diff options
| author | erwin <erwin@FreeBSD.org> | 2013-08-14 11:10:02 +0000 |
|---|---|---|
| committer | erwin <erwin@FreeBSD.org> | 2013-08-14 11:10:02 +0000 |
| commit | f32b4abce98c97ee6e51b7aa8f8fde6e4cab7f28 (patch) | |
| tree | 2158e1c09a984412fbfaaf073f515cd4e8f1ea60 | |
| parent | c110f0c4dc517517abacd7bc7c5d0d41325a4057 (diff) | |
| download | FreeBSD-src-f32b4abce98c97ee6e51b7aa8f8fde6e4cab7f28.zip FreeBSD-src-f32b4abce98c97ee6e51b7aa8f8fde6e4cab7f28.tar.gz | |
Vendor import of Bind 9.9.3-P2
Approved by: delphij (mentor, implicit)
Sponsored by: DK Hostmaster A/S
331 files changed, 27594 insertions, 13983 deletions
@@ -1,15 +1,15 @@ - --- 9.8.5-P2 released --- + --- 9.9.3-P2 released --- 3621. [security] Incorrect bounds checking on private type 'keydata' can lead to a remotely triggerable REQUIRE failure (CVE-2013-4854). [RT #34238] - --- 9.8.5-P1 released --- + --- 9.9.3-P1 released --- 3584. [security] Caching data from an incompletely signed zone could trigger an assertion failure in resolver.c [RT #33690] - --- 9.8.5 released --- + --- 9.9.3 released --- 3568. [cleanup] Add a product description line to the version file, to be reported by named -v/-V. [RT #33366] @@ -21,7 +21,7 @@ 3561. [bug] dig: issue a warning if an EDNS query returns FORMERR or NOTIMP. Adjust usage message. [RT #33363] - --- 9.8.5rc1 released --- + --- 9.9.3rc2 released --- 3560. [bug] isc-config.sh did not honor includedir and libdir when set via configure. [RT #33345] @@ -31,6 +31,8 @@ 3558. [bug] IXFR of a DLZ stored zone was broken. [RT #33331] +3557. [bug] Reloading redirect zones was broken. [RT #33292] + 3556. [maint] Added AAAA for D.ROOT-SERVERS.NET. 3555. [bug] Address theoretical race conditions in acache.c @@ -51,9 +53,7 @@ 3547. [bug] Some malformed unknown rdata records were not properly detected and rejected. [RT #33129] -3056. [func] Added support for URI resource record. [RT #23386] - - --- 9.8.5rc1 released --- + --- 9.9.3rc1 released --- 3546. [func] Add EUI48 and EUI64 types. [RT #33082] @@ -64,8 +64,6 @@ 3543. [bug] Update socket structure before attaching to socket manager after accept. [RT #33084] -3542. [bug] masterformat system test was broken. [RT #33086] - 3541. [bug] Parts of libdns were not properly initialized when built in libexport mode. [RT #33028] @@ -94,6 +92,17 @@ 3530. [contrib] Better RTT tracking in queryperf. [RT #30128] +3528. [func] New "dnssec-coverage" command scans the timing + metadata for a set of DNSSEC keys and reports if a + lapse in signing coverage has been scheduled + inadvertently. (Note: This tool depends on python; + it will not be built or installed on systems that + do not have a python interpreter.) [RT #28098] + +3527. [compat] Add a URI to allow applications to explicitly + request a particular XML schema from the statistics + channel, returning 404 if not supported. [RT #32481] + 3526. [cleanup] Set up dependencies for unit tests correctly during build. [RT #32803] @@ -102,7 +111,7 @@ 3520. [bug] 'mctx' was not being referenced counted in some places where it should have been. [RT #32794] - --- 9.8.5b2 released --- + --- 9.9.3b2 released --- 3517. [bug] Reorder destruction to avoid shutdown race. [RT #32777] @@ -114,6 +123,8 @@ to 1024 bits for hmac-sha384 and hmac-sha512. [RT #32753] +3511. [doc] Improve documentation of redirect zones. [RT #32756] + 3509. [cleanup] Added a product line to version file to allow for easy naming of different products (BIND vs BIND ESV, for example). [RT #32755] @@ -121,8 +132,24 @@ 3508. [contrib] queryperf was incorrectly rejecting the -T option. [RT #32338] +3507. [bug] Statistics channel XSL (when built with + --enable-newstats) had a glitch when attempting + to chart query data before any queries had been + received. [RT #32620] + +3505. [bug] When setting "max-cache-size" and "max-acache-size", + larger values than 4 gigabytes could not be set + explicitly, though larger sizes were available + when setting cache size to 0. This has been + corrected; the full range is now available. + [RT #32358] + 3503. [doc] Clarify size_spec syntax. [RT #32449] +3501. [func] zone-statistics now takes three options: full, + terse, and none. "yes" and "no" are retained as + synonyms for full and terse, respectively. [RT #29165] + 3500. [security] Support NAPTR regular expression validation on all platforms without using libregex, which can be vulnerable to memory exhaustion attack @@ -141,6 +168,15 @@ NSIP and NSDNAME checking. --enable-rpz-nsip and --enable-rpz-nsdname are now the default. [RT #32251] +3493. [contrib] Added BDBHPT dynamically-lodable DLZ module, + contributed by Mark Goldfinch. [RT #32549] + +3492. [bug] Fixed a regression in zone loading performance + due to lock contention. [RT #30399] + +3491. [bug] Slave zones using inline-signing must specify a + file name. [RT #31946] + 3489. [bug] --enable-developer now turns on ISC_LIST_CHECKINIT. When cloning a rdataset do not copy the link contents. [RT #32651] @@ -156,8 +192,14 @@ 3485. [cleanup] Only compile openssl_gostlink.c if we support GOST. +3483. [bug] Corrected XSL code in use with --enable-newstats. + [RT #32587] + 3481. [cleanup] Removed use of const const in atf. +3480. [bug] Silence logging noise when setting up zone + statistics. [RT #32525] + 3479. [bug] Address potential memory leaks in gssapi support code. [RT #32405] @@ -167,10 +209,18 @@ 3474. [bug] nsupdate could assert when the local and remote address families didn't match. [RT #22897] +3473. [bug] dnssec-signzone/verify could incorrectly report + an error condition due to an empty node above an + opt-out delegation lacking an NSEC3. [RT #32072] + +3471. [bug] The number of UDP dispatches now defaults to + the number of CPUs even if -n has been set to + a higher value. [RT #30964] + 3470. [bug] Slave zones could fail to dump when successfully refreshing after an initial failure. [RT #31276] - --- 9.8.5b1 released --- + --- 9.9.3b1 released --- 3468. [security] RPZ rules to generate A records (but not AAAA records) could trigger an assertion failure when used in @@ -179,6 +229,9 @@ 3467. [bug] Added checks in dnssec-keygen and dnssec-settime to check for delete date < inactive date. [RT #31719] +3466. [contrib] Corrected the DNS_CLIENTINFOMETHODS_VERSION check + in DLZ example driver. [RT #32275] + 3465. [bug] Handle isolated reserved ports. [RT #31778] 3464. [maint] Updates to PKCS#11 openssl patches, supporting @@ -192,6 +245,8 @@ 3461. [bug] Negative responses could incorrectly have AD=1 set. [RT #32237] +3460. [bug] Only link against readline where needed. [RT #29810] + 3458. [bug] Return FORMERR when presented with a overly long domain named in a request. [RT #29682] @@ -203,6 +258,9 @@ 3454. [port] sparc64: improve atomic support. [RT #25182] +3453. [bug] 'rndc addzone' of a zone with 'inline-signing yes;' + failed. [RT #31960] + 3452. [bug] Accept duplicate singleton records. [RT #32329] 3451. [port] Increase per thread stack size from 64K to 1M. @@ -266,9 +324,19 @@ 3427. [bug] dig +trace incorrectly displayed name server addresses instead of names. [RT #31641] +3426. [bug] dnssec-checkds: Clearer output when records are not + found. [RT #31968] + 3425. [bug] "acacheentry" reference counting was broken resulting in use after free. [RT #31908] +3424. [func] dnssec-dsfromkey now emits the hash without spaces. + [RT #31951] + +3423. [bug] "rndc signing -nsec3param" didn't accept the full + range of possible values. Address portability issues. + [RT #31938] + 3422. [bug] Added a clear error message for when the SOA does not match the referral. [RT #31281] @@ -279,9 +347,22 @@ 3419. [bug] Memory leak on validation cancel. [RT #31869] +3417. [func] Optional new XML schema (version 3.0) for the + statistics channel adds query type statistics at the + zone level, and flattens the XML tree and uses + compressed format to optimize parsing. Includes new XSL + that permits charting via the Google Charts API on + browsers that support javascript in XSL. To enable, + build with "configure --enable-newstats". [RT #30023] + +3416. [bug] Named could die on shutdown if running with 128 UDP + dispatches per interface. [RT #31743] + 3415. [bug] named could die with a REQUIRE failure if a validation was canceled. [RT #31804] +3414. [bug] Address locking issues found by Coverity. [RT #31626] + 3412. [bug] Copy timeval structure from control message data. [RT #31548] @@ -295,6 +376,11 @@ (DNS-based Authentication of Named Entities). [RT #30513] +3408. [bug] Some DNSSEC-related options (update-check-ksk, + dnssec-loadkeys-interval, dnssec-dnskey-kskonly) + are now legal in slave zones as long as + inline-signing is in use. [RT #31078] + 3406. [bug] mem.c: Fix compilation errors when building with ISC_MEM_TRACKLINES or ISC_MEMPOOL_NAMES disabled. Also, ISC_MEM_DEBUG is no longer optional. [RT #31559] @@ -316,6 +402,13 @@ in the "srcid" file in the build tree and normally set to the most recent git hash. [RT #31494] +3399. [port] netbsd: rename 'bool' parameter to avoid namespace + clash. [RT #31515] + +3398. [bug] SOA parameters were not being updated with inline + signed zones if the zone was modified while the + server was offline. [RT #29272] + 3397. [bug] dig crashed when using +nssearch with +tcp. [RT #25298] 3396. [bug] OPT records were incorrectly removed from signed, @@ -348,11 +441,10 @@ 3386. [bug] Address locking violation when generating new NSEC / NSEC3 chains. [RT #31224] -3384. [bug] Improved logging of crypto errors. [RT #30963] +3385. [bug] named-checkconf didn't detect missing master lists + in also-notify clauses. [RT #30810] -3383. [security] A certain combination of records in the RBT could - cause named to hang while populating the additional - section of a response. [RT #31090] +3384. [bug] Improved logging of crypto errors. [RT #30963] 3382. [bug] SOA query from slave used use-v6-udp-ports range, if set, regardless of the address family in use. @@ -370,6 +462,9 @@ 3378. [bug] Handle missing 'managed-keys-directory' better. [RT #30625] +3377. [bug] Removed spurious newline from NSEC3 multiline + output. [RT #31044] + 3376. [bug] Lack of EDNS support was being recorded without a successful response. [RT #30811] @@ -386,19 +481,34 @@ add NS RRsets to the additional section or not. [RT #30479] - --- 9.8.4 released --- +3316. [tuning] Improved locking performance when recursing. + [RT #28836] + +3315. [tuning] Use multiple dispatch objects for sending upstream + queries; this can improve performance on busy + multiprocessor systems by reducing lock contention. + [RT #28605] + + --- 9.9.2 released --- + +3383. [security] A certain combination of records in the RBT could + cause named to hang while populating the additional + section of a response. [RT #31090] 3373. [bug] win32: open raw files in binary mode. [RT #30944] 3364. [security] Named could die on specially crafted record. [RT #30416] - --- 9.8.4rc1 released --- + --- 9.9.2rc1 released --- + +3370. [bug] Address use after free while shutting down. [RT #30241] 3369. [bug] nsupdate terminated unexpectedly in interactive mode if built with readline support. [RT #29550] -3368. [bug] <dns/iptable.h> and <dns/zone.h> were not C++ safe. +3368. [bug] <dns/iptable.h>, <dns/private.h> and <dns/zone.h> + were not C++ safe. 3367. [bug] dns_dnsseckey_create() result was not being checked. [RT #30685] @@ -417,6 +527,9 @@ could trigger an assertion failure on startup. [RT #27730] +3361. [bug] "rndc signing -nsec3param" didn't work correctly + when salt was set to '-' (no salt). [RT #30099] + 3360. [bug] 'host -w' could die. [RT #18723] 3359. [bug] An improperly-formed TSIG secret could cause a @@ -428,10 +541,12 @@ approaching their expiry, so they don't remain in caches after expiry. [RT #26429] - --- 9.8.4b1 released --- +3355. [port] Use more portable awk in verify system test. 3354. [func] Improve OpenSSL error logging. [RT #29932] + --- 9.9.2b1 released --- + 3353. [bug] Use a single task for task exclusive operations. [RT #29872] @@ -446,6 +561,8 @@ ISC_MEM_DEBUGCTX memory debugging flag is set. [RT #30240] +3349. [bug] Change #3345 was incomplete. [RT #30233] + 3348. [bug] Prevent RRSIG data from being cached if a negative record matching the covering type exists at a higher trust level. Such data already can't be retrieved from @@ -459,16 +576,42 @@ 3346. [security] Bad-cache data could be used before it was initialized, causing an assert. [RT #30025] +3345. [bug] Addressed race condition when removing the last item + or inserting the first item in an ISC_QUEUE. + [RT #29539] + +3344. [func] New "dnssec-checkds" command checks a zone to + determine which DS records should be published + in the parent zone, or which DLV records should be + published in a DLV zone, and queries the DNS to + ensure that it exists. (Note: This tool depends + on python; it will not be built or installed on + systems that do not have a python interpreter.) + [RT #28099] + 3342. [bug] Change #3314 broke saving of stub zones to disk resulting in excessive cpu usage in some cases. [RT #29952] +3341. [func] New "dnssec-verify" command checks a signed zone + to ensure correctness of signatures and of NSEC/NSEC3 + chains. [RT #23673] + +3339. [func] Allow the maximum supported rsa exponent size to be + specified: "max-rsa-exponent-size <value>;" [RT #29228] + +3338. [bug] Address race condition in units tests: asyncload_zone + and asyncload_zt. [RT #26100] + 3337. [bug] Change #3294 broke support for the multiple keys in controls. [RT #29694] 3335. [func] nslookup: return a nonzero exit code when unable to get an answer. [RT #29492] +3334. [bug] Hold a zone table reference while performing a + asynchronous load of a zone. [RT #28326] + 3333. [bug] Setting resolver-query-timeout too low can cause named to not recover if it loses connectivity. [RT #29623] @@ -504,7 +647,7 @@ 3317. [func] Add ECDSA support (RFC 6605). [RT #21918] - --- 9.8.3 released --- + --- 9.9.1 released --- 3318. [tuning] Reduce the amount of work performed while holding a bucket lock when finished with a fetch context. @@ -536,6 +679,8 @@ 3304. [bug] Use hmctx, not mctx when freeing rbtdb->heaps. [RT #28571] +3303. [bug] named could die when reloading. [RT #28606] + 3302. [bug] dns_dnssec_findmatchingkeys could fail to find keys if the zone name contained character that required special mappings. [RT #28600] @@ -549,22 +694,15 @@ 3299. [bug] Make SDB handle errors from database drivers better. [RT #28534] -3232. [bug] Zero zone->curmaster before return in - dns_zone_setmasterswithkeys(). [RT #26732] - -3183. [bug] Added RTLD_GLOBAL flag to dlopen call. [RT #26301] - -3197. [bug] Don't try to log the filename and line number when - the config parser can't open a file. [RT #22263] - - --- 9.8.2 released --- - 3298. [bug] Named could dereference a NULL pointer in zmgr_start_xfrin_ifquota if the zone was being removed. [RT #28419] 3297. [bug] Named could die on a malformed master file. [RT #28467] +3296. [bug] Named could die with a INSIST failure in + client.c:exit_check. [RT #28346] + 3295. [bug] Adjust isc_time_secondsastimet range check to be more portable. [RT # 26542] @@ -576,6 +714,16 @@ 3290. [bug] <isc/hmacsha.h> was not being installed. [RT #28169] +3273. [bug] AAAA responses could be returned in the additional + section even when filter-aaaa-on-v4 was in use. + [RT #27292] + + --- 9.9.0 released --- + + --- 9.9.0rc4 released --- + +3289. [bug] 'rndc retransfer' failed for inline zones. [RT #28036] + 3288. [bug] dlz_destroy() function wasn't correctly registered by the DLZ dlopen driver. [RT #28056] @@ -584,7 +732,7 @@ 3286. [bug] Managed key maintenance timer could fail to start after 'rndc reconfig'. [RT #26786] - --- 9.8.2rc2 released --- + --- 9.9.0rc3 released --- 3285. [bug] val-frdataset was incorrectly disassociated in proveunsecure after calling startfinddlvsep. @@ -607,24 +755,34 @@ 3280. [bug] Potential double free of a rdataset on out of memory with DNS64. [RT #27762] +3279. [bug] Hold a internal reference to the zone while performing + a asynchronous load. Address potential memory leak + if the asynchronous is cancelled. [RT #27750] + 3278. [bug] Make sure automatic key maintenance is started when "auto-dnssec maintain" is turned on during "rndc reconfig". [RT #26805] +3277. [bug] win32: isc_socket_dup is not implemented. [RT #27696] + 3276. [bug] win32: ns_os_openfile failed to return NULL on safe_open failure. [RT #27696] -3274. [bug] Log when a zone is not reusable. Only set loadtime - on successful loads. [RT #27650] - -3273. [bug] AAAA responses could be returned in the additional - section even when filter-aaaa-on-v4 was in use. - [RT #27292] +3275. [bug] Corrected rndc -h output; the 'rndc sync -clean' + option had been misspelled as '-clear'. (To avoid + future confusion, both options now work.) [RT #27173] 3271. [port] darwin: mksymtbl is not always stable, loop several times before giving up. mksymtbl was using non portable perl to covert 64 bit hex strings. [RT #27653] + --- 9.9.0rc2 released --- + +3270. [bug] "rndc reload" didn't reuse existing zones correctly + when inline-signing was in use. [RT #27650] + +3269. [port] darwin 11 and later now built threaded by default. + 3268. [bug] Convert RRSIG expiry times to 64 timestamps to work out the earliest expiry time. [RT #23311] @@ -636,14 +794,26 @@ DNSKEY RRset was not being properly computed. [RT #26543] +3265. [bug] Corrected a problem with lock ordering in the + inline-signing code. [RT #27557] + +3264. [bug] Automatic regeneration of signatures in an + inline-signing zone could stall when the server + was restarted. [RT #27344] + +3263. [bug] "rndc sync" did not affect the unsigned side of an + inline-signing zone. [RT #27337] + 3262. [bug] Signed responses were handled incorrectly by RPZ. [RT #27316] - --- 9.8.2rc1 released --- +3261. [func] RRset ordering now defaults to random. [RT #27174] 3260. [bug] "rrset-order cyclic" could appear not to rotate for some query patterns. [RT #27170/27185] + --- 9.9.0rc1 released --- + 3259. [bug] named-compilezone: Suppress "dump zone to <file>" message when writing to stdout. [RT #27109] @@ -655,12 +825,21 @@ 3256. [bug] Disable empty zones for lwresd -C. [RT #27139] +3255. [func] No longer require that a empty zones be explicitly + enabled or that a empty zone is disabled for + RFC 1918 empty zones to be configured. [RT #27139] + 3254. [bug] Set isc_socket_ipv6only() on the IPv6 control channels. [RT #22249] 3253. [bug] Return DNS_R_SYNTAX when the input to a text field is too long. [RT #26956] +3252. [bug] When master zones using inline-signing were + updated while the server was offline, the source + zone could fall out of sync with the signed + copy. They can now resynchronize. [RT #26676] + 3251. [bug] Enforce a upper bound (65535 bytes) on the amount of memory dns_sdlz_putrr() can allocate per record to prevent run away memory consumption on ISC_R_NOSPACE. @@ -680,8 +859,34 @@ 3247. [bug] 'raw' format zones failed to preserve load order breaking 'fixed' sort order. [RT #27087] -3243. [port] netbsd,bsdi: the thread defaults were not being - properly set. +3246. [bug] Named failed to start with a empty also-notify list. + [RT #27087] + +3245. [bug] Don't report a error unchanged serials unless there + were other changes when thawing a zone with + ixfr-fromdifferences. [RT #26845] + +3244. [func] Added readline support to nslookup and nsupdate. + Also simplified nsupdate syntax to make "update" + and "prereq" optional. [RT #24659] + +3243. [port] freebsd,netbsd,bsdi: the thread defaults were not + being properly set. + +3242. [func] Extended the header of raw-format master files to + include the serial number of the zone from which + they were generated, if different (as in the case + of inline-signing zones). This is to be used in + inline-signing zones, to track changes between the + unsigned and signed versions of the zone, which may + have different serial numbers. + + (Note: raw zonefiles generated by this version of + BIND are no longer compatible with prior versions. + To generate a backward-compatible raw zonefile + using dnssec-signzone or named-compilezone, specify + output format "raw=0" instead of simply "raw".) + [RT #26587] 3241. [bug] Address race conditions in the resolver code. [RT #26889] @@ -696,10 +901,21 @@ 3237. [bug] dig -6 didn't work with +trace. [RT #26906] - --- 9.8.2b1 released --- +3236. [bug] Backed out changes #3182 and #3202, related to + EDNS(0) fallback behavior. [RT #26416] + +3235. [func] dns_db_diffx, a extended dns_db_diff which returns + the generated diff and optionally writes it to a + journal. [RT #26386] 3234. [bug] 'make depend' produced invalid makefiles. [RT #26830] +3233. [bug] 'rndc freeze/thaw' didn't work for inline zones. + [RT #26632] + +3232. [bug] Zero zone->curmaster before return in + dns_zone_setmasterswithkeys(). [RT #26732] + 3231. [bug] named could fail to send a incompressible zone. [RT #26796] @@ -717,14 +933,29 @@ 3226. [bug] Address minor resource leakages. [RT #26624] +3225. [bug] Silence spurious "setsockopt(517, IPV6_V6ONLY) failed" + messages. [RT #26507] + +3224. [bug] 'rndc signing' argument parsing was broken. [RT #26684] + +3223. [bug] 'task_test privilege_drop' generated false positives. + [RT #26766] + +3222. [cleanup] Replace dns_journal_{get,set}_bitws with + dns_journal_{get,set}_sourceserial. [RT #26634] + 3221. [bug] Fixed a potential core dump on shutdown due to referencing fetch context after it's been freed. [RT #26720] + --- 9.9.0b2 released --- + 3220. [bug] Change #3186 was incomplete; dns_db_rpz_findips() could fail to set the database version correctly, causing an assertion failure. [RT #26180] +3219. [bug] Disable NOEDNS caching following a timeout. + 3218. [security] Cache lookup could return RRSIG data associated with nonexistent records, leading to an assertion failure. [RT #26590] @@ -733,12 +964,24 @@ 3216. [bug] resolver.c:validated() was not thread-safe. [RT #26478] +3215. [bug] 'rndc recursing' could cause a core dump. [RT #26495] + +3214. [func] Add 'named -U' option to set the number of UDP + listener threads per interface. [RT #26485] + 3213. [doc] Clarify ixfr-from-differences behavior. [RT #25188] 3212. [bug] rbtdb.c: failed to remove a node from the deadnodes list prior to adding a reference to it leading a possible assertion failure. [RT #23219] +3211. [func] dnssec-signzone: "-f -" prints to stdout; "-O full" + option prints in single-line-per-record format. + [RT #20287] + +3210. [bug] Canceling the oldest query due to recursive-client + overload could trigger an assertion failure. [RT #26463] + 3209. [func] Add "dnssec-lookaside 'no'". [RT #24858] 3208. [bug] 'dig -y' handle unknown tsig algorithm better. @@ -748,6 +991,11 @@ 3206. [cleanup] Add ISC information to log at start time. [RT #25484] +3205. [func] Upgrade dig's defaults to better reflect modern + nameserver behavior. Enable "dig +adflag" and + "dig +edns=0" by default. Enable "+dnssec" when + running "dig +trace". [RT #23497] + 3204. [bug] When a master server that has been marked as unreachable sends a NOTIFY, mark it reachable again. [RT #25960] @@ -755,12 +1003,24 @@ 3203. [bug] Increase log level to 'info' for validation failures from expired or not-yet-valid RRSIGs. [RT #21796] +3202. [bug] NOEDNS caching on timeout was too aggressive. + [RT #26416] + +3201. [func] 'rndc querylog' can now be given an on/off parameter + instead of only being used as a toggle. [RT #18351] + 3200. [doc] Some rndc functions were undocumented or were missing from 'rndc -h' output. [RT #25555] +3199. [func] When logging client information, include the name + being queried. [RT #25944] + 3198. [doc] Clarified that dnssec-settime can alter keyfile permissions. [RT #24866] +3197. [bug] Don't try to log the filename and line number when + the config parser can't open a file. [RT #22263] + 3196. [bug] nsupdate: return nonzero exit code when target zone doesn't exist. [RT #25783] @@ -789,10 +1049,50 @@ 3187. [port] win32: support for Visual Studio 2008. [RT #26356] + --- 9.9.0b1 released --- + 3186. [bug] Version/db mis-match in rpz code. [RT #26180] +3185. [func] New 'rndc signing' option for auto-dnssec zones: + - 'rndc signing -list' displays the current + state of signing operations + - 'rndc signing -clear' clears the signing state + records for keys that have fully signed the zone + - 'rndc signing -nsec3param' sets the NSEC3 + parameters for the zone + The 'rndc keydone' syntax is removed. [RT #23729] + +3184. [bug] named had excessive cpu usage when a redirect zone was + configured. [RT #26013] + +3183. [bug] Added RTLD_GLOBAL flag to dlopen call. [RT #26301] + +3182. [bug] Auth servers behind firewalls which block packets + greater than 512 bytes may cause other servers to + perform poorly. Now, adb retains edns information + and caches noedns servers. [RT #23392/24964] + +3181. [func] Inline-signing is now supported for master zones. + [RT #26224] + +3180. [func] Local copies of slave zones are now saved in raw + format by default, to improve startup performance. + 'masterfile-format text;' can be used to override + the default, if desired. [RT #25867] + 3179. [port] kfreebsd: build issues. [RT #26273] +3178. [bug] A race condition introduced by change #3163 could + cause an assertion failure on shutdown. [RT #26271] + +3177. [func] 'rndc keydone', remove the indicator record that + named has finished signing the zone with the + corresponding key. [RT #26206] + +3176. [doc] Corrected example code and added a README to the + sample external DLZ module in contrib/dlz/example. + [RT #26215] + 3175. [bug] Fix how DNSSEC positive wildcard responses from a NSEC3 signed zone are validated. Stop sending a unnecessary NSEC3 record when generating such @@ -803,9 +1103,14 @@ 3173. [port] Correctly validate root DS responses. [RT #25726] +3172. [port] darwin 10.* and freebsd [89] are now built threaded by + default. + 3171. [bug] Exclusively lock the task when adding a zone using 'rndc addzone'. [RT #25600] + --- 9.9.0a3 released --- + 3170. [func] RPZ update: - fix precedence among competing rules - improve ARM text including documenting rule precedence @@ -820,10 +1125,28 @@ 3169. [func] Catch db/version mis-matches when calling dns_db_*(). [RT #26017] +3168. [bug] Nxdomain redirection could trigger an assert with + a ANY query. [RT #26017] + 3167. [bug] Negative answers from forwarders were not being correctly tagged making them appear to not be cached. [RT #25380] +3166. [bug] Upgrading a zone to support inline-signing failed. + [RT #26014] + +3165. [bug] dnssec-signzone could generate new signatures when + resigning, even when valid signatures were already + present. [RT #26025] + +3164. [func] Enable DLZ modules to retrieve client information, + so that responses can be changed depending on the + source address of the query. [RT #25768] + +3163. [bug] Use finer-grained locking in client.c to address + concurrency problems with large numbers of threads. + [RT #26044] + 3162. [test] start.pl: modified to allow for "named.args" in ns*/ subdirectory to override stock arguments to named. Largely from RT#26044, but no separate ticket. @@ -831,24 +1154,52 @@ 3161. [bug] zone.c:del_sigs failed to always reset rdata leading assertion failures. [RT #25880] +3160. [bug] When printing out a NSEC3 record in multiline form + the newline was not being printed causing type codes + to be run together. [RT #25873] + +3159. [bug] On some platforms, named could assert on startup + when running in a chrooted environment without + /proc. [RT #25863] + +3158. [bug] Recursive servers would prefer a particular UDP + socket instead of using all available sockets. + [RT #26038] + 3157. [tuning] Reduce the time spent in "rndc reconfig" by parsing the config file before pausing the server. [RT #21373] +3156. [placeholder] + + --- 9.9.0a2 released --- + 3155. [bug] Fixed a build failure when using contrib DLZ drivers (e.g., mysql, postgresql, etc). [RT #25710] 3154. [bug] Attempting to print an empty rdataset could trigger an assert. [RT #25452] +3153. [func] Extend request-ixfr to zone level and remove the + side effect of forcing an AXFR. [RT #25156] + 3152. [cleanup] Some versions of gcc and clang failed due to incorrect use of __builtin_expect. [RT #25183] 3151. [bug] Queries for type RRSIG or SIG could be handled incorrectly. [RT #21050] +3150. [func] Improved startup and reconfiguration time by + enabling zones to load in multiple threads. [RT #25333] + +3149. [placeholder] + 3148. [bug] Processing of normal queries could be stalled when forwarding a UPDATE message. [RT #24711] +3147. [func] Initial inline signing support. [RT #23657] + + --- 9.9.0a1 released --- + 3146. [test] Fixed gcc4.6.0 errors in ATF. [RT #25598] 3145. [test] Capture output of ATF unit tests in "./atf.out" if @@ -859,29 +1210,31 @@ 3143. [bug] Silence clang compiler warnings. [RT #25174] -3139. [test] Added tests from RFC 6234, RFC 2202, and RFC 1321 - for the hashing algorithms (md5, sha1 - sha512, and - their hmac counterparts). [RT #25067] - - --- 9.8.1 released --- - - --- 9.8.1rc1 released --- +3142. [bug] NAPTR is class agnostic. [RT #25429] 3141. [bug] Silence spurious "zone serial (0) unchanged" messages associated with empty zones. [RT #25079] +3140. [func] New command "rndc flushtree <name>" clears the + specified name from the server cache along with + all names under it. [RT #19970] + +3139. [test] Added tests from RFC 6234, RFC 2202, and RFC 1321 + for the hashing algorithms (md5, sha1 - sha512, and + their hmac counterparts). [RT #25067] + 3138. [bug] Address memory leaks and out-of-order operations when shutting named down. [RT #25210] +3137. [func] Improve hardware scalability by allowing multiple + worker threads to process incoming UDP packets. + This can significantly increase query throughput + on some systems. [RT #22992] + 3136. [func] Add RFC 1918 reverse zones to the list of built-in empty zones switched on by the 'empty-zones-enable' option. [RT #24990] - Note: empty-zones-enable must be "yes;" or a empty - zone needs to be disabled in named.conf for RFC 1918 - zones to be activated. This requirement may be - removed in future releases. - 3135. [port] FreeBSD: workaround broken IPV6_USE_MIN_MTU processing. See http://www.freebsd.org/cgi/query-pr.cgi?pr=158307 [RT #24950] @@ -889,19 +1242,34 @@ 3134. [bug] Improve the accuracy of dnssec-signzone's signing statistics. [RT #16030] - --- 9.8.1b3 released --- - 3133. [bug] Change #3114 was incomplete. [RT #24577] +3132. [placeholder] + 3131. [tuning] Improve scalability by allocating one zone task per 100 zones at startup time, rather than using a fixed-size task table. [RT #24406] +3130. [func] Support alternate methods for managing a dynamic + zone's serial number. Two methods are currently + defined using serial-update-method, "increment" + (default) and "unixtime". [RT #23849] + 3129. [bug] Named could crash on 'rndc reconfig' when allow-new-zones was set to yes and named ACLs were used. [RT #22739] - --- 9.8.1b2 released --- +3128. [func] Inserting an NSEC3PARAM via dynamic update in an + auto-dnssec zone that has not been signed yet + will cause it to be signed with the specified NSEC3 + parameters when keys are activated. The + NSEC3PARAM record will not appear in the zone until + it is signed, but the parameters will be stored. + [RT #23684] + +3127. [bug] 'rndc thaw' will now remove a zone's journal file + if the zone serial number has been changed and + ixfr-from-differences is not in use. [RT #24687] 3126. [security] Using DNAME record to generate replacements caused RPZ to exit with a assertion failure. [RT #24766] @@ -941,6 +1309,12 @@ never-implemented 'auto-dnssec create' option. [RT #24533] +3116. [func] New 'dnssec-update-mode' option controls updates + of DNSSEC records in signed dynamic zones. Set to + 'no-resign' to disable automatic RRSIG regeneration + while retaining the ability to sign new or changed + data. [RT #24533] + 3115. [bug] Named could fail to return requested data when following a CNAME that points into the same zone. [RT #24455] @@ -951,8 +1325,6 @@ 3113. [doc] Document the relationship between serial-query-rate and NOTIFY messages. - --- 9.8.1b1 released --- - 3112. [doc] Add missing descriptions of the update policy name types "ms-self", "ms-subdomain", "krb5-self" and "krb5-subdomain", which allow machines to update @@ -965,9 +1337,23 @@ 3110. [bug] dnssec-signzone: Wrong error message could appear when attempting to sign with no KSK. [RT #24369] +3109. [func] The also-notify option now uses the same syntax + as a zone's masters clause. This means it is + now possible to specify a TSIG key to use when + sending notifies to a given server, or to include + an explicit named masters list in an also-notfiy + statement. [RT #23508] + +3108. [cleanup] dnssec-signzone: Clarified some error and + warning messages; removed #ifdef ALLOW_KSKLESS_ZONES + code (use -P instead). [RT #20852] + 3107. [bug] dnssec-signzone: Report the correct number of ZSKs when using -x. [RT #20852] +3106. [func] When logging client requests, include the name of + the TSIG key if any. [RT #23619] + 3105. [bug] GOST support can be suppressed by "configure --without-gost" [RT #24367] @@ -977,6 +1363,12 @@ instead of in the options statement could trigger an assertion failure in named-checkconf. [RT #24382] +3102. [func] New 'dnssec-loadkeys-interval' option configures + how often, in minutes, to check the key repository + for updates when using automatic key maintenance. + Default is every 60 minutes (formerly hard-coded + to 12 hours). [RT #23744] + 3101. [bug] Zones using automatic key maintenance could fail to check the key repository for updates. [RT #23744] @@ -1012,6 +1404,9 @@ 3090. [func] Make --with-gssapi default [RT #23738] +3089. [func] dnssec-dsfromkey now supports reading keys from + standard input "dnssec-dsfromkey -f -". [RT# 20662] + 3088. [bug] Remove bin/tests/system/logfileconfig/ns1/named.conf and add setup.sh in order to resolve changing named.conf issue. [RT #23687] @@ -1024,6 +1419,17 @@ other change has been specified, using "-P now -A now" as default values. [RT #22474] +3085. [func] New '-R' option in dnssec-signzone forces removal + of signatures which have not yet expired but + were generated by a key that no longer exists. + [RT #22471] + +3084. [func] A new command "rndc sync" dumps pending changes in + a dynamic zone to disk; "rndc sync -clean" also + removes the journal file after syncing. Also, + "rndc freeze" no longer removes journal files. + [RT #22473] + 3083. [bug] NOTIFY messages were not being sent when generating a NSEC3 chain incrementally. [RT #23702] @@ -1044,6 +1450,11 @@ 3077. [bug] zone.c:zone_refreshkeys() incorrectly called dns_zone_attach(), use zone->irefs instead. [RT #23303] +3076. [func] New '-L' option in dnssec-keygen, dnsset-settime, and + dnssec-keyfromlabel sets the default TTL of the + key. When possible, automatic signing will use that + TTL when the key is published. [RT #23304] + 3075. [bug] dns_dnssec_findzonekeys{2} used a inconsistent timestamp when determining which keys are active. [RT #23642] @@ -1076,7 +1487,7 @@ 3066. [func] The DLZ "dlopen" driver is now built by default, no longer requiring a configure option. To disable it, use "configure --without-dlopen". - (Note: driver not supported on win32.) [RT #23467] + Driver also supported on win32. [RT #23467] 3065. [bug] RRSIG could have time stamps too far in the future. [RT #23356] @@ -1086,6 +1497,25 @@ 3063. [contrib] More verbose error reporting from DLZ LDAP. [RT #23402] +3062. [func] Made several changes to enhance human readability + of DNSSEC data in dig output and in generated + zone files: + - DNSKEY record comments are more verbose, no + longer used in multiline mode only + - multiline RRSIG records reformatted + - multiline output mode for NSEC3PARAM records + - "dig +norrcomments" suppresses DNSKEY comments + - "dig +split=X" breaks hex/base64 records into + fields of width X; "dig +nosplit" disables this. + [RT #22820] + +3061. [func] New option "dnssec-signzone -D", only write out + generated DNSSEC records. [RT #22896] + +3060. [func] New option "dnssec-signzone -X <date>" allows + specification of a separate expiration date + for DNSKEY RRSIGs and other RRSIGs. [RT #22141] + 3059. [test] Added a regression test for change #3023. 