From 90c5127f2adf679af4cd90046e0cbb5b3b1e82db Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20=C5=A0pa=C4=8Dek?= Date: Wed, 16 Mar 2022 10:49:17 +0100 Subject: [PATCH 01/15] Restructure includes for ARM chapters 1 (Intro) and 2 (Requirements) We have had perpetual problem with Sphinx implicitly double-including files. To avoid that problem all files with name suffix .inc.rst are now ignored by Sphinx, and writter can conveniently include them without modifying conf.py for each and every file. (cherry picked from commit 1322372a0c9b6efd3af866455bbdb25e6d55c650) --- doc/arm/Makefile.am | 31 ++++++++++--------- doc/arm/advanced.rst | 12 +++---- doc/arm/{build.rst => build.inc.rst} | 0 doc/arm/{catz.rst => catz.inc.rst} | 0 doc/arm/chapter1.rst | 12 +++++++ doc/arm/chapter2.rst | 14 +++++++++ doc/arm/conf.py | 13 +------- doc/arm/configuration.rst | 2 +- doc/arm/{dlz.rst => dlz.inc.rst} | 0 doc/arm/{dnssec.rst => dnssec.inc.rst} | 0 doc/arm/{dyndb.rst => dyndb.inc.rst} | 0 doc/arm/index.rst | 4 +-- ...{introduction.rst => introduction.inc.rst} | 0 ...egories.rst => logging-categories.inc.rst} | 0 ...{managed-keys.rst => managed-keys.inc.rst} | 0 doc/arm/{pkcs11.rst => pkcs11.inc.rst} | 0 doc/arm/{platforms.rst => platforms.inc.rst} | 0 doc/arm/{plugins.rst => plugins.inc.rst} | 0 doc/arm/reference.rst | 2 +- ...{requirements.rst => requirements.inc.rst} | 2 -- util/check-categories.sh | 2 +- 21 files changed, 55 insertions(+), 39 deletions(-) rename doc/arm/{build.rst => build.inc.rst} (100%) rename doc/arm/{catz.rst => catz.inc.rst} (100%) create mode 100644 doc/arm/chapter1.rst create mode 100644 doc/arm/chapter2.rst rename doc/arm/{dlz.rst => dlz.inc.rst} (100%) rename doc/arm/{dnssec.rst => dnssec.inc.rst} (100%) rename doc/arm/{dyndb.rst => dyndb.inc.rst} (100%) rename doc/arm/{introduction.rst => introduction.inc.rst} (100%) rename doc/arm/{logging-categories.rst => logging-categories.inc.rst} (100%) rename doc/arm/{managed-keys.rst => managed-keys.inc.rst} (100%) rename doc/arm/{pkcs11.rst => pkcs11.inc.rst} (100%) rename doc/arm/{platforms.rst => platforms.inc.rst} (100%) rename doc/arm/{plugins.rst => plugins.inc.rst} (100%) rename doc/arm/{requirements.rst => requirements.inc.rst} (98%) diff --git a/doc/arm/Makefile.am b/doc/arm/Makefile.am index 9db674b8d6..bfc12db128 100644 --- a/doc/arm/Makefile.am +++ b/doc/arm/Makefile.am @@ -2,29 +2,32 @@ include $(top_srcdir)/Makefile.top include $(top_srcdir)/Makefile.docs EXTRA_DIST = \ - conf.py \ - isc-logo.pdf \ advanced.rst \ - build.rst \ - catz.rst \ + build.inc.rst \ + catz.inc.rst \ + chapter1.rst \ + chapter2.rst \ configuration.rst \ - dlz.rst \ + conf.py \ + dlz.inc.rst \ dnssec-guide.rst \ - dnssec.rst \ - dyndb.rst \ + dnssec.inc.rst \ + dyndb.inc.rst \ general.rst \ history.rst \ index.rst \ - introduction.rst \ - logging-categories.rst \ - managed-keys.rst \ + introduction.inc.rst \ + isc-logo.pdf \ + logging-categories.inc.rst \ + managed-keys.inc.rst \ manpages.rst \ notes.rst \ - pkcs11.rst \ - platforms.rst \ - plugins.rst \ + pkcs11.inc.rst \ + platforms.inc.rst \ + plugins.inc.rst \ reference.rst \ - requirements.rst \ + requirements.inc.rst \ + requirements.txt \ security.rst \ troubleshooting.rst \ ../dnssec-guide \ diff --git a/doc/arm/advanced.rst b/doc/arm/advanced.rst index 30fdcdb7b7..10457c87fd 100644 --- a/doc/arm/advanced.rst +++ b/doc/arm/advanced.rst @@ -779,12 +779,12 @@ according to its parent, should have been secure. response; parent indicates it should be secure." -.. include:: dnssec.rst -.. include:: managed-keys.rst -.. include:: pkcs11.rst -.. include:: dlz.rst -.. include:: dyndb.rst -.. include:: catz.rst +.. include:: dnssec.inc.rst +.. include:: managed-keys.inc.rst +.. include:: pkcs11.inc.rst +.. include:: dlz.inc.rst +.. include:: dyndb.inc.rst +.. include:: catz.inc.rst .. _ipv6: diff --git a/doc/arm/build.rst b/doc/arm/build.inc.rst similarity index 100% rename from doc/arm/build.rst rename to doc/arm/build.inc.rst diff --git a/doc/arm/catz.rst b/doc/arm/catz.inc.rst similarity index 100% rename from doc/arm/catz.rst rename to doc/arm/catz.inc.rst diff --git a/doc/arm/chapter1.rst b/doc/arm/chapter1.rst new file mode 100644 index 0000000000..a392637fdf --- /dev/null +++ b/doc/arm/chapter1.rst @@ -0,0 +1,12 @@ +.. Copyright (C) Internet Systems Consortium, Inc. ("ISC") +.. +.. SPDX-License-Identifier: MPL-2.0 +.. +.. This Source Code Form is subject to the terms of the Mozilla Public +.. License, v. 2.0. If a copy of the MPL was not distributed with this +.. file, you can obtain one at https://mozilla.org/MPL/2.0/. +.. +.. See the COPYRIGHT file distributed with this work for additional +.. information regarding copyright ownership. + +.. include:: introduction.inc.rst diff --git a/doc/arm/chapter2.rst b/doc/arm/chapter2.rst new file mode 100644 index 0000000000..2e50f15b75 --- /dev/null +++ b/doc/arm/chapter2.rst @@ -0,0 +1,14 @@ +.. Copyright (C) Internet Systems Consortium, Inc. ("ISC") +.. +.. SPDX-License-Identifier: MPL-2.0 +.. +.. This Source Code Form is subject to the terms of the Mozilla Public +.. License, v. 2.0. If a copy of the MPL was not distributed with this +.. file, you can obtain one at https://mozilla.org/MPL/2.0/. +.. +.. See the COPYRIGHT file distributed with this work for additional +.. information regarding copyright ownership. + +.. include:: requirements.inc.rst +.. include:: platforms.inc.rst +.. include:: build.inc.rst diff --git a/doc/arm/conf.py b/doc/arm/conf.py index 742626335b..60131b41f6 100644 --- a/doc/arm/conf.py +++ b/doc/arm/conf.py @@ -142,18 +142,7 @@ exclude_patterns = [ '_build', 'Thumbs.db', '.DS_Store', - '*.grammar.rst', - '*.zoneopts.rst', - 'build.rst', - 'catz.rst', - 'dlz.rst', - 'dnssec.rst', - 'dyndb.rst', - 'logging-categories.rst', - 'managed-keys.rst', - 'pkcs11.rst', - 'platforms.rst', - 'plugins.rst' + '*.inc.rst' ] # The master toctree document. diff --git a/doc/arm/configuration.rst b/doc/arm/configuration.rst index 6ef62e2b38..807891c5a3 100644 --- a/doc/arm/configuration.rst +++ b/doc/arm/configuration.rst @@ -312,4 +312,4 @@ described in the following table. These signals can be sent using the | ``SIGINT`` | Causes the server to clean up and exit. | +--------------+-------------------------------------------------------------+ -.. include:: plugins.rst +.. include:: plugins.inc.rst diff --git a/doc/arm/dlz.rst b/doc/arm/dlz.inc.rst similarity index 100% rename from doc/arm/dlz.rst rename to doc/arm/dlz.inc.rst diff --git a/doc/arm/dnssec.rst b/doc/arm/dnssec.inc.rst similarity index 100% rename from doc/arm/dnssec.rst rename to doc/arm/dnssec.inc.rst diff --git a/doc/arm/dyndb.rst b/doc/arm/dyndb.inc.rst similarity index 100% rename from doc/arm/dyndb.rst rename to doc/arm/dyndb.inc.rst diff --git a/doc/arm/index.rst b/doc/arm/index.rst index 431f0cd598..7dec5cf947 100644 --- a/doc/arm/index.rst +++ b/doc/arm/index.rst @@ -17,8 +17,8 @@ BIND 9 Administrator Reference Manual :numbered: :maxdepth: 2 - introduction - requirements + chapter1 + chapter2 configuration reference advanced diff --git a/doc/arm/introduction.rst b/doc/arm/introduction.inc.rst similarity index 100% rename from doc/arm/introduction.rst rename to doc/arm/introduction.inc.rst diff --git a/doc/arm/logging-categories.rst b/doc/arm/logging-categories.inc.rst similarity index 100% rename from doc/arm/logging-categories.rst rename to doc/arm/logging-categories.inc.rst diff --git a/doc/arm/managed-keys.rst b/doc/arm/managed-keys.inc.rst similarity index 100% rename from doc/arm/managed-keys.rst rename to doc/arm/managed-keys.inc.rst diff --git a/doc/arm/pkcs11.rst b/doc/arm/pkcs11.inc.rst similarity index 100% rename from doc/arm/pkcs11.rst rename to doc/arm/pkcs11.inc.rst diff --git a/doc/arm/platforms.rst b/doc/arm/platforms.inc.rst similarity index 100% rename from doc/arm/platforms.rst rename to doc/arm/platforms.inc.rst diff --git a/doc/arm/plugins.rst b/doc/arm/plugins.inc.rst similarity index 100% rename from doc/arm/plugins.rst rename to doc/arm/plugins.inc.rst diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst index e3cd0f1149..4b9b7ecded 100644 --- a/doc/arm/reference.rst +++ b/doc/arm/reference.rst @@ -760,7 +760,7 @@ The following are the available categories and brief descriptions of the types of log information they contain. More categories may be added in future BIND releases. -.. include:: logging-categories.rst +.. include:: logging-categories.inc.rst .. _query_errors: diff --git a/doc/arm/requirements.rst b/doc/arm/requirements.inc.rst similarity index 98% rename from doc/arm/requirements.rst rename to doc/arm/requirements.inc.rst index 09f0f427ef..90bd0e965a 100644 --- a/doc/arm/requirements.rst +++ b/doc/arm/requirements.inc.rst @@ -70,5 +70,3 @@ much memory or CPU power as in the first alternative, but this has the disadvantage of making many more external queries, as none of the name servers share their cached data. -.. include:: platforms.rst -.. include:: build.rst diff --git a/util/check-categories.sh b/util/check-categories.sh index 6a4b0232da..c8c6e3cc2c 100644 --- a/util/check-categories.sh +++ b/util/check-categories.sh @@ -19,7 +19,7 @@ list1=$( sort -u ) list2=$( - sed -ne 's/^``\(.*\)``/\1/p' doc/arm/logging-categories.rst | + sed -ne 's/^``\(.*\)``/\1/p' doc/arm/logging-categories.inc.rst | sort -u ) status=0 From daaab5fc5245928412ff5d850173d4d0dee0adcc Mon Sep 17 00:00:00 2001 From: Ron Aitchison Date: Sat, 2 Apr 2022 01:06:19 +0000 Subject: [PATCH 02/15] Add link anchors into Configuration Reference section of the ARM (cherry picked from commit dc7efb8e60ad52d28d36d2ec77fa444c71f5e144) --- doc/arm/reference.rst | 44 ++++++++++++++++++++++++++++++++++++++----- 1 file changed, 39 insertions(+), 5 deletions(-) diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst index 4b9b7ecded..ed72dfca50 100644 --- a/doc/arm/reference.rst +++ b/doc/arm/reference.rst @@ -9,10 +9,10 @@ .. See the COPYRIGHT file distributed with this work for additional .. information regarding copyright ownership. -.. Reference: +.. _reference: -BIND 9 Configuration Reference -============================== +Configuration Reference +======================= .. _configuration_file_elements: @@ -245,7 +245,7 @@ line, as in C++ comments. For example: in a zone file. The semicolon indicates the end of a configuration statement. -.. _Configuration_File_Grammar: +.. _configuration_file_grammar: Configuration File Grammar -------------------------- @@ -284,6 +284,8 @@ The following statements are supported: ``parental-agents`` Defines a named list of servers for inclusion in primary and secondary zones' ``parental-agents`` lists. +.. _primaries: + ``primaries`` Defines a named list of servers for inclusion in stub and secondary zones' ``primaries`` or ``also-notify`` lists. (Note: this is a synonym for the original keyword ``masters``, which can still be used, but is no longer the preferred terminology.) @@ -311,6 +313,8 @@ The following statements are supported: ``view`` Defines a view. +.. _zone_clause: + ``zone`` Defines a zone. @@ -586,6 +590,8 @@ handles messages sent to this facility is described in the version of ``syslog``, which only uses two arguments to the ``openlog()`` function, this clause is silently ignored. +.. _severity: + The ``severity`` clause works like ``syslog``'s "priorities," except that they can also be used when writing straight to a file rather than using ``syslog``. Messages which are not at least of the severity @@ -982,6 +988,8 @@ default is used. administrator's responsibility to ensure that configuration differences in different views do not cause disruption with a shared cache. +.. _directory: + ``directory`` This sets the working directory of the server. Any non-absolute pathnames in the configuration file are taken as relative to this directory. @@ -1819,9 +1827,11 @@ Boolean Options unnecessary records are added to the authority or additional sections. The default is ``no``. +.. _notify_st: + ``notify`` If set to ``yes`` (the default), DNS NOTIFY messages are sent when a - zone the server is authoritative for changes; see :ref:`notify`. + zone the server is authoritative for changes; see :ref:`using notify`. The messages are sent to the servers listed in the zone's NS records (except the primary server identified in the SOA MNAME field), and to any servers listed in the ``also-notify`` option. @@ -1845,6 +1855,8 @@ Boolean Options ultimate primary should be set to still send NOTIFY messages to all the name servers listed in the NS RRset. +.. _recursion: + ``recursion`` If ``yes``, and a DNS query requests recursion, then the server attempts to do all the work required to answer the query. If recursion @@ -2310,6 +2322,8 @@ access to the Internet, but wish to look up exterior names anyway. Forwarding occurs only on those queries for which the server is not authoritative and does not have the answer in its cache. +.. _forward: + ``forward`` This option is only meaningful if the forwarders list is not empty. A value of ``first`` is the default and causes the server to query the @@ -2317,6 +2331,8 @@ authoritative and does not have the answer in its cache. server then looks for the answer itself. If ``only`` is specified, the server only queries the forwarders. +.. _forwarders: + ``forwarders`` This specifies a list of IP addresses to which queries are forwarded. The default is the empty list (no forwarding). Each address in the list can be @@ -2394,6 +2410,8 @@ for details on how to specify IP address lists. .. note:: ``allow-query-cache`` is used to specify access to the cache. +.. _allow-query-cache: + ``allow-query-cache`` This specifies which hosts are allowed to get answers from the cache. If ``allow-recursion`` is not set, BIND checks to see if the following parameters @@ -2461,6 +2479,8 @@ for details on how to specify IP address lists. .. _allow-transfer-access: +.. _allow-transfer: + ``allow-transfer`` This specifies which hosts are allowed to receive zone transfers from the server. ``allow-transfer`` may also be specified in the ``zone`` @@ -2720,6 +2740,8 @@ BIND has mechanisms in place to facilitate zone transfers and set limits on the amount of load that transfers place on the system. The following options apply to zone transfers. +.. _also-notify: + ``also-notify`` This option defines a global list of IP addresses of name servers that are also sent NOTIFY messages whenever a fresh copy of the zone is loaded, in @@ -3120,6 +3142,8 @@ system. ``reserved-sockets`` This option is deprecated and no longer has any effect. +.. _max-cache-size: + ``max-cache-size`` This sets the maximum amount of memory to use for an individual cache database and its associated metadata, in bytes or percentage of total @@ -3948,9 +3972,13 @@ away from the infrastructure servers. This specifies the contact name that appears in the returned SOA record for empty zones. If none is specified, "." is used. +.. _empty-zones-enable: + ``empty-zones-enable`` This enables or disables all empty zones. By default, they are enabled. +.. _disable-empty-zone: + ``disable-empty-zone`` This disables individual empty zones. By default, none are disabled. This option can be specified multiple times. @@ -5581,6 +5609,8 @@ Here is an example of a typical split DNS setup implemented using .. _zone_types: +.. _type: + Zone Types ^^^^^^^^^^ @@ -5834,6 +5864,8 @@ Zone Options ``allow-notify`` See the description of ``allow-notify`` in :ref:`access_control`. +.. _allow-query: + ``allow-query`` See the description of ``allow-query`` in :ref:`access_control`. @@ -5930,6 +5962,8 @@ Zone Options .. _file-option: +.. _file: + ``file`` This sets the zone's filename. In ``primary``, ``hint``, and ``redirect`` zones which do not have ``primaries`` defined, zone data is loaded from From 2f53384e84c54ba7d2fe5260adbc0bfde4809c43 Mon Sep 17 00:00:00 2001 From: Ron Aitchison Date: Thu, 31 Mar 2022 12:51:57 +0000 Subject: [PATCH 03/15] Change title and add extra link to Resource Requirements in the ARM (cherry picked from commit 0c3b75f80b4335fc5b83efee4cbd37bc60fe8020) --- doc/arm/requirements.inc.rst | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/doc/arm/requirements.inc.rst b/doc/arm/requirements.inc.rst index 90bd0e965a..dcb080ec33 100644 --- a/doc/arm/requirements.inc.rst +++ b/doc/arm/requirements.inc.rst @@ -9,10 +9,10 @@ .. See the COPYRIGHT file distributed with this work for additional .. information regarding copyright ownership. -.. _Requirements: +.. _requirements: -BIND Resource Requirements -========================== +Resource Requirements +===================== .. _hw_req: @@ -45,7 +45,7 @@ Memory Requirements ------------------- Server memory must be sufficient to hold both the cache and the -zones loaded from disk. The ``max-cache-size`` option can +zones loaded from disk. The :ref:`max-cache-size` option can limit the amount of memory used by the cache, at the expense of reducing cache hit rates and causing more DNS traffic. It is still good practice to have enough memory to load all zone and cache data into memory; From f82a42559ee0a31a3a0755b2034d5deeab5c133b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20=C5=A0pa=C4=8Dek?= Date: Thu, 21 Apr 2022 08:14:42 +0200 Subject: [PATCH 04/15] Remove build from chapter 2 and move it to the end of ARM (cherry picked from commit 9d15decc41d96869217fb82d168757b33c1e297f) --- doc/arm/Makefile.am | 1 + doc/arm/build.inc.rst | 2 ++ doc/arm/chapter10.rst | 12 ++++++++++++ doc/arm/chapter2.rst | 1 - doc/arm/index.rst | 3 ++- 5 files changed, 17 insertions(+), 2 deletions(-) create mode 100644 doc/arm/chapter10.rst diff --git a/doc/arm/Makefile.am b/doc/arm/Makefile.am index bfc12db128..57612a6fcc 100644 --- a/doc/arm/Makefile.am +++ b/doc/arm/Makefile.am @@ -5,6 +5,7 @@ EXTRA_DIST = \ advanced.rst \ build.inc.rst \ catz.inc.rst \ + chapter10.rst \ chapter1.rst \ chapter2.rst \ configuration.rst \ diff --git a/doc/arm/build.inc.rst b/doc/arm/build.inc.rst index 9ea1cd307d..5bad09e2af 100644 --- a/doc/arm/build.inc.rst +++ b/doc/arm/build.inc.rst @@ -9,6 +9,8 @@ .. See the COPYRIGHT file distributed with this work for additional .. information regarding copyright ownership. +.. _build_bind: + Building BIND 9 --------------- diff --git a/doc/arm/chapter10.rst b/doc/arm/chapter10.rst new file mode 100644 index 0000000000..1e8425ea4b --- /dev/null +++ b/doc/arm/chapter10.rst @@ -0,0 +1,12 @@ +.. Copyright (C) Internet Systems Consortium, Inc. ("ISC") +.. +.. SPDX-License-Identifier: MPL-2.0 +.. +.. This Source Code Form is subject to the terms of the Mozilla Public +.. License, v. 2.0. If a copy of the MPL was not distributed with this +.. file, you can obtain one at https://mozilla.org/MPL/2.0/. +.. +.. See the COPYRIGHT file distributed with this work for additional +.. information regarding copyright ownership. + +.. include:: build.inc.rst diff --git a/doc/arm/chapter2.rst b/doc/arm/chapter2.rst index 2e50f15b75..bbf847736e 100644 --- a/doc/arm/chapter2.rst +++ b/doc/arm/chapter2.rst @@ -11,4 +11,3 @@ .. include:: requirements.inc.rst .. include:: platforms.inc.rst -.. include:: build.inc.rst diff --git a/doc/arm/index.rst b/doc/arm/index.rst index 7dec5cf947..771e8405c7 100644 --- a/doc/arm/index.rst +++ b/doc/arm/index.rst @@ -24,7 +24,8 @@ BIND 9 Administrator Reference Manual advanced security troubleshooting - + chapter10 + .. toctree:: :caption: Appendices :name: appendices From d012689eeead06c5cce4e5abe19866045d6ac4e5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20=C5=A0pa=C4=8Dek?