊáSK}ÙZ5–˰Ćc¡ajjl‡†½;â/C£AÎmíφ µM Õí³I¾±µÊ6?¶!A¾7LWóh‹4ú¥9ìë|c\¨†œugÛ# +€¿±\¶4DÃy°ë{ɹ‹ù¸«CñAŸøàÃChk{ç}v¶G=1ØóóýÌ{>k˜oó®+·;=7ÜçÙœžÈ\ƒ}¬ZOÕfrz8sÑ¿…µOe=‹_°0ˆL“ô<~
¹æñËsµò§yô +å²ÿ+àåbÔ³í#Ù‘I§#ÙÀ¦/êüN;a’öØÅ“Ìx$sóØÏ»!÷^/-–‰$ÑX†ïë¦e(•ŒXæ L¤$NéÉ©d5À2å±L9,S¡.ðì±M
±
kô86làíÙRø-+W°0ÄÆ0a6Ô2;<SÃm>(ªöó)hÓP endobj -960 0 obj << +965 0 obj << /Type /Page -/Contents 961 0 R -/Resources 959 0 R +/Contents 966 0 R +/Resources 964 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 939 0 R +/Parent 944 0 R >> endobj -962 0 obj << -/D [960 0 R /XYZ 56.6929 794.5015 null] +967 0 obj << +/D [965 0 R /XYZ 56.6929 794.5015 null] >> endobj -959 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F53 957 0 R /F14 681 0 R /F21 654 0 R /F23 678 0 R /F48 880 0 R /F55 965 0 R >> +964 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F53 962 0 R /F14 685 0 R /F21 658 0 R /F23 682 0 R /F48 885 0 R /F55 970 0 R >> /ProcSet [ /PDF /Text ] >> endobj -968 0 obj << -/Length 3905 -/Filter /FlateDecode ->> -stream -xÚÙrã¸ñÝ_á·ÈU#qLžfÙLª2›Ì8GÕî>Ð$m1C‘Z‘¯óõéF<$Hr%)—‹ Ð@7}ƒâ· üñ[«Y"3u›fŠé„ëÛb{“Ü>ÁØ7ÜìÐzõÍýÍÛ÷2½ÍXf„¹½œeYb-¿½/Z}ûÇw¹ÿþÓÝZèd%ÙÝZ›dõñÝŸ¿§žÏ0¤õêïâÛ?¾ÿðÃß>½»KÕêþÃïÖi’)˜y}îù~š÷ùî—û?Ý|?îb¾SžHܯ7?ý’Ü–°á?Ý$LfVß>ÃKÂx–‰ÛíÒ’i%eèin>ßüu\p6ê¦Æ8§¥eÚŠ4Â:!g¬ã’3k¤½MuÆŒ„1ä]]Þ¥±«º§çþŽÛU5ömU7ŒÑ«ûMÌ›¦{í–žÕoCµoóß²ÕÎÍ÷`CGϲ°mÝVôú¼©üü6ßVž†M^Ò*E·Ý50¡DÃ.ל³Lká(î‡n·«Û'vÌ}ž(جJoSž2)²,Ê®j=sìRvήÚÊL‹!îMÞÀ”$Yý´ÞýrB€‘,UJ^! @°</cY*ôŸa÷ ŠB®†M…
±ê«ý×jOõ¸YçCÕ¼ÜqÎWp„2á«OUQµ›¼}ªîøª§÷m^VaE:½ÃÓ†:Ê8º 4‡] ëÒ@çÑ}øçûOîŒàØ@¸¸]UNÒ4p½j»}þÕ84tpE{ÁŽmÞ¸lÿœ$¢©ú7ð&ùêáà§?×MC?‰¨nš°êc·&Ô%-ÿH[4 ûWwð’;aó8H<=ðBÉäŒ<ÏŒS‘y2ª~È÷ƒÓ¥ÒÕ‡G[ï–°ý®*jD‰4ã€Sƒßõô²Ð"¯ËªQKi)æwk¾jà€IYq*+>GeèÕ)Ø:<|ÎT_‰7Øòª‹M§ºØ˜T×÷7ÃE]5š3ÎSqEWç`çuu„Âýû¼¨NðÊŒY)³+xÔ)Þ¥Š*Å,þ-h:Ÿ-é²rã™GrÓÆ>žž€=ôÚT_«†š/ôìÚêëDÂÒôãF l#˜ÓÞ¾×z*5¨7ô$Š(=¦+ÕÌdàý.Ñ`ŽéZ²Õ&ÌØÄÎ û\
}”—à¼ÕêwW9„9÷²[ý¶kê¢öçó5o8³„)!ì^ÏÁÎs{„ÂmQŒŠ)ÈSj3~s€:żä§6ÀÆD-Qÿ¿8š\à›IX’‚»Â·Ø¾($þ±9ô›³Ê}ï¨Ü'xãʽ@üW¯`\‘›K"%2ðîV]cÍìkÔÈ4Í5AÖf^Ђ@açÔ)KfšqaŽ(Œóð©þ:w,Ôš<÷ÿÈo•eLZ~ÍÏÌÁÎó{„¢x4ý b“C,~q€:E|¤Á`3PÜæïê~×äè*Èpí£Ž$„ˆÉ"»jõ±üаɇÐò]íaûà‚X‚–«ƒ+ò«×mÑÊð6ΪÛ)¶ -$½¨Â‰NAÉ:´u1. -쩇
µ(¨àG±3 É0Ü8Õ%Ô -J¿Tå3¨YoöÝ‚Ó ³ðl;~vÞ:ßá“Ú¯uégŠä tní@vK‘‰ƒB*"\ž¡’à*/ -ÒòŠzƒŸróš®'(¬WPÃŽ$ˆc೯ØÁlb‚qŠÐ¥<]Ô®{Z”oV\M™Ôctø¶Š·ˆÁj”VB–fĨŽ¤ÒÂ@dh–|sµ¡²ÑGæ‹\Ý3v¸H®¥î‡í-Š%0àÏZ#Çóœ$ؤuT…S* &©Û!~<3žPÑÆ/~䬙0:²ÚË` -ZH›G–öž~ðôµL%˄Ζ\#‰Y~‚ÃaW¤„8<±.5¦ÁýÓ-5>ÍCÀ -B -=<}](S&äxÈ#mX1‘«3ÙxKVUôZ4ù¡¯úßG
z - šÒà#ÀõYA4è’Ë
®wÆG ¦!랈FãÂ
~gÚvX¥Ø²Š¥VXÌ@x3†a5oY2ÁLz|Kx–X3ÌL^†ü‹K+ áÉé±é\½ -hàÎÃ{iä¡|† V¸íãc½ŽaëÁÃ]ò‚¼>¼ºÊR×Eû:ìnÁ‹u&TÍ»_TåãN=OsJ!bXJ
ÔÛÔþb餤 Øvñ: óšXqt<Zœz¬ãj_С¼ ^¿8Ë‚ï~õàçÎɧDÙ#–6ÏÍLõ<xÄWi¥x ‘L¬BŒãŒSɘTé‰
ˆ1KOàÒ¾RoR¦…¸§ŒÆï‚X
7º:z’EŽœ’Š·:×êQ µ#ÞMwh<§@X[Àèʼnjª½¨b eÁ¹ê#éôÄÍ -p³¢}äfYÓ(q‰“8·«/”FåP1píæ®››Ñ²/O%ÄÆ*Óñïæšd@r«"ÞÁÊQ -{zÍéAb
r”ÞPÀ<†ËÊk„T¡í+Ž6ãAþüµ<"Ÿ -8Tµr¬àœÈPÊ1ªUX£lβQx]•>~³ýX½ßB¢ŒTGyÆ¿hJ"“Xí?þÐ窖³¸t$X¼—“”LGâ°µ„f -™ñ{&!}T°è³LhñeÉÜ‚³†_¦€3eFõ -}ìðC)kk2I’lŸÇ:ö&dµše–›¥‰±˜°«íÁ¹:á‹"ГÓãkÞ¸C YvÛÜ)@ÑÚ¾â>èÉVîV@Ûªò“(¶ÂõŠá7®@7ò©!u,*6xr bÖ°9¸4@Ê@G?ìIØ`rS©bqÜÏB¨£n]Éúñ½®Ö^pfm’½æÃ:«Zÿ¬n=®¸ž/¹6Q” -È®G°ö!e™ƒ=·×Em(§×p`ŠÉ—œâV)C#|Õ*%XQ>µJ€€bV´ÉÏõ\ŠVa)£Fž7OݬÆ6VñO!{ͳ“ÔcŠ‡‰Ié†SL¦¹ñM*káû+,M“ý]ˆT¤2gV»|ß»pM™¤A+/ÜuµÛjŒb«4E*¤HʇŒÊgQ8˜ƒJ Ò“{( -qJú +973 0 obj << +/Length 3750 +/Filter /FlateDecode +>> +stream +xÚksã¶ñ»…¿Už9ñð$ÁöÓå’K.3½¤wîc&Éth’¶Ø£HG¤Îqû绋@R‚$OÓñx‚‹ÝÅbß ¿fðǯN˜ÌÕu–«D3®¯Ëí»~€wß^q³ö@ë9ÔW·W¯ßÉì:OòT¤×·÷3\&aÆðëÛê§ÕÛïÞüxûÍÇ›µÐl%“›µNÙêÛ?C3Ÿà•Ö«¿yˆ·?|x÷þÛ¿~|s“©Õíû>ܬ3–+Xyyí?~3ûtóËí÷Wß܆]ÌwÊ™Ä-üzõÓ/캂
Å™}ý,áy.®·WJËD+)ýL{õéê/áì]“œ–&ÑFdÑ 9—<1©4יΓTÂ;”]SݬejVÍ@¿»nVõ¸ßuuÒHS½ºÝø—EÛöO~ÜÑoýÛXﺢŧ|õh×÷e=8°±§ßª°mÓÕôø´©Ýú®ØÖŽ‡MQ–²ß>¶° BÃ.ל'¹ÖÂr<ŒýãcÓ=$‡ÒçLÁfUvñ,‘"Ï£â +Pë9˜—2sq1«tB†´7E;‚P[ý´~üåˆT&™Ròê˜åy¥&É„>ààìTQÈÕ¸©q VC½ûRïh²Ù‚4›b¬ÛçÎù +ŽP2¾úX—u7H¹)º‡ú†¯zÞUí1Òéí64Q=Ãé4%‘Ù?V€—^ôŽÜû¼ûhÏŽ
”‹›åQ¤MÀ׫®i0_ì‰ÃÐjW´œØÈ{ÁñÏŒ‰¶^Á“ä«»½[þÔ´-îÜ"âºm=Öû~÷D¤+BO[GÔûW¿wš;Qs4H=ðB Éå™ç©5‘;6êa,v£µ¥²Õû{z·~\ÂuÙ Iä_X3øÃ@+B𦊑 +VŠ”ÈJñeq³æ«˜Œ×¡±âo0Öˆ]-‰‚¯ÃÃÁß™éâ#ÉGÎtqhM“éºùv<k«©æ 癸`«s°Ó¶ p?ã®(ë#º2OŒ”ùºê˜îÒD•Jù-¿ïJ:Ÿ-ÙŠrã„Gz3xÁÞí@<ôØÖ_ê–†wÏôÛwõÑ –dÙ%Á 3b#˜…Ð^¿Óz*5˜7Ì0Eœò•é$Í!úãËÃòµ«aIj˜™3ö©‡¨,!x«Õ.JÔ+sát·þí±mÊÆÏ—¢ÝŸ‘´ÎY¢„0d=;-í +w»«Ëýn@ß~ª9O;2G´ã…Ì‚ø×ûíãÁQ¶ÍàäÔ;™ÿº¯w÷³tÓø'ùucû<xؘˢ*R40’å)°n ž”Ê¿Dß̤›³ÃmQ€‰tM¶6žÆ¯ûÆ”(ŠËP,k‚(lK ÞH!nÆ
¨(ïÏpÒ)öðºq©-l +\5‚sÒ9¼¥i+,˜G–p¶ Çaã*¶Ê¡ª]&;¾Â‰Ô™ŸE8 +Ï‘œ¡7½ÅíÙîb¥ +IPHEŒ«ãÃÒWt¶VPÕ4ëý…]×öeX °n¤+úü 0—€ït®b×UeÌŸˆÄ°ÔGØ_ÊñEãf ŽÌš\Pïkâu=–¯‘XÈî#„d9åüiº)èt)6[B•Wźl +`z&
P;š¾óAwQ³Âw0 +[ìCL7YêX[ÇäÅU¢“¤DúxdœQíìøLÏ&¼
Ò„ñÒ'ÃÄ}¿ïªW‘³DáCEÃò¥!:T™¨Lx&]‚qßÐÓ¨íûÏ4jºˆ$2•è”§GGú¹~Ž({ð“úg¦*&"«©ÑS“€$•KåµfxP]ªfÁŸ +pƒÚkÌS1òªFYvÖÙXZ¶#rS0øêý‡¯]»‡ñŠÞìPÁšu]bæ8ÐÁv8¶, c¸j
i§V&;;!'HŠ@¨Y“S稑øCÝÕ;òŸ8mËjøÝݘվë\ä;P
.t¢4Ëfô×(Ë›ÂêuáNXpå3Ú<Št(wÍkd®e&“\è|)5Ò˜Eü¤‚éÀÙºŽ^î®iðq‰=üz¾ ‰ðR!XNVB¢b¥½L_ð-î-Ô%.Ž°ÙüŒD”‚ð¹â>DÛWÖwËÔ:è-†
™RbŠs£yÀÊ+P[A€Ü6m±sË{¤x„3ý}Ì•i°`Åù¬rªN9d£y™à×°×¾ô-P§€>£Þw‘i‹ûSp’§ùa÷ÔKØiv"VAÊ•3¾ðªC„U‰$¡ã +9dì,Ë^ŠÄ¥:^D×܃a¦±Í<Qyˆ®‰áÅÊÁ$3Œ, ä Pz +üôŸÕԲƗO”¤À¨†¾Ä¾:€M‘Ëeô @eÒeJc2Ü@ol>„¿šÍ‚0ë*Ž6M¹! +´6ÐÝôûÖI +”µƒŒ¬ªfÚ©*Xª4\õv:æf}YïÔ'r³ª)h³çàv…¯£z¨íéB7Oƒg_žKÈU$§;ßÓKšÅŠD#ƒôXЩ9(P:G¿1le P_#Ü€¦ +m^p´9÷úçnG‘øÔ¿¡N”‘¡s¤CYÂD0 jtEÅœçAym•¯Þn³Ã3x½ß|¡‚Tuæ¿è*b‹Xíîàõ©¦‡áI†Î öPå¤%Ó‘Xj‘™Rfü¬DH—Õ }r‰ !_v.
+ú'8à‰JƒyùÞ÷ø½ŠÍµ5¹$I¾ÏQ{å«Z䆧Kçs1aVÛ½
uÂ5E`¦ Ÿ/EkïèaXõÛÂ@n×ðòßUä+ÛЮ®Ý"Ê_9î‹ÖöçfT6
”±VDåOîOÔË7{[HéùÆ),n›Ïu,ûY´ÂË]?¼^S :0A‘ +ŠRÕu +zô¦è\Ë)î•rt½Æò±W”³¢O~êiæ\¶ +¨RâyÑ>ô;ðÛQ•Aõ +Í““Ô¡ÄäŽÅE‘&à8ÅäZPß4¾³æ?ƒÁÎ4ùß…JE:séê±Ø
6]S©OÒ`T”eý8ºq÷Lƒ ¶JSF¡|‰¤ÒÔQ¹* +ßxá ¨ìè: endobj -967 0 obj << +972 0 obj << /Type /Page -/Contents 968 0 R -/Resources 966 0 R +/Contents 973 0 R +/Resources 971 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 939 0 R -/Annots [ 970 0 R ] +/Parent 944 0 R +/Annots [ 975 0 R ] >> endobj -970 0 obj << +975 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [120.1376 335.453 176.3563 344.6684] +/Rect [120.1376 365.8002 176.3563 375.0156] /Subtype /Link /A << /S /GoTo /D (controls_statement_definition_and_usage) >> >> endobj -969 0 obj << -/D [967 0 R /XYZ 85.0394 794.5015 null] +974 0 obj << +/D [972 0 R /XYZ 85.0394 794.5015 null] >> endobj -966 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F48 880 0 R /F55 965 0 R /F21 654 0 R /F39 858 0 R >> +971 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F48 885 0 R /F55 970 0 R /F21 658 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -974 0 obj << +979 0 obj << /Length 1632 /Filter /FlateDecode >> stream -xÚÝX[oÛ6~÷¯Š=ØÀÄð"ÞÖ§4HSwhÚ%N¶¶+Ebl¡²”Yr³`èß‘Hʲ´AÅà‹ä¹ñœï\$`ø‘€$4ÕÔâ˜ð YŽp0‡³“q4¡' -ûTÏf£ƒçLiAE0»îÉR+E‚Yú~ÌC€Ç§‡¯Ž'!åx|~|6á|| íúõ›ã³Ã‰ŒÆ³éëÓóI(±ŽÆG/ßÌ<Å×e½>}>=¹ØÈ™|˜½Ïº[ôoJ0k®ðçèý¤pá—#Œ˜V<¸…FDk,GgˆGŒù|t>ú¥Ø;mY=G0¢LÐ!×éžëA\kÈH"!¥uÝGs7 ÆãU‘&t«¿››T#¥T‚4ç´eˆóy¹ÊêÅÒ>Y,ã$\¦üÉÓ–{j+¾2ÉÊÔŽ4agwW”Ó“Ëõ»,â£gË+6¿=V¿ý5š¿-.ñô„,Þ\Ìß-õÝôäxžRÝœýìćC&}ÞQmwË›:+‹êþûXSs¯ó:¬Ìê“YYjB%Âð#ƒ‚=Gë,õ|÷UžSÖ‹v´R·4³EVY ýŽ1ÍÍv‘]»ÿ¢ªã<7©]Æ••¸c‚1Ò‡[‰¦NëPR×(†„èXr§ð¶\ç^Iž—·ö±^û”Ëe\¤?
¨‰*ÁáI"ͨjåþ`I#ÕOd¤¥Nqc¢ƒ¡ÉË8°4tN°lùêL’L* -“Ôvá7»(ÚåM¹rš3û -eX‡ôŠtsƒÁÎvþÈý²O•FŒ(±Ñìëþ¾×|nÙ{ WÎ(G‚¹zgµlñl¥‘~Š+ð -‹z^ ›247Å€jÁ•ÊßXÜÎWñÒj¸Íò&4Z4°üdŠB’ßÙ³ÄfÊRÄC!cˆ}cÐÄ%ï̶¥Ø*j¢ßj¸+×ök‡¬Fi^•Ö_Œ Q²“$iVÝäqc1¡.ÿ ƒË¬¬ñÕMY¤?÷ÝHˆ -™ÏR[ú† Æ!èÒZ¾00QBïÃ]œ[4 o\ª¯o\…ðDS‡„Ö}0
'‡´&„íb©-<®¥S¸,Óìún@›‚¢ª)ˆÛETO×]GÓ:CO0AL‚ãBÆ!Xtã4„0KÀœÍ‹xmM…ŽHÔ2™Ug¿Éøâtú›}ª?,h×faßMÄ7ʆÔ7Ê渴uüÑŸÞ˜$k˜Øuœ´ãÝ–.®ìnjªd•]Ù šr±£m«C6â¯rƒ†úïla*©ÞzP¼ò§]oXW]箇Pu‰ü±©h%X!ÎpÔe{;k¡Ývµ?"Pb€˜+³ÐMXûRÂwúÉ·qy;z^»×ˇA–{ô;
Íß ªA‚¬çûÙ–5ERI0Á%‘
×ùôäÅÅ›]/ UHpô%þ;#;‘Vn‡Q ÒäÆ–™GMT;óô÷¸«B®£¥CU˜0(‘ü†ràKÎfxÝ1%!#âÊìá-‚ ‡ýˆŽdš!‰%8rójûÿAp¤aš°}ÁœBÁÜ#xv|öê~÷D>„÷̆pßÎC8ɯ•]+õ +xÚÝXmoÛ6þî_!û`Ãñmý”iêM»ÄÉÖvÅ HŠ-T–2Knýï;Š”,ÛLtÁ6þ`R<ÞŸ{îŽ 0üHÀšê@êqLx,G8˜ÃÚɈ8™° +‡RÏf£ƒçLiAE0»èR+E‚Yú~ÌCЀǧ‡¯Ž'!åx|~|6á|| íüõ›ã³Ã‰ŒÆ³éëÓóI(±ŽÆG/ßÌ:‰¯ë8z}ú|zr±Ñ3ù0{9:žõ§ž”`fŽðûèý¤pà—#Œ˜V<¸… FDk,GgˆGŒuOŠÑùè§^á`µÝêEŽ`D™ >èô +·£†1Ò¸„[Y“ïPR•×CB¬¸3x[‹ÎHQT·vØ,2;Hªå2.Ó<æC¢€SJpI¤•Þï¬h¤†©‰´”Â6.ZèWYQÅ©ÇÓÐmpŠ-bM.I.•e–4vÒ=ì£h§7ÕÊ hÎì +8PvH¹§H›âà-öa¯1ªÜ¯äTiĈËÆGsÀ}غ¬µç@®žQŽ'r;÷ÎzjÙÚj#ÃW€ +‹¨„¦Í³ÒcZ0D¥ê„o,qç«xi-Üæ… †—Ÿ²2‡wv-±é²±/DàbèÌ}Eú²ä½Û¶[C&ú…»j
yÏ°vÌ2F‹º²x1&PD‰ÜÎè4¯oŠØxL¨+ +q†£>ÛÛËÚm'Pû#%†i‰"ÍÈCº kß3øN?ù¶]ƒk˽Ø}t¹a‡óNCëÎ2ÅÕ·³-5ERIÅNC1Š,cϧ'/.Þì‚D$!ÁY0Pø÷\ì5îû¸CˆIŒ-'ûëÛô†ô¸/A®¥¾LÔ‚H~C-èêÍæêºãJC:Äu¶G¶®7„èǃ‘i†$– endobj -973 0 obj << +978 0 obj << /Type /Page -/Contents 974 0 R -/Resources 972 0 R +/Contents 979 0 R +/Resources 977 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 939 0 R +/Parent 944 0 R >> endobj -975 0 obj << -/D [973 0 R /XYZ 56.6929 794.5015 null] +980 0 obj << +/D [978 0 R /XYZ 56.6929 794.5015 null] >> endobj 126 0 obj << -/D [973 0 R /XYZ 56.6929 442.7583 null] +/D [978 0 R /XYZ 56.6929 466.6686 null] >> endobj -976 0 obj << -/D [973 0 R /XYZ 56.6929 415.4538 null] +981 0 obj << +/D [978 0 R /XYZ 56.6929 439.3642 null] >> endobj -977 0 obj << -/D [973 0 R /XYZ 56.6929 385.9365 null] +982 0 obj << +/D [978 0 R /XYZ 56.6929 409.8468 null] >> endobj -978 0 obj << -/D [973 0 R /XYZ 56.6929 373.9813 null] +983 0 obj << +/D [978 0 R /XYZ 56.6929 397.8916 null] >> endobj -972 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F23 678 0 R /F48 880 0 R /F21 654 0 R >> +977 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F48 885 0 R /F21 658 0 R >> /ProcSet [ /PDF /Text ] >> endobj -982 0 obj << +987 0 obj << /Length 2297 /Filter /FlateDecode >> @@ -3062,29 +3116,29 @@ oQÈ"ú5QÚìû¶)—ª:kE¦òXÕ•-Åä…£¹ ¼>Å‚3eSojÍkâ f2€ïFt-˜¢~¶åônwâ-ú¬;]àc×BλÈs¤Hz ƒúÅå©9Eª;4UUw—iwÉIÎ’iÌœæšÎž¿“²‡§þØVÓcïb¢uÕŒ1tì|w|ON~™
ˆI›ÏŠ“<>Ú<¶= ö endobj -981 0 obj << +986 0 obj << /Type /Page -/Contents 982 0 R -/Resources 980 0 R +/Contents 987 0 R +/Resources 985 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 996 0 R -/Annots [ 986 0 R 987 0 R ] +/Parent 1001 0 R +/Annots [ 991 0 R 992 0 R ] >> endobj -979 0 obj << +984 0 obj << /Type /XObject /Subtype /Form /FormType 1 /PTEX.FileName (/usr/local/share/db2latex/xsl/figures/note.pdf) /PTEX.PageNumber 1 -/PTEX.InfoDict 997 0 R +/PTEX.InfoDict 1002 0 R /Matrix [1.00000000 0.00000000 0.00000000 1.00000000 0.00000000 0.00000000] /BBox [0.00000000 0.00000000 27.00000000 27.00000000] /Resources << /ProcSet [ /PDF ] /ExtGState << -/R4 998 0 R +/R4 1003 0 R >>>> -/Length 999 0 R +/Length 1004 0 R /Filter /FlateDecode >> stream @@ -3097,12 +3151,12 @@ qª„Ñ«ò^ÿï>‹«>÷—
.13×…Óƒ!¶3¢SËAÕ”ih¥Å¨Š^…(€<Îm䦽ªšÛÆlLÊâ³ò7Ù n*Œ1½÷¨¾x¥Æˆpîâ‹&Xîܧ³±è\íD¤ßä0}#XŒûž˜‹¸À>#^V°¡|2Îi‰9ÊÎr)`˜¢Xh¡Ò& „hb—H°Œe"Ãê þrÓGçX5¾ûû8‡´ÕªOª«t–Ô³$Ây°‰—BÒ›ÀÄ5©/¨vp÷o`kA“ôr±ñœÓ4N.4Žæ endobj -997 0 obj +1002 0 obj << /Producer (AFPL Ghostscript 6.50) >> endobj -998 0 obj +1003 0 obj << /Type /ExtGState /Name /R4 @@ -3112,116 +3166,122 @@ endobj /SA true >> endobj -999 0 obj +1004 0 obj 1049 endobj -986 0 obj << +991 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [470.3398 482.8902 539.579 494.9499] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -987 0 obj << +992 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [316.7164 470.9351 385.3363 482.9947] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -983 0 obj << -/D [981 0 R /XYZ 85.0394 794.5015 null] +988 0 obj << +/D [986 0 R /XYZ 85.0394 794.5015 null] >> endobj 130 0 obj << -/D [981 0 R /XYZ 85.0394 769.5949 null] +/D [986 0 R /XYZ 85.0394 769.5949 null] >> endobj -984 0 obj << -/D [981 0 R /XYZ 85.0394 582.0558 null] +989 0 obj << +/D [986 0 R /XYZ 85.0394 582.0558 null] >> endobj 134 0 obj << -/D [981 0 R /XYZ 85.0394 582.0558 null] +/D [986 0 R /XYZ 85.0394 582.0558 null] >> endobj -985 0 obj << -/D [981 0 R /XYZ 85.0394 543.4475 null] +990 0 obj << +/D [986 0 R /XYZ 85.0394 543.4475 null] >> endobj 138 0 obj << -/D [981 0 R /XYZ 85.0394 324.8439 null] +/D [986 0 R /XYZ 85.0394 324.8439 null] >> endobj -994 0 obj << -/D [981 0 R /XYZ 85.0394 292.4184 null] +999 0 obj << +/D [986 0 R /XYZ 85.0394 292.4184 null] >> endobj 142 0 obj << -/D [981 0 R /XYZ 85.0394 174.5048 null] +/D [986 0 R /XYZ 85.0394 174.5048 null] >> endobj -995 0 obj << -/D [981 0 R /XYZ 85.0394 146.6189 null] +1000 0 obj << +/D [986 0 R /XYZ 85.0394 146.6189 null] >> endobj -980 0 obj << -/Font << /F21 654 0 R /F23 678 0 R /F62 990 0 R /F63 993 0 R /F39 858 0 R >> -/XObject << /Im2 979 0 R >> +985 0 obj << +/Font << /F21 658 0 R /F23 682 0 R /F62 995 0 R /F63 998 0 R /F39 863 0 R >> +/XObject << /Im2 984 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1004 0 obj << -/Length 3372 +1009 0 obj << +/Length 3382 /Filter /FlateDecode >> stream -xÚ¥ksÛ6ò»…¾•ž‰x$Ad¿¹‰su§uS[÷˜&ù@“ņ"U²¢üúÛÅ.øèëÍÜx<x-‹}c©pÀ_¸‰ŸdQ¶PYìË ”‹b{,žaíïW!Ã,ÐrõÃêêoï…Zd~–DÉbµáJý MÃŪüèžð¯CàÝÝ¿}¸ýåö~ubïæçëe$ï÷_ïo©·z¸¹|ûðHÃOîþýþÚðz)Tyo¼ù°º} õ˜±Þ¼ûçu†ÞÍýÛÛw´ôîžq¼¿½Á³Vÿx¸}¼þ¼úéêvÕ_j|ñ0x£?¯>~%Üÿ§«ÀY*G~˜eÑb{KáËX7S_=^ýÖ#Ú³Œ?I4ÃÉHÌqRf~"` 9Yçûë0õž5\.ʼomýÊP{Ø•y§K¬-°þó ›®>YÇDywét^¾8{ÝÆbI½ò°ÝMñ•ºÎOßÓÉBm×RJj·Usè´±X…—×u{¬šgZË˲ꪶÉk”°b†~&edïEd™E‹mþESoWç…öû™†Ib7þk£<@z96‰gôþEïiŠ.!=bƒéò=³&ñòuç rjÌæЕ푱µ{‚+ö¹ÙØ^ÕÑÚ±ªkZ%Ä@݉V˜‘Òû£=ìñªvð)¢ZÓbÖí~×îáÖn‚–‹d†E,kàFÞœ¨3åÚ&ïÿÚ/#¾ñ&¾°…ä¹:7¼e@Ž*0Ëé·›¼y¾<Œy{¨yL:×ni„×ܒЈÀ· –;“£»}Þ˜µÞó¤êŽüÚ°V0kk+I‹”!¨1Õ¶B+±ƒcî´~æB+bƒè)ˆXR†¦Û5M–§&ßVÅ -~'Ž3æùd÷ÑOƦº1>hÆFjîÔxÐ ÞÒ Oâëõb$ÅñŽÊ8Sšúž’sáVöשwh4pØáÈaG2öUf@1ºoJ>ÍtíŽáÇ>Ž|!‚”ÁIE‘~Ejªªwx—Ty§ö@Mþ‚ä¥)‘3[r–éXŽ0pË9A\€9æ‚Ýܬú¢±¼Kö¬ÛÁ‘쎼Ðå¡W˜f§ˆ½vÿå{3©ôÞU&ªgåØS"‚lpd"$Fã¤% -\†K§¾ -bÖ«¯ôzZ®÷ívY -ßµ8ýRé#:ôÕV¸vÎTOœÙ¿róEpÑÅvlá;fgk'‚‹6Ø‚Óô°ÎSaR¡¿vסׯ(WikÊŒìVn†|âL´ ]pêX7sº+<ò¿ÉzÇE×2ŠX.Ž± -wƒ¡%’M2‘gùLÔ:ÿb¨k1Q»µeRì`ãúK•Ó@CJÂ'l๦Š>!s9"B|Í·»Zóç˜ “G䶤†=“¿¼œ^“¯¼ø˜Y@2ê!n¤Z•E']• -øbz -g‹Å¦Ïse9éõ… ->…²G -UZJÆðz¦åY~ -‚Ê\Uó–hCek|þL’•Ä¾Œã¾^+ƒ™Ò¯ðE¨\jÏ7ö -÷ç褯¤¾HÞäîn.=ÃÁèÛ"™ŠŠë™3)ÚiÕ?ë4\…Cd'çŸ^¢ª7P«nC½©ÝàŒÓU%Þ‡i‘MQ(¾ûÀUH%!’G.Ç®YŽÃŠÂÔÓø|_}s‡ñ;^%í»_~§‡ûŒ µüe2ë6'bV‰\X¹T:¾ø›ó⺒Î+†±;ÀÑiÊD»ÎôuÐ.§¯jWè'*vê€9µ}_d”;‹(¼U²QZÈŸí±}ÒJTW¦ -@ àò²´ÆÇ!·¡ûþ* +xÚ¥ZÝsã6Ï_‘·*3k$’¢toénöšN›î%¾Ùn‰ŽÕ•%W’ãõþõ >líõfnüÀ/AàrxÀ/¼V±§QzSé« T×ùî*¸~±¿]…L³rD«)Õ÷ë«¿¼ú:õÓ8Š¯×› ¯Ä’$¼^¿zÒþ
p¼û‡·w?ß=¬o´ônºYE*ð>þòpGµõãíÃÓû»Ç'j~ +Tpÿï÷P†7+¡eä½ýáöÃúî‘Æ%s½}÷Ï›0½Û‡·wïhèÝóxw‹kÿñx÷tóÛúÇ«»õ°©éÆÃ@àŽþ¸úõ·àº€ýÿxø"MÔõ¦it½»’JøJ +ázª«§«¿'£vê¢"ÃÀD-h2KšT©BMVY{&Þ‹ÍE©÷µ©¹VvTöEÖ›‚Klþ8˜º¯NVE 1DÞ}Ýõ&+Þ +VmeOÒ2e +*ºrW¢—ØÆ1sV¿°¡5©AD|Ru7ê,Nu¶+󑶣þ<«ë¦§îºiw Ó‰Fž™±“'1#òè-º“g‡ŽIáLxòdÛÈ·§Þ—CÚé
±hG6’7 W«4æcNµ·kì1§Î^sÐ>µÇY>0Œ|Š"MÝý¶±BBç(4šÚn(.9YîH™²Îg³ÖyRv
è0uwà…f[¤X21sgÆ£
žu:¾Á.&§8QvΕæØScN(ÜH{“x‡EÀ'€)éë8LAb´^ë›=ÓO^F¾AÂäd¢¨ +Æ„‚[£ÌÈg?Töƈ—²šYo‡4ŽðLŽ½[©àN»7- +›˜Ýt3Ä!Á†yZ¤Á¡½5ËP)dâë@º^~¡›ÓjÓ6»U| B™:7ÝB0HÑ”K6ËŽÝJƾŒ‚³ 3ÃÍ8Éd–·B–)ætZ\
½ +U, +JÎt…Gð‹œwúÞý@E‹Ó+/ëUJ?ÑQ2vØs>¿£Ÿ]kl ƒÝÐk–dY³®©;¯¦r —¬.¿:WÞcs¨ +"<fu?ßtЋ"ÀgÏLY|TSè'€N3‡ì·îVþ__x~±¯…—7»HOå§1Š50Ð9+Ã^+¶I6é9‰NºvÔÉRhÁ)²æø mPc‚P°Ÿ`{Έ°NãÌWœAŒïhx„óÁò&¼„†{OU‚tÔhÀ,kª’}k|ôÅ)|vk5=q-yf×츧0Ï”EhpÍ(%$KýÖ¦'¸—öµ +©I3S®8!À@bÉîGG‹»d¬ÎÒ)è¨Lö¹£ªÅb"¢rg_H±ÃDÖ_ËŒ2^aW
pUÄ„Ô¥ˆHñ%Ûí+Ã_ ƒ\™Û×4¬uÙëëé[ç±+Ë?g> •âƒ!N¤g*ËN¹¨ÌwH#'¢¯í³öш6¬ßH`ðT…ö~hŽè.?N´Sr^£‚|•À¬¬(ºód¶aãF"&؇ÉOº×8èvöHÁmÃ=”¸¡ +9ÐìsÉ3ÛásLÜC¶;e/hÕÒç›™E=žÍ?¹êÜKüä8UàŽs’"ºÃ² žP~(¥ËýsÃ;B^~:_ؤÍZ¾‘3JŸFåO¦ÿÎ^À3›ûkº}h´ù=˜' hÃÅ™î’g¹U(@^ºÇL@|Ú󄈥¯¤žiU°ðâ+|j—Õs ñs +õç씯•P#¿DÞfno.5ÃÆä“"u%½©§Î—h¦µ»Ô¢=~Â"*•ñùg8J=x&5Že¿¥ÚÜa°Ç)ì‡ù㚦0|ÿ_µrˆUp[¡rR4^žv˜ÂgmùÕ-ÆWx[¶ï~þHwö%h䂌٨9 ³åBÊåg#Þø›óÏž.ÿ^s¾áû\¥Ì¬ë•Gë2ù¦u…~¬¥3̧íÝ"¥¼YDÉìž’NRBþZå³!R’z:2‡& O endobj -1003 0 obj << +1008 0 obj << /Type /Page -/Contents 1004 0 R -/Resources 1002 0 R +/Contents 1009 0 R +/Resources 1007 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 996 0 R -/Annots [ 1007 0 R 1008 0 R ] +/Parent 1001 0 R +/Annots [ 1012 0 R 1013 0 R ] >> endobj -1007 0 obj << +1012 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [464.1993 509.0768 511.2325 521.1365] +/Rect [464.1993 519.4233 511.2325 531.4829] /Subtype /Link /A << /S /GoTo /D (proposed_standards) >> >> endobj -1008 0 obj << +1013 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [55.6967 498.1379 105.4 509.1813] +/Rect [55.6967 508.4843 105.4 519.5278] /Subtype /Link /A << /S /GoTo /D (proposed_standards) >> >> endobj -1005 0 obj << -/D [1003 0 R /XYZ 56.6929 794.5015 null] +1010 0 obj << +/D [1008 0 R /XYZ 56.6929 794.5015 null] >> endobj 146 0 obj << -/D [1003 0 R /XYZ 56.6929 577.5408 null] +/D [1008 0 R /XYZ 56.6929 584.989 null] >> endobj -1006 0 obj << -/D [1003 0 R /XYZ 56.6929 542.4624 null] +1011 0 obj << +/D [1008 0 R /XYZ 56.6929 551.635 null] >> endobj 150 0 obj << -/D [1003 0 R /XYZ 56.6929 380.9794 null] +/D [1008 0 R /XYZ 56.6929 396.4263 null] >> endobj -1009 0 obj << -/D [1003 0 R /XYZ 56.6929 343.6916 null] +1014 0 obj << +/D [1008 0 R /XYZ 56.6929 360.8629 null] +>> endobj +154 0 obj << +/D [1008 0 R /XYZ 56.6929 173.1662 null] >> endobj -1002 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F21 654 0 R /F55 965 0 R /F39 858 0 R /F48 880 0 R /F47 874 0 R >> +1015 0 obj << +/D [1008 0 R /XYZ 56.6929 145.9427 null] +>> endobj +1007 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F55 970 0 R /F39 863 0 R /F48 885 0 R /F47 879 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1013 0 obj << +1019 0 obj << /Length 2880 /Filter /FlateDecode >> @@ -3237,29 +3297,29 @@ _©ƒ©A˜[ÌÛªÃ3šÍ?¾ü"—3.=½ MQ‡o(GèËuËámˆåL˜¦MY.|^ÂÏÊyqç³ ªºìIú³ÏÎ$ÿ¥þ08Kpó<ŸÞà3hóešf8™Nf8°iìbÂ/xN¥|Šýï°|Gÿô?ájQÖóíê’þ,®º¬îK,ú˜¾š2¢*š¸ŠDŧïQúÍFÇoE×Ø%?¿4 ½_ŽÓp·Œµrl->VwÑïø^£Œ¿º,‡ö¬…cN+7‘ P…ÿCz¹½žÐâ}bÚ-ü,ý`׶wñ¢ >`¹RLìPc!âä}bv¼+£`ˆ+ùiXA¸4Æ
Íy/_
ºö¾à÷Œµ`Î9*‹ùšÆ|1
Ö´ýWfàœ–ÁÿùK©_…Ãéá¿_E›¢1 î£é´>f«Ûzv]Í–å¶ÜƒŽrFu‹à-Žt’Ùk¢cc¾sLÐ40YVô–W |GX Ã?1>øÿÇ×%&
·srÜŒ·ÌÉ<‹D!/rÇqÚ?ØÛ%ý?mwendstream endobj -1012 0 obj << +1018 0 obj << /Type /Page -/Contents 1013 0 R -/Resources 1011 0 R +/Contents 1019 0 R +/Resources 1017 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 996 0 R -/Annots [ 1015 0 R ] +/Parent 1001 0 R +/Annots [ 1021 0 R ] >> endobj -1015 0 obj << +1021 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [417.8476 228.9788 466.5943 241.0384] /Subtype /Link /A << /S /GoTo /D (sample_configuration) >> >> endobj -1014 0 obj << -/D [1012 0 R /XYZ 85.0394 794.5015 null] +1020 0 obj << +/D [1018 0 R /XYZ 85.0394 794.5015 null] >> endobj -1011 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F39 858 0 R /F47 874 0 R /F14 681 0 R >> +1017 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F47 879 0 R /F14 685 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1018 0 obj << +1024 0 obj << /Length 837 /Filter /FlateDecode >> @@ -3267,21 +3327,21 @@ stream xÚÅWKSÛ0¾ûWx8%+zÙ–Ë)…Жé0”¸½ gVé…³ Œ´QXK`ZyÊÈ endobj -1017 0 obj << +1023 0 obj << /Type /Page -/Contents 1018 0 R -/Resources 1016 0 R +/Contents 1024 0 R +/Resources 1022 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 996 0 R +/Parent 1001 0 R >> endobj -1019 0 obj << -/D [1017 0 R /XYZ 56.6929 794.5015 null] +1025 0 obj << +/D [1023 0 R /XYZ 56.6929 794.5015 null] >> endobj -1016 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F23 678 0 R >> +1022 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1022 0 obj << +1028 0 obj << /Length 2146 /Filter /FlateDecode >> @@ -3296,39 +3356,39 @@ xÚ¥ÛrÛ¶òÝ_¡É“4 a¼">¸‰“¸—4'Ö9/M'‘ÄT$^ì¨gοŸ],@‰2ݤSkÆ KÖûcâf±$îfˉ&Ägqdd<h< ;‡'ȨÜc>’ᮨl–÷L\Ø&¥¨ŽhÊŸzœ†»IEC#Â÷#Ë!$â)IcûIlqر!pRPGÊQŠ ðeÏ¢™˜…¢“Yéî^ëŠØOŸ–XøÎèØò nEȤ/ϽgL _|qzBHL÷IR9XÞžð*bS5«Šæ<\¢}Íû½±üÐ×ÕsêÉô¨>‡îy”>q<ÃÃ5&XHUKטpB7à¬ìÛÎ:§>kÚÉÕöUíê8ÞѲ ŸÅg@ÀÒ4G¼ìªïêŠpFD¬ÓaëðU‡!b¬ø¨±¦< EXÜØ‹álsôgX)¸H=Ð8-°åä1ÍW‡N»ÖSÎßürõÂûåeD+Òiitm¤½Sê;SÉâdþs
íÞdAµM×âµ;i0"ª*¸cºmê_ÒÇNkÕ…:ŸÔ6*GŽd8[w¹3]©p•'¥úR”}9ÜAxOmŒ™mÁˆ#.,ÃE‡/D!15ñÚ‘¬/©á=¦:×#x\^@/Ô¹„slÉx¸µ±yŸÙ“Š†£a“cƒf½3LÇNEÝ9U^µq<8þBo+OѸ-Uæ•yd¡+ûò©Xô7¿Þ.í“Ø›vçӛɥI˜UKNÏéÂ&öÑñ°~É endobj -1021 0 obj << +1027 0 obj << /Type /Page -/Contents 1022 0 R -/Resources 1020 0 R +/Contents 1028 0 R +/Resources 1026 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 996 0 R ->> endobj -1023 0 obj << -/D [1021 0 R /XYZ 85.0394 794.5015 null] +/Parent 1001 0 R >> endobj -154 0 obj << -/D [1021 0 R /XYZ 85.0394 479.27 null] ->> endobj -1024 0 obj << -/D [1021 0 R /XYZ 85.0394 444.0186 null] +1029 0 obj << +/D [1027 0 R /XYZ 85.0394 794.5015 null] >> endobj 158 0 obj << -/D [1021 0 R /XYZ 85.0394 287.5734 null] +/D [1027 0 R /XYZ 85.0394 479.27 null] >> endobj -1025 0 obj << -/D [1021 0 R /XYZ 85.0394 259.9325 null] +1030 0 obj << +/D [1027 0 R /XYZ 85.0394 444.0186 null] >> endobj 162 0 obj << -/D [1021 0 R /XYZ 85.0394 214.4637 null] +/D [1027 0 R /XYZ 85.0394 287.5734 null] >> endobj -1026 0 obj << -/D [1021 0 R /XYZ 85.0394 191.8161 null] +1031 0 obj << +/D [1027 0 R /XYZ 85.0394 259.9325 null] >> endobj -1020 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F23 678 0 R /F21 654 0 R /F47 874 0 R /F48 880 0 R >> +166 0 obj << +/D [1027 0 R /XYZ 85.0394 214.4637 null] +>> endobj +1032 0 obj << +/D [1027 0 R /XYZ 85.0394 191.8161 null] +>> endobj +1026 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F21 658 0 R /F47 879 0 R /F48 885 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1029 0 obj << +1035 0 obj << /Length 2336 /Filter /FlateDecode >> @@ -3340,189 +3400,195 @@ r¥mÓd-Äô—…½!ª>.Ù14 sÚ˜zRunýŽ|[¢”"ç'CÖ-—¶ëx>œÉò %Øõæ1$¡#ÂR»^Û¶(Nçc¬òMæBBt&ƒû!¹—õ]*tM;^ÝcT?æÈþö_šƒ.CEÙ‚µ?‡öþsmîçå§S°2<¶|Ö8JÏL]\™æÖ˜'Ím…›0h·‹¤¨n°>åwfeÇû¶nþŠV›ª nwžü,5•g¿¾²‚zÊFä|yvnvfÄÉ…P„êÿÍľF8ŽÕ:‚©H$OÕ:‚é(öXTãåwk±ë÷ÝÅÈŠÏUÛý“cˆGJö«,ùd•åE½9´×LÖ*,Ô:æf¯[øí”Â{Oí‘(P^üùw«†·çÖ5JèH•¦'hé@R5Šmuß6¸D-ŒP°ÝêþXÓº|ÉXUú¸˜wsàe•¡eÕ \“ºG€¦%w.Ü#‚í ª1Èßðž†Ù3/)Ó¥ËùC™òN_Œ
Þõ˜u%,P±zº„Wô%7È5s—Æ,c5Ðe™¨KY=·ÀrŠSdöckj’”óæÁŽžG8)g5
θ͋G+Zîr›[um@äS0€êƒYS"¡„®XsýhJrq2üªf‡Ø´íÄg`€T‹6ÑÕ9˜Âêa€;§jîo~ÃÛE“.Þ5.ß¹ÑàrÐa€N÷VÐ3‘uÛݳ„4PCeÚàs¹eÖ}wC@^Žµx«aðdDÐg]^Zåm[ztÀ.h»±æîö#8X]äöçöìÑ>n!p<A„ÚSñt˜DwŒÓ¥“÷¶$HÅ´ÖáÐ.‡ž3f#ŽÍp¬¾êÚ£ÅpyÚ ûE¦"ˆ^´©œÁ· ´öV¹pEŽ/!8«âé’ÇöoV8zD( œ>$fN;ëÅ Á‚ðÍÈ=ù d endobj -1028 0 obj << +1034 0 obj << /Type /Page -/Contents 1029 0 R -/Resources 1027 0 R +/Contents 1035 0 R +/Resources 1033 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 996 0 R ->> endobj -1030 0 obj << -/D [1028 0 R /XYZ 56.6929 794.5015 null] ->> endobj -166 0 obj << -/D [1028 0 R /XYZ 56.6929 769.5949 null] +/Parent 1001 0 R >> endobj -1031 0 obj << -/D [1028 0 R /XYZ 56.6929 752.2692 null] +1036 0 obj << +/D [1034 0 R /XYZ 56.6929 794.5015 null] >> endobj 170 0 obj << -/D [1028 0 R /XYZ 56.6929 663.7495 null] +/D [1034 0 R /XYZ 56.6929 769.5949 null] >> endobj -1032 0 obj << -/D [1028 0 R /XYZ 56.6929 633.2462 null] +1037 0 obj << +/D [1034 0 R /XYZ 56.6929 752.2692 null] >> endobj 174 0 obj << -/D [1028 0 R /XYZ 56.6929 587.2939 null] +/D [1034 0 R /XYZ 56.6929 663.7495 null] >> endobj -1033 0 obj << -/D [1028 0 R /XYZ 56.6929 559.4406 null] +1038 0 obj << +/D [1034 0 R /XYZ 56.6929 633.2462 null] >> endobj 178 0 obj << -/D [1028 0 R /XYZ 56.6929 362.928 null] +/D [1034 0 R /XYZ 56.6929 587.2939 null] >> endobj -1034 0 obj << -/D [1028 0 R /XYZ 56.6929 335.0747 null] +1039 0 obj << +/D [1034 0 R /XYZ 56.6929 559.4406 null] >> endobj 182 0 obj << -/D [1028 0 R /XYZ 56.6929 132.2109 null] +/D [1034 0 R /XYZ 56.6929 362.928 null] >> endobj -1035 0 obj << -/D [1028 0 R /XYZ 56.6929 104.3577 null] +1040 0 obj << +/D [1034 0 R /XYZ 56.6929 335.0747 null] >> endobj -1027 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F47 874 0 R /F39 858 0 R /F14 681 0 R >> +186 0 obj << +/D [1034 0 R /XYZ 56.6929 132.2109 null] +>> endobj +1041 0 obj << +/D [1034 0 R /XYZ 56.6929 104.3577 null] +>> endobj +1033 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F47 879 0 R /F39 863 0 R /F14 685 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1038 0 obj << -/Length 2907 +1044 0 obj << +/Length 2916 /Filter /FlateDecode >> stream -xÚ¥YYoÜÈ~ׯ˜·Œ -PÈŽ‡•U]mÈ-@Ð^c((Ë„ëì1ëíº6o€1ÿ/ÒF@÷óÕO—WWÜù¤Œº›CÖr¿ç|&=eÉÙ™Oi»D‘½A·;e÷˜mRÕrTWíó¼£Úëä“(Í®ºj¸ -i~3^áŽð'„n¯AhÏ4¨¯öG„Î @¶$Jžµ]†Š@PtTâõ¾¦F…¤‡¬,03¡žIsHŸé–ˆžaìF(½ž‰*ŒÑ²‰ˆ
¤‘fU<Ñ,ŠfULš]0sÒshPÏ°£ÇRq‘’Bã΂ÖXÅáà˜Øž©xX=¨:"Ihx*2xÀ{×¹å_–§#ð"!aQ“Uw¤Ö(ýz˜rJ´q!OG9€Ò»¸vŒá(‡íÄFÒ b¤TŒ]V1N#ãE…MJÝ~øéòsdÕ.°i'<’ÀV:ÊpsFDËöÿ‚ HÜ$ÁÚâY‰SD -o™€ÂÉfߪµ -Òl~ÆóxŽÇðû¦ìÅÍ$LÉÛ#™ddRç©ÐâÌ ‹ *—¡5ëLJlÐ…¢©¹ÞqX à„kÁyò¥YÂ(ü¦x‘Ÿ¸ûß
õ%[»Ê‘h¬Có.µìó2wÕ§‰"Å;E¸’k+ò{ïJbÈEÝYWâé•”Nü@{Q¦3y,Û4ÌŒ‰¾QceÂ%“Ö†&ýVE[pÀÄ.½"F¿ÐÝ•y¶)–ÂoéÜt¢U{ÊO£µƒ‡ÌÙÁ]”ú.þ] çs—7rú¼ËNN"öD“x&ŠÒ:ŠøǦ Êy–ßÌZÞîšßîøC<¥Áz3ƳT:Þnãûì£j÷° -Â" +Ì:¤¢Ž¢yÐ/¨lÇ%AÚ€–LÀ区j3Œ|ÌÞ"‡çÝÀ‡¶¨ó$J«DÐ'à9ÆqH™ë
G![q©$Z_ܶž)p@Ë%±\¹á$Y°¦8f”bq*'(Ë+I'@-*®o`ÑË¡b}šn%ÉíÁC›CáRt&þŠýÞ__ákK3ó/ÙNÐÆ4ðÓîG°lëp +xÚ¥YYsÛÈ~ׯà[¨*žÁ`pÄO²%¯½©õndnR[ë}€HHB–h(YI忧¯ÁEÈvUŠUœ»§»§oz¡à§©
”É¢E’EUÚ.6û3µ¸ƒ±Î´ÌYùI«á¬×ë³—oM²È‚,ãÅúv@+
TšêÅzûûòÍ»‹_ÖW×ç«Ðªeœ¯l¬–—ÿ8×Z//>¼¹ºä¡Ë¹òöêâ<‰–ë_¯¯°Ge0/ +bY¹þÛÕoç¬<»Zwü
eÐÊ sŸÏ~ÿC-¶ Êg*0YjÐPβp±?‹¬ ldŒïÙ}<û{Gp0JKçtbMØ4Lf”š9¥Ø,ˆ
¡R.*–µø’ﻂõ-—¹æ»]ý¸:¶y+3¶es®Óe±iËéz¬»-WoŠ¿¢fàP²Áþj±2a†)ï<&+µüO\¹¯]«WøÜó꿯˜ðH° áõ}é|K}ûTåûrÃ
ÞUFÚšKwÜlŠBD¨«Ý×JQF{/‚²äŸ…kEò\(¹ò®òndyÎ …àÂOù†‘ˆ£â˜LÊÂA)g¤…Sá-¹
e2’¤Y‹UÙÀÆQ¼ +u6béÄk»Yßbä„2tzFåZ8˜ºŠ” +²4´xøAñT° >_iþsÕ4uãæ](Ì‚0V‰¸«N–:ãzS8WVwÜGÑAÇËõÇ÷?pOg÷PßÃÔüŽ|Z +!0™mÅw-”•,-Š&ßq£hx»Æ¿‡Yº|Ëù³û5Ç»8¶è!;îWVuµ"· +aë˜*h^Åå±ú³ª+^…‰ +hÜD)«ûå¬uå„$[ ,<!ÙfÆ2Ëöf-$¡"âD-hžøƒþά¹¹©·OsE+$j.__\"*B~î!
B™ó +¿…iš¡>Ñ Q¼Z4^€|N>”<oÝ*AÑQJ–Ûš(C9v=ä»3ê9”4‡ý=ÃÑ3ŒÝHO§gêÆhC!"bC×@³*iE³*!ÍΘ9é9²¨g pƒTŤ¤Èú½ 6TqÔ;&Ö'*îW÷*††HYʽpåÖ7n¹dyq:/5yuGj³¯‡©NÉZy%kÅJÖ=¸âQbLûsÒe©l¨b誚¢bíWsˆÀ”º~ÿÓÕnQdí ÂC
låHzóŒÎˆD/½nÿAb´†£ØŠ)bÇÍ8žè +Ÿ@”ÂYA±ÝBÆ”%yõÄŠá´cÑÓu…Þ¨~{9ø¿¸7¤¬3ļ7aײj%ñ!T󘸘 Ë?¯1Þ^üº~'0¨q^Ã8}Žª¶Ü€+n‘Ú +$,‚ªD\†ß¬3 (‰EŠÇæ6¸ëYŸ”±¶&pr*_‘%Š£oŠëÔŸÿ¦ƒrµ]’Gç¿O-ÛbWøª‘"(yEøgÖ¦*)ïýs‡òCYê•<¯èÐq¦3º0ÌÛ4Ì¿Qe£9“6–&•UÙ–0±Iw‡˜247»’¼ëK¡ìpŸŸN}Õ–òÓ`mï!Söp¥¾‹ÿÌóùX4²úÜwGÙº°'Ú4°qœí*?ˆø‡¦¤×A +òÃ#÷{Ã÷{,ˆ§,\®†˜—žúûÝÊjÍ9¡z‡e ,œÁL`"zøÃѲ•T¶ágC"À`L&{¼šà¶Í1ò1{³`dvžw
uQçI”V)#Ô.Œõ°gª7…lÅÏ)ñòⶥ(¦ðIj>‰½à'”Nb°ð7 endobj -1037 0 obj << +1043 0 obj << /Type /Page -/Contents 1038 0 R -/Resources 1036 0 R +/Contents 1044 0 R +/Resources 1042 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1044 0 R -/Annots [ 1040 0 R ] +/Parent 1050 0 R +/Annots [ 1046 0 R ] >> endobj -1040 0 obj << +1046 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [418.3461 669.297 487.0181 681.3566] /Subtype /Link /A << /S /GoTo /D (dynamic_update_policies) >> >> endobj -1039 0 obj << -/D [1037 0 R /XYZ 85.0394 794.5015 null] ->> endobj -186 0 obj << -/D [1037 0 R /XYZ 85.0394 648.2128 null] ->> endobj -1041 0 obj << -/D [1037 0 R /XYZ 85.0394 619.5539 null] +1045 0 obj << +/D [1043 0 R /XYZ 85.0394 794.5015 null] >> endobj 190 0 obj << -/D [1037 0 R /XYZ 85.0394 445.0359 null] +/D [1043 0 R /XYZ 85.0394 648.2128 null] >> endobj -1042 0 obj << -/D [1037 0 R /XYZ 85.0394 407.9434 null] +1047 0 obj << +/D [1043 0 R /XYZ 85.0394 619.5539 null] >> endobj 194 0 obj << -/D [1037 0 R /XYZ 85.0394 220.8457 null] +/D [1043 0 R /XYZ 85.0394 444.3683 null] >> endobj -1043 0 obj << -/D [1037 0 R /XYZ 85.0394 183.187 null] +1048 0 obj << +/D [1043 0 R /XYZ 85.0394 407.9434 null] >> endobj -1036 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F39 858 0 R /F21 654 0 R >> +198 0 obj << +/D [1043 0 R /XYZ 85.0394 220.8457 null] +>> endobj +1049 0 obj << +/D [1043 0 R /XYZ 85.0394 183.187 null] +>> endobj +1042 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F21 658 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1048 0 obj << -/Length 3089 +1054 0 obj << +/Length 3094 /Filter /FlateDecode >> stream -xÚËrã6òî¯Ða«F®Œ€ -F;·béù»Õ¾^:WG’мø\õpƒCçˆÔƒçãs×@;ïê':ÀŸÚÆuIœQ$Ú¦d
ïäÔí÷¬Ü_ͼo ݹž‡!Jz
èÒsLc¸ÈJ¥4)/q¥Îík×1ŒëÝŽQÀHׄݺžK^ï±ÝlÚ®Ië<ŸýîöšŠ±p(‚të:®Z÷ëÀü{·/7ø’éÛ
Sôë’71
ò¯ˆ¶naÍSvdõ+×u|üÈ|>^Å}Ümʺ¡¥²¸Ô¶U®/kfléàœ—E:÷'µ¬5Xu³™2ƒUÙ9oÙY•wUÜEë¬(ewY¬'< -)´b’vÇÖ˜8hÝôÁ%=À‰‡65j)Í4E$/÷åÖõnß¡G3¿m{GC$e‚M‘¤I2¿ê "Ü!NúÍ={KEyã:rc«•‹ÇwjÉŒRV%¼ûåñ¡ÝÿV7O„xËUßîŸi¼ÝŸL8£gß¹U¼x-Íòù8é\!©5Ó4RMiÄ$©´éH#hi:§ -&@íç¿òéTQ8åÔ¨!–ýGøÌ€õ'LÝTxLæýLhηjÌ>ïC#þ€*é=º Vå®ä|®ØñºvóÞñ8âÄ¡úý%¦'Vcíã -–‹ (Ó·cŸ¡ -ı¥ç±|,Ð…µI&ó± bÀÊdX³á; 2)†ï*†^â¸×)ÒµÓó9¸ArñR™%èCí+†” -U‚Ê€ -¦ -9a¼Áçïî¯î¿½’/ÕEDDÍP\(ÑX¬±³‹’yf¡îG›„éÇa,?O±Jx« -µ©/÷±DyM˜—õ—%¡·@Åý¿P-”…*r3>ñ8.2ˆ4‹’ž‘w\ÒNǦö6ï¡ŸÉtœ û² -z
+r²?Dnc²³Py &åv(¥¼Tê9Ûb¹ÃÎùâQ\× +xÚËrã6òî¯Ða«F®Œ<Ìžœ±'™d×Ùµ=äq DØbE"‘šÏ×o7º‘Ij·|P£Ñ +J$š-RÂUÆÎR‚ŒòóîcïšnÒ½t6¯Ü/B¨ÆU8TpWú½{û=O…ÖLÊ8…¸”qeSøIƨXÚÚK +véÜŠÅ•ëVûzé:’Œ€hå…çÊ#eÜýÐ1
(o'Æ· +ŽVÞÕOt€?µë’¸¢HR«ÈÞ5È"(ÛŸY¹=ͼo ݹž‡!J†ƒˆ4é9¦9<¤¢•À+
gÊã îÔ¹}ðL<2®w;F} +Äœæùüëw·×DPŒ…Cñ£[×q׺_æß»}¹ÁA·n7LѯK>lÄ4È¿"Úº „5/ّͯ\×ñõ#óùx÷q·)놶ÊâVÛvHT¹¾¬™±¥ƒ{^jîojYk°ëf3e«²sÞ®³Â[•w]œ%M•B¬"gY¬'ü ÂŽ)RÍ$íŽ13pѺé;‚Kúy< +¡°ì<Ãw¬¿)`ê¦Âkú0ègBs¶Õcöùšyô· +g³y¦ñªm0T=q¯hÎ’ÈÏè¼WÝ”|ŠÊü
ùj*ŠlŠ&(®a¡ŒéÊeû>ÚH°›8[7'Ä¿§›¸„u
etàÕ—Ã)…Ejcc!¹„þÆ5Pô>úã>߃¯NÔ*Çh,CpŠçlªHd–lSUÓk/àâO®™Ø2CI‹P¿r1Eúvì3Tø+¶ôûD,Ëtam’É|l‚p 2Öl8fÄAFaøn ihç½N‘®^ÏÁ
’‹—ÊÄ,Aj_1(*T **˜€cWô‹å<pÕOx=e•%®Pñ9¿7@Ck`î¤ ÜINHÜ<0˜Ì‚ó{]ðxmUóŸ&öc©´.ß»:(j"4Éå멲¸Õa)@ýóŽ!jN¬2³I!bKõÓ·7ƨŠD«"„Ã×´å~@K>éÐqÆ°!µ ý¨©ÄŒ' tå•ÞžŽúÝn]S9>€ëB€X9 +‚Œ—f/Á-ÉAjl…ÇÓ¡ñ{¶3Á0 )™__ćAïvãw@aÞ¬µOù4vâ‘þ
+a+ÓtlÈ+ð˜~CYˆ|q`õ2¿œ‹ñäL +üãqÚÑÑ\5áy-ý!Œ(p†÷O'Š›jºg¸Îa¹lB%¾3“õv'ã_Œ™)7þ<[eI*äÔå&KÂ¥G÷!tþ="dc‰Ü$ÆdgA2,ÊíPJy1¨Ñs¶Äro󓢸¢G¾Û÷þ™gQ4ËäËþtƒ’Uýˆ«Ý {žÈ±À—%áihçJÞŽ¹°±w +ScvøÛ»Û7ÿøñzª2„"rU.NÞÓ±£ô•Q÷g;.Å×=˜j¬Zb#÷—Dÿ·¾=âÓô¦yÕÈ_ﻸo9–Q¸=û~·0À¸÷jž§ò²JZˆoC®Ÿ`RÛÄš¢8Ó©€àÛrÙíÚ¦ªÁ±¼ ÉÏøòä‰X?,}dzÁ˜³ƒg—÷L²GÀ›±àO{ÂrÑ#bdõ¯
ç×]`©“ª“s;ýÝJa]“™?¬k@ÂY¡C¸»»÷Í”øT’ËTN¾ïøº?=ö-\ §áqEA<,™ˆûH€ÊnŠ
܈øŒûÒSS)–IøÔð˜
LJwEf€®'ŽÃ”Ç^-ªW/ +1ôr5ï7xŸFK97uBf ·õúð–BòR½FšŽ¯Ã^Gçg‡ºæWœ»;p†n¢¡†=¹ÇY‡ÏÑîÔq—¡û©ª0yààŸÃð›ñË}–.²aŸ…ÃØgá endobj -1047 0 obj << +1053 0 obj << /Type /Page -/Contents 1048 0 R -/Resources 1046 0 R +/Contents 1054 0 R +/Resources 1052 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1044 0 R ->> endobj -1049 0 obj << -/D [1047 0 R /XYZ 56.6929 794.5015 null] +/Parent 1050 0 R >> endobj -198 0 obj << -/D [1047 0 R /XYZ 56.6929 769.5949 null] ->> endobj -1050 0 obj << -/D [1047 0 R /XYZ 56.6929 747.8139 null] +1055 0 obj << +/D [1053 0 R /XYZ 56.6929 794.5015 null] >> endobj 202 0 obj << -/D [1047 0 R /XYZ 56.6929 540.916 null] +/D [1053 0 R /XYZ 56.6929 769.5949 null] >> endobj -1051 0 obj << -/D [1047 0 R /XYZ 56.6929 511.3349 null] +1056 0 obj << +/D [1053 0 R /XYZ 56.6929 747.8139 null] >> endobj 206 0 obj << -/D [1047 0 R /XYZ 56.6929 239.6059 null] +/D [1053 0 R /XYZ 56.6929 540.916 null] >> endobj -1052 0 obj << -/D [1047 0 R /XYZ 56.6929 207.3747 null] +1057 0 obj << +/D [1053 0 R /XYZ 56.6929 511.3349 null] >> endobj -1046 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F47 874 0 R /F39 858 0 R /F48 880 0 R >> +210 0 obj << +/D [1053 0 R /XYZ 56.6929 239.6059 null] +>> endobj +1058 0 obj << +/D [1053 0 R /XYZ 56.6929 207.3747 null] +>> endobj +1052 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F47 879 0 R /F39 863 0 R /F48 885 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1055 0 obj << -/Length 2920 +1061 0 obj << +/Length 2903 /Filter /FlateDecode >> stream -xÚµYI“«8¾×¯¨x—qMua$±FǼ=ï;xëYlÀëÄü÷Ñ.\™×> R©T._¦R¼òø^‘ã‘*¼ÊªÀ‰<_Mÿ…uð\ó¤<ÓGž«ª½”¿#ùUåT J¯Ú&'KáxE¯šõ[©ÖªŒ´ÆäíŠ|IàÞ>D‰/Uê³7 -PEáuJº³Mµ·?´ÎKC{h˜·ðˆ¨w|ùíþÕÂÆt^x©ŠøzÁ/<T¾ú/‚ˆ8Q@(£x/Ó—ñC`n–.-òŠˆNT \àŠÜ"ªœ„ ¢n±‚8¶ÍØu‚{ØÄ ¼å–É2'ŠªŒ÷"ü×ó°¹dxqÈF‡è
(¥Ð:™v:Å{ûÛIJ -,2PJVü ýÎóгã'¹7Ï»= ³¼ó—…8%mkÇÙ¾T›mtŠm‹˜ƒÝ’Zð -ÃXÌÀ˜V‚'Ëó6á(«’ôeÿ§\?Âý%¢7;¦q$2§ª¸B=9\”þ‹ÃNäŸû[$”÷7–y6<×Â~eoF_lš¨¢œ÷ž -1æ"6ŒS´Ð—5ž(P à2ýIÇIÎy ¥Ü¤Î‰Ä ¤~‘øп (CNJ&“Æ€f¢€ -jæð|j=ŒÅãÔ"Ÿõ?9x³ðåë]–·Ö—- -c <Ê$;Tgz.ùó2+VEçÿ*²s©ú´‰eÇfä®?Ó“=ýð™)1ÜÔ~[=3'[7u“š'<Ü‚tß']õÀs÷D°ŒJÕö€ô߸ßV~!OõAA%•MX!m1!F•ÚÝÜ‘t°F’Ö˜”1ŸV*–ö¬x*íäðd[L£9KÆ)Ù†‘‹›;÷œr¥iLf‘ˆÙ©–ˬÀþŠ‡Gù=ئKù«“ù,•i‚1ëvNÐʆŠ-B*³]z<J/T¢ŠýAa'‘cÜHRCñˆŠ9ñ%Ii´ŒK0©ô쌆içé„ñGí% -½„™îÅ©ŠÙÍJâŸÚý/A$‹
XïJžvŸžè´È!¦=%’`Ч/ÌÐO›cßíŒ1ȤÙLXÛlFN¤ÌÄ!9fÄî!nr{LXótãK/!1WШË~$éÇÂû!á«È?©xAæÈã»'DœŠob”¹L§DN•eR9Y@lâït"ƒMnb’šGÄvmv|‰ô"‚ -–§rst¶ßÀ·ªè˜ß¸oL2î‹Ù -‘J>½ý¥Ä€âx€äg/ØWÃ?àƒ×$Wa†ˆi†T.JŸŽúæ^ùÖz<æöª*…úâ=âÇ}Iì®·Ú.šƒ•Q™ø£mcµbê|ayIy)ZªîÆiœŽòyU¾7WºÕhæ·÷Îê~ŠyO?$g×¼lõ)E¥µ:]}½.ÇP3ûÊá²ðv|Ã] °þ}æïZCAœÞ¾:dè]}Sökrë¼¹,[åª
a3¨!Ã‹Ü Û9€¡#Ü.÷¡:w¼þ^Þ7s„½{v#A±Ù“§ÚX¿W×¢_Û$Ås‚›¦·b Î¥¶·Ý•T;~¿ú•Ùjy×ÑÜ«”AÏŒœE¹Ûo4r¡‰îéü]8vj7ëäÚÓþ´D-aѯ˜“÷«k@fbÐÖGg¿Þæ¥:/oçÖ}xŠLœÖ´×Ú «»ôìú:)‡`¨yµÂÿ#ÃûgÐþo€ÈÁONßܬÂáæ@ï÷¾ìËø¢eñÙLÈ‘Îk>*õúdTá
íg8ƒ©p
Êmg¨ª£Z‡Îýb^‡ÖÀ¸ò2èe|\ãñ¸ÂÔUé§é|Àf³èÝím›Z0hP+œ{zûÞ:³º;Î
Í/MÚ¯BÉä‹žÄ÷åqœÍïŒkJíÞ
wýòH®Ôo–m#õiSG±k)_æÛ°-UQ|y_®¬»·ìíNs#ôëvÛÛ»µºáz9Žv·q‘B¯Ê{5Ùqÿ¶ì¶ZK{rf;®»öxá[GgØißϸ‰kòRá5WgÙÙªQ½ |Ð$Hw®½QžZ½< z‹÷:ÒÞ+2Bnu–沪‹=QwÓQ¼ê´ìzM¿Í—Ñy´²ãU½=9oëõ¢ýE8íž×[ÛÖ:º/5¶ûû-àt JãÉ^ٕݶ⮰/Œæ¿~Í$³d`ÿ+°¯øÅP~5ÇqÿéO„¡ŽPÑ_ü#™þç?X>ÿSÂê!EŸÿ<}`ä%¬¼*gJÑ’¿jþø'æGÕÿ
¼!Xendstream +xÚµYI“«F¾÷¯èx«§Ýˆ¢XÃ1mOûÚl @b‘ +WýÀ«,0,TøWIá«῰¯6¢µ_@Æó‘3}<rÕÕ—êw(½*Œ"r⫺{%3¬,ƒWÕüµÒèÔ&jkööÁ l…gÞ>‘Ôš‹7 +lr݈nf„Õ->†évɆ€™òýæ%[çGÎB%"ÑøiÆhko¬'I¨HdåÊOØQÚøð +ºˆâ,\ÈüJtâX Â?‰œˆl–Ø<¹py+ɈBW™ÄLTKý!A• +”¢4’°È8³^øÔ<óúTàì_l”©â×ÈÆ›˜VlDîö3;éÓŸ™ÝÍì÷…Ñ3sâ¸Lfhœ}Ôl˜"ɾOºjç°` VêÝ>i£“µü3~*Ŭ(”`†äPˆ&‚0¡S¨8»»”N⳪žd%&cÊç…º™‰%§SD¢Ç6LÌ|‹æHÎâ~Nœ0rTn/W–Ƙj†t +«‘w²‡Ì +¬¯ñPߣe¸8‘¿‚\DÈg¥¤•žLæçÚ’®YÛQpâCß+¶EÏ"B"AÈ‹ +|ŽÍoÌ7*™$:€OoõÑš¿FË!»Þ{ce²Ñb•®ýp›Hq«µëCÛmÛºz÷nQûpë-ÃÍYìJ“{ïL·F×m‰%-àê–bßxîíZÇ[õÍ_w3G¯÷ƒ‹Ñà4Åß8S;š`‡ÕNÍÜ,yà½à¾†eλ§Ü*åÞr\kª“ûü¢Xº¿—@žtÚûú@_$ëË¡ê¦vܯmg÷.îZ^ä¦~/KÜá”7‚Zc&©ù¯×uI›U·V³“w©®–sW\ùao°m+sãdHžÄö›'ﲚÁa™ŽUOÓ³íÁ²AwÒ›»¦ß‡›´áy¿š÷·{«ÊóþÙèØÁUöÖn˜œDÑî‡ætÿ^*Ñq ¶Ó–tV”å] tNÞéÜÖÓ)Ç~Ÿ*Òü}Ð×ÔãÔ8qÒLª©°ºœÙô67ºeVNWãÎïקM“ÛMMû¶5šjÃÓØƬnº®•†£ûª
¿ýR|M¡îý{AŽC›„©pxžóAôY¯~Š.tÅ5éKþ¥ê•ƒ +þÎÿJbp"dX +Fd¯ªýa«mVKMtÏ—ïü©×Hͳku·óvøÕ°fÌÞo®ÎQƒ®6¹øÕ0]Îäú²ê,Íûø”™8o¨Ž×ÙÁ›»ö¬æ6©†`¬NY¥Æþ3÷O§ýß>½wß<¸é +¹›áþRÙ—Ð]‹“„g39]æ˜îè£ÖlÎ&5fÔRÿ(Χã`Îß‚j×kÇú¤·¡}¿·±9Òo¬@žž6Át:QuÀpä;ô£Ã‹èÝ8m5µ°.§{ïG½ÅÞm;…ËëH›P4Ø2‡'ñ}}Ú&ÃñíiCnÜûá~X]Ñ‡íª¥g˜¶5»úØœ³enNÇ]±nOâëûzcÞ½õPïöÚ;~È›iØï:ws“N¹ízíÓi™ü Îz
Iñ0]÷;µ5»Ð'·}wºòÍ“=îµOïtŽk³biÃZ¾ƒ›½î9JÔèî´q¤Û·Á¤Í]Vj³:«÷&T¡6(3BêôÖžSÛ4… ,.ûù$Þô:V³¡¥Ëut™l¬xÓìÎ.N³Y¶¿ÀÍû—cYjOóÅ–s¸§ÉhÄÍGŠ8ä}ÕíÊî¶ûRoþû—\2Mú'ýd_~z\Í0ÌûÇ¢P‡°ìÿ
¶H¦¿ýoÊçHH=(ËÜç%OŸñ—stÎÏ•"$}Õ¼øÛåGÕÿôtúendstream endobj -1054 0 obj << +1060 0 obj << /Type /Page -/Contents 1055 0 R -/Resources 1053 0 R +/Contents 1061 0 R +/Resources 1059 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1044 0 R +/Parent 1050 0 R >> endobj -1056 0 obj << -/D [1054 0 R /XYZ 85.0394 794.5015 null] +1062 0 obj << +/D [1060 0 R /XYZ 85.0394 794.5015 null] >> endobj -210 0 obj << -/D [1054 0 R /XYZ 85.0394 717.5894 null] +214 0 obj << +/D [1060 0 R /XYZ 85.0394 717.5894 null] >> endobj -1057 0 obj << -/D [1054 0 R /XYZ 85.0394 690.1986 null] +1063 0 obj << +/D [1060 0 R /XYZ 85.0394 690.1986 null] >> endobj -1053 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R >> +1059 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1060 0 obj << +1066 0 obj << /Length 2379 /Filter /FlateDecode >> @@ -3539,48 +3605,48 @@ tÒ“'--$¤ƒÞ:Û…k"wŸÜTx½ñ¨¡ãà:wá¹™ŠZŠ œí†ÐEôz82CT¼~1ŒCÜB—×Ñ¡h±óþ½×=ÎxKo ?Qù=‘ê#ÏgÙ¥XíÀÕXu¾ŸõùŠ¶€$y&zT¼çNª ÿµwQŵ³»Wdî¡!æÁûî¥ë5”ÓÂ}…×ÝlÆ`DB"zÆ^gÈŒ}Ò]„£Ã™ý÷eç-ª]™¢c$È6 £”òåjÎ$PšÀƒ endobj -1059 0 obj << +1065 0 obj << /Type /Page -/Contents 1060 0 R -/Resources 1058 0 R +/Contents 1066 0 R +/Resources 1064 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1044 0 R -/Annots [ 1063 0 R ] +/Parent 1050 0 R +/Annots [ 1069 0 R ] >> endobj -1063 0 obj << +1069 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [349.4919 384.4828 408.4801 395.2672] /Subtype /Link /A << /S /GoTo /D (ipv6addresses) >> >> endobj -1061 0 obj << -/D [1059 0 R /XYZ 56.6929 794.5015 null] ->> endobj -214 0 obj << -/D [1059 0 R /XYZ 56.6929 594.1106 null] ->> endobj -1062 0 obj << -/D [1059 0 R /XYZ 56.6929 562.6395 null] +1067 0 obj << +/D [1065 0 R /XYZ 56.6929 794.5015 null] >> endobj 218 0 obj << -/D [1059 0 R /XYZ 56.6929 370.2937 null] +/D [1065 0 R /XYZ 56.6929 594.1106 null] >> endobj -1064 0 obj << -/D [1059 0 R /XYZ 56.6929 341.714 null] +1068 0 obj << +/D [1065 0 R /XYZ 56.6929 562.6395 null] >> endobj 222 0 obj << -/D [1059 0 R /XYZ 56.6929 214.6004 null] +/D [1065 0 R /XYZ 56.6929 370.2937 null] >> endobj -1065 0 obj << -/D [1059 0 R /XYZ 56.6929 186.0207 null] +1070 0 obj << +/D [1065 0 R /XYZ 56.6929 341.714 null] >> endobj -1058 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F23 678 0 R /F62 990 0 R /F21 654 0 R /F47 874 0 R >> -/XObject << /Im2 979 0 R >> +226 0 obj << +/D [1065 0 R /XYZ 56.6929 214.6004 null] +>> endobj +1071 0 obj << +/D [1065 0 R /XYZ 56.6929 186.0207 null] +>> endobj +1064 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F62 995 0 R /F21 658 0 R /F47 879 0 R >> +/XObject << /Im2 984 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1069 0 obj << +1075 0 obj << /Length 1913 /Filter /FlateDecode >> @@ -3590,59 +3656,59 @@ xÚX_Û8ï§È£h\KòßÇöfoÑÅ]±èÎ>]ïA±•‰P[ÊFöäæÛ)JNœqºE€˜¦(Š"©)³M?¶©‹4M¾©š<-2Vl veÒÖNϬ—ê¼g¸rÞÊ.ÎèŒÈ¢h¡Á¾¨îý<æBh%ÒËÞ:z³á˜èáhÓ»>HÅôÑhÇ L8[Ú,²j¼œ—D>Õ/…T¿—T„
¬ñØ€0š&îm´Ù4DÈÞY¢Bž¼è.ÈÜ&ò0§5¤RP¦†³à÷öÆ'çSʯ†í°ÓF^b ®Æû+ìY‰Óò¸ó†_Ž;oDHàJz+ÞI©!úê`Dñ:™Œ¡£Q’â™ÞR-ÅãT!pº M&PÄqíèÙi7jÓŽ4¾§YyŸ"A¦Í ì‚d,"û©ì±‰kkÒ;¥)ÏR^Š:”&JÓ×9*—“²,Jן©IW؃È!6Š‚O endobj -1068 0 obj << +1074 0 obj << /Type /Page -/Contents 1069 0 R -/Resources 1067 0 R +/Contents 1075 0 R +/Resources 1073 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1044 0 R +/Parent 1050 0 R >> endobj -1070 0 obj << -/D [1068 0 R /XYZ 85.0394 794.5015 null] ->> endobj -226 0 obj << -/D [1068 0 R /XYZ 85.0394 769.5949 null] ->> endobj -1071 0 obj << -/D [1068 0 R /XYZ 85.0394 576.7004 null] +1076 0 obj << +/D [1074 0 R /XYZ 85.0394 794.5015 null] >> endobj 230 0 obj << -/D [1068 0 R /XYZ 85.0394 576.7004 null] +/D [1074 0 R /XYZ 85.0394 769.5949 null] >> endobj -1072 0 obj << -/D [1068 0 R /XYZ 85.0394 544.8207 null] +1077 0 obj << +/D [1074 0 R /XYZ 85.0394 576.7004 null] >> endobj 234 0 obj << -/D [1068 0 R /XYZ 85.0394 403.9445 null] +/D [1074 0 R /XYZ 85.0394 576.7004 null] >> endobj -1073 0 obj << -/D [1068 0 R /XYZ 85.0394 368.2811 null] +1078 0 obj << +/D [1074 0 R /XYZ 85.0394 544.8207 null] >> endobj -1067 0 obj << -/Font << /F21 654 0 R /F23 678 0 R /F39 858 0 R >> +238 0 obj << +/D [1074 0 R /XYZ 85.0394 403.9445 null] +>> endobj +1079 0 obj << +/D [1074 0 R /XYZ 85.0394 368.2811 null] +>> endobj +1073 0 obj << +/Font << /F21 658 0 R /F23 682 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1076 0 obj << +1082 0 obj << /Length 69 /Filter /FlateDecode >> stream xÚ3T0 endobj -1075 0 obj << +1081 0 obj << /Type /Page -/Contents 1076 0 R -/Resources 1074 0 R +/Contents 1082 0 R +/Resources 1080 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1044 0 R +/Parent 1050 0 R >> endobj -1077 0 obj << -/D [1075 0 R /XYZ 56.6929 794.5015 null] +1083 0 obj << +/D [1081 0 R /XYZ 56.6929 794.5015 null] >> endobj -1074 0 obj << +1080 0 obj << /ProcSet [ /PDF ] >> endobj -1080 0 obj << +1086 0 obj << /Length 3113 /Filter /FlateDecode >> @@ -3662,152 +3728,150 @@ Hy‰¨Uc‹\`e*Y;
Þ7hfå*óUÌ8ëÏ;xÃ
”èÚÞŠçßEž
w¨µzÌsÖµƒëðL;s”=—Í⫬ƒWŽi}n‹¥÷ ³ÆGZP[ññk(ü[wÔ6-µ]_6zü´ ‘5hÉsª\0Á03 “ã…õ"GÌX€2Á K!§óÝ–(Š¯x¼‡]Ç^ 2Èíc™¨/Öìªn>EXX'»ÃîÅOÃ;"¢Ùmðx¥Z 5=J·[S 2³¾ÍAèAøñ¡êŸ«ªÉ²œÈK’dB©
›Êó>”_>u|¶ô&2¶‡œÚy¹Š(FiÁ©Ï“Ã[ã’Ï{¬—=+K£z©Â©«Â&±ÂPÙ÷å|qh endobj -1079 0 obj << +1085 0 obj << /Type /Page -/Contents 1080 0 R -/Resources 1078 0 R +/Contents 1086 0 R +/Resources 1084 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1087 0 R -/Annots [ 1086 0 R ] +/Parent 1093 0 R +/Annots [ 1092 0 R ] >> endobj -1086 0 obj << +1092 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [356.2946 363.7923 412.5133 376.6291] /Subtype /Link /A << /S /GoTo /D (address_match_lists) >> >> endobj -1081 0 obj << -/D [1079 0 R /XYZ 85.0394 794.5015 null] ->> endobj -238 0 obj << -/D [1079 0 R /XYZ 85.0394 769.5949 null] ->> endobj -1082 0 obj << -/D [1079 0 R /XYZ 85.0394 576.7004 null] +1087 0 obj << +/D [1085 0 R /XYZ 85.0394 794.5015 null] >> endobj 242 0 obj << -/D [1079 0 R /XYZ 85.0394 479.565 null] ->> endobj -1083 0 obj << -/D [1079 0 R /XYZ 85.0394 441.8891 null] ->> endobj -1084 0 obj << -/D [1079 0 R /XYZ 85.0394 424.9629 null] ->> endobj -1085 0 obj << -/D [1079 0 R /XYZ 85.0394 413.0077 null] ->> endobj -1078 0 obj << -/Font << /F21 654 0 R /F23 678 0 R /F39 858 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -1091 0 obj << -/Length 3627 -/Filter /FlateDecode ->> -stream -xÚÍ[[sã¶~÷¯PŸ"gV0î—dú°I¼©Ód“nœéC’ÙÐms–"µ"µ^§íïÁ")HVje¦³“Áƒƒƒs¾sL&þ‘‰Hj&Êp$0“ùòOîàÝ×g$Œ™ÅA³þ¨/®Ï.^151ÈH*'×·=ZaÉäzñóT"‚Ξ~ùýëWW_ÿôæå¹âÓë«ï_ŸÏ¨ÀÓWWß^úÖå·—ß]¾¾þ~af¦_þíå×—oü;ˆ|qõú+ßcücÕ7—¯.ß\¾þòòü×ëoÎ.¯»ÅôL0³+yöó¯x²€us†3ZLàFÄ:YžqÁàŒÅžòìdzt{oݧ)rN¤‚MfZ"ª¤Ø?ŸÃ´¡)RJèѬ3©‘$Øî ÖˆÒÞ–˜Þ–(ŽŒVD$£ÌíH±ËD+$˜1ÛaG…aÓ"™E‚³>Å]îF‚ŽÙ[ÕëÖ2xñ -:¶c …¶bv -;êeu>c°ãW?øçö«Á‚"…… U›åM¾Ngi)D†„¢‹'éÔMV4ž³²Xm¾ð?ÚÚ>Ù‡Ÿ÷ës¢§õæîÞw -ƒWž±yÞ40‡åùXŸÃWUUTwÀ9–Ó¬ñOÿ]}N¦-˜,WzzUù7M½ÌmKLç}mŠ§Y¿oóuѼó#~Áÿöé'ð þõü>[gÀ÷:ü„ÏLy°¹±e—³ð-Ç– -’ -!PP$î0â0íHÚ*oB<@TtŒ"ŠÂ4%"NÁ U?f|΢Œ8ìUC#Ú# *"ŒçMí‹éOŃ‹G€võÄÓýÇS3H/”îTI§Ø÷7§òŠ·ø ‘n¯W¤ö0{Eú¢±t+~—?Ž×l M JlÇ=""ÁYŸbÂ-‚Z£ðW,’.ä`º0øeÊ·aÄš
áQVT;`›Ï™R§[iGñ‰¥RìQ)†k²ež'È9¢±ø°nbä¼j]`Kw±
GZܹ"Û“ùG±iˆ -Ýo»ù„ë2©2>Æ†î› -6D(2D=±Rça×¾ÑB -rÑ“I¦£ø„h˜õ€ýCÙ¤ñ&è¿_…K… -±ç‹,=ø(!øW®ûQAÒtþuSE|ÛS0¤Œî•z,å.=b*HÊ(S1˜^ä·Ù¦LCœ Í»¢ÚÖ|<Pø—ÉÒˆFt…íŠf\ÐäŽ3 -† -Y0!Ã\äýL¼ñKÔVë]z!0sÛd;»² -aÖã+5”ç2ûX,7K‹Áï~ÈŠÒ{L÷sYo*[®Wàš“i7clFûkƒø¤Øíy—fDLÖ°µL=[ìÅYŸä®Ø9çHS€§nØ!±+¤
ï$žt€²ƒ U.;;p{m#‡¬†·ÞZæÑx\us`OM¾þ¯GŸ7m¶nCä0vÉu¤â˜“)aÔ°yâ°zeÓKFdûã˼¾Æk{Ã[Õ+œg¥÷…v$d¨õú³&PÂ-þD$û{‚+Èìâ’Žtµ^'Ȇ(qïÔÒ¸1—F3ͧ¾ylíÓ.Q Dy÷Íw{ˆÊ¨øG0¶<š±%DÖ±'f[Kƒ8:RÿúÞÍá]ÑU!‚˜bT…ܲÏë‚""‚ä¾éTžöTÒ
¤®ùi÷›ù€8æÓîéCGWžk¶)IÙ«„ŒG^ßçþ¤0fÐ\n\ΕWóxXÙ¯ú„,¢wž™ù/$‰tmª¦¸«œq`Ù¥A‰„Â&E6ÓÁÔŸ3Z͹Tœc€&lJâ’"v’7ý© ‡ãJV6`’Çøv‰4Ár[aö; -ù#jT{ï é&o:\‹‰P -|+2JyÙ>zï’*_uãNV¾êSÜ_¾ðç‘£Ï,Â-˜ådüuŸ`Š0@Ø€ÁªNEËàæ¹`ÑÉ\.Éß…@†Ÿ‰öb@¼,ºc›}HŠŠÆ”æhPÕ²‡jš8Å1t“rF -Ÿû!ßø5”¡†Äö±9ä#°æüK$èîˆiõ6‹âu/ʼºkïÃûel,Ã’º1Ðx[,âx¿¶yùÖŸî÷:ÿµoݾÿ?S$±§³Ž.m:#{[KÃÖ~•Û+…U±=à÷&Ÿšì.… -£M·šæÁ ñW–AÛ Y:mƒ&í¡ô¯ÖÅ2[.CƒŸáÞ½ç®),ò6_/‹*Ïçy{æïÌ•¾ÃßU€Æ YoÂ|]]^Ô«|Ùî@D`l$ü˜JØ{LÒÚÖæœL‹Ô—ÖTWêÉ\k -|>‘ªRrww¥—ûR_QÝ}¶ïO%¬ÇdþlcÿŸ†ô9Ì$¼BfÅä–’/Ž5žQ5qþ¡ã˜‡^ž€ŸÿÙŸ1ÊÄÞñu2Xx„¹úáž@ŒfžˆÑ'¤³³_8aÌS²90]'šÑtIÉô¦&Ä,<}ÜJ&¶»ø$dtuëLûp˜Í¥XŠ[ܹ›gÿ ÎVÎ\!¦5M¯¼óð)»tFw8'è2I¬ÿ‹²l½endstream -endobj -1090 0 obj << -/Type /Page -/Contents 1091 0 R -/Resources 1089 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 1087 0 R ->> endobj -1092 0 obj << -/D [1090 0 R /XYZ 56.6929 794.5015 null] ->> endobj -246 0 obj << -/D [1090 0 R /XYZ 56.6929 304.8746 null] +/D [1085 0 R /XYZ 85.0394 769.5949 null] >> endobj 1088 0 obj << -/D [1090 0 R /XYZ 56.6929 277.1668 null] +/D [1085 0 R /XYZ 85.0394 576.7004 null] >> endobj -250 0 obj << -/D [1090 0 R /XYZ 56.6929 277.1668 null] +246 0 obj << +/D [1085 0 R /XYZ 85.0394 479.565 null] >> endobj -1093 0 obj << -/D [1090 0 R /XYZ 56.6929 249.2319 null] +1089 0 obj << +/D [1085 0 R /XYZ 85.0394 441.8891 null] >> endobj -254 0 obj << -/D [1090 0 R /XYZ 56.6929 169.6708 null] +1090 0 obj << +/D [1085 0 R /XYZ 85.0394 424.9629 null] >> endobj -1094 0 obj << -/D [1090 0 R /XYZ 56.6929 141.5207 null] +1091 0 obj << +/D [1085 0 R /XYZ 85.0394 413.0077 null] >> endobj -1089 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F23 678 0 R /F21 654 0 R /F48 880 0 R /F14 681 0 R >> +1084 0 obj << +/Font << /F21 658 0 R /F23 682 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj 1097 0 obj << -/Length 2803 +/Length 3638 /Filter /FlateDecode >> stream -xÚ]sÛ6òÝ¿B™{¨œX4@ðóúÔ¸NÏÖí%ÎÜÍ49Š‚lŽ)R%©8þ÷·‹]€DÛ¹kG -²h</æ8*'fybÎaš)¸]…bþ$dzxU)"Ø¥3ŸÞÑ©nÕñ±0•æQ²lA¾×4¹úþŒ&EOãJ"lôŠ>—¼n¸ÓÈ-!ý#dD‘DÖ8R¥E{|ä€ûóš~(½ÑÍð¤ž#$ðy‰{«ž‘¸]õ²ÄŸ;Õ“øá±Ó÷EÉ6ņgíšeÞð¸Zu§2›ëž•°)†òŽ¦uÕ“šy¨†»çt†`¹i³Ü‹²žÒM„2̾Z7¡’X¼t¼UÏèÆ®zY7ÏêéæðØiÝøDz74º¬X¿Nº)붷{*Öã²+JÝã=f~.’Ì‚<™9ï²6âEÊJÍK£˜,Ñ.T|ÜÄ -ùÆÓauÊF
ãŽÜPCKÏE]@Z-Ê’|-%›ow}ÊoÉ>H4 ©Ä@À¶Zã HÚúò©œ÷=Ø’ÊäüŒäXágS:wªt·¡™ñ†â´‰½µˆªfãعP1Ü*íî–/êÓª-w¨+cÚ“vô¯;«J@…ùü¶úl!W¿hSD lÁÎ…®õ…0È*bÊv³e?\mˆÙãöˆ‚¯8¼>˜‹ŠrºŠ…ÑŠ¹ºâ³îŒ ¸qÌ¡zÁè&Œl×€A6yB¹2÷Í9Oˆ š¢„ÀUºãÛ6FÂ^cî9™»ÝM˜•ÞêfÕÜ.¸CCéHJ(ÇK<†×/Á¼4ù|±®aQjÊÀœÁƒÆË¶È ê³½,Ï.J‚ÔÍ mÛ
=/56ï¥Îf=,a•P‘awßæ¼ð -G¨I°> »‹«ýÍ´§’톕Mß«–ƒ^;¥v'ñÂájú·Ú^SæÄVh· -¸E -+Æ/õÚUçøí6.)è+s*ìáSñfùayWSJ„U†aØ>¦+øÐÕ87iÆ£)§)ˆÇáü]kW)6ÛZO¶)tÛ£wŒ —Ò¶Á2uFßb.Éç¯N18R};á‰ÐúªÔ…o*‚Bå¶àW8 -QTy9§ƒ73‹À’jöW,¡Ù´ã¨:¡Or7\a“®iÉÏó4 -!æíf¬×>`«÷eBn°òHÉÊo?S÷Ž›Ð;nŠöçu‡DÎ lÙ…p2’q5ƒ‘àÒíVw’ÍãÃXA!–õ8¹ûmQòtSpË;’IŸˆIÞw‰ùiÐ&nwÕL’+©5v{‰œßœæá¼%„9 ¦†wÙvn»nÖõ4!7Ô¼ú¾‚æ -ª×~(ºôªìó'‚†‡– å]Ñå`<ç¯ Žo¨}]ôØ꩘Èáƒ*¢Ö_aiâŸñúœ †ìâ·4C "üK,Î\å8]}aA RïyT¤ûÕ|¯t
U:u½ðÉ\óZÑÛ=îŠg\H@òväéqTPÑ{zA!’åº>ÚÆž]Ѐô+(pn"®ÕPžï?\3VöfWÕ¶v5wƒ;Ïi>ÜÓ|¨Ìs/ò€Ö{*•P\&Ô•‰ðeßV¼n1õñK{H妲M - -*â=ß8fœp¬ÛæËJ?—˜.øˆ›P¨ „6äë3êÔ_|*ðڄ“ðŸþ~ü¯0J•eáôvÉ‚,ÌSË2®Ô!ç1Êq¦¬ÿÕ -€endstream +xÚÍ[Ýsã¶÷_¡>EÎœ`|$Ó‡KâK/M.iâL’Ì…–h›s”¨ˆÔùœ¶ÿ{w")Jvje¦s“ÁÅb±ûÛÀlBá›(M´ãnbœ$Š25™/ÏèäÞ}yÆâ˜Y;hÖõÙÕÙÅ+a&Ž8Íõäê¦CËj-›\-~šjÂÈ9P ÓÏ¿}óêõ—?~ÿòÜÈéÕëoߜϸ¢ÓW¯¿¾Ë¯/¿¹|sõü¢ÂM?ÿÛËï®.¿ït$òÙë7_„¨~ùêòûË7Ÿ_žÿrõÕÙåUZLwÁŒ +\Éog?ýB'X÷Wg”gÕä~PÂœã“å™T‚()DÛSžýpöD°óÖ:&@)Ñ\‰ÉÌjÂV‡§
SP˜66•#Æ(;˜u¦-ÑŒâžPK8ïl‰ël‰‘ÄY31@D.üŽë¡L¬!J8·ö¡p lí¸Hf-ÁY—â>wŽÅ‡ì«Mƒ^¼‚ŽÝXÆ¡mN£^®PKìôõwø4¯z3HCŒ°:~´Ú.¯óÍq¡ˆÕJÅa jÜééÕ]>B‘ƒÚXù(ACœ€ï°¢Ì–ŲhòEษB'?ï6çÌN«íí]è~„z´'3&1œCƒ§÷T23}Ÿ•Û¼í뼬î±i§Œr:›‡u1ÏÊò!üô3åu³)æÙîí9›Öyh_ÇñëÀÚ<¯k˜9¢}V6çðájU¬nÏg‚êiVãS…‰ªª‰J›µ +¯ëj™‡ó(¾€6§ÓlÕ~Ü䛢~FüLýõãàÁÂëù]¶É€ïMü Ÿõ8 +°s(3ÝÖ¸@lyž?×e6Ïïªrá © +üx›6búªÚ„îüC¶\—ù‹Hˆ
Œ¼“”7vl>M”¡¬ã‘n<,¬Qjb©8¸Öòög/ ’¦I ÅcŽšÂ¶Ž8ºL•d„¶æ +u>ßnŠ&?bSm}žmJœÒ¦(…äØÏ`5Ó„*µ©vÜélªCñˆMuù+‹ºyŠUA¸$Ã`ßBeBM«U;6Ṭ‚V˜!n5-F
^J¹ÓI&Q|D4ý#`_6ãxõ?¬Â'„J–¯!ÕkB|)c|‰ÝËb^•ÕªýÑó‚ F¸šž9å«E0`0›ËZ;Š¤ŽØPG;OeCm¹áé$Û/ÙðÄhqÔ„”ãà§!{:Z¹ÀRƒbÒu”Ãj5[å·YS¼GÝÔt*øâïð¶X5ùÏ£á†õÉ n¢5!…ÞÅï8ââº#||AC_»‰ƒÈd&6Ü)$'5L5/·5piÖ…›¾Æ4@p˜k>Ï×Mv]"\‡ºHxµ„´½ ½7Û
ù&ôG(Tv…òÂþ¡1¯`½šð£ˆ|WÌ£rí«:<Ñ+Xg랧&F+p£V»?ª`JÃ2¦ÛYs·Ò
;qølŽg]Šûü1ʉ´ÐÕãð@4À˜%”ÙŽþk;ým[‚6ÖÍ|¡K›v×±û¾(ËÐòµ'xÆÚ´|• +±ç‹,݇(!úWi»Q#Ú%ÿº]µø¶?§Ä8Û)õ å‡>a*Hʸ0m0½Èo²m9IF¬LE7²«(ø¸§ð/GKk • + +»Í¤â£;.8d®Å}uÐ=?j)κ$G⠈…´|7ó‘=ç3ÖÏE~Û‚‰×aiƒ•ÄœûôBQá· ;SY… ôøÆôå¹Ì>ËíÆRð»ï³¢Óÿ\VÛ–ë
¸æÑ´O:B)uƒýÅ ~TìxòeSE-l0Ï{¢8ë’Ü»”’X𔆻!ÖÉd í1(;HñAå2Ùß‹Ö6²ØºÏê~hp¬eÞ¯nöì©Î7ïóÍàóºÉ6MŒ†N`tk@yÊ.MaI*iØ<‹qXµÆô2œáïp€âB™7Ôx±7¾õQ¸ÂyV_ˆ#!C6ŸŒ`gñ§E²¿p™½"Ró®V›rLNU»‚w#Ô±4˜O£…•ÓwEY]?4xà´OTQ™¾ùæ +|+qÆÙ>ï2V¾JãNV¾êR<\¾êñ£Ë,Â-˜ådü%Š0È' ¬Çઋ–ÁÍK%Z'sYø$E?Ó"\Ü‹a8 +w "p ?Œ%ì&yŒ?±.&/Â_Z3©Ô9¹µ +ÍGXÿ/Õ/oendstream endobj 1096 0 obj << /Type /Page /Contents 1097 0 R /Resources 1095 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1087 0 R +/Parent 1093 0 R >> endobj 1098 0 obj << -/D [1096 0 R /XYZ 85.0394 794.5015 null] +/D [1096 0 R /XYZ 56.6929 794.5015 null] >> endobj -258 0 obj << -/D [1096 0 R /XYZ 85.0394 438.8479 null] +250 0 obj << +/D [1096 0 R /XYZ 56.6929 304.8746 null] +>> endobj +1094 0 obj << +/D [1096 0 R /XYZ 56.6929 277.1668 null] +>> endobj +254 0 obj << +/D [1096 0 R /XYZ 56.6929 277.1668 null] >> endobj 1099 0 obj << -/D [1096 0 R /XYZ 85.0394 409.9891 null] +/D [1096 0 R /XYZ 56.6929 249.2319 null] >> endobj -262 0 obj << -/D [1096 0 R /XYZ 85.0394 349.7918 null] +258 0 obj << +/D [1096 0 R /XYZ 56.6929 169.6708 null] >> endobj 1100 0 obj << -/D [1096 0 R /XYZ 85.0394 323.4555 null] +/D [1096 0 R /XYZ 56.6929 141.5207 null] +>> endobj +1095 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F21 658 0 R /F48 885 0 R /F14 685 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1103 0 obj << +/Length 2809 +/Filter /FlateDecode +>> +stream +xÚ]sÛ6òÝ¿B™{¨œX4@ðóúÔ¸NÏÖí%ÎÜÍ49Š‚$Ž)R%©8þ÷·‹]€¤DÛ¹kG +ùÆÓauÌF
ãÜ–ºš Ÿ³²X´šå9ùZL6_:ú •oÈ>ŽHd4 ©Ñˆ€m=ÔÆ´õås9o[°%•Èù-1ȱ„C/¦tîTÛéfG3ã
/Ä2h
ZkEÉÆqp¡¢Û*õaÃӪΨ+cÚ“vô¯F‹U% üt¾)>[ÈͯqŠ(\`çB×úB+È*®äõnÏ~¸¢´!f…¾>®áõÁ\TÒU,Œæ¢k²Ïº1‚0àÊ1‡ê£›0²C2Ù¤åÊthÎiDLhÔlDìd +c
¸2d²I\à€hªV‹°8.ƒk5¼ò¢ª»b=UP‡ÝqÌÈô"/Œý`Díƒn&‰…ž +üÿƒÖ‚ê¨ø¼$QÉØÆó,wEéð4¬IÓ(|済ÄjtDŽª]S„8¢AO˜$ÑKôÆìö&ûLPƒŽPªÿ‘;¢¶ +RQ™útàè™&šBÍõ¡ØeÖ”çRJò6 +ÊQX‚’¬¶5,=PÚ3•Õ0é`c«›ÏS%es,ÖêŽÈ Gí;¢‘¦å +G¨I°>¢»‹+*ýÍ´§÷’І…Mß«šƒ^ݤv'ñÂGájú·Ú^S¦Ä–o· +>tÑÏMÚ…±ÂhÊi +â±?W[ì/Ùn_êÉ6…n{òŽá¥RÚ6Xz¾§.ýà[Ì%éüÕù"ç1POªo'<Z_»ðME¯Üüò{¡ãU^FŽÀi§ÁÍXRÉþŠ%4›®8ªÎDè“Ü
1lÒCœê‘ü<=ðŽqp.ëúþ°GKP¦FI0àÁÆ3¥U¦TN&FÉ—Üí€2“ùǶ|£`&!Wù
|¯»¥±qGûT°qì%ÒåS¹[GÙ ®kë%pDKæÑ +¶Ùgª£ä@ÔCÖò(hF¶±„öô~ê嫯‰\'¸´Õ{f‹üº¯®è°×ôM +µCôž“›ãeV«/¢g +|EõÏR1¿ªw}½ö[½/rƒíGHVƒöê-~Ç…F)åvÍ‘ƒ–ÈQ‡ÅeÂ׶»bìvØŒA·ßëŒ1Àðú +Ê`‘žbôè¢Óí>˹3ÜeÇ‚'¢¶(¶ìÊJ´†Í¡±:‰c¥Æ>/’ó»óԟ״`(i§áF¶šM“Áš–€&øà†’±ïh0bÅ&×<Ò25¹°lš\À!;ÍÀ‚Ù!ËÀÕoÞRþ|º3h¡--/÷ºqo +xS·BëˆÀ:â}x’-dh*}Ú(.
PÑÄ1–^("÷Ú,XñîÌC$¨qÄ1£ô‚3gOfÕbW4^aŒ–"”g23ø%û«H=_BU4êD./‰îŸæëÍ›©Fço
u\¬yþñöæß43º¶ô°•Á‰Qý3êê¶á{nûÐä:¾m¶Ñ/G‡«Þ«MñÃÏy¥!9rkÀ²ÎUR½[?Eà¨GíÿO:ud|paGžPÊÕÂx>øƒx¤ bm»¬éhO•}òDP÷P$ßfM–wÆçqáò5ÁñÝ´-³Û;9|D%,j7ñå•&Ã3^_ÄP€]ü~fˆ A¤‚ƒ…‰«§+.,D<xñ¸B€ï•.¡2§N>™a^(Z»Ç]ñ‚‹HØŽ<=ˆ +Š^8r/(8ò¡\«ÀG]Ù³3ð‚_…LZ›ˆh%”äãÇŠŽ‹m0VöîPvžtuv…:ÏiÞiÞW扗ŠwXéÓ[*
•P\Ô•†ðeßS¼®1ÝñëºO%¦² +endobj +1102 0 obj << +/Type /Page +/Contents 1103 0 R +/Resources 1101 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 1093 0 R +>> endobj +1104 0 obj << +/D [1102 0 R /XYZ 85.0394 794.5015 null] +>> endobj +262 0 obj << +/D [1102 0 R /XYZ 85.0394 438.8479 null] +>> endobj +1105 0 obj << +/D [1102 0 R /XYZ 85.0394 409.9891 null] >> endobj 266 0 obj << -/D [1096 0 R /XYZ 85.0394 249.9022 null] +/D [1102 0 R /XYZ 85.0394 349.7918 null] >> endobj -1101 0 obj << -/D [1096 0 R /XYZ 85.0394 222.3206 null] +1106 0 obj << +/D [1102 0 R /XYZ 85.0394 323.4555 null] >> endobj -1095 0 obj << -/Font << /F37 743 0 R /F14 681 0 R /F23 678 0 R /F21 654 0 R /F39 858 0 R >> +270 0 obj << +/D [1102 0 R /XYZ 85.0394 249.9022 null] +>> endobj +1107 0 obj << +/D [1102 0 R /XYZ 85.0394 222.3206 null] +>> endobj +1101 0 obj << +/Font << /F37 747 0 R /F14 685 0 R /F23 682 0 R /F21 658 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1105 0 obj << +1111 0 obj << /Length 2453 /Filter /FlateDecode >> @@ -3826,14 +3890,14 @@ kJÞãGñŒLG£DKaA"™$ØØ‚Ütí|Óv·Žeé85…~ÞñéOUÿï73è§HöCÈP-/ÖÛ Té*㶓ÉÈ=Uk©žåð {þõÿã](‚¸„è’‚ñð§;?Ñ äPÇQÁäþ_hD1ŠUÿ,9ö‚@ =z|²b.ªòðQgÆQ^Lô ùéŒÍ"cÒÇÿgÑUòèã{á[iÚùÜZ¦ÙïÇ2Å“&„© ÐXÓqõvt‡ÒŠ`|çäþ9»Gÿ²Ë÷endstream endobj -1104 0 obj << +1110 0 obj << /Type /Page -/Contents 1105 0 R -/Resources 1103 0 R +/Contents 1111 0 R +/Resources 1109 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1087 0 R +/Parent 1093 0 R >> endobj -1102 0 obj << +1108 0 obj << /Type /XObject /Subtype /Form /FormType 1 @@ -3853,27 +3917,27 @@ xÚm”In1EOPw¨u€$ÅIg0²Êľÿ6¤¤êV5oʯÅésÀóή¯ƒÖ×O²Î Ž¢‘ÿ¨#h8Çùø:„5?ù 6\>RgÈbÏWÖ¹j[†› WŒÏ¢®{6;»²þFÃÇñ÷ø]š¨)Õ/Ô¬Mu;pk;Ì©Ëdh<åE–ñ¬AÏw³ð¬±±Nê¦ó¡Ä½t•‹ùD„™Â²]°Ä(‡;„ ·åŽ°Šr²ÂÙÄLûˆ
T¥Í¡èª‹ŠŽt’¹w_=Î]ˆ‹=¦uSä÷—ä"ï±yl±‡µÃ-ËkHsŠöreOÚ³êvg›<7ºt,‡Ýe—;ãÒèÐ/I…B÷&ê(ýê³ö󻉨YÙ¹Ç,çkRÔšÚ'^
m" ^˜h±ÎW9AVªy©/fýÆ"•œãûFy-Sng \Çdª¼˜©Æ¥†Í}B©•µŒÎ$âw1.¶&Øíþ²C¶O–ÃVç X×9g¹E{îÇ<•ãóP)!ÍZÜÅŸLÞª~ÑÔ'¯UâXLµüc“ÅXsЖõÚ¯½˜Ó’~òBL–§èªÆ¹O¦ºNZ_[Èü.øšŠû*]3QôçÇñ!Ö-žendstream endobj -1106 0 obj << -/D [1104 0 R /XYZ 56.6929 794.5015 null] +1112 0 obj << +/D [1110 0 R /XYZ 56.6929 794.5015 null] >> endobj -270 0 obj << -/D [1104 0 R /XYZ 56.6929 426.5656 null] +274 0 obj << +/D [1110 0 R /XYZ 56.6929 426.5656 null] >> endobj -1107 0 obj << -/D [1104 0 R /XYZ 56.6929 394.7216 null] +1113 0 obj << +/D [1110 0 R /XYZ 56.6929 394.7216 null] >> endobj -1108 0 obj << -/D [1104 0 R /XYZ 56.6929 335.9523 null] +1114 0 obj << +/D [1110 0 R /XYZ 56.6929 335.9523 null] >> endobj -1109 0 obj << -/D [1104 0 R /XYZ 56.6929 323.9972 null] +1115 0 obj << +/D [1110 0 R /XYZ 56.6929 323.9972 null] >> endobj -1103 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F39 858 0 R /F62 990 0 R /F21 654 0 R >> -/XObject << /Im3 1102 0 R >> +1109 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F62 995 0 R /F21 658 0 R >> +/XObject << /Im3 1108 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1112 0 obj << +1118 0 obj << /Length 2937 /Filter /FlateDecode >> @@ -3892,51 +3956,51 @@ clk¿©ÊßãNs¨4¨ŒZÕfuYDuÖwUjÉ×ëzs»OþS;Ú‰’{¢ín%;Ñè`ñŽhTt^«Ÿâµ_Y¿Üy¼~—pªM–J² 5®èÄÂ¥ÂpU›é(dà³SsY§§Ç^bá‡ýÑh2`J^ì÷:‚Ë˼À«k.Â#pÞ²ƒÞ*,„J™™‰PžÚg{kÇq6d9r£`=„¨ºay+6šG¼5ƒS‡¼|9–¥¢"Sí7ÓüìŠÔw_o°ò÷ÉGÓ†[ñkÃÎ<}•ÉGA‚6΢82$7‡ÕbŒ4¬X;£†Ü·3²¾½Ì矣µè4‹ÝA½¡øÙWÞÍdI&À~bDz8Èu_”êõ¸â5ºSü›„Èù ŒB@R6C ƒ ðR±HWúët}ð{¹Ú¬†™oÖˆ³„ÆÌœgšk›ÐLXäüjû‚•ª³á¢ƒúbwŒ7j{0"GF‹ºo)ÄÅoCRêõ@Æ‚¢#…Qs0Œæ³ÌN£ÇÀ2Ý8á7Œ¢—¨WÔˆw &\÷
hHäõ.xø€«Ÿ endobj -1111 0 obj << +1117 0 obj << /Type /Page -/Contents 1112 0 R -/Resources 1110 0 R +/Contents 1118 0 R +/Resources 1116 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1087 0 R ->> endobj -1113 0 obj << -/D [1111 0 R /XYZ 85.0394 794.5015 null] +/Parent 1093 0 R >> endobj -274 0 obj << -/D [1111 0 R /XYZ 85.0394 769.5949 null] ->> endobj -1114 0 obj << -/D [1111 0 R /XYZ 85.0394 752.4085 null] +1119 0 obj << +/D [1117 0 R /XYZ 85.0394 794.5015 null] >> endobj 278 0 obj << -/D [1111 0 R /XYZ 85.0394 683.64 null] +/D [1117 0 R /XYZ 85.0394 769.5949 null] >> endobj -1115 0 obj << -/D [1111 0 R /XYZ 85.0394 653.5261 null] +1120 0 obj << +/D [1117 0 R /XYZ 85.0394 752.4085 null] >> endobj -1116 0 obj << -/D [1111 0 R /XYZ 85.0394 576.1881 null] +282 0 obj << +/D [1117 0 R /XYZ 85.0394 683.64 null] >> endobj -1117 0 obj << -/D [1111 0 R /XYZ 85.0394 564.2329 null] +1121 0 obj << +/D [1117 0 R /XYZ 85.0394 653.5261 null] >> endobj -282 0 obj << -/D [1111 0 R /XYZ 85.0394 417.9499 null] +1122 0 obj << +/D [1117 0 R /XYZ 85.0394 576.1881 null] >> endobj -1118 0 obj << -/D [1111 0 R /XYZ 85.0394 388.7174 null] +1123 0 obj << +/D [1117 0 R /XYZ 85.0394 564.2329 null] >> endobj 286 0 obj << -/D [1111 0 R /XYZ 85.0394 267.384 null] +/D [1117 0 R /XYZ 85.0394 417.9499 null] >> endobj -971 0 obj << -/D [1111 0 R /XYZ 85.0394 235.1866 null] +1124 0 obj << +/D [1117 0 R /XYZ 85.0394 388.7174 null] >> endobj -1110 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F39 858 0 R /F23 678 0 R >> +290 0 obj << +/D [1117 0 R /XYZ 85.0394 267.384 null] +>> endobj +976 0 obj << +/D [1117 0 R /XYZ 85.0394 235.1866 null] +>> endobj +1116 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F39 863 0 R /F23 682 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1121 0 obj << +1127 0 obj << /Length 3451 /Filter /FlateDecode >> @@ -3955,131 +4019,127 @@ BȤ†µ‡%ãâCÉåS ^Fçc6Š8’ªðÀÙÒ¤ÖÀÇkàxR`8òh&¡¥:“TÏÙnþ²FyFË€Ÿf Ë3nh2Ž K¹Îº{}9œ#L™÷ó ¹»Þñ^úïrÐöXQËñ ´
u`‚¨jQ®>ßIÄ£$¦“${…$?hûU¬šü&#øÅ‘Sít"ša!x|ƒËà9J0b V$jä”OjDzÅÎg£;4†U»ì]¥Ã`ÞQoë2²{Ä ¡ÎÙË08gÒì+%BU8ëßzN%Þ¶[a‡qá¬"µ|8]ÏŒˆcM²Èg˜ ¯üw Âqjˆ>û"»‘zG*À‹ëäP»’x L$ð«Ã½=öl¡^ôÕ”Óü]ž1É{D‚Ø[|É¡âÁÓ¨å"׃CGŽ¦¦8Ò9öowågŸqðáHš(K¾7Ü#õ(A€OE ÃIuý endobj -1120 0 obj << +1126 0 obj << /Type /Page -/Contents 1121 0 R -/Resources 1119 0 R +/Contents 1127 0 R +/Resources 1125 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1087 0 R -/Annots [ 1123 0 R 1124 0 R 1129 0 R 1130 0 R ] +/Parent 1093 0 R +/Annots [ 1129 0 R 1130 0 R 1135 0 R 1136 0 R ] >> endobj -1123 0 obj << +1129 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [55.6967 676.8938 256.3816 688.9534] /Subtype /Link /A << /S /GoTo /D (rndc) >> >> endobj -1124 0 obj << +1130 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [268.5158 676.8938 332.4306 688.9534] /Subtype /Link /A << /S /GoTo /D (admin_tools) >> >> endobj -1129 0 obj << +1135 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [378.2799 73.4705 428.5017 85.5301] /Subtype /Link /A << /S /GoTo /D (tsig) >> >> endobj -1130 0 obj << +1136 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [112.234 62.1828 168.4527 73.5749] /Subtype /Link /A << /S /GoTo /D (controls_statement_definition_and_usage) >> >> endobj -1122 0 obj << -/D [1120 0 R /XYZ 56.6929 794.5015 null] ->> endobj -290 0 obj << -/D [1120 0 R /XYZ 56.6929 403.8784 null] ->> endobj -1125 0 obj << -/D [1120 0 R /XYZ 56.6929 377.7405 null] +1128 0 obj << +/D [1126 0 R /XYZ 56.6929 794.5015 null] >> endobj 294 0 obj << -/D [1120 0 R /XYZ 56.6929 339.6466 null] +/D [1126 0 R /XYZ 56.6929 403.8784 null] >> endobj -1126 0 obj << -/D [1120 0 R /XYZ 56.6929 308.8302 null] +1131 0 obj << +/D [1126 0 R /XYZ 56.6929 377.7405 null] >> endobj 298 0 obj << -/D [1120 0 R /XYZ 56.6929 236.1221 null] +/D [1126 0 R /XYZ 56.6929 339.6466 null] >> endobj -1127 0 obj << -/D [1120 0 R /XYZ 56.6929 207.0192 null] +1132 0 obj << +/D [1126 0 R /XYZ 56.6929 308.8302 null] >> endobj 302 0 obj << -/D [1120 0 R /XYZ 56.6929 125.1654 null] +/D [1126 0 R /XYZ 56.6929 236.1221 null] >> endobj -1128 0 obj << -/D [1120 0 R /XYZ 56.6929 93.2531 null] +1133 0 obj << +/D [1126 0 R /XYZ 56.6929 207.0192 null] >> endobj -1119 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F21 654 0 R /F39 858 0 R /F48 880 0 R /F14 681 0 R >> -/ProcSet [ /PDF /Text ] +306 0 obj << +/D [1126 0 R /XYZ 56.6929 125.1654 null] >> endobj 1134 0 obj << -/Length 2601 -/Filter /FlateDecode ->> -stream -xÚ]“Û6î}…µ3‘ÊQ”.OiºÉm¯Mî6Û¹‡4“ÑÚ\[S[r-9¾½Þý÷RÖ7»ÜøÁ$‚ -R *’LÂ*ðvcP@åTž'š³è#ÎoæÁáÈ1N–répÚ®ìÌÎÔ臥Ѳ¬iÐ,—Ç
K·ÖÁ‘0PQ×ì ²5_ÌÖá߀RSÿʘXeW5Ž*B¶¡q䫺VVd’L%Jh/Ô—ÊœR ¸8ÍÔT*°Q¨èoæ¡¥V&ÆÝ‹Xf:aŠùržJ »¬Í -p%rFÿ oL¢Î¹Ó:‘)Üá/R6ÓxKÔIå0¸3ôlǨ¨Ün €Â· “IœL3õŠ6©èÞ*–èŒåiWh•H®SÇÜZwh¶m@ -°Ö\)>³«Í”³$UJMµ©XkÌÔÛ8K“Œ+½ÐR%Zðížë
nŽÒãÇÃ
sG™ÓE&>˜¥3@jD’ÎøQ Z -èCò3wí±žâbFÍ©‚»cÛÑÈ^8ü¯ÌÙì`Zºer%Xƒ5„4®e’3 -,a,ÔÔþÀÜÇ6:R€²l¡¹e9}N -ï~æðÅB^ -ÖÀE ¸Û8FbYö¡ápÉóÈ€Œ-…#”§èݦtw*A›aÔ‚}Õºœ§ªÛø½•R^EVýyäƒTâV+â¥uø»²[n\pÑ3Qx]Q±ˆå\+yop;FL誗͎®p&Ãú¦übhíΘš`½00vÂÀzI -=8øq×V -ž9IP)ã¨nük»ƒÕ1ŽéVSp±vo–Õ%·¶i æ7H]ªîá»ò -»tˆ%êÕ®ª3½ƒ»Z¹}Çý¾9tîí“Å€Á4ÆßÚfW.ãÝJ$Ju’¦û`5' áNõyƒ¥ÔnJ ™$¤Îò)Rù„”i€X†¸2ý³| •=JLýYb2r¯fÖ§¥ÎO&ä8uª&ôÒó‘ðöÃõ[ˆÍŒäû”^P)óqXZFsÁ¢ÛË‚AÜÈá5 -B}ÜnÏr¼ü -^ƒ Ú+j SˆÛ‘’àÔf¬¶Sy¨{kð§7°ÓxžíÎ$¾oFÛVæîè9®\Ï‚t9B}€ë¯–C‡çHîÁoºßðX'îƒqâe«›—Á»çsJcÅ=›R€§®ò>ñ•éM±ÿ>ƒç±Ü~öˆ;NèÏ}÷åè²]O’ä¹G -´Õ=Ûƒ -‘öa³gÄÁ¨À¯Î}ˆ>lÿÒ–kxW&2ÜîÃAjÿ’z‚¼|óÖM,¥4ê¨þB¨upñd[s8úR*ƒ6‰ÌM«Ú÷ÅEœØ.ì{†¸t‡re¤N1OPëå6ÔøƒºA2îÓGôçâA*§¥!GÝá~s(©ÎÅG°m–ÈÝRß 9vûcGk;ÓmšUû‚êN`|Wº•^"Ûj°W&‡q
g6ž8”V$TúÚò×]3A²¾Žæ¾åg[<nDe4?w&níªP× -(«H˜òÙsï’ŠÆÜ«´×m2¹,ÀlÍÒÙí¦9Ñ -ƒãMéαͯÀ;¹/5aÅ4IÆ•—ŒgQŽ’a;µ£•“¥cn@*jËÇ +/D [1126 0 R /XYZ 56.6929 93.2531 null] +>> endobj +1125 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F39 863 0 R /F48 885 0 R /F14 685 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1140 0 obj << +/Length 2602 +/Filter /FlateDecode +>> +stream +xÚ]sÛ6òÝ¿BôLˆâƒàÇå)Mœ{WçÎqçÒL†– ‰S‰TEÊ:_¯ÿýv± +Olxwý÷+½¿}óÓOon/?ßýxqu×Ë2”Wp…‚üvñé3Ÿ-@ì/8SE®gG˜p&ŠBζ‰VL'JyÈæâãÅ?{‚ƒU»5¤?r¦s™(UHº`©‚%TàÝÚ €*¨"g™à9ÐGœ_Í£ÃQcœ4Êá´]Ù™©;ÐO¢yYÓ ™Ï{–nƒ#a £®ÙdcÌÆá/GH@©©á\®û²«G!‡Ð8òUÝV+2)®™–™ê¡2Ç€T..ãz*Ø…,tô7óØÒ ãîY¬ÒŒqÍÁ|…`…ÖÒnDk³ +´{Zܯf4¸8J7œ;Ê9]d⣙;´¡F²äŒ
¢%€>$æ®=Ös\œQsªÄÂöÐv4²ÿs2;˜–n™\ Öß``‘Æ3År.Aá’3ÎÁòGQAOíÌ}l£#H ñ'Mg™°,'/ €’yž‡Ã_ÜSŒ‡$²Æ¬IÍ’B'§“‘Åjò"gX$Å+4ižÑ60’YôkÝk–-ý“q
D†AÕåÖØ2ªRI+‹f[Vn?bÑèPW¿Ìæ‘f¦ê®Z>VõŠ6BDÖ5etݘ\÷žº¶½>
v(„ûË×.Qi^x÷3û³y)XƒànãEˆyÙ‡†ý¥È#2¶Ž4Pž¢wëÒAÜ©m†QöU«>p«ní÷V.HyYõç‘R}ˆ[,ˆ—ÖáoËn¾vÁDOeáuEĦ"–óŒXÉóxƒÛq0bFU=o¶te€3Ö×僡µ{cj‚õÂÀØ ë%Èš``Yì);Qó¬·²¬k³jö@`ëç5Ý?_|kæÄXÇüòón
i¦¼[÷'9w +. +†“Bù +›°MK0¿Á@éRuß•pPðع«@,Q¯&pÕ,UÑ
ÜÕÂí;ìv;s¹Oc(иàb|këm9·(ÉX.yÖ«s’ît_7XJíºRPIB鬞#•OHI™ˆ¥ˆ«’?Ë—Ôé“ÄôŸ%¦ò g5Ó¾,u~2!'`˜%zBOù$= ï>^¿‡Ø,ÀH±/Y ƒ*•ÃÊÐb0šKÝ]âFÙ +§`ÿf+¶beP%§ç< íL°LùÚô–@n~"j¥ÇÒ>CAà3Ý4d)‘² +æT*DEñÍ!ËŒ‡ÏC–Ó…ÈOSµ(Xg:׃°…š¥›-Ä ¨»…ÆÝ„[wuþànÜV>LÖV%T{ÊÆÜáí¢“ØºÐ…"ç”S%„ÿ®à,[§ MäÅ…G$Y_wôÇ,ѤɸÌèP¬ áy. 9E›fµrÍ£ƒb_Úûr»-÷ÃÂä–#ç¤ÞžH +·ò +XVø0Jû‰0æë²®ñÕ9˜|¡Šm@Àí¹6¾FiYmú®ÄäŽ#K÷âÕc t8T-†–f'‚Þoqü_ú;Ô›j[Ù›p¸‚FŸCŽêè·ÕÌÙ2ÝpgÎÚ>¶ Ïáø˲œWH‡¡cý®naöû¯ Ô‡Íæ$Çë!ḃÄ`1‡öŠšÃâêf¤$8µ«íXîëÞüé
ì4„g»p3)ž—ÍhÛÂÜ!Ç•ëW.G¨pýÕ|(âPã¡ãÉøMc^ +ðÔUÞ'ž£2µ("öÇxËígϹ£ËMg¾ûztYO®3ƾ‘{¤@[Cæ×O„AIA&}üqðzÜW§D¶nË• ä•I€·úð} 2Ÿ|<Á$%UqÞ¶‰•ÊM:z{!Ô¾spñhÛr8z(÷•A›Ä Ö%ˆÕm»Žâ"Nl +6Ÿ!.Ý!‚Ü2K°Jо•ÛPÓÞP›øÒÑýsñ ŒË˜ÎòI¼Þ÷%½q1 ¶Í¼¹[ê4‡nwèhmkºu³h_ћߖn¥—ȶ앩a\Ù'刯zöR‘¥¸o$(Þ¿¡…o÷Ù:Áè -N݉[»¨k ”U0®}åÜ»dàQÆÜ«´×v• VfcæÎn×Í‘xùÍÁó
hÓ¸ U¨¨Ä-Ùקb˜<Ã,|˪`Y2~Ù~¨ms%I¢¦‰•G‘ô<ÅÊ3¨’<Ð÷ +9‰s.:ØÞì0-tù×îíèÙtïÏå$¬üÒwŸÆý›T²ôÔËŠW϶ù-!bj7ˆIþ]k»€¶H9&ôMWÁm*ú¤Ãûþù{ïécx–›ç2ümHñ”å²È<S(¢Ê¦œ÷†ÏYÿ~þØendstream endobj -1133 0 obj << +1139 0 obj << /Type /Page -/Contents 1134 0 R -/Resources 1132 0 R +/Contents 1140 0 R +/Resources 1138 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1139 0 R -/Annots [ 1136 0 R ] +/Parent 1145 0 R +/Annots [ 1142 0 R ] >> endobj -1136 0 obj << +1142 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [103.6195 731.9163 159.8382 743.9759] /Subtype /Link /A << /S /GoTo /D (controls_statement_definition_and_usage) >> >> endobj -1135 0 obj << -/D [1133 0 R /XYZ 85.0394 794.5015 null] +1141 0 obj << +/D [1139 0 R /XYZ 85.0394 794.5015 null] >> endobj -306 0 obj << -/D [1133 0 R /XYZ 85.0394 589.1911 null] +310 0 obj << +/D [1139 0 R /XYZ 85.0394 589.1911 null] >> endobj -1137 0 obj << -/D [1133 0 R /XYZ 85.0394 558.8491 null] +1143 0 obj << +/D [1139 0 R /XYZ 85.0394 558.8491 null] >> endobj -310 0 obj << -/D [1133 0 R /XYZ 85.0394 294.8462 null] +314 0 obj << +/D [1139 0 R /XYZ 85.0394 294.8462 null] >> endobj -1138 0 obj << -/D [1133 0 R /XYZ 85.0394 261.6947 null] +1144 0 obj << +/D [1139 0 R /XYZ 85.0394 261.6947 null] >> endobj -1132 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F21 654 0 R /F53 957 0 R /F39 858 0 R >> +1138 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F53 962 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1142 0 obj << +1148 0 obj << /Length 4109 /Filter /FlateDecode >> @@ -4095,27 +4155,27 @@ xÚ]sã¶ñÝ¿ÂÓ—È3'?zO—Ô—\Ú\Ò«ûÐI2J¢$ö(R)ëœNÿ{w±”!Ûio<‚X,ö{!y-àO^›$Jr•_§ [@Ŧ?Òõ|ß*NR4p¼:/å,½Cy¼ãfkkòÒU'ãIuÒø^TæÔTØÇEÿxdñW0ttÁ¡Ë<ZÈHŠL=-Ńϧ]ˆ…L.†ˆ~q¼Æá¯<,Ž=aG&±†›³ÑÏcp¦„™*“M˜« ÐH³<Ÿl$:‡f>) Á†TìóFU8…¥ã—1S<ŽÏ\FRÓlª‘lb‡-ôÌšLõ›„,NŸ¾j¡y¦=Ë_ôJñŽ«p*¦Z–áRà²éQQ
]0ú+bØýÞ›P¥Q®³lÊÙ6y,Üý!
.ƒÀëiÈ)W¶BϦ\½¢ò„M³ö` -y¾!´wÀ}W€á0Äy!Ç0ŽR;F½ÌI˜ÎV>/CÉ`ãT.p¶ÝU~©Àþ8ùÓlYh[¨¢$ÏÌÅ©=Öll’õ¶SäSsà2¾œM+«{oVèlwaÛÌû^ö”Œ¯Ëvý /X†#©X¥ÁäŸÉGžS~–üK<vùøÎ;&z»ò`«_p_ð—g×?aÐøú'~㯢“ 3Ø$¹“ùÌ?›ÞV
9H§M¨3ÕN6:StÓGjçjkær“™òèaÛÎaeë¤ênË[¥#áántp
ðh¯EÁg{z_ÂY¿¢°ÎcPúäü«›7Ã:ô endobj -1141 0 obj << +1147 0 obj << /Type /Page -/Contents 1142 0 R -/Resources 1140 0 R +/Contents 1148 0 R +/Resources 1146 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1139 0 R +/Parent 1145 0 R >> endobj -1143 0 obj << -/D [1141 0 R /XYZ 56.6929 794.5015 null] +1149 0 obj << +/D [1147 0 R /XYZ 56.6929 794.5015 null] >> endobj -314 0 obj << -/D [1141 0 R /XYZ 56.6929 769.5949 null] +318 0 obj << +/D [1147 0 R /XYZ 56.6929 769.5949 null] >> endobj -1144 0 obj << -/D [1141 0 R /XYZ 56.6929 752.0323 null] +1150 0 obj << +/D [1147 0 R /XYZ 56.6929 752.0323 null] >> endobj -1140 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F47 874 0 R /F39 858 0 R >> +1146 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F47 879 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1147 0 obj << +1153 0 obj << /Length 2579 /Filter /FlateDecode >> @@ -4134,29 +4194,29 @@ pHÅïPâyxå‘UÆÝÌi¹ó0é4D(æ"s%4~[jêࣦ™XÛtBP£:øÅih£VÎC‡ùßÅØ=#óTdÎeGN^+¬D¨D’Ð vV|\ …º¯³#ï;·‰¦ÿ¨1ß4³±ÆÚ¶ÈI*í@%Gè;6Ã
©Î±ÌÞ¡ÝÑ¢ÑÚ¾c¤ ¿Eþ8ìÆÖ0•6iàÉËŒiØñŠí®¦ôÙëhÿWk7©öοM,ñ{$5¡2–ë¯u¨˜='fΘõîc¤°‘e e$³SÊÇŽž“þ7½6Òóendstream endobj -1146 0 obj << +1152 0 obj << /Type /Page -/Contents 1147 0 R -/Resources 1145 0 R +/Contents 1153 0 R +/Resources 1151 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1139 0 R -/Annots [ 1149 0 R ] +/Parent 1145 0 R +/Annots [ 1155 0 R ] >> endobj -1149 0 obj << +1155 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [173.6261 500.8708 242.2981 510.2804] /Subtype /Link /A << /S /GoTo /D (the_category_phrase) >> >> endobj -1148 0 obj << -/D [1146 0 R /XYZ 85.0394 794.5015 null] +1154 0 obj << +/D [1152 0 R /XYZ 85.0394 794.5015 null] >> endobj -1145 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R >> +1151 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1153 0 obj << +1159 0 obj << /Length 2502 /Filter /FlateDecode >> @@ -4173,707 +4233,706 @@ GMtlï‘`‡úøæqÊОî>SCW‚ÝE[&èW¥9ç´†<ºu‹8~³îæþÜÕæêÕ*1ßå„}µ—èžàæ–à ì§Á;S¼`‡ fºÌ´ýž"Í…¡8t)„0{‡ҿy!Å~XšiꀒÐkS³"ÉèK`'Ÿª)UÞR{7ÛÒÀî«.bfzø›^ã°M[7x—ËcñÜ‹Þ#ž¿s©—yé×£žÏžŠ£^„?D 8Z¨ê¡Ü|9é÷7–"(T»¦C9+;{ù–S÷ Qãá Èx.Ù`¹NÁ/N·[ˆ‰Ù¼¹DÂ9Çàêìã[†ËuYè†'.¸ë3t¿Z“¯uµ`•ñœ$NG^‹’¤&> Æ%]]ìÿÇ,5Ÿúßݯ¢|ÉDyÿéñdZ endobj -1152 0 obj << +1158 0 obj << /Type /Page -/Contents 1153 0 R -/Resources 1151 0 R +/Contents 1159 0 R +/Resources 1157 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1139 0 R +/Parent 1145 0 R >> endobj -1154 0 obj << -/D [1152 0 R /XYZ 56.6929 794.5015 null] +1160 0 obj << +/D [1158 0 R /XYZ 56.6929 794.5015 null] >> endobj -318 0 obj << -/D [1152 0 R /XYZ 56.6929 729.6823 null] +322 0 obj << +/D [1158 0 R /XYZ 56.6929 729.6823 null] >> endobj -1150 0 obj << -/D [1152 0 R /XYZ 56.6929 704.9004 null] +1156 0 obj << +/D [1158 0 R /XYZ 56.6929 704.9004 null] >> endobj -1155 0 obj << -/D [1152 0 R /XYZ 56.6929 387.929 null] +1161 0 obj << +/D [1158 0 R /XYZ 56.6929 387.929 null] >> endobj -1156 0 obj << -/D [1152 0 R /XYZ 56.6929 375.9738 null] +1162 0 obj << +/D [1158 0 R /XYZ 56.6929 375.9738 null] >> endobj -1151 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F21 654 0 R /F39 858 0 R >> +1157 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1159 0 obj << -/Length 2765 -/Filter /FlateDecode ->> -stream -xÚ¥koÛFò»…€ûp4zb¸O’é'7Vr.§g»ÀiPÐÒJ"J‘ªHÙõî¿ßÌÎ.EJ”Ç1}ÏìÎ{†b£þØ(Qa$R9ŠSªˆ©Ñtu°öጹ=c¿iÜÝõÓÝÙ›÷"¥aª¹ÝÍ;°’0J6º›} Þýóâ—»ÉÍù˜«(ÐáùXé(øéêú’fRjÞ}¾~õá×›‹óXwWŸ¯iúfò~r3¹~79³D18Ï„#Þ_}œPïÃÍŧO7ç_ï~>›Üµoé¾—EòçÙ—¯ÑhÏþù, -Eš¨Ñ#¢¥)Τ¡’Bø™âìöì_-ÀΪ=:D?±q%Fð -¦,NŽã%àu]¦T(Y¼wÌDJW4ã¡J€ž+œu¸Â¤!Ô(Vi¨–-nÍ&75’ö‹Î~ L¬dHpßíÚLóùÑôqi6ç,
=;¨—Õ¶˜QÿÞm(ªÅ¸¹¦ -€3 RÜ¿hÎÇ@½ n²M³]ÿF -Θq·ï1/ -‚ue¯8æ…àªUSf÷¾,Nú96O4ÂwÚ»â`[¦®‡.ÈãKžt.ø'n‹%sûªu“W%Á^fHí8 -›’îÊâ(L‘ø»’ÖYþEÜÌÉ~·4ÈÞ‚ºxÛ1eãçˆÝëjÓ8Ä?8-rØ÷w7}õ]0›ÍèHí²r6„!ž…Žƒr»º©-Þ‹TÛvގ»£Ð:(³•qû¦E†HpÃîÈÓڀКWM/ÑÅòxÌ™Ú{L€p7(ßv@τΙn751 -ʪiwÀ9ævM.¯o{Èà„»Ú¶64h&x†æ«M²{švd¸'FÎ¥×_„z‹PCX‘vvÊ$À‡( -Pê#øcÓ`õ[°ä<"ÛñôvûãchþÊVë„ÓjEP®®©½€Ôûáv2tº‹úí[B?‡” -Msé˜vŠkÍG]+üJÓ.d -ð `‰¸‹H¾ -TsjóxéfY°Î¦«x°ÔT®µ‚ Úl¬"BUͶ™ñAé{#8îÜTÖ›®ú>im«)X(g¹Ù¥Òë(¿c¦¸ˆ{îqfÆ:ŒYÂO0S%€$’ 1³„§OO³òúövòÎQ´tVàîöêCŽM5ŠÊ£Ÿ!mçί£ÃŽ´B…‰Vê ý‰ã¤•Q˜(~*ªRî SmiV€{“øž>Âfp[*u_£ç1úæÚ-´’ŒƒU^O«úb»É0(°î/² -ÊD:Ûj -³°ìWeñtZ/ÛýÀI›ì!ÆX -=ÈŽ -©ÃB0þ®ò¦±¨v ’¿¹ÂÛŠu·¦A/õ•:o®ÛÊ›ƒD—¶]8{¬ÁÆü–dÈzÒ“xÿ¡Ø&Á}^Îjê)°·Ùø -ÚŒš}
Ĺ¾âŒg¼\õ -ÕmªçÂÞ*+KªQzÅI[°)«Í*sÐé10éëøöè® -€Ií¿ýAŸJD8GYÎØÂŒ¤°DÆ{|¦(4´êb~éM4öÚ`@ö+R¸æÏe‰ù‹²˜²ö“f‹ªúc»¦é{ãŠaGª«$ª^p×Yãz¦ðáæQýJ¢xIß öcñ¨Mð^ý†ÝÏ;$†®Ý =ã7îRøjÉ‘„*áñÀÕÿÚÁ”úendstream +1165 0 obj << +/Length 2770 +/Filter /FlateDecode +>> +stream +xÚ¥]oÛFòÝ¿BÀ=žî'ÉôÉ•œ‹ÄéÙ.p@´´’ˆR¤*Rv}‡ûï7³³K‘eÅqt—»³3»ó=#³QÿØ(Qa$R9ŠSªˆ©Ñtu°÷áŒ9˜±w¡~º;{ó^Ä£4L5×£»yWFIÂFw³/Á»^ür7¹9s:<+?]]_ÒJJûÏ×ï¯>üzsqËàîêó5-ßLÞOn&×ï&çc–(ç¹ÃpäÀû«š}¸¹øôéâæüëÝÏg“»ö-Ý÷²HàCþ<ûò5ÍàÙ?ŸE¡H5z„(diÊG«3©D¨¤~¥8»=ûW‹°³kñOF,d\‰¼‚…)‹“ãt‰FtÝ”)JïÓ3‡RÅ Íx¨…— +g©0)ÂD5ŠUjÁ…ËŸ[³ÉMìxÑÆÄJÆ@án×fšÏŸˆ§K³9gI`èÓã°õ²Ú3šß;€¢Z,Œ[kª‰Ú1(Å-þ‹æ|Üê&Û4Ûõ?à+dD5/´Û,
M¦YcÕæÉÝ»÷N-C®™p?þ@Ú3îàó¢ ÜYQWöŠcñP®úW5ev_àËⱟ³`óD_øN{WüØ–…©ë¡ò8ä’'>ÁÉ‚ÄbÉ\µnòª$Ü˹'ÀaSÒ]Y…i"W²:ËÀߢˆ›Ù Ûï–†Ù[Ðïb'¦lü‰{]mG¸ñ§EpwËW¿Ð³ÙŒŽÔn#+gCôãùXè8(·«{Ð*°b½Hµ=aw,)œ¸; +ƒ2[7-2$‚ +Pë#øÇþ¦Áê·àÉyD¾ãéí õÇÇÐü•Ö… §ÕŠ°\]ÓxÿÑì‡ÛÉÐé.é·o‰hüQv@´4Í1¢c"Ú
("J¬5u½ð+]»I( ‚‚'."ùœtB*IBq"ZèÜ)sì™åõ:k¦Ë“áâÒ’7<¨æ4æ%ÈÒ²`Mÿ0Öð`«©Üh&µÙ<XC„ùªšmrãŠÒFpÜ…©¬·\õcÒÚnVSðPÎ7J³Ë¥×q~'L¯p/P÷ÜãÂŒu³„Ÿ¦J€H$f OŸžåõííäãhé¼ÀÝíÕ‡›jZœA?ÃÚÎ_LJk… +ÔPúÇY+£0QüTV¥4ÜA¦Úò¬€ð4&õ=Z}`[*u +_cä1ÆæÚm´šŒ«¼žV%õÅv“aR`Ã_d# +ÊD:ßj +³°âWeñtÚ.[x$¤Möc, +xk =ÌŽˆ©#"0”ð®ò¦±¤v%‘¿¹í»Ûu·‹A/õ½9ï Û^›ÃD—¶?³pö]-é&ñþz ›IDpŸ—³š¦Ä +œí¿lFcF(Ä9v:k}Ä/x‹¸ê! Ot<eGŠz¦0ÁÀP{)!eczÏ:³)¶—¹HÛ'¶ +ªÍ…oœ +ß:®×P€Áíú¸w`àdêfsžÛ)IÊ…Çê€j«p¶ÊÊ’º^TPq²Êj³Êvz,úν=ºk¹9È+,‡Rn#VÄœ®ÊVWe_WEà—wÚ)„Ëq{fæ™-ð†¸3 +ÂÚNêÚó¸×’lÝ—Ù£ìbíù¬$³!Gºi©ØU³ÉßãØÓÿäyýg2m3uJ~Hb!¸_ËeBõ„´†œ?dE»nÕV¦Ç* À©õ.ïù>Òå@ÂyBÞ˜fúfc-ëX‘*ÜÌÇOP¥ø›Š½»bù̸Wf4P ÁY5'3Å<Ý+”mžì½Û2Ç,û s›×¦œí~?ìzÇŠìgº_E¹ÎÇËDÎÛß)õ,àÒ$eCœt¤êÖéâ꧱ԯ¢|DÞ‰jñ~—Ä!µWè·f9þöZ»7Q‘ž'¿çº8؃åö~ŠÌWÛ “ÚÿÔsêá9¸bû0’rïÉ™@Qih×¥øÒûgœµ™€ì7 pÏŸËó%ÿ°d'UõÇvMË÷Æõ¾Ž4SIU½â®³ÆÍLáÍ£ +û£HÚ%ýä°ŸzGm=÷ê?XØý5‡Ä~D÷·ƒž‡ñ}w)|µdõHB•ðxàêÿ5‘Cendstream endobj -1158 0 obj << +1164 0 obj << /Type /Page -/Contents 1159 0 R -/Resources 1157 0 R +/Contents 1165 0 R +/Resources 1163 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1139 0 R -/Annots [ 1163 0 R 1164 0 R ] +/Parent 1145 0 R +/Annots [ 1169 0 R 1170 0 R ] >> endobj -1163 0 obj << +1169 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [519.8432 252.798 539.579 264.8576] /Subtype /Link /A << /S /GoTo /D (lwresd) >> >> endobj -1164 0 obj << +1170 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.0431 240.8428 119.7369 252.9024] +/Rect [84.0431 240.8428 117.8035 252.9024] /Subtype /Link /A << /S /GoTo /D (lwresd) >> >> endobj -1160 0 obj << -/D [1158 0 R /XYZ 85.0394 794.5015 null] +1166 0 obj << +/D [1164 0 R /XYZ 85.0394 794.5015 null] >> endobj -322 0 obj << -/D [1158 0 R /XYZ 85.0394 451.0558 null] +326 0 obj << +/D [1164 0 R /XYZ 85.0394 451.0558 null] >> endobj -1161 0 obj << -/D [1158 0 R /XYZ 85.0394 423.9067 null] +1167 0 obj << +/D [1164 0 R /XYZ 85.0394 423.9067 null] >> endobj -326 0 obj << -/D [1158 0 R /XYZ 85.0394 301.4703 null] +330 0 obj << +/D [1164 0 R /XYZ 85.0394 301.4703 null] >> endobj -1162 0 obj << -/D [1158 0 R /XYZ 85.0394 271.3564 null] +1168 0 obj << +/D [1164 0 R /XYZ 85.0394 271.3564 null] >> endobj -1157 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R >> +1163 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1167 0 obj << -/Length 1235 +1173 0 obj << +/Length 1216 /Filter /FlateDecode >> stream -xÚ¥X[s›8~÷¯àÑyVÜaû”¦N7mºëºOnÆ#ƒš -Bhžãš“ªVV~易œ\óWá<Ç•4Yx&ìyÀö…š(Ü#v ž@,pNTm]²Š«*-7²q§Zÿ¨â+r‘ªi€MFk-ð£“Ãq\½‚·~ Ϫ&*w¸©joô$¡û÷²iH–0Ê k[á&gMïÈW„¬‚rÊ -Õƒ‹XU¾Ôøžtk
ø³\è®?àOM´{˶zB@Γôhp–±'UMX¥ûT±<o5©‰V’%ªÂ™*·D•×4{Võ¦&ÚˆîÉ›ŒÓ2ÓskÞl¬3ü¨G¿³‚ÔðË 5 Øt}?8íj²Y)©±'Tuœz{ÄUJ5B[òT+w¯1ÄÈÑ—Ž2Í -6BÜð»¾ûω¼"| -Þœ5e¿¾QqcÄú ~ €~kH{hÎQ>!<JÁ}Öó•N²¦NÁþÖ‘–×iÃcö4Á€,QFEøžàAèÎÝæ/ +xÚ¥XKsÛ6¾ëWðh€‚o²99Žœ:Ó8¢œ"A c’`ЖÛô¿@Š”Õš’G£Ás?ì~X,°´-$¶å0ˆØ +cúÈö¤˜ k-Ç>Nl3´“@Öûùä—7´bN`ͳVQÙÖ<]\З]\¹»¹ýømvuzóÛ/w—ÀñÑÅÍíïS]û8»úüùjv ìÈ·/®»úc>é¡À`¼¿½û {b]üèlz3Mﮧ—÷óO“é¼³¥o¯\eÈÉâY©4ûÓA7Ž|ëI6´ãرŠ‰ç»Ð÷\·íÉ'_'v€½ÑèQþl7pŽèØ–mÃØ÷ƒ~×q;mW²‚º(0¤æÚʯRRþj\¸V&ˉ{;ƒ,à†RMï;@"–¸ º¶¨X-t•VKո׿uñùH×À2§ÜüìäpšÖ¯à-ȳ®ÉÊ}nëÚ;3 BhÆþy§m’%ò"è»N¼§ÉAÓò!§¤‚²R÷à2Õ•o¯I·Ö€?LJ~ä‡þôD·7Q²ìzq Ô<EÑç9{ÒՌզO +ŠVNŒ’,ÓåÀÁt¹"º$˜ÓüY×NŒ+ÓS4¹ UnærѬ¬å9~4£±’pxŒeÐšÜ +VfGV èA«r»œüz81‚~J–¥nh{õÍ!”r–ãÂXÅ-Ðm‘œ·Ð3¥£ì|º×XrQÓrmÎÔýµÒv_zøØÇ‚¶õ¿òƒÕ9©åš€¦ýæ’¦ãRZ“D°ÚĆ +‹ÍRé0ByGÀi⃕w›¶©O—»µY©a^×G*®¥7ý€¸Üï‚j <†»'2š“Ó-H›¢/:P¿ …:;2ÎÑ„Ÿ¹|EÓ3%å~7ÒËËõ™Ú¿Yu6ÁEw>¾dõ²d# +srÆI/9' %^ågœ#þˆsšb1–Ác9còÙ™’þeg‘®ŒËdÃêþèxó +°’!Umô‘ÎÐ' ©„Œ•|¤gDV?á:=Ì€”Ç<9£u›©TfLüÓÈ]"f²¬Å)™”YF¦JízmÂ4âÖ—!CÆäè·5Ü?@½!äž½[ËIåÏ\ËË€ q¶÷3F°´j5NŽ}p}¨òø# <ê¢7.ØKñd^EÎþK@?qpB™ÇDÄ(¥,ñœš·ß^ªþ/#„¹rendstream endobj -1166 0 obj << +1172 0 obj << /Type /Page -/Contents 1167 0 R -/Resources 1165 0 R +/Contents 1173 0 R +/Resources 1171 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1139 0 R ->> endobj -1168 0 obj << -/D [1166 0 R /XYZ 56.6929 794.5015 null] +/Parent 1145 0 R >> endobj -330 0 obj << -/D [1166 0 R /XYZ 56.6929 769.5949 null] ->> endobj -1169 0 obj << -/D [1166 0 R /XYZ 56.6929 752.2028 null] +1174 0 obj << +/D [1172 0 R /XYZ 56.6929 794.5015 null] >> endobj 334 0 obj << -/D [1166 0 R /XYZ 56.6929 693.9224 null] +/D [1172 0 R /XYZ 56.6929 769.5949 null] >> endobj -1170 0 obj << -/D [1166 0 R /XYZ 56.6929 663.1642 null] +1175 0 obj << +/D [1172 0 R /XYZ 56.6929 752.2028 null] >> endobj 338 0 obj << -/D [1166 0 R /XYZ 56.6929 628.9495 null] +/D [1172 0 R /XYZ 56.6929 693.9224 null] >> endobj -1171 0 obj << -/D [1166 0 R /XYZ 56.6929 601.0964 null] +1176 0 obj << +/D [1172 0 R /XYZ 56.6929 663.1642 null] >> endobj -1165 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F39 858 0 R /F23 678 0 R >> +342 0 obj << +/D [1172 0 R /XYZ 56.6929 628.9495 null] +>> endobj +1177 0 obj << +/D [1172 0 R /XYZ 56.6929 601.0964 null] +>> endobj +1171 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F39 863 0 R /F23 682 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1174 0 obj << -/Length 1161 +1180 0 obj << +/Length 1186 /Filter /FlateDecode >> stream -xÚÍYMsÛ6½ëWðhu(>Ibrr\9u¦qZU=©
MB2kŠTJ¶Óä¿¿-Ê"e9ÓñAÀ}ûöa…]ÀØ@ú6‡ˆ -fX‚AŽ07Üå -O,Äzå9É©5È@Á<Šuªze> -%ØlÔ&êl2L@F…Ùº>?FjàÝ‹ÔȾÔ)ó¶={Ì]Í„‰‰HïìÑ,ÕßN˜=lŸoÖ+{p§ì1÷eë¿t‡—èœ=Kç±l/@â/¥nk³™p½¼•q‡½k"Z'‡1öÓð½ h4BIÜp_†E ëì=ï¥6òH{%cß ò2.Û§ÎÌkö¾ìë<
;¯}`-ûšªëæL¿ç™…èdÜ8O,ð)W½N…;µÍLŽ¡ªŽÈÑÊv¥c
UßÜ*Tz^å{Vu…e™í;Át§Q¹iÝ^Ú½Ÿñl””J}ªQH¨%öœÐKÖÚó’SçÊŽå* Áœï9#ìp=(-!b™o$-± f6i?)ý£Ý'oŸC|v|ï–ôUKÚº:üU«ƒ- -)¢uu,§|õûy‹_§Àl¯ëZS^EmW"°byÈÑôa£ÛøÞ±$ûóÑ(ÿ«<¢³øG/I¨+[ež>ÍÔJº]n½"ÝÿíZ¶ÈÞnï9‰ÓÓ¾ÁÜŠjÜß¹JôÙÿ5ìÝ@:¡.¶W•ñÆ zê'8¹•NÒ A`k6w\y í’œr˜Þl·\i£²!~õzõߦwÛ&åÝ8¡µ»qŠLha¤Ò }μ¼iߥþÝilÏendstream +xÚÕYËrÛ6Ýë+¸´:O’˜¬WNiœVUWªGC“Ìš"‚’í4ù÷Bâ[¢lRÌt¼òž{îÁpcé?lØ"*˜a 9ÂÜpç=dÌô»=œ}ò@õ«÷£ÞÏ×Ô2&1Ñ´‚eCdÛØyã‹«_/
†}@8º0ap]¼¿¹ý%íéÏÕçÛë›
/û»Ý|¾M»‡ƒëÁpp{5èls¬íI†°Çàúæ·AÚú0¼üôérØ¿}ì
FE,Õx1¢ë@¾ôÆwÈðtØ{RasãI? ˆ… ƼÇ8…œQš÷½?{€•·Ó&ý8µ!·‰Õ$ ¨ˆ‘
–aqMJèFÁq˜]¸Ò}¡3—*íøq”¶æŽJdœ¶¿¥?*pV²ÖKµˆB%c¼ÖÆ Šµ +¦Q¬SÕ+òébdÈi²>ªÇCueõ&RùêdÁߎûøòtc¿Š|¬Xz°ˆâ¤NvÝÓu€RDótˆë¯eòÌ—@ÙZ´˜”w'“¦p«ƒ9»çZÀéÚ¡¢eìî,ÍeË_°ÉÚK¾.¯ñ°% %×°Ðb”oPJ_e~*/Š`Ó‚Ô"¬‘NbÕy%òÌ7ÖõŽÅpæ›íóÍJßUݾeL‡œÚœ©¨” d6c”¨V'˜ Ȩ0O(H +e!¶i½kOš:EÞ6g¹«™° 1é0‚)#];SýÔ8f?F¬=ÙCZeù?Èž®Ó©möÔÆjî<åHü¹Ôemú&\ÎïeÜbíÚ…ˆ–É1¾´£_‡èN#qÀ
|æ[Xkˬ–ZÉöö5öJƾd5d\”OýWì}©;Ûû4ÀRvä^¨®‹3½ùmgzJ ?xÚ:•Îð%ëWN¹;µÉL:EZضJÜl»Ð±†EÎUÚÞå;îê +Ë2›£ñN¡r׸"lÞ¯ñ¬m)¯l!´aÕªRe‡Q%ˆBB-±ç“€N²VÐÎ +AÌùž3Â×7¥%Cl!óLt‰1³I#Ý¥Ò“vŸ¼oœjc”ß'ç%_ªÜ(ôT¥æ‰“!´š6eQÛ(?nÚXR&ÄÛ,ßž4å<äÁC²¹clœ4*jºTÑ€%Ë·°Öê•ï-ëÿyƒ šå•Ôÿè! õÞXš¯[µn›{³HW»–³×sçû©äûy+ãzU‘8îã1ÞÝ@:¡Î6—ñÊ öéßt¯N9\_†7Ü‚£¢ =úνü‡Ós߶IqNhå:"ÚDX9©uŒŒn3/.çw©ÿÏ@wJendstream endobj -1173 0 obj << +1179 0 obj << /Type /Page -/Contents 1174 0 R -/Resources 1172 0 R +/Contents 1180 0 R +/Resources 1178 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1176 0 R +/Parent 1182 0 R >> endobj -1175 0 obj << -/D [1173 0 R /XYZ 85.0394 794.5015 null] +1181 0 obj << +/D [1179 0 R /XYZ 85.0394 794.5015 null] >> endobj -1172 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F23 678 0 R >> +1178 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1179 0 obj << -/Length 1707 +1185 0 obj << +/Length 1615 /Filter /FlateDecode >> stream -xÚ¥ËrÛ6ð®¯ÐôL€|srrS;u§uZG™‘Ä E²Giûï]pI‰”hW’í‹Å¾€ø”Á?Ÿz>õ#;š‘K=ƽi¼ž°éöÞNxKC:"Ò§úa6ùþÚ ¦|ÛŸÎ=^!eaȧ³ä£åS›^ -ÊyW{Z~ÕÿTâÑÕÑü亄Á¯ÀÃ'u%<¹±>îüˆøoE.Õéi3šø;Žˆ7Ðiö›¬ -’Dbw¡:]¡=6ÇŽb;4âÌòÄ;ç÷×6ŸnÑ#Ø
¨ÁöqÄ}xð0s§-MÏRø€y×}¹†ôÃåòcvÞL8ÄÀ„BàƒKÙÊrz e{”!>#f+¹UhGÄCEQ - ÉŠ8¤EBƒÛÆñ‘jÕ&-óièEÑÐ7‰\ˆ:k“î1Í2„špyÍÍ?¡OjNÎý)wÊm;|â ŒD¤OÕ¼€nëžç[ªF©´’±. ÿîIŽê»aø¼äŽhDr?œÙ+ÌŠ6UCÛ³‹ê3Ì6\€BM@å–Ñ«ÁüêîLÛ£×2¿^@Ö_æ-iw1WEVë–Ö\/MÏ3!¶]ÌÑ>¯Ã,$fiON™Ãüa81‚Ž‹ç¸P€â³Ì%~Ñ–ø~éˆ -ÜÑMhg±1—sÞ˜ñÖA†¢Ëà -í¶ÆpÚÚ–¦½µÓ í¦1F7`–skI52j¶C†Ñ4[Ûlå f|ÓøS!¢é›@ûçˆ#ß¡0º&NÇ@£ ð[‚ï^aƸ0·œÀ÷†)ƒçò}µ×¶
¦X#Áã*mZ€í!»KyÜÇ㦩UÚ4â…^—1#xße-¿UQg nÎÛsMO„½mLtSNO6*ߣtgÛÔŽæé&ÕÒyŸå†<Ù¦8¨¸ÏÉíHäZ”mSÏóœ¾à?VM9sxàÁ%î—ؤXd%(‰4ÆͺLDÓj +xÚ¥]sÓ8ð=¿"oçÎ`!ùÛÃS–+s”»žJ§§ØJâÁ±Œ¤ôëà¿ßÊ’;1% ɃV«Õîj?%“1†?‡ŠR/Çi€BLÂq¶áñÖÞˆ¥q["·Kõz2zyîÇ㥑'³¯á$!ãI~íDÈC'À;o>^ž_¼û|uzÎäâãå‰ë…Ø9¿øëÌ@ï®N?|8½:qIçÍŸ§OήÌRdy¼¾¸|k0©~ÂôêìüìêìòÍÙÉÍäýèl²>K÷¼ûú ßF×7xœÃ±ß0òÓ$ßÃ#’¦Þx9 +B…ï·˜rôiôÏšagµÙ:h?‚‘çGÞÓŽŒ"¬â0E‘ïù¯OÜcgÁ¨PSF•[TŠ‰;Z|µZN™xe&7ú¸ Ó%¥aèu4Ûf4cÇ2ŠªBª"“p ]Š×¼äóG3ûÏ4Ï“òvIU¶¸-A‚Áÿ¸yõœ2\¨
ío±B2år‘3ÑãÖ`neÍ23·¼~v!ÔÚ¡;üxõŒYJºd®R‡úcIÜ*£ÙâØÍìíé+‹¹Î/òB=†BÏ"ÏjQT®à\ɵ_Iˆâ‡™ôÈä-·NnïµàwE>Ècé‚}[1©ŽÜ„NâL¸Tº²†|<öñØ"~áªbÉŽó +mˆH‚Ò4XÓ´ì2ó“Nv”ó}.ðÒ@«ÚŒó’Ouþkxs,˜(®ÇÀ™2»A²Ü@ÓG3ê7&2àdQØm[—Ôë®H…•ÓÔzeÌx&µÚ^ß3º¨úQäP=Ĥ‚¶í|%¨±®^Ó˜’éÇD˜:3ƒTÈ8’8ÌlÔÊi4Å€a£%iJ~mÙ@œl[öðNC𲑵6¢8-yöÕ€÷…¾1i +Ájp†ÖÀ೬
¯…’6hq„’0Mû¶ÉÙŒ®Jt÷EY¨qWØÜüs´ó¨'(&$‚0÷ +Á2Å¡þnINcIò¼ä–h@r×{+Øë‹ÖYãú^èÜsñz›™€BM@%ŽÖ«Áò™U»ÇÖè8pô÷ˆúÓÊ’Vp7¡SÉË•²´úz©kžv±˜íòÚR@š(µþ$û8ê»ÓxÐLÂù$ ýÊ*ƒ¢ÒŒæ,%ð½k‰¸YQMjhsb}\BHs¤”XiŠ6r4ÐVMX‚¶g€%—Ê@iÀxv¯T½²KæP²„˜¡92‰Óû\³Uõñr$VÕ@Ž…>ŠÓij9fºniÊKÜžSCƒçô¯©š€Ñõ˜U\@ßZ +}–C6{ 6ÞÔKëhä¦mÓØSDS7ößCø‘ µE
endobj -1178 0 obj << +1184 0 obj << /Type /Page -/Contents 1179 0 R -/Resources 1177 0 R +/Contents 1185 0 R +/Resources 1183 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1176 0 R +/Parent 1182 0 R >> endobj -1180 0 obj << -/D [1178 0 R /XYZ 56.6929 794.5015 null] +1186 0 obj << +/D [1184 0 R /XYZ 56.6929 794.5015 null] >> endobj -342 0 obj << -/D [1178 0 R /XYZ 56.6929 242.1112 null] +346 0 obj << +/D [1184 0 R /XYZ 56.6929 215.7523 null] >> endobj -1181 0 obj << -/D [1178 0 R /XYZ 56.6929 211.8603 null] +1187 0 obj << +/D [1184 0 R /XYZ 56.6929 183.9675 null] >> endobj -1177 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F21 654 0 R /F23 678 0 R >> +1183 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F21 658 0 R /F23 682 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1184 0 obj << -/Length 3757 -/Filter /FlateDecode ->> -stream -xÚ¥]sÛ6òÝ¿Bo'O+† -¤H¹×K&!´X`—‹ýÅ,„¿bftª4š%ièPèÙj{Î`î§Á8‡´ð±~\^¼z«’Y¤±ŒgË{o/„ƈÙ2ÿmþæç×–×/R‡ó8¸\è8œÿxs{E”oÞß¾½ùéóÇ×—I4_Þ¼¿%ðÇë·×¯oß\_.„ÑÖKÞabÁÛ›_¯iôÓÇ×ïÞ½þxùÇò—‹ëe÷.þûŠPá‹|½øíp–Ãkÿr*5zö?Â@¤©œm/")å ›‹Oÿè6ôfíÒ1ùiemd2"@©<ŠÆQ<KtÄ -¦P€»}ù˜µÅåBÉtþ¥x¦Áïa(7Eƒ?̼YׇMNwŒy_ªü{Gé¼¼'¼ÂÌï‹=>Šª%ÔvUnÄ«W‡}ç©Þ)«·M®Úzÿ|)„˜ã©DÉ|éÖ÷1à@!‚Tkiߪ٫_¢È鼶‡¦¥¾>‘)û¼kêÍ¡eè.k×ÁÉ©†A¨Aá‘RÃj1#-|,:1¦ÅÙ²m‘/¾¡ä¤…J‚0VéyÚÖ)ñÈ7!É Œ@F=êËu‰'̼޵e‡¥’yCùma¥2Ш4
$è0ûÜ´´â)kh‹CƒâGPYÑ“,çÚšžöÀîŸhÏð4P6}\œ&^|ÁÊHR©˜™é‹tÀ÷B%q)Ö¶ÔªúaŸm$Ío¬’˜Î£˜y -J/c1¯júÝ»ltÊ‘ˆ’@)-þG7Õ)£zŒ<|VE‘ùÈ‚œ—-CïÕ -.Û”í³¿ -< -{vá©B¤ê¦Â¾ õKÆ÷Lc–¥¢0ŽÏ©w Ë8UÌè>«à•Hxëâ
òò]èˆÁ-Ƥ}9±ïˆ‹)šÒ°0úËr\€=bÄ!y¢2Ô¶vYÌ*kŠæ{Çü›Pîˆ+õfd ãØÅ)—îùÉ’=/$, &ü!ó”8F“±B›(ˆS©Ïk:ZtXGQ¯ÑâFÓ§è<i‡4BZ&OªOÛ .抲_›t.~.6›Í0SCž -VÑ3Ò Î -Ñ܆¤ªÂ´{ÌîXsÌ$½æH%œ¢6op’*ƒ[IR×Ä齬Á«F3`!ÔnQ^6˜7´„Ý‹*p³7Jæ=> ~àÀ'•fâHÒ*–ÊkÝ9hb[T¼q•³l#fèg²Ê:³=”˿ྚ¸ÝSÞ=åfÓ¶~¥A!&óÛºå9{¦#‚Äžó1¼ŽË
û ‰rHV“`ÇŒtC”;LSŽüGŒ£H¨³Çh\\Ø{âüžöaŽÉŠ ;Áô$ “¾‰téEQ6uã.&\‘×*v`üõ -¨TYä¥ØHˆB=–—BÙ2Ÿ -šQtFvkŠì¸„\9®í»òTºÎcä¹òXMq4ø3Ó‹âSÜ@¤’ÄuÎl<îZ jX‰â\ÿ:9«‹ñµ–ÝÍC¢ÂØÓ6c3©ï¹Ê18+¾¼hVûòÎ3¦ÆJ
Û‡ ZJ(0ˆØ Š4¹˜Ñࣧ»þÂ_pª»§û"ÿŸŠ] Ñm´ÈÝœ¤ÿ;@’ôx:±¢ëNNw;›yIñbþyçácM;ˆ´šzÒ=É£6ñyªÖY5h7¹h.û3ÿ|õáÕòÍúa¹Ä¹ÃöŽ\‚K¶Bãù ƒñ³!Tº7 -‡ÏݾÜfûrÃ`º–¦±Õ8À}º~ÃUƒ Dd׎õÛÛ ÌØUBΛÃjÆêÑÐÓ¶”íÌ©j2ë^/雨ØƇ]NŸ³„|µ„·gøŒüÈ4GºsÇ+wÙ¶û¬ÄÆ_Ä. -¿VÐM‚.Aˆ ß]ïÙþzZ—öe•""¯ƒýmüå¤û†K~"_2#î™9ì÷|¹Ö‰Ø'ñõPîÉ…
茼2Ûp›•<¢¤I&® ŸxÁÆk<=œ½Ã[s‡Z|[g‡¦µ™¾J¸w‘8ל´Ýívžo¼Çls`J£ÉTïA„í3®[á|^ñýßH²c‚(r¹Ÿi,öié¾Ê¢è€>ÈŒÎUF©“ŒúÇ¡’!J©P±£Ú]‰¢ÂÔÅ„á×,cŒ{÷—žß¼Fº»iï"Pk³/¶`„aÁ_gZúH ,Z——¥XôÇq_ ʪlKçxWu…§ôp Í" ßË goû7vÜfûö°co^n»O°ò~:vZ/¹4÷¼pƒÃ]ƒ%T¼9!!Ñé2I(¼…¤÷l𱦃@‡Eß÷Å~_ä‹ÔÄ“(bfhÎÓï°FèG£DŸêûɡɤݘšoÊÆÖ1ˆÖ>ïø®5ü5!ØÄ - -S®Õ¨ Ão×lt¦îKOò‹NÑŠo«Í!ç“Fk ºð1ÁŠ6ä~*fíܽƒÝ¹³_ÃŽð. ;…*‚VXüêãêÿç¶<½„ÒþŸàçOô
JÏi"èÝçOןßáh\G]—Gø
ñˆ~À?ßÿý©òñ;nüîÑ9Q¯†q`°ƒÇL¡”#=ä¼û¦ù”õÿ<xmendstream +1190 0 obj << +/Length 3618 +/Filter /FlateDecode +>> +stream +xÚµ]sã¶ñÝ¿Bo•' Nž.w¾Äis¹Þ9Óé$y EÊâœDêDÒ>÷×w@ EÊi3‡Ðb],ö +£ÔÊê£rꊻ’k©i»J—ùnG€v›“ϲƒayõ¡¬KÔ ‚F<UÝvB™¤W™SÝükB`,Ò"EDÀÆ%\m»Ôi”²8úÌõ®"œ¥KbõK_¶¨cÏi舧4bÈq.³$9ä@ÊùˆòëÂÁC Vƒ}U;ϟ‰ps¤¯€LËÒÉCÀ9te[ä +=Ö]@kCs¹ý†7NR%–·g•$jÒ”-Èã\æq’8Ð2Ûœ¨S×`›¡ƒ"*t<UF eB(tý&DLòÇl!KÀ¤Â +ÌíJ˜A…sãOp<Ý„À¹PdenCÆþæ2] ;ՙ߈D¢¢TÉ8 ÙCðˆ's¢üÄs|ªZÜu ~Åúwî)m"$} +P?—`|ÏÔ¶²”Ìñ;·&²L2i=B*ÔìIxÛò+5Šêé„Á9&\gC9±oˆ‹9š"RšÅÿ³W`wlÊ8…)2Ô}ãr™uÞš4QX¡ž›hîK·bÄH}‚‰$qÑÊ%}aÊd6'+ˆi ä<%¶‘ÀlÄPèqÅK©ˆ51<ÖIÔ[´¸É$*¾LÚ!M–ç)”Ò6C€‹yK9°I=W?”»ÝÞä™™&O€(”!èÞB:7ÚÉ;M°˜
ÍBKk©eâ†Á!—Ñ:j&¯Yö%,!«é皃¾H]´Ò‰4ǸÏXÿȤO '&©Á¼~ÝH2u€µH~¿³-#èÙ5ya!n +Wñ˜ua®¸A¨´6”^íû—*J21ª‹|„ +íÛ€¯WŒêOÕ+XyÝÚaókÀXsý—v·õs_´º8ëV2½lu!Ö¼Õy,Ÿòõ¶\‘´Îì6=Œ˜4<‡5A~`y ¶‰`é>/f“ì×Ä}#6È^ü&5õn°7o+µÆŠÌr^z ‹À˜^(üB¬ÒsXÆ!÷ûìð²H'/ÐvH´‡¢‹#‹qÊre2(³lNßÎu[þBàÉU!WÑŽy—߃¶[pCß'JE¡UÕmw¼ÖË~M™o€TØoÛ©™ŒxÑRgè±C»=ÖÅÚš%pUÜÏ:•ˆ IF[ÝŒô!8BlQnò~×yµ;OŒOáY–~ã
†R6’,M1D ™Ó9ƒQ¦µž>[ùWá”t>r'cZ +ÌyÝΙKƒÏ²Ë\x¬ 6“dQ¢¹òaã¡Áà·sÝÎ` b„cÕ™ØmXœ9ÎÃvßævÜiÁvžÆ«é[~:PݘqR]Mªk"šÊ¢TŽë™?§ÏL‚e¡:GvW¦Rg-Az…Í(ŒL1¿¬0!Ö¼Âx,S»UÅœšp ÊEÚk‚ø°Ô‚¢‰'CâwÓ§WäVÓ“=¹U=åVS¯%æ +¿Œ>÷»æK‡qòÊ™®:XhÛŒtÐÿ¥ÇãÛcUúrj™»MÄÁÝÔî™@¶¼#éÈ$²îVMj=ÜêQrk‚mã¶Ù¦—ö;“Ürõrœ87yÊjý.M'©Ô'ý?[=È.ñ¤Áã%2})‰¦Z½p*b]Pj‡eÒžG<Ðaà¼.²à±&x%¡'jÈ¥à!‚” +Ç‘Y ‰‰¢<‡ŸÅ±ÃÄ$î=“DÎh"Hšã|¨‰sÜ@:/!^¸HPKMŽÏU°oxEMòà²îüm× €£ë4|[“j6#ƒ;9²ÓùEQ¶ëcuć‘Æ +ÅññA¶Àób*“œRçñaAîzüU8à\wÏçEþ?•kº¦w+"‚Šˆë³b2a¨©ÓOgVä±^àä|¶‹ÎƒCɸ~! †XóÎÃc™¡–¿ÀRHéä2U5AVŽOµ„Êj@×ú½üåí‡Wwo>ÐÃ
´ Sé÷÷ä\éÀtà'4fƒ-¡Ò-€¬ö–Õ£ÍÉ|>£Mvì¡oߢ¡6Ãîšu³³´Ž¹?$^c®¦c¯þ¬1é~OR‡¤¹\þè.õïN7×xXÕ»gumï]±ÇðÇåx K‡}ßÒí|~ŽàÂUêzIžØט„Î +ñ9õ²Ä&Ça@õ/J|þæ‚ýºÙïûºZçîy‰=¤]Àî¹Ïí” úy%GGr½¬ã'¤*n‘NWb«¢|¬Ö硶Šs™\¤í‘Ή3>±,ÎÔžó³!zþ´¶¿ÑQâ¼/)áá™ +À=yEÀ{Ìw½¥4™æÈ8…ZR+wþûóÊÞcO¤9:Šc—uÙÝ#å*Êâx”Å¡è€>ÈŒöUÄ™“´† B÷jÐ0õ¶i5îj?¢ˆwÓo³F9‘îá§3ZFÊ"å_ŒøØ endobj -1183 0 obj << +1189 0 obj << /Type /Page -/Contents 1184 0 R -/Resources 1182 0 R +/Contents 1190 0 R +/Resources 1188 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1176 0 R -/Annots [ 1186 0 R ] +/Parent 1182 0 R +/Annots [ 1192 0 R ] >> endobj -1186 0 obj << +1192 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [250.9056 311.8959 324.559 321.3055] +/Rect [250.9056 223.7195 324.559 233.1291] /Subtype /Link /A << /S /GoTo /D (statsfile) >> >> endobj -1185 0 obj << -/D [1183 0 R /XYZ 85.0394 794.5015 null] +1191 0 obj << +/D [1189 0 R /XYZ 85.0394 794.5015 null] >> endobj -1182 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F21 654 0 R /F47 874 0 R /F39 858 0 R >> +1188 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F47 879 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1190 0 obj << -/Length 3440 -/Filter /FlateDecode ->> -stream -xÚÍZÝsÛ¸÷_¡¹'z&dÁ¹§\â\Ó^œ6q?nîîa‹
EêDÉŽÛéÿÞ]ì‚")JNz}èøKp,ûñÛ•åBÀŸ\¤:Òyœ/²\E©éb¹¾‹{øöý…džÐ3…C®ïn.~÷&Éy”ëX/nîk™H#7åOŽâèVÁ«÷×oÞ~ÿ—//3ܼ}}Æ©Þ¼ýከï?¼|÷îå‡ËPšT¯~ÿòO7Wè“æ5¾{{ýšFrzœXôÃÕ›«Wׯ®.¹ùÃÅÕM–áy¥Hð ¿^üô‹X”pì?\ˆ(ÉMºx„É<ë•&Qª’ÄÔ/þÜ/8øê¦ÎêOŠ(Nt<§À| @#£4ÏÓE¦²Hg)°Ý쪶é.C-Dð/<Ï>›Xd‹PÊ(OÓØñmÛv–¶¶÷NÛ¦~¢Iöó²Þ—Ö¯àß”ö›o™¬zrßõäzßÙýÚ¿þû[·s8ÙšD¤#5Ë(“R/4)ÁJæÕBLáËi%–3fÕsá–eÕ·µ
‹ú¾ÝV»Õº›Š U)-Òó2ô\3B$!$\)iÆR¼&)Àæ´ -v+G$A·±Ëêg!b[Ò—××?^½¢Ý·bÇϦ$†[[·ÏØk.‘€Ÿ¼Û×»*¤ÛÑidÈ=2Œ
_'Z•:’ -¬YœQçDÆDqjü”nWììÚ6»Ž\®Ø^JX~©á¶D¥Þ;SÄq:ë¶ÛÕŸmIïU]uëÛlê -;edJ@¼ú#p12Ïå´Òt]†uÛ~*ºª´G&–¨(¹9/AÏ5#ÂÈÄ’dr,ÃßV¶Á;7Agw/f.RébP‘3"O¯QDÚæ߸[k€µ£mØèLðPÔUYìÚ-½>‚YU°@Dê ¾”ÁÎn0̓µÝÚ’×jû¥ØB!´C(ŒÍØDq˜žˆ}åW?"²¨eëžeGè0øtr:¢Ý{{ÇôøgÛ (#X‰ƒoÃ]ªÉÂx`gGÌ*ÛuQñBC—Ä“‰qH¼EƒWÞ…U”Ön,Øüñj ´Ð/¾ÀÒ«Ô9Oxë§?†;6ív]Ô4H«Í÷ -9‚øVEGj{·£!^CŸ,Ÿcß춗&Øw;[òŽÈDwªT$bÈ}£;õüaÑ,W¤ÓŒ›´ËªÝl,ŠN79ºZMÛãÆ;æ÷̱¼þá2ƒ¿ÒØØ`Nm‰ºµüu¿nÁɘ©bcªØ*–`õ£{¦S²2íŒàRÊÀÙŸÞÞÑpo³ÏHûu»f›?‹TtÕºª‹mýÄË·×x,ø‹Ÿÿñ´žÊÖv°¦œ³æ>l{Æú -‰´4ŠÐ“2‹rŒó‡ EöAGæ©sè’HrP¤²"U,—v³cºéí¶£tK|ÂJžÕWæzp|ð¼8—óâÇ€ÙMžûÚ´sò³“Ÿ’Ÿƒ+Ò>¸"=®N¥qøRè $#Dƒ¾+ÂJUsoIpçB%WÍð.£Wò9_‡Á[ÿÑiÌA®LÉàÆ…€|‘±Ob@“…!›_fß”–(fr•˜ÆxçÐ!†»c¦Xëô*„sÍ Pª¯/© -PrA–*ˆ¾Î=ñ{iï -(àðÅðµKˆÊ™Iõ—«o½¶]Z†Mü³ ÇrU4÷–¶¼#ü¿¦/Ü^Ê8AµC.øþÔîy>»À˾sq5=±~r¨w”˜@ü¶.{Á…_{·{äå^Ðí‚åaÁcc§xâ -3‹T–«ó2ô\3BŒ›®ÙaÆRܬ<|£V—á®*H%ܱ¿Š?šp†Xк["mÃ
øº\Ùå'2xs‰ÍÝ]·Û'b‡XûÉoΫ£\ß@ÒFÔØ'd<6)nºiÙ'M†áyø¸Ö¤7vb§óœàÝi{PàCš<c®3ö๨SÔPL¶5€¤ÈÎoë™f¶Z@.#Оo{ -â!õ¼ûdˆ$E‘rV§}uƒtS…ë ×(¢Xû±Ž†0ã»ÇzÃàÃeëlËOfÞ- ¤;†‹Œ)¾u~iFE£Ë•vváL,
‚MŒo$LÒ4¨«æf{Ž£X:Â!¨ªLÚq¿ÚÑ?[øï…{^82Ä}Õ@‚p(xaÙÍpŠ«2SXYÂ5°óâ'WÆãbeå–%8e5»¹ŠÎ2Ï/"‘?r9HBÀƒ˜ð$íº‘§
ST†K8Û,a-ת’ãyˆcv€•ºÖóº®P?A ±r^ÓVؘ«Á;È°.Än³þ‚^[·!RÖç§# -(ÁˆÎQ„RÑl«:´2yߪöAr²OGFå¾4ècnM`8 ëà9î¬Ã€Kr½fDI
dÐÄoòPÙÇIâ4’¤™=”Iz|â.hf! -ˆÔ -zî_œ’ШLóñ¿8ýw³¼ƒÐ{Rš'`-&ýEŒ— -ý‘Â\E:†R`¾¹‘–ÄJI¦é¨€§ÿ9)\Séy'B&dB!ÚÐ .™%Ù×!˜
oDeøÚZ¤ÿmú@Í+™
@üÿNÅ&Žtvê±¼Š!\ÄZ$gŠ>Ié~‚±³˜›J¡Pù -!C¼ÔœêRýÿªRK&Mz^uÄÁ©e¾¯†ýó„ë•sÐO›ÓÓ@„ßv(%áŠ
þ€”@–3éì6ŠÅ³JüÒÿ£<ü“©Ê A›xÞÇã -p•#H…k¡†”>îÔò?\2×@ôÿ +1196 0 obj << +/Length 3360 +/Filter /FlateDecode +>> +stream +xÚ¥]sÛÆñ]¿B“'jÆDqÀÝá0yR,9uK$·Í$y +…ºœ¯/ÂË%<ûñB0ÎÔ#MûX?<]üå]œ\¦Aª#}ù´èíe‚Ðqù”ÿ:ÑA\ÁáäíýÝ»÷?~|¸¾JääéýýÝÕ4RáäÝûŸo úñáúÇ뇫©0JLÞþõúïO·ôHó?¼¿»¡•”.'6}¸}wûp{÷ööê÷§Ÿ.nŸº³ôÏ+ÂòÇů¿‡—9û§‹0ˆS£._à&DšF—ë©â@É8ö+åÅãÅ?º
{OÝ«cò“Ê*’úrËÀ +Þ l°dƒý-ŠäÍ-þ}Ãüù*&ÿ<Xüøˆýiòýƒo?~@¨³QÈiO±pžXÂwp¯Ãpòw`™& +“¡GÍϽԉvp—ïrûÝ÷–ϸk:p½kìníoÿû=ƒ1ÒôpÌÓ”I‚P¥ñyWëcöµIæE“ÍJ;ÍÊe½³Y7G®&£@êPç¡Ãabàlpp)…rqC\€rµäØ©ã~ˆ§'7w·oéaa÷,kùêlf¶¬_^Û±ÊÖ.†Bðâ¦ÕZFßílJKF6*Ä!!Ó†gÄy c‚HÿJÓf%cŽ••p›³×ÜwÞÔú€¿®v½îlsJv÷™ßl³)Ü씑É8HázÞÆöHgLŒ‘œHªÛ´¬ëOYSäÇEÔ*I˜š³ä;¤cú늡RH…0ð¯•Åh¤
$Øö͈ +%„}w*á÷Pa !ª„\¹Øü¨
‘as3“ç¬,ò¬uåÜrX(c† ¹‹I I¥µÛ*sáV§“µmWuÎ{ÕÝVl›P´bŒ6Þ8©üE:ðz&è%»ýa͵œ2VÞº +^Ÿp¹Ð]Cº`JÓ“‰Hˆ½g}*ÅÁÆx`\gì½EŽà¾3úôÓs·šºôÎ+cÈ-vc›vDZ!çW+0ÆAè”_Àl#GŽ>Ūޮ]΄EÚ•`Ö+e9À[e
=(í¢¥%ÞCN>Y>Ç®j·Wf²ÃÚ”)"éTÊ Œ ªÖ†Œ?ͪùŠdš°[“tY´›uu‚Óä@µšÈã +F:Æ÷È¡ÜPÞ¥µ¡Áœ"‰²µüt·é“ÖàdŒT°1ls°úžÉrY˜v„q!ÄÄÙŸpe?.w6û +׺۷9a¶‰+Išb]”ÙÖÕj¸}}à/?ñï?ž–S^[ªÝF¬¹Øž×=>@DÖê`äk›Ëu¿÷ös2„KMpŽ³1¼u:ˆwX=§Z£9ÎìàÝö8”C£¦`›óltX#|‚¹–J5dä£Æ}*J&«Ân)_ÎlhñeUÌW"»9FšÜ“Œ· Òµ‡áŽæSpädY9Dì>xË»úórj€ÓÄU¦ë"4ý¼‘€¾Ø±2A$Ð/F¦¤Èþ!èˆT9‡Î $EˆŠU„²ùÜnZ†«æÅnºA·Ä+ìäQýqEª{Ǩe?Rq`ÒÔGЪãŸepŠ®ûàŠp/¸:‘F)T–¡Ž‡QƒjôíTR•TTK¼‹'*aZ©ž.¢â9_‡Å™è$æŠD +ê©oP4"b—Ä +Á«èö~•8o‹gŒšŠ"ˆ‘еÄPÅëd?yÃ*ÔB‡óC]—Ö÷÷ÜtW±#^éjzH§ƒ•Gr¶±kWÓê3«éhFÕ^%â9ÚÒ1ña¹)À4#9 >ê/iÄ2ý6w#Áî‡Æ× +‡¥+Ô‚2üÒõõؾ&PZx”™ÏÆ]ÍVBŠcØe#$Vs‰v÷ï›û×ïïú9O
3hŸ}]èÓ=§N¬¶·ÏvÛQãBGQb’¡3S6)ÚÞœùß±‹‚ú8#›œJˆ»4ì‚çûa—1Lá@ìâqb”þú0õ½—¶KÈ@Ä_3ºÌWYµ´DrA•ÿšžðÈ ãÕ<ªL'_êﱟ¦È]Äžq¶GòI¡Ï‘áA©Ë¼+üDfѾðv<,!*ØfÜ$Vö°’Ø—û‰àˆÔpúnLü
æz² ¢ +=ßÃ"¦…Ð +‚ä8 +ŒL}SÐÅþÔp5á€DK®S€ëpš.ÉqôaEÈ ±'ò\Ø—N"ˆÐ¨žŒÊÄ]}â4²1:LŽ¦ìoHOžW?- +<z w’k…Á#žüö
hYÖ³Îþû¬'°C"“¯ÐG¬ÍP¬}¢®µïæcFq +xãG´J%Äév°óÝýÓûw¿L.øÇÎ6Œã"âú}ödÊì™=õ 8áè…݈f,S-Ã.l§¼vXÇ}±X.·šõ€ endobj -1189 0 obj << +1195 0 obj << /Type /Page -/Contents 1190 0 R -/Resources 1188 0 R +/Contents 1196 0 R +/Resources 1194 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1176 0 R ->> endobj -1191 0 obj << -/D [1189 0 R /XYZ 56.6929 794.5015 null] ->> endobj -346 0 obj << -/D [1189 0 R /XYZ 56.6929 496.716 null] +/Parent 1182 0 R >> endobj -1000 0 obj << -/D [1189 0 R /XYZ 56.6929 471.8543 null] +1197 0 obj << +/D [1195 0 R /XYZ 56.6929 794.5015 null] >> endobj -1192 0 obj << -/D [1189 0 R /XYZ 56.6929 118.9377 null] +350 0 obj << +/D [1195 0 R /XYZ 56.6929 396.2024 null] >> endobj -1193 0 obj << -/D [1189 0 R /XYZ 56.6929 106.9825 null] +1005 0 obj << +/D [1195 0 R /XYZ 56.6929 369.4308 null] >> endobj -1188 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F21 654 0 R /F23 678 0 R /F48 880 0 R >> +1194 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F48 885 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1196 0 obj << -/Length 3558 +1200 0 obj << +/Length 3390 /Filter /FlateDecode >> stream -xÚÍ]sÛ6òÝ¿Bo•gB>I`î)Mœ;皸sÓkû@K”ʼnLª"eÅ÷ëo@¤DIM¯GK`,ö{—ä|btʤU“ܪT3®'³§+6y„¹wWÜã$)éc}{õ··2ŸØÔf"›Ü/z{™”Ã'÷óŸ§oþñú_÷7¯¡Ù4K¯±é··wßш¥Ÿ7îÞÞ¾ûñãëë\Mïo?ÜÑðÇ›·7oîÞÜ\'Ühë…ßáÄ‚··ÿ¼!èÝÇ×ïß¿þxýëý÷W7÷ñ.ýûr&ñ"¿]ýü+›ÌáÚß_±TZ£';x`)·VLž®”–©VR†‘ÕÕ§«â†½Y·tŒŠgi–Ûl’H“*ÍécéÇzóÔj}xjÂŒ3 P®³”)G™Þ“ &9ì“k›fRH'”ºéªÅòÐe¸’k•ÃˆöR¶×‰aZÀ -‚ZpS$ -œØYR"Ö-ïÏ $Ä!1ÿvr—R’ˆ¥„,´x*ƒªâDù¥êZššoKóVVÏNEpîÓí;(ÞÞ¿"IšjüNóÆŸ€®åTÝ}¹CÅ(ê0Ëz#%²Ž ݦêÊí›3Ð"?:/ÅvÕE:Ž™<ÏSÁ¥òözV&‡îƒÿ±Šïó«co®p!ÔbÚhú‚Žõ°ÎèXÀ—Üb5Of«ª¬»£t"dj18K@Ä¡`pY(欶|H™´Ì³è™Þ~°ºæÓ\”פnõâÇŸÖ«ò ˆF[w~%4B½ËÉÖJØó±n¢ŸÀ8äåp¹mÉŒ™Þ_[PMÒ=(àÇ„¼z‹Ù²*ÑArËÈ<¨€´zŽ'àSS4zÇ7¢lÇ+´á¨XfÀésÕ«GT,OaOLh˜˜¶ër†åúän×ЖëbSt~˜ä2jQÃþÛn™Ô_æÍSQYWÕé鎓
õ…ÑîP„#Ç[ˆ¥yˆ¥›ÅLHfL§ø³dÿê¬5*`?Ö¥‚øVó“F©P„ÌÎeë´QF,'÷¦í’¶ƒ<íªÙ±Q*0#“©óD¬ -†F ¢È 2à2 Í{ÑÑ¥Â0âSa€(ýõòsY®½ÛåÕá·w‡´h6~é3%¿ -–v¡ÑÐÇ:myËY^UWOÅ*ÙøŠãØÓæ@!åó$D¬†8K
æƒ"n#̳sšìw„uÓë:GÇéŒA‡:
GбMhLèlPcµ„âýîyYØ¡ZhES¯^hª:Ž+GÀ#EìmWlŸ²cSÚê¡AvË’rÜR}ªÇ$ŽXJPá(y([÷”.Z„Mˆ,&ø·mµ¯å¦Y™>:CO³*]?Ä©¾Ô`Vøìª]Àð -–òEéSñC
5îžc§¯õÉf½¾z,uq€á…àýÌÅre 8ìA2þ„šCXJË/˜]ë´ÙE,gvp… -"q2säq¤ã€ÅÁY"ÖƒËfY*si†$x‰Ù^?`Š6± -†*?å]=@†Pœ®Ãc±Z¹‚ôã³_‡åó
ø¡“¢#óÍÝë÷7d,P%)ÕT_ÇŽ
NH¢NˆésÕPW†FÁ0iPÓF !«ç…ßÃÙ@Lñ`¼Žß ÞƒƒŠÕ®xiÛŠÊ0œ)ëEã{JíÁ©û+Ä0×4Š™ãCÓ-‡éØS‰·oÁ@Á-"jlÚÌ_€³ÕÌG«5ø¬íO)²b·.ôgzHgÔØ#
ßw”—‹4çZž=4"Ÿ:´Ó<Íl–
Ž
œ¥àýíÙx! äæÚÄ>†fÔÈÉ¢[Aÿ†]““ÂHmã«D[m‹G”ÎD_‹S-¤‘[v4@YBtÌĦQFm<‡½¥p@ΗºÜ6ÕBdq.e“LNgË¢b`Žë8c62Í8DYUµe¹K†iró8!àc_*?é/ËѾHקÐÕDÚTÊztdh Õîo~Ü£Xh8ÞͧÞ*3.ŒžÀX/8┣¤§»eœBé´ô°‚òÍ5I -*¸ÏÐá9|`E,`˶k ËWâÁ«·kÂ÷ï^žŠ‡%¾ŠÇ“âdË}9"Ü›67IX|¿É®Ù|öA ?—¯GÕ5£x* (êvç(`>6#@Wß5X1ÜÄàZ´Ó[˜Ú«3Sži!Á‘xS¬åée-“þ»\°¢‹ùÍ|¦·Å}ª<©Pm£SårJÑé°Æ÷|áµ·8x.úÃð Å +xÚÍ]sã¶ñÝ¿Bo•gŽ>Iàñrñ]éùŸ34ÍO¢,62鈔}î¯ï. H‘’®i:½ñx´\,€Åb¿I1ãð'fÖ0®œžeN3Ã…™-.øìÆÞ]ˆ@“D¢¤OõíÝÅ7oU6sÌ¥2ÝzkYƳ»åÏó7~ý×»«ÛËD>OÙebR>ÿöúæ;Â8úyóáæíõ»o__fz~wýá†Ð·Wo¯n¯nÞ\]&ÂóeXáÈ„·×¹"èÝíë÷ï_ß^þr÷ýÅÕ]w–þyWxß.~þ…Ï–pìï/8SΚÙ3<p&œ“³‡m3Z©ˆÙ\|¼ø¡[°7ê§NÉÏ(ËŒ•Ù„ +ã†îæ÷ÍŠŒð½6å€æqX+€qÆp©¤;T’º”¥ÚsfÒ2™Á:çdœ(õe™ov$½‡z‰¦eµ9-iÅ…"EJP“ŽP‰Le#ª½Këßx`¦$7³þ þ;© üµÈôÿFÐV³Ô)µ´˜tj=à‚;° +
+«çK§á¶¼äa¬~l˺¢Ñ¢ÂraIMù°Ûä-]<ûÊ©êOM½)ü½ú»›Ð!=EûòF¯øñêöRÙŸ.…p~ÌÜ…Y1´ÄA‘XAå¿
uLk˜Þzþ92YWGïVƒ1hËõé»íS¿ÛŽÊßmÑ.ÖÉýfWŒ¯–ÃÔÔžÞ»£šØ|pµÊ€áõO‚»ßÑ
¦vƒi6ïpáŽ@à*U¤€‚ÈNö0 öÔVÅFï€IÊù‘*|e°cäç,ò]ã5ö ®(•ý]"²¦ß¼m‹‡Ç–"ÒïH*hf•êñ"
SSï<°`µÿÅ. +ñOË'ó7®” +Í0YhþPD%ÅâsÙ64´Ü„ºU”O^9pìãõ»»«Û÷¯ˆ œ†ê°Ò²;`€ëSy%‡‚Rm9låÕK˜Eµì"%Ê çmÙ
Z¶à ?jßN—Æ1Ó÷GT·üü…:a¡0ÖbŸ_MTãA«Ï„ZÈe˜æ©;^}ªãúÕQùÞ\§Ø,“Ŧ,ªv”îApdS“tTkR8CȘU–v>áç< ËK1¯À9Mj}·ñ›â˜önD„™dÊaÜÖ<½]$‰kÞWuç!ñ 6y9œî@[Rkçw—T“tOgŒLÈûî(tÜ÷-Q`³³Z¡ÁZt)=ƒË›P6HߵË9P±Š=%t¯´žP±Œ9%㚘Êp9o‹VëC–Ûç:¶ƒómÞ4Ýˤuh컊¨¿ù®]'Õçeý—Sa-'‡â›f[Bå';»ëº¾ÃíDÑ,FÑíj!· &RbJX²}Ò5ˆßÄ.r ‘È—ÇRÂNžñù}ªF©ü½×M›4-dhM[.ÆF©ÁŒlªO3ÐQMp04JtòY6dÁç>Fôâ¢O‚ˆI0@”ø†ÐøkQ<·+(žÃoïžhUoÃÔ'J{ÄË¡ð¾ÅGa1a©˜
ì_#ä²°IɸÙÁÛ’²]oˤËðˆjýÞ6ä'øêàLFܧ:~ÛrŠ¶ÒÂR~¦Vvò)oÆÙ1˜ºKõi6"ј
<‚‚ÜØð“*½Ï&œÚ×/¹¬e&㮋aP?‹ùuKó½G d¸¸dX:J +,ÚÃ'´ð¸„}¶%…nÉ&(Ä–rúi·yÕ€ +€ßîXÝÔ÷¤ÂHäHh„çDPUŸADúÀuµ x€Úá“U@þ’Í1ð9î¸62íÏq% +V‹!׫ á9È9múaÝöºÉÐqzc0±Bètl[&TW
‘kz^V(7šA¯øõãšèH{Ëå»ð.ßiûî WÑ®kHÊqeHõ©SbX2b)A%£±dl¨|´ˆ‹[„&ø·]¹¯ßxìÞÛzšMqï;!^õ•³Âg_çõ@Vø†ŒMÙä¾}È_ºPC»§®ÓWÄúd»Â^_µˆ–º: —üÌÙre 8ìAq£ÿ€šC€_ÙÓfק:nv•7;8B ‘8Yø +réSNšÓtT›¦LeÊY7æz<€)B¸4Æ*@•a(¸z€,‘x]‡Ç|³ñé'd¿ž*ä/€ô±‡b:1å››×ï¯ÈX JÒø.i`,cƒ“Š¸“rþTÖÔÏ#´×(@“F‚Ú€„¬Zæa
o]Š£àuÂÕs>Ø(ß<ç/M\c[R†#EµªC7©9Øu$~x;ßu™ã§º]Ó±‡ïÐ|‚[v¤]»fù’-!Z=‚ÀÚþ˜"+É2ÇÏô©ûT'9R
ßxôW +ÈN”Vÿž†·÷3nû÷é“þ„‰{‹|}Œ]MäM31jÓ)Žß)Ù7ã>]¤:ÃÃxµ€ëÔRÐ@6zÆ{!‡Â…qJ½q¸]wCx;
=l ˆó (Ãé:J¼Ú?…Õ½Âp5òV”–—N«Çæòç…ÏÉ¡‰íEÝy„÷mFÝÛª-Ñ/x–ƒ©?¼&à½wAô6˨ޘTa¾?<üúâ~»†ºÃì4NÒ‚|ÓÔÉѯ" —Èt¨)± endobj -1195 0 obj << +1199 0 obj << /Type /Page -/Contents 1196 0 R -/Resources 1194 0 R +/Contents 1200 0 R +/Resources 1198 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1176 0 R -/Annots [ 1198 0 R ] +/Parent 1182 0 R +/Annots [ 1204 0 R ] >> endobj -1198 0 obj << +1204 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [182.6146 225.1021 231.8861 237.1618] +/Rect [182.6146 117.0296 231.8861 129.0892] /Subtype /Link /A << /S /GoTo /D (notify) >> >> endobj -1197 0 obj << -/D [1195 0 R /XYZ 85.0394 794.5015 null] +1201 0 obj << +/D [1199 0 R /XYZ 85.0394 794.5015 null] >> endobj -1194 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F48 880 0 R /F47 874 0 R >> +1202 0 obj << +/D [1199 0 R /XYZ 85.0394 720.9574 null] +>> endobj +1203 0 obj << +/D [1199 0 R /XYZ 85.0394 709.0022 null] +>> endobj +1198 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F48 885 0 R /F21 658 0 R /F47 879 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1201 0 obj << -/Length 3695 -/Filter /FlateDecode ->> -stream -xÚ]sã¶ñÝ¿Bo¥gN>H|tî|Ww_ës¦é$y )ÈæE*"eÅýõÝÅ)Òòµ‰5c€‹°Xì' -’‚nÚµÞ¸‘ª„[n°8•Au?_.îῈ&f\ƒ -nÖ36Â&Ð̳î |e.…ß™wä%(´ÉÓà°N®KäIT¶uMa¢øUÛh -ÜÛp†©ÍñXo2m6Bó64É4¸·Òƒ!Öë†6`ø;Xþ“‰sŽj¤ÏO쑦|_® î’|<1¹> –Ë»>¬Øë®/˜#äGQÊÖÚö{i÷TiÊ2ÖlÜåªêŠvü¸ùéãݸ¹ b[ì@’÷u±£ïA Q#Xç?ÜNW0$À8(IÇv¡j ØGAó弎é4fYîW¹ÝµÏÕê¸S§Úú¨åG¡Dsº±ØŒVe&É%žÑ+¾âOÅy2ê¼^M” -Œ_¬ ‘3‘³€õÓÑÑÑ$³Ñ¡Àm$ì›Ùðߢh2î„1I,'Á9ä%è,WÖ4LG;ojd - ¶”o˜šÖSã±æ„x|¡†€öììkfúqÚÒ¨ Í ?&Ù]¹«êÒ®gT1Ïb&ýÿ¨âŒúO˜ŽzNÿ<þKžŽû˜ð˜gýšÕ@õÓÑÎËєɢvD:#iɆQ²›®Ÿ4p·šKqvê€4{,f•ZÅLþçHÙéN¥ì>pFÊÐÓâÑã€þsBæÑϯw2ê·Š˜Ìb
qÞYž¤ó4LÆ:+_2KÀ`$oœ±^—°€…3ö;SôË’2¢¢[vÛ¢4Ó,5‡À'ççÉX3tŒ¤M&q*X:&Ä $üèö¡~(pOHÂ(¤ˆ;$€š¦Â&PnŠ¯ÆA¬äBŸ"N:‹ž>Ëb·«ŠG׃Ú0½¤oLF"!ÑåÉÈGƒÃç0ÍŒ*$`9¸Ï²çÄ_Æ:Ký8fnŽ®§bW”KŠÄ$dhâÍQ ÖÛÐMd>
Ê Û*6†@{…Ë@h*è“ö×Ví1.´ôÅhJ¯ˆ0%Ó’˜ -m뢬ê -Lú®ÛbE÷%0‚½a eÔX£üÉMm7I¡âÇÛ›Ÿ¹/©mÆ”?ôO´?°ÊÖ
}=šoLHÜ9€WÞÞSi—å‡Ï_¨²±×;Æ^öèèÆ¡{RQþŽÊ‡Oȱ樄ÚkûÏ3:xüÆýofövUgb°ÿ~9+¿žïÜÒ×ÈÈÒ’®ü”ÂñJ†Rø'Êm‚‡¿ééÁBcuÕøó»"lïé9_Yš-ìô;½°:qGs'ÕcC7fõº-…´F«<Ö°ÎØRe/ÆV« -I*êåz×n–žz.ëFM%ÈãÄÌŠÜR&õy -Ö‰ãLÆ2ŸiôçA!]uÙ_Ù6d[¼…Ê¥»!‚–óT<W>el]~Z¸<×ØîÐ0àE¥ZÄ,MOÒFo‚Á¢Ã“i°ÆÝ¥‘5$Ø€‡¹JaÙÓ ¬ÆuŒ¤<S|‡G]Ò*ýptÛºnaô÷·W?\ûyWsfçaàŽ1¬š.X#$ZÊ¿ì’g.°fùeïøËù€¿ -`³râìD:/<ntû0!¶W
ïyU ®éÝIËPlŒJ3Ú>å(RµÀ`<hÆ=P¸?ndxì9#ÖŸÕtäœS’kwjAþl[/ -åÁÔ5ò"?}mÚCã`æÙZ\ŽgðíþÍ·öôÅ
¬0|4ö
TªÐǵ¥ÊÐ"Æäü#&ºøs91?6‚J#ˆ%C¬2Šƒ3K‚•ù§;Iù¬ -å./:šÀ™:ýe"ÜÙfisù€kÌRØXn¡Cã*Ü+%h™ -hpFTIwÜdŸ²(!O³kojŽáJÕ^:ßÌšmK9ˆáã
JiŸ6VTðËÒ•}Ú±‡Ú— ,KZ<69?‰^4%/ŠPê(ÇGè%£çÊî`ñW=äåÛ—(R2êBQØjtKM3×ã,‰3)ÏK&üøø
Þn¯5h³—ð0TÕ³)÷»Ž>dvRÈœ2Øø±â²{q‡SÒ¶‹Á‡ŽÙeàƒ¿AGæe'áðQ}†ùkÝ>ŽÞ¥Š]C±|lÀþfV˜¾œãF¢cÍ•ÏæÓMˆtÅkÏ벘«`‹¢Izl=*›x5„ -±,.¶´ŒfëRã‡#ÅLœb‚ “n¾òüX¦q‚W®3™0oçþðÛäãÃí$ƒ¦åëçÆ ÞxªY‰ž4¸WÌ3Äÿ%õU¡endstream +1207 0 obj << +/Length 3814 +/Filter /FlateDecode +>> +stream +xÚ]sÛ6òÝ¿BoGÏD,@$0÷ä&N΋sç¸s½iû@K”Í Eª"Õ÷ëo» H‘’Òiã™ +òÛÕÏ¿ŠÙ–ýÕ•5z¶‡"”ÖF³õU¬U¨c¥üHyõùêßÂÞ¬ûtrÿ¤#•D©Þjkõ,Õ6LLá>¾ä¸ +
²jOˆ*ÁÌ{@$¨rJÓinóÅnÛà*ŽÈZ*¥gÉz˜1ÙþñH‡‘‰dïVtŽ±éÚPá•ã6l|Ô2
ŠÃ€ý «pŸ-t°‘Á»ûÏôû·]îκ[<Àš¶!(áÕ3&ΊàQL]§É· Àôɾ(K¦Ô‚”mZvòƒKn3‚’$ûzû…Ž]£9JÍðà=sup5"&´BÁòš½ã +S)†´i0Û¡ìV +ýeíä¦Aëøƒ’PgËWšùRÕû#®˜U0ê°¡‘T¨
¸lá×KÞ…÷12Ì-+üÎúÃ+0Ù +îë–©´/™#‘ÂFµmQ=O˜1pBo‹¶½c +&$HiÊH«#ÛQ +¿êM¾ÍZ2+‘²A³÷8¡Ž"Ä=÷ŸïÞÿ—úÙrɲΓe]ÙmÜ‚¤>ç9Ãa +öb^,盺.G†Q@Ø R=ë£F5¦§5„Å…È?RšúÝ¥9¤ë4öÔÔeÞN¹Ø¶X'¦Gɉ@Vî³×Æ÷Ëzyÿôa;tïÞñX/€À¨Á9é²â8¼t, 3§Â@>Ožc’Y@±hFæß$2=K½“ú+P³>ùyS:ùGó¦Ä§'º—ãè.ljƒE]–ü ˆ_²‹q`€c;‹¡ µœöh·G
áøEh±«J +f/R +ækº¾™‚>y¡ØƒíJ°…‹‰E÷Ûð*9ÄØÖmZF<ŽôQiÁU:td¬t¸ÝÖ X˜i˜C€öiLµ\Ð×HtJºbƶs]ôjã‹BøËP\îÖƒ}Zs¯¦9G@ù(s,a‘ÄnJ¾CŸ*!E¶·´AsÆ7‘|¿KtßR©.ÂNº{*$‰…EßàüÍmŸÙ»>|˜ˆúð§+ˆ¦‹ƒÙÅz¬„°ÍŒŽVà©Á±õ)Œ-Ž‡ºÀÈÛd`æͧJÁÁ$ZŸ·±}¨ÓF¶ƒê\ßï`ó‹RÕÈœ'ìÆ„^Ï&XÚ”CÂäôTz¨ía¿;íôl*Ùwz‰M]MF¼Ö;BPå®8›RÛeÑdO(ìøãî§÷Ã錚M¶IÞ•Ù–‚çðCw#;Þ`uVJøÅhY_0 +0œq{ÿH[´ï>}¦ÎÚ]ñÐ¥ îÜ‹PØ7Ô>ÕX&Çs ½Sç/S*@~ãùWS JN£Þùûå,ýz¾ã%èSl€©´Kh¿U +‡+éKá_´'¶1õq™¡Ê÷eQù:^Öïq½o±È7pÒoüÃòÈ)MU‹çªæûñÓ¶œc¢ÕSz +vj»8×ÈÃû²¥–˜€MÝ4…++âpþû&¯žrG5b#ê¬ôÄ1xÍåw)uéì)”Ã?¯DDÁÚMÞ©ÝÕ‘`bÙÕ +¿ˆ£·L80zÊ‚ƒèEnøZŸnày;üÅ:u¼õ‘ÀÌþRm°€SÈ•ñÕ÷D endobj -1200 0 obj << +1206 0 obj << /Type /Page -/Contents 1201 0 R -/Resources 1199 0 R +/Contents 1207 0 R +/Resources 1205 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1176 0 R -/Annots [ 1203 0 R 1204 0 R 1205 0 R 1206 0 R 1207 0 R ] +/Parent 1182 0 R +/Annots [ 1209 0 R 1210 0 R 1211 0 R 1212 0 R 1213 0 R ] >> endobj -1203 0 obj << +1209 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [80.6033 508.2814 154.2566 517.4968] +/Rect [80.6033 407.9328 154.2566 417.1482] /Subtype /Link /A << /S /GoTo /D (statsfile) >> >> endobj -1204 0 obj << +1210 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [265.4578 462.9269 326.6578 474.9865] +/Rect [265.4578 363.0047 326.6578 375.0643] /Subtype /Link /A << /S /GoTo /D (server_statement_definition_and_usage) >> >> endobj -1205 0 obj << +1211 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [367.5441 462.9269 416.2908 474.9865] +/Rect [367.5441 363.0047 416.2908 375.0643] /Subtype /Link /A << /S /GoTo /D (incremental_zone_transfers) >> >> endobj -1206 0 obj << +1212 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [280.9692 432.1776 342.1692 444.2372] +/Rect [280.9692 332.6817 342.1692 344.7414] /Subtype /Link /A << /S /GoTo /D (server_statement_definition_and_usage) >> >> endobj -1207 0 obj << +1213 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [277.6219 401.4283 338.8219 413.4879] +/Rect [277.6219 302.3588 338.8219 314.4184] /Subtype /Link /A << /S /GoTo /D (server_statement_definition_and_usage) >> >> endobj -1202 0 obj << -/D [1200 0 R /XYZ 56.6929 794.5015 null] +1208 0 obj << +/D [1206 0 R /XYZ 56.6929 794.5015 null] >> endobj -1199 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F21 654 0 R /F48 880 0 R /F62 990 0 R /F47 874 0 R /F14 681 0 R /F39 858 0 R >> -/XObject << /Im2 979 0 R >> +1205 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F48 885 0 R /F62 995 0 R /F47 879 0 R /F14 685 0 R /F39 863 0 R >> +/XObject << /Im2 984 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1211 0 obj << -/Length 3636 -/Filter /FlateDecode ->> -stream -xÚMw¤6òî_áÛâ÷Òôè8q<Yç%“YçåÉíf‡†ö8¿~«T%0ng6y}h©T’J¥úáy -'æH†ÂO´Rà</û²©Ój³m›ýÆîãéSk¶çÏno—Z…LàVÝÀŒt‡"+?(r…U{×u×ilQhEg'p¢;4uNCx~»ÔíBZع™ýŽÀ¥|üpõ½Op²|vâ®*^Œô€Y:t«"HªÖ„ù
÷°g;Ó‘@asÆ{,xoÍÒÔàñÆñáhnJ¶djò˜M5àÍÌHÊÀPúÏܘ;
ž9’<ŒÖÝ=#m¦XäÂw?b!cöiŸí6ûôp(ò
HLTÀ%,ÈAàG‰2§é±V™ -š´E‘œSr½%™TÉÌÃúB:~"–N8ö_M8¨˜‰B†[ך%бwýþAñ9i - -Ž$¹®”ˆ`ΊRtbxCgƒPþYP.D6ŠMq‰Ó`ᮬ)49N<®ÈˆpÄŠqÒšÌ^3²p´pœø˜ãnÇj‘Y9]_]¸„‰ˆ…ÿbhÚ´-]Ñ U,³V{N¦SvLnàôÁ–¡è^¹ÄôŒ×® Õû+ÙôBÙ_
¾Ù$>dÚÊùf[ô&æ°²[ÙPk_í’Ö‹çKéKE§ÿ|©‚'ŒCNr%|ˆ|H‡em²á襽nÃÞAd`:êTÅCQqûqWZëMØŸ¶HúzóÛÿjÆÆ~&ÚÝ>ÛÕB R¶‘ôu˜W™,|#"·KÓ®ñ8ô“H«×x¬ýXJÆY³=«0y±¥È0½£a)?ÒÚœŽ†§X/GÃ#–åÀPõåæȇYð«$äóIrz÷keûYð«?Šƒp¾?tÀvŒH•C˜µ—Ð R9¶žšpv6òC=ár={–Ž¨QºÙßhª\ÑB¦YÆú£6ÝÊÄ… -—IÍܼ å ت4Û¹ÅpL³^å -Gêa©ŒIE³<´ŽGNiw©ePP¼jÍu±MábÇG•âP"ý%x²ZÔtÄÊËúÀ•B¾õŠ~M°Nè—òRQƒ4e\5y®`òÀDÞ~ÄZÙvTðÁ+žpUs,$Þ÷ï>|¸ºÄ6^àb{°= -ö -ÖÍÿ6N?HÔ?`âЉqãi <"@Fš\EµHË–^6çU4ðøaDzNļ†fü(€Ñ)oìöXÁ=KÃøè-ñç¾Nû};!ñÓ;ŒBvRnŸ¨j.'âíùD”Wíj¥0:ÞvVïn©@ë<Nø;wÆ14”>}‰S¬—oqÄÂí[+ÆË›ƒ! -“0å\CÉ…+Š¼p«V²
‡‹ JEc¨ߌ/„õâÐ^“ÓO>È!³m÷.•lÑs¶ --ת äzj–íÓÜŠ;о2á1ªÒÃH p&Ž^/C9ÆGÿåi[¯má¸_ã'”Ó£/½DÂA„eÐáOÝã\xìW“‚ëÄt±ðPçS ƒµ>Vˆš–ÅtÍžÛ¯Ù‚ÕÂÅn«‘Ú¼²¤}}´:4íêM_JO
$D<:óHWr”lL -ª;´‰7TT”®¦!