3058. [bug] Cause named to terminate at startup or rndc reconfig/ @@ -1095,6 +1525,10 @@ 3057. [bug] "rndc secroots" would abort after the first error and so could miss some views. [RT #23488] +3056. [func] Added support for URI resource record. [RT #23386] + +3055. [placeholder] + 3054. [bug] Added elliptic curve support check in GOST OpenSSL engine detection. [RT #23485] @@ -1123,6 +1557,8 @@ 3046. [bug] Use RRSIG original TTL to compute validated RRset and RRSIG TTL. [RT #23332] +3045. [removed] Replaced by change #3050. + 3044. [bug] Hold the socket manager lock while freeing the socket. [RT #23333] @@ -1143,6 +1579,8 @@ with a CNAME existed between the trust anchor and the top of the zone. [RT #23338] +3039. [func] Redirect on NXDOMAIN support. [RT #23146] + 3038. [bug] Install <dns/rpz.h>. [RT #23342] 3037. [doc] Update COPYRIGHT to contain all the individual @@ -1180,8 +1618,6 @@ after calling grow_headerspace() and if not re-call grow_headerspace() until we do. [RT #22521] - --- 9.8.0 released --- - 3025. [bug] Fixed a possible deadlock due to zone resigning. [RT #22964] @@ -1203,8 +1639,6 @@ 3019. [test] Test: check apex NSEC3 records after adding DNSKEY record via UPDATE. [RT #23229] - --- 9.8.0rc1 released --- - 3018. [bug] Named failed to check for the "none;" acl when deciding if a zone may need to be re-signed. [RT #23120] @@ -1216,6 +1650,8 @@ 3015. [port] win32: fix IN6_IS_ADDR_LINKLOCAL and IN6_IS_ADDR_SITELOCAL macros. [RT #22724] +3014. [placeholder] + 3013. [bug] The DNS64 ttl was not always being set as expected. [RT #23034] @@ -1223,7 +1659,8 @@ signing records for any remaining DNSKEY changes. [RT #22590] -3011. [func] Allow setting this in named.conf using the new +3011. [func] Change the default query timeout from 30 seconds + to 10. Allow setting this in named.conf using the new 'resolver-query-timeout' option, which specifies a max time in seconds. 0 means 'default' and anything longer than 30 will be silently set to 30. [RT #22852] @@ -13,7 +13,7 @@ LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -$Id: COPYRIGHT,v 1.17.14.2 2012/01/04 23:46:18 tbox Exp $ +$Id: COPYRIGHT,v 1.19 2012/01/03 23:46:59 tbox Exp $ Portions of this code release fall under one or more of the following Copyright notices. Please see individual source diff --git a/FREEBSD-Upgrade b/FREEBSD-Upgrade index 799b72a..cf11266 100644 --- a/FREEBSD-Upgrade +++ b/FREEBSD-Upgrade @@ -56,11 +56,11 @@ $ sed -i.orig -e '/\/tests/d; /docutil/d; /\/xsl/d;' \ -e '/contrib\/check-secure-delegation.pl/d;' \ - -e '/contrib\/zone-edit.sh/d;' \ + -e '/contrib\/zone-edit.sh/d;' -e '/bin\/python/d;' \ configure.in Makefile.in */Makefile.in - Remove mention of doxygen, pkcs11, unit and related files from - configure.in + Remove mention of doxygen, pkcs11, unit, python and related files + from configure.in Please do not commit this change. You only need this to generate config.h. @@ -121,6 +121,7 @@ src/usr.sbin/dnssec-revoke bind9/bin/dnssec src/usr.sbin/dnssec-settime bind9/bin/dnssec src/usr.sbin/dnssec-signzone bind9/bin/dnssec + src/usr.sbin/dnssec-verify bind9/bin/dnssec src/usr.sbin/genrandom bind9/bin/tools src/usr.sbin/isc-hmac-fixup bind9/bin/tools src/usr.sbin/named bind9/bin/named diff --git a/FREEBSD-Xlist b/FREEBSD-Xlist index 805a9d7..47b335c 100644 --- a/FREEBSD-Xlist +++ b/FREEBSD-Xlist @@ -4,6 +4,7 @@ .cvsignore bin/named/bindkeys.pl bin/pkcs11 +bin/python bind.keys configure contrib @@ -1,5 +1,57 @@ Summary of functional enhancements from prior major releases of BIND 9: +BIND 9.8.0 + + BIND 9.8.0 includes a number of changes from BIND 9.7 and earlier + releases. New features include: + + - Built-in trust anchor for the root zone, which can be + switched on via "dnssec-validation auto;" + - Support for DNS64. + - Support for response policy zones (RPZ). + - Support for writable DLZ zones. + - Improved ease of configuration of GSS/TSIG for + interoperability with Active Directory + - Support for GOST signing algorithm for DNSSEC. + - Removed RTT Banding from server selection algorithm. + - New "static-stub" zone type. + - Allow configuration of resolver timeouts via + "resolver-query-timeout" option. + - The DLZ "dlopen" driver is now built by default. + - Added a new include file with function typedefs + for the DLZ "dlopen" driver. + - Made "--with-gssapi" default. + - More verbose error reporting from DLZ LDAP. + +BIND 9.7.0 + + BIND 9.7.0 includes a number of changes from BIND 9.6 and earlier + releases. Most are intended to simplify DNSSEC configuration. + + New features include: + + - Fully automatic signing of zones by "named". + - Simplified configuration of DNSSEC Lookaside Validation (DLV). + - Simplified configuration of Dynamic DNS, using the "ddns-confgen" + command line tool or the "local" update-policy option. (As a side + effect, this also makes it easier to configure automatic zone + re-signing.) + - New named option "attach-cache" that allows multiple views to + share a single cache. + - DNS rebinding attack prevention. + - New default values for dnssec-keygen parameters. + - Support for RFC 5011 automated trust anchor maintenance + - Smart signing: simplified tools for zone signing and key + maintenance. + - The "statistics-channels" option is now available on Windows. + - A new DNSSEC-aware libdns API for use by non-BIND9 applications + - On some platforms, named and other binaries can now print out + a stack backtrace on assertion failure, to aid in debugging. + - A "tools only" installation mode on Windows, which only installs + dig, host, nslookup and nsupdate. + - Improved PKCS#11 support, including Keyper support and explicit + OpenSSL engine selection. + BIND 9.6.0 Full NSEC3 support diff --git a/Makefile.in b/Makefile.in index 4e41fe5..7c1d665 100644 --- a/Makefile.in +++ b/Makefile.in @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: Makefile.in,v 1.58.250.4 2011/09/06 04:06:11 marka Exp $ +# $Id: Makefile.in,v 1.62 2011/09/06 04:06:37 marka Exp $ srcdir = @srcdir@ VPATH = @srcdir@ @@ -51,119 +51,64 @@ BIND 9 For up-to-date release notes and errata, see http://www.isc.org/software/bind9/releasenotes -BIND 9.8.5 - - BIND 9.8.5 includes several bug fixes and patches security - flaws described in CVE-2012-5688, CVE-2012-5689 and CVE-2013-2266. - -BIND 9.8.4 - - BIND 9.8.4 includes several bug fixes and patches security - flaws described in CVE-2012-1667, CVE-2012-3817 and CVE-2012-4244. - -BIND 9.8.3 - - BIND 9.8.3 is a maintenance release. - -BIND 9.8.2 - - BIND 9.8.2 includes a number of bug fixes and prevents a security - problem described in CVE-2011-4313 - -BIND 9.8.1 - - BIND 9.8.1 includes a number of bug fixes and enhancements from - BIND 9.8 and earlier releases. New features include: - - - The DLZ "dlopen" driver is now built by default. - - Added a new include file with function typedefs - for the DLZ "dlopen" driver. - - Made "--with-gssapi" default. - - More verbose error reporting from DLZ LDAP. - -BIND 9.8.0 - - BIND 9.8.0 includes a number of changes from BIND 9.7 and earlier - releases. New features include: - - - Built-in trust anchor for the root zone, which can be - switched on via "dnssec-validation auto;" - - Support for DNS64. - - Support for response policy zones (RPZ). - - Support for writable DLZ zones. - - Improved ease of configuration of GSS/TSIG for - interoperability with Active Directory - - Support for GOST signing algorithm for DNSSEC. - - Removed RTT Banding from server selection algorithm. - - New "static-stub" zone type. - - Allow configuration of resolver timeouts via - "resolver-query-timeout" option. - -BIND 9.7.0 - - BIND 9.7.0 includes a number of changes from BIND 9.6 and earlier - releases. Most are intended to simplify DNSSEC configuration. - - New features include: - - - Fully automatic signing of zones by "named". - - Simplified configuration of DNSSEC Lookaside Validation (DLV). - - Simplified configuration of Dynamic DNS, using the "ddns-confgen" - command line tool or the "local" update-policy option. (As a side - effect, this also makes it easier to configure automatic zone - re-signing.) - - New named option "attach-cache" that allows multiple views to - share a single cache. - - DNS rebinding attack prevention. - - New default values for dnssec-keygen parameters. - - Support for RFC 5011 automated trust anchor maintenance - - Smart signing: simplified tools for zone signing and key - maintenance. - - The "statistics-channels" option is now available on Windows. - - A new DNSSEC-aware libdns API for use by non-BIND9 applications - - On some platforms, named and other binaries can now print out - a stack backtrace on assertion failure, to aid in debugging. - - A "tools only" installation mode on Windows, which only installs - dig, host, nslookup and nsupdate. - - Improved PKCS#11 support, including Keyper support and explicit - OpenSSL engine selection. - - Known issues in this release: - - - In rare cases, DNSSEC validation can leak memory. When this - happens, it will cause an assertion failure when named exits, - but is otherwise harmless. A fix exists, but was too late for - this release; it will be included in BIND 9.7.1. - - Compatibility notes: - - - If you had built BIND 9.6 with any of ALLOW_NSEC3PARAM_UPDATE, - ALLOW_SECURE_TO_INSECURE or ALLOW_INSECURE_TO_SECURE defined, then - you should ensure that all changes that are in progress have - completed prior to upgrading to BIND 9.7. BIND 9.7 implements - those features in a way which is not backwards compatible. - - - Prior releases had a bug which caused HMAC-SHA* keys with long - secrets to be used incorrectly. Fixing this bug means that older - versions of BIND 9 may fail to interoperate with this version - when using TSIG keys. If this occurs, the new "isc-hmac-fixup" - tool will convert a key with a long secret into a form that works - correctly with all versions of BIND 9. See the "isc-hmac-fixup" - man page for additional details. - - - Revoking a DNSSEC key with "dnssec-revoke" changes its key ID. - It is possible for the new key ID to collide with that of a - different key. Newly generated keys will not have this problem, - as "dnssec-keygen" looks for potential collisions before - generating keys, but exercise caution if using key revokation - with keys that were generated by older versions of BIND 9. See - the Administrator's Reference Manual, section 4.10 ("Dynamic - Trust Anchor Management") for more details. - - - A bug was fixed in which a key's scheduled inactivity date was - stored incorectly. Users who participated in the 9.7.0 BETA test - and had DNSSEC keys with scheduled inactivity dates will need to - reset those keys' dates using "dnssec-settime -I". +BIND 9.9.3 + + BIND 9.9.3 is a maintenance release and patches the security + flaws described in CVE-2012-5688, CVE-2012-5689 and CVE-2013-2266. + +BIND 9.9.2 + + BIND 9.9.2 is a maintenance release and patches the security + flaw described in CVE-2012-4244. + +BIND 9.9.1 + + BIND 9.9.1 is a maintenance release. + +BIND 9.9.0 + + BIND 9.9.0 includes a number of changes from BIND 9.8 and earlier + releases. New features include: + + - Inline signing, allowing automatic DNSSEC signing of + master zones without modification of the zonefile, or + "bump in the wire" signing in slaves. + - NXDOMAIN redirection. + - New 'rndc flushtree' command clears all data under a given + name from the DNS cache. + - New 'rndc sync' command dumps pending changes in a dynamic + zone to disk without a freeze/thaw cycle. + - New 'rndc signing' command displays or clears signing status + records in 'auto-dnssec' zones. + - NSEC3 parameters for 'auto-dnssec' zones can now be set prior + to signing, eliminating the need to initially sign with NSEC. + - Startup time improvements on large authoritative servers. + - Slave zones are now saved in raw format by default. + - Several improvements to response policy zones (RPZ). + - Improved hardware scalability by using multiple threads + to listen for queries and using finer-grained client locking + - The 'also-notify' option now takes the same syntax as + 'masters', so it can used named masterlists and TSIG keys. + - 'dnssec-signzone -D' writes an output file containing only DNSSEC + data, which can be included by the primary zone file. + - 'dnssec-signzone -R' forces removal of signatures that are + not expired but were created by a key which no longer exists. + - 'dnssec-signzone -X' allows a separate expiration date to + be specified for DNSKEY signatures from other signatures. + - New '-L' option to dnssec-keygen, dnssec-settime, and + dnssec-keyfromlabel sets the default TTL for the key. + - dnssec-dsfromkey now supports reading from standard input, + to make it easier to convert DNSKEY to DS. + - RFC 1918 reverse zones have been added to the empty-zones + table per RFC 6303. + - Dynamic updates can now optionally set the zone's SOA serial + number to the current UNIX time. + - DLZ modules can now retrieve the source IP address of + the querying client. + - 'request-ixfr' option can now be set at the per-zone level. + - 'dig +rrcomments' turns on comments about DNSKEY records, + indicating their key ID, algorithm and function + - Simplified nsupdate syntax and added readline support Building @@ -193,12 +138,12 @@ Building AIX 4.3, 5L CentOS 4, 4.5, 5 Darwin 9.0.0d1/ARM - Debian 4 - Fedora Core 5, 7 - FreeBSD 6.1 + Debian 4, 5, 6 + Fedora Core 5, 7, 8 + FreeBSD 6, 7, 8 HP-UX 11.23 PA - MacOS X 10.4, 10.5 - Red Hat Enterprise Linux 4, 5 + MacOS X 10.5, 10.6, 10.7 + Red Hat Enterprise Linux 4, 5, 6 SCO OpenServer 5.0.6 Slackware 9, 10 SuSE 9, 10 @@ -219,7 +164,8 @@ Building CFLAGS C compiler flags. Defaults to include -g and/or -O2 - as supported by the compiler. + as supported by the compiler. Please include '-g' + if you need to set CFLAGS. STD_CINCLUDES System header file directories. Can be used to specify @@ -336,6 +282,10 @@ Building libraries. sh-utils-1.16 provides a "printf" which compiles on SunOS 4. +Known limitations + + Linux requires kernel build 2.6.39 or later to get the + performance benefits from using multiple sockets. Documentation diff --git a/bin/Makefile.in b/bin/Makefile.in index 897c0f3..87ca5b2 100644 --- a/bin/Makefile.in +++ b/bin/Makefile.in @@ -20,7 +20,7 @@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ SUBDIRS = named rndc dig dnssec tools tests nsupdate \ - check confgen @PKCS11_TOOLS@ + check confgen @PYTHON_TOOLS@ @PKCS11_TOOLS@ TARGETS = @BIND9_MAKE_RULES@ diff --git a/bin/check/check-tool.c b/bin/check/check-tool.c index 46cf2bf..1e53407 100644 --- a/bin/check/check-tool.c +++ b/bin/check/check-tool.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2010, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2012 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000-2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: check-tool.c,v 1.41 2010/09/07 23:46:59 tbox Exp $ */ +/* $Id: check-tool.c,v 1.44 2011/12/22 07:32:39 each Exp $ */ /*! \file */ @@ -638,7 +638,8 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename, /*% dump the zone */ isc_result_t dump_zone(const char *zonename, dns_zone_t *zone, const char *filename, - dns_masterformat_t fileformat, const dns_master_style_t *style) + dns_masterformat_t fileformat, const dns_master_style_t *style, + const isc_uint32_t rawversion) { isc_result_t result; FILE *output = stdout; @@ -664,8 +665,8 @@ dump_zone(const char *zonename, dns_zone_t *zone, const char *filename, } } - result = dns_zone_dumptostream2(zone, output, fileformat, style); - + result = dns_zone_dumptostream3(zone, output, fileformat, style, + rawversion); if (output != stdout) (void)isc_stdio_close(output); diff --git a/bin/check/check-tool.h b/bin/check/check-tool.h index e988597..0794729 100644 --- a/bin/check/check-tool.h +++ b/bin/check/check-tool.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007, 2010 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2010, 2011 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000-2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: check-tool.h,v 1.16 2010/09/07 23:46:59 tbox Exp $ */ +/* $Id: check-tool.h,v 1.18 2011/12/09 23:47:02 tbox Exp $ */ #ifndef CHECK_TOOL_H #define CHECK_TOOL_H @@ -41,7 +41,8 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename, isc_result_t dump_zone(const char *zonename, dns_zone_t *zone, const char *filename, - dns_masterformat_t fileformat, const dns_master_style_t *style); + dns_masterformat_t fileformat, const dns_master_style_t *style, + const isc_uint32_t rawversion); #ifdef _WIN32 void InitSockets(void); diff --git a/bin/check/named-checkconf.c b/bin/check/named-checkconf.c index ef754ff..0b3c508 100644 --- a/bin/check/named-checkconf.c +++ b/bin/check/named-checkconf.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: named-checkconf.c,v 1.54.62.2 2011/03/12 04:59:13 tbox Exp $ */ +/* $Id: named-checkconf.c,v 1.56 2011/03/12 04:59:46 tbox Exp $ */ /*! \file */ diff --git a/bin/check/named-checkzone.8 b/bin/check/named-checkzone.8 index b7b8a4c..8538ca8 100644 --- a/bin/check/named-checkzone.8 +++ b/bin/check/named-checkzone.8 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004-2007, 2009, 2010, 2013 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004-2007, 2009-2011, 2013 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000-2002 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -33,9 +33,9 @@ named\-checkzone, named\-compilezone \- zone file validity checking or converting tool .SH "SYNOPSIS" .HP 16 -\fBnamed\-checkzone\fR [\fB\-d\fR] [\fB\-h\fR] [\fB\-j\fR] [\fB\-q\fR] [\fB\-v\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-f\ \fR\fB\fIformat\fR\fR] [\fB\-F\ \fR\fB\fIformat\fR\fR] [\fB\-i\ \fR\fB\fImode\fR\fR] [\fB\-k\ \fR\fB\fImode\fR\fR] [\fB\-m\ \fR\fB\fImode\fR\fR] [\fB\-M\ \fR\fB\fImode\fR\fR] [\fB\-n\ \fR\fB\fImode\fR\fR] [\fB\-o\ \fR\fB\fIfilename\fR\fR] [\fB\-r\ \fR\fB\fImode\fR\fR] [\fB\-s\ \fR\fB\fIstyle\fR\fR] [\fB\-S\ \fR\fB\fImode\fR\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-T\ \fR\fB\fImode\fR\fR] [\fB\-w\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-W\ \fR\fB\fImode\fR\fR] {zonename} {filename} +\fBnamed\-checkzone\fR [\fB\-d\fR] [\fB\-h\fR] [\fB\-j\fR] [\fB\-q\fR] [\fB\-v\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-f\ \fR\fB\fIformat\fR\fR] [\fB\-F\ \fR\fB\fIformat\fR\fR] [\fB\-i\ \fR\fB\fImode\fR\fR] [\fB\-k\ \fR\fB\fImode\fR\fR] [\fB\-m\ \fR\fB\fImode\fR\fR] [\fB\-M\ \fR\fB\fImode\fR\fR] [\fB\-n\ \fR\fB\fImode\fR\fR] [\fB\-L\ \fR\fB\fIserial\fR\fR] [\fB\-o\ \fR\fB\fIfilename\fR\fR] [\fB\-r\ \fR\fB\fImode\fR\fR] [\fB\-s\ \fR\fB\fIstyle\fR\fR] [\fB\-S\ \fR\fB\fImode\fR\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-T\ \fR\fB\fImode\fR\fR] [\fB\-w\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-W\ \fR\fB\fImode\fR\fR] {zonename} {filename} .HP 18 -\fBnamed\-compilezone\fR [\fB\-d\fR] [\fB\-j\fR] [\fB\-q\fR] [\fB\-v\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-C\ \fR\fB\fImode\fR\fR] [\fB\-f\ \fR\fB\fIformat\fR\fR] [\fB\-F\ \fR\fB\fIformat\fR\fR] [\fB\-i\ \fR\fB\fImode\fR\fR] [\fB\-k\ \fR\fB\fImode\fR\fR] [\fB\-m\ \fR\fB\fImode\fR\fR] [\fB\-n\ \fR\fB\fImode\fR\fR] [\fB\-r\ \fR\fB\fImode\fR\fR] [\fB\-s\ \fR\fB\fIstyle\fR\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-T\ \fR\fB\fImode\fR\fR] [\fB\-w\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-W\ \fR\fB\fImode\fR\fR] {\fB\-o\ \fR\fB\fIfilename\fR\fR} {zonename} {filename} +\fBnamed\-compilezone\fR [\fB\-d\fR] [\fB\-j\fR] [\fB\-q\fR] [\fB\-v\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-C\ \fR\fB\fImode\fR\fR] [\fB\-f\ \fR\fB\fIformat\fR\fR] [\fB\-F\ \fR\fB\fIformat\fR\fR] [\fB\-i\ \fR\fB\fImode\fR\fR] [\fB\-k\ \fR\fB\fImode\fR\fR] [\fB\-m\ \fR\fB\fImode\fR\fR] [\fB\-n\ \fR\fB\fImode\fR\fR] [\fB\-L\ \fR\fB\fIserial\fR\fR] [\fB\-r\ \fR\fB\fImode\fR\fR] [\fB\-s\ \fR\fB\fIstyle\fR\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-T\ \fR\fB\fImode\fR\fR] [\fB\-w\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-W\ \fR\fB\fImode\fR\fR] {\fB\-o\ \fR\fB\fIfilename\fR\fR} {zonename} {filename} .SH "DESCRIPTION" .PP \fBnamed\-checkzone\fR @@ -139,11 +139,19 @@ Specify the format of the zone file. Possible formats are .PP \-F \fIformat\fR .RS 4 -Specify the format of the output file specified. Possible formats are +Specify the format of the output file specified. For +\fBnamed\-checkzone\fR, this does not cause any effects unless it dumps the zone contents. +.sp +Possible formats are \fB"text"\fR (default) and -\fB"raw"\fR. For -\fBnamed\-checkzone\fR, this does not cause any effects unless it dumps the zone contents. +\fB"raw"\fR +or +\fB"raw=N"\fR, which store the zone in a binary format for rapid loading by +\fBnamed\fR. +\fB"raw=N"\fR +specifies the format version of the raw zone file: if N is 0, the raw file can be read by any version of +\fBnamed\fR; if N is 1, the file can be read by release 9.9.0 or higher. The default is 1. .RE .PP \-k \fImode\fR @@ -160,6 +168,11 @@ checks with the specified failure mode. Possible modes are \fB"ignore"\fR. .RE .PP +\-L \fIserial\fR +.RS 4 +When compiling a zone to 'raw' format, set the "source serial" value in the header to the specified serial number. (This is expected to be used primarily for testing purposes.) +.RE +.PP \-m \fImode\fR .RS 4 Specify whether MX records should be checked to see if they are addresses. Possible modes are @@ -289,7 +302,7 @@ BIND 9 Administrator Reference Manual. .PP Internet Systems Consortium .SH "COPYRIGHT" -Copyright \(co 2004\-2007, 2009, 2010, 2013 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004\-2007, 2009\-2011, 2013 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000\-2002 Internet Software Consortium. .br diff --git a/bin/check/named-checkzone.c b/bin/check/named-checkzone.c index fdc3ddc..7e779c2 100644 --- a/bin/check/named-checkzone.c +++ b/bin/check/named-checkzone.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: named-checkzone.c,v 1.61.62.2 2011/12/22 23:45:54 tbox Exp $ */ +/* $Id: named-checkzone.c,v 1.65 2011/12/22 17:29:22 each Exp $ */ /*! \file */ @@ -39,6 +39,7 @@ #include <dns/db.h> #include <dns/fixedname.h> #include <dns/log.h> +#include <dns/master.h> #include <dns/masterdump.h> #include <dns/name.h> #include <dns/rdataclass.h> @@ -112,8 +113,12 @@ main(int argc, char **argv) { const char *outputformatstr = NULL; dns_masterformat_t inputformat = dns_masterformat_text; dns_masterformat_t outputformat = dns_masterformat_text; + dns_masterrawheader_t header; + isc_uint32_t rawversion = 1, serialnum = 0; + isc_boolean_t snset = ISC_FALSE; isc_boolean_t logdump = ISC_FALSE; FILE *errout = stdout; + char *endp; outputstyle = &dns_master_style_full; @@ -159,7 +164,7 @@ main(int argc, char **argv) { isc_commandline_errprint = ISC_FALSE; while ((c = isc_commandline_parse(argc, argv, - "c:df:hi:jk:m:n:qr:s:t:o:vw:DF:M:S:T:W:")) + "c:df:hi:jk:L:m:n:qr:s:t:o:vw:DF:M:S:T:W:")) != EOF) { switch (c) { case 'c': @@ -237,6 +242,17 @@ main(int argc, char **argv) { } break; + case 'L': + snset = ISC_TRUE; + endp = NULL; + serialnum = strtol(isc_commandline_argument, &endp, 0); + if (*endp != '\0') { + fprintf(stderr, "source serial number " + "must be numeric"); + exit(1); + } + break; + case 'n': if (ARGCMP("ignore")) { zone_options &= ~(DNS_ZONEOPT_CHECKNS| @@ -413,7 +429,11 @@ main(int argc, char **argv) { inputformat = dns_masterformat_text; else if (strcasecmp(inputformatstr, "raw") == 0) inputformat = dns_masterformat_raw; - else { + else if (strncasecmp(inputformatstr, "raw=", 4) == 0) { + inputformat = dns_masterformat_raw; + fprintf(stderr, + "WARNING: input format raw, version ignored\n"); + } else { fprintf(stderr, "unknown file format: %s\n", inputformatstr); exit(1); @@ -421,11 +441,22 @@ main(int argc, char **argv) { } if (outputformatstr != NULL) { - if (strcasecmp(outputformatstr, "text") == 0) + if (strcasecmp(outputformatstr, "text") == 0) { outputformat = dns_masterformat_text; - else if (strcasecmp(outputformatstr, "raw") == 0) + } else if (strcasecmp(outputformatstr, "raw") == 0) { outputformat = dns_masterformat_raw; - else { + } else if (strncasecmp(outputformatstr, "raw=", 4) == 0) { + char *end; + + outputformat = dns_masterformat_raw; + rawversion = strtol(outputformatstr + 4, &end, 10); + if (end == outputformatstr + 4 || *end != '\0' || + rawversion > 1U) { + fprintf(stderr, + "unknown raw format version\n"); + exit(1); + } + } else { fprintf(stderr, "unknown file format: %s\n", outputformatstr); exit(1); @@ -480,13 +511,20 @@ main(int argc, char **argv) { result = load_zone(mctx, origin, filename, inputformat, classname, &zone); + if (snset) { + dns_master_initrawheader(&header); + header.flags = DNS_MASTERRAW_SOURCESERIALSET; + header.sourceserial = serialnum; + dns_zone_setrawdata(zone, &header); + } + if (result == ISC_R_SUCCESS && dumpzone) { if (logdump) { fprintf(errout, "dump zone to %s...", output_filename); fflush(errout); } result = dump_zone(origin, zone, output_filename, - outputformat, outputstyle); + outputformat, outputstyle, rawversion); if (logdump) fprintf(errout, "done\n"); } diff --git a/bin/check/named-checkzone.docbook b/bin/check/named-checkzone.docbook index c25dd1e..ea37fa2 100644 --- a/bin/check/named-checkzone.docbook +++ b/bin/check/named-checkzone.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [<!ENTITY mdash "—">]> <!-- - - Copyright (C) 2004-2007, 2009, 2010, 2013 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004-2007, 2009-2011, 2013 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000-2002 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: named-checkzone.docbook,v 1.40 2010/01/16 23:48:15 tbox Exp $ --> +<!-- $Id: named-checkzone.docbook,v 1.44 2011/12/22 07:32:39 each Exp $ --> <refentry id="man.named-checkzone"> <refentryinfo> <date>June 13, 2000</date> @@ -38,6 +38,7 @@ <year>2007</year> <year>2009</year> <year>2010</year> + <year>2011</year> <year>2013</year> <holder>Internet Systems Consortium, Inc. ("ISC")</holder> </copyright> @@ -71,6 +72,7 @@ <arg><option>-m <replaceable class="parameter">mode</replaceable></option></arg> <arg><option>-M <replaceable class="parameter">mode</replaceable></option></arg> <arg><option>-n <replaceable class="parameter">mode</replaceable></option></arg> + <arg><option>-L <replaceable class="parameter">serial</replaceable></option></arg> <arg><option>-o <replaceable class="parameter">filename</replaceable></option></arg> <arg><option>-r <replaceable class="parameter">mode</replaceable></option></arg> <arg><option>-s <replaceable class="parameter">style</replaceable></option></arg> @@ -97,6 +99,7 @@ <arg><option>-k <replaceable class="parameter">mode</replaceable></option></arg> <arg><option>-m <replaceable class="parameter">mode</replaceable></option></arg> <arg><option>-n <replaceable class="parameter">mode</replaceable></option></arg> + <arg><option>-L <replaceable class="parameter">serial</replaceable></option></arg> <arg><option>-r <replaceable class="parameter">mode</replaceable></option></arg> <arg><option>-s <replaceable class="parameter">style</replaceable></option></arg> <arg><option>-t <replaceable class="parameter">directory</replaceable></option></arg> @@ -250,12 +253,20 @@ <listitem> <para> Specify the format of the output file specified. - Possible formats are <command>"text"</command> (default) - and <command>"raw"</command>. For <command>named-checkzone</command>, this does not cause any effects unless it dumps the zone contents. </para> + <para> + Possible formats are <command>"text"</command> (default) + and <command>"raw"</command> or <command>"raw=N"</command>, + which store the zone in a binary format for rapid loading + by <command>named</command>. <command>"raw=N"</command> + specifies the format version of the raw zone file: if N + is 0, the raw file can be read by any version of + <command>named</command>; if N is 1, the file can be read + by release 9.9.0 or higher. The default is 1. + </para> </listitem> </varlistentry> @@ -275,6 +286,17 @@ </varlistentry> <varlistentry> + <term>-L <replaceable class="parameter">serial</replaceable></term> + <listitem> + <para> + When compiling a zone to 'raw' format, set the "source serial" + value in the header to the specified serial number. (This is + expected to be used primarily for testing purposes.) + </para> + </listitem> + </varlistentry> + + <varlistentry> <term>-m <replaceable class="parameter">mode</replaceable></term> <listitem> <para> diff --git a/bin/check/named-checkzone.html b/bin/check/named-checkzone.html index ab9c8ef..6941326 100644 --- a/bin/check/named-checkzone.html +++ b/bin/check/named-checkzone.html @@ -1,5 +1,5 @@ <!-- - - Copyright (C) 2004-2007, 2009, 2010, 2013 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004-2007, 2009-2011, 2013 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000-2002 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -29,11 +29,11 @@ </div> <div class="refsynopsisdiv"> <h2>Synopsis</h2> -<div class="cmdsynopsis"><p><code class="command">named-checkzone</code> [<code class="option">-d</code>] [<code class="option">-h</code>] [<code class="option">-j</code>] [<code class="option">-q</code>] [<code class="option">-v</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-f <em class="replaceable"><code>format</code></em></code>] [<code class="option">-F <em class="replaceable"><code>format</code></em></code>] [<code class="option">-i <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-k <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-m <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-M <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-n <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-o <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-r <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-s <em class="replaceable"><code>style</code></em></code>] [<code class="option">-S <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-T <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-w <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-W <em class="replaceable"><code>mode</code></em></code>] {zonename} {filename}</p></div> -<div class="cmdsynopsis"><p><code class="command">named-compilezone</code> [<code class="option">-d</code>] [<code class="option">-j</code>] [<code class="option">-q</code>] [<code class="option">-v</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-C <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-f <em class="replaceable"><code>format</code></em></code>] [<code class="option">-F <em class="replaceable"><code>format</code></em></code>] [<code class="option">-i <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-k <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-m <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-n <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-r <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-s <em class="replaceable"><code>style</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-T <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-w <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-W <em class="replaceable"><code>mode</code></em></code>] {<code class="option">-o <em class="replaceable"><code>filename</code></em></code>} {zonename} {filename}</p></div> +<div class="cmdsynopsis"><p><code class="command">named-checkzone</code> [<code class="option">-d</code>] [<code class="option">-h</code>] [<code class="option">-j</code>] [<code class="option">-q</code>] [<code class="option">-v</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-f <em class="replaceable"><code>format</code></em></code>] [<code class="option">-F <em class="replaceable"><code>format</code></em></code>] [<code class="option">-i <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-k <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-m <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-M <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-n <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-L <em class="replaceable"><code>serial</code></em></code>] [<code class="option">-o <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-r <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-s <em class="replaceable"><code>style</code></em></code>] [<code class="option">-S <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-T <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-w <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-W <em class="replaceable"><code>mode</code></em></code>] {zonename} {filename}</p></div> +<div class="cmdsynopsis"><p><code class="command">named-compilezone</code> [<code class="option">-d</code>] [<code class="option">-j</code>] [<code class="option">-q</code>] [<code class="option">-v</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-C <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-f <em class="replaceable"><code>format</code></em></code>] [<code class="option">-F <em class="replaceable"><code>format</code></em></code>] [<code class="option">-i <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-k <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-m <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-n <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-L <em class="replaceable"><code>serial</code></em></code>] [<code class="option">-r <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-s <em class="replaceable"><code>style</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-T <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-w <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-W <em class="replaceable"><code>mode</code></em></code>] {<code class="option">-o <em class="replaceable"><code>filename</code></em></code>} {zonename} {filename}</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543716"></a><h2>DESCRIPTION</h2> +<a name="id2543736"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">named-checkzone</strong></span> checks the syntax and integrity of a zone file. It performs the same checks as <span><strong class="command">named</strong></span> does when loading a @@ -53,7 +53,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543751"></a><h2>OPTIONS</h2> +<a name="id2543771"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-d</span></dt> <dd><p> @@ -128,14 +128,24 @@ and <span><strong class="command">"raw"</strong></span>. </p></dd> <dt><span class="term">-F <em class="replaceable"><code>format</code></em></span></dt> -<dd><p> +<dd> +<p> Specify the format of the output file specified. - Possible formats are <span><strong class="command">"text"</strong></span> (default) - and <span><strong class="command">"raw"</strong></span>. For <span><strong class="command">named-checkzone</strong></span>, this does not cause any effects unless it dumps the zone contents. - </p></dd> + </p> +<p> + Possible formats are <span><strong class="command">"text"</strong></span> (default) + and <span><strong class="command">"raw"</strong></span> or <span><strong class="command">"raw=N"</strong></span>, + which store the zone in a binary format for rapid loading + by <span><strong class="command">named</strong></span>. <span><strong class="command">"raw=N"</strong></span> + specifies the format version of the raw zone file: if N + is 0, the raw file can be read by any version of + <span><strong class="command">named</strong></span>; if N is 1, the file can be read + by release 9.9.0 or higher. The default is 1. + </p> +</dd> <dt><span class="term">-k <em class="replaceable"><code>mode</code></em></span></dt> <dd><p> Perform <span><strong class="command">"check-names"</strong></span> checks with the @@ -146,6 +156,12 @@ (default for <span><strong class="command">named-checkzone</strong></span>) and <span><strong class="command">"ignore"</strong></span>. </p></dd> +<dt><span class="term">-L <em class="replaceable"><code>serial</code></em></span></dt> +<dd><p> + When compiling a zone to 'raw' format, set the "source serial" + value in the header to the specified serial number. (This is + expected to be used primarily for testing purposes.) + </p></dd> <dt><span class="term">-m <em class="replaceable"><code>mode</code></em></span></dt> <dd><p> Specify whether MX records should be checked to see if they @@ -254,14 +270,14 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2544422"></a><h2>RETURN VALUES</h2> +<a name="id2544612"></a><h2>RETURN VALUES</h2> <p><span><strong class="command">named-checkzone</strong></span> returns an exit status of 1 if errors were detected and 0 otherwise. </p> </div> <div class="refsect1" lang="en"> -<a name="id2544434"></a><h2>SEE ALSO</h2> +<a name="id2544624"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>, <em class="citetitle">RFC 1035</em>, @@ -269,7 +285,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2544603"></a><h2>AUTHOR</h2> +<a name="id2544657"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/bin/confgen/ddns-confgen.c b/bin/confgen/ddns-confgen.c index 826b500..d655145 100644 --- a/bin/confgen/ddns-confgen.c +++ b/bin/confgen/ddns-confgen.c @@ -14,7 +14,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: ddns-confgen.c,v 1.9.308.2 2011/03/12 04:59:13 tbox Exp $ */ +/* $Id: ddns-confgen.c,v 1.11 2011/03/12 04:59:46 tbox Exp $ */ /*! \file */ diff --git a/bin/confgen/rndc-confgen.c b/bin/confgen/rndc-confgen.c index 49119ce..e2ac079 100644 --- a/bin/confgen/rndc-confgen.c +++ b/bin/confgen/rndc-confgen.