= Date: Thu, 21 Apr 2022 18:10:19 +0200 Subject: [PATCH 05/15] License PNG and DIA images in the ARM under MPL-2.0 as usual (cherry picked from commit 647318c9b70358ddf7e9dfbe6484b793e312e05f) --- .reuse/dep5 | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.reuse/dep5 b/.reuse/dep5 index 147970dc81..de69b93035 100644 --- a/.reuse/dep5 +++ b/.reuse/dep5 @@ -82,6 +82,8 @@ Files: **/*.after* cocci/*.cocci cocci/*.disabled cocci/*.spatch + doc/arm/*.dia + doc/arm/*.png doc/arm/isc-logo.pdf doc/arm/requirements.txt doc/man/*.1in From 7a57b242897fd9dda03117d8fbe293547d675200 Mon Sep 17 00:00:00 2001 From: Ron Aitchison Date: Sun, 20 Mar 2022 18:41:11 +0000 Subject: [PATCH 06/15] Rewrite Introduction chapters of the ARM (cherry picked from commit 0951922028ec4cf5b963034bbf82074d41c3935a) --- doc/arm/Makefile.am | 12 ++ doc/arm/chapter1.rst | 2 + doc/arm/dns-security-overview.dia | Bin 0 -> 3495 bytes doc/arm/dns-security-overview.png | Bin 0 -> 25862 bytes doc/arm/dns-servers.dia | Bin 0 -> 3233 bytes doc/arm/dns-servers.png | Bin 0 -> 40019 bytes doc/arm/dns-tree.dia | Bin 0 -> 3019 bytes doc/arm/dns-tree.png | Bin 0 -> 40307 bytes doc/arm/intro-dns-bind.inc.rst | 197 +++++++++++++++++++ doc/arm/intro-security.inc.rst | 76 ++++++++ doc/arm/introduction.inc.rst | 313 +++++------------------------- doc/arm/name-resolution.dia | Bin 0 -> 3084 bytes doc/arm/name-resolution.png | Bin 0 -> 29727 bytes doc/arm/recursive-query.dia | Bin 0 -> 3377 bytes doc/arm/recursive-query.png | Bin 0 -> 42576 bytes 15 files changed, 338 insertions(+), 262 deletions(-) create mode 100644 doc/arm/dns-security-overview.dia create mode 100644 doc/arm/dns-security-overview.png create mode 100644 doc/arm/dns-servers.dia create mode 100644 doc/arm/dns-servers.png create mode 100644 doc/arm/dns-tree.dia create mode 100644 doc/arm/dns-tree.png create mode 100644 doc/arm/intro-dns-bind.inc.rst create mode 100644 doc/arm/intro-security.inc.rst create mode 100644 doc/arm/name-resolution.dia create mode 100644 doc/arm/name-resolution.png create mode 100644 doc/arm/recursive-query.dia create mode 100644 doc/arm/recursive-query.png diff --git a/doc/arm/Makefile.am b/doc/arm/Makefile.am index 57612a6fcc..52bc19b9fb 100644 --- a/doc/arm/Makefile.am +++ b/doc/arm/Makefile.am @@ -13,19 +13,31 @@ EXTRA_DIST = \ dlz.inc.rst \ dnssec-guide.rst \ dnssec.inc.rst \ + dns-security-overview.dia \ + dns-security-overview.png \ + dns-servers.dia \ + dns-servers.png \ + dns-tree.dia \ + dns-tree.png \ dyndb.inc.rst \ general.rst \ history.rst \ index.rst \ + intro-dns-bind.inc.rst \ introduction.inc.rst \ + intro-security.inc.rst \ isc-logo.pdf \ logging-categories.inc.rst \ managed-keys.inc.rst \ manpages.rst \ + name-resolution.dia \ + name-resolution.png \ notes.rst \ pkcs11.inc.rst \ platforms.inc.rst \ plugins.inc.rst \ + recursive-query.dia \ + recursive-query.png \ reference.rst \ requirements.inc.rst \ requirements.txt \ diff --git a/doc/arm/chapter1.rst b/doc/arm/chapter1.rst index a392637fdf..d3d0c708c7 100644 --- a/doc/arm/chapter1.rst +++ b/doc/arm/chapter1.rst @@ -10,3 +10,5 @@ .. information regarding copyright ownership. .. include:: introduction.inc.rst +.. include:: intro-dns-bind.inc.rst +.. include:: intro-security.inc.rst diff --git a/doc/arm/dns-security-overview.dia b/doc/arm/dns-security-overview.dia new file mode 100644 index 0000000000000000000000000000000000000000..77f00f34a5098c1a999f447b023e8ace8f753d6a GIT binary patch literal 3495 zcmV;Y4OsFYiwFP!000023+-K7bK5o+e)q4?xHCJ+i~{3+shV`s^tQ9zY_?7xc3(V{ zM9bV#q=%yIcpvt+FAgc&x{$U+5{j8XZ9JAt;Uhqt4<8N=4!-;T(>xwrhuI=Zlh?-t z;p0J=OwwtT%w8Y=@$u(Z`uO`dN8e4O;9L7|mId>H{YJ8Ycdw5x^8E7Klarg98x-Fz zf;`Po99^MBc=Ep>j)N0>(aG_fqrqUcfN78i@Y(XyAkVXCe3gfTB$$V`k+Ls?SvbzZ;LrM^v3(iSr0B~q+bni| znJyxGNq&2|bxBP*@N?ywHb#ou;Q{N~ds*!$t@Eqg;*TJ7*K)u9N*{=>uUDw>9iC%W1CH8mw& zEH68Gs?|5I+qGfJk2VJD0wNA>!)#gn4-doiVEKTTj57!(d31gEZlz7q@qfZezO3wN z9wgHsn+{$Len>wZKWGrEK%(jE0R_gxBG(j6M4xY%riZ3d}B z7>_prGFycpnZ@B9h*B0r8ZlBxs3D<9HU$jhaDFyPvt(N(bXctdrQnn8s@-vkv=v%= zu@+btVKlqQ>%r{cDDdj5Va3L2HVw0wKRwu26Vu6q6*e|Y($*{qM$`-mM}j-FOF-d(!p(>%#KjPPa+ikLx?;On zrb2|Q+KM+!ZD zlBGGa_U5RqjTrD82&Xn#!e9ngNeoye*0`b78ql=tCCGgY34(J@&|)vd%$~CV3S)d_Fi2=23iWZ!$<0$Ad+F3zHvhnYjG!uVH*0 z=Fud0^+Os@S7&Pb-^Ug$R89R67Mj7!2uv8kq#fpZ$K1VhHo@9thFYgA#_fQDIGQE% zu==Tn$<=&Gd^@64&ZhS>mh0k{HqGVXR@gy^ink^zf{YYHYDahMma3LO*bcjxjVMFf zPzu0G5cB*A>*MKPe;E!w{_UrK4F~qu7x?AiFTwnBH2C=2spqZ3@K#M<^~}{n<`Qk0 z%Q6WJW0WG}R%AT@+1a~gE@c@Dn2RBz`oLU2zCS(v>78e*1G80K|MYCtL$;Ew*$Oc= z zt<&4Z+vz+?yrw#crmE?Yo}QjFJyoxG=?<2n3$cT#+m&c$r+Ub!5s`o=teSVc4&AC& zyR3ZKI;<^55#m?A8m@d{e15)45WQddG95USrM3bROXb*|Y+)FpdPM9@M^Ir+lTkY! zJ%7>gdpJ+?@W=~?gSw6@dZpJ5{nHJkb!e$U0;U@bDeRJ=EDSDSq!1t;Ac{>QiJium zwy)c6p);DV4(gP90pUYumi9^7+oys)%#q^Mt%0i2R!nK2gn)tCC*Qm9nbUBR!ej9P zG>1_WH9geJi5|*{_K~+7QB_37x}ES?7+SzkF`^72{Tk1(c63FwuGlVGLPIrHMtA9@ zL_;Yt9xEBDFG)(U4s28Kp+UyEZ5A-Zj3_}AWWRm*jWG`@By4{j{2ne+J7#BIJ{-mw zQQ0fKdU$r~;eD9jq}iXAp-%HO3ua*zNwp5aWrb@%Ac3`Z8XKZ0z;L1UNFvE##g+1= zgVH?AgQrMp8clMS3Z;F^?V?a9;_Irxu|(072?+HdN^(USjv;ZBga;ES1sG7y)f0;) z>qN8<#Ca6QJ3y@Gmieq2=&`mc2EBUj!dv+PDl3qF7K^6xYW z2R}z~xcExL!}P{8a~>YXVY)UX8X2?77GHvRA%_z$=W%p-1`fRc+FljJk5bJ>BAvZq ztYU#K=?r9XHHK_M;c;Wi>c)}NenWvogn_?9YNs)}5@B7yFfpQLxtCgKr@ox_b=yTL zF+?O^*-Uxf@gjGst$VEPiK5)=tW9UK1=2xC>4zb?j8hL~zPuQ+Iw z{^@Tg?}Bk09{oL?hV!pAC?AXBWu$$0924d|D8HtEdY@4bfUX!R5|=5*WMyHj z)F(hxm_f<_(+8*ahb;Z%*TN69&9SmCdSZIc#Pl|sRL!7Thvai)gySq!9C68s9CAb% zCv-%xojPFyIdDj0FYqKylCv!q4I` znLS=3(H`WhTMofw>Z*hQP{)*9 zEh{N*&&aayk-JS$W=WB=lJ1nyBf=2Tya*2`O^1R#2)Uw$6^u-an4wntJD!ia#K=(l zpP-6RsR(bH;Mw!F=j$($uW_yXb}FGMY3~P+1f11|38$_AA~BZ$q*;;hh)^y#1cXUK zm~&S^MICG7CECQOebF+S-fbZ?8dFA_?j-cI>}mN>w9MCO8Fx*~HOoenw%5^A7vd3X zx2_FcELCzXMsP|1p#>=IL1u=JS&%HwZOi*`!o!3UR(46hc+|sHZOS@G=%h7dtaQ2! z;vR(pJuxfKh8p1>aMM4p!YuNE&WB>A%HHUisgKOWyNI`;wks& z&@gvS{idXT#T9TrBwd9hSgZ#cm3&5Zx-Cw>%-rl%ozR&s-Q4N#b*UR&+QBIjl0kB2 z>X@5^1{7jdse+$FiB!KuY0GBwn$&AjuSvZoZKg?E?*)>;T$Y3>ame~5h@HPv3W5}3 zBPHTJNL)j`9Ca*5tNNc8qkUYyF&!){D_z7_OQ#z24hJI*6J(3WXaTGHFhll~bbux0 zs($EM>7cCCWhBh7p>i%uV9vJ$OVcnO0gE$E*t^PcrU3NtT--Amz$Ug(u@zZZ)b?Sh@G zOf(Rk?UW5yOKIg@wnp_sF_1+)oe{fQgaY;!S66+d90ElBY;@~=EdPp%6 zin-2eSyjc#Ocui4&~wXSaj3*UK6gU5hABFjDw-iBh`F^(ZYbwqh{_HMAQrH|8gR8T zuG4~5RI%bBxT0xhwEo+r&-~)TI@_P9frpeLDO?+;#1eq8Bw|ECuwiSgkZgpyP5`xC z!%Ew7m@C#g9-rCqq&NynId!pG7+M^2rI;8owLIoZx;^Hqecg8PfeK{g zs$-IIf6SFXvwUfvx&!+ZaGrsp%CUVGFho#mpRzc=16&@G>mHm#b(&v|2QMbUJw4)(M@JLQWcOr+vSE2E2ot)8qOOc z!kCeTuymbVWR z=cpuB?e^S-dmLJvh)S0yqGHRTvdJWp| zI6~e!%9%pm{UI!-x;-J)!oVS3OaOIBL}^J}s>gAJ?VHZW5&AenA4llp2%8Dl)-mK1 zvH$@ObGO2^#3?)xBm28jh5HouL9_~gIQC%<$FA;*K9sQM`m}YdGlewYMaK|s1**lN zWd{U>3dhbC>##!8K1z%0wI#;5uPkMLiXO*kv`#87_vo}ZO V8~bmT1@kvY{|C);%+>?o000Cf#0CHW literal 0 HcmV?d00001 diff --git a/doc/arm/dns-security-overview.png b/doc/arm/dns-security-overview.png new file mode 100644 index 0000000000000000000000000000000000000000..28e92202dc9bc663c781b050bbb5e6b1b3ab65c3 GIT binary patch literal 25862 zcmZsDWn5KX(Cz_=Lw9!w(%mJEbV+whhjdCKEnOla(j{FYEnO1QNOyPL#s7Wp?|!-G z1F?g>*Q|+WW}YERRaq7dnHU)YfuOySlTwF3V09o67)2;7IFeraHVb@v;U@7$6AFdS zud1woUy+>Ublt%B|2{CgmiXTw5K71!DRE7&?EM^H1C0%eJ~2sLr!U`9KJYo?NKT^S zkuBk+sC~3bjmof8)rvbMHv9hdrHwd&gH6WOAN5HS#*NX5;n)3AxR!$ojNh?0d0v~g zi;)YEkFeUCo0Ir0vl-Q$Wp4?OUJW_qp82ybSIQMmekjt7^ppPWS&KCiPx8Lte3c#w zdl<(XRD}@_6GG+?!sQ0x-?AZr20Nq6LG50B_(d!`zcM8C2@@O6g@R9(L6K-8&mS$O?1GwGjln5j2?@D$Dfn#& z879K3QbQD^V9I?ABq~#K7a+e%DYV~Sk7me~*(u%0?FkTu)`3qSSy1MpU?AThR2z8L z8+5lXp}|$i*b<$35)jL#K|%znv)Yf6h`(W2Fwtta$Od9+X%Iib5Mja>dBtuA(JDM& z&rSla7ybtWS>1?G^j#0aecjZau6Oc@qxI>lK|d_av9Q9lvW~Y{);O_tt}p!L%ldqNHU6TM=hgBp*yGx=^v5NXnd(v<=xoGB8I6x5P4 zLr!WBVH@`k~MrhunbkikOTvx zPQS)h#)h(GbhjhH48vR?JlokG8qHU@f;q~0sVzHU#2pBLCzAP}T z)15U+XEA6wRA4G1pBADvCBCi8yM4Q#2JR*mLXVY^mJSOGV@Q#&(?bioiL|ZD^p3@j zqNSsgS@vJQOUCYh2)hi<#EuGWThUAv;~p^L+V}LV!>Z>Db3=Z+5zYJe{h|luaEXeDeBb$Q+Gg|5R)T;&dURevfzZl4amQ>wFakUbd%fj9fKz2LY(NH z{{DW**RNmSg9Q|76l?00ryi;P$b{7Dl`9t}4Q|L6aK0?)6y?lN{I1EEp&&16mSW=O zbPvxq@e#*WoidhBAY4MvME01Oi`a4#2dshH;7o~ykWJ;~KdKj_ zqM#(nAGP2OF|4GOBK(-@ilU>vwYe|KR5CHexlj+f@IC6Ahb8v6F` zpUNo|Dfm_4t#Ieu;9|>c6^z}q$+Bp2itcipTmxC+;ug;v zywREBl70-6Q-s$BE~77=<@zCX?DPI&bTY2}vg3!Rtd9fwmPW$~nlu2ud*EUopcC48P9Q}10#)~b% zx}xh#Ni=Jq2A%p9dOG&S6pu|aZ7VDxP4+9+i^&fMK92<^HpwljFj8p^S`RM@fmfrm zZ;emrkyxugskX6Z?#^`3_fTgw?yY@i^B0?gBc;fsP}%E9au0u<>pXA(|V(XC1y5z(U^6D zzR_wZyq2auKa6!*!z7B5i7grDFI7$R^<|ciCme%i*oX)YZB~2zHLo?uz|n~AD}vh@ zacDVnDlGPElp0${DLxcbkXsW6N;85yZszV9J(d8qz3s>Hnk< z+IH^>NN1_Y0O1qn>EWFHDEjN#BrG71f#y13!C9_Vs$P7p5pwI&kpK0ojwUa@l8~sV zQL$#pv&j|!yDy`oqYDoU+ZkB>*Zeo}6E-cK1amKa?w6w9ufv+%IqdL(t{##a1(Kl= z&o0uEd@^`6R`WK39-qF%0y}_P@)oN5$DY-Lcfj0&YaAJ+rTt&0)Plp~TPiB5GFX%Y zGIH_?O~#klQHpe>=$_73j26?^YtvLY_g_Q|JDr6p?@g%DcD=h zOyPn~@wmapF@)0rW1=*G%_&!Vg=?^8R-N9TLb(V>LSqSaWkk}0{6Y}E`C2r&!+(X< z8WSF@u-_R$vAa7p`Sv{d@ag7uHK$#OglL7WXXAY$d{rbo4ML|0s;aA ztOkvKH?CdbX!^A_t6N($#Ttdz*Ip3SQVv(z3Ih)36BM?UNtKi1t|@!2XIG44>pON} z*y1sqEpRqlZQi>Sfq+IVy!_MuU$y!0MOP>S-0Qs8?ExMQ6B55^%1Hmm;pl0{3gTTI zE|PFs$m!_lczD!D6@GYnygSOum-QbQ__>zW++^ATODc94%J_^tbfj3wh#$^I#R}AS z@IoYW!W&V95nGYV;KqK6OqYo}SBap}0_!M2n)eO0t!thO4*o$Fk$UOA)*DOz*{jnJ zZ~YoMof3cTH(<`60ty^8i^DwJvv_TG|2Ihi- zX8Sd}LtECPNR#pJOU9HE|GPU=R^a*S^vZAMx3-2dlCrYwPGV0YV`5tEotZ>{2v>t= zb)aspuBsf7#Il;2nmRh^>czN`sU5CO2A?xCOO~P0@-!*(NuLf2-7Nj91DH0J+I*u4 z*m%{b7#ZdB$E#RUnN4Cv3knLH+AdNB7J)@!j>H3nrw~=57>O;d6=r8wrA|Die*)Uw zZRXy*&39&2w^)-H3yZ_F6VA~-H7s({x-X8*^0tKmtP@HAV2;fg z!Me$K^)PdMbTp3QBZsk4fjWoux^KewyN&Dpno-4U%fC5|R%>f(J!aJ%%=j-~zGP;> zeO}q_tk<1Xp>mE%x0u44H)@P2rlzLq#mQoy`q{Q-(&P&OW{K`5!@lvuq zxLMXUE?btbUR_uk$q`!i-Xhblv+`wy43Yu}Ykr*=Lm874Ci2Tv_lJp~-Af|GBT8GWp|#S#)q?6^26kKkazoMe!GH9KwPf zap3YMclNQ~>z8XqgobLW_#GrCCxh_Mb*IMMTB6MTU~Veg_T9U8Km-eM0p@?o^=I&9p7#pZg|q_7lo`)8#^*hxSR|pWmp@%$#an=Ek)aH((k1Bg9-;#61YUpkPo{jqgl*k@Hn#nYaC98PYr3R& zb$TiCZ_Dra@LA^c)YW@@(NR&eg}r|`>{EfKkjAzNcP1oYb}-_P>Hg@43y{r7aZHO3ZC)YjG>v z!dpCHS`nr6ro!cD=h}Q5($dl#lxUtG5(yMN%#mXo3t3J<0l-xdF{Y|qU?D%RVTp(q z#`R1dBeC$^AAZxs+i+(B!-+O0nNl<~G!f53 zg95bk!^OKa;{X@8Qp0F_AW7R7b!%xNy!FAzyf%<9Sn5P6Y60KNeYW=diE{l0LHFHl zE<%Pt7dDxxfoz0R={b~%N|tN6na)a4 zs{zPtIlaHAFAfjmcbzxYAoHBm$?bD;m#DsaF9;M?2lxg`-;me4*B5xm(yp$Y1Su@Q znrUgJfE}beAcu9D3E{JrIloH!-~scjdU(}qq^5V52QcgF>&`C$WZ>bM(s=-4sH$Qw zQ17pG1Lq(BPB+%5sj1<=54>i-JSRo-r4 z*z(y@n4wChc4VXu@TM>Jd1QYFI|87OvI#9vFP5U_AhZ;E`BJ)A6QGppWLzvPEXcJ+ zI6iZ#ZWH#)ml)_TUSJX1_QYbssd24T4z3kO&_HLMYyi9&*l>m5&?#bOf1J!JH7B<) zGy7`5x}|~)piit!muSoQ`1t0fp;q|YQpRM(3|JrM8v1h^MSd;@1_p47`DF?4NsK9P ziJckgSy;-$oy1B-wr$CGb_7>CatjL&HJdJlg9Yr&bJUaVQHxi3ULd*1U?bYV87`Zg*m$`8wuOElE&U#7(Myc2Uz1M^S~iZ9JgO~nTvY-}_3^L$Z+ zy_(|$@Dz~Z>Z7XgGfZ(4ymQm4Xl=*;?qY5z5nS<2s&I1WaA`{9Ts16()3#1IZ_It~ z`-}HSKlg0%$uP2hZEZrIQ&o?T?Y2R8_Ej$-w`ceF1AvoeJ?IPSEzl0%IOm79$N#ve|jo!g2Ew;pDG{%j`UBXy|N_@eqMost7@eGprF zBv9^OYL^Rg2^VW9!roa{-IU;4U_|<>1Mkx5RC-T0Fwmu`K~`iwX_&=pI+VU!J@_^< zD(a20veqlyRCpHvTZ(iWe_%eIAU1pOlx`+ab)L5Z6NZENRTqZ&+L@h`i>Y{R^@Dkz zN%W#CI3YFM#iJeTn$Go|&m5tc5?pDDN^k{rS`Lp_35yMZy?;nd3PC_C8K--8s431a z@l|Rxt=C_Rk#qfJ{)27lzk0$j>3|i+!ENY2hXloc|0MHc$VHsD6RN<)+58`-%gIbJ zpZykR<4;*Ajq>WCRe7t_)z9%^H-=lbnu*glVArxA09sF|3Vqve9gsnbbGP4ITKiRG zPN$Ul?fdsmMXCi*ya|GNvG4Tu?K`*yk6N^pi7(#KLfUNL&u zCvo*Xkiye5GKXM>ea6s?jEs(s4kcpYKVw~!0d0+fVGWgD zjWg{5g_!tgu^zEePB^z^i)AHvMON*ud!0nG`m3<#*cchYHXriKDHTud{u*051}u$h zVagCua5{8r;E*|lopIi^{7y;>u&!jml)zv+3Xi{?>-#n*k>f)i$NS;A^!QrouPE3& zP#hBf-=d@K*yVG)lYD=SH?nh1#?Nkfpcg?X$xo%ciiK}sZNI%)mzR~Mq&KK1=qAZm z>91kmRMAK7fDNaXV}HLIkwn1uxz+2W;7wA%Vv8q8>hf8rv%?sXR(~>#a>C3DoW41$ z{87IDx3$HVceEN87xxwJN4_O5^RX}DD#9n-kytcKzDI2o0oNVl9$2AdQ8|2-?(_A5 zIU+6Ii_J6<7@o%$2P=Ev7r{%j@r5Qx9H}TNPk=DfDl$=7_N3aO#HHu@v1!F7Ktj{5 zJj-9ubT7~D@{r;S$a&mR`q;=zYUA9=h94abY&y+Tc~gAe=M-FOzO&&r&KWUU5Dsjn z6w3GBS}CcuVhaAwik{g#do%x@8DNhL9=mCZ!26D6xy+=b8uLDM2st@9h-d#;f~Kx&8X3s!br*(Vi@QFz=V4|F)97c>VHpjL=?XGz z?9-XQHPM?RXug{nSJoqN?13j{S1wlbF?a?Fe}O>-Fe-;t;Qn3UV7>3w)tZ?V{nMC-zT2kZbuO! zIx!Yh?F8XZ`2NW&RvhTuu> z&=qI#gz1R%hL(v>D_4xW*=;?Eq}dzK!g_l-N8GMXUt9NqZa$>5v$Nh|9-U0^{C6Tv zZzlsT0fEz8ZU4-S=jHz2DSIQ92oZwON5|}ZG#8m4KYrk|=y7}O&$1dehlYkKrn8&w zOcVe_qQ&igdHznkpTt$*D)T1L9}#_juAC%j*82={-|We@b-<#mj8FySlHn>)DnQ4{ zxu0RJ!=okJjWq&{4PzmkeX&_Bv{PMv zAOBlayUuvHJB*QbkIif8w$KBaswJ8su_}_+gO4hFc!;0p8t?z~ZfssF{!_!r`uHMa zw$j_PLoLVfjn#N;!F=bfM3m6A8F zTjKp~Mw0SB)x*Cv*1!g&rKLADr+3~*1EgQ?kfm4dI9FTT=1_`zm^j@x?{s0eySt+q zXb~==q^)uU7X%Vb@3T!1dIKMCB8)4vN?{bUc*_Cyo&2ukdw0+-7sXV)ve09)B{qHD}eNQ zuRq)<E1IaS6#AE`l-BKFnvN0x;UUpg)`$Enu~NlLO#OoH=>W7PYgUjy*u32Ui0i$HU0vxtKMqgT?6@5Ijtu;@5b{iI31vc6^0MzlW+-(+XS@6e}(`vndq32OoxqipY|^?XRsTPg!n>$)^sBifG_ zdBu#XQzU-(k~ii0dK4WM2(SQ)-YlII(Z6Z;y6%mRa5|4vs^32C>l=hIn7yJ|=GxST z65b)$W!%+#7=L<*7!~cxu7 znMO#zcCG^X_Ngj>>@$qX@dveXwI7Izy!O~N0bZLsZTs)4Bc6VJTbvXSF`1e*R&Ww~ z*fKcdm`2G;*;y4!xZspbEt`Jzw-VzC`!d;KsK-KsjRc*px(hfvj)ukw67K78eyqN@ zw|XFpw0Q6t4FBRTxVX^dw(PZrW;fg%Z=$ZsZV3%yN$`F*LA$B-BaCbRk3te%p5OPe zl|~yEmy=i$K6wR&Va|=|a>gYTbKqKQRJ>%D4|^@bG5BsfO)65v5lbD;Add{w{7>_> z0&YZ*?;Qqt0X%yq2UV4L%T`txHN&I}j~pQ+e2n*TTq=QOvA3cGDG9vZWL{r<$u zF1HboU$Les(0-C9(QWmr=3w9%>cXI*hQ*;<85Lt`9Kf`fAb;(Z_B-z9qJNBEbb3p# z$tU1~crI&yD|7JRQKp2#sM;lO>U45P=@XlLO^cp+g!@%4zr8*0zq)+^JepetOH1e* zO|S_Fxnmi-Zp+S_h&A-aZjK30;ru8&JKKvb6ZGF28~J(RZQzXqZZ( z^NxOfu;+Fk9!OzR%Ip?MR9owNu`T3GIXQR}P4Gge#`UF!QoTjEX^6`>3IY53SLmcg zW?T-L4a?b0G2T}8ia+w5JTG_T=R|UpLTgqv4ihj)G!|3q%z!U|<%{#DXu??P9N+uP zMYMki6e=T{>10adAVY6bUu=jD5DdhT&8t(nU^zh1G5EF?= zMDdd2qhi)k$Qvxeo5J4~NFs7O#fkc}d$EgNL#7d6phwunV(5QCz%sE_3PhV*7e8Yn zQ%Ri$NFuYKb@h5-pv@$1(DAQ)nUi1*sdJjv! z_ioqCdrSWDCbz*YB3Swp>Pb;llU-61TA1WdWifs}LAOLFI%=K`kpo z$^T{}Efr~XQUx>wNd)#()AAg{W*?=B!_3kl&cN>Iegt5f4~XmRl@GtL7$9q?3+rY1sHDMR=cr3@rs(w zpWK7kLVK-RKmWZ%ylVE|GI`8{JUr|K^TH2|1Bk)F@@`2$$GJRU4WXe6g?L??y$~Mk z3)Q;brw=F`lzHl|i2_E60#%iyN>?b!?O6rmZCy$f_OWeFrp+=1_O zfzBQ)KV2(Ia@0!Wmz2u&->705uxjI{<=ng)Q+*D@k+c(=;o6fKfWkoCp z_^M7cuqis03wfWeXK=~5d4NVfDBiPyen78im*r;pk7_FWe32mFn$E7wHKY0{`qDXO z8?hi0lZl_>##H@|VZN!)*B%Yb%7^4oPrq`>WzuGMqr1Pyq+rwRNM$iyf_xVxj_oz^ z2GvH;7pNeu)+tkc74vqp%4?I38a78zgrAvF!j*HbuIqf~s?V1xWOxb5WBg75^=`D7S4;Y9D=tVTPouj+m@G}Yv{QPDbm zEcAYFx+{7f;O@_b8MR^JYl*|FH3?mh2pwt8dAxsLTSSVZ;(GUZC03(YN9L=^SkE}s z+d{WF^nv84K~RK@ii%M1{6mtGCK|TH*2=`o);rew`-Fs`EIu^N$XMxz+vz$7djn0n zq$n?&y1DJ`ZF%isQbCJV1W`V|?TErAH$;WhU&|CV)?$QrJg|W|w6b1la=hMFW_Vr` zjb!&o-gPqlRs?hynWObD!s&!l6X>@5n7K@uRQYeXrw4)K9>rUCLFsF9Avwh6?Ha|W zOkc_y)uaeAd0f_+L6<3(8vTqwiwU}RgzUf0r?e^)$G6r`*6M8sI@k+Ue|;87kms-` z>^Gglf;moV8?*aatoxNo7ct;t>V@AE%G2sv>0ni6|5ATfWv;0A7UO7|SRgqPl1>vg zokv-;l+7QgqocE%WRBpKF`+QGX5J0xsF?Q>Cd%Z$QB*8@|I^vA(uhK?fUcR#8A>Ti z9{A+Y*h8m;i4)?vB%VYEK}JEz;<4l9w3%2JPgRt`o*Fr_4$Nt~xdHib42AJyO+sq8 z_gO;5yYoyH(T=1Im|N+uh#L!biABm!kCv8}y~LQPv6+Mf@MB|LYk(!uscvMv|0GD0 znqIFl8`;l#9c!=G9*`oDn3_5r*MjACJ7Eh}8`H+s6>fTHaK7Ik$H~PN5)!gZ+-lRU z5nkwIA53|xh-W&9s0Al#>2|MW!2drrj^|2Aa{O3gwm?X{XeZzDmkALhLBqH8INmR0 z%w2Wj`Z_{*17O<%$j&x_2jg%c9*X-U%}-EVoG!MU49Cexa>)!AV@nBnoj(pz(+}RU zZ{EBCEkV%FBI$j_!0Kq;kLz{8j*<@lt3Lc-F3hln-JTGHfDVM|W)!VZfmLFrfOW?Y zbq1=E^?I@T#KYaAA2H`|$Ht068eLxa-%`FTaK$U*v~tu*_tkcQj>mw9*g+kiukPT6f$XxbNwzZ3s$6C>s2;4GXn%59cEs9tYUc-6~jcs zma!Uoiyt!d%7ntB5}6=Lv3X}f7!R!==>v3TlhDTL$dg2ORr6{9Yur=eg*y3;Z$Vu<+9FX>0=9PN5Ez-s~Jj6>)cpDDyqRF(T_ABmCPY&vF&>XN5 z6p${OW$|b+%l>4|B9(A@&RO*|%$JxGyOrCp&GjxOg8BXpXIuSX&By6R>VN>9>VI;! zyOwKj)4#G)nd+s0umtRP=mfS3pjZOpgr2oc?KN0yx2g>*fT>Riyh!XbN^?cmumerg zqF59aY5d#f4I8cAYbX`OYRabwOQgPoZlEuZB&rb43+bF;&(EQHdbZv&_Qv6?O=3IPvNtnhn~@e0Pi+}*an9dm#c~n1VAmLrltn8 zvnBxv;I^l1W6^eeXG%Rw0|Q_9!%(jw{8}-3Ea6tKK2{HS>}h}81@TL=o@Mr4CXT!( zM=0D87qYSy@wet=LZL`s+u9;MQ^B=6mWk7S_41pWzI}sbd3u$^K$zsezWU3POPpt~ zaRv^qh<>!c95)$6^&cJm!uDHt&`iLv_0sz18y0S{?t0OBB4V`6X8xyNhgn-Hpt$ny z^yVT`$tv%y&MW1|F<IOS{6}pV)6aU3=XC`02W;$FHj92S~+8M`L1rAmaL>y3(|DcvM!Yf#|-Q zK6&p89O9f^ssr{|-{PW(M;Ah){$qx2%XASkI#IBIn+azfe3sY>uK;`ha|RZTVqPuc zGpi~ACvLrum}bkD|58D* zVfiY`-L&xI^%}lG{W}~Zua0Aez`*WaP9*L{nW3@n`r#L5(-@!%(*{yA z{GhA?j(=j+)vq!4UAU|sjzLLG@3fu~)C%%*w>})m!m`1KcBIBqMJ^2M4hAlLlJC?( z;C8&n-v}r#psK&9{!5w%N-Mz@k_O)mlC5{ReuD&qld zCd*7lvIP#cidNcu$3|mlu*K=RvIP*d8<8-FD5_Qo9*SYJ)}N$$-k}~(&kzkgF_?fX zh^R0S8=5EH1=m(3l327oyQ5OQ-KA1zyU+L#MHG@Gh|n_Go|+Z!UG~QA1%mr-=x`Qj zmUy34xtFSqAsDVt;LJ+(uG3Q)zydMp|gd?VqA8+ZVX~#mpPsR8pYQg zOFs=;rUwU^8aQIHc+m?EUzI^-3N{IQVts)bVQWT@ z*i4@y3u$%utW#BG(_+AKwPZdt&Mbh+?IQEqoqd*afX2^g_A3ANY~xQIjou%d%?N;b zwW}#5yH+z=Wzip!C-FTPjf7fw;iDE87ngpW?OOu_`y914p9`NS|5Deva$OBmo&>qj zNGQOa#f3xmuaC2B>`Q`B*njiVR@2L}J{6kmC*O6tbxgoP8J%y$0N&!`$eR7`eFqX_ zT>fGNw6!bj%wwI$IxYiZNBq`w5(9WlP(JyYFW^0PA2TWDa-x0n(eaq^kqzsPVf}{? z{2d1GV$NgbEGQ6mN&MdagQQ=-GRrZPYb=iLv@ByrjjbdtnJPznFjse1GeD#OY1BPg zK!8O0UoDnr@xnN}xh2ULJU%{x2LI21huh18c{Zcg^v|i&H5!HP`VIALDk?TuZFd)E z=cl%&9+BdZ*&p!1E0BY^#kALFhlvyc8kn;B##85#P9$Z$Y#fBUici=$RIN9OEwS(@ z2ix<8%e+hy_Iu_eR6}}#XPY;ZpUdxi^66X|kcRuwO_g)}H9l`3?(;4xgL*FWFFu7w z%HNrL^4yLwS4&-0ri7xco!zTdrZ#_mf4n3QxLySXfCA9o)C%Qt1ZbxxH3oaCmSxVoDYjUe(%)5}Db#r^8aJ zPKVQe=jz=V>1L}YV#xMTJN@a8pgP3iW+oG;ZrzDo9CbL9{Riu`8wV`;@87G91pnhy zw!ZV7?>U{I$or;XqNIDVLcihAkOn6nQS@G7|?3?mi@RmI1PybryE;hMY z{|bTueI^YF8iJ3UJIsXnCX6>7;eT985_zHJ>Qnt~r_mquX*4g>^ zr~e(X9$`}p==0s&+)Sf>guTAC%NB_ibO$`lY*PCGXVfKji zr#}(HEysI=+(Sd;x)X*S*h1kQnx!d5JsravRRo*HHYa|HTO-$pLiZ<#GO@vOq4Nz) zIduDfYqnaw&xRb9F)92l7^8!bQke}J*Y1u)goRz*+{A9yaUSCR0np*%d0U#06`f{WVamAeTtXWPa_KGXv$=O6U+{?DXY4Nu2WDCh zyH~rY^==G$Z4$LU3OX)Vs2(1ok201c9nCi!Z49O<*|+_p!H&XbGrGS!YS%Bxxnf|I zk$|OBmU3jBt_YJ>c;N-*3=H>-QY3Cz>#XBq{zbQCFF^ZLC=R#dj7Dsw9B&{zF&5ef zSG;9PJ7rs-y+hJ(lpdIua>kJ(1Qz464wZ@PKHW&^)z9U!j+6FQy9O-h7-F8?o8NLS zL6)WT6-GZ>UH@`=dR{%;T{YOvj7SYP035fGX3W~=d31qSuc%Mzp%L05oEm`0$3q;eSN>Vl|JJGf!HT`YJYOdE zGiWb>$3~F*{J#A>lHHLfX)`@^i$8#6@yN~p)+7liIO8wXM-}rn6a;Tn;@+dMQiGlK z*lO~dbODZhF>K2!p^mz@Iq^Fa@cIoB`QlpmU|S6NczAdi8Et!zQCveBo0?dRTD<@_ z60*rs@71m);U^q4V;tD#dxgx&mMEtKB?)j$O<~doR34tY--)Pog0lfciJV-3^4c5A z<>t?CN;bk8`kiZ=I7Hw7#SAe)n>Wr;Ye?l!PQ5%0`t=QQYK|v;HBHT0P@3wBz_7Nq zzPr8kIGB6Om{RYwYy=pDnkAsz{cyb&udA!u)YLSj;rB0!UP40R_N{5t;)^mpc@s=T zt49mMp(kCG>V7{|T5QeK_0YsmpH3ItMnxXZCtq4gQJv1Pa?2M z^KhHcKi0s8fHvoL^6wanMsYv+6)Wo!u;R_(tQOBB(7!4-fJ$Oc1-G>L+CP8x0f)fz zV9tFXFkbuOK*#V6?I-$NKXtmKx{_;L8?rEXc*waY4hqv*+n69KHhBQ{`&R$kr5JHR0r)<1Db~Znl)|jy_s_4ZZjfRqhyEICJ9Qqb_H#fJzl63Wtv0-#CU&5HgQR;JcjT|nukp#7SXC*?d z!