¿·)<ÀvM׳~ûùSNð½}úEY^âøŽ€-'fÏ>B¼›·—6ZðLW6á!é%"äMyñ}“—›µÚ59¼¹³¢e â§/}ý)A¤\³×Á:ýí/CŸÍªØ—IòBš-ƒÈOÐ -0Qx2e–”Ÿ>'ý‹í, -endstream +1217 0 obj << +/Length 3673 +/Filter /FlateDecode +>> +stream +xÚËrã6òî¯ðmåª!ðuœL<Y§’ÉìØS9$9ÐdqM‘ +Ö8_¿ÝèHJ”&³»¥Fh4ú
…×üÂë4Êôu’iat½Ú]×O0öÃUÈ8K‡´c}÷põí;•\g"‹e|ý°•Š MÃë‡õo‹·ÿ|óááöãÍRFÁ"7Ë(ßݽÿž }ÞþòþÝÝŸ>¾¹Iôâáî—÷þxûîöãíû··7Ë0B˜/y…3ÞÝýtK>¾ùùç7oþxøñêöÁŸe|Þ0Px?¯~û#¸^ñ¼ +„ÊÒèú +%Ò$Ô^‡Pàyõ¼l݆{³*6¯,¯3»@3á%³ê›XL‹Ìn¥"‹Ÿ*. ¯rËlÜ’®`^ÊF(žªÚ« ñ)Eæ%É”‹ƒúX¡YS£¬ŸBŸCÞTxBÛÙ™¶ÍŸÌ¬0Ý_â†NEÆmù妩wËU¾²çÒòÌm„‰ã0tÓW]Ÿ—V³`ÆHeµSChË QoŽF&»uŒT¹åH15+&2é¦åcG"KŽ4‘VÅȺú¹ß£EÙâå¡$/Ø:lÑ~â bZ¦"¸ßÐhgXFïV1Vè)Ú!*xõ¾e ÐO\›¶ X3ÞlÙÉ•[N©æÔïÜKZdOà, +#´ª‚¯º +D„€–ñ,d<‹›¹ˆŽDèúm?/a¿nÿÉÉõTùŽ}Š' Eë<PµdªPõ^Œ= üÙ›¦p¾î 9Ïâ5ѱåÎ…µ¼Ÿói¦¬Þý1M{ó™Zöà¸bõ:¢n=Çt´ÞhUjÍ·’lÒìønåȘcíÓ÷w)u¿?Á^3zcš&/¡¡µ8JÒâÐêš·eM+1cÜéè†Vlë™;TÝ¡˜€¨I +¨¹g¯RuÔ·«8lj
¼–Wjâ% ìëdq_T+s„éTN²HKâ|§¼ +yèÑÈñHÈú–†˜œ”ïRaDS®ú2ïœ ¶´}bG¶Ä˜bje¬~&ëö< +¯9Tw2rœ3g+ë§'kÎ4Wð´«àéȲñ-ÿ
ŠMÅ+è¸;Á6›b9ã>¬ «m^=^b•ó¼¾½œ]ÑuŽk«á»†l¢íˆþ|Çû H´41Ÿ5?>³<‰iýl,Óü3²Ë|‡!%Šb É™rè.êåLŽä¬ånMßG¼¦)4Õ
µQ~ׯ+BÃõ¬#A±¢UŠM4¶[fÌ~aZÎÝé¡XÛü1€Ô´£/‡ja>ïMex@ ,ýÙrK&‚Þ~øÄ+TÙ™]mó6hƒwnûó§ûhg_¨¶¡ã2  +}¯’a‚Uè™ûäèZ’ÞaÃëv¨î ©€%ýK®4Øp_šŽê‘4® +WsB[Y#HUG’°ñ”-“8}°U(ºW®0ðÚÕ³:1“LÕš¾5¹æ,h»‚1׈³„£ÊvfÃ(‘Œ\®Ãzqº°RBeq<òù3µfˆdâ^|ÈGÎD±²&9ãàXn§GºÖ,Uˆ¡SšSrû°-¬q‡&Çë§D-RBBozû_ÍØD¤‰d¢ÝíC¬] DNÂvDD¬DÙ™,E&c·KÝÌñ8ié/ñ8?-X³=)ì1w±•È0gƒa™H§’är0<Æ:{,˾ìŠåÀ‡I쫤óizyw5³ýô]-q„Óý¹ž¶Ã×sbIVaÖ^Bƒ*åØz{ÂÙÚÀAöûÒõìYÚÉ«e›±Oþ¼©Þ鎒4ùò£ÖÜ*|—ÑáQÙÿȼ å)ت|µs‹Ñ˜Ê²ù"Ø +„êoT9Ò¡Ê!ÓÄ–E×´—ÚRW“JÝËM’9•Úúm‘» ýîÑÚ”êg¢‹ÿ±m¯ +¦’¾]߀±ÕÀòÌŠô°RƤ¢YîÇ#§´ÛÜ2((\µæÚlr¸Xÿ&0SJ•HPò.½Ûñ
ÊyýBö&`V.ë×ë‚~9,+HÓŠ‹&§ +– ¦úòökfÿÉQ#:H¦ÜV¤éâû÷÷÷·o±u×=¸ØŽl@@{I‡Éhñ©rל²¦™?fª†Qø•â~Å‹oJSVí`—œ·µÿ9€~Ád®k‡2Î/™àSTMÅn8ÈZPçkÄKk¡Ó8þŠs•¯0áˆÃì²|±ÎË—ÇÉ×K^ë܆ÙÇ2GBÆIv™5CÃô¸:SS"œŒáK‡“1l¨²ý‚¿NÌ¢T-Þ×™ñ®¶”gŽ±'jtDWœˆ(ž“é…w‚в¥fWŸbØ·ðÀéå/áREMMü™"Ö~”>ŠHYÎ{ëæÿ'!MõÿÁÄ…Ó„Äù²Ž°.ˆ ÃÝ
¶KÈ‹†Þ6§u4ü÷C¤.“á±fè˜ÖÑ20:!ä¥ +vÀ1´§Qj#W0…QƒØ™½Áe´±G9Ïß¹I+,îPG¹ÏõG!/¾í‚ŒÒ¯ýï†a£:uÀ/}YŸ#óéŒû2wYW×å«çóRpR…_¨ÐŽÎ”CÂsÛg_Œ]ŽEò• ˆôÅm=Òé¾Ó¿ó"Kãd²1ÿa…ªH TÒÆ¿~ðK4±F×¥&³úZ•Z´]Þø:G^Z{öã,Ä°ñNú€ðè!ø†NÆ9:ˆÆlP;UpÿÆ¢ñ¡ö&\¬–·‚(jY5~ÈýÆ¿TVGo–îôôg '/ŒN×b7;WSlñu² + ×Ù1åþ¢§¤ÿðDÂendstream endobj -1210 0 obj << +1216 0 obj << /Type /Page -/Contents 1211 0 R -/Resources 1209 0 R +/Contents 1217 0 R +/Resources 1215 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1213 0 R +/Parent 1219 0 R >> endobj -1212 0 obj << -/D [1210 0 R /XYZ 85.0394 794.5015 null] +1218 0 obj << +/D [1216 0 R /XYZ 85.0394 794.5015 null] >> endobj -1209 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F21 654 0 R /F48 880 0 R >> +1215 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F21 658 0 R /F48 885 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1216 0 obj << -/Length 3228 -/Filter /FlateDecode ->> -stream -xÚÅZYsã6~÷¯ÐÛÊU#,‚$•Ï¬“ŒÇ+;{T’ŽDY¬‘IG¤Æq~}ºÑ
%ïÔnÕ–«L°Ñ@7Ð?4¤&þÔÄÆ"vÚM +•,/ääú>\(晦YŸë»û‹¿¾7ÉÄ ëxr¿îÍ• -™¦jr¿úy-.a9}ûéæýõ‡ŸóË$šÞ_º¹œi+§ï¯¼¢Ö‡ÅüãÇùâr¦R«¦oÿ6¿½¿ZPWÌs|w}óŽ(Ž'&]\½¿Z\ݼ½ºüõþû‹«ûv-ýõ*ip!¿]üü«œ¬`Ùß_Ha\j'Ïð"…rNO/"k„Œ ”íÅÝÅßÛ {½~èèþ))´‰õÈjÕÛÀT ëœ$Ö‰Øhã7p¹É—_feö˜×¸bzCb)“¤ y³§§m|3ä´©à)Ý´ÙäD¨žË|G4šŽ¨k"ÍßÐû|>§FV®¨ç㿈°»Té4_Vþ¹ªÁ$ÚÅÓë†Ù·5<¯ÅªzÌŠ—2™‘öÉd¦”pÖj¿ÖÍÈd -|ðŒi0ïÈÐøoN}¨?vÝܽ!Âݧ9Qü‚@Âñ¢Äùxv¿ -ÌYÃ
QŠšÞ3z¥™¿æ»š§ßVÕ—ýKX-£×MU7A’œþ"<¯K^.ˆ"…±w}3›¿{·óÅí¥ÓäWH¾[Qª]×s}s’•8ŠW%¥â °Išœˆ/bšõ¹ŽÃ+Ä~ËÕ…×ã©•éyÁiDp?H•ŒDj@—ä·(wÀ /4¿ÓðB»
wð:ÑÀEólWóˆªÏ¸n'brFë[~]ˆ±Æ0ÊMïƒÄU¾ÎöÛ†^ŠnvÊ;ý½4V -'!RâyÎvåHvÒFèH'ÌÄÒ>ù¥úø7.&¢ad<Uu]|Þæä_³íÞ'hg1Çú¤VDQ±¤uVlGÔQ‰p©L˜Ž'RN›æ)Êj—Ø@ûve§Ü6r"2Ö¾â¶=®3n¸:·}.¶«e¶[ŠW:‘TçŦñƒM3 -l¤üûwM«§¦¨JjÚ¾ö™Ê°eÉÎ͵{h”U9kòÝcQf[¢ðzÚôldÄÎI“²Äõ¹ñ3r-P6Iu:ô¬vn`×ìáð̶±Aû9{¹TÓš_=8p(FàÝ«º#ïwû6«k^><÷å -rqCŸTbýå1k–›¢|ª=T»¢Ù<’ -4½¯`ß¡kà+dsmµˆ•uÃïmºÅod½ç¤’ÑÓlõÉðµ©ßWî|øö¹N‡oËÕ…oQ6ùX÷å8~0Òž—˜FäãÀg›¡·ùöÖ{•Ä„ëýYLÈVDCO V§¥gñª×ÔåãžÁ…°?¸Z³pt£T@/@õ_8 &tÝ-.þƒC8q„ð!²š£ú>c4A6 ÷¾tD@çSÓ;<îÎÉqäèì„#MP[[ô$q$ctŠü÷¢æ¡äÒ0r•oóéF¢¹
DØ÷>a¦„cuÊÀ a»<õH0rTåö…º‹rÆ6rÀ|5OØ!јLEH3ñ;¶ò«}3«Öí4Ioš<HùæEŽÕÌO‹C9IaÓÊ -“["à
5¸^ìVË -.•˜àR@ô.ÏKÁ°îåO ²_µÝäW(±"ò‘_Yuˆœÿß~G7™Æñ+~Õã:ãW«çWpÜDÈ}èU*Jj}^|Ë5"àW°V™;TàŸdõ(ž>$#è%Üñg¹~C}\lƒV ->(ç‹Hë\
ßú®Flh-ìavïpHG‡{!šw7lxóc§w7OáÑ=[k§ÈÖH¶ö˜DBEJ
?1£àà@ßš¶¬Æ¬¯´ÌkÖ‡ï8L¥Ï¿ÇtÚöÉŸqžVp‚#X?ûR9Æ%€%bw^|Ët,èæ -…ÅçvvÏæ«+Ølñ†ôBÒY -¢²X„w»¬NÅ„Mö5«
-ÆȧÏ.—T@Ó|áªS¾pÂu‰KÍÜI€¨Ÿ÷
1<õ¦?$ñ·œÔ»NäñÛTø’PÃÕ2J,_|¡€îU¤Ù{Î\Õr 2NZ•c您Ş£YÉ÷XmÞËÍ|¢ž¦(ö{Ø* Ä~ýiUå‡ì~³ÐYY?·Ó3*+è}øäSE‘0Ú½rãÚç:ýÉl¹üåEúÑ…+œµµç妹ý|áRH\q:”Ë7"N·WV -‚IX)\Ý!]‘#w¬úŸÈYendstream +1222 0 obj << +/Length 3453 +/Filter /FlateDecode +>> +stream +xÚÅZYs#7~÷¯ðÛÊUã/>*3žY'Wvö¨$m©euÔí¨[vœ_€ +˜âЊÈhÓXY«1+{.´òb-¾L‹t›UÃ+ +@ßî°Â®é¦#]i˜§6ñ÷뼺€ÉÙIùTçeeXOÛWÙ’(uI”Ý…J&YUïòEÍ-댚ët—.êlGô*«‰žK*T¯EþFåŠ;e»:ÍYì²ÜRÈ"¤M–%HD¬ƒ +û*}„Át,')i“‚ëÉ +4%™ì]êÈLVÎœ@Þdé†h벪9À±Åe¤oÑÁ‰RÁQÁ-ÙŽ
•Žµoþá‘a¸gÁŒÜd&‰V,”ß–Ë|ÚKÅf•Ú¯êÃ+ïNn((¾3bVÙ·É »ŒI›Øûyúô´qÉC+Ê·ZZ^Q ”/¦9¤yË)J£Hš]R}6›Q&-ŸþMöTÎHøº¶ÑäºföMÅOkÁÚy×¾—Ë|Ú–ñÄeré(æïi¯Ç?3jsÛ +™<]Àš¶ºÝI•èP•˜U‰&·÷óQc.ò²Î×L|ø%ªY, ¡Aˆ˜Ë|‘ÖÎ¥sZsCMÜu±žR•F~†ÄÃoÊòËþ‰%¬ˆ–RÕ1¿œÖ%+†¢åÃ5C÷¾¾™ÎÞ¿Ÿ‹ÙüöÂjr/$ßFC’‹nnº¾¹Ç\$ ã£HZØÁMrDu¹Žƒ¨†«
³íoCÁÖŠ$”ÉiÁžiDpo—“€ +gbCñ¿}o"ÄZ–î*îQvWÍ@LNéçú–«Ë%cŒ£,§_hêä~C>EÃ&+ +P9@µ‰Eûtð:ŠYT l`lzÂ^Qg,k_¢ól¬54õ|ŃK-"Úþ¢“јöœTRúÁ´¦>¾R‰DñáÛá:¾ž«
ß¼¨³GXÝ×Ãø…ƒ¹OË÷L#òûñ+…N"ÓWà6ÛmWIL¸ÎŸà„tI4ô*µZ:§zEM.îá×»¶{ÂUã,m/åáPݧ=䄦»ùENþÉ!œˆ(‰!<„Vp8VÝÏM˜
ÈŽè¼3*Òù^!ì‘+bÏÑÑ O¯8–7ûŒzÈ"û-¯¸+¹´ÁÓkÔDsˆ`:U&„gu +¦Háˆqø±‰#8U¬{@>‰hcò»›Ù§«;¾IQ&‚ÃGbú®zÔ™è’gÊÇFÄ‘6_‡ä8•IPùÞírwª†«]°j÷|Ò«NË÷L#òG|Êô8âS&H¾Æ¥`U×¥¢„]*²Þ¥€ä]*6Þ¥€HwaIߥ [»DcùˆìWM3ùJ,‰|àW¡"çÿ·_è¦;íV-Ó ¯b¦ŽSÁYñöÁJ"”Ôú¤ì†éPxÿÅ™˜°'ý_´ÞA4y"0F ?ˆ{ˆ+à
¹º¤6¾nƒ’‡ÉA“9€è'ãȼGÙáBeص]K`ßp"8F©äkpýñ5”ÐEFol8]®«è¹VÊvå´(§U™Nëzs¦µƒÐœV áÑ ¿”1l$QÜW×RyøWïá`Ç.·@M÷õÏqi?ó}hàkjøº„$Àèî5‘ðë>Û5÷«”6Í_°Þßÿ@‚AþN8!êPX«Ñ‡N*oÚixŠ¿ßk +üœõTp¢¤‹ +À…ý7B +þ@’Ò]r +äÝ—ŠŠtµeÐÛ»»P¤Òë–X*~iâŸ8Jfüc-–¸^P¨É²3ºcs—+Xl@‡ëôJÒY +w¢[± +GF|‰”Ç=¾¡-†©lçÐV´Ž©Ä_Ò(Úø¢æ endobj -1215 0 obj << +1221 0 obj << /Type /Page -/Contents 1216 0 R -/Resources 1214 0 R +/Contents 1222 0 R +/Resources 1220 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1213 0 R +/Parent 1219 0 R >> endobj -1217 0 obj << -/D [1215 0 R /XYZ 56.6929 794.5015 null] +1223 0 obj << +/D [1221 0 R /XYZ 56.6929 794.5015 null] >> endobj -350 0 obj << -/D [1215 0 R /XYZ 56.6929 254.6581 null] +354 0 obj << +/D [1221 0 R /XYZ 56.6929 183.6365 null] >> endobj -1218 0 obj << -/D [1215 0 R /XYZ 56.6929 227.9662 null] +1224 0 obj << +/D [1221 0 R /XYZ 56.6929 158.6249 null] >> endobj -1214 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R >> +1220 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1221 0 obj << -/Length 3314 -/Filter /FlateDecode ->> -stream -xÚ¥]oã¸ñ=¿Âou€µNüѧ½Ýì6‡^îšMŠ»{Pl%V–²– -úß;Ã!%êÃ΢‡ -+ÆÊD¥L-Ö»‹tñsŸ/˜ÇY¤UŒõãÝÅŸ„YØÄj®w,I³Œ-î6¿-?üíý¯wW·—+®Ò¥N.WJ§Ë¯o>ÄÒãÃ/7Ÿ®?ÿóöý¥‘Ë»ë_n|{õéêöêæÃÕåŠeŠÁzî)œXðéúïW4ú|ûþçŸßß^þq÷ÓÅÕ]w–ø¼,xo¿ý‘.6pìŸ.ÒDØL-^à%M˜µ|±»J$J - ÕÅ—‹t£Y·tN~Jd‰Ê¸™ sT6ѦP€ŸšýK¾¿dÙrSÖp8®–뼦A^µ
î?ÕÔ¿§)<º%ņ MÀ§ÇSáfW›f——~ê>oËöŒE -d«æ¥Ûí¡ÙÓà°õ›<VÍ}^u³þš§CÙÔ_Õà%€$VŒ%V)îŽåøÕbÙ<û}¹ÙȆ–KÇÀsz<çû²8¼Ò\ó@À—üµ=pÍÿº´|Ù NbĶ8ä)ßÊõ±Ê÷ôNn ëÐðØz^6åžã¤SÔ‹NX숴^:™Àä6.æΗ“NI.\;‹®]šÄ¨T\H»mhySW¯?à}îÛ°r 0<ÑT2õ"fJ`Lâ_¿§gÝh… -‡}^·¨ -èܵ|dÀdèK…±Žäœ€eKP4ð\’1Òœ#©ÓüîèN
Ðû‚ 9(3A× -\-qÍíP7ô,|([û³ë -ïß](X|Â2TÕAôâ´ñÆ¿FòA«Í=Ú}QÔ!t¶xS›v¾nv;§YøR‘à`ô{ªÒ"yœsÞ<ƒ´Ê€›§âÕúå+9#É“ æ±.› -¿†ð=¤ï#A|hêþ©ÞŽÝ"ÉIzÒ«8‚Šã˜ò˜½÷“^Ÿûr}pgäw4d$KÉ{b׿ÒDähÂùèÓGƒâÛˆS¶‡¬¼¶‡b‡ ¨õ—iö 3™HaÅBIL’SýFöÐá¯â3a{Bw˜= -IœWââ—U;Ôámó2´‰]õÃkˆmÞP—ᔼE×x"šI¨ºä‰³tÁ,B:Ë’³`¬V>"{ã "3s~ëiº÷ „I0
7D0ÎÙòe[®·8ä.xh—!Ü1Le#ùÂÓóïÛÒ¯ó&ä³en¨:}®Àõy3 -}›â!?V>r–£øúD {o:åÇ” 9i¯¯.}ÚM‹vƒ<ÿ¥
¹4ª(ÚÊi$0©cì
aqA«W{ˆ9û:Ÿ1y~ókf÷¡RÊÁå¶z¡^‡!輚Yç… -tx¸é_ÀɲåüçË«‰h€¨à*[f“Œq×ÿ]|[0ˆoÖ -ŠÆî´½à‡ë_|làL‹øXò*&íÎ¥.ª›A©.¸4_ªã½_2¨VbÍ°|]óõ%‚zƒ)Gæf©oFgvjUkMDè…ÚCÜW¹øì³L¬©Cq!’Ík‰rIk
W²ð×'þ¼FˆHZ ´ê[èN_¡BNpJ -Ê×U;ã¹8n…d¬jÖyU‡¹~…äIf².9®7sqÀ&BSsm°j)º™àø½¿g -œÂ}3’NA°¿C`Ñëý7 -É♾ƒÚÖEñÞhÁö{&–p~ÈgûãÛ|”ç•ÿ¢´ñEi9nù†ž'(a¨K}d:á\3o•¤1ÖiÇÐaõžáø§›& -¡üÕÚŒ^§]æOÿ8®ÿå 4æ”jð(Ö¦ð8êôg»)ëÿ=¼endstream +1227 0 obj << +/Length 3161 +/Filter /FlateDecode +>> +stream +xÚ¥]sÛ6òÝ¿Bo•g*ß +ò÷ÅñÙ +ŽýÛg*ófö/œ‰,“³Í…6ŠT‚TŸ.þÕmØ›
K§äg”gÆK7!@©zÆÚΜɘU0…l8‘7ó¦Ø})v8Öó粪 +Ó[Uuý™f×õ®›¤A¾mž‹K1ð²mŠj
¢ÔBϯ×($¸Ë¬ÇŠ†9é28 +j@P8[®ñk’N±m oh("kçA&0ù˜)†ç£x“{>Þ’¼Kßè´cÎðä]¢µÑrô?á}îšvÂ/yɬWÍ£H™ƒPñc\¿£ç¶niÐ;ò8W×4E1¶se=:9³”ÔM˜&w3ÜöL¾Ã_ôÛüñ¾Áæ‹%ªO +¥’I5fHË 37`èÈótX¯°q¼²Á&®j¡ÀC;!ÀšåI™‘Ia™‚ðÍ9Ÿ¿ÛçÕ¢ióåg:ç
š‰¥ØÂ3Ú¦¿N)KQãDCïtq½SS +Œºé¡® ¶‚À*G…è%ë]K3¨þ®wŸûû×ûíŠÞŸB$EÐ}Ul"4P|Òvùò1¿/«M7[í#{)¦Ì¾ê„ŒÕmÿôxŠêIƒ¢„
âøúã=Tg€Ød ô$׃Ǻ‰{m€·r[œŒ—Æ8¸÷J¼ìcŽ—žqÕ]ã¢9Üü nZq>3çyè°&˜DNZk¹r1ˆœJ›(¥í|›o%ŠÏQE¬ A0å<ÃÅÐ|¾\6Aƒ.쾦Y/-lÔ &Ã…8ff„öCÕhw½¡* o·™Å„m¡œGWª\øGÎ ˆQ¡h?b‚4Î¥ìç7ûpj€ÞÉA™ ¸H²ŒêKšxŒ¸‰ÒÅóz£LG'ô¼;fxQz>æx8Í]8BbÊ(“˜#~COT%©yЧ˜hò.–‰þH/AÿY†Þ‰ŸÑÈq01Lðl´$ĵ@!d5ð,b$[Ƴì·Þ¸P°x&<ªê F
ZÇ8_{òA«Í#Ú}QlSälð¦V'ì|Yo6A³ð¥"ÁÁÓ°‚=Lùné¡Úpàåé€xµqùBOˆCæ¼»KÒŽ‚¿o!zO›ž ÞÖÛvWW¯ƒn–$<RP +m^VÍPƒëç¡E„2rý’"[4“Á]oÚÓµŸ†šÉjãÏDz>ÖéXÖaÆJ`é#r8Žb`"Ú»W¨wXäQLƒ½X?¢?¬ÿ¤˜??–ËGÊ"´ËŒx¦Ê'Ö‚ðŒGíc×E;Š ³tT RWàþ"(Xàþ·ÞFólCT?I¼±2¨9DËŒ”zèC¼ñ)¼À€¶ÄÑÒ´TÜî%ó,ëãû tU e"ò&¡Ý©LÄÑ}¤×ë] ¤u‘·c„’ŒkmãÆï‰6‰aÚtHoÀ1@Ƀá”(ÄÄá¼R”xK—
¢hB·LEbÈA൅@<É&$BÎféø]Šk^YXëƬc&â ™‰|”q³þ!jù\áz_á{l0zôŠDCZÚoM ,ËÂñ…Ãxmåðø£S?ü:ðRŽbì%퇘Ó)?¦Å +¯ ¸“ILYší»‘\F‡1žIaeßÈä
Èê<ø.ÄDk®yà#\<§}„—°—Î^qÃd6á"¤ç$^AÔ[zÖ`ýpš +ç°˜y\q^n c!ı/ˆ2S¨Ç#S½^-ßj»3"{e2Ô‘y†–r,wÓ‚Ô`Gm×}Mûu{ï§ÛÿÛ·–>½ã°W¦Ã‰;› +R;øJÐ .Pf¥v¹K$}Ó»0cµ +Ì(™nú8Y1¿ƒÿr~u$ØTIÈ.¤r,èKÆìø–eŠ°zãpÚƒà§ëœ½«áL³þ±Ò΋þÖá\vàbÀ³dÊuÐMæœÌ:K¾P_ĺaþ²XæËK$õSî™[F³Þ7 ¨\·´ ½Ä¾w¬tñyÈ5±®NF”Ôah^Âö:R.A~¦àHýëû>P¶Ì8äü‡¯Kߧ¯Ôu÷¡¥n!²ž‰Hpsý!äèó©Ã9Þ‰ê¨ÅDfz˦[<k‚‡a‹G1ã ?01lñ¨.9ÆaK8ìµ
Å!,)ÅcPÌŠ6Îâ÷³]\wp9øFI+Âqñó¤QÝ7µÀ‡’X[s£)9dÐü¡íÄ8Žó}E×":Z-b¯_ÇžÈ17ܵ5nÀÌ®XîwMLÖGä@ÒÎólDnß•ÏåšÈ]tìZÍklU>—Ídâ/N|]¼·¡»ÌÿM+¡†2Ù¸±6x°S2Á°›†t$òPÕ˼Úmós¬BñUëç©’gž[Õë˜Cädê(´b^ÈW*Ø>ÖKMX'n|`§D&_¡Ÿ&è¬ÔB©Ë1ˆõZ©=@0LVj{Écxé¬ÔÆ6¥Åñsœ&Ôp¢/Ô%aÅcìä?<&@§/Ö"ÖL›ðb”6vôÑò+ŒGƒOÖn”’b5lÕ‰“¶ªÄú ¿qÊ7xˤÉĈ^Š{’,Ɖd1νb¬Ò%þÕÉ5×æ,é.Çöœ‹a+ 2„XÇЙ,ñ„± +¨šúÛU~›µBò!•P絇tÚVÒAàû§dÜÇedW’¥s¤;¤cÚà +¥å€ø°Æㇻ®Æãý÷Ì‘B +Àf¿ µ +Œß½lóM¹$ªð +%ì¸ð8¨‰Í¢ÆbÞWÅö… ’ +ðAN›™Åt\¼Òmî°ôc…ïyô•Ú±£OÔÒræ¥w=>ŽôµÃ9OR%ÀVzÔÇ=fvê`Ê0üÕÖuÞÕZßýã°Ã/ç´#þÜþÕËÌ%¦ð ætƒþ˜õÿØúÎÆendstream endobj -1220 0 obj << +1226 0 obj << /Type /Page -/Contents 1221 0 R -/Resources 1219 0 R +/Contents 1227 0 R +/Resources 1225 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1213 0 R -/Annots [ 1223 0 R 1226 0 R 1227 0 R ] +/Parent 1219 0 R +/Annots [ 1229 0 R 1232 0 R 1233 0 R ] >> endobj -1223 0 obj << +1229 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [367.5469 732.0757 428.747 743.9759] +/Rect [367.5469 658.7781 428.747 670.6783] /Subtype /Link /A << /S /GoTo /D (zone_statement_grammar) >> >> endobj -1226 0 obj << +1232 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [483.4431 536.585 539.579 548.6446] +/Rect [483.4431 456.4665 539.579 468.5262] /Subtype /Link /A << /S /GoTo /D (address_match_lists) >> >> endobj -1227 0 obj << +1233 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [213.0783 116.7303 261.825 127.5147] +/Rect [213.0783 62.7905 261.825 73.5749] /Subtype /Link /A << /S /GoTo /D (dynamic_update_security) >> >> endobj -1222 0 obj << -/D [1220 0 R /XYZ 85.0394 794.5015 null] +1228 0 obj << +/D [1226 0 R /XYZ 85.0394 794.5015 null] >> endobj -354 0 obj << -/D [1220 0 R /XYZ 85.0394 717.5548 null] +358 0 obj << +/D [1226 0 R /XYZ 85.0394 642.7523 null] >> endobj -1224 0 obj << -/D [1220 0 R /XYZ 85.0394 694.8763 null] +1230 0 obj << +/D [1226 0 R /XYZ 85.0394 619.131 null] >> endobj -358 0 obj << -/D [1220 0 R /XYZ 85.0394 580.8047 null] +362 0 obj << +/D [1226 0 R /XYZ 85.0394 502.2708 null] >> endobj -1225 0 obj << -/D [1220 0 R /XYZ 85.0394 558.2856 null] +1231 0 obj << +/D [1226 0 R /XYZ 85.0394 478.809 null] >> endobj -1219 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F21 654 0 R /F63 993 0 R /F62 990 0 R /F48 880 0 R >> -/XObject << /Im2 979 0 R >> +1225 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F21 658 0 R /F63 998 0 R /F62 995 0 R >> +/XObject << /Im2 984 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1232 0 obj << -/Length 2980 +1238 0 obj << +/Length 3053 /Filter /FlateDecode >> stream -xÚ]sã6î=¿Â÷fϬ¹üÐg÷)ÝKÚtn·Û47÷ÐöA¶™X³¶äZrÒÜÍý÷–dÙ»7ífvD € -õöæ;º7Ô\¸5¨-PáÏ;»,_Ëêi67FNŸ‹ÍÁ64®ÛµÝÓ°]‘ìq£L.dª3¦É|Tue=#c|¤xôš×Ôû1ºZ$I”öÉvÄ£ª„R2á%%‹phÅfóJ/ËúPµv¿ÛÏT6W‡åéLæFfL”LæJ‰<Žµ#Ñ–Ïö
,”fÚ”ÕÒ‚ÕäázêˆØfWWM¹(7eûJ C8ìVEË«ŠåÒ6
—u5SÓ–˜Ø¬Yׇ͊ÆL¸%*/e»ì¼-šÖîy¡Ý?ÛYêöˆŽÒɾTͦx¶S™ÈÒ˜¬ècìš(ÃÓnid«b±!ãˆRbÁ^6ƒÀ/…czň -ì7i&tœy‘5^ÔŽúà:UÉÀ9/ª/—i4Àûå£÷GvÐŽßð½WÏcqØ9\ßÈ#ƒŽ4À 3Ô³Þ'²CÞ~Ù{»Xç½7`¡è‹
äëzs’X( u -{@£«²…KiÈd¬±Ø0!“žâ—˜„œ@FpØ=&] -ö›¦YßoËjYoCEÿ{7_l Øø80î>='£¶ô/laœÆ™ÖW5½kœze:H…d6-x"äA½Ó -ß(¿œ)¨\2ȉNR¡©’øSwp 8ïP<½‚Uš‹ü>ì{6MÐø EAqüWq^æP„–*ïqx.Gˆ¡4O|ZHµ{.ý.Àc±ÿe§ƒ,8í9†•° ]x -$)Üݱr -ÎpŽÖ»ž†RÜ3Qž sçNÜ1è·òx7•gܳ« -öÏ~úqR2¼é62žØŠ6¡–¨9+zY[úT<è½5e¯MN†ÑI½Ø@Î/dxQÝp6l¦* [˜øÙ¯¨ÆŠ˜¯/òT˜Èœ+Ÿn¶?üz¶n/•ZJõÍj‘}óÍ[£ß}ÕïF«xÕƒ‘œû#ª¨3K€kÁt!Îò -u€ŠžNM8Ãߕпþ ©ÞÉè(,. ¾ìæH*ÞÇ)¡ä¾8r©ýbhGµŒùÑÃ,×ÓÚ·>ÛH(”Æêwª>í=G°g{æÇ6&ø™‘.6üçCûÓ?Ä9þJ)×Äß Œ¶Ãuš‰("Ìê)Ö§ÍþÅÎ)ëÿ£Â`˜endstream +xÚ]sã6î=¿Â÷fÏÄ\‘ú Õ}J·I››ëv›ÍÍ=´}m%ÖÔ–\KN껹ÿ~ +>™§±F¡DR¤q¬,ÿ®JûIÌŸÄjºÈé‡|,3°E(€ºfœmV7ù
,2”zúèvVùSvØ4ôRÔÈ»»Èt¦T"©XNþ3›'A0-¡÷´ü/}ÔÓ2˜ø“ûæšÈ;"CyVÖÌì:ããKf›4D» Š6'Ý( +#Uì”CÎêÄGÛ™«HO_‹ÍW†”]¾JÛ|…òéôq–ªiE8y™-6Œç†uG±@ùšk4”§ã˜žR)d¬Ë|Á¸AÂ
û—̪ÍÊ£Óìû7U‹ÂÎgbËj ƒéK¶9 Áàº3ØÓt]Ž°.Ã\™?vÅÃ¥®i„®Ié>ÙŽxcTA12Hø“‚E8ÔÐç‘^–Õ¡kÞÙ«©V‡%G(A3!Æ«®R›â%¿ÆK'+Ê%Þmê<l€ºÞUe],ŠMÑ íÎ"x‹ +hc·>VÈn¶Jž:'ã +D'iŸ²}8[uõ½Ê›¬ØÑõŠ.iD¨ Š\¬ºXçëÕ†Ò—d^K°ÝšÒT¯DˆÀ„¥/óà±F˜è•Q"Œ‰úL<®1)O«ß¬_3LÀ<¬ñÁ&éäó°¨·Ue÷G*™>Ñ÷[Ú½ÿ¯bHBϬ\
>°Ñ/‰…2QÔ÷¦Ÿ•ŠÊbAé
>Ùd‹|S#”Þ‰¶ž.Š2Û»8˜'M:ý*œ62)ÓQÀ\°, ó–8ÞÆÒú5÷…ǯó’ðW9…ó| iu=º +ÔÕ’ [œžH)#Õ
Øô6/[ŽJ‚+a¹Ìj[À‚i7©@QûbeˆóÜh#TlœÆÈÇj'jG}`Ðk%ýzä²úÒ@GCœ_>9dí(ñšÓôÚ' ß«´Žì“8òÈ Ö€´°†zÞ{Bî¼ì½¬Þë°PôŪŒuµ9)/d EIçòÑkäìžã‰ +Ù9„¯,7Eý [ÉDÄ3°h°î±OzÊ 9Ò+tö;{ªol_‚!ÅdûÊé°±«övKîÙSåÚé
׬Fûqýê Þð¥s+¶:xÁÍQ?”ÂÆ¡¦ük‹_tÃéí:/çU9"ùÜãö̈BÞh6=±ùÒQ(ãb]“ýJ=¸=ГÎÈ6ÔÉ¢F±á‹%i™1-Ù0í5èøôÍ6Z.¶5Ã6êÕØHCe}Bc½·æ„J¤Æ˜ñ)áÜSœwIÒµË_¨ 6ihÛ=¥Ê’ÒÉXaËþ…L:Šo1 5AÁ÷˜´ðmœƒ•à%ùè:cÇ_tIWŒI‡ò¦RB%íèŠl®çl.‹¹ø²8àI§K¶K<|S3z •
‹ß³É¶EŽÃaLt¡¢õjtôð=ľb·uÏ@À*ýRÂh_nùzÁ)¨Û‘²¶Xì;׶æ¿g[àâzÄ‘æ&1º2óìعª ‚Z˜Þ,nØ”¾$íá +Š»¨Gíobs("&oïdriÎ ûA4‡2Â9é ÞõóJí¦I +´žÑÀ|ƒE¡ŸoHIó
€€ñ7Åò°ÉöôNzEŒáä6—¶qƒMû«`„ô3}¨´-Tp‡‡qô½lHÉ“Ù™œ0wöÆ-ƒî(‡×qÓàŒ{vUÁþÙ/BN‡ëî8ã™hã;ŠŠk£×uN?&puÑ–“at +06³-ÞàÆôÿÙ=œ
›Zzäv‰?fåX+óåíCªE…¦oj=~º5ÿð—ü³ÝƒÿðR¡‚@~µZ˜¯¾zª÷ã'ŒýÑPüKŸ‘™"üÏÜüé?(jÿÚ*Âq”93œTÚˆÈ +µ«ÓQ,äé0Q#¬ÿ?-endstream endobj -1231 0 obj << +1237 0 obj << /Type /Page -/Contents 1232 0 R -/Resources 1230 0 R +/Contents 1238 0 R +/Resources 1236 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1213 0 R -/Annots [ 1234 0 R ] +/Parent 1219 0 R +/Annots [ 1240 0 R ] >> endobj -1234 0 obj << +1240 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [369.8158 701.0858 418.5625 713.1454] +/Rect [369.8158 645.68 418.5625 657.7397] /Subtype /Link /A << /S /GoTo /D (dynamic_update_security) >> >> endobj -1233 0 obj << -/D [1231 0 R /XYZ 56.6929 794.5015 null] +1239 0 obj << +/D [1237 0 R /XYZ 56.6929 794.5015 null] >> endobj -362 0 obj << -/D [1231 0 R /XYZ 56.6929 532.4192 null] +366 0 obj << +/D [1237 0 R /XYZ 56.6929 475.2364 null] >> endobj -1235 0 obj << -/D [1231 0 R /XYZ 56.6929 508.7234 null] +1241 0 obj << +/D [1237 0 R /XYZ 56.6929 451.0522 null] >> endobj -1230 0 obj << -/Font << /F37 743 0 R /F48 880 0 R /F23 678 0 R /F21 654 0 R /F39 858 0 R >> +1236 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F48 885 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1238 0 obj << -/Length 2534 -/Filter /FlateDecode ->> -stream -xÚÍYÝsÛ6÷_¡·Ê7%‚O‚¸<¹±s§uRGN¯í#Ñ6'©ˆ”=îÍýïÝÅ)QN:ÉÍÜxÆ°XìþöbÂáOL2ørzbf†3™¯NøäÆ^Ÿˆ@“D¢¤OõÝìäÅ¥²Ç\*ÓÉ춷VÆx–‰ÉlñÛôÕ¿ÎÞÎ.nNiø4e§‰Iùô»«ësêqôóêÍõåÕëŸoÎNžÎ®Þ\S÷ÍÅåÅÍÅõ«‹ÓDdFÀ|V82áòê‡j½¾9ûñdz›Ó?fߟ\̺³ôÏ+¸Âƒ|<ùí>YÀ±¿?áL¹ÌLáƒ3᜜¬N´QÌh¥bÏòäÝÉOÝ‚½Q?uL~FeÌdÒŽ Ð Ð8–*©¼ -äùQ5S–éLDû+›‘•³Ú˜@ñ1Ö×&rö;7<SÚ”ÍhÐóTMQ¶øëí4ÕÓzU¶-Ù(‰AéóÜËsAdWoidpÕØ»Œ O)M<ÎÕõÙùùî -$š$Úp&%ˆ{`%Á^•ž¾GUTÊk¾÷Xb\?¬/Äãµz‹eBhiŸÓÁ™Ö -°¹SeŒ·èÜ€%×+"ÜVëMùP.‹;oÉ0¬Æâ©U8µîŸzv?fwìÈq1)¨ËEò “íb€Uæ˜ÒÚ
7³ÀhÁ…ˆËˆ,H5Ü2õ[[ÖLõ>³Óy^QŒ¿pØB`Çß5Yʃ.™¥«ÍCÑâWS,‹y[VwaíbÓæeXß3’Ô²“$œš -pß}V ã<"Ž!ÜH¦XªÕ3kÑ<k…fœ±‚]¨pÀ,·;THH³€ÝºÄ)º¹î™€pÀb”ŒPþn -£È)éæ©äÓL
8J-“ - -®±g _f[hÅÆAæ“ìr½/¶|p]*¥ýkYÈn¬LÿÆIãŒc(¢ - -ü@£±¢¦ž£ÅÀE¬ô˜…ôoùËçÿßDKSÈ´þÆIÃŒc&"!Ç˸M?a"ŠƒŒUöU=-¤é÷êÿ§í¯üŒ‰@Úȸq¤r09_6õˆÅlK©˜£´^4·ò…w Ï{RÈÔ.¿éü¡“†Œ!‹YX[yû)÷ºÂUL¾Ž›Gÿ†¿Li¾¾yõPs'Æ“ÞH†¹9伃Š˜
±×U¨ÒÍN…SCÅæ3êbTÏÅbË}Š/«b~ŸWe³ -ß`ùªÐ2÷ †5$,‚¥åóòT -ÈWõ¶ -„õm˜PçÚ¥½ÏÛ1ðìí‰Ò,÷k’»zæSÓ+€@“g±÷¶^.ëGÊépV—<bjAV¨;úÀ -~ÿìßí| K -lÏÈñ:} IzDÇU!y‹“MÈfö7ÆØW:ýüÎÑáÖÃ8Ú1Èý‡{ŸˆWÞOÊÌW¤Þ-ë÷ù’º°*L-‡0Š%)O¼+IÅù‘$G¡'G©Ûß9Ííj†2`–'µFè»~3»ºü•Ú+Ø!¿+šƒÔH·—?ÞUÊ“œŠ"äúEsO½ózýD-ÒFU•w*ÏCýRxE¥¢L–ûñ‘@Iy~‘ õVÙ5
ÕôQÄùƒý¾ ;]¿3b}^S-Ð×!Ö!|ùÐñé}±\‡¦×dø-ªfÅ*ÒÆ89eŽÎîgÝ2ä%Œ…G‡5ïrþÁ›ŠŸ^=P‘÷®‹T4Ž˜/1]ÂήîY¥’Û~•7¯ÆªC -GWAšÃþ$`©T½×,‡ÊPVÓ»òÁ¿a`WøÍÇjXeè|š¿þ‘Ê–ÔO£j!W ¾dK¸cl„õñM¹(諾 ¥Ï´;(m!£Ïž<˘͸Ûç†ÅšBü‘C-úåÞéQ! +1244 0 obj << +/Length 2446 +/Filter /FlateDecode +>> +stream +xÚÍ]sÛFîÝ¿Bo¥nÂÍ~“›<¹±sçꤎúÐkû@Kk‹c‰TEɾôæþû‹%EI´“Žs37š—X,ÀX +O,¸¸üÇ9Þ_Ÿþøãéõø÷É'ç“N–¾¼‚+ä“_磈ýà gÊåfô/œ çähy¢bF+ÕB'ŸN~êöfÃÒ!ý•3“Ël@R
)Ð8fL¡ËÅbœ*n_7cl枀U±Œ Ưüš uE°U½ÞÄ(‚ÜÖ¥¨>Óàòュ¹b6[Ežø¦ñ
MþÆ
,7óˆ@À¦¬îZF€½Ù´Ëfq¶žÞû
,¯ +\ÅZè\Þ¶lG\ÑÕ’å`ðüxÇcºÆ²LX‘ëÕ¦l…ÆãZZùi‰Gìg¯žQ yÔUɤ÷fVp +ÐŒk—N1h ËÐŽ9èì§_G§@H
ëP¦7U+Žê‰£ (ÎjßTßmh⾪p‹ªy$\ +°¹3eLð +Q -øå~ìšùÛb»ØĘü׿ùrz±w„d¢¦Fn?#‚5`?ÊìÌkÔnÞ›híw$C?=^Çže¦¿æm +<Aiwpíäcþ´bÚʸ“>bOŽzûìen`UàÏö½}ªrÑ$™–_Uº@Èq!"E.8‘\1«á˜ž¤Eë8ЊÃvÅAìJDå t)ª¬Ú +§Sm0íL@i¨‚{CåAÖ«ž«EŒ,FÉ6–€# +æ!õÆAÖàõåRŽÎjhÔª%œö)¡àè{.áÄÑpŸ:!H(ôp ÝÙ
¼¨~ŠJ³èrøÜ´Ëö#€DÒ‚Þ{I¦‘ çXò¤Í¦ö8²ƒRJ¤Êa»ÈE„ÜŽ_nj¬~pôóÙGÂŒQ
R.X¥î¾«LÞá-ë–7Hƒ {‚Ç+Š?7Èä6£XŽ!ò*lù(Á‹Õj’.œ««Åçˆ^$ð‚€Ã=0‚|`˜¢¼xDÄ…ü7ˆåÏa†yH–'Á0gW¾ãD4»{ÁìÐ!ï€cì»Â˼ýØ8¨}Ò]—áž!6Wö›Ð‚˜d3iÿ‚¤íŠ§âˆ„‹ØeÆ~!Ž(Xdß4Ž(Hèd®þq¤Où™8¢¤`R;XþT/Šh€˜5å<[`‚†TôÀÀGp£5A°,¤Q¨rqÐlW=Ç¿¡@e.ÖV·rØ¡^øÒÅ +|A¯èv4õ]þÿ°aÜô)éŸòËçÿßE³j¿ i\ñ”‹€I1¶ò¼ŒeVÉoé"XjYéÄ·w‘>åg\D +…GC–OÞSP.M=p‹jª¶JÙ@ÑÜb”÷á}þ*…ŠAí*œ.Åß¿¥¡fÈÛ: ¼¼ýÒý¶ÂU[~=íý~™Ñ|{÷èÛ!Rv¸ìmÑöïxÌncO,‹=±ÖUìÓMÆBˆ$œ_EgŒ¾$`»e^ÄöËÒOçEU6ËøŽVè-ŠÔ°‹„m0Q1-Ç‚æ&ôyôg`% u\ì÷— fÒ`QBùgëj¯?èËz[EDìf‡u1£]Bëz xööDmD–û]É]Gós³ñKÌ€À’'-ô¶^,êGªêpUW>bqYVì<nb«ùÏNñÝÎGÖ˜sÆ
ÄÕR 5ü…(â¤=¤§M¡E +.›’ÏnŒÉ¯túù;¤ã÷i˜ÍÌþÞgá{@îI™‡þƒÌ’»E}S,„}a…3„YlJäƒo%=”ØHl˜>W„µ]×PƘb·`W&—¿Ðx ;w¾‰I8„éôAÿgî+”œÚ"Vû¾™tZ¯>Óˆ¬Q´¦Ê;“籃)‚¡R[&Ï£ÿ„L ¤BßÈ…zTv²ÚØOŸF»~o¿ïâNWŸ†Rqb}ZS70t"v"BÑñdî«8–O_5ÛVp}DmãHNå€#ÙêyDC^â\ü,à°ë]N„åÕµyï|$RÑZ±X`½„À®X¥¦ÛPù®Ã¯…¦Ì»ËûÅ%w±Ygp5årØ)ܵ¹tY˪ި£Žiûõò˜õÿÔ–F{endstream endobj -1237 0 obj << +1243 0 obj << /Type /Page -/Contents 1238 0 R -/Resources 1236 0 R +/Contents 1244 0 R +/Resources 1242 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1213 0 R +/Parent 1219 0 R >> endobj -1239 0 obj << -/D [1237 0 R /XYZ 85.0394 794.5015 null] +1245 0 obj << +/D [1243 0 R /XYZ 85.0394 794.5015 null] >> endobj -366 0 obj << -/D [1237 0 R /XYZ 85.0394 708.1399 null] +370 0 obj << +/D [1243 0 R /XYZ 85.0394 650.4851 null] >> endobj -1240 0 obj << -/D [1237 0 R /XYZ 85.0394 681.7727 null] +1246 0 obj << +/D [1243 0 R /XYZ 85.0394 625.2941 null] >> endobj -370 0 obj << -/D [1237 0 R /XYZ 85.0394 221.7119 null] +374 0 obj << +/D [1243 0 R /XYZ 85.0394 171.1138 null] >> endobj -1001 0 obj << -/D [1237 0 R /XYZ 85.0394 198.8068 null] +1006 0 obj << +/D [1243 0 R /XYZ 85.0394 149.3849 null] >> endobj -1236 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F23 678 0 R /F21 654 0 R /F62 990 0 R /F63 993 0 R >> -/XObject << /Im2 979 0 R >> +1242 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F21 658 0 R /F62 995 0 R /F63 998 0 R >> +/XObject << /Im2 984 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1243 0 obj << -/Length 3560 -/Filter /FlateDecode ->> -stream -xÚÝZÝoã6Ï_‘·:ÀšÇOI|Ün³½×íÞ6Å×öA¶•DX[r-9ÙÜ_3œ¡,ɲ“½;à€Â¢È9þæ“V—~êÒ%"ñÚ_¦Þ -'•»\n.äå=Œ}¡˜f‰æ}ªoo/þòÞ¤—^øD'—·w½¹2!³L]Þ®~%B‹+˜AÎÞýôáýÍ÷¿|z{•ÚÙíÍO®æÚÉÙû›¿]SëûOoüñí§«¹Êœš½ûë۷ןh(á9¾½ùðõxzœ˜ôÓõûëO×Þ]_ý~ûÃÅõm·—þ~•4¸‘?.~ý]^®`Û?\Ha|æ.ŸàE -å½¾Ü\Xg„³ÆÄžõÅÏï&ì†O§äg]&œ¶ÉåÜX‘ÁúÓRV"U -ˆRçEb´é¤¬Õ””#Jy“™·»¼jîŠÝ•Êfó¶Üó²o_9)\vÙ_ሦ™`ÃôØPÎ —(3äã¦ZÔûju57™ý«® -jEÖ|5³ÝU6ÛWUYÝÓðº®îo"}È«Ø*jmò꙾ܔվ-¸û©\¯©µˆë»M9ÇMûxU)ìG ïœüUy[¬ -[‹¸TP«ôPêÏeÀ?zR=ª3ŠT§Õ$¤Œ0Ö¿ÀJG5ÁËÐ\eÂ9bæ -"9qE‘ÙÃÞ¥ -Û¥îm¤kŠe]‚lA -M.©[ Ïûò±¨hX¬L¤Ž¥‰ãž«šÖ&ë–ÈÙ „ex½¸k‡]OémŸ#ÒzÀ‘m†ûªæPâ`kŽOVep´Þ™¯8Z%¡Ù?Z6?7ø™œìh~;6w6š;wdî,š;°uáµõY¥#Ímc0qØ.¼L!¼°mÀî&F1Á·áAãë¾!Bó„4ÒL8É×ÙÀÔ¦ÙH '̉µ m+_(þô©N›“Ž*H§ -ÍýŸácˆç‘ôᾨ–Ü?dÓM<Š`˜2¸… Š–:ïðŽe$@6k¡®È:U¶[T+4Öu¾ªkohr(Lž! ÚœTe¤Ҟ×>Õiå騆‚Ÿ*XäSyôÙå;ª‰õ‡8ñ"M]:d hU½<_¢Y-áa_Ý•¶ñT[=BrR!*„SöUIO¨iN&Tš¨¡3¤ô"œa´çᦀ4i›z_–¡”Îÿn|þ\܃&—R{Æžæ¼Ã úlm|XÎ>Ö`ã$Ø]Lõ*>…BHµ¼T/\¡ô©Î 0R
Q}Xu\’Ò™°Ö¨ó\tTlÓG#,ùàfÿ -)y0çøÂ%j5¸f ¯1±kÁ”GØ|¿c£ÄšéqXrGQòçÉýÃkBؤi7u(rÀ;ÆLÔbg:”Ã=oÙ÷Aå ò'@¥-è|¢¢ùÖS6[ø4Mz^ÁÈWy–?ò -CXŒ£&N.ËQn5xVfü;ɸ¢|†âJ°QzÂg(ªã`ΫƒÏÐ)û¬+·DGÞ{ÈO)=ò½%{$ª«7ýCÄ:ÄÀJïe8*ݽVˆàb]/0vÑü¯3=±¿ægNÃãÐ3|J¡ghò_g8ôÄ®¡§…„Æ$f€ †-Ö•}¤Ü>ìH¸ÈÛ6½ä¹ü[7ÄÂÿ,ÈUI*\’¼PaëS¶‘ÕQùøòøP[È9Ò˜è¨^àBixc0ÐÒ,F]1'\ûÉ®šcQ³|µ:Ü<2¾]d›‰O6¹@MW‡`Q>>ZjݾûH
ÐâªXb9Š¯ñ¢B0FÚßU§bÑé®h©Ê”‘†óè°$Õ§Îü;ωU¯º50²Æ@4Ì…ª9fC™¾íWZà7ËôôfêÚ*ï.áZ_ÅÂ;ÏÎ~ùî#õ`.þfX¤•µ}C^õ:{åïä°&|ëq¾Õ3X¬rIãûí -43v£aSwD‚··
MA…®ðé.³oè-˜Æ;S¿%ç¸^F /:3hFèa“à}³gai2xanq©5ß¡y¹R¡Ìm¼fÜÝåKþæ7ír]7ó©s‚ ¥ -4–h³sæÛm‘ï¨7üuC›8÷È£À +1249 0 obj << +/Length 3623 +/Filter /FlateDecode +>> +stream +xÚÝ[Ýsã6Ï_á·sfÖ<~ˆù¸Ýf{é\w÷¶étîÚ>(¶œhjK®eošûë @}YvÒ¹›¹™NL‘ ?€ +ã=ÁƒÊ{=Û^%Ö›{6Wß_ý£°7^”Ÿ’B›TOP›ž +=D»)›È(Õó²Á_5(¿wño>±d¦D–¤)Oóïº*&ÖÒ UŸZ&jù¡ØÕá
NkçåV|*7Z¨þRì÷åª §Ãc1¹WpJ<OZïe]5ÌèÅ;'2'ý˜¤³…q0¯u ¥„·Vªƒ0¼™‚É„²Æ÷…hÏßÌÒd̽4 +¥¼ºÈGKtÊÈ +U%C€Á$oeE…è +q +Ó\b‘h|oÊf4g€ÍÎË==–`ÛKž%TÉ ¹zhBi”c{j2±‰vå¹ÜZ§ÂúXF˜Dý®àùt›ßS*Ž»VjŽD‰5„C'%h‚G‚͇VIçdÄQDf»½Ks@0»–uµ”»ÞÑÎ`ÛÒg¢rÒAHpΩ$༷Ée§Ò§:ïTZª‘xqoc¢œH_Xi&xmDš€G¬~‹êÑ>‚S»¹Cõs©…´,\žá}´hš$É +G g‡–}äõâ®qv=e·}ŽÈêY +ŒfI:dã_!XPÞö^|\â€{']a‹•^zª©±‚èvÂjIicÍ›©³ËdÂù$ž^ÀÇx‚ & +’ (Ù¶õr°˜)»NzÍ4só|“Faá¨i‚+Êì`t[LÃ΃¿l:£Ë1î”°©;ñ±Öñ±–… „zâÛëBB ‹ÁR ¨éwU„Ä´br2Î@ÍüÐBüº\5bª@®P)®§tu;”ÍY}AP¬ñz†¦¡Ñ„m¡¦¾þð=õp-˜zC€€½ì!9ÁƲè÷.ÉI®è•(z[MíIƒýÿÉ+‘áE¢ÚÚ÷._þʼç
²9ª}§ÙdTJ:å]«lÄ{C9ÿîê¦)ï7L +XÍãôÃ2“8ÔÂ9õZÔ;!U{ýQòêÛº‹N³yì8”ÇK¾úÑf~’dŽ_ª«·@«9îvõR>R ²jt¦?S‚I+mòÇ›c ÿDƒœ„&e=x¢Î;°?(AÆ0{| irsâw&¦ú£ì%ÂKuõ”³60Ñ$cÚÔ÷à+×1ëŸFü”QL‰ßx!]Ö.%ßåIºÃ–éI5 üð—aÔ†Ôß•K*B4õš»~¼¶0´ªŸšªÊ@$Ï^Èh»àš˜˜Ø=¨3K}òòîÕK»Ï„ÌdÖw¹ãsRØÌÿaŸšx¥Zîø(Þ?ñýäªà[žxÛ“ÓÏŽ§ï*¼š71˸~e¢ÁßÛÝTÒt"B¥§×«gƒÈš…Éä¹LŸê|ðÑRõ…ÛLÝH8ÛÌWo©&–^m&xwn‡ë +~ªl
˜Ï<dÓ—o©&ÖâÄ‹,ƒp}À@° Dõ²q|ˆ”h”†}u[àÆ'2!lõLÉÉ„p ˜6oBHzÆ„ø«¡²ttúS’t½zx¢) YkMßçÿ¾õ ÿõXÿ\âƒ&T{.Ÿæ\c(}±B>,jŸZ°±Òì6²z• ŸA¡òpJe©½ŒÂ>Õy¶TCÆ“¬:-Li'’ĨË\´Tl˜ÑÇ< d>C>¸ŒÙ¿6€‡®2È¥!%;wŽ\¨VƒË–ðH_‚HÆ"vÝ3å öïïÙi±:=ÍÖ+!ž‚ + -r*a1Ž8äœÄN¸Õp:°1ãç$ãºN83׃Òg†¢Z0¶A½êÎñ™ÕåÑÑé€=tN)=:zK*>¨®FÜô•ˆ¤ÄÀJO‰§2ð^+D8bm/<»hþªÅPì¯ù7§áq +,óv£aSk"‰__ʱ1R¹†ë|ºÍïz + +ÓÁùàÅÎÔåèpÜl#Ð3hFèa“àcsdairxaGnq©5ß¡{¹V¡Ø¤M¸lܯó%¿ó³ÖÉrS7‹áîxER<üÊé°ÍËaçÀëÃ@îÆ;ÖàNµ²„DÛcœ3ßíŠ|O½ámâÜ£`î¿LÖJT*¬J}ûí¦~ê>t™(Çe"‘z\ÆSg¾|7VàçêJ¶ñèýU|÷/I& F8óñƒÎ jtxAALá6lrêâùóùSÖÿ!Å^ßendstream endobj -1242 0 obj << +1248 0 obj << /Type /Page -/Contents 1243 0 R -/Resources 1241 0 R +/Contents 1249 0 R +/Resources 1247 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1213 0 R +/Parent 1219 0 R >> endobj -1244 0 obj << -/D [1242 0 R /XYZ 56.6929 794.5015 null] +1250 0 obj << +/D [1248 0 R /XYZ 56.6929 794.5015 null] >> endobj -1241 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R >> +1247 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1247 0 obj << -/Length 2459 +1253 0 obj << +/Length 2665 /Filter /FlateDecode >> stream -xÚåZKoÛH¾ûWð¶0ìéw7™ÄÉz0ãd=Êa13Z¢l"©ˆ”µÞ_¿Uý H‰’3HìbÀ,v«««ëñU+,¡ð%V*2™˜LE™Jæë+š<ÀÜ»+xÒÈ”ö¹~š]ýøV˜$#™æ:™-{²,¡Ö²d¶ø}òúï¯>Ì®ï¦)Wt¢É4UšN~º¹}ãG2ÿxýþöíÍ»w¯¦FNf7ïoýðÝõÛë»ëÛ××Ó”YÅà{$œùàíÍ/מzw÷ê×__ÝMÿœý|u=ëöÒß/£7òùê÷?i²€mÿ|E‰È¬JöðB Ë2ž¬¯¤DI!âÈêê·«t{³îÓ1ûIn‰Ú$©€hù%« -ëŒhÇW¥pšh†?+ËGAV ãCQ)£p„R'©¶Œ(-³ît¹H#™R—1E4—&1ŒH
wç{‹v¬~Ì'%Jp â‘ãý4Õl2ƒ¿|r}|(TpeC)±F0\<ùœ0Be– ÏÕ£ÝnVp?Þ¬yò¦†=%ýmEÉi_´Û—æ=¯e -¶h)hÀ8±ÂfNéßêU¾¯S“²™Â±eNažÌ«…'ŠÀ³*‹YÔEà¯êÖÍn³©aZÒI)Ú¶¬üKûX„Ñz·:_,¶E$-§‚N@˜¾;Psöú¸»±ðñ|Êéäþ)Úf -J‘c[ËÌ Š¤Ð_ç;‚Èâ(=¸ÿ×yvÊ3‚“)ÄUÙx>¢0,bQ#ËFÒQÇ…k·yÕ,á´˜¤Þâé“>ñJ‰Ñ ¿Â‰×ˆ"¢ïa†#Å‘&3<wÌTM¾TÞ„`êoCiÂxÆB0èßÀø6`CˆTÿÍ^zñ¯y±i=ýïº -kFMPÁIs›b»¬·ëbá_wsZ$o><éÿòÇFc¡†^:;´YëÂáE.ÜH¾jÓ3žlü㢑iDáÙaR€ä3PäU‘i*Tl«¼Å¨5úp8n•C-]LÃ{¹ôOðÀîÎ -0*Ê-ƒ›A<qŸX‡*nå·©’V-Å_Étñ‹sURâ’’ª—ª¤R–H%¿i‘TLñJäAð…©„ -bÓŠËå(2]¨Fcpð–ÎtÒ[â´žS=åÈ"3b V#nh¿áë¡á[¿qÃ\5r\Ý# b5Bz¼QKøåùjlp¤¼•D2ɇÉ)>^‘ AjzÉG„„Ll9 ¨AD\ÀÇj@Ò£.W¾T‘"V‘z¼ŒñË€¦ÏuÁƒ"×iö¹jðä5žü%e:®m~”·I«‡ê|lÐlL6¸Ž\Êf=—jüt& ¥ÌcÊ• œy*‹}DvÆ›M1/19‡³Ø
•AØ¢Xæ»U¾‚Ôuê!)ÄŒ¡@<¡ªGêcÑ—jØßjS€¹e -dÑx°\ÓB¦ZU^ñ"ÄQh¦‘`– +xÚÝ]oÛ8ò=¿Âo§ +{vO@" +Uï~³ÎÛ²«8³(Ò}Sí¬©TI0¼gت̼ëÉÆm•šÔX¡Ó¢}hv˜=RÓÈÝ$˜Zclߤ»·Bj²²ã8h>¼$Êèª'Em'ëOµQÔΧ†'7ð¿H.DD¥ÐÙÄÀ;3«>ù2MRÎIÂêÁþ¶;)ø‰Ÿ.—bò¶†;Mú׊”§}Òþ^`‡=½ÐpŌ૘bÖ3ý{½ÈÁ¤À:¼ñ—ˆT§œÀ¼šPœEY¬if^¿ª[šÍj…æ©@{ÂLѶd}0ðågɬè„ù|]4ÒݹdA§ñáûæsóæ#hžÍ`óì\°ä3þ‡¾˜:PCå,8c#'ý‡þ1Ý‘t}¦» ñcš=.ÅEp¡©qí0Œ³”ù—e2UÚî^v`ñ1BvXG<ÙôѨ¥1 ! Ö?á€k„‘A4Çh•Üãä&º’&_(oF—6)Ž—'6„¦J{^õâ_³bÕLñÁ{´@° ,Pð¥DˆkËbNÃMC¡ÀËæ@ÁèYøD[È$Œs'Þs‰ÖñÇë°ð"ù¢Àðõàú 'ùˆH#|ß"·ï3`ä5Æck‘¡b]AœÃ¡Ù=Ž_DæKoÔ0ÆD¿dñ€N1feÓ¢=V5¢‚ƒ›}o862n¹ËËE˜÷5g!r*:íMSLQÚ!vC²—9©‡ÎçÙi’´]Ü-ƒš<&µ„-˜{‰0™ÉÔ@ÌýWw“J/Ì2ñ0©áÍ8ãöEäutÆÚÿ@˜ì“>&Dg]ëUš±ä ãN½¡Á¼Æ/&¶eó@©> +‡OÕ ø¶á~î6Ù¡ý× +H#¬S†)™•C^00 Ëú ‡»À„£~`–S…mcq +ÅŒ€÷yù"¶OúD+0p\üÿ÷zûý?ÝëåÒ–©ÓÙL‡uà¶ÆÊ1°QÁÀoõi&4k„…Aªg@§2ž
yøµü\Œ6ôRÛÅoºW|ØÍõaÅwlW+ÐÉ]¦ê¿!xz8&±¸©Ú!.ör©]ÆùȈ§æ†§Bc'PŠTe d Íæ&…<–3™mÆ>}Bà#¤Oý +eÕ\°ƒ2‚þc]Χjº™¯¦˜n¥!;ƒ]”¯9¤†GÙ²æd»ø……ˆžã>ä:*„i¢¾£š +(è"”¡)º8 +aöTPÕÇý}›@€Tâ‘ôÖª|Ù¹ókõ’fu~"è±ZîÞ»Ÿ#Bù8÷µò¬Ij´’Óg7¤HTŠÜô… Ÿ¢ŸñÍ-ƒ-¤g)ýäíkÑyls…Û`"©7À†›Íìa°qȸeˆóîr (š·E¨ endobj -1246 0 obj << +1252 0 obj << /Type /Page -/Contents 1247 0 R -/Resources 1245 0 R +/Contents 1253 0 R +/Resources 1251 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1250 0 R +/Parent 1256 0 R >> endobj -1248 0 obj << -/D [1246 0 R /XYZ 85.0394 794.5015 null] +1254 0 obj << +/D [1252 0 R /XYZ 85.0394 794.5015 null] >> endobj -374 0 obj << -/D [1246 0 R /XYZ 85.0394 151.4942 null] +378 0 obj << +/D [1252 0 R /XYZ 85.0394 141.2512 null] >> endobj -1249 0 obj << -/D [1246 0 R /XYZ 85.0394 123.0886 null] +1255 0 obj << +/D [1252 0 R /XYZ 85.0394 118.94 null] >> endobj -1245 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F62 990 0 R /F21 654 0 R /F63 993 0 R >> -/XObject << /Im2 979 0 R >> +1251 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F62 995 0 R /F63 998 0 R >> +/XObject << /Im2 984 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1253 0 obj << +1259 0 obj << /Length 3339 /Filter /FlateDecode >> @@ -4890,49 +4949,49 @@ G˜óÖ5óoso&¨Ïõ±únÑÞ'¦ùR€9[Ù =iyÍ¡%ÈÅ&o<ÐÖaLÂMhëœ qaþк|9út¼ "EÞže"?†xª²€ QÁk¬Á]áñBû%ÃG‡×øB©$Rd@¹/© .+±Ãßó÷Ô4]üsÅÄžT*ÎW#Ò)™ª$ÊŸ·P§±É_C‚|姲¢uÍ©D†“â¥ÎCV™qCi‚µƒë’àõƒÅ=ëí˜XKuÙÙLç}=0ùmZíÎ:9Ä÷4lö’äŽéTôøÈìbëR3’½eÖAiÞö4Õ„í±‡CKgÆ@/ÞýÂuU]4Ϻ`_ÒMG%ݾZL‡¾Š”)Þ©ŒÍù‚¶•x<6½Oý¾"38M¾…P±Ðâ•p=亰ëkºB8Úy X§!q¾(¿ãšP`4W™Å©tv¬óµ¦ß}Í;¼×#C¨JC¿÷Eí¨ŠgéáЯO~ñƒM~¦ˆ/©òÛ<æ endobj -1252 0 obj << +1258 0 obj << /Type /Page -/Contents 1253 0 R -/Resources 1251 0 R +/Contents 1259 0 R +/Resources 1257 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1250 0 R -/Annots [ 1256 0 R 1258 0 R ] +/Parent 1256 0 R +/Annots [ 1262 0 R 1264 0 R ] >> endobj -1256 0 obj << +1262 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [361.118 694.3759 409.8647 706.4356] /Subtype /Link /A << /S /GoTo /D (configuration_file_elements) >> >> endobj -1258 0 obj << +1264 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [347.1258 314.3269 404.2417 326.3865] /Subtype /Link /A << /S /GoTo /D (journal) >> >> endobj -1254 0 obj << -/D [1252 0 R /XYZ 56.6929 794.5015 null] +1260 0 obj << +/D [1258 0 R /XYZ 56.6929 794.5015 null] >> endobj -378 0 obj << -/D [1252 0 R /XYZ 56.6929 769.5949 null] +382 0 obj << +/D [1258 0 R /XYZ 56.6929 769.5949 null] >> endobj -1255 0 obj << -/D [1252 0 R /XYZ 56.6929 749.7681 null] +1261 0 obj << +/D [1258 0 R /XYZ 56.6929 749.7681 null] >> endobj -382 0 obj << -/D [1252 0 R /XYZ 56.6929 443.842 null] +386 0 obj << +/D [1258 0 R /XYZ 56.6929 443.842 null] >> endobj -1257 0 obj << -/D [1252 0 R /XYZ 56.6929 420.887 null] +1263 0 obj << +/D [1258 0 R /XYZ 56.6929 420.887 null] >> endobj -1251 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R >> +1257 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1261 0 obj << -/Length 2859 +1267 0 obj << +/Length 2860 /Filter /FlateDecode >> stream @@ -4941,39 +5000,41 @@ xÚ]sÛ¸ñÝ¿B}£g"ß'O¾œ“ú¦—¤®Û—ë=ÐeqB‘ŠHÛñÝô¿wP D)餓ñp±X,vý„Âgþñ™Õ)“¹še¹J5 ^,¯wV½´ÄÜžÀy-|ë¶XbÑ7WÂ&W+WŽ8¡\ ´d,ÂÓÁÍÙîˇÊïäû¢)uYQB â\¨·w•‹dR%(+"©† )Ÿk.«nÑâƾ*BÜ`Oñj¶Tþ<UK¢R(¹ç±”8¨ëö9pº÷¾9LÖ¦BÙPÊxÛf2WÚ‘âW‚Öâk׃ÃS×·[‚h§¡–pw©ÙHoŠw…¯PÖÅ“|5q‡gþXŸŒv ¡åÜœw1Õéx7P¡Ú]êv}µèÎF<&Í7„¨&¤8ŒzŒgb|(°“QåáàA8Í ÌÜ{êº}xpð©Çs¨ôsÖ ctÇÇ¥±²Ò—l_PÄ“*Õ";¬¾½†’³à£!aûæ¿.aëP##'lÍ6ðþîr8>رeß{)è`ì‘38"e sPÐFA½õ¯EèoÌZ;ýZñJQÃŒ>Í‹Ö1àåÁ°bÌj¤›K¯JBÅ&8Ü X&\’„kÚzŒÌ@Å%dG |È>B©Ç¡už‘\
džò"߶`óÙ—’ÊsITì´ÝŸ‚C¼¾ÙˆÙÏ-è4‹Õ -œç1k§—±¡ƒ!ä–JAë·ãÔj]õf“—KÁ’ҪͶ.7%8ÀÒ#úâCd~tï*ÏR#¡[ŽOöÇ.ª×Ôä:öý;á™ÒøþÁSóóP€9ó(<—ÿ\B$í¶Ox™`·øM§|åÚ\ -[.°áh:Bû'$D—_‹Riîk".‰rh½ -E‘Ûˇ¶™7åCá‚/èØ#_ˆÑ¤]Ð8°$ä}Ñ…e®®ò¯v„Ú¶]E-N¸CÜ;© r=Zº¶d(¶$œ<sw€$ãq`ÕMõ@Î…¥õ+€=ˆ¼ë ‡‘Q~ÎRѯÛýÚs‰T—þFbõ×?—î÷ ©ü.Þ*¢m||t¯pÑ:¹"üþè:hx_^J앦"btßbØ&~ì#a´Á£cÁ”ÿ‡(öw’{}©lñ“õUü[ ‹åÒ¿^yj¯LyCÊÉ6#CšPîy]á9ÄèêqGÉÌw0Mè‡^B5™qh†ò}ØAÛ:Å0fæYøÒö]x9*¿Xº¼¢()~”’¹k.ô87Ì
äó?ÒB¦9þÈ9R³×öÍÔ™üªÃT¾êÍ”ÉÿIŒæ57oh ‘“ƒþCkæ“;ÒäqE‹:wå\ûÌLop®ãäþœÑ×? ˆdÓ:Ãw€UÚj¤À¶¿k 8ËNÚL`#³úù–Sü -lG&ÇÙ€R[%‰B)
Êökš&‘(¿â¯jô:”DUôSGå•ŽÅ ¦5tø¸»·}XSyÞû3ï:Õe¾õT8é@ÝæÐö
O`ÔŸõ~wâ·y©SüA}¢ïfC_óÿÛïÿSƒÊR¨´Oür ™Iȳ j§³CÉ5dumE6!úO³Vòendstream +œç1k§—±¡ƒ!ä–JAë·ãÔj]õf“—KÁ’ҪͶ.7%8ÀÒ#úú‡H€ò£ÛWy– =s|¾?vePæ&gзï_Ì ÆV +HSØøpmGóÐÚ?$!ºüòXÔà–Js_!qI”CÈźm»Ò³(èÓ¸€‰³{Jz‘BæìBE
aµðu¡tEÇo¢ î–9O*l…Àø)…—+˜A„ô/0ãra +O\:Æjyý…¦5*Ö‡yOßwe½Â¶J
åaºg`5:Ͻ_ö§/<É(ò;›÷ûA‘W|.½tE3±˜†2YpÿbéZ>Fèìàñt¹Ã§¾‰€©0+iÓ\èïz_àÆgÍÛqœÇ,í›s°~7¹LVô‹õ‘Š¥Æ2ñ2pü– +:%“ó±Î<ï’gi&Exü¢§q™Qå-Ò=s#®sø5h÷8ì¶å¢r}?öE×\g<¹.à`ܘӼ†j¢¦µä,8QÖÁ|µßªèºê¡)½0~#¨…{l‚ýãUfR(ìØ^>´Í¼) +‚A¯ÀùB¤~ÀPè‚Æ%!ï‹.,s5¹põµ#Ô¶í*j,p‚àÞIèÑÒ5'CÉ-X áä™»$«nªr.,_ìAä]O8Œ4ˆòsv°ˆ~Ýîè7‡˜K¤ºôï0kÀþ¹t¿ª +Ï!®CW;Jf¾iBWôjÊÈŒCKD7èÃ>*ØÖ)†13ϸïÂûQùµÀæE Hñ£”Ì]‹¡Ç¹an Ÿÿé”2Íñ§Î‘ꜽ¶o¦Îä/P#¦òµPo¦LþOb4¯¹yC‰œôZ3ŸÜ‘&+ŠXüпó(çÒØgfz‰s}' ÷A0àŒ¾þa@$›Öy¾¬ÚÐ\#6×ø]ÁYŽpÐlÒ endobj -1260 0 obj << +1266 0 obj << /Type /Page -/Contents 1261 0 R -/Resources 1259 0 R +/Contents 1267 0 R +/Resources 1265 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1250 0 R +/Parent 1256 0 R >> endobj -1262 0 obj << -/D [1260 0 R /XYZ 85.0394 794.5015 null] +1268 0 obj << +/D [1266 0 R /XYZ 85.0394 794.5015 null] >> endobj -386 0 obj << -/D [1260 0 R /XYZ 85.0394 690.2056 null] +390 0 obj << +/D [1266 0 R /XYZ 85.0394 690.2056 null] >> endobj -1263 0 obj << -/D [1260 0 R /XYZ 85.0394 665.1198 null] +1269 0 obj << +/D [1266 0 R /XYZ 85.0394 665.1198 null] >> endobj -390 0 obj << -/D [1260 0 R /XYZ 85.0394 302.1184 null] +394 0 obj << +/D [1266 0 R /XYZ 85.0394 302.1184 null] >> endobj -1264 0 obj << -/D [1260 0 R /XYZ 85.0394 278.2032 null] +1270 0 obj << +/D [1266 0 R /XYZ 85.0394 278.2032 null] >> endobj -1259 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F62 990 0 R /F39 858 0 R >> -/XObject << /Im2 979 0 R >> +1265 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F62 995 0 R /F39 863 0 R >> +/XObject << /Im2 984 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1267 0 obj << +1273 0 obj << /Length 2998 /Filter /FlateDecode >> @@ -4988,43 +5049,43 @@ r Ž†à†-ïœdûÉ5… غ(ÿì oëî(Ô5#„}¯
?ÖË9Å™Ml䛺Üü´‘ȱʴ±x)5-1GèªEÊv
ˆÅMO-Vë{ž€[VÜwL쾟êIJ&ÉíÁ`E
+|}8ëŸíN‚êÔ|ç»»æ¡&ðèQÞ¡$rÔ1 J„ò6FE¿† øÃìÀ0á« -LQ×QwÆFÒœ»‰¿®2™·I€‚‹¹oîæ"85yC:Ä%NSL6&ëR
ã#¢™êÃu±ÕLB¥‰—ÏŒ9í¥eò©´Ìèïk–fÖ5Í0cùpºæÓ}4ƒb¦Ò²¡õ9á¾2caæ,ÌeLß2:ÄzpˆUKàº5±±c¼`솛üÆ?é§îQ¤_÷‘) •
þmˆµ™þ¥ûqòåKZ9‡8‘°ëp t"ßÓÖÇió›´¯¾?» è¦j=³7(¢”žáŸ%|HßxúŽç fà<21§f44ßWã)µŸúûp¤&þ˜”d_¥ì¹Ì圄ý…W›#9‚o&ûç„-¾vRjgå½ëX™±xÁÒnyBN¾Õ£ÆóÏËM>SnòÉr“O•›œÊMüßrÿ˜ÜÔ3妞,7õT¹©Çä&Ÿ#7ù<¹MЇ˜ñYx]ì7¸+èÉ•ßù¾¥`A^è¯4=¿³’8þ‡XÊÄøgc3údø‹§gÿuÚþ¯`°Ïn<ÒñÏ@†ˆ0Sȹ±œû?c;dý¿?¿Évendstream endobj -1266 0 obj << +1272 0 obj << /Type /Page -/Contents 1267 0 R -/Resources 1265 0 R +/Contents 1273 0 R +/Resources 1271 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1250 0 R -/Annots [ 1270 0 R 1271 0 R ] +/Parent 1256 0 R +/Annots [ 1276 0 R 1277 0 R ] >> endobj -1270 0 obj << +1276 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [213.6732 554.0172 286.8984 566.0768] /Subtype /Link /A << /S /GoTo /D (rrset_ordering) >> >> endobj -1271 0 obj << +1277 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [209.702 475.7236 283.4678 487.7833] /Subtype /Link /A << /S /GoTo /D (topology) >> >> endobj -1268 0 obj << -/D [1266 0 R /XYZ 56.6929 794.5015 null] +1274 0 obj << +/D [1272 0 R /XYZ 56.6929 794.5015 null] >> endobj -394 0 obj << -/D [1266 0 R /XYZ 56.6929 622.2509 null] +398 0 obj << +/D [1272 0 R /XYZ 56.6929 622.2509 null] >> endobj -1269 0 obj << -/D [1266 0 R /XYZ 56.6929 600.0717 null] +1275 0 obj << +/D [1272 0 R /XYZ 56.6929 600.0717 null] >> endobj -1265 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F23 678 0 R /F62 990 0 R /F63 993 0 R /F21 654 0 R >> -/XObject << /Im2 979 0 R >> +1271 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F62 995 0 R /F63 998 0 R /F21 658 0 R >> +/XObject << /Im2 984 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1274 0 obj << +1280 0 obj << /Length 2668 /Filter /FlateDecode >> @@ -5042,49 +5103,49 @@ $>…<k©Ó‹ÕÁKPîºÂX’+%®âŠâˆGüª
…§P¶}~¼¢yÙA )*Å@8pY!ArP—ØúLÛ÷ΰÁ\Àõž¹º ”y >2r'˜ï¥Æ QÔeq“º*;rì݉sín¦Ory’Ad¶JMûr¸½jý5i_\±çû>þÒËSÏÖ›3è4%93pcgî‚Lü29 *¢'ñ¼ËfðŸgçû’œ’¹XΘ[æ·ž|œ@t”Ö Júž×üÀK>ù¹Ž& Sñ4Å왂`––ŠrWø endobj -1273 0 obj << +1279 0 obj << /Type /Page -/Contents 1274 0 R -/Resources 1272 0 R +/Contents 1280 0 R +/Resources 1278 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1250 0 R -/Annots [ 1276 0 R ] +/Parent 1256 0 R +/Annots [ 1282 0 R ] >> endobj -1276 0 obj << +1282 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [353.6787 560.2827 427.332 572.3423] /Subtype /Link /A << /S /GoTo /D (the_sortlist_statement) >> >> endobj -1275 0 obj << -/D [1273 0 R /XYZ 85.0394 794.5015 null] +1281 0 obj << +/D [1279 0 R /XYZ 85.0394 794.5015 null] >> endobj -398 0 obj << -/D [1273 0 R /XYZ 85.0394 630.8728 null] +402 0 obj << +/D [1279 0 R /XYZ 85.0394 630.8728 null] >> endobj -950 0 obj << -/D [1273 0 R /XYZ 85.0394 603.2815 null] +955 0 obj << +/D [1279 0 R /XYZ 85.0394 603.2815 null] >> endobj -1277 0 obj << -/D [1273 0 R /XYZ 85.0394 477.5928 null] +1283 0 obj << +/D [1279 0 R /XYZ 85.0394 477.5928 null] >> endobj -1278 0 obj << -/D [1273 0 R /XYZ 85.0394 465.6376 null] +1284 0 obj << +/D [1279 0 R /XYZ 85.0394 465.6376 null] >> endobj -402 0 obj << -/D [1273 0 R /XYZ 85.0394 128.2785 null] +406 0 obj << +/D [1279 0 R /XYZ 85.0394 128.2785 null] >> endobj -1279 0 obj << -/D [1273 0 R /XYZ 85.0394 104.5761 null] +1285 0 obj << +/D [1279 0 R /XYZ 85.0394 104.5761 null] >> endobj -1272 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F39 858 0 R /F21 654 0 R /F53 957 0 R /F62 990 0 R /F63 993 0 R >> -/XObject << /Im2 979 0 R >> +1278 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F21 658 0 R /F53 962 0 R /F62 995 0 R /F63 998 0 R >> +/XObject << /Im2 984 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1282 0 obj << -/Length 3614 +1288 0 obj << +/Length 3669 /Filter /FlateDecode >> stream @@ -5096,1260 +5157,1250 @@ c…bì1jW¦« 3¹ZM’ špmøJiE”Ph5ÂP¹d(/hçñLÿñz3ˆjÖ9ÏfQ¤h‚FF$eÞ`W¿¯¡ÒZLƒ Õ÷Õ¡JqhNq”&Äø›}³ a^÷¥|r÷닱äpñЯÂá€ë8Œ\)¶+ïÛ²ÛÝö¾Á¹ø~‰ì¹ûöyΉ3ÊÉi._ÞBâZØÃȃòœ(1âh·x…f„ë-¦Ã ˜GñÙ ^µ®ã~-³¿u!:3’X3
ÏîÊ]ñXyÕ €ã¿h÷ñvUý€ô? • ‰Ç2ˆ ÛçÀ%ƒ¥ -Ò£'NåSV°:·O)\êÍuZ;=;W–2‘+Ä#OVh’gûæÎ[%y›3Q nÀ$W9ë*>àÂ"Ú¢b¯ÏÂ]ºC’[T¦Íà&ûâp\ÚV‚l4m(̤åQ¸Þ[ûöùŒëÝØÓˆ]ŠÓ¶ƒŒKw©D×’Û—zÀt§#“×Û¶îÖ§íqÝU”óô/nšÙçNLóÉÅ$x0pMÍ“-úœl)¶à:}ÕÅœÙ
„šØòóÛŸtwòyà{t1ù¥{]qÏ}é±KÐìßÎÞ‚™ -‚«9*8":ª+ŸvÅ!¸zrmá_þ&}Ð*§Ìçá“͸Ê_½7ÿIT`šËô+.C®Ë¨¸\œì$·/×þÕ´ŸƒP„k-_^DâZXÅ$…Ôèñ2Æ™+n"<ùîC9¬Ï—1dÂâÌÙÅŠ¢]9¿9B(2У½¼ Jü¯ìj>î$d²œ¢gë1A !^–mâzm³Ñb.Èý‚ɘñ1ÃŒI9f.$(à9¢}ùµ_Èþ -ÿP„âxôqº36.oÕ=ð+žæÚâii«”¡—vz»«Bt~Lv"úCYÔ!èò™Y}B‰³>TøK—Iá^œKûÚ"¥¢j´JôpÂdBI1‚
¨>UýÂ[d]q%/h,îËÇrŒEgæ*н…¨IÄŒ–'.@”ƒLeó×ýL2•,¡©Ý´§¶ÿu’Q¸)MT…Ľ¼U¼¦]\3ì3áÄ…h²:vJó¹„<“ç'Ù%LbºìRßë] @Íä(p)öÚn=Î -RÂøø“j¡·øÜšo¹+:/hô§ªz³?mC²×
º ¥áÆ–óÿM v@£º†*ÚÛ^¶±¬„5 +Ò£'NåSV°:·O)\êÍuZ;=;W–2‘+Ä#OVh’gûæÎ[%y›3Q nÀ$W9ë*>àÂ"Ú¢b¯ÏÂ]ºC’[T¦Íà&ûâp\ÚV‚l4m(̤åQ¸Þ[ûöùŒëÝØÓˆ]ŠÓ¶ƒŒKw©D×’Û—zÀt§#“×Û¶îÖ§íqÝU”óô/nšÙçNLóÉÅ$x0pMÍ“-úœl)¶à:}ÕÅœÙ
„šØòóÛŸtwòyà{t1ù¥{]qÏ}é±KÐìßÎÞ‚™ +ŽˆŽêJÁ§]qˆ®ž\[ø—?ÄI´Ê)óyød3®2ÂÀW/ÅÍST Û˜¾Oßz[ÁÂËé…/ÅãÃ3†#›4Ý££“¦DÉ;¸6$,&xgAÂôõK¦m`~ñ)iN,Ó¯¼
¹.[âB`s¡¾Sþ¾\û‡ß~†oB®µ|y‰ka#|“‚ +4úSHU½ÙŸ¶!_í]ÐÒpéÌùÿ& +; Q]Cím¯ +ÛXV€šP©'ùý'—„êdAŒS2ð&]Þ‹dqœœ§“o©¨êécÓÌþ|ÜöwáO®Ëå·išþ!ñ—ÿ endobj -1281 0 obj << +1287 0 obj << /Type /Page -/Contents 1282 0 R -/Resources 1280 0 R +/Contents 1288 0 R +/Resources 1286 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1250 0 R -/Annots [ 1284 0 R 1285 0 R ] +/Parent 1256 0 R +/Annots [ 1290 0 R 1291 0 R ] >> endobj -1284 0 obj << +1290 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [297.8955 476.5924 347.2449 488.6521] /Subtype /Link /A << /S /GoTo /D (dynamic_update) >> >> endobj -1285 0 obj << +1291 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [324.9335 169.1118 381.8296 181.1714] /Subtype /Link /A << /S /GoTo /D (zonefile_format) >> >> endobj -1283 0 obj << -/D [1281 0 R /XYZ 56.6929 794.5015 null] +1289 0 obj << +/D [1287 0 R /XYZ 56.6929 794.5015 null] >> endobj -1280 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R /F48 880 0 R /F62 990 0 R >> -/XObject << /Im2 979 0 R >> +1286 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F48 885 0 R /F62 995 0 R >> +/XObject << /Im2 984 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1289 0 obj << -/Length 3521 -/Filter /FlateDecode ->> -stream -xÚksã¶ñ»…¾Už9!xñÕt:ãÜùRg_ês;™&ù@“”Å9ŠÔ‰”}ʯï.€@‰²/ÓÎ=,€ÝÅbŸ€ÄŒÃ1K#ÆU¦gI¦YÄE4+Ö|öcß_;gá&-ÂYßÝ_|ó^%³Œe±Œg÷Ë -®p#Ÿ/~ýÏJØöœ©,fÏÐáLd™œ/t¤X¤•ræâãÅ?=Â`Ô,’ŸŽRIÏJ³4“RæŒG µEe,VRy)K1%e7¥\4uÕýbSm/E:_|ÞUÛý’Ä:ÿ²˜?–Œ–*ÍBNØô³&øTŸ2‘,*3z¿ªú -øâñ¼¯lDóae!u[uÞô)ovþø×»54çmI£°?¡N»[?Àag³…ˆƒ8É %XEÒpÐ-Q,ÑÜ¢*vÛ¾~ºóŠ = j†¼»]íDKÃËnK¼ÝÓðcýTµ#¡(rŒL|ó^„g'UÂ2 ,‘•¿Ñ”‘Ø–è4±>·ùºzóyØoàÿ¢Éû~i3GÊ.ùûk8#”{>»t¸ýjûTm ø\7
R©Œ¥<KÇ‚Ì‹¢Ú ‚XÎ*” -”ú¥ét›MÝ>$/K8Ü®5Ç'V0g¥áØ`Ÿ%M4diÉ0Tk¢ æCGÀ¾j–Ôv¥6¬êžZNipuk«¼}¬Œä@väœ,-0’‡Š¾M÷øX•È•à¨¬-«ejAC£§vî7
Á-ÐP6 -¶ÀêKQ€{Ä -Õqk3ŠÊmz*k§Ò6Ùò+‹R½,Rmfbö+bøÙ0ÓønW7ÃÂxp8«CèFSçfZwv=Õ+pž2b2†ã²Ù˜_z@¦R1ß´ŸêÒ+ŽšXƒUÕl–»†&–uþØvà -q€aE¨v+Z‘Ü)8‚PÁöà7‡=âßL€ƒ³ ÞIÔA¦ÀûmújWv‹¡Û,šê©je‡þƒ¶ i pJ²8Jœ/x¨ÛrBH2a2î¼K@Éžœç¢|‚Åχ5˜Hê32“Øa]Êlóc$àö¬ÒCša¶—ojYá0u‘Aï©®ži“ѾªÎ•B‘€¢N¥¦(¡±íãŒwSE`8ÿ4í?ÁŠ;üié¢ÈŒKqÌÐ -Rc.Gìœ~Ö+\œbR_àÁ¸Qø9õè!áUI¿rŒ˜©í¬çU]¬-¥w˜–‰–2 %iÿšÆlÆ•É%tèÔ<‹°ê‹’§LƒòZê7·SF¢æ~ë “:¹”c•ŒmI›î!w©?”®‰ÉØÔ¼¯É0:àÑöÔéwFä'ýdh,•©³·¼$ál4 -³ºÎ©a?.U„¦ñ4!NSžFK¼Ñ‰ ´8]"~Ø™¨™àU!wi °Ê~38uÄ”Ê\à¼ÿå~ÊAS9ŒTÜ@‚‘>2Ƴ>Sc¸—¯¹õ„ÅÒGg,Ñ2iS#hxwº§ïàFIìyC=dØñY´eîæ[ö¨ê>nª¢^îÑ0'â ƒHŽŽÂÒÁªôtWè™ QñØ0—³–fs½¢ê{[s[rpWðCízÆ -ÞkP0œuÞ -ý,äuÉ¥ÓÍ‘BÖ¥„z™°›4Ax¤c -jLQ&#Œã¦78°·Â8¸È×>²B#+Œ©®co…Ð4bqž³ÂT0Ä™=zÇÐ934uëØ‘È´B‚
Ö”B™;Ò‘¯²FXϧ á•\ýiÔtYŒ9Ëë ŽaÚ|©f ÁTGøá"J±ªÛ`.…¼pŠ[õOd3Ð\È· IfIu¤Ô‰ ¨R;/ªÍ%Žc 3p›|ÂŒå®5é°¹üɬnÁ‚Ͷ^çF°³Ûb J+Œn -w -2l¼-©ËS5{EÍK´ý¤SâcÇ¡b…t-¤nÝ]2¿y:§dÊá%Ë^räð’S‡—¼îð ßÎtìœÇÍ;öñúîß×wS%CÌ ß×_ëî ç‚Ç&ç0ŸÍ}¡â„œ<M¿.÷=qwÒå27 -7Í=ëÔ{©ð¡3ÒkhÛË ò]i‘÷s?. -üp)Å©°î7yQÙ$†a·m©ûË»?]Ý܆£ôèg˜]qŽÓª‹ /‰ëb·˜:—&7u¦¹ö“•Ðžiោû™îÑNò{ qûʬñ…Ó2Ü»7éðÂSÏïÞ¿%°ÈDjטÃÓs>‡Ñ•ÂžFó¦ïh¸n‹fWZÒÃjòõy̱s]â7??ÅÔ2HÍ`ˆŒ]4g@˜xl«-ÇÈ01Õí§—pš;B\Bü!Ýæ!/>Mæè#¶ÂøDÕ"‚Ö®ýÔvÏÖ+ûÉG<ëz)ûÃo/0|t,+0¡µ)¢°[/í\ú'EŒ} Ç9½)÷¨¾Ô½y¿„¶9\fû8Ð;´Qü¤—Îc ©ý²‰_ÛgòXå}Ú”Vs|®_VÉmÍÕ!tyÁžCÉÍ„Âîf°²ÏéSü¾Ýzd…aÊ]nB2Uùaˆ]Sì¶D¡µKšºÆÊ-«uÿ×sï<©b:yå~‡9¦R€„)ˆ§ÐL•ÇC* -ÎnnWïÞݱ«»ŸñýêÜvãˆ)ˆä/n÷0çüvíœW·û½ÃvNn7 (dòÕûUß!NЇÖþç_;D§…Ιç7Åc–JHv-S&c:yò‹TÊ @M&Xÿ/Vãšendstream +1295 0 obj << +/Length 3537 +/Filter /FlateDecode +>> +stream +xÚZmoã6þž_áoç +‹x–‰ÙæJÅ2Š•”žR_}ºúçÀ0hµC§ô§â4Š…Jf©¢4“Zf‹AkgQ"…´,ø”–}/ÔrQW¦é»ÅÖì®y:_|Ù›Ýá
ib“]L¶ŸêF$:J¥ˆg¡ +ÜœÜ\à$†¾u»Z™¥â•¨¥Yæ`T±stT·EC…3G´3[‹†iÓ(µrN`ååÉ /»u»¯K*×_“¦è‰´nŸ©°!ÓƒÚ[e%áñ¼h7ŽQÕЗl +9}¼¥rR÷¸3Y +hp[T«²7Göe`¶+xÉÞ®ÁNF’HZ
P<›Òä5'4>WýšÈù”™4m³pKÞ¶
àr—Éü÷ÖZ ÔnËäÄ +¹"ÑnÒL†÷¸y:NÉBzÈÃ
l¨Ç£k«Ûg:lp‡°M
£: ú¾Ç½Fbµtœtë¼sÂY›¼j€ÏÄrö
ùw9éi X‚Ã0³H0‘:8¼x2ž`(œÎÊz+¢3í³%ÂïĦ}ã!–köG¬ƒÆ««MåXµÍÈQÔ¤£§’šo}ëpIBvâiÅ †¡eþÆ&Ðp°¬?£^΢Tå4õbôq¢cÎTèX‰”t¬„¶:FB c¥…7=htŒUÏ iiü~k…¤ÇvúÁbkG¹ñyC]«Í¶íŒëñx˜X%¨1Ž¸Æ8(4Ç‹(Œ_ôÔq¬¢$… –…¨.Œèûôb¬tº*úN„e}µ<,JSçg W¸u™|qê¡ÓùÜ£½Tq”AD6šœT
àh§çœÏÑQRIçÆ °h›²³TvØ?345%!0è!¡d=šiaDÛ˜®ËWÖ®µ?œÓa7ÍBü •ªsq,AcغŒ·¾hÊ(„Š2–` © +§˜´ðþBà +‡Ö¶3û²]ôívQ›'S/ÊaŸ–yD`[R€IiáUSN(IèHhîÝÌŠ³àtç'àLC\9ëÇOÑòÓ!¶ñ8¦£€A.Á üšezŒíòò]O%«+l¦j 2¨=U晚1‡èŒ¹”Áª,@«ÝÚv«î§r÷°ÿ¹»žqÅ~‚è“l‘gÖŒ?‡
#q&0ÃõzEŠsnAÆ2X_‡o +¶ò©Óä•mÄl†åz=¯«bMl)*ÏÀ`³l# p]’õo¨ÍÊY€P¡]D„Q—D,¯›ýönêÀÐÊ[î·ÃÄdN>ÓBŒ‰ËD¡ÃªnsŸ±Åi¤%×cW°&ÃC·¶£J··*È +ˆCÑ1'Î'eªO¶Â̓— ç«Bd‚£PžD¡åœ§¹X¯€°×Ýi0—)2ŸF²ã•Ã%/T*JµÌ^ñ ×^è{¡¬k.½mŽÜ¢.ÉåËûNlLB꘩“™É “ä(‚õž<xaÜ¿´¼ÚȺŽI’Á¡hÕò¼ä…)”N2·õ^ Knh¯ÆNˆ“L;!ØàMi,Çîô‡¼ÆÆ—ã)†9œüÓŽ,éŽóž×iû¥œ%Ü$S14Çp¢ëª úÒ‘vñ£“ ÿ‰]$–ñVªÆÞ³¤ô_(mT¡<Š*{÷æEÂÜŸÐc¹ol8lïì|궻j“[sÀÊ~‡74ÂÚ]x¥Òà¾Ei +7Ýk`#ÄËaêãRâ3‘8¡-‚+—œm©jç„/„…EÞõT!½àtŒ®El¢ßÃ}ðý»gÍ¢T!æÚQéxS)²×à
lK¤">±qâƒøöíÔ§'"ã…±™Œ˜b'ÇÄÿífŠé—Ñ.ìuí†^A÷\Uyyq$âT¼<ýÐkbþ1è1H[!f à@OÏo߇¥§`O°—œÀž>=}{úu؃¨;S‰‡Û÷ѧ›ûßÜO%IQ¿ú£ ‘ç,ù3‘‡•øby'DæéÉ+×=á£
‘ñ +–Iðª¸*SOÑû:·Ù¦} +Bk¯7íã‚kt„a
£—‘Ÿ§À$-‚kO¨ÝxGCxÆS7Æîö±-žKÀœˆ"qØ…ƒëVw-
š¢Þ—æâ#€âDbÀ²Pbh'‰~ûÓSB$k‚D–AmèXGµ¨ÙU«Æ”è:oèùÜsâóºj>¿ÄÓÞâ<‘½Ä¡ ív1µºÇ¼øì®ÄF†¿WÇJûæsÓ>7g#»É·X‡BBøgy,BƒIKÄÒ€7mlR…ÕjéúÒÇâ
°$÷;ìS»›’ò@óµêìK”ik…Â&ôS (ãF…zðÀ©Ç™íI¶{&ð*oSöôbÿÒ@L·³VÇClPìñU›',n5½Ó}Ns<ÜÒc§»Qþ²Â*]zž‘q„¿ +œï៳ÿùLJÁ뎎 tÓy‚dI” +_œPö<{ʉeAÒ¡'Dÿ/ä×}endstream endobj -1288 0 obj << +1294 0 obj << /Type /Page -/Contents 1289 0 R -/Resources 1287 0 R +/Contents 1295 0 R +/Resources 1293 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1297 0 R -/Annots [ 1295 0 R ] +/Parent 1303 0 R +/Annots [ 1301 0 R ] >> endobj -1295 0 obj << +1301 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.0431 510.7325 144.9365 522.7922] +/Rect [84.0431 462.4692 144.9365 474.5288] /Subtype /Link /A << /S /GoTo /D (view_statement_grammar) >> >> endobj -1290 0 obj << -/D [1288 0 R /XYZ 85.0394 794.5015 null] ->> endobj -406 0 obj << -/D [1288 0 R /XYZ 85.0394 581.6899 null] ->> endobj -1294 0 obj << -/D [1288 0 R /XYZ 85.0394 556.4234 null] ->> endobj -410 0 obj << -/D [1288 0 R /XYZ 85.0394 250.947 null] ->> endobj 1296 0 obj << -/D [1288 0 R /XYZ 85.0394 225.1724 null] +/D [1294 0 R /XYZ 85.0394 794.5015 null] >> endobj -1287 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F11 1293 0 R /F39 858 0 R /F14 681 0 R >> -/ProcSet [ /PDF /Text ] +410 0 obj << +/D [1294 0 R /XYZ 85.0394 535.1829 null] >> endobj -1301 0 obj << -/Length 1676 -/Filter /FlateDecode ->> -stream -xÚ½šËnÛ8†÷~ -£+¨Y^D]fVnãt\LÓŒëYµ](¶Òp$×R’É<ý")+4Y¡À (ÌËOþç;"i*
™bñC¦<BQJÓiœ†ˆc§Ûû ž~}ï'DkæF4‡ª·›É›KOS”F4šnnÁ\ ÂIB¦›Ý— BÍÄ8x÷éêrõþïõb‡Áfõéj6§—«?—ªô~½øøq±žÍIÂIðîÅõf¹V]‘žãíêêBµ¤êã̤ëåår½¼z·œ}Û|˜,7ä%˜I“/ßðt'°?L0bi§O¢‚IS:½Ÿ„œ!2fZö“Ï“¿º Ao;Ô–¿N3g!J„¿'Ë<E£¬Ë2 A–c":#A`T2Ë_1‰‡¨±˜$t -§{ajD/ME±7MâiÊOM)9ŒR´ºš/..Öh±¾ž¥4XœÍ9KPš$¾5Tz£òÒ»L{ú¡©š’‘˜þ<<IÃØTx£ò»L{ø¡©š’x|”Æ(Æ8uÃCÕyøNåƒwšvð/Lð'¦"£àãa<P9àÊï2íᇦvxhJÒqð¢Æ<ð@å€7*/¼Ë´‡šÚá¡)ÅãàGq”z<¨rÀ•ÞeÚÃMíðД’qð„#B¹çÀƒ*¼Qyá]¦=üÐÔM)ÏÅõ"LˆçÀƒªóðÊï4íà_˜ZáOL)3”°ÄsàA•Þ¨¼ð.Ó~hj‡‡¦4/îz$
C<P9àÊï2íᇦvxhJù8xFç8òÀ•Þ¨¼ð.Ó~hj‡‡¦tÜ
‚R%x rÀ•ÞeÚÃMíðДŽ»á…)A4ò|ÍÑyt#ò‘»;𡣕:Òqw»0ÆÂÉ÷BUp£ò’»L{ô¡©šÒqw»0óÅÜsÔA•Þ¨¼ð.Ó~hj‡‡¦lÜÝ.ÉbŒxŽ:¨rÀ•ÞeÚÃMíðД»Û…8AQ{Ž:¨rÀ•ÞeÚÃMíðДDbÓ§?OÏ’aß7<g7"ºË±#:ZÁ¡#Exw£cÏaUr£ò¢»L{ö¡©šbôk?«ëÈŸ±0B1|K¨3*oÆ\¦}Ɔ¦öŒASòdL^ºõ«PåȘQy3æ2í364µgš^ KIûs䘣0J<¯ŒPå 7*/¹Ë´'šÚÉ¡i‚–#Øi¢„rÏ#TgïT>v§iÇþÂÔÊ~bšŽcÄfB<Wg¨r°•—ÝeÚ³MíìÐt1Ž=dˆ³Øó2¨r°•—ÝeÚ³MíìÐôíYv9|µŠDAÜ·C¦.ËûCó<›Sƒ«2¯e1²ãŒ$A®Úë¼i²›½®e’4wºá±ÈŸTiŸ?æ{=A¹SmU¹×Óg‡ƒ*Š±U?´Öº[ÕµÝgµnZ]!U¸(jé¿SŠÜ1ï"–¤x:—¯‘œ«oYãAQÞåÇ¢igbQpÛŽ©îUguhŠª¬UWq«e— -ÑÜçEô••jÜõá‰Vžè0á‰Öúo‹¯â{ßx·iTªA§‘é4 -tq˜ùü´Oõ˜ÅnÀ¨ö»š†c@!*û¢ntóú±ŠZàkU~®Ta›•'ZUéTΪ¦ŸA•²f Ô@2 ¤mn«£*äÿd÷‡}þ›¤ysÉÒÓí3"¿íä -oùt,ó6»såa¼B¯~W3œì¹eŠ•LAiÐ>LQy˜‘ .Ê益 ¤f·SªvQŠ†cV~Ïuy+ŸHÛ»S
f±¼–/îê»êa¯5Ù^i²\%)î²Gm¦:Äœµn0ÈxÄgY Z9ŽñPÅ u.ÖTDY°*UËá˜m›b›«ZsWè!b£æÙQWäV•Ÿ¥|â²pÓêõ•
Û¬Ö¥§¢¹S¥û¬|V¥"lÌMÞ(Å.‡ü%“Ú½E)¶i"ÂoÚmóÐ=¶Hd6?Ê|É -×kK´–Ù}›7Q,JÕ'f¯Í˜C¶Ík¹Áx|®T¿Š¸!N‘3¶]Ürh¶=¶Ûx[d{KO9®Ìó]»4DYPZànô^Ùå‡}õl¶e{<Êx—•e{¢Â}%3ú¬7V•é!ÙS¦ÛÀ¡G9Ò(z5:{1×*ûÿe‰šç—ÿŒþ² -‰—Ä3oR4NP˜0j‚jÿƒ¾ˆœ`$Mj ý?„{“endstream -endobj 1300 0 obj << -/Type /Page -/Contents 1301 0 R -/Resources 1299 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 1297 0 R +/D [1294 0 R /XYZ 85.0394 508.8634 null] +>> endobj +414 0 obj << +/D [1294 0 R /XYZ 85.0394 198.9245 null] >> endobj 1302 0 obj << -/D [1300 0 R /XYZ 56.6929 794.5015 null] +/D [1294 0 R /XYZ 85.0394 172.1168 null] >> endobj -1299 0 obj << -/Font << /F37 743 0 R /F14 681 0 R /F23 678 0 R /F39 858 0 R >> +1293 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F11 1299 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1305 0 obj << -/Length 2717 +1307 0 obj << +/Length 1767 /Filter /FlateDecode >> stream -xÚÍ]oÛFòÝ¿‚oG!á–ûÍí=9±sÐØwŽÐô)›8‰TDÊŽûë;ûIJ¢d]œM -qÁ°FÄ)â” -‘E%/‚ ™ÝÄ -¸*Jú$óºô‘0¤2¬EÊåÁÝ´Ÿ¢”C¼'ëˆbÊú¼€GÒ~ÀÒ2æLÀCAƒ[ÂŒ¡3
éîì°F¶§Ãf -IÅÕæþŸ—å´šCQªâ§‡¼³cÈÀu¾(ݼq"
åËe™»ymrý4&× -1ù¢S°8…ÇêbÚÔ]>ív½B!B^Ú>`ì¿áœ!’n3¼‚dÌyÉxì92ÃNm0ìÔcÞ-4l÷©‘m¹…ž2nÑOõn¡'g#2nÁ0nîOxó+Üâ!é?ßå\B"#’vƒ!Ö~7X½™µçåŽ/HTÊØaÖ¾A q¹ÉŹÝÙèÁ˜žæDöƒ¹×–7”‹/m( -çÅ;7V”³|mŽ3«|7œ[ã;f³ºfIª^¹!Ö]{,-¥“(éu¾«kŽKÅaÖ›ºN!>±Úäâ¬×+… -a`¡‘!·cPoUFN€›Y¿¢µXæàjGVøUÓf]wFwz«çeéø±• <æóµÛÈS
s~±qçálJ€äþìIŸz\ŽàKX`t«òÉ"èE!û8BNP
j¿mlT±°ŠöôûÝçà’6ˆ6r‹ïçͤÌ
‰l’ÙÛV -`èé¡q0Äé€ØžX…¬êp;Üyf6ÖhmÐÌlf4Ñ3⚥ni¦üYc~L–„ªQ¾”&{œïÍ“–¹YÆÎÎíHQµ€Ô¡ÓGYü¼SÔP‰´ÒQN_EŽi™)ËLåÖEß÷ÜÓA!”‘Tþ× -‡Ô.›Ú\çQû¿³Ï9œ¾´éLÏÕíÓ¸¸77»FP¸K!H4´êë<Eû$M³lã~çH’~Å~çÆ3ò’óÑ)øgµ]ÎÊÕÊ_/{Ã$xŸ†µ÷1L{oÓƒÖ²tf‚T¯=Aè‚«Ÿq{v$=GÛHþ:mþ¥,U/CØ)›êo«U[vGf‡lp6l²ƒ‹;›
²ÌÛGƒ›ö¡îÖW¯ðÑ6)ÃØÛ©þk×y—ï·×P?Ö^ì‡ÚzkYò{a…–®£®¿>ÿŽ3á<LÃÚ`ú¦_œÁ4¸i0Â…/?4xõß³ëO§—W/í€aÿ ªE¹÷n«7ŒˆˆÌfºY^Í׫òÈ@ÒíØ”kbIßXÌì³%rߊ%nsµ=‰~µø”‘ñ\-Ý=”¡€ÎÃÅrãçó»æ±<`Ò®þαFàÄÄ"{ɤ -Q æNhŠrx3ºsCJS]l+%J ¦°¿
?@€œ!Ý7ôóÜD·È|åJEø¤TB]ØÉ»gûtWƒ¯YÂÕñ'‹ +xÚ½š]sÚ8†ïùL¯ÌLQõaÉÖîmH—Î6íRöªí…¦x†Ø“d³¿~e$áƒ#¤x:³“É K¯õžçÈ’ebõG†\ !©&2F>\Þ
ðð‡j{? F3¶¢1T½]Þ\³d(‘TkÐWŠpš’ábõ5ˆ¢‘êGï>Ý\ÏÞÿ=ŸŒ’8ZÌ>݌ƔãèzöçT—ÞÏ'?Næ£1I9‰Þý1ù¼˜Îu“0}¼Ý\é©?.t:Ÿ^OçÓ›wÓÑ÷ŇÁtqb¼³äçàëw<\)쌘LùðQ`D¤¤Ã»AÌâ1c¶f;ø2øëÔ!h=žêÌÁˆ2A ¤Ì•@.‘`ª©Iàb“k¦åý~?"i”—]±-jSªÖú3¿ÛžtñߪÌk],êß.¦)w'aªcÔ$Q'D+@_MÔß0Iº¦‰ê¤ÔojEÏMÏR•Ä¥äç¦*ͳ›ñäêjŽ&óÏ#I£ÉEpÚIBà@å·ª ¸Ï´ïšºÁ¡)¡ÉËÉ1FœÉÐL*¹UÉ}¦-y×ÔMM)WóXÈÓ‹£4&ÒOU—éOª½×ôDÿÌÔIfJ" }9¼ ˆÄq€*¼Uá}¦-|×Ô
MIÒ>&(ŽE€*¼Uá}¦-|×Ô
MIÚž”Äêæå‡*¼Uá}¦-|×Ô
M‰ì)Âœˆ +”JXV¡êrÆNªPƼ¦§Œ=3ufìÌô +]7´/#I3wS¨ò[UÜgÚ’wMÝäÐ4EÓ>ìq‚bÉOPåa·ª »Ï´e١©ìÇ®öÛ‰LPåa·ª »Ï´e١é¤;N–2ðì +²ûL[ö®©›š¾½ÈÞ\FHb!†c"U¢7SóÊðÓ+CG™~Ó¨ëëüpÈn·æ(;hÉac*ŠüQ—¶ùC¾5”+]W•[Ó}¶Ûé¢:·jOn›–Û¬6U³¤WEÝø¯´"wDÌO7¤X!$9×+ ñ¨(7ù¾8{b"ZÏ©îtcµ;UYë¦b+å)ªºÍ‹j++]¹jÃSµ6<Õ`ÃSµõ._ß0¦Öû˜Fm +L™I£Bg˜G‹füŒOõï÷ŪèçûÁ¾%n)œoˆA¬ö%ñk]~ªîÍ{æ¬<ÓꃓÎYuh{Ð¥ìÐ &ŒÈج«½yWýOv·ÛæÇWÓo®™<ŸN SA=Nõß3>¦w¬mÆÑ+ôêwÝÅÙäŸ÷¡o³& RT ‡SÜHTå}¤1Íj¥UÇËRUì³òGnÊËfLŽ+]a/—×Íð%S½©î·F“mµ&[5׉äÑ&{0fºAõY› +{ Y¯³ø×:ˆ¶9ñXÇÐîë\]U‚²hVêšÝ>[Še®›Âœ¢¦jžíÍA3Y›Ï²ó¦p{Ô›K·©Xfµ)=‡.Ýeå“.ý¼WaÛ`nó#V¬rèÀ/1åzŸÕ‡ý(î—‡ûÓ˜%j¼ò}“,} /-U(³»ÜÔ¥þT]×öœèl™×ÍKXô¥Òõ:bxÒZeÇžž™R-÷lj¼,²#ˆÇÆWæùêxi4}T®‰{kfË*ßm«';1d37YY×T8³šŒšŸyl«Ìœ’=f¦,kð¬KiTM† endobj -1304 0 obj << +1306 0 obj << /Type /Page -/Contents 1305 0 R -/Resources 1303 0 R +/Contents 1307 0 R +/Resources 1305 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1297 0 R ->> endobj -1306 0 obj << -/D [1304 0 R /XYZ 85.0394 794.5015 null] ->> endobj -414 0 obj << -/D [1304 0 R /XYZ 85.0394 517.7894 null] ->> endobj -1187 0 obj << -/D [1304 0 R /XYZ 85.0394 495.4781 null] ->> endobj -1307 0 obj << -/D [1304 0 R /XYZ 85.0394 307.5429 null] +/Parent 1303 0 R >> endobj 1308 0 obj << -/D [1304 0 R /XYZ 85.0394 295.5877 null] +/D [1306 0 R /XYZ 56.6929 794.5015 null] >> endobj -1303 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F62 990 0 R /F21 654 0 R >> -/XObject << /Im2 979 0 R >> +1305 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F14 685 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj 1311 0 obj << -/Length 3077 -/Filter /FlateDecode ->> -stream -xÚZ[sÛ6~÷¯ÐÛÊ;ŠA³Oi›´î´É®ãNÒL‡– ™SŠTy±£îîßsp -Ô†ÅJª^"†A/œóåËÍ&oóªÌ -:ê;»Æ®WG¶¾ËËžx«o¾XɈ™HDŽëͽ\©H/³;EË&°ÃÁ5°³/ §Ë¬h*š²ÎŠÂnücùE -J•i›á™[>#‹4,M’ÔOóüóÆTÒ.yÙÚÚ‹å%¡¶"R¾?Ô—"]V÷þ(m˜áȶ9TeㇶÞVŽ¼By@"bœ£I„`FkéDÙgåVÈÄ,«-|ÓÞã€bÀÁÄË_îlIc¨»K±ì¤^}¸bíáFð|H´evê{ÔdÌž>yáYù##1ó¸½îªº]»Ö‰‡£PÜ¡–¤LH)ØZÊt$)®+à\¶ÔAM¹† hrV6ÖS¯¯5ÞT
›díŒ?ÈD3ðeýœ?(ððHpŠB½l£Cƒ$ƒNaho×wY™7{2ªâ 3\¨©Q%õ$w¼ oVn¨á¶„oYµÔ *²ÖúNøuê„Æ·oÞQcH£ùë{§'ho»Òi˜õæé”LPã(V`Ù!ìÆ~£ÀÊ›Ê6DvÒ¹q8ôÎR›œ'NüÀ;]±ÿ+×Ü~\ÛC{²ôúº±ß„¢dckÀG.oÉv§Ž6ñ+Õ'T±B/³D¾µEõ -T®[KtÄ\Ô»=Òèùt"ÎÒÈL…Xp›‘%ŽYÄ#õd,Š¹~2‹À…Q€ºÂ•¤=x$Ž”CÕ49Êãzžà™vožè6”@Ãtzê@Ýá J‘ïó“ ïýVŸØÝÅtåf£è½õ³»f^«R¦•ŠƒÑ²+¯Ù&ÿsN¯‰b\é¤×n1:6jZ½^΃ªöBƒ¯A*«¢êý}^R|F£úOCÄ©G$šÑ¦€É¡¿o_¦Ié<8ùåRCÊoïVs…»êÚYeI¢ÒϽg=fø\Ä¡þë"_ÏñI™†søic„À
å ->Ã^ôœlQL)´^ðþâ]ŠÂ†GYÇž§¿ä¥‚¥F˜©FnBÕKµü¾z°ˆÆ -ßßÝ[λ‘·^[ë.ÀaÙ¸ì4~c¢í2Ú£°Mã7ÝNä‰útFŸEyu
KVUžøØg£î”=(Ãç#p
zõñ$À•HèŽ#°0;w -`Ÿ®ØõÖ¯¢A΢”ZÞMÜ)Þ º¾â"oIl: - hŽz?/ˆ>ª¾tïp¼³Æú™èÊŸ²1´°aû3¸Ë9Ìx2îu‚OC+`˜ÉÅ=`×T2'oËmUÀ´çž2k»ý>50ÔÅê.^gž f -ìÍ…J>/]³GO—’µˆê _9æŸiÒj<ëüKc?kçŒw’3¨½âéíûY3ûOÀŽÔ²C4àj.ê
± áŸNø°©Fï‰ÏÞR&6ÁìþeŽQ©édc·YWxÿºÏú›tÞÌÙ:†š#"ó9HïŒU*Ñm¢§í<žuÞÎý¬‘×…Ð\îVî{dò8a€¿äÓ’ô³fD™œ:‘L©TOe!-K3¼‹Èþ
T†‹Ìžž„pV›9È«†{£Ä'Õ¶Î]Å‘ƒo!ulh€ž7ýû)|¼þ™ædÅÁÃÝž.)+Ã@«Ð€iþ8kn–òhúÀ9¯ØG> Y*EX •¥k-Âi|™’P׃zà܈1§þtÍÕ–F 6`ù¨ˆÀQ-2BWt} -Ô=„Y~p¹z÷¹}péæøŠñ–ÙáPä¤dxÈj€ -ÏØÿOº<zzÓ/ÓMŸÚõw{l‚¹OÓÒÅhÄàýùÆØï£ÿýl=šª«×v8i~ˆ\ -$øèÈ’HQþÝ
if’$^ŒèÃÙߪºí£ -;fäÃÁ„xÚ"$çê>‹?Õ$LÆ.@Q¤èŒ¨Ñ—‰*¹bR%fVT(Zùöøi -E È蜔ú/I)ÅTd̬á'R>¯ÎÁ6ÿwËÏý/Òÿgññ¾,üåÿóþ *3¤éè(“”E)0ñB¹Ò=†Ëþ‚‹þ?]˜Ãýendstream +/Length 2674 +/Filter /FlateDecode +>> +stream +xÚÍÙnÛHòÝ_¡·¥ˆÓ'Ù=ûä$vÖÁÄžu<À“y EÊ&–"‘ò1_¿U}‘”écã0.VWWW×ÕU-Ót¦dL¸³T‹X*gËõ™]ÁÜÇêhžh1¤zwqðÓ1Og:Ö Kf«/¥èì"ÿ=zÿ¯Ã_/ŽÎç&I”Äó…LHôîäôƒÅh;¼?;=>ùøÛùá<ÑÅÉÙ©EŸ¾?š/¨’Ö3Çá‘Ç'¿Yèãùáçχçó?.>]„³ÏK ǃ|;øý2ËáØŸH̵’³[ø 1ÕšÍÖBòX +Î=¦:ørðïÀp0k–Né/Ð,„Š/Ù–²Xk)¦·%``šŠ'xÙux9Я³êÍ›$,N Λ—ñ¥±–’¡}5‰S +³)ç1A˜÷lu,A‘Ž’Xr‚Š³ù"¡ÑüÏ¢£}s +vмOt"ë*´1ç<ä4¸§!*D¬¨HfC¾vTÛóa§Zêñþ_6Ų\Cq®£Û묳ÈÀu¶.ܼq"„²Í¦ÈÜ<šGcrÀKÀÍÀ‡ê"·˜/g‡Ã©ecF7¹j#çÚþ‰n7xÐÉʸö‚ëXA†‡qmÃî1ãé0¶x¢¯„°"k1 X ÿ¸ö|¹ èÒavm‘?ð\oopµXÊ„=íCªÇ"PõN±lê.[v½BÇŒ=·} šØäRČ켂)ἂ)y‰Ú©
ÐNm€ón°MXÒ§F±ç8eÜ¢ŸêÝ'Wc2žn!¨nîÏ.^ã_1þ÷}n +úBˆ+-Ï—.ëʶ+—.ŒK{ê$–/ä…AeŠQ¿·ö"^u±Í:/ÿ¥óÇ-WÈ åº¬@ÐG¹r¹sÞ\7(s(*ËeVùÓxwϺîªúJ.5géÓ'ÊwëOVWeÝúÖ]»ð²CUÖÅ[þ·øyÂ2aGev|óæÍ´ >„ÉW"‰N9ô³Zhø Ó&zp Ul½[_šR`SJÀ¸q^[›¡u“nÌì +2ËÔ=à¹(ªÖ:0}ùÏŠžÆZéK^òô%-3 +ötïïûV
žéD +…Iÿg +×Þû +n_Út†su{;}Üóó‡FP¸§ t¨C«¾ÎSÐ'9Qjô¾óB–~ÅãÎGHRÒçœê^¢¤M'ÛbUl·öúzÞûeÁûFï”÷Þ†HkY:3AªGO@\ýŒÛÛð°˜Åä=jìÜ>a ÁÉ_§Í¿Ô@Ø'œ«gD5ô&©´Ù¡¾ÛnÛ¢{avPƒ» `“\ÜÙl ”·‚cûp÷ê‹+|´= Î&ûÕíú<ë²Çí5Tĵ—ø¡ö’,N.›ÓDÅ,ñµÐ]Þàý÷2ƒ1)ƒÁFƒá†Î`Ž
ÆdâËOÿóáìóáÉéTzí ÃNüw$¦bõèÛVo!b.…6XeeµÛ/$l7À. \Køb±²cK2ä:ÄïÅ’´¹ŽÛž? endobj 1310 0 obj << /Type /Page /Contents 1311 0 R /Resources 1309 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1297 0 R +/Parent 1303 0 R >> endobj 1312 0 obj << -/D [1310 0 R /XYZ 56.6929 794.5015 null] +/D [1310 0 R /XYZ 85.0394 794.5015 null] >> endobj 418 0 obj << -/D [1310 0 R /XYZ 56.6929 769.5949 null] +/D [1310 0 R /XYZ 85.0394 494.8753 null] >> endobj -925 0 obj << -/D [1310 0 R /XYZ 56.6929 749.9737 null] ->> endobj -422 0 obj << -/D [1310 0 R /XYZ 56.6929 262.7954 null] +1193 0 obj << +/D [1310 0 R /XYZ 85.0394 472.5641 null] >> endobj 1313 0 obj << -/D [1310 0 R /XYZ 56.6929 238.4558 null] +/D [1310 0 R /XYZ 85.0394 284.6288 null] +>> endobj +1314 0 obj << +/D [1310 0 R /XYZ 85.0394 272.6736 null] >> endobj 1309 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R >> +/Font << /F37 747 0 R /F23 682 0 R /F62 995 0 R /F21 658 0 R >> +/XObject << /Im2 984 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1316 0 obj << -/Length 3978 -/Filter /FlateDecode ->> -stream -xÚZY“ÛÈ‘~ï_Ñl‡£.TUÌ“<#ÍʱÖx¥ž];Æ4²±"š -s½9\¥×;hûñJpŸuì´÷úÃíÕïß*{íŸÉìúv;šË%©sâú¶øeõý¿½þóí›7kiÒU–ܬM–®þðîýDñô÷ýOïß¾ûñç¯o¬^ݾûé=‘?¼yûæÛ÷ß¿¹YgŒ—<Ã…oßýû*ýøáõŸþôúÃͯ·¼zsÛŸe|^‘*<È?®~ù5½.àؼJå¹~„JšïåõáJ•T¤ì¯>^ýG?á¨5]âŸQ.1NÚ%úE꯽½¶Æ'™’*pð—›u–¦«œËÓÓºmΧMInÈ‹âT¶-Uþ–š”JÕñïØB•ÿA>\K)aÓìz-«• Óÿ.4 ‘xcäõ¨¦4ú×ÉzÇæÔ-,6i1¡l¢Öß¼ØwqQìºVN&&38
ºÀ“õCö[Ù¢<ÊÂåŠÿ¶˜o^lÊ-u¢S7cËÿ~‡¿+EÏc«º[]IP‰„Jaº¶<=”'R™]Þ•‡²î¨úCù·4•uÕUMM”¼.¨ðs›ïJ^JV‚}yŸù°Òí}Ùïg$å.É\j 3öá
<ŸK‚ -XP7î6Ú[*Víl©º¹ÏOù¦+OUÛU&v
ýß•ôŸ·m³©`š‚êUwÏ-ôwºnUš.«:?ðPÞ$@
Àôjõn;y¤¡¸§Ï4v_ÞˆU½ƒèº\¢(öä¶*ܨ‚Ùå¦Â±eñ -)fÕÝ—Èr%ÃÐå”×»’ŠÍ–G…=µÔ-NµipŸ¸—vªR½ú©Þ?QLJ…CÓv³•74M/
8Õ>?·<"?÷UÉkÐü»<üû c86†gMã! ÿiU™†úGa«jºó -ž9_8–&`pxÃUù¸¤\:qÆ=;ÊŒõ$Ýæ@ö‰Kž^óåul -”çÜ3ÏÜåp¬¹US—D'Â$fñîtš8k¾æò¤Ï–oQÍŒ‡%ƒnÀZÝ}Óòò(ë‘Ú‰eØÑ)©A¡ƒÂwjŽkºaEo'üT㛀X*)á³vu3h¶i¸Ð:<T€&¸4V¶aºYâµ -^¢tVgatG84îÓ³!)¢îÞ-{WÖ$FôþÙK* -æʨ¨ÏÍ‘] ˜½ª‡Uhd‚û ð¿Û7w¨
†¶T¹µýÄÓ0)XâŒR€d~@åªùAíËE¯R;܉Ôåâ±Mâ™èn' ™–¤,a#óBDXBÚD¥` û…S9 -&°/+µt> -“cõ¦Q‹ZתSo¦\#’6›Ê±YmIÛÜHÒl"!m*ØfvÞ3ô5Óe¬™KkÙ½óÚ¢´Bk³ö°€L €ZöFëåks™y&0{Åð
>'øD^]…¢™²¯›2Œ´^†¡e
<“È; -Rú5ÒJ1л¿¼ÅœÒ35 ´–QD©Ù?Âæ‚›‰ÓØï|¤¬¶³(-?wÍâN ->õjKP¥»<h´îk˜"¡âí=‡¯[vˆC@Ôæ!&¿qþݪ.ƒ€B+ ;VŸã^ÀšWÿ¢µ¯6÷TÞOèûzvú¡}4Ž\z,qù¦ûJ:Â74õ׫ÜÈ+ÃÑK®˜Æt¡÷拆rÝ÷š¨b{ßœ÷¸KpBóýcþÔRù±9}BÍÉ2öv<ŸŽödž$ó—àÜÉD+e¾Îµ•ÑID®-¥Ñ½½¬qÖû Nò¹*þ7ïOá@.xÝá”lÑû~ä=@˜:33Œ"äÔÕÅÛƒBÊdòz™‡RI@æû[Øë® y% 1h…2ÉúRO8IuàÅní%*Ù_±Ú6<Kù9? ë÷XñŽ€ê·È×8W•AÊG€rwÞížf¾Í)oïcˆQjÓœN7nu>vÜ€•øøPbæÌ -jÎFKËÍ€#$QIŠü -¨Œ(wO‰©ã)šsG‰>lìî+&s"‰,«8MÜbµW
Í\ØDñßgÀŸß’%0¸¥Yu:܈ò«HYßž÷Dc•³)ÀÓª½§Æp,Ñ='rÌز§ôø@€bäža-ÎÁííq¤æ¼9ݧ3â–’$ývÆðF@8þŠhÛlV÷å«9–
nÇÐó0=KÍäÝ`S÷’jW±ÄÖˆÑÙ#¯j{’¢Ýd¢‡ÿ¶xÄ‚¦³æòÏ_TS€+ÕÇ#½PÕT¨ˆ hÜ>W‡ó+²ÇCÅ:‹íe^‰h<)0”¢Z -Õƒ-F/uÈ|ú™V©¨U¤¥:Q*©i¯jRJR5)ùí¤jHaUCâXÕ°©W5l$ Dr|s"»¶’“€2¨R§ª¶V©`å -ÓÇ -'0ÙMr¾¶Ñø!9«§hÁÙ¼a—EÙË5Lø¸˜‰621Vš!£EÈ -”Ñ[C|‰yyìLƒd|å -*RMÄ°{Í)3¨ŸëöÑ5MÁô'¢ó—*@ñ<ÿ@qÉg¦‘ÛÝy·¹)&>ÂD6Ðû¦èÓ‹èã?͉%ðËrŸy½ú+Ba°·Ðž±Þl·OTá@4䜃ÎP9˜SýU(K‡…œ'‰º‰spöÙ]JŽ -¼_üè/…§ý¨éXÀB„z’«Á/æÄÒo[ÌÊ$uý+cð ROù -tž§ïëJêu½õaåÑB´…à‹ŠôÂzVfk=1·‹o.6Q¾çÿè—¦‰âi¢2ë¦jvW΂°Ù&f!ÙÀ{¾
¸©¤ë¤íÓQ–.PöÕ!ß6ºAP¨Ï‡;JXóÃÉzs>
n!Òªú®9m‚JÌ+Ši^qb‹Æ‹Løæq½«òç3t” «–ŸRºdÿ™Àì÷Äͳ¹#ƒ;ûÐcì&Fž{—LÈ7’{cý–KBt6äKú=¯,΋Rfu"u:Ñ’øú*’Ô‡××£wXZùõ©|º½›4“óè]CôQ€(Z¢,}„àT¢‡½Â"óÏü$~¶¡µ„ë‰R~͇~2ñιåÏüÖýŒëñ”á¾Ù[hµRbX9(K±„ËÄ
×?i*èØ:ô¥|˜§ÌŒs&§ˆMnüÄÖaÆó›;”ÈVàÒ(8øŽ¢ -FŸMöÝ×£þÄñéËÚlVÜÃÇ2îÛY0ªæÙV2·£Æ;yöÙfìóÂò³™†Ïöpé˜zÈV]¾çOð9«ármí4Ûà²)rYˆæÿ‹'²Á„÷#ø½Fñ
»/®‚/Þ¼<¸P”WjçÉ\ÓøÙš3»:ïÎ}ºÃô)4âÿ»².OôÝVÏ-±ÁÄp¡Ó„ -„!ÎÁZp´Báx„˜1vB‘l&SúÁ!]gÊ®^/%@¦O^!ÑYíª:ïzœ=/åë&ðMÏ%fx7¯ØËŸ"ø]ŸØÕ±íî)®'Cþ`âb1úzžßyNœNy“XØòºPA›[—ŒœOlf²PÛ$©xö\‰³BÙ<¶Tð…ÃyßUÇ=wÁ91ÔRø¥f°ŸÂlF™u¥Ú+jeþb¹âl€ÈtbŸ}a5r(öÌEŽ=ÙýYú\|ÜX€´ÿŽö_þP|øŠ^ƒ?çœ\†•f‰“ÞÆM…/vŸÁWÿEùóÿ™¹lùendstream +1317 0 obj << +/Length 3317 +/Filter /FlateDecode +>> +stream +xÚ¥ZYoä6~÷¯è·m#†‡(‰Ø§ÉÄ“8H&»y˜²Zm«££ÃvgÿüV±HmÙžl`À"‹W©Î¯¨b£#i6± ™æBo²êŒonaìû3áæ~R0ŸõíõÙ7ïU¼1ÌD2Ú\ïg{%Œ'‰Ø\ï>m#&Ù9ìÀ·ï~ùðþòû_¯ÞžÇáöúò—çÔ|ûþò§j}õöçŸß^"Ñbûÿº¾¸¢¡Èíñíå‡ïˆbèñ̦Wï/®.>¼»8ÿ|ýãÙÅõø.ó÷\á‹üqöé3ßìàµ<ãL™Do Ù0Fnª³P+¦C¥<¥<ûxöïqÃÙ¨]º&¿&¤V À))^8–Žàp¬k†1K$ON
7LÀ?ØRÂÌ„ËQ'RÌt"„faobmX¤¤²:ÙµÍáïP60]ͦƒTbÆpλ¾ËAœa¼‡ê&o±m›=Ñþò¶È;êì›–wEvG{¿ºËÛûÜïŠ.k°'’-q +¯ÀóÝ¢’ÇB£JŽ²Û}ÑÔiY:ŠS76Ñ0V4+CïÔRÌižy{Á¹SÖÀJë¶~™_¶&!Å%ø8N +–ˆZ
6Wb««E…) +úG!W¾|Æ=§Ü=ËÙνÜ(‹@DPBħʹ¾:DO +ŒÐ‘®ÒOr-½3ÓŠöi%BÐÜ÷T¹Ôˆ£ž$BBé†êàŒ2¢¼i'
TñÙËÛû +@ŒoVÊ*ú´«_¡¬Hûâk‚XWºŒ™Ë‚o ¡ 梖…Ò¦Ü版9KB³d" à¶ÂKÕÕ‹QD°0âúÅ("´ü.ŒÔ&®˜ð±‚‡#åÐt]üØž…'øN‡<+öGGt R a:95 ápðP¥,ªâÄÉG»Õ'z·>ݸ…éÌ{oÜì¡[—ªÔPv*y¥¥“lWü¹&W¨°¹Òñ(z¨ÎtdÔópjB(ÛO
Fœ•Ï¬Š²/ô«¢&ÿgùŸ†h§‘hBLD[&‹2ܹ#~YB$í¹sàä·s
!¿¿Öw3ô«ÊâX%µÔzºàsùü—³²ÈÖöI˜†÷pÓæŠð<ÁLH²f‚
+LÐX$|>‡½8èvzÈËrI¡õ‚uˆ´! +eÇ=]—–aNÂâ&½TÛš‡Ñ@[D'¹mnHznH0‚HóÑFí
¦œXƒ£Õñ´²íúiÏÜU‡Ú!G˜ã
HÎÙf‡ “«Ö2rnæ8l¼ßt¢jv!z³ }jB +¡ðü°eÛ^ƒfYžïü-’æi§sí6¥3ÊÜ_®Ú83ñŽáؾŠòìíVдh‰+w3 Ô”#(ÃO`tñ!¢…ƒ+S#01[s +`Ÿ¡ÜõÆ¢AÆ¢”ÚÞ-Ì)Þ *_q‘Ó$6-€±7祵arœu<8;öï²°cÌ«öª’ûµoa!@½£^J®JÉ£¦Û~»jOOàX :¯Š‰YxRÝa÷N»ÜÍDSþšƒA¡eîOqÕß|sú¤°bÉxÖ b<u-a…»Ç0¶
¨dN^û-÷M U鸟¿H®ª*õ9ÐçÅæà¯g® VœÍ…ŠÿZ¸~òí +>+Vá·ô@ØŸä;ÈC{³‰ä”ŸÒ_œµ7+6¶@ï¾Èl89îÅüÈôp(é÷vÃCÚ wîS˜NR•Ø>¹ovZ´=ùÜHº¸–><êY$€ŽÏ<Ê," +g2”¾JjËïê/AÀTb“¨Y¾TXðS °'8ùCËÅVꤣ¡slï–©ž_ôIo¸fÔÚÁEKí§iî’+d< °Pó,XaÖ.GkU>}GWí!à~GÕL©§O©±ûŽ:ÿNó±åÑ
µý¥R›"ì[‘ðÉWT¿Gû‡/€7ÚOßÚ|_<–yý™þkßN*fðþuñnŸhÆMs‹šØtó¥i¿`¤Æî?éñyÍbÜâCÛÜ»<(÷í«{¬ýV +$„?pZ‰–|éßþÕô#³âi’Èõ°ë~¢<SVkáÓTv®"¹Âúÿ endobj -1315 0 obj << +1316 0 obj << /Type /Page -/Contents 1316 0 R -/Resources 1314 0 R +/Contents 1317 0 R +/Resources 1315 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1297 0 R -/Annots [ 1318 0 R ] +/Parent 1303 0 R >> endobj 1318 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [116.0003 115.3513 166.1092 127.411] -/Subtype /Link -/A << /S /GoTo /D (tsig) >> +/D [1316 0 R /XYZ 56.6929 794.5015 null] >> endobj -1317 0 obj << -/D [1315 0 R /XYZ 85.0394 794.5015 null] +422 0 obj << +/D [1316 0 R /XYZ 56.6929 644.4755 null] +>> endobj +930 0 obj << +/D [1316 0 R /XYZ 56.6929 619.6136 null] >> endobj 426 0 obj << -/D [1315 0 R /XYZ 85.0394 708.4928 null] +/D [1316 0 R /XYZ 56.6929 131.4228 null] >> endobj -1208 0 obj << -/D [1315 0 R /XYZ 85.0394 678.3234 null] +1319 0 obj << +/D [1316 0 R /XYZ 56.6929 107.0033 null] >> endobj -1314 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F21 654 0 R /F23 678 0 R >> +1315 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1321 0 obj << -/Length 2790 +1322 0 obj << +/Length 3405 /Filter /FlateDecode >> stream -xÚÅZÝsÛ¸÷_¡·“g,Ä'ONb§¹ö’«í{èä2J¢-N$R'RvÝÎýïÝÅ)Q±}—NGÀÅb±Øýí.(1âð#m˜Ie:²iÂ4z4[ðѼ{w"Í$MºT¯oNþr©ì(e©‘ftsÛáåwNŒnæŸÆ†Iv -øøÍÇ—ïßýru~j“ñÍûN'Róñåû¿_PëÝÕùO?_N„Óbüæ¯ç?ß\\Ñ+x¼~ÿá-¤ô8ÂôêâòâêâÛ‹ÓÏ7?ž\Ü´{éîWp…ùíäÓg>šÃ¶<áL¥N ÙHS9Z$Z1(G–'×'ÿhvÞú©ƒúœIe䀥R N™Qð -x³Èq@*:¤"eBJ ü‘¦Ùde}›oN…Oêj»™Å9]öD”©s²r>ÌW aóܛִilœ6[fÛ:¯á(=®×ù¬¸}ÄŽ7°?úþçû„†PŽ8dÂX —œåd>÷ý¼<›Š^L7XÍof4©d© ´Kµ–^ Ûjs:Q<ÿ»*sléÝÖüøCÑ,Âø"§!ZqU5aBoîÌìà] ¶×÷ùòñT1;M¬_Ò‚vGÜh¿8Òç›òJàux2Êif´3/:òI;«§Š%eP <ý!ýʹÌçÅ’ãëbU,³M؈&• ="=Í·ñÌ`¤»-ϱ»-œ{d[R' —Ô/¶8ÅR•ñŒý\’èv¼ªHT²¥K%ømÐÖ<o²bYŸ˜ÔyN
²^hÌóz¶)ÖMQ•4PÝù’Ä@y©“Z<é¤Úª?à¤R¨Èº(÷±QYP²rd¥bÖ‡(E/7w#j\u`¥Ÿt'ÂÚ!_\ÿý&꣄0Ìî‹”Àñ@–žHøÚR=!È!7„Kp ¥T,Á1a…| -}E<€²j -6
S½±xø$„Üù1C5…"ÊË
© -‚çÃ"”˧¨¨¦S»ý>©Þ«³]ÅÓNzåßÈà
W(4‚B¡ÕjÚÃÚ±Žqéžç\Lè}RÊÛªÎ÷—Þé:±R5m
í¿W {PùÛÅ?c¶` ]0{éæÕU7ûÖ¿SéÑÞƒ{rj>Ѿ F;©Ê·g¤O\ürÓçkM3¨4$¡Ê!D!RÓèj»lŠõ2§^')nŒ I6[´sk8èà"i0¹4'ÏÁëhÉyi¸ÌVùé¯
¬Ü»ÌTÙ]¼ÈÔT³jyãCÙbu¶—eµ—t¯3ˆ½&ébÔ:x5ì&ë]ÞõgÒ®±#)"åáj—"Š"Þùß˿‰ƒ ¼¾ ®¼ª`Igô^mø ªÕºþÜÍÓ÷{•5³Åd¶,@’6Ÿ÷,L-¾xŠ/K(8þû«¡€N| ãƒãöêûc̺Bm³kÈF&äÒHÿ˜×_ªÍ—²zºFðê©ü=lHù1ã’=L@dûÒúÁþœÉ ‚Ÿ_$ȧ,àXH ~î—?äù§ -/Ó.Û÷€.e -§ï'`dø„€©dVò¤'¡=Öl˜µ"š|u»;ß@Ëý¡ðÐ5í§Š[±¤—r17d\Cé˜RŒ+£{·ÌôÍ—j0h„‘«
³4€VæI{—É¢ceØ9be ¨ÓíÊGLCBnìÈh¦ä÷0²Ào²c8dcPmâªß°1‡ÿßM¼ÈïÛ⥂%iW¸cæe·m&LrýÜqó2²2æ5ô¯ÈOð¯&wV¼ÍMþô?Zv÷”$‡/¿ €±Ä“ ”Ï‚Ìäñ¯/‡¢ÿ¤¼Oendstream +xÚµk“Û¶ñûýŠû¨ëXñ"É''>§Î4Nê\:í8O¤N¬%R©;_Úü÷îb|ïOG,€ÅîbŸ +9cäG‘WÍ—¬]óý²)/Tw—Åá!bˆa—}~6‚ í!«šuqh¾hõr]vYKÀ_cS«®Š%L¸ ÿˆ®nÞtKÄxÓ‡˜þTÜòºÿÐ_ÓÊêj„àýý#Qzßþãùœ6õñ°*zN˽þ˜åyÇ!¢©‹”L
`ŠRŒGô?d"—¦Éé +¥!ö2R1|Ã@{l¤ìÐq¥„#Çðmv] HƼÆߨ44êUN§)»+DÓòžs^IÙbvÙ·Åœ~3qZ…9¼ó”qr à`S)'¶K»L%% +âÕ¦XS˜F:«‚‚fÍÓÛùì*5‘]~ö˜‰B¸2*Øs½ç°—U¿Q@!Ørž +/ €Ð˜ŽUÇ@Dó’ê_ŒöåjCÍóvÈ¡ë8tœôÃø`¥ôØÊÃöuû5´tpß0Ô¯²ƒ¬WÏ¥bß>œ3Êe7k$‹fS·H%$¡Ùö&ÛtlßÔ‡Oh9IÂù!ÀöÇÞʞđ$î>wne¤•2Ovç:•!ID©Í:J£;#zÜâRçF~’ù*ùߟ´O¼?y†¬Ïº=—Ñ»y”=@™6“Ž³(2šjÃéA£óÊò:‡VAŽÌ*ηpÖeíï• +ýŒ4;T`¨L<¹OªÀ’îZlüÐyw; É%ÖM"&Ôµñœ,_O"ˆe_^ýDcôü‰ .Û-iŽe9ˆª-éÊ +È´l64èÙÒq
Á3çà£@kàt½9x1JÏ°p0£]<ÐŒ‰#%ÑÝuF iÆÕuä3,€rüÁÖÁ±y·º-^L}YŸvŒû<¼ž¥áÊnp¨}Ì´ËÐâkèˆ1Ù£¬z[Ò¢«"ÿ<gš‚¥³å>'˜1SpWª«G:¥*˜©PÁƒbpû\îŽ;ìÈÎ*¶Y/ÿJDëÉ€¡ÌR¨ÎÙbõRù›O7±*¬Š¬TGJÅ3íLMJI¦&%¿ý +‡Ïrf¬Õ³"»—@¯±PPuOBГP$bÇ?_–`Œè½5Ô—x/“i‘¯< +}¼…ÿÔˆ
ÿf»¾¥¢þÎÙÛµ}8MC¾ +
é°‘1’`›ˆƒoŸí}—#àw–á,:KÙ‡ïÂîùbP,ç¾ï‹»ï¾økÂþSKFÊZÙ}(8y¸H"+]ˆò_B˜)åÝg‡wIÿÝíúendstream endobj -1320 0 obj << +1321 0 obj << /Type /Page -/Contents 1321 0 R -/Resources 1319 0 R +/Contents 1322 0 R +/Resources 1320 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1297 0 R -/Annots [ 1323 0 R 1326 0 R ] +/Parent 1303 0 R >> endobj 1323 0 obj << +/D [1321 0 R /XYZ 85.0394 794.5015 null] +>> endobj +430 0 obj << +/D [1321 0 R /XYZ 85.0394 575.952 null] +>> endobj +1214 0 obj << +/D [1321 0 R /XYZ 85.0394 545.1349 null] +>> endobj +1320 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F21 658 0 R /F23 682 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1326 0 obj << +/Length 3013 +/Filter /FlateDecode +>> +stream +xÚÅZKsÛ8¾ûWè¶r•…Ń +FÇMfAo* +P,–6xÅó(Ńyë,C¶w¦ÒCGÄÚºnmÖùŽt±(Â˼Xùye;ÿpÏRr'ÉpϳwçQ/‹#&#žô¼‘yÏÒ‚ñ$}W¹_pEË`¯oÙãØZqÃÈ©T”Ló%¸Ù¨¢žt,R‹Ú½Â"C`”Î5X0€Þ±Uæ%Ð(YbÆY#qÖI¨××?1Æ´+»`YŽXAHfÛcZf¨uá #òпã'l,³J042Gl:€
„ÀX9rëxÃScÀÎ/Ž“.Ш£Ê ^óSÇGrpAp8íäüÆ5¿¹¾üp6<k™ûvo˜Å Ò»ÝjB«ÎE†Ïºã¸‡ë,ìÛÆSð¶áV„2,6F÷örpÕ5£žÙ¡4oAx¸ËÜVÌ´N×ß\c·;üEÀa᦬3ÝïXòé?½ ¢3ãû>«jêp·Ÿ›ZÔO¯çèŠ;ÑÉZ8Øœ·¸¦NkBG•¯Š´ÞS?vYº–ÜKç`ð»ÊŠl>¸¤Ç}EfЉßLB?&½‹:î²V8@Bá»Óí6+–aPõD&ÓMVUé*óOÏr¼ï®=uTË]¾ÊA¡m;×M³»§E€íŒØqGBÚÁß÷95–}·4Z2¼C õ‚0´bÊ5:p|¾®ïÊýê¨÷›ÄÆj—n6éŽðæ
oÇ®º¼X›g°[3.Œ`7JM×ëò¡¢¶llöë:ß®ý” +ÊŠ¤ï¨Z±öV¬öÛm¹«= oü. ²á•=FX•ûÝ"»Fáf‘I`è©£r•ñq¹³{3"ÚÉ7qܳ<zF¤)`nQÕÈx…ÞË_î#êr㻌ŸRRÀ.2?d¹$›U^¦óMx1÷ÒÜ
AFOàªTb + +ÞQtƒ(0Õk{Th +©S,å EW’Ùÿu‡ r!é¹fUï\2ŠÃB%õ©vwüc9ïçÃq¯—ë~>3ƾ|ñå þÞÉ}~ÿaÌÖ°ŸÈ2kxû]Eò—ù•Êò–ÚÐm_ñîñŒÆúÑÓŒ#Â:?<¡C‰:aR6Ÿ:UyiySÌ«èñÝÇëë‹·Ô¦"ZýHOTY(ëŠQ"Ü™WAá¹ãØ]8ÅldÕD!Æ#ÃyšS6ãgÝ cTn(·Ï)a3³»tM8$]á‡t2ŒznÒˆNº*Ày0é¬0ÉÓwöÆÞ {Ó“³0üvj¯Rq_®ÃDì ±ÝÏ×ù‚Ú®2ÑfjÊ•/ð§(‹Yº¯ïJX/Eø§nÿCñf½oEùP¸”MOç{¿À«"llî§:gqèI +Oeý\j´&Ã'ŸÜC«çålÓöÃN^Xi_Pµ‹Ô§ÂÝëÚø#BmOïÒŠz晫…j÷! Ïoµojkn¢—Òc½;µSÑôŠi®îíàw8«&YiÝni@˜p—.Ã~NÅ”¶$¦÷é:_v&~Ж¬yŸcZ·ÇíoÚ›~±*×M…1p¶µGÈ7 í×nóæ +8Lu¹(×g0Vx•ÝmÎ,«©Ñ½Iáî5Q£¶>ªA›´W»ëÏ$=±#ÑÑð(i)¢ðñ>Ïþ(ÿ&HŒ—õmåL¥4°R=°ÔgHV«êK—§.âMZ/îf‹u;iø¼ûÁ¼Ðâ«ñuí +ØÈŒBÇ?fÕ×r÷µ(GsÑÍœyèß<åGÆÿDRÈöµ‰ƒÁœ±ÿ^“ã¿°DÞøßþϦöß¾¢˜)kå8Ý” +endobj +1325 0 obj << +/Type /Page +/Contents 1326 0 R +/Resources 1324 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 1303 0 R +/Annots [ 1328 0 R 1329 0 R 1332 0 R ] +>> endobj +1328 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [87.6538 683.0228 137.7628 695.0824] +/Subtype /Link +/A << /S /GoTo /D (tsig) >> +>> endobj +1329 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [370.941 719.9611 439.613 732.0207] +/Rect [370.941 574.3534 439.613 586.4131] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1326 0 obj << +1332 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [432.8521 465.5772 481.8988 477.6369] +/Rect [432.8521 316.5051 481.8988 328.5648] /Subtype /Link /A << /S /GoTo /D (DNSSEC) >> >> endobj -1322 0 obj << -/D [1320 0 R /XYZ 56.6929 794.5015 null] ->> endobj -430 0 obj << -/D [1320 0 R /XYZ 56.6929 621.0496 null] ->> endobj -1324 0 obj << -/D [1320 0 R /XYZ 56.6929 593.3949 null] +1327 0 obj << +/D [1325 0 R /XYZ 56.6929 794.5015 null] >> endobj 434 0 obj << -/D [1320 0 R /XYZ 56.6929 514.8384 null] +/D [1325 0 R /XYZ 56.6929 474.1474 null] >> endobj -1325 0 obj << -/D [1320 0 R /XYZ 56.6929 484.3742 null] +1330 0 obj << +/D [1325 0 R /XYZ 56.6929 446.055 null] >> endobj 438 0 obj << -/D [1320 0 R /XYZ 56.6929 330.8003 null] +/D [1325 0 R /XYZ 56.6929 366.5019 null] >> endobj -1298 0 obj << -/D [1320 0 R /XYZ 56.6929 306.1104 null] +1331 0 obj << +/D [1325 0 R /XYZ 56.6929 335.6 null] >> endobj 442 0 obj << -/D [1320 0 R /XYZ 56.6929 176.7683 null] +/D [1325 0 R /XYZ 56.6929 180.4336 null] >> endobj -1327 0 obj << -/D [1320 0 R /XYZ 56.6929 146.3041 null] +1304 0 obj << +/D [1325 0 R /XYZ 56.6929 155.306 null] >> endobj -1319 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F21 654 0 R /F39 858 0 R >> +1324 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1330 0 obj << -/Length 2380 -/Filter /FlateDecode ->> -stream -xÚksÛ¸ñ»…&Ÿ¨™ˆÁƒ/ÔŸœœ“óÍÅ—:n;Ó\¦C“PÄ EêDJŽÛ¹ÿÞ]`Á‡ÄTrïF°X -ß9ðöæçk½»»zÿþênþùþ§‹ëûN–¡¼œIä·‹OŸÙ,±º`¾TI8{„ ó¹Rb¶¾B釔S^|¼økGp°jŽNé/”‰&"žP àS -•I!sÝ´E•¶E]5(
œ‘ƒ3°•«$€‹psV¦»F£ŽBåÝ,ç)¥W՚Ί_: ˜0ðêvED‡ŒpÉý-h©®Ó6[-²²ÐU;ÅCºŒTL»Ó*Ÿ )@{`ÂÅ¢)<ÂÉõ2Ý•$I[ÛÑÐ)ª/xz¶QèBŠÙ‚s_…¡°ü”%º„òÒ<ßÎyâé¦Ñ"ï¦êÖ -äÃÎ<ŽÙJg_‘¼™Ý|˜ 3%ªü8ç:S{Ò$ÿS{\ùA†ÏÑ^‚G„;’¥Nв!áÚô«ž¸j!Uì3t呿ꧩ[@Ô(œû=®ŠlŠocTTï‹\#BzÈ -„BÀ*)Áœt¡ vÉ£iÓV¯‰s [ÐØ_*c00jkQ¿ -#Ƴç8”e¤€ôpKS—{tsYÕcguÕêom'ªÑÒ—ŒÄ‡=…™Ü6í„6$¨rÎImD"v*#× -¦ÆF%õÙ ‰q4¡¼ƒ‚-¸?ŒÖú°Ô¤kZª:ȸ¬¡|›’°ÈeƒyÊX^,Ñ—Úú¤qbØâîQ^ž¶©ÅÙDÀ-}A(S¶`œ$§œz_‰Ù8©™4Œþ¥¿¥kàñ%93Ô²b`[¥%‹5ª[†ø8XîSúmEgìÐlJçÉ?Ü~$œnw¿ãjàÉïÓ -óa(¢CéÂ[øÌÄé -'Ñ+Å\V-Üñ}Ïôzg:äš’t:((ÉBÞ¡‹.I©¼)zûØ@Æ0ÀÍËÝV¤’ÕëMQê|áLØ»/]ÖLfo£¾Pà%Ʊú÷ª=vx%Œ‘ƒ@Mõ@ײê - @khÚ/v† 9aµ&†R zEˆ®Aµ^tÈV&Þwx«[ܵ5ì.2°*5I‚/¸ƒ´œYU -ôb£ødè™q_¡ÐÌIBÅ2ù^â±€¤ÎªL©d¢z -N`qƒŒõ£j pj©F11ºõµíÓ£ýD“Kt‘ -ò¢©Þ5ô ëð]ïgèþ?9ÿb÷J5ú¶‰€%ÁØ6ÙEày/\³ÿÂÎÿc”%Cxe†ÞW¯ì–{|5«zWæ¦7‚5GÛÎ*Ý>ÖÛ¯ƒÒqô¥{HXVÌÀ™o~¯’K‹øýÒ -'ÛþƒŠáWo÷EFŒÑc&G`Ùœä–èbÊÃ}Oº9Ÿ§”.ªÑ)ZBöA73ìh‰œÐÏð³"\À2ånƒ²_îrÓ×›ûò|k?\Žèņ®=4ŒèÃۺʀ“ÓÞñ¡g4pÕåä#´(ˆ/_~þðâ’"wŠþïg,væ‡^ïÞ°ç{ýûÞ¿Mçvä,æ£{ šÂâáéÀœ›Þõ®éíþÌx€qV Üéå®yF8•ŒD;Çû«úÙÎÙn‹¬uZú3ÝŸºåÎÿmïkT¿{€¢êfÃoR8„ò“$VN8KB`’þ!`êK‡^â弄#ú« ÿ^Ú3ækÊÓÇá×æ½Û¦ë5´ -ÇåMúLÄñ¢ú—ý †ÓO¦½ý<ÒæiMý›"ã_pÿ½±NÜ?üO_ÿ7(èL&‰èÿĵ‡^¨ú1bÊ(6>ä¼ûKð˜õÿxÅÃ…endstream +1335 0 obj << +/Length 2914 +/Filter /FlateDecode +>> +stream +xÚZKsÛ8¾ûW¨rYºÊb@€`sr'㩉'ëxv«vf4Y¬P¤F¤ìx·æ¿o7àC†#e6¥6¯_ ¢ƒ_4“IÈ„Šg™ŠÃ„EɬXŸ°ÙŒ½?‰ìœ¹›4Ïz}sòòÈf*T)Og7Ë/2)£ÙÍâ×àÍço.®Oç<aAžÎ“”¯/¯ÞR¢Ç›Ÿ¯Þ]¾ÿåúü4‹ƒ›ËŸ¯¨ûúâÝÅõÅÕ›‹Óy$“Þç–Ã3/¼»ü邨÷×ç>œ_Ÿþ~óãÉÅM¿—ñ~#&p#œüú;›-`Û?ž°P(™Ì ÁÂH)>[ŸÄ‰“X×S|:ùGÏp4j^õé/2L$Ï| +T>&*LF¾Â=¼|Ç£Y…*I8Ne³y,C%$7“P1œƒ–cÁ}©H Ÿº¼Ók]wÔ|«cŒ×eW65õäõ‚ˆ_ÚüNÛ…ÄH$X‡'a–ÂAã:7+ÝK3LŠ,®p»8Ç,ÿ”ÃTJi'µcÉÒ lé™ÓcÓ<èírWa+–:ïN£`·=d ©¯YÒL‡¤””Ý*·<+ÝM¹ÖùÚ¾Ýêí½ÞÚÁº}èiz¼½úDÄ;½}$rQ.qù¥6RÌqƒp"TQ¦fóþd`k°© +_Êd°Ð]/ÊúŽšFëð|X5D˜mÃ3o?Ã$€¶P"¸ì¦ƒ›|ەŮʷŽí®Õ¤ —ÍÖN_o*£Ñ~¹vS•–íût·ÛXÆe·jvÙ +s{ «]å÷Ä Ñ5ôÜžÂÊ7ë]Õ•°µHmØs’a¬xb8]äÅÊ@ƒPÉÄ$!#bDÄAµËºÅf„'‡½}¤ 8ÐbM‡Qö ÚM^Ø~ReUÑ”[;Öj]uû8Y§ÝÝ‚&§+U Òæ±J‚s‹´ät!4t'³`wÅ +w
ÄŸ”°€»±ah”K+;;©mÈpؾüh_^,ÈBÚ–Þœ°îœåN<Cq[#|}Ïi + ¶ËD:K“ŒÇǸM*cî>§9ï9ÎÇ,ŸzD!³0Q0ÚOC1ÍÆö…¤„,ƒ¨óÝ„ì92æQÈR8ä‰UÙv>P§a–EùÍr8C €ÿÖzBB–2gFÎ q&‰’>Œµ „€(“: Š*w‚–
0XCb¡[ð'9ì@°™©c°aG6l<6T&ýÊÏ‚M„"|–‚úÓ(ãßl–ã|ÌÒ¶4éhá¯`-
eœeßOÆžãcˆµOo"äsXË +é^ª2= +_‰”}e¡—9FÚ †M|>Láè˜#ÇÆšW&ÕQc³ÒI„HƒËºë37e£² +ÀèŠÏ6V+Šû||[…ø›IÈÔžcÁøWµÀŒã$ùíI|…÷ž(wZ»¹.ÿìË7!Md£M´øY?¶Ï$žIìà÷°*Ážáâ`cTÔÜ—4ˆT( +þ +¦nÃ>µTCWÝSV06ªë8%-úcÓú—@SÜ:*Xä]N}äȸµCwà l— [ðô²SN½g¾š”*]8ý%ÇZ÷Ì‚bY 6°ó +齋
ìûØ\âÖ]†ØjÖ–ÍxaBŒÊfo}û!¯Í
°W™tl(ð™†Óe=Lô +q’ÿê™ÕÍ0aÞÚÂvæÕNYZææðÎF +ûóê)`ëQ*€qª/8ŒØs¸*¶bÅî$•É
èI›ˆâ¾cœÎ(FZs…)8•MCXå÷z‚f«vî$/1ÒØwýÛ'êžá$:>²ô»~e/¢ ¨Øöôà ÓŠlÚ䎆ÚØLE/t]ؾÆÞÿ!×ÆquŽÀ¿ð½PÕÅü(ÃdÑ“tÁÆC!#Ì8â©ùçiÁÜ-H +(0ˆžÎ-íÓ—Gñxøòj:
vk½°|¯šÎ®n͉¥¶J1‹Õs÷úý ôzg2”’’ÜoÖÉ‚ß±>!i]y[çC.À†!.¯œï¦= —ÜE³Þ”•^ÌÝðµ‹ùo'ú¼ÔÃír4R?Œj=%²€3fGxÆ8V¾¼ø’¨Î¡@h
öŽZHÚ ÇIk|¼+Þ_ó÷Ù9ô
W~øE¦hÈ:qU7¸ë˜]pª6Á+¸=·\*@t0÷H‘Ø‘ŠÜ1`×åUHÄyýèMÙâ"€S–ñAeA©ž~°KL¼.ßÔ4`´gˆfC#•¾×õaHMŠzï¶öNGIÓD÷'og·åÂ"cáRë,Ì>ug&«‘ŒB,<ñÊž(ºàCÅË12³!BÑ-KùœŠ2H;˜R¾o-ÀÛ–@¹+Y¿{éÄ<pQ{K#ÃAµe ¿@ÚT”·FePè+•yÊ·£c€5ô‘eöŽ½uÙ3.Ê£7ˆ¹P‚ˆ +k¿®úr«¿¶Ï¿{.‰a×"d2ÞÛ69»÷Â%û/¨ý_£,‘@•™ì¼/_Ò”c|Hµ«fW-ˆ¶5’øEÅŽ7µjÝ=4ÛÏ£Ðñ䎥/$HóˆXh~/å+ê O¸æ[*~0dñDº[{…íp¡bäÕÛû²°
´Ñ§BN$À°é•ÖòE—‡óu{¼L¹]¨APt¶s8„™oe‡,ï}°ÃܾPn5ûÕŽ>“šõèÀn§ü§Û†¬Û?>˜7Ae$Éa´€}h‡Œ–zå-BËjùÜÉ.n_¼²–ëãÿçƒýqˆ}Ô»öxÔðm2·'`1—î½%hkø¥srœ›¾/›];œû7ÚĈ£áZ/ͧ¨cíÀ©d²µcÐ_7ß~ +)‡oKÓ¬AáÂ!L[¡ÌK²}Éû?³<ý="c¢endstream endobj -1329 0 obj << +1334 0 obj << /Type /Page -/Contents 1330 0 R -/Resources 1328 0 R +/Contents 1335 0 R +/Resources 1333 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1332 0 R +/Parent 1338 0 R >> endobj -1331 0 obj << -/D [1329 0 R /XYZ 85.0394 794.5015 null] +1336 0 obj << +/D [1334 0 R /XYZ 85.0394 794.5015 null] >> endobj 446 0 obj << -/D [1329 0 R /XYZ 85.0394 122.2879 null] +/D [1334 0 R /XYZ 85.0394 731.1791 null] >> endobj -1228 0 obj << -/D [1329 0 R /XYZ 85.0394 95.0525 null] +1337 0 obj << +/D [1334 0 R /XYZ 85.0394 700.243 null] >> endobj -1328 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R >> +1333 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F21 658 0 R /F23 682 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1335 0 obj << -/Length 1016 +1341 0 obj << +/Length 1132 /Filter /FlateDecode >> stream -xÚíX]sÚ8}çWøvFªåoOŸÒ,ɦ³MwYúDF±ÑÆ_•D€”þ÷•-ì@ -†ffw¶Ã0¶¯¬££«{¥ã‹4]þf;Ðñ
_s}Ú:²µ îèÚL¶]wPù¨^õ·Þ
;o®LWó¡ïŽ6œÖ°<¨{Ò†á¨ë@ö$‚Þ½üx{usýipÑsîðæãm¶Þ½ºù½¯î®>\z +xÚÍXÝsâ6ç¯ðä :#Åò·§O¹”¤¹éåZŽ>ѣ؂¨ñ×I"@Êýï•-ÛØ’™X+ë§ß®v×»Bš.H³èø†¯¹¾mÙZ÷tm.ç®{¨|T/æ[ŸÆ½ó+ÓÕ|è;†£g
,ꞇ´q8é;Ѐ‰ ÷/¿Þ^Ý\ÿ9º¸V|óõv +d©ôé¶ÔÌTÍLÙ¢r° „ðîcð$© ³6<ͦ9ï3K™¨åù Ü¡Ü`ò†5’fÅ®³‰ƒ<‚Üã¸ü¥Ûú³d3Ã4ÚÐy’2"e¨µÓ©¯ãÕ»Â-i˜…J¶&|š²i’vV&‚Ìë +˜ŸŠ)ú®ëh
ù6fE™bkBÓ>Ì<9MšÎ.Mφ¦Üýƒhúžáî=«¼Æ\–j²l käq:O8¢¡üªßöT%Õ#=]Vø˜dÔ8™E™Ér衈·7Çÿé ÁÖGA ]ÇB´XÈ0!e$iUàfX<Eu‡åÏ„åÅ›tc„ˆ;Ø[ÿ¨+p5m½wÏ#üD—ù{ÊÐÓëü“{ô1½ƒñZï endobj -1334 0 obj << +1340 0 obj << /Type /Page -/Contents 1335 0 R -/Resources 1333 0 R +/Contents 1341 0 R +/Resources 1339 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1332 0 R +/Parent 1338 0 R >> endobj -1336 0 obj << -/D [1334 0 R /XYZ 56.6929 794.5015 null] +1342 0 obj << +/D [1340 0 R /XYZ 56.6929 794.5015 null] >> endobj -1333 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F23 678 0 R >> -/ProcSet [ /PDF /Text ] +450 0 obj << +/D [1340 0 R /XYZ 56.6929 672.4064 null] +>> endobj +1234 0 obj << +/D [1340 0 R /XYZ 56.6929 645.0635 null] >> endobj 1339 0 obj << -/Length 1041 +/Font << /F37 747 0 R /F39 863 0 R /F21 658 0 R /F23 682 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1345 0 obj << +/Length 1074 /Filter /FlateDecode >> stream -xÚíX[oâ8~çWäV²ëKœÄêS§K»Œv˜]†ybJÁ´ÑäÂÄf[f˜ÿ¾Ps-h´ÚBqœøËw>Ÿãcl!ýÃ–Ç ¢Ü¶\nC†0³†Q
YúÙ}
/ß«—@ùwÝÚÕu-¹C«;.ayy¶º£^ýö·›?ºÍN†êl -™Méª'¬}ªýY -¿æq,D•Å4TÈSΩòM¤ ˆí>P*Ü…/Ânɨ׫oäóµ’9ÍÚ}±¿2´7})—^ø=9&X5›,G<±º6Ù1B£7íðAŠGíÈI\ÊÓ)W™Àá“~™Mr½jŸý4žý œq’Šõ"\"^]å×v²\‘hŠHÄJŒà.‰QgúVɆÎRMv‰ç‡aò¾NE:[¡æý:T )‘¯†OƒPG‰¼ÿÇÅ”Üf?œNÊíA2Éfüp„ó8É6ï< Le«:ÆIªU]+£Ä‹š§þóQŠhèh’Y5©Tûp°G¤²2ý½"½¬sÖ¾´aáð»\Å ‹Üóïk3+ÃJ~9?†p¯ØŸëF¿ +xÚåX]“Ú6}çWø:#%Y¶5yÚlÙ-™†´„<Q†ñ‚`Õ›H¢òß+ +vjÀµíê@átRl÷â‰q”u½Ë.ÝÄ`óU€d”â"ÂP„<k)-E4:zà8PšËd8Ærè¬û/›ÚšÏôBϦöá¡"ÞßñTFAxCà9ƒ5ƒ8 +ç‹¡JâP†Ã¥Êî¿g—ü©˜ô‚Á@æ}“XêUrÓÝø„pù½ôòã Äl(Ác ÎsH:Z'à—ŠH›?Ø"2çªË^íÌ,8Ô©¾¯¶1¬ +•Xœ"}ç+Ÿg-Óè®À7ýß1žÙï“-Mf™a<J¼ä’DÓñ#—'(;Z‘r ÄÀÌ„öÅS}9%-ƧP: +–"Ë]ígÒJeVµ>_ǹ˜8…H^¤Èc`$è9ÄI~IQÈ<ϵ +ýëx>´eü’=3¨Tñ-žà·HÕ}M•y»f‹Ì¨ÒTéyT±M &+•458IÖÚ›pe#JåzPZŒDží¾M`ìAäø¸4 +¦Šƒò®&âaŸMàã‚Þõ ñ°³Ë;ô"ï @â0v˜åá_ÏŸ·˜Aœf%~y‰#”´ÙE_°oØ;tpvV16é€äCÉÕSº¸Ÿ½kRÂDËù)S!6M™†Z€lË9×!/\Æ ŠM@ëð0À2”.»4“¾äßX>Nz“ Y‡O/ +–†vúa Ô*õJל2X=Ÿä#žL:ø®L‹]æžä!IeRاOW®ÿÄû_Ab“ZÏZ“²G‹a Â…E±ä¯R¾››ìÚŒóÙOB>æ‘æ¸OgTª³s©ÎhKg¥§ûÄÂ0~ߦ\Î7çd©âJõLñÕ*$Í?ÞLÉ}3ãòZôJArJýƒ®\ÒþŒeéÏUÌ[†]xBÿ‘:äÊ óv‚¯X‡\;YÞªCÐÿ¸¹*ݲCWBarRZrDjþ¹IÈ®O«Svø>^µbR8k%¶}̼%©ÄD—m3_ܾ¦þ/
$þÇendstream endobj -1338 0 obj << +1344 0 obj << /Type /Page -/Contents 1339 0 R -/Resources 1337 0 R +/Contents 1345 0 R +/Resources 1343 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1332 0 R +/Parent 1338 0 R >> endobj -1340 0 obj << -/D [1338 0 R /XYZ 85.0394 794.5015 null] +1346 0 obj << +/D [1344 0 R /XYZ 85.0394 794.5015 null] >> endobj -1337 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F23 678 0 R >> +1343 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1343 0 obj << -/Length 2934 +1349 0 obj << +/Length 1975 /Filter /FlateDecode >> stream -xÚ¥]sÛ6òÝ¿BôLÄ -&¡äp¬ßƒªMÕ<ü¾úE©¤q[ƸvÉÀϽ{¬Â>'Y£Ò¸LµíkÙéïa§ûËä¼ú§–TèØÚ,ª41{ñ?™’c)³sKú¿ùS¨“l_ÜŸ×)`% Wý9«¹¿xÈ)×é´•jrëÌŠ,δaen\?T;´‘çiœë²€-ì~r‘öÕîмv= -T”`߸/Õ” è87Z,à-ª%Z½®Š¨îãøC⯶M½p<Ï&æƒHi’=wøD•qžæ©ƒ×ö§5yœ'þ´MÝràmµ¨çÎÒ<Nmñ$žaªÈòHâyLjMÇ·áÑÍO<ë–KF÷}X¹’þr@ÆÎ"ÃÚ
’M¼0·€À;e݃[ž™·ö[ð YVó¤õþbý.AÄƨèƒHDF@±ƒ²gåZF»¦ïÎÏÄÁüpn@´˜ozqSú®;‹ )Âã^=4}wdܲZ¹}3¼bí;pÉUXà¼Ø
ÌrÒõWìè8n®£m·ÃûäI”ÆPV/‹ -P8.†
*¾ÆxŽªÕý”úÄ2Qã:ã,iT"gk:ðÁœœGr€Â -{õ¤æ~Q™ªQà>"™8VmÏ(r^À¬÷xÙÒϬ„vÝí{8[œôxJ“ÕôLµ%
†`‡
†X¥HÊ8ñÔ°‰ê”Œf†ïŽ -²Çpèæ
˜lÃXÿÝîëj#Ô,£} -^VQøP&ºö¤Õ×Iå¹Í¶©^ŠLÚ¡ - -•¡¬Ã"'µÑG‘ãS—\€i1TÑ „ÿ¶“,ëx™´]2…dÑ£ -ZI*T>šâûÛoêȸ÷ÀtU¹a?Ƈ:k1Yeu>±Jþ<½ÖÖ°-¡Ò2žÒI -)5§úÿZøïéñ\Ÿd¹'µç@&mLþ´Âd$+€¶:0 -Ë1‚ R|ÁÚ)°yÛÔp'aš`8ëÊŽ -†ˆH¾S¦Â2õìN”U²£*$; /. -öºgÂQ–lwõ)-`I}Îî7ìûù”ž˜¿µÑÝõ;]ê‚£´+Xy’Tfí3;`¬>êkƒ XNÏÓ÷Áh×í»ÝÖMäðÒĵ}í›YR˜±¥ïjIAFòƒô½Õ®u
S‰HíèœZ➧Coí7;7¡ç?ëŒ^ÜG?뜞mØÆ^þ‘gÔÎ|c‡”&E¬sìŠ3g×ùÔOÌ*ü‚úÍ?hŸ~íO¡ç/Š$´dç-|^ÄiLL#/”c®žýÜîùªÑÑÿ…wQÒendstream +xÚX_sÛ8÷§ð£<S±¤Dý›<¥Ý¤›mv/õ¾\6Ó¡m:Ö,yE¹®ïn¿û)Ë©ÒK¯7~ ‚ ü +É.’ér;áÓGX{7N&ôBáPêÍ|òú:Φ+Ò(Î×]9ãy.¦óÕ}²ˆÍ@Þþr{}óî·»ËY&ƒùÍ/·³0Jxp}óóQïî.ß¿¿¼›…"ODðöÇË_çWw´”:onn NAÃ3Jï®®¯î®nß^Íæ?M®æý]†÷<Æ‹ü9¹àÓ\û§ gq‘'ÓL8EM·™Ä,‘qì9ÕäÃäo½ÂÁªÝ:ê?ÁY§Ñ˜‹sÎRª²¤`iÅÖ÷³0å<تª»VÕfÛÐ4ûv©iñ¨ÍǦýX74ÀkÃÙ¡¬H’h¨èŸMCÓ©®4]¹4OÐôjVªSeœ¦kËúñk›Åpó¶¬ÃV¯[m6aWn’z¿]èöÅlÕçÿƒkI׿I…øÒŽoUqnžêÊp«Lç7}- a³Bpy®ê¯ +r*Ê‹@Ñܤ—ÍîHT³&¡Î«ÀrOä&ýšƒ +ê´H +Þ‰·ÒkÍÊ+Š¾oFÝåÝ[À¬FSM‰¾s3ÐëeQÄı¯ +Œä + \@.päÆøteعp‚˪õŠ&T€P¶Ø)°À]Çgq·>ÚV6–±Ëĉß×!w¡×=ÎpÍŒ#dY!hõ
!>ŒS•IV9m§í¾°¯ä‰ û¶® +ì¡@õ†àf8@Ó5†‡PUEª4£.#dbÄEB¯dÌ#g[Õ@¦8Î)9pæl endobj -1342 0 obj << +1348 0 obj << /Type /Page -/Contents 1343 0 R -/Resources 1341 0 R +/Contents 1349 0 R +/Resources 1347 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1332 0 R +/Parent 1338 0 R >> endobj -1344 0 obj << -/D [1342 0 R /XYZ 56.6929 794.5015 null] +1350 0 obj << +/D [1348 0 R /XYZ 56.6929 794.5015 null] >> endobj -450 0 obj << -/D [1342 0 R /XYZ 56.6929 660.7607 null] +454 0 obj << +/D [1348 0 R /XYZ 56.6929 493.3884 null] >> endobj -1345 0 obj << -/D [1342 0 R /XYZ 56.6929 630.6469 null] +1351 0 obj << +/D [1348 0 R /XYZ 56.6929 463.2745 null] >> endobj -454 0 obj << -/D [1342 0 R /XYZ 56.6929 630.6469 null] +458 0 obj << +/D [1348 0 R /XYZ 56.6929 463.2745 null] >> endobj -1346 0 obj << -/D [1342 0 R /XYZ 56.6929 606.2355 null] +1352 0 obj << +/D [1348 0 R /XYZ 56.6929 438.8631 null] >> endobj -1347 0 obj << -/D [1342 0 R /XYZ 56.6929 606.2355 null] +1353 0 obj << +/D [1348 0 R /XYZ 56.6929 438.8631 null] >> endobj -1348 0 obj << -/D [1342 0 R /XYZ 56.6929 594.2803 null] +1354 0 obj << +/D [1348 0 R /XYZ 56.6929 426.9079 null] >> endobj -1341 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F21 654 0 R /F23 678 0 R >> +1347 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F21 658 0 R /F23 682 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1351 0 obj << -/Length 3085 +1357 0 obj << +/Length 3410 /Filter /FlateDecode >> stream -xÚµZYsã6~÷¯Ð[誂›ä£3ñLœÊx²§v+Ç-Q³©ˆ”í¯ßn4Hñ5ÙÉÖÔ@ ôñ¡ÈbÆ៘E†qëYkf¸0³ÅöŠÏžaîý•ð4óšhÞ¦úæñêëw*œÅ,¶ÒÎW½"Æ£HÌ—¿o¿»ùññöáz.
,»žËƒoîî¿¥‘˜š·ïßݽÿéáæ:ÔÁãÝÇ{~¸}wûp{ÿööz."#`½ô;œYðîî‡[꽸ùðáæáú·Çï¯nYÚò -®P?®~ùÏ– ö÷Wœ©82³WøàLıœm¯´QÌh¥ê‘ÍÕ§«4¶fÝÒ1ýi1ccè ªá¡9.Áá\ßJ€ÎmÔ;w.g\(;›[e™™£Ä-£
{ÏB3«¤r&Yû×d¿DÕ|ýÆNÄaÈBY8 -[TÇ]:¶È")¿ö¼~UÄlIO·H<û žÊËbAôáþ`=y²ìÒÊ\†’…± »Ú9À´ÌFQä7Jòå×°×ð<eX(uÔ•'Ý—#;ü¥‰j{s=W!^×Ùb
]mƒ×l³¡^²ÛmŽØ5 8ôÇ!ÝgiI a@MRÖ‘#yͪµÓƒjb': -;ü%™¡(ühî,M„ÞÒnß:à \ј8p(/ÃA<:þÜWQ±13ÿ“Ð-bocèЩ¾_%ûª¤þa‡—&È*?P¦eom[’Ø騦(¨EÆó%õ“±5Nú‘ËÒpe-¦Ôyvš§HÀȶ(+궔iÁ7E7ì9µÃ¢ÖÁ0êÕn›†þÖ„Ìq¾ ¶6|_“Þ_JŠ½Øv-%)¬º™Å&)=ÑÝý긬–ú^Å’L‹+‹í.ۤ˹‹40°LWÉa3ÊùK8Ãö$0~ü”=ÎT ±÷¹KK¿øÚS|iN½»{¿*yIiµƒíÓ!ÛTÈ܈ =«>âøǽFëB~Ñ?ùŒHAîbå_ر^qÖkèH0‚£wÂ2Åvftb½6és‚1jŽ‘căY–ˆBZuXRâ²ÒÜ'î.ä˜J0Ó?Í
bBqð›Q¼†ÍóÕ>)«ý5¤‹ª®¦Î ×ráÂk -Ñ=»´WCéüá
MÝß>bùì¾xðñá=F#Fs7.‚á$/_ιƒVE£™ß½¾¾Ùá$†ALÕ‹C5ž–QÒ–þ¹ÛdtQ - -Æ:̶íÑ“ZülÞI£ 9À9ûÌ%Æ0^BN艣&ù1ùÑPEœCÒL‹Xº-bÜÿëÛnîî
“e±·,RO’ãÝtk¨’Á.Zçs8@Ž†¨Ò?îí6æ@_›%Ý8·;vž|4ÇS²tÙÍò6iÒÊ -àfO³P±‘‡]M¾Ûg-¿3¥Ò°¦,¨-rQ+ákùwz|-|É{1|÷iì@…~ë5Èá‘šò˜ùqÛƒaùÇ¿Þ#Š›orŸšJ凾ý%Ý;ÿÀªÈBؾýîæã'¸Ox¡Uä‡Ñnîi½“U±(64µhÇq·SN¤t``›-£»J›àgª -ÿæ&ìœþ©É¤»õþò ß=üÀ:Í_à÷OŽkÿC |{ö…/Â}ëY΄‚ØÛâs -O5ù´\ƒ]GÑ©ù -qKÜ Ä5Ô“‚÷÷ülï¥ALÈ×õ”îšiz;ƒÍƒD¹?‚;
þûêú‹ÿïôWŠ:„¬>:àë·SÏ2ŠÁ3³ŠàÉp„õÿ˜Þç×endstream +xÚ¥ÙnãFòÝ_¡·Ð€Åé“öÉ™x&v<Y»@’Z¢,&©ˆ”=Ê×o]MQIv`]¬¾ë®j鉂?=É|¬lî&iîb¯´ŸÌÖjò}ï/´Œ™†AÓá¨o.Þ¼³é$óÄ$“‡Å`,VY¦'óŸ¢·ß_ÿøps95^EI|9õ‰Š¾½½ûŽ197o?Þ½»}ÿïûëËÔE·ï}óîæþæîíÍåTg^Ã|#+¼2áÝí?ozýáÃõýå/?\Ü<ôwÞW+‹ùýâ§_Ôd×þáBÅ6Ïüä>T¬óÜLÖÎÛØ;kfuñéâ_ý‚ƒ^š:F?g²Ø'9@&Ëc¯{}_ÞCÁ¾šÄÆJ¡÷jŸL¦^¹8ÏR}àJ>àŠvyl’®ìó8±Æ[Ún÷ˆ´yó‡ÁI§Îàþ8èHiSPýÑÔ%ãªVúªuµ*¶ÜÝ5Œ,¤oU<—‡‰WæQùyVn:Ñ-ªŽn/u•›U5+ºRöhêÕÏ +§‚[ǹ÷†Ž×-aukòèLž5ÔÎ[îlÜYðçºh»rË(¾b«°ÅüxF¿~Yw¯}˜‡rè’è“Ðñôl8¯tT„©F©¨n:ÁòwÛõœG̹cSl;îÃs †Îˆïî>ý£Gí7X½_tQÝnˆo7å¬úY)3;>+«(±
T†÷ñCõ¬Ö›U¹†û]ÕÔñØM‰@îlfE͸ǒ»¶œ3wCL¹Ñ©Ë‚^ +P—<ÒG‹f˨§ÕN–aN»N«Âh’E«¤*M©;F롧 +.Hú{¬ìIg&KEq±y<kêň®ƒ9HÁ&ÈPgkmô°¬dý][<ÉI +=êU¨Î[™>kv«9ƒO%v M¨—ª[†qõtì "¤U&MøVzºjËXæ/Bx0ìdÚ"Xtštð$yÈHd°c„8Ì8p¿Ÿ Ù.iYĬ«Ï¨‚v
ÜxIûÁf2âçE,qÏ:ÂWüYêèÞW(º¼¬FÅ} ÀV¡¶ÊR–ö±&ªPØça#ö œ›žd†Íÿ0áˆP½£DhY´0›FŽ(ò©Üá^~ ó´îÏ©mT¬VÜ/.Îõ1ƒ +¼lÏÌŽ<:#tÈ¡§XµÍWÙ³§·ä͆¾¯û«zAD$ßÉ«þN^Ýéϼ£Êzï {G +ƒ†ç2Œ!fŽjÛ;öó xÞã
t·ˆ +N0LîÃͧP¾yW<¢ p&çOjŒy¬ŒÊ{ºõÊÅ.ÍOïD1¡q2/¯Ä+;Hø0·3λìE/²m;ö<8¹kh¸A¥õÆ&b↲8ÐÏÕ¬äY*Wc’ô¸ë¸®Â|CˆÌ–N$ÂÑI¨Ú$·Ô1hÔÛ€”žVHm8“òš1$Håi°
‡Q/H%µÅþŒÄËùäÿµpgD|edrwR
.õïDP2áõPGÁ +,M¼Û ”ÏÕlDpµn8wx“œhF4ÜâÁ©H¨s>íéºýˆºô§ÂÄ…V +bê†ÛÇ]µê¦\½=e¡U|ŽìøŠÝhäW)ùÁjd—ÄüÃŒWí†ÑY¬ûÚÓ”Nb›åÉÄ`j™©Tˆ°*Ÿ¨4<
/?'&DÃÝ÷&„´‰BËE„Ø5›¨¬C¹„u%è9ÝSìd1vÙ°x½Øm·½„¨aÖ?¯üùÓzX|KˆŸ(òuÑÛ®¸ëîæŸ.¯¸î÷ñþ=:¤˜û®ëð¸S·/\^Ô!Æ"¡¬ô·z†-Jy>Âh½Ùuã‘Çmåg|_£Ê9äŒ!ħžö@é¢Á¬Ïû÷Œo!,”ÁY¦Ž=ÜñɪËëÜ—Ö¹îþûÝÇ×·w1£™³Í›R†ÐkÍádAä2öÑáJ±8ªüL´×¼Ú˜XrUŽŸç +dü°þŒ“Žó×°ãiúú¥ˆe¨Ó_g'¦çðxþÅ×x˜ãsüÿM +Ç€Äänå IåÊSxÃ?{Ë· +_ØrÌú3ç:=üâ(x?4Ð.ÓTs¿ +½ã:X{@ЛÐLä6¾>Ü>|#KþÈ¿²QÄ5æ‚þ2šè¶;>Àù/ +`c¿G‚¡ðWÿúéðÓ0Ð8›eæ`¤3M9Þ1ÕgþÅf±ÏL:rôÿ^܉endstream endobj -1350 0 obj << +1356 0 obj << /Type /Page -/Contents 1351 0 R -/Resources 1349 0 R +/Contents 1357 0 R +/Resources 1355 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1332 0 R -/Annots [ 1355 0 R 1356 0 R 1357 0 R 1358 0 R 1359 0 R 1360 0 R ] +/Parent 1338 0 R +>> endobj +1358 0 obj << +/D [1356 0 R /XYZ 85.0394 794.5015 null] +>> endobj +462 0 obj << +/D [1356 0 R /XYZ 85.0394 167.2075 null] +>> endobj +1359 0 obj << +/D [1356 0 R /XYZ 85.0394 139.8789 null] >> endobj 1355 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F21 658 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1362 0 obj << +/Length 3030 +/Filter /FlateDecode +>> +stream +xÚµ[Ksã6¾ûW¨ö²rU„àI‚GgâÉ:•ØYsØMr $x̲D*$5Žóë·Á)‚¤@§â)—@à#ú
Áa +ÿØBE$Jx²ˆIej±Ù_ÐÅghûî‚9̪ú¨o.¾þ(âEB’ˆG‹‡Ç^_šPÙâaûË2"œ\BtùáîöãÍw?ß_]Ærùpsw{¹âŠ.?Þüp¥ïî¯~üñêþrÅ´bËÿºúéáú›"×Ç77·ßbM‚?g:½¿þx}}ûáúò·‡ï/®:[úö2*¬!¿_üò]lÁìï/(‰V‹x „% _ì/¤DI!ÚšÝŧ‹wöZ›W'ýÇ(á"âäbÊ*!‘€&ëÀ«¼¨ŸL viµüñæÁärk¾˜]qØ›¼Æ–¬ÂßOiQå¦þ +±L±ö‡«[|ïP^2½,êbSì°iÓÔ˜´6[×SŽPŠûl»bIL+Éäò¿EîZ¶i"ø±pfNŸMš[߃VŒ‘D)ÞX³68@ÕÁl²_)åT¨xÉê',Y¹ð&+éù&7Sm]j»rÜ}B”çAÁ‰ˆaµÙ¥(0ÖƒWDë(Z¬DL„U¹$H)mÍîuVäÕˆKŒÄŒE‹(fDqynì´ê£pèÙÄÐw(«PºÛ/+ÿìñu(œ1A˜¤qXz‡šß÷cš0Î}ñŸŒ9HSØšjSf7°¢xœðnÊ¥vƒ04bÈyM¡¥gùÐNàá±`žØX~^`á¾gq‡Ÿ±xÜ/š¼9gùÀ""‡* e Íg¾CÍ(2îÍ*BÎ’MB ‰ &[ [‹:ÓïGSNp*dÞ¡&¤û\~°Høâß“lC®ÅD¸&XìÙäšÃÏX<î÷í\“ ‰%ãa×w¨Eƽ…¹FXòt<õ*Àµu¦ºLóê–¶!Ý8…à‹dP~‡šPÀ£›
õÑPƒ÷¤[ߎð¬q–q‚R+™x¦×ágŒ÷ûvÆE1‘BŠ°÷;Ôœ"£Þ‚ŒS1l…ša\užqê4RÇìXÌ8¼Á ÒH†¥w¨ ñ>ß žë8öåÿ=¾%ßNVÙƉ¦’o°‰¢TúnÅ·?cò¸ß¿°–ÂVWƒÎAßw¨Eƽ…Ù&#¢c®gØÖCØÖ¢¬D¡Õ¡Øe›‰Õ‚0lñÃâ;Ô„|Ÿnfz,|>uÛë +ýŸâϯœËOÙþ°s$„1:âþŸn·(|v0ÆÀ‹+ÁhCäá +p•†=\_ÓPkñ3¦û¤8`L+8‚Jˆ¼aw¨9EF½…iʼni2G«*@«5œþ+8q½¤å6Ë?IMápT¤CMhâ,Ž`úfýâÙÀ ‰M£JôùØ&) +s‰%c6æ*À§uØÎn7px§rá\DYX|šïqK0"4Tyòßç :¶b <昽<›È… ÃQó4”iñ3Fû};Ób
g!ÂÎïPsŠŒzòk
JɾõQçùÖ¡N#•åµù\fõøj'Uaù-hB¾O8J¸Ž„¯À{Î3cÈ8F
\VÁ˜D”iÏÔàÕÃÏX=î÷/0Z4aïw¨9EF½…§l~žñÆõPƵ¨ÓPUÙz7•k³ç”ó°ø5!ßß'BµP¾ï¹€öÌ^¢“$ \(ó,
^8üŒÍã~ßηˆ«™±ïP3ŠŒ{óÍÞ+Âz4÷*À·Õl<MiOª«ªHWu½G8N”T"¬@‡šÐÀg\L”=ã{*¼ã&rNÃñQ°@Œ“0¸òl
Æ8‡Ÿ±zÜï_ˆq”ÄKÂîïPsŠŒzrŽ%’D±šÉôQç9סzV#ž«çéœk¢dFƒ5¡‚G:ɉTt Ãû,¬S–Äk8~EqàR^’ +ÄMúÏÖ5 [¨ŽëÊü~ÄÏf“ž–×]†ÃÃ!š1n<Àç£ýð¶U£«ãš×f*ÿ6ò:ǤcÿÒþ%}|4»q²Ì“ä.£× +M§qì¯!Y/Ÿm>Öoï“Áh{ +ùG¹®ÿ1}¦uwf?=–¢ýVzNþyÉ––óÔ]ªY‰ùjoöEùŠè…íj½K!v×øØjê,k.Üb—:æÞ$m`…iå5Ò(iNî‘ïö:}vNòtà-¼b½sB.¿¤»#¦Xʼn*¶áPTvgm°){ÄÚt»ÍlxOwXß(r¹-3wMO6%ÙT¯É±6êϘ––'Öº€%Ý]šýî½I³å§b?àƆ*=}ðÑ =ÙnZÒmvÇíôçØøjfcÕúxZ° Ü^”äf¢ËÖ€>§×¯^*•œû@_("§oàÏäßþxÿô?¤ýüÜ.Û܇¶¹TÊ:5æãÓ}å?Vý…endstream +endobj +1361 0 obj << +/Type /Page +/Contents 1362 0 R +/Resources 1360 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 1338 0 R +/Annots [ 1365 0 R 1366 0 R 1367 0 R 1368 0 R 1369 0 R 1370 0 R 1371 0 R 1372 0 R 1373 0 R 1374 0 R 1375 0 R 1376 0 R ] +>> endobj +1365 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [312.6233 217.8123 381.2953 229.872] +/Rect [284.2769 667.7189 352.9489 679.7785] /Subtype /Link /A << /S /GoTo /D (access_control) >> >> endobj -1356 0 obj << +1366 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [310.4119 186.5529 379.0839 198.6126] +/Rect [282.0654 636.5559 350.7374 648.6156] /Subtype /Link /A << /S /GoTo /D (access_control) >> >> endobj -1357 0 obj << +1367 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [328.1051 155.2935 396.7771 167.3532] +/Rect [299.7586 605.393 368.4306 617.4526] /Subtype /Link /A << /S /GoTo /D (access_control) >> >> endobj -1358 0 obj << +1368 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [320.3548 124.0341 389.0268 136.0937] +/Rect [292.0084 574.23 360.6804 586.2897] /Subtype /Link /A << /S /GoTo /D (access_control) >> >> endobj -1359 0 obj << +1369 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [359.1386 92.7747 427.8106 104.8343] +/Rect [330.7921 543.0671 399.4641 555.1267] /Subtype /Link /A << /S /GoTo /D (dynamic_update_policies) >> >> endobj -1360 0 obj << +1370 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [429.9426 61.5153 498.6146 73.5749] +/Rect [401.5962 511.9042 470.2682 523.9638] /Subtype /Link /A << /S /GoTo /D (access_control) >> >> endobj -1352 0 obj << -/D [1350 0 R /XYZ 85.0394 794.5015 null] ->> endobj -458 0 obj << -/D [1350 0 R /XYZ 85.0394 430.9244 null] ->> endobj -1353 0 obj << -/D [1350 0 R /XYZ 85.0394 403.7891 null] ->> endobj -462 0 obj << -/D [1350 0 R /XYZ 85.0394 277.0241 null] ->> endobj -1354 0 obj << -/D [1350 0 R /XYZ 85.0394 250.3071 null] ->> endobj -1349 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F23 678 0 R /F21 654 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -1363 0 obj << -/Length 3306 -/Filter /FlateDecode ->> -stream -xÚZmsÛ6þî_áé—“g*”x#Áijçܹ&=Ç»›¶h‰²YS¤JRqÝ_»X€ï¢Òi&“1<Äîvøe -C.âÕ>MŠ¬xÜsúíP—‘öI£@,~Ü©<’$ ¨£ØÁ²šzL6Mö)¥ò®¬¨Ð<ùæ?Ë"šÈ@®îŸ¬N*”;§e²yÊŠ´ö'®ý%ËÞÕ7«t“¶¢RPÆ}CÍTd„Óð»÷3
C -†”ƒZØÖ÷îooþ7c¦40ì0ãÔÉ>ëä1Eœ}X ûd`¬}TG5hÌÖÕôÍDl‚ÖÐç‘gu“n©\${W[§Õ§´r~ tPÂä¤ur¨²}R½’^{g+ñaŸ€˜ -zâð…Î(PJz3 êk*%Å+ntÛ-ÍC]§5}WÒMöKk`^²æi†b"LèиQѨ°*rXt2&Z½qê•UC¥}âÔ{HGº\ñ¨CÃà 9øÆÁÜ[%íè¦À¼uUÈd$ôgi«“"ôÚöƈ$4¥ŸÔbëjhâŒ_iÄâÙà#`Œ›a2*Z&˜)Ìj›î’cî¡;jï6cáÂAˆŽs00g,_¨´ê; -ܵ%NKÚP}b™ …úµh’?¨ÕÒ?J«&ÉœØm¹§²"U;mŠÖùDB©9ç@®puæö+øb¿)]új[pêÊ¢ö¸žïßRÍÎV•{úEöA¡H›—²z¶»CüÂênUÀOI•µ -l6¥íi´u}•Ö’`¸,È;ZZ¾RÇßøvº®Âœ{oàlŸ 2‚vè#•]#ÞWÅLØŽ˜ÿæúØ%Y>#¸§bÞó¥§U “‘>ðÕy±vf Y$qgõÅ4IªbNdB‰NóSë>™ #qfÝ÷PëÞ£ºu¿ÿc,8Ž™ÑYìA3‚³(f$è2ü1M'CZoªÌA«s:¬qÄ¡|Œíë?°š…Êø™¦ÕÛ7QhR
l¤Æêñ’ -w=k[üs§ý’¹›Î0<™ðñ±Jx!ùÌ°·¨3ŠL{[䘎43Lç"Çú¨ÓkQÝÁ6w»Iªí$¼ˆ©€/‹÷ ñ¦IΤªü¿Ç´xÀ´¾#áÌil¢“|Ã]ZG¥|kñgŒžöûù|‹œ%¤\üuN‘IoË|Sà"¤Ë|ë¡øæQÝLeE“>VY3=—â²€ƒð¢|š‘?$\À„ åP/I¸cÆqƱÀ¸ faÀÍÀÔ%Æyü«§ýþÆA‹áryô[Ô9E&½-3ŽK@sphoÔÍS=ä¸Ášlž
ΑX”Ý‚¦Â‡[gÉ#õ@ú—£=F¢CÇñéXkp~!J=|ÙàI¯ŸO38\˜H/OyZÖbÒ×"Ç”Ì(,’¬:Ͳe7¡i…§Öu]&ë¦É§^M0´\V EÍh0¤ZÄ4ž÷*|®Í2f›£¤ä~MÁBz`ë¢_sø3VOûý~-`QÈãåáoQç™ô¶Ì9(£Ïœú¨ÎyJ<¶I“®É;<×ÏÒI8ã„ñ
ZÔŒ -Ò)Á”F:|™`:gÉH¼£XÉÓ¬“’Å’l]"ƒŸ1zÒëgSN1£¿8ø-êŒÓÞ–)'@™3±´Z œG¡D˜¦ä!©ÓÉ4dZ¡jQ°ÍH1_ª¢¡ä˜Yµ™JåÓI2¶¹ª¢\QÐiHí%Õ>8”ËU)—DHÝ”å^ÚŽUà“ÑÐŽÚüoàÓ9øM÷É®ÌóòeÐÃLª“C™ëQª³?šã —°ç¼S~N__\š¤ˆˆroøöŸÕ²S”Åf•¸Æ„þ`Ê’JvŒ -6Д„E„â½Üüð¹-ˆß½-˜ä?y|U=4_ÍߥÓÞ¥}ýI -=Çÿ¸â«šÊEâ.ØPb±Þ§û²z¥Ÿ4 -ÛõCž€ïnè§×ÔYf/ß"—FƒEjaeêå”
Ñ(¶§õpH£&yvƒ4˜ÐÑhöƒ»¤jõ)É”n•U°áPÖ¸§N©)ÛQm²ÝfèÞ“œêûE¶UæîÅ é Ó“¶ú!Mªƒ-ú3åˆò¤¤Zç°”»WÃ;i›"æ«å>Ë÷ÖÉþ{†x¡í©'Ý&?n=éNiH®}ÕñXPö—&E:Ó¥7 Ïé‡×AZõdÜ0o<“3èNG²n2ƒ<Œeˆ&|I¦ÇLeöBñF>ùe6ÓæÓÜ»>}b -k¯Ëcîä'xšp:QMQV{ÜŒ`•k[Iu~]‰H Ôx]eéö$ïyûõ(–ËÄï£N3¿Eõ¨ã;yxA9 -™ûÐú#nܨ¼G²ˆ‚ ýt^²•I‡Ÿ2I³¨»¡ïy“IÖ"lý3ÄÄq5ÚBeû.Æ[Fdï9Öm»/l_Ï´› î-˜~[;r¸7²û¤¹kûTâ§y ëCˆ(:ÃËj—e·ZÐÃõ‰,†Ô2^–îA3ÒÇYpZb(þ?W±°‘C¤d•eÖÐéK†¾ø³öÙüaG[é¹V!“zMP¨Àg%ng‡Ø¼|¤|Ì÷[y¬à€C¯ñ¨ÅÒÎ:Vn_A@¶qÊÚQZ‘ÔÑèÝ–%œhnÿ{sǨèN“!½Ê…Šì±(Ýóª ö„Aû²+Û®6À!ؘÕqÓŒ? ã±Ê.£®‰¯œy„ó¦aƒ=Ç €Ã!-óáç/B¨™·œJêXôŸàºrµƒ˜ó[‘ŸÝ8Y1ó9 -endobj -1362 0 obj << -/Type /Page -/Contents 1363 0 R -/Resources 1361 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 1332 0 R -/Annots [ 1365 0 R 1366 0 R 1367 0 R 1368 0 R 1369 0 R 1370 0 R 1371 0 R ] ->> endobj -1365 0 obj << +1371 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [257.6971 603.0615 326.3691 615.1212] +/Rect [257.6971 346.6843 326.3691 358.744] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1366 0 obj << +1372 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [310.7975 572.0651 379.4695 584.1248] +/Rect [310.7975 315.5214 379.4695 327.581] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1367 0 obj << +1373 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [308.6055 541.0687 377.2775 553.1283] +/Rect [308.6055 284.3584 377.2775 296.4181] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1368 0 obj << +1374 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [294.1999 510.0723 362.8719 522.1319] +/Rect [294.1999 253.1955 362.8719 265.2551] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1369 0 obj << +1375 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [303.0862 479.0759 371.7582 491.1355] +/Rect [303.0862 222.0326 371.7582 234.0922] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1370 0 obj << +1376 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [332.9347 448.0795 401.6067 460.1391] +/Rect [332.9347 190.8696 401.6067 202.9292] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1371 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [231.137 288.2283 299.809 300.288] -/Subtype /Link -/A << /S /GoTo /D (boolean_options) >> +1363 0 obj << +/D [1361 0 R /XYZ 56.6929 794.5015 null] +>> endobj +466 0 obj << +/D [1361 0 R /XYZ 56.6929 726.6924 null] >> endobj 1364 0 obj << -/D [1362 0 R /XYZ 56.6929 794.5015 null] +/D [1361 0 R /XYZ 56.6929 700.1172 null] >> endobj -1361 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R /F48 880 0 R >> +1360 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F21 658 0 R /F48 885 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1374 0 obj << -/Length 2658 -/Filter /FlateDecode ->> -stream -xÚµ[MsÜ6½ëWÌm¥*‹ï£ãÈ^¥6ή¬=esk(‹ñhF;3’¢üúm† Ȇ\‘Ëå|ì~
<Ý Åþ±…U„ -'ÆI¢(S‹ë»ºø×>œ°SP5Dýpuò÷÷Â,qšëÅÕÍÀ–%ÔZ¶¸Zýzúîoÿuu~yVqEO59«”¦§?\|ü±;㺟w¿||ñá?—oÏŒ<½ºøåcwúòüýùåùÇwçg³ŠÁý¼·0sÃû‹žw—oþùíåÙoW?œ_ÅX†ñ2*| ÿ;ùõ7ºXAØ?P"œU‹'8 „9Çw'R ¢¤áÌúäÓÉ¿£ÁÁÕöÖ©þ“ÊÅ¥^T -¼ -é¦{™ª ×*#Á–Ö:ö2gS½P¾—ß>ì6Ëõ8ZÆ,áMfŽ#j³xf\ΕK]¿]¯·Og•àêôp[wU}ÆNo–ëCwÜÓûÛ¾;ü/¥|ÝC7Ë»¾uØú_yú¹?Þ>Ö»]³ZÕ?æ†ùh~`»Ù'ÎåéŸÛM=åé©9Üög9—¾«@¿nŸ¤Ž#LÛÀˆ‡ÀàqN´rm?§T'ëß7ëÎBÚC†8Ámo uÓŠqy_oVõ -ŒB ž´¿~°n®—Ÿ=W}ÑYŽ<“†h-Eoþn¹?Ô» ‚Çuc¹YMÙ‚P•‘=f¿^>Ö–¸"FˆàÐwìždOT/[í<ÔàÚ¢æµQ]œT‡Ýr³¿h™=Í]]5›LìÆú¸%Î$¢&¨$Ci‹6åò©tÛ7Võþz×Üší¦;±½™èn°A¹´qäæ#Ñp$iLc´°–Hgytwq÷eÑ5.áG|!üÜnþõ1P?3M̘’TŠ0χˆ*ÉÅgsR…ZÁ®0ÃQˆ -jrÌšÕzZ…š0¥Î$¢&¨¤*d°`øarùk*ts*D4V¡ šZŽ¨¦åx4ªÂ_?·ûrJG´°‡ˆ*Éá*’ k®Â -Qa@ÍÏÛ‡C&C+‰ÔJãT"j‚K*CG Ap)™ï$ÃaHc–`¦Ý¼#Êh•„ 1àÛ}¹5\)
D -j~æ˜T!#Ú镈šà’ªPm̈ÌwZ’‡!gCG “ˆ%tšQIÔ¨{|!þÜî7ˆÃ>T ‘ÙBE¨'‚‹pˆšaDy›í¡¹yÎ+ä”ÀýFÔ„ãDqЃ2uêùuwä?f¨3}q5'/˜ -“ŒP«mAa¢°€òï>'·Q¨ôQ¿5á8©%±ÖÙÔó…ïo#Ã> ´ìøµ$×–Œpfäí§e²ÙÚBÓ©Ó›í®;½¿¯¯AlÍæKw¼ì~ @¨:»¶/|Ìí©x;⯤¯—G— ð½o¾l–UW*3Iœ6TʼåðÐN¨µgÈ=Ãî÷ÇŸ>¿ëÚÞF˹¯Þ{èÓm݃áA{îZËÎXw°Þ.Wá¾›öÂö®;Z5û¯¾Ø¦,ô!œtýµmp -U ’[ÃIµuº°3D! -(dȦ&Án»§@T&¶EÊ廊pzìöEiOP$Q—÷E©r»ß¸'¨
>U ’[CuÈÛS…M›!j^‡å=>ìëꥳ¡¿OCß¡d"j‚M"EŠ…².¥ó:ïH -AeoI`iÚ³bô)“3Î%#bŒøBäv_.FH`µæ¤ªD$³†‹Q)(¯UáuÝ…ˆ1 Ž{¼sò“°vi¨“P÷5á?@ ñ›o ×ܪžœ†L€ÅÍœ‰É3¨N¨H"Å&¿€/ÄœÛ}±Þü÷
T:‹w~D•ˆdÖp½qHša° -z ½T6PSK¯òûxTá"j‚B"9Ÿ‚[fSßArÓK®G[1DuQ©E,¦º€/„Û}ù,Ç1\Y¼ÿ#ª@$·†ªŽ9È™P¸ê†¨yÕETûî´ÙT»úfWïoÛ—÷oºNð¯T§N·èÃî9dž“ùà -·x5Ã8erBò4ˆV¶Ìõ²õD¶þÄÄB -.•ßzÄÒ€/PÌí&ódf7ó$bÊ@e‚vVD˜äÖpiFŒã…Ýä! -ÑX@µ÷Ýžêf·½«VÍ?€L¨Þ\×ùK
ð$9ÔD(ˆšà“Ö0§Sžòy¼®Õ¸Ê€ÔÚ ŸaA -*ý;Äa@h‘Ñã=Û}ñ›aÿé3ÓšãCQ"¹5\¢oaoyˆBÔPÞã×úFk°Ý=OåuŽS‰»¨ ÿã¼ÎQX毳ÈfaŒó:éC>>åÜë‚'‘¢y]/ÄœÛÑ[¾Pø]að®¨Ìª6ç?©f…åh^kÔ.®ëCS¿õN•&ˆ¶Ö¢®#(÷èLZ¨”(Kœ¿Ò~£Æ*c„IÊæUÆ ¹öwécëÑx´c›/ÿÒÅJb(”cX—GPÄØþ5L}‚–>æ;‚oùzÐñº÷ÎU÷~<ß4Ý»zŒAåÒ’TFO8¼Ö|“‘Œ÷‹™ÿÆ ›ò»Wb+&¶=¶ù
/f9äªÐõ„³ÈlM«-ìíBÎ#&Ëøßèð—ÿvêø‡eÒag_õPM,w&òÄÈò^a‰²ÜLPÿ?¡xdendstream +1379 0 obj << +/Length 2951 +/Filter /FlateDecode +>> +stream +xÚµ[ÙrÜ6}×WôÛ´ªÒìË£ãÈ¥&vFVj¦*ÎÕÍ–SdO/R”¯Ÿbi® <qÊåj8Ä]pp\PdáYh03|¡G±X?^àÅ=´}A<f@«6êÛÛ‹¿¿cja‘T.n·¾4ÂZ“Åíæ—åÛ¼ùéöêærE^Jt¹/¿½~ÿ«1îçí‡÷﮿ÿùæÍ¥âËÛëï]õÍÕ»«›«÷o¯.WDïSßÃÄï®ÿyåJßß¼ùñÇ77—¿ÞþpqumiÛK0³†ü÷â—_ñbfÿp3Z,žá#b]<^pÁàŒ…šòâãÅ¿b‡ÖæÕ1ÿq¡‘ \.V ++½Lɘ—ÊzySdåi×7–ŽQtÑîq 7¢F³–`BÒÖÄŽäyî~|ð…M~Xï‹Ý±¨+WQob=3ŒB˜r*tõï e1 2¬¨ú&R‰WFuLtûû…+Ü´Œøc‡ý:c×g³,‰D¤¯£ +af¼Q3Š{³Š ¯=y†A¢s;ƒüò fxò2¿Ï¬é«º*_<m’Âf(¼Ã1IQ¸+ý¶a–‘ËO³ìޖŲѣ©Ív»²ÈîáX»ß‡¢::`Vm\Õáxºs¥?ê*?@ á\-¯·¾5÷xè¡¡!×m:0ƒ'ÒóðÄ
¹J2tv˜o.W+;-*¯Z0Êw²ž‹²ôF”¯ù]n»‚€°ÑÚNPd„ M¯Çý%ÑË<;æÇÂìà~‹ÿ=ú__ï;¶¥0=»cé&ïËÎÏ^«Ü$»¤„A4Œ¤éÕFMó+¢¬YÛzÿœí7bQ‚„"&-8¢F$wƇJ$„êŽèËÇ<«Šê~{*í3o\j뛳7p¶éÁºÝVeîÇéo‡f“ïS‡c³Zñ†ÁÃî†-•'L˜YýHÄ&ŠxÐÄI¯Í:;r/+ªXÖõg¤NïÚ5n³¢tœ¢† Âér*Ûó=Œ¾ì_À¶L<_¡²oœmt³ +ïóã1¾RÕ®2«ÏÐ%,ÍßØ +¹|~(Êq$µfÞ:˜àt8Žy¡Y^ƒžëSéågeY?{\MUï³ÒUw4¶Õ®.L0ª(lS$Î ~‚ùfzŠ¨Û6$ø%èïA-ö[çö' +{W™ßØYlYß»–OXàßêÓ¾ÊJ(’P‰ié{mÆÝVn^@@±öÊî6°>;vÁžY1¡ºär”dyýŸw7ÈÁžK²üÎ=÷SÜC,k(qpŽB2ÐÆUÆÞÖ@$Øèåi}ì¿àì·UÍd:7‘¥·Ðá‚u¶áîÅØíòÊÓ?QÊÝäb¦5ŠœR$… !…Ùåk;+ÎoU9»jĸ‰S÷&7Æ-¦æ³dzâÀ©G¨Ù‰ÓB%&N@u&Îñq·òîìOn’tF‰ˆÑ¢ã6.Q¬§Fœ>.ùPRmêõé1¯âö±nÓ +ÿ{>k '#xy‰¸™‚šIOsÍ4š§=ÝFM{:¢yâN½Q§í¤àˆ‘Ü
NQ*LWô¿ëÐai +kß6;•GWëuûÛÁ=:xÞ¶¡´nö"ͯ_v7ye%Xø3´tzmVûzhµtŸ’ñ\|”1Ý985á”FÂ~OTp‰!pHëOT(ìjÕ°æö!¬”ñ0bjëì®ÌãÌ.ç„+$%Ý?f»=M
˜óªo£àH_° Ì9”ÙS>f€ ÍÊŸ§Ø³RK&fØÜB%ØPÎÎßWÍR´Í}ü(óÕ0ãA”¶vó´&5¢J‡ÞÀjƒ•îêòç’::ŽÜ´E=5ŒDL)5™æaZ#n4íHóDüŒùÃ~§Ò<ª¯6ì‚ÎÉqˆ¨E†½%Ó<ëš©¶P Ô蘛rœ…°k†ýZZ“ˆQ¥ËB{.µÃÐÖåë¤SõYkš`!„›‹k[“d¡ÇϘ?ì÷õ,ä°wfZ¦Ç!¢fö–d!SÙu IÂhšƒ46êÓqÀAÍ—B&õˆ ¡"]»ÓÑä/"`Ûž¾Vh"Í4=žm›Sð´õƒ^_Ï? -3C0iú=¥™Ça÷FùL"¦Jp/ ¦£Å(ùlåŒ*5¢K—~I¥zÊüEËpÛ¤~´inÅôãà4%:V'ùçñ3öûýb¤ˆJC +êܾœ•ÉÎJ[Ãp7¦ƒß»-éæ¾Û‘Â
×4‰1¬áffQnö ZŽ0l‡c±ÞÓÁÁ‰Ú£cJz
Åwˆ,줅ֶüëíÈW pX³aæÿù&!|ô°j®~¡|þásžïÂ'ÞàÌ7ÕÖÞ®zòB…cvóuCq8ÞÐÒöÚwýàj×Y¿oh~7§Ç]¾qtWiŒ{Wpí´ÿÈͱB\ËÜÏ#ÓJ¹÷—8á‰øÆ&·ÀªŸÐŽ,‹®9_ÒMRŽð²Ä3q³š&]D5f÷«§¬,6Åñee#Òþi$ßRh•T#¢FôèžD€tX×Qäë¬×“æó0”‘ÌÃP +ûô¶)3y˜?cû°ß×/Üö;@p¯HBDÍh2ì-¹p˜
XÏebÚ¨Ê}
Ñ:7êÓ~=¼Ì6Ïg”ˆ¨-ºÁìÅ¢§Æס߄1=
FpMl¥{Säøˇý¾þŒ™½L@ +ýžÆ™rrÙûG¤Á.ûÓ?pþã +®³´qßa‰45*(eW¬¯¹`Ž¾T¨þ?탄kendstream endobj -1373 0 obj << +1378 0 obj << /Type /Page -/Contents 1374 0 R -/Resources 1372 0 R +/Contents 1379 0 R +/Resources 1377 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1394 0 R -/Annots [ 1376 0 R 1377 0 R 1378 0 R 1379 0 R 1380 0 R 1381 0 R 1382 0 R 1383 0 R 1384 0 R 1385 0 R 1386 0 R 1387 0 R 1388 0 R 1389 0 R 1390 0 R 1391 0 R 1392 0 R 1393 0 R ] +/Parent 1392 0 R +/Annots [ 1381 0 R 1382 0 R 1383 0 R 1384 0 R 1385 0 R 1386 0 R 1387 0 R 1388 0 R 1389 0 R 1390 0 R 1391 0 R ] >> endobj -1376 0 obj << +1381 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [259.4835 736.902 328.1555 748.9617] +/Subtype /Link +/A << /S /GoTo /D (boolean_options) >> +>> endobj +1382 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [387.5019 693.385 456.1739 705.4447] +/Rect [387.5019 437.0578 456.1739 449.1174] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1377 0 obj << +1383 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [381.9629 662.1643 450.6349 674.2239] +/Rect [381.9629 406.178 450.6349 418.2377] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1378 0 obj << +1384 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [398.5803 630.9435 467.2523 643.0031] +/Rect [398.5803 375.2983 467.2523 387.358] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1379 0 obj << +1385 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [393.0412 599.7227 461.7132 611.7823] +/Rect [393.0412 344.4186 461.7132 356.4782] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1380 0 obj << +1386 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [255.0796 568.5019 323.7516 580.5616] +/Rect [255.0796 313.5389 323.7516 325.5985] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1381 0 obj << +1387 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [381.2254 438.9741 454.8788 451.0337] +/Rect [311.5276 282.6591 385.1809 294.7188] /Subtype /Link /A << /S /GoTo /D (tuning) >> >> endobj -1382 0 obj << +1388 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [335.4973 407.7533 404.1693 419.8129] +/Rect [381.2254 154.1545 454.8788 166.2141] +/Subtype /Link +/A << /S /GoTo /D (tuning) >> +>> endobj +1389 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [335.4973 123.2747 404.1693 135.3344] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1383 0 obj << +1390 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [363.1733 376.5325 431.8453 388.5921] +/Rect [363.1733 92.395 431.8453 104.4547] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1384 0 obj << +1391 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [365.365 345.3117 434.037 357.3714] +/Rect [365.365 61.5153 434.037 73.5749] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1385 0 obj << +1380 0 obj << +/D [1378 0 R /XYZ 85.0394 794.5015 null] +>> endobj +1377 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F48 885 0 R /F39 863 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1395 0 obj << +/Length 3132 +/Filter /FlateDecode +>> +stream +xÚµZÝsÛ¸÷_¡Gy&b ö)—8©¯=çêø¦ÓÉå‘(‹DêDÊŽnúÇw‚¤H‘î\:™˜ °\ìÇo?@‘Ïüã3‘ Í,62PŒ«ÙrwÅf°öþŠ;šEM´hSýðpõ§w"ž™ÀDa4{X·xé€iÍg«Oó(ƒkàÀæo>ܽ»}ÿËýëëXÎn?Ü]/BÅæïnÿ~C£÷÷¯úéõýõ‚kÅçoþúú燛{ZŠnïÞÒŒ¡Ë¦÷7ïnîoîÞÜ\~øñêæÁëÒÖ—3Šüvõé3›@í¯X ŒV³g¸a7&œí®¤’BÔ3Û«Wÿð[«öÑ!ûI¥Ê,š…ÃFæAÌ9ÐÄ’ƒŒ¦1rȇŒ\S¡‘“mµ¨I^®ÓÃ5×óEYËtñëÏA\!á±ö.=Y<Õ€0¢%Å„`º+ÍÇ4%/T7X¥åòí«¬Èi¢X£`gª™8`¡4 ´Ng‚p‡îÑ,?W[D +äk +úÐâáqFƒû–<ý„ú|É +wÌ‹*[Ÿ.aƒƒ§v¯‰vïø;„U‹îöß' ö”8Û;‚zÂaÇKP +h%Ǩ‰è +ã ÆUÏÝÐ…Ø3Œû»¦š¤ÏmcÊ +ô}:ºIµÎÏq GœÄºŠ/ý„ ú|/¥<Þ‘Ð@k +‚NÒ¢Ü#fŸÒíéšsN¸oBíÔ²´7F„ô +äaXCÄB½P?ÛŒG¼Ü&Ǽ'X<._KZâ Lvõjr¢Aâh ÐáÍ÷¤ÄSVÝÊSz(AGw‡Â+"2 ámEW+GöÈiXƒËšAC˜°Htá³Àk—•¥x‹#¸[A“䧶µ—…½®|ìåVceùY +E Ö+zÌ+_ †/G‰d¡9óK(Ä<+隧Ïnaã0cè‚h¥bÀ=¶#}3Œž<]€å³<uÔT•¥)¶Ä¸ +äqeM(4øP‡Ý×RmÇê€ÒÐúŠû´˜Øȇ5b1O¿%ˆó’æ):`ÚG¯i.¡[—þÒÎ&øDA½Ô2%²dµrz•D¹=ò¢rx +6vñDmÓ§Í1X$3—:êë¦xîäV&ÇP¶¥*kšùmQ|-ÿL&æ¬õ5Ö1½¿ÂŒs½ˆ ¶€†ÿ¡ä–(%á¨I8x‡é¼:íÓæŽFŸè‚K%
?_èÂ[¢ÜP•‚Ðlt‹¢¦2aˆ»8ö•)–*{ʶé#³ÒóùÒ=šÐ¥Éìðè&qÏ•Çå IPÚ +•“:J
é²¢1%6ä]×ǃ«ðD«@Ú¦šáØBÈ0²-Ì6v„J º¥%L>câ³#W1M}Ü›!û¤=„Äõ9F·KLÛ°µ¬y"×(ʸÍįÇ~]×hÚ–˜L–uLȹ°ö5u€Á±Åɉâ'ç>ò¥Ò=gª%l—R‡e[U;p¨ùm˜9!.vÂ=š¶tk/g²„ˆƒYÁLB·ÏÙvµL|×îl¡ÁÙü_KlÝÑé=WQªA1º^él²>[ríKkÿNû2€ž¯©=ü”dE#¬(BÎÍÐYÊøV
ÇV
ñ
¶õÚ®%tyøÛÍ¿h”~[n’üÑ=j£·€âMqN7gÀuI{ø-Ûr“ø³³4u„P/IÈv–Ä;{¨“¬Yî°•m¶îñÒ= +Â2’á´I„ŽDϤ°Ýîh= žgJ`”\`ÎÖÄÅoÇdÛJs`™b—Ø÷Zî4…ZAÿÛ;á
ž'†µáKßÁù>¬çÊ0WÒñ
&]ž’-䊡æGó@o:›Þú;adžßÅÑ«620š×˜`YÃäCBèOu8ŪÞË¡p5q C¿”S™n×U“ÿPoHh)¸gä^8†lî?D–¨æ¤Š½_#8¨ÀŸYh‹„yÉwËBê Æw̓ß-ã§È¿ˆQ ðÞ×Úðß…ûþLºù†4Z_ú)N R‹p&T +endobj +1394 0 obj << +/Type /Page +/Contents 1395 0 R +/Resources 1393 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 1392 0 R +/Annots [ 1397 0 R 1398 0 R 1399 0 R 1400 0 R 1401 0 R 1402 0 R 1403 0 R 1404 0 R 1405 0 R ] +>> endobj +1397 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [393.041 314.0909 461.713 326.1506] +/Rect [364.6945 737.8938 433.3665 749.9535] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1386 0 obj << +1398 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [402.9837 282.8702 471.6557 294.9298] +/Rect [374.6372 708.0059 443.3092 720.0656] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1387 0 obj << +1399 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [320.374 251.6494 389.046 263.709] +/Rect [292.0276 678.118 360.6996 690.1776] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1388 0 obj << +1400 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [348.05 220.4286 416.722 232.4882] +/Rect [319.7036 648.2301 388.3756 660.2897] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1389 0 obj << +1401 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [488.512 189.2078 561.5676 201.2675] +/Rect [460.1655 618.3422 533.2211 630.4018] /Subtype /Link /A << /S /GoTo /D (tuning) >> >> endobj -1390 0 obj << +1402 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [390.4905 157.987 459.1625 170.0467] +/Rect [362.144 588.4542 430.816 600.5139] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1391 0 obj << +1403 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [321.49 126.7663 382.69 138.8259] +/Rect [293.1435 558.5663 354.3435 570.626] /Subtype /Link /A << /S /GoTo /D (options) >> >> endobj -1392 0 obj << +1404 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [317.0267 95.5455 385.6987 107.6051] +/Rect [288.6803 528.6784 357.3523 540.738] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1393 0 obj << +1405 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [356.8967 64.3247 430.5501 76.3843] +/Rect [328.5503 498.7905 402.2036 510.8501] /Subtype /Link /A << /S /GoTo /D (tuning) >> >> endobj -1375 0 obj << -/D [1373 0 R /XYZ 85.0394 794.5015 null] ->> endobj -1372 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R /F48 880 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -1397 0 obj << -/Length 3410 -/Filter /FlateDecode ->> -stream -xÚÅZÝsÛ¸÷_áGºc¡ø"¶O¾œ“ºí9WÇ7›»{ %Úf#‘ŠHÅñMÿøîb”(Û¹x¦“‰.€°øí qÌáŸ8N
3¹Ì³\³”‹ôx¾:âÇwÐöîHø>³Ði6ìõÝõџߪì8g¹‘æøúvÀË2n8¾^ü’&Ù pàÉ›÷—o/Þýtuv’éäúâýåÉL¦<y{ñÏsª½»:ûᇳ«“™°©HÞüíìÇëó+j2žÇw—ß%§â -D+U~ØŠö뙡öÔå$_Õ¥ï
JÕ¹>Í’7p‚Ôôp_tTëÕù{–tB`¸8ãr+(xàR%g(À4iKd–j/u
'b“íÒq…f·Q ¢>T¸ÐráôÄÀ2Àö”qз,æ÷#ž\Áim¨! ËM¸¡öEYW¥§õØñ„ÛÐÎy<,ÊpÂ:!`M }V'7%}“ÌžøHDbŽ•
5¨,±«:X%ȬyrqK݆У·¢q -êAl>m˶£FXX[ÜùÖÊ/²îèä¡þ+Oy‡G<Ú9õªõFªê‚>Ì—ÛI$
ÊCÅõ‡‹w^«|p -Ä”"ýtG˼ -úì}{Ñ‘Ab¹!Ë´¡OÚ¶=t2RsÆÅ‹¡0fzí¤ÈâʉPY8C+Ç -2ØÊ<ËøÔ2ÉÅWDYžåëÊdÀC¦’òK8o‰NÚä¨Øù–h}zcðס5Á
ÅR󒺋…ßWK*?GÝtORcËåO4hY~.P“N²ò¦#”÷ÍÃÈ~,9ª²sUU}û²i>¶!‘©|'ôÍ™µ¤ähpNfÂhç -y“ ¤9íeAu²kP©*o·ï8`ÄÀÿcßÞæàAhi\Ô^ŽðAöÃv Ä´{®æf”bÂÇÑH—ƒd!±Cdç–.¶ØÉlj:2‰íYl·‘gb1>° Ã…¶p©\ŽN~)>7Ù=£è)ý8¨õ+zReçTGp*öí™ùE„÷D˜%`sy‘Ô©˜ÃP -ú|¨–‹yƒv/{T
Á“KH.‹¥ÏœNi\G–—1>•Ñ$·;M>zÌ?Š^&$ý±t)Qž@¨¾ :\BÎS(•Êc¤†õA¤†ø;wíÚ -*®ÿqþ3ÕÊ/óû¢¾óC¶ãà› &®écgPÎiŽ8¥gÛÞ1uv-}Gp·À¤ôÐJâ—Ëé4ï›GlõÞú°æ8†rK¨í»gf#Áë¸mM‰Ÿcµ…^0vNŽr0A¾£“pR¨>ÆH‡6>ŒÛ4$Ðq¥ûÎ@CUg!:êu - -›„wÈÐÔnoþSÎ=ÑE,P~ùZwYaÈ°.êÖ…œäÇ5ìDɸ°EF&„H\—D®Kªë5yéÕZm—]µ½G¹ŒÒi $ -‹c¹Œ7$Oˆ4åLK+öDêfvY,ÓÙ‚"xINO&Ñ'ÊäÓ–d‘,¡2ûe²hV8®_Œf*v?Ù{ú -`´3‘CŒƒ¹hÌ'7¦DŒûa”Tx#m¨ø\,ÁnLÅAV0¥âÕ•3uû3að†—¢Ôét‚f¹D -ü9VFB0þ‚[k¥-Ëx¶skýÇF……`ë!rp4Ž/_
#ƬfqS3$A™íòQB2m³c…ˆÒyú~3Ž¶"€îüK1ïf.¾Á,k¹Â«ê9Zc¹Ï:°%Ú1üˆ~PȨ2Ÿ!)L¾ëoÊÊ]Ç+ÆÅ8¥!Û5/–ãëÈF¡mòç;—SfQ0Ù_3ÒgÃ4ß±ˆ{èÒiÆ´ÈAƒsø¶³E)9×,¨ÝkÂEh&óL?̵T.Ÿ5TcÌ„DtèÚàc$‹E@͈â‚@$mA…[Ñl -E«"Ä×ÍíéøÆl@§ß€ a-ãZ¦¯Š ÁѼ‚TʬIÓ¯`FDÌ,ž?ƒ ž2üÅÁþi@“ê -ËÕâ9mÍX -n×Ï+C¹ -–1¬SxÙÑ…uX‡uH„u3•g1-œÇÉ!ú»”A”0°‡zh¡ÅÛC-Cì,=ø±§?#ø‡=¤õÕô[D/•·™qánz‡[=ŒÇáAxz<ZÅŒ5ò+X†ñ(r
®-͞ƣ q£ÔSQΔ1Aôç)rÓŸ'¶ÐybÍÉÛé´äωñ<‘>âàÍËîaö¶HIzÔÁrÚ™œC{IŒY‰ÎÕ®=š¥JÐ< -)Ì~¦C—>`Õ’`4VMÛRo÷14‚îܽÀ>ÑV¸W¤ùÜ]âóÛ¡ç4è€WÔhûlxy<Å×0‡åpK¨Â56Vˆ-ô¦û‘a“? «¼‡&®¼¯W&æ¶P½ñ¤íhNS½€Èý„dÜÆŸ<Õ¢öYaÊMˆ<T_Ð)ªýóÎ
³ÜàA‚QFÿiòÈÓœñTã«:'µ7çáEͽ*UíÇþ宿Áî¼hËÆyhñ¾ÍŠî†š¯š™°§V¥Ï„šÂ¦²L>“8Nšfô²á¯
Þ®ªe±!"€}â<ñ}-&؇²^ßrìGùe^®;š £Ç{àƒc?us;1d(þ?f.âSl±l›ñ£¬w+O ep¯›”¼.R´ÓMÅ3Hü]cŸ»˜‚ŠâðŒûP -Êü˜† -Dúi¼•<•öºÇÓAkôÄè&€ÆµLf&ðWgYªvnc5¦{¯÷Ïep¯”þ'}ÿÛa‘Ê@Fò2eøè·…{¿1t±®Uîå5Å×ë‹c‡âcþ@‚uwÒ¾ˆú¹ìw{úTúh,¨¥_Ÿ=úW'º‘
ÏK·£ÇÞp#ÕO[H -†¯O>‘¿Çò¿ˆsƒ»·,×äÞܯcÀAºçE•ÅG- õω@‡d:Ù¹9Çe â«‘DÒر¿€†aš¬·¸@¾ºúpñî”è—N‰øáý™'ùßgh;Èv}’óÄq›|Ÿ|WþNa÷¡î汿8õ×îw:ñŠâW)õÙåÏXx¸y ì=
Š€
Ñ?