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: rndc-confgen.c,v 1.5.308.2 2011/03/12 04:59:13 tbox Exp $ */ +/* $Id: rndc-confgen.c,v 1.7 2011/03/12 04:59:46 tbox Exp $ */ /*! \file */ diff --git a/bin/dig/Makefile.in b/bin/dig/Makefile.in index 2a3bc5d..5bc4db0 100644 --- a/bin/dig/Makefile.in +++ b/bin/dig/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2004, 2005, 2007, 2009, 2012 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004, 2005, 2007, 2009, 2012, 2013 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 2000-2002 Internet Software Consortium. # # Permission to use, copy, modify, and/or distribute this software for any @@ -23,6 +23,8 @@ top_srcdir = @top_srcdir@ @BIND9_MAKE_INCLUDES@ +READLINE_LIB = @READLINE_LIB@ + CINCLUDES = -I${srcdir}/include ${DNS_INCLUDES} ${BIND9_INCLUDES} \ ${ISC_INCLUDES} ${LWRES_INCLUDES} ${ISCCFG_INCLUDES} @@ -78,7 +80,7 @@ host@EXEEXT@: host.@O@ dighost.@O@ ${UOBJS} ${DEPLIBS} ${FINALBUILDCMD} nslookup@EXEEXT@: nslookup.@O@ dighost.@O@ ${UOBJS} ${DEPLIBS} - export BASEOBJS="nslookup.@O@ dighost.@O@ ${UOBJS}"; \ + export BASEOBJS="nslookup.@O@ dighost.@O@ ${READLINE_LIB} ${UOBJS}"; \ ${FINALBUILDCMD} doc man:: ${MANOBJS} diff --git a/bin/dig/dig.1 b/bin/dig/dig.1 index 6d8688e..818c020 100644 --- a/bin/dig/dig.1 +++ b/bin/dig/dig.1 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004-2010, 2013 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004-2011, 2013 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000-2003 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -300,7 +300,7 @@ A synonym for .PP \fB+[no]adflag\fR .RS 4 -Set [do not set] the AD (authentic data) bit in the query. This requests the server to return whether all of the answer and authority sections have all been validated as secure according to the security policy of the server. AD=1 indicates that all records have been validated as secure and the answer is not from a OPT\-OUT range. AD=0 indicate that some part of the answer was insecure or not validated. +Set [do not set] the AD (authentic data) bit in the query. This requests the server to return whether all of the answer and authority sections have all been validated as secure according to the security policy of the server. AD=1 indicates that all records have been validated as secure and the answer is not from a OPT\-OUT range. AD=0 indicate that some part of the answer was insecure or not validated. This bit is set by default. .RE .PP \fB+[no]cdflag\fR @@ -341,6 +341,9 @@ attempts to find the authoritative name servers for the zone containing the name Toggle tracing of the delegation path from the root name servers for the name being looked up. Tracing is disabled by default. When tracing is enabled, \fBdig\fR makes iterative queries to resolve the name being looked up. It will follow referrals from the root servers, showing the answer from each server that was used to resolve the lookup. +.sp +\fB+dnssec\fR +is also set when +trace is set to better emulate the default queries from a nameserver. .RE .PP \fB+[no]cmd\fR @@ -367,6 +370,24 @@ option is enabled. If short form answers are requested, the default is not to sh Toggle the display of comment lines in the output. The default is to print comments. .RE .PP +\fB+[no]rrcomments\fR +.RS 4 +Toggle the display of per\-record comments in the output (for example, human\-readable key information about DNSKEY records). The default is not to print record comments unless multiline mode is active. +.RE +.PP +\fB+split=W\fR +.RS 4 +Split long hex\- or base64\-formatted fields in resource records into chunks of +\fIW\fR +characters (where +\fIW\fR +is rounded up to the nearest multiple of 4). +\fI+nosplit\fR +or +\fI+split=0\fR +causes fields not to be split at all. The default is 56 characters, or 44 characters when multiline mode is active. +.RE +.PP \fB+[no]stats\fR .RS 4 This query option toggles the printing of statistics: when the query was made, the size of the reply and so on. The default behavior is to print the query statistics. @@ -454,7 +475,7 @@ bytes. The maximum and minimum sizes of this buffer are 65535 and 0 respectively .RS 4 Specify the EDNS version to query with. Valid values are 0 to 255. Setting the EDNS version will cause a EDNS query to be sent. \fB+noedns\fR -clears the remembered EDNS version. +clears the remembered EDNS version. EDNS is set to 0 by default. .RE .PP \fB+[no]multiline\fR @@ -576,7 +597,7 @@ RFC1035. .PP There are probably too many query options. .SH "COPYRIGHT" -Copyright \(co 2004\-2010, 2013 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004\-2011, 2013 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000\-2003 Internet Software Consortium. .br diff --git a/bin/dig/dig.c b/bin/dig/dig.c index ce9ccde..7903710 100644 --- a/bin/dig/dig.c +++ b/bin/dig/dig.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dig.c,v 1.237.124.4 2011/12/07 17:23:55 each Exp $ */ +/* $Id: dig.c,v 1.245 2011/12/07 17:23:28 each Exp $ */ /*! \file */ @@ -67,7 +67,8 @@ static char domainopt[DNS_NAME_MAXTEXT]; static isc_boolean_t short_form = ISC_FALSE, printcmd = ISC_TRUE, ip6_int = ISC_FALSE, plusquest = ISC_FALSE, pluscomm = ISC_FALSE, multiline = ISC_FALSE, nottl = ISC_FALSE, noclass = ISC_FALSE, - onesoa = ISC_FALSE; + onesoa = ISC_FALSE, rrcomments = ISC_FALSE; +static isc_uint32_t splitwidth = 0xffffffff; /*% opcode text */ static const char * const opcodetext[] = { @@ -201,6 +202,8 @@ help(void) { " +[no]cl (Control display of class in records)\n" " +[no]cmd (Control display of command line)\n" " +[no]comments (Control display of comment lines)\n" +" +[no]rrcomments (Control display of per-record " + "comments)\n" " +[no]question (Control display of question)\n" " +[no]answer (Control display of answer)\n" " +[no]authority (Control display of authority)\n" @@ -213,7 +216,7 @@ help(void) { " +[no]qr (Print question before sending)\n" " +[no]nssearch (Search all authoritative nameservers)\n" " +[no]identify (ID responders in short answers)\n" -" +[no]trace (Trace delegation down from root)\n" +" +[no]trace (Trace delegation down from root [+dnssec])\n" " +[no]dnssec (Request DNSSEC records)\n" " +[no]nsid (Request Name Server ID)\n" #ifdef DIG_SIGCHASE @@ -223,6 +226,7 @@ help(void) { " +[no]topdown (Do DNSSEC validation top down mode)\n" #endif #endif +" +[no]split=## (Split hex/base64 fields into chunks)\n" " +[no]multiline (Print records in an expanded format)\n" " +[no]onesoa (AXFR prints only one soa record)\n" " global d-opts and servers (before host name) affect all queries.\n" @@ -395,6 +399,8 @@ printrdataset(dns_name_t *owner_name, dns_rdataset_t *rdataset, styleflags |= DNS_STYLEFLAG_NO_TTL; if (noclass) styleflags |= DNS_STYLEFLAG_NO_CLASS; + if (rrcomments) + styleflags |= DNS_STYLEFLAG_RRCOMMENT; if (multiline) { styleflags |= DNS_STYLEFLAG_OMIT_OWNER; styleflags |= DNS_STYLEFLAG_OMIT_CLASS; @@ -403,16 +409,21 @@ printrdataset(dns_name_t *owner_name, dns_rdataset_t *rdataset, styleflags |= DNS_STYLEFLAG_TTL; styleflags |= DNS_STYLEFLAG_MULTILINE; styleflags |= DNS_STYLEFLAG_COMMENT; + styleflags |= DNS_STYLEFLAG_RRCOMMENT; } + if (multiline || (nottl && noclass)) - result = dns_master_stylecreate(&style, styleflags, - 24, 24, 24, 32, 80, 8, mctx); + result = dns_master_stylecreate2(&style, styleflags, + 24, 24, 24, 32, 80, 8, + splitwidth, mctx); else if (nottl || noclass) - result = dns_master_stylecreate(&style, styleflags, - 24, 24, 32, 40, 80, 8, mctx); + result = dns_master_stylecreate2(&style, styleflags, + 24, 24, 32, 40, 80, 8, + splitwidth, mctx); else - result = dns_master_stylecreate(&style, styleflags, - 24, 32, 40, 48, 80, 8, mctx); + result = dns_master_stylecreate2(&style, styleflags, + 24, 32, 40, 48, 80, 8, + splitwidth, mctx); check_result(result, "dns_master_stylecreate"); result = dns_master_rdatasettotext(owner_name, rdataset, style, target); @@ -437,6 +448,10 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) { unsigned int styleflags = 0; styleflags |= DNS_STYLEFLAG_REL_OWNER; + if (query->lookup->comments) + styleflags |= DNS_STYLEFLAG_COMMENT; + if (rrcomments) + styleflags |= DNS_STYLEFLAG_RRCOMMENT; if (nottl) styleflags |= DNS_STYLEFLAG_NO_TTL; if (noclass) @@ -448,17 +463,20 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) { styleflags |= DNS_STYLEFLAG_OMIT_TTL; styleflags |= DNS_STYLEFLAG_TTL; styleflags |= DNS_STYLEFLAG_MULTILINE; - styleflags |= DNS_STYLEFLAG_COMMENT; + styleflags |= DNS_STYLEFLAG_RRCOMMENT; } if (multiline || (nottl && noclass)) - result = dns_master_stylecreate(&style, styleflags, - 24, 24, 24, 32, 80, 8, mctx); + result = dns_master_stylecreate2(&style, styleflags, + 24, 24, 24, 32, 80, 8, + splitwidth, mctx); else if (nottl || noclass) - result = dns_master_stylecreate(&style, styleflags, - 24, 24, 32, 40, 80, 8, mctx); + result = dns_master_stylecreate2(&style, styleflags, + 24, 24, 32, 40, 80, 8, + splitwidth, mctx); else - result = dns_master_stylecreate(&style, styleflags, - 24, 32, 40, 48, 80, 8, mctx); + result = dns_master_stylecreate2(&style, styleflags, + 24, 32, 40, 48, 80, 8, + splitwidth, mctx); check_result(result, "dns_master_stylecreate"); if (query->lookup->cmdline[0] != 0) { @@ -765,6 +783,7 @@ plus_option(char *option, isc_boolean_t is_batchfile, lookup->section_answer = state; lookup->section_additional = state; lookup->comments = state; + rrcomments = state; lookup->stats = state; printcmd = state; break; @@ -925,6 +944,7 @@ plus_option(char *option, isc_boolean_t is_batchfile, lookup->identify = ISC_TRUE; lookup->stats = ISC_FALSE; lookup->comments = ISC_FALSE; + rrcomments = ISC_FALSE; lookup->section_additional = ISC_FALSE; lookup->section_authority = ISC_FALSE; lookup->section_question = ISC_FALSE; @@ -985,6 +1005,10 @@ plus_option(char *option, isc_boolean_t is_batchfile, goto invalid_option; } break; + case 'r': /* rrcomments */ + FULLCHECK("rrcomments"); + rrcomments = state; + break; default: goto invalid_option; } @@ -1011,6 +1035,7 @@ plus_option(char *option, isc_boolean_t is_batchfile, lookup->section_authority = ISC_FALSE; lookup->section_question = ISC_FALSE; lookup->comments = ISC_FALSE; + rrcomments = ISC_FALSE; lookup->stats = ISC_FALSE; } break; @@ -1033,6 +1058,36 @@ plus_option(char *option, isc_boolean_t is_batchfile, lookup->dnssec = ISC_TRUE; break; #endif + case 'p': /* split */ + FULLCHECK("split"); + if (value != NULL && !state) + goto invalid_option; + if (!state) { + splitwidth = 0; + break; + } else if (value == NULL) + break; + + result = parse_uint(&splitwidth, value, + 1023, "split"); + if (splitwidth % 4 != 0) { + splitwidth = ((splitwidth + 3) / 4) * 4; + fprintf(stderr, ";; Warning, split must be " + "a multiple of 4; adjusting " + "to %d\n", splitwidth); + } + /* + * There is an adjustment done in the + * totext_<rrtype>() functions which causes + * splitwidth to shrink. This is okay when we're + * using the default width but incorrect in this + * case, so we correct for it + */ + if (splitwidth) + splitwidth += 3; + if (result != ISC_R_SUCCESS) + fatal("Couldn't parse retries"); + break; case 't': /* stats */ FULLCHECK("stats"); lookup->stats = state; @@ -1077,10 +1132,12 @@ plus_option(char *option, isc_boolean_t is_batchfile, lookup->recurse = ISC_FALSE; lookup->identify = ISC_TRUE; lookup->comments = ISC_FALSE; + rrcomments = ISC_FALSE; lookup->stats = ISC_FALSE; lookup->section_additional = ISC_FALSE; lookup->section_authority = ISC_TRUE; lookup->section_question = ISC_FALSE; + lookup->dnssec = ISC_TRUE; usesearch = ISC_FALSE; } break; @@ -1484,6 +1541,8 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, if (!is_batchfile) { debug("making new lookup"); default_lookup = make_empty_lookup(); + default_lookup->adflag = ISC_TRUE; + default_lookup->edns = 0; #ifndef NOPOSIX /* diff --git a/bin/dig/dig.docbook b/bin/dig/dig.docbook index 1285c43..028f0fc 100644 --- a/bin/dig/dig.docbook +++ b/bin/dig/dig.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [<!ENTITY mdash "—">]> <!-- - - Copyright (C) 2004-2010, 2013 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004-2011, 2013 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000-2003 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: dig.docbook,v 1.47 2010/03/04 23:50:34 tbox Exp $ --> +<!-- $Id: dig.docbook,v 1.51 2011/11/04 11:02:50 jreed Exp $ --> <refentry id="man.dig"> <refentryinfo> @@ -45,6 +45,7 @@ <year>2008</year> <year>2009</year> <year>2010</year> + <year>2011</year> <year>2013</year> <holder>Internet Systems Consortium, Inc. ("ISC")</holder> </copyright> @@ -467,7 +468,8 @@ policy of the server. AD=1 indicates that all records have been validated as secure and the answer is not from a OPT-OUT range. AD=0 indicate that some part - of the answer was insecure or not validated. + of the answer was insecure or not validated. This + bit is set by default. </para> </listitem> </varlistentry> @@ -504,19 +506,17 @@ <varlistentry> <term><option>+[no]recurse</option></term> - <listitem> - <para> - Toggle the setting of the RD (recursion desired) bit in the - query. - This bit is set by default, which means <command>dig</command> - normally sends recursive queries. Recursion is automatically - disabled - when the <parameter>+nssearch</parameter> or - <parameter>+trace</parameter> query options are - used. - </para> - </listitem> - </varlistentry> + <listitem> + <para> + Toggle the setting of the RD (recursion desired) bit + in the query. This bit is set by default, which means + <command>dig</command> normally sends recursive + queries. Recursion is automatically disabled when + the <parameter>+nssearch</parameter> or + <parameter>+trace</parameter> query options are used. + </para> + </listitem> + </varlistentry> <varlistentry> <term><option>+[no]nssearch</option></term> @@ -536,20 +536,21 @@ <varlistentry> <term><option>+[no]trace</option></term> <listitem> - <para> - Toggle tracing of the delegation path from the root name servers - for - the name being looked up. Tracing is disabled by default. When - tracing is enabled, <command>dig</command> makes - iterative queries to - resolve the name being looked up. It will follow referrals from - the - root servers, showing the answer from each server that was used - to - resolve the lookup. - </para> - </listitem> - </varlistentry> + <para> + Toggle tracing of the delegation path from the root + name servers for the name being looked up. Tracing + is disabled by default. When tracing is enabled, + <command>dig</command> makes iterative queries to + resolve the name being looked up. It will follow + referrals from the root servers, showing the answer + from each server that was used to resolve the lookup. + </para> + <para> + <command>+dnssec</command> is also set when +trace is + set to better emulate the default queries from a nameserver. + </para> + </listitem> + </varlistentry> <varlistentry> <term><option>+[no]cmd</option></term> @@ -594,8 +595,35 @@ <listitem> <para> Toggle the display of comment lines in the output. The default - is to - print comments. + is to print comments. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term><option>+[no]rrcomments</option></term> + <listitem> + <para> + Toggle the display of per-record comments in the output (for + example, human-readable key information about DNSKEY records). + The default is not to print record comments unless multiline + mode is active. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term><option>+split=W</option></term> + <listitem> + <para> + Split long hex- or base64-formatted fields in resource + records into chunks of <parameter>W</parameter> characters + (where <parameter>W</parameter> is rounded up to the nearest + multiple of 4). + <parameter>+nosplit</parameter> or + <parameter>+split=0</parameter> causes fields not to be + split at all. The default is 56 characters, or 44 characters + when multiline mode is active. </para> </listitem> </varlistentry> @@ -755,9 +783,10 @@ <listitem> <para> Specify the EDNS version to query with. Valid values - are 0 to 255. Setting the EDNS version will cause a - EDNS query to be sent. <option>+noedns</option> clears the - remembered EDNS version. + are 0 to 255. Setting the EDNS version will cause + a EDNS query to be sent. <option>+noedns</option> + clears the remembered EDNS version. EDNS is set to + 0 by default. </para> </listitem> </varlistentry> diff --git a/bin/dig/dig.html b/bin/dig/dig.html index a1cd5cf..768582e 100644 --- a/bin/dig/dig.html +++ b/bin/dig/dig.html @@ -1,5 +1,5 @@ <!-- - - Copyright (C) 2004-2010, 2013 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004-2011, 2013 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000-2003 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -34,7 +34,7 @@ <div class="cmdsynopsis"><p><code class="command">dig</code> [global-queryopt...] [query...]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543527"></a><h2>DESCRIPTION</h2> +<a name="id2543530"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">dig</strong></span> (domain information groper) is a flexible tool for interrogating DNS name servers. It performs DNS lookups and @@ -81,7 +81,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543606"></a><h2>SIMPLE USAGE</h2> +<a name="id2543609"></a><h2>SIMPLE USAGE</h2> <p> A typical invocation of <span><strong class="command">dig</strong></span> looks like: </p> @@ -134,7 +134,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543709"></a><h2>OPTIONS</h2> +<a name="id2543713"></a><h2>OPTIONS</h2> <p> The <code class="option">-b</code> option sets the source IP address of the query to <em class="parameter"><code>address</code></em>. This must be a valid @@ -238,7 +238,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2544058"></a><h2>QUERY OPTIONS</h2> +<a name="id2544061"></a><h2>QUERY OPTIONS</h2> <p><span><strong class="command">dig</strong></span> provides a number of query options which affect the way in which lookups are made and the results displayed. Some of @@ -323,7 +323,8 @@ policy of the server. AD=1 indicates that all records have been validated as secure and the answer is not from a OPT-OUT range. AD=0 indicate that some part - of the answer was insecure or not validated. + of the answer was insecure or not validated. This + bit is set by default. </p></dd> <dt><span class="term"><code class="option">+[no]cdflag</code></span></dt> <dd><p> @@ -342,15 +343,13 @@ </p></dd> <dt><span class="term"><code class="option">+[no]recurse</code></span></dt> <dd><p> - Toggle the setting of the RD (recursion desired) bit in the - query. - This bit is set by default, which means <span><strong class="command">dig</strong></span> - normally sends recursive queries. Recursion is automatically - disabled - when the <em class="parameter"><code>+nssearch</code></em> or - <em class="parameter"><code>+trace</code></em> query options are - used. - </p></dd> + Toggle the setting of the RD (recursion desired) bit + in the query. This bit is set by default, which means + <span><strong class="command">dig</strong></span> normally sends recursive + queries. Recursion is automatically disabled when + the <em class="parameter"><code>+nssearch</code></em> or + <em class="parameter"><code>+trace</code></em> query options are used. + </p></dd> <dt><span class="term"><code class="option">+[no]nssearch</code></span></dt> <dd><p> When this option is set, <span><strong class="command">dig</strong></span> @@ -362,18 +361,21 @@ zone. </p></dd> <dt><span class="term"><code class="option">+[no]trace</code></span></dt> -<dd><p> - Toggle tracing of the delegation path from the root name servers - for - the name being looked up. Tracing is disabled by default. When - tracing is enabled, <span><strong class="command">dig</strong></span> makes - iterative queries to - resolve the name being looked up. It will follow referrals from - the - root servers, showing the answer from each server that was used - to - resolve the lookup. - </p></dd> +<dd> +<p> + Toggle tracing of the delegation path from the root + name servers for the name being looked up. Tracing + is disabled by default. When tracing is enabled, + <span><strong class="command">dig</strong></span> makes iterative queries to + resolve the name being looked up. It will follow + referrals from the root servers, showing the answer + from each server that was used to resolve the lookup. + </p> +<p> + <span><strong class="command">+dnssec</strong></span> is also set when +trace is + set to better emulate the default queries from a nameserver. + </p> +</dd> <dt><span class="term"><code class="option">+[no]cmd</code></span></dt> <dd><p> Toggles the printing of the initial comment in the output @@ -400,8 +402,25 @@ <dt><span class="term"><code class="option">+[no]comments</code></span></dt> <dd><p> Toggle the display of comment lines in the output. The default - is to - print comments. + is to print comments. + </p></dd> +<dt><span class="term"><code class="option">+[no]rrcomments</code></span></dt> +<dd><p> + Toggle the display of per-record comments in the output (for + example, human-readable key information about DNSKEY records). + The default is not to print record comments unless multiline + mode is active. + </p></dd> +<dt><span class="term"><code class="option">+split=W</code></span></dt> +<dd><p> + Split long hex- or base64-formatted fields in resource + records into chunks of <em class="parameter"><code>W</code></em> characters + (where <em class="parameter"><code>W</code></em> is rounded up to the nearest + multiple of 4). + <em class="parameter"><code>+nosplit</code></em> or + <em class="parameter"><code>+split=0</code></em> causes fields not to be + split at all. The default is 56 characters, or 44 characters + when multiline mode is active. </p></dd> <dt><span class="term"><code class="option">+[no]stats</code></span></dt> <dd><p> @@ -496,9 +515,10 @@ <dt><span class="term"><code class="option">+edns=#</code></span></dt> <dd><p> Specify the EDNS version to query with. Valid values - are 0 to 255. Setting the EDNS version will cause a - EDNS query to be sent. <code class="option">+noedns</code> clears the - remembered EDNS version. + are 0 to 255. Setting the EDNS version will cause + a EDNS query to be sent. <code class="option">+noedns</code> + clears the remembered EDNS version. EDNS is set to + 0 by default. </p></dd> <dt><span class="term"><code class="option">+[no]multiline</code></span></dt> <dd><p> @@ -569,7 +589,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2545207"></a><h2>MULTIPLE QUERIES</h2> +<a name="id2545324"></a><h2>MULTIPLE QUERIES</h2> <p> The BIND 9 implementation of <span><strong class="command">dig </strong></span> supports @@ -615,7 +635,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr </p> </div> <div class="refsect1" lang="en"> -<a name="id2545337"></a><h2>IDN SUPPORT</h2> +<a name="id2545386"></a><h2>IDN SUPPORT</h2> <p> If <span><strong class="command">dig</strong></span> has been built with IDN (internationalized domain name) support, it can accept and display non-ASCII domain names. @@ -629,14 +649,14 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr </p> </div> <div class="refsect1" lang="en"> -<a name="id2545360"></a><h2>FILES</h2> +<a name="id2545409"></a><h2>FILES</h2> <p><code class="filename">/etc/resolv.conf</code> </p> <p><code class="filename">${HOME}/.digrc</code> </p> </div> <div class="refsect1" lang="en"> -<a name="id2545377"></a><h2>SEE ALSO</h2> +<a name="id2545426"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">host</span>(1)</span>, <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>, @@ -644,7 +664,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr </p> </div> <div class="refsect1" lang="en"> -<a name="id2545414"></a><h2>BUGS</h2> +<a name="id2545531"></a><h2>BUGS</h2> <p> There are probably too many query options. </p> diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c index 8ea7d8e..3c4b335 100644 --- a/bin/dig/dighost.c +++ b/bin/dig/dighost.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dighost.c,v 1.336.22.9 2011/12/07 17:23:55 each Exp $ */ +/* $Id: dighost.c,v 1.345 2011/12/07 17:23:28 each Exp $ */ /*! \file * \note @@ -362,8 +362,6 @@ connect_timeout(isc_task_t *task, isc_event_t *event); static void launch_next_query(dig_query_t *query, isc_boolean_t include_question); -static void -send_tcp_connect(dig_query_t *query); static void * mem_alloc(void *arg, size_t size) { @@ -791,7 +789,6 @@ make_empty_lookup(void) { looknew->new_search = ISC_FALSE; looknew->done_as_is = ISC_FALSE; looknew->need_search = ISC_FALSE; - dns_fixedname_init(&looknew->fdomain); ISC_LINK_INIT(looknew, link); ISC_LIST_INIT(looknew->q); ISC_LIST_INIT(looknew->connecting); @@ -868,8 +865,6 @@ clone_lookup(dig_lookup_t *lookold, isc_boolean_t servers) { looknew->tsigctx = NULL; looknew->need_search = lookold->need_search; looknew->done_as_is = lookold->done_as_is; - dns_name_copy(dns_fixedname_name(&lookold->fdomain), - dns_fixedname_name(&looknew->fdomain), NULL); if (servers) clone_server_list(lookold->my_server_list, @@ -1814,6 +1809,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) lookup->trace_root = ISC_FALSE; if (lookup->ns_search_only) lookup->recurse = ISC_FALSE; + dns_fixedname_init(&lookup->fdomain); domain = dns_fixedname_name(&lookup->fdomain); dns_name_copy(name, domain, NULL); } diff --git a/bin/dig/host.c b/bin/dig/host.c index 6b37f5f..49fe991 100644 --- a/bin/dig/host.c +++ b/bin/dig/host.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: host.c,v 1.124.40.3 2011/03/11 06:46:59 marka Exp $ */ +/* $Id: host.c,v 1.127 2011/03/11 06:11:20 marka Exp $ */ /*! \file */ diff --git a/bin/dig/include/dig/dig.h b/bin/dig/include/dig/dig.h index e039745..f04440c 100644 --- a/bin/dig/include/dig/dig.h +++ b/bin/dig/include/dig/dig.h @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dig.h,v 1.111.306.3 2011/12/07 17:23:55 each Exp $ */ +/* $Id: dig.h,v 1.114 2011/12/07 17:23:28 each Exp $ */ #ifndef DIG_H #define DIG_H diff --git a/bin/dig/nslookup.c b/bin/dig/nslookup.c index 2ef8f84..3f5b82f 100644 --- a/bin/dig/nslookup.c +++ b/bin/dig/nslookup.c @@ -15,11 +15,12 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: nslookup.c,v 1.127.38.2 2011/02/28 01:19:58 tbox Exp $ */ +/* $Id: nslookup.c,v 1.130 2011/12/16 23:01:16 each Exp $ */ #include <config.h> #include <stdlib.h> +#include <unistd.h> #include <isc/app.h> #include <isc/buffer.h> @@ -45,6 +46,11 @@ #include <dig/dig.h> +#if defined(HAVE_READLINE) +#include <readline/readline.h> +#include <readline/history.h> +#endif + static isc_boolean_t short_form = ISC_TRUE, tcpmode = ISC_FALSE, identify = ISC_FALSE, stats = ISC_TRUE, @@ -53,6 +59,8 @@ static isc_boolean_t short_form = ISC_TRUE, section_additional = ISC_TRUE, recurse = ISC_TRUE, aaonly = ISC_FALSE, nofail = ISC_TRUE; +static isc_boolean_t interactive; + static isc_boolean_t in_use = ISC_FALSE; static char defclass[MXRD] = "IN"; static char deftype[MXRD] = "A"; @@ -715,28 +723,12 @@ addlookup(char *opt) { } static void -get_next_command(void) { - char *buf; +do_next_command(char *input) { char *ptr, *arg; - char *input; - fflush(stdout); - buf = isc_mem_allocate(mctx, COMMSIZE); - if (buf == NULL) - fatal("memory allocation failure"); - fputs("> ", stderr); - fflush(stderr); - isc_app_block(); - ptr = fgets(buf, COMMSIZE, stdin); - isc_app_unblock(); - if (ptr == NULL) { - in_use = ISC_FALSE; - goto cleanup; - } - input = buf; ptr = next_token(&input, " \t\r\n"); if (ptr == NULL) - goto cleanup; + return; arg = next_token(&input, " \t\r\n"); if ((strcasecmp(ptr, "set") == 0) && (arg != NULL)) @@ -750,20 +742,48 @@ get_next_command(void) { show_settings(ISC_TRUE, ISC_TRUE); } else if (strcasecmp(ptr, "exit") == 0) { in_use = ISC_FALSE; - goto cleanup; } else if (strcasecmp(ptr, "help") == 0 || strcasecmp(ptr, "?") == 0) { printf("The '%s' command is not yet implemented.\n", ptr); - goto cleanup; } else if (strcasecmp(ptr, "finger") == 0 || strcasecmp(ptr, "root") == 0 || strcasecmp(ptr, "ls") == 0 || strcasecmp(ptr, "view") == 0) { printf("The '%s' command is not implemented.\n", ptr); - goto cleanup; } else addlookup(ptr); - cleanup: +} + +static void +get_next_command(void) { + char *buf; + char *ptr; + + fflush(stdout); + buf = isc_mem_allocate(mctx, COMMSIZE); + if (buf == NULL) + fatal("memory allocation failure"); + isc_app_block(); + if (interactive) { +#ifdef HAVE_READLINE + ptr = readline("> "); + add_history(ptr); +#else + fputs("> ", stderr); + fflush(stderr); + ptr = fgets(buf, COMMSIZE, stdin); +#endif + } else + ptr = fgets(buf, COMMSIZE, stdin); + isc_app_unblock(); + if (ptr == NULL) { + in_use = ISC_FALSE; + } else + do_next_command(ptr); +#ifdef HAVE_READLINE + if (interactive) + free(ptr); +#endif isc_mem_free(mctx, buf); } @@ -859,6 +879,8 @@ int main(int argc, char **argv) { isc_result_t result; + interactive = ISC_TF(isatty(0)); + ISC_LIST_INIT(lookup_list); ISC_LIST_INIT(server_list); ISC_LIST_INIT(search_list); diff --git a/bin/dnssec/Makefile.in b/bin/dnssec/Makefile.in index 0bca141..4f8bceb 100644 --- a/bin/dnssec/Makefile.in +++ b/bin/dnssec/Makefile.in @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: Makefile.in,v 1.42 2009/12/05 23:31:40 each Exp $ +# $Id: Makefile.in,v 1.42.332.1 2011/03/16 06:37:51 each Exp $ srcdir = @srcdir@ VPATH = @srcdir@ @@ -44,19 +44,23 @@ NOSYMLIBS = ${DNSLIBS} ${ISCNOSYMLIBS} @LIBS@ # Alphabetically TARGETS = dnssec-keygen@EXEEXT@ dnssec-signzone@EXEEXT@ \ dnssec-keyfromlabel@EXEEXT@ dnssec-dsfromkey@EXEEXT@ \ - dnssec-revoke@EXEEXT@ dnssec-settime@EXEEXT@ + dnssec-revoke@EXEEXT@ dnssec-settime@EXEEXT@ \ + dnssec-verify@EXEEXT@ OBJS = dnssectool.@O@ SRCS = dnssec-dsfromkey.c dnssec-keyfromlabel.c dnssec-keygen.c \ - dnssec-revoke.c dnssec-settime.c dnssec-signzone.c dnssectool.c + dnssec-revoke.c dnssec-settime.c dnssec-signzone.c \ + dnssec-verify.c dnssectool.c MANPAGES = dnssec-dsfromkey.8 dnssec-keyfromlabel.8 dnssec-keygen.8 \ - dnssec-revoke.8 dnssec-settime.8 dnssec-signzone.8 + dnssec-revoke.8 dnssec-settime.8 dnssec-signzone.8 \ + dnssec-verify.8 HTMLPAGES = dnssec-dsfromkey.html dnssec-keyfromlabel.html \ dnssec-keygen.html dnssec-revoke.html \ - dnssec-settime.html dnssec-signzone.html + dnssec-settime.html dnssec-signzone.html \ + dnssec-verify.html MANOBJS = ${MANPAGES} ${HTMLPAGES} @@ -82,6 +86,14 @@ dnssec-signzone@EXEEXT@: dnssec-signzone.@O@ ${OBJS} ${DEPLIBS} export BASEOBJS="dnssec-signzone.@O@ ${OBJS}"; \ ${FINALBUILDCMD} +dnssec-verify.@O@: dnssec-verify.c + ${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \ + -c ${srcdir}/dnssec-verify.c + +dnssec-verify@EXEEXT@: dnssec-verify.@O@ ${OBJS} ${DEPLIBS} + export BASEOBJS="dnssec-verify.@O@ ${OBJS}"; \ + ${FINALBUILDCMD} + dnssec-revoke@EXEEXT@: dnssec-revoke.@O@ ${OBJS} ${DEPLIBS} ${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \ dnssec-revoke.@O@ ${OBJS} ${LIBS} diff --git a/bin/dnssec/dnssec-dsfromkey.8 b/bin/dnssec/dnssec-dsfromkey.8 index ae9bb54..89d4228 100644 --- a/bin/dnssec/dnssec-dsfromkey.8 +++ b/bin/dnssec/dnssec-dsfromkey.8 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2008-2010, 2012 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2008-2012 Internet Systems Consortium, Inc. ("ISC") .\" .\" Permission to use, copy, modify, and/or distribute this software for any .