$Ze1Fr&uu5%Jl2a|5ZFP>$NHy<7~{u&}X#`*WB-UX6&145~cRGm*se`RTr=B^T+h zfrcH*rO_Vn0Lr7dczFH~7c&NV%7tr)jiwO`ooe+zxo0hYdv(5~q{v1uWE(P>LjO9Q^VF+na=YXG-5h%z6t;=UzvPUWAj)U8lKuYAt52(ML`k^SHODR zI4IV5?pYpyx?YOb(ho}oEv?kFH0^VJr@zbGoj(&W1w{;-O*&xLH~#@hkrN$92J@u| znwa=%+2CTBZ~0zZ)8cDvWF)9A(?tUEoLn*>@`7;{EqxRAP7(1x=(nhZW7Eq|b9Ht= zwRsHBmII%ji3h!Ps5Eja%F2emX7iZ$#;mGbqv+Usn=l3!ar`MY7CV?RCgHJ7 z2EEAIcat3PT76^1R^#{PA+wcM`%x-DwBXt0%)(H3NNqHPuk ze~pU`$=@a>C)1`4!hjkUQZEhsmU=qsSF4jQ&*gIUS3{LYi)FgKQ8-a2CnPgvH$WqS zGq)CpucTAbDl?pa`6`kr3K%j@UtGp=PtjIxu82csO7%XH&})h9Qws}=bPX0Tb3jLj z@EWwXo|(i_2&IPnF0g`RG1=w3thkR&Y*&bVbFb4k&!=$Wcsp=mL`C0%2N zCq~HjO_#U7d2@3+$OhQ0wR#6rAO$jPp~H>}MBhmZQ6TciN_U_(G zOw1HpeqP;~Yq|d^mUJ-iB?fOy6y&{^-Y=DL&Z}Frg`YxE;OBOX+^l$0!+Ur}Q6lM{bDYOgf=Nngsq%xrHJ9f~J)Q3a%WveqXw zhx`@xKlY6>h2|jAvF(cggEH07IdqTbztk5`f*@_U*@hA6(GwM$5?1 zDKtu6;PK*9{@`Y=pnJ(}h{xkm;1h|B>ki<+Ynqr)Zar1^OPEXMFMd$G92iDpVDP$l zJFf?ZHLfzAc%0Qf$QuV_PgKFk>T4$~cQ`)=orCDMcy zyn9E;k2zC0{|yBYfUHA8tLWIBmRbSbR-M21#%T0-o~LrrEIxF1}VZL2!}7ZwttqE!nOx)0iyYa8mVV#l@pxc&q z0p>&qa+Lcfs+^;Xz@VX4=?1PBm5xrTzm@(#au5hy^<%fvF1uX}3g(9t3GQETnNHeA==ZcbT=*Iv=V6MA^ z_9-({&}xVfGT-1t5ZzM-ru3BLOa1O%tq#RtXM7<3?zT8E3h*D<8UZi5!{U=A$D|E+ zuq`0@4&@~e0=iKDy~guskUF4w<`0j|Me zkOadf)u8tU=sUnuX;1uHi>DC*LqB-PVz8X?JUY2W%3$7=PQ>>TkYRgzdQMJG z@@3->=j!(I<3;B{VlXx~*0AKW2f%3yun|D@vUYSm7|F@g{A$#buvhu>qrArG{*uE6 z8fNH&TIm#^(3(~AGcqE-R#ZeK$wfs)U4LW>0`G!}h1IcBpjRFTIG0LFc+owI@)vjN zrBi@S+FtZLM{tW8vhyR#HfVx<%3@)05e$|%WYr^}{?a!7kZZki=@3H-QV~M^JT70} zg+-3{MGmNx(5y~g_Rz2}@ZK(AAlBPQaxybBGctaRB5lZ&$y5E}XMhVy8tv|u+8piQ zI6Xc-USGEe(WlX&u~$xvjf4f1cyqVV{p4Tmv?XX*kfTeLT4Mgr@zh3M?H`v<{@Vl* zaEldMRwGgp5@DaBa852}5Nt;>!+N5tJy-zItB)I)-QE|aoceC>P*u7lFoFsJjOf%g zmVyF8LEPZ%Mg4k{^KImplZ7FcANqg4jwk2c14D0}=#kf44N`dT0Ntm}CuN=0$~PV^ z3^^kG%J zYnu23WNaR!J5e+2xDc&aLHPT070!&9c9t|>_0^eGruNOJwUo;u z3Jqikn3_vwxV|>Ozowb1{a~WD&>MSwV-0BCk4p?&gfHo!F#BC>*9eIUs-@#t=n~BM zZbxGJ_QPg8C#Ei0KzZTZuV=tyiq?maa)&iN6ciN6n*gHZ>gW9~MJF(e`i= z+4=$p|C6j7KL?m~Iv@so_Wk}(9X-NpPDR#X_ec4Z+{Ap_oe`~y+8rrj?4smbBLZ{K zmW1?lsFAA4B<;(WJMWu8V6@}T1P}2iGGCTSk?;BJ4;cMrHtV8Y5o_~KY7G^-4dN2u z5tD@~VD8Ho*u@!?$Y8+%pC;BHt5Je?8g?yjT$2&cjSmkQ9;HYIOUe*74X=}g@3@~n zU1(<9V-_ACI{QVo2;-`(WXcvW;m`RLz7-UJq33Go$KFppnsdKjfONAr)|rn6_XQHw zYWFj-J7wU{pFfe2&Oif11eCB)1@1ZCwMI3)iJ|%p4 z@g59mxVn-$$d_B3S>?2}IIAasQPuBvM`E)2Z!i%|l(Uoz!H$`0gaA>snFRMunXbJu zpyIn5G5k$c)TPwVg!|F9U98j0fU8^2g=6+~V?rGiCJyGw98?e1nzmH+KK_D#o&!oGV3F0ueEVZ-J{X8BQD+nQp=gI($UXp2bd5vZVzzZ{ZkAQRX`B@?0@+eV5zxZb9z0X_F9i>ZOy`seMT&fw9Tyx_nmuzyPsWfS;pd#f~iu3=Fszop+Ij%H+ni z^@a}ih3O3HGm@z9DhNIPYhCSLT8zx1_qtR%Uxu!PS@(y<=1_)JT<}M!uh-Ytv$HzU zL$x?h_h%|TKF#^%MWp?oMdCNtNxiNNWl7BN!HDMJNhErj7YRql;FnG=Rp%^)1{T00KKaRyxto3C=;z{#Khu z;ONqEU|Cw)Od-2%nRUXoK8bqlLxOw&phLrF{xwl>y~{*P_wQonWK8lF zt@UDB9}EdKeBA=H7+)Ws3WKH}A3aTQX!GfBF40O`Kj**Ovw6X|v3pdqw(PfW!vy|i zgD@*~C;{v1;_go`z0QX3KC}o6ALcT$A_Va|9PbpSb0OviAcsi=Mn8b)*$y}`rFT!e zrIpV>*5}-&RKE&Ospo^}gsQB*8cw6&;0Y;nXq14@Bg{Ljd0pz-&pk7@#YaLq58^{#go0w5T^^x6HL zH*V9IXof=vrU^YC?{7AV6`uhe6uk5;;W;$+muomth;-tX^$d3}n0gxGiUUM%XCebF zsFGJGUjN`A2)v(^Zd-jWY{4X`QYJN+6v&24!;`2H=>*x)->P{q!9h~LsfqjlV|#zD zdt-NLmjqU18J2JcWx@dySMhUI^J{(a^Hn@qRZasnioZPK{3h;8?U{Uek18^UX`o+u z!OW-3#j3CbSGbJB>;c#chuKV}-`dLjhubOvL8dc-x*HjrF?@B$LL z!88rGuT3o|_VDgsg4~VQzI@k$B?sx3EHN?rB^qRFf+Fp70+JRApy`*vQ}eO~AJ9iPwV z`^6>HOWU{!bY0ma^PPQ}Ofdz?+Vo^?X}8dmamosf*b6Fb`YqDSuE0vjOSFYftw% zXHN|gVJ992-Rs${XSGS*wm$FD6C-E6f8QVooO04-m=#B-cDwFofrfgxWDNG-SV`qg zjpwP(TSwLiR<`VZdDrgumA8vUsyT{$2>%+*@<<-7|B|Ij;JjB^x^}h@sJR+czZu%n z!e_ZO)!cBc>wRZ%8Z{ZFh=<%IOqUuK7QJ=< zZT?;j&;;oWAOA_UQ}qFbzh0rBj_2R?X)Ov{mf>Ql`6v6^bY3$HOQdIs@un+ko}x|;xy2>abGn0w8a6j_&Oa8l8wq^Dq%J8ioUNP;dUU80 z{h>3)o7kzuu2*GeJr?leX0z{ae5t+8doHop`Lf&eMEQ(US4Y}U6Yc$w?+%8qYVSCl z{Emr9u;hw09^Nz8bf$+}VaI#sliBxGpz&IVbBDx3Ow4tmVlW^{jtr1z1w;}+O$-GO zA`@n|Y2oqY45oU2AVK=~584F`Hu)nOEDiyuMQ?Am5ttpuwlJYp%33 ztXhr?{0mV{D@}TxShkY10nKPd)AmAZPw~`MGIE(L^kjp_fi?8FSm?*s#sU#hN|+@9 zYM-e~LYh~7~drazwiWOsjJHk*#37O|XnSk3bVmwn6`BgO1BN@3m?!0v)o+F@9YQpcd>Akj*^xDL5 z<26J+TJ~`FKznVZT!EQLcf9rvGgRbh89Q9Ti)5yREjrRk*?*;Klh5UaH`I?{H_5D{ z8P~uYZFJX9L!Q|s*K5|S`F^l}plo6LboGSN;|??)I4p>{p2;HeBQ~kYSjt|CXDQ1!&92PK%60i-kAA{LB0WLQ*T>>$ zBo!@9kHCF##YwXkQLns9{ykJ)Pb?GzD4UWhCAd|9+-HCP zmXnv)vt+}10iv2D6s}GQvKs2<)5$O7ua&P=2;`Xd{rmh71o-p!Y9}p7njGG5wG_)e1G&#u4^D)+p!I5mE$=~!=N>Q zi%@PcyjM2r8@>b@ahcDM4#MUcp9}Bqp>JC0p-&+jI@;OW`Ks^8aBHJ!`tQbN zf!15#C1wkhrX1tQ@shAbXE(nJzzpS>bnE`Z;z`dI+3zbG#;qk)wjY!C9HEPAn-sh?J4{`XPMXAvo>5=(Z!vZza^hXn%1VF46gFHU}x- zKP(Ebs2A!a{p6KoohK&Ps>gY~;e&XofC zbs(f5kcNSej}MiPFs8Gz8hsB}R<8Nx0$~Wy@wF$*r9h(OLf#LL%YL-NbM}S82e*~Q zKVl{12BTr1fpFoXn*X$5ncbzGGkl2M@yn-_>Cwxv!KV>wQ`Gpoj@1fRNU+sHC7| zWp;LVec`$w@K~CjcD~KQRp(x;qS&?qzy+ig0JXypTkKG@cZGuIEiie&D*@Z(IOw7# ze5Fh5+?E0xrJdR>IG4nU);pTZlDQ`0hg>;zn4A^+7V_r1#OoKz4$Dk_o{d|Dg&HPf zA!^2A`#Pm&Kmb!xQYsxW6SZCB{)nQXSzcNi%T}f?)mdIKR7BVO`t|Ex0#~Y-yGmv+ zV42Iy%YfEOz+hlVH>&r7nkyK<0~E$nmx+Nr0TLJL(vI>aoJ}WVl&t?M{_Sj2(!Zqh z!au3lvSVkRw11BNf(~rzgkuo>!u=Wny!wL2z{pXKLHN-wob=J=gZm z<+@O=qpc>}4&wE)cXinP!xzHObr;YKrz5jOsMI+*KI};qtA3EL1-s=V1oXeYMnVBZ zfts{=1yE3232OkBfFuPVANHF!sf3-TAc(UYY>>g040Tx45M>M55%kJp^o})uGE(K2 zuU+68a4`IOja=Y`{}7&C8=;GfwZThzg2QPK25%_-*;|{Gf`$qJ0p+Cmez>{d!v1?Y z?3z)DNfWeBz*esT9CI&AW2Crvk-^=b_nvrNdh$@$mfxlj#p_n3jzXq~IUq@xqN)%* zEKW&Zc?>tvBJG$InEy~(G zb3?*CM~JA!x?DBPi~{K?F7Fa_w6{Z8m(^*9L%X-1=QzVW}^MWLv7WV;4D!6Fq1oH_fg)3;`O{K zl6-kU!Y~+&iOCe0c?q*GPjSwi9X8J{sj2b!8bJz46If^s_y+vQ7=We8d+1@j3$!XI z*~)1WI&6V`44uRQkYT<+-9XLl=EjC6umx~>eYXGf-mEeJb^;LN*RO>=)~6usZ#do^ z1G?P{I+v)XivHHBtWd_<(ymWz;5h;U0`#lwYCSf7K?Lg#=gJG~ceKysYUXr9?Wi7f zpMbChI7rVYPo%cL%RrTp6UaE=J@eDk>JVvxSmpkGSGXxaJfJJaAt3i6&^5uxXaaun zTpVDlqH68xvWK!Ah{0o?KBZT{R_IPSkug~OJviu20-l+T>|0-ya4Dd+wifiUACRM7-j+A@>s}9sF48!x4W!+{B{gx0iR3Uj97V>;4@XT?NQovj9CqL4bu{Eze;`$p8C|I^@A$zI_vg z&!UvTWk_R>3vMAaxI`WZf;uOL{Xn=T+3m=O@ag}zcSOSx{2%WQg!JIgwf(L6$cTs} zAxERGW2_VE4h;%XVf{TgC9LRIg)FLm@dXEh=E2~_U9BMH)yPa+9!U%IlU!yWC zvuK-Y3W8f*oSEVCJ2_(4E*dT_2A&gQj)TKPILJPL75g0SRvH__?7{cw^8}?j@!;7T z`|J!t$N=)Knbp-3kYD4SJ9iErzY;9wViZu47)#6i`*|Q3(8|&Xmt{;;0%E5Cc9wR% zGj{z3oi8w0{Bae{(nw56NqO_8yTGRJogy5yz`(#aUW*{ZY6J#Y2#ggVnE<%yT!a%> z?|bY800l{#DgXc`E`r~FbYN_(4i*jzbF8mBRqSJLL30KdtwZ{+ zAB4qTtDiEgJL;K@p1{o)cVtOHQ(S6K4$Uf#c7cbmA7jCu3FblOV5%s2Xm;Q#3e?qI z&}c6AzCfp&&_a_T8~~M>$p6*cOINNkDZva-4GWD5YS2JSdJBikHs1xF=Wm0dlG3xc z+4~c8bzgKu8rcG5-UE-`pp0GkSKl8n6)3>euK?V}QNworyKq}ahhko!%m&amO19iK z$KWP%?IPT|h{=S~>@Q}wu()zy?t>cbL z?jwxV{E*As@(F^JeQ8#XPv_=WJsBMx#glfb8+WKqo)M1Q{#G?0E}Vk@Is4B?t?Dt_ z$gg=vT|8gu@cu8(<>x!H9g9oo( zzVwEKLQ_-IO#v=3!pKR)z%ctIoEWUbP_eO;)6}PUPW^_X&5ma$?bLd6Y$Iy{nL9aZ z8We~LL)JY;@8!~#-L*+oV`FeLAPmEv_UnpChPGuKtoihj$`$|6C z2|6JC{{1^CWYTBPP*-;Z+q_9sl%t9`T$X@=rls@(k$8`7yK!zmMWLAVp2i+istSwY zonB`ZX_VFY6zF2!U%A=AYp)g?vn1HJJ~ou7*$5g^nxJr!kHWddH>khbOQX? z_TP<}%VFk_%!HmM6_nKk>|@~EaB^}Uu#Wv3SRIV}gr{XkJg1h*Gc6&)vq4ZuXsF4C zB6ynNaji1b)G>ot@y(Sy;x>x)Nmev>*eG6`ugV?NJ&ZI-6V4AB!i@()`^o= z{Ow!b%tRZ9$D!(M5gLYuoDmt5Ygh1a?d|Qi3tMJxEf5F_39&~oc9ab*y<%pA)}b7d zgb1SbzGE;Akcm|%B5>D*1qE1z(91;1%fV-Hak}&l;@#Hpq}52|Pq4s^%G%Z)r z&C?|fS9i`<_+?bUJg4CYqv1gyKF_rfFPaSJ~EjLr?(p3zkd%aR%=j1ZtT4g zBXz>_Gj!fF$#6hc{hfKTcu&78I!r=WDh8!tV4zg}?(-|Un6Rj~eF17oxdaTZ1l6^* zi47~u%NBK-q2<;X!)5XZfjG!qk54#{X2ZmFx)_jXNr2h}3Ux!N|9VTxsb}UkvKY<)zd!auV70=eT{ZUy?fCC!4kovhzvZK}6KvR=A@#ODYuV~ise0Z<#+voH9 zR{V=QUJGh@SVz-&Fa`~cO&ET&T5l<18sYFl62c#j?K+ZZ`R09oJ|rdjHdp31JeU

*P%;}5O+#3@ zKB#TnI|Qd-%d5V!vJx_yH!axv?mNP%?h82s^s$4nHYFC(;Y35yqCxC{*qg&ZdgY9D2d2O!ApABqX- z>hPiT->FmH08gv6q^8!8I^5t^~ zeGtP{Oy0r40nl%I6Hkhv#}x?I8XG59pVGhjQ+?b!YI?pmgLR9R=u<}JcYGAXW2jml zIi1OSkPqx~AvmXf;pYtvOiTo5eyRuB>-2edX)9L48e*OJsj?~~2kS}>K9@%aH$c&H zl&(16@r4pIrh?%zFL(9?){)5P>lY~K^n3^&=N|NZ54~E(bmQab+)!eOB~&bBf#L)1 zx}d(^&?Qa}Oei+R5Ed5pJC`M-dCZy2nJ#2-Fv@f8dvd{nk&5gGG=S8VHV7JEmbwjg2Saf%K$^5EGs?_WVt{wfU9pYUI}x6-yop*II))kBp_rM-wk-*IqQg?N+Zatoxun=rPv z61a^U%)Ul|1XObU(;0xmyw;n}VZ%fa^8lt|1>gdJ2LjfGB_-=YS0pJYDHR9PRFY0` zmL_vcCt?~D?hyO?o_}@U?_oAw`i-*!KDkK^7nkl5bp&O!83hMxe=6z7oxInN&+n&{ zD=DjSeCK)_UHU%uneSnuZvKr(+~yGwApK`?T3~$p1`Uqae%6Azm>0kUetv$~2|PUC zCnqO|hK9iV^!I}T+q6&5-Q8VTxeLNune^{qkTmHyd$tb3Ni$gWQdaK}Slikr$D~Q9 zlRVTFG{|c3vHhTsuJ-iO^E`HuImPAm4ni`J&ay5QGxcnTb*Tl z$c+>gmRdhl--RV|hG|k0^YFzf%Ls+I&xAs@4h}bh@o;h8%r6v+(4Opg)d!=ZXEemT z5(j$D+!n1#AP~r!HoXN*U|YbMbKnU~O{c|a1Lr-{dWL@d$fh$KxEO*CMk&T(?y8q@ z^!(C&uLt&U>1ECM>K$g@rR>)8WYOHZ3eHwBx&^ z?Dp;$tr%N_$Cija?}{^Deap zu6GM3*K+P@JRzvG;6^vI-?nVv7ZNHz3r@-0oJlziyyuH=COoZf>AGF({Os)P5D3VX zzIzwEOTX}i@Sm*$04 z_<}yKpV>L+G3dY2*LxE2YJX2lvbS|K=N5$#YuB?Y#}y<$29(shelfl_z}cy_x@>V0 z;1wsrmh{=VzresIu8sGA-5Ps>iHS@xeBK|*?MBM-^76nMkFWm0$egNgxR$J|U+=WH z3DqS=IM5Q!gl;ECp323H+}vxB@wLSK%hs18Y@)^Kdf@KJr^+1^6?<|K`s>dL_=W*g z784cyvvhQH1Ub#%j~~!kbki-l@}@a^+5=j$@Cz&)p&Io$HWK%XO0R;$(AP@{Qv@)?@6l`BSUU8 z;^{b13)Kg(|etEfHgc@Vbo`5d?LbpP=J}xS*i?#d~~Zl?Nde zye~OA=wcN5qeboFDn;Z6&hbtf%EUj+>2DL{V;d(8mnFQC8W%US;la<6D;2Tx++?F< z<6~#|2TLKLs6vH+mSniER9*HTBC*^LogrQd%1jmQeM(_G#`)5b zEG{%T6NV@}_8jwutR%%tY@a`M_7ITeKat54a`-9iGDmnE7j?WMsLD+?$GY24BH=IR z7Hx6M3&5$KHxjlri)}1vc2-uyU}p=cbI3WVqRR9P2L}f;ST6*Ank&fT<`|1z@qk0u zIN9TzVmcCahuN&`2M=1#}JV$xj?`4XM+!-z_7_Ise+D!WC3 z5J&Qk#KgqR&r(R`Gy;MK5_uRhGBVI-^=^?VD+!UDdMtC-BWV<~;-*)9=y`gwNRiZT z6P`bhYPS_zy;qd-^79v*3(xg98*q>%v$c{WjZ;cv%zZw0Byf+>UPLH{0fqwG9!tBD zerR(R5s(S7qdo}KqQhJqc_bkC)TZGFPhGjGd=f5aJS}F-mdZ58T!TmCeR^-OC0^uU zy{yMV-}Q@)v4}|wOcWg*ePg3enV>XA!xN?Zo$54Xn78Ux#E%i%PMbqnm&?85a?S6SUzW zP8Xx9qN1XN9nav&Mg1Gm(f>jF>fBd<0uqlMAU&tTjt>B(O#K@mSogz@Q+WR1%CO^~ zJL`urKJEjS80069A3q)(8tU1OOiW9|N+3=^Cs{6uKN|fiMzzEq*5abSB-5<0$}wKF zAUff7@t{zV>G2HlqQYyAo00A%7HLf8!VFLqG_?U<=@o};DYWoEbNqI~Dj;+gN)A~BN6&qL=kMq-mOWswK2gv9BRCD?B^c$s zf3I8ZkUD-9$3lP^?H_U@;uj!T0BPw#J7RYZ#9x-6WC}urt*xz%HzV-$Av2v=QmZ|)LGGNLS9r=nP>ABwW)9O!*Ldq zth7VyvBwH{ip!#DsweLMGAkFmJV5*LXKUNna%XihecW(YuGrGb$70%CoqvkdU2W@k zky`&yEQ*UV@4EY9-t^Y|T|dpQ|2m$%zkEG#G_vPn~XxPSMcPpXUm)fJF20sn{mDiWf*oEyvfQ(A8yU1*&D_(V^d7xfh=w>oZpuZ5ALM)!irl>9X^N?0OeQNzF%g?bbh2gZonHwHZ-*!^~Vpd)(ssi)_ z1_}TQ016PI0Bjx&sp+778SL|8$6O=N%Q3zFdl<&X)@3Hx@jgD3G8@+! zPw@WQHQRnipDDa@-C9yHvJG!ZD}E#wZ`;_kBfksGeLlF%u8Z={-cvST3r zbR=5p8j8S5C&x;AO_+5LITKhPA$88-urIlD(!nL4JJ&|C%DfqP)A@l0;kZ=`GI z^InuapPpxRU47hctCR*deO~7C+2b@VLLr_Mf*ldu&u#~owSvV43E%(A;L6&KTidZ_ z(o{a5Xz=AC$EFb6{nb3p}aq;_T`BqgU|+4i1@q@Hawmtfmq+xNDu zSHG+Kw(Tv!Lc)5;UUPmZvwmpY?6r37T`}R(7^sU@JMq>D1Pt>}+4W7CL(uRzLBq}w z2|>dIQyEAv8!MGmGnX78cbySuzNcrNqoQW~RZT_b~Ch7do z;I4xTx==wEGJqfhC|Cx9Hv&+Cv>FlTK*p2-2SXiUSOtQ20Z`=&0V2}?j|w}AqH0)PU50tDAk58f0& zIpW-Vvn1*~fV;&=HxH0@9w3l3ejXrGo(BZ?9H;=O0H^?{K(GpsK2$(Cht|Z^08YKv z>?J_?GKwT|1qkUi;D6wM;D6x%VEzx@W#ke`h$FJ7F=6W5e}}@X066d8@;_xM3qWYM zK^a|808ju>fP)eiY48R#OTvtdv@3@YllDD|Wl8QLz)bsMsWOF>MRdD>Y{lbbD|QY= z$W}}+kD3PWJfi{`;Yfl)#T{+iUKN(z1h)N6+BU^s$+mSGwrxQ$ccm0DHO#FmQAT_zMWUjYQrywB6(WN8 zQi|9>DMhgEht@5=PBBGl`iN!uwGm}vd*#a&7#GdrjQScuCW)#*6)YMbFPgP67-7vg z!DtriWrsyuNKC89TP&71RJ$pKAg(MGP9mI@LBXM~grY#1AH#Dp<&Of=Hm zpPI}$ma&5@ozJ-C)Ilyse)p7QC$wC%XtKJAwP5q0@pwx%4?(`_qK(+PsQUDpjfuQu zv(3m^KWE!$L}QD*jJ(73}mr_eJcBo1_5yyhz=*duB&)8|=QY&L`QZcE($iGb^PtnTz zN_dQ09>i7Gb{US&QI~v~@JJn~G{?%ESb4%u6E}nz@2Cq&z{I~v6DJ9pczEKY_9rJt zt_11~2vg%-buEbt1`vgPO$aVTbRqA0#%?Q@T6k}rA3A>kD?e>3C+38$d|SLv_i&~o zb&1AqXw%52I@0zeQRz;d<bkMQpIH{WH@kJz6{GxstA6GkvO!pV-E0}{f1 zDdr=X9&)9Ka-)HY*tt>;has-UZilUDhv31W$0Vo81nB8l^t5F>0y`zhP8|1;EyeBp zfg#MJI!{X+VtI**F|(5;S7wwWMF~kDXX@2$Feb3Z z>O{uJ#4>u^G!%6bYlKpXrInt2tdyx8*91^eM$- zcB}Hi?@wej5_8G9hBc!e){J(s&EJZ}q_T$j_t$?6{wU_f;D=Xl?XU4;ms1g(>4=e5 zRBAhvQA{&+FobJqVYt!Cj2RMED#%D6Cdi@jl~X7u6yAZmloO&z+7}T-5y2={hbFJ@ zR8ELlzIvE?P53d&34KOOy`0dce?d7RC?|AODPZAJV3>3fZ)X3Bss)B|W0Xg-|6{el zx)|731Rz@Rl(itZ2SE%#3_uJ(3A8SDd1SYypjKhX5=s%oCS`Nvxb zh94yu-aR5Awv=KlT!zz=*8aE*6`7tKjLX>lOi#wn@spsZcfY>@b~++Ebqz>hrxe*q z^}tR(ZHr(PnVozVA){l}W;hGPq|m3&O@A)(8p!FG@KfgK5O6D TKeIZ!e);VG<4I&!M)d#yGyN^+ literal 0 HcmV?d00001 diff --git a/doc/arm/dns-servers.png b/doc/arm/dns-servers.png new file mode 100644 index 0000000000000000000000000000000000000000..14a7bea765ca4a73af33be30d476174a88c6b469 GIT binary patch literal 40019 zcmXtA1z1&Uust9Rl2XzksDL2dNFyjn2}lbFN`th3(xEg;cSs8=-AFe`N_ThX8}55= zfA_n3Ih(WNpINikn)z?w3q{%6Sa-1y2*mBDa#AV?1hOUqfrNvB3_tm{uYU}G+_IN= zs)m7q@o!dX2L2P%Mo!Bf{`~JiS~DTZKp1woD((@U4;MsyKe3MT(gm?E#E2a zHmUOPq2T{_kZAJ0z_N(Z2fbwb9=C=*Gw%8*)80816%}I>lUTm_gv!eCgoNJy{`SU3 z`f6%yN9TCoA6YEkD1j?&>ac2>Jxkn_~5;7F+Tmnax>3&rJmb{$Y&ijqVM&$qdfHl$g=7R?h9(;Jwkd{^y7`Xca zl@5M~Uh|5<=Ywj)++3rN&v}!-B(V?NcEHC|PdX_zo7qNRI3FEv>o$!jO0e%kjGJdd z+83jfQn%?#5f`Sy%cZ@!&9gh2^|HjQ4<7jacS@KjDlfx4^|Ts?s3`9LpV6qSth~0i zCLkanOqG?MetBp<*A_1SzjrZ^UEk3r*U_o)R6c0;Kwna_;PYoj8a4buR3084`tY`9 zx&SHq0WPO1U%0-j;AE?_;Mdw(QBO1pTSrHkX(~?{W3Qc=25(|w{~gzuxVSYMF=vss zYa%i-Gjnrn1T8)WKc%9!wh#k@q=G`QCkcED20A?b84WfT7JM}`-(z?8%Rhgl5Fc}M z-+6e5W*_aMiIWS|N9z0=AJ5IrMMhXnl+&4M!|(a1&&|yVQVH13`8;7gB_f-Vz(5%A z56X@pagcqkt@X&3R%9~8MDZ#u<=uOwtsS4tf{Bl@(2EpHhJ*-{bva|Wb&H0EX51RZ z61$$4m)F$9ede%kZ%90x5jCWefROfJ12`PMBWA|hqW_1*k}0!tYgv^_xv z25*`4!!c%)@yBUrYmDg^0N9%$H>IAw!Y5H$e1Gg_wV1Z^M~@{;-89&w!P8u zD&xuC*JPBz1Jfo;X2(9R^vlo9?Kq;&{Snl0|6ZnH!e}cNJv}{**j{fdp?}k?4gW!F zef^UI2R%J%#1mazDv`9p!lam(07_F25(q@++u?FjJd#REc!-qT+#pIrYlpwXH^*0L zu{*}Jf2#0n7#}|-a2V_hb(aW<8+XLjr;kr) zQ}9q$OiN6AslSRv^cdvj*5>8m%^!*p=J;6>jUlu~rA9bx`6+Q6K0a~vnH3}}=^389 zd)H^Z&+Ui~Z?Q{5wn9-;lPpcsAD2o3&*S2R0P%#8PtJI__HhoON%w7C!=zTVShT%4=cFC3}utxB)#FZb50MLP7c zGZQ{TUKy5F{$d>ZiPh)hqYucj?UFm;ApO)=6znzaMBy4M&hvz}FPQS0;pgvPzg{#*E_JUQ{93=IQ*@IHDXcl=-`cAQ6Nc9v!OJihm}*Yv9Xz&n!**B znVAn(Z>zT|wlXUveYPN?MX#!S!q7?4RfaIgz^5^2rt2F93GpIS?o34Oh|Ej^;}ecWLPA0xGuMJ&z_Stj+mc%!C#n1oYz5gw2d}VQ z6FeNEuEtO+666>;C;Ftd?Mlk!>-YmjogwDbBGuH@1#Dj#Hn$a)_0=jVIA=fTJNHge;ys9TGyW+9P?EZgaVd4XJ*Zg^#Z^KAS&&)sOk6d@ zCW$tRm_ew(bY*qbwpRPW=Zo#0#P@WmNva=>ILPRCH)FXJQ6wh%Qdu+CAaCvMI2YSw zFi;vX82_BKe4%*t>Q#UrU1$qVDA)0(gw?$jU7Ru1_jYy?R)TGoq?1XXb}-Hy`U`(1 zz^hNW4X<8Vq^+&($FE;fUuD$Q)sHvExLo!Y3KjC(q`C(OBb(|S5l;X?KRrp=mRDCF zs;~dJpU=R0HzzyWzgE2P1KVR}MgDhY&w@h~1HNp!6e&D?`c&0^YpJ_(q==s9_KN#4-?4(n6{*%(Ll*@fpQ^iix)vuT@@dlwqasF|BkkT@w#tD?Tka}!_fAD! zI_2KP7Kuk2*aCEP_&ev;NG{#cMT^&Od^A~0b8>#S4s&uEAMmhjA|YZ#UzlSdlOt$z z_ynmAc6SX=$a;48_f1$B?OOwhm6b zH}7>kL2jPXc$u|YXu&;3#;Mv%QUon~(J$*{7M5FKa*T=_MtJYBrS$cuM{bU9vsoAj zgcio@QOt-d;u<(%s@(S0n`u9&Tc7G}oIbK#C}CtP(X`K@{xl6mL#(Xz%=q%?FhlhB zb1`O>=Y3;~cwVsXAH4KcS_yz=S1c3%rc66`KheIsi52HvsJcbJQ+2@A#8~>h$Ytd0 z@TO*v%i(;WlghT$)m=K;81ue!wif3~(9P(h_Fa}2!*Iax<`n0fQw+&c$w^4yvT@-7 zqLKKn0=WL(?L4&Z3DwoY&!2Y_FvzsEw?h)b@hpz}?fKDWY;3F-?``DO^b2u`fGpHB zbmHp5trSd5OkHoaN){o^PZ*Te*4EO}&9?I`CU4$+jgB4~87cdHbGTn!2yk$`P*t^` z`xB^Z-YiZV_KDqR1y|oGQs9p{_v6RK>mtYnoZ;c&4TiI_7(Py6?Z#A8R2mv1YisYA zy6x=jn4ZV|eL#pkkeyPLEKO7HE9GUIXKJO@se1Bur=C>eudLtGMH%Cz)(o_=uU|>x z-hHjb$3&sGdC0;-eCN)<;GmX;5-t94fp)8EB<)0I%6~`ItB6Zd?iboK+KRVyFv3SM z5l;*ZXd`FPX=suav9qP<33fxonWO$IpC9+J!tgPiw0;J*u!@?m620=VFZK zqn&~pv!am!NrfIkazucZg-^dI$3gbY!=pAbQdLGqCe$#-jLywfSVW{>g;wsjt7iP2 zfo%Q{Cme21sevCPi+T1qxY1T4w8ABHNmhb?;u);0C-1xF1287aYb`A=pP!t(Pi%Vp zz&KPc@$1)@9yf=myY&w;kqjjuWVU+?PfOX$N=uj09^Vuan<1XF*eA5#b8`BvSxO## zWz|z)BwQus3PUZilrIX``S+9&>wjXx~A=k!@8?(>uYxf z`h4(_Pwn{~*6uLlb)KG{a%f3iBeV5P<$SD)i@S^KpB{>DBr*})Y#u0;1|+HGJyi8y zq8u!=kH->vO~~(Vtgm-2bkkSxuClFW_`blP3%ly5aXaSU_!Njvo`EN!Ur!~iuTN9Z z5g#7@Y2yLCeJfPaB?n~9y5WHVLiaDfaBy%odK$t!)QONL=cSfP+OQ~HU#P1STeerH zpuFRFhZg5rm6Gx?l>`{l!tyf1mwo~uTC2&7Dfkk!mk~=#O9KNcxI(klngTw_eO37k zZ)yAU+Yldr{NOOAkW)~=c5q#Jl}qh=XdWIH)n@*8w-5Nmq1{I_Di_6Cy92cJH&C2W z(a_Qoxe{#CwnMJk@w(G7|NHVNrDRdtEvb6pE&PFzlsYGdG&xU{!wt!V^S=4X0+|vI z%Mn`wvYr2~B9(sLKj+r)u=gcsJs+t(RPSSY;wnB;CCr@T zrCIm2_Fm2R_oQkCSy?T?&3;>5GnD)cK2NT6?%xSYdH(Uh3muP|mc364_c8%z3~gQB zslg~;Utv1JLsV8wT2fr1FnmN&QBh88W$hmGdsDRKCv-kf&hB|$9+EC6wsmyaO=0?o z@e2v1BYRuTJ52HzQwT)M0B&=Zjr6+~)Q-n!*U!t$^!4MIv*9=9m7&Ea zbNw=)KrmqH#5OcE6i%9$Ca%d%R^cPZm_`u>{A?rohd)%`0|j7Ij}049aD~W)94#y@ z*)%pj*--r*^b!5o+uoj|`VlD(jlA#PkVN6@2(gN?5qjcveEiWi(ZnyUA!1G7#3*B7Uek%ge) zA|oQAqN0ZLwf0YTjYJtsyngt@ZRO@ZESYZM=z1h3CdR?>L$%R(A%gn%r)F~?Nh_*J z@HrY9T3k#F$Hq_9&jvu}?~00t0^eB# z0*^(YyIW0v+Dwn))~5qm;L+aR-t2nSnrdn&h!`QKt*qzqk95jkXll0U`3IA*adL2A zU}B0NSu-gnlmpOo$MY%3%i9fFwbeI|jgcqvAFZQ5xQUH3K>&}bVx!go0tOvj-OkQV zHdfXEskwnn1zjDTxcGQ!DXGyFRYk?E)xqqotu21aM?5?Zla&rGE-r9c%EzyLe*WZo z_6TnkMJ3GNV=}^Hxv1`&x$n)&D1TR5yF5R3aBu*MMTw73%f{xuF2nsqoI}4!^(^FDn zhw_GYSK^kKjbl#Ym#Y9AKx*ctp zj}#Jm3;+0Rx=ep#evX=zyl;(u6(l$7*(Z!tI`BI3)J?wijF zbz;NAAG@C&!0)>_JAXJoV&mq1e|E46d<7PAzU51m&8&pGyU6wwYleQ`+faO@u?Lih zb#!-=&@ibrGEU>JTKDYYQPGTUe2nDw_V(T5JuF*npCPzq}K**w5DBrBxG-Me=i z8X5+(p5H=LJMT75PhUe>+1%U&T~+$y$B(kIWbU_wy;FiH^c-hCYfp%ME@ofk{5?52 zG3osJJdS&HZ?O}eS2mQI?ZJbRI~~kc(&bXJ8vg~cqQu0+WIbJ*2y`)=K~|1& zV4}i4JuNLLI5?DAF;b+Dgoula3keBXA1NXwCYHWyY;0^XS$Wv`js4-nhbYK~r+bSlzuPDa zfBoWq^r)w=4_`!)DRO^rFDNJo?hn2R$P5E3D-Po1bUzyk5J_-%Z?DFS7c1|cSy*iJ zBnq)SdXIn=&JI&#JS6D z_9uVRc^Mnw#LScHCS2M*-G)e z-L0*%($e%gsXZZQRzyL%8yj?#(zjtP4UGaSEOibYXq<>2WZK;7DgM9f? zyqq5ERMpJF;^6R*iqC4IBbo*Bliz-+Drx<_Y)xG{CNBN>~I~Hnw0I86eA&AoZt1p3=c1qM$F@f6%NXPEdFPVRQm?K z%iEH)mr?Bcwfy}2w8d-p?%ku{v-+?**9;Na-QC?^^TY>ijU3hNx!se;MlBgxS@4%a z7rnjxeNYS1($dzGmCY@W5_57^H^zQ$PuC^K#dT!FMn(N?4kjHO7=VHUUoH$H3f|-y z8UP;D5BmxAKo@7VnOjY8e3y}iA;`FV|e z&0PRQHto{y-@j7|JA-76vQ(wR7p>QzV+f^=wY0SMm%7&r?L9rOAtSnD9?#D; z2UCu_Kq!J9k@UyCJUa}IK7vpKAQbs!`=oAkObkDODrgf>P$F(eU7ei@5)x@uEmHLTLqqC%dRHJ|p2ZcnjTReG zQBrnvc7m0sRV}5a_P42tfs0F3QW7c}MI_VnO2^GtPG6w9xVyX8d0vOK&JX?lYc*Y4 z17qVi;lGv?Z#wkx^>x~waz9v62Gn8NWMN_9;pPSyht;ZxUahOG)dL?6>JH>>M@L7# zz8q6zO?7n$l@K_1rFM%Q@N=$EzpQ>UNYa*ha2j{-U`Z<~_Kc5@_w-l+#h|RiloLz0 zZXrM>)c;;kkorQ<48ILQ&(02v5EFBoh=5@1hhYzA1gh3mZ6dZC8@Nu6jIT^L`7X& zdwpTy4mtS)R@Q0=6ZjIYWPbYc%1T!^xApb)={nEkD%&!+CDm-j?#@m(2)TpRK{q#n zX!+*(U8oy%9+$65jN7AGG+I8B56-It*Z?(f7QTYSM0|ue*qo>UcqvhBLFny3Is^D! zTwDMu0~G~C&&pyV4E#HFbA<2`5&w4(5dpW20O_fwMk!#I5f?WOu{m}UMSF12Po8Sv zK!&_3%gw_xyL+-b-^$=A1o)13`!1AH#6y|$i>vu z)Z4dj1Cl~|I=p{xJU2BK2zCHEx<8of@cVo>N13AS!DM)3Bo~x@&e+dUI14jW97gRC z_W*k#N;7*WCRxn5U)k9F$jdXAl=KGq46%Gx-p2st4habf1$lP4H<=7a1^^LWVtsu| znf>(9(GipdFu!X&udn`y8mu7`jmniq># zu?OAcbT>jp8}8H2t^~+~N}jH`xZ%H2OGih?nvN*X{iWydHi7EXbIE0l)3Ctmbtj1k zfe8w1w(~37Mm5qfD7=BbK7iiyo!MK=T-hZhCBS+n>O28wCMG8*hlZjZmiY+--_N() z7N&-(X^yA|9NFC1fX2k)!a|I`GXNfdEGfGl6tjMsZ&6WdceSN+?QeAD`+zh4jz!aixxhJs-7V|a*uZ?ZrC#0LlneLmIprob-?6J4A zLm;j%_CvkBn?UKroI5(s!Apl&t9Do?AuKMlo)#T8@smln9Q`r7)Ey5hg_ibX;&C4Z z+#0womlqe5l$87%SZw<@tRyT9f7q917O2_P)fJ!h6l1uYH`;AZF0P-zqXZoux>In* zet=#bEZp+KLQ10$xUv27aW2S<@2hy6wr}FZRHE!Ee)eqQN(!<)@#92v% zZ0DpH7#N(KoMP0-Z_L~Qypyv-mJ+O2`ugmU;BUI`LhzwtlN^*LudJBK%Ca$;sQ;91Q-Kk zZtzBTJ0}5`sz|4T5Fh`=%a>?~zW)B=vNAqyZehobQK;-dLHa31R*H?X6_c&1-$uUq zmha#-M;z`f#Kd$ySvA)vv4DZ*t*ol5UFT8b@83#O7;xja)M9^;ftF=)a`H522@rE( zbdtbmfzBV5=7Ay+5~?aM=jVNiL69WsUip4i1&AQ5M2R87jS|ppr9ZvOY5NF@u)IIu zJVc^y=S7JkXg>=JR_ahsAmpBk1{|Jwxjk`0$1}x7^zP1*h3Pey3*ij0?D`&T_YvH8 z5s2XCo;aS)rY0kxvtFf&9AHXZtb%~~_3IaK0!VHs5fIqC+}!Y!U%!7tqSH?KArLrd z4A3%y0}2bQ2^1N2cCmMV?}Hf)sMVV+mR!~Q7r-+pAYkYC7*stM!eIQ@+qQ@I-Nv-x z*T8xK60_VDOGHS>2`X&r=!Kr1C`1pe2Td)j9zEtz<@ zp*(m_NkSr%ys9lHXSNu}L!w=#xV4y;he%b)F%=P3p#cH(Ks*HOQQ#0%Vjk5RG;Ih3 z7TrSc9MB6;cfCm>ps@0Ca)2;x6b~Z>V_;(|C@6%IJ$?=34ruXMt-D)M>DCKiTI{-& zAX+}>dll-{j5jnOVd|QCL+S#fZEbB;kdt$EcHS8O9sDJs5{d{m=_5wMz-+}tL7N$b z+t(l6LwOnn`T3u}e6gOYZf~{%)*a9^3xWv}*xSoX^VA1y1E?6(q95c^Umy?