Š~{З}.H*ú–zk(éwc´Þ?Ê…äK+%¦~CÿýÞ¿ù»ýÏ™!9PÖÊiEñ -¥âªPè™Þ[{ømïÄâÿ’:eendstream -endobj 1396 0 obj << -/Type /Page -/Contents 1397 0 R -/Resources 1395 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 1394 0 R +/D [1394 0 R /XYZ 56.6929 794.5015 null] >> endobj -1398 0 obj << -/D [1396 0 R /XYZ 56.6929 794.5015 null] ->> endobj -466 0 obj << -/D [1396 0 R /XYZ 56.6929 769.5949 null] +470 0 obj << +/D [1394 0 R /XYZ 56.6929 484.6014 null] >> endobj -1045 0 obj << -/D [1396 0 R /XYZ 56.6929 749.9737 null] +1051 0 obj << +/D [1394 0 R /XYZ 56.6929 459.8194 null] >> endobj -1399 0 obj << -/D [1396 0 R /XYZ 56.6929 374.4718 null] +1406 0 obj << +/D [1394 0 R /XYZ 56.6929 84.3175 null] >> endobj -1400 0 obj << -/D [1396 0 R /XYZ 56.6929 362.5166 null] +1407 0 obj << +/D [1394 0 R /XYZ 56.6929 72.3624 null] >> endobj -1395 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R /F53 957 0 R >> +1393 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F53 962 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1403 0 obj << -/Length 2993 -/Filter /FlateDecode ->> -stream -xÚÍksÛFî»…>Ò3»O>î›ËMz9''«ss×öE-N)R'RvÒ_Àb—"e=Ò‹3M<‚Xì.¯@ñƒ?>JtÈdªFqªB͸å«6z€±/¸£{¢qŸêõìâ‡Ò0D4šÝ÷ÖJB–$|4[ü¼y{õq6™^Ž…fA^ŽuÄ‚×ïn¯ “Òã͇ۛw?þ<½ºŒU0{÷á–ÐÓÉÍd:¹}3¹s©´€¤[â?n'Dtóîýäò·ÙO“YÇrÿXœIä÷¿¿üÆF8ÝO,”i¢GOðÂBž¦b´ºPZ†ZIé1åÅÝÅ?»{£vê!1i™„:ñ9 yHN:
# C(§íz‘µfñ+ÓN(YÜÖª4h—Y‹P<-MEPVÑXÖ¶fµvÃECÏU¶0µ5‘-LiZ‡ËÊ’€Í%O“×ö¹hÜ‚MSçòâ¶,Ú¥›G*[™Wž1ãWJ‚miü´0*$3æ<Lµö˜ùÒä¿Û¥As÷°³L–/ô©hÚ¢z ·!ƒ„k?¯MˆKƒTùˆ«PªH Xa'ÅBÉÄî¦VØJ]g*EivS=[vªdaónjÈÝäÙeÊز¡ê{g™¦©·›Üø7àqáH²Êqú/Rò\ÓóçÆM˜-ÍÊ1Ò·àC¨0U\Y>fKT¨ÔIИ¼-ê -Ä.“((IÀ¦üŒÃi0¯7S?¡hqÂ=½¯h|zó†ÐàÊ-²0M¾)æÆí`U‰´y]å
-±x\DfôJ§Æ•sG=íi)À~ÙtŠVì&‚0˜ù´.³¢Â½¹pV-¹t†€¸Âm³ -ö€0͇œ¸Kg°Ôp¿3ý¥¢èèÏ1ðlÝ£¢Pû<i‡®›Ó¢è¨Îpò|5ä„‚âXN¤ÞŒy¦pî‚#²h#TQ~/ËÉúÉŽ“ÝÅÒKÊÜ5ö·ý#r‡JÇj¤’$LáíK2q©’0fñ^&þÿÍòŒô|ó(4ÁZôqi¸Ô¸;ÔXÅP$G4±”Ï xðü©ò>MS$ÛtªðWpo 'Œ–»D¡Ë)¦®°*ŸQo+JÆGA–Üç÷ëd€Ò†ëJHP,SbIš!OˆŠ-¦qN¬Ô[)ÅZÈÐ/Ç‘Štp…ÂK£ÀT9d"hŸ©x4ž-
<fåÖè¢1Ø íSò4vi¤±^Ñ"•Œ‹%’¬kp™í»Í°ž9¡§ž -Ÿ5¥ Fº€4›½Eé”9“AžÅÊŒá¶äÁ¸,Ò -;öÂŽ5˜zHªŠeõU.푽Já4¨²òëtHWÒ]ÙÛª°!PRŽŠO¨¼êja/~åk;@Žl½)VÙ¦ÀB_·6ÍChî0ƒ$ˆP¶Ü9úÀQqRă²iC %†pã:yÊŠ^ ‡¯Ëú ”µM„"›£Ò"~ÝŠ€ùáâ·]ø|ã¾î‡œÂ¥-Ͳޖ‹aN²(š<sùé)«î™Ë×™à7>2áSÄç¢L£0qá'/¡L -û‘rÅb"Õ†€]dm¾ÙÞŽ’ªE‚mM–pלp²U<é2A%¾9r05õÊ`dt7»51ê«tE…âNh¯'–—ÒÞ®ýùWdq<JCТ+ŠCû°Ï2gÉÀCE -åŒ`à;§û±ÅŸÆ|˜ß×eY?u-É^oó‡5h#Ë pÞe$‡/ a-¸vTÞ+!&ŸÒ5ÇÓhAG*þ¦Ñß â -tLAÅÁ ÿPC@†§}Ç*ŠUd;WBÂÝ×´e‹…s_ÛQið®¢òK -µmWðB®â$ú9Çè
;gå—$Ñ ùõ{©Zô• ~ù’~Æqù í¿PŸPꤔm\Ä"¶\xÜgÉxsdU?]ãƒÎvÃ÷ "{?¹»f{CxÛ|ÚÝ@®óÍñKÔ MÕ¢pEk©jacöIŸ„o jѯs¥æ; -Ç[KoôU¢·À€{D ÷íáFªkdöO¢$!`…OWIÛfåäÓÚ@žZV:Tß6UD¶ O²M -þLâ€ÚIü„µíG©Õq-ôÎ÷GXž¤!Üç",œ²å"ìG(µ–<¸:6Ø?aÊ¢k"ïË}…¡:?ˆ%'ÄÜçÿ¥ñ7èåñ8ðœ˜!ÍK" -Äo&ÓK¨çg¶|`ÁÛºì¾ûÂø¡h}ˆÍͦu^ZsæŠi{á -üYÁqáö¸þŽ;z\KLÜÏÉ6²MbjN¿¹½úǤ)Èà†Õ1”l][w]¹2à]Ë4vÝ:ÀØÀŽ}¡²ÈlxIÔ@ì@R84è£ÙÜélwÀ—mØÅ/Ù°ãLCÆÏe\AEÄ$Eôk§
r›šu™åÔ¡ˆƒ¬”Z¡ñ®m
°Ó@»®ê‚îÇ$ -ÝaÍ#ô@K<uîÁS¿6Y„ÏŒ(¼ehÇz -D"R`7Kw -Dx4*
”ú5šë åëä¬c¡êð«oú®ÌFgSÕ/ýmäî÷¡àô29öÝ®kÇÁ=Šk¡ðbý죸ÿ¥£ê±þ?+–ý`endstream +1410 0 obj << +/Length 3082 +/Filter /FlateDecode +>> +stream +xÚÍZKsãÈ
¾ûWèH§¬^ö‹Üfg<»³µåIdm¥²%µ-f)R+Rãq~}€š¢dÉòij•”l¢Ñ/à +©¬µYs¼`Ym2‘Æé‰eãÑXi‘ËØœž‹ÆÅ07i„>˜ +$˜ +cST£¶"U2ß©1¨Q-2í(µR¨TŒz¬‹•C)ó^és‹\i\™®?ón¼*ºùòr¬SµnUÔ]9oAkIGÓeÙRÏæ2‹¶•£?ÂqÏÃÒÕØ2Q·äþ°8ÊCJ‘[«üz3WÖ÷„‚ízQtnA/¸ˆ.®^TôÚ5üÄy±1oê8˜»¹Ûuû“ÚáI•Di˜ŒzB* +ä2 +Óôð;ƒ‘ß&CàŠ›ºz„dŽÑ(óU!4ÐÍׂ 2K¬ý‚)È“JR+r“ÈsŠµ0Fû£?”Õb^l/ +—›ÎÔóŒñ[žâ>Ïݺ£ºeÑÑì}tÌK7wGV“2Cù©¿ “™÷È©ZN{fn/Uz*ü§%`0Âè\Ÿƒ +WÎÕ”!2/„ŠŽ‡YÌÁ<{¨àËq¨@¨o9•Îz +¶šºzäE ñ=Ç@3–ʈ<µzß?ƒÕ>×è!ór 4ðµ€²+°üw¥“×\$ÄE:lHé|XéyRñÛFd*‡ ÞJ 'æPŽ2y*ÒÌJ>ôZíüw{õ\ v™i©¾<¤IWÛ¶£–¿¿îyô€ð¡zÿ±…” ¿Ù€ÌY¼o㊂b1p…`- +PyV鎮ÇÚ_ѧBÀÒ©aÒ!רÊyÙ!²®S<¿Îæq42îŠÐC‚à ,“îÜ-'“Ûß]ýæöŠˆ·ß0 33Oº¹½~+ˆ6½ÌãÈÏv$ +Y¡àÀ…½( +Ö<²?4ûã3nû*”GJ¬¸a“öà>¹M¿ß#‘[7F>pÊ£›¦Ã“™<ÜT&•hù‰¡¯è:·Zs·×<WÅÂQËÙ€má*×1Ž
ÁœâúE˶m3/¹nƒK–Ý’ÇÑ#ˆÓoÌ…™<,ÂŒ®cIÑÒÍ +ºuWÀ0ï-Û®/#îomä/ØÐÀC¸Á÷¥ÅXóÅ)¡?Ò³8Ž£Ÿ}xí‹ÓeåvCöüP‹$•ýP!yðƒ{‰øĵÍv3wá
ö¸`B24þÁe²]©ó§–@P¼:â,°À÷…‘fxía„â Úw\ÈÈ’¨"ß;ǬÙxJóà‹6‹îè}Eý“÷o‰îÞð$×Î7åÌ—6 ‡rà…Ì•ï> úĈ½ÒÁqæ9sO +B´¡É„Bc?k.H@¯Ã·§ì“$©H+¹’)L&À]G·`ÀŽ¨´[°ÞÎÀ}/–`ß1<éÈÐGVìë‡H¯ÝM1™ðRËâO?saC”›°c9âˆz}—«uåVÀܾ냪ͻ›[Ñ `aç‹÷âCrU|ß{ÀîáDD%ÇQ¯=bCó,ØÞ ×ÉúÛœÆéP-õÌÒ,êòÇkR©Eù掽uMèu´) –5¸†Uð®Tð©Øé?6fÌþïñRJ‰c@›.9¹¦Å¡á7òØâ&.ÎiûÀ#â;yDßCu±éÊù–BP#ûr_¨`]zµnÚ0AX¿u0²è˜@ˆ…äôxA‰Ìmè~ æ^hÚÈReds˜œƒZ˜Ð–÷µW&\OLò öLÎ-ØIÎy´fy¹Í'Ï#éŠõ¼ŒôTлi¯¨j$\
hMØ·<,rœQœèKcr>*MœÒ÷àéðNMM„·‘L£¶ÙðÕ1¹ÚV]¹®x¸—•b™ aí6«²#‹…Wº‘psë’Š3 +<çvƒ*ly±žÓ}.Ði,øý½ +’ endobj -1402 0 obj << +1409 0 obj << /Type /Page -/Contents 1403 0 R -/Resources 1401 0 R +/Contents 1410 0 R +/Resources 1408 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1394 0 R -/Annots [ 1407 0 R 1408 0 R ] +/Parent 1392 0 R +/Annots [ 1414 0 R 1415 0 R ] >> endobj -1407 0 obj << +1414 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [341.1654 518.2039 414.8187 530.2635] +/Rect [341.1654 214.5127 414.8187 226.5723] /Subtype /Link /A << /S /GoTo /D (the_sortlist_statement) >> >> endobj -1408 0 obj << +1415 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [434.6742 518.2039 508.3275 530.2635] +/Rect [434.6742 214.5127 508.3275 226.5723] /Subtype /Link /A << /S /GoTo /D (rrset_ordering) >> >> endobj -1404 0 obj << -/D [1402 0 R /XYZ 85.0394 794.5015 null] ->> endobj -470 0 obj << -/D [1402 0 R /XYZ 85.0394 728.5142 null] ->> endobj -1405 0 obj << -/D [1402 0 R /XYZ 85.0394 696.4086 null] +1411 0 obj << +/D [1409 0 R /XYZ 85.0394 794.5015 null] >> endobj 474 0 obj << -/D [1402 0 R /XYZ 85.0394 696.4086 null] +/D [1409 0 R /XYZ 85.0394 424.823 null] >> endobj -894 0 obj << -/D [1402 0 R /XYZ 85.0394 666.5529 null] +1412 0 obj << +/D [1409 0 R /XYZ 85.0394 392.7174 null] >> endobj 478 0 obj << -/D [1402 0 R /XYZ 85.0394 609.895 null] +/D [1409 0 R /XYZ 85.0394 392.7174 null] >> endobj -1406 0 obj << -/D [1402 0 R /XYZ 85.0394 587.5837 null] ->> endobj -1409 0 obj << -/D [1402 0 R /XYZ 85.0394 501.2674 null] ->> endobj -1410 0 obj << -/D [1402 0 R /XYZ 85.0394 489.3122 null] ->> endobj -1411 0 obj << -/D [1402 0 R /XYZ 85.0394 309.1877 null] ->> endobj -1412 0 obj << -/D [1402 0 R /XYZ 85.0394 297.2325 null] +899 0 obj << +/D [1409 0 R /XYZ 85.0394 362.8617 null] >> endobj -1401 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F21 654 0 R /F47 874 0 R >> -/ProcSet [ /PDF /Text ] +482 0 obj << +/D [1409 0 R /XYZ 85.0394 306.2038 null] >> endobj -1415 0 obj << -/Length 2737 -/Filter /FlateDecode ->> -stream -xÚíZKs¹¾ëWð8ª²°x?’“W–¼Ú‡¤ÜÄÉîFäHšZšär†–_Ÿn4†Ò"G^щ)U
-X*¼Ì.ÆÅ´^óT¸ÄS N¯&"Ÿ"ß„ÏPØ°¬"'Šœ„/9UïgU
l—!doŠj´(ošŽå”:öÏO‘ã° bÕIÃ3\lÔìHk§ÏãÞ¶@ôAÂ=“ÒtȦqÖú¸í‹Áð†—õ‹ùâØTT –µ>H™Ín±TMWhÉÇãÔ³**à¹ÒggçÅ¢|c'MÛ›âd7Ç×2sˆ2B2Š„^í‘Çz£‡ˆß[ó%S6#vŠÃ:É” ò°!0o¬ŽLùáìŸÀc#ÁwÔ³Ädð%Ê šc1_ÞLÊÑ¿ŸÒ·ªšÊ¼Fnbý¡¬ï7F½¹1Íß1D˜ìçªéÌDJd°³EyWN££yg§¥ --o>ÉGQŠÐM’ºÅHš¼5ô¦¬^aÝg7Ë:þ*ßÒŠºœ$gšL(ÚRƒ‹·¿rÃ9üÉɶ}S“’§†€bˆ"o‚MA‰ÝÚÕ–Ûót᫺_“k
=÷«—…yôêõîøÄ -%¶}/˜?ºQãI§(>Žîóé]± êí,õ}Y• -‡&¥RJo -ÃïÐ,’ôÊÔ¥T|0Z»<”7Ë8 º°Ê2:B¡Õp·qÿ€ -:Í4ˬ&¢øXVõö|d -šÁ
SÊÐ)U´DãChY¢“|Ò‘Þ2CljÌiB‘H!SààŠÜÅd©Äöµ‘„,ñKòرŒØ¼5RJÄ[£Ø!ÝaŸxOôˆ¤+‹ÿÒ¥QK‡½3:(‚m± }’60
@:sõ“;ð[GéN¬#gUGlð-•9u¡„hãÃêPbD<u›FŽ¼;–ϸ³ooõÇS¼üâà:$i¡d{Ð?6&û;&VoâeYÞÌ¢XŸ=ÑD€ú}Šî9’+‹•t€ZQ
¤eÕî|á?’1¡at‚Tçå9µð‚/ø¤ðŒ[Õ‘â>eVB>Ãx,c ÙzMüH±î÷ÇOÍ“;´½µ¼üdHàs2#;©%ô·âoÒ5|v8}C×4®#ùp_Žî‘´Ií±1©=’+µÇÚ¿Ú“/GéÉAž"Âà§áõ±!{Õ< -yª%s ¿~.ö浨@P:á6÷ËtcÙðù›sÝ~òjAéƒ×ðs8d4ÉQÄÔoãd`RD¨_„+OZÍ67[þ5ih±2Z.Ò=|=Iw³òI¹¥$«r@¡ÙÖ‘•E am°ÿ+‰ò¯rYs¢+뜎þâKÂKH8ñPz%ö<Î;Þm^yÞº5çÌIÖe%“^èÇžó^',xêcæõƒní˜ò»Ð[2…Pæ"F9ûÙ[k^FY¹êÖZü -endobj -1414 0 obj << -/Type /Page -/Contents 1415 0 R -/Resources 1413 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 1394 0 R +1413 0 obj << +/D [1409 0 R /XYZ 85.0394 283.8925 null] >> endobj 1416 0 obj << -/D [1414 0 R /XYZ 56.6929 794.5015 null] +/D [1409 0 R /XYZ 85.0394 197.5762 null] >> endobj 1417 0 obj << -/D [1414 0 R /XYZ 56.6929 122.0233 null] ->> endobj -1418 0 obj << -/D [1414 0 R /XYZ 56.6929 110.0681 null] +/D [1409 0 R /XYZ 85.0394 185.621 null] >> endobj -1413 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F47 874 0 R >> +1408 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F53 962 0 R /F21 658 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1421 0 obj << -/Length 3228 -/Filter /FlateDecode ->> -stream -xÚÍZÝsÛ6÷_¡·“g"ð½'7±[wR§ç¨wkû -ƾº<gæ'͆³¾œ_üýF¥èD&“ùÀW„Y&&óüÇé믯¾›_ß_ÎdN“àr'áôËÛ»7DÑôyýîîæö«ïï¯.Óh:¿}wGäûë›ëûë»××—3¡¢XÅ,þóîîš&Ýܾ½¾üyþÍÅõ¼yx,*”÷׋'9œî›‹0P:‹'{è„ÐZN6Q¬‚8RÊSÊ‹÷ÿìFÝÒ15E¡„Œè) -”Ù–¶a[nFiÉ0=ÙNQœ¢ê%ÌÌBÙ«^ªêE¤‚L©x’Æ:HŒ‘îAW:Sh„wï+Û¾‚¾H¦ær%rúöêjºÝ]ŠlZ·õ².‰²tkZ›Á´´æÛÛ9ŠŠ¾íÚRcSä34ïã…ØN¡Ó°Ó)àqoˆ{ùLÒi×à.Øz¨wÔ(Ú†ë¢ië]±4%õ·Ýn[7"S9]t-‘‰á1#”%<–ýîoÀY¹µEÙÎð*UÓÆîíŽFŠ -–oL[Ô~¯+ÛÀ–Q¨¦6X¯78¿X -žÛ h¼bi©“ÛG[Ö[ç Ð]<Ñ-ÍïÈݱËö¼Ã^cW“̦·àfJ‚g ïHÅ‹”¶&J³f§æ‰G.ãfQwÌäÑ슺cNÍS3;öTòÖnJo¹iÍÂ4αßtË5µÏ - á}å4+³a"9>´¶bÒf[Ës´RÙtgÀy]»6< ½ª¨VÔñD4ðj‡{[³k=s¿œw½¿¨qS3gû›m-ï¹1ÕÓ˜3’Ü‚”&Ñ™²Øí»«Léò8¢pÔj),ÍsI¨kÓ¬‰ÒÀ„lÚ-ÛŽ&6=^¿æ¥ƒ·féÒ¾VìÅ@\®
&pœyÏLàÔÀò:U[,;‘ˆœEFjI°FN±2À¿Ò©²!RÝØ!ñ ñSÊß\¦Ùkkr´
Äaû´uGPNKÓ4ÜžÏߨ yûuá¢9¢Ü‚¤e]5PôlÕRŸ”@Ñ^<Ï‹âÑL-fQŽž“üc…»CPÿ»bybçiý¤P¶§ZjTÖæLCç:cKÖdÒ%S–´Š‰Ì6Ë]±°yЋ—ZÉt/ ÍƲ„Jcrá” =¢ |¶Ì©ã F
Ï.6<½,6EKD*æà…õžÇjÚ… -RÐîØ_ž»`6ì–¹ÕÑNK³\[ð¯@Ö|íÅ ]Gl×ÖMà˜Ž!ñv‹ñƒ4WKÔµkÀ<-”GKCX¨E„„Iþž€Öò37eìP9¡þ8#5áèÂoLÚõ6|`S®Ùbº15yÙÏ€+â¢#'è$¿œ{ÙM³©0†›¦XUN8 :IttàarÈs]®ÒœpéÑFÔÚc®äò{`£¼Þ€ -] -TøüNâÖý6Ô` ¾.€ŸñáÄ(ØR¦,ÚÂòL‘ð½uiÙŽ:àÖî0©–Tšnµ²
#Š~jÙ†g 5<y]w%ŸÀ‘¾ÈHÌöQØŽ»ôÍÍs!;—@¦$„uÝ´v%Ó[^kèÙ¾Zæ6 -X©Y*Ôw»ÅûÖ¶(ó›iöDh<[D:Í»%;؉dÕŒólX˜Á x -A á‹¥ -êL7ôaÌš†ý£Rkþz˜Tâĉ{I!iÓŽ%í‘yC=VÂc‘ŸnzóšVŠPE¯ÆΆÙ3„äÝ>•–›¥J³£ŽK^aŸüC_ÚæÀ|7²ÏGàåäÂÎÞp°õÓéºa-è·XGö~S R%B^ææŠ|Á¼'‰Ó-(š± ¦ë6¦MO75V4 [“=ðøàþ5]\²Ž@)-‘Ê¢ryX)‘u«5
¬EÕù”ËpjCÍÁF`¶BoQò¶]CxZå -m󱌫ÀrÝ¡I¹Oy7QnglÉé -Àbs2ÊwÏÑ•î2ˆ[1ÄÇsTP11Ë}Ñ®Ó`°4ÕT‡«Ó™fˆ¯C4:öÚQûÛÂIl(–©õpCyváh¤×Êr5¾Di©émušÙù*Î5¶ìrŸÔéÖßpLnà®'—kG-ws(¯ÛääÐ ¥@ÐcÓÉtÏô²pl8PÊ+&Ñ5综‡4wŸdž'+é’ׇIýBdF®±'7•ÝÔU±lFo.ã¾êkô¢~tÁ‘ølœx›„}Y7\{ݹÚø¡îõ>D$¶øn‡çˆ¥F¬û‡dâ¦×D6uᥤ°êÐ4Gø‚a.ŠÛŒø CE^¹Ø<¨Äuþ¼h~ÁlUæ¯ -§³øèî®ÒÃ&tjlЩ›a/&"·rï3¶A0„Æ*Œ89À¼Û»¡ÔcéßcH2‚/„@
7ض -: -MßÓ’ƒ¤Ö~qîϲTàßRüU8y1-êŸlþl-J•egþtª -O—>˸±Ê‚8“éˆèÿnÿ¸Nendstream -endobj 1420 0 obj << +/Length 2921 +/Filter /FlateDecode +>> +stream +xÚÍ[[SÛH~çWøQT…ž¾_vŸ3`Tewf„-‚*ÆòZ’ýõ{NŸ–-;Ø +ƒ©!©JŸnµÚÝß¹ŸVÄ€Ã_10–Ù ÃÀÍf0¼ÝáƒÏðìýŽHsöÚI{ÝYo/w~:RnX°Ò.¯;kyƽƒËÑï™eŠí +<ûÏéÉáîž4<;:þ +Ÿuu‰aåM,pÜ,f^W³Û¼!ººÆVdÍMç¢ÊšÚæÛ4=ûƒžOFÈš‡ó#áD‚Ü`]ÝMy[ÔÄÌá8¯kxIP·žÃòÎårWø8o•ç!´g +„v°·`pŸÄà;Ž»‰ùkoµ60倃{Ò1î–%í;‰“ÎßàêH¼Pkä£Uši=÷þÈaDúº«‡rò™º9É‚þÓ‘î*¸Ç-{Øy|9]Ó¬¥„6ÍB‘ÁUïóq9JZ{^ÿc•¥sI· *F8÷w1€ªQDô6Õ×¢bâonT_ë:ᕵN[lA£³›ªnˆÊG£¤½5šK²ã =!µâø„Ú¨Ro€Ö¨³QEa”ZåÔUrïªLkŸ=ò¨ÀN?¢ÀïŠz8+¯ŠÄ×r’ø{t@@bÖ+o“m)/íî)–·=ÏzÖiǬ‘²‡uF0©<iÖ>üƒ«…@ïmR«%¶)ÁûáóÞn€¯³¯çu°Ë[ósÚ¾±>øQçëO&½² f%ˆþzðX¯²õyî*Ú3rÝi>kÊ|üÝ4)z§äiî®ñúš¯ÿƒ®‹–›¬×€r2*iÝaSV¨†Ò4Uj£:1ÉoõpS$ë +]±˜‘öÖP/ºÙîK»ÇÜ=>Åñ…Øã–¦4³{€’@"‚íuu7!–<d‡_§Åñ¤ÉÇi¨+›0»Lo“l!=à±^6;Lž -dó¬²ñŽygû¬2WpªÎî]¼{º-=Ï>TÃœ¸A_rtgÐ +lsšÑò‡"ã³qñpþ–™óiäáZ~-ñõYÌë ²Ýpt«’V’kDó”eŽ!zv +ìÓò¢‹¹W¨W,×çquÕKÓª.1sH¸^ÜMð7³ºµØ^%]üpz°ÑÎV_q|¤¹gFÃ⛕±–K±çÏÇ'G§ +ÄÁÙG"(YµAFàÀ]‘*" Orêb
ýFXÎqáIg˜øŒ@©{ÒíÚ§2¢Df•ï‰”4‡õ<§s_¼;”‹‡R²P˜GQl$U-Öiª\*[ +ÁÌJÇÖ8ñcs +Ü=é¶òE²X’î«+g™´!DP¢g¨–=»RѾcÓz¤£WˆÏ:^ûä:oEoŽÆ~ñ2Îdëvz¹¡VÍ œDGë\ü“:´½]h$ê$M‹‘´xçÕ«ëÖRùìê®y,2¬›rœ¬iÒu R¤ÔÅñ{¬‘q¬€õz¯zž‹š¥ÚHÖKׂm¯¸Êü¨ìIýäxšk +ýшPbÕö‚öÇÜß·Á"ðõë²€Ï1%€îu•ˆ&Õg}ŠkeJ©å¦l¬E/ßÀ‹Î)_q±K Éw=¦W ËtÐ$é€"‚+ÌŽ"¸`/kÐyº¯“¢-'×U,ߪ%|aJ”ué–0 ¼³iê²=^og߯ø¶A:aYO)QqÍŒòdHQ‡ê;QG÷…Ê !ÕÊ:õHÔÛk7|až<Ã`2ERµËK×lH'z½!MJ÷“˜w{÷§w‰DÃ6®¢Êy¯ópøªhšb–JþЧkÝ(øôµ´Yx.q(åù@ÄÔÎCØ„P-?˜§ß<én°ÃÇmYÖH¤5Œ{ÛØJHZSdYOöÏ.Ï!°åŠg'„;ú›»æ4ºùÖ¦åX‰n<¡’x/‘m +Ä +:ºÌ´JÕQ|-ëfu½Gœ–¥°ro)XG¢s6è=ÐÙ€:?§–>XÒÍ¿qŠãt–¢ÔÒÒÔÆMí=V/Ÿ5Õ·Ï.“uEc[i O1O1üíë%X +f¥îñ}Â)ÆU2ÒŸ.c«’üjO©öüÒ +/¶ËÂK³[Çy‘ÁHEáE‚„©|ƒ)ù;…W¾>á
º^eâ
Ò•—êfö0ºÈ졳’ÙÃH3¡%k•–yD}çëusó
:ÓÆç ø‹fâÁAÈ¢uÊÅ ¸!Å`ÑXâg€ZÏCÃØ!3¯÷qF>kˆŠW}:]! Ñæ'H§o’tºÜÃZOPϹ¹Ùì—;GÅ…Q°VžëžÒ¿LiCÙãJðcŸ³¨ +Õ}9ŠÙ£w,M§ `©ÉÙCQL¨C˜á¥$‚ +N@|BÛŸÆ–«§ù+L)ì† +içÈÏCËÅr,/3åèó÷Õ/–ù 7aøÑ/òÿ+ÜŸò~MÒŸ>‘V˜ âZˆ˜³ßýÁ™TV¶³:[ÿ? +endobj +1419 0 obj << /Type /Page -/Contents 1421 0 R -/Resources 1419 0 R +/Contents 1420 0 R +/Resources 1418 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1394 0 R +/Parent 1392 0 R >> endobj -1422 0 obj << -/D [1420 0 R /XYZ 85.0394 794.5015 null] +1421 0 obj << +/D [1419 0 R /XYZ 56.6929 794.5015 null] >> endobj -482 0 obj << -/D [1420 0 R /XYZ 85.0394 465.493 null] +1422 0 obj << +/D [1419 0 R /XYZ 56.6929 695.8713 null] >> endobj 1423 0 obj << -/D [1420 0 R /XYZ 85.0394 440.7907 null] ->> endobj -1424 0 obj << -/D [1420 0 R /XYZ 85.0394 255.2465 null] ->> endobj -1425 0 obj << -/D [1420 0 R /XYZ 85.0394 243.2913 null] +/D [1419 0 R /XYZ 56.6929 683.9162 null] >> endobj -1426 0 obj << -/D [1420 0 R /XYZ 85.0394 76.199 null] ->> endobj -1419 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F39 858 0 R /F21 654 0 R >> +1418 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F47 879 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1429 0 obj << -/Length 2977 +1426 0 obj << +/Length 3296 /Filter /FlateDecode >> stream -xÚÍ]sÛ6òÝ¿B÷@ÏT8|“¼77qZw§ç¸3™kû@S´Å)EêH*Žï×ß. )™rœ‹3WûÀØö»K‰‡±0–ÙT¦‹8ÕÌpaùæ„/î`î‡á×,âåtÕ÷×'£âEÊR+íâúv‚+a<IÄâzõ[d™b§€Gÿzwy~º”†Go.~†žPÚÈèÕg¿\Ÿ_Ñ„õK¿¿¸|M”šWï.ß\üðëÕÙi¬£ë‹w—¾:s~u~ùêüôëŸNί‡#O¯%¸Âóþûä·?øb·ûé„3•&fqÎDšÊÅæDÅŒV*@ª“÷'ÿNfÝÖ96i!˜åÈ'¥YôŸCVÙ”Y+Í>ÙÿmW8 _,á(©1Oœ€öqÀå»aÇ>ª%ÈÒ*¸÷2Ö1³q,FÙ§Ùnç©^ÄF0iA/Pø>°Ÿ_½go/®Ùùë_A¸2MtÒ³œGgÐ!#Áþk}(Emc–¤±ZLiÝuqÒêo eX,E:Ï )5S(Ç*eŠ
dЫ§¬ÑÈ)„J-ùqžLȽOFÝþhˆS–èÌGÆŒÇûFöÈØdœ0( |ç “Z|—jÆ)ÙN$¤tl¿^—yâS¶ÙV
ºusïáý}ClµjOE]Wø¹Û¦E©Z@,™P@‰Ï¨>ß;X¢˜M¬ôË¿óÇÉò5õš[OŸšUy‹§¸-è0uOà¼ÊºŽyìb0 ‡iÑ¢|
‚ǃ;–à{9¨×ë²Ëw]W6õ>É·¼w-ò¦]u3gêœj¡Ò3`Œ²2Z]Þ–7Å -‡*Ênš\L¥pþf“•5Á»¢ýX´~O×7t%š+kàî&ëÝ¡p>óë²aoYxža^>ÍÎuò‚f šöUçÎ!<ƒ§»ï×%€àŽ£Û¤—+oêÎŒBWÂÉšmÖöe¾«²ÖË b×±Ú½+¸7Íå¥xÀrW~,üd`öëlãqýÎ
§ƒJˆ]·ËªêáT€«@Q&º!Ô°¹ñ¬ºÏà¾{W"½G& -›® -ÜŒNc°†‚à]‰¶Ðõ8’`!pß _—õŸrÌ2 ¼º¢!žÇYhýÆ‡Ó €l³²% ¡PÑ*ë3ŽLÂòAW`–X‚=àhŽÑø¾ì×ÊÌUIüUñ1s¶¢5ÚmkÚDY½"à ~~LXÝLã„=p%J3«p¬Üuhf_Ô -^ù¸(x«é¥Ø°!f)pÏm@ÓU ÊOÀl04§JN$ÐsâÝD}w+šŠ&VEzÚ>ÐÈÉÚ„Saœf”×\ -B¤^·yù;ç2PpÂDJaùþñü¢pJj¶mÙ´eï‰;yÑ웅ѱSÿ|Òé -Jü@ ì¦kª]_ÐhSd5Ü™Öü.eL`8iX>0 -ø5˜nêÊ/L,ò¾DÝÅqàk©ëÞ÷ÕÄIà$7ž¾+¬óæ5§¯ÞؤôÆfôhŒÐ÷Þz^'°ë,Åho¥›¯OtІÚ`sûí™ lìݲdäËý™.zŠ]ô4KUr‡Àk³ëú™ÂHg¬_D2D2ñtr\c“•îº&/³Þ½&ûÁãÔŽaøÖŸù¬¥öþðöH'0
¾<{{¾ÿ$žaðºs"º¼,½þ½q,™ªMº$7´¼ò[:¥ñÊCGڛƽ’6xÂÁlòøŠH:Ô:|´Ø'=ºjzòÑ8.Zòé-V"åÈÎh÷•¢ò`[ÞÕͨ:tþ¢†g;sN^ï5Òàˆ`Ëc${H ò:©ß€Áõb;y&Ý)j¿+Ps÷Og´`Û¦¬û ™{Þ<ø\f]LÔç ½ó¡¦²Ü8‰v% -ôþ9™2‹øË’Äù]ߢ´î´ÔR¥DØùÌ=6`é:Yhž2mâçË›
:1–5”ä$6è$‘à§zÇÅö¶fõ)°Õ@2?=Ê×Ýù(bLóôrS©b©´æH©˜5¸Ú˜¡Ã¹“î(Çù<öL ¿,{^RŸTb¡>ÇžÄ0câôä”?C™Ý–5íÝÜ™Ðýs'æŒ+ž¶6+,¦’{zl?Œ&—`ýL%N§\)QgÑ„ø_˜E¢ËÓÏ°È -ful¼OðHç‘£þ¢,z~eñ[<hq ×æK+‹3“觋JH†elÊ¿)>r’J)B´ -ÚlÔ—›bÙ7ËŠR:€â×Y_&².ö/ª
(A †J.oÊÞOAäxG·>¸Üú<¥ðA¥[EvuÙwSÊÂØõΉ$D÷I‹ ô&kK—–",5‹O'õÛÊW\Q–ÒÒ`èåYN‰Ö;|tâÙ à*uBÚcZ7÷Ô©' -ﮀsINÊùþ¼—ÜHšŽªÌUˆ "›šò|ÖÁm•¾Ò€>`¨‹»Ì—fé™W§¿Œ…Sê R‰s¨Í¨kÖíÙ“×pc†btÇBfpmf0&èÖÍ\ìz9|‰ -6Ù§r³ó«ÑÏß×üË0²‹OÙ5–?5`m7–SÔš>oF81ˆ\¤ è‰6|‚¡*+ž$à¼!3yò§P†Gu‚šD¥öiÕ†AÜOIÖßœ›ÐX¢¤z¼ÂƒD<’/$OÝ—žZ*±Áš¾ÙÄ•ûe¨Z€üöÈÐ4r{ê#÷!ò KM]øÎ3£ÃÞk·Ù®êœÞ Åøô‡o#X`§ïk£¯J+ù¢®èŸÐŠ ¿¿N„‡Z¡_R+8ðMÒKŽk…LÇû‘\ÜÑm¬¢súÌ,
MJãAè„rµq¼„†x‡ãŽZòfÒø(€ú£G„AY¬¼ºr!áð%a!$6{žŽ:7zÇáÁËñÑËñ©—ãþ.Þc5°ò)˜°ö¥à~Sñ
ÞR‘B䃆,5d|<ŸÎ|@kân³DKH’¹_9ñÅgÓÝçþ¦jü]8W•$GTzÈÇ ºF\¨
qòè_ÖJe‡U“£ÿ ùM%endstream +xÚÍ]sÛÆñ]¿‚of$‡;|\óäÈRÌÔ‘]‰i2Mò +„/ÂHŽÎ£ÀWB¾•nàVCék¤sûRxéÄWQ‚œWÊt°á|(œJú©”Ñ(‰´K˜CÖß¼?=CàÚ¸¹kW‹¬«ÚX–„ž{.‹•iCƒÕ©H½Â,QMë‚°éu%còv‘U
HA&‰wùŽÀ}ç(Q¢|EH¸@ ´dT‹¢é²wˆÀ{]˜Ùªš9 ¯jXÒW‘‚ˆwÄ©@žI‡£!>µR¥¾-»/)V¦AxLZ^+š¤us;þáô\E±ô.ZàX…‚Q©ð^_ßÞ^^L+;=SÍ›¬[“¸•g]üA
ŒSÈ`|"ƒ÷ˆˆŒTR=ÃôÁÛ¼ÓáÍÓ8úoäèvdzœ*_ +•c:¼x*DLL?•‰7A3IAÛuWœw¥ål»ž— ‘2ò¦U“WÍ1Û +Gh)5‡™ÿËßoÙ¢Ð:Ž%Aa’†ÏˆjÀƒ—•£õÓt;Š*JS?N¤<"ªH‡~iJ‚&¿NPLà¼&§:ôŠ1„cbkŸ¹ùÔ\òYÒ÷yïüE5>ŠÐ{”‹)ܨÔ)p³ö-eÂÈ);‚e5+ŒYïÉz`¯÷¸ÂéýÙa7k<ÎFŽ·?MÞŸŠP{g4æD WЃj ‚Íz¹lW“í›Êtàöf˜¼”à†5_±ËŠ <¤ cŒ ¸ÕJY^þF˜{D‰wS,9µÃLŽ½V*mxÀç¯>.Ehã§`°›&ÞÉ' ŸU¡
ßö¥„²©¹ñ¸' ’"þÛå±öeBƒëÉvñÿ¤ ƒØOC€Ü…„}ѹ»…Ò¤B!»?› +œU˜€Ëÿ?I4ø"ñNÅ ¯áÑúS%p”šŒ¯¡ö”Q¼‘ü¸éŠ˜òaÞóRqë”\J† +SoŒµJ5Ö ¡ÓIÄt-aLÙ{n»p«àyWðÀÜ}¶ªÚ5ŸdÍNˆ¬ +°·1ÍL¯bOS> fåfçÜH[:ÄrU¡w3;½ÓÒ´ð ‚
%÷R +öÕ¤°ê¹OL+ dõ¶øŸM+ðn-ùŒ
.¼äöè:l²#I‘`ò®+F-–u5«:ÛHJ½U +Èû ‡çE¨U¶/Š‡DÏWèq´´m:Ümç[on|®Z>¹ø˜Áµß¹ÈšÇ}ÊHt£ ’#DeJ#{ïªÉjë©a‰#¨#[(hõ¶€-3SÆÀ‚Ô[Ï\Ïôðþ’·n^B±:%k1 g%•2)öæøxk8òŽM›ÛT\ e%²ÇÓXQÃY 8Ÿ¡e¥!Ô&/S®§ +™€/—h?ˆ³±QÜ}„ðq_Ђˆ +Û.÷Y½~ÒêØöátùaÿÆ›BTÞ¹pˆ B(I6åé1Ç\gcuL³lµª¨Œä´6¦~%ε‹).Ÿ"úS»zäk:d¬ÛØðI}«va&aü}ïÛ +M¸ Œ]N¨ù{™vÚ¢1»š}(:¾ÁÒ¥ÃÍ,¼>6Ж—öh±M×Ú¬9=L¤%c”Õ¼´[cí¹BÖ˜Ó€é‡Øø@&8ì9« qÅøŒœ³&ƒ¶`[~º4©Æ°Ÿ>ˆÚ¶¤]fnhÄL¸¯òÝK©EœØ/êlŸsDïà÷ÏGü‘ÁKÕÙŠÖy½ó\hCœM6à¹ÈÀ‹ñzL¼,]8xÈ(€Øöqwß0ôW Œ#îR& \%¦¼|š
ðÄä=Ž-hCeö ÊmÛø‰¼Eklç'e
z )ðÀû]’΀±?ÃT]5ÔI‚l¤†ŒŒ~œHkÕ¬K‚m¸Ô8¸ÄÖ÷».@®
y\œÈ\cyÎãÊþËu,Ù÷¹_†€7#zsHÍÎ,מ{wÚb1ÏdtŽ;QB\œÛ` üPuå`LÖYóÙÇ.:¸¹â# ã[/v ÁÝŽÖU;NÐ-
\ë¦ByR°µßSw…¼üý©%ÐÉj׳s)Î1¶^çΩ÷?ÓปgÓªÞü6àÀ¯ eä+úιÛWFGáŸúÉͯDUâË4=ð[›¾‘ÁD!Ë“d—òH¦~”†ÉÒÿ³Ÿk#endstream endobj -1428 0 obj << +1425 0 obj << /Type /Page -/Contents 1429 0 R -/Resources 1427 0 R +/Contents 1426 0 R +/Resources 1424 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1394 0 R +/Parent 1392 0 R >> endobj -1430 0 obj << -/D [1428 0 R /XYZ 56.6929 794.5015 null] +1427 0 obj << +/D [1425 0 R /XYZ 85.0394 794.5015 null] >> endobj -1431 0 obj << -/D [1428 0 R /XYZ 56.6929 769.5949 null] +1428 0 obj << +/D [1425 0 R /XYZ 85.0394 492.6335 null] +>> endobj +1429 0 obj << +/D [1425 0 R /XYZ 85.0394 480.6783 null] >> endobj 486 0 obj << -/D [1428 0 R /XYZ 56.6929 672.3174 null] +/D [1425 0 R /XYZ 85.0394 173.0867 null] >> endobj -1432 0 obj << -/D [1428 0 R /XYZ 56.6929 647.9778 null] +1430 0 obj << +/D [1425 0 R /XYZ 85.0394 147.5597 null] +>> endobj +1424 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F47 879 0 R /F39 863 0 R /F21 658 0 R >> +/ProcSet [ /PDF /Text ] >> endobj 1433 0 obj << -/D [1428 0 R /XYZ 56.6929 430.1905 null] +/Length 2902 +/Filter /FlateDecode +>> +stream +xÚÍZÝsÛ6÷_¡Gz&Æ${s§U§urŠ{“¹¦”D[¼J¤N¤ìø¿¿]ì‚¢$Êq÷.ñLˆÅb÷‡Åb±Åð'GI*R§Ü(sF$±LF³ÕY<ºƒ¾ïÏ$Ó\¢‹>Õw7g{«³‘.Uéèæ¶ÇËŠØZ9º™ÿ¥B‹sàGÿzw}u~¡’8z;þ JR›DE¯¸|s5¡Ž”I¿_¿¡GŸ×ï®ßŽ¿ÿeryž™èfüîšš'Wo¯&Wׯ¯Î»ùñìꦹ¯–Œ5ÊûŸ³_‹GsÐîdzXhg“ÑTb!S£Õ™I´HŒÖ¡eyöáìÃ^¯:“Œ…Ò©ÀIé!œ'R
]ˆÓÛz¹¬ÊêîüB§YÔ. +*ÔU±A_Aݥѷ/˦= ½¹ùé7=®¦Ï«9µÍ–yÓ0ÏÛƒ‘“‰ ÂëQ7™QiÛWU±ª«rÖà +R +—$Ê«4/>űª +à£`Qói}R©Ts•J”™zˆ©*ê(«¶¸Í}ã´¸7çÒFuúù±ƒdÃNU,稇‘ј¹Ð¨yàÓÖÔœß×ej5-ï¶eûÈbðÀu¾i`1X\?Í€†¤†6\,î ñÕ¼“*ó²ùw
š![mQù!*V½ñTÙnÒ¤uo2¬%„!r[>ä\ÁZ%†}Cã“h|Ý—zO/ÙÓ6-îóå¶h¨¼*õm[T\\•m[ðÈ[OT¯¨V|ÎWëe`Pò +°¨ì4,½ ¿]ÓH,Xx¢¾`‰SAÛtß2ÂöÐ'1èq!vׂÿÇQ;]hãà†¦2gû÷“£{ +8a¬G9•"ɾpMkHR»hî,Þcke(dÀ†E~Ï]Âû®ý@»º@+‹r¶ ÒY]5¥ý°ÃßOuÊôbZ¶ÔTmWSŒæ±|ë¯L¥ Õô±7HGóz•—,H•¯ +1çÞ„À'ŸÏ9k"!çéE?MÁ1E‚ߟàQÛ*ç`Ëß<0°ª!Ì;¨´"ýºH¸*Ú#–Oľ ßöâ¾]ŒÇÒ4åçNµ–í‚Å{¨ô‚ùl±‘·’)D¢4–èf0,ýP®Jˆä—§ÃÑ¢8 +%…íÍÈX°þä¹ûËý©ýåþG¡dÐé¤Vd±Ö§<nÚ%#“)¡¬£ÓïãGñÓëâçñ
”ÊetŸÃ 6YšHàŸ1Ç0Ç™ ½¹¿Öº>w +ÄϤzúX0 ¼ÖÖ°#*›§ÝOçaz>Ø9J\•Ã +Ã>̲ÿ%‚’‡ÏÀ'K²ÑЮWËÄîÍoÁË0ãàÃýÜ-éÓy7·C~è5¢“Øv>|]Ws~ÇpŠÕ°&"Б®á€jÓR5¿££ÐâÎ]2ÍmN%¸då³ßy\ÍßÀ²*>3% rçvuB³þFÆÑû΄pSCäózH;rÇàÔ袩”#~¤¦|ÚÔËm[PmUäeäæ“R5ƒ¤¼ +üt×Õ’ ˆxk
“zÅ‘ +øm¨èÏ÷ŽUÏI`'åîýü~YŽ·×½òfSŠ7[bv›11Á{'ÝûýNIø•+8“½Oô5}ÞÛ'ô{/ ‹¥i˜–v#ùr–iÜRìbúϾÚÃ-…¯Õ¶i"oà:“2'`šœp +ŽíÜ;ñ8¼8Y‘‹˜ìY 5‘×q<ÞÅ;׋åuï˜ôRT<*ÌæõwVmk|˜íÍ3à‚¦ïe~•žõw”Ú€xšY;’Ú +›jù¬Ÿ(ÀÅ,ÉdöÇ.‰Ã£þŠÔFÐéBªT¸8sÃ7÷,nPõXgã$fõÊ¿“A‡i
bǹÆØúס,fÇ%ö†ÞêÜêA¾$_§Â(3^¯9Âå/9ùdCÙ&ØX‘h~2;DÇt´GG=éFý™¿a|b%œ;õ„¶Ã'NEbù íÕÇG`(³]‹zs÷:½y_ù‚è8 ç¯2Oo68¤SEIÄãÍ7Ý~³>Yo½Aù<¢<‰Ooæo×x2'b{ê-ÀcPóóÚÀöÓï €ÔI€zs¿@ÏÏ)þÇ…_›€7Z¨$I‡~ ¾häÏýÝÝî·‡&ÚÚIIN^ª‘Nð"Ù£Ÿ†_貞ðÿd`®endstream +endobj +1432 0 obj << +/Type /Page +/Contents 1433 0 R +/Resources 1431 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 1392 0 R >> endobj 1434 0 obj << -/D [1428 0 R /XYZ 56.6929 418.2353 null] ->> endobj -490 0 obj << -/D [1428 0 R /XYZ 56.6929 282.7013 null] +/D [1432 0 R /XYZ 56.6929 794.5015 null] >> endobj 1435 0 obj << -/D [1428 0 R /XYZ 56.6929 255.3968 null] +/D [1432 0 R /XYZ 56.6929 673.1367 null] >> endobj 1436 0 obj << -/D [1428 0 R /XYZ 56.6929 213.9243 null] +/D [1432 0 R /XYZ 56.6929 661.1815 null] >> endobj 1437 0 obj << -/D [1428 0 R /XYZ 56.6929 201.9691 null] +/D [1432 0 R /XYZ 56.6929 493.0122 null] >> endobj -1427 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F23 678 0 R /F21 654 0 R /F47 874 0 R >> -/ProcSet [ /PDF /Text ] +1438 0 obj << +/D [1432 0 R /XYZ 56.6929 481.057 null] +>> endobj +490 0 obj << +/D [1432 0 R /XYZ 56.6929 393.3436 null] +>> endobj +1439 0 obj << +/D [1432 0 R /XYZ 56.6929 369.004 null] >> endobj 1440 0 obj << -/Length 2405 -/Filter /FlateDecode ->> -stream -xÚÅ]oÛ8ò=¿B÷ —¢D.dS§çE›äRïu±Ý>(¶%×’“æ~ý
9¤,ÙJÓîÞáP b†Ãá|Ð, ðJ*t¤:&’2,6g4¸‡½7gÌáD)êcý<?ûáR¤&:áI0_õh)B•bÁ|ù1¼øÇùÍ|z;‰¸¤aB&‘Lhøóìê5B4~.®¯.go~½=Ÿ¤q8Ÿ]_!øvz9½^]L'±ä@@8¿__Méröv:ù4ÿål:ïXî‹Å¨0ü~>ûø‰Kî—3J„V2x„?(aZó`sKAd,„‡”gïÏþÙìíÚ£cj’B©x:¢'.Æô$5Il=—å$š…õÊ|yØ®ó&GÐ|þ¶Aà2Ÿ°p•íËÖ!Õˆ±¯ŠÖ¡ày6ù¢®–Í«Ió¨Õûûõ2Y…§îÜUù—mY,Š¶|Bx³ÍÅ”ò|i)%áªÞáVþ%ÛlËü•Ñ=x‚îIHƒˆ1¢¥äV6¶tƒhEpM”J5 ,â0XÐ]‘lj„$ŒÑÄ¢7ˆÁ'(¥á¬zÈwFSÆÞeÛmQÝãE…ßÙÍC<r;0Éc¢c[š·¹£#4
«lcVJ‡» SaÞÔå¾-ê -wÿ ’¶ë¬EŒu,Ãv—UM™9<ØYÙÃõOÍnš-—ŽhƒÖˆ°a.Ò¡EãÐëX["ôî ¡›îBœ‡A)ãôySUdï‡0#Ùn›è<i@G«,ëMVXyÒ0«* oæ·¸@Aµý.ˆÍ”ÓpZµ»"oðN,{pÄ‚Ý܃dqc“-ó!¥2Ïš6jëhS7À„òìdÅÔÓ÷•õ]ðr°WÈhno³qpy¼,["F™¯,®°f1]q¿nA²˜¦á|mÌb ø(–%½ÝÖMÑæ>\d7=-‡-ÂÇì !Æ+Ì·ç¹#Ý©Áìï›}V–Oîô®h#+ù‘yÛ¼2œrœî_ -ˆÌ—1žTrà,E»F°É -ö2(!þ¾uæ07uçl½xð˜FãZ" /Màý -`ƒðóȵKÍ6YÔ›O˜ÿñ¸x3iY¦qPJRÁ¾¥z-HJÓ£êýçNy>z’<Ëž£@Ë-ý‰!©¨“)’J‘4•êÐCõ+'ãŒ!d 5„Z±6ýíúvöfM‘d‚†ÃxèÒx_…’*“„ýÛþšFWÚºÿRÒ„(Õý¥(J
»Ä0‰T -ê0zOÁP0‹U]“ž³‘畃·¦ÿMåúÃÿ‡Ë2͈J¡œG<%JÇi¿Q=iX9è5ÕÐG‚)cõM}2ãDk?3J•(öJõ'Ž”ÚÐwƒÃÇI¿îõˆ²SÆ® šØ…ÌU¯³‘I̬Q"ìcgs
Þ½5üÏÓhÆX‹MNUl®>ŒÐXkH½µ•õ øa¶áÁë$ -zByÂQŸ² -²ïò)¡ L§Š@Óƒ.?÷-^2h£É¼X>W ^Ÿf%!Ư„¢ã:È¢:tv‘O ®0‚J¶s[+³…# -$$Öf%Ôz8âš îxz;®n>|°O[4¼¸:g~P°~w>»ŠÞOoÿ5½Ïmæ¾ä``Êlñ•d`ƒÑ×ìÃI¸šL;wóvJ.®ßdر‘¹"žÚƒš) +/D [1432 0 R /XYZ 56.6929 151.2167 null] +>> endobj +1441 0 obj << +/D [1432 0 R /XYZ 56.6929 139.2615 null] +>> endobj +1431 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F21 658 0 R /F47 879 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1444 0 obj << +/Length 2798 +/Filter /FlateDecode +>> +stream +xÚÍZÝsÛ¸÷_¡‡>P3 ö-Û©o;UtÓÎåò@K°Å)E*"'ý뻋HJ¦ì\“Îu2B‹ÅXìÇo‹ ‡bb4ã*‹'i3Í…ž,7g|r}¯Ï„癦ÙëçÅÙO—*d,Kd2YÜ
dÆ“ÅêCôêo/ß-.æÓ™Ô<JØt¦ý|u}N”Œ>¯n®/¯^ÿ:9MãhqusMäùÅåÅüâúÕÅt&T¬%P^Äo7×ÄtyõæbúqñËÙÅ¢[òp[‚+\麟ùd»ûåŒ3•=y€œ‰,““ÍY¬Ó±RRž½?û{'pÐ놎©I*ÁR&33“€ˆÓ#fÅfd–‚RuÆ%U§ThŽ(5,É2í”ú6/Jؼ”ÑÊ–Åg»ûŠ¿DôP”ž~ké›·Ýl[»¢Ÿmš‚sËS-@IICáÎì—|³--[Öq°¨,eFóÄÈ«Õ˜ÔŒqØÚ@¨|F*¨ÄH?äw®yQùmT~‡õn*ìz½âÒL˜tš +P¼ +Á2¥“SÜ‘T¶h×vG?jOl×uc©Ùì—KkW/è×@±È6ª·$cZ‰áÙm¾ü×~ËêÝý˜Ú$:zö‡Òoý +ºÃb~°˜t¹ûJÀL‚¦™€sbÐ%øç<zoÛ¶¨îIÚbñ¦YA1Ëb»á‹µ›<‰Úbcgm=Ãm…t”‚Ž<a>§ïïœK[®èGÑWN?•œÝïªZ{OO"wpvKŸÆVd“Ž‹ì«¢m†3'Qc—uµjÜ‘Ð9¦L¢í®Ø仢üê4–À-ö'ʯ ©K8׆Hk[Q6éÙ–ùÒmšóyáFÅÆ« H Uj¬l³Ü·ÖKZ×Ô(kw +hY¾FŠšu›ši#d@9Î…L)¥'‰””¤Ü¾¿y9AŠáäâ¨ÌçEjèmÊ+;>©h(RÈ)Tè‰!ÞÝçwf26oΈ1-ÖaxZë¹.êC“FƒK4YÛSy3×:ªCTÕà¯;ï[à!¾éΣ YÕ3ˆ³ëÙª†pY
ýõ?ÏoÞ¾¼ºÆ°NTïÛºjl3føw´Ú
Û×zÏÆœ¿s…Mþ¥Øì=7»à!»zuñ¡º¸W-}À%wM0q8Â5.ú‘™kn˜L9Ä÷š³d…PƒeOâšG"ÈÓv«
3&Íž±[àe±Ì(÷üÅ…‹XEzV‰¦d +‘‰ÎpIjÅμ¥oKÜ[ê-Q0 +~QØÌ=†} +Fç%Àa±ôD¤y +Å%Ož®ƒb ;I; —xœ*=2‰*G8$2=$®ìTDÞÍSMp"‰Æ‹àŒ],ª÷÷ë#fAg£nýTö˶,–…ÃFHï«&b°AP°ËW@/Fʉ£Ä%ÖŠUI2£ AEĉJÁó<*b_(\UhºÞ<ßæÛmŸë¼_½û?_=Ì—£2È 9&Ue²iïÛ¢®¨#w»v +Ò1øë.¯š2÷|ÐÓ§uuõŽ¨ùjå…6Ôá:pRô3ÊÔŽ²7,mET, +#•<º€€T¸ŒƒhpâS›#-ÁuÌÓ¥DèØä+{(©´ +}.(É# «QÞÐíIá½aÅÊåaÞ¨+W‚@ÛR¦ÔB +ua-عlVQ{ßä÷·ƒi.¦›ç~6R +åÅ‘ÌnlY4ô + +…u[8ÐF·wÃÓØòîð¶xYæMŠê•ÝâœU¸7Oèã•ñé7û¦=|>ìß4Ëfn¹ÝZúûq@7J†§ä1áçëÛnUËr¿²Ý…à î*°ô4cÁôÀF0˜J¡=ß‹Q endobj -1439 0 obj << +1443 0 obj << /Type /Page -/Contents 1440 0 R -/Resources 1438 0 R +/Contents 1444 0 R +/Resources 1442 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1448 0 R +/Parent 1453 0 R >> endobj -1441 0 obj << -/D [1439 0 R /XYZ 85.0394 794.5015 null] +1445 0 obj << +/D [1443 0 R /XYZ 85.0394 794.5015 null] >> endobj 494 0 obj << -/D [1439 0 R /XYZ 85.0394 732.3673 null] +/D [1443 0 R /XYZ 85.0394 711.7496 null] >> endobj -1442 0 obj << -/D [1439 0 R /XYZ 85.0394 702.3779 null] +1446 0 obj << +/D [1443 0 R /XYZ 85.0394 684.4451 null] >> endobj -1443 0 obj << -/D [1439 0 R /XYZ 85.0394 613.0847 null] +1447 0 obj << +/D [1443 0 R /XYZ 85.0394 642.9726 null] >> endobj -1444 0 obj << -/D [1439 0 R /XYZ 85.0394 601.1295 null] +1448 0 obj << +/D [1443 0 R /XYZ 85.0394 631.0174 null] >> endobj 498 0 obj << -/D [1439 0 R /XYZ 85.0394 411.9014 null] +/D [1443 0 R /XYZ 85.0394 462.3028 null] >> endobj -1445 0 obj << -/D [1439 0 R /XYZ 85.0394 388.7145 null] +1449 0 obj << +/D [1443 0 R /XYZ 85.0394 432.3134 null] >> endobj -502 0 obj << -/D [1439 0 R /XYZ 85.0394 323.2073 null] +1450 0 obj << +/D [1443 0 R /XYZ 85.0394 343.0202 null] >> endobj -1446 0 obj << -/D [1439 0 R /XYZ 85.0394 298.2648 null] +1451 0 obj << +/D [1443 0 R /XYZ 85.0394 331.065 null] >> endobj -506 0 obj << -/D [1439 0 R /XYZ 85.0394 108.8668 null] +502 0 obj << +/D [1443 0 R /XYZ 85.0394 138.4884 null] >> endobj -1447 0 obj << -/D [1439 0 R /XYZ 85.0394 82.3901 null] +1452 0 obj << +/D [1443 0 R /XYZ 85.0394 114.5262 null] >> endobj -1438 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F39 858 0 R /F21 654 0 R /F47 874 0 R /F62 990 0 R /F63 993 0 R /F53 957 0 R /F11 1293 0 R >> -/XObject << /Im2 979 0 R >> +1442 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F21 658 0 R /F47 879 0 R /F62 995 0 R /F63 998 0 R >> +/XObject << /Im2 984 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1451 0 obj << -/Length 2130 +1456 0 obj << +/Length 2275 /Filter /FlateDecode >> stream -xÚµMsÛ¶òî_ÁƒÒLˆàDo®ä©ãÈyŠÚyÓ4Z¢,ÎH¤"Rqýï»Àe1®û2ÍËÅb±»Ø/€%~,QšhËmb¬$Š2•Ì74y€¹÷,Ф‘(íRý<»xûN˜Ä«¹Nf˯ŒÐ,cÉlñy ‰ Cà@¿ßMFÔ+:x7¾ˆ ©øàú?Wg£)Nè@úóxrƒ‹ÃõÝäÝøý¯Ó«¡‘ƒÙøn‚èéèÝh:š\†_f¿\Œf‘»j1*œ¼_/>¡É´ûå‚a3•<Â%ÌZžl.¤DI!"f}ñé⿆Y¿´×LŒ.4ï±}vR–hSÎNÓ"_€R"ä•Ì`»²lPÏ‹¦Á™vU ð¥|]8¥ál‡5cÄ”rL—庨òM <ÔÌ2ó°C¹ÄË¿/Cض¬æëý¢â•U[÷Ëå§ó6N–ù¶†%p‚êÁxdb™8à8\¡ê]ùPV=²J¨Y ‹ì›m1/ ¬IRI%É”5I -V±JqOŽÂ‚ó„Øó€±cr¯& ËvÕ#«³4œ!.ï¦ã÷ãI°ÒÁtMÑ"[o;7®ò€ù–¯÷Å„kr÷X6E$ -À|¿Ã©Ú>™œ¾‘ÿT¦¨üt&h:a¸2ÍÀt†XÁ3O8óbÈ,žŒ‡Ñ]eôiO„ô3‹z“GrïŽBšoÅ.Py‹ùdhyò ±«<ì·Ý•õî|é¹Y„fÄ2ž\ßþz3ê‹ ~užºš'lÁ£˜&d‡èQ˜âºŽ´Êƒ1ï‹¢BõÌÑ´}IJg²…V¯ÊRŒk•ìÏR4I œkû}^¸Ž¯ -¤qÑà#ÁaÃ25ÀèqˆfUïפ¼/·+š¶Þ›/[HÂ~"ÉPŸ$CÁ‰VÇ OÒÃqâ$ýu|ÿDe!!%°ÈÒ”jp?äœìRûšà.]¸±qÅ%àê -iW…Ë\ˆD -ò;ûu›p¸ÅkFmÂ9'Lð×4ÌšoCͳ7ÇÿoUç
+xÚ½YÝo7÷_¡?¬€Šáç~Ū-ç\Ør*«ÍáÒ<¬%Ê^@Ú•µ«8¾¿þ†rŵ6‰{¹Â9;œÎüfH³…l bg<$™$Š25XlNèàÖÞž0Ç3òL£ëçùÉ›‘2’Å<ÌW¬”Ð4eƒùòCA† Fÿ¾™N†#®htqyRñèìŸãwóÉbÇúóåôg2În¦—o›‡‰Œæ—7SœžM.&³Éôl2ü8ÿåd2oUÍbT}O>|¤ƒ%X÷Ë %"KÕà ~P²Œ6'R ¢¤~f}r{òk+0XµŸöº‰QÂEÌ{üÄYŸŸTFbÁEë'E¸…RÍ4Zxz3»|{éÌ=/vzÑŸ´1„Š@( +>0|^¾åS¡@™Á8w|Ëj“å¨Ì7}›Ç)áR2Çû¡Gš +
EOÊ0Œ»«ÖíèhTöØ„ +(g‰$ÚÚ𯺮qó“xkÝ.bUI™¾Êe,má#w;Øü‚m~Á率Õr±Þ#jžÒâF^v9oübá„o+øÄG—«žÀ +2õ'ciWé£@f%íJÛ£ +À”*ºr€£»ŒmM0“.ÌXØ»º*‘çéAÛÞÝN¢€8¸ +_⃳Y?Ô}ý')å¯MŽþc ÉOÿì•m×}Á].EY÷¯{'•ÛÇžæyëÜõ(á¼!ÿÿ–—EA3hIJq}|`]|â endobj -1450 0 obj << +1455 0 obj << /Type /Page -/Contents 1451 0 R -/Resources 1449 0 R +/Contents 1456 0 R +/Resources 1454 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1448 0 R +/Parent 1453 0 R >> endobj -1452 0 obj << -/D [1450 0 R /XYZ 56.6929 794.5015 null] +1457 0 obj << +/D [1455 0 R /XYZ 56.6929 794.5015 null] +>> endobj +506 0 obj << +/D [1455 0 R /XYZ 56.6929 769.5949 null] +>> endobj +1458 0 obj << +/D [1455 0 R /XYZ 56.6929 751.4464 null] >> endobj 510 0 obj << -/D [1450 0 R /XYZ 56.6929 572.7144 null] +/D [1455 0 R /XYZ 56.6929 563.3947 null] >> endobj -1453 0 obj << -/D [1450 0 R /XYZ 56.6929 550.4382 null] +1459 0 obj << +/D [1455 0 R /XYZ 56.6929 537.1873 null] >> endobj 514 0 obj << -/D [1450 0 R /XYZ 56.6929 469.4994 null] +/D [1455 0 R /XYZ 56.6929 314.9763 null] >> endobj -1454 0 obj << -/D [1450 0 R /XYZ 56.6929 442.3384 null] +1460 0 obj << +/D [1455 0 R /XYZ 56.6929 292.5697 null] >> endobj -1455 0 obj << -/D [1450 0 R /XYZ 56.6929 234.4857 null] +518 0 obj << +/D [1455 0 R /XYZ 56.6929 211.1564 null] >> endobj -1456 0 obj << -/D [1450 0 R /XYZ 56.6929 222.5305 null] +1461 0 obj << +/D [1455 0 R /XYZ 56.6929 183.865 null] >> endobj -1449 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F39 858 0 R /F21 654 0 R /F62 990 0 R /F63 993 0 R /F53 957 0 R >> -/XObject << /Im2 979 0 R >> +1454 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F53 962 0 R /F11 1299 0 R /F39 863 0 R /F62 995 0 R /F63 998 0 R >> +/XObject << /Im2 984 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1459 0 obj << -/Length 3279 +1464 0 obj << +/Length 3617 /Filter /FlateDecode >> stream -xÚåËrÛÈñ®¯àÁUªDd^ -™LÕ,IU1Í–›36{€µwgÜî™»MóᮟîÏþz-“Y¦±ˆg÷«,2ùì>ÿ¼ýÛåo÷Wwçs± ÏçQÌ‚Ÿnn¦™”š·n¯oÞýãîò<QÁý͇[š¾»º¾º»º}{u>çRE -wçE»Ü•‹¾‘‘ºuAæ©.vÔ³›\a›ô»vç\EÛìMgy4»lL›;È
µ»iI»²®ÈCÄ® -:‘¼0÷iyÊÑÉæÿVÜu$^«zDÎC&¿È¥—>Nl¤ýÞÌI®
Åæ'Äœ'àlÉzË`³o;Ú¹É:̪pÒÁ·¦.¦„Ý# -OwƒEo hYP42¥mi/ƒc‚š%àÏÆÑm¥g!N§öc¢O;‚™ùLlp¢}±‡˜Ô
Ú|¿Ùï#~bø9Š™ÉŸPE? -r²Ø%L1N‰dÔK¸L‡ÎXÈTì¼ù.{šŠ8JK_} -ß&Û}JعrcÍýãó¦j²¼Ÿ-]¶Ïœžê>Ë`…2j¶»rc#RH²ŠÝcáëðÌo²F!½Q€¾qN©èë)Ç‘Hõxò²p@ˆ&}Xé¤Ã -æëpäI¨X‹>‹©ç¸sÿ8bØ6Z«ðeÞ:d0¬ö^d—¡ã“2|I¥£÷2`xfW¹ÏVK`zÛí²º]
Ó¼]M¯:x¥]u[ö[°3¶Ñ«8y>ªs’P0åNcªW^èåí79óˆ}¯†ÐÇWÜ–º ª¤CØ·å`¬±55J—$eö˜]k6¯Å#ÌÉX^¬Av -J7pE©¡®E§WX‹q˜Ê.NÈ - -Ìîª|¨mÝZ«©F¯ìô¨DÐ6ÔvëÌΔ®µOæÑÆ›½èaühßâ`äÖ·MÛ–2¥F`\Pš C‘˵þVY«¬¿…vߺ•²¶?KQ®ì(µæw?}ÿÛ›q¸ÙÀ¶o@³â8¦À:ÖG¤ŽíF`1)Îe4eCZ˜p
gM§'lKqþªÄÄL=“ +xÚÝZKsÛ8¾ûW誥«,^|íM“(YOeœ¬íÝšÚL”HÙ¬P¤V¤ì(¿~»Ñ +'1‹LnW=ZãQ$&·é'ïõßfoç×çSés/`çS?àÞÏ—Wo¨'¦ÇëWo/ßýãzvjïöòÃu_ÏßίçW¯ççS¡´/€²$þõájNƒÞ^¾ŸŸ¾ýål~Ûn¹,Áî÷ßgŸ>óI +§ûåŒ3Gþä~p&âXNÖgÚWÌ×J¹žâìæìï-ÁÞ[3uŒM¾Š˜ÉpŒOñŸü˜J*Ã'Îð_Ä’]^MgoÞ\³ÙõÇÙù4àÜ»º¡çÍüúŸókÁæ¿Í~ýø~ÎðÔ°ôTû¾|‚#$Ÿ$$ž"ôújö뜚4nlä€(iƒ|!Qù2¢´SÆÆ Ã—ÁŽ<±^_±„аB¨'AèƒB„ÁKTKÅŠ…<<Pÿn–ÛVù, +|ÿôhZ¶éfIMÛCM*IÑ*.4;ÅR0¥”? ‚‰06lÞ&å]†l‚Áª78Ô$vnFÝÞç5˜kyˤ¤Æ"£gUšFèU+êh+j¬ªíºþëùTéÀ«›dÛLë¦ÚØY[zvý?ÕM¶áª@y—ŽÔ½]äwÎå¶nÆôWAqì™-ÂsWgé àvc\(Û‡ÕYC¦¢§€Õµx³¢ s"‰›´í€bR¦îµ#½ÞÕ–æ"³ŸMUçMþé¥Ï#&ƒ@Núü1@ýSàÇa nJý4Û)'UM‡ÈÇásª¦ ! Ç/îëjšÜK³z¹ÍYÝŠ’ú«Ç2ÛR_™¬]çê`Ôö\D^VW;ÓXfôšz—•y¦v!”?>vÐ’F%M–Žz¦Y¹ÇЂÏË»ÂOÿø>°6Šb{¤Wc‡f~໿sŸ§UQ$[G÷®„>ºÏ½z¿^TEM¯óæ>/éžõxm¡ZÚã<Óš4¦ÎÓŒÈ'tt¢OíM‘,³”^/ö†S) +ÀÌD8y*Ó`áÒ“Ÿªg9ØKXº—»-©vÙÐãÀÁ†¤Þfª^Ì°±vWØ ‰Ðë4[æë¤ >¼ºwß2ÚÄt.%iJ¡‡wÆ‹?0ƒ§5béKâ3Œ0I^$‹"³£M +W¨›C¤ïÒˆ»2ÿF0Ç7NŸy™æ.úBâq †çYÂLôED ë}^ÑÃ8Ê>ƒÈNûÙ¦y]îø')´•_òL樅qÌjKS<›9ÞlÀÏÇ€j¨m.hù:›6Õ´€Ô›zL +r‘9 ßgÛ¼qÎfC£€påôyП—”K;j{y»"«Ùó9Ï’—17"5ã~ìà¦Eć¢@â‡ÎÕŒ‹b€ÖÊ$*õŽî†<½;´Óò9ÛZE'–g»?¡ï==ú£J%†ºsÎü0z®P¢%¤ÔàퟔÒS +ï;@æ+;ßôTê½ë«9ô¨¹]½†Û’Œ\'Íòž:-1é}Ãê߈Ïn7 +ê>!…Þñ~ŒeºkÁÿÅeâÄ(~CrÈt$dÿ~òèžRñ€EpÞTAŒP” ÕÈ=%¨?–÷B[^ÏÆ=$@Á¶^ýn~5¿6‰ôí|,ÉUŒså +ι7KÓ¼¿ÈÛÜì9ؘq9ˆƒ +!¼‹ÖèÅbïüµN¶_€¶/_[ÿpœÖU’v½y?ñ7vu‰¿Œ©V›ÚãÚ0FÆweÛ‡¬îóvu +ÐjBl«Žq¯Ú=TŽPúk£Û åààk[¤é´Ã¯é™}ô#¼%ak\¢çÂág¯þ +²ûompô0¶¬ ™Œ„:¸®@ƀƌ—’°˜¬Û²5étŠõð.ÃF|
XG:/c×à.ñš$#µÙ4–F @_²w?lL»²ÏÕÁ”t›È—ô·€º¥lš`mÂß5€.š|i®™¬ +DG†¬Îévttðƒ”yëÛƒþmŒhÅl1íÝwÃÆk†\~''ñû”'FßAVÃÜZÄ"_…Cõ
œüKÐJœ.dQ¬ÄsÀ|Ÿ:D@sW›„W¹/[ QfÍcµýB?ûÆvwÕó“n€°ñPå©¥AhoyŸ7Yê§ifªõ¥]‘@]äw¥-eGš ˜xwOW„Zzuån“Û“»§)Æ*º„ßëQh!~´—tZ¶ï7U]çR2È8¡)äÚx«m¼Õ6ÞÂsW»7yi¿qÑ®[ªÍ×Cfûí‡<‡‚z¾}÷QA@Àš>^kYÄö”7cRìK¨ËBZèp
{é—ø„€oa¾ÏjLÀõ‘Æ endobj -1458 0 obj << +1463 0 obj << /Type /Page -/Contents 1459 0 R -/Resources 1457 0 R +/Contents 1464 0 R +/Resources 1462 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1448 0 R +/Parent 1453 0 R >> endobj -1460 0 obj << -/D [1458 0 R /XYZ 85.0394 794.5015 null] +1465 0 obj << +/D [1463 0 R /XYZ 85.0394 794.5015 null] >> endobj -518 0 obj << -/D [1458 0 R /XYZ 85.0394 420.8405 null] +1466 0 obj << +/D [1463 0 R /XYZ 85.0394 687.9013 null] >> endobj -1286 0 obj << -/D [1458 0 R /XYZ 85.0394 396.5009 null] +1467 0 obj << +/D [1463 0 R /XYZ 85.0394 675.9461 null] >> endobj -1457 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F14 681 0 R /F39 858 0 R >> +522 0 obj << +/D [1463 0 R /XYZ 85.0394 283.5376 null] +>> endobj +1292 0 obj << +/D [1463 0 R /XYZ 85.0394 259.198 null] +>> endobj +1462 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F21 658 0 R /F23 682 0 R /F14 685 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1463 0 obj << +1470 0 obj << /Length 69 /Filter /FlateDecode >> stream xÚ3T0 endobj -1462 0 obj << +1469 0 obj << /Type /Page -/Contents 1463 0 R -/Resources 1461 0 R +/Contents 1470 0 R +/Resources 1468 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1448 0 R +/Parent 1453 0 R >> endobj -1464 0 obj << -/D [1462 0 R /XYZ 56.6929 794.5015 null] +1471 0 obj << +/D [1469 0 R /XYZ 56.6929 794.5015 null] >> endobj -1461 0 obj << +1468 0 obj << /ProcSet [ /PDF ] >> endobj -1467 0 obj << +1474 0 obj << /Length 1368 /Filter /FlateDecode >> @@ -6359,1237 +6410,1226 @@ xÚ•]oÛ6ð=¿ÂÈ“Ä)ês}jÓvëPCã>{ eÚ*‰šD%͆þ÷ñx¤,Ǫ·À0t<ïŽ÷M¶ æÇYL(Ï£EšG$¦,^õ ôU”N|æ$LŒ/ÐW{¥¶îÌVŠ¹Pa$ËSÆà ¶Y ýM# endobj -1466 0 obj << +1473 0 obj << /Type /Page -/Contents 1467 0 R -/Resources 1465 0 R +/Contents 1474 0 R +/Resources 1472 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1448 0 R +/Parent 1453 0 R >> endobj -1468 0 obj << -/D [1466 0 R /XYZ 85.0394 794.5015 null] +1475 0 obj << +/D [1473 0 R /XYZ 85.0394 794.5015 null] >> endobj -522 0 obj << -/D [1466 0 R /XYZ 85.0394 769.5949 null] +526 0 obj << +/D [1473 0 R /XYZ 85.0394 769.5949 null] >> endobj -1469 0 obj << -/D [1466 0 R /XYZ 85.0394 574.5824 null] +1476 0 obj << +/D [1473 0 R /XYZ 85.0394 574.5824 null] >> endobj -526 0 obj << -/D [1466 0 R /XYZ 85.0394 574.5824 null] +530 0 obj << +/D [1473 0 R /XYZ 85.0394 574.5824 null] >> endobj -1470 0 obj << -/D [1466 0 R /XYZ 85.0394 544.7049 null] +1477 0 obj << +/D [1473 0 R /XYZ 85.0394 544.7049 null] >> endobj -1465 0 obj << -/Font << /F21 654 0 R /F23 678 0 R /F47 874 0 R /F39 858 0 R >> +1472 0 obj << +/Font << /F21 658 0 R /F23 682 0 R /F47 879 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1473 0 obj << +1480 0 obj << /Length 3343 /Filter /FlateDecode >> stream -xÚ¥ZmÛFþ¾¿ÂßN¬eÍ‹ÞŠÃÛfÓnïô/dKkë"KŽ$¯ëþú#‡œ±dk› -Î1äHÿ/ÝôÓ$I¦o`î$~aƒpK¾/Ž7o®5…¤W'|q©ŽëzÕÑ¥^KÃeÿA ÅLh_i°
`+0Ø|‚{òµBë ·s·Þ¶MÓ“guNƒ®èeÎòÔ`å -‘xÁ,FŽÝìQ1‡aâ-·xY¸Ð:«i~[T{•»=ÝKA„îÔõÅŽø»b}hËþD3+~î«lÍ›|»FËÎΛêÀüVÍï8¼£“I¤Ã¦ìÁPn9nËõ–ÌôXVªrW²›ƒÂAží²75Êg¶ukéh¯<ÕÑsÝØmîÊ®ÈM&Cˇd’Ä9Ð}ÝÀBø¡¼CW<P-¼ç"ëæë‚&Ãév áÊÂëàðé½y&v •´Ý²UY™36Ô†žÎ†ËäY±³‚3“ñû¡Þ·åKYò³»ñÁ†øLо'¬MB -k J¤æŽñiÜ
žÅïÙn_ñ$Øâ΄e|©ÊšÉxó†Òd<Ç®bK–“MíKAÂHµúŠ}¥ajï—=ónB $•@VÞâ%ku¶›ŒÃp¹2‰-ë:~ä¹½Ù±-_¯H&Lû¹[òš” -PÑ’îhhœç±!N9íK›Õi -ÞkP?Vÿz2âà‰]:á‹FÁŠÅ•Õ+·Ê0¹Ì$×M¥¾w}Ö³¾f•ºi-¼ƒ)Ø¥{ˆ– -h—!&„£ô—„©¡°ªÙLù&¦À >[+OàbMpeýšÐA_î¦Ü4Qè¦vÃþ -ñ7-?†bBÊs@;@ 8‘œá¢¢ÀÑCïJ%a`‚ÝÒz›Õ›ÂÒM5tˆE×qÅdZ!@Ü5y‰Lë¬wuÞfg«~8A ¦¦ôe¦hÿ´ÀHàRµCUÍqêv”ôS©«ýp]fãºóIwûg4km -3X|È<J©±g«[ I
}*&@O¨óò1Šrà;ÒK[t=+µîæÜ›<££wÓ„B [nüU½•¡Gh !XlDb™Ï¨QW9Jn@@ë_³ô4 ƒœ|økÞ9t)A͹ԨUmùd -@µuqÖÑpw
±Ø‰ñ]àŠ¶$Áý"póQÅÎrg´8~zƒ§beý‰ðAâÔ*²®4…ŒŸ©´1‹ùûªkøěީšYÏ#åcºÅ±Ò/cΗڰ ™Â«7£RåKé ánfîØ'jsXÆ4’LÇ„^HYŒOÆÊq‚]•½0«ûa -hDÙ† Ó|ßTåú4ÝÂc÷×+î´Œ#ð`u®øò×KÐÇ?'™ø“ƒÀÕ4ù¯VÎ8OhK9¬œ†5zâë„°R¸³D_inÿ¼åZõÿŸJendstream +xÚ¥Z[oÛV~÷¯ÐÛÒ€Eñ\x+¸Óº»Hº‰ŒÝ¢íEKÜP¤BRVÕ_¿3gæP”D7Š æáp8ç2·o†³ +¬$ ƒU‚3åGax‘~_3b™úI§£ˆ…†Kï؀•N8)á¨6h8²Æ
W0Jì1¡ê˜|î¯Ì¾µÉxTÖyµ/LÇÌ7Žý†²*ܳëƒ8œ±;Ÿ’üÉGÛÓÞ[Nk´s·—³ôŠÂþ†A5M®•v-`|65é¥4ŒÍSG8&NRñ5± ‚ÌÆ.n–<aœ +ð9« +ìË
]³âû®¿˜ï%«ö¦f³§#"+îÏì‚°RçPÇ'3];OÛ”‘;°^¶ÜëApŽ“'FÅ +€M)_ÄQr
\ ÿtŽf¹®±ðÇŽßréùg +ñÍ7-?†bBÊS@ÛC 8‘œAQQà‚è¾J%aa‚ÛR¾ÉêµqtA-â£é:®˜l+ˆÛ¦(‘)Ïú¡NCmv®ê‡”`jJ_fŠöOŒ”ªTÕ¦´£¤ŸÊH]í‡ë2ן´B³Î`?·¢5çÁeÁ= 7µo3,‹m\ý4TÞ8–¹„rê£ümÙS!4Õ.U +QØ´£³À›ÐÉ^Å‚³É +€è=B Áb+Ë|nDu•£àÔ±±þ5ûGO:8ÀéãÃ_óαK ‚lƒKµªŸÀJ9Ï)ÎroŽ`JeN¡åiWd½qÍjî;~±]}Ï^ Åý×WÒ+œ|¤îY>ŽŸ³œ/Þu›f_4^ñ« qPvŶ‰Úšƒ«Úš©`ÆN€!`Æ+æѪàY]§pØÁ¶Tq]£½¢áû
US`ï¶7¤UÖQ¤(¾§Ú•RÊ{ü‰YQFíø%*º”ãÔÞ¦¡²I&5Ÿ¡bbX9f£“»cÿâEVåÀª©U÷ÊÔ;¥¬…^ÖSç@†P™Þ +\Tü·”Ã'ºm¶†É«üØ×qêðÀöæ0gUOÖ¨I2ı?¸ƒœœÚåJ…Ü.GòÖô›¦àe0
Š4N×
+@µÜœÖh¹»†X܃s]àŒ®$Áý"pó³Šå$ƒÑâøé
žnˆ-”üáƒdX–ɺÒ20~¦fÐÚ,väï«®áoúa©™ñ|¶ø˜´x¾hÃÓØó¥6lB¦ðªfTª|)høÍÌö‰Ú¦±$Û1¡Z,ÎOÖÊñ]º*{aÖáà +ìÍ´phÛŽ0<PyÇEØHêRð†vc¿Œ)qZÒ6ƒz¬2üœzÚfdN‹m.Aœõ=ê¶ ‡+¦vC5:7ÕÈ44Ã3ç²@°»¾£ñ€ñÔðuE÷Hè[Ë„(Þ
¿o›!~¼ðl2\½`Ï `› +.júl?Qëœ&=aÏl7úReQnï¾›îù†b:óÄ'ž·ÍÉÖ|:‹b}Y±C¦}CL˜õmÿnmóÀÀ‹
|c›ÜVA¨ÁèfÅÒóö¸ë›u›í6®×€³=¬ ÆöCoXЊçØš¬ž>[4A endobj -1472 0 obj << +1479 0 obj << /Type /Page -/Contents 1473 0 R -/Resources 1471 0 R +/Contents 1480 0 R +/Resources 1478 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1448 0 R -/Annots [ 1478 0 R ] +/Parent 1453 0 R +/Annots [ 1485 0 R ] >> endobj -1478 0 obj << +1485 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [63.4454 757.0719 452.088 767.2337] /Subtype/Link/A<</Type/Action/S/URI/URI(ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos)>> >> endobj -1474 0 obj << -/D [1472 0 R /XYZ 56.6929 794.5015 null] ->> endobj -530 0 obj << -/D [1472 0 R /XYZ 56.6929 739.5018 null] ->> endobj -1479 0 obj << -/D [1472 0 R /XYZ 56.6929 704.7645 null] +1481 0 obj << +/D [1479 0 R /XYZ 56.6929 794.5015 null] >> endobj 534 0 obj << -/D [1472 0 R /XYZ 56.6929 563.5308 null] +/D [1479 0 R /XYZ 56.6929 739.5018 null] >> endobj -1480 0 obj << -/D [1472 0 R /XYZ 56.6929 535.7626 null] +1486 0 obj << +/D [1479 0 R /XYZ 56.6929 704.7645 null] >> endobj 538 0 obj << -/D [1472 0 R /XYZ 56.6929 418.2412 null] +/D [1479 0 R /XYZ 56.6929 563.5308 null] >> endobj -1481 0 obj << -/D [1472 0 R /XYZ 56.6929 389.5504 null] +1487 0 obj << +/D [1479 0 R /XYZ 56.6929 535.7626 null] >> endobj 542 0 obj << -/D [1472 0 R /XYZ 56.6929 228.1296 null] +/D [1479 0 R /XYZ 56.6929 418.2412 null] >> endobj -1229 0 obj << -/D [1472 0 R /XYZ 56.6929 194.8993 null] +1488 0 obj << +/D [1479 0 R /XYZ 56.6929 389.5504 null] >> endobj -1471 0 obj << -/Font << /F37 743 0 R /F67 1477 0 R /F11 1293 0 R /F39 858 0 R /F21 654 0 R /F23 678 0 R /F47 874 0 R /F53 957 0 R /F48 880 0 R /F62 990 0 R /F63 993 0 R >> -/XObject << /Im2 979 0 R >> +546 0 obj << +/D [1479 0 R /XYZ 56.6929 228.1296 null] +>> endobj +1235 0 obj << +/D [1479 0 R /XYZ 56.6929 194.8993 null] +>> endobj +1478 0 obj << +/Font << /F37 747 0 R /F67 1484 0 R /F11 1299 0 R /F39 863 0 R /F21 658 0 R /F23 682 0 R /F47 879 0 R /F53 962 0 R /F48 885 0 R /F62 995 0 R /F63 998 0 R >> +/XObject << /Im2 984 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1484 0 obj << +1491 0 obj << /Length 533 /Filter /FlateDecode >> stream xÚ¥TM›0½ó+|©¸6Æ`³IÚ²RÓ4a«ÕxT‚Ó@6Úýõµ3·¶ôTEóÆoÞ|x€"b~ Ž “1JeŒ9¡•[ µ9ûêQÇ Ï¤ð–u—{Ÿ¿°I,“(AùË–ÀDŠòêÉÍóé"#Nü!Oˆ—Í&à‘ðXNÇ‹,4þ1[f“éb¤±Ÿga,ˆ0ñÌ)Lg£ïÙøó P§Ôžó{oš_¹m–f»øí==T™žï=‚™
˜J¡s†yÌØÙÓxKïçEðæô:4<Îæ"J¦±¡éq‰fŽìô–z«lO‰ßÕ½êÀ,7ZwÎÝkûäþ/¥và)šŒê-¶uið[xØUE¯*8˜ØyžE_€U· ã`wXUz[€×H¶.²RZ!—{Sô7üÐŽÛôRŠ%çÑ©'ÂTÊä)…Ú{2è]·ÊÜ,#‰Ÿoê˜Çâ- ”úŸŒ‰I§Àßë]بWÕ\cÁ*uÛ›|u»vx_÷v endobj -1483 0 obj << +1490 0 obj << /Type /Page -/Contents 1484 0 R -/Resources 1482 0 R +/Contents 1491 0 R +/Resources 1489 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1486 0 R +/Parent 1493 0 R >> endobj -1485 0 obj << -/D [1483 0 R /XYZ 85.0394 794.5015 null] +1492 0 obj << +/D [1490 0 R /XYZ 85.0394 794.5015 null] >> endobj -1482 0 obj << -/Font << /F37 743 0 R /F23 678 0 R >> +1489 0 obj << +/Font << /F37 747 0 R /F23 682 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1489 0 obj << +1496 0 obj << /Length 69 /Filter /FlateDecode >> stream xÚ3T0 endobj -1488 0 obj << +1495 0 obj << /Type /Page -/Contents 1489 0 R -/Resources 1487 0 R +/Contents 1496 0 R +/Resources 1494 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1486 0 R +/Parent 1493 0 R >> endobj -1490 0 obj << -/D [1488 0 R /XYZ 56.6929 794.5015 null] +1497 0 obj << +/D [1495 0 R /XYZ 56.6929 794.5015 null] >> endobj -1487 0 obj << +1494 0 obj << /ProcSet [ /PDF ] >> endobj -1493 0 obj << -/Length 1978 +1500 0 obj << +/Length 1972 /Filter /FlateDecode >> stream -xÚ¥ÛŽë¶ñý|…ßâb(êšM“=M²
9iOh™k«+‰ŽDÙu¾¾3œ¡$Û:Mî>x4wÎ#‰Uÿb•'A(‹x•q„"Y•Í»pµÚ·ïóĉ’XJxX n™Ie«Í\É×/￉Ä* -ƒ4’ÕËëh+Íò q±zÙýcýtPG«»‡M”„ëüáŸ/%±8ÈòL X&’ +ÂÜ ¼<!Ö¶µîÆتÝb"dœF,–Ê KC²“âa#Â0\?™¦1-ü©3 ¦é'"(’Ä+à|&r¯`Tñl?{H’uOJZc 8›î
¼ù=Ì™€R±µgúù†Ñ~è4=™ÁKÔ•ÚsgÚý—ì™\A‘F);á)bS@ IÆb½Õ½%¨7õ`+<$>Y3bO,÷PµÀ,Öª®ÕÄ©Ú¥iÙ˵êûA÷¾ÖmÕ{qìD¾Ö'ÝZ=1¶ÑªˆÂ’Û
3ÆÓk뺉²l=ñ7]×f¿‘èWJ²Õ¯†´À÷ - -U[”Ár
Ö:i¸¸?\ ßÜÒ“i{ÓÙjhèëéùÃW ¸áЯ4ÐAZúLÛ)@lWšhtc• ”(z@ÅŽJ–R{ -¦ÛÙغªóëçß/E˜Öÿ0]¿ÿîé'„=Ž}Xi¿ÁÙqÔ°à×=Án[^ÞjwX$Œ~âô¸áÃIUµÚâšà1Þ¶VåafƒTWmY;Ý/èÅS-\âÔ;q´†h# ý»ïTÓcåÅÐÕ¾pO.©J}Wõ¥(fðèFÈ$¼JO¡¸`;(B˜â¬“ñÒeÈtìÒ€¥ßôÎk«à䦫ì…dV±aO·¼/·</SLÕvó:´;§5ƒULãFàþÞÛ,&Q¦9T+‰ÃÌ«pF¢ßÐø'À_U$ò‘¦Þ‚aJ"۟ʹæG¨£*ßÔž9*ÈëÂqf©‰/b~êü›>¼R -zr‘B€_sTm©+}Í#Ê訉JÓ¸w +xÚ¥X[ë¶~?¿ÂoѱVÔ•J‹¦Éž&Ù ‚œ‚´§²ÄµÕ•DG»Î¯ÏgHɶÒè9;ä\9üf8–Øð_ldâQo²<ö“@$›²}löÀûú`™8‰ü$Ž"X¬p·I$ýD†Ùf»4òå˻ǯB± ?MÃdóòê|¥™ôó(Î7/Õ?½§CqUÿ°
“À“ÿzù;©Å~&3j¸Hü,¤QxyBx½žvZu·wj"ö£8
Y-ü,
ÈôÅÃVAà=é¶Õ9ü¡×`¦fÂϓĈ øLHkÀ™x?yHo #‰8ëþ
¢ùúLDY°·gúó1ÂýÔ+ZéÉjŠ+³ç^wûÏ9²h“ûy¦¤'EL 9€¥(ÞN
#Qƒn¦±ÆCâjÔn÷„É2‹ºaáMSÌ’EWQꎣ\pëa˜Ô`ékÛcñÆQû!=uRݺ'ÞmU1LÄaÍ݆‡q9‡Ãj4º
³Ì›Žø7õ½ß»MŒ«A#ÈÙ©WMV»–ó€Âzw:¨OuÅbíš,y[¿Òþ¡îFvgòƒ{u~[Î
rF¸<bÑm±S×æ€Ó *º_LÝæ+` +ÒiaaÂ7é€%…´„ÛÒîxëÀ–ùìˆyÿwŠ&ü0,æC‹ø®ìUAÔwŽ¡‚»½Ûv®>¨¾.¢¿ŸÚÔø:”%ÔXÿÐj§pÀÚ@wF¯ ͽÂ% +8ÿžñ72Òû†IC4Úc½îV¨Š‘Ê@ +lùÀêsw<™ +âU=”z¢œÁÒ´Y¹šJË¡¼1ö endobj -1492 0 obj << +1499 0 obj << /Type /Page -/Contents 1493 0 R -/Resources 1491 0 R +/Contents 1500 0 R +/Resources 1498 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1486 0 R -/Annots [ 1500 0 R 1501 0 R ] +/Parent 1493 0 R +/Annots [ 1507 0 R 1508 0 R ] >> endobj -1500 0 obj << +1507 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [348.3486 128.9523 463.9152 141.0119] /Subtype/Link/A<</Type/Action/S/URI/URI(mailto:info@isc.org)>> >> endobj -1501 0 obj << +1508 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [147.3629 116.9971 364.5484 129.0567] /Subtype/Link/A<</Type/Action/S/URI/URI(http://www.isc.org/services/support/)>> >> endobj -1494 0 obj << -/D [1492 0 R /XYZ 85.0394 794.5015 null] ->> endobj -546 0 obj << -/D [1492 0 R /XYZ 85.0394 769.5949 null] ->> endobj -1495 0 obj << -/D [1492 0 R /XYZ 85.0394 576.7004 null] +1501 0 obj << +/D [1499 0 R /XYZ 85.0394 794.5015 null] >> endobj 550 0 obj << -/D [1492 0 R /XYZ 85.0394 576.7004 null] +/D [1499 0 R /XYZ 85.0394 769.5949 null] >> endobj -1496 0 obj << -/D [1492 0 R /XYZ 85.0394 548.3785 null] +1502 0 obj << +/D [1499 0 R /XYZ 85.0394 576.7004 null] >> endobj 554 0 obj << -/D [1492 0 R /XYZ 85.0394 548.3785 null] +/D [1499 0 R /XYZ 85.0394 576.7004 null] >> endobj -1497 0 obj << -/D [1492 0 R /XYZ 85.0394 518.5228 null] +1503 0 obj << +/D [1499 0 R /XYZ 85.0394 548.3785 null] >> endobj 558 0 obj << -/D [1492 0 R /XYZ 85.0394 460.6968 null] +/D [1499 0 R /XYZ 85.0394 548.3785 null] >> endobj -1498 0 obj << -/D [1492 0 R /XYZ 85.0394 425.0333 null] +1504 0 obj << +/D [1499 0 R /XYZ 85.0394 518.5228 null] >> endobj 562 0 obj << -/D [1492 0 R /XYZ 85.0394 260.2468 null] +/D [1499 0 R /XYZ 85.0394 460.6968 null] >> endobj -1499 0 obj << -/D [1492 0 R /XYZ 85.0394 224.698 null] +1505 0 obj << +/D [1499 0 R /XYZ 85.0394 425.0333 null] >> endobj -1491 0 obj << -/Font << /F21 654 0 R /F23 678 0 R /F11 1293 0 R /F39 858 0 R >> +566 0 obj << +/D [1499 0 R /XYZ 85.0394 260.2468 null] +>> endobj +1506 0 obj << +/D [1499 0 R /XYZ 85.0394 224.698 null] +>> endobj +1498 0 obj << +/Font << /F21 658 0 R /F23 682 0 R /F11 1299 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1504 0 obj << +1511 0 obj << /Length 69 /Filter /FlateDecode >> stream xÚ3T0 endobj -1503 0 obj << +1510 0 obj << /Type /Page -/Contents 1504 0 R -/Resources 1502 0 R +/Contents 1511 0 R +/Resources 1509 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1486 0 R +/Parent 1493 0 R >> endobj -1505 0 obj << -/D [1503 0 R /XYZ 56.6929 794.5015 null] +1512 0 obj << +/D [1510 0 R /XYZ 56.6929 794.5015 null] >> endobj -1502 0 obj << +1509 0 obj << /ProcSet [ /PDF ] >> endobj -1508 0 obj << -/Length 2638 +1515 0 obj << +/Length 2543 /Filter /FlateDecode >> stream -xÚ}YÝsÛ8ï_‘·*3kW%Kº·ÄéGÚM6§·3w{´Äؼ諢×û×@€²âÕít:&‚ññ¨>ü.Òxé‹,ºH²hûA|‘Wïü‹ð>¿xM‹e “î"é2NÃäb1Ýäúé݇OapúËÕ*Œ/žžÇ³VIºãhÅ¿½«¶Uu¡^.ÂØ÷®.ÿóô•ä¢e’&ÊùpÆjÁ6S‰\™qq-E„l»x-#±´x\.߇ó—º9”ªØUªî'²Á2‹c'+P7r¢'aRïºÓꙆ_´é›îH“†‰ý^Ñàæ~CY,z{ÃgŠ‹l™ÂÆËL¶FÙï›a·‘ñv0ø##8#H½?|?̵,‘B¼íeà©®k]ïˆbµ™Šß4•Ô5ïeÅÔÍÑôªb‘<ºP¨¯H=·>ÈR>è ûs½Úa[ê\öº©Ç£áŽx«Ñ¬p«ÇOk4Bäe¡ÿØR‘—7t,Îrd¯V¢§-Ò±P&ïôÖêt«3AgA#¢Ô€EÒ4${)by¹¡ï}²ª4Õ¸KÄÚ4$”Äê[gnzõøp™…ÞUzˆœ,ž½NZº*˜ÚÀ- ·¦ßBßœÄÞmÝ«¶ -õªÊ¦µb· Åbkå7· ìmjYÁÚ²(Hqc(Æß3ù^Ù@‚±52üJúéd«‹òHP
bh· -F`4†dƒ\#å¯hòЄ6DÖ5DuÛÀEŸV‘ë›W5.O¼4pÄÌ
l6e.Ï`€"ÓÃÔS%˜&ŠÎ, ¾ˆÀÄlƒÐ0f|Foë¦ÎUk™Ÿd®KÝkePŒw¹Óíc˧ÛÏ„v[µ¥šD¡ùHlZ•[ûp’!ct*ÌÒ©ÃÞˆ»TÀ±5L|iÅC¤¡u'ö:ßó.e9gð®õÅ
cø ¡|o;èÓm’.W~J›<f%£;ÓÓääºã…Ý㚀FFu¯põ$ò,¸d^j¦%ÖÜ_$®s.` -¬õæñ3ç, -;(“¶ðÕuóçÑž<N°Û+Yáøö™a!±½C94Wz쇸^Ш©ÝbW'šçþ0)F‰ËWÂű(MÞ‚ÿ£,Û=
ײj·ª,Y©oêõ¼sIêR¶VÉÀ&
¾jôN÷¤¨ï}ü1èK%-YsÇ3†µ‚RÚ#.Q( ’ùÔT§7FŸgÐ[¦nKt X\DRHó#$ âLŒM²ZI(1Žb:ž( 6SQU‰Ù`"~«šÖ†eiX*oj¨ŸÛª[Æ,aÂÍ6[XÅÐq76›¨tëÿ€ói äç\ñ
Äà±Y#,§ -X`àYfšñSòló˜NBšÈ±¦CT‡.’P¸èÿëÒ1¦ÓIL¤ë\·²¤©kZæŸ=í\À¡=¬*ù3Ý_Ø'à‚³SµÁÞ_а©¹r4ßËWÔ×ÇO;6qÆCñÂ`L{5œ[{ù®õ÷ãi³³±Wà <ûs¹ .èõ€zìb|øëÞ…¿T -^Pè-ŠF®Ü{#xóÂð¡¡šö&È_[?ã!V2æï‡È2CØÆ’[e«"ÒÝG]Ø«>¿+à°Íú½™MK -'Œ%ô -A>Äú¼~5gŽÅÚ -x&4ÐflI澺4¦ Wp`4 9œžÕgœÞÿ0ás‹!G(_˜Ð™¹Ì˜<ÓoÊ®ŽùoÙ)°àéäòdYòwõPˆ³ÎDD®ç–6ôË}0ðÚ~k; ÛÏ”4´è.ܧZ 8WìuKú
8¯³Å&ù©®‘\W~¶å\‚jgtÃk–¡Û$œ…¨2oÍW•â׉q&+4„Ø +xÚuYYsÛ8~ϯð[誑ÂûØ7[ÎádìrYÎNÕnö"! k’`ÒŠæ×O7ºyØéTJ@£hôñuƒö.\øç]¤ÑÚ
²ð"ÉÂuäzÑE^½s/°öùÇ<a¬£0`²°ºŠ‚t¥~r±šorýôîÃ'ß»ðÝuûÑÅÓ~<+N’µ¥OÅ«¦‘u¡~]®üÈu®.ÿ÷ô•ÄÂu’&Š¹pD²ã$žKäÒŒÌ^¸ÂØgæ8Z‡A’óÚ»\y®[çϵ>•²8T²îf²Þ:‹¢A6Ö^yƒì$Mú]·JîiøE™N·gšh&vGIƒ›û-
D]°èíý
\dë,öc>Ӈ˹!ë[vGÝŽ d¼~ø~gx©óÃuý\‰)´¶»ôyPuêQ¬6sñ] UÓø^TLÝžM'+Éó¾mñ +\Ó±8ØãràÔòD3hÄ“0D,¤É[µ³:ÝêdÐ9 QÔ€EÒÔ'{)Áúrø®óɪ¢«q—µÑ$”ÄêY_ÝÔ'ÿ=>\f¾sUË"'Á_‘k/ƒ“†® +¦6pkKÂé·ç÷'‘s[w²…-@Ø£åÌßp,XBšÎÞ'h7ü•¿Ù*Œpv +÷Ãa…|‘¥nl Ø-H±ÈZyá6µ¨€÷ƒ( +RÜŠ1ÏuL~”6`l¿‚~ZѨ¢<ÓCƒÚ̓ +’
r”OœBç=Á 1j"«¢ºÑpQɧUäzý"GöÄÙ G,ØÝfS6äÐBdz˜€z²Ó„Q™DÏ
B0q +ã”U#7Cã@Q²€.ÿ¾ô +ÝD‘øñðñ^=:\è±æí +®o¬ƒñ+ñ'E\2}8Ç’;i%Ò‡ï&ª°Wõ\~jÀaÛÍ{³˜¢GË!zeoA_^†NmÞxš^Xð”Ð;’ù‚Ïr{z8Ø'"Hóȃ…×UØNÑô endobj -1507 0 obj << +1514 0 obj << /Type /Page -/Contents 1508 0 R -/Resources 1506 0 R +/Contents 1515 0 R +/Resources 1513 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1486 0 R ->> endobj -1509 0 obj << -/D [1507 0 R /XYZ 85.0394 794.5015 null] ->> endobj -566 0 obj << -/D [1507 0 R /XYZ 85.0394 769.5949 null] +/Parent 1493 0 R >> endobj -1510 0 obj << -/D [1507 0 R /XYZ 85.0394 575.5478 null] +1516 0 obj << +/D [1514 0 R /XYZ 85.0394 794.5015 null] >> endobj 570 0 obj << -/D [1507 0 R /XYZ 85.0394 575.5478 null] +/D [1514 0 R /XYZ 85.0394 769.5949 null] >> endobj -1511 0 obj << -/D [1507 0 R /XYZ 85.0394 542.4777 null] +1517 0 obj << +/D [1514 0 R /XYZ 85.0394 573.5449 null] >> endobj 574 0 obj << -/D [1507 0 R /XYZ 85.0394 542.4777 null] +/D [1514 0 R /XYZ 85.0394 573.5449 null] >> endobj -1512 0 obj << -/D [1507 0 R /XYZ 85.0394 515.1876 null] +1518 0 obj << +/D [1514 0 R /XYZ 85.0394 539.0037 null] >> endobj -1506 0 obj << -/Font << /F21 654 0 R /F23 678 0 R >> +578 0 obj << +/D [1514 0 R /XYZ 85.0394 539.0037 null] +>> endobj +1519 0 obj << +/D [1514 0 R /XYZ 85.0394 510.2426 null] +>> endobj +1513 0 obj << +/Font << /F21 658 0 R /F23 682 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1515 0 obj << -/Length 2940 -/Filter /FlateDecode ->> -stream -xÚksÛ¸ñ»…¾Už‰` ÒétÆçØ©sãÚêcšËL) -’8–HHÙñýú.° -à?‰ˆD KF2 ‰¨e›³`´„½gÔÂLÐćúizvqËå(!IÄ¢ÑtááŠIÇt4_FÎC0þxsóxõ—ó ÁøÃýonooî¯opzwûåñóÕ¹ÇÓ»/÷ç“X&b|õðpsÿáîŸs¥[½¾y:ÿ6ýtv3m8öoE®Ùýõìë·`4‡Ë}:Ob1z…I@h’°Ñæ,œˆs·²>{:ûkƒÐÛ5G¥DÂxÄÄÄ舆„‡°éËI$„Å’99Oh -µK×}9©…Ú©"SVNÅ¢ÜmÒ:/}y$AI"„!Œ&< Z%P‹þîá%Bé|¾SU¥*œþˆà -þÁ—ZœÜÓ. d‚ÐXHƒÒ¢‰¥AsNã±CÇãpŸ²x2ËkÜÉ窨ós -Ô¦vî‚°yQ«Ý"ÍDÅ7*UW8*STŽ_Wy¶²CÕÒ7€fZÎ÷™š;:¸W¯”¾ª¾\#=¸J]&ãºÄ/ÐÉ×yÖ -çU–®ÓÙÚÎî4+…ªq†Äöu^,ÁPy"ÇÓUË -9%’7pï´"1’AÍ Zì¥A+Z8.c8HŒÐ¦R¸[HÇ\SˇA«’÷\ÆŒð˜3Küªx;Æ$¸Ðc’GÜ0©©u™Ô+Æt4qÇVƒhñu˜ªÞ¹ð|€=0lÂ9“–îçýº>*Æ„„’ò߃Co!©ìÚ`Ë·¶"ŒÿÜxë«ýÎU•íò™i{6ƒåºœ¹â¢qzkM¸Pe+µQ–ÆqDXÝ”>±¼6ïì)e·o¯qÀE,IãL’„ú‘@öGq(+‹*wûÆü5ܲ Gœ…Vþe=ïÃ…-RÑù> L0Ë€ùÊ<J“È°ÚÏÐáµt|•Rˆ”ÓØÌ`È£%‰ ƒÚ#%üWä$'Lpw52 YH˜I§³75Æ“V~<îÉ6;ò3+y… ¸S¾ -ƒ¯J7>:sh‡+Æä -¨MºRiQ!&“XŒÒ2+4“™€e–yÁ, ¢21+`îšqdžõÁÞM¥½©t¬Ç}ñÙÄï1—óÌhòè(š9Ñ’ñlù‹²+öBï]¤³õwGÕLK_ŒDÐGt Jë•Ú¹°œ]èMšòBÇöˆ‰R²«˜gé6éBDû™ˆlŒ”Mˆµb-è‘É#]vqõ=ÇÒEȆ33ªqäa
/AŒ0bOÍ”[Øír4‚}=ä{FPØc1¨å¾˜§p®2µˆ•>lXîa„æ ¹³dXzMßpVø½^§UµF;©©Æ>”›Ôa{lÂLt4¹¾ûð¨ÃÈ;‹ÇDš–Xèê¿pü0}2.”¨Œ˜rjã€-£a,,òHYp3¨^Æž©Th!In½D¦^ F¶&ü[Y¸*r°-`ð¸ýp¡(Ð ¸…vk -œrý†‹KÓÎÔjŽ{é¾.u%‘µ5¬•‘$θa”o¶k¨U¬¸uáEé8]×+,Hm¿~Vôd[V•5ýÄf -ø– ã$»êÈÎÕ"…"'†4î~Î^¥»·s -|@ÄE<¾²¨êóÌU(ݬS‹mòåÊë²|¶£üY]6MžWDœÄœ»Š•½œÏâKßä2
-4úÅåBÅô’Í8Hi“ÏPÕ–ô1´3ÕVeÆŠ2£‡ -ÁÊEmBj¢3¨Èx_¢må¡ -•ë®q¹.7:BxoСT?zÓˆö§®a -hìæe¶w£Ð‚uÔmúÝ?,Ûú¶.ÁNp¥ÚƒéjåDÎ\Qß‘K8 -ýdŒf{Ñç/ÔüDZìñ×{Þm yêã›æéOC™—˜˜kúÚÔÆôÚ¼*ŽCƒOýÞ"&¯z¯CÅ~3s½‰{gi6Á\œãÌžNý¡t]ÙN&}Is÷êmƒïÚ*Õ¬cÁ=™M@‘~¬öŸ'ì( -IR9b1të!?4#w`âŸ8´¢¼¦R¨[+Rõ‚”»åÅn‘$IÞçªg<
Ô!+Ab;f<’È0–þ+O?AO¨ˆ!Ü$¢›¨›ªcùV(ŠPOÒçÕ±_XhPñéß|(üA„ünÔ@iÊ_ÁðhÀÃo}Ê”1"B!O“n i÷^õ$Lvi7Í#ì=ô®˜`Lº"ä·uEFSÚÜâ¯y#ÚN¼•‘Lºï€øäEþŽ\û\fÏéVA]XY¨{èQZ¥‰}iTHÄ×ɧâAPˆƒò"N(äiO!}Úà -ñiÿP!wΰ§–~Y7-)Ô
N~G
…!a’ýHCÔ
9(§¡Džò˜S”=õI+È'ýr€ÍþÛ{£‚&øš|zƒ6`3ä*Ö©è*ãÚŠþj_èÖ—Ê®J‹½nÁÜ#2Ö&Œ…$‰CjÃrý°+¡s¥×c]ÌIÈNk9®2i< -òÿq…§Øj«KrPU-É»"Ã,n|Ūì_¥«8§æ%c—Õ™²S–~ÐTH â°««ÏVW_Vuj—®ö˽ëÕàÎÑQïˆá »“RnaŽ‹ÙÂxrŽŽËùÑVÐ=ªƒ’ö¨^YY@ã”yµéõ©ØAl¶µ u·õôJ³VA×+ýÂPzaÀg$ÙÉ&Ä8ÿž«ÿU%à1úO¤4>öÿ…E«ÝPÇG¼ˆÉ˜„1 ±LéË&ÁçîO1Yÿ—ÌÉBendstream +1522 0 obj << +/Length 2893 +/Filter /FlateDecode +>> +stream +xÚksã¸í{~…¿Õ™‰IÔ3ÛéL.›ls×Ë¥‰;íÌíÍ”–h[]Yò‰r²¹__€ +'é<%Ø«Ô4hνd®J%µÊ‰¢¨ó¬öÚTCSßu]"UN ‚yH‚ïäêfÈõµ)ZE¸zMˆJɦ|ãeeÉõ^e-3³”í–—ª\~4 +hfáyN†¾9fùVT²"ŸFÒÐg[Ø>k$ŒÓ%ya4P’~¯$œø#Ìùp +"‡Ï®ëgýFÐ\í‰s&[ÔÂŒjp`‹1ãÄ.}Qe½ß©ª%€Ý)«+]ðq‰§ +~H¿°OQ4Áæ:“¥$o…Ù=ŠR©–fì-DM¸û"çËm/Èá¤ÝÒÌNßöæ@1t$ê÷Š,s¸b,Â)PøTE&u;aBá9±èèðV$ÑÜ\{؆,CfáCƒUP9'°ÐßHI"ð掉zÛ›äÄ”‰ïˆDø¼ùuõöžè‚"FHÜm,$BŒëàæV4P}#¡ô +±AiÏK:·úCÛÅÂñCa×R¾_~à‰-³¤üœö +É‘9R P)0¦†Œi‚4`(M§6ó'óÃ^S(Wr7dg51™hïŸÏ=¨m/̹?5YŽ¥ÚlË7“ìÌ(Ø… ¾È5o]÷"L¸6xc0¡q²m +©—´¦5õÃD œ$ŒlH„r«å&Âçݳ5º?¾·hdµÁk+ §/-UçI0> +è¾ÏÝG$”uf,ÕDC¡Æüx¾;˜t +(–"—ÜYi4¹B™º¦qfèY'ÉíŽÑ–\z
¬nÌ\³&ÊKŸ ‰•v(Äð1“‘㣓Æ|ÒØŠž«Ëˆp}µ6eè£[SWöj›ŸMñ¢Âú`K@®Ö j]¼©VP%Û +·KÊÿóWÞþCw;"Iüé¸~œ8Ô¥V(<AêžHn?ŸŠþ_`Ý2ƒendstream endobj -1514 0 obj << +1521 0 obj << /Type /Page -/Contents 1515 0 R -/Resources 1513 0 R +/Contents 1522 0 R +/Resources 1520 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1486 0 R -/Annots [ 1519 0 R 1520 0 R ] +/Parent 1493 0 R +/Annots [ 1526 0 R 1527 0 R ] >> endobj -1519 0 obj << +1526 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [253.7995 314.5359 417.685 326.5956] +/Rect [253.7995 146.8976 417.685 158.9572] /Subtype/Link/A<</Type/Action/S/URI/URI(ftp://www.isi.edu/in-notes/)>> >> endobj -1520 0 obj << +1527 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [63.4454 279.5831 208.8999 289.7449] +/Rect [63.4454 108.9117 208.8999 119.0735] /Subtype/Link/A<</Type/Action/S/URI/URI(http://www.ietf.org/rfc/)>> >> endobj -1516 0 obj << -/D [1514 0 R /XYZ 56.6929 794.5015 null] ->> endobj -578 0 obj << -/D [1514 0 R /XYZ 56.6929 769.5949 null] ->> endobj -1517 0 obj << -/D [1514 0 R /XYZ 56.6929 748.2046 null] +1523 0 obj << +/D [1521 0 R /XYZ 56.6929 794.5015 null] >> endobj 582 0 obj << -/D [1514 0 R /XYZ 56.6929 748.2046 null] +/D [1521 0 R /XYZ 56.6929 652.1213 null] >> endobj -1066 0 obj << -/D [1514 0 R /XYZ 56.6929 720.0412 null] +1524 0 obj << +/D [1521 0 R /XYZ 56.6929 614.8935 null] >> endobj 586 0 obj << -/D [1514 0 R /XYZ 56.6929 449.6752 null] +/D [1521 0 R /XYZ 56.6929 614.8935 null] >> endobj -1518 0 obj << -/D [1514 0 R /XYZ 56.6929 413.7675 null] +1072 0 obj << +/D [1521 0 R /XYZ 56.6929 584.5024 null] >> endobj 590 0 obj << -/D [1514 0 R /XYZ 56.6929 413.7675 null] ->> endobj -895 0 obj << -/D [1514 0 R /XYZ 56.6929 387.3208 null] ->> endobj -1521 0 obj << -/D [1514 0 R /XYZ 56.6929 230.2407 null] ->> endobj -1522 0 obj << -/D [1514 0 R /XYZ 56.6929 230.2407 null] ->> endobj -1523 0 obj << -/D [1514 0 R /XYZ 56.6929 198.3547 null] ->> endobj -1524 0 obj << -/D [1514 0 R /XYZ 56.6929 198.3547 null] +/D [1521 0 R /XYZ 56.6929 289.5256 null] >> endobj 1525 0 obj << -/D [1514 0 R /XYZ 56.6929 198.3547 null] +/D [1521 0 R /XYZ 56.6929 251.3901 null] >> endobj -1526 0 obj << -/D [1514 0 R /XYZ 56.6929 192.4259 null] +594 0 obj << +/D [1521 0 R /XYZ 56.6929 251.3901 null] >> endobj -1527 0 obj << -/D [1514 0 R /XYZ 56.6929 177.6614 null] +900 0 obj << +/D [1521 0 R /XYZ 56.6929 222.7156 null] >> endobj 1528 0 obj << -/D [1514 0 R /XYZ 56.6929 174.3269 null] +/D [1521 0 R /XYZ 56.6929 53.7852 null] >> endobj 1529 0 obj << -/D [1514 0 R /XYZ 56.6929 159.5623 null] ->> endobj -1530 0 obj << -/D [1514 0 R /XYZ 56.6929 156.2278 null] +/D [1521 0 R /XYZ 56.6929 53.7852 null] >> endobj -1531 0 obj << -/D [1514 0 R /XYZ 56.6929 98.4347 null] ->> endobj -1010 0 obj << -/D [1514 0 R /XYZ 56.6929 98.4347 null] +1520 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F47 879 0 R /F53 962 0 R /F11 1299 0 R /F39 863 0 R >> +/ProcSet [ /PDF /Text ] >> endobj 1532 0 obj << -/D [1514 0 R /XYZ 56.6929 98.4347 null] +/Length 2825 +/Filter /FlateDecode +>> +stream +xÚµZ]{£6¾Ï¯ð¥ý<-’ KÇö¤É4™4v·Ûα›g0¸g&ýõ{„>äζûä" ôâóžO <òà"†<ÊýQÈ}Ä<ÌFëý•7ÚÂÜíV2×ZèÚ–ºY]ýó
Gñ€£ÕgkyQ„G«ÍÇñôéiñ8¿û÷äš0o<E“kæyzt¶XN®Ã€‹ *¦o|swóã݇Ûçéӿʇ~ó˜7}œË›åÏ··‹åj¡nŸÓùÝã-ˆàɧÕýÕbe^ÛþiØ£â¿úøÉmàÞ_yˆòˆ¾Â‡0çd´¿òȨTdWË«ŸÌ‚ÖlýhŸª‹HØ£+‚G#Îi)‹qPBke-«8ßÄÇM9ø[¨(c—h²¤$4í£IK äÏïf $ÿS3EÞÝ m¤Î±}ÛD0c( +)kƒÏ‹}œæ’ÐÇxŸ”ŠwBBy5+òur¨Ô8èH^¼‹×i–ViRë«ó3qè!„¼ Àø‡|äi‚ £Érì¡X‰IuLK%õX¼&û—ä(ï0B4ÈÀVüKŒXRF´”Ås0₶éb0bƒ_dänÈ’}’Wq•y‡—å!Y§¿yYËÙsr&@¿ö’#oþ>Š(½@‘-5L‘‘ÒñÐá3N䆡3è~†ZØqš©Xœª4ßv8¨v‰¼°©\¾•U²ïs1Òç¼ÍÇLiÿ)>‚æ7ÛDßÇù)>¾ÕH-ÙŠpׄøˆG Z*~€O꥟ŽÅ¡(m)—^@Eäw–”ƒ;-eÜ‹s‡{9¡-òºØäÙàwùú8ÁÑXzâñ?E®([M0Æãcœ—ŸµkçË>ú|Œp +ªèf1ˆ{²¶À,@^C-·{FæBþ¿9•;yµÈþЉ픽ý&A$¢ä–”ƒ -e˜ ^ä`Âm1ÑÅ`ÂL¶ ÒWÕâõÎT:è~:%Dz›r„I@úSÑ4ßÈÄ÷U×qq=°Þ½GÃz‡¦CP½ wKÊ¡w-eô„.pA[zïbèÝ_|«’¼4 Æ$§²“ŒòE?¼€;Ow½gF¡€ùŸóŽÃô1|‰KÊA–²( +\Ð]ì +lðÇ"¿–EWrܧ¹®ÈŒÆe‚©£G²I¥¯ÃC$d´ßfÇø«`VØôëžêÞ^"ˆ|nÝÛRú7RF÷‘洞ÐîÏ°ûuß_&ª* lü>y“M¯UýEÐ䄼JMM’ÒEàBÂEVË»Û!„"/bØâj<nÀCüq:Ácå$”?¨©ÛÓfé»”E¡Ñx®fqY]˼o Zy?‹¿h—£-#0}Û2”_&œŒ“,ƒ\Iœ:XªôD<(›í$QQ~ÁN,)‡h)c'œz;qA[vÒÅ°¼e' i'"}—Uü’¥åN4S®˜¹z¿P;ŠÏÏC¡3âÈçAgÓh®8ô2¸L•µ#áfÈçˆr‰!KÊÁ–²r$2'´ÅP{€!Ü(û9ùý”èf,»ÇŸ…ÚÒmW'ImÙ%׫s\9äÆÔ”ðÿ7[#àKlYR¶´”f‹z^è`Ëm±ÕÅ`ËRZ?ß'jòj¨-ÀqM†|D·kâF¶k½Á#ƃ6IÎ0×ÞÛssƒ)è7–”ƒ-e¸ œ9ÑmqÓÅàÆ¿Mr¨¯…bÃP•V"Ú…Ü_Óu"§¦Ù¶€©Ý^ÎÉ°'ib%ÜËX =>(–éæT{-éÕp!è¿].e~ót^“§<®\ËÏüN9´Tô¿ÿç}õéì +¶º/ÓÃi&·hÞêß¡fÔ_¦/Å«=sß²²~e|–pu?øCœejîú*ló£ýû›<€æ©»¿Ù4ª
mõÖÒwm{RßCKqšµ-5lÖFʘ5!³vB7f}†ÝoÖ-ð»|SÛ˜n+Ÿ“²È^µ¢—§Ã¡8Vgçr1ëËԃرþØ?+ò£¡zž¬Ûᆠ+±ŠSzIï–”CïZÊè=¢Ô¡w´¥÷.ö€ÞmðÕNFƒ”/]xœ½•i)Źµfk
®ÕÖ\éL ®íLÐð©p’f¯M¬Šxõ%Í´Ü-ƒ‹g= P’Šàã@wFªžV‹¶êi Ó$“pŒ"^Ø#µ¥†É4RšLßs‘é„nÈ<Ãî'³^Ìí¼€y¾UÉ|\lN*²‹ÑZÁBX”disæлsùбØÅ”ÕĈç§òYèzº†11ú FŒª;òdw$^æ!.ËDGn¹9ª [œ6LjHp•IÿnÐφé0 +=|a¿Ô–rЯ¥,ú1Ô mÑßÅ ßWgU±.Ä.øÌC±él FD¥oíÕbD&&áÈMb‚;¹û}nýlŸ3C¯îs;s,“&,Ú63a;²}PâÚ,”G«•[ìëÞ2–Îñò_´¨‚™èÌÝvaI9ìBK5vá;΃Ж]t±ì¹TÖó¢8„È#ëB”õMm”F*ÊSU׉‹ÆÄÙì5,>}ñ}ʸ޴#š‰È21ú ÄMŒƒsu\bZFñ÷ÃY‚©À²¸ ¡£ùÈ +’Xï* +endobj +1531 0 obj << +/Type /Page +/Contents 1532 0 R +/Resources 1530 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 1589 0 R >> endobj 1533 0 obj << -/D [1514 0 R /XYZ 56.6929 95.3752 null] +/D [1531 0 R /XYZ 85.0394 794.5015 null] >> endobj 1534 0 obj << -/D [1514 0 R /XYZ 56.6929 80.6106 null] +/D [1531 0 R /XYZ 85.0394 752.3015 null] >> endobj 1535 0 obj << -/D [1514 0 R /XYZ 56.6929 77.2761 null] +/D [1531 0 R /XYZ 85.0394 752.3015 null] >> endobj -1513 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F47 874 0 R /F53 957 0 R /F11 1293 0 R /F39 858 0 R >> -/ProcSet [ /PDF /Text ] +1536 0 obj << +/D [1531 0 R /XYZ 85.0394 752.3015 null] >> endobj -1538 0 obj << -/Length 2936 -/Filter /FlateDecode ->> -stream -xÚµZ[sÛ6~÷¯Ð£4Sc‚àåQ‘ÕN츒²ÝNÚZb,N(Ò);î¯ßâB" tº;~0 â£Îwn8 aø#£ˆ!LcÆ>b˜°Ñöp…GO0·¼"RæZ ]›Rï6WÿzOÃQŒâÀF›¯ÆZÂQDF›Ý—ñôáaq?¿ùÏäÚcx<E“k†±-Ö“ë0ˆùåS¿»y÷ñæÓr5}øù7ñÐï˜áéý\ܬ?/—‹õf!oW‹éüæ~ "dòÇæöj±Ñ¯mþ4‚)ç?¯¾üG;ø…·WÑ8b£W¸ÁˆÄ±7:\ùŒ"æSªFò«õÕ/zAc¶ytHUZæšú( -`
·BYŒêQP¸P¨’â -ý²z?ó
þèÿ^Â0ŠbŒÌEÏ µÔ9¶o’ICQHY|þV$‡l;¹¦A8þü¼Kê´â7Ñ8+Ä`½OÅż<$jð>9¤BlýVÕé¿zï·0š -Ÿ%Û}V<‰›òk…_Né1ßÐ>ñ¯«ý;©ôi±;NH4N_+5“4Û½Ö{dÕ;Ä;K‡n½›Rv½k)÷ tx€ºÕûö°Þ;à‹ïuZTÜ–…BÒí>)²ê ]ákyì)Ÿ'¬Üa•–ú„…¦CŽuüÆŒu
/§§SUÿ€é!EaL.˜¾)å @Ix -\Ð}l&ø}Y\ošÀžY‘ä=‹ÓDt— ÞZÃC^Èè°ÌŽÉ+gVØ
ë>¶ëV¦O.èÞrè^IiÝG>sèÞmè¾mѽ ¾N·B¡\”?¤oâBrLŠ*º†Ñ -‰Í\ -G
üù©xv:ý ͽ“£“£Üa±#â/s—TUª¢µhˆJÈ:«Ä°‚`9Ü!Ê™rÂcÔ¿@º!å ]IÄ»â¦Ú ¾m!ßI¯.·%ïL€ŸÜ•»^Ó4òdÊVžÌGD2âÎÛ&#¸'ØÛ6Ï9pˆ"?6svLD¢„E»f¡'Lçå£wR\™…ôb¹r‡}µ;ÆÒÍÒÿÐ. Qð®ä…``JÙíBKµváûv»pB·vq†=lpž?E
ÏBJ¹ËoK^V47=PÉÈNe-Ç/Z{àwº9h„ŸGùF¯„²XlÚ‹íDd½“â:FðÁ¹<"Ñ£øßÃYÑ‚Â)Ç2‹¶O !YÜx’¨NÐ+7¥ÓÇòT÷º - œ7±UŸEü>Æ[ânã3¤Æ§¤”ñæ -JNhÃøúØã3Á§“kæù†%ñ;©s^)ð†3cFÁ|dVÍNj3öëÄÃcØИw»4—«ÏÓç¼|SÏ7,4¯P~_ÿ)°` -¥bH#˱‚ ´>=Û±¾eò"^¸Ú8¦ÖXãEá8¾ÐÜ1¥ìtk)ƒnÇѬº¥û{˜îø¬<D¿•¨6ë™ý7“Ájy¬„ŒðZ˜XŸžž`Öì`ü}ö}ð -Ò:õ¨u;<wvó¤ø+{²E›»,ÏõYïß4 ?FAèÅLÂr˜„’Ò&GŽS'´a}l‹I˜àëô˜©£’ûS»Ãš6-‰´Î¶C'f柟Îê£XËöœ×˜vµS‚<L.Tƒ¦”CíJªÍú¡#ë;¡
µ÷±-j7Áµ'Bå—Ué>yÉx -¬äÄç<‡°\Èu¥¡P#ó‡Ëí·ä9Á¦Ô¾Q½U'~÷c°½Sµ"á¥6L)ËJJ³bGZvB,÷±-,›àíõzúÐvÕÚ]Aë
ƒT{$Å0nÎßKºYw‘gežæybI†ö¶Áˆ±wa/fJ9ˆPRšˆ(tá‚6ˆèc[ˆ0Á§ÜšÃñ]š4ÛqOuÐ=¾½zVÁUh&?–ºÙ7ô@Ð|îÆ'ÄNÞk?wã“òtFŸ»QLTŠn"ê"¾$ŒJŽµ^çu>µ±Z¦Ûìo"z¿LºQET¶å
>]8ß&Å)9¾ý@ºCä…Á…ž·!äø¨J -é#QÌ%’×ø¤ªlù¢Ê@“ D~”@‰ßÄ_> öåpÑ|Ëöõ1 -~/öé ÙZn´\\ýTÈ~jö\\Šù“ËSþx¦ª´ -¡“®„R†ø·ªzÅ:¡ÿãÏfͶ<¢Qd Ý(òâP½ùøì£^F#Ä"/xõÿp=7endstream -endobj 1537 0 obj << -/Type /Page -/Contents 1538 0 R -/Resources 1536 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 1592 0 R +/D [1531 0 R /XYZ 85.0394 746.3107 null] +>> endobj +1538 0 obj << +/D [1531 0 R /XYZ 85.0394 731.5461 null] >> endobj 1539 0 obj << -/D [1537 0 R /XYZ 85.0394 794.5015 null] +/D [1531 0 R /XYZ 85.0394 728.1497 null] >> endobj 1540 0 obj << -/D [1537 0 R /XYZ 85.0394 769.5949 null] +/D [1531 0 R /XYZ 85.0394 713.3851 null] >> endobj 1541 0 obj << -/D [1537 0 R /XYZ 85.0394 771.5874 null] +/D [1531 0 R /XYZ 85.0394 709.9887 null] >> endobj 1542 0 obj << -/D [1537 0 R /XYZ 85.0394 744.8677 null] +/D [1531 0 R /XYZ 85.0394 651.9592 null] +>> endobj +1016 0 obj << +/D [1531 0 R /XYZ 85.0394 651.9592 null] >> endobj 1543 0 obj << -/D [1537 0 R /XYZ 85.0394 741.1608 null] +/D [1531 0 R /XYZ 85.0394 651.9592 null] >> endobj 1544 0 obj << -/D [1537 0 R /XYZ 85.0394 726.3962 null] +/D [1531 0 R /XYZ 85.0394 648.8377 null] >> endobj 1545 0 obj << -/D [1537 0 R /XYZ 85.0394 722.6893 null] +/D [1531 0 R /XYZ 85.0394 634.0731 null] >> endobj 1546 0 obj << -/D [1537 0 R /XYZ 85.0394 707.9846 null] +/D [1531 0 R /XYZ 85.0394 630.6767 null] >> endobj 1547 0 obj << -/D [1537 0 R /XYZ 85.0394 704.2179 null] +/D [1531 0 R /XYZ 85.0394 615.9121 null] >> endobj 1548 0 obj << -/D [1537 0 R /XYZ 85.0394 689.4533 null] +/D [1531 0 R /XYZ 85.0394 612.5156 null] >> endobj 1549 0 obj << -/D [1537 0 R /XYZ 85.0394 685.7464 null] +/D [1531 0 R /XYZ 85.0394 585.7959 null] >> endobj 1550 0 obj << -/D [1537 0 R /XYZ 85.0394 670.9818 null] +/D [1531 0 R /XYZ 85.0394 582.3994 null] >> endobj 1551 0 obj << -/D [1537 0 R /XYZ 85.0394 667.2749 null] +/D [1531 0 R /XYZ 85.0394 567.6349 null] >> endobj 1552 0 obj << -/D [1537 0 R /XYZ 85.0394 640.5552 null] +/D [1531 0 R /XYZ 85.0394 564.2384 null] >> endobj 1553 0 obj << -/D [1537 0 R /XYZ 85.0394 636.8483 null] +/D [1531 0 R /XYZ 85.0394 549.5337 null] >> endobj 1554 0 obj << -/D [1537 0 R /XYZ 85.0394 622.0837 null] +/D [1531 0 R /XYZ 85.0394 546.0774 null] >> endobj 1555 0 obj << -/D [1537 0 R /XYZ 85.0394 618.3768 null] +/D [1531 0 R /XYZ 85.0394 531.3128 null] >> endobj 1556 0 obj << -/D [1537 0 R /XYZ 85.0394 603.6122 null] +/D [1531 0 R /XYZ 85.0394 527.9163 null] >> endobj 1557 0 obj << -/D [1537 0 R /XYZ 85.0394 599.9053 null] +/D [1531 0 R /XYZ 85.0394 513.1518 null] >> endobj 1558 0 obj << -/D [1537 0 R /XYZ 85.0394 585.1408 null] +/D [1531 0 R /XYZ 85.0394 509.7553 null] >> endobj 1559 0 obj << -/D [1537 0 R /XYZ 85.0394 581.4339 null] +/D [1531 0 R /XYZ 85.0394 483.0356 null] >> endobj 1560 0 obj << -/D [1537 0 R /XYZ 85.0394 510.1696 null] +/D [1531 0 R /XYZ 85.0394 479.6391 null] >> endobj 1561 0 obj << -/D [1537 0 R /XYZ 85.0394 510.1696 null] +/D [1531 0 R /XYZ 85.0394 464.8745 null] >> endobj 1562 0 obj << -/D [1537 0 R /XYZ 85.0394 510.1696 null] +/D [1531 0 R /XYZ 85.0394 461.4781 null] >> endobj 1563 0 obj << -/D [1537 0 R /XYZ 85.0394 506.8333 null] +/D [1531 0 R /XYZ 85.0394 446.7135 null] >> endobj 1564 0 obj << -/D [1537 0 R /XYZ 85.0394 492.1286 null] +/D [1531 0 R /XYZ 85.0394 443.3171 null] >> endobj 1565 0 obj << -/D [1537 0 R /XYZ 85.0394 488.3618 null] +/D [1531 0 R /XYZ 85.0394 428.5525 null] >> endobj 1566 0 obj << -/D [1537 0 R /XYZ 85.0394 464.2921 null] +/D [1531 0 R /XYZ 85.0394 425.156 null] >> endobj 1567 0 obj << -/D [1537 0 R /XYZ 85.0394 457.9352 null] +/D [1531 0 R /XYZ 85.0394 355.0758 null] >> endobj 1568 0 obj << -/D [1537 0 R /XYZ 85.0394 432.4907 null] +/D [1531 0 R /XYZ 85.0394 355.0758 null] >> endobj 1569 0 obj << -/D [1537 0 R /XYZ 85.0394 427.5086 null] +/D [1531 0 R /XYZ 85.0394 355.0758 null] >> endobj 1570 0 obj << -/D [1537 0 R /XYZ 85.0394 400.7888 null] +/D [1531 0 R /XYZ 85.0394 352.0499 null] >> endobj 1571 0 obj << -/D [1537 0 R /XYZ 85.0394 397.0819 null] +/D [1531 0 R /XYZ 85.0394 337.3452 null] >> endobj 1572 0 obj << -/D [1537 0 R /XYZ 85.0394 325.9133 null] +/D [1531 0 R /XYZ 85.0394 333.8889 null] >> endobj 1573 0 obj << -/D [1537 0 R /XYZ 85.0394 325.9133 null] +/D [1531 0 R /XYZ 85.0394 309.8192 null] >> endobj 1574 0 obj << -/D [1537 0 R /XYZ 85.0394 325.9133 null] +/D [1531 0 R /XYZ 85.0394 303.7727 null] >> endobj 1575 0 obj << -/D [1537 0 R /XYZ 85.0394 322.4814 null] +/D [1531 0 R /XYZ 85.0394 278.3282 null] >> endobj 1576 0 obj << -/D [1537 0 R /XYZ 85.0394 297.0369 null] +/D [1531 0 R /XYZ 85.0394 273.6565 null] >> endobj 1577 0 obj << -/D [1537 0 R /XYZ 85.0394 292.0547 null] +/D [1531 0 R /XYZ 85.0394 246.9367 null] >> endobj 1578 0 obj << -/D [1537 0 R /XYZ 85.0394 265.335 null] +/D [1531 0 R /XYZ 85.0394 243.5403 null] >> endobj 1579 0 obj << -/D [1537 0 R /XYZ 85.0394 261.6281 null] +/D [1531 0 R /XYZ 85.0394 173.5556 null] >> endobj 1580 0 obj << -/D [1537 0 R /XYZ 85.0394 246.8635 null] +/D [1531 0 R /XYZ 85.0394 173.5556 null] >> endobj 1581 0 obj << -/D [1537 0 R /XYZ 85.0394 243.1566 null] +/D [1531 0 R /XYZ 85.0394 173.5556 null] >> endobj 1582 0 obj << -/D [1537 0 R /XYZ 85.0394 171.8924 null] +/D [1531 0 R /XYZ 85.0394 170.4341 null] >> endobj 1583 0 obj << -/D [1537 0 R /XYZ 85.0394 171.8924 null] +/D [1531 0 R /XYZ 85.0394 144.9896 null] >> endobj 1584 0 obj << -/D [1537 0 R /XYZ 85.0394 171.8924 null] +/D [1531 0 R /XYZ 85.0394 140.3179 null] >> endobj 1585 0 obj << -/D [1537 0 R /XYZ 85.0394 168.5561 null] +/D [1531 0 R /XYZ 85.0394 113.5982 null] >> endobj 1586 0 obj << -/D [1537 0 R /XYZ 85.0394 144.4863 null] +/D [1531 0 R /XYZ 85.0394 110.2017 null] >> endobj 1587 0 obj << -/D [1537 0 R /XYZ 85.0394 138.1294 null] +/D [1531 0 R /XYZ 85.0394 95.4372 null] >> endobj 1588 0 obj << -/D [1537 0 R /XYZ 85.0394 123.3648 null] ->> endobj -1589 0 obj << -/D [1537 0 R /XYZ 85.0394 119.6579 null] +/D [1531 0 R /XYZ 85.0394 92.0407 null] >> endobj -1590 0 obj << -/D [1537 0 R /XYZ 85.0394 92.9382 null] ->> endobj -1591 0 obj << -/D [1537 0 R /XYZ 85.0394 89.2313 null] ->> endobj -1536 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F47 874 0 R /F21 654 0 R >> +1530 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F47 879 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1595 0 obj << -/Length 2839 +1592 0 obj << +/Length 2889 /Filter /FlateDecode >> stream -xÚµšÝs›¸ÀßóWøÑž©µHâóщ]ÇmãæÚIwwº} ¶’0µ!Ü6ÿýJH‚¢½wîä! :X?OÀ#‡ÿá‘ç#?"Ñ(ˆ\ä9ØíŽÎè‰_[^`%3ÕBS(uywñÇ[Œ"ùÄÝ=‚¹Bä„!Ýí?gˆ¢ ŸÁ_®.?¬>.7³Ûë¿'Sâ9ãÏ™çòd{¿\.¶wuºYÌæ«õ’‹àÉ4ð#g<»½]¬ç«¿äõ™˜Õ©G¯ÛÉ—»w‹»ú±áOÃÏüíâóg´ç¿ðÝ…ƒhz£üÄA8ŠÈèxázy.¥zäp±½øO=!¸ZÝjZªZfJ]rýêEȧ„ÖÊ
ª¥Ä‚~Þ¼½"ا_º¿ÂU{ÁNz¦º–:×íB˜˜È#A[÷}‘¤O“)%d\>3y°JK–§¬”góõV]ÏÔ@R”yòp*•øÍê¯ÅF^eéc–ãTÝ»<dñAÏöû|‚Ã1+ -u_üò"”óÝY%êFÈÅ.ÇR=ã.ïÊýQMt˜Š{%6ÅEžG*éC¶Û='Ù¹©ÞÅé)Î_å ß!êÝT|y"Š£¼@Ê‚WK¼¡¯M5ÀÛÕmÆuoX‘Ne’¥|¨?ÎÅÿ`|Ÿ&”B§ŠÍŽÉ‘Õž¥eòã–rè$7Š¸¹Ú(blžãDͼŽL^Þ¾%;š°:¡°7HM§ ;È)ât/oBom¡¾añáÀK³>¥¬ô‚ö#Š];h(Õº–ªAêôƒ¶ªn@Ÿé6‚né~ÏÔ_üÜ=Çé“Zˆ9;°§Xñ>˜í²|/ù’§^o
Øpèq=š˜)§]~MÒ"KÕðÇ]™=°üW(>rCÀ›B)-USð¨o¡`S
(tu›)@ÝóíLþô÷‹¿y$·²ˆ†«¥JÒîºk;âÇÊŽÄ
ÒŽê¸ÊéT±óœá‘) -ü6¡¹"´ˆ‹òej˜V†¾Wg7±´ûçšXÔOŒ®3à ¡”…˜–Ä1›j@¬«ÛLêÞlgÜÌ=YMXRC’š8€Ä&¹Œ¦&%µêEMPó#ñ!ˆrÄ&fØ\bg
¶Ê;Ö3µ¼£&ñã:Ù!”²ÀÔR -Ü0¯±²ÝóY¿ÆŽÿlÇ
êN(eÁ¦¥jl^déXUl]ÝflP·ìª†<GüY²´àÁQ”™‘#»¬üqzyÉòR -nåàw–Uƒ¾©W`äø.ñÆ[$ï¸{ÎŽ²‚£Wjôú”p»Õè'
K\z_$iœ–ê’,Šù°îÊÕÚÚN6;%E‘˜:Bœ3íåL#g÷Á@I -¥ú9×R€³¥¿`UÝp>ÓmäÜÒ}Íí 2¢ÆäîÓ¯iö#íšn»Ûi× T†×2ðÂ؈ﴎΔ .OE?M-y%%>+_$öQ´a ¢˜{ž)Oq@Ýf/·z]ug«~•ÐÇœøȆ*S(ea®¥4sc±…¹M5`ÞÕmfu×ë±HwÙþþš•?²ükSÕt;…ùòå¿ -žVv,õ2‹;=µ_é¥ðº….?PÊÂKK5íbi_[U^]Ýf^PwíéÜP{:7žnÂíÊÙ¹Q§»É%W³õL]ñŠ!Ù³¼²¿¢§Õé“Ö[A>cUdóÛa‘͇A‘-.*¡Ëªá•¦¬º:ý³²¹Ã!‰…î²h% - 6ÙKzÄiÚ¼§ïëÂœ¥›ƒBêâžlóãüõ¦ƒ¹pcðÍPªãÔRuˆt¨%o±ªn6ΙnãÆié†!2Þ“T|Ž—Y®ËúfYªó§ß&Èä¡}O¼¹îä7 -Ù‡¬äsŠ6¬º°Î¾h<5é·/ž›úþ€ƒ…R–u×RMjb{SlU
Ö½«Û¼îP·ð¡Y·d›Çe¬ÚÃÉig›ŠÖÉÓ)Ùá"—a-/Œ_XÈõ]×’É_2–«*ÝôEU€[èÐ[{(ea¡¥j¶¼Š°ª,ººÍ, n#‹Úè¨W»¡ß'B0OØß]Æ9´Œ³7ˆß„³o mBý8´PÊ[SÙ¦·ÑUldŸúUÎã~žÄzªÊ'ºy=ËEGËèœ^Üâ°óMK'žüN‚ص˜~@~ˆ0u†>k„,F(¡æã0lÉ5lzÁgÅæ¯"€âû‚µûµÁÌx$/X·ðmµ'¶ê9~„( ]¯¥ãÇu|LåYq¬¿ûSØOž<=—¿ýååa‹?…uêìáþ2¾áATx#i"^®„|õPb!"röäØA„úÄðèÿå3fƒendstream +xÚµšÝw›:ÀßóWøÑ>§ÑEŸ$v·‰›µ“·ÄVN0¤·Í¿#ôÀ zwÏž<¤AƒõÓŒfFà‰xâùÈH4 "yö&Ûý™3ù}WgXÊœ+¡sSêâþì÷4˜D(ò‰?¹2Æ +‘†xr¿û2E3Á™^,/n–Ÿ®ÖñÝõ_³sâ9ӿωWsq³y¸ºZlîòv½ˆçËÕˆàÙyàGÎ4¾»[¬æË?EÌGutëåb3ûzÿálq¯_ÛüiØ¡ü¿Ÿ}ùêLvð?œ9ˆF¡7ù 7ÂQD&û3×£Ès)U-ÙÙæì_z@£·~´wª°ƒõIÏ\<ÁEžGZ“åEȧ„Ö“µfeq<l™œ¶-;q}?ƒx{eå௤€°4¤ÄKÑ>€JŠ¿Ó—õûKŒCúµ«ÓávÕZêT·k.Lä‘ {Å~ÂÏÇt:_mÄÅz-ØߎCò´J‹¼ž“ÎOÁŽÓJ}x >Ð;xŠ8ÓKô~‘)c,~°Ã‡ÓçäPÕxz#»âú?™Þ&ûä¥(eïZö>dÙ>És9h’ïDóÝ“H
~[l_’WVRxÞfB½Ò¹XÂ>>m«âÞ£¦‹ÎAC„ý(B¡ïŽ6¥† k)M8püaÂVÕ
áݽ„[ºXøé«M|§–=7¦m½˜Aw‘ä/øÒü›¸˜øh²÷²ÈX–%ò™.w˜C +jt¼G¯~c¬úqe×õ‚ÐZÂNû{ÞH`dJY¨*)Mû–}ÕªÚ ÚÕÝOÕÔý ,fBò‚‹e^±CÎ*q'€óþB6¤%ìeÇJŠß.ÿ\¬Ååe!ì?—Ï^eÅc’‰ëx·SÎC>—¼¾rå=FïFÈÅ.5ð»"ΫÊÎ¥Q+±Ã¬ØnŸÓbÀhÃA¼^è"⮯)5ŒWKxÃa¼VÕ
Þݽx[ºùš¥;¦~m|„Ó‡<å Dcg›…–åŽåUÊã*v(EÓQº|ª|9´i_Nµ/§V_NQzÔôå‘Ø„ù`Iž²L!|14Þ"å¿å£-Ô°Ge¼–b}Ì™ƒö¢ADG@RÐJJƒ&Ô±€¶©6@wu÷ƒ6udr/~mŸ“ü›œˆ9ËØ7µw ±Ã…àÉ¥W›¾È*ô ‘¡íÀJ…NqÕÚ#»±“…%Èuý1 +†”…‚’Ò`¯·P°©6(tu÷S0uÏ7±øé•°b³¼’MiÞweG<úvÄv¤óc SçÀ=Û%uQømBsIh‘”U–¼0ÙLkCß½Sq±°ûgM,&†af0s†”…˜’2ˆb6Õ±®î~b¦îõ&þãvîÁÎ(j4À2¢5~Åñÿb›E7 +jõ’¿¡æG(pÐØån`s¿k°‰`FÔÊ'0ÝÐA>Lº¦)5SK0-»UuóDw/Ì–îMUê] +GtzÉbƒà“•¼Íò¾š!oPy£`ȯC.1ÂP„!ílòç9Cþ¬izŽ§ +™z…ñ‹ORøê¸Û!¨•Á¹Å´ñ´ÿÄr]ˆã؆”¶’2`GØ6Õì®î~ئn;û\(â/‚Øô©ŽZίY]™½°9–¢?•-Òõ††ë´ë
×-€ÀEÄÒ†ë
¥ëZüý–ëõñ‰
Ëþ CºÑUCÊBUI5T]KcUmPíêî§jêž³*Ù>³Ý³1Šìݨ@ôà‚Ù¥ÔõþÏ[%…42ÂþSj–Òh‚ÐR +5 ‰¥ngÓkì(îGi(Ž›t]$ãk}4HøÑ`'¿¿IËJ¦žÂ÷:íbo¸·<xúÅJãPöîFé= ààö–j¸^È«ŠíóIÆ +<¢8²3„†)!
Ì‹,¥›ÞXWq/0S±¨¡†þªX^Ö'•°;¢¦ +ÿËãëkq¨„ÐòN4þ`‡R”Í¡Ñï«Ì9~dl„.ñ¦$ž¸.ö"_à—²õú˜‚&²õ³.˜C×Ç2Í“¼’]"†fUƒÓÚÚδ8¦e™öÕ€0&Ì‹·ÔClHY+)²¥š`UmPîêîÇl꾆IËô9£2¶‡ü%/~æ]£8ÜllOš\Ë´ËÞòFnu,0–Æwu,«ä©l2ÇÓíª3˜Öw à—¬`Jx Bãö9®lé:–>8`ù,ä8Έ6¥†™k©æË3·ªn˜ŸèîeÞÒçc‘o‹Ý ü«~‡—&‡éÖ?Áô~²"âø¡ÅÍ~6oZ_ˆñzH3•¼„ÃÉö"â±j)e¡¤¤J¶ýÒªÚ ÔÕÝOÉÔ½fß©Øãö,WÛ¡Þ"›#/~w]è
ó\ÍÝk–nBzSÖ•ž»Ï,HžÜNáüâìØ@¹Ü… ݑz)e¢¤4/²™ŽMµ¥«»Š©{<½ßT‡ã¶n’ufÞ8ÛèÙ#ùuÛ“ÿAÇ +¶}ÎÁ=eês¦=÷qrê6=äé÷#ë#@ wÓ!(ôü
¶í,c‰ÂÊŽ¥^I§‚ö;•“~f8ö•…!4LK 5eb©TÛô6¬ºŠ{Q™ŠµsCåã܈û¸¤Õµ›s£N$—ñ*W—+¤;vH†¾oä%MŸ´Nÿ`Ä:¥†ÇÍ”š”šwJ¡‹º°•çâ#Èó×Ö–ei²W_,j%Ø_kç3»Á@ÓRgñÿž¶gò“þÏŸíUñ endobj -1594 0 obj << +1591 0 obj << /Type /Page -/Contents 1595 0 R -/Resources 1593 0 R +/Contents 1592 0 R +/Resources 1590 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1592 0 R +/Parent 1589 0 R +>> endobj +1593 0 obj << +/D [1591 0 R /XYZ 56.6929 794.5015 null] +>> endobj +1594 0 obj << +/D [1591 0 R /XYZ 56.6929 748.5056 null] +>> endobj +1595 0 obj << +/D [1591 0 R /XYZ 56.6929 748.5056 null] >> endobj 1596 0 obj << -/D [1594 0 R /XYZ 56.6929 794.5015 null] +/D [1591 0 R /XYZ 56.6929 748.5056 null] >> endobj 1597 0 obj << -/D [1594 0 R /XYZ 56.6929 769.5949 null] +/D [1591 0 R /XYZ 56.6929 743.7078 null] >> endobj 1598 0 obj << -/D [1594 0 R /XYZ 56.6929 771.5874 null] +/D [1591 0 R /XYZ 56.6929 719.6381 null] >> endobj 1599 0 obj << -/D [1594 0 R /XYZ 56.6929 744.8677 null] +/D [1591 0 R /XYZ 56.6929 711.8197 null] >> endobj 1600 0 obj << -/D [1594 0 R /XYZ 56.6929 739.887 null] +/D [1591 0 R /XYZ 56.6929 697.0552 null] >> endobj 1601 0 obj << -/D [1594 0 R /XYZ 56.6929 713.1673 null] +/D [1591 0 R /XYZ 56.6929 691.8868 null] >> endobj 1602 0 obj << -/D [1594 0 R /XYZ 56.6929 708.1866 null] +/D [1591 0 R /XYZ 56.6929 665.1671 null] >> endobj 1603 0 obj << -/D [1594 0 R /XYZ 56.6929 693.4819 null] +/D [1591 0 R /XYZ 56.6929 659.9987 null] >> endobj 1604 0 obj << -/D [1594 0 R /XYZ 56.6929 688.4414 null] +/D [1591 0 R /XYZ 56.6929 635.929 null] >> endobj 1605 0 obj << -/D [1594 0 R /XYZ 56.6929 673.7366 null] +/D [1591 0 R /XYZ 56.6929 628.1106 null] >> endobj 1606 0 obj << -/D [1594 0 R /XYZ 56.6929 668.6961 null] +/D [1591 0 R /XYZ 56.6929 601.3909 null] >> endobj 1607 0 obj << -/D [1594 0 R /XYZ 56.6929 644.6264 null] +/D [1591 0 R /XYZ 56.6929 596.2225 null] >> endobj 1608 0 obj << -/D [1594 0 R /XYZ 56.6929 636.9957 null] +/D [1591 0 R /XYZ 56.6929 569.5028 null] >> endobj 1609 0 obj << -/D [1594 0 R /XYZ 56.6929 611.5512 null] +/D [1591 0 R /XYZ 56.6929 564.3344 null] >> endobj 1610 0 obj << -/D [1594 0 R /XYZ 56.6929 605.2953 null] +/D [1591 0 R /XYZ 56.6929 549.6297 null] >> endobj 1611 0 obj << -/D [1594 0 R /XYZ 56.6929 581.2255 null] +/D [1591 0 R /XYZ 56.6929 544.4015 null] >> endobj 1612 0 obj << -/D [1594 0 R /XYZ 56.6929 573.5948 null] +/D [1591 0 R /XYZ 56.6929 529.6968 null] >> endobj 1613 0 obj << -/D [1594 0 R /XYZ 56.6929 558.8901 null] +/D [1591 0 R /XYZ 56.6929 524.4686 null] >> endobj 1614 0 obj << -/D [1594 0 R /XYZ 56.6929 553.8496 null] +/D [1591 0 R /XYZ 56.6929 500.3989 null] >> endobj 1615 0 obj << -/D [1594 0 R /XYZ 56.6929 527.1298 null] +/D [1591 0 R /XYZ 56.6929 492.5805 null] >> endobj 1616 0 obj << -/D [1594 0 R /XYZ 56.6929 522.1492 null] +/D [1591 0 R /XYZ 56.6929 467.136 null] >> endobj 1617 0 obj << -/D [1594 0 R /XYZ 56.6929 495.4294 null] +/D [1591 0 R /XYZ 56.6929 460.6924 null] >> endobj 1618 0 obj << -/D [1594 0 R /XYZ 56.6929 490.4487 null] +/D [1591 0 R /XYZ 56.6929 436.6227 null] >> endobj 1619 0 obj << -/D [1594 0 R /XYZ 56.6929 466.379 null] +/D [1591 0 R /XYZ 56.6929 428.8043 null] >> endobj 1620 0 obj << -/D [1594 0 R /XYZ 56.6929 458.7483 null] +/D [1591 0 R /XYZ 56.6929 414.0996 null] >> endobj 1621 0 obj << -/D [1594 0 R /XYZ 56.6929 444.0436 null] +/D [1591 0 R /XYZ 56.6929 408.8714 null] >> endobj 1622 0 obj << -/D [1594 0 R /XYZ 56.6929 439.0031 null] +/D [1591 0 R /XYZ 56.6929 382.1516 null] >> endobj 1623 0 obj << -/D [1594 0 R /XYZ 56.6929 413.5586 null] +/D [1591 0 R /XYZ 56.6929 376.9833 null] >> endobj 1624 0 obj << -/D [1594 0 R /XYZ 56.6929 407.3026 null] +/D [1591 0 R /XYZ 56.6929 350.2636 null] >> endobj 1625 0 obj << -/D [1594 0 R /XYZ 56.6929 346.1003 null] +/D [1591 0 R /XYZ 56.6929 345.0952 null] >> endobj 1626 0 obj << -/D [1594 0 R /XYZ 56.6929 346.1003 null] +/D [1591 0 R /XYZ 56.6929 321.0255 null] >> endobj 1627 0 obj << -/D [1594 0 R /XYZ 56.6929 346.1003 null] +/D [1591 0 R /XYZ 56.6929 313.2071 null] >> endobj 1628 0 obj << -/D [1594 0 R /XYZ 56.6929 338.5253 null] +/D [1591 0 R /XYZ 56.6929 298.5024 null] >> endobj 1629 0 obj << -/D [1594 0 R /XYZ 56.6929 323.7607 null] +/D [1591 0 R /XYZ 56.6929 293.2742 null] >> endobj 1630 0 obj << -/D [1594 0 R /XYZ 56.6929 318.7801 null] +/D [1591 0 R /XYZ 56.6929 267.8297 null] >> endobj 1631 0 obj << -/D [1594 0 R /XYZ 56.6929 304.0753 null] +/D [1591 0 R /XYZ 56.6929 261.3861 null] >> endobj 1632 0 obj << -/D [1594 0 R /XYZ 56.6929 299.0348 null] +/D [1591 0 R /XYZ 56.6929 199.468 null] >> endobj 1633 0 obj << -/D [1594 0 R /XYZ 56.6929 284.3301 null] +/D [1591 0 R /XYZ 56.6929 199.468 null] >> endobj 1634 0 obj << -/D [1594 0 R /XYZ 56.6929 279.2896 null] +/D [1591 0 R /XYZ 56.6929 199.468 null] >> endobj 1635 0 obj << -/D [1594 0 R /XYZ 56.6929 264.5848 null] +/D [1591 0 R /XYZ 56.6929 191.7053 null] >> endobj 1636 0 obj << -/D [1594 0 R /XYZ 56.6929 259.5443 null] +/D [1591 0 R /XYZ 56.6929 176.9408 null] >> endobj 1637 0 obj << -/D [1594 0 R /XYZ 56.6929 244.7797 null] +/D [1591 0 R /XYZ 56.6929 171.7724 null] >> endobj 1638 0 obj << -/D [1594 0 R /XYZ 56.6929 239.7991 null] +/D [1591 0 R /XYZ 56.6929 157.0677 null] >> endobj 1639 0 obj << -/D [1594 0 R /XYZ 56.6929 163.7723 null] +/D [1591 0 R /XYZ 56.6929 151.8395 null] >> endobj 1640 0 obj << -/D [1594 0 R /XYZ 56.6929 163.7723 null] +/D [1591 0 R /XYZ 56.6929 137.1348 null] >> endobj 1641 0 obj << -/D [1594 0 R /XYZ 56.6929 163.7723 null] +/D [1591 0 R /XYZ 56.6929 131.9066 null] >> endobj 1642 0 obj << -/D [1594 0 R /XYZ 56.6929 159.0666 null] +/D [1591 0 R /XYZ 56.6929 117.2018 null] >> endobj 1643 0 obj << -/D [1594 0 R /XYZ 56.6929 144.3618 null] +/D [1591 0 R /XYZ 56.6929 111.9736 null] >> endobj 1644 0 obj << -/D [1594 0 R /XYZ 56.6929 139.3213 null] +/D [1591 0 R /XYZ 56.6929 97.2091 null] >> endobj 1645 0 obj << -/D [1594 0 R /XYZ 56.6929 124.6166 null] ->> endobj -1646 0 obj << -/D [1594 0 R /XYZ 56.6929 119.576 null] +/D [1591 0 R /XYZ 56.6929 92.0407 null] >> endobj -1647 0 obj << -/D [1594 0 R /XYZ 56.6929 104.8115 null] +1590 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F47 879 0 R >> +/ProcSet [ /PDF /Text ] >> endobj 1648 0 obj << -/D [1594 0 R /XYZ 56.6929 99.8308 null] +/Length 2575 +/Filter /FlateDecode +>> +stream +xÚÝšÏw£8Çïù+|´ßk3!{sâ$Þî$k§wv_Oˆ8¼ÅàœžÌ_¿%ô‘Ü;{Ûׇ6RÁê#•ª¤øÿü %ÂI8‰“Ð#È'“ÍþMvÐw{áK›¹2š›V—O¿Üàx’xID“§ãYÔC”ú“§í·éâññú~y÷Ù< hºðfs‚j½º^Ïæq”ðÌ»"4½¼»ü|÷p»Z<~ü§¸é7DÐâ~).Ö_oo¯×O×òru½XÞÝß‚‰?ûþôéâúI¿¶ùi>Âüÿ}ñí;šlá?] '”L~Àòü$ &û‹`„«–üb}ñ7ý@£·½uÌUSÐ ñUàO|ßK zÎ"‰á +C‡„4—ó£ØþY$O¼ˆÒ d©h¤•97nØs5£ÓcZ½k"‘HAÒGgâ’iå ¢¬‘ +9³?˜3—N>ø¬™<æûnò¦•¼¶Òäi@ìäÒùíqò=ñ|yMŸf¾ï]Þú%ŠÁùš²ç¿Ìæ8¦wu}lGô´cî¹óéýñS;º['òöX!ƒæ•‰ÞøUÉû[ ¬Ww›rSæc±‰‡Pb.‡ p·¸ÏÕJ«vLLæÚ~.††øÜešÁ'ªa˜ÊÈ „¬3žÐÃÔÇg¸VîÊJqÇaâˆÌNiƒûPÛÂÝÌ/1éHâPN‡¶Y4‘éâpȳN%¡…WwËû…*%†K&Ž½(!¾
nê‚1\ܤyéj‹ßÄ}ƒ0â óeŸm7•´ùûHÚZf®A›Ô
ËóRónE6¯šº=C"AàÑð\agZ9¨++ƒºï î’6¨µ-ÔMqNTL4v€™MH +ÀûF¢)ïWÇ›èh:4ÕÛœÉ!Š:âü1qñ¬8ïù¢€«‡ô€_æi±yeÍŸ +Êt€¹EH±^Áø>Š§oÛ“ +Þ)’<±Ã©îîP +0•Åô¢>„š†ç"Íë¦äÿ›ûÐ(ã1ü2VBÙ°Û‰†úãªæ<eÅŠ#ããû"Áű¹E‹öqu•+¦¼±w&x¥N£™ñÇ4ŸŽùÏœbâñ?mñ3Ò¡ýþ:cã8ö0µí`AŽžÄê¥øÇ%xøæúOíN_ý?R¾Xendstream +endobj +1647 0 obj << +/Type /Page +/Contents 1648 0 R +/Resources 1646 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 1589 0 R >> endobj 1649 0 obj << -/D [1594 0 R /XYZ 56.6929 85.0662 null] +/D [1647 0 R /XYZ 85.0394 794.5015 null] >> endobj 1650 0 obj << -/D [1594 0 R /XYZ 56.6929 80.0855 null] +/D [1647 0 R /XYZ 85.0394 748.7645 null] >> endobj -1593 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F47 874 0 R /F21 654 0 R >> -/ProcSet [ /PDF /Text ] +1651 0 obj << +/D [1647 0 R /XYZ 85.0394 748.7645 null] >> endobj -1653 0 obj << -/Length 2728 -/Filter /FlateDecode ->> -stream -xÚÝZ[w£8~ϯð#>§Í" q™7'N§Ó—$k§wv¶§ˆMÎbðNoæ×O ]‰ÞÝ·=~0H%}P_U©TÍ<ø¡YD]Äþ,Œ}—zˆÎ¶‡o¶‡¾›$dRh¡K]>^üå= g±8˜=>ksE®Ehö¸ûæ,®ïV·Ÿ/0õœ¥;_PÏ“W×›ù"bÖAXWà9—·—ŸoïoÖˇ¿ñA¿{Ô[ÞøÍæëÍÍõæñZÜ®¯—«Û»Aóï/®Õc믆<žù_ß¾{³¼áÇÏ%qDg?àÆsQãÙá§ĥ>!²%¿Ø\üUM¨õ¶CÇTEIäÒ‡#ºÂh†SŠ{Ê¢±LZeÝMZI“•E’g¤;þ’«òd¿¾Kim|Uâ»~ngQ“âOFÆX”RìÁ¾ß_áÓïCdD=7ŠáÕ¬ÐJêÛ×-QêF!¡}ð%¼y8s„“û¼ÕK:¿Î±ç¤O¿ÌÄÇÎm]Ÿ@5mOùÌÇÜ¢èî¿TJ„îV‰¬=ô`Âh^RÞ{W•ß’6üîXÍQä”M¹-ó–ƒêŽ]Ï‹Á@Úç -|ëvÿT—yÚ¤4°´Ã1O°ÈòÄõ¿á3Ö"_‘…“- KýTªKYlAJiû\ËÒh…Ölaˆm°œÛœë®²wmô„ÿ›´ÜWÉñœ4ç-Ÿ-ù€ÝˆÒX¯`#çÊåß'§9ÏEÏ—¶‡:›íË)ÿ#!ÿ§YS€€w‹.Î%ô„ì we‘½‰¨Äï9ø°ÃÆhÆŸJKu)3ÅJJe?Ah)eX¡;ŠÏ°Ç)î_f…Z¶>'O©,idg+íè–OÔ©Û½ØûÿE«äÇ3/díd08íOu£xˆÍ<¾‹Ã©,T—²ð ¥ºÄÐRé°Bk<±
<èàÜÕ"a§a¹Oyà¾)Ù¿^F›áJ[EÃ~Ïö‰Hf#é0Ë:-NÌÞÇ+%Äó\/õÊTsÒ¢>iÝ´bõûçF‚í§Œ$‘9Ô)žžÅîTI|4¨%‹Ð½ÔÚ6éöyÆÛtUÅÈ¥áT5R—2›Ž’R¦ã–Jº33ìqÓéKÏô±ôLH£U™µvb=š…¯Ôaj5? mHm‡B6–'ÿœ#§M¡`ïO¤=0œÖÌØÅ•ÿ”œÄq#›åcR´92ÇhX0zP -€gÙTZ¡5&†Ø&tpU"Yâ„+u6Æ®$ -ÛsOX6×WíÉ'—Èö?ƒ¹'}ÛñƒS’X#ÊÇعtùÀ¶ -É)ÌÔ”m<äKùá˜ßûPÆúIL¯:õiD'c&LÈttÙ>†±€vd
PÇ©Ò`
k±ò‘õåI•±Ï ¶IWg“ÿÿ(éiMÒœFk2(„,vt=_ºveqîGVOÍõ˜0„,,˜Hë5!ËgIB¨û\Ávv`ÃÕ>J -¿á3Eân„ãP>{ø˜Ÿ\}ŽyþèpnØMendstream -endobj 1652 0 obj << -/Type /Page -/Contents 1653 0 R -/Resources 1651 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 1592 0 R +/D [1647 0 R /XYZ 85.0394 748.7645 null] +>> endobj +1653 0 obj << +/D [1647 0 R /XYZ 85.0394 744.2194 null] >> endobj 1654 0 obj << -/D [1652 0 R /XYZ 85.0394 794.5015 null] +/D [1647 0 R /XYZ 85.0394 729.5147 null] >> endobj 1655 0 obj << -/D [1652 0 R /XYZ 85.0394 752.341 null] +/D [1647 0 R /XYZ 85.0394 724.6347 null] >> endobj 1656 0 obj << -/D [1652 0 R /XYZ 85.0394 752.341 null] +/D [1647 0 R /XYZ 85.0394 709.93 null] >> endobj 1657 0 obj << -/D [1652 0 R /XYZ 85.0394 752.341 null] +/D [1647 0 R /XYZ 85.0394 705.05 null] >> endobj 1658 0 obj << -/D [1652 0 R /XYZ 85.0394 746.4344 null] +/D [1647 0 R /XYZ 85.0394 690.2855 null] >> endobj 1659 0 obj << -/D [1652 0 R /XYZ 85.0394 719.7147 null] +/D [1647 0 R /XYZ 85.0394 685.4653 null] >> endobj 1660 0 obj << -/D [1652 0 R /XYZ 85.0394 716.4024 null] +/D [1647 0 R /XYZ 85.0394 670.7008 null] >> endobj 1661 0 obj << -/D [1652 0 R /XYZ 85.0394 690.9579 null] +/D [1647 0 R /XYZ 85.0394 665.8807 null] >> endobj 1662 0 obj << -/D [1652 0 R /XYZ 85.0394 686.3704 null] +/D [1647 0 R /XYZ 85.0394 605.2907 null] >> endobj 1663 0 obj << -/D [1652 0 R /XYZ 85.0394 660.9259 null] +/D [1647 0 R /XYZ 85.0394 605.2907 null] >> endobj 1664 0 obj << -/D [1652 0 R /XYZ 85.0394 656.3385 null] +/D [1647 0 R /XYZ 85.0394 605.2907 null] >> endobj 1665 0 obj << -/D [1652 0 R /XYZ 85.0394 589.5443 null] +/D [1647 0 R /XYZ 85.0394 597.8763 null] >> endobj 1666 0 obj << -/D [1652 0 R /XYZ 85.0394 589.5443 null] +/D [1647 0 R /XYZ 85.0394 571.1566 null] >> endobj 1667 0 obj << -/D [1652 0 R /XYZ 85.0394 589.5443 null] +/D [1647 0 R /XYZ 85.0394 566.3365 null] >> endobj 1668 0 obj << -/D [1652 0 R /XYZ 85.0394 583.6377 null] +/D [1647 0 R /XYZ 85.0394 540.892 null] >> endobj 1669 0 obj << -/D [1652 0 R /XYZ 85.0394 559.568 null] +/D [1647 0 R /XYZ 85.0394 534.7966 null] >> endobj 1670 0 obj << -/D [1652 0 R /XYZ 85.0394 553.6057 null] +/D [1647 0 R /XYZ 85.0394 509.3521 null] >> endobj 1671 0 obj << -/D [1652 0 R /XYZ 85.0394 538.901 null] +/D [1647 0 R /XYZ 85.0394 503.2568 null] >> endobj 1672 0 obj << -/D [1652 0 R /XYZ 85.0394 535.5289 null] +/D [1647 0 R /XYZ 85.0394 430.7117 null] >> endobj 1673 0 obj << -/D [1652 0 R /XYZ 85.0394 520.7643 null] +/D [1647 0 R /XYZ 85.0394 430.7117 null] >> endobj 1674 0 obj << -/D [1652 0 R /XYZ 85.0394 517.4521 null] +/D [1647 0 R /XYZ 85.0394 430.7117 null] >> endobj 1675 0 obj << -/D [1652 0 R /XYZ 85.0394 502.6875 null] +/D [1647 0 R /XYZ 85.0394 423.2972 null] >> endobj 1676 0 obj << -/D [1652 0 R /XYZ 85.0394 499.3753 null] +/D [1647 0 R /XYZ 85.0394 399.2275 null] >> endobj 1677 0 obj << -/D [1652 0 R /XYZ 85.0394 475.3056 null] +/D [1647 0 R /XYZ 85.0394 391.7574 null] >> endobj 1678 0 obj << -/D [1652 0 R /XYZ 85.0394 469.3433 null] +/D [1647 0 R /XYZ 85.0394 377.0527 null] >> endobj 1679 0 obj << -/D [1652 0 R /XYZ 85.0394 454.5787 null] +/D [1647 0 R /XYZ 85.0394 372.1727 null] >> endobj 1680 0 obj << -/D [1652 0 R /XYZ 85.0394 436.5019 null] +/D [1647 0 R /XYZ 85.0394 357.4081 null] >> endobj 1681 0 obj << -/D [1652 0 R /XYZ 85.0394 433.1897 null] +/D [1647 0 R /XYZ 85.0394 352.588 null] >> endobj 1682 0 obj << -/D [1652 0 R /XYZ 85.0394 418.4251 null] +/D [1647 0 R /XYZ 85.0394 337.8234 null] >> endobj 1683 0 obj << -/D [1652 0 R /XYZ 85.0394 415.1128 null] +/D [1647 0 R /XYZ 85.0394 333.0033 null] >> endobj 1684 0 obj << -/D [1652 0 R /XYZ 85.0394 391.0431 null] +/D [1647 0 R /XYZ 85.0394 308.9336 null] >> endobj 1685 0 obj << -/D [1652 0 R /XYZ 85.0394 385.0808 null] +/D [1647 0 R /XYZ 85.0394 301.4635 null] >> endobj 1686 0 obj << -/D [1652 0 R /XYZ 85.0394 327.3726 null] +/D [1647 0 R /XYZ 85.0394 286.6989 null] >> endobj 1687 0 obj << -/D [1652 0 R /XYZ 85.0394 327.3726 null] +/D [1647 0 R /XYZ 85.0394 267.1142 null] >> endobj 1688 0 obj << -/D [1652 0 R /XYZ 85.0394 327.3726 null] +/D [1647 0 R /XYZ 85.0394 262.2941 null] >> endobj 1689 0 obj << -/D [1652 0 R /XYZ 85.0394 324.3353 null] +/D [1647 0 R /XYZ 85.0394 247.5295 null] >> endobj 1690 0 obj << -/D [1652 0 R /XYZ 85.0394 300.2656 null] +/D [1647 0 R /XYZ 85.0394 242.7095 null] >> endobj 1691 0 obj << -/D [1652 0 R /XYZ 85.0394 294.3033 null] +/D [1647 0 R /XYZ 85.0394 218.6397 null] >> endobj 1692 0 obj << -/D [1652 0 R /XYZ 85.0394 279.5387 null] +/D [1647 0 R /XYZ 85.0394 211.1696 null] >> endobj 1693 0 obj << -/D [1652 0 R /XYZ 85.0394 276.2265 null] +/D [1647 0 R /XYZ 85.0394 147.7104 null] >> endobj 1694 0 obj << -/D [1652 0 R /XYZ 85.0394 206.4674 null] +/D [1647 0 R /XYZ 85.0394 147.7104 null] >> endobj 1695 0 obj << -/D [1652 0 R /XYZ 85.0394 206.4674 null] +/D [1647 0 R /XYZ 85.0394 147.7104 null] >> endobj 1696 0 obj << -/D [1652 0 R /XYZ 85.0394 206.4674 null] +/D [1647 0 R /XYZ 85.0394 143.1652 null] >> endobj 1697 0 obj << -/D [1652 0 R /XYZ 85.0394 203.5257 null] +/D [1647 0 R /XYZ 85.0394 119.0955 null] >> endobj 1698 0 obj << -/D [1652 0 R /XYZ 85.0394 179.456 null] +/D [1647 0 R /XYZ 85.0394 111.6254 null] >> endobj 1699 0 obj << -/D [1652 0 R /XYZ 85.0394 173.4937 null] +/D [1647 0 R /XYZ 85.0394 96.8608 null] >> endobj 1700 0 obj << -/D [1652 0 R /XYZ 85.0394 158.7292 null] ->> endobj -1701 0 obj << -/D [1652 0 R /XYZ 85.0394 155.4169 null] +/D [1647 0 R /XYZ 85.0394 92.0407 null] >> endobj -1702 0 obj << -/D [1652 0 R /XYZ 85.0394 140.7122 null] +1646 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F47 879 0 R >> +/ProcSet [ /PDF /Text ] >> endobj 1703 0 obj << -/D [1652 0 R /XYZ 85.0394 137.3401 null] +/Length 2122 +/Filter /FlateDecode +>> +stream +xÚ¥YKs㸾ûWèª*Bðà37ÙÒ8žñÚŽåd33š‚%–)R+RžÑþú4Ð J$µ•”n ?ôQø±‘ç?âÑ(ˆ\âQæ’Í`ìöŠžIÍ4±¹®_®þöI£ˆD>÷G/o–¬Ð0d£—åWgJƒê\ß]ßß=Þ>OŸþñÛxÂ=ê|£>Ì°³øõöv¾x™›îó|:»{¸6ž~DéÓÓüav÷oŸ*©´¡ÞÌãï/Ÿ¯æ/Ͳí1*Ôš¿úúŽ–°ÃÏW”ˆ(ôF? C ‹">Ú\¹ž ž+DMÉ®WÿlZ£zj§©%\ø¼ÃVœ#‘çñ–±¼ˆø‚m¬ÇײÈd%—¸ÇÙÃÂØF&û]ZŒi>Ý”½›.4htG‹×&ºp¬¹ÔÒ¾‚VN}ïû©fÆ9XņU7\çº]û1mݳb§ùxârê<Ä©ZÌYÊJnz4™ÿ¬d^¦E®Ít²;R„ëR²ÿ +S|á̈™—U¿Ë1Ã×»1%ê‰sÓ¸1ü_âýÛ&ΔÏq¾w¥¶\+š4°ƒ>8WéEº$Ä£: +‰"ïÀà—Xw“uƒCÔƒ’Hò’Í5€CÍUã (
pRmápª»[wƒCƒƒjÕ8èvƒƒ'!,æ7˜5GºÊÓ|…é¾Zšÿ'î3HW‘î8w® Nü×8âŽÌ2T:Šqá<ró*wÆêù(Æ)¥ý˜‰ˆP7º„™Å5€YÍuÄ,¢˜
©¶0;ÕÝ™»'7.‚Ý›,Þ¥ß(åI\5ÄúûŸ"¯]®Š«}—Sqð°íUsãU÷òGZv; +p¹™Ll«ežúï…ÔƒÈyx¡Î³¹ú!m¸H}o +ÌWP%ºQ…A=-Í@Rà:Mb;4ظýØp¸`ÂØX\ØÔ\6—¥AÕ6§º»±±u7õ¹[×…ªÕÔçÐÖL5LI}ãE@;ñ"M1^df/B±öåúó¼Ú°ùT¤yuœµ˜?§}ÊâUÎ.»|±ZÇĆڊ‰µs~)²w¼;«ÞgC]$ëìPµŽ„Ž¾}…u£<1PÈ/¼t“°¹úOLÃÕœ˜p¨T}<1gº;OLKwOUzzaÐ>ù³BëB®øZ\ϳéØóœå™S$}*v›¸3ú°ò»mçÀqº_íËê«Ó‡±‰€á2ª!áA¹Gýæ‘'.Î]rsi$Ívñ[ÕULSHÊ.Dæj ֬ЫgA¾»Yi¬ +ë˜èÊÿ€\åºØg†ªµªÆ«ÄïïûßUQg5 %©!¹Ú>Zcn„½©SŸ!Ñƺû<3þ$)6“.|¶qžjéŒ:¯ü≀Æ2-“,N7:‡ê¸jXóñBçç®:s%võrá‹(+d-K¢øpuüa„ÄøÉÒ7YÂò°§O+|Ëô'66E^Í\8ïõ¬S¸lvlԬسW¥´^²“©¶~Ö3¯f*IM=ëÇŒ²38Ðó LPxuµbá¥ÂÎk±7±âúîav”ëB±ê7r)‰X}y“;åF½Ïì<„RïÂõËæ:O&°lâ(LgÖŸGµóÈ™ÚÎ<ÒÒŠy„zƨo[Ê^´5Vć9Oñ>ÃIÓ.\œHºSá¤É»ŽÐ¿O÷j"s¡âÜvéj“ˈ!lÀ
Õß+Ô¼ '¸ˆàÇ%L8 üöiñ}£ÌëºpØbXWŸ,ŠB\ÛB¾ÆeUlM ÈÞLÿŽ#y†‚43OøÜSºN®tM52…kE’ÂY.{‹8¬ê£¼hs¬ÿïÿ¥¬ê% "컊p°¯‚³(µ—È=[yýÖùÒÿš`£endstream +endobj +1702 0 obj << +/Type /Page +/Contents 1703 0 R +/Resources 1701 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 1589 0 R >> endobj 1704 0 obj << -/D [1652 0 R /XYZ 85.0394 113.2704 null] +/D [1702 0 R /XYZ 56.6929 794.5015 null] >> endobj 1705 0 obj << -/D [1652 0 R /XYZ 85.0394 107.3081 null] +/D [1702 0 R /XYZ 56.6929 749.4437 null] >> endobj 1706 0 obj << -/D [1652 0 R /XYZ 85.0394 92.6034 null] +/D [1702 0 R /XYZ 56.6929 749.4437 null] >> endobj 1707 0 obj << -/D [1652 0 R /XYZ 85.0394 89.2313 null] +/D [1702 0 R /XYZ 56.6929 749.4437 null] >> endobj -1651 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F47 874 0 R >> -/ProcSet [ /PDF /Text ] +1708 0 obj << +/D [1702 0 R /XYZ 56.6929 746.6461 null] >> endobj -1710 0 obj << -/Length 1567 -/Filter /FlateDecode ->> -stream -xÚ¥XKsâ8¾ó+|[S5h%[~í’e&K²ÀÖîÔdÆPÅÛÉ°¿~[ÆIÕ·¤~©¿n©10üˆá¸È
¬ÀðŠL#JzØØÀÚ}hžAÅ4hrÝ,z¿ÞÙž Àµ\c±nèòö}b,VßÌ!²Q4`ófró0y¼Ÿ
Ÿ~ÿÚX6Ÿ±ƒ‡Ó‘Ìÿº¿Ïc=œ‡£ÉôXHà¹6‡OOãéhòZ -¸ž½Ïûߟ{ãEívskÛÂç½oß±±‚~îad¾c¼Á -»ÍH5vá@õíƉ2Oa+¡aÏ®Ï4ÝBV˜<z‘çŒx) …ŽswØóÍV^.ñ|Ø -endobj 1709 0 obj << -/Type /Page -/Contents 1710 0 R -/Resources 1708 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 1592 0 R +/D [1702 0 R /XYZ 56.6929 722.5763 null] +>> endobj +1710 0 obj << +/D [1702 0 R /XYZ 56.6929 716.7581 null] >> endobj 1711 0 obj << -/D [1709 0 R /XYZ 56.6929 794.5015 null] +/D [1702 0 R /XYZ 56.6929 701.9936 null] >> endobj 1712 0 obj << -/D [1709 0 R /XYZ 56.6929 769.5949 null] +/D [1702 0 R /XYZ 56.6929 698.8254 null] >> endobj 1713 0 obj << -/D [1709 0 R /XYZ 56.6929 771.5874 null] +/D [1702 0 R /XYZ 56.6929 684.1207 null] >> endobj 1714 0 obj << -/D [1709 0 R /XYZ 56.6929 747.5177 null] +/D [1702 0 R /XYZ 56.6929 680.8926 null] >> endobj 1715 0 obj << -/D [1709 0 R /XYZ 56.6929 741.6995 null] +/D [1702 0 R /XYZ 56.6929 656.8229 null] >> endobj 1716 0 obj << -/D [1709 0 R /XYZ 56.6929 726.9948 null] +/D [1702 0 R /XYZ 56.6929 651.0047 null] >> endobj 1717 0 obj << -/D [1709 0 R /XYZ 56.6929 723.7668 null] +/D [1702 0 R /XYZ 56.6929 636.3 null] >> endobj 1718 0 obj << -/D [1709 0 R /XYZ 56.6929 709.0022 null] +/D [1702 0 R /XYZ 56.6929 633.072 null] >> endobj 1719 0 obj << -/D [1709 0 R /XYZ 56.6929 705.834 null] +/D [1702 0 R /XYZ 56.6929 609.0023 null] >> endobj 1720 0 obj << -/D [1709 0 R /XYZ 56.6929 679.1143 null] +/D [1702 0 R /XYZ 56.6929 603.184 null] >> endobj 1721 0 obj << -/D [1709 0 R /XYZ 56.6929 675.9461 null] ->> endobj -594 0 obj << -/D [1709 0 R /XYZ 56.6929 645.9962 null] +/D [1702 0 R /XYZ 56.6929 579.1143 null] >> endobj 1722 0 obj << -/D [1709 0 R /XYZ 56.6929 621.6566 null] ->> endobj -598 0 obj << -/D [1709 0 R /XYZ 56.6929 538.1235 null] +/D [1702 0 R /XYZ 56.6929 573.2961 null] >> endobj 1723 0 obj << -/D [1709 0 R /XYZ 56.6929 513.7839 null] +/D [1702 0 R /XYZ 56.6929 558.5914 null] >> endobj 1724 0 obj << -/D [1709 0 R /XYZ 56.6929 479.0839 null] +/D [1702 0 R /XYZ 56.6929 555.3634 null] >> endobj 1725 0 obj << -/D [1709 0 R /XYZ 56.6929 479.0839 null] +/D [1702 0 R /XYZ 56.6929 540.5988 null] >> endobj 1726 0 obj << -/D [1709 0 R /XYZ 56.6929 479.0839 null] +/D [1702 0 R /XYZ 56.6929 537.4306 null] >> endobj 1727 0 obj << -/D [1709 0 R /XYZ 56.6929 479.0839 null] +/D [1702 0 R /XYZ 56.6929 510.7109 null] >> endobj -1708 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F47 874 0 R /F21 654 0 R /F14 681 0 R >> -/ProcSet [ /PDF /Text ] +1728 0 obj << +/D [1702 0 R /XYZ 56.6929 507.5427 null] +>> endobj +598 0 obj << +/D [1702 0 R /XYZ 56.6929 477.5928 null] +>> endobj +1729 0 obj << +/D [1702 0 R /XYZ 56.6929 453.2532 null] +>> endobj +602 0 obj << +/D [1702 0 R /XYZ 56.6929 369.7201 null] >> endobj 1730 0 obj << -/Length 1914 +/D [1702 0 R /XYZ 56.6929 345.3805 null] +>> endobj +1731 0 obj << +/D [1702 0 R /XYZ 56.6929 310.6805 null] +>> endobj +1732 0 obj << +/D [1702 0 R /XYZ 56.6929 310.6805 null] +>> endobj +1733 0 obj << +/D [1702 0 R /XYZ 56.6929 310.6805 null] +>> endobj +1734 0 obj << +/D [1702 0 R /XYZ 56.6929 310.6805 null] +>> endobj +1701 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F47 879 0 R /F14 685 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1737 0 obj << +/Length 1917 /Filter /FlateDecode >> stream -xÚµXKÛ6¾çWh^ bøE©§æÕfdS4[ôìAkÓ¶YR%y7FÑÿÞ)[^9FQ¬ÉáðãpÞ”˜qø³T3®²xf²˜i.ôl±}ÆgkXûù™ð<±VLÇJÁdb5Ò*e:•fƒ¼º}öâ')f’³$‘zv»ÎJŒa<›Ý.?Í_6–Å׫Hj>uuwû튙IÀ]N0,Q:q;ÞçÕ./‰¿É׶öˆ˜©8‘~O¢YÂuêö¼bâ*œóù²X#?2(ÃT’7ùÖz5ËX–ÈÄÃ(ÁT -2#nvç~–ÒÐèÍÍG”uýe×Ðx×eÑï‚ –i‹“© Ë|ÜWuÓîÏÞÞ:M8 -4‹„ ©)½SêøŒQRÎàö;@8›¨ìè†Á$×pÏ´õéÇ涽óÓèžî¤•$¸a:K4œ‹›óå²µ·Êè,¸x+áùÌŦÒ,Mt€\”ù$ ÌXššìpupU”¶L>Ò°TrsŠùåÀl&0#…¾®Ót
^{šºí¿;§ôøϋžT*– ®Nñú‹xý¾ùx_/â¡MáÅL&O콿÷i³Í?Üáøb÷ÈgqÆ“Sèx%w.oD -3ÅåØ>Ÿ:ð¢2Âعn˜ü¹³í¾nzÆØݹˆWF²ØˆÿñÇç#~àG|´9/š–,É”ù/¢A|C´À5m]Ö÷y´ 9h6¨õBÎ}óöãëß®½½þp3pR¾Ä‡”ÿ´.(ŠGüÌ5_ÖÛ¼¨ ýÇ|^T«ºÝæ}Q#Aeóu{%ÒyÝØX…gêh-§égΕýZÜ—–È}]—´X¶·-!¼Z'U Xw1íH”´;v)næ×=Qáx”«#nÜæ:ÜeäÏTÍ€U ±ZÂ@bñìš2ß{r¿±DΫîŽÔ¼÷Ûœ¬ž‡Æý®ì’–Wt•í ÝItTnGjÃå<ða†PØ%\YÃì}Ýõ¡Ì_ËéJ%ò˶¨Š+1ïú6ïk'<wp I6Ô™3.=JBŽïkìé’;°k·©k=á1Z†ÕmGK÷v‘£n¹^ÑoÑûÕà%Ô^€\óç°‚òÓ=„;ë‘¡g¤ jk‹`®qÁÍîw×7»ýGðù°Mû´ÉAíüТ‡‘~7ùƒõ[°p£Õ®Z`LäåpX³šP¸Âl¢µù¶Âc–Å*Ô>²sÌÒ,ÓpÇŒc(â_–ý¦Þ7GÅúL¥.™VB¦ô<¸JÉy…1^–{œ9u/‰þXô¢-êí´•EeiBb½ÛÚªïÐtZ‚q‰;/»š¸6yçI4¿Ïû…‡ÜÖKå쌿֔jœ’R(Çn?¤Š˜|IÉ#>2(äZ„@êzŸ#!Š³C¦’¥u¹%™¿$Ú=ÄÞŠ†Ý.ÝîiR{¢s`<c¬‡z¬OrÞ„Û¼X7$̉ˆnZL‹Èo %l,fÜ”»tò´È›Œi{;F›i§2*“ž…Î'l—¯y]<Ø -oŸ¥óß«²øb‰nó¶,\œ -Få–¨eÑ‘?â-« 'Z3!EhM_Ø~ñLuùrX -ï$!ObxQW« ¹©ÃŽÇY0Gêÿƒ‚,TÕgÌF£ÓˆÄzàóÿ! >¿É…Ås{íáûœZÏï/æ`azzXÇÿù)ÿÁËÈ÷ê›IsN’’S%M]ç;* :Çjg=[C
D©»¥¥¥]å£PÍ€I îæ;ëM ÏBmz(ò)?€· 0ßÿõîÃû·¿`€×.&SÅ’4‘ƒ¡´«ùí&\•’òñõÓ!ÙÈyµ'ÊÁ˜¸É×™Å,RÏ…ë©É󦌷ÙÕuX<Ÿ&œlÒš·®#„s}C¿Ô†Âàõ;ú¥Ï®ÇÅ\е†X,ó†&¾Ã¨¿××
•öÁ–D£¶Þ#»C@õ±IçoêŠN–?câõxÐÛ…×ôȼÑÀ4Ò»ïÝN='c"‘Á»¢Åt“zHyK+Ÿß¡•pétµ÷DÊe‚òŽDFÃ6†ÔŒ4¦Ê7—aßÄ3ÃCN¯ïð=bB >?–J¨Ãë -ˆ!íOHƒ‰ãú&äl Bï+Ý‹’§ã*ˆŒ¯ßå›Ç!GbI¤. ¿ç5ƒSwÁ¿ë&ô·ÎYpè…¾ŸÏZ†Q'Èž%:ðÐ÷ÓÑ7
ž°Tf& +xÚµX[Ûº~ϯ0Ð>hˆáE¤¤óÔÜÚì²)š-úìƒÖ¦m!²¤#É»1Šþ÷ÎpHÙòÊÇ(ŠÖäpøq8wJ,8ü‰E¦Wy²Hó„i.ôb¹{ÅXûÛ+áy˜N”‚ÉÌj¬UÆt&ÓE| +òîþÕ›¿J±œ#õâ~=žeÒ”ñ|q¿ú½m[[¯ÊŸ7±Ô<zwópÿ+íJXš¥wq8!eFiãv|.ê}Q[ll?î S‰‘~ÑÌp¹=‰ç<Z•äG•2e‰qWì¬ÇQ‹œåF£SÈŒ\¸Ùû]Ê”Fî¾Ò jšû–Æû¡¬ÊápL°\ë X"˜Ì]æë¡nÚ¾twxõñ~Ô©áL(Ðh":Wsz §ÔÉ£dœÁíw„p6QùÉ
ƒIF®ñž´õí/½ížl÷à§ñ#ÝIŸ*Ið”éÜh87«Ug{o•ÉYpñ,QÂó˜ËL¥Yft€\VÅ, ÌY–¥ù9àú*ຬl=š|*dÊ2ÉÓsÌÿÌv3Vèë:Ëñè5°§mºáO—4ÿvUØ‚JÅrÁÕ9Þpo8´ÿÞÏ«xèDsx “æ…½Wá¾mwÅò—¼õ/?ìa9ç,ɹ9‡NÆ‘ypy#V€œ+.§öù†Ð•ÆÎuÃä·½íM;0Æ.E¼J%KRñG"þârÄ\Óˆ·—EÓ’™\¥D´ˆß-pMEÛTÍcQÅ-ÆBŽš
j½’s?|üúþ·¿¿ýr7rOR¾ÄÇ”ÿ².(ŠGüÎ5_5»¢¬!ý'<*ëuÓ튡l òhÓ݈,jZÛ«ðL=4ýι²?ËÇÊyhšŠV +ë.¦‰’vÏnbÅÓèv *rõÄÛœC‡»Lü™ª°*"Ö+H,ž}[O¶–ÈEÝ?ÃqZ~›“ÕóÐxØwµ]Ñòš®²;£[ ‰nÊíIm¸|„‡#>ÌÐJ»‚+k˜}nú!”ùÓk9])# ¿ìʺ¼Q?tÅÐ8á¼ïíŒK€0ùXg.¸ô@Ê„?48Ð%÷`×~Û4(ºáG1ZZ†Õ]OKvY n¹YÓo9øÕà%Ô^€\ÑkXÈ@ÅùÂõÈЊ3
RP‰µµC0׸àf÷»Úý€þ#xôlÓ½lrÐC{?´è!D¤ßmñdýìÜh½¯—E5žÖ¬g®0›hþ¾Â–'*Ô>²s²<×pÇœ¥iJÿ¶¶Í~³9*ÑÐg*uÍ´2¥çÁÀUJF5ÆxUpæÔ½"ús9l‰¶lv;Ð~\•µ¥5 +‰Í~gë¡GÓi Æ%î¢êâÚ½'Ñü±–r׬<”³3þBXSªq +0 ¤PžLÝ~L!1ÅŠ’GrbPÈ´Ô>GCgÇL%+ër‹‰ÞíboMÃ~—î4i<Ñ90ž1U‰C=U‰'9oÂí-^¬æLD·¦Eä7Iô¼µ50¼,òi΄0‰7d¼÷*™Ð +;‘ +¢ô]–è„Kš‡²§|Á¸IÈŠ/(yÎàõ!¯)PÂ[Æó<—UåBØCQú +o§¾÷Pcµ·ž¥>"†ÞÑÒÊ®ŒžÖQ¨™ž 5P~DrÍ›ÏC‰z*‹9?€ww¼àÏÿþôåóÇÿ¼a€×-g3ÅLfähg¨ð*ºß†«Rn>½~6æ|â C¹¨D97ù2"ó„%BžÕ®ç&/ÚòÞ*dT×qñrn˜q²YkÞ»ÆJÍíýR7 +ƒ÷Ÿè—¾¸VsAOÔb±*Zšøš£á*ÜдVÙ'[º{ìÕ'i},©9B:u\þŒ™ endobj -1729 0 obj << +1736 0 obj << /Type /Page -/Contents 1730 0 R -/Resources 1728 0 R +/Contents 1737 0 R +/Resources 1735 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1592 0 R +/Parent 1589 0 R >> endobj -1731 0 obj << -/D [1729 0 R /XYZ 85.0394 794.5015 null] +1738 0 obj << +/D [1736 0 R /XYZ 85.0394 794.5015 null] >> endobj -602 0 obj << -/D [1729 0 R /XYZ 85.0394 769.5949 null] +606 0 obj << +/D [1736 0 R /XYZ 85.0394 769.5949 null] >> endobj -1732 0 obj << -/D [1729 0 R /XYZ 85.0394 573.0107 null] +1739 0 obj << +/D [1736 0 R /XYZ 85.0394 573.0107 null] >> endobj -606 0 obj << -/D [1729 0 R /XYZ 85.0394 573.0107 null] +610 0 obj << +/D [1736 0 R /XYZ 85.0394 573.0107 null] >> endobj -1733 0 obj << -/D [1729 0 R /XYZ 85.0394 538.4209 null] +1740 0 obj << +/D [1736 0 R /XYZ 85.0394 538.4209 null] >> endobj -1734 0 obj << -/D [1729 0 R /XYZ 85.0394 504.6118 null] +1741 0 obj << +/D [1736 0 R /XYZ 85.0394 504.6118 null] >> endobj -1735 0 obj << -/D [1729 0 R /XYZ 85.0394 432.7569 null] +1742 0 obj << +/D [1736 0 R /XYZ 85.0394 432.7569 null] >> endobj -1736 0 obj << -/D [1729 0 R /XYZ 85.0394 303.3232 null] +1743 0 obj << +/D [1736 0 R /XYZ 85.0394 303.3232 null] >> endobj -1728 0 obj << -/Font << /F21 654 0 R /F23 678 0 R /F39 858 0 R /F53 957 0 R >> +1735 0 obj << +/Font << /F21 658 0 R /F23 682 0 R /F39 863 0 R /F53 962 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1739 0 obj << -/Length 3967 +1746 0 obj << +/Length 3971 /Filter /FlateDecode >> stream -xÚÍZësÛ6ÿî¿Â3ýPe&b$ÀÞcÎy4q§qr±;×N{h‰¶8‘HE¤ìúþúÛÅ. R‚¢tîËÅ3!´x/öñÛä¹€?yžåI^¤Å¹)t’ ™ÏVgâüêÞœIn3õ¦ÃV/nξûA™ó")ò4?¿¹Œea<¿™ÿ6y‘ÈäŒ &¯.ß<›¦y&ÒÉŇ¯¯^]þ¿3M “wW?_üD´Ï -höæõõ³ßüxöú&,f¸`)®äóÙoÿçsX÷g"Q…ÍÎá‡HdQ¤ç«3©$ÓJyÊòìúìŸaÀAëe€Iªò4ÂTžK™Y–ŽXI®RåXp}ùîÃO¯i_?_æpOÐS
x'Ρ:Qyn\—jÝ?ëY¹¤uóÐÎʾnúÝÞñ8r0°$†nœy}™LšD+q›eÛ~êhÈeý©úž:¨bÐa*¥Nt¼›J›¤ð/Œ>ÍáäþÑU›‡jC?šrUQ –_E¦ŸfIaL>ëqý¥Ðü£—‰‘2?Þ$¹VöÈ Q£é°•; m#"ZáÔ¼ø½i‹4É2«¿<ot8íhÇ…I2U˜ñ´52Ý—À®ÔÌ8$µú^~ šr>'ætÜÎþX_Hí[¢}ÞV›§gRÊ ¨š*ŠÉÍÂÏ>+j{ËýÝo7÷ƒ>2{ÍMæmßWó)rNU”¯(!Õ¬^9¶jÒ´½_øE{T<ŸÂùr¦ŒçS<ŸšÌÚeÛLçÕ²^Õ0ñxTØ™Åä_‹Š[o Ðm×ëe
í(fÃQÆ$¶0’Ua' {¨l’[]p³Ò-÷ežd6웬ÞývU5=ë-+WIŸEÛõxZÏ£ÚbldqZ{•_2sª]>T<O¿(yf -(ÁáÊÉ]K‰äd¢nîwbní¤F‚HÜq“6ÂÊLž@m>ÍJ•Ržfe:f¥¶ÄJø®]¯ö¡žWó™ØL§'Ù(óœÛÌÚ¦Û.û.bü`Ám?5ü®êgßmÃètÜØK@e3§E#ÃëŠw@©ƒâ‰8Æõ˺# §¶tp ±)Õy"S)Ç|ºYð±QÛõò‰~Þ¯Vþœ«#Ǽ',W붙wc9ž×ÝzY>Uó䘥Î,x?™/[êa«ã–:´Â=ºEïMjE’pß_œÔ7:œttr6ùÓùxÒº;ʺön¯ÊkãÖf#êŒÔo¾Ïé0~t•œ1øåŠ[o×Ç™
z§Á8`ö Õ˜í[á¾½÷Ž2ûK“?iœÙÃIëfˆ§wjRH@ŽKPr«q%Çtø’SsÅš›£?ok*̉ú{š, ¼úÕyÁçTqÁßw¿páúò
—@Ë“˜‘+@õ¤ðÆàÀIóÄJ¡½iqƼå
”
/û¡\Öóáfœz+è^ˆ,«7Nõ5fXö–…:¹@-äÈÇ<–wœQk«ü8ó±^2’]WðE«‘[Diß®ÙdµlŽJ†º1=Jª -·¼žn
°õw£Ð‚¸Š'ª(×ë -Tã„Eg¸-œñâ´i -–üü5r&1ÚúnY‡ƒ@¨RíáßOâ¸B˜JƒŒC-B -<yuWèÁ¨¼’ôÙ²tG -ÅßE&.¯¨Lj MݱÀAA¥¤ªš›·€$6õ|î08üFÆa>ªVÐ")dêw5Åõ*×éX¯b–Y餰ÂÃJÚA|B¼f2o™ýªÉ Ã2½p{ 30ØÁÙ‚ms¦ÀþK3>ù’íåÛë=ûõ¶êêv3^ÜÃ7|ùv¯ç˷ﯯ^ßDû&AüöN5j¹ -£½;˜Æà*Ì4¸Ý[.ˆ0@1>U]Äöç -PEqÂöÃÒt8L>xu¶æáoËøJ3µs®$Uó®¼tÊæ%~„ÆD 3"ƒçØõQîúŽ(ˆªðË!ÃÌ+$\LÑ+ø*isµçtISôÁ²Š‰] -bç¥ó®^V¢î›[ˆ3SaæÖj¯ˆax'lTôe
áZÓ¡¤O³]¹(nC?g€/ì‰X °Z錯«YS@ËšŠg|]"ǑΞÔ=£ðH¼Ûl°=éív9'ú-›u -!g(=¢Íå:.=ÂD°î{Ë
×ìb`½~X§nðÝT8NÔÔ°MÕÉx:ÚͶ£˜x¸ìY»ZA7EFú±câL p»0›WIJü!PS ðZ3íz¨ô -–ÁMÐþQôAåGÖ)ÆøÝ’Ö(:r÷#ÆƉ75v:_Ç/¼sº*FÓ`aPÃï·»(i~ºÌC³çŽv¼B§ÕŒû¡X;ŒO|Ázâ‹K#ý¿eŠpŽS÷[¤پKå]³¸óÌa‚É>ê¼D.½v8„aÛs*X‚â%I±ÄðIÉtÒoʦÃýcJÒ%[£;4)º„ -¼aíô¸š\íË(YóÐ!ÿNËi¹–3=ô«¤Y$Lƒ2À0Þƒi +xÚÍZÝsÛ6÷_á™>T™‰X€ +ç\9æ=5`½Z7õ¼êñ¼j×Ëâ©œ'Ç<uf!úéÌ|ÞS÷G÷ÔqîÑ3½·¨I. |vÑ0èpÑÁÉÙôOçÃE«ö¨èš»½®`[ߘ
¨32¿ù¾¤ãüM´U +Æ—K½]6ØçtBؽQŸv…ûÑ{TØŸ[t'ìýEÇ…Ý_´ªç€x:o&N*ðR‚–çÆ·¼ÐáIAÍ7+N‚þ´¨1'êoij°€òêŸSÇ?ßýÌëË7Ü+OÆœœÓ“"8ƒ# +“mà +[Á6ÄÚé=¨ôœ>QܼjÃOð`ì™xSÈó×’øEˆL·eÉPÜš÷ýv—"õrO_v¨÷bÑNV±êl?TkðI.ØOrñ5¤/ ZÆÅsœêñ %Lší«°T¡Ê5\ +)¶;) ~cSÔ-î둾Ò:ºC“b<ˆÈ'ÿÿÝbÎN¾rv¨‡1ýÉA+#¯Óîþ;Ì«Œy•‘!p‰†õ#Æó$@ À‰S‰<8v¼dÚEm˜ù²£¸rÎòz D)û¨zÇÑ㢢0,#ÅTdWòkOýâòê»~ ßGžÎód’H{Þ¨Ýâi\<å•O.ð?ríd[/)‘3é‘Ð"]ùüNiÿ8r\¹=<®Ýº±O+5ÜËuS‘\E™w‚z¼çûç.Û”:·ç*½^Þù0ƒÑM~ð15MûˆÑg{ØõD]>
¼£9Ò"“(‘à(P.~þîCB$º~@bX¨ªg´ÖW|ò žiß=dϧ[0eVþõv˜kÊ^ÕWèz>V RIžŠì„†ƒVíÊcã¶ì"z)ˆ`$^RTÜmþq52¬Dd=ã o1 ØY,*í‹èʱE蘈.L6[õ}Ù†¬%ä„ý£:ƒ5z³§!´ª¢ÀU¹WÒ…ÈZ…+Øå3¾ëÄi¾æ(yýãÅñÒïcѹ?d8ŘDùÞ4””>1;‘þEw°=ø¼é§qûU:Û‡†Éw«ÃŽõÎݪÝ5Æ1w˜Q@ŽG’¤Cw+L +œk,]IvfRqé`%ýK»q—Ž8$ÏNW`r +0+–þ*J÷,ø‚¤/€D)ïãúµI$‚éAðe_'œÿ^fĪ0ÊĪ&¼)ÓDªŽ©ª§¨XI±Y£Î7K2mÌàæ–a×+ƒë»j-4ÚI±{!p}ïo>!òe]¹»é-g]õP.Ãw"0 +”Ø¢/Û†H½m„ËH Ž0]um¹¼#"‰*ß+—R‰ÊõÔ¸9.Ã;ÈGtzX†«¡à ±Jôtäj£ ;þ۱ˣ,DŽÅª˜C¹—)‰‚ˆ˜:¾—èuÝÐgØŒé9|ûîâåôÝ«l,§ÌÒw"¨#KñÐx¢@u”'jáÑñwÞFÔÐ
ñ`ìA<Å>s"Q2ïC=Lbò +œÀ4d‹V ½K²Üì]½„Á…s¯I°Måz°“âcÉÝ‹ÐbKöýãjmÁL8¥×BªÃ>]ÁãsZVM!äm˜¿§ürK?ŠvÇ€oxóEÉSy¤·‡‡ª|0ÆØ8È9÷]Wá +êyŽvQ.—_3¤¼Ý5TÉ +weþ>Kô@yðÐd·cá„` endobj -1738 0 obj << +1745 0 obj << /Type /Page -/Contents 1739 0 R -/Resources 1737 0 R +/Contents 1746 0 R +/Resources 1744 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1592 0 R +/Parent 1589 0 R >> endobj -1740 0 obj << -/D [1738 0 R /XYZ 56.6929 794.5015 null] +1747 0 obj << +/D [1745 0 R /XYZ 56.6929 794.5015 null] >> endobj -1741 0 obj << -/D [1738 0 R /XYZ 56.6929 752.2728 null] +1748 0 obj << +/D [1745 0 R /XYZ 56.6929 752.2728 null] >> endobj -1742 0 obj << -/D [1738 0 R /XYZ 56.6929 504.0748 null] +1749 0 obj << +/D [1745 0 R /XYZ 56.6929 504.0748 null] >> endobj -1737 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R /F48 880 0 R /F53 957 0 R /F11 1293 0 R >> +1744 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F48 885 0 R /F53 962 0 R /F11 1299 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1745 0 obj << -/Length 2766 +1752 0 obj << +/Length 2762 /Filter /FlateDecode >> stream -xÚZQoÛ8~ϯð£‚ݨ¤HJâû6Ù"‹nšÝ¤ÀÚ<(–ì±¥¬%'çCIQ²$îjz8ä?~œÒ¡ÿè"!a’/ÉCA¨X,·gd±†¾ÏgÔè\X¥_ëãÃÙ‡_Y²¡Œ£xñ°òæJC’¦tñ.ïî®o¯nþ:¿ˆ >†ç‚à÷ËÛo—_Pvw.£àòóõ=|‰@‰*µ˜W7ŸÏ~;»~pÎøS”'Ÿ}$‹üþ팄L¦bñ_HH¥ŒÛ3.X(8cV²9»?ûÃMèõê¡c -€¢P”P¦RÂdjµ"TòѤ2$2eFG-vd"2‘XõñT¶>Žc«Ö‚WÛ¢jô·¬p“Þ<”„›!U¶Ø–uµ™v;-7ª¡sÓÁ´Z\Dø•¤pˆ8
cB¼?¾]ÿy.DðOtäëÝÃÍ×Ûû‘uèQ&’r=./×c€%!hbüè6¦Pë¤@õ‘Õ~û¤ ¢z…2Eý¶e]™!ïÏå9
–Ïf‚•šrU,[üŽ”Ñ{f—•<—vЦ®_ö¯Ö픵Íòˆ5“ijg”ê5û
l’bÝ…]œ!584¯›ì€Œ&qp_oÕx–âÂX¢&lŒ¨)ZÓ·Ã>cʲ5¶ŸJMPÒ+bÖ3ÖA}Ϭ`wžð@N‚ÆÙÏ‹¶ØmËÊ|µxÀ à3 -jD@¤FÁ -IJ²Ô‚ª‹Â[dÛÎ60wU¬UÀÖÓ;à[‘UÛAªùª½Ð9$Df]_Q‡ŸÆ%")8Gé€ç
î' ¼e›½ -YŒ2혒¹ ¤„›ò¥@±öQ7,¯U¿:;˜Üá2Q0°ã9{\Õ»íyh&)†<¸ŽüíÛœ)ã4Ž\ -°†Ñ.ž½|™'‚÷ãXsÕ±ÄÿÇQéCB" ¬1 -¬ñZÍ(]øZºRáéH¥â´ô*¿Wõc»|¦¨“–Ö±éó8t`û[£±âÁ÷¼ÆFU·Ø€ŠåQµàÀ|ºCÑûsQaKC«Ù©Çd[3
–®7™Ý qq•ANÁ/O¢¬÷;üZ6øÙÖÎ.šývug¸žK18ÒûjS4vë*ü¼üë×?MP6ÁûÆIlÐT…GãÇ_èhº°^š©læ€æ2kLÏðCã¡{êªÂ´ÒŸ‹½)E,$‘ˆOðÈÓšá‘Õr<z[Ñ(‚ýN#1oØi[ЈÝXÚ74‚LŒ4‚ÒˆK#n`S
C#N}©1H#•Ð;¥0PWÇJžm ÄT:VjµCÕfÿÂvkÂè <
Yê*Pÿ¤
s
#"©Q,MÔä
e¢6¼Ïdò•åÛS¶|yϺ̥I²}ÍÚò©Ü”íáœRªâ£O‡ÒøEüm©þ·… -ÝBSsUTxž6Æ^g¨·3&D.!Ecx‡Þ>VÔÞ½BeÂeÀúû“²ó» nA±(Y<Vê›$^øçj
8U“gŠAlI ÌŸ)_kúL9-&»UŒ†ÉYã]˜<²>&{æujV!I§fbjVLͪe.²·£ªwTõä…¢u…Db.ˆ£#Íjª0ø4ŒÆyú´UÝ£´…œm!eÍ%otç'è…
'´»mÅ?¬æòÙËÆ=„ƒÀ+ï@S發° -܃¦¾PB,ñrì*vý<5
1QOÔòÄžÖÄVËA<š02!|ÞºÓ:6ßÇ7¦a"hÒ·UØ׉¬»¯´(RlÓøPÕÕaÛ“#W]£HúEò8‹,zQ…PÃœ€Øך†Øi9ÛYVW›Ãd¬œ5ÞÅÊ#ëã±²gjfðr§Jë,ëjs÷ZéÝ2Þ1±ÄŸ‚ÂìtžÖtV˃nµÉÖÓÐÍ÷ ZŸ€Î7ùÓ-–°H÷Â?ØñL &ü'þQPIÆ‘8ª§5ªÕê¼ËçA3î:´>ªoka!̵ZØ×4Eûˆ"¬wAty…•ã²=ˆ«¶\bWžµ™Êu¨ðTšItq*„‚÷|Gܼà@N.ìX÷ΆžªÝ°ïYWxÐÈf®:úr›Ù×gH ÝC§ú¢‰ &ÓΤwgSÕ¨ˆ
L8%ü=»“àioºqaÐÈÌõ¥5ZÐÇ=5\7¯ë1ÏGÚ±¦ÿ“ÁÉGõ°)Ú¢‚jx’ÃTDaš&'ît¾Ö4‡–ãðržÃ³Æ;Yçpϼæ0°ÀTÐÀŠ ¥†Ãª…Ÿ®ðSqxù\,_° -›ÉÂYÃÝá‘åñžé+üÉpª84¿(>ê§/—÷÷öA¶¨¼ßá\‘ètMmä~™ +xÚZßoÛ8~Ï_áG»QI‘”Äö!m²EÝ6»I=´yP,9jKYKNÎÿý
9Cê‡%åpw(PKÃ!gøñãÌ +_0ølj +˜Ðrk(ÆÕbµ;c‹'hûxÆIçÂ)]tµÞߟ½ûUÄè(Œ÷ëÎXIÀ’„/î³oËËÛÛëÏW7_„Š-ß犱åï—Ÿ¿^~BÙí¹——¯ïà5R,%nÔ"¶¼ºùxþpÿÛÙõ½w¦ë0gÂxò÷Ù·¶ÈÀïßÎX t¢¯ð®u¸ØI%%…p’íÙÝÙ~ÀN«í:€I ’0A c(Dšu¾É÷f®zÙlÒÆ<%Ë¢FÉ߇|_ä¾”yžÕØÞT(úQV¯®oŽM?ò#JÒ’ú¥Û§j_4›õ%+Ú[yÌ‹ò už¼BDË›[ßß|¾úÙ)꾃YUæ4ÈÑ, rÁy • +íôž÷ç<YV/EF&Ø2}&áó¾H›Üô x(ÎX a03†™*uÑä:`:¤c&;2„ŠA}:”€¥¢È©5àÕ./›ý-Jì"t§Kj&©K™î +ûþµ²Æiù‘³ù*Ï&z<o4x]<‘¹ïL±‘
|’(Ih;ü4¶qÇ.*À0&ï„Z;ñ¤ëaÖ.œXÄû,2Ž–ÈWÁà ‘‘ì¯'Âdͨå=q“IØ +fžLA¤FÁ +ê<æ@ˆÂìcóf¢–Q±”C³øðõê–¨Žk5Øчr›×nåJü½üë×?)&Sì¾ñ3Éb~¡¡n£zAC¹Ä«´¦(žâ…öTe‰Y¥?0ÖzS4 +EÀB½A£ŽÖœ–§ÑËê„E!,wªyÃ^ëÔò€EØ&’¾id‘ô,bÄ"éY$=‹˜c‘ä=1Ç"Ùe‘J ã9°…SÚPiÕŽe“þŸŠ¶ªWÊ$‰/@»m˜’x2ÍI± )C(.T?jt*<JäkÇ·Çtõã5m—%Éî9mŠÇb[4Çsι S‚3ÜFã{Ê—•ùßÕP!Ôƒ‘R±oé–Æ-¬™Õ¡hLÛ$ßd¬ƒP†jžo]i¾y-&djŸŸpN1(š¡n™5îµN÷9§ú’÷ÍßË®ª…³m³?‡SV¹Jq?‘73ÃHbT3<CÌ·Å93vša;fÙNaFù8Ç<Ô14æ¡6«hÞQL΄îBDg$(êˆR*HÂd˜†ýDL™™ïMvœ !R¨@*-ÞXÒŽÖÌ’:-»¤YµK‹òSOÛÝ8\W<JX<ï×:u¡¿®àCÉ»çÂ)èDäJx¨s„ÇÄc™2¤v*þBnR³Øý~°x[zÆyDˆC1ª¥;Dv'>ðVB +™+î`…†€TãøÅ}«Ÿó•¯¼my•Ž./„Ђ’§O†®¯ýÓtÈH»`–Tª6…®">~ VB pGõwy³z·Ïëjû2u¬Ö°*¦Nh'šÐIÑLàyÜ’½þÊðÎÊPˆ\AŠÆð}¬¸;z
„ë$€³€ó÷'cÆ?uÜ‚ZQ‹h¬Ò§$žw÷ÕàTNî)±%†0¿§ºZÓ{Êkù0ÙÎb4LÎoÃä‰õñ0Ù3oS³ I65ƒS³‘`j6Otæн5
¸¢¦%Ë
K<2:Žö¤>œª0ø%Fã8}ÚšæQÚBN‡g¥ˆDY:ã®ü¡°‘Œ·‡Mfø‡Uã‘Ξ½l܃@y:åHuåý£;ÿÛ,0Í2uZÄñ,ëhÍ°Ìiµ,ÛT¯L‹e3ñ†^ëÔƒÁ…—† +-Ø»ãžÎ®3®o¡ë#ëXÝÿbð楀¹ØæM^B5<Éa®Â Iâ7Ît]i{-ÏáÕ<‡g·>±>ÎážyËa`Uð€A‰Ãæ #(<|¸Â_ÃáÕ&_ýÀb +LCÖ ç©ÐÑš¡‚Ój©°¼!œ5ÜÞžX¿!왾Â/†SÅ!}P|$ÔŸ.ïîÜ…l^v>Ãù"ÑëRmä?‰L€ÇAGo`ÛQš†Ö)µ7‹
¬ú ¸R ìˆYÃ^éÄrZ ;8õLÿwÈÞßú?áêJe˜¿æ™óäÿç?iÿ$FÆ endobj -1744 0 obj << +1751 0 obj << /Type /Page -/Contents 1745 0 R -/Resources 1743 0 R +/Contents 1752 0 R +/Resources 1750 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1748 0 R +/Parent 1755 0 R >> endobj -1746 0 obj << -/D [1744 0 R /XYZ 85.0394 794.5015 null] +1753 0 obj << +/D [1751 0 R /XYZ 85.0394 794.5015 null] >> endobj -1747 0 obj << -/D [1744 0 R /XYZ 85.0394 695.9587 null] +1754 0 obj << +/D [1751 0 R /XYZ 85.0394 695.9587 null] >> endobj -1743 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F21 654 0 R /F39 858 0 R /F48 880 0 R /F53 957 0 R >> +1750 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F39 863 0 R /F48 885 0 R /F53 962 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1751 0 obj << -/Length 2849 +1758 0 obj << +/Length 2840 /Filter /FlateDecode >> stream -xÚ¥Z[oܺ~÷¯ØGITR¤(©@$=ÈA{êž8hÄòŠ¶…h¥ÍJÃùõrHŠÔmO[ìƒ(rÄÎ|s!¹tGàGw©ˆE‘»¬àqJhºÛ®ÈîÆ~¹¢†æ%zãS½»½úÓ_Y¶+âB$bwûàÍ•Ç$Ïéî¶ú½‹i|
3èýÇ_®ß$"%IôöææÃoï?þÞS$@@Hô÷·¿}~û7컹.€ì—Ÿ®ïn½úpë„ñ¦„)I¾_}¹#» -äþõŠÄ¬ÈÓÝ3¼˜E²;\ñ”Å)gÌö4WŸ®þé&ôFõ§K -ài§ »7ŒÇ9ð_V3J(K‹X°„95ñ|IM–J©éÕ—¶»;ÉýùÔËé’i’Ç<aÞKÜÕœ=4Gö”±˜“4 ùß*}w¼~Ãr
Oº‘D½†kÕí#¾w~ϯ$%§kšGzu×"}%û»+ H{_Ø¨Û »ïgyz¹¦”F -¢ž‚ -tú!Ofš -m[ ¨†3ŠHŒ¡ÓI«ßz¹_´c«ZÅQjCÓœ¼Â<¥¡uõ#´µ=„ÝçS‹õ?/´ï×,ÿuÕê ¯Á³_,ÂÊ Â¯C‚¨OÆ/@£ڀ„¥r«µð¢#¼(Ø6sG5ç>‰ðYÌaW²ïgÕ¹Ÿš¤{·±´jór9¹æ -ãgß Ý×ë†I2ÖèBØô©Ö
ã¨F؃Þù¦‚iVÐmþŽj.@hðQ&%mÃm¸µ
lÃÝ11‰F‘õëhV y8š‡/™‡dÆ<Ü77æáÆ<<8ZÞ6lYó"¿J}ª
óXªÑ<UU«Õ•ÍÜ>B]´dÛ8ª¹¡}@Rµï$ðÌ#¬y„5Ìch ÛY¿öáÂØG }Ä’} -káÛGûcŸÌÙGSQÄË'…цÑh›?Â/œÊûTëFsT£Ñšfõˆn“óxD7c½|Dðþ$M¤±ûF–¦©DšG¯„°òq½b£‚ÇD\8Íðˆ6”dˆðê°>È¿Ü®”k[<mµ6e¹\¬ù<A7æŠqZ‘’¢Sçª/uÔM,¾›T¯?è–.CÁO²"±Ç·¹j1C -ïý_’3Sàæ¹:F[ +xÚ¥Z[oܺ~÷¯ØGITR¤(©@$=ÈA{êž8hÄòŠ¶…h¥ÍJÃùõrHŠÔmO[ìƒ(qÄÎ|s£–îüè.±(’b—<N MwûÃÙ=ÂÜ/WÔм±Do|ªw·Wú+ËvE\ˆDìn¼µò˜ä9ÝÝV_¢w1¯a½ÿøËõ›D¤$‰ÞÞÜ|øíýÇÃ}J€‰þþö·Ïoÿ†Ïn® ûåçë»Û_¯>Ü:a|)aJ’ïW_îÈ®¹½"1+òt÷7$¦E‘ìW<eqʳOš«OWÿtz³úÕ%ð4Ó„‹ÝÆãø/«‰Æ¥@”¥E,XÂœšx¾¤&K¥ÔôêKÛÝäþ|êåtË4Écž0ï%îŽjΆ#{ÊXÌIš„üo•¾»ÇÇF^¿a9†'=H¢^Ã5êöﻇ€€F¿¿ÇëW’’Ó5Í#½‰ºk‘¾’}+ H{_8¨Û »ïgyz¹¦”F +oν¬â™ßçL€h°ö¶zTh©œú* \üž«À·ÉÞQÍùO\°ˆ·y(À¿´õÍÀzâ0B%áØ>Ø¿^€-%EL“,ÝÆmAÓ£y8fÙ¡ÃëWB’¶²‚H +1‰`ÑñT·†kx¬€7Í¡â«…²Áû}w8Èv°““źóp<ÛÉ +èꇷ¶£RðÐÅp\p,!bFT‘¿]Ô¥µ4*©h×á +28B¡Í{®R78†Óª\€V×`“¥l³ÏÕ®¶×¡ruZ6©xzm· +ƒCYÉת
¥#]_ÿ”ŽÁzOã€N|l^&^Üswí&:î%T/µmpÿHÊôê¡që«b˜ŸB$ÝDOµŽ Gåôý4å[äqÊ.°54s®“ª˜Aõœ±íͨ‘/•Ñ’ŽÉN]wëú²G=qÍœÐXé]Xý½^_̾rß8WcûhF/Œ>Õ†),Õh +•Ä”×Möcpñ_® +¤YA·ù;ª¹ +ïýEpÌÔ#x®NÍ\Zö<½È×~«Íç/¯}ûŸþàk#¥ü~.›°<û)ñøjÚv-„¥ú}\Ý@µm[q\êܺ“0ý1ÛãF×ÿ‘ÅI&.TÑÆ ‘ôI:6 endobj -1750 0 obj << +1757 0 obj << /Type /Page -/Contents 1751 0 R -/Resources 1749 0 R +/Contents 1758 0 R +/Resources 1756 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1748 0 R +/Parent 1755 0 R >> endobj -1752 0 obj << -/D [1750 0 R /XYZ 56.6929 794.5015 null] +1759 0 obj << +/D [1757 0 R /XYZ 56.6929 794.5015 null] >> endobj -1749 0 obj << -/Font << /F37 743 0 R /F48 880 0 R /F23 678 0 R /F21 654 0 R /F53 957 0 R >> +1756 0 obj << +/Font << /F37 747 0 R /F48 885 0 R /F23 682 0 R /F21 658 0 R /F53 962 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1755 0 obj << +1762 0 obj << /Length 3318 /Filter /FlateDecode >> stream xÚZÝsÛ6÷_¡™¾ÐÓ -!¾HâfòàÔNÎmš¸µÓ»›¶”HÛœR¤*’NÜ¿þv± -–D!_לp¬…°æ2f‰â¼oóö|)e´95ªn³ÊwØŽ‚úžÆP>O–º é“›ÑÖôL·ÛüœéŽºE…zõV¥¡aQ¢ÈŽì«t“ÕHV3EÜÁúÓ…¸`¡’Žârf
äÊÜ×^¨v(s¬ÜÖuÕì›'Až¹ý¬šºìÚœáê‹¥H"&Ç#çÌh-ìÊwöÜ4œQ~ŸveK§´ìÜxÑÐÓœ¥ü5EeÙ@·k -8µêÁ“¹y•;th6mÚ曼róýÁJ3<²D1Ør~•·ëW»6ðÄ`o÷s¤Y¤¸?Âo`íDöœ€w¬ -ªšÎ@Æ@[UmE…Ý8iq¤po¶0Lj‘^ƒž+¥‚ -…·ã–Ú|·¥‘ÒR¸…h¸LÛâ)§7ÕžKZ9êÏEYÒÐÊ‚NÂm‹ÌW“Çõ£]Ì•…6à -ìÓÞ6²z“UC²hZ?eH9½5',᱇)r\?ÎÜ•L\ƒ×bf)f@û•Hž£+yÕÊ -:ªµ;)xº¸ŒG2ú«àbKîÌeKPÓ(9mS‡TÇmjOemꪻoŠ?ó×o&VU)8r@îIÞ=Õ”ùت*Ãbé1wkU…×fl|º¼¡À°IÜ(‰Ço±ŽŠc+ -Òì)ßµEC0²F-6¯.?܆nù9Ë(¢]°Ë›™Û&cO°znó†¡Éãdͬ˜é—bÓm¨ƒCêÏ5S±6cõß•£ÝBCMôøl72Ú/ô÷
Hk©Ý¸UQh„ô ²fK8-ŸÏ9çŠlâàg!ÐÜz®]‹–|Ä: ƒ] -çÇ-/èÛvÝUYžÍ™nKŠáu?«?;‡Gs·»,ô@.ŽåÂ逅·©[áOò85õœA‚Ö:í§)=ðÖ©õG—ïžÝBnâÊÑ’Y=¦k<aBJó‚®
¨N蚧²º–gUóú«‰¢‰ˆõiÆ=Õ”óAø‚öM&cÖ· -DŠðA'8¤:ÄžÊîë—ªþmAXQU>Ác”°lëiþ=ÕT€1ÁÞÇadÆÜì -Œ{”HÜ9kûÌ,‹ßsjÙóÄÆíÇlÄó0|ÀgJ8ÚUݸ™v§K»UÛ‡èd“:îJaë±Û¤Õ’PÌQhÆöø¦Yº*q¡C0¼Áø
Bir -8Þ‡¸ØAê cCbë¶Cyº~¤ÁñžhÕ©Rê¢c#Æ"À½@ ª¤é—½O×p› -7õ×P‡—áN}tÜDûÙoîæd¡;Wš%"ác×7IãÓ,+Zˆ]zåÆŒ£®¦.e‰QÌÒ„’ò“0ØÓ£é!ÐëÇ´™ r‹a…|=É!ßñõC#‡Œ¿µ—‚ -QB`ÒúP¥m׫£ÀŠ CPÁc#f\™¡¡×èomÃÆ«o›mQZåêcl-/gªÀ*L©{|© -,À§%É|
xÙ¯wò@ÜPŠáÜ^¿ûöŸ·WÇoânðK/Ýÿ€ê<•Å@»ë°Æ´ü=~ýü™à ‰X¤yZ„žj*Ã
†³Hšh,„M¾°”™[u·© ->p¨Ì©F°àTtgwž•Ç°ò»Éhñ¹r3»ÆÓX<ÌT<¥bÚôµ³¯‡*q ¿†¸¢š¾µ°ì•R‘ ùû«ÿø -'\Kb"†Ã8ÖºØÆ8ýò†¢h}Îï+ز>f5Àº3¼F›b\,#Àš5ý¡fsq«Á´|)nõ‰ž¯pÆAY׿ƒûÙê¡Ž!ï?[à@ŒÁ¿9NB0Æ~ØÅÙÊ4ÅÂËüòªF°ˆ÷¹ª5ÑÆWÒ@þ5Y—ÑHPÞ\Â\JSõŽÜ9롹>¼Š;e'>Œ/x`§tèí´f픈ф*³ -0-1—ñžóÿdD.?2/-CªãÖª§ê=V[omålµDg„ê4÷žjÊþÀmqkùÿ Å cr)¢NÌL˜qNŒH·ùÃ?z‘Ò6D/]A†ž°~”¶¶ø¾ObJ†^g1cI¨ã±ùk@ãXÝÁëÖ˜Ä)ý÷æW\—œê¶zÏy4kÀú-ÞcFƒÑ6îaàJèŠ~øôs¤»ë›÷W´Õ?]ýt}u;c BDKtlö_à$}o®?\bˆŠÍ¶´_¢RÄ)[”žšUÌ’u$ø‹õ -'õL-׉,±^ÜË¿6è–¶ÞìjŠYN¯ðíÒŽÈ`´Û–nœ¬° A@pE×éÚxÛ¶©§„/؃A2GE„í.gËÓî,•r>@{ †>@»dÖJ‚- èïÞûëTj +!¾HâfòàÔNÎmš¸µÓ»›¶”HÛœJ¤*RNÜ¿þvDŠ”|Ó^2 p] +×R&“ʦŽÉSá1}]M×¾¾<Ü.—‚eIÌgý5GœÕ˜µ=Ö\¦,Sü€÷mÙÏ¥L£î±tz·^”[l'QsïÆP>O–Ó„Çü‰ft{æ›MyΣ|ëºUzõV÷¥±aI¦ÈŽìë|]:ª¬"e"I8Áúã…¸`±’Dq9±†aR +E÷ªëËœDÚò©Ûª€}ó,*ÚÏ¢mV»®d¸úl.²„ ÁñÈ93Z»ò=7
gTÞç»Uç:OùjGãUëžtr–ò×8µeÝ][Á©ÕžŒæÕtèÐl»¼+×eMóýÁJÓ?²L1Ø¢
¿*»å«m xb°·û©Ò,QÜá7°v¦"{NÀƒ+€N¢ºqg S ‚΀DF[Qa7$-ŽTôfÃp¼i„iá5è¹R*ú +ìÓÞ6ŠfWuë:«ªíü”>åøÖxš±Œ§¦Èqù8qW2cp
^k@Š‰¥8˜íWrò]É«VQ¹£ZÒI9Ç‹kÁx"“¿ +.6²äd.“T‚š&Ùi›Ú§:nS•µ©‹Ý}[ýY¾~3²ªJÁ‘rOòTcæC«ªKM¢‡ÜU^›±ñéòÆ5 +:Ó¸$h-ó]Kú˜»Þºký±+·Ï´M\3«ÇtgLHi^ÐµÕ ]óTV×Ê¢n_5R4‘0€¡>Í8P9„/hßd6d}¨îíid^Ù²pVYJÔVMMï÷˜Yc¡¯ü}UÍW—õÐx¸˜Ðš +H= +DŠ2ðA'ا:Ä@e÷õKÝü¶† ¬ZUu9Âc’±lëiþj,À`ïÓ81C n¶Æ=JdtNËÆ>‹Ö
®ªßKײç‰ÛØH§'`ø€ÏÜ=àhMK3íNçv«¶ÑÉ:'î.”ÂÖãn×s‡ºdNb3´oŽo^ä‹.s†×¿¡SH휎‡;hXdlˆAìohë0TæËG78Ü“CuDªÜuѱ9Æ"½@ ª¤ ËÞçK¸M€ÉÖ¦ËÝj§> +±™”¢ÜmB,Ÿ<©Ë…,°¯TâEµ>÷±B°ÚÈwÚÔ¡9+‡ ªQÓÈT·ÝnÑ'ǨØ/¾(!K® +,˜|A€@5–à@[lb¯‡"\t¸n0Nœ¥ ˜‘ªÝ¬òg´‡
H$:4:ŽÆž4ŒR¸Üºž¿¬„÷|2Rå+4~eañC_ü`§jÉ +BÈ.3=Ä„w¥T6ÌRB'0 Ÿ\·Ÿ¶Ç¯P—diú•ö¨N\©§ +W +®»-—£ëÔ1d"";Í<P¹¯Âš4U|Èþ§‚ïˆCÖÿöê[×9/îÒjûlm1ÀŽ<ûŠ•°c!p¸àÇïiFESu|ùþ箞‘›d?ûãÍÝ”,îΕf™ÈøÐó²ø¼(ªB— Û˜p4õØ£ô1ò‚41ƒœü$ö4ÇA@4mõ°|ÌÛ‰G°V8Áדò^?ä©0²Ïø[Ëp. ¦ð%æ¬uÞí‚: +,˜`-u6b†ª{îÖ6lØ*°ø¶ÞT+«\!tÁÖür¢¬2Á”‘ª·Ç—ŠÀ\Z–M—€ça½“¢à&€RôäöúÝ·ÿ¼¸½:~ûvƒ[zéþ{T'à©,ºíKLóßËç×_ÁŸ²„%:“§ETc†h0œ%Ò$C!lî…•ÌÒª»ÍTðC«ÒµÑ¨HÕAw¶çY´sÕ1ìƒü4í/>4s×z‹‡‰‚§TL›P:ûº¯òk{!¨ Ũ¹€e¯lŠ +.a*£©ƒ#÷5Φo®¯âÀNÙ‰ÃîÙ){;I;%R4¡ÊÌ@jÜœüÛ–*¬8ï/9VW¦%å2ÝsþŸ¬•HÀå'æ… ¥OuÜZªà±ºfcg£¨%8#V§¹ª1û·ÅYªy:äÿ/æ\ØJ~N"7{'/÷N̵7åÃ?×ÉÝtØÐœJÜ–‹ª"ïlٮǠ&ºb&ƲX§Có×0Ʊ®ƒ71}Súïc̯8ï/91Tk%ôžócÖv…-Þc.š‚½6äaàEÜíüðé=¦Gw×7ï¯ÜVütõÓõÕí„mˆ +‡Â™àø2'éå^úUe¿Â¨Ã?Ž[§jWü\¥ýtíx¸â ‹…9Hì@V™?´ßK¶¢¶>+F%U"˜öÖx)Rú¯ +ÐZBÀ+ËĽÆ_cR
˜÷Ο‰r‚‰8óíRÛ‡}C6ÎŽÐ×Î6ç$OUÕSUìlÚ"EØŽ}åE.Ib‡9*âHûjòŵ‹²]n«}™ó<WŸ¼óEóTâ¯4À¨ÑM‹Ø}A·¹!öì½sü’óÜ”=a£í@ŒÜGTHî_Û»ÁÆþþö?S€aûË·bã¦/¨±NI“wšga&üõæ«©=ýÂúó¦<ÀÈr•·‡¸±»›PøÒCQHûØìVÅ0žÈ=Ôûµüý”ƒüòw«fá.>u*!è‡øHH¼\&TRp’—Œ~Ͻdô[ ;h£IZ4˜–Z:âû¶q3ü2^™m*hË26ƒ +’z¢ŠK"K¬@`á×ÆÛÒVš©šX”A»´ud0ºÛ¬hÜY!aAƒ€àÊ]'µñ¶mS÷N _ô°=ÉX¶;Ÿ,LÓY*E>@{ ú>@Sž endobj -1754 0 obj << +1761 0 obj << /Type /Page -/Contents 1755 0 R -/Resources 1753 0 R +/Contents 1762 0 R +/Resources 1760 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1748 0 R +/Parent 1755 0 R >> endobj -1756 0 obj << -/D [1754 0 R /XYZ 85.0394 794.5015 null] +1763 0 obj << +/D [1761 0 R /XYZ 85.0394 794.5015 null] >> endobj -1757 0 obj << -/D [1754 0 R /XYZ 85.0394 204.5196 null] +1764 0 obj << +/D [1761 0 R /XYZ 85.0394 204.5196 null] >> endobj -1753 0 obj << -/Font << /F37 743 0 R /F48 880 0 R /F23 678 0 R /F53 957 0 R /F39 858 0 R /F21 654 0 R >> +1760 0 obj << +/Font << /F37 747 0 R /F48 885 0 R /F23 682 0 R /F53 962 0 R /F39 863 0 R /F21 658 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1760 0 obj << +1767 0 obj << /Length 2180 /Filter /FlateDecode >> @@ -7604,809 +7644,823 @@ C¦#Xs ºfÓ
˜Gñ¨É?Ø $âÎ…~u])ÀE/31K6›²È3T¹”^Û¶['݈3G’ùQœWœâ“ŽÆÞâ™PÔEW˜“ÃÀ ¬Íõ1¿?Îò{NŠîU~ªçG-ZzŽË£/³jd—CVeò8¶‹f:ŒN´ {(°U2G¥Á·Ñ *Lâ0h\ß,Þ}šß/çw·#ya$,Ž·JGÃÒ/–4øk‹jƒéHÄQ'Í„©%Øä[€+S¬áØ\gì;$MC®ìëø×°&)KËCÂzÿ¶<¤M9z8?¿·rfÅ@ˆä-tí,IÕ1”OOEj1|~HL
¦¼?¨Klmk@ ;,Z[ymíŸçΰ½Çâ)¯ßŒ˜BB”àÚw>óš)$„Jß]nÓå¹]lí¸6e†wU•˜Pû6¶„,½{<"…„ø¾xÜ1Û'¥>‹¼QF]'IÂ?Ší”Õɽêñ endobj -1759 0 obj << +1766 0 obj << /Type /Page -/Contents 1760 0 R -/Resources 1758 0 R +/Contents 1767 0 R +/Resources 1765 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1748 0 R +/Parent 1755 0 R >> endobj -1761 0 obj << -/D [1759 0 R /XYZ 56.6929 794.5015 null] +1768 0 obj << +/D [1766 0 R /XYZ 56.6929 794.5015 null] >> endobj -1762 0 obj << -/D [1759 0 R /XYZ 56.6929 626.4701 null] +1769 0 obj << +/D [1766 0 R /XYZ 56.6929 626.4701 null] >> endobj -1763 0 obj << -/D [1759 0 R /XYZ 56.6929 517.4334 null] +1770 0 obj << +/D [1766 0 R /XYZ 56.6929 517.4334 null] >> endobj -1764 0 obj << -/D [1759 0 R /XYZ 56.6929 438.0429 null] +1771 0 obj << +/D [1766 0 R /XYZ 56.6929 438.0429 null] >> endobj -1765 0 obj << -/D [1759 0 R /XYZ 56.6929 376.8269 null] +1772 0 obj << +/D [1766 0 R /XYZ 56.6929 376.8269 null] >> endobj -610 0 obj << -/D [1759 0 R /XYZ 56.6929 339.1376 null] +614 0 obj << +/D [1766 0 R /XYZ 56.6929 339.1376 null] >> endobj -1766 0 obj << -/D [1759 0 R /XYZ 56.6929 306.6767 null] +1773 0 obj << +/D [1766 0 R /XYZ 56.6929 306.6767 null] >> endobj -1767 0 obj << -/D [1759 0 R /XYZ 56.6929 271.6646 null] +1774 0 obj << +/D [1766 0 R /XYZ 56.6929 271.6646 null] >> endobj -1768 0 obj << -/D [1759 0 R /XYZ 56.6929 207.5268 null] +1775 0 obj << +/D [1766 0 R /XYZ 56.6929 207.5268 null] >> endobj -1769 0 obj << -/D [1759 0 R /XYZ 56.6929 137.3205 null] +1776 0 obj << +/D [1766 0 R /XYZ 56.6929 137.3205 null] >> endobj -1758 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F23 678 0 R /F21 654 0 R /F53 957 0 R /F47 874 0 R >> +1765 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F21 658 0 R /F53 962 0 R /F47 879 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1772 0 obj << -/Length 4060 -/Filter /FlateDecode ->> -stream -xÚÍ[ÝsÛ8’÷_á·“«"† -6Τ U!¢LkIBÚ6}µ!ø܇/Ô,ë¶+r¦#{øtìaÃ3å^Æ´–~T%|¾ñC7*q#U•ù=x[të·‡¢mª—hÝÔO3üÃ"ÓD(þ Â×K¥d¤l¬¯—Æî?Ÿ§S -ØõÔx)-ó™9D%‰¶Üå×XÇyUÁCðRfðªx¥Åç¾|É+§NFGוõó ¸†RPÖ8,iùr‘£1yÍòÍÛßp¢S½°2Jȯ«…‘ÕÆOà¹ßå¿ñVç'ª´áËžûÜÞÿÏ"l -Œ™&™nÊ߶˜Pg¤‘¤°“Ò3²|7'Ðs#’#aàÎáÙ·ÅæÍŒ(@Ò±Tâ‚(d”ØÄwz-«ŠÍ»®Øí;f¾Á§\lÊv_å_†¹ÆÃ/·Ô û^7î¹aîž@ã_MÍ"ÐSD*n˜3lXK@¯'7C³cV=Ï,c°úÆ„µ{«§Íðö©d²ÈûnÛÊ.ïÊ—‚H~ô`ÕH&þ¡á€Èµp%è4”rVçh88}M¸6Œ—LÇ#øÔ‹MñkËÚ3´úâgáî¨ß±PqñΈ3§¸Ô›~<5½7—'XÍh
<Ø7áHf¼–,×óz*“ìXM•p¨z¸±‹~ÝáÒÁ¾!ƒCJN„Ý¢¡–w#_è—“(<×UÞ¶s*$âÈàvÓä£nSÊ"kâj Ë-™«uί -z¢]M®šæ·~O´?mÙl˜Áé4:²"–Óíy·Í›¶.x‹ˆ;×dØô®±.ÆÔ°áêvLŠ†¯7ÅSÞW§ƒyl¾»§'ù]ݘÑüh³guVVMëF‡8 ïö}GmÑ,ž‹º8äìÚjê)Ö/´6â"îfÒ°qàˆCžG¥à.¼Òmæ=…©WºÃœâ”J§Ü
"NÜÍ Ô„ˆ¶š÷x~mXdîî92@3r“ì$$à}œ¢“ë‰^&1‹mŽ`$:èd´=aÝK¹q -á â8f»šg[Št -¹õÈåØ -û§âã`]dvÑî‹u‰A/ä§à+!@ž‚äY[úþûß}|I‰2Ú™‚;ù;ö~·Ëظû˜Fw÷ôcÓìò²¦®9>„_¾CÊ
AèD»JÎ:>}x',Ó×<±w¿>™è= '·Ÿ¨îð’—qgÁ,—÷ó—2ú$äJæaÔ$>œRÝïV.¥¢‹§€¶i†n.¶¹ GCŸ@Íâ³Ú£ -›-d•EÜp³i¾6Qb¤þ¿¦ùoºÂ”‚åMY7óL-Y‘µŠDcSMfŽ¥eGe}кàæS‹{Ø9~ép˵žŠW‚{ËÚ‚!ÈÁ1ÆäÑØñ‘•áK"Wœe!¥f!ÜuÓ9x“– -žmAspÄ€Œ4?Mᓽ£\ˆl}¾"s\ÏñsLk:-\»dÀåœì€
Ø86ÿnesáDžâX€D¾Áìä@?ÉŠåâ/?b…-ñ¾¡;”EK¶3éÒ+xThÑœÁÀOJx AfÎk›×Ïdo’u -à‰éG€O?áWˆº‰2Z¤Ï©$$-"IOb[*cÁcÈ8^¬Ð
#É¡^ì÷)A}¡I -e*‚(î(MÁrŸÉP?È8 ]Ï2qGɊᇋ#”Åï{ôÔþ[UÂsP€ ÛN{u[W8Cc;*®"¹o{Hʾ̅ Ô
2×C^e
™9$Á‡H³ÉÁ(“Ø<ÝÍ$‹â4½\äWÂcvïr(•B‡Øp)[Aøðšå€Îês¢‰£DÆ!Qy<s„!ìÉFì+n2—ÀÓ%Nø.§ßï˜G¤jÜ^úÖϤM:…4M¦Fí¬žÖ"°ÆeyôL²p+ÌüTY8‰É1 -سhGB¥—O¡â4LOhƒI”µ4>›ÒÝÇ—„HÞ7ÑÉdß\&cä¹%ºó°P[¦ÿטúØFⵃtF±CiÔ¯ü{¶ZÛ$x•n^6•'°˜…rDIg#˜vœ’9eÎ!þ•îät.ö&ƒ“;`^ -®0œÝ¸¸
]ñ<܇x¨y®ËÀáÿ‰.7Y¼»¿ýóû7DÆš ! d"i6TÉæ~¹ÅŽV.î~âÖŸÞãñ¯\ðO4BnBî‡xk>ýEšKÚí +ýI²åšP†zÙìq.¨øm«/ûm“x%?‚-7‹Û§–¦Î™¿|ÏÇûC )#SQ’Êl^û²”·t™$Æù)™éqŽ’:HG"÷Z"Q[zuTÏ|CP¿êýO<Ó||”,O&_=>O¢,ŽOw`ÌWW¤ - -9‘TÙeUFO.P_¥‘V&™Ê1 ¼¯ -÷ÆΔ‚a»R<¼Íé1MÎXR!!³¥–3BƒÕ kî¿åîm—øLŠäµC&‹ŸæüÝÊ64¿8ŠÉ¢ÀøŠzŽ»ò:\²É+|_UÍ«¯d¾W²ö(œ,ý‡ãDc…"zæ*ö’Ói”À ©;sN<ªAA'W<áVCÏ×Ü™¹â›ØÈéÁ5<ð“Ä£¨šìMÝêTt§0Õ%Jÿ¼åiÎdF22i€¹åßÎœ Øáeöà¯Ge&ļž&à‡Ó4À÷yÿªM¤Ó`ßÀZ -⤱Sû#
ër5ètJ…aÚ‚_Óõ
7†ƒì3÷|GK©³…N©DÙ¯) ø@Q•SË;kSöòæüm-‰4½œ•KNŒÙ?ÁàÅZÍÕ©ÉÓo™6õÁkAÕëÝ°¥,~¦ÊW‘±ÑC'6zË…“¡]#§7ì ö`%üçÒáÛÔmŒÃü,Ž”5G×e|®üÕj!+ ýpü6nù~ß“(þ£õ—ý~/wýŽo -‡â—+#œ^±ú¦k¹»‹VÖ^ýY>'`ÓË·G«Û»ÆgŠ}›?‡sëÉõPTþ<{¯²!-&0Ôš»õ£4¤‹Z‡ãËÓ‘ ·á¨ˆX™¥ô98ìi¶˜EJ›P–Ä›AçnúÙñÙÚÜ¥~…çÖjî -~|í5íß¾ð?ü=$+ Ä2Ü埮=N"¥2á™BÆE,ŽYpÊûÿª–³ßendstream +1779 0 obj << +/Length 4061 +/Filter /FlateDecode +>> +stream +xÚÍ[[wã¶~÷¯ð[åsV\\ì9}pö’ºMœíÚIÛ“ô’h‹'©);ίïf +ìVµWS²IQãÓNšMW5u±bêöJºÉãn]ÖQž—Õ|I]çeÕ-a&Oƒëb͆_Ý|à1?jÙò÷ÍÃÉoyüºèx9r°X½q9¯gÙ´ÝÈ¢§©†³HUÊ$7F‘–Ínµ ø´+·/Ô¬ê¶+¦#{øôìa#0å_n÷i-ýXUðù"EÜè|¥³Äê<ìÁë²›¿Þ–m³zJæMý0Â?,2K¥æìq9ÕZ%Ú s9Uа–tÿø<žR®g6HiZŒÌ!Ó$Mã.¿#ŠÕ +’—ê5ƒWÅ+-?íª§båµÃ˨ â躪~ì7ÂPÊ*â’¦Og9Úg ¨Y¾Eû+Nt¬N%RKõyµP2qƆ ÷ëâWÞêâH5¢6¼l¸Ïõí¿¯¤”qS`Ì,ÍÝpSþ¹,ÑÀ¤>!4ƒT‘é›1a€ž[™‡ô†Ï][.^ˆ$-”–gD¡’Ô¥¡ÓsµZÑ EוëMÇÌ7øT“EÕnVÅK¿"߸ûášdßóÆ?Ì݃wÐø½©YfÈ€L@Å-sàÀ›Ö½×ƒŸ¡Y3«g–1X½€1aíÁêi3‚}j•NŠ]·l¶UWtÕSI¤à~LoÕH&þ¡á‘oáJ0hhíÎÓppúšüZ?^:ܧ™,Ê_„Pu`höfánï¨ß¡PqbèΈ3¯¸Ô›~<4»`.ÁaEoFkàÁ¾Èä6hÉt>®§*ÍÕTKïU·Wn²›w¸tMîßÁ!¥ Â[¿hh å]ÉÉýò…ç|U´í˜ +I‘XÜnš|¯ÛP‡òĹèq‚åVÌÕ¼`†g%=Ñ®†¯šæ×݆h-ÛªY0ƒ[Ò;eMâ¤PÃíy³,š¶.y‹ˆ;ßäxØì|c^îSã†'¨Û‚
_/ʇb·:,øæ›[z¢#¿©»r3£7?ØlÏÙOÞƒ•ÛYÓúÑìºÍ®£6h'e]nm5õØ×H€ÆXyÖïæÊEgã#yÂ9ê$ƒp”n1)ŒÌ‚ÒmǦÔ&;n`ynz &$´Õ¼ÀósÃ"ópÏ=´{a’ƒ„/2ûúCb”IídY 3R©ô²Ú†|ÝSµð +Xí©7 +rrý‘ê_!y%‘G³œÞŽ#.mÍäJ5æajÒ +€„àí$uó0"ü©é[yà1No‚Ã=•{ud´Šº|,z ¦ô;-¥yu`z‘ù½ÊÚy °pm°2Øó3°™Û¦ž²åî »yâøõiw…é.ˆ-YpקŠævϳÄZ+wÛÚÝs“»P'¥ *f§á`œ+pOLï‚øø–¿ +œñj*Gµþ¾ÃEÞë½ÿØ×…yʶk¿®¾¯mLЦéxE"3ò¨¶g gúö¨·‰ÔÙùS(‘Åé½µX¬H¢¬•
Ù4n><¥D +± ˆ^&›fë3«N-ÑŸ‡ÅrØ4û?^c°ÂkÙˆbÇÒhXù×lµI]ðìÓn\NeG°ŽÓGçølD9òŸH!s 6E^ç"«H{Ù”cØ_Ú,6VAýëˆð +_Š‡·=öF`“³TaÆç
˜-µ¼Z¬¬¹ÿ’»·]±å3ü*‚BÅvÌdñÓ‚¿›…Ïzƒæx‘, +Œ¯¬ñ¸«¨ã%›bŽïW«æ9T²f/‡•¬ž=‚“Uøp?ÑF¬P&\Åžr:ø‹T:5™u#çÄ{5(èä‹'Üjèù\x3×|S=¸&âü$ñhª&{BSwäuVt§1Õ%ÊîqÉÓŒ[¾Q‰Íb3ýç‰×Ÿ Œâõ¨Üƃ˜çSÃdÿá5
üûx|561Y´‚/`-:%Xî©£¼LBü‹ùën»ÑiƒÓ:¬¾9eo‘Ø{´€¯Tt7-X]í-Θ|¼¬d4 xÆõE£ÒM=Y‘còê@—24à¤}§ G@ê×åkÐOÞÑi‡iK~M×7üá
²ÏÜó-O:M¢Sí>§$ebðêÀ²{ä”q”·§ok¹Df™=_~T+q|‚ÁË´šªSS¤·Á2]ÀkIÕ°£#^øÝ›*_HeÎFØ衽á}£ 7 6`%üMàÒ2ZËüÆxŸŸ‹ ØÁu™+¶ZÈ +H?| endobj -1771 0 obj << +1778 0 obj << /Type /Page -/Contents 1772 0 R -/Resources 1770 0 R +/Contents 1779 0 R +/Resources 1777 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1748 0 R +/Parent 1755 0 R >> endobj -1773 0 obj << -/D [1771 0 R /XYZ 85.0394 794.5015 null] +1780 0 obj << +/D [1778 0 R /XYZ 85.0394 794.5015 null] >> endobj -1770 0 obj << -/Font << /F37 743 0 R /F53 957 0 R /F23 678 0 R /F21 654 0 R /F39 858 0 R /F47 874 0 R >> +1777 0 obj << +/Font << /F37 747 0 R /F53 962 0 R /F23 682 0 R /F21 658 0 R /F39 863 0 R /F47 879 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1776 0 obj << -/Length 2189 +1783 0 obj << +/Length 2136 /Filter /FlateDecode >> stream -xÚ¥X_oÛHϧðÛ)@5¿’fq8ÀMÒ6»mš½À²}Pä±#T–¼–œ^îÓ/g8R$g’8øAÔˆÃ!9ä¤ÙŒÂÍTBÍõ,Õ’(ÊԬ؞ÐÙ¾}8až'î™â1×»åÉÛ÷"i¢žÌ–둬ŒÐ,c³åê&zG9 4:¿Z,.Îâß.þóáâê4f:S:š___\_þû4æŠ3°R}ž_ý1ÿ„kקšGó‹ÓoË_O.–ƒZcÕV§¿Nn¾ÑÙ -,øõ„'Ì~À%Lk>ÛžH%ˆ’Bô+ÕÉâä÷Aàè«Ût£„‹„|ÁÙŒ1¢•âg(MÁ…sÆåùµøãúúË×S¥¢¥56‹‘#é,æ ÉÓ¸kíy؈'#™¤°ZŽ»¦ír8#JÖ3å-ÎÒèÖ˜ÚRYt{(«”Ý.¢’°ô'U´¬;³¯ó®lê¼*ÿgVøiÕlóÒ©óV†_ÚÃn×ì»7ðÆeTzéEî™ó¢0;¿˜×½´²ÝUùƒ×Ô±µe¸‡T@Ø
n+拳ËKàLÙ£@[%Zð£”h)^ó'4ISÏ”ïvûSP¥Ùí˼3ÕžQ4õ½Ùw»Ë÷yÞÁWSͪ¬7øÖ¬Ã*"ukÖ;À¿·¦v[ÕŒBÄ•7Ó(ÎDG¸ë¯ƒi;\èûÌlráBkö÷N' ÿôþEX´Á¥‰¼³^×höÖ˾3(ÜËLeù)’ÔF¤ûðÐþ±BæªünÆ*Á󰯑
¼bשÚÇ™UCÆ™O§·mý.j¬óç^å¼mjˆ1!À:ˆ>ÊkÓ"§•ï."g\šråoØž}'œJµҳD' €Ô?(œè,ËÂpã±HÄͱnœ¦„g2}<Ùªx~¹˜¿ûtV©•’{SL}_âµÕ[Swè„û"÷¶2O!
—wÞyÎçΟÞçî¥lñ+ĉݴò«k\õ…‹Ñ - ,™ÞPâš•dŸéøqX@/ -˜Ÿ€cãQbR@ÄjÖ‡a^mš=ÔÊm ®”S¶OÌø6$-%Z‡·PT¢dJ2N“^Týª(OÝÃ.$ÚhÉzµnâ" ŠŽfTzž¢ÊÛ6 @4ˆŒü†^»‰Í@¢ER%zÑë*ß„$KÈßAÇo8’e„)–Mç&Þ¼j€T¨w@»¨’'FÜ
Ô÷Ú² (™ðÛwû¦kŠ>
W˜Ÿ³ÈŠd‰ê‹Ó£f»2÷aåªø±ÐöU¡m·7õz¼ŸV´È„¼ó³„M»“gïD¾UÙÊÜ›êgã¯~D»ã¢ -¨7)`iZ‰zS™ÂÍXRúYˆbÿ°ëšÍ>ßÝ•.