\" purpose with or without fee is hereby granted, provided that the above @@ -32,9 +32,9 @@ dnssec\-dsfromkey \- DNSSEC DS RR generation tool .SH "SYNOPSIS" .HP 17 -\fBdnssec\-dsfromkey\fR [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-1\fR] [\fB\-2\fR] [\fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] {keyfile} +\fBdnssec\-dsfromkey\fR [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-1\fR] [\fB\-2\fR] [\fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] {keyfile} .HP 17 -\fBdnssec\-dsfromkey\fR {\-s} [\fB\-1\fR] [\fB\-2\fR] [\fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-s\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-f\ \fR\fB\fIfile\fR\fR] [\fB\-A\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] {dnsname} +\fBdnssec\-dsfromkey\fR {\-s} [\fB\-1\fR] [\fB\-2\fR] [\fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-s\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] [\fB\-f\ \fR\fB\fIfile\fR\fR] [\fB\-A\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] {dnsname} .SH "DESCRIPTION" .PP \fBdnssec\-dsfromkey\fR @@ -58,6 +58,11 @@ Select the digest algorithm. The value of must be one of SHA\-1 (SHA1), SHA\-256 (SHA256), GOST or SHA\-384 (SHA384). These values are case insensitive. .RE .PP +\-T \fITTL\fR +.RS 4 +Specifies the TTL of the DS records. +.RE +.PP \-K \fIdirectory\fR .RS 4 Look for key files (or, in keyset mode, @@ -71,6 +76,15 @@ files) in Zone file mode: in place of the keyfile name, the argument is the DNS domain name of a zone master file, which can be read from \fBfile\fR. If the zone name is the same as \fBfile\fR, then it may be omitted. +.sp +If +\fBfile\fR +is set to +"\-", then the zone data is read from the standard input. This makes it possible to use the output of the +\fBdig\fR +command as input, as in: +.sp +\fBdig dnskey example.com | dnssec\-dsfromkey \-f \- example.com\fR .RE .PP \-A @@ -139,5 +153,5 @@ RFC 4509. .PP Internet Systems Consortium .SH "COPYRIGHT" -Copyright \(co 2008\-2010, 2012 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2008\-2012 Internet Systems Consortium, Inc. ("ISC") .br diff --git a/bin/dnssec/dnssec-dsfromkey.c b/bin/dnssec/dnssec-dsfromkey.c index 93d789b..bfedae8 100644 --- a/bin/dnssec/dnssec-dsfromkey.c +++ b/bin/dnssec/dnssec-dsfromkey.c @@ -14,7 +14,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dnssec-dsfromkey.c,v 1.19.14.2 2011/09/05 23:45:53 tbox Exp $ */ +/* $Id: dnssec-dsfromkey.c,v 1.24 2011/10/25 01:54:18 marka Exp $ */ /*! \file */ @@ -31,12 +31,13 @@ #include <isc/string.h> #include <isc/util.h> +#include <dns/callbacks.h> #include <dns/db.h> #include <dns/dbiterator.h> #include <dns/ds.h> #include <dns/fixedname.h> -#include <dns/log.h> #include <dns/keyvalues.h> +#include <dns/log.h> #include <dns/master.h> #include <dns/name.h> #include <dns/rdata.h> @@ -61,6 +62,7 @@ static dns_rdataclass_t rdclass; static dns_fixedname_t fixed; static dns_name_t *name = NULL; static isc_mem_t *mctx = NULL; +static isc_uint32_t ttl; static isc_result_t initname(char *setname) { @@ -76,8 +78,28 @@ initname(char *setname) { return (result); } +static void +db_load_from_stream(dns_db_t *db, FILE *fp) { + isc_result_t result; + dns_rdatacallbacks_t callbacks; + + dns_rdatacallbacks_init(&callbacks); + result = dns_db_beginload(db, &callbacks.add, &callbacks.add_private); + if (result != ISC_R_SUCCESS) + fatal("dns_db_beginload failed: %s", isc_result_totext(result)); + + result = dns_master_loadstream(fp, name, name, rdclass, 0, + &callbacks, mctx); + if (result != ISC_R_SUCCESS) + fatal("can't load from input: %s", isc_result_totext(result)); + + result = dns_db_endload(db, &callbacks.add_private); + if (result != ISC_R_SUCCESS) + fatal("dns_db_endload failed: %s", isc_result_totext(result)); +} + static isc_result_t -loadsetfromfile(char *filename, dns_rdataset_t *rdataset) { +loadset(const char *filename, dns_rdataset_t *rdataset) { isc_result_t result; dns_db_t *db = NULL; dns_dbnode_t *node = NULL; @@ -90,9 +112,15 @@ loadsetfromfile(char *filename, dns_rdataset_t *rdataset) { if (result != ISC_R_SUCCESS) fatal("can't create database"); - result = dns_db_load(db, filename); - if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE) - fatal("can't load %s: %s", filename, isc_result_totext(result)); + if (strcmp(filename, "-") == 0) { + db_load_from_stream(db, stdin); + filename = "input"; + } else { + result = dns_db_load(db, filename); + if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE) + fatal("can't load %s: %s", filename, + isc_result_totext(result)); + } result = dns_db_findnode(db, name, ISC_FALSE, &node); if (result != ISC_R_SUCCESS) @@ -141,7 +169,7 @@ loadkeyset(char *dirname, dns_rdataset_t *rdataset) { return (ISC_R_NOSPACE); isc_buffer_putuint8(&buf, 0); - return (loadsetfromfile(filename, rdataset)); + return (loadset(filename, rdataset)); } static void @@ -256,7 +284,9 @@ emit(unsigned int dtype, isc_boolean_t showall, char *lookaside, } } - result = dns_rdata_totext(&ds, (dns_name_t *) NULL, &textb); + result = dns_rdata_tofmttext(&ds, (dns_name_t *) NULL, 0, 0, 0, "", + &textb); + if (result != ISC_R_SUCCESS) fatal("can't print rdata"); @@ -267,6 +297,9 @@ emit(unsigned int dtype, isc_boolean_t showall, char *lookaside, isc_buffer_usedregion(&nameb, &r); printf("%.*s ", (int)r.length, r.base); + if (ttl != 0U) + printf("%u ", ttl); + isc_buffer_usedregion(&classb, &r); printf("%.*s", (int)r.length, r.base); @@ -302,6 +335,7 @@ usage(void) { fprintf(stderr, " -l: add lookaside zone and print DLV records\n"); fprintf(stderr, " -s: read keyset from keyset-<dnsname> file\n"); fprintf(stderr, " -c class: rdata class for DS set (default: IN)\n"); + fprintf(stderr, " -T TTL\n"); fprintf(stderr, " -f file: read keyset from zone file\n"); fprintf(stderr, " -A: when used with -f, " "include all keys in DS set, not just KSKs\n"); @@ -341,7 +375,7 @@ main(int argc, char **argv) { isc_commandline_errprint = ISC_FALSE; while ((ch = isc_commandline_parse(argc, argv, - "12Aa:c:d:Ff:K:l:sv:h")) != -1) { + "12Aa:c:d:Ff:K:l:sT:v:h")) != -1) { switch (ch) { case '1': dtype = DNS_DSDIGEST_SHA1; @@ -381,6 +415,9 @@ main(int argc, char **argv) { case 's': usekeyset = ISC_TRUE; break; + case 'T': + ttl = atol(isc_commandline_argument); + break; case 'v': verbose = strtol(isc_commandline_argument, &endp, 0); if (*endp != '\0') @@ -466,7 +503,7 @@ main(int argc, char **argv) { if (usekeyset) result = loadkeyset(dir, &rdataset); else - result = loadsetfromfile(filename, &rdataset); + result = loadset(filename, &rdataset); if (result != ISC_R_SUCCESS) fatal("could not load DNSKEY set: %s\n", diff --git a/bin/dnssec/dnssec-dsfromkey.docbook b/bin/dnssec/dnssec-dsfromkey.docbook index d705033..77c0994 100644 --- a/bin/dnssec/dnssec-dsfromkey.docbook +++ b/bin/dnssec/dnssec-dsfromkey.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [<!ENTITY mdash "—">]> <!-- - - Copyright (C) 2008-2010, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2008-2012 Internet Systems Consortium, Inc. ("ISC") - - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above @@ -17,7 +17,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: dnssec-dsfromkey.docbook,v 1.12 2010/12/23 23:47:08 tbox Exp $ --> +<!-- $Id: dnssec-dsfromkey.docbook,v 1.17 2011/10/25 01:54:18 marka Exp $ --> <refentry id="man.dnssec-dsfromkey"> <refentryinfo> <date>August 26, 2009</date> @@ -39,6 +39,7 @@ <year>2008</year> <year>2009</year> <year>2010</year> + <year>2011</year> <year>2012</year> <holder>Internet Systems Consortium, Inc. ("ISC")</holder> </copyright> @@ -52,6 +53,7 @@ <arg><option>-2</option></arg> <arg><option>-a <replaceable class="parameter">alg</replaceable></option></arg> <arg><option>-l <replaceable class="parameter">domain</replaceable></option></arg> + <arg><option>-T <replaceable class="parameter">TTL</replaceable></option></arg> <arg choice="req">keyfile</arg> </cmdsynopsis> <cmdsynopsis> @@ -64,6 +66,7 @@ <arg><option>-l <replaceable class="parameter">domain</replaceable></option></arg> <arg><option>-s</option></arg> <arg><option>-c <replaceable class="parameter">class</replaceable></option></arg> + <arg><option>-T <replaceable class="parameter">TTL</replaceable></option></arg> <arg><option>-f <replaceable class="parameter">file</replaceable></option></arg> <arg><option>-A</option></arg> <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg> @@ -115,6 +118,15 @@ </varlistentry> <varlistentry> + <term>-T <replaceable class="parameter">TTL</replaceable></term> + <listitem> + <para> + Specifies the TTL of the DS records. + </para> + </listitem> + </varlistentry> + + <varlistentry> <term>-K <replaceable class="parameter">directory</replaceable></term> <listitem> <para> @@ -134,6 +146,15 @@ from <option>file</option>. If the zone name is the same as <option>file</option>, then it may be omitted. </para> + <para> + If <option>file</option> is set to <literal>"-"</literal>, then + the zone data is read from the standard input. This makes it + possible to use the output of the <command>dig</command> + command as input, as in: + </para> + <para> + <userinput>dig dnskey example.com | dnssec-dsfromkey -f - example.com</userinput> + </para> </listitem> </varlistentry> diff --git a/bin/dnssec/dnssec-dsfromkey.html b/bin/dnssec/dnssec-dsfromkey.html index 24bc0c1..50d4d78 100644 --- a/bin/dnssec/dnssec-dsfromkey.html +++ b/bin/dnssec/dnssec-dsfromkey.html @@ -1,5 +1,5 @@ <!-- - - Copyright (C) 2008-2010, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2008-2012 Internet Systems Consortium, Inc. ("ISC") - - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above @@ -28,18 +28,18 @@ </div> <div class="refsynopsisdiv"> <h2>Synopsis</h2> -<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] {keyfile}</p></div> -<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> {-s} [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-s</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-A</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {dnsname}</p></div> +<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] {keyfile}</p></div> +<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> {-s} [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-s</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-A</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {dnsname}</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543468"></a><h2>DESCRIPTION</h2> +<a name="id2543489"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">dnssec-dsfromkey</strong></span> outputs the Delegation Signer (DS) resource record (RR), as defined in RFC 3658 and RFC 4509, for the given key(s). </p> </div> <div class="refsect1" lang="en"> -<a name="id2543480"></a><h2>OPTIONS</h2> +<a name="id2543500"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-1</span></dt> <dd><p> @@ -57,6 +57,10 @@ SHA-256 (SHA256), GOST or SHA-384 (SHA384). These values are case insensitive. </p></dd> +<dt><span class="term">-T <em class="replaceable"><code>TTL</code></em></span></dt> +<dd><p> + Specifies the TTL of the DS records. + </p></dd> <dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt> <dd><p> Look for key files (or, in keyset mode, @@ -64,12 +68,23 @@ <code class="option">directory</code>. </p></dd> <dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt> -<dd><p> +<dd> +<p> Zone file mode: in place of the keyfile name, the argument is the DNS domain name of a zone master file, which can be read from <code class="option">file</code>. If the zone name is the same as <code class="option">file</code>, then it may be omitted. - </p></dd> + </p> +<p> + If <code class="option">file</code> is set to <code class="literal">"-"</code>, then + the zone data is read from the standard input. This makes it + possible to use the output of the <span><strong class="command">dig</strong></span> + command as input, as in: + </p> +<p> + <strong class="userinput"><code>dig dnskey example.com | dnssec-dsfromkey -f - example.com</code></strong> + </p> +</dd> <dt><span class="term">-A</span></dt> <dd><p> Include ZSK's when generating DS records. Without this option, @@ -101,7 +116,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2543667"></a><h2>EXAMPLE</h2> +<a name="id2543726"></a><h2>EXAMPLE</h2> <p> To build the SHA-256 DS RR from the <strong class="userinput"><code>Kexample.com.+003+26160</code></strong> @@ -116,7 +131,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543697"></a><h2>FILES</h2> +<a name="id2543756"></a><h2>FILES</h2> <p> The keyfile can be designed by the key identification <code class="filename">Knnnn.+aaa+iiiii</code> or the full file name @@ -130,13 +145,13 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543732"></a><h2>CAVEAT</h2> +<a name="id2543792"></a><h2>CAVEAT</h2> <p> A keyfile error can give a "file not found" even if the file exists. </p> </div> <div class="refsect1" lang="en"> -<a name="id2543741"></a><h2>SEE ALSO</h2> +<a name="id2543801"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>, <em class="citetitle">BIND 9 Administrator Reference Manual</em>, @@ -146,7 +161,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543781"></a><h2>AUTHOR</h2> +<a name="id2543841"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/bin/dnssec/dnssec-keyfromlabel.8 b/bin/dnssec/dnssec-keyfromlabel.8 index 9867ff7e..0e1ea16 100644 --- a/bin/dnssec/dnssec-keyfromlabel.8 +++ b/bin/dnssec/dnssec-keyfromlabel.8 @@ -32,7 +32,7 @@ dnssec\-keyfromlabel \- DNSSEC key generation tool .SH "SYNOPSIS" .HP 20 -\fBdnssec\-keyfromlabel\fR {\-l\ \fIlabel\fR} [\fB\-3\fR] [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-k\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-y\fR] {name} +\fBdnssec\-keyfromlabel\fR {\-l\ \fIlabel\fR} [\fB\-3\fR] [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-k\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-y\fR] {name} .SH "DESCRIPTION" .PP \fBdnssec\-keyfromlabel\fR @@ -122,6 +122,15 @@ Sets the directory in which the key files are to be written. Generate KEY records rather than DNSKEY records. .RE .PP +\-L \fIttl\fR +.RS 4 +Sets the default TTL to use for this key when it is converted into a DNSKEY RR. If the key is imported into a zone, this is the TTL that will be used for it, unless there was already a DNSKEY RRset in place, in which case the existing TTL would take precedence. Setting the default TTL to +0 +or +none +removes it. +.RE +.PP \-p \fIprotocol\fR .RS 4 Sets the protocol value for the key. The protocol is a number between 0 and 255. The default is 3 (DNSSEC). Other possible values for this argument are listed in RFC 2535 and its successors. diff --git a/bin/dnssec/dnssec-keyfromlabel.c b/bin/dnssec/dnssec-keyfromlabel.c index 6572d4c..3ad00d7 100644 --- a/bin/dnssec/dnssec-keyfromlabel.c +++ b/bin/dnssec/dnssec-keyfromlabel.c @@ -14,7 +14,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dnssec-keyfromlabel.c,v 1.32.14.4 2011/11/30 00:51:38 marka Exp $ */ +/* $Id: dnssec-keyfromlabel.c,v 1.38 2011/11/30 00:48:51 marka Exp $ */ /*! \file */ @@ -85,6 +85,7 @@ usage(void) { fprintf(stderr, " -K directory: directory in which to place " "key files\n"); fprintf(stderr, " -k: generate a TYPE=KEY key\n"); + fprintf(stderr, " -L ttl: default key TTL\n"); fprintf(stderr, " -n nametype: ZONE | HOST | ENTITY | USER | OTHER\n"); fprintf(stderr, " (DNSKEY generation defaults to ZONE\n"); fprintf(stderr, " -p protocol: default: 3 [dnssec]\n"); @@ -139,12 +140,13 @@ main(int argc, char **argv) { dns_rdataclass_t rdclass; int options = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC; char *label = NULL; + dns_ttl_t ttl = 0; isc_stdtime_t publish = 0, activate = 0, revoke = 0; isc_stdtime_t inactive = 0, delete = 0; isc_stdtime_t now; isc_boolean_t setpub = ISC_FALSE, setact = ISC_FALSE; isc_boolean_t setrev = ISC_FALSE, setinact = ISC_FALSE; - isc_boolean_t setdel = ISC_FALSE; + isc_boolean_t setdel = ISC_FALSE, setttl = ISC_FALSE; isc_boolean_t unsetpub = ISC_FALSE, unsetact = ISC_FALSE; isc_boolean_t unsetrev = ISC_FALSE, unsetinact = ISC_FALSE; isc_boolean_t unsetdel = ISC_FALSE; @@ -166,7 +168,7 @@ main(int argc, char **argv) { isc_stdtime_get(&now); while ((ch = isc_commandline_parse(argc, argv, - "3a:Cc:E:f:K:kl:n:p:t:v:yFhGP:A:R:I:D:")) != -1) + "3a:Cc:E:f:K:kl:L:n:p:t:v:yFhGP:A:R:I:D:")) != -1) { switch (ch) { case '3': @@ -204,6 +206,13 @@ main(int argc, char **argv) { case 'k': options |= DST_TYPE_KEY; break; + case 'L': + if (strcmp(isc_commandline_argument, "none") == 0) + ttl = 0; + else + ttl = strtottl(isc_commandline_argument); + setttl = ISC_TRUE; + break; case 'l': label = isc_mem_strdup(mctx, isc_commandline_argument); break; @@ -517,6 +526,10 @@ main(int argc, char **argv) { dst_key_setprivateformat(key, 1, 2); } + /* Set default key TTL */ + if (setttl) + dst_key_setttl(key, ttl); + /* * Do not overwrite an existing key. Warn LOUDLY if there * is a risk of ID collision due to this key or another key diff --git a/bin/dnssec/dnssec-keyfromlabel.docbook b/bin/dnssec/dnssec-keyfromlabel.docbook index 4662e87..0dd3c0e 100644 --- a/bin/dnssec/dnssec-keyfromlabel.docbook +++ b/bin/dnssec/dnssec-keyfromlabel.docbook @@ -17,7 +17,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: dnssec-keyfromlabel.docbook,v 1.18.14.2 2011/02/28 01:19:58 tbox Exp $ --> +<!-- $Id: dnssec-keyfromlabel.docbook,v 1.21 2011/03/17 01:40:34 each Exp $ --> <refentry id="man.dnssec-keyfromlabel"> <refentryinfo> <date>February 8, 2008</date> @@ -60,6 +60,7 @@ <arg><option>-I <replaceable class="parameter">date/offset</replaceable></option></arg> <arg><option>-k</option></arg> <arg><option>-K <replaceable class="parameter">directory</replaceable></option></arg> + <arg><option>-L <replaceable class="parameter">ttl</replaceable></option></arg> <arg><option>-n <replaceable class="parameter">nametype</replaceable></option></arg> <arg><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg> <arg><option>-p <replaceable class="parameter">protocol</replaceable></option></arg> @@ -237,6 +238,20 @@ </varlistentry> <varlistentry> + <term>-L <replaceable class="parameter">ttl</replaceable></term> + <listitem> + <para> + Sets the default TTL to use for this key when it is converted + into a DNSKEY RR. If the key is imported into a zone, + this is the TTL that will be used for it, unless there was + already a DNSKEY RRset in place, in which case the existing TTL + would take precedence. Setting the default TTL to + <literal>0</literal> or <literal>none</literal> removes it. + </para> + </listitem> + </varlistentry> + + <varlistentry> <term>-p <replaceable class="parameter">protocol</replaceable></term> <listitem> <para> diff --git a/bin/dnssec/dnssec-keyfromlabel.html b/bin/dnssec/dnssec-keyfromlabel.html index 0fa3aff..f0e2c5c 100644 --- a/bin/dnssec/dnssec-keyfromlabel.html +++ b/bin/dnssec/dnssec-keyfromlabel.html @@ -28,10 +28,10 @@ </div> <div class="refsynopsisdiv"> <h2>Synopsis</h2> -<div class="cmdsynopsis"><p><code class="command">dnssec-keyfromlabel</code> {-l <em class="replaceable"><code>label</code></em>} [<code class="option">-3</code>] [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-k</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-y</code>] {name}</p></div> +<div class="cmdsynopsis"><p><code class="command">dnssec-keyfromlabel</code> {-l <em class="replaceable"><code>label</code></em>} [<code class="option">-3</code>] [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-k</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-y</code>] {name}</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543498"></a><h2>DESCRIPTION</h2> +<a name="id2543507"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">dnssec-keyfromlabel</strong></span> gets keys with the given label from a crypto hardware and builds key files for DNSSEC (Secure DNS), as defined in RFC 2535 @@ -44,7 +44,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543516"></a><h2>OPTIONS</h2> +<a name="id2543525"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt> <dd> @@ -135,6 +135,15 @@ <dd><p> Generate KEY records rather than DNSKEY records. </p></dd> +<dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt> +<dd><p> + Sets the default TTL to use for this key when it is converted + into a DNSKEY RR. If the key is imported into a zone, + this is the TTL that will be used for it, unless there was + already a DNSKEY RRset in place, in which case the existing TTL + would take precedence. Setting the default TTL to + <code class="literal">0</code> or <code class="literal">none</code> removes it. + </p></dd> <dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt> <dd><p> Sets the protocol value for the key. The protocol @@ -164,7 +173,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2543880"></a><h2>TIMING OPTIONS</h2> +<a name="id2543980"></a><h2>TIMING OPTIONS</h2> <p> Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '-', it is interpreted as @@ -211,7 +220,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2544046"></a><h2>GENERATED KEY FILES</h2> +<a name="id2543054"></a><h2>GENERATED KEY FILES</h2> <p> When <span><strong class="command">dnssec-keyfromlabel</strong></span> completes successfully, @@ -250,7 +259,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2544119"></a><h2>SEE ALSO</h2> +<a name="id2543127"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>, <em class="citetitle">BIND 9 Administrator Reference Manual</em>, @@ -258,7 +267,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2544152"></a><h2>AUTHOR</h2> +<a name="id2543160"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/bin/dnssec/dnssec-keygen.8 b/bin/dnssec/dnssec-keygen.8 index 689f23d..90daddd 100644 --- a/bin/dnssec/dnssec-keygen.8 +++ b/bin/dnssec/dnssec-keygen.8 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007-2010, 2012 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007-2012 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000-2003 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -33,7 +33,7 @@ dnssec\-keygen \- DNSSEC key generation tool .SH "SYNOPSIS" .HP 14 -\fBdnssec\-keygen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-e\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-r\ \fR\fB\fIrandomdev\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-z\fR] {name} +\fBdnssec\-keygen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-k\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-r\ \fR\fB\fIrandomdev\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-z\fR] {name} .SH "DESCRIPTION" .PP \fBdnssec\-keygen\fR @@ -103,11 +103,6 @@ Indicates that the DNS record containing the key should have the specified class Uses a crypto hardware (OpenSSL engine) for random number and, when supported, key generation. When compiled with PKCS#11 support it defaults to pkcs11; the empty name resets it to no engine. .RE .PP -\-e -.RS 4 -If generating an RSAMD5/RSASHA1 key, use a large exponent. -.RE -.PP \-f \fIflag\fR .RS 4 Set the specified flag in the flag field of the KEY/DNSKEY record. The only recognized flags are KSK (Key Signing Key) and REVOKE. @@ -139,6 +134,15 @@ Sets the directory in which the key files are to be written. Deprecated in favor of \-T KEY. .RE .PP +\-L \fIttl\fR +.RS 4 +Sets the default TTL to use for this key when it is converted into a DNSKEY RR. If the key is imported into a zone, this is the TTL that will be used for it, unless there was already a DNSKEY RRset in place, in which case the existing TTL would take precedence. Setting the default TTL to +0 +or +none +removes it. +.RE +.PP \-p \fIprotocol\fR .RS 4 Sets the protocol value for the generated key. The protocol is a number between 0 and 255. The default is 3 (DNSSEC). Other possible values for this argument are listed in RFC 2535 and its successors. @@ -298,7 +302,7 @@ RFC 4034. .PP Internet Systems Consortium .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007\-2010, 2012 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004, 2005, 2007\-2012 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000\-2003 Internet Software Consortium. .br diff --git a/bin/dnssec/dnssec-keygen.c b/bin/dnssec/dnssec-keygen.c index 3d22f99..1e61ca3 100644 --- a/bin/dnssec/dnssec-keygen.c +++ b/bin/dnssec/dnssec-keygen.c @@ -29,7 +29,7 @@ * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dnssec-keygen.c,v 1.115.14.4 2011/11/30 00:51:38 marka Exp $ */ +/* $Id: dnssec-keygen.c,v 1.120 2011/11/30 00:48:51 marka Exp $ */ /*! \file */ @@ -124,11 +124,12 @@ usage(void) { #else fprintf(stderr, " -E <engine name>\n"); #endif - fprintf(stderr, " -e: use large exponent (RSAMD5/RSASHA1 only)\n"); fprintf(stderr, " -f <keyflag>: KSK | REVOKE\n"); fprintf(stderr, " -g <generator>: use specified generator " "(DH only)\n"); + fprintf(stderr, " -L <ttl>: default key TTL\n"); fprintf(stderr, " -p <protocol>: (default: 3 [dnssec])\n"); + fprintf(stderr, " -r <randomdev>: a file containing random data\n"); fprintf(stderr, " -s <strength>: strength value this key signs DNS " "records with (default: 0)\n"); fprintf(stderr, " -T <rrtype>: DNSKEY | KEY (default: DNSKEY; " @@ -137,8 +138,6 @@ usage(void) { fprintf(stderr, " -t <type>: " "AUTHCONF | NOAUTHCONF | NOAUTH | NOCONF " "(default: AUTHCONF)\n"); - fprintf(stderr, " -r <randomdev>: a file containing random data\n"); - fprintf(stderr, " -h: print usage and exit\n"); fprintf(stderr, " -m <memory debugging mode>:\n"); fprintf(stderr, " usage | trace | record | size | mctx\n"); @@ -212,7 +211,7 @@ main(int argc, char **argv) { isc_boolean_t conflict = ISC_FALSE, null_key = ISC_FALSE; isc_boolean_t oldstyle = ISC_FALSE; isc_mem_t *mctx = NULL; - int ch, rsa_exp = 0, generator = 0, param = 0; + int ch, generator = 0, param = 0; int protocol = -1, size = -1, signatory = 0; isc_result_t ret; isc_textregion_t r; @@ -231,6 +230,7 @@ main(int argc, char **argv) { dns_rdataclass_t rdclass; int options = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC; int dbits = 0; + dns_ttl_t ttl = 0; isc_boolean_t use_default = ISC_FALSE, use_nsec3 = ISC_FALSE; isc_stdtime_t publish = 0, activate = 0, revoke = 0; isc_stdtime_t inactive = 0, delete = 0; @@ -238,7 +238,7 @@ main(int argc, char **argv) { int prepub = -1; isc_boolean_t setpub = ISC_FALSE, setact = ISC_FALSE; isc_boolean_t setrev = ISC_FALSE, setinact = ISC_FALSE; - isc_boolean_t setdel = ISC_FALSE; + isc_boolean_t setdel = ISC_FALSE, setttl = ISC_FALSE; isc_boolean_t unsetpub = ISC_FALSE, unsetact = ISC_FALSE; isc_boolean_t unsetrev = ISC_FALSE, unsetinact = ISC_FALSE; isc_boolean_t unsetdel = ISC_FALSE; @@ -257,7 +257,7 @@ main(int argc, char **argv) { /* * Process memory debugging argument first. */ -#define CMDLINE_FLAGS "3A:a:b:Cc:D:d:E:eFf:Gg:hI:i:K:km:n:P:p:qR:r:S:s:T:t:v:" +#define CMDLINE_FLAGS "3A:a:b:Cc:D:d:E:eFf:Gg:hI:i:K:kL:m:n:P:p:qR:r:S:s:T:t:v:" while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) { switch (ch) { case 'm': @@ -310,7 +310,9 @@ main(int argc, char **argv) { engine = isc_commandline_argument; break; case 'e': - rsa_exp = 1; + fprintf(stderr, + "phased-out option -e " + "(was 'use (RSA) large exponent)\n"); break; case 'f': c = (unsigned char)(isc_commandline_argument[0]); @@ -340,6 +342,13 @@ main(int argc, char **argv) { "To generate a key-signing key, use -f KSK.\n" "To generate a key with TYPE=KEY, use -T KEY.\n"); break; + case 'L': + if (strcmp(isc_commandline_argument, "none") == 0) + ttl = 0; + else + ttl = strtottl(isc_commandline_argument); + setttl = ISC_TRUE; + break; case 'n': nametype = isc_commandline_argument; break; @@ -782,13 +791,6 @@ main(int argc, char **argv) { break; } - if (!(alg == DNS_KEYALG_RSAMD5 || alg == DNS_KEYALG_RSASHA1 || - alg == DNS_KEYALG_NSEC3RSASHA1 || alg == DNS_KEYALG_RSASHA256 || - alg == DNS_KEYALG_RSASHA512 || alg == DST_ALG_ECCGOST || - alg == DST_ALG_ECDSA256 || alg == DST_ALG_ECDSA384) && - rsa_exp != 0) - fatal("specified RSA exponent for a non-RSA key"); - if (alg != DNS_KEYALG_DH && generator != 0) fatal("specified DH generator for a non-DH key"); @@ -848,7 +850,6 @@ main(int argc, char **argv) { case DNS_KEYALG_NSEC3RSASHA1: case DNS_KEYALG_RSASHA256: case DNS_KEYALG_RSASHA512: - param = rsa_exp; show_progress = ISC_TRUE; break; @@ -983,6 +984,10 @@ main(int argc, char **argv) { dst_key_setprivateformat(key, 1, 2); } + /* Set the default key TTL */ + if (setttl) + dst_key_setttl(key, ttl); + /* * Do not overwrite an existing key, or create a key * if there is a risk of ID collision due to this key diff --git a/bin/dnssec/dnssec-keygen.docbook b/bin/dnssec/dnssec-keygen.docbook index 0a1926b..bc50c02 100644 --- a/bin/dnssec/dnssec-keygen.docbook +++ b/bin/dnssec/dnssec-keygen.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [<!ENTITY mdash "—">]> <!-- - - Copyright (C) 2004, 2005, 2007-2010, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007-2012 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000-2003 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: dnssec-keygen.docbook,v 1.36 2010/12/23 04:07:59 marka Exp $ --> +<!-- $Id: dnssec-keygen.docbook,v 1.38 2011/03/17 23:47:29 tbox Exp $ --> <refentry id="man.dnssec-keygen"> <refentryinfo> <date>June 30, 2000</date> @@ -43,6 +43,7 @@ <year>2008</year> <year>2009</year> <year>2010</year> + <year>2011</year> <year>2012</year> <holder>Internet Systems Consortium, Inc. ("ISC")</holder> </copyright> @@ -67,7 +68,6 @@ <arg><option>-c <replaceable class="parameter">class</replaceable></option></arg> <arg><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg> <arg><option>-E <replaceable class="parameter">engine</replaceable></option></arg> - <arg><option>-e</option></arg> <arg><option>-f <replaceable class="parameter">flag</replaceable></option></arg> <arg><option>-G</option></arg> <arg><option>-g <replaceable class="parameter">generator</replaceable></option></arg> @@ -75,6 +75,7 @@ <arg><option>-I <replaceable class="parameter">date/offset</replaceable></option></arg> <arg><option>-i <replaceable class="parameter">interval</replaceable></option></arg> <arg><option>-K <replaceable class="parameter">directory</replaceable></option></arg> + <arg><option>-L <replaceable class="parameter">ttl</replaceable></option></arg> <arg><option>-k</option></arg> <arg><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg> <arg><option>-p <replaceable class="parameter">protocol</replaceable></option></arg> @@ -232,15 +233,6 @@ </varlistentry> <varlistentry> - <term>-e</term> - <listitem> - <para> - If generating an RSAMD5/RSASHA1 key, use a large exponent. - </para> - </listitem> - </varlistentry> - - <varlistentry> <term>-f <replaceable class="parameter">flag</replaceable></term> <listitem> <para> @@ -301,6 +293,20 @@ </varlistentry> <varlistentry> + <term>-L <replaceable class="parameter">ttl</replaceable></term> + <listitem> + <para> + Sets the default TTL to use for this key when it is converted + into a DNSKEY RR. If the key is imported into a zone, + this is the TTL that will be used for it, unless there was + already a DNSKEY RRset in place, in which case the existing TTL + would take precedence. Setting the default TTL to + <literal>0</literal> or <literal>none</literal> removes it. + </para> + </listitem> + </varlistentry> + + <varlistentry> <term>-p <replaceable class="parameter">protocol</replaceable></term> <listitem> <para> diff --git a/bin/dnssec/dnssec-keygen.html b/bin/dnssec/dnssec-keygen.html index 3bdfa07..ecf512b 100644 --- a/bin/dnssec/dnssec-keygen.html +++ b/bin/dnssec/dnssec-keygen.html @@ -1,5 +1,5 @@ <!-- - - Copyright (C) 2004, 2005, 2007-2010, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007-2012 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000-2003 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -29,10 +29,10 @@ </div> <div class="refsynopsisdiv"> <h2>Synopsis</h2> -<div class="cmdsynopsis"><p><code class="command">dnssec-keygen</code> [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-3</code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-C</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-e</code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-g <em class="replaceable"><code>generator</code></em></code>] [<code class="option">-h</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-k</code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-q</code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S <em class="replaceable"><code>key</code></em></code>] [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-z</code>] {name}</p></div> +<div class="cmdsynopsis"><p><code class="command">dnssec-keygen</code> [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-3</code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-C</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-g <em class="replaceable"><code>generator</code></em></code>] [<code class="option">-h</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-k</code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-q</code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S <em class="replaceable"><code>key</code></em></code>] [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-z</code>] {name}</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543582"></a><h2>DESCRIPTION</h2> +<a name="id2543590"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">dnssec-keygen</strong></span> generates keys for DNSSEC (Secure DNS), as defined in RFC 2535 and RFC 4034. It can also generate keys for use with @@ -46,7 +46,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543601"></a><h2>OPTIONS</h2> +<a name="id2543608"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt> <dd> @@ -139,10 +139,6 @@ support it defaults to pkcs11; the empty name resets it to no engine. </p></dd> -<dt><span class="term">-e</span></dt> -<dd><p> - If generating an RSAMD5/RSASHA1 key, use a large exponent. - </p></dd> <dt><span class="term">-f <em class="replaceable"><code>flag</code></em></span></dt> <dd><p> Set the specified flag in the flag field of the KEY/DNSKEY record. @@ -173,6 +169,15 @@ <dd><p> Deprecated in favor of -T KEY. </p></dd> +<dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt> +<dd><p> + Sets the default TTL to use for this key when it is converted + into a DNSKEY RR. If the key is imported into a zone, + this is the TTL that will be used for it, unless there was + already a DNSKEY RRset in place, in which case the existing TTL + would take precedence. Setting the default TTL to + <code class="literal">0</code> or <code class="literal">none</code> removes it. + </p></dd> <dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt> <dd><p> Sets the protocol value for the generated key. The protocol @@ -251,7 +256,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2544169"></a><h2>TIMING OPTIONS</h2> +<a name="id2544187"></a><h2>TIMING OPTIONS</h2> <p> Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '-', it is interpreted as @@ -322,7 +327,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2544359"></a><h2>GENERATED KEYS</h2> +<a name="id2544377"></a><h2>GENERATED KEYS</h2> <p> When <span><strong class="command">dnssec-keygen</strong></span> completes successfully, @@ -368,7 +373,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2544441"></a><h2>EXAMPLE</h2> +<a name="id2544459"></a><h2>EXAMPLE</h2> <p> To generate a 768-bit DSA key for the domain <strong class="userinput"><code>example.com</code></strong>, the following command would be @@ -389,7 +394,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2544485"></a><h2>SEE ALSO</h2> +<a name="id2544571"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>, <em class="citetitle">BIND 9 Administrator Reference Manual</em>, <em class="citetitle">RFC 2539</em>, @@ -398,7 +403,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2544584"></a><h2>AUTHOR</h2> +<a name="id2544602"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/bin/dnssec/dnssec-revoke.c b/bin/dnssec/dnssec-revoke.c index fb116e6..7b11581 100644 --- a/bin/dnssec/dnssec-revoke.c +++ b/bin/dnssec/dnssec-revoke.c @@ -14,7 +14,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dnssec-revoke.c,v 1.22.124.2 2011/10/20 23:46:27 tbox Exp $ */ +/* $Id: dnssec-revoke.c,v 1.24 2011/10/20 23:46:51 tbox Exp $ */ /*! \file */ diff --git a/bin/dnssec/dnssec-revoke.docbook b/bin/dnssec/dnssec-revoke.docbook index 99518bb..4062f5e 100644 --- a/bin/dnssec/dnssec-revoke.docbook +++ b/bin/dnssec/dnssec-revoke.docbook @@ -17,7 +17,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: dnssec-revoke.docbook,v 1.7.266.2 2011/10/20 23:46:27 tbox Exp $ --> +<!