=2YS^X zD%KmkkGCfRaq-w$*iaGA;vY9njJq~>MC;&unc;yt;IE^rN+a^_^bne^jEuitHwQsm zJLE2pd|%cs=6#J$$AUhk;mzVT^c$+FW zC4*Z^TwLbmOBEHnA5nM4%ZpP}i;IghD=Mn<^Rseuv$C=-&X03DIzS|!jgLcJRh-ra zXa{V*eftZD&zKmB7pk}Ze-d-tw6}2?AUYQX(RWhcoyu&ECBmuk-YL z@&xfk<{wnOv7e@yD;|>v3yX`f@$q#o`)H@cq4E5?2fo-utB#rv?sP;(MYZ+yed|pg zG~-5Z+=$68+K@M#rKvMtCid z0C8;Z>B%ZG`q=z>abZ#R`ttbC)5teHv0R@0^jnXR)HT#I8JTL`&P#u!q^zuuys11} zMIeAZvauC7tPjIo4bog6u4@<@XVleQgVTXP0Kss8%ErYt&*<*}ZAD<(Dk=jh;@*l$ z!mBGQZATrJYHCqXZR6rzy?K)bROla*t;DNW<4|d#Kd)c=q21x0qLNZsadA6HYh`6< zaOxDlM!g(^423wWb3MdDd~A4a+MDRM*62Gsxx9WF_l?x$aBWh%?3KqQAqmOw&`8;j z(xir$Uu49UU%pyfn%g^DRJa?Bg?NI+1QHT!{1G*>FFvOYXlZ!Iz2FDe0y(9Qii%Jn z7jZ59`ZYW-@NVbs-wCgi4Xugp_#1S-zM|4nx`i+(9)(V5(W~EZHxFrPY5Dof3kwzH z{tg_;;`j($KXB`j5qj0mk4-x6DB{eA!ShT5 zx{d!fkLR_Vb6qYdD3A@Itgx9y_LV69^{d)u)+-@F=k427pwnEOoCt&_tK)8o3A3<> z$>O5c>W`e92S+VmzUOHWkalB6GRJFck>_hQO}(pl^1UEOU}G)rYlPPZ)&GfQjkkU0 z1c1nwNnn(NJOR}GMM8z<9n0}HV%Q7ypW{|kcr9s zfB*L^726$84Iyorcf9f0V)%(%%-EvBy7`Pr+3z*UJ(b17y z(4~sZT-=$;5XEPOH;JB*pb{DRmK!V=2ooS=RL)P|fj@lq7Z0vKWkb4Xy!HIP? zvkw{4qs>RKhJS3CnOoL4Eh{>|cpLJfST9L5p zQQo=pM?UNA5*28^BVf2tAECXG@V=QXte_*3S*fz3V%IDHC>cBoXli<~o*15Bd~#rz z?S^I3LBU13HFw=EU5$*=!@~OLb#?8{*T-JHx|p^x2?aJrrCn-V>x_f|OCdBgRCcc% zm+a=|X)-f2dwP0~x2I(}`CfCxJh;C2X|t*#WNIoNKg?#5nW=1OSeBMfv9=zro!UHH z!1bnE(DUq|2_3J)vuF`&lAwS96{t~-L{bux@zK$Y%uKKpU0hv3#MpWGgM)Ho1%U+z z!j8uFV}4E!)MtjscHjY$E;BxRyYsTJcpy{}9|OLd$+}hLCrmWVw`$m~R^vyGSLYyqzz4eXOL+qLN`~0( z!Kx}m*v5v%0!144`xQ=i_p;hV()q(+(phowx9#nqv|h=yIM2)cWYdnirU;uF7?`WI z)^D7wY79M>^=v z5kc5rUV!aSpFT}&lKVI5R@nK+)c020Bm3l z2YA#Xt}vwK+ahMxmE?Xk*PNd-2ZEunT71x@}v?o6=51QGA zLLT9=zsky#68MWDU0GQ2%1&o1=fOG!)hSyYyliH!ANW~nzwwUyrK`>HmM0e%7~n_L z0G5{k?ZVm{urr$-$Xps8w*U28tInT< zm_%@Vbiwn~>w+IF@sks07eP;HEZ@2Hb+?n9SrGUz4OL%XuNR$UfE+0G3QQmnHK4>D zx2L+JMJqbti6OtgvFj&AMg4KH2A6&J=m=yvD4N<&pT>24lI1h?s$35nW4YMsJh~J4 zdYcCA8Tpnb?t|SSuA^gYwz7;zgFvLWe1811l6QJxGYxb8{4Y){Y|1Kg!5CPoFMzeuDtb38kjXOId&Ryt~wb zykX1zXIk|{cQYzxUyA_;%gcNWJUp;`+q%1Rnj@?U#yf_&hZ3_#VxZwhxd3oBJ+C_S0A*T=T2dk;S z+_JTCmS!9<;|9+YI_{uWfwz#~y{lLIA-0ObS&s83CJ_^K7IN8p<-pw#G3`ls8p#Bg zDh_{)iwFw~`(ZU%2_*&mg5>)8W>&^{SiCZ$*FDri!+-yByDxP`PE8pJVDxQ-fFd=b zr!SP1Qqxd3C(NeRM<7+ApaYEh%*A)QTL zzorM~*uXkCa$Ng9r?&?=+%hR%S^3bx0g567BnbrMQuq9sPHt-L)cD_nL4Uj(`aTcs zrmd}>NjivuY?$m}WxZG%V&N^Z+b6fT-v>z#s(;3&d`hp%?RX2a>J~yKl*;Y$>QYZS z?&Z~q?fdJiUkk?I#3ep@q+MoBI@j>+XL|a);fD{#W@f|x$`FXfa0WiBDT`{`bk^42 z-<_r0EeqOn)uAFFA%FxVB_(;4es{V-4mx-+RyH;Y3JN3y0C^)idM6$^y;(Zh{?bq$ zz)+Mw-UH(jkRRbWIkC~iPEMgO?i<_nEq0RjCc{JnG%PHwtu_v&r10Q5-9|c#0sd6~#6*62`cKEr@s<{uQ##2;tEtaH!Ry`+p_^gV`X^tv zv}>YmW!4)#z4fy#D4h0qzVpdRmkckLiVCK@m%9A+GAiPvaa2dHyTf_9n=VVx&;W858R2(z_$|lRH!yZAO!O;m zRc?vh>BTAF=1m73W`hz1)%!>epG_waNYGuV(nhvJKcy{X27@@dFD543y$EIepGFbA zghWJS#C_uuaLK@EeltA$P`H%qcrg1`mE+=vGj1v6{>#5PCTC~5|0e3}m&5W{0;OQq zY46}*;95++vTVu=RAQ3e!M|ZBK zJ^$+(l9Q9y#0`MQ)SV#kv!X(PjqN#%|6&jClVbVq^@?48fOanEZXlC5|G;0f7%TCW z&%8=cB_JkkWtg5{hUWEHS<%J0Q*?j2lB-+q++{%>JhS7oXTUWwr)!ZASE;qy25MR z!awLj)InP_UuOtLlM4ziwcJr;gT5a~FW=JABTz||S6+Z$(9JO8jw`IK zy^dxP{=J}K|8pcqb%cQ)eh5(qir%|I@X#0|TK>7x^Dh{fbXnPhX20mLu-5r3IVY=Q zwJ`xrJl2P!G8l2t?4kXkp7#=SJi+Rd1ja0%+Cv8r#2^h3h{Wb#c7NZ)L_`Bn8U`=# zNFpKtvW%!GP-Ydsc|0SYl$Mpv*VK65LcVXj_s(eEo0@u{CdW(rl}d^2;o4g6LwIXM zL_a+)jpOG|NY-{#@sk_=`$P=&@5_@rPbkF^hiw}GzpsPspvsPhHC=VzDwwV{T| zDutjRzXvRC2||3yKi4AiRSyo=f9Gk;1IAmuBP1jl)-7%Xqhe`e?1DTIvlWlJ+VSuq znm6l4M=EA3;P#}1&y^#H^Z z*@RLq&HGl++mKPb&{qZ@3c5>l=-^Po6e$An^e0RDOFkVmVy_#UtaYkhs_K4W6fGUCbfDIMDNX=@ zcTrPaNQj~KaLBC5?{aHPrG_1$ptO^zpqH)KZ}tlsBVdYhum)a%I0P#*AUN3c&70hu z99vEu8l-j{|0UTPyG1M*@ai|?b#yGO$$#6-R`Rn1x3V0lW?IVk6_2xDg-O)YHw~OW z2M3_PvqNbZs_=ld@oBv(N!$#z7gkEZsQp0h-GG9Ms->-s-SK(rBg7dI5S4g7>#P^| zo1&s=va*9YE5-LCovf#%e0*qgsP1KE3>WHKTUm+({d`?&F*>s}rveecVX`<66EO1w zoUfiL_vbbT|NHk3M*6@bi;9k3?R}}CVQyv?_4R8@b2D%!I}@o-s-Pwc3qzV;@9*z} zwO9+iFvQ1-=%G|1W)w4ZfE*KjeXlw(fSh8x#o0(^|NHlM20sp1Pp36CT1m_D@p8lP z%_^(bYb%rH!5A7Q=kf|^Utc5yWFZWjbbH>4LHOb~;`K4VFF?hXNJ~dGdkT3wSK~%N zM+Zrdj`&P1M52Wny@Di%5xxI(vFv zUME(?N~Gp%7SrFm2aftCv_o|$m1k(9eMSnjNhv54GF3((hFV(D5ief8%I(U$5Zc(i z$K2Z8yr}Bv7;54XzOkmmms0Ti(8Iz4F#B5q<<7rrm*2&Yr(a$v9|;OhRk?$gd0#}N zM#<%YB%RMr0u=MplM@7@baZ@c+0pOW@Try-`ImgJmpAkfv+@RcNo&Oh1jyOhajIzb!A(P33;I!DY`F`Ba#8#$Erpnh zj*dn`EV1d3z2CfxNJ&p`vb#L{Ue4bzE<+b7iHYLL&JKPnv`PY2SN+z9ciTR9ePd^k zlnAT-2pYtExQOpxiAmSA=e`-gpQiPM+%qMhV$gA*YMMqRV|qeoOiV43f7`j#YVs~2 zAu?k0w{>y~J?hV?S^z*7G8!eONOT4HLan-~iH@LN&ufeVHnyp3C0X4X`Skv0&^WN) zp;byJ%u&k?{M698VZlmr4jch&lHcYdA(R4pppURFbkpZ=!6l&`Z29(WcvRGf{i>++ zqHNQTMcb_r5w$62B41B0cdjlKS@QlIyie*G3R_9h?(gRr8iJmZwruM}$2*`YBBBI( z*tdCpmds6jR1YRy_B^F$VbOm1a#*&5_t2W|U{|0k{f;M0>AAYC4&2t#I!%g~Sa~9k zfDSmAg_IuoA8$X` zC`fy8-`dU|^-y6OC0hPVrR(9v|H{7pVbQHc>EyH{WeKnOQp*e59q}U!dRU}7+-T)= zUdyr9zYK3hrX>1unNkaTB-j@vha4Tb3}*BF9SMbN@$r3YnkttNBasjjJ5H7K-*dHl zp85h<$}^@&Z?CQ6@Tl9Ds1y|OGcyKIn0k7xqr(Zr{0q-cxdeqTT#Xq^uyPC1jSMYC zz!()rWxaZ5btLG*$wZIr-4J6rHfJ}3(2yrC!R=|Bd;9JoVg?%Ot*6AwtxC`-cUtbD z0{wuEgd|jO!>I2NlbYsdAM=ROAi}P;>*U=Zxal~Vcr6Gq&jneOkWdu$e#8Xg`S9esAPtE+vN^_AMuruLsiA=Rws^EQ1QL0GzM1z=85 z&wn_PoW9eTv<>6ATVTP%maCMMPCGkq#(U>ZDa6+evo--(GE)^zO2l0r$2~(+9>rNp znb@R27x*m4_Ga26Q_M%+e`O_z!Xg|T)L_#hq@ph5bbbG4^B;OB&2kPFC#(EN(Iseb ztw95%nnIUW2gZM3@(JNx;X2&qW5R?LjNztbX87Dw0{UX2D4JbXyk-_KlK zE#>2@L?!UL)RB$wNaN^I=q4ZMxoK|EWOv8R2DWCKyb-Ldlz;kEH}o^NPKoi);@xx~ zln&221?V+{-7mz-2Bro-<@=Q%hN&Y(w-BH`iShC44XtlQQ(I|XUCBmAMM0OiQ!j?IWtQ5UPLGg6iwbhY$7u-) zht$>i6*~31yD3Ayr{=8wvZg`Q_w)db4y8Qer8O+&UfcFm6BnPgrgjsAjfKdwX`j1j zF)@{Iwm9X5D&gqdH9-ZA#~2<#N?ljtretfStgG%ILQgL!TwR%q<=tS$rfFbk+1=42 zwhZ&{Oyq@wg99NOljrHxAM$h8Krmh#vRyO#S34hVd<<6L48KoL??vfyywv^1XkOeK zeOmDuWolZ<+wM5vZq0xGz|{O%NH6uju=WK=JQ%)!UfFv%Mp*ZH5^KXO@`d_1>t4^z zWt8$R%s_i_9#!KX@A7;rlyr1kTUhhguV0_#X@I%yONaqWCFhMAOsZe&8f{OS!N$bI z&c*46L%uiPiih+Sv2Lo6?tJn1Dv#F30TfAC^-IT|p6Ztk8~OP)xVXV@y7!Kctibg* zdrO}Dm4uS`H<+!W-)D}kr?)0+yLZ%7jpje;R#|j+=RIVx+}LN82L=UGnS=Fd ze-&FvtHRN8AyJ4y_KSo%KH`OrCK&-G>-|WkXGtFh{+)v$E=0$}RaW~9IGC6;)w$f; zkG7hVqoY-KJ18h3JQ`w=oTGxO9AmzUjM~$pEsXAia)SaVC*ccJH#j*NX8WF}_v4Hd z*iZcQmraLP`=_-fE??*EYXckDy<^zqPXp6vtMPnW*@~Cltrmt!%!;(qiz+c9r{guwpl=-Q5;LX@s0MU;Qv67-!m=l|+?p z20t5`?8-T6wPP&~kbs9fvy#BKJ=VXbMMO+Tv*m8p84V=3X!R(synPU z`ZmYK6&@YYl$0#>BzvB&4P`9%vXxoRbBLK*yIjsS-&p9^>zsWr^y@|%468Ct!1{8O zZ56_!QM_EH@py&mfo*7OI1AuYq?*mCU#s)Oc^B8z^o%!cZf-Xx2jaE4xf#sBnV-HB zX|=V~4{XcMXT<+D+b)j(-hKO4uEXvOzee9(9YbH(?M?an)f@&{kcNVZY5itU$CrB( z2m%ZbfZ$#7d^jnao4cmW><4rBfz$E9Up3rw8Zq0n&Z|pkr>PE}ow?$=QOLa~X$&S6 zfnK1x%f{i8^!`GfPY>IeV94s7g@qcW;KBH|F3L+Y%eT8CPKB*+Xr}6>*H_BrR0n%I z^C~LF{x;H!^6+poy$LUTbnPwo?m{Mb<>{k9nr@;x0Z`BcuS^+NAeQ1k0=YpaW%r<^Y1zY2NogCbw@ zZLJy|OB8gFhmivfjc;`=c2b&}qu|oRxJ6-WE0@KOp1<$6s$I~Xwmo()1Xl7C(!o)l zDtF;Rq|_D`rse0SRa2f?yJ(GtLiCoDK&ig_rPOke={F`30^yqXlH78%{zn4FHU=if zj-X3KJE3c5k-qtR2bf@gi?|QndiSMg463T#0`{&#eTV1Azq1s(yShM#Z_F=loVHxM zebK9YuOlPlHxm8YRZV<_r^5#f_V~Cs=qJsrm=&DvYt`ZBbU{mC9+SODF&hSgtfgdR z{Qa-<^ZyudfQ!#oYBi))A~h3O5_gy4+gtOIk)eJwZXA+z-_~S7yNs+#*T#kRY<3+o zh)RSd_Q7#oz1h9n-pwJW=i4{4ma(Glk(u`{O#>LkNk~bH^77{QslHmm+TXcz2X-wd zf+^m>{g&p7OfW9?zOc){L`TQlZ9OExdq+V75fS#xio(yI8piM{yj0wR-gfZG-VEW) z@-Zvhb9wlVSFcq5`}ZpunO8DPi~Gwt?d{K~+0|r1kE-l4%RF&U_Lq03rU321w*GL% zd-S}h{~D7{O#KCrpS~2UWv>?)Rq6Tp7F{uqVRiwa%+AKa9$Y+J#cHRbni{Hhd&6RfytVB)OyuRRVj~Sql(U;T5XUM<%YPNBb zbF76<5x?+9$}bz{NS}3e<(FD-$E|D0N~Z6%hSo-I|)}0TUHN-LT(}2jA5ImgtN^K&=&-P zK~0TU>(yPL{EYi_*ALFlcsLnRyic!*v6UYe*ZAYb+cOY7UjFdmI%$e`;dj)pUm$GX zP*4cCw8YwNGcmLG^_@V^4BS4jIO}EI#%7^s1rvJp1{@lNy6c6vkwWoy4mT^=N5=;u z_E%MVvXxR%yf%9htL-h`;6Xl54n#;#M}p!r|Hc+vZEt$k6DmV*PfT9vkT!oJhnI5^LqJws6+Gl%_!)3xp}50A0UlompF4?Jn@ zvb3>yz-ANu>6o1za6GQcu-;kLywK2?$xG1{u;0*RrWtW0T>X(UtN8isesGNTU%QTE(FXx35s=@e1k?Hq@1q1 zyC0_aceUIvvE+|M5?z=VLP8WoMf+!G@whlMP%EdOg%0`ME((wu{-=8X4z|(!Xa*xs z&ysJxQLUA(wUc(Tut)XuSnQ!oYHsD(z+$IrLrUmTY)c0)PJxi{> zFz_JJNV}BzZ*x2BrlmI2?Segk;R-N)4m$`Tl`yY$^XKuvjcY6aR-_kgT=DLiqy!$nkBELY1A4_m6C)vnG~2Gi@1Y3+loi^4nJZ4 z7vZW2C!j&#+rQsK7#vPcd8(?oyqRQ*R6#K4!fw%v}7?1{<#kx~*8-FUXa zVd|p%4-A|oRUSRbqLU8>!lmb|rZ$GOt87k7egw2ZYmT9cZwXJFqdokb3KJ7EAO*IH zz23eK;x~rfAKZ5>V?Q-eeqHZ~Xg6-P{3jn2w1S6aSX_E^q%>W<%kQLUIl)h@*@4<- zy!STio-a(zh#8wC3OME${EoJM*}wllhyua!^7-cH&|cW(@?5+0pkuP0nfA#m85lBZ z0o*p_wF`pHPQcllrG5IXYNB&idpkPx97g~C%_vGAl=;@1N%Tx@VKSaCz?t@%EEhYN zo0pgRjZ6N8!Id2#8fqM z8sCzusPdm=s<`(io`X-Ot-61Yd3iaM26}9uxH=eQaA+P&xctF@rk6hp3m(nm*D)oW zVuP(IQog>r_wd)&*W@fMVORtPv7j$uBGb~QobDPwNfF$P=I3v%Q*$$y3%d#2e;A~~ zb`f{?n$P*Hl1lyOPFpY@(I8U>hQ&E0mAhMAR!MLBsIy2JH*j< zh?^&?1+3HfS@qbFkt5J`CyZf<#z!!~|FJbQLV6<2$Az_s0 zMqU8Qj+TcdX^@j2NH{Za?zPprAJ`JeUB%szX+XqVS_ENZ52~tKvawJ$CT~OU?>{(j{pB)MF-X*nAznf`IqSF0s{4&v zOPGB^2?_bN9Hj1F9u-unGA%7VzysSlD@5bvR^e?r`o`hLG$FQ&xa9w#=_|vsT%xsK zQV^96X#@#L>1NYNDbn5D-60{Rq?D9^fI%bO4T6Lq-5{W}bbpKUox>mZrTcn$-g#zb z&D`sbp}H{ls;Z`@&h5#k#6k_w%)S|skjqba^VZuSH4k==@nRB#*mj{8R1XabDgJ{l zFA`#Fx+Ob@9dM1SdP3&rlw{6bRPBLh;GE-s8ke&Y^51Z}SW7|u`=etzygsMCgjHhp z)$n^und*$&_V(jsd=(|Z7yviBNWLy>cBq!q)bwu;ZOkAyHC<7QIbd=P15SUU9G&#z zd_rbTPP@J9ZQTdqRyzgC`1pk4?@+v(jP^~&O@9iFw6*CGbf)G&X+!MngDFH`Fws+tVp~p2IF-F5NY3+=1wS(r){EgRls-4}<8guCV~@ zP_o$M;Lmc&6}E>xN4m`lq|=CgE71H?nfwLxpwyu0E@H29QW|yU=2%4R zq7{x*2_knMpYP1gR#g1qvV0_MKb(AMA2F2G^np2g8bk@xujaj8!kT#`?Eq?Wjx?84zqeX5*M^)P5=drKDsBcJz#y;oZ~G zFr4rXTOacD zBvOfoF!5vM16P$^0|K8RPLGFFn!s;ov zlyz_n$yWLQ8HQf&B+3U~@4eEWK|*|}|MK@oe@e#TFl{z}Wt>c&{?=Q~kF~Y6Q^~9d z1Zc_oYRQ2WcFU-xF*cShNV5|t^#u`~51~!FwAt_9gh}uCx1>UPoU=(QEnO#3D!Ng!R_vntCDGOi^ z0|5k!h~wnbdwy@ua1>|Jm8H*bx2$$uyScjoUvY1M z84v0|1Y#oOPFjuLkh2bdTY;>TfKyQ7YCVwg8a0dpun&g7tzEps8 z|3#VYk>A=)nA0?O)lhbW|9FArTzwTHNIH5g;QTONetT+P{CO;v?^qx*AX2>s1wD1H z_sF=pxt&D6v)BK}rlIyx)_TeE4S|u4QMCJflXs=_kjw9tt$+Y5yh{ro={QwOFghvX*NVMW?4T^n0TSKJ~ozyOs*(Y@7Z5iW>Gv(v^eb?CK4KF@X$Jr`6R1^1@Fz#B0&3?aeZhYwlQCA0V( zpCW?f^PBuH%JcKr?-PC$`6vqvLTKWQb-!J)ZW4KtB%l8hEkP}g`Fb;?4!4&Fh-Z2- z%9nS^g;WuU*A>63JvUDG(?>=?DhWR;XX+;p5TFgp0GV~0QT0^iH@iyri{pkGha(Rv z0t7V;OeD!>u7>|z1Gd>y*SrG5ok5N!bgAzNFbL_~yw9G!?SJuP$p z*)UuaUIhdQ2ncMMhiw@fr+$~l6ESxL3 zcvkXJZtj7*8+6&W1cl0afRk>`{r*e6;AYoHht3{si#j&?;7_TOO+B&Z7c%q$aLP}| zzAkOziVe33Tsd_`4~dkhW0fCI(AD{7^Bhy3RX#sg=^fD%>pZpZ#RSudj0DfpB`~#f z6NsK@R=-Ff(ncR8aSaH}n7Lfj=^029Fdew~jh!j5e&N5tpMBuhGK6RSLt88AWh`Y% zM+chW8>i*5&wcC$hYnx)QG%%}*9QHwlEO4!-VKu&8UAU)nI@~Fm4f%IQ-YC2uhuCC zeBo4{eNJkvF7e`*Bv@`gzDKW2chFeNofvMF$qTJZHFeb$=eWoHDXyM5(G5ZfQ0`a% ztikpKk^ZYncNHRFH1?GmI5#`cfYXDRK-#CG$YkiL8csI(o||@mJNyeOoQCzqwy`(& z1{+A1qJtBD=6(BSi;J7r{nnOrg?6E8lLRHC&~brM$e(n9N4F?fLJo_m1SE0J*sM&%vXGIZI}0h4pa>wqhi&oEmIMs-u(9N9l^LPT+=~w z1PD~ofP{wg!*MI1Ht^Gno9-GGi%IrzayDHYGF@G!r9?)^TXqjqaIW%TA3gD9WInj~ z%-z%8zP@K%!oE9GYUnFOP_Z%5((?YbjInszE0jB^s@JJ9dB4FjhAsg-LN)-BZIX@E z%gE5NISqS79q}haAkfzv^LeJO$Kh-27MBD1#6G=ByD5+^qNAfAa8T1M%)YHJiWfZ~ zU%K~e0{bquC1;wUyn+}JVUpjuRPh&`Y8%3varb04!+_P+S5OB9GY2oyZNnFDIC;&# zb3Ew40pd^U06Ko+2s!#At~4u2$p+dFd&|Io(-I&7jv6=%!q0fT%(tJ;#H!-sVZapv zF)qw*uZL&1&A&!rOw7nC`>LocK~wZt3dEYW)}D(%Y;Ao5I|tA2`r3gt3ZcEKLZ(e# z`+8EG;g@#y=}z-Ox!QJH+xi(9YzB>tBs9CYIL6+0zqH-s^b6? z5arz5TmXP>`)F)c&rUoL5iv2x_9dwbP_NdoDpp5?UNl+RK|Q%L~jg z&UltE6WNW-tHP}L+~kIY>KK=ytOK-{iKAk4p$(H`IkYm0zgf?WU*$j6)~PQlV&URS zOmXH%)xBP>C&EO?#rJLUIV$^{{nH0w+q1rov9bP%(i?!oe)gvrtPf(=-4%VNoWo4`?xrnwy|-)_=A7R z2cwOf<81zzivTU1$wKP;_q<;}Gy>yFAK~P{ocR!O{^`?zZf)FVWRXVk^0`i<)5V2j zKBdUCFJZnyif-`tgJ0t#&USSuk_w+}ZC=mTbzE#|^}aEZ7i|U|5~7UMv39sLFwjJG zO(0ac5V{S4M+uMN7OuO#=yWugdHwgVR@UY)E-hPFn7itW$rj%lF~_hBLAHL4Vq`>H z<6BIWOa%;W-JqgOF(MF{g0vW9>-rNnMS6svZ|t&dtQ6!Q^G{&!3)@q6Diu1#<;T;f;;_r4s*Shq63Z zR-C7*wOiboZ}*vhqH3FF78XCPz5z0Mx6dNAwYR@do8MNW_3QvX54od*A|tcBlTr}_ zX!O@(qgeN_HUEyR^u9u|Y;26EPC@vb{GnxFht5ck3yM_w;Nwsh!1Ui!Hu{}$B2F)B zx=9e=K51n8Wh-T7YHI0M4zcU=8FjS%pH;To{%glCGy>w@NvVOlv!02u^W(>X44&x3 z#5)@sQVjHWMc0P?mfC?YdO1>QxmgG@4tqBjd7m@9QiIs~kUO5LFF=E?)JZE=PY9SQ z0ulK4&%QfR4zlzJGZGS(q9Tx^EYi~#0#4&ZDk4=3v0Ezj;geApYDd0$?&1RtIkUp? z0^}P=t-GF{&qrh!DWik$=wjHTD(oqy+oi#opXbL8yo8P}c13x4U=3mhi9UJqjNQ?5A}=>80vj9KFWg>APmdfyLP~bvPPDXiQRC>L zp#dB?fYtVa$C)8K^@+qlBm@bO&?009GZ1~QaY|GD*X}@CNJ$AreJMZj00%Gnt0F~= z|CvZaeyjqnT9*pY`-G!;UM$#7lqV~KHs>w5l!4dvrMHsOTToJ^n^ThI%vM@T_?&-o zUeOV|f1vr2i%Z~n3K5;@y?gCDbG~WmLW+jjgxQa1Xv*z=eVI5rdp_UzP{*eqTX2Y1+1fYjUWne!tmSQc04wcVWSOhL>LR$AS%rf2izkhy9U7v7!^)3wTF4WWr)>I#?)iJ*kTM6S9u7Fc!emsxgQFZ0}GjHzU zb5%x6YB5<`1DQUylpX43i_7C(kwQT>TA8=VLHMk0E6Wrt&beYk=5C=Go@r?yna>dy zw;?5+*qPU_4De^3S$%VUZgFGa!^nK+b@=9khj`8hYisVCwHsI?;wswfD8egBQR2 z?Tp)pX?(Kv8B2&>oq(KXGMi2GV(pkLBIIqYL}5*=pN5264`)n z75rFnlV(;{M^F%#LJ$1qegAv=0?A3zmj;B&bMSh z$yyp2f!b~3*fz;4B5{v1ZEI!I797#i-@N%vL?qT6xIVu6Ajsro2hqAa{U8(usJ(Um z@ZxY=;Tw(Lx~=xq-^U8Vv$JMQ1XP9#l0C6CW8+m*4DrXUuiE$=kN?hHtd^T*e(CP1 zjl{=AZ5!v<2ZbLRBI1c^kkI{muZKqRG!E7SuMe%mitV+`KJseLrElua(VEGEw)kM| zvo{v8g{8SRyVhP3_KmCr^7t-tgRvCJ?XZ9y6=LH)mGU>5%iqRshjx-3V;?^{wGq}FwDT_*+t3@bZ4Ct(dD zw*s5YFPxB$P%O|vr_$nNycn^#^T+$=&~qq3Jx>K@Y0d74$5Hs6l(;%EvNCB4IvR)u z{HPB@-J)OWId6PHLnL7W2b$uqUlU=s|2LSgckAyn-ecL9A;EIZf!g*|Y_3dG6M7$XK;G;BCFeHSUy< zyQj5uLm7A}{*8uT_1}KpQ81dQY>b<#nlKf~#^0SmZ>Ij&3v-J)VoKsF`!BU7VOONm z+E$DIKQ4fbY^h;YluX{f%{Lq_n=LKGX^f}dqqj1WI8v!!-^^oTJ0A0AD&P1nh-ygA z#m&^r{F+S2gmt;K(BwN}7%1{g`8EBn@#kmH#<7UDrYoe=D#c#T+$ZzcUbv}joSkle zl;}ukf))#QHo?@nSDNT1G<0{1>^^^K_1)S}ib&^MA57hU#A^Tj@DFZzd18T*?Zod4 zuTT;=q7s)HP?#FU5m2>^PuG`JCo4pUQQ}3?K|8!~bl)Fu|Fh10gOBu&^)WH5e8_D- z`SwlJJYQ%Q=X2oa7jmVX`ANXU^jY0@0;Wxq%l6G1 zL&(EP^aB_iTs)vE(9kTc_~y62rCqtsA-L$%9QyHNFMCr&SRBcGqc=(mZG}|O-!ETS zkB{(Jl&_^RBw_L=0LpTD7h24yCz;A4?N#YY`CTR+ApOi2F$ z)7tbfLcr*lI?nVj1%cKDx?sfy_1rv6pZ{PID`zgx*&#{NC#nz-ZfE$w z@##SRBSjXB0!uqn#NTHuQ>b3@^=xC{!q4gYrpN)34Bt=^fGrA9kPFDjTKul{ zLSb%-ggCuPX{-P1lxf=PxU1We)yoPoD9D)N(!ymBLlrb{1R+ZPZc$}1U2MTFbIet5axnRaQwSMV6 zD&RVAVW!2dMV-JSdJc&M|9N=u8lVJR9N$NTj?$WOkj%@*7%c?$4&4blO-fEfd8#+yA^1m@|?g-vcU(wZdc22Gar}IOqCLjH~SgzAe4L|r(#@mG3Js!It z1%-ZG9Z6*PLCorNGb9H4eoEwQHnT?}!E#F8G0;2_aYXVo_pmXU&i9ZmuKhK}=fS8_ zv!tlxi%nAw8@t=~_>Z5{=VFgZairkjlv8J5m%(Lze(0LQt`Og+J5d^Ynu#8DH1VcY zi22=u(XQg8J?$5aXdII#wf+|)qW)4Xt0V|GUn)R%Z*XfHY z6u|;b+&B3Hnha1GKCkp>4^Ck|AF^$0gJXIQE^aa3*zb74>S{C2vm0fas6n`wpQMaA z<1?J2-Rb}SeaFe|UV}@Rav_6=4=Tc2KwygEOF6E`*9ecrPcMWco)Wrwh|WG!!->|w z8Ps&SCzv_^)7SPamg<;U6IiWRFv~25JhsQ*HfTdvrNN;q3M%$P&w39@KaxV3VahSKYxxM7}(M*>HOkCje)ndD`q-dtFK%A zF5ud3ccXX73L}`mp?=zNUJsOE1GB=VVWdyGOeFW?7F&RBrP4IDbjo-}_`lURU+G2|ueoP;X%b zQ=d32?EJ@r{M0aG;RdZ!Vvh=?Ab6(cX3iUqrO<;$AiSiTmmXBrpBKdrh2M0Sg6CC# zW>e12k92=^=Tr7d?V1O!r^}`$8N7Cgp!A87x`z7Xfa`mRevOh&hYiRMm zvS~7E6H|JEmdEJRJ(KQPiH4~ygD#FkzR*)%tf$sX*$EoMj~be{-$5E_(e+v11KFNB zE{o2d&OJwuq=2jI_k7q0IDyT)CEF)GhQ2p;Ufy$GZ!md5LeL*DMkOaD7u3XAF@_qw zXAM=r;FtJ_1Dk9c`?jJDtKGO8i7)QoWGzz={l@i zx^lr!gvzMKerhNh=)fD2C2cM({ULh+n#X6BA=~FiaI)!o&!hLTl{dK0OjJS1-Pz?m zhux$MS$g=$NGkCl+W`fm8G3_ys5f)CC&mnitjdR%DwgXl7su+f-_dhhT^Jbk>v8Pm zxcoqB|1%5=@j@~`fR%YOr-*!G-E+1hM7c1XUFVzc&2_R4rpw#y*Y`c!JJLNgbebIW z`OwgIy1(gE$!lnM#8w`B?}{F}gKknhk3_xGhGOIH4#*==s`kyk8O6uNwLZ;!=!=4% zfXARnUs?8{b?#Tv5sG|&@2AgT`eyUR*4o<2`m?PSz!}Q{6XmX~{QOUOtGD`zBCF1j10lNyY0JotJ|4EEgPG(3HuH53&YXT;CQi9@L|#W z9Q5T(Vise=Ki?ah;NcT?2?kR~;n-6Pn4f`MdggtM#a#dL#>U38Txq~=NB;hOiHC1W zCG2&$XWTWEU4;LFpt$6V{F~@>W0PPCW6m_B^+7bldNmE5@7F>qFVx6+O+qiqO-0@% zd7o-~BPY6URpY8-XpvqO2U9}wPH?t9N$dEt>2wYTL{xNCdvJ(064nd_IS^}1@4KIU z3?}ionM)E^aoa9XYHVQ~;N?3J^d{3E~U{ao5 zx#0^l#86(Tsvm*aDqGCohJfRxWIjyF%#Wpx0+tWH7TwE^h>d(o&bMRi=Ej`mJScXf zNX0kU)fc&`ZDwYE|Lt3m#>SVNoWTyWTFn;s8;UASWMe4=KYsn(8?mq8HRfj@pk&j^!j;?h z{yOnni^~baW^r+QUZ^NyM~7trl87K`IXKP}YiloYR>Xh)^EsLr7j??Y)b;$-dCLgA zIYN5n^ty@fo!&JD2i&ETQKdM5bH1Ws4SM7zS#emy*VMl17C%>O%sLJWnV8DJ?P zA*aT0p_Y^&N=w`4&kGIh1Z2yzzOD-nM-05<#xuNd!^B%zh6S%XnC7~4Xl=FWnQ(ph z=hV1^)1Yy21dpxNf$;Wqp*{&^jMC8Lvzznz#PyZ>(!ezZr{eS|5X5u!uHjc0QMo6( zb6i~9Zz7{?4wkxTSqgEaNABy^EZ1_0O%3nq8GRr~8Rb~a8#1TBMFT^C>^9;45hf%(|@G$}g@`UBE$gCqNER~NB{Exc*m zn43OrnBXmx?79xGw5uQQLC)wOEuZ|LbwauX#0y=8i_5xq3tVt{f5N<}r>A_lyYOl= zY6+RBWuDq>f3rtK_`P~VdvLIl?fAWiyaU!JJ5SNk{oebJO_l@lOiQwTYym;6Df?P&F%$q3A>HY>(`%}4`kJXo@A{*{ z9PZ$N1h1HPgI?vq_FR8g7^bsxbD{E-!(>p(V?XXnUG%MjRFcWooJ`&5V`3dybd&9OfQkz=?HW3!w~=dh~023{}5z zvc^!1&EyV$r^AX2v^go$2aJcoLD1CXk;A-SM%?gL)7xAt(6sO#9}6qfk(6bKk#`(} z`w*CoLhsT@0tw&5bfxw?vKePux}BZLzAmkPxf9LAP<`e6JpbJ#*vVF9V{2>6a&nAU z-t(O7+xGtwRC_`wt&;QOs2%GWf<)Mhf5gI#jf3VRRyYn+CL&^@9b@LFMPp4+9+T_g zrb^UO@_7m#bH3~IW0HH_C9JxlM1<<<8sN-DIa|5jU1clWT{YFp+rVWYuXTkGBFVVT03o< zCu|D1;KaoGi)=X*=l}-{%9HlfoeePFKt?SoWo2RP_1ZW2)GW%D{7w1R5oGx73}+Mt z8m^~T7(RR|;!{_tm4+{H6AUORJss!1d?_*$V}qj3XVSSpT1fcr9jcMc+E>k;k`hOQ z7K@Zm@Jo6yF|{tw;ePr2;)1zK%t80F?+IFRG8PM~t*s3u1AVuQEJJ5E?~{qN#LTPf z>_C{vp;w?8{aYK})1+JT$xbAoW^#s^@yXx&Q~{kmvK%dm7RDST7{QB-eSw$zx6<)> zOLNTsFb-T?yxxq=)wo&`P^O0w4`r@6hxP{q)M6OJH&L6{dDb8(B-`1w@9-?WF%TN& zKF3>3L3J3Rr!{lR;Hiy=DEoPYI*?H3D*J%k>-W!mnI{+su#o0qvd+lLDo!Fi@_c0^ z>fAl!8=s~P-?2D!sZstpXhAldv9U`mbKL%znA!NOuJ$p&3GFVHZncd%Rkgo3O8`_E zHsCcLeh|-j^-78AIlv6`T|Kd*qm_o`xyc`HDqsTa_)yeH0gQ$SB0h<5z4T7bmicvE zi{Ag}ci6GRpDNVdmP9aP(qpmq&CMW3yy(iy%H;rH3b~cj1@%Ua^=9An@5Tt2ojG1{ z6G$g6uk<{i94Nd4aw0vj@s9-O-bg8Fm9dkt&&7JbbWCL>Ub<|Z?z7!_&?(~UvDtI5-$$$KqJZtDvX|}D|yJ$mGH=@CG-l~%&67P#+aZOD<3t1eq;l;M}j0^`cKN6Sq z!NYP>f!*J_hK6D@!!KHOAO!9OK^NZ_^VwQw#GW?wTQXgmbhV9_9fN8T&oF`&`YZx?^*`c%rt_q6RdVQN?9*qCpPgR`@7 zT+2AMpf`3`CnHw=b1Iu*mZn1(D3=uyyli9^<7tT}M^3=0R1ROIH^P zqW;Uv66d9cGkcq3qx6#x9yS~M!nGTep+GGQ-6l-WSDSbK9Oy zT2LLf=4R=U`BwQyoF!BWSOq_fI8aA365EVUvxNJOe*bx%z5JViH>%H$9maSz-+(7S zOSxrrv;XKfU@^$9g=Lx3240$V9m|O9y+H3`W=cF!k9O4gJ1V1#Rqw(-ex#dV64_eJ zHO@P0(L3X3!aQ}_#iW6+gnsMm+)FI?O+w3wgFPxbcf*15?}JKwQu2WnjGhM+?Oh4~ z1qK>Kb>}eF_e?z`R+#=+1_60+FWIB;0Oxf?&_uK}v*OL1(JNa(8J+$#867tqJf1lG zI~wi@Mx%eQJalE)-zCr$!VApzF{E)j1e6bgy8rkN$KjU)|oE z5RTbP``R^7F#Ef1+={fvoXZ;(D|M``;o~?sGb1fZ>(X>KR{Ct~P|A{U+L5p&YZV*( zFeUo_AcJUKvsAZd1*1duEj;sh+oJ&}l4u;n<+q3qxBw$9-XCgj#S{>h4H#dx26tf*|lTXtzvBWoN3A&oSm*Lm>lOGB9)% z`FPjPU4CbYc-Li6z=h?Vx15SB&gyWvX|2{zLFurty$cOo`&*pO$H#~I(;JI z-Y%iqPfQ5zy-T4s=KLb1GP)fgC#(qB-CSRRThV8=CkAtwI!k^pa3)G7KZxCok#Zo| z6&eRKSA3+MZZJ%;2FhC*ION`){6&CJR%9t!sfaj!LUatMr+>fRuT@M^>EF-q| z+c^Wn|ALVKC?dNFSqSP5S1dx%M$F$F%h4q~8gl>Y9NBdTF;8~0O!#a;P-~KMC!UkU zcDx8F2ySwhB#lg#Z2A?;{L$|qHp0&4i{KC@_7Bd0f2*h8xRoENfJh=XOSsN`f-N8w z34xT86D{Cy#>~J#e6fmobN+$n(dG{_gjSPJl~DmL(Jg47E$WY0#MShlp6-Gg=uIw8 zS@@rQ$g@N*a^tcrO19*C4+m{G%S-Owy`2|YxMPr%uxGjlN(W$^f}`18i%NWi2NnO~ z%I4RxJXz-TI668aUEM-U%ag6S^uXjpXv71;L&MH~pS9Qmg!=@9#Tv!(Lxa3reCyc{ z5sPa}&X)sej9aiO&!d78&1=@a*h{Fec^Oht8CTA_jTr!Ux28|>iQaTP*@mRc6Uz{)15o0d)Ai) zKmcIop{0HD)Oj`(^PheL=-!P5>1dgSjE1Snd@tTK3iDxOw|#rXZCK0k@+|$`}XkaMt{CFGg)~H4(h}6Nf#P@05d~6P5wa!~D_}X`+Wi>s2oF6?z zLu1?73ATItaCH~E#q?Ydd# z_s*M#Q`*|I`a&jSpT5>Ou9!eho3)jb{%>V@`M>H0S#%5U2~9cD2E^3WpV8s%I=8So zZ%sZ0N~62dkByIXqDnLcv?jvNCdT5gQc_a#@@SiBvjto&{1b^yU=SfkYEej~0mnBq zv>f7Z5Q~izsO;n-?opezHvmzHVsJ1n;vJX3cXDFk1B)9<06n{Y2oox{^IRc2lsx zI>3yrHTNa%-3`kH*^?P(seWC1i*~0QO9?t!4&xW#pgSJ08_Ph6;k29NXw5??tn6U8w3VAurCNl7| z5!4_j_Feuv;|iu;^Naa@8w86($IhpTcx*AfIy~Pb_~gkX@z+hFi#Cp|&FW}t3eva9 z+3C^Lz0l^4sFrqutx*mXj$zxw7d=%HHjcXahsGbGA=vYhk&>QT-bathRkJyYq44Uq!e9j(I8X>--oN|4dmovC z?cVT6+f%|lJ_MS0*h*M}{y;ty*#G3^<_gcv4Pk!#z!hD#xF|AHqdPOX1$mj!7Xxyx zrN7@KA%;-IXXNobl2OFGcT!gKTw6|US=q?G1;wax`$)(gq}JYExwyWIc7&`L=$PFk zB!XjNltCEEbQuaw1<4Sf6OF%9mHy>^6e+h=r@wzW@-~fC1%s@ z29wGl{flGccurOdz1|sR`%ztGUD7)JUTL42oJvj_jZJvX%Lx2`6RfI_UPrUu+q%k$Af z+Mbxl(;0(UM2}zj$8PK3nsi$`I^w7`G73StgTN)Q{BOi170e#ezLaXCq~`Kl?cE}} zOAc=-_S4N3FHDKSl38dGc65zxYL=*JYBDo2vS?R?o{R{Rv-*TuTaQ3h0!