Jº -Pµl`JA{$Ü¥Ñ[|<¦jP–€r°äžÝü›^ãH`ôÁ©Ì<#¸ÃŸw-ðÑCKð¸À¿5ˆ‰zt8¼À˜o‰¬ïMt$©N<#n}ƒk}×”
`«Ã‚Ñ* ¼à,b”ËGÁ“–À§ù/”{$·‡ª+`BáàR.‘$”Çý†×Ryß«±ïá…å=jzÇ?óŸ6´Ãöè@®Ð¡¥ø¿ÿï~ü_& +xÚ¥X_sÛ8ϧðÛ)3Ë?¢$î›Û¸÷Ú4Wygî&ÛE¦MeÉkÉîæ>ý¥H“tæÆ) àÀlFáÇf2&±âj–¨ˆHÊä¬Ø]ÐÙÞ}¼`Ž'ì™Â1×»ÕÅÛ"™)¢bÏV›‘¬”Ð4e³Õú6xG¹ 4¸ºÎ²ÅûðŸ‹ÿ|\\_†L¥Ró››ÅõÕòß—!—˜•ÒàËüúùgÜ»¹T<˜\d—ßW¿_,VƒZcÕF§¿.n¿ÓÙ,øý‚7Ì~‚¦Ÿí.")ˆŒ„èwª‹ìâ_ƒÀÑ[{Ôë +F 1÷ø‚³cDIÉ'ΊĂëŒåÕ5•ýqsóõÛ¥”Áʘ‡ÅÈ‘tò˜¤Œ)<µq<lÄ“’4¢)°Žû¦í<r8#RÖ3å-\Î’àNëÚPipw,«7–Ý=n¢’°õ'•´¬;}¨ó®lê¼*ÿ«×øjÝìòÒ ©óV†oÚã~ߺ7°âQP:éEî˜ó¢Ð{·™×½´²ÝWùƒ×Ô¡±e +ø‰€°Ü +V̳÷Ë%p&ìQ -ñø‰QJT$^ó'4NÇ”ï÷‡KP¥ÙʼÓÕÞQ4õIºÖîóC^€wp©ë¢Y—õWÍƯ"RwzÓØܺյ=jf\Ê ®œÙ˜F9pÆ*ÀSuÛáFטgj’7Z}8Y€nÜÓùaÁ·&òöÖBXnÐì“}¯Q¸“™D䧈‘öÅCsüÇ™«ò‡«Ïã¡F6ðˆÝL¤*gFek>~mã§PppQcœ'8w*çmSCŒ ÖAôQ^ë9|û!rFaÀ¡ —î›»Ïà„Óˆp%Õ,V1(©_NTš¦~8 ‰áX$âæX7NÂÓ(y¼Ù¨xµÌæï>/<ÁIB£ˆ;St}*ñ³Õ;]wè„S‘{Wiƒ§†«{ç<ësëOçs»([|qbÝîwCáÃ( PO¿Pâš‘džîøyXãA/ +€ž ÄÄ®ÙûoË›Õò뵧0÷9ÔžAj¬ +¸âÁ±uïÜð +3ñº±¹—¨€ýfæ.3;åî`ˆbÔJio¾±½x‚£<À€µ©ˆÈj§4õÛWËÜ(+±ŸÑÍ=Ù|$ ME³§ƒê×zm‡ÑàC\²÷ž›Î
JBG¼äƒ¿¡ø©(¿©Ù8v0…we‘WÕÃÙx‚áDø£G-*ò-y3 dP¨^ÁŒ×˜ÑsMšÅ fÀ +'8
åÑ£àÉKCàSÿ
åÉݱêJ endobj -1775 0 obj << +1782 0 obj << /Type /Page -/Contents 1776 0 R -/Resources 1774 0 R +/Contents 1783 0 R +/Resources 1781 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1748 0 R +/Parent 1755 0 R >> endobj -1777 0 obj << -/D [1775 0 R /XYZ 56.6929 794.5015 null] +1784 0 obj << +/D [1782 0 R /XYZ 56.6929 794.5015 null] >> endobj -1778 0 obj << -/D [1775 0 R /XYZ 56.6929 751.8114 null] +1785 0 obj << +/D [1782 0 R /XYZ 56.6929 751.8114 null] >> endobj -1779 0 obj << -/D [1775 0 R /XYZ 56.6929 637.809 null] +1786 0 obj << +/D [1782 0 R /XYZ 56.6929 637.809 null] >> endobj -1780 0 obj << -/D [1775 0 R /XYZ 56.6929 571.6272 null] +1787 0 obj << +/D [1782 0 R /XYZ 56.6929 571.6272 null] >> endobj -614 0 obj << -/D [1775 0 R /XYZ 56.6929 530.4875 null] +618 0 obj << +/D [1782 0 R /XYZ 56.6929 530.4875 null] >> endobj -1781 0 obj << -/D [1775 0 R /XYZ 56.6929 492.9536 null] +1788 0 obj << +/D [1782 0 R /XYZ 56.6929 492.9536 null] >> endobj -1782 0 obj << -/D [1775 0 R /XYZ 56.6929 459.984 null] +1789 0 obj << +/D [1782 0 R /XYZ 56.6929 459.984 null] >> endobj -1783 0 obj << -/D [1775 0 R /XYZ 56.6929 390.8804 null] +1790 0 obj << +/D [1782 0 R /XYZ 56.6929 390.8804 null] >> endobj -1784 0 obj << -/D [1775 0 R /XYZ 56.6929 303.7532 null] +1791 0 obj << +/D [1782 0 R /XYZ 56.6929 303.7532 null] >> endobj -1785 0 obj << -/D [1775 0 R /XYZ 56.6929 225.6163 null] +1792 0 obj << +/D [1782 0 R /XYZ 56.6929 225.6163 null] >> endobj -1774 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R /F53 957 0 R /F11 1293 0 R /F14 681 0 R /F55 965 0 R >> +1781 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F53 962 0 R /F55 970 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1788 0 obj << -/Length 2917 +1795 0 obj << +/Length 2915 /Filter /FlateDecode >> stream -xÚ¥Z[sÛ6~÷¯Ð£<\y™}rçÒ´v6Rf·Ûö–(›ŠTEÊÞô×ï98 - …°ˆOßÞÍç·ofŸn}{wýÇ⧫ÛEGVHºà -iúóê·?ød'øéŠ3«M^à3‘¦r²¹ÒF1£•ò#åÕüêŸÝ‚Á¬}uˆÚ$ÌHMf -{.;„¾4ð$ðÿ+B}¸Ÿ/f·‚öönñqñ+Íh€‰ìhݬiêe‘µùŠž_à8Éh੶'=pØOÃý)È.¿Îo¿àaexrÚÚ5:Ú5êv„Gî›|w´MøïÂla4ÐäÔµ:иw×dFËÌCŠªÉ«Yÿ@$–¦h‹çœx gŠQ¬Q›Õy{
QãöÚ¡¬½.‡ì•3©ÀO’.K`㉱JÄI’ó”u¨ÒzƪÀ¥i.ú´}¬VÅ„‡<Õ -Œ0k}/§ˆ;rJì^Ö¶]Ñä²®Ú¬¨Šêñè-Rè4Oõ¾tè§ì9ïáä´éœ…_9¦Ï“éÇ5Uµ#Ê¢I¶3‰Z‹¾ˆi¥W6ˆ©¶ûñŽÚÂ=ƒN®ÆAI&“ä’"¨3ŠàQVNüqª˜R‰<¿¥
l -bª©éoiY~ÌÁõf- -ž³ŠÚ/ó›_Þš×ÐÌ?ÜóøUÇ+÷5%Þ£Íÿ»Wµãìä‚Å ¡ìPgØéQ–ë»JY”(oVë2{<±*‘°HA?KW‡ ¬gUR±H@äëQ6ÏQacáô:}=Ñ“s•¡0btYGèä •.Ý[6X†ÈC¡¥úFŠv+BñõªüN={¬Š¿IjÈÊ/J¢¾•}š"Ù[·n-æÅcÕéŒ:Gol’†RPÑcR¦t|AKBÔ¸–t(«%ÃÙ -Ê‘* +xÚ¥Z[sÛ6~÷¯Ð£<\y™}rçÒ´v6Rf·Ûö–(›ŠTEÊÞô×ï98 +Y\!O^ýöŸ¬`?]q¦`µÉ<p&ÒTN6WÚ(f´R~¤¼š_ý³[0˜µ¯‰B›„©£ÉÀšGé°À8ã0‹µ`<¸˜Có(ج¾~gL€‚%©Î,¤Ê6yû}›KDhÍbc‚‡˜ëPÜ©¦NY¬¢¸ÏÞ|›/‹ß9—yÇ%Óö)§NýRå;ì¦SË
®Pßòï×Bˆ)œ°ŠÌtAãéô9+÷‡w¬Tp#EÌDlÄ€Žø6œéTiÜì›––Í`bGýGõ?÷w·4ò;7|]»é—Ì™6 '3jŒ´+’RÔö¯ºÂ•Ra÷e‡p!PØ× +Rúb‚>Ý;IWffB¥ðR2•èähSGœÈˆ nú +5⛿R-Ú£HÓ”lì[·P’%ÉX +Š±—šê_*û{#oÜ÷{ ñ4yȨ°ƒÑºr¯ÛTæ,ç~–ÛPb&#Åb.Gü4CQ
•¿J±ÔV!¡7vÅ鱸·û‡Ò«òÑGL—ÜŸ$‹ c¡ƒÁÆž15:eKhÌt7Õcì¸÷{üŒ‹2Y4 ¸¼Kþï0ÌNÇ&'r8sZ)’qLá&WǬ¨”Lb8åý6A&Æendstream endobj -1787 0 obj << +1794 0 obj << /Type /Page -/Contents 1788 0 R -/Resources 1786 0 R +/Contents 1795 0 R +/Resources 1793 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1791 0 R +/Parent 1798 0 R >> endobj -1789 0 obj << -/D [1787 0 R /XYZ 85.0394 794.5015 null] +1796 0 obj << +/D [1794 0 R /XYZ 85.0394 794.5015 null] >> endobj -1790 0 obj << -/D [1787 0 R /XYZ 85.0394 181.7045 null] +1797 0 obj << +/D [1794 0 R /XYZ 85.0394 181.7045 null] >> endobj -1786 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F55 965 0 R /F23 678 0 R /F39 858 0 R /F14 681 0 R >> +1793 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F55 970 0 R /F23 682 0 R /F39 863 0 R /F14 685 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1794 0 obj << -/Length 1916 +1801 0 obj << +/Length 1931 /Filter /FlateDecode >> stream -xÚ¥XKwÛ¶ÞëWhqòiˆâE¸;ÅVRµ±ìk)ç´7ñ‚!‰-ŠH9U}H‰2¥§Gƒá`æÃ` C?2Šªa¤8 -1 ‡Ë|€‡kX{? Ž'h™‚S®·‹ÁïX4TH *†‹Õ‰,‰°”d¸H>Þ"Ž®@ÝÌæóÉu0Ÿ¾Ÿýÿn6¹ -ˆŒH4ßßOf7Ó_¯b`fŒG·ãÙÇñK»¿Rt4~?™_=.~Lb§ÊÌŒV_Ÿñ0~`Ä”‡_a‚QŠó -9c-%Ìÿ랬6ŸzÁ Q&¨
Ê|h„ - KÅF# -CÚyýáãÍÄú@UǵÎuQÃ5ß``h#N¾-Å!Zh·»ôyà©”`r/ǧðÂ,ÎÖåìÈÍ”Œª^¦†{i—ÍPgIeÜXâÑ»Ætà+Ÿž¯È(-÷•ûN/÷ æ`¿²€ÅUYTo€"LZ%¶ª$¥vÔ¢¬-pè‰3à6ñ³¶¸u¡wqf'n›Äζz—§U•–…Ï·%–PŠ"ÎÄE_Å’Pljßé1‹¾ãd8‰z'(P°%¶Ù‰5µñX3]èÍ :ä¹®wéÒL£‘.–»Ã¶³Œã6ÜûåÆ-¸M~º_·7á8!’!€ÔC\?ëÂÂZoÊýzÓŽÝ1l÷OY£ -÷™2ÒÂÞ©-!¶‘ÁSZ› ÄîùØRš@±ðÅÚÈŒsæpMìæ\öî A8"Ü þ3η™FË2÷h*B…¬å}cDóv»fYù5-ÖvK‘[8aík¹ÏKrìàÞ{ü×£S@…@’çôIQÁÍÀʵ9O™(ˆíACx²ÿ -29ÏbÃÙæýH÷û<Ÿ¸ì7þ0¿»|«ºUº.Lv6¹XštéÎ…ŸÖjR"©Â¶äx;ÝØ”Û0ÉÓ"7‹ëæžéA¯´=bé<í6.ö[|HJDiק - ØîÏ)eÌ$˜¿P½}}©ûߦ¨endstream +xÚ¥XKsã6¾ëWè°¹2D +©=h„Ô‡—HPXÒh,6J€“G¬D¢(Œb¯yÐê`˜zòBC,-ÓWŒÃ\]‹Ñ²*›$+k3Kô_¤Ñ6ó_&¿™ÁîŠÄ#µ¬ÚÿÔКMÒX!IiOÊ +i¥ì÷eÕÀ"Ð7¤Ø&yV¯µ*Õ.ÉÍÄn“šÙV튬®³ªôâø¾#y€dˆðõ·}4B‚I‡vR¦~‹ÌÅwY„s)zÑ(D|”˜é‰°G5ž +k«wÔ‡¢PÍ.[š©*—»Ã¶c›Ï:CZ™õ~¹±Ò-å§ÛñµuOÇ' VíÛþÎ@ªžUiFͦگ7nl±Ý?åZ
=Ö ¢=x;Ñpšew²VìŸ{àÉÁë‘Ň;VÚp#I9kÕ™ü:¾½ÿ4ñ Œ`&¥a\èx +·9¤ÄwEÚ=˜¿HÄÁSÖè DîùØPš@iAÖsF ¤U—Äl×èØÞD_Afí¨þ—Û\¡eUx4Eœ:^.en»æyõ-+×fKQ8aí[µÏSC²ìàä{•þÛ£S +âh=×OËîg +ÈCAbþ[Z“ù€,Áršœ¦GoѶZc¿œ&î4ÆOÊÆ:‡‹…;ƒŒ«Õ‰¯e +ß‘O¶ýåHIôÆô‡P/ë;mÓw +3wÜw‹¾|1Ä0
9ûðzŒCº¿´Q«i/}»£2ºPð:¶@PÄDº uæŒgb lË7ƒ !q—„»
L ò8ã'1ùdóóñŽPxXte€ïÊSïêÏ'6MŽ?Íï. +…!O%Î.J¬«$€N5KòóÚ¨A‰_Ýê¢thÖÇjw^„9E˜ž6kΕÏB¡Ç¯<mÛvž½ú7`ULU¤êùÌýÆüàõeÀ›dל»áJ ¨+:©M7z>«´“ŸC7•”ûëÑV_±„l&edkÛ`a¸áN#„½™Z<‰¡é%“›Éüúaz¿˜ÞÍ<õíÛu•''‚MiÈܽԌ:;Ö–öÐþëÏT¹œŒ¦!¹öÖ2ÎL–„Ó, +!@¿‹zª"Ü]¢üüúòÐù‹ÆqèYL£h•ÒÇ$˜½RÝ=Ô¾Öýÿ~·endstream endobj -1793 0 obj << +1800 0 obj << /Type /Page -/Contents 1794 0 R -/Resources 1792 0 R +/Contents 1801 0 R +/Resources 1799 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1791 0 R +/Parent 1798 0 R >> endobj -1795 0 obj << -/D [1793 0 R /XYZ 56.6929 794.5015 null] +1802 0 obj << +/D [1800 0 R /XYZ 56.6929 794.5015 null] >> endobj -1796 0 obj << -/D [1793 0 R /XYZ 56.6929 635.5323 null] +1803 0 obj << +/D [1800 0 R /XYZ 56.6929 635.5323 null] >> endobj -1797 0 obj << -/D [1793 0 R /XYZ 56.6929 476.3563 null] +1804 0 obj << +/D [1800 0 R /XYZ 56.6929 476.3563 null] >> endobj -1798 0 obj << -/D [1793 0 R /XYZ 56.6929 407.9215 null] +1805 0 obj << +/D [1800 0 R /XYZ 56.6929 407.9215 null] >> endobj -618 0 obj << -/D [1793 0 R /XYZ 56.6929 365.2162 null] +622 0 obj << +/D [1800 0 R /XYZ 56.6929 365.2162 null] >> endobj -1799 0 obj << -/D [1793 0 R /XYZ 56.6929 326.9947 null] +1806 0 obj << +/D [1800 0 R /XYZ 56.6929 326.9947 null] >> endobj -1800 0 obj << -/D [1793 0 R /XYZ 56.6929 293.3376 null] +1807 0 obj << +/D [1800 0 R /XYZ 56.6929 293.3376 null] >> endobj -1801 0 obj << -/D [1793 0 R /XYZ 56.6929 221.9809 null] +1808 0 obj << +/D [1800 0 R /XYZ 56.6929 221.9809 null] >> endobj -1802 0 obj << -/D [1793 0 R /XYZ 56.6929 108.6903 null] +1809 0 obj << +/D [1800 0 R /XYZ 56.6929 108.6903 null] >> endobj -1792 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F39 858 0 R /F21 654 0 R /F48 880 0 R /F47 874 0 R /F53 957 0 R >> +1799 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F21 658 0 R /F48 885 0 R /F47 879 0 R /F53 962 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1805 0 obj << -/Length 3193 +1812 0 obj << +/Length 3191 /Filter /FlateDecode >> stream -xÚ¥Z[wÛ6~÷¯ð#}±¸’D÷)mÜ4mâdk·»Ý¶´DÛl$Ò©8Þ_¿3˜o¢¤œ³öƒÀÁ -iÏ—›3q~}¯Ï$ó,ÓbÈõíÍÙ×ßëôÜÅ.QÉùÍÝ`®,Y&ÏoV¿G/?|¸¼zõæßeEôm|±°BDï^^ýòò-Ñ>\8½|}y}±Y*S`2È–ˆèÕÕõõåw‹ë7¯¯þóþêòâÏ›Ï.o:Á†ÂK¡Qª¿Ï~ÿSœ¯`?ž‰X»Ìž?Áƒˆ¥sê|sf¬ŽÑ:PÖg×gÿì&ôú¡sÊ°:‹m¦Òm(y.eì¬U#uX'Zi¯Ž÷nÞ¼¿ºÞÛ‰ˆ…¥JÄN¥jÞÌ´r……g̸pÝE>]ÒéXëL_20Í,©K‚Áµtv¼ä¯RʨؖwÏdè|½¦Æ}QÛ¼-VôØ”÷UÞî¶2‹Š&>¤›$sq& qT7C®Ãºé¸¼n–¸ä×ß[;à”"Vl+<Ër7ÍT0©l,m–—¬ãšm¨C©Á%cÙ®‹eù‡ªhHYíCA
ˆ
jl¾YßM˜þ[WÅa…Ú,†ÅN)tÀuD¡Ë+ôãœBeœ9«Y¡‹ç=uJgIjËÕqÍ6R§-4ÎP²›'"r´¼½Xh%£¦ÓðŠ(šoä
ÿŽèÊûkYÝO¸Xo;r^=Oúa ß7ˆlJG7%Ï^?¶e]Q{“ó·Å¾p .ÈØ •¡g`S›Ýº-×lò¶Ü"iãDwÂæ®#6\Þæë›»¼?e“¯êM^V{V·Z$Ç%ë¸fDȦËöšñ”4§Jlôê-ž;¿)Z¢‚€Ä´Z•d¤¶5Q)® áŠ=+ ºü
Z’ÇV+^⺛í®-Ú½ >Ö†ïGW@ZþøXT«`jÀ
‘X7¶µ—dáU¾)?ùù²ö¿«Ã>aS§žHûÄë°Ot\Þ'V'q`Un‹e[o÷ÑÀŠ8…“ø¨piF¸‘WX§Òè±toëú#)êTäÕn0Ê -™WhÆPì+7ÜùôPT#~=J$þóÏP)PsßH@¼Â†‡~Ê×%f¡œåÃ9–yX „`D¦d -ШâÂ¹ä ŠëÎc„ß”ëPß
N@VÚvדÉÆa&˜ÁN_q5Ü6’w‡UýôÕULm7ì7
•7gS¯‘1Ev -å9@KÒX¨H‹1£”R1TÒrl}–àPI§xŽ½Š»¬üfûrá°ÿk“¸lrñŸÀåýça¯úÿ6æÄ’ifÉQõåÀìdÉÛ²jùÀÏ9x¨·¬ˆf·ÙäÛçtÅW\å>Àïw›¢›¸e°i@¢ºk¤ªˆ] õÐofì—š8qnäsÖQióº™Éë°u:.oòÔU¨²ØB²Ÿ˜€fÀvT¶ŽkF¸qb’@;•céþÕe9ý<Òéñ©¬wÍš–ØöZö’³‰Ç¼iBoÎ4x8 -5Ÿ›ø»MlÜÆVât£&¨!Á2Îe3Ê›ìx¡Á V‰É¥Y¸bgÕÍ4Õ^®Cm–ðO9sæ<ø7H~G—“ÒÁExXÓ”n¾z fÝe5*D0³ö¥…êJ‹œæ …-PƺKbú$åÎ -¹öwÒ î]"W|+±?Ö\HýÉšÀó!ÄÙì¥(Jྸª
œ‡ý¢ÀÓºv©>o1òËÑ>µêò¦P05¼ÖèÕb¸ÄÏ[®§%TnJMêé^XÒ56.ˆ†¹*0WE§5"T@̉'ÄP`þp*TòDÀY|Ô'証¶ô«a“(y˜¯„ÊþnÈ t:sóÄ°§?ZíŠîðõ¿=~t×Øþw]4ÝtÎ4ÚÞF³.èØçDà©Þ…Û׃Á:w2K¼ú–öDÞ4ä:|2w\þd~s*ïöÇØ”¿!''Þ ¤ÊGåë¸fΩŒ
$Ýc oBNÍ"@ÛpÂmû„›SPì£Ó‰!…<ÚDê¦)o×1Ñd
'Ͻ/ìeZIœ&"d¾@åÖŸ[ü <Šs¶óaã+Ýù¥B’>Žp‹L›Á*ÛüéÐ"ÏËLMóù²üd’Ïó-®³ýyïlhÛ2ÔO† ô¯ÚüÕÔ y)<S‰- -zh¬ž«|S.é!¤GØï\ótˆ0ÜâW»Í#H¢ +xÚ¥Z[wÛ6~÷¯ð#}Z±¸’D÷)mÜ4mâdk·»Ý¦´DÛl$Ò©8Þ_¿3˜o¢¤œ³öƒÀÁ +iÏ—›3q~}¯Î$ó,ÓbÈõÝÍÙ7?èôÜÅ.QÉùÍÝ`®,Y&ÏoVD/Þ¿¿¼zùúßeEô]|±°BDo_\ýúâ
ÑÞ_8½xuy}±Y*S`2È–ˆèåÕõõå÷‹ëׯ®þóîêòâÏ›ŸÎ.o:Á†ÂK¡Qª¿ÏþøSœ¯`?‰X»Ìž?Áƒˆ¥sê|sf¬ŽÑ:PÖg×gÿì&ôú¡sÊ°:‹m¦Òm(y.eì¬U#uX'Zi¯Žwïo^¿»ºÞÛ‰ˆ…¥JÄN¥jÞÌ´r……g̸pÝE>]ÒéXëL_20Í,©K‚Áµtv¼äoRʨؖwÏdè|½¦Æ}QÛ¼-VôØ”÷UÞî¶2‹Š&>¤›$sq& qT7C®Ãºé¸¼n–¸ä7?X;à”"Vl+<Ër7ÍT0©l,m–—¬ãšm¨C©Á%cÙ®‹eùAU4¤¬ö¡ Ä5H6߬ï&Lÿ«â°BmÃb§:à:¢ÐÀåúqN¡2ΜլÐÅóž:¥‰³$µÇåê¸f©S‚
g(ÙÍ…9ZÞ^,´’QÓixEÍ7ò†Gtåýµ¬î'Ü@¬·9¯ž'ý°„ÎïD6¥£›‡’g¯Û²®¨½Éy‰Ûb_8Pdì„ÊP
Œ3°©ÍnÝ–k6y[nŽ‘´q";aó×›.oóõŒÍ]ÞŸ²ÉWõ&/«=«ƒÛ-’ã’u\3¢ƒdÓe{Åx +JšS%6zùÏ߈Ö-QA@bZJ²RÛš¨WÐðVŞ +ˆÄŸ/‡–ä±ÕŠ—¸îfG»k‹v/¨µáûÑ–?>Õ*˜pC$Ömí%Fx•oŠÁO~¾¬ýïê°OØTÁ©'Òã>1ä:ì—÷‰ÕIX•ÛbÙÖÛ}4°"Ná$>*\`šnäÖÆ©4z,Ý›ºþHŠºyAµŒ2€Ç©ëñ +}Äsæ†l@ÛD2†ê:@59ûdV-ã<tnû“™m«,äSü‡¡dß9íu¦526J&'L;à:bÚÀåM{?“Od.9±d`šYr’Odi:YrÅxü]Ï:yoP:Êõª? +C·g®7ôĦõm¶«Ñåç²i=¤Ÿ\ñ©ÉÍí(ú6õ§bu8ò ËÐBÙæp1OàòæiN¦4M›oÛžû¡Sš$=.^Ç5#ß(ø؇n¶Ëk|b(¬BcEæš1ûÊ
w>=Õˆ_I ÿòT +ÔÜ7o°á¡Ÿòu †Y(gù0FŽe^Va +îÝKÈèEEÌá†ìÒóRË˧ðxZ•Ä¤=åö™×§Ÿj·¹
¢•<ÿïð÷öíË…ß‘Ÿ'/üñíÛëkô÷4ªê6ÇCïxVÉH ø³ ©1P³!¨² +<²‰èw<bÍ9©†-&&ù'µ.NS›1+{¤Ñ +S|=R‰ +’Uc3®è±G
PÅ…sÈA×Æ¿)ס¾œ€¬´/ì®'“Ã>L0ƒ¾â4j¸;m$ï;ªúé««˜ÚnØ;n*n&Φ^#c8Šì +Yw9ÔαK[é§>qA2ä:Œ]—Ç®»Ùb9ÉtÐT½kwíâ®\ï£$T&Môqñ:®ùÆé™MÓ±€¾LÕ2‰ªÿ!£
4˜†…&þ’M IX"úºç…Xh¡Î¥{`mÃÄx‰âDº¥‚\+ífÛƒ·/®XÓ3Ês€–¤±4P9cF)¥b¨¤åØú,Á¡’Nñ{wYùÍöå–à‡}H¸X›ìÄ…Ëëˆ.ïC{ø¸1'–L3KŽ*0Î`'K¾ß–Uˇ~ÎÁC½ee4»Í&ß>¸Œ k®0¸â¢,÷A~¿ÛÝÄ-ÎHÊ8ÀÕ]%U
Àì-ˆ¾3cÃÔĉs#?˜³ŽJ3˜×ÈN†\‡Óqy딧®Ã@•Åªýä|4¶£²u\3““Ú©K÷¯.ÓÈéç‘NOe½kÖÏ‹œØåì[%'yÓ„Þœi>(ðlj>5ñW›Ø¸-† ÄÙ +ÿLLƒí2fFo“Í.t»5 óQ ‡ÖqRÝL3ýçå:”a ÿ”3gÎS€kƒäwtg0©\„g5Méæ‹jaÒ]V£:k_Y¨®²ÈižP×e¬Û¹¦ÏQîàû®õar!h„Íf²Û,/ƒ½·LæÑ4b¸7“ºçV¿OeS»iÊUA#W¼rM¿·¼ª—’®Và©©ëÊOæ<4Ìå.íñ{–Çu¾ä*Ä…PK´ëÏ2 ‰Rw¤H§‚Þ›Û?5ÄÀn¯£¿wq ñq
{ÛnÒ’Ü·[-™~[´OEÙ€{ôª‹H*T]vˆÍþ2ªk%
âÞÑrÅ—ûñc- …Ô_« <B†?{'Š¸/.jCÈæa¿(ð´¬ ©O[Œür Ocº´)ÔK
¯5z³îðó–Ëi …›R“rºV§tK„Í„ëa aªŠLUÑisâ ñ”˜@‡? +…<põ :*¯-ýjØäJæ_+á°¢¿šr endobj -1804 0 obj << +1811 0 obj << /Type /Page -/Contents 1805 0 R -/Resources 1803 0 R +/Contents 1812 0 R +/Resources 1810 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1791 0 R +/Parent 1798 0 R >> endobj -1806 0 obj << -/D [1804 0 R /XYZ 85.0394 794.5015 null] +1813 0 obj << +/D [1811 0 R /XYZ 85.0394 794.5015 null] >> endobj -1807 0 obj << -/D [1804 0 R /XYZ 85.0394 751.8312 null] +1814 0 obj << +/D [1811 0 R /XYZ 85.0394 751.8312 null] >> endobj -1803 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F55 965 0 R /F39 858 0 R >> +1810 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F55 970 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1810 0 obj << -/Length 2888 -/Filter /FlateDecode ->> -stream -xÚ¥Z[sÛ¶~÷¯Ð[åi„âÂpÞœÄͤi“œÚ霶´HÙ<•HU¤ì8¿¾»X€)’>3~ | -<(ÎPaXœ€*¹Åü·lÛâ@°ÞŠJ³4ÆÁê}[ÖhÈðe³/ÖåïœË¢m–õ»¥lû©¬òú‰ÚíCÖð©Ün©ï® ç±)rkkê9d0sW~-üä‚Æ›ò¾ÊÚãáRè¥+¾ìK÷äei¦Dœ,VB0ÇÒJÞ–»â™¶}86Ôjö4/ËËꞺÊjM}»¢j³Ã
6….jßUqÈœN ·~´'ÇM`?fåá H -úTd›ÁZ‘YnËMxúÕé/ÒËlÛÔÔÛºgS{\ñ¥©}r )Ú†~?fÛ2ÏÚúиuªÜM/ ¢CÝ=»Î «>º•×ÙšÜÇž#P¨Õº=ºU«Z–¼R°P¹¡žmf×½·*“Ë긻£½a¬ÞPçÏ?ûéúòºú¦¥îÀ¦vȺ<É -@=ÄH,õ ÔĪ¢ ÇaìL›X¹ P÷ðB
¤‚p¥°æ¤ò˜s©ÂA–Eq÷ĺ ƒŠbÒ–Š"çeÔ‰NFƒÞÁ¡!p -¾mÄüîjdûž -ÍÍû¿u1»ª»—›aŒ¶þiƒµóO;…ü3fÔ–H&…‰^P[€šQ›GMúKOw -^8m’y:Ôˆ=Ý·F)7}!Þ‡dêh̶MGÊ~þþ
5„ÑÒeÌCÙ>ì€6›iå*É¡æ• f”ëQS¯M_·HºŽæ%èP#"ôtK6Hû2ÜÿX£ž~t3ÂÁzã'ÕÉ=ArØb_¯&UÌA4-_`!j:Qu(›¨êqþ¡¢4òEÉ¡¼/«3 -\Жƕ€ÚdMK¬BD¤ÄòÎ: ¨Eiwƒà0TŽâK›ˆw%U¸N!‡œÕ‹/SiÅǸ•¦N(™ªÓ… -j -¨{’A½Ö8y^Üïï»*× -62hˆˆëT fTæQVe_Ïœ(bÆ=¿¥lÙs"h¦Jô·|_ÕáÇ”7ºúFeNþ¦ÞEj8š`!lç
yçóRi]JÁ¤”ê]¨]zÉ C“,IR3¿µlêü0‰Àz[w3¬Ã -š¦{iµ{{È-ŸÍþ -X„؂߆µëú¡D¦$}Ði^uñSžì
ãöÐð´‡–þÐÐXcùx>öMz~Ïç¤4P%êó¹|NùO9¯Â/–°aàû(vçû8öDTÓ‚>"x¤Ñýb lšc‘ÿkDÒÁÿ8?Ä—Š¼?áoYí3<†íÈïØY߇ ‡}û[ …&ŸúGøß-#±›w‘äÿþ'šÓ¿E)SZOP3™ÆÀZ í„B…€c';÷ï6ç²ÿ
3íðDendstream +1817 0 obj << +/Length 2975 +/Filter /FlateDecode +>> +stream +xÚ¥ZÝsÛ6÷_¡·ÊÓÁI +3wÅ·<Löº¸/Óæx¸f鎵X™˜›„`6†RšÝäD‹üxå›ÇšZõž iV”÷ÔU”kêÛåe“n=®·©ë¢ö}^懔x‚½Õ#ž<ìÇ}3L&I컬Ùå¶Ø䈧_22Ët[WÔÛøo]\þµ©}t (šš~?¦Û"K›êPûuÊÌOÏ@¢GÝ=ûÎ «:ú•×éšÔÇcÈ`wtÇVµ,*œ‚…Š
õlS·î½c™\–ÇÝí
cÕ†:?†kêû²ªü®¡î¾øÔ2mèëô +ε=Ð(´d‘0vžÈ5BeOÌZ³äÙ'Ø*âzyóñ +É’H¢Î jl#ïÅÉt?QòømÂhÈQN¸Æ7+ˆ]ðûU]wÛ¼]V¨éGzò4Ž®,øΓ¾ÿ2ú+Ï÷øs§àÈ-œ¸û¹W5hŠW#»DÜ4¼]=”óN[Ć)Ó +-ÿùªÂ2kÕYõX_ѼL-Ê™…HËO8ÓT
Ú%Œ\ÀÙ€ÜÈŽ*A +駎fØ–p¦¹’/°ƒša[@MêKw +.œ±É< -j„†ï@[#ÍmŸˆwÝêp̵uš}þñjk¤÷›‡¢yØA𴮧™«8/’˜ÛAÍ07 ¦®MŸ·¢vÍSТFHèñ–d û4Üäÿ˜£!igt«M˜OÂdP!Í÷ÕúaÒQA>Å$0jÞQuQÓŽªE9GU‡ *Òmjr(î‹òL7X›yÒZÔmý(Ä0¹dŸ¸ÛÀÈo.Ppltĸp˜/ßm¶ã”9e¯†²hc½ ‰æ|uœºõíÂË(ëãng†0¶]#Ð5!?¸»Œ+#çå×EM˯E9ù}|)Ѐ„cl¦‚ŒÈà‰ç lQ#ö¤¹7Ü$Ó'ÑIQiîÝ?¶…ŽÚ3D&µƒ·¥I‹²€èÍvµsBÐmt$0~ +:N»Ö4u&èÐwsut4N8oiDã1‡×žÑ(!¶LÛÓDXü>Mí¡™@C: ´8“ˆè
ë f4, œ†í‡[& ãV¿°e +U×ëì$Mé±°!Љ=¾úUSÿ_ùó]Eúžù‘|;¬r©¤SÁq@ä3 +½\÷øýb,ö…+Q`É3ruZø¬ÒCº¦R-àˆy oëáî= YµæǼµã¾¤ß;¿»/ìBOQ‚R¤YŸ”fX[¤«ëùîã§6¾r‡LOU¶ãX][ˆ˜Å"žÈK!Ïid…X”Y±N›¼në{>ZëË‘jÄ.p$=TÇmÖ¶ðÌÓV‡k–Dò…«‹š±:å¬ÎYÔ”(¦¤¶ó[ÐÈ–]^%†)nUËO‡"$tu÷¿Æ<¬_Ð\W»ý6G¿1ɉ5ÉãyŽtQÓiQŽ#/&
Ûü1ßžÕ-5–\ä<a4BX?cY@æØ£²¶z™gùÝñþ¾ÍuaÓ,‹ ڲ慂`5ò€r,ûv¦D³V˜ù-hdËžAS+ÑßòÝ}YuVÞß¼o³•zv„ª;ÜEjø0Á1LØÎ& +ÊÒ A¦y) J¿p!»¨^ƒo@‡ +&Y’h;¿u +e nYÝ_Ö“ëT=]èObžÁƒ] +×Ä‘«8½RHiñ±üýõ¿©“HXÓ}tÕ +¿öˆÖšÑX9ø*øåfCbDk7•ùGÅuSž/…ËSæ4¹öÓ=[®ZÄ?G€NÖæÏ-Ï7hÁú'¨'LJM_ÿvõë§_®G"8„ìÃ%kœà“Òv[=7 þ§º#&Âî_S³ ý‘”;$oŸP
À%³õh´Œ~Þ$4²Ø¢y Í›@ÔÛ›+jQ††
§ãóòÈËú +cß!+kÈ_W°L
wáŽÆ&¼–aã}ç$ì{pß
ž‹˜OCN%C7å;Œj!K}ö?vǺ!ȇ¢áHæî(wí6 endobj -1809 0 obj << +1816 0 obj << /Type /Page -/Contents 1810 0 R -/Resources 1808 0 R +/Contents 1817 0 R +/Resources 1815 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1791 0 R +/Parent 1798 0 R >> endobj -1811 0 obj << -/D [1809 0 R /XYZ 56.6929 794.5015 null] +1818 0 obj << +/D [1816 0 R /XYZ 56.6929 794.5015 null] >> endobj -1812 0 obj << -/D [1809 0 R /XYZ 56.6929 136.9875 null] +1819 0 obj << +/D [1816 0 R /XYZ 56.6929 119.3275 null] >> endobj -1808 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F39 858 0 R /F21 654 0 R /F55 965 0 R /F48 880 0 R >> +1815 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F21 658 0 R /F55 970 0 R /F48 885 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1815 0 obj << -/Length 1618 +1822 0 obj << +/Length 1544 /Filter /FlateDecode >> stream -xÚ¥XÛrÛ6}×WèQš‰ÜIôͱ•Äi#»–Üv&ñMA6‰tIÊŽóõ] -2̧˼ªt:©²»ü{‘k‡ï-Š%ÌÁÓrLâ‘Nj]y•ÚjüŒ1]»ï™ê|/¢Œq¯ï9Ûx½zÐJ¨@‚*¯(ÂHÍœ^§®YW÷Þ¥ltëö¬+Ýü4N›0Ž‘Œ¥ç¤„ h§ÚÅ#Ë{ÁhâÂ'Þh¬îåq ã(¢Ìž'½„£æ«À!%ETJá öH¨
YkäÊD["«£XÊæƒùtjí8ùm~,¡ …E7Ô_õóÎ?ccø8Šð^nÄÎή7ç³3«G9uËM–g@Õ¤.J»uå]m¼i·>&ù6Y‡B+csléćàpØ–sWoODˆ¯ÈãQ.HË”ÿ¨(V&ôÿ\/Þ_\sœtéUë2×.øóç -¸PÙ‡Ó"¯Š²Î¶›ZŽ—ÔÉáa¢lu„RUCElX1IïuúÕSÀ™DKž$lƒzEc±£WGPcÔgJ#»j^û”‚Ým!jYá¼Ë"àøs^'ßØlQ]ëW±ó¦P–ŽÏyñPA‚în Õ—A 唀Oc*´PͦH[†Z-fÒa[’ -áôÿš<ÞøÕ—vUÛCŠY#ÞŽ|Ž.³R§Àúç@æŽ$my褮²µ6&xßoÂüd@N—ŸgÓùéÕùåâüb¨ã{Ù Ô~‚ÂO•/ü
²Úë0–¯ìÃíÖ1>/ê}œ†~Vgiõªßª’Ÿ¡]8S½•]G\4>˜¿˜-h£ˆazœ;]”mà$Àeô¶Œ¤BЛ¢º¶ÁЎעÖõX((RœË¾yé}Sr‹&<0JÕE€•P¹daúöt iêÛtU8‘÷I#\@ÏK×Û¥¶Û §)öi=6“@ðŸh»ñ2ôð¶8°N¬‹~°gI54©¥{_Ù¾M o%d¿ogŽså8m±nŸûÓT¶ÉÖI¹~öUÍû˳Óv烼bE’óðªƒ:Â+jxõ¸¯R1Óž~ Òƒ*»„<Ž¢=•—»Q³ÍâG]VmNv§Í—ÅnÄ9–Ý©æ'Šî]™l\€ü4¬¿eõá +xÚ¥XmsÚ8þίàËÍÀ´VõbÉöGJH›¶!¹@çn¦Í¸5rÎ6´ô×ßÚ’ŒmÍÍMf‚-¯wWÏ>û"“>†?Ò÷9Â,pû^à"Ž ï/¶=Ü_ów=¢e#ä4¥ÞÎ{o®™×P ¨èÏW
]>¾Oúóå—Áèþ~2½ºù{èPŽoÑÐánGÓÏ£Ojí~ÐÁèÝd6tˆ'˜B¼x0ÝN®œñûÉøãønz=|œèMæµcMç f¥Wÿô¾<âþöð¡‡|Þÿ7‘ ýmÏåq—1³’ôf½?k…§Õ«608ó÷©gC#°¡Á$eÛ_Ê<N¯å¯TFjÑYëßTýF?Ãís¡EºÕo=¡“µ¯„¹%,à›C +8§•¡
Iô +cöŠxÔõl¢mµ¨t*Z¶‰vß\ÃVŽ»,E|$|W"7RÅ´ØDå„Oé~HúNÛy‘†¢ @„ø.(¬|ê +Wo6™(´FŸfwöúAÂPF›yá[Gò+,ûðèzᶚ
A.6åâíÍôJ™ ´µå6–q^d!G-=4óK-݆r&¶,~™B«·ÙwQàS®ÇJ#åŒ[ô¹Q—“ºhXpshÀ‘xmøFŸçïï~Û„”‘fæìCuÐiœÊ<ÍŠx·=šus… —K‘çCå€Dº0žTuÂYl¢ÅwS,ªØrä îUÂS9ãZPª<Ö›†U%)õÔUõX'X*ËŠ³ÞAÐâTZêéAáO-\*ŒåZ'iš&/!ãA¦Ï9T¬Î!``Ð +†ÖÎ +ÁœâÙÑô¸¼-ý¢sµ”Å»9E늶{ãMUsÓ2>e›=å¥3•/<;ƒ[F¸@ÐIdžj¥›P«å"Ù-#uslÐñ¾œ+F¥yKË \4…§¼®gˆòF0é"‚N¥Ú"@Ä‘+:3]¨™kâeC°Óìz:´È˜ÇÛ8 ³ä`j›ÁÌPT
mg¹I&°`¿áVCê·ŒTÅ}×dÀ G‰ß˜4B“ÍXÂ)Ñ÷¼ŽÉû,–ÝTÞôW'¦ÉãòéiÅS r],šÃî¨8:¶k˜1u€¤Ž@ô3.Î endobj -1814 0 obj << +1821 0 obj << /Type /Page -/Contents 1815 0 R -/Resources 1813 0 R +/Contents 1822 0 R +/Resources 1820 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1791 0 R +/Parent 1798 0 R >> endobj -1816 0 obj << -/D [1814 0 R /XYZ 85.0394 794.5015 null] ->> endobj -1817 0 obj << -/D [1814 0 R /XYZ 85.0394 682.0055 null] +1823 0 obj << +/D [1821 0 R /XYZ 85.0394 794.5015 null] >> endobj -1818 0 obj << -/D [1814 0 R /XYZ 85.0394 616.549 null] +1824 0 obj << +/D [1821 0 R /XYZ 85.0394 562.7154 null] >> endobj -622 0 obj << -/D [1814 0 R /XYZ 85.0394 575.9131 null] +1825 0 obj << +/D [1821 0 R /XYZ 85.0394 499.03 null] >> endobj -1819 0 obj << -/D [1814 0 R /XYZ 85.0394 542.1583 null] +626 0 obj << +/D [1821 0 R /XYZ 85.0394 459.6249 null] >> endobj -1820 0 obj << -/D [1814 0 R /XYZ 85.0394 505.8522 null] +1826 0 obj << +/D [1821 0 R /XYZ 85.0394 426.4105 null] >> endobj -1821 0 obj << -/D [1814 0 R /XYZ 85.0394 437.4739 null] +1827 0 obj << +/D [1821 0 R /XYZ 85.0394 390.6449 null] >> endobj -1822 0 obj << -/D [1814 0 R /XYZ 85.0394 374.9822 null] +1828 0 obj << +/D [1821 0 R /XYZ 85.0394 324.0377 null] >> endobj -1823 0 obj << -/D [1814 0 R /XYZ 85.0394 309.5257 null] +1829 0 obj << +/D [1821 0 R /XYZ 85.0394 263.3171 null] >> endobj -1824 0 obj << -/D [1814 0 R /XYZ 85.0394 84.1613 null] +1830 0 obj << +/D [1821 0 R /XYZ 85.0394 199.6317 null] >> endobj -1813 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F21 654 0 R /F39 858 0 R /F47 874 0 R /F53 957 0 R /F55 965 0 R >> +1820 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F21 658 0 R /F47 879 0 R /F53 962 0 R /F55 970 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1827 0 obj << -/Length 1899 +1833 0 obj << +/Length 1880 /Filter /FlateDecode >> stream -xÚíYÝsÛ6×_¡Gi¦Äრ-ðäæâÍì*¸üivùÏ?oofÓ€D‚’ÉÅÝÝìæêúi@9r Æxòæâæ·‹_ìÜÝTÑÉųùôÃýÏ£Ù}+XWx‚™–êóèÝ<N@‡ŸG1%ùø0"JÑñjr†xȘŸÉGóѯ-ÃΪyu‚e‚ Aɘ¤8§=8¸B‚Qfà˜ÏfV©‹_æ·Zx‹u0Äã€Â{‚WÄ«4y9–ð|géÃ.æa„0c!¼gÀ¾¾¹²ì•Û%YeEV7UÜ”•z›.ÓjJä$-©z›8†‰¨Â±GŽ¤§f@ Gl0…0ur_üvÿÓíÛêae讋&Š´±bÌ·u“®jûpYuY5ÙfµÛ4D,Ôñ Áæ`ïdàNüÆ ,žÒŧ¿Ë"Õïjb&‹„%¾’aј1»ÚA¿cô•ÊÍ–«u–§f3ýžÒÈŽ:sÓÜŸã<K²fkŸÓ¬x´OÞ.‹²xNAa?ß”e>„7îC=ßåºÎêýØ`ER°q¨0!ôeÚSÞ~ÄÑQDˆ -i$Â\ò/IËrßF—¯¨ÿ™,“é«¥ûoÉ¢ÿíYþ5+ŒK¤™öNà/ÍÎÿÏ›ûyÓ<õM³×Q0ÊQȔ𕮯«ÙüòíõÝýõíMûÖÑÎb Ø«÷eˆBy¯2”¦õ`“æÉ”íá¤ÞMü—Œ‹ÄNfг<V®˜g“réÖíª¯ÿ™«ÿ¡eÐä^7vrV:MldpÑS;9ÂI\èɘD„R®Ñs@» ¤r”ÚËQI™jæ2œ¼<¥…åeœØ®CZ5¤UD‡ªbrÿ”ÕvmJ‡D"ׇ’ìŠtúˆ*#›:]nr»ïÒtC0èôH°³Cæ-ªN‡‡TÓëVÖ½Tzý1°g3…!Ù+7Õ®ÅzJWvF-í(Þ5zvT§ôeÓ(ì´¿=·#®/>bµWQ"|ÜYpa›l•å±Ñž@ï7°Ä«¤¡úr”AiL}&Ð
¬”“‡Mc÷Ë»Uœ¿Ä['C²YÝк&¬{èMƒÚ¤Eã J÷¾.<ìPå((<ú°gÚ2àªÐdó¶7fX -~&0Œ”b»[œ€c:ùÝ$ -„ò±ŠÝQï -9k™£PúÂXñÎÑqø=‘Aÿãú1©“ûyšÃýz•¹D -}`™ŒëlæÀ¬›ú(œà?p¬žqçÑq8=‘Ó_Hðž¿ ¨@î#ºRD’@ }J*Os(Uï á‹zbÍõñ´ÜîÁg%9pøÖºS xríÖŠ²9rؽ‡êÿúFÿw&¨ýAYo 6б¯dL7UlHYÜdßüm÷:l&%ÆBË +xÚíY[sÛ¶~ׯÐ#5S!¸’à£b«{;µ•¶Ó$´Ù<¡HE¤âª¿¾‹ER”LÜNÏÌϘ °Ü;>`WdŒáŒEˆÂ˜Æã(æH`"ÆËõï`í‡q4SO4mS½\Œ^|Ï¢qŒâ†ãŪÅK",%/ÒwÁK¢ pÀÁåìõü|zöãüì?¿_]Î'S…”³7oæ—ç¿M¦T` bŒƒ×³Ë·³WvîÍ$¦Áì‡ùÍäÃâ§Ñ|Ñ(ÖVž`¦µú4z÷S°á§F,–bü +ŒxÉ \Ù™úÞM,ËB«x·Û&uVvÕ*m êÒÎÝúîÕò£J!²‹àbeg‹²¶dÕF-3ý½J¿ƒŽƒ¬¶$©Z%»¼®œ¥öä\Ü2ƒqˆ µõZÿª^¾Ðºƒ4 OY¨ƒ‚b!¨!V–YÇ'”¡˜`îx!GAÆͧ+¿D’DÀX Œ
åõ|ñöúÒ&ë/Bã`öêM×^Àñˆ™ýÐh:5þ9¡’¤(¢§V¥í„È@Õ»mQYiIaŸêã3UuRïܪ <‰}dîUm
ŸrëÈ”åkßRU«eR/À
°c i°}È*5ì¯nÇ=7ó¹ýxöêæjÀÆ!§¼ÇKøG¾³Ÿ¶<õgY¨Ö²áÇÛ8D '#>Ž//.Ï-“Ø©‘®³"«jÈßrk§®ÕÊ9¡X:?¼NŠ]’¨KB‰h†¦ ƒË®#fo?^]?í‹¢VÛB¹ˆÞì«Z]¬ÎÊ¢*·u¶[ÄrÄxHŽÁˆðØ(‹ñ‘ûÌÞ +Nò,Íê½}3L³âÎ%š‹ì‹Ï +öóuYæCÇÞÕv‡ßì‹rSeUB +8‡ö6{ÆÐÞP
xo2
!6ï¦é?úo3úÔŒ>7£¥5\t1+ÖgŸOöežTÕ +=×gP[¨Ë&oÀ´ƒ +ÔZµ'(Ý÷NýZz·Ã-'欇—®ñe[c¾6f8×۹ľ¶šdvÞ«:£(˜¥PFge‘äù~BÑf1k“Í&ÏtzVõ6[Ö;³d\erõY啾ÝÛ§kÁi~TGôGô‚ñ„þJ{Ç÷Ú–•»z£½Êìª,ÏíH÷õ²;µ£¤rÏÂ=—µî»˜±õ²5®!vgú¯o÷)A)Ä`À0ŠcvèãL¦Á¯ +cØ¡Qø”—â’7ÂQó·ééœh„aª2ˆ»°+s^7ôÝ5^cAß<zÕoî¬{"-tšöåA¤p=.ÏÓËk{)‚ë~$»òæEr›7]ÕÛÝÝ@,:e3\!àH|ÜäÍi‹1øÓ)ƒÖØÛ6dnKØÏ»Ìw,ÍýÇŒ¦ýöô²Y*‡UèÔÏ:L_wØ’¸I±oþÉçðãÜ}Í¥jÐ` +‡9|z¥´ÅËã`bDYHtÿÑ®vendstream endobj -1826 0 obj << +1832 0 obj << /Type /Page -/Contents 1827 0 R -/Resources 1825 0 R +/Contents 1833 0 R +/Resources 1831 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1791 0 R +/Parent 1798 0 R >> endobj -1828 0 obj << -/D [1826 0 R /XYZ 56.6929 794.5015 null] +1834 0 obj << +/D [1832 0 R /XYZ 56.6929 794.5015 null] >> endobj -1829 0 obj << -/D [1826 0 R /XYZ 56.6929 751.8596 null] +1835 0 obj << +/D [1832 0 R /XYZ 56.6929 687.0104 null] >> endobj -1830 0 obj << -/D [1826 0 R /XYZ 56.6929 686.1725 null] +1836 0 obj << +/D [1832 0 R /XYZ 56.6929 626.5588 null] >> endobj -626 0 obj << -/D [1826 0 R /XYZ 56.6929 645.3764 null] +1837 0 obj << +/D [1832 0 R /XYZ 56.6929 566.1072 null] >> endobj -1831 0 obj << -/D [1826 0 R /XYZ 56.6929 611.5513 null] +630 0 obj << +/D [1832 0 R /XYZ 56.6929 528.949 null] >> endobj -1832 0 obj << -/D [1826 0 R /XYZ 56.6929 575.1748 null] +1838 0 obj << +/D [1832 0 R /XYZ 56.6929 496.7215 null] >> endobj -1833 0 obj << -/D [1826 0 R /XYZ 56.6929 506.5659 null] +1839 0 obj << +/D [1832 0 R /XYZ 56.6929 461.9427 null] >> endobj -1834 0 obj << -/D [1826 0 R /XYZ 56.6929 364.9645 null] +1840 0 obj << +/D [1832 0 R /XYZ 56.6929 398.5692 null] >> endobj -1835 0 obj << -/D [1826 0 R /XYZ 56.6929 220.3983 null] +1841 0 obj << +/D [1832 0 R /XYZ 56.6929 263.2909 null] >> endobj -1825 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F47 874 0 R /F39 858 0 R /F53 957 0 R /F55 965 0 R >> +1842 0 obj << +/D [1832 0 R /XYZ 56.6929 125.0477 null] +>> endobj +1831 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F47 879 0 R /F53 962 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1838 0 obj << -/Length 3112 +1845 0 obj << +/Length 2946 /Filter /FlateDecode >> stream -xÚÝ[Ý“Û¶¿¿B}àÍX¾>^ìsš4vÜúÒfšä'Q'Ž%ñ"R¾8}Ÿ")ÒÕn§ÓóƒÀåX,~»Ø]Àd†á™i0ËùLå LÄl±½Â³x÷Íñ<óÀ4ïr}}wõÕk¦f9Ê%•³»U§/°Ödv·ü9»y÷îöí«oºžS³¯Ñõ\`œ½¹yûãÍ÷Žöî:§ÙÍ7·ï¯çDIJ€I6‰³·7on_Í_þùöå_þùÃÛÛë_ï¾»º½‹‚u…'˜©~»úùW<[¾»ÂˆåZÌžà#’çt¶½â‚!Á”ÍÕû«¿Æ;oí§)ep¡‘ \Îæ‚"-`êI•a„¨`®8A’ë<ªŒ’”Ê—QÙ¼2ýêµÎ*tn8¶õ²*ƒÐº¾RrE®„`¬3¡& U_²wå~Uï·×sÆiöX7i±lSKGû£Þ•ŽVíÚòa_µŸÜ‹Åº\|h̲j•½«›¦ºßxN3™Æqûk¢³ÒM¿§(ªÂDj¯€_(å«Ãfc~=wWz -ME"3xY®ŠÃ¦…&y‘èžsÐJ®½Ï”ÕîadI ©ˆÿ(ÕíœS‰—Vñ(‚Æþ7õ¢Ÿ@!XÙxÇåšðŽ¸¶»sò戳ÜTì–‰~IŽ˜PÝŽw°¢cbR$ÌÈpÀ<…ÝpÀ˜AHÆíË7°ÃUTE/_Ôœu;@؈¬]‰<{ó“£8-jû»lºÄU¹w¼míÈ7î±ÞûGøKu⸖îëví8ªÝ< ^Xºží¼^¹7V'ÂL“°>Ö`>»b[6“`Œà15iîˆêár-`™Ñ Ôz·ùäülИi¿ñþøDO†ø´®ëî{«2óhTf~ã¼ÍCœH@ -TO@…Ì–å¦|(ÚªÞ¹7oß»ßÄDEvÒÏÎzóS{²CÅi'ŽvD…yê(F:TØž -1…E0–÷”e߶î]±i¼ˆÇÉó8y‘=l¥£Ë¥¶iÊfBÕ.ôᇂðl[´‹uPoÝø÷Åòc¹o«¦´Û,…Ÿ‰‹úî=Þ|wxÕfyá)®È³N&îÖüƒÛ=Ö×ëgM½-îs¤—½Åuƒüv¨\cé¾ -+…³ò÷ªi›Ãn«(n¹èÔŠSî?¹kå‹Žê]ÓLÅõºÈ*1ÇÏ
‹8¢šósqÑœ<?€¡2Á˪)lIËü‡æ¥9¢¨÷‡ÖC”i©`±åþ©jüN¹¦CP®ã(šTdG ÂWŠç§‘Ý´ã/¡Ÿ‚]î轩?–‹¶úX‚IBB`¦)âó‹½1¹4 -ájÒ_”æÄü]ø?Là|–$˜àd*ÕåO¥"—M¥VÉTJj¢k“Ï€
“)†‘КOK¹¢õ’)Б^ôd{ËT†ŽÒËãœÌjðòèŽ~Á˜nJïPùÔ±¿ä<÷Œ»-o'‘›§3*?TÎûª\tCü}ñ46ˆB3nB‘D-J}&ñîrM %pY´¼N Ì›qÅÎÀ…"*À'E‹\ ÙúpQ\èá´ߦ™f.†hàbhþ¥MD#:À8ºq•!”fKVà#:yì´qÌãb„"ÆH~‚ÀV˜&£²C%4‡@ a<ÌŸ.P²vòví„!Pã¥g5›êrnýUÞ]kS³so¢a÷]ÖÁûíjoÇ‹âДÁH¼Á—+£ÖxjÏ}ØÛ;¸ÿpyØ>6£>`QïÚr׎»U.%¢fš4”.׸¡D.k(Ò†¢sÁ¦JT#ÍÅ´\)!W¿@% ¡’ÁB*Q1éÚÝÓìÏ]ˆ‘‚-“œ4Éž*›ýiltmÊVEµ9„HÃŒFŒ¹aÞ37`zº -å\|àâKEù3<»Èÿÿ£"P :c–‘eÜ&‹5Èú|fi”sb”œ#ŠŸ)²…ê$75O:RýãZñl_µ'™]HÜ}5ÚŠÎò.´˜9z Ñ£r^ -HÄäù¿oã«-A#NžYð×Äš.»ìMjÙ1¢,ž®7í§Mª¤*“’E®„hýzF„cÒ—íèŠuî³û{q,ÍVÿºïL5Àz[ z¬èüX ä4w|ºó¡¡¿ÆqN%—ð$ÔÅÇo<†§ñ¥)é*$lD*ï ûrS˜JõÈ@Ƭ“ýþJEßßßÙ4œé̈í[¡2msó»uWV ÕªÖx^×x´*ª°)ÙÓC+m
=U‹bc™éÞÿ¾³ò±Øï¬Yì«ÇÖ\uQ"ûaçˆmО7¤ŽÌÖ ´À#H`SNGŽrœñ³ãcRÔõŒyî(Å2Ìû£éÎgíúÐ8Js -N)¹¡4 Í#Ï80=…å«á`¹t‘ûÄ`åd°Î0¤ +xÚÝZY“·~ß_ÁGn•ˆà>ײìȉÖr´‰U±ý0KÎ.Ç&9kÎP²òëÓ8çr#U*m•ˆÁô +ûÔŒŒ±²p¨pPˆ),"|8 lpÖ¯kÿ.ÛU¥o%;€v°h=îNa”l³ñÌVhhÐYâî3ºlØØgµÅ€[ViXH=ê¢ÊÝ&ŠèÀú~¦m‹Ýæ¾R\‘gá›ÌâÛküC;Äš‘6À
ÊrŸGÔ¤¤‘øI~?¾¢N¯§&äѶHìÆÜ#ÉÔ±“?D¾#i³–èÛqÔ×EÎs¬žqD5ç碢9y~øBeŠ~7E•¹’2¶Ú…ÊXƒè½?Õ¾3Ƙ®ì5?~,ªð®„ë)²j,®#ÚC†n†qݼۡŸ€]î惡CjSr0 –|±¦6ûç—ê’Kc@Èé¸&]¥Tó÷ÁÿDÅaŒÏ¤P-¢é*¹êa4’šÅÀÚf1`hý +ÒOÈRù,[‰hÈW7•HH£:Œg²™éT¶]Z®´É£šbÞ:IA®ÃqǬëüz³f<“j*AÃi æ…¬Ú³S“(DHÑ4N0ƒ=‚œ©æµ©f©T¾«{ĸbg°B`€³¬%ªÞºhQœè2—àÂ4´f .¶ÓÂÅö…—.y:Õ¾3Ö¢l«êRàZ™x´òÄÓ‚ +µ¹Ì\Z\p~®ÄË>Ït.ÒÈó +ѨôÌÑi›jš‘ÊAóðYÁÑ,_):ò5uk²MÆœç½&Kç|í³+‘16R"c49_Kpª!ÉùºjIóP5qçØŒç;(¶ô/â²è|;_Ž_`ÚÕ2úµ—t+d¸øÁÅ— +ŠÌ3<»0ÿÿQÑ +I†ÏÜiSM[f¢r–YžOîA£VJëäQpñóÌ%ªî:öÉmÙS«.{?^+¾<õ Ë‹I|¨I»50ӳǯbd
½‰¹¿nþ„œø.%®ñwêÎêòøiZö1ÿ¹MLë_HÄ$;ã™ÛT3úTNÿÕÙK-Uýi—O^j™å¬¹Ô2dmôRK‡·Æ9k2}ƒ;®ÏUÛïleÀù_èXѦ© +rnW€—÷^5ŽWyʹt“øKO—Áñ,#N;Ó¨ó°™»2íä˜ï2[¯ž˜È—b²{É \«èî endobj -1837 0 obj << +1844 0 obj << /Type /Page -/Contents 1838 0 R -/Resources 1836 0 R +/Contents 1845 0 R +/Resources 1843 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1840 0 R +/Parent 1847 0 R >> endobj -1839 0 obj << -/D [1837 0 R /XYZ 85.0394 794.5015 null] +1846 0 obj << +/D [1844 0 R /XYZ 85.0394 794.5015 null] >> endobj -1836 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F55 965 0 R /F23 678 0 R /F39 858 0 R >> +1843 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F55 970 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1843 0 obj << -/Length 1768 +1850 0 obj << +/Length 2037 /Filter /FlateDecode >> stream -xÚÝXKoÛF¾ëWèE¬Í.÷}tb§u‘(®%7Ò‘’‰R¤Ë‡÷×w–»K“ÒJ.PôRèÀ!9œ™Ç73"S?2å é©ÔqLøt½›àéÞý8!Žgî™æC®·«É›÷TN5Ò"ÓÕf K!¬™®’/³·H¢3€g‹‹W—góˆ1*f77W‹Ëëßàžc`Œg/wì³›3Í.~¼Zž}]ý<¹ZõæM&˜[þœ|ùŠ§ Xþó#ªŸ>Á
FDëhº›0Ng”ú'ùd9ù¥8xÛ}rã -ñˆ pE"’a?$ É0R’½ø)"!?y.ã§ùgsÎ7ï9pŽ¤Ä -¤–]™¤ûÎÐQÉÈt¨ñÀ.Ï°‹µa‚(çllØò!]g›ç³9ÕbötŸ6÷ieošÒ^×÷éúCÊÙ¦t˜7iµËŠ8wŸfy²Ž«3¢fI
ñ–Lͧ¹ì#{—Zq¾+ëÆxa:'IÎiΣÎÜ8ŠŸk“fÑLµ„•P·ycï˽Æö²‰³¼õZºK{m‹$ê&.’=C3í“]ܬï³bëç۲ʚû½ýs|ûþ½œeð€€(V³›²®³oyY—;é#^Ûrð^è’d”NL"E0sIò{±§¸*ÌÕ1cL9äžð¼`V’nbð‹1È)‚Ã*áàkÍÉ@I¶-Ê*=¦F#Šá‰eG%ì -E("N¢ÓÕ4ä:^M=—ÑøWY¤E¼;(ð="J±Óš{®€êqÁ(D„–cÝ«.IÀ“I¹‹³ÂÒ1Õå\ÏflµÔ·Ô&]M¥ÉqÏqŽ8UôÏ
¸NxÎsÙœÀQôæБV홪ǞÃ@9ÖÝ{îyËZŠúdíQ`pÍP$)@…âPFüíÕêîva?þõŒDzvñáÎö—=Ï@FN]ÆœdÞ…¤S˜ïŠAë ¾<l©6mUøâuY~ÏK¨4m=>£+ÀÌݦU'§¬ÛSÚC”I®´I×Mš¼mG`'Ò ôSVq7wäžåÕ•ýøâÃòSàŒ!§Q;ÎíLŽ SêAÀâŸ9&¦< ž±a‚ò µˆÇ¹·×‹K+O;«h#YÝTqcšyt›nœÏŠµsÛǸh¡×ª'B¡H1„¬¿E‚À ØØqw«Ÿ>ݾî±ëz]‘ºX>×Mºs±}WuY5Y»{Ñ1b"rrE€§ÜTg€QØÖIâ@»Jw,W¿ƒ4RšBèŠ)Š¤¥ÆV†1¬N«GðlÀEØ»ÆjX>åCÕûXB¡” ÓHc$¸V!,ö®#nÒç$Æ
EØ™T0®çœ[€¿ÌÙWO‰žZ»Yl” `ôeéd]›l;ßd¹sôH€ÁSŸ«½Ü$ ·L}–5I¿µÛyž>¦ù?»é©mOU -XG`.ï„v]±Ø&àçÑÜ#hSuߧèyO²ó½NkÚê‡vq—]>ߧ
<–X„U°24÷eÛØ7všß¶»´hêó@ —ŠË·££Q„ÍUbŸ¤°•äV¾õMìT»óê™öí
˜¡¶mÕ»H¹¡*®DbÄh_½oÒfý¦³ -$D AÕ°Ÿ›5š Ì#9^s†Ö?»A¨Èš,Î]#Š›x?9¤MêbºñMÿÏ6²´F'»“O]
-ÍØ°6C -èÓígÀt|ÂöLÝ¢Ïöõ l4Q'õyžC}#øRR2ÒwW»Ì¾¾yd¾rçbè3ÅxêìkãÞìÙµ‹Ífëg®:ÖñCl¶ÖÑ* -A)7kôØ<ŒÄ”p‡ý:NBX+¹ôå\ã+"ŽÌ»¶Ù¯?ú÷uÞÖÙczbÇBÂùʆåyNíWÏ‹É¡àŸPÖÇ~_Y(ôeÃÈ‹ÿ>òìy1@vó` ¸‡“ý·ãËߪÌ`½:ò'C$Áƒhg”9!ø0i1Š(쇶ÿ
J{9endstream +xÚ¥YKsÛ8¾ûW¨j÷ UYž$pt,eÖS‰âµäJr )Jb…
öx~ý6"%HJÕ–l‚îF÷×Àd„ጄ‡<EÕÈW LÄ(Loðhß~»!–gÚ2Mû\W7>1¤ò¨7Zmz²$ÂR’Ñjýmüùhðxq÷e>›L)çÌß=>γ‡ÿ»ÀÀ,¿Ü-žï>›µÇ‰¢ã»ßæËÉÕï7óUgNßd‚™¶åÏ›o?ðh
–ÿ~ƒSRŒÞà#¢¥7\0$8cíJr³¼ùw'°÷µù©Ë\H$(÷À1ß;ã(‚|B€Éçzð%.?Y&í¦i¥·ùá“=F¥?û Zs¬ã" +«¼x?ö! +yÄ;ÈsYÖ1šÆz … +ã
$SÞømAîæEg“~†»(ü©I¿ G³ÁB’§q¦#Üü4NÖ¡éëís9^\æ2K‡Î +‚$ÍËÊVÈ.Ùe‹™‡:¤pjÓ#¡¬“ʼçóÌcÄIÝji~˜›g£¢¬‚l}$°o¦Yô†»8ÛZÁÉ6/âj—š×ïXà§O÷æf*DƒËñc^–1 +BÙµl>A\ÀÔw1›ú\糩ãÒu’ë¬?i¹˜!"%¿¬¹ãr¨&ŒD0óùCÝ«®¹äiЖ»Æ˜†Ê7G=èP'_" f¾œº0ÏhÜ0i“+žëq]ð\Ëe0Ñví“R#Lïü²ê–É¡zè9øêyþPwç¹_ò–±u`ígÇ Ž ~Ai`>ÂŒšYèi¾z~Z˜ÿgóÒøîó³9ÿyÒJ /ë÷’3ÝCr8Ú°6=LªVu‘µÉkQýWv,©‚ª.‡{$Ãa8*̈[X¶·¨+Q\QSKÛM…[‘ºJ¿Åå÷´æܳœÏÍï>/¿:öèrŠ® R׎ÛÞn<¥G¢ÞçF÷C2´"•uš©Ú
˜ ‡z়«@. GÚšóña13ò”ÝÕÚL\Vp€Éí8øm¬O³ÐºõKÕЋNÕŠ¨×ÀÜ~…î µ˜¨¡cïžWÿúútÉ£†ï!ƒ^˜E!Ëw˜’Sûû<+ó¢Šëô bÈ=jåp +KˆöJ`5Ûp´J¿ÀX5,›ßƒàAY/Ä6Ù(õ
5´Ò]ãʨx +—‹ðæÞ³|_ÆåqaPÁ¤ÇFDR$ˆûÚÚ¿¢BÇûb
ì‹0w*ÊQ;®Þ¾=ðà·)ÿÑR^G…vV +Š·ÇIûóMl]ÇŽ¸/ɱŽÌ!oÊÀ«„é[‘þTóp_—.É +Ié«cÉû«NÙCj¸ä1¤ƒQ'¯ì¨Ê!yè£ñ:Á |âˆúª¹p¼,ÜŽ¥ÞÉî_;꯫ֆTÞsžE¸Û&ÅÈ#À?HÒÙ|yÿôð¸zøºøÅ^éš6¼»Ñç:¨^z +hhÝIf‹¥Sõ‚-1>‡V endobj -1842 0 obj << +1849 0 obj << /Type /Page -/Contents 1843 0 R -/Resources 1841 0 R +/Contents 1850 0 R +/Resources 1848 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1840 0 R ->> endobj -1844 0 obj << -/D [1842 0 R /XYZ 56.6929 794.5015 null] +/Parent 1847 0 R >> endobj -1845 0 obj << -/D [1842 0 R /XYZ 56.6929 610.0572 null] +1851 0 obj << +/D [1849 0 R /XYZ 56.6929 794.5015 null] >> endobj -1846 0 obj << -/D [1842 0 R /XYZ 56.6929 546.0335 null] +1852 0 obj << +/D [1849 0 R /XYZ 56.6929 496.4666 null] >> endobj -1847 0 obj << -/D [1842 0 R /XYZ 56.6929 482.0098 null] +1853 0 obj << +/D [1849 0 R /XYZ 56.6929 433.6488 null] >> endobj -630 0 obj << -/D [1842 0 R /XYZ 56.6929 442.3696 null] +1854 0 obj << +/D [1849 0 R /XYZ 56.6929 370.8311 null] >> endobj -1848 0 obj << -/D [1842 0 R /XYZ 56.6929 409.052 null] +634 0 obj << +/D [1849 0 R /XYZ 56.6929 332.0288 null] >> endobj -1849 0 obj << -/D [1842 0 R /XYZ 56.6929 373.1831 null] +1855 0 obj << +/D [1849 0 R /XYZ 56.6929 299.0792 null] >> endobj -1850 0 obj << -/D [1842 0 R /XYZ 56.6929 306.2376 null] +1856 0 obj << +/D [1849 0 R /XYZ 56.6929 263.5784 null] >> endobj -1851 0 obj << -/D [1842 0 R /XYZ 56.6929 233.2236 null] +1857 0 obj << +/D [1849 0 R /XYZ 56.6929 197.8388 null] >> endobj -1852 0 obj << -/D [1842 0 R /XYZ 56.6929 126.5318 null] +1858 0 obj << +/D [1849 0 R /XYZ 56.6929 126.0307 null] >> endobj -1841 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F55 965 0 R /F23 678 0 R /F47 874 0 R /F39 858 0 R /F53 957 0 R >> +1848 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F55 970 0 R /F23 682 0 R /F39 863 0 R /F47 879 0 R /F53 962 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1855 0 obj << -/Length 2451 +1861 0 obj << +/Length 2811 /Filter /FlateDecode >> stream -xÚÅYÝÛ6ß¿ÂÀ=Ô"†ß’pO›&
¶h÷Òfƒ; íƒÖ¢m5²äXR¶¹¿¾3ü%Yöö‡–#rH‡3¿™¡Ù‚Â[$ŠP‘ÊEœJ¢(S‹õþ†.¶0öö†yž(0EC®W7/¿ñ"%©æzñ°¬•š$lñÿ²¼}÷îÍýë»ÿ¬"®èòYEŠÒå·÷np}ïV)_Þ¾}ó>¥˜bdÓtyûã›×«ß¾¿yóЋ3™Q²|ºùå7ºÈAòïo(i¢OðA KS¾ØßH%ˆ’B„žòæýÍOý‚ƒQ;uNR%Dq©‘¦„)æE Upð(’pó^QœÍ)*p¡¢¢5ôåwJ
8nú¦–e]W›bmŠÒL•Â4#”ƒXÃÏäë¹fÃmµ&”ªx,á‡Æx‡¼œ'ñ¼ˆ“uuJt¢¸çÍšU$Rµlw ‰“¥”o»cÖuåF±§4Ž.ª¦5Yî¸ëÍdzn6YW¶/ÜÆ" -É4‘*
R¾4íúe•íMNy ÍI’€ DŒ‘T)Þfæ\
Ϧšh¹|@+®W‘jiª¦;®X²4î»Ýe-RrézË:Ë‹j=×Ùé±3œ'C[TiüD¿ÛS}üè²MkŽ“Usü:w q{ÜpZç©ë]Vm
*W¤Ë¢m«[Yñ#/ÜÖm}üâ»:ãgØf®9ÔMS<k_Š $¥T{EÂâ~ás•«˜°X?¨Þ<PPß:+ -~O?ÖM0¶ÆµNs@]éu…dQÝYcšË&ˆVAÁ®›à€ëŠ .k‚›é–)‡èº¹ºe`šÙr¨Õ4&œ =Þò箚h&À¡ÓÇdpãU¼uwÜUÞ©¥Š¼6”[»Þªn½¶ÿ5ÀÇ.êUÅ’ÈD¥×õ:京מËêu{¦W~ŸÙ20Íl9ÒkB’8žlù7é5„gX{.½Å–uðBurõqSÝG†¦ÍÍñ8çtŠ$'¶Ë—$ ÐhH|®_Ò€ëÊ%.{IÕ³øûõ¡kΗk’p`¿*YÏ5#Ú:ÇD´o=(´sÙLˆ™Œ§"žCe4 - Û4û²áÚWw÷¯ÝœÔuäf% RXq…O4ü6>íŠamdøâ&9\Ž—G0åS~^>¤,.ÅÉéÅ -†!¥Ãæ!}§Å5œ¬|¦9} : +xÚÝZÝoÛF÷_!àJáf¿—D8±/pÑ8¾ÆA´} ©•ÄV"‘t’þõ7ûE‘%ùôå Z.ggggg~óA“†d–„YÊg*åH`"fùæÏ–ðîÍñ4q ŠûT¯.^þ›©YŠRIåìaÑã• œ$dö0ÿ5ºº¿¿¹»¾ýå2¦G¯Ðe,0ŽÞ^Ý}¸úÑÍÝ_¦4ºzsó9gˆ”!“8º»z{s}ùûÃ78}‘ fF–¿þŽgsü‡ŒXšˆÙ'xÀˆ¤)m.¸`HpÆÂÌúâýÅ:†½·vé” +KH¨šÐ%3BP*(A¤H2ʬÞÝ?ܾ»{pŒ° +d¢—ôŒô©Ž[AGµ|Ê +NnÙYÁá–SV0زoòï·þd 5KÙ9+èQ°‚@eÏàBôLj2À2'x^•‹b/ +PñH<" ”³ÓòuTô%%ÂX¨¡„Æhœˆ}ZŠ‘T‰šqÄWæ&€ÃþÀjX*œu>Ìâß0¦Ëv—5EUº·ffݸ(ëFgsGmìk°|®Y»n^LÙ‘ˆ‹4HùR7ùË2Ûè¹½çYÌ$EI!&v¡‚t‡™8e(5Íñ‚P˜H=˜(Y]Æœ‰H—ulÌ<7«¬1#¹Ùu•Í‹r^zªƒÓ›Épz³š¢luíúÝ>U»?A¶hônĵֻ§0¹Ûã†Ä]`4§]eåRå²4*šÚ
w+«y˜î +Ñ
tsrË@4±å ÍQˆ&‡[þÔ–#Í8tú½\x/Ý·¥wêß°À¯åVn¶¬|*äì´øK9®W¸V&å9½ö¨Nè5PY½.'ÒÇ$•g¶D[ŽÒÇD©Ñ–ßH¯Yx‚<ØóÚ[ìº +^(ö®>J"!£‘]d¨›¹Þí¦œN dOvô’¸JMÕ™KêS¿¤ŽÊ^Òf +9à H°Xg7I RKÂåiÁ:ª ɸH¡HNE:
2µ;)9‹lÄä<Ú€MÛsm-µÎ÷Èh¨ ®²lY›v +=1‘}ëÄŸË>¡R†ì›³¾|*l̤nêÛAe¾`žPUn\¯ÇL¯ü l76äswCkäw3[)ºlÜ„ö0È÷a×T{ÎA‰žEà\‘£½]¸™Â3-ünméûNœû<Ô08`ÿ}`ëNÑëX™S¼ð©ˆOo â…¾V¸wǦ'²yW„Ô%‚ûÓÎ:"³á¢ÅIOìSwÅŽÊúâö¬/n«]sèŠ%\œ–+MÈ5Ì9 TR9ìÇ¢nB“Ñ$vð±Õ»BסéKf/ß8òÈÒ½/î©Î‡¾ÛÅ(8Ö¸²-¥a—ÓnfG‚¿S åçî´GuâN•½Óz¢ŒR ¨âä–hbËQ¥$‘Ã-¾T<Ú¡‹RC3ö©¡Uc“5pE^ŸÈ×Mi.9ݧëU;uq,ÄF† +>Ø‚þ\4 +'– €• :NŸæYb¿€ ô€Êt(Àhòrë0ðòC·‚s† ]Ld-)}µ÷>K¨þ%…Ä0F‚aa~×Sœø–°`4÷w—±$ÂÇ’F7ª¦ŒŠª$ ’K»ùìãOSæ¨zc{Ú½ìÄËÛ
]Wp¦YÿXsÜgmÏ%iÿº¡<KœØ,ŸS¸[q¬œ+©®“gÆnNF›¬ðŸ"”GdxWzk÷íAùìTE¯nï®ÝšÔMÌõ%ÃÑÓ%¦É +ñÃoãM¼
Á·ÈA´‚,S]á×ͧ¢‡…(•ì{¤æÁֹ𛹟EÛ´;íÆ;½6]ÃõÀ`¹ ÀL¥o_ge,ùÔ4t÷ŸH¿Îb_(ÅÔÈHø 0r‰Ï¡XGeQ¬™ˆL)‚h¡¦ÚÁ«hJ%c³þ¶‡á)PMH7$r~oâ½vq½²!‚Êé6£IÉ{N÷tÈ»ªÓwé
[—$U¹®k×æ0[Ù؃¼ÚlœáÂÃÚe.` ®’^¶È¬l–ÂHôØz9õbß&„ç$Ü”8Ì»‹wÍs_¬Ðµ> +¼DrD¡¾ ð¦ñ„§ÿƒK„Ç€Wa¤0 ÐÜ%èêãÝìBí§h¨¿®,àþdÿg!ø¶ÓèÍQ †Œ’¦„{ ÆžpîÀ·?>Äì÷YŸ endobj -1854 0 obj << +1860 0 obj << /Type /Page -/Contents 1855 0 R -/Resources 1853 0 R +/Contents 1861 0 R +/Resources 1859 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1840 0 R +/Parent 1847 0 R >> endobj -1856 0 obj << -/D [1854 0 R /XYZ 85.0394 794.5015 null] +1862 0 obj << +/D [1860 0 R /XYZ 85.0394 794.5015 null] >> endobj -1853 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F55 965 0 R /F23 678 0 R /F53 957 0 R /F39 858 0 R /F62 990 0 R >> -/XObject << /Im2 979 0 R /Im3 1102 0 R >> -/ProcSet [ /PDF /Text ] +1863 0 obj << +/D [1860 0 R /XYZ 85.0394 751.3856 null] >> endobj 1859 0 obj << -/Length 2185 +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F55 970 0 R /F53 962 0 R /F62 995 0 R >> +/XObject << /Im2 984 0 R /Im3 1108 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1866 0 obj << +/Length 2226 /Filter /FlateDecode >> stream -xÚµÛnÛFöÝ_Á·¥ -v¶´8²‰J¤*Q¶ó÷=s!MŠ”ÒEºbÏœ9÷ÛP$Áð$B"i¨I”áH`"’Åú'O°wsF"δAšv±>ÌÏ.®™J2’Êd¾ìÐÒkM’yþKú)4 -8]~ºú8™RΙL/¿|¹š}¼ý/¼H€‚qúéröõò.À¾LM/o®&¿Í>»š·âtE&˜9Yþ8ûå7œä ùÏg1£Eò -/ch²>ã‚!Ák «³‡³·;»þè˜ 8ÕH2©
1,È_aË´7„g‹“)!1}ŠX8ˆX\¶GúĦš aŒH¦RP¤ a(ƒCÈA“´BTiš(!Àq28iælì1
’‡H0Œr î0>O¦’¤søKÓ«Ch‰x#‘F"n„r¬“?‚07†¤ÎÚ+ûn¸¸]Óäc%]¥"ái—²WJÒNàÊÀ9œ%ŠîLÉ r9™2.Ó»¢œœîß΃–’uŽr ¤ŽZ–ÙÚæ«Ë€ $„Rk¿³»@º~¶añû„âÔn]䦥]ýcqÙ&{,VEý-¼¯íâ9+‹ÝÚ½ª´®8ßV›°ÊV«°ØVUí„;P.\ÀDG‚`GDZ¼+ûä$âD§vÂpú¶°›:¼{ 91i+ƒ‡VAIfºVd)ÊMÔò±(ó_±À🌘„c„iŽp}Ñò Á¦(Çi”,+ó°ØÙº9UMƒ¾D(ÜÒSxawNK¨[»«öÛ…S©tU¬‹z7†PF4púZ.~û2«íêNϤ˜¥Ø…Ãk›•‘jýœÕÍÊŽˆJH ¬eÔyº1‹ËNLID©6uQ•fU‚^;ª èVv!_]VÁp¿»Ø¡&}}¶åHÐBƒòï-Ó´ í"’ö.7¨N«2@â7lRDÑÁ æ`+0åÖE÷¹‹QÚÂG À1ÓÍÖ² ¹!HcJûnõ$0é“Æ*Ý¥ó0˜"ÃÇõKQíwù€_„æE”9ÉT¹Èx
¯ƒœq@Ÿ‚pèц÷³¢´y¤°tb
£÷µ€(Þ'F!MqSCÐa
åÒ ªNºõû{ƒb/
´Èé{gû±ž5¥iŒoƒœR6>/¤@&(Û -¸ÁïódÆp^h±|V½ZFBñåF&]b–
ÒËnæ(×ÔðË{¥©S‡¯—nñb·;Ÿ»î¥Ü¯C°áP·Ü¾õÀê€@ËÓöéb·O‹åíóbKˆnÕÁHihþ!¶ÙâÙN—â‡Ò -Ý_hvZ¼kD>ÖkP!˜‘}ïª,(Ïê,¬–Û Ô÷jE?ðˆT\ŽŠ~ÀO;)-‹ÒåmÏgþtXV˃½Ü.³ý*zù¥°¯n¼¸¯™¢ðRF˜¿eÊSùÌüù›ð¸æPw¤ù΄ù -ÁäMÇãÚ7‚Ã²Ê ñ:ÌwŒ(ƒ6”ýO®Aendstream +xÚµY_oÛ8ϧÐÛÉ@Íð¿DìSzMr^´n/q±ìîƒbщP[òZR’~û›!)G²e÷½C +4Ël›=ë¢ùîç»|ÊÊ¢Þà4ÁHsËù®ÚúQ¶^ûÁ®ªšàµÜAªÎkYðÚÉ”©8¸.JÓAã×¥Ý6~î5Ô&~ÓWCxÓ·¢ +ìRÔ~óÆfeàêS‡Ùq
A!½ÒA"ú"'å,T[ÌhžgU‚ +ît<Á$ :8Ýziå
÷
¯“›øåÉ–#^¸"™‘?öZ‘òη‹ÀÒh18xŠyÑ8°É ',õ¨®3ÌèÊœe¿>ÂÀ +DS…žñâ§ÇA‹ÎyaÓƒõóm²¢tn‹†{^_íàó\Ä@õS‡ñGøy‹ð𵟿${m vš¾•<?‡Y€¦$M@P @¤â|}ÖraÎ×G{*Vχ–Ñ Iõ™‰ìˆFDöC'AP£"ï,B¾—1qðlwµ^œ”íæÁ{õ‰öµhŽ®±;ºâŒ@Rc?°OêŒ}:*gŸ×±ú‘’ +Èà[Ëlùd§+ðñCí‡$¯àÖΪ·§ÑO R„0z¨àÇ*ʳ&ó£•+ݪÍHY 7¢©GU?§AœÖÝ)‹wpgn·V«ƒw¹]eí:Üòsa_°ï8YåIˆ©ù?©ò’ªŒÔüív˜“%ž„ûÖ,U?(ñ +túõS>ú€œÛCõÐË•=§ï’¥À#)ãûšûÙíüêãýH.¡X‡µ‹#œ¡ý8T–.OµÐ§Z¿°ïK¡*á‚AUòXfXoàËú©j×x<8.>„èT~äò<—UÙxk¿Ç''xƒ54Ô€9¿]û8 @Ó„§]Á·+óåXë
53¤Ç@ô¦Ú±FèÃÐgùIô`i°vz½úT§ÑkO.ä_¿}ÜH5ŒÛˆ€å„&зäÞTÎðË +Ò†0(òÔÌÌ«—ò¼yàŽ$ Âï+24 )ÙöÍ]ïQ¸3wmËÜÐqåÕ÷ðÄ„’ë-èPz5®…¨-sû¥¼´Þɳ„¿„RPùo_ÿ<¿™Ý~½»Bƒ/fŸç?N‹®E\%[3ò=aÀJHB™î:mÈ +¨écëóv"Æ•µëG¤‡"XkªÊü·´Wÿ¶ ‹¹—»â¡ÛSv«Ðˬý͉@°¦÷H>ÌÙ>—í›"^¸ÄÎ Whб—aíùs‘w_Њž£¸ãËÁ÷cE¤f]#ä©\团,êÌQ…[½³« {ÙEð§¬l³õˆq™N±JÔý>ëðö!Â8¶1Þ|åz3û8ò:Ä°«•šŸó‘‹/(JŽã¼#B‘—¶Y^:?!à«ãð†ÆNéä¬ô=Ñ‘øƒð†"]¤ñ‹ÑêøÈ#qÑ{äÉ4Vgà'çÍÓ#:mžŽÈ™ç9Û]îÚ2˜h[äGÒ+yV=Ñ‘®¥CˆÑWaÜD!ð“Ô´ÈÏ[¨ÃAp{1Ú/Ó½oþôÿ8Þþ‡#!Y¥é _€$M`³î”ƒ2Æ/ +.¾r¬û¿IË!endstream endobj -1858 0 obj << +1865 0 obj << /Type /Page -/Contents 1859 0 R -/Resources 1857 0 R +/Contents 1866 0 R +/Resources 1864 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1840 0 R +/Parent 1847 0 R >> endobj -1860 0 obj << -/D [1858 0 R /XYZ 56.6929 794.5015 null] +1867 0 obj << +/D [1865 0 R /XYZ 56.6929 794.5015 null] >> endobj -1861 0 obj << -/D [1858 0 R /XYZ 56.6929 436.0529 null] +1868 0 obj << +/D [1865 0 R /XYZ 56.6929 361.2723 null] >> endobj -1862 0 obj << -/D [1858 0 R /XYZ 56.6929 286.4775 null] +1869 0 obj << +/D [1865 0 R /XYZ 56.6929 210.791 null] >> endobj -1863 0 obj << -/D [1858 0 R /XYZ 56.6929 207.1916 null] +1870 0 obj << +/D [1865 0 R /XYZ 56.6929 130.947 null] >> endobj 1864 0 obj << -/D [1858 0 R /XYZ 56.6929 96.5058 null] ->> endobj -1857 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F62 990 0 R /F63 993 0 R /F39 858 0 R /F21 654 0 R /F55 965 0 R /F53 957 0 R /F47 874 0 R /F48 880 0 R >> -/XObject << /Im2 979 0 R /Im3 1102 0 R >> +/Font << /F37 747 0 R /F21 658 0 R /F55 970 0 R /F23 682 0 R /F53 962 0 R /F62 995 0 R /F63 998 0 R /F39 863 0 R /F47 879 0 R /F48 885 0 R >> +/XObject << /Im2 984 0 R /Im3 1108 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1867 0 obj << -/Length 2451 +1873 0 obj << +/Length 2455 /Filter /FlateDecode >> stream -xÚ¥YIsÛ¸¾ûWè6rU„`%€£³LÆSÇ/v¦^U&F¢,V$R#Rñó¿ÝXHP¢¤©šÒXFãë
b -?61ŠPaåD[Iej2ß\ÑÉÌ}¸bf‰f)՛ǫ׿ -=±Äf<›<.^†PcØäqñuzsÿþîÝí¯g\Ñér=S”N?ÞÜ}¹ùÃÝ_[>½ùðþ»°ˆ’etúùîÝÛëo¿_½ì¤I%fT (_}ýF'ü÷+J„5jòJ˜µ|²¹’J%…ˆ#뫇«ÿt“Y·tLJ¢×#*àl±Jñ”%™àÂëàËãoŸ>ãA€\$£“ψ²F;ºÛª-vUÑz½<¼4m±i|çm]5õ®-÷›Àv•DÈŒ>RÂÆ:s|@×3FAÏ»j1ÇH!2"˜äŽâ.ßãòЂÈ<·ÚmÿçÚ·*\éZM±ûYì|{^Wíîš™i½öû¶\—íK/l¯"ÜÄc¤r›<¼Tõ¶)›Ã{Îà²h\©Œ8æȵ0œ+ íQÔRB•ÁËë9xÐÚÐF¢þÜèïëì»?‚JÕ€ŒsØ©›z¿›³|±ØMãɇ[’!kOþ-ržp -„P*‚V—åÓlY®‹¶™"Z yÈöÇE¶?Š—S<¥&†S}ȳ¹È3€á˜# ŽsÉ9nG8B¡£¹šÌ:¸Àš-à~„1Ä¢ý0þ³k½Œl1Ô(âuœÂ$°U`P–föŸøN¬1fÜ»Ì:Ž³”¥â@4Îaܲ~g±\Œq"”ȆGŸ×›M^-Æ,nƤ!]\°<é¾{ÿðöóíýãí§»nÕIß=ÉÇàœ(àÞ6ºô[TMÛUáõ¶ØåmYW¡»ôßÜ‚WV -Jã‚^¢V€H?ëN>ˆ¥Ïe»òÃUíG"6Üຬ -?\oñB‹z翹“öi¿)ª¶yu
Ø·~ÁvWÂ` óŸf…æéf›=ì²{ ì–^#Z.h6TˆGÆýÍÛI®:‡˜ç%†FGžÿÌËuþ}º½üÔeKƒ³qC¡µ@.LçQÈ}UÎó¡È, -g ')y@ãP“8Z‡GíáÀãÛ{ßË©Š9çb -ôZT‹²zòd½^ÜÚ=lSµN‚E"G`u ïEùT¶9†f™M›ò©ÊÛ½%âQP©‡Ÿôª†Æ|¿óÞ®ÔS½ Ú†éz¿r#£½ -
õ¿*ç+?³oŠ@“ûO³ò0Ä]¿˜û~ëûèñ[ä‘EQ9Ré¼$¸ó`£‡ Ü[&íôq%JüTS¾·fMû²v¬Ì¡ÜØ€ÈtÜÐôž;^ì¿÷EÓq¦£÷¸G÷àÉiÒõÍPT üp›õz°Ñ¨è!Z|—qv>a¾ÊA'!íÜì›@ù=z@{t/ß_‚[ðŸ±ðo4d›€‹… ÁÌ¿ÿ‘ã,eé+‡U@ä°TÚ~çþ½¨Uý\…ƒ× -H#æ±%a€ò‰š÷tì’i“5]¹wÇÞá+ç©þ¢”?í»ps8â½2Šé¢€jfãƒ
¯êg?îç£6Ÿ·apÈb}!’ú‚GçŽLç -÷íÊ•:KFŒUâd9’JÈ€[Æ!ܱ£‘q˜I)’Q·B~iŠ‘Ô›StÖêLÑ4`
f#ŒŠ1“1¡Yð3š»õÏyá'‘÷.Ò»2Íã–øÎÀ«> 80$T¸ó¡7ú¸_·å6æ eÕ´y5/š4ãs[ÄÛe7ÑróõÚÛÚnÛº(ïœÛ2¸©Úåo©ßÞÿ”ieI¢GÒë¢ðYÏ(F…&ýÁyŒ&Tg0©Fçc¥²…í -0H8P,0<Q{øfhµLЙd#>£Ä6¢<«ïà½3+úå‹b™È^U½nF³(å뢿FgNPÞ13¼=œÍ z]€BGsžÆÁàÇEW•>D0 -=MRü¡§9iŽ6#Ò¾óÖ˜6ÆHälq{1ìÅí%r|ûSg…Š4ÇB
¬C½Ç³¡TE5úÄSR÷åRÖî±}hÚÜ¡»'çžjˆØŒHló’Ët/¥®e "ÌœøiPÝ㶯ÂrW§.ŒTð÷ÚÓœ¾Ö@ãnõÏÃÍ@»Œ‚¯;³Y$9Úl Y -™¬±éfï«þ‰Ìè{Íg]?=Aµ@Ný%*ÁGþYhWËþë¿Kûƒ%–h†ŸKP ðƒ"<…cLŠÞý±z,ûÿ³@‡¬endstream +xÚYYoÛH~÷¯ÐÛÊÀ°Ó÷ñè8Nƃ±ãÅIŠ²S¤F¤ìõþú¾(’¢ä +Á 1¶î3]tX•Q}v,_ý¨230žGÁq%âZ²aêIËÇz&\ƒhÉœ·Ùçï7—ÉÍaW4dþ²*²•ŸÙ5yàIý£YyÚµÝ{žù÷Ö¿ÛxhŸyEä•cå.DZ‚Ç"Fê +NLr3XEzAª‰õ^÷ן’¦}-(=6£-m`RÅõ>lدö_»¼iƒŒ8ÓñÐKÕÂø?šþ÷Íð“[ýa‡e9XhRõÆÃϺ{Wnv![¥`“Ps®wMàüÃà<Æ–Ÿ¯!&øÇTî‡Ò™1j¬¢?÷G‰I_¤ï6þ +zº+ésÅû‡Ã¶¤ã²ëv͈èÇIEš`G›‘¾†V—›Ó*v\:ë(ÛQR:Tòk“OÞC*ʼn–i ü†iûÔe=³+uß[xf¹Ÿ°‚|x œ>–gø„ô‚gUFždÍ +£D¹rá
Œö¹Žc´ãrͦ0Š¡$GÚÚ@%A˜rvZ¿ŽkBÁá•DŒNÔ60¤óÈ• +xï¡“˜€$b&b¤%ÆiÇ5Yý‹=wbØþóE¾Ld¿Mõ¼NF‘¨å»¼ÍÞÙ`î.ɦÜhpópøm§ÁÐã:†ÈåÀðôfÀê_FÀ9´ê‚ŸV®ãšÐnpºÐ*(L†êE‚QœN^–„B»†¹2=PËgÊB¦J—)Û½p.Ocú‰£'B#M>8úPÈŒtS +"²Þ_VBiL ^ëÕ¬:K è0’ý•|D„ê)‰Ã"ù„`u£IÔù¥°õ%Ê×gð„|»ð#áÙol,Eö{B¢b5ØûÂìkN;.–ûɉd¤CäW}ÝCע΃"UÝF£Ä¥5^ùŠ¦=êpÚØxÈNû[鸻E&çmÍ›¡wM7ð5F–ã¤^ÓbCïa¢Ô@³þíà°ƒPóÎ×üm†‰-œ‰å Œüí„fz7±}ÓÁ +®K¦Qu3¸ÅéC¯(:rÙÇ #ãì
B; ™Ú;û¸Á½þÇ Õk"mBÇ~¼dÙ{Õ ‡Á]ñ·ØÜÿnËm]¬”;sÄ E¥ì~ acÕ»Ÿ@uÿ‚D|Õendstream endobj -1866 0 obj << +1872 0 obj << /Type /Page -/Contents 1867 0 R -/Resources 1865 0 R +/Contents 1873 0 R +/Resources 1871 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1840 0 R +/Parent 1847 0 R >> endobj -1868 0 obj << -/D [1866 0 R /XYZ 85.0394 794.5015 null] +1874 0 obj << +/D [1872 0 R /XYZ 85.0394 794.5015 null] >> endobj -1869 0 obj << -/D [1866 0 R /XYZ 85.0394 751.8794 null] +1875 0 obj << +/D [1872 0 R /XYZ 85.0394 752.1052 null] >> endobj -634 0 obj << -/D [1866 0 R /XYZ 85.0394 711.2251 null] +1876 0 obj << +/D [1872 0 R /XYZ 85.0394 676.9839 null] >> endobj -1870 0 obj << -/D [1866 0 R /XYZ 85.0394 677.4622 null] +638 0 obj << +/D [1872 0 R /XYZ 85.0394 637.9396 null] >> endobj -1871 0 obj << -/D [1866 0 R /XYZ 85.0394 641.148 null] +1877 0 obj << +/D [1872 0 R /XYZ 85.0394 604.8838 null] >> endobj -1872 0 obj << -/D [1866 0 R /XYZ 85.0394 572.743 null] +1878 0 obj << +/D [1872 0 R /XYZ 85.0394 569.2766 null] >> endobj -1873 0 obj << -/D [1866 0 R /XYZ 85.0394 498.2696 null] +1879 0 obj << +/D [1872 0 R /XYZ 85.0394 503.1887 null] >> endobj -1874 0 obj << -/D [1866 0 R /XYZ 85.0394 310.9784 null] +1880 0 obj << +/D [1872 0 R /XYZ 85.0394 431.0324 null] >> endobj -1865 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R /F53 957 0 R /F55 965 0 R >> +1881 0 obj << +/D [1872 0 R /XYZ 85.0394 247.0209 null] +>> endobj +1871 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F47 879 0 R /F23 682 0 R /F39 863 0 R /F53 962 0 R /F55 970 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1877 0 obj << -/Length 2033 +1884 0 obj << +/Length 2194 /Filter /FlateDecode >> stream -xÚ¥]oÛ8òÝ¿ÂÀ½Ø»1ÃOIì[š¦{^´i¯v¶û Xr,¬,å,9YÿûrH}Ø즋ƒ‹ç{†3bS -?6U‰4×ÓXK¢(SÓÍ~B§°÷Ë„9œ…GZ±Þ®'×ïE<ÕDG<š®·Z ¡I¦ëì÷Ù[¢Éüõ¯×ï•àrF"žh o¾Ü¿»%·Ÿîß#æˆ*O8UÜ¡Þ|þ|wÿnùÛ|Áêó…¢töñæþëÍ„}žk>»ùåneˆMîÖC]F‰ÿN~ÿƒN3Pù× %B'jú/”0ùt?‘J%…ðr²šü§#8صGC¶“*!ŠË¬È,–a33H±¤D'’uæ,dae,²89ûª&cDH`†Fû3?Ù¹9tL4w:dy!˜G -6t'£œhªÕX²¯M>_®gíÎ.#H @-.´8öŒ‡„E\9¬íaÎ’Y½?c°©«o”òÇã!m‹ºÂ])óP2Æâc9¬ý±i‘ðƒW«ª_¯‡>«tŸg¸ûR´»^L >]ðˆkãpp”V݆pg †ãh––õŽíÝk•á¢É7Vï¼uïí¡¨q]TæÏj‹‘åok· -3[ù0hL>1:[¶º«eæÎìro[wbµÃÝ¥Ïô˜Wù!uŒ7uD¬§áùUÄa§ÈMC\‚4¢‘IÁ„D2Aϼ·§dì| MÍØ?•¹¥ -¤/gŠPªØ+ùK‰ìŠò•gžŸ ÷vyÿA7Ù¾¨ -¨‰ië5ù’o5«;ö1Ž`44ƒPÀ Z•Ëœ³&…è¨ZJ(‹ù+JÀ•‰¨+B-øعãïñhRá,RPMX~g——O¸r›tuBCUUÀ.¡ ”×z4àk¸~X~\®m?dþÖËO÷«€:Ó\Á}⿪/ªY7gyÊ}4c 8]˲‹ëPŠØXn;·Â* ˆ #Ñ>€Â¢2mP@Ƕ(‹ö4gŒÍ|øCÕ c>þ1™×>ó€=ÜÖ¶ŽÂss<¸jË‚l†çKê -7}’C<H±³$÷_Ô装íÕ½ÅS|àÜ?Ä#ßû¨j)!B×í*ûÿýÁµÿ-cðBÂÃ_#ylïƒÈe´fL^ˆÎ¨iHy@öÿ‰Sѯendstream +xÚÛrÛ6öÝ_¡·¥ÚÆDß\Ç麓8n¤tv¦é-R§é%){õ÷{p£H +²§ÓLf"ðàààÜ/0™aøGfB"©¨šÅŠ#‰˜wxö{¿\‡³ðH‹!ÖÏ«‹Ë,ž)¤$•³Õf@+A8IÈl•ýýŒšÿ¹úõòƒ`\J¤‰úéËÝûktýùîƒÅQ¥ ²‚:Ô«ûû›»÷·ÿ™/¨À@}¾GŸ®î¾^}´°û¹¢ÑÕ/7KMìâfÕË1”•`¦…øïÅâY"ÿzS‰˜½ÀFD):Û]pÁàŒyHy±¼ø'8Ø5GCºã"A‚r Zdˆb‡5LPL Åœ ªDÒk˜’†=–ÖÈâÉéW0 A‰[¥=ÕM7Õ†¢ˆ«DΆ7žðå‘|
©bÄc5ák™W™µÈºÞíÒ*kíWWÛßÕõ½]xî&.B¨B,fr"Ãäj*ÇÄáUÛå©»µÞ8¹½{oWê_Ž…,ߤû²óÜU]3'IT—°M«*/̽sÇÁ‚'>åÿ!Œ9}ú¬W¬ë±ŒuŸ^)cKÂ^¿Ò#®j/¦(æTŽ¯¼©Ò‡2·2?çÍCݺ²~|,ªÇ³J †{U C¬óJ豌ag<æÎôå‡)[‰D"Æñˆ·ž"•$I8Üžà©#Æ…„Pr,B‘MÙ#˜ AxüºÚz¬€ÞFÑ‚!”$ã[¿ÓIu[·pzšÄšà K,Îë’ÄŒò;êÒèr$dÚ)sª¨MJú’²±!½›ˆÁþ
cú¸oÒ®¨+Ô2GÁןWc1J ˜|7Åx‚o(Ì…bE’¿˜Ý¾í¬ØÞ%ªúÅiâá eT¥»<³ —¢Û•Ôg3'J[‘ %„M-œÑyBDiùX7plç>mQ›¯UòÎ}w
¤».4‚GµÁÈòÆ‚7µ[L²´ˆvyÛ¦îÆç´,2oQø¶5nد×yžA—À¨ˆn7ZÕS3%‘”ž75ª@µR&(zþ©{Š‹!ÉScC
F4!äxóYc/8š@æŒcÛ°*ƒF©}Ê×…ö÷<{çN“qPÚ—¬š*[‡J.C\2/EYZÚšl£K”uý—^0áœD]§vS+×,Öeº×)J¯µè_«¹Í›ç¼q|wi—ïòÊQ×µ}€‹G¸¹ñ*Mˆ[9¡&ÐMH6öYã]ŠG…öe<Ã|{r6¸Ú ¶üd]¹í7¬«*'©mëV7KÍie6ÁÂu!£
}ÐkCoÖOÌž´{·žF0<–H3Š4’ŒîêNŸÅÊs„G@§‰vm"캴0ÂN»M¼™Ý=†²CxÙëÝs˜®-à˜¨)ÛjĽÖJW¬A˜l,ŒõÚÓÖ,ØIV.óx7hu¼Ýº¯ÝÖûÒu…p£eoS÷ljµÃݦÏô˜Wy“º‹-nßZ6ö÷²œÃN!Ñ´-r ÂëâFÀé˜F˜æ
¸ÔÒ<•¹¡ +ÈÙiç%ù’oœ6«µ;ö)ö 4«&঄Œê•×ÌÁ;ª€#Lbú†Xe?è"Uï ÿ=îu(L<ÅŠ ‹ÂïlóòÉ®\AA=G}XAV:ãÊ3´YÒ +òñöÓíÊ›ú¿Õíç»e@pi*`œ¿-ŽÏ©Y·¿<äÞ™8Q˲wëP„ø¨ß>CIÈ@:h¾½ÿ„Y%JO÷Þö]QÝaN‰¼÷CªUºZ9÷·‚¯|àÁõTÙ4 +¿ë}ã<¨+d’0ü¾¤Ð9€M¹õs‘">›ÁÎ(=Q5î4àÛæfX¤î…A
¥ +ÅXÈך<®õƒ”xÂøwhò,ÁÅ¢}Qr¦{AEâäxñkM
„ˆ¼om“¥éõušý8hƒgºÊ€£c56â2>æÄÜZÎdz‹ŸÖûaŸr¼k–¹³R3y4<Š°åÍ=zõqù9 t ¶ˆ¶ù†ðyw,™&S`=[͵|ô$³V,˜ÏPƒÇí$Shš)tÌ”SSB“M¸7f8!±R=Q>#¡ÌëØ×Õ¿?y[S·U—7•O)ËCŽ3Ü54_Šýîx¯ž¥·'HÞ¿î9ý$C,ðnóaiô"¸ð¸(”++Ǯ觑ª¥PˆÆ Zˆ0¿#Ф`üFi쪎NjþÝgû(XÅ‘ƒªú©…\6M$h6!öQ"xðÑò¨¢æ‰îÕç’!‰ÓáŸKz¬3 +?aïo–×_nïuñ:£ïP|…ôÃ$ƒ½¾Í¸!ˆëÏCÊÖ»¾ÝÔ:CŸ$ƒöùï54Ðço¶Ñ©¯S`»E
臆é+ Þ¶…$Pâ·V.<àœ@Ç耩˜˜"¬ød +îSÁ?þëÇñÏB<F,IÎ<1S(TpXz¦´Ä„ðÓ7d¬àýÿ&t}Ûendstream endobj -1876 0 obj << +1883 0 obj << /Type /Page -/Contents 1877 0 R -/Resources 1875 0 R +/Contents 1884 0 R +/Resources 1882 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1840 0 R +/Parent 1847 0 R >> endobj -1878 0 obj << -/D [1876 0 R /XYZ 56.6929 794.5015 null] +1885 0 obj << +/D [1883 0 R /XYZ 56.6929 794.5015 null] >> endobj -1879 0 obj << -/D [1876 0 R /XYZ 56.6929 605.5421 null] +1886 0 obj << +/D [1883 0 R /XYZ 56.6929 546.7712 null] >> endobj -1880 0 obj << -/D [1876 0 R /XYZ 56.6929 504.7499 null] +1887 0 obj << +/D [1883 0 R /XYZ 56.6929 448.103 null] >> endobj -1881 0 obj << -/D [1876 0 R /XYZ 56.6929 441.2539 null] +1888 0 obj << +/D [1883 0 R /XYZ 56.6929 386.1077 null] >> endobj -638 0 obj << -/D [1876 0 R /XYZ 56.6929 401.9804 null] +642 0 obj << +/D [1883 0 R /XYZ 56.6929 347.8768 null] >> endobj -1882 0 obj << -/D [1876 0 R /XYZ 56.6929 368.8239 null] +1889 0 obj << +/D [1883 0 R /XYZ 56.6929 315.1782 null] >> endobj -1883 0 obj << -/D [1876 0 R /XYZ 56.6929 333.1161 null] +1890 0 obj << +/D [1883 0 R /XYZ 56.6929 279.9283 null] >> endobj -1884 0 obj << -/D [1876 0 R /XYZ 56.6929 266.6983 null] +1891 0 obj << +/D [1883 0 R /XYZ 56.6929 215.0111 null] >> endobj -1885 0 obj << -/D [1876 0 R /XYZ 56.6929 206.1673 null] +1892 0 obj << +/D [1883 0 R /XYZ 56.6929 155.9807 null] >> endobj -1875 0 obj << -/Font << /F37 743 0 R /F53 957 0 R /F21 654 0 R /F55 965 0 R /F23 678 0 R /F39 858 0 R /F47 874 0 R /F48 880 0 R >> +1882 0 obj << +/Font << /F37 747 0 R /F53 962 0 R /F21 658 0 R /F55 970 0 R /F23 682 0 R /F39 863 0 R /F47 879 0 R /F48 885 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1888 0 obj << -/Length 2595 +1895 0 obj << +/Length 2682 /Filter /FlateDecode >> stream -xÚ¥ÛrÛ6öÝ_¡éKåÙÅàfú‹“:m·ñîdÚí-Q7銔5N§ÿ¾çà -ÁRH½6°OŠi¶XlN…›æMC€zèãñø ¦žÜDOÑú¤f‹plU7-vEYÒè:œÚam•W/ «^áñûqD|SÜÅ3Y -Gö´9¢K™0—Hw ÊÏùýV›2.=Ô£t¿´¯G€z=”ô€(œ4(Æ‘bÜïóðݪ˜¯†8‹H¤@=Ä›ñ“ -&‰gD -&¹Nû¾1#ûÒÜËÈ4J™¢ê¤hž#áX©G.7–AœPû»‹ÅÈí -â†I£÷x6m:½õú¯ï -°¥…ç€uE_’ \ëõíAóz½ÎªË¢ÊŸÁ0‰Váì(…R$,á&yJ<–ku¨gÀIÄ:Ðó6^STÊhºÎÚù*tÄœnh²Eu3S 9ÈN#Ç"‰‚ðhœ8jÀº -¤äés"Ú1MȸÎì‚3»Î™a ’mAÖ`os@M’=l‰
ãÛpOPB˜‘èa'¡ “0ë’ƒˆÕÜBÔ¦0›$G\Ó -ÌúÀ5oëM;"™D³$yè›Ü†k1Ö†kbŒµS×ÚÍ`y¢Êç^Óo”8§£&°»®Û€*¸9Œ‚È|ŒõÂÊ2ÍÝн¼Oñ#>%!×hÔî%8äÎAR$œ1ÃtîE¾+qG—e‚ohï[|ï[RN;ØJPÑ…Ý¿Eê^Q®—·ñž"Иъw®qÿÁŒˆ÷‘K>éIê‘1O‚B,xRÂ{ž„1Šl$é\ FÞ•à\) ®_20&;p$§ª+àºj¢ÞnæùS:¦ó‡e ,Ñ?P7#bÑ`póÁ@,ã—ÌîìØ=F2aÍ0‚t$XuHW2QÓ9&r„¡@@A -!MÞÀ*§Áùå¦5oZdÃv v6÷ª›¼ îiøSØužõFy*„ˆåƒc:•†Êðe‹Mjrƒ‡òÓ‚%¼žŠËŽ)åô>«ìjOÄâ"ùo‰1Ô÷5)N‹j^n^²Ú[<lÚ
Ú»Eakr•H´`ÅFaOÕá†A=ˆ€e½!Á9(é¥1C«ÈÈËc•¢áJDë-˜Vzõ4YQ5' º0§émÝ4ÅuÓùç˜`–H»’d</CîNUW«=+@4Xæ‰ -ý§.\ Ëš|f5AAšõ"Ô ymo'Üo›a\'Í÷u~Ó3+%b¶øþJô¿XØÀ¸ˆÊºsî" [Ô[_Aàø-4YÍ1$q„Ža?I¼áv
õ=Ét—Ý7¡ª r“Wù†úÞ~_ÔÑÐH7Ž—þÝmÿPçz:ñˆ2T°òòüâ5mN ²›M¶1Õðãz¦:|¡9ˆ å%?Þèpð ˜6}ÖJð:è6SMRÀï^ -^÷Ü@×4Žú}FS*6“}=ô¹Ô1É»¦p½ö¶–ù¾dÒñXC÷ÄîÉÊ&Pø¹ªwU ¯»“ƒ](Q‹G.UL¨îÒgAÄF0nðÕºï¶!a‡‚¡ëøBÕPÚ¬ga{gö¶WÏÃú’X\ÓJdÊ?)Ýn[6ÂdIfºèqYê´{$_ÔTÉá›XKw7«â–@”XpD&Š«i |ÛÆWgÇx*åÁCVpÛì.+ʬóÑÖY2rsõÔº ñàcž$ê³O/Þ_þt6cº8¼‡yh¶¾t¯8Á׉æ`s¥Ø^|ÉþñÚáÔÑÿñÚ‘„}„ÅîH%,Œ1ø«af9ŸþéQ÷Ö¡Nö—õ<+±I{>AûÏÎxäæÏC£;¼‰,ò¯$dχ½&Õ“Ù]ûÕ¢+O -xúj9zµ{p5Äé¶?DbÔÅèp¨»ù@HûÞ àã:eÔsþõõBô$Ù¾4žä¢W‚hTùjÍgë…y>Öa¢È‰R>ýƾy¿ü¯Vš/º¼¿–úÃy.‹·g_Òr)Êò݇”_¾ùzmtD©~
ö8rÀ€WÛ7¿¨ÎÝ¥}ùã.ýu÷iw¡þýëÛŸ¿ÿž¨û\ÿ;ùÓwÄýßQîÿ¢Õ SÎÉñ!@딊Hò'„9$½û3ó!íÿTQÖ_endstream +xÚYÝsÛ6÷_¡é=”ž‹P| ˜<9‰Ós¦ù¸‹;Ó™^h‰²x¡HU¤ìsnú¿ß.€(šŠÓ¹=\€‹Å~þ3?1³šq•§³,O™æBÏ›3>»…¹Ï„_3‹æÃU/¯Ï~x£²YÎr#Íìz5àe·VÌ®—¿&?^¾}õËù\jž¼dçsÍyòîâýÏ?íãy.“‹/?Á«Ì3‹rvþÛõÛÞh5`¯òœe©F©ñ?Þ¿~Å^}xÿ—ž]^Gq‡G\¡¬¿ŸýúŸ-ádoÏ8S¹Õ³{xáL乜mÎR˜N• +”úìÓÙß#ÃÁ¬ûtJEZY¦Ì&t$Õ”ŽtÎŒ‚)<ÊÏMõoÒE×?Ôåóó¹<ù‘ú–že³¤A»¢g]5%©Iåƒøl.,Ë…&Þ»f¹`‹¶YÑÒ#a´a2S^ŸUlS›lö‹5Žò¤«6ۺܹ_ÍÄn¹fÊFM±)—'wóeÚú¥àŠçÉõº¤Íþɹ¬KÚkß•Qûõî\ؤô]_ôå¦lúî9}2¹uí¶¯Ú¦zF“ +3›K!Xª¹ÖÒÉÑ•»;wF§}ÿ!½Aã=>—£uÎMÇÇ#=V”€Ó+ä}¬¥4e9—ÁÉ)ž% Ù¾¨ðœø†*»+ýL] Ö@«©§D0)ãÚhÏ{Y®Š}ÝϽ‹b
Æ›ôËiÚò¬ÚºnïË%½Ý<г_ûeè¤{%4KS>Ò}zWR$ÅrIfî:" ‹» z8>nˆÄ‰›¥èBZ*8lå?[·]O£ûª®itã¿Ù—~n]6žo‹O~ÄŸ¼Çëmu>(<©ïNìÛ½·P ZI‘b’ƒccHN¨[r–ÆH³¥ú„!eÆl&íÈŽèž¹šœq©Í؈ÒúóåC#ÕQæÞˆ@ÊɽU,YÅR8 ý~]aÊò¬– ‘ +tÌ·˜:O.˜ÈLrú R0ÉÓ|sr®TBli™-Sá¡øœc’+ÜX´÷ãÍ! BÊW‡½«åÄî +J€Îõ W*“'[gÿö®¯\º“±mèI„m½iÑn6.« ó7d(()‰§åÓJ‘±Œëì)õžª±' kÁÎû°MÕ© ×MÑ/Ö^™`#f°Ç.[5·S 꼌9•FT:me48z*hÉÉgEðcz!ç²<D²õ‘lc$[*H)ö kð·°& +é–„€†tñ½ßÇÁ¿‘êa%e ¯1c³q©ØBʦ›e'BÓ,ëé(4·í®ŸÐL–bE|›Üø«¬ñ V‡kÇ×zðÀ–†P$šrè-}âœßéSí»i{Ïʇ9Œ¼Ê\‚uÊÊ°”Ûãðr1ÅOÄ”„B“ª Nœ^Bà:ªˆÄ3”—^[0VÄãcH‡Øâ‡Ø’2‰´’*"¦Ýoõ`(;¨„û°Oåe,hÆ×tü`Å +ƒ«w)Í@$’ñËA8tÚ…_<€6eçÃ)ÈvO~Õ"ðFýp.„H&ñåŪ?€ò)㤂e˜¼žÊË–)eÓCU¹oËg{Ô ò[ÓkÕ,êý²ôÀ»ð}C¿Cw¤ ìÔÆ#òE¸FiÇAx¿ÃDªݑâ,tgRëc¯((ÊJQGéð¡¡ÃÍÀ4|²&4'‡M¾nÛ®«njÿ‘wçSA€U"dº.CíÎUÄjϦ +6Ê—TY|.iDõª”ð¢&êÝm#Vðk§”i +ݪËðúÁWüdX]pÉÈG4ÿuäDeçÐK¥ò뽆dœçöñEÊÑ5oÝ
Žï«~0Ÿ;7A +5†«W @Å!L(9H¥ä#42ˆS(ižYKy‰á²;úû6´‰,3éȡõÉcE ز*¸eQ߶;8Íf*È!9ïÑ/ÖåS‘R2)›Åî!à\˜80u¯«àÌG—"Èdcÿtêò +ÀÌË«÷¯iqNß‘ÝîŠÍ„«ú‹;pÕã+šQnÄ‹bºÓáA¡nÒ5¯¥d +¶õÉ4%-àó g{"î …¶û>£WB›ÙAÇ\n™ä±+Ülœ¯•S±/™´<€èzü>EÝy ?7í}ãÅë¦öä–¥*
¬6ÕW6UL¨¸é3¯b-×øÄ0lIuÆ#†Øò!…àP>T]Fwݸ<º½ +ãÐS¶åðR¬§½»uµ%‘‹âlî%ß÷áÎÙ2žK9ºÉòa[ÜU]Ä
i`S4á’ÿ +õå/ï>þtéc¹
<\„9j Ð8^O„¿nºÑâ°ØA}Qdw{ŒZžQÊûNT,è$öG®³Ëó£æ†óä?N3÷twí‘¢°¾nEmÚ‹)l<¼x†ìÀÃáý…ou§vú#2ƒŠl¡‰:úÆ·ýŠÔ"â€ÿ¿!Q÷Ã÷§ö–©ÿ(î<ª3‡îÀó›:!õ(8ÒJ«4üãÏœÄD2Cm<i÷IÑäëM±˜o–zò0X)J’”'ß™7ïVÿJÕ‡îKZ?ÜÈôÃU)«/¿äõJÔõÛ¿|7}18ÃÔ_·àÉøëÄ<žâþ[÷ð·vš1eœþÇ-F“B¡äBè±èñàDzÿ1'¹endstream endobj -1887 0 obj << +1894 0 obj << /Type /Page -/Contents 1888 0 R -/Resources 1886 0 R +/Contents 1895 0 R +/Resources 1893 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1891 0 R +/Parent 1898 0 R >> endobj -1889 0 obj << -/D [1887 0 R /XYZ 85.0394 794.5015 null] +1896 0 obj << +/D [1894 0 R /XYZ 85.0394 794.5015 null] >> endobj -1890 0 obj << -/D [1887 0 R /XYZ 85.0394 420.6717 null] +1897 0 obj << +/D [1894 0 R /XYZ 85.0394 368.0049 null] >> endobj -1886 0 obj << -/Font << /F37 743 0 R /F53 957 0 R /F23 678 0 R /F39 858 0 R /F21 654 0 R >> +1893 0 obj << +/Font << /F37 747 0 R /F53 962 0 R /F23 682 0 R /F39 863 0 R /F21 658 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1894 0 obj << -/Length 2221 +1901 0 obj << +/Length 1897 /Filter /FlateDecode >> stream -xÚ¥YOsÛ¶¿ûShz)=¡øKï¦ÚNêNíäÙJçÍ$9Ð"lqB‘ªHÙM§ýîo)R¢-g::\.‹Åîow!6¡ðc“Øp3IŒ$Š25Y¬Nèä¾½;agÚ2Mû\?ÏO~z+’‰!&æñd~ß“¥ ÕšMæÙ§ègÂ(94º¹>?›ž½¿~ûîâútÊŒLd4ûðáâúüò§S®(0'¥ÑÕìúãì7¤}85<š½»¸=ý2ÿõäbÞ©ÕWQátúãäÓ:É`¿žP"ŒV“'x¡„Ã'«©QRˆ–RœÜžü·Øû꧎švÃEÌÇlaz¶0œ(¥å$Q†Ä‚o‹Ü~zo;Æ©PDÇJÁ€så9/Kؼ¤Q³´0&JïªG‹4ûgºZöMÆú«j’0&AU'dSf‹‘9'Z˜žò¢@¹wßp©ÌÞ§Û¢Aⶠ- &@©íæÑn‚V«¨i±¬êÉŸ)†'„ÂÁC®´Ìöd}µaM˜^Ø,,®¦NíÉ”qFTBÁñ#F)î5†½»yŒ±ÜE€»œU«¯a>çQS…§_…³v@ï6 -,dŽ„ÆíEˆŒÙo·ï;¿ó×h×¼ 9º— ÷¿µAê -¤#RôÛN–¸Œc´í¿³ÄáX¬æÆ;ŒXe*$tqPL3û8ÿåýÍKf‘¡Ûkì¦lÁõö[
G2Æ8ÔOùvµ[WB)·§!9TJu½64Ö”ÒƒúÂœ…nÊcšCŸqÅQ\ŒT)^ŸÏà™»sÃn»D‚mŠóΪ*^ãDßÊj]çõ~ƒ/ ft,à€L…Jy¤!‡Äl¸r‰y¼[wý°K!=‡Íz{“ÐqîÝ¥ŒOÓôK;ºÃ}©§€ÂŠvf©¸¢d®xoK°NæbDf{;Љ¼Ï‹ï¹ìF_G„CQ¨®òáe篾>ª¯/ýåq€Ož¼Íˆ<èPø£äC8ÄÂþ[ñ»_U7Ͳë×[ 9*r±ÜTU“åcutcLuîÒ Ý -}Þ˜<.¨vâFqŠq¢
âïüâöìæòC¯~a/CøK
î”·.ÕV–Ì´¹ËÐ&äûÀÑÈ{u¥ 5üHß -u|W¢»¬Í“è² +§a5/£MÛ*Ã(
K§Ž¶Ì1Ó:rá°ô}3}竱§ ÷TÜ•ØZÆCÅ×ÄÏ”‚À_6¾¦>J$׃ú%ã…‰Q¡0®òÛ`b«×Ué[¹s‚¥¸2æx1"‘qÂö[£¡4Wʳ—[,à«°±®ÈÄãõZg4eS”ðNü5&H]‚º¡’.e¹w8Ûl±»Ú“ ¿l’Ái¤B§ÂæTGÛ@×n@íŽwh¥!1˶š¦cf¡PªVñj‚Bb™îd×xñ¥¢í 鈩Me¬ïIãÇ Ü¹ïÚ(>ܼüÇ*Ï‚Ë°íÒÚ@Âñ5À„J’Áþ +xÚ¥X_sÛ6÷§ðåeò]ÅŠ¤(ŠÛíÁMÒ6[㶉»Ûíƒ"1±®²äYòÜìÏwHP²l+Kz;?˜A +'"ä¼¥£ëÑûN`oÕntXÃxĆ|¡z¾PŒ‡cJI‰¾ø¢ï'~ö5ºnºÉ_Æ°1¥D rÛÙwÕ:oKä\,“Ô_fâ»#hyQxÓµnÀg!pž\ñ×ñ»èÅÏ[õÛö×íŒÿòÛÏ›÷?þx‚{ýÁãþ±‹Ï_2Þ³Äç‚Ä‘0 +£{Ú½3 +”º=Æ^;žã<´g^8ÔlãöºcïõåôÔ¿<8KŠ õº´«#òÆmÝ)‹ó´Hð¢Ì¸*›$/-§Ür“ÔÚBœè2²¼¼ÃYuûBúï
@ ¢Šª¶ 3{‘ðŸU›{0þ}S“H+ŒAøóHb>ßdkL \?Y!¨ç‹8³(æâ8‰eL⻽y;7¨·ñUœ(B"Cþ8>H)𤃿K6î€ +‰;4 žN¾ŸoÀºªÖ
..x«)^ +oó
hhߘሑ ÜÔŽ=¯ÎMíªÐùwºÔ"î*ü[CDUKާ͛cÑ<¬ç#,¿½ëÚ÷UµŒpÌß#G÷ñŠÐœîTŸ"÷ |¦©P²2ùÖhÜ°W… Q¸‡üÄH-$`ª Ž‘0-gçâLsœ½;7B².‹{$´ÎαF†ŒY0(hþ·ä
Šb«¾x +„Tm†8Œ:Œô€„¬Kƒ>ráB¶<sÖUQùBôvŒ„Öm·Õz@xè„ÚT3`=tm#,ŠZVôVìXu`´ZçÆ%.i8‹ åÐ}[Òì +Á)oÕã˜}F}“–ÒëTÌ4/ÕÌñS’L((}¢Õ&TÊ»Öú@ºçanË^»<„C”HÊÇÄA$ƒÉ~ÒkÆz–M󨻘áHáß4[æe^7Ø&éJßj¼÷2uÛ.“r“;pÂnFCGU`ó`jp«Öõ¹ËŒé›ë·¿‰ó,ˆÍsà™«Î½x¸Ö&©}J ‘¢ÿ"¦ÒÔ2Ö‚âÿóı 4Š
æF]8xÅç!¼ß ÞŽé‡ùë·W»å°k]¶àz}_ÃU»Šq +S¾YîÎ
¡ ŠºÛ„4ê>À›?‚£Î°r }ŸDÖ™AŸAÅà*åqwbµùožÝá¶]Á牉ͪ*ž€®×÷eµªóúð˃Ñ#Ž¸éq¹dCß (+&Lþˆ`^ÁF;Ç_ºÏÈslµ)ýäs;ºA‹Ä^„€ª"è RP=Fšv½ºNf: ³ýЉ¼Í‹o¹èF_„C-E×ñ€ð²‹†§_=ª¯möå1@ðCyëyð&åD°ðàã ¶òøq;>_?ªn’ek]×O÷@ó¨Èt±®ª&ˇú=xQÑ…K'tó¨PxÙ
Éc! endobj -1893 0 obj << +1900 0 obj << /Type /Page -/Contents 1894 0 R -/Resources 1892 0 R +/Contents 1901 0 R +/Resources 1899 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1891 0 R ->> endobj -1895 0 obj << -/D [1893 0 R /XYZ 56.6929 794.5015 null] ->> endobj -1896 0 obj << -/D [1893 0 R /XYZ 56.6929 513.8248 null] ->> endobj -1897 0 obj << -/D [1893 0 R /XYZ 56.6929 427.0967 null] ->> endobj -1898 0 obj << -/D [1893 0 R /XYZ 56.6929 364.279 null] ->> endobj -642 0 obj << -/D [1893 0 R /XYZ 56.6929 325.4767 null] ->> endobj -1899 0 obj << -/D [1893 0 R /XYZ 56.6929 288.9693 null] ->> endobj -1900 0 obj << -/D [1893 0 R /XYZ 56.6929 257.0263 null] ->> endobj -1901 0 obj << -/D [1893 0 R /XYZ 56.6929 191.2867 null] +/Parent 1898 0 R >> endobj 1902 0 obj << -/D [1893 0 R /XYZ 56.6929 119.4786 null] +/D [1900 0 R /XYZ 56.6929 794.5015 null] >> endobj -1892 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F23 678 0 R /F21 654 0 R /F48 880 0 R /F47 874 0 R /F53 957 0 R >> -/ProcSet [ /PDF /Text ] +1903 0 obj << +/D [1900 0 R /XYZ 56.6929 449.4646 null] >> endobj -1905 0 obj << -/Length 3038 -/Filter /FlateDecode ->> -stream -xÚ¥Z[Û¶~ß_áG/pÌð.ç)iÒ E»ÙÓlm´–±%×’³ÝþúÎð"KZÊNqàQÒˆÎ|s¥Ù‚Â-Œ"TX¹È¬$Š2µXïoèâ3¼{ÃÍ*†Ton^}/²…%Vs½xØæ2„ÃÅoË×÷÷ïîÞ~øõvÅ]¾!·+Eéò§×w¿¼þÑ?»¿µ|ùúý»O·+fe&ˆQ¤ÓtùóÝÛïVß}¼ûþý»»Û?~¸y÷г5dQ<ýyóÛtQÀ~¸¡DX£OpC ³–/ö7R ¢¤ñÉîæÓÍÿú oݧ)Q(aˆ2<KÈ‚³cÄ*ÅGÂP–hÁ…ÆÇû‡ï>½Ø %T¼2Îà#˜<©„@´RÅ…JˆT¸î*Ÿ.iÂðËKF¢Ä’b°$¨[0«ÆK¾m@»F/óS×ìó®Z#^5'&“Ã/Žu‰†³s`‚sˆÖMý;¥üóés65ÀD2³|ØV_n}¼…û2ïÊð ÷ühWúé…LϤ"2Ó|ÀùR>'Q”茪@XÕ©É -¤°Ï¤™H9
†ÃžÉ€Å§rY”xW;´RåÐêžnòÓ®ó7ëf¿Ç½;‚õ6¯ërçßôOÁÈnÙÔvæìÂ?Ff<án×<Uõç„üSÄH«®jBQÕÕ5gÎN5.Y™(p<SQ&><UipŸ”×4'ˆ4R4‡1£Û–~°kÖùηMÛù‘[ÐêÆ_7§#|rô7/|ˆã]i¹ÇÊ¢–{Ö>ÕuZn|êÝŠm…&ù¹tfÁåN6“ ’‰,‚Éi¥õäÞâ¸ÒKë¤Ñn€IÔUI˜ÿ@Y0ácéç?µh÷n‰°váL·9¬ªÀ»7åÃ._—{ÀTë?Ü875à5[/:Î%|=1…{µD¨,ê3½¦‰²Yhþ3§T´…ÏÎrÍå_UÛ¡î|âx¦žç©ß΀«¬—«Ã"Au&˜ƒ þ@l9@ˆg2>†Ð‡
®kiCF³o¼týÃr—?6G´w;A¦®ö<êü, -™OÔç³Û!Õ|vÛS9‘?zFÁ~G"7¶W8D¶ú»œ²Æ ›Ï2@ûEÞzªs#-K°eÙ˜»O}º…p—Ü{(8ŽÜ¨ÙL^A@Es|æ¢9ªðà±êZ¬“ sü鄱Ï=,ãµ{*Ë@ɬl0PŒã@¸)þCÓ#0&ˆab±sFꮂÚ7óÚ¡„vYÛªÚŽTNÛ딶Á¼!“9k{SíÚÎcò2k‘(ÁÚX×\<àkÄÛ/!¶£UÚch §w³i§AÁ÷‰YtÃXç2ùͳ¿ÉÃË|וÇ:„Ÿ ¿D‡°ƒ…Þõ -HfÓèÆæUO5¡œê+ªP]P}¤rbÚ¾(c%òÊ’‘(±ä¨ŒµDr5YòþX…ˆºŽRß6Ç`í RócP@³™d ^eñã: #w®òó©Ï¬œ>Óá›sž}cÈ¢x~M52“ÄfâŠRÍ«¦§rªùò->Cˬ¾ÈÛÙ¿d.éƒGÜ|0æ²AG:”H0p¬¹‘×ã€Æg,8šºå8æ%ćíЊ€û“¯GtŸzçþò5ßU…Í>¯ê3ä‚~ˆ¸šúâDÑ -åš‘Ã2auÉ¢õUØà#£ö -lT`©lWas@k›b†S‚û»ÈW$Jð5BWXáOGmЀƒ¾vPŽãÇ©=aé²ü„]SHá¸×ê^€¯èë¤Ô2eXqY·g_'ƒìl|%·OÕ]‚Fûr{®t¤Dö‹¢3ib_äH!æqŒW3Pß,˜ ÙÀnˆº¦!Õ<˜z*¦cL–h#zK -ÅwHApŠ{ÝZ¢„œxœöP·÷¥^Ñ8ß©”ßtðhûZ¥'[¢†ëWEùõUØW"ˆ©î;¬®¶„Y±ì— ~ׯSTëÒU aÓŽ¿†@2”(¾t.®~åºl[¿kf4F‹I¿*:pp™×Á]WõáÔ‘Ä.
žœÛ™nà3] ™õÜÙÀô2…è.ç˜C¡å*o¤(þÚ7•ó„˜ÐÑ˳ð1¨Zð´sv@C!º,SS½à>4ŽàIU.òÂ?ö²iÓÓñ¥†Z:$«®W4 ÏSªÛÊ¥úr˜È£Št7^2Ý÷)êµ!DÏ’‰áÓaè×XÕ´Ô‡†ú±Çrqïó¡k½–ï©.8´HåZ{µÔÉ‹âàœ*u.²Ö—:/YK–:#ÞÆ)úçlùáÞ?@Ö\lÅ¥¨È ÞQɲëÝ`fŒžFEœÝ÷¢`ýs¿œÓA¿œÓq¼tßÌÇKÈŠ·âßÅKïJ¹&LêoLÞ¦íìæ𘯿„Ra$AWpC± ?6‹E®ÂÂà"‡TóXì©»dp…ì)êl½=6MΤF`„,ÓjHÅ/2×S%¸ÇVN¬ùŽØ•·µ±ò¶v®ò†tOu¥]Ç3-§•7NÙøë¹ò¶¾³kÍ ÖÛ‹ˆ‡2É®#ÞfŒ÷½ÈÝÎOZn’w8n\ûm%ÁÍ¿¯òbJ -&PZfêŠ -÷æ½² -®:ב†{/¬ä%_…BȈ³ô1Ã˶'òn_,«p…%aþɪ›æäÜ>z>GB€òä£7Ë¡€Síß3¯ú.J¬Wk-Î8¸kÑdHuÁ‚#•ƒúéjaî8Wk]䫯µ^ò•¬µFŒÛuêr¶«å|×,Ë»Ò5³œÙ©íöP’¾ÓÁíÍSíÒ)n&ë“YÁ!_¤öÛПžø -ýÑ
&H€›ÄF3Eíëòè{Çí*xåÃs˜<ßµq—ƒSþp6‹)>¤{M½{žÄ söH—Õô¼õl ÃnVZcÛx PÅÖVm\W~»ƒË¬8”»Tk,¬ˆÅ̽ûõõO÷?¾û”Ø=Å0A4ž»ðŠÿ!jbt×<¥Nl!n -{ý/„²ÑÙé8
œ;„œã¢'çxásx:%ÍðXGCZC¹Žì4¥iÀÓñWQ‚j(Ð*,šp˜ûKÛÓM]:#BŒp=ždä×nסXqCÖrh -Ožž3ê:\âü¯žîØìÚ”×Ôf\^þ™
é¿`èóWÛ†,ò܉=†Íxe¢ià]UÇ Ê¦v“Üœfqoâ…òZÒo:`+gÇgßóÈaWfíèÌümN("ÓÍVÚ[æÿý—ºó_!»Æðt\T"üXd -÷ÀX6e½ÿóÝKÞÿn9ôÝendstream -endobj 1904 0 obj << -/Type /Page -/Contents 1905 0 R -/Resources 1903 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 1891 0 R +/D [1900 0 R /XYZ 56.6929 355.3738 null] +>> endobj +1905 0 obj << +/D [1900 0 R /XYZ 56.6929 285.1933 null] +>> endobj +646 0 obj << +/D [1900 0 R /XYZ 56.6929 241.275 null] >> endobj 1906 0 obj << -/D [1904 0 R /XYZ 85.0394 794.5015 null] +/D [1900 0 R /XYZ 56.6929 202.5209 null] >> endobj 1907 0 obj << -/D [1904 0 R /XYZ 85.0394 751.8648 null] +/D [1900 0 R /XYZ 56.6929 168.3311 null] >> endobj 1908 0 obj << -/D [1904 0 R /XYZ 85.0394 153.4294 null] +/D [1900 0 R /XYZ 56.6929 95.2288 null] >> endobj -1903 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R /F55 965 0 R /F48 880 0 R >> +1899 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F21 658 0 R /F48 885 0 R /F47 879 0 R /F53 962 0 R >> /ProcSet [ /PDF /Text ] >> endobj 1911 0 obj << -/Length 438 +/Length 3181 /Filter /FlateDecode >> stream -xÚ¥SMo›@½ó+öR™îì»GbÇQ‚]C¤Ji–Á‘¥°V1QÕßlg£8Ê¡BBìÌ›Ù÷ÞH¨{HÊ0C#@R”dÓ”<»Ü,À#&>buU߯yBÅ)·^/
Tk$eõ^Rˆ\®òé$ž,òëY–G1‘ˆ0].³|:ÿÅLRvHJÃû4HïÆØ22,LgY=•·AVžiùÔ‘òžÓïàñ‰’Ê)¸
(p£%ùãÐFš@HRp~Š¼EðãÜÐË¥pjWì‚ ")Ù;3¤ÅÌ(²l•Þ‹^«âžƒ”ÄL€(xk«Í/*©v/ü6Vö1Øìí¶OH/a×M]yè¡»ð烂j©Ý5Ãdæùt,5GRU³³»C×®»};†Võ¶n#Ôam7õº_Û×õËò¨40¥Ô±=!ï\‰¹óOH&Ü—DªlúPÞ,V_2·]ÝÚº™]ÝÆÃdoû¶Û½6Ÿí‰»°î…©Ò3ÅÿÞ¡·E$Àµfoëáëb‰W¬N¤zqˆúõÓ¶}äþjnÕÃendstream +xÚ¥ZKã6¾÷¯ðÑ
Ä>%{šd&A›™ÙLX ›ƒÚ’»…Ø’cÉÝéüúTñeI¦ì>ˆ¦Jd©ê«'Å~l¡¡ÂÈEn$Q”©ÅzwCpï‡æiVh5¤úöþæÝ÷"_b2ž-î7ƒµ4¡Z³Å}ùëòý—/?}¸ûïíŠ+ºü–Ü®¥ËŸÞúåý¿ÝÜ—[×ïøøõvÅŒÌ%1Št]þüéÃw«ï>úþ‡Ÿn»ÿñæã}dkÈ:£yúãæ×ß袄7øñ†a´Z¼ÀJ˜1|±»‘J%…3Û›¯7ÿ‰îÚGS¢PB¥yžgƈQŠ„¡ÉV>~ýîç»/÷wŸíÛØgNò£‹7„K–YâCS®Wë¶Ù<V§êLN¹„§hªCÑWÈT›%<ö?Jùãæê¶q“8³
›ö`IAr +’¡‘…ÄÖœ™Oš’<_Þõ~çÂïöP¹ë±«J7*üÖEäñ¹jêªñOÛ¾:4Àï³²oÝõåP÷+däÃs"´Ì«(j`¡nÒdËþ©rì +3`Wb¬Zã;kâÅTFrɵ§tòr+
¾„Qv;³n‡[¦—U·o›YHˆ$Å•1~Aص?´Û.±³0Df¹§ÃÍ‹¢ªù½zM,4 ”@Óõ€ˆ¸s,×MB:#ÚhæiŠ]UΉ'ã$ç4@îáÕúì§É$˜Ž4cõ¼?)vûzË[~OJà5/¥ÇŒT30q¸ÕË£Ÿ{©û'7µ;‹Ò„id·*Rb¡$* Ý{›€Õ-Æ`í®êÝÄqï&Š„¨rMel¤´ª=çSÁòG¸þs[—ž‡'ÿÚMUù)´ÎY6WDåùˆ/.H¦”ògv)mòŒHʦ<‚Cv<â !npÄý&DS&Î èWÞöíc/~¸‡Oâ>ºbT)`±•” wî¼âgë=¿žJ¨gøW:Ç<ÑjH|÷y‹T'\
·4‚¡ùå-QbË¡° b +fÔxËÖÿï9öíÌgP˜¤ÎÁ^ö×Àç/4Œ
è¿ÁÝ?ÕÛníÜZ&™ó×Y€HRA<Èø›ì"Ë©ò„IwP2bû]Õ¯ÓÐͳvµöL¾<ßÏÕ!±2b-TB÷Ú¡]”õ!±þJdšhPÆØ‘½`5-»}µ®Qh¯8n¼<A¬¶£oï>}ðsáæñÞöÀ,s{`Õ¦<ËÚxÁû5Ñ¿Úkð\ó\)gWTωdÑóÍxWªÍ0¤ì™s_ë_ìúÐ÷C¥ð²äYvî® Ë‚x«õØ]ÍF6“E&£»¢rYVø¯±h¥Ê¢ÕÎnŠã¶wÖín缬!`5ÕÖ݉³`d·l ê;9L#3Žp»m_ÒQ^0E´4êª&5A]6îxÎŽ
nYy™@8<WäÕi@@–R^Óœ RK1к`u`°m×ÅÖ
ŸÚÎ;huaÔ´îº9¬¿¶Î|ˆåÒ'Î5äÆöh´OÜïçcÓ¤å&¸ãè–Fé.l’§Cy ªÈ˜¬V:Gî,Ž«liÜD현yÕcRAõPY° MO`}ŸÒâ~ïÒšn»_ÕžwgÊûm±Ž <èÂú€×|©Cb+¡fÊ&g6*æßé`Q&IÑ7sJE[x´–ƒˆh'Ȩþ¬»Þ%×X»yž©ãyê·sà*r½–G‚?P#[öâyŽŒ!t·Á}]á +yeË@”ØrTƬ^'[~9Ô>¢6‚£ÔŸÚƒ7„î©ùÁ+ ÝL2§²nÚ—°®òñ3+«ÏtøæœçoYïØ°˜Wbࢴ¼¢šÕÕ*«šßßâƒ1´Ìúà‹¼|ð9sI<ânäƒ1—õ:Ê|‰Ëš9=h\Æ‚£©[+`^B\Øö¸±;ºz$‹©wá.ÏÅÖvÏ`X¶»¢nN¤vQþ>àjê‹E+”kZË„Õ%‹Î®Â†fÄè+}©ÑÐx"‹™ýUÌìÑÔ¦€Áì^îSæœ)1éEBq?æj¯}_Þb!.Ì Ç;–M;zÁ*Óæ÷ ‹¦¼ñL\«x%1"VH[¨bªÆ³bómÇ +l¾öîÙÙ¸n—ª¸%ŒÆBûÇ"¹Ô¡#±B´ãLŽ™Ì @w³0â˜=²\]ÆÑjH‘Ê"é@’!™Ñ@qí.™(¨ü‹ÜEª{#H)ˆ"š²1cL)ìŒÃE-»öhõ¶®Ü´Íáê¸u4eÑnÖi¾ú³Å-’8„â²àŸÚCýWèf\Øúïy"a)<ìtkˆrâkºW@ÝÎyek½fÆ ðîÝÔÞ¡í¹.+7‘ìô3MD<>zWVÏïü{%Âf±·j«JXNp–®ñûÃõº²µg8x@þ"d(Q¼i9\ÝÎMÕuî™Î0N¨IÚEŸþк@íuÝì=I¼¥Æc×S#Ón|¦+1!óØÂ
Iç‘ÈÇ
p9‡J,[s+/
Oyp×ÓIˆõ=ßÉ–'ác85àf'æl†B´ùeF]Ü‚ÿ¾e3u¸(J7íd«« ⊯2Ÿ¦Ú.Ѐ>©>+—*Ëa +(Ó}xɲءhJÛ€ô=µH&:„{V‡¾Sc4ÔÑZLPï[ èÇ|°ÅwŸuhL3ìt\Ét‡Tó-RY‡Ö]-rŠ²<x8§Šœ‹¬Å"眵d‘3âmœLñ Ζw_ܲæN—=Å¥¨È ÞQ¨¢®÷™ÖÙ4*âê®ûŸ:åœ:圎ã¥}f>^B>D¸ÿ,^úÌŒ°éùþlÚ6md·û‡bý»/F´¥vN +O—%»Žx“ÇO&^êíÖ-¿/€1HÞ⸵·•7ÿÞß*JÿÙ‰`¬xzPUÖønÎ+°ýë0`Š™¯Q4¸M¿í°TŠh®žyXÖ…a?‹¹wm{Ñðß k> AÚÀˆµô1ÃÍ.9·/Üg¸A½…õ'»nÚ£u8õzŠ„GFÍr(àTã7ÇcÌ«¾‹cÄÕ*¯Z]ÉŽDóöˆ,ÎW«,ˆq‡¹*ëS±Ê:c*Ye
¹òVke6“ó²<WìJ§Ìpf¦VA¾ñ°¶ƒö¥±‰7“ýÇi¬à)Ró6Ì觧¼°C<®ÁÔPu·I¼h®ˆ¢±^wÜ¢"€T><›Å‹mÞrp²ïÏc1¹§flúm³}DŸá4õôŒõdÃVåÛaOá í¬ ÚxD—H b‰àÇm pÑø9ÍÿýiäéPi{µ<SA%¶Ž,S(*Æò)ëñ#ÊsÞÿFðl“endstream endobj 1910 0 obj << /Type /Page /Contents 1911 0 R /Resources 1909 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1891 0 R +/Parent 1898 0 R >> endobj 1912 0 obj << -/D [1910 0 R /XYZ 56.6929 794.5015 null] +/D [1910 0 R /XYZ 85.0394 794.5015 null] >> endobj 1913 0 obj << -/D [1910 0 R /XYZ 56.6929 752.4085 null] +/D [1910 0 R /XYZ 85.0394 751.0357 null] >> endobj 1914 0 obj << -/D [1910 0 R /XYZ 56.6929 692.3565 null] +/D [1910 0 R /XYZ 85.0394 641.026 null] >> endobj 1909 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F47 874 0 R >> +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F55 970 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1131 0 obj -[646 0 R /Fit] +1917 0 obj << +/Length 733 +/Filter /FlateDecode +>> +stream +xÚ¥UßO£@~ç¯à’co³ûˆZ=/Z{¶&&êì‘+‹4Æÿþ†(.MÚaùæ›™of§Ì§ða¾ÒD[nýØJ¢(Sþºô¨¿wgë1Ñ +¤ÛmõÒ»°‘‹„*„íRë<j—'x9Ú„ ¶§|Ìñw×äZ/Eû-×cÊÔíÒ-ÚëÊÝSÊ7»:m‹Ê}ÃÓ:4ÁÎaPiFA#- %Üø‹‰`FÀô´É]iès”N+^ñ‚êà¹.\‹fŠ?MZ>osdvÄbpð®
é"O„ƒFH]‘@‡\†Æºªë™ ož+—n3Ñ@b˜=ÄjëjÛLÄ–¨NØ™`“iÕcþä¯<€Ñ*6mÚæeîÚsn{Åûb°™ÛW|*\Ô1ú‘àŒ0©5H>ŒnG–×í0 x5!¯´DÒ!¸KË<ûT_Kb¸=ôËÉaÔ[{8£3è5ºm03BÆ(—³ÆI.–W__¶Žýž*jà‹
#Ó½P£ûbGh¬a¼™ä„5ÌÔÑùü]mŸTV®hZ¸KUG×ùSŽ3æÖýÕ¼Äë7Ñxm×Ð3¤'SzDö”T\ºè=6¹Yý¸ºþZs×æµË[ÌdùÚÀl5øp\¹¦ªÛbW~¶!`·D'¶'}Kñ¿wõû’Œ‰0†¿¯áƒí+ÎzHª+Ž1ó!õa«Ìý ˳Øendstream endobj +1916 0 obj << +/Type /Page +/Contents 1917 0 R +/Resources 1915 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 1898 0 R +>> endobj +1918 0 obj << +/D [1916 0 R /XYZ 56.6929 794.5015 null] +>> endobj +1919 0 obj << +/D [1916 0 R /XYZ 56.6929 752.4085 null] +>> endobj +1920 0 obj << +/D [1916 0 R /XYZ 56.6929 626.6031 null] +>> endobj +1921 0 obj << +/D [1916 0 R /XYZ 56.6929 566.5511 null] +>> endobj 1915 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F48 885 0 R /F39 863 0 R /F47 879 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1137 0 obj +[650 0 R /Fit] +endobj +1922 0 obj << /Type /Encoding /Differences [ 0 /.notdef 1/dotaccent/fi/fl/fraction/hungarumlaut/Lslash/lslash/ogonek/ring 10/.notdef 11/breve/minus 13/.notdef 14/Zcaron/zcaron/caron/dotlessi/dotlessj/ff/ffi/ffl/notequal/infinity/lessequal/greaterequal/partialdiff/summation/product/pi/grave/quotesingle/space/exclam/quotedbl/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/backslash/bracketright/asciicircum/underscore/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright/asciitilde 127/.notdef 128/Euro/integral/quotesinglbase/florin/quotedblbase/ellipsis/dagger/daggerdbl/circumflex/perthousand/Scaron/guilsinglleft/OE/Omega/radical/approxequal 144/.notdef 147/quotedblleft/quotedblright/bullet/endash/emdash/tilde/trademark/scaron/guilsinglright/oe/Delta/lozenge/Ydieresis 160/.notdef 161/exclamdown/cent/sterling/currency/yen/brokenbar/section/dieresis/copyright/ordfeminine/guillemotleft/logicalnot/hyphen/registered/macron/degree/plusminus/twosuperior/threesuperior/acute/mu/paragraph/periodcentered/cedilla/onesuperior/ordmasculine/guillemotright/onequarter/onehalf/threequarters/questiondown/Agrave/Aacute/Acircumflex/Atilde/Adieresis/Aring/AE/Ccedilla/Egrave/Eacute/Ecircumflex/Edieresis/Igrave/Iacute/Icircumflex/Idieresis/Eth/Ntilde/Ograve/Oacute/Ocircumflex/Otilde/Odieresis/multiply/Oslash/Ugrave/Uacute/Ucircumflex/Udieresis/Yacute/Thorn/germandbls/agrave/aacute/acircumflex/atilde/adieresis/aring/ae/ccedilla/egrave/eacute/ecircumflex/edieresis/igrave/iacute/icircumflex/idieresis/eth/ntilde/ograve/oacute/ocircumflex/otilde/odieresis/divide/oslash/ugrave/uacute/ucircumflex/udieresis/yacute/thorn/ydieresis] >> endobj -1476 0 obj << +1483 0 obj << /Length1 1628 /Length2 8040 /Length3 532 @@ -8416,7 +8470,7 @@ endobj stream xÚíte\Ôí¶6Ò ˆtÃÐÝÝÝÝ¡Ä000Ì ÝÝÝÝ’‚R"‚´t ÒÈ‹>ïÞûüž³?³?½¿w¾Ìÿ^×Z׺î7¶‡Œ5Ü ¬‡¹rðpr‹t´P(ÐWç…CfL9g0ЇÉ]Á¢ -Äü{fXE +Äü{fXE 0Üú÷äè¹aÖÃöOÃoäæìüØã?ûÿxýœÿŒ=ì a.ÌÁAb¡ö™9Y®
Ä£ò/z{xÂœ*Þè—ÖÁ»2#×Dj,ïêÃ8›ÇEµyÍî;Ýoª²n
öA™ºÓÁß‹(üèX>ã.3v±ms™W`gÅúϨ¯"› rnêèš—ß¡RŽwð9£_²Ò¹Ð_8=óe4%v>oFÀk(Ù?`LÙ½¼`êú4ð±ûåÃ&9[~ƒ˜;26cLà«|r)Sƒj…×Íl(ßÛ b¬Å7ÎßÊçÏVð™h9Žù,¢I‚°RÊ• e®äß·RÆ%=²ìÙ
êt›œ(†Ì%³LÇî)®Ž>1Ù¥‘„µ…^Ñ2¼éˆO£Ý %õ‰>•pjÕr{2–ÂwÍ<–g¬™-j—!3cäáakIè,AŒ$ÁLˆÇÆ‹J¯³nöùU»Ïm›Þ‰D3 @@ -8439,226 +8493,220 @@ $OíœàÅ€DÈ t‡Í=žÝbóÆÃwî6ß"£“˵?”JËOP2RÐoQo+†â1)©w†¦ÜèådîI½ÈZ¿VÍ(e÷åû È"[vQÔüFØs(úF$'‘qL ®/¶!õÔ
¤HvkÖ‰Œh¼È‰¬ê؉á¶o?Ùa:Šÿ±qêcŒ°gã!_QÇ~ÏWê¡1üaœ¯UÝGmã§Yñmn%ìRãr9÷¬ß0qˆ5†/‚E…(êÚ“†,W‚˜$Ù½ï¶åçLxËÎÔ|ú奕£w†Z|ÂV€ãž÷,éOd ÞyŠGÝ
ŽÎ¨Ý3lÍ4©¿Î\×T2Zª½Ag—.7Ù#ÏPæï™v¼eŦQLÞ»±Oþ¼Ô\’ ¬ÿĵJÅñ¾(š3Ç].Å*,MÎ>ÛBx(ÃSÃó|D³uû‚Þ¡ï†{:Ò‘Á¨2G9¡Cê{É•<|?ÒK áéá@F)Ø,êw÷ó?È ¸¢Ëa„Çh%Ù±o^Œñ{‹6™Ý@¥-«ä%Å~jÉwXjz1îi´·î¬%uÕ3^¿±g¸`d+ÎK[ŽDe—„]âò†YèÖýÇ?Ï>£³HjË,èkѸÍhÔ8Š”™v_Å
[ªJÖ®²9m=·âú?\‹k>¼à¬‡¤*³Ñ³ž,Y
ê<‹ý¹uÓZ/ZV$S·é#ƒmNOš¨5M@¿§rãÝ0Hõ7¬&7[àçŽAØñêOõƧÈêÚ5±pE6~d»Ž^.x¨T1¬µ¤$£Í7¿ÿ4òÆêüj§‹G1¬èípoóÌ3³QýÐZ:œNÍÆéç,0½‹Š‡Zg‹ðâ£à)‹Q©¯³‹X""œÛÆ0ÏÁ¾äBvFA‚)Y9(ÎYÖý…ì¬S…|¸Ôü¾“qbæÇN.LÔX§…_ï‚¿œ%%½¥åŒìé|°D>W²7}C–Í#—ZR¸$º`bÛGο…a¿9gÝS%\”Á/œîñhC|?s§Ø…šg¯ÎÙÈ)ª¬m}ÐvÖËk†Ÿ.bÉ&O üõí+uqfº`Îa‡„°£â,I§ã¯½/‘˜÷ÇÝ›Á¤'P6ߢH‚Ú?÷›½šÙ¹˜Žà9¦ŠmHr7:pMRYŸ#£ 'æW¥¿ðKCß|-¡mWÝ躖nᲶË0–«ÞÐ3äÛÙ=j’¸Ë-,n–³e±€¢üb½iÙ;‘˜Hâ°l<)žL.ßÐYÖÿ°Ú·)wL=(‚Œ£± L|)=å'ÀÆ-Å@²öò¾µ<ÃNrä³6îµEôʃ3±d¶kÓ»¬ÿ‹%ôµøü·(kD~ô(¬_yñ‡Í;¯åä²fùOî{&*‰äyÒ¯9ÛB±T¨d>è.<Sâ¢éX3p7«Á~ª"럽Ÿ“lË´ÍÔDQÿfŒ°Ì -*s"}Y
;Ò‰¢ú{YÌÝÇí]p¶Òݯ€Ž¶Xo³êÙ} +*s"}Y
;Ò‰¢ú{YÌÝÇí]p¶Òݯ€Ž¶Xo³êÙ} endobj -1477 0 obj << +1484 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1915 0 R +/Encoding 1922 0 R /FirstChar 67 /LastChar 85 -/Widths 1916 0 R -/BaseFont /XHCQCG+URWPalladioL-Bold-Slant_167 -/FontDescriptor 1475 0 R +/Widths 1923 0 R +/BaseFont /IKLSXN+URWPalladioL-Bold-Slant_167 +/FontDescriptor 1482 0 R >> endobj -1475 0 obj << +1482 0 obj << /Ascent 708 /CapHeight 672 /Descent -266 -/FontName /XHCQCG+URWPalladioL-Bold-Slant_167 +/FontName /IKLSXN+URWPalladioL-Bold-Slant_167 /ItalicAngle -9 /StemV 123 /XHeight 471 /FontBBox [-152 -301 1000 935] /Flags 4 /CharSet (/C/D/E/H/I/O/R/S/T/U) -/FontFile 1476 0 R +/FontFile 1483 0 R >> endobj -1916 0 obj +1923 0 obj [722 833 611 0 0 833 389 0 0 0 0 0 833 0 0 722 611 667 778 ] endobj -1292 0 obj << +1298 0 obj << /Length1 771 /Length2 1151 /Length3 532 -/Length 1712 +/Length 1711 /Filter /FlateDecode >> stream -xÚíRkTבª¡¬òRIÕzX%ró˜h B,òF32%™¡Ã -«Š@} Ô«pø""\ÂòZ¤jU|uÀººJ¶¿îºçü9ûÛßÙû;ßÙ—°–Æ7 8F² 6$þ2™âêÌåÒ‘“(ŽÈID ¡Ð¬ÎPÞ -Àˆø+D|üñ4¦¨HàæÏœ$ €Xƒ¨BŽ™œT!ª†B®¸EHˆÕj>y#„#鑉ÀlU`’‚b4Τ&)¦Äà
g¤½Me"D:% -¸MÉdJ$Œcj€%³§º!”–BÖôâjõ¹f²ü”SÉË5¨Z÷;פed8ŒØtjòFœÑÍô¬””«Q…KQ#€dsW¾ÁÑô@T‹Àa(©P¥\ŽLáOWBù7¥ƒîþû×N%Ãä(FFêÒÀýƒ=CÄ”Iªñ\6—QDj¿=%Nk&Á8Œb)€Ç÷ -`ñøT+îJO àssþDTd‚‘SãCô6V¢”§¢E4Ó
\áµå㽧¶ÕæJª»ŽZ3Ó–ÞÒqnëÉR/öpŸ—Ã5¢é‡Häƒ_í·ÚŒ³+ ùŠ+ùýôSâl£>‚³µ×ÞhëĬÜ1ëb8!iÆ¥òö¶÷4¶ß5-6§5¹?øÑõéÌsÖõ¡÷ A}¤pfíÍ/ç¦nìì7Ù| »•ÐËO‡îA¢ÿ{§èÊÄý ¼7Õ\šŸ°ï©ã+½ívOê-ÛR¡¡\fu½ÔûÅ.S«è¤AûS›bË„«#D³z\‹®(ï{»”Æú´4‡È~™=Øͺ”¾Û#ÍÏ) Ž‘F.8Zé ¨] öª¡["
mëZ5>Ø…sÃÚ|‡Ô†.žw1”Ö´‡ž<þ’ñë’3Ÿ$>Þ÷ìµÞú@¡w±p>>#ÆÝs¿o¦›û0³ƒK·¾ú™Ñ%N®úâ.)ö
î³Yeh×üÛw »eLb…×óœnùÌÕÄ£ÝköVüK¶Îýëfãî‰ÖBwûp êáÏ[
ûyIþñ}Ég"oº_ªk<_àXW03ÑØX½¤y6Þ;è7ßÅÇq¡×\;q‚9¨vš.ôh‹î«Îf;ð'Æyèyá5ôCI”±iä°Ç¢\ë¡ÍRw²ïG.×{þbu.¤.Y×åYwÂøý¼e{áÈlÖÚ½©ÇjCj·it„sö6<„¬*²Ï>7§,'Š@½[ÈƧ˙íŒõ—ë‘vEaÏ«’ÙDœï™Ö6ŒÀÌÇÇõ™¼3ç{%¤¼êñ9~°F¿kãƒG7W.Ú¾ž&²èÒÓ$Ÿ–ä¾Þ2Ú”ac/iîˆ7aw–Þþ¾n>{Ð>ÃÕ;ö«¥>ôúóÿ[µ–ųWFê¹ê8÷BË ÜR¥©sbÀNæK~ò7“³Qæøô‰3flI3l$‡^ž¨.‰æäš{Wôp!CǪDXÄRé)õr‹·gŽ=.q6?%6¸,h¬Ø ûÞª[7Z9á}§{"#ÏñòHaçO§WÈ”²×ñ{’ç+³tÚ®yYÍÝeì*´þ,·-§?ÒÎû┡i“Å<b4þÆRÕ±íšã•àh[
´9F¨å=;Û™oõnNáj:ýÌ°´~L»¯>¸ÌÜdÇŬ¨÷ŒwÜ¢Ë$%¯,ã¢ë‡:,ËñDMŠ¦ÃîUŶF«ý‰²È|Eû¤Í«‡eõÇwÙl‡ª²‹»ç´ÌZ¸cÓN–eFT~¹Îçœ ?3úl ¿ßwη®‹‹T$œ”sb¨HRs 室78û™ïwïÁïXŒ.ys¦´°à¹YÕwÚ³¢X:|¹K|³m7£®[Ý\SV°[6·Öaý;Av‡:.‹®Úyïê(îàÒ>N_F¾xr¹Ó׺ä"( Çð0¨54Æ·â¶kúšÚ}Ùyyâ2¿îë;GTI×Êó~¢"éíÕûæ@QyŸöYÄb¡Õ¬{\‰ûô›äÁàØyIkâÕÞÏG×î¼0%r˜‰E,9¹ª‡?Ï´áIVØ¡üjzÝ +xÚíRiTSבª¡¬2©¤j=,Œy5„„H b,F$æÞ[’{éå’q ’ª,‹Øè’QT” +«Š@Pj‰UxœH«X>‹TŠ€S/XWWéÏö×[ïœ?gû;{ç;›æ!gˆ l,ÁP‚Áar„ X&“rØ€<³Ù-‡‚¡! +Ž@àVê4€»°ùBÞ2!O¡`,Í€#)jxÓ'H| ÒÂ8¢T @¦ Ô°–¬¡Th€S"0a`‘FÖNÜHkátÏ€!&…â$À8A)¬ MRT…þÒ¥½MeÀx:) +xMʤR$„¡€`…µ#»Á¤–BÖÔâF³Z¡(?éÔ_ò +-¢1üÎÀ´i:ƃ`J߈“Á¢ÓNÍJ …QŠÐ
œåLöò78’.Aô0J5P)4éð$£ÐT%¤“:Xâ°(‘$Ìû÷¯LF(”ˆ4¤Á€ý{2æü“&áˆÄ³™l6‡$’ûí)qJ31ªÄ M\žPà¸Â@!‡ˆŒxÀÈ +Áz +!=…a=¬¤Xo`J¿-ï=µ:G\ÙqÔžž>ß|xKÛ¹'Í~Ì¡?—kxÑð¿:ouþ9æT<þRñz©§DY£œµµÛÙâèF/ß'Ÿñ@9”4íRikË{ÚÛïZ¤5x?øÑóéŒsöµ«îqøÔá‚éÕ7o¼|œ“º±½×êð%ä9XLI,=½jýß;…WÆï‡b•˜µêÒÜ„}O]_Y©-·»Ro9š¦R™Ýu³ÿ‹Ylº^Õ×NáìO]h-¬”gÎ÷¹]f6ïû{˜cšÃe¿Ììï¤ú=ÌïvIó²‹Ãb¤Q#óŽ–»(«çiüC«¨¶p]˺fm +®çºÝ8ò™§•K¹'Óî-û—l÷×–Ý b½ î"úa_Åß/6›ös“$Áñ=Ég"oz_ª©?_âZ“?=ÑÒ(‘T.jœ‰u÷Íõpï7ÛI”0 Ô;ºô…÷Õg³\xãcŽ }t½ðü¡8ÊÒ0|ØgAŽýàæy©;™÷#—}±;^“lèð9aù~Î’½PdcÍÞÔcÕáÕÛ´†G‚Y{Ž +êrìʲÎ>5~§*ÅAWøƧKé´õ—kN…Ï+’™x\à™æGŽ3¸g>ZÏóKHyÕpxíÁ*ã®Ý\¾`ûzŠÐ¡¯»_@MZœózËHw¨ÎÁYÜØoEï5ßþ¾ôo>{ÐYçéûÕâ€fjíùÿŒ®XÃà:«"lMœwmß8
jªÐÖ¸Ñ ·KAŠ/«»Eæúô‰;jiJ3m“´C/OTG³rºWœôñ VVQùbé)ÍR›i·§>.vxŠo:p5Œ__¶ +¼U±n¤|ÜÿNç¸.×õòpAûO§—ÉT²×ñò=ÉsU™}ÇœÌÆÎ’yNeú`†×–Ó?ç~qÊÔ°Éf¾Z}c«nÛvÍõJX´£–³9F ç>;Ûžg÷nvÁJ*õÔ´¸vT¿¯6¬d ÷ÈŽ‹™Qïç[îxE»—ˆ‹_ÙÆE׶ٖ&â +]”
u¦Ý*Š?ŒÖã%‘yÊÖ[I›WÉjëïrØÎ9¨Î*êœß4cþŽM?º=Z’!/ÿr]À9~^FôY ¯7pÖ·žÕ””}b°P\u 宸;,ëYàwïAï؇Œ,zsÆ\ÿ|@ÝsÚ·¬H:t¹Ct³e7¦SÓXU’¿[6»Úeý;¡N‡Ú.¯:ùïj+jã}Ò:F]B¼xr©Û׆äBNH—éahóªL=ÜŒ…8®îipi
dææŠJ‚:¯ïV'Õ·_+Íý ’×SÇ[+÷ÍâDå²Zgàv3î}p%îÓo’«øý£çÅ͉W»?Y³ƒÿšȢ'2ÄŠ.Þë†'™‡ò*©5}쿹(ÿ/ð?Q@©8ix*å7õDŒendstream endobj -1293 0 obj << +1299 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1917 0 R +/Encoding 1924 0 R /FirstChar 60 /LastChar 62 -/Widths 1918 0 R -/BaseFont /DTYLPR+CMMI10 -/FontDescriptor 1291 0 R +/Widths 1925 0 R +/BaseFont /EHUAFH+CMMI10 +/FontDescriptor 1297 0 R >> endobj -1291 0 obj << +1297 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 -/FontName /DTYLPR+CMMI10 +/FontName /EHUAFH+CMMI10 /ItalicAngle -14.04 /StemV 72 /XHeight 431 /FontBBox [-32 -250 1048 750] /Flags 4 /CharSet (/less/greater) -/FontFile 1292 0 R +/FontFile 1298 0 R >> endobj -1918 0 obj +1925 0 obj [778 0 778 ] endobj -1917 0 obj << +1924 0 obj << /Type /Encoding /Differences [ 0 /.notdef 60/less 61/.notdef 62/greater 63/.notdef] >> endobj -992 0 obj << +997 0 obj << /Length1 1608 /Length2 7939 /Length3 532 -/Length 8789 -/Filter /FlateDecode ->> -stream -xÚívgPTݶ-HPPÉ™&çÐÉ™–œƒº–††î&K(HÎQÉH’sÎ 9#$ˆ€øÐïžsn}ïüº÷üzõvÕ®ÚkιÆsŽ¹VmVF-]^Yª„p@óùž4`ö–Î(]°ƒ¯ÜEXYå‘P0†pP -G8ÚCзÿãºP( -²BÂÑ€Û¬Z -JñDÛ‚Ñ¿s£`·n -œ6B†NšVµúz9S,nq2BÙYÒ_+Ÿ¦Þsà›`n'.@b%iî§ZüwœJ¯îsúð{^¥’¸úCHW—Z“èŒÁv,!ieí1«¥O˜–©í[oF‹£‡y‚öƒÛ¢Aùx@”SÜeMIƒZ| -úˆJý€•<.%sõJŽÅ?ANïÝy¯2}oÁ[+B”z1’áž ‚`Ïtf¶¢tÈwŒ°ÏŽ·xÀ©þ™Ììè)‰ë{çqéœÅâêsn¹ÁâÑÈ!áLâ|®Å–êjÙµXùPüðáæN…:ÍâŸiËÉ#V -.¡Þ&ä±.µÙ:á%%¯ÆƒÀ+Ùì£àrÒôdxå ~åj}vøñÅ -E“õî
÷*\ÔíÀ5´Êµ³nÝ¥¿ìv°¦Õ°“@<˜ÐÀÁæ„|º‡¹Uº–ÒSCö¡•Z„þîýÐni¯0q¡~‘ -5¿Õ¬g-Í=¥á`8Z4~ iN6ý”@}!ôk °)„COÊ,”úP¹EÞ}/šòÜ:o«4QßФháôBlågË”O„á1
QÏ—=GÖíÎ2‹$ö"Ä‚B5GmÞœ!kÊ€ÅÁFþ9¡Ë+TdùGô“Àû"6®ld&Zíeí{4BQãÛ£xæ -Çžó,g½Ã!‰âŒOòpÓª¥øℱ—ê¨,«é•¨’/+U²ðN\ú_øHîÙ;š2™´@r•zPÆœ±¹ú™5¿,Oì°v^=³ŽÐŽrûÊ`ÉØÒd±‡U”£'„/,&z‰â£óõ¾ÔáÌÚ_'z8ƒ^»‚!OUáö:§˜VeÞö¨|BVvÔ0ó+·–0ûÖÓ¶Ú,V¿š J,â^´S´+kNï¯s¥8¡ËÐ f´“[„wO¹¹Ržáè.ÁFFM„l-¿?®f$i½*Z§g´É-@$ˆð‰´…G©3ªV;eW„ôÆwœÃðÇkÝüÓï«Ï0¾B¸9lZàâèàø3x?Üßj¼¼ß· E=_a^ñêu(ýv --gھ蟖¤§I„²kZKéä”ð -›û,¥ñº“ÛýÙU@žXÒÖrÝ}Â;´w`D.à™Œ«ž¥ÅÇ3\™»ølð…Ébñƒ¥‚U³¢ÌöMÌœÞÎÛJ”…¶WkÓhý j¢’«qµD¹Kz瑳³B|óG\Caî+þ¹*ÊÛ~¡ñ¥ÎGÙ§}–ΪJæÄäû§ W÷HíÚ>ÛÀaòœúò4ó üN$ÕYYšžÇï_œ••W+vqƒÛSš:± 0ZÌ©„›a‚â[‹”%sˆ{¬Þd?zä7~ÞÛsý3M{öži17ÍÖ‚\"éýGeã3mì7 -Kygm/®SÉçÍÄ\ÊqÈbO;z¸‰ð«-4'¤§€+k=ž~(6¸hLìÈÒúô<6»¯´yjÊ^"þxNLÝ°Ç%3jz˾‘e2 ÃÏfĺEÎ>_žÝ(¸š¤²uy•“®ƒ›{!Þ4l"ùíóQtñÚIÝE°ºÙu²¯‡Ån¹¹ÄùÂGˈÃÄ › -?y“w¾G$ÜË×ß™‹<Ê™2ãtÏ¢Þ}ÿ†@´yIGbc‚²Kê·HŸ|ëÖ
x°–Ñx½Ùþ2—€_M”+=‘Û~d˜„“•/tŸ†ò³vLFd*°Ä¾ù±b«&}¢¥çË/à¥2?‘©"B¾,|BÊ1û楛æŽÈkf}°¿Åø«þŒ„g“IÆÞyã8‚©.ͲmhïF`”ÜN‚”ƺʨjÊéž=wþ¼æuußÆ?ÀTÓˆ½~.%º·2¢_½¥’()“5”ôe-èÍÜhxlšŒS+é\d®ýÞ¢Ïd=ºñbfýFÇO¹!3‚"Ž±6÷'íjCœ´¾X‰Œ]Š*ÅÂBùwK‡õiŽ€hn"d²¦…Œ·âg쎓š™Îë`ÎÓp¦»²'UJfaþ»f[Ĉ]ˆ•á®þÍz´&—À$ñZ¼¡®i¾—fG‹LßÇzbÕû\dÊÅï격|X“Ý\sÉ•ŠØÊ+¾ÿfÜŸ|>„%ýHÎÌÚ`=6"æ’P«ô9#Ñ\Ó#3z-Rô|%ñ¨$¾Gc^¤‹M]÷²³Ôú{'¢_ýDÊû1éÍ*õ,θÈêÝþ²â³Gƒg¸LMa2B Æ»é»*+M[TÏ•´lm§2!ž7V¦Ôˆ·nŠæ‘’¸†pj7ŒÙ>ò"$›XêÐ:{—¶^˜u^9Ì’„‡DW¬9%%^ÑËå,W0ß²¦ÜÝ™ZÒ×ý/õ{øúÆ>²Ý” à/"ŽDkúmù0§_ì>WTxìÑéƹœ ‹› -zƒ½Ê-%¯Oà¸L5“‡û’ªV,î½øÊáÃz‡>ò&ïw¼´rY6Ç—ÆJwŽGƒ±Â*ÜA5ƒ -ëšSùSÕi…Ÿ*z~Öå{OrÛÎâ¿z»—’M®læ|Pû„î"‡ãüi®WêæˆOâ›Ð'ñëgÏbíbœŒÉQùb³ 3.ã…ñk›ÌBd¬ilüÖw_ãcÂŒ´¾,ã
Ž -¢&tG÷ü©Ï¾2¤ûôþÌÓ(v'«.Š -òôÿÑü0íû¾€Žˆtß -sožbrÌûvE ²ÁÅ/ÍWRÙu/w¦ØÒÕÛïòxœ‘h<LšøÖ‘píÇâa
®”Y -Kqh|>6œÊ³(æÀ’ßë. - a‰ñµoWkrŸÔgÔÅÖº›Ð˜wÜ6îÂÞN¾Ùö
i± XüÐ~ýÅ´á´ÙÞVóÞ³6÷³Ý>EŽ -‹^±Šî±nl#šñ‰65%,ç_°Oê”+µNý%Ùz¯>W7¶]•fzã}A}H›ÎÀSÝÀ~ƒQrNÉ)îs¬þr]Lf¸á“ -<á¼ØËûò
Aê)¡³k¯×ývuSøGlVªs#Nu¥¬·OŠE•?.j?øÿ©ÓwGä“øݺ23oªkvSÛë>Ñ=¶ Ðz¸^"èÁ8¡-òo*N¡žº3Xl‰eÓk‹þœ%¿_> -Ý‘o•~~æHj¦ä=ß‚§§Øç÷üÁ4fA|Nç“ž@íD2ÏJªÏ ªßãfœêvæ_ïùQÎ`œTäUí`Ø@–¶Y™i"Çø¡Ñ=¸M×g•Õ´1š:Uпƒfèò©ü¢hçˆ Šl`‡N¤·èç«s¼„klbhL˜:g6(皊…KQ}ÈÞ]Ÿjƒ+ÅÁ7„,IL$¥<³
Àãyª1ÕÓ¬^Ubó¥s¼=õ¤¯æ-_ãº"/·ÒøìX¸¶å¤)"<XŠxÜ*%Å•€,Kß‹?¯‘¬’ÿ„Ç#8,Gi§ñ -D¯°4Õ4øO‰h§ª‚Ã*÷)É›%ŠØb~ø-GÈs“I»øNà9-ŽSqÈÓºD
{Ú½S\pzùÃuyjD¡«†k!ÈÅ¡ùð4yªQemˆÿÉX‡Fiomß¿»jÑÄŒŸ*m—´Ã”8Fèc…ךÆàAÔÉÜî°’Z¼5è篫a¸”dñF~²á)ž!“F³ò±Ëâ7£gªØjB}X€‰/‘'™“š"ZtÍCöEqË’¼R7ö¿Õð®ÒÂö@.)¨F…t ‘½uŸ¬®%Qò«§µEp˜Çd€™ÑÛkï#ÝýFø‡‰0A³KE*3Æ€F ‚é®0BÖLqÄ`nÿ‚Š%P爉䅟Ú*›X‹²Å·jÔi÷b¶‹ôRáó"¿¬žû6vTZRœÌ°T3Séèv\ã«%øÜýI¯”Þ¯é¡ëæ®ZÖ·mpßú”Qn?ø&Å—Â#Ôߟ›ì}ÅÀ^í° ª"Á"çt{RH:†×¼woŽ¸ÏhFO°™§éç€oÊC£B÷~”… - sœçã¸!q?Oƒ¶•G¯îW̳ŒÔ)HænÉøoÌF–A£Êå{Ç‘æä8£jýäUu;W+Aà¢ïóÇ;X;{¥ð”ÇÎwÆ}x"
Æš=×N¿nc}&±Éy[µ~œ ¿öµh¨»š«¢³ñ©"Ì‹üEmÊ`;µ -Lj -â³ß -Ì Q=w¾?‰¦6ª~ûá¤àõd‰xW/aéÒÛ‹†Cú\»UÒâàfÒ~…¶‡Í -¤´HNú2HBÃ8—GÂ+zq(6|£}h`wŽXn‘ÉÖ\ƒd0ÖŸ9yEúQ§lõ8þ4»G“‘Èh(1›‚#Tšl8ùñ\^ß/Jö\¥H§¼¿Õž‹r2Σ}‰RÕ»Y€|áCžÓ|ƒi
xCªÝªÌZ-›Çð0ÜJLÕ—D9dkùåΞ‹üÀu!!‘}U?³9Ü«eŒiÒF̦ì½Äõ–çwNRi¸Ž~ÑqÂzÊ—eh)¶M#±M¤µ.?¶%aÿ5ßóÀ€L]t“ö´ƒÓÈÙ‹CM³Sꣲlµ^÷³²ÚfÉÔë'7±‹÷bqÛG2®K œ¾’j…Ã×?“ vœ:Û¤~í^~ŒÓ}ü>[6ï¥Ô‘Uïi!~£óú“á{±±?Gywuîj>S–µ¿ƒÆçò8CëD?¯‹{ÇéëˆLŠ"X?¹ÒPÌÔÜìô|/*_6fñfw -=ÂRŸó>ÍjóðÔv)Ùyÿ¹[G¼Ü5)…ðwÃä¼Ar«òqsV -…üЦ^o{<´p–…p¤(„¬Ý¡òž#% -o–›.%§ª¿ƒàêÕÎ*4Z®÷„&§xás=G‡ü<ṼǕoÜRŠÂò7ð|lä”güâ(l€Â(Ù‘(8Å|)ÿ¿wÆô/þQL™uG«ØâÐÏœÎÎ~N*{cÀt(û6HÝB=viˆÀ%ŒÐ/ÌÐà>^P䶊ŧ¡¯ÕrȈ=ÂÆé2¾ldÔD4“kêœÐw§3\Wd†@$B}vÓmwÝK&à#ýÁ?¡e6êœÿ¸¥*IÖÔ*Àií¨²Q„É¿åAFÜd@+íy‡íj¡×Ré¬üž±àV{ñ)„ÓÜy¸KþÍç*ï¬%3Ã6ÄÐqO®Vîz -Pdž·ÕŽÝKcì" ÂñקÃ߸Ð|÷”:
úaAÞffñ~þµGµ³+ìMk{çg1Û»tîO±¶)0ÞÊœ<vŸj5Uq"¯}h‘ïÎ[
ã^ýŒwXcsÝX YVW³Zxg/ÁÍ&YÜÔŠþ6¾ÿ„×ÔĈäUu&S·+0›Ý)§LI4îÄR°vò[_•(ÉëOJ¼‡ŽÛXÄbÉÛú󅟃HÙ¾üª½[!+ØÑ™õd¶¶¹c
¡µìÉŠaüð L²ëb_Àå¦RnMúY6F¿ÅýíÕ<úx*¸÷â&?ñiÛJÌ¤éŠ Žô·Î±¯‰Ò%§¤+Žpñýïê=Ú02á=o !“®…-‰NØ ží2_Ûš,l|%ÕvW”v¨q$M1‘]–OmÍöèÂg®eÝ/Ý»ÈÔß1x±]Ô'ÎÝíÎ<±úa’'0x{&¿µx¯ùí©wÏ.o†l¬AÁ +Øο>Ú²Ê.ÔZlvp‡k³g¤…æ[FMIÁ‹£÷0ê¹³ÕvœøæhPKò´ ûäx´!vyÚ³×eœï?uúfK¿ŠÈ+>ªX'·[ò&&ÇŒÈSm"~Ê\mŸ$¯GÊ-ˆýJo%ÛÞêdyž†õJ-»Û¼`~DÒ]FB´§Aäû¹xx²Ãò`}fZ%±ÆÈr™6³Á‡å_Êf -í&2PƒóuíIŸ[^|uÊàïíŽl«0x¦ŸøpÙ(ÈÅ%mé…ÆÃð½/¯±sqØo -ŠÉËQfþNÒúðÄCzòÛgêg_åD6ºq¸I“ª¸ÊFØ2ËvÖ¦™˜¤Pé¿g¦Uu䂱~Õ#ÉUz$¼ -ÇHÄ•vËÕ$«x-‘–ß™š¦#{eöòÓ`ÐhšDŸâ°º ë«×^9ÁB0¤ñ뫽‡í»˜m×ÖÜ¢Ò ¯-‘+ÖŒ!ÇBPŸÕvî¦è ·?§¡ºƒ¼E^$‡ý…’*O*n˜.—Çw2wÏ5N¨°xNÂø,†éõG#ËÕ€ª“ŸêÅUOr3~\Å[kÒ¸!9×0ϵ -CÝ_‹{™éÉYŠúð["šgì2eàß$‹îy;Þ;Ú -_ƒ
ÃižòÆv==·%!Ãd2KVûBàùü€ÿ' -endobj -993 0 obj << +/Length 8790 +/Filter /FlateDecode +>> +stream +xÚívgPTݶ-HPPÉIhrM‘œirNlèZº›,Q@¢ 9G%#A2HÎ9ƒäŒd âC¿{ιõ½óëÞóëÕÛU»j¯9çsÌ9æZµY´tyd K¨"ÂÍäåЀÙ[:£tÁj<²8pk&`a‘CBÁhÂAŒ†>B! + ³‚: +uû
€¡ + sDn³jÉ+þÅmFÿ΂ݺëÛHÂÊùwI|·0·^4æ€ ¡nèß¹,¡ +a%ð21% ]F‘Ñ5 ÿ¼ˆÕè˜÷Iï}¶ïGD³Obð²hÑ‹ëÒ@ÞÊ¡g7uî“;Ž?×U87zZÈálÍñЃ,Z/&ŽÖìG¬
"\þ|æy„I»†áž‡jKØ&Oø
6V´uÌs¯ï>jDâ~çðerÉö%e>w$ò¶J¨ˆ$k|X‰A\–³³Ëóõû9[GowWgó1Në:
Wz$>‹˜6!k˜¯S:”‰~‘g„e.0¦ãclKP«>»àÂÌ1yÕ’ ÀdÿS¡Õ¬çn9´éçï©|e>·'ëC‹›f§—ЛÙq€úYšµ«„8ë$fÚõSëÁ·RÞoÛ@*¾«Ê¹AÔguG…*|«eB‰;}ƒv©¢]ùßÖÒï6”‡yÛ}sx/Gj¢T«$Jñ£•H
âQ–®‹B~RlEÛ1w.ì*Çbr|¬½}$nÖ‡·Gs]> Ã?V1òx£+w¿³\õ9’e‡Ð†ŠØ¥ÍäÊv””7œœ¸äNÑ÷«/ùŠö.‹ú…&Ð)âá0äPùÝÚ…k¥èé¹éÛR§ö +^8³÷&sݱ|&éŸî#6cÕ¯‡‹úœ‚œEë=öÚÊÔïƒ.Œ}(pÚéc8hXÔêëeM±¸ÄÈpefI|š +8xÏŽo‚¹
Lœ¸ +R!ß1Âr<;Þâ$ûg2³£§Ä¯Cǥs‹©Ï¹å‹E#‡„2‰ó9[ª«eÖb äBñÇ›;qäë4‹¦y,'XÈ.ó¹^Ûû¾çm}l3S@+'éY“W[ZTç¤ay þR#ÁWeôùì¯w<Ààø!ËêHô‘ªÝ°a2Y'ŸxVc[ЃÖ̺«P‘|m÷L¨3X´•¢|FSp õ6!wˆ¥qiÍÖ)/)y4ž^ÉdÏ—“¦'»À+Oð+Wë³Ã/HŽõ°8³:̨%¾0€°nô™¦RºNSX)šÄ©wo¸Vá"n®¡U®uë.ýe‡°ƒ5†âÁ„v0äÓ=̲е”ž²ÔÂtwï‡tKy…‰ ö€À›Á²Ãí/hÆnfÔÛYÏß35|\Ã)͹b€½^s$QÛ<.'DÑ +(^‹òp߬h7š” ~Ý¢ñí‚…Ë.^,°‰ðzÈî§D€×û3ÊZú’|JRA.KÞ&[å/0õî¼2³–ÛOy«óCúÒB«e€öžt‹:¹ïäCA2µÅËV‘ÀP½'Ûz”êÅŒ~,ÁÑ’ØAkQè +Çö7=s`[šzþáÞ•MåME÷¿€uG–h‰+÷ÜKI•9º¶Z¶ý3h#`+]¥J¢æ·šõ¬¥¸¦4G‹Æä5ÍɦŸñ
¨/„~
2…°ëIš%ƒR*µÈ¹ï¥‚CSž[çm•&ê,œ^ˆ®ül™ò‰0¼3F£!âù2°gáȺÝYzñ‚Ä^˜X@°æ¨Í›#díQ¿¸ ˜ßÈ?'ty…Š,ÿˆbx_¸Âæ••ÌDC«½¬}F0j|{¯Õ\þ˜ßsžù¬—}8$QŒáinúAµ$o<½öR•eµ#"Uòe¥rÞ‰KÿñÃ=Û`GS"“H®bʘ#6W?³æ—å‰ÖÎ+ëíø ·¯ô–-ÝI{ˆQeY:BøÂb¢÷‘>:_/!€ÐéË@íáÞÑȬýu¢‡3èµ+òLn¯óqŠq`Uúmò'ÄaeG- +óŠW¯C鶰€®ô +„©ÊìiÝÇ.h™³
6'¢È6 +VÍŠ2Û71sz8o+VPÚ^M£õ‚¨‰J®ÆÕe/ýéœGÎ>Î +òÎqE„¹¯øç*+nû…Æ—²;OeŸöY:«*š“ïgœò'\Ý7"µkûl‡ÉqèËÑÌ'ð9‘Tgeix¿qVV^ÐÅnOiêlÄ&Àh1ÿ¥n† Šo-R’È!î±~x“ýè‘·ÞøyoÏõÏ4íÙ{¦Å\4X²‰¤÷•Ï´±ÝÈ/åµ½¸N%{’;4u)Ç!‹=íè¡ç"Â3¬¶Ðœš®`¬õ<xö¡Øà + 1±#-@ëÓóÄ<ì¾âæ©)[‰Ø“9QuC—̨é-ûFæÉ€?›ëþYû|96£àj’òÖåUNºnî…XÓ°‰Ä·ÏGÑÅk'uÁêFd×É>0¼f»åæ6ç-#vƒl|¯göÕšŽùí:qÄÔyN¿3-y„¨Å–UÇâ${Læ6¬ÆÚRøÉ™¼ó¥?"áZ¾þþË\øQ>È” §{õîû7l] +™mÜtW?e‡ÌŠØÇRXÝŸ¶«
qÐNøb%2t)( æß-Ö§9¢A¸‰Éš2žŠŸ±;Njf:¯ƒ9NÃïÊœT)š…ùïš=l“'v!V‚»ú7?êÑš\“Äk=ò†º¦ù^š-2~ë‰Uïs‘.»o¨ËªüaMfsÍ%W2b+¯ø¾ +(Ì°?ø6|Kú‘œ™µÁ86<6zlDÌ)®VésF¢¹¦GfôZ¸èøJü
P!HlÆ<¼H›8ºîeg©õ/¶D-¾ú‰¤÷ ã›UêYœqáÕ±ÇøË +*Ïp›Â¤AwÓ'v•ù7Vš4¶¨ž+jÙÚN9dB<o¬L©oÝÌ#%páÔn³òäAH41ס
tö. Zm½0ë¼r˜$‰®XrJJ&¼è
¢—Ë™¯`¾eM¹»3µ¤¯û_ê÷ðö}d½)(A=À_D‰ÔôÛòbN¿Ø}® ÆÿÄ5,¢Óc9A7!ô{•K*J^ŸÀ~™j'÷%UYÜ{ñ•Ý‡å]ä"Lžïxiå2¬Ž/ïb…U¸ƒjå×)4§"ò§ªÓ +?Uôü¬Ë÷ +žä²5Äõv!.[7$›\ÉÌù ö)%Ü-DÇ9øÓ\¯äͯø7F Oâ×ÏžÅÚÅ8i“£òÅf&\†
+-â×6™…ÈXÓØø,ï¾ÆÇ„Ék}YÆð”êA±<‘‹?qâoYêLÁoȯü¸"‚˜‰œñµŠýVw$€ÇÞ5-M¶Ãú&š{ŸQ}2Ñ»5ãùáö¶xĽuéBÿ;¤»¥ªïÕ\rþhüæx¿Í?‚^iºÇ&‹ ÕCžËQµb\¸THüe%¤¼®QÕE²üO¥}¿:y´ÀJ ÛAHù åP¤-´á€[kNÔ/ˆ<Í©ÁEÁ‹zHÃ('¿8/ÖÈ><ï·NZN,±$íŽÝ\ë|.ʳ4 +Úu&IFlµPÈ‹˜<>ê¼çO}ö•>ݧ·ðgžF±;YuQTˆ §ÿæ‡ ¬ßôtD¤ûfP˜{s“cÞ·+J .>xi¾’²È¦{¹3Åš®Þ~—ÛãŒd@ãa‚äÄ·Ž„kï887Kp¥ôRXŠCãóÑ°áTîEQæü^w~@³ßG±¸½Kë3rÎN¡ÀK’jùÚ +}~ÏLcÄçt>í ÔN$c÷¬¤úœ ú=nÆ©ngþõžåÆIE^ÕÖŠ +!dÌFæö/¨˜õpŽI^ø©Ý©²‰µ([|«Fv/f»H/>_!üËê¹ocG¥%ÅÉs5“•ŽnÇ5¾Z‚ÏÝŸ¤±ðJ©ýšžÇÝ\UËúö¡
î[Ÿ2Êíß2û²Qx„úûs‘½¯Ø«PU XäxŠnO +IÇäœ÷îÍóÍè v ó4ýð
CihTðÞ²° ÇÒf%’2Ž +Oyâ|g܇;Òðh¬Ù#1|éôë6Ög²›œ·UëáÇ rk_‹öw€º«¹j!:/œ*¼È_Ô¦¶S+³(#>ûpKÕs%ìÛø“hj£ê·ßN +\O–ˆuõ–.½½h8¤Ëµ[%-n&í—o{Ø,OJ‹ä k ƒ$4Œsz!¼¢‡bÃ7Ú‡vçˆemÝÊ5Hcý™’W¤uÊTãO³‰³7 †³Ê;B¥È†“ŸÌõáõý"¡dËUŒtúÀóñ[í¹0!Ã<Ú—(U½›È>ä9íÁ;˜Ö€7¤ÊÞ:À¤Õ²y£7ÀÔÁT}I”C¶–‘Qîì¹È\·ÞWõ3›Ã½ZÆ™&ÝhÄlÊÞK\o`~~çt!•†ó(à'¤§tq Y†¶bëÑ4r3ÛDZëòa[ö_ó>(ÁÔE7 bO;8<0¹8Ô4;Õª>*ËVëu?+«h–H½~šq»x/·}$ãºÊá+¡V8|ýƒ!Ù‘`Ç©³Mò×ÎàåÇøQÝ'ï³eò^JYõžâ7:¯?¾kñs”ÛqWç®fa Š’Œý4>§ ÇZ'úy]Ü;_GdRÁú È•†bn¥æf§çƒ\Qù²1³7› +3ú·<Ȉ›h¥=¯`·C-ãZ*¾•‘Û3ØJ`+>…p˜;w cÁ¿ù\åµdf؆:îÉVÂÊ£QÏ +Ló¶Ú±{iC¤üD8þúñ7.4ß=£Nƒ~ØA·™Y¼ŸíQíì +;dÕÚÞùYÌú.ëÅ3¬m +Œ·Ò'OܧZM•ÈkÚEä»óÔAøV¿F+áÖØ\7H”ÕÁ¬–ÞÙ‹s± +A7µ¢¿ï?å151"yUF„I×íòÏfwÊ*Q;1WG¬ä‡üÖWG9 +dòú“¢Ï¡ã6–±hò¶þ|áç RÖ/?‚jïVÈttf=]«mîXCh-»E²`?|(“躃Øçw¹©”]“RÉÆè·¸¿½ú‚[O÷^Üä'^m[ñ™4]aÄ‘þÖ9ö5QºÄ”ÔbcÅ‘n"¾ÿ]½GF&<ç
¤3dRµ°%‘ ”Ê.ÓµÉÂÆWòQmw)‡GÒDa™e¹ÔÖlNA|¦Z–ýÒ½‹Lýƒ÷ÛE}b\ÝîL» &épƒ·gr[‹÷šßžz÷ìòdÈĺ‚íüë£-«‡Z‹ÎîpnöŒ´Ð|˨) 2xqô¦S=w¶Ã†ß
jIž6a›6Ä.OSy]ÆñþS§oa¶Ô«ˆÌ±â£Š51r»%ob2üpȈEÐ&â§ÜÈÕöIòÊp¤ì‚è¯ôV²íNæçiX¯Ô²»Íæá‡A$Ñe$D{òD¾Ÿû‡‡';,Ög¦•k\Ü Gái3¼q¸Qþ¥L +Xæ"¢Úbò3¸ý]ub7¾‚夨õù-ÅsÅK>ˆ<–!!’=j‰Á
bê÷](åÏi·t9ù +KÆ.Ha½+-Ε[åòÿÑÒñx Ciif|-is \‹¦ÿ€|6±m¦ÍñŠ =“1ä`K^!y9ÊÌßIjX÷žXHO~ûLýì«œÈF7v—")òï@µW™[zb™®ÕÚ4“*ý÷L´ªŽœ0–¯z$¹Š/‚„à{>UiO³ýE©²5êæ÷”t¦=Ä;î +€¯À4?œt€sTeù›!4J%h¹‰¸—ŽQÏ:µ¿yÓ´(kY¸³½M>X‹–
sôqÀirÐÀ³8!ÂùÕÏS€¤Sì$óÅ$R÷Ñ•amPÍ$?çÔg•ËŸ˜Vd[ƒ1ËiÇO°<Ø_¥¶%yÐœáZ.›eˆô¤Xþ*Iò{()õŠ_¼¾êW÷ºÛ£x}kã¾ããVÔ³Ö–I͵'EÜöGi‚õÂV;áåÏ¿Ø×6™+Ý$Éž {ýTö"1Ðœä5v-V$ÍlÂÞ¯«ª›bݦ´³ã)º§ÊoS6”hLGñ…îÇ,v%¹u©I~®]%¾)Ñ}ú‚¸2¸ âoJ°]^¯ÿRÓ HmØ;Âúž +8>Ô +²© +3ã½+ôÞÊ•÷aˆlª Ïn×–OBw:ëÌDöƒ^ቃ€¸Rn¹šd¢¯ÅÓò;SÓtd®ÌA~zM“èRVt}õÚ+'˜ †4~}µ÷°}³íÚš[T:áµ%|Å’Q"èXê³ÚÎÝ9"áòç0Tw³È‹d·¿Pô@åÉ@ÅìÓEâòxOæî¹Ã åÏIXUb_4²üQ
¨:ù©^\õ47ãÇU¸µ&²ðc
óŒA«`á0Ôýµ˜—™žÌ‘¥ˆß·%¢y†.Sz¾M²hàž·ãý°óg
#$SÿçÅOÁëÏàBø[yã¦5åž Šq(OÜâƒL#‘'Þ/ãØ«*ûü©¯ð5X1œæ)ol×Ós[2L&³d´/øÿ—ÁÿøÀ +#Ñ{0ÒŽàÿ +endobj +998 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1915 0 R +/Encoding 1922 0 R /FirstChar 36 /LastChar 121 -/Widths 1919 0 R -/BaseFont /MITGYF+NimbusSanL-Bold -/FontDescriptor 991 0 R +/Widths 1926 0 R +/BaseFont /DCHBJO+NimbusSanL-Bold +/FontDescriptor 996 0 R >> endobj -991 0 obj << +996 0 obj << /Ascent 722 /CapHeight 722 /Descent -217 -/FontName /MITGYF+NimbusSanL-Bold +/FontName /DCHBJO+NimbusSanL-Bold /ItalicAngle 0 /StemV 141 /XHeight 532 /FontBBox [-173 -307 1003 949] /Flags 4 /CharSet (/dollar/hyphen/semicolon/C/D/E/F/G/I/L/N/O/R/T/U/Y/a/c/d/e/f/g/h/i/l/m/n/o/p/q/r/s/t/u/w/y) -/FontFile 992 0 R +/FontFile 997 0 R >> endobj -1919 0 obj +1926 0 obj [556 0 0 0 0 0 0 0 0 333 0 0 0 0 0 0 0 0 0 0 0 0 0 333 0 0 0 0 0 0 0 722 722 667 611 778 0 278 0 0 611 0 722 778 0 0 722 0 611 722 0 0 0 667 0 0 0 0 0 0 0 556 0 556 611 556 333 611 611 278 0 0 278 889 611 611 611 611 389 556 333 611 0 778 0 556 ] endobj -989 0 obj << +994 0 obj << /Length1 1166 -/Length2 8219 +/Length2 8264 /Length3 544 -/Length 9029 -/Filter /FlateDecode ->> -stream -xÚízU\\kö%Ü(Ü¡p'¸CÐàN…KáÁàîîîî4¸îî0ÜÛÿÛ=}»çiÞæ7ç<œï[kŸµ÷^ß>õTÔäÊjÌ¢fö& ){;3 ¶5qqV3¶S`VY¸ -ì2SCL-ÿ1.¹löçwR¶wÿñ%˜Ù¸ØþÆ©[‚Mí@Îίgñ'²3û[JI;S{3°@
ò:•ÆNfÿþ M]œœ^íùó€^ßýko~-r™"/ÌÚ› -|¶ªþÜz[)JâƼ5ÆÑÃqýâBƉüÝz“¦[‰Ðºˆ„3ëŠ7.MBù‡¥p¹.¬",tp$‰äw7k>±6lœ l™PâC–A%~ÔSDº‰3`qÔ7„Œ=q~™ò’kmjañQlµ`{<ßw·:;»ŽÞ–ä”!}Ø¥çÿ8þ cã£Âÿfz¨]hð%E®£~òŽVN¥þð§¬
Ûhf¶WËw:XR}jB¢]ÄÃß>ÚÁ~oYÜb~_9äÃ%Ç¡ï°ÄÔ—«Ÿ³Ü©û¶ÐÊhíƒõ&¦¯ð»%ŠSä6QüfÃ`¹ %®“ßmÇ|?Š¨†ªÆéo -ÍZ‹²™åkÒ9W\Ž˜µEÎ0³ÚpC²I;ü&âuuΆ¶sMѨ͞eÕ0p]³÷R› »û=¸lG+»ó”Ua×>Ÿ}’&ÚªTC&p«¬*å*]±–æú¾üw³ÓT^
ËcÝ-õn÷³Íi=Î]á)Iš°-V$¶º Ë"š¦ -g¸—Útk}Œx[ñ®Ìõ.€jþ¬´%€Ä4êª! -k¬Öþ´qÃÆ´°µgê»÷ZÂJ¬v3’>‘M0•¬*3ò(ybQÛ_.²‡
ÇP3âĤÙXÕ˜…FŸ~||Yà^òVOƒí÷.tc`ufÀûe¡ÏŽÝý}@csÏÊÍë -‹¡å7Ĺ@œõ ŒÈ±-ñÚΔõ=±ýÄÆá¤ÇÞŸÚ‡ÓRCbÇù0X÷ÞXcÁi¨>ýÅŸêr¦šæö!î!uÔµ€(vîkõÔ¥„–»ÓE±Ô¢AÓzzQÄ u´üÞäâ%`O¤ÊPÌu¯QM!3™e¤ßóÉ*Ä’C†òßoÐÚj0‘ûi·w/™#g“a¾‹RJ³’¿h(úõÓÁΫxƒ×KZÿ¾}_ΆMëoÁàþA¡ßŸÒ_}
›m߱ݹe½¨ Ì6Ÿmà*Ç(O FÕr$[ÏEra&C…ö´,^.ßöpÍÈZ‘Ê4Љh6Ç£r¡ñß›Ûu‰j9…£d¯|5M¥[+Øë0Š˜[õ¨[Ù‡ì™}t ð&N/*ƒ·GÝ$®ãÊf½9à€ø¹ªöäŒüV|âí*t¨À›¸ê…í+Êu!÷؉w6ºSyß‘8óý3N®AÕ÷³X
7šDŽ;‰tÛÙÛŒs•šŸ'Õó÷ÜÄ°£ç‰Í"7?Øë`ÕÜæ½k$8ﺒ[vX¦¬;;
$ØÕÿÈ»—û¯“³Að^W
Ú¬Îs0blD@Ê æPgW,…·°P@”ô36†—ò”оxíx=,‰Û=¨‰æ"Ú’®À<^jÒq©ç7>qOUeƒzIeÆ$uŸ¨nýàӾȹ‡t•µÔ ¾Ö_ÀI½…ÌeÃ޺Хèjâ6C9B:JëVÓ³w†cÒNqî_¾3¥öþ§²}l™ý-"yÎ>ò-Ì„4ÝÑkh ë-¹ùHjÿ‘šN¸ì çB¾—–"Y©4.
-A¸i9ŽÌä“op…~{ìƒ °CÏÕÑÈú²’a
ÜV njBL¹Å°oÈ¡ê+PÍq—6 À=jßÝ"_¸Ï~pü\îà€²'æ¼Ì+(Œ1ó„À%CŠ‚â"t«%Ø̈Z rN:A&¼Û`¢Ó
¹MÑóå9~¯ßW'úØ·õ*òÔ}”w]ˆÈ¤%Á’U‡îJŒe!s‚ÞŽa[]s@éƒyhžuÜýIK±,>®øÝzÚ€$Vý®ª
[‹g˜®ùœ7vØ>À‰Î”
Æ>ìÆ?€á,=P-°ŽÑòsFö›œe‡H¶fkÁ–ä2W>JjÌdÑÒ*”Æd(ÛBçˆÓsmº¬vkuEúCǘžœ `g“Èñ[ª€O‚zŒJi¹F…ÿ3_â9N¯!úÐéLJgH*Û<ª"
Æ)cømR"N|ÃI–Æ@àÂHóèg÷Ø!ÎÚVB†,õ ¬kiU¨£žÅˆ¨iGÁtä“üª›:æÝÀK¿±=q§‘Ï;+ƒh± -Y®R®º)Ë»Ê&:ð1öi?¾rÀÓtãÓD÷Ê Ÿ -~/bÕÉØ>íXÑîtÁ§ìF¥&ʤ§<õE¤O¬hª¥ªMó*æ9¥nïæS<¹ -•>!¼©öHøŽÊ}1/Ì錇¯ü%ŽÔ—;f%]žª‚Q«Wnõ¢¨Ÿ¬þë×üäùs† ÃÐð<*:›Úƒ=‹’‰yÁbd³ý’wÝ·¨ös©n
﮼iÖU=³¸L…çM‹àÛ™,’¿ÚU¾Eï_‘¥b¾ZŒ~*{b´‡iÿ¦EÁqžtïå%¨ÿpá¹óp®Ì±´¯Å&‚ãßÔhUµÞ°Ö)³ÃéLïf\¬á?îŸ÷Ö|;Çè]zÑá8*Œz·2ÆwáQx+®w±Þè%ý˜¨Øôêã%Ãï ýü?ó>Ës«WÄ¡¹×ÏÕ|îÍä)”ÉáÚVÁL³ºVY¸9r‰ŒzÃrÄ¥$êío—Rè5t‡©ªt,uöEé‘w -ÇÈ“Öó²‰ÁÕ¢eÓTî^ú1 -ô 2ो±¦ -
I~Í)¤×™±'yš‡°öÞ»øþ¼¥þ2†kø@6×Øò¸÷k1v¢üsí†Ö]0RrÁ5í‘bíêÃ÷s,íq ¸{×vزֲá$Ðx:ûÕŒ|EÅrÆ~?ó¢Ìd¼ô3×n¬ÊKD¥9ÏÃjHpßí¤ªo¶Ê6‰ØŽ -TteS¾¯<´`oCïO¥L"/[Q×f¶“,TÝÐÉi£È]²Ânñ¦d&hY·zp|„1v:LI0W$Í°¾}R©‹•èVuÑâ…u¼É³Ô"Ÿõ—JL‰æ3Þâã¸;Š%æ?¢SôLÌZl‡)u‹1¢99lŸÿR°uø¤qCdyÂã¾jw;‘Í7®˜ -5õ~Å®“ⶈDó:0K®sØaì÷ -\§«0ù¦ÞÈ»Ujáýì?ÓÁÛº€”<®eFÂÛ;/…)*ÈħDª7ÆúxYvƒ•Â©%‘æÜ€5¸¶rlb,îE{D‡‚n¾ºI¬Xß—F¸N[0D:.hIí{bM@Ž\LZ8Vô1KgçÓ&ÃÜsß~)Ì8Òr^œæÆcXÐúAÄ0ŸžÙ7eTW±çNÑ16ÑÜ=Lð‚ûHj•OáQ«FÑ®-Ž.S[Îæ€ø¦Ó¾/ø¬¤=™¿[£>^µ qj‹ïkñ‹—èYv3ÞåêšuÂKýÄE‚àÇ΀(¥'ÕéZI
¿týLô%-d8=ïò^%† JKÓó.›Ïïñ®„Mõö´‡\wõÛF?|Êà~TƒŠ0FvdíÓæÁBª0¤üx«›‚ô3×ÃÏc³3®{຿ø¥¦S§4@²AWÅ6×™»ž]}ÇçŠfTwn¡)¹ÃÔwâÁúábNv5)îðE3ÍEyñÑñÛò†).ùÄ»òcO:ôÖÉV½õ_/[ÝÞíŒOÂôqD=yeÅdæ&ûyi‡wÝ©Zpî¨TÔ
¡J/>/å -nñë炸™Y*h°‹?t -H?¸eIŠ—ªÆÁÿ°’ó(üèšÐ@õºõ‘7=Au±P¶v«¢½Ò¼¸ªÁW…NÌÍeêáá²”eÝÐ31_&„‚òwnª³Á= …¤_"kÁíZkZÂì+ø'Õ]ß•|4¤IÉ}4˜F˜Q†[P»ký»ÇUª‘ÕŸÕó?FÛ>S—yWÞs‰K=!“ÖRÀX'<jù|«ž
—íJ½jŒ—åf(^¸AÞ…k±ÎY§ð§-ï -bÛ -~kКYãYç–ˆ'bK\û^àúeÜñƒ‡³žjYØ„— H_fU:º½ç(ëÃïø‰8lÞ@ÞÀ·k=†ŒêAotZAxÖ«Ž6;ÆÉ×ý¶Šêý¬Ž.†I/½üþ¢ôˆ7D[»fëäî”îv¸!ëPÒÑ^š¡¾t¥-ÄM~&’~ÆÑÝ7ÇêãE)ŽÕÐj\ƒv+1\…xwÖ b´|}"ªÖœ°wU䆅âWcœˆ¸èiOõ·¶ê$hBbýÊɢ뽪¦¡¡ñ}Zwö†U)fßu^ˆ”TQ(”9%S3ôëhC,‚ܪ˜éí¥nÅ ha6Š/¿¢pg¾ÖéW,öPÏ=VjáÁ+)¯BK-b
»&ÈÒÝÜȶÂjÜ:°Á5×ð§¾ëMflb†?î·A%ÑhNÉùM×jBòý/£!™^dýì?Ž}uÓxkàÊ̺‹” -ºE<å_ð]¢Ò«¨£ëK#Ô8ßôÌTòÖ8ïn§àôØùß¿[Ècj¦©YlÜf³Ó¢Ç…hum´—*KÒïòþŒÆ·R¼SØkæ\§Ç@°[‘Á¦lëÙß6úÁ¦;+36*ø¥ZS‡'Ï K¼GvŒµ ¾ -òI» ½KZsìã&&ÑŽ|(ã½%8‹|ß]´së"¥õ.6óá®3ïw?D`l0
£¬ÓÝ,w@§‘mÁÏ…XhÓ¸êC¡ùa6›t:4Vü•þƒË©¦©†ƒÀV’[‚ËIϨ*[Ûž\÷Üz–¼°9hóáäýÈã%Ôc‹qƒî‡<%ÝjÕL–*º¢ú¾V_x*]'×ö@Žî)Ï9o¦ån¤à>!ƒKc~FlPWšˆâfh¢ô9&»»äNA0¢òǬmZû§æ;é
ϼGªmnõýa ƒö½Ï¬¶íX@ä7^þs‚ìpé‡(ÍLÝ!·]ÓKCÖ'"öÂEàÍ
•,³’]R#;·y#ÇVcðŠ®j°¤§÷b²º´TüñgOÞ0å¢u'”–å¯0Zèñ0É#fo1E¯NV -ºÇwÞ‰ˆ``×긘ÎD÷Ô‹ß\Hh˜ h@pE…°/¯è$!1D¹‘VB¡ŽèòëFŽ®–ÍäêEH˜$.¡KÑ~LtBðòUkÚþs“y‚üþHN‚>¸)Ïê:Ÿí»%²OzF?‰B:$ä÷K
¢ªLM$åÉá‚=¨ÖŸ2OŒÞϘÅ}!¹ið<ŸÓŸ^€Zògäm#q^åBÛáXˆ¤¢Žô^îpT%Ñ j÷Š—ûñyôR8Áà×Ò)Ÿ¬#2š>ÄÏøƒ§%£h¿ÖGbHGfh~LÚb„,Ô܈ӽ™”ĸŽi2µÑÉOvô¯L¹`Ň¿¤1BáéÅåœV×VæŠ -ëJR†sýœS³o?Û\Yûylîc¿¥ØÚ&W}{é—%‹‚òCÆgØb1ô3šY- A -µ¯\M©°x2Y£|é´É˜™™ÃªÉrÊ’r¬^•†Wé7®uñ©·ßÔƒÞ½<‘Î7!+çRSOÝ3+èó@zÒã·
¾E2¨ƒk-Î\/…ËÖDÊéI}÷Žmƒ*Wç EÂÊœºJ Æ¥à·ÍìµO).žÚûü{‰Ò—‰¯?ÕóR~µ\B‰2b9®Ü}“‹Êú«ˆüßæ:Üoß®Œc…èšÎ¸°ý6QÐ%9ï"n9êäˆkà ‹5…ªE¿mc©#ÓûŽ~SœNܤá‘kîdË¥=´Is™Í²ä»§”é~-®‚b -ŸÃT¤±öVið„B»·¼P@V–bß]AhSL±ä…M±x7̺¾!¤”ÃEúT<ÕÞwü(ˆ¬úA*U ©„÷0[Û-© ^Æœ -ñ"~£t¦K©¢·Þ+ÿ¥ØËZNrósÝ,2r,ZAqÙúK]¦äñæ×4«(‘kÆÉÉ
©^¬MòáFÌÔ[X•ty‚…ƒ\[$«Å -Æñݧ‚}~¾+kv&×uXFû\éo¿æ€Òý¦ TÔW›EšÃƒùì -|û;Îb‰; …ìs™| )Yÿ7™îÀø"G›àX!¾,ÒÈHÐã›}€ÖÞü‹i-PÁF²«ƒüÞ¦ZÓijýBõl&ü`>R}-•ÏT{@Æ×›îMß.¹\næ€Ñ‡ÿloÙ©%Èä'$€n’ëó(½0ŽùnÆûd¾¹
G1Ôù-F‹x -˜Õÿ9¾|r=Œy©7y«ìýUT`-ͽ̷4k¨ -󚺪mÒгdÃÊ-e¨®\øÔ¯Õ&/ævÈðnßSÙïK½c‡ê=åË×Pã{;õö{I‡´HCvÞb˜qÌŸŽÞ¥J—†u;òi²aï2®zú!¹BÕ£èæÅÊfùvwVúÃVMæÎüÅ·±CqßFê7|½xÍ·i‰¡dð‚nŽJ`±—æ)ÒFÅΓHú_FܬWÒŽÄxÏ|=çtà¾U×ÅhG³ùJ|~+ã4p¼ÍHSª# ùÞ”zâñ)åí‚äbÅ7Å!„²‘˜‹OõÂÍʵ6w"3¥·'Í{YVO"þDh‡¦£ï¶¸„Êt¿’XÅ/D*³íÜd -½~O½—Åóè.¶ÅÀ[›ÿl8¨¬–†JEj`sí#'=Û|HåÈ/}'ôäÇ!›XÖÅ×@ú3ò%éJÉ
M|–9qú€Ù¡¦‘.Á™m÷›±Gf)Û -ª¬†ÒU8ã>Á<uµ?Bâ¬Æ+2(¢š‚a—-<çfhF ³9žäžOLFzƒ±†Rºr]ÇÈ£"KԽΨˆ[ª, GÊÇ•ÛÃp‰ÕBÉÞöÓ7 -‹Š=TÄÔ&ÌC!¼ªZøkÚû#Ê7›•‹2Ÿº«áÍcTvšò¦[bc+Äû -[Ñ=wy3WR‘úžv -¢³‰¶U$òhØ0R"úkV9ödùZ#×yÔD¹ˆì˜ôÑ{<ô%5åVáÛÇ'¾.ÝOUc~QeAÜ<M#œNä^Hœýjœ—Ôn”\ëЇ”é¾tþNŽY±ßË/„r Ö‘½îƒ™×òͼPÛØP9 “,¶HBwúF:¤ÞH¾¼í¶ú;sÖµ¿Nï~ßÓÎc]æ -n‹ù¥RßÖo$sj±E É”w…âNÈ”A÷UŒX[><{a™®’cÈ÷˜ìÂYkvE#N¦ôßÔ2á ¢ç$WÂÄ¥s¦Iãã9ë»Çô¾ª‹$¡=aLjôïZ‹ÃÃtn͊2ù!¡þ5ÍcÍ"fÖGÐ:~°çwˆÿÏMBØOd´¢Ìð^A@Ê®$%¾bÍ:†¾]¥Qs4±›éÇL†ä%}‘a\bBiÚ¨„7±œ?DãD]+nŸk`¾bž3pþÔÊ63稜¨;ÛE‡Õýi`"ܵuêÆšLlVW©V·
³‹ÁO|´6¢/¤ƒm? Le>u¨Äþ_^Èÿ_àÿ S±ÄÞÖØÉÙË ä±wúãÏLÈÿYŒøCendstream +/Length 9079 +/Filter /FlateDecode +>> +stream +xÚízUX\[Ö-4Á½p'hpw×*(¤€*Ü!‚»înÁ]ƒ»kÜÝ/çôºoŸîûtßîw«öZcÌ=æœcÍýíz(*r%U&3[ÐG[¨+3 +në3Áù +|ØGè´£ÇÀNâ¨Ð× éÛb®=R‡äEÚTBbCøª¶DÞ¤W:›[öŠ¨$dEY%Š[Ót¼/oü¥¬½”ùP'û[Ä–~ X2µc×42:Xµ{—%ÍøFSÓ]¢8œÞ“’˜•G&$ÚÜ|-Cl7…à›ò~»,Nv}»Æî,@HíŒÅfMè\ƒ•jLw~˜,rÿMüF]_© +ýÍ8¶öOáÏoëÓ‚úïLîÓ¼¿œ+è¶kÎ6ÙAÝ$=43Žºoô°Jü¨rOwVsr¶Ê¬ðšz¾Ž~ÿ²ºþëÁ‹êËõ-!蔄Wd=R9‹ò”l:VŽhÔïÀ³¼LôÃaìtþ8QIVæyU&Á¡û«ü\žj_E‘{<óéYàôDËæúløa½ê£D–Îîç„xô?¹é$Ì|’"Xûü"rø—Xu[ÊÚ6·èNâ÷AŒ»®qmƒ½Éý¢¹Hx7žMxÃ_Õ[±½z +¼*K«™Zú¹úÕ°×Wý¢Øø¹.ÔR¯æESúLkéDÐ?«áäv%. +šI-b´zŸŒU íÑ—þDÅyMß\…‹ÙCó«ïÓÖSätRR˜…$ùÛˆFy/Áê}äYeOÈZñ¸ÕÏ«¥¬øïc}͹ü< ÂåŠ^úRX¿T[ÅgÝñF/yo\ky“Wb“Ë·Ú{že”Ã_¥b1‰¯ç(17•®LsT/“ks¸àýÄR–Ê8à׆h0ƒÄcsâð]€¡í"Z°p¬Ì¥`ÓTÚÕ¼V£ˆ™×Þš¥”¾Îé;»WžÄi%(¶ØÄ5œ™,—»ì>N*Yƒ?åïyÚóíʈfüλ»²É½ø7ãáFWqÊZS>M…ùdT„Ǫ;£Qס3˱_‹§ÙL_¥Ÿ€(U}Üh-²CöF;5œ}ó.T²¶/0žyÖ]±!3f\CÕ1WR|#¯o‚Ǧ?}Fq?¯ÓfÏ ‰²¾RŒ2Á œðäÞ"# +hŠÚ?åðP‘||èuæsSQ2¨•PbHRóŠêÐ8ꎜ¹MS^MýÜÝ´Ó›û¶ÈnØU´]IÜl(óš–ªÉô˜ÔpXò,Î%0Œ1µky„Òæ®qú§°Ä ßÉ`hˆ Y›½ goû[rð`jϾªN¸tÇ\®»–ü»bIBj¬÷¯Âµ^‘•HÝ{”é·ÄÞê +Ô
+¸'º]÷ñ@f̼ÀÜGgìdô—éËùêÛðFÔ!k£«Ã*.$|™/mßFàŽùyAO&—2Ö…Õªõ¾1Ù«<Žø+vˆý–Dce”µEx`Iµ5úÐçK:™¢¦ïÝOÜtó‡ž.erƧbÛ,H/«äíuåí™RrŠò–WW“OF3³gÃ)‡¬Då"\ßžâjèßÓ”võVسïuÔt2C
«Æh]W*é„g̯%ä"‡È@Šr¤Bqf„•4†Fóó<ÐP+]°¹Ng…8à„q/•ãȼ¹b–Òdù&Ê´ºdVNšùÞÕç6bÎNé?ï…çPÒZWïn›vÊ +bší‘v\aۺΤ:×}¸½øÚ"¤#"tl~–ŠÂó5‚ws¬@ö|KéêyÏ’4%Óù|ô}É=ƒ-RK¨Ö{Öˆ“¤‹xwwa@â©Ûæí‰ûÂŽKˆ0oýwËŠµºÕ6©M8³q¡ºïˆoâ³·àßYF¤i{#ØHjî˜/„†HP,9;]D»¢ôc¢bÓ*ÃzøüÆísüe¹ÔÊâ°?»ÔÎTùw}ãΗÊâÜšTÆýjy¡<w¹ï…ʼOŽ âéMÉwï¿ÆUQ8øx¬È¬¿àñÆ3…}ð^ëaÑÄà|Ý’¯¼~¢Zw(í +kA,Èž¼ÃR*(^?X5ðÙä,|í0&æ)q¡35QýQ”>1(`ãóŸ©3;çó~•…jffl¯©È{>ë²SÕ†¬[ZÆ€ñí^m5 +îlúôü4
} +¸iÛ¬[ +AEÂiæ·Ü¾^Ápš¡¶²S‹q”)ä—®}ÀÈ™’X¦‘Ñê ½ž¹I|&åYöd§œçI»Á~hÜ%i}ºZùñfǤXÂx,¯ðçÝÀŠÆTÀ;=ÝJi×î^‡É¦Öèz,€h?R9Ìó;@Öÿj—þY) Ƀp9:•I߸ùG« +gwoÔЇ¼V}ŽCsg@ˆÑÕ†šÒm
^©‰iÙ;4 +ú‹®fºÐ61^Ô˜±õƒøåiBž•1•ƒ—ÛÉŽ¸ïõ+üèªicöe 3+âòÖÛ'˜–ÍN¥ê“7ðÉi˜ì§ï´½~2¤bêó²ãò½õþ•`×Êê¯áÞØC?¹ÕÔÌ=u¤ÛˆU¸…Í"â#øŽ\f£N2ú +wŸè’¡µ¸§¶”¬Õ¾Ï®HÁ=ˆÒT“³šÌ6X’>3¡6º1•üVŽ mjƒ3/7¯=Íôþ
&!nIy<<QDð"'É[nt”;D[sZæZÿÄŽ¥¾v™•8`±ÝÆfF—ÚsÔ|¯ï7G 9Î+
?Iæ†]KkÛdìÓ½çÓô+(–¶ÿ5ß(äþCT°‚\ÚŸ§l±npOhÃíÜ@tþ¹3´6PäUi·QñGŸð*íwõÌx¿©1)mvj"§f6¦F0±ÎýèªêµÌY™i õÞK÷òUQNÉg_;;C4‹±o%bTèŠÍ†d^âFG
ÐÛk—W·>`e%aŠ{ƒ#0SÌ=²\:×Ñòz¤ØGàU%˜YMçËá.žÜÃ_bÔõ~¬›ÖwŸXöçÏ×{7¨‡¬MÅ6ê£BÊæz‘×´‡ïÝpä÷¹QØì‡G2n2ªDö.×hE#£“ Z½¼Y‘ñ&ÐëE\(ÃES¥cùlgK„ŽT@â91D±èc™×Àj…¤ÐiÞÚDÅëÁ»ÂЯ0Tµµ£bÅ$㪌íéyÑdö¸Ì„ýn&¢›\ ‹Hè^¶ÙôX\JÆÇH?!Ê +F‘PÖçhé!ÍFµù„複ì‚4ãE¢Q¢ªÈŒêË¿$Æ£}IÅD0I>àÅlPól&ÕFXÞáÅâ‹×Ž^ì÷êÑ!W‹ é·qV`ç¥Óz"!׌_j¯Ñò«E’µeä—QúŸŠGÌå«P•['ïkÈôZðÛ5%K…š†Â¸ª¾àÛ㼿°è/©äGZÖ¸µ²¤Ë›w f§þĺ#7^•Ÿ?<Žàa¶Úñ9" ç*‹æz]à•Öˆ·Ñôv–ý £-ÉTqÿ.åó%‚8Þkeÿ3¿[M£6ò¢@Gò‰ƒXúÞ¥çˆS&2ØŸjF[fzØ.½„ø'eCL`KI +g.£Êù5õ\Ïc¯ªO]ffå,§m¾¼@+¬—q[¹ ,<¸¡ÎIPŸ©if8§”MIe({—Jœ~À$:`š‘-éé;±‘¬y~`²ŸâÑjr+Ö-±˜…>IEƒfçl±¢ZV®ô
ÛûUM½5
ßOÇRòˆœN@Èd£èF_ó³òÌu³Gö–l0êYiQ¶ˆrœÔÑeY$î9Ùq+SÊbÁ9+²ÀYƒŒá—)mdA(Å”µˆm;ÞUÓ
ŠÊˆm-Œ/=ŠÉ?ˆ)CHÙrS¶Ô-“×ìª0Kƒk}öWjõ‰9‡ý@F#iÍKû½D;¦$*µ±¯ˆ:vÍuš + ¢6G4ÚWó÷mq£Mo’¾íü0zt™žà[ΛÙóïÄ3ÕÝZsÆÈP:dVÔ/fyŨV³Œ§²·ÞŽ%ŸðG5¤ÆA«ÀÞ«§hÏ}Kœ¤=ª4¢a3¨˜– xMPn”ªÇ#qp´ų́çxk lƒ<¶ä¥ùÁãÊ¿aLÆòË+&ç0qwl$^dnÜðy(ÙBÓ¶ûo‘#@¹×M±®@S#8±CjQðç}ékŠ»*lí,¡µ=êïΘexí¬„¢h‹®•ëö¥°gЇ™N¬/U
tùM-w*Û¼¿<ý\ɽ~,($ۥDzÁÏ5dèrÐ ®Êº=¸’+•"‹~tó%Ê"â…,iãä, +û +àÑè.šoÏxg6åëÚ†ÇËVDU±N…;ZÆÒ5oùOhú—Ð>IîÌ:h^$¼Ôlz×ÚÁÓT @ÿ}&YƒHõEŒ(=‹qåö6õÙ¨ôW=wš’xsDs‰¼:ŒëöÊ-¶¿{´1öFi”"}±FêÃLf_ÜÅÅ;FO5æøþ|y~U¦Î ‡ëÄCš¢Õ„’+ê´Èø–u{Ó&d¹¿*¯’E牊ô‡Mâ‰t/&%Ï©H6ÛÒ¥Š‡¬GJ×:Ìøö•¿ÒÒ•ß:–”eˆº —ýq«É(LdOÅ"^$·u1§&j¶ÀZ¬ +Ú=;ˆðá:ØÓÏäÁÏ/én¼¡,*¢`\ÜäK}["ÊHTÆÞˆo`ÝÙýz„N¢&j¸'µ2ó‹|K×c6Qén)' üÖœëv?.ßüê´–®PÌ£§åZ]GOŸIªvIbŒµ³ÉЄH\Ô‡óÉ}vÆé¾°å1ù{'¾ógâ݇ûmœ‡½*œ‰VákÑJÃÙ9ÿ¾<§µÈi¥ßgCL‚¶áX±rX¯=Gó‹Ûìö.BÒÓ oû~o‡´~8:_ª˜WzåHTº{‚,×d?u-ôR,ýá²ÍþcQk®‰î•üâŒ'ÄݹQ쪡³¾§Æç‰g\&ÚQ„#J©Yð#Õ²á[ƒËEßE(@˵¸x†üœ³/ö®:g]!$…US ](%v¨ åÑÜ팼`‰jî&^Ûœ?-ó@öùàjÙ÷<³ïlY?XRr$Š™£-ÑTù†~ŠÇ/0‰ÌB¯7Ù×ìYSB{@&A^UEs $DH@ +Ù¦ÏÓ%"Òð9Ó +-ý¸Bçhµ0ÊnnL¿ñE~„éMÇv¡“LYd< gñÕ¾ìQ±íÅ EþoÉ|Ľ„\cvê´ +Y
É4j"¼ÒÜçÞ»6ð¯ø»(~7qBËb“½L*&=¤ö4P'©ð·@Xáѧ†÷§€R§ ÙiîÌ#k]3§&M<~èêÆŽ¬y×–=¶÷.Ö}ìh"rr²Ë«À±æ<³$wt•°CnEÕ@¸*ùwN.߆Z r™LŽ:øõŒªOâTãPêŽ".!ÉMù?dð<Ÿ½h·Õð¯=B›B] oº×dûJèoÛ°Æ°TFØQêP¢úC@qSÁÅùÖ÷¥7_±¸Ôˆ²»ÞÌ3å³_Ž¾«š’ñ #¼Ì‚
¸~sOsÔ|ùƱ-J?§>8_@1.æXIg5ßRic¹Rc endobj -990 0 obj << +995 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1915 0 R +/Encoding 1922 0 R /FirstChar 2 -/LastChar 148 -/Widths 1920 0 R -/BaseFont /LOBUAX+NimbusSanL-Regu -/FontDescriptor 988 0 R +/LastChar 151 +/Widths 1927 0 R +/BaseFont /YOTDOT+NimbusSanL-Regu +/FontDescriptor 993 0 R >> endobj -988 0 obj << +993 0 obj << /Ascent 712 /CapHeight 712 /Descent -213 -/FontName /LOBUAX+NimbusSanL-Regu +/FontName /YOTDOT+NimbusSanL-Regu /ItalicAngle 0 /StemV 85 /XHeight 523 /FontBBox [-174 -285 1001 953] /Flags 4 -/CharSet (/fi/quoteright/parenleft/parenright/comma/hyphen/period/zero/one/two/three/five/eight/nine/semicolon/A/B/C/D/F/I/L/N/O/P/R/S/T/U/Y/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/quotedblright) -/FontFile 989 0 R +/CharSet (/fi/quoteright/parenleft/parenright/comma/hyphen/period/zero/one/two/three/five/eight/nine/semicolon/A/B/C/D/F/I/L/N/O/P/R/S/T/U/Y/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/quotedblright/emdash) +/FontFile 994 0 R >> endobj -1920 0 obj -[500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 222 333 333 0 0 278 333 278 0 556 556 556 556 0 556 0 0 556 556 0 278 0 0 0 0 0 667 667 722 722 0 611 0 0 278 0 0 556 0 722 778 667 0 722 667 611 722 0 0 0 667 0 0 0 0 0 0 222 556 556 500 556 556 278 556 556 222 222 500 222 833 556 556 556 556 333 500 278 556 500 722 500 500 500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 333 ] +1927 0 obj +[500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 222 333 333 0 0 278 333 278 0 556 556 556 556 0 556 0 0 556 556 0 278 0 0 0 0 0 667 667 722 722 0 611 0 0 278 0 0 556 0 722 778 667 0 722 667 611 722 0 0 0 667 0 0 0 0 0 0 222 556 556 500 556 556 278 556 556 222 222 500 222 833 556 556 556 556 333 500 278 556 500 722 500 500 500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 333 0 0 1000 ] endobj -964 0 obj << +969 0 obj << /Length1 1624 /Length2 8351 /Length3 532 @@ -8670,7 +8718,7 @@ xÚíweT›ë¶.R´¸;A‹»Cq-î‡ H!P¼x‘Bq)-îîPZ(VÜÝݵ-íº{ï3ÖÝ¿ÎÙ¿î¸#ß;Ÿ9Ÿ©ï_˜è´t9 ‚l °… qòØ€l1¹5 ðG— -úhÄÃó7LÏt„ü.¿à_bó÷Øõ'rn•Jrìÿn·þÑÔzœ¸ž—ðܪCmþyøÍ#+õøp +úhÄÃó7LÏt„ü.¿à_bó÷Øõ'rnemu¹Fìÿn·þÑÔzœ¸ž—ðܪCmþyøÍ#+õøp ñ8ù„E â6/ÄN;0|ës2©¶òÄXˆÇ`kmH[Ǽà*õp+?ýä†5€Á#/€ˆñÚǘRóŽ¸
¯ *ÿ€9a÷æúÙ—þ¯½=g(Ÿ6)Ù³Þa0‰{<ÁfŽ pÍ¢”2Ö/õ‰`”TèÄjš 3L¿àƒíá!ŠH» s…?VLãT‘¹Jˆ&‰g: ÉÒѧLy‰À¸Šge0å+÷&|ÂýÀê~sóTšù‡²©ttÔRmñIëëd°9:6+¶@›ÿ䧗%«ŠA~ªÎA ý¨£±bíè0TóYòs¢1…Ðg{Ü™ü_8X—Áx!Öy4´Ê3æmü,qÕ¡Fôž¸Uœ1”=Ê™gÊ™gÆȲüwâEÉw#A¯òøJàú•BþS›•¤ònë®”{w‘?ßW#·TæJZ…å˜>}‡Ñ•ÁJJù‹”ºŠÑäÊj¿¸°[f"u¬x^Ø( HHŠ}Q¡‚ßaŽRz8Œ¶¦µ“;jÇÐ:šÈƒÏó%^%QÓ±¬v˜iŒ¼Æ¤|hÉÊUq”J÷¹ù»Ìã:aẖ²Åà2]½Rô¶°÷\xT;
µ7L4T3FÁ°.ÌkÛ4ä»Ïuä‰qÑÅÓÅŠ ›c´ã¨ˆ“Ÿ¾Ú:‰Á˃NG!òç»EŽfµ4ƒvZi•M–Þc’þÆXÓ"Ã-íêÆáP‡³ÕÌ$’_?Nˆyéå…ÓÕ½mÞ+à„_½‘sãÙ’I%pazÏl›€ÿ¶uçU«
·\Û×Ðbjêìb>U¸)}{QŸNßà—¨ªw%=Ák±äfZ%Åêos[1øÉ]·êñZ¬w¹fsƒ\û¾cx‰¾¾‰ŽµMÌ(}–"Ú\ñ|1wNkõTƒh,.Wèçh7)m|°Íü'gˆ5’S¯ŠJ2ÇM<'sÖ+±UÇR·¬§ëÁµ&I"AkËðÖíƒÜc»Êþª'ºø®¾bÒ^XÛÒV¶ãž‹c&jžüõ«{Aî.5ûÛd @@ -8705,35 +8753,35 @@ o¶d©W<DÐ?§|)"¶úšzœ8…û>r‘ÓÕ$EŠÚÜÍyÆokjÄÀ”*€Ò¤'ñË']Çåú®8šŸªBžß%[Ž1FôõU~zË OêX¡gŠÛm9#Êó2Ôq ÓRLvÏÍŒÆ/Ï7Xy!r8Ë!MÔ4ócKv&½›Ä4á”UO-EyÂTóTâÑÕì}3Þ5ªV¡H·>”œ³"M*œjnøÏ3°ï|Ú÷×’4²{óÝéL¬!àW”¬Pfœ«ÙýFGó¼Õ‰}j™j컓íRÜAñÓ5Ý«rà)vw º'-¢ßGrËpnvÙ1AÛõ ·ºó\<užèÃbð‡ÖhQjÄcñžŠ:DqŽz,|¸>1sNñ&b®]?Mr)smWÅ€ÑûäÌuQØÉ aàùÚîjäßÜš¨SÞ‚{ÈTvø…ùî)x“›”Vˆc†šçùÁüÿÿO -æˆù_Ð@endstream +æˆù_t)ÐJendstream endobj -965 0 obj << +970 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1915 0 R +/Encoding 1922 0 R /FirstChar 35 /LastChar 122 -/Widths 1921 0 R -/BaseFont /IJVGNC+NimbusMonL-BoldObli -/FontDescriptor 963 0 R +/Widths 1928 0 R +/BaseFont /HQMCJX+NimbusMonL-BoldObli +/FontDescriptor 968 0 R >> endobj -963 0 obj << +968 0 obj << /Ascent 624 /CapHeight 552 /Descent -126 -/FontName /IJVGNC+NimbusMonL-BoldObli +/FontName /HQMCJX+NimbusMonL-BoldObli /ItalicAngle -12 /StemV 103 /XHeight 439 /FontBBox [-61 -278 840 871] /Flags 4 /CharSet (/numbersign/hyphen/period/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/r/s/t/u/v/w/y/z) -/FontFile 964 0 R +/FontFile 969 0 R >> endobj -1921 0 obj +1928 0 obj [600 0 0 0 0 0 0 0 0 0 600 600 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 0 600 600 600 600 600 600 0 600 600 ] endobj -956 0 obj << +961 0 obj << /Length1 1630 /Length2 10420 /Length3 532 @@ -8741,67 +8789,85 @@ endobj /Filter /FlateDecode >> stream -xÚíteTœí’-îîNÜ%¸{pw·iÜÝÝÝ݃kp× -äh- -×u”ø¦ñWÉê!r6Y—fü…øÙGRŸ¾yKR‰vUå)0o+Xä - ø`8ï&-Ô§|_wñ˜7¦æ
奿i®™ÀÂÆC6K’kФZqÿ©Üõ-„8ª±Ïë½=Iæ¾xV@f³6Å-ýwËÄÎûñÌq#Eûu$u±ë5Äel&Qül‰x„ù»ƒ#MeȦ’9ázÚð¤Æ¯ëÃÈ E¸½ëâíŸ+óˆ°×CˆØ³Üg¨´ä·[¾Ñ÷pÒ!ìSðŸò“Ø›9"ÐbòMÀ8Õëq]yZsY£4îV¯—…d<¥siáøÞù%Þ«¯ÔˆÝ¤qg'ä·„ãKä´¾ÀGq!»:½mQ!!&ßa?F±1Ž»ÁÞ¥Y†eP.hNø1!/öã÷œ½ð&
‚¸a©7hèÛûŒýóÇÙ‡\š¯+D®ÉÑÐZƒœ0üÓvÄùØEýÉO¼ö~&ÙRm³ŽÊø=q¶qÊ¥¥»5ôÌ”ëb_
¸mÓa…©!RÇ<Ê)¯$KåT¾C’"ú3LºwìóÏ
#uCm…›®££¥b·B_iÊîð¼ ]7‰Œõ•
ðeQ ,®€”]®ì|va!Ø;ýF‰E=ÅÑ8³¬5)Å¢u,
ûÕðì^È ›Âê‡V+ƉC~~UY›¿>%<{ïè—ÒQs…ñpbÈNÖi¿KÚëC/`_IL»/\x7´×´mÂdšØÒeÖίð¸‡^ìë!>ûÙ;æ ê¹MQU,¯ÕêÓÉKQBäg~—šö–S£,QØú¹¸_ìMjŽCçqTlÉJ6È£¾šø (Ü×}Yô*NY&Xìs'«Q·’RïÍnƒa°1³'ù¶¢;\´ý6§eã3Qº7¢RÜ -ã>õû~ -[`Ï—Ì/ù®—o
MyYU‹â¢/ÿ¼Ý›Âœ¢ÝˆÓ[³¶MlÆ -ËšÕ˜±{[½¤-üyª!Ø¥ò6¯Ë,ÝÏ–r‡{ŠÒþŽ•ðRö¢i³4:»ŒNt8¬¼GrØ¿š&¦².ÌP˜ã®—ae‘©Ö’ГÖNTX/ïbmåV¡îé1âûœ9åì¾ú;‘ùÑ[BvÞÄÏdär{,‹&z¨½tEÒ2]A fS0ò}úö4kwçXN!ZÔ¿£I5·›_m—Ákˆìˆ±—|šÓC„8Ìx^]·=´–(LHžI3(ed7iwã—⋪%ú£%wÚS?{drS[nA½G›;õ>Òi´ý'mLG:dŒhfL{¤ÞzÚGÛH,UAw™Ö
PÖê=µàŒ dn¶h˜¥‚Jï
¡ßÜè{ruIîÏžçS?èôQÚØŒjT3§Ïñ¤ŽYΡ¯jã"»t¡EM>í'ÎÄ—·pýèþÉR
?©0 o‹Oï|ς®š!\Õsø” ¶ìOߨùu -/À/„¡œ‹œãWÃ5t/‡…û’ÀÈÍL´ÀhDÔËá磑À÷7 -Ö«LA‘G´D©(aÿ à;ÔAG´Õ JU;_^\‡uç.-©¤î,+»¼Z‘=•¿RæŸÐò…FIجóÔ~ÅÇ›º1“|÷dÈ…¾^¢§ =Ô**sç «n-Ø[”Ú¶Q¶ñ¦D•œ1ÃØu®KÁ¦¿µÜ†y€´Pä†c(âÏnh0(iX²w¬N¸×õ¡ÍI˜û„ùÒ¥Èæbd¶ùq0«s°ö؆¿-ÆN™¦}ümšŒü‡+ÈŽšœ=zàë…qãWÈÅ+¯|jeÅ5ÎtÿwˆŠoµé¼’{„Ùdã
å”=\bHv8†Nt{„¿_å<˜m«3²”K,Í"ëT)(ãú`ÙP¸&«Âo˜«·õ£C·’=øV–ŽŽ‚ä±à Ë1>F,.6¬z&·!^ý‚÷ž·9š/–_Ý‹ROnOs!ºð± -
ÍœçIËýMãèY=±Dˆ* -Xÿ÷Ô&?=b¬;”½î‚™ ¬«zGn£P6í±ÿû±Ù‘,œPýgµƒ6å Åù„
˜:vn‹ -®õgJŒGâÖÜ3ûRÄë,’ Órw¨¾}óã”sᓱx&á=¥Ì\_Îƈ߾lz'¦vC>_ €1Ä8ïÁ'nX«ÄÿÔ_>E듸è3cióú‚"“š¿X.,\Œ:ÚÎä½s¿
‹Šs©h‰74’žÅïM$úÚ”t¹A¬Å‰V%è¼Úï¯àFð¥ìÌšjIp0!{»¢”§îYý2™‡5¥C)›¬ÜgªïvPc,ØÖ1#H¼l€àT3%H°øófØúï{l;¸¼ûüÓ
¿@vt
MrO;¨|¡–Ï즪ègY§ÓùîîÆô[q£¿èÄ"
…W²Èj7ð!¸ÇŸnV¼ð’"ꘕ¤i$| ðæjlF -ÃÚ¶lóE7÷³3™N/,*+¿PC.m.>ÊÖSyüŠô¥–ƒ®v«~@ P2ÝÒfNMTP-OÏ<a-€…>oIBeqì†bHpæÔt‡“ŽÄqj
µ¥u!Œ»MB“†#z«Vk™…ó³;¨b„èC5ãAÆyÝYïØü£D@ìpøÃò¾×{àOÅvcwQŠrøŽ €e·52åeú/ZLé¹ÉË`~>\‚hX"'N¡Ã$wõ¶!•õ[5ièÑsh7â”›Ž›ã¥ä»l—Ý~ú,;>Â|¡bŒ»-挟 B—ík.D¿ÛµËïÅÓ€”ÖWQ”‘]H‰Õ÷gÆPіتïS+ØT
‹§y3ÕúÑ›:u–ù§™Ã×&_¡TT}4ÞÝÛ˜¤¢ÓM2²%Òì½#øE= -;½N -¸»v ½Ê…éÔÔqKoœâ\¶Ý€×Ÿ0 hïóÚR -¨T5=š€áÅ -•½*V^¾º1êrðŒ* -®é/Š)T,¯}«2lÍ,ʽÆÎ[ÙŸMÕ° Ú~(¤ÞQò«Žã¶ÚœuÁ3°QÑ•×46™›œö¬}Ù6tF-„zôôÏ -x0Æà K¾'¯g~y÷ý|Ž°ž¡CCëLFRçÔûCx“U2x’ì¤Ú€òzô8i½‚“ÀÀºP &&åËk剺âi-`JÜ&â,¿Ý¦¯˜Á¦¯z‚+Ý°G…˜Ö¬l†0ÏüÜÖ9oHƒT>vüŠ"nC1Ç=ˆ§XØ„?ýËzñŽ7½Ò!·51ضMcÿekxnºÒº1Èv&ÿ%V¯ŒQ¶Ù¾¡cÑ4~€Úgo¡ =;?§‹c6vÖÂ5NCÞ0è+wµ ý¶NùLCª•û‰r,Ïbj¿ÞÀ×Otm‹yã«÷Q±âm·/SVæK|“D|VïáEV<Q¡)…xú—7'Õ^'å´U6æAÂÉ¡ehSÃQúÙì6p5=‚ÔKÅ´t,ý‰>
¯-¢A–×pE¸6¥]“¼á£Êh3–©pD’&ä£Ä
É
+k«ût‹2üWŽÜª|nÈ<~'>m8MUš™Ö²Z†>?nÆšfcBeµvG5?ÛbêÀ:' ñ”"en<Ma f'2$ûÌ]R_I¬‹ÃXż #—ˆd}lu>ërv×Mq(‘¦aíÅýv&…æäüá —<šµWˆ¼üe®vz{óü·ÄÜÓòŽ¦G§IDÃ"b_ÖÍ%ËŒ‚²¢êx‡Ê^‘$Û„ù…üÆy
uÁéQ_p$@ÖU/Èãˆ(w¡id-êl¡å¾kT -K§4xÈÔP¶—ÛÛ‰Õ[û‹ÕÇo›_¶¤uÃwü`@Àr4ýÃ¥Šùâu.Çc^ʈ~¢{ªŽËûb²OÁw}ñx×—`c™ãø?$?q;a—C¸GKÁCÐJ&Ÿò"t¸§'¥=€gh¥Þ¹êýs§H½Q”þ¯ÙN0ViT®I‚ÀRÜ#Š,šõ@¯»Ï„S; —nÑ´„(ÁPþ±Óí'ó±÷t—¢ç©¤ç‹ûø?0õK*`ÁÎöÄË’&8¡ßçöìd„ÌV }¼·Õ0£¢²Ü}çŽ 3ѬÅ@‘Òµ13LëÃAÏNÓó.WN8™œ `c¥ý -üm££O<+„ºlMË´p~Mý™[ñ©ø·hÊW·N–&9_ 9øÂåÖ ÒgÙ0ª¸Lt»ÈéX+sÿõ„&ûI*ofʸèÊ
/ŒÀÐÀƒÔ[ü"¤}.¸ûæ¥c‘çäß>3D|åOVη}ðî -(ª4rQ¹!Yzˆ‘Yù_‡u¼‡Ó´Q½Þˆ®¸ËÛÌ« -|ø2C¸Yƒ~Y¤¬BþLŽË¬ðLÕûvè÷Í ³˜U@âçÖ¾”5Ù¹~ÜCåýŽœ—®‘ë†<…¡ÚÉ¡È„¿;÷Un¹ù¼‡ ã
à™9 ZTêS½D,f¥‘j@xqÒ–iEÐ+ž²J>`ýáìÃÕ´Eñϼœ#ÄñN%€õÐ7 -l^¹C8I‘èe«3ÅA¤Ã¯ðÿØòk¾Z¬nk¢ªh±¡FÃ]ðÙ›·²îtxrJ¼‰Ù¿bo
-d©‘¯l};¥ZòM«yŽÏ‚ÐÛe´Æ;Î÷kßíªêÂ×¢èCsú?êÂr؇VÚýV.K“.ÅÍ"ûUg§ ™áön~ vµ2Ävgè"àÃ\ôAm»)Zÿh”RøÉR¼.|y÷¹'"ˆ*&–ç>™#xr§cm¦Æö0žœn³‘=ǤslF&~k2E«jlþ¬ Ƈf„ÃLbJ&ÆRXc6¦KnÄÎäÖ¹˜O"êûðΕ¦#{äÚª|^3ŨÊ;è44Âr1f5)·g¼_
ì(1%Õ -rÒŽ½wÂø’>;Slêô‰‘5s¼uÖ²Å#&ëA¬!ø5çÈÔúÉÂbªªF%.ïîÐ{ãRU©ÉàëNyÐÒ6½/ÚÓNEg“É·Û¯êÏò¼hžNº–Ž¡]Șùj©<}crÑ¥d!]ìÜÎò>þ
ÞÄ ÷{€m6"ûªùø@P¡S†¸s}'V%ó.£zùˆí]¡I^(ÛùÌ6…–¯ƒÑ|4âsæþ>êYÈ-Ï:´¢Ù2åÁÅs(×±@¢
=}Åæ—U·n6ÈBC¯>Ç!Âû@u=å<²—1i=íÉú=ƒ-¨òZ—ÅM Â4÷–@tõJæv‘q½ãû´yç¾vr«Ï„¾VnEø„}j*7Si‹{=‹Áï£!æXàý1±J ='»Ê`W¸îÌÒìì;ïD}Âv-wŒ$ØM0½(ðö¨ÍéM$ÀzCç§ 3ß3XôåB£ -°œâ‘1é#V~Ö¤›½hBñ
åùjtw“bsYŸ´5 ¬˜ºÿ“,W²ýÖ»X,+'z7ÂàOe~a.!dÊ«+¼˜å¡ñÊVóÎçõîú…*>3 þ»m'¯¼ŽpFTYDº9HÁ†“lPËÁsà–Žý„Ä&ä’ÍåìƒÔ„¶“MÊBW{a -œây[ƒËu¦YÚr!ƒô$l³Øa£.†þÌGƒaW]èPj©"!w¦k?…Bm$¯œ:#ϯ˜R¡~+Oø0¹`5ÌP(ÅÍé=vÛ
„ú"þÀ‘—Ñî1+…¸Ý¸&ߘ óÚ*-‰Š ”8ÕÐYNÒcŸ˜¾üJìsMQj[F¸‹kzéú¸ä(ŽÀK¹öëÎá½gnä@@m35N-Í˨d²äí«hV]¨Áà^ƒì÷¾Þ uŸ÷ÚÖ¦k‰-¾·UÉ[~¡‰è%?Ôé·SrJvı}Ñ™¾Ä=3¯rêÅÀØ›uYoaQ•L}F¡©›§ü¡à:Ežir¢,sÊÜ[<z˜¦öÚwR–o'«èC=Rp3s*£_Ë•Fª!Ñ ŒLïЋ˜¦)§í>¸©¿ÄG€ÇàðÿÀï>Â6SGÄT¤®I;@|&ÞHJstÊk=Lig¤5è‰,þm!7ÿîág=ò"Œ -<uHîPe£C³PÍ2EíäÁ|ËMó«QX³g9(bçŠvà‹÷µ/’TÂèó¹ÂûàEÔ’÷¼¡¿J£ºV]CG ;f¥/ÁàL÷mˆª©’’ùê#°ð¯¸1¹C‚U=è3TnÌó´sS_vçahîÖ5ImŒ=_²ž‘•9–ãÆ›Öo!|>i÷.T+=a9?wô²ÅùÄ˺éN¡¼‡Q²¡\Ýq.¿³lߣ¯ÚÌMú‘á£óäPêç@lʼnT -¨JUŠÆ•ý¿Ñu3·àp G„‡ùbÃéÏÝDŒ%çwì´¯ïª9áÌ ó5SsÕþ†ˆKë†Üœ¼e}Vô™¡)‹$?·,V§¨$Uã½cNùÕTD ½³#éˆF»œ±´Å(EB‰w%È
{|(¬3-I™¢m8W‘r…XÍe«àÞVLL¥Q.*Gõt¹IÚ¯±™^_Ø“’ÚÖÈûR˜Sö «îÒžÿk./·9Ï•ÅyÊo •ÓwÉ×°ïJwYâ‘ϱî¸6eÉÑœEɈeósS}¯E±X8‚ÕË#¤y㼟KuEüì£!o´öUöä”óÏéŽÃZX©¨,M|eÍóÉÝ)ƒ^»D¥?OÜ]De×a$p*£<Ôu¸-‡•²·HÈÁÉ'.
JØ QíH2³&šÞ–é{IênÊf›êòËŽêõ0]\³Ç¸,Y|egσÜÍ–Ø,’ä¥à¦¥\ÂO°ÌA%hP
ŽmÀÙ3Y'Ä]ÄhÌýð±ÕÞì²›ODPxþõnº”å“]ç7CåÎm gªô÷ËÜÆu“óm‚5 :ª4kíusD󰈪KÀs¢'·»^Rå”XÄ
)>M“£<Áp©E^ˆž+vxE$¶ÆöÕ¸œ eMÁ$ ÷Š¡|¨•ùìü–îøÈp¹[䢧ªT«-ĺ ô{~Êfª~ý
WÑ8æôQT“yi¬W%>ùàw—3+¶ë‡IÕæŒ}'Î
'>š! ^ËÉ´¯ƒT%¼àn=0Z€ÞOi°nŠŒƒÔ'ó'~ -\´)(ät‹hß÷çuÌîÈÕyêáTÅD_.àÞM`¦_}\_i¥ê#k?×ziÓÍà‰Á¼zñ)90¥7€•ØIgx¶}/b -(Ñ-ì@¹ÀËq²<Þl™xüú0·¨gOyP} Å¥\’`ÀxªÃÆ°6‹9)ü<»^íéîä>ƒ@1è¥ôk5 ê¥5a*ìH¹4}YÕ #|ÿ§¦}ý68w…Ëj*6Ã㸟QmŽECÁ¬œ“§ÄƒOoül“³æoC’rR>s”Ù°ký“Xâ²Tþ--i»ê‘7`ù`/N…›'¶1 h<þS°=xÇ4î×ÚT¡ëÛÇÍs=@· 1~_¶ý)î;ÎnoŸ*CHÖÏÄÒú`^¨VY©êKŒ·€’ÃN±ÍÉÿ£†-$Û:5š›B§>™ÌwÍ? -qÒ¸#q¹àÞMn¢¾ƒÂ†ÇUÛòAö5 îQ¤±£-•²x^€’ÙtÉ¥óçw¸_Ü ý‡ýZ;Ô4ò#qó)ùtƒ/UåÐnp©á„Ͷ5ž‚B²W ÎQÝNk›‹v<§sïU'¦J*"Ñx«xóoŽú¡…ÁÇ••×ÕqƧÇãç‘œ^¬³“RöéEhæå)ôd6ºØ¦Nr?â¿®¼Ä½`„ˆÇÐS#£‹c†MéáßÞÀ>RÝNf¹h}ù)æ_Èt€½ +xÚíteTœí’-î\›à.Á݃»»5ÐHãîîîî Hð Á=¸[p· Á!—|ßœ9³Î_3ç×]·×z{½Oíª]UÏ®·¨È•Õ˜DÍíMRö`&6fV>€"ÈÎÔÕYÁ,Ϥ +´tU2µÞ + nïàé²´rÐj¨jÑ100þÓòÇ`êùä-Òd P¿½¸míì€`—7Šÿq p±,@¶@€¸’²ŽŒâG +À¦¼u@ó3K¯ÇéÀh„Àª+>>¡N>¼»¥é躄íÙ%bÈ‹G¤âwƒA¥ŽpÌ#ÖÕ¨òŽdØú²Gד”Ïe‚eq.õ‚;˜1WY b§¡~Ååבç“#Ç
]–Ú©z€Pfø+ק=_ô:ªÖ«›ªÀ›Øûg³-÷!ƒÈÞD…‚dÅ‚0'´oúo¥í¼_¹MP¿^²_,+]Úw¢
ñw$*’žðˆäT\'¸€ï¾rpg\nSYÍÓÀê&Y
†|‰¶úAsÓ{ÜO½e¿ÿC˳N +w<“8þ«$µ`YëÌKS¾¼¬#ɯ?¼$(EÚ+rå™6åÍsø¼1œ¶gkSówWÝgŒ¨xBxènªF°Þa‹"›…&ÊÖiP.ºýT
jÿLù¥Ëóƒ0qÆžX¦Fƒù-Ý®EOBÛ‰Ýp<拘!Œ‚Ý*’»èõ +âÂ;F¼,ñ8„™»ý#?
%ÈÆâi¡Zš°Ä/=ž«ýÈ 9¸ë¢FŸ‹3ˆ°×}ˆï&¹ÎPiÈn7|¢îõᤂÙÆà¿æÞÿn!¶2u@ Áäq¬Õå¼ò°âšZ¡0êP«•ée8 +¡undßmˆ˜Êƒ÷ì*1ds©ßÙ +úÎcû:®Îò’_È,oš—‹†ÊáµÚ
†’¯
㬱uci”bé— ˜üøŸ›Zýy7{_7¬h fPâêûñ!}ïüqò¡‡zy‘Ð?) +š^s·œæ‚oÜÜ–(ò]awÒOº/„q–d³ø¤ƒ^gÏc¬M¬RIÉv•:Ūè²>—Mj +Ñ(mƒnU\ÛRèúÐÚ¾¥òa¢àŸËÊ+3×g!¤½g +vg™^}ÊI“c°2fJ:ºø ³q¤Ÿ¾‘
¶ÈÏ”EX/óëÅCd[P«å%3Þ\Q»‚¢¿ø4cƽdäŲub;ç¡C(–=6gØØY¿3¡*Y—/t¹G©c\ÖèBT·öÁ!$jD!aO×â+W´Û'ÝL@É5[í¿uÖk`>7J24ÌÈ`¨&©¹ØrÙ•>ËФ[i —[.§T±7”?å6Îåw‹d—hÒ»5‘8£F9¡\®ZžÍ.Œ¿¾'çµgÂùµ€NSÛ©mÄiò¬]¯¼ …k +ª²–}¡5¿Ý®[dÆQiŸð6Y>&nÜ©ëÁvÿP‡¿ kfeRÌ…žƒ
í®bÑðdå +Éü’¾{[9¯%ô}¬.ÈùÓm8,n–iš5®
Å×:…ÝÁ¥Ì3Dýz)hprð°_i‡ø< {)UTyUˆÑ¿ +0ÍU+ÍÂ,]©)®+÷¬• ¿ZÖÎÒÄ¥LÕÙ*mÈû=cÌÉméwÓ£k‡¸ÌŒ±¯ñÀåæP +!ZõfUú0®U¾¶]ÖuøsFÁ„zÕÁ‡§3Ê?üÍ8"·ã%‡€ öU·ò%÷ÓYÕžCIe€o0}'û¯ºkèoìænóü7Qüƒá‘/‡ß>Ü€´ýiëæ +Z`îwÇèaù©C(#!6ÕÜ^U|î³Ö¿ºâˉ„æ#ÕJâ8~ÿt‡Õ²3bäwxoŠè2NŠz:§Ä_„aIë©bôzzpYèûa]åõ·»Ž‹HùÌòu–Bß¹ÊgQO/M‘³\e?¢%HVA ÁøU‰ß£ö: -(VlM½¸ôëL_ZPJÞY|j÷lBöPZ¦È;¡á "‰·^å®^Ɔǻ0•xÿdÀ‰¶Z¬+/Õ×""}ç«n*†Ø“Ü´V²†ñ¢@•˜0ÅØví¯J~Gwk± ó +SNënOs Úñ° +LfHËüLbéX<°„ Ëï¤G gX~ƒéšRIH®ìÅùõf`êàèͯ
¡\`©³òáGïËnlt׉Ï1 ©cI:õôÅó±µÁòtuÚ_8˜…Ÿ¨ƒÓíœ:ÞMr´«1,9Dß!#f»7bnŒï¿Üê‰j-hÁ…‡õqÎÐraO× sáÊÅÕ䀊J55ã[ëTeêû!·"ÝöîMãÈëÃÃ]?]©nôÇåÎ¥òQ*êðgÜøé·ì½íÅä{‘2žB9T+k/ùeèF{sôü™Öíæ1a1>ÄyKëåÍÊ‚*—¦hÆA½¿Ü•ò›ñXï¡yYÉÐÏý¶ÝDci~.í9§ÂÜÈ4ºSá²ü ø˜@ÙêóñðEÙ¸Ô +_áŽq\i!{{Ÿgúë(ŒÉÖ.Ó縫xÑă¹˜”[ï8´}²ï®ßŠîﵛNj¦[ƒá- œ P†ðKWIhO.ÚÛ`SF6/B›@W5Ÿ½J×h
‹ÑIŸÊ`½{`ìS‡ªÜø€‘N_Öª3f¼HŽ|ÈY,™µ|é¸ûÞ.×cƒiÚÏ*{-Šòók05lô\æþn§¥¥†<d¦T´l”d)íÌ?;8 ÊÙ.PœŽ‘¯¯™ê7Ô¯ Ù$bÚI)ÈçÝ{¼4qÍ}ïé°qýØ=]Z¯¿>®„4Ðm"9¬Äù÷lrB.1YaWjŽ3`PzyéZ…YƒcW´qLí-=}Üš¦toØÙzM‡ÖwVØÌ©—œû¼^_™!Ä`>DÔÍÎUèSõ’Ë¡ˆ,š¬î‡ÛÜ9d™‡„QÛÁÍÅc\ú„!Lq~%o.ØáÜèϲ¢€=…³wì+°L…7‰|Ø–'Ë·õ'ï›1¾J5«£Ü’zéuo~ºƒkúوힰ1ýÌ6þ:‰d+À¸ÐQªmYÿ<æTðd$–ApOK!½—ÈÛˆ½6໧ ›Ö†©U—ÇÛJ`6Ê}ðŽí×,ö;õÓOÖü*&òÌJÒ°:«À¨ê'šƒË‰†¶5zïÔm
ǬìT"Rì$‹kþ{‰®:9M¶UÀ=knk¤I:·z÷U\GïÍàÖ¨˜•QU)î"`kF”ôÐ9«] u·¢°ï.a•‘ýN¹k5ÄüÎ*z +4$®'7b•¨«rsžÀÄ(6 —@ÊÒÃjIPòý®}nÜ`ûaãÝmáîã#_Ùëç…t1:ò&mþP˜þ8±%"ž
Œ~zü*÷6“šå]ÒCtÞÞ,艮¥’1ÚS3N¥¥åÆ®ýh&t„Ëz,ÊÞ+2Za#|»ä
Z3%†•M5ØzJ'ç»=©ö7XT>Áºš$<”;Dz¸>e©KM{&½@ +f&·PE ÐûªúõrË;2ß³åûE +ƒØàðúå|®õwÀ_‹l‡î"dñâ³J®+¤JtSôšŒi9I`l>^ü(XoBGÁÏýÄwµ6ÁŸj7ªRÑ£¦ÑnÄ(ÖÖ‡Kȶ!Y/;|õ˜·¼…xCöE¶Í¾óC…,ØU]ìÚ6ÉíÄQƒW—PJI/$Ek»3¢)iŠmÔö¨ä+z‹Ä’¼«ýà‡ÈLì ÛJ}‡SÍàˆ„€« +¢T ç˜Òqè)O¡(CNt¨Ö !—Ë~ÚûbÇc<v¶¦}7í$Õ¬MuI¡
±9ű^;K0š$3oÖ(ÛØ7C¯y[ò‰8š}Û=ÃÔ² ªÂ<Œ¯ŸHqrñŠñ×Å™öÍlnÙæØÊ5~¦²°@nš6G<êÔ6TœG‹§ÂœrE
ÂO‚¢d.ƆQúkVØv¹4™FY8ó1]Jñ>tß“&Y¿6?5,ì“Ò{AWÞж¬ÑÁ¼½…KÑÛpÁv$‚ìL3•w¤¢˜t$ï‚«Ö4Awã ³ks+V}E\»VMØWò>¨;$w‘-úu¤¨Ö.Ûój
Ø +LµSrv°m9K
–Ï‘p +Í›²]p,V.àò‰ùU9MÒ¤4øÏëõÁ¢§×iO +ÂmÐ<v8Û¥?EZd™àk{Ä÷„hIÇ“u+ß²r÷(Á˜Ÿ©Ë/B–¸6‰Ú-Êâsj1dúm‰ñtY!¤ÉnßóÚs¶à"}”¶°‘Gˆ‡ +±”‘YÄë†]:O5"!«Ý…Xü[/:q—²et +sJ„ Ø+ªAF ¬Ô
ðlB„îj>aÖ?ÓJÓo/ZçsµoA{– ÑΪªá”Ü8ÙÇ:oº¯¿bâÓÜç6§ôäSªh¸×Êä>}S¶ôôщVû˜kXžMwQD®lqíS‘ncj^æ9tÞôÈöl ŠÑ| ŸrGÁ§2ŒÓd}ÖOÏ&HI{TTõ¥ÞÌÿ´sejS_À µ +q¬KÚGéyÂÕñ•gÑ&,Rà%ŒÉ[‰ê’òëW–öhç¤ù®¸Tx]‘¹}O¼Ù›±ë+42¬d4
¼n†ê'£Cd4·5¾Û`jÃ:' +r— e¬=b f%ÐÇ{O_Rõ_ˆã¯ŠÁXF¿ #g~nr:kwrÓI¶/–¢fù†óãLÍÑ)èãþ7²(–oò@ä…©éêñÍõóßâÓóŒ/È[îmÆáusˆ]™Ô—ÌòJ +*ÃÊ;…¬#‚frkçUTù§G]A]´Š +´ˆä×ZñÌO¶„*þaE‰&åó,¸JÊy€Õ‡³WãæE?s³‡ÛV}? +álå5Ò]ßÏÌÃ.ÕAÛa÷]øœn&…Þ¯n1A뾂‚¾Zˆ€W….ï¾w†ç +!éúŒûâ£þ.RTQ¥œŒ¤u罞†÷Ö«]BDÕçì:/í•,±ð†ZKp^Õ92•^’¨ŠŠa±3ùû;ôo±)*” ¤ð5 +§Üèñ©ë^ˆ-©§"“Id›-Wµg¹žHûÔO'íHóñÇÐΤL¼Õ”>Ñ9è’2ÇV.=¶®g¹ß¿ÿ† +«ç€ûÝúJžuU…|¼/ ß&MÔ¶ºÃ£œq—^¹„|Äú¾À87„žõ|b“\Ó“ÇÞp& +ñ9coõ,ø–{•[JÁô +™bÿ⣔ËP +û„F$X5z™£®æt"ñE}Ô´çKQõ +…¼L™¤]RVÄ°¢jº|O2œIvïc°ì-ñé\ ‚¾–ú†:“*--òèc–…Ä=(YÎ8׺é({O€ºï6å=s[ÃPei§!êN²ÜCˆñ-zÏ݃[÷âê‘‹×?–±õRØŒÖ+ ^턪Ësˆånô.Ô˜djÉ÷Ò³N¾›
t6(÷c:ê
½josG‡RM¾k3Yù)b-qåØq~ÅÈŸì +ÇTÁ¸Ñ¼53ý%È%à^1”U#3žÝ€?Òü/·½‚uåC+`µYÖ¾‚ýOYŒ•¯¿áÊ¿9~ÑàešjÅQŽKÚÿÝîÄÂøÎåã¨JCúž#Çš#>/uŸ8Åhêrx/e1¸CŒæ¯Ûç]¤“,m/ùÕì‰m +ùÝ<ÊçÃyk
9“²{e®Z˜¸=eáÔÜûÌ´«Ï«‹M”]¤-çš/Í:éÜј·/ÞÅû&tú°â[iôσ„õ¡&ÁE˜a1Є÷×eág‰|&ï<d¯ìGö‘*-x}Ãïò•¢ŠÝ‰·×£èIí¾b#ÿ=%šB'wn,_ñœWUÐË/k*öÉb¯Ñ¹ãò2´]¾¤xØš¿÷1Câ“$¥E +?¹ØÄbTMzY‰‹åLcàß>:ÐÔÇ©àSÐ%Zˆœ_EŽ;øè÷c'xë†@ppjÌ}&übÊ륡´¢½¸éuþ\—–¶B唾(]ö 'l<ÿº“ù9/^sý²DÞU&7¥g°·˜½\4Ý8i<XîóE#
ù^G‹Om1v[]‹/áõiÜ|ÃIª‰;A\C³˜¤©H5¬ŒëÆ +;w’oÞ Y<ê¨ ¼01b‚à‰PÅðJÊìò*¢‹Û`º§|¸Sý¸‰–ôéZüEkxv +ZQ.p³-Ž×G—¦çtí(ök¢ö%9•ŠãõNµY9ýW&‘ G…ž'Wk¢<ܼÝ&È{=-ùW¼4Å…)•¤-¨8b„íýÔ°«Ýçl£pZŽÅ¤»w3¨N3«Ë›–qp»“á +ðÿ€wÒøm@\FÂk†2zM¯wCTú‘Ò¯±1u[]-â,äÉ!óÄ:$mŽËw +¶o™ÄþZ™B¼¾}ìÑ8×dr‰âöhZžbw±·¿u©ÐgþLh$©Mæ†h––¨œ1G{ñ+ÚoYŸìó=zcØ@²NÑâ«R7Z@8vIg¼o8 +ýmgq Ü©¡c.±*£µNJk÷Õ’+Ê&ø›ðÉÕÞ®s†kNŒi»@[F¯[qwL +‚ ?}º®Œ5:=>àðd™D•´kM+D3+K¦#µÖyWnâ(;{·¼øû‚ê/MG…Œ.†:J¨‹w{ûHy;šé¬9õSÔ¯€qÿÝ,´˜EÆËg®Ft~óžã N ÉŠ E{Âàœwž£c)”u›3È«½ô9ÔáAiPß~déjùþ0Ø|Æe^EK>ȲÉn Äžþ.Ó¨5dz¤ä2ìBí2¤t߈*˜s%~.ô8Aã9½èpcjüüî= +¢×Ó¬7!K߆ÏË-—êdÖã<¥° +¹1ÌImO:U›Ýó5I«Øe³®8dü‚ YÕ\^ñ!.^&’2Á endobj -957 0 obj << +962 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1915 0 R +/Encoding 1922 0 R /FirstChar 34 /LastChar 122 -/Widths 1922 0 R -/BaseFont /BYOQTK+NimbusMonL-ReguObli -/FontDescriptor 955 0 R +/Widths 1929 0 R +/BaseFont /YUEJBL+NimbusMonL-ReguObli +/FontDescriptor 960 0 R >> endobj -955 0 obj << +960 0 obj << /Ascent 625 /CapHeight 557 /Descent -147 -/FontName /BYOQTK+NimbusMonL-ReguObli +/FontName /YUEJBL+NimbusMonL-ReguObli /ItalicAngle -12 /StemV 43 /XHeight 426 /FontBBox [-61 -237 774 811] /Flags 4 /CharSet (/quotedbl/numbersign/parenleft/parenright/plus/hyphen/period/colon/B/C/D/F/N/O/R/T/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z) -/FontFile 956 0 R +/FontFile 961 0 R >> endobj -1922 0 obj +1929 0 obj [600 600 0 0 0 0 600 600 0 600 0 600 600 0 0 0 0 0 0 0 0 0 0 0 600 0 0 0 0 0 0 0 600 600 600 0 600 0 0 0 0 0 0 0 600 600 0 0 600 0 600 0 0 0 0 0 0 600 0 600 0 0 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 ] endobj -879 0 obj << +884 0 obj << /Length1 1606 /Length2 16237 /Length3 532 @@ -8811,7 +8877,7 @@ endobj stream xÚ¬¶ct§_Ó%œ¤cÛøŶmÛ¶mÛ¶Ží¤£N:¶mÛvòöÿ¾gæ™u¿óiæùpuª:»vÕ®sÖ!%TP¦4±72³·s¡e¤càÈYÚ¹:ËÚÛÉÐ ÙÛ˜ -"bÿæébaèòOngË¿n€½ÙßH{c×Jú—ï/Ì_¯‹¡¥3ÀÅÔÃåŸ\F¦ +"bÿæébaèòOngË¿n€½ÙßH{c×Jú—ï/Ì_¯‹¡¥3ÀÅÔÃåŸ\F¦ IŒ‡1† í:Œ}V T§:jâV6ðë>z1ZVª=àšì™ÓvÓFÑÐ54½ú!§¶å9A6P0ð®+MG¼bê¢Y‘ßçGaƒæ¶ËVc3çY?â!_¸Ù
þZk @@ -8862,35 +8928,35 @@ Rs2$Ñ%º‹ë!nß%BÛ»C)uv÷'\ó&6Éu¨ë=Ôä:Æ k‡z½ÌèœýU9S/ƒœþÀϨŠïw1~µ0D6Y+e»øݼF‚z— y#K×2ª®q1g¬›“‘-öæÙú݃ÓIÝFÍ×½Mx°<?ÑgýÆkµB-ÝNlr¥A¤M/šÅƒ¾Iµä;5÷£,Ø¿W‰`ˆiÈäLJ©x’ ʪѾÓF/Gc à"Ç»_¹,Ó¯+¢¸&lwsä`“ïS&®ÖyGpˆ$9>O cׇK2ºëAÆö¹Ì,b
šO)Ù˜•äªŽÛ–Üå×ïLlˆ¨¯Ø: :^fËër¡ó5‘ª‹ê(foC;a'¥'Ô'pq84«Åq†‚iµ‡„ ¤¬™·yæN¡ÒÍ=Ñxhwí‡Ð¦-LêÅoR„µ ”3'ÅžŽ7vF£¼êb•r1uºÄ…›Ùaml³§W·áFIöõ»_ìß±#EÂp¯Î\R8úrî ,¸©n²o‰¨¡2V;ëÃrÁÿßþî[gƶé¾ï—OžBË&í)Ü\ù#ûÌÿ7õ|®æov·E|’ïÙ}…I%\ÜrŸø¥
7K¢ì´v,_Zµ¢e¥ÐŠÒyÛÕíŽ%_ÿœ÷ãyìÍ2#íO¯Ö8_^{ñšÃÿ9ÊçC'±2]ØÓÔyÕáùÍ)Óç©X÷\â~¡æô}Ù’—§Ëøby³Äó{K9ì™ül“íÙtß9³äí2Ë~ŸÏMÖYYzࢄ°TƒÎŸ8ë6‰B9ûdIF†Æ{úáª:OãÊ.,|©–u‰•Énãk“9u³3zX&jîû7WD‹ý î9“fGÝÏòTNo½ª÷À’Ñž3(È'Pôè§b/©ˆóy§?nIËy¶ÚH©îš©ÖšÖæ-×¾$êMS|á*¹áö±k¬«¼+§Yå–óŸ}˜á·ÓÂ;œ¬ëönüÍ¢°iòüêÕþ™6íŸLÂ6/èžµý±æc‰][K8–¾‰KQùiš¾ZnrKb]Ÿ:ß˃ü—ü¬²´o\glV“Üèãë]šwó¹KÿM“?