-- $Id: dnssec-revoke.docbook,v 1.9 2011/10/20 23:46:51 tbox Exp $ --> <refentry id="man.dnssec-revoke"> <refentryinfo> <date>June 1, 2009</date> diff --git a/bin/dnssec/dnssec-settime.8 b/bin/dnssec/dnssec-settime.8 index 8a5e2e7..7c0c3b2 100644 --- a/bin/dnssec/dnssec-settime.8 +++ b/bin/dnssec/dnssec-settime.8 @@ -32,7 +32,7 @@ dnssec\-settime \- Set the key timing metadata for a DNSSEC key .SH "SYNOPSIS" .HP 15 -\fBdnssec\-settime\fR [\fB\-f\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-h\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] {keyfile} +\fBdnssec\-settime\fR [\fB\-f\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-h\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] {keyfile} .SH "DESCRIPTION" .PP \fBdnssec\-settime\fR @@ -67,6 +67,15 @@ will fail when attempting to update a legacy key. With this option, the key will Sets the directory in which the key files are to reside. .RE .PP +\-L \fIttl\fR +.RS 4 +Sets the default TTL to use for this key when it is converted into a DNSKEY RR. If the key is imported into a zone, this is the TTL that will be used for it, unless there was already a DNSKEY RRset in place, in which case the existing TTL would take precedence. Setting the default TTL to +0 +or +none +removes it. +.RE +.PP \-h .RS 4 Emit usage message and exit. diff --git a/bin/dnssec/dnssec-settime.c b/bin/dnssec/dnssec-settime.c index a7fbed3..4c88a07 100644 --- a/bin/dnssec/dnssec-settime.c +++ b/bin/dnssec/dnssec-settime.c @@ -14,7 +14,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dnssec-settime.c,v 1.28.16.3 2011/06/02 20:24:11 each Exp $ */ +/* $Id: dnssec-settime.c,v 1.32 2011/06/02 20:24:45 each Exp $ */ /*! \file */ @@ -66,6 +66,7 @@ usage(void) { fprintf(stderr, " -f: force update of old-style " "keys\n"); fprintf(stderr, " -K directory: set key file location\n"); + fprintf(stderr, " -L ttl: set default key TTL\n"); fprintf(stderr, " -v level: set level of verbosity\n"); fprintf(stderr, " -h: help\n"); fprintf(stderr, "Timing options:\n"); @@ -137,12 +138,13 @@ main(int argc, char **argv) { unsigned int size = 0; isc_uint16_t flags = 0; int prepub = -1; + dns_ttl_t ttl = 0; isc_stdtime_t now; isc_stdtime_t pub = 0, act = 0, rev = 0, inact = 0, del = 0; isc_stdtime_t prevact = 0, previnact = 0, prevdel = 0; isc_boolean_t setpub = ISC_FALSE, setact = ISC_FALSE; isc_boolean_t setrev = ISC_FALSE, setinact = ISC_FALSE; - isc_boolean_t setdel = ISC_FALSE; + isc_boolean_t setdel = ISC_FALSE, setttl = ISC_FALSE; isc_boolean_t unsetpub = ISC_FALSE, unsetact = ISC_FALSE; isc_boolean_t unsetrev = ISC_FALSE, unsetinact = ISC_FALSE; isc_boolean_t unsetdel = ISC_FALSE; @@ -169,7 +171,7 @@ main(int argc, char **argv) { isc_stdtime_get(&now); -#define CMDLINE_FLAGS "A:D:E:fhI:i:K:P:p:R:S:uv:" +#define CMDLINE_FLAGS "A:D:E:fhI:i:K:L:P:p:R:S:uv:" while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) { switch (ch) { case 'E': @@ -233,6 +235,13 @@ main(int argc, char **argv) { "directory"); } break; + case 'L': + if (strcmp(isc_commandline_argument, "none") == 0) + ttl = 0; + else + ttl = strtottl(isc_commandline_argument); + setttl = ISC_TRUE; + break; case 'v': verbose = strtol(isc_commandline_argument, &endp, 0); if (*endp != '\0') @@ -535,6 +544,9 @@ main(int argc, char **argv) { else if (unsetdel) dst_key_unsettime(key, DST_TIME_DELETE); + if (setttl) + dst_key_setttl(key, ttl); + /* * No metadata changes were made but we're forcing an upgrade * to the new format anyway: use "-P now -A now" as the default @@ -545,6 +557,9 @@ main(int argc, char **argv) { changed = ISC_TRUE; } + if (!changed && setttl) + changed = ISC_TRUE; + /* * Print out time values, if -p was used. */ diff --git a/bin/dnssec/dnssec-settime.docbook b/bin/dnssec/dnssec-settime.docbook index 3d89b65..bc6870b 100644 --- a/bin/dnssec/dnssec-settime.docbook +++ b/bin/dnssec/dnssec-settime.docbook @@ -17,7 +17,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: dnssec-settime.docbook,v 1.11.70.3 2011/11/03 20:21:30 each Exp $ --> +<!-- $Id: dnssec-settime.docbook,v 1.15 2011/11/03 20:21:37 each Exp $ --> <refentry id="man.dnssec-settime"> <refentryinfo> <date>July 15, 2009</date> @@ -48,6 +48,7 @@ <command>dnssec-settime</command> <arg><option>-f</option></arg> <arg><option>-K <replaceable class="parameter">directory</replaceable></option></arg> + <arg><option>-L <replaceable class="parameter">ttl</replaceable></option></arg> <arg><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg> <arg><option>-A <replaceable class="parameter">date/offset</replaceable></option></arg> <arg><option>-R <replaceable class="parameter">date/offset</replaceable></option></arg> @@ -117,6 +118,20 @@ </varlistentry> <varlistentry> + <term>-L <replaceable class="parameter">ttl</replaceable></term> + <listitem> + <para> + Sets the default TTL to use for this key when it is converted + into a DNSKEY RR. If the key is imported into a zone, + this is the TTL that will be used for it, unless there was + already a DNSKEY RRset in place, in which case the existing TTL + would take precedence. Setting the default TTL to + <literal>0</literal> or <literal>none</literal> removes it. + </para> + </listitem> + </varlistentry> + + <varlistentry> <term>-h</term> <listitem> <para> diff --git a/bin/dnssec/dnssec-settime.html b/bin/dnssec/dnssec-settime.html index 0ac82bc..7b02265 100644 --- a/bin/dnssec/dnssec-settime.html +++ b/bin/dnssec/dnssec-settime.html @@ -28,10 +28,10 @@ </div> <div class="refsynopsisdiv"> <h2>Synopsis</h2> -<div class="cmdsynopsis"><p><code class="command">dnssec-settime</code> [<code class="option">-f</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] {keyfile}</p></div> +<div class="cmdsynopsis"><p><code class="command">dnssec-settime</code> [<code class="option">-f</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] {keyfile}</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543424"></a><h2>DESCRIPTION</h2> +<a name="id2543432"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">dnssec-settime</strong></span> reads a DNSSEC private key file and sets the key timing metadata as specified by the <code class="option">-P</code>, <code class="option">-A</code>, @@ -57,7 +57,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543472"></a><h2>OPTIONS</h2> +<a name="id2543480"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-f</span></dt> <dd><p> @@ -74,6 +74,15 @@ <dd><p> Sets the directory in which the key files are to reside. </p></dd> +<dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt> +<dd><p> + Sets the default TTL to use for this key when it is converted + into a DNSKEY RR. If the key is imported into a zone, + this is the TTL that will be used for it, unless there was + already a DNSKEY RRset in place, in which case the existing TTL + would take precedence. Setting the default TTL to + <code class="literal">0</code> or <code class="literal">none</code> removes it. + </p></dd> <dt><span class="term">-h</span></dt> <dd><p> Emit usage message and exit. @@ -90,7 +99,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2543563"></a><h2>TIMING OPTIONS</h2> +<a name="id2543664"></a><h2>TIMING OPTIONS</h2> <p> Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '-', it is interpreted as @@ -169,7 +178,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2543770"></a><h2>PRINTING OPTIONS</h2> +<a name="id2543802"></a><h2>PRINTING OPTIONS</h2> <p> <span><strong class="command">dnssec-settime</strong></span> can also be used to print the timing metadata associated with a key. @@ -195,7 +204,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2543848"></a><h2>SEE ALSO</h2> +<a name="id2543880"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>, <em class="citetitle">BIND 9 Administrator Reference Manual</em>, @@ -203,7 +212,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543881"></a><h2>AUTHOR</h2> +<a name="id2542138"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/bin/dnssec/dnssec-signzone.8 b/bin/dnssec/dnssec-signzone.8 index 0280688..c917495 100644 --- a/bin/dnssec/dnssec-signzone.8 +++ b/bin/dnssec/dnssec-signzone.8 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004-2009, 2011 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000-2003 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -33,7 +33,7 @@ dnssec\-signzone \- DNSSEC zone signing tool .SH "SYNOPSIS" .HP 16 -\fBdnssec\-signzone\fR [\fB\-a\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-d\ \fR\fB\fIdirectory\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-e\ \fR\fB\fIend\-time\fR\fR] [\fB\-f\ \fR\fB\fIoutput\-file\fR\fR] [\fB\-g\fR] [\fB\-h\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\ \fR\fB\fIkey\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-I\ \fR\fB\fIinput\-format\fR\fR] [\fB\-j\ \fR\fB\fIjitter\fR\fR] [\fB\-N\ \fR\fB\fIsoa\-serial\-format\fR\fR] [\fB\-o\ \fR\fB\fIorigin\fR\fR] [\fB\-O\ \fR\fB\fIoutput\-format\fR\fR] [\fB\-p\fR] [\fB\-P\fR] [\fB\-r\ \fR\fB\fIrandomdev\fR\fR] [\fB\-S\fR] [\fB\-s\ \fR\fB\fIstart\-time\fR\fR] [\fB\-T\ \fR\fB\fIttl\fR\fR] [\fB\-t\fR] [\fB\-u\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-x\fR] [\fB\-z\fR] [\fB\-3\ \fR\fB\fIsalt\fR\fR] [\fB\-H\ \fR\fB\fIiterations\fR\fR] [\fB\-A\fR] {zonefile} [key...] +\fBdnssec\-signzone\fR [\fB\-a\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-d\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-e\ \fR\fB\fIend\-time\fR\fR] [\fB\-f\ \fR\fB\fIoutput\-file\fR\fR] [\fB\-g\fR] [\fB\-h\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\ \fR\fB\fIkey\fR\fR] [\fB\-L\ \fR\fB\fIserial\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-I\ \fR\fB\fIinput\-format\fR\fR] [\fB\-j\ \fR\fB\fIjitter\fR\fR] [\fB\-N\ \fR\fB\fIsoa\-serial\-format\fR\fR] [\fB\-o\ \fR\fB\fIorigin\fR\fR] [\fB\-O\ \fR\fB\fIoutput\-format\fR\fR] [\fB\-P\fR] [\fB\-p\fR] [\fB\-R\fR] [\fB\-r\ \fR\fB\fIrandomdev\fR\fR] [\fB\-S\fR] [\fB\-s\ \fR\fB\fIstart\-time\fR\fR] [\fB\-T\ \fR\fB\fIttl\fR\fR] [\fB\-t\fR] [\fB\-u\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-X\ \fR\fB\fIextended\ end\-time\fR\fR] [\fB\-x\fR] [\fB\-z\fR] [\fB\-3\ \fR\fB\fIsalt\fR\fR] [\fB\-H\ \fR\fB\fIiterations\fR\fR] [\fB\-A\fR] {zonefile} [key...] .SH "DESCRIPTION" .PP \fBdnssec\-signzone\fR @@ -72,6 +72,15 @@ files in \fBdirectory\fR. .RE .PP +\-D +.RS 4 +Output only those record types automatically managed by +\fBdnssec\-signzone\fR, i.e. RRSIG, NSEC, NSEC3 and NSEC3PARAM records. If smart signing (\fB\-S\fR) is used, DNSKEY records are also included. The resulting file can be included in the original zone file with +\fB$INCLUDE\fR. This option cannot be combined with +\fB\-O raw\fR +or serial number updating. +.RE +.PP \-E \fIengine\fR .RS 4 Uses a crypto hardware (OpenSSL engine) for the crypto operations it supports, for instance signing with private keys from a secure key store. When compiled with PKCS#11 support it defaults to pkcs11; the empty name resets it to no engine. @@ -119,11 +128,29 @@ must be later than \fBstart\-time\fR. .RE .PP +\-X \fIextended end\-time\fR +.RS 4 +Specify the date and time when the generated RRSIG records for the DNSKEY RRset will expire. This is to be used in cases when the DNSKEY signatures need to persist longer than signatures on other records; e.g., when the private component of the KSK is kept offline and the KSK signature is to be refreshed manually. +.sp +As with +\fBstart\-time\fR, an absolute time is indicated in YYYYMMDDHHMMSS notation. A time relative to the start time is indicated with +N, which is N seconds from the start time. A time relative to the current time is indicated with now+N. If no +\fBextended end\-time\fR +is specified, the value of +\fBend\-time\fR +is used as the default. (\fBend\-time\fR, in turn, defaults to 30 days from the start time.) +\fBextended end\-time\fR +must be later than +\fBstart\-time\fR. +.RE +.PP \-f \fIoutput\-file\fR .RS 4 The name of the output file containing the signed zone. The default is to append \fI.signed\fR -to the input filename. +to the input filename. If +\fBoutput\-file\fR +is set to +"\-", then the signed zone is written to the standard output, with a default output format of "full". .RE .PP \-h @@ -164,6 +191,11 @@ option specifies a jitter window that will be used to randomize the signature ex Signature lifetime jitter also to some extent benefits validators and servers by spreading out cache expiration, i.e. if large numbers of RRSIGs don't expire at the same time from all caches there will be less congestion than if all validators need to refetch at mostly the same time. .RE .PP +\-L \fIserial\fR +.RS 4 +When writing a signed zone to 'raw' format, set the "source serial" value in the header to the specified serial number. (This is expected to be used primarily for testing purposes.) +.RE +.PP \-n \fIncpus\fR .RS 4 Specifies the number of threads to use. By default, one thread is started for each detected CPU. @@ -205,8 +237,15 @@ The zone origin. If not specified, the name of the zone file is assumed to be th .RS 4 The format of the output file containing the signed zone. Possible formats are \fB"text"\fR -(default) and -\fB"raw"\fR. +(default) +\fB"full"\fR, which is text output in a format suitable for processing by external scripts, and +\fB"raw"\fR +or +\fB"raw=N"\fR, which store the zone in a binary format for rapid loading by +\fBnamed\fR. +\fB"raw=N"\fR +specifies the format version of the raw zone file: if N is 0, the raw file can be read by any version of +\fBnamed\fR; if N is 1, the file can be read by release 9.9.0 or higher. The default is 1. .RE .PP \-p @@ -221,6 +260,17 @@ Disable post sign verification tests. The post sign verification test ensures that for each algorithm in use there is at least one non revoked self signed KSK key, that all revoked KSK keys are self signed, and that all records in the zone are signed by the algorithm. This option skips these tests. .RE .PP +\-R +.RS 4 +Remove signatures from keys that no longer exist. +.sp +Normally, when a previously\-signed zone is passed as input to the signer, and a DNSKEY record has been removed and replaced with a new one, signatures from the old key that are still within their validity period are retained. This allows the zone to continue to validate with cached copies of the old DNSKEY RRset. The +\fB\-R\fR +forces +\fBdnssec\-signzone\fR +to remove all orphaned signatures. +.RE +.PP \-r \fIrandomdev\fR .RS 4 Specifies the source of randomness. If the operating system does not provide a @@ -265,8 +315,8 @@ If either of the key's unpublication or deletion dates are set and in the past, .PP \-T \fIttl\fR .RS 4 -Specifies the TTL to be used for new DNSKEY records imported into the zone from the key repository. If not specified, the default is the minimum TTL value from the zone's SOA record. This option is ignored when signing without -\fB\-S\fR, since DNSKEY records are not imported from the key repository in that case. It is also ignored if there are any pre\-existing DNSKEY records at the zone apex, in which case new records' TTL values will be set to match them. +Specifies a TTL to be used for new DNSKEY records imported into the zone from the key repository. If not specified, the default is the TTL value from the zone's SOA record. This option is ignored when signing without +\fB\-S\fR, since DNSKEY records are not imported from the key repository in that case. It is also ignored if there are any pre\-existing DNSKEY records at the zone apex, in which case new records' TTL values will be set to match them, or if any of the imported DNSKEY records had a default TTL value. In the event of a a conflict between TTL values in imported keys, the shortest one is used. .RE .PP \-t @@ -378,7 +428,7 @@ RFC 4033. .PP Internet Systems Consortium .SH "COPYRIGHT" -Copyright \(co 2004\-2009 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004\-2009, 2011 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000\-2003 Internet Software Consortium. .br diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c index 86c3aee..83456a7 100644 --- a/bin/dnssec/dnssec-signzone.c +++ b/bin/dnssec/dnssec-signzone.c @@ -1,5 +1,5 @@ /* - * Portions Copyright (C) 2004-2012 Internet Systems Consortium, Inc. ("ISC") + * Portions Copyright (C) 2004-2013 Internet Systems Consortium, Inc. ("ISC") * Portions Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -29,7 +29,7 @@ * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dnssec-signzone.c,v 1.262.110.9 2011/07/19 23:47:12 tbox Exp $ */ +/* $Id: dnssec-signzone.c,v 1.285 2011/12/22 07:32:39 each Exp $ */ /*! \file */ @@ -37,6 +37,7 @@ #include <stdlib.h> #include <time.h> +#include <unistd.h> #include <isc/app.h> #include <isc/base32.h> @@ -124,7 +125,7 @@ struct signer_event { static dns_dnsseckeylist_t keylist; static unsigned int keycount = 0; isc_rwlock_t keylist_lock; -static isc_stdtime_t starttime = 0, endtime = 0, now; +static isc_stdtime_t starttime = 0, endtime = 0, dnskey_endtime = 0, now; static int cycle = -1; static int jitter = 0; static isc_boolean_t tryverify = ISC_FALSE; @@ -133,11 +134,13 @@ static isc_mem_t *mctx = NULL; static isc_entropy_t *ectx = NULL; static dns_ttl_t zone_soa_min_ttl; static dns_ttl_t soa_ttl; -static FILE *fp; +static FILE *fp = NULL; static char *tempfile = NULL; static const dns_master_style_t *masterstyle; static dns_masterformat_t inputformat = dns_masterformat_text; static dns_masterformat_t outputformat = dns_masterformat_text; +static isc_uint32_t rawversion = 1, serialnum = 0; +static isc_boolean_t snset = ISC_FALSE; static unsigned int nsigned = 0, nretained = 0, ndropped = 0; static unsigned int nverified = 0, nverifyfailed = 0; static const char *directory = NULL, *dsdir = NULL; @@ -171,6 +174,10 @@ static isc_boolean_t disable_zone_check = ISC_FALSE; static isc_boolean_t update_chain = ISC_FALSE; static isc_boolean_t set_keyttl = ISC_FALSE; static dns_ttl_t keyttl; +static isc_boolean_t smartsign = ISC_FALSE; +static isc_boolean_t remove_orphans = ISC_FALSE; +static isc_boolean_t output_dnssec_only = ISC_FALSE; +static isc_boolean_t output_stdout = ISC_FALSE; #define INCSTAT(counter) \ if (printstats) { \ @@ -182,19 +189,71 @@ static dns_ttl_t keyttl; static void sign(isc_task_t *task, isc_event_t *event); -#define check_dns_dbiterator_current(result) \ - check_result((result == DNS_R_NEWORIGIN) ? ISC_R_SUCCESS : result, \ - "dns_dbiterator_current()") - static void dumpnode(dns_name_t *name, dns_dbnode_t *node) { + dns_rdataset_t rds; + dns_rdatasetiter_t *iter = NULL; + isc_buffer_t *buffer = NULL; + isc_region_t r; isc_result_t result; + unsigned bufsize = 4096; if (outputformat != dns_masterformat_text) return; - result = dns_master_dumpnodetostream(mctx, gdb, gversion, node, name, - masterstyle, fp); - check_result(result, "dns_master_dumpnodetostream"); + + if (!output_dnssec_only) { + result = dns_master_dumpnodetostream(mctx, gdb, gversion, node, + name, masterstyle, fp); + check_result(result, "dns_master_dumpnodetostream"); + return; + } + + result = dns_db_allrdatasets(gdb, node, gversion, 0, &iter); + check_result(result, "dns_db_allrdatasets"); + + dns_rdataset_init(&rds); + + result = isc_buffer_allocate(mctx, &buffer, bufsize); + check_result(result, "isc_buffer_allocate"); + + for (result = dns_rdatasetiter_first(iter); + result == ISC_R_SUCCESS; + result = dns_rdatasetiter_next(iter)) { + + dns_rdatasetiter_current(iter, &rds); + + if (rds.type != dns_rdatatype_rrsig && + rds.type != dns_rdatatype_nsec && + rds.type != dns_rdatatype_nsec3 && + rds.type != dns_rdatatype_nsec3param && + (!smartsign || rds.type != dns_rdatatype_dnskey)) { + dns_rdataset_disassociate(&rds); + continue; + } + + for (;;) { + result = dns_master_rdatasettotext(name, &rds, + masterstyle, buffer); + if (result != ISC_R_NOSPACE) + break; + + bufsize <<= 1; + isc_buffer_free(&buffer); + result = isc_buffer_allocate(mctx, &buffer, bufsize); + check_result(result, "isc_buffer_allocate"); + } + check_result(result, "dns_master_rdatasettotext"); + + isc_buffer_usedregion(buffer, &r); + result = isc_stdio_write(r.base, 1, r.length, fp, NULL); + check_result(result, "isc_stdio_write"); + isc_buffer_clear(buffer); + + dns_rdataset_disassociate(&rds); + } + + isc_buffer_free(&buffer); + dns_rdatasetiter_destroy(&iter); } /*% @@ -206,7 +265,7 @@ signwithkey(dns_name_t *name, dns_rdataset_t *rdataset, dst_key_t *key, dns_ttl_t ttl, dns_diff_t *add, const char *logmsg) { isc_result_t result; - isc_stdtime_t jendtime; + isc_stdtime_t jendtime, expiry; char keystr[DST_KEY_FORMATSIZE]; dns_rdata_t trdata = DNS_RDATA_INIT; unsigned char array[BUFSIZE]; @@ -216,7 +275,12 @@ signwithkey(dns_name_t *name, dns_rdataset_t *rdataset, dst_key_t *key, dst_key_format(key, keystr, sizeof(keystr)); vbprintf(1, "\t%s %s\n", logmsg, keystr); - jendtime = (jitter != 0) ? isc_random_jitter(endtime, jitter) : endtime; + if (rdataset->type == dns_rdatatype_dnskey) + expiry = dnskey_endtime; + else + expiry = endtime; + + jendtime = (jitter != 0) ? isc_random_jitter(expiry, jitter) : expiry; isc_buffer_init(&b, array, sizeof(array)); result = dns_dnssec_sign(name, rdataset, key, &starttime, &jendtime, mctx, &b, &trdata); @@ -254,6 +318,12 @@ issigningkey(dns_dnsseckey_t *key) { } static inline isc_boolean_t +ispublishedkey(dns_dnsseckey_t *key) { + return ((key->force_publish || key->hint_publish) && + !key->hint_remove); +} + +static inline isc_boolean_t iszonekey(dns_dnsseckey_t *key) { return (ISC_TF(dns_name_equal(dst_key_name(key->key), gorigin) && dst_key_iszonekey(key->key))); @@ -334,13 +404,16 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) { directory, mctx, &privkey); if (result == ISC_R_SUCCESS) { dst_key_free(&pubkey); - dns_dnsseckey_create(mctx, &privkey, &key); - } else { - dns_dnsseckey_create(mctx, &pubkey, &key); + result = dns_dnsseckey_create(mctx, &privkey, &key); + } else + result = dns_dnsseckey_create(mctx, &pubkey, &key); + + if (result == ISC_R_SUCCESS) { + key->force_publish = ISC_FALSE; + key->force_sign = ISC_FALSE; + key->index = keycount++; + ISC_LIST_APPEND(keylist, key, link); } - key->force_publish = ISC_FALSE; - key->force_sign = ISC_FALSE; - ISC_LIST_APPEND(keylist, key, link); isc_rwlock_unlock(&keylist_lock, isc_rwlocktype_write); return (key); @@ -481,38 +554,38 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name, "private dnskey not found\n", sigstr); } else if (key == NULL || future) { + keep = (!expired && !remove_orphans); vbprintf(2, "\trrsig by %s %s - dnskey not found\n", - expired ? "retained" : "dropped", sigstr); - if (!expired) - keep = ISC_TRUE; + keep ? "retained" : "dropped", sigstr); } else if (issigningkey(key)) { + wassignedby[key->index] = ISC_TRUE; + if (!expired && rrsig.originalttl == set->ttl && setverifies(name, set, key->key, &sigrdata)) { vbprintf(2, "\trrsig by %s retained\n", sigstr); keep = ISC_TRUE; - wassignedby[key->index] = ISC_TRUE; - nowsignedby[key->index] = ISC_TRUE; } else { vbprintf(2, "\trrsig by %s dropped - %s\n", sigstr, expired ? "expired" : rrsig.originalttl != set->ttl ? "ttl change" : "failed to verify"); - wassignedby[key->index] = ISC_TRUE; resign = ISC_TRUE; } + } else if (!ispublishedkey(key) && remove_orphans) { + vbprintf(2, "\trrsig by %s dropped - dnskey removed\n", + sigstr); } else if (iszonekey(key)) { + wassignedby[key->index] = ISC_TRUE; + if (!expired && rrsig.originalttl == set->ttl && setverifies(name, set, key->key, &sigrdata)) { vbprintf(2, "\trrsig by %s retained\n", sigstr); keep = ISC_TRUE; - wassignedby[key->index] = ISC_TRUE; - nowsignedby[key->index] = ISC_TRUE; } else { vbprintf(2, "\trrsig by %s dropped - %s\n", sigstr, expired ? "expired" : rrsig.originalttl != set->ttl ? "ttl change" : "failed to verify"); - wassignedby[key->index] = ISC_TRUE; } } else if (!expired) { vbprintf(2, "\trrsig by %s retained\n", sigstr); @@ -545,6 +618,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name, } } else { tuple = NULL; + vbprintf(2, "removing signature by %s\n", sigstr); result = dns_difftuple_create(mctx, DNS_DIFFOP_DEL, name, sigset.ttl, &sigrdata, &tuple); @@ -922,26 +996,6 @@ loadds(dns_name_t *name, isc_uint32_t ttl, dns_rdataset_t *dsset) { } static isc_boolean_t -delegation(dns_name_t *name, dns_dbnode_t *node, isc_uint32_t *ttlp) { - dns_rdataset_t nsset; - isc_result_t result; - - if (dns_name_equal(name, gorigin)) - return (ISC_FALSE); - - dns_rdataset_init(&nsset); - result = dns_db_findrdataset(gdb, node, gversion, dns_rdatatype_ns, - 0, 0, &nsset, NULL); - if (dns_rdataset_isassociated(&nsset)) { - if (ttlp != NULL) - *ttlp = nsset.ttl; - dns_rdataset_disassociate(&nsset); - } - - return (ISC_TF(result == ISC_R_SUCCESS)); -} - -static isc_boolean_t secure(dns_name_t *name, dns_dbnode_t *node) { dns_rdataset_t dsset; isc_result_t result; @@ -976,7 +1030,7 @@ signname(dns_dbnode_t *node, dns_name_t *name) { /* * Determine if this is a delegation point. */ - if (delegation(name, node, NULL)) + if (is_delegation(gdb, gversion, gorigin, name, node, NULL)) isdelegation = ISC_TRUE; /* @@ -1309,485 +1363,6 @@ postsign(void) { dns_dbiterator_destroy(&gdbiter); } -static isc_boolean_t -goodsig(dns_rdata_t *sigrdata, dns_name_t *name, dns_rdataset_t *keyrdataset, - dns_rdataset_t *rdataset) -{ - dns_rdata_dnskey_t key; - dns_rdata_rrsig_t sig; - dst_key_t *dstkey = NULL; - isc_result_t result; - - dns_rdata_tostruct(sigrdata, &sig, NULL); - - for (result = dns_rdataset_first(keyrdataset); - result == ISC_R_SUCCESS; - result = dns_rdataset_next(keyrdataset)) { - dns_rdata_t rdata = DNS_RDATA_INIT; - dns_rdataset_current(keyrdataset, &rdata); - dns_rdata_tostruct(&rdata, &key, NULL); - result = dns_dnssec_keyfromrdata(gorigin, &rdata, mctx, - &dstkey); - if (result != ISC_R_SUCCESS) - return (ISC_FALSE); - if (sig.algorithm != key.algorithm || - sig.keyid != dst_key_id(dstkey) || - !dns_name_equal(&sig.signer, gorigin)) { - dst_key_free(&dstkey); - continue; - } - result = dns_dnssec_verify(name, rdataset, dstkey, ISC_FALSE, - mctx, sigrdata); - dst_key_free(&dstkey); - if (result == ISC_R_SUCCESS) - return(ISC_TRUE); - } - return (ISC_FALSE); -} - -static void -verifyset(dns_rdataset_t *rdataset, dns_name_t *name, dns_dbnode_t *node, - dns_rdataset_t *keyrdataset, unsigned char *ksk_algorithms, - unsigned char *bad_algorithms) -{ - unsigned char set_algorithms[256]; - char namebuf[DNS_NAME_FORMATSIZE]; - char algbuf[80]; - char typebuf[80]; - dns_rdataset_t sigrdataset; - dns_rdatasetiter_t *rdsiter = NULL; - isc_result_t result; - int i; - - dns_rdataset_init(&sigrdataset); - result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter); - check_result(result, "dns_db_allrdatasets()"); - for (result = dns_rdatasetiter_first(rdsiter); - result == ISC_R_SUCCESS; - result = dns_rdatasetiter_next(rdsiter)) { - dns_rdatasetiter_current(rdsiter, &sigrdataset); - if (sigrdataset.type == dns_rdatatype_rrsig && - sigrdataset.covers == rdataset->type) - break; - dns_rdataset_disassociate(&sigrdataset); - } - if (result != ISC_R_SUCCESS) { - dns_name_format(name, namebuf, sizeof(namebuf)); - type_format(rdataset->type, typebuf, sizeof(typebuf)); - fprintf(stderr, "no signatures for %s/%s\n", namebuf, typebuf); - for (i = 0; i < 256; i++) - if (ksk_algorithms[i] != 0) - bad_algorithms[i] = 1; - return; - } - - memset(set_algorithms, 0, sizeof(set_algorithms)); - for (result = dns_rdataset_first(&sigrdataset); - result == ISC_R_SUCCESS; - result = dns_rdataset_next(&sigrdataset)) { - dns_rdata_t rdata = DNS_RDATA_INIT; - dns_rdata_rrsig_t sig; - - dns_rdataset_current(&sigrdataset, &rdata); - dns_rdata_tostruct(&rdata, &sig, NULL); - if (rdataset->ttl != sig.originalttl) { - dns_name_format(name, namebuf, sizeof(namebuf)); - type_format(rdataset->type, typebuf, sizeof(typebuf)); - fprintf(stderr, "TTL mismatch for %s %s keytag %u\n", - namebuf, typebuf, sig.keyid); - continue; - } - if ((set_algorithms[sig.algorithm] != 0) || - (ksk_algorithms[sig.algorithm] == 0)) - continue; - if (goodsig(&rdata, name, keyrdataset, rdataset)) - set_algorithms[sig.algorithm] = 1; - } - dns_rdatasetiter_destroy(&rdsiter); - if (memcmp(set_algorithms, ksk_algorithms, sizeof(set_algorithms))) { - dns_name_format(name, namebuf, sizeof(namebuf)); - type_format(rdataset->type, typebuf, sizeof(typebuf)); - for (i = 0; i < 256; i++) - if ((ksk_algorithms[i] != 0) && - (set_algorithms[i] == 0)) { - dns_secalg_format(i, algbuf, sizeof(algbuf)); - fprintf(stderr, "Missing %s signature for " - "%s %s\n", algbuf, namebuf, typebuf); - bad_algorithms[i] = 1; - } - } - dns_rdataset_disassociate(&sigrdataset); -} - -static void -verifynode(dns_name_t *name, dns_dbnode_t *node, isc_boolean_t delegation, - dns_rdataset_t *keyrdataset, unsigned char *ksk_algorithms, - unsigned char *bad_algorithms) -{ - dns_rdataset_t rdataset; - dns_rdatasetiter_t *rdsiter = NULL; - isc_result_t result; - - result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter); - check_result(result, "dns_db_allrdatasets()"); - result = dns_rdatasetiter_first(rdsiter); - dns_rdataset_init(&rdataset); - while (result == ISC_R_SUCCESS) { - dns_rdatasetiter_current(rdsiter, &rdataset); - if (rdataset.type != dns_rdatatype_rrsig && - rdataset.type != dns_rdatatype_dnskey && - (!delegation || rdataset.type == dns_rdatatype_ds || - rdataset.type == dns_rdatatype_nsec)) { - verifyset(&rdataset, name, node, keyrdataset, - ksk_algorithms, bad_algorithms); - } - dns_rdataset_disassociate(&rdataset); - result = dns_rdatasetiter_next(rdsiter); - } - if (result != ISC_R_NOMORE) - fatal("rdataset iteration failed: %s", - isc_result_totext(result)); - dns_rdatasetiter_destroy(&rdsiter); -} - -/*% - * Verify that certain things are sane: - * - * The apex has a DNSKEY RRset with at least one KSK, and at least - * one ZSK if the -x flag was not used. - * - * The DNSKEY record was signed with at least one of the KSKs in - * the DNSKEY RRset. - * - * The rest of the zone was signed with at least one of the ZSKs - * present in the DNSKEY RRset. - */ -static void -verifyzone(void) { - char algbuf[80]; - dns_dbiterator_t *dbiter = NULL; - dns_dbnode_t *node = NULL, *nextnode = NULL; - dns_fixedname_t fname, fnextname, fzonecut; - dns_name_t *name, *nextname, *zonecut; - dns_rdata_dnskey_t dnskey; - dns_rdata_t rdata = DNS_RDATA_INIT; - dns_rdataset_t keyset, soaset; - dns_rdataset_t keysigs, soasigs; - int i; - isc_boolean_t done = ISC_FALSE; - isc_boolean_t first = ISC_TRUE; - isc_boolean_t goodksk = ISC_FALSE; - isc_result_t result; - unsigned char revoked_ksk[256]; - unsigned char revoked_zsk[256]; - unsigned char standby_ksk[256]; - unsigned char standby_zsk[256]; - unsigned char ksk_algorithms[256]; - unsigned char zsk_algorithms[256]; - unsigned char bad_algorithms[256]; -#ifdef ALLOW_KSKLESS_ZONES - isc_boolean_t allzsksigned = ISC_TRUE; - unsigned char self_algorithms[256]; -#endif - - if (disable_zone_check) - return; - - result = dns_db_findnode(gdb, gorigin, ISC_FALSE, &node); - if (result != ISC_R_SUCCESS) - fatal("failed to find the zone's origin: %s", - isc_result_totext(result)); - - dns_rdataset_init(&keyset); - dns_rdataset_init(&keysigs); - dns_rdataset_init(&soaset); - dns_rdataset_init(&soasigs); - - result = dns_db_findrdataset(gdb, node, gversion, - dns_rdatatype_dnskey, - 0, 0, &keyset, &keysigs); - if (result != ISC_R_SUCCESS) - fatal("cannot find DNSKEY rrset\n"); - - result = dns_db_findrdataset(gdb, node, gversion, - dns_rdatatype_soa, - 0, 0, &soaset, &soasigs); - dns_db_detachnode(gdb, &node); - if (result != ISC_R_SUCCESS) - fatal("cannot find SOA rrset\n"); - - if (!dns_rdataset_isassociated(&keysigs)) - fatal("cannot find DNSKEY RRSIGs\n"); - - if (!dns_rdataset_isassociated(&soasigs)) - fatal("cannot find SOA RRSIGs\n"); - - memset(revoked_ksk, 0, sizeof(revoked_ksk)); - memset(revoked_zsk, 0, sizeof(revoked_zsk)); - memset(standby_ksk, 0, sizeof(standby_ksk)); - memset(standby_zsk, 0, sizeof(standby_zsk)); - memset(ksk_algorithms, 0, sizeof(ksk_algorithms)); - memset(zsk_algorithms, 0, sizeof(zsk_algorithms)); - memset(bad_algorithms, 0, sizeof(bad_algorithms)); -#ifdef ALLOW_KSKLESS_ZONES - memset(self_algorithms, 0, sizeof(self_algorithms)); -#endif - - /* - * Check that the DNSKEY RR has at least one self signing KSK - * and one ZSK per algorithm in it (or, if -x was used, one - * self-signing KSK). - */ - for (result = dns_rdataset_first(&keyset); - result == ISC_R_SUCCESS; - result = dns_rdataset_next(&keyset)) { - dns_rdataset_current(&keyset, &rdata); - result = dns_rdata_tostruct(&rdata, &dnskey, NULL); - check_result(result, "dns_rdata_tostruct"); - - if ((dnskey.flags & DNS_KEYOWNER_ZONE) == 0) - ; - else if ((dnskey.flags & DNS_KEYFLAG_REVOKE) != 0) { - if ((dnskey.flags & DNS_KEYFLAG_KSK) != 0 && - !dns_dnssec_selfsigns(&rdata, gorigin, &keyset, - &keysigs, ISC_FALSE, - mctx)) { - char namebuf[DNS_NAME_FORMATSIZE]; - char buffer[1024]; - isc_buffer_t buf; - - dns_name_format(gorigin, namebuf, - sizeof(namebuf)); - isc_buffer_init(&buf, buffer, sizeof(buffer)); - result = dns_rdata_totext(&rdata, NULL, &buf); - check_result(result, "dns_rdata_totext"); - fatal("revoked KSK is not self signed:\n" - "%s DNSKEY %.*s", namebuf, - (int)isc_buffer_usedlength(&buf), buffer); - } - if ((dnskey.flags & DNS_KEYFLAG_KSK) != 0 && - revoked_ksk[dnskey.algorithm] != 255) - revoked_ksk[dnskey.algorithm]++; - else if ((dnskey.flags & DNS_KEYFLAG_KSK) == 0 && - revoked_zsk[dnskey.algorithm] != 255) - revoked_zsk[dnskey.algorithm]++; - } else if ((dnskey.flags & DNS_KEYFLAG_KSK) != 0) { - if (dns_dnssec_selfsigns(&rdata, gorigin, &keyset, - &keysigs, ISC_FALSE, mctx)) { - if (ksk_algorithms[dnskey.algorithm] != 255) - ksk_algorithms[dnskey.algorithm]++; - goodksk = ISC_TRUE; - } else { - if (standby_ksk[dnskey.algorithm] != 255) - standby_ksk[dnskey.algorithm]++; - } - } else if (dns_dnssec_selfsigns(&rdata, gorigin, &keyset, - &keysigs, ISC_FALSE, - mctx)) { -#ifdef ALLOW_KSKLESS_ZONES - if (self_algorithms[dnskey.algorithm] != 255) - self_algorithms[dnskey.algorithm]++; -#endif - if (zsk_algorithms[dnskey.algorithm] != 255) - zsk_algorithms[dnskey.algorithm]++; - } else if (dns_dnssec_signs(&rdata, gorigin, &soaset, - &soasigs, ISC_FALSE, mctx)) { - if (zsk_algorithms[dnskey.algorithm] != 255) - zsk_algorithms[dnskey.algorithm]++; - } else { - if (standby_zsk[dnskey.algorithm] != 255) - standby_zsk[dnskey.algorithm]++; -#ifdef ALLOW_KSKLESS_ZONES - allzsksigned = ISC_FALSE; -#endif - } - dns_rdata_freestruct(&dnskey); - dns_rdata_reset(&rdata); - } - dns_rdataset_disassociate(&keysigs); - dns_rdataset_disassociate(&soaset); - dns_rdataset_disassociate(&soasigs); - -#ifdef ALLOW_KSKLESS_ZONES - if (!goodksk) { - if (!ignore_kskflag) - fprintf(stderr, "No self signing KSK found. Using " - "self signed ZSK's for active " - "algorithm list.