}cpN}KEV z@BcDY(VmtKoYU^?NRde(CLhH@SQ4%#+R$F^6di9{hZ$!!9Ro@$OcYeHi)2<^MC*Dl zZrgL#*ODAp7XC|w(?0E^_y{m=b9z|ZG13T~D2UAboZG&zp~OqLT7Xm8ySTLUin@2^ z&6{J56Qlfb(zjGY^1|&8ZvXuLu3glI*ZIqc_*T12Wc}Mg>u2Tfc?y)&evMTq$V=?Z z0(pV%1y&fH1_w7s8PGpKL4^__XX@na9G{$gt)p?wA*i!g8BG&)akAroajveT;{(2Y zQZo|weqhiP1OrDnSf!0pM6ls5@_*p6c;^8*SX@4@VNgR-DDG;XM+8+F1vk;%!ZTCN z6bLP{-N^uy<6n%{#HzF`9?D9RC>NqI?e&LrG>ekoSmU$sB2|`Iv-nze++2DisGmef zOFgomt;I#m>g!=V{qG(P`E2DKgws~78u%frsdZlP1NRf2`L}-tuQki<(1XGQ9?E}4 z`%P_Anc54T`pU1=-EFXF7j=B)nM{-ivbJa3)zmmJjsIx$W(rO6-S&FzqX2iX^!9zb z{DXt1-D7U*WZt#1k}PvH!KBLM&G1j|0R7hT;I}{rJyX+T0rH>!g-5O(grk;$bHG#z zdvK8l-Ru8Mb{B3mH0YU`qgQN%!z8rpT=LV>v;}LhUsY6aGBCJ`HdY`IWZloC#MKyp z(pE(z&#~Mec)L8{f?9s}E~TrhtGD+V1Px4HoXoh>X!v4Yn1tz7qTcI&){gVvvRY+# z*(i4ah3X4M9?WO!?KoORM$AU+Yv6)n#;LtmX$tu?c7;w8$*fXS)G~2E0VYI18Gh}E zcLnygyK@bEK8G8}-)ZPy!3g!lP*he_fRi?Hj7C-GO`wY+8l*3weh4OJk5Vst2%&_S zh%89=b5T}!R{M7HU?!iDjm7Rz(eXWh7fms<26Oi}WoP3Yn9Hyv;fxr}VuP0PxE%8y z_-3;JIY&8zpJwqh+0xF=JXoRwX6^62vCdK;>2%x~2{a`@zGf@w=|K(d{#T7aS|CNz z0~2yo@?S85;rXe~FT9)o+3I0agQo%wS)8Oxjv6;*O448P+Qq zmP`yMo$XK@e}1#Rz@|bE`cF(uu}MchV>xb|@atn!(zX(jE#Ks+$B*G0tEcstvvzwD z4rt-`9_Gf_-Wcz++C*mvdnnG<8H9c=933JTdw`gqpT8st+}+i5@(^HQV{`DK&s4Td z`ETn3(DjUF#S#C#AV3R>i&KR_3l*y>A#AqQ^%l(+aq;i$@|eEn=GG^wS`Iu09}@6_ zrV@6u@=_xhslKE-4vv$WdGsDy@KD8oK?o{Ruu8_Ye}D*rxC0fHc<2>*XNx`m#%glf z-pyl6DI*Q7A>uOo4~zW}N(9d0odKxg*Mt-vaNQ@Za{cgv5uDnQ@g@2ey5nWvoT?)3 ze}ZV9X|=Y&fiNs$huPYFUam@N_UDoc(N?aV7!fUVv%rJ{!n8zgFv1B^xFBIqB;w8G zix(eaRJZY-wo8f|7}&XS2UA1#%i;nH`0Cozg(`t7(R*GVypKW{%K@S7uY-ewBO@_C zYfcpk6D(=683ZQa7ikAbhbFjaUW}4_}Fm%eQ zvXnJ7HNgh=F?>7@B_$gz?ZM|-Epi@OlME5(+|^MAZS5%t%?%i;s<}d%ME1BN9vW7* z0`@9)78dA;7!MB^`PaLUIASc)hJuV7QJw#k;4Yf$OaB;h$hLnpP5$&0n%M5&VXGa? z5>d!`aVnzkn<>%O5YlSk1`#%qgEtsYkuK+@gIZf#LDRYZdzG%M2R~JZK?Y&BaGMxn z49-izpr{x4s!uW#wA27>Ip6b0!z#$H&mb0>A9I5^$2T3?-ii1NxApID5 zq#7f*;FsrAOPL~Fk%X!imiveIM7tv2JWJyUbn3l!X2UQ2z#N(cN#nutEE8QP1*%8v zaCf(|eAI58zqR%AFJHc#iC{7C3ksf}o&xx1tfKh;WgnpY(8A}3G7k+qpb5@QPlKUB z3>B!oPxo($);gVGVPT-1iKEiyXLz0kl=y$Ky9>}?E++2JiKv+Vi6^ZB$;jZAmTPZ) z8@dGtQIPLaPPGJHc1BJM3QFmA8cyo+OzCJFf92GB=QA02%E22`oTUCC+wem+)h33@ zs+lE~kQWXD=I1*=%>{VEm1$^psLOmq)z$M`0+J3cnECh=_QcF8!JPn2z{|x+m0_Rl08Xg4!1piNJPqGVeB&ng}bP<;gwvA{w zWv#T3Idf~$k=XaGy3B|(O)7n~Z4dAqUjE7cSu9HQ5aT8zq{KdMPR@$5GMv4w4E`{w zx{%?t5c4u#KF~1~bv@UJU@C|&ip4?Qx6UCt0K5G&%cTnQe)RjKV~_@@@j~J3^1o2c zG_P06dD~7-2n585A+7HIQ-)NP+}!1%e=g8~fidF?Ki)B)lPFp%&Tqw6ceG9>8ShV`y7i_&fZo69*`nolkFF9)xjH#X{XoKC4CDy zIrXmV%DMJS7+|!tF+z(foug>|U7rSK@!g zuN5}+`27VRKgAV~gMip)@_3`jP40zp|9Rp_X<=09u=Tg=JU9X_*pDAwQiGkHr~wzj zsgC89^x{~_({-Xs-h%)avLG%#uZvvgPbYB&P6W(XM>FUKfau}ol8>%jwIG_3k z%VrT@0qVA`!16RSA7)aV=jM8D%+5_HK?hk9S z0hA7%Jf~~in-_#~o+2L2NlDteT8Jn(pA&D^D^jxxgmu=3P`681+1jQjB;@Aj^MISX zUG@+Z&CbqH!n4R?*NUGExp{ezyr{LG4N68h9Dpc!vJlo&HoyWzLbP5Gfe0@c_*ml@ zpA#idpWw$988+3wmf!yMH3gDmN2;A9rKCa&3f9<3?W=QgypnbWG>gI-yO;vIi@$~5sY)B((XLAkALz%X6`B7BMdM+TnfCyON zO~QoE75v9VAdA}ay^|KYdJUNw2qQS}PCoLxlMiVCfByUlygsu8VvCOLrt7O$Qo3W0 z;O?Uk@wRJP)ztTu7XLuIdB4sXh9Oy*nH1u7k6K4EX{@xEs>leuj!#JNxxTD>Ax+Qs zor!LiB2-3#kyUB%$5mY1UeS+!Ui)*?Qzv!AD!eMql39m?OHBOk!h&W{q})GA_VA$; z3z!9NZE#~_%gOf4$hBbgBNUadij7=Dlc_3(&@>x{AQT*XtWua9Vvqz1L1WMW214;p zR@UuKBsS2yYmW&Lai%a~=B6Lh) z0YfD&FE4K&w?MeweacFJ?ukQ+nL}bMqpc0vj!iKBZgyL0-*8?jc=!<49``9u6$~6u z{@8A=n-o&m{!s8vR^dWC4mfP<*E$({$;lB5)MYw2{O`coevZ^)rb7Bpp}v>ROR0~I z$vVZm)^+&T(OQ))!s+VVed&)=--CXp+utkY8~frAlB0ARJXk+`3MmFgJL||A4g!Wi z*yZYb5}cV~Rx2vrQ_em+Hyk=B^ZH#27K`46)viP=S~J#w2!QD zW3Lh1jTFLA3X79^6yNvKJ|JH1#v@G@CuT4u0WVW5z(m0JxF{>j0C*7KN&SbLbYyL@ z8!ixJ>T%Y`qwT@SfGEWYc}5gZO|t#W675Rv6&4mo#n*om5GVF7B?X&=n^7X;1Hyp}<1h^;Ljm;>furZ-Bu7VzuY3_%$NS}$0+Z~?A{p0fmA*8vp`L6DLOO=lPw zx^HZ34F5U&)7@RjWI~r}($PdYj5a0~Yrk@A z$|BJpR99m^qQynU#KtC`CRE9hHao$HzsW5wp8GUsls7sl_V4JZi_MtAcvmUH-wbq< zAF@9RK=hfZi3y;NTUQr%^z|{nNhvCTVx{u4Dl_vFDB)7{{}m9jKqSZIB@Sw2v#;l$ zMsFyvby}RBJ3vdpizI-&cMWki9BrCT{=jSDv$YsL4Q734n5(NxHvgQMFOo+Z(PaFusCVZU1?~fH=Q#IK~4W* z17Fa_&5avT_N3n^6ANu2GM5R~^a%hy2v1_-a-zG0$*yaDy+aJ~a^TIrJ5|XrvW5`@ zcL6YeQPj{lHdPtEpy`~ug(az{larF8WdCeEOBb8$fq0zKTa{6~r4%%opm58a^21jj~W2azEL zIEh9_M+5sG1T3mDF^#~{9U+ROAHl^zx-tbSpy0FiT;sz8$-ac9=hYjTUUaupQPz#^jSz6}R#^gVF^ zcRi_e$$Mbqb8Gwtsf`csz0S*=yVh@rsFoXZnyGU=sCU1AuN$&H!GSI5-MfhDPo}p@ zFlhq=gV7Ku1?WKqnH#rGY}dNlB(_V;YUZ4jB!91V01zJjla@Vz4^xGFy>0@ALheNJ7LKYsFHBd?%1BA1 zWnzNu5RzLZb6N53LY5tL-NA|b5A4;LlHv4~NjgLwXwUZd@x!ri; zNy#56iQefY+rG4pWkVRy^a4L`U*Adz8KuywqcpvlxQ`!HgqD)aV9 zZ$D@vz@x!B+_t7)6O#K5APxjV24Ugy^e1myRa{WNmaG=ypVZMF`Qrw5>L7whPfNqK zkKY)E5hbMUhZENNj;5E24{|C&-mDiNz;uBB)pe2Xm60AYDqNL1qw zriMskNUp+32xfUC36qtD7zZ(!Ew&)vBn$cNGFXLhTKaz-oq0IadmF}eQkIg&dMXrI zhEmA(l0-B1?8_WUIE>|Rv{_2g%aFasWXqC9;xt1BS6PZ;oSJNTE7?v$MYfWV3g`CD zUoMwx{MPSsKlgKgC}%gf-Nb_k<}g}(#X9Th2zLTu2=~AJ!hBFwp2YwT*gwf}HJ)uxow3^!S zjK{laPek()3@HIv4wH^4UYA+?oD&+{?xnF&RL%oL>tb_J-0^U;wC&^)M`+JUyDY4H zM$i!q_gkW_Rb-u%4BOc2aF8P^e%KIJAgfm=NCJnWJmOxgU`-~sKBeyl0f4|ii{Sb{ zyiIDz%=K}PD>ZbM$Nn+oqf}GV?BkDy3Bt!fMHiok$7VigEh_swo`1X`lwA%5q&%*C z`Uz8k4@}*LGh^w6g>v|IErl6EI2HMtXzl>8oW>l7*;nbzSkH@(q#a7a*eUH8|F}Fi zQ$VAUf`i$V4Ru~%?~%!5I-TyTRaaYi616>~{7Pl}uD^sx0|Y4Mb>%N{$}B)m!QKx9 zX&=dVdOq?Jr;r}kRbZ%sf%41J9Op;^BwUTLpvdY^)@~E%NINnut~rsgYpFImjws?2wjduC;wq?^`+X}O}R2EVhg@%2RrXPHCsAvCuldu(O-hj@tlnCZ_agTL*fTL2`D z2+XTcT^Hsj2e%#QaX)q-*M>PQ7LHAKyMO1|h*RD#U)vQJAjzbH!ifziCNUuE8RN^4 zo{2kxfCtzZF?wt3>2`K>D)(#u=RfYH&>)-c(nG-NtqG6O9c z*^!vLd-C+C2?@Ky&W7t7{4Y?OSw1Rhkan-7`_!%UPPEgp?}wsFPVLOk&CXr~#M8F7 zjD&KUcWIoBvN?$aAq%(FiN(@mdm8!wy?L+wvCS!Eh7o2W+a+YS!YKlL<0=qWQBhIM zv(;gW{JqgGD*1>`of&FcZB3ExeTc4IG$x{#bYS>{vZ|_OO_+MKm&Qu?8SAJoii^up zS?`h91x_8oO;}P57r0M#|Nax$UP6aSW-1CLos*J^5|x|EKTY{M+~OMb<35l!hm{$S z7DZ+B57#*OtcWsrgLP;8@gSR+teY%K$m&6p?tGpe>+7U>QOMM_3qK?K+a~8zq&Ec1 z4#8l9l#V&%bBXX-SXt(FaU+aYPPY6m_&j)0YGsn);Tt)!nO->yM8AcUoP9mleUt~&Hd56g@jabYL`pub0K*K=q*YgCnn0vh%INFNA`1;lx;^wp(>F1A zYvJ|tEH_OdP`hK6=iLq;zLb&iZJt$ZTHGBQ7l*K4oa!823bS(ct^9O)Cc^XbVwp?? zd?4|~!P(Jqrq5~Vit)RK@Jt3i+5QDKedXeU2X+}tx#|ZGzRrz>`uV}T=<4c> zDE_P+$Wbd3G z955dJwai(dYbOz&#lMk22LLDkF;K-xF&+!APHwM7^_QTH!zqwJ3GI9 zHE)U0%*5m-dimih#maJRzM(7`7&I%;a)j&a&#S5?MfC|104hRhwE>8lqen%;Nl|Yf z%`#LB8|uT^MlpEVLl4l3}5U4InT?`i6$$e-r|cO%sWY|NlM7NJ+`2Y%rACys-sz8SIFm zxUe6s3*46b=HmBpwBi5L8wnp?Y|Uk!ui2YM*|4$B0lm=1nB`|$mS$#DjK`a#_VzwF zSG{YRfH)X|SPOY9LhB7OSS)<4E^ds7u&|Z2HMrvb#z3MBxw(WrDl$1@p8Bf}HT7Ql zmUKpATf0r_m6&Y0gEQqDr)(S-pM3=bGpw&557a|Kf&b~P{$Dt3l2|j%o*l~+*b{98 zT4-%;j?s6%BVa<>dU~R*`Eu3i2*3Aoa7aIUmTYwXXbRbz?*q}fTF(}f~*_oL@^|^X_zH#1OcLYBgV?`a#jI$>6#h|Cv&8H6?c!HHHf;NT~ni- z3wjGrSXda-BWAq@XmendL11mYINX{@h}+LE=xL&Yo=2gE(uvC6ljONQ%mLQ{YbA4{?=slwDN_Fven B78(Em literal 0 HcmV?d00001 diff --git a/doc/arm/dns-tree.dia b/doc/arm/dns-tree.dia new file mode 100644 index 0000000000000000000000000000000000000000..052e7ee766171dba109f7d99e1e4c5aca5f1e65c GIT binary patch literal 3019 zcmV;+3pDf}iwFP!000023+-K7Z{xTXexF}qcwSl{!|;AtZ)UOEMYj(NOwpY_2ePd= z>dICiE6Jn}{p}?wXC}7gI5tJa${Yi8i6irqXrAvJ@_an}@ux5Id~lbR%dA*j3<<)+ zLAsa}(`+%j823SNVt8FuH$R-8-{0S({9&0? zMTzq47A@2B|0Q{zoZE}ehacY!22UH9CRO6zTfLi9Rhf-%t8}nP=IO<7oJ{_lmBsC1 zI;^i+T{kK6q8!{M`Ni=4m46M-SIwNSwew8dH_0p=mud3n?xwMQ8FNh2H)*-q?EI!! zX7-Zm;b!ZS9qqWkpIo!LYH2T8%s#&VnZK`ZY4ygpwwi8qCrC9<%2~G9#<6{q*BwET zrj**w5JnrUxFU~zayZ<$Te!SixUyTgY}ctF zb=mp8Uf;a#r5#hhwc)HiM4mjP<*NB#zPaha>I+^m&LEjo+1=w$Px_=7|0kVPtB3t9 zE#|33oeVw<{+X6n?l*tS%1Le;_!f^02if#u_zACf+~%X&hAk&<_1sPIb$D?^&ZH$_ zvDqElWU>ojJl<@-wD+7WW_kLEfrSN8N{k3c@{B0Njs>(`lMMHa`)M|*j%z*5)A{A3 zC>Pt|NPB(eK|F75_uE&_!iWp} zd3JMoU6k2>i$#^>&pzBnNOLfZWyUI-!~& zRL7)$iLkC=m>5~=cRw&BSdTqGc+b7a2_TBsUNoi?XbJ2)bpjy}-~_-49P0#Vs1qQ> z2Igl5Q5w+&I1p+aJis58I;TlFwGQBO`lV{1eHotk6`sDdiktVXQK%ki#IR?5d@NyBt}FJi z{>C-CzC|w(Ub}8XON?y8JJiI_Nbq)zOgrwIz})+Tt7M+#5B8pt#d0|C)@dgfc)0rP zKhpdzbwm2YFGW6mYMh7P$Cd+VBxb!n4Zu7MbbT1UcqkqNwJuM5Ax$3xl;qiLF;APn z)g4^=oN}{Ce0Z2`-1%GDP3x=^R#L&4NQ|gU5^55Yl^#(j9T9@0AACmkft8AK2CUQ# zD>V*9V5O5|rGsY6x&^5O)g1`t91i=cn6v)~)_=)d3!MkcrZ8!SNi$5ELmhz$b_5(5 zb;gm1s+qGO)Pis|BGQE;0;xVr<^uZ+$REfb$REi6`L&7P?RWNs@$utUnc#hr1~Kkc z3q0zIspL#ahr<+RBZD}$q-kSjCXSU$Pm0CjGF?plvmE+_P3v_kaOaD)oypDSeKc)% zK8Udw)61kRi~HTCdbC#ivFXb^UCf?mX%Pys*AKi9!F}s?Y*`~%ZgKGAZwA-aY~0e0 zwUVmvLZZR9-!^eu!)M9rvt<3VWP5k@#tpS(*rXSRt)1i**M_Z~1WGC`m^W-G^+_1E zsZ%rodR8#(w`kbxl?n2+Cjw? zF0guQuf)PlhK#C1Ce{npClFId>Z+!}2*lJ!Vv;SS(uFzWu0&YeT)IVJh?@~nh;R!? z`@l(MQB;G!puYk$b;L|fqY;>?-?~o{u1pt5Ghf0sE=vgqaOP92BPtPdOA6}vOzTO= zeuBFW%H=}2ToC?%@F&;}gzNt`!s^V0C zfnf1JWxn#CwsCDlCty)r$wY1A<`Ly}#YAl9rTz5*!Tkm<09*jL0B`}p zCDVg915k`4_u;IJIT5fh!gv@WM$`q*ej-46JP`=*Iq(AD1;7h{7YOzOqzx~id_Wu7 z2}tTuoC`2@@kG*Z4-nLA-~hk@fCB&r5bOZLk4{oH7`IGjSk!cYLRdP!)M7+5VtyAP z>2*#xwBMk5F1P@20pJ3T(kxQeLLOLhM3pC|qmOgwmYDtoV(NyNng=5=Q@^Fu zRJ5R;pftXQ&cYD&sG*~-h+^+Gbm2V*E2l7RhG{cQn~y5UM1!~bQQ}Sj^D?&B^Jb;B zJJvyC=8|TNbMFg`j9x^s`57DMZ8A&{4HcPAwIUNGA$1h>>(pDLswd`6?PSLKZ)e`d zV6TgkzV?o*HW0m*;!Ew@T^FWv0{ecG_D%6C*|+YCeY;5kXU@Kr@heQ65noY}(C8Hv zUu@nCF+qGyMa-e5B3SrS3m30bRgs!D@>+hKMDf`1`D!)BWws=vzGRR#y*L>X7LdEk zY;6rjSU>JzW{b75-=eN7rfF=gZH+_y!hs_0|E3qItpv)Kb(Pv`9*w|FedH$6MncQ) z%hDunKC4Ed#OJdV_XE&KIJXw4Y0qE;Vmf7F+Ob~4Xn2kMTA9P5hD;U(8^+EAV%Qit zA_8HK-Py^^U>Q5z()f%!&K~5_-J}wdozQa4vP#M-)`HEG#^Wv7JOz2xMH{hmVRiqS zjfuQuv&+a?D~H?|L?fSZqp+O{33nPD^A>KDOTbu*r>2WDZq^^LvB)5%O1nE$S{ShJ zw`kwIhxQ$;>2)W>DL4M3mTjjtYBbvWaEX<(a9;axYA}hNQf+#~MiaMJxxXY8VBl}j zz-bQ+T(q!($0rt%y8@|z3~~FO9g9X+)Zk!z{uaGk@wNc z+mb#;E)_zgQzIxJs7t<5K2m3R#B?Q{SbxL@BbSH}W_+kFBmpCTlSWQ@XyoAnNbZkN zj$9bj84#w%2kTlAmkeO4E)Zdah^}vLdd6lemskICTnbV*C)~xDQIH$pqM`D|Xs39)X>D$W9!$AeG{F z^1v-$(8!zr9gb6&Q!!$8407e>B3cnbPM@HDP4je?xX}0A&$pG^##}vor+mdp{W6RR ztTF3AKh-osfvJJfY>A zmsR@Uj|VdviMixl!&*@bYeg-E5#eQbeKjA9Xw<_uJc{vpYqvM8-W4hstiC|JuxBVj zw9v=dO?XvUf3gijGHUk6gHR;&$Oft8ap!Cw)?NMpR_ctEwnrk6QXfevye6zWcb6j( zx7eZsVMuT>vNIQE@wDtiob<0xpFRU6b+fS2Fb;u|UX_ySpY!A)EkC}if3SaMWitQx N?*BCwQa=9T000eW<{SV3 literal 0 HcmV?d00001 diff --git a/doc/arm/dns-tree.png b/doc/arm/dns-tree.png new file mode 100644 index 0000000000000000000000000000000000000000..c76ae1bbf7ab1eb310c36dd60dc812b4f1f8d901 GIT binary patch literal 40307 zcmYIv2RK*#8}~6nHYJ;~N4BylnMH&Uk(s?RvL(qT$zCDK%HEsoJ(4}Lv-jq`J^%N; z-g7-&(eoSUyYBn5PJr@LSv+hCYy?5@F7M&&#}<3rhoq&^PgeEG@B3AK_q=|WgCo4Iv$He24nB{_ z(ZI;)!&+(s``r_oQHo#P-FVN4Qb10=wE>2dcpDoR8OO)0J)%iP@D zgZ?%~_Sf%@dlMn=&hpGIUIk~opr=nu`qS_8wT{FRPf`Q-pBD)-SypdqRP1W_tx3=m z#{pC7l~f(ho|pHcMpG7b%kn352aAKsuUL3^(r%J3)|%B{6$_MVIGZvVo;|%iO*fB| z9Dj8MxucmK+*zJ_&q*p(y@}|U9&YNFc9H?1XUY0ZT z+utjz&*P7H#e^W7$!4XR+#kp*t$E6Wd}ik7KTH@Dt2Qs(rl6o$jy7x!O&4LB$ViRV zImM^QoMFRLdG@SfJ3nEWyZBCkdajrN8LVG;ua=@BUV(!Bn>U2J!|m+>KOeSOzj81# zQNoE^yp^Vig^SxZRpT~GD;r9Mf|OTQ{#&`a8n{HO+vacC6AogZ^KD#DAY9>m#`6Jl zkIv_H+^yHJ+xt(A+R&dEa$J{~7}H<2M@;E&BA;Ml)g?(tNZPp6m6Y;QQ{T%gunBnZ zaF=5q*Y@WS_D9@|&?fW3@8f{kYbA`ae7H|R*f4sVf0d?km}X1~>yQ53$BjJvDk)1= zO#J~hjcBjv#wH#H`Rab!7%50IXBn}a*R-*PsY4qAi9XL3(qy4lv<9YQkall$<~*IHP0BNI$&+c1n8(je!em;|jyHdzG=(=vV(baQFF zxIZ#83#`Kiyu&>nqeUR9^TNV6KR>Hx#dDYwtXK*9*zQS&fuXb9@++-OuV1^U%ZBID zbKuu7eQ)|PiC)1zDyG;z&-?H+0x^%lYi8{%+=;mle_ST+_5JN9iQE__Ju#4z!*boK zb;jYJwv|ccB~Q>6!ObmO5k5ycYoAuyB~0u!*Xxlo@cJ(rNK0R<4xNfK_GG80M>~$) zpRjy~qhv%9CQ52{U5rB^HI)ZFC@wB8Je(+DfjpK7>KyD|6K#y96H=?c6TK zc=+8GUEhD+uv|MG#t z5EDhEaB_UDDYppjqZsc&%*i~?{Ux_5T&xyCIkE4%0SUR)UeqDnwcAVtR7np5}@V;-DNJ-xG7 zH8nLsA)%Gk)h2EY2a3?7@Q6Chi4$To@tY1Ucn+UD0H zp?8@eCLt-=k@Xlm==8OM!K&Gss!R>pLeM{<+lL-^G!-zfUb-2Ab*Qy9-yX4CeO1r> z?Jy1rQo@K{ORbNJF))1CxKDqz509F@DL)dXl2~P(#hy+uPI9)^@XE<={w+h)B!KY{$%m=~8e`;37hsJ8Wrfm3{Ig zh~ydu0^dA1JbZ9)uwila3QbrvG@s`$b##;xg_|GBl9EP${dzm8(+9fYDD>&O;c;;t zv8ZTBg1Cn;BcpHGj^3G2c}2w?l7tm?+zpFQmDqw*q4L&l-dBA#cq%hDSEtrpNPu2b zOUv_k$5&%V4-37RvtibDLe2Wu49QhXT&Bjv^!xdf(^_Wv-@iAuwlk5UWT@U5F-FG5 zjCp}=I1>YZarFr)ubO_%1Ez?g!oqS|W)YEi1txn5{ErVFER{W~hnG<)`04BIy$=f` zh?XJypul9PI+cf$vn%$|lF`J??K-=&&{<8vCL|QA@koD*+~GbQ zzgWa)zMcI3kYMO5&9k=44S-GD9Q(*ADGw=(!sFvDEG=`O4^P#n#Y-m2=*6tla6C|I zcO#)Ze;MbOYGb$Q{mX$2Lx#)!{3KH2(eL5m9dj03Pf0$UG`<@=VS>hLk75lwIy>zI zsm3lkySjeO+VXc#Oib+U?*sbizvzX^0-Jm>g$26!vgIL_59h|P zu@SO%Qq31H+NDB_U%#f)S;nqU9a#=t4#TRUn2{g7``?_Q21xz=t$coZxb$0@>m)FBBC+G(>bAIv=EJ zpuK+mdP3qqFjsS%ld~r~gXrXTR^$eE3cFPv` z81jope`Ob;%gRnoMXhLy$fEymM_i+!P}eam-4>C)f^GI|mzg>RqK)=b;H`UYE*Z27| z@jT<$<2j705p(-IP9Mmv>mUcjH#s?3O@Ze_kpClrOnNFhDvHi4&BXTN!5p^~Wzd=Y z7vF1 z;n%z@BKhc1f9S6y9;{_WYANZIN6e^bXes+QC@4A@uxUMlgP#>&TmAZIs^2e@$dHJ7 zq75&{Kjeb{6TuCSaBb%oHz@#tXH-?4j+I#KE_VB9QwvgAH@v^b%F3FQl=S)Y=fc9m ziL*Wt0BL_!rettd_FRYVE!#xYkr^7cXGl>Ukqp~ak6|A$&r{mMDhLK`&AL^t7XF=sl2#!upObiUSp0!e--wk8r%N%T&rPA zu=iu*KR`FSJg{tl+{T3QsvM9>3COiLS18nMz0gmLG} zzE@R=h>3Z?ZuWm1BVaRCV)3VsZMHRx7T)PB3KSqS^M$6S9A8_1nk))}hKcWfxIx{W z3rh{3tE8j^y$^o)wJn#T%%qfriwHU_6Vi`nWoMIe>Ee1#?Jo6tU0#TtY;;C*B_GCV4Yo;ukmS1LOW`D@7SsJK3XQliC0)Q0gjg>!eDvHQ>sIGp?`$7HOHY|Wd}<103HZfjiGmQSy`>ac=o9N0rK#{z%#IZ%G1!;h>Fb2%+yzpLdjA8 z`SN=DJ#KCmF0SupeUp=kQBfaDneg!NfOl3^RtkQ?M)T2u@9^$la(MgJ#K;JM;hh`j z2}1TNs;ccqZ+ctGtS5oDc#muN5zsP)%ZZH>21qRvyeu{)G8umcY}dfR039{u$B!R> zTA=Pg6}^VY$;nYkcqaTDv6-qKEi}e?GvoTpp9ppy>_4iukKPT!|MiJST3T996NP=h zz4O5@gA!jE0?ZE<<7-kpzZvn3I;t*?Z&_JmBO`4EmgA*XXh>J0NOWY&be&gOS(#s< zVl1z3xFrV%2jH=fm>`h+{rlJA&rc2(mKjYsT-?PgjUr761};0!$i~J7TgN2zjrCOZ zb)P?Q8a>?IV~+mP(bJFbNJOQhk(J zzO1dSH3yN>UzY-aModghR?=EOLw41XwurHPfwh}iTH?MfvK5?I8!gJyt$FeHOm_tAI(Z( zFebaZiGWh)llLCUwY#+h#C@U>J7+Zik>IS7i)S3IN5AIA< zR8-vksJ>wkCwZRhIpazT@O>cS!-HPzL6PV6Kkk!x#~>aIiqzhYuySXDFX z!z87oeoaiAZA?~CVZGaC_PLtW`#*AWCMq4-|K2}4-K+y$$jyfwI;eyYLOP-wXS!%-6ZVlwxW`DcH7_NBM?N8s;8mBdw)pP#l>ZKc=-He z--mYP!}S|Ii6Vc7hg%95$h>a;cc!ReCq_mZo0|uguZZl zdS6feHM6mScVQrRbt;QDJKlO+oV@_q!>`HihI#+*-wUg&I899Y(u%{Up72F|DUYC^ z_|QIswJft5R|hy+z)j|bb@g?6G8PuAqeUj+kE-B6;N#=x%$Gi}-~KDju&oEZRXfXc zeXIl&PP~xC#n<eAD|-E4*w;q`%lX|B9IHc{>#c#PtSH` zfD!-m2=J;VDKfx7`uh576gQNTM7^t|0s;co#N+t%FbIu}jgx*=@n!vJ7vA6B2W-R5 zhgECDn4-TwCK3?nkyZHa4O5KY=edrJNjYdR?5k;LF^OXt!VLxrQhtizix7 zoz%`9tdIBEp23&qwHWC>i*VGfaV@c%lUYthmrzwMq`4Wmtqo^CSb`LenalG#llBuD-c61^54Ix62jIW?s9Q? zLB)Z>We>uqp`o@mWw;znyYk9oIk~;nKS~M;mH^EFOi*#_)dMcQ$It(1QWaO+es!3` zXq==wRXXVBtGXU97ea38gVl#j5jZ$FogE#3DkMBkhJdIH44{5Thyy<4R5kzlCH3Dm zzpwyX2QKKJ;s(F`>n<*Cp!w{UKYCSE<)9VWrAw5?Y;%9 zFN9KHcxdRV4~sh6!r}3!?m~fHZPJ?*5*P?tE-J#p%4#)|uMY=Yj+4ETFyL2laWS;W zI@nxr3ou21>DJfRsgy(nsh+-k`BGioss0@bDEUxuW4QGjfrRr+4*$W*#cy&CkW|#r z_>=x58q`$a#8AqB47u!UH_vTD8Hb%vSy@?HS_PFb*JfL`{5=ROgblLsG)FNdHK=SY?Gpb!r9pwOn%$K_^;*bi%)*(T@eU>e}C;V z>*s1}?q^2@+1WwXe5l^Hhx3v@eE0xJ@Jnzo05||~@T+E>=TWkQlarI9W4Qb`Ff~FC z4gixzMcp!xl_d@MWvU5h{Mt2NySbK?fB#&ao#h@sF64A^b8~ZdcUM;K0}P0A1!UOO zb4Ch{J0&j9ni`hgEkfN~9nST6NC^KQwi^F#iC12ZZjJDrJNj!Q1yHIU(vhP3CMQor z1A$YSEauh{lKATbv?p2FR@i4j0Rb+qt{YP|luSDFWNeYHhZ~bHd9SLRa;vH+5pL7I z+f?{}pkU3l62!Ftq}w?^Wyht-$;ryf`uQ^_mG^ZcdSp1gklS8#TwEiw5*s^P?eI`F zD+hGbbyJ&7Q=9K*Oq`rQQ&V}(1{l1&ysQ6MjBX{Y#^lGB<`f7L`53mr8noZ>v9X&Z zBmjPVsEih4Kn2r0JO;ENN5qRVFghyav^D}G0|xB4I=tVnIyN>2IH4y=>`96;OdmZR zo!)?S=pEt!U0vO1PM!DtVawXQyu2M*Sz2RbCwwMPlZ8~jh;b(NKs&CS_f z2CuHHSdA7oPfWa2Q~Tnk4}7r7da@Fr4+^55t3^UaCJ2kl*$Toi4?jOcM0+&XtNQ{1 zOS*DNSN-nElTP5@U!tQAR~SxVsO%gH=EKD~e662oIpdYAiE#pg-0^f2gN`X;@% zNN(N~^SY=hAgTy$npJ!Lyfv6y_4)Jtf4|w02X&t3U&obYW&N1LGL%`M!h_Ty;dw^J zYa|Dq_syqRNG0M%UWLevLI%DTE6 zGc#Mu{q)E?IBWqonDxYNa(cJMZcf+Pn3~2!Mm8J26zp}`nQt#P8w5pbs@f&(+qa=V zVV%9bZ*6Uzk9Qbp!lr@Fmz4?VoQ5edRaI5JDz{C!W&9;OD|@v!VWrSR1h-(Ny=-g@ zr=URI&aMyR^X9bIm6e&h&iyc6{CQ*~P*;MDiHCXZ0FO&8fz);0x?30yK>qa6F|>kz zzq3Jh^mFe)M{Tg3s%Gqr>gMAm&at!%PmU&~B(f7>&yH8X0G#gZtc8W#rlU*!{{8LV z@-ubyJq2JB;&At%X9x=m!&$yXO#B`WEzR4vZ=sMdGNv~+N^S`JJ9!WK3?ma0@Ig?p zwr1@Zh}*}<$6H(dr07`L+5LQd8@@1pf(-{)cWGha&ZY4+>E`yz$|)3-yA;oLbaVs; z2Mp-xgObG1BsnIe?Jg(9oc8;BjdSZN9Yt z&IXiSfLG+Tp!~*-jqNHbP~EpA%+a%a$Ur>!Q#T|i_%1ugH3aw+2mieiJKLDA>Ce?P zmzU;tMI~s3LlFcU8yhGdl&0DG4!GH(vNEr;BOZLeqN1YR!$Vo#QTtwKpXxc9ci7lm zFE2dcc6ISOwSl>CyY8712kh;wsOq{HyDb2l0+@Y#d<=|WYHF&tm+Q`*hAh&v!T*;9 z7#{~(PjSC~cH5QjH5CCi1-I>OlQ0%mw!omkj%ugeqM{qf*Q^wME0eNcjgl&l15Ipv zR0FYb&_b!%op;c!mr;?HFj~0sGBa5<8$J*!_?@!?HUOKTxwSPyj=@>lu8nXo{YjaN z^O;spVBWoZ+e^K#o+^9@CG~Ca$+fi7(9|Y4+q^)56A=~|7~p@jH;YzH$HrFaurdIK z)2&FtScQYbLkZg%BwUV4+}&AIbL9Os9OomMt0L$4ZwLqupGnUZuJohdr6M2*11GgR zLFk4|;TC4OtQ$y&p`rLx8<)%-Uj%*b#T(8T&evtI;{ z=(nOGJ~2kd`*eTzvo#Rp*|TT#s;U;4nB4(4UeJQ^k}T{gI(z0aU;pmsPiqH<;*TF? zdZU2t0D9d30i=Sq>BbMWtn~D&omf&_3{LZ?a3Kc^5YeTzH85FpRa6=muE zK2zv(n~vAKE9R}uv{P{z0kr+;aC#YuqM6+UXq)A2Z5A3o2}Ohvg#HUuo3$t{t&S~+ zYfa?PWvnUhi+Uar)`B*+yT9-F<_&R<8Y;v`>X@bI`n$StUvHrya-D60mF4gsmO7i$ z@yWsy0|y5ccTopQd==&V!V(>QLq7kY{JD7?(zBYH6nhN6CPip`?bojlK$TvaJG=({0d!l|=^u`+v;4IfP8oe<6~=i?(>b+t8ma;>=d2(FiMf?gMct)PR* zvt~9gF2XvRi>ZsAea|eg`<}fDO6@Fe=Fgv=3muW5AmeCpdV8v_6+tl*UG1 zpNNEHVQFb;eO-|*9NK78QdF`pz; zCh9yyIN8_^8_?Jy1Dj?u{;j+iAE)ez|0CO8ruqG6>F{Lp!pdB$Z4yX>?!dB@zBeW# zaQfH*c2&U%KR9qg-ueIdF_)pJ?X*T%tZdmgIvN`uM?p#c;$(*rc>tBUAyv8*A3x3` z{~9V%ev|fcbGB*A`ED=;h^`Vq#YdiX+>)!ufdpZm|Iwo z-qloAQ$t5?6JoJjS&9P~KMV6L&oLgP?4@bdJ&W?AXp(BW$ zo!uPc6U(*rR;;nG!>sZV{oh#`o6{%=Ix1k=U8utENdl7fgx8||6qv?GMqXAs6L}g` zo}756qy!J=OSToAoq?IT7K|$xq}Vr5XlJWwYTn_uFyEP)DyChgUhU$;O!$$N_0F>+ z)eHp}pj^GzfYUqymNV^jsiUbWxTS%EEp6-IfQy5p4c#GJRM^%%E)BCb#THBTzo>10fRN;qi841ZRwn_{M45dW*dr z1F-{TEgL5W0%Y&5W^r4~lqcP*r~ObOk`4~TaIdd0MF59%!9-UW>d$0hw=XR^J=>;7 z9=v=h%Eo36=eF9_z}>yNq@<+0{0P*~3WaV?%_}IHk^(K@s;Pr19ojlt>9`7Yk>w^f zoGS~Xo3@L%CbNZa3k&hrrp|Lq)nC4JFRD7#l9jz6D^C{pR1owMKW_AmT6~Sv>q$39 z-oGC;JUoF;Whbv{IOj?kAI+tUAX3uOh6V=CN7rs?0bs!~w6db6r6oY>Z(yw^BtoCY z(xQtxQrE_r{D`-|kG%87#*WI?&>kH-(1{_(lkQDgA1z(ClD_8sAm9GY*xJTa-YbcD zYc)Clx-f!@Y!F|;&;m)$miF`lpq|-a#`)29n$l{_R!Ev`7;r5OS=lAvR#eVgS9ryK zu?vI_1erfQBnSu{{%buuFgEaJZKi>pluIRZ=(?8H6!X&`yV=fo1!;39zq6r?+340` zaNiqBm4>RQ^-|;eT#Q?pwUwO%gQF8FlJPXr6}azoRXz@!EO{`NgM)+hwjF`fr*Z01 zHCD}+db9>LHpcj4F?bv~b8t|)xurD+9hc%LG7u|KOVCi?8lIfY%}AN`_=`UI=rxEM z!%x5|{_@|vsj8@4$#R~i_V&A=tAHj8J}G!rLeaXWAi$7`x$c1~0<#Md!I6KIw{Df{ zH(@OM4)SsPD=5rIs#Orstc_O`oeVNRd)AMqT`Fij)s@YnuHM$$859&Og+J4@c_68( zy0_zR1HK6+J9~L2J1eUTP#KU0cVFRNyj#hC6*gJ*wh8;nyp8v3JyDED=Xl2TN$wlv zpS)HnsV_H4P!Ld(7UN?^M#e36|D+$>mGJ5Z+ZDv*FQk0(1up6 zjLKy2t4ijRXig~Kzx(@L_Ljpx4duUsi z*VuWgQl*zivzv1fWYmf&$}%D3_CwQN)ls)>Xd4m$Z z0te?{&Az|igH%TIXg=V3mB`DS5h3A$qrhV%KngH1$9-O6&M}xvAfoxDWyxKK#XXKC zCF-wV+XlVuis1pxy;?Dr3HPcLrc_tE0~i2t40%T~JdEj^scE1Tm?Rby5?mb{h0*C6 zlE~dK+|c0MPJBVD+uqx`J5hT+cX|loWoW#BNL6Lws=>~|PGE>XtP$ue;NI~=tg*n* z$*C0LT#=8vA;D@@tEWE$8VBf~0|Nt)DS7k}SAT#P#2$z?8S#>bwb~qR*)E@=w@T4% z7uR{InVJg3=A>r1{_0h_T@nuz2lig|_O1rEc^8?5n;W2Y0D(uWAHkD`$%lZkiV9eB z$K4&}Fs48CfByVwYJyZnpnqTz7XGa<;#a^wVqy1v^s75txt{>Vb8cpr)(`D%tiO9f66G z8W`679!5os7UrStzASNC-y)(vVrmL0=6_2{`bLA4CQJef&gPe68Yt`tNLsz^?I;Kf zE{(eo{iE=eI1S|?un+FsKQOSod-wBcUE;fY78k^yid{enn4FaGI%5H1(%)@W6ND4p z`W6hyuEp-`<1=!E8$dnS=e*?kMMd_|kbrUp-QswxsCe#+A73O5<`{VG0J%YG8!jp) z@s$LX#eHiA1$m(Oh@Mp}@p3c-h?u0$`<_H$Xz%wxa%{T1$Zl->;t+&1d$jUyAX31WED?(oF4jTUwXXZtrGdaP<{`XejL+|$z&@Sw}S!yWXv7m$VkNn7$2GjRY&WDxs6 z-ZkI4b(tj0cpC);`C6URWj|gTEiDZM)L@}Q=kySVo8Wx)^XKv(KlZ-dqzlJF$TBlZ zUDvgW7CO^U#8GR5q_irWx3jN=O`vtv_Di9JJ_mq`1tJR>2kq~-SgA8j*j~uKYrZXbC^eO z1k)H;ZLQZOC`=QF8zdizXD5x`sF^OCd3n)=3u->wt}iewx<+9=wRe8H@axxyWmD79 zC!K9~UzBzM22bByC0m;)T+n(0LJ*kSHq*5vmaaq_4GuA%Q~(lKjTHl+h1?7A4Zfy6 zFi`xkHw$Q?M9%ty?