ÌÉ{EÝf3Ë…¼×Q©‘éÏÙ¼‚ýCÒR¥Èk_g-äM·´ÊQüµõöf -רÀäœÔÄ¢’üÜÄ¢l. +רÀäœÔÄ¢’üÜÄ¢l. endobj -880 0 obj << +885 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1915 0 R +/Encoding 1922 0 R /FirstChar 34 /LastChar 125 -/Widths 1923 0 R -/BaseFont /UFWDEX+NimbusMonL-Bold -/FontDescriptor 878 0 R +/Widths 1930 0 R +/BaseFont /FEMKID+NimbusMonL-Bold +/FontDescriptor 883 0 R >> endobj -878 0 obj << +883 0 obj << /Ascent 624 /CapHeight 552 /Descent -126 -/FontName /UFWDEX+NimbusMonL-Bold +/FontName /FEMKID+NimbusMonL-Bold /ItalicAngle 0 /StemV 101 /XHeight 439 /FontBBox [-43 -278 681 871] /Flags 4 /CharSet (/quotedbl/numbersign/plus/hyphen/period/slash/zero/one/two/three/five/six/seven/eight/semicolon/equal/A/B/D/E/F/G/H/K/M/N/O/R/S/T/W/Z/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright) -/FontFile 879 0 R +/FontFile 884 0 R >> endobj -1923 0 obj +1930 0 obj [600 600 0 0 0 0 0 0 0 600 0 600 600 600 600 600 600 600 0 600 600 600 600 0 0 600 0 600 0 0 0 600 600 0 600 600 600 600 600 0 0 600 0 600 600 600 0 0 600 600 600 0 0 600 0 0 600 600 0 600 0 0 0 600 600 600 600 600 600 600 600 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 ] endobj -873 0 obj << +878 0 obj << /Length1 1620 /Length2 20127 /Length3 532 @@ -8898,7 +8964,7 @@ endobj /Filter /FlateDecode >> stream -xÚ¬ºct¤]·.Ûv*I§cul'[£b§bÛ¶mÛ¶Ží¤cwý¼ï·÷>cŸóëœý£jÜk^s^×Zë5FQ’)ª0›Ø%ìlA,ŒÌ< +xÚ¬ºct¤]·.Ûv*I§cul'[£b§bÛ¶mÛ¶Ží¤cwý¼ï·÷>cŸóëœý£jÜk^s^×Zë5FQ’)ª0›Ø%ìlA,ŒÌ< o(:¨Ñ_‚ä¤ñOFuØI)Q’¬¥®‰Í:T\+kÀ2ñ´Ò(ÏË2+Ô»Ð]é¾çAM¾×Q?A"tto¯$ÏÊAœÇÛwÎB¼ã¢ü1lþUxq¨eÝÒäöt¼d"$ÀÇŒ‡™M ,tEÃ2g§ö“0ACª•ƒÇ“IyàbLżê|c )/úh½0HéZ=`|K›@?ôî3Ob¨cËL<Bß1d÷h•ß$™§”±ù¡î]C¶Y™GOýú!‰ëŠ.=÷«Ý¹½.oÇ°,½ƒšt¯”3sƒÆÖ®·qbé§0ŠÅ°ÈDY~–iÃøu(Ò˾‰ªæ³?ž
cŠÔbdS7sYð§>ádÍíìÉQûcz‹þú7¾cèü¹$ Æ>2Í%—¹ß°%F >@í£dJî'¾T¨WÝ–
’ÆÑë«úþ®@Zl—,P* ï™7o6x©bäÀ×ZëíùOרc ‰^à°HY¹ê¶]¼„qGÝx-
$v·úyüJŠÑ‹lüwÝ„ze|5lÇ¢‰Û&^^Y†¯d¤å¸=眫Ø'ZðþžQ.,°#p¯ü°Éøù¨~j‡|i¯ÖÍ_)¢é<-ëqHb_Ò»S3‚4~«Ò/²Jú @@ -8980,137 +9046,153 @@ JÎtŒa½µ~öB¿çn
8b¦”W»VŽn$èÍñ)4Üê¤÷VûËÌŒ;µ•èN ‰R£ËÐŪ§ýÿ×>Y¶5(QD‰!%Ý åUÔwUMõ»gÕ"& C•Á&ûA×"4ÂÌ]iÅÎ|,›ž(mÍ…pêÖ.‰ý³oRŽÕ]¸kŽ¬¢PÖ¡ZÛZŒŽT2Ê©‚pC¯–dô.Rn®f™7£žØærðk®–-!OõŽž1t¿9~‚ó–‰æ·q¼mxYæó”9gK’}ÃÜÕè×å HéÏAf™\pCÊˬM‚._óBâÚjq
À¶]qL÷‡Âa¯¡n—ˆ›´¢('â¥&Cvpñf–¿‡OFÙ2ö # ð:øF(‰¥YäsäLèÆùxÂJßÓ%ÌgæÂîˆñe:‡¯#0®ÿëÊ»3¯‡óíLM¤\“wŒgßRkHäŽÅ_KØwÓªÂìni–ŠØ±
¨wŠlNþjsßÑ8v<o¸ÞâÖ²ãU8^ë|Wš -ÆúÁÿ%ž†ëÿ öÿÿsK¨«»³#ÔÕûÿ +ÆúÁÿ%ž†ëÿ öÿÿsK¨«»³#ÔÕûÿ endobj -874 0 obj << +879 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1915 0 R +/Encoding 1922 0 R /FirstChar 2 /LastChar 151 -/Widths 1924 0 R -/BaseFont /HMLXEY+URWPalladioL-Ital -/FontDescriptor 872 0 R +/Widths 1931 0 R +/BaseFont /XEGCHP+URWPalladioL-Ital +/FontDescriptor 877 0 R >> endobj -872 0 obj << +877 0 obj << /Ascent 722 /CapHeight 693 /Descent -261 -/FontName /HMLXEY+URWPalladioL-Ital +/FontName /XEGCHP+URWPalladioL-Ital /ItalicAngle -9.5 /StemV 78 /XHeight 482 /FontBBox [-170 -305 1010 941] /Flags 4 /CharSet (/fi/fl/parenleft/parenright/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/a/b/c/d/e/f/g/h/i/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/emdash) -/FontFile 873 0 R +/FontFile 878 0 R >> endobj -1924 0 obj +1931 0 obj [528 545 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 333 333 0 0 250 333 250 296 500 500 500 500 500 500 500 500 500 500 250 0 0 0 0 0 0 722 611 667 778 611 556 722 778 333 0 667 556 944 778 778 611 778 667 556 611 778 722 944 722 667 667 0 0 0 0 0 0 444 463 407 500 389 278 500 500 278 0 444 278 778 556 444 500 463 389 389 333 556 500 722 500 500 444 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1000 ] endobj -857 0 obj << +862 0 obj << /Length1 1612 -/Length2 18467 +/Length2 18760 /Length3 532 -/Length 19384 -/Filter /FlateDecode ->> -stream -xÚ¬´cx¦ÝÖ%Û¬ø +¶mÛöÛFŶTl;Û¶UÛÉ©wïîþúڧϟ>ßûºî51æ˜s̵ȉUè„Líâöv.tLôŒÜ -Î#óãJB'‹'EÂ2^ÈÓùú3p’é±m‡–^ù;Ðëw¨ë ÜìB0à’»¢€ÌFÈVóçC'EÅ]Ë“&Km,wy*qLm±ãÛÈøÒtv8o _V´~hç+2œn£Ýáxþó‰¿Ó¤õ›Î¸õË0¸’¨9\oW&ÎçxL#¼#‘Rd´«%1î‚øå|q‘?iÔl7Ú28ó±óðIpãYÑí aFR»_$ç³¢d’_Jþ껊¤ª›zÊ+Ñ#j»i ->„*ÝÓçuÈö0Îftð¤†1%z†SdÑwÒ½9êçkV’™Ú
ÇÈ)¢£Ý™¬‡¸yœû¯O.óÝj«Ä˜¾”À/Zín)£1T§Iü.Kx‘mŒÐÕÔå^
Í©L$xÜ…æ¬++túÍX†Ô339L(æ¢ñ*hZWâÈÁ·T+~›_æQŸãt©WtôÚ¶Çѵ< Ñ »fùÜd!Ä[ÉW™¹m0ìÊz}̰ʥ᫽ªÑdÕ°–˜<’¶8æ{ñP×"¦Þ&žNOØ*ÐcŽ;54µ]óyÈ;ëÍi^Z‹ž+jhîz'æM|h¯Ñ23òÔןû><é>.à«Êðàq²ô½}•¶McœØd"#’}!.”öýì?Dåõ÷œÙ9VÐܳ#§•¶ö>VÕ_÷GpÁEj‚±pP(Ê{t3óç~_FqUÕEv¶3/ç¤xû˜žf5gKï ”ð]Ü+]õSLðâ )ý¸GV‚ûÜW´NÇ—%_{Ó…™ž}§¿¬öÞE±m™Iƒ²z)eÜŸ@‚”]cHj-«ˆÚxýÑ GhønàÏÿJÐÓ´®ã}bB=<ÿPᥫÔèÉñ²²c}Ξ@ïý›¸ºyì·¬@Òw -ÆK´¾9¬m–Ʀì;MÏÙoÎȳ†¼E„DåFtÙnÞqW]+ÔÀ;žÚ¹Ä0fÙWÐ"NLJï¡qžÃøÜæ)jªeRC·¾ž«{ÌÎO?I—å°’Z_žBHqƒW剈çz.ó^äÓÏJó„¿ËnÌü24-çý
άgìyÓèìeÌ|èÁ/ñ‹q{³.~È:_K‡(4qïtb_¾÷D†;ßN(™ÂÒÞ_•p¬×´úTÔbÈm}(M¤ Â&@ÁÁÌ¿ýê¤99Ùnwü“LôyØv7Àß™Ÿ½õ"»7\œ=p¥ldöŠ’v@¸Y¿€.iŒ§vaP_ëèÕYè&lÀ^Ä_„¹~¡£0Z‡wÅôí’)'¥“ºã -üºŸŸÏ›‚Wõ<d=àraéÞU½J†îé<W*|CJc‹ÒvèaùÏԂݱ¤3ñ6¯`}îÁÛJ˜Ôü9{%·Ño“Ø¡7g -•:D?IéðBÉì/$/hm5…ÜëüŸßÁÞ¿,‹{¡Àˆ’ - -Íõø;›WV>{€º^O -
œ
ɲ+ÕÚåÏY÷V¿*r†úíÆÐ-w-XF¢¬p&wŸX„ -_Ó#>R+r¥*³DilDÐqo]• †œÁ‰y¦S ʈÑni³ ë—ð{s®Ü4ÑÍôÁ¹¼ôLG¿¯á÷¯ÄiÔBØ¨Ô -ò¡krNÚ -åa‹êÛÉýÓŸ´ý-ç_vJ/.:óQ9D¦š¢~cܸÁU•&ŒÅsm -½%}‘>@:ÐaZýði”ó¨ÖUɬµñ ŠæRLje¡ònAÝhI
ÆB -¥ö¦Üà‚ÿEÆ ÌQŒU\€|e‚roàÈböôa‹@J©$,aóK+£,¿Ð -_<YpD[¦bè)Ý÷A±¢YNb.Þ¬±µ”29pŸ·Ñù0¦œUŒbeAÚ@k¡âÈñL:·YÂ5µåÖUñ£=ER÷”oiæUìÚ“Æ™ÌU [î¥ ê'5TxJFŽû[èO¨“CWU0'‰¼Äk8æÐî2ècŽõ
¦ž2}¨q*Ôc.pÊϾ7Št S~Mac^í¿èeéJá?v ]›±wtY`~õ¦„ˆr,
¨<P«¬¶ò.Xaœç`Ž#Xæ¯ ÆlPWMcÎEÈr6p,¨ ³“gg
µl‚N0êT8ï–{Ëô˜ÍmwÆ‚ÜòbɇF%¿»mÝ.n.Óg+O£Þ‡º¹¥võ½^K¶Á§ñþj1-–±óMJ‚³¯yd¢Jƒ÷ÝÈ8¨ÕÉw#¬ï`w%º¤\©ïÆŽ8?y܃¤Ÿ'TìE¶g6»-QƒÚ7@yŸpc¨¶@ÏÙáÊ'ò°™Ô» :iWýÞô^^©ÌP:Ùʉ4GÂCe*Z£:?ß*íÑŠS,`ï¹&~=QáAn£¾l3`0]‘iþ9ö[ÿD&¹R–ˆ%êa9Gm€¡ÆcÅdr¾ô*𑘮Ċ[ℳ“ra± -ð?%÷’BÏÛ›Ù‡¦_¡,Ðqv]Y4Ôýay½’¬”¸=ŠÖM’œïa¬ZÇb~ÆA¬/$OXݯ€°I,Ø!kÀ~Y2Ó &!sÐö~#5*³3€»ßÉAôÀà2ÀF•íß-2äà÷Æg‹¬¿J7£rèÄ’ìæÚSÓ&6ý`âûJà‹1ÈbBZu2zýÈp¤ì8ÌÁ
ºQ1Éþ0ˆáÛ½WlÄþ‰¯L7Ä‹âOT触ôœWï#¦q'oô²`Jó]+R€Q¢ ˆ|t“¼fáçYŠQQ>Ì®*?ìRîÆ~"~öaÚè¥óÆ”HãÌ&ÝÖÊGºd,ìPz®Hx=»¼G9ɹo{`Ó[?‰ôXãZMÙÔñÞ¨ûdÓvÛÌ •ß/О±.%ûäמ~—Å43Ñ_êWhÄ[)Å/îš[!·yÓ¢Ù^i£û%óEåêË—‰ïpÛK„þ~rŽ<3°õE˜}eâ4“ôm§>›hEaŽÎˆYÈBË'²Ë7;ÐpHÁŠÖ;o$lN„ùæ茔–Ô~ -Æ㜾µ¯õŒÇdgñâ— èõ¾ÄšFŠ¡X½aN¿Ð1•f`q¡¢9ßcEF슚Â7õ¼é¨Í€j†C“›ƒH» ãÄumŒJkÞƒhþðK´Se^ðÝ+¡–Ž¶÷'aïqog&„ÕÄ»pyÿ"Ž—w‰¶ƒpP—ÛlMÆØNÝû÷(ål[‘fmîñR~àû®!!%¡ÂMêL²9³Ð/—‘ôÙ«% -m¢üß«†™¢EÖM@ùXž,µ¾v…Ë;•,ÿFm|ûÅÑ+°ÜT´æUû~Ñ_±îç4ýY§v‘u1e2q¢bè•ÒY¹ç½9®OÁ‹„-›Éšª®YÑ\éI#mFIÑ™-gE¬‡ôn>~6ß6ft7#IhÉWVî#á’ç[øó9RÅÊR¡Bò¢Â§©ûRü¡ü|uâ`îú‰nqÜ¥hÂÅ -[#ÚÊféÜÿVùA•àPÜÅ»íD{SÏƤÊÆw‘눃¡¥91óEøI=ðU9_.‡H¿,êÿ!ñ+×êëB,츼©^$ƒ¸´ŸqØB$pAIÜvżj«‘ç|©ˆJ]ÂËs™êáP Á/Þ P?}¶'uhW¡k1šKU÷€ºyIeÃ׸,gÖ“ü¶Ÿ¢Ö”B¨SˆgŦß*öuÑïwTõw)•Ì_‚úªÓÔÉ3øè•0PY^·»ô’²ÒŸ€Ôsù1ï/ó²=]ßëÀOá‡DûÁ⼑[¨åáºêÐãYGOä¤Ï‡Š¨?=EôÅ6K›('36V:̆M”ܲ|%äÁ¶åæõ
½ÙtaÏ$w›Ø±‚ŒÕ¹Ö?tB‘ÖB—Õ˜‚ÍI&«O¤ -!)KáÊ…jþɶ‘ܸ$`Z=ÛV(µ:k}BŒ¬Éßè.ùÎE‚F˜x›éˆ,7JÚ`*µß¹–Ýçðd¡’^…œtÒ†©H›$c‚ÃõPìàÎÚʆ¢wÉÔqe·؃ž®ÂØ,ô£/ÝñŒ>p§¨o!tûœ’Ñ…P.Ióf;§W䛧 -éÊÆF@´ùbôìL¯Æ8üB„$³)ßUȦëŠ×1ÒቹeeÕí6FÊ”#ñ]vê$âãÝ;%ÖKu¡‡Ÿû?`„ivÈp–ŸJÙTá‡ð~Váêä·Æd.Vç~Ì9(ì8 -ÁÎn¦¸øãßÎ×Ê)¶xõ2÷%3gÜÿ´\U.²Ð^xWG)×¼ÅÛÝ—b%HŽíU×ýÊr^ÉÈ¿>ziˆú¢‹'e¯ÿzTÈS>±âv»¾fn2†ß~A]ß -/¾ëÃw6¥%±ì¤³H¬c¨O4# ›Ïõ¬ÝA“ÂáùÝ|c–¼›¬öÝÿ{ö~,É8k4&QœÐQ0V,ë¯ÿ#Ú`nDôþ粧ÎáZ0Yu¿»Á]ŸÕº´«7OLaÿŒ®í½PÊ3*+¨¢ÁjeÛƾê&gzaS?Š±ºàVm”äšÔîc¦WkÜÀÍÀŠ(ÈÙŽ»È^ÉyCi‡Å]²D*t<‹'6MñïÍu,*ð§™åèoÜžÃH?,j·-o`1=R¿ àˆ š<qQu¶ÅžÊŸ¦RËè¾saOÑêåœ_ÚçæM¢XOÚ+ðAŽ>îC=_ûõ&”ByÝçË><óµUùät›‘„¨)ûéÖ…þÂIÒ٣ꈒÌí[§ -®,£“ç—iø"Õš€xv^P«+M›ê~IeùÔ–S˜1‹w¼/ù¬á<é?ç̃âyû!Å¥žZ‘8žï3ŒìôP½»Û‘†ßĸA™ùSUÊz0 6µR -#¡ÂF¸õ ³1=ÈJçfTnh!@?¹å#ü×KÅ4XÆ©˜’%`o+Àz› -—¦é[ž8ö»gºE©s1ѼîC ´†nË$yCØy¼Þª¼¢ò㛉ÖröWmØ©wÑ”œLm
¯'¸ß4Èìjø¤œŽ©~íìDã,Q›’Îci=ø³"£lÙÛ'˸9Êê -Çf¡— Rªeß:ãƒG†ñí -=0‡Ç/ÿŒ‘´‘ùµÕn´?ye8`kõõm‹4Qí¹ÖièÜ&ZèjÖ– -•äJBžO+ÚƒÄòÎ"«g®ÄõS?39’°Tvd(Ôõ·Ug(ÂÜ5¬$Éî°÷^ö/€Õ™DГüì³—µ²‚1î˜à äa.ð•Ïá\à?˜¶þغ¾~
î±ËA[ù{ÍL*-0§‚(Êr¤àñá’ô’Ù[—óÈe÷€¤u£ré]•N¥›ÍW±F‚KÇè4Ì–Ùç?$“v³;-kÞkâXcÙ=H“añÌ‹†s’6i5ß©ÿM
ïü&º—X -ES…|Ε\À³«0Iª´ªY;o‡ò¸]»t«½a¢?esûºŠ7týgZTE¨REýóc -CíOónrªË€„…ƒ}ô¹6¾@ ??‘¶”xMõTµÇþ ¥õê6“$Ì[(ûfé^õQÍ¢£¿—êsyOúmù…MÆX7ô¶eø½Ž -aƒâOӘܡïÐPG¶¨¸Š{õâÏ-ú÷T6ì`#lì}X…šu'Ä·]ŒÐWПºR„[,6yªj¤wð„Ü·S»â¢H¾Vë<zrìmæÙ¾@Ä4Îœ®ñ[í¿=±÷xärö|á·¸t¨ !7O×i
Z¹‡7‚ÚWr9>D.Æ,˧‹X™öÍpŒ‹âäýˆÓ‰É‚þ>LÈÌ)v…ÁÂ2dÖQ‚6ø®ý´¡‰K>Ðñ’«=5Ìw‚H^[ô7Qáá[ò-@^ŸF°/¤ß¶?27,Ïm]L5ì3j¦{Þ&Jì.ÕÁínfÓîS¸&Q=“ -¦*âA3Ÿû<Ü@Ðe “Gp±¢/æÍŸ -?§‡èBya̘¿ÅOä(h.`è×åÖg¤Íü¹¡°‚Ú9#!ê -D$ÏÑ#=…Ꭼ›}Qb'Ž5 |,wÞ¸iS( ñR&ñn°úpšQÙq-ШFvf(¶Øj—R·é@–¸sëì)”8‡Ã³&ŸÑ;ù¶vŽb¶'Ï[3=oýkX=*ÍÁ·#ªï)tsÂfÚ¶n“N•ySȪI—gÞ¿A®¢÷Âúj¢¹:„¶ûÇHè&s–·Ð8ßÛþAX~:U{K¢Ý˜ù½ 4óNÁUé0ÉÙÓtA-‰]ñ<:19¡§ýàñ¥æö3^Ö/_‹HA…®‡ØþaÇŸÙ6Ôš4$ªzÉó0ãô%×þž÷XlI2mex‰SÑaiÞp>ªxmkí–àvÖ”Õð<…bLïNÕ -Ã:nBXMëž?QQÌàóGën 1Võp¾*Ë»sÉè¶qÏpeÎÃH_¿yu8\ä.~ƒ2ÁÉÛã#áæOåÏoß¼·ÓnJ‚ít”ƒát–%ô}H:S¼ÙÀ?£U:¼î˜+qÛyÀ5ͼ·h!vm RáKŸò2Þo
ÈïqÙÁ‡Ápe-ÄUÂõÜ<œ)J^T¹lŒi…xöpéù…(V"7 -I+RPÞµ1pï’›jÕZdw|^zÏi)—›Õ‘Á…§t—Ë:RÖñ{w}HÙòп -Œ´OÑ!Àq´ïѼ²‘j JпAAºçôgÃìd‰Æ0è^J#¸©÷YAª×°îTó¢ˆ +ÝÍ̶EÕK]K#ûEÅu¦‰CB4Ž?žb -i"9u2’V"múN‰aõCr*\O…¼€Ÿc
B&ïEö°}Ê¢4]û$“Íœ¬ìùë$&/é’¹¯Ô2ؤœ„Ñ»ÿcQ÷s'õƒÞÀ;dwܳíØ0“9Ól°/›ìÞ‚’ñ‘eë#ÙÊ⬼þœLÁ*ºµ}|ƒ¯]wDq5UJNÑP§ËŸÖgˆÜõTx¿&ÓákAcFκD§õ삃G
ŠxrnºWM‘üè€(Cù^Q]a{IPžËA‰>ÒNöÏç$á¢]uÅ@ï0ï;OÿU-m -OÁª>+7JN,¶³-¼1ÃݘÅâ׋qrÃ2Ñ7…ÓïXòaa×ÃB·>ã\wC‰eÇóNw;™¤×d
H[Sy2N³‚vßzÙ7ë“Ý%\›;[ÕM>ѦâÎßÍá¡c'…,jx³Šõž|¯ J,š˜~œtç¿Úá:ƒ“;0çÃ¥ìŠ+;O@— íZ€]ÝÇYQÏ šCúw—´ÍMñ2 -!èDU]IN‰ž<ÚhDž˜t‡±‰h¢ -â
¾ùÿIý½ª¼v.aÌ7@Ýñë[$¾™Häž"p—Å…RÂv`Êc§Û`¦¾lITöcíûËn0[ÌJõôž†½;øKâÆýîMëcö~ˆþKü§;m£ÏÕÊ–Wb1¯—NxÚ«îtzc±-ŸyN7k©uQœ±Ó&†ëMÍ"ãEu±Ûù¨ÂpÛQÁJ’õ‹_ãµj&ô%A†
RhƱ?ò)û#9ZžõÝ‹®Áµ‹mb¨hº=¯´<ZpŽÝGÒ[?ž"ëò‚er‰as¦)Õ0w´w»WÖ.EÄJÊ9Š#6°9üxÁ¡‚ ó<B-AIuÍê¦uʮхçŠØ™zvtJkÉÑÓîãDQøúçnéêÜ|²Øü’ÂK X×Ö°žPvžŽaªu`ÅÔtpñ7œÄàeKJ×¹ýöqŒ¬g#lÎO…ß-–VÀ½î§Œ\ƒ¤»$^©}–!¾'5–Þ4$K¹Ãû.Êq¸E ã`Ô -q2=¨YÓ$£2 -¨¿)Þ-ò×8ú¾ÂZ0yëýš3óBÉzó‡zèíТìkÌldµµxi1bIDÔƒ
VþŒ7CŒ?LÎkp‰ÃãS¾NŒ0Ì´fiäz³ÄäJ‹—ƒ×ƒø¨m Û¾°^Òë7Ô!¡%Dºâs“k2F$ -tAؤÆ1Í«åY`Êö¡9Q¶$çÐŒ%@ùÿÐ>”Nê’àl -1¡»¦Ç%®÷Þu–T{’zð…D#8®9Ç£Ú¿vR"éº<•|îlƒ¤MÉwV`Gªªõ[‰v½I’¯l -I5Ø‘ý¾s]#¦¹ e¡¸ßÐNtÖ02àvÍîPá÷—¤û@°÷¨qn]”ê·_úÝôéœ_J`rŠµï0§›Š²áÃkBÌh V|·ÐexRiÆ4ñ®Ò»ûiAdÿ-¦ž”Ë®'ÀEñ¾Ì'í%8l -ªå´$ ´¥ØSê¾:Ž™ âí"óY’xñ!#º°¨!7OyØ2ù@"iPEP,ÃJèéªòÅÎW•¹‹Û—ظx±©È˜ÄsUÇU¨œ´Bω¬â¦H🔙 †SÕ‡·<”]ÅX~‚ ”/Ãiõ¶¦‰RÖçéßÒ!®E.ä/dï;K¶‹ÃR¬ -J¨–/–]&áÄdã-˜]µµü ìªò¬_A®Bùyæ¹ÞÛ#sÊɤ”CÑzHóý˜Ÿ*¤KBMØ4Rî
èáç
s -Õ-ÃMÅ[!‹°cr7ŠsÑoU¸ù¦òíóâíý¦V|ªâzË‚ ‰úzÓsOgy¤V) -A†Ê™ÏvVgå7Y”Ž
$¨×Ý\t+o.G^_Ëçï©hÔµ°ÇŒÅ¼Ó/°’³ÔjüÇl6Œxƒ’9Æ<Œ^F8uΆ×?†xu$FôÐ3¥‚ö7`Ì‚÷tèz¿Ò¼!*7zç@àzsùPW`"½¹æ"Q»´œNtXêAý,ï}NÐ|^“«Û³‚x5‹ôM“TyâqBj{{ÃÝBO2)Q#ÏŸÏí¥–¡gÛÕŒo‘ Ìž6“µ–œs@D'h]¿Ó¼±.Jkë,G3ÖÄ憙*XîRáHÚ»Øì|Ó™©¥ÉÏ茇èXGÐ*„æ -÷D¼§~‡¹(‘ŽctD›?Æ´"ß$r˜Þ[ñÈšûų5ÉýûÁ/Ôžb»as."Ñ>Aé´X~4`Z[B|¤{eô-|óéòþã.bP…›5½áê >nŠ‘œÉ§â†¢™21‘*S½¶¬'.:F‚Æ2ïôk>®u‹"4cÁYû¤cnT¥4þÑ°Ô=﹌€ºÉ
ÓípòÁ,ÉãÖ:ƒ/¿þ‚[ ©Àßr‡âg/¡óÁLC9í}ú®¼žÿ¯9¹dHú¼:ÍFÜüÝf…-Ù[ýRû_oÝÕÎMŠ"RƃHí!Ý^`|£}þP;¼š&þt1c,oäÑâj>—÷·{_56Éï.CœÝ¸ôÉ«yIœŠØÓðö™;¯$Ù¬1øGh÷¿ß - ¥æ†×²?¡*!%`†¾sÝ+h>Á»Â;Ü·˜yl.¼j4ä*²”cQÃët‘>üàë°CÕ,jȻХ²ù1Î\¿³àhÀ¦OA·âè6!în#{T´¹Úûç‚àêáA~c{9Û3Cdœƒñ-£VM¹šÀc#t:ŽîÀü›Ó•_˜çod¬ÁØ/OÉõmJ>á–Ðϑ狧$Y¾¤†0èD„
þI Õ{c‰öò˜À¸‹ïV&2}‰*T1À‚G!$¤ª’Þ5%Ø+<É ÞÁ~1°•Ój8ž¬‚UK£{¦»ØÅNd-5½=r¢W$ANp…$5i™ºgöàŒûi¿PÁZA¤ÜÆÌhó† ìéà s Æ«âÖ~–^Zhh\.…K¼¡¢²Ð ŸpÌ» Ž¼ŽÙ5MYóÞU-atÙ«Œ–xªñôu‚~o`¹lWŸÉïµ@Í\Öbž»]™¥/RÛãàëW0Ÿ@ü¦izgžxñÀ.⧧.%T^¬”9Nÿ ;Æã—½ö5awÔ)üÝöõïÕ£-I&ߥ±'y…—žÀXß"žÚ7oô*ŒD:`Ø\:m·K±jþ0›`æ¶ÐÏ4¬”*xýÔWÁŠ`ßbÂ6aÊzÓ:Uç?fû"Ôôý‘GÙÐrÔÂöŒ²ž£²èô£ðAŽPW‡6\Èœ7
•±øä´äÝž:ìãÄ -õ¹‚t#PcßÕÑ/&Ø™ -k0͆‰àEP«t¯'øß!q‚Ù½Zó÷ó¬AP¿a0qt.z„×,S¨æ|«–ÐhóTŠµhÏs°ÓÐÉ–»n€hvÅл:N^”4Ôù&ºÊËXEš´Ù6ý?íÖ÷?ŽãÀqgeœ-+3.IV2“âDÊJÆÙ{&¡³ÎÈΈKVæ™Ýg:;ªwgwgœ£8ã}öù|ÿ‡ïoŸÇçõ<~=n¼Ú¡`(?®ÉLÕ³Ÿ¡þôR‚Ív#®ÚŽ¶m~Aö´§¬ð2ĬÏ`“\nCØÔòóæKÙZ ~:§pñæç•Ñj2~Ò¢–tUˆs°‡²Ô’Ô*/.éÃéXÓyb¶©¢d‚éý¦*´ Š9íJÿ$«F`™GÇ—ÒžX°©ÊCÛßß -ç.pÒ%o~Í-¤6L-LŒ}
Bv£"Í°íÓ]`Õim"¿Y…éÉQÚB>Öž÷cÔ£z>(]<E6ÿd껾 Ct™–ÈŒ¸_
R‘hdC§¹0´ÔCþï‹™\Rr,ò?u'Äc$„R$ò‚Œc+•ê¬¯*tòLiod »Žº -^•ÉÓÌˬ6`¸½G¯;¸ÖâJðN¢yÂûOÔˆôïþÛ¨:”²É±Ýͽì4áÈd¾}sNKÑ&}ù&‹°’š¯ˆ·Y:PÏ•Õ45™Í²]ˆï×ÕøÝñ¼ -ÐÁ]Ý@?H[ª~T|ü[\._¯Äû†‡Ûm«~â¿Î&]“=æÉ?”b‘Y}…ö†®²žb&_˜Uá¹#Q\´3|°/›øè3—3:@÷×D„} ‰n7U)4žu¾_Ù×)Ó¡;ÃÊg”‹îÝ{ÁåôÑáÛ‹`ñ’\+ÕHïì] -ËdQWþðãéH… —îc‚·¶Þ‚©Û’£RÄ’bݬ†G’+lIáCªw¼,Í*¬¹EÈþ YÑ•¬Ñ‘Àº%ÁH‡½@[˜ -–Á -ŠßÛf_ÿÞÛ -7{–4 pÎušóÌ(Ãq"»Ý:56©"KÑ^_Á”Ùw#çãHJ~1g<ujÆ׺ݨ‹¯ñYùÖn;“[ØŽîXo¼?A¸5IÍ-╯#¤”µü -pÆU¢ûß· à2b¯½V¹•‹ôk -KÒ§yçÙW9ô/˜µGB„ÝÀ¶ºSsâ'⃥—GWýè¤Ø@ níVM£YQ|¸óØ`”~x·¦äe·=éšJàľ¿çò£‹²6“a~5¡FËŸo=q9¨tÿÉ-äš —ErÆÅŒ½](©DM<6FZHf]Á«·ÑÈ?ÕG[>gùhH¬t͈Àd…>cÍ}una=ôp]Ë‘|Ý-ÿšÅQERv›0výšGñs€Ýi,¬v®dR¾—“UÊ(af¦Û´¼9&M¬@mšäK4G:Š¨'ÿ(Ž|ªŸÓ34TDŸ`umÊ¡;>ÀªáÓï¶ì¿Á×jÃzþ´õîÜî‰kæ%]«Èó×rL¡°þ¦Võ®ÅÜý®Åºßý>7Gm*þLÈ•UüàÙkö†öM#Kfró–²ÊÔRŽ,˜
OÝöþizD}uÜ>©êûâarê(v¯€ÏSi¹á®NEƒÏ#k–ûnÆw—’Ûí¿wè®]öÝÎÒ -ØfòC9’¨þ1â°'Å:Ü$–oKòs×ðlÀ[ŸÔy>ÖÚĪÏBÜŽÀ,ÿkOù]d´I $"kõ4ïþûþ¶ÕÞ¢„´~¸|`ãÂC_iMTã[rLölÒ½«_X] ʦy=Ò˜úÖv–6þôO‡ÛžXÌÐú°D´e¢=YêMÅHºEr'óMˆÎ‹vYÊ$ÿdƒîvQ€¿!4X¢¤Ó2(uJíÆj)Â7îY m¦ÎÔ.µ«ZÄ ×Ĺ'd*oøö²™êLi+îÜú™9àS¯ -Muà™C} -Ó 6+Ø[É>Þ]¨W:£{C˜µ «x<Ä5w=¿ÕZLL‘1Ž,6ÑI½Þ šMxã…Û”«fÆ~¸ÚUÍÓcˆÚP]S\ÜènëGñö_j Ýpu+,Ûî’±ÊÞdŠ ûüÕQŒà¨±—:àGyäç÷Bº9èÉÜ‘Oµhªày߉zwL”ªÈ +/Length 19672 +/Filter /FlateDecode +>> +stream +xÚ¬·ctåßÖ&›£’Û¶mWœT²cÛ¶m§bÛ¶]±*¶[ÿsºûíqnß/}ß{Œßšxæ3ç3×c“)ªÐ ÛþŠÛÚ8Ñ1Ñ3räÍ:;ÊÙÚÈÒ)Mlpdd"@C's[QC' 7@h˜™L\\\pd +ŠšRò +üªm{|ÓÂv¸*Þk‚駹?ÛÜ—Ní>ö¥©F{1(zR€—ùøÞ$T}¨›ä4z%ˆégQžW‹²ÛZìŒê»“JÊzÅïPߧ;X`®ž¨üH\ +üÐIí|ŒRëc1:QA¾Õžž‘'?=RŽõÜ@öíãÑäÄÂ’ñ¸@ ’GúÙçà h©Ux†SA¥7!àÝ´_}jt{êå‘‘â’FX˾*šæ¯Ù´Ë¾'A¦·ð&Ê9H¶îWþÀ¼žŸŽäJœæšËýZw&sÄâmŸ +쿵$
œÉ„®'~ +j8+¼="HOló‰à|V”LôIŽÅ_y·1A‘T5dSoEy%|Dm3N†Á‡P¥{ú¼ÞÆÙˆ +šÔ0ã#¢DËFwˆ(¤ ÙÓ§~¾f%ž©Y·˜"<Ø™Él¶‹Ç¹ÿúä2Ý©²HˆîKöÿ¢Õê’2|Cu˜Äï4‡Ùb +dÇ$[ß4˜h3iï*#§†]Y·6_¡$l¥—\5Š´ +ÖƒGÒgÏt7êz \ÄØSÂèÑÝá Kz¬Å~»šF£¦s>y{)ÕCóaÑýû²Ú7× Ý#ÓF¾o¯Q2v3äòÔן¼xÒ¾#x9s¬(ÃÇÊÒ÷öUX7Žqb‘ŠŒHö;QºÙö³ˆÊëí:²5p,sÍŠ˜VÚÜýXQý3j.jWô…¼¬[Ç2#oîä2’«²6¢£yé0O ÙÓËø8³)Kz¡l„ïzä^骟|‚gOH)àY îó¸¢e¾,Ùê›Ì,ðŒ‚þ²Êsźy&Ê⥄ñϤì*“@bKiyäúk@WÁ»¾/ÿë÷îÆ5
Ï##êáù@¹‡ŽRƒ;ÇË6ÈV|¶å9{<)¼ç QU+ó؉¬@"9ãå·¾9Ì-–†Æ¬»î³ØŽÈ³¼…„e†tY.ž±áWËÔÀ;žš¹„PfÙWÐBNûŠX÷a|nÓd5ÕR©¡Ûo÷¿]fǧ_$¿å0[^ž‚IpƒVzrEÄsÜó^Á¤ÑÏJó„½Ë®Ïô—qŠž€3«Çþt¿ipôøɼïÆ/ÑøµÑ7d™§©M’°{<1†/ß{€"Ãg'”Dnnë«J0VkÜ„},j6ä²6”ª’nå'Ž`gâ[ö +õ Ò””d³3þˆA*ú<ì;»ãçëȈÏÞr‘U¦Îžƒ ¸R64yEIÝ#ب[@“4ÂS»Ð¯«±÷è(pÖg/ä/ÄX»ÐÖ@Å»b¾äcŠÅIî n¿¿„îçç3Ã"çU=^ó»\XºwV¯”¡ûB:Ï‘ +[—ÒØ$ ´zEø}:µ`s(éHô‚Å+X—³÷¶*5Â^ÁmøÆÊ$¶ïÉéGH +>êò:Û†ç-àñwN‰ +3“7º]Ç }"}xt¿-i7Ÿè¹½‚• +üƉ¾ÏÑüІž@S&_#‰= ]Œ% ešPŠ†¼RŽ”oQÈJt{¸œñàº0ê8&ò½A"zXXª‰„^i$º@õÁh0škm}…“u@îK/²OÊ\®zOóu#«"ùÈR.¯AÇ„ŠòÙôÐJ©4I°muþ`*?섨0V2 +p‡÷/ó¢nD(0ÂD +[Õ%:P+t¦*5Gil@ÐvmY‘ ‚œÁ‰~¦S JÖjn5£ë—ðys¬Ø0ÒÉð¹¼tOC»¯‰æ÷™ÄiÐDX¯Ð +Ù¿®;ªôŠD™r]9@èšÌˆ“ÖS|æ[Û,
('|f¤~}Ã!Ónëw¦©®n”Š\8ÖgK½Uz:'=*"Ô›%FWHO´Ú³ÒèÒõÖDÐ_|ÌÎ\ê\Û +qá‚ú a¾ýGŸºî“•e +™âîÑ~)Ü“U‚™$¹ß“ñA=‡C“ü‘:³œW•Pv Æû§hbÖ¼ð»AàlmoÎUÁùË7…¹í\~3È +ÂÏå±äÑs‰TNŸ +Ã<ˆ•9O¶¥fÈËDˆF§‹ÑÉöY廙l›¸·°6¿33ïáð\1ôb° a÷ Á{ó|³m«é*Ê›}½"é?Yš,µÔ¹‹e§úPh‹ŽŸXEô¸º\©çÜ[ëgøV3C^à ±çSø¥$š ƒÛáÃ:“É»®’´ð¾ˆïÅ^ƒÑÁ´‹¶ù´ë¬†)à!jáìKøGR~ŽCkCœùŒBΔí!$ÐdÕˆV`¨\ ©n¿»Gó§æHðnêÚïvœ&ëÌŠ":—íÞÕ^"Æ;bÊz³N¾0UÅÕ–ûÖ1ÃÁ,Ծ㢫|7ßoV};º:Mý³éØc£ôÂà¤=™MhüCÔgaì‘7¨²Âˆ±b®5_¡·¸/ÂH:L«
>r>Õ²"™y£6o„Aù±RQ ¼“_;N\¾L©µá%7¸àÀ‘¾g$µc [ž Ü80›=~Øü.¥T¿†ñ¥™^šW`/ž$8¢%S>ô”æý XÞ$'ñ.ά¡¥„2Éÿoƒã;At«!Äò‚´žÖ&\Åžã™dn£˜kjÓ¥³< -YRç˜oiæUìÚÆ‘ÌY Kî%?ê5TXrz¶ë[È/¨£=gU0‰Ü„€UShW´1ûºzcw™>ÔXê1§†S\»²3Š‘ÎBaʉ@,ŒëÂ?/ßu3u¤ð;…®MXÛ;Í0¾z“ƒE9–T¨ÕÖ[x,ÐÏsô1Æ÷Ìó–Q£×©VNcÌ…ËrÖs,¨ ³“eeµ‚l€N0j—;î +??zÜ…¤Ÿ'PìE¶e6¹-Vƒú£ò>áÂPe†–½Í•Gèf5©{AuÔ¦JÑø^V¡ÌP +:Ù‰4GÌCe*Z:?ß"íÖŠS$`ë¾*~=QîFf†£¾d5 ?Užaú9v¢÷"“T!KÈ
õð;[ùÛ +ðþ¿$vCÎÛš,Ù‡¦_¡ÌÐpvœY4Ô}ay=,”¸Ý +׌’üïa,ZÆ¢O>c!Ö’&,î—AØ$l‹ˆ4`¿Ì™é„G‘9h{±IKàôáî·3ÂF£Ýйô±Peûw +
8ø=ÇC¦ñÙ"ê®ÒL¨ì:0%»¸vÕ´HƒŒ?˜ø¾âù¢õ3™VF_?Òí)Û÷³qoTŒ²>ô£‚ùvî[±~á+Ó
ñ¢øøhÂ…ª>çV©Ã{‰iÜÁɾ,ÓPhF°1J4‘÷Ò.’×l"ü<KÑ*ÊûY•eûÊ]XODÏ^,@+Ý4‘‚èbiœüÙÄÛù§ô¥‘mJ÷e g§÷H9×-7,z3’ '‘nKÜ‹)«ZÞu¯,Ú.«9¡²ûÚ3Ö¥$¯Ü šc +9P“½¥Þ8€Fl‘…RÜ⎩r«'¶&ÍÖr+v¤Ì•³7_¾‡ßm/!ÚûÑ9òÌÀæAVÔ•I°ÃL"ö„O]á²Â!³™¦WD§w<·¿
`Ÿœõ[A°)!䛽'2Rj:PCøÄfűbü]–¬L¡ÅpÝ·mñª}pÜf†Ë ÑSYá‚ë^0Ñx‘Ê·€ýÍEÛÝöEô7N‚)ÕmÑŒªæÀ á7Š•U÷ↇK›—ß²9¯É,‡…ŒŸX¨<™¡ÌÅ…cÆ"ûgÚùÏ=j³é b«*"ìëLZaì{oFðÂ{¹†âMAÆ ßQƒ(°Á0ÖkøcÇǦŽtDþ<`N%ìy0ÉB´¨þ•PPˆ?Ĭ‰…šåxùVày»—.Jª“ÈÌë/vg`ž0zðõà~¬ |ôiÄlTªœXöA¥j–çW¸ӷôµœñø€l/^ôŠ^ÿ‘XÕH6«3d"Èî:¤úá_T`‚¨KÆ÷Xž³¬¦€À›†ÚÐt¨bØ×82ºÙ‹°Y +g–w¸Ò_ÍÑf4…,lÕF¯tçÜ äÊåšv…è0‚Z„•åIÝX®E˜w²b!ZhÙ”áÉTëkS¸¼SÉômз}P¼½ËiGýÖ´b
Â/ÚãzNÓŸylQ]*+ ºÞ"†V!™s¾Ð›Íáüô¸Hм‘ôCÕ93Š+-q¤Õ01=*ã±ù¬uŸrÀeÂËÇ +{ÃbFg#‚˜–lyù>.i¾™?#E¬4*872lºGÝ›ü”òóÕƒ¹óšAúa§¢+lµh›¹cÿ[ÅU‚·_Q'ï–íMÇ7&U6æØ‹{tÍ3_ŸÔ_óerˆ$q¿E½â>$zr,¾.ÄBËëDÒ‰ú@û‡ÍDü”ÄwPL+w1xàKDTjã_žKU÷‡Š¿÷ðN€úè±=©C;]‹‰ØÑ\z©r¸úÕ~ÈK*¼Æf:²}䥳ý]°¤Bu›B<+2¦ø¥Ø×Iÿ§½²¿S©ôûü¨·zM<ƒïˆn1•ùu›Ó÷^Vú#:.æ?¿yÙž®ïµá§ðƒ£|`q^Iš©åâ:kÓãZFMd§Í‡ˆ¨><…÷Å4I)'16TØ͆Nß°`‹ð` [€r óz‡ÅÜl8±§’¹Ll[@Æh_ëí; Hk¢ÉjLÁf'‘Ö%З&så@µTýb[Ojöß 0®šm-Z‡µ<"ÂVçwSp#H¸Í°ÿ,3L\g*±Ý¾–Ýçpg¡’^uІªH%a€ÃuQlàÎZK‡B£vHÕqe·lAW`¬úÑ–îxüFÁŽ¸“Õ7º¼ÎIhB($y{³ÓËòMSô~¥ã# Z|Ѻ6Æ×c>ÁB’Y”ï‚*¤ÓµEkèið„ûܲ²ê6ë#¥ÊxNÛµqqŠ®k%:ЂÃÏý0{Â4Û¤8¿ŸJØTá‡ð~UâjçµDg,Vå|ÌÙ)îmÛÁÎn$;ùâßÎWûË)6{ô2÷Å1§ßÿ2_Q.4ÓZxWG)ûqŠ·óGŠõ{RÜh¯ºÎW¦ãrzÞõÈÐKËDä]Üw¹Qöº¯G…\å#n—ë{aæÆŸð»Â¯U"¨k;`aEw}øŽ¦¢´Äætf µŒu &ßéæsÜk¶Qk¥pxNšnL’v’Ô(|)²FðcˆÇY£0c…‚Ø0cX{Ò}hƒ¸eÐúƒKŸ:†ohÁhdYÔ}îw¼Vj¾]½¹cû¦wní†PžQY@V)[7ôU5:Ò³ûÑ
+¢ðBîBZYø ¡QÚ÷¥Ä:_}ÒbeÚ*r³9ò”¯Ô¿åÏ{ݘéËáªÝ]1÷WšeÂ…5âo#”‰Nb… ¨ô>¶ïÓAÎì·¼žíÉzàá]M¸Q»„)ˆ'°&má"²‡8øg+Gž‹-¯ðJÁÙ¶(!‚d%šò÷F¨é’‹Íü0ÓK^žŒð§.Úf9Õºi"‚Bœ‘תÂh<MÆOOìu h9ž&ZO{èìxö6"÷rWNÕ6Ù$Çøâ0™…´žUîÇ>‚0æ£Þ·/Dž¿V™¹6j©Û̇‡o— +_0ß9ø™Ü®Á³@3&i¯)BBD‚Òr8ª¯sÿ’¶þø¶6ù5EåÇÁ‡›3§ŸÒûišI©R«‹ª]S¯Ðeÿzý!KþãÑÑÛ7çÙ96@:áO´ˆE(Q`¡W¡ÐêgÉCIචœ7·@ªÁ×N~ðOÎÏL ÔšîÑ„6t>æ€ñtFt&QòŒõk©ú¡Ì: ZBw˜0.•Ö +X˜DöBà矉uƒRá±êëŒãù³"‹‡»½øS,VëUgÈÓÑ×Hë‡
Ö•Ø®ôh3ßõ½@gYa°«¯ÃK}\)ÚÖ„èoô}7dÔ{Â+ä’רþ‘ǟúiæpC8[bk%u‘I0: ]¯úíŽI*]¬NꌕԲî<'âÌ€Dq¥1öYßþù4ˆù;4Ù´Ô˜¥^ðžöE›:ãZ”¢‡ÖãßhSÁÒ"”‘æeGq ¿¸ú‚Ò®ˆ÷ñ"‰v=}ç¾ÌÅ%ű;>RÕw´ºÊuú)DãPèñåVÂ-{
i¢87£rC~zIu(a=/åÓ`éÇ +`JVæ€ÝM?Ë-*\šFì\q¬w÷4³Ç"Ây'LÜi
æI²úвTxÝCxEåÇ7#Í=䬯šÐ]ÏÂ)9™šj^wpŸiuØ•°I/9c½šÙ;ˆ†YÂV%íÇ’:ðgEFÙÒ·O(–qS”•=ŽM.A¥ó¾5Æ·ôŸ·¸PF×/ *ÝXåï·Dê,oö°`ÐO„&ÄÓú1¢ç)ã”au§4‚x¦"ô£šVKnþ?af¿½ðÒâº-©Þ(äM×4jý€‘âª[ Âx06Ä–3±ÊbV®gG¬$¨ˆX”£þÙ]0ML]B@! !k“ö'9iH„%7ØdÇýý³ê«VÂiH€ð‹Lêõº«§ÜTÉMÓ´1=1TäöÅ¢ÕæûH&LÏ5« "ŒúÞ¶jªÏa1¾5e‘ׯŠ9³dfƒC|—fS}½Á¢^3²Ry€!©ìcÊ^Ù±•CyÞ>æäŸGY›µöLˆ²Í+ðüw…¯‰‡›]E™†ÏIœº#½Á”“W¿ig/€¶0@hçnlÊäª5Áç®ýF6PI¥pKˆÈKUëqßoÁÎJôƒED=§É*óS½PlBø±a` +^ñ2Ý9á4GÌMdHä:a,h&y að;!Ù$õÖaÖ8|Z2ÃdÞ‹J‰Óc—…6‘Ñ}Äu"åÈÄ7)õ)ÚÞ”L#mõ0n—Ü^žÇl¡~c[øïz¡AèÖЕ–êÍ™qùÐEm)PF½÷¢xŠÔ–ŒisØ€ç³D6
&œ<ÝÍYï’Úl¥ç¬œs·ÚCò£ypKWFsš£jƒ“ÃÉs ÈÚË~ +¸š4?æ·q|CÇÂ[9ËÞnÑŽ¯U…”kCWvܾOøHBÔfGpÊñ¦Ú™uw"£Û¬‘M+<ÂREÍœËâ`Ôщ) SßêÓk3—ÌŒÊy‰m:ãs‚êf“BܲþàĨÙþ†¨4ÃJ´§¹=µ¬l%Ž»Wa*ÂÎK6#º=\{œ˜{áÒBz[òaey}1i%œ1ˆpÊeDNi±`à6^¥ +“V-Á …ê©>Zw>î^’:ðëÖ£,AÎó=a¼PP?N}“8s3zxC4-áÙ'Ð@¢¯Äa0½ÌåŠ&vù& Ê«¹jÐ-OB;ó¹bîAl/äÝÈ»÷
#o«²#yÁ?.¶Ü詮ϲ +sf"7íȘ'z½½Aܬù;˜-Ø„º5½ŸPoö’RnÃã—§cÄd>Õ‚ëmOévXš}Ý…["äC»Îµš Ú·ñfº ?jÊ…Šs$!ϧmAb÷yg‘Õ3–ã¾ú©Ÿ™ì‰YÊIÚÓjû[«Òaîë—e·Ù{/ûÀjÂé‰õÙÊZXÀüì˜à äa.ð–Ïæ\àß›¶üؼ¾~
ê¶Éþ¶ü5öZ š‘X’oJQ˜iOÎãÅ[=Z)é!³»&ç–ÃîIëBå\Ý;»"B7›§ c)Œ—†Þa%ó‡ŸTÚÅLn_´´i·‘c•udg/U†Å=7 +BÎA>ȨÅt»î„ÞñMt7¡Š:»ùœ=2>ï((Ÿ!{GÅo’8DiåGÍlœ
ÊãVÍÒUŒÖº‘jÜ”Õíë +ÞÐõ)δ¨ŠP=¥ŠúçÇ ºÚiÓNRŠÓ€„™m:ô¹¾@1??¡–”x!MÕT•ÛŸAsË•-&I˜·ö@ãݪƒêE!F_Õç5²î´ÛT²«ô±.è-ó°{m”´YÐßžëÈC&ÐöºoÕ¬ìêW5iø·Š ¹Ž–ðûï~dÏFœöN{uÍUg¿a`BFtCÙ¾VØ-¯Vâe*ï@ì @uòQµ
ä8L°4§2Ir©¶Ð“†¤o§¿Ù §¥ëÁIÆtPÕ'ÆiÎâsëŽÉÇTЃF`Þ™0Úu5hJ»½
Ù‡,KíÜкÔP¡f|éO7§Hf|dÑr^kç
Žß¼¥'@>¢íð@‘…„—Ä”ÄÄJÄÞ¿Ý>3„Œµ¬èZˆ›Ù¡R^XÚ9ÈÍjÕy0”Nš¯s„gA‚îWˆ™[Uú £™2õÞzבl‡KØ6`ñ +î†Å×°æËùß'™+¹O?àªH‡q@… +…eȤ½øÛ ]Ûq};—¼¿ý%W[J¨÷¡¼–Þè aÁþ[Ò-@^ŸFðGH¿ ìÏÈÜ°<·eÕ@wô¨‰Îy«(‘«xd;{”«‰U¸otÁªDÕL +˜ªˆÍ|Îóp—aÜ^§9Lî÷‹¥¨`=1OþL +^ú”ãh@RÄfíÁ•6—U +×qóp&+yPå°1¦àÙÂ¥å Xˆ|¿ð$6Uç»’ÄŽ¸%¼ûm'v»!†æ^™íç Åä.°¥6q2Œ\õº«CÛ7E.ÄÔ—¨lwBÂæ8=÷_so09Fµtéf²ÅoÊRaáÜJýèb;†xŸ)ォGœþW¤ÈùQw¤ØØV„K˜7µºy$•o5MåÐà,=²æ_³4¥ñ3ž•÷°Ÿ +áB«¦¨Û$EZk°`ë¥Y
5qÁ[œù¥ëÂF…:ÁƒN„´®jîܨ€›JV[‘ +ü™±8Ébº¢¾9àѲœ&Â&9h°¼§!`Z„ù“½M$¨'Ìé·Ç ˆ‰b|ö]·[EÍ\çtHL”.=MSeî{F"ä(ËfIÜ +ˆ4ƬÆx»ák&ªˆü•“KѡڪƎ5soõUKæU6Û‹m™³Ó<{WûFgsü2‘“+tëÑɇ¡ˆ§Ç—–Fë¹mù¨ö9¥ûŒí¬ ( Q«¿˜?©Fߧ$‹OÌr?ãZJŠM¿{m9ùœÄ1+É°‡!¨Ú‚§¨næòY:ŸAÈ‹Wv¿˜iq“~ˆRŠ +íqÃoØ8\"ÉÄø‰m~'8
£Éùª¤\"~Ķº…puX‚8R±·ù;¤‡,qÞ\;1´L AÈ›œ>lϴʘƒš¶ü¸\UÆækèK¬ôó(29÷ðJ3ôûõrï˜O²âåMçÑñBu”蓼!þ*²‰ñØx“–ãfðÔƒªáFb6ä([N£+þe÷#Ìó,+CðÇUÓ3Mcf‘ÐAñn0Ja¸Þ.H”#ÓJ>U³ÂåbFµîV?4™;> +Û Ì_÷cvDMÄȺ„‘)˜3,fÅ·„@sž?X³¡˜ò\ªå$@Š$ÈW;ö=W!za(NGv È(èᇓÃY†CõdQ1”On?S9Ç>Oµ +dõ›#. +óÕu«ðaxÍ'¢T´Æ49¿} +„¹ƒ°yeàêÙÔSYãæœjî×]…)Å’ÀY¡vSWòÀ¢ÒGÕîUê£ ãþh4×
¯DTÚè¢Ë ¾ŠŒ}dœœ'.ßñ»c)sùÂ4E©”€cr'L’q!2XdêFÒ±!NMi€âñ¢ÂdÖ |H—^ÉuÞõ“ù¦?aÈísNfBèÈ(û;Ÿ>§[Q-„- ï$àKor§ËûI’;G¸],˜úJâAžXÚ€àvÞ9g•0žh}[ü £Å‹—T€%/WHþî×Dªÿ~Å!¬„ŒµWJQ;dZUüÁˆo 7êU
‰iT†dGà!y×"?αLÛuº·Ô~¡šŒ{U#[Ö÷g_SÚ®s·ßñs=„Ñý}Ž´þ^W@ƒ¨IÙ9¼£ýè@‡}Ó$0_>)’¤Èz®Ep,—ðóõè¦ +ÈïQš4Zl’€AÍMNÒ1B.NèL·YÏ¥£ÌÊ©“0d›±)š„¢«ëOØF'Í<I('Ó.DÁ=Œ”³‡pEdùØøõmQÜÛÓ +~z#ë6 å˜Mmné©^«ŠÒŽ†y§×ù{?¤¾ó
ÃN[„!H-Èâ–‘Ôyúê³Ból«nsªYòU4Mö¤
©0lÕÜ´~µÇê½æ` +chô„, 3 ‹
ï‘“#•ÃùG ÖÑŠ9$5à »l|ëQλM}ž¥’>‚ÈÔ!¦}™n¿°B=…_½' qŠ=ò¼²D½JQ:|4ù "V&71¢‡»Ê´XGŽÌ˜Û6¸XÉLjðD^«Pìˆ,0ª°>«ÇŒzK„Uê• Á;ð#
zJí™ÛGÃLtåk
' , 2ýòô™ÏªÍÑk|Õ[~>'}A–žh¦M$™O¤{É™™aý|Fo¾á¦›\basmç‚‹ÝjM߃½€—RÚ·Ž¤`W<Tº;ˆˆ³õì&> 5YC¶]Þœ}ËA… IñFÝi„—¤>4Å1 <ÏÜïQ»ÔäJ!¼@ïµ/g”Æ +¹?¯²YÉLµOÿº“oc€ùÃ^vu?ÂYáQbâÔò%hñ£›Þ|ù:µ˜Âôʼn "¶®œ%v ¾õ +U¨!š»N}œ Ñ“;æJ›ªÙCĵ?ûœôý+¼<¹è¾ŒÐp—³[»õþAN +ç´hô@ª{âN'H_È9S(rÚ·kEü&ßÏ•tÛª.Ü,çx>A(wYœÐ% + ±(ø'E5 Í0Á{'WÈÐÐlûù
4·Oÿæþk¨ÕÏÙ€œ“æ¬)Tlý¼SM¢ÌºtÙö:ʇOI[|¹,™á +¸}³i¼<nU·ƒÊ'D†7Òz;%s}S°l<•’y°46Ê–TZ¹eÛ]DÕ\Y¹ñ}˜en|(xèn)<¸ËŒ¢G/Çê‚«þf$'„ƒ":èuë ìðx/’<€Â?‰CòSÁ064qcZŒz¸ÙÝü\! ;‰^¼·'PZÖ‰EvdŒ¢bòjGYþ=Ñh/«¹È´®ŸË $8éÈ'kê¼²à +%gsðùB§*÷Ä•TÝþô¶VÔ½~Þgÿ°s-Ãê¾ù¤‡I3ôÀâʨbŠÅ4ZŨǾdzçÏ—à Áç‰÷ø׳ŠX]"ïe‰¥?ÂÛjš…<®ÛsÒfÔAgV+¢ÔŸ8ýdÚ¥_ÜÌl:ɶ™q +L!
…a¥,C-CŒ}M¾~šÞƒÔCzâë—ò'|;¦DÜ‹ Ž‹¼”ýû·NsŠŠô
c‹Ð9T#qY%%ËGð 0Ù¥*÷f’ +.³ã׋ÏLH]DÒ.½Å¦œÈçûNcxï*ÿÍRŒõjHGmwr$Æ›~üzXÉõ½c7G9±fRpÂÔ›õñ`ç¾/ŽFöøÍ¡Sësöe‘Ä¡ûůjrv±K±‚º‹—li¬@bÁ̧òÓµ¬FÁ§”L¡s¾´_úm\9G›8+¥£XmK‰^γ³æ&„m©œtðÞì]ª_l„Š@O3º] q—ÃX;Ü3œåá› +kƒãåxÄüÁ‡¹C ¥"QPf¦CY_vŠÓÑô|‚ŸŽîdœîÃ:
eФÛw‘éûe« VÑê–†P-o‰ã¶*‚½—€:GçMøŸ¥ÀOr¿/CîlMk[6qÉŠP·eÙ0ÿ¸•Ëzý?TRÈõó·—Ï(ªå8“j$27BjߺÌèÖ–õ¦òãȹÿäâÌ-:N
^TüÚO`bŒvï ×o(<>yýeþðHó‚Tƒƒ2¸¹ÁíåÞ(å2Çæ¬9½³g¦F³Ùå’Ë?q…ÃNßJšPZØcš¹ÔiΑ88›ï…wäD&oô\<朕çÞ‡.'cve‰kÎþšØuôI¡]Èš‡þý+‡¨§Ä ~¸db D:{‹ÛÖq •¢j+˜ZÖ+·?ÜT±æºŸÀÜÀ! +û:%é5¾¯åV¾çu™J°5Jòb´â"2jþä³àí=j¹òüÅÍ·½OÖ±¼×Ñi¥Réqødoeל}½j(áIaRFT¼‡{°˜Të‰n°‹W÷'½y@,}H5»A¬8ÑLØÑ]ƒ5ævYÛÐD"ßïŽÊDʺ°z¡Ž »z}ð…ˆÇÄ_@ïO>s0<#gr¹ñ´»f!bºÛèÊ5ƒ¢Ã–x¦ÐJÚ./°A>x»! jm–²sÞ7vÁßC}AœíÁ÷}Žn4XìÅVÄés¡%›†¹¢{Pû< ´éÔ Ì7¹d±·ÝÖ.´?²s1‹t¯}¼;¯±Ý½’×Gû»{UÔ.!ó!T-ºž¸9Çݯ~_’*gûkèŽvª»¦$û¦ÝU‰ô¥5Sü¼ +¨ïÃÌ'l¿:¦ðè;{3¦Íäeµ—Ä;»¯McÕÒÚ-ÿXON´Â½²ùr0‘õC€ƒºÆ…L9ꉱSWËñÛÖþN2¼‹ÆvÃñ’ýÐ È*ö{ä•k^‡jogÊ"oØÊglÂóIüPÚ}tq(½Ÿ +QCm6õ +Ê’¸È˜”m€¿™»_–pÛD‹KÅ|iVWeeÀÀ«‰
„lÐÁôÿê4èT0Éëë]Ïd‹;PL¹£¥e!D*%)fоì {ÄùíÐîòsÃÕ|0ŠLï-ûÈØÀªY‚èZ`ä<Üu´N!ìÆÂçaæ¨ÞôIJE OÕFÚØÙ‚™O¥ì鲟‹„œ*+aB5*êëˆYš0MŽŒ£>ÂãðSΚb¤³(=nìj‘·æÑ4WÁÂ-ÕÏ·_ѱîíô‡Çº™·`î%âg›«ïW‘iІJmøª º¢Ô††ß‘$1½ÑØ“](snr…„L¹Rœ±¹UbµVfn3]ú‘ÛÀáˆÿ3È9ÆTÄk›“¯Bšž«µW¯ôoäˆ9u“lܲ‡vxvèô3Õ ÖÞlQ;,
ÿ®w½ß,Öf9z ïï‹?ŽJ¬äl*+pË(ÑMÁ™ž eF×gº‡@‰<·5ð˜MêÍ jmòÏ °ñksŒ]VY:zÅPÆ]•a£¿u_d„‰ê`”]&6ú‚–2#³ëb…S–ä|_'UBÉ9ÇØÔ*+‹©´ËY[–µ²zŽ’w +Áë±(`°1BøÍéÑ÷kL»;B„/ˆ,àG70“›(Y:¥ö +ùµi¸ŸÔ§îwX\Ÿy=rû„7"¬ˆiÝe6ÕÈý`Cõì¥oØ?g`ÍF朌‹ÀH‹†ò×ÓÕÏ‘`ñ»
‚ƒT~65Î.96,`³xõµôlë Ä\θ;&¦!kÇ×å ÆæÁJôV>ÓÛnQ3‹c…8¤„½aGãÐ$îÉ(»çf†A*"CÛï}„:¾¹Ìl{‹7nN^ÐÊ`„påƒå˘ÌV—Ûyþ2>÷{Ή =½"ž;ôl`¦GS=)ÅhhR:êbÞ°ã}µ;íYÏHey~aN'¡¦o¦NQ»ð%`\ô?G°2™9×Á>ìSŠ¬7…¾»Ù6ò_qÛ§ÍȒΊŽ¤¦vغä.Ù#*Íõ¹²G-–à°Ã~3º½øÕNôdàÐH¬|ò€Ò>I6]ñs˜öüåÛ{ñ7cÌ a8d?‡ÉNV¦æWíûê^ÙŸ\W’é†;ˆwÒ`–v0zA…füA©‰õ§$=›Ò¥˜ÖÒGVöašMŒs*(±Ó8üì¹äô¶^d•àŒ1÷·»s®ÛCºDdq +I¢BŸîÙ¿¿²ÊXãÞLbÁcÔÅã‡Î0¸±hÿŸvæû +‡ +ïÔ2AÆìöâ©eîÛ›Ó¦;»ŠÞ¹‘°!¸„è`Ò]åU-YñÌëŸò¬ùM5ÁF³·&RGßw´+ùûè8šŒÁÈfïyFW
OU£wÀº$¾¿@i¼ù9ºùr¹>ÒHÝÂö§õÆe¢Íw{˜¡Ù +,ùÌçÖ6ºþ‘ß‘—§ìä*ƒšA>SxÏå’ò§Oœ•Ãøjäwcâ]o¸‡´×ç?e•é%IômßÞl)·œ?Þ4‹™æI¿´—.¦Äì Ê×AÖŒqh}Ä_J¬Qêõu‘¦ZX´y7³xÄ,i’¸«^飯\µ1)Ík„ÝÅ TÅ>¹Þðô3¥Ÿ¦õ1!}KGf³[ZdɦÚ^Ýs>¶ì¨¹…ç›ý˜“]û·çÁ ~V\Yƒ°ÕæÆÐ¥–tQrÿ=<e¢w†|hó$¿åÜ£ëØÁSä<þxØI'è÷¤ïëÚ_tšd¯„§wòÒs_×àdI#ØÙÒ¿˜ +ogÓƒ1GC6E®Í]cdv®l}©µžÆÍE*û‚Xí
øVr,À8è–>7%×5/ÔQz 6@^î$Æ +Ìkª¸â§hDlU¼v7X}ñÂúZ%fòb+†Î5ƒ;TÅHÿ$IÀÒR.X/+ùeÌö2¸Õ4•õ…6È(z¡ØîõÉìg,Í¢ÛäZ}~û JmÕg(±èe{u›"&Œ›Å?c +áò¼\¶¿ûë¦n +Ý)¥ÀÓ,Ú €ž–ñ;Þ©x%ŽÇ*:GïÌ‘bàÞšÈÚ±ÓÀ'“('
ø·&ᦗ„Bfs^0©^T +i¿5xÑ@>,Ïu> w?tiÓ¶0ûôIÏä#%(ù‰ö +©«ˆ|LO†D¨Å÷¦gîÑå¼Þ8vÉC÷I~®O–ÙÍ>mŒáõÞ¢‰‘}‚ +^hâŒð·¹ œ£“hZ™Í/øÅ_à7œÀ+P¸¸&&êåî$+Nȶp®Ô
~I(–»c¹ÚŸYªÓÅg¶%ø¥p%ö>’H¾iL¿\ÚõÐß(¦µâ_«8Cƒ—R{‹ +Žµrð¦ëØíû‹0Ê{‡˜ÊQê¸2‰«Zœa‰ƒ†*7Äc¹äJî„I›ÏüìÒ]©æÁ 1=Š¡å©òñS€MX¡¥GMøªéþP¢‹:*½ÙOT9†ÜD¨*ÀzÞÃ*Úž“¬ÿ°Ë_hg +‚œ«ê9ŸjˆŠ"J7Þ®(ðhT(ìâ ª¦¼ÜðÊ™§Ä‹V¬áÝq +oò]ç}£¯9B‘7õ· öœH{È’ëæi`T&éVÇãs"¹‡‡ªÃßÛçVMo¼iá÷׈â{C„^×;¿_g¿`,·÷þ2
Ún“
RÂɫǶ]ÅjÍuib°ƒãÏV!QÏÆ>²¦aO<ö”ñOÁxƒªH²$áófe°§Åû›ê¥úКxÇÑiêÅà>ò$–Ìy"-Ú-ŵ ôý‰¤Ëq¸ŠÖˆÕ"™[Ø m¥cA¸¶¹"t8Q+PK¥ìó÷Ñ”¶ëÛãh_“ ®$+ƒº‡¼S¾ÎúÜþµ$áØ™éezv~7EhÅZÞ‚¥ÓªãHÝåûm®Ý‘(ãŸÄ"Þïòwnúê›»ÉÕ”^«¦ endobj -858 0 obj << +863 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1915 0 R +/Encoding 1922 0 R /FirstChar 33 /LastChar 125 -/Widths 1925 0 R -/BaseFont /XMUYIO+NimbusMonL-Regu -/FontDescriptor 856 0 R +/Widths 1932 0 R +/BaseFont /RVRURJ+NimbusMonL-Regu +/FontDescriptor 861 0 R >> endobj -856 0 obj << +861 0 obj << /Ascent 625 /CapHeight 557 /Descent -147 -/FontName /XMUYIO+NimbusMonL-Regu +/FontName /RVRURJ+NimbusMonL-Regu /ItalicAngle 0 /StemV 41 /XHeight 426 /FontBBox [-12 -237 650 811] /Flags 4 -/CharSet (/exclam/quotedbl/numbersign/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/bracketright/underscore/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright) -/FontFile 857 0 R +/CharSet (/exclam/quotedbl/numbersign/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/backslash/bracketright/underscore/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright) +/FontFile 862 0 R >> endobj -1925 0 obj -[600 600 600 600 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 0 600 0 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 0 600 0 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 ] +1932 0 obj +[600 600 600 600 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 0 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 ] endobj -742 0 obj << +746 0 obj << /Length1 1630 /Length2 15892 /Length3 532 @@ -9121,7 +9203,7 @@ stream xÚ¬¹cx¥]³-Ûv¯ØfǶm¯$+6:ìض“Žm;éØè°culãëç}ÏÞû\ûœ_çÛ¿Ö=kTªY£æ¼îûZ”¤ÊjŒ"æ¦@I{WFV&^€†ª–²‰‰9ÈAžQÕÁÎð×̉@I)æ4q9Ø‹›¸yZ@s€8ÐÀÆ`ýúõ+%@ÌÁÑËdiå ùËAKOÏð_–\ ø›UY\òßuºZ™¸þ“Ûô8Xüõ4w0sûgKÿÂþÒüE]M@ö. -`abû·Wÿ²kØ›mAöÀ¿šþ« +`abû·Wÿ²kØ›mAöÀ¿šþ« ™**À)—PHW£B¢ªU³m·WÛÔOrí]VÉ• $«ùqyĤ"õÂzŒf<0ëûë£Îðf}/Ÿí¤>bêFè,VØUd‹ÕƒæÔJlNÍo’©+¬OXÏ1Ï-¼§c-NÂ1ipÝ›í\AÖ úêì`uvdé,RHžê$žkK‚>&Y ¤ºÛ”OØ&â„o™kâÆœm§Ù WëÙÉ ¨œ/û«Ð[BÒó´`Ûtä¯äÍN¿GfáĈHªýmVéDÇÏ“Ÿ”Ä÷¦Y_kÉóÍ+èü1pÇÒ¨åÁ³ñÂjD•jÊ @@ -9183,195 +9265,210 @@ MIª\ÂuTØjGI-gýÂÓ–GâydføæÅxÃÃ,oÛ.رÌ*_ùSÕúƒóØCkëÚ™¨·>]ÙrÿÅ:K¥ÓS%œx ¿n$rÝ XðD˜t
ÎõÓ…”2§—n„sÞmOÆ„ ˆ;²ÃßshuåU9ñÖ&;y-sõP~K*ªÅz4rnp´}ª÷œõ)RB—+«å—>¢cI£Ž¹w× éhz€Ì\mm £MúHþ×<×|Ìï&‰ Ÿw³s£Üë+\?VË´<=yò‹ØH»M'²ñÑ67Cøoí+A5x5½·x¯'_Ë c!vÜ~óÓ4¶bIpµP]ãH^ŒúÀnkLßYßÙ„æÀ,•‰)tCœrÀ‘Çi†Ï±m$hýÈn.ÿ¶»öO¿ªWÂ[–{OFChÓ'žWùÆ*6L‡1±’g^H]u Ââa3ð¸g@—TÕL_1@d7¾ùÁ“†µ‹Œ:…‘XF.ÿ§Òfb1\ÄñSÙ£Ö®TÁIS ÒŽã{9.´ v´ôPš_$ƒºÃ™.T€Áj”¤RÚ.zàÂiXÎ^;-”ûkwå0HMKyÃûSc-‘tkâôk'a.*bí Û¶4ŠdÇ&ž*qÉŸX‡ÒÝÓä"c°4 *+9‚3£ cáE¢Lg%ãŸïÁó§KíÚï©=ëg‡~Q)œu‘Še7@ô`¥¡c˜„s2¬ìe/ï´Ã÷5ØI*·[ÔrHîD4;"«hntRÉ´c¬¥ŸýÝ„u å{ÿÁØ}hë … -¯41¶{ºQµÚâl·Pãg;‹($@QQ~:ú4¥ /麞e„¼æª't“Ê>~œÍÆTÂ={š÷ÈcW
äë6Å͆ÇIjË‚¶{Al ¸¸
²œísè¹”Lª £ÈàýÞùqœöÇ=*Y€þK +¯41¶{ºQµÚâl·Pãg;‹($@QQ~:ú4¥ /麞e„¼æª't“Ê>~œÍÆTÂ={š÷ÈcW
äë6Å͆ÇIjË‚¶{Al ¸¸
²œísè¹”Lª £ÈàýÞùqœöÇ=*Y€þK endobj -743 0 obj << +747 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1915 0 R +/Encoding 1922 0 R /FirstChar 40 /LastChar 90 -/Widths 1926 0 R -/BaseFont /IZQUPU+URWPalladioL-Roma-Slant_167 -/FontDescriptor 741 0 R +/Widths 1933 0 R +/BaseFont /ZXITPH+URWPalladioL-Roma-Slant_167 +/FontDescriptor 745 0 R >> endobj -741 0 obj << +745 0 obj << /Ascent 715 /CapHeight 680 /Descent -282 -/FontName /IZQUPU+URWPalladioL-Roma-Slant_167 +/FontName /ZXITPH+URWPalladioL-Roma-Slant_167 /ItalicAngle -9 /StemV 84 /XHeight 469 /FontBBox [-166 -283 1021 943] /Flags 4 /CharSet (/parenleft/parenright/hyphen/period/zero/one/two/three/four/five/six/seven/eight/nine/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/Q/R/S/T/U/V/X/Y/Z) -/FontFile 742 0 R +/FontFile 746 0 R >> endobj -1926 0 obj +1933 0 obj [333 333 0 0 0 333 250 0 500 500 500 500 500 500 500 500 500 500 0 0 0 0 0 0 0 778 611 709 774 611 556 763 832 337 0 726 611 946 831 786 604 786 668 525 613 778 722 0 667 667 667 ] endobj -680 0 obj << +684 0 obj << /Length1 862 /Length2 1251 /Length3 532 -/Length 1860 +/Length 1861 /Filter /FlateDecode >> stream xÚíUkTgnõJÀ+Å€€¸ -æ2@ Š&X4•;*(R’É’LP -A@0¨P¹TZ)`åb°¢àY#BAn¬\uÝôØ¥?wíÙ™?ó>Ïó½ß3ÏûóY˜yùèl$vEDHi€‹»ïA€D2ÎÂÂ…! í‚$0
-ߢÒÁ}t?Æ^›·s]$½ ¾H²/2ÈïÕ‹5ø¾ÆRBù2 €L$“ALˆ½ï¾—mö…ˆ…°ù".@¡ÚŠB‘8ìaˆ¾ˆ
Ë -|¨ÒðK–Ó)}ôŠQºGÚWSÅú¯¦–ùgÆQ‰Ý¾øÈ„Tùª×6–#LEøÓùߨŒi裳ßnÙÚ3µ%¶Uï[Í8t¾av Kw½µÏIkó=´û?Ü€ìÒ±y¢&6÷ÆvÖøíûnL/¼Ø5ÕRÉqÖ
ž‚fã9J¥÷0½ùžZuÔ=·Ö31@öÔ4Å<Ùây‹o™l:5Æ8ú·[aÚø»)£éEÓ_{êàM×ûï(o¨Hq»LÝLZÙò^mlµñÂ%Ø®¸4\cÔòxÿ/•`òµöÆÒ˜ePh~uŽé®§Qáß×mŸÝO?FÜ[uúà³’:…nW¨¿ã^KÆËvTŠ»ôꌼ†wb”„³kﺳ»äQœð=£ï¾ö¬Æ¥{B®¯µÒ›‡Ž_£è˜Ë;L,¿:ðŠ¹²lµ¸Øjƒ¸øRÜhï(Xy³£| K?œÃœ`¦äp¯ÅÃ8rœc¥uÓzyAwõY¹¢WÏT»O•e 4“WH‚øœ3º3ié^Þþ{µb7å&z>×hz_”?+EÎnÝ?ê§Ibžhy90n3)óÕ¥]ê,ñO6¶Œ„/Õ;ÛMçkÓËήU3•HvÛM†ÿÅ}¼‚¤,^Ôdʹ˜¿Œø}âûõ…!„Ÿ¢Çµ[{²¦c‡ÝN–òž«<kªJM͈=Žc‰Ý!8gTžØ¦ZõÓ6¨ãОÓðØÌ#á£f^Zúžeò+NºññB
Ïme>£+t<4ûŸÊ)Q‹ õS¯tpUÏæm»&>Ö½œï3|jÛOŠµ´å»ê}ì SUû7¼É8ð¼a˜óIèßôgü5¯ÂsçŽiŽ«=彊˸ód?ÿË`ÉDøÚ¼k·×DWBËxKßB{ªòèà ÕõŠ£Òú›N–r’ê6eü™Lv@I®ßÅ5ž‘¬+j«Ç•
ݵsÉAâù0èž²òSÚÊyæ:Vî4QQ@ûÜwϯ±T ç$ýÅßO‘Þ$t½Ðªm‘™”ú1*“'§ŠuZÞlöÊlô0ÏÚX3(U«¤{š@ªãÎ>ãm»8³~“96¯óS&D;êùp\pÖë=ýùnÓÎ×¼¼gǵ¢“C…|š€ûêjÍi“0Ú}E`ù(±¶ õ¯; -TÉIs›ò¯7”ï8Ëlòm~èp|ÝLã«+õ·•^æ+M‹zç‹+ +æ2@ Š,š–;*R’ $˜$ \(PÁ Bå"Pi¥´^€ÊÅÄŠ‚§F„‚Ü4 +& X¹ê +ºè±KîþÚ³3æ}žç{¿gž÷;ç33ñô!8±`؈ ¤În>‡@2 +X°€%˜cQ€ˆ°% +1aÌþ3lý^ú;ÜÃ!ô€e€Ì0!r–à¿G§#’Å ØÛb?‚¶€5öß„L1ŠÂÑÒÙÄâ[³¹ØÈ`X3q½ÝÓ!94¿&¥2î³s·¿ÿ€¤õ¢JÝ«ÙâWWÀeÅúPÏz™„ˆÊFK”WŽËða +ýÏ™'uÑË™î_N—ê^¸’^\á—@m&öø࣒ҥk^Y™2dO~4¤5£Ï|³m{ïô¶ø6³,Ýÿ\ÓÜ`·öFKï–¦›ízÏk¼¿ 5ð¸sëd]|þõ̉[÷\žx¡Kº¹‚í¨<
Í>²# ++¯§Ö»*åQ}ÖüzŒæ +ÉLzœaÌï7Ã5ñwÒÆ2Kf¾òÐÂ5Ó¯
Ü–%_W’²ö6»µ=´æ¼ÜÜfå.ý(„<h½êâHA{è£?Wƒ©¯Uš›ËãžW@a…µyÆ{žDG|×°sî +|IOÌ%a÷8Ú¨¶1ðößÓv›¹sNk(’Ž¹ªVÅhöèÞét)Õ•/Ô±v·Þurºª%æµiþ´ õo þ¾ùš36’“ÜŒÀñîÂíú†ërŒö’ؼ endobj -681 0 obj << +685 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1927 0 R +/Encoding 1934 0 R /FirstChar 13 /LastChar 110 -/Widths 1928 0 R -/BaseFont /YTAWBK+CMSY10 -/FontDescriptor 679 0 R +/Widths 1935 0 R +/BaseFont /YQRGZW+CMSY10 +/FontDescriptor 683 0 R >> endobj -679 0 obj << +683 0 obj << /Ascent 750 /CapHeight 683 /Descent -194 -/FontName /YTAWBK+CMSY10 +/FontName /YQRGZW+CMSY10 /ItalicAngle -14.035 /StemV 85 /XHeight 431 /FontBBox [-29 -960 1116 775] /Flags 4 /CharSet (/circlecopyrt/bullet/braceleft/braceright/bar/backslash) -/FontFile 680 0 R +/FontFile 684 0 R >> endobj -1928 0 obj +1935 0 obj [1000 0 500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 500 500 0 0 278 0 0 0 500 ] endobj -1927 0 obj << +1934 0 obj << /Type /Encoding /Differences [ 0 /.notdef 13/circlecopyrt 14/.notdef 15/bullet 16/.notdef 102/braceleft/braceright 104/.notdef 106/bar 107/.notdef 110/backslash 111/.notdef] >> endobj -677 0 obj << +681 0 obj << /Length1 1616 -/Length2 25061 +/Length2 25291 /Length3 532 -/Length 25968 -/Filter /FlateDecode ->> -stream -xÚ¬¸ct%\°&ÛvNlÛ¶mçĶmvœŽmÛIwlw’Ž:¶í¯ß÷Î;ëÎüšo~œµÎ®ªýÔSõÔ®µÎ¡ QVc1w4J::¸1°02ó4Tµ”MììLÌåTíM -°t1qpûÛ7G€µƒ™»ù?þÚ-ÿ%ääâø7Âþ¯ï/˜²£«›«™‹µ“àoVeqÉÿàéfeâöOnWë¿n€£ÅßHsG3÷Jú×÷æ¯×ÍÄÚÁàôrû'—)`níêdgâý7÷_0'ëi¸»Z;Xþz€ÐÒÄÅÜèêúæ/ö?Ýù¯:ÿKõ&NNvÞÿÞvü7êr°vsÚY0±°þÍiæö7·¥µÓ?£"ã`á`aþ»¹»Óú<€.ÿ6ˆúŸ™¡ùKÂÄÜÑÁÎ`´€cRttû›@ý§2ãÿ;‘ÿHüÿDàÿ'òþÿ÷¿kô¿<âÿ¿ïù¿CKºÛÙ)šØÿ½øÏü³dþ·h{k;ïÿSüÔþÉÿ#ŒŒ›ÉßVˆ8Xþ•ƒ™‘ù?ŒÖ®’Ö^@sek73+€…‰Ýß>ýk×p0ºØY; -ŽæÿóðŠ¨¨£À—…“ÀÀÊÍö÷ɱ² -"—x
r[Hzä-ÙÙc«óæXÓ¬ŒQm í-½èÄEꋳ’øÞË[=Yym ú¯®jµ|XV^hƒØrMYáXz2(—²ß6êX´oϯÛåzðïæñeç,ø¦¸µ©Æ‘W“‰¹dÖÌ!àPjBü„RËEW&ù?GƒzÖÔáB ¥9ó?ªsUe˜ÐàÇþŒ¹zþ¶#¹ÙÍÁ¬JÉôŒt36²o=Í`ſͽâL®W3¼:Í0J5WuÁ ¡.þkì9sÐêà -YN¤µ(¦6;.2P' -¥>®6Sô¹p¯{¡ŽMº7q'÷BSì\!#Ò
ì²Ý,k:èJ Z®{ ?ó™¸ z$©Ÿ{F”§‘€ -–u°U×Ðü$~ßÀÝîÖÐ¿Ä ÒÜeuãónÃöÍZ¶ú««ìbE¢°ÙAeÞbdË(j~nZ¢1«…ÐÈ^Óˆ+¹ýÖoK²±µ>”/81Ó¹Ì%=ô'åU-Ól,õ]ð5Uó/”Á¤ˆ"1ˆÝeÛ?Ó˜ð¬*à0ŽmzŒÀŒÏ&=t°óv%!—°‹&H=—pO¤'³z}ïI¶×4>±Íi7H`,e ½Óí½6 + -AZºM}eP„H‡§žÕ"Ùt‚aÜLæÝ@g¥˜£ !É ñ¯y€ -leh¯4³Àe ê¢$SbdxßW#Mÿ(\?'aS4©/K>ƒÝnèÔ„˜6¬÷Æ`š6Šg×!«˜[“wf×bRIñOð“-Gè…=lº¥
HYä°¾TÎ…k›íáx±µ,¶v.©ºø¢gáe1eX¹¢èÉUNÐÆlB¹øªÓ>îmcxé+Y»èY»m)6d`÷*ÉfïQÔ]%1E¯ÈU¿o:ŽŽ×¥IÓQÞ†Ào?Ô#„¿NdævB!†‘$)ó–×KŽxv…@MkG/f,p}·S¤µÅ6Ó¥!2:D•V³âšçà6{RWx®í‚7ÈViµ<epŸ–h -@uº@ä® ÀŠTœå’WÙ-ƒ -ü;RAeýöžœi7Žsþ5ÒñIÓŸ¥%ªÍäyÈ°—©áú’P–*Fñ
ý+QàKš©}%÷ÞlwQ,CÆ)=ž»Ê" 3£–LRw<;a!ªÌ(ÈfÊRb—G¢Ö1…›òM E[ÕhtÂŒ¡ÈI"+¤½?e–ø1CÒÝ·Yôä<ÐÐ`üɲ ¨Î°e…(-ƒpÕp$ߺBË_}êçÓªÓËYkûùþZMÌî¬l¸ÌÑx‰ë<ÚÓO¾C艋BX\唽4Jhõüá7Ð2
qû&ŒÑúwÿÌA*Öz½C¾Â1ÃÑŽa.g€ÀMnÓ“û 4¸=¿jy 9Ù`è…']X¦zý–(©È0NIíëk9K±FbêËRJ)!ØÙ룰»®¡q‡¦ìE¡÷Gη¨-˜}U æ½ä)Þ…ÀÐIÞ3(bÝÔ¾PEPÈKr]å]U™ ¯P¶LEqòÂÔø,0-ɹêÒÇ*Ö6h=éŠKS;¬n±HüEp2=96éU-9¸ÈQÕŸED€éD˜ŸÑj+Ä´k#™ù‰@G&¿8Üü8ÆØ¥n°å¤ƒ+ŠK–±«Ô4Q6nCNTM´gu„í¢—ýy|d®¸ZÏƼ‰›‡zü •…(¶]î1í~ÑÎÇœª÷ÇΑV1]F Ç\EØ%H2ÊuÝÖ”Œu}¯¬ÞdbÂÂy;²ø¥XO††Ìƒ(Hþé%_èTrzè©ùËE)`~6çÛí²|Œ5ŸVàP”ðyj.k"äçeÁS’݆-ÞÖš¯g[‚r›Qyv,ºgb£T?ߺUÖb›Ç÷ŸD~øàÉ`“ÈÇ›8b89<†9ìðfÎðN>’)»êÉøñ;™Òa[#CÏW²p?¶ªQ¯ý®†[>x”©ÐCk`+E#UÍ‹ô¨Îi÷ÜGNà%Âñ§»}ðš´f•¦$ÊùäyþÄ5Ò¦”·@8¨âeô¾.%³cË]ÉÑXSЄmÍO„X_(‹Cz>sñb}„óº~ë'_<m4ú-œÝ3¿Èîω—ßœQuŸé9îTHØ6cŽ÷©¯gdÛq'òV„mzgiüíEÀÆý¼\Þ›{èLŒç!Ãã—œ}žrT-¹rfålžðµ"zX€|29ö‰ç’ -j_ë0ÚCQf#dèÃ…Z®vòëÞ`©XRe‚Þ¶“ÆbCç_† Í3§¿/¼&¬+¥ž²ó܉ÈFÔïòÎÜ¢Pî)EïIÌv/Ò¨O³¥‘—ÐSìvm¹=–¶cê×cý3ê« ¥_Ba>éUDžèß´84—5†¸ô´%Ìd¤`Dœ™´ãI|vU@^Ù96¿L>ô•‰÷äv ØŒr©w^>w(dphµ5³]‰´MäA:bÙïVp‰WØŠÊ‹8Š„NdMjËñȚͪ~ÏÃMiŸ?oëµû/ªk·åµÙª“IÆ_4ËøÆ¿É·+€:’1fîúmv€1Xût~?ÀÎ(Ö4»c`
Ð⪗|•õચ¾ëU½OVp¥×Î[Ãq©«6‹Q½Ì ®îúÀw£c:£w†ôøo¦¬ŒììCz@ÆЫ®e÷îYi׸p2w•º)Î,«èsÞzÇjKÀ¬ç -õÁÈ28žäp¦£›ô–Yÿ -}jÀЖ¦EöT'¨4kâùÁ:¯ kN)4m{ª'¨8 -o"®ßÜ–},2þv~D7e¤ÞZ rùˆgÉžà±3pm?ÿ,T -ëîgÄ?)•Šl®/×ð£ Ñ]ÛºŽƒ†šÞŽi—é -W7ª°å:)ª²‰¢Ò8¾M²
cOšg<ºÝö§Ü½‘çÅåÍ×3K‡à^i¨g7ÎÅN`‡©™ÔÎKO™É·Ì~rf䉶MÉ™\Sþü0[:Im²z?¸,ÛY¼[YØÝ T_ôöNÀ[ŠôAf¿/èçÃ4ÑÓ¤L3³ñ±•4Á„D›Z8âD¿ú>‡àotgç{°ÑÔؾєAåiÌÿpÁóI›úžöâ4»èÊv‹M~C{ôš*¾T8Ù(Y² ©`Wkf¼!6cZEËàxpâuÆ9ÃÐ}Óá7uCÓïT÷E j²DÎ"0R/mx„â/!öFkÆ™ÔøˆiD¹—¯ÒLðVÿfô²< *ÉÄŽtûS3û nú>sF£Sc×Êå -:ïزAøÀêPØ5Á2#U[øð/•ª€Ç»¦î”n[WˆLØoHé„W¹„ 3Ts€´<±_Z_÷ÈÜõž/Y8VÖŒ6•ñíZ(D{Ô~‹Šc?W-QQƒ¿QØÌt°•ÑNóPtz'æ_!ÆμMÓ²·ý *cëè;Ç…X9Ï!øù©Ò -‘"Õôç|ÈÈtú<®{ }à -]’4ªLîl£+òöÁðt¤q©Èñ·*¾kÏø˜þ’3YwÂ~.u=è|›ËáAN@®¦§‹»‚=ÀôÕ~LUP|Ñy+cwFæéB´ öQxÞjÊd]æ}ƬsŸ«ØÃ>S,ÔÙQ‰Î¿ÚiSFÁêÎω ¿k_rÿÅ&h&o”€¶ÚŒ%UʼãŽN7ùäøcÓc*eQTæþìvÍ`éXb4o01j}OÎW†lÙÿGµ“æÙ‚ßE×x#KG7Ø¢ò“–LÂBµôE9rÙv¶J?F0‰×…Ä–šˆÞïXx»¼ûê|¶m—{·Ñc¾ -úÊ•REË
»Ñr:ýYîËñ˜ ùII·ÍWæÎаD0p,yà›ÁÄŸþ!ÏêS/‘çt •™•œÌiÊü1 ->ú#ÍÌ׬-cRÏx_QkÞ±{Q*‡Õ™-ÝQ^+b<y6Ö8‘ê fkw6IŠ;R¶×T
?~¡˜5‰PdíܵzwZó²Û´ÄúóÓ¾ÈàÞË&Óéè’¸_É×_]m=‰ÀGÛ6=Ý?%¹!¯ƒ5i‚h1ÎZ]b îxÜítsÃ) ís¯
¦¸Ø’ù( ùX¤ƒ·`bÅßéµú€÷ð@l{(ƒ.•ôF|ÊÏñtK“MîvîØóŒ¬É¾»–Y1«Y£C=V<É3-Vêàõ0œ=ƒlðaqʡݘ’
Æ_p¸¥BøoU¯)ÆáQá#ªÝ{eN†û9Î(ÔAïé~ýÙ0EŸ"œã|K¶êÅñ¯¸1pn»‚dNƆmU8'¬ÿ=ó¢`íuwÞ]½dfŸT&YŠ¢žnª ƒ“¤à„0‚Ø^ÚTø蓺›M×ü˦Çdx9&qÖ‰–Æßp±p3;™*–œ¢Ãêc Ö½³ª18«°óiÉpÆU£@Kèçø÷'ZkÓÃøè÷©ìzF\ek9-‚rrGnr÷ÈÖÎf[Ó¼¨¢ž5ÇbÕJÁ%!’õ‘o²—r ÛJ(hô|ÉÝI¸<ŠÈ¦€G(Åa—›Å³¹“勪âs‹(ÛpÌ2ÛýXµ@û-5=ÒtN žyJc¹fza -Ê_ñŸÃ§ÑÔèõðnÏ c›Nê—ÃIlŸÃSÃÖ$ÓRAkP$'ÙÆò³¢lÁ‰“•¨=ÏÖtF%ç̾O¢-
8b(!O¥®4öT”Ä/-_0!Ô=èæöx)”ƒØåÒ‹ÛBŒÆ¸@£"‚8I#ÇE”b8¤‡O“‘w©O»Ž$Žç i'À]K-xzfÞ]üïË t͈á*(/ÅÎú0aOcº¾FÔ»å5úÅ+6öÎjxÉònÜX‹{˜SÄ…œ¶F‚máWÌ{ߣ$qum»Üø
çqw00_PC^vÉ'ÌQ©‘ÙNòáyÃŒÁ_A¾*ãuΛíöùD«dºë4Q^)ðO½öa»þhÔ–õ³¥jÂJÕ¾‡!-²ÕÒOí±âT"´xâ±Z´5ó-ÁÀ̲ElJ›VŒöù^[úkJà•ñ¢^Hrï“Ί€‡ØïO§ŽoDEizÑâ¥/ÝëÝò@,²ŽÞK;ñzàÂ//+s›I‘"_«ó¿«h˜+É„éq
é¨Wn4 ÓGˆ²¯%±_0‰Û ݸMÉŠÙÆÏmp ³æu£ª1R×õ!^dÞX€ -¼/ú¡e“–NfoŸ=\îÒ.³p¤Œÿg Æ"‚í¶K‘2›ÕýÞ ;¯ÀƒÓZU1Vµõ+Ê[ò0…=¶%Pêi~.½ÚdìÝ´j¹]ÔSŸzl]GU -¹±Œ2e8¿ûž÷‹£Ï;ãÛéå¸D(-’PÑΚïXíj»<àèékÃrt1fà‘ìðÆ"e—_¶Ë/ZÂÉ™K -äÕAüÞ#(€ñ³ê[&H8¬ëé”//ð'tÔdN´ÖÙ–r‰»M¡Ù -wp‘éõó åÑûkB“꽞ü³süyí)ˆ¨X²59~þ¿¯ï%v£‡"w‚é„0Í>au#§PùRà!ƒ’QNT>d⥄n0ßÊjš‘â¾BÌ¡„J»ªø›Ö)²‘¨V+ô1«éƒÃå¹;ýÐb1±’4Î5¿[Pö²ù¶£sw~ó#l -%p<ƵulºM*sLÛVXë$„'+kË’Tó6qI[ëRÛäHJìTÍR70O!½}Ó´<çJΚ - . úBU*R‘VI*‰~†:¨ª˜M]ªßö£ˆµ-‹•$ƒ@¹À\F?ÂŃ´æª]Ä$ÙxãÑ´ÕëìZx7‚\g¸cÆÃf¥B¸à¥9èkItÃGåÞd^jÕ·«¤ãæ€þIwÿŽ®„g'éÛµËÿM5‰l ü
hd¥}–uyRw÷º41]›u·ÎQ,f¢äá¶ÀßBû¡ýE;&)AD)Õh³rJ–¨À£=Ç.¨Þ‰@¹#VÊ–GG¢Ýþ…e§ì+Sõø*ë<*zÛ±ÙõÑ”ª†¢éÃ}ü
Ü£?ŠquPibîB!B7›²L@UÔîuÆiHà q–^ã8ÌŸ>o!"="¾å[½†¢"SÖºþnŸÑ#Ëå¹¼PGËPÈ1Ù,E"ÇyG:í´æÎ÷0ý¹z$J¬xÀo„…:f±ð™µm‚éø¼MI"Hv¤ö®òÞO5.ÅpÔ]Iœ p±úJžœ‡]H—ýØ$çO¼ãóØ`vNܒЉ¼â†ƒá•Gñ™®Zú«²øá·(«†ù·ÿš"à -RÈrdKÚ*Ÿ¤\*9f+2æúpŒËlóž°I¼/]Ù¥QÔA‰Ó€kŽŸ˜¾›lq Ç¢ð/Tg^:RvGà˜H…ØøH{Œ“HÉîd×_³,ˆÉ‰ÍNñŒÜ<xK
t¸»8‹ðÿæ¥
¡Ë…ìdíº…£—Qá@ùš—`ãSYN§2GM(t–¨Ñ£äÌ/¨ñ"Z«rúGÊO‰Ï‰^²ã¦/%›Ý‚Ƶ SgëiËOC(:å÷~Ê4Ÿ.óÊnädy«‚c˜ÞÁýRSæ’"© Òó -‘²4‹g…ÌÃv`u*“ä¹àð³_˜Ì) ¬}©øæraÙ*×;î;»›¼=nâ)MÔ‘LpFäµ\yå”àúËôá8Jy8¼ºEg³!DÃÛ#ëS$)ú3Åîå¥Èoéú'DæƒkP¢¾chL³`Æ/íËŒJ¥Y¢ß»Æ>‚Xä¥R”/…ÓZíÇô†ãLÜu:ï±÷"Ôz¯!ÖŸÈpì“;qªMŠ•…©• RÈ.jêEäÆ7Yã)Ì×ôVK„vvJñn¨éÀ/˜”_èÒ×E69zfŸìˆjxSp‡M˜8
< }ÔL†PüxTJÜÆÛo½Á9ÁÛiWÓ¢|NsÍC®ŒŸ</ÎKû˜™¨»††¤+â‚ï—¿°0Az{¾N©8Açi ³¬¤wkR3Ü´pÝ!¨2®É9Zdâ~WÞ¦]F=¢(XÌ™á\¨‘_?¿<yáå¨aŒ -¢°cmí”(¥ƒ¾sÕD¶ пû°-
ÐSJC_7æšø^Œf鄺©sŸ·:%/Ò‹%‘omoC>…üÉxÝô÷éOBÚ÷FÒ0® h@Ë‚kápØ[ÈÛýNm‹•=sÙló¶ÿ1Fä0·Š2ªâØg
gyGª]¾úzÿÍUaÀ¾W¨Ï…—"³?þ¦«D·°ÁVVnŽ}ï-ôz`ȼÃÛú*WÄÂm/Ž3*܈^ª>Ìš…ùfÀu*´Ó.£È“3O×Çï s/C6þÕRí¶p¿J Küh€GeŸÆMNb¼ˆPr’•‰5Cøˆ¨‚bͨÍ~Ò´ü!Ù÷£@e=\ûö@¢ -!§âe0ÒwyëÅÄ›°$µ«‹q.wà6;}Ø^Ù¸í(R -/÷¾Î*ߧ›UC·H®Ðû%
3†×÷<Ü÷û/š%=QÐÛLæ¬MÍÜ+‡¥B¤Ki¿ö¯ÎÊÌNlK¾Õl™!ø&KJp®·[éµ_Y&•í%óU¹«¿ÆÜ[SÁ>æÏ·7[8xgŒÝU抯#Dýƒ¸Ž:ŠÈnåU¼‰âz"דø ;“„FCϳF+õaX/b»á„3ÅÖìÀ=#>J…dÚJRýßS3çÊ”!‹)~¿@ÓÞAõ2?d3òÊZׯecŠWMi,ý0]y8yñq±§‚q€ËÉûƒÎAfüÆ_þS‹1yM±Ù-~òns%þwèO®úÒõîg¥h±êû4DÚŠw-fy^×Ü€‘â^|,Mo±>…2eýšÈ ?ª”¤™4DF’ -;å¬&¸P±öÊ‘>çÂ’‰#¢!jϧœuA`9‰GBÇæ§Of• -wJÔúB/.qfQäXò‹›b¼¨)¸"Á,ÈítcG`Å«ßnÃ7&uù;eßÊ
§N¬º[ü\™\7’M¿mLªræ‰1ÞϵèlH 3Ý!r¥Z”°ÎT ³¥/EÐaß¹;™¢l¯:¶þUîÛû¯Ré6‹@eQ¨z0Úõ'¾ùYÓ(UY¨o®&lv4\ÄåÒ_ɪFC†ãñœj*?Ë‹Ëg~"¶!¡’Œ3ùþ:¸äë‚"¯=Ag ƒ¿| 1Ñî7öC$¾ù÷}†?¼ª¶~ǒ稽²ÄôšˆfÎ ¸<—a¯¸#"tÑcŒe!èË¿ŽŒv.ÛõÕzµN«Xí“Ý™N—LbF8ÏÕÕ4PW¾>³»’#GÊdÔëè3*æ“YŽhd ¨ ú®šµ±¤Õ$ÍÁrR -ã:I‘ì×òõð,°ˆ²ám©l×曼½€#«[*A¢¢U‹5Uí³õþ·¬üçápM#Ó2O(ñPWSxœ~þ‰!_¿Ú»È.s5%Ú£30ÆÞ=ôÏI¯ÛI"[€/nAq‡{4}¼ã‘Ôþ‚š-Ò)p+ÐÞ„efTZ@¿¤˜]ò×=ždŸ…±@_–{سÆS2{*Jyk/Z<ü–ù~õwo/¢l{„͘Ï]¦ý.ß®ªFÝ©e³§tH‡§/
Ñ™Äü¥u[Ü׋©$ŽáÄÄëã,UFÖ ÞåŸW6Ëj›¾½7æF7ñ
£Þçréq¹'Î0¿æÛVÝRR™$ÙÞƒhÿ7GÒvÕñ¤®ðàäeïËÜÛ -FñÁe¿agöÓè7è—‹Þ|‘Ô7ßo×M…•ºW€‰¶•ÜËKïØ‘ƒÅ2Œöý¼iFØ6ùÄ›¦«oR²LAJ7Ò'·#0ÍÒk²ó§Ð(¤ñý'™_Ŷ‚ú°ÜdÛßdÓÙ+³Üœò´õæyxáK/ìj!T>‡ (FÉ>òþ‰VŽ-®yôyñðÙbþ]s¨C2òù¸2úÐþUû¶‰
²DjÍÛ#) ÀT+PØûº(T!Mð%tÜÎð9Cñ<Üí -xýövB¶è2bJ®ÌLÓY>=Vàr?,(f»«iÂúŽü›NÚ8ŒÖÝô¹Ëº„0Tvº@ý*‰’(ÿªÝfEBZˆqàÖ©À6º Wì¸Ö÷d¹C6n¢BÔ*Ä"ßk° I6”V³6èô8ÖÅ.,O‡lÌÀ>“#\µM²õ!HèRåƒmcü¯º¹ -`ìgcxþôaÈ9P|ŠRm¶£Ç"`¡²'“ŠÏÖFMŽšNyÚT
·oe¬5<Ã-Ö±Ó—µ»WC¼³l„†üÈӶ߱‚$â[Èš¨Vp~#B¼-Èä˜åô0RF~Ü~g™xò‹…že††f@)‘ 9! -90š Š\ñ‚³„tŒ¶òj´ÅåC–ZÝ4}iÔÑ™ÒV{qÁ4^Ág×£Ö*,Úæ« Så=ö«j>n€'*S%:ÄWª˜w¾F¶I¤áýaXä3B¥z>Yø\I±DQ’Ëx嚌ý:l¤*ÊwAÍÔÂéjÍJÕ¸\ÖbÉ åÏ,ø06”6†Ã -O†½Ð¼ÿìát»¾£â†¡þ½äÓå`K:JDm’êP4o變o݉4-gÑäê¹ð -"ü„£ÐD‚oà^b±IÁ÷-‚áp,mÕ8®V¥‡dØÆÆ‘ü%kû¹ùð· „·²³Ü¨7úüYCµ%Ýéï±³ëP7\ây<ìc¤LšeMu ©Úœ6²†>–\sý]C:8yB69æd‹)‘SbŽ)Ì:øL€ãŒ_`ùI˜-BN|ÇaD˜r>g0k&rIöXkæ ”V2øÅ/1™‡œëÓrÞ0ÊÒû#䳜Æg®BAÓK°™“„JR -4£C!µ*•Ò&Ê(aYƒ?c4[¾›÷>˜SC_¢?5›¿+Bí÷Ð.« ÒëRÒ;_öç]bŒ"fT·Ó¼À»š¥‘(• <mÖ;ápú²49¡“<oË¨Ô -ŪpÉíÿtùátI -†Û*üh»(bxW˺~CÅó¢”$”XxèEš‹ÖùxãÌ1I"Ñ3ÑÞÏAÏJbÚ)—½Ï¶£«S0¾ëºóXD¯fÅ(Š|d×egªZO*voÛãÐX:_Õ'Ôi¿{q:?·Œ®í%Æ(͘¹ÄdnR‡Qo@N©>äš8<å¾ýŒ‹Í³Oˆ¾Ð_ô1ÀÀ‰)ó›sÜWȳgVšÍ -qmÏÌàcEB°†0æª/’/N?yœÞßþñ“—³qTј:8yA«ïïºáή“hÊÌ-€PͪˆÜÅeån²ñéf%$›Ú±“YnyÅ™ÝbIQ~_™¶oà&r8›[Bž
Ài'”<b.DöD–;†Ã4~LOìj“¶“#x0Vªžúݶת^ -³à8Š/ÝËOþB¬ºc½NÅöT!´ìX£*Båµû9á+é!<«
V™´u4ŽÌ×ýmçNËncéDŽ¨=ÑúV4HbÚ˜°2‘Ï_êÉL§Þ–67…uÒ¥SÈxÒé:çÏñWÎÏ’Æ"¾®…ßߌÍÅíb^¡BŽóá!³¢;ˆãñ2¡Ey.˜6”•>‰æ9ÎÍôQÃâ -Y6Z*óø+9#«8wØ|¼4N|k%;îˆ"äAçbJ]¸ø«Æ÷‚ÇT6„XLäÝñº4g]D9D•F¡7a‰çÚž‹”b|ÍeJµ+j¯»x*]vÍʧե º1`7`e‚>¹ë;¨ªì|cÄÏ}›åÎ/ÞoÈl‡ÀºñÂ3ßçH0èöÚ-(Ç…¶jÁU<4õÅ‘¬°Ë¯—ršWߪ
¥È‹F6j¢×ÛÀÌWñ áÿ‰M(LóMEÑÍ<¨í—J+„9ÙQÎ([ÂpRQ‹0CgäŽqd?§WE;wÆ–…¤†${N†³v1<«”¾SpN¸!6=ç,ÝK¯Ê:ÞV+*ʻ࣢P†]ž‘5ÃÆFS çÚåÍzòøÛOª¨GîËiÁÌ!ÿ b|TØÚø€ÈÄ1e²{'U}f<`·AÁk¥¥Ç˜Íj~¨ÎVÈt®Æ„°¬íª´Öé k^HøÀ?5h‚LùF'öÆÖƒ&-¢]\<üòt"e¥1/U½Sõ‰c±Ç¸Ùæ¡®jè1ù£ÞÛyE9“Ÿ'7šÍ4l#>´ç`xÈ -l®Ö/ÏŒ…°ý<ãÓöxyõå\¤.çé;ãËÃÚöø¢·¯=‡T†QQ–2aŸF9¾(²™N™(Ô‘üNa}R·pf¶°Öz(Fý‡ù†=èÕu¬¡RòX14)Î\DJjg<¿óÑbÖIÙ|
0RµR—¤k¨EÙïº Æ Œ¤ -í³|Ïõ™œHa™€4ú@»ä/ú£sß· -™#+.‘]q&½‹«
hJ©T¦:Ó’Q!0
`9
RaÏˉ'·w¢HÐ\z”Œ>Fˆ} -sf³±jÍ2‰ -.\R^æ•o;gV;§¿¢¶Çù‘fbîI$c4ŠÕŽ"7%€NWãJÌö,YøQRJò Í6®Kä‚úärSÌÇB :¹õm°S·Î’!Ðu¤žöºÚÏc!–ÙÆã|€TÔa’±dsXA’¾ç ß)ÂèÜ#rî_£Ð¦ß¤¤P£¸$<™äE3*ÛóŸÛ¥§ÈAì˜
Ft‘0í‚+'+yÑÔð¨èYÒº%?5Øe=¼\}ù“ƒ%˜Â)%9EJªÛªùq2ò¤F×@Dn©6봼礜O}Â0*“¡²^ŒJ¶i€X°¯ÀIOS9 ×çúÙ}{¡Ñ+Ò¹)Ã%¥f2öB+è!ŠùIXllëòè&Êg"ë~Á:Ýö”:Ys§>j¤¥w- ¡/r*ÁÑ£¸ÏSø°‘³VÃIvõ€Eë#¬Ç†Áâ–1F$~„}â1;yV®"vÆŒ;gR~ S±ÂƒŒlÀ hràE¨;:ÉÏ3ÔÜ>r˜÷ÇÙ 4upcñT·’~õU) -‹@Mcpƒä½‡×µ¶¡ŒËžÉò`™TîPm/dÉ–°ƒ,¦‡ú\‚јýÎIä›îs߯=l -¦ÜÞ°éˆÝÜb_ZFÍ’L”
ç“sÂgúœÓ›”pzŒÄ¦ðñÖ÷µfi×V"¬O¬:·Qîã~®ÃZ4ÀD/BEƒm»á®®²3ÖŽçÛwfÍÌÓVîÞ”fîmY’ìAŠÚ[UGÌ7¦6 V·hûBÔ@ÛC¥Ž¶;µ'úÓØý ‡7ø×âÕ„OÚ‹¼r.±|¥Tý±ŠLs”ä ¿Ìf¯Ÿ;ËUŠmK¢°õ©5Œg
½C¨îÐÇåª#¡L›q’Ý3R²¢?ð/™&ô=ÁôcZ4<˜Ïm÷êØz«ÈÇ[ÝB¢òMÿhäÖl§¹Ê§œ²íÛ„LÖ±x¸•Aû™[bv¤uËE0?_|O
Ô×ëæfB¿{§$íÅ©rŽ;÷6þÕµž:Ã"¡&§;*\U„jŒ§Êž…lÙ5̳HU;ËYÂD™0œÚ7Øl;½¼é1Q‚D½±—¢IíOùʈ¸ ƒ -b´Îì(«£IÛ{jú»±Ú3í½ÏéÒªXÿ|\hÝ™#XòèŠ_^—7ÿlÅx$×ëËrÃKÂ'”?õ[õÉ¿—°QÓž¸}ƒ[ê!&1‚4AhLêåSÅÜ”qâ>XâîeTfO®\pCÚ ž¿òE?àã˜fB܇Žrm3eμW_Ÿ±ômšY7Fv Ÿt¨çÔDƈP.=Õ"tHKÆ‹.‡4›žaÑ!ƒêâÖ_Ÿ“WJ%`Fµ€:¬ä:§ÜI?ôw?ÂÚ¤¦ÍÛŽJŠíPúþeCiq¢E™w¢n;³‹2HÐÍ'a*àæíÅyîøn°˜š¢Ïa2¯~T -‡}ºšíPøÌ^Ì ã~9|t=Ž%ÿ©øóÕšÐûäâÿ×âÒöµl/îh¨¯šs±º×Ø¥T9½ÉEUTJ–@”ŒAQÎ'4XÏýv;—uS]Ss½Ÿ–ÈÿàÆF`‡ãŠé+f¤þ[¥ebǨ‹åxŽ‘Rñ°<1?FQkáÆ c¨üè#?Žþ&.-AöÔÐ[(CàÀ¥o]ô¯½þœcpàÈn÷Ž”óÄÁp˜,\’@|†‚”Ö$.DS`X¦a¡™ðÌà,(8‚Ùvãñix,?"xŸXéT–rÖ8¸–+ÅÖÚå{fÅÄ-(6¤/ÐKwäÙùd-ptÈÊq2?àÑ‘xfß|ÈÅŸ¤F† ñ2òjÑà9tñmÞ1B4‰³¯¥üúUŽäµš[wŸy<‚&üš4ñ@Òà%GòV·žº·Ð.NRé´KóÙš$ŒÀùSN¬m[oðÝlˆÓÏ#92+úÇ?e‰×WÙ4Øê¨5 \ÕïÒ<?§yžvcÑþÞ)%Ÿ`ViWbù€ÂÔ™
:=[ŽÐ×¾¼f£eìáµ0ôÁRÀ×QEK0‚-IÃË®ëLÄætv±™«éÛ–Å:Ú–¸9c ‡_>6w¡íð(§¬íìàò‘£}1tUüÖÀ_€>*'ø’ö ‰¬ü¤éÉ¿8*îÓ—¿i>ÀÈÛÙa8mù‘º½lØÖZÝð{Xþ¨Î¡»c’P1¾Â©e«Fm¦6Ê¢øð„§£0*£šß—L[NË|äm -.ó)¹)ÛÍߢßÏǨ8Ë—ËîÁÎïÀCuR5‡ˆb¼¿(ãS]ZÝ+ïa›ÒìÛþkª_YGëVâïbaˆèþmmt/:ÅáúGÒDÄnB{²Ø?§¯1i¶Wéž¹5»/èzú¾éWƒb#½cCÂù Ž¶*_6Kªsálssy\½mQõ·]»p¾Ö´ßcÇ"çxÓÍËmõv€qËdíy T¬†eœó÷Éc†Uï»ó˶—«C®Sè»XlÔ -ÓuÅl–Ä=§‡ÎóliŽµÏ®ß2@A7÷Ï4.¢”K{[s߉Ë&MÔ3V¤eå‚Ÿ‡´Ré8œÛçýwñäìÌR5BÜVxÚï 6þzÌ(î ½º È%Â3Í@½ºðéŠúVªI%°ð&ÄEf©¢Wÿ¹Föô"ê/-or@zZSö<Kl¾Ck:úw9FŽãqUk‰
oµ€Çï´ÓÔ¢’:(d›ØI)FQïŠ&
Y‘5²ÀD¬ˆá'³ºS¸ªn0%FDCÛcŒsÏn[ÐIc; -›u*öctIñ¬'2͹Ù>Ëk»¿ -–J3ðMÖ
£«ñH¬a@¯œÎÉ÷k®?s½la`²ÉÕÀ¦7"+GQ‚ž%ŸÉ79µµøèµùÁþ‰˜¤–ß9æ²ñÓ.éeØý‹Ýߺ™¤/ÇN¿HˆÓ$:°øgL¯Œ=ßÂôäuå¥xÅ…¥Ÿæ‘ÙjKÍiŸ@·©.å8Þ"ih«Œ›èµ8!
õÔ1e± 1'‡+0É]Êò»l)Ú±©S…⡾q}lY™ø1¿§M
Ç“«¿¬Žíì²:RÆ0ÁØ°§ÇáˋÛA³†9´9\v~Ë–©aòîo=ù"‚êÆêë%á{3Ý’Õ® -~J]áÿÎaËŒ¶Bؤ™¾oÍHϬ„鲉®‹¹.ê—ë|ùç¾0ðòœ³xcÚq ry×ïІݸë,«ÖÃïï¯&3sDÄžíÉþ¾,0ÂY†û44ßH¢3ÎÚ~%Ï¡]óŽî6 -à[†#NÁ3ŠfêvߧqëX¨ÍÝ{ûeaÖQ@ßÍ}kYzéB>_¥UÍ5îºÄ7‚ úÊU¿Ø‘Ø'+u7»ñ[–¶ûŠ†uVÉ„½x]oøŹpQÏò+á]ͪº9Äß—cÖu -ù=€«ªû%ýš²B»¹Øœp«îfq»sGTÌ•WÒ?–9´°$E8¯—Xð‰jU·«pž[…þ0&¢aoìÏì+²K/¹+9ù²g+,6@^›¥Î~R=Ïi</BÿºWÂÄV/Ü›åÓ<6e7—ûý„emP°{Ñ4{æÖ-
Ò‹ïJÿåAŠ2õøD[˜éWºç~÷ûk]àÉTðÃW¶ jr¶n=]ƒþfŽuõ8Ö:¬¸áÈ[¢‡7ù«L·#Íö×4Y|€¾Sjènß“kÒünIçØ7¿£o(’‚&²:ÊÚ1á¸
yµì{5þhî¹gz²r”ÑVÎÅPyÒŽzôÑ|NRgÀOn.øüFEÞƒq”ÓWf?l§:nÒú69ý…/Y:²}§Ç祲î¸6ìÜë7az¾3&4ìžþ° -¬kr ÓÄÇr} u
+Ü”¶Ü[§ûÕ–0>Q„…¾Ïr¶kµ3ç̼ê7âéL×»:2ýõ<—‡ÌŸb®_>-z˜Ú‹8„Uåg'²¤UuŽ€mvf»ö!úΓëJ›ë²pZ¾Õ9äådLÉ–í”° ªúªä7¡Ð>÷ìjFWÄÑNƒ\¨GŽÕïí¶ëÉ„+âëÐ&Ø¥ŸÊª?á°0²|Ÿ³n`³¡ñʆ¦„Ëz
Çî'¾Ekåh%(m±®TQþM˜¼îÛè¬nBAá÷¨–Ðh½71ñ]6þ¹£Åa°–¨‘£0~˜ôD©iþÑÆDÉD‚ê²ÞÞ“Ô«%N×…b'Ýsãc›pC<}oC°éŽyÇQ{²œhöItßÇ`[i“ä«kì}Æ5bþS›å“?k{뇴ºý˜üyý÷Rfê·/ßËÝvÖ9ÔÍ!dôQûó!á@^Ĺü4ÆÃÝ9&^Ð^µ
GÑKŒ±,&÷îd+z.ø!IÛÞYS¼A¦ùWmM,I Ðj€æ+|“¹o&ºæ‚´ÇóÁvÎý4×V×KÏb¢ƒêÏq{Ó¸R!i0a7ŒQšbc©ä¤eÂy°X£vœsÄ/uÌ@çÀ1a}#¾:ÒÝIrÝ_ÿšÌ4@¸#ùO}*ÏRÈZ˜»âŒ§wŒbüíô¾0#VŠÈ´J†õ„ïcÈÎ2r<ã;Ä¥4<R,IWòå°^¶˜/½o+JUøê¬Â"AG†¼1(Q|ÝIØZʾÌKƒÖ›þÖƒðÆÓ9Þa„˜Ì ZÀ%EÄPsÐ’ñð}ùsÔr¬æ_¼"šØ¡ƒßa»/ËQ¸xV]ÇŒËÐ> -)œÊÓTU×ÀŽx(S•ü+Õ˜ºÉhn6÷^ê->97ø_Á$k©½œð––RYö«GÞ.²(²Ó"ž,‹ŽNWa¾üê‰ê˜*×X2/¥›ád:"!1¶Ò<7_ËÖÌÌ.j'kí”6!À -Œ8¼TŠRWæâ9í.ž©ÖYÈ‘€ÁÁØ2ñNæäüY4Lᯪ|˜oc%|äx±(··èŸWò(‹xiD,¨Þ Æ›hq‚³Ë ŽÝª±]Bž#¤@ZO¾Æäô«‡‚½}p¾Qv%Ár_`£Ë§ôQéÝ/èaÅ)ýS;.Ì)Û²ˆÜþÙx£›1kÞ[ª;µÚd¡oÞ°8[¡tÄ6Cí;lv€°D41¯å
RÃ(´Öãí¹ æ»kr8ûŽ˜ë¡lêo
að°åf& -.$ƃÊQÎO/UŸöÑ$2yÿ¢Ì$¿ÓÚ£Ž?߆\M$]´áõ˜™! áÄ3¸žjIœè½ÛÐÞy ÞêœQxu«,Ã1RèGÅ}²¹é.*e¬´“gS_Þây\˜<~Å`K ôsWJ{\|=eü¤yɟŇÐúšö©>|U=D6ÒB3iƒJ›ð"-©Yå?%ß+æïê¾Tp.ˆd)¿Z8âÇsDFO,L%•!<ôKæá%L)ßHõÓŸ¹?¦#ë˜<ŒüKð<ñ%§./½<T¹$‰3KDrÛmþèa‹±gy «ž
|êÚY"enèiA/G.hŒ2i´ÏËJá©uˆ¯ØM. ”A˜l;E™¬÷¨Þü“:ÑäjÇu+^éX¼ðîQJ÷Í•ó~ @)ñ3…àVþˆÙî'‚¡2ËQþKéÎYšØ…¯Á”¥*W]LÔ\(}I¡-”’ηmIï]Ó'šATàãZÊÞ=\r¯…ªmW3T‡¬:ÆГýpR%TvŸû…¼—Ó¹ú½”Ï/ïè¦v/{½Èñúéï%7=A}i^…·qâºwƒiÈÆgÑþõ/¬ìÌwD¥îT“]CœxÖ@ý«kÙ‡]»}VLºÇüe6Ë -ªÁ ¡1”ÕZÁ‚àˆ=ØrB =-…ü> -!?Ðè‘ñ—Ådf¸÷•Ï±ÈÎcÓñÔw—
Oq_/0òkxLu\ÎRýZ«ïüd_¥Á¾™*˜Ð‹l^s>PWêѦæé—¸y5×yÉÞYš¼jli\aÄâ’šÎí^8‡/cyÜ}g‡Œôô_Þ‘òïªðk_öѨr.
ã -末vß,ybÓœrJHÅ#n}{iÔúìæzfï¦ÏAoéú2ºÞ¶HG.‰ùq6ÐóÝSdùLè²Ä*öåpÑ,7ĉˆÈ,0šqDµqœ¸3O§÷—'H<q»’›êNœ^$q^åTÄ€3–‹(¶^„?¹Šy Xøì²Á¾vô¤Ù>†Ó¢WÒSÏGuu]„††TôöÊgäêÔ”3Þ{§tRÌâdh´š[½*ŠOÍòÎùBVù¬šq21N{›}×~LܯÆù -<>ݯ¥h<òÀ@"«
ºØïÀ9ÉÔZɈ”òœWÄ«ÕI½†…*GIÛ‚þ!T¶þk„Õ[“|<²…‹Ñ°â£%Q®¥/ ºÉJÙÅIM.²«b¡ÜÞ†1F)—½¸J¦–oMùÎØ‹^>+'ø‘ï<¸ëÒñ-¨ÀÿPÐSýE\üïá—Ù
Qš:>°ð"0èV乊žW,¥ì_ãÅhý$Ù9¦”/À|£ZÉ<ö–Ê‘(ÅñWµÀ]›Q8ªN“Ã(~ö¾}:-]ÖjwÏ)áÅ@;ÂŽßQ®«ÊBí”èÚsã,]hÇb:Û—K)4çŠI„©ò>Qõvªaì0±0Ÿ!• -@¦ðÛÒGì+œé;D“±}¡Ð—ž~µ -¡?ôèMô©ê==зÔf®2 ¶‹Mªf4ø/ÓäõGáK› ”ÜZÕ†§ÓSþsT:ÆF)¸ÛÉ=#|2õÊ’ªö\:`¤Ú¼îÂKÉÀÁw{m
1ÎSk¼¶`ÿ¼6KÑôüc×ýhºÙ3IÜax>ójÅíõtããl'‰î0‚à‡êõ˜BGßÅΦòF›þí´ºT\Eq©S1r551LñYADôìå…_ˆ²¢ÄZZ -¶?¨žC$‰ë»y„kˆâŽL<±4–þõ /nKgÓÒõý-ÏUÔQr?S²QÑð²Ž5úÁýГ&Hë{R×î°â'=ä÷
hþp·~õŒBtŠJ©IpãQ¼R~¯ƒºý ¬ûäŠÂáWv}¹YʽóëtÇÈwàe"Gx þj$”mÂëeÎŽ¾ê¸µ¯4c~:ŒÌ7\T-n×ÃO-ôÖ›2f‹§+¿ªýtÀÎtnCóí/é
8¸(8–f‘¾á• ¾/¿ÑüØ»e±Ëî'ݱ՚Ûïccp¹é`”;˜A®•!XŠ$zȪ‘¬ok¡u㉉„ìJ3<ÛÝä%Ö©=<ÏÏl§Y©Æh—!H‚z6÷xˆ9¹Â0ò‹±ó§$ s«…rüÝv†AÓÁ´ÜtÚµŠ1ÐæêòÃæ¢ì`§a´ß‘^dC>¹¦D"Šô€zÒìæ/AOÁ}`Û%þ«\Ø[ÉÖ…ÙuÜíƒi“ÈG,djCÕÁñU¥ý´ê[¥!ë/OÇÞ^>ù¦ýó¾þ¿XWm&›ËŒ¥ù¸˜1gèS¸Àys¯ƒB÷ц7”qýCIvcØV«Kçâ´ŸS”JÚ*¢Çõ˜,}¸VV
”iײ÷8ÌÅ÷Ç¢D3Œ‰¸¾Út_/g¬"0ÔF(YŠ[fnMœñqb/'%€o¶úú>"Ñ2.~ Vú*¡qèÅ·@ò:ýø¯ô -YEÄáõj64ÍÔŒfÄÒø„á -³=Ö²%öËÿBy otµË{w>ÓŽei -"öpfÂjZä—‹ìêéóäëêg¯Ìû=aÕi6ux‹²cVþ7èïå–5“ýÂòÐØÞd
¯$}„bV¼Ú[ë/ƒ˜¢1Rçµdwƒ/˜L#©dR£W¯¨™$m¦|¤$:{ý®EÞw†MÀOüáMtáäù¸ñ6a´ºB–Ÿ¬V¦çæy:yц”! –¥m<î2w¡X9-]Ü V®ÌºêëyG;ç©ißÝ;³‹ö”gþBØJw„h4û¿Á÷rŒx™ÈÁ»«<?…ÿ“÷Œö°3Þ#9fÉ$'>¨£Äm*Èövh¹—‰Œ8êÇ@Ú^o·tEër_— -îj1q<„I²žI^L7bfD$À¢¡ë¢1õ%Ó8Ó
"¥›<øp#sû½åÄÎœ
÷KןFŽÿePþð`á`eæêîôÓÌÕå?;|aendstream +/Length 26183 +/Filter /FlateDecode +>> +stream +xÚ¬ºc”¤]°%\]èª.uÙȲmÛ¶]YV—mÛ¶mtÙ¶ºlÛÖ×ï{çÎug~Í7?rçDÄÙ±#ö9±Ö“™$òJ4ƶ†@Q[GZzN€Š¢š¼••±¹4¢µà¯™š„DÈhàhnk#làä¨Â@# +Ó¿rÐÓÒÿ‡ÑÜAÔÜh,oîhd01°úÛ§í*6Æ@{+sà_=ÿm%€†žþ¿ù”ÍÌ,mþi<˸€6Æÿû_‰þeN§,«$$¬Iõ¿ÏÔãäÿjï¨ìf÷—Úÿ(EÆÖø.þA´uxÐ0°²hÙ™þ^9F +4‚^ùckÄh‘š‘æX‹ž34!¬Õ×à +¥$T³ØÄ^×âs:‰¿„³Ót»©È i+3«0€Ö~Z¦Ò‹Áº*ã¹®.òzbdÄhn“<£c¿§¯ +ë³ü>Ëä1os´˜™(ÏÂß_Ø⟣ +Üiv^ëå‚áßcHdð8âzî‡ù&v'ö@¹v +Ý}ÈâJK3î„ÕžÖõlµüÁçÓDÓRfd‚ICÖFJ$GKó¾¯D˜ü‘·vŽ+À$kPSöc«¶U|R·Æ
‹‡hX'œQýSÁàØœ¸5£ +•LŒ{Œ›h1X+ðaÃ1©GÌ$“ñ¥l&HÝoÿÃ5Ÿ©qΧ©uAÑÇÁÛ9+.ÅÌAK¯lrD‡2||ÀÞW™òqoÅU{´@ÎÜ^ËÜqøHΧ6U½SN0} ì Šz,sE¬˜¶a;<Zt$N}Dzë³õPô:–šÕú. Nž³¤Ftȥ͜hR=l>eŽE/Í:P–ÒÝH“OïQ\ÉŒm–Õ›ÝèIY湪
F'}P¡Éô”ÆiR¤ÞÑî •¼Æ-D1dšMZa·ø»ooÄPe0™ù{à3X|ªÕ(Æ5rcˆí“ªCch³Áó€n']íõ%®$Á÷pÙC$äg´ž/qº–Q„¬{kÐÝy¡ »ä(örïZÔ”*"ILÎÑŒè¹ÐbG. /“!C¡U†RmÊfB,@²¼NïÊ;ÉE–•@’O}64jÂ(æcŠ +M
J9‚®»˜=¾EMì¥Ç§SëøüªæÊgg æ·g˜èô\ %#B9%´®©b]cA=Ô +‹“Û,o2ˆC½³Ò=ÙÖk•/ØØK‘ÕœƒjŸQªÊ„·¨Ãy +@†Ä¿ØÜôH¢ì’×Z²øPAçGÆKX•©Èë7ÿŒQŒ±f´ý1ÜF-Ùw|¤$»\ÃD¿‰x¼ È€Ñ"õ†t?oånŒFÖÙ»s¤‡V@•RÈ2Sx p]½ùö]¼¦ÊCRë
".zî¼å§ð©PGŠŠÔƒ H>öé%WÀD|rÀ©ñËE`…zôGfìí¢t•„9—šÏ¶3Í7„ ir6s¼ŸÏ‹¼Á†(»µ›œM•_Ï^–8%ÃÒÌh<TÏø<G‰& žÕsŠŒï}x4ž"Ø`ñ ã?70„029t3™aŒh ~Áع‹&ì*ÇcGí\¤Šn
<_‰HB÷nV ^?z^
6~pÈ“!Tþ(Q4Î×"‹>§Üs: žlwÇjèQ›–óž…-á’æØŽ¬£öI:(i>·QÄJé|]ˆgZC—º’¢0'¡Üœó7Á¿†pyfãÎCûâtˆí&ž?¨Ó[åÏ蘚ç>÷bE‰ÌiòK)¿Oµ…µËÃmžÒÃúÔˆÒÒ³ü}'ð–ixiªûÂcá‰|^"íÆÅ>p&ÄñâüGÚ:[>´ŠX>µlºZ‹ÿZ9Ð[:ž}€Àe‡Fk;èpO©¿=–õySɱ¤T‰‚í)Üs<ZvkHJÉ=žEFék
Ê[} ´ÇHeˆ"y0OÍÁJzÍ
4M¬˜×Ír|L_hàüKå[ÃÔéê…ë˜Ùc™ØSF¶Ñò]ö™c(Î=©à=ñÁîEù©y†øÏ$¸«]K¶ç…𚵯Ô>m%¾äËï¨OZ¥8!'Ú76
ÅuþöÍqCS) (Ág-˜¾"Ÿmå:ºWV¶õÇ/ã|ÅÂY¿,F}ØÛu/ŸË¤°¨570]ç4eCØ¢Yøí–² ó—Z +JëØ +{Œ¥«KqHM+~ÏBO¨Ÿ?oiµxÍ+«7g7[*‰F]4HxD½I·È-÷€ðÚѦîº-v€á*hûT°ž½ g$+ªíá?t"+<äµ +zÒ´ÊßÇKÙ’«fÍ¡Ù”ø…È^fx—wÝ¡×Ú‘Q!·úwxm$,
ãûùyïìC8@„S+®dtóWÚ³æѶ9ÊN-*h³ÞºE¨‹@åðòuAIÒØždé°&#t›ÿ xªÅæQ§„
ó +9µÝ.Ý0{Z[Cdiî×É!âOø^)kUIÑhäëºCiµá{¾ç&KÚéçýoû›ÆîZ—‰ÜËlÓîÔù—6lÂKR:¶;y>ñuju¶ M¯²á3Ú©*cð!¼cpäï ½¿§$+7æ,ÌŸ; o&ÁÈbÓZlÑ~ËwÔ»¤¶”Y¶ˆ~ÂÞÉ)X‡[uçÌSX‰&©ìÈ-D rÄ-‘7Œ¿îV5Û—nþÙÓžÍÔÞš£÷âËì›tŽƒ‚õGQbEˆD>¤*꯴Â[@ÁÖ5Ƥö*>›9%§úýDHÔy µff3@h?L;¬îFÂð¡Íϸ/;*s ˆ¯cOåU®BÚ½/âAñ.kþÚ sHFC®Ü¨¬J½¯1þFn^×áöƒ¿¢WW)ËNV¹ŸQO‘Âömœi}Ü8åÑñ¶;áî=Ÿ8;2{¶†^ÜóJE9£n(tòx~˜Jþká)5þ–ÞBʨnŽ8Ʋ>>•m‹jS#®YR«—Í´…Á‰Ù\ñGkï¬1_d:mN;ªž‚˜"a’žq€‹©°Ê?ÌÐÄ#ìÕãÙ{½=#Ç™‰¢Òò¢äè{¶Êl¯=¨çPÒDZÒ‹Ýlļ÷Ù-:ñeD8å=ü*$YTÔO½xÑÜúÜ]µ©ÑÚˆ”I5ãþ±×©_)ºNÈ3¨6«äµõ«‰Nó"äD1¬ù „®ê0ö°7®<4ö(Ìuæ´SˆQÁ“pR/Á®E©`SŒ^ôÈÅÙ@D‚±ñ–§æxÌä}ú”:»º¶¥uÒpp—§QÿÐšÓ +ÒÎ&rs¿:Ÿ°ôåÌÄÜÏVèy.<Ó!f•ÛËiQØg:0ÖáéãÍs_E©3dΑ¹Ÿ:A=Ë×8‹´dÍAƒÊ½ïêÛRØ-À×SÄÂ'ãBØ\eá~›"›ÙRrD|©}Ýÿd¯qyIÇð1ó6§µ(‹‚hQCÀÛ#÷œ—é[6ED€ó‹%±˜úÍ<ZL9ÉAÒê“sõ“7\wêm’’¹Ù·—¬˜9ðwב0Êpø¢Ày&NߧBm4D”SD"«4*Èwît£&ˆÞWÄŠWÈžèHÌËKv3†;a4¥QoÚ®ÓA.óÎ`L›&<v×2•M\ü;C‰ï!Uê›^e_Å Ú*Ù³ä_ª¤Ø¶•ð +¢á`7z´|„yð•Ý™íýîkn:ð˜|—
ý +ã;[Ȳœ]P¿“ؤ¸›äNßñÕ§Ü
ÿH¬Ù|.´=hÄÎdr †E#†UPQE^}ÿv€ê¡þ˜(#û¢2ôVÌìôü“£
βÄÏcH®çy³>•q‘óýÁµÚi¦týL6OcG!,çj§eD=G83˜ø®eÁ鯑´^4ÒršXýŽ2Nä@È“mï†óD¼ <ÔýÙíŠÎ±6øpv\èÚž”%¦3+è¢W,K…êÙœçEÛhÃï`vÐyù'5‰$ع$rñ‹’ŸÅ[ +Ý(~®$"·jJZ«ö0V;XÁÖ9àL[ö÷ŽÃ=ú\µ$ÔeKE²¦ë•*VÃ%TÚÓì—£ácÒ㢎¯ô1 6`hÒÀ7>œm¸>/ÿge–‰—sªè²àÔ2Vú¤yîpwí¡úÜkÆƱg¬¯Ð·ˆ½P…ÊÔÆöÐGWð%!ŽlsŒÒe£•;‹8Ù1Ëk²àÚ>Ø?Fõ$é;wͺnæœÌ^Ü”/˜÷RºñTš„ŽzÇWÒU~WW›G0a–
@8§OQvˆk?UJ_xJ”³&ûˆ#p;'+ÍUv˜á#9¾}¶Qý•þÇ%ë<"w9>O“d°FT´pü;í&w°nð-gùo…ÁŸÒ3íâDã»;ÖC+Ò¸ïÅf@Ô +Æ° +á[xœŒ†÷\KQ}Þ£{ânUÃ{¨ƒÁÅð(¸ixJ +/ÀÅÜÍôx¢Pt|‚£»ŽPûβJÿ´ÌΧ•Í[…†%®§íßW´¦ú‡Ñá´L±ŒZLys)5œb[vb§¦ÖKÃB¬ÐüŽÛ|Å2Þ>‚µ¡XÉK©o[rHÔ\ñíq˜²?
ßyæùíoædÏfN/ÊÎMB-£ÁPˆ,÷#”|¬7a•´“YE8n¤
Hõ¥ ¨ùIHÿD}ž†‘#×Àä:>ƒŒlØ)_Æ1}NšLŠýö]ùNp’›±=’“j †/Gîr¶Ò£1,Â;c|6Ž4Õ‘a 'ýq*v¥Ú³§ '|iú‚â®ìL5³ÇI"wè{À,•|XÐì¯/û(3Âö-4Ø—•0dT@N&‚†E|ð4þç.ùiÛÑœÈ1àü[Ò pJÓT
†šžs;ícñU\ÂKÁ/m¨@‘§M=ò]“’Jí‚%ë_JXñÒ¹Žìhuó{¨øy¬–z¼ÍAWô{iaz¢˜š–mŽÜ󺳘;¨2¨/ˆþ/»ÄcÆѶˆäó?™Nû¸°Ü F`® ^å±Z§ôv»ÜÃR4êI¯d¸'|ß|ºÐzëÔ%†=-ÉjÅÐÕï¡ó-‡Õ´;ÌXåpMž8Ìæ-< +QPÓ-áê“&eÃÜÓªŠ^"q\SVÁkøD÷>©Ìp8ð=·[5<‚K‹ “óç/=¨^ï{"~jhõ^Z × +TSõ÷Ò‘òÍ?¡n¢‡ Ì>bO³3ÙØÈ#wÈVßÊ[½6´Éû‰V˜5xy`ï’ÙFC±èëŠY &³»ïÙXºÜR>Ñí.Žù’BpeŒ ¹Ž•®¶ºÁ¼ž¾ÖM‡çÃ{‰(Lv¹%Û<ÃDì¼Ù ÑÄ@^m„ï}(}屩 A?N'´89}¡ãÕ°àahg›ò…NyF=Ø,¨E$ª=ˆ +‡?wÔ]™{†]°á³Í4jÕâŠ”P)ssW;RëË„‘#•m“>®~Fí&û[¾ +Êçx™>]ù‘³±”íìÕÄõ3OSF}óÞn+QýíPR»Š¦½Ý5¨VÅÅ ç„þªeh—‡ÇŠûFe]mÿ‚e¤e¤RÕƒÓI¤MQÈ›.·—~#v‰XÇJ€Ë¦ïu»wgß´»Ù² +^>íª$¡‚ªN³°jQtˆâ¡'§"»BKº-¯”¬ØfOUÎ51½D:e;…"YE"^gŽLÖIÜ)Éæ#S|^o´¨/‘feý•á€•‰¶ 4ê|¶%ýý
.–î´0¶&Û$LèÐÛýÏk¨MLèOöc«¨ðæ[›L3xÒZsýZ”Óîd42)wàÐ!É5³ %aû+|ã=Ê.ÜÓ¹3ÜÙ8Þ- pˆh’•™ž^¿W¯ïEvÃhdBdwü¨øPy>h†L r%@÷CøÆ#œ(|HD‰ñÝ ¾W6ÀG~ùç+¢m+ç®_#É€'[.ÕF öÔ9”f÷iõD +ÇEE‹S9WM3×!ídòÔmAfoçõÄmî¦Ð[Òd‘F$ØíRUJt·äýÀ ÷ +0ê +‚‚DqÓÚ»uJ‡$m¨Ëâ\5%wËxƒëá¤ÝŠc×Ãäçò‘ ¾¶Ï· +:âP ÉÜgú–ÁÏÛç-R^üÀ#¥w…÷n²Q1šû£ö2ü8 +ßU‰òãTç[Fèšx],Z·Éðšsðð½Š+šž ÈS&×9hÁôœp4mYKØ…Ðl]ë³.)µ~gRšŽ_•Ÿ(ºë÷˜te“c»¼x„Ÿ×ŽÆ¡â]ôî2xÂÂ4–ÙO®°¤ë梨áq.svÞ}µØüDváð -7—s‹fYn‘iÌŽR0Ö˜Áp§¡G~)!×R%e¼k/“‡£%A0Ê|&á8¬
ºàµoŒ/t!„ÈÏ$»g¤—«â½Ú'xÆý+ß=Fœ‘è¦y@õST~£Ì½´,Ò~”B”Ê¥¦µ|ø2H‹%È_Øò'5Yh
ÂE8i´ÞÅ ï…Ø)uô_ƒ¯ òÉ`XÇ˶b”ëÈó“Ëã$]TÖHõŒn0F’¯h-òðíìaÝÛR]ÐÉËæ½PÉ$¯ Ðêm<²ètL?Y=àGWr&`Ðñ°êà8Cº+Úš!xr(<:Ž¶Üº±‚=6ûP.'…ºŸfzh?9>^.~-죦ª îêê>. ó¾_þAC鈮ëø:%cý6{L™n&¾[™˜â¨†énC–rMÌÒ( ¿Zv›ptúˆ c2{d„q¡D|ýü¢ó䊇•©|„¦3Ì‹ÀŒ¶¹S(·’ÖÿÎV‰Ò‡CýîδÐCM*y]?œeàq1œ®=à¨Ì>xÞd?O-G¼®·²µñ¤ç¿òºáåÞ¿ï¯ý _ŠS߃Ø#”ÍÝÈÞc³7—½û9˜X'!yf¿ÑìfÝ;ˆg3³Œ0¬`ÛemrG¨^²üzë ÓãÓÉ×eI’ÚuÓV¨™Wk))5ü÷pÝ3`ÜŠŽâf~€)`â¸ÒÉê¦GñF¬&ÐœíçMÃD@«UJ¾k¶¦»Öê^ŠdÔ«©ÒmÞ~9OºðQ†4Â>…£”ÈX>®è8#c +ÿ^÷É + ŽM·«*T$à&N_Òò,j5% +œì_ØË\ŸŽdµíY|ï—ô(®iÙ˜ï÷_<{‚ßnSéÓ7T³®lpá/Å=[ü][Ë6S[ÑM¹–3$`êMIuÀØR{,ÅWþ¤”µÎ–g-ÿqjòIý˜=ßôY÷idᜒÑtR˜)¸zéôªóe;úOt+%«Àã†Ù²ÇÙWË7pž>\¦
ÅxÑÍŸ*L³bæüQÄ'QÛ\˜èõžx˜:S,Q@²úIyîÛIÿAË)i^í·’ê#\>¡²ˆ×k¸ôpÀ/ðânoMe™3²ÌB¤ÿÆ]Ò§F¿"Ûà5~·±µÐÇVS´Öþ,&Tqx`•GYú®F/Í âå=TЉ¦ê&Ô%³S¬À#¯]âëI–7•„ +öšûDG¹_×
óæÕõôðªØtx˜†&ÍRueŠÖï:FŸ‚sy.!À\Ùs‡‡k¯EÁ€Ó•sö«x×CíÕ<©t¹KrgÆ/Y4Žö<KSUGYþúÌôJŠ>•V«‹§K¯€Kb1¸Ž†¤”,M1}}AÖW2Œ…á¤ÊùÛ8x¼3tã×Ã3Ï<º›©¼U³GüÖ†¤|D‘‚ZÚD…ûú÷÷>Ìâ’¾ÃÁÊ:ºŸømõA‘ÚõØ'º\ÝöH+Ì»tô¤H¿€áÖNÛstàmœŽ'1LÞd˜Í8¿Ê!©£lÄö'`•,áO›>ÖSÃâ<Ú…Ì¢î±D»Lôyº*mpÐœŸUžâ™Jš:‘¢`6Í؈÷+ÒÜ\ñ2¬aÃUÃ?wéöÛ<ÚÊë4'ž’!lž¾T§brÖœ-1_/&âXcb®ÓiÇD8ûæþŽu†åfmk7ÔõvüZÏÅ¢ã|$bŒAnÕ·Íê…¸bQ&¢½ÁRîX[ÂÅѸ¶ ¿øE·Ë¬[oÙ¶žÚ[£Ê«ïÌw>w¦{3ÿD)¯Iÿ#Ó)°Ó'×J‡£ÀŒÏF™¡ã×ö£M÷ß4ÙËáZuT»Ø²n“€9DDt”¾ôb5Û1g8õ!2õ¬j<è+Íy"
$¬ï¡1!‰ùœ«l_.‰‰´—k3q,7’•ˆ³F÷F¹¡ï_z=F¨ïœ:Gß¿q€*F yDÓ³–R3¡ÞPaZ¥~CRœúsF]ñµ«†, +áŠD(A~«ÌiðÔ–Eó—1+¥^¨„iyÖ¡dõgVs¥Ý_Çë t\û¥[Vƒ‹¢ 㟞4Ž«EUwS¦€˜”ÍƵßT÷Ün¯
°"@æs÷‚Ù¡h B^#ÓÞ€Ý~aG>aLÉ uò§p€ºf¦Î +ë`H“@$ÕflÕ=nUúÕ5îÙù-2?—+{žj•ð¡Òj›W b>H°ÿØ…9ŠÌïh‹æv =f÷{fÕüVì:Ç1["rù”SêƒoÑõ¾Ç’€šlOÕ‘äÌ]ªãuƒ0êôXPðkµ»9Ð…Ø:ÿÖ‹\þ±Öãà–{áÍÜÒ#ú}B*Q½‘W¢¢´ž…tZ…xœêÆ/*ÖV’^oá?Z‘F
‰Ô7”:ã
øcj¿?‰zz1ÿÍ^yãývÍð¿\û0Æò±ŒÄ†]dqá=¤¿@‚Öº›3IoÝûÂ"Ãp™çMLò"–Îw»h=y|+Õ(¹2#g‰DÛkœþUhÉ«ýƒh+V2™¹,ÈÎ*MYcœ´ð¬äOæ~‚ gï.ícfÛèMM““!TêÕ6ƒ8 .ƒ)¡
éU¾ïmS‹"Œ§Ô°5”
L4ûöã¾:‘Oìc³5hFWG8sË›æs-¡ëûç";÷\¬ã2•„ys8‹×ªlºP²XÎL|¹©‰ü4ÍÞ̯v9êNvsr‰…Â+xCü>c¯Xç§Ë'}ֲ߱ß1TÝçu#ß2çÓ ++¦É¿ìÚÖŠ^Ú®/\—sjÇOŒ¤+G4Õ–¬¨9 +,Ù°U×g·ù;ŸÐôl"•R’uEc°VÁ2^ºBRA4MæÀQ‰ç‰¶·#ÂÊ€ó#Šh5¾;•b‡§XæD””gX]åF¥"yM…Y@ÅZéxaxÕ49ìÍ|ÑÞŒ>‹ŠçââD’ü2¼C%4öÿ/ô»ènÙt§ÄŠeýú2nš±t
=_~ ¼}RÉ~>Ë »a0¬n.¿Î¥µ#M
HöíTiCÕNjŽØÃsûÖ‘ýaç_ÒÈ£ÑxF‰“Ô
EG^Èn Ý=†¨Œr&ª‡C0ŒwCÀ“`>ÒUÜFæœØXîØ}6ø[·ìfÇ·fíŒz¼–ç‡ñVÉSçä‘¿Ôìi€ÐgoLúº¨6UtY–S
ýS´,ãþXppjIíWÀž8›‘ÊsÇÞwZ„EyB¦È˜Ê}°w9zÌ^Ù®(ÿ÷ôÈЩÛ<KäVÕø>Q/ÚÜ#ï×Ø·¢yû!«oø~Aòô%“#¹ö÷ƒ¼BzÁ˜»ªŒï?_"’ ë‘Úë?w0ºŠüvˆ_…¡"=%_U[Œˆ|ð<"á6ìZƒ UcèzA²¿¯5`¢\î~ê×Sù©å¡ïÕšPÄëŠó+™ë +1·ð€š2åªvÙz¥›Ž³AfWæ›îs÷óK—i&ê¯Ózy¿ðƒþ#t°ZÚ)þƒÝ6Ö +kÈä+>x‡ÅôŸåÞ„PÁ
EEo-B1ЦL¥ŠñãÝÖ›²Ö›ï{ƒÎûZq"Cöá±âši¨èbyÇû[&Èïd_†/ +ÁÑ™i-j´ã/¾fXØü€ßÙ(‡.V’+®¿
² +½JTàÇÊcŒ†úJ$1³Ù«B«“HûS•°
î{ƒ)E˜ï@Ä|èÈö,›G|8fäUÜêg¾dÊÊSðõÀPÒ”¬^Ÿ¢õ±ûJ#„ÉòvÖœ¶2W¡ýâVø~-…3RüzÌýÝ÷ +3Üdc
×›+°É'©z8údÆÕùÛüÌ[Tòw@ÿŽ¦žÍ…gM/Ù›ƒéFŽ]á,ˆø½Åžlx+d±‹
9²ðä~OêÌKC†«hMŒú%ÎvkøæþÒ(„¼MW{B%8T ØdaèÒ…`[Ô¥Ýy¬CCtt?èhîÑâðïä÷`ãß1>ëÕÙu•î$= ›gSg¸W‚Åw‚¾H.Þ¬¬_ÕLz£x÷þç…«ˆ9ú¼Q³:²sðÖ9v®A%ý˲ùïß¡ãë’!CÒ¶è‰)YXP›Äîé•1*A‹EöRSîŸùÆš¦ÿ8L?#ºOYI(¬c,F‡n¿ô¤@É«ïE6ÊPdw9^Öäv]
ô%cND·y§;£ÙP™äµQFaØ®›qF?Æh¿µÚëè-Å×›ÞË#ôý<ë)%™<åàiÙFÏ +{@[s0Ÿ"¥²ŽÌdbÔǘ–´EVðMh^±i5q×B2¯^JO
^Ìê£oÜ'‹âØL¥ÆdýT<“øê²fjí7Dµ• 1X}2†7›€¤c½Bbá/?ãÒIxPp%‡Œ©SíCÖ…“La2ì‹i½I[«E8Ššå½¸çÌ Þ@Âî\ǸŸ29SQTw*ÑB1ï¼Ðå+Uïh®¼Ä¡Ê/þ‘Cå y[üAôŒŸ#2‰oLú*ÇÇUqQ½ +ó|,šZŠK§ -J˜UÀ·~SsÜ1Á¥Ã3ûtâ’”§ ¿ømƒQDf"x~ˆîd÷ôM”prB!4¥”N½Ëïb«@äÒë³q
§àάAÃêÕµhÛ„Œ°Ç³8vˆti¤E¥ÌU$ÕƒF#ãlˆè‹2Ž55JÁÆû +W—‰ÊGo#Jܤ±ÐLê yNב]IïðÔfñ+ZMv‡ï7{ä¶Ãê‚øíXºžXäó½Ý‹`*‹Ò‚jpj÷´?+› +|B@†-›&±í
ä5‰tkfÏ?B~½b:%Yñóà6uΣþ˜”£LA®ªˆðÁëX‹ÀÌWÿªïÏ,Ñoðö»¶ƒ1´†Ö®ûM")ûŠ’8H_Q@)ÃûÌßj”Yã*Fô&ù2ÙüB‘çÇ.Œ%nåÁ\Û†_ØO˜Aê;)çÓjÙ7 ÊíåÛsoÒ쪰1¯3Yjè@á³fæåE#ÚQÔYï”zpÒáš×,£»e‹\nÆnCþÙPÛöXCƒ +Û .]¿1èf‹Þ$‰V™ÇŒ[óN<š?ÜY ætLçN¢“v} «˜&…yncú(Å:ÉZ£Ÿœî,Õ„wJo ØŸq”é»»2ÛÔŒR⩽(Òue†·¦³‰Â€D…%ô¿Á„Ä a÷uZG“9ì4éÓ¤uy Ù¡]&PžàfÌeAÔ>X õ®pøN·¶±R`ÿläC‰ÚHlÐ$ðô²NæPh7»˜ è›LfŒ¨“ah¿Ïy8
¨ã q˜ác )ÿ_~1iSÕˆC¢aH
”Ó‰k0zÉæ.@ÉÕ—Rû“µl‚‘¿R
§´ù½Lý¥tû(Iðd˜î |ëm´ØÿSáB÷ÈVG:ý†®§DÚƒ?s¼Úö˜ ÎTëýô?ÿ?ˆ¹×”-.ûdÜ7”ˆì¾.îÐ +q· +<Š´yçö{e¯(×6鈔I»îbyö„•ZA„I³ªÙÆç`¼ÏÎS¼^™AáRup:ÓäGW@-!Äø«ƒèÕßèËs=aË‹Ü'vÉRýl+}¦Á_¾u0 +Öÿ“^)~ƒpàÕ²ô*²ÿ‰sY:ûyé×6Å€$ŒÝº½Å{‡êÑi×rL#¯(T‹PÆvœ·Qr†¤óVJôkH0¥rÔIV€«´*$ã®/ +ëÙO³!õxÉRdíhÜ!] úãUK+<7Öœjã«/ªM;Ë>ú‘ÕÃ}„ý甂ÜZV +bù‰æ1²y†#Ö6yéRØÙ`sßUJ öà‚Hø.ß°›GßôýMŒek½„¾Ûº¦¥CŽšËž…l^§¿\<…‡6ÂK̹çø$‡’vçÏ
%hf¥Ëm°¥sô |G'Æ[fûý/Ša¥¬3µrž®gS¬Ê~9^éÈŠSìꦘÏéNÐó á¢M>À]àpÀ +䀚Œ5åèÓíöRŠÙRÒ +Ì‚StRóùa¼âæøïŸm+ŽÞ¾µ¬¼/†m@”«†fDä)”y âXDl_`p ˜3‰Õé"p£ ùÓ½r§à‡¬i3N€‚_ø+iÝ‚WQô¥ˆlò÷ÅK¯Ë.XÐ:îîÐ0ûvפ¹,aÑ;‰<e8“z Uö¯ùšÒø\j^íÂÖ"œ‰7 s.G쯸‘U,™Ç‘–ÚUõ
ê…¶,?àE jÏ2 +K¼BPÒÇMÆÍÖßx)<¨„Ó«à?j¨¨[âs£ +#!ÕŸÝS‰¾¡Ú±á$j',göbõÓËÍÅ!:Ñi¼|ÓÜîÊûJpÙ‘ýéÞÇœ*ðáˆR7¢O&½¶$nÄP$sn¢ä+ouu*„Û“A–’
ã†ò/%£¸¾älÛñËÔk|*“š
HîÀ²äk|ßm: ÕU¥Õ6ØŸo£;§h™:Á„tè÷!©N|çÊ?÷`~Y`¶VG?Ãça}4¨äIßž=6Î,ºJ¥ÀV9uÖ”!þÈjYA‹¯ÏdJõæÕ…2–ÎÊ/«âÖV0ÙFìŒù.}3}ä–Ü&q—ó?xúœ¾˜þsóp¿]×U‡|y
#çjr¶24°E_ôaà´¢u¨‰C¡^¡Óå’&BŒ‹‚•M}ŽÀÙz) Ü…tMJXŧòŽ©:õCbX(—Ârj´¶45õèÚ{,3¶jòWó0_±Žª +þ®£¥?]ÄýŽ<ꯞ'°á1ÛÃCÃæKtð(Õ‚Ã'%ÔŸ8“ÓM¼æcûÕz&CA3þ×E®rÒÝ,”BªyK¤åNÉ×%‘/);ÐÖS˧‡v!ï]Àÿ_›ÓdðŒ¶6ýCŠŸTÝçÌôûî*®¥e轜Ódv*LáOhfòÕúÓ€oMºÜ¸‡_õxB5(Ceõº%-n„ôVDÆ„ç™6j®Ž\åoÕ”ƒºB¬çýû[ÝÌ›_œÿr¸HÔ;6é×ÑðÀ¼!Çrª¬
±£ +éNÀÐq
„Ê•GÄ`“Ïx]SJãõ_ê»G1ÁmÃðé²]„5½R)%hÃ+Ñ] +we:‰¢}‡”ëâ.ðUöÉ›±-ÏÒõwKP–ŒxÊÙl×Ê´ Õ®Hi¸®Àð”á6Ãìؼyn¼ +#"±91cÓ…†5BZÌ¡UQ}‚Û’á“ÓiþçáœBpØ÷=:¸Œ=ĪÈÃýïVƒ®Ì¾‡¡¤ã<Å‘J*=
ó2",^†B;TË}Ç\å€S ´rV„-ã•£‘c?5ä圣9zL’ž1dpAP³¡Ÿ63—ó[%Ò
MD´j&z\%djÕ2žS)Ü‚í:cExòCU}SÄ\ºáz&¶ð,GÂ{k˳Ô:•³D"¸
²„?.¤V5’0_‚Üö»Hñ´é¦Èݼ+ÙŽÚñ#ü™ëÊ°øm;•HP^vø+ˆoo|ú²®Ë7¨õ$0‚b…çþç<nhœBmWf¡Áy°+‘›¸Uë«Ð-‘±ôwhÒýi‰›õž+æ/Ã={W¬ÎZð|,'‘¿ó#hQlÍüyïírT¶Ô‰ƒ"~1]¹²?::·ç3ÝÛ¨wÎC +Òðš¦}dÔF\•È]Œ9@òµñ…¿[¡Ô´]z›»•K½Ÿ³™µŸ Pù +‚Ï€oD‚¯õ!ä]OZg*µ@D©(ú¢é¯NVÓX.ò_šï¾Ü@Üú$4Ü"_=‚1«qÓTnÌhž¹ÈuÑRý +lj
»•ª nÀC›žFåÔã€ë(RX¦ðròÚ…ïØÈzš¹]3èm8Y)HRï˜*w;6ü-$9Ô7ÈbVu|sÀùñ¯ªã°}¨$\ˆ%¼®ËDq–îÑAÃ÷Ð&8Ýß«ñ¨Âµ”(Æo™;Z{ŠrA y¤÷>[€Äß‘yO(³ÿ®™3hwr粂ˆ¢†;D¾J#Hù]øÝ/˜[>@çÆŒt.<‘I×S=RÌZ`Ï3Uó%ÖÑõ,Á>!ßÀÄt$9·žÒ›Q6óâ‚:ÕEðµ$î£?u&ÌIßIUŒûÍÛÜ¡½Àý—#û&y- +tkR¦ ÍûÀVùŒ ++Eª0»¹§“Í3M‡rN?ZeÜÔhSžK½c#B¯š`”Ž+ÞÁ?í@žâM¹ÓØ%qndzF¯ðIÏE8ú£ÖÚ¥dó½ëH’›Tz]¾7]37Ô—ãß?2œœÕ˜`‹Óý5ŒVY7Žâv‡ébŸ +2ã$5nµD錥öI …5;£·‘³â¥œš½œ¹ÎœI—¼ŠP¶–z¬{çÙÏšÐQÅhÆ- [/µ/þ%Á4¾Ù^—a‚ªßvè¨1¡x™6LÚëI –œ©n¾4âzEÍçõ3ù¬ßÇÖ%r—±(×Ù[!yŒk»¬Fy›˜µ›e5kWâìŒ(¯(j¶Y9›oæÔjCBçO›ƒ±æä9?}0‹ÀÃÒéstQ Óútƒy QÆä*¥[ ~R¨[E†¼Íx#è{¬=6OKâ#s‚{oq“7ë[›¹<nÃœ!é“q’§€
%ã¼ ×$21Ó‚åûˆY£®ƒ;YÕjįb§E»iœs'hœüÓò +xá¢,FÅ×V¢u=;”ZØn†•îµ"ÊÖÔêvС՛¶õÝäa®r¿=Ia‰›qììY˜f ‚¤H¸¸ÃซqõÛ#ø¢tÞDײØ)b»„ +•±ÒAëågѪ‡Öö-Ñ©3 … +iâwˆ]SwC''/ˆŽ‰~ðs + +ñ 8þ~|²oßÅ3ôv<*gÅײî_ÈŠZœëÁ +jf«ÕIˆ7ÛÑt":¤Ê˜f÷ºá|¥Ýn«8ËiòÙºi=7"*ÆZ÷T…½ƒ Jœ[É©L~¯ä÷úxô|×ôjƒsm #ƒYmèu#Œì .¨lÝPXUòÑ,‹÷âÐysËÓJàläy¨›Èß¾gVmè|Yɺ™IÎoÆÙ¥Ã}xªhx R§ªœØD"áíñmóC/·Û]Ë#ìß’œ|rÝB>ý†›Ýe‚gظ%ÛâÂ¥FK#¼Ü +VKëÏ°@öMêhµÕ{íÓ«k +ýñWÖ͸uòóɃɋ,In“„È ÷úÏh¬Záßrž×wç3÷¡nã)8FÕ°=ÀËÈS¬‡5÷*ÎoÕ`!Ú\:âÀÉGàb¸ØÖ:*™°Wɬ)÷Ðõáñµ.Åzxï¶Q+u +ßoÕüŠèg|)¢Ý”+媀B}lzr}/LŸè×Z + ¸Ä¦~Vyg²åŒ¡°uÆJ°Ê×´fM-€8¥K¬Ÿ«äCËš,J½|šj_6R#/&]ääæ|e@¸(óã#š'ò{Ì¿’˜qå »|ð¹L¹¹j + +0ís¬¦¬×&0/¾Ét‹ÕŸóëå;”Û9t;ÎÑÛ¶niaóÀvñ~¶"‘_ŒNëÁÚGM] Ñ#·8-z;aaZJpÙ ½kš +²°×³^Kè„…žåÖ#Ö »*0N” u ^8~=“²BÑóCŒüÛr/CÎà-À;0|ûÇ£‡gÊÒMNÄéa`œËßwª@É#—0ñŸ}Åà¦Åÿ“[Ž5^3H¸>x«0Ò"†„TÛp» +ÓhÙ$ål$zQœ€ì=´ö‚1d–®ÓÃû"sx(Ú*1¨ø¶z,ˆÒ'݇v!²§ðI1Õ΃ñ¦©»g [ÞC¡ç1Q1SÑÄl»Iz_TŸÊé–Éü¢Í«¹>Ð¥GâÈ…¬oa¦Ý—ÞëZ¼êɬÿDW•¸¼‹Uô‰ù;VtWí½ªŒä´p€4oUû¤I67Â]¯KÃ%µôN”ph»ÈØO{ViÂÔFìË¿ú°È‹!”éH8-“¨š +:B‡ŒlŽgú‚2ºaÒ"¦¹?| ÿ¢
t+ë+ˆùR–~h
,“Ø‚_s +h<…È™¸gßW ¯@Wç™áÜ;_y"ÙCü :mM`¢= ã;òtçÊXÈê
~Ô“'–6Ç3mœÄAÛ÷1Á¦±ÙMæŽW‰¡Þ®jjÚÔ2ä,Êb¡¦³ÿÊ<)yh+oÕQÑv‘j—3¦‘„å&‰ +ÃGÖÏ:¾åîø§¡û2M.ˆºD7–c ùWkx6Š„N+§Ls£ÙȶVaŽkŸÓÜ øœy#‡-ôØ¢xofiRTÚ´µlQNí¸ÙÕULÓ‚Mæ&ò“2ç‚‹D‡u£®#}J¡4×pÚ4emØ +ÖVxæ]"ÊÕ=¤¿Ëós÷ç~ÿ—41‚ó¸%ÊO:F§£43†Y\ô¹³*lT¶Š‚Tò3®³¡Ž¨Å°¸n«¼AoœsíêrO¼±¶5åd1
¢~ìËQ¢¸¾»Æ)56(ù×ÖÂ<ìÖåZ‰G¬LQ„pyC¯gŠ÷).è1 οy™ëßáÖO–‚\7ŒTQ|§uÎC†wv#†ææ¤MÊØrÌ\÷˜›d†À¡f¤Æ1`ˆ×J8>ùÔ~ÐõÔ&Ø`Y£Í˜¡cç?›2¡e‰ð D/Ô(–+ÉP×½L-Íaž +Z¦Ûæûa„Ék6kUqèL£%hp—´rÛ° ÍèE–r:-ÃdÆÊHP:ì‡2;P®…ÓêF{Ư<Q,JšãÁ~ +¡h[ÅRN]~¾…L„ÁßïüÉíä-—Ù¥ìŸ +»áY€»}€cù‡Câˤêðq£þ¤ÂeSê]èûgÚò6\LÀž/*X«–Ü>ДÏ@ÏœüO©ªtºG©÷Ž’4Å%ü’Y×ÞöPðüid‘˃8LÖU/p„h[×ÿ1õ˜åô×îE¥JP(òCˆ¤‚§t¢8ꜧÝÎQ‹‚j%U×¼±†ÙŸJXµ¿LF-.=5†Oí~Ñ +\jË9gWØÅ."FˆmßÝÔÇ‘ÓßAÌõ|ˆWj
p7MÐ"Kc20ȧåOh]9J°F®×Ò‡õíTNì)mC\Rà‰æ8èÄЗ|- µÂ¸ÅæßËlÏB@\ë®4Ʋó˜•k™_̦CÍö˜T!Ô½\!ƒÂD×$×&miÀ槻ÁLÝ¢»?a|ÿ¤þë™ú*$÷¼66ÛëðÞºR¨p`N‹8¹Îs©2õóŸÉ×®aLç%¢)K–9CJN +iÿót:ùÃûxxñÍš6ïÛ÷ÄKZ·ÏlŽ¸ŠŒbd|Oá±–kË¥þÎÏB™E‹¤» +èlLäšOnRZ~‡î&I°=w¦}æ‰l§b””Î÷g ÅTÍ‘ûûÁ{Ë1LxméÌ?b†‘Ü€±%Öé]¶çÛ'$5ˆç
}~Ü‹{Á47
ŒCS endobj -678 0 obj << +682 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1915 0 R +/Encoding 1922 0 R /FirstChar 2 -/LastChar 151 -/Widths 1929 0 R -/BaseFont /FRWOFA+URWPalladioL-Roma -/FontDescriptor 676 0 R +/LastChar 216 +/Widths 1936 0 R +/BaseFont /TNSCDZ+URWPalladioL-Roma +/FontDescriptor 680 0 R >> endobj -676 0 obj << +680 0 obj << /Ascent 715 /CapHeight 680 /Descent -282 -/FontName /FRWOFA+URWPalladioL-Roma +/FontName /TNSCDZ+URWPalladioL-Roma /ItalicAngle 0 /StemV 84 /XHeight 469 /FontBBox [-166 -283 1021 943] /Flags 4 -/CharSet (/fi/fl/exclam/numbersign/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/bracketright/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/circumflex/quotedblright/emdash) -/FontFile 677 0 R +/CharSet (/fi/fl/exclam/numbersign/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/bracketright/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/circumflex/quotedblright/emdash/Oslash) +/FontFile 681 0 R >> endobj -1929 0 obj -[605 608 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 278 0 500 500 840 0 278 333 333 389 606 250 333 250 606 500 500 500 500 500 500 500 500 500 500 250 250 0 606 0 444 747 778 611 709 774 611 556 763 832 337 333 726 611 946 831 786 604 786 668 525 613 778 722 1000 667 667 667 333 0 333 0 0 278 500 553 444 611 479 333 556 582 291 234 556 291 883 582 546 601 560 395 424 326 603 565 834 516 556 500 0 0 0 0 0 0 0 0 0 0 0 0 0 333 0 0 0 0 0 0 0 0 0 0 0 500 0 0 1000 ] +1936 0 obj +[605 608 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 278 0 500 500 840 0 278 333 333 389 606 250 333 250 606 500 500 500 500 500 500 500 500 500 500 250 250 0 606 0 444 747 778 611 709 774 611 556 763 832 337 333 726 611 946 831 786 604 786 668 525 613 778 722 1000 667 667 667 333 0 333 0 0 278 500 553 444 611 479 333 556 582 291 234 556 291 883 582 546 601 560 395 424 326 603 565 834 516 556 500 0 0 0 0 0 0 0 0 0 0 0 0 0 333 0 0 0 0 0 0 0 0 0 0 0 500 0 0 1000 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 833 ] endobj -653 0 obj << +657 0 obj << /Length1 1614 /Length2 24766 /Length3 532 @@ -9379,7 +9476,7 @@ endobj /Filter /FlateDecode >> stream -xÚ¬zSm]³eÙ¶]uʶmÛ¶mÛö)Û¶mÛæ)ó”«ëû¯:n÷S÷}Xkfæ92GÎ{G,RBy%c;CQ;[gZzNE5ykkc;iA;kc‚3)©£‰³…°³ 'š‰1°‰##)½‡£…™¹3ùõYþ !0ôøÏÏN'3[²ŸWk;{[çˆÿçJ&&Îæ&¦Ö&Brò²bäb²*b&¶&ŽÖò.†ÖFÒF&¶N&¦vŽÖÿ¶ 0²³5¶ø§4'Ú,''{#‹Ÿm&îF&öÿ¸¨ ìMm,œœ~Þ ,œÌ
lzàlG`akdíbü»©Ý¿Ù;ÚýDØüø~Àä휜Œ-ì ~²Ê‹þOgsçr;Yü¸ ìL"íŒ\þ)é_¾˜¯³…³‰»ó?¹MŒ-œì
<~rÿ€Ù;Zü‹†‹“…Ù1 &p413p4¶6qrúùÁþ§;ÿU'ÁÿV½½½µÇ¿vÛý+ê?9X8;™X›ÒB10þä4rþÉmfaE÷ϨHØšÚ0Ðÿ›ÝØÅþ?|®&Žÿjù?3CñCÂÀØÎÖÚƒÀØÄŠNÖÎù'%ùÿ›Ê´ÿs"ÿHü?"ðÿˆ¼ÿâþwþ·Cüÿ{žÿ;´¨‹µµ¬É¿6üÇC MðÏ%óØXX{üßÂÿ{¤šÉ¿qü¿¡H8ü4BÀÖìGzZú3Z8‰Z¸›Ë[8™˜Xÿté_v[cGk[“5ÿÕHzúÿæS6·0²²ý§í,ÿæ2±5þïÔúq:%!M 5ªÿóFýWœüòÎÊö?Ôþ½;ãÿ\üƒ"(hçNàEÃÀÂH@ÃDÏðsà~øp0±øü_2þˆá¿Ö2ÎŽîZ?eÿìü§øþk¥óß`DlìŒÿ™%g[ãŸñúOÃ?n#GÇUÿuâŠþõ¿ÝÄÄÝÄj}ÅΈ+Ø2ýw†szîÈ”°Ö@ðHˆ}i£rQ]¯_zøG¥þGmmÓçW»ÇòûÏ#IÊã±>4ë_½©&×ù8>ÄýˆÛdlTÇtº¥°jÑ^7KÒ» š¬ôªÇûS +xÚ¬zSm]³eÙ¶]uʶmÛ¶mÛö)Û¶mÛæ)ó”«ëû¯:n÷S÷}Xkfæ92GÎ{G,RBy%c;CQ;[gZzNE5ykkc;iA;kc‚3)©£‰³…°³ 'š‰1°‰##)½‡£…™¹3ùõYþ !0ôøÏÏN'3[²ŸWk;{[çˆÿçJ&&Îæ&¦Ö&Brò²bäb²*b&¶&ŽÖò.†ÖFÒF&¶N&¦vŽÖÿ¶ 0²³5¶ø§4'Ú,''{#‹Ÿm&îF&öÿ¸¨ ìMm,œœ~Þ ,œÌ
lzàlG`akdíbü»©Ý¿Ù;ÚýDØüø~Àä휜Œ-ì ~²Ê‹þOgsçr;Yü¸ ìL"íŒ\þ)é_¾˜¯³…³‰»ó?¹MŒ-œì
<~rÿ€Ù;Zü‹†‹“…Ù1 &p413p4¶6qrúùÁþ§;ÿU'ÁÿV½½½µÇ¿vÛý+ê?9X8;™X›ÒB10þä4rþÉmfaE÷ϨHØšÚ0Ðÿ›ÝØÅþ?|®&Žÿjù?3CñCÂÀØÎÖÚƒÀØÄŠNÖÎù'%ùÿ›Ê´ÿs"ÿHü?"ðÿˆ¼ÿâþwþ·Cüÿ{žÿ;´¨‹µµ¬É¿6üÇC MðÏ%óØXX{üßÂÿ{¤šÉ¿qü¿¡H8ü4BÀÖìGzZú3Z8‰Z¸›Ë[8™˜Xÿté_v[cGk[“5ÿÕHzúÿæS6·0²²ý§í,ÿæ2±5þïÔúq:yUuuªÿóFýWœüòÎÊö?Ôþ½;ãÿ\üƒ"(hçNàEÃÀÂH@ÃDÏðsà~øp0±øü_2þˆá¿Ö2ÎŽîZ?eÿìü§øþk¥óß`DlìŒÿ™%g[ãŸñúOÃ?n#GÇUÿuâŠþõ¿ÝÄÄÝÄj}ÅΈ+Ø2ýw†szîÈ”°Ö@ðHˆ}i£rQ]¯_zøG¥þGmmÓçW»ÇòûÏ#IÊã±>4ë_½©&×ù8>ÄýˆÛdlTÇtº¥°jÑ^7KÒ» š¬ôªÇûS Šº%`¸3LŽ7)ü‰]üQHžíá|ÒâP»š ÿ\%ý}þ54>:2Ü{Ú„M•IÊå KåïƒÍ§©R!RÕDzÝžeÌ}øØ"œ³\ʤ!g?5íµ Îk“T$f}QìŒ}}œ7Ãë–aIzQ£Ø`{1®ËÊ›¡9sõ‰ór5úË<#¤=ø…ˆ´±36…è4Ó+òŽÇ¾a‘Ïp:‰é"“|:[5P6“Ó<M`IÍÍÍLÕ‘˜‡‰ŠŒDa_gÁ¡Ãœá½]é–§ 9ç8sêÓšÆô e¬bô:miØ*N±«z|+hytHOÛV77Ùa‰ @@ -9478,1079 +9575,1087 @@ Iö×~pºóE¦f}^!˜tQ°Ù’‹ƒEäì>‰ n|'ÆV²5D9_äå‹7â̬FJvõ˜2ÈÛŒ’ý;Û£K¿>Z&ú‰Àš¤þØɉ, y‘üP'càÜ^M#R°·ñÃ4
{LJB«œ»×ën¾HïŸMc–9|þ*S5ïV®ñKãÁ“üvÚJ¦‰‡’à°áR‹ÁPKw©ä;ÉͳðåH-ºOÖ²ÉâØÉ*Wü—¼éýšö•p…+èó®a7AÔºº;˜âR·~4ÿÕ|S®‘mƒ®W•~ ©Ãâ‡}DL×WF5J‰åéØ|¨i÷>#\2®˜ šÒ30D”€`Ÿ†§¾ç4}&1xÒ¤Ö¥ ÎdP•Ý‹$ȾCO‡Ù’jÛvëö?`C&W'aÔCJ•I'sŠFðìM˼k©¡¨»°+X ŠcAÐÀ«á¥£ùr!<s%!ÈbˆÀNÑ*d3³Ê6†Ø0´+3ïÍNYÀ8îj•ÛP³7Þ¨VäÎc=$0€Ž9€òõ
«£…WCÒ¸1å
Ô²9L±ž±~óŸ–äWÚyüInÐäöÀ'¼I3
ú]`+ò7vÃÝ!’ÔËö—k«Zœ–(&4¨j„¸`é+àpôxÿÅë«SüWâ$åM7ƒ[IZÒýš®ê~‚VƒÍ:Ø\é«…Œ€Øy_à£öý .ÈëÃ6‹û¯™ÅSßcŽ¾Q&É5 fd -ön’“,6"”@K;\ÿŸÁüø¯ +ön’“,6"”@K;\ÿŸÁüø¯ endobj -654 0 obj << +658 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1915 0 R +/Encoding 1922 0 R /FirstChar 2 /LastChar 151 -/Widths 1930 0 R -/BaseFont /SCZMIW+URWPalladioL-Bold -/FontDescriptor 652 0 R +/Widths 1937 0 R +/BaseFont /PVQQXX+URWPalladioL-Bold +/FontDescriptor 656 0 R >> endobj -652 0 obj << +656 0 obj << /Ascent 708 /CapHeight 672 /Descent -266 -/FontName /SCZMIW+URWPalladioL-Bold +/FontName /PVQQXX+URWPalladioL-Bold /ItalicAngle 0 /StemV 123 /XHeight 471 /FontBBox [-152 -301 1000 935] /Flags 4 /CharSet (/fi/fl/exclam/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/question/at/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/quotedblright/emdash) -/FontFile 653 0 R +/FontFile 657 0 R >> endobj -1930 0 obj +1937 0 obj [611 611 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 278 0 0 500 889 0 278 333 333 444 606 250 333 250 296 500 500 500 500 500 500 500 500 500 500 250 250 0 0 0 444 747 778 667 722 833 611 556 833 833 389 0 778 611 1000 833 833 611 833 722 611 667 778 778 1000 667 667 667 333 0 333 0 0 0 500 611 444 611 500 389 556 611 333 333 611 333 889 611 556 611 611 389 444 333 611 556 833 500 556 500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 500 0 0 1000 ] endobj -655 0 obj << +659 0 obj << /Type /Pages /Count 6 -/Parent 1931 0 R -/Kids [646 0 R 673 0 R 683 0 R 738 0 R 802 0 R 862 0 R] +/Parent 1938 0 R +/Kids [650 0 R 677 0 R 687 0 R 742 0 R 806 0 R 867 0 R] >> endobj -881 0 obj << +886 0 obj << /Type /Pages /Count 6 -/Parent 1931 0 R -/Kids [866 0 R 883 0 R 897 0 R 908 0 R 915 0 R 927 0 R] +/Parent 1938 0 R +/Kids [871 0 R 888 0 R 902 0 R 913 0 R 920 0 R 932 0 R] >> endobj -939 0 obj << +944 0 obj << /Type /Pages /Count 6 -/Parent 1931 0 R -/Kids [932 0 R 941 0 R 952 0 R 960 0 R 967 0 R 973 0 R] +/Parent 1938 0 R +/Kids [937 0 R 946 0 R 957 0 R 965 0 R 972 0 R 978 0 R] >> endobj -996 0 obj << +1001 0 obj << /Type /Pages /Count 6 -/Parent 1931 0 R -/Kids [981 0 R 1003 0 R 1012 0 R 1017 0 R 1021 0 R 1028 0 R] +/Parent 1938 0 R +/Kids [986 0 R 1008 0 R 1018 0 R 1023 0 R 1027 0 R 1034 0 R] >> endobj -1044 0 obj << +1050 0 obj << /Type /Pages /Count 6 -/Parent 1931 0 R -/Kids [1037 0 R 1047 0 R 1054 0 R 1059 0 R 1068 0 R 1075 0 R] +/Parent 1938 0 R +/Kids [1043 0 R 1053 0 R 1060 0 R 1065 0 R 1074 0 R 1081 0 R] >> endobj -1087 0 obj << +1093 0 obj << /Type /Pages /Count 6 -/Parent 1931 0 R -/Kids [1079 0 R 1090 0 R 1096 0 R 1104 0 R 1111 0 R 1120 0 R] +/Parent 1938 0 R +/Kids [1085 0 R 1096 0 R 1102 0 R 1110 0 R 1117 0 R 1126 0 R] >> endobj -1139 0 obj << +1145 0 obj << /Type /Pages /Count 6 -/Parent 1932 0 R -/Kids [1133 0 R 1141 0 R 1146 0 R 1152 0 R 1158 0 R 1166 0 R] +/Parent 1939 0 R +/Kids [1139 0 R 1147 0 R 1152 0 R 1158 0 R 1164 0 R 1172 0 R] >> endobj -1176 0 obj << +1182 0 obj << /Type /Pages /Count 6 -/Parent 1932 0 R -/Kids [1173 0 R 1178 0 R 1183 0 R 1189 0 R 1195 0 R 1200 0 R] +/Parent 1939 0 R +/Kids [1179 0 R 1184 0 R 1189 0 R 1195 0 R 1199 0 R 1206 0 R] >> endobj -1213 0 obj << +1219 0 obj << /Type /Pages /Count 6 -/Parent 1932 0 R -/Kids [1210 0 R 1215 0 R 1220 0 R 1231 0 R 1237 0 R 1242 0 R] +/Parent 1939 0 R +/Kids [1216 0 R 1221 0 R 1226 0 R 1237 0 R 1243 0 R 1248 0 R] >> endobj -1250 0 obj << +1256 0 obj << /Type /Pages /Count 6 -/Parent 1932 0 R -/Kids [1246 0 R 1252 0 R 1260 0 R 1266 0 R 1273 0 R 1281 0 R] +/Parent 1939 0 R +/Kids [1252 0 R 1258 0 R 1266 0 R 1272 0 R 1279 0 R 1287 0 R] >> endobj -1297 0 obj << +1303 0 obj << /Type /Pages /Count 6 -/Parent 1932 0 R -/Kids [1288 0 R 1300 0 R 1304 0 R 1310 0 R 1315 0 R 1320 0 R] +/Parent 1939 0 R +/Kids [1294 0 R 1306 0 R 1310 0 R 1316 0 R 1321 0 R 1325 0 R] >> endobj -1332 0 obj << +1338 0 obj << /Type /Pages /Count 6 -/Parent 1932 0 R -/Kids [1329 0 R 1334 0 R 1338 0 R 1342 0 R 1350 0 R 1362 0 R] +/Parent 1939 0 R +/Kids [1334 0 R 1340 0 R 1344 0 R 1348 0 R 1356 0 R 1361 0 R] >> endobj -1394 0 obj << +1392 0 obj << /Type /Pages /Count 6 -/Parent 1933 0 R -/Kids [1373 0 R 1396 0 R 1402 0 R 1414 0 R 1420 0 R 1428 0 R] +/Parent 1940 0 R +/Kids [1378 0 R 1394 0 R 1409 0 R 1419 0 R 1425 0 R 1432 0 R] >> endobj -1448 0 obj << +1453 0 obj << /Type /Pages /Count 6 -/Parent 1933 0 R -/Kids [1439 0 R 1450 0 R 1458 0 R 1462 0 R 1466 0 R 1472 0 R] +/Parent 1940 0 R +/Kids [1443 0 R 1455 0 R 1463 0 R 1469 0 R 1473 0 R 1479 0 R] >> endobj -1486 0 obj << +1493 0 obj << /Type /Pages /Count 6 -/Parent 1933 0 R -/Kids [1483 0 R 1488 0 R 1492 0 R 1503 0 R 1507 0 R 1514 0 R] +/Parent 1940 0 R +/Kids [1490 0 R 1495 0 R 1499 0 R 1510 0 R 1514 0 R 1521 0 R] >> endobj -1592 0 obj << +1589 0 obj << /Type /Pages /Count 6 -/Parent 1933 0 R -/Kids [1537 0 R 1594 0 R 1652 0 R 1709 0 R 1729 0 R 1738 0 R] +/Parent 1940 0 R +/Kids [1531 0 R 1591 0 R 1647 0 R 1702 0 R 1736 0 R 1745 0 R] >> endobj -1748 0 obj << +1755 0 obj << /Type /Pages /Count 6 -/Parent 1933 0 R -/Kids [1744 0 R 1750 0 R 1754 0 R 1759 0 R 1771 0 R 1775 0 R] +/Parent 1940 0 R +/Kids [1751 0 R 1757 0 R 1761 0 R 1766 0 R 1778 0 R 1782 0 R] >> endobj -1791 0 obj << +1798 0 obj << /Type /Pages /Count 6 -/Parent 1933 0 R -/Kids [1787 0 R 1793 0 R 1804 0 R 1809 0 R 1814 0 R 1826 0 R] +/Parent 1940 0 R +/Kids [1794 0 R 1800 0 R 1811 0 R 1816 0 R 1821 0 R 1832 0 R] >> endobj -1840 0 obj << +1847 0 obj << /Type /Pages /Count 6 -/Parent 1934 0 R -/Kids [1837 0 R 1842 0 R 1854 0 R 1858 0 R 1866 0 R 1876 0 R] +/Parent 1941 0 R +/Kids [1844 0 R 1849 0 R 1860 0 R 1865 0 R 1872 0 R 1883 0 R] >> endobj -1891 0 obj << +1898 0 obj << /Type /Pages /Count 4 -/Parent 1934 0 R -/Kids [1887 0 R 1893 0 R 1904 0 R 1910 0 R] +/Parent 1941 0 R +/Kids [1894 0 R 1900 0 R 1910 0 R 1916 0 R] >> endobj -1931 0 obj << +1938 0 obj << /Type /Pages /Count 36 -/Parent 1935 0 R -/Kids [655 0 R 881 0 R 939 0 R 996 0 R 1044 0 R 1087 0 R] +/Parent 1942 0 R +/Kids [659 0 R 886 0 R 944 0 R 1001 0 R 1050 0 R 1093 0 R] >> endobj -1932 0 obj << +1939 0 obj << /Type /Pages /Count 36 -/Parent 1935 0 R -/Kids [1139 0 R 1176 0 R 1213 0 R 1250 0 R 1297 0 R 1332 0 R] +/Parent 1942 0 R +/Kids [1145 0 R 1182 0 R 1219 0 R 1256 0 R 1303 0 R 1338 0 R] >> endobj -1933 0 obj << +1940 0 obj << /Type /Pages /Count 36 -/Parent 1935 0 R -/Kids [1394 0 R 1448 0 R 1486 0 R 1592 0 R 1748 0 R 1791 0 R] +/Parent 1942 0 R +/Kids [1392 0 R 1453 0 R 1493 0 R 1589 0 R 1755 0 R 1798 0 R] >> endobj -1934 0 obj << +1941 0 obj << /Type /Pages /Count 10 -/Parent 1935 0 R -/Kids [1840 0 R 1891 0 R] +/Parent 1942 0 R +/Kids [1847 0 R 1898 0 R] >> endobj -1935 0 obj << +1942 0 obj << /Type /Pages /Count 118 -/Kids [1931 0 R 1932 0 R 1933 0 R 1934 0 R] +/Kids [1938 0 R 1939 0 R 1940 0 R 1941 0 R] >> endobj -1936 0 obj << +1943 0 obj << /Type /Outlines /First 7 0 R -/Last 603 0 R +/Last 607 0 R /Count 10 >> endobj +647 0 obj << +/Title 648 0 R +/A 645 0 R +/Parent 607 0 R +/Prev 643 0 R +>> endobj 643 0 obj << /Title 644 0 R /A 641 0 R -/Parent 603 0 R +/Parent 607 0 R /Prev 639 0 R +/Next 647 0 R >> endobj 639 0 obj << /Title 640 0 R /A 637 0 R -/Parent 603 0 R +/Parent 607 0 R /Prev 635 0 R /Next 643 0 R >> endobj 635 0 obj << /Title 636 0 R /A 633 0 R -/Parent 603 0 R +/Parent 607 0 R /Prev 631 0 R /Next 639 0 R >> endobj 631 0 obj << /Title 632 0 R /A 629 0 R -/Parent 603 0 R +/Parent 607 0 R /Prev 627 0 R /Next 635 0 R >> endobj 627 0 obj << /Title 628 0 R /A 625 0 R -/Parent 603 0 R +/Parent 607 0 R /Prev 623 0 R /Next 631 0 R >> endobj 623 0 obj << /Title 624 0 R /A 621 0 R -/Parent 603 0 R +/Parent 607 0 R /Prev 619 0 R /Next 627 0 R >> endobj 619 0 obj << /Title 620 0 R /A 617 0 R -/Parent 603 0 R +/Parent 607 0 R /Prev 615 0 R /Next 623 0 R >> endobj 615 0 obj << /Title 616 0 R /A 613 0 R -/Parent 603 0 R +/Parent 607 0 R /Prev 611 0 R /Next 619 0 R >> endobj 611 0 obj << /Title 612 0 R /A 609 0 R -/Parent 603 0 R -/Prev 607 0 R +/Parent 607 0 R /Next 615 0 R >> endobj 607 0 obj << /Title 608 0 R /A 605 0 R -/Parent 603 0 R -/Next 611 0 R +/Parent 1943 0 R +/Prev 571 0 R +/First 611 0 R +/Last 647 0 R +/Count -10 >> endobj 603 0 obj << /Title 604 0 R /A 601 0 R -/Parent 1936 0 R -/Prev 567 0 R -/First 607 0 R -/Last 643 0 R -/Count -10 +/Parent 591 0 R +/Prev 599 0 R >> endobj 599 0 obj << /Title 600 0 R /A 597 0 R -/Parent 587 0 R +/Parent 591 0 R /Prev 595 0 R +/Next 603 0 R >> endobj 595 0 obj << /Title 596 0 R /A 593 0 R -/Parent 587 0 R -/Prev 591 0 R +/Parent 591 0 R /Next 599 0 R >> endobj 591 0 obj << /Title 592 0 R /A 589 0 R -/Parent 587 0 R -/Next 595 0 R +/Parent 571 0 R +/Prev 583 0 R +/First 595 0 R +/Last 603 0 R +/Count -3 >> endobj 587 0 obj << /Title 588 0 R /A 585 0 R -/Parent 567 0 R -/Prev 579 0 R -/First 591 0 R -/Last 599 0 R -/Count -3 +/Parent 583 0 R >> endobj 583 0 obj << /Title 584 0 R /A 581 0 R -/Parent 579 0 R +/Parent 571 0 R +/Prev 575 0 R +/Next 591 0 R +/First 587 0 R +/Last 587 0 R +/Count -1 >> endobj 579 0 obj << /Title 580 0 R /A 577 0 R -/Parent 567 0 R -/Prev 571 0 R -/Next 587 0 R -/First 583 0 R -/Last 583 0 R -/Count -1 +/Parent 575 0 R >> endobj 575 0 obj << /Title 576 0 R /A 573 0 R /Parent 571 0 R +/Next 583 0 R +/First 579 0 R +/Last 579 0 R +/Count -1 >> endobj 571 0 obj << /Title 572 0 R /A 569 0 R -/Parent 567 0 R -/Next 579 0 R +/Parent 1943 0 R +/Prev 551 0 R +/Next 607 0 R /First 575 0 R -/Last 575 0 R -/Count -1 +/Last 591 0 R +/Count -3 >> endobj 567 0 obj << /Title 568 0 R /A 565 0 R -/Parent 1936 0 R -/Prev 547 0 R -/Next 603 0 R -/First 571 0 R -/Last 587 0 R -/Count -3 +/Parent 551 0 R +/Prev 563 0 R >> endobj 563 0 obj << /Title 564 0 R /A 561 0 R -/Parent 547 0 R -/Prev 559 0 R +/Parent 551 0 R +/Prev 555 0 R +/Next 567 0 R >> endobj 559 0 obj << /Title 560 0 R /A 557 0 R -/Parent 547 0 R -/Prev 551 0 R -/Next 563 0 R +/Parent 555 0 R >> endobj 555 0 obj << /Title 556 0 R /A 553 0 R /Parent 551 0 R +/Next 563 0 R +/First 559 0 R +/Last 559 0 R +/Count -1 >> endobj 551 0 obj << /Title 552 0 R /A 549 0 R -/Parent 547 0 R -/Next 559 0 R +/Parent 1943 0 R +/Prev 527 0 R +/Next 571 0 R /First 555 0 R -/Last 555 0 R -/Count -1 +/Last 567 0 R +/Count -3 >> endobj 547 0 obj << /Title 548 0 R /A 545 0 R -/Parent 1936 0 R -/Prev 523 0 R -/Next 567 0 R -/First 551 0 R -/Last 563 0 R -/Count -3 +/Parent 527 0 R +/Prev 535 0 R >> endobj 543 0 obj << /Title 544 0 R /A 541 0 R -/Parent 523 0 R -/Prev 531 0 R +/Parent 535 0 R +/Prev 539 0 R >> endobj 539 0 obj << /Title 540 0 R /A 537 0 R -/Parent 531 0 R -/Prev 535 0 R +/Parent 535 0 R +/Next 543 0 R >> endobj 535 0 obj << /Title 536 0 R /A 533 0 R -/Parent 531 0 R -/Next 539 0 R +/Parent 527 0 R +/Prev 531 0 R +/Next 547 0 R +/First 539 0 R +/Last 543 0 R +/Count -2 >> endobj 531 0 obj << /Title 532 0 R /A 529 0 R -/Parent 523 0 R -/Prev 527 0 R -/Next 543 0 R -/First 535 0 R -/Last 539 0 R -/Count -2 +/Parent 527 0 R +/Next 535 0 R >> endobj 527 0 obj << /Title 528 0 R /A 525 0 R -/Parent 523 0 R -/Next 531 0 R +/Parent 1943 0 R +/Prev 243 0 R +/Next 551 0 R +/First 531 0 R +/Last 547 0 R +/Count -3 >> endobj 523 0 obj << /Title 524 0 R /A 521 0 R -/Parent 1936 0 R -/Prev 239 0 R -/Next 547 0 R -/First 527 0 R -/Last 543 0 R -/Count -3 +/Parent 475 0 R +/Prev 519 0 R >> endobj 519 0 obj << /Title 520 0 R /A 517 0 R -/Parent 471 0 R -/Prev 515 0 R +/Parent 475 0 R +/Prev 503 0 R +/Next 523 0 R >> endobj 515 0 obj << /Title 516 0 R /A 513 0 R -/Parent 471 0 R -/Prev 499 0 R -/Next 519 0 R +/Parent 503 0 R +/Prev 511 0 R >> endobj 511 0 obj << /Title 512 0 R /A 509 0 R -/Parent 499 0 R +/Parent 503 0 R /Prev 507 0 R +/Next 515 0 R >> endobj 507 0 obj << /Title 508 0 R /A 505 0 R -/Parent 499 0 R -/Prev 503 0 R +/Parent 503 0 R /Next 511 0 R >> endobj 503 0 obj << /Title 504 0 R /A 501 0 R -/Parent 499 0 R -/Next 507 0 R +/Parent 475 0 R +/Prev 499 0 R +/Next 519 0 R +/First 507 0 R +/Last 515 0 R +/Count -3 >> endobj 499 0 obj << /Title 500 0 R /A 497 0 R -/Parent 471 0 R +/Parent 475 0 R /Prev 495 0 R -/Next 515 0 R -/First 503 0 R -/Last 511 0 R -/Count -3 +/Next 503 0 R >> endobj 495 0 obj << /Title 496 0 R /A 493 0 R -/Parent 471 0 R +/Parent 475 0 R /Prev 491 0 R /Next 499 0 R >> endobj 491 0 obj << /Title 492 0 R /A 489 0 R -/Parent 471 0 R -/Prev 487 0 R +/Parent 475 0 R +/Prev 479 0 R /Next 495 0 R >> endobj 487 0 obj << /Title 488 0 R /A 485 0 R -/Parent 471 0 R -/Prev 475 0 R -/Next 491 0 R +/Parent 479 0 R +/Prev 483 0 R >> endobj 483 0 obj << /Title 484 0 R /A 481 0 R -/Parent 475 0 R -/Prev 479 0 R +/Parent 479 0 R +/Next 487 0 R >> endobj 479 0 obj << /Title 480 0 R /A 477 0 R /Parent 475 0 R -/Next 483 0 R +/Next 491 0 R +/First 483 0 R +/Last 487 0 R +/Count -2 >> endobj 475 0 obj << /Title 476 0 R /A 473 0 R -/Parent 471 0 R -/Next 487 0 R +/Parent 243 0 R +/Prev 275 0 R /First 479 0 R -/Last 483 0 R -/Count -2 +/Last 523 0 R +/Count -7 >> endobj 471 0 obj << /Title 472 0 R /A 469 0 R -/Parent 239 0 R -/Prev 271 0 R -/First 475 0 R -/Last 519 0 R -/Count -7 +/Parent 455 0 R +/Prev 467 0 R >> endobj 467 0 obj << /Title 468 0 R /A 465 0 R -/Parent 451 0 R +/Parent 455 0 R /Prev 463 0 R +/Next 471 0 R >> endobj 463 0 obj << /Title 464 0 R /A 461 0 R -/Parent 451 0 R +/Parent 455 0 R /Prev 459 0 R /Next 467 0 R >> endobj 459 0 obj << /Title 460 0 R /A 457 0 R -/Parent 451 0 R -/Prev 455 0 R +/Parent 455 0 R /Next 463 0 R >> endobj 455 0 obj << /Title 456 0 R /A 453 0 R -/Parent 451 0 R -/Next 459 0 R +/Parent 275 0 R +/Prev 451 0 R +/First 459 0 R +/Last 471 0 R +/Count -4 >> endobj 451 0 obj << /Title 452 0 R /A 449 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 447 0 R -/First 455 0 R -/Last 467 0 R -/Count -4 +/Next 455 0 R >> endobj 447 0 obj << /Title 448 0 R /A 445 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 443 0 R /Next 451 0 R >> endobj 443 0 obj << /Title 444 0 R /A 441 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 439 0 R /Next 447 0 R >> endobj 439 0 obj << /Title 440 0 R /A 437 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 435 0 R /Next 443 0 R >> endobj 435 0 obj << /Title 436 0 R /A 433 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 431 0 R /Next 439 0 R >> endobj 431 0 obj << /Title 432 0 R /A 429 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 427 0 R /Next 435 0 R >> endobj 427 0 obj << /Title 428 0 R /A 425 0 R -/Parent 271 0 R -/Prev 423 0 R +/Parent 275 0 R +/Prev 347 0 R /Next 431 0 R >> endobj 423 0 obj << /Title 424 0 R /A 421 0 R -/Parent 271 0 R -/Prev 343 0 R -/Next 427 0 R +/Parent 347 0 R +/Prev 419 0 R >> endobj 419 0 obj << /Title 420 0 R /A 417 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 415 0 R +/Next 423 0 R >> endobj 415 0 obj << /Title 416 0 R /A 413 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 411 0 R /Next 419 0 R >> endobj 411 0 obj << /Title 412 0 R /A 409 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 407 0 R /Next 415 0 R >> endobj 407 0 obj << /Title 408 0 R /A 405 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 403 0 R /Next 411 0 R >> endobj 403 0 obj << /Title 404 0 R /A 401 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 399 0 R /Next 407 0 R >> endobj 399 0 obj << /Title 400 0 R /A 397 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 395 0 R /Next 403 0 R >> endobj 395 0 obj << /Title 396 0 R /A 393 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 391 0 R /Next 399 0 R >> endobj 391 0 obj << /Title 392 0 R /A 389 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 387 0 R /Next 395 0 R >> endobj 387 0 obj << /Title 388 0 R /A 385 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 383 0 R /Next 391 0 R >> endobj 383 0 obj << /Title 384 0 R /A 381 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 379 0 R /Next 387 0 R >> endobj 379 0 obj << /Title 380 0 R /A 377 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 375 0 R /Next 383 0 R >> endobj 375 0 obj << /Title 376 0 R /A 373 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 371 0 R /Next 379 0 R >> endobj 371 0 obj << /Title 372 0 R /A 369 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 367 0 R /Next 375 0 R >> endobj 367 0 obj << /Title 368 0 R /A 365 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 363 0 R /Next 371 0 R >> endobj 363 0 obj << /Title 364 0 R /A 361 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 359 0 R /Next 367 0 R >> endobj 359 0 obj << /Title 360 0 R /A 357 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 355 0 R /Next 363 0 R >> endobj 355 0 obj << /Title 356 0 R /A 353 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 351 0 R /Next 359 0 R >> endobj 351 0 obj << /Title 352 0 R /A 349 0 R -/Parent 343 0 R -/Prev 347 0 R +/Parent 347 0 R /Next 355 0 R >> endobj 347 0 obj << /Title 348 0 R /A 345 0 R -/Parent 343 0 R -/Next 351 0 R +/Parent 275 0 R +/Prev 343 0 R +/Next 427 0 R +/First 351 0 R +/Last 423 0 R +/Count -19 >> endobj 343 0 obj << /Title 344 0 R /A 341 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 339 0 R -/Next 423 0 R -/First 347 0 R -/Last 419 0 R -/Count -19 +/Next 347 0 R >> endobj 339 0 obj << /Title 340 0 R /A 337 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 335 0 R /Next 343 0 R >> endobj 335 0 obj << /Title 336 0 R /A 333 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 331 0 R /Next 339 0 R >> endobj 331 0 obj << /Title 332 0 R /A 329 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 327 0 R /Next 335 0 R >> endobj 327 0 obj << /Title 328 0 R /A 325 0 R -/Parent 271 0 R -/Prev 323 0 R +/Parent 275 0 R +/Prev 315 0 R /Next 331 0 R >> endobj 323 0 obj << /Title 324 0 R /A 321 0 R -/Parent 271 0 R -/Prev 311 0 R -/Next 327 0 R +/Parent 315 0 R +/Prev 319 0 R >> endobj 319 0 obj << /Title 320 0 R /A 317 0 R -/Parent 311 0 R -/Prev 315 0 R +/Parent 315 0 R +/Next 323 0 R >> endobj 315 0 obj << /Title 316 0 R /A 313 0 R -/Parent 311 0 R -/Next 319 0 R +/Parent 275 0 R +/Prev 311 0 R +/Next 327 0 R +/First 319 0 R +/Last 323 0 R +/Count -2 >> endobj 311 0 obj << /Title 312 0 R /A 309 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 307 0 R -/Next 323 0 R -/First 315 0 R -/Last 319 0 R -/Count -2 +/Next 315 0 R >> endobj 307 0 obj << /Title 308 0 R /A 305 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 303 0 R /Next 311 0 R >> endobj 303 0 obj << /Title 304 0 R /A 301 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 299 0 R /Next 307 0 R >> endobj 299 0 obj << /Title 300 0 R /A 297 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 295 0 R /Next 303 0 R >> endobj 295 0 obj << /Title 296 0 R /A 293 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 291 0 R /Next 299 0 R >> endobj 291 0 obj << /Title 292 0 R /A 289 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 287 0 R /Next 295 0 R >> endobj 287 0 obj << /Title 288 0 R /A 285 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 283 0 R /Next 291 0 R >> endobj 283 0 obj << /Title 284 0 R /A 281 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 279 0 R /Next 287 0 R >> endobj 279 0 obj << /Title 280 0 R /A 277 0 R -/Parent 271 0 R -/Prev 275 0 R +/Parent 275 0 R /Next 283 0 R >> endobj 275 0 obj << /Title 276 0 R /A 273 0 R -/Parent 271 0 R -/Next 279 0 R +/Parent 243 0 R +/Prev 247 0 R +/Next 475 0 R +/First 279 0 R +/Last 455 0 R +/Count -24 >> endobj 271 0 obj << /Title 272 0 R /A 269 0 R -/Parent 239 0 R -/Prev 243 0 R -/Next 471 0 R -/First 275 0 R -/Last 451 0 R -/Count -24 +/Parent 263 0 R +/Prev 267 0 R >> endobj 267 0 obj << /Title 268 0 R /A 265 0 R -/Parent 259 0 R -/Prev 263 0 R +/Parent 263 0 R +/Next 271 0 R >> endobj 263 0 obj << /Title 264 0 R /A 261 0 R -/Parent 259 0 R -/Next 267 0 R +/Parent 247 0 R +/Prev 251 0 R +/First 267 0 R +/Last 271 0 R +/Count -2 >> endobj 259 0 obj << /Title 260 0 R /A 257 0 R -/Parent 243 0 R -/Prev 247 0 R -/First 263 0 R -/Last 267 0 R -/Count -2 +/Parent 251 0 R +/Prev 255 0 R >> endobj 255 0 obj << /Title 256 0 R /A 253 0 R -/Parent 247 0 R -/Prev 251 0 R +/Parent 251 0 R +/Next 259 0 R >> endobj 251 0 obj << /Title 252 0 R /A 249 0 R /Parent 247 0 R -/Next 255 0 R +/Next 263 0 R +/First 255 0 R +/Last 259 0 R +/Count -2 >> endobj 247 0 obj << /Title 248 0 R /A 245 0 R /Parent 243 0 R -/Next 259 0 R +/Next 275 0 R /First 251 0 R -/Last 255 0 R +/Last 263 0 R /Count -2 >> endobj 243 0 obj << /Title 244 0 R /A 241 0 R -/Parent 239 0 R -/Next 271 0 R +/Parent 1943 0 R +/Prev 231 0 R +/Next 527 0 R /First 247 0 R -/Last 259 0 R -/Count -2 +/Last 475 0 R +/Count -3 >> endobj 239 0 obj << /Title 240 0 R /A 237 0 R -/Parent 1936 0 R -/Prev 227 0 R -/Next 523 0 R -/First 243 0 R -/Last 471 0 R -/Count -3 +/Parent 231 0 R +/Prev 235 0 R >> endobj 235 0 obj << /Title 236 0 R /A 233 0 R -/Parent 227 0 R -/Prev 231 0 R +/Parent 231 0 R +/Next 239 0 R >> endobj 231 0 obj << /Title 232 0 R /A 229 0 R -/Parent 227 0 R -/Next 235 0 R +/Parent 1943 0 R +/Prev 131 0 R +/Next 243 0 R +/First 235 0 R +/Last 239 0 R +/Count -2 >> endobj 227 0 obj << /Title 228 0 R /A 225 0 R -/Parent 1936 0 R -/Prev 131 0 R -/Next 239 0 R -/First 231 0 R -/Last 235 0 R -/Count -2 +/Parent 219 0 R +/Prev 223 0 R >> endobj 223 0 obj << /Title 224 0 R /A 221 0 R -/Parent 215 0 R -/Prev 219 0 R +/Parent 219 0 R +/Next 227 0 R >> endobj 219 0 obj << /Title 220 0 R /A 217 0 R -/Parent 215 0 R -/Next 223 0 R +/Parent 131 0 R +/Prev 203 0 R +/First 223 0 R +/Last 227 0 R +/Count -2 >> endobj 215 0 obj << /Title 216 0 R /A 213 0 R -/Parent 131 0 R -/Prev 199 0 R -/First 219 0 R -/Last 223 0 R -/Count -2 +/Parent 203 0 R +/Prev 211 0 R >> endobj 211 0 obj << /Title 212 0 R /A 209 0 R -/Parent 199 0 R +/Parent 203 0 R /Prev 207 0 R +/Next 215 0 R >> endobj 207 0 obj << /Title 208 0 R /A 205 0 R -/Parent 199 0 R -/Prev 203 0 R +/Parent 203 0 R /Next 211 0 R >> endobj 203 0 obj << /Title 204 0 R /A 201 0 R -/Parent 199 0 R -/Next 207 0 R +/Parent 131 0 R +/Prev 199 0 R +/Next 219 0 R +/First 207 0 R +/Last 215 0 R +/Count -3 >> endobj 199 0 obj << /Title 200 0 R /A 197 0 R /Parent 131 0 R /Prev 195 0 R -/Next 215 0 R -/First 203 0 R -/Last 211 0 R -/Count -3 +/Next 203 0 R >> endobj 195 0 obj << /Title 196 0 R /A 193 0 R /Parent 131 0 R -/Prev 191 0 R +/Prev 159 0 R /Next 199 0 R >> endobj 191 0 obj << /Title 192 0 R /A 189 0 R -/Parent 131 0 R -/Prev 155 0 R -/Next 195 0 R +/Parent 159 0 R +/Prev 187 0 R >> endobj 187 0 obj << /Title 188 0 R /A 185 0 R -/Parent 155 0 R +/Parent 159 0 R /Prev 183 0 R +/Next 191 0 R >> endobj 183 0 obj << /Title 184 0 R /A 181 0 R -/Parent 155 0 R +/Parent 159 0 R /Prev 179 0 R /Next 187 0 R >> endobj 179 0 obj << /Title 180 0 R /A 177 0 R -/Parent 155 0 R +/Parent 159 0 R /Prev 175 0 R /Next 183 0 R >> endobj 175 0 obj << /Title 176 0 R /A 173 0 R -/Parent 155 0 R -/Prev 171 0 R +/Parent 159 0 R +/Prev 163 0 R /Next 179 0 R >> endobj 171 0 obj << /Title 172 0 R /A 169 0 R -/Parent 155 0 R -/Prev 159 0 R -/Next 175 0 R +/Parent 163 0 R +/Prev 167 0 R >> endobj 167 0 obj << /Title 168 0 R /A 165 0 R -/Parent 159 0 R -/Prev 163 0 R +/Parent 163 0 R +/Next 171 0 R >> endobj 163 0 obj << /Title 164 0 R /A 161 0 R /Parent 159 0 R -/Next 167 0 R +/Next 175 0 R +/First 167 0 R +/Last 171 0 R +/Count -2 >> endobj 159 0 obj << /Title 160 0 R /A 157 0 R -/Parent 155 0 R -/Next 171 0 R +/Parent 131 0 R +/Prev 151 0 R +/Next 195 0 R /First 163 0 R -/Last 167 0 R -/Count -2 +/Last 191 0 R +/Count -6 >> endobj 155 0 obj << /Title 156 0 R /A 153 0 R -/Parent 131 0 R -/Prev 151 0 R -/Next 191 0 R -/First 159 0 R -/Last 187 0 R -/Count -6 +/Parent 151 0 R >> endobj 151 0 obj << /Title 152 0 R /A 149 0 R /Parent 131 0 R /Prev 147 0 R -/Next 155 0 R +/Next 159 0 R +/First 155 0 R +/Last 155 0 R +/Count -1 >> endobj 147 0 obj << /Title 148 0 R @@ -10583,11 +10688,11 @@ endobj 131 0 obj << /Title 132 0 R /A 129 0 R -/Parent 1936 0 R +/Parent 1943 0 R /Prev 91 0 R -/Next 227 0 R +/Next 231 0 R /First 135 0 R -/Last 215 0 R +/Last 219 0 R /Count -9 >> endobj 127 0 obj << @@ -10657,7 +10762,7 @@ endobj 91 0 obj << /Title 92 0 R /A 89 0 R -/Parent 1936 0 R +/Parent 1943 0 R /Prev 67 0 R /Next 131 0 R /First 95 0 R @@ -10700,7 +10805,7 @@ endobj 67 0 obj << /Title 68 0 R /A 65 0 R -/Parent 1936 0 R +/Parent 1943 0 R /Prev 7 0 R /Next 91 0 R /First 71 0 R @@ -10809,1986 +10914,1993 @@ endobj 7 0 obj << /Title 8 0 R /A 5 0 R -/Parent 1936 0 R +/Parent 1943 0 R /Next 67 0 R /First 11 0 R /Last 23 0 R /Count -4 >> endobj -1937 0 obj << -/Names [(Access_Control_Lists) 1470 0 R (Bv9ARM.ch01) 869 0 R (Bv9ARM.ch02) 918 0 R (Bv9ARM.ch03) 935 0 R (Bv9ARM.ch04) 984 0 R (Bv9ARM.ch05) 1071 0 R (Bv9ARM.ch06) 1082 0 R (Bv9ARM.ch07) 1469 0 R (Bv9ARM.ch08) 1495 0 R (Bv9ARM.ch09) 1510 0 R (Bv9ARM.ch10) 1732 0 R (Configuration_File_Grammar) 1107 0 R (DNSSEC) 1050 0 R (Doc-Start) 651 0 R (Setting_TTLs) 1435 0 R (acache) 925 0 R (access_control) 1225 0 R (acl) 1115 0 R (address_match_lists) 1088 0 R (admin_tools) 958 0 R (appendix.A) 566 0 R (appendix.B) 602 0 R (bibliography) 1518 0 R (boolean_options) 1000 0 R (builtin) 1294 0 R (chapter*.1) 686 0 R (chapter.1) 6 0 R (chapter.2) 66 0 R (chapter.3) 90 0 R (chapter.4) 130 0 R (chapter.5) 226 0 R (chapter.6) 238 0 R (chapter.7) 522 0 R (chapter.8) 546 0 R (cite.RFC1033) 1642 0 R (cite.RFC1034) 1526 0 R (cite.RFC1035) 1528 0 R (cite.RFC1101) 1628 0 R (cite.RFC1123) 1630 0 R (cite.RFC1183) 1585 0 R (cite.RFC1464) 1668 0 R (cite.RFC1535) 1575 0 R (cite.RFC1536) 1577 0 R (cite.RFC1537) 1644 0 R (cite.RFC1591) 1632 0 R (cite.RFC1706) 1587 0 R (cite.RFC1712) 1689 0 R (cite.RFC1713) 1670 0 R (cite.RFC1794) 1672 0 R (cite.RFC1876) 1589 0 R (cite.RFC1912) 1646 0 R (cite.RFC1982) 1579 0 R (cite.RFC1995) 1533 0 R (cite.RFC1996) 1535 0 R (cite.RFC2010) 1648 0 R (cite.RFC2052) 1591 0 R (cite.RFC2065) 1697 0 R (cite.RFC2136) 1541 0 R (cite.RFC2137) 1699 0 R (cite.RFC2163) 1598 0 R (cite.RFC2168) 1600 0 R (cite.RFC2181) 1543 0 R (cite.RFC2219) 1650 0 R (cite.RFC2230) 1602 0 R (cite.RFC2240) 1674 0 R (cite.RFC2308) 1545 0 R (cite.RFC2317) 1634 0 R (cite.RFC2345) 1676 0 R (cite.RFC2352) 1678 0 R (cite.RFC2535) 1701 0 R (cite.RFC2536) 1604 0 R (cite.RFC2537) 1606 0 R (cite.RFC2538) 1608 0 R (cite.RFC2539) 1610 0 R (cite.RFC2540) 1612 0 R (cite.RFC2671) 1547 0 R (cite.RFC2672) 1549 0 R (cite.RFC2673) 1691 0 R (cite.RFC2782) 1614 0 R (cite.RFC2825) 1658 0 R (cite.RFC2826) 1636 0 R (cite.RFC2845) 1551 0 R (cite.RFC2874) 1693 0 R (cite.RFC2915) 1616 0 R (cite.RFC2929) 1638 0 R (cite.RFC2930) 1553 0 R (cite.RFC2931) 1555 0 R (cite.RFC3007) 1557 0 R (cite.RFC3008) 1703 0 R (cite.RFC3071) 1681 0 R (cite.RFC3090) 1705 0 R (cite.RFC3110) 1618 0 R (cite.RFC3123) 1620 0 R (cite.RFC3225) 1563 0 R (cite.RFC3258) 1683 0 R (cite.RFC3445) 1707 0 R (cite.RFC3490) 1660 0 R (cite.RFC3491) 1662 0 R (cite.RFC3492) 1664 0 R (cite.RFC3596) 1622 0 R (cite.RFC3597) 1624 0 R (cite.RFC3645) 1559 0 R (cite.RFC3655) 1713 0 R (cite.RFC3658) 1715 0 R (cite.RFC3755) 1717 0 R (cite.RFC3757) 1719 0 R (cite.RFC3833) 1565 0 R (cite.RFC3845) 1721 0 R (cite.RFC3901) 1685 0 R (cite.RFC4033) 1567 0 R (cite.RFC4035) 1569 0 R (cite.RFC4044) 1571 0 R (cite.RFC4074) 1581 0 R (cite.RFC974) 1530 0 R (cite.id2499275) 1726 0 R (configuration_file_elements) 1083 0 R (controls_statement_definition_and_usage) 971 0 R (diagnostic_tools) 906 0 R (dynamic_update) 994 0 R (dynamic_update_policies) 1045 0 R (dynamic_update_security) 1229 0 R (empty) 1296 0 R (historical_dns_information) 1512 0 R (id2465026) 870 0 R (id2467301) 871 0 R (id2467572) 875 0 R (id2467581) 876 0 R (id2467713) 886 0 R (id2467890) 888 0 R (id2467911) 889 0 R (id2467945) 890 0 R (id2468029) 893 0 R (id2470291) 900 0 R (id2470314) 903 0 R (id2470344) 904 0 R (id2470434) 905 0 R (id2470464) 911 0 R (id2470499) 912 0 R (id2470594) 913 0 R (id2470628) 919 0 R (id2470654) 920 0 R (id2470667) 921 0 R (id2470693) 924 0 R (id2470704) 930 0 R (id2470872) 937 0 R (id2470888) 938 0 R (id2470910) 944 0 R (id2470997) 945 0 R (id2471334) 948 0 R (id2471339) 949 0 R (id2472978) 976 0 R (id2472989) 977 0 R (id2473299) 1009 0 R (id2473818) 1025 0 R (id2473835) 1026 0 R (id2473874) 1031 0 R (id2473892) 1032 0 R (id2473902) 1033 0 R (id2474010) 1034 0 R (id2474068) 1035 0 R (id2474113) 1041 0 R (id2474195) 1042 0 R (id2474244) 1043 0 R (id2474449) 1051 0 R (id2474518) 1052 0 R (id2474597) 1057 0 R (id2474808) 1062 0 R (id2474870) 1064 0 R (id2474960) 1065 0 R (id2474993) 1072 0 R (id2475208) 1084 0 R (id2476001) 1093 0 R (id2476028) 1094 0 R (id2476203) 1099 0 R (id2476218) 1100 0 R (id2476248) 1101 0 R (id2476331) 1108 0 R (id2476747) 1114 0 R (id2476858) 1116 0 R (id2477005) 1118 0 R (id2477366) 1125 0 R (id2477381) 1126 0 R (id2477404) 1127 0 R (id2477426) 1128 0 R (id2477585) 1137 0 R (id2477779) 1138 0 R (id2477831) 1144 0 R (id2478456) 1155 0 R (id2479266) 1161 0 R (id2479339) 1162 0 R (id2479403) 1169 0 R (id2479447) 1170 0 R (id2479462) 1171 0 R (id2481444) 1192 0 R (id2483414) 1218 0 R (id2483541) 1224 0 R (id2483880) 1235 0 R (id2484037) 1240 0 R (id2484784) 1249 0 R (id2484798) 1255 0 R (id2484982) 1257 0 R (id2485184) 1263 0 R (id2485614) 1277 0 R (id2486968) 1307 0 R (id2487888) 1324 0 R (id2488005) 1325 0 R (id2488085) 1327 0 R (id2489456) 1345 0 R (id2489463) 1346 0 R (id2489468) 1347 0 R (id2489950) 1353 0 R (id2489984) 1354 0 R (id2491390) 1399 0 R (id2491648) 1405 0 R (id2491666) 1406 0 R (id2491686) 1409 0 R (id2491923) 1411 0 R (id2492952) 1417 0 R (id2493148) 1423 0 R (id2493238) 1424 0 R (id2493532) 1426 0 R (id2493669) 1432 0 R (id2493691) 1433 0 R (id2494232) 1436 0 R (id2494357) 1442 0 R (id2494372) 1443 0 R (id2494484) 1445 0 R (id2494506) 1446 0 R (id2494567) 1447 0 R (id2494705) 1453 0 R (id2494741) 1454 0 R (id2494803) 1455 0 R (id2495349) 1479 0 R (id2495562) 1480 0 R (id2495622) 1481 0 R (id2495770) 1496 0 R (id2495776) 1497 0 R (id2495787) 1498 0 R (id2495804) 1499 0 R (id2495866) 1511 0 R (id2495960) 1517 0 R (id2496148) 1522 0 R (id2496150) 1524 0 R (id2496158) 1529 0 R (id2496182) 1525 0 R (id2496205) 1527 0 R (id2496242) 1542 0 R (id2496268) 1544 0 R (id2496294) 1532 0 R (id2496318) 1534 0 R (id2496342) 1540 0 R (id2496397) 1546 0 R (id2496424) 1548 0 R (id2496451) 1550 0 R (id2496513) 1552 0 R (id2496542) 1554 0 R (id2496572) 1556 0 R (id2496599) 1558 0 R (id2496674) 1561 0 R (id2496681) 1562 0 R (id2496708) 1564 0 R (id2496744) 1566 0 R (id2496809) 1570 0 R (id2496874) 1568 0 R (id2497008) 1573 0 R (id2497016) 1574 0 R (id2497042) 1576 0 R (id2497110) 1578 0 R (id2497145) 1580 0 R (id2497186) 1583 0 R (id2497191) 1584 0 R (id2497317) 1586 0 R (id2497354) 1599 0 R (id2497389) 1588 0 R (id2497444) 1590 0 R (id2497482) 1597 0 R (id2497508) 1601 0 R (id2497533) 1603 0 R (id2497560) 1605 0 R (id2497587) 1607 0 R (id2497626) 1609 0 R (id2497656) 1611 0 R (id2497686) 1613 0 R (id2497729) 1615 0 R (id2497762) 1617 0 R (id2497788) 1619 0 R (id2497812) 1621 0 R (id2497869) 1623 0 R (id2497894) 1626 0 R (id2497901) 1627 0 R (id2497927) 1629 0 R (id2497949) 1631 0 R (id2497973) 1633 0 R (id2498019) 1635 0 R (id2498042) 1637 0 R (id2498092) 1640 0 R (id2498100) 1641 0 R (id2498123) 1643 0 R (id2498150) 1645 0 R (id2498177) 1647 0 R (id2498213) 1649 0 R (id2498253) 1656 0 R (id2498259) 1657 0 R (id2498291) 1659 0 R (id2498337) 1661 0 R (id2498372) 1663 0 R (id2498398) 1666 0 R (id2498417) 1667 0 R (id2498507) 1669 0 R (id2498533) 1671 0 R (id2498558) 1673 0 R (id2498582) 1675 0 R (id2498628) 1677 0 R (id2498651) 1680 0 R (id2498678) 1682 0 R (id2498704) 1684 0 R (id2498740) 1679 0 R (id2498764) 1687 0 R (id2498771) 1688 0 R (id2498828) 1690 0 R (id2498855) 1692 0 R (id2498891) 1695 0 R (id2498903) 1696 0 R (id2498942) 1698 0 R (id2498969) 1700 0 R (id2498999) 1702 0 R (id2499025) 1704 0 R (id2499051) 1706 0 R (id2499088) 1712 0 R (id2499124) 1714 0 R (id2499150) 1716 0 R (id2499177) 1718 0 R (id2499222) 1720 0 R (id2499264) 1723 0 R (id2499273) 1725 0 R (id2499275) 1727 0 R (incremental_zone_transfers) 1006 0 R (internet_drafts) 1722 0 R (ipv6addresses) 1066 0 R (journal) 995 0 R (lwresd) 1073 0 R (man.dig) 1733 0 R (man.dnssec-keygen) 1781 0 R (man.dnssec-signzone) 1799 0 R (man.host) 1766 0 R (man.named) 1848 0 R (man.named-checkconf) 1819 0 R (man.named-checkzone) 1831 0 R (man.rndc) 1870 0 R (man.rndc-confgen) 1899 0 R (man.rndc.conf) 1882 0 R (notify) 985 0 R (options) 1181 0 R (page.1) 650 0 R (page.10) 910 0 R (page.100) 1761 0 R (page.101) 1773 0 R (page.102) 1777 0 R (page.103) 1789 0 R (page.104) 1795 0 R (page.105) 1806 0 R (page.106) 1811 0 R (page.107) 1816 0 R (page.108) 1828 0 R (page.109) 1839 0 R (page.11) 917 0 R (page.110) 1844 0 R (page.111) 1856 0 R (page.112) 1860 0 R (page.113) 1868 0 R (page.114) 1878 0 R (page.115) 1889 0 R (page.116) 1895 0 R (page.117) 1906 0 R (page.118) 1912 0 R (page.12) 929 0 R (page.13) 934 0 R (page.14) 943 0 R (page.15) 954 0 R (page.16) 962 0 R (page.17) 969 0 R (page.18) 975 0 R (page.19) 983 0 R (page.2) 675 0 R (page.20) 1005 0 R (page.21) 1014 0 R (page.22) 1019 0 R (page.23) 1023 0 R (page.24) 1030 0 R (page.25) 1039 0 R (page.26) 1049 0 R (page.27) 1056 0 R (page.28) 1061 0 R (page.29) 1070 0 R (page.3) 685 0 R (page.30) 1077 0 R (page.31) 1081 0 R (page.32) 1092 0 R (page.33) 1098 0 R (page.34) 1106 0 R (page.35) 1113 0 R (page.36) 1122 0 R (page.37) 1135 0 R (page.38) 1143 0 R (page.39) 1148 0 R (page.4) 740 0 R (page.40) 1154 0 R (page.41) 1160 0 R (page.42) 1168 0 R (page.43) 1175 0 R (page.44) 1180 0 R (page.45) 1185 0 R (page.46) 1191 0 R (page.47) 1197 0 R (page.48) 1202 0 R (page.49) 1212 0 R (page.5) 804 0 R (page.50) 1217 0 R (page.51) 1222 0 R (page.52) 1233 0 R (page.53) 1239 0 R (page.54) 1244 0 R (page.55) 1248 0 R (page.56) 1254 0 R (page.57) 1262 0 R (page.58) 1268 0 R (page.59) 1275 0 R (page.6) 864 0 R (page.60) 1283 0 R (page.61) 1290 0 R (page.62) 1302 0 R (page.63) 1306 0 R (page.64) 1312 0 R (page.65) 1317 0 R (page.66) 1322 0 R (page.67) 1331 0 R (page.68) 1336 0 R (page.69) 1340 0 R (page.7) 868 0 R (page.70) 1344 0 R (page.71) 1352 0 R (page.72) 1364 0 R (page.73) 1375 0 R (page.74) 1398 0 R (page.75) 1404 0 R (page.76) 1416 0 R (page.77) 1422 0 R (page.78) 1430 0 R (page.79) 1441 0 R (page.8) 885 0 R (page.80) 1452 0 R (page.81) 1460 0 R (page.82) 1464 0 R (page.83) 1468 0 R (page.84) 1474 0 R (page.85) 1485 0 R (page.86) 1490 0 R (page.87) 1494 0 R (page.88) 1505 0 R (page.89) 1509 0 R (page.9) 899 0 R (page.90) 1516 0 R (page.91) 1539 0 R (page.92) 1596 0 R (page.93) 1654 0 R (page.94) 1711 0 R (page.95) 1731 0 R (page.96) 1740 0 R (page.97) 1746 0 R (page.98) 1752 0 R (page.99) 1756 0 R (proposed_standards) 1010 0 R (rfcs) 895 0 R (rndc) 1131 0 R (rrset_ordering) 950 0 R (sample_configuration) 936 0 R (section*.10) 1655 0 R (section*.11) 1665 0 R (section*.12) 1686 0 R (section*.13) 1694 0 R (section*.14) 1724 0 R (section*.15) 1734 0 R (section*.16) 1735 0 R (section*.17) 1736 0 R (section*.18) 1741 0 R (section*.19) 1742 0 R (section*.2) 1521 0 R (section*.20) 1747 0 R (section*.21) 1757 0 R (section*.22) 1762 0 R (section*.23) 1763 0 R (section*.24) 1764 0 R (section*.25) 1765 0 R (section*.26) 1767 0 R (section*.27) 1768 0 R (section*.28) 1769 0 R (section*.29) 1778 0 R (section*.3) 1523 0 R (section*.30) 1779 0 R (section*.31) 1780 0 R (section*.32) 1782 0 R (section*.33) 1783 0 R (section*.34) 1784 0 R (section*.35) 1785 0 R (section*.36) 1790 0 R (section*.37) 1796 0 R (section*.38) 1797 0 R (section*.39) 1798 0 R (section*.4) 1531 0 R (section*.40) 1800 0 R (section*.41) 1801 0 R (section*.42) 1802 0 R (section*.43) 1807 0 R (section*.44) 1812 0 R (section*.45) 1817 0 R (section*.46) 1818 0 R (section*.47) 1820 0 R (section*.48) 1821 0 R (section*.49) 1822 0 R (section*.5) 1560 0 R (section*.50) 1823 0 R (section*.51) 1824 0 R (section*.52) 1829 0 R (section*.53) 1830 0 R (section*.54) 1832 0 R (section*.55) 1833 0 R (section*.56) 1834 0 R (section*.57) 1835 0 R (section*.58) 1845 0 R (section*.59) 1846 0 R (section*.6) 1572 0 R (section*.60) 1847 0 R (section*.61) 1849 0 R (section*.62) 1850 0 R (section*.63) 1851 0 R (section*.64) 1852 0 R (section*.65) 1861 0 R (section*.66) 1862 0 R (section*.67) 1863 0 R (section*.68) 1864 0 R (section*.69) 1869 0 R (section*.7) 1582 0 R (section*.70) 1871 0 R (section*.71) 1872 0 R (section*.72) 1873 0 R (section*.73) 1874 0 R (section*.74) 1879 0 R (section*.75) 1880 0 R (section*.76) 1881 0 R (section*.77) 1883 0 R (section*.78) 1884 0 R (section*.79) 1885 0 R (section*.8) 1625 0 R (section*.80) 1890 0 R (section*.81) 1896 0 R (section*.82) 1897 0 R (section*.83) 1898 0 R (section*.84) 1900 0 R (section*.85) 1901 0 R (section*.86) 1902 0 R (section*.87) 1907 0 R (section*.88) 1908 0 R (section*.89) 1913 0 R (section*.9) 1639 0 R (section*.90) 1914 0 R (section.1.1) 10 0 R (section.1.2) 14 0 R (section.1.3) 18 0 R (section.1.4) 22 0 R (section.2.1) 70 0 R (section.2.2) 74 0 R (section.2.3) 78 0 R (section.2.4) 82 0 R (section.2.5) 86 0 R (section.3.1) 94 0 R (section.3.2) 106 0 R (section.3.3) 110 0 R (section.4.1) 134 0 R (section.4.2) 138 0 R (section.4.3) 146 0 R (section.4.4) 150 0 R (section.4.5) 154 0 R (section.4.6) 190 0 R (section.4.7) 194 0 R (section.4.8) 198 0 R (section.4.9) 214 0 R (section.5.1) 230 0 R (section.5.2) 234 0 R (section.6.1) 242 0 R (section.6.2) 270 0 R (section.6.3) 470 0 R (section.7.1) 526 0 R (section.7.2) 530 0 R (section.7.3) 542 0 R (section.8.1) 550 0 R (section.8.2) 558 0 R (section.8.3) 562 0 R (section.A.1) 570 0 R (section.A.2) 578 0 R (section.A.3) 586 0 R (section.B.1) 606 0 R (section.B.10) 642 0 R (section.B.2) 610 0 R (section.B.3) 614 0 R (section.B.4) 618 0 R (section.B.5) 622 0 R (section.B.6) 626 0 R (section.B.7) 630 0 R (section.B.8) 634 0 R (section.B.9) 638 0 R (server_statement_definition_and_usage) 1208 0 R (server_statement_grammar) 1313 0 R (statsfile) 1187 0 R (subsection.1.4.1) 26 0 R (subsection.1.4.2) 30 0 R (subsection.1.4.3) 34 0 R (subsection.1.4.4) 38 0 R (subsection.1.4.5) 54 0 R (subsection.1.4.6) 62 0 R (subsection.3.1.1) 98 0 R (subsection.3.1.2) 102 0 R (subsection.3.3.1) 114 0 R (subsection.3.3.2) 126 0 R (subsection.4.2.1) 142 0 R (subsection.4.5.1) 158 0 R (subsection.4.5.2) 170 0 R (subsection.4.5.3) 174 0 R (subsection.4.5.4) 178 0 R (subsection.4.5.5) 182 0 R (subsection.4.5.6) 186 0 R (subsection.4.8.1) 202 0 R (subsection.4.8.2) 206 0 R (subsection.4.8.3) 210 0 R (subsection.4.9.1) 218 0 R (subsection.4.9.2) 222 0 R (subsection.6.1.1) 246 0 R (subsection.6.1.2) 258 0 R (subsection.6.2.1) 274 0 R (subsection.6.2.10) 310 0 R (subsection.6.2.11) 322 0 R (subsection.6.2.12) 326 0 R (subsection.6.2.13) 330 0 R (subsection.6.2.14) 334 0 R (subsection.6.2.15) 338 0 R (subsection.6.2.16) 342 0 R (subsection.6.2.17) 422 0 R (subsection.6.2.18) 426 0 R (subsection.6.2.19) 430 0 R (subsection.6.2.2) 278 0 R (subsection.6.2.20) 434 0 R (subsection.6.2.21) 438 0 R (subsection.6.2.22) 442 0 R (subsection.6.2.23) 446 0 R (subsection.6.2.24) 450 0 R (subsection.6.2.3) 282 0 R (subsection.6.2.4) 286 0 R (subsection.6.2.5) 290 0 R (subsection.6.2.6) 294 0 R (subsection.6.2.7) 298 0 R (subsection.6.2.8) 302 0 R (subsection.6.2.9) 306 0 R (subsection.6.3.1) 474 0 R (subsection.6.3.2) 486 0 R (subsection.6.3.3) 490 0 R (subsection.6.3.4) 494 0 R (subsection.6.3.5) 498 0 R (subsection.6.3.6) 514 0 R (subsection.6.3.7) 518 0 R (subsection.7.2.1) 534 0 R (subsection.7.2.2) 538 0 R (subsection.8.1.1) 554 0 R (subsection.A.1.1) 574 0 R (subsection.A.2.1) 582 0 R (subsection.A.3.1) 590 0 R (subsection.A.3.2) 594 0 R (subsection.A.3.3) 598 0 R (subsubsection.1.4.4.1) 42 0 R (subsubsection.1.4.4.2) 46 0 R (subsubsection.1.4.4.3) 50 0 R (subsubsection.1.4.5.1) 58 0 R (subsubsection.3.3.1.1) 118 0 R (subsubsection.3.3.1.2) 122 0 R (subsubsection.4.5.1.1) 162 0 R (subsubsection.4.5.1.2) 166 0 R (subsubsection.6.1.1.1) 250 0 R (subsubsection.6.1.1.2) 254 0 R (subsubsection.6.1.2.1) 262 0 R (subsubsection.6.1.2.2) 266 0 R (subsubsection.6.2.10.1) 314 0 R (subsubsection.6.2.10.2) 318 0 R (subsubsection.6.2.16.1) 346 0 R (subsubsection.6.2.16.10) 382 0 R (subsubsection.6.2.16.11) 386 0 R (subsubsection.6.2.16.12) 390 0 R (subsubsection.6.2.16.13) 394 0 R (subsubsection.6.2.16.14) 398 0 R (subsubsection.6.2.16.15) 402 0 R (subsubsection.6.2.16.16) 406 0 R (subsubsection.6.2.16.17) 410 0 R (subsubsection.6.2.16.18) 414 0 R (subsubsection.6.2.16.19) 418 0 R (subsubsection.6.2.16.2) 350 0 R (subsubsection.6.2.16.3) 354 0 R (subsubsection.6.2.16.4) 358 0 R (subsubsection.6.2.16.5) 362 0 R (subsubsection.6.2.16.6) 366 0 R (subsubsection.6.2.16.7) 370 0 R (subsubsection.6.2.16.8) 374 0 R (subsubsection.6.2.16.9) 378 0 R (subsubsection.6.2.24.1) 454 0 R (subsubsection.6.2.24.2) 458 0 R (subsubsection.6.2.24.3) 462 0 R (subsubsection.6.2.24.4) 466 0 R (subsubsection.6.3.1.1) 478 0 R (subsubsection.6.3.1.2) 482 0 R (subsubsection.6.3.5.1) 502 0 R (subsubsection.6.3.5.2) 506 0 R (subsubsection.6.3.5.3) 510 0 R (table.1.1) 877 0 R (table.1.2) 887 0 R (table.3.1) 946 0 R (table.3.2) 978 0 R (table.6.1) 1085 0 R (table.6.10) 1410 0 R (table.6.11) 1412 0 R (table.6.12) 1418 0 R (table.6.13) 1425 0 R (table.6.14) 1431 0 R (table.6.15) 1434 0 R (table.6.16) 1437 0 R (table.6.17) 1444 0 R (table.6.18) 1456 0 R (table.6.2) 1109 0 R (table.6.3) 1117 0 R (table.6.4) 1156 0 R (table.6.5) 1193 0 R (table.6.6) 1278 0 R (table.6.7) 1308 0 R (table.6.8) 1348 0 R (table.6.9) 1400 0 R (the_category_phrase) 1150 0 R (the_sortlist_statement) 1269 0 R (topology) 1264 0 R (tsig) 1024 0 R (tuning) 1279 0 R (types_of_resource_records_and_when_to_use_them) 894 0 R (view_statement_grammar) 1298 0 R (zone_statement_grammar) 1228 0 R (zone_transfers) 1001 0 R (zonefile_format) 1286 0 R] +1944 0 obj << +/Names [(Access_Control_Lists) 1477 0 R (Bv9ARM.ch01) 874 0 R (Bv9ARM.ch02) 923 0 R (Bv9ARM.ch03) 940 0 R (Bv9ARM.ch04) 989 0 R (Bv9ARM.ch05) 1077 0 R (Bv9ARM.ch06) 1088 0 R (Bv9ARM.ch07) 1476 0 R (Bv9ARM.ch08) 1502 0 R (Bv9ARM.ch09) 1517 0 R (Bv9ARM.ch10) 1739 0 R (Configuration_File_Grammar) 1113 0 R (DNSSEC) 1056 0 R (Doc-Start) 655 0 R (Setting_TTLs) 1446 0 R (acache) 930 0 R (access_control) 1231 0 R (acl) 1121 0 R (address_match_lists) 1094 0 R (admin_tools) 963 0 R (appendix.A) 570 0 R (appendix.B) 606 0 R (bibliography) 1525 0 R (boolean_options) 1005 0 R (builtin) 1300 0 R (chapter*.1) 690 0 R (chapter.1) 6 0 R (chapter.2) 66 0 R (chapter.3) 90 0 R (chapter.4) 130 0 R (chapter.5) 230 0 R (chapter.6) 242 0 R (chapter.7) 526 0 R (chapter.8) 550 0 R (cite.RFC1033) 1653 0 R (cite.RFC1034) 1537 0 R (cite.RFC1035) 1539 0 R (cite.RFC1101) 1635 0 R (cite.RFC1123) 1637 0 R (cite.RFC1183) 1597 0 R (cite.RFC1464) 1675 0 R (cite.RFC1535) 1582 0 R (cite.RFC1536) 1584 0 R (cite.RFC1537) 1655 0 R (cite.RFC1591) 1639 0 R (cite.RFC1706) 1599 0 R (cite.RFC1712) 1696 0 R (cite.RFC1713) 1677 0 R (cite.RFC1794) 1679 0 R (cite.RFC1876) 1601 0 R (cite.RFC1912) 1657 0 R (cite.RFC1982) 1586 0 R (cite.RFC1995) 1544 0 R (cite.RFC1996) 1546 0 R (cite.RFC2010) 1659 0 R (cite.RFC2052) 1603 0 R (cite.RFC2065) 1708 0 R (cite.RFC2136) 1548 0 R (cite.RFC2137) 1710 0 R (cite.RFC2163) 1605 0 R (cite.RFC2168) 1607 0 R (cite.RFC2181) 1550 0 R (cite.RFC2219) 1661 0 R (cite.RFC2230) 1609 0 R (cite.RFC2240) 1681 0 R (cite.RFC2308) 1552 0 R (cite.RFC2317) 1641 0 R (cite.RFC2345) 1683 0 R (cite.RFC2352) 1685 0 R (cite.RFC2535) 1712 0 R (cite.RFC2536) 1611 0 R (cite.RFC2537) 1613 0 R (cite.RFC2538) 1615 0 R (cite.RFC2539) 1617 0 R (cite.RFC2540) 1619 0 R (cite.RFC2671) 1554 0 R (cite.RFC2672) 1556 0 R (cite.RFC2673) 1698 0 R (cite.RFC2782) 1621 0 R (cite.RFC2825) 1665 0 R (cite.RFC2826) 1643 0 R (cite.RFC2845) 1558 0 R (cite.RFC2874) 1700 0 R (cite.RFC2915) 1623 0 R (cite.RFC2929) 1645 0 R (cite.RFC2930) 1560 0 R (cite.RFC2931) 1562 0 R (cite.RFC3007) 1564 0 R (cite.RFC3008) 1714 0 R (cite.RFC3071) 1688 0 R (cite.RFC3090) 1716 0 R (cite.RFC3110) 1625 0 R (cite.RFC3123) 1627 0 R (cite.RFC3225) 1570 0 R (cite.RFC3258) 1690 0 R (cite.RFC3445) 1718 0 R (cite.RFC3490) 1667 0 R (cite.RFC3491) 1669 0 R (cite.RFC3492) 1671 0 R (cite.RFC3596) 1629 0 R (cite.RFC3597) 1631 0 R (cite.RFC3645) 1566 0 R (cite.RFC3655) 1720 0 R (cite.RFC3658) 1722 0 R (cite.RFC3755) 1724 0 R (cite.RFC3757) 1726 0 R (cite.RFC3833) 1572 0 R (cite.RFC3845) 1728 0 R (cite.RFC3901) 1692 0 R (cite.RFC4033) 1574 0 R (cite.RFC4035) 1576 0 R (cite.RFC4044) 1578 0 R (cite.RFC4074) 1588 0 R (cite.RFC974) 1541 0 R (cite.id2499639) 1733 0 R (configuration_file_elements) 1089 0 R (controls_statement_definition_and_usage) 976 0 R (diagnostic_tools) 911 0 R (dynamic_update) 999 0 R (dynamic_update_policies) 1051 0 R (dynamic_update_security) 1235 0 R (empty) 1302 0 R (historical_dns_information) 1519 0 R (id2465026) 875 0 R (id2467301) 876 0 R (id2467572) 880 0 R (id2467581) 881 0 R (id2467713) 891 0 R (id2467890) 893 0 R (id2467911) 894 0 R (id2467945) 895 0 R (id2468029) 898 0 R (id2470291) 905 0 R (id2470314) 908 0 R (id2470344) 909 0 R (id2470434) 910 0 R (id2470464) 916 0 R (id2470499) 917 0 R (id2470594) 918 0 R (id2470628) 924 0 R (id2470654) 925 0 R (id2470667) 926 0 R (id2470693) 929 0 R (id2470704) 935 0 R (id2470804) 942 0 R (id2470820) 943 0 R (id2470842) 949 0 R (id2470928) 950 0 R (id2471333) 953 0 R (id2471338) 954 0 R (id2473121) 981 0 R (id2473132) 982 0 R (id2473510) 1014 0 R (id2473528) 1015 0 R (id2473963) 1031 0 R (id2473980) 1032 0 R (id2474019) 1037 0 R (id2474037) 1038 0 R (id2474048) 1039 0 R (id2474155) 1040 0 R (id2474281) 1041 0 R (id2474326) 1047 0 R (id2474340) 1048 0 R (id2474389) 1049 0 R (id2474594) 1057 0 R (id2474731) 1058 0 R (id2474810) 1063 0 R (id2474953) 1068 0 R (id2475083) 1070 0 R (id2475105) 1071 0 R (id2475138) 1078 0 R (id2475353) 1090 0 R (id2476146) 1099 0 R (id2476173) 1100 0 R (id2476280) 1105 0 R (id2476295) 1106 0 R (id2476393) 1107 0 R (id2476476) 1114 0 R (id2476892) 1120 0 R (id2477003) 1122 0 R (id2477150) 1124 0 R (id2477511) 1131 0 R (id2477526) 1132 0 R (id2477549) 1133 0 R (id2477571) 1134 0 R (id2477661) 1143 0 R (id2477856) 1144 0 R (id2477908) 1150 0 R (id2478601) 1161 0 R (id2479411) 1167 0 R (id2479484) 1168 0 R (id2479548) 1175 0 R (id2479592) 1176 0 R (id2479607) 1177 0 R (id2481555) 1202 0 R (id2483457) 1224 0 R (id2483515) 1230 0 R (id2483868) 1241 0 R (id2484025) 1246 0 R (id2484840) 1255 0 R (id2484855) 1261 0 R (id2484970) 1263 0 R (id2485172) 1269 0 R (id2485739) 1283 0 R (id2486973) 1313 0 R (id2488076) 1330 0 R (id2488125) 1331 0 R (id2488274) 1337 0 R (id2489651) 1351 0 R (id2489658) 1352 0 R (id2489664) 1353 0 R (id2490146) 1359 0 R (id2490247) 1364 0 R (id2491607) 1406 0 R (id2491864) 1412 0 R (id2491882) 1413 0 R (id2491902) 1416 0 R (id2492139) 1422 0 R (id2493237) 1428 0 R (id2493365) 1430 0 R (id2493386) 1435 0 R (id2493817) 1437 0 R (id2493954) 1439 0 R (id2493976) 1440 0 R (id2494449) 1447 0 R (id2494573) 1449 0 R (id2494588) 1450 0 R (id2494700) 1452 0 R (id2494723) 1458 0 R (id2494920) 1459 0 R (id2494989) 1460 0 R (id2495026) 1461 0 R (id2495088) 1466 0 R (id2495703) 1486 0 R (id2495780) 1487 0 R (id2495840) 1488 0 R (id2495920) 1503 0 R (id2495925) 1504 0 R (id2495937) 1505 0 R (id2495954) 1506 0 R (id2496152) 1518 0 R (id2496256) 1524 0 R (id2496443) 1529 0 R (id2496445) 1535 0 R (id2496454) 1540 0 R (id2496477) 1536 0 R (id2496501) 1538 0 R (id2496537) 1549 0 R (id2496564) 1551 0 R (id2496589) 1543 0 R (id2496614) 1545 0 R (id2496637) 1547 0 R (id2496693) 1553 0 R (id2496720) 1555 0 R (id2496746) 1557 0 R (id2496876) 1559 0 R (id2496906) 1561 0 R (id2496936) 1563 0 R (id2496963) 1565 0 R (id2497037) 1568 0 R (id2497045) 1569 0 R (id2497140) 1571 0 R (id2497176) 1573 0 R (id2497241) 1577 0 R (id2497306) 1575 0 R (id2497371) 1580 0 R (id2497380) 1581 0 R (id2497474) 1583 0 R (id2497542) 1585 0 R (id2497577) 1587 0 R (id2497618) 1595 0 R (id2497623) 1596 0 R (id2497681) 1598 0 R (id2497718) 1606 0 R (id2497753) 1600 0 R (id2497808) 1602 0 R (id2497846) 1604 0 R (id2497872) 1608 0 R (id2497897) 1610 0 R (id2497924) 1612 0 R (id2497950) 1614 0 R (id2497990) 1616 0 R (id2498020) 1618 0 R (id2498050) 1620 0 R (id2498092) 1622 0 R (id2498125) 1624 0 R (id2498152) 1626 0 R (id2498176) 1628 0 R (id2498233) 1630 0 R (id2498258) 1633 0 R (id2498265) 1634 0 R (id2498291) 1636 0 R (id2498313) 1638 0 R (id2498337) 1640 0 R (id2498451) 1642 0 R (id2498474) 1644 0 R (id2498524) 1651 0 R (id2498532) 1652 0 R (id2498555) 1654 0 R (id2498582) 1656 0 R (id2498609) 1658 0 R (id2498645) 1660 0 R (id2498685) 1663 0 R (id2498691) 1664 0 R (id2498723) 1666 0 R (id2498769) 1668 0 R (id2498804) 1670 0 R (id2498830) 1673 0 R (id2498849) 1674 0 R (id2498871) 1676 0 R (id2498897) 1678 0 R (id2498922) 1680 0 R (id2498946) 1682 0 R (id2498992) 1684 0 R (id2499015) 1687 0 R (id2499042) 1689 0 R (id2499067) 1691 0 R (id2499104) 1686 0 R (id2499128) 1694 0 R (id2499134) 1695 0 R (id2499192) 1697 0 R (id2499219) 1699 0 R (id2499255) 1706 0 R (id2499267) 1707 0 R (id2499306) 1709 0 R (id2499333) 1711 0 R (id2499363) 1713 0 R (id2499388) 1715 0 R (id2499415) 1717 0 R (id2499451) 1719 0 R (id2499488) 1721 0 R (id2499514) 1723 0 R (id2499541) 1725 0 R (id2499586) 1727 0 R (id2499627) 1730 0 R (id2499637) 1732 0 R (id2499639) 1734 0 R (incremental_zone_transfers) 1011 0 R (internet_drafts) 1729 0 R (ipv6addresses) 1072 0 R (journal) 1000 0 R (lwresd) 1079 0 R (man.dig) 1740 0 R (man.dnssec-keygen) 1788 0 R (man.dnssec-signzone) 1806 0 R (man.host) 1773 0 R (man.named) 1855 0 R (man.named-checkconf) 1826 0 R (man.named-checkzone) 1838 0 R (man.rndc) 1877 0 R (man.rndc-confgen) 1906 0 R (man.rndc.conf) 1889 0 R (notify) 990 0 R (options) 1187 0 R (page.1) 654 0 R (page.10) 915 0 R (page.100) 1768 0 R (page.101) 1780 0 R (page.102) 1784 0 R (page.103) 1796 0 R (page.104) 1802 0 R (page.105) 1813 0 R (page.106) 1818 0 R (page.107) 1823 0 R (page.108) 1834 0 R (page.109) 1846 0 R (page.11) 922 0 R (page.110) 1851 0 R (page.111) 1862 0 R (page.112) 1867 0 R (page.113) 1874 0 R (page.114) 1885 0 R (page.115) 1896 0 R (page.116) 1902 0 R (page.117) 1912 0 R (page.118) 1918 0 R (page.12) 934 0 R (page.13) 939 0 R (page.14) 948 0 R (page.15) 959 0 R (page.16) 967 0 R (page.17) 974 0 R (page.18) 980 0 R (page.19) 988 0 R (page.2) 679 0 R (page.20) 1010 0 R (page.21) 1020 0 R (page.22) 1025 0 R (page.23) 1029 0 R (page.24) 1036 0 R (page.25) 1045 0 R (page.26) 1055 0 R (page.27) 1062 0 R (page.28) 1067 0 R (page.29) 1076 0 R (page.3) 689 0 R (page.30) 1083 0 R (page.31) 1087 0 R (page.32) 1098 0 R (page.33) 1104 0 R (page.34) 1112 0 R (page.35) 1119 0 R (page.36) 1128 0 R (page.37) 1141 0 R (page.38) 1149 0 R (page.39) 1154 0 R (page.4) 744 0 R (page.40) 1160 0 R (page.41) 1166 0 R (page.42) 1174 0 R (page.43) 1181 0 R (page.44) 1186 0 R (page.45) 1191 0 R (page.46) 1197 0 R (page.47) 1201 0 R (page.48) 1208 0 R (page.49) 1218 0 R (page.5) 808 0 R (page.50) 1223 0 R (page.51) 1228 0 R (page.52) 1239 0 R (page.53) 1245 0 R (page.54) 1250 0 R (page.55) 1254 0 R (page.56) 1260 0 R (page.57) 1268 0 R (page.58) 1274 0 R (page.59) 1281 0 R (page.6) 869 0 R (page.60) 1289 0 R (page.61) 1296 0 R (page.62) 1308 0 R (page.63) 1312 0 R (page.64) 1318 0 R (page.65) 1323 0 R (page.66) 1327 0 R (page.67) 1336 0 R (page.68) 1342 0 R (page.69) 1346 0 R (page.7) 873 0 R (page.70) 1350 0 R (page.71) 1358 0 R (page.72) 1363 0 R (page.73) 1380 0 R (page.74) 1396 0 R (page.75) 1411 0 R (page.76) 1421 0 R (page.77) 1427 0 R (page.78) 1434 0 R (page.79) 1445 0 R (page.8) 890 0 R (page.80) 1457 0 R (page.81) 1465 0 R (page.82) 1471 0 R (page.83) 1475 0 R (page.84) 1481 0 R (page.85) 1492 0 R (page.86) 1497 0 R (page.87) 1501 0 R (page.88) 1512 0 R (page.89) 1516 0 R (page.9) 904 0 R (page.90) 1523 0 R (page.91) 1533 0 R (page.92) 1593 0 R (page.93) 1649 0 R (page.94) 1704 0 R (page.95) 1738 0 R (page.96) 1747 0 R (page.97) 1753 0 R (page.98) 1759 0 R (page.99) 1763 0 R (proposed_standards) 1016 0 R (rfcs) 900 0 R (rndc) 1137 0 R (rrset_ordering) 955 0 R (sample_configuration) 941 0 R (section*.10) 1662 0 R (section*.11) 1672 0 R (section*.12) 1693 0 R (section*.13) 1705 0 R (section*.14) 1731 0 R (section*.15) 1741 0 R (section*.16) 1742 0 R (section*.17) 1743 0 R (section*.18) 1748 0 R (section*.19) 1749 0 R (section*.2) 1528 0 R (section*.20) 1754 0 R (section*.21) 1764 0 R (section*.22) 1769 0 R (section*.23) 1770 0 R (section*.24) 1771 0 R (section*.25) 1772 0 R (section*.26) 1774 0 R (section*.27) 1775 0 R (section*.28) 1776 0 R (section*.29) 1785 0 R (section*.3) 1534 0 R (section*.30) 1786 0 R (section*.31) 1787 0 R (section*.32) 1789 0 R (section*.33) 1790 0 R (section*.34) 1791 0 R (section*.35) 1792 0 R (section*.36) 1797 0 R (section*.37) 1803 0 R (section*.38) 1804 0 R (section*.39) 1805 0 R (section*.4) 1542 0 R (section*.40) 1807 0 R (section*.41) 1808 0 R (section*.42) 1809 0 R (section*.43) 1814 0 R (section*.44) 1819 0 R (section*.45) 1824 0 R (section*.46) 1825 0 R (section*.47) 1827 0 R (section*.48) 1828 0 R (section*.49) 1829 0 R (section*.5) 1567 0 R (section*.50) 1830 0 R (section*.51) 1835 0 R (section*.52) 1836 0 R (section*.53) 1837 0 R (section*.54) 1839 0 R (section*.55) 1840 0 R (section*.56) 1841 0 R (section*.57) 1842 0 R (section*.58) 1852 0 R (section*.59) 1853 0 R (section*.6) 1579 0 R (section*.60) 1854 0 R (section*.61) 1856 0 R (section*.62) 1857 0 R (section*.63) 1858 0 R (section*.64) 1863 0 R (section*.65) 1868 0 R (section*.66) 1869 0 R (section*.67) 1870 0 R (section*.68) 1875 0 R (section*.69) 1876 0 R (section*.7) 1594 0 R (section*.70) 1878 0 R (section*.71) 1879 0 R (section*.72) 1880 0 R (section*.73) 1881 0 R (section*.74) 1886 0 R (section*.75) 1887 0 R (section*.76) 1888 0 R (section*.77) 1890 0 R (section*.78) 1891 0 R (section*.79) 1892 0 R (section*.8) 1632 0 R (section*.80) 1897 0 R (section*.81) 1903 0 R (section*.82) 1904 0 R (section*.83) 1905 0 R (section*.84) 1907 0 R (section*.85) 1908 0 R (section*.86) 1913 0 R (section*.87) 1914 0 R (section*.88) 1919 0 R (section*.89) 1920 0 R (section*.9) 1650 0 R (section*.90) 1921 0 R (section.1.1) 10 0 R (section.1.2) 14 0 R (section.1.3) 18 0 R (section.1.4) 22 0 R (section.2.1) 70 0 R (section.2.2) 74 0 R (section.2.3) 78 0 R (section.2.4) 82 0 R (section.2.5) 86 0 R (section.3.1) 94 0 R (section.3.2) 106 0 R (section.3.3) 110 0 R (section.4.1) 134 0 R (section.4.2) 138 0 R (section.4.3) 146 0 R (section.4.4) 150 0 R (section.4.5) 158 0 R (section.4.6) 194 0 R (section.4.7) 198 0 R (section.4.8) 202 0 R (section.4.9) 218 0 R (section.5.1) 234 0 R (section.5.2) 238 0 R (section.6.1) 246 0 R (section.6.2) 274 0 R (section.6.3) 474 0 R (section.7.1) 530 0 R (section.7.2) 534 0 R (section.7.3) 546 0 R (section.8.1) 554 0 R (section.8.2) 562 0 R (section.8.3) 566 0 R (section.A.1) 574 0 R (section.A.2) 582 0 R (section.A.3) 590 0 R (section.B.1) 610 0 R (section.B.10) 646 0 R (section.B.2) 614 0 R (section.B.3) 618 0 R (section.B.4) 622 0 R (section.B.5) 626 0 R (section.B.6) 630 0 R (section.B.7) 634 0 R (section.B.8) 638 0 R (section.B.9) 642 0 R (server_statement_definition_and_usage) 1214 0 R (server_statement_grammar) 1319 0 R (statsfile) 1193 0 R (subsection.1.4.1) 26 0 R (subsection.1.4.2) 30 0 R (subsection.1.4.3) 34 0 R (subsection.1.4.4) 38 0 R (subsection.1.4.5) 54 0 R (subsection.1.4.6) 62 0 R (subsection.3.1.1) 98 0 R (subsection.3.1.2) 102 0 R (subsection.3.3.1) 114 0 R (subsection.3.3.2) 126 0 R (subsection.4.2.1) 142 0 R (subsection.4.4.1) 154 0 R (subsection.4.5.1) 162 0 R (subsection.4.5.2) 174 0 R (subsection.4.5.3) 178 0 R (subsection.4.5.4) 182 0 R (subsection.4.5.5) 186 0 R (subsection.4.5.6) 190 0 R (subsection.4.8.1) 206 0 R (subsection.4.8.2) 210 0 R (subsection.4.8.3) 214 0 R (subsection.4.9.1) 222 0 R (subsection.4.9.2) 226 0 R (subsection.6.1.1) 250 0 R (subsection.6.1.2) 262 0 R (subsection.6.2.1) 278 0 R (subsection.6.2.10) 314 0 R (subsection.6.2.11) 326 0 R (subsection.6.2.12) 330 0 R (subsection.6.2.13) 334 0 R (subsection.6.2.14) 338 0 R (subsection.6.2.15) 342 0 R (subsection.6.2.16) 346 0 R (subsection.6.2.17) 426 0 R (subsection.6.2.18) 430 0 R (subsection.6.2.19) 434 0 R (subsection.6.2.2) 282 0 R (subsection.6.2.20) 438 0 R (subsection.6.2.21) 442 0 R (subsection.6.2.22) 446 0 R (subsection.6.2.23) 450 0 R (subsection.6.2.24) 454 0 R (subsection.6.2.3) 286 0 R (subsection.6.2.4) 290 0 R (subsection.6.2.5) 294 0 R (subsection.6.2.6) 298 0 R (subsection.6.2.7) 302 0 R (subsection.6.2.8) 306 0 R (subsection.6.2.9) 310 0 R (subsection.6.3.1) 478 0 R (subsection.6.3.2) 490 0 R (subsection.6.3.3) 494 0 R (subsection.6.3.4) 498 0 R (subsection.6.3.5) 502 0 R (subsection.6.3.6) 518 0 R (subsection.6.3.7) 522 0 R (subsection.7.2.1) 538 0 R (subsection.7.2.2) 542 0 R (subsection.8.1.1) 558 0 R (subsection.A.1.1) 578 0 R (subsection.A.2.1) 586 0 R (subsection.A.3.1) 594 0 R (subsection.A.3.2) 598 0 R (subsection.A.3.3) 602 0 R (subsubsection.1.4.4.1) 42 0 R (subsubsection.1.4.4.2) 46 0 R (subsubsection.1.4.4.3) 50 0 R (subsubsection.1.4.5.1) 58 0 R (subsubsection.3.3.1.1) 118 0 R (subsubsection.3.3.1.2) 122 0 R (subsubsection.4.5.1.1) 166 0 R (subsubsection.4.5.1.2) 170 0 R (subsubsection.6.1.1.1) 254 0 R (subsubsection.6.1.1.2) 258 0 R (subsubsection.6.1.2.1) 266 0 R (subsubsection.6.1.2.2) 270 0 R (subsubsection.6.2.10.1) 318 0 R (subsubsection.6.2.10.2) 322 0 R (subsubsection.6.2.16.1) 350 0 R (subsubsection.6.2.16.10) 386 0 R (subsubsection.6.2.16.11) 390 0 R (subsubsection.6.2.16.12) 394 0 R (subsubsection.6.2.16.13) 398 0 R (subsubsection.6.2.16.14) 402 0 R (subsubsection.6.2.16.15) 406 0 R (subsubsection.6.2.16.16) 410 0 R (subsubsection.6.2.16.17) 414 0 R (subsubsection.6.2.16.18) 418 0 R (subsubsection.6.2.16.19) 422 0 R (subsubsection.6.2.16.2) 354 0 R (subsubsection.6.2.16.3) 358 0 R (subsubsection.6.2.16.4) 362 0 R (subsubsection.6.2.16.5) 366 0 R (subsubsection.6.2.16.6) 370 0 R (subsubsection.6.2.16.7) 374 0 R (subsubsection.6.2.16.8) 378 0 R (subsubsection.6.2.16.9) 382 0 R (subsubsection.6.2.24.1) 458 0 R (subsubsection.6.2.24.2) 462 0 R (subsubsection.6.2.24.3) 466 0 R (subsubsection.6.2.24.4) 470 0 R (subsubsection.6.3.1.1) 482 0 R (subsubsection.6.3.1.2) 486 0 R (subsubsection.6.3.5.1) 506 0 R (subsubsection.6.3.5.2) 510 0 R (subsubsection.6.3.5.3) 514 0 R (table.1.1) 882 0 R (table.1.2) 892 0 R (table.3.1) 951 0 R (table.3.2) 983 0 R (table.6.1) 1091 0 R (table.6.10) 1417 0 R (table.6.11) 1423 0 R (table.6.12) 1429 0 R (table.6.13) 1436 0 R (table.6.14) 1438 0 R (table.6.15) 1441 0 R (table.6.16) 1448 0 R (table.6.17) 1451 0 R (table.6.18) 1467 0 R (table.6.2) 1115 0 R (table.6.3) 1123 0 R (table.6.4) 1162 0 R (table.6.5) 1203 0 R (table.6.6) 1284 0 R (table.6.7) 1314 0 R (table.6.8) 1354 0 R (table.6.9) 1407 0 R (the_category_phrase) 1156 0 R (the_sortlist_statement) 1275 0 R (topology) 1270 0 R (tsig) 1030 0 R (tuning) 1285 0 R (types_of_resource_records_and_when_to_use_them) 899 0 R (view_statement_grammar) 1304 0 R (zone_statement_grammar) 1234 0 R (zone_transfers) 1006 0 R (zonefile_format) 1292 0 R] /Limits [(Access_Control_Lists) (zonefile_format)] >> endobj -1938 0 obj << -/Kids [1937 0 R] +1945 0 obj << +/Kids [1944 0 R] >> endobj -1939 0 obj << -/Dests 1938 0 R +1946 0 obj << +/Dests 1945 0 R >> endobj -1940 0 obj << +1947 0 obj << /Type /Catalog -/Pages 1935 0 R -/Outlines 1936 0 R -/Names 1939 0 R +/Pages 1942 0 R +/Outlines 1943 0 R +/Names 1946 0 R /PageMode /UseOutlines -/OpenAction 645 0 R +/OpenAction 649 0 R >> endobj -1941 0 obj << +1948 0 obj << /Author()/Title()/Subject()/Creator(LaTeX with hyperref package)/Producer(pdfeTeX-1.21a)/Keywords() -/CreationDate (D:20070215121800+11'00') +/CreationDate (D:20070725091225+10'00') /PTEX.Fullbanner (This is pdfeTeX, Version 3.141592-1.21a-2.2 (Web2C 7.5.4) kpathsea version 3.5.4) >> endobj xref -0 1942 +0 1949 0000000001 65535 f 0000000002 00000 f 0000000003 00000 f 0000000004 00000 f 0000000000 00000 f 0000000009 00000 n -0000066574 00000 n -0000661205 00000 n +0000066898 00000 n +0000664747 00000 n 0000000054 00000 n 0000000086 00000 n -0000066698 00000 n -0000661133 00000 n +0000067022 00000 n +0000664675 00000 n 0000000133 00000 n 0000000173 00000 n -0000066823 00000 n -0000661047 00000 n +0000067147 00000 n +0000664589 00000 n 0000000221 00000 n 0000000273 00000 n -0000066948 00000 n -0000660961 00000 n +0000067272 00000 n +0000664503 00000 n 0000000321 00000 n 0000000377 00000 n -0000071356 00000 n -0000660851 00000 n +0000071535 00000 n +0000664393 00000 n 0000000425 00000 n 0000000478 00000 n -0000071480 00000 n -0000660777 00000 n +0000071660 00000 n +0000664319 00000 n 0000000531 00000 n 0000000572 00000 n -0000071605 00000 n -0000660690 00000 n +0000071785 00000 n +0000664232 00000 n 0000000625 00000 n 0000000674 00000 n -0000071730 00000 n -0000660603 00000 n +0000071910 00000 n +0000664145 00000 n 0000000727 00000 n 0000000757 00000 n -0000076025 00000 n -0000660479 00000 n +0000076188 00000 n +0000664021 00000 n 0000000810 00000 n 0000000861 00000 n -0000076150 00000 n -0000660405 00000 n +0000076313 00000 n +0000663947 00000 n 0000000919 00000 n 0000000964 00000 n -0000076275 00000 n -0000660318 00000 n +0000076438 00000 n +0000663860 00000 n 0000001022 00000 n 0000001062 00000 n -0000076400 00000 n -0000660244 00000 n +0000076563 00000 n +0000663786 00000 n 0000001120 00000 n 0000001162 00000 n -0000079196 00000 n -0000660120 00000 n +0000079535 00000 n +0000663662 00000 n 0000001215 00000 n 0000001260 00000 n -0000079321 00000 n -0000660059 00000 n +0000079660 00000 n +0000663601 00000 n 0000001318 00000 n 0000001355 00000 n -0000079446 00000 n -0000659985 00000 n +0000079785 00000 n +0000663527 00000 n 0000001408 00000 n 0000001463 00000 n -0000082373 00000 n -0000659860 00000 n +0000082713 00000 n +0000663402 00000 n 0000001509 00000 n 0000001556 00000 n -0000082498 00000 n -0000659786 00000 n +0000082838 00000 n +0000663328 00000 n 0000001604 00000 n 0000001648 00000 n -0000082623 00000 n -0000659699 00000 n +0000082963 00000 n +0000663241 00000 n 0000001696 00000 n 0000001735 00000 n -0000082748 00000 n -0000659612 00000 n +0000083088 00000 n +0000663154 00000 n 0000001783 00000 n 0000001825 00000 n -0000082872 00000 n -0000659525 00000 n +0000083212 00000 n +0000663067 00000 n 0000001873 00000 n 0000001936 00000 n -0000083958 00000 n -0000659451 00000 n +0000084298 00000 n +0000662993 00000 n 0000001984 00000 n 0000002034 00000 n -0000085668 00000 n -0000659323 00000 n +0000086008 00000 n +0000662865 00000 n 0000002080 00000 n 0000002126 00000 n -0000085792 00000 n -0000659210 00000 n +0000086132 00000 n +0000662752 00000 n 0000002174 00000 n 0000002218 00000 n -0000085917 00000 n -0000659134 00000 n +0000086257 00000 n +0000662676 00000 n 0000002271 00000 n 0000002323 00000 n -0000086042 00000 n -0000659057 00000 n +0000086382 00000 n +0000662599 00000 n 0000002377 00000 n 0000002436 00000 n -0000088553 00000 n -0000658966 00000 n +0000088910 00000 n +0000662508 00000 n 0000002485 00000 n 0000002523 00000 n -0000088805 00000 n -0000658849 00000 n +0000089162 00000 n +0000662391 00000 n 0000002572 00000 n 0000002618 00000 n -0000088931 00000 n -0000658731 00000 n +0000089288 00000 n +0000662273 00000 n 0000002672 00000 n 0000002739 00000 n -0000092111 00000 n -0000658652 00000 n +0000092495 00000 n +0000662194 00000 n 0000002798 00000 n 0000002842 00000 n -0000092237 00000 n -0000658573 00000 n +0000092621 00000 n +0000662115 00000 n 0000002901 00000 n 0000002949 00000 n -0000102534 00000 n -0000658494 00000 n +0000102950 00000 n +0000662036 00000 n 0000003003 00000 n 0000003036 00000 n -0000107458 00000 n -0000658362 00000 n +0000107881 00000 n +0000661904 00000 n 0000003083 00000 n 0000003126 00000 n -0000107584 00000 n -0000658283 00000 n +0000108007 00000 n +0000661825 00000 n 0000003175 00000 n 0000003205 00000 n -0000107710 00000 n -0000658151 00000 n +0000108133 00000 n +0000661693 00000 n 0000003254 00000 n 0000003292 00000 n -0000107836 00000 n -0000658086 00000 n +0000108259 00000 n +0000661628 00000 n 0000003346 00000 n 0000003388 00000 n -0000112115 00000 n -0000657993 00000 n +0000112550 00000 n +0000661535 00000 n 0000003437 00000 n 0000003496 00000 n -0000112244 00000 n -0000657900 00000 n +0000112677 00000 n +0000661403 00000 n 0000003545 00000 n 0000003578 00000 n -0000119613 00000 n -0000657768 00000 n -0000003627 00000 n -0000003655 00000 n -0000119740 00000 n -0000657650 00000 n -0000003709 00000 n -0000003778 00000 n -0000119869 00000 n -0000657571 00000 n -0000003837 00000 n -0000003885 00000 n -0000122743 00000 n -0000657492 00000 n -0000003944 00000 n -0000003989 00000 n -0000122872 00000 n -0000657399 00000 n -0000004043 00000 n -0000004111 00000 n -0000123001 00000 n -0000657306 00000 n -0000004165 00000 n -0000004235 00000 n -0000123130 00000 n -0000657213 00000 n -0000004289 00000 n -0000004352 00000 n -0000123258 00000 n -0000657120 00000 n -0000004406 00000 n -0000004461 00000 n -0000126895 00000 n -0000657041 00000 n -0000004515 00000 n -0000004547 00000 n -0000127024 00000 n -0000656948 00000 n -0000004596 00000 n -0000004624 00000 n -0000127153 00000 n -0000656855 00000 n -0000004673 00000 n -0000004705 00000 n -0000130754 00000 n -0000656723 00000 n -0000004754 00000 n -0000004784 00000 n -0000130883 00000 n -0000656644 00000 n -0000004838 00000 n -0000004879 00000 n -0000131011 00000 n -0000656551 00000 n -0000004933 00000 n -0000004975 00000 n -0000134470 00000 n -0000656472 00000 n -0000005029 00000 n -0000005074 00000 n -0000137544 00000 n -0000656354 00000 n -0000005123 00000 n -0000005169 00000 n -0000137673 00000 n -0000656275 00000 n -0000005223 00000 n -0000005283 00000 n -0000137801 00000 n -0000656196 00000 n -0000005337 00000 n -0000005406 00000 n -0000140281 00000 n -0000656063 00000 n -0000005453 00000 n -0000005506 00000 n -0000140410 00000 n -0000655984 00000 n -0000005555 00000 n -0000005611 00000 n -0000140539 00000 n -0000655905 00000 n -0000005660 00000 n -0000005709 00000 n -0000144723 00000 n -0000655772 00000 n -0000005756 00000 n -0000005808 00000 n -0000144852 00000 n -0000655654 00000 n -0000005857 00000 n -0000005908 00000 n -0000149108 00000 n -0000655536 00000 n -0000005962 00000 n -0000006007 00000 n -0000149237 00000 n -0000655457 00000 n -0000006066 00000 n -0000006100 00000 n -0000149366 00000 n -0000655378 00000 n -0000006159 00000 n -0000006207 00000 n -0000152708 00000 n -0000655260 00000 n -0000006261 00000 n -0000006301 00000 n -0000152837 00000 n -0000655181 00000 n -0000006360 00000 n -0000006394 00000 n -0000152966 00000 n -0000655102 00000 n -0000006453 00000 n -0000006501 00000 n -0000156871 00000 n -0000654969 00000 n -0000006550 00000 n -0000006600 00000 n -0000160493 00000 n -0000654890 00000 n -0000006654 00000 n -0000006701 00000 n -0000160622 00000 n -0000654797 00000 n -0000006755 00000 n -0000006815 00000 n -0000160879 00000 n -0000654704 00000 n -0000006869 00000 n -0000006921 00000 n -0000161008 00000 n -0000654611 00000 n -0000006975 00000 n -0000007040 00000 n -0000165662 00000 n -0000654518 00000 n -0000007094 00000 n -0000007145 00000 n -0000165791 00000 n -0000654425 00000 n -0000007199 00000 n -0000007263 00000 n -0000165920 00000 n -0000654332 00000 n -0000007317 00000 n -0000007364 00000 n -0000166049 00000 n -0000654239 00000 n -0000007418 00000 n -0000007478 00000 n -0000169396 00000 n -0000654146 00000 n -0000007532 00000 n -0000007583 00000 n -0000169525 00000 n -0000654014 00000 n -0000007638 00000 n -0000007703 00000 n -0000174160 00000 n -0000653935 00000 n -0000007763 00000 n -0000007810 00000 n -0000180339 00000 n -0000653856 00000 n -0000007870 00000 n -0000007918 00000 n -0000184081 00000 n -0000653763 00000 n +0000112806 00000 n +0000661338 00000 n +0000003632 00000 n +0000003681 00000 n +0000120178 00000 n +0000661206 00000 n +0000003730 00000 n +0000003758 00000 n +0000120305 00000 n +0000661088 00000 n +0000003812 00000 n +0000003881 00000 n +0000120434 00000 n +0000661009 00000 n +0000003940 00000 n +0000003988 00000 n +0000123309 00000 n +0000660930 00000 n +0000004047 00000 n +0000004092 00000 n +0000123438 00000 n +0000660837 00000 n +0000004146 00000 n +0000004214 00000 n +0000123567 00000 n +0000660744 00000 n +0000004268 00000 n +0000004338 00000 n +0000123696 00000 n +0000660651 00000 n +0000004392 00000 n +0000004455 00000 n +0000123824 00000 n +0000660558 00000 n +0000004509 00000 n +0000004564 00000 n +0000127470 00000 n +0000660479 00000 n +0000004618 00000 n +0000004650 00000 n +0000127599 00000 n +0000660386 00000 n +0000004699 00000 n +0000004727 00000 n +0000127728 00000 n +0000660293 00000 n +0000004776 00000 n +0000004808 00000 n +0000131334 00000 n +0000660161 00000 n +0000004857 00000 n +0000004887 00000 n +0000131463 00000 n +0000660082 00000 n +0000004941 00000 n +0000004982 00000 n +0000131591 00000 n +0000659989 00000 n +0000005036 00000 n +0000005078 00000 n +0000135033 00000 n +0000659910 00000 n +0000005132 00000 n +0000005177 00000 n +0000138107 00000 n +0000659792 00000 n +0000005226 00000 n +0000005272 00000 n +0000138236 00000 n +0000659713 00000 n +0000005326 00000 n +0000005386 00000 n +0000138364 00000 n +0000659634 00000 n +0000005440 00000 n +0000005509 00000 n +0000140844 00000 n +0000659501 00000 n +0000005556 00000 n +0000005609 00000 n +0000140973 00000 n +0000659422 00000 n +0000005658 00000 n +0000005714 00000 n +0000141102 00000 n +0000659343 00000 n +0000005763 00000 n +0000005812 00000 n +0000145286 00000 n +0000659210 00000 n +0000005859 00000 n +0000005911 00000 n +0000145415 00000 n +0000659092 00000 n +0000005960 00000 n +0000006011 00000 n +0000149682 00000 n +0000658974 00000 n +0000006065 00000 n +0000006110 00000 n +0000149811 00000 n +0000658895 00000 n +0000006169 00000 n +0000006203 00000 n +0000149940 00000 n +0000658816 00000 n +0000006262 00000 n +0000006310 00000 n +0000153288 00000 n +0000658698 00000 n +0000006364 00000 n +0000006404 00000 n +0000153417 00000 n +0000658619 00000 n +0000006463 00000 n +0000006497 00000 n +0000153546 00000 n +0000658540 00000 n +0000006556 00000 n +0000006604 00000 n +0000157451 00000 n +0000658407 00000 n +0000006653 00000 n +0000006703 00000 n +0000161073 00000 n +0000658328 00000 n +0000006757 00000 n +0000006804 00000 n +0000161202 00000 n +0000658235 00000 n +0000006858 00000 n +0000006918 00000 n +0000161459 00000 n +0000658142 00000 n +0000006972 00000 n +0000007024 00000 n +0000161588 00000 n +0000658049 00000 n +0000007078 00000 n +0000007143 00000 n +0000166242 00000 n +0000657956 00000 n +0000007197 00000 n +0000007248 00000 n +0000166371 00000 n +0000657863 00000 n +0000007302 00000 n +0000007366 00000 n +0000166500 00000 n +0000657770 00000 n +0000007420 00000 n +0000007467 00000 n +0000166629 00000 n +0000657677 00000 n +0000007521 00000 n +0000007581 00000 n +0000169977 00000 n +0000657584 00000 n +0000007635 00000 n +0000007686 00000 n +0000170106 00000 n +0000657452 00000 n +0000007741 00000 n +0000007806 00000 n +0000174741 00000 n +0000657373 00000 n +0000007866 00000 n +0000007913 00000 n +0000180920 00000 n +0000657294 00000 n 0000007973 00000 n -0000008023 00000 n -0000184210 00000 n -0000653670 00000 n -0000008078 00000 n -0000008141 00000 n -0000185958 00000 n -0000653577 00000 n -0000008196 00000 n -0000008248 00000 n -0000186087 00000 n -0000653484 00000 n -0000008303 00000 n -0000008368 00000 n -0000186216 00000 n -0000653391 00000 n -0000008423 00000 n -0000008475 00000 n -0000189968 00000 n -0000653258 00000 n -0000008530 00000 n -0000008595 00000 n -0000198252 00000 n -0000653179 00000 n -0000008655 00000 n -0000008699 00000 n -0000215386 00000 n -0000653086 00000 n -0000008759 00000 n -0000008798 00000 n -0000219756 00000 n -0000652993 00000 n -0000008858 00000 n -0000008905 00000 n -0000219885 00000 n -0000652900 00000 n -0000008965 00000 n +0000008021 00000 n +0000184667 00000 n +0000657201 00000 n +0000008076 00000 n +0000008126 00000 n +0000184796 00000 n +0000657108 00000 n +0000008181 00000 n +0000008244 00000 n +0000186525 00000 n +0000657015 00000 n +0000008299 00000 n +0000008351 00000 n +0000186654 00000 n +0000656922 00000 n +0000008406 00000 n +0000008471 00000 n +0000186783 00000 n +0000656829 00000 n +0000008526 00000 n +0000008578 00000 n +0000190468 00000 n +0000656696 00000 n +0000008633 00000 n +0000008698 00000 n +0000198533 00000 n +0000656617 00000 n +0000008758 00000 n +0000008802 00000 n +0000215894 00000 n +0000656524 00000 n +0000008862 00000 n +0000008901 00000 n +0000220110 00000 n +0000656431 00000 n +0000008961 00000 n 0000009008 00000 n -0000223624 00000 n -0000652807 00000 n +0000220238 00000 n +0000656338 00000 n 0000009068 00000 n -0000009107 00000 n -0000226684 00000 n -0000652714 00000 n -0000009167 00000 n -0000009209 00000 n -0000226813 00000 n -0000652621 00000 n -0000009269 00000 n +0000009111 00000 n +0000224047 00000 n +0000656245 00000 n +0000009171 00000 n +0000009210 00000 n +0000227019 00000 n +0000656152 00000 n +0000009270 00000 n 0000009312 00000 n -0000233783 00000 n -0000652528 00000 n +0000227148 00000 n +0000656059 00000 n 0000009372 00000 n -0000009419 00000 n -0000238035 00000 n -0000652435 00000 n -0000009479 00000 n -0000009540 00000 n -0000238164 00000 n -0000652342 00000 n -0000009601 00000 n -0000009653 00000 n -0000241534 00000 n -0000652249 00000 n -0000009714 00000 n -0000009767 00000 n -0000241663 00000 n -0000652156 00000 n -0000009828 00000 n -0000009866 00000 n -0000245562 00000 n -0000652063 00000 n -0000009927 00000 n -0000009979 00000 n -0000248987 00000 n -0000651970 00000 n -0000010040 00000 n -0000010084 00000 n -0000249245 00000 n -0000651877 00000 n -0000010145 00000 n -0000010181 00000 n -0000257943 00000 n -0000651784 00000 n -0000010242 00000 n -0000010305 00000 n -0000258072 00000 n -0000651691 00000 n -0000010366 00000 n -0000010416 00000 n -0000263388 00000 n -0000651598 00000 n -0000010477 00000 n -0000010526 00000 n -0000267136 00000 n -0000651519 00000 n -0000010587 00000 n -0000010643 00000 n -0000267264 00000 n -0000651426 00000 n -0000010698 00000 n -0000010749 00000 n -0000271927 00000 n -0000651333 00000 n -0000010804 00000 n -0000010868 00000 n -0000275574 00000 n -0000651240 00000 n -0000010923 00000 n -0000010980 00000 n -0000275703 00000 n -0000651147 00000 n -0000011035 00000 n -0000011105 00000 n -0000275832 00000 n -0000651054 00000 n -0000011160 00000 n -0000011209 00000 n -0000275961 00000 n -0000650961 00000 n -0000011264 00000 n -0000011326 00000 n -0000278854 00000 n -0000650868 00000 n -0000011381 00000 n -0000011430 00000 n -0000285099 00000 n -0000650750 00000 n -0000011485 00000 n -0000011547 00000 n -0000285228 00000 n -0000650671 00000 n -0000011607 00000 n -0000011646 00000 n -0000289999 00000 n -0000650578 00000 n -0000011706 00000 n -0000011740 00000 n -0000290128 00000 n -0000650485 00000 n -0000011800 00000 n -0000011841 00000 n -0000305064 00000 n -0000650406 00000 n -0000011901 00000 n -0000011953 00000 n -0000309075 00000 n -0000650288 00000 n -0000012002 00000 n -0000012035 00000 n -0000309204 00000 n -0000650170 00000 n -0000012089 00000 n -0000012161 00000 n -0000309332 00000 n -0000650091 00000 n -0000012220 00000 n +0000009415 00000 n +0000234387 00000 n +0000655966 00000 n +0000009475 00000 n +0000009522 00000 n +0000238637 00000 n +0000655873 00000 n +0000009582 00000 n +0000009643 00000 n +0000238766 00000 n +0000655780 00000 n +0000009704 00000 n +0000009756 00000 n +0000242137 00000 n +0000655687 00000 n +0000009817 00000 n +0000009870 00000 n +0000242266 00000 n +0000655594 00000 n +0000009931 00000 n +0000009969 00000 n +0000246165 00000 n +0000655501 00000 n +0000010030 00000 n +0000010082 00000 n +0000249590 00000 n +0000655408 00000 n +0000010143 00000 n +0000010187 00000 n +0000249848 00000 n +0000655315 00000 n +0000010248 00000 n +0000010284 00000 n +0000258617 00000 n +0000655222 00000 n +0000010345 00000 n +0000010408 00000 n +0000258746 00000 n +0000655129 00000 n +0000010469 00000 n +0000010519 00000 n +0000264098 00000 n +0000655036 00000 n +0000010580 00000 n +0000010629 00000 n +0000268086 00000 n +0000654957 00000 n +0000010690 00000 n +0000010746 00000 n +0000268214 00000 n +0000654864 00000 n +0000010801 00000 n +0000010852 00000 n +0000272132 00000 n +0000654771 00000 n +0000010907 00000 n +0000010971 00000 n +0000276161 00000 n +0000654678 00000 n +0000011026 00000 n +0000011083 00000 n +0000276289 00000 n +0000654585 00000 n +0000011138 00000 n +0000011208 00000 n +0000276415 00000 n +0000654492 00000 n +0000011263 00000 n +0000011312 00000 n +0000279841 00000 n +0000654399 00000 n +0000011367 00000 n +0000011429 00000 n +0000281485 00000 n +0000654306 00000 n +0000011484 00000 n +0000011533 00000 n +0000285418 00000 n +0000654188 00000 n +0000011588 00000 n +0000011650 00000 n +0000285547 00000 n +0000654109 00000 n +0000011710 00000 n +0000011749 00000 n +0000289600 00000 n +0000654016 00000 n +0000011809 00000 n +0000011843 00000 n +0000295217 00000 n +0000653923 00000 n +0000011903 00000 n +0000011944 00000 n +0000305618 00000 n +0000653844 00000 n +0000012004 00000 n +0000012056 00000 n +0000309716 00000 n +0000653726 00000 n +0000012105 00000 n +0000012138 00000 n +0000309844 00000 n +0000653608 00000 n +0000012192 00000 n 0000012264 00000 n -0000316570 00000 n -0000650012 00000 n +0000309972 00000 n +0000653529 00000 n 0000012323 00000 n -0000012376 00000 n -0000320317 00000 n -0000649919 00000 n -0000012430 00000 n -0000012480 00000 n -0000320576 00000 n -0000649826 00000 n -0000012534 00000 n -0000012572 00000 n -0000323637 00000 n -0000649733 00000 n -0000012626 00000 n +0000012367 00000 n +0000317475 00000 n +0000653450 00000 n +0000012426 00000 n +0000012479 00000 n +0000321162 00000 n +0000653357 00000 n +0000012533 00000 n +0000012583 00000 n +0000324615 00000 n +0000653264 00000 n +0000012637 00000 n 0000012675 00000 n -0000323896 00000 n -0000649601 00000 n +0000324874 00000 n +0000653171 00000 n 0000012729 00000 n -0000012781 00000 n -0000324025 00000 n -0000649522 00000 n -0000012840 00000 n -0000012892 00000 n -0000324154 00000 n -0000649429 00000 n -0000012951 00000 n -0000013004 00000 n -0000326890 00000 n -0000649350 00000 n -0000013063 00000 n -0000013112 00000 n -0000327019 00000 n -0000649257 00000 n +0000012778 00000 n +0000325132 00000 n +0000653039 00000 n +0000012832 00000 n +0000012884 00000 n +0000327987 00000 n +0000652960 00000 n +0000012943 00000 n +0000012995 00000 n +0000328116 00000 n +0000652867 00000 n +0000013054 00000 n +0000013107 00000 n +0000328245 00000 n +0000652788 00000 n 0000013166 00000 n -0000013246 00000 n -0000331008 00000 n -0000649178 00000 n -0000013300 00000 n +0000013215 00000 n +0000328374 00000 n +0000652695 00000 n +0000013269 00000 n 0000013349 00000 n -0000333285 00000 n -0000649045 00000 n -0000013396 00000 n -0000013448 00000 n -0000333414 00000 n -0000648966 00000 n -0000013497 00000 n -0000013541 00000 n -0000337507 00000 n -0000648834 00000 n -0000013590 00000 n -0000013631 00000 n -0000337636 00000 n -0000648755 00000 n -0000013685 00000 n -0000013733 00000 n -0000337765 00000 n -0000648676 00000 n -0000013787 00000 n -0000013838 00000 n -0000337894 00000 n -0000648597 00000 n -0000013887 00000 n -0000013934 00000 n -0000342171 00000 n -0000648464 00000 n -0000013981 00000 n -0000014018 00000 n -0000342300 00000 n -0000648346 00000 n -0000014067 00000 n -0000014106 00000 n -0000342429 00000 n -0000648281 00000 n -0000014160 00000 n -0000014238 00000 n -0000342558 00000 n -0000648188 00000 n -0000014287 00000 n -0000014354 00000 n -0000342687 00000 n -0000648109 00000 n -0000014403 00000 n -0000014448 00000 n -0000346221 00000 n -0000647976 00000 n -0000014496 00000 n -0000014528 00000 n -0000346350 00000 n -0000647858 00000 n -0000014577 00000 n -0000014616 00000 n -0000346479 00000 n -0000647793 00000 n -0000014670 00000 n -0000014731 00000 n -0000350291 00000 n -0000647661 00000 n -0000014780 00000 n -0000014837 00000 n -0000350420 00000 n -0000647596 00000 n -0000014891 00000 n +0000332714 00000 n +0000652616 00000 n +0000013403 00000 n +0000013452 00000 n +0000334990 00000 n +0000652483 00000 n +0000013499 00000 n +0000013551 00000 n +0000335119 00000 n +0000652404 00000 n +0000013600 00000 n +0000013644 00000 n +0000339212 00000 n +0000652272 00000 n +0000013693 00000 n +0000013734 00000 n +0000339341 00000 n +0000652193 00000 n +0000013788 00000 n +0000013836 00000 n +0000339470 00000 n +0000652114 00000 n +0000013890 00000 n +0000013941 00000 n +0000339599 00000 n +0000652035 00000 n +0000013990 00000 n +0000014037 00000 n +0000343870 00000 n +0000651902 00000 n +0000014084 00000 n +0000014121 00000 n +0000343999 00000 n +0000651784 00000 n +0000014170 00000 n +0000014209 00000 n +0000344128 00000 n +0000651719 00000 n +0000014263 00000 n +0000014341 00000 n +0000344257 00000 n +0000651626 00000 n +0000014390 00000 n +0000014457 00000 n +0000344386 00000 n +0000651547 00000 n +0000014506 00000 n +0000014551 00000 n +0000347825 00000 n +0000651414 00000 n +0000014599 00000 n +0000014631 00000 n +0000347954 00000 n +0000651296 00000 n +0000014680 00000 n +0000014719 00000 n +0000348083 00000 n +0000651231 00000 n +0000014773 00000 n +0000014834 00000 n +0000351848 00000 n +0000651099 00000 n +0000014883 00000 n 0000014940 00000 n -0000350549 00000 n -0000647478 00000 n -0000014989 00000 n -0000015051 00000 n -0000350678 00000 n -0000647399 00000 n -0000015105 00000 n -0000015160 00000 n -0000374453 00000 n -0000647306 00000 n -0000015214 00000 n -0000015255 00000 n -0000374582 00000 n -0000647227 00000 n -0000015309 00000 n -0000015361 00000 n -0000377282 00000 n -0000647107 00000 n -0000015409 00000 n -0000015443 00000 n -0000377411 00000 n -0000647028 00000 n -0000015492 00000 n -0000015519 00000 n -0000395360 00000 n -0000646935 00000 n -0000015568 00000 n -0000015596 00000 n -0000402947 00000 n -0000646842 00000 n -0000015645 00000 n -0000015682 00000 n -0000409275 00000 n -0000646749 00000 n -0000015731 00000 n -0000015770 00000 n -0000418787 00000 n -0000646656 00000 n -0000015819 00000 n -0000015858 00000 n -0000421692 00000 n -0000646563 00000 n -0000015907 00000 n -0000015946 00000 n -0000427976 00000 n -0000646470 00000 n -0000015995 00000 n -0000016024 00000 n -0000437167 00000 n -0000646377 00000 n -0000016073 00000 n -0000016101 00000 n -0000440192 00000 n -0000646284 00000 n -0000016150 00000 n -0000016183 00000 n -0000446424 00000 n -0000646205 00000 n -0000016233 00000 n -0000016270 00000 n -0000016639 00000 n -0000016761 00000 n -0000024590 00000 n -0000016323 00000 n -0000024464 00000 n -0000024527 00000 n -0000642088 00000 n -0000616145 00000 n -0000641914 00000 n -0000643113 00000 n -0000019624 00000 n -0000019841 00000 n -0000019910 00000 n -0000019979 00000 n -0000020047 00000 n -0000020115 00000 n -0000020164 00000 n -0000020211 00000 n -0000020544 00000 n -0000020566 00000 n -0000020734 00000 n -0000020899 00000 n -0000021068 00000 n -0000021247 00000 n -0000021556 00000 n -0000021716 00000 n -0000025949 00000 n -0000025764 00000 n -0000024690 00000 n -0000025886 00000 n -0000615072 00000 n -0000588808 00000 n -0000614898 00000 n -0000588123 00000 n -0000585979 00000 n -0000587959 00000 n -0000037649 00000 n -0000028998 00000 n -0000026034 00000 n -0000037523 00000 n -0000037586 00000 n -0000029532 00000 n -0000029686 00000 n -0000029843 00000 n -0000030000 00000 n -0000030156 00000 n -0000030313 00000 n -0000030475 00000 n -0000030636 00000 n -0000030797 00000 n -0000030959 00000 n -0000031126 00000 n -0000031293 00000 n -0000031458 00000 n -0000031620 00000 n -0000031786 00000 n -0000031947 00000 n -0000032102 00000 n -0000032259 00000 n -0000032415 00000 n -0000032572 00000 n -0000032729 00000 n -0000032886 00000 n -0000033040 00000 n -0000033196 00000 n -0000033358 00000 n -0000033520 00000 n -0000033676 00000 n -0000033833 00000 n -0000033995 00000 n -0000034162 00000 n -0000034328 00000 n -0000034489 00000 n -0000034644 00000 n -0000034801 00000 n -0000034958 00000 n -0000035120 00000 n -0000035277 00000 n -0000035434 00000 n -0000035591 00000 n -0000035753 00000 n -0000035920 00000 n -0000036087 00000 n -0000036248 00000 n -0000036410 00000 n -0000036572 00000 n -0000036734 00000 n -0000036896 00000 n -0000037053 00000 n -0000037208 00000 n -0000037363 00000 n -0000051025 00000 n -0000040974 00000 n -0000037734 00000 n -0000050962 00000 n -0000585428 00000 n -0000568347 00000 n -0000585244 00000 n -0000041564 00000 n -0000041727 00000 n -0000041890 00000 n -0000042048 00000 n -0000042211 00000 n -0000042374 00000 n -0000042530 00000 n -0000042688 00000 n -0000042846 00000 n -0000043001 00000 n -0000043159 00000 n -0000043322 00000 n -0000043490 00000 n -0000043658 00000 n -0000043821 00000 n -0000043989 00000 n -0000044157 00000 n -0000044315 00000 n -0000044477 00000 n -0000044640 00000 n -0000044803 00000 n -0000044965 00000 n -0000045127 00000 n -0000045290 00000 n -0000045452 00000 n -0000045614 00000 n -0000045777 00000 n -0000045941 00000 n -0000046109 00000 n -0000046277 00000 n -0000046441 00000 n -0000046605 00000 n -0000046768 00000 n -0000046932 00000 n -0000047096 00000 n -0000047259 00000 n -0000047428 00000 n -0000047597 00000 n -0000047765 00000 n -0000047934 00000 n -0000048103 00000 n -0000048272 00000 n -0000048441 00000 n -0000048610 00000 n -0000048779 00000 n -0000048949 00000 n -0000049119 00000 n -0000049289 00000 n -0000049459 00000 n -0000049628 00000 n -0000049798 00000 n -0000049968 00000 n -0000050138 00000 n -0000050307 00000 n -0000050477 00000 n -0000050639 00000 n -0000050800 00000 n -0000063624 00000 n -0000054499 00000 n -0000051123 00000 n -0000063561 00000 n -0000055057 00000 n -0000055220 00000 n -0000055383 00000 n -0000055546 00000 n -0000055709 00000 n -0000055871 00000 n -0000056039 00000 n -0000056207 00000 n -0000056375 00000 n -0000056541 00000 n -0000056698 00000 n -0000056859 00000 n -0000057026 00000 n -0000057193 00000 n -0000057355 00000 n -0000057517 00000 n -0000057679 00000 n -0000057841 00000 n -0000058008 00000 n -0000058175 00000 n -0000058342 00000 n -0000058504 00000 n -0000058666 00000 n -0000058821 00000 n -0000058978 00000 n -0000059133 00000 n -0000059295 00000 n -0000059457 00000 n -0000059614 00000 n -0000059769 00000 n -0000059926 00000 n -0000060088 00000 n -0000060245 00000 n -0000060401 00000 n -0000060557 00000 n -0000060713 00000 n -0000060875 00000 n -0000061032 00000 n -0000061194 00000 n -0000061351 00000 n -0000061513 00000 n -0000061674 00000 n -0000061836 00000 n -0000061992 00000 n -0000062149 00000 n -0000062306 00000 n -0000062463 00000 n -0000062620 00000 n -0000062777 00000 n -0000062933 00000 n -0000063090 00000 n -0000567410 00000 n -0000547731 00000 n -0000567237 00000 n -0000063247 00000 n -0000063404 00000 n -0000064069 00000 n -0000063884 00000 n -0000063735 00000 n -0000064006 00000 n -0000067199 00000 n -0000066389 00000 n -0000064110 00000 n -0000066511 00000 n -0000066635 00000 n -0000066760 00000 n -0000066885 00000 n -0000546842 00000 n -0000525510 00000 n -0000546668 00000 n -0000067010 00000 n -0000067073 00000 n -0000067136 00000 n -0000524743 00000 n -0000507335 00000 n -0000524570 00000 n -0000643231 00000 n -0000071855 00000 n -0000070673 00000 n -0000067323 00000 n -0000071167 00000 n -0000071230 00000 n -0000071293 00000 n -0000071417 00000 n -0000071542 00000 n -0000071667 00000 n -0000070823 00000 n -0000071016 00000 n -0000071792 00000 n -0000309268 00000 n -0000350742 00000 n -0000076525 00000 n -0000075489 00000 n -0000071979 00000 n -0000075962 00000 n -0000076087 00000 n -0000075639 00000 n -0000075801 00000 n -0000076212 00000 n -0000076337 00000 n -0000076462 00000 n -0000092174 00000 n -0000079571 00000 n -0000079011 00000 n -0000076649 00000 n -0000079133 00000 n -0000079258 00000 n -0000079383 00000 n -0000079508 00000 n -0000082997 00000 n -0000081857 00000 n -0000079682 00000 n -0000082310 00000 n -0000082435 00000 n -0000082560 00000 n -0000082685 00000 n -0000082810 00000 n -0000082007 00000 n -0000082159 00000 n -0000082934 00000 n -0000267200 00000 n -0000084083 00000 n -0000083773 00000 n -0000083082 00000 n -0000083895 00000 n -0000084020 00000 n -0000086168 00000 n -0000085483 00000 n -0000084181 00000 n -0000085605 00000 n -0000085730 00000 n -0000085854 00000 n -0000085979 00000 n -0000086105 00000 n -0000643349 00000 n -0000089056 00000 n -0000088188 00000 n -0000086266 00000 n -0000088490 00000 n -0000088616 00000 n -0000088679 00000 n -0000088742 00000 n -0000088330 00000 n -0000088868 00000 n -0000088994 00000 n -0000249051 00000 n -0000092363 00000 n -0000091926 00000 n -0000089167 00000 n -0000092048 00000 n -0000506679 00000 n -0000495097 00000 n -0000506502 00000 n -0000092300 00000 n -0000095962 00000 n -0000095777 00000 n -0000092487 00000 n -0000095899 00000 n -0000494562 00000 n -0000485048 00000 n -0000494385 00000 n -0000100500 00000 n -0000100110 00000 n -0000096125 00000 n -0000100437 00000 n -0000100252 00000 n -0000161071 00000 n -0000102786 00000 n -0000102349 00000 n -0000100637 00000 n -0000102471 00000 n -0000102597 00000 n -0000102660 00000 n -0000102723 00000 n -0000105437 00000 n -0000107962 00000 n -0000105287 00000 n -0000102910 00000 n -0000107395 00000 n -0000107521 00000 n -0000107647 00000 n -0000107073 00000 n -0000107234 00000 n -0000484205 00000 n -0000474883 00000 n -0000484033 00000 n -0000474321 00000 n -0000465238 00000 n -0000474148 00000 n -0000107773 00000 n -0000107899 00000 n -0000643467 00000 n -0000106905 00000 n -0000106962 00000 n -0000107051 00000 n -0000198315 00000 n -0000226877 00000 n -0000112373 00000 n -0000111567 00000 n -0000108114 00000 n -0000112050 00000 n -0000112179 00000 n -0000111722 00000 n -0000111888 00000 n -0000112308 00000 n -0000351520 00000 n -0000115864 00000 n -0000115485 00000 n -0000112524 00000 n -0000115799 00000 n -0000115631 00000 n -0000117097 00000 n -0000116907 00000 n -0000115989 00000 n -0000117032 00000 n -0000119998 00000 n -0000119423 00000 n -0000117196 00000 n -0000119548 00000 n -0000119675 00000 n -0000119804 00000 n -0000119933 00000 n -0000123387 00000 n -0000122553 00000 n -0000120136 00000 n -0000122678 00000 n -0000122807 00000 n -0000122936 00000 n -0000123065 00000 n -0000123193 00000 n -0000123322 00000 n -0000127281 00000 n -0000126513 00000 n -0000123525 00000 n -0000126830 00000 n -0000126660 00000 n -0000126959 00000 n +0000351977 00000 n +0000651034 00000 n +0000014994 00000 n +0000015043 00000 n +0000352106 00000 n +0000650916 00000 n +0000015092 00000 n +0000015154 00000 n +0000352235 00000 n +0000650837 00000 n +0000015208 00000 n +0000015263 00000 n +0000376350 00000 n +0000650744 00000 n +0000015317 00000 n +0000015358 00000 n +0000376479 00000 n +0000650665 00000 n +0000015412 00000 n +0000015464 00000 n +0000379182 00000 n +0000650545 00000 n +0000015512 00000 n +0000015546 00000 n +0000379311 00000 n +0000650466 00000 n +0000015595 00000 n +0000015622 00000 n +0000397251 00000 n +0000650373 00000 n +0000015671 00000 n +0000015699 00000 n +0000404786 00000 n +0000650280 00000 n +0000015748 00000 n +0000015785 00000 n +0000411100 00000 n +0000650187 00000 n +0000015834 00000 n +0000015873 00000 n +0000420622 00000 n +0000650094 00000 n +0000015922 00000 n +0000015961 00000 n +0000423509 00000 n +0000650001 00000 n +0000016010 00000 n +0000016049 00000 n +0000429882 00000 n +0000649908 00000 n +0000016098 00000 n +0000016127 00000 n +0000439478 00000 n +0000649815 00000 n +0000016176 00000 n +0000016204 00000 n +0000442678 00000 n +0000649722 00000 n +0000016253 00000 n +0000016286 00000 n +0000448674 00000 n +0000649643 00000 n +0000016336 00000 n +0000016373 00000 n +0000016742 00000 n +0000016864 00000 n +0000024693 00000 n +0000016426 00000 n +0000024567 00000 n +0000024630 00000 n +0000645524 00000 n +0000619581 00000 n +0000645350 00000 n +0000646549 00000 n +0000019727 00000 n +0000019944 00000 n +0000020013 00000 n +0000020082 00000 n +0000020150 00000 n +0000020218 00000 n +0000020267 00000 n +0000020314 00000 n +0000020647 00000 n +0000020669 00000 n +0000020837 00000 n +0000021002 00000 n +0000021171 00000 n +0000021350 00000 n +0000021659 00000 n +0000021819 00000 n +0000026052 00000 n +0000025867 00000 n +0000024793 00000 n +0000025989 00000 n +0000618369 00000 n +0000591890 00000 n +0000618195 00000 n +0000591205 00000 n +0000589060 00000 n +0000591041 00000 n +0000037758 00000 n +0000029108 00000 n +0000026137 00000 n +0000037632 00000 n +0000037695 00000 n +0000029642 00000 n +0000029796 00000 n +0000029953 00000 n +0000030110 00000 n +0000030266 00000 n +0000030423 00000 n +0000030585 00000 n +0000030746 00000 n +0000030907 00000 n +0000031069 00000 n +0000031236 00000 n +0000031403 00000 n +0000031568 00000 n +0000031730 00000 n +0000031896 00000 n +0000032057 00000 n +0000032212 00000 n +0000032369 00000 n +0000032525 00000 n +0000032682 00000 n +0000032839 00000 n +0000032996 00000 n +0000033150 00000 n +0000033306 00000 n +0000033468 00000 n +0000033630 00000 n +0000033786 00000 n +0000033943 00000 n +0000034105 00000 n +0000034272 00000 n +0000034438 00000 n +0000034599 00000 n +0000034754 00000 n +0000034911 00000 n +0000035068 00000 n +0000035230 00000 n +0000035387 00000 n +0000035544 00000 n +0000035706 00000 n +0000035863 00000 n +0000036025 00000 n +0000036192 00000 n +0000036358 00000 n +0000036520 00000 n +0000036682 00000 n +0000036844 00000 n +0000037005 00000 n +0000037167 00000 n +0000037322 00000 n +0000037477 00000 n +0000051127 00000 n +0000041075 00000 n +0000037843 00000 n +0000051064 00000 n +0000588509 00000 n +0000571428 00000 n +0000588325 00000 n +0000041665 00000 n +0000041828 00000 n +0000041990 00000 n +0000042153 00000 n +0000042311 00000 n +0000042474 00000 n +0000042637 00000 n +0000042792 00000 n +0000042950 00000 n +0000043108 00000 n +0000043264 00000 n +0000043422 00000 n +0000043585 00000 n +0000043753 00000 n +0000043921 00000 n +0000044084 00000 n +0000044252 00000 n +0000044420 00000 n +0000044578 00000 n +0000044741 00000 n +0000044904 00000 n +0000045066 00000 n +0000045228 00000 n +0000045391 00000 n +0000045553 00000 n +0000045715 00000 n +0000045878 00000 n +0000046041 00000 n +0000046204 00000 n +0000046373 00000 n +0000046542 00000 n +0000046706 00000 n +0000046869 00000 n +0000047033 00000 n +0000047197 00000 n +0000047360 00000 n +0000047524 00000 n +0000047693 00000 n +0000047862 00000 n +0000048031 00000 n +0000048200 00000 n +0000048369 00000 n +0000048538 00000 n +0000048707 00000 n +0000048876 00000 n +0000049045 00000 n +0000049215 00000 n +0000049385 00000 n +0000049555 00000 n +0000049724 00000 n +0000049894 00000 n +0000050064 00000 n +0000050234 00000 n +0000050403 00000 n +0000050573 00000 n +0000050741 00000 n +0000050902 00000 n +0000063950 00000 n +0000054658 00000 n +0000051225 00000 n +0000063887 00000 n +0000055224 00000 n +0000055387 00000 n +0000055550 00000 n +0000055713 00000 n +0000055876 00000 n +0000056038 00000 n +0000056201 00000 n +0000056369 00000 n +0000056537 00000 n +0000056704 00000 n +0000056872 00000 n +0000057028 00000 n +0000057190 00000 n +0000057357 00000 n +0000057524 00000 n +0000057686 00000 n +0000057848 00000 n +0000058010 00000 n +0000058172 00000 n +0000058339 00000 n +0000058506 00000 n +0000058673 00000 n +0000058835 00000 n +0000058997 00000 n +0000059152 00000 n +0000059307 00000 n +0000059464 00000 n +0000059626 00000 n +0000059788 00000 n +0000059944 00000 n +0000060099 00000 n +0000060256 00000 n +0000060418 00000 n +0000060574 00000 n +0000060731 00000 n +0000060887 00000 n +0000061044 00000 n +0000061206 00000 n +0000061363 00000 n +0000061525 00000 n +0000061682 00000 n +0000061843 00000 n +0000062005 00000 n +0000062167 00000 n +0000062322 00000 n +0000062478 00000 n +0000062635 00000 n +0000062792 00000 n +0000062949 00000 n +0000063105 00000 n +0000063262 00000 n +0000063419 00000 n +0000570462 00000 n +0000550495 00000 n +0000570289 00000 n +0000063576 00000 n +0000063731 00000 n +0000064395 00000 n +0000064210 00000 n +0000064061 00000 n +0000064332 00000 n +0000067523 00000 n +0000066713 00000 n +0000064436 00000 n +0000066835 00000 n +0000066959 00000 n +0000067084 00000 n +0000067209 00000 n +0000549606 00000 n +0000528274 00000 n +0000549432 00000 n +0000067334 00000 n +0000067397 00000 n +0000067460 00000 n +0000527507 00000 n +0000510099 00000 n +0000527334 00000 n +0000646667 00000 n +0000072034 00000 n +0000070852 00000 n +0000067647 00000 n +0000071346 00000 n +0000071409 00000 n +0000071472 00000 n +0000071597 00000 n +0000071722 00000 n +0000071847 00000 n +0000071002 00000 n +0000071195 00000 n +0000071972 00000 n +0000309908 00000 n +0000352299 00000 n +0000076688 00000 n +0000075652 00000 n +0000072158 00000 n +0000076125 00000 n +0000076250 00000 n +0000075802 00000 n +0000075964 00000 n +0000076375 00000 n +0000076500 00000 n +0000076625 00000 n +0000092558 00000 n +0000079910 00000 n +0000079350 00000 n +0000076812 00000 n +0000079472 00000 n +0000079597 00000 n +0000079722 00000 n +0000079847 00000 n +0000083337 00000 n +0000082196 00000 n +0000080021 00000 n +0000082650 00000 n +0000082775 00000 n +0000082900 00000 n +0000083025 00000 n +0000083150 00000 n +0000082346 00000 n +0000082498 00000 n +0000083274 00000 n +0000268150 00000 n +0000084423 00000 n +0000084113 00000 n +0000083422 00000 n +0000084235 00000 n +0000084360 00000 n +0000086508 00000 n +0000085823 00000 n +0000084521 00000 n +0000085945 00000 n +0000086070 00000 n +0000086194 00000 n +0000086319 00000 n +0000086445 00000 n +0000646785 00000 n +0000089413 00000 n +0000088545 00000 n +0000086606 00000 n +0000088847 00000 n +0000088973 00000 n +0000089036 00000 n +0000089099 00000 n +0000088687 00000 n +0000089225 00000 n +0000089351 00000 n +0000249654 00000 n +0000092747 00000 n +0000092310 00000 n +0000089524 00000 n +0000092432 00000 n +0000509443 00000 n +0000497861 00000 n +0000509266 00000 n +0000092684 00000 n +0000096532 00000 n +0000096347 00000 n +0000092871 00000 n +0000096469 00000 n +0000497326 00000 n +0000487812 00000 n +0000497149 00000 n +0000100916 00000 n +0000100525 00000 n +0000096695 00000 n +0000100853 00000 n +0000100667 00000 n +0000161651 00000 n +0000103202 00000 n +0000102765 00000 n +0000101053 00000 n +0000102887 00000 n +0000103013 00000 n +0000103076 00000 n +0000103139 00000 n +0000105854 00000 n +0000108386 00000 n +0000105703 00000 n +0000103326 00000 n +0000107818 00000 n +0000107944 00000 n +0000108070 00000 n +0000107496 00000 n +0000107657 00000 n +0000486953 00000 n +0000477581 00000 n +0000486781 00000 n +0000477019 00000 n +0000467935 00000 n +0000476846 00000 n +0000108196 00000 n +0000108322 00000 n +0000646903 00000 n +0000107325 00000 n +0000107383 00000 n +0000107473 00000 n +0000198597 00000 n +0000227212 00000 n +0000112935 00000 n +0000112001 00000 n +0000108538 00000 n +0000112485 00000 n +0000112613 00000 n +0000112157 00000 n +0000112323 00000 n +0000112741 00000 n +0000112870 00000 n +0000356325 00000 n +0000116427 00000 n +0000116047 00000 n +0000113086 00000 n +0000116362 00000 n +0000116194 00000 n +0000117661 00000 n +0000117470 00000 n +0000116552 00000 n +0000117596 00000 n +0000120563 00000 n +0000119987 00000 n +0000117760 00000 n +0000120113 00000 n +0000120240 00000 n +0000120369 00000 n +0000120498 00000 n +0000123953 00000 n +0000123118 00000 n +0000120701 00000 n +0000123244 00000 n +0000123373 00000 n +0000123502 00000 n +0000123631 00000 n +0000123759 00000 n +0000123888 00000 n +0000127856 00000 n 0000127088 00000 n -0000127217 00000 n -0000643590 00000 n -0000305128 00000 n -0000131140 00000 n -0000130563 00000 n -0000127393 00000 n -0000130689 00000 n -0000130818 00000 n -0000130946 00000 n -0000131075 00000 n -0000134599 00000 n -0000134279 00000 n -0000131278 00000 n -0000134405 00000 n -0000134534 00000 n -0000137930 00000 n -0000137171 00000 n -0000134711 00000 n -0000137479 00000 n -0000137608 00000 n -0000137318 00000 n -0000137737 00000 n -0000137865 00000 n -0000350484 00000 n -0000140668 00000 n -0000140090 00000 n -0000138096 00000 n -0000140216 00000 n -0000140345 00000 n -0000140474 00000 n -0000140603 00000 n -0000141108 00000 n -0000140917 00000 n -0000140767 00000 n -0000141043 00000 n -0000145110 00000 n -0000144344 00000 n -0000141150 00000 n -0000144658 00000 n -0000144787 00000 n -0000144915 00000 n -0000144980 00000 n -0000145045 00000 n -0000144491 00000 n -0000643715 00000 n -0000149172 00000 n -0000149495 00000 n -0000148917 00000 n -0000145209 00000 n -0000149043 00000 n -0000149301 00000 n -0000149430 00000 n -0000153095 00000 n -0000152517 00000 n -0000149633 00000 n -0000152643 00000 n -0000152772 00000 n -0000152901 00000 n -0000153030 00000 n -0000155880 00000 n -0000157130 00000 n -0000155754 00000 n -0000153220 00000 n -0000156806 00000 n -0000156935 00000 n -0000157000 00000 n -0000157065 00000 n -0000161135 00000 n -0000160302 00000 n -0000157284 00000 n -0000160428 00000 n -0000160557 00000 n -0000160684 00000 n -0000160749 00000 n -0000160814 00000 n -0000160943 00000 n +0000124091 00000 n +0000127405 00000 n +0000127235 00000 n +0000127534 00000 n +0000127663 00000 n +0000127792 00000 n +0000647027 00000 n +0000305682 00000 n +0000131720 00000 n +0000131143 00000 n +0000127968 00000 n +0000131269 00000 n +0000131398 00000 n +0000131526 00000 n +0000131655 00000 n +0000135162 00000 n +0000134842 00000 n +0000131858 00000 n +0000134968 00000 n +0000135097 00000 n +0000138493 00000 n +0000137734 00000 n +0000135274 00000 n +0000138042 00000 n +0000138171 00000 n +0000137881 00000 n +0000138300 00000 n +0000138428 00000 n +0000352041 00000 n +0000141231 00000 n +0000140653 00000 n +0000138659 00000 n +0000140779 00000 n +0000140908 00000 n +0000141037 00000 n +0000141166 00000 n +0000141671 00000 n +0000141480 00000 n +0000141330 00000 n +0000141606 00000 n +0000145673 00000 n +0000144907 00000 n +0000141713 00000 n +0000145221 00000 n +0000145350 00000 n +0000145478 00000 n +0000145543 00000 n +0000145608 00000 n +0000145054 00000 n +0000647152 00000 n +0000149746 00000 n +0000150069 00000 n +0000149491 00000 n +0000145772 00000 n +0000149617 00000 n +0000149875 00000 n +0000150004 00000 n +0000153675 00000 n +0000153097 00000 n +0000150207 00000 n +0000153223 00000 n +0000153352 00000 n +0000153481 00000 n +0000153610 00000 n +0000156460 00000 n +0000157710 00000 n +0000156334 00000 n +0000153800 00000 n +0000157386 00000 n +0000157515 00000 n +0000157580 00000 n +0000157645 00000 n +0000161715 00000 n +0000160882 00000 n +0000157864 00000 n +0000161008 00000 n +0000161137 00000 n +0000161264 00000 n +0000161329 00000 n +0000161394 00000 n +0000161523 00000 n +0000166757 00000 n +0000165359 00000 n +0000161827 00000 n 0000166177 00000 n -0000164779 00000 n -0000161247 00000 n -0000165597 00000 n -0000164953 00000 n -0000165104 00000 n -0000165726 00000 n -0000165855 00000 n -0000165984 00000 n -0000166113 00000 n -0000165263 00000 n -0000165413 00000 n -0000451429 00000 n -0000169654 00000 n -0000168997 00000 n -0000166315 00000 n -0000169331 00000 n -0000169144 00000 n -0000169460 00000 n -0000169589 00000 n -0000643840 00000 n -0000174289 00000 n -0000173969 00000 n -0000169779 00000 n -0000174095 00000 n -0000174224 00000 n -0000177453 00000 n -0000177074 00000 n -0000174414 00000 n -0000177388 00000 n -0000177221 00000 n -0000180403 00000 n -0000180597 00000 n -0000180148 00000 n -0000177565 00000 n -0000180274 00000 n -0000180468 00000 n -0000180532 00000 n -0000184339 00000 n -0000183555 00000 n -0000180709 00000 n -0000184016 00000 n -0000184145 00000 n -0000184274 00000 n -0000183711 00000 n -0000183863 00000 n -0000186345 00000 n -0000185767 00000 n -0000184451 00000 n -0000185893 00000 n -0000186022 00000 n -0000186151 00000 n -0000186280 00000 n -0000187890 00000 n -0000187699 00000 n -0000186457 00000 n -0000187825 00000 n -0000643965 00000 n -0000190097 00000 n -0000189777 00000 n -0000187989 00000 n -0000189903 00000 n -0000190032 00000 n -0000194415 00000 n -0000194047 00000 n -0000190209 00000 n -0000194350 00000 n -0000194194 00000 n -0000263452 00000 n -0000198510 00000 n -0000198061 00000 n -0000194540 00000 n -0000198187 00000 n -0000198380 00000 n -0000198445 00000 n -0000202640 00000 n -0000202274 00000 n -0000198635 00000 n -0000202575 00000 n -0000202421 00000 n -0000207674 00000 n -0000206541 00000 n -0000202765 00000 n -0000207609 00000 n -0000206724 00000 n -0000206880 00000 n -0000207065 00000 n -0000207239 00000 n -0000207424 00000 n -0000271991 00000 n -0000211774 00000 n -0000211583 00000 n -0000207866 00000 n -0000211709 00000 n -0000644090 00000 n -0000215515 00000 n -0000215195 00000 n -0000211886 00000 n -0000215321 00000 n -0000215450 00000 n -0000220014 00000 n -0000219022 00000 n -0000215627 00000 n -0000219691 00000 n -0000219187 00000 n -0000219820 00000 n -0000219949 00000 n -0000219356 00000 n -0000219521 00000 n -0000278918 00000 n -0000337958 00000 n -0000223753 00000 n -0000223241 00000 n -0000220180 00000 n -0000223559 00000 n -0000223388 00000 n -0000223688 00000 n -0000226942 00000 n -0000226493 00000 n -0000223878 00000 n -0000226619 00000 n -0000226748 00000 n -0000230940 00000 n -0000230749 00000 n -0000227108 00000 n -0000230875 00000 n -0000233912 00000 n -0000233592 00000 n -0000231052 00000 n -0000233718 00000 n -0000233847 00000 n -0000644215 00000 n -0000238291 00000 n -0000237485 00000 n -0000234065 00000 n -0000237970 00000 n -0000238099 00000 n -0000237641 00000 n -0000238227 00000 n -0000237815 00000 n -0000241792 00000 n -0000241343 00000 n -0000238403 00000 n -0000241469 00000 n -0000241598 00000 n -0000241727 00000 n -0000245691 00000 n -0000245024 00000 n -0000241945 00000 n -0000245497 00000 n -0000245626 00000 n -0000245180 00000 n -0000245342 00000 n -0000249374 00000 n -0000248606 00000 n -0000245857 00000 n -0000248922 00000 n -0000248753 00000 n -0000249115 00000 n -0000249180 00000 n -0000249309 00000 n -0000253794 00000 n -0000253248 00000 n -0000249553 00000 n -0000253729 00000 n -0000253404 00000 n -0000253566 00000 n -0000331072 00000 n -0000258200 00000 n -0000257562 00000 n -0000253960 00000 n -0000257878 00000 n -0000464883 00000 n -0000462885 00000 n -0000464718 00000 n -0000258007 00000 n -0000257709 00000 n -0000258135 00000 n -0000644340 00000 n -0000275896 00000 n -0000260287 00000 n -0000260096 00000 n -0000258339 00000 n -0000260222 00000 n -0000263647 00000 n -0000263197 00000 n -0000260399 00000 n -0000263323 00000 n -0000263517 00000 n -0000263582 00000 n -0000267393 00000 n -0000266945 00000 n -0000263787 00000 n -0000267071 00000 n -0000267328 00000 n -0000272056 00000 n -0000271564 00000 n -0000267505 00000 n -0000271862 00000 n -0000271711 00000 n -0000276090 00000 n -0000275039 00000 n -0000272168 00000 n -0000275509 00000 n -0000275195 00000 n -0000275638 00000 n -0000275767 00000 n -0000275355 00000 n -0000276025 00000 n -0000278982 00000 n -0000278663 00000 n -0000276202 00000 n -0000278789 00000 n -0000644465 00000 n -0000280382 00000 n -0000280191 00000 n -0000279094 00000 n -0000280317 00000 n -0000281794 00000 n -0000281603 00000 n -0000280481 00000 n -0000281729 00000 n -0000285487 00000 n -0000284908 00000 n -0000281893 00000 n -0000285034 00000 n -0000285163 00000 n -0000285292 00000 n -0000285357 00000 n -0000285422 00000 n -0000290257 00000 n -0000288765 00000 n -0000285599 00000 n -0000289934 00000 n -0000290063 00000 n -0000290192 00000 n -0000288957 00000 n -0000289118 00000 n -0000289280 00000 n -0000289442 00000 n -0000289604 00000 n -0000289774 00000 n -0000295160 00000 n -0000293756 00000 n -0000290369 00000 n -0000295095 00000 n -0000293957 00000 n -0000294120 00000 n -0000294283 00000 n -0000294446 00000 n -0000294609 00000 n -0000294772 00000 n -0000294935 00000 n -0000301257 00000 n -0000298024 00000 n -0000295285 00000 n -0000301192 00000 n -0000298324 00000 n -0000298485 00000 n -0000298647 00000 n -0000298809 00000 n -0000298971 00000 n -0000299134 00000 n -0000299288 00000 n -0000299450 00000 n -0000299612 00000 n -0000299772 00000 n -0000299932 00000 n -0000300094 00000 n -0000300253 00000 n -0000300412 00000 n -0000300565 00000 n -0000300727 00000 n -0000300878 00000 n -0000301040 00000 n -0000644590 00000 n -0000305323 00000 n -0000304873 00000 n -0000301382 00000 n -0000304999 00000 n -0000305193 00000 n -0000305258 00000 n -0000309720 00000 n -0000308522 00000 n -0000305448 00000 n -0000309010 00000 n -0000309139 00000 n -0000309395 00000 n -0000308678 00000 n -0000308848 00000 n -0000309460 00000 n -0000309525 00000 n -0000309590 00000 n -0000309655 00000 n -0000312971 00000 n -0000312650 00000 n -0000309832 00000 n -0000312776 00000 n -0000312841 00000 n -0000312906 00000 n -0000316891 00000 n -0000316379 00000 n -0000313070 00000 n -0000316505 00000 n -0000316633 00000 n -0000316698 00000 n -0000316763 00000 n -0000316828 00000 n -0000320835 00000 n -0000320061 00000 n -0000317003 00000 n -0000320187 00000 n -0000320252 00000 n -0000320381 00000 n -0000320446 00000 n -0000320511 00000 n -0000320640 00000 n -0000320705 00000 n -0000320770 00000 n -0000324282 00000 n -0000323446 00000 n -0000320960 00000 n -0000323572 00000 n -0000323701 00000 n -0000323766 00000 n -0000323831 00000 n -0000323960 00000 n -0000324089 00000 n -0000324218 00000 n -0000644715 00000 n -0000327278 00000 n -0000326699 00000 n -0000324488 00000 n -0000326825 00000 n -0000326954 00000 n -0000327083 00000 n -0000327148 00000 n -0000327213 00000 n -0000331137 00000 n -0000330817 00000 n -0000327457 00000 n -0000330943 00000 n -0000331603 00000 n -0000331412 00000 n -0000331262 00000 n -0000331538 00000 n -0000333543 00000 n -0000333094 00000 n -0000331645 00000 n -0000333220 00000 n -0000333349 00000 n -0000333478 00000 n -0000338023 00000 n -0000337079 00000 n -0000333655 00000 n -0000337442 00000 n -0000462564 00000 n -0000453351 00000 n -0000462378 00000 n -0000337226 00000 n -0000337571 00000 n -0000337700 00000 n -0000337829 00000 n -0000339061 00000 n -0000338870 00000 n -0000338256 00000 n -0000338996 00000 n -0000644840 00000 n -0000339488 00000 n -0000339297 00000 n +0000165533 00000 n +0000165684 00000 n +0000166306 00000 n +0000166435 00000 n +0000166564 00000 n +0000166693 00000 n +0000165843 00000 n +0000165993 00000 n +0000454127 00000 n +0000170235 00000 n +0000169578 00000 n +0000166895 00000 n +0000169912 00000 n +0000169725 00000 n +0000170041 00000 n +0000170170 00000 n +0000647277 00000 n +0000174870 00000 n +0000174550 00000 n +0000170360 00000 n +0000174676 00000 n +0000174805 00000 n +0000178034 00000 n +0000177655 00000 n +0000174995 00000 n +0000177969 00000 n +0000177802 00000 n +0000180984 00000 n +0000181178 00000 n +0000180729 00000 n +0000178146 00000 n +0000180855 00000 n +0000181049 00000 n +0000181113 00000 n +0000184925 00000 n +0000184141 00000 n +0000181290 00000 n +0000184602 00000 n +0000184731 00000 n +0000184860 00000 n +0000184297 00000 n +0000184449 00000 n +0000186912 00000 n +0000186334 00000 n +0000185037 00000 n +0000186460 00000 n +0000186589 00000 n +0000186718 00000 n +0000186847 00000 n +0000188482 00000 n +0000188291 00000 n +0000187024 00000 n +0000188417 00000 n +0000647402 00000 n +0000190597 00000 n +0000190277 00000 n +0000188581 00000 n +0000190403 00000 n +0000190532 00000 n +0000194776 00000 n +0000194408 00000 n +0000190709 00000 n +0000194711 00000 n +0000194555 00000 n +0000264162 00000 n +0000198662 00000 n +0000198342 00000 n +0000194901 00000 n +0000198468 00000 n +0000202754 00000 n +0000202258 00000 n +0000198787 00000 n +0000202559 00000 n +0000202624 00000 n +0000202689 00000 n +0000202405 00000 n +0000207907 00000 n +0000206774 00000 n +0000202879 00000 n +0000207842 00000 n +0000206957 00000 n +0000207113 00000 n +0000207298 00000 n +0000207472 00000 n +0000207657 00000 n +0000272195 00000 n +0000212044 00000 n +0000211853 00000 n +0000208099 00000 n +0000211979 00000 n +0000647527 00000 n +0000216023 00000 n +0000215703 00000 n +0000212169 00000 n +0000215829 00000 n +0000215958 00000 n +0000220366 00000 n +0000219377 00000 n +0000216135 00000 n +0000220045 00000 n +0000219542 00000 n +0000220174 00000 n +0000220302 00000 n +0000219711 00000 n +0000219877 00000 n +0000281549 00000 n +0000339663 00000 n +0000224176 00000 n +0000223666 00000 n +0000220532 00000 n +0000223982 00000 n +0000223813 00000 n +0000224111 00000 n +0000227277 00000 n +0000226828 00000 n +0000224301 00000 n +0000226954 00000 n +0000227083 00000 n +0000231338 00000 n +0000231147 00000 n +0000227443 00000 n +0000231273 00000 n +0000234514 00000 n +0000234196 00000 n +0000231450 00000 n +0000234322 00000 n +0000234451 00000 n +0000647652 00000 n +0000238893 00000 n +0000238087 00000 n +0000234667 00000 n +0000238572 00000 n +0000238701 00000 n +0000238243 00000 n +0000238829 00000 n +0000238417 00000 n +0000242395 00000 n +0000241946 00000 n +0000239005 00000 n +0000242072 00000 n +0000242201 00000 n +0000242330 00000 n +0000246294 00000 n +0000245627 00000 n +0000242548 00000 n +0000246100 00000 n +0000246229 00000 n +0000245783 00000 n +0000245945 00000 n +0000249977 00000 n +0000249209 00000 n +0000246460 00000 n +0000249525 00000 n +0000249356 00000 n +0000249718 00000 n +0000249783 00000 n +0000249912 00000 n +0000254452 00000 n +0000253906 00000 n +0000250156 00000 n +0000254387 00000 n +0000254062 00000 n +0000254224 00000 n +0000332778 00000 n +0000258875 00000 n +0000258236 00000 n +0000254618 00000 n +0000258552 00000 n +0000467580 00000 n +0000465583 00000 n +0000467415 00000 n +0000258681 00000 n +0000258383 00000 n +0000258810 00000 n +0000647777 00000 n +0000276479 00000 n +0000261040 00000 n +0000260849 00000 n +0000259001 00000 n +0000260975 00000 n +0000264357 00000 n +0000263907 00000 n +0000261152 00000 n +0000264033 00000 n +0000264227 00000 n +0000264292 00000 n +0000268343 00000 n +0000267895 00000 n +0000264497 00000 n +0000268021 00000 n +0000268278 00000 n +0000272260 00000 n +0000271941 00000 n +0000268455 00000 n +0000272067 00000 n +0000276543 00000 n +0000275466 00000 n +0000272372 00000 n +0000276096 00000 n +0000275631 00000 n +0000275782 00000 n +0000276225 00000 n +0000276353 00000 n +0000275942 00000 n +0000279969 00000 n +0000279650 00000 n +0000276655 00000 n +0000279776 00000 n +0000279905 00000 n +0000647902 00000 n +0000281614 00000 n +0000281294 00000 n +0000280081 00000 n +0000281420 00000 n +0000283072 00000 n +0000282881 00000 n +0000281726 00000 n +0000283007 00000 n +0000285806 00000 n +0000285227 00000 n +0000283171 00000 n +0000285353 00000 n +0000285482 00000 n +0000285611 00000 n +0000285676 00000 n +0000285741 00000 n +0000289729 00000 n +0000289409 00000 n +0000285918 00000 n +0000289535 00000 n +0000289664 00000 n +0000295346 00000 n +0000292952 00000 n +0000289841 00000 n +0000295152 00000 n +0000295281 00000 n +0000293198 00000 n +0000293360 00000 n +0000293522 00000 n +0000293683 00000 n +0000293843 00000 n +0000294014 00000 n +0000294176 00000 n +0000294338 00000 n +0000294500 00000 n +0000294663 00000 n +0000294826 00000 n +0000294989 00000 n +0000300564 00000 n +0000298503 00000 n +0000295471 00000 n +0000300499 00000 n +0000298740 00000 n +0000298902 00000 n +0000299064 00000 n +0000299225 00000 n +0000299386 00000 n +0000299548 00000 n +0000299711 00000 n +0000299865 00000 n +0000300019 00000 n +0000300181 00000 n +0000300341 00000 n +0000648027 00000 n +0000305875 00000 n +0000303902 00000 n +0000300689 00000 n +0000305553 00000 n +0000304121 00000 n +0000304283 00000 n +0000304445 00000 n +0000304606 00000 n +0000304768 00000 n +0000304922 00000 n +0000305083 00000 n +0000305237 00000 n +0000305399 00000 n +0000305747 00000 n +0000305811 00000 n +0000310230 00000 n +0000309163 00000 n +0000306000 00000 n +0000309651 00000 n +0000309779 00000 n +0000310036 00000 n +0000309319 00000 n +0000309489 00000 n +0000310101 00000 n +0000310166 00000 n +0000313678 00000 n +0000313357 00000 n +0000310355 00000 n +0000313483 00000 n +0000313548 00000 n +0000313613 00000 n +0000317604 00000 n +0000317154 00000 n +0000313777 00000 n +0000317280 00000 n +0000317345 00000 n +0000317410 00000 n +0000317539 00000 n +0000321420 00000 n +0000320712 00000 n +0000317729 00000 n +0000320838 00000 n +0000320903 00000 n +0000320968 00000 n +0000321033 00000 n +0000321098 00000 n +0000321226 00000 n +0000321290 00000 n +0000321355 00000 n +0000325261 00000 n +0000324424 00000 n +0000321545 00000 n +0000324550 00000 n +0000324679 00000 n +0000324744 00000 n +0000324809 00000 n +0000324938 00000 n +0000325003 00000 n +0000325068 00000 n +0000325196 00000 n +0000648152 00000 n +0000328502 00000 n +0000327796 00000 n +0000325440 00000 n +0000327922 00000 n +0000328051 00000 n +0000328180 00000 n +0000328309 00000 n +0000328438 00000 n +0000332842 00000 n +0000332393 00000 n +0000328695 00000 n +0000332519 00000 n +0000332584 00000 n +0000332649 00000 n +0000333308 00000 n +0000333117 00000 n +0000332967 00000 n +0000333243 00000 n +0000335248 00000 n +0000334799 00000 n +0000333350 00000 n +0000334925 00000 n +0000335054 00000 n +0000335183 00000 n +0000339728 00000 n +0000338784 00000 n +0000335360 00000 n 0000339147 00000 n -0000339423 00000 n -0000342815 00000 n -0000341589 00000 n -0000339530 00000 n -0000342106 00000 n -0000342235 00000 n -0000342364 00000 n -0000342493 00000 n -0000342622 00000 n -0000342751 00000 n -0000341745 00000 n -0000341917 00000 n -0000343269 00000 n -0000343078 00000 n -0000342928 00000 n -0000343204 00000 n -0000346608 00000 n -0000346030 00000 n -0000343311 00000 n -0000346156 00000 n -0000346285 00000 n -0000346414 00000 n -0000346543 00000 n -0000351840 00000 n -0000349715 00000 n -0000346694 00000 n -0000350226 00000 n -0000350355 00000 n -0000350613 00000 n -0000349871 00000 n -0000350050 00000 n -0000350806 00000 n -0000350871 00000 n -0000350936 00000 n -0000351001 00000 n -0000351066 00000 n -0000351131 00000 n -0000351196 00000 n -0000351261 00000 n -0000351326 00000 n -0000351391 00000 n -0000351456 00000 n -0000351584 00000 n -0000351648 00000 n -0000351712 00000 n -0000351776 00000 n -0000358577 00000 n -0000355009 00000 n -0000351992 00000 n -0000355135 00000 n -0000355200 00000 n -0000355265 00000 n -0000355330 00000 n -0000355395 00000 n -0000355460 00000 n -0000355525 00000 n -0000355590 00000 n -0000355655 00000 n -0000355720 00000 n -0000355785 00000 n -0000355850 00000 n -0000355915 00000 n -0000355980 00000 n -0000356045 00000 n -0000356110 00000 n -0000356175 00000 n -0000356240 00000 n -0000356305 00000 n -0000356370 00000 n -0000356435 00000 n -0000356500 00000 n -0000356565 00000 n -0000356630 00000 n -0000356695 00000 n -0000356760 00000 n -0000356825 00000 n -0000356890 00000 n -0000356955 00000 n -0000357020 00000 n -0000357085 00000 n -0000357150 00000 n -0000357215 00000 n -0000357280 00000 n -0000357345 00000 n -0000357410 00000 n -0000357475 00000 n -0000357540 00000 n -0000357605 00000 n -0000357670 00000 n -0000357734 00000 n -0000357799 00000 n -0000357864 00000 n -0000357929 00000 n -0000357994 00000 n -0000358059 00000 n -0000358124 00000 n -0000358189 00000 n -0000358254 00000 n -0000358319 00000 n -0000358384 00000 n -0000358449 00000 n -0000358513 00000 n -0000644965 00000 n -0000365304 00000 n -0000361609 00000 n -0000358689 00000 n -0000361735 00000 n -0000361800 00000 n -0000361865 00000 n -0000361930 00000 n -0000361995 00000 n -0000362059 00000 n -0000362124 00000 n -0000362189 00000 n -0000362254 00000 n -0000362319 00000 n -0000362384 00000 n -0000362449 00000 n -0000362514 00000 n -0000362579 00000 n -0000362644 00000 n -0000362709 00000 n -0000362774 00000 n -0000362839 00000 n -0000362904 00000 n -0000362969 00000 n -0000363034 00000 n -0000363099 00000 n -0000363164 00000 n -0000363229 00000 n -0000363293 00000 n -0000363358 00000 n -0000363423 00000 n -0000363488 00000 n -0000363553 00000 n -0000363618 00000 n -0000363683 00000 n -0000363748 00000 n -0000363813 00000 n -0000363878 00000 n -0000363943 00000 n -0000364008 00000 n -0000364073 00000 n -0000364138 00000 n -0000364203 00000 n -0000364268 00000 n -0000364333 00000 n -0000364398 00000 n -0000364463 00000 n -0000364528 00000 n -0000364593 00000 n -0000364658 00000 n -0000364723 00000 n -0000364788 00000 n -0000364853 00000 n -0000364918 00000 n -0000364983 00000 n -0000365047 00000 n -0000365112 00000 n -0000365176 00000 n -0000365240 00000 n -0000371853 00000 n -0000368225 00000 n -0000365416 00000 n -0000368351 00000 n -0000368416 00000 n -0000368480 00000 n -0000368544 00000 n -0000368608 00000 n -0000368673 00000 n -0000368738 00000 n -0000368803 00000 n -0000368868 00000 n -0000368933 00000 n -0000368998 00000 n -0000369063 00000 n -0000369128 00000 n -0000369193 00000 n -0000369258 00000 n -0000369323 00000 n -0000369387 00000 n -0000369452 00000 n -0000369516 00000 n -0000369581 00000 n -0000369646 00000 n -0000369711 00000 n -0000369776 00000 n -0000369841 00000 n -0000369906 00000 n -0000369971 00000 n -0000370036 00000 n -0000370101 00000 n -0000370166 00000 n -0000370231 00000 n -0000370296 00000 n -0000370361 00000 n -0000370426 00000 n -0000370491 00000 n -0000370556 00000 n -0000370621 00000 n -0000370686 00000 n -0000370751 00000 n -0000370816 00000 n -0000370881 00000 n -0000370946 00000 n -0000371011 00000 n -0000371076 00000 n -0000371141 00000 n -0000371206 00000 n -0000371270 00000 n -0000371335 00000 n -0000371400 00000 n -0000371465 00000 n -0000371530 00000 n -0000371595 00000 n -0000371660 00000 n -0000371725 00000 n -0000371789 00000 n -0000374971 00000 n -0000373613 00000 n -0000371965 00000 n -0000373739 00000 n -0000373804 00000 n -0000373869 00000 n -0000373934 00000 n -0000373999 00000 n -0000374064 00000 n -0000374129 00000 n -0000374194 00000 n -0000374259 00000 n -0000374323 00000 n -0000374388 00000 n -0000374517 00000 n -0000374646 00000 n -0000374711 00000 n -0000374776 00000 n -0000374841 00000 n -0000374906 00000 n -0000377735 00000 n -0000377091 00000 n -0000375096 00000 n -0000377217 00000 n -0000377346 00000 n -0000377475 00000 n -0000377540 00000 n -0000377605 00000 n -0000377670 00000 n -0000382216 00000 n -0000381895 00000 n -0000377847 00000 n -0000382021 00000 n -0000382086 00000 n -0000382151 00000 n -0000385471 00000 n -0000385215 00000 n -0000382368 00000 n -0000385341 00000 n -0000385406 00000 n -0000645090 00000 n -0000388730 00000 n -0000388539 00000 n -0000385609 00000 n -0000388665 00000 n -0000392510 00000 n -0000392254 00000 n -0000388855 00000 n -0000392380 00000 n -0000392445 00000 n -0000395684 00000 n -0000394909 00000 n -0000392648 00000 n -0000395035 00000 n -0000395100 00000 n -0000395165 00000 n -0000395230 00000 n -0000395295 00000 n -0000395424 00000 n -0000395489 00000 n -0000395554 00000 n -0000395619 00000 n -0000400154 00000 n -0000399963 00000 n -0000395822 00000 n -0000400089 00000 n -0000403335 00000 n -0000402562 00000 n -0000400292 00000 n -0000402688 00000 n -0000402753 00000 n -0000402818 00000 n -0000402882 00000 n -0000403011 00000 n -0000403076 00000 n -0000403140 00000 n -0000403205 00000 n -0000403270 00000 n -0000406754 00000 n -0000406498 00000 n -0000403500 00000 n -0000406624 00000 n -0000406689 00000 n -0000645215 00000 n -0000409599 00000 n -0000408889 00000 n -0000406892 00000 n -0000409015 00000 n -0000409080 00000 n -0000409145 00000 n -0000409210 00000 n -0000409339 00000 n -0000409404 00000 n -0000409469 00000 n -0000409534 00000 n -0000413280 00000 n -0000413024 00000 n -0000409750 00000 n -0000413150 00000 n -0000413215 00000 n -0000416630 00000 n -0000416374 00000 n -0000413405 00000 n -0000416500 00000 n -0000416565 00000 n -0000419240 00000 n -0000418467 00000 n -0000416768 00000 n -0000418593 00000 n -0000418658 00000 n -0000418723 00000 n -0000418851 00000 n -0000418916 00000 n -0000418981 00000 n -0000419046 00000 n -0000419111 00000 n -0000419176 00000 n -0000422081 00000 n -0000421371 00000 n -0000419391 00000 n -0000421497 00000 n -0000421562 00000 n -0000421627 00000 n -0000421756 00000 n -0000421821 00000 n -0000421886 00000 n -0000421951 00000 n -0000422016 00000 n -0000425616 00000 n -0000425425 00000 n -0000422232 00000 n -0000425551 00000 n -0000645340 00000 n -0000428364 00000 n -0000427590 00000 n -0000425741 00000 n -0000427716 00000 n -0000427781 00000 n -0000427846 00000 n -0000427911 00000 n -0000428040 00000 n -0000428104 00000 n -0000428169 00000 n -0000428234 00000 n -0000428299 00000 n -0000431238 00000 n -0000431047 00000 n -0000428515 00000 n -0000431173 00000 n -0000434147 00000 n -0000433697 00000 n -0000431431 00000 n -0000433823 00000 n -0000433888 00000 n -0000433953 00000 n -0000434018 00000 n -0000434083 00000 n -0000437554 00000 n -0000436911 00000 n -0000434379 00000 n -0000437037 00000 n -0000437102 00000 n -0000437231 00000 n -0000437296 00000 n -0000437360 00000 n -0000437424 00000 n -0000437489 00000 n -0000440516 00000 n -0000439806 00000 n -0000437692 00000 n -0000439932 00000 n -0000439997 00000 n -0000440062 00000 n -0000440127 00000 n -0000440256 00000 n -0000440321 00000 n -0000440386 00000 n -0000440451 00000 n -0000443612 00000 n -0000443356 00000 n -0000440680 00000 n -0000443482 00000 n -0000443547 00000 n -0000645465 00000 n -0000446748 00000 n -0000446039 00000 n -0000443737 00000 n -0000446165 00000 n -0000446230 00000 n -0000446295 00000 n -0000446360 00000 n -0000446488 00000 n -0000446553 00000 n -0000446618 00000 n -0000446683 00000 n -0000450339 00000 n -0000450018 00000 n -0000446899 00000 n -0000450144 00000 n -0000450209 00000 n -0000450274 00000 n -0000451317 00000 n -0000450996 00000 n -0000450477 00000 n -0000451122 00000 n -0000451187 00000 n -0000451252 00000 n -0000451462 00000 n -0000462806 00000 n -0000465130 00000 n -0000465099 00000 n -0000474618 00000 n -0000484617 00000 n -0000494846 00000 n -0000507048 00000 n -0000525181 00000 n -0000547269 00000 n -0000567968 00000 n -0000585780 00000 n -0000588610 00000 n -0000588380 00000 n -0000615646 00000 n -0000642623 00000 n -0000645572 00000 n -0000645694 00000 n -0000645820 00000 n -0000645946 00000 n -0000646036 00000 n -0000646128 00000 n -0000661315 00000 n -0000678553 00000 n -0000678594 00000 n -0000678634 00000 n -0000678768 00000 n +0000465262 00000 n +0000456049 00000 n +0000465076 00000 n +0000338931 00000 n +0000339276 00000 n +0000339405 00000 n +0000339534 00000 n +0000340766 00000 n +0000340575 00000 n +0000339961 00000 n +0000340701 00000 n +0000648277 00000 n +0000341193 00000 n +0000341002 00000 n +0000340852 00000 n +0000341128 00000 n +0000344514 00000 n +0000343288 00000 n +0000341235 00000 n +0000343805 00000 n +0000343934 00000 n +0000344063 00000 n +0000344192 00000 n +0000344321 00000 n +0000344450 00000 n +0000343444 00000 n +0000343616 00000 n +0000344968 00000 n +0000344777 00000 n +0000344627 00000 n +0000344903 00000 n +0000348212 00000 n +0000347634 00000 n +0000345010 00000 n +0000347760 00000 n +0000347889 00000 n +0000348018 00000 n +0000348147 00000 n +0000352491 00000 n +0000351272 00000 n +0000348298 00000 n +0000351783 00000 n +0000351912 00000 n +0000352170 00000 n +0000351428 00000 n +0000351607 00000 n +0000352363 00000 n +0000352427 00000 n +0000359377 00000 n +0000355549 00000 n +0000352643 00000 n +0000355675 00000 n +0000355740 00000 n +0000355805 00000 n +0000355870 00000 n +0000355935 00000 n +0000356000 00000 n +0000356065 00000 n +0000356130 00000 n +0000356195 00000 n +0000356260 00000 n +0000356390 00000 n +0000356455 00000 n +0000356520 00000 n +0000356585 00000 n +0000356650 00000 n +0000356715 00000 n +0000356780 00000 n +0000356845 00000 n +0000356910 00000 n +0000356975 00000 n +0000357040 00000 n +0000357105 00000 n +0000357170 00000 n +0000357235 00000 n +0000357300 00000 n +0000357365 00000 n +0000357430 00000 n +0000357495 00000 n +0000357560 00000 n +0000357625 00000 n +0000357690 00000 n +0000357755 00000 n +0000357820 00000 n +0000357885 00000 n +0000357949 00000 n +0000358014 00000 n +0000358079 00000 n +0000358144 00000 n +0000358209 00000 n +0000358274 00000 n +0000358339 00000 n +0000358404 00000 n +0000358469 00000 n +0000358534 00000 n +0000358599 00000 n +0000358664 00000 n +0000358729 00000 n +0000358794 00000 n +0000358859 00000 n +0000358924 00000 n +0000358989 00000 n +0000359054 00000 n +0000359119 00000 n +0000359184 00000 n +0000359249 00000 n +0000359313 00000 n +0000648402 00000 n +0000366023 00000 n +0000362459 00000 n +0000359489 00000 n +0000362585 00000 n +0000362650 00000 n +0000362715 00000 n +0000362780 00000 n +0000362845 00000 n +0000362910 00000 n +0000362975 00000 n +0000363040 00000 n +0000363105 00000 n +0000363170 00000 n +0000363235 00000 n +0000363300 00000 n +0000363364 00000 n +0000363429 00000 n +0000363494 00000 n +0000363559 00000 n +0000363624 00000 n +0000363689 00000 n +0000363754 00000 n +0000363819 00000 n +0000363884 00000 n +0000363949 00000 n +0000364014 00000 n +0000364079 00000 n +0000364143 00000 n +0000364208 00000 n +0000364273 00000 n +0000364338 00000 n +0000364403 00000 n +0000364468 00000 n +0000364533 00000 n +0000364598 00000 n +0000364663 00000 n +0000364728 00000 n +0000364793 00000 n +0000364858 00000 n +0000364923 00000 n +0000364988 00000 n +0000365053 00000 n +0000365118 00000 n +0000365182 00000 n +0000365246 00000 n +0000365310 00000 n +0000365375 00000 n +0000365440 00000 n +0000365505 00000 n +0000365570 00000 n +0000365635 00000 n +0000365700 00000 n +0000365765 00000 n +0000365830 00000 n +0000365895 00000 n +0000365959 00000 n +0000372289 00000 n +0000368791 00000 n +0000366135 00000 n +0000368917 00000 n +0000368982 00000 n +0000369047 00000 n +0000369112 00000 n +0000369177 00000 n +0000369242 00000 n +0000369307 00000 n +0000369372 00000 n +0000369435 00000 n +0000369498 00000 n +0000369563 00000 n +0000369628 00000 n +0000369693 00000 n +0000369758 00000 n +0000369823 00000 n +0000369888 00000 n +0000369953 00000 n +0000370018 00000 n +0000370083 00000 n +0000370148 00000 n +0000370212 00000 n +0000370277 00000 n +0000370342 00000 n +0000370407 00000 n +0000370472 00000 n +0000370537 00000 n +0000370602 00000 n +0000370667 00000 n +0000370732 00000 n +0000370797 00000 n +0000370862 00000 n +0000370927 00000 n +0000370992 00000 n +0000371056 00000 n +0000371121 00000 n +0000371186 00000 n +0000371251 00000 n +0000371316 00000 n +0000371381 00000 n +0000371446 00000 n +0000371511 00000 n +0000371576 00000 n +0000371641 00000 n +0000371706 00000 n +0000371771 00000 n +0000371836 00000 n +0000371901 00000 n +0000371966 00000 n +0000372031 00000 n +0000372096 00000 n +0000372161 00000 n +0000372225 00000 n +0000376868 00000 n +0000374604 00000 n +0000372401 00000 n +0000374730 00000 n +0000374795 00000 n +0000374860 00000 n +0000374925 00000 n +0000374990 00000 n +0000375055 00000 n +0000375120 00000 n +0000375185 00000 n +0000375250 00000 n +0000375315 00000 n +0000375380 00000 n +0000375445 00000 n +0000375510 00000 n +0000375575 00000 n +0000375637 00000 n +0000375701 00000 n +0000375766 00000 n +0000375830 00000 n +0000375895 00000 n +0000375960 00000 n +0000376025 00000 n +0000376090 00000 n +0000376155 00000 n +0000376220 00000 n +0000376285 00000 n +0000376414 00000 n +0000376543 00000 n +0000376608 00000 n +0000376673 00000 n +0000376738 00000 n +0000376803 00000 n +0000379635 00000 n +0000378991 00000 n +0000376993 00000 n +0000379117 00000 n +0000379246 00000 n +0000379375 00000 n +0000379440 00000 n +0000379505 00000 n +0000379570 00000 n +0000384120 00000 n +0000383799 00000 n +0000379747 00000 n +0000383925 00000 n +0000383990 00000 n +0000384055 00000 n +0000387371 00000 n +0000387115 00000 n +0000384272 00000 n +0000387241 00000 n +0000387306 00000 n +0000648527 00000 n +0000390621 00000 n +0000390430 00000 n +0000387509 00000 n +0000390556 00000 n +0000394401 00000 n +0000394145 00000 n +0000390746 00000 n +0000394271 00000 n +0000394336 00000 n +0000397575 00000 n +0000396800 00000 n +0000394539 00000 n +0000396926 00000 n +0000396991 00000 n +0000397056 00000 n +0000397121 00000 n +0000397186 00000 n +0000397315 00000 n +0000397380 00000 n +0000397445 00000 n +0000397510 00000 n +0000402046 00000 n +0000401855 00000 n +0000397713 00000 n +0000401981 00000 n +0000405174 00000 n +0000404401 00000 n +0000402184 00000 n +0000404527 00000 n +0000404592 00000 n +0000404657 00000 n +0000404721 00000 n +0000404850 00000 n +0000404915 00000 n +0000404979 00000 n +0000405044 00000 n +0000405109 00000 n +0000408564 00000 n +0000408308 00000 n +0000405312 00000 n +0000408434 00000 n +0000408499 00000 n +0000648652 00000 n +0000411424 00000 n +0000410714 00000 n +0000408702 00000 n +0000410840 00000 n +0000410905 00000 n +0000410970 00000 n +0000411035 00000 n +0000411164 00000 n +0000411229 00000 n +0000411294 00000 n +0000411359 00000 n +0000415103 00000 n +0000414847 00000 n +0000411575 00000 n +0000414973 00000 n +0000415038 00000 n +0000418540 00000 n +0000418284 00000 n +0000415228 00000 n +0000418410 00000 n +0000418475 00000 n +0000421011 00000 n +0000420303 00000 n +0000418678 00000 n +0000420429 00000 n +0000420494 00000 n +0000420559 00000 n +0000420686 00000 n +0000420751 00000 n +0000420816 00000 n +0000420881 00000 n +0000420946 00000 n +0000423897 00000 n +0000423123 00000 n +0000421162 00000 n +0000423249 00000 n +0000423314 00000 n +0000423379 00000 n +0000423444 00000 n +0000423572 00000 n +0000423637 00000 n +0000423702 00000 n +0000423767 00000 n +0000423832 00000 n +0000427253 00000 n +0000427062 00000 n +0000424035 00000 n +0000427188 00000 n +0000648777 00000 n +0000430206 00000 n +0000429496 00000 n +0000427378 00000 n +0000429622 00000 n +0000429687 00000 n +0000429752 00000 n +0000429817 00000 n +0000429946 00000 n +0000430011 00000 n +0000430076 00000 n +0000430141 00000 n +0000433505 00000 n +0000433249 00000 n +0000430357 00000 n +0000433375 00000 n +0000433440 00000 n +0000436389 00000 n +0000436005 00000 n +0000433698 00000 n +0000436131 00000 n +0000436196 00000 n +0000436261 00000 n +0000436325 00000 n +0000439867 00000 n +0000439157 00000 n +0000436621 00000 n +0000439283 00000 n +0000439348 00000 n +0000439413 00000 n +0000439542 00000 n +0000439607 00000 n +0000439672 00000 n +0000439737 00000 n +0000439802 00000 n +0000443002 00000 n +0000442293 00000 n +0000440018 00000 n +0000442419 00000 n +0000442484 00000 n +0000442549 00000 n +0000442613 00000 n +0000442742 00000 n +0000442807 00000 n +0000442872 00000 n +0000442937 00000 n +0000446185 00000 n +0000445929 00000 n +0000443166 00000 n +0000446055 00000 n +0000446120 00000 n +0000648902 00000 n +0000448931 00000 n +0000448288 00000 n +0000446310 00000 n +0000448414 00000 n +0000448479 00000 n +0000448544 00000 n +0000448609 00000 n +0000448737 00000 n +0000448802 00000 n +0000448867 00000 n +0000452664 00000 n +0000452344 00000 n +0000449082 00000 n +0000452470 00000 n +0000452535 00000 n +0000452600 00000 n +0000453989 00000 n +0000453603 00000 n +0000452789 00000 n +0000453729 00000 n +0000453794 00000 n +0000453859 00000 n +0000453924 00000 n +0000454160 00000 n +0000465504 00000 n +0000467827 00000 n +0000467796 00000 n +0000477316 00000 n +0000487372 00000 n +0000497610 00000 n +0000509812 00000 n +0000527945 00000 n +0000550033 00000 n +0000571043 00000 n +0000588861 00000 n +0000591692 00000 n +0000591462 00000 n +0000618950 00000 n +0000646059 00000 n +0000649009 00000 n +0000649132 00000 n +0000649258 00000 n +0000649384 00000 n +0000649474 00000 n +0000649566 00000 n +0000664857 00000 n +0000682144 00000 n +0000682185 00000 n +0000682225 00000 n +0000682359 00000 n trailer << -/Size 1942 -/Root 1940 0 R -/Info 1941 0 R -/ID [<C16C2A8590B8858C2F91556A1B642356> <C16C2A8590B8858C2F91556A1B642356>] +/Size 1949 +/Root 1947 0 R +/Info 1948 0 R +/ID [<29C33ACC9F6B4BF3B2F79BA1BECE5209> <29C33ACC9F6B4BF3B2F79BA1BECE5209>] >> startxref -679032 +682623 %%EOF diff --git a/doc/arm/man.dig.html b/doc/arm/man.dig.html index 942b7feb..844a92be 100644 --- a/doc/arm/man.dig.html +++ b/doc/arm/man.dig.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: man.dig.html,v 1.2.2.37 2007/01/30 00:23:46 marka Exp $ --> +<!-- $Id: man.dig.html,v 1.2.2.45 2007/07/09 06:51:14 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -52,7 +52,7 @@ <div class="cmdsynopsis"><p><code class="command">dig</code> [global-queryopt...] [query...]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2564009"></a><h2>DESCRIPTION</h2> +<a name="id2563963"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">dig</strong></span> (domain information groper) is a flexible tool for interrogating DNS name servers. It performs DNS lookups and @@ -68,7 +68,7 @@ arguments, it also has a batch mode of operation for reading lookup requests from a file. A brief summary of its command-line arguments and options is printed when the <code class="option">-h</code> option is given. - Unlike earlier versions, the BIND9 implementation of + Unlike earlier versions, the BIND 9 implementation of <span><strong class="command">dig</strong></span> allows multiple lookups to be issued from the command line. @@ -98,7 +98,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2572153"></a><h2>SIMPLE USAGE</h2> +<a name="id2569650"></a><h2>SIMPLE USAGE</h2> <p> A typical invocation of <span><strong class="command">dig</strong></span> looks like: </p> @@ -144,7 +144,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2572264"></a><h2>OPTIONS</h2> +<a name="id2569829"></a><h2>OPTIONS</h2> <p> The <code class="option">-b</code> option sets the source IP address of the query to <em class="parameter"><code>address</code></em>. This must be a valid @@ -157,7 +157,7 @@ The default query class (IN for internet) is overridden by the <code class="option">-c</code> option. <em class="parameter"><code>class</code></em> is any valid - class, such as HS for Hesiod records or CH for CHAOSNET records. + class, such as HS for Hesiod records or CH for Chaosnet records. </p> <p> The <code class="option">-f</code> option makes <span><strong class="command">dig </strong></span> @@ -165,7 +165,7 @@ in batch mode by reading a list of lookup requests to process from the file <em class="parameter"><code>filename</code></em>. The file contains a number of - queries, one per line. Each entry in the file should be organised in + queries, one per line. Each entry in the file should be organized in the same way they would be presented as queries to <span><strong class="command">dig</strong></span> using the command-line interface. </p> @@ -188,7 +188,7 @@ The <code class="option">-t</code> option sets the query type to <em class="parameter"><code>type</code></em>. It can be any valid query type which is - supported in BIND9. The default query type "A", unless the + supported in BIND 9. The default query type is "A", unless the <code class="option">-x</code> option is supplied to indicate a reverse lookup. A zone transfer can be requested by specifying a type of AXFR. When an incremental zone transfer (IXFR) is required, @@ -199,11 +199,11 @@ </p> <p> The <code class="option">-q</code> option sets the query name to - <em class="parameter"><code>name</code></em>. This useful do distingish the + <em class="parameter"><code>name</code></em>. This useful do distinguish the <em class="parameter"><code>name</code></em> from other arguments. </p> <p> - Reverse lookups - mapping addresses to names - are simplified by the + Reverse lookups — mapping addresses to names — are simplified by the <code class="option">-x</code> option. <em class="parameter"><code>addr</code></em> is an IPv4 address in dotted-decimal notation, or a colon-delimited IPv6 address. @@ -244,7 +244,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2649124"></a><h2>QUERY OPTIONS</h2> +<a name="id2649419"></a><h2>QUERY OPTIONS</h2> <p><span><strong class="command">dig</strong></span> provides a number of query options which affect the way in which lookups are made and the results displayed. Some of @@ -267,7 +267,7 @@ <dt><span class="term"><code class="option">+[no]tcp</code></span></dt> <dd><p> Use [do not use] TCP when querying name servers. The default - behaviour is to use UDP unless an AXFR or IXFR query is + behavior is to use UDP unless an AXFR or IXFR query is requested, in which case a TCP connection is used. </p></dd> @@ -380,7 +380,7 @@ </p></dd> <dt><span class="term"><code class="option">+[no]cmd</code></span></dt> <dd><p> - toggles the printing of the initial comment in the output + Toggles the printing of the initial comment in the output identifying the version of <span><strong class="command">dig</strong></span> and the query options that have @@ -412,7 +412,7 @@ This query option toggles the printing of statistics: when the query was made, the size of the reply and so on. The default - behaviour is + behavior is to print the query statistics. </p></dd> <dt><span class="term"><code class="option">+[no]qr</code></span></dt> @@ -451,8 +451,8 @@ <dd><p> Sets the timeout for a query to - <em class="parameter"><code>T</code></em> seconds. The default time - out is 5 seconds. + <em class="parameter"><code>T</code></em> seconds. The default + timeout is 5 seconds. An attempt to set <em class="parameter"><code>T</code></em> to less than 1 will result in a query timeout of 1 second being applied. @@ -517,7 +517,7 @@ default is to not try the next server which is the reverse of normal stub resolver - behaviour. + behavior. </p></dd> <dt><span class="term"><code class="option">+[no]besteffort</code></span></dt> <dd><p> @@ -553,7 +553,7 @@ </dd> <dt><span class="term"><code class="option">+[no]topdown</code></span></dt> <dd><p> - When chasing DNSSEC signature chains perform a top down + When chasing DNSSEC signature chains perform a top-down validation. Requires dig be compiled with -DDIG_SIGCHASE. </p></dd> @@ -563,7 +563,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2650042"></a><h2>MULTIPLE QUERIES</h2> +<a name="id2650474"></a><h2>MULTIPLE QUERIES</h2> <p> The BIND 9 implementation of <span><strong class="command">dig </strong></span> supports @@ -609,7 +609,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr </p> </div> <div class="refsect1" lang="en"> -<a name="id2650196"></a><h2>IDN SUPPORT</h2> +<a name="id2650560"></a><h2>IDN SUPPORT</h2> <p> If <span><strong class="command">dig</strong></span> has been built with IDN (internationalized domain name) support, it can accept and display non-ASCII domain names. @@ -623,14 +623,14 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr </p> </div> <div class="refsect1" lang="en"> -<a name="id2650225"></a><h2>FILES</h2> +<a name="id2650588"></a><h2>FILES</h2> <p><code class="filename">/etc/resolv.conf</code> </p> <p><code class="filename">${HOME}/.digrc</code> </p> </div> <div class="refsect1" lang="en"> -<a name="id2650246"></a><h2>SEE ALSO</h2> +<a name="id2650610"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">host</span>(1)</span>, <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>, @@ -638,7 +638,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr </p> </div> <div class="refsect1" lang="en"> -<a name="id2650352"></a><h2>BUGS</h2> +<a name="id2650647"></a><h2>BUGS</h2> <p> There are probably too many query options. </p> diff --git a/doc/arm/man.dnssec-keygen.html b/doc/arm/man.dnssec-keygen.html index 4836f044..4e98186d 100644 --- a/doc/arm/man.dnssec-keygen.html +++ b/doc/arm/man.dnssec-keygen.