\n"); - memcpy(ksk_algorithms, self_algorithms, sizeof(ksk_algorithms)); - if (!allzsksigned) - fprintf(stderr, "warning: not all ZSK's are self " - "signed.\n"); - } -#else - if (!goodksk) { - fatal("No self signed KSK's found"); - } -#endif - - fprintf(stderr, "Verifying the zone using the following algorithms:"); - for (i = 0; i < 256; i++) { -#ifdef ALLOW_KSKLESS_ZONES - if (ksk_algorithms[i] != 0 || zsk_algorithms[i] != 0) -#else - if (ksk_algorithms[i] != 0) -#endif - { - dns_secalg_format(i, algbuf, sizeof(algbuf)); - fprintf(stderr, " %s", algbuf); - } - } - fprintf(stderr, ".\n"); - - if (!ignore_kskflag && !keyset_kskonly) { - for (i = 0; i < 256; i++) { - /* - * The counts should both be zero or both be non-zero. - * Mark the algorithm as bad if this is not met. - */ - if ((ksk_algorithms[i] != 0) == - (zsk_algorithms[i] != 0)) - continue; - dns_secalg_format(i, algbuf, sizeof(algbuf)); - fprintf(stderr, "Missing %s for algorithm %s\n", - (ksk_algorithms[i] != 0) - ? "ZSK" - : "self signing KSK", - algbuf); - bad_algorithms[i] = 1; - } - } - - /* - * Check that all the other records were signed by keys that are - * present in the DNSKEY RRSET. - */ - - dns_fixedname_init(&fname); - name = dns_fixedname_name(&fname); - dns_fixedname_init(&fnextname); - nextname = dns_fixedname_name(&fnextname); - dns_fixedname_init(&fzonecut); - zonecut = NULL; - - result = dns_db_createiterator(gdb, DNS_DB_NONSEC3, &dbiter); - check_result(result, "dns_db_createiterator()"); - - result = dns_dbiterator_first(dbiter); - check_result(result, "dns_dbiterator_first()"); - - while (!done) { - isc_boolean_t isdelegation = ISC_FALSE; - - result = dns_dbiterator_current(dbiter, &node, name); - check_dns_dbiterator_current(result); - if (!dns_name_issubdomain(name, gorigin)) { - dns_db_detachnode(gdb, &node); - result = dns_dbiterator_next(dbiter); - if (result == ISC_R_NOMORE) - done = ISC_TRUE; - else - check_result(result, "dns_dbiterator_next()"); - continue; - } - if (delegation(name, node, NULL)) { - zonecut = dns_fixedname_name(&fzonecut); - dns_name_copy(name, zonecut, NULL); - isdelegation = ISC_TRUE; - } - verifynode(name, node, isdelegation, &keyset, - ksk_algorithms, bad_algorithms); - result = dns_dbiterator_next(dbiter); - nextnode = NULL; - while (result == ISC_R_SUCCESS) { - result = dns_dbiterator_current(dbiter, &nextnode, - nextname); - check_dns_dbiterator_current(result); - if (!dns_name_issubdomain(nextname, gorigin) || - (zonecut != NULL && - dns_name_issubdomain(nextname, zonecut))) - { - dns_db_detachnode(gdb, &nextnode); - result = dns_dbiterator_next(dbiter); - continue; - } - dns_db_detachnode(gdb, &nextnode); - break; - } - if (result == ISC_R_NOMORE) { - done = ISC_TRUE; - } else if (result != ISC_R_SUCCESS) - fatal("iterating through the database failed: %s", - isc_result_totext(result)); - dns_db_detachnode(gdb, &node); - } - - dns_dbiterator_destroy(&dbiter); - - result = dns_db_createiterator(gdb, DNS_DB_NSEC3ONLY, &dbiter); - check_result(result, "dns_db_createiterator()"); - - for (result = dns_dbiterator_first(dbiter); - result == ISC_R_SUCCESS; - result = dns_dbiterator_next(dbiter) ) { - result = dns_dbiterator_current(dbiter, &node, name); - check_dns_dbiterator_current(result); - verifynode(name, node, ISC_FALSE, &keyset, - ksk_algorithms, bad_algorithms); - dns_db_detachnode(gdb, &node); - } - dns_dbiterator_destroy(&dbiter); - - dns_rdataset_disassociate(&keyset); - - /* - * If we made it this far, we have what we consider a properly signed - * zone. Set the good flag. - */ - for (i = 0; i < 256; i++) { - if (bad_algorithms[i] != 0) { - if (first) - fprintf(stderr, "The zone is not fully signed " - "for the following algorithms:"); - dns_secalg_format(i, algbuf, sizeof(algbuf)); - fprintf(stderr, " %s", algbuf); - first = ISC_FALSE; - } - } - if (!first) { - fprintf(stderr, ".\n"); - fatal("DNSSEC completeness test failed."); - } - - if (goodksk || ignore_kskflag) { - /* - * Print the success summary. - */ - fprintf(stderr, "Zone signing complete:\n"); - for (i = 0; i < 256; i++) { - if ((ksk_algorithms[i] != 0) || - (standby_ksk[i] != 0) || - (revoked_zsk[i] != 0) || - (zsk_algorithms[i] != 0) || - (standby_zsk[i] != 0) || - (revoked_zsk[i] != 0)) { - dns_secalg_format(i, algbuf, sizeof(algbuf)); - fprintf(stderr, "Algorithm: %s: KSKs: " - "%u active, %u stand-by, %u revoked\n", - algbuf, ksk_algorithms[i], - standby_ksk[i], revoked_ksk[i]); - fprintf(stderr, "%*sZSKs: " - "%u active, %u %s, %u revoked\n", - (int) strlen(algbuf) + 13, "", - zsk_algorithms[i], - standby_zsk[i], - keyset_kskonly ? "present" : "stand-by", - revoked_zsk[i]); - } - } - } -} - /*% * Sign the apex of the zone. * Note the origin may not be the first node if there are out of zone @@ -1885,7 +1460,7 @@ assignwork(isc_task_t *task, isc_task_t *worker) { if (dns_name_issubdomain(name, gorigin) && (zonecut == NULL || !dns_name_issubdomain(name, zonecut))) { - if (delegation(name, node, NULL)) { + if (is_delegation(gdb, gversion, gorigin, name, node, NULL)) { dns_fixedname_init(&fzonecut); zonecut = dns_fixedname_name(&fzonecut); dns_name_copy(name, zonecut, NULL); @@ -2181,7 +1756,7 @@ nsecify(void) { remove_records(node, dns_rdatatype_nsec3param, ISC_TRUE); - if (delegation(name, node, &nsttl)) { + if (is_delegation(gdb, gversion, gorigin, name, node, &nsttl)) { zonecut = dns_fixedname_name(&fzonecut); dns_name_copy(name, zonecut, NULL); remove_sigs(node, 0); @@ -2622,7 +2197,9 @@ nsec3ify(unsigned int hashalg, unsigned int iterations, result = dns_dbiterator_next(dbiter); continue; } - if (delegation(nextname, nextnode, &nsttl)) { + if (is_delegation(gdb, gversion, gorigin, + nextname, nextnode, &nsttl)) + { zonecut = dns_fixedname_name(&fzonecut); dns_name_copy(nextname, zonecut, NULL); remove_sigs(nextnode, 0); @@ -2751,7 +2328,9 @@ nsec3ify(unsigned int hashalg, unsigned int iterations, result = dns_dbiterator_next(dbiter); continue; } - if (delegation(nextname, nextnode, NULL)) { + if (is_delegation(gdb, gversion, gorigin, + nextname, nextnode, NULL)) + { zonecut = dns_fixedname_name(&fzonecut); dns_name_copy(nextname, zonecut, NULL); if (OPTOUT(nsec3flags) && @@ -3324,10 +2903,16 @@ usage(void) { fprintf(stderr, "update DS records based on child zones' " "dsset-* files\n"); fprintf(stderr, "\t-s [YYYYMMDDHHMMSS|+offset]:\n"); - fprintf(stderr, "\t\tRRSIG start time - absolute|offset (now - 1 hour)\n"); + fprintf(stderr, "\t\tRRSIG start time " + "- absolute|offset (now - 1 hour)\n"); fprintf(stderr, "\t-e [YYYYMMDDHHMMSS|+offset|\"now\"+offset]:\n"); - fprintf(stderr, "\t\tRRSIG end time - absolute|from start|from now " + fprintf(stderr, "\t\tRRSIG end time " + "- absolute|from start|from now " "(now + 30 days)\n"); + fprintf(stderr, "\t-X [YYYYMMDDHHMMSS|+offset|\"now\"+offset]:\n"); + fprintf(stderr, "\t\tDNSKEY RRSIG end " + "- absolute|from start|from now " + "(matches -e)\n"); fprintf(stderr, "\t-i interval:\n"); fprintf(stderr, "\t\tcycle interval - resign " "if < interval from end ( (end-start)/4 )\n"); @@ -3345,6 +2930,8 @@ usage(void) { fprintf(stderr, "\t\tfile format of signed zone file (text)\n"); fprintf(stderr, "\t-N format:\n"); fprintf(stderr, "\t\tsoa serial format of signed zone file (keep)\n"); + fprintf(stderr, "\t-D:\n"); + fprintf(stderr, "\t\toutput only DNSSEC-related records\n"); fprintf(stderr, "\t-r randomdev:\n"); fprintf(stderr, "\t\ta file containing random data\n"); fprintf(stderr, "\t-a:\t"); @@ -3361,6 +2948,8 @@ usage(void) { fprintf(stderr, "use pseudorandom data (faster but less secure)\n"); fprintf(stderr, "\t-P:\t"); fprintf(stderr, "disable post-sign verification\n"); + fprintf(stderr, "\t-R:\t"); + fprintf(stderr, "remove signatures from keys that no longer exist\n"); fprintf(stderr, "\t-T TTL:\tTTL for newly added DNSKEYs\n"); fprintf(stderr, "\t-t:\t"); fprintf(stderr, "print statistics\n"); @@ -3398,36 +2987,39 @@ print_stats(isc_time_t *timer_start, isc_time_t *timer_finish, isc_uint64_t time_us; /* Time in microseconds */ isc_uint64_t time_ms; /* Time in milliseconds */ isc_uint64_t sig_ms; /* Signatures per millisecond */ + FILE *out = output_stdout ? stderr : stdout; - printf("Signatures generated: %10d\n", nsigned); - printf("Signatures retained: %10d\n", nretained); - printf("Signatures dropped: %10d\n", ndropped); - printf("Signatures successfully verified: %10d\n", nverified); - printf("Signatures unsuccessfully verified: %10d\n", nverifyfailed); + fprintf(out, "Signatures generated: %10d\n", nsigned); + fprintf(out, "Signatures retained: %10d\n", nretained); + fprintf(out, "Signatures dropped: %10d\n", ndropped); + fprintf(out, "Signatures successfully verified: %10d\n", nverified); + fprintf(out, "Signatures unsuccessfully " + "verified: %10d\n", nverifyfailed); time_us = isc_time_microdiff(sign_finish, sign_start); time_ms = time_us / 1000; - printf("Signing time in seconds: %7u.%03u\n", - (unsigned int) (time_ms / 1000), - (unsigned int) (time_ms % 1000)); + fprintf(out, "Signing time in seconds: %7u.%03u\n", + (unsigned int) (time_ms / 1000), + (unsigned int) (time_ms % 1000)); if (time_us > 0) { sig_ms = ((isc_uint64_t)nsigned * 1000000000) / time_us; - printf("Signatures per second: %7u.%03u\n", - (unsigned int) sig_ms / 1000, - (unsigned int) sig_ms % 1000); + fprintf(out, "Signatures per second: %7u.%03u\n", + (unsigned int) sig_ms / 1000, + (unsigned int) sig_ms % 1000); } time_us = isc_time_microdiff(timer_finish, timer_start); time_ms = time_us / 1000; - printf("Runtime in seconds: %7u.%03u\n", - (unsigned int) (time_ms / 1000), - (unsigned int) (time_ms % 1000)); + fprintf(out, "Runtime in seconds: %7u.%03u\n", + (unsigned int) (time_ms / 1000), + (unsigned int) (time_ms % 1000)); } int main(int argc, char *argv[]) { int i, ch; char *startstr = NULL, *endstr = NULL, *classname = NULL; + char *dnskey_endstr = NULL; char *origin = NULL, *file = NULL, *output = NULL; char *inputformatstr = NULL, *outputformatstr = NULL; char *serialformatstr = NULL; @@ -3447,20 +3039,20 @@ main(int argc, char *argv[]) { #endif unsigned int eflags; isc_boolean_t free_output = ISC_FALSE; - int tempfilelen; + int tempfilelen = 0; dns_rdataclass_t rdclass; isc_task_t **tasks = NULL; isc_buffer_t b; int len; hashlist_t hashlist; - isc_boolean_t smartsign = ISC_FALSE; isc_boolean_t make_keyset = ISC_FALSE; isc_boolean_t set_salt = ISC_FALSE; isc_boolean_t set_optout = ISC_FALSE; isc_boolean_t set_iter = ISC_FALSE; + isc_boolean_t nonsecify = ISC_FALSE; #define CMDLINE_FLAGS \ - "3:AaCc:Dd:E:e:f:FghH:i:I:j:K:k:l:m:n:N:o:O:pPr:s:ST:tuUv:xz" + "3:AaCc:Dd:E:e:f:FghH:i:I:j:K:k:L:l:m:n:N:o:O:PpRr:s:ST:tuUv:X:xzZ:" /* * Process memory debugging argument first. @@ -3546,6 +3138,10 @@ main(int argc, char *argv[]) { dsdir, isc_result_totext(result)); break; + case 'D': + output_dnssec_only = ISC_TRUE; + break; + case 'E': engine = isc_commandline_argument; break; @@ -3556,6 +3152,8 @@ main(int argc, char *argv[]) { case 'f': output = isc_commandline_argument; + if (strcmp(output, "-") == 0) + output_stdout = ISC_TRUE; break; case 'g': @@ -3604,6 +3202,17 @@ main(int argc, char *argv[]) { dskeyfile[ndskeys++] = isc_commandline_argument; break; + case 'L': + snset = ISC_TRUE; + endp = NULL; + serialnum = strtol(isc_commandline_argument, &endp, 0); + if (*endp != '\0') { + fprintf(stderr, "source serial number " + "must be numeric"); + exit(1); + } + break; + case 'l': len = strlen(isc_commandline_argument); isc_buffer_init(&b, isc_commandline_argument, len); @@ -3646,6 +3255,10 @@ main(int argc, char *argv[]) { pseudorandom = ISC_TRUE; break; + case 'R': + remove_orphans = ISC_TRUE; + break; + case 'r': setup_entropy(mctx, isc_commandline_argument, &ectx); break; @@ -3683,6 +3296,10 @@ main(int argc, char *argv[]) { fatal("verbose level must be numeric"); break; + case 'X': + dnskey_endstr = isc_commandline_argument; + break; + case 'x': keyset_kskonly = ISC_TRUE; break; @@ -3705,6 +3322,10 @@ main(int argc, char *argv[]) { fprintf(stderr, "%s: unhandled option -%c\n", program, isc_commandline_option); exit(1); + case 'Z': /* Undocumented test options */ + if (!strcmp(isc_commandline_argument, "nonsecify")) + nonsecify = ISC_TRUE; + break; } } @@ -3730,11 +3351,19 @@ main(int argc, char *argv[]) { } else starttime = now - 3600; /* Allow for some clock skew. */ - if (endstr != NULL) { + if (endstr != NULL) endtime = strtotime(endstr, now, starttime); - } else + else endtime = starttime + (30 * 24 * 60 * 60); + if (dnskey_endstr != NULL) { + dnskey_endtime = strtotime(dnskey_endstr, now, starttime); + if (endstr != NULL && dnskey_endtime == endtime) + fprintf(stderr, "WARNING: -e and -X were both set, " + "but have identical values.\n"); + } else + dnskey_endtime = endtime; + if (cycle == -1) cycle = (endtime - starttime) / 4; @@ -3777,16 +3406,36 @@ main(int argc, char *argv[]) { inputformat = dns_masterformat_text; else if (strcasecmp(inputformatstr, "raw") == 0) inputformat = dns_masterformat_raw; - else - fatal("unknown file format: %s\n", inputformatstr); + else if (strncasecmp(inputformatstr, "raw=", 4) == 0) { + inputformat = dns_masterformat_raw; + fprintf(stderr, + "WARNING: input format version ignored\n"); + } else + fatal("unknown file format: %s", inputformatstr); + } if (outputformatstr != NULL) { - if (strcasecmp(outputformatstr, "text") == 0) + if (strcasecmp(outputformatstr, "text") == 0) { outputformat = dns_masterformat_text; - else if (strcasecmp(outputformatstr, "raw") == 0) + } else if (strcasecmp(outputformatstr, "full") == 0) { + outputformat = dns_masterformat_text; + masterstyle = &dns_master_style_full; + } else if (strcasecmp(outputformatstr, "raw") == 0) { outputformat = dns_masterformat_raw; - else + } else if (strncasecmp(outputformatstr, "raw=", 4) == 0) { + char *end; + outputformat = dns_masterformat_raw; + + outputformat = dns_masterformat_raw; + rawversion = strtol(outputformatstr + 4, &end, 10); + if (end == outputformatstr + 4 || *end != '\0' || + rawversion > 1U) { + fprintf(stderr, + "unknown raw format version\n"); + exit(1); + } + } else fatal("unknown file format: %s\n", outputformatstr); } @@ -3803,6 +3452,12 @@ main(int argc, char *argv[]) { serialformatstr); } + if (output_dnssec_only && outputformat != dns_masterformat_text) + fatal("option -D can only be used with \"-O text\"\n"); + + if (output_dnssec_only && serialformat != SOA_SERIAL_KEEP) + fatal("option -D can only be used with \"-N keep\"\n"); + result = dns_master_stylecreate(&dsstyle, DNS_STYLEFLAG_NO_TTL, 0, 24, 0, 0, 0, 8, mctx); check_result(result, "dns_master_stylecreate"); @@ -3826,18 +3481,6 @@ main(int argc, char *argv[]) { else set_nsec3params(update_chain, set_salt, set_optout, set_iter); - if (IS_NSEC3) { - isc_boolean_t answer; - hash_length = dns_nsec3_hashlength(dns_hash_sha1); - hashlist_init(&hashlist, dns_db_nodecount(gdb) * 2, - hash_length); - result = dns_nsec_nseconly(gdb, gversion, &answer); - check_result(result, "dns_nsec_nseconly"); - if (answer) - fatal("NSEC3 generation requested with " - "NSEC only DNSKEY"); - } - /* * We need to do this early on, as we start messing with the list * of keys rather early. @@ -3890,6 +3533,22 @@ main(int argc, char *argv[]) { if (IS_NSEC3) { unsigned int max; + isc_boolean_t answer; + + hash_length = dns_nsec3_hashlength(dns_hash_sha1); + hashlist_init(&hashlist, dns_db_nodecount(gdb) * 2, + hash_length); + result = dns_nsec_nseconly(gdb, gversion, &answer); + if (result == ISC_R_NOTFOUND) + fprintf(stderr, "%s: warning: NSEC3 generation " + "requested with no DNSKEY; ignoring\n", + program); + else if (result != ISC_R_SUCCESS) + check_result(result, "dns_nsec_nseconly"); + else if (answer) + fatal("NSEC3 generation requested with " + "NSEC-only DNSKEY"); + result = dns_nsec3_maxiterations(gdb, NULL, mctx, &max); check_result(result, "dns_nsec3_maxiterations()"); if (nsec3iter > max) @@ -3916,11 +3575,13 @@ main(int argc, char *argv[]) { remove_duplicates(); - if (IS_NSEC3) - nsec3ify(dns_hash_sha1, nsec3iter, salt, salt_length, - &hashlist); - else - nsecify(); + if (!nonsecify) { + if (IS_NSEC3) + nsec3ify(dns_hash_sha1, nsec3iter, salt, salt_length, + &hashlist); + else + nsecify(); + } if (!nokeys) { writeset("dsset-", dns_rdatatype_ds); @@ -3931,24 +3592,29 @@ main(int argc, char *argv[]) { } } - tempfilelen = strlen(output) + 20; - tempfile = isc_mem_get(mctx, tempfilelen); - if (tempfile == NULL) - fatal("out of memory"); + if (output_stdout) { + fp = stdout; + if (outputformatstr == NULL) + masterstyle = &dns_master_style_full; + } else { + tempfilelen = strlen(output) + 20; + tempfile = isc_mem_get(mctx, tempfilelen); + if (tempfile == NULL) + fatal("out of memory"); - result = isc_file_mktemplate(output, tempfile, tempfilelen); - check_result(result, "isc_file_mktemplate"); + result = isc_file_mktemplate(output, tempfile, tempfilelen); + check_result(result, "isc_file_mktemplate"); - fp = NULL; - if (outputformat == dns_masterformat_text) - result = isc_file_openunique(tempfile, &fp); - else - result = isc_file_bopenunique(tempfile, &fp); - if (result != ISC_R_SUCCESS) - fatal("failed to open temporary output file: %s", - isc_result_totext(result)); - removefile = ISC_TRUE; - setfatalcallback(&removetempfile); + if (outputformat == dns_masterformat_text) + result = isc_file_openunique(tempfile, &fp); + else + result = isc_file_bopenunique(tempfile, &fp); + if (result != ISC_R_SUCCESS) + fatal("failed to open temporary output file: %s", + isc_result_totext(result)); + removefile = ISC_TRUE; + setfatalcallback(&removetempfile); + } print_time(fp); print_version(fp); @@ -4005,29 +3671,42 @@ main(int argc, char *argv[]) { isc_mem_put(mctx, tasks, ntasks * sizeof(isc_task_t *)); postsign(); TIME_NOW(&sign_finish); - verifyzone(); + + if (!disable_zone_check) + verifyzone(gdb, gversion, gorigin, mctx, + ignore_kskflag, keyset_kskonly); if (outputformat != dns_masterformat_text) { - result = dns_master_dumptostream2(mctx, gdb, gversion, + dns_masterrawheader_t header; + dns_master_initrawheader(&header); + if (rawversion == 0U) + header.flags = DNS_MASTERRAW_COMPAT; + else if (snset) { + header.flags = DNS_MASTERRAW_SOURCESERIALSET; + header.sourceserial = serialnum; + } + result = dns_master_dumptostream3(mctx, gdb, gversion, masterstyle, outputformat, - fp); - check_result(result, "dns_master_dumptostream2"); + &header, fp); + check_result(result, "dns_master_dumptostream3"); } - result = isc_stdio_close(fp); - check_result(result, "isc_stdio_close"); - removefile = ISC_FALSE; - - result = isc_file_rename(tempfile, output); - if (result != ISC_R_SUCCESS) - fatal("failed to rename temp file to %s: %s\n", - output, isc_result_totext(result)); - DESTROYLOCK(&namelock); if (printstats) DESTROYLOCK(&statslock); - printf("%s\n", output); + if (!output_stdout) { + result = isc_stdio_close(fp); + check_result(result, "isc_stdio_close"); + removefile = ISC_FALSE; + + result = isc_file_rename(tempfile, output); + if (result != ISC_R_SUCCESS) + fatal("failed to rename temp file to %s: %s\n", + output, isc_result_totext(result)); + + printf("%s\n", output); + } dns_db_closeversion(gdb, &gversion, ISC_FALSE); dns_db_detach(&gdb); @@ -4038,7 +3717,8 @@ main(int argc, char *argv[]) { dns_dnsseckey_destroy(mctx, &key); } - isc_mem_put(mctx, tempfile, tempfilelen); + if (tempfilelen != 0) + isc_mem_put(mctx, tempfile, tempfilelen); if (free_output) isc_mem_free(mctx, output); diff --git a/bin/dnssec/dnssec-signzone.docbook b/bin/dnssec/dnssec-signzone.docbook index 128ebe9..e427fc1 100644 --- a/bin/dnssec/dnssec-signzone.docbook +++ b/bin/dnssec/dnssec-signzone.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [<!ENTITY mdash "—">]> <!-- - - Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004-2009, 2011 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000-2003 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: dnssec-signzone.docbook,v 1.44 2009/12/03 23:18:16 each Exp $ --> +<!-- $Id: dnssec-signzone.docbook,v 1.52 2011/12/22 07:32:40 each Exp $ --> <refentry id="man.dnssec-signzone"> <refentryinfo> <date>June 05, 2009</date> @@ -43,6 +43,7 @@ <year>2007</year> <year>2008</year> <year>2009</year> + <year>2011</year> <holder>Internet Systems Consortium, Inc. ("ISC")</holder> </copyright> <copyright> @@ -60,6 +61,7 @@ <arg><option>-a</option></arg> <arg><option>-c <replaceable class="parameter">class</replaceable></option></arg> <arg><option>-d <replaceable class="parameter">directory</replaceable></option></arg> + <arg><option>-D</option></arg> <arg><option>-E <replaceable class="parameter">engine</replaceable></option></arg> <arg><option>-e <replaceable class="parameter">end-time</replaceable></option></arg> <arg><option>-f <replaceable class="parameter">output-file</replaceable></option></arg> @@ -67,6 +69,7 @@ <arg><option>-h</option></arg> <arg><option>-K <replaceable class="parameter">directory</replaceable></option></arg> <arg><option>-k <replaceable class="parameter">key</replaceable></option></arg> + <arg><option>-L <replaceable class="parameter">serial</replaceable></option></arg> <arg><option>-l <replaceable class="parameter">domain</replaceable></option></arg> <arg><option>-i <replaceable class="parameter">interval</replaceable></option></arg> <arg><option>-I <replaceable class="parameter">input-format</replaceable></option></arg> @@ -74,8 +77,9 @@ <arg><option>-N <replaceable class="parameter">soa-serial-format</replaceable></option></arg> <arg><option>-o <replaceable class="parameter">origin</replaceable></option></arg> <arg><option>-O <replaceable class="parameter">output-format</replaceable></option></arg> - <arg><option>-p</option></arg> <arg><option>-P</option></arg> + <arg><option>-p</option></arg> + <arg><option>-R</option></arg> <arg><option>-r <replaceable class="parameter">randomdev</replaceable></option></arg> <arg><option>-S</option></arg> <arg><option>-s <replaceable class="parameter">start-time</replaceable></option></arg> @@ -83,6 +87,7 @@ <arg><option>-t</option></arg> <arg><option>-u</option></arg> <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg> + <arg><option>-X <replaceable class="parameter">extended end-time</replaceable></option></arg> <arg><option>-x</option></arg> <arg><option>-z</option></arg> <arg><option>-3 <replaceable class="parameter">salt</replaceable></option></arg> @@ -152,6 +157,22 @@ </varlistentry> <varlistentry> + <term>-D</term> + <listitem> + <para> + Output only those record types automatically managed by + <command>dnssec-signzone</command>, i.e. RRSIG, NSEC, + NSEC3 and NSEC3PARAM records. If smart signing + (<option>-S</option>) is used, DNSKEY records are also + included. The resulting file can be included in the original + zone file with <command>$INCLUDE</command>. This option + cannot be combined with <option>-O raw</option> or serial + number updating. + </para> + </listitem> + </varlistentry> + + <varlistentry> <term>-E <replaceable class="parameter">engine</replaceable></term> <listitem> <para> @@ -238,13 +259,40 @@ </varlistentry> <varlistentry> + <term>-X <replaceable class="parameter">extended end-time</replaceable></term> + <listitem> + <para> + Specify the date and time when the generated RRSIG records + for the DNSKEY RRset will expire. This is to be used in cases + when the DNSKEY signatures need to persist longer than + signatures on other records; e.g., when the private component + of the KSK is kept offline and the KSK signature is to be + refreshed manually. + </para> + <para> + As with <option>start-time</option>, an absolute + time is indicated in YYYYMMDDHHMMSS notation. A time relative + to the start time is indicated with +N, which is N seconds from + the start time. A time relative to the current time is + indicated with now+N. If no <option>extended end-time</option> is + specified, the value of <option>end-time</option> is used as + the default. (<option>end-time</option>, in turn, defaults to + 30 days from the start time.) <option>extended end-time</option> + must be later than <option>start-time</option>. + </para> + </listitem> + </varlistentry> + + <varlistentry> <term>-f <replaceable class="parameter">output-file</replaceable></term> <listitem> <para> The name of the output file containing the signed zone. The default is to append <filename>.signed</filename> to - the - input filename. + the input filename. If <option>output-file</option> is + set to <literal>"-"</literal>, then the signed zone is + written to the standard output, with a default output + format of "full". </para> </listitem> </varlistentry> @@ -325,6 +373,17 @@ </varlistentry> <varlistentry> + <term>-L <replaceable class="parameter">serial</replaceable></term> + <listitem> + <para> + When writing a signed zone to 'raw' format, set the "source serial" + value in the header to the specified serial number. (This is + expected to be used primarily for testing purposes.) + </para> + </listitem> + </varlistentry> + + <varlistentry> <term>-n <replaceable class="parameter">ncpus</replaceable></term> <listitem> <para> @@ -388,7 +447,15 @@ <para> The format of the output file containing the signed zone. Possible formats are <command>"text"</command> (default) - and <command>"raw"</command>. + <command>"full"</command>, which is text output in a + format suitable for processing by external scripts, + and <command>"raw"</command> or <command>"raw=N"</command>, + which store the zone in a binary format for rapid loading + by <command>named</command>. <command>"raw=N"</command> + specifies the format version of the raw zone file: if N + is 0, the raw file can be read by any version of + <command>named</command>; if N is 1, the file can be + read by release 9.9.0 or higher. The default is 1. </para> </listitem> </varlistentry> @@ -422,6 +489,24 @@ </varlistentry> <varlistentry> + <term>-R</term> + <listitem> + <para> + Remove signatures from keys that no longer exist. + </para> + <para> + Normally, when a previously-signed zone is passed as input + to the signer, and a DNSKEY record has been removed and + replaced with a new one, signatures from the old key + that are still within their validity period are retained. + This allows the zone to continue to validate with cached + copies of the old DNSKEY RRset. The <option>-R</option> forces + <command>dnssec-signzone</command> to remove all orphaned + signatures. + </para> + </listitem> + </varlistentry> + <varlistentry> <term>-r <replaceable class="parameter">randomdev</replaceable></term> <listitem> <para> @@ -508,15 +593,17 @@ <term>-T <replaceable class="parameter">ttl</replaceable></term> <listitem> <para> - Specifies the TTL to be used for new DNSKEY records imported - into the zone from the key repository. If not specified, - the default is the minimum TTL value from the zone's SOA + Specifies a TTL to be used for new DNSKEY records imported + into the zone from the key repository. If not + specified, the default is the TTL value from the zone's SOA record. This option is ignored when signing without <option>-S</option>, since DNSKEY records are not imported from the key repository in that case. It is also ignored if there are any pre-existing DNSKEY records at the zone apex, in which case new records' TTL values will be set to match - them. + them, or if any of the imported DNSKEY records had a default + TTL value. In the event of a a conflict between TTL values in + imported keys, the shortest one is used. </para> </listitem> </varlistentry> diff --git a/bin/dnssec/dnssec-signzone.html b/bin/dnssec/dnssec-signzone.html index 82185c6..3799453 100644 --- a/bin/dnssec/dnssec-signzone.html +++ b/bin/dnssec/dnssec-signzone.html @@ -1,5 +1,5 @@ <!-- - - Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004-2009, 2011 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000-2003 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -29,10 +29,10 @@ </div> <div class="refsynopsisdiv"> <h2>Synopsis</h2> -<div class="cmdsynopsis"><p><code class="command">dnssec-signzone</code> [<code class="option">-a</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>] [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>] [<code class="option">-g</code>] [<code class="option">-h</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-j <em class="replaceable"><code>jitter</code></em></code>] [<code class="option">-N <em class="replaceable"><code>soa-serial-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>] [<code class="option">-p</code>] [<code class="option">-P</code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S</code>] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-T <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-t</code>] [<code class="option">-u</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-x</code>] [<code class="option">-z</code>] [<code class="option">-3 <em class="replaceable"><code>salt</code></em></code>] [<code class="option">-H <em class="replaceable"><code>iterations</code></em></code>] [<code class="option">-A</code>] {zonefile} [key...]</p></div> +<div class="cmdsynopsis"><p><code class="command">dnssec-signzone</code> [<code class="option">-a</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>] [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>] [<code class="option">-g</code>] [<code class="option">-h</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key</code></em></code>] [<code class="option">-L <em class="replaceable"><code>serial</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-j <em class="replaceable"><code>jitter</code></em></code>] [<code class="option">-N <em class="replaceable"><code>soa-serial-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>] [<code class="option">-P</code>] [<code class="option">-p</code>] [<code class="option">-R</code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S</code>] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-T <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-t</code>] [<code class="option">-u</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-X <em class="replaceable"><code>extended end-time</code></em></code>] [<code class="option">-x</code>] [<code class="option">-z</code>] [<code class="option">-3 <em class="replaceable"><code>salt</code></em></code>] [<code class="option">-H <em class="replaceable"><code>iterations</code></em></code>] [<code class="option">-A</code>] {zonefile} [key...]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543597"></a><h2>DESCRIPTION</h2> +<a name="id2543626"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">dnssec-signzone</strong></span> signs a zone. It generates NSEC and RRSIG records and produces a signed version of the @@ -43,7 +43,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543612"></a><h2>OPTIONS</h2> +<a name="id2543641"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-a</span></dt> <dd><p> @@ -67,6 +67,17 @@ Look for <code class="filename">dsset-</code> or <code class="filename">keyset-</code> files in <code class="option">directory</code>. </p></dd> +<dt><span class="term">-D</span></dt> +<dd><p> + Output only those record types automatically managed by + <span><strong class="command">dnssec-signzone</strong></span>, i.e. RRSIG, NSEC, + NSEC3 and NSEC3PARAM records. If smart signing + (<code class="option">-S</code>) is used, DNSKEY records are also + included. The resulting file can be included in the original + zone file with <span><strong class="command">$INCLUDE</strong></span>. This option + cannot be combined with <code class="option">-O raw</code> or serial + number updating. + </p></dd> <dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt> <dd><p> Uses a crypto hardware (OpenSSL engine) for the crypto operations @@ -118,12 +129,36 @@ <code class="option">end-time</code> must be later than <code class="option">start-time</code>. </p></dd> +<dt><span class="term">-X <em class="replaceable"><code>extended end-time</code></em></span></dt> +<dd> +<p> + Specify the date and time when the generated RRSIG records + for the DNSKEY RRset will expire. This is to be used in cases + when the DNSKEY signatures need to persist longer than + signatures on other records; e.g., when the private component + of the KSK is kept offline and the KSK signature is to be + refreshed manually. + </p> +<p> + As with <code class="option">start-time</code>, an absolute + time is indicated in YYYYMMDDHHMMSS notation. A time relative + to the start time is indicated with +N, which is N seconds from + the start time. A time relative to the current time is + indicated with now+N. If no <code class="option">extended end-time</code> is + specified, the value of <code class="option">end-time</code> is used as + the default. (<code class="option">end-time</code>, in turn, defaults to + 30 days from the start time.) <code class="option">extended end-time</code> + must be later than <code class="option">start-time</code>. + </p> +</dd> <dt><span class="term">-f <em class="replaceable"><code>output-file</code></em></span></dt> <dd><p> The name of the output file containing the signed zone. The default is to append <code class="filename">.signed</code> to - the - input filename. + the input filename. If <code class="option">output-file</code> is + set to <code class="literal">"-"</code>, then the signed zone is + written to the standard output, with a default output + format of "full". </p></dd> <dt><span class="term">-h</span></dt> <dd><p> @@ -184,6 +219,12 @@ validators need to refetch at mostly the same time. </p> </dd> +<dt><span class="term">-L <em class="replaceable"><code>serial</code></em></span></dt> +<dd><p> + When writing a signed zone to 'raw' format, set the "source serial" + value in the header to the specified serial number. (This is + expected to be used primarily for testing purposes.) + </p></dd> <dt><span class="term">-n <em class="replaceable"><code>ncpus</code></em></span></dt> <dd><p> Specifies the number of threads to use. By default, one @@ -217,7 +258,15 @@ <dd><p> The format of the output file containing the signed zone. Possible formats are <span><strong class="command">"text"</strong></span> (default) - and <span><strong class="command">"raw"</strong></span>. + <span><strong class="command">"full"</strong></span>, which is text output in a + format suitable for processing by external scripts, + and <span><strong class="command">"raw"</strong></span> or <span><strong class="command">"raw=N"</strong></span>, + which store the zone in a binary format for rapid loading + by <span><strong class="command">named</strong></span>. <span><strong class="command">"raw=N"</strong></span> + specifies the format version of the raw zone file: if N + is 0, the raw file can be read by any version of + <span><strong class="command">named</strong></span>; if N is 1, the file can be + read by release 9.9.0 or higher. The default is 1. </p></dd> <dt><span class="term">-p</span></dt> <dd><p> @@ -239,6 +288,22 @@ This option skips these tests. </p> </dd> +<dt><span class="term">-R</span></dt> +<dd> +<p> + Remove signatures from keys that no longer exist. + </p> +<p> + Normally, when a previously-signed zone is passed as input + to the signer, and a DNSKEY record has been removed and + replaced with a new one, signatures from the old key + that are still within their validity period are retained. + This allows the zone to continue to validate with cached + copies of the old DNSKEY RRset. The <code class="option">-R</code> forces + <span><strong class="command">dnssec-signzone</strong></span> to remove all orphaned + signatures. + </p> +</dd> <dt><span class="term">-r <em class="replaceable"><code>randomdev</code></em></span></dt> <dd><p> Specifies the source of randomness. If the operating @@ -297,15 +362,17 @@ </dd> <dt><span class="term">-T <em class="replaceable"><code>ttl</code></em></span></dt> <dd><p> - Specifies the TTL to be used for new DNSKEY records imported - into the zone from the key repository. If not specified, - the default is the minimum TTL value from the zone's SOA + Specifies a TTL to be used for new DNSKEY records imported + into the zone from the key repository. If not + specified, the default is the TTL value from the zone's SOA record. This option is ignored when signing without <code class="option">-S</code>, since DNSKEY records are not imported from the key repository in that case. It is also ignored if there are any pre-existing DNSKEY records at the zone apex, in which case new records' TTL values will be set to match - them. + them, or if any of the imported DNSKEY records had a default + TTL value. In the event of a a conflict between TTL values in + imported keys, the shortest one is used. </p></dd> <dt><span class="term">-t</span></dt> <dd><p> @@ -379,7 +446,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2544965"></a><h2>EXAMPLE</h2> +<a name="id2545127"></a><h2>EXAMPLE</h2> <p> The following command signs the <strong class="userinput"><code>example.com</code></strong> zone with the DSA key generated by <span><strong class="command">dnssec-keygen</strong></span> @@ -409,14 +476,14 @@ db.example.com.signed %</pre> </div> <div class="refsect1" lang="en"> -<a name="id2545020"></a><h2>SEE ALSO</h2> +<a name="id2545182"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>, <em class="citetitle">BIND 9 Administrator Reference Manual</em>, <em class="citetitle">RFC 4033</em>. </p> </div> <div class="refsect1" lang="en"> -<a name="id2545045"></a><h2>AUTHOR</h2> +<a name="id2545207"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/bin/dnssec/dnssec-verify.8 b/bin/dnssec/dnssec-verify.8 new file mode 100644 index 0000000..1de88fa --- /dev/null +++ b/bin/dnssec/dnssec-verify.8 @@ -0,0 +1,97 @@ +.