>8doa%aURsn?-JRjg@xw%%f*KeyO2s?Jbtbq_LEiDa&1|UdB zM~4(0k!lzCDHVBw^FQ6)6B-ok z{y82;b#9fMOmlp+JAv=J62~{-&1W9&NMzQJACLkZBYlo_1XkCF@V|czpa}BD-UY!z zoK-$Q3NH>eMZxSW)Q!ttD?#golA80>^e5LA?n^n_F7;d_iqv@?({Xav8n=etTm5tB z*q9Rc&)g6VjV|23b&gB7y4-S<7kOZ4I0ud=WGaA8x*x2KijzEWhGZcHkOmi*WAMZ- zj+c_*ug`J}&v*)c;E=lGQ_1yo-7J20=`ESUAR~KvdQ^OQ#G^M;U*ktW$@QY~hn<1L z9-X~CIeBbtR90a%)$o+%Tl~?=dCAJo{6|(vp~l_ia5z^DTl(qK4akSo zS#uI7_+6)lwDpsyyDJ+TQJ+4wId456Ber#LbTm%?4$b+dm>Y&?(%S-%eE1!+zDlEU zbazkb>as?2q97NsqQ^h#BxtL7KAlunN`L&QI9)eqTMlY!58Qu$sx(k8Fh&53UZy?P z`<9Ur7aQB&*(o3(pqi<6UB3NGPR{byR!~7fp19}DVh0Dkg49JQltxCzV)#@uVQRS? z92yay|E8vj*Lo2kgwdZgEv;(-{0_zNcx;Sj=zBHN#HA7$JCn$D+0-+P@ z)mEG?Pu09LZ2g<}GF(sSV%O!NcZlybhhvZ+&(060MV-;kAh9SZ_4sihP&!}9@QCQT z^Z5Y1+|$pgsWJZkfS*9GLh6?b3{%FHBSRWs zWTdxsJjje7G-16xz(?ImA21NzhQ1GZ2ir!)TDv(LW8*;~`&u;(G~`WCQ0%7A^;?T1 z_egtUwrjJ@PjX(&Zf~DOuLF(We)bGjMK5-^?jwE)2oSaABx$`x%cDgk85#Ds?qXpR zn0WALoShwKr9Wxc(aE9GAeH=}?svXJl)UyiDG74NPg9gJ@F^SwBwi_F2P-g{e9QO= z)GM}NyJUXe8rwK2{F&vOH;!Z-*%ltt8GS9i9zjwK z42S{(Y&)Qy(E1KI4u1zb1f&mTmYYP+o*@s8MvKHT@gG2j_?@r!hp2|YKodH8w4Nkt zZd<*c^V6W$y-x+bXxI$dB2P*(Fpw=+36V=Np?ca2^=G5@%YEmKl3cX3&+$S48Zw7c z^CgJ7l*Lna8Azjva@(FRcF)O%=3m@Yv|9gG%>UkBPFp)3c%6rbSnpJQa(A+^pP2I& zpt4cO%z@K1?Q-(vQWm07Ku_eiw*&h7{l{%%BYy+gKB?>z(dNI;Pc>B~usa65=x6N( zk%R=JIFrbatQ@M$3>o`yIR-6`7dw^Tq$DL#U!zvJ?z62P|L}AKM??g2+C4o_Aw}`a z;!h47V(@1qriQf3G$(q9?uOvu$sTShDaoTqu$y;uw6C0tmW%z}tQ*{zyfH(=3|OqQ z9VE=k_(VJ$o&T@?eVQ!#9Row{Ai4So*Gqnv#*x zGBM%4x7?qYm-+a&Vb@bvLf#bzcQsr584+f5 zIq!%B{S4BkKyw!s7Y_oKt1*h2(B<9SsxmTOgX;ueZ0>Y_`lhDgqoxYg?~4kFmA^-i zUwGCgR9E{H*{eV8S@FlZVCP2a!)x61V>v6o>C~7TfK3w)o|65qUM{*j4{s0a!}DMQ zvF_shH)H7oUsVfM+R!31ZQFC^6kuY)b}g=Y3(j=A(aslERnN`bYY=dNr^Kl61>Vj| zG7+Hzhduie=mxFekXp#V-1_N_Gzed9wDyRrCPRz0E_k!>J16HTTO;Ha7Y1Sk6@-`X z(PikEmUg1073Ih=aa>%y8;v+FgcFYnYPhMNUXmQsJH(WhI>8YINbR-#*S1!wB&ybZ zrNA+JcD|k2!vieI=d}0!_0?TYaj}dPyxrtRNyK-FN=}aYypx`hv6NeBGkt$_ysE04 z-{aC+&(!&RW71e%{Y?JT*p2ca-NW_q$RJV_1PXR|~X5jXqe!WYU{h zQfxBI3bAkK1dk3Pn0u_PdEdOT&BmSGg*e38diZlvc0e+*d73DQe_)_6W8dBAI^nuH z{G$AP$OU2|=;)YA26cio+O@;hyh6Jt`@f$=$8o)MzQ-D%z|^Z#zU8hmP%>V|p^>*} ze~+I3CU*09XVBwxI({mgh=PKG|Cl7y-GQOZ%rfg2pv%0} zKa&(*>t6j++8JdvnV+&$MkJZ861FzZ{J~AyhlHeAN_t#N%XP~2ndWkVBfIvX@7o9U zQou>;hjX=Q#aw^!v0id}+EXtsExldnAc44C#9*Uz(8#*yX-h~}$76LZPa8|z>)3H= z*;S5B9{~&-FU+qASiZA&F(dvByrEK>V@pT2B!Wv1PsJx(b*O= z+jGG;pUas4%baT+rQqA>h@9TuUR;bNpy4ii(xF=e7L=Tlymu1%JqU_m`hobKlRUd=;aOb55hG4LOga8{qtFGsa`}LdH>9s#MEI^NO-2Ven$=>9; zp&|Fo%wrXu$&tQyNf23H_+v96XudXL#`hXabmjE0MJC#DRqvMJ;@LeT{~s|iJ8j`? zSy_W7J^ah-44&)JT)TUFatxn=yfIp^zxKXe3=dr8;#-)TtEj0lgvxjoi^MZHfa#OjYeP0Q0g1bSsWighRI&0KBma}#;>btUmZ1Ee*H#^nR&+{3(0Fi z_R2lCUE`qJ>N#0^m!>~ce}|?y6E*CzDBuw zB`}9pxw+?NRpMz8yU#@m4^1nIquutU?S^D=3>ay)%;$N(qO&N zA&{Ql6+gS}T&7b+rStNLo@BluQRMtr^HqWjGW!ejQ1oXLl#li@Ya*XBhmWkn#LfPw zs~g=}2&SMKt%7gCMr=Va6|!I4Qg+sb3}x+Kcv@j|lK>GUCvM!hPv$FW=jhPY(}j+- zb+n5~pa1B1{A7-f9*k_?Nd4#c_`wp0*3`rb8_#Fv#K$kQp7>f(Zrh*gAsdEI#V>c8 zjt7O6QZ5>R`qOv;rQ~}-8bMU@Vi6=brooxtG**>2Wj7y1wQ{=MC$;<>SvdLvPmGh-smAy%N zNC-E3erp)bzM399r$hhycRBz#I%4}z@9_BnRV^k6U1w!2Xm1a`Nrvcs{<#sAD1w5( z@!; zp!dDW$@dLE=C8Z;_bD77NzdG1A8qY;Ofca0n!%{JY=m}8r& z?vEENDE{{0yTQ)qC)?XR!HPGS_yz98a%k4uyJ*fn1we4To3QVpt6b0G^vtvV-OTP1 z3IbN_<;5x2_knY}Gi%|l#>T5eBz(cfzvoV;i%SdZmo`R!#sjhI(q!w@G$6I&=HfQZ z&ax$FtM`jb<&>FKy!LN5rOey9;i2-X@*G}1H+e3;vIoxR|4802$boSf8~J?E2b1}| zk8DxI<9}~nXZZgxg|H=8Sxk3N&&Q<)2|7A%8KM{nr2NT+g&p`Z`BHLA9Am?Yf@GzR z6rLL|pb!vPS8kfzxd|+^VOhUP=JIZH^i5Jf&w!Txme+gv`ruH<1`m()Y`UrMoFpH9K&yk+w>^cLDR|U0G?%mhsVduvV*DG)u+QYr)_l0er9Lm zc!WPrHxH(v4*&GY>G0?8xO<-^SG>}mJh8Xevypv{g)aF>N9SGHVJiVG)CK#m^v@(! z28J8%oNmw2dwP0h|Hv2d2fW*0*oq*)UBkn}tD_5TzACdsMMWX+>Yl5CWHx9umv8>u zUiF5F50?NBkz~_Q`*0Kose#hxzjG@YNwe>cPfj4{L!Oe85E;?*ZB$=Li8G=R&av2d zDNm&v6Wvv0M1g5=(!Fsx;GL4r79m*F?#FMCchI3ICnrY!jSoz$8Ci_)oxAmFFBluc zhxI3lCqB5nCDSLK2Dt(Gr%&adJsSo1ChjRU75eSV&?kKem{ZpC)zP6;ttm>qvxOBJy7=ak&d;B;({%zdVj}$a zqvZLpeNj7|-^d$FOG7^n+`~_Tv`b=0@XIQL=BsDJ5`>D(2AMW!58ZZ8m-FHA33z&F zZu_VWhjiqh98-i2HMN=giuRO3daD-kkvfOHUI|6!Pve(1g*7=)ceR z{qb8(gLY@j*?E(un-^Nlv*#~fJbw|J7|sJT7E~n?VQa+nftg`Bly-V_)a>K+F$$89MrfG-+s@oN7$sSK-km{OMQuY2OLkA!Hmf&kN67O%*EX$PGBA*mk|vra z#<<~mgZj0(Ikq7Yc{l2(?=CK#!6El#LxV$t-OrZ${oZZ@fJ`~O4&LiMnXvoXwG(Ya z4j=^GaCA_+$A6VOR(YINonu)Ma6PSC(|hLa-j8(n5wV~ExlTgo3A<8Xru5s2N>}UY zo)gZtPEsz1d-pm!J4QVEzyt{=lXg1YiGYCW+s!Ey1eF|f(C=KKsF9H?C{R$lwM!=- zLAGXk63?rgU=X~nBix+39jYuhOAD*{{FpeeU;q1+h?kWUA0ecnny^PV(a;!oTzz0; zzQ(?(UH}@U!bV_FP?ei2Dgw_r#U>~BX8T=4o#6}LWnh3uuCNipF8&$EptQ7HU$AG0 zBFg6htwCHTcxVW`0MNQff9gD`b363ZpDo(i8Bj_d*ql@)6OCEgv2Q62p=|0+GG-S{ zl4JO(Q$V*nR#F=gC`6-OmZ4kQWu13GD{=Q~ElmV(koY#u{##uYE64I&Rc$jWjE|>8 z^u~h8g;g`S%|G@Gb>XRDGp=`#;0tSMX-7ZTV9v;(+1aN~$-zaiWJq2uzAK#CvCEex znF|3&>EN5Zvc&pyi3Oy}b1Ljt?vLAV>E)RRZ$t^1>}56n`T0u1XjvJuDX|7!4Re}I z{QNf&LJEq&mv*Zh4yco4A)v(;6xiiWzVKFH0y&==;dUA0SG2OKwEAamfyb=W^H|Bm zPJuXJ9`qRC_Wh)Gf(Z%LXP>61BG2wHiHiC(5T)vl7P#1l+)hZ11*^?iVwd*=Oak{k z@75Ym1Cl%O&4B4}bw8dHNVur$gshFM3po?&ws*8Yyx15eu4p#R4ikvi zM-T);5qZtVPi3VL1RQzW|HIQ;M^*KG;oh4D=`ImLN@=8#7EwVI>F!Wkx&-ME5K*K< zq@=r%4(U!wDQTti&hPJi?;XRxbPUfv`|Q2en)7*{&rBIvw)8>uD`^GL3*^h|W;qIr&fO?T6k5DKhVw3FnT2Bw z{Uaf!C=)Qtxe3#dx>1cmo4_OD#;xpJoT#IJrZv}fe%V))0;7vh6Li2~Kl`A2Y>b@x z9upI~`wK(Ew2~5D3zN$7@}~Pz?D+*N)TUHACa=0@4|@Y9!6=XthqGQYH`IaIf7oyj z5gxju_o2g{ychlWSzOnalOM{Bx+Uk{FRD_%%81*nue*Cq4vycUli4QV^4|9#Hf@F41AV5 z@R248SJ%}|hePEIx06|yaYo-W8i*G@*d@^Y9(AiPFFmd`6N?-_{Lc$%Wrvh#Vq^he z0y3JD+EhfQik;xm85-B*N-U{_bQKSKa7-S1#s~w7goN%5=n~U49as`1jlsGXidk46RQDi<=;;x3=q(($M>F+*q(qG+~9ePAUg5WvqYyTXl|CJii5*| ze$ZWN`*p?Ef^BBDY9`~}CH(B!iQEzih+_gAta_hfV+93-u#hBiPm25P9*l-`n2v4I zU>Mcf)zr|y(&J66v^5)DE&m}YRLXE+X;s%LJb{+f7|+hRdc&8~jmqG7@yEF=zw+zB z=TxM(uIkek+@(=wDNR3hAu04SG$UKV`+M6UtU6Q{xwH)sB6~~i;Uo-?m%y@)L==PX zEWeyy+#K(D3OnPy+7Fj|{SwBff5sl%9j!^P`b|?G$ok#2|Kij-(|u-l8~PC;50|dy z?zLUL!yY;#r+h-SBnbU(Y;>ir=to-xpOf263K^EC;B?^ za~y4>_vO#uh427F#rU6_G?t@8yVNwGlrKi~9k{08xC7A$h1jh#cU`jd*bV>5%!!vj zoZ^ivLG2|*iVHjS=~5xX8;~m-$MM6`@a>yaXFT)1B|cVCyQz-D8gUFcImc1aIKq7G zI`wC={)xm;k6)Ypb4vd9jcJzL|1&Y~Aa*o?Nisy8Kx0OlJhE_jpVTX$BO|#(81b9O zyVC+5lf?^7QinqsQ*hz`-jz_@lp^h(y8rZ<=kT}uq?=4H@V)6mHD!G}4UH7sFnAx; z)kHpiD7)Z9F<0WsjVyr6$_uwWs|VuXcge!OeKQ^CqI?AX?$Aiq-*FA{QEw!%2}|^< zB0rbfzb7Ilf3}pInBdH%`=j4sMMsn3>3eUqgR~-Ug5b^db>W_jZ=65yWy;x9uI+9k zq?I-^AYl9g>lceo{_gkhZf<;JHcy(UZ+cVqAM)$1>u*ib(Phm#n$oyYQD7ho`5&SA15%`b@?v)X^uF?dHXVLDII#P~b9Q^XTlw`qd>!p5W2P{q7+eC{yEg%7-+C z^(Biy@j70h-`A%xJvv)Iq5AcLRrKzY=PG5NGrTuP78hmRD5+XR|C1{B_s3UPZ(fKI z&`TCJE0blycFUyq>!LF%>Xvvdgcu1Po#+u4(*;E?4;oI%M1_Z=A>jHpT~e`qZT(BTl`PJch)ojKQ#u+U#WdrVyQ7#Z(*Fbc;h zkF!an-8cK0oc(<24CBeur?6dU+ebHy^vuvAFH}_iL8vei>-3VSm_R{(#i!J?ugH6~ zHy&*45O|H*I9hc}iKRJZ;ExacW@hRpKxS7Us$gYR8!7)kozngA)75OvXp*k3;WPoD z4fI3XD6*B3QIXy_5fxR%_rDtJ8tU;x5-ON8zZK#*{Cz9peo9M7U#MRf+kOO{KwHVT z*5z&v1~>{$gE)%5;}&nI^ye{w4;C_FF!LmQ^xm-(egd@zx8(9RY?jX!}+0% zctZOAB=N*2qusEM?UJ(IYH(|wQB|8IqM+2!RjYVA0+P{b$~EQPySbUMvCj>DG}>>| zV0jvfzmtvwYYw>TXQPfhZ&T4x(9l3)Ed{*%1~k;v$$+{090^5Xs)RQxvSpD@^6|m) zO{XnBB}=8Tt)sujRyRxn{&Sxd++(>FmD(QO@&_HYInaUFm13&FN0K1;9OOI~7r|r3 z5)8%EB7S4^44E(a3t(m)%jbw?aky#QcXl{o`-|i)2BtE#2p^MRFf^!IMQkA?>H_6R@Bl!NKX?rt2LcV@-9TDEYyL=aey)JuEp)lsWi-B67h z%I-f8T1r7d!+O29R6eM^Q)*D!6TRG7qtQ^d+Pm0+nfi)*Sz~TzabQo?t0=4 zzu&)KW?&G#JQFxo+5VPO-8S-X1>%gn37t+?;c0`+ zD`FU#afjPZzr;fT1NWW3QERZtN35nW;9sF${TLPCzhZL;;7leX*T9Z#(@=f+SJIt? z)P#ad3l)KuEqSKf0`N&T|NO~$`I4Z&KaRsv)JR76*ED!EQ>Y#nJR<# z5q(!D`$Kse?Bj*Zs_azU^>0t#WM!JUJ;siBr1QgOrX^DW#jtICh$Z9EXULWaJFX^9 z6zx|M`@ASK)Y6)|&)B!z9vvhBdE}@JuKC|sKu@fL{6#kdhG^430DdKm#STldY zq;o630Qc`-r?bQGYM1R@xo}NqXJk-XTND-x-sMgoc6P_o3h&U31zv}5i9whN#?|is z%62%ikA7!b6|{J_hgrGq z{-sjgIN1CW8=os_8d6+vb|=xxODQn;x4^34H;B;AJiL?xc@Z_$s!`5&pVpUq5-hvl9{ z+-Zf@dRDR;7!?g}Kd_R|G3beaB*Z1AL`;7A+UP@v?fR+~>6A&7tAd=GihWJ?lr z!gx#KeY>%lg#{WiFQ8ZJ;X!E7$X``{VIr0FEx+DmAZ0l{-MC!H*7g;3VqA6eOk&51 z(-WrQQnft&w>W%S6KOv@2IFWO^=265l0#x-NJvgzUd9VH zKSjx}FLQ(a{YvM47%Xk%W)=2(*RjTQLp3tGF|qrzK!>ob)Lh`7yqsp^=UA?*^WEe` zq5D+taVRK|!3rHAMEK2ul%+k--1vT2NNbxkCMI8LskI>Oh9piDxZcp3e5L&ZJSa-i z_FA#vnj^R739T#Pp#>|h&f~k+MOhhl1HTB+3UL`U)JAq+ShR=b?AbGDE2@%_kwJ(9 z6*=cg_{i265=;nmD^!Hj#-`ci&b`mI#@o}d6ZE?7z6lHK*K16=+&4MujC%gYaT)MC zhX=*Q8sBCcygmN};B<$EKK=O5|WstELU!!9DE zdUPqtwi%rCVZ^q6JIfWE%(~l=Tof=ll8@HWq zGcOY=((@!BT;ZAJr52|_NO1B4?$Wfi24`kxqct&ES@miNf=Hi{WQ6u1=iT|m>HN>1 zk0R)39nX)@adFKrM>cg?v%&MK!uIL1&h?zMqL#!UYkC^B$;!y3U&7-cq}lMpW2Ssn zleXy8l@)MvZE6(e7k)2Ikq}=U=hQb%i$AP5>}zOl|K(j4MTl%omfy{}d^T2keQt-G zT%6tyZ*Q5QctGqw(RFKT7UWzB1=jXHOHymgcV96ki4T# z&#&ve#e&errZH74dT&QR2JdH!RfP!f!jK%74VjCx+YHgMANg!r0swFWW#2A7_8u!JX&h{-Ew<|Z1up?c|G)=T$Rh`Nohlt7D`EbbH(Y&lBEI=6mwD2!14vd zFZKo*^e{1ekF@%fb#&@1IwLV0SH13X3Eq^rfQMBj>-pN{a_{PKYjwPcMSqHHFq`V1 z=*#otux~1U!Uw~n=)MqttH*C9<=ry^`!g029hy&?#GNYX7*6xBqf>|qH#|kZ27|nh z<(a6*SvhbY+$`5S#`4-_#MDgj1OzdWMSOBtzR?i{l-JR1pZsQZA&sok85PrQ`kcFH zu&ZnQ`{Bf2qF@GyD_@|Yf#&BIMfY#6y5#aV?T6U8_c(xM|B`6?HO);*lwDaa+TY_27hg1Oeu<=QudGoA6S3{8{<{{%^P6VUJ zr1jD1eG7AK?Z&r<-(gu@EGY@s$X}4ntR*mOcTapE)ZDVvwE>)j;kALJsdDpYV(u?w z6Z1j%-4^*F<3tbCMmQ$oACeetQ!u?QezU){`Ve23zbc%kx9zv8TeY8`jEr@Da2~sV zGf`!qadX`M@)M?)dV0w`x6C2>hav^slr5&;r>i=zauZ`>jyocpM1Q&L%(4sF5iGeL z-Qqqsnte|#wBu%(W8E3~g-dtu?_Q1-7U63TG_03wWP*tiAJw)=zn=3rQGSU2tOhEP zosRvo)+0>$QNzx;hG$_k_BmGHY@3=5*9Y$t6T>?kDrC#y;F5KH#{4j&9i1=!{o6PQ zJhXZ3gS?04tMub-T#=&Ui^R@`Z%m`Bi_2@QcbZQ6B*&QrJ4{D&KpBMSLy>;t*5Yc= z8xk8@)oy0g8tN9f6E5dRHpn_x)2vPjW+;ttZ&Ek0K%9V`eh>Yt(+xGd!L-2~HrT(h zTz9$N*yj{}Z<(`nK+FAxYoY*0EXS!f!xx5_1aZO!a)$mn0m0uX#%iNU`7gBL5w?=Ugb zm6em#)OLT>ludT$X4Pujn_&0wK-J_1Sh~5O1G>iE0NoTE^EOa+uqY+nuMCR;%IB$95OiKXceQ>`@%%+|JG6C+^^PD%YApzyRUx*U zHVSacOUsZ?wE9Q%p(Ei({fLIfv9;7g15qtsW>uCsFNT;E zaMsYI91n4AKEhIVtFZ8z`?dYKAoo|yn{KmmgX=@f)=o~l65gd{rAgK{Jx>)d__ULT zXoWvKWGtE5l8?G&RLwDMzE+Z|aZ}pn)>|=G!HLzOdt7?egNFW<-R$w*rWAiE94%j2 z1?x5D4`p;hI5yd0fUEP2I`HTQULACE3{R9L~K z4E_`ut(RYK^M1*t#wE zQ@Ruq&$(P59%rS|zU zb8o8*!q=9n;*}ajRMM98N1#w5maOEVc$oe=qqkR&w$(#v>`#{8QVGGYDVy;XlZL9^ z=bS<?x3LJOKv>7wk6Q2;q#1d*$2H1v;8eosbhn0;E)X|F0L|1!W7B!B^!EiDEO;2|A-`I>$Q~ zoMY2^=1jNy|YQL2QfD6$7|NW6)Qzbm-N0lhF$tAHHn&%dsI z)y)ezGe79*ij#0)%bffbI z)Awe-VkT&7dxg{3OFb_tAKwb->FL2rm6Y`Q-NoJBPH^91b@lh2w+nBk-SyQA1E~OV z%fw%X>o4#o$nYH?{bo1E@0PG=`;V$kCsE!i-rOquH#xFxQeWK}La2Fy{lDtU@ z-MDb)DJPPA@h{k>V+9vM@P=`mR_1ux*|tV$t^|2o=@*{{43>&wW(M zIx_Oj8>oFAB__mvjui#wT=M63_l>tNUqVh<*QxyW<}!xI&ucyUf=Z!~%~mQr%v!oC z@pg~1A_G`$*FtF8SXdHpI9@ls>kK7-#>mXPLQiFBW&-0OHu&u3GDcPN^BIMKpOKSy z_xMNDnwNj&8?na-ZBe?l-xCF|~^ z?S7)Zk8WU~{b+T4V`Q0C>0nOc9M zOCOZA39*}34t2!kiZ1HoiV8h@gD)a;-a(<~RpcVVxCH2jS@}3;=fTIn(tsTntB@)3 zB4<=QnBc$QOjhl5-_U-_V2~^cK1~EBqDA$qWl)`qOxfx<&7(s;b*Iw=Rr! zw`QxqbeL>wOACh9qz_pJE2WetiBRDOS-sgX- zSpsGD_x~jd`A8%y8T{Gus`Gwq+~cx^J=tz#X&q;2d#1TxP|p9m4QJ;L5WE^HDs;r^ zUP_UPIwvguZu2%xd-tv;lQ}3G0tIhTPz1}&)il&N-`EQ~U%06?*jsujz8CJdk$!Ht z-ksYZtxJD&w5@}DSj@x2;og~VpnZE}9m8$J{<)Wyyw@!$R&b!Bqp$n!+8BHP z+sU%`ctWh%8>Fl(Z5{mv<&Tx0gdUqg6=qIPPw9FL4=16J5bv)|Tk@`8?~a_IbLbHv zga1j>V-H)S{jr7!_=R@={`Tl*&KF1eeEX_=rHMlX* zn5e3%S@g#HHwxb3H6EQTX%SWcr+5*BFYcpeR$k^gz4Z-buXVXqqHz! za&iJdL+tG5TKfGWnrd1bD~rvXuYFJHO<{Ky{<#jdU4?z)%4;_#oyz<>KaBNyz!6#I zU;=A-mVi}%s>sL*e#y`foYnTKgwsFlj^ZH2)8z7uWyYTr9+bP<^^8;wzkIospZ`Et zFVVWNB`I)c$1=)drPg_}P*+Qf+I#;ibZW9%gHAm>p;2VD7nHcaZ>+H#{8w#7*EQt` z&7rgB>pa%aJ)%_j9hDv}=}9*m%E}^cvC;bje^=;nalzOqWIZ40{+tb~YNf|cx30sy zjP}QE@lb)BRB_kx0kFL9b$%0`?mmm~}f+^krK zjq>&{UMi)luqvvP3W^lzw+m%(WTvI1O=UladvUhDey}r=?V2j##okqZ0~XdtQFP~E zBw={;NV7nz)718AEp<}iOB`pUTjBTode8GCCU*Axes0W(i zs~^TNAD_DS|TFIN#KyR71_uh>pcb< zeKYf{*}5;st9>)|^#gKp92DV-EUue#bf@>Aw&t|ip3~NbqlcV1NqGAWd;$qlsuTE1 z+L&l`qho^~z7Bm7b9HfXbbR9={mStw?L}_g(XQ(ohbO=lIXc{g+|cWtWY{O4ofUgN zd9p!B-`Ll44rhns6mjRXBRWxQh%+V^$Y`rm{Mn7)#$P()aS}>5sn^p6OI*I4n5!+;s}1Lrl;DdC zAP|mQ&tfB0cC!e=65}q;Wjl9q8kdC4Jvc(5ZsK#j)*3QFA(K5qcy{*4pk8z6@%X!T zV{-2cm}X-k>2n2@jhyx5cV>mc&US$*6a5~;Ph^zWbv84%>~^21t7ApdQ~rKfi-x&Q zKvnEC_I)5#f*Gh-Vhjw+Lm8MAA;%v--g|rXJ7A~=df>M6S8U9I=QdMXTF@InLueud zn}>(3{+U;Jq;m}U{~@71jQpV|J$uP>a84A?HS{5dwWjQk^4dW7qfuX4S(D|C%WU@X z{8t6*s<2`~!d863q++~|& z_TH705cU7ReQfy%EKvyv-iQJ>8y3A-hxfO_LZuAPV`!@3z|j!Jw&#nZPhMWOg^2UL z%50vh@&|AJs0I_zwJ0TPH`*_LITOu+?K3P_{~p%wt&-scMj8%^p3B`I6I=%UCjUmh zEG_W{1wA<&U~7Tuup=&AHoBHPij0yxf?D+8iHE4VpwmkTtvaqkpDKi?FH=Bf&)Pzg@)PKd#O~<&7``0Uy>YM%0E1kD$ZiNxEzj<`V+B zR0;Um-0f!BewKLp#3#IYezte;m&Ej6nn=fcdY=dUs*luT>uyH(nO62mh(yvnWS0uPMJf`$nky@D}WS_`qTS%aXXy>ig5K=qt}- z_0VtnArBcHWJ+L($s%Pjd>aNXqu}G+PW{@^6K034?~9n1mqJ=I-B?|er6CT_rz+oy z&;N6pT^qRODDR&VQOO!S<@}mHvQbu0P*M^6-}xI3*NX$p!1(O#5WU`)|D(yVps-Pg z58Kz#4?J$(9n?ODu7RQz?@#%~AM)>5y-iHz9w*iL@Q6}9ntfWY_4`j{q8(;tJ#74y^JPof$5eO67nVEcZwOZI z>q$%R4P|Ifwe~T3p3|dRV?i_HPt%WUW6J^h++|m7Ia=T9>$PjO>5vEa){^Um>}V$V zpd}{Ye0Z(K3Kfv{>spsh7C$EPWTodyid#T&SJBfuxoUv+Hvz>Pb!)*HyS4ssBO{;p zEX!O56!Q#dIUkAGjkJCPRcGPPuWIuMU-pZWD{+2dx3`;_`r0h(UBq}4A}+mV-6YKu zi>tq8stD;H5ZOmVx%;I+o0+dhV>F8GQ5X@G3>@le6R^j422A;mw5pPvnN;sZ2?o4em2*q06X@Aiq_ocSeV9}t+z6>Zjh|opX^_HPWxlAWXR(- zk_G?Lsk+hl7=C^@?1*2V%I{^mp&SPAkDuES5(#|?c}pK5_t=4fRcvNxTpcKpgK24_ zp2u@Pymj>SA|A1*tEo5k4G=!?5@z5kjQRMHjZTx(pSQKeI6ry_f>eo$uS%!303`#R z6p{W(%_cnnPd#Ysvh3@Km;lV6%kj=1eA=$^mWvn>~p6`hB<0xU* zo%WIJ_EgCU2(@tDbw6E_J7^Ejz#_c$%FzCI6N(=h`h=<)ip%rT^*;qoI_I4eGqf?z zPs75?3>w=^@3tuyzI}><(_{;%5We`_;~k^Y(RTCSKLSz0PTC*O;K@SK09IBctyZ}^ zb$zPBdGjEY6mpA`Erm!~<&nBf3p!~G4B3z~QB!g`dW?p4Oa6$QlHABrhn_B3PT|WV zK#U08F{vxsg}u1^Ea}PYN)NJERzJH`^rOk= zw?}hH5kr0932h#y2gF83n!xu9oV@G^=dtEAF_f8HSU%#h@w_r!`f&ulGU!H)M9(T)@Lm;qQ>3K$~L;IQcv^u6JaN1 zmBj4@dpJ#u_V%K6M(IpVJ^+q{{>x#Q4mS7M=!eg_`Tm4~2IC!G{`Z70bO>wzpkoz` zd^h;OvrzY^h<7)ErmIOvQb((74t4Uzug11=t_?uTP!*1&=6F1Y0So-ucgWffjr8hV zFc7abkIA^iAKm@7+u1uTEL`PPltJPle|P7<2nZAFYKM34()(X2p%Pv108T$Xg@I zv@W9rsUDwyn5|>b`);?dppbG#1C|a^-v%~@gLfR@!wk=EPic?4dr&m`49r`o?EVs? zqYB9txgOxKvXXwPccoP#^O#Pu0xzhwH{Po=4GO$COYD8DpUmKIhL83*{Da{(;bbVr zgrW1y;)ctwW64JE*4K9tHY@%xIU=^h<K zCK(LR6=DJ~F>tCq+f4a14E0ze>{G-vK6Lpv8}<^rJF;PYssP2Y!&CrX(i3z{1Pv3v z#a_Vr-&Zffax1*b<#>LcWDZ%n-k zQ-0jTaVmbHE_dKCXI%J4UHj$V-$Qp$C{I;2PeSral|Q9rXG&B3I)@){1B&57aEk$x*p55byKjPJ01=23a260+BcRjp%^OzK3TcvLriuT~=Ps|A*fr z@Rc$*cYWW$^}&9|!sY`dh1PKtiyvO67~u}fPzE?gY{T+sQhHuG(J8+tr>y|jo!E|w z=yBAxph&^cv0pD9-ao7s;eoj`=SS^uGpSglTEFhaqWT)e{c&>K{Bk1-(pk49GAMY1 zp$h%u!_N8sJ1I%yfB&fxEKZA;=e$}s-aR1-YSR7qVE@cnaU6D=DNR|e$$EfGA^=O~ z@%kvYJv<;+kvGqj!Ampnm@&F~%@w!*PXsNmav>yn^LYDQ)(NTo)S?WZKYKQW{-~zN zK-QBpAItBYM>VZi-Ym`6)MQOy<2y+M7nC`fd+`vPfJrjO0^?&?O^s0SY;@; z4VYfn%o@7+T!#e?6JjYk`4iz`qO}$zWK&cBw{&nD)Hm4+=y&z?WBPLG)f!f_)Moz< zz4){8=$W3Lj=cPyv$}^nPUB-VuZs(GympB89nUquF1wh@se>Lx3>}Ywr2AN;o>z~D z03yiqg2`P0b$Bospw5vr0{0jg(wp}ITnzwfn1Eqqi=sU>KmViT&cn>F1qo5XICxtR zX-YVgbK0DOaD&SF+&`iu0 z;q^ZooRo@DZX4g#JY=dJdb+zgHS0B-*&V%x2%!>rV+!zXphyrOa)uqm- zFco0fhv```R*rD<9)zeu_zFw*ptYP)>mY5F6`a+06Az=j@i1i%nD61oiC9ElUYr8d z`{~m^)5&5obhqCe4QGOxqUuP+CxVue<#&7@@L*17UTx;)Zs^eCg!sbY7Y&Jcq|)YL z@Iv<_iV!-TR*MB)F*x0kFoooeyb0W7BrQMxeFD15$CyB;IhJPo0F=r;c5#oxme+T! znG3OKX^g8Ac6?E&3XkO9IKI*3pa6*Ast}7M2?hoR|GO1}app9yV)wQFh`G6fdoi2e z3sZm(b}uV5paaYgq!t5zZE52b=Zd}0yNh{@zFa&RvLs9qzi(}pd+8)rmlzl8a7p~F zbYAUuF7DD^>ZY$)?_Xl~#K_N|$=5bRLa+}ohKuT8k7MK92ugNhsnip2Oin7+{^{0+ zoga&e(CO*n1$#vj*_cc21KIvXTlpQTcdDc@F&~TdVkIH(NJ1~Zw9nfG>Q5atb&HGP zP58T=Z`nGUI#su=r89;&@(XsqWs7m@veD#yvn&Uy7la7wb!YTON4YvWb~>Dh@VHGS zJTbSc)6i&6cy`3M0|L;Mh8BRD{LnBA(5!2lvuCflzyeR?9uvXtB3F_UN8uFz{#HRi zXt8K$x$TS~-uNOayIBU;>(`S{WiFy2Y$ekm!CHw&CrY-*R%T6bX#2}HGwV@DC!rv} zb?Kn2l2X4zv)>v9hQ%LxM!BGb+Oy`SCXl&fi?mFPYzl-dKYUL}`1p6>zOMxRMcIfFsG?@txi*>k>faVGbQR)0rB6sSBd01ReOT8Ajd zD|>IF`2z_Wk;)#~ool@0xRa4rTYL3^LH7OoklX6zPAgCApIKsqIZ3O2(rn)t>FVx( zn-aZWnI>hoAcZE|Iw#|Hu$UYcc7tEU8tQK0gm>Kd+*5FfTMfAL@83W92%69Lv_-%r zESqNxL6Wu@I^&@TKLm;s z5_c!S_SPqDLmn#nxrSCRhh`|%DvJS;Zj)G+mSV2+if})o=Ffg> zbMdkUtf5{~#%&c=UQtRfK!_k9>>R&E&`?ocd4BfycnS<0Tne#S2krqRjHPfs@@c1 zd6s~F_=8jVDZH2KVs^c6K1{ z+P}|u2%-ZaQxFW;pl|V#hJir z=FNzBLnDXlZqi#e8P4lOE*rzE$zp*vIlRbWKVhQ(a+&OE6nr zUuXNK(hI0ofPB2YrfAq=_4!Yr5`O)uFenKA91#TrR-h^OMNh;!i}C`^Tb zf!ot)LhxSXMQ1S3K5A=fHel$6hsT=+37y;8?B)VZTsSZ;VNKySmi=?(D3u zqBtivuV|)n+x=~0G|`b~f=NPw&2*jySOhQkli|GwFyE|tKG8e1h#Hrb8;R{;@*!na zA{)L77diA+EXdI@pcB4B%}5q`qtEX4W}=Gf@14cyFEOnmRJTY;Z;`5;TwOv>n#mT= z720AbO+?Y}rICF* zNW{vrPY6!q)m70A+^VhFsRnsMP{sNkNa8tWN;0xy)!h^oA1M)V9UI3CWn_?$+*7{h)`k5X#?B`VgG34J)Z>yea)^h{AA+(P?PFx3I2L*Gc@DT z_H-?|_qzh|{|KW978aKE7jm(ym_5iosX#dZQ(*pq&|OpB3bq+%CnrIhX{Pt9JmuAp z9(9}}Mqup8$Cw!0y*br5A)l*yk6$&EFiMVxhv-k1M&5^*nEO@b{GF-^TJ}IVtp1Ff zVrEK(NB1;|W(Pb-NRtyoPg$XE&0m-XW}xsCCXf}=DF=yIl6+qEQRtvmEEpLbu4P4E ziH6pYh@9NI71?QDvLI)64z@QwGS}GXLO?LU$M^Tmn;Kd(rAyzXn)V_;z-M@L7dd^M5X^<$Q7c=}XSG$ftxLUGYIzRH>Y@CrSX)wofU z>(cds!IIG(dOkAZ(F?bC$0lDn_=GRs9$y95#3*EJ5yqC51U&pe8z~bvoJYSl1AFY| ztD7&)jY3QUlO^yGAR~B9C{~!IcJ1HTH0-fF+IXpFb5!{S?@!=G{VzF zI3@~piH}0Haajq2_)ONhynx@w$br{DLrf7w5QK>#-qQt|!8<>m{!1EJ;doI!{D_w0 zU6k9B+(q4kFAmDLCWw>b@|zQRsb!}T)#vQ*JG@F{A9ztA!eU}*QdyRPq|D_;gAH!q ziOvRT{qLoRNqB!9*y}k%e4qx1XjRj*eP?kZncR zkne=g>U>Y1s-pTyMKxfF$C3q{fdw}n(biM{>ks?%+Z4nlz}oz~A?EPV+G{e5oE?zD z{>_gWo0xEyn%pBhW{7z2oUinRrAne0!lX<_;a}jaf(TKUc^To~nItZzK`vD#W#Ud& zd|tlV_>X=BDZ-ulw|ZcXk4muTj{hn$Nhi~%51=JA{|B-E2ox8i#{Bf|Wo}$oXZ^j$|e9Kz@C~#CQhL z-~zBYPL?=ibSd3K;dZh4^)p&ny5`|0L$aIY(;>unmf zvXhnpOq5i9%eB+k(fdo%G8=tYjhG|F+P5v*V@bg^lZ3Jec_8tFeGzU$^m|kvN&4Pb zFON~|G8Ui{hNQs|uchq(7-)nh^|Qf~gF@lc+UMII<<3s^4<0xP@C%2^D{7;LLFip9 z5C%aIdsS4vi#z2xNMygu^>*S+G&7`_C(<;ss%RJ7Q2qL&p=B1HuU|uVWcSbd`pP28 z;U!xV-EPuX#>k&a{$|SfV-4TF!DeuJcAin#!5P64T(M=MT^u3Lk*$b=^v{P{9yMHJ zODA|%pI&Y2z_3!JScU0N^lZMtj})17n6Z!&%S19Q3ad< zKC`eq3pdWc%P~#y7$h2Hg*zU((#2z?QLm;1^%s)9lu;|8W5e&&mqI5tY3%|TmTEOA zIkeADei)q}L2zR8wdJhB z)9DK5yt?2{5K@%qSN?lUeqs3t-l6yJ-<+|umBXzRNORD@U(=cGVNMg!6ZpCYelL(l z(R>XV2+M4#+1c}8gfJvm%^+C5#>6>5;$|`rX&4^kHf;V#CAYK}TQF5)UFUZG9et;Xb4GFc|8>`R69@_1}Y^FmzC{TW-<%kp`~$^eoDl<{5~Q) zJPZ#X|Nh=w_=>Wd^}X<6m0_4)z#>s zPgC_S-h_rMEEtl6s_y?=bARjE&Q#704Sfnqa+D@$B<)vXm=B~BeEr&DUUp6FcUBir z*$E;%0*=XaMtj2-^kMs#4$7EDw;LrC_4K?iPWF+7AFkYUm5+(gpjV0t!vWB+`ReG% zKR^&utPzFngB6kw0pY9O-AZKglW9pirnVlcrTNF@jZ8{%mfR* z=xsI&r4$&a1Jy9hNN$>mz5b6s59&SAbfcRHALm)KDIeO=E*1jIlT&U8iG)l0!+O#n zB0Ksl=!~FKf=CIh+NPPCI063MrvG_Q5GZ-R-3f@^LnXO&ivVetlUtLk9%GQ!ovija zv=dE!nwcWzNAH(B`pKjN z92I0R6g$U+rrur-h@{B|6M&JOd4xZKiIF3}B*X=6@ZnRy;(x1LF1KF{+Mc1Uw^+(i z#y=B-CH?j5S2dn)hMC>r3?O4bjY5{#_uo*))Kq$X^SwrPma}A@0JlyfL@HzG>hjnC zdHh7FpSekw5T`ADeYukz@SVj#Trn2qK_II`^ZDr|xTO;^72qlUr3}hgf^c(Z`5mLO zwyF3&b3kS-uQ#O$q*HN8Qtxfqplt@!CR@IBKY4l8$b<+B-7&xY1XOGEV3le+{jxkcWZ6YYpyb zNP2quiFV6!Ar+UHQAp)NE3yE%ASRLxt0zx#auQnQFpr7)S*{sE<@h^DBUY^Iv8&D` zEXY`;v+m)BLVkekOL${iUIlo~LE=pAGv_X^>YSlSZx!FH*tgt`HE2(Q<-_y*>}ye| z6gvQ3kkC|S=G_=OKIXHtpgwsKodBdAXSeQiBx#_3>=E?Z!n0>k(WAY1- zM8MbNr-3Px1a>-z8+N-rUQ1fv2|U|S4J0K&YAab`<|kWa6~_&hY7tRBDmk1z} z@dUL4>+pVZlPlxx1vPaF1RV>Dl*eb#lr6}U2-9XDc*wGRrpm4=I9LlO0z7pOSjA`& z85tRy-#<)NIJ2`x_fIi& z1kNTU`8PHqhCoPuJj$2XkxsP(H%1(843LQ&U0tz!6)3r8Yn*ZI9I^2oO4C)2AD%1GgJ});7;<@5o#dtNRjcnUkYjUWs^(Tkw29Dk)yCVbNaX1*I2?kew5T3iC zF;S_#!Ytg@{S})aS;;j;9Qx~dIXSwGUetDu=rSP2ZLk5@r=mo+1y-9@6Jud&>;Dzc zo|m@=V-3hL;e-ao3;iup$E7W;#pIQ!$$=y|S3OC8aqEGb6btEDN-td)F#|T5uVCIl zY(fHLXu(x8sjUs9dD4rYMB?z#hAmrnRbYl@uIg)TZEe~Uy@5F1*0Hg}wopiSdc>_asPEL)6j*A>;(R)fUAYXd`*%LZ%j0wDbe!em#Fr|W+ z3ERJtCKv@ypFd&pD0t|;EEymFxP~`)h(TYAO!2=}I`PbgXDBL%h~(WnSfvQiebp3V z|Ep1}L`VW!3IYPkvXxMpV54r!d`}T*jE>WihJVh3@Z7%-vrlOeCRS#;={ia~#}Eu@ z`0*T>`Th3zPBpmwWs61?5p=O}}M|z;q?!5==0#Y)##-?