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: man.dnssec-keygen.html,v 1.2.2.37 2007/01/30 00:23:46 marka Exp $ --> +<!-- $Id: man.dnssec-keygen.html,v 1.2.2.44 2007/07/09 06:51:14 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -50,15 +50,15 @@ <div class="cmdsynopsis"><p><code class="command">dnssec-keygen</code> {-a <em class="replaceable"><code>algorithm</code></em>} {-b <em class="replaceable"><code>keysize</code></em>} {-n <em class="replaceable"><code>nametype</code></em>} [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-e</code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-g <em class="replaceable"><code>generator</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k</code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {name}</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2597473"></a><h2>DESCRIPTION</h2> +<a name="id2597836"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">dnssec-keygen</strong></span> generates keys for DNSSEC (Secure DNS), as defined in RFC 2535 - and RFC <TBA\>. It can also generate keys for use with + and RFC 4034. It can also generate keys for use with TSIG (Transaction Signatures), as defined in RFC 2845. </p> </div> <div class="refsect1" lang="en"> -<a name="id2597555"></a><h2>OPTIONS</h2> +<a name="id2597850"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt> <dd> @@ -166,7 +166,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2597966"></a><h2>GENERATED KEYS</h2> +<a name="id2598194"></a><h2>GENERATED KEYS</h2> <p> When <span><strong class="command">dnssec-keygen</strong></span> completes successfully, @@ -186,7 +186,7 @@ </p></li> </ul></div> <p><span><strong class="command">dnssec-keygen</strong></span> - creates two file, with names based + creates two files, with names based on the printed string. <code class="filename">Knnnn.+aaa+iiiii.key</code> contains the public key, and <code class="filename">Knnnn.+aaa+iiiii.private</code> contains the @@ -200,19 +200,19 @@ statement). </p> <p> - The <code class="filename">.private</code> file contains algorithm - specific + The <code class="filename">.private</code> file contains + algorithm-specific fields. For obvious security reasons, this file does not have general read permission. </p> <p> Both <code class="filename">.key</code> and <code class="filename">.private</code> - files are generated for symmetric encryption algorithm such as + files are generated for symmetric encryption algorithms such as HMAC-MD5, even though the public and private key are equivalent. </p> </div> <div class="refsect1" lang="en"> -<a name="id2598074"></a><h2>EXAMPLE</h2> +<a name="id2598301"></a><h2>EXAMPLE</h2> <p> To generate a 768-bit DSA key for the domain <strong class="userinput"><code>example.com</code></strong>, the following command would be @@ -229,11 +229,11 @@ In this example, <span><strong class="command">dnssec-keygen</strong></span> creates the files <code class="filename">Kexample.com.+003+26160.key</code> and - <code class="filename">Kexample.com.+003+26160.private</code> + <code class="filename">Kexample.com.+003+26160.private</code>. </p> </div> <div class="refsect1" lang="en"> -<a name="id2598131"></a><h2>SEE ALSO</h2> +<a name="id2598358"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>, <em class="citetitle">BIND 9 Administrator Reference Manual</em>, <em class="citetitle">RFC 2535</em>, @@ -242,7 +242,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2600824"></a><h2>AUTHOR</h2> +<a name="id2600300"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/doc/arm/man.dnssec-signzone.html b/doc/arm/man.dnssec-signzone.html index 84a79791..b1159240 100644 --- a/doc/arm/man.dnssec-signzone.html +++ b/doc/arm/man.dnssec-signzone.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: man.dnssec-signzone.html,v 1.2.2.35 2007/01/30 00:23:46 marka Exp $ --> +<!-- $Id: man.dnssec-signzone.html,v 1.2.2.43 2007/07/09 06:51:14 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -50,7 +50,7 @@ <div class="cmdsynopsis"><p><code class="command">dnssec-signzone</code> [<code class="option">-a</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>] [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>] [<code class="option">-g</code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>key</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-j <em class="replaceable"><code>jitter</code></em></code>] [<code class="option">-N <em class="replaceable"><code>soa-serial-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>] [<code class="option">-p</code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-t</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-z</code>] {zonefile} [key...]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2598526"></a><h2>DESCRIPTION</h2> +<a name="id2598761"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">dnssec-signzone</strong></span> signs a zone. It generates NSEC and RRSIG records and produces a signed version of the @@ -61,7 +61,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2598546"></a><h2>OPTIONS</h2> +<a name="id2598780"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-a</span></dt> <dd><p> @@ -117,7 +117,7 @@ The name of the output file containing the signed zone. The default is to append <code class="filename">.signed</code> to the - input file. + input filename. </p></dd> <dt><span class="term">-h</span></dt> <dd><p> @@ -127,7 +127,7 @@ <dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt> <dd> <p> - When a previously signed zone is passed as input, records + When a previously-signed zone is passed as input, records may be resigned. The <code class="option">interval</code> option specifies the cycle interval as an offset from the current time (in seconds). If a RRSIG record expires after the @@ -163,8 +163,8 @@ When signing a zone with a fixed signature lifetime, all RRSIG records issued at the time of signing expires simultaneously. If the zone is incrementally signed, i.e. - a previously signed zone is passed as input to the signer, - all expired signatures has to be regenerated at about the + a previously-signed zone is passed as input to the signer, + all expired signatures have to be regenerated at about the same time. The <code class="option">jitter</code> option specifies a jitter window that will be used to randomize the signature expire time, thus spreading incremental signature @@ -250,47 +250,52 @@ </p></dd> <dt><span class="term">key</span></dt> <dd><p> - The keys used to sign the zone. If no keys are specified, the - default all zone keys that have private key files in the - current directory. + Specify which keys should be used to sign the zone. If + no keys are specified, then the zone will be examined + for DNSKEY records at the zone apex. If these are found and + there are matching private keys, in the current directory, + then these will be used for signing. </p></dd> </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2623261"></a><h2>EXAMPLE</h2> +<a name="id2641314"></a><h2>EXAMPLE</h2> <p> The following command signs the <strong class="userinput"><code>example.com</code></strong> - zone with the DSA key generated in the <span><strong class="command">dnssec-keygen</strong></span> - man page. The zone's keys must be in the zone. If there are - <code class="filename">keyset</code> files associated with child - zones, - they must be in the current directory. - <strong class="userinput"><code>example.com</code></strong>, the following command would be - issued: - </p> -<p><strong class="userinput"><code>dnssec-signzone -o example.com db.example.com - Kexample.com.+003+26160</code></strong> - </p> -<p> - The command would print a string of the form: + zone with the DSA key generated by <span><strong class="command">dnssec-keygen</strong></span> + (Kexample.com.+003+17247). The zone's keys must be in the master + file (<code class="filename">db.example.com</code>). This invocation looks + for <code class="filename">keyset</code> files, in the current directory, + so that DS records can be generated from them (<span><strong class="command">-g</strong></span>). </p> +<pre class="programlisting">% dnssec-signzone -g -o example.com db.example.com \ +Kexample.com.+003+17247 +db.example.com.signed +%</pre> <p> - In this example, <span><strong class="command">dnssec-signzone</strong></span> creates + In the above example, <span><strong class="command">dnssec-signzone</strong></span> creates the file <code class="filename">db.example.com.signed</code>. This - file - should be referenced in a zone statement in a + file should be referenced in a zone statement in a <code class="filename">named.conf</code> file. </p> +<p> + This example re-signs a previously signed zone with default parameters. + The private keys are assumed to be in the current directory. + </p> +<pre class="programlisting">% cp db.example.com.signed db.example.com +% dnssec-signzone -o example.com db.example.com +db.example.com.signed +%</pre> </div> <div class="refsect1" lang="en"> -<a name="id2641212"></a><h2>SEE ALSO</h2> +<a name="id2641454"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>, <em class="citetitle">BIND 9 Administrator Reference Manual</em>, <em class="citetitle">RFC 2535</em>. </p> </div> <div class="refsect1" lang="en"> -<a name="id2652706"></a><h2>AUTHOR</h2> +<a name="id2641479"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/doc/arm/man.host.html b/doc/arm/man.host.html index 4d3e6f33..f0796fb1 100644 --- a/doc/arm/man.host.html +++ b/doc/arm/man.host.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: man.host.html,v 1.2.2.36 2007/01/30 00:23:46 marka Exp $ --> +<!-- $Id: man.host.html,v 1.2.2.43 2007/07/09 06:51:14 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -50,7 +50,7 @@ <div class="cmdsynopsis"><p><code class="command">host</code> [<code class="option">-aCdlnrsTwv</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-N <em class="replaceable"><code>ndots</code></em></code>] [<code class="option">-R <em class="replaceable"><code>number</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-W <em class="replaceable"><code>wait</code></em></code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-4</code>] [<code class="option">-6</code>] {name} [server]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2596643"></a><h2>DESCRIPTION</h2> +<a name="id2597006"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">host</strong></span> is a simple utility for performing DNS lookups. It is normally used to convert names to IP addresses and vice versa. @@ -143,7 +143,7 @@ attempt to resolve <em class="parameter"><code>name</code></em>. The <code class="option">-r</code> option enables <span><strong class="command">host</strong></span> to mimic - the behaviour of a name server by making non-recursive queries and + the behavior of a name server by making non-recursive queries and expecting to receive answers to those queries that are usually referrals to other name servers. </p> @@ -161,7 +161,7 @@ </p> <p> The <code class="option">-t</code> option is used to select the query type. - <em class="parameter"><code>type</code></em> can be any recognised query + <em class="parameter"><code>type</code></em> can be any recognized query type: CNAME, NS, SOA, SIG, KEY, AXFR, etc. When no query type is specified, <span><strong class="command">host</strong></span> automatically selects an appropriate @@ -192,7 +192,7 @@ The <code class="option">-s</code> option tells <span><strong class="command">host</strong></span> <span class="emphasis"><em>not</em></span> to send the query to the next nameserver if any server responds with a SERVFAIL response, which is the - reverse of normal stub resolver behaviour. + reverse of normal stub resolver behavior. </p> <p> The <code class="option">-m</code> can be used to set the memory usage debugging @@ -202,7 +202,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2597157"></a><h2>IDN SUPPORT</h2> +<a name="id2597521"></a><h2>IDN SUPPORT</h2> <p> If <span><strong class="command">host</strong></span> has been built with IDN (internationalized domain name) support, it can accept and display non-ASCII domain names. @@ -216,12 +216,12 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2597186"></a><h2>FILES</h2> +<a name="id2597549"></a><h2>FILES</h2> <p><code class="filename">/etc/resolv.conf</code> </p> </div> <div class="refsect1" lang="en"> -<a name="id2597200"></a><h2>SEE ALSO</h2> +<a name="id2597563"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>, <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>. </p> diff --git a/doc/arm/man.named-checkconf.html b/doc/arm/man.named-checkconf.html index d71bb2e6..376bce92 100644 --- a/doc/arm/man.named-checkconf.html +++ b/doc/arm/man.named-checkconf.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: man.named-checkconf.html,v 1.2.2.38 2007/01/30 00:23:46 marka Exp $ --> +<!-- $Id: man.named-checkconf.html,v 1.2.2.46 2007/07/09 06:51:14 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -50,18 +50,18 @@ <div class="cmdsynopsis"><p><code class="command">named-checkconf</code> [<code class="option">-v</code>] [<code class="option">-j</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] {filename} [<code class="option">-z</code>]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2600049"></a><h2>DESCRIPTION</h2> +<a name="id2599610"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">named-checkconf</strong></span> checks the syntax, but not the semantics, of a named configuration file. </p> </div> <div class="refsect1" lang="en"> -<a name="id2600062"></a><h2>OPTIONS</h2> +<a name="id2599624"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt> <dd><p> - chroot to <code class="filename">directory</code> so that + Chroot to <code class="filename">directory</code> so that include directives in the configuration file are processed as if run by a similarly chrooted named. @@ -73,8 +73,8 @@ </p></dd> <dt><span class="term">-z</span></dt> <dd><p> - Perform a check load the master zonefiles found in - <code class="filename">named.conf</code>. + Perform a test load of all master zones found in + <code class="filename">named.conf</code>. </p></dd> <dt><span class="term">-j</span></dt> <dd><p> @@ -88,20 +88,21 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2600164"></a><h2>RETURN VALUES</h2> +<a name="id2599726"></a><h2>RETURN VALUES</h2> <p><span><strong class="command">named-checkconf</strong></span> returns an exit status of 1 if errors were detected and 0 otherwise. </p> </div> <div class="refsect1" lang="en"> -<a name="id2600178"></a><h2>SEE ALSO</h2> +<a name="id2599740"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, + <span class="citerefentry"><span class="refentrytitle">named-checkzone</span>(8)</span>, <em class="citetitle">BIND 9 Administrator Reference Manual</em>. </p> </div> <div class="refsect1" lang="en"> -<a name="id2600199"></a><h2>AUTHOR</h2> +<a name="id2599770"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/doc/arm/man.named-checkzone.html b/doc/arm/man.named-checkzone.html index 5f0b0669..b0a9425c 100644 --- a/doc/arm/man.named-checkzone.html +++ b/doc/arm/man.named-checkzone.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: man.named-checkzone.html,v 1.2.2.40 2007/01/30 00:23:46 marka Exp $ --> +<!-- $Id: man.named-checkzone.html,v 1.2.2.49 2007/07/09 06:51:14 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -51,7 +51,7 @@ <div class="cmdsynopsis"><p><code class="command">named-compilezone</code> [<code class="option">-d</code>] [<code class="option">-j</code>] [<code class="option">-q</code>] [<code class="option">-v</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-C <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-f <em class="replaceable"><code>format</code></em></code>] [<code class="option">-F <em class="replaceable"><code>format</code></em></code>] [<code class="option">-i <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-k <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-m <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-n <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-o <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-s <em class="replaceable"><code>style</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-w <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-W <em class="replaceable"><code>mode</code></em></code>] {zonename} {filename}</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2602354"></a><h2>DESCRIPTION</h2> +<a name="id2601787"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">named-checkzone</strong></span> checks the syntax and integrity of a zone file. It performs the same checks as <span><strong class="command">named</strong></span> does when loading a @@ -65,13 +65,13 @@ Additionally, it applies stricter check levels by default, since the dump output will be used as an actual zone file loaded by <span><strong class="command">named</strong></span>. - When manaully specified otherwise, the check levels must at + When manually specified otherwise, the check levels must at least be as strict as those specified in the <span><strong class="command">named</strong></span> configuration file. </p> </div> <div class="refsect1" lang="en"> -<a name="id2602404"></a><h2>OPTIONS</h2> +<a name="id2601837"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-d</span></dt> <dd><p> @@ -97,7 +97,7 @@ <dt><span class="term">-i <em class="replaceable"><code>mode</code></em></span></dt> <dd> <p> - Perform post load zone integrity checks. Possible modes are + Perform post-load zone integrity checks. Possible modes are <span><strong class="command">"full"</strong></span> (default), <span><strong class="command">"full-sibling"</strong></span>, <span><strong class="command">"local"</strong></span>, @@ -119,7 +119,7 @@ <p> Mode <span><strong class="command">"full"</strong></span> checks that delegation NS records refer to A or AAAA record (both in-zone and out-of-zone - hostnames). It also checks that glue addresses records + hostnames). It also checks that glue address records in the zone match those advertised by the child. Mode <span><strong class="command">"local"</strong></span> only checks NS records which refer to in-zone hostnames or that some required glue exists, @@ -213,7 +213,7 @@ </p></dd> <dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt> <dd><p> - chroot to <code class="filename">directory</code> so that + Chroot to <code class="filename">directory</code> so that include directives in the configuration file are processed as if run by a similarly chrooted named. @@ -251,21 +251,22 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2654862"></a><h2>RETURN VALUES</h2> +<a name="id2655184"></a><h2>RETURN VALUES</h2> <p><span><strong class="command">named-checkzone</strong></span> returns an exit status of 1 if errors were detected and 0 otherwise. </p> </div> <div class="refsect1" lang="en"> -<a name="id2654876"></a><h2>SEE ALSO</h2> +<a name="id2655197"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, + <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>, <em class="citetitle">RFC 1035</em>, <em class="citetitle">BIND 9 Administrator Reference Manual</em>. </p> </div> <div class="refsect1" lang="en"> -<a name="id2654901"></a><h2>AUTHOR</h2> +<a name="id2655230"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/doc/arm/man.named.html b/doc/arm/man.named.html index 4b446404..80194ae7 100644 --- a/doc/arm/man.named.html +++ b/doc/arm/man.named.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: man.named.html,v 1.2.2.43 2007/02/02 04:33:09 marka Exp $ --> +<!-- $Id: man.named.html,v 1.2.2.50 2007/07/09 06:51:14 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -47,10 +47,10 @@ </div> <div class="refsynopsisdiv"> <h2>Synopsis</h2> -<div class="cmdsynopsis"><p><code class="command">named</code> [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div> +<div class="cmdsynopsis"><p><code class="command">named</code> [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2602900"></a><h2>DESCRIPTION</h2> +<a name="id2602555"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">named</strong></span> is a Domain Name System (DNS) server, part of the BIND 9 distribution from ISC. For more @@ -65,7 +65,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2602931"></a><h2>OPTIONS</h2> +<a name="id2602586"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-4</span></dt> <dd><p> @@ -106,6 +106,17 @@ Run the server in the foreground and force all logging to <code class="filename">stderr</code>. </p></dd> +<dt><span class="term">-m <em class="replaceable"><code>flag</code></em></span></dt> +<dd><p> + Turn on memory usage debugging flags. Possible flags are + <em class="replaceable"><code>usage</code></em>, + <em class="replaceable"><code>trace</code></em>, + <em class="replaceable"><code>record</code></em>, + <em class="replaceable"><code>size</code></em>, and + <em class="replaceable"><code>mctx</code></em>. + These correspond to the ISC_MEM_DEBUGXXXX flags described in + <code class="filename"><isc/mem.h></code>. + </p></dd> <dt><span class="term">-n <em class="replaceable"><code>#cpus</code></em></span></dt> <dd><p> Create <em class="replaceable"><code>#cpus</code></em> worker threads @@ -135,7 +146,7 @@ </dd> <dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt> <dd> -<p><code class="function">chroot()</code> +<p>Chroot to <em class="replaceable"><code>directory</code></em> after processing the command line arguments, but before reading the configuration file. @@ -146,7 +157,7 @@ This option should be used in conjunction with the <code class="option">-u</code> option, as chrooting a process running as root doesn't enhance security on most - systems; the way <code class="function">chroot()</code> is + systems; the way <code class="function">chroot(2)</code> is defined allows a process with root privileges to escape a chroot jail. </p> @@ -154,7 +165,7 @@ </dd> <dt><span class="term">-u <em class="replaceable"><code>user</code></em></span></dt> <dd> -<p><code class="function">setuid()</code> +<p>Setuid to <em class="replaceable"><code>user</code></em> after completing privileged operations, such as creating sockets that listen on privileged ports. @@ -164,7 +175,7 @@ <p> On Linux, <span><strong class="command">named</strong></span> uses the kernel's capability mechanism to drop all root privileges - except the ability to <code class="function">bind()</code> to + except the ability to <code class="function">bind(2)</code> to a privileged port and set process resource limits. Unfortunately, this means that the <code class="option">-u</code> @@ -172,7 +183,7 @@ run on kernel 2.2.18 or later, or kernel 2.3.99-pre3 or later, since previous kernels did not allow privileges - to be retained after <code class="function">setuid()</code>. + to be retained after <code class="function">setuid(2)</code>. </p> </div> </dd> @@ -198,7 +209,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2604871"></a><h2>SIGNALS</h2> +<a name="id2604908"></a><h2>SIGNALS</h2> <p> In routine operation, signals should not be used to control the nameserver; <span><strong class="command">rndc</strong></span> should be used @@ -219,7 +230,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2604921"></a><h2>CONFIGURATION</h2> +<a name="id2604958"></a><h2>CONFIGURATION</h2> <p> The <span><strong class="command">named</strong></span> configuration file is too complex to describe in detail here. A complete description is provided @@ -228,7 +239,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2604940"></a><h2>FILES</h2> +<a name="id2604978"></a><h2>FILES</h2> <div class="variablelist"><dl> <dt><span class="term"><code class="filename">/etc/named.conf</code></span></dt> <dd><p> @@ -241,10 +252,12 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2604984"></a><h2>SEE ALSO</h2> +<a name="id2605021"></a><h2>SEE ALSO</h2> <p><em class="citetitle">RFC 1033</em>, <em class="citetitle">RFC 1034</em>, <em class="citetitle">RFC 1035</em>, + <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>, + <span class="citerefentry"><span class="refentrytitle">named-checkzone</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">lwresd</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>, @@ -252,7 +265,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2605035"></a><h2>AUTHOR</h2> +<a name="id2605092"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/doc/arm/man.rndc-confgen.html b/doc/arm/man.rndc-confgen.html index 25186f2e..296f6958 100644 --- a/doc/arm/man.rndc-confgen.html +++ b/doc/arm/man.rndc-confgen.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: man.rndc-confgen.html,v 1.2.2.44 2007/02/02 04:33:09 marka Exp $ --> +<!-- $Id: man.rndc-confgen.html,v 1.2.2.52 2007/07/09 06:51:14 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -48,7 +48,7 @@ <div class="cmdsynopsis"><p><code class="command">rndc-confgen</code> [<code class="option">-a</code>] [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>] [<code class="option">-c <em class="replaceable"><code>keyfile</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>keyname</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomfile</code></em></code>] [<code class="option">-s <em class="replaceable"><code>address</code></em></code>] [<code class="option">-t <em class="replaceable"><code>chrootdir</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2605267"></a><h2>DESCRIPTION</h2> +<a name="id2605735"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">rndc-confgen</strong></span> generates configuration files for <span><strong class="command">rndc</strong></span>. It can be used as a @@ -64,7 +64,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2605469"></a><h2>OPTIONS</h2> +<a name="id2605801"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-a</span></dt> <dd> @@ -171,7 +171,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2605856"></a><h2>EXAMPLES</h2> +<a name="id2606392"></a><h2>EXAMPLES</h2> <p> To allow <span><strong class="command">rndc</strong></span> to be used with no manual configuration, run @@ -188,7 +188,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2605912"></a><h2>SEE ALSO</h2> +<a name="id2607814"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>, <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, @@ -196,7 +196,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2608476"></a><h2>AUTHOR</h2> +<a name="id2607852"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/doc/arm/man.rndc.conf.html b/doc/arm/man.rndc.conf.html index 7e873bab..a8350e10 100644 --- a/doc/arm/man.rndc.conf.html +++ b/doc/arm/man.rndc.conf.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: man.rndc.conf.html,v 1.2.2.43 2007/02/02 04:33:09 marka Exp $ --> +<!-- $Id: man.rndc.conf.html,v 1.2.2.52 2007/07/09 06:51:14 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -50,7 +50,7 @@ <div class="cmdsynopsis"><p><code class="command">rndc.conf</code> </p></div> </div> <div class="refsect1" lang="en"> -<a name="id2604307"></a><h2>DESCRIPTION</h2> +<a name="id2600474"></a><h2>DESCRIPTION</h2> <p><code class="filename">rndc.conf</code> is the configuration file for <span><strong class="command">rndc</strong></span>, the BIND 9 name server control utility. This file has a similar structure and syntax to @@ -105,7 +105,7 @@ name of a key statement in the file. The port number specifies the port to connect to. If an <code class="option">addresses</code> clause is supplied these addresses will be used instead of - the server name. Each address can take a optional port. + the server name. Each address can take an optional port. If an <code class="option">source-address</code> or <code class="option">source-address-v6</code> of supplied then these will be used to specify the IPv4 and IPv6 source addresses respectively. @@ -135,7 +135,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2604478"></a><h2>EXAMPLE</h2> +<a name="id2605220"></a><h2>EXAMPLE</h2> <pre class="programlisting"> options { default-server localhost; @@ -171,7 +171,7 @@ key testkey { algorithm hmac-md5; secret "R3HI8P6BKw9ZwXwN3VZKuQ=="; - } + }; </pre> <p> </p> @@ -198,7 +198,7 @@ A complete <code class="filename">rndc.conf</code> file, including the randomly generated key, will be written to the standard - output. Commented out <code class="option">key</code> and + output. Commented-out <code class="option">key</code> and <code class="option">controls</code> statements for <code class="filename">named.conf</code> are also printed. </p> @@ -209,7 +209,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2605078"></a><h2>NAME SERVER CONFIGURATION</h2> +<a name="id2605341"></a><h2>NAME SERVER CONFIGURATION</h2> <p> The name server must be configured to accept rndc connections and to recognize the key specified in the <code class="filename">rndc.conf</code> @@ -219,7 +219,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2605104"></a><h2>SEE ALSO</h2> +<a name="id2605367"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">mmencode</span>(1)</span>, @@ -227,7 +227,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2605142"></a><h2>AUTHOR</h2> +<a name="id2605542"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/doc/arm/man.rndc.html b/doc/arm/man.rndc.html index efe4bd0f..55e4e537 100644 --- a/doc/arm/man.rndc.html +++ b/doc/arm/man.rndc.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: man.rndc.html,v 1.2.2.42 2007/02/02 04:33:09 marka Exp $ --> +<!-- $Id: man.rndc.html,v 1.2.2.51 2007/07/09 06:51:14 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -50,7 +50,7 @@ <div class="cmdsynopsis"><p><code class="command">rndc</code> [<code class="option">-b <em class="replaceable"><code>source-address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key-file</code></em></code>] [<code class="option">-s <em class="replaceable"><code>server</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-V</code>] [<code class="option">-y <em class="replaceable"><code>key_id</code></em></code>] {command}</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2603458"></a><h2>DESCRIPTION</h2> +<a name="id2603585"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">rndc</strong></span> controls the operation of a name server. It supersedes the <span><strong class="command">ndc</strong></span> utility @@ -64,7 +64,7 @@ communicates with the name server over a TCP connection, sending commands authenticated with digital signatures. In the current versions of - <span><strong class="command">rndc</strong></span> and <span><strong class="command">named</strong></span> named + <span><strong class="command">rndc</strong></span> and <span><strong class="command">named</strong></span>, the only supported authentication algorithm is HMAC-MD5, which uses a shared secret on each end of the connection. This provides TSIG-style authentication for the command @@ -79,7 +79,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2603508"></a><h2>OPTIONS</h2> +<a name="id2603635"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-b <em class="replaceable"><code>source-address</code></em></span></dt> <dd><p> @@ -106,13 +106,12 @@ </p></dd> <dt><span class="term">-s <em class="replaceable"><code>server</code></em></span></dt> <dd><p><em class="replaceable"><code>server</code></em> is - the name or address of the server which matches a + the name or address of the server which matches a server statement in the configuration file for - <span><strong class="command">rndc</strong></span>. If no server is supplied on - the + <span><strong class="command">rndc</strong></span>. If no server is supplied on the command line, the host named by the default-server clause - in the option statement of the configuration file will be - used. + in the options statement of the <span><strong class="command">rndc</strong></span> + configuration file will be used. </p></dd> <dt><span class="term">-p <em class="replaceable"><code>port</code></em></span></dt> <dd><p> @@ -125,15 +124,15 @@ <dd><p> Enable verbose logging. </p></dd> -<dt><span class="term">-y <em class="replaceable"><code>keyid</code></em></span></dt> +<dt><span class="term">-y <em class="replaceable"><code>key_id</code></em></span></dt> <dd><p> - Use the key <em class="replaceable"><code>keyid</code></em> + Use the key <em class="replaceable"><code>key_id</code></em> from the configuration file. - <em class="replaceable"><code>keyid</code></em> + <em class="replaceable"><code>key_id</code></em> must be known by named with the same algorithm and secret string in order for control message validation to succeed. - If no <em class="replaceable"><code>keyid</code></em> + If no <em class="replaceable"><code>key_id</code></em> is specified, <span><strong class="command">rndc</strong></span> will first look for a key clause in the server statement of the server being used, or if no server statement is present for that @@ -152,7 +151,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2604136"></a><h2>LIMITATIONS</h2> +<a name="id2603860"></a><h2>LIMITATIONS</h2> <p><span><strong class="command">rndc</strong></span> does not yet support all the commands of the BIND 8 <span><strong class="command">ndc</strong></span> utility. @@ -166,16 +165,16 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2604167"></a><h2>SEE ALSO</h2> +<a name="id2603891"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>, <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, - <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span> + <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>, <span class="citerefentry"><span class="refentrytitle">ndc</span>(8)</span>, <em class="citetitle">BIND 9 Administrator Reference Manual</em>. </p> </div> <div class="refsect1" lang="en"> -<a name="id2604282"></a><h2>AUTHOR</h2> +<a name="id2604006"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/doc/rfc/index b/doc/rfc/index index 947827e5..990d4a90 100644 --- a/doc/rfc/index +++ b/doc/rfc/index @@ -105,4 +105,10 @@ 4255: Using DNS to Securely Publish Secure Shell (SSH) Key Fingerprints 4343: Domain Name System (DNS) Case Insensitivity Clarification 4367: What's in a Name: False Assumptions about DNS Names +4398: Storing Certificates in the Domain Name System (DNS) 4431: The DNSSEC Lookaside Validation (DLV) DNS Resource Record +4408: Sender Policy Framework (SPF) for Authorizing Use of Domains + in E-Mail, Version 1 +4470: Minimally Covering NSEC Records and DNSSEC On-line Signing +4634: US Secure Hash Algorithms (SHA and HMAC-SHA) +4641: DNSSEC Operational Practices diff --git a/doc/rfc/rfc4398.txt b/doc/rfc/rfc4398.txt new file mode 100644 index 00000000..6437436e --- /dev/null +++ b/doc/rfc/rfc4398.txt @@ -0,0 +1,955 @@ + + + + + + +Network Working Group S. Josefsson +Request for Comments: 4398 March 2006 +Obsoletes: 2538 +Category: Standards Track + + + Storing Certificates in the Domain Name System (DNS) + +Status of This Memo + + This document specifies an Internet standards track protocol for the + Internet community, and requests discussion and suggestions for + improvements. Please refer to the current edition of the "Internet + Official Protocol Standards" (STD 1) for the standardization state + and status of this protocol. Distribution of this memo is unlimited. + +Copyright Notice + + Copyright (C) The Internet Society (2006). + +Abstract + + Cryptographic public keys are frequently published, and their + authenticity is demonstrated by certificates. A CERT resource record + (RR) is defined so that such certificates and related certificate + revocation lists can be stored in the Domain Name System (DNS). + + This document obsoletes RFC 2538. + + + + + + + + + + + + + + + + + + + + + + + +Josefsson Standards Track [Page 1] + +RFC 4398 Storing Certificates in the DNS February 2006 + + +Table of Contents + + 1. Introduction ....................................................3 + 2. The CERT Resource Record ........................................3 + 2.1. Certificate Type Values ....................................4 + 2.2. Text Representation of CERT RRs ............................6 + 2.3. X.509 OIDs .................................................6 + 3. Appropriate Owner Names for CERT RRs ............................7 + 3.1. Content-Based X.509 CERT RR Names ..........................8 + 3.2. Purpose-Based X.509 CERT RR Names ..........................9 + 3.3. Content-Based OpenPGP CERT RR Names ........................9 + 3.4. Purpose-Based OpenPGP CERT RR Names .......................10 + 3.5. Owner Names for IPKIX, ISPKI, IPGP, and IACPKIX ...........10 + 4. Performance Considerations .....................................11 + 5. Contributors ...................................................11 + 6. Acknowledgements ...............................................11 + 7. Security Considerations ........................................12 + 8. IANA Considerations ............................................12 + 9. Changes since RFC 2538 .........................................13 + 10. References ....................................................14 + 10.1. Normative References .....................................14 + 10.2. Informative References ...................................15 + Appendix A. Copying Conditions ...................................16 + + + + + + + + + + + + + + + + + + + + + + + + + + + + +Josefsson Standards Track [Page 2] + +RFC 4398 Storing Certificates in the DNS February 2006 + + +1. Introduction + + Public keys are frequently published in the form of a certificate, + and their authenticity is commonly demonstrated by certificates and + related certificate revocation lists (CRLs). A certificate is a + binding, through a cryptographic digital signature, of a public key, + a validity interval and/or conditions, and identity, authorization, + or other information. A certificate revocation list is a list of + certificates that are revoked, and of incidental information, all + signed by the signer (issuer) of the revoked certificates. Examples + are X.509 certificates/CRLs in the X.500 directory system or OpenPGP + certificates/revocations used by OpenPGP software. + + Section 2 specifies a CERT resource record (RR) for the storage of + certificates in the Domain Name System [1] [2]. + + Section 3 discusses appropriate owner names for CERT RRs. + + Sections 4, 7, and 8 cover performance, security, and IANA + considerations, respectively. + + Section 9 explains the changes in this document compared to RFC 2538. + + The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", + "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this + document are to be interpreted as described in [3]. + +2. The CERT Resource Record + + The CERT resource record (RR) has the structure given below. Its RR + type code is 37. + + 1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3 + 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + | type | key tag | + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + | algorithm | / + +---------------+ certificate or CRL / + / / + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-| + + The type field is the certificate type as defined in Section 2.1 + below. + + The key tag field is the 16-bit value computed for the key embedded + in the certificate, using the RRSIG Key Tag algorithm described in + Appendix B of [12]. This field is used as an efficiency measure to + + + +Josefsson Standards Track [Page 3] + +RFC 4398 Storing Certificates in the DNS February 2006 + + + pick which CERT RRs may be applicable to a particular key. The key + tag can be calculated for the key in question, and then only CERT RRs + with the same key tag need to be examined. Note that two different + keys can have the same key tag. However, the key MUST be transformed + to the format it would have as the public key portion of a DNSKEY RR + before the key tag is computed. This is only possible if the key is + applicable to an algorithm and complies to limits (such as key size) + defined for DNS security. If it is not, the algorithm field MUST be + zero and the tag field is meaningless and SHOULD be zero. + + The algorithm field has the same meaning as the algorithm field in + DNSKEY and RRSIG RRs [12], except that a zero algorithm field + indicates that the algorithm is unknown to a secure DNS, which may + simply be the result of the algorithm not having been standardized + for DNSSEC [11]. + +2.1. Certificate Type Values + + The following values are defined or reserved: + + Value Mnemonic Certificate Type + ----- -------- ---------------- + 0 Reserved + 1 PKIX X.509 as per PKIX + 2 SPKI SPKI certificate + 3 PGP OpenPGP packet + 4 IPKIX The URL of an X.509 data object + 5 ISPKI The URL of an SPKI certificate + 6 IPGP The fingerprint and URL of an OpenPGP packet + 7 ACPKIX Attribute Certificate + 8 IACPKIX The URL of an Attribute Certificate + 9-252 Available for IANA assignment + 253 URI URI private + 254 OID OID private + 255 Reserved + 256-65279 Available for IANA assignment + 65280-65534 Experimental + 65535 Reserved + + These values represent the initial content of the IANA registry; see + Section 8. + + The PKIX type is reserved to indicate an X.509 certificate conforming + to the profile defined by the IETF PKIX working group [8]. The + certificate section will start with a one-octet unsigned OID length + and then an X.500 OID indicating the nature of the remainder of the + + + + + +Josefsson Standards Track [Page 4] + +RFC 4398 Storing Certificates in the DNS February 2006 + + + certificate section (see Section 2.3, below). (NOTE: X.509 + certificates do not include their X.500 directory-type-designating + OID as a prefix.) + + The SPKI and ISPKI types are reserved to indicate the SPKI + certificate format [15], for use when the SPKI documents are moved + from experimental status. The format for these two CERT RR types + will need to be specified later. + + The PGP type indicates an OpenPGP packet as described in [5] and its + extensions and successors. This is used to transfer public key + material and revocation signatures. The data is binary and MUST NOT + be encoded into an ASCII armor. An implementation SHOULD process + transferable public keys as described in Section 10.1 of [5], but it + MAY handle additional OpenPGP packets. + + The ACPKIX type indicates an Attribute Certificate format [9]. + + The IPKIX and IACPKIX types indicate a URL that will serve the + content that would have been in the "certificate, CRL, or URL" field + of the corresponding type (PKIX or ACPKIX, respectively). + + The IPGP type contains both an OpenPGP fingerprint for the key in + question, as well as a URL. The certificate portion of the IPGP CERT + RR is defined as a one-octet fingerprint length, followed by the + OpenPGP fingerprint, followed by the URL. The OpenPGP fingerprint is + calculated as defined in RFC 2440 [5]. A zero-length fingerprint or + a zero-length URL are legal, and indicate URL-only IPGP data or + fingerprint-only IPGP data, respectively. A zero-length fingerprint + and a zero-length URL are meaningless and invalid. + + The IPKIX, ISPKI, IPGP, and IACPKIX types are known as "indirect". + These types MUST be used when the content is too large to fit in the + CERT RR and MAY be used at the implementer's discretion. They SHOULD + NOT be used where the DNS message is 512 octets or smaller and could + thus be expected to fit a UDP packet. + + The URI private type indicates a certificate format defined by an + absolute URI. The certificate portion of the CERT RR MUST begin with + a null-terminated URI [10], and the data after the null is the + private format certificate itself. The URI SHOULD be such that a + retrieval from it will lead to documentation on the format of the + certificate. Recognition of private certificate types need not be + based on URI equality but can use various forms of pattern matching + so that, for example, subtype or version information can also be + encoded into the URI. + + + + + +Josefsson Standards Track [Page 5] + +RFC 4398 Storing Certificates in the DNS February 2006 + + + The OID private type indicates a private format certificate specified + by an ISO OID prefix. The certificate section will start with a + one-octet unsigned OID length and then a BER-encoded OID indicating + the nature of the remainder of the certificate section. This can be + an X.509 certificate format or some other format. X.509 certificates + that conform to the IETF PKIX profile SHOULD be indicated by the PKIX + type, not the OID private type. Recognition of private certificate + types need not be based on OID equality but can use various forms of + pattern matching such as OID prefix. + +2.2. Text Representation of CERT RRs + + The RDATA portion of a CERT RR has the type field as an unsigned + decimal integer or as a mnemonic symbol as listed in Section 2.1, + above. + + The key tag field is represented as an unsigned decimal integer. + + The algorithm field is represented as an unsigned decimal integer or + a mnemonic symbol as listed in [12]. + + The certificate/CRL portion is represented in base 64 [16] and may be + divided into any number of white-space-separated substrings, down to + single base-64 digits, which are concatenated to obtain the full + signature. These substrings can span lines using the standard + parenthesis. + + Note that the certificate/CRL portion may have internal sub-fields, + but these do not appear in the master file representation. For + example, with type 254, there will be an OID size, an OID, and then + the certificate/CRL proper. However, only a single logical base-64 + string will appear in the text representation. + +2.3. X.509 OIDs + + OIDs have been defined in connection with the X.500 directory for + user certificates, certification authority certificates, revocations + of certification authority, and revocations of user certificates. + The following table lists the OIDs, their BER encoding, and their + length-prefixed hex format for use in CERT RRs: + + + + + + + + + + + +Josefsson Standards Track [Page 6] + +RFC 4398 Storing Certificates in the DNS February 2006 + + + id-at-userCertificate + = { joint-iso-ccitt(2) ds(5) at(4) 36 } + == 0x 03 55 04 24 + id-at-cACertificate + = { joint-iso-ccitt(2) ds(5) at(4) 37 } + == 0x 03 55 04 25 + id-at-authorityRevocationList + = { joint-iso-ccitt(2) ds(5) at(4) 38 } + == 0x 03 55 04 26 + id-at-certificateRevocationList + = { joint-iso-ccitt(2) ds(5) at(4) 39 } + == 0x 03 55 04 27 + +3. Appropriate Owner Names for CERT RRs + + It is recommended that certificate CERT RRs be stored under a domain + name related to their subject, i.e., the name of the entity intended + to control the private key corresponding to the public key being + certified. It is recommended that certificate revocation list CERT + RRs be stored under a domain name related to their issuer. + + Following some of the guidelines below may result in DNS names with + characters that require DNS quoting as per Section 5.1 of RFC 1035 + [2]. + + The choice of name under which CERT RRs are stored is important to + clients that perform CERT queries. In some situations, the clients + may not know all information about the CERT RR object it wishes to + retrieve. For example, a client may not know the subject name of an + X.509 certificate, or the email address of the owner of an OpenPGP + key. Further, the client might only know the hostname of a service + that uses X.509 certificates or the Key ID of an OpenPGP key. + + Therefore, two owner name guidelines are defined: content-based owner + names and purpose-based owner names. A content-based owner name is + derived from the content of the CERT RR data; for example, the + Subject field in an X.509 certificate or the User ID field in OpenPGP + keys. A purpose-based owner name is a name that a client retrieving + CERT RRs ought to know already; for example, the host name of an + X.509 protected service or the Key ID of an OpenPGP key. The + content-based and purpose-based owner name may be the same; for + example, when a client looks up a key based on the From: address of + an incoming email. + + Implementations SHOULD use the purpose-based owner name guidelines + described in this document and MAY use CNAME RRs at content-based + owner names (or other names), pointing to the purpose-based owner + name. + + + +Josefsson Standards Track [Page 7] + +RFC 4398 Storing Certificates in the DNS February 2006 + + + Note that this section describes an application-based mapping from + the name space used in a certificate to the name space used by DNS. + The DNS does not infer any relationship amongst CERT resource records + based on similarities or differences of the DNS owner name(s) of CERT + resource records. For example, if multiple labels are used when + mapping from a CERT identifier to a domain name, then care must be + taken in understanding wildcard record synthesis. + +3.1. Content-Based X.509 CERT RR Names + + Some X.509 versions, such as the PKIX profile of X.509 [8], permit + multiple names to be associated with subjects and issuers under + "Subject Alternative Name" and "Issuer Alternative Name". For + example, the PKIX profile has such Alternate Names with an ASN.1 + specification as follows: + + GeneralName ::= CHOICE { + otherName [0] OtherName, + rfc822Name [1] IA5String, + dNSName [2] IA5String, + x400Address [3] ORAddress, + directoryName [4] Name, + ediPartyName [5] EDIPartyName, + uniformResourceIdentifier [6] IA5String, + iPAddress [7] OCTET STRING, + registeredID [8] OBJECT IDENTIFIER } + + The recommended locations of CERT storage are as follows, in priority + order: + + 1. If a domain name is included in the identification in the + certificate or CRL, that ought to be used. + 2. If a domain name is not included but an IP address is included, + then the translation of that IP address into the appropriate + inverse domain name ought to be used. + 3. If neither of the above is used, but a URI containing a domain + name is present, that domain name ought to be used. + 4. If none of the above is included but a character string name is + included, then it ought to be treated as described below for + OpenPGP names. + 5. If none of the above apply, then the distinguished name (DN) + ought to be mapped into a domain name as specified in [4]. + + Example 1: An X.509v3 certificate is issued to /CN=John Doe /DC=Doe/ + DC=com/DC=xy/O=Doe Inc/C=XY/ with Subject Alternative Names of (a) + string "John (the Man) Doe", (b) domain name john-doe.com, and (c) + URI <https://www.secure.john-doe.com:8080/>. The storage locations + recommended, in priority order, would be + + + +Josefsson Standards Track [Page 8] + +RFC 4398 Storing Certificates in the DNS February 2006 + + + 1. john-doe.com, + 2. www.secure.john-doe.com, and + 3. Doe.com.xy. + + Example 2: An X.509v3 certificate is issued to /CN=James Hacker/ + L=Basingstoke/O=Widget Inc/C=GB/ with Subject Alternate names of (a) + domain name widget.foo.example, (b) IPv4 address 10.251.13.201, and + (c) string "James Hacker <hacker@mail.widget.foo.example>". The + storage locations recommended, in priority order, would be + + 1. widget.foo.example, + 2. 201.13.251.10.in-addr.arpa, and + 3. hacker.mail.widget.foo.example. + +3.2. Purpose-Based X.509 CERT RR Names + + Due to the difficulty for clients that do not already possess a + certificate to reconstruct the content-based owner name, + purpose-based owner names are recommended in this section. + Recommendations for purpose-based owner names vary per scenario. The + following table summarizes the purpose-based X.509 CERT RR owner name + guidelines for use with S/MIME [17], SSL/TLS [13], and IPsec [14]: + + Scenario Owner name + ------------------ ---------------------------------------------- + S/MIME Certificate Standard translation of an RFC 2822 email + address. Example: An S/MIME certificate for + "postmaster@example.org" will use a standard + hostname translation of the owner name, + "postmaster.example.org". + + TLS Certificate Hostname of the TLS server. + + IPsec Certificate Hostname of the IPsec machine and/or, for IPv4 + or IPv6 addresses, the fully qualified domain + name in the appropriate reverse domain. + + An alternate approach for IPsec is to store raw public keys [18]. + +3.3. Content-Based OpenPGP CERT RR Names + + OpenPGP signed keys (certificates) use a general character string + User ID [5]. However, it is recommended by OpenPGP that such names + include the RFC 2822 [7] email address of the party, as in "Leslie + Example <Leslie@host.example>". If such a format is used, the CERT + ought to be under the standard translation of the email address into + + + + + +Josefsson Standards Track [Page 9] + +RFC 4398 Storing Certificates in the DNS February 2006 + + + a domain name, which would be leslie.host.example in this case. If + no RFC 2822 name can be extracted from the string name, no specific + domain name is recommended. + + If a user has more than one email address, the CNAME type can be used + to reduce the amount of data stored in the DNS. For example: + + $ORIGIN example.org. + smith IN CERT PGP 0 0 <OpenPGP binary> + john.smith IN CNAME smith + js IN CNAME smith + +3.4. Purpose-Based OpenPGP CERT RR Names + + Applications that receive an OpenPGP packet containing encrypted or + signed data but do not know the email address of the sender will have + difficulties constructing the correct owner name and cannot use the + content-based owner name guidelines. However, these clients commonly + know the key fingerprint or the Key ID. The key ID is found in + OpenPGP packets, and the key fingerprint is commonly found in + auxiliary data that may be available. In this case, use of an owner + name identical to the key fingerprint and the key ID expressed in + hexadecimal [16] is recommended. For example: + + $ORIGIN example.org. + 0424D4EE81A0E3D119C6F835EDA21E94B565716F IN CERT PGP ... + F835EDA21E94B565716F IN CERT PGP ... + B565716F IN CERT PGP ... + + If the same key material is stored for several owner names, the use + of CNAME may help avoid data duplication. Note that CNAME is not + always applicable, because it maps one owner name to the other for + all purposes, which may be sub-optimal when two keys with the same + Key ID are stored. + +3.5. Owner Names for IPKIX, ISPKI, IPGP, and IACPKIX + + These types are stored under the same owner names, both purpose- and + content-based, as the PKIX, SPKI, PGP, and ACPKIX types. + + + + + + + + + + + + +Josefsson Standards Track [Page 10] + +RFC 4398 Storing Certificates in the DNS February 2006 + + +4. Performance Considerations + + The Domain Name System (DNS) protocol was designed for small + transfers, typically below 512 octets. While larger transfers will + perform correctly and work is underway to make larger transfers more + efficient, it is still advisable at this time that every reasonable + effort be made to minimize the size of certificates stored within the + DNS. Steps that can be taken may include using the fewest possible + optional or extension fields and using short field values for + necessary variable-length fields. + + The RDATA field in the DNS protocol may only hold data of size 65535 + octets (64kb) or less. This means that each CERT RR MUST NOT contain + more than 64kb of payload, even if the corresponding certificate or + certificate revocation list is larger. This document addresses this + by defining "indirect" data types for each normal type. + + Deploying CERT RRs to support digitally signed email changes the + access patterns of DNS lookups from per-domain to per-user. If + digitally signed email and a key/certificate lookup based on CERT RRs + are deployed on a wide scale, this may lead to an increased DNS load, + with potential performance and cache effectiveness consequences. + Whether or not this load increase will be noticeable is not known. + +5. Contributors + + The majority of this document is copied verbatim from RFC 2538, by + Donald Eastlake 3rd and Olafur Gudmundsson. + +6. Acknowledgements + + Thanks to David Shaw and Michael Graff for their contributions to + earlier works that motivated, and served as inspiration for, this + document. + + This document was improved by suggestions and comments from Olivier + Dubuisson, Scott Hollenbeck, Russ Housley, Peter Koch, Olaf M. + Kolkman, Ben Laurie, Edward Lewis, John Loughney, Allison Mankin, + Douglas Otis, Marcos Sanz, Pekka Savola, Jason Sloderbeck, Samuel + Weiler, and Florian Weimer. No doubt the list is incomplete. We + apologize to anyone we left out. + + + + + + + + + + +Josefsson Standards Track [Page 11] + +RFC 4398 Storing Certificates in the DNS February 2006 + + +7. Security Considerations + + By definition, certificates contain their own authenticating + signatures. Thus, it is reasonable to store certificates in + non-secure DNS zones or to retrieve certificates from DNS with DNS + security checking not implemented or deferred for efficiency. The + results may be trusted if the certificate chain is verified back to a + known trusted key and this conforms with the user's security policy. + + Alternatively, if certificates are retrieved from a secure DNS zone + with DNS security checking enabled and are verified by DNS security, + the key within the retrieved certificate may be trusted without + verifying the certificate chain if this conforms with the user's + security policy. + + If an organization chooses to issue certificates for its employees, + placing CERT RRs in the DNS by owner name, and if DNSSEC (with NSEC) + is in use, it is possible for someone to enumerate all employees of + the organization. This is usually not considered desirable, for the + same reason that enterprise phone listings are not often publicly + published and are even marked confidential. + + Using the URI type introduces another level of indirection that may + open a new vulnerability. One method of securing that indirection is + to include a hash of the certificate in the URI itself. + + If DNSSEC is used, then the non-existence of a CERT RR and, + consequently, certificates or revocation lists can be securely + asserted. Without DNSSEC, this is not possible. + +8. IANA Considerations + + The IANA has created a new registry for CERT RR: certificate types. + The initial contents of this registry is: + + Decimal Type Meaning Reference + ------- ---- ------- --------- + 0 Reserved RFC 4398 + 1 PKIX X.509 as per PKIX RFC 4398 + 2 SPKI SPKI certificate RFC 4398 + 3 PGP OpenPGP packet RFC 4398 + 4 IPKIX The URL of an X.509 data object RFC 4398 + 5 ISPKI The URL of an SPKI certificate RFC 4398 + 6 IPGP The fingerprint and URL RFC 4398 + of an OpenPGP packet + 7 ACPKIX Attribute Certificate RFC 4398 + 8 IACPKIX The URL of an Attribute RFC 4398 + Certificate + + + +Josefsson Standards Track [Page 12] + +RFC 4398 Storing Certificates in the DNS February 2006 + + + 9-252 Available for IANA assignment + by IETF Standards action + 253 URI URI private RFC 4398 + 254 OID OID private RFC 4398 + 255 Reserved RFC 4398 + 256-65279 Available for IANA assignment + by IETF Consensus + 65280-65534 Experimental RFC 4398 + 65535 Reserved RFC 4398 + + Certificate types 0x0000 through 0x00FF and 0xFF00 through 0xFFFF can + only be assigned by an IETF standards action [6]. This document + assigns 0x0001 through 0x0008 and 0x00FD and 0x00FE. Certificate + types 0x0100 through 0xFEFF are assigned through IETF Consensus [6] + based on RFC documentation of the certificate type. The availability + of private types under 0x00FD and 0x00FE ought to satisfy most + requirements for proprietary or private types. + + The CERT RR reuses the DNS Security Algorithm Numbers registry. In + particular, the CERT RR requires that algorithm number 0 remain + reserved, as described in Section 2. The IANA will reference the + CERT RR as a user of this registry and value 0, in particular. + +9. Changes since RFC 2538 + + 1. Editorial changes to conform with new document requirements, + including splitting reference section into two parts and + updating the references to point at latest versions, and to add + some additional references. + 2. Improve terminology. For example replace "PGP" with "OpenPGP", + to align with RFC 2440. + 3. In Section 2.1, clarify that OpenPGP public key data are binary, + not the ASCII armored format, and reference 10.1 in RFC 2440 on + how to deal with OpenPGP keys, and acknowledge that + implementations may handle additional packet types. + 4. Clarify that integers in the representation format are decimal. + 5. Replace KEY/SIG with DNSKEY/RRSIG etc, to align with DNSSECbis + terminology. Improve reference for Key Tag Algorithm + calculations. + 6. Add examples that suggest use of CNAME to reduce bandwidth. + 7. In Section 3, appended the last paragraphs that discuss + "content-based" vs "purpose-based" owner names. Add Section 3.2 + for purpose-based X.509 CERT owner names, and Section 3.4 for + purpose-based OpenPGP CERT owner names. + 8. Added size considerations. + 9. The SPKI types has been reserved, until RFC 2692/2693 is moved + from the experimental status. + 10. Added indirect types IPKIX, ISPKI, IPGP, and IACPKIX. + + + +Josefsson Standards Track [Page 13] + +RFC 4398 Storing Certificates in the DNS February 2006 + + + 11. An IANA registry of CERT type values was created. + +10. References + +10.1. Normative References + + [1] Mockapetris, P., "Domain names - concepts and facilities", + STD 13, RFC 1034, November 1987. + + [2] Mockapetris, P., "Domain names - implementation and + specification", STD 13, RFC 1035, November 1987. + + [3] Bradner, S., "Key words for use in RFCs to Indicate Requirement + Levels", BCP 14, RFC 2119, March 1997. + + [4] Kille, S., Wahl, M., Grimstad, A., Huber, R., and S. Sataluri, + "Using Domains in LDAP/X.500 Distinguished Names", RFC 2247, + January 1998. + + [5] Callas, J., Donnerhacke, L., Finney, H., and R. Thayer, + "OpenPGP Message Format", RFC 2440, November 1998. + + [6] Narten, T. and H. Alvestrand, "Guidelines for Writing an IANA + Considerations Section in RFCs", BCP 26, RFC 2434, + October 1998. + + [7] Resnick, P., "Internet Message Format", RFC 2822, April 2001. + + [8] Housley, R., Polk, W., Ford, W., and D. Solo, "Internet X.509 + Public Key Infrastructure Certificate and Certificate + Revocation List (CRL) Profile", RFC 3280, April 2002. + + [9] Farrell, S. and R. Housley, "An Internet Attribute Certificate + Profile for Authorization", RFC 3281, April 2002. + + [10] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform + Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986, + January 2005. + + [11] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, + "DNS Security Introduction and Requirements", RFC 4033, + March 2005. + + [12] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, + "Resource Records for the DNS Security Extensions", RFC 4034, + March 2005. + + + + + +Josefsson Standards Track [Page 14] + +RFC 4398 Storing Certificates in the DNS February 2006 + + +10.2. Informative References + + [13] Dierks, T. and C. Allen, "The TLS Protocol Version 1.0", + RFC 2246, January 1999. + + [14] Kent, S. and K. Seo, "Security Architecture for the Internet + Protocol", RFC 4301, December 2005. + + [15] Ellison, C., Frantz, B., Lampson, B., Rivest, R., Thomas, B., + and T. Ylonen, "SPKI Certificate Theory", RFC 2693, + September 1999. + + [16] Josefsson, S., "The Base16, Base32, and Base64 Data Encodings", + RFC 3548, July 2003. + + [17] Ramsdell, B., "Secure/Multipurpose Internet Mail Extensions + (S/MIME) Version 3.1 Message Specification", RFC 3851, + July 2004. + + [18] Richardson, M., "A Method for Storing IPsec Keying Material in + DNS", RFC 4025, March 2005. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +Josefsson Standards Track [Page 15] + +RFC 4398 Storing Certificates in the DNS February 2006 + + +Appendix A. Copying Conditions + + Regarding the portion of this document that was written by Simon + Josefsson ("the author", for the remainder of this section), the + author makes no guarantees and is not responsible for any damage + resulting from its use. The author grants irrevocable permission to + anyone to use, modify, and distribute it in any way that does not + diminish the rights of anyone else to use, modify, and distribute it, + provided that redistributed derivative works do not contain + misleading author or version information. Derivative works need not + be licensed under similar terms. + +Author's Address + + Simon Josefsson + + EMail: simon@josefsson.org + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +Josefsson Standards Track [Page 16] + +RFC 4398 Storing Certificates in the DNS February 2006 + + +Full Copyright Statement + + Copyright (C) The Internet Society (2006). + + This document is subject to the rights, licenses and restrictions + contained in BCP 78, and except as set forth therein, the authors + retain all their rights. + + This document and the information contained herein are provided on an + "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS + OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET + ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, + INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE + INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED + WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. + +Intellectual Property + + The IETF takes no position regarding the validity or scope of any + Intellectual Property Rights or other rights that might be claimed to + pertain to the implementation or use of the technology described in + this document or the extent to which any license under such rights + might or might not be available; nor does it represent that it has + made any independent effort to identify any such rights. Information + on the procedures with respect to rights in RFC documents can be + found in BCP 78 and BCP 79. + + Copies of IPR disclosures made to the IETF Secretariat and any + assurances of licenses to be made available, or the result of an + attempt made to obtain a general license or permission for the use of + such proprietary rights by implementers or users of this + specification can be obtained from the IETF on-line IPR repository at + http://www.ietf.org/ipr. + + The IETF invites any interested party to bring to its attention any + copyrights, patents or patent applications, or other proprietary + rights that may cover technology that may be required to implement + this standard. Please address the information to the IETF at + ietf-ipr@ietf.org. + +Acknowledgement + + Funding for the RFC Editor function is provided by the IETF + Administrative Support Activity (IASA). + + + + + + + +Josefsson Standards Track [Page 17] + diff --git a/doc/draft/draft-schlitt-spf-classic-02.txt b/doc/rfc/rfc4408.txt index 3bd9594c..bc1b3f53 100644 --- a/doc/draft/draft-schlitt-spf-classic-02.txt +++ b/doc/rfc/rfc4408.txt @@ -1,193 +1,203 @@ -Network Working Group M. Wong -Internet-Draft W. Schlitt -Expires: December 8, 2005 June 6, 2005 - -Sender Policy Framework (SPF) for Authorizing Use of Domains in E-MAIL, - version 1 - draft-schlitt-spf-classic-02 -Status of this Memo - By submitting this Internet-Draft, each author represents that any - applicable patent or other IPR claims of which he or she is aware - have been or will be disclosed, and any of which he or she becomes - aware will be disclosed, in accordance with Section 6 of BCP 79. - - Internet-Drafts are working documents of the Internet Engineering - Task Force (IETF), its areas, and its working groups. Note that - other groups may also distribute working documents as Internet- - Drafts. +Network Working Group M. Wong +Request for Comments: 4408 W. Schlitt +Category: Experimental April 2006 - Internet-Drafts are draft documents valid for a maximum of six months - and may be updated, replaced, or obsoleted by other documents at any - time. It is inappropriate to use Internet-Drafts as reference - material or to cite them other than as "work in progress." - The list of current Internet-Drafts can be accessed at - http://www.ietf.org/ietf/1id-abstracts.txt. + Sender Policy Framework (SPF) for + Authorizing Use of Domains in E-Mail, Version 1 - The list of Internet-Draft Shadow Directories can be accessed at - http://www.ietf.org/shadow.html. +Status of This Memo - This Internet-Draft will expire on December 8, 2005. + This memo defines an Experimental Protocol for the Internet + community. It does not specify an Internet standard of any kind. + Discussion and suggestions for improvement are requested. + Distribution of this memo is unlimited. Copyright Notice - Copyright (C) The Internet Society (2005). + Copyright (C) The Internet Society (2006). -Abstract +IESG Note - E-mail on the Internet can be forged in a number of ways. In - particular, existing protocols place no restriction on what a sending - host can use as the reverse-path of a message or the domain given on - the SMTP HELO/EHLO commands. This document describes version 1 of - the SPF protocol, whereby a domain may explicitly authorize the hosts - that are allowed to use its domain name, and a receiving host may - check such authorization. + The following documents (RFC 4405, RFC 4406, RFC 4407, and RFC 4408) + are published simultaneously as Experimental RFCs, although there is + no general technical consensus and efforts to reconcile the two + approaches have failed. As such, these documents have not received + full IETF review and are published "AS-IS" to document the different + approaches as they were considered in the MARID working group. + The IESG takes no position about which approach is to be preferred + and cautions the reader that there are serious open issues for each + approach and concerns about using them in tandem. The IESG believes + that documenting the different approaches does less harm than not + documenting them. + Note that the Sender ID experiment may use DNS records that may have + been created for the current SPF experiment or earlier versions in + this set of experiments. Depending on the content of the record, + this may mean that Sender-ID heuristics would be applied incorrectly + to a message. Depending on the actions associated by the recipient + with those heuristics, the message may not be delivered or may be + discarded on receipt. + Participants relying on Sender ID experiment DNS records are warned + that they may lose valid messages in this set of circumstances. + aParticipants publishing SPF experiment DNS records should consider + the advice given in section 3.4 of RFC 4406 and may wish to publish + both v=spf1 and spf2.0 records to avoid the conflict. -Wong & Schlitt Expires December 8, 2005 [Page 1] - -Internet-Draft Sender Policy Framework (SPF) June 2005 -Table of Contents - 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4 - 1.1. State of this draft . . . . . . . . . . . . . . . . . . . 4 - 1.2. Protocol Status . . . . . . . . . . . . . . . . . . . . . 5 - 1.3. Terminology . . . . . . . . . . . . . . . . . . . . . . . 5 - 2. Operation . . . . . . . . . . . . . . . . . . . . . . . . . . 6 - 2.1. The HELO Identity . . . . . . . . . . . . . . . . . . . . 6 - 2.2. The MAIL FROM Identity . . . . . . . . . . . . . . . . . . 6 - 2.3. Publishing Authorization . . . . . . . . . . . . . . . . . 6 - 2.4. Checking Authorization . . . . . . . . . . . . . . . . . . 7 - 2.5. Interpreting the Result . . . . . . . . . . . . . . . . . 8 - 2.5.1. None . . . . . . . . . . . . . . . . . . . . . . . . . 8 - 2.5.2. Neutral . . . . . . . . . . . . . . . . . . . . . . . 9 - 2.5.3. Pass . . . . . . . . . . . . . . . . . . . . . . . . . 9 - 2.5.4. Fail . . . . . . . . . . . . . . . . . . . . . . . . . 9 - 2.5.5. SoftFail . . . . . . . . . . . . . . . . . . . . . . . 9 - 2.5.6. TempError . . . . . . . . . . . . . . . . . . . . . . 10 - 2.5.7. PermError . . . . . . . . . . . . . . . . . . . . . . 10 - 3. SPF Records . . . . . . . . . . . . . . . . . . . . . . . . . 11 - 3.1. Publishing . . . . . . . . . . . . . . . . . . . . . . . . 11 - 3.1.1. DNS Resource Record Types . . . . . . . . . . . . . . 11 - 3.1.2. Multiple DNS Records . . . . . . . . . . . . . . . . . 12 - 3.1.3. Multiple Strings in a Single DNS record . . . . . . . 12 - 3.1.4. Record Size . . . . . . . . . . . . . . . . . . . . . 12 - 3.1.5. Wildcard Records . . . . . . . . . . . . . . . . . . . 13 - 4. The check_host() Function . . . . . . . . . . . . . . . . . . 14 - 4.1. Arguments . . . . . . . . . . . . . . . . . . . . . . . . 14 - 4.2. Results . . . . . . . . . . . . . . . . . . . . . . . . . 14 - 4.3. Initial Processing . . . . . . . . . . . . . . . . . . . . 14 - 4.4. Record Lookup . . . . . . . . . . . . . . . . . . . . . . 15 - 4.5. Selecting Records . . . . . . . . . . . . . . . . . . . . 15 - 4.6. Record Evaluation . . . . . . . . . . . . . . . . . . . . 15 - 4.6.1. Term Evaluation . . . . . . . . . . . . . . . . . . . 16 - 4.6.2. Mechanisms . . . . . . . . . . . . . . . . . . . . . . 16 - 4.6.3. Modifiers . . . . . . . . . . . . . . . . . . . . . . 17 - 4.7. Default Result . . . . . . . . . . . . . . . . . . . . . . 17 - 4.8. Domain Specification . . . . . . . . . . . . . . . . . . . 17 - 5. Mechanism Definitions . . . . . . . . . . . . . . . . . . . . 19 - 5.1. "all" . . . . . . . . . . . . . . . . . . . . . . . . . . 19 - 5.2. "include" . . . . . . . . . . . . . . . . . . . . . . . . 20 - 5.3. "a" . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 - 5.4. "mx" . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 - 5.5. "ptr" . . . . . . . . . . . . . . . . . . . . . . . . . . 22 - 5.6. "ip4" and "ip6" . . . . . . . . . . . . . . . . . . . . . 23 - 5.7. "exists" . . . . . . . . . . . . . . . . . . . . . . . . . 24 - 6. Modifier Definitions . . . . . . . . . . . . . . . . . . . . . 25 - 6.1. redirect: Redirected Query . . . . . . . . . . . . . . . . 25 - - - -Wong & Schlitt Expires December 8, 2005 [Page 2] +Wong & Schlitt Experimental [Page 1] -Internet-Draft Sender Policy Framework (SPF) June 2005 - - - 6.2. exp: Explanation . . . . . . . . . . . . . . . . . . . . . 26 - 7. The Received-SPF header field . . . . . . . . . . . . . . . . 28 - 8. Macros . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 - 8.1. Macro definitions . . . . . . . . . . . . . . . . . . . . 30 - 8.2. Expansion Examples . . . . . . . . . . . . . . . . . . . . 33 - 9. Implications . . . . . . . . . . . . . . . . . . . . . . . . . 34 - 9.1. Sending Domains . . . . . . . . . . . . . . . . . . . . . 34 - 9.2. Mailing Lists . . . . . . . . . . . . . . . . . . . . . . 34 - 9.3. Forwarding Services and Aliases . . . . . . . . . . . . . 34 - 9.4. Mail Services . . . . . . . . . . . . . . . . . . . . . . 36 - 9.5. MTA Relays . . . . . . . . . . . . . . . . . . . . . . . . 37 - 10. Security Considerations . . . . . . . . . . . . . . . . . . . 38 - 10.1. Processing Limits . . . . . . . . . . . . . . . . . . . . 38 - 10.2. SPF-Authorized E-Mail May Be UBE . . . . . . . . . . . . . 39 - 10.3. Spoofed DNS and IP Data . . . . . . . . . . . . . . . . . 40 - 10.4. Cross-User Forgery . . . . . . . . . . . . . . . . . . . . 40 - 10.5. Untrusted Information Sources . . . . . . . . . . . . . . 40 - 10.6. Privacy Exposure . . . . . . . . . . . . . . . . . . . . . 41 - 11. Contributors and Acknowledgements . . . . . . . . . . . . . . 42 - 12. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 43 - 12.1. The SPF DNS Record Type . . . . . . . . . . . . . . . . . 43 - 12.2. The Received-SPF mail header . . . . . . . . . . . . . . . 43 - 13. References . . . . . . . . . . . . . . . . . . . . . . . . . . 44 - 13.1. Normative References . . . . . . . . . . . . . . . . . . . 44 - 13.2. Informative References . . . . . . . . . . . . . . . . . . 44 - Appendix A. Collected ABNF . . . . . . . . . . . . . . . . . . . 46 - Appendix B. Extended Examples . . . . . . . . . . . . . . . . . . 48 - B.1. Simple Examples . . . . . . . . . . . . . . . . . . . . . 48 - B.2. Multiple Domain Example . . . . . . . . . . . . . . . . . 49 - B.3. DNSBL Style Example . . . . . . . . . . . . . . . . . . . 50 - B.4. Multiple Requirements Example . . . . . . . . . . . . . . 50 - Appendix C. Change Log . . . . . . . . . . . . . . . . . . . . . 51 - C.1. Changes in Version -02 . . . . . . . . . . . . . . . . . . 51 - C.2. Changes in Version -01 . . . . . . . . . . . . . . . . . . 52 - Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 55 - Intellectual Property and Copyright Statements . . . . . . . . . . 56 - - - - - - - - +RFC 4408 Sender Policy Framework (SPF) April 2006 + Participants in the Sender-ID experiment need to be aware that the + way Resent-* header fields are used will result in failure to receive + legitimate email when interacting with standards-compliant systems + (specifically automatic forwarders which comply with the standards by + not adding Resent-* headers, and systems which comply with RFC 822 + but have not yet implemented RFC 2822 Resent-* semantics). It would + be inappropriate to advance Sender-ID on the standards track without + resolving this interoperability problem. + The community is invited to observe the success or failure of the two + approaches during the two years following publication, in order that + a community consensus can be reached in the future. +Abstract + E-mail on the Internet can be forged in a number of ways. In + particular, existing protocols place no restriction on what a sending + host can use as the reverse-path of a message or the domain given on + the SMTP HELO/EHLO commands. This document describes version 1 of + the Sender Policy Framework (SPF) protocol, whereby a domain may + explicitly authorize the hosts that are allowed to use its domain + name, and a receiving host may check such authorization. +Table of Contents -Wong & Schlitt Expires December 8, 2005 [Page 3] + 1. Introduction ....................................................4 + 1.1. Protocol Status ............................................4 + 1.2. Terminology ................................................5 + 2. Operation .......................................................5 + 2.1. The HELO Identity ..........................................5 + 2.2. The MAIL FROM Identity .....................................5 + 2.3. Publishing Authorization ...................................6 + 2.4. Checking Authorization .....................................6 + 2.5. Interpreting the Result ....................................7 + 2.5.1. None ................................................8 + 2.5.2. Neutral .............................................8 + 2.5.3. Pass ................................................8 + 2.5.4. Fail ................................................8 + 2.5.5. SoftFail ............................................9 + 2.5.6. TempError ...........................................9 + 2.5.7. PermError ...........................................9 + 3. SPF Records .....................................................9 + 3.1. Publishing ................................................10 + 3.1.1. DNS Resource Record Types ..........................10 + 3.1.2. Multiple DNS Records ...............................11 + 3.1.3. Multiple Strings in a Single DNS record ............11 + 3.1.4. Record Size ........................................11 + 3.1.5. Wildcard Records ...................................11 + + + +Wong & Schlitt Experimental [Page 2] -Internet-Draft Sender Policy Framework (SPF) June 2005 +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + 4. The check_host() Function ......................................12 + 4.1. Arguments .................................................12 + 4.2. Results ...................................................13 + 4.3. Initial Processing ........................................13 + 4.4. Record Lookup .............................................13 + 4.5. Selecting Records .........................................13 + 4.6. Record Evaluation .........................................14 + 4.6.1. Term Evaluation ....................................14 + 4.6.2. Mechanisms .........................................15 + 4.6.3. Modifiers ..........................................15 + 4.7. Default Result ............................................16 + 4.8. Domain Specification ......................................16 + 5. Mechanism Definitions ..........................................16 + 5.1. "all" .....................................................17 + 5.2. "include" .................................................18 + 5.3. "a" .......................................................19 + 5.4. "mx" ......................................................20 + 5.5. "ptr" .....................................................20 + 5.6. "ip4" and "ip6" ...........................................21 + 5.7. "exists" ..................................................22 + 6. Modifier Definitions ...........................................22 + 6.1. redirect: Redirected Query ................................23 + 6.2. exp: Explanation ..........................................23 + 7. The Received-SPF Header Field ..................................25 + 8. Macros .........................................................27 + 8.1. Macro Definitions .........................................27 + 8.2. Expansion Examples ........................................30 + 9. Implications ...................................................31 + 9.1. Sending Domains ...........................................31 + 9.2. Mailing Lists .............................................32 + 9.3. Forwarding Services and Aliases ...........................32 + 9.4. Mail Services .............................................34 + 9.5. MTA Relays ................................................34 + 10. Security Considerations .......................................35 + 10.1. Processing Limits ........................................35 + 10.2. SPF-Authorized E-Mail May Contain Other False + Identities ...............................................37 + 10.3. Spoofed DNS and IP Data ..................................37 + 10.4. Cross-User Forgery .......................................37 + 10.5. Untrusted Information Sources ............................38 + 10.6. Privacy Exposure .........................................38 + 11. Contributors and Acknowledgements .............................38 + 12. IANA Considerations ...........................................39 + 12.1. The SPF DNS Record Type ..................................39 + 12.2. The Received-SPF Mail Header Field .......................39 + 13. References ....................................................39 + 13.1. Normative References .....................................39 + 13.2. Informative References ...................................40 + + + +Wong & Schlitt Experimental [Page 3] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + Appendix A. Collected ABNF .......................................42 + Appendix B. Extended Examples ....................................44 + B.1. Simple Examples ..........................................44 + B.2. Multiple Domain Example ..................................45 + B.3. DNSBL Style Example ......................................46 + B.4. Multiple Requirements Example ............................46 1. Introduction - The current e-mail infrastructure has the property that any host + The current E-Mail infrastructure has the property that any host injecting mail into the mail system can identify itself as any domain name it wants. Hosts can do this at a variety of levels: in - particular, the session, the envelope, and the mail headers. While - this feature is desirable in some circumstances, it is a major - obstacle to reducing Unsolicited Bulk E-mail (UBE, aka "spam"). + particular, the session, the envelope, and the mail headers. + Although this feature is desirable in some circumstances, it is a + major obstacle to reducing Unsolicited Bulk E-Mail (UBE, aka spam). Furthermore, many domain name holders are understandably concerned about the ease with which other entities may make use of their domain names, often with malicious intent. This document defines a protocol by which domain owners may authorize hosts to use their domain name in the "MAIL FROM" or "HELO" identity. - Compliant domain holders publish SPF records specifying which hosts - are permitted to use their names, and compliant mail receivers use - the published SPF records to test the authorization of sending MTAs - using a given "HELO" or "MAIL FROM" identity during a mail - transaction. + Compliant domain holders publish Sender Policy Framework (SPF) + records specifying which hosts are permitted to use their names, and + compliant mail receivers use the published SPF records to test the + authorization of sending Mail Transfer Agents (MTAs) using a given + "HELO" or "MAIL FROM" identity during a mail transaction. An additional benefit to mail receivers is that after the use of an identity is verified, local policy decisions about the mail can be @@ -195,40 +205,12 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 This is advantageous because reputation of domain names is likely to be more accurate than reputation of host IP addresses. Furthermore, if a claimed identity fails verification, local policy can take - stronger action against such e-mail, such as rejecting it. - -1.1. State of this draft - - This draft version attempts to resolve all known issues and address - all comments received from the IESG review of 2005/02/17, as well - reviews from the namedroppers, ietf-smtp, ietf-822 and spf-discuss - mailing lists both in January and in May. - - Please check the Change log in Appendix C before proposing changes, - as it is possible that your idea has already been discussed. Please - post comments on the spf-discuss@v2.listbox.com mailing list or - e-mail them directly to the author. - - I am sorry for the length of this I-D; I have not had time to make it - shorter. - - RFC Editor Note: Please remove this section for the final publication - of the document. It has been inspired by - draft-ietf-tools-draft-submission-09.txt. - - - - - -Wong & Schlitt Expires December 8, 2005 [Page 4] - -Internet-Draft Sender Policy Framework (SPF) June 2005 - + stronger action against such E-Mail, such as rejecting it. -1.2. Protocol Status +1.1. Protocol Status - SPF has been in development since the Summer of 2003, and has seen - deployment beyond the developers beginning in December, 2003. The + SPF has been in development since the summer of 2003 and has seen + deployment beyond the developers beginning in December 2003. The design of SPF slowly evolved until the spring of 2004 and has since stabilized. There have been quite a number of forms of SPF, some written up as documents, some submitted as Internet Drafts, and many @@ -238,11 +220,19 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 by earlier draft specifications of SPF as used in existing implementations. This conception of SPF is sometimes called "SPF Classic". It is understood that particular implementations and + + + +Wong & Schlitt Experimental [Page 4] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + deployments may differ from, and build upon, this work. It is hoped that we have nonetheless captured the common understanding of SPF version 1. -1.3. Terminology +1.2. Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this @@ -251,35 +241,10 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 This document is concerned with the portion of a mail message commonly called "envelope sender", "return path", "reverse path", "bounce address", "2821 FROM", or "MAIL FROM". Since these terms are - either not well defined, or often used casually, this document - defines the "MAIL FROM" identity in Section 2.2. Note that other - terms that may superficially look like the common terms, such as - "reverse-path", are used only with the defined meanings from - normative documents. - - - - - - - - - - - - - - - - - - - - -Wong & Schlitt Expires December 8, 2005 [Page 5] - -Internet-Draft Sender Policy Framework (SPF) June 2005 - + either not well defined or often used casually, this document defines + the "MAIL FROM" identity in Section 2.2. Note that other terms that + may superficially look like the common terms, such as "reverse-path", + are used only with the defined meanings from normative documents. 2. Operation @@ -291,10 +256,10 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 presented in the EHLO or HELO command are not always clear to the sending party, and SPF clients must be prepared for the "HELO" identity to be malformed or an IP address literal. At the time of - this writing, many legitimate e-mails are delivered with invalid HELO + this writing, many legitimate E-Mails are delivered with invalid HELO domains. - It is RECOMMENDED that SPF clients check not only the "MAIL FROM" + It is RECOMMENDED that SPF clients not only check the "MAIL FROM" identity, but also separately check the "HELO" identity by applying the check_host() function (Section 4) to the "HELO" identity as the <sender>. @@ -307,13 +272,21 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 which notification messages are to be sent if there are problems delivering the message. - [RFC2821] allows the reverse-path to be null (see Section 4.5.5). In - this case, there is no explicit sender mailbox, and such a message - can be assumed to be a notification message from the mail system - itself. When the reverse-path is null, this document defines the - "MAIL FROM" identity to be the mailbox composed of the localpart - "postmaster" and the "HELO" identity (which may or may not have been - checked separately before). + [RFC2821] allows the reverse-path to be null (see Section 4.5.5 in + RFC 2821). In this case, there is no explicit sender mailbox, and + such a message can be assumed to be a notification message from the + mail system itself. When the reverse-path is null, this document + + + +Wong & Schlitt Experimental [Page 5] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + defines the "MAIL FROM" identity to be the mailbox composed of the + localpart "postmaster" and the "HELO" identity (which may or may not + have been checked separately before). SPF clients MUST check the "MAIL FROM" identity. SPF clients check the "MAIL FROM" identity by applying the check_host() function to the @@ -329,20 +302,12 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 that they end in "-all", or redirect to other records that do, so that a definitive determination of authorization can be made. - - - -Wong & Schlitt Expires December 8, 2005 [Page 6] - -Internet-Draft Sender Policy Framework (SPF) June 2005 - - Domain holders may publish SPF records that explicitly authorize no hosts if mail should never originate using that domain. When changing SPF records, care must be taken to ensure that there is a transition period so that the old policy remains valid until all - legitimate e-mail has been checked. + legitimate E-Mail has been checked. 2.4. Checking Authorization @@ -359,39 +324,37 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 there are cases that are known to give incorrect results. For example, almost all mailing lists rewrite the "MAIL FROM" identity (see Section 9.2), but some do not change any other identities in the - message. The scenario described in Section 9.3.1.2 is another - example. Documents that define other identities should define the - method for explicit approval. + message. The scenario described in Section 9.3, sub-section 1.2, is + another example. Documents that define other identities should + define the method for explicit approval. It is possible that mail receivers will use the SPF check as part of a larger set of tests on incoming mail. The results of other tests may influence whether or not a particular SPF check is performed. For example, finding the sending host's IP address on a local white + + + +Wong & Schlitt Experimental [Page 6] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + list may cause all other tests to be skipped and all mail from that host to be accepted. When a mail receiver decides to perform an SPF check, it MUST use a correctly-implemented check_host() function (Section 4) evaluated - with the correct parameters. While the test as a whole is optional, - once it has been decided to perform a test it must be performed as - specified so that the correct semantics are preserved between - publisher and receiver. + with the correct parameters. Although the test as a whole is + optional, once it has been decided to perform a test it must be + performed as specified so that the correct semantics are preserved + between publisher and receiver. To make the test, the mail receiver MUST evaluate the check_host() function with the arguments set as follows: <ip> - the IP address of the SMTP client that is emitting the - mail, either IPv4 or IPv6. - - - - - - -Wong & Schlitt Expires December 8, 2005 [Page 7] - -Internet-Draft Sender Policy Framework (SPF) June 2005 - + mail, either IPv4 or IPv6. <domain> - the domain portion of the "MAIL FROM" or "HELO" identity. @@ -403,18 +366,18 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 cases, check_host() is defined in Section 4.3 to return a "None" result. - While invalid, malformed, or non-existent domains cause SPF checks to - return "None" because no SPF record can be found, it has long been - the policy of many MTAs to reject e-mail from such domains, + Although invalid, malformed, or non-existent domains cause SPF checks + to return "None" because no SPF record can be found, it has long been + the policy of many MTAs to reject E-Mail from such domains, especially in the case of invalid "MAIL FROM". In order to prevent - the circumvention of SPF records, rejecting e-mail from invalid + the circumvention of SPF records, rejecting E-Mail from invalid domains should be considered. Implementations must take care to correctly extract the <domain> from the data given with the SMTP MAIL FROM command as many MTAs will - still accept such things as source routes (see [RFC2821] appendix C), - the %-hack (see [RFC1123]), and bang paths (see [RFC1983]). These - archaic features have been maliciously used to bypass security + still accept such things as source routes (see [RFC2821], Appendix + C), the %-hack (see [RFC1123]), and bang paths (see [RFC1983]). + These archaic features have been maliciously used to bypass security systems. 2.5. Interpreting the Result @@ -423,13 +386,21 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 should interpret the results of the check_host() function. The authorization check SHOULD be performed during the processing of the SMTP transaction that sends the mail. This allows errors to be - returned directly to the sending server by way of SMTP replies. + returned directly to the sending MTA by way of SMTP replies. + + + + +Wong & Schlitt Experimental [Page 7] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + Performing the authorization after the SMTP transaction has finished - may cause problems, such as: 1) It may be difficult to accurately - extract the required information from potentially deceptive headers. - 2) Legitimate e-mail may fail because the sender's policy may have - since changed. + may cause problems, such as the following: (1) It may be difficult to + accurately extract the required information from potentially + deceptive headers; (2) legitimate E-Mail may fail because the + sender's policy may have since changed. Generating non-delivery notifications to forged identities that have failed the authorization check is generally abusive and against the @@ -437,26 +408,19 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 2.5.1. None - A result of "None" means that no records were published by the - domain, or that no checkable sender domain could be determined from - the given identity. The checking software cannot ascertain whether - the client host is authorized or not. - - - -Wong & Schlitt Expires December 8, 2005 [Page 8] - -Internet-Draft Sender Policy Framework (SPF) June 2005 - + A result of "None" means that no records were published by the domain + or that no checkable sender domain could be determined from the given + identity. The checking software cannot ascertain whether or not the + client host is authorized. 2.5.2. Neutral - The domain owner has explicitly stated that they cannot or do not - want to assert whether the IP address is authorized or not. A + The domain owner has explicitly stated that he cannot or does not + want to assert whether or not the IP address is authorized. A "Neutral" result MUST be treated exactly like the "None" result; the distinction exists only for informational purposes. Treating - "Neutral" more harshly than "None" will discourage domain owners from - testing the use of SPF records (see Section 9.1). + "Neutral" more harshly than "None" would discourage domain owners + from testing the use of SPF records (see Section 9.1). 2.5.3. Pass @@ -470,7 +434,7 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 A "Fail" result is an explicit statement that the client is not authorized to use the domain in the given identity. The checking - software can choose to mark the mail based on this, or to reject the + software can choose to mark the mail based on this or to reject the mail outright. If the checking software chooses to reject the mail during the SMTP @@ -478,38 +442,38 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 [RFC2821]) and, if supported, the 5.7.1 Delivery Status Notification (DSN) code (see [RFC3464]), in addition to an appropriate reply text. The check_host() function may return either a default explanation - string, or one from the domain that published the SPF records (see - Section 6.2). If the information doesn't originate with the checking - software, it should be made clear that the text is provided by the - sender's domain. For example: + string or one from the domain that published the SPF records (see + Section 6.2). If the information does not originate with the - 550-5.7.1 SPF MAIL FROM check failed: - 550-5.7.1 The domain example.com explains: - 550 5.7.1 Please see http://www.example.com/mailpolicy.html -2.5.5. SoftFail - A "SoftFail" result should be treated as somewhere between a "Fail" - and a "Neutral". The domain believes the host isn't authorized but - isn't willing to make that strong of a statement. Receiving software - SHOULD NOT reject the message based solely on this result, but MAY - subject the message to closer scrutiny than normal. - - The domain owner wants to discourage the use of this host and so they - desire limited feedback when a "SoftFail" result occurs. For +Wong & Schlitt Experimental [Page 8] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + checking software, it should be made clear that the text is provided + by the sender's domain. For example: -Wong & Schlitt Expires December 8, 2005 [Page 9] - -Internet-Draft Sender Policy Framework (SPF) June 2005 + 550-5.7.1 SPF MAIL FROM check failed: + 550-5.7.1 The domain example.com explains: + 550 5.7.1 Please see http://www.example.com/mailpolicy.html +2.5.5. SoftFail - example, the recipient's MUA could highlight the "SoftFail" status, - or the receiving MTA could give the sender a message using a - technique called "greylisting" whereby the MTA can issue an SMTP - reply code of 451 (4.3.0 DSN code) with a note the first time the - message is received, but accept it the second time. + A "SoftFail" result should be treated as somewhere between a "Fail" + and a "Neutral". The domain believes the host is not authorized but + is not willing to make that strong of a statement. Receiving + software SHOULD NOT reject the message based solely on this result, + but MAY subject the message to closer scrutiny than normal. + + The domain owner wants to discourage the use of this host and thus + desires limited feedback when a "SoftFail" result occurs. For + example, the recipient's Mail User Agent (MUA) could highlight the + "SoftFail" status, or the receiving MTA could give the sender a + message using a technique called "greylisting" whereby the MTA can + issue an SMTP reply code of 451 (4.3.0 DSN code) with a note the + first time the message is received, but accept it the second time. 2.5.6. TempError @@ -522,54 +486,30 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 2.5.7. PermError - A "PermError" result means that the domain's published records - couldn't be correctly interpreted. This signals an error condition - that requires manual intervention to be resolved, as opposed to the + A "PermError" result means that the domain's published records could + not be correctly interpreted. This signals an error condition that + requires manual intervention to be resolved, as opposed to the TempError result. Be aware that if the domain owner uses macros (Section 8), it is possible that this result is due to the checked identities having an unexpected format. +3. SPF Records + An SPF record is a DNS Resource Record (RR) that declares which hosts + are, and are not, authorized to use a domain name for the "HELO" and + "MAIL FROM" identities. Loosely, the record partitions all hosts + into permitted and not-permitted sets (though some hosts might fall + into neither category). - - - - - - - - - - - - - - - - - - - - - - - -Wong & Schlitt Expires December 8, 2005 [Page 10] +Wong & Schlitt Experimental [Page 9] -Internet-Draft Sender Policy Framework (SPF) June 2005 - +RFC 4408 Sender Policy Framework (SPF) April 2006 -3. SPF Records - An SPF record is a DNS Resource Record (RR) that declares which hosts - are, and are not, authorized to use a domain name for the "HELO" and - "MAIL FROM" identities. Loosely, the record partitions all hosts - into permitted and not-permitted sets. (Though some hosts might fall - into neither category.) - - The SPF record is a single string of text. An example record is: + The SPF record is a single string of text. An example record is the + following: v=spf1 +mx a:colo.example.com/28 -all @@ -582,10 +522,11 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 for the hosts that are used in the "MAIL FROM" and "HELO" identities. The SPF records are placed in the DNS tree at the host name it pertains to, not a subdomain under it, such as is done with SRV - records. This is the same whether the TXT or SPF RR type is used. + records. This is the same whether the TXT or SPF RR type (see + Section 3.1.1) is used. - The example above in Section 3 might be published via this lines in a - domain zone file: + The example above in Section 3 might be published via these lines in + a domain zone file: example.com. TXT "v=spf1 +mx a:colo.example.com/28 -all" smtp-out.example.com. TXT "v=spf1 a -all" @@ -596,13 +537,9 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 3.1.1. DNS Resource Record Types - This document defines a new DNS RR of type SPF, type code to be - determined. The format of this type is identical to the TXT RR - [RFC1035]. For either type, the character content of the record is - encoded as [US-ASCII]. - - RFC Editor Note: Please add the DNS RR type code once it has been - allocated by the IANA. + This document defines a new DNS RR of type SPF, code 99. The format + of this type is identical to the TXT RR [RFC1035]. For either type, + the character content of the record is encoded as [US-ASCII]. It is recognized that the current practice (using a TXT record) is not optimal, but it is necessary because there are a number of DNS @@ -610,24 +547,26 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 the new RR type. The two-record-type scheme provides a forward path to the better solution of using an RR type reserved for this purpose. - - -Wong & Schlitt Expires December 8, 2005 [Page 11] - -Internet-Draft Sender Policy Framework (SPF) June 2005 - - An SPF-compliant domain name SHOULD have SPF records of both RR types. A compliant domain name MUST have a record of at least one type. If a domain has records of both types, they MUST have - identical content. For example, instead of just publishing one + identical content. For example, instead of publishing just one record as in Section 3.1 above, it is better to publish: example.com. IN TXT "v=spf1 +mx a:colo.example.com/28 -all" example.com. IN SPF "v=spf1 +mx a:colo.example.com/28 -all" - Example RRs in this document are shown with the TXT record type, - however they could be published with the SPF type or with both types. + + + +Wong & Schlitt Experimental [Page 10] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + Example RRs in this document are shown with the TXT record type; + however, they could be published with the SPF type or with both + types. 3.1.2. Multiple DNS Records @@ -638,7 +577,7 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 3.1.3. Multiple Strings in a Single DNS record As defined in [RFC1035] sections 3.3.14 and 3.3, a single text DNS - record (either TXT and SPF RR types) can be composed of more than one + record (either TXT or SPF RR types) can be composed of more than one string. If a published record contains multiple strings, then the record MUST be treated as if those strings are concatenated together without adding spaces. For example: @@ -649,9 +588,9 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 IN TXT "v=spf1 .... firstsecond string..." - SPF or TXT records containing multiple strings are useful in order to - construct records which would exceed the 255 byte maximum length of a - string within a single TXT or SPF RR record. + SPF or TXT records containing multiple strings are useful in + constructing records that would exceed the 255-byte maximum length of + a string within a single TXT or SPF RR record. 3.1.4. Record Size @@ -665,14 +604,6 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 DNS answers should fit in UDP packets. Note that when computing the sizes for queries of the TXT format, one must take into account any other TXT records published at the domain name. Records that are too - - - -Wong & Schlitt Expires December 8, 2005 [Page 12] - -Internet-Draft Sender Policy Framework (SPF) June 2005 - - long to fit in a single UDP packet MAY be silently ignored by SPF clients. @@ -681,10 +612,18 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 Use of wildcard records for publishing is not recommended. Care must be taken if wildcard records are used. If a domain publishes wildcard MX records, it may want to publish wildcard declarations, + + + +Wong & Schlitt Experimental [Page 11] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + subject to the same requirements and problems. In particular, the declaration must be repeated for any host that has any RR records at all, and for subdomains thereof. For example, the example given in - [RFC1034], Section 4.3.3, could be extended with: + [RFC1034], Section 4.3.3, could be extended with the following: X.COM. MX 10 A.X.COM X.COM. TXT "v=spf1 a:A.X.COM -all" @@ -707,28 +646,6 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 under the domain to exist and queries against arbitrary names will never return RCODE 3 (Name Error). - - - - - - - - - - - - - - - - - -Wong & Schlitt Expires December 8, 2005 [Page 13] - -Internet-Draft Sender Policy Framework (SPF) June 2005 - - 4. The check_host() Function The check_host() function fetches SPF records, parses them, and @@ -743,14 +660,21 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 4.1. Arguments - The function check_host() takes these arguments: + The check_host() function takes these arguments: <ip> - the IP address of the SMTP client that is emitting the - mail, either IPv4 or IPv6. + mail, either IPv4 or IPv6. <domain> - the domain that provides the sought-after authorization - information; initially the domain portion of the "MAIL FROM" - or "HELO" identity. + information; initially, the domain portion of the "MAIL + FROM" or "HELO" identity. + + + +Wong & Schlitt Experimental [Page 12] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + <sender> - the "MAIL FROM" or "HELO" identity. @@ -770,31 +694,24 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 4.3. Initial Processing - If the <domain> is malformed (label longer than 63 characters, zero - length label not at the end, etc.), is not a fully qualified domain + If the <domain> is malformed (label longer than 63 characters, zero- + length label not at the end, etc.) or is not a fully qualified domain name, or if the DNS lookup returns "domain does not exist" (RCODE 3), check_host() immediately returns the result "None". If the <sender> has no localpart, substitute the string "postmaster" for the localpart. - - -Wong & Schlitt Expires December 8, 2005 [Page 14] - -Internet-Draft Sender Policy Framework (SPF) June 2005 - - 4.4. Record Lookup - In accordance with how the records are published, see Section 3.1 - above, a DNS query needs to be made for the <domain> name, querying + In accordance with how the records are published (see Section 3.1 + above), a DNS query needs to be made for the <domain> name, querying for either RR type TXT, SPF, or both. If both SPF and TXT RRs are looked up, the queries MAY be done in parallel. - If the DNS lookup returns a server failure (RCODE 2), or other error - (RCODE other than 0 or 3), or the query times out, check_host() exits - immediately with the result "TempError". + If all DNS lookups that are made return a server failure (RCODE 2), + or other error (RCODE other than 0 or 3), or time out, then + check_host() exits immediately with the result "TempError". 4.5. Selecting Records @@ -804,19 +721,25 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 version = "v=spf1" Starting with the set of records that were returned by the lookup, - record selection proceeds in three steps: + record selection proceeds in two steps: + - 1. Records that do not begin with a version section of exactly - "v=spf1" are discarded. Note that the version section is - terminated either by a SP character or the end of the record. A - record with a version section of "v=spf10" does not match and - must be discarded. - 2. If there are both SPF and TXT records in the set and if they are - not all identical, return a "PermError". - 3. If any records of type SPF are in the set, then all records of - type TXT are discarded. + +Wong & Schlitt Experimental [Page 13] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + 1. Records that do not begin with a version section of exactly + "v=spf1" are discarded. Note that the version section is + terminated either by an SP character or the end of the record. A + record with a version section of "v=spf10" does not match and must + be discarded. + + 2. If any records of type SPF are in the set, then all records of + type TXT are discarded. After the above steps, there should be exactly one record remaining and evaluation can proceed. If there are two or more records @@ -834,13 +757,6 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 there are any syntax errors, check_host() returns immediately with the result "PermError". - - -Wong & Schlitt Expires December 8, 2005 [Page 15] - -Internet-Draft Sender Policy Framework (SPF) June 2005 - - Implementations MAY choose to parse the entire record first and return "PermError" if the record is not syntactically well formed. However, in all cases, any syntax errors anywhere in the record MUST @@ -849,7 +765,8 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 4.6.1. Term Evaluation There are two types of terms: mechanisms and modifiers. A record - contains an ordered list of these as specified in the following ABNF. + contains an ordered list of these as specified in the following + Augmented Backus-Naur Form (ABNF). terms = *( 1*SP ( directive / modifier ) ) @@ -864,15 +781,22 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 Most mechanisms allow a ":" or "/" character after the name. + + +Wong & Schlitt Experimental [Page 14] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + Modifiers always contain an equals ('=') character immediately after the name, and before any ":" or "/" characters that may be part of the macro-string. - Terms that do not contain any of "=", ":" or "/" are mechanisms, as + Terms that do not contain any of "=", ":", or "/" are mechanisms, as defined in Section 5. - As per the definition of the ABNF notation in [I-D.crocker-abnf- - rfc2234bis], mechanism and modifier names are case-insensitive. + As per the definition of the ABNF notation in [RFC4234], mechanism + and modifier names are case-insensitive. 4.6.2. Mechanisms @@ -880,22 +804,14 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 are no more mechanisms, the result is specified in Section 4.7. When a mechanism is evaluated, one of three things can happen: it can - match, it can not match, or it can throw an exception. + match, not match, or throw an exception. If it matches, processing ends and the qualifier value is returned as the result of that record. If it does not match, processing continues with the next mechanism. If it throws an exception, mechanism processing ends and the exception value is returned. - The possible qualifiers, and the results they return are: - - - - -Wong & Schlitt Expires December 8, 2005 [Page 16] - -Internet-Draft Sender Policy Framework (SPF) June 2005 - + The possible qualifiers, and the results they return are as follows: "+" Pass "-" Fail @@ -913,9 +829,20 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 4.6.3. Modifiers Modifiers are not mechanisms: they do not return match or not-match. - Instead they provide additional information. While modifiers do not - directly affect the evaluation of the record, the "redirect" modifier - has an effect after all the mechanisms have been evaluated. + Instead they provide additional information. Although modifiers do + not directly affect the evaluation of the record, the "redirect" + modifier has an effect after all the mechanisms have been evaluated. + + + + + + + +Wong & Schlitt Experimental [Page 15] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + 4.7. Default Result @@ -924,7 +851,7 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 "?all" were specified as the last directive. If there is a "redirect" modifier, check_host() proceeds as defined in Section 6.1. - Note that records SHOULD always either use a "redirect" modifier or + Note that records SHOULD always use either a "redirect" modifier or an "all" mechanism to explicitly terminate processing. For example: @@ -943,72 +870,13 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 Note: The result of the macro expansion is not subject to any further escaping. Hence, this facility cannot produce all characters that - are legal in a DNS label (e.g. the control characters). However, - this facility is powerful enough to express legal host names, and - - - -Wong & Schlitt Expires December 8, 2005 [Page 17] - -Internet-Draft Sender Policy Framework (SPF) June 2005 - - + are legal in a DNS label (e.g., the control characters). However, + this facility is powerful enough to express legal host names and common utility labels (such as "_spf") that are used in DNS. For several mechanisms, the <domain-spec> is optional. If it is not provided, the <domain> is used as the <target-name>. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Wong & Schlitt Expires December 8, 2005 [Page 18] - -Internet-Draft Sender Policy Framework (SPF) June 2005 - - 5. Mechanism Definitions This section defines two types of mechanisms. @@ -1023,6 +891,15 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 addresses as being permitted or not permitted to use the <domain> for sending mail. + + + + +Wong & Schlitt Experimental [Page 16] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + a mx ptr @@ -1034,7 +911,8 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 comparison between <ip> and an IP address at any point: If no CIDR-length is given in the directive, then <ip> and the IP - address are compared for equality. + address are compared for equality. (Here, CIDR is Classless Inter- + Domain Routing.) If a CIDR-length is specified, then only the specified number of high-order bits of <ip> and the IP address are compared for equality. @@ -1042,7 +920,7 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 When any mechanism fetches host addresses to compare with <ip>, when <ip> is an IPv4 address, A records are fetched, when <ip> is an IPv6 address, AAAA records are fetched. Even if the SMTP connection is - via IPv6, an IPv4-mapped IPv6 IP address (see [RFC3513] section + via IPv6, an IPv4-mapped IPv6 IP address (see [RFC3513], Section 2.5.5) MUST still be considered an IPv4 address. Several mechanisms rely on information fetched from DNS. For these @@ -1057,14 +935,6 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 all = "all" The "all" mechanism is a test that always matches. It is used as the - - - -Wong & Schlitt Expires December 8, 2005 [Page 19] - -Internet-Draft Sender Policy Framework (SPF) June 2005 - - rightmost mechanism in a record to provide an explicit default. For example: @@ -1074,9 +944,21 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 Mechanisms after "all" will never be tested. Any "redirect" modifier (Section 6.1) has no effect when there is an "all" mechanism. + + + + + + + +Wong & Schlitt Experimental [Page 17] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + 5.2. "include" - include = "include" ":" domain-spec + include = "include" ":" domain-spec The "include" mechanism triggers a recursive evaluation of check_host(). The domain-spec is expanded as per Section 8. Then @@ -1106,8 +988,6 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 were not permitted for either of those domains would the result be "Fail". - Whether this mechanism matches, does not match, or throws an error, - depends on the result of the recursive evaluation of check_host(): @@ -1116,11 +996,26 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 -Wong & Schlitt Expires December 8, 2005 [Page 20] + + + + + + + + + + + +Wong & Schlitt Experimental [Page 18] -Internet-Draft Sender Policy Framework (SPF) June 2005 +RFC 4408 Sender Policy Framework (SPF) April 2006 + Whether this mechanism matches, does not match, or throws an + exception depends on the result of the recursive evaluation of + check_host(): + +---------------------------------+---------------------------------+ | A recursive check_host() result | Causes the "include" mechanism | | of: | to: | @@ -1141,12 +1036,12 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 +---------------------------------+---------------------------------+ The "include" mechanism is intended for crossing administrative - boundaries. While it is possible to use includes to consolidate + boundaries. Although it is possible to use includes to consolidate multiple domains that share the same set of designated hosts, domains are encouraged to use redirects where possible, and to minimize the number of includes within a single administrative domain. For example, if example.com and example.org were managed by the same - entity, and if the permitted set of hosts for both domains were + entity, and if the permitted set of hosts for both domains was "mx:example.com", it would be possible for example.org to specify "include:example.com", but it would be preferable to specify "redirect=example.com" or even "mx:example.com". @@ -1162,43 +1057,46 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 to the returned address(es). If any address matches, the mechanism matches. -5.4. "mx" - This mechanism matches if <ip> is one of the MX hosts for a domain - name. - MX = "mx" [ ":" domain-spec ] [ dual-cidr-length ] -Wong & Schlitt Expires December 8, 2005 [Page 21] +Wong & Schlitt Experimental [Page 19] -Internet-Draft Sender Policy Framework (SPF) June 2005 +RFC 4408 Sender Policy Framework (SPF) April 2006 + +5.4. "mx" + + This mechanism matches if <ip> is one of the MX hosts for a domain + name. + + MX = "mx" [ ":" domain-spec ] [ dual-cidr-length ] check_host() first performs an MX lookup on the <target-name>. Then it performs an address lookup on each MX name returned. The <ip> is - compared to each returned IP address. To prevent DoS attacks, more - than 10 MX names MUST NOT be looked up during the evaluation of an - "mx" mechanism (see Section 10). If any address matches, the - mechanism matches. + compared to each returned IP address. To prevent Denial of Service + (DoS) attacks, more than 10 MX names MUST NOT be looked up during the + evaluation of an "mx" mechanism (see Section 10). If any address + matches, the mechanism matches. - Note regarding implicit MXes: If the <target-name> has no MX records, + Note regarding implicit MXs: If the <target-name> has no MX records, check_host() MUST NOT pretend the target is its single MX, and MUST NOT default to an A lookup on the <target-name> directly. This - behavior breaks with the legacy "implicit MX" rule. See [RFC2821] + behavior breaks with the legacy "implicit MX" rule. See [RFC2821], Section 5. If such behavior is desired, the publisher should specify an "a" directive. 5.5. "ptr" - This mechanism tests whether the DNS reverse mapping for <ip> exists + This mechanism tests whether the DNS reverse-mapping for <ip> exists and correctly points to a domain name within a particular domain. PTR = "ptr" [ ":" domain-spec ] - First the <ip>'s name is looked up using this procedure: perform a + First, the <ip>'s name is looked up using this procedure: perform a DNS reverse-mapping for <ip>, looking up the corresponding PTR record in "in-addr.arpa." if the address is an IPv4 one and in "ip6.arpa." if it is an IPv6 address. For each record returned, validate the @@ -1207,32 +1105,30 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 a "ptr" mechanism (see Section 10). If <ip> is among the returned IP addresses, then that domain name is validated. In pseudocode: - sending-domain_names := ptr_lookup(sending-host_IP); - if more than 10 sending-domain_names are found, use at most 10. - for each name in (sending-domain_names) { + sending-domain_names := ptr_lookup(sending-host_IP); if more than 10 + sending-domain_names are found, use at most 10. for each name in + (sending-domain_names) { IP_addresses := a_lookup(name); if the sending-domain_IP is one of the IP_addresses { validated-sending-domain_names += name; - } - } + } } Check all validated domain names to see if they end in the <target-name> domain. If any do, this mechanism matches. If no validated domain name can be found, or if none of the validated - domain names end in the <target-name>, this mechanism fails to match. - If a DNS error occurs while doing the PTR RR lookup, then this - mechanism fails to match. If a DNS error occurs while doing an A RR - lookup, then that domain name is skipped and the search continues. - - -Wong & Schlitt Expires December 8, 2005 [Page 22] +Wong & Schlitt Experimental [Page 20] -Internet-Draft Sender Policy Framework (SPF) June 2005 +RFC 4408 Sender Policy Framework (SPF) April 2006 + domain names end in the <target-name>, this mechanism fails to match. + If a DNS error occurs while doing the PTR RR lookup, then this + mechanism fails to match. If a DNS error occurs while doing an A RR + lookup, then that domain name is skipped and the search continues. + Pseudocode: for each name in (validated-sending-domain_names) { @@ -1242,15 +1138,15 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 return no-match. This mechanism matches if the <target-name> is either an ancestor of - a validated domain name, or if the <target-name> and a validated + a validated domain name or if the <target-name> and a validated domain name are the same. For example: "mail.example.com" is within the domain "example.com", but "mail.bad-example.com" is not. - Note: Use of this mechanism is discouraged because it is slow, is not - as reliable as other mechanisms in cases of DNS errors and it places - a large burden on the arpa name servers. If used, proper PTR records - must be in place for the domain's hosts and the "ptr" mechanism - should be one of the last mechanisms checked. + Note: Use of this mechanism is discouraged because it is slow, it is + not as reliable as other mechanisms in cases of DNS errors, and it + places a large burden on the arpa name servers. If used, proper PTR + records must be in place for the domain's hosts and the "ptr" + mechanism should be one of the last mechanisms checked. 5.6. "ip4" and "ip6" @@ -1270,25 +1166,25 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 / "1" 2DIGIT ; 100-199 / "2" %x30-34 DIGIT ; 200-249 / "25" %x30-35 ; 250-255 - ; as per conventional dotted quad notation. e.g. 192.0.2.0 + ; as per conventional dotted quad notation. e.g., 192.0.2.0 ip6-network = <as per [RFC 3513], section 2.2> - ; e.g. 2001:DB8::CD30 + ; e.g., 2001:DB8::CD30 The <ip> is compared to the given network. If CIDR-length high-order bits match, the mechanism matches. - If ip4-cidr-length is omitted it is taken to be "/32". If - ip6-cidr-length is omitted it is taken to be "/128". It is not - permitted to omit parts of the IP address instead of using CIDR - notations. That is, use 192.0.2.0/24 instead of 192.0.2. - -Wong & Schlitt Expires December 8, 2005 [Page 23] +Wong & Schlitt Experimental [Page 21] -Internet-Draft Sender Policy Framework (SPF) June 2005 +RFC 4408 Sender Policy Framework (SPF) April 2006 + If ip4-cidr-length is omitted, it is taken to be "/32". If + ip6-cidr-length is omitted, it is taken to be "/128". It is not + permitted to omit parts of the IP address instead of using CIDR + notations. That is, use 192.0.2.0/24 instead of 192.0.2. + 5.7. "exists" This mechanism is used to construct an arbitrary domain name that is @@ -1300,7 +1196,7 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 The domain-spec is expanded as per Section 8. The resulting domain name is used for a DNS A RR lookup. If any A record is returned, - this mechanism matches. The lookup type is 'A' even when the + this mechanism matches. The lookup type is A even when the connection type is IPv6. Domains can use this mechanism to specify arbitrarily complex @@ -1315,36 +1211,6 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 This mechanism enables queries that mimic the style of tests that existing anti-spam DNS blacklists (DNSBL) use. - - - - - - - - - - - - - - - - - - - - - - - - - -Wong & Schlitt Expires December 8, 2005 [Page 24] - -Internet-Draft Sender Policy Framework (SPF) June 2005 - - 6. Modifier Definitions Modifiers are name/value pairs that provide additional information. @@ -1361,6 +1227,15 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 gracefully handle records with modifiers that are defined in other specifications. + + + + +Wong & Schlitt Experimental [Page 22] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + 6.1. redirect: Redirected Query If all mechanisms fail to match, and a "redirect" modifier is @@ -1393,21 +1268,13 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 the same record. This can be an administrative advantage. Note: In general, the domain "A" cannot reliably use a redirect to - - - -Wong & Schlitt Expires December 8, 2005 [Page 25] - -Internet-Draft Sender Policy Framework (SPF) June 2005 - - another domain "B" not under the same administrative control. Since the <sender> stays the same, there is no guarantee that the record at domain "B" will correctly work for mailboxes in domain "A", especially if domain "B" uses mechanisms involving localparts. An "include" directive may be more appropriate. - For clarity it is RECOMMENDED that any "redirect" modifier appear as + For clarity, it is RECOMMENDED that any "redirect" modifier appear as the very last term in a record. 6.2. exp: Explanation @@ -1417,6 +1284,14 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 If check_host() results in a "Fail" due to a mechanism match (such as "-all"), and the "exp" modifier is present, then the explanation string returned is computed as described below. If no "exp" modifier + + + +Wong & Schlitt Experimental [Page 23] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + is present, then either a default explanation string or an empty explanation string may be returned. @@ -1429,41 +1304,34 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 explanation string, then proceed as if no exp modifier was given. The fetched TXT record's strings are concatenated with no spaces, and - then treated as an <explain-string> which is macro-expanded. This + then treated as an <explain-string>, which is macro-expanded. This final result is the explanation string. Implementations MAY limit the length of the resulting explanation string to allow for other protocol constraints and/or reasonable processing limits. Since the explanation string is intended for an SMTP response and [RFC2821] - section 2.4 says that responses are in [US-ASCII], the explanation + Section 2.4 says that responses are in [US-ASCII], the explanation string is also limited to US-ASCII. Software evaluating check_host() can use this string to communicate information from the publishing domain in the form of a short message or URL. Software SHOULD make it clear that the explanation string comes from a third party. For example, it can prepend the macro - string "%{o} explains: " to the explanation, such as shown in - Section 2.5.4. + string "%{o} explains: " to the explanation, such as shown in Section + 2.5.4. Suppose example.com has this record: v=spf1 mx -all exp=explain._spf.%{d} Here are some examples of possible explanation TXT records at - - - -Wong & Schlitt Expires December 8, 2005 [Page 26] - -Internet-Draft Sender Policy Framework (SPF) June 2005 - - explain._spf.example.com: + "Mail from example.com should only be sent by its own servers." -- a simple, constant message "%{i} is not one of %{d}'s designated mail servers." - -- a message with a little more info, including the IP address - that failed the check + -- a message with a little more information, including the IP + address that failed the check "See http://%{d}/why.html?s=%{S}&i=%{I}" -- a complicated example that constructs a URL with the @@ -1472,63 +1340,33 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 Note: During recursion into an "include" mechanism, an exp= modifier from the <target-name> MUST NOT be used. In contrast, when executing - a "redirect" modifier, an exp= modifier from the original domain MUST - NOT be used. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Wong & Schlitt Expires December 8, 2005 [Page 27] +Wong & Schlitt Experimental [Page 24] -Internet-Draft Sender Policy Framework (SPF) June 2005 +RFC 4408 Sender Policy Framework (SPF) April 2006 -7. The Received-SPF header field + a "redirect" modifier, an exp= modifier from the original domain MUST + NOT be used. + +7. The Received-SPF Header Field It is RECOMMENDED that SMTP receivers record the result of SPF - processing in the message headers. If an SMTP receiver chooses to do - so, it SHOULD use the "Received-SPF" header defined here for each - identity that was checked. This information is intended for the + processing in the message header. If an SMTP receiver chooses to do + so, it SHOULD use the "Received-SPF" header field defined here for + each identity that was checked. This information is intended for the recipient. (Information intended for the sender is described in Section 6.2, Explanation.) - The Received-SPF header is a trace field (see [RFC2822] section - 3.6.7) and SHOULD be prepended to existing headers, above the - Received: header that is generated by the SMTP receiver. It MUST - appear above any other Received-SPF headers in the message. The - header has the format: + The Received-SPF header field is a trace field (see [RFC2822] Section + 3.6.7) and SHOULD be prepended to the existing header, above the + Received: field that is generated by the SMTP receiver. It MUST + appear above all other Received-SPF fields in the message. The + header field has the following format: - header = "Received-SPF:" [CFWS] result FWS [comment FWS] + header-field = "Received-SPF:" [CFWS] result FWS [comment FWS] [ key-value-list ] CRLF result = "Pass" / "Fail" / "SoftFail" / "Neutral" / @@ -1554,22 +1392,22 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 FWS = <folding white space as per [RFC2822]> CRLF = <standard end-of-line token as per [RFC2822]> - The header SHOULD include a "(...)" style <comment> after the result, - conveying supporting information for the result, such as <ip>, - <sender> and <domain>. + The header field SHOULD include a "(...)" style <comment> after the + result, conveying supporting information for the result, such as + <ip>, <sender>, and <domain>. - The following key-value pairs are designed for later machine parsing. - SPF clients SHOULD give enough information so that the SPF results - can be verified. That is, at least the "client-ip", "helo", and, if -Wong & Schlitt Expires December 8, 2005 [Page 28] +Wong & Schlitt Experimental [Page 25] -Internet-Draft Sender Policy Framework (SPF) June 2005 +RFC 4408 Sender Policy Framework (SPF) April 2006 - the "MAIL FROM" identity was checked, the "envelope-from". + The following key-value pairs are designed for later machine parsing. + SPF clients SHOULD give enough information so that the SPF results + can be verified. That is, at least "client-ip", "helo", and, if the + "MAIL FROM" identity was checked, "envelope-from". client-ip the IP address of the SMTP client @@ -1578,30 +1416,30 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 helo the host name given in the HELO or EHLO command mechanism the mechanism that matched (if no mechanisms matched, - substitute the word "default".) + substitute the word "default") problem if an error was returned, details about the error receiver the host name of the SPF client - identity the identity that was checked, see the <identity> ABNF - rule. + identity the identity that was checked; see the <identity> ABNF + rule Other keys may be defined by SPF clients. Until a new key name becomes widely accepted, new key names should start with "x-". - SPF clients MUST make sure that the Received-SPF header does not - contain invalid characters, is not excessively long, and does not + SPF clients MUST make sure that the Received-SPF header field does + not contain invalid characters, is not excessively long, and does not contain malicious data that has been provided by the sender. - Examples of various header styles that could be generated: + Examples of various header styles that could be generated are the + following: Received-SPF: Pass (mybox.example.org: domain of myname@example.com designates 192.0.2.1 as permitted sender) receiver=mybox.example.org; client-ip=192.0.2.1; envelope-from=<myname@example.com>; helo=foo.example.com; - Received-SPF: Fail (mybox.example.org: domain of myname@example.com does not designate 192.0.2.1 as permitted sender) @@ -1617,26 +1455,25 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 - - - -Wong & Schlitt Expires December 8, 2005 [Page 29] +Wong & Schlitt Experimental [Page 26] -Internet-Draft Sender Policy Framework (SPF) June 2005 +RFC 4408 Sender Policy Framework (SPF) April 2006 8. Macros -8.1. Macro definitions +8.1. Macro Definitions Many mechanisms and modifiers perform macro expansion on part of the term. domain-spec = macro-string domain-end - domain-end = ( "." toplabel ) / macro-expand + domain-end = ( "." toplabel [ "." ] ) / macro-expand - toplabel = ALPHA / ALPHA *[ alphanum / "-" ] alphanum - ; LDH rule (See [RFC3696]) + toplabel = ( *alphanum ALPHA *alphanum ) / + ( 1*alphanum "-" *( alphanum / "-" ) alphanum ) + ; LDH rule plus additional TLD restrictions + ; (see [RFC3696], Section 2) alphanum = ALPHA / DIGIT explain-string = *( macro-string / SP ) @@ -1654,7 +1491,7 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 A literal "%" is expressed by "%%". "%_" expands to a single " " space. - "%-" expands to a URL-encoded space, viz. "%20". + "%-" expands to a URL-encoded space, viz., "%20". The following macro letters are expanded in term arguments: @@ -1667,22 +1504,26 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 v = the string "in-addr" if <ip> is ipv4, or "ip6" if <ip> is ipv6 h = HELO/EHLO domain - The following macro letters are only allowed in "exp" text: - c = SMTP client IP (easily readable format) - r = domain name of host performing the check - t = current timestamp -Wong & Schlitt Expires December 8, 2005 [Page 30] + + +Wong & Schlitt Experimental [Page 27] -Internet-Draft Sender Policy Framework (SPF) June 2005 +RFC 4408 Sender Policy Framework (SPF) April 2006 + The following macro letters are allowed only in "exp" text: + + c = SMTP client IP (easily readable format) + r = domain name of host performing the check + t = current timestamp + A '%' character not followed by a '{', '%', '-', or '_' character is - a syntax error. So, + a syntax error. So -exists:%(ir).sbl.spamhaus.example.org @@ -1691,7 +1532,7 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 -exists:%{ir}.sbl.spamhaus.example.org - Optional transformers are: + Optional transformers are the following: *DIGIT = zero or more digits 'r' = reverse value, splitting on dots by default @@ -1702,9 +1543,12 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 using "." and not the original splitting characters. By default, strings are split on "." (dots). Note that no special - treatment is given to leading, trailing or consecutive delimiters, - and so the list of parts may contain empty strings. Macros may - specify delimiter characters which are used instead of ".". + treatment is given to leading, trailing, or consecutive delimiters, + and so the list of parts may contain empty strings. Older + implementations of SPF prohibit trailing dots in domain names, so + trailing dots should not be published by domain owners, although they + must be accepted by implementations conforming to this document. + Macros may specify delimiter characters that are used instead of ".". The 'r' transformer indicates a reversal operation: if the client IP address were 192.0.2.1, the macro %{i} would expand to "192.0.2.1" @@ -1719,48 +1563,49 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 support at least a value of 128, as that is the maximum number of labels in a domain name. - The "s" macro expands to the <sender> argument. It is an e-mail - address with a localpart, an "@" character, and a domain. The "l" - macro expands to just the localpart. The "o" macro expands to just - the domain part. Note that these values remain the same during - recursive and chained evaluations due to "include" and/or "redirect". - Note also that if the original <sender> had no localpart, the - localpart was set to "postmaster" in initial processing (see - Section 4.3). - For IPv4 addresses, both the "i" and "c" macros expand to the -Wong & Schlitt Expires December 8, 2005 [Page 31] +Wong & Schlitt Experimental [Page 28] -Internet-Draft Sender Policy Framework (SPF) June 2005 +RFC 4408 Sender Policy Framework (SPF) April 2006 + The "s" macro expands to the <sender> argument. It is an E-Mail + address with a localpart, an "@" character, and a domain. The "l" + macro expands to just the localpart. The "o" macro expands to just + the domain part. Note that these values remain the same during + recursive and chained evaluations due to "include" and/or "redirect". + Note also that if the original <sender> had no localpart, the + localpart was set to "postmaster" in initial processing (see Section + 4.3). + + For IPv4 addresses, both the "i" and "c" macros expand to the standard dotted-quad format. For IPv6 addresses, the "i" macro expands to a dot-format address; it is intended for use in %{ir}. The "c" macro may expand to any of the - hexadecimal colon-format addresses specified in [RFC3513] section + hexadecimal colon-format addresses specified in [RFC3513], Section 2.2. It is intended for humans to read. The "p" macro expands to the validated domain name of <ip>. The - procedure for finding the validated domain name is defined in - Section 5.5. If the <domain> is present in the list of validated - domains, it SHOULD be used. Otherwise, if a subdomain of the - <domain> is present, it SHOULD be used. Otherwise, any name from the - list may be used. If there are no validated domain names or if a DNS - error occurs, the string "unknown" is used. + procedure for finding the validated domain name is defined in Section + 5.5. If the <domain> is present in the list of validated domains, it + SHOULD be used. Otherwise, if a subdomain of the <domain> is + present, it SHOULD be used. Otherwise, any name from the list may be + used. If there are no validated domain names or if a DNS error + occurs, the string "unknown" is used. The "r" macro expands to the name of the receiving MTA. This SHOULD be a fully qualified domain name, but if one does not exist (as when the checking is done by a MUA) or if policy restrictions dictate otherwise, the word "unknown" SHOULD be substituted. The domain name - may be different than the name found in the MX record that the client + may be different from the name found in the MX record that the client MTA used to locate the receiving MTA. The "t" macro expands to the decimal representation of the - approximate number of seconds since the Epoch (Midnight, January 1st, + approximate number of seconds since the Epoch (Midnight, January 1, 1970, UTC). This is the same value as is returned by the POSIX time() function in most standards-compliant libraries. @@ -1770,34 +1615,35 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 successive domain labels until the total length does not exceed 253 characters. - Uppercased macros expand exactly as their lower case equivalents, and + Uppercased macros expand exactly as their lowercased equivalents, and are then URL escaped. URL escaping must be performed for characters not in the "uric" set, which is defined in [RFC3986]. + + + + +Wong & Schlitt Experimental [Page 29] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + Note: Care must be taken so that macro expansion for legitimate - e-mail does not exceed the 63 character limit on DNS labels. The - localpart of e-mail addresses, in particular, can have more than 63 + E-Mail does not exceed the 63-character limit on DNS labels. The + localpart of E-Mail addresses, in particular, can have more than 63 characters between dots. Note: Domains should avoid using the "s", "l", "o", or "h" macros in - conjunction with any mechanism directive. While these macros are + conjunction with any mechanism directive. Although these macros are powerful and allow per-user records to be published, they severely limit the ability of implementations to cache results of check_host() and they reduce the effectiveness of DNS caches. - - - -Wong & Schlitt Expires December 8, 2005 [Page 32] - -Internet-Draft Sender Policy Framework (SPF) June 2005 - - Implementations should be aware that if no directive processed during - the evaluation of check_host() contains an "s", "l", "o" or "h" + the evaluation of check_host() contains an "s", "l", "o", or "h" macro, then the results of the evaluation can be cached on the basis - of <domain> and <ip> alone for as long as the shortest TTL of all the - DNS records involved. + of <domain> and <ip> alone for as long as the shortest Time To Live + (TTL) of all the DNS records involved. 8.2. Expansion Examples @@ -1806,7 +1652,6 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 The IPv6 SMTP client IP is 2001:DB8::CB01. The PTR domain name of the client IP is mx.example.org. - macro expansion ------- ---------------------------- %{s} strong-bad@email.example.com @@ -1824,6 +1669,21 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 %{lr-} bad.strong %{l1r-} strong + + + + + + + + + + +Wong & Schlitt Experimental [Page 30] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + macro-string expansion -------------------------------------------------------------------- %{ir}.%{v}._spf.%{d2} 3.2.0.192.in-addr._spf.example.com @@ -1842,21 +1702,14 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 %{ir}.%{v}._spf.%{d2} 1.0.B.C.0.0.0.0. 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.B.D.0.1.0.0.2.ip6._spf.example.com - - -Wong & Schlitt Expires December 8, 2005 [Page 33] - -Internet-Draft Sender Policy Framework (SPF) June 2005 - - 9. Implications This section outlines the major implications that adoption of this - document will have on various entities involved in Internet e-mail. + document will have on various entities involved in Internet E-Mail. It is intended to make clear to the reader where this document knowingly affects the operation of such entities. This section is - not a "how-to" manual, nor a "best practices" document, and is not a - comprehensive list of what such entities should do in light of this + not a "how-to" manual, or a "best practices" document, and it is not + a comprehensive list of what such entities should do in light of this document. This section is non-normative. @@ -1876,15 +1729,26 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 v=spf1 exists:_h.%{h}._l.%{l}._o.%{o}._i.%{i}._spf.%{d} ?all + + + + + + +Wong & Schlitt Experimental [Page 31] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + 9.2. Mailing Lists Mailing lists must be aware of how they re-inject mail that is sent to the list. Mailing lists MUST comply with the requirements in - [RFC2821] Section 3.10 and [RFC1123] Section 5.3.6 that say that the - reverse-path MUST be changed to be the mailbox of a person or other - entity who administers the list. While the reasons for changing the - reverse-path are many and long standing, SPF adds enforcement to this - requirement. + [RFC2821], Section 3.10, and [RFC1123], Section 5.3.6, that say that + the reverse-path MUST be changed to be the mailbox of a person or + other entity who administers the list. Whereas the reasons for + changing the reverse-path are many and long-standing, SPF adds + enforcement to this requirement. In practice, almost all mailing list software in use already complies with this requirement. Mailing lists that do not comply may or may @@ -1897,129 +1761,125 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 Forwarding services take mail that is received at a mailbox and direct it to some external mailbox. At the time of this writing, the - - - -Wong & Schlitt Expires December 8, 2005 [Page 34] - -Internet-Draft Sender Policy Framework (SPF) June 2005 - - near-universal practice of such services is to use the original "MAIL FROM" of a message when re-injecting it for delivery to the external mailbox. [RFC1123] and [RFC2821] describe this action as an "alias" - rather than a "mail list". This means the external mailbox's MTA - sees all such mail in a connection from a host of the forwarding + rather than a "mail list". This means that the external mailbox's + MTA sees all such mail in a connection from a host of the forwarding service, and so the "MAIL FROM" identity will not, in general, pass authorization. There are three places that techniques can be used to ameliorate this problem. - 1. The beginning, when e-mail is first sent. + 1. The beginning, when E-Mail is first sent. - 1. "Neutral" results could be given for IP addresses that may be - forwarders, instead of "Fail" results. For example: + 1. "Neutral" results could be given for IP addresses that may be + forwarders, instead of "Fail" results. For example: - "v=spf1 mx -exists:%{ir}.sbl.spamhaus.example.org ?all" + "v=spf1 mx -exists:%{ir}.sbl.spamhaus.example.org ?all" - This would cause a lookup on an anti-spam DNS blocklist - (DNSBL) and cause a result of "Fail" only for e-mail coming - from listed sources. All other e-mail, including e-mail sent - through forwarders, would receive a "Neutral" result. By - checking the DNSBL after the known good sources, problems - with incorrect listing on the DNSBL are greatly reduced. + This would cause a lookup on an anti-spam DNS blacklist + (DNSBL) and cause a result of "Fail" only for E-Mail coming + from listed sources. All other E-Mail, including E-Mail sent + through forwarders, would receive a "Neutral" result. By + checking the DNSBL after the known good sources, problems with + incorrect listing on the DNSBL are greatly reduced. - 2. The "MAIL FROM" identity could have additional information in - the localpart that cryptographically identifies the mail as - coming from an authorized source. In this case, such an SPF - record could be used: - "v=spf1 mx exists:%{l}._spf_verify.%{d} -all" - Then, a specialized DNS server can be set up to serve the - _spf_verify subdomain which validates the localpart. While - this requires an extra DNS lookup, this only happens when the - e-mail would otherwise be rejected as not coming from a known - good source. - Note that due to the 63 character limit for domain labels, - this approach only works reliably if the localpart signature - scheme is guaranteed either to only produce localparts with a - maximum of 63 characters or to gracefully handle truncated - localparts. - 3. Similarly, a specialized DNS server could be set up that will - rate-limit the e-mail coming from unexpected IP addresses. +Wong & Schlitt Experimental [Page 32] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + 2. The "MAIL FROM" identity could have additional information in + the localpart that cryptographically identifies the mail as + coming from an authorized source. In this case, such an SPF + record could be used: + "v=spf1 mx exists:%{l}._spf_verify.%{d} -all" -Wong & Schlitt Expires December 8, 2005 [Page 35] - -Internet-Draft Sender Policy Framework (SPF) June 2005 + Then, a specialized DNS server can be set up to serve the + _spf_verify subdomain that validates the localpart. Although + this requires an extra DNS lookup, this happens only when the + E-Mail would otherwise be rejected as not coming from a known + good source. + Note that due to the 63-character limit for domain labels, + this approach only works reliably if the localpart signature + scheme is guaranteed either to only produce localparts with a + maximum of 63 characters or to gracefully handle truncated + localparts. - "v=spf1 mx exists:%{ir}._spf_rate.%{d} -all" + 3. Similarly, a specialized DNS server could be set up that will + rate-limit the E-Mail coming from unexpected IP addresses. - 4. SPF allows the creation of per-user policies for special - cases. For example, the following SPF record and appropriate - wildcard DNS records can be used: + "v=spf1 mx exists:%{ir}._spf_rate.%{d} -all" - "v=spf1 mx redirect=%{l1r+}._at_.%{o}._spf.%{d}" + 4. SPF allows the creation of per-user policies for special + cases. For example, the following SPF record and appropriate + wildcard DNS records can be used: - 2. The middle, when e-mail is forwarded. + "v=spf1 mx redirect=%{l1r+}._at_.%{o}._spf.%{d}" - 1. Forwarding services can solve the problem by rewriting the - "MAIL FROM" to be in their own domain. This means that mail - bounced from the external mailbox will have to be re-bounced - by the forwarding service. Various schemes to do this exist - though they vary widely in complexity and resource - requirements on the part of the forwarding service. + 2. The middle, when E-Mail is forwarded. - 2. Several popular MTAs can be forced from "alias" semantics to - "mailing list" semantics by configuring an additional alias - with "owner-" prepended to the original alias name (e.g. an - alias of "friends: george@example.com, fred@example.org" - would need another alias of the form "owner-friends: - localowner"). + 1. Forwarding services can solve the problem by rewriting the + "MAIL FROM" to be in their own domain. This means that mail + bounced from the external mailbox will have to be re-bounced + by the forwarding service. Various schemes to do this exist + though they vary widely in complexity and resource + requirements on the part of the forwarding service. - 3. The end, when e-mail is received. + 2. Several popular MTAs can be forced from "alias" semantics to + "mailing list" semantics by configuring an additional alias + with "owner-" prepended to the original alias name (e.g., an + alias of "friends: george@example.com, fred@example.org" would + need another alias of the form "owner-friends: localowner"). - 1. If the owner of the external mailbox wishes to trust the - forwarding service, they can direct the external mailbox's - MTA to skip SPF tests when the client host belongs to the - forwarding service. - 2. Tests against other identities, such as the "HELO" identity, - may be used to override a failed test against the "MAIL FROM" - identity. - 3. For larger domains, it may not be possible to have a complete - or accurate list of forwarding services used by the owners of - the domain's mailboxes. In such cases, whitelists of - generally-recognized forwarding services could be employed. -9.4. Mail Services - - Service providers that offer mail services to third-party domains, - such as sending of bulk mail, may have to adjust their setup in light - of the authorization check described in this document. If the "MAIL - FROM" identity used for such e-mail uses the domain of the service - provider, then the provider needs only to ensure that their sending - host is authorized by their own SPF record, if any. -Wong & Schlitt Expires December 8, 2005 [Page 36] +Wong & Schlitt Experimental [Page 33] -Internet-Draft Sender Policy Framework (SPF) June 2005 +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + 3. The end, when E-Mail is received. + 1. If the owner of the external mailbox wishes to trust the + forwarding service, he can direct the external mailbox's MTA + to skip SPF tests when the client host belongs to the + forwarding service. + + 2. Tests against other identities, such as the "HELO" identity, + may be used to override a failed test against the "MAIL FROM" + identity. + + 3. For larger domains, it may not be possible to have a complete + or accurate list of forwarding services used by the owners of + the domain's mailboxes. In such cases, whitelists of + generally-recognized forwarding services could be employed. + +9.4. Mail Services + + Service providers that offer mail services to third-party domains, + such as sending of bulk mail, may want to adjust their setup in light + of the authorization check described in this document. If the "MAIL + FROM" identity used for such E-Mail uses the domain of the service + provider, then the provider needs only to ensure that its sending + host is authorized by its own SPF record, if any. If the "MAIL FROM" identity does not use the mail service provider's domain, then extra care must be taken. The SPF record format has - several options for the third party domain to authorize the service + several options for the third-party domain to authorize the service provider's MTAs to send mail on its behalf. For mail service providers, such as ISPs, that have a wide variety of customers using the same MTA, steps should be taken to prevent cross-customer forgery @@ -2028,7 +1888,7 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 9.5. MTA Relays The authorization check generally precludes the use of arbitrary MTA - relays between sender and receiver of an e-mail message. + relays between sender and receiver of an E-Mail message. Within an organization, MTA relays can be effectively deployed. However, for purposes of this document, such relays are effectively @@ -2040,57 +1900,41 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 these are just the border MTAs as internal MTAs simply forward mail to these MTAs for delivery. - Mail receivers will generally want to perform the authorization check - at the border MTAs, specifically including all secondary MXes. This - allows mail that fails to be rejected during the SMTP session rather - than bounced. Internal MTAs then do not perform the authorization - test. To perform the authorization test other than at the border, - the host that first transferred the message to the organization must - be determined, which can be difficult to extract from headers. - Testing other than at the border is not recommended. - - - - - - - - - - - - - - - - - -Wong & Schlitt Expires December 8, 2005 [Page 37] +Wong & Schlitt Experimental [Page 34] -Internet-Draft Sender Policy Framework (SPF) June 2005 +RFC 4408 Sender Policy Framework (SPF) April 2006 + Mail receivers will generally want to perform the authorization check + at the border MTAs, specifically including all secondary MXs. This + allows mail that fails to be rejected during the SMTP session rather + than bounced. Internal MTAs then do not perform the authorization + test. To perform the authorization test other than at the border, + the host that first transferred the message to the organization must + be determined, which can be difficult to extract from the message + header. Testing other than at the border is not recommended. + 10. Security Considerations 10.1. Processing Limits - As with most aspects of e-mail, there are a number of ways that - malicious parties could use the protocol as an avenue for a Denial- - of-Service (DoS) attack. The processing limits outlined here are - designed to prevent attacks such as: + As with most aspects of E-Mail, there are a number of ways that + malicious parties could use the protocol as an avenue for a + Denial-of-Service (DoS) attack. The processing limits outlined here + are designed to prevent attacks such as the following: o A malicious party could create an SPF record with many references - to a victim's domain and send many e-mails to different SPF + to a victim's domain and send many E-Mails to different SPF clients; those SPF clients would then create a DoS attack. In effect, the SPF clients are being used to amplify the attacker's bandwidth by using fewer bytes in the SMTP session than are used by the DNS queries. Using SPF clients also allows the attacker to hide the true source of the attack. - o While implementations of check_host() are supposed to limit the + o Whereas implementations of check_host() are supposed to limit the number of DNS lookups, malicious domains could publish records that exceed these limits in an attempt to waste computation effort at their targets when they send them mail. Malicious domains @@ -2107,28 +1951,28 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 the easiest for a DoS attack to effectively exploit. As a result, limits that may seem reasonable for an individual mail server can still allow an unreasonable amount of bandwidth amplification. - Therefore the processing limits need to be quite low. + Therefore, the processing limits need to be quite low. SPF implementations MUST limit the number of mechanisms and modifiers that do DNS lookups to at most 10 per SPF check, including any lookups caused by the use of the "include" mechanism or the + + + +Wong & Schlitt Experimental [Page 35] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + "redirect" modifier. If this number is exceeded during a check, a PermError MUST be returned. The "include", "a", "mx", "ptr", and "exists" mechanisms as well as the "redirect" modifier do count - against this limit. The "all", "ip4" and "ip6" mechanisms do not + against this limit. The "all", "ip4", and "ip6" mechanisms do not require DNS lookups and therefore do not count against this limit. The "exp" modifier does not count against this limit because the DNS lookup to fetch the explanation string occurs after the SPF record has been evaluated. - - - -Wong & Schlitt Expires December 8, 2005 [Page 38] - -Internet-Draft Sender Policy Framework (SPF) June 2005 - - When evaluating the "mx" and "ptr" mechanisms, or the %{p} macro, there MUST be a limit of no more than 10 MX or PTR RRs looked up and checked. @@ -2136,8 +1980,8 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 SPF implementations SHOULD limit the total amount of data obtained from the DNS queries. For example, when DNS over TCP or EDNS0 are available, there may need to be an explicit limit to how much data - will be accepted to prevent excessive bandwidth usage or memory - usage, and DoS attacks. + will be accepted to prevent excessive bandwidth usage or memory usage + and DoS attacks. MTAs or other processors MAY also impose a limit on the maximum amount of elapsed time to evaluate check_host(). Such a limit SHOULD @@ -2151,7 +1995,7 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 that require less DNS information and placing lower-cost mechanisms earlier in the SPF record. - For example, consider a domain set up as: + For example, consider a domain set up as follows: example.com. IN MX 10 mx.example.com. mx.example.com. IN A 192.0.2.1 @@ -2161,32 +2005,32 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 Evaluating check_host() for the domain "a.example.com" requires the MX records for "example.com", and then the A records for the listed - hosts. Evaluating for "b.example.com" only requires the A records. + hosts. Evaluating for "b.example.com" requires only the A records. Evaluating for "c.example.com" requires none. However, there may be administrative considerations: using "a" over "ip4" allows hosts to be renumbered easily. Using "mx" over "a" allows the set of mail hosts to be changed easily. -10.2. SPF-Authorized E-Mail May Be UBE - The "MAIL FROM" and "HELO" identity authorizations must not be - construed to provide more assurance than they do. It is entirely - possible for a malicious sender to inject a message using their own - domain in the identities used by SPF, to have that domain's SPF - record authorize the sending host, and yet the message content can - easily claim other identities in the headers. Unless the user or the - MUA takes care to note that the authorized identity does not match - -Wong & Schlitt Expires December 8, 2005 [Page 39] +Wong & Schlitt Experimental [Page 36] -Internet-Draft Sender Policy Framework (SPF) June 2005 +RFC 4408 Sender Policy Framework (SPF) April 2006 + +10.2. SPF-Authorized E-Mail May Contain Other False Identities - the other more commonly-presented identities (such as the From: - header), the user may be lulled into a false sense of security. + The "MAIL FROM" and "HELO" identity authorizations must not be + construed to provide more assurance than they do. It is entirely + possible for a malicious sender to inject a message using his own + domain in the identities used by SPF, to have that domain's SPF + record authorize the sending host, and yet the message can easily + list other identities in its header. Unless the user or the MUA + takes care to note that the authorized identity does not match the + other more commonly-presented identities (such as the From: header + field), the user may be lulled into a false sense of security. 10.3. Spoofed DNS and IP Data @@ -2198,7 +2042,7 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 check_host() to see spoofed DNS data, and then return incorrect results. This could include returning "Pass" for an <ip> value where the actual domain's record would evaluate to "Fail". See - [RFC3833] for a description of the DNS weaknesses. + [RFC3833] for a description of DNS weaknesses. o The client IP address, <ip>, is assumed to be correct. A malicious attacker could spoof TCP sequence numbers to make mail @@ -2208,39 +2052,42 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 10.4. Cross-User Forgery By definition, SPF policies just map domain names to sets of - authorized MTAs, not whole e-mail addresses to sets of authorized + authorized MTAs, not whole E-Mail addresses to sets of authorized users. Although the "l" macro (Section 8) provides a limited way to - define individual sets of authorized MTAs for specific e-mail + define individual sets of authorized MTAs for specific E-Mail addresses, it is generally impossible to verify, through SPF, the use - of specific e-mail addresses by individual users of the same MTA. + of specific E-Mail addresses by individual users of the same MTA. + + It is up to mail services and their MTAs to directly prevent + cross-user forgery: based on SMTP AUTH ([RFC2554]), users should be + restricted to using only those E-Mail addresses that are actually + under their control (see [RFC4409], Section 6.1). Another means to + verify the identity of individual users is message cryptography such + as PGP ([RFC2440]) or S/MIME ([RFC3851]). + + + + + + + +Wong & Schlitt Experimental [Page 37] + +RFC 4408 Sender Policy Framework (SPF) April 2006 - It is up to mail services and their MTAs to directly prevent cross- - user forgery: based on SMTP AUTH ([RFC2554]), users should be - restricted to using only those e-mail addresses that are actually - under their control (see [I-D.gellens-submit-bis] section 6.1). - Another means to verify the identity of individual users is message - cryptography such as PGP ([RFC2440]) or S/MIME ([RFC3851]). 10.5. Untrusted Information Sources SPF uses information supplied by third parties, such as the "HELO" domain name, the "MAIL FROM" address, and SPF records. This - information is then passed to the receiver in the Received-SPF: mail - headers and possibly returned to the client MTA in the form of an - SMTP rejection message. This information must be checked for invalid + information is then passed to the receiver in the Received-SPF: trace + fields and possibly returned to the client MTA in the form of an SMTP + rejection message. This information must be checked for invalid characters and excessively long lines. When the authorization check fails, an explanation string may be included in the reject response. Both the sender and the rejecting receiver need to be aware that the explanation was determined by the - - - -Wong & Schlitt Expires December 8, 2005 [Page 40] - -Internet-Draft Sender Policy Framework (SPF) June 2005 - - publisher of the SPF record checked and, in general, not the receiver. The explanation may contain malicious URLs, or it may be offensive or misleading. @@ -2252,62 +2099,39 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 someone other than the actual sender, the only people who see malicious explanation strings are people whose messages claim to be from domains that publish such strings in their SPF records. In - practice DSNs can be misdirected, such as when an MTA accepts an - e-mail and then later generates a DSN to a forged address, or when an - e-mail forwarder does not direct the DSN back to the original sender. + practice, DSNs can be misdirected, such as when an MTA accepts an + E-Mail and then later generates a DSN to a forged address, or when an + E-Mail forwarder does not direct the DSN back to the original sender. 10.6. Privacy Exposure Checking SPF records causes DNS queries to be sent to the domain owner. These DNS queries, especially if they are caused by the "exists" mechanism, can contain information about who is sending - e-mail and likely to which MTA the e-mail is being sent to. This can + E-Mail and likely to which MTA the E-Mail is being sent. This can introduce some privacy concerns, which may be more or less of an issue depending on local laws and the relationship between the domain - owner and the person sending the e-mail. - - - - - - - - - - - - - - - - - - - - - - - - - - - -Wong & Schlitt Expires December 8, 2005 [Page 41] - -Internet-Draft Sender Policy Framework (SPF) June 2005 - + owner and the person sending the E-Mail. 11. Contributors and Acknowledgements This document is largely based on the work of Meng Weng Wong and Mark - Lentczner. While, as this section acknowledges, many people have + Lentczner. Although, as this section acknowledges, many people have contributed to this document, a very large portion of the writing and editing are due to Meng and Mark. This design owes a debt of parentage to [RMX] by Hadmut Danisch and to [DMP] by Gordon Fecyk. The idea of using a DNS record to check - the legitimacy of an e-mail address traces its ancestry farther back + the legitimacy of an E-Mail address traces its ancestry further back through messages on the namedroppers mailing list by Paul Vixie + + + +Wong & Schlitt Experimental [Page 38] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + [Vixie] (based on suggestion by Jim Miller) and by David Green [Green]. @@ -2317,7 +2141,7 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 The authors would also like to thank the literally hundreds of individuals who have participated in the development of this design. - They are far too numerous to name, but they include: + They are far too numerous to name, but they include the following: The folks on the spf-discuss mailing list. The folks on the SPAM-L mailing list. @@ -2325,42 +2149,14 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 The folks on the IETF MARID mailing list. The folks on #perl. - - - - - - - - - - - - - - - - - - - - - - - -Wong & Schlitt Expires December 8, 2005 [Page 42] - -Internet-Draft Sender Policy Framework (SPF) June 2005 - - 12. IANA Considerations 12.1. The SPF DNS Record Type - The IANA needs to assign a new Resource Record Type and Qtype from - the DNS Parameters Registry for the SPF RR type. + The IANA has assigned a new Resource Record Type and Qtype from the + DNS Parameters Registry for the SPF RR type with code 99. -12.2. The Received-SPF mail header +12.2. The Received-SPF Mail Header Field Per [RFC3864], the "Received-SPF:" header field is added to the IANA Permanent Message Header Field Registry. The following is the @@ -2368,53 +2164,29 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 Header field name: Received-SPF Applicable protocol: mail ([RFC2822]) - Status: standard - (Note to RFC Editor: Replace the status with the final - determination by the IESG) + Status: Experimental Author/Change controller: IETF - Specification document(s): this Internet Draft - (Note to RFC Editor: Replace this with RFC YYYY (RFC number of - this spec)) + Specification document(s): RFC 4408 Related information: Requesting SPF Council review of any proposed changes and - additions to this field is recommended. For information about SPF - Council see http://spf.mehnle.net/ - - - - - - - - - - - - - - - - - + additions to this field are recommended. For information about + the SPF Council see http://www.openspf.org/Council +13. References +13.1. Normative References + [RFC1035] Mockapetris, P., "Domain names - implementation and + specification", STD 13, RFC 1035, November 1987. -Wong & Schlitt Expires December 8, 2005 [Page 43] +Wong & Schlitt Experimental [Page 39] -Internet-Draft Sender Policy Framework (SPF) June 2005 - - -13. References +RFC 4408 Sender Policy Framework (SPF) April 2006 -13.1 Normative References - - [RFC1035] Mockapetris, P., "Domain names - implementation and - specification", STD 13, RFC 1035, November 1987. [RFC1123] Braden, R., "Requirements for Internet Hosts - Application and Support", STD 3, RFC 1123, October 1989. @@ -2422,20 +2194,15 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. - [I-D.crocker-abnf-rfc2234bis] - Crocker, D. and P. Overell, "Augmented BNF for Syntax - Specifications: ABNF", draft-crocker-abnf-rfc2234bis-00 - (work in progress), March 2005. - [RFC2821] Klensin, J., "Simple Mail Transfer Protocol", RFC 2821, April 2001. - [RFC2822] Resnick, P., "Internet Message Format", RFC 2822, - April 2001. + [RFC2822] Resnick, P., "Internet Message Format", RFC 2822, April + 2001. [RFC3464] Moore, K. and G. Vaudreuil, "An Extensible Message Format - for Delivery Status Notifications", RFC 3464, - January 2003. + for Delivery Status Notifications", RFC 3464, January + 2003. [RFC3513] Hinden, R. and S. Deering, "Internet Protocol Version 6 (IPv6) Addressing Architecture", RFC 3513, April 2003. @@ -2445,41 +2212,37 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 September 2004. [RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform - Resource Identifier (URI): Generic Syntax", STD 66, - RFC 3986, January 2005. + Resource Identifier (URI): Generic Syntax", STD 66, RFC + 3986, January 2005. + + [RFC4234] Crocker, D. and P. Overell, "Augmented BNF for Syntax + Specifications: ABNF", RFC 4234, October 2005. - [US-ASCII] - American National Standards Institute (formerly United + [US-ASCII] American National Standards Institute (formerly United States of America Standards Institute), "USA Code for Information Interchange, X3.4", 1968. - ANSI X3.4-1968 has been replaced by newer versions with - slight modifications, but the 1968 version remains - definitive for the Internet. - - - - -Wong & Schlitt Expires December 8, 2005 [Page 44] - -Internet-Draft Sender Policy Framework (SPF) June 2005 - + ANSI X3.4-1968 has been replaced by newer versions with slight + modifications, but the 1968 version remains definitive for + the Internet. 13.2 Informative References [RFC1034] Mockapetris, P., "Domain names - concepts and facilities", STD 13, RFC 1034, November 1987. - [RFC1983] Malkin, G., "Internet Users' Glossary", RFC 1983, - August 1996. + [RFC1983] Malkin, G., "Internet Users' Glossary", RFC 1983, August + 1996. [RFC2440] Callas, J., Donnerhacke, L., Finney, H., and R. Thayer, "OpenPGP Message Format", RFC 2440, November 1998. - [I-D.gellens-submit-bis] - Gellens, R. and J. Klensin, "Message Submission for Mail", - draft-gellens-submit-bis-02 (work in progress), - April 2005. + + +Wong & Schlitt Experimental [Page 40] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + [RFC2554] Myers, J., "SMTP Service Extension for Authentication", RFC 2554, March 1999. @@ -2494,14 +2257,13 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 Extensions (S/MIME) Version 3.1 Message Specification", RFC 3851, July 2004. - [RMX] Danish, H., "The RMX DNS RR Type for light weight sender - authentication", October 2003. + [RFC4409] Gellens, R. and J. Klensin, "Message Submission for Mail", + RFC 4409, April 2006. - Work In Progress - - [DMP] Fecyk, G., "Designated Mailers Protocol", December 2003. + [RMX] Danish, H., "The RMX DNS RR Type for light weight sender + authentication", Work In Progress - Work In Progress + [DMP] Fecyk, G., "Designated Mailers Protocol", Work In Progress [Vixie] Vixie, P., "Repudiating MAIL FROM", 2002. @@ -2516,9 +2278,26 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 -Wong & Schlitt Expires December 8, 2005 [Page 45] + + + + + + + + + + + + + + + + + +Wong & Schlitt Experimental [Page 41] -Internet-Draft Sender Policy Framework (SPF) June 2005 +RFC 4408 Sender Policy Framework (SPF) April 2006 Appendix A. Collected ABNF @@ -2527,10 +2306,9 @@ Appendix A. Collected ABNF fragments in the preceding text are to be resolved in favor of this grammar. - See [I-D.crocker-abnf-rfc2234bis] for ABNF notation. Please note - that as per this ABNF definition, literal text strings (those in - quotes) are case-insensitive. Hence, "mx" matches "mx", "MX", "mX" - and "Mx". + See [RFC4234] for ABNF notation. Please note that as per this ABNF + definition, literal text strings (those in quotes) are case- + insensitive. Hence, "mx" matches "mx", "MX", "mX", and "Mx". record = version terms *SP version = "v=spf1" @@ -2566,21 +2344,25 @@ Appendix A. Collected ABNF / "1" 2DIGIT ; 100-199 / "2" %x30-34 DIGIT ; 200-249 / "25" %x30-35 ; 250-255 - ; conventional dotted quad notation. e.g. 192.0.2.0 + ; conventional dotted quad notation. e.g., 192.0.2.0 ip6-network = <as per [RFC 3513], section 2.2> - ; e.g. 2001:DB8::CD30 + ; e.g., 2001:DB8::CD30 + -Wong & Schlitt Expires December 8, 2005 [Page 46] +Wong & Schlitt Experimental [Page 42] -Internet-Draft Sender Policy Framework (SPF) June 2005 +RFC 4408 Sender Policy Framework (SPF) April 2006 domain-spec = macro-string domain-end - domain-end = ( "." toplabel ) / macro-expand - toplabel = ALPHA / ALPHA *[ alphanum / "-" ] alphanum - ; LDH rule (See [RFC3696]) + domain-end = ( "." toplabel [ "." ] ) / macro-expand + toplabel = ( *alphanum ALPHA *alphanum ) / + ( 1*alphanum "-" *( alphanum / "-" ) alphanum ) + ; LDH rule plus additional TLD restrictions + ; (see [RFC3696], Section 2) + alphanum = ALPHA / DIGIT explain-string = *( macro-string / SP ) @@ -2597,7 +2379,7 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 name = ALPHA *( ALPHA / DIGIT / "-" / "_" / "." ) - header = "Received-SPF:" [CFWS] result FWS [comment FWS] + header-field = "Received-SPF:" [CFWS] result FWS [comment FWS] [ key-value-list ] CRLF result = "Pass" / "Fail" / "SoftFail" / "Neutral" / @@ -2625,12 +2407,9 @@ Internet-Draft Sender Policy Framework (SPF) June 2005 - - - -Wong & Schlitt Expires December 8, 2005 [Page 47] +Wong & Schlitt Experimental [Page 43] -Internet-Draft Sender Policy Framework (SPF) June 2005 +RFC 4408 Sender Policy Framework (SPF) April 2006 Appendix B. Extended Examples @@ -2684,9 +2463,9 @@ B.1. Simple Examples -Wong & Schlitt Expires December 8, 2005 [Page 48] +Wong & Schlitt Experimental [Page 44] -Internet-Draft Sender Policy Framework (SPF) June 2005 +RFC 4408 Sender Policy Framework (SPF) April 2006 v=spf1 a:example.org -all @@ -2740,9 +2519,9 @@ B.2. Multiple Domain Example -Wong & Schlitt Expires December 8, 2005 [Page 49] +Wong & Schlitt Experimental [Page 45] -Internet-Draft Sender Policy Framework (SPF) June 2005 +RFC 4408 Sender Policy Framework (SPF) April 2006 B.3. DNSBL Style Example @@ -2750,9 +2529,8 @@ B.3. DNSBL Style Example Imagine that, in addition to the domain records listed above, there are these: - $ORIGIN _spf.example.com. - mary.mobile-users A 127.0.0.2 - fred.mobile-users A 127.0.0.2 + $ORIGIN _spf.example.com. mary.mobile-users A + 127.0.0.2 fred.mobile-users A 127.0.0.2 15.15.168.192.joel.remote-users A 127.0.0.2 16.15.168.192.joel.remote-users A 127.0.0.2 @@ -2776,9 +2554,9 @@ B.3. DNSBL Style Example B.4. Multiple Requirements Example - Say that your sender policy requires that both the IP address is + Say that your sender policy requires both that the IP address is within a certain range and that the reverse DNS for the IP matches. - This can be done several ways, including: + This can be done several ways, including the following: example.com. SPF ( "v=spf1 " "-include:ip4._spf.%{d} " @@ -2788,241 +2566,18 @@ B.4. Multiple Requirements Example ptr._spf.example.com. SPF "v=spf1 -ptr +all" This example shows how the "-include" mechanism can be useful, how an - SPF record that ends in "+all" can be very restrictive and the use of - De Morgan's Law. - - - - - - -Wong & Schlitt Expires December 8, 2005 [Page 50] - -Internet-Draft Sender Policy Framework (SPF) June 2005 - - -Appendix C. Change Log - - RFC Editor Note: This section is to be removed during the final - publication of the document. - -C.1. Changes in Version -02 - - o The abstract notes that SPF-classic covers both the HELO and MAIL - FROM identities. (ietf-822 review) - - o In section 2.3 "Publishing Authorization", it now makes it clear - that publishing is optional. (ietf-smtp review) - - o The definition of the "SoftFail" result have been recast from - Receiver Policy to Sender Policy. - - o The definitions of Neutral, Pass and PermError have been updated/ - clarified to more correctly reflect the semantics of - draft-mengwong-spf-01. - - o A note to the RFC editor was made indicating that the SPF DNS RR - type number should be added to the draft once the IANA has made an - allocation. - - o The ip4-network ABNF has been fixed to give the ABNF of the - dotted-quad format, rather than just using words to explain it. - - o The ABNF for the Received-SPF header now shows that it ends with a - CRLF. (ietf-822 review) + SPF record that ends in "+all" can be very restrictive, and the use + of De Morgan's Law. - o The new, optional, "scope" keyword-value pair has been renamed to - "identity". - o The "exp=" modifier no longer counts toward the DoS DNS lookup - limits. - o In section 10.5 "Untrusted Information Sources", the explanation - about explanation strings going to only the sender has been fixed - to note that, in some cases, it can go to other people. (ietf-822 - review) - o Sections 3.1.2 and 3.1.3 were updated to make the distinction - between "multiple TXT RRs" and "multiple strings within a TXT" - clearer. (ietf-822 review) - o A normative reference to US-ASCII has been added. - - - -Wong & Schlitt Expires December 8, 2005 [Page 51] - -Internet-Draft Sender Policy Framework (SPF) June 2005 - - - o Text describing how to lookup and process the SPF records has been - removed from section 3.1.1 "DNS Resource Record Types" and merged - into similar text in sections 4.4 "Record Lookup" and 4.5 - "Selecting Records" - - o Section 4.5 "Selecting Records" has been updated to give an - algorithm that says to return a PermError when it discovers that - SPF and TXT records don't match. - - o In section 6.1 "redirect: Redirected Query", the semantics have - been changed to specify a result of PermError instead of None in - cases where the target domain does not have any SPF records. It - makes no sense to return None, that is "no SPF records found", - when SPF records were found. - - o In section 6.2 "exp: Explanation", it is explained that the record - must be in US-ASCII due to requirements of RFC2821. - - o In section 6.2 "exp: Explanation", the duplicate warning about - source being from a third party was deleted. - - o A note has been added to section 9.3.1.2 warning about domain - labels being over 63 characters. - - o The "prefix" ABNF rule was renamed to "qualifier" to reflect the - semantics of the rule, rather than the syntax. - -C.2. Changes in Version -01 - - o IETF boilerplate was updated to BCP 79. - - o A version number was added to the title. (IESG review) - - o Many grammatical, typographical and spelling errors were - corrected, along with rephrasing sentences to make the intent and - meaning clearer. - - o Sections have been re-ordered in so that they conform to the - instructions2authors.txt document. All required sections and - arrangements are included, and only the "Security Considerations" - section is not in the suggested order. Since the Security - Considerations is such an important part of the spec, it has been - moved before the Acknowledgement section. - - o The HELO identity checking has been changed from "MAY" to - "RECOMMENDED". - - - - - -Wong & Schlitt Expires December 8, 2005 [Page 52] - -Internet-Draft Sender Policy Framework (SPF) June 2005 - - - o The e-mail receiver policy definition on how to handle HELO - checking was removed. It was copied incorrectly from - draft-mengwong-spf-01, changing its meaning. - - o A note was added that when changing SPF records, there needs to be - a transitional period to prevent incorrect results. - - o The RECOMMENDATION not to use other identities with version 1 SPF - records has been clarified. Example cases where checking other - identities will cause incorrect results have been cited. (IESG - review) - - o The "zone cut" method of determining if there is an SPF record at - the top of the zone has been removed. It wasn't implemented very - often and could not always be easily done. (IESG/namedroppers' - review) - - o A note was added that receivers should consider rejecting e-mail - for non-existent domains in order to prevent circumvention of SPF - policies. This is due to the remove of "zone cuts". - (namedroppers' review) - - o The RECOMMENDATION to perform SPF checks during the SMTP session - has been clarified and strengthened. - - o Note added about the consequences of treating "Neutral" results - worse than "None". - - o The suggested e-mail receiver policy when a "PermError" is - encountered has been changed to be, effectively, the same - semantics as were in draft-mengwong-spf-01. (MAAWG review) - - o ABNF cleaned up to pass Bill Fenner's checker and not just the one - at http://www.apps.ietf.org/abnf.html - - o A few host names/IP addresses were fixed to use appropriate ones - for I-Ds. - - o A definition of what to should be done if there are syntax errors - in the explanation string was added. (E.g. use the default.) - - o Section 10 "Security Considerations" has been broken up into - subsections and reorganized. - - o Section 7.1 "Process Limits" has been merged into the similar - language in the "Security Considerations" section. - - - - - -Wong & Schlitt Expires December 8, 2005 [Page 53] - -Internet-Draft Sender Policy Framework (SPF) June 2005 - - - o The ABNF for the Received-SPF e-mail header has been made to be - more compatible with draft-mengwong-spf-01. It was fixed to - require whitespace when needed and to show where the suggested - comment should be added to the header. - - o The IANA Considerations section now has the required information - to document the Received-SPF header. - - o A new, optional, "scope" keyword has added to the Received-SPF - header. - - o The non-normative Section 9.3 "Forwarding Services and Aliases" - has been expanded to more thoroughly cover the subject. - - o New Security Considerations sections on "Privacy Exposure" and - "Cross-User Forgery" have been added. - - o A new example of an SPF policy with a non-obvious implementation - has been added. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Wong & Schlitt Expires December 8, 2005 [Page 54] +Wong & Schlitt Experimental [Page 46] -Internet-Draft Sender Policy Framework (SPF) June 2005 +RFC 4408 Sender Policy Framework (SPF) April 2006 Authors' Addresses @@ -3030,8 +2585,7 @@ Authors' Addresses Meng Weng Wong Singapore - Email: mengwong+spf@pobox.com - URI: http://spf.pobox.com/ + EMail: mengwong+spf@pobox.com Wayne Schlitt @@ -3039,7 +2593,7 @@ Authors' Addresses Lincoln Nebraska, NE 68506 United States of America - Email: wayne@schlitt.net + EMail: wayne@schlitt.net URI: http://www.schlitt.net/spf/ @@ -3076,12 +2630,29 @@ Authors' Addresses -Wong & Schlitt Expires December 8, 2005 [Page 55] + +Wong & Schlitt Experimental [Page 47] -Internet-Draft Sender Policy Framework (SPF) June 2005 +RFC 4408 Sender Policy Framework (SPF) April 2006 + + +Full Copyright Statement + + Copyright (C) The Internet Society (2006). + This document is subject to the rights, licenses and restrictions + contained in BCP 78, and except as set forth therein, the authors + retain all their rights. + + This document and the information contained herein are provided on an + "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS + OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET + ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, + INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE + INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED + WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. -Intellectual Property Statement +Intellectual Property The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to @@ -3105,32 +2676,16 @@ Intellectual Property Statement this standard. Please address the information to the IETF at ietf-ipr@ietf.org. +Acknowledgement -Disclaimer of Validity - - This document and the information contained herein are provided on an - "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS - OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET - ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, - INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE - INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED - WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. - - -Copyright Statement - - Copyright (C) The Internet Society (2005). This document is subject - to the rights, licenses and restrictions contained in BCP 78, and - except as set forth therein, the authors retain all their rights. + Funding for the RFC Editor function is provided by the IETF + Administrative Support Activity (IASA). -Acknowledgment - Funding for the RFC Editor function is currently provided by the - Internet Society. -Wong & Schlitt Expires December 8, 2005 [Page 56] +Wong & Schlitt Experimental [Page 48] diff --git a/doc/rfc/rfc4470.txt b/doc/rfc/rfc4470.txt new file mode 100644 index 00000000..ac12d65c --- /dev/null +++ b/doc/rfc/rfc4470.txt @@ -0,0 +1,451 @@ + + + + + + +Network Working Group S. Weiler +Request for Comments: 4470 SPARTA, Inc. +Updates: 4035, 4034 J. Ihren +Category: Standards Track Autonomica AB + April 2006 + + + Minimally Covering NSEC Records and DNSSEC On-line Signing + + +Status of This Memo + + This document specifies an Internet standards track protocol for the + Internet community, and requests discussion and suggestions for + improvements. Please refer to the current edition of the "Internet + Official Protocol Standards" (STD 1) for the standardization state + and status of this protocol. Distribution of this memo is unlimited. + +Copyright Notice + + Copyright (C) The Internet Society (2006). + +Abstract + + This document describes how to construct DNSSEC NSEC resource records + that cover a smaller range of names than called for by RFC 4034. By + generating and signing these records on demand, authoritative name + servers can effectively stop the disclosure of zone contents + otherwise made possible by walking the chain of NSEC records in a + signed zone. + +Table of Contents + + 1. Introduction ....................................................1 + 2. Applicability of This Technique .................................2 + 3. Minimally Covering NSEC Records .................................2 + 4. Better Epsilon Functions ........................................4 + 5. Security Considerations .........................................5 + 6. Acknowledgements ................................................6 + 7. Normative References ............................................6 + +1. Introduction + + With DNSSEC [1], an NSEC record lists the next instantiated name in + its zone, proving that no names exist in the "span" between the + NSEC's owner name and the name in the "next name" field. In this + document, an NSEC record is said to "cover" the names between its + owner name and next name. + + + +Weiler & Ihren Standards Track [Page 1] + +RFC 4470 NSEC Epsilon April 2006 + + + Through repeated queries that return NSEC records, it is possible to + retrieve all of the names in the zone, a process commonly called + "walking" the zone. Some zone owners have policies forbidding zone + transfers by arbitrary clients; this side effect of the NSEC + architecture subverts those policies. + + This document presents a way to prevent zone walking by constructing + NSEC records that cover fewer names. These records can make zone + walking take approximately as many queries as simply asking for all + possible names in a zone, making zone walking impractical. Some of + these records must be created and signed on demand, which requires + on-line private keys. Anyone contemplating use of this technique is + strongly encouraged to review the discussion of the risks of on-line + signing in Section 5. + +1.2. Keywords + + The keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", + "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this + document are to be interpreted as described in RFC 2119 [4]. + +2. Applicability of This Technique + + The technique presented here may be useful to a zone owner that wants + to use DNSSEC, is concerned about exposure of its zone contents via + zone walking, and is willing to bear the costs of on-line signing. + + As discussed in Section 5, on-line signing has several security + risks, including an increased likelihood of private keys being + disclosed and an increased risk of denial of service attack. Anyone + contemplating use of this technique is strongly encouraged to review + the discussion of the risks of on-line signing in Section 5. + + Furthermore, at the time this document was published, the DNSEXT + working group was actively working on a mechanism to prevent zone + walking that does not require on-line signing (tentatively called + NSEC3). The new mechanism is likely to expose slightly more + information about the zone than this technique (e.g., the number of + instantiated names), but it may be preferable to this technique. + +3. Minimally Covering NSEC Records + + This mechanism involves changes to NSEC records for instantiated + names, which can still be generated and signed in advance, as well as + the on-demand generation and signing of new NSEC records whenever a + name must be proven not to exist. + + + + + +Weiler & Ihren Standards Track [Page 2] + +RFC 4470 NSEC Epsilon April 2006 + + + In the "next name" field of instantiated names' NSEC records, rather + than list the next instantiated name in the zone, list any name that + falls lexically after the NSEC's owner name and before the next + instantiated name in the zone, according to the ordering function in + RFC 4034 [2] Section 6.1. This relaxes the requirement in Section + 4.1.1 of RFC 4034 that the "next name" field contains the next owner + name in the zone. This change is expected to be fully compatible + with all existing DNSSEC validators. These NSEC records are returned + whenever proving something specifically about the owner name (e.g., + that no resource records of a given type appear at that name). + + Whenever an NSEC record is needed to prove the non-existence of a + name, a new NSEC record is dynamically produced and signed. The new + NSEC record has an owner name lexically before the QNAME but + lexically following any existing name and a "next name" lexically + following the QNAME but before any existing name. + + The generated NSEC record's type bitmap MUST have the RRSIG and NSEC + bits set and SHOULD NOT have any other bits set. This relaxes the + requirement in Section 2.3 of RFC4035 that NSEC RRs not appear at + names that did not exist before the zone was signed. + + The functions to generate the lexically following and proceeding + names need not be perfect or consistent, but the generated NSEC + records must not cover any existing names. Furthermore, this + technique works best when the generated NSEC records cover as few + names as possible. In this document, the functions that generate the + nearby names are called "epsilon" functions, a reference to the + mathematical convention of using the greek letter epsilon to + represent small deviations. + + An NSEC record denying the existence of a wildcard may be generated + in the same way. Since the NSEC record covering a non-existent + wildcard is likely to be used in response to many queries, + authoritative name servers using the techniques described here may + want to pregenerate or cache that record and its corresponding RRSIG. + + For example, a query for an A record at the non-instantiated name + example.com might produce the following two NSEC records, the first + denying the existence of the name example.com and the second denying + the existence of a wildcard: + + exampld.com 3600 IN NSEC example-.com ( RRSIG NSEC ) + + \).com 3600 IN NSEC +.com ( RRSIG NSEC ) + + + + + + +Weiler & Ihren Standards Track [Page 3] + +RFC 4470 NSEC Epsilon April 2006 + + + Before answering a query with these records, an authoritative server + must test for the existence of names between these endpoints. If the + generated NSEC would cover existing names (e.g., exampldd.com or + *bizarre.example.com), a better epsilon function may be used or the + covered name closest to the QNAME could be used as the NSEC owner + name or next name, as appropriate. If an existing name is used as + the NSEC owner name, that name's real NSEC record MUST be returned. + Using the same example, assuming an exampldd.com delegation exists, + this record might be returned from the parent: + + exampldd.com 3600 IN NSEC example-.com ( NS DS RRSIG NSEC ) + + Like every authoritative record in the zone, each generated NSEC + record MUST have corresponding RRSIGs generated using each algorithm + (but not necessarily each DNSKEY) in the zone's DNSKEY RRset, as + described in RFC 4035 [3] Section 2.2. To minimize the number of + signatures that must be generated, a zone may wish to limit the + number of algorithms in its DNSKEY RRset. + +4. Better Epsilon Functions + + Section 6.1 of RFC 4034 defines a strict ordering of DNS names. + Working backward from that definition, it should be possible to + define epsilon functions that generate the immediately following and + preceding names, respectively. This document does not define such + functions. Instead, this section presents functions that come + reasonably close to the perfect ones. As described above, an + authoritative server should still ensure than no generated NSEC + covers any existing name. + + To increment a name, add a leading label with a single null (zero- + value) octet. + + To decrement a name, decrement the last character of the leftmost + label, then fill that label to a length of 63 octets with octets of + value 255. To decrement a null (zero-value) octet, remove the octet + -- if an empty label is left, remove the label. Defining this + function numerically: fill the leftmost label to its maximum length + with zeros (numeric, not ASCII zeros) and subtract one. + + In response to a query for the non-existent name foo.example.com, + these functions produce NSEC records of the following: + + + + + + + + + +Weiler & Ihren Standards Track [Page 4] + +RFC 4470 NSEC Epsilon April 2006 + + + fon\255\255\255\255\255\255\255\255\255\255\255\255\255\255 + \255\255\255\255\255\255\255\255\255\255\255\255\255\255\255 + \255\255\255\255\255\255\255\255\255\255\255\255\255\255\255 + \255\255\255\255\255\255\255\255\255\255\255\255\255\255\255 + \255.example.com 3600 IN NSEC \000.foo.example.com ( NSEC RRSIG ) + + \)\255\255\255\255\255\255\255\255\255\255\255\255\255\255\255 + \255\255\255\255\255\255\255\255\255\255\255\255\255\255\255 + \255\255\255\255\255\255\255\255\255\255\255\255\255\255\255 + \255\255\255\255\255\255\255\255\255\255\255\255\255\255\255 + \255\255.example.com 3600 IN NSEC \000.