\" Copyright (C) 2012 Internet Systems Consortium, Inc. ("ISC") +.\" +.\" Permission to use, copy, modify, and/or distribute this software for any +.\" purpose with or without fee is hereby granted, provided that the above +.\" copyright notice and this permission notice appear in all copies. +.\" +.\" THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +.\" REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +.\" AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +.\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +.\" LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +.\" PERFORMANCE OF THIS SOFTWARE. +.\" +.\" $Id$ +.\" +.hy 0 +.ad l +.\" Title: dnssec\-verify +.\" Author: +.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/> +.\" Date: April 12, 2012 +.\" Manual: BIND9 +.\" Source: BIND9 +.\" +.TH "DNSSEC\-VERIFY" "8" "April 12, 2012" "BIND9" "BIND9" +.\" disable hyphenation +.nh +.\" disable justification (adjust text to left margin only) +.ad l +.SH "NAME" +dnssec\-verify \- DNSSEC zone verification tool +.SH "SYNOPSIS" +.HP 14 +\fBdnssec\-verify\fR [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-I\ \fR\fB\fIinput\-format\fR\fR] [\fB\-o\ \fR\fB\fIorigin\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-x\fR] [\fB\-z\fR] {zonefile} +.SH "DESCRIPTION" +.PP +\fBdnssec\-verify\fR +verifies that a zone is fully signed for each algorithm found in the DNSKEY RRset for the zone, and that the NSEC / NSEC3 chains are complete. +.SH "OPTIONS" +.PP +\-c \fIclass\fR +.RS 4 +Specifies the DNS class of the zone. +.RE +.PP +\-I \fIinput\-format\fR +.RS 4 +The format of the input zone file. Possible formats are +\fB"text"\fR +(default) and +\fB"raw"\fR. This option is primarily intended to be used for dynamic signed zones so that the dumped zone file in a non\-text format containing updates can be verified independently. The use of this option does not make much sense for non\-dynamic zones. +.RE +.PP +\-o \fIorigin\fR +.RS 4 +The zone origin. If not specified, the name of the zone file is assumed to be the origin. +.RE +.PP +\-v \fIlevel\fR +.RS 4 +Sets the debugging level. +.RE +.PP +\-x +.RS 4 +Only verify that the DNSKEY RRset is signed with key\-signing keys. Without this flag, it is assumed that the DNSKEY RRset will be signed by all active keys. When this flag is set, it will not be an error if the DNSKEY RRset is not signed by zone\-signing keys. This corresponds to the +\fB\-x\fR +option in +\fBdnssec\-signzone\fR. +.RE +.PP +\-z +.RS 4 +Ignore the KSK flag on the keys when determining whether the zone if correctly signed. Without this flag it is assumed that there will be a non\-revoked, self\-signed DNSKEY with the KSK flag set for each algorithm and that RRsets other than DNSKEY RRset will be signed with a different DNSKEY without the KSK flag set. +.sp +With this flag set, we only require that for each algorithm, there will be at least one non\-revoked, self\-signed DNSKEY, regardless of the KSK flag state, and that other RRsets will be signed by a non\-revoked key for the same algorithm that includes the self\-signed key; the same key may be used for both purposes. This corresponds to the +\fB\-z\fR +option in +\fBdnssec\-signzone\fR. +.RE +.PP +zonefile +.RS 4 +The file containing the zone to be signed. +.RE +.SH "SEE ALSO" +.PP +\fBdnssec\-signzone\fR(8), +BIND 9 Administrator Reference Manual, +RFC 4033. +.SH "AUTHOR" +.PP +Internet Systems Consortium +.SH "COPYRIGHT" +Copyright \(co 2012 Internet Systems Consortium, Inc. ("ISC") +.br diff --git a/bin/dnssec/dnssec-verify.c b/bin/dnssec/dnssec-verify.c new file mode 100644 index 0000000..682896c --- /dev/null +++ b/bin/dnssec/dnssec-verify.c @@ -0,0 +1,328 @@ +/* + * Copyright (C) 2012 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +/* $Id: dnssec-verify.c,v 1.1.2.1 2011/03/16 06:37:51 each Exp $ */ + +/*! \file */ + +#include <config.h> + +#include <stdlib.h> +#include <time.h> + +#include <isc/app.h> +#include <isc/base32.h> +#include <isc/commandline.h> +#include <isc/entropy.h> +#include <isc/event.h> +#include <isc/file.h> +#include <isc/hash.h> +#include <isc/hex.h> +#include <isc/mem.h> +#include <isc/mutex.h> +#include <isc/os.h> +#include <isc/print.h> +#include <isc/random.h> +#include <isc/rwlock.h> +#include <isc/serial.h> +#include <isc/stdio.h> +#include <isc/stdlib.h> +#include <isc/string.h> +#include <isc/time.h> +#include <isc/util.h> + +#include <dns/db.h> +#include <dns/dbiterator.h> +#include <dns/diff.h> +#include <dns/dnssec.h> +#include <dns/ds.h> +#include <dns/fixedname.h> +#include <dns/keyvalues.h> +#include <dns/log.h> +#include <dns/master.h> +#include <dns/masterdump.h> +#include <dns/nsec.h> +#include <dns/nsec3.h> +#include <dns/rdata.h> +#include <dns/rdatalist.h> +#include <dns/rdataset.h> +#include <dns/rdataclass.h> +#include <dns/rdatasetiter.h> +#include <dns/rdatastruct.h> +#include <dns/rdatatype.h> +#include <dns/result.h> +#include <dns/soa.h> +#include <dns/time.h> + +#include <dst/dst.h> + +#include "dnssectool.h" + +const char *program = "dnssec-verify"; +int verbose; + +static isc_stdtime_t now; +static isc_mem_t *mctx = NULL; +static isc_entropy_t *ectx = NULL; +static dns_masterformat_t inputformat = dns_masterformat_text; +static dns_db_t *gdb; /* The database */ +static dns_dbversion_t *gversion; /* The database version */ +static dns_rdataclass_t gclass; /* The class */ +static dns_name_t *gorigin; /* The database origin */ +static isc_boolean_t ignore_kskflag = ISC_FALSE; +static isc_boolean_t keyset_kskonly = ISC_FALSE; + +/*% + * Load the zone file from disk + */ +static void +loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) { + isc_buffer_t b; + int len; + dns_fixedname_t fname; + dns_name_t *name; + isc_result_t result; + + len = strlen(origin); + isc_buffer_init(&b, origin, len); + isc_buffer_add(&b, len); + + dns_fixedname_init(&fname); + name = dns_fixedname_name(&fname); + result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL); + if (result != ISC_R_SUCCESS) + fatal("failed converting name '%s' to dns format: %s", + origin, isc_result_totext(result)); + + result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, + rdclass, 0, NULL, db); + check_result(result, "dns_db_create()"); + + result = dns_db_load2(*db, file, inputformat); + if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE) + fatal("failed loading zone from '%s': %s", + file, isc_result_totext(result)); +} + +ISC_PLATFORM_NORETURN_PRE static void +usage(void) ISC_PLATFORM_NORETURN_POST; + +static void +usage(void) { + fprintf(stderr, "Usage:\n"); + fprintf(stderr, "\t%s [options] zonefile [keys]\n", program); + + fprintf(stderr, "\n"); + + fprintf(stderr, "Version: %s\n", VERSION); + + fprintf(stderr, "Options: (default value in parenthesis) \n"); + fprintf(stderr, "\t-v debuglevel (0)\n"); + fprintf(stderr, "\t-o origin:\n"); + fprintf(stderr, "\t\tzone origin (name of zonefile)\n"); + fprintf(stderr, "\t-I format:\n"); + fprintf(stderr, "\t\tfile format of input zonefile (text)\n"); + fprintf(stderr, "\t-c class (IN)\n"); + fprintf(stderr, "\t-E engine:\n"); +#ifdef USE_PKCS11 + fprintf(stderr, "\t\tname of an OpenSSL engine to use " + "(default is \"pkcs11\")\n"); +#else + fprintf(stderr, "\t\tname of an OpenSSL engine to use\n"); +#endif + fprintf(stderr, "\t-x:\tDNSKEY record signed with KSKs only, " + "not ZSKs\n"); + fprintf(stderr, "\t-z:\tAll records signed with KSKs\n"); + exit(0); +} + +int +main(int argc, char *argv[]) { + char *origin = NULL, *file = NULL; + char *inputformatstr = NULL; + isc_result_t result; + isc_log_t *log = NULL; +#ifdef USE_PKCS11 + const char *engine = "pkcs11"; +#else + const char *engine = NULL; +#endif + char *classname = NULL; + dns_rdataclass_t rdclass; + char ch, *endp; + +#define CMDLINE_FLAGS \ + "m:o:I:c:E:v:xz" + + /* + * Process memory debugging argument first. + */ + while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) { + switch (ch) { + case 'm': + if (strcasecmp(isc_commandline_argument, "record") == 0) + isc_mem_debugging |= ISC_MEM_DEBUGRECORD; + if (strcasecmp(isc_commandline_argument, "trace") == 0) + isc_mem_debugging |= ISC_MEM_DEBUGTRACE; + if (strcasecmp(isc_commandline_argument, "usage") == 0) + isc_mem_debugging |= ISC_MEM_DEBUGUSAGE; + if (strcasecmp(isc_commandline_argument, "size") == 0) + isc_mem_debugging |= ISC_MEM_DEBUGSIZE; + if (strcasecmp(isc_commandline_argument, "mctx") == 0) + isc_mem_debugging |= ISC_MEM_DEBUGCTX; + break; + default: + break; + } + } + isc_commandline_reset = ISC_TRUE; + check_result(isc_app_start(), "isc_app_start"); + + result = isc_mem_create(0, 0, &mctx); + if (result != ISC_R_SUCCESS) + fatal("out of memory"); + + dns_result_register(); + + isc_commandline_errprint = ISC_FALSE; + + while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) { + switch (ch) { + case 'c': + classname = isc_commandline_argument; + break; + + case 'E': + engine = isc_commandline_argument; + break; + + case 'h': + usage(); + break; + + case 'I': + inputformatstr = isc_commandline_argument; + break; + + case 'm': + break; + + case 'o': + origin = isc_commandline_argument; + break; + + case 'v': + endp = NULL; + verbose = strtol(isc_commandline_argument, &endp, 0); + if (*endp != '\0') + fatal("verbose level must be numeric"); + break; + + case 'x': + keyset_kskonly = ISC_TRUE; + break; + + case 'z': + ignore_kskflag = ISC_TRUE; + break; + + case '?': + if (isc_commandline_option != '?') + fprintf(stderr, "%s: invalid argument -%c\n", + program, isc_commandline_option); + usage(); + break; + + default: + fprintf(stderr, "%s: unhandled option -%c\n", + program, isc_commandline_option); + exit(1); + } + } + + if (ectx == NULL) + setup_entropy(mctx, NULL, &ectx); + + result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE); + if (result != ISC_R_SUCCESS) + fatal("could not create hash context"); + + result = dst_lib_init2(mctx, ectx, engine, ISC_ENTROPY_BLOCKING); + if (result != ISC_R_SUCCESS) + fatal("could not initialize dst: %s", + isc_result_totext(result)); + + isc_stdtime_get(&now); + + rdclass = strtoclass(classname); + + setup_logging(verbose, mctx, &log); + + argc -= isc_commandline_index; + argv += isc_commandline_index; + + if (argc < 1) + usage(); + + file = argv[0]; + + argc -= 1; + argv += 1; + + POST(argc); + POST(argv); + + if (origin == NULL) + origin = file; + + if (inputformatstr != NULL) { + if (strcasecmp(inputformatstr, "text") == 0) + inputformat = dns_masterformat_text; + else if (strcasecmp(inputformatstr, "raw") == 0) + inputformat = dns_masterformat_raw; + else + fatal("unknown file format: %s\n", inputformatstr); + } + + gdb = NULL; + fprintf(stderr, "Loading zone '%s' from file '%s'\n", origin, file); + loadzone(file, origin, rdclass, &gdb); + gorigin = dns_db_origin(gdb); + gclass = dns_db_class(gdb); + + gversion = NULL; + result = dns_db_newversion(gdb, &gversion); + check_result(result, "dns_db_newversion()"); + + verifyzone(gdb, gversion, gorigin, mctx, + ignore_kskflag, keyset_kskonly); + + dns_db_closeversion(gdb, &gversion, ISC_FALSE); + dns_db_detach(&gdb); + + cleanup_logging(&log); + dst_lib_destroy(); + isc_hash_destroy(); + cleanup_entropy(&ectx); + dns_name_destroy(); + if (verbose > 10) + isc_mem_stats(mctx, stdout); + isc_mem_destroy(&mctx); + + (void) isc_app_finish(); + + return (0); +} diff --git a/bin/dnssec/dnssec-verify.docbook b/bin/dnssec/dnssec-verify.docbook new file mode 100644 index 0000000..0835df1 --- /dev/null +++ b/bin/dnssec/dnssec-verify.docbook @@ -0,0 +1,185 @@ +<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN" + "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" + [<!ENTITY mdash "—">]> +<!-- + - Copyright (C) 2012 Internet Systems Consortium, Inc. ("ISC") + - + - Permission to use, copy, modify, and/or distribute this software for any + - purpose with or without fee is hereby granted, provided that the above + - copyright notice and this permission notice appear in all copies. + - + - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + - PERFORMANCE OF THIS SOFTWARE. +--> + +<!-- $Id: dnssec-verify.docbook,v 1.52 2011/12/22 07:32:40 each Exp $ --> +<refentry id="man.dnssec-verify"> + <refentryinfo> + <date>April 12, 2012</date> + </refentryinfo> + + <refmeta> + <refentrytitle><application>dnssec-verify</application></refentrytitle> + <manvolnum>8</manvolnum> + <refmiscinfo>BIND9</refmiscinfo> + </refmeta> + + <refnamediv> + <refname><application>dnssec-verify</application></refname> + <refpurpose>DNSSEC zone verification tool</refpurpose> + </refnamediv> + + <docinfo> + <copyright> + <year>2012</year> + <holder>Internet Systems Consortium, Inc. ("ISC")</holder> + </copyright> + </docinfo> + + <refsynopsisdiv> + <cmdsynopsis> + <command>dnssec-verify</command> + <arg><option>-c <replaceable class="parameter">class</replaceable></option></arg> + <arg><option>-E <replaceable class="parameter">engine</replaceable></option></arg> + <arg><option>-I <replaceable class="parameter">input-format</replaceable></option></arg> + <arg><option>-o <replaceable class="parameter">origin</replaceable></option></arg> + <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg> + <arg><option>-x</option></arg> + <arg><option>-z</option></arg> + <arg choice="req">zonefile</arg> + </cmdsynopsis> + </refsynopsisdiv> + + <refsect1> + <title>DESCRIPTION</title> + <para><command>dnssec-verify</command> + verifies that a zone is fully signed for each algorithm found + in the DNSKEY RRset for the zone, and that the NSEC / NSEC3 + chains are complete. + </para> + </refsect1> + + <refsect1> + <title>OPTIONS</title> + + <variablelist> + <varlistentry> + <term>-c <replaceable class="parameter">class</replaceable></term> + <listitem> + <para> + Specifies the DNS class of the zone. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term>-I <replaceable class="parameter">input-format</replaceable></term> + <listitem> + <para> + The format of the input zone file. + Possible formats are <command>"text"</command> (default) + and <command>"raw"</command>. + This option is primarily intended to be used for dynamic + signed zones so that the dumped zone file in a non-text + format containing updates can be verified independently. + The use of this option does not make much sense for + non-dynamic zones. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term>-o <replaceable class="parameter">origin</replaceable></term> + <listitem> + <para> + The zone origin. If not specified, the name of the zone file + is assumed to be the origin. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term>-v <replaceable class="parameter">level</replaceable></term> + <listitem> + <para> + Sets the debugging level. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term>-x</term> + <listitem> + <para> + Only verify that the DNSKEY RRset is signed with key-signing + keys. Without this flag, it is assumed that the DNSKEY RRset + will be signed by all active keys. When this flag is set, + it will not be an error if the DNSKEY RRset is not signed + by zone-signing keys. This corresponds to the <option>-x</option> + option in <command>dnssec-signzone</command>. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term>-z</term> + <listitem> + <para> + Ignore the KSK flag on the keys when determining whether + the zone if correctly signed. Without this flag it is + assumed that there will be a non-revoked, self-signed + DNSKEY with the KSK flag set for each algorithm and + that RRsets other than DNSKEY RRset will be signed with + a different DNSKEY without the KSK flag set. + </para> + <para> + With this flag set, we only require that for each algorithm, + there will be at least one non-revoked, self-signed DNSKEY, + regardless of the KSK flag state, and that other RRsets + will be signed by a non-revoked key for the same algorithm + that includes the self-signed key; the same key may be used + for both purposes. This corresponds to the <option>-z</option> + option in <command>dnssec-signzone</command>. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term>zonefile</term> + <listitem> + <para> + The file containing the zone to be signed. + </para> + </listitem> + </varlistentry> + + </variablelist> + </refsect1> + + <refsect1> + <title>SEE ALSO</title> + <para> + <citerefentry> + <refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum> + </citerefentry>, + <citetitle>BIND 9 Administrator Reference Manual</citetitle>, + <citetitle>RFC 4033</citetitle>. + </para> + </refsect1> + + <refsect1> + <title>AUTHOR</title> + <para><corpauthor>Internet Systems Consortium</corpauthor> + </para> + </refsect1> + +</refentry><!-- + - Local variables: + - mode: sgml + - End: +--> diff --git a/bin/dnssec/dnssec-verify.html b/bin/dnssec/dnssec-verify.html new file mode 100644 index 0000000..135556f --- /dev/null +++ b/bin/dnssec/dnssec-verify.html @@ -0,0 +1,117 @@ +<!-- + - Copyright (C) 2012 Internet Systems Consortium, Inc. ("ISC") + - + - Permission to use, copy, modify, and/or distribute this software for any + - purpose with or without fee is hereby granted, provided that the above + - copyright notice and this permission notice appear in all copies. + - + - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + - PERFORMANCE OF THIS SOFTWARE. +--> +<!-- $Id$ --> +<html> +<head> +<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> +<title>dnssec-verify</title> +<meta name="generator" content="DocBook XSL Stylesheets V1.71.1"> +</head> +<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en"> +<a name="man.dnssec-verify"></a><div class="titlepage"></div> +<div class="refnamediv"> +<h2>Name</h2> +<p><span class="application">dnssec-verify</span> — DNSSEC zone verification tool</p> +</div> +<div class="refsynopsisdiv"> +<h2>Synopsis</h2> +<div class="cmdsynopsis"><p><code class="command">dnssec-verify</code> [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-x</code>] [<code class="option">-z</code>] {zonefile}</p></div> +</div> +<div class="refsect1" lang="en"> +<a name="id2543390"></a><h2>DESCRIPTION</h2> +<p><span><strong class="command">dnssec-verify</strong></span> + verifies that a zone is fully signed for each algorithm found + in the DNSKEY RRset for the zone, and that the NSEC / NSEC3 + chains are complete. + </p> +</div> +<div class="refsect1" lang="en"> +<a name="id2543402"></a><h2>OPTIONS</h2> +<div class="variablelist"><dl> +<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt> +<dd><p> + Specifies the DNS class of the zone. + </p></dd> +<dt><span class="term">-I <em class="replaceable"><code>input-format</code></em></span></dt> +<dd><p> + The format of the input zone file. + Possible formats are <span><strong class="command">"text"</strong></span> (default) + and <span><strong class="command">"raw"</strong></span>. + This option is primarily intended to be used for dynamic + signed zones so that the dumped zone file in a non-text + format containing updates can be verified independently. + The use of this option does not make much sense for + non-dynamic zones. + </p></dd> +<dt><span class="term">-o <em class="replaceable"><code>origin</code></em></span></dt> +<dd><p> + The zone origin. If not specified, the name of the zone file + is assumed to be the origin. + </p></dd> +<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt> +<dd><p> + Sets the debugging level. + </p></dd> +<dt><span class="term">-x</span></dt> +<dd><p> + Only verify that the DNSKEY RRset is signed with key-signing + keys. Without this flag, it is assumed that the DNSKEY RRset + will be signed by all active keys. When this flag is set, + it will not be an error if the DNSKEY RRset is not signed + by zone-signing keys. This corresponds to the <code class="option">-x</code> + option in <span><strong class="command">dnssec-signzone</strong></span>. + </p></dd> +<dt><span class="term">-z</span></dt> +<dd> +<p> + Ignore the KSK flag on the keys when determining whether + the zone if correctly signed. Without this flag it is + assumed that there will be a non-revoked, self-signed + DNSKEY with the KSK flag set for each algorithm and + that RRsets other than DNSKEY RRset will be signed with + a different DNSKEY without the KSK flag set. + </p> +<p> + With this flag set, we only require that for each algorithm, + there will be at least one non-revoked, self-signed DNSKEY, + regardless of the KSK flag state, and that other RRsets + will be signed by a non-revoked key for the same algorithm + that includes the self-signed key; the same key may be used + for both purposes. This corresponds to the <code class="option">-z</code> + option in <span><strong class="command">dnssec-signzone</strong></span>. + </p> +</dd> +<dt><span class="term">zonefile</span></dt> +<dd><p> + The file containing the zone to be signed. + </p></dd> +</dl></div> +</div> +<div class="refsect1" lang="en"> +<a name="id2543543"></a><h2>SEE ALSO</h2> +<p> + <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>, + <em class="citetitle">BIND 9 Administrator Reference Manual</em>, + <em class="citetitle">RFC 4033</em>. + </p> +</div> +<div class="refsect1" lang="en"> +<a name="id2543637"></a><h2>AUTHOR</h2> +<p><span class="corpauthor">Internet Systems Consortium</span> + </p> +</div> +</div></body> +</html> diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c index 882b042..7c8c6ce 100644 --- a/bin/dnssec/dnssectool.c +++ b/bin/dnssec/dnssectool.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007, 2009-2011 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2009-2013 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001, 2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dnssectool.c,v 1.60.162.3 2011/10/21 03:56:32 marka Exp $ */ +/* $Id: dnssectool.c,v 1.63 2011/10/21 03:55:33 marka Exp $ */ /*! \file */ @@ -27,9 +27,11 @@ #include <stdlib.h> +#include <isc/base32.h> #include <isc/buffer.h> #include <isc/dir.h> #include <isc/entropy.h> +#include <isc/heap.h> #include <isc/list.h> #include <isc/mem.h> #include <isc/string.h> @@ -37,12 +39,19 @@ #include <isc/util.h> #include <isc/print.h> +#include <dns/db.h> +#include <dns/dbiterator.h> #include <dns/dnssec.h> +#include <dns/fixedname.h> #include <dns/keyvalues.h> #include <dns/log.h> #include <dns/name.h> +#include <dns/nsec.h> +#include <dns/nsec3.h> #include <dns/rdatastruct.h> #include <dns/rdataclass.h> +#include <dns/rdataset.h> +#include <dns/rdatasetiter.h> #include <dns/rdatatype.h> #include <dns/result.h> #include <dns/secalg.h> @@ -50,6 +59,18 @@ #include "dnssectool.h" +static isc_heap_t *expected_chains, *found_chains; + +struct nsec3_chain_fixed { + isc_uint8_t hash; + isc_uint8_t salt_length; + isc_uint8_t next_length; + isc_uint16_t iterations; + /* unsigned char salt[0]; */ + /* unsigned char owner[0]; */ + /* unsigned char next[0]; */ +}; + extern int verbose; extern const char *program; @@ -467,3 +488,1314 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir, return (conflict); } + +isc_boolean_t +is_delegation(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin, + dns_name_t *name, dns_dbnode_t *node, isc_uint32_t *ttlp) +{ + dns_rdataset_t nsset; + isc_result_t result; + + if (dns_name_equal(name, origin)) + return (ISC_FALSE); + + dns_rdataset_init(&nsset); + result = dns_db_findrdataset(db, node, ver, dns_rdatatype_ns, + 0, 0, &nsset, NULL); + if (dns_rdataset_isassociated(&nsset)) { + if (ttlp != NULL) + *ttlp = nsset.ttl; + dns_rdataset_disassociate(&nsset); + } + + return (ISC_TF(result == ISC_R_SUCCESS)); +} + +static isc_boolean_t +goodsig(dns_name_t *origin, dns_rdata_t *sigrdata, dns_name_t *name, + dns_rdataset_t *keyrdataset, dns_rdataset_t *rdataset, isc_mem_t *mctx) +{ + dns_rdata_dnskey_t key; + dns_rdata_rrsig_t sig; + dst_key_t *dstkey = NULL; + isc_result_t result; + + result = dns_rdata_tostruct(sigrdata, &sig, NULL); + check_result(result, "dns_rdata_tostruct()"); + + for (result = dns_rdataset_first(keyrdataset); + result == ISC_R_SUCCESS; + result = dns_rdataset_next(keyrdataset)) { + dns_rdata_t rdata = DNS_RDATA_INIT; + dns_rdataset_current(keyrdataset, &rdata); + result = dns_rdata_tostruct(&rdata, &key, NULL); + check_result(result, "dns_rdata_tostruct()"); + result = dns_dnssec_keyfromrdata(origin, &rdata, mctx, + &dstkey); + if (result != ISC_R_SUCCESS) + return (ISC_FALSE); + if (sig.algorithm != key.algorithm || + sig.keyid != dst_key_id(dstkey) || + !dns_name_equal(&sig.signer, origin)) { + dst_key_free(&dstkey); + continue; + } + result = dns_dnssec_verify(name, rdataset, dstkey, ISC_FALSE, + mctx, sigrdata); + dst_key_free(&dstkey); + if (result == ISC_R_SUCCESS) + return(ISC_TRUE); + } + return (ISC_FALSE); +} + +static isc_result_t +verifynsec(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, + dns_dbnode_t *node, dns_name_t *nextname) +{ + unsigned char buffer[DNS_NSEC_BUFFERSIZE]; + char namebuf[DNS_NAME_FORMATSIZE]; + char nextbuf[DNS_NAME_FORMATSIZE]; + char found[DNS_NAME_FORMATSIZE]; + dns_rdataset_t rdataset; + dns_rdata_t rdata = DNS_RDATA_INIT; + dns_rdata_t tmprdata = DNS_RDATA_INIT; + dns_rdata_nsec_t nsec; + isc_result_t result; + + dns_rdataset_init(&rdataset); + result = dns_db_findrdataset(db, node, ver, dns_rdatatype_nsec, + 0, 0, &rdataset, NULL); + if (result != ISC_R_SUCCESS) { + dns_name_format(name, namebuf, sizeof(namebuf)); + fprintf(stderr, "Missing NSEC record for %s\n", namebuf); + goto failure; + } + + result = dns_rdataset_first(&rdataset); + check_result(result, "dns_rdataset_first()"); + + dns_rdataset_current(&rdataset, &rdata); + result = dns_rdata_tostruct(&rdata, &nsec, NULL); + check_result(result, "dns_rdata_tostruct()"); + /* Check bit next name is consistent */ + if (!dns_name_equal(&nsec.next, nextname)) { + dns_name_format(name, namebuf, sizeof(namebuf)); + dns_name_format(nextname, nextbuf, sizeof(nextbuf)); + dns_name_format(&nsec.next, found, sizeof(found)); + fprintf(stderr, "Bad NSEC record for %s, next name " + "mismatch (expected:%s, found:%s)\n", namebuf, + nextbuf, found); + goto failure; + } + /* Check bit map is consistent */ + result = dns_nsec_buildrdata(db, ver, node, nextname, buffer, + &tmprdata); + check_result(result, "dns_nsec_buildrdata()"); + if (dns_rdata_compare(&rdata, &tmprdata) != 0) { + dns_name_format(name, namebuf, sizeof(namebuf)); + fprintf(stderr, "Bad NSEC record for %s, bit map " + "mismatch\n", namebuf); + goto failure; + } + result = dns_rdataset_next(&rdataset); + if (result != ISC_R_NOMORE) { + dns_name_format(name, namebuf, sizeof(namebuf)); + fprintf(stderr, "Multipe NSEC records for %s\n", namebuf); + goto failure; + + } + dns_rdataset_disassociate(&rdataset); + return (ISC_R_SUCCESS); + failure: + if (dns_rdataset_isassociated(&rdataset)) + dns_rdataset_disassociate(&rdataset); + return (ISC_R_FAILURE); +} + +static void +check_no_rrsig(dns_db_t *db, dns_dbversion_t *ver, dns_rdataset_t *rdataset, + dns_name_t *name, dns_dbnode_t *node) +{ + char namebuf[DNS_NAME_FORMATSIZE]; + char typebuf[80]; + dns_rdataset_t sigrdataset; + dns_rdatasetiter_t *rdsiter = NULL; + isc_result_t result; + + dns_rdataset_init(&sigrdataset); + result = dns_db_allrdatasets(db, node, ver, 0, &rdsiter); + check_result(result, "dns_db_allrdatasets()"); + for (result = dns_rdatasetiter_first(rdsiter); + result == ISC_R_SUCCESS; + result = dns_rdatasetiter_next(rdsiter)) { + dns_rdatasetiter_current(rdsiter, &sigrdataset); + if (sigrdataset.type == dns_rdatatype_rrsig && + sigrdataset.covers == rdataset->type) + break; + dns_rdataset_disassociate(&sigrdataset); + } + if (result == ISC_R_SUCCESS) { + dns_name_format(name, namebuf, sizeof(namebuf)); + type_format(rdataset->type, typebuf, sizeof(typebuf)); + fprintf(stderr, "Warning: Found unexpected signatures for " + "%s/%s\n", namebuf, typebuf); + } + if (dns_rdataset_isassociated(&sigrdataset)) + dns_rdataset_disassociate(&sigrdataset); + dns_rdatasetiter_destroy(&rdsiter); +} + +static isc_boolean_t +chain_compare(void *arg1, void *arg2) { + struct nsec3_chain_fixed *e1 = arg1, *e2 = arg2; + size_t len; + + /* + * Do each element in turn to get a stable sort. + */ + if (e1->hash < e2->hash) + return (ISC_TRUE); + if (e1->hash > e2->hash) + return (ISC_FALSE); + if (e1->iterations < e2->iterations) + return (ISC_TRUE); + if (e1->iterations > e2->iterations) + return (ISC_FALSE); + if (e1->salt_length < e2->salt_length) + return (ISC_TRUE); + if (e1->salt_length > e2->salt_length) + return (ISC_FALSE); + if (e1->next_length < e2->next_length) + return (ISC_TRUE); + if (e1->next_length > e2->next_length) + return (ISC_FALSE); + len = e1->salt_length + 2 * e1->next_length; + if (memcmp(e1 + 1, e2 + 1, len) < 0) + return (ISC_TRUE); + return (ISC_FALSE); +} + +static isc_boolean_t +chain_equal(struct nsec3_chain_fixed *e1, struct nsec3_chain_fixed *e2) { + size_t len; + + if (e1->hash != e2->hash) + return (ISC_FALSE); + if (e1->iterations != e2->iterations) + return (ISC_FALSE); + if (e1->salt_length != e2->salt_length) + return (ISC_FALSE); + if (e1->next_length != e2->next_length) + return (ISC_FALSE); + len = e1->salt_length + 2 * e1->next_length; + if (memcmp(e1 + 1, e2 + 1, len) != 0) + return (ISC_FALSE); + return (ISC_TRUE); +} + +static isc_result_t +record_nsec3(const unsigned char *rawhash, const dns_rdata_nsec3_t *nsec3, + isc_mem_t *mctx, isc_heap_t *chains) +{ + struct nsec3_chain_fixed *element; + size_t len; + unsigned char *cp; + isc_result_t result; + + len = sizeof(*element) + nsec3->next_length * 2 + nsec3->salt_length; + + element = isc_mem_get(mctx, len); + if (element == NULL) + return (ISC_R_NOMEMORY); + memset(element, 0, len); + element->hash = nsec3->hash; + element->salt_length = nsec3->salt_length; + element->next_length = nsec3->next_length; + element->iterations = nsec3->iterations; + cp = (unsigned char *)(element + 1); + memcpy(cp, nsec3->salt, nsec3->salt_length); + cp += nsec3->salt_length; + memcpy(cp, rawhash, nsec3->next_length); + cp += nsec3->next_length; + memcpy(cp, nsec3->next, nsec3->next_length); + result = isc_heap_insert(chains, element); + if (result != ISC_R_SUCCESS) { + fprintf(stderr, "isc_heap_insert failed: %s\n", + isc_result_totext(result)); + isc_mem_put(mctx, element, len); + } + return (result); +} + +static isc_result_t +match_nsec3(dns_name_t *name, isc_mem_t *mctx, + dns_rdata_nsec3param_t *nsec3param, dns_rdataset_t *rdataset, + unsigned char types[8192], unsigned int maxtype, + unsigned char *rawhash, size_t rhsize) +{ + unsigned char cbm[8244]; + char namebuf[DNS_NAME_FORMATSIZE]; + dns_rdata_nsec3_t nsec3; + isc_result_t result; + unsigned int len; + + /* + * Find matching NSEC3 record. + */ + for (result = dns_rdataset_first(rdataset); + result == ISC_R_SUCCESS; + result = dns_rdataset_next(rdataset)) { + dns_rdata_t rdata = DNS_RDATA_INIT; + dns_rdataset_current(rdataset, &rdata); + result = dns_rdata_tostruct(&rdata, &nsec3, NULL); + check_result(result, "dns_rdata_tostruct()"); + if (nsec3.hash == nsec3param->hash && + nsec3.next_length == rhsize && + nsec3.iterations == nsec3param->iterations && + nsec3.salt_length == nsec3param->salt_length && + memcmp(nsec3.salt, nsec3param->salt, + nsec3param->salt_length) == 0) + break; + } + if (result != ISC_R_SUCCESS) { + dns_name_format(name, namebuf, sizeof(namebuf)); + fprintf(stderr, "Missing NSEC3 record for %s\n", namebuf); + return (result); + } + + /* + * Check the type list. + */ + len = dns_nsec_compressbitmap(cbm, types, maxtype); + if (nsec3.len != len || memcmp(cbm, nsec3.typebits, len) != 0) { + dns_name_format(name, namebuf, sizeof(namebuf)); + fprintf(stderr, "Bad NSEC3 record for %s, bit map " + "mismatch\n", namebuf); + return (ISC_R_FAILURE); + } + + /* + * Record chain. + */ + result = record_nsec3(rawhash, &nsec3, mctx, expected_chains); + check_result(result, "record_nsec3()"); + + /* + * Make sure there is only one NSEC3 record with this set of + * parameters. + */ + for (result = dns_rdataset_next(rdataset); + result == ISC_R_SUCCESS; + result = dns_rdataset_next(rdataset)) { + dns_rdata_t rdata = DNS_RDATA_INIT; + dns_rdataset_current(rdataset, &rdata); + result = dns_rdata_tostruct(&rdata, &nsec3, NULL); + check_result(result, "dns_rdata_tostruct()"); + if (nsec3.hash == nsec3param->hash && + nsec3.iterations == nsec3param->iterations && + nsec3.salt_length == nsec3param->salt_length && + memcmp(nsec3.salt, nsec3param->salt, + nsec3.salt_length) == 