`uwh zadaqXm~h&5QC3khNlLmoM^WLIkU+CEdRgfW z&mBx3a6dodgw#9{rBGKB0voqs>)O|^p?Bo@;uY1@#vrgdG`)T)&dWPAJDb#JempV~ z9z8l$iL>rhn;Wfs8buEa7b|P7DSv z3{zM~AngeLWkqVq#*1^;dd`oxiSR^!dCXP=WAsMgU+~HUWv-r+1p1a7F!+WY`NqUr zq+N;*-v&EiC5~5)UJ_cpkUE1rKaHJZTZ+qng%sEmfv5+aiSMOvN^@Vq!#zjwWPy|= z=9S3*Oyw{`Qc!R_&6_D0=25S1ZQ&vNyu35xMV+wcd-3)B`~x^r1bU&;B|B}b1l#TK zY^A3g0USDB@#<fu)C{2Nb zgEpJvi#Cw~>i5kq+(vIy!srT^p}kSb2DD z8)iUYAVeHWrmR=`lXtWJPe)e*4Q1Pg2c?uOqmXEnX{3-Q5{j0wZ~0{@WgDb4p}x>( zNfAvWvWztmDlL53DWoistAiK)`;@(@tm$GSoE$=WZ&EWn<)|+TDQ_|n6{xO z45IhkcFD?E7dQ#LKvCL+x2LrM4>5f8YH+g@Wm&x?^k*)Tq)ow`xGG~}=IGJ0HMlnp z9#dn|P&`85=R{~@bMvR3JNATJU5N8l_#HT&)oZxQZS1eP5c)^J>0!7Gi`M%G%S8QI z@02I~jN;Ir_W|h&(tFVQ32cn1d;X%Sf4!LXexTr9zO6=WW<`mOjy6-2k40v^GQsC@ znBL%9=h7NW?dj8}O}~z-ED4(99%G8g5GQpd_U(jWBJv0r8N(hFB%7F)mJk>6&_bJ; z<>~7NRjE%PhzIvu!2ohlRyrQ%8-}Q$kb?)jrKRPolq@kYGwIc+&oL&U8_Adm-YYhE;8Z1!wxZN->dd^L5EKWnMQ z;lrR*Z4=a#7IjiKTw zR#WT7ofN?m8LV;o$K*H{`qniyHE1G+xX^rIx(Czadw1^=8lLo>O-_)+e%m{%zuvhf zOVD|Yymf0dS=AO$l&S4^uK=C4kWf+rHc*0)fc4QOCU!ZAB`JwGaivBtbGN`lG&A#E zOoi0e0@NjM-|{Q(k;KQvFF$9RAu2nB5%0aEIfRqL002XN@C)=K=++_xw&YU(*6A<2|sIU zC{d!j%x$0b7X~#=j=$+Jji>dN85$ab+?TdPt4o>LsDPg7HW?Wi0J8|19FCtZ<7t21 z%+ninp&&e#^_{>V1{;ocE<%eX&U{(T!zhArasVjo=>Imd%9x=@Nv`SX)6-KEBf#Vf zlsYbtht*J8H|1fyA2uN{;zqti7#qxg);H#hncny9cQqQlsB(R9R!1U+y>NwQZXZD= z8h?y4Cju=I!o%5#voo(Yv@KRABb%$%({uR!TTGB6SXx*R|2dY*Aefi;FM@3fBq<74 zeF3HEi=CBFLBC!`}Xb7_9iZ&DB~CLosEqR5@majA>f$ku@Xa! z18YWdR&5@&$%;_~f8LiSxLg~zYURWq4N{`n9IvCX zm#g6~91_CEgN1iu9S8wfl$+=X6UO=ERLFkKrZvb#4xO=3|a<17e%(tFjy?QnLV9gcfN7J*i7Up<< zUwiHluA<;uDiT%X>Z&fg-2YLNylD2xql`)I)1#f!r-;mQIDW#sl_}CFZLZiN1H(DE zHqZ0ME zctbB@Fi4t(L>MaVawDIFV2xE;US1nAl~*vIu6(%WRC8CCG<#sZZRL1_5U>QblTUN1 ze*Of%`9;`__`q5nZEX}UMP!3Z(X`>lMR^D%u*#08+r-XGdiAi#g+b<>5tNku6=(d+ z1Gmlv!F(R+ZgPsh^wn&vFWoO?P#&{qe`Xt*WM-00AF9%k5KfM5Nc>>_yFOo zq&Brh&)&QVM%)K_oc10ic+ud4C;xp#bh}3rWi{)AH-3lyte(xjp@M^NSNL4HS9>ZS zYvlu0yZWK>G1%OVnOdw*q&Oeq7zX5K7rcCKVHxb-AGFzUt+};uWMX0$>tnS3-bNLb zZE#?MtEgJ#fYq_k-NTJEAyzXiO_xhZyzJ=sq*&19YeJ#OP^>XlROVlaZ1ZZN86Sy{ z3u9;eymu?+bnVg3>j=!C8KwC$%FiNpAQr_d8KlCaC(wtGTUemo)9RbYX7jjTq94ZL zEY@_Z4N)&7!_@&pD7X;Q zym<~`OE-9XYba$)=bPGI*LSdVapA^z7u;+%F@21{awH;RRoZ)DK}#p3X zkDqOGs@?Lsd;wucR~~mNd&HHj45tvzxX8#tMSLoMUu$x;Xa(aMvK=6b?O?QpV}b<#O*A6+wJ#L#GR46&~&!3}uU4ss`b( z1}Y0?vnyQL$!Sh@4!sitE~ZYwk@fXoqQ%k=SZQUvh(np*)AL)`-|*br0shcF2XF7F zS?CqxfJ0g{|D)3=$x}m218(rAfsR0%7P`UPFP-0E*5ym3QlSOJPGREX#~yuIWFlnAz^2lI|i;9Z)Kg&QAo*#eHIXw;X5$LM;!O7`afFO|Jp`jlG z(he#K@2UIxiMtn}oQFnI4ZW;9{(ZPfgNcvr2Xu8{Ig)B9$^b-k?b@{q z7cO9r1lH8>YT}N0`1-zm6zpHSKq8XOt}1U_Sn_2hr(O4Y!6OJS63mTlXvKToFZ>Vi CWzWC> literal 0 HcmV?d00001 diff --git a/doc/arm/intro-dns-bind.inc.rst b/doc/arm/intro-dns-bind.inc.rst new file mode 100644 index 0000000000..f8a61c4c43 --- /dev/null +++ b/doc/arm/intro-dns-bind.inc.rst @@ -0,0 +1,197 @@ +.. Copyright (C) Internet Systems Consortium, Inc. ("ISC") +.. +.. SPDX-License-Identifier: MPL-2.0 +.. +.. This Source Code Form is subject to the terms of the Mozilla Public +.. License, v. 2.0. If a copy of the MPL was not distributed with this +.. file, you can obtain one at https://mozilla.org/MPL/2.0/. +.. +.. See the COPYRIGHT file distributed with this work for additional +.. information regarding copyright ownership. + +.. _dns_overview: + +The Domain Name System (DNS) +---------------------------- + +This is a brief description of the functionality and organization of the Domain Name System (DNS). +It is provided to familiarize users with the concepts involved, the (often confusing) terminology +used, and how all the parts fit together to form an operational system. + +All network systems operate with network addresses, such as IPv4 and IPv6. The vast majority of +humans find it easier to work with names rather than seemingly endless strings of network address digits. The earliest ARPANET systems +(from which the Internet evolved) mapped names to addresses using a **hosts** file that was distributed to all entities +whenever changes occurred. Operationally, such a system became rapidly unsustainable once there were more +than 100 networked entities, which led to the specification and implementation of the Domain Name System that we use today. + +.. _dns_fundamentals: + +DNS Fundamentals +~~~~~~~~~~~~~~~~ + +The DNS naming system is organized as a tree structure comprised of multiple levels and +thus it naturally creates a distributed system. Each node +in the tree is given a label which defines its **Domain** (its area or zone) of **Authority**. +The topmost node in the tree is the **Root Domain**; it delegates to **Domains** at the next level which are generically +known as the **Top-Level Domains (TLDs)**. They in turn delegate to **Second-Level Domains (SLDs)**, and so on. +The Top-Level Domains (TLDs) include a special group of TLDs called the **Country Code Top-Level Domains (ccTLDs)**, +in which every country is assigned a unique two-character country code from ISO 3166 as its domain. + +.. Note:: The Domain Name System is controlled by ICANN (https://www.icann.org) (a 501c non-profit entity); their current policy + is that any new TLD, consisting of three or more characters, may be proposed by any group of commercial sponsors and + if it meets ICANN's criteria will be added to the TLDs. + +The concept of delegation and authority flows down the DNS tree (the DNS hierarchy) as shown: + +.. figure:: dns-tree.png + :align: center + + Delegation and Authority in the DNS Name Space + +A domain is the label of a node in the tree. A **domain name** uniquely identifies any node in the DNS tree and is written, left to right, +by combining all the domain labels (each of which are unique within their parent's zone or domain of authority), with a dot +separating each component, up to the root domain. In the above diagram the following are all domain names: + +.. code-block:: + + example.com + b.com + ac.uk + us + org + +The root has a unique label of "." (dot), which is normally omitted when it is written as +a domain name, but when it is written as a **Fully Qualified Domain Name (FQDN)** the dot must be present. Thus: + +.. code-block:: + + example.com # domain name + example.com. # FQDN + +Authority and Delegation +~~~~~~~~~~~~~~~~~~~~~~~~ + +Each domain (node) has been **delegated** the authority from its parent domain. The delegated authority includes +specific responsibilities to ensure that every domain it delegates has a unique name or label within its zone or domain of authority, and +that it maintains an **authoritative** list of its delegated domains. The responsibilities further include an operational requirement to +operate two (or more) name servers (which may be contracted to a third party) which will contain the authoritative data +for all the domain labels within its zone of authority in a :ref:`zone file`. Again, the +tree structure ensures that the DNS name space is naturally distributed. + +The following diagram illustrates that **Authoritative Name Servers** exist for every level and every domain in the DNS name space: + +.. figure:: dns-servers.png + :align: center + + Authoritative Name Servers in the DNS Name Space + +.. Note:: The difference between a domain and a zone can appear confusing. Practically, the terms are generally used synonymously in the DNS. + If, however, you are into directed graphs and tree structure theory or similar exotica, a zone can be considered as + an arc through any node (or domain) with the domain at its apex. The zone therefore encompasses all the name space below the domain. + This can, however, lead to the concept of subzones and these were indeed defined in the original DNS specifications. + Thankfully the term subzone has been lost in the mists of time. + +.. _root_servers: + +Root Servers +~~~~~~~~~~~~ + +The **root servers** are a critical part of the DNS authoritative infrastructure. There are 13 root servers (*a.root-servers.net* +to *m.root-servers.net*). The number 13 is historically based on the maximum amount of name and IPv4 data +that could be packed into a 512-byte UDP message, and not a perverse affinity for a number that certain +cultures treat as unlucky. The 512-byte UDP data limit +is no longer a limiting factor and all root servers now support both IPv4 and IPv6. In addition, almost all the +root servers use **anycast**, with well over +300 instances of the root servers now providing service worldwide (see further information at https://www.root-servers.org). +The root servers are the starting point for all **name resolution** within the DNS. + +Name Resolution +~~~~~~~~~~~~~~~ + +So far all the emphasis has been on how the DNS stores its authoritative domain (zone) data. End-user systems +use names (an email address or a web address) and need to access this authoritative data to obtain an IP address, which +they use to contact the required network resources such as web, FTP, or mail servers. The process of converting a +domain name to a result (typically an IP address, though other types of data may be obtained) is generically called **name resolution**, and is handled by +**resolvers** (also known as **caching name servers** and many other terms). The following diagram shows the typical name resolution process: + +.. figure:: name-resolution.png + :align: center + + Authoritative Name Servers and Name Resolution + +An end-user application, such as a browser (1), when needing to resolve a name such as **www.example.com**, makes an +internal system call to a minimal function resolution entity called a **stub resolver** (2). The stub resolver (using stored +IP addresses) contacts a resolver (a caching name server or full-service resolver) (3), which in turn contacts all the necessary +authoritative name servers (4, 5, and 6) to provide the answer that it then returns to the user (2, 1). To improve performance, +all resolvers (including most stub resolvers) cache (store) their results such that a subsequent request for the same data +is taken from the resolver's cache, removing the need to repeat the name resolution process and use time-consuming resources. All communication between +the stub resolver, the resolver, and the authoritative name servers uses the DNS protocol's query and response message pair. + +.. _referral: + +.. _recursive_query: + +.. _iterative_query: + +DNS Protocol and Queries +~~~~~~~~~~~~~~~~~~~~~~~~ + +DNS **queries** use the UDP protocol over the reserved port 53 (but both TCP and TLS can optionally be used in some parts of the network). + +The following diagram shows the name resolution process expressed in terms of DNS queries and responses. + +.. figure:: recursive-query.png + :align: center + + Resolvers and Queries + +The stub resolver sends a **recursive query** message (with the required domain name in the QUESTION section of the query) (2) to the resolver. +A **recursive** query simply requests the resolver to find the complete answer. A stub resolver only ever sends recursive queries +and always needs the service of a resolver. The response to a recursive query can be: + +1. The answer to the user's QUESTION in the ANSWER section of the query response. + +2. An error (such as NXDOMAIN - the name does not exist). + +The resolver, on receipt of the user's recursive query, either responds immediately, if the ANSWER is in its cache, or accesses +the DNS hierarchy to obtain the answer. The resolver always starts with root servers and sends an **iterative query** (4, 5, and 6). The +response to an iterative query can be: + +1. The answer to the resolver's QUESTION in the ANSWER section of the query response. + +2. A **referral** (indicated by an empty ANSWER section but data in the AUTHORITY section, +and typically IP addresses in the ADDITIONAL section of the response). + +3. An error (such as NXDOMAIN - the name does not exist). + +If the response is either an answer or an error, these are returned immediately to the user (and cached for future use). If the response +is a referral, the resolver needs to take additional action to respond to the user's recursive query. + +A referral, in essence, indicates that the queried server does not know the answer (the ANSWER section of the response is empty), but it +refers the resolver to the authoritative name servers (in the AUTHORITY section of the response) which it knows about in the +domain name supplied in the QUESTION section of the query. Thus, if the QUESTION is for the domain name **www.example.com**, the root +server to which the iterative query was sent adds a list of the **.com authoritative name servers** in the AUTHORITY section. +The resolver selects one of the servers from the AUTHORITY section and sends an +iterative query to it. Similarly, the .com authoritative name servers send a referral containing a list of the **example.com** authoritative name servers. +This process continues down the DNS hierarchy until either an ANSWER or an error is received, at which point the user's original recursive query +is sent a response. + +.. Note:: The DNS hierarchy is always accessed starting at the root servers and working down; there is no concept of "up" in the DNS hierarchy. Clearly, + if the resolver has already cached the list of .com authoritative name servers and the user's recursive query QUESTION contains a domain name + ending in .com, it can omit access to the root servers. However, that is simply an artifact (in this case a performance benefit) of + caching and does not change the concept of top-down access within the DNS hierarchy. + +The insatiably curious may find reading :rfc:`1034` and :rfc:`1035` a useful starting point for further information. + +DNS and BIND 9 +~~~~~~~~~~~~~~ + +BIND 9 is a complete implementation of the DNS protocol. BIND 9 can be configured (using its ``named.conf`` file) as +an authoritative name server, a resolver, and, on supported hosts, a stub resolver. While large operators +usually dedicate DNS servers to a single function per system, smaller operators will find that +BIND 9's flexible configuration features support multiple functions, such as a single DNS server acting +as both an authoritative name server and a resolver. + +Example configurations of basic :ref:`authoritative name servers` and +:ref:`resolvers and forwarding resolvers`, as +well as :ref:`advanced configurations` and :ref:`secure configurations`, are provided. diff --git a/doc/arm/intro-security.inc.rst b/doc/arm/intro-security.inc.rst new file mode 100644 index 0000000000..40abef87c2 --- /dev/null +++ b/doc/arm/intro-security.inc.rst @@ -0,0 +1,76 @@ +.. Copyright (C) Internet Systems Consortium, Inc. ("ISC") +.. +.. SPDX-License-Identifier: MPL-2.0 +.. +.. This Source Code Form is subject to the terms of the Mozilla Public +.. License, v. 2.0. If a copy of the MPL was not distributed with this +.. file, you can obtain one at https://mozilla.org/MPL/2.0/. +.. +.. See the COPYRIGHT file distributed with this work for additional +.. information regarding copyright ownership. + +.. _intro_dns_security: + +DNS Security Overview +--------------------- + +DNS is a communications protocol. All communications protocols are potentially +vulnerable to both subversion and eavesdropping. It is important for +users to audit their exposure to the various threats within their operational environment and implement the +appropriate solutions. BIND 9, a specific implementation of the DNS protocol, +provides an extensive set of security features. The purpose of this section +is to help users to select from the range of available security features those +required for their specific user environment. + +A generic DNS network is shown below, followed by text descriptions. In general, +the further one goes from the left-hand side of the diagram, the more complex +the implementation. + +.. Note:: Historically, DNS data was regarded as public and security was + concerned, primarily, with ensuring the integrity of DNS data. DNS data privacy + is increasingly regarded as an important dimension of overall security, specifically :ref:`DNS over TLS`. + +.. figure:: dns-security-overview.png + :align: center + + BIND 9 Security Overview + +The following notes refer to the numbered elements in the above diagram. + +1. A variety of system administration techniques and methods may be used to secure +BIND 9's local environment, including :ref:`file permissions `, running +BIND 9 in a :ref:`jail `, and the use of :ref:`Access_Control_Lists`. + +2. The remote name daemon control (:ref:`rndc`) program allows the system +administrator to control the operation of a name server. The majority of BIND 9 packages +or ports come preconfigured with local (loopback address) security preconfigured. +If ``rndc`` is being invoked from a remote host, further configuration is required. +The ``nsupdate`` tool uses **Dynamic DNS (DDNS)** features and allows users to dynamically +change the contents of the zone file(s). ``nsupdate`` access and security may be controlled +using ``named.conf`` :ref:`statements or using TSIG or SIG(0) cryptographic methods `. +Clearly, if the remote hosts used for either ``rndc`` or DDNS lie within a network entirely +under the user's control, the security threat may be regarded as non-existent. Any implementation requirements, +therefore, depend on the site's security policy. + +3. Zone transfer from a **primary** to one or more **secondary** authoritative name servers across a +public network carries risk. The zone transfer may be secured using +``named.conf`` :ref:`statements, TSIG cryptographic methods or TLS`. +Clearly, if the secondary authoritative name server(s) all lie within a network entirely +under the user's control, the security threat may be regarded as non-existent. Any implementation requirements +again depend on the site's security policy. + +4. If the operator of an authoritative name server (primary or secondary) wishes to ensure that +DNS responses to user-initiated queries about the zone(s) for which they are responsible can only +have come from their server, that the data received by the user is the same as that sent, and that +non-existent names are genuine, then :ref:`DNSSEC` is the only solution. DNSSEC requires configuration +and operational changes both to the authoritative name servers and to any resolver which accesses +those servers. + +5. The typical Internet-connected end-user device (PCs, laptops, and even mobile phones) either has +a stub resolver or operates via a DNS proxy. A stub resolver requires the services of an area +or full-service