*.example.com ( NSEC RRSIG ) + + The first of these NSEC RRs proves that no exact match for + foo.example.com exists, and the second proves that there is no + wildcard in example.com. + + Both of these functions are imperfect: they do not take into account + constraints on number of labels in a name nor total length of a name. + As noted in the previous section, though, this technique does not + depend on the use of perfect epsilon functions: it is sufficient to + test whether any instantiated names fall into the span covered by the + generated NSEC and, if so, substitute those instantiated owner names + for the NSEC owner name or next name, as appropriate. + +5. Security Considerations + + This approach requires on-demand generation of RRSIG records. This + creates several new vulnerabilities. + + First, on-demand signing requires that a zone's authoritative servers + have access to its private keys. Storing private keys on well-known + Internet-accessible servers may make them more vulnerable to + unintended disclosure. + + Second, since generation of digital signatures tends to be + computationally demanding, the requirement for on-demand signing + makes authoritative servers vulnerable to a denial of service attack. + + Last, if the epsilon functions are predictable, on-demand signing may + enable a chosen-plaintext attack on a zone's private keys. Zones + using this approach should attempt to use cryptographic algorithms + that are resistant to chosen-plaintext attacks. It is worth noting + that although DNSSEC has a "mandatory to implement" algorithm, that + is a requirement on resolvers and validators -- there is no + requirement that a zone be signed with any given algorithm. + + The success of using minimally covering NSEC records to prevent zone + walking depends greatly on the quality of the epsilon functions + + + +Weiler & Ihren Standards Track [Page 5] + +RFC 4470 NSEC Epsilon April 2006 + + + chosen. An increment function that chooses a name obviously derived + from the next instantiated name may be easily reverse engineered, + destroying the value of this technique. An increment function that + always returns a name close to the next instantiated name is likewise + a poor choice. Good choices of epsilon functions are the ones that + produce the immediately following and preceding names, respectively, + though zone administrators may wish to use less perfect functions + that return more human-friendly names than the functions described in + Section 4 above. + + Another obvious but misguided concern is the danger from synthesized + NSEC records being replayed. It is possible for an attacker to + replay an old but still validly signed NSEC record after a new name + has been added in the span covered by that NSEC, incorrectly proving + that there is no record at that name. This danger exists with DNSSEC + as defined in [3]. The techniques described here actually decrease + the danger, since the span covered by any NSEC record is smaller than + before. Choosing better epsilon functions will further reduce this + danger. + +6. Acknowledgements + + Many individuals contributed to this design. They include, in + addition to the authors of this document, Olaf Kolkman, Ed Lewis, + Peter Koch, Matt Larson, David Blacka, Suzanne Woolf, Jaap Akkerhuis, + Jakob Schlyter, Bill Manning, and Joao Damas. + + In addition, the editors would like to thank Ed Lewis, Scott Rose, + and David Blacka for their careful review of the document. + +7. Normative References + + [1] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, + "DNS Security Introduction and Requirements", RFC 4033, March + 2005. + + [2] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, + "Resource Records for the DNS Security Extensions", RFC 4034, + March 2005. + + [3] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, + "Protocol Modifications for the DNS Security Extensions", RFC + 4035, March 2005. + + [4] Bradner, S., "Key words for use in RFCs to Indicate Requirement + Levels", BCP 14, RFC 2119, March 1997. + + + + + +Weiler & Ihren Standards Track [Page 6] + +RFC 4470 NSEC Epsilon April 2006 + + +Authors' Addresses + + Samuel Weiler + SPARTA, Inc. + 7075 Samuel Morse Drive + Columbia, Maryland 21046 + US + + EMail: weiler@tislabs.com + + + Johan Ihren + Autonomica AB + Bellmansgatan 30 + Stockholm SE-118 47 + Sweden + + EMail: johani@autonomica.se + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +Weiler & Ihren Standards Track [Page 7] + +RFC 4470 NSEC Epsilon April 2006 + + +Full Copyright Statement + + Copyright (C) The Internet Society (2006). + + This document is subject to the rights, licenses and restrictions + contained in BCP 78, and except as set forth therein, the authors + retain all their rights. + + This document and the information contained herein are provided on an + "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS + OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET + ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, + INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE + INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED + WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. + +Intellectual Property + + The IETF takes no position regarding the validity or scope of any + Intellectual Property Rights or other rights that might be claimed to + pertain to the implementation or use of the technology described in + this document or the extent to which any license under such rights + might or might not be available; nor does it represent that it has + made any independent effort to identify any such rights. Information + on the procedures with respect to rights in RFC documents can be + found in BCP 78 and BCP 79. + + Copies of IPR disclosures made to the IETF Secretariat and any + assurances of licenses to be made available, or the result of an + attempt made to obtain a general license or permission for the use of + such proprietary rights by implementers or users of this + specification can be obtained from the IETF on-line IPR repository at + http://www.ietf.org/ipr. + + The IETF invites any interested party to bring to its attention any + copyrights, patents or patent applications, or other proprietary + rights that may cover technology that may be required to implement + this standard. Please address the information to the IETF at + ietf-ipr@ietf.org. + +Acknowledgement + + Funding for the RFC Editor function is provided by the IETF + Administrative Support Activity (IASA). + + + + + + + +Weiler & Ihren Standards Track [Page 8] + diff --git a/doc/rfc/rfc4634.txt b/doc/rfc/rfc4634.txt new file mode 100644 index 00000000..b672df8a --- /dev/null +++ b/doc/rfc/rfc4634.txt @@ -0,0 +1,6051 @@ + + + + + + +Network Working Group D. Eastlake 3rd +Request for Comments: 4634 Motorola Labs +Updates: 3174 T. Hansen +Category: Informational AT&T Labs + July 2006 + + + US Secure Hash Algorithms (SHA and HMAC-SHA) + +Status of This Memo + + This memo provides information for the Internet community. It does + not specify an Internet standard of any kind. Distribution of this + memo is unlimited. + +Copyright Notice + + Copyright (C) The Internet Society (2006). + +Abstract + + The United States of America has adopted a suite of Secure Hash + Algorithms (SHAs), including four beyond SHA-1, as part of a Federal + Information Processing Standard (FIPS), specifically SHA-224 (RFC + 3874), SHA-256, SHA-384, and SHA-512. The purpose of this document + is to make source code performing these hash functions conveniently + available to the Internet community. The sample code supports input + strings of arbitrary bit length. SHA-1's sample code from RFC 3174 + has also been updated to handle input strings of arbitrary bit + length. Most of the text herein was adapted by the authors from FIPS + 180-2. + + Code to perform SHA-based HMACs, with arbitrary bit length text, is + also included. + + + + + + + + + + + + + + + + + +Eastlake 3rd & Hansen Informational [Page 1] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +Table of Contents + + 1. Overview of Contents ............................................3 + 1.1. License ....................................................4 + 2. Notation for Bit Strings and Integers ...........................4 + 3. Operations on Words .............................................5 + 4. Message Padding and Parsing .....................................6 + 4.1. SHA-224 and SHA-256 ........................................7 + 4.2. SHA-384 and SHA-512 ........................................8 + 5. Functions and Constants Used ....................................9 + 5.1. SHA-224 and SHA-256 ........................................9 + 5.2. SHA-384 and SHA-512 .......................................10 + 6. Computing the Message Digest ...................................11 + 6.1. SHA-224 and SHA-256 Initialization ........................11 + 6.2. SHA-224 and SHA-256 Processing ............................11 + 6.3. SHA-384 and SHA-512 Initialization ........................13 + 6.4. SHA-384 and SHA-512 Processing ............................14 + 7. SHA-Based HMACs ................................................15 + 8. C Code for SHAs ................................................15 + 8.1. The .h File ...............................................18 + 8.2. The SHA Code ..............................................24 + 8.2.1. sha1.c .............................................24 + 8.2.2. sha224-256.c .......................................33 + 8.2.3. sha384-512.c .......................................45 + 8.2.4. usha.c .............................................67 + 8.2.5. sha-private.h ......................................72 + 8.3. The HMAC Code .............................................73 + 8.4. The Test Driver ...........................................78 + 9. Security Considerations .......................................106 + 10. Normative References .........................................106 + 11. Informative References .......................................106 + + + + + + + + + + + + + + + + + + + + +Eastlake 3rd & Hansen Informational [Page 2] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +1. Overview of Contents + + NOTE: Much of the text below is taken from [FIPS180-2] and assertions + therein of the security of the algorithms described are made by the + US Government, the author of [FIPS180-2], and not by the authors of + this document. + + The text below specifies Secure Hash Algorithms, SHA-224 [RFC3874], + SHA-256, SHA-384, and SHA-512, for computing a condensed + representation of a message or a data file. (SHA-1 is specified in + [RFC3174].) When a message of any length < 2^64 bits (for SHA-224 + and SHA-256) or < 2^128 bits (for SHA-384 and SHA-512) is input to + one of these algorithms, the result is an output called a message + digest. The message digests range in length from 224 to 512 bits, + depending on the algorithm. Secure hash algorithms are typically + used with other cryptographic algorithms, such as digital signature + algorithms and keyed hash authentication codes, or in the generation + of random numbers [RFC4086]. + + The four algorithms specified in this document are called secure + because it is computationally infeasible to (1) find a message that + corresponds to a given message digest, or (2) find two different + messages that produce the same message digest. Any change to a + message in transit will, with very high probability, result in a + different message digest. This will result in a verification failure + when the secure hash algorithm is used with a digital signature + algorithm or a keyed-hash message authentication algorithm. + + The code provided herein supports input strings of arbitrary bit + length. SHA-1's sample code from [RFC3174] has also been updated to + handle input strings of arbitrary bit length. See Section 1.1 for + license information for this code. + + Section 2 below defines the terminology and functions used as + building blocks to form these algorithms. Section 3 describes the + fundamental operations on words from which these algorithms are + built. Section 4 describes how messages are padded up to an integral + multiple of the required block size and then parsed into blocks. + Section 5 defines the constants and the composite functions used to + specify these algorithms. Section 6 gives the actual specification + for the SHA-224, SHA-256, SHA-384, and SHA-512 functions. Section 7 + provides pointers to the specification of HMAC keyed message + authentication codes based on the SHA algorithms. Section 8 gives + sample code for the SHA algorithms and Section 9 code for SHA-based + HMACs. The SHA-based HMACs will accept arbitrary bit length text. + + + + + + +Eastlake 3rd & Hansen Informational [Page 3] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +1.1. License + + Permission is granted for all uses, commercial and non-commercial, of + the sample code found in Section 8. Royalty free license to use, + copy, modify and distribute the software found in Section 8 is + granted, provided that this document is identified in all material + mentioning or referencing this software, and provided that + redistributed derivative works do not contain misleading author or + version information. + + The authors make no representations concerning either the + merchantability of this software or the suitability of this software + for any particular purpose. It is provided "as is" without express + or implied warranty of any kind. + +2. Notation for Bit Strings and Integers + + The following terminology related to bit strings and integers will be + used: + + a. A hex digit is an element of the set {0, 1, ... , 9, A, ... , + F}. A hex digit is the representation of a 4-bit string. + Examples: 7 = 0111, A = 1010. + + b. A word equals a 32-bit or 64-bit string, which may be + represented as a sequence of 8 or 16 hex digits, respectively. + To convert a word to hex digits, each 4-bit string is converted + to its hex equivalent as described in (a) above. Example: + + 1010 0001 0000 0011 1111 1110 0010 0011 = A103FE23. + + Throughout this document, the "big-endian" convention is used + when expressing both 32-bit and 64-bit words, so that within + each word the most significant bit is shown in the left-most bit + position. + + c. An integer may be represented as a word or pair of words. + + An integer between 0 and 2^32 - 1 inclusive may be represented + as a 32-bit word. The least significant four bits of the + integer are represented by the right-most hex digit of the word + representation. Example: the integer 291 = 2^8+2^5+2^1+2^0 = + 256+32+2+1 is represented by the hex word 00000123. + + The same holds true for an integer between 0 and 2^64-1 + inclusive, which may be represented as a 64-bit word. + + + + + +Eastlake 3rd & Hansen Informational [Page 4] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + If Z is an integer, 0 <= z < 2^64, then z = (2^32)x + y where 0 + <= x < 2^32 and 0 <= y < 2^32. Since x and y can be represented + as words X and Y, respectively, z can be represented as the pair + of words (X,Y). + + d. block = 512-bit or 1024-bit string. A block (e.g., B) may be + represented as a sequence of 32-bit or 64-bit words. + +3. Operations on Words + + The following logical operators will be applied to words in all four + hash operations specified herein. SHA-224 and SHA-256 operate on + 32-bit words, while SHA-384 and SHA-512 operate on 64-bit words. + + In the operations below, x<<n is obtained as follows: discard the + left-most n bits of x and then pad the result with n zeroed bits on + the right (the result will still be the same number of bits). + + a. Bitwise logical word operations + + X AND Y = bitwise logical "and" of X and Y. + + X OR Y = bitwise logical "inclusive-or" of X and Y. + + X XOR Y = bitwise logical "exclusive-or" of X and Y. + + NOT X = bitwise logical "complement" of X. + + Example: + 01101100101110011101001001111011 + XOR 01100101110000010110100110110111 + -------------------------------- + = 00001001011110001011101111001100 + + b. The operation X + Y is defined as follows: words X and Y + represent w-bit integers x and y, where 0 <= x < 2^w and + 0 <= y < 2^w. For positive integers n and m, let + + n mod m + + be the remainder upon dividing n by m. Compute + + z = (x + y) mod 2^w. + + Then 0 <= z < 2^w. Convert z to a word, Z, and define Z = X + + Y. + + + + + +Eastlake 3rd & Hansen Informational [Page 5] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + c. The right shift operation SHR^n(x), where x is a w-bit word and + n is an integer with 0 <= n < w, is defined by + + SHR^n(x) = x>>n + + d. The rotate right (circular right shift) operation ROTR^n(x), + where x is a w-bit word and n is an integer with 0 <= n < w, is + defined by + + ROTR^n(x) = (x>>n) OR (x<<(w-n)) + + e. The rotate left (circular left shift) operation ROTL^n(x), where + x is a w-bit word and n is an integer with 0 <= n < w, is + defined by + + ROTL^n(X) = (x<<n) OR (x>>w-n) + + Note the following equivalence relationships, where w is fixed + in each relationship: + + ROTL^n(x) = ROTR^(w-x)(x) + + ROTR^n(x) = ROTL^(w-n)(x) + +4. Message Padding and Parsing + + The hash functions specified herein are used to compute a message + digest for a message or data file that is provided as input. The + message or data file should be considered to be a bit string. The + length of the message is the number of bits in the message (the empty + message has length 0). If the number of bits in a message is a + multiple of 8, for compactness we can represent the message in hex. + The purpose of message padding is to make the total length of a + padded message a multiple of 512 for SHA-224 and SHA-256 or a + multiple of 1024 for SHA-384 and SHA-512. + + The following specifies how this padding shall be performed. As a + summary, a "1" followed by a number of "0"s followed by a 64-bit or + 128-bit integer are appended to the end of the message to produce a + padded message of length 512*n or 1024*n. The minimum number of "0"s + necessary to meet this criterion is used. The appended integer is + the length of the original message. The padded message is then + processed by the hash function as n 512-bit or 1024-bit blocks. + + + + + + + + +Eastlake 3rd & Hansen Informational [Page 6] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +4.1. SHA-224 and SHA-256 + + Suppose a message has length L < 2^64. Before it is input to the + hash function, the message is padded on the right as follows: + + a. "1" is appended. Example: if the original message is + "01010000", this is padded to "010100001". + + b. K "0"s are appended where K is the smallest, non-negative + solution to the equation + + L + 1 + K = 448 (mod 512) + + c. Then append the 64-bit block that is L in binary representation. + After appending this block, the length of the message will be a + multiple of 512 bits. + + Example: Suppose the original message is the bit string + + 01100001 01100010 01100011 01100100 01100101 + + After step (a), this gives + + 01100001 01100010 01100011 01100100 01100101 1 + + Since L = 40, the number of bits in the above is 41 and K = 407 + "0"s are appended, making the total now 448. This gives the + following in hex: + + 61626364 65800000 00000000 00000000 + 00000000 00000000 00000000 00000000 + 00000000 00000000 00000000 00000000 + 00000000 00000000 + + The 64-bit representation of L = 40 is hex 00000000 00000028. + Hence the final padded message is the following hex: + + 61626364 65800000 00000000 00000000 + 00000000 00000000 00000000 00000000 + 00000000 00000000 00000000 00000000 + 00000000 00000000 00000000 00000028 + + + + + + + + + + +Eastlake 3rd & Hansen Informational [Page 7] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +4.2. SHA-384 and SHA-512 + + Suppose a message has length L < 2^128. Before it is input to the + hash function, the message is padded on the right as follows: + + a. "1" is appended. Example: if the original message is + "01010000", this is padded to "010100001". + + b. K "0"s are appended where K is the smallest, non-negative + solution to the equation + + L + 1 + K = 896 (mod 1024) + + c. Then append the 128-bit block that is L in binary + representation. After appending this block, the length of the + message will be a multiple of 1024 bits. + + Example: Suppose the original message is the bit string + + 01100001 01100010 01100011 01100100 01100101 + + After step (a) this gives + + 01100001 01100010 01100011 01100100 01100101 1 + + Since L = 40, the number of bits in the above is 41 and K = 855 + "0"s are appended, making the total now 896. This gives the + following in hex: + + 61626364 65800000 00000000 00000000 + 00000000 00000000 00000000 00000000 + 00000000 00000000 00000000 00000000 + 00000000 00000000 00000000 00000000 + 00000000 00000000 00000000 00000000 + 00000000 00000000 00000000 00000000 + 00000000 00000000 00000000 00000000 + + The 128-bit representation of L = 40 is hex 00000000 00000000 + 00000000 00000028. Hence the final padded message is the + following hex: + + 61626364 65800000 00000000 00000000 + 00000000 00000000 00000000 00000000 + 00000000 00000000 00000000 00000000 + 00000000 00000000 00000000 00000000 + 00000000 00000000 00000000 00000000 + + + + + +Eastlake 3rd & Hansen Informational [Page 8] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + 00000000 00000000 00000000 00000000 + 00000000 00000000 00000000 00000000 + 00000000 00000000 00000000 00000028 + +5. Functions and Constants Used + + The following subsections give the six logical functions and the + table of constants used in each of the hash functions. + +5.1. SHA-224 and SHA-256 + + SHA-224 and SHA-256 use six logical functions, where each function + operates on 32-bit words, which are represented as x, y, and z. The + result of each function is a new 32-bit word. + + CH( x, y, z) = (x AND y) XOR ( (NOT x) AND z) + + MAJ( x, y, z) = (x AND y) XOR (x AND z) XOR (y AND z) + + BSIG0(x) = ROTR^2(x) XOR ROTR^13(x) XOR ROTR^22(x) + + BSIG1(x) = ROTR^6(x) XOR ROTR^11(x) XOR ROTR^25(x) + + SSIG0(x) = ROTR^7(x) XOR ROTR^18(x) XOR SHR^3(x) + + SSIG1(x) = ROTR^17(x) XOR ROTR^19(x) XOR SHR^10(x) + + SHA-224 and SHA-256 use the same sequence of sixty-four constant + 32-bit words, K0, K1, ..., K63. These words represent the first + thirty-two bits of the fractional parts of the cube roots of the + first sixty-four prime numbers. In hex, these constant words are as + follows (from left to right): + + 428a2f98 71374491 b5c0fbcf e9b5dba5 + 3956c25b 59f111f1 923f82a4 ab1c5ed5 + d807aa98 12835b01 243185be 550c7dc3 + 72be5d74 80deb1fe 9bdc06a7 c19bf174 + e49b69c1 efbe4786 0fc19dc6 240ca1cc + 2de92c6f 4a7484aa 5cb0a9dc 76f988da + 983e5152 a831c66d b00327c8 bf597fc7 + c6e00bf3 d5a79147 06ca6351 14292967 + 27b70a85 2e1b2138 4d2c6dfc 53380d13 + 650a7354 766a0abb 81c2c92e 92722c85 + a2bfe8a1 a81a664b c24b8b70 c76c51a3 + d192e819 d6990624 f40e3585 106aa070 + 19a4c116 1e376c08 2748774c 34b0bcb5 + + + + + +Eastlake 3rd & Hansen Informational [Page 9] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + 391c0cb3 4ed8aa4a 5b9cca4f 682e6ff3 + 748f82ee 78a5636f 84c87814 8cc70208 + 90befffa a4506ceb bef9a3f7 c67178f2 + +5.2. SHA-384 and SHA-512 + + SHA-384 and SHA-512 each use six logical functions, where each + function operates on 64-bit words, which are represented as x, y, and + z. The result of each function is a new 64-bit word. + + CH( x, y, z) = (x AND y) XOR ( (NOT x) AND z) + + MAJ( x, y, z) = (x AND y) XOR (x AND z) XOR (y AND z) + + BSIG0(x) = ROTR^28(x) XOR ROTR^34(x) XOR ROTR^39(x) + + BSIG1(x) = ROTR^14(x) XOR ROTR^18(x) XOR ROTR^41(x) + + SSIG0(x) = ROTR^1(x) XOR ROTR^8(x) XOR SHR^7(x) + + SSIG1(x) = ROTR^19(x) XOR ROTR^61(x) XOR SHR^6(x) + + SHA-384 and SHA-512 use the same sequence of eighty constant 64-bit + words, K0, K1, ... K79. These words represent the first sixty-four + bits of the fractional parts of the cube roots of the first eighty + prime numbers. In hex, these constant words are as follows (from + left to right): + + 428a2f98d728ae22 7137449123ef65cd b5c0fbcfec4d3b2f e9b5dba58189dbbc + 3956c25bf348b538 59f111f1b605d019 923f82a4af194f9b ab1c5ed5da6d8118 + d807aa98a3030242 12835b0145706fbe 243185be4ee4b28c 550c7dc3d5ffb4e2 + 72be5d74f27b896f 80deb1fe3b1696b1 9bdc06a725c71235 c19bf174cf692694 + e49b69c19ef14ad2 efbe4786384f25e3 0fc19dc68b8cd5b5 240ca1cc77ac9c65 + 2de92c6f592b0275 4a7484aa6ea6e483 5cb0a9dcbd41fbd4 76f988da831153b5 + 983e5152ee66dfab a831c66d2db43210 b00327c898fb213f bf597fc7beef0ee4 + c6e00bf33da88fc2 d5a79147930aa725 06ca6351e003826f 142929670a0e6e70 + 27b70a8546d22ffc 2e1b21385c26c926 4d2c6dfc5ac42aed 53380d139d95b3df + 650a73548baf63de 766a0abb3c77b2a8 81c2c92e47edaee6 92722c851482353b + a2bfe8a14cf10364 a81a664bbc423001 c24b8b70d0f89791 c76c51a30654be30 + d192e819d6ef5218 d69906245565a910 f40e35855771202a 106aa07032bbd1b8 + 19a4c116b8d2d0c8 1e376c085141ab53 2748774cdf8eeb99 34b0bcb5e19b48a8 + 391c0cb3c5c95a63 4ed8aa4ae3418acb 5b9cca4f7763e373 682e6ff3d6b2b8a3 + 748f82ee5defb2fc 78a5636f43172f60 84c87814a1f0ab72 8cc702081a6439ec + 90befffa23631e28 a4506cebde82bde9 bef9a3f7b2c67915 c67178f2e372532b + ca273eceea26619c d186b8c721c0c207 eada7dd6cde0eb1e f57d4f7fee6ed178 + 06f067aa72176fba 0a637dc5a2c898a6 113f9804bef90dae 1b710b35131c471b + 28db77f523047d84 32caab7b40c72493 3c9ebe0a15c9bebc 431d67c49c100d4c + 4cc5d4becb3e42b6 597f299cfc657e2a 5fcb6fab3ad6faec 6c44198c4a475817 + + + +Eastlake 3rd & Hansen Informational [Page 10] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +6. Computing the Message Digest + + The output of each of the secure hash functions, after being applied + to a message of N blocks, is the hash quantity H(N). For SHA-224 and + SHA-256, H(i) can be considered to be eight 32-bit words, H(i)0, + H(i)1, ... H(i)7. For SHA-384 and SHA-512, it can be considered to + be eight 64-bit words, H(i)0, H(i)1, ..., H(i)7. + + As described below, the hash words are initialized, modified as each + message block is processed, and finally concatenated after processing + the last block to yield the output. For SHA-256 and SHA-512, all of + the H(N) variables are concatenated while the SHA-224 and SHA-384 + hashes are produced by omitting some from the final concatenation. + +6.1. SHA-224 and SHA-256 Initialization + + For SHA-224, the initial hash value, H(0), consists of the following + 32-bit words in hex: + + H(0)0 = c1059ed8 + H(0)1 = 367cd507 + H(0)2 = 3070dd17 + H(0)3 = f70e5939 + H(0)4 = ffc00b31 + H(0)5 = 68581511 + H(0)6 = 64f98fa7 + H(0)7 = befa4fa4 + + For SHA-256, the initial hash value, H(0), consists of the following + eight 32-bit words, in hex. These words were obtained by taking the + first thirty-two bits of the fractional parts of the square roots of + the first eight prime numbers. + + H(0)0 = 6a09e667 + H(0)1 = bb67ae85 + H(0)2 = 3c6ef372 + H(0)3 = a54ff53a + H(0)4 = 510e527f + H(0)5 = 9b05688c + H(0)6 = 1f83d9ab + H(0)7 = 5be0cd19 + +6.2. SHA-224 and SHA-256 Processing + + SHA-224 and SHA-256 perform identical processing on messages blocks + and differ only in how H(0) is initialized and how they produce their + final output. They may be used to hash a message, M, having a length + of L bits, where 0 <= L < 2^64. The algorithm uses (1) a message + + + +Eastlake 3rd & Hansen Informational [Page 11] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + schedule of sixty-four 32-bit words, (2) eight working variables of + 32 bits each, and (3) a hash value of eight 32-bit words. + + The words of the message schedule are labeled W0, W1, ..., W63. The + eight working variables are labeled a, b, c, d, e, f, g, and h. The + words of the hash value are labeled H(i)0, H(i)1, ..., H(i)7, which + will hold the initial hash value, H(0), replaced by each successive + intermediate hash value (after each message block is processed), + H(i), and ending with the final hash value, H(N), after all N blocks + are processed. They also use two temporary words, T1 and T2. + + The input message is padded as described in Section 4.1 above then + parsed into 512-bit blocks, which are considered to be composed of 16 + 32-bit words M(i)0, M(i)1, ..., M(i)15. The following computations + are then performed for each of the N message blocks. All addition is + performed modulo 2^32. + + For i = 1 to N + + 1. Prepare the message schedule W: + For t = 0 to 15 + Wt = M(i)t + For t = 16 to 63 + Wt = SSIG1(W(t-2)) + W(t-7) + SSIG0(t-15) + W(t-16) + + 2. Initialize the working variables: + a = H(i-1)0 + b = H(i-1)1 + c = H(i-1)2 + d = H(i-1)3 + e = H(i-1)4 + f = H(i-1)5 + g = H(i-1)6 + h = H(i-1)7 + + 3. Perform the main hash computation: + For t = 0 to 63 + T1 = h + BSIG1(e) + CH(e,f,g) + Kt + Wt + T2 = BSIG0(a) + MAJ(a,b,c) + h = g + g = f + f = e + e = d + T1 + d = c + c = b + b = a + a = T1 + T2 + + + + +Eastlake 3rd & Hansen Informational [Page 12] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + 4. Compute the intermediate hash value H(i): + H(i)0 = a + H(i-1)0 + H(i)1 = b + H(i-1)1 + H(i)2 = c + H(i-1)2 + H(i)3 = d + H(i-1)3 + H(i)4 = e + H(i-1)4 + H(i)5 = f + H(i-1)5 + H(i)6 = g + H(i-1)6 + H(i)7 = h + H(i-1)7 + + After the above computations have been sequentially performed for all + of the blocks in the message, the final output is calculated. For + SHA-256, this is the concatenation of all of H(N)0, H(N)1, through + H(N)7. For SHA-224, this is the concatenation of H(N)0, H(N)1, + through H(N)6. + +6.3. SHA-384 and SHA-512 Initialization + + For SHA-384, the initial hash value, H(0), consists of the following + eight 64-bit words, in hex. These words were obtained by taking the + first sixty-four bits of the fractional parts of the square roots of + the ninth through sixteenth prime numbers. + + H(0)0 = cbbb9d5dc1059ed8 + H(0)1 = 629a292a367cd507 + H(0)2 = 9159015a3070dd17 + H(0)3 = 152fecd8f70e5939 + H(0)4 = 67332667ffc00b31 + H(0)5 = 8eb44a8768581511 + H(0)6 = db0c2e0d64f98fa7 + H(0)7 = 47b5481dbefa4fa4 + + For SHA-512, the initial hash value, H(0), consists of the following + eight 64-bit words, in hex. These words were obtained by taking the + first sixty-four bits of the fractional parts of the square roots of + the first eight prime numbers. + + H(0)0 = 6a09e667f3bcc908 + H(0)1 = bb67ae8584caa73b + H(0)2 = 3c6ef372fe94f82b + H(0)3 = a54ff53a5f1d36f1 + H(0)4 = 510e527fade682d1 + H(0)5 = 9b05688c2b3e6c1f + H(0)6 = 1f83d9abfb41bd6b + H(0)7 = 5be0cd19137e2179 + + + + + + +Eastlake 3rd & Hansen Informational [Page 13] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +6.4. SHA-384 and SHA-512 Processing + + SHA-384 and SHA-512 perform identical processing on message blocks + and differ only in how H(0) is initialized and how they produce their + final output. They may be used to hash a message, M, having a length + of L bits, where 0 <= L < 2^128. The algorithm uses (1) a message + schedule of eighty 64-bit words, (2) eight working variables of 64 + bits each, and (3) a hash value of eight 64-bit words. + + The words of the message schedule are labeled W0, W1, ..., W79. The + eight working variables are labeled a, b, c, d, e, f, g, and h. The + words of the hash value are labeled H(i)0, H(i)1, ..., H(i)7, which + will hold the initial hash value, H(0), replaced by each successive + intermediate hash value (after each message block is processed), + H(i), and ending with the final hash value, H(N) after all N blocks + are processed. + + The input message is padded as described in Section 4.2 above, then + parsed into 1024-bit blocks, which are considered to be composed of + 16 64-bit words M(i)0, M(i)1, ..., M(i)15. The following + computations are then performed for each of the N message blocks. + All addition is performed modulo 2^64. + + For i = 1 to N + + 1. Prepare the message schedule W: + For t = 0 to 15 + Wt = M(i)t + For t = 16 to 79 + Wt = SSIG1(W(t-2)) + W(t-7) + SSIG0(t-15) + W(t-16) + + 2. Initialize the working variables: + a = H(i-1)0 + b = H(i-1)1 + c = H(i-1)2 + d = H(i-1)3 + e = H(i-1)4 + f = H(i-1)5 + g = H(i-1)6 + h = H(i-1)7 + + 3. Perform the main hash computation: + For t = 0 to 79 + T1 = h + BSIG1(e) + CH(e,f,g) + Kt + Wt + T2 = BSIG0(a) + MAJ(a,b,c) + h = g + g = f + f = e + + + +Eastlake 3rd & Hansen Informational [Page 14] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + e = d + T1 + d = c + c = b + b = a + a = T1 + T2 + + 4. Compute the intermediate hash value H(i): + H(i)0 = a + H(i-1)0 + H(i)1 = b + H(i-1)1 + H(i)2 = c + H(i-1)2 + H(i)3 = d + H(i-1)3 + H(i)4 = e + H(i-1)4 + H(i)5 = f + H(i-1)5 + H(i)6 = g + H(i-1)6 + H(i)7 = h + H(i-1)7 + + After the above computations have been sequentially performed for all + of the blocks in the message, the final output is calculated. For + SHA-512, this is the concatenation of all of H(N)0, H(N)1, through + H(N)7. For SHA-384, this is the concatenation of H(N)0, H(N)1, + through H(N)5. + +7. SHA-Based HMACs + + HMAC is a method for computing a keyed MAC (message authentication + code) using a hash function as described in [RFC2104]. It uses a key + to mix in with the input text to produce the final hash. + + Sample code is also provided, in Section 8.3 below, to perform HMAC + based on any of the SHA algorithms described herein. The sample code + found in [RFC2104] was written in terms of a specified text size. + Since SHA is defined in terms of an arbitrary number of bits, the + sample HMAC code has been written to allow the text input to HMAC to + have an arbitrary number of octets and bits. A fixed-length + interface is also provided. + +8. C Code for SHAs + + Below is a demonstration implementation of these secure hash + functions in C. Section 8.1 contains the header file sha.h, which + declares all constants, structures, and functions used by the sha and + hmac functions. Section 8.2 contains the C code for sha1.c, + sha224-256.c, sha384-512.c, and usha.c along with sha-private.h, + which provides some declarations common to all the sha functions. + Section 8.3 contains the C code for the hmac functions. Section 8.4 + contains a test driver to exercise the code. + + + + + +Eastlake 3rd & Hansen Informational [Page 15] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + For each of the digest length $$$, there is the following set of + constants, a structure, and functions: + + Constants: + SHA$$$HashSize number of octets in the hash + SHA$$$HashSizeBits number of bits in the hash + SHA$$$_Message_Block_Size + number of octets used in the intermediate + message blocks + shaSuccess = 0 constant returned by each function on success + shaNull = 1 constant returned by each function when + presented with a null pointer parameter + shaInputTooLong = 2 constant returned by each function when the + input data is too long + shaStateError constant returned by each function when + SHA$$$Input is called after SHA$$$FinalBits or + SHA$$$Result. + + Structure: + typedef SHA$$$Context + an opaque structure holding the complete state + for producing the hash + + Functions: + int SHA$$$Reset(SHA$$$Context *); + Reset the hash context state + int SHA$$$Input(SHA$$$Context *, const uint8_t *octets, + unsigned int bytecount); + Incorporate bytecount octets into the hash. + int SHA$$$FinalBits(SHA$$$Context *, const uint8_t octet, + unsigned int bitcount); + Incorporate bitcount bits into the hash. The bits are in + the upper portion of the octet. SHA$$$Input() cannot be + called after this. + int SHA$$$Result(SHA$$$Context *, + uint8_t Message_Digest[SHA$$$HashSize]); + Do the final calculations on the hash and copy the value + into Message_Digest. + + In addition, functions with the prefix USHA are provided that take a + SHAversion value (SHA$$$) to select the SHA function suite. They add + the following constants, structure, and functions: + + Constants: + shaBadParam constant returned by USHA functions when + presented with a bad SHAversion (SHA$$$) + parameter + + + + +Eastlake 3rd & Hansen Informational [Page 16] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + SHA$$$ SHAversion enumeration values, used by usha + and hmac functions to select the SHA function + suite + + Structure: + typedef USHAContext + an opaque structure holding the complete state + for producing the hash + + Functions: + int USHAReset(USHAContext *, SHAversion whichSha); + Reset the hash context state. + int USHAInput(USHAContext *, + const uint8_t *bytes, unsigned int bytecount); + Incorporate bytecount octets into the hash. + int USHAFinalBits(USHAContext *, + const uint8_t bits, unsigned int bitcount); + Incorporate bitcount bits into the hash. + int USHAResult(USHAContext *, + uint8_t Message_Digest[USHAMaxHashSize]); + Do the final calculations on the hash and copy the value + into Message_Digest. Octets in Message_Digest beyond + USHAHashSize(whichSha) are left untouched. + int USHAHashSize(enum SHAversion whichSha); + The number of octets in the given hash. + int USHAHashSizeBits(enum SHAversion whichSha); + The number of bits in the given hash. + int USHABlockSize(enum SHAversion whichSha); + The internal block size for the given hash. + + The hmac functions follow the same pattern to allow any length of + text input to be used. + + Structure: + typedef HMACContext an opaque structure holding the complete state + for producing the hash + + Functions: + int hmacReset(HMACContext *ctx, enum SHAversion whichSha, + const unsigned char *key, int key_len); + Reset the hash context state. + int hmacInput(HMACContext *ctx, const unsigned char *text, + int text_len); + Incorporate text_len octets into the hash. + int hmacFinalBits(HMACContext *ctx, const uint8_t bits, + unsigned int bitcount); + Incorporate bitcount bits into the hash. + + + + +Eastlake 3rd & Hansen Informational [Page 17] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + int hmacResult(HMACContext *ctx, + uint8_t Message_Digest[USHAMaxHashSize]); + Do the final calculations on the hash and copy the value + into Message_Digest. Octets in Message_Digest beyond + USHAHashSize(whichSha) are left untouched. + + In addition, a combined interface is provided, similar to that shown + in RFC 2104, that allows a fixed-length text input to be used. + + int hmac(SHAversion whichSha, + const unsigned char *text, int text_len, + const unsigned char *key, int key_len, + uint8_t Message_Digest[USHAMaxHashSize]); + Calculate the given digest for the given text and key, and + return the resulting hash. Octets in Message_Digest beyond + USHAHashSize(whichSha) are left untouched. + +8.1. The .h File + +/**************************** sha.h ****************************/ +/******************* See RFC 4634 for details ******************/ +#ifndef _SHA_H_ +#define _SHA_H_ + +/* + * Description: + * This file implements the Secure Hash Signature Standard + * algorithms as defined in the National Institute of Standards + * and Technology Federal Information Processing Standards + * Publication (FIPS PUB) 180-1 published on April 17, 1995, 180-2 + * published on August 1, 2002, and the FIPS PUB 180-2 Change + * Notice published on February 28, 2004. + * + * A combined document showing all algorithms is available at + * http://csrc.nist.gov/publications/fips/ + * fips180-2/fips180-2withchangenotice.pdf + * + * The five hashes are defined in these sizes: + * SHA-1 20 byte / 160 bit + * SHA-224 28 byte / 224 bit + * SHA-256 32 byte / 256 bit + * SHA-384 48 byte / 384 bit + * SHA-512 64 byte / 512 bit + */ + +#include <stdint.h> +/* + * If you do not have the ISO standard stdint.h header file, then you + + + +Eastlake 3rd & Hansen Informational [Page 18] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * must typedef the following: + * name meaning + * uint64_t unsigned 64 bit integer + * uint32_t unsigned 32 bit integer + * uint8_t unsigned 8 bit integer (i.e., unsigned char) + * int_least16_t integer of >= 16 bits + * + */ + +#ifndef _SHA_enum_ +#define _SHA_enum_ +/* + * All SHA functions return one of these values. + */ +enum { + shaSuccess = 0, + shaNull, /* Null pointer parameter */ + shaInputTooLong, /* input data too long */ + shaStateError, /* called Input after FinalBits or Result */ + shaBadParam /* passed a bad parameter */ +}; +#endif /* _SHA_enum_ */ + +/* + * These constants hold size information for each of the SHA + * hashing operations + */ +enum { + SHA1_Message_Block_Size = 64, SHA224_Message_Block_Size = 64, + SHA256_Message_Block_Size = 64, SHA384_Message_Block_Size = 128, + SHA512_Message_Block_Size = 128, + USHA_Max_Message_Block_Size = SHA512_Message_Block_Size, + + SHA1HashSize = 20, SHA224HashSize = 28, SHA256HashSize = 32, + SHA384HashSize = 48, SHA512HashSize = 64, + USHAMaxHashSize = SHA512HashSize, + + SHA1HashSizeBits = 160, SHA224HashSizeBits = 224, + SHA256HashSizeBits = 256, SHA384HashSizeBits = 384, + SHA512HashSizeBits = 512, USHAMaxHashSizeBits = SHA512HashSizeBits +}; + +/* + * These constants are used in the USHA (unified sha) functions. + */ +typedef enum SHAversion { + SHA1, SHA224, SHA256, SHA384, SHA512 +} SHAversion; + + + +Eastlake 3rd & Hansen Informational [Page 19] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +/* + * This structure will hold context information for the SHA-1 + * hashing operation. + */ +typedef struct SHA1Context { + uint32_t Intermediate_Hash[SHA1HashSize/4]; /* Message Digest */ + + uint32_t Length_Low; /* Message length in bits */ + uint32_t Length_High; /* Message length in bits */ + + int_least16_t Message_Block_Index; /* Message_Block array index */ + /* 512-bit message blocks */ + uint8_t Message_Block[SHA1_Message_Block_Size]; + + int Computed; /* Is the digest computed? */ + int Corrupted; /* Is the digest corrupted? */ +} SHA1Context; + +/* + * This structure will hold context information for the SHA-256 + * hashing operation. + */ +typedef struct SHA256Context { + uint32_t Intermediate_Hash[SHA256HashSize/4]; /* Message Digest */ + + uint32_t Length_Low; /* Message length in bits */ + uint32_t Length_High; /* Message length in bits */ + + int_least16_t Message_Block_Index; /* Message_Block array index */ + /* 512-bit message blocks */ + uint8_t Message_Block[SHA256_Message_Block_Size]; + + int Computed; /* Is the digest computed? */ + int Corrupted; /* Is the digest corrupted? */ +} SHA256Context; + +/* + * This structure will hold context information for the SHA-512 + * hashing operation. + */ +typedef struct SHA512Context { +#ifdef USE_32BIT_ONLY + uint32_t Intermediate_Hash[SHA512HashSize/4]; /* Message Digest */ + uint32_t Length[4]; /* Message length in bits */ +#else /* !USE_32BIT_ONLY */ + uint64_t Intermediate_Hash[SHA512HashSize/8]; /* Message Digest */ + uint64_t Length_Low, Length_High; /* Message length in bits */ +#endif /* USE_32BIT_ONLY */ + + + +Eastlake 3rd & Hansen Informational [Page 20] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + int_least16_t Message_Block_Index; /* Message_Block array index */ + /* 1024-bit message blocks */ + uint8_t Message_Block[SHA512_Message_Block_Size]; + + int Computed; /* Is the digest computed?*/ + int Corrupted; /* Is the digest corrupted? */ +} SHA512Context; + +/* + * This structure will hold context information for the SHA-224 + * hashing operation. It uses the SHA-256 structure for computation. + */ +typedef struct SHA256Context SHA224Context; + +/* + * This structure will hold context information for the SHA-384 + * hashing operation. It uses the SHA-512 structure for computation. + */ +typedef struct SHA512Context SHA384Context; + +/* + * This structure holds context information for all SHA + * hashing operations. + */ +typedef struct USHAContext { + int whichSha; /* which SHA is being used */ + union { + SHA1Context sha1Context; + SHA224Context sha224Context; SHA256Context sha256Context; + SHA384Context sha384Context; SHA512Context sha512Context; + } ctx; +} USHAContext; + +/* + * This structure will hold context information for the HMAC + * keyed hashing operation. + */ +typedef struct HMACContext { + int whichSha; /* which SHA is being used */ + int hashSize; /* hash size of SHA being used */ + int blockSize; /* block size of SHA being used */ + USHAContext shaContext; /* SHA context */ + unsigned char k_opad[USHA_Max_Message_Block_Size]; + /* outer padding - key XORd with opad */ +} HMACContext; + + + + + + +Eastlake 3rd & Hansen Informational [Page 21] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +/* + * Function Prototypes + */ + +/* SHA-1 */ +extern int SHA1Reset(SHA1Context *); +extern int SHA1Input(SHA1Context *, const uint8_t *bytes, + unsigned int bytecount); +extern int SHA1FinalBits(SHA1Context *, const uint8_t bits, + unsigned int bitcount); +extern int SHA1Result(SHA1Context *, + uint8_t Message_Digest[SHA1HashSize]); + +/* SHA-224 */ +extern int SHA224Reset(SHA224Context *); +extern int SHA224Input(SHA224Context *, const uint8_t *bytes, + unsigned int bytecount); +extern int SHA224FinalBits(SHA224Context *, const uint8_t bits, + unsigned int bitcount); +extern int SHA224Result(SHA224Context *, + uint8_t Message_Digest[SHA224HashSize]); + +/* SHA-256 */ +extern int SHA256Reset(SHA256Context *); +extern int SHA256Input(SHA256Context *, const uint8_t *bytes, + unsigned int bytecount); +extern int SHA256FinalBits(SHA256Context *, const uint8_t bits, + unsigned int bitcount); +extern int SHA256Result(SHA256Context *, + uint8_t Message_Digest[SHA256HashSize]); + +/* SHA-384 */ +extern int SHA384Reset(SHA384Context *); +extern int SHA384Input(SHA384Context *, const uint8_t *bytes, + unsigned int bytecount); +extern int SHA384FinalBits(SHA384Context *, const uint8_t bits, + unsigned int bitcount); +extern int SHA384Result(SHA384Context *, + uint8_t Message_Digest[SHA384HashSize]); + +/* SHA-512 */ +extern int SHA512Reset(SHA512Context *); +extern int SHA512Input(SHA512Context *, const uint8_t *bytes, + unsigned int bytecount); +extern int SHA512FinalBits(SHA512Context *, const uint8_t bits, + unsigned int bitcount); +extern int SHA512Result(SHA512Context *, + uint8_t Message_Digest[SHA512HashSize]); + + + +Eastlake 3rd & Hansen Informational [Page 22] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +/* Unified SHA functions, chosen by whichSha */ +extern int USHAReset(USHAContext *, SHAversion whichSha); +extern int USHAInput(USHAContext *, + const uint8_t *bytes, unsigned int bytecount); +extern int USHAFinalBits(USHAContext *, + const uint8_t bits, unsigned int bitcount); +extern int USHAResult(USHAContext *, + uint8_t Message_Digest[USHAMaxHashSize]); +extern int USHABlockSize(enum SHAversion whichSha); +extern int USHAHashSize(enum SHAversion whichSha); +extern int USHAHashSizeBits(enum SHAversion whichSha); + +/* + * HMAC Keyed-Hashing for Message Authentication, RFC2104, + * for all SHAs. + * This interface allows a fixed-length text input to be used. + */ +extern int hmac(SHAversion whichSha, /* which SHA algorithm to use */ + const unsigned char *text, /* pointer to data stream */ + int text_len, /* length of data stream */ + const unsigned char *key, /* pointer to authentication key */ + int key_len, /* length of authentication key */ + uint8_t digest[USHAMaxHashSize]); /* caller digest to fill in */ + +/* + * HMAC Keyed-Hashing for Message Authentication, RFC2104, + * for all SHAs. + * This interface allows any length of text input to be used. + */ +extern int hmacReset(HMACContext *ctx, enum SHAversion whichSha, + const unsigned char *key, int key_len); +extern int hmacInput(HMACContext *ctx, const unsigned char *text, + int text_len); + +extern int hmacFinalBits(HMACContext *ctx, const uint8_t bits, + unsigned int bitcount); +extern int hmacResult(HMACContext *ctx, + uint8_t digest[USHAMaxHashSize]); + +#endif /* _SHA_H_ */ + + + + + + + + + + + +Eastlake 3rd & Hansen Informational [Page 23] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +8.2. The SHA Code + + This code is primarily intended as expository and could be optimized + further. For example, the assignment rotations through the variables + a, b, ..., h could be treated as a cycle and the loop unrolled, + rather than doing the explicit copying. + + Note that there are alternative representations of the Ch() and Maj() + functions controlled by an ifdef. + +8.2.1. sha1.c + +/**************************** sha1.c ****************************/ +/******************** See RFC 4634 for details ******************/ +/* + * Description: + * This file implements the Secure Hash Signature Standard + * algorithms as defined in the National Institute of Standards + * and Technology Federal Information Processing Standards + * Publication (FIPS PUB) 180-1 published on April 17, 1995, 180-2 + * published on August 1, 2002, and the FIPS PUB 180-2 Change + * Notice published on February 28, 2004. + * + * A combined document showing all algorithms is available at + * http://csrc.nist.gov/publications/fips/ + * fips180-2/fips180-2withchangenotice.pdf + * + * The SHA-1 algorithm produces a 160-bit message digest for a + * given data stream. It should take about 2**n steps to find a + * message with the same digest as a given message and + * 2**(n/2) to find any two messages with the same digest, + * when n is the digest size in bits. Therefore, this + * algorithm can serve as a means of providing a + * "fingerprint" for a message. + * + * Portability Issues: + * SHA-1 is defined in terms of 32-bit "words". This code + * uses <stdint.h> (included via "sha.h") to define 32 and 8 + * bit unsigned integer types. If your C compiler does not + * support 32 bit unsigned integers, this code is not + * appropriate. + * + * Caveats: + * SHA-1 is designed to work with messages less than 2^64 bits + * long. This implementation uses SHA1Input() to hash the bits + * that are a multiple of the size of an 8-bit character, and then + * uses SHA1FinalBits() to hash the final few bits of the input. + */ + + + +Eastlake 3rd & Hansen Informational [Page 24] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +#include "sha.h" +#include "sha-private.h" + +/* + * Define the SHA1 circular left shift macro + */ +#define SHA1_ROTL(bits,word) \ + (((word) << (bits)) | ((word) >> (32-(bits)))) + +/* + * add "length" to the length + */ +static uint32_t addTemp; +#define SHA1AddLength(context, length) \ + (addTemp = (context)->Length_Low, \ + (context)->Corrupted = \ + (((context)->Length_Low += (length)) < addTemp) && \ + (++(context)->Length_High == 0) ? 1 : 0) + +/* Local Function Prototypes */ +static void SHA1Finalize(SHA1Context *context, uint8_t Pad_Byte); +static void SHA1PadMessage(SHA1Context *, uint8_t Pad_Byte); +static void SHA1ProcessMessageBlock(SHA1Context *); + +/* + * SHA1Reset + * + * Description: + * This function will initialize the SHA1Context in preparation + * for computing a new SHA1 message digest. + * + * Parameters: + * context: [in/out] + * The context to reset. + * + * Returns: + * sha Error Code. + * + */ +int SHA1Reset(SHA1Context *context) +{ + if (!context) + return shaNull; + + context->Length_Low = 0; + context->Length_High = 0; + context->Message_Block_Index = 0; + + + + +Eastlake 3rd & Hansen Informational [Page 25] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + /* Initial Hash Values: FIPS-180-2 section 5.3.1 */ + context->Intermediate_Hash[0] = 0x67452301; + context->Intermediate_Hash[1] = 0xEFCDAB89; + context->Intermediate_Hash[2] = 0x98BADCFE; + context->Intermediate_Hash[3] = 0x10325476; + context->Intermediate_Hash[4] = 0xC3D2E1F0; + + context->Computed = 0; + context->Corrupted = 0; + + return shaSuccess; +} + +/* + * SHA1Input + * + * Description: + * This function accepts an array of octets as the next portion + * of the message. + * + * Parameters: + * context: [in/out] + * The SHA context to update + * message_array: [in] + * An array of characters representing the next portion of + * the message. + * length: [in] + * The length of the message in message_array + * + * Returns: + * sha Error Code. + * + */ +int SHA1Input(SHA1Context *context, + const uint8_t *message_array, unsigned length) +{ + if (!length) + return shaSuccess; + + if (!context || !message_array) + return shaNull; + + if (context->Computed) { + context->Corrupted = shaStateError; + return shaStateError; + } + + if (context->Corrupted) + + + +Eastlake 3rd & Hansen Informational [Page 26] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + return context->Corrupted; + + while (length-- && !context->Corrupted) { + context->Message_Block[context->Message_Block_Index++] = + (*message_array & 0xFF); + + if (!SHA1AddLength(context, 8) && + (context->Message_Block_Index == SHA1_Message_Block_Size)) + SHA1ProcessMessageBlock(context); + + message_array++; + } + + return shaSuccess; +} + +/* + * SHA1FinalBits + * + * Description: + * This function will add in any final bits of the message. + * + * Parameters: + * context: [in/out] + * The SHA context to update + * message_bits: [in] + * The final bits of the message, in the upper portion of the + * byte. (Use 0b###00000 instead of 0b00000### to input the + * three bits ###.) + * length: [in] + * The number of bits in message_bits, between 1 and 7. + * + * Returns: + * sha Error Code. + */ +int SHA1FinalBits(SHA1Context *context, const uint8_t message_bits, + unsigned int length) +{ + uint8_t masks[8] = { + /* 0 0b00000000 */ 0x00, /* 1 0b10000000 */ 0x80, + /* 2 0b11000000 */ 0xC0, /* 3 0b11100000 */ 0xE0, + /* 4 0b11110000 */ 0xF0, /* 5 0b11111000 */ 0xF8, + /* 6 0b11111100 */ 0xFC, /* 7 0b11111110 */ 0xFE + }; + uint8_t markbit[8] = { + /* 0 0b10000000 */ 0x80, /* 1 0b01000000 */ 0x40, + /* 2 0b00100000 */ 0x20, /* 3 0b00010000 */ 0x10, + /* 4 0b00001000 */ 0x08, /* 5 0b00000100 */ 0x04, + + + +Eastlake 3rd & Hansen Informational [Page 27] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + /* 6 0b00000010 */ 0x02, /* 7 0b00000001 */ 0x01 + }; + + if (!length) + return shaSuccess; + + if (!context) + return shaNull; + + if (context->Computed || (length >= 8) || (length == 0)) { + context->Corrupted = shaStateError; + return shaStateError; + } + + if (context->Corrupted) + return context->Corrupted; + + SHA1AddLength(context, length); + SHA1Finalize(context, + (uint8_t) ((message_bits & masks[length]) | markbit[length])); + + return shaSuccess; +} + +/* + * SHA1Result + * + * Description: + * This function will return the 160-bit message digest into the + * Message_Digest array provided by the caller. + * NOTE: The first octet of hash is stored in the 0th element, + * the last octet of hash in the 19th element. + * + * Parameters: + * context: [in/out] + * The context to use to calculate the SHA-1 hash. + * Message_Digest: [out] + * Where the digest is returned. + * + * Returns: + * sha Error Code. + * + */ +int SHA1Result(SHA1Context *context, + uint8_t Message_Digest[SHA1HashSize]) +{ + int i; + + + + +Eastlake 3rd & Hansen Informational [Page 28] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + if (!context || !Message_Digest) + return shaNull; + + if (context->Corrupted) + return context->Corrupted; + + if (!context->Computed) + SHA1Finalize(context, 0x80); + + for (i = 0; i < SHA1HashSize; ++i) + Message_Digest[i] = (uint8_t) (context->Intermediate_Hash[i>>2] + >> 8 * ( 3 - ( i & 0x03 ) )); + + return shaSuccess; +} + +/* + * SHA1Finalize + * + * Description: + * This helper function finishes off the digest calculations. + * + * Parameters: + * context: [in/out] + * The SHA context to update + * Pad_Byte: [in] + * The last byte to add to the digest before the 0-padding + * and length. This will contain the last bits of the message + * followed by another single bit. If the message was an + * exact multiple of 8-bits long, Pad_Byte will be 0x80. + * + * Returns: + * sha Error Code. + * + */ +static void SHA1Finalize(SHA1Context *context, uint8_t Pad_Byte) +{ + int i; + SHA1PadMessage(context, Pad_Byte); + /* message may be sensitive, clear it out */ + for (i = 0; i < SHA1_Message_Block_Size; ++i) + context->Message_Block[i] = 0; + context->Length_Low = 0; /* and clear length */ + context->Length_High = 0; + context->Computed = 1; +} + +/* + + + +Eastlake 3rd & Hansen Informational [Page 29] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * SHA1PadMessage + * + * Description: + * According to the standard, the message must be padded to an + * even 512 bits. The first padding bit must be a '1'. The last + * 64 bits represent the length of the original message. All bits + * in between should be 0. This helper function will pad the + * message according to those rules by filling the Message_Block + * array accordingly. When it returns, it can be assumed that the + * message digest has been computed. + * + * Parameters: + * context: [in/out] + * The context to pad + * Pad_Byte: [in] + * The last byte to add to the digest before the 0-padding + * and length. This will contain the last bits of the message + * followed by another single bit. If the message was an + * exact multiple of 8-bits long, Pad_Byte will be 0x80. + * + * Returns: + * Nothing. + */ +static void SHA1PadMessage(SHA1Context *context, uint8_t Pad_Byte) +{ + /* + * Check to see if the current message block is too small to hold + * the initial padding bits and length. If so, we will pad the + * block, process it, and then continue padding into a second + * block. + */ + if (context->Message_Block_Index >= (SHA1_Message_Block_Size - 8)) { + context->Message_Block[context->Message_Block_Index++] = Pad_Byte; + while (context->Message_Block_Index < SHA1_Message_Block_Size) + context->Message_Block[context->Message_Block_Index++] = 0; + + SHA1ProcessMessageBlock(context); + } else + context->Message_Block[context->Message_Block_Index++] = Pad_Byte; + + while (context->Message_Block_Index < (SHA1_Message_Block_Size - 8)) + context->Message_Block[context->Message_Block_Index++] = 0; + + /* + * Store the message length as the last 8 octets + */ + context->Message_Block[56] = (uint8_t) (context->Length_High >> 24); + context->Message_Block[57] = (uint8_t) (context->Length_High >> 16); + + + +Eastlake 3rd & Hansen Informational [Page 30] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + context->Message_Block[58] = (uint8_t) (context->Length_High >> 8); + context->Message_Block[59] = (uint8_t) (context->Length_High); + context->Message_Block[60] = (uint8_t) (context->Length_Low >> 24); + context->Message_Block[61] = (uint8_t) (context->Length_Low >> 16); + context->Message_Block[62] = (uint8_t) (context->Length_Low >> 8); + context->Message_Block[63] = (uint8_t) (context->Length_Low); + + SHA1ProcessMessageBlock(context); +} + +/* + * SHA1ProcessMessageBlock + * + * Description: + * This helper function will process the next 512 bits of the + * message stored in the Message_Block array. + * + * Parameters: + * None. + * + * Returns: + * Nothing. + * + * Comments: + * Many of the variable names in this code, especially the + * single character names, were used because those were the + * names used in the publication. + */ +static void SHA1ProcessMessageBlock(SHA1Context *context) +{ + /* Constants defined in FIPS-180-2, section 4.2.1 */ + const uint32_t K[4] = { + 0x5A827999, 0x6ED9EBA1, 0x8F1BBCDC, 0xCA62C1D6 + }; + int t; /* Loop counter */ + uint32_t temp; /* Temporary word value */ + uint32_t W[80]; /* Word sequence */ + uint32_t A, B, C, D, E; /* Word buffers */ + + /* + * Initialize the first 16 words in the array W + */ + for (t = 0; t < 16; t++) { + W[t] = ((uint32_t)context->Message_Block[t * 4]) << 24; + W[t] |= ((uint32_t)context->Message_Block[t * 4 + 1]) << 16; + W[t] |= ((uint32_t)context->Message_Block[t * 4 + 2]) << 8; + W[t] |= ((uint32_t)context->Message_Block[t * 4 + 3]); + } + + + +Eastlake 3rd & Hansen Informational [Page 31] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + for (t = 16; t < 80; t++) + W[t] = SHA1_ROTL(1, W[t-3] ^ W[t-8] ^ W[t-14] ^ W[t-16]); + + A = context->Intermediate_Hash[0]; + B = context->Intermediate_Hash[1]; + C = context->Intermediate_Hash[2]; + D = context->Intermediate_Hash[3]; + E = context->Intermediate_Hash[4]; + + for (t = 0; t < 20; t++) { + temp = SHA1_ROTL(5,A) + SHA_Ch(B, C, D) + E + W[t] + K[0]; + E = D; + D = C; + C = SHA1_ROTL(30,B); + B = A; + A = temp; + } + + for (t = 20; t < 40; t++) { + temp = SHA1_ROTL(5,A) + SHA_Parity(B, C, D) + E + W[t] + K[1]; + E = D; + D = C; + C = SHA1_ROTL(30,B); + B = A; + A = temp; + } + + for (t = 40; t < 60; t++) { + temp = SHA1_ROTL(5,A) + SHA_Maj(B, C, D) + E + W[t] + K[2]; + E = D; + D = C; + C = SHA1_ROTL(30,B); + B = A; + A = temp; + } + + for (t = 60; t < 80; t++) { + temp = SHA1_ROTL(5,A) + SHA_Parity(B, C, D) + E + W[t] + K[3]; + E = D; + D = C; + C = SHA1_ROTL(30,B); + B = A; + A = temp; + } + + context->Intermediate_Hash[0] += A; + context->Intermediate_Hash[1] += B; + context->Intermediate_Hash[2] += C; + + + +Eastlake 3rd & Hansen Informational [Page 32] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + context->Intermediate_Hash[3] += D; + context->Intermediate_Hash[4] += E; + + context->Message_Block_Index = 0; +} + +8.2.2. sha224-256.c + +/*************************** sha224-256.c ***************************/ +/********************* See RFC 4634 for details *********************/ +/* + * Description: + * This file implements the Secure Hash Signature Standard + * algorithms as defined in the National Institute of Standards + * and Technology Federal Information Processing Standards + * Publication (FIPS PUB) 180-1 published on April 17, 1995, 180-2 + * published on August 1, 2002, and the FIPS PUB 180-2 Change + * Notice published on February 28, 2004. + * + * A combined document showing all algorithms is available at + * http://csrc.nist.gov/publications/fips/ + * fips180-2/fips180-2withchangenotice.pdf + * + * The SHA-224 and SHA-256 algorithms produce 224-bit and 256-bit + * message digests for a given data stream. It should take about + * 2**n steps to find a message with the same digest as a given + * message and 2**(n/2) to find any two messages with the same + * digest, when n is the digest size in bits. Therefore, this + * algorithm can serve as a means of providing a + * "fingerprint" for a message. + * + * Portability Issues: + * SHA-224 and SHA-256 are defined in terms of 32-bit "words". + * This code uses <stdint.h> (included via "sha.h") to define 32 + * and 8 bit unsigned integer types. If your C compiler does not + * support 32 bit unsigned integers, this code is not + * appropriate. + * + * Caveats: + * SHA-224 and SHA-256 are designed to work with messages less + * than 2^64 bits long. This implementation uses SHA224/256Input() + * to hash the bits that are a multiple of the size of an 8-bit + * character, and then uses SHA224/256FinalBits() to hash the + * final few bits of the input. + */ + +#include "sha.h" +#include "sha-private.h" + + + +Eastlake 3rd & Hansen Informational [Page 33] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +/* Define the SHA shift, rotate left and rotate right macro */ +#define SHA256_SHR(bits,word) ((word) >> (bits)) +#define SHA256_ROTL(bits,word) \ + (((word) << (bits)) | ((word) >> (32-(bits)))) +#define SHA256_ROTR(bits,word) \ + (((word) >> (bits)) | ((word) << (32-(bits)))) + +/* Define the SHA SIGMA and sigma macros */ +#define SHA256_SIGMA0(word) \ + (SHA256_ROTR( 2,word) ^ SHA256_ROTR(13,word) ^ SHA256_ROTR(22,word)) +#define SHA256_SIGMA1(word) \ + (SHA256_ROTR( 6,word) ^ SHA256_ROTR(11,word) ^ SHA256_ROTR(25,word)) +#define SHA256_sigma0(word) \ + (SHA256_ROTR( 7,word) ^ SHA256_ROTR(18,word) ^ SHA256_SHR( 3,word)) +#define SHA256_sigma1(word) \ + (SHA256_ROTR(17,word) ^ SHA256_ROTR(19,word) ^ SHA256_SHR(10,word)) + +/* + * add "length" to the length + */ +static uint32_t addTemp; +#define SHA224_256AddLength(context, length) \ + (addTemp = (context)->Length_Low, (context)->Corrupted = \ + (((context)->Length_Low += (length)) < addTemp) && \ + (++(context)->Length_High == 0) ? 1 : 0) + +/* Local Function Prototypes */ +static void SHA224_256Finalize(SHA256Context *context, + uint8_t Pad_Byte); +static void SHA224_256PadMessage(SHA256Context *context, + uint8_t Pad_Byte); +static void SHA224_256ProcessMessageBlock(SHA256Context *context); +static int SHA224_256Reset(SHA256Context *context, uint32_t *H0); +static int SHA224_256ResultN(SHA256Context *context, + uint8_t Message_Digest[], int HashSize); + +/* Initial Hash Values: FIPS-180-2 Change Notice 1 */ +static uint32_t SHA224_H0[SHA256HashSize/4] = { + 0xC1059ED8, 0x367CD507, 0x3070DD17, 0xF70E5939, + 0xFFC00B31, 0x68581511, 0x64F98FA7, 0xBEFA4FA4 +}; + +/* Initial Hash Values: FIPS-180-2 section 5.3.2 */ +static uint32_t SHA256_H0[SHA256HashSize/4] = { + 0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A, + 0x510E527F, 0x9B05688C, 0x1F83D9AB, 0x5BE0CD19 +}; + + + + +Eastlake 3rd & Hansen Informational [Page 34] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +/* + * SHA224Reset + * + * Description: + * This function will initialize the SHA384Context in preparation + * for computing a new SHA224 message digest. + * + * Parameters: + * context: [in/out] + * The context to reset. + * + * Returns: + * sha Error Code. + */ +int SHA224Reset(SHA224Context *context) +{ + return SHA224_256Reset(context, SHA224_H0); +} + +/* + * SHA224Input + * + * Description: + * This function accepts an array of octets as the next portion + * of the message. + * + * Parameters: + * context: [in/out] + * The SHA context to update + * message_array: [in] + * An array of characters representing the next portion of + * the message. + * length: [in] + * The length of the message in message_array + * + * Returns: + * sha Error Code. + * + */ +int SHA224Input(SHA224Context *context, const uint8_t *message_array, + unsigned int length) +{ + return SHA256Input(context, message_array, length); +} + +/* + * SHA224FinalBits + * + + + +Eastlake 3rd & Hansen Informational [Page 35] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * Description: + * This function will add in any final bits of the message. + * + * Parameters: + * context: [in/out] + * The SHA context to update + * message_bits: [in] + * The final bits of the message, in the upper portion of the + * byte. (Use 0b###00000 instead of 0b00000### to input the + * three bits ###.) + * length: [in] + * The number of bits in message_bits, between 1 and 7. + * + * Returns: + * sha Error Code. + */ +int SHA224FinalBits( SHA224Context *context, + const uint8_t message_bits, unsigned int length) +{ + return SHA256FinalBits(context, message_bits, length); +} + +/* + * SHA224Result + * + * Description: + * This function will return the 224-bit message + * digest into the Message_Digest array provided by the caller. + * NOTE: The first octet of hash is stored in the 0th element, + * the last octet of hash in the 28th element. + * + * Parameters: + * context: [in/out] + * The context to use to calculate the SHA hash. + * Message_Digest: [out] + * Where the digest is returned. + * + * Returns: + * sha Error Code. + */ +int SHA224Result(SHA224Context *context, + uint8_t Message_Digest[SHA224HashSize]) +{ + return SHA224_256ResultN(context, Message_Digest, SHA224HashSize); +} + +/* + * SHA256Reset + + + +Eastlake 3rd & Hansen Informational [Page 36] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * + * Description: + * This function will initialize the SHA256Context in preparation + * for computing a new SHA256 message digest. + * + * Parameters: + * context: [in/out] + * The context to reset. + * + * Returns: + * sha Error Code. + */ +int SHA256Reset(SHA256Context *context) +{ + return SHA224_256Reset(context, SHA256_H0); +} + +/* + * SHA256Input + * + * Description: + * This function accepts an array of octets as the next portion + * of the message. + * + * Parameters: + * context: [in/out] + * The SHA context to update + * message_array: [in] + * An array of characters representing the next portion of + * the message. + * length: [in] + * The length of the message in message_array + * + * Returns: + * sha Error Code. + */ +int SHA256Input(SHA256Context *context, const uint8_t *message_array, + unsigned int length) +{ + if (!length) + return shaSuccess; + + if (!context || !message_array) + return shaNull; + + if (context->Computed) { + context->Corrupted = shaStateError; + return shaStateError; + + + +Eastlake 3rd & Hansen Informational [Page 37] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + } + + if (context->Corrupted) + return context->Corrupted; + + while (length-- && !context->Corrupted) { + context->Message_Block[context->Message_Block_Index++] = + (*message_array & 0xFF); + + if (!SHA224_256AddLength(context, 8) && + (context->Message_Block_Index == SHA256_Message_Block_Size)) + SHA224_256ProcessMessageBlock(context); + + message_array++; + } + + return shaSuccess; + +} + +/* + * SHA256FinalBits + * + * Description: + * This function will add in any final bits of the message. + * + * Parameters: + * context: [in/out] + * The SHA context to update + * message_bits: [in] + * The final bits of the message, in the upper portion of the + * byte. (Use 0b###00000 instead of 0b00000### to input the + * three bits ###.) + * length: [in] + * The number of bits in message_bits, between 1 and 7. + * + * Returns: + * sha Error Code. + */ +int SHA256FinalBits(SHA256Context *context, + const uint8_t message_bits, unsigned int length) +{ + uint8_t masks[8] = { + /* 0 0b00000000 */ 0x00, /* 1 0b10000000 */ 0x80, + /* 2 0b11000000 */ 0xC0, /* 3 0b11100000 */ 0xE0, + /* 4 0b11110000 */ 0xF0, /* 5 0b11111000 */ 0xF8, + /* 6 0b11111100 */ 0xFC, /* 7 0b11111110 */ 0xFE + }; + + + +Eastlake 3rd & Hansen Informational [Page 38] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + uint8_t markbit[8] = { + /* 0 0b10000000 */ 0x80, /* 1 0b01000000 */ 0x40, + /* 2 0b00100000 */ 0x20, /* 3 0b00010000 */ 0x10, + /* 4 0b00001000 */ 0x08, /* 5 0b00000100 */ 0x04, + /* 6 0b00000010 */ 0x02, /* 7 0b00000001 */ 0x01 + }; + + if (!length) + return shaSuccess; + + if (!context) + return shaNull; + + if ((context->Computed) || (length >= 8) || (length == 0)) { + context->Corrupted = shaStateError; + return shaStateError; + } + + if (context->Corrupted) + return context->Corrupted; + + SHA224_256AddLength(context, length); + SHA224_256Finalize(context, (uint8_t) + ((message_bits & masks[length]) | markbit[length])); + + return shaSuccess; +} + +/* + * SHA256Result + * + * Description: + * This function will return the 256-bit message + * digest into the Message_Digest array provided by the caller. + * NOTE: The first octet of hash is stored in the 0th element, + * the last octet of hash in the 32nd element. + * + * Parameters: + * context: [in/out] + * The context to use to calculate the SHA hash. + * Message_Digest: [out] + * Where the digest is returned. + * + * Returns: + * sha Error Code. + */ +int SHA256Result(SHA256Context *context, uint8_t Message_Digest[]) +{ + + + +Eastlake 3rd & Hansen Informational [Page 39] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + return SHA224_256ResultN(context, Message_Digest, SHA256HashSize); +} + +/* + * SHA224_256Finalize + * + * Description: + * This helper function finishes off the digest calculations. + * + * Parameters: + * context: [in/out] + * The SHA context to update + * Pad_Byte: [in] + * The last byte to add to the digest before the 0-padding + * and length. This will contain the last bits of the message + * followed by another single bit. If the message was an + * exact multiple of 8-bits long, Pad_Byte will be 0x80. + * + * Returns: + * sha Error Code. + */ +static void SHA224_256Finalize(SHA256Context *context, + uint8_t Pad_Byte) +{ + int i; + SHA224_256PadMessage(context, Pad_Byte); + /* message may be sensitive, so clear it out */ + for (i = 0; i < SHA256_Message_Block_Size; ++i) + context->Message_Block[i] = 0; + context->Length_Low = 0; /* and clear length */ + context->Length_High = 0; + context->Computed = 1; +} + +/* + * SHA224_256PadMessage + * + * Description: + * According to the standard, the message must be padded to an + * even 512 bits. The first padding bit must be a '1'. The + * last 64 bits represent the length of the original message. + * All bits in between should be 0. This helper function will pad + * the message according to those rules by filling the + * Message_Block array accordingly. When it returns, it can be + * assumed that the message digest has been computed. + * + * Parameters: + * context: [in/out] + + + +Eastlake 3rd & Hansen Informational [Page 40] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * The context to pad + * Pad_Byte: [in] + * The last byte to add to the digest before the 0-padding + * and length. This will contain the last bits of the message + * followed by another single bit. If the message was an + * exact multiple of 8-bits long, Pad_Byte will be 0x80. + * + * Returns: + * Nothing. + */ +static void SHA224_256PadMessage(SHA256Context *context, + uint8_t Pad_Byte) +{ + /* + * Check to see if the current message block is too small to hold + * the initial padding bits and length. If so, we will pad the + * block, process it, and then continue padding into a second + * block. + */ + if (context->Message_Block_Index >= (SHA256_Message_Block_Size-8)) { + context->Message_Block[context->Message_Block_Index++] = Pad_Byte; + while (context->Message_Block_Index < SHA256_Message_Block_Size) + context->Message_Block[context->Message_Block_Index++] = 0; + SHA224_256ProcessMessageBlock(context); + } else + context->Message_Block[context->Message_Block_Index++] = Pad_Byte; + + while (context->Message_Block_Index < (SHA256_Message_Block_Size-8)) + context->Message_Block[context->Message_Block_Index++] = 0; + + /* + * Store the message length as the last 8 octets + */ + context->Message_Block[56] = (uint8_t)(context->Length_High >> 24); + context->Message_Block[57] = (uint8_t)(context->Length_High >> 16); + context->Message_Block[58] = (uint8_t)(context->Length_High >> 8); + context->Message_Block[59] = (uint8_t)(context->Length_High); + context->Message_Block[60] = (uint8_t)(context->Length_Low >> 24); + context->Message_Block[61] = (uint8_t)(context->Length_Low >> 16); + context->Message_Block[62] = (uint8_t)(context->Length_Low >> 8); + context->Message_Block[63] = (uint8_t)(context->Length_Low); + + SHA224_256ProcessMessageBlock(context); +} + +/* + * SHA224_256ProcessMessageBlock + * + + + +Eastlake 3rd & Hansen Informational [Page 41] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * Description: + * This function will process the next 512 bits of the message + * stored in the Message_Block array. + * + * Parameters: + * context: [in/out] + * The SHA context to update + * + * Returns: + * Nothing. + * + * Comments: + * Many of the variable names in this code, especially the + * single character names, were used because those were the + * names used in the publication. + */ +static void SHA224_256ProcessMessageBlock(SHA256Context *context) +{ + /* Constants defined in FIPS-180-2, section 4.2.2 */ + static const uint32_t K[64] = { + 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, + 0x59f111f1, 0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, + 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, + 0xc19bf174, 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, + 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da, 0x983e5152, + 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, + 0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, + 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, + 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, + 0xd6990624, 0xf40e3585, 0x106aa070, 0x19a4c116, 0x1e376c08, + 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, + 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, + 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2 + }; + int t, t4; /* Loop counter */ + uint32_t temp1, temp2; /* Temporary word value */ + uint32_t W[64]; /* Word sequence */ + uint32_t A, B, C, D, E, F, G, H; /* Word buffers */ + + /* + * Initialize the first 16 words in the array W + */ + for (t = t4 = 0; t < 16; t++, t4 += 4) + W[t] = (((uint32_t)context->Message_Block[t4]) << 24) | + (((uint32_t)context->Message_Block[t4 + 1]) << 16) | + (((uint32_t)context->Message_Block[t4 + 2]) << 8) | + (((uint32_t)context->Message_Block[t4 + 3])); + + + + +Eastlake 3rd & Hansen Informational [Page 42] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + for (t = 16; t < 64; t++) + W[t] = SHA256_sigma1(W[t-2]) + W[t-7] + + SHA256_sigma0(W[t-15]) + W[t-16]; + + A = context->Intermediate_Hash[0]; + B = context->Intermediate_Hash[1]; + C = context->Intermediate_Hash[2]; + D = context->Intermediate_Hash[3]; + E = context->Intermediate_Hash[4]; + F = context->Intermediate_Hash[5]; + G = context->Intermediate_Hash[6]; + H = context->Intermediate_Hash[7]; + + for (t = 0; t < 64; t++) { + temp1 = H + SHA256_SIGMA1(E) + SHA_Ch(E,F,G) + K[t] + W[t]; + temp2 = SHA256_SIGMA0(A) + SHA_Maj(A,B,C); + H = G; + G = F; + F = E; + E = D + temp1; + D = C; + C = B; + B = A; + A = temp1 + temp2; + } + + context->Intermediate_Hash[0] += A; + context->Intermediate_Hash[1] += B; + context->Intermediate_Hash[2] += C; + context->Intermediate_Hash[3] += D; + context->Intermediate_Hash[4] += E; + context->Intermediate_Hash[5] += F; + context->Intermediate_Hash[6] += G; + context->Intermediate_Hash[7] += H; + + context->Message_Block_Index = 0; +} + +/* + * SHA224_256Reset + * + * Description: + * This helper function will initialize the SHA256Context in + * preparation for computing a new SHA256 message digest. + * + * Parameters: + * context: [in/out] + * The context to reset. + + + +Eastlake 3rd & Hansen Informational [Page 43] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * H0 + * The initial hash value to use. + * + * Returns: + * sha Error Code. + */ +static int SHA224_256Reset(SHA256Context *context, uint32_t *H0) +{ + if (!context) + return shaNull; + + context->Length_Low = 0; + context->Length_High = 0; + context->Message_Block_Index = 0; + + context->Intermediate_Hash[0] = H0[0]; + context->Intermediate_Hash[1] = H0[1]; + context->Intermediate_Hash[2] = H0[2]; + context->Intermediate_Hash[3] = H0[3]; + context->Intermediate_Hash[4] = H0[4]; + context->Intermediate_Hash[5] = H0[5]; + context->Intermediate_Hash[6] = H0[6]; + context->Intermediate_Hash[7] = H0[7]; + + context->Computed = 0; + context->Corrupted = 0; + + return shaSuccess; +} + +/* + * SHA224_256ResultN + * + * Description: + * This helper function will return the 224-bit or 256-bit message + * digest into the Message_Digest array provided by the caller. + * NOTE: The first octet of hash is stored in the 0th element, + * the last octet of hash in the 28th/32nd element. + * + * Parameters: + * context: [in/out] + * The context to use to calculate the SHA hash. + * Message_Digest: [out] + * Where the digest is returned. + * HashSize: [in] + * The size of the hash, either 28 or 32. + * + * Returns: + + + +Eastlake 3rd & Hansen Informational [Page 44] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * sha Error Code. + */ +static int SHA224_256ResultN(SHA256Context *context, + uint8_t Message_Digest[], int HashSize) +{ + int i; + + if (!context || !Message_Digest) + return shaNull; + + if (context->Corrupted) + return context->Corrupted; + + if (!context->Computed) + SHA224_256Finalize(context, 0x80); + + for (i = 0; i < HashSize; ++i) + Message_Digest[i] = (uint8_t) + (context->Intermediate_Hash[i>>2] >> 8 * ( 3 - ( i & 0x03 ) )); + + return shaSuccess; +} + +8.2.3. sha384-512.c + +/*************************** sha384-512.c ***************************/ +/********************* See RFC 4634 for details *********************/ +/* + * Description: + * This file implements the Secure Hash Signature Standard + * algorithms as defined in the National Institute of Standards + * and Technology Federal Information Processing Standards + * Publication (FIPS PUB) 180-1 published on April 17, 1995, 180-2 + * published on August 1, 2002, and the FIPS PUB 180-2 Change + * Notice published on February 28, 2004. + * + * A combined document showing all algorithms is available at + * http://csrc.nist.gov/publications/fips/ + * fips180-2/fips180-2withchangenotice.pdf + * + * The SHA-384 and SHA-512 algorithms produce 384-bit and 512-bit + * message digests for a given data stream. It should take about + * 2**n steps to find a message with the same digest as a given + * message and 2**(n/2) to find any two messages with the same + * digest, when n is the digest size in bits. Therefore, this + * algorithm can serve as a means of providing a + * "fingerprint" for a message. + * + + + +Eastlake 3rd & Hansen Informational [Page 45] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * Portability Issues: + * SHA-384 and SHA-512 are defined in terms of 64-bit "words", + * but if USE_32BIT_ONLY is #defined, this code is implemented in + * terms of 32-bit "words". This code uses <stdint.h> (included + * via "sha.h") to define the 64, 32 and 8 bit unsigned integer + * types. If your C compiler does not support 64 bit unsigned + * integers, and you do not #define USE_32BIT_ONLY, this code is + * not appropriate. + * + * Caveats: + * SHA-384 and SHA-512 are designed to work with messages less + * than 2^128 bits long. This implementation uses + * SHA384/512Input() to hash the bits that are a multiple of the + * size of an 8-bit character, and then uses SHA384/256FinalBits() + * to hash the final few bits of the input. + * + */ + +#include "sha.h" +#include "sha-private.h" + +#ifdef USE_32BIT_ONLY +/* + * Define 64-bit arithmetic in terms of 32-bit arithmetic. + * Each 64-bit number is represented in a 2-word array. + * All macros are defined such that the result is the last parameter. + */ + +/* + * Define shift, rotate left and rotate right functions + */ +#define SHA512_SHR(bits, word, ret) ( \ + /* (((uint64_t)((word))) >> (bits)) */ \ + (ret)[0] = (((bits) < 32) && ((bits) >= 0)) ? \ + ((word)[0] >> (bits)) : 0, \ + (ret)[1] = ((bits) > 32) ? ((word)[0] >> ((bits) - 32)) : \ + ((bits) == 32) ? (word)[0] : \ + ((bits) >= 0) ? \ + (((word)[0] << (32 - (bits))) | \ + ((word)[1] >> (bits))) : 0 ) + +#define SHA512_SHL(bits, word, ret) ( \ + /* (((uint64_t)(word)) << (bits)) */ \ + (ret)[0] = ((bits) > 32) ? ((word)[1] << ((bits) - 32)) : \ + ((bits) == 32) ? (word)[1] : \ + ((bits) >= 0) ? \ + (((word)[0] << (bits)) | \ + ((word)[1] >> (32 - (bits)))) : \ + + + +Eastlake 3rd & Hansen Informational [Page 46] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + 0, \ + (ret)[1] = (((bits) < 32) && ((bits) >= 0)) ? \ + ((word)[1] << (bits)) : 0 ) + +/* + * Define 64-bit OR + */ +#define SHA512_OR(word1, word2, ret) ( \ + (ret)[0] = (word1)[0] | (word2)[0], \ + (ret)[1] = (word1)[1] | (word2)[1] ) + +/* + * Define 64-bit XOR + */ +#define SHA512_XOR(word1, word2, ret) ( \ + (ret)[0] = (word1)[0] ^ (word2)[0], \ + (ret)[1] = (word1)[1] ^ (word2)[1] ) + +/* + * Define 64-bit AND + */ +#define SHA512_AND(word1, word2, ret) ( \ + (ret)[0] = (word1)[0] & (word2)[0], \ + (ret)[1] = (word1)[1] & (word2)[1] ) + +/* + * Define 64-bit TILDA + */ +#define SHA512_TILDA(word, ret) \ + ( (ret)[0] = ~(word)[0], (ret)[1] = ~(word)[1] ) + +/* + * Define 64-bit ADD + */ +#define SHA512_ADD(word1, word2, ret) ( \ + (ret)[1] = (word1)[1], (ret)[1] += (word2)[1], \ + (ret)[0] = (word1)[0] + (word2)[0] + ((ret)[1] < (word1)[1]) ) + +/* + * Add the 4word value in word2 to word1. + */ +static uint32_t ADDTO4_temp, ADDTO4_temp2; +#define SHA512_ADDTO4(word1, word2) ( \ + ADDTO4_temp = (word1)[3], \ + (word1)[3] += (word2)[3], \ + ADDTO4_temp2 = (word1)[2], \ + (word1)[2] += (word2)[2] + ((word1)[3] < ADDTO4_temp), \ + ADDTO4_temp = (word1)[1], \ + + + +Eastlake 3rd & Hansen Informational [Page 47] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + (word1)[1] += (word2)[1] + ((word1)[2] < ADDTO4_temp2), \ + (word1)[0] += (word2)[0] + ((word1)[1] < ADDTO4_temp) ) + +/* + * Add the 2word value in word2 to word1. + */ +static uint32_t ADDTO2_temp; +#define SHA512_ADDTO2(word1, word2) ( \ + ADDTO2_temp = (word1)[1], \ + (word1)[1] += (word2)[1], \ + (word1)[0] += (word2)[0] + ((word1)[1] < ADDTO2_temp) ) + +/* + * SHA rotate ((word >> bits) | (word << (64-bits))) + */ +static uint32_t ROTR_temp1[2], ROTR_temp2[2]; +#define SHA512_ROTR(bits, word, ret) ( \ + SHA512_SHR((bits), (word), ROTR_temp1), \ + SHA512_SHL(64-(bits), (word), ROTR_temp2), \ + SHA512_OR(ROTR_temp1, ROTR_temp2, (ret)) ) + +/* + * Define the SHA SIGMA and sigma macros + * SHA512_ROTR(28,word) ^ SHA512_ROTR(34,word) ^ SHA512_ROTR(39,word) + */ +static uint32_t SIGMA0_temp1[2], SIGMA0_temp2[2], + SIGMA0_temp3[2], SIGMA0_temp4[2]; +#define SHA512_SIGMA0(word, ret) ( \ + SHA512_ROTR(28, (word), SIGMA0_temp1), \ + SHA512_ROTR(34, (word), SIGMA0_temp2), \ + SHA512_ROTR(39, (word), SIGMA0_temp3), \ + SHA512_XOR(SIGMA0_temp2, SIGMA0_temp3, SIGMA0_temp4), \ + SHA512_XOR(SIGMA0_temp1, SIGMA0_temp4, (ret)) ) + +/* + * SHA512_ROTR(14,word) ^ SHA512_ROTR(18,word) ^ SHA512_ROTR(41,word) + */ +static uint32_t SIGMA1_temp1[2], SIGMA1_temp2[2], + SIGMA1_temp3[2], SIGMA1_temp4[2]; +#define SHA512_SIGMA1(word, ret) ( \ + SHA512_ROTR(14, (word), SIGMA1_temp1), \ + SHA512_ROTR(18, (word), SIGMA1_temp2), \ + SHA512_ROTR(41, (word), SIGMA1_temp3), \ + SHA512_XOR(SIGMA1_temp2, SIGMA1_temp3, SIGMA1_temp4), \ + SHA512_XOR(SIGMA1_temp1, SIGMA1_temp4, (ret)) ) + +/* + * (SHA512_ROTR( 1,word) ^ SHA512_ROTR( 8,word) ^ SHA512_SHR( 7,word)) + + + +Eastlake 3rd & Hansen Informational [Page 48] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + */ +static uint32_t sigma0_temp1[2], sigma0_temp2[2], + sigma0_temp3[2], sigma0_temp4[2]; +#define SHA512_sigma0(word, ret) ( \ + SHA512_ROTR( 1, (word), sigma0_temp1), \ + SHA512_ROTR( 8, (word), sigma0_temp2), \ + SHA512_SHR( 7, (word), sigma0_temp3), \ + SHA512_XOR(sigma0_temp2, sigma0_temp3, sigma0_temp4), \ + SHA512_XOR(sigma0_temp1, sigma0_temp4, (ret)) ) + +/* + * (SHA512_ROTR(19,word) ^ SHA512_ROTR(61,word) ^ SHA512_SHR( 6,word)) + */ +static uint32_t sigma1_temp1[2], sigma1_temp2[2], + sigma1_temp3[2], sigma1_temp4[2]; +#define SHA512_sigma1(word, ret) ( \ + SHA512_ROTR(19, (word), sigma1_temp1), \ + SHA512_ROTR(61, (word), sigma1_temp2), \ + SHA512_SHR( 6, (word), sigma1_temp3), \ + SHA512_XOR(sigma1_temp2, sigma1_temp3, sigma1_temp4), \ + SHA512_XOR(sigma1_temp1, sigma1_temp4, (ret)) ) + +#undef SHA_Ch +#undef SHA_Maj + +#ifndef USE_MODIFIED_MACROS +/* + * These definitions are the ones used in FIPS-180-2, section 4.1.3 + * Ch(x,y,z) ((x & y) ^ (~x & z)) + */ +static uint32_t Ch_temp1[2], Ch_temp2[2], Ch_temp3[2]; +#define SHA_Ch(x, y, z, ret) ( \ + SHA512_AND(x, y, Ch_temp1), \ + SHA512_TILDA(x, Ch_temp2), \ + SHA512_AND(Ch_temp2, z, Ch_temp3), \ + SHA512_XOR(Ch_temp1, Ch_temp3, (ret)) ) +/* + * Maj(x,y,z) (((x)&(y)) ^ ((x)&(z)) ^ ((y)&(z))) + */ +static uint32_t Maj_temp1[2], Maj_temp2[2], + Maj_temp3[2], Maj_temp4[2]; +#define SHA_Maj(x, y, z, ret) ( \ + SHA512_AND(x, y, Maj_temp1), \ + SHA512_AND(x, z, Maj_temp2), \ + SHA512_AND(y, z, Maj_temp3), \ + SHA512_XOR(Maj_temp2, Maj_temp3, Maj_temp4), \ + SHA512_XOR(Maj_temp1, Maj_temp4, (ret)) ) + + + + +Eastlake 3rd & Hansen Informational [Page 49] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +#else /* !USE_32BIT_ONLY */ +/* + * These definitions are potentially faster equivalents for the ones + * used in FIPS-180-2, section 4.1.3. + * ((x & y) ^ (~x & z)) becomes + * ((x & (y ^ z)) ^ z) + */ +#define SHA_Ch(x, y, z, ret) ( \ + (ret)[0] = (((x)[0] & ((y)[0] ^ (z)[0])) ^ (z)[0]), \ + (ret)[1] = (((x)[1] & ((y)[1] ^ (z)[1])) ^ (z)[1]) ) + +/* + * ((x & y) ^ (x & z) ^ (y & z)) becomes + * ((x & (y | z)) | (y & z)) + */ +#define SHA_Maj(x, y, z, ret) ( \ + ret[0] = (((x)[0] & ((y)[0] | (z)[0])) | ((y)[0] & (z)[0])), \ + ret[1] = (((x)[1] & ((y)[1] | (z)[1])) | ((y)[1] & (z)[1])) ) +#endif /* USE_MODIFIED_MACROS */ + +/* + * add "length" to the length + */ +static uint32_t addTemp[4] = { 0, 0, 0, 0 }; +#define SHA384_512AddLength(context, length) ( \ + addTemp[3] = (length), SHA512_ADDTO4((context)->Length, addTemp), \ + (context)->Corrupted = (((context)->Length[3] == 0) && \ + ((context)->Length[2] == 0) && ((context)->Length[1] == 0) && \ + ((context)->Length[0] < 8)) ? 1 : 0 ) + +/* Local Function Prototypes */ +static void SHA384_512Finalize(SHA512Context *context, + uint8_t Pad_Byte); +static void SHA384_512PadMessage(SHA512Context *context, + uint8_t Pad_Byte); +static void SHA384_512ProcessMessageBlock(SHA512Context *context); +static int SHA384_512Reset(SHA512Context *context, uint32_t H0[]); +static int SHA384_512ResultN( SHA512Context *context, + uint8_t Message_Digest[], int HashSize); + +/* Initial Hash Values: FIPS-180-2 sections 5.3.3 and 5.3.4 */ +static uint32_t SHA384_H0[SHA512HashSize/4] = { + 0xCBBB9D5D, 0xC1059ED8, 0x629A292A, 0x367CD507, 0x9159015A, + 0x3070DD17, 0x152FECD8, 0xF70E5939, 0x67332667, 0xFFC00B31, + 0x8EB44A87, 0x68581511, 0xDB0C2E0D, 0x64F98FA7, 0x47B5481D, + 0xBEFA4FA4 +}; + + + + +Eastlake 3rd & Hansen Informational [Page 50] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +static uint32_t SHA512_H0[SHA512HashSize/4] = { + 0x6A09E667, 0xF3BCC908, 0xBB67AE85, 0x84CAA73B, 0x3C6EF372, + 0xFE94F82B, 0xA54FF53A, 0x5F1D36F1, 0x510E527F, 0xADE682D1, + 0x9B05688C, 0x2B3E6C1F, 0x1F83D9AB, 0xFB41BD6B, 0x5BE0CD19, + 0x137E2179 +}; + +#else /* !USE_32BIT_ONLY */ + +/* Define the SHA shift, rotate left and rotate right macro */ +#define SHA512_SHR(bits,word) (((uint64_t)(word)) >> (bits)) +#define SHA512_ROTR(bits,word) ((((uint64_t)(word)) >> (bits)) | \ + (((uint64_t)(word)) << (64-(bits)))) + +/* Define the SHA SIGMA and sigma macros */ +#define SHA512_SIGMA0(word) \ + (SHA512_ROTR(28,word) ^ SHA512_ROTR(34,word) ^ SHA512_ROTR(39,word)) +#define SHA512_SIGMA1(word) \ + (SHA512_ROTR(14,word) ^ SHA512_ROTR(18,word) ^ SHA512_ROTR(41,word)) +#define SHA512_sigma0(word) \ + (SHA512_ROTR( 1,word) ^ SHA512_ROTR( 8,word) ^ SHA512_SHR( 7,word)) +#define SHA512_sigma1(word) \ + (SHA512_ROTR(19,word) ^ SHA512_ROTR(61,word) ^ SHA512_SHR( 6,word)) + +/* + * add "length" to the length + */ +static uint64_t addTemp; +#define SHA384_512AddLength(context, length) \ + (addTemp = context->Length_Low, context->Corrupted = \ + ((context->Length_Low += length) < addTemp) && \ + (++context->Length_High == 0) ? 1 : 0) + +/* Local Function Prototypes */ +static void SHA384_512Finalize(SHA512Context *context, + uint8_t Pad_Byte); +static void SHA384_512PadMessage(SHA512Context *context, + uint8_t Pad_Byte); +static void SHA384_512ProcessMessageBlock(SHA512Context *context); +static int SHA384_512Reset(SHA512Context *context, uint64_t H0[]); +static int SHA384_512ResultN(SHA512Context *context, + uint8_t Message_Digest[], int HashSize); + +/* Initial Hash Values: FIPS-180-2 sections 5.3.3 and 5.3.4 */ +static uint64_t SHA384_H0[] = { + 0xCBBB9D5DC1059ED8ll, 0x629A292A367CD507ll, 0x9159015A3070DD17ll, + 0x152FECD8F70E5939ll, 0x67332667FFC00B31ll, 0x8EB44A8768581511ll, + 0xDB0C2E0D64F98FA7ll, 0x47B5481DBEFA4FA4ll + + + +Eastlake 3rd & Hansen Informational [Page 51] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +}; +static uint64_t SHA512_H0[] = { + 0x6A09E667F3BCC908ll, 0xBB67AE8584CAA73Bll, 0x3C6EF372FE94F82Bll, + 0xA54FF53A5F1D36F1ll, 0x510E527FADE682D1ll, 0x9B05688C2B3E6C1Fll, + 0x1F83D9ABFB41BD6Bll, 0x5BE0CD19137E2179ll +}; + +#endif /* USE_32BIT_ONLY */ + +/* + * SHA384Reset + * + * Description: + * This function will initialize the SHA384Context in preparation + * for computing a new SHA384 message digest. + * + * Parameters: + * context: [in/out] + * The context to reset. + * + * Returns: + * sha Error Code. + * + */ +int SHA384Reset(SHA384Context *context) +{ + return SHA384_512Reset(context, SHA384_H0); +} + +/* + * SHA384Input + * + * Description: + * This function accepts an array of octets as the next portion + * of the message. + * + * Parameters: + * context: [in/out] + * The SHA context to update + * message_array: [in] + * An array of characters representing the next portion of + * the message. + * length: [in] + * The length of the message in message_array + * + * Returns: + * sha Error Code. + * + + + +Eastlake 3rd & Hansen Informational [Page 52] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + */ +int SHA384Input(SHA384Context *context, + const uint8_t *message_array, unsigned int length) +{ + return SHA512Input(context, message_array, length); +} + +/* + * SHA384FinalBits + * + * Description: + * This function will add in any final bits of the message. + * + * Parameters: + * context: [in/out] + * The SHA context to update + * message_bits: [in] + * The final bits of the message, in the upper portion of the + * byte. (Use 0b###00000 instead of 0b00000### to input the + * three bits ###.) + * length: [in] + * The number of bits in message_bits, between 1 and 7. + * + * Returns: + * sha Error Code. + * + */ +int SHA384FinalBits(SHA384Context *context, + const uint8_t message_bits, unsigned int length) +{ + return SHA512FinalBits(context, message_bits, length); +} + +/* + * SHA384Result + * + * Description: + * This function will return the 384-bit message + * digest into the Message_Digest array provided by the caller. + * NOTE: The first octet of hash is stored in the 0th element, + * the last octet of hash in the 48th element. + * + * Parameters: + * context: [in/out] + * The context to use to calculate the SHA hash. + * Message_Digest: [out] + * Where the digest is returned. + * + + + +Eastlake 3rd & Hansen Informational [Page 53] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * Returns: + * sha Error Code. + * + */ +int SHA384Result(SHA384Context *context, + uint8_t Message_Digest[SHA384HashSize]) +{ + return SHA384_512ResultN(context, Message_Digest, SHA384HashSize); +} + +/* + * SHA512Reset + * + * Description: + * This function will initialize the SHA512Context in preparation + * for computing a new SHA512 message digest. + * + * Parameters: + * context: [in/out] + * The context to reset. + * + * Returns: + * sha Error Code. + * + */ +int SHA512Reset(SHA512Context *context) +{ + return SHA384_512Reset(context, SHA512_H0); +} + +/* + * SHA512Input + * + * Description: + * This function accepts an array of octets as the next portion + * of the message. + * + * Parameters: + * context: [in/out] + * The SHA context to update + * message_array: [in] + * An array of characters representing the next portion of + * the message. + * length: [in] + * The length of the message in message_array + * + * Returns: + * sha Error Code. + + + +Eastlake 3rd & Hansen Informational [Page 54] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * + */ +int SHA512Input(SHA512Context *context, + const uint8_t *message_array, + unsigned int length) +{ + if (!length) + return shaSuccess; + + if (!context || !message_array) + return shaNull; + + if (context->Computed) { + context->Corrupted = shaStateError; + return shaStateError; + } + + if (context->Corrupted) + return context->Corrupted; + + while (length-- && !context->Corrupted) { + context->Message_Block[context->Message_Block_Index++] = + (*message_array & 0xFF); + + if (!SHA384_512AddLength(context, 8) && + (context->Message_Block_Index == SHA512_Message_Block_Size)) + SHA384_512ProcessMessageBlock(context); + + message_array++; + } + + return shaSuccess; +} + +/* + * SHA512FinalBits + * + * Description: + * This function will add in any final bits of the message. + * + * Parameters: + * context: [in/out] + * The SHA context to update + * message_bits: [in] + * The final bits of the message, in the upper portion of the + * byte. (Use 0b###00000 instead of 0b00000### to input the + * three bits ###.) + * length: [in] + + + +Eastlake 3rd & Hansen Informational [Page 55] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * The number of bits in message_bits, between 1 and 7. + * + * Returns: + * sha Error Code. + * + */ +int SHA512FinalBits(SHA512Context *context, + const uint8_t message_bits, unsigned int length) +{ + uint8_t masks[8] = { + /* 0 0b00000000 */ 0x00, /* 1 0b10000000 */ 0x80, + /* 2 0b11000000 */ 0xC0, /* 3 0b11100000 */ 0xE0, + /* 4 0b11110000 */ 0xF0, /* 5 0b11111000 */ 0xF8, + /* 6 0b11111100 */ 0xFC, /* 7 0b11111110 */ 0xFE + }; + uint8_t markbit[8] = { + /* 0 0b10000000 */ 0x80, /* 1 0b01000000 */ 0x40, + /* 2 0b00100000 */ 0x20, /* 3 0b00010000 */ 0x10, + /* 4 0b00001000 */ 0x08, /* 5 0b00000100 */ 0x04, + /* 6 0b00000010 */ 0x02, /* 7 0b00000001 */ 0x01 + }; + + if (!length) + return shaSuccess; + + if (!context) + return shaNull; + + if ((context->Computed) || (length >= 8) || (length == 0)) { + context->Corrupted = shaStateError; + return shaStateError; + } + + if (context->Corrupted) + return context->Corrupted; + + SHA384_512AddLength(context, length); + SHA384_512Finalize(context, (uint8_t) + ((message_bits & masks[length]) | markbit[length])); + + return shaSuccess; +} + +/* + * SHA384_512Finalize + * + * Description: + * This helper function finishes off the digest calculations. + + + +Eastlake 3rd & Hansen Informational [Page 56] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * + * Parameters: + * context: [in/out] + * The SHA context to update + * Pad_Byte: [in] + * The last byte to add to the digest before the 0-padding + * and length. This will contain the last bits of the message + * followed by another single bit. If the message was an + * exact multiple of 8-bits long, Pad_Byte will be 0x80. + * + * Returns: + * sha Error Code. + * + */ +static void SHA384_512Finalize(SHA512Context *context, + uint8_t Pad_Byte) +{ + int_least16_t i; + SHA384_512PadMessage(context, Pad_Byte); + /* message may be sensitive, clear it out */ + for (i = 0; i < SHA512_Message_Block_Size; ++i) + context->Message_Block[i] = 0; +#ifdef USE_32BIT_ONLY /* and clear length */ + context->Length[0] = context->Length[1] = 0; + context->Length[2] = context->Length[3] = 0; +#else /* !USE_32BIT_ONLY */ + context->Length_Low = 0; + context->Length_High = 0; +#endif /* USE_32BIT_ONLY */ + context->Computed = 1; +} + +/* + * SHA512Result + * + * Description: + * This function will return the 512-bit message + * digest into the Message_Digest array provided by the caller. + * NOTE: The first octet of hash is stored in the 0th element, + * the last octet of hash in the 64th element. + * + * Parameters: + * context: [in/out] + * The context to use to calculate the SHA hash. + * Message_Digest: [out] + * Where the digest is returned. + * + * Returns: + + + +Eastlake 3rd & Hansen Informational [Page 57] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * sha Error Code. + * + */ +int SHA512Result(SHA512Context *context, + uint8_t Message_Digest[SHA512HashSize]) +{ + return SHA384_512ResultN(context, Message_Digest, SHA512HashSize); +} + +/* + * SHA384_512PadMessage + * + * Description: + * According to the standard, the message must be padded to an + * even 1024 bits. The first padding bit must be a '1'. The + * last 128 bits represent the length of the original message. + * All bits in between should be 0. This helper function will + * pad the message according to those rules by filling the + * Message_Block array accordingly. When it returns, it can be + * assumed that the message digest has been computed. + * + * Parameters: + * context: [in/out] + * The context to pad + * Pad_Byte: [in] + * The last byte to add to the digest before the 0-padding + * and length. This will contain the last bits of the message + * followed by another single bit. If the message was an + * exact multiple of 8-bits long, Pad_Byte will be 0x80. + * + * Returns: + * Nothing. + * + */ +static void SHA384_512PadMessage(SHA512Context *context, + uint8_t Pad_Byte) +{ + /* + * Check to see if the current message block is too small to hold + * the initial padding bits and length. If so, we will pad the + * block, process it, and then continue padding into a second + * block. + */ + if (context->Message_Block_Index >= (SHA512_Message_Block_Size-16)) { + context->Message_Block[context->Message_Block_Index++] = Pad_Byte; + while (context->Message_Block_Index < SHA512_Message_Block_Size) + context->Message_Block[context->Message_Block_Index++] = 0; + + + + +Eastlake 3rd & Hansen Informational [Page 58] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + SHA384_512ProcessMessageBlock(context); + } else + context->Message_Block[context->Message_Block_Index++] = Pad_Byte; + + while (context->Message_Block_Index < (SHA512_Message_Block_Size-16)) + context->Message_Block[context->Message_Block_Index++] = 0; + + /* + * Store the message length as the last 16 octets + */ +#ifdef USE_32BIT_ONLY + context->Message_Block[112] = (uint8_t)(context->Length[0] >> 24); + context->Message_Block[113] = (uint8_t)(context->Length[0] >> 16); + context->Message_Block[114] = (uint8_t)(context->Length[0] >> 8); + context->Message_Block[115] = (uint8_t)(context->Length[0]); + context->Message_Block[116] = (uint8_t)(context->Length[1] >> 24); + context->Message_Block[117] = (uint8_t)(context->Length[1] >> 16); + context->Message_Block[118] = (uint8_t)(context->Length[1] >> 8); + context->Message_Block[119] = (uint8_t)(context->Length[1]); + + context->Message_Block[120] = (uint8_t)(context->Length[2] >> 24); + context->Message_Block[121] = (uint8_t)(context->Length[2] >> 16); + context->Message_Block[122] = (uint8_t)(context->Length[2] >> 8); + context->Message_Block[123] = (uint8_t)(context->Length[2]); + context->Message_Block[124] = (uint8_t)(context->Length[3] >> 24); + context->Message_Block[125] = (uint8_t)(context->Length[3] >> 16); + context->Message_Block[126] = (uint8_t)(context->Length[3] >> 8); + context->Message_Block[127] = (uint8_t)(context->Length[3]); +#else /* !USE_32BIT_ONLY */ + context->Message_Block[112] = (uint8_t)(context->Length_High >> 56); + context->Message_Block[113] = (uint8_t)(context->Length_High >> 48); + context->Message_Block[114] = (uint8_t)(context->Length_High >> 40); + context->Message_Block[115] = (uint8_t)(context->Length_High >> 32); + context->Message_Block[116] = (uint8_t)(context->Length_High >> 24); + context->Message_Block[117] = (uint8_t)(context->Length_High >> 16); + context->Message_Block[118] = (uint8_t)(context->Length_High >> 8); + context->Message_Block[119] = (uint8_t)(context->Length_High); + + context->Message_Block[120] = (uint8_t)(context->Length_Low >> 56); + context->Message_Block[121] = (uint8_t)(context->Length_Low >> 48); + context->Message_Block[122] = (uint8_t)(context->Length_Low >> 40); + context->Message_Block[123] = (uint8_t)(context->Length_Low >> 32); + context->Message_Block[124] = (uint8_t)(context->Length_Low >> 24); + context->Message_Block[125] = (uint8_t)(context->Length_Low >> 16); + context->Message_Block[126] = (uint8_t)(context->Length_Low >> 8); + context->Message_Block[127] = (uint8_t)(context->Length_Low); +#endif /* USE_32BIT_ONLY */ + + + + +Eastlake 3rd & Hansen Informational [Page 59] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + SHA384_512ProcessMessageBlock(context); +} + +/* + * SHA384_512ProcessMessageBlock + * + * Description: + * This helper function will process the next 1024 bits of the + * message stored in the Message_Block array. + * + * Parameters: + * context: [in/out] + * The SHA context to update + * + * Returns: + * Nothing. + * + * Comments: + * Many of the variable names in this code, especially the + * single character names, were used because those were the + * names used in the publication. + * + * + */ +static void SHA384_512ProcessMessageBlock(SHA512Context *context) +{ + /* Constants defined in FIPS-180-2, section 4.2.3 */ +#ifdef USE_32BIT_ONLY + static const uint32_t K[80*2] = { + 0x428A2F98, 0xD728AE22, 0x71374491, 0x23EF65CD, 0xB5C0FBCF, + 0xEC4D3B2F, 0xE9B5DBA5, 0x8189DBBC, 0x3956C25B, 0xF348B538, + 0x59F111F1, 0xB605D019, 0x923F82A4, 0xAF194F9B, 0xAB1C5ED5, + 0xDA6D8118, 0xD807AA98, 0xA3030242, 0x12835B01, 0x45706FBE, + 0x243185BE, 0x4EE4B28C, 0x550C7DC3, 0xD5FFB4E2, 0x72BE5D74, + 0xF27B896F, 0x80DEB1FE, 0x3B1696B1, 0x9BDC06A7, 0x25C71235, + 0xC19BF174, 0xCF692694, 0xE49B69C1, 0x9EF14AD2, 0xEFBE4786, + 0x384F25E3, 0x0FC19DC6, 0x8B8CD5B5, 0x240CA1CC, 0x77AC9C65, + 0x2DE92C6F, 0x592B0275, 0x4A7484AA, 0x6EA6E483, 0x5CB0A9DC, + 0xBD41FBD4, 0x76F988DA, 0x831153B5, 0x983E5152, 0xEE66DFAB, + 0xA831C66D, 0x2DB43210, 0xB00327C8, 0x98FB213F, 0xBF597FC7, + 0xBEEF0EE4, 0xC6E00BF3, 0x3DA88FC2, 0xD5A79147, 0x930AA725, + 0x06CA6351, 0xE003826F, 0x14292967, 0x0A0E6E70, 0x27B70A85, + 0x46D22FFC, 0x2E1B2138, 0x5C26C926, 0x4D2C6DFC, 0x5AC42AED, + 0x53380D13, 0x9D95B3DF, 0x650A7354, 0x8BAF63DE, 0x766A0ABB, + 0x3C77B2A8, 0x81C2C92E, 0x47EDAEE6, 0x92722C85, 0x1482353B, + 0xA2BFE8A1, 0x4CF10364, 0xA81A664B, 0xBC423001, 0xC24B8B70, + 0xD0F89791, 0xC76C51A3, 0x0654BE30, 0xD192E819, 0xD6EF5218, + 0xD6990624, 0x5565A910, 0xF40E3585, 0x5771202A, 0x106AA070, + + + +Eastlake 3rd & Hansen Informational [Page 60] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + 0x32BBD1B8, 0x19A4C116, 0xB8D2D0C8, 0x1E376C08, 0x5141AB53, + 0x2748774C, 0xDF8EEB99, 0x34B0BCB5, 0xE19B48A8, 0x391C0CB3, + 0xC5C95A63, 0x4ED8AA4A, 0xE3418ACB, 0x5B9CCA4F, 0x7763E373, + 0x682E6FF3, 0xD6B2B8A3, 0x748F82EE, 0x5DEFB2FC, 0x78A5636F, + 0x43172F60, 0x84C87814, 0xA1F0AB72, 0x8CC70208, 0x1A6439EC, + 0x90BEFFFA, 0x23631E28, 0xA4506CEB, 0xDE82BDE9, 0xBEF9A3F7, + 0xB2C67915, 0xC67178F2, 0xE372532B, 0xCA273ECE, 0xEA26619C, + 0xD186B8C7, 0x21C0C207, 0xEADA7DD6, 0xCDE0EB1E, 0xF57D4F7F, + 0xEE6ED178, 0x06F067AA, 0x72176FBA, 0x0A637DC5, 0xA2C898A6, + 0x113F9804, 0xBEF90DAE, 0x1B710B35, 0x131C471B, 0x28DB77F5, + 0x23047D84, 0x32CAAB7B, 0x40C72493, 0x3C9EBE0A, 0x15C9BEBC, + 0x431D67C4, 0x9C100D4C, 0x4CC5D4BE, 0xCB3E42B6, 0x597F299C, + 0xFC657E2A, 0x5FCB6FAB, 0x3AD6FAEC, 0x6C44198C, 0x4A475817 + }; + int t, t2, t8; /* Loop counter */ + uint32_t temp1[2], temp2[2], /* Temporary word values */ + temp3[2], temp4[2], temp5[2]; + uint32_t W[2*80]; /* Word sequence */ + uint32_t A[2], B[2], C[2], D[2], /* Word buffers */ + E[2], F[2], G[2], H[2]; + + /* Initialize the first 16 words in the array W */ + for (t = t2 = t8 = 0; t < 16; t++, t8 += 8) { + W[t2++] = ((((uint32_t)context->Message_Block[t8 ])) << 24) | + ((((uint32_t)context->Message_Block[t8 + 1])) << 16) | + ((((uint32_t)context->Message_Block[t8 + 2])) << 8) | + ((((uint32_t)context->Message_Block[t8 + 3]))); + W[t2++] = ((((uint32_t)context->Message_Block[t8 + 4])) << 24) | + ((((uint32_t)context->Message_Block[t8 + 5])) << 16) | + ((((uint32_t)context->Message_Block[t8 + 6])) << 8) | + ((((uint32_t)context->Message_Block[t8 + 7]))); + } + + for (t = 16; t < 80; t++, t2 += 2) { + /* W[t] = SHA512_sigma1(W[t-2]) + W[t-7] + + SHA512_sigma0(W[t-15]) + W[t-16]; */ + uint32_t *Wt2 = &W[t2-2*2]; + uint32_t *Wt7 = &W[t2-7*2]; + uint32_t *Wt15 = &W[t2-15*2]; + uint32_t *Wt16 = &W[t2-16*2]; + SHA512_sigma1(Wt2, temp1); + SHA512_ADD(temp1, Wt7, temp2); + SHA512_sigma0(Wt15, temp1); + SHA512_ADD(temp1, Wt16, temp3); + SHA512_ADD(temp2, temp3, &W[t2]); + } + + A[0] = context->Intermediate_Hash[0]; + + + +Eastlake 3rd & Hansen Informational [Page 61] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + A[1] = context->Intermediate_Hash[1]; + B[0] = context->Intermediate_Hash[2]; + B[1] = context->Intermediate_Hash[3]; + C[0] = context->Intermediate_Hash[4]; + C[1] = context->Intermediate_Hash[5]; + D[0] = context->Intermediate_Hash[6]; + D[1] = context->Intermediate_Hash[7]; + E[0] = context->Intermediate_Hash[8]; + E[1] = context->Intermediate_Hash[9]; + F[0] = context->Intermediate_Hash[10]; + F[1] = context->Intermediate_Hash[11]; + G[0] = context->Intermediate_Hash[12]; + G[1] = context->Intermediate_Hash[13]; + H[0] = context->Intermediate_Hash[14]; + H[1] = context->Intermediate_Hash[15]; + + for (t = t2 = 0; t < 80; t++, t2 += 2) { + /* + * temp1 = H + SHA512_SIGMA1(E) + SHA_Ch(E,F,G) + K[t] + W[t]; + */ + SHA512_SIGMA1(E,temp1); + SHA512_ADD(H, temp1, temp2); + SHA_Ch(E,F,G,temp3); + SHA512_ADD(temp2, temp3, temp4); + SHA512_ADD(&K[t2], &W[t2], temp5); + SHA512_ADD(temp4, temp5, temp1); + /* + * temp2 = SHA512_SIGMA0(A) + SHA_Maj(A,B,C); + */ + SHA512_SIGMA0(A,temp3); + SHA_Maj(A,B,C,temp4); + SHA512_ADD(temp3, temp4, temp2); + H[0] = G[0]; H[1] = G[1]; + G[0] = F[0]; G[1] = F[1]; + F[0] = E[0]; F[1] = E[1]; + SHA512_ADD(D, temp1, E); + D[0] = C[0]; D[1] = C[1]; + C[0] = B[0]; C[1] = B[1]; + B[0] = A[0]; B[1] = A[1]; + SHA512_ADD(temp1, temp2, A); + } + + SHA512_ADDTO2(&context->Intermediate_Hash[0], A); + SHA512_ADDTO2(&context->Intermediate_Hash[2], B); + SHA512_ADDTO2(&context->Intermediate_Hash[4], C); + SHA512_ADDTO2(&context->Intermediate_Hash[6], D); + SHA512_ADDTO2(&context->Intermediate_Hash[8], E); + SHA512_ADDTO2(&context->Intermediate_Hash[10], F); + + + +Eastlake 3rd & Hansen Informational [Page 62] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + SHA512_ADDTO2(&context->Intermediate_Hash[12], G); + SHA512_ADDTO2(&context->Intermediate_Hash[14], H); + +#else /* !USE_32BIT_ONLY */ + static const uint64_t K[80] = { + 0x428A2F98D728AE22ll, 0x7137449123EF65CDll, 0xB5C0FBCFEC4D3B2Fll, + 0xE9B5DBA58189DBBCll, 0x3956C25BF348B538ll, 0x59F111F1B605D019ll, + 0x923F82A4AF194F9Bll, 0xAB1C5ED5DA6D8118ll, 0xD807AA98A3030242ll, + 0x12835B0145706FBEll, 0x243185BE4EE4B28Cll, 0x550C7DC3D5FFB4E2ll, + 0x72BE5D74F27B896Fll, 0x80DEB1FE3B1696B1ll, 0x9BDC06A725C71235ll, + 0xC19BF174CF692694ll, 0xE49B69C19EF14AD2ll, 0xEFBE4786384F25E3ll, + 0x0FC19DC68B8CD5B5ll, 0x240CA1CC77AC9C65ll, 0x2DE92C6F592B0275ll, + 0x4A7484AA6EA6E483ll, 0x5CB0A9DCBD41FBD4ll, 0x76F988DA831153B5ll, + 0x983E5152EE66DFABll, 0xA831C66D2DB43210ll, 0xB00327C898FB213Fll, + 0xBF597FC7BEEF0EE4ll, 0xC6E00BF33DA88FC2ll, 0xD5A79147930AA725ll, + 0x06CA6351E003826Fll, 0x142929670A0E6E70ll, 0x27B70A8546D22FFCll, + 0x2E1B21385C26C926ll, 0x4D2C6DFC5AC42AEDll, 0x53380D139D95B3DFll, + 0x650A73548BAF63DEll, 0x766A0ABB3C77B2A8ll, 0x81C2C92E47EDAEE6ll, + 0x92722C851482353Bll, 0xA2BFE8A14CF10364ll, 0xA81A664BBC423001ll, + 0xC24B8B70D0F89791ll, 0xC76C51A30654BE30ll, 0xD192E819D6EF5218ll, + 0xD69906245565A910ll, 0xF40E35855771202All, 0x106AA07032BBD1B8ll, + 0x19A4C116B8D2D0C8ll, 0x1E376C085141AB53ll, 0x2748774CDF8EEB99ll, + 0x34B0BCB5E19B48A8ll, 0x391C0CB3C5C95A63ll, 0x4ED8AA4AE3418ACBll, + 0x5B9CCA4F7763E373ll, 0x682E6FF3D6B2B8A3ll, 0x748F82EE5DEFB2FCll, + 0x78A5636F43172F60ll, 0x84C87814A1F0AB72ll, 0x8CC702081A6439ECll, + 0x90BEFFFA23631E28ll, 0xA4506CEBDE82BDE9ll, 0xBEF9A3F7B2C67915ll, + 0xC67178F2E372532Bll, 0xCA273ECEEA26619Cll, 0xD186B8C721C0C207ll, + 0xEADA7DD6CDE0EB1Ell, 0xF57D4F7FEE6ED178ll, 0x06F067AA72176FBAll, + 0x0A637DC5A2C898A6ll, 0x113F9804BEF90DAEll, 0x1B710B35131C471Bll, + 0x28DB77F523047D84ll, 0x32CAAB7B40C72493ll, 0x3C9EBE0A15C9BEBCll, + 0x431D67C49C100D4Cll, 0x4CC5D4BECB3E42B6ll, 0x597F299CFC657E2All, + 0x5FCB6FAB3AD6FAECll, 0x6C44198C4A475817ll + }; + int t, t8; /* Loop counter */ + uint64_t temp1, temp2; /* Temporary word value */ + uint64_t W[80]; /* Word sequence */ + uint64_t A, B, C, D, E, F, G, H; /* Word buffers */ + + /* + * Initialize the first 16 words in the array W + */ + for (t = t8 = 0; t < 16; t++, t8 += 8) + W[t] = ((uint64_t)(context->Message_Block[t8 ]) << 56) | + ((uint64_t)(context->Message_Block[t8 + 1]) << 48) | + ((uint64_t)(context->Message_Block[t8 + 2]) << 40) | + ((uint64_t)(context->Message_Block[t8 + 3]) << 32) | + ((uint64_t)(context->Message_Block[t8 + 4]) << 24) | + ((uint64_t)(context->Message_Block[t8 + 5]) << 16) | + + + +Eastlake 3rd & Hansen Informational [Page 63] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + ((uint64_t)(context->Message_Block[t8 + 6]) << 8) | + ((uint64_t)(context->Message_Block[t8 + 7])); + + for (t = 16; t < 80; t++) + W[t] = SHA512_sigma1(W[t-2]) + W[t-7] + + SHA512_sigma0(W[t-15]) + W[t-16]; + + A = context->Intermediate_Hash[0]; + B = context->Intermediate_Hash[1]; + C = context->Intermediate_Hash[2]; + D = context->Intermediate_Hash[3]; + E = context->Intermediate_Hash[4]; + F = context->Intermediate_Hash[5]; + G = context->Intermediate_Hash[6]; + H = context->Intermediate_Hash[7]; + + for (t = 0; t < 80; t++) { + temp1 = H + SHA512_SIGMA1(E) + SHA_Ch(E,F,G) + K[t] + W[t]; + temp2 = SHA512_SIGMA0(A) + SHA_Maj(A,B,C); + H = G; + G = F; + F = E; + E = D + temp1; + D = C; + C = B; + B = A; + A = temp1 + temp2; + } + + context->Intermediate_Hash[0] += A; + context->Intermediate_Hash[1] += B; + context->Intermediate_Hash[2] += C; + context->Intermediate_Hash[3] += D; + context->Intermediate_Hash[4] += E; + context->Intermediate_Hash[5] += F; + context->Intermediate_Hash[6] += G; + context->Intermediate_Hash[7] += H; +#endif /* USE_32BIT_ONLY */ + + context->Message_Block_Index = 0; +} + +/* + * SHA384_512Reset + * + * Description: + * This helper function will initialize the SHA512Context in + * preparation for computing a new SHA384 or SHA512 message + + + +Eastlake 3rd & Hansen Informational [Page 64] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * digest. + * + * Parameters: + * context: [in/out] + * The context to reset. + * H0 + * The initial hash value to use. + * + * Returns: + * sha Error Code. + * + */ +#ifdef USE_32BIT_ONLY +static int SHA384_512Reset(SHA512Context *context, uint32_t H0[]) +#else /* !USE_32BIT_ONLY */ +static int SHA384_512Reset(SHA512Context *context, uint64_t H0[]) +#endif /* USE_32BIT_ONLY */ +{ + int i; + if (!context) + return shaNull; + + context->Message_Block_Index = 0; + +#ifdef USE_32BIT_ONLY + context->Length[0] = context->Length[1] = 0; + context->Length[2] = context->Length[3] = 0; + + for (i = 0; i < SHA512HashSize/4; i++) + context->Intermediate_Hash[i] = H0[i]; +#else /* !USE_32BIT_ONLY */ + context->Length_High = context->Length_Low = 0; + + for (i = 0; i < SHA512HashSize/8; i++) + context->Intermediate_Hash[i] = H0[i]; +#endif /* USE_32BIT_ONLY */ + + context->Computed = 0; + context->Corrupted = 0; + + return shaSuccess; +} + +/* + * SHA384_512ResultN + * + * Description: + * This helper function will return the 384-bit or 512-bit message + + + +Eastlake 3rd & Hansen Informational [Page 65] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * digest into the Message_Digest array provided by the caller. + * NOTE: The first octet of hash is stored in the 0th element, + * the last octet of hash in the 48th/64th element. + * + * Parameters: + * context: [in/out] + * The context to use to calculate the SHA hash. + * Message_Digest: [out] + * Where the digest is returned. + * HashSize: [in] + * The size of the hash, either 48 or 64. + * + * Returns: + * sha Error Code. + * + */ +static int SHA384_512ResultN(SHA512Context *context, + uint8_t Message_Digest[], int HashSize) +{ + int i; + +#ifdef USE_32BIT_ONLY + int i2; +#endif /* USE_32BIT_ONLY */ + + if (!context || !Message_Digest) + return shaNull; + + if (context->Corrupted) + return context->Corrupted; + + if (!context->Computed) + SHA384_512Finalize(context, 0x80); + +#ifdef USE_32BIT_ONLY + for (i = i2 = 0; i < HashSize; ) { + Message_Digest[i++]=(uint8_t)(context->Intermediate_Hash[i2]>>24); + Message_Digest[i++]=(uint8_t)(context->Intermediate_Hash[i2]>>16); + Message_Digest[i++]=(uint8_t)(context->Intermediate_Hash[i2]>>8); + Message_Digest[i++]=(uint8_t)(context->Intermediate_Hash[i2++]); + Message_Digest[i++]=(uint8_t)(context->Intermediate_Hash[i2]>>24); + Message_Digest[i++]=(uint8_t)(context->Intermediate_Hash[i2]>>16); + Message_Digest[i++]=(uint8_t)(context->Intermediate_Hash[i2]>>8); + Message_Digest[i++]=(uint8_t)(context->Intermediate_Hash[i2++]); + } +#else /* !USE_32BIT_ONLY */ + for (i = 0; i < HashSize; ++i) + Message_Digest[i] = (uint8_t) + + + +Eastlake 3rd & Hansen Informational [Page 66] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + (context->Intermediate_Hash[i>>3] >> 8 * ( 7 - ( i % 8 ) )); +#endif /* USE_32BIT_ONLY */ + + return shaSuccess; +} + +8.2.4. usha.c + +/**************************** usha.c ****************************/ +/******************** See RFC 4634 for details ******************/ +/* + * Description: + * This file implements a unified interface to the SHA algorithms. + */ + +#include "sha.h" + +/* + * USHAReset + * + * Description: + * This function will initialize the SHA Context in preparation + * for computing a new SHA message digest. + * + * Parameters: + * context: [in/out] + * The context to reset. + * whichSha: [in] + * Selects which SHA reset to call + * + * Returns: + * sha Error Code. + * + */ +int USHAReset(USHAContext *ctx, enum SHAversion whichSha) +{ + if (ctx) { + ctx->whichSha = whichSha; + switch (whichSha) { + case SHA1: return SHA1Reset((SHA1Context*)&ctx->ctx); + case SHA224: return SHA224Reset((SHA224Context*)&ctx->ctx); + case SHA256: return SHA256Reset((SHA256Context*)&ctx->ctx); + case SHA384: return SHA384Reset((SHA384Context*)&ctx->ctx); + case SHA512: return SHA512Reset((SHA512Context*)&ctx->ctx); + default: return shaBadParam; + } + } else { + return shaNull; + + + +Eastlake 3rd & Hansen Informational [Page 67] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + } +} + +/* + * USHAInput + * + * Description: + * This function accepts an array of octets as the next portion + * of the message. + * + * Parameters: + * context: [in/out] + * The SHA context to update + * message_array: [in] + * An array of characters representing the next portion of + * the message. + * length: [in] + * The length of the message in message_array + * + * Returns: + * sha Error Code. + * + */ +int USHAInput(USHAContext *ctx, + const uint8_t *bytes, unsigned int bytecount) +{ + if (ctx) { + switch (ctx->whichSha) { + case SHA1: + return SHA1Input((SHA1Context*)&ctx->ctx, bytes, bytecount); + case SHA224: + return SHA224Input((SHA224Context*)&ctx->ctx, bytes, + bytecount); + case SHA256: + return SHA256Input((SHA256Context*)&ctx->ctx, bytes, + bytecount); + case SHA384: + return SHA384Input((SHA384Context*)&ctx->ctx, bytes, + bytecount); + case SHA512: + return SHA512Input((SHA512Context*)&ctx->ctx, bytes, + bytecount); + default: return shaBadParam; + } + } else { + return shaNull; + } +} + + + +Eastlake 3rd & Hansen Informational [Page 68] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +/* + * USHAFinalBits + * + * Description: + * This function will add in any final bits of the message. + * + * Parameters: + * context: [in/out] + * The SHA context to update + * message_bits: [in] + * The final bits of the message, in the upper portion of the + * byte. (Use 0b###00000 instead of 0b00000### to input the + * three bits ###.) + * length: [in] + * The number of bits in message_bits, between 1 and 7. + * + * Returns: + * sha Error Code. + */ +int USHAFinalBits(USHAContext *ctx, + const uint8_t bits, unsigned int bitcount) +{ + if (ctx) { + switch (ctx->whichSha) { + case SHA1: + return SHA1FinalBits((SHA1Context*)&ctx->ctx, bits, bitcount); + case SHA224: + return SHA224FinalBits((SHA224Context*)&ctx->ctx, bits, + bitcount); + case SHA256: + return SHA256FinalBits((SHA256Context*)&ctx->ctx, bits, + bitcount); + case SHA384: + return SHA384FinalBits((SHA384Context*)&ctx->ctx, bits, + bitcount); + case SHA512: + return SHA512FinalBits((SHA512Context*)&ctx->ctx, bits, + bitcount); + default: return shaBadParam; + } + } else { + return shaNull; + } +} + +/* + * USHAResult + * + + + +Eastlake 3rd & Hansen Informational [Page 69] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * Description: + * This function will return the 160-bit message digest into the + * Message_Digest array provided by the caller. + * NOTE: The first octet of hash is stored in the 0th element, + * the last octet of hash in the 19th element. + * + * Parameters: + * context: [in/out] + * The context to use to calculate the SHA-1 hash. + * Message_Digest: [out] + * Where the digest is returned. + * + * Returns: + * sha Error Code. + * + */ +int USHAResult(USHAContext *ctx, + uint8_t Message_Digest[USHAMaxHashSize]) +{ + if (ctx) { + switch (ctx->whichSha) { + case SHA1: + return SHA1Result((SHA1Context*)&ctx->ctx, Message_Digest); + case SHA224: + return SHA224Result((SHA224Context*)&ctx->ctx, Message_Digest); + case SHA256: + return SHA256Result((SHA256Context*)&ctx->ctx, Message_Digest); + case SHA384: + return SHA384Result((SHA384Context*)&ctx->ctx, Message_Digest); + case SHA512: + return SHA512Result((SHA512Context*)&ctx->ctx, Message_Digest); + default: return shaBadParam; + } + } else { + return shaNull; + } +} + +/* + * USHABlockSize + * + * Description: + * This function will return the blocksize for the given SHA + * algorithm. + * + * Parameters: + * whichSha: + * which SHA algorithm to query + + + +Eastlake 3rd & Hansen Informational [Page 70] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * + * Returns: + * block size + * + */ +int USHABlockSize(enum SHAversion whichSha) +{ + switch (whichSha) { + case SHA1: return SHA1_Message_Block_Size; + case SHA224: return SHA224_Message_Block_Size; + case SHA256: return SHA256_Message_Block_Size; + case SHA384: return SHA384_Message_Block_Size; + default: + case SHA512: return SHA512_Message_Block_Size; + } +} + +/* + * USHAHashSize + * + * Description: + * This function will return the hashsize for the given SHA + * algorithm. + * + * Parameters: + * whichSha: + * which SHA algorithm to query + * + * Returns: + * hash size + * + */ +int USHAHashSize(enum SHAversion whichSha) +{ + switch (whichSha) { + case SHA1: return SHA1HashSize; + case SHA224: return SHA224HashSize; + case SHA256: return SHA256HashSize; + case SHA384: return SHA384HashSize; + default: + case SHA512: return SHA512HashSize; + } +} + +/* + * USHAHashSizeBits + * + * Description: + + + +Eastlake 3rd & Hansen Informational [Page 71] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * This function will return the hashsize for the given SHA + * algorithm, expressed in bits. + * + * Parameters: + * whichSha: + * which SHA algorithm to query + * + * Returns: + * hash size in bits + * + */ +int USHAHashSizeBits(enum SHAversion whichSha) +{ + switch (whichSha) { + case SHA1: return SHA1HashSizeBits; + case SHA224: return SHA224HashSizeBits; + case SHA256: return SHA256HashSizeBits; + case SHA384: return SHA384HashSizeBits; + default: + case SHA512: return SHA512HashSizeBits; + } +} + +8.2.5. sha-private.h + +/*************************** sha-private.h ***************************/ +/********************** See RFC 4634 for details *********************/ +#ifndef _SHA_PRIVATE__H +#define _SHA_PRIVATE__H +/* + * These definitions are defined in FIPS-180-2, section 4.1. + * Ch() and Maj() are defined identically in sections 4.1.1, + * 4.1.2 and 4.1.3. + * + * The definitions used in FIPS-180-2 are as follows: + */ + +#ifndef USE_MODIFIED_MACROS +#define SHA_Ch(x,y,z) (((x) & (y)) ^ ((~(x)) & (z))) +#define SHA_Maj(x,y,z) (((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z))) + +#else /* USE_MODIFIED_MACROS */ +/* + * The following definitions are equivalent and potentially faster. + */ + +#define SHA_Ch(x, y, z) (((x) & ((y) ^ (z))) ^ (z)) +#define SHA_Maj(x, y, z) (((x) & ((y) | (z))) | ((y) & (z))) + + + +Eastlake 3rd & Hansen Informational [Page 72] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +#endif /* USE_MODIFIED_MACROS */ + +#define SHA_Parity(x, y, z) ((x) ^ (y) ^ (z)) + +#endif /* _SHA_PRIVATE__H */ + +8.3 The HMAC Code + +/**************************** hmac.c ****************************/ +/******************** See RFC 4634 for details ******************/ +/* + * Description: + * This file implements the HMAC algorithm (Keyed-Hashing for + * Message Authentication, RFC2104), expressed in terms of the + * various SHA algorithms. + */ + +#include "sha.h" + +/* + * hmac + * + * Description: + * This function will compute an HMAC message digest. + * + * Parameters: + * whichSha: [in] + * One of SHA1, SHA224, SHA256, SHA384, SHA512 + * key: [in] + * The secret shared key. + * key_len: [in] + * The length of the secret shared key. + * message_array: [in] + * An array of characters representing the message. + * length: [in] + * The length of the message in message_array + * digest: [out] + * Where the digest is returned. + * NOTE: The length of the digest is determined by + * the value of whichSha. + * + * Returns: + * sha Error Code. + * + */ +int hmac(SHAversion whichSha, const unsigned char *text, int text_len, + const unsigned char *key, int key_len, + uint8_t digest[USHAMaxHashSize]) + + + +Eastlake 3rd & Hansen Informational [Page 73] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +{ + HMACContext ctx; + return hmacReset(&ctx, whichSha, key, key_len) || + hmacInput(&ctx, text, text_len) || + hmacResult(&ctx, digest); +} + +/* + * hmacReset + * + * Description: + * This function will initialize the hmacContext in preparation + * for computing a new HMAC message digest. + * + * Parameters: + * context: [in/out] + * The context to reset. + * whichSha: [in] + * One of SHA1, SHA224, SHA256, SHA384, SHA512 + * key: [in] + * The secret shared key. + * key_len: [in] + * The length of the secret shared key. + * + * Returns: + * sha Error Code. + * + */ +int hmacReset(HMACContext *ctx, enum SHAversion whichSha, + const unsigned char *key, int key_len) +{ + int i, blocksize, hashsize; + + /* inner padding - key XORd with ipad */ + unsigned char k_ipad[USHA_Max_Message_Block_Size]; + + /* temporary buffer when keylen > blocksize */ + unsigned char tempkey[USHAMaxHashSize]; + + if (!ctx) return shaNull; + + blocksize = ctx->blockSize = USHABlockSize(whichSha); + hashsize = ctx->hashSize = USHAHashSize(whichSha); + + ctx->whichSha = whichSha; + + /* + * If key is longer than the hash blocksize, + + + +Eastlake 3rd & Hansen Informational [Page 74] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * reset it to key = HASH(key). + */ + if (key_len > blocksize) { + USHAContext tctx; + int err = USHAReset(&tctx, whichSha) || + USHAInput(&tctx, key, key_len) || + USHAResult(&tctx, tempkey); + if (err != shaSuccess) return err; + + key = tempkey; + key_len = hashsize; + } + + /* + * The HMAC transform looks like: + * + * SHA(K XOR opad, SHA(K XOR ipad, text)) + * + * where K is an n byte key. + * ipad is the byte 0x36 repeated blocksize times + * opad is the byte 0x5c repeated blocksize times + * and text is the data being protected. + */ + + /* store key into the pads, XOR'd with ipad and opad values */ + for (i = 0; i < key_len; i++) { + k_ipad[i] = key[i] ^ 0x36; + ctx->k_opad[i] = key[i] ^ 0x5c; + } + /* remaining pad bytes are '\0' XOR'd with ipad and opad values */ + for ( ; i < blocksize; i++) { + k_ipad[i] = 0x36; + ctx->k_opad[i] = 0x5c; + } + + /* perform inner hash */ + /* init context for 1st pass */ + return USHAReset(&ctx->shaContext, whichSha) || + /* and start with inner pad */ + USHAInput(&ctx->shaContext, k_ipad, blocksize); +} + +/* + * hmacInput + * + * Description: + * This function accepts an array of octets as the next portion + * of the message. + + + +Eastlake 3rd & Hansen Informational [Page 75] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * + * Parameters: + * context: [in/out] + * The HMAC context to update + * message_array: [in] + * An array of characters representing the next portion of + * the message. + * length: [in] + * The length of the message in message_array + * + * Returns: + * sha Error Code. + * + */ +int hmacInput(HMACContext *ctx, const unsigned char *text, + int text_len) +{ + if (!ctx) return shaNull; + /* then text of datagram */ + return USHAInput(&ctx->shaContext, text, text_len); +} + +/* + * HMACFinalBits + * + * Description: + * This function will add in any final bits of the message. + * + * Parameters: + * context: [in/out] + * The HMAC context to update + * message_bits: [in] + * The final bits of the message, in the upper portion of the + * byte. (Use 0b###00000 instead of 0b00000### to input the + * three bits ###.) + * length: [in] + * The number of bits in message_bits, between 1 and 7. + * + * Returns: + * sha Error Code. + */ +int hmacFinalBits(HMACContext *ctx, + const uint8_t bits, + unsigned int bitcount) +{ + if (!ctx) return shaNull; + /* then final bits of datagram */ + return USHAFinalBits(&ctx->shaContext, bits, bitcount); + + + +Eastlake 3rd & Hansen Informational [Page 76] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +} + +/* + * HMACResult + * + * Description: + * This function will return the N-byte message digest into the + * Message_Digest array provided by the caller. + * NOTE: The first octet of hash is stored in the 0th element, + * the last octet of hash in the Nth element. + * + * Parameters: + * context: [in/out] + * The context to use to calculate the HMAC hash. + * digest: [out] + * Where the digest is returned. + * NOTE 2: The length of the hash is determined by the value of + * whichSha that was passed to hmacReset(). + * + * Returns: + * sha Error Code. + * + */ +int hmacResult(HMACContext *ctx, uint8_t *digest) +{ + if (!ctx) return shaNull; + + /* finish up 1st pass */ + /* (Use digest here as a temporary buffer.) */ + return USHAResult(&ctx->shaContext, digest) || + + /* perform outer SHA */ + /* init context for 2nd pass */ + USHAReset(&ctx->shaContext, ctx->whichSha) || + + /* start with outer pad */ + USHAInput(&ctx->shaContext, ctx->k_opad, ctx->blockSize) || + + /* then results of 1st hash */ + USHAInput(&ctx->shaContext, digest, ctx->hashSize) || + + /* finish up 2nd pass */ + USHAResult(&ctx->shaContext, digest); +} + + + + + + + +Eastlake 3rd & Hansen Informational [Page 77] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +8.4. The Test Driver + + The following code is a main program test driver to exercise the code + in sha1.c, sha224-256.c, and sha384-512.c. The test driver can also + be used as a stand-alone program for generating the hashes. + + See also [RFC2202], [RFC4231], and [SHAVS]. + +/**************************** shatest.c ****************************/ +/********************* See RFC 4634 for details ********************/ +/* + * Description: + * This file will exercise the SHA code performing + * the three tests documented in FIPS PUB 180-2 + * (http://csrc.nist.gov/publications/fips/ + * fips180-2/fips180-2withchangenotice.pdf) + * one that calls SHAInput with an exact multiple of 512 bits + * the seven tests documented for each algorithm in + * "The Secure Hash Algorithm Validation System (SHAVS)", + * three of which are bit-level tests + * (http://csrc.nist.gov/cryptval/shs/SHAVS.pdf) + * + * This file will exercise the HMAC SHA1 code performing + * the seven tests documented in RFCs 2202 and 4231. + * + * To run the tests and just see PASSED/FAILED, use the -p option. + * + * Other options exercise: + * hashing an arbitrary string + * hashing a file's contents + * a few error test checks + * printing the results in raw format + * + * Portability Issues: + * None. + * + */ + +#include <stdint.h> +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <ctype.h> +#include "sha.h" + +static int xgetopt(int argc, char **argv, const char *optstring); +extern char *xoptarg; +static int scasecmp(const char *s1, const char *s2); + + + +Eastlake 3rd & Hansen Informational [Page 78] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +/* + * Define patterns for testing + */ +#define TEST1 "abc" +#define TEST2_1 \ + "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq" +#define TEST2_2a \ + "abcdefghbcdefghicdefghijdefghijkefghijklfghijklmghijklmn" +#define TEST2_2b \ + "hijklmnoijklmnopjklmnopqklmnopqrlmnopqrsmnopqrstnopqrstu" +#define TEST2_2 TEST2_2a TEST2_2b +#define TEST3 "a" /* times 1000000 */ +#define TEST4a "01234567012345670123456701234567" +#define TEST4b "01234567012345670123456701234567" + /* an exact multiple of 512 bits */ +#define TEST4 TEST4a TEST4b /* times 10 */ + +#define TEST7_1 \ + "\x49\xb2\xae\xc2\x59\x4b\xbe\x3a\x3b\x11\x75\x42\xd9\x4a\xc8" +#define TEST8_1 \ + "\x9a\x7d\xfd\xf1\xec\xea\xd0\x6e\xd6\x46\xaa\x55\xfe\x75\x71\x46" +#define TEST9_1 \ + "\x65\xf9\x32\x99\x5b\xa4\xce\x2c\xb1\xb4\xa2\xe7\x1a\xe7\x02\x20" \ + "\xaa\xce\xc8\x96\x2d\xd4\x49\x9c\xbd\x7c\x88\x7a\x94\xea\xaa\x10" \ + "\x1e\xa5\xaa\xbc\x52\x9b\x4e\x7e\x43\x66\x5a\x5a\xf2\xcd\x03\xfe" \ + "\x67\x8e\xa6\xa5\x00\x5b\xba\x3b\x08\x22\x04\xc2\x8b\x91\x09\xf4" \ + "\x69\xda\xc9\x2a\xaa\xb3\xaa\x7c\x11\xa1\xb3\x2a" +#define TEST10_1 \ + "\xf7\x8f\x92\x14\x1b\xcd\x17\x0a\xe8\x9b\x4f\xba\x15\xa1\xd5\x9f" \ + "\x3f\xd8\x4d\x22\x3c\x92\x51\xbd\xac\xbb\xae\x61\xd0\x5e\xd1\x15" \ + "\xa0\x6a\x7c\xe1\x17\xb7\xbe\xea\xd2\x44\x21\xde\xd9\xc3\x25\x92" \ + "\xbd\x57\xed\xea\xe3\x9c\x39\xfa\x1f\xe8\x94\x6a\x84\xd0\xcf\x1f" \ + "\x7b\xee\xad\x17\x13\xe2\xe0\x95\x98\x97\x34\x7f\x67\xc8\x0b\x04" \ + "\x00\xc2\x09\x81\x5d\x6b\x10\xa6\x83\x83\x6f\xd5\x56\x2a\x56\xca" \ + "\xb1\xa2\x8e\x81\xb6\x57\x66\x54\x63\x1c\xf1\x65\x66\xb8\x6e\x3b" \ + "\x33\xa1\x08\xb0\x53\x07\xc0\x0a\xff\x14\xa7\x68\xed\x73\x50\x60" \ + "\x6a\x0f\x85\xe6\xa9\x1d\x39\x6f\x5b\x5c\xbe\x57\x7f\x9b\x38\x80" \ + "\x7c\x7d\x52\x3d\x6d\x79\x2f\x6e\xbc\x24\xa4\xec\xf2\xb3\xa4\x27" \ + "\xcd\xbb\xfb" +#define TEST7_224 \ + "\xf0\x70\x06\xf2\x5a\x0b\xea\x68\xcd\x76\xa2\x95\x87\xc2\x8d" +#define TEST8_224 \ + "\x18\x80\x40\x05\xdd\x4f\xbd\x15\x56\x29\x9d\x6f\x9d\x93\xdf\x62" +#define TEST9_224 \ + "\xa2\xbe\x6e\x46\x32\x81\x09\x02\x94\xd9\xce\x94\x82\x65\x69\x42" \ + "\x3a\x3a\x30\x5e\xd5\xe2\x11\x6c\xd4\xa4\xc9\x87\xfc\x06\x57\x00" \ + "\x64\x91\xb1\x49\xcc\xd4\xb5\x11\x30\xac\x62\xb1\x9d\xc2\x48\xc7" \ + "\x44\x54\x3d\x20\xcd\x39\x52\xdc\xed\x1f\x06\xcc\x3b\x18\xb9\x1f" \ + + + +Eastlake 3rd & Hansen Informational [Page 79] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + "\x3f\x55\x63\x3e\xcc\x30\x85\xf4\x90\x70\x60\xd2" +#define TEST10_224 \ + "\x55\xb2\x10\x07\x9c\x61\xb5\x3a\xdd\x52\x06\x22\xd1\xac\x97\xd5" \ + "\xcd\xbe\x8c\xb3\x3a\xa0\xae\x34\x45\x17\xbe\xe4\xd7\xba\x09\xab" \ + "\xc8\x53\x3c\x52\x50\x88\x7a\x43\xbe\xbb\xac\x90\x6c\x2e\x18\x37" \ + "\xf2\x6b\x36\xa5\x9a\xe3\xbe\x78\x14\xd5\x06\x89\x6b\x71\x8b\x2a" \ + "\x38\x3e\xcd\xac\x16\xb9\x61\x25\x55\x3f\x41\x6f\xf3\x2c\x66\x74" \ + "\xc7\x45\x99\xa9\x00\x53\x86\xd9\xce\x11\x12\x24\x5f\x48\xee\x47" \ + "\x0d\x39\x6c\x1e\xd6\x3b\x92\x67\x0c\xa5\x6e\xc8\x4d\xee\xa8\x14" \ + "\xb6\x13\x5e\xca\x54\x39\x2b\xde\xdb\x94\x89\xbc\x9b\x87\x5a\x8b" \ + "\xaf\x0d\xc1\xae\x78\x57\x36\x91\x4a\xb7\xda\xa2\x64\xbc\x07\x9d" \ + "\x26\x9f\x2c\x0d\x7e\xdd\xd8\x10\xa4\x26\x14\x5a\x07\x76\xf6\x7c" \ + "\x87\x82\x73" +#define TEST7_256 \ + "\xbe\x27\x46\xc6\xdb\x52\x76\x5f\xdb\x2f\x88\x70\x0f\x9a\x73" +#define TEST8_256 \ + "\xe3\xd7\x25\x70\xdc\xdd\x78\x7c\xe3\x88\x7a\xb2\xcd\x68\x46\x52" +#define TEST9_256 \ + "\x3e\x74\x03\x71\xc8\x10\xc2\xb9\x9f\xc0\x4e\x80\x49\x07\xef\x7c" \ + "\xf2\x6b\xe2\x8b\x57\xcb\x58\xa3\xe2\xf3\xc0\x07\x16\x6e\x49\xc1" \ + "\x2e\x9b\xa3\x4c\x01\x04\x06\x91\x29\xea\x76\x15\x64\x25\x45\x70" \ + "\x3a\x2b\xd9\x01\xe1\x6e\xb0\xe0\x5d\xeb\xa0\x14\xeb\xff\x64\x06" \ + "\xa0\x7d\x54\x36\x4e\xff\x74\x2d\xa7\x79\xb0\xb3" +#define TEST10_256 \ + "\x83\x26\x75\x4e\x22\x77\x37\x2f\x4f\xc1\x2b\x20\x52\x7a\xfe\xf0" \ + "\x4d\x8a\x05\x69\x71\xb1\x1a\xd5\x71\x23\xa7\xc1\x37\x76\x00\x00" \ + "\xd7\xbe\xf6\xf3\xc1\xf7\xa9\x08\x3a\xa3\x9d\x81\x0d\xb3\x10\x77" \ + "\x7d\xab\x8b\x1e\x7f\x02\xb8\x4a\x26\xc7\x73\x32\x5f\x8b\x23\x74" \ + "\xde\x7a\x4b\x5a\x58\xcb\x5c\x5c\xf3\x5b\xce\xe6\xfb\x94\x6e\x5b" \ + "\xd6\x94\xfa\x59\x3a\x8b\xeb\x3f\x9d\x65\x92\xec\xed\xaa\x66\xca" \ + "\x82\xa2\x9d\x0c\x51\xbc\xf9\x33\x62\x30\xe5\xd7\x84\xe4\xc0\xa4" \ + "\x3f\x8d\x79\xa3\x0a\x16\x5c\xba\xbe\x45\x2b\x77\x4b\x9c\x71\x09" \ + "\xa9\x7d\x13\x8f\x12\x92\x28\x96\x6f\x6c\x0a\xdc\x10\x6a\xad\x5a" \ + "\x9f\xdd\x30\x82\x57\x69\xb2\xc6\x71\xaf\x67\x59\xdf\x28\xeb\x39" \ + "\x3d\x54\xd6" +#define TEST7_384 \ + "\x8b\xc5\x00\xc7\x7c\xee\xd9\x87\x9d\xa9\x89\x10\x7c\xe0\xaa" +#define TEST8_384 \ + "\xa4\x1c\x49\x77\x79\xc0\x37\x5f\xf1\x0a\x7f\x4e\x08\x59\x17\x39" +#define TEST9_384 \ + "\x68\xf5\x01\x79\x2d\xea\x97\x96\x76\x70\x22\xd9\x3d\xa7\x16\x79" \ + "\x30\x99\x20\xfa\x10\x12\xae\xa3\x57\xb2\xb1\x33\x1d\x40\xa1\xd0" \ + "\x3c\x41\xc2\x40\xb3\xc9\xa7\x5b\x48\x92\xf4\xc0\x72\x4b\x68\xc8" \ + "\x75\x32\x1a\xb8\xcf\xe5\x02\x3b\xd3\x75\xbc\x0f\x94\xbd\x89\xfe" \ + "\x04\xf2\x97\x10\x5d\x7b\x82\xff\xc0\x02\x1a\xeb\x1c\xcb\x67\x4f" \ + "\x52\x44\xea\x34\x97\xde\x26\xa4\x19\x1c\x5f\x62\xe5\xe9\xa2\xd8" \ + "\x08\x2f\x05\x51\xf4\xa5\x30\x68\x26\xe9\x1c\xc0\x06\xce\x1b\xf6" \ + "\x0f\xf7\x19\xd4\x2f\xa5\x21\xc8\x71\xcd\x23\x94\xd9\x6e\xf4\x46" \ + + + +Eastlake 3rd & Hansen Informational [Page 80] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + "\x8f\x21\x96\x6b\x41\xf2\xba\x80\xc2\x6e\x83\xa9" +#define TEST10_384 \ + "\x39\x96\x69\xe2\x8f\x6b\x9c\x6d\xbc\xbb\x69\x12\xec\x10\xff\xcf" \ + "\x74\x79\x03\x49\xb7\xdc\x8f\xbe\x4a\x8e\x7b\x3b\x56\x21\xdb\x0f" \ + "\x3e\x7d\xc8\x7f\x82\x32\x64\xbb\xe4\x0d\x18\x11\xc9\xea\x20\x61" \ + "\xe1\xc8\x4a\xd1\x0a\x23\xfa\xc1\x72\x7e\x72\x02\xfc\x3f\x50\x42" \ + "\xe6\xbf\x58\xcb\xa8\xa2\x74\x6e\x1f\x64\xf9\xb9\xea\x35\x2c\x71" \ + "\x15\x07\x05\x3c\xf4\xe5\x33\x9d\x52\x86\x5f\x25\xcc\x22\xb5\xe8" \ + "\x77\x84\xa1\x2f\xc9\x61\xd6\x6c\xb6\xe8\x95\x73\x19\x9a\x2c\xe6" \ + "\x56\x5c\xbd\xf1\x3d\xca\x40\x38\x32\xcf\xcb\x0e\x8b\x72\x11\xe8" \ + "\x3a\xf3\x2a\x11\xac\x17\x92\x9f\xf1\xc0\x73\xa5\x1c\xc0\x27\xaa" \ + "\xed\xef\xf8\x5a\xad\x7c\x2b\x7c\x5a\x80\x3e\x24\x04\xd9\x6d\x2a" \ + "\x77\x35\x7b\xda\x1a\x6d\xae\xed\x17\x15\x1c\xb9\xbc\x51\x25\xa4" \ + "\x22\xe9\x41\xde\x0c\xa0\xfc\x50\x11\xc2\x3e\xcf\xfe\xfd\xd0\x96" \ + "\x76\x71\x1c\xf3\xdb\x0a\x34\x40\x72\x0e\x16\x15\xc1\xf2\x2f\xbc" \ + "\x3c\x72\x1d\xe5\x21\xe1\xb9\x9b\xa1\xbd\x55\x77\x40\x86\x42\x14" \ + "\x7e\xd0\x96" +#define TEST7_512 \ + "\x08\xec\xb5\x2e\xba\xe1\xf7\x42\x2d\xb6\x2b\xcd\x54\x26\x70" +#define TEST8_512 \ + "\x8d\x4e\x3c\x0e\x38\x89\x19\x14\x91\x81\x6e\x9d\x98\xbf\xf0\xa0" +#define TEST9_512 \ + "\x3a\xdd\xec\x85\x59\x32\x16\xd1\x61\x9a\xa0\x2d\x97\x56\x97\x0b" \ + "\xfc\x70\xac\xe2\x74\x4f\x7c\x6b\x27\x88\x15\x10\x28\xf7\xb6\xa2" \ + "\x55\x0f\xd7\x4a\x7e\x6e\x69\xc2\xc9\xb4\x5f\xc4\x54\x96\x6d\xc3" \ + "\x1d\x2e\x10\xda\x1f\x95\xce\x02\xbe\xb4\xbf\x87\x65\x57\x4c\xbd" \ + "\x6e\x83\x37\xef\x42\x0a\xdc\x98\xc1\x5c\xb6\xd5\xe4\xa0\x24\x1b" \ + "\xa0\x04\x6d\x25\x0e\x51\x02\x31\xca\xc2\x04\x6c\x99\x16\x06\xab" \ + "\x4e\xe4\x14\x5b\xee\x2f\xf4\xbb\x12\x3a\xab\x49\x8d\x9d\x44\x79" \ + "\x4f\x99\xcc\xad\x89\xa9\xa1\x62\x12\x59\xed\xa7\x0a\x5b\x6d\xd4" \ + "\xbd\xd8\x77\x78\xc9\x04\x3b\x93\x84\xf5\x49\x06" +#define TEST10_512 \ + "\xa5\x5f\x20\xc4\x11\xaa\xd1\x32\x80\x7a\x50\x2d\x65\x82\x4e\x31" \ + "\xa2\x30\x54\x32\xaa\x3d\x06\xd3\xe2\x82\xa8\xd8\x4e\x0d\xe1\xde" \ + "\x69\x74\xbf\x49\x54\x69\xfc\x7f\x33\x8f\x80\x54\xd5\x8c\x26\xc4" \ + "\x93\x60\xc3\xe8\x7a\xf5\x65\x23\xac\xf6\xd8\x9d\x03\xe5\x6f\xf2" \ + "\xf8\x68\x00\x2b\xc3\xe4\x31\xed\xc4\x4d\xf2\xf0\x22\x3d\x4b\xb3" \ + "\xb2\x43\x58\x6e\x1a\x7d\x92\x49\x36\x69\x4f\xcb\xba\xf8\x8d\x95" \ + "\x19\xe4\xeb\x50\xa6\x44\xf8\xe4\xf9\x5e\xb0\xea\x95\xbc\x44\x65" \ + "\xc8\x82\x1a\xac\xd2\xfe\x15\xab\x49\x81\x16\x4b\xbb\x6d\xc3\x2f" \ + "\x96\x90\x87\xa1\x45\xb0\xd9\xcc\x9c\x67\xc2\x2b\x76\x32\x99\x41" \ + "\x9c\xc4\x12\x8b\xe9\xa0\x77\xb3\xac\xe6\x34\x06\x4e\x6d\x99\x28" \ + "\x35\x13\xdc\x06\xe7\x51\x5d\x0d\x73\x13\x2e\x9a\x0d\xc6\xd3\xb1" \ + "\xf8\xb2\x46\xf1\xa9\x8a\x3f\xc7\x29\x41\xb1\xe3\xbb\x20\x98\xe8" \ + "\xbf\x16\xf2\x68\xd6\x4f\x0b\x0f\x47\x07\xfe\x1e\xa1\xa1\x79\x1b" \ + "\xa2\xf3\xc0\xc7\x58\xe5\xf5\x51\x86\x3a\x96\xc9\x49\xad\x47\xd7" \ + "\xfb\x40\xd2" +#define SHA1_SEED "\xd0\x56\x9c\xb3\x66\x5a\x8a\x43\xeb\x6e\xa2\x3d" \ + + + +Eastlake 3rd & Hansen Informational [Page 81] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + "\x75\xa3\xc4\xd2\x05\x4a\x0d\x7d" +#define SHA224_SEED "\xd0\x56\x9c\xb3\x66\x5a\x8a\x43\xeb\x6e\xa2" \ + "\x3d\x75\xa3\xc4\xd2\x05\x4a\x0d\x7d\x66\xa9\xca\x99\xc9\xce\xb0" \ + "\x27" +#define SHA256_SEED "\xf4\x1e\xce\x26\x13\xe4\x57\x39\x15\x69\x6b" \ + "\x5a\xdc\xd5\x1c\xa3\x28\xbe\x3b\xf5\x66\xa9\xca\x99\xc9\xce\xb0" \ + "\x27\x9c\x1c\xb0\xa7" +#define SHA384_SEED "\x82\x40\xbc\x51\xe4\xec\x7e\xf7\x6d\x18\xe3" \ + "\x52\x04\xa1\x9f\x51\xa5\x21\x3a\x73\xa8\x1d\x6f\x94\x46\x80\xd3" \ + "\x07\x59\x48\xb7\xe4\x63\x80\x4e\xa3\xd2\x6e\x13\xea\x82\x0d\x65" \ + "\xa4\x84\xbe\x74\x53" +#define SHA512_SEED "\x47\x3f\xf1\xb9\xb3\xff\xdf\xa1\x26\x69\x9a" \ + "\xc7\xef\x9e\x8e\x78\x77\x73\x09\x58\x24\xc6\x42\x55\x7c\x13\x99" \ + "\xd9\x8e\x42\x20\x44\x8d\xc3\x5b\x99\xbf\xdd\x44\x77\x95\x43\x92" \ + "\x4c\x1c\xe9\x3b\xc5\x94\x15\x38\x89\x5d\xb9\x88\x26\x1b\x00\x77" \ + "\x4b\x12\x27\x20\x39" + +#define TESTCOUNT 10 +#define HASHCOUNT 5 +#define RANDOMCOUNT 4 +#define HMACTESTCOUNT 7 + +#define PRINTNONE 0 +#define PRINTTEXT 1 +#define PRINTRAW 2 +#define PRINTHEX 3 +#define PRINTBASE64 4 + +#define PRINTPASSFAIL 1 +#define PRINTFAIL 2 + +#define length(x) (sizeof(x)-1) + +/* Test arrays for hashes. */ +struct hash { + const char *name; + SHAversion whichSha; + int hashsize; + struct { + const char *testarray; + int length; + long repeatcount; + int extrabits; + int numberExtrabits; + const char *resultarray; + } tests[TESTCOUNT]; + const char *randomtest; + const char *randomresults[RANDOMCOUNT]; + + + +Eastlake 3rd & Hansen Informational [Page 82] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +} hashes[HASHCOUNT] = { + { "SHA1", SHA1, SHA1HashSize, + { + /* 1 */ { TEST1, length(TEST1), 1, 0, 0, + "A9993E364706816ABA3E25717850C26C9CD0D89D" }, + /* 2 */ { TEST2_1, length(TEST2_1), 1, 0, 0, + "84983E441C3BD26EBAAE4AA1F95129E5E54670F1" }, + /* 3 */ { TEST3, length(TEST3), 1000000, 0, 0, + "34AA973CD4C4DAA4F61EEB2BDBAD27316534016F" }, + /* 4 */ { TEST4, length(TEST4), 10, 0, 0, + "DEA356A2CDDD90C7A7ECEDC5EBB563934F460452" }, + /* 5 */ { "", 0, 0, 0x98, 5, + "29826B003B906E660EFF4027CE98AF3531AC75BA" }, + /* 6 */ { "\x5e", 1, 1, 0, 0, + "5E6F80A34A9798CAFC6A5DB96CC57BA4C4DB59C2" }, + /* 7 */ { TEST7_1, length(TEST7_1), 1, 0x80, 3, + "6239781E03729919C01955B3FFA8ACB60B988340" }, + /* 8 */ { TEST8_1, length(TEST8_1), 1, 0, 0, + "82ABFF6605DBE1C17DEF12A394FA22A82B544A35" }, + /* 9 */ { TEST9_1, length(TEST9_1), 1, 0xE0, 3, + "8C5B2A5DDAE5A97FC7F9D85661C672ADBF7933D4" }, + /* 10 */ { TEST10_1, length(TEST10_1), 1, 0, 0, + "CB0082C8F197D260991BA6A460E76E202BAD27B3" } + }, SHA1_SEED, { "E216836819477C7F78E0D843FE4FF1B6D6C14CD4", + "A2DBC7A5B1C6C0A8BCB7AAA41252A6A7D0690DBC", + "DB1F9050BB863DFEF4CE37186044E2EEB17EE013", + "127FDEDF43D372A51D5747C48FBFFE38EF6CDF7B" + } }, + { "SHA224", SHA224, SHA224HashSize, + { + /* 1 */ { TEST1, length(TEST1), 1, 0, 0, + "23097D223405D8228642A477BDA255B32AADBCE4BDA0B3F7E36C9DA7" }, + /* 2 */ { TEST2_1, length(TEST2_1), 1, 0, 0, + "75388B16512776CC5DBA5DA1FD890150B0C6455CB4F58B1952522525" }, + /* 3 */ { TEST3, length(TEST3), 1000000, 0, 0, + "20794655980C91D8BBB4C1EA97618A4BF03F42581948B2EE4EE7AD67" }, + /* 4 */ { TEST4, length(TEST4), 10, 0, 0, + "567F69F168CD7844E65259CE658FE7AADFA25216E68ECA0EB7AB8262" }, + /* 5 */ { "", 0, 0, 0x68, 5, + "E3B048552C3C387BCAB37F6EB06BB79B96A4AEE5FF27F51531A9551C" }, + /* 6 */ { "\x07", 1, 1, 0, 0, + "00ECD5F138422B8AD74C9799FD826C531BAD2FCABC7450BEE2AA8C2A" }, + /* 7 */ { TEST7_224, length(TEST7_224), 1, 0xA0, 3, + "1B01DB6CB4A9E43DED1516BEB3DB0B87B6D1EA43187462C608137150" }, + /* 8 */ { TEST8_224, length(TEST8_224), 1, 0, 0, + "DF90D78AA78821C99B40BA4C966921ACCD8FFB1E98AC388E56191DB1" }, + /* 9 */ { TEST9_224, length(TEST9_224), 1, 0xE0, 3, + "54BEA6EAB8195A2EB0A7906A4B4A876666300EEFBD1F3B8474F9CD57" }, + + + +Eastlake 3rd & Hansen Informational [Page 83] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + /* 10 */ { TEST10_224, length(TEST10_224), 1, 0, 0, + "0B31894EC8937AD9B91BDFBCBA294D9ADEFAA18E09305E9F20D5C3A4" } + }, SHA224_SEED, { "100966A5B4FDE0B42E2A6C5953D4D7F41BA7CF79FD" + "2DF431416734BE", "1DCA396B0C417715DEFAAE9641E10A2E99D55A" + "BCB8A00061EB3BE8BD", "1864E627BDB2319973CD5ED7D68DA71D8B" + "F0F983D8D9AB32C34ADB34", "A2406481FC1BCAF24DD08E6752E844" + "709563FB916227FED598EB621F" + } }, + { "SHA256", SHA256, SHA256HashSize, + { + /* 1 */ { TEST1, length(TEST1), 1, 0, 0, "BA7816BF8F01CFEA4141" + "40DE5DAE2223B00361A396177A9CB410FF61F20015AD" }, + /* 2 */ { TEST2_1, length(TEST2_1), 1, 0, 0, "248D6A61D20638B8" + "E5C026930C3E6039A33CE45964FF2167F6ECEDD419DB06C1" }, + /* 3 */ { TEST3, length(TEST3), 1000000, 0, 0, "CDC76E5C9914FB92" + "81A1C7E284D73E67F1809A48A497200E046D39CCC7112CD0" }, + /* 4 */ { TEST4, length(TEST4), 10, 0, 0, "594847328451BDFA" + "85056225462CC1D867D877FB388DF0CE35F25AB5562BFBB5" }, + /* 5 */ { "", 0, 0, 0x68, 5, "D6D3E02A31A84A8CAA9718ED6C2057BE" + "09DB45E7823EB5079CE7A573A3760F95" }, + /* 6 */ { "\x19", 1, 1, 0, 0, "68AA2E2EE5DFF96E3355E6C7EE373E3D" + "6A4E17F75F9518D843709C0C9BC3E3D4" }, + /* 7 */ { TEST7_256, length(TEST7_256), 1, 0x60, 3, "77EC1DC8" + "9C821FF2A1279089FA091B35B8CD960BCAF7DE01C6A7680756BEB972" }, + /* 8 */ { TEST8_256, length(TEST8_256), 1, 0, 0, "175EE69B02BA" + "9B58E2B0A5FD13819CEA573F3940A94F825128CF4209BEABB4E8" }, + /* 9 */ { TEST9_256, length(TEST9_256), 1, 0xA0, 3, "3E9AD646" + "8BBBAD2AC3C2CDC292E018BA5FD70B960CF1679777FCE708FDB066E9" }, + /* 10 */ { TEST10_256, length(TEST10_256), 1, 0, 0, "97DBCA7D" + "F46D62C8A422C941DD7E835B8AD3361763F7E9B2D95F4F0DA6E1CCBC" }, + }, SHA256_SEED, { "83D28614D49C3ADC1D6FC05DB5F48037C056F8D2A4CE44" + "EC6457DEA5DD797CD1", "99DBE3127EF2E93DD9322D6A07909EB33B6399" + "5E529B3F954B8581621BB74D39", "8D4BE295BB64661CA3C7EFD129A2F7" + "25B33072DBDDE32385B9A87B9AF88EA76F", "40AF5D3F9716B040DF9408" + "E31536B70FF906EC51B00447CA97D7DD97C12411F4" + } }, + { "SHA384", SHA384, SHA384HashSize, + { + /* 1 */ { TEST1, length(TEST1), 1, 0, 0, + "CB00753F45A35E8BB5A03D699AC65007272C32AB0EDED163" + "1A8B605A43FF5BED8086072BA1E7CC2358BAECA134C825A7" }, + /* 2 */ { TEST2_2, length(TEST2_2), 1, 0, 0, + "09330C33F71147E83D192FC782CD1B4753111B173B3B05D2" + "2FA08086E3B0F712FCC7C71A557E2DB966C3E9FA91746039" }, + /* 3 */ { TEST3, length(TEST3), 1000000, 0, 0, + "9D0E1809716474CB086E834E310A4A1CED149E9C00F24852" + "7972CEC5704C2A5B07B8B3DC38ECC4EBAE97DDD87F3D8985" }, + /* 4 */ { TEST4, length(TEST4), 10, 0, 0, + + + +Eastlake 3rd & Hansen Informational [Page 84] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + "2FC64A4F500DDB6828F6A3430B8DD72A368EB7F3A8322A70" + "BC84275B9C0B3AB00D27A5CC3C2D224AA6B61A0D79FB4596" }, + /* 5 */ { "", 0, 0, 0x10, 5, + "8D17BE79E32B6718E07D8A603EB84BA0478F7FCFD1BB9399" + "5F7D1149E09143AC1FFCFC56820E469F3878D957A15A3FE4" }, + /* 6 */ { "\xb9", 1, 1, 0, 0, + "BC8089A19007C0B14195F4ECC74094FEC64F01F90929282C" + "2FB392881578208AD466828B1C6C283D2722CF0AD1AB6938" }, + /* 7 */ { TEST7_384, length(TEST7_384), 1, 0xA0, 3, + "D8C43B38E12E7C42A7C9B810299FD6A770BEF30920F17532" + "A898DE62C7A07E4293449C0B5FA70109F0783211CFC4BCE3" }, + /* 8 */ { TEST8_384, length(TEST8_384), 1, 0, 0, + "C9A68443A005812256B8EC76B00516F0DBB74FAB26D66591" + "3F194B6FFB0E91EA9967566B58109CBC675CC208E4C823F7" }, + /* 9 */ { TEST9_384, length(TEST9_384), 1, 0xE0, 3, + "5860E8DE91C21578BB4174D227898A98E0B45C4C760F0095" + "49495614DAEDC0775D92D11D9F8CE9B064EEAC8DAFC3A297" }, + /* 10 */ { TEST10_384, length(TEST10_384), 1, 0, 0, + "4F440DB1E6EDD2899FA335F09515AA025EE177A79F4B4AAF" + "38E42B5C4DE660F5DE8FB2A5B2FBD2A3CBFFD20CFF1288C0" } + }, SHA384_SEED, { "CE44D7D63AE0C91482998CF662A51EC80BF6FC68661A3C" + "57F87566112BD635A743EA904DEB7D7A42AC808CABE697F38F", "F9C6D2" + "61881FEE41ACD39E67AA8D0BAD507C7363EB67E2B81F45759F9C0FD7B503" + "DF1A0B9E80BDE7BC333D75B804197D", "D96512D8C9F4A7A4967A366C01" + "C6FD97384225B58343A88264847C18E4EF8AB7AEE4765FFBC3E30BD485D3" + "638A01418F", "0CA76BD0813AF1509E170907A96005938BC985628290B2" + "5FEF73CF6FAD68DDBA0AC8920C94E0541607B0915A7B4457F7" + } }, + { "SHA512", SHA512, SHA512HashSize, + { + /* 1 */ { TEST1, length(TEST1), 1, 0, 0, + "DDAF35A193617ABACC417349AE20413112E6FA4E89A97EA2" + "0A9EEEE64B55D39A2192992A274FC1A836BA3C23A3FEEBBD" + "454D4423643CE80E2A9AC94FA54CA49F" }, + /* 2 */ { TEST2_2, length(TEST2_2), 1, 0, 0, + "8E959B75DAE313DA8CF4F72814FC143F8F7779C6EB9F7FA1" + "7299AEADB6889018501D289E4900F7E4331B99DEC4B5433A" + "C7D329EEB6DD26545E96E55B874BE909" }, + /* 3 */ { TEST3, length(TEST3), 1000000, 0, 0, + "E718483D0CE769644E2E42C7BC15B4638E1F98B13B204428" + "5632A803AFA973EBDE0FF244877EA60A4CB0432CE577C31B" + "EB009C5C2C49AA2E4EADB217AD8CC09B" }, + /* 4 */ { TEST4, length(TEST4), 10, 0, 0, + "89D05BA632C699C31231DED4FFC127D5A894DAD412C0E024" + "DB872D1ABD2BA8141A0F85072A9BE1E2AA04CF33C765CB51" + "0813A39CD5A84C4ACAA64D3F3FB7BAE9" }, + /* 5 */ { "", 0, 0, 0xB0, 5, + "D4EE29A9E90985446B913CF1D1376C836F4BE2C1CF3CADA0" + + + +Eastlake 3rd & Hansen Informational [Page 85] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + "720A6BF4857D886A7ECB3C4E4C0FA8C7F95214E41DC1B0D2" + "1B22A84CC03BF8CE4845F34DD5BDBAD4" }, + /* 6 */ { "\xD0", 1, 1, 0, 0, + "9992202938E882E73E20F6B69E68A0A7149090423D93C81B" + "AB3F21678D4ACEEEE50E4E8CAFADA4C85A54EA8306826C4A" + "D6E74CECE9631BFA8A549B4AB3FBBA15" }, + /* 7 */ { TEST7_512, length(TEST7_512), 1, 0x80, 3, + "ED8DC78E8B01B69750053DBB7A0A9EDA0FB9E9D292B1ED71" + "5E80A7FE290A4E16664FD913E85854400C5AF05E6DAD316B" + "7359B43E64F8BEC3C1F237119986BBB6" }, + /* 8 */ { TEST8_512, length(TEST8_512), 1, 0, 0, + "CB0B67A4B8712CD73C9AABC0B199E9269B20844AFB75ACBD" + "D1C153C9828924C3DDEDAAFE669C5FDD0BC66F630F677398" + "8213EB1B16F517AD0DE4B2F0C95C90F8" }, + /* 9 */ { TEST9_512, length(TEST9_512), 1, 0x80, 3, + "32BA76FC30EAA0208AEB50FFB5AF1864FDBF17902A4DC0A6" + "82C61FCEA6D92B783267B21080301837F59DE79C6B337DB2" + "526F8A0A510E5E53CAFED4355FE7C2F1" }, + /* 10 */ { TEST10_512, length(TEST10_512), 1, 0, 0, + "C665BEFB36DA189D78822D10528CBF3B12B3EEF726039909" + "C1A16A270D48719377966B957A878E720584779A62825C18" + "DA26415E49A7176A894E7510FD1451F5" } + }, SHA512_SEED, { "2FBB1E7E00F746BA514FBC8C421F36792EC0E11FF5EFC3" + "78E1AB0C079AA5F0F66A1E3EDBAEB4F9984BE14437123038A452004A5576" + "8C1FD8EED49E4A21BEDCD0", "25CBE5A4F2C7B1D7EF07011705D50C62C5" + "000594243EAFD1241FC9F3D22B58184AE2FEE38E171CF8129E29459C9BC2" + "EF461AF5708887315F15419D8D17FE7949", "5B8B1F2687555CE2D7182B" + "92E5C3F6C36547DA1C13DBB9EA4F73EA4CBBAF89411527906D35B1B06C1B" + "6A8007D05EC66DF0A406066829EAB618BDE3976515AAFC", "46E36B007D" + "19876CDB0B29AD074FE3C08CDD174D42169D6ABE5A1414B6E79707DF5877" + "6A98091CF431854147BB6D3C66D43BFBC108FD715BDE6AA127C2B0E79F" + } + } +}; + +/* Test arrays for HMAC. */ +struct hmachash { + const char *keyarray[5]; + int keylength[5]; + const char *dataarray[5]; + int datalength[5]; + const char *resultarray[5]; + int resultlength[5]; +} hmachashes[HMACTESTCOUNT] = { + { /* 1 */ { + "\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b" + "\x0b\x0b\x0b\x0b\x0b" + }, { 20 }, { + + + +Eastlake 3rd & Hansen Informational [Page 86] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + "\x48\x69\x20\x54\x68\x65\x72\x65" /* "Hi There" */ + }, { 8 }, { + /* HMAC-SHA-1 */ + "B617318655057264E28BC0B6FB378C8EF146BE00", + /* HMAC-SHA-224 */ + "896FB1128ABBDF196832107CD49DF33F47B4B1169912BA4F53684B22", + /* HMAC-SHA-256 */ + "B0344C61D8DB38535CA8AFCEAF0BF12B881DC200C9833DA726E9376C2E32" + "CFF7", + /* HMAC-SHA-384 */ + "AFD03944D84895626B0825F4AB46907F15F9DADBE4101EC682AA034C7CEB" + "C59CFAEA9EA9076EDE7F4AF152E8B2FA9CB6", + /* HMAC-SHA-512 */ + "87AA7CDEA5EF619D4FF0B4241A1D6CB02379F4E2CE4EC2787AD0B30545E1" + "7CDEDAA833B7D6B8A702038B274EAEA3F4E4BE9D914EEB61F1702E696C20" + "3A126854" + }, { SHA1HashSize, SHA224HashSize, SHA256HashSize, + SHA384HashSize, SHA512HashSize } + }, + { /* 2 */ { + "\x4a\x65\x66\x65" /* "Jefe" */ + }, { 4 }, { + "\x77\x68\x61\x74\x20\x64\x6f\x20\x79\x61\x20\x77\x61\x6e\x74" + "\x20\x66\x6f\x72\x20\x6e\x6f\x74\x68\x69\x6e\x67\x3f" + /* "what do ya want for nothing?" */ + }, { 28 }, { + /* HMAC-SHA-1 */ + "EFFCDF6AE5EB2FA2D27416D5F184DF9C259A7C79", + /* HMAC-SHA-224 */ + "A30E01098BC6DBBF45690F3A7E9E6D0F8BBEA2A39E6148008FD05E44", + /* HMAC-SHA-256 */ + "5BDCC146BF60754E6A042426089575C75A003F089D2739839DEC58B964EC" + "3843", + /* HMAC-SHA-384 */ + "AF45D2E376484031617F78D2B58A6B1B9C7EF464F5A01B47E42EC3736322" + "445E8E2240CA5E69E2C78B3239ECFAB21649", + /* HMAC-SHA-512 */ + "164B7A7BFCF819E2E395FBE73B56E0A387BD64222E831FD610270CD7EA25" + "05549758BF75C05A994A6D034F65F8F0E6FDCAEAB1A34D4A6B4B636E070A" + "38BCE737" + }, { SHA1HashSize, SHA224HashSize, SHA256HashSize, + SHA384HashSize, SHA512HashSize } + }, + { /* 3 */ + { + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa" + }, { 20 }, { + + + +Eastlake 3rd & Hansen Informational [Page 87] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + "\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd" + "\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd" + "\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd" + "\xdd\xdd\xdd\xdd\xdd" + }, { 50 }, { + /* HMAC-SHA-1 */ + "125D7342B9AC11CD91A39AF48AA17B4F63F175D3", + /* HMAC-SHA-224 */ + "7FB3CB3588C6C1F6FFA9694D7D6AD2649365B0C1F65D69D1EC8333EA", + /* HMAC-SHA-256 */ + "773EA91E36800E46854DB8EBD09181A72959098B3EF8C122D9635514CED5" + "65FE", + /* HMAC-SHA-384 */ + "88062608D3E6AD8A0AA2ACE014C8A86F0AA635D947AC9FEBE83EF4E55966" + "144B2A5AB39DC13814B94E3AB6E101A34F27", + /* HMAC-SHA-512 */ + "FA73B0089D56A284EFB0F0756C890BE9B1B5DBDD8EE81A3655F83E33B227" + "9D39BF3E848279A722C806B485A47E67C807B946A337BEE8942674278859" + "E13292FB" + }, { SHA1HashSize, SHA224HashSize, SHA256HashSize, + SHA384HashSize, SHA512HashSize } + }, + { /* 4 */ { + "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f" + "\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19" + }, { 25 }, { + "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd" + "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd" + "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd" + "\xcd\xcd\xcd\xcd\xcd" + }, { 50 }, { + /* HMAC-SHA-1 */ + "4C9007F4026250C6BC8414F9BF50C86C2D7235DA", + /* HMAC-SHA-224 */ + "6C11506874013CAC6A2ABC1BB382627CEC6A90D86EFC012DE7AFEC5A", + /* HMAC-SHA-256 */ + "82558A389A443C0EA4CC819899F2083A85F0FAA3E578F8077A2E3FF46729" + "665B", + /* HMAC-SHA-384 */ + "3E8A69B7783C25851933AB6290AF6CA77A9981480850009CC5577C6E1F57" + "3B4E6801DD23C4A7D679CCF8A386C674CFFB", + /* HMAC-SHA-512 */ + "B0BA465637458C6990E5A8C5F61D4AF7E576D97FF94B872DE76F8050361E" + "E3DBA91CA5C11AA25EB4D679275CC5788063A5F19741120C4F2DE2ADEBEB" + "10A298DD" + }, { SHA1HashSize, SHA224HashSize, SHA256HashSize, + SHA384HashSize, SHA512HashSize } + }, + + + +Eastlake 3rd & Hansen Informational [Page 88] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + { /* 5 */ { + "\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c" + "\x0c\x0c\x0c\x0c\x0c" + }, { 20 }, { + "Test With Truncation" + }, { 20 }, { + /* HMAC-SHA-1 */ + "4C1A03424B55E07FE7F27BE1", + /* HMAC-SHA-224 */ + "0E2AEA68A90C8D37C988BCDB9FCA6FA8", + /* HMAC-SHA-256 */ + "A3B6167473100EE06E0C796C2955552B", + /* HMAC-SHA-384 */ + "3ABF34C3503B2A23A46EFC619BAEF897", + /* HMAC-SHA-512 */ + "415FAD6271580A531D4179BC891D87A6" + }, { 12, 16, 16, 16, 16 } + }, + { /* 6 */ { + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + }, { 80, 131 }, { + "Test Using Larger Than Block-Size Key - Hash Key First" + }, { 54 }, { + /* HMAC-SHA-1 */ + "AA4AE5E15272D00E95705637CE8A3B55ED402112", + /* HMAC-SHA-224 */ + "95E9A0DB962095ADAEBE9B2D6F0DBCE2D499F112F2D2B7273FA6870E", + /* HMAC-SHA-256 */ + "60E431591EE0B67F0D8A26AACBF5B77F8E0BC6213728C5140546040F0EE3" + "7F54", + /* HMAC-SHA-384 */ + "4ECE084485813E9088D2C63A041BC5B44F9EF1012A2B588F3CD11F05033A" + "C4C60C2EF6AB4030FE8296248DF163F44952", + /* HMAC-SHA-512 */ + "80B24263C7C1A3EBB71493C1DD7BE8B49B46D1F41B4AEEC1121B013783F8" + "F3526B56D037E05F2598BD0FD2215D6A1E5295E64F73F63F0AEC8B915A98" + "5D786598" + }, { SHA1HashSize, SHA224HashSize, SHA256HashSize, + SHA384HashSize, SHA512HashSize } + }, + + + +Eastlake 3rd & Hansen Informational [Page 89] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + { /* 7 */ { + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + }, { 80, 131 }, { + "Test Using Larger Than Block-Size Key and " + "Larger Than One Block-Size Data", + "\x54\x68\x69\x73\x20\x69\x73\x20\x61\x20\x74\x65\x73\x74\x20" + "\x75\x73\x69\x6e\x67\x20\x61\x20\x6c\x61\x72\x67\x65\x72\x20" + "\x74\x68\x61\x6e\x20\x62\x6c\x6f\x63\x6b\x2d\x73\x69\x7a\x65" + "\x20\x6b\x65\x79\x20\x61\x6e\x64\x20\x61\x20\x6c\x61\x72\x67" + "\x65\x72\x20\x74\x68\x61\x6e\x20\x62\x6c\x6f\x63\x6b\x2d\x73" + "\x69\x7a\x65\x20\x64\x61\x74\x61\x2e\x20\x54\x68\x65\x20\x6b" + "\x65\x79\x20\x6e\x65\x65\x64\x73\x20\x74\x6f\x20\x62\x65\x20" + "\x68\x61\x73\x68\x65\x64\x20\x62\x65\x66\x6f\x72\x65\x20\x62" + "\x65\x69\x6e\x67\x20\x75\x73\x65\x64\x20\x62\x79\x20\x74\x68" + "\x65\x20\x48\x4d\x41\x43\x20\x61\x6c\x67\x6f\x72\x69\x74\x68" + "\x6d\x2e" + /* "This is a test using a larger than block-size key and a " + "larger than block-size data. The key needs to be hashed " + "before being used by the HMAC algorithm." */ + }, { 73, 152 }, { + /* HMAC-SHA-1 */ + "E8E99D0F45237D786D6BBAA7965C7808BBFF1A91", + /* HMAC-SHA-224 */ + "3A854166AC5D9F023F54D517D0B39DBD946770DB9C2B95C9F6F565D1", + /* HMAC-SHA-256 */ + "9B09FFA71B942FCB27635FBCD5B0E944BFDC63644F0713938A7F51535C3A" + "35E2", + /* HMAC-SHA-384 */ + "6617178E941F020D351E2F254E8FD32C602420FEB0B8FB9ADCCEBB82461E" + "99C5A678CC31E799176D3860E6110C46523E", + /* HMAC-SHA-512 */ + "E37B6A775DC87DBAA4DFA9F96E5E3FFDDEBD71F8867289865DF5A32D20CD" + "C944B6022CAC3C4982B10D5EEB55C3E4DE15134676FB6DE0446065C97440" + "FA8C6A58" + }, { SHA1HashSize, SHA224HashSize, SHA256HashSize, + SHA384HashSize, SHA512HashSize } + } +}; + +/* + + + +Eastlake 3rd & Hansen Informational [Page 90] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * Check the hash value against the expected string, expressed in hex + */ +static const char hexdigits[] = "0123456789ABCDEF"; +int checkmatch(const unsigned char *hashvalue, + const char *hexstr, int hashsize) +{ + int i; + for (i = 0; i < hashsize; ++i) { + if (*hexstr++ != hexdigits[(hashvalue[i] >> 4) & 0xF]) + return 0; + if (*hexstr++ != hexdigits[hashvalue[i] & 0xF]) return 0; + } + return 1; +} + +/* + * Print the string, converting non-printable characters to "." + */ +void printstr(const char *str, int len) +{ + for ( ; len-- > 0; str++) + putchar(isprint((unsigned char)*str) ? *str : '.'); +} + +/* + * Print the string, converting non-printable characters to hex "## ". + */ +void printxstr(const char *str, int len) +{ + for ( ; len-- > 0; str++) + printf("%c%c ", hexdigits[(*str >> 4) & 0xF], + hexdigits[*str & 0xF]); +} + +/* + * Print a usage message. + */ +void usage(const char *argv0) +{ + fprintf(stderr, + "Usage:\n" + "Common options: [-h hash] [-w|-x] [-H]\n" + "Standard tests:\n" + "\t%s [-m] [-l loopcount] [-t test#] [-e]\n" + "\t\t[-r randomseed] [-R randomloop-count] " + "[-p] [-P|-X]\n" + "Hash a string:\n" + "\t%s [-S expectedresult] -s hashstr [-k key]\n" + + + +Eastlake 3rd & Hansen Informational [Page 91] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + "Hash a file:\n" + "\t%s [-S expectedresult] -f file [-k key]\n" + "Hash a file, ignoring whitespace:\n" + "\t%s [-S expectedresult] -F file [-k key]\n" + "Additional bits to add in: [-B bitcount -b bits]\n" + "-h\thash to test: " + "0|SHA1, 1|SHA224, 2|SHA256, 3|SHA384, 4|SHA512\n" + "-m\tperform hmac test\n" + "-k\tkey for hmac test\n" + "-t\ttest case to run, 1-10\n" + "-l\thow many times to run the test\n" + "-e\ttest error returns\n" + "-p\tdo not print results\n" + "-P\tdo not print PASSED/FAILED\n" + "-X\tprint FAILED, but not PASSED\n" + "-r\tseed for random test\n" + "-R\thow many times to run random test\n" + "-s\tstring to hash\n" + "-S\texpected result of hashed string, in hex\n" + "-w\toutput hash in raw format\n" + "-x\toutput hash in hex format\n" + "-B\t# extra bits to add in after string or file input\n" + "-b\textra bits to add (high order bits of #, 0# or 0x#)\n" + "-H\tinput hashstr or randomseed is in hex\n" + , argv0, argv0, argv0, argv0); + exit(1); +} + +/* + * Print the results and PASS/FAIL. + */ +void printResult(uint8_t *Message_Digest, int hashsize, + const char *hashname, const char *testtype, const char *testname, + const char *resultarray, int printResults, int printPassFail) +{ + int i, k; + if (printResults == PRINTTEXT) { + putchar('\t'); + for (i = 0; i < hashsize ; ++i) { + putchar(hexdigits[(Message_Digest[i] >> 4) & 0xF]); + putchar(hexdigits[Message_Digest[i] & 0xF]); + putchar(' '); + } + putchar('\n'); + } else if (printResults == PRINTRAW) { + fwrite(Message_Digest, 1, hashsize, stdout); + } else if (printResults == PRINTHEX) { + for (i = 0; i < hashsize ; ++i) { + + + +Eastlake 3rd & Hansen Informational [Page 92] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + putchar(hexdigits[(Message_Digest[i] >> 4) & 0xF]); + putchar(hexdigits[Message_Digest[i] & 0xF]); + } + putchar('\n'); + } + + if (printResults && resultarray) { + printf(" Should match:\n\t"); + for (i = 0, k = 0; i < hashsize; i++, k += 2) { + putchar(resultarray[k]); + putchar(resultarray[k+1]); + putchar(' '); + } + putchar('\n'); + } + + if (printPassFail && resultarray) { + int ret = checkmatch(Message_Digest, resultarray, hashsize); + if ((printPassFail == PRINTPASSFAIL) || !ret) + printf("%s %s %s: %s\n", hashname, testtype, testname, + ret ? "PASSED" : "FAILED"); + } +} + +/* + * Exercise a hash series of functions. The input is the testarray, + * repeated repeatcount times, followed by the extrabits. If the + * result is known, it is in resultarray in uppercase hex. + */ +int hash(int testno, int loopno, int hashno, + const char *testarray, int length, long repeatcount, + int numberExtrabits, int extrabits, const unsigned char *keyarray, + int keylen, const char *resultarray, int hashsize, int printResults, + int printPassFail) +{ + USHAContext sha; + HMACContext hmac; + int err, i; + uint8_t Message_Digest[USHAMaxHashSize]; + char buf[20]; + + if (printResults == PRINTTEXT) { + printf("\nTest %d: Iteration %d, Repeat %ld\n\t'", testno+1, + loopno, repeatcount); + printstr(testarray, length); + printf("'\n\t'"); + printxstr(testarray, length); + printf("'\n"); + + + +Eastlake 3rd & Hansen Informational [Page 93] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + printf(" Length=%d bytes (%d bits), ", length, length * 8); + printf("ExtraBits %d: %2.2x\n", numberExtrabits, extrabits); + } + + memset(&sha, '\343', sizeof(sha)); /* force bad data into struct */ + memset(&hmac, '\343', sizeof(hmac)); + err = keyarray ? hmacReset(&hmac, hashes[hashno].whichSha, + keyarray, keylen) : + USHAReset(&sha, hashes[hashno].whichSha); + if (err != shaSuccess) { + fprintf(stderr, "hash(): %sReset Error %d.\n", + keyarray ? "hmac" : "sha", err); + return err; + } + + for (i = 0; i < repeatcount; ++i) { + err = keyarray ? hmacInput(&hmac, (const uint8_t *) testarray, + length) : + USHAInput(&sha, (const uint8_t *) testarray, + length); + if (err != shaSuccess) { + fprintf(stderr, "hash(): %sInput Error %d.\n", + keyarray ? "hmac" : "sha", err); + return err; + } + } + + if (numberExtrabits > 0) { + err = keyarray ? hmacFinalBits(&hmac, (uint8_t) extrabits, + numberExtrabits) : + USHAFinalBits(&sha, (uint8_t) extrabits, + numberExtrabits); + if (err != shaSuccess) { + fprintf(stderr, "hash(): %sFinalBits Error %d.\n", + keyarray ? "hmac" : "sha", err); + return err; + } + } + + err = keyarray ? hmacResult(&hmac, Message_Digest) : + USHAResult(&sha, Message_Digest); + if (err != shaSuccess) { + fprintf(stderr, "hash(): %s Result Error %d, could not " + "compute message digest.\n", keyarray ? "hmac" : "sha", err); + return err; + } + + sprintf(buf, "%d", testno+1); + + + +Eastlake 3rd & Hansen Informational [Page 94] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + printResult(Message_Digest, hashsize, hashes[hashno].name, + keyarray ? "hmac standard test" : "sha standard test", buf, + resultarray, printResults, printPassFail); + + return err; +} + +/* + * Exercise a hash series of functions. The input is a filename. + * If the result is known, it is in resultarray in uppercase hex. + */ +int hashfile(int hashno, const char *hashfilename, int bits, + int bitcount, int skipSpaces, const unsigned char *keyarray, + int keylen, const char *resultarray, int hashsize, + int printResults, int printPassFail) +{ + USHAContext sha; + HMACContext hmac; + int err, nread, c; + unsigned char buf[4096]; + uint8_t Message_Digest[USHAMaxHashSize]; + unsigned char cc; + FILE *hashfp = (strcmp(hashfilename, "-") == 0) ? stdin : + fopen(hashfilename, "r"); + + if (!hashfp) { + fprintf(stderr, "cannot open file '%s'\n", hashfilename); + return shaStateError; + } + + memset(&sha, '\343', sizeof(sha)); /* force bad data into struct */ + memset(&hmac, '\343', sizeof(hmac)); + err = keyarray ? hmacReset(&hmac, hashes[hashno].whichSha, + keyarray, keylen) : + USHAReset(&sha, hashes[hashno].whichSha); + + if (err != shaSuccess) { + fprintf(stderr, "hashfile(): %sReset Error %d.\n", + keyarray ? "hmac" : "sha", err); + return err; + } + + if (skipSpaces) + while ((c = getc(hashfp)) != EOF) { + if (!isspace(c)) { + cc = (unsigned char)c; + err = keyarray ? hmacInput(&hmac, &cc, 1) : + USHAInput(&sha, &cc, 1); + + + +Eastlake 3rd & Hansen Informational [Page 95] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + if (err != shaSuccess) { + fprintf(stderr, "hashfile(): %sInput Error %d.\n", + keyarray ? "hmac" : "sha", err); + if (hashfp != stdin) fclose(hashfp); + return err; + } + } + } + else + while ((nread = fread(buf, 1, sizeof(buf), hashfp)) > 0) { + err = keyarray ? hmacInput(&hmac, buf, nread) : + USHAInput(&sha, buf, nread); + if (err != shaSuccess) { + fprintf(stderr, "hashfile(): %s Error %d.\n", + keyarray ? "hmacInput" : "shaInput", err); + if (hashfp != stdin) fclose(hashfp); + return err; + } + } + + if (bitcount > 0) + err = keyarray ? hmacFinalBits(&hmac, bits, bitcount) : + USHAFinalBits(&sha, bits, bitcount); + if (err != shaSuccess) { + fprintf(stderr, "hashfile(): %s Error %d.\n", + keyarray ? "hmacResult" : "shaResult", err); + if (hashfp != stdin) fclose(hashfp); + return err; + } + + err = keyarray ? hmacResult(&hmac, Message_Digest) : + USHAResult(&sha, Message_Digest); + if (err != shaSuccess) { + fprintf(stderr, "hashfile(): %s Error %d.\n", + keyarray ? "hmacResult" : "shaResult", err); + if (hashfp != stdin) fclose(hashfp); + return err; + } + + printResult(Message_Digest, hashsize, hashes[hashno].name, "file", + hashfilename, resultarray, printResults, printPassFail); + + if (hashfp != stdin) fclose(hashfp); + return err; +} + +/* + * Exercise a hash series of functions through multiple permutations. + + + +Eastlake 3rd & Hansen Informational [Page 96] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * The input is an initial seed. That seed is replicated 3 times. + * For 1000 rounds, the previous three results are used as the input. + * This result is then checked, and used to seed the next cycle. + * If the result is known, it is in resultarrays in uppercase hex. + */ +void randomtest(int hashno, const char *seed, int hashsize, + const char **resultarrays, int randomcount, + int printResults, int printPassFail) +{ + int i, j; char buf[20]; + unsigned char SEED[USHAMaxHashSize], MD[1003][USHAMaxHashSize]; + + /* INPUT: Seed - A random seed n bits long */ + memcpy(SEED, seed, hashsize); + if (printResults == PRINTTEXT) { + printf("%s random test seed= '", hashes[hashno].name); + printxstr(seed, hashsize); + printf("'\n"); + } + + for (j = 0; j < randomcount; j++) { + /* MD0 = MD1 = MD2 = Seed; */ + memcpy(MD[0], SEED, hashsize); + memcpy(MD[1], SEED, hashsize); + memcpy(MD[2], SEED, hashsize); + for (i=3; i<1003; i++) { + /* Mi = MDi-3 || MDi-2 || MDi-1; */ + USHAContext Mi; + memset(&Mi, '\343', sizeof(Mi)); /* force bad data into struct */ + USHAReset(&Mi, hashes[hashno].whichSha); + USHAInput(&Mi, MD[i-3], hashsize); + USHAInput(&Mi, MD[i-2], hashsize); + USHAInput(&Mi, MD[i-1], hashsize); + /* MDi = SHA(Mi); */ + USHAResult(&Mi, MD[i]); + } + + /* MDj = Seed = MDi; */ + memcpy(SEED, MD[i-1], hashsize); + + /* OUTPUT: MDj */ + sprintf(buf, "%d", j); + printResult(SEED, hashsize, hashes[hashno].name, "random test", + buf, resultarrays ? resultarrays[j] : 0, printResults, + (j < RANDOMCOUNT) ? printPassFail : 0); + } +} + + + + +Eastlake 3rd & Hansen Informational [Page 97] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +/* + * Look up a hash name. + */ +int findhash(const char *argv0, const char *opt) +{ + int i; + const char *names[HASHCOUNT][2] = { + { "0", "sha1" }, { "1", "sha224" }, { "2", "sha256" }, + { "3", "sha384" }, { "4", "sha512" } + }; + + for (i = 0; i < HASHCOUNT; i++) + if ((strcmp(opt, names[i][0]) == 0) || + (scasecmp(opt, names[i][1]) == 0)) + return i; + + fprintf(stderr, "%s: Unknown hash name: '%s'\n", argv0, opt); + usage(argv0); + return 0; +} + +/* + * Run some tests that should invoke errors. + */ +void testErrors(int hashnolow, int hashnohigh, int printResults, + int printPassFail) +{ + USHAContext usha; + uint8_t Message_Digest[USHAMaxHashSize]; + int hashno, err; + + for (hashno = hashnolow; hashno <= hashnohigh; hashno++) { + memset(&usha, '\343', sizeof(usha)); /* force bad data */ + USHAReset(&usha, hashno); + USHAResult(&usha, Message_Digest); + err = USHAInput(&usha, (const unsigned char *)"foo", 3); + if (printResults == PRINTTEXT) + printf ("\nError %d. Should be %d.\n", err, shaStateError); + if ((printPassFail == PRINTPASSFAIL) || + ((printPassFail == PRINTFAIL) && (err != shaStateError))) + printf("%s se: %s\n", hashes[hashno].name, + (err == shaStateError) ? "PASSED" : "FAILED"); + + err = USHAFinalBits(&usha, 0x80, 3); + if (printResults == PRINTTEXT) + printf ("\nError %d. Should be %d.\n", err, shaStateError); + if ((printPassFail == PRINTPASSFAIL) || + ((printPassFail == PRINTFAIL) && (err != shaStateError))) + + + +Eastlake 3rd & Hansen Informational [Page 98] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + printf("%s se: %s\n", hashes[hashno].name, + (err == shaStateError) ? "PASSED" : "FAILED"); + + err = USHAReset(0, hashes[hashno].whichSha); + if (printResults == PRINTTEXT) + printf("\nError %d. Should be %d.\n", err, shaNull); + if ((printPassFail == PRINTPASSFAIL) || + ((printPassFail == PRINTFAIL) && (err != shaNull))) + printf("%s usha null: %s\n", hashes[hashno].name, + (err == shaNull) ? "PASSED" : "FAILED"); + + switch (hashno) { + case SHA1: err = SHA1Reset(0); break; + case SHA224: err = SHA224Reset(0); break; + case SHA256: err = SHA256Reset(0); break; + case SHA384: err = SHA384Reset(0); break; + case SHA512: err = SHA512Reset(0); break; + } + if (printResults == PRINTTEXT) + printf("\nError %d. Should be %d.\n", err, shaNull); + if ((printPassFail == PRINTPASSFAIL) || + ((printPassFail == PRINTFAIL) && (err != shaNull))) + printf("%s sha null: %s\n", hashes[hashno].name, + (err == shaNull) ? "PASSED" : "FAILED"); + } +} + +/* replace a hex string in place with its value */ +int unhexStr(char *hexstr) +{ + char *o = hexstr; + int len = 0, nibble1 = 0, nibble2 = 0; + if (!hexstr) return 0; + for ( ; *hexstr; hexstr++) { + if (isalpha((int)(unsigned char)(*hexstr))) { + nibble1 = tolower(*hexstr) - 'a' + 10; + } else if (isdigit((int)(unsigned char)(*hexstr))) { + nibble1 = *hexstr - '0'; + } else { + printf("\nError: bad hex character '%c'\n", *hexstr); + } + if (!*++hexstr) break; + if (isalpha((int)(unsigned char)(*hexstr))) { + nibble2 = tolower(*hexstr) - 'a' + 10; + } else if (isdigit((int)(unsigned char)(*hexstr))) { + nibble2 = *hexstr - '0'; + } else { + printf("\nError: bad hex character '%c'\n", *hexstr); + + + +Eastlake 3rd & Hansen Informational [Page 99] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + } + *o++ = (char)((nibble1 << 4) | nibble2); + len++; + } + return len; +} + +int main(int argc, char **argv) +{ + int i, err; + int loopno, loopnohigh = 1; + int hashno, hashnolow = 0, hashnohigh = HASHCOUNT - 1; + int testno, testnolow = 0, testnohigh; + int ntestnohigh = 0; + int printResults = PRINTTEXT; + int printPassFail = 1; + int checkErrors = 0; + char *hashstr = 0; + int hashlen = 0; + const char *resultstr = 0; + char *randomseedstr = 0; + int runHmacTests = 0; + char *hmacKey = 0; + int hmaclen = 0; + int randomcount = RANDOMCOUNT; + const char *hashfilename = 0; + const char *hashFilename = 0; + int extrabits = 0, numberExtrabits = 0; + int strIsHex = 0; + + while ((i = xgetopt(argc, argv, "b:B:ef:F:h:Hk:l:mpPr:R:s:S:t:wxX")) + != -1) + switch (i) { + case 'b': extrabits = strtol(xoptarg, 0, 0); break; + case 'B': numberExtrabits = atoi(xoptarg); break; + case 'e': checkErrors = 1; break; + case 'f': hashfilename = xoptarg; break; + case 'F': hashFilename = xoptarg; break; + case 'h': hashnolow = hashnohigh = findhash(argv[0], xoptarg); + break; + case 'H': strIsHex = 1; break; + case 'k': hmacKey = xoptarg; hmaclen = strlen(xoptarg); break; + case 'l': loopnohigh = atoi(xoptarg); break; + case 'm': runHmacTests = 1; break; + case 'P': printPassFail = 0; break; + case 'p': printResults = PRINTNONE; break; + case 'R': randomcount = atoi(xoptarg); break; + case 'r': randomseedstr = xoptarg; break; + + + +Eastlake 3rd & Hansen Informational [Page 100] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + case 's': hashstr = xoptarg; hashlen = strlen(hashstr); break; + case 'S': resultstr = xoptarg; break; + case 't': testnolow = ntestnohigh = atoi(xoptarg) - 1; break; + case 'w': printResults = PRINTRAW; break; + case 'x': printResults = PRINTHEX; break; + case 'X': printPassFail = 2; break; + default: usage(argv[0]); + } + + if (strIsHex) { + hashlen = unhexStr(hashstr); + unhexStr(randomseedstr); + hmaclen = unhexStr(hmacKey); + } + testnohigh = (ntestnohigh != 0) ? ntestnohigh: + runHmacTests ? (HMACTESTCOUNT-1) : (TESTCOUNT-1); + if ((testnolow < 0) || + (testnohigh >= (runHmacTests ? HMACTESTCOUNT : TESTCOUNT)) || + (hashnolow < 0) || (hashnohigh >= HASHCOUNT) || + (hashstr && (testnolow == testnohigh)) || + (randomcount < 0) || + (resultstr && (!hashstr && !hashfilename && !hashFilename)) || + ((runHmacTests || hmacKey) && randomseedstr) || + (hashfilename && hashFilename)) + usage(argv[0]); + + /* + * Perform SHA/HMAC tests + */ + for (hashno = hashnolow; hashno <= hashnohigh; ++hashno) { + if (printResults == PRINTTEXT) + printf("Hash %s\n", hashes[hashno].name); + err = shaSuccess; + + for (loopno = 1; (loopno <= loopnohigh) && (err == shaSuccess); + ++loopno) { + if (hashstr) + err = hash(0, loopno, hashno, hashstr, hashlen, 1, + numberExtrabits, extrabits, (const unsigned char *)hmacKey, + hmaclen, resultstr, hashes[hashno].hashsize, printResults, + printPassFail); + + else if (randomseedstr) + randomtest(hashno, randomseedstr, hashes[hashno].hashsize, 0, + randomcount, printResults, printPassFail); + + else if (hashfilename) + err = hashfile(hashno, hashfilename, extrabits, + + + +Eastlake 3rd & Hansen Informational [Page 101] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + numberExtrabits, 0, + (const unsigned char *)hmacKey, hmaclen, + resultstr, hashes[hashno].hashsize, + printResults, printPassFail); + + else if (hashFilename) + err = hashfile(hashno, hashFilename, extrabits, + numberExtrabits, 1, + (const unsigned char *)hmacKey, hmaclen, + resultstr, hashes[hashno].hashsize, + printResults, printPassFail); + + else /* standard tests */ { + for (testno = testnolow; + (testno <= testnohigh) && (err == shaSuccess); ++testno) { + if (runHmacTests) { + err = hash(testno, loopno, hashno, + hmachashes[testno].dataarray[hashno] ? + hmachashes[testno].dataarray[hashno] : + hmachashes[testno].dataarray[1] ? + hmachashes[testno].dataarray[1] : + hmachashes[testno].dataarray[0], + hmachashes[testno].datalength[hashno] ? + hmachashes[testno].datalength[hashno] : + hmachashes[testno].datalength[1] ? + hmachashes[testno].datalength[1] : + hmachashes[testno].datalength[0], + 1, 0, 0, + (const unsigned char *)( + hmachashes[testno].keyarray[hashno] ? + hmachashes[testno].keyarray[hashno] : + hmachashes[testno].keyarray[1] ? + hmachashes[testno].keyarray[1] : + hmachashes[testno].keyarray[0]), + hmachashes[testno].keylength[hashno] ? + hmachashes[testno].keylength[hashno] : + hmachashes[testno].keylength[1] ? + hmachashes[testno].keylength[1] : + hmachashes[testno].keylength[0], + hmachashes[testno].resultarray[hashno], + hmachashes[testno].resultlength[hashno], + printResults, printPassFail); + } else { + err = hash(testno, loopno, hashno, + hashes[hashno].tests[testno].testarray, + hashes[hashno].tests[testno].length, + hashes[hashno].tests[testno].repeatcount, + hashes[hashno].tests[testno].numberExtrabits, + + + +Eastlake 3rd & Hansen Informational [Page 102] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + hashes[hashno].tests[testno].extrabits, 0, 0, + hashes[hashno].tests[testno].resultarray, + hashes[hashno].hashsize, + printResults, printPassFail); + } + } + + if (!runHmacTests) { + randomtest(hashno, hashes[hashno].randomtest, + hashes[hashno].hashsize, hashes[hashno].randomresults, + RANDOMCOUNT, printResults, printPassFail); + } + } + } + } + + /* Test some error returns */ + if (checkErrors) { + testErrors(hashnolow, hashnohigh, printResults, printPassFail); + } + + return 0; +} + +/* + * Compare two strings, case independently. + * Equivalent to strcasecmp() found on some systems. + */ +int scasecmp(const char *s1, const char *s2) +{ + for (;;) { + char u1 = tolower(*s1++); + char u2 = tolower(*s2++); + if (u1 != u2) + return u1 - u2; + if (u1 == '\0') + return 0; + } +} + +/* + * This is a copy of getopt provided for those systems that do not + * have it. The name was changed to xgetopt to not conflict on those + * systems that do have it. Similarly, optarg, optind and opterr + * were renamed to xoptarg, xoptind and xopterr. + * + * Copyright 1990, 1991, 1992 by the Massachusetts Institute of + * Technology and UniSoft Group Limited. + + + +Eastlake 3rd & Hansen Informational [Page 103] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * + * Permission to use, copy, modify, distribute, and sell this software + * and its documentation for any purpose is hereby granted without fee, + * provided that the above copyright notice appear in all copies and + * that both that copyright notice and this permission notice appear in + * supporting documentation, and that the names of MIT and UniSoft not + * be used in advertising or publicity pertaining to distribution of + * the software without specific, written prior permission. MIT and + * UniSoft make no representations about the suitability of this + * software for any purpose. It is provided "as is" without express + * or implied warranty. + * + * $XConsortium: getopt.c,v 1.2 92/07/01 11:59:04 rws Exp $ + * NB: Reformatted to match above style. + */ + +char *xoptarg; +int xoptind = 1; +int xopterr = 1; + +static int xgetopt(int argc, char **argv, const char *optstring) +{ + static int avplace; + char *ap; + char *cp; + int c; + + if (xoptind >= argc) + return EOF; + + ap = argv[xoptind] + avplace; + + /* At beginning of arg but not an option */ + if (avplace == 0) { + if (ap[0] != '-') + return EOF; + else if (ap[1] == '-') { + /* Special end of options option */ + xoptind++; + return EOF; + } else if (ap[1] == '\0') + return EOF; /* single '-' is not allowed */ + } + + /* Get next letter */ + avplace++; + c = *++ap; + + + + +Eastlake 3rd & Hansen Informational [Page 104] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + cp = strchr(optstring, c); + if (cp == NULL || c == ':') { + if (xopterr) + fprintf(stderr, "Unrecognised option -- %c\n", c); + return '?'; + } + + if (cp[1] == ':') { + /* There should be an option arg */ + avplace = 0; + if (ap[1] == '\0') { + /* It is a separate arg */ + if (++xoptind >= argc) { + if (xopterr) + fprintf(stderr, "Option requires an argument\n"); + return '?'; + } + xoptarg = argv[xoptind++]; + } else { + /* is attached to option letter */ + xoptarg = ap + 1; + ++xoptind; + } + } else { + /* If we are out of letters then go to next arg */ + if (ap[1] == '\0') { + ++xoptind; + avplace = 0; + } + + xoptarg = NULL; + } + return c; +} + + + + + + + + + + + + + + + + + +Eastlake 3rd & Hansen Informational [Page 105] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +9. Security Considerations + + This document is intended to provides the Internet community + convenient access to source code that implements the United States of + America Federal Information Processing Standard Secure Hash + Algorithms (SHAs) [FIPS180-2] and HMACs based upon these one-way hash + functions. See license in Section 1.1. No independent assertion of + the security of this hash function by the authors for any particular + use is intended. + +10. Normative References + + [FIPS180-2] "Secure Hash Standard", United States of America, + National Institute of Standards and Technology, Federal + Information Processing Standard (FIPS) 180-2, + http://csrc.nist.gov/publications/fips/fips180-2/ + fips180-2withchangenotice.pdf. + + [RFC2104] Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed- + Hashing for Message Authentication", RFC 2104, February + 1997. + +11. Informative References + + [RFC2202] Cheng, P. and R. Glenn, "Test Cases for HMAC-MD5 and + HMAC-SHA-1", RFC 2202, September 1997. + + [RFC3174] Eastlake 3rd, D. and P. Jones, "US Secure Hash Algorithm + 1 (SHA1)", RFC 3174, September 2001. + + [RFC3874] Housley, R., "A 224-bit One-way Hash Function: SHA-224", + RFC 3874, September 2004. + + [RFC4086] Eastlake, D., 3rd, Schiller, J., and S. Crocker, + "Randomness Requirements for Security", BCP 106, RFC + 4086, June 2005. + + [RFC4231] Nystrom, M., "Identifiers and Test Vectors for HMAC-SHA- + 224, HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512", RFC + 4231, December 2005. + + [SHAVS] "The Secure Hash Algorithm Validation System (SHAVS)", + http://csrc.nist.gov/cryptval/shs/SHAVS.pdf. + + + + + + + + +Eastlake 3rd & Hansen Informational [Page 106] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +Authors' Addresses + + Donald E. Eastlake, 3rd + Motorola Laboratories + 155 Beaver Street + Milford, MA 01757 USA + + Phone: +1-508-786-7554 (w) + EMail: donald.eastlake@motorola.com + + + Tony Hansen + AT&T Laboratories + 200 Laurel Ave. + Middletown, NJ 07748 USA + + Phone: +1-732-420-8934 (w) + EMail: tony+shs@maillennium.att.com + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +Eastlake 3rd & Hansen Informational [Page 107] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +Full Copyright Statement + + Copyright (C) The Internet Society (2006). + + This document is subject to the rights, licenses and restrictions + contained in BCP 78, and except as set forth therein, the authors + retain all their rights. + + This document and the information contained herein are provided on an + "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS + OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET + ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, + INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE + INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED + WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. + +Intellectual Property + + The IETF takes no position regarding the validity or scope of any + Intellectual Property Rights or other rights that might be claimed to + pertain to the implementation or use of the technology described in + this document or the extent to which any license under such rights + might or might not be available; nor does it represent that it has + made any independent effort to identify any such rights. Information + on the procedures with respect to rights in RFC documents can be + found in BCP 78 and BCP 79. + + Copies of IPR disclosures made to the IETF Secretariat and any + assurances of licenses to be made available, or the result of an + attempt made to obtain a general license or permission for the use of + such proprietary rights by implementers or users of this + specification can be obtained from the IETF on-line IPR repository at + http://www.ietf.org/ipr. + + The IETF invites any interested party to bring to its attention any + copyrights, patents or patent applications, or other proprietary + rights that may cover technology that may be required to implement + this standard. Please address the information to the IETF at + ietf-ipr@ietf.org. + +Acknowledgement + + Funding for the RFC Editor function is provided by the IETF + Administrative Support Activity (IASA). + + + + + + + +Eastlake 3rd & Hansen Informational [Page 108] + diff --git a/doc/rfc/rfc4641.txt b/doc/rfc/rfc4641.txt new file mode 100644 index 00000000..0a013bcb --- /dev/null +++ b/doc/rfc/rfc4641.txt @@ -0,0 +1,1963 @@ + + + + + + +Network Working Group O. Kolkman +Request for Comments: 4641 R. Gieben +Obsoletes: 2541 NLnet Labs +Category: Informational September 2006 + + + DNSSEC Operational Practices + +Status of This Memo + + This memo provides information for the Internet community. It does + not specify an Internet standard of any kind. Distribution of this + memo is unlimited. + +Copyright Notice + + Copyright (C) The Internet Society (2006). + +Abstract + + This document describes a set of practices for operating the DNS with + security extensions (DNSSEC). The target audience is zone + administrators deploying DNSSEC. + + The document discusses operational aspects of using keys and + signatures in the DNS. It discusses issues of key generation, key + storage, signature generation, key rollover, and related policies. + + This document obsoletes RFC 2541, as it covers more operational + ground and gives more up-to-date requirements with respect to key + sizes and the new DNSSEC specification. + + + + + + + + + + + + + + + + + + + + +Kolkman & Gieben Informational [Page 1] + +RFC 4641 DNSSEC Operational Practices September 2006 + + +Table of Contents + + 1. Introduction ....................................................3 + 1.1. The Use of the Term 'key' ..................................4 + 1.2. Time Definitions ...........................................4 + 2. Keeping the Chain of Trust Intact ...............................5 + 3. Keys Generation and Storage .....................................6 + 3.1. Zone and Key Signing Keys ..................................6 + 3.1.1. Motivations for the KSK and ZSK Separation ..........6 + 3.1.2. KSKs for High-Level Zones ...........................7 + 3.2. Key Generation .............................................8 + 3.3. Key Effectivity Period .....................................8 + 3.4. Key Algorithm ..............................................9 + 3.5. Key Sizes ..................................................9 + 3.6. Private Key Storage .......................................11 + 4. Signature Generation, Key Rollover, and Related Policies .......12 + 4.1. Time in DNSSEC ............................................12 + 4.1.1. Time Considerations ................................12 + 4.2. Key Rollovers .............................................14 + 4.2.1. Zone Signing Key Rollovers .........................14 + 4.2.1.1. Pre-Publish Key Rollover ..................15 + 4.2.1.2. Double Signature Zone Signing Key + Rollover ..................................17 + 4.2.1.3. Pros and Cons of the Schemes ..............18 + 4.2.2. Key Signing Key Rollovers ..........................18 + 4.2.3. Difference Between ZSK and KSK Rollovers ...........20 + 4.2.4. Automated Key Rollovers ............................21 + 4.3. Planning for Emergency Key Rollover .......................21 + 4.3.1. KSK Compromise .....................................22 + 4.3.1.1. Keeping the Chain of Trust Intact .........22 + 4.3.1.2. Breaking the Chain of Trust ...............23 + 4.3.2. ZSK Compromise .....................................23 + 4.3.3. Compromises of Keys Anchored in Resolvers ..........24 + 4.4. Parental Policies .........................................24 + 4.4.1. Initial Key Exchanges and Parental Policies + Considerations .....................................24 + 4.4.2. Storing Keys or Hashes? ............................25 + 4.4.3. Security Lameness ..................................25 + 4.4.4. DS Signature Validity Period .......................26 + 5. Security Considerations ........................................26 + 6. Acknowledgments ................................................26 + 7. References .....................................................27 + 7.1. Normative References ......................................27 + 7.2. Informative References ....................................28 + Appendix A. Terminology ...........................................30 + Appendix B. Zone Signing Key Rollover How-To ......................31 + Appendix C. Typographic Conventions ...............................32 + + + + +Kolkman & Gieben Informational [Page 2] + +RFC 4641 DNSSEC Operational Practices September 2006 + + +1. Introduction + + This document describes how to run a DNS Security (DNSSEC)-enabled + environment. It is intended for operators who have knowledge of the + DNS (see RFC 1034 [1] and RFC 1035 [2]) and want to deploy DNSSEC. + See RFC 4033 [4] for an introduction to DNSSEC, RFC 4034 [5] for the + newly introduced Resource Records (RRs), and RFC 4035 [6] for the + protocol changes. + + During workshops and early operational deployment tests, operators + and system administrators have gained experience about operating the + DNS with security extensions (DNSSEC). This document translates + these experiences into a set of practices for zone administrators. + At the time of writing, there exists very little experience with + DNSSEC in production environments; this document should therefore + explicitly not be seen as representing 'Best Current Practices'. + + The procedures herein are focused on the maintenance of signed zones + (i.e., signing and publishing zones on authoritative servers). It is + intended that maintenance of zones such as re-signing or key + rollovers be transparent to any verifying clients on the Internet. + + The structure of this document is as follows. In Section 2, we + discuss the importance of keeping the "chain of trust" intact. + Aspects of key generation and storage of private keys are discussed + in Section 3; the focus in this section is mainly on the private part + of the key(s). Section 4 describes considerations concerning the + public part of the keys. Since these public keys appear in the DNS + one has to take into account all kinds of timing issues, which are + discussed in Section 4.1. Section 4.2 and Section 4.3 deal with the + rollover, or supercession, of keys. Finally, Section 4.4 discusses + considerations on how parents deal with their children's public keys + in order to maintain chains of trust. + + The typographic conventions used in this document are explained in + Appendix C. + + Since this is a document with operational suggestions and there are + no protocol specifications, the RFC 2119 [7] language does not apply. + + This document obsoletes RFC 2541 [12] to reflect the evolution of the + underlying DNSSEC protocol since then. Changes in the choice of + cryptographic algorithms, DNS record types and type names, and the + parent-child key and signature exchange demanded a major rewrite and + additional information and explanation. + + + + + + +Kolkman & Gieben Informational [Page 3] + +RFC 4641 DNSSEC Operational Practices September 2006 + + +1.1. The Use of the Term 'key' + + It is assumed that the reader is familiar with the concept of + asymmetric keys on which DNSSEC is based (public key cryptography + [17]). Therefore, this document will use the term 'key' rather + loosely. Where it is written that 'a key is used to sign data' it is + assumed that the reader understands that it is the private part of + the key pair that is used for signing. It is also assumed that the + reader understands that the public part of the key pair is published + in the DNSKEY Resource Record and that it is the public part that is + used in key exchanges. + +1.2. Time Definitions + + In this document, we will be using a number of time-related terms. + The following definitions apply: + + o "Signature validity period" The period that a signature is valid. + It starts at the time specified in the signature inception field + of the RRSIG RR and ends at the time specified in the expiration + field of the RRSIG RR. + + o "Signature publication period" Time after which a signature (made + with a specific key) is replaced with a new signature (made with + the same key). This replacement takes place by publishing the + relevant RRSIG in the master zone file. After one stops + publishing an RRSIG in a zone, it may take a while before the + RRSIG has expired from caches and has actually been removed from + the DNS. + + o "Key effectivity period" The period during which a key pair is + expected to be effective. This period is defined as the time + between the first inception time stamp and the last expiration + date of any signature made with this key, regardless of any + discontinuity in the use of the key. The key effectivity period + can span multiple signature validity periods. + + o "Maximum/Minimum Zone Time to Live (TTL)" The maximum or minimum + value of the TTLs from the complete set of RRs in a zone. Note + that the minimum TTL is not the same as the MINIMUM field in the + SOA RR. See [11] for more information. + + + + + + + + + + +Kolkman & Gieben Informational [Page 4] + +RFC 4641 DNSSEC Operational Practices September 2006 + + +2. Keeping the Chain of Trust Intact + + Maintaining a valid chain of trust is important because broken chains + of trust will result in data being marked as Bogus (as defined in [4] + Section 5), which may cause entire (sub)domains to become invisible + to verifying clients. The administrators of secured zones have to + realize that their zone is, to verifying clients, part of a chain of + trust. + + As mentioned in the introduction, the procedures herein are intended + to ensure that maintenance of zones, such as re-signing or key + rollovers, will be transparent to the verifying clients on the + Internet. + + Administrators of secured zones will have to keep in mind that data + published on an authoritative primary server will not be immediately + seen by verifying clients; it may take some time for the data to be + transferred to other secondary authoritative nameservers and clients + may be fetching data from caching non-authoritative servers. In this + light, note that the time for a zone transfer from master to slave is + negligible when using NOTIFY [9] and incremental transfer (IXFR) [8]. + It increases when full zone transfers (AXFR) are used in combination + with NOTIFY. It increases even more if you rely on full zone + transfers based on only the SOA timing parameters for refresh. + + For the verifying clients, it is important that data from secured + zones can be used to build chains of trust regardless of whether the + data came directly from an authoritative server, a caching + nameserver, or some middle box. Only by carefully using the + available timing parameters can a zone administrator ensure that the + data necessary for verification can be obtained. + + The responsibility for maintaining the chain of trust is shared by + administrators of secured zones in the chain of trust. This is most + obvious in the case of a 'key compromise' when a trade-off between + maintaining a valid chain of trust and replacing the compromised keys + as soon as possible must be made. Then zone administrators will have + to make a trade-off, between keeping the chain of trust intact -- + thereby allowing for attacks with the compromised key -- or + deliberately breaking the chain of trust and making secured + subdomains invisible to security-aware resolvers. Also see Section + 4.3. + + + + + + + + + +Kolkman & Gieben Informational [Page 5] + +RFC 4641 DNSSEC Operational Practices September 2006 + + +3. Keys Generation and Storage + + This section describes a number of considerations with respect to the + security of keys. It deals with the generation, effectivity period, + size, and storage of private keys. + +3.1. Zone and Key Signing Keys + + The DNSSEC validation protocol does not distinguish between different + types of DNSKEYs. All DNSKEYs can be used during the validation. In + practice, operators use Key Signing and Zone Signing Keys and use the + so-called Secure Entry Point (SEP) [3] flag to distinguish between + them during operations. The dynamics and considerations are + discussed below. + + To make zone re-signing and key rollover procedures easier to + implement, it is possible to use one or more keys as Key Signing Keys + (KSKs). These keys will only sign the apex DNSKEY RRSet in a zone. + Other keys can be used to sign all the RRSets in a zone and are + referred to as Zone Signing Keys (ZSKs). In this document, we assume + that KSKs are the subset of keys that are used for key exchanges with + the parent and potentially for configuration as trusted anchors -- + the SEP keys. In this document, we assume a one-to-one mapping + between KSK and SEP keys and we assume the SEP flag to be set on all + KSKs. + +3.1.1. Motivations for the KSK and ZSK Separation + + Differentiating between the KSK and ZSK functions has several + advantages: + + o No parent/child interaction is required when ZSKs are updated. + + o The KSK can be made stronger (i.e., using more bits in the key + material). This has little operational impact since it is only + used to sign a small fraction of the zone data. Also, the KSK is + only used to verify the zone's key set, not for other RRSets in + the zone. + + o As the KSK is only used to sign a key set, which is most probably + updated less frequently than other data in the zone, it can be + stored separately from and in a safer location than the ZSK. + + o A KSK can have a longer key effectivity period. + + For almost any method of key management and zone signing, the KSK is + used less frequently than the ZSK. Once a key set is signed with the + KSK, all the keys in the key set can be used as ZSKs. If a ZSK is + + + +Kolkman & Gieben Informational [Page 6] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + compromised, it can be simply dropped from the key set. The new key + set is then re-signed with the KSK. + + Given the assumption that for KSKs the SEP flag is set, the KSK can + be distinguished from a ZSK by examining the flag field in the DNSKEY + RR. If the flag field is an odd number it is a KSK. If it is an + even number it is a ZSK. + + The Zone Signing Key can be used to sign all the data in a zone on a + regular basis. When a Zone Signing Key is to be rolled, no + interaction with the parent is needed. This allows for signature + validity periods on the order of days. + + The Key Signing Key is only to be used to sign the DNSKEY RRs in a + zone. If a Key Signing Key is to be rolled over, there will be + interactions with parties other than the zone administrator. These + can include the registry of the parent zone or administrators of + verifying resolvers that have the particular key configured as secure + entry points. Hence, the key effectivity period of these keys can + and should be made much longer. Although, given a long enough key, + the key effectivity period can be on the order of years, we suggest + planning for a key effectivity on the order of a few months so that a + key rollover remains an operational routine. + +3.1.2. KSKs for High-Level Zones + + Higher-level zones are generally more sensitive than lower-level + zones. Anyone controlling or breaking the security of a zone thereby + obtains authority over all of its subdomains (except in the case of + resolvers that have locally configured the public key of a subdomain, + in which case this, and only this, subdomain wouldn't be affected by + the compromise of the parent zone). Therefore, extra care should be + taken with high-level zones, and strong keys should be used. + + The root zone is the most critical of all zones. Someone controlling + or compromising the security of the root zone would control the + entire DNS namespace of all resolvers using that root zone (except in + the case of resolvers that have locally configured the public key of + a subdomain). Therefore, the utmost care must be taken in the + securing of the root zone. The strongest and most carefully handled + keys should be used. The root zone private key should always be kept + off-line. + + Many resolvers will start at a root server for their access to and + authentication of DNS data. Securely updating the trust anchors in + an enormous population of resolvers around the world will be + extremely difficult. + + + + +Kolkman & Gieben Informational [Page 7] + +RFC 4641 DNSSEC Operational Practices September 2006 + + +3.2. Key Generation + + Careful generation of all keys is a sometimes overlooked but + absolutely essential element in any cryptographically secure system. + The strongest algorithms used with the longest keys are still of no + use if an adversary can guess enough to lower the size of the likely + key space so that it can be exhaustively searched. Technical + suggestions for the generation of random keys will be found in RFC + 4086 [14]. One should carefully assess if the random number + generator used during key generation adheres to these suggestions. + + Keys with a long effectivity period are particularly sensitive as + they will represent a more valuable target and be subject to attack + for a longer time than short-period keys. It is strongly recommended + that long-term key generation occur off-line in a manner isolated + from the network via an air gap or, at a minimum, high-level secure + hardware. + +3.3. Key Effectivity Period + + For various reasons, keys in DNSSEC need to be changed once in a + while. The longer a key is in use, the greater the probability that + it will have been compromised through carelessness, accident, + espionage, or cryptanalysis. Furthermore, when key rollovers are too + rare an event, they will not become part of the operational habit and + there is risk that nobody on-site will remember the procedure for + rollover when the need is there. + + From a purely operational perspective, a reasonable key effectivity + period for Key Signing Keys is 13 months, with the intent to replace + them after 12 months. An intended key effectivity period of a month + is reasonable for Zone Signing Keys. + + For key sizes that match these effectivity periods, see Section 3.5. + + As argued in Section 3.1.2, securely updating trust anchors will be + extremely difficult. On the other hand, the "operational habit" + argument does also apply to trust anchor reconfiguration. If a short + key effectivity period is used and the trust anchor configuration has + to be revisited on a regular basis, the odds that the configuration + tends to be forgotten is smaller. The trade-off is against a system + that is so dynamic that administrators of the validating clients will + not be able to follow the modifications. + + Key effectivity periods can be made very short, as in a few minutes. + But when replacing keys one has to take the considerations from + Section 4.1 and Section 4.2 into account. + + + + +Kolkman & Gieben Informational [Page 8] + +RFC 4641 DNSSEC Operational Practices September 2006 + + +3.4. Key Algorithm + + There are currently three different types of algorithms that can be + used in DNSSEC: RSA, DSA, and elliptic curve cryptography. The + latter is fairly new and has yet to be standardized for usage in + DNSSEC. + + RSA has been developed in an open and transparent manner. As the + patent on RSA expired in 2000, its use is now also free. + + DSA has been developed by the National Institute of Standards and + Technology (NIST). The creation of signatures takes roughly the same + time as with RSA, but is 10 to 40 times as slow for verification + [17]. + + We suggest the use of RSA/SHA-1 as the preferred algorithm for the + key. The current known attacks on RSA can be defeated by making your + key longer. As the MD5 hashing algorithm is showing cracks, we + recommend the usage of SHA-1. + + At the time of publication, it is known that the SHA-1 hash has + cryptanalysis issues. There is work in progress on addressing these + issues. We recommend the use of public key algorithms based on + hashes stronger than SHA-1 (e.g., SHA-256), as soon as these + algorithms are available in protocol specifications (see [19] and + [20]) and implementations. + +3.5. Key Sizes + + When choosing key sizes, zone administrators will need to take into + account how long a key will be used, how much data will be signed + during the key publication period (see Section 8.10 of [17]), and, + optionally, how large the key size of the parent is. As the chain of + trust really is "a chain", there is not much sense in making one of + the keys in the chain several times larger then the others. As + always, it's the weakest link that defines the strength of the entire + chain. Also see Section 3.1.1 for a discussion of how keys serving + different roles (ZSK vs. KSK) may need different key sizes. + + Generating a key of the correct size is a difficult problem; RFC 3766 + [13] tries to deal with that problem. The first part of the + selection procedure in Section 1 of the RFC states: + + 1. Determine the attack resistance necessary to satisfy the + security requirements of the application. Do this by + estimating the minimum number of computer operations that the + attacker will be forced to do in order to compromise the + + + + +Kolkman & Gieben Informational [Page 9] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + security of the system and then take the logarithm base two of + that number. Call that logarithm value "n". + + A 1996 report recommended 90 bits as a good all-around choice + for system security. The 90 bit number should be increased by + about 2/3 bit/year, or about 96 bits in 2005. + + [13] goes on to explain how this number "n" can be used to calculate + the key sizes in public key cryptography. This culminated in the + table given below (slightly modified for our purpose): + + +-------------+-----------+--------------+ + | System | | | + | requirement | Symmetric | RSA or DSA | + | for attack | key size | modulus size | + | resistance | (bits) | (bits) | + | (bits) | | | + +-------------+-----------+--------------+ + | 70 | 70 | 947 | + | 80 | 80 | 1228 | + | 90 | 90 | 1553 | + | 100 | 100 | 1926 | + | 150 | 150 | 4575 | + | 200 | 200 | 8719 | + | 250 | 250 | 14596 | + +-------------+-----------+--------------+ + + The key sizes given are rather large. This is because these keys are + resilient against a trillionaire attacker. Assuming this rich + attacker will not attack your key and that the key is rolled over + once a year, we come to the following recommendations about KSK + sizes: 1024 bits for low-value domains, 1300 bits for medium-value + domains, and 2048 bits for high-value domains. + + Whether a domain is of low, medium, or high value depends solely on + the views of the zone owner. One could, for instance, view leaf + nodes in the DNS as of low value, and top-level domains (TLDs) or the + root zone of high value. The suggested key sizes should be safe for + the next 5 years. + + As ZSKs can be rolled over more easily (and thus more often), the key + sizes can be made smaller. But as said in the introduction of this + paragraph, making the ZSKs' key sizes too small (in relation to the + KSKs' sizes) doesn't make much sense. Try to limit the difference in + size to about 100 bits. + + + + + + +Kolkman & Gieben Informational [Page 10] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + Note that nobody can see into the future and that these key sizes are + only provided here as a guide. Further information can be found in + [16] and Section 7.5 of [17]. It should be noted though that [16] is + already considered overly optimistic about what key sizes are + considered safe. + + One final note concerning key sizes. Larger keys will increase the + sizes of the RRSIG and DNSKEY records and will therefore increase the + chance of DNS UDP packet overflow. Also, the time it takes to + validate and create RRSIGs increases with larger keys, so don't + needlessly double your key sizes. + +3.6. Private Key Storage + + It is recommended that, where possible, zone private keys and the + zone file master copy that is to be signed be kept and used in off- + line, non-network-connected, physically secure machines only. + Periodically, an application can be run to add authentication to a + zone by adding RRSIG and NSEC RRs. Then the augmented file can be + transferred. + + When relying on dynamic update to manage a signed zone [10], be aware + that at least one private key of the zone will have to reside on the + master server. This key is only as secure as the amount of exposure + the server receives to unknown clients and the security of the host. + Although not mandatory, one could administer the DNS in the following + way. The master that processes the dynamic updates is unavailable + from generic hosts on the Internet, it is not listed in the NS RR + set, although its name appears in the SOA RRs MNAME field. The + nameservers in the NS RRSet are able to receive zone updates through + NOTIFY, IXFR, AXFR, or an out-of-band distribution mechanism. This + approach is known as the "hidden master" setup. + + The ideal situation is to have a one-way information flow to the + network to avoid the possibility of tampering from the network. + Keeping the zone master file on-line on the network and simply + cycling it through an off-line signer does not do this. The on-line + version could still be tampered with if the host it resides on is + compromised. For maximum security, the master copy of the zone file + should be off-net and should not be updated based on an unsecured + network mediated communication. + + In general, keeping a zone file off-line will not be practical and + the machines on which zone files are maintained will be connected to + a network. Operators are advised to take security measures to shield + unauthorized access to the master copy. + + + + + +Kolkman & Gieben Informational [Page 11] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + For dynamically updated secured zones [10], both the master copy and + the private key that is used to update signatures on updated RRs will + need to be on-line. + +4. Signature Generation, Key Rollover, and Related Policies + +4.1. Time in DNSSEC + + Without DNSSEC, all times in the DNS are relative. The SOA fields + REFRESH, RETRY, and EXPIRATION are timers used to determine the time + elapsed after a slave server synchronized with a master server. The + Time to Live (TTL) value and the SOA RR minimum TTL parameter [11] + are used to determine how long a forwarder should cache data after it + has been fetched from an authoritative server. By using a signature + validity period, DNSSEC introduces the notion of an absolute time in + the DNS. Signatures in DNSSEC have an expiration date after which + the signature is marked as invalid and the signed data is to be + considered Bogus. + +4.1.1. Time Considerations + + Because of the expiration of signatures, one should consider the + following: + + o We suggest the Maximum Zone TTL of your zone data to be a fraction + of your signature validity period. + + If the TTL would be of similar order as the signature validity + period, then all RRSets fetched during the validity period + would be cached until the signature expiration time. Section + 7.1 of [4] suggests that "the resolver may use the time + remaining before expiration of the signature validity period of + a signed RRSet as an upper bound for the TTL". As a result, + query load on authoritative servers would peak at signature + expiration time, as this is also the time at which records + simultaneously expire from caches. + + To avoid query load peaks, we suggest the TTL on all the RRs in + your zone to be at least a few times smaller than your + signature validity period. + + o We suggest the signature publication period to end at least one + Maximum Zone TTL duration before the end of the signature validity + period. + + + + + + + +Kolkman & Gieben Informational [Page 12] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + Re-signing a zone shortly before the end of the signature + validity period may cause simultaneous expiration of data from + caches. This in turn may lead to peaks in the load on + authoritative servers. + + o We suggest the Minimum Zone TTL to be long enough to both fetch + and verify all the RRs in the trust chain. In workshop + environments, it has been demonstrated [18] that a low TTL (under + 5 to 10 minutes) caused disruptions because of the following two + problems: + + 1. During validation, some data may expire before the + validation is complete. The validator should be able to + keep all data until it is completed. This applies to all + RRs needed to complete the chain of trust: DSes, DNSKEYs, + RRSIGs, and the final answers, i.e., the RRSet that is + returned for the initial query. + + 2. Frequent verification causes load on recursive nameservers. + Data at delegation points, DSes, DNSKEYs, and RRSIGs + benefit from caching. The TTL on those should be + relatively long. + + o Slave servers will need to be able to fetch newly signed zones + well before the RRSIGs in the zone served by the slave server pass + their signature expiration time. + + When a slave server is out of sync with its master and data in + a zone is signed by expired signatures, it may be better for + the slave server not to give out any answer. + + Normally, a slave server that is not able to contact a master + server for an extended period will expire a zone. When that + happens, the server will respond differently to queries for + that zone. Some servers issue SERVFAIL, whereas others turn + off the 'AA' bit in the answers. The time of expiration is set + in the SOA record and is relative to the last successful + refresh between the master and the slave servers. There exists + no coupling between the signature expiration of RRSIGs in the + zone and the expire parameter in the SOA. + + If the server serves a DNSSEC zone, then it may well happen + that the signatures expire well before the SOA expiration timer + counts down to zero. It is not possible to completely prevent + this from happening by tweaking the SOA parameters. However, + the effects can be minimized where the SOA expiration time is + equal to or shorter than the signature validity period. The + consequence of an authoritative server not being able to update + + + +Kolkman & Gieben Informational [Page 13] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + a zone, whilst that zone includes expired signatures, is that + non-secure resolvers will continue to be able to resolve data + served by the particular slave servers while security-aware + resolvers will experience problems because of answers being + marked as Bogus. + + We suggest the SOA expiration timer being approximately one + third or one fourth of the signature validity period. It will + allow problems with transfers from the master server to be + noticed before the actual signature times out. We also suggest + that operators of nameservers that supply secondary services + develop 'watch dogs' to spot upcoming signature expirations in + zones they slave, and take appropriate action. + + When determining the value for the expiration parameter one has + to take the following into account: What are the chances that + all my secondaries expire the zone? How quickly can I reach an + administrator of secondary servers to load a valid zone? These + questions are not DNSSEC specific but may influence the choice + of your signature validity intervals. + +4.2. Key Rollovers + + A DNSSEC key cannot be used forever (see Section 3.3). So key + rollovers -- or supercessions, as they are sometimes called -- are a + fact of life when using DNSSEC. Zone administrators who are in the + process of rolling their keys have to take into account that data + published in previous versions of their zone still lives in caches. + When deploying DNSSEC, this becomes an important consideration; + ignoring data that may be in caches may lead to loss of service for + clients. + + The most pressing example of this occurs when zone material signed + with an old key is being validated by a resolver that does not have + the old zone key cached. If the old key is no longer present in the + current zone, this validation fails, marking the data "Bogus". + Alternatively, an attempt could be made to validate data that is + signed with a new key against an old key that lives in a local cache, + also resulting in data being marked "Bogus". + +4.2.1. Zone Signing Key Rollovers + + For "Zone Signing Key rollovers", there are two ways to make sure + that during the rollover data still cached can be verified with the + new key sets or newly generated signatures can be verified with the + keys still in caches. One schema, described in Section 4.2.1.2, uses + + + + + +Kolkman & Gieben Informational [Page 14] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + double signatures; the other uses key pre-publication (Section + 4.2.1.1). The pros, cons, and recommendations are described in + Section 4.2.1.3. + +4.2.1.1. Pre-Publish Key Rollover + + This section shows how to perform a ZSK rollover without the need to + sign all the data in a zone twice -- the "pre-publish key rollover". + This method has advantages in the case of a key compromise. If the + old key is compromised, the new key has already been distributed in + the DNS. The zone administrator is then able to quickly switch to + the new key and remove the compromised key from the zone. Another + major advantage is that the zone size does not double, as is the case + with the double signature ZSK rollover. A small "how-to" for this + kind of rollover can be found in Appendix B. + + Pre-publish key rollover involves four stages as follows: + + ---------------------------------------------------------------- + initial new DNSKEY new RRSIGs DNSKEY removal + ---------------------------------------------------------------- + SOA0 SOA1 SOA2 SOA3 + RRSIG10(SOA0) RRSIG10(SOA1) RRSIG11(SOA2) RRSIG11(SOA3) + + DNSKEY1 DNSKEY1 DNSKEY1 DNSKEY1 + DNSKEY10 DNSKEY10 DNSKEY10 DNSKEY11 + DNSKEY11 DNSKEY11 + RRSIG1 (DNSKEY) RRSIG1 (DNSKEY) RRSIG1(DNSKEY) RRSIG1 (DNSKEY) + RRSIG10(DNSKEY) RRSIG10(DNSKEY) RRSIG11(DNSKEY) RRSIG11(DNSKEY) + ---------------------------------------------------------------- + + Pre-Publish Key Rollover + + initial: Initial version of the zone: DNSKEY 1 is the Key Signing + Key. DNSKEY 10 is used to sign all the data of the zone, the Zone + Signing Key. + + new DNSKEY: DNSKEY 11 is introduced into the key set. Note that no + signatures are generated with this key yet, but this does not + secure against brute force attacks on the public key. The minimum + duration of this pre-roll phase is the time it takes for the data + to propagate to the authoritative servers plus TTL value of the + key set. + + new RRSIGs: At the "new RRSIGs" stage (SOA serial 2), DNSKEY 11 is + used to sign the data in the zone exclusively (i.e., all the + signatures from DNSKEY 10 are removed from the zone). DNSKEY 10 + remains published in the key set. This way data that was loaded + + + +Kolkman & Gieben Informational [Page 15] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + into caches from version 1 of the zone can still be verified with + key sets fetched from version 2 of the zone. The minimum time + that the key set including DNSKEY 10 is to be published is the + time that it takes for zone data from the previous version of the + zone to expire from old caches, i.e., the time it takes for this + zone to propagate to all authoritative servers plus the Maximum + Zone TTL value of any of the data in the previous version of the + zone. + + DNSKEY removal: DNSKEY 10 is removed from the zone. The key set, now + only containing DNSKEY 1 and DNSKEY 11, is re-signed with the + DNSKEY 1. + + The above scheme can be simplified by always publishing the "future" + key immediately after the rollover. The scheme would look as follows + (we show two rollovers); the future key is introduced in "new DNSKEY" + as DNSKEY 12 and again a newer one, numbered 13, in "new DNSKEY + (II)": + + ---------------------------------------------------------------- + initial new RRSIGs new DNSKEY + ---------------------------------------------------------------- + SOA0 SOA1 SOA2 + RRSIG10(SOA0) RRSIG11(SOA1) RRSIG11(SOA2) + + DNSKEY1 DNSKEY1 DNSKEY1 + DNSKEY10 DNSKEY10 DNSKEY11 + DNSKEY11 DNSKEY11 DNSKEY12 + RRSIG1(DNSKEY) RRSIG1 (DNSKEY) RRSIG1(DNSKEY) + RRSIG10(DNSKEY) RRSIG11(DNSKEY) RRSIG11(DNSKEY) + ---------------------------------------------------------------- + + ---------------------------------------------------------------- + new RRSIGs (II) new DNSKEY (II) + ---------------------------------------------------------------- + SOA3 SOA4 + RRSIG12(SOA3) RRSIG12(SOA4) + + DNSKEY1 DNSKEY1 + DNSKEY11 DNSKEY12 + DNSKEY12 DNSKEY13 + RRSIG1(DNSKEY) RRSIG1(DNSKEY) + RRSIG12(DNSKEY) RRSIG12(DNSKEY) + ---------------------------------------------------------------- + + Pre-Publish Key Rollover, Showing Two Rollovers + + + + + +Kolkman & Gieben Informational [Page 16] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + Note that the key introduced in the "new DNSKEY" phase is not used + for production yet; the private key can thus be stored in a + physically secure manner and does not need to be 'fetched' every time + a zone needs to be signed. + +4.2.1.2. Double Signature Zone Signing Key Rollover + + This section shows how to perform a ZSK key rollover using the double + zone data signature scheme, aptly named "double signature rollover". + + During the "new DNSKEY" stage the new version of the zone file will + need to propagate to all authoritative servers and the data that + exists in (distant) caches will need to expire, requiring at least + the Maximum Zone TTL. + + Double signature ZSK rollover involves three stages as follows: + + ---------------------------------------------------------------- + initial new DNSKEY DNSKEY removal + ---------------------------------------------------------------- + SOA0 SOA1 SOA2 + RRSIG10(SOA0) RRSIG10(SOA1) RRSIG11(SOA2) + RRSIG11(SOA1) + + DNSKEY1 DNSKEY1 DNSKEY1 + DNSKEY10 DNSKEY10 DNSKEY11 + DNSKEY11 + RRSIG1(DNSKEY) RRSIG1(DNSKEY) RRSIG1(DNSKEY) + RRSIG10(DNSKEY) RRSIG10(DNSKEY) RRSIG11(DNSKEY) + RRSIG11(DNSKEY) + ---------------------------------------------------------------- + + Double Signature Zone Signing Key Rollover + + initial: Initial Version of the zone: DNSKEY 1 is the Key Signing + Key. DNSKEY 10 is used to sign all the data of the zone, the Zone + Signing Key. + + new DNSKEY: At the "New DNSKEY" stage (SOA serial 1) DNSKEY 11 is + introduced into the key set and all the data in the zone is signed + with DNSKEY 10 and DNSKEY 11. The rollover period will need to + continue until all data from version 0 of the zone has expired + from remote caches. This will take at least the Maximum Zone TTL + of version 0 of the zone. + + DNSKEY removal: DNSKEY 10 is removed from the zone. All the + signatures from DNSKEY 10 are removed from the zone. The key set, + now only containing DNSKEY 11, is re-signed with DNSKEY 1. + + + +Kolkman & Gieben Informational [Page 17] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + At every instance, RRSIGs from the previous version of the zone can + be verified with the DNSKEY RRSet from the current version and the + other way around. The data from the current version can be verified + with the data from the previous version of the zone. The duration of + the "new DNSKEY" phase and the period between rollovers should be at + least the Maximum Zone TTL. + + Making sure that the "new DNSKEY" phase lasts until the signature + expiration time of the data in initial version of the zone is + recommended. This way all caches are cleared of the old signatures. + However, this duration could be considerably longer than the Maximum + Zone TTL, making the rollover a lengthy procedure. + + Note that in this example we assumed that the zone was not modified + during the rollover. New data can be introduced in the zone as long + as it is signed with both keys. + +4.2.1.3. Pros and Cons of the Schemes + + Pre-publish key rollover: This rollover does not involve signing the + zone data twice. Instead, before the actual rollover, the new key + is published in the key set and thus is available for + cryptanalysis attacks. A small disadvantage is that this process + requires four steps. Also the pre-publish scheme involves more + parental work when used for KSK rollovers as explained in Section + 4.2.3. + + Double signature ZSK rollover: The drawback of this signing scheme is + that during the rollover the number of signatures in your zone + doubles; this may be prohibitive if you have very big zones. An + advantage is that it only requires three steps. + +4.2.2. Key Signing Key Rollovers + + For the rollover of a Key Signing Key, the same considerations as for + the rollover of a Zone Signing Key apply. However, we can use a + double signature scheme to guarantee that old data (only the apex key + set) in caches can be verified with a new key set and vice versa. + Since only the key set is signed with a KSK, zone size considerations + do not apply. + + + + + + + + + + + +Kolkman & Gieben Informational [Page 18] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + -------------------------------------------------------------------- + initial new DNSKEY DS change DNSKEY removal + -------------------------------------------------------------------- + Parent: + SOA0 --------> SOA1 --------> + RRSIGpar(SOA0) --------> RRSIGpar(SOA1) --------> + DS1 --------> DS2 --------> + RRSIGpar(DS) --------> RRSIGpar(DS) --------> + + + Child: + SOA0 SOA1 --------> SOA2 + RRSIG10(SOA0) RRSIG10(SOA1) --------> RRSIG10(SOA2) + --------> + DNSKEY1 DNSKEY1 --------> DNSKEY2 + DNSKEY2 --------> + DNSKEY10 DNSKEY10 --------> DNSKEY10 + RRSIG1 (DNSKEY) RRSIG1 (DNSKEY) --------> RRSIG2 (DNSKEY) + RRSIG2 (DNSKEY) --------> + RRSIG10(DNSKEY) RRSIG10(DNSKEY) --------> RRSIG10(DNSKEY) + -------------------------------------------------------------------- + + Stages of Deployment for a Double Signature Key Signing Key Rollover + + initial: Initial version of the zone. The parental DS points to + DNSKEY1. Before the rollover starts, the child will have to + verify what the TTL is of the DS RR that points to DNSKEY1 -- it + is needed during the rollover and we refer to the value as TTL_DS. + + new DNSKEY: During the "new DNSKEY" phase, the zone administrator + generates a second KSK, DNSKEY2. The key is provided to the + parent, and the child will have to wait until a new DS RR has been + generated that points to DNSKEY2. After that DS RR has been + published on all servers authoritative for the parent's zone, the + zone administrator has to wait at least TTL_DS to make sure that + the old DS RR has expired from caches. + + DS change: The parent replaces DS1 with DS2. + + DNSKEY removal: DNSKEY1 has been removed. + + The scenario above puts the responsibility for maintaining a valid + chain of trust with the child. It also is based on the premise that + the parent only has one DS RR (per algorithm) per zone. An + alternative mechanism has been considered. Using an established + trust relation, the interaction can be performed in-band, and the + removal of the keys by the child can possibly be signaled by the + parent. In this mechanism, there are periods where there are two DS + + + +Kolkman & Gieben Informational [Page 19] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + RRs at the parent. Since at the moment of writing the protocol for + this interaction has not been developed, further discussion is out of + scope for this document. + +4.2.3. Difference Between ZSK and KSK Rollovers + + Note that KSK rollovers and ZSK rollovers are different in the sense + that a KSK rollover requires interaction with the parent (and + possibly replacing of trust anchors) and the ensuing delay while + waiting for it. + + A zone key rollover can be handled in two different ways: pre-publish + (Section 4.2.1.1) and double signature (Section 4.2.1.2). + + As the KSK is used to validate the key set and because the KSK is not + changed during a ZSK rollover, a cache is able to validate the new + key set of the zone. The pre-publish method would also work for a + KSK rollover. The records that are to be pre-published are the + parental DS RRs. The pre-publish method has some drawbacks for KSKs. + We first describe the rollover scheme and then indicate these + drawbacks. + + -------------------------------------------------------------------- + initial new DS new DNSKEY DS/DNSKEY removal + -------------------------------------------------------------------- + Parent: + SOA0 SOA1 --------> SOA2 + RRSIGpar(SOA0) RRSIGpar(SOA1) --------> RRSIGpar(SOA2) + DS1 DS1 --------> DS2 + DS2 --------> + RRSIGpar(DS) RRSIGpar(DS) --------> RRSIGpar(DS) + + + Child: + SOA0 --------> SOA1 SOA1 + RRSIG10(SOA0) --------> RRSIG10(SOA1) RRSIG10(SOA1) + --------> + DNSKEY1 --------> DNSKEY2 DNSKEY2 + --------> + DNSKEY10 --------> DNSKEY10 DNSKEY10 + RRSIG1 (DNSKEY) --------> RRSIG2(DNSKEY) RRSIG2 (DNSKEY) + RRSIG10(DNSKEY) --------> RRSIG10(DNSKEY) RRSIG10(DNSKEY) + -------------------------------------------------------------------- + + Stages of Deployment for a Pre-Publish Key Signing Key Rollover + + + + + + +Kolkman & Gieben Informational [Page 20] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + When the child zone wants to roll, it notifies the parent during the + "new DS" phase and submits the new key (or the corresponding DS) to + the parent. The parent publishes DS1 and DS2, pointing to DNSKEY1 + and DNSKEY2, respectively. During the rollover ("new DNSKEY" phase), + which can take place as soon as the new DS set propagated through the + DNS, the child replaces DNSKEY1 with DNSKEY2. Immediately after that + ("DS/DNSKEY removal" phase), it can notify the parent that the old DS + record can be deleted. + + The drawbacks of this scheme are that during the "new DS" phase the + parent cannot verify the match between the DS2 RR and DNSKEY2 using + the DNS -- as DNSKEY2 is not yet published. Besides, we introduce a + "security lame" key (see Section 4.4.3). Finally, the child-parent + interaction consists of two steps. The "double signature" method + only needs one interaction. + +4.2.4. Automated Key Rollovers + + As keys must be renewed periodically, there is some motivation to + automate the rollover process. Consider the following: + + o ZSK rollovers are easy to automate as only the child zone is + involved. + + o A KSK rollover needs interaction between parent and child. Data + exchange is needed to provide the new keys to the parent; + consequently, this data must be authenticated and integrity must + be guaranteed in order to avoid attacks on the rollover. + +4.3. Planning for Emergency Key Rollover + + This section deals with preparation for a possible key compromise. + Our advice is to have a documented procedure ready for when a key + compromise is suspected or confirmed. + + When the private material of one of your keys is compromised it can + be used for as long as a valid trust chain exists. A trust chain + remains intact for + + o as long as a signature over the compromised key in the trust chain + is valid, + + o as long as a parental DS RR (and signature) points to the + compromised key, + + o as long as the key is anchored in a resolver and is used as a + starting point for validation (this is generally the hardest to + update). + + + +Kolkman & Gieben Informational [Page 21] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + While a trust chain to your compromised key exists, your namespace is + vulnerable to abuse by anyone who has obtained illegitimate + possession of the key. Zone operators have to make a trade-off if + the abuse of the compromised key is worse than having data in caches + that cannot be validated. If the zone operator chooses to break the + trust chain to the compromised key, data in caches signed with this + key cannot be validated. However, if the zone administrator chooses + to take the path of a regular rollover, the malicious key holder can + spoof data so that it appears to be valid. + +4.3.1. KSK Compromise + + A zone containing a DNSKEY RRSet with a compromised KSK is vulnerable + as long as the compromised KSK is configured as trust anchor or a + parental DS points to it. + + A compromised KSK can be used to sign the key set of an attacker's + zone. That zone could be used to poison the DNS. + + Therefore, when the KSK has been compromised, the trust anchor or the + parental DS should be replaced as soon as possible. It is local + policy whether to break the trust chain during the emergency + rollover. The trust chain would be broken when the compromised KSK + is removed from the child's zone while the parent still has a DS + pointing to the compromised KSK (the assumption is that there is only + one DS at the parent. If there are multiple DSes this does not apply + -- however the chain of trust of this particular key is broken). + + Note that an attacker's zone still uses the compromised KSK and the + presence of a parental DS would cause the data in this zone to appear + as valid. Removing the compromised key would cause the attacker's + zone to appear as valid and the child's zone as Bogus. Therefore, we + advise not to remove the KSK before the parent has a DS to a new KSK + in place. + +4.3.1.1. Keeping the Chain of Trust Intact + + If we follow this advice, the timing of the replacement of the KSK is + somewhat critical. The goal is to remove the compromised KSK as soon + as the new DS RR is available at the parent. And also make sure that + the signature made with a new KSK over the key set with the + compromised KSK in it expires just after the new DS appears at the + parent, thus removing the old cruft in one swoop. + + The procedure is as follows: + + 1. Introduce a new KSK into the key set, keep the compromised KSK in + the key set. + + + +Kolkman & Gieben Informational [Page 22] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + 2. Sign the key set, with a short validity period. The validity + period should expire shortly after the DS is expected to appear + in the parent and the old DSes have expired from caches. + + 3. Upload the DS for this new key to the parent. + + 4. Follow the procedure of the regular KSK rollover: Wait for the DS + to appear in the authoritative servers and then wait as long as + the TTL of the old DS RRs. If necessary re-sign the DNSKEY RRSet + and modify/extend the expiration time. + + 5. Remove the compromised DNSKEY RR from the zone and re-sign the + key set using your "normal" validity interval. + + An additional danger of a key compromise is that the compromised key + could be used to facilitate a legitimate DNSKEY/DS rollover and/or + nameserver changes at the parent. When that happens, the domain may + be in dispute. An authenticated out-of-band and secure notify + mechanism to contact a parent is needed in this case. + + Note that this is only a problem when the DNSKEY and or DS records + are used for authentication at the parent. + +4.3.1.2. Breaking the Chain of Trust + + There are two methods to break the chain of trust. The first method + causes the child zone to appear 'Bogus' to validating resolvers. The + other causes the child zone to appear 'insecure'. These are + described below. + + In the method that causes the child zone to appear 'Bogus' to + validating resolvers, the child zone replaces the current KSK with a + new one and re-signs the key set. Next it sends the DS of the new + key to the parent. Only after the parent has placed the new DS in + the zone is the child's chain of trust repaired. + + An alternative method of breaking the chain of trust is by removing + the DS RRs from the parent zone altogether. As a result, the child + zone would become insecure. + +4.3.2. ZSK Compromise + + Primarily because there is no parental interaction required when a + ZSK is compromised, the situation is less severe than with a KSK + compromise. The zone must still be re-signed with a new ZSK as soon + as possible. As this is a local operation and requires no + communication between the parent and child, this can be achieved + fairly quickly. However, one has to take into account that just as + + + +Kolkman & Gieben Informational [Page 23] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + with a normal rollover the immediate disappearance of the old + compromised key may lead to verification problems. Also note that as + long as the RRSIG over the compromised ZSK is not expired the zone + may be still at risk. + +4.3.3. Compromises of Keys Anchored in Resolvers + + A key can also be pre-configured in resolvers. For instance, if + DNSSEC is successfully deployed the root key may be pre-configured in + most security aware resolvers. + + If trust-anchor keys are compromised, the resolvers using these keys + should be notified of this fact. Zone administrators may consider + setting up a mailing list to communicate the fact that a SEP key is + about to be rolled over. This communication will of course need to + be authenticated, e.g., by using digital signatures. + + End-users faced with the task of updating an anchored key should + always validate the new key. New keys should be authenticated out- + of-band, for example, through the use of an announcement website that + is secured using secure sockets (TLS) [21]. + +4.4. Parental Policies + +4.4.1. Initial Key Exchanges and Parental Policies Considerations + + The initial key exchange is always subject to the policies set by the + parent. When designing a key exchange policy one should take into + account that the authentication and authorization mechanisms used + during a key exchange should be as strong as the authentication and + authorization mechanisms used for the exchange of delegation + information between parent and child. That is, there is no implicit + need in DNSSEC to make the authentication process stronger than it + was in DNS. + + Using the DNS itself as the source for the actual DNSKEY material, + with an out-of-band check on the validity of the DNSKEY, has the + benefit that it reduces the chances of user error. A DNSKEY query + tool can make use of the SEP bit [3] to select the proper key from a + DNSSEC key set, thereby reducing the chance that the wrong DNSKEY is + sent. It can validate the self-signature over a key; thereby + verifying the ownership of the private key material. Fetching the + DNSKEY from the DNS ensures that the chain of trust remains intact + once the parent publishes the DS RR indicating the child is secure. + + Note: the out-of-band verification is still needed when the key + material is fetched via the DNS. The parent can never be sure + whether or not the DNSKEY RRs have been spoofed. + + + +Kolkman & Gieben Informational [Page 24] + +RFC 4641 DNSSEC Operational Practices September 2006 + + +4.4.2. Storing Keys or Hashes? + + When designing a registry system one should consider which of the + DNSKEYs and/or the corresponding DSes to store. Since a child zone + might wish to have a DS published using a message digest algorithm + not yet understood by the registry, the registry can't count on being + able to generate the DS record from a raw DNSKEY. Thus, we recommend + that registry systems at least support storing DS records. + + It may also be useful to store DNSKEYs, since having them may help + during troubleshooting and, as long as the child's chosen message + digest is supported, the overhead of generating DS records from them + is minimal. Having an out-of-band mechanism, such as a registry + directory (e.g., Whois), to find out which keys are used to generate + DS Resource Records for specific owners and/or zones may also help + with troubleshooting. + + The storage considerations also relate to the design of the customer + interface and the method by which data is transferred between + registrant and registry; Will the child zone administrator be able to + upload DS RRs with unknown hash algorithms or does the interface only + allow DNSKEYs? In the registry-registrar model, one can use the + DNSSEC extensions to the Extensible Provisioning Protocol (EPP) [15], + which allows transfer of DS RRs and optionally DNSKEY RRs. + +4.4.3. Security Lameness + + Security lameness is defined as what happens when a parent has a DS + RR pointing to a non-existing DNSKEY RR. When this happens, the + child's zone may be marked "Bogus" by verifying DNS clients. + + As part of a comprehensive delegation check, the parent could, at key + exchange time, verify that the child's key is actually configured in + the DNS. However, if a parent does not understand the hashing + algorithm used by child, the parental checks are limited to only + comparing the key id. + + Child zones should be very careful in removing DNSKEY material, + specifically SEP keys, for which a DS RR exists. + + Once a zone is "security lame", a fix (e.g., removing a DS RR) will + take time to propagate through the DNS. + + + + + + + + + +Kolkman & Gieben Informational [Page 25] + +RFC 4641 DNSSEC Operational Practices September 2006 + + +4.4.4. DS Signature Validity Period + + Since the DS can be replayed as long as it has a valid signature, a + short signature validity period over the DS minimizes the time a + child is vulnerable in the case of a compromise of the child's + KSK(s). A signature validity period that is too short introduces the + possibility that a zone is marked "Bogus" in case of a configuration + error in the signer. There may not be enough time to fix the + problems before signatures expire. Something as mundane as operator + unavailability during weekends shows the need for DS signature + validity periods longer than 2 days. We recommend an absolute + minimum for a DS signature validity period of a few days. + + The maximum signature validity period of the DS record depends on how + long child zones are willing to be vulnerable after a key compromise. + On the other hand, shortening the DS signature validity interval + increases the operational risk for the parent. Therefore, the parent + may have policy to use a signature validity interval that is + considerably longer than the child would hope for. + + A compromise between the operational constraints of the parent and + minimizing damage for the child may result in a DS signature validity + period somewhere between a week and months. + + In addition to the signature validity period, which sets a lower + bound on the number of times the zone owner will need to sign the + zone data and which sets an upper bound to the time a child is + vulnerable after key compromise, there is the TTL value on the DS + RRs. Shortening the TTL means that the authoritative servers will + see more queries. But on the other hand, a short TTL lowers the + persistence of DS RRSets in caches thereby increasing the speed with + which updated DS RRSets propagate through the DNS. + +5. Security Considerations + + DNSSEC adds data integrity to the DNS. This document tries to assess + the operational considerations to maintain a stable and secure DNSSEC + service. Not taking into account the 'data propagation' properties + in the DNS will cause validation failures and may make secured zones + unavailable to security-aware resolvers. + +6. Acknowledgments + + Most of the ideas in this document were the result of collective + efforts during workshops, discussions, and tryouts. + + At the risk of forgetting individuals who were the original + contributors of the ideas, we would like to acknowledge people who + + + +Kolkman & Gieben Informational [Page 26] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + were actively involved in the compilation of this document. In + random order: Rip Loomis, Olafur Gudmundsson, Wesley Griffin, Michael + Richardson, Scott Rose, Rick van Rein, Tim McGinnis, Gilles Guette + Olivier Courtay, Sam Weiler, Jelte Jansen, Niall O'Reilly, Holger + Zuleger, Ed Lewis, Hilarie Orman, Marcos Sanz, and Peter Koch. + + Some material in this document has been copied from RFC 2541 [12]. + + Mike StJohns designed the key exchange between parent and child + mentioned in the last paragraph of Section 4.2.2 + + Section 4.2.4 was supplied by G. Guette and O. Courtay. + + Emma Bretherick, Adrian Bedford, and Lindy Foster corrected many of + the spelling and style issues. + + Kolkman and Gieben take the blame for introducing all miscakes (sic). + + While working on this document, Kolkman was employed by the RIPE NCC + and Gieben was employed by NLnet Labs. + +7. References + +7.1. Normative References + + [1] Mockapetris, P., "Domain names - concepts and facilities", STD + 13, RFC 1034, November 1987. + + [2] Mockapetris, P., "Domain names - implementation and + specification", STD 13, RFC 1035, November 1987. + + [3] Kolkman, O., Schlyter, J., and E. Lewis, "Domain Name System + KEY (DNSKEY) Resource Record (RR) Secure Entry Point (SEP) + Flag", RFC 3757, May 2004. + + [4] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, + "DNS Security Introduction and Requirements", RFC 4033, March + 2005. + + [5] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, + "Resource Records for the DNS Security Extensions", RFC 4034, + March 2005. + + [6] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, + "Protocol Modifications for the DNS Security Extensions", RFC + 4035, March 2005. + + + + + +Kolkman & Gieben Informational [Page 27] + +RFC 4641 DNSSEC Operational Practices September 2006 + + +7.2. Informative References + + [7] Bradner, S., "Key words for use in RFCs to Indicate Requirement + Levels", BCP 14, RFC 2119, March 1997. + + [8] Ohta, M., "Incremental Zone Transfer in DNS", RFC 1995, August + 1996. + + [9] Vixie, P., "A Mechanism for Prompt Notification of Zone Changes + (DNS NOTIFY)", RFC 1996, August 1996. + + [10] Wellington, B., "Secure Domain Name System (DNS) Dynamic + Update", RFC 3007, November 2000. + + [11] Andrews, M., "Negative Caching of DNS Queries (DNS NCACHE)", + RFC 2308, March 1998. + + [12] Eastlake, D., "DNS Security Operational Considerations", RFC + 2541, March 1999. + + [13] Orman, H. and P. Hoffman, "Determining Strengths For Public + Keys Used For Exchanging Symmetric Keys", BCP 86, RFC 3766, + April 2004. + + [14] Eastlake, D., Schiller, J., and S. Crocker, "Randomness + Requirements for Security", BCP 106, RFC 4086, June 2005. + + [15] Hollenbeck, S., "Domain Name System (DNS) Security Extensions + Mapping for the Extensible Provisioning Protocol (EPP)", RFC + 4310, December 2005. + + [16] Lenstra, A. and E. Verheul, "Selecting Cryptographic Key + Sizes", The Journal of Cryptology 14 (255-293), 2001. + + [17] Schneier, B., "Applied Cryptography: Protocols, Algorithms, and + Source Code in C", ISBN (hardcover) 0-471-12845-7, ISBN + (paperback) 0-471-59756-2, Published by John Wiley & Sons Inc., + 1996. + + [18] Rose, S., "NIST DNSSEC workshop notes", June 2001. + + [19] Jansen, J., "Use of RSA/SHA-256 DNSKEY and RRSIG Resource + Records in DNSSEC", Work in Progress, January 2006. + + [20] Hardaker, W., "Use of SHA-256 in DNSSEC Delegation Signer (DS) + Resource Records (RRs)", RFC 4509, May 2006. + + + + + +Kolkman & Gieben Informational [Page 28] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + [21] Blake-Wilson, S., Nystrom, M., Hopwood, D., Mikkelsen, J., and + T. Wright, "Transport Layer Security (TLS) Extensions", RFC + 4366, April 2006. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +Kolkman & Gieben Informational [Page 29] + +RFC 4641 DNSSEC Operational Practices September 2006 + + +Appendix A. Terminology + + In this document, there is some jargon used that is defined in other + documents. In most cases, we have not copied the text from the + documents defining the terms but have given a more elaborate + explanation of the meaning. Note that these explanations should not + be seen as authoritative. + + Anchored key: A DNSKEY configured in resolvers around the globe. + This key is hard to update, hence the term anchored. + + Bogus: Also see Section 5 of [4]. An RRSet in DNSSEC is marked + "Bogus" when a signature of an RRSet does not validate against a + DNSKEY. + + Key Signing Key or KSK: A Key Signing Key (KSK) is a key that is used + exclusively for signing the apex key set. The fact that a key is + a KSK is only relevant to the signing tool. + + Key size: The term 'key size' can be substituted by 'modulus size' + throughout the document. It is mathematically more correct to use + modulus size, but as this is a document directed at operators we + feel more at ease with the term key size. + + Private and public keys: DNSSEC secures the DNS through the use of + public key cryptography. Public key cryptography is based on the + existence of two (mathematically related) keys, a public key and a + private key. The public keys are published in the DNS by use of + the DNSKEY Resource Record (DNSKEY RR). Private keys should + remain private. + + Key rollover: A key rollover (also called key supercession in some + environments) is the act of replacing one key pair with another at + the end of a key effectivity period. + + Secure Entry Point (SEP) key: A KSK that has a parental DS record + pointing to it or is configured as a trust anchor. Although not + required by the protocol, we recommend that the SEP flag [3] is + set on these keys. + + Self-signature: This only applies to signatures over DNSKEYs; a + signature made with DNSKEY x, over DNSKEY x is called a self- + signature. Note: without further information, self-signatures + convey no trust. They are useful to check the authenticity of the + DNSKEY, i.e., they can be used as a hash. + + + + + + +Kolkman & Gieben Informational [Page 30] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + Singing the zone file: The term used for the event where an + administrator joyfully signs its zone file while producing melodic + sound patterns. + + Signer: The system that has access to the private key material and + signs the Resource Record sets in a zone. A signer may be + configured to sign only parts of the zone, e.g., only those RRSets + for which existing signatures are about to expire. + + Zone Signing Key (ZSK): A key that is used for signing all data in a + zone. The fact that a key is a ZSK is only relevant to the + signing tool. + + Zone administrator: The 'role' that is responsible for signing a zone + and publishing it on the primary authoritative server. + +Appendix B. Zone Signing Key Rollover How-To + + Using the pre-published signature scheme and the most conservative + method to assure oneself that data does not live in caches, here + follows the "how-to". + + Step 0: The preparation: Create two keys and publish both in your key + set. Mark one of the keys "active" and the other "published". + Use the "active" key for signing your zone data. Store the + private part of the "published" key, preferably off-line. The + protocol does not provide for attributes to mark a key as active + or published. This is something you have to do on your own, + through the use of a notebook or key management tool. + + Step 1: Determine expiration: At the beginning of the rollover make a + note of the highest expiration time of signatures in your zone + file created with the current key marked as active. Wait until + the expiration time marked in Step 1 has passed. + + Step 2: Then start using the key that was marked "published" to sign + your data (i.e., mark it "active"). Stop using the key that was + marked "active"; mark it "rolled". + + Step 3: It is safe to engage in a new rollover (Step 1) after at + least one signature validity period. + + + + + + + + + + +Kolkman & Gieben Informational [Page 31] + +RFC 4641 DNSSEC Operational Practices September 2006 + + +Appendix C. Typographic Conventions + + The following typographic conventions are used in this document: + + Key notation: A key is denoted by DNSKEYx, where x is a number or an + identifier, x could be thought of as the key id. + + RRSet notations: RRs are only denoted by the type. All other + information -- owner, class, rdata, and TTL--is left out. Thus: + "example.com 3600 IN A 192.0.2.1" is reduced to "A". RRSets are a + list of RRs. A example of this would be "A1, A2", specifying the + RRSet containing two "A" records. This could again be abbreviated to + just "A". + + Signature notation: Signatures are denoted as RRSIGx(RRSet), which + means that RRSet is signed with DNSKEYx. + + Zone representation: Using the above notation we have simplified the + representation of a signed zone by leaving out all unnecessary + details such as the names and by representing all data by "SOAx" + + SOA representation: SOAs are represented as SOAx, where x is the + serial number. + + Using this notation the following signed zone: + + example.net. 86400 IN SOA ns.example.net. bert.example.net. ( + 2006022100 ; serial + 86400 ; refresh ( 24 hours) + 7200 ; retry ( 2 hours) + 3600000 ; expire (1000 hours) + 28800 ) ; minimum ( 8 hours) + 86400 RRSIG SOA 5 2 86400 20130522213204 ( + 20130422213204 14 example.net. + cmL62SI6iAX46xGNQAdQ... ) + 86400 NS a.iana-servers.net. + 86400 NS b.iana-servers.net. + 86400 RRSIG NS 5 2 86400 20130507213204 ( + 20130407213204 14 example.net. + SO5epiJei19AjXoUpFnQ ... ) + 86400 DNSKEY 256 3 5 ( + EtRB9MP5/AvOuVO0I8XDxy0... ) ; id = 14 + 86400 DNSKEY 257 3 5 ( + gsPW/Yy19GzYIY+Gnr8HABU... ) ; id = 15 + 86400 RRSIG DNSKEY 5 2 86400 20130522213204 ( + 20130422213204 14 example.net. + J4zCe8QX4tXVGjV4e1r9... ) + + + + +Kolkman & Gieben Informational [Page 32] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + 86400 RRSIG DNSKEY 5 2 86400 20130522213204 ( + 20130422213204 15 example.net. + keVDCOpsSeDReyV6O... ) + 86400 RRSIG NSEC 5 2 86400 20130507213204 ( + 20130407213204 14 example.net. + obj3HEp1GjnmhRjX... ) + a.example.net. 86400 IN TXT "A label" + 86400 RRSIG TXT 5 3 86400 20130507213204 ( + 20130407213204 14 example.net. + IkDMlRdYLmXH7QJnuF3v... ) + 86400 NSEC b.example.com. TXT RRSIG NSEC + 86400 RRSIG NSEC 5 3 86400 20130507213204 ( + 20130407213204 14 example.net. + bZMjoZ3bHjnEz0nIsPMM... ) + ... + + is reduced to the following representation: + + SOA2006022100 + RRSIG14(SOA2006022100) + DNSKEY14 + DNSKEY15 + + RRSIG14(KEY) + RRSIG15(KEY) + + The rest of the zone data has the same signature as the SOA record, + i.e., an RRSIG created with DNSKEY 14. + + + + + + + + + + + + + + + + + + + + + + + +Kolkman & Gieben Informational [Page 33] + +RFC 4641 DNSSEC Operational Practices September 2006 + + +Authors' Addresses + + Olaf M. Kolkman + NLnet Labs + Kruislaan 419 + Amsterdam 1098 VA + The Netherlands + + EMail: olaf@nlnetlabs.nl + URI: http://www.nlnetlabs.nl + + + R. (Miek) Gieben + + EMail: miek@miek.nl + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +Kolkman & Gieben Informational [Page 34] + +RFC 4641 DNSSEC Operational Practices September 2006 + + +Full Copyright Statement + + Copyright (C) The Internet Society (2006). + + This document is subject to the rights, licenses and restrictions + contained in BCP 78, and except as set forth therein, the authors + retain all their rights. + + This document and the information contained herein are provided on an + "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS + OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET + ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, + INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE + INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED + WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. + +Intellectual Property + + The IETF takes no position regarding the validity or scope of any + Intellectual Property Rights or other rights that might be claimed to + pertain to the implementation or use of the technology described in + this document or the extent to which any license under such rights + might or might not be available; nor does it represent that it has + made any independent effort to identify any such rights. Information + on the procedures with respect to rights in RFC documents can be + found in BCP 78 and BCP 79. + + Copies of IPR disclosures made to the IETF Secretariat and any + assurances of licenses to be made available, or the result of an + attempt made to obtain a general license or permission for the use of + such proprietary rights by implementers or users of this + specification can be obtained from the IETF on-line IPR repository at + http://www.ietf.org/ipr. + + The IETF invites any interested party to bring to its attention any + copyrights, patents or patent applications, or other proprietary + rights that may cover technology that may be required to implement + this standard. Please address the information to the IETF at + ietf-ipr@ietf.org. + +Acknowledgement + + Funding for the RFC Editor function is provided by the IETF + Administrative Support Activity (IASA). + + + + + + + +Kolkman & Gieben Informational [Page 35] + diff --git a/lib/bind/api b/lib/bind/api index 8701441a..cee50bba 100644 --- a/lib/bind/api +++ b/lib/bind/api @@ -1,3 +1,3 @@ LIBINTERFACE = 4 -LIBREVISION = 6 +LIBREVISION = 8 LIBAGE = 0 diff --git a/lib/bind/config.h.in b/lib/bind/config.h.in index c4d88d34..69ea2854 100644 --- a/lib/bind/config.h.in +++ b/lib/bind/config.h.in @@ -11,6 +11,8 @@ #undef POSIX_GETPWNAM_R #undef POSIX_GETGRGID_R #undef POSIX_GETGRNAM_R +#undef HAVE_MEMMOVE +#undef HAVE_MEMCHR #undef NEED_SETGROUPENT #undef NEED_GETGROUPLIST @@ -38,6 +40,7 @@ #undef HAS_PW_CLASS +#undef ssize_t #undef uintptr_t /* Shut up warnings about sputaux in stdio.h on BSD/OS pre-4.1 */ diff --git a/lib/bind/configure b/lib/bind/configure index d6171dc9..403c09e0 100755 --- a/lib/bind/configure +++ b/lib/bind/configure @@ -1,5 +1,5 @@ #! /bin/sh -# From configure.in Revision: 1.90.18.29 . +# From configure.in Revision: 1.90.18.33 . # Guess values for system-dependent variables and create Makefiles. # Generated by GNU Autoconf 2.59. # @@ -464,7 +464,7 @@ ac_includes_default="\ # include <unistd.h> #endif" -ac_subst_vars='SHELL PATH_SEPARATOR PACKAGE_NAME PACKAGE_TARNAME PACKAGE_VERSION PACKAGE_STRING PACKAGE_BUGREPORT exec_prefix prefix program_transform_name bindir sbindir libexecdir datadir sysconfdir sharedstatedir localstatedir libdir includedir oldincludedir infodir mandir build_alias host_alias target_alias DEFS ECHO_C ECHO_N ECHO_T LIBS build build_cpu build_vendor build_os host host_cpu host_vendor host_os SET_MAKE RANLIB ac_ct_RANLIB INSTALL_PROGRAM INSTALL_SCRIPT INSTALL_DATA STD_CINCLUDES STD_CDEFINES STD_CWARNINGS CCOPT AR ARFLAGS LN ETAGS PERL CC CFLAGS LDFLAGS CPPFLAGS ac_ct_CC EXEEXT OBJEXT CPP EGREP ISC_PLATFORM_NEEDSYSSELECTH WANT_IRS_GR WANT_IRS_GR_OBJS WANT_IRS_PW WANT_IRS_PW_OBJS WANT_IRS_NIS WANT_IRS_NIS_OBJS WANT_IRS_NISGR_OBJS WANT_IRS_NISPW_OBJS WANT_IRS_DBPW_OBJS ALWAYS_DEFINES DO_PTHREADS WANT_IRS_THREADSGR_OBJS WANT_IRS_THREADSPW_OBJS WANT_IRS_THREADS_OBJS WANT_THREADS_OBJS USE_IFNAMELINKID ISC_THREAD_DIR DAEMON_OBJS NEED_DAEMON STRSEP_OBJS NEED_STRSEP NEED_STRERROR MKDEPCC MKDEPCFLAGS MKDEPPROG IRIX_DNSSEC_WARNINGS_HACK purify_path PURIFY LN_S ECHO ac_ct_AR STRIP ac_ct_STRIP CXX CXXFLAGS ac_ct_CXX CXXCPP F77 FFLAGS ac_ct_F77 LIBTOOL O A SA LIBTOOL_MKDEP_SED LIBTOOL_MODE_COMPILE LIBTOOL_MODE_INSTALL LIBTOOL_MODE_LINK HAS_INET6_STRUCTS ISC_PLATFORM_NEEDNETINETIN6H ISC_PLATFORM_NEEDNETINET6IN6H HAS_IN_ADDR6 NEED_IN6ADDR_ANY ISC_PLATFORM_HAVEIN6PKTINFO ISC_PLATFORM_FIXIN6ISADDR ISC_IPV6_H ISC_IPV6_O ISC_ISCIPV6_O ISC_IPV6_C HAVE_SIN6_SCOPE_ID HAVE_SOCKADDR_STORAGE ISC_PLATFORM_NEEDNTOP ISC_PLATFORM_NEEDPTON ISC_PLATFORM_NEEDATON HAVE_SA_LEN HAVE_MINIMUM_IFREQ BSD_COMP SOLARIS_BITTYPES USE_FIONBIO_IOCTL PORT_NONBLOCK PORT_DIR USE_POLL HAVE_MD5 SOLARIS2 PORT_INCLUDE ISC_PLATFORM_MSGHDRFLAVOR ISC_PLATFORM_NEEDPORTT ISC_LWRES_ENDHOSTENTINT ISC_LWRES_SETNETENTINT ISC_LWRES_ENDNETENTINT ISC_LWRES_GETHOSTBYADDRVOID ISC_LWRES_NEEDHERRNO ISC_LWRES_GETIPNODEPROTO ISC_LWRES_GETADDRINFOPROTO ISC_LWRES_GETNAMEINFOPROTO NEED_PSELECT NEED_GETTIMEOFDAY HAVE_STRNDUP ISC_PLATFORM_NEEDSTRSEP ISC_PLATFORM_NEEDVSNPRINTF ISC_EXTRA_OBJS ISC_EXTRA_SRCS USE_SYSERROR_LIST ISC_PLATFORM_QUADFORMAT ISC_SOCKLEN_T GETGROUPLIST_ARGS NET_R_ARGS NET_R_BAD NET_R_COPY NET_R_COPY_ARGS NET_R_OK NET_R_SETANSWER NET_R_RETURN GETNETBYADDR_ADDR_T NETENT_DATA NET_R_ENT_ARGS NET_R_SET_RESULT NET_R_SET_RETURN NET_R_END_RESULT NET_R_END_RETURN GROUP_R_ARGS GROUP_R_BAD GROUP_R_OK GROUP_R_RETURN GROUP_R_END_RESULT GROUP_R_END_RETURN GROUP_R_ENT_ARGS GROUP_R_SET_RESULT GROUP_R_SET_RETURN HOST_R_ARGS HOST_R_BAD HOST_R_COPY HOST_R_COPY_ARGS HOST_R_ERRNO HOST_R_OK HOST_R_RETURN HOST_R_SETANSWER HOSTENT_DATA HOST_R_END_RESULT HOST_R_END_RETURN HOST_R_ENT_ARGS HOST_R_SET_RESULT HOST_R_SET_RETURN SETPWENT_VOID SETGRENT_VOID NGR_R_ARGS NGR_R_BAD NGR_R_COPY NGR_R_COPY_ARGS NGR_R_OK NGR_R_RETURN NGR_R_PRIVATE NGR_R_END_RESULT NGR_R_END_RETURN NGR_R_ENT_ARGS NGR_R_SET_RESULT NGR_R_SET_RETURN PROTO_R_ARGS PROTO_R_BAD PROTO_R_COPY PROTO_R_COPY_ARGS PROTO_R_OK PROTO_R_SETANSWER PROTO_R_RETURN PROTOENT_DATA PROTO_R_END_RESULT PROTO_R_END_RETURN PROTO_R_ENT_ARGS PROTO_R_ENT_UNUSED PROTO_R_SET_RESULT PROTO_R_SET_RETURN PASS_R_ARGS PASS_R_BAD PASS_R_COPY PASS_R_COPY_ARGS PASS_R_OK PASS_R_RETURN PASS_R_END_RESULT PASS_R_END_RETURN PASS_R_ENT_ARGS PASS_R_SET_RESULT PASS_R_SET_RETURN SERV_R_ARGS SERV_R_BAD SERV_R_COPY SERV_R_COPY_ARGS SERV_R_OK SERV_R_SETANSWER SERV_R_RETURN SERVENT_DATA SERV_R_END_RESULT SERV_R_END_RETURN SERV_R_ENT_ARGS SERV_R_ENT_UNUSED SERV_R_SET_RESULT SERV_R_SET_RETURN SETNETGRENT_ARGS INNETGR_ARGS BIND9_TOP_BUILDDIR BIND9_VERSION LIBOBJS LTLIBOBJS' +ac_subst_vars='SHELL PATH_SEPARATOR PACKAGE_NAME PACKAGE_TARNAME PACKAGE_VERSION PACKAGE_STRING PACKAGE_BUGREPORT exec_prefix prefix program_transform_name bindir sbindir libexecdir datadir sysconfdir sharedstatedir localstatedir libdir includedir oldincludedir infodir mandir build_alias host_alias target_alias DEFS ECHO_C ECHO_N ECHO_T LIBS build build_cpu build_vendor build_os host host_cpu host_vendor host_os SET_MAKE RANLIB ac_ct_RANLIB INSTALL_PROGRAM INSTALL_SCRIPT INSTALL_DATA STD_CINCLUDES STD_CDEFINES STD_CWARNINGS CCOPT AR ARFLAGS LN ETAGS PERL CC CFLAGS LDFLAGS CPPFLAGS ac_ct_CC EXEEXT OBJEXT CPP EGREP ISC_PLATFORM_NEEDSYSSELECTH WANT_IRS_GR WANT_IRS_GR_OBJS WANT_IRS_PW WANT_IRS_PW_OBJS WANT_IRS_NIS WANT_IRS_NIS_OBJS WANT_IRS_NISGR_OBJS WANT_IRS_NISPW_OBJS WANT_IRS_DBPW_OBJS ALWAYS_DEFINES DO_PTHREADS WANT_IRS_THREADSGR_OBJS WANT_IRS_THREADSPW_OBJS WANT_IRS_THREADS_OBJS WANT_THREADS_OBJS USE_IFNAMELINKID ISC_THREAD_DIR DAEMON_OBJS NEED_DAEMON STRSEP_OBJS NEED_STRSEP NEED_STRERROR MKDEPCC MKDEPCFLAGS MKDEPPROG IRIX_DNSSEC_WARNINGS_HACK purify_path PURIFY LN_S ECHO ac_ct_AR STRIP ac_ct_STRIP CXX CXXFLAGS ac_ct_CXX CXXCPP F77 FFLAGS ac_ct_F77 LIBTOOL O A SA LIBTOOL_MKDEP_SED LIBTOOL_MODE_COMPILE LIBTOOL_MODE_INSTALL LIBTOOL_MODE_LINK HAS_INET6_STRUCTS ISC_PLATFORM_NEEDNETINETIN6H ISC_PLATFORM_NEEDNETINET6IN6H HAS_IN_ADDR6 NEED_IN6ADDR_ANY ISC_PLATFORM_HAVEIN6PKTINFO ISC_PLATFORM_FIXIN6ISADDR ISC_IPV6_H ISC_IPV6_O ISC_ISCIPV6_O ISC_IPV6_C HAVE_SIN6_SCOPE_ID HAVE_SOCKADDR_STORAGE ISC_PLATFORM_NEEDNTOP ISC_PLATFORM_NEEDPTON ISC_PLATFORM_NEEDATON HAVE_SA_LEN HAVE_MINIMUM_IFREQ BSD_COMP SOLARIS_BITTYPES USE_FIONBIO_IOCTL PORT_NONBLOCK PORT_DIR USE_POLL HAVE_MD5 SOLARIS2 PORT_INCLUDE ISC_PLATFORM_MSGHDRFLAVOR ISC_PLATFORM_NEEDPORTT ISC_PLATFORM_NEEDTIMESPEC ISC_LWRES_ENDHOSTENTINT ISC_LWRES_SETNETENTINT ISC_LWRES_ENDNETENTINT ISC_LWRES_GETHOSTBYADDRVOID ISC_LWRES_NEEDHERRNO ISC_LWRES_GETIPNODEPROTO ISC_LWRES_GETADDRINFOPROTO ISC_LWRES_GETNAMEINFOPROTO NEED_PSELECT NEED_GETTIMEOFDAY HAVE_STRNDUP ISC_PLATFORM_NEEDSTRSEP ISC_PLATFORM_NEEDVSNPRINTF ISC_EXTRA_OBJS ISC_EXTRA_SRCS USE_SYSERROR_LIST ISC_PLATFORM_QUADFORMAT ISC_SOCKLEN_T GETGROUPLIST_ARGS NET_R_ARGS NET_R_BAD NET_R_COPY NET_R_COPY_ARGS NET_R_OK NET_R_SETANSWER NET_R_RETURN GETNETBYADDR_ADDR_T NETENT_DATA NET_R_ENT_ARGS NET_R_SET_RESULT NET_R_SET_RETURN NET_R_END_RESULT NET_R_END_RETURN GROUP_R_ARGS GROUP_R_BAD GROUP_R_OK GROUP_R_RETURN GROUP_R_END_RESULT GROUP_R_END_RETURN GROUP_R_ENT_ARGS GROUP_R_SET_RESULT GROUP_R_SET_RETURN HOST_R_ARGS HOST_R_BAD HOST_R_COPY HOST_R_COPY_ARGS HOST_R_ERRNO HOST_R_OK HOST_R_RETURN HOST_R_SETANSWER HOSTENT_DATA HOST_R_END_RESULT HOST_R_END_RETURN HOST_R_ENT_ARGS HOST_R_SET_RESULT HOST_R_SET_RETURN SETPWENT_VOID SETGRENT_VOID NGR_R_ARGS NGR_R_BAD NGR_R_COPY NGR_R_COPY_ARGS NGR_R_OK NGR_R_RETURN NGR_R_PRIVATE NGR_R_END_RESULT NGR_R_END_RETURN NGR_R_ENT_ARGS NGR_R_SET_RESULT NGR_R_SET_RETURN PROTO_R_ARGS PROTO_R_BAD PROTO_R_COPY PROTO_R_COPY_ARGS PROTO_R_OK PROTO_R_SETANSWER PROTO_R_RETURN PROTOENT_DATA PROTO_R_END_RESULT PROTO_R_END_RETURN PROTO_R_ENT_ARGS PROTO_R_ENT_UNUSED PROTO_R_SET_RESULT PROTO_R_SET_RETURN PASS_R_ARGS PASS_R_BAD PASS_R_COPY PASS_R_COPY_ARGS PASS_R_OK PASS_R_RETURN PASS_R_END_RESULT PASS_R_END_RETURN PASS_R_ENT_ARGS PASS_R_SET_RESULT PASS_R_SET_RETURN SERV_R_ARGS SERV_R_BAD SERV_R_COPY SERV_R_COPY_ARGS SERV_R_OK SERV_R_SETANSWER SERV_R_RETURN SERVENT_DATA SERV_R_END_RESULT SERV_R_END_RETURN SERV_R_ENT_ARGS SERV_R_ENT_UNUSED SERV_R_SET_RESULT SERV_R_SET_RETURN SETNETGRENT_ARGS INNETGR_ARGS BIND9_TOP_BUILDDIR BIND9_VERSION LIBOBJS LTLIBOBJS' ac_subst_files='BIND9_INCLUDES BIND9_MAKE_RULES LIBBIND_API' # Initialize some variables set by options. @@ -3867,6 +3867,72 @@ _ACEOF fi +echo "$as_me:$LINENO: checking for ssize_t" >&5 +echo $ECHO_N "checking for ssize_t... $ECHO_C" >&6 +if test "${ac_cv_type_ssize_t+set}" = set; then + echo $ECHO_N "(cached) $ECHO_C" >&6 +else + cat >conftest.$ac_ext <<_ACEOF +/* confdefs.h. */ +_ACEOF +cat confdefs.h >>conftest.$ac_ext +cat >>conftest.$ac_ext <<_ACEOF +/* end confdefs.h. */ +$ac_includes_default +int +main () +{ +if ((ssize_t *) 0) + return 0; +if (sizeof (ssize_t)) + return 0; + ; + return 0; +} +_ACEOF +rm -f conftest.$ac_objext +if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5 + (eval $ac_compile) 2>conftest.er1 + ac_status=$? + grep -v '^ *+' conftest.er1 >conftest.err + rm -f conftest.er1 + cat conftest.err >&5 + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); } && + { ac_try='test -z "$ac_c_werror_flag" + || test ! -s conftest.err' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; } && + { ac_try='test -s conftest.$ac_objext' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; }; then + ac_cv_type_ssize_t=yes +else + echo "$as_me: failed program was:" >&5 +sed 's/^/| /' conftest.$ac_ext >&5 + +ac_cv_type_ssize_t=no +fi +rm -f conftest.err conftest.$ac_objext conftest.$ac_ext +fi +echo "$as_me:$LINENO: result: $ac_cv_type_ssize_t" >&5 +echo "${ECHO_T}$ac_cv_type_ssize_t" >&6 +if test $ac_cv_type_ssize_t = yes; then + : +else + +cat >>confdefs.h <<_ACEOF +#define ssize_t signed +_ACEOF + +fi + echo "$as_me:$LINENO: checking for uintptr_t" >&5 echo $ECHO_N "checking for uintptr_t... $ECHO_C" >&6 if test "${ac_cv_type_uintptr_t+set}" = set; then @@ -6340,6 +6406,200 @@ _ACEOF fi +echo "$as_me:$LINENO: checking for memmove" >&5 +echo $ECHO_N "checking for memmove... $ECHO_C" >&6 +if test "${ac_cv_func_memmove+set}" = set; then + echo $ECHO_N "(cached) $ECHO_C" >&6 +else + cat >conftest.$ac_ext <<_ACEOF +/* confdefs.h. */ +_ACEOF +cat confdefs.h >>conftest.$ac_ext +cat >>conftest.$ac_ext <<_ACEOF +/* end confdefs.h. */ +/* Define memmove to an innocuous variant, in case <limits.h> declares memmove. + For example, HP-UX 11i <limits.h> declares gettimeofday. */ +#define memmove innocuous_memmove + +/* System header to define __stub macros and hopefully few prototypes, + which can conflict with char memmove (); below. + Prefer <limits.h> to <assert.h> if __STDC__ is defined, since + <limits.h> exists even on freestanding compilers. */ + +#ifdef __STDC__ +# include <limits.h> +#else +# include <assert.h> +#endif + +#undef memmove + +/* Override any gcc2 internal prototype to avoid an error. */ +#ifdef __cplusplus +extern "C" +{ +#endif +/* We use char because int might match the return type of a gcc2 + builtin and then its argument prototype would still apply. */ +char memmove (); +/* The GNU C library defines this for functions which it implements + to always fail with ENOSYS. Some functions are actually named + something starting with __ and the normal name is an alias. */ +#if defined (__stub_memmove) || defined (__stub___memmove) +choke me +#else +char (*f) () = memmove; +#endif +#ifdef __cplusplus +} +#endif + +int +main () +{ +return f != memmove; + ; + return 0; +} +_ACEOF +rm -f conftest.$ac_objext conftest$ac_exeext +if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5 + (eval $ac_link) 2>conftest.er1 + ac_status=$? + grep -v '^ *+' conftest.er1 >conftest.err + rm -f conftest.er1 + cat conftest.err >&5 + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); } && + { ac_try='test -z "$ac_c_werror_flag" + || test ! -s conftest.err' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; } && + { ac_try='test -s conftest$ac_exeext' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; }; then + ac_cv_func_memmove=yes +else + echo "$as_me: failed program was:" >&5 +sed 's/^/| /' conftest.$ac_ext >&5 + +ac_cv_func_memmove=no +fi +rm -f conftest.err conftest.$ac_objext \ + conftest$ac_exeext conftest.$ac_ext +fi +echo "$as_me:$LINENO: result: $ac_cv_func_memmove" >&5 +echo "${ECHO_T}$ac_cv_func_memmove" >&6 +if test $ac_cv_func_memmove = yes; then + cat >>confdefs.h <<\_ACEOF +#define HAVE_MEMMOVE 1 +_ACEOF + +fi + +echo "$as_me:$LINENO: checking for memchr" >&5 +echo $ECHO_N "checking for memchr... $ECHO_C" >&6 +if test "${ac_cv_func_memchr+set}" = set; then + echo $ECHO_N "(cached) $ECHO_C" >&6 +else + cat >conftest.$ac_ext <<_ACEOF +/* confdefs.h. */ +_ACEOF +cat confdefs.h >>conftest.$ac_ext +cat >>conftest.$ac_ext <<_ACEOF +/* end confdefs.h. */ +/* Define memchr to an innocuous variant, in case <limits.h> declares memchr. + For example, HP-UX 11i <limits.h> declares gettimeofday. */ +#define memchr innocuous_memchr + +/* System header to define __stub macros and hopefully few prototypes, + which can conflict with char memchr (); below. + Prefer <limits.h> to <assert.h> if __STDC__ is defined, since + <limits.h> exists even on freestanding compilers. */ + +#ifdef __STDC__ +# include <limits.h> +#else +# include <assert.h> +#endif + +#undef memchr + +/* Override any gcc2 internal prototype to avoid an error. */ +#ifdef __cplusplus +extern "C" +{ +#endif +/* We use char because int might match the return type of a gcc2 + builtin and then its argument prototype would still apply. */ +char memchr (); +/* The GNU C library defines this for functions which it implements + to always fail with ENOSYS. Some functions are actually named + something starting with __ and the normal name is an alias. */ +#if defined (__stub_memchr) || defined (__stub___memchr) +choke me +#else +char (*f) () = memchr; +#endif +#ifdef __cplusplus +} +#endif + +int +main () +{ +return f != memchr; + ; + return 0; +} +_ACEOF +rm -f conftest.$ac_objext conftest$ac_exeext +if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5 + (eval $ac_link) 2>conftest.er1 + ac_status=$? + grep -v '^ *+' conftest.er1 >conftest.err + rm -f conftest.er1 + cat conftest.err >&5 + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); } && + { ac_try='test -z "$ac_c_werror_flag" + || test ! -s conftest.err' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; } && + { ac_try='test -s conftest$ac_exeext' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; }; then + ac_cv_func_memchr=yes +else + echo "$as_me: failed program was:" >&5 +sed 's/^/| /' conftest.$ac_ext >&5 + +ac_cv_func_memchr=no +fi +rm -f conftest.err conftest.$ac_objext \ + conftest$ac_exeext conftest.$ac_ext +fi +echo "$as_me:$LINENO: result: $ac_cv_func_memchr" >&5 +echo "${ECHO_T}$ac_cv_func_memchr" >&6 +if test $ac_cv_func_memchr = yes; then + cat >>confdefs.h <<\_ACEOF +#define HAVE_MEMCHR 1 +_ACEOF + +fi + echo "$as_me:$LINENO: checking for if_nametoindex" >&5 echo $ECHO_N "checking for if_nametoindex... $ECHO_C" >&6 @@ -8126,7 +8386,7 @@ ia64-*-hpux*) ;; *-*-irix6*) # Find out which ABI we are using. - echo '#line 8129 "configure"' > conftest.$ac_ext + echo '#line 8389 "configure"' > conftest.$ac_ext if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5 (eval $ac_compile) 2>&5 ac_status=$? @@ -9123,7 +9383,7 @@ fi # Provide some information about the compiler. -echo "$as_me:9126:" \ +echo "$as_me:9386:" \ "checking for Fortran 77 compiler version" >&5 ac_compiler=`set X $ac_compile; echo $2` { (eval echo "$as_me:$LINENO: \"$ac_compiler --version </dev/null >&5\"") >&5 @@ -10184,11 +10444,11 @@ else -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` - (eval echo "\"\$as_me:10187: $lt_compile\"" >&5) + (eval echo "\"\$as_me:10447: $lt_compile\"" >&5) (eval "$lt_compile" 2>conftest.err) ac_status=$? cat conftest.err >&5 - echo "$as_me:10191: \$? = $ac_status" >&5 + echo "$as_me:10451: \$? = $ac_status" >&5 if (exit $ac_status) && test -s "$ac_outfile"; then # The compiler can only warn and ignore the option if not recognized # So say no if there are warnings @@ -10427,11 +10687,11 @@ else -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` - (eval echo "\"\$as_me:10430: $lt_compile\"" >&5) + (eval echo "\"\$as_me:10690: $lt_compile\"" >&5) (eval "$lt_compile" 2>conftest.err) ac_status=$? cat conftest.err >&5 - echo "$as_me:10434: \$? = $ac_status" >&5 + echo "$as_me:10694: \$? = $ac_status" >&5 if (exit $ac_status) && test -s "$ac_outfile"; then # The compiler can only warn and ignore the option if not recognized # So say no if there are warnings @@ -10487,11 +10747,11 @@ else -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` - (eval echo "\"\$as_me:10490: $lt_compile\"" >&5) + (eval echo "\"\$as_me:10750: $lt_compile\"" >&5) (eval "$lt_compile" 2>out/conftest.err) ac_status=$? cat out/conftest.err >&5 - echo "$as_me:10494: \$? = $ac_status" >&5 + echo "$as_me:10754: \$? = $ac_status" >&5 if (exit $ac_status) && test -s out/conftest2.$ac_objext then # The compiler can only warn and ignore the option if not recognized @@ -12672,7 +12932,7 @@ else lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2 lt_status=$lt_dlunknown cat > conftest.$ac_ext <<EOF -#line 12675 "configure" +#line 12935 "configure" #include "confdefs.h" #if HAVE_DLFCN_H @@ -12770,7 +13030,7 @@ else lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2 lt_status=$lt_dlunknown cat > conftest.$ac_ext <<EOF -#line 12773 "configure" +#line 13033 "configure" #include "confdefs.h" #if HAVE_DLFCN_H @@ -14967,11 +15227,11 @@ else -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` - (eval echo "\"\$as_me:14970: $lt_compile\"" >&5) + (eval echo "\"\$as_me:15230: $lt_compile\"" >&5) (eval "$lt_compile" 2>conftest.err) ac_status=$? cat conftest.err >&5 - echo "$as_me:14974: \$? = $ac_status" >&5 + echo "$as_me:15234: \$? = $ac_status" >&5 if (exit $ac_status) && test -s "$ac_outfile"; then # The compiler can only warn and ignore the option if not recognized # So say no if there are warnings @@ -15027,11 +15287,11 @@ else -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` - (eval echo "\"\$as_me:15030: $lt_compile\"" >&5) + (eval echo "\"\$as_me:15290: $lt_compile\"" >&5) (eval "$lt_compile" 2>out/conftest.err) ac_status=$? cat out/conftest.err >&5 - echo "$as_me:15034: \$? = $ac_status" >&5 + echo "$as_me:15294: \$? = $ac_status" >&5 if (exit $ac_status) && test -s out/conftest2.$ac_objext then # The compiler can only warn and ignore the option if not recognized @@ -16388,7 +16648,7 @@ else lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2 lt_status=$lt_dlunknown cat > conftest.$ac_ext <<EOF -#line 16391 "configure" +#line 16651 "configure" #include "confdefs.h" #if HAVE_DLFCN_H @@ -16486,7 +16746,7 @@ else lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2 lt_status=$lt_dlunknown cat > conftest.$ac_ext <<EOF -#line 16489 "configure" +#line 16749 "configure" #include "confdefs.h" #if HAVE_DLFCN_H @@ -17323,11 +17583,11 @@ else -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` - (eval echo "\"\$as_me:17326: $lt_compile\"" >&5) + (eval echo "\"\$as_me:17586: $lt_compile\"" >&5) (eval "$lt_compile" 2>conftest.err) ac_status=$? cat conftest.err >&5 - echo "$as_me:17330: \$? = $ac_status" >&5 + echo "$as_me:17590: \$? = $ac_status" >&5 if (exit $ac_status) && test -s "$ac_outfile"; then # The compiler can only warn and ignore the option if not recognized # So say no if there are warnings @@ -17383,11 +17643,11 @@ else -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` - (eval echo "\"\$as_me:17386: $lt_compile\"" >&5) + (eval echo "\"\$as_me:17646: $lt_compile\"" >&5) (eval "$lt_compile" 2>out/conftest.err) ac_status=$? cat out/conftest.err >&5 - echo "$as_me:17390: \$? = $ac_status" >&5 + echo "$as_me:17650: \$? = $ac_status" >&5 if (exit $ac_status) && test -s out/conftest2.$ac_objext then # The compiler can only warn and ignore the option if not recognized @@ -19422,11 +19682,11 @@ else -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` - (eval echo "\"\$as_me:19425: $lt_compile\"" >&5) + (eval echo "\"\$as_me:19685: $lt_compile\"" >&5) (eval "$lt_compile" 2>conftest.err) ac_status=$? cat conftest.err >&5 - echo "$as_me:19429: \$? = $ac_status" >&5 + echo "$as_me:19689: \$? = $ac_status" >&5 if (exit $ac_status) && test -s "$ac_outfile"; then # The compiler can only warn and ignore the option if not recognized # So say no if there are warnings @@ -19665,11 +19925,11 @@ else -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` - (eval echo "\"\$as_me:19668: $lt_compile\"" >&5) + (eval echo "\"\$as_me:19928: $lt_compile\"" >&5) (eval "$lt_compile" 2>conftest.err) ac_status=$? cat conftest.err >&5 - echo "$as_me:19672: \$? = $ac_status" >&5 + echo "$as_me:19932: \$? = $ac_status" >&5 if (exit $ac_status) && test -s "$ac_outfile"; then # The compiler can only warn and ignore the option if not recognized # So say no if there are warnings @@ -19725,11 +19985,11 @@ else -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` - (eval echo "\"\$as_me:19728: $lt_compile\"" >&5) + (eval echo "\"\$as_me:19988: $lt_compile\"" >&5) (eval "$lt_compile" 2>out/conftest.err) ac_status=$? cat out/conftest.err >&5 - echo "$as_me:19732: \$? = $ac_status" >&5 + echo "$as_me:19992: \$? = $ac_status" >&5 if (exit $ac_status) && test -s out/conftest2.$ac_objext then # The compiler can only warn and ignore the option if not recognized @@ -21910,7 +22170,7 @@ else lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2 lt_status=$lt_dlunknown cat > conftest.$ac_ext <<EOF -#line 21913 "configure" +#line 22173 "configure" #include "confdefs.h" #if HAVE_DLFCN_H @@ -22008,7 +22268,7 @@ else lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2 lt_status=$lt_dlunknown cat > conftest.$ac_ext <<EOF -#line 22011 "configure" +#line 22271 "configure" #include "confdefs.h" #if HAVE_DLFCN_H @@ -23473,10 +23733,22 @@ echo "${ECHO_T}no -- disabling runtime ipv6 support" >&6 ISC_PLATFORM_HAVEIN6PKTINFO="#undef ISC_PLATFORM_HAVEIN6PKTINFO" fi rm -f conftest.err conftest.$ac_objext conftest.$ac_ext + ;; + no) + HAS_INET6_STRUCTS="#undef HAS_INET6_STRUCTS" + NEED_IN6ADDR_ANY="#undef NEED_IN6ADDR_ANY" + ISC_PLATFORM_HAVEIN6PKTINFO="#undef ISC_PLATFORM_HAVEIN6PKTINFO" + HAVE_SIN6_SCOPE_ID="#define HAVE_SIN6_SCOPE_ID 1" + ISC_IPV6_H="ipv6.h" + ISC_IPV6_O="ipv6.$O" + ISC_ISCIPV6_O="unix/ipv6.$O" + ISC_IPV6_C="ipv6.c" + ;; +esac - echo "$as_me:$LINENO: checking for sockaddr_storage" >&5 +echo "$as_me:$LINENO: checking for sockaddr_storage" >&5 echo $ECHO_N "checking for sockaddr_storage... $ECHO_C" >&6 - cat >conftest.$ac_ext <<_ACEOF +cat >conftest.$ac_ext <<_ACEOF /* confdefs.h. */ _ACEOF cat confdefs.h >>conftest.$ac_ext @@ -23486,8 +23758,6 @@ cat >>conftest.$ac_ext <<_ACEOF #include <sys/types.h> #include <sys/socket.h> #include <netinet/in.h> -$isc_netinetin6_hack -$isc_netinet6in6_hack int main () @@ -23521,29 +23791,16 @@ if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5 (exit $ac_status); }; }; then echo "$as_me:$LINENO: result: yes" >&5 echo "${ECHO_T}yes" >&6 - HAVE_SOCKADDR_STORAGE="#define HAVE_SOCKADDR_STORAGE 1" + HAVE_SOCKADDR_STORAGE="#define HAVE_SOCKADDR_STORAGE 1" else echo "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 echo "$as_me:$LINENO: result: no" >&5 echo "${ECHO_T}no" >&6 - HAVE_SOCKADDR_STORAGE="#undef HAVE_SOCKADDR_STORAGE" + HAVE_SOCKADDR_STORAGE="#undef HAVE_SOCKADDR_STORAGE" fi rm -f conftest.err conftest.$ac_objext conftest.$ac_ext - ;; - no) - HAS_INET6_STRUCTS="#undef HAS_INET6_STRUCTS" - NEED_IN6ADDR_ANY="#undef NEED_IN6ADDR_ANY" - ISC_PLATFORM_HAVEIN6PKTINFO="#undef ISC_PLATFORM_HAVEIN6PKTINFO" - HAVE_SIN6_SCOPE_ID="#define HAVE_SIN6_SCOPE_ID 1" - HAVE_SOCKADDR_STORAGE="#undef HAVE_SOCKADDR_STORAGE" - ISC_IPV6_H="ipv6.h" - ISC_IPV6_O="ipv6.$O" - ISC_ISCIPV6_O="unix/ipv6.$O" - ISC_IPV6_C="ipv6.c" - ;; -esac @@ -24022,6 +24279,61 @@ fi rm -f conftest.err conftest.$ac_objext conftest.$ac_ext +echo "$as_me:$LINENO: checking for struct timespec" >&5 +echo $ECHO_N "checking for struct timespec... $ECHO_C" >&6 +cat >conftest.$ac_ext <<_ACEOF +/* confdefs.h. */ +_ACEOF +cat confdefs.h >>conftest.$ac_ext +cat >>conftest.$ac_ext <<_ACEOF +/* end confdefs.h. */ + +#include <sys/types.h> +#include <time.h> +int +main () +{ +struct timespec ts = { 0, 0 }; return (0); + ; + return 0; +} +_ACEOF +rm -f conftest.$ac_objext +if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5 + (eval $ac_compile) 2>conftest.er1 + ac_status=$? + grep -v '^ *+' conftest.er1 >conftest.err + rm -f conftest.er1 + cat conftest.err >&5 + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); } && + { ac_try='test -z "$ac_c_werror_flag" + || test ! -s conftest.err' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; } && + { ac_try='test -s conftest.$ac_objext' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; }; then + echo "$as_me:$LINENO: result: yes" >&5 +echo "${ECHO_T}yes" >&6 + ISC_PLATFORM_NEEDTIMESPEC="#undef ISC_PLATFORM_NEEDTIMESPEC" +else + echo "$as_me: failed program was:" >&5 +sed 's/^/| /' conftest.$ac_ext >&5 + +echo "$as_me:$LINENO: result: no" >&5 +echo "${ECHO_T}no" >&6 + ISC_PLATFORM_NEEDTIMESPEC="#define ISC_PLATFORM_NEEDTIMESPEC 1" +fi +rm -f conftest.err conftest.$ac_objext conftest.$ac_ext + + # # Check for addrinfo # @@ -32893,6 +33205,7 @@ s,@SOLARIS2@,$SOLARIS2,;t t s,@PORT_INCLUDE@,$PORT_INCLUDE,;t t s,@ISC_PLATFORM_MSGHDRFLAVOR@,$ISC_PLATFORM_MSGHDRFLAVOR,;t t s,@ISC_PLATFORM_NEEDPORTT@,$ISC_PLATFORM_NEEDPORTT,;t t +s,@ISC_PLATFORM_NEEDTIMESPEC@,$ISC_PLATFORM_NEEDTIMESPEC,;t t s,@ISC_LWRES_ENDHOSTENTINT@,$ISC_LWRES_ENDHOSTENTINT,;t t s,@ISC_LWRES_SETNETENTINT@,$ISC_LWRES_SETNETENTINT,;t t s,@ISC_LWRES_ENDNETENTINT@,$ISC_LWRES_ENDNETENTINT,;t t diff --git a/lib/bind/configure.in b/lib/bind/configure.in index 34318187..e97b3a87 100644 --- a/lib/bind/configure.in +++ b/lib/bind/configure.in @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -AC_REVISION($Revision: 1.90.18.31 $) +AC_REVISION($Revision: 1.90.18.33 $) AC_INIT(resolv/herror.c) AC_PREREQ(2.13) @@ -174,6 +174,7 @@ AC_CHECK_HEADERS(fcntl.h db.h paths.h sys/time.h unistd.h sys/sockio.h sys/selec AC_C_CONST AC_C_INLINE AC_TYPE_SIZE_T +AC_CHECK_TYPE(ssize_t,signed) AC_CHECK_TYPE(uintptr_t,unsigned long) AC_HEADER_TIME # @@ -458,6 +459,8 @@ AC_SUBST(WANT_IRS_THREADS_OBJS) AC_SUBST(WANT_THREADS_OBJS) AC_CHECK_FUNC(strlcat, AC_DEFINE(HAVE_STRLCAT)) +AC_CHECK_FUNC(memmove, AC_DEFINE(HAVE_MEMMOVE)) +AC_CHECK_FUNC(memchr, AC_DEFINE(HAVE_MEMCHR)) AC_CHECK_FUNC(if_nametoindex, [USE_IFNAMELINKID="#define USE_IFNAMELINKID 1"], @@ -879,27 +882,12 @@ $isc_netinet6in6_hack ISC_PLATFORM_HAVEIN6PKTINFO="#define ISC_PLATFORM_HAVEIN6PKTINFO 1"], [AC_MSG_RESULT(no -- disabling runtime ipv6 support) ISC_PLATFORM_HAVEIN6PKTINFO="#undef ISC_PLATFORM_HAVEIN6PKTINFO"]) - - AC_MSG_CHECKING(for sockaddr_storage) - AC_TRY_COMPILE([ -#include <sys/types.h> -#include <sys/socket.h> -#include <netinet/in.h> -$isc_netinetin6_hack -$isc_netinet6in6_hack -], - [struct sockaddr_storage xyzzy; return (0);], - [AC_MSG_RESULT(yes) - HAVE_SOCKADDR_STORAGE="#define HAVE_SOCKADDR_STORAGE 1"], - [AC_MSG_RESULT(no) - HAVE_SOCKADDR_STORAGE="#undef HAVE_SOCKADDR_STORAGE"]) ;; no) HAS_INET6_STRUCTS="#undef HAS_INET6_STRUCTS" NEED_IN6ADDR_ANY="#undef NEED_IN6ADDR_ANY" ISC_PLATFORM_HAVEIN6PKTINFO="#undef ISC_PLATFORM_HAVEIN6PKTINFO" HAVE_SIN6_SCOPE_ID="#define HAVE_SIN6_SCOPE_ID 1" - HAVE_SOCKADDR_STORAGE="#undef HAVE_SOCKADDR_STORAGE" ISC_IPV6_H="ipv6.h" ISC_IPV6_O="ipv6.$O" ISC_ISCIPV6_O="unix/ipv6.$O" @@ -907,6 +895,18 @@ $isc_netinet6in6_hack ;; esac +AC_MSG_CHECKING(for sockaddr_storage) +AC_TRY_COMPILE([ +#include <sys/types.h> +#include <sys/socket.h> +#include <netinet/in.h> +], +[struct sockaddr_storage xyzzy; return (0);], + [AC_MSG_RESULT(yes) + HAVE_SOCKADDR_STORAGE="#define HAVE_SOCKADDR_STORAGE 1"], + [AC_MSG_RESULT(no) + HAVE_SOCKADDR_STORAGE="#undef HAVE_SOCKADDR_STORAGE"]) + AC_SUBST(HAS_INET6_STRUCTS) AC_SUBST(ISC_PLATFORM_NEEDNETINETIN6H) AC_SUBST(ISC_PLATFORM_NEEDNETINET6IN6H) @@ -1117,6 +1117,17 @@ AC_TRY_COMPILE([ ISC_PLATFORM_NEEDPORTT="#define ISC_PLATFORM_NEEDPORTT 1"]) AC_SUBST(ISC_PLATFORM_NEEDPORTT) +AC_MSG_CHECKING(for struct timespec) +AC_TRY_COMPILE([ +#include <sys/types.h> +#include <time.h>], +[struct timespec ts = { 0, 0 }; return (0);], + [AC_MSG_RESULT(yes) + ISC_PLATFORM_NEEDTIMESPEC="#undef ISC_PLATFORM_NEEDTIMESPEC"], + [AC_MSG_RESULT(no) + ISC_PLATFORM_NEEDTIMESPEC="#define ISC_PLATFORM_NEEDTIMESPEC 1"]) +AC_SUBST(ISC_PLATFORM_NEEDTIMESPEC) + # # Check for addrinfo # diff --git a/lib/bind/dst/hmac_link.c b/lib/bind/dst/hmac_link.c index d4f0a2a9..ce629412 100644 --- a/lib/bind/dst/hmac_link.c +++ b/lib/bind/dst/hmac_link.c @@ -1,6 +1,6 @@ #ifdef HMAC_MD5 #ifndef LINT -static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/hmac_link.c,v 1.3.164.3 2006/03/10 00:20:08 marka Exp $"; +static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/hmac_link.c,v 1.3.164.4 2007/02/26 02:00:24 marka Exp $"; #endif /* * Portions Copyright (c) 1995-1998 by Trusted Information Systems, Inc. @@ -276,13 +276,18 @@ dst_hmac_md5_key_to_file_format(const DST_KEY *dkey, char *buff, const int buff_len) { char *bp; - int len, b_len, i, key_len; + int len, i, key_len; u_char key[HMAC_LEN]; HMAC_Key *hkey; if (dkey == NULL || dkey->dk_KEY_struct == NULL) return (0); - if (buff == NULL || buff_len <= (int) strlen(key_file_fmt_str)) + /* + * Using snprintf() would be so much simpler here. + */ + if (buff == NULL || + buff_len <= (int)(strlen(key_file_fmt_str) + + strlen(KEY_FILE_FORMAT) + 4)) return (-1); /*%< no OR not enough space in output area */ hkey = (HMAC_Key *) dkey->dk_KEY_struct; memset(buff, 0, buff_len); /*%< just in case */ @@ -290,7 +295,6 @@ dst_hmac_md5_key_to_file_format(const DST_KEY *dkey, char *buff, sprintf(buff, key_file_fmt_str, KEY_FILE_FORMAT, KEY_HMAC_MD5, "HMAC"); bp = buff + strlen(buff); - b_len = buff_len - (bp - buff); memset(key, 0, HMAC_LEN); for (i = 0; i < HMAC_LEN; i++) @@ -300,19 +304,21 @@ dst_hmac_md5_key_to_file_format(const DST_KEY *dkey, char *buff, break; key_len = i + 1; + if (buff_len - (bp - buff) < 6) + return (-1); strcat(bp, "Key: "); bp += strlen("Key: "); - b_len = buff_len - (bp - buff); - len = b64_ntop(key, key_len, bp, b_len); + len = b64_ntop(key, key_len, bp, buff_len - (bp - buff)); if (len < 0) return (-1); bp += len; + if (buff_len - (bp - buff) < 2) + return (-1); *(bp++) = '\n'; *bp = '\0'; - b_len = buff_len - (bp - buff); - return (buff_len - b_len); + return (bp - buff); } diff --git a/lib/bind/irs/gai_strerror.c b/lib/bind/irs/gai_strerror.c index 29196a0a..90e90cdd 100644 --- a/lib/bind/irs/gai_strerror.c +++ b/lib/bind/irs/gai_strerror.c @@ -68,8 +68,10 @@ gai_strerror(int ecode) { if (pthread_mutex_lock(&lock) != 0) goto unknown; if (!once) { - if (pthread_key_create(&key, free) != 0) + if (pthread_key_create(&key, free) != 0) { + pthread_mutex_unlock(&lock); goto unknown; + } once = 1; } if (pthread_mutex_unlock(&lock) != 0) diff --git a/lib/bind/irs/irs_data.c b/lib/bind/irs/irs_data.c index b71bc33f..0c55f1c0 100644 --- a/lib/bind/irs/irs_data.c +++ b/lib/bind/irs/irs_data.c @@ -16,7 +16,7 @@ */ #if !defined(LINT) && !defined(CODECENTER) -static const char rcsid[] = "$Id: irs_data.c,v 1.7.18.3 2006/03/10 00:20:08 marka Exp $"; +static const char rcsid[] = "$Id: irs_data.c,v 1.7.18.4 2007/02/26 00:05:34 marka Exp $"; #endif #include "port_before.h" @@ -132,8 +132,10 @@ net_data_init(const char *conf_file) { if (pthread_mutex_lock(&keylock) != 0) return (NULL); if (!once) { - if (pthread_key_create(&key, net_data_destroy) != 0) + if (pthread_key_create(&key, net_data_destroy) != 0) { + pthread_mutex_unlock(&keylock); return (NULL); + } once = 1; } if (pthread_mutex_unlock(&keylock) != 0) diff --git a/lib/bind/isc/ctl_clnt.c b/lib/bind/isc/ctl_clnt.c index 7dcf1be2..eca8e7fc 100644 --- a/lib/bind/isc/ctl_clnt.c +++ b/lib/bind/isc/ctl_clnt.c @@ -1,5 +1,5 @@ #if !defined(lint) && !defined(SABER) -static const char rcsid[] = "$Id: ctl_clnt.c,v 1.7.18.1 2005/04/27 05:01:05 sra Exp $"; +static const char rcsid[] = "$Id: ctl_clnt.c,v 1.7.18.2 2007/05/18 06:24:39 marka Exp $"; #endif /* not lint */ /* @@ -114,6 +114,19 @@ static void touch_timer(struct ctl_cctx *); static void timer(evContext, void *, struct timespec, struct timespec); +#ifndef HAVE_MEMCHR +static void * +memchr(const void *b, int c, size_t len) { + const unsigned char *p = b; + size_t i; + + for (i = 0; i < len; i++, p++) + if (*p == (unsigned char)c) + return ((void *)p); + return (NULL); +} +#endif + /* Private data. */ static const char * const state_names[] = { diff --git a/lib/bind/port/sunos/include/paths.h b/lib/bind/port/sunos/include/paths.h new file mode 100644 index 00000000..277e3cfa --- /dev/null +++ b/lib/bind/port/sunos/include/paths.h @@ -0,0 +1,20 @@ +/* + * Copyright (C) 2007 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +/* $Id: paths.h,v 1.1.6.2 2007/05/16 23:46:24 tbox Exp $ */ + +#define _PATH_DEVNULL "/dev/null" + diff --git a/lib/bind/port_before.h.in b/lib/bind/port_before.h.in index 79cf2777..1f6ff1a0 100644 --- a/lib/bind/port_before.h.in +++ b/lib/bind/port_before.h.in @@ -12,6 +12,16 @@ struct timezone; /* silence warning */ #endif #include <limits.h> +#ifdef ISC_PLATFORM_NEEDTIMESPEC +#include <time.h> /* For time_t */ +struct timespec { + time_t tv_sec; /* seconds */ + long tv_nsec; /* nanoseconds */ +}; +#endif +#ifndef HAVE_MEMMOVE +#define memmove(a,b,c) bcopy(b,a,c) +#endif @WANT_IRS_GR@ @WANT_IRS_NIS@ diff --git a/lib/bind/resolv/res_init.c b/lib/bind/resolv/res_init.c index 013a3cae..f580b9cc 100644 --- a/lib/bind/resolv/res_init.c +++ b/lib/bind/resolv/res_init.c @@ -70,7 +70,7 @@ #if defined(LIBC_SCCS) && !defined(lint) static const char sccsid[] = "@(#)res_init.c 8.1 (Berkeley) 6/7/93"; -static const char rcsid[] = "$Id: res_init.c,v 1.16.18.5 2006/08/30 23:23:13 marka Exp $"; +static const char rcsid[] = "$Id: res_init.c,v 1.16.18.7 2007/07/09 01:52:58 marka Exp $"; #endif /* LIBC_SCCS and not lint */ #include "port_before.h" @@ -166,7 +166,9 @@ __res_vinit(res_state statp, int preinit) { #endif int dots; union res_sockaddr_union u[2]; + int maxns = MAXNS; + RES_SET_H_ERRNO(statp, 0); if (statp->_u._ext.ext != NULL) res_ndestroy(statp); @@ -216,8 +218,22 @@ __res_vinit(res_state statp, int preinit) { statp->_u._ext.ext->nsaddrs[0].sin = statp->nsaddr; strcpy(statp->_u._ext.ext->nsuffix, "ip6.arpa"); strcpy(statp->_u._ext.ext->nsuffix2, "ip6.int"); - } else - return (-1); + } else { + /* + * Historically res_init() rarely, if at all, failed. + * Examples and applications exist which do not check + * our return code. Furthermore several applications + * simply call us to get the systems domainname. So + * rather then immediately fail here we store the + * failure, which is returned later, in h_errno. And + * prevent the collection of 'nameserver' information + * by setting maxns to 0. Thus applications that fail + * to check our return code wont be able to make + * queries anyhow. + */ + RES_SET_H_ERRNO(statp, NETDB_INTERNAL); + maxns = 0; + } #ifdef RESOLVSORT statp->nsort = 0; #endif @@ -238,9 +254,9 @@ __res_vinit(res_state statp, int preinit) { buf[0] = '.'; cp = strchr(buf, '.'); cp = (cp == NULL) ? buf : (cp + 1); - if (strlen(cp) >= sizeof(statp->defdname)) - goto freedata; - strcpy(statp->defdname, cp); + strncpy(statp->defdname, cp, + sizeof(statp->defdname) - 1); + statp->defdname[sizeof(statp->defdname) - 1] = '\0'; } } #endif /* SOLARIS2 */ @@ -346,7 +362,7 @@ __res_vinit(res_state statp, int preinit) { continue; } /* read nameservers to query */ - if (MATCH(buf, "nameserver") && nserv < MAXNS) { + if (MATCH(buf, "nameserver") && nserv < maxns) { struct addrinfo hints, *ai; char sbuf[NI_MAXSERV]; const size_t minsiz = @@ -482,16 +498,7 @@ __res_vinit(res_state statp, int preinit) { if ((cp = getenv("RES_OPTIONS")) != NULL) res_setoptions(statp, cp, "env"); statp->options |= RES_INIT; - return (0); - -#ifdef SOLARIS2 - freedata: - if (statp->_u._ext.ext != NULL) { - free(statp->_u._ext.ext); - statp->_u._ext.ext = NULL; - } - return (-1); -#endif + return (statp->res_h_errno); } static void diff --git a/lib/bind9/api b/lib/bind9/api index aba393a7..d94beab3 100644 --- a/lib/bind9/api +++ b/lib/bind9/api @@ -1,3 +1,3 @@ LIBINTERFACE = 30 -LIBREVISION = 3 +LIBREVISION = 4 LIBAGE = 0 diff --git a/lib/bind9/check.c b/lib/bind9/check.c index 3144e655..18c90e7b 100644 --- a/lib/bind9/check.c +++ b/lib/bind9/check.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2001-2003 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: check.c,v 1.44.18.31 2006/08/21 00:09:52 marka Exp $ */ +/* $Id: check.c,v 1.44.18.33 2007/03/14 23:46:21 tbox Exp $ */ /*! \file */ @@ -46,6 +46,10 @@ #include <bind9/check.h> +#ifndef DNS_RDATASET_FIXED +#define DNS_RDATASET_FIXED 1 +#endif + static void freekey(char *key, unsigned int type, isc_symvalue_t value, void *userarg) { UNUSED(type); @@ -121,8 +125,12 @@ check_orderent(const cfg_obj_t *ent, isc_log_t *logctx) { cfg_obj_log(ent, logctx, ISC_LOG_ERROR, "rrset-order: missing ordering"); result = ISC_R_FAILURE; - } else if (strcasecmp(cfg_obj_asstring(obj), "fixed") != 0 && - strcasecmp(cfg_obj_asstring(obj), "random") != 0 && + } else if (strcasecmp(cfg_obj_asstring(obj), "fixed") == 0) { +#if !DNS_RDATASET_FIXED + cfg_obj_log(obj, logctx, ISC_LOG_WARNING, + "rrset-order: order 'fixed' not fully implemented"); +#endif + } else if (strcasecmp(cfg_obj_asstring(obj), "random") != 0 && strcasecmp(cfg_obj_asstring(obj), "cyclic") != 0) { cfg_obj_log(obj, logctx, ISC_LOG_ERROR, "rrset-order: invalid order '%s'", diff --git a/lib/bind9/win32/DLLMain.c b/lib/bind9/win32/DLLMain.c index 80907bcc..b0873de9 100644 --- a/lib/bind9/win32/DLLMain.c +++ b/lib/bind9/win32/DLLMain.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2001 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,13 +15,11 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: DLLMain.c,v 1.2 2004/03/05 05:09:14 marka Exp $ */ +/* $Id: DLLMain.c,v 1.2.18.2 2007/06/18 23:46:32 tbox Exp $ */ #include <windows.h> #include <signal.h> -BOOL InitSockets(void); - /* * Called when we enter the DLL */ diff --git a/lib/dns/adb.c b/lib/dns/adb.c index 714df960..9d75225c 100644 --- a/lib/dns/adb.c +++ b/lib/dns/adb.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: adb.c,v 1.215.18.13 2006/08/30 23:49:57 marka Exp $ */ +/* $Id: adb.c,v 1.215.18.15 2007/02/26 23:46:22 tbox Exp $ */ /*! \file * @@ -2987,7 +2987,7 @@ dbfind_name(dns_adbname_t *adbname, isc_stdtime_t now, dns_rdatatype_t rdtype) adbname->fetch6_err = FIND_ERR_UNEXPECTED; result = dns_view_find(adb->view, &adbname->name, rdtype, now, - NAME_GLUEOK(adbname), + NAME_GLUEOK(adbname) ? DNS_DBFIND_GLUEOK : 0, ISC_TF(NAME_HINTOK(adbname)), NULL, NULL, fname, &rdataset, NULL); diff --git a/lib/dns/api b/lib/dns/api index 5798ebc7..d1f34539 100644 --- a/lib/dns/api +++ b/lib/dns/api @@ -1,3 +1,3 @@ -LIBINTERFACE = 33 -LIBREVISION = 1 -LIBAGE = 1 +LIBINTERFACE = 34 +LIBREVISION = 0 +LIBAGE = 2 diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c index 02accdf4..37974c5d 100644 --- a/lib/dns/dispatch.c +++ b/lib/dns/dispatch.c @@ -15,21 +15,23 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dispatch.c,v 1.116.18.13 2007/02/07 23:57:58 marka Exp $ */ +/* $Id: dispatch.c,v 1.116.18.18 2007/06/27 04:18:42 marka Exp $ */ /*! \file */ #include <config.h> #include <stdlib.h> +#include <sys/types.h> +#include <unistd.h> #include <isc/entropy.h> -#include <isc/lfsr.h> #include <isc/mem.h> #include <isc/mutex.h> #include <isc/print.h> #include <isc/string.h> #include <isc/task.h> +#include <isc/time.h> #include <isc/util.h> #include <dns/acl.h> @@ -43,13 +45,22 @@ typedef ISC_LIST(dns_dispentry_t) dns_displist_t; +typedef struct dns_nsid { + isc_uint16_t nsid_state; + isc_uint16_t *nsid_vtable; + isc_uint16_t *nsid_pool; + isc_uint16_t nsid_a1, nsid_a2, nsid_a3; + isc_uint16_t nsid_c1, nsid_c2, nsid_c3; + isc_uint16_t nsid_state2; + isc_boolean_t nsid_usepool; +} dns_nsid_t; + typedef struct dns_qid { unsigned int magic; unsigned int qid_nbuckets; /*%< hash table size */ unsigned int qid_increment; /*%< id increment on collision */ isc_mutex_t lock; - isc_lfsr_t qid_lfsr1; /*%< state generator info */ - isc_lfsr_t qid_lfsr2; /*%< state generator info */ + dns_nsid_t nsid; dns_displist_t *qid_table; /*%< the table itself */ } dns_qid_t; @@ -158,7 +169,7 @@ static void destroy_disp(isc_task_t *task, isc_event_t *event); static void udp_recv(isc_task_t *, isc_event_t *); static void tcp_recv(isc_task_t *, isc_event_t *); static void startrecv(dns_dispatch_t *); -static dns_messageid_t dns_randomid(dns_qid_t *); +static dns_messageid_t dns_randomid(dns_nsid_t *); static isc_uint32_t dns_hash(dns_qid_t *, isc_sockaddr_t *, dns_messageid_t); static void free_buffer(dns_dispatch_t *disp, void *buf, unsigned int len); static void *allocate_udp_buffer(dns_dispatch_t *disp); @@ -179,8 +190,12 @@ static isc_result_t dispatch_createudp(dns_dispatchmgr_t *mgr, static isc_boolean_t destroy_mgr_ok(dns_dispatchmgr_t *mgr); static void destroy_mgr(dns_dispatchmgr_t **mgrp); static isc_result_t qid_allocate(dns_dispatchmgr_t *mgr, unsigned int buckets, - unsigned int increment, dns_qid_t **qidp); + unsigned int increment, isc_boolean_t usepool, + dns_qid_t **qidp); static void qid_destroy(isc_mem_t *mctx, dns_qid_t **qidp); +static isc_uint16_t nsid_next(dns_nsid_t *nsid); +static isc_result_t nsid_init(isc_mem_t *mctx, dns_nsid_t *nsid, isc_boolean_t usepool); +static void nsid_destroy(isc_mem_t *mctx, dns_nsid_t *nsid); #define LVL(x) ISC_LOG_DEBUG(x) @@ -260,38 +275,16 @@ request_log(dns_dispatch_t *disp, dns_dispentry_t *resp, } } -static void -reseed_lfsr(isc_lfsr_t *lfsr, void *arg) -{ - dns_dispatchmgr_t *mgr = arg; - isc_result_t result; - isc_uint32_t val; - - REQUIRE(VALID_DISPATCHMGR(mgr)); - - if (mgr->entropy != NULL) { - result = isc_entropy_getdata(mgr->entropy, &val, sizeof(val), - NULL, 0); - INSIST(result == ISC_R_SUCCESS); - lfsr->count = (val & 0x1f) + 32; - lfsr->state = val; - return; - } - - lfsr->count = (random() & 0x1f) + 32; /* From 32 to 63 states */ - lfsr->state = random(); -} - /* * Return an unpredictable message ID. */ static dns_messageid_t -dns_randomid(dns_qid_t *qid) { +dns_randomid(dns_nsid_t *nsid) { isc_uint32_t id; - id = isc_lfsr_generate32(&qid->qid_lfsr1, &qid->qid_lfsr2); + id = nsid_next(nsid); - return (dns_messageid_t)(id & 0xFFFF); + return ((dns_messageid_t)id); } /* @@ -631,6 +624,9 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) { goto restart; } + dns_dispatch_hash(&ev->timestamp, sizeof(&ev->timestamp)); + dns_dispatch_hash(ev->region.base, ev->region.length); + /* response */ bucket = dns_hash(qid, &ev->address, id); LOCK(&qid->lock); @@ -865,6 +861,8 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) { goto restart; } + dns_dispatch_hash(tcpmsg->buffer.base, tcpmsg->buffer.length); + /* * Response. */ @@ -1252,7 +1250,7 @@ dns_dispatchmgr_setudp(dns_dispatchmgr_t *mgr, isc_mempool_setmaxalloc(mgr->bpool, maxbuffers); isc_mempool_associatelock(mgr->bpool, &mgr->pool_lock); - result = qid_allocate(mgr, buckets, increment, &mgr->qid); + result = qid_allocate(mgr, buckets, increment, ISC_TRUE, &mgr->qid); if (result != ISC_R_SUCCESS) goto cleanup; @@ -1398,7 +1396,7 @@ dispatch_find(dns_dispatchmgr_t *mgr, isc_sockaddr_t *local, static isc_result_t qid_allocate(dns_dispatchmgr_t *mgr, unsigned int buckets, - unsigned int increment, dns_qid_t **qidp) + unsigned int increment, isc_boolean_t usepool, dns_qid_t **qidp) { dns_qid_t *qid; unsigned int i; @@ -1420,8 +1418,17 @@ qid_allocate(dns_dispatchmgr_t *mgr, unsigned int buckets, return (ISC_R_NOMEMORY); } + result = nsid_init(mgr->mctx, &qid->nsid, usepool); + if (result != ISC_R_SUCCESS) { + isc_mem_put(mgr->mctx, qid->qid_table, + buckets * sizeof(dns_displist_t)); + isc_mem_put(mgr->mctx, qid, sizeof(*qid)); + return (ISC_R_NOMEMORY); + } + result = isc_mutex_init(&qid->lock); if (result != ISC_R_SUCCESS) { + nsid_destroy(mgr->mctx, &qid->nsid); isc_mem_put(mgr->mctx, qid->qid_table, buckets * sizeof(dns_displist_t)); isc_mem_put(mgr->mctx, qid, sizeof(*qid)); @@ -1434,21 +1441,6 @@ qid_allocate(dns_dispatchmgr_t *mgr, unsigned int buckets, qid->qid_nbuckets = buckets; qid->qid_increment = increment; qid->magic = QID_MAGIC; - - /* - * Initialize to a 32-bit LFSR. Both of these are from Applied - * Cryptography. - * - * lfsr1: - * x^32 + x^7 + x^5 + x^3 + x^2 + x + 1 - * - * lfsr2: - * x^32 + x^7 + x^6 + x^2 + 1 - */ - isc_lfsr_init(&qid->qid_lfsr1, 0, 32, 0x80000057U, - 0, reseed_lfsr, mgr); - isc_lfsr_init(&qid->qid_lfsr2, 0, 32, 0x80000062U, - 0, reseed_lfsr, mgr); *qidp = qid; return (ISC_R_SUCCESS); } @@ -1464,6 +1456,7 @@ qid_destroy(isc_mem_t *mctx, dns_qid_t **qidp) { *qidp = NULL; qid->magic = 0; + nsid_destroy(mctx, &qid->nsid); isc_mem_put(mctx, qid->qid_table, qid->qid_nbuckets * sizeof(dns_displist_t)); DESTROYLOCK(&qid->lock); @@ -1605,7 +1598,7 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, isc_socket_t *sock, return (result); } - result = qid_allocate(mgr, buckets, increment, &disp->qid); + result = qid_allocate(mgr, buckets, increment, ISC_FALSE, &disp->qid); if (result != ISC_R_SUCCESS) goto deallocate_dispatch; @@ -1622,8 +1615,10 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, isc_socket_t *sock, DNS_EVENT_DISPATCHCONTROL, destroy_disp, disp, sizeof(isc_event_t)); - if (disp->ctlevent == NULL) + if (disp->ctlevent == NULL) { + result = ISC_R_NOMEMORY; goto kill_task; + } isc_task_setname(disp->task, "tcpdispatch", disp); @@ -1804,8 +1799,10 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr, DNS_EVENT_DISPATCHCONTROL, destroy_disp, disp, sizeof(isc_event_t)); - if (disp->ctlevent == NULL) + if (disp->ctlevent == NULL) { + result = ISC_R_NOMEMORY; goto kill_task; + } isc_task_setname(disp->task, "udpdispatch", disp); @@ -1926,7 +1923,7 @@ dns_dispatch_addresponse(dns_dispatch_t *disp, isc_sockaddr_t *dest, */ qid = DNS_QID(disp); LOCK(&qid->lock); - id = dns_randomid(qid); + id = dns_randomid(&qid->nsid); bucket = dns_hash(qid, dest, id); ok = ISC_FALSE; for (i = 0; i < 64; i++) { @@ -2269,3 +2266,409 @@ dns_dispatchmgr_dump(dns_dispatchmgr_t *mgr) { } } #endif + +/* + * Allow the user to pick one of two ID randomization algorithms. + * + * The first algorithm is an adaptation of the sequence shuffling + * algorithm discovered by Carter Bays and S. D. Durham [ACM Trans. Math. + * Software 2 (1976), 59-64], as documented as Algorithm B in Chapter + * 3.2.2 in Volume 2 of Knuth's "The Art of Computer Programming". We use + * a randomly selected linear congruential random number generator with a + * modulus of 2^16, whose increment is a randomly picked odd number, and + * whose multiplier is picked from a set which meets the following + * criteria: + * Is of the form 8*n+5, which ensures "high potency" according to + * principle iii in the summary chapter 3.6. This form also has a + * gcd(a-1,m) of 4 which is good according to principle iv. + * + * Is between 0.01 and 0.99 times the modulus as specified by + * principle iv. + * + * Passes the spectral test "with flying colors" (ut >= 1) in + * dimensions 2 through 6 as calculated by Algorithm S in Chapter + * 3.3.4 and the ratings calculated by formula 35 in section E. + * + * Of the multipliers that pass this test, pick the set that is + * best according to the theoretical bounds of the serial + * correlation test. This was calculated using a simplified + * version of Knuth's Theorem K in Chapter 3.3.3. + * + * These criteria may not be important for this use, but we might as well + * pick from the best generators since there are so many possible ones and + * we don't have that many random bits to do the picking. + * + * We use a modulus of 2^16 instead of something bigger so that we will + * tend to cycle through all the possible IDs before repeating any, + * however the shuffling will perturb this somewhat. Theoretically there + * is no minimimum interval between two uses of the same ID, but in + * practice it seems to be >64000. + * + * Our adaptatation of Algorithm B mixes the hash state which has + * captured various random events into the shuffler to perturb the + * sequence. + * + * One disadvantage of this algorithm is that if the generator parameters + * were to be guessed, it would be possible to mount a limited brute force + * attack on the ID space since the IDs are only shuffled within a limited + * range. + * + * The second algorithm uses the same random number generator to populate + * a pool of 65536 IDs. The hash state is used to pick an ID from a window + * of 4096 IDs in this pool, then the chosen ID is swapped with the ID + * at the beginning of the window and the window position is advanced. + * This means that the interval between uses of the ID will be no less + * than 65536-4096. The ID sequence in the pool will become more random + * over time. + * + * For both algorithms, two more linear congruential random number generators + * are selected. The ID from the first part of algorithm is used to seed + * the first of these generators, and its output is used to seed the second. + * The strategy is use these generators as 1 to 1 hashes to obfuscate the + * properties of the generator used in the first part of either algorithm. + * + * The first algorithm may be suitable for use in a client resolver since + * its memory requirements are fairly low and it's pretty random out of + * the box. It is somewhat succeptible to a limited brute force attack, + * so the second algorithm is probably preferable for a longer running + * program that issues a large number of queries and has time to randomize + * the pool. + */ + +#define NSID_SHUFFLE_TABLE_SIZE 100 /* Suggested by Knuth */ +/* + * Pick one of the next 4096 IDs in the pool. + * There is a tradeoff here between randomness and how often and ID is reused. + */ +#define NSID_LOOKAHEAD 4096 /* Must be a power of 2 */ +#define NSID_SHUFFLE_ONLY 1 /* algorithm 1 */ +#define NSID_USE_POOL 2 /* algorithm 2 */ +#define NSID_HASHSHIFT 3 +#define NSID_HASHROTATE(v) \ + (((v) << NSID_HASHSHIFT) | ((v) >> ((sizeof(v) * 8) - NSID_HASHSHIFT))) + +static isc_uint32_t nsid_hash_state; + +/* + * Keep a running hash of various bits of data that we'll use to + * stir the ID pool or perturb the ID generator + */ +static void +nsid_hash(void *data, size_t len) { + unsigned char *p = data; + /* + * Hash function similar to the one we use for hashing names. + * We don't fold case or toss the upper bit here, though. + * This hash doesn't do much interesting when fed binary zeros, + * so there may be a better hash function. + * This function doesn't need to be very strong since we're + * only using it to stir the pool, but it should be reasonably + * fast. + */ + /* + * We don't care about locking access to nsid_hash_state. + * In fact races make the result even more non deteministic. + */ + while (len-- > 0U) { + nsid_hash_state = NSID_HASHROTATE(nsid_hash_state); + nsid_hash_state += *p++; + } +} + +/* + * Table of good linear congruential multipliers for modulus 2^16 + * in order of increasing serial correlation bounds (so trim from + * the end). + */ +static const isc_uint16_t nsid_multiplier_table[] = { + 17565, 25013, 11733, 19877, 23989, 23997, 24997, 25421, + 26781, 27413, 35901, 35917, 35973, 36229, 38317, 38437, + 39941, 40493, 41853, 46317, 50581, 51429, 53453, 53805, + 11317, 11789, 12045, 12413, 14277, 14821, 14917, 18989, + 19821, 23005, 23533, 23573, 23693, 27549, 27709, 28461, + 29365, 35605, 37693, 37757, 38309, 41285, 45261, 47061, + 47269, 48133, 48597, 50277, 50717, 50757, 50805, 51341, + 51413, 51581, 51597, 53445, 11493, 14229, 20365, 20653, + 23485, 25541, 27429, 29421, 30173, 35445, 35653, 36789, + 36797, 37109, 37157, 37669, 38661, 39773, 40397, 41837, + 41877, 45293, 47277, 47845, 49853, 51085, 51349, 54085, + 56933, 8877, 8973, 9885, 11365, 11813, 13581, 13589, + 13613, 14109, 14317, 15765, 15789, 16925, 17069, 17205, + 17621, 17941, 19077, 19381, 20245, 22845, 23733, 24869, + 25453, 27213, 28381, 28965, 29245, 29997, 30733, 30901, + 34877, 35485, 35613, 36133, 36661, 36917, 38597, 40285, + 40693, 41413, 41541, 41637, 42053, 42349, 45245, 45469, + 46493, 48205, 48613, 50861, 51861, 52877, 53933, 54397, + 55669, 56453, 56965, 58021, 7757, 7781, 8333, 9661, + 12229, 14373, 14453, 17549, 18141, 19085, 20773, 23701, + 24205, 24333, 25261, 25317, 27181, 30117, 30477, 34757, + 34885, 35565, 35885, 36541, 37957, 39733, 39813, 41157, + 41893, 42317, 46621, 48117, 48181, 49525, 55261, 55389, + 56845, 7045, 7749, 7965, 8469, 9133, 9549, 9789, + 10173, 11181, 11285, 12253, 13453, 13533, 13757, 14477, + 15053, 16901, 17213, 17269, 17525, 17629, 18605, 19013, + 19829, 19933, 20069, 20093, 23261, 23333, 24949, 25309, + 27613, 28453, 28709, 29301, 29541, 34165, 34413, 37301, + 37773, 38045, 38405, 41077, 41781, 41925, 42717, 44437, + 44525, 44613, 45933, 45941, 47077, 50077, 50893, 52117, + 5293, 55069, 55989, 58125, 59205, 6869, 14685, 15453, + 16821, 17045, 17613, 18437, 21029, 22773, 22909, 25445, + 25757, 26541, 30709, 30909, 31093, 31149, 37069, 37725, + 37925, 38949, 39637, 39701, 40765, 40861, 42965, 44813, + 45077, 45733, 47045, 50093, 52861, 52957, 54181, 56325, + 56365, 56381, 56877, 57013, 5741, 58101, 58669, 8613, + 10045, 10261, 10653, 10733, 11461, 12261, 14069, 15877, + 17757, 21165, 23885, 24701, 26429, 26645, 27925, 28765, + 29197, 30189, 31293, 39781, 39909, 40365, 41229, 41453, + 41653, 42165, 42365, 47421, 48029, 48085, 52773, 5573, + 57037, 57637, 58341, 58357, 58901, 6357, 7789, 9093, + 10125, 10709, 10765, 11957, 12469, 13437, 13509, 14773, + 15437, 15773, 17813, 18829, 19565, 20237, 23461, 23685, + 23725, 23941, 24877, 25461, 26405, 29509, 30285, 35181, + 37229, 37893, 38565, 40293, 44189, 44581, 45701, 47381, + 47589, 48557, 4941, 51069, 5165, 52797, 53149, 5341, + 56301, 56765, 58581, 59493, 59677, 6085, 6349, 8293, + 8501, 8517, 11597, 11709, 12589, 12693, 13517, 14909, + 17397, 18085, 21101, 21269, 22717, 25237, 25661, 29189, + 30101, 31397, 33933, 34213, 34661, 35533, 36493, 37309, + 40037, 4189, 42909, 44309, 44357, 44389, 4541, 45461, + 46445, 48237, 54149, 55301, 55853, 56621, 56717, 56901, + 5813, 58437, 12493, 15365, 15989, 17829, 18229, 19341, + 21013, 21357, 22925, 24885, 26053, 27581, 28221, 28485, + 30605, 30613, 30789, 35437, 36285, 37189, 3941, 41797, + 4269, 42901, 43293, 44645, 45221, 46893, 4893, 50301, + 50325, 5189, 52109, 53517, 54053, 54485, 5525, 55949, + 56973, 59069, 59421, 60733, 61253, 6421, 6701, 6709, + 7101, 8669, 15797, 19221, 19837, 20133, 20957, 21293, + 21461, 22461, 29085, 29861, 30869, 34973, 36469, 37565, + 38125, 38829, 39469, 40061, 40117, 44093, 47429, 48341, + 50597, 51757, 5541, 57629, 58405, 59621, 59693, 59701, + 61837, 7061, 10421, 11949, 15405, 20861, 25397, 25509, + 25893, 26037, 28629, 28869, 29605, 30213, 34205, 35637, + 36365, 37285, 3773, 39117, 4021, 41061, 42653, 44509, + 4461, 44829, 4725, 5125, 52269, 56469, 59085, 5917, + 60973, 8349, 17725, 18637, 19773, 20293, 21453, 22533, + 24285, 26333, 26997, 31501, 34541, 34805, 37509, 38477, + 41333, 44125, 46285, 46997, 47637, 48173, 4925, 50253, + 50381, 50917, 51205, 51325, 52165, 52229, 5253, 5269, + 53509, 56253, 56341, 5821, 58373, 60301, 61653, 61973, + 62373, 8397, 11981, 14341, 14509, 15077, 22261, 22429, + 24261, 28165, 28685, 30661, 34021, 34445, 39149, 3917, + 43013, 43317, 44053, 44101, 4533, 49541, 49981, 5277, + 54477, 56357, 57261, 57765, 58573, 59061, 60197, 61197, + 62189, 7725, 8477, 9565, 10229, 11437, 14613, 14709, + 16813, 20029, 20677, 31445, 3165, 31957, 3229, 33541, + 36645, 3805, 38973, 3965, 4029, 44293, 44557, 46245, + 48917, 4909, 51749, 53709, 55733, 56445, 5925, 6093, + 61053, 62637, 8661, 9109, 10821, 11389, 13813, 14325, + 15501, 16149, 18845, 22669, 26437, 29869, 31837, 33709, + 33973, 34173, 3677, 3877, 3981, 39885, 42117, 4421, + 44221, 44245, 44693, 46157, 47309, 5005, 51461, 52037, + 55333, 55693, 56277, 58949, 6205, 62141, 62469, 6293, + 10101, 12509, 14029, 17997, 20469, 21149, 25221, 27109, + 2773, 2877, 29405, 31493, 31645, 4077, 42005, 42077, + 42469, 42501, 44013, 48653, 49349, 4997, 50101, 55405, + 56957, 58037, 59429, 60749, 61797, 62381, 62837, 6605, + 10541, 23981, 24533, 2701, 27333, 27341, 31197, 33805, + 3621, 37381, 3749, 3829, 38533, 42613, 44381, 45901, + 48517, 51269, 57725, 59461, 60045, 62029, 13805, 14013, + 15461, 16069, 16157, 18573, 2309, 23501, 28645, 3077, + 31541, 36357, 36877, 3789, 39429, 39805, 47685, 47949, + 49413, 5485, 56757, 57549, 57805, 58317, 59549, 62213, + 62613, 62853, 62933, 8909, 12941, 16677, 20333, 21541, + 24429, 26077, 26421, 2885, 31269, 33381, 3661, 40925, + 42925, 45173, 4525, 4709, 53133, 55941, 57413, 57797, + 62125, 62237, 62733, 6773, 12317, 13197, 16533, 16933, + 18245, 2213, 2477, 29757, 33293, 35517, 40133, 40749, + 4661, 49941, 62757, 7853, 8149, 8573, 11029, 13421, + 21549, 22709, 22725, 24629, 2469, 26125, 2669, 34253, + 36709, 41013, 45597, 46637, 52285, 52333, 54685, 59013, + 60997, 61189, 61981, 62605, 62821, 7077, 7525, 8781, + 10861, 15277, 2205, 22077, 28517, 28949, 32109, 33493, + 4661, 49941, 62757, 7853, 8149, 8573, 11029, 13421, + 21549, 22709, 22725, 24629, 2469, 26125, 2669, 34253, + 36709, 41013, 45597, 46637, 52285, 52333, 54685, 59013, + 60997, 61189, 61981, 62605, 62821, 7077, 7525, 8781, + 10861, 15277, 2205, 22077, 28517, 28949, 32109, 33493, + 3685, 39197, 39869, 42621, 44997, 48565, 5221, 57381, + 61749, 62317, 63245, 63381, 23149, 2549, 28661, 31653, + 33885, 36341, 37053, 39517, 42805, 45853, 48997, 59349, + 60053, 62509, 63069, 6525, 1893, 20181, 2365, 24893, + 27397, 31357, 32277, 33357, 34437, 36677, 37661, 43469, + 43917, 50997, 53869, 5653, 13221, 16741, 17893, 2157, + 28653, 31789, 35301, 35821, 61613, 62245, 12405, 14517, + 17453, 18421, 3149, 3205, 40341, 4109, 43941, 46869, + 48837, 50621, 57405, 60509, 62877, 8157, 12933, 12957, + 16501, 19533, 3461, 36829, 52357, 58189, 58293, 63053, + 17109, 1933, 32157, 37701, 59005, 61621, 13029, 15085, + 16493, 32317, 35093, 5061, 51557, 62221, 20765, 24613, + 2629, 30861, 33197, 33749, 35365, 37933, 40317, 48045, + 56229, 61157, 63797, 7917, 17965, 1917, 1973, 20301, + 2253, 33157, 58629, 59861, 61085, 63909, 8141, 9221, + 14757, 1581, 21637, 26557, 33869, 34285, 35733, 40933, + 42517, 43501, 53653, 61885, 63805, 7141, 21653, 54973, + 31189, 60061, 60341, 63357, 16045, 2053, 26069, 33997, + 43901, 54565, 63837, 8949, 17909, 18693, 32349, 33125, + 37293, 48821, 49053, 51309, 64037, 7117, 1445, 20405, + 23085, 26269, 26293, 27349, 32381, 33141, 34525, 36461, + 37581, 43525, 4357, 43877, 5069, 55197, 63965, 9845, + 12093, 2197, 2229, 32165, 33469, 40981, 42397, 8749, + 10853, 1453, 18069, 21693, 30573, 36261, 37421, 42533 +}; + +#define NSID_MULT_TABLE_SIZE \ + ((sizeof nsid_multiplier_table)/(sizeof nsid_multiplier_table[0])) +#define NSID_RANGE_MASK (NSID_LOOKAHEAD - 1) +#define NSID_POOL_MASK 0xFFFF /* used to wrap the pool index */ +#define NSID_SHUFFLE_ONLY 1 +#define NSID_USE_POOL 2 + +static isc_uint16_t +nsid_next(dns_nsid_t *nsid) { + isc_uint16_t id, compressed_hash; + isc_uint16_t j; + + compressed_hash = ((nsid_hash_state >> 16) ^ + (nsid_hash_state)) & 0xFFFF; + + if (nsid->nsid_usepool) { + isc_uint16_t pick; + + pick = compressed_hash & NSID_RANGE_MASK; + pick = (nsid->nsid_state + pick) & NSID_POOL_MASK; + id = nsid->nsid_pool[pick]; + if (pick != 0) { + /* Swap two IDs to stir the pool */ + nsid->nsid_pool[pick] = + nsid->nsid_pool[nsid->nsid_state]; + nsid->nsid_pool[nsid->nsid_state] = id; + } + + /* increment the base pointer into the pool */ + if (nsid->nsid_state == 65535) + nsid->nsid_state = 0; + else + nsid->nsid_state++; + } else { + /* + * This is the original Algorithm B + * j = ((u_long) NSID_SHUFFLE_TABLE_SIZE * nsid_state2) >> 16; + * + * We'll perturb it with some random stuff ... + */ + j = ((isc_uint32_t) NSID_SHUFFLE_TABLE_SIZE * + (nsid->nsid_state2 ^ compressed_hash)) >> 16; + nsid->nsid_state2 = id = nsid->nsid_vtable[j]; + nsid->nsid_state = (((isc_uint32_t) nsid->nsid_a1 * nsid->nsid_state) + + nsid->nsid_c1) & 0xFFFF; + nsid->nsid_vtable[j] = nsid->nsid_state; + } + + /* Now lets obfuscate ... */ + id = (((isc_uint32_t) nsid->nsid_a2 * id) + nsid->nsid_c2) & 0xFFFF; + id = (((isc_uint32_t) nsid->nsid_a3 * id) + nsid->nsid_c3) & 0xFFFF; + + return (id); +} + +static isc_result_t +nsid_init(isc_mem_t *mctx, dns_nsid_t *nsid, isc_boolean_t usepool) { + isc_time_t now; + pid_t mypid; + isc_uint16_t a1ndx, a2ndx, a3ndx, c1ndx, c2ndx, c3ndx; + int i; + + isc_time_now(&now); + mypid = getpid(); + + /* Initialize the state */ + memset(nsid, 0, sizeof(*nsid)); + nsid_hash(&now, sizeof now); + nsid_hash(&mypid, sizeof mypid); + + /* + * Select our random number generators and initial seed. + * We could really use more random bits at this point, + * but we'll try to make a silk purse out of a sows ear ... + */ + /* generator 1 */ + a1ndx = ((isc_uint32_t) NSID_MULT_TABLE_SIZE * + (nsid_hash_state & 0xFFFF)) >> 16; + nsid->nsid_a1 = nsid_multiplier_table[a1ndx]; + c1ndx = (nsid_hash_state >> 9) & 0x7FFF; + nsid->nsid_c1 = 2 * c1ndx + 1; + + /* generator 2, distinct from 1 */ + a2ndx = ((isc_uint32_t) (NSID_MULT_TABLE_SIZE - 1) * + ((nsid_hash_state >> 10) & 0xFFFF)) >> 16; + if (a2ndx >= a1ndx) + a2ndx++; + nsid->nsid_a2 = nsid_multiplier_table[a2ndx]; + c2ndx = nsid_hash_state % 32767; + if (c2ndx >= c1ndx) + c2ndx++; + nsid->nsid_c2 = 2*c2ndx + 1; + + /* generator 3, distinct from 1 and 2 */ + a3ndx = ((isc_uint32_t) (NSID_MULT_TABLE_SIZE - 2) * + ((nsid_hash_state >> 20) & 0xFFFF)) >> 16; + if (a3ndx >= a1ndx || a3ndx >= a2ndx) + a3ndx++; + if (a3ndx >= a1ndx && a3ndx >= a2ndx) + a3ndx++; + nsid->nsid_a3 = nsid_multiplier_table[a3ndx]; + c3ndx = nsid_hash_state % 32766; + if (c3ndx >= c1ndx || c3ndx >= c2ndx) + c3ndx++; + if (c3ndx >= c1ndx && c3ndx >= c2ndx) + c3ndx++; + nsid->nsid_c3 = 2*c3ndx + 1; + + nsid->nsid_state = + ((nsid_hash_state >> 16) ^ (nsid_hash_state)) & 0xFFFF; + + nsid->nsid_usepool = usepool; + if (nsid->nsid_usepool) { + nsid->nsid_pool = isc_mem_get(mctx, 0x10000 * sizeof(isc_uint16_t)); + if (nsid->nsid_pool == NULL) + return (ISC_R_NOMEMORY); + for (i = 0; ; i++) { + nsid->nsid_pool[i] = nsid->nsid_state; + nsid->nsid_state = + (((u_long) nsid->nsid_a1 * nsid->nsid_state) + + nsid->nsid_c1) & 0xFFFF; + if (i == 0xFFFF) + break; + } + } else { + nsid->nsid_vtable = isc_mem_get(mctx, NSID_SHUFFLE_TABLE_SIZE * + (sizeof(isc_uint16_t)) ); + if (nsid->nsid_vtable == NULL) + return (ISC_R_NOMEMORY); + + for (i = 0; i < NSID_SHUFFLE_TABLE_SIZE; i++) { + nsid->nsid_vtable[i] = nsid->nsid_state; + nsid->nsid_state = + (((isc_uint32_t) nsid->nsid_a1 * nsid->nsid_state) + + nsid->nsid_c1) & 0xFFFF; + } + nsid->nsid_state2 = nsid->nsid_state; + } + return (ISC_R_SUCCESS); +} + +static void +nsid_destroy(isc_mem_t *mctx, dns_nsid_t *nsid) { + if (nsid->nsid_usepool) + isc_mem_put(mctx, nsid->nsid_pool, + 0x10000 * sizeof(isc_uint16_t)); + else + isc_mem_put(mctx, nsid->nsid_vtable, + NSID_SHUFFLE_TABLE_SIZE * (sizeof(isc_uint16_t)) ); + memset(nsid, 0, sizeof(*nsid)); +} + +void +dns_dispatch_hash(void *data, size_t len) { + nsid_hash(data, len); +} diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c index c0339a12..e194e1d5 100644 --- a/lib/dns/dnssec.c +++ b/lib/dns/dnssec.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -16,7 +16,7 @@ */ /* - * $Id: dnssec.c,v 1.81.18.6 2006/03/07 00:34:53 marka Exp $ + * $Id: dnssec.c,v 1.81.18.8 2007/05/18 23:46:28 tbox Exp $ */ /*! \file */ @@ -531,6 +531,9 @@ dns_dnssec_findzonekeys2(dns_db_t *db, dns_dbversion_t *ver, dst_key_t *pubkey = NULL; unsigned int count = 0; + REQUIRE(nkeys != NULL); + REQUIRE(keys != NULL); + *nkeys = 0; dns_rdataset_init(&rdataset); RETERR(dns_db_findrdataset(db, node, ver, dns_rdatatype_dnskey, 0, 0, @@ -540,7 +543,8 @@ dns_dnssec_findzonekeys2(dns_db_t *db, dns_dbversion_t *ver, pubkey = NULL; dns_rdataset_current(&rdataset, &rdata); RETERR(dns_dnssec_keyfromrdata(name, &rdata, mctx, &pubkey)); - if (!is_zone_key(pubkey)) + if (!is_zone_key(pubkey) || + (dst_key_flags(pubkey) & DNS_KEYTYPE_NOAUTH) != 0) goto next; keys[count] = NULL; result = dst_key_fromfile(dst_key_name(pubkey), @@ -549,17 +553,23 @@ dns_dnssec_findzonekeys2(dns_db_t *db, dns_dbversion_t *ver, DST_TYPE_PUBLIC|DST_TYPE_PRIVATE, directory, mctx, &keys[count]); - if (result == ISC_R_FILENOTFOUND) + if (result == ISC_R_FILENOTFOUND) { + keys[count] = pubkey; + pubkey = NULL; + count++; goto next; + } if (result != ISC_R_SUCCESS) goto failure; if ((dst_key_flags(keys[count]) & DNS_KEYTYPE_NOAUTH) != 0) { + /* We should never get here. */ dst_key_free(&keys[count]); goto next; } count++; next: - dst_key_free(&pubkey); + if (pubkey != NULL) + dst_key_free(&pubkey); dns_rdata_reset(&rdata); result = dns_rdataset_next(&rdataset); } @@ -575,6 +585,9 @@ dns_dnssec_findzonekeys2(dns_db_t *db, dns_dbversion_t *ver, dns_rdataset_disassociate(&rdataset); if (pubkey != NULL) dst_key_free(&pubkey); + if (result != ISC_R_SUCCESS) + while (count > 0) + dst_key_free(&keys[--count]); *nkeys = count; return (result); } diff --git a/lib/dns/include/dns/db.h b/lib/dns/include/dns/db.h index a791a2e3..7c1a49ec 100644 --- a/lib/dns/include/dns/db.h +++ b/lib/dns/include/dns/db.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: db.h,v 1.76.18.7 2005/10/13 02:12:25 marka Exp $ */ +/* $Id: db.h,v 1.76.18.9 2007/03/06 02:12:08 tbox Exp $ */ #ifndef DNS_DB_H #define DNS_DB_H 1 @@ -860,7 +860,7 @@ dns_db_attachnode(dns_db_t *db, dns_dbnode_t *source, dns_dbnode_t **targetp); * * \li 'source' is a valid node. * - * \li 'targetp' points to a NULL dns_node_t *. + * \li 'targetp' points to a NULL dns_dbnode_t *. * * Ensures: * diff --git a/lib/dns/include/dns/dispatch.h b/lib/dns/include/dns/dispatch.h index 47f6b209..232edcf4 100644 --- a/lib/dns/include/dns/dispatch.h +++ b/lib/dns/include/dns/dispatch.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dispatch.h,v 1.48.18.2 2005/04/29 00:16:12 marka Exp $ */ +/* $Id: dispatch.h,v 1.48.18.4 2007/06/26 23:46:21 tbox Exp $ */ #ifndef DNS_DISPATCH_H #define DNS_DISPATCH_H 1 @@ -441,6 +441,13 @@ dns_dispatch_importrecv(dns_dispatch_t *disp, isc_event_t *event); * event != NULL */ +void +dns_dispatch_hash(void *data, size_t len); +/*%< + * Feed 'data' to the dispatch query id generator where 'len' is the size + * of 'data'. + */ + ISC_LANG_ENDDECLS #endif /* DNS_DISPATCH_H */ diff --git a/lib/dns/lookup.c b/lib/dns/lookup.c index 642a4345..d44cc6b7 100644 --- a/lib/dns/lookup.c +++ b/lib/dns/lookup.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001, 2003 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: lookup.c,v 1.14.18.4 2005/11/30 03:44:39 marka Exp $ */ +/* $Id: lookup.c,v 1.14.18.6 2007/03/06 02:12:08 tbox Exp $ */ /*! \file */ @@ -181,7 +181,7 @@ static void lookup_find(dns_lookup_t *lookup, dns_fetchevent_t *event) { isc_result_t result; isc_boolean_t want_restart; - isc_boolean_t send_event = ISC_FALSE; + isc_boolean_t send_event; dns_name_t *name, *fname, *prefix; dns_fixedname_t foundname, fixed; dns_rdata_t rdata = DNS_RDATA_INIT; @@ -201,6 +201,7 @@ lookup_find(dns_lookup_t *lookup, dns_fetchevent_t *event) { do { lookup->restarts++; want_restart = ISC_FALSE; + send_event = ISC_TRUE; if (event == NULL && !lookup->canceled) { dns_fixedname_init(&foundname); @@ -208,6 +209,15 @@ lookup_find(dns_lookup_t *lookup, dns_fetchevent_t *event) { INSIST(!dns_rdataset_isassociated(&lookup->rdataset)); INSIST(!dns_rdataset_isassociated (&lookup->sigrdataset)); + /* + * If we have restarted then clear the old node. */ + if (lookup->event->node != NULL) { + INSIST(lookup->event->db != NULL); + dns_db_detachnode(lookup->event->db, + &lookup->event->node); + } + if (lookup->event->db != NULL) + dns_db_detach(&lookup->event->db); result = view_find(lookup, fname); if (result == ISC_R_NOTFOUND) { /* @@ -222,8 +232,8 @@ lookup_find(dns_lookup_t *lookup, dns_fetchevent_t *event) { if (lookup->event->db != NULL) dns_db_detach(&lookup->event->db); result = start_fetch(lookup); - if (result != ISC_R_SUCCESS) - send_event = ISC_TRUE; + if (result == ISC_R_SUCCESS) + send_event = ISC_FALSE; goto done; } } else if (event != NULL) { @@ -244,7 +254,6 @@ lookup_find(dns_lookup_t *lookup, dns_fetchevent_t *event) { switch (result) { case ISC_R_SUCCESS: result = build_event(lookup); - send_event = ISC_TRUE; if (event == NULL) break; if (event->db != NULL) @@ -269,8 +278,10 @@ lookup_find(dns_lookup_t *lookup, dns_fetchevent_t *event) { break; result = dns_name_copy(&cname.cname, name, NULL); dns_rdata_freestruct(&cname); - if (result == ISC_R_SUCCESS) + if (result == ISC_R_SUCCESS) { want_restart = ISC_TRUE; + send_event = ISC_FALSE; + } break; case DNS_R_DNAME: namereln = dns_name_fullcompare(name, fname, &order, @@ -296,8 +307,10 @@ lookup_find(dns_lookup_t *lookup, dns_fetchevent_t *event) { result = dns_name_concatenate(prefix, &dname.dname, name, NULL); dns_rdata_freestruct(&dname); - if (result == ISC_R_SUCCESS) + if (result == ISC_R_SUCCESS) { want_restart = ISC_TRUE; + send_event = ISC_FALSE; + } break; default: send_event = ISC_TRUE; @@ -368,7 +381,6 @@ levent_destroy(isc_event_t *event) { isc_mem_put(mctx, event, event->ev_size); } - isc_result_t dns_lookup_create(isc_mem_t *mctx, dns_name_t *name, dns_rdatatype_t type, dns_view_t *view, unsigned int options, isc_task_t *task, diff --git a/lib/dns/master.c b/lib/dns/master.c index 8eb1f2d9..32a55f62 100644 --- a/lib/dns/master.c +++ b/lib/dns/master.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: master.c,v 1.148.18.13 2006/12/07 23:57:58 marka Exp $ */ +/* $Id: master.c,v 1.148.18.16 2007/05/16 06:59:31 marka Exp $ */ /*! \file */ @@ -276,7 +276,8 @@ loadctx_destroy(dns_loadctx_t *lctx); #define MANYERRS(lctx, result) \ ((result != ISC_R_SUCCESS) && \ - ((lctx)->options & DNS_MASTER_MANYERRORS) != 0) + (result != ISC_R_IOERROR) && \ + ((lctx)->options & DNS_MASTER_MANYERRORS) != 0) #define SETRESULT(lctx, r) \ do { \ @@ -1474,7 +1475,7 @@ load_text(dns_loadctx_t *lctx) { } else { UNEXPECTED_ERROR(__FILE__, __LINE__, "%s:%lu: isc_lex_gettoken() returned " - "unexpeced token type (%d)", + "unexpected token type (%d)", source, line, token.type); result = ISC_R_UNEXPECTED; if (MANYERRS(lctx, result)) { diff --git a/lib/dns/message.c b/lib/dns/message.c index a4a1f878..12261f4f 100644 --- a/lib/dns/message.c +++ b/lib/dns/message.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: message.c,v 1.222.18.10 2006/03/02 23:19:20 marka Exp $ */ +/* $Id: message.c,v 1.222.18.12 2007/05/15 23:46:28 tbox Exp $ */ /*! \file */ @@ -3007,8 +3007,7 @@ dns_message_sectiontotext(dns_message_t *msg, dns_section_t section, ADD_STRING(target, ";; "); if (msg->opcode != dns_opcode_update) { ADD_STRING(target, sectiontext[section]); - } - else { + } else { ADD_STRING(target, updsectiontext[section]); } ADD_STRING(target, " SECTION:\n"); @@ -3130,7 +3129,12 @@ dns_message_totext(dns_message_t *msg, const dns_master_style_t *style, ADD_STRING(target, ";; ->>HEADER<<- opcode: "); ADD_STRING(target, opcodetext[msg->opcode]); ADD_STRING(target, ", status: "); - ADD_STRING(target, rcodetext[msg->rcode]); + if (msg->rcode < (sizeof(rcodetext)/sizeof(rcodetext[0]))) { + ADD_STRING(target, rcodetext[msg->rcode]); + } else { + snprintf(buf, sizeof(buf), "%4u", msg->rcode); + ADD_STRING(target, buf); + } ADD_STRING(target, ", id: "); snprintf(buf, sizeof(buf), "%6u", msg->id); ADD_STRING(target, buf); diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c index cd256081..e880a946 100644 --- a/lib/dns/rbtdb.c +++ b/lib/dns/rbtdb.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: rbtdb.c,v 1.196.18.41 2006/10/26 06:04:29 marka Exp $ */ +/* $Id: rbtdb.c,v 1.196.18.47 2007/06/19 06:21:25 marka Exp $ */ /*! \file */ @@ -179,6 +179,10 @@ typedef isc_mutex_t nodelock_t; #define NODE_WEAKDOWNGRADE(l) ((void)0) #endif +#ifndef DNS_RDATASET_FIXED +#define DNS_RDATASET_FIXED 1 +#endif + /* * Allow clients with a virtual time of upto 5 minutes in the past to see * records that would have otherwise have expired. @@ -495,6 +499,19 @@ typedef struct rbtdb_dbiterator { static void free_rbtdb(dns_rbtdb_t *rbtdb, isc_boolean_t log, isc_event_t *event); +/*% + * 'init_count' is used to initialize 'newheader->count' which inturn + * is used to determine where in the cycle rrset-order cyclic starts. + * We don't lock this as we don't care about simultanious updates. + * + * Note: + * Both init_count and header->count can be ISC_UINT32_MAX. + * The count on the returned rdataset however can't be as + * that indicates that the database does not implement cyclic + * processing. + */ +static unsigned int init_count; + /* * Locking * @@ -889,7 +906,7 @@ free_noqname(isc_mem_t *mctx, struct noqname **noqname) { if ((*noqname)->nsec != NULL) isc_mem_put(mctx, (*noqname)->nsec, dns_rdataslab_size((*noqname)->nsec, 0)); - if ((*noqname)->nsec != NULL) + if ((*noqname)->nsecsig != NULL) isc_mem_put(mctx, (*noqname)->nsecsig, dns_rdataslab_size((*noqname)->nsecsig, 0)); isc_mem_put(mctx, *noqname, sizeof(**noqname)); @@ -1857,8 +1874,8 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node, raw = (unsigned char *)header + sizeof(*header); rdataset->private3 = raw; rdataset->count = header->count++; - if (header->count == ISC_UINT32_MAX) - header->count = 0; + if (rdataset->count == ISC_UINT32_MAX) + rdataset->count = 0; /* * Reset iterator state. @@ -1964,12 +1981,20 @@ valid_glue(rbtdb_search_t *search, dns_name_t *name, rbtdb_rdatatype_t type, header = search->zonecut_rdataset; raw = (unsigned char *)header + sizeof(*header); count = raw[0] * 256 + raw[1]; +#if DNS_RDATASET_FIXED raw += 2 + (4 * count); +#else + raw += 2; +#endif while (count > 0) { count--; size = raw[0] * 256 + raw[1]; +#if DNS_RDATASET_FIXED raw += 4; +#else + raw += 2; +#endif region.base = raw; region.length = size; raw += size; @@ -3298,7 +3323,8 @@ find_coveringnsec(rbtdb_search_t *search, dns_dbnode_t **nodep, header_prev = header; continue; } - if (NONEXISTENT(header) || NXDOMAIN(header)) { + if (NONEXISTENT(header) || + RBTDB_RDATATYPE_BASE(header->type) == 0) { header_prev = header; continue; } @@ -3324,7 +3350,7 @@ find_coveringnsec(rbtdb_search_t *search, dns_dbnode_t **nodep, result = DNS_R_COVERINGNSEC; } else if (!empty_node) { result = ISC_R_NOTFOUND; - }else + } else result = dns_rbtnodechain_prev(&search->chain, NULL, NULL); unlock_node: @@ -4825,7 +4851,7 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version, rdataset->covers); newheader->attributes = 0; newheader->noqname = NULL; - newheader->count = 0; + newheader->count = init_count++; newheader->trust = rdataset->trust; newheader->additional_auth = NULL; newheader->additional_glue = NULL; @@ -4910,7 +4936,7 @@ subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version, newheader->serial = rbtversion->serial; newheader->trust = 0; newheader->noqname = NULL; - newheader->count = 0; + newheader->count = init_count++; newheader->additional_auth = NULL; newheader->additional_glue = NULL; @@ -5161,7 +5187,7 @@ loading_addrdataset(void *arg, dns_name_t *name, dns_rdataset_t *rdataset) { newheader->trust = rdataset->trust; newheader->serial = 1; newheader->noqname = NULL; - newheader->count = 0; + newheader->count = init_count++; newheader->additional_auth = NULL; newheader->additional_glue = NULL; @@ -5636,9 +5662,11 @@ rdataset_first(dns_rdataset_t *rdataset) { return (ISC_R_NOMORE); } +#if DNS_RDATASET_FIXED if ((rdataset->attributes & DNS_RDATASETATTR_LOADORDER) == 0) raw += 2 + (4 * count); else +#endif raw += 2; /* @@ -5673,11 +5701,17 @@ rdataset_next(dns_rdataset_t *rdataset) { * Skip forward one record (length + 4) or one offset (4). */ raw = rdataset->private5; +#if DNS_RDATASET_FIXED if ((rdataset->attributes & DNS_RDATASETATTR_LOADORDER) == 0) { +#endif length = raw[0] * 256 + raw[1]; raw += length; +#if DNS_RDATASET_FIXED } - rdataset->private5 = raw + 4; + rdataset->private5 = raw + 4; /* length(2) + order(2) */ +#else + rdataset->private5 = raw + 2; /* length(2) */ +#endif return (ISC_R_SUCCESS); } @@ -5685,7 +5719,9 @@ rdataset_next(dns_rdataset_t *rdataset) { static void rdataset_current(dns_rdataset_t *rdataset, dns_rdata_t *rdata) { unsigned char *raw = rdataset->private5; /* RDATASLAB */ +#if DNS_RDATASET_FIXED unsigned int offset; +#endif isc_region_t r; REQUIRE(raw != NULL); @@ -5694,14 +5730,21 @@ rdataset_current(dns_rdataset_t *rdataset, dns_rdata_t *rdata) { * Find the start of the record if not already in private5 * then skip the length and order fields. */ +#if DNS_RDATASET_FIXED if ((rdataset->attributes & DNS_RDATASETATTR_LOADORDER) != 0) { offset = (raw[0] << 24) + (raw[1] << 16) + (raw[2] << 8) + raw[3]; raw = rdataset->private3; raw += offset; } +#endif r.length = raw[0] * 256 + raw[1]; + +#if DNS_RDATASET_FIXED raw += 4; +#else + raw += 2; +#endif r.base = raw; dns_rdata_fromregion(rdata, rdataset->rdclass, rdataset->type, &r); } diff --git a/lib/dns/rdata/generic/dlv_32769.c b/lib/dns/rdata/generic/dlv_32769.c index fa225809..454fee3f 100644 --- a/lib/dns/rdata/generic/dlv_32769.c +++ b/lib/dns/rdata/generic/dlv_32769.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2006, 2007 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -14,7 +14,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dlv_32769.c,v 1.2.2.2 2006/02/19 06:50:47 marka Exp $ */ +/* $Id: dlv_32769.c,v 1.2.2.4 2007/02/26 23:46:22 tbox Exp $ */ /* draft-ietf-dnsext-delegation-signer-05.txt */ @@ -23,9 +23,17 @@ #define RRTYPE_DLV_ATTRIBUTES 0 +#include <isc/sha1.h> +#include <isc/sha2.h> + +#include <dns/ds.h> + + static inline isc_result_t fromtext_dlv(ARGS_FROMTEXT) { isc_token_t token; + unsigned char c; + int length; REQUIRE(type == 32769); @@ -61,11 +69,17 @@ fromtext_dlv(ARGS_FROMTEXT) { if (token.value.as_ulong > 0xffU) RETTOK(ISC_R_RANGE); RETERR(uint8_tobuffer(token.value.as_ulong, target)); - type = (isc_uint16_t) token.value.as_ulong; + c = (unsigned char) token.value.as_ulong; /* * Digest. */ + if (c == DNS_DSDIGEST_SHA1) + length = ISC_SHA1_DIGESTLENGTH; + else if (c == DNS_DSDIGEST_SHA256) + length = ISC_SHA256_DIGESTLENGTH; + else + length = -1; return (isc_hex_tobuffer(lexer, target, -1)); } @@ -130,9 +144,27 @@ fromwire_dlv(ARGS_FROMWIRE) { UNUSED(options); isc_buffer_activeregion(source, &sr); - if (sr.length < 4) + + /* + * Check digest lengths if we know them. + */ + if (sr.length < 4 || + (sr.base[3] == DNS_DSDIGEST_SHA1 && + sr.length < 4 + ISC_SHA1_DIGESTLENGTH) || + (sr.base[3] == DNS_DSDIGEST_SHA256 && + sr.length < 4 + ISC_SHA256_DIGESTLENGTH)) return (ISC_R_UNEXPECTEDEND); + /* + * Only copy digest lengths if we know them. + * If there is extra data dns_rdata_fromwire() will + * detect that. + */ + if (sr.base[3] == DNS_DSDIGEST_SHA1) + sr.length = 4 + ISC_SHA1_DIGESTLENGTH; + else if (sr.base[3] == DNS_DSDIGEST_SHA256) + sr.length = 4 + ISC_SHA256_DIGESTLENGTH; + isc_buffer_forward(source, sr.length); return (mem_tobuffer(target, sr.base, sr.length)); } @@ -174,6 +206,14 @@ fromstruct_dlv(ARGS_FROMSTRUCT) { REQUIRE(source != NULL); REQUIRE(dlv->common.rdtype == type); REQUIRE(dlv->common.rdclass == rdclass); + switch (dlv->digest_type) { + case DNS_DSDIGEST_SHA1: + REQUIRE(dlv->length == ISC_SHA1_DIGESTLENGTH); + break; + case DNS_DSDIGEST_SHA256: + REQUIRE(dlv->length == ISC_SHA256_DIGESTLENGTH); + break; + } UNUSED(type); UNUSED(rdclass); diff --git a/lib/dns/rdata/generic/ds_43.c b/lib/dns/rdata/generic/ds_43.c index b9a3a3e6..632bb9f3 100644 --- a/lib/dns/rdata/generic/ds_43.c +++ b/lib/dns/rdata/generic/ds_43.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2002 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: ds_43.c,v 1.7.18.2 2005/09/06 07:29:32 marka Exp $ */ +/* $Id: ds_43.c,v 1.7.18.4 2007/02/26 23:46:22 tbox Exp $ */ /* draft-ietf-dnsext-delegation-signer-05.txt */ @@ -25,10 +25,16 @@ #define RRTYPE_DS_ATTRIBUTES \ (DNS_RDATATYPEATTR_DNSSEC|DNS_RDATATYPEATTR_ATPARENT) +#include <isc/sha1.h> +#include <isc/sha2.h> + +#include <dns/ds.h> + static inline isc_result_t fromtext_ds(ARGS_FROMTEXT) { isc_token_t token; unsigned char c; + int length; REQUIRE(type == 43); @@ -63,12 +69,18 @@ fromtext_ds(ARGS_FROMTEXT) { if (token.value.as_ulong > 0xffU) RETTOK(ISC_R_RANGE); RETERR(uint8_tobuffer(token.value.as_ulong, target)); - type = (isc_uint16_t) token.value.as_ulong; + c = (unsigned char) token.value.as_ulong; /* * Digest. */ - return (isc_hex_tobuffer(lexer, target, -1)); + if (c == DNS_DSDIGEST_SHA1) + length = ISC_SHA1_DIGESTLENGTH; + else if (c == DNS_DSDIGEST_SHA256) + length = ISC_SHA256_DIGESTLENGTH; + else + length = -1; + return (isc_hex_tobuffer(lexer, target, length)); } static inline isc_result_t @@ -132,9 +144,27 @@ fromwire_ds(ARGS_FROMWIRE) { UNUSED(options); isc_buffer_activeregion(source, &sr); - if (sr.length < 4) + + /* + * Check digest lengths if we know them. + */ + if (sr.length < 4 || + (sr.base[3] == DNS_DSDIGEST_SHA1 && + sr.length < 4 + ISC_SHA1_DIGESTLENGTH) || + (sr.base[3] == DNS_DSDIGEST_SHA256 && + sr.length < 4 + ISC_SHA256_DIGESTLENGTH)) return (ISC_R_UNEXPECTEDEND); + /* + * Only copy digest lengths if we know them. + * If there is extra data dns_rdata_fromwire() will + * detect that. + */ + if (sr.base[3] == DNS_DSDIGEST_SHA1) + sr.length = 4 + ISC_SHA1_DIGESTLENGTH; + else if (sr.base[3] == DNS_DSDIGEST_SHA256) + sr.length = 4 + ISC_SHA256_DIGESTLENGTH; + isc_buffer_forward(source, sr.length); return (mem_tobuffer(target, sr.base, sr.length)); } @@ -176,6 +206,14 @@ fromstruct_ds(ARGS_FROMSTRUCT) { REQUIRE(source != NULL); REQUIRE(ds->common.rdtype == type); REQUIRE(ds->common.rdclass == rdclass); + switch (ds->digest_type) { + case DNS_DSDIGEST_SHA1: + REQUIRE(ds->length == ISC_SHA1_DIGESTLENGTH); + break; + case DNS_DSDIGEST_SHA256: + REQUIRE(ds->length == ISC_SHA256_DIGESTLENGTH); + break; + } UNUSED(type); UNUSED(rdclass); diff --git a/lib/dns/rdataslab.c b/lib/dns/rdataslab.c index 3b5ab2dd..a3096fd1 100644 --- a/lib/dns/rdataslab.c +++ b/lib/dns/rdataslab.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: rdataslab.c,v 1.35.18.5 2006/03/05 23:58:51 marka Exp $ */ +/* $Id: rdataslab.c,v 1.35.18.7 2007/03/14 23:46:21 tbox Exp $ */ /*! \file */ @@ -33,6 +33,10 @@ #include <dns/rdataset.h> #include <dns/rdataslab.h> +#ifndef DNS_RDATASET_FIXED +#define DNS_RDATASET_FIXED 1 +#endif + /* * The rdataslab structure allows iteration to occur in both load order * and DNSSEC order. The structure is as follows: @@ -45,10 +49,19 @@ * order (2 bytes) * data (data length bytes) * + * If DNS_RDATASET_FIXED is defined to be zero (0) the format of a + * rdataslab is as follows: + * + * header (reservelen bytes) + * record count (2 bytes) + * data records + * data length (2 bytes) + * data (data length bytes) + * * Offsets are from the end of the header. * * Load order traversal is performed by walking the offset table to find - * the start of the record. + * the start of the record (DNS_RDATASET_FIXED = 1). * * DNSSEC order traversal is performed by walking the data records. * @@ -79,6 +92,7 @@ compare_rdata(const void *p1, const void *p2) { return (dns_rdata_compare(&x1->rdata, &x2->rdata)); } +#if DNS_RDATASET_FIXED static void fillin_offsets(unsigned char *offsetbase, unsigned int *offsettable, unsigned length) @@ -108,6 +122,7 @@ fillin_offsets(unsigned char *offsetbase, unsigned int *offsettable, *raw = j++ & 0xff; } } +#endif isc_result_t dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx, @@ -115,13 +130,17 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx, { struct xrdata *x; unsigned char *rawbuf; +#if DNS_RDATASET_FIXED unsigned char *offsetbase; +#endif unsigned int buflen; isc_result_t result; unsigned int nitems; unsigned int nalloc; unsigned int i; +#if DNS_RDATASET_FIXED unsigned int *offsettable; +#endif buflen = reservelen + 2; @@ -147,7 +166,9 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx, INSIST(result == ISC_R_SUCCESS); dns_rdata_init(&x[i].rdata); dns_rdataset_current(rdataset, &x[i].rdata); +#if DNS_RDATASET_FIXED x[i].order = i; +#endif result = dns_rdataset_next(rdataset); } if (result != ISC_R_NOMORE) @@ -179,20 +200,30 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx, if (compare_rdata(&x[i-1].rdata, &x[i].rdata) == 0) { x[i-1].rdata.data = NULL; x[i-1].rdata.length = 0; +#if DNS_RDATASET_FIXED /* * Preserve the least order so A, B, A -> A, B * after duplicate removal. */ if (x[i-1].order < x[i].order) x[i].order = x[i-1].order; +#endif nitems--; } else +#if DNS_RDATASET_FIXED buflen += (8 + x[i-1].rdata.length); +#else + buflen += (2 + x[i-1].rdata.length); +#endif } /* * Don't forget the last item! */ +#if DNS_RDATASET_FIXED buflen += (8 + x[i-1].rdata.length); +#else + buflen += (2 + x[i-1].rdata.length); +#endif /* * Ensure that singleton types are actually singletons. @@ -216,6 +247,7 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx, goto free_rdatas; } +#if DNS_RDATASET_FIXED /* Allocate temporary offset table. */ offsettable = isc_mem_get(mctx, nalloc * sizeof(unsigned int)); if (offsettable == NULL) { @@ -224,33 +256,43 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx, goto free_rdatas; } memset(offsettable, 0, nalloc * sizeof(unsigned int)); +#endif region->base = rawbuf; region->length = buflen; rawbuf += reservelen; +#if DNS_RDATASET_FIXED offsetbase = rawbuf; +#endif *rawbuf++ = (nitems & 0xff00) >> 8; *rawbuf++ = (nitems & 0x00ff); +#if DNS_RDATASET_FIXED /* Skip load order table. Filled in later. */ rawbuf += nitems * 4; +#endif for (i = 0; i < nalloc; i++) { if (x[i].rdata.data == NULL) continue; +#if DNS_RDATASET_FIXED offsettable[x[i].order] = rawbuf - offsetbase; +#endif *rawbuf++ = (x[i].rdata.length & 0xff00) >> 8; *rawbuf++ = (x[i].rdata.length & 0x00ff); +#if DNS_RDATASET_FIXED rawbuf += 2; /* filled in later */ +#endif memcpy(rawbuf, x[i].rdata.data, x[i].rdata.length); rawbuf += x[i].rdata.length; } +#if DNS_RDATASET_FIXED fillin_offsets(offsetbase, offsettable, nalloc); - isc_mem_put(mctx, offsettable, nalloc * sizeof(unsigned int)); +#endif result = ISC_R_SUCCESS; @@ -274,7 +316,11 @@ rdataset_first(dns_rdataset_t *rdataset) { rdataset->private5 = NULL; return (ISC_R_NOMORE); } +#if DNS_RDATASET_FIXED raw += 2 + (4 * count); +#else + raw += 2; +#endif /* * The privateuint4 field is the number of rdata beyond the cursor * position, so we decrement the total count by one before storing @@ -300,7 +346,11 @@ rdataset_next(dns_rdataset_t *rdataset) { rdataset->privateuint4 = count; raw = rdataset->private5; length = raw[0] * 256 + raw[1]; +#if DNS_RDATASET_FIXED raw += length + 4; +#else + raw += length + 2; +#endif rdataset->private5 = raw; return (ISC_R_SUCCESS); @@ -314,7 +364,11 @@ rdataset_current(dns_rdataset_t *rdataset, dns_rdata_t *rdata) { REQUIRE(raw != NULL); r.length = raw[0] * 256 + raw[1]; +#if DNS_RDATASET_FIXED raw += 4; +#else + raw += 2; +#endif r.base = raw; dns_rdata_fromregion(rdata, rdataset->rdclass, rdataset->type, &r); } @@ -390,12 +444,18 @@ dns_rdataslab_size(unsigned char *slab, unsigned int reservelen) { current = slab + reservelen; count = *current++ * 256; count += *current++; +#if DNS_RDATASET_FIXED current += (4 * count); +#endif while (count > 0) { count--; length = *current++ * 256; length += *current++; +#if DNS_RDATASET_FIXED current += length + 2; +#else + current += length; +#endif } return ((unsigned int)(current - slab)); @@ -417,7 +477,9 @@ rdata_from_slab(unsigned char **current, region.length = *tcurrent++ * 256; region.length += *tcurrent++; +#if DNS_RDATASET_FIXED tcurrent += 2; +#endif region.base = tcurrent; tcurrent += region.length; dns_rdata_fromregion(rdata, rdclass, type, ®ion); @@ -443,7 +505,9 @@ rdata_in_slab(unsigned char *slab, unsigned int reservelen, count = *current++ * 256; count += *current++; +#if DNS_RDATASET_FIXED current += (4 * count); +#endif for (i = 0; i < count; i++) { rdata_from_slab(¤t, rdclass, type, &trdata); @@ -473,11 +537,13 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab, unsigned int oadded = 0; unsigned int nadded = 0; unsigned int nncount = 0; +#if DNS_RDATASET_FIXED unsigned int oncount; unsigned int norder = 0; unsigned int oorder = 0; unsigned char *offsetbase; unsigned int *offsettable; +#endif /* * XXX Need parameter to allow "delete rdatasets in nslab" merge, @@ -490,15 +556,21 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab, ocurrent = oslab + reservelen; ocount = *ocurrent++ * 256; ocount += *ocurrent++; +#if DNS_RDATASET_FIXED ocurrent += (4 * ocount); +#endif ostart = ocurrent; ncurrent = nslab + reservelen; ncount = *ncurrent++ * 256; ncount += *ncurrent++; +#if DNS_RDATASET_FIXED ncurrent += (4 * ncount); +#endif INSIST(ocount > 0 && ncount > 0); +#if DNS_RDATASET_FIXED oncount = ncount; +#endif /* * Yes, this is inefficient! @@ -511,8 +583,13 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab, for (count = 0; count < ocount; count++) { length = *ocurrent++ * 256; length += *ocurrent++; +#if DNS_RDATASET_FIXED olength += length + 8; ocurrent += length + 2; +#else + olength += length + 2; + ocurrent += length; +#endif } /* @@ -528,7 +605,9 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab, do { nregion.length = *ncurrent++ * 256; nregion.length += *ncurrent++; - ncurrent += 2; +#if DNS_RDATASET_FIXED + ncurrent += 2; /* Skip order. */ +#endif nregion.base = ncurrent; dns_rdata_init(&nrdata); dns_rdata_fromregion(&nrdata, rdclass, type, &nregion); @@ -537,7 +616,11 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab, /* * This rdata isn't in the old slab. */ +#if DNS_RDATASET_FIXED tlength += nregion.length + 8; +#else + tlength += nregion.length + 2; +#endif tcount++; nncount++; added_something = ISC_TRUE; @@ -576,7 +659,9 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab, return (ISC_R_NOMEMORY); memcpy(tstart, nslab, reservelen); tcurrent = tstart + reservelen; +#if DNS_RDATASET_FIXED offsetbase = tcurrent; +#endif /* * Write the new count. @@ -584,6 +669,7 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab, *tcurrent++ = (tcount & 0xff00) >> 8; *tcurrent++ = (tcount & 0x00ff); +#if DNS_RDATASET_FIXED /* * Skip offset table. */ @@ -596,25 +682,33 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab, return (ISC_R_NOMEMORY); } memset(offsettable, 0, (ocount + oncount) * sizeof(unsigned int)); +#endif /* * Merge the two slabs. */ ocurrent = ostart; INSIST(ocount != 0); +#if DNS_RDATASET_FIXED oorder = ocurrent[2] * 256 + ocurrent[3]; INSIST(oorder < ocount); +#endif rdata_from_slab(&ocurrent, rdclass, type, &ordata); ncurrent = nslab + reservelen + 2; +#if DNS_RDATASET_FIXED ncurrent += (4 * oncount); +#endif if (ncount > 0) { do { dns_rdata_reset(&nrdata); +#if DNS_RDATASET_FIXED norder = ncurrent[2] * 256 + ncurrent[3]; + INSIST(norder < oncount); - rdata_from_slab(&ncurrent, rdclass, type, &nrdata); +#endif + rdata_from_slab(&ncurrent, rdclass, type, &nrdata); } while (rdata_in_slab(oslab, reservelen, rdclass, type, &nrdata)); } @@ -628,36 +722,48 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab, else fromold = ISC_TF(compare_rdata(&ordata, &nrdata) < 0); if (fromold) { +#if DNS_RDATASET_FIXED offsettable[oorder] = tcurrent - offsetbase; +#endif length = ordata.length; *tcurrent++ = (length & 0xff00) >> 8; *tcurrent++ = (length & 0x00ff); +#if DNS_RDATASET_FIXED tcurrent += 2; /* fill in later */ +#endif memcpy(tcurrent, ordata.data, length); tcurrent += length; oadded++; if (oadded < ocount) { dns_rdata_reset(&ordata); +#if DNS_RDATASET_FIXED oorder = ocurrent[2] * 256 + ocurrent[3]; INSIST(oorder < ocount); - rdata_from_slab(&ocurrent, rdclass, type, +#endif + rdata_from_slab(&ocurrent, rdclass, type, &ordata); } } else { +#if DNS_RDATASET_FIXED offsettable[ocount + norder] = tcurrent - offsetbase; +#endif length = nrdata.length; *tcurrent++ = (length & 0xff00) >> 8; *tcurrent++ = (length & 0x00ff); +#if DNS_RDATASET_FIXED tcurrent += 2; /* fill in later */ +#endif memcpy(tcurrent, nrdata.data, length); tcurrent += length; nadded++; if (nadded < ncount) { do { dns_rdata_reset(&nrdata); +#if DNS_RDATASET_FIXED norder = ncurrent[2] * 256 + ncurrent[3]; INSIST(norder < oncount); - rdata_from_slab(&ncurrent, rdclass, +#endif + rdata_from_slab(&ncurrent, rdclass, type, &nrdata); } while (rdata_in_slab(oslab, reservelen, rdclass, type, @@ -666,10 +772,12 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab, } } +#if DNS_RDATASET_FIXED fillin_offsets(offsetbase, offsettable, ocount + oncount); isc_mem_put(mctx, offsettable, (ocount + oncount) * sizeof(unsigned int)); +#endif INSIST(tcurrent == tstart + tlength); @@ -688,8 +796,10 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab, unsigned int mcount, scount, rcount ,count, tlength, tcount, i; dns_rdata_t srdata = DNS_RDATA_INIT; dns_rdata_t mrdata = DNS_RDATA_INIT; +#if DNS_RDATASET_FIXED unsigned char *offsetbase; unsigned int *offsettable; +#endif unsigned int order; REQUIRE(tslabp != NULL && *tslabp == NULL); @@ -714,8 +824,10 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab, tcount = 0; rcount = 0; +#if DNS_RDATASET_FIXED mcurrent += 4 * mcount; scurrent += 4 * scount; +#endif sstart = scurrent; /* @@ -744,11 +856,13 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab, dns_rdata_reset(&mrdata); } +#if DNS_RDATASET_FIXED tlength += (4 * tcount); +#endif /* * Check that all the records originally existed. The numeric - * check only works as rdataslabs do not contain duplicates. + * check only works as rdataslabs do not contain duplicates. */ if (((flags & DNS_RDATASLAB_EXACT) != 0) && (rcount != scount)) return (DNS_R_NOTEXACT); @@ -773,6 +887,7 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab, return (ISC_R_NOMEMORY); memcpy(tstart, mslab, reservelen); tcurrent = tstart + reservelen; +#if DNS_RDATASET_FIXED offsetbase = tcurrent; offsettable = isc_mem_get(mctx, mcount * sizeof(unsigned int)); @@ -781,6 +896,7 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab, return (ISC_R_NOMEMORY); } memset(offsettable, 0, mcount * sizeof(unsigned int)); +#endif /* * Write the new count. @@ -788,7 +904,9 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab, *tcurrent++ = (tcount & 0xff00) >> 8; *tcurrent++ = (tcount & 0x00ff); +#if DNS_RDATASET_FIXED tcurrent += (4 * tcount); +#endif /* * Copy the parts of mslab not in sslab. @@ -796,11 +914,15 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab, mcurrent = mslab + reservelen; mcount = *mcurrent++ * 256; mcount += *mcurrent++; +#if DNS_RDATASET_FIXED mcurrent += (4 * mcount); +#endif for (i = 0; i < mcount; i++) { unsigned char *mrdatabegin = mcurrent; +#if DNS_RDATASET_FIXED order = mcurrent[2] * 256 + mcurrent[3]; INSIST(order < mcount); +#endif rdata_from_slab(&mcurrent, rdclass, type, &mrdata); scurrent = sstart; for (count = 0; count < scount; count++) { @@ -815,16 +937,20 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab, * copied to the tslab. */ unsigned int length = mcurrent - mrdatabegin; +#if DNS_RDATASET_FIXED offsettable[order] = tcurrent - offsetbase; +#endif memcpy(tcurrent, mrdatabegin, length); tcurrent += length; } dns_rdata_reset(&mrdata); } +#if DNS_RDATASET_FIXED fillin_offsets(offsetbase, offsettable, mcount); isc_mem_put(mctx, offsettable, mcount * sizeof(unsigned int)); +#endif INSIST(tcurrent == tstart + tlength); @@ -852,8 +978,10 @@ dns_rdataslab_equal(unsigned char *slab1, unsigned char *slab2, if (count1 != count2) return (ISC_FALSE); +#if DNS_RDATASET_FIXED current1 += (4 * count1); current2 += (4 * count2); +#endif while (count1 > 0) { length1 = *current1++ * 256; @@ -862,8 +990,10 @@ dns_rdataslab_equal(unsigned char *slab1, unsigned char *slab2, length2 = *current2++ * 256; length2 += *current2++; +#if DNS_RDATASET_FIXED current1 += 2; current2 += 2; +#endif if (length1 != length2 || memcmp(current1, current2, length1) != 0) @@ -898,8 +1028,10 @@ dns_rdataslab_equalx(unsigned char *slab1, unsigned char *slab2, if (count1 != count2) return (ISC_FALSE); +#if DNS_RDATASET_FIXED current1 += (4 * count1); current2 += (4 * count2); +#endif while (count1-- > 0) { rdata_from_slab(¤t1, rdclass, type, &rdata1); diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c index 73128415..1d582077 100644 --- a/lib/dns/resolver.c +++ b/lib/dns/resolver.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: resolver.c,v 1.284.18.57 2007/02/14 23:41:01 marka Exp $ */ +/* $Id: resolver.c,v 1.284.18.60 2007/06/18 02:43:46 marka Exp $ */ /*! \file */ @@ -250,7 +250,7 @@ struct fetchctx { #define ADDRWAIT(f) (((f)->attributes & FCTX_ATTR_ADDRWAIT) != \ 0) #define SHUTTINGDOWN(f) (((f)->attributes & FCTX_ATTR_SHUTTINGDOWN) \ - != 0) + != 0) #define WANTCACHE(f) (((f)->attributes & FCTX_ATTR_WANTCACHE) != 0) #define WANTNCACHE(f) (((f)->attributes & FCTX_ATTR_WANTNCACHE) != 0) #define NEEDEDNS0(f) (((f)->attributes & FCTX_ATTR_NEEDEDNS0) != 0) @@ -353,6 +353,8 @@ struct dns_resolver { #define NXDOMAIN(r) (((r)->attributes & DNS_RDATASETATTR_NXDOMAIN) != 0) +#define dns_db_transfernode(a,b,c) do { (*c) = (*b); (*b) = NULL; } while (0) + static void destroy(dns_resolver_t *res); static void empty_bucket(dns_resolver_t *res); static isc_result_t resquery_send(resquery_t *query); @@ -793,6 +795,15 @@ fctx_sendevents(fetchctx_t *fctx, isc_result_t result) { fctx->type == dns_rdatatype_any || fctx->type == dns_rdatatype_rrsig || fctx->type == dns_rdatatype_sig); + + /* + * Negative results must be indicated in event->result. + */ + if (dns_rdataset_isassociated(event->rdataset) && + event->rdataset->type == dns_rdatatype_none) { + INSIST(event->result == DNS_R_NCACHENXDOMAIN || + event->result == DNS_R_NCACHENXRRSET); + } isc_task_sendanddetach(&task, ISC_EVENT_PTR(&event)); count++; @@ -802,7 +813,7 @@ fctx_sendevents(fetchctx_t *fctx, isc_result_t result) { fctx->spilled && (count < fctx->res->spillatmax || fctx->res->spillatmax == 0)) { LOCK(&fctx->res->lock); - if (count == fctx->res->spillat && !fctx->res->exiting) { + if (count == fctx->res->spillat && !fctx->res->exiting) { fctx->res->spillat += 5; if (fctx->res->spillat > fctx->res->spillatmax && fctx->res->spillatmax != 0) @@ -1067,7 +1078,7 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, isc_netaddr_t dstip; isc_netaddr_fromsockaddr(&dstip, &addrinfo->sockaddr); result = dns_peerlist_peerbyaddr(res->view->peers, - &dstip, &peer); + &dstip, &peer); if (result == ISC_R_SUCCESS) { result = dns_peer_getquerysource(peer, &addr); if (result == ISC_R_SUCCESS) @@ -1433,7 +1444,7 @@ resquery_send(resquery_t *query) { FCTXTRACE("too many timeouts, disabling EDNS0"); } else if ((triededns(fctx, &query->addrinfo->sockaddr) || fctx->timeouts >= MAX_EDNS0_TIMEOUTS) && - (query->options & DNS_FETCHOPT_NOEDNS0) == 0) { + (query->options & DNS_FETCHOPT_NOEDNS0) == 0) { query->options |= DNS_FETCHOPT_EDNS512; FCTXTRACE("too many timeouts, setting EDNS size to 512"); } @@ -1841,7 +1852,7 @@ mark_bad(fetchctx_t *fctx) { } static void -add_bad(fetchctx_t *fctx, isc_sockaddr_t *address, isc_result_t reason) { +add_bad(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, isc_result_t reason) { char namebuf[DNS_NAME_FORMATSIZE]; char addrbuf[ISC_SOCKADDR_FORMATSIZE]; char classbuf[64]; @@ -1850,6 +1861,7 @@ add_bad(fetchctx_t *fctx, isc_sockaddr_t *address, isc_result_t reason) { isc_buffer_t b; isc_sockaddr_t *sa; const char *sep1, *sep2; + isc_sockaddr_t *address = &addrinfo->sockaddr; if (bad_server(fctx, address)) { /* @@ -1870,6 +1882,11 @@ add_bad(fetchctx_t *fctx, isc_sockaddr_t *address, isc_result_t reason) { if (reason == DNS_R_LAME) /* already logged */ return; + if (reason == DNS_R_UNEXPECTEDRCODE && + fctx->rmessage->opcode == dns_rcode_servfail && + ISFORWARDER(addrinfo)) + return; + if (reason == DNS_R_UNEXPECTEDRCODE) { isc_buffer_init(&b, code, sizeof(code) - 1); dns_rcode_totext(fctx->rmessage->rcode, &b); @@ -3166,7 +3183,7 @@ is_lame(fetchctx_t *fctx) { if (rdataset->type != dns_rdatatype_ns) continue; namereln = dns_name_fullcompare(name, &fctx->domain, - &order, &labels); + &order, &labels); if (namereln == dns_namereln_equal && (message->flags & DNS_MESSAGEFLAG_AA) != 0) return (ISC_FALSE); @@ -3441,7 +3458,7 @@ validated(isc_task_t *task, isc_event_t *event) { if (result == ISC_R_SUCCESS) dns_db_detachnode(fctx->cache, &node); result = vevent->result; - add_bad(fctx, &addrinfo->sockaddr, result); + add_bad(fctx, addrinfo, result); isc_event_free(&event); UNLOCK(&fctx->res->buckets[fctx->bucketnum].lock); if (!ISC_LIST_EMPTY(fctx->validators)) @@ -3528,6 +3545,7 @@ validated(isc_task_t *task, isc_event_t *event) { * If we only deferred the destroy because we wanted to cache * the data, destroy now. */ + dns_db_detachnode(fctx->cache, &node); UNLOCK(&fctx->res->buckets[fctx->bucketnum].lock); if (SHUTTINGDOWN(fctx)) maybe_destroy(fctx); /* Locks bucket. */ @@ -3544,6 +3562,7 @@ validated(isc_task_t *task, isc_event_t *event) { * more rdatasets that still need to * be validated. */ + dns_db_detachnode(fctx->cache, &node); UNLOCK(&fctx->res->buckets[fctx->bucketnum].lock); dns_validator_send(ISC_LIST_HEAD(fctx->validators)); goto cleanup_event; @@ -3609,8 +3628,7 @@ validated(isc_task_t *task, isc_event_t *event) { dns_fixedname_name(&hevent->foundname), NULL) == ISC_R_SUCCESS); dns_db_attach(fctx->cache, &hevent->db); - hevent->node = node; - node = NULL; + dns_db_transfernode(fctx->cache, &node, &hevent->node); clone_results(fctx); } @@ -3623,6 +3641,7 @@ validated(isc_task_t *task, isc_event_t *event) { fctx_done(fctx, result); /* Locks bucket. */ cleanup_event: + INSIST(node == NULL); isc_event_free(&event); } @@ -3742,8 +3761,10 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_adbaddrinfo_t *addrinfo, fail ? "failure" : "warning", namebuf, typebuf, classbuf); if (fail) { - if (ANSWER(rdataset)) + if (ANSWER(rdataset)) { + dns_db_detachnode(fctx->cache, &node); return (DNS_R_BADNAME); + } continue; } } @@ -3949,8 +3970,7 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_adbaddrinfo_t *addrinfo, if (event != NULL) { event->result = eresult; dns_db_attach(fctx->cache, adbp); - *anodep = node; - node = NULL; + dns_db_transfernode(fctx->cache, &node, anodep); clone_results(fctx); } } @@ -4190,8 +4210,7 @@ ncache_message(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, if (event != NULL) { event->result = eresult; dns_db_attach(fctx->cache, adbp); - *anodep = node; - node = NULL; + dns_db_transfernode(fctx->cache, &node, anodep); clone_results(fctx); } } @@ -5830,7 +5849,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) { * Add this server to the list of bad servers for * this fctx. */ - add_bad(fctx, &addrinfo->sockaddr, broken_server); + add_bad(fctx, addrinfo, broken_server); } if (get_nameservers) { @@ -5912,7 +5931,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) { fctx_done(fctx, result); } else if (result == DNS_R_CHASEDSSERVERS) { unsigned int n; - add_bad(fctx, &addrinfo->sockaddr, result); + add_bad(fctx, addrinfo, result); fctx_cancelqueries(fctx, ISC_TRUE); fctx_cleanupfinds(fctx); fctx_cleanupforwaddrs(fctx); @@ -7024,7 +7043,7 @@ static isc_boolean_t yes = ISC_TRUE, no = ISC_FALSE; isc_result_t dns_resolver_setmustbesecure(dns_resolver_t *resolver, dns_name_t *name, - isc_boolean_t value) + isc_boolean_t value) { isc_result_t result; diff --git a/lib/dns/validator.c b/lib/dns/validator.c index a92d647b..7066633b 100644 --- a/lib/dns/validator.c +++ b/lib/dns/validator.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: validator.c,v 1.119.18.29 2007/01/08 02:41:59 marka Exp $ */ +/* $Id: validator.c,v 1.119.18.31 2007/04/27 06:37:38 marka Exp $ */ /*! \file */ @@ -26,6 +26,7 @@ #include <isc/string.h> #include <isc/task.h> #include <isc/util.h> +#include <isc/sha2.h> #include <dns/db.h> #include <dns/ds.h> @@ -351,10 +352,12 @@ dsfetched(isc_task_t *task, isc_event_t *event) { if (result != DNS_R_WAIT) validator_done(val, result); } else if (eresult == DNS_R_NXRRSET || - eresult == DNS_R_NCACHENXRRSET) + eresult == DNS_R_NCACHENXRRSET || + eresult == DNS_R_SERVFAIL) /* RFC 1034 parent? */ { validator_log(val, ISC_LOG_DEBUG(3), - "falling back to insecurity proof"); + "falling back to insecurity proof (%s)", + dns_result_totext(eresult)); val->attributes |= VALATTR_INSECURITY; result = proveunsecure(val, ISC_FALSE); if (result != DNS_R_WAIT) @@ -1504,7 +1507,8 @@ dlv_validatezonekey(dns_validator_t *val) { dlv.algorithm)) continue; - if (dlv.digest_type == DNS_DSDIGEST_SHA256) { + if (dlv.digest_type == DNS_DSDIGEST_SHA256 && + dlv.length == ISC_SHA256_DIGESTLENGTH) { digest_type = DNS_DSDIGEST_SHA256; break; } @@ -1837,7 +1841,8 @@ validatezonekey(dns_validator_t *val) { ds.algorithm)) continue; - if (ds.digest_type == DNS_DSDIGEST_SHA256) { + if (ds.digest_type == DNS_DSDIGEST_SHA256 && + ds.length == ISC_SHA256_DIGESTLENGTH) { digest_type = DNS_DSDIGEST_SHA256; break; } diff --git a/lib/dns/view.c b/lib/dns/view.c index 49385973..53c657d0 100644 --- a/lib/dns/view.c +++ b/lib/dns/view.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: view.c,v 1.126.18.11 2006/03/09 23:38:21 marka Exp $ */ +/* $Id: view.c,v 1.126.18.13 2007/03/06 02:12:08 tbox Exp $ */ /*! \file */ @@ -703,6 +703,7 @@ dns_view_find(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type, REQUIRE(view->frozen); REQUIRE(type != dns_rdatatype_rrsig); REQUIRE(rdataset != NULL); /* XXXBEW - remove this */ + REQUIRE(nodep == NULL || *nodep == NULL); /* * Initialize. diff --git a/lib/dns/win32/DLLMain.c b/lib/dns/win32/DLLMain.c index d32d4e36..1ad9d7f8 100644 --- a/lib/dns/win32/DLLMain.c +++ b/lib/dns/win32/DLLMain.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2001 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,13 +15,11 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: DLLMain.c,v 1.4 2004/03/05 05:10:41 marka Exp $ */ +/* $Id: DLLMain.c,v 1.4.18.2 2007/06/18 23:46:32 tbox Exp $ */ #include <windows.h> #include <signal.h> -BOOL InitSockets(void); - /* * Called when we enter the DLL */ diff --git a/lib/dns/win32/libdns.def b/lib/dns/win32/libdns.def index fbdce93e..205a3882 100644 --- a/lib/dns/win32/libdns.def +++ b/lib/dns/win32/libdns.def @@ -164,6 +164,7 @@ dns_dispatch_detach dns_dispatch_getlocaladdress dns_dispatch_getsocket dns_dispatch_getudp +dns_dispatch_hash dns_dispatch_importrecv dns_dispatch_removeresponse dns_dispatch_starttcp diff --git a/lib/dns/xfrin.c b/lib/dns/xfrin.c index bec8501b..4e225135 100644 --- a/lib/dns/xfrin.c +++ b/lib/dns/xfrin.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: xfrin.c,v 1.135.18.11 2006/07/19 00:58:01 marka Exp $ */ +/* $Id: xfrin.c,v 1.135.18.14 2007/05/24 02:56:10 marka Exp $ */ /*! \file */ @@ -722,6 +722,11 @@ xfrin_fail(dns_xfrin_ctx_t *xfr, isc_result_t result, const char *msg) { result = DNS_R_BADIXFR; } xfrin_cancelio(xfr); + /* + * Close the journal. + */ + if (xfr->ixfr.journal != NULL) + dns_journal_destroy(&xfr->ixfr.journal); if (xfr->done != NULL) { (xfr->done)(xfr->zone, result); xfr->done = NULL; @@ -1304,6 +1309,11 @@ xfrin_recv_done(isc_task_t *task, isc_event_t *ev) { CHECK(xfrin_send_request(xfr)); } else if (xfr->state == XFRST_END) { /* + * Close the journal. + */ + if (xfr->ixfr.journal != NULL) + dns_journal_destroy(&xfr->ixfr.journal); + /* * Inform the caller we succeeded. */ if (xfr->done != NULL) { diff --git a/lib/dns/zone.c b/lib/dns/zone.c index 5a737963..6f8f6c0b 100644 --- a/lib/dns/zone.c +++ b/lib/dns/zone.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: zone.c,v 1.410.18.47 2006/12/07 06:21:16 marka Exp $ */ +/* $Id: zone.c,v 1.410.18.49 2007/02/26 23:46:22 tbox Exp $ */ /*! \file */ @@ -1138,7 +1138,8 @@ zone_load(dns_zone_t *zone, unsigned int flags) { result = isc_file_getmodtime(zone->masterfile, &filetime); if (result == ISC_R_SUCCESS) { - if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_HASINCLUDE) && + if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADED) && + !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_HASINCLUDE) && isc_time_compare(&filetime, &zone->loadtime) <= 0) { dns_zone_log(zone, ISC_LOG_DEBUG(1), "skipping load: master file " diff --git a/lib/isc/api b/lib/isc/api index 759a0518..e57948fe 100644 --- a/lib/isc/api +++ b/lib/isc/api @@ -1,3 +1,3 @@ LIBINTERFACE = 32 -LIBREVISION = 3 +LIBREVISION = 4 LIBAGE = 0 diff --git a/lib/isc/mem.c b/lib/isc/mem.c index 35918dca..026d5a8c 100644 --- a/lib/isc/mem.c +++ b/lib/isc/mem.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1997-2003 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: mem.c,v 1.116.18.12 2006/12/08 05:07:59 marka Exp $ */ +/* $Id: mem.c,v 1.116.18.16 2007/03/06 00:50:11 marka Exp $ */ /*! \file */ @@ -1948,7 +1948,7 @@ isc_mem_checkdestroyed(FILE *file) { } fflush(file); #endif - INSIST(1); + INSIST(0); } UNLOCK(&lock); } diff --git a/lib/isc/unix/ifiter_getifaddrs.c b/lib/isc/unix/ifiter_getifaddrs.c index 7e359aa8..34479685 100644 --- a/lib/isc/unix/ifiter_getifaddrs.c +++ b/lib/isc/unix/ifiter_getifaddrs.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2003 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: ifiter_getifaddrs.c,v 1.4.18.2 2005/04/29 00:17:08 marka Exp $ */ +/* $Id: ifiter_getifaddrs.c,v 1.4.18.4 2007/03/13 23:46:23 tbox Exp $ */ /*! \file * \brief @@ -111,7 +111,9 @@ internal_current(isc_interfaceiter_t *iter) { INSIST(ifa != NULL); INSIST(ifa->ifa_name != NULL); - INSIST(ifa->ifa_addr != NULL); + + if (ifa->ifa_addr == NULL) + return (ISC_R_IGNORE); family = ifa->ifa_addr->sa_family; if (family != AF_INET && family != AF_INET6) diff --git a/lib/isc/unix/socket.c b/lib/isc/unix/socket.c index 6b4c34cb..14a22c90 100644 --- a/lib/isc/unix/socket.c +++ b/lib/isc/unix/socket.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1998-2003 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: socket.c,v 1.237.18.24 2006/06/06 00:56:09 marka Exp $ */ +/* $Id: socket.c,v 1.237.18.28 2007/05/21 01:56:11 marka Exp $ */ /*! \file */ @@ -48,6 +48,7 @@ #include <isc/msgs.h> #include <isc/mutex.h> #include <isc/net.h> +#include <isc/once.h> #include <isc/platform.h> #include <isc/print.h> #include <isc/region.h> @@ -71,6 +72,11 @@ #define ISC_SOCKADDR_LEN_T unsigned int #endif + +#if defined(SO_BSDCOMPAT) && defined(__linux__) +#include <sys/utsname.h> +#endif + /*% * Define what the possible "soft" errors can be. These are non-fatal returns * of various network related functions, like recv() and so on. @@ -1386,7 +1392,45 @@ free_socket(isc_socket_t **socketp) { *socketp = NULL; } +#ifdef SO_BSDCOMPAT /* + * This really should not be necessary to do. Having to workout + * which kernel version we are on at run time so that we don't cause + * the kernel to issue a warning about us using a deprecated socket option. + * Such warnings should *never* be on by default in production kernels. + * + * We can't do this a build time because executables are moved between + * machines and hence kernels. + * + * We can't just not set SO_BSDCOMAT because some kernels require it. + */ + +static isc_once_t bsdcompat_once = ISC_ONCE_INIT; +isc_boolean_t bsdcompat = ISC_TRUE; + +static void +clear_bsdcompat(void) { +#ifdef __linux__ + struct utsname buf; + char *endp; + long int major; + long int minor; + + uname(&buf); /* Can only fail if buf is bad in Linux. */ + + /* Paranoia in parsing can be increased, but we trust uname(). */ + major = strtol(buf.release, &endp, 10); + if (*endp == '.') { + minor = strtol(endp+1, &endp, 10); + if ((major > 2) || ((major == 2) && (minor >= 4))) { + bsdcompat = ISC_FALSE; + } + } +#endif /* __linux __ */ +} +#endif + +/*% * Create a new 'type' socket managed by 'manager'. Events * will be posted to 'task' and when dispatched 'action' will be * called with 'arg' as the arg value. The new socket is returned @@ -1407,6 +1451,7 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type, #endif char strbuf[ISC_STRERRORSIZE]; const char *err = "socket"; + int try = 0; REQUIRE(VALID_MANAGER(manager)); REQUIRE(socketp != NULL && *socketp == NULL); @@ -1416,6 +1461,7 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type, return (result); sock->pf = pf; + again: switch (type) { case isc_sockettype_udp: sock->fd = socket(pf, SOCK_DGRAM, IPPROTO_UDP); @@ -1427,6 +1473,8 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type, sock->fd = socket(pf, SOCK_STREAM, 0); break; } + if (sock->fd == -1 && errno == EINTR && try++ < 42) + goto again; #ifdef F_DUPFD /* @@ -1493,7 +1541,9 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type, } #ifdef SO_BSDCOMPAT - if (type != isc_sockettype_unix && + RUNTIME_CHECK(isc_once_do(&bsdcompat_once, + clear_bsdcompat) == ISC_R_SUCCESS); + if (type != isc_sockettype_unix && bsdcompat && setsockopt(sock->fd, SOL_SOCKET, SO_BSDCOMPAT, (void *)&on, sizeof(on)) < 0) { isc__strerror(errno, strbuf, sizeof(strbuf)); @@ -1540,7 +1590,7 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type, } #ifdef ISC_PLATFORM_HAVEIN6PKTINFO #ifdef IPV6_RECVPKTINFO - /* 2292bis */ + /* RFC 3542 */ if ((pf == AF_INET6) && (setsockopt(sock->fd, IPPROTO_IPV6, IPV6_RECVPKTINFO, (void *)&on, sizeof(on)) < 0)) { @@ -1555,7 +1605,7 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type, strbuf); } #else - /* 2292 */ + /* RFC 2292 */ if ((pf == AF_INET6) && (setsockopt(sock->fd, IPPROTO_IPV6, IPV6_PKTINFO, (void *)&on, sizeof(on)) < 0)) { @@ -1571,7 +1621,7 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type, } #endif /* IPV6_RECVPKTINFO */ #endif /* ISC_PLATFORM_HAVEIN6PKTINFO */ -#ifdef IPV6_USE_MIN_MTU /*2292bis, not too common yet*/ +#ifdef IPV6_USE_MIN_MTU /* RFC 3542, not too common yet*/ /* use minimum MTU */ if (pf == AF_INET6) { (void)setsockopt(sock->fd, IPPROTO_IPV6, diff --git a/lib/isc/win32/DLLMain.c b/lib/isc/win32/DLLMain.c index 8a33774f..c9dc556a 100644 --- a/lib/isc/win32/DLLMain.c +++ b/lib/isc/win32/DLLMain.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2001 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,13 +15,11 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: DLLMain.c,v 1.5 2004/03/05 05:11:56 marka Exp $ */ +/* $Id: DLLMain.c,v 1.5.18.2 2007/06/18 23:46:32 tbox Exp $ */ #include <windows.h> #include <stdio.h> -BOOL InitSockets(void); - /* * Called when we enter the DLL */ @@ -35,8 +33,6 @@ __declspec(dllexport) BOOL WINAPI DllMain(HINSTANCE hinstDLL, * initialization or a call to LoadLibrary. */ case DLL_PROCESS_ATTACH: - if (!InitSockets()) - return (FALSE); break; /* The attached process creates a new thread. */ diff --git a/lib/isc/win32/condition.c b/lib/isc/win32/condition.c index c5688cd7..24655f27 100644 --- a/lib/isc/win32/condition.c +++ b/lib/isc/win32/condition.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2006, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1998-2001 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,13 +15,14 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: condition.c,v 1.18.18.2 2006/02/13 23:50:53 marka Exp $ */ +/* $Id: condition.c,v 1.18.18.4 2007/05/10 23:46:24 tbox Exp $ */ #include <config.h> #include <isc/condition.h> #include <isc/assertions.h> #include <isc/util.h> +#include <isc/thread.h> #include <isc/time.h> #define LSIGNAL 0 @@ -34,23 +35,92 @@ isc_condition_init(isc_condition_t *cond) { REQUIRE(cond != NULL); cond->waiters = 0; + /* + * This handle is shared across all threads + */ h = CreateEvent(NULL, FALSE, FALSE, NULL); if (h == NULL) { /* XXX */ return (ISC_R_UNEXPECTED); } cond->events[LSIGNAL] = h; - h = CreateEvent(NULL, TRUE, FALSE, NULL); - if (h == NULL) { - (void)CloseHandle(cond->events[LSIGNAL]); - /* XXX */ + + /* + * The threadlist will hold the actual events needed + * for the wait condition + */ + ISC_LIST_INIT(cond->threadlist); + + return (ISC_R_SUCCESS); +} + +/* + * Add the thread to the threadlist along with the required events + */ +static isc_result_t +register_thread(unsigned long thrd, isc_condition_t *gblcond, + isc_condition_thread_t **localcond) +{ + HANDLE hc; + isc_condition_thread_t *newthread; + + REQUIRE(localcond != NULL && *localcond == NULL); + + newthread = malloc(sizeof(isc_condition_thread_t)); + if (newthread == NULL) + return (ISC_R_NOMEMORY); + + /* + * Create the thread-specific handle + */ + hc = CreateEvent(NULL, FALSE, FALSE, NULL); + if (hc == NULL) { + free(newthread); return (ISC_R_UNEXPECTED); } - cond->events[LBROADCAST] = h; + /* + * Add the thread ID and handles to list of threads for broadcast + */ + newthread->handle[LSIGNAL] = gblcond->events[LSIGNAL]; + newthread->handle[LBROADCAST] = hc; + newthread->th = thrd; + + /* + * The thread is holding the manager lock so this is safe + */ + ISC_LIST_APPEND(gblcond->threadlist, newthread, link); + *localcond = newthread; return (ISC_R_SUCCESS); } +static isc_result_t +find_thread_condition(unsigned long thrd, isc_condition_t *cond, + isc_condition_thread_t **threadcondp) +{ + isc_condition_thread_t *threadcond; + + REQUIRE(threadcondp != NULL && *threadcondp == NULL); + + /* + * Look for the thread ID. + */ + for (threadcond = ISC_LIST_HEAD(cond->threadlist); + threadcond != NULL; + threadcond = ISC_LIST_NEXT(threadcond, link)) { + + if (threadcond->th == thrd) { + *threadcondp = threadcond; + return (ISC_R_SUCCESS); + } + } + + /* + * Not found, so add it. + */ + return (register_thread(thrd, cond, threadcondp)); +} + isc_result_t isc_condition_signal(isc_condition_t *cond) { @@ -60,8 +130,7 @@ isc_condition_signal(isc_condition_t *cond) { */ REQUIRE(cond != NULL); - if (cond->waiters > 0 && - !SetEvent(cond->events[LSIGNAL])) { + if (!SetEvent(cond->events[LSIGNAL])) { /* XXX */ return (ISC_R_UNEXPECTED); } @@ -72,29 +141,54 @@ isc_condition_signal(isc_condition_t *cond) { isc_result_t isc_condition_broadcast(isc_condition_t *cond) { + isc_condition_thread_t *threadcond; + isc_boolean_t failed = ISC_FALSE; + /* * Unlike pthreads, the caller MUST hold the lock associated with * the condition variable when calling us. */ REQUIRE(cond != NULL); - if (cond->waiters > 0 && - !SetEvent(cond->events[LBROADCAST])) { - /* XXX */ - return (ISC_R_UNEXPECTED); + /* + * Notify every thread registered for this + */ + for (threadcond = ISC_LIST_HEAD(cond->threadlist); + threadcond != NULL; + threadcond = ISC_LIST_NEXT(threadcond, link)) { + + if (!SetEvent(threadcond->handle[LBROADCAST])) + failed = ISC_TRUE; } + if (failed) + return (ISC_R_UNEXPECTED); + return (ISC_R_SUCCESS); } isc_result_t isc_condition_destroy(isc_condition_t *cond) { + isc_condition_thread_t *next, *threadcond; + REQUIRE(cond != NULL); REQUIRE(cond->waiters == 0); (void)CloseHandle(cond->events[LSIGNAL]); - (void)CloseHandle(cond->events[LBROADCAST]); + + /* + * Delete the threadlist + */ + threadcond = ISC_LIST_HEAD(cond->threadlist); + + while (threadcond != NULL) { + next = ISC_LIST_NEXT(threadcond, link); + DEQUEUE(cond->threadlist, threadcond, link); + (void) CloseHandle(threadcond->handle[LBROADCAST]); + free(threadcond); + threadcond = next; + } return (ISC_R_SUCCESS); } @@ -111,22 +205,26 @@ isc_condition_destroy(isc_condition_t *cond) { static isc_result_t wait(isc_condition_t *cond, isc_mutex_t *mutex, DWORD milliseconds) { DWORD result; + isc_result_t tresult; + isc_condition_thread_t *threadcond = NULL; + + /* + * Get the thread events needed for the wait + */ + tresult = find_thread_condition(isc_thread_self(), cond, &threadcond); + if (tresult != ISC_R_SUCCESS) + return (tresult); cond->waiters++; LeaveCriticalSection(mutex); - result = WaitForMultipleObjects(2, cond->events, FALSE, milliseconds); + result = WaitForMultipleObjects(2, threadcond->handle, FALSE, + milliseconds); EnterCriticalSection(mutex); cond->waiters--; if (result == WAIT_FAILED) { /* XXX */ return (ISC_R_UNEXPECTED); } - if (cond->waiters == 0 && - !ResetEvent(cond->events[LBROADCAST])) { - /* XXX */ - return (ISC_R_UNEXPECTED); - } - if (result == WAIT_TIMEOUT) return (ISC_R_TIMEDOUT); diff --git a/lib/isc/win32/include/isc/condition.h b/lib/isc/win32/include/isc/condition.h index fff62ac5..0688c8f2 100644 --- a/lib/isc/win32/include/isc/condition.h +++ b/lib/isc/win32/include/isc/condition.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1998-2001 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: condition.h,v 1.14 2004/03/05 05:12:05 marka Exp $ */ +/* $Id: condition.h,v 1.14.18.2 2007/05/10 23:46:24 tbox Exp $ */ #ifndef ISC_CONDITION_H #define ISC_CONDITION_H 1 @@ -24,11 +24,22 @@ #include <isc/lang.h> #include <isc/mutex.h> +#include <isc/thread.h> #include <isc/types.h> +typedef struct isc_condition_thread isc_condition_thread_t; + +struct isc_condition_thread { + unsigned long th; + HANDLE handle[2]; + ISC_LINK(isc_condition_thread_t) link; + +}; + typedef struct isc_condition { HANDLE events[2]; unsigned int waiters; + ISC_LIST(isc_condition_thread_t) threadlist; } isc_condition_t; ISC_LANG_BEGINDECLS diff --git a/lib/isc/win32/interfaceiter.c b/lib/isc/win32/interfaceiter.c index 0cbcd190..8f70bb9b 100644 --- a/lib/isc/win32/interfaceiter.c +++ b/lib/isc/win32/interfaceiter.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2001 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: interfaceiter.c,v 1.8 2004/03/05 05:11:57 marka Exp $ */ +/* $Id: interfaceiter.c,v 1.8.18.2 2007/06/18 23:46:32 tbox Exp $ */ /* * Note that this code will need to be revisited to support IPv6 Interfaces. @@ -39,6 +39,8 @@ #include <isc/types.h> #include <isc/util.h> +void InitSockets(void); + /* Common utility functions */ /* @@ -115,6 +117,8 @@ isc_interfaceiter_create(isc_mem_t *mctx, isc_interfaceiter_t **iterp) { if (iter == NULL) return (ISC_R_NOMEMORY); + InitSockets(); + iter->mctx = mctx; iter->buf = NULL; diff --git a/lib/isc/win32/net.c b/lib/isc/win32/net.c index b604f33a..095d642d 100644 --- a/lib/isc/win32/net.c +++ b/lib/isc/win32/net.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: net.c,v 1.9.18.3 2005/02/24 00:32:22 marka Exp $ */ +/* $Id: net.c,v 1.9.18.5 2007/06/18 23:46:32 tbox Exp $ */ #include <config.h> @@ -42,6 +42,8 @@ static isc_result_t ipv6_result = ISC_R_NOTFOUND; static isc_result_t ipv6only_result = ISC_R_NOTFOUND; static isc_result_t ipv6pktinfo_result = ISC_R_NOTFOUND; +void InitSockets(void); + static isc_result_t try_proto(int domain) { SOCKET s; @@ -121,6 +123,7 @@ try_proto(int domain) { static void initialize_action(void) { + InitSockets(); ipv4_result = try_proto(PF_INET); #ifdef ISC_PLATFORM_HAVEIPV6 #ifdef WANT_IPV6 diff --git a/lib/isc/win32/ntpaths.c b/lib/isc/win32/ntpaths.c index 7043c000..74f1e0ca 100644 --- a/lib/isc/win32/ntpaths.c +++ b/lib/isc/win32/ntpaths.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2001 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: ntpaths.c,v 1.9 2004/03/05 05:11:58 marka Exp $ */ +/* $Id: ntpaths.c,v 1.9.18.2 2007/06/18 23:46:32 tbox Exp $ */ /* * This module fetches the required path information that is specific @@ -63,9 +63,8 @@ isc_ntpaths_init() { if (RegQueryValueEx(hKey, "InstallDir", NULL, NULL, (LPBYTE)namedBase, &baseLen) != ERROR_SUCCESS) keyFound = FALSE; + RegCloseKey(hKey); } - - RegCloseKey(hKey); GetSystemDirectory(systemDir, MAX_PATH); diff --git a/lib/isc/win32/once.c b/lib/isc/win32/once.c index b38e38c4..46428e4b 100644 --- a/lib/isc/win32/once.c +++ b/lib/isc/win32/once.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2001 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: once.c,v 1.10 2004/03/05 05:11:58 marka Exp $ */ +/* $Id: once.c,v 1.10.18.2 2007/06/18 23:46:32 tbox Exp $ */ /* Principal Authors: DCL */ @@ -41,8 +41,11 @@ isc_once_do(isc_once_t *controller, void(*function)(void)) { } else { while (controller->status == ISC_ONCE_INIT_NEEDED) { /* - * Spin wait. + * Sleep(0) indicates that this thread + * should be suspended to allow other + * waiting threads to execute. */ + Sleep(0); } } } diff --git a/lib/isc/win32/socket.c b/lib/isc/win32/socket.c index 7d40b36b..633e94a0 100644 --- a/lib/isc/win32/socket.c +++ b/lib/isc/win32/socket.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: socket.c,v 1.30.18.17 2007/02/01 23:55:20 marka Exp $ */ +/* $Id: socket.c,v 1.30.18.18 2007/06/18 03:08:56 marka Exp $ */ /* This code has been rewritten to take advantage of Windows Sockets * I/O Completion Ports and Events. I/O Completion Ports is ONLY @@ -77,6 +77,7 @@ #include <isc/msgs.h> #include <isc/mutex.h> #include <isc/net.h> +#include <isc/once.h> #include <isc/os.h> #include <isc/platform.h> #include <isc/print.h> @@ -904,10 +905,11 @@ socket_close(isc_socket_t *sock) { } } -/* - * Initialize socket services - */ -BOOL InitSockets() { +static isc_once_t initialise_once = ISC_ONCE_INIT; +static isc_boolean_t initialised = ISC_FALSE; + +static void +initialise(void) { WORD wVersionRequested; WSADATA wsaData; int err; @@ -916,11 +918,26 @@ BOOL InitSockets() { wVersionRequested = MAKEWORD(2, 0); err = WSAStartup(wVersionRequested, &wsaData); - if ( err != 0 ) { - /* Tell the user that we could not find a usable Winsock DLL */ - return(FALSE); - } - return(TRUE); + if (err != 0) { + char strbuf[ISC_STRERRORSIZE]; + isc__strerror(err, strbuf, sizeof(strbuf)); + FATAL_ERROR(__FILE__, __LINE__, "WSAStartup() %s: %s", + isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL, + ISC_MSG_FAILED, "failed"), + strbuf); + } else + initialised = ISC_TRUE; +} + +/* + * Initialize socket services + */ +void +InitSockets(void) { + RUNTIME_CHECK(isc_once_do(&initialise_once, + initialise) == ISC_R_SUCCESS); + if (!initialised) + exit(1); } int @@ -2775,6 +2792,8 @@ isc_socketmgr_create(isc_mem_t *mctx, isc_socketmgr_t **managerp) { if (manager == NULL) return (ISC_R_NOMEMORY); + InitSockets(); + manager->magic = SOCKET_MANAGER_MAGIC; manager->mctx = NULL; ISC_LIST_INIT(manager->socklist); diff --git a/lib/isccc/win32/DLLMain.c b/lib/isccc/win32/DLLMain.c index 6fc959c9..2f6c62c9 100644 --- a/lib/isccc/win32/DLLMain.c +++ b/lib/isccc/win32/DLLMain.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2001 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,13 +15,11 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: DLLMain.c,v 1.4 2004/03/05 05:12:19 marka Exp $ */ +/* $Id: DLLMain.c,v 1.4.18.2 2007/06/18 23:46:32 tbox Exp $ */ #include <windows.h> #include <signal.h> -BOOL InitSockets(void); - /* * Called when we enter the DLL */ diff --git a/lib/isccfg/win32/DLLMain.c b/lib/isccfg/win32/DLLMain.c index dbfd9393..5df2e94b 100644 --- a/lib/isccfg/win32/DLLMain.c +++ b/lib/isccfg/win32/DLLMain.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2001 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,13 +15,11 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: DLLMain.c,v 1.4 2004/03/05 05:12:42 marka Exp $ */ +/* $Id: DLLMain.c,v 1.4.18.2 2007/06/18 23:46:32 tbox Exp $ */ #include <windows.h> #include <signal.h> -BOOL InitSockets(void); - /* * Called when we enter the DLL */ diff --git a/lib/lwres/context.c b/lib/lwres/context.c index 0da426ba..3dc53eee 100644 --- a/lib/lwres/context.c +++ b/lib/lwres/context.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001, 2003 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: context.c,v 1.45.18.3 2005/04/29 00:17:16 marka Exp $ */ +/* $Id: context.c,v 1.45.18.6 2007/06/18 23:46:33 tbox Exp $ */ /*! \file context.c lwres_context_create() creates a #lwres_context_t structure for use in @@ -209,6 +209,9 @@ lwres_context_destroy(lwres_context_t **contextp) { *contextp = NULL; if (ctx->sock != -1) { +#ifdef WIN32 + DestroySockets(); +#endif (void)close(ctx->sock); ctx->sock = -1; } @@ -315,19 +318,34 @@ context_connect(lwres_context_t *ctx) { } else return (LWRES_R_IOERROR); +#ifdef WIN32 + InitSockets(); +#endif s = socket(domain, SOCK_DGRAM, IPPROTO_UDP); - if (s < 0) + if (s < 0) { +#ifdef WIN32 + DestroySockets(); +#endif return (LWRES_R_IOERROR); + } ret = connect(s, sa, salen); if (ret != 0) { +#ifdef WIN32 + DestroySockets(); +#endif (void)close(s); return (LWRES_R_IOERROR); } MAKE_NONBLOCKING(s, ret); - if (ret < 0) + if (ret < 0) { +#ifdef WIN32 + DestroySockets(); +#endif + (void)close(s); return (LWRES_R_IOERROR); + } ctx->sock = s; diff --git a/lib/lwres/getipnode.c b/lib/lwres/getipnode.c index 46eed144..e37b1aa3 100644 --- a/lib/lwres/getipnode.c +++ b/lib/lwres/getipnode.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: getipnode.c,v 1.37.18.3 2005/04/29 00:17:18 marka Exp $ */ +/* $Id: getipnode.c,v 1.37.18.6 2007/06/18 23:46:33 tbox Exp $ */ /*! \file */ @@ -671,13 +671,20 @@ scan_interfaces(int *have_v4, int *have_v6) { int s, n; size_t cpsize; +#ifdef WIN32 + InitSockets(); +#endif #if defined(SIOCGLIFCONF) && defined(SIOCGLIFADDR) && \ !defined(IRIX_EMUL_IOCTL_SIOCGIFCONF) /* * Try to scan the interfaces using IPv6 ioctls(). */ - if (!scan_interfaces6(have_v4, have_v6)) + if (!scan_interfaces6(have_v4, have_v6)) { +#ifdef WIN32 + DestroySockets(); +#endif return (0); + } #endif /* @@ -802,13 +809,20 @@ scan_interfaces(int *have_v4, int *have_v6) { } if (buf != NULL) free(buf); +#ifdef WIN32 + DestroySockets(); +#endif close(s); return (0); + err_ret: if (buf != NULL) free(buf); if (s != -1) close(s); +#ifdef WIN32 + DestroySockets(); +#endif return (-1); #endif } diff --git a/lib/lwres/win32/DLLMain.c b/lib/lwres/win32/DLLMain.c index cba1adb9..04458986 100644 --- a/lib/lwres/win32/DLLMain.c +++ b/lib/lwres/win32/DLLMain.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2001 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,13 +15,11 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: DLLMain.c,v 1.3 2004/03/05 05:13:20 marka Exp $ */ +/* $Id: DLLMain.c,v 1.3.18.2 2007/06/18 23:46:33 tbox Exp $ */ #include <windows.h> #include <signal.h> -BOOL InitSockets(void); - /* * Called when we enter the DLL */ diff --git a/lib/lwres/win32/include/lwres/platform.h b/lib/lwres/win32/include/lwres/platform.h index 2c58e64a..5def3d82 100644 --- a/lib/lwres/win32/include/lwres/platform.h +++ b/lib/lwres/win32/include/lwres/platform.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: platform.h,v 1.5 2004/03/05 05:13:35 marka Exp $ */ +/* $Id: platform.h,v 1.5.18.2 2007/06/18 23:46:33 tbox Exp $ */ #ifndef LWRES_PLATFORM_H #define LWRES_PLATFORM_H 1 @@ -92,4 +92,11 @@ do { \ #undef close #define close closesocket +/* + * Internal to liblwres. + */ +void InitSockets(void); + +void DestroySockets(void); + #endif /* LWRES_PLATFORM_H */ diff --git a/lib/lwres/win32/liblwres.dsp b/lib/lwres/win32/liblwres.dsp index 1394d2e1..74432c3f 100644 --- a/lib/lwres/win32/liblwres.dsp +++ b/lib/lwres/win32/liblwres.dsp @@ -174,6 +174,10 @@ SOURCE=..\lwresutil.c # End Source File
# Begin Source File
+SOURCE=.\socket.c
+# End Source File
+# Begin Source File
+
SOURCE=.\version.c
# End Source File
# End Group
diff --git a/lib/lwres/win32/liblwres.mak b/lib/lwres/win32/liblwres.mak index febc8113..9d92f133 100644 --- a/lib/lwres/win32/liblwres.mak +++ b/lib/lwres/win32/liblwres.mak @@ -135,6 +135,7 @@ CLEAN : -@erase "$(INTDIR)\lwres_noop.obj"
-@erase "$(INTDIR)\lwresutil.obj"
-@erase "$(INTDIR)\vc60.idb"
+ -@erase "$(INTDIR)\socket.obj"
-@erase "$(INTDIR)\version.obj"
-@erase "$(OUTDIR)\liblwres.exp"
-@erase "$(OUTDIR)\liblwres.lib"
@@ -174,6 +175,7 @@ LINK32_OBJS= \ "$(INTDIR)\lwres_grbn.obj" \
"$(INTDIR)\lwres_noop.obj" \
"$(INTDIR)\lwresutil.obj" \
+ "$(INTDIR)\socket.obj" \
"$(INTDIR)\version.obj" \
"$(INTDIR)\lwconfig.obj"
@@ -237,6 +239,8 @@ CLEAN : -@erase "$(INTDIR)\lwresutil.sbr"
-@erase "$(INTDIR)\vc60.idb"
-@erase "$(INTDIR)\vc60.pdb"
+ -@erase "$(INTDIR)\socket.obj"
+ -@erase "$(INTDIR)\socket.sbr"
-@erase "$(INTDIR)\version.obj"
-@erase "$(INTDIR)\version.sbr"
-@erase "$(OUTDIR)\liblwres.bsc"
@@ -274,6 +278,7 @@ BSC32_SBRS= \ "$(INTDIR)\lwres_grbn.sbr" \
"$(INTDIR)\lwres_noop.sbr" \
"$(INTDIR)\lwresutil.sbr" \
+ "$(INTDIR)\socket.sbr" \
"$(INTDIR)\version.sbr" \
"$(INTDIR)\lwconfig.sbr"
@@ -306,6 +311,7 @@ LINK32_OBJS= \ "$(INTDIR)\lwres_grbn.obj" \
"$(INTDIR)\lwres_noop.obj" \
"$(INTDIR)\lwresutil.obj" \
+ "$(INTDIR)\socket.obj" \
"$(INTDIR)\version.obj" \
"$(INTDIR)\lwconfig.obj"
@@ -714,6 +720,22 @@ SOURCE=..\lwresutil.c !ENDIF
+SOURCE=.\socket.c
+
+!IF "$(CFG)" == "liblwres - Win32 Release"
+
+
+"$(INTDIR)\socket.obj" : $(SOURCE) "$(INTDIR)"
+
+
+!ELSEIF "$(CFG)" == "liblwres - Win32 Debug"
+
+
+"$(INTDIR)\socket.obj" "$(INTDIR)\socket.sbr" : $(SOURCE) "$(INTDIR)"
+
+
+!ENDIF
+
SOURCE=.\version.c
!IF "$(CFG)" == "liblwres - Win32 Release"
diff --git a/lib/lwres/win32/lwconfig.c b/lib/lwres/win32/lwconfig.c index 9a8c742d..3af18ac6 100644 --- a/lib/lwres/win32/lwconfig.c +++ b/lib/lwres/win32/lwconfig.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2006, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2002 Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: lwconfig.c,v 1.2.18.2 2006/10/03 23:50:51 marka Exp $ */ +/* $Id: lwconfig.c,v 1.2.18.4 2007/06/18 23:46:33 tbox Exp $ */ /* * We do this so that we may incorporate everything in the main routines @@ -67,10 +67,9 @@ get_win32_searchlist(lwres_context_t *ctx) { if (RegQueryValueEx(hKey, "SearchList", NULL, NULL, (LPBYTE)searchlist, &searchlen) != ERROR_SUCCESS) keyFound = FALSE; + RegCloseKey(hKey); } - RegCloseKey(hKey); - confdata->searchnxt = 0; idx = 0; diff --git a/lib/lwres/win32/socket.c b/lib/lwres/win32/socket.c new file mode 100644 index 00000000..12024186 --- /dev/null +++ b/lib/lwres/win32/socket.c @@ -0,0 +1,41 @@ +/* + * Copyright (C) 2007 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +/* $Id: socket.c,v 1.1.4.2 2007/06/18 23:46:33 tbox Exp $ */ + +#include <stdio.h> +#include <lwres/platform.h> +#include <Winsock2.h> + +void +InitSockets(void) { + WORD wVersionRequested; + WSADATA wsaData; + int err; + + wVersionRequested = MAKEWORD(2, 0); + + err = WSAStartup( wVersionRequested, &wsaData ); + if (err != 0) { + fprintf(stderr, "WSAStartup() failed: %d\n", err); + exit(1); + } +} + +void +DestroySockets(void) { + WSACleanup(); +} @@ -1,10 +1,10 @@ -# $Id: version,v 1.29.134.13.8.1 2007/04/30 01:11:30 marka Exp $ +# $Id: version,v 1.29.134.15 2007/05/24 02:59:51 marka Exp $ # # This file must follow /bin/sh rules. It is imported directly via # configure. # MAJORVER=9 MINORVER=4 -PATCHVER=1 -RELEASETYPE= -RELEASEVER= +PATCHVER=2 +RELEASETYPE=b +RELEASEVER=1 diff --git a/win32utils/BuildSetup.bat b/win32utils/BuildSetup.bat index 2ad2070b..e0a7dd67 100644 --- a/win32utils/BuildSetup.bat +++ b/win32utils/BuildSetup.bat @@ -57,4 +57,34 @@ echo Copying the OpenSSL DLL. copy ..\..\openssl-0.9.8d\out32dll\libeay32.dll ..\Build\Release\
copy ..\..\openssl-0.9.8d\out32dll\libeay32.dll ..\Build\Debug\
+rem
+rem set vcredist here so that it is correctly expanded in the if body
+rem
+set vcredist=BootStrapper\Packages\vcredist_x86\vcredist_x86.exe
+
+if Defined FrameworkSDKDir (
+
+rem
+rem vcredist_x86.exe path relative to FrameworkSDKDir
+rem
+
+if Exist "%FrameworkSDKDir%\%vcredist%" (
+
+echo Copying Visual C x86 Redistributable Installer
+
+rem
+rem Use /Y so we allways have the current version of the installer.
+rem
+
+copy /Y "%FrameworkSDKDir%\%vcredist%" ..\Build\Release\
+copy /Y "%FrameworkSDKDir%\%vcredist%" ..\Build\Debug\
+
+) else (
+ echo "**** %FrameworkSDKDir%\%vcredist% not found ****"
+)
+) else (
+ echo "**** Warning FrameworkSDKDir not defined ****"
+ echo "**** Run vsvars32.bat ****"
+)
+
rem Done
diff --git a/win32utils/readme1st.txt b/win32utils/readme1st.txt index 3706229f..2a936006 100644 --- a/win32utils/readme1st.txt +++ b/win32utils/readme1st.txt @@ -1,12 +1,12 @@ -Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
Copyright (C) 2001, 2003 Internet Software Consortium.
See COPYRIGHT in the source root or http://isc.org/copyright.html for terms.
-$Id: readme1st.txt,v 1.12.18.3 2005/09/06 03:47:20 marka Exp $
+$Id: readme1st.txt,v 1.12.18.5 2007/05/02 23:46:24 tbox Exp $
- Release of BIND 9.4 for Window NT/2000/XP/2003
+ Release of BIND 9.4 for Window 2000/XP/2003
-This is a release of BIND 9.4 for Window NT/2000/XP/2003.
+This is a release of BIND 9.4 for Window 2000/XP/2003.
Only IPv4 stacks are supported on the box running this version of BIND.
IPv6 stacks will be supported in a future release.
@@ -33,7 +33,12 @@ it needs to read. It is important that on Windows the directory directive is used in
the options section to tell BIND where to find the files used in
-named.conf.
+named.conf (default %WINDOWS%\system32\dns\etc\named.conf).
+
+e.g.
+ options {
+ directory "C:\WINDOWS\system32\dns\etc";
+ };
If you have previously installed BIND 8 or BIND 4 on the system that
you wish to install this kit, you MUST use the BIND 8 or BIND 4 installer
|