resolver to completely answer user queries. Stub resolvers on the majority of PCs and laptops +typically have a caching capability to increase performance. At this time there are no standard stub resolvers or proxy +DNS tools that implement DNSSEC. BIND 9 may be configured to provide such capability on supported Linux or Unix platforms. +:ref:`DNS over TLS ` may be configured to verify the integrity of the data between the stub resolver and +area (or full-service) resolver. However, unless the resolver and the Authoritative Name Server implements DNSSEC, end-to-end integrity (from +authoritative name server to stub resolver) cannot be guaranteed. diff --git a/doc/arm/introduction.inc.rst b/doc/arm/introduction.inc.rst index fc80fb8119..009a702347 100644 --- a/doc/arm/introduction.inc.rst +++ b/doc/arm/introduction.inc.rst @@ -9,25 +9,27 @@ .. See the COPYRIGHT file distributed with this work for additional .. information regarding copyright ownership. -.. _Introduction: +.. _introduction: -Introduction -============ +Introduction to DNS and BIND 9 +============================== -The Internet Domain Name System (DNS) consists of the syntax to specify -the names of entities in the Internet in a hierarchical manner, the -rules used for delegating authority over names, and the system -implementation that actually maps names to Internet addresses. DNS data -is maintained in a group of distributed hierarchical databases. +The Internet Domain Name System (DNS) consists of: + +- the syntax to specify the names of entities in the Internet in a hierarchical manner, +- the rules used for delegating authority over names, and +- the system implementation that actually maps names to Internet addresses. + +DNS data is maintained in a group of distributed hierarchical databases. .. _doc_scope: Scope of Document ----------------- -The Berkeley Internet Name Domain (BIND) implements a domain name server +The Berkeley Internet Name Domain (BIND) software implements a domain name server for a number of operating systems. This document provides basic -information about the installation and care of the Internet Systems +information about the installation and maintenance of Internet Systems Consortium (ISC) BIND version 9 software package for system administrators. @@ -38,25 +40,50 @@ This manual covers BIND version |release|. Organization of This Document ----------------------------- -In this document, *Chapter 1* introduces the basic DNS and BIND -concepts. *Chapter 2* describes resource requirements for running BIND -in various environments. Information in *Chapter 3* is *task-oriented* -in its presentation and is organized functionally, to aid in the process -of installing the BIND 9 software. The task-oriented section is followed -by *Chapter 4*, which is organized as a reference manual to aid in the ongoing -maintenance of the software. *Chapter 5* contains more advanced concepts that -the system administrator may need for implementing certain options. *Chapter 6* -addresses security considerations, and *Chapter 7* contains troubleshooting help. -The main body of the document is followed by several *appendices* which contain -useful reference information, such as a *bibliography* and historic -information related to BIND and the Domain Name System. +:ref:`introduction` introduces the basic DNS and BIND concepts. Some tutorial material on +:ref:`dns_overview` is presented for those unfamiliar with DNS. A +:ref:`intro_dns_security` is provided to allow BIND operators to implement +appropriate security for their operational environment. + +:ref:`requirements` describes the hardware and environment requirements for BIND 9 +and lists both the supported and unsupported platforms. + +:ref:`configuration` is intended as a quickstart guide for newer users. Sample files +are included for :ref:`config_auth_samples` (both :ref:`primary` and +:ref:`secondary`), as well as a simple :ref:`config_resolver_samples` and +a :ref:`sample_forwarding`. Some reference material on the :ref:`Zone File` is included. + +:ref:`ns_operations` covers basic BIND 9 software and DNS operations, including some +useful tools, Unix signals, and plugins. + +:ref:`advanced` builds on the configurations of :ref:`configuration`, adding +functions and features the system administrator may need. + +:ref:`security` covers most aspects of BIND 9 security, including file permissions, +running BIND 9 in a "jail," and securing file transfers and dynamic updates. + +:ref:`dnssec` describes the theory and practice of cryptographic authentication of DNS +information. The :ref:`dnssec_guide` is a practical guide to implementing DNSSEC. + +:ref:`Reference` gives exhaustive descriptions of all supported clauses, statements, +and grammars used in BIND 9's ``named.conf`` configuration file. + +:ref:`troubleshooting` provides information on identifying and solving BIND 9 and DNS +problems. Information about bug-reporting procedures is also provided. + +:ref:`build_bind` is a definitive guide for those occasions where the user requires +special options not provided in the standard Linux or Unix distributions. + +The **Appendices** contain useful reference information, such as a bibliography and historic +information related to BIND and the Domain Name System, as well as the current *man* +pages for all the published tools. .. _conventions: Conventions Used in This Document --------------------------------- -In this document, we generally use ``Fixed Width`` text to indicate the +In this document, we generally use ``fixed-width`` text to indicate the following types of information: - pathnames @@ -70,242 +97,4 @@ following types of information: - keywords - variables -Text in "quotes," **bold**, or *italics* is also used for emphasis or clarity. - -.. _dns_overview: - -The Domain Name System (DNS) ----------------------------- - -This document explains the installation and upkeep -of the BIND (Berkeley Internet Name Domain) software package. We -begin by reviewing the fundamentals of the Domain Name System (DNS) as -they relate to BIND. - -.. _dns_fundamentals: - -DNS Fundamentals -~~~~~~~~~~~~~~~~ - -The Domain Name System (DNS) is a hierarchical, distributed database. It -stores information for mapping Internet host names to IP addresses and -vice versa, mail routing information, and other data used by Internet -applications. - -Clients look up information in the DNS by calling a *resolver* library, -which sends queries to one or more *name servers* and interprets the -responses. The BIND 9 software distribution contains a name server, -:iscman:`named`, and a set of associated tools. - -.. _domain_names: - -Domains and Domain Names -~~~~~~~~~~~~~~~~~~~~~~~~ - -The data stored in the DNS is identified by *domain names* that are -organized as a tree according to organizational or administrative -boundaries. Each node of the tree, called a *domain*, is given a label. -The domain name of the node is the concatenation of all the labels on -the path from the node to the *root* node. This is represented in -written form as a string of labels listed from right to left and -separated by dots. A label need only be unique within its parent domain. - -For example, a domain name for a host at the company *Example, Inc.* -could be ``ourhost.example.com``, where ``com`` is the top-level domain -to which ``ourhost.example.com`` belongs, ``example`` is a subdomain of -``com``, and ``ourhost`` is the name of the host. - -For administrative purposes, the name space is partitioned into areas -called *zones*, each starting at a node and extending down to the "leaf" -nodes or to nodes where other zones start. The data for each zone is -stored in a *name server*, which answers queries about the zone using -the *DNS protocol*. - -The data associated with each domain name is stored in the form of -*resource records* (RRs). Some of the supported resource record types -are described in :ref:`types_of_resource_records_and_when_to_use_them`. - -For more detailed information about the design of the DNS and the DNS -protocol, please refer to the standards documents listed in :ref:`rfcs`. - -Zones -~~~~~ - -To properly operate a name server, it is important to understand the -difference between a *zone* and a *domain*. - -As stated previously, a zone is a point of delegation in the DNS tree. A -zone consists of those contiguous parts of the domain tree for which a -name server has complete information and over which it has authority. It -contains all domain names from a certain point downward in the domain -tree except those which are delegated to other zones. A delegation point -is marked by one or more *NS records* in the parent zone, which should -be matched by equivalent NS records at the root of the delegated zone. - -For instance, consider the ``example.com`` domain, which includes names -such as ``host.aaa.example.com`` and ``host.bbb.example.com``, even -though the ``example.com`` zone includes only delegations for the -``aaa.example.com`` and ``bbb.example.com`` zones. A zone can map -exactly to a single domain, but could also include only part of a -domain, the rest of which could be delegated to other name servers. -Every name in the DNS tree is a *domain*, even if it is *terminal*, that -is, has no *subdomains*. Every subdomain is a domain and every domain -except the root is also a subdomain. The terminology is not intuitive -and we suggest reading :rfc:`1033`, :rfc:`1034`, and :rfc:`1035` to gain a complete -understanding of this difficult and subtle topic. - -Though BIND 9 is called a "domain name server," it deals primarily in -terms of zones. The ``primary`` and ``secondary`` declarations in the :iscman:`named.conf` -file specify zones, not domains. When BIND asks some other site if it is -willing to be a secondary server for a *domain*, it is actually asking -for secondary service for some collection of *zones*. - -.. _auth_servers: - -Authoritative Name Servers -~~~~~~~~~~~~~~~~~~~~~~~~~~ - -Each zone is served by at least one *authoritative name server*, which -contains the complete data for the zone. To make the DNS tolerant of -server and network failures, most zones have two or more authoritative -servers, on different networks. - -Responses from authoritative servers have the "authoritative answer" -(AA) bit set in the response packets. This makes them easy to identify -when debugging DNS configurations using tools like :iscman:`dig` (:ref:`diagnostic_tools`). - -.. _primary_master: - -The Primary Server -^^^^^^^^^^^^^^^^^^ - -The authoritative server, where the main copy of the zone data is -maintained, is called the *primary* (formerly *master*) server, or simply the -*primary*. Typically it loads the zone contents from some local file -edited by humans or perhaps generated mechanically from some other local -file which is edited by humans. This file is called the *zone file* or -*master file*. - -In some cases, however, the master file may not be edited by humans at -all, but may instead be the result of *dynamic update* operations. - -.. _secondary_server: - -Secondary Servers -^^^^^^^^^^^^^^^^^ - -The other authoritative servers, the *secondary* servers (formerly known as -*slave* servers) load the zone contents from another server using a -replication process known as a *zone transfer*. Typically the data is -transferred directly from the primary, but it is also possible to -transfer it from another secondary. In other words, a secondary server may -itself act as a primary to a subordinate secondary server. - -Periodically, the secondary server must send a refresh query to determine -whether the zone contents have been updated. This is done by sending a -query for the zone's Start of Authority (SOA) record and checking whether the SERIAL field -has been updated; if so, a new transfer request is initiated. The timing -of these refresh queries is controlled by the SOA REFRESH and RETRY -fields, but can be overridden with the ``max-refresh-time``, -``min-refresh-time``, ``max-retry-time``, and ``min-retry-time`` -options. - -If the zone data cannot be updated within the time specified by the SOA -EXPIRE option (up to a hard-coded maximum of 24 weeks), the secondary -zone expires and no longer responds to queries. - -.. _stealth_server: - -Stealth Servers -^^^^^^^^^^^^^^^ - -Usually, all of the zone's authoritative servers are listed in NS -records in the parent zone. These NS records constitute a *delegation* -of the zone from the parent. The authoritative servers are also listed -in the zone file itself, at the *top level* or *apex* of the zone. -Servers that are not in the parent's NS delegation can be listed in the -zone's top-level NS records, but servers that are not present at the -zone's top level cannot be listed in the parent's delegation. - -A *stealth server* is a server that is authoritative for a zone but is -not listed in that zone's NS records. Stealth servers can be used for -keeping a local copy of a zone, to speed up access to the zone's records -or to make sure that the zone is available even if all the "official" -servers for the zone are inaccessible. - -A configuration where the primary server itself is a stealth -server is often referred to as a "hidden primary" configuration. One use -for this configuration is when the primary is behind a firewall -and is therefore unable to communicate directly with the outside world. - -.. _cache_servers: - -Caching Name Servers -~~~~~~~~~~~~~~~~~~~~ - -The resolver libraries provided by most operating systems are *stub -resolvers*, meaning that they are not capable of performing the full DNS -resolution process by themselves by talking directly to the -authoritative servers. Instead, they rely on a local name server to -perform the resolution on their behalf. Such a server is called a -*recursive* name server; it performs *recursive lookups* for local -clients. - -To improve performance, recursive servers cache the results of the -lookups they perform. Since the processes of recursion and caching are -intimately connected, the terms *recursive server* and *caching server* -are often used synonymously. - -The length of time for which a record may be retained in the cache of a -caching name server is controlled by the Time-To-Live (TTL) field -associated with each resource record. - -.. _forwarder: - -Forwarding -^^^^^^^^^^ - -Even a caching name server does not necessarily perform the complete -recursive lookup itself. Instead, it can *forward* some or all of the -queries that it cannot satisfy from its cache to another caching name -server, commonly referred to as a *forwarder*. - -Forwarders are typically used when an administrator does not wish for -all the servers at a given site to interact directly with the rest of -the Internet. For example, a common scenario is when multiple internal -DNS servers are behind an Internet firewall. Servers behind the firewall -forward their requests to the server with external access, which queries -Internet DNS servers on the internal servers' behalf. - -Another scenario (largely now superseded by Response Policy Zones) is to -send queries first to a custom server for RBL processing before -forwarding them to the wider Internet. - -There may be one or more forwarders in a given setup. The order in which -the forwarders are listed in :iscman:`named.conf` does not determine the -sequence in which they are queried; rather, :iscman:`named` uses the response -times from previous queries to select the server that is likely to -respond the most quickly. A server that has not yet been queried is -given an initial small random response time to ensure that it is tried -at least once. Dynamic adjustment of the recorded response times ensures -that all forwarders are queried, even those with slower response times. -This permits changes in behavior based on server responsiveness. - -.. _multi_role: - -Name Servers in Multiple Roles -~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -The BIND name server can simultaneously act as a primary for some zones, -a secondary for other zones, and as a caching (recursive) server for a set -of local clients. - -However, since the functions of authoritative name service and -caching/recursive name service are logically separate, it is often -advantageous to run them on separate server machines. A server that only -provides authoritative name service (an *authoritative-only* server) can -run with recursion disabled, improving reliability and security. A -server that is not authoritative for any zones and only provides -recursive service to local clients (a *caching-only* server) does not -need to be reachable from the Internet at large and can be placed inside -a firewall. +Text in "quotes," **bold text**, or *italics* is also used for emphasis or clarity. diff --git a/doc/arm/name-resolution.dia b/doc/arm/name-resolution.dia new file mode 100644 index 0000000000000000000000000000000000000000..272169f5ad458f91727fb842f7b258300c2b6c60 GIT binary patch literal 3084 zcmV+n4D<6JiwFP!000023+-K7Z`(K)e$THk+?N@^WyCulmR*ZjpfAZ@*4u4Vq7J0ZFsVCAxzk4^nD$DC%PEYUd?m%*1gk_e4 zB)$Pfbo#$ANy1ar=yd%4WHfr-!8|NO{n_f%uq^X3m$Z zTD6;HNtTap!{pug&82ybPgmWXuJ!Xm-`C+Hn&wgXt-0$!y`*f@^>vhQcDuaJidZ!% z@2|I-H1wnY`>f5XRiPTCi}!CnkT=y=T7B@;SKSwF6jCn3d=aPHa@5=;)kGj55JGA) zs1!2bgu{n9Ib7VdUvWvl;_`mQ#l^*SmX~=Lm)jzzS(Zd$T1hSQo2b23tSQ`;Zcpv4f?ms>))1%c7yh5B&I4k4Zhj-8BB%A&xnw6`;o|j=d5A*rx z?dW6nef-2h6a$Ip@5cWM)+cLoc&amngIlw8ojs})LV!#J2fa!Fz|6GkA zOczP?C}2fRI7dPF!)7-Cfks)ZJ_FAyU-h8(kFTeG+X7 zh|-&7)jQeIb@gFocdZQ(+8Sa2IGqqc9NM80p(J2>rYvy60irI=&~7~YSRs2<)zynS zv_b^dWBrB zj7ACpoY6B32tibdPLdzo~JY*V=9P*uQ^1Z*a0-V5UuOPL`H+vh?Sp z%WxSd_v$N!X)zuds8?&Eg5B!be?-Y`RK~OL?Z+&cKj(Xge~&E;sB<6`u@G3lBn=>j z0ko63u7!JRVjEGLD9{+$2?9Go$|YW;%c%ZGeOj0Il~PN|53`J0^Oc$@0`3KrustYY zG+}@+r;voTx(NkI3X7P6BnB8fen85ztbAKUxt{eO5}ATcKOrFQp=nDWJun?JFxC4m z#NKxiNV(jMQMcX;*FvE2U-$$c1s(!wfP2N8G4CQ$qPj)U$JYB9=D)sc4yb>tmM>NxgpIkqFT&OwIX z_q5LGl(UGx9_!@R)`>xY73rhUv26+^gfL^7LUUQ-)-WxHb&O^y)>3e<$trc-)^lHX z=vFDL17BEYlLWxrX*6C*(LxYCgAzz>mCUJCS`X{!%n}2HNC%nmlD(1(-6U_o9aiYbkKeEqXYqbtbWvsqj%~&YucrX9+rj( zOI_4IN{tcRF)US5AcREMKvD*)brB+T{K)k6kKaeXXUi~7J#p%-3UXU3Jwgo;p-2Y^ z1t*G0bK(}Dj1Y*J1}I4cL;Af$d;kFTXA$Kdq54LsEv@tbHAH}-9RL*31zG}f#~jLt z39xeQu--+Y)Guf))4O)B)3vM9MGs6v1SadUSZFpALBJfxoQ#+NP$((GX9xi(bUitc zmjh8i)WpN2*%o^hh;Cq_Qs&rpndVWhQP53lIj3 z=;}bq=o#XGOA{YwFc<(#otHP$6JKA@E1jy>%hv!>@P`8_>xyYa05N-H1E(7qDk*_l zkPSvbyecnX11K+;`SOAuV^FmU=^4}z!AW+o$%;uG5yEbxP%AlDZ%$U|#Gna7(Lscv zKIYk7;ki>^+^Jq8Jw6Q(pHR>NdD8AaRodW|JYkc!)yy z4CAoD)dXZ88qr;?Y_`{$(}j2LK}9PRKvDzRoX%a%(PP){X6Q*oSMxK=(o`9)!k1!e>3{gk=t`lIUNaQ{m6