0) { + dns_name_format(name, namebuf, sizeof(namebuf)); + fprintf(stderr, "Multiple NSEC3 records with the " + "same parameter set for %s", namebuf); + result = DNS_R_DUPLICATE; + break; + } + } + if (result != ISC_R_NOMORE) + return (result); + + result = ISC_R_SUCCESS; + return (result); +} + +static isc_boolean_t +innsec3params(dns_rdata_nsec3_t *nsec3, dns_rdataset_t *nsec3paramset) { + dns_rdata_nsec3param_t nsec3param; + isc_result_t result; + + for (result = dns_rdataset_first(nsec3paramset); + result == ISC_R_SUCCESS; + result = dns_rdataset_next(nsec3paramset)) { + dns_rdata_t rdata = DNS_RDATA_INIT; + + dns_rdataset_current(nsec3paramset, &rdata); + result = dns_rdata_tostruct(&rdata, &nsec3param, NULL); + check_result(result, "dns_rdata_tostruct()"); + if (nsec3param.flags == 0 && + nsec3param.hash == nsec3->hash && + nsec3param.iterations == nsec3->iterations && + nsec3param.salt_length == nsec3->salt_length && + memcmp(nsec3param.salt, nsec3->salt, + nsec3->salt_length) == 0) + return (ISC_TRUE); + } + return (ISC_FALSE); +} + +static isc_result_t +record_found(dns_db_t *db, dns_dbversion_t *ver, isc_mem_t *mctx, + dns_name_t *name, dns_dbnode_t *node, + dns_rdataset_t *nsec3paramset) +{ + unsigned char owner[NSEC3_MAX_HASH_LENGTH]; + dns_rdata_nsec3_t nsec3; + dns_rdataset_t rdataset; + dns_label_t hashlabel; + isc_buffer_t b; + isc_result_t result; + + if (nsec3paramset == NULL || !dns_rdataset_isassociated(nsec3paramset)) + return (ISC_R_SUCCESS); + + dns_rdataset_init(&rdataset); + result = dns_db_findrdataset(db, node, ver, dns_rdatatype_nsec3, + 0, 0, &rdataset, NULL); + if (result != ISC_R_SUCCESS) + return (ISC_R_SUCCESS); + + dns_name_getlabel(name, 0, &hashlabel); + isc_region_consume(&hashlabel, 1); + isc_buffer_init(&b, owner, sizeof(owner)); + result = isc_base32hex_decoderegion(&hashlabel, &b); + if (result != ISC_R_SUCCESS) + goto cleanup; + + for (result = dns_rdataset_first(&rdataset); + result == ISC_R_SUCCESS; + result = dns_rdataset_next(&rdataset)) { + dns_rdata_t rdata = DNS_RDATA_INIT; + dns_rdataset_current(&rdataset, &rdata); + result = dns_rdata_tostruct(&rdata, &nsec3, NULL); + check_result(result, "dns_rdata_tostruct()"); + if (nsec3.next_length != isc_buffer_usedlength(&b)) + continue; + /* + * We only care about NSEC3 records that match a NSEC3PARAM + * record. + */ + if (!innsec3params(&nsec3, nsec3paramset)) + continue; + + /* + * Record chain. + */ + result = record_nsec3(owner, &nsec3, mctx, found_chains); + check_result(result, "record_nsec3()"); + } + + cleanup: + dns_rdataset_disassociate(&rdataset); + return (ISC_R_SUCCESS); +} + +static isc_boolean_t +isoptout(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin, + dns_rdata_t *nsec3rdata) +{ + dns_rdataset_t rdataset; + dns_rdata_t rdata = DNS_RDATA_INIT; + dns_rdata_nsec3_t nsec3; + dns_rdata_nsec3param_t nsec3param; + dns_fixedname_t fixed; + dns_name_t *hashname; + isc_result_t result; + dns_dbnode_t *node = NULL; + unsigned char rawhash[NSEC3_MAX_HASH_LENGTH]; + size_t rhsize = sizeof(rawhash); + isc_boolean_t ret; + + result = dns_rdata_tostruct(nsec3rdata, &nsec3param, NULL); + check_result(result, "dns_rdata_tostruct()"); + + dns_fixedname_init(&fixed); + result = dns_nsec3_hashname(&fixed, rawhash, &rhsize, origin, origin, + nsec3param.hash, nsec3param.iterations, + nsec3param.salt, nsec3param.salt_length); + check_result(result, "dns_nsec3_hashname()"); + + dns_rdataset_init(&rdataset); + hashname = dns_fixedname_name(&fixed); + result = dns_db_findnsec3node(db, hashname, ISC_FALSE, &node); + if (result == ISC_R_SUCCESS) + result = dns_db_findrdataset(db, node, ver, dns_rdatatype_nsec3, + 0, 0, &rdataset, NULL); + if (result != ISC_R_SUCCESS) + return (ISC_FALSE); + + result = dns_rdataset_first(&rdataset); + check_result(result, "dns_rdataset_first()"); + + dns_rdataset_current(&rdataset, &rdata); + + result = dns_rdata_tostruct(&rdata, &nsec3, NULL); + if (result != ISC_R_SUCCESS) + ret = ISC_FALSE; + else + ret = ISC_TF((nsec3.flags & DNS_NSEC3FLAG_OPTOUT) != 0); + + if (dns_rdataset_isassociated(&rdataset)) + dns_rdataset_disassociate(&rdataset); + if (node != NULL) + dns_db_detachnode(db, &node); + + return (ret); +} + +static isc_result_t +verifynsec3(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin, + isc_mem_t *mctx, dns_name_t *name, dns_rdata_t *rdata, + isc_boolean_t delegation, isc_boolean_t empty, + unsigned char types[8192], unsigned int maxtype) +{ + char namebuf[DNS_NAME_FORMATSIZE]; + char hashbuf[DNS_NAME_FORMATSIZE]; + dns_rdataset_t rdataset; + dns_rdata_nsec3param_t nsec3param; + dns_fixedname_t fixed; + dns_name_t *hashname; + isc_result_t result; + dns_dbnode_t *node = NULL; + unsigned char rawhash[NSEC3_MAX_HASH_LENGTH]; + size_t rhsize = sizeof(rawhash); + isc_boolean_t optout; + + result = dns_rdata_tostruct(rdata, &nsec3param, NULL); + check_result(result, "dns_rdata_tostruct()"); + + if (nsec3param.flags != 0) + return (ISC_R_SUCCESS); + + if (!dns_nsec3_supportedhash(nsec3param.hash)) + return (ISC_R_SUCCESS); + + optout = isoptout(db, ver, origin, rdata); + + dns_fixedname_init(&fixed); + result = dns_nsec3_hashname(&fixed, rawhash, &rhsize, name, origin, + nsec3param.hash, nsec3param.iterations, + nsec3param.salt, nsec3param.salt_length); + check_result(result, "dns_nsec3_hashname()"); + + /* + * We don't use dns_db_find() here as it works with the choosen + * nsec3 chain and we may also be called with uncommitted data + * from dnssec-signzone so the secure status of the zone may not + * be up to date. + */ + dns_rdataset_init(&rdataset); + hashname = dns_fixedname_name(&fixed); + result = dns_db_findnsec3node(db, hashname, ISC_FALSE, &node); + if (result == ISC_R_SUCCESS) + result = dns_db_findrdataset(db, node, ver, dns_rdatatype_nsec3, + 0, 0, &rdataset, NULL); + if (result != ISC_R_SUCCESS && + (!delegation || (empty && !optout) || + (!empty && dns_nsec_isset(types, dns_rdatatype_ds)))) + { + dns_name_format(name, namebuf, sizeof(namebuf)); + dns_name_format(hashname, hashbuf, sizeof(hashbuf)); + fprintf(stderr, "Missing NSEC3 record for %s (%s)\n", + namebuf, hashbuf); + } else if (result == ISC_R_NOTFOUND && + delegation && (!empty || optout)) + { + result = ISC_R_SUCCESS; + } else if (result == ISC_R_SUCCESS) { + result = match_nsec3(name, mctx, &nsec3param, &rdataset, + types, maxtype, rawhash, rhsize); + } + + if (dns_rdataset_isassociated(&rdataset)) + dns_rdataset_disassociate(&rdataset); + if (node != NULL) + dns_db_detachnode(db, &node); + + return (result); +} + +static isc_result_t +verifynsec3s(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin, + isc_mem_t *mctx, dns_name_t *name, dns_rdataset_t *nsec3paramset, + isc_boolean_t delegation, isc_boolean_t empty, + unsigned char types[8192], unsigned int maxtype) +{ + isc_result_t result; + + for (result = dns_rdataset_first(nsec3paramset); + result == ISC_R_SUCCESS; + result = dns_rdataset_next(nsec3paramset)) { + dns_rdata_t rdata = DNS_RDATA_INIT; + + dns_rdataset_current(nsec3paramset, &rdata); + result = verifynsec3(db, ver, origin, mctx, name, &rdata, + delegation, empty, types, maxtype); + if (result != ISC_R_SUCCESS) + break; + } + if (result == ISC_R_NOMORE) + result = ISC_R_SUCCESS; + return (result); +} + +static void +verifyset(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin, + isc_mem_t *mctx, dns_rdataset_t *rdataset, dns_name_t *name, + dns_dbnode_t *node, dns_rdataset_t *keyrdataset, + unsigned char *act_algorithms, unsigned char *bad_algorithms) +{ + unsigned char set_algorithms[256]; + char namebuf[DNS_NAME_FORMATSIZE]; + char algbuf[80]; + char typebuf[80]; + dns_rdataset_t sigrdataset; + dns_rdatasetiter_t *rdsiter = NULL; + isc_result_t result; + int i; + + dns_rdataset_init(&sigrdataset); + result = dns_db_allrdatasets(db, node, ver, 0, &rdsiter); + check_result(result, "dns_db_allrdatasets()"); + for (result = dns_rdatasetiter_first(rdsiter); + result == ISC_R_SUCCESS; + result = dns_rdatasetiter_next(rdsiter)) { + dns_rdatasetiter_current(rdsiter, &sigrdataset); + if (sigrdataset.type == dns_rdatatype_rrsig && + sigrdataset.covers == rdataset->type) + break; + dns_rdataset_disassociate(&sigrdataset); + } + if (result != ISC_R_SUCCESS) { + dns_name_format(name, namebuf, sizeof(namebuf)); + type_format(rdataset->type, typebuf, sizeof(typebuf)); + fprintf(stderr, "No signatures for %s/%s\n", namebuf, typebuf); + for (i = 0; i < 256; i++) + if (act_algorithms[i] != 0) + bad_algorithms[i] = 1; + dns_rdatasetiter_destroy(&rdsiter); + return; + } + + memset(set_algorithms, 0, sizeof(set_algorithms)); + for (result = dns_rdataset_first(&sigrdataset); + result == ISC_R_SUCCESS; + result = dns_rdataset_next(&sigrdataset)) { + dns_rdata_t rdata = DNS_RDATA_INIT; + dns_rdata_rrsig_t sig; + + dns_rdataset_current(&sigrdataset, &rdata); + result = dns_rdata_tostruct(&rdata, &sig, NULL); + check_result(result, "dns_rdata_tostruct()"); + if (rdataset->ttl != sig.originalttl) { + dns_name_format(name, namebuf, sizeof(namebuf)); + type_format(rdataset->type, typebuf, sizeof(typebuf)); + fprintf(stderr, "TTL mismatch for %s %s keytag %u\n", + namebuf, typebuf, sig.keyid); + continue; + } + if ((set_algorithms[sig.algorithm] != 0) || + (act_algorithms[sig.algorithm] == 0)) + continue; + if (goodsig(origin, &rdata, name, keyrdataset, rdataset, mctx)) + set_algorithms[sig.algorithm] = 1; + } + dns_rdatasetiter_destroy(&rdsiter); + if (memcmp(set_algorithms, act_algorithms, sizeof(set_algorithms))) { + dns_name_format(name, namebuf, sizeof(namebuf)); + type_format(rdataset->type, typebuf, sizeof(typebuf)); + for (i = 0; i < 256; i++) + if ((act_algorithms[i] != 0) && + (set_algorithms[i] == 0)) { + dns_secalg_format(i, algbuf, sizeof(algbuf)); + fprintf(stderr, "No correct %s signature for " + "%s %s\n", algbuf, namebuf, typebuf); + bad_algorithms[i] = 1; + } + } + dns_rdataset_disassociate(&sigrdataset); +} + +static isc_result_t +verifynode(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin, + isc_mem_t *mctx, dns_name_t *name, dns_dbnode_t *node, + isc_boolean_t delegation, dns_rdataset_t *keyrdataset, + unsigned char *act_algorithms, unsigned char *bad_algorithms, + dns_rdataset_t *nsecset, dns_rdataset_t *nsec3paramset, + dns_name_t *nextname) +{ + unsigned char types[8192]; + unsigned int maxtype = 0; + dns_rdataset_t rdataset; dns_rdatasetiter_t *rdsiter = NULL; + isc_result_t result, tresult; + + memset(types, 0, sizeof(types)); + result = dns_db_allrdatasets(db, node, ver, 0, &rdsiter); + check_result(result, "dns_db_allrdatasets()"); + result = dns_rdatasetiter_first(rdsiter); + dns_rdataset_init(&rdataset); + while (result == ISC_R_SUCCESS) { + dns_rdatasetiter_current(rdsiter, &rdataset); + /* + * If we are not at a delegation then everything should be + * signed. If we are at a delegation then only the DS set + * is signed. The NS set is not signed at a delegation but + * its existance is recorded in the bit map. Anything else + * other than NSEC and DS is not signed at a delegation. + */ + if (rdataset.type != dns_rdatatype_rrsig && + rdataset.type != dns_rdatatype_dnskey && + (!delegation || rdataset.type == dns_rdatatype_ds || + rdataset.type == dns_rdatatype_nsec)) { + verifyset(db, ver, origin, mctx, &rdataset, + name, node, keyrdataset, + act_algorithms, bad_algorithms); + dns_nsec_setbit(types, rdataset.type, 1); + if (rdataset.type > maxtype) + maxtype = rdataset.type; + } else if (rdataset.type != dns_rdatatype_rrsig && + rdataset.type != dns_rdatatype_dnskey) { + if (rdataset.type == dns_rdatatype_ns) + dns_nsec_setbit(types, rdataset.type, 1); + check_no_rrsig(db, ver, &rdataset, name, node); + } else + dns_nsec_setbit(types, rdataset.type, 1); + dns_rdataset_disassociate(&rdataset); + result = dns_rdatasetiter_next(rdsiter); + } + if (result != ISC_R_NOMORE) + fatal("rdataset iteration failed: %s", + isc_result_totext(result)); + dns_rdatasetiter_destroy(&rdsiter); + + result = ISC_R_SUCCESS; + + if (nsecset != NULL && dns_rdataset_isassociated(nsecset)) + result = verifynsec(db, ver, name, node, nextname); + + if (nsec3paramset != NULL && dns_rdataset_isassociated(nsec3paramset)) { + tresult = verifynsec3s(db, ver, origin, mctx, name, + nsec3paramset, delegation, ISC_FALSE, + types, maxtype); + if (result == ISC_R_SUCCESS && tresult != ISC_R_SUCCESS) + result = tresult; + } + return (result); +} + +static isc_boolean_t +is_empty(dns_db_t *db, dns_dbversion_t *ver, dns_dbnode_t *node) { + dns_rdatasetiter_t *rdsiter = NULL; + isc_result_t result; + + result = dns_db_allrdatasets(db, node, ver, 0, &rdsiter); + check_result(result, "dns_db_allrdatasets()"); + result = dns_rdatasetiter_first(rdsiter); + dns_rdatasetiter_destroy(&rdsiter); + if (result == ISC_R_NOMORE) + return (ISC_TRUE); + return (ISC_FALSE); +} + +static void +check_no_nsec(dns_name_t *name, dns_dbnode_t *node, dns_db_t *db, + dns_dbversion_t *ver) +{ + dns_rdataset_t rdataset; + isc_result_t result; + + dns_rdataset_init(&rdataset); + result = dns_db_findrdataset(db, node, ver, dns_rdatatype_nsec, + 0, 0, &rdataset, NULL); + if (result != ISC_R_NOTFOUND) { + char namebuf[DNS_NAME_FORMATSIZE]; + dns_name_format(name, namebuf, sizeof(namebuf)); + fatal("unexpected NSEC RRset at %s\n", namebuf); + } + + if (dns_rdataset_isassociated(&rdataset)) + dns_rdataset_disassociate(&rdataset); +} + +static isc_boolean_t +newchain(const struct nsec3_chain_fixed *first, + const struct nsec3_chain_fixed *e) +{ + if (first->hash != e->hash || + first->iterations != e->iterations || + first->salt_length != e->salt_length || + first->next_length != e->next_length || + memcmp(first + 1, e + 1, first->salt_length) != 0) + return (ISC_TRUE); + return (ISC_FALSE); +} + +static void +free_element(isc_mem_t *mctx, struct nsec3_chain_fixed *e) { + size_t len; + + len = sizeof(*e) + e->salt_length + 2 * e->next_length; + isc_mem_put(mctx, e, len); +} + +static isc_boolean_t +checknext(const struct nsec3_chain_fixed *first, + const struct nsec3_chain_fixed *e) +{ + char buf[512]; + const unsigned char *d1 = (const unsigned char *)(first + 1); + const unsigned char *d2 = (const unsigned char *)(e + 1); + isc_buffer_t b; + isc_region_t sr; + + d1 += first->salt_length + first->next_length; + d2 += e->salt_length; + + if (memcmp(d1, d2, first->next_length) == 0) + return (ISC_TRUE); + + DE_CONST(d1 - first->next_length, sr.base); + sr.length = first->next_length; + isc_buffer_init(&b, buf, sizeof(buf)); + isc_base32hex_totext(&sr, 1, "", &b); + fprintf(stderr, "Break in NSEC3 chain at: %.*s\n", + (int) isc_buffer_usedlength(&b), buf); + + DE_CONST(d1, sr.base); + sr.length = first->next_length; + isc_buffer_init(&b, buf, sizeof(buf)); + isc_base32hex_totext(&sr, 1, "", &b); + fprintf(stderr, "Expected: %.*s\n", (int) isc_buffer_usedlength(&b), + buf); + + DE_CONST(d2, sr.base); + sr.length = first->next_length; + isc_buffer_init(&b, buf, sizeof(buf)); + isc_base32hex_totext(&sr, 1, "", &b); + fprintf(stderr, "Found: %.*s\n", (int) isc_buffer_usedlength(&b), buf); + + return (ISC_FALSE); +} + +#define EXPECTEDANDFOUND "Expected and found NSEC3 chains not equal\n" + +static isc_result_t +verify_nsec3_chains(isc_mem_t *mctx) { + isc_result_t result = ISC_R_SUCCESS; + struct nsec3_chain_fixed *e, *f = NULL; + struct nsec3_chain_fixed *first = NULL, *prev = NULL; + + while ((e = isc_heap_element(expected_chains, 1)) != NULL) { + isc_heap_delete(expected_chains, 1); + if (f == NULL) + f = isc_heap_element(found_chains, 1); + if (f != NULL) { + isc_heap_delete(found_chains, 1); + + /* + * Check that they match. + */ + if (chain_equal(e, f)) { + free_element(mctx, f); + f = NULL; + } else { + if (result == ISC_R_SUCCESS) + fprintf(stderr, EXPECTEDANDFOUND); + result = ISC_R_FAILURE; + /* + * Attempt to resync found_chain. + */ + while (f != NULL && !chain_compare(e, f)) { + free_element(mctx, f); + f = isc_heap_element(found_chains, 1); + if (f != NULL) + isc_heap_delete(found_chains, 1); + if (f != NULL && chain_equal(e, f)) { + free_element(mctx, f); + f = NULL; + break; + } + } + } + } else if (result == ISC_R_SUCCESS) { + fprintf(stderr, EXPECTEDANDFOUND); + result = ISC_R_FAILURE; + } + if (first == NULL || newchain(first, e)) { + if (prev != NULL) { + if (!checknext(prev, first)) + result = ISC_R_FAILURE; + if (prev != first) + free_element(mctx, prev); + } + if (first != NULL) + free_element(mctx, first); + prev = first = e; + continue; + } + if (!checknext(prev, e)) + result = ISC_R_FAILURE; + if (prev != first) + free_element(mctx, prev); + prev = e; + } + if (prev != NULL) { + if (!checknext(prev, first)) + result = ISC_R_FAILURE; + if (prev != first) + free_element(mctx, prev); + } + if (first != NULL) + free_element(mctx, first); + do { + if (f != NULL) { + if (result == ISC_R_SUCCESS) { + fprintf(stderr, EXPECTEDANDFOUND); + result = ISC_R_FAILURE; + } + free_element(mctx, f); + } + f = isc_heap_element(found_chains, 1); + if (f != NULL) + isc_heap_delete(found_chains, 1); + } while (f != NULL); + + return (result); +} + +static isc_result_t +verifyemptynodes(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin, + isc_mem_t *mctx, dns_name_t *name, dns_name_t *prevname, + isc_boolean_t isdelegation, dns_rdataset_t *nsec3paramset) +{ + dns_namereln_t reln; + int order; + unsigned int labels, nlabels, i; + dns_name_t suffix; + isc_result_t result = ISC_R_SUCCESS, tresult; + + reln = dns_name_fullcompare(prevname, name, &order, &labels); + if (order >= 0) + return (result); + + nlabels = dns_name_countlabels(name); + + if (reln == dns_namereln_commonancestor || + reln == dns_namereln_contains) { + dns_name_init(&suffix, NULL); + for (i = labels + 1; i < nlabels; i++) { + dns_name_getlabelsequence(name, nlabels - i, i, + &suffix); + if (nsec3paramset != NULL && + dns_rdataset_isassociated(nsec3paramset)) { + tresult = verifynsec3s(db, ver, origin, mctx, + &suffix, nsec3paramset, + isdelegation, ISC_TRUE, + NULL, 0); + if (result == ISC_R_SUCCESS && + tresult != ISC_R_SUCCESS) + result = tresult; + } + } + } + return (result); +} + +/*% + * Verify that certain things are sane: + * + * The apex has a DNSKEY record with at least one KSK, and at least + * one ZSK if the -x flag was not used. + * + * The DNSKEY record was signed with at least one of the KSKs in this + * set. + * + * The rest of the zone was signed with at least one of the ZSKs + * present in the DNSKEY RRSET. + */ +void +verifyzone(dns_db_t *db, dns_dbversion_t *ver, + dns_name_t *origin, isc_mem_t *mctx, + isc_boolean_t ignore_kskflag, isc_boolean_t keyset_kskonly) +{ + char algbuf[80]; + dns_dbiterator_t *dbiter = NULL; + dns_dbnode_t *node = NULL, *nextnode = NULL; + dns_fixedname_t fname, fnextname, fprevname, fzonecut; + dns_name_t *name, *nextname, *prevname, *zonecut; + dns_rdata_dnskey_t dnskey; + dns_rdata_t rdata = DNS_RDATA_INIT; + dns_rdataset_t keyset, soaset; + dns_rdataset_t keysigs, soasigs; + dns_rdataset_t nsecset, nsecsigs; + dns_rdataset_t nsec3paramset, nsec3paramsigs; + int i; + isc_boolean_t done = ISC_FALSE; + isc_boolean_t first = ISC_TRUE; + isc_boolean_t goodksk = ISC_FALSE; + isc_boolean_t goodzsk = ISC_FALSE; + isc_result_t result, vresult = ISC_R_UNSET; + unsigned char revoked_ksk[256]; + unsigned char revoked_zsk[256]; + unsigned char standby_ksk[256]; + unsigned char standby_zsk[256]; + unsigned char ksk_algorithms[256]; + unsigned char zsk_algorithms[256]; + unsigned char bad_algorithms[256]; + unsigned char act_algorithms[256]; + + result = isc_heap_create(mctx, chain_compare, NULL, 1024, + &expected_chains); + check_result(result, "isc_heap_create()"); + result = isc_heap_create(mctx, chain_compare, NULL, 1024, + &found_chains); + check_result(result, "isc_heap_create()"); + + result = dns_db_findnode(db, origin, ISC_FALSE, &node); + if (result != ISC_R_SUCCESS) + fatal("failed to find the zone's origin: %s", + isc_result_totext(result)); + + dns_rdataset_init(&keyset); + dns_rdataset_init(&keysigs); + dns_rdataset_init(&soaset); + dns_rdataset_init(&soasigs); + dns_rdataset_init(&nsecset); + dns_rdataset_init(&nsecsigs); + dns_rdataset_init(&nsec3paramset); + dns_rdataset_init(&nsec3paramsigs); + result = dns_db_findrdataset(db, node, ver, dns_rdatatype_dnskey, + 0, 0, &keyset, &keysigs); + if (result != ISC_R_SUCCESS) + fatal("Zone contains no DNSSEC keys\n"); + + result = dns_db_findrdataset(db, node, ver, dns_rdatatype_soa, + 0, 0, &soaset, &soasigs); + if (result != ISC_R_SUCCESS) + fatal("Zone contains no SOA record\n"); + + result = dns_db_findrdataset(db, node, ver, dns_rdatatype_nsec, + 0, 0, &nsecset, &nsecsigs); + if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) + fatal("NSEC lookup failed\n"); + + result = dns_db_findrdataset(db, node, ver, dns_rdatatype_nsec3param, + 0, 0, &nsec3paramset, &nsec3paramsigs); + if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) + fatal("NSEC3PARAM lookup failed\n"); + + if (!dns_rdataset_isassociated(&keysigs)) + fatal("DNSKEY is not signed (keys offline or inactive?)\n"); + + if (!dns_rdataset_isassociated(&soasigs)) + fatal("SOA is not signed (keys offline or inactive?)\n"); + + if (dns_rdataset_isassociated(&nsecset) && + !dns_rdataset_isassociated(&nsecsigs)) + fatal("NSEC is not signed (keys offline or inactive?)\n"); + + if (dns_rdataset_isassociated(&nsec3paramset) && + !dns_rdataset_isassociated(&nsec3paramsigs)) + fatal("NSEC3PARAM is not signed (keys offline or inactive?)\n"); + + if (!dns_rdataset_isassociated(&nsecset) && + !dns_rdataset_isassociated(&nsec3paramset)) + fatal("No valid NSEC/NSEC3 chain for testing\n"); + + dns_db_detachnode(db, &node); + + memset(revoked_ksk, 0, sizeof(revoked_ksk)); + memset(revoked_zsk, 0, sizeof(revoked_zsk)); + memset(standby_ksk, 0, sizeof(standby_ksk)); + memset(standby_zsk, 0, sizeof(standby_zsk)); + memset(ksk_algorithms, 0, sizeof(ksk_algorithms)); + memset(zsk_algorithms, 0, sizeof(zsk_algorithms)); + memset(bad_algorithms, 0, sizeof(bad_algorithms)); + memset(act_algorithms, 0, sizeof(act_algorithms)); + + /* + * Check that the DNSKEY RR has at least one self signing KSK + * and one ZSK per algorithm in it (or, if -x was used, one + * self-signing KSK). + */ + for (result = dns_rdataset_first(&keyset); + result == ISC_R_SUCCESS; + result = dns_rdataset_next(&keyset)) { + dns_rdataset_current(&keyset, &rdata); + result = dns_rdata_tostruct(&rdata, &dnskey, NULL); + check_result(result, "dns_rdata_tostruct"); + + if ((dnskey.flags & DNS_KEYOWNER_ZONE) == 0) + ; + else if ((dnskey.flags & DNS_KEYFLAG_REVOKE) != 0) { + if ((dnskey.flags & DNS_KEYFLAG_KSK) != 0 && + !dns_dnssec_selfsigns(&rdata, origin, &keyset, + &keysigs, ISC_FALSE, + mctx)) { + char namebuf[DNS_NAME_FORMATSIZE]; + char buffer[1024]; + isc_buffer_t buf; + + dns_name_format(origin, namebuf, + sizeof(namebuf)); + isc_buffer_init(&buf, buffer, sizeof(buffer)); + result = dns_rdata_totext(&rdata, NULL, &buf); + check_result(result, "dns_rdata_totext"); + fatal("revoked KSK is not self signed:\n" + "%s DNSKEY %.*s", namebuf, + (int)isc_buffer_usedlength(&buf), buffer); + } + if ((dnskey.flags & DNS_KEYFLAG_KSK) != 0 && + revoked_ksk[dnskey.algorithm] != 255) + revoked_ksk[dnskey.algorithm]++; + else if ((dnskey.flags & DNS_KEYFLAG_KSK) == 0 && + revoked_zsk[dnskey.algorithm] != 255) + revoked_zsk[dnskey.algorithm]++; + } else if ((dnskey.flags & DNS_KEYFLAG_KSK) != 0) { + if (dns_dnssec_selfsigns(&rdata, origin, &keyset, + &keysigs, ISC_FALSE, mctx)) { + if (ksk_algorithms[dnskey.algorithm] != 255) + ksk_algorithms[dnskey.algorithm]++; + goodksk = ISC_TRUE; + } else { + if (standby_ksk[dnskey.algorithm] != 255) + standby_ksk[dnskey.algorithm]++; + } + } else if (dns_dnssec_selfsigns(&rdata, origin, &keyset, + &keysigs, ISC_FALSE, mctx)) { + if (zsk_algorithms[dnskey.algorithm] != 255) + zsk_algorithms[dnskey.algorithm]++; + goodzsk = ISC_TRUE; + } else if (dns_dnssec_signs(&rdata, origin, &soaset, + &soasigs, ISC_FALSE, mctx)) { + if (zsk_algorithms[dnskey.algorithm] != 255) + zsk_algorithms[dnskey.algorithm]++; + } else { + if (standby_zsk[dnskey.algorithm] != 255) + standby_zsk[dnskey.algorithm]++; + } + dns_rdata_freestruct(&dnskey); + dns_rdata_reset(&rdata); + } + dns_rdataset_disassociate(&keysigs); + dns_rdataset_disassociate(&soaset); + dns_rdataset_disassociate(&soasigs); + if (dns_rdataset_isassociated(&nsecsigs)) + dns_rdataset_disassociate(&nsecsigs); + if (dns_rdataset_isassociated(&nsec3paramsigs)) + dns_rdataset_disassociate(&nsec3paramsigs); + + if (ignore_kskflag ) { + if (!goodksk && !goodzsk) + fatal("No self-signed DNSKEY found."); + } else if (!goodksk) + fatal("No self-signed KSK DNSKEY found. Supply an active\n" + "key with the KSK flag set, or use '-P'."); + + fprintf(stderr, "Verifying the zone using the following algorithms:"); + for (i = 0; i < 256; i++) { + if (ignore_kskflag) + act_algorithms[i] = (ksk_algorithms[i] != 0 || + zsk_algorithms[i] != 0) ? 1 : 0; + else + act_algorithms[i] = ksk_algorithms[i] != 0 ? 1 : 0; + if (act_algorithms[i] != 0) { + dns_secalg_format(i, algbuf, sizeof(algbuf)); + fprintf(stderr, " %s", algbuf); + } + } + fprintf(stderr, ".\n"); + + if (!ignore_kskflag && !keyset_kskonly) { + for (i = 0; i < 256; i++) { + /* + * The counts should both be zero or both be non-zero. + * Mark the algorithm as bad if this is not met. + */ + if ((ksk_algorithms[i] != 0) == + (zsk_algorithms[i] != 0)) + continue; + dns_secalg_format(i, algbuf, sizeof(algbuf)); + fprintf(stderr, "Missing %s for algorithm %s\n", + (ksk_algorithms[i] != 0) + ? "ZSK" + : "self-signed KSK", + algbuf); + bad_algorithms[i] = 1; + } + } + + /* + * Check that all the other records were signed by keys that are + * present in the DNSKEY RRSET. + */ + + dns_fixedname_init(&fname); + name = dns_fixedname_name(&fname); + dns_fixedname_init(&fnextname); + nextname = dns_fixedname_name(&fnextname); + dns_fixedname_init(&fprevname); + prevname = NULL; + dns_fixedname_init(&fzonecut); + zonecut = NULL; + + result = dns_db_createiterator(db, DNS_DB_NONSEC3, &dbiter); + check_result(result, "dns_db_createiterator()"); + + result = dns_dbiterator_first(dbiter); + check_result(result, "dns_dbiterator_first()"); + + while (!done) { + isc_boolean_t isdelegation = ISC_FALSE; + + result = dns_dbiterator_current(dbiter, &node, name); + check_dns_dbiterator_current(result); + if (!dns_name_issubdomain(name, origin)) { + check_no_nsec(name, node, db, ver); + dns_db_detachnode(db, &node); + result = dns_dbiterator_next(dbiter); + if (result == ISC_R_NOMORE) + done = ISC_TRUE; + else + check_result(result, "dns_dbiterator_next()"); + continue; + } + if (is_delegation(db, ver, origin, name, node, NULL)) { + zonecut = dns_fixedname_name(&fzonecut); + dns_name_copy(name, zonecut, NULL); + isdelegation = ISC_TRUE; + } + nextnode = NULL; + result = dns_dbiterator_next(dbiter); + while (result == ISC_R_SUCCESS) { + result = dns_dbiterator_current(dbiter, &nextnode, + nextname); + check_dns_dbiterator_current(result); + if (!dns_name_issubdomain(nextname, origin) || + (zonecut != NULL && + dns_name_issubdomain(nextname, zonecut))) + { + check_no_nsec(nextname, nextnode, db, ver); + dns_db_detachnode(db, &nextnode); + result = dns_dbiterator_next(dbiter); + continue; + } + if (is_empty(db, ver, nextnode)) { + dns_db_detachnode(db, &nextnode); + result = dns_dbiterator_next(dbiter); + continue; + } + dns_db_detachnode(db, &nextnode); + break; + } + if (result == ISC_R_NOMORE) { + done = ISC_TRUE; + nextname = origin; + } else if (result != ISC_R_SUCCESS) + fatal("iterating through the database failed: %s", + isc_result_totext(result)); + result = verifynode(db, ver, origin, mctx, name, node, + isdelegation, &keyset, act_algorithms, + bad_algorithms, &nsecset, &nsec3paramset, + nextname); + if (vresult == ISC_R_UNSET) + vresult = ISC_R_SUCCESS; + if (vresult == ISC_R_SUCCESS && result != ISC_R_SUCCESS) + vresult = result; + if (prevname != NULL) { + result = verifyemptynodes(db, ver, origin, mctx, name, + prevname, isdelegation, + &nsec3paramset); + } else + prevname = dns_fixedname_name(&fprevname); + dns_name_copy(name, prevname, NULL); + if (vresult == ISC_R_SUCCESS && result != ISC_R_SUCCESS) + vresult = result; + dns_db_detachnode(db, &node); + } + + dns_dbiterator_destroy(&dbiter); + + result = dns_db_createiterator(db, DNS_DB_NSEC3ONLY, &dbiter); + check_result(result, "dns_db_createiterator()"); + + for (result = dns_dbiterator_first(dbiter); + result == ISC_R_SUCCESS; + result = dns_dbiterator_next(dbiter) ) { + result = dns_dbiterator_current(dbiter, &node, name); + check_dns_dbiterator_current(result); + result = verifynode(db, ver, origin, mctx, name, node, + ISC_FALSE, &keyset, act_algorithms, + bad_algorithms, NULL, NULL, NULL); + check_result(result, "verifynode"); + record_found(db, ver, mctx, name, node, &nsec3paramset); + dns_db_detachnode(db, &node); + } + dns_dbiterator_destroy(&dbiter); + + dns_rdataset_disassociate(&keyset); + if (dns_rdataset_isassociated(&nsecset)) + dns_rdataset_disassociate(&nsecset); + if (dns_rdataset_isassociated(&nsec3paramset)) + dns_rdataset_disassociate(&nsec3paramset); + + result = verify_nsec3_chains(mctx); + if (vresult == ISC_R_UNSET) + vresult = ISC_R_SUCCESS; + if (result != ISC_R_SUCCESS && vresult == ISC_R_SUCCESS) + vresult = result; + isc_heap_destroy(&expected_chains); + isc_heap_destroy(&found_chains); + + /* + * If we made it this far, we have what we consider a properly signed + * zone. Set the good flag. + */ + for (i = 0; i < 256; i++) { + if (bad_algorithms[i] != 0) { + if (first) + fprintf(stderr, "The zone is not fully signed " + "for the following algorithms:"); + dns_secalg_format(i, algbuf, sizeof(algbuf)); + fprintf(stderr, " %s", algbuf); + first = ISC_FALSE; + } + } + if (!first) { + fprintf(stderr, ".\n"); + fatal("DNSSEC completeness test failed."); + } + + if (vresult != ISC_R_SUCCESS) + fatal("DNSSEC completeness test failed (%s).", + dns_result_totext(vresult)); + + if (goodksk || ignore_kskflag) { + /* + * Print the success summary. + */ + fprintf(stderr, "Zone fully signed:\n"); + for (i = 0; i < 256; i++) { + if ((ksk_algorithms[i] != 0) || + (standby_ksk[i] != 0) || + (revoked_zsk[i] != 0) || + (zsk_algorithms[i] != 0) || + (standby_zsk[i] != 0) || + (revoked_zsk[i] != 0)) { + dns_secalg_format(i, algbuf, sizeof(algbuf)); + fprintf(stderr, "Algorithm: %s: KSKs: " + "%u active, %u stand-by, %u revoked\n", + algbuf, ksk_algorithms[i], + standby_ksk[i], revoked_ksk[i]); + fprintf(stderr, "%*sZSKs: " + "%u active, %u %s, %u revoked\n", + (int) strlen(algbuf) + 13, "", + zsk_algorithms[i], + standby_zsk[i], + keyset_kskonly ? "present" : "stand-by", + revoked_zsk[i]); + } + } + } +} diff --git a/bin/dnssec/dnssectool.h b/bin/dnssec/dnssectool.h index e6dfe51..09b4fb1 100644 --- a/bin/dnssec/dnssectool.h +++ b/bin/dnssec/dnssectool.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2007-2011 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007-2012 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001, 2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dnssectool.h,v 1.31.162.2 2011/10/20 23:46:27 tbox Exp $ */ +/* $Id: dnssectool.h,v 1.33 2011/10/20 23:46:51 tbox Exp $ */ #ifndef DNSSECTOOL_H #define DNSSECTOOL_H 1 @@ -25,6 +25,11 @@ #include <dns/rdatastruct.h> #include <dst/dst.h> +#define check_dns_dbiterator_current(result) \ + check_result((result == DNS_R_NEWORIGIN) ? ISC_R_SUCCESS : result, \ + "dns_dbiterator_current()") + + typedef void (fatalcallback_t)(void); ISC_PLATFORM_NORETURN_PRE void @@ -81,4 +86,12 @@ isc_boolean_t key_collision(dst_key_t *key, dns_name_t *name, const char *dir, isc_mem_t *mctx, isc_boolean_t *exact); +isc_boolean_t +is_delegation(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin, + dns_name_t *name, dns_dbnode_t *node, isc_uint32_t *ttlp); + +void +verifyzone(dns_db_t *db, dns_dbversion_t *ver, + dns_name_t *origin, isc_mem_t *mctx, + isc_boolean_t ignore_kskflag, isc_boolean_t keyset_kskonly); #endif /* DNSSEC_DNSSECTOOL_H */ diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in index e3ce3bd..6894135 100644 --- a/bin/named/Makefile.in +++ b/bin/named/Makefile.in @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: Makefile.in,v 1.114.14.2 2011/03/10 23:47:25 tbox Exp $ +# $Id: Makefile.in,v 1.116 2011/03/10 23:47:49 tbox Exp $ srcdir = @srcdir@ VPATH = @srcdir@ @@ -161,8 +161,11 @@ maintainer-clean:: bind9.xsl.h: bind9.xsl ${srcdir}/convertxsl.pl ${PERL} ${srcdir}/convertxsl.pl < ${srcdir}/bind9.xsl > bind9.xsl.h -depend: bind9.xsl.h -statschannel.@O@: bind9.xsl.h +bind9.ver3.xsl.h: bind9.ver3.xsl ${srcdir}/convertxsl.pl + ${PERL} ${srcdir}/convertxsl.pl < ${srcdir}/bind9.ver3.xsl > bind9.ver3.xsl.h + +depend: bind9.xsl.h bind9.ver3.xsl.h +statschannel.@O@: bind9.xsl.h bind9.ver3.xsl.h installdirs: $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir} diff --git a/bin/named/bind9.ver3.xsl b/bin/named/bind9.ver3.xsl new file mode 100644 index 0000000..22e5c45 --- /dev/null +++ b/bin/named/bind9.ver3.xsl @@ -0,0 +1,738 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!-- + - Copyright (C) 2012, 2013 Internet Systems Consortium, Inc. ("ISC") + - + - Permission to use, copy, modify, and/or distribute this software for any + - purpose with or without fee is hereby granted, provided that the above + - copyright notice and this permission notice appear in all copies. + - + - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + - PERFORMANCE OF THIS SOFTWARE. +--> + +<!-- $Id$ --> + +<!-- %Id: bind9.xsl,v 1.21 2009/01/27 23:47:54 tbox Exp % --> +<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns="http://www.w3.org/1999/xhtml" version="1.0"> + <xsl:output method="html" indent="yes" version="4.0"/> + <xsl:template match="statistics[@version="3.0"]"> + <html> + <head> + <xsl:if test="system-property('xsl:vendor')!='Transformiix'"> + <!-- Non Mozilla specific markup --> + <script type="text/javascript" src="https://www.google.com/jsapi"/> + <script type="text/javascript"> + + google.load("visualization", "1", {packages:["corechart"]}); + google.setOnLoadCallback(loadGraphs); + + var graphs=[]; + + function drawChart(chart_title,target,data) { + var data = google.visualization.arrayToDataTable(data); + + var options = { + title: chart_title + }; + + var chart = new google.visualization.BarChart(document.getElementById(target)); + chart.draw(data, options); + } + + function loadGraphs(){ + //alert("here we are!"); + var g; + + // Server Incoming query Types + while(g = graphs.shift()){ + // alert("going for: " + g.target); + if(g.data.length > 1){ + drawChart(g.title,g.target,g.data); + } + } + } + + // Server Incoming Queries Types + graphs.push({ + 'title' : "Server Incoming Query Types", + 'target': 'chart_incoming_qtypes', + 'data': [['Type','Counter'],<xsl:for-each select="server/counters[@type="qtype"]/counter">['<xsl:value-of select="@name"/>',<xsl:value-of select="."/>],</xsl:for-each>] + }); + + + // Server Incoming Requests + graphs.push({ + 'title' : "Server Incoming Requests", + 'target': 'chart_incoming_requests', + 'data': [['Requests','Counter'],<xsl:for-each select="server/counters[@type="opcode"]/counter">['<xsl:value-of select="@name"/>',<xsl:value-of select="."/>],</xsl:for-each>]}); + + + + + </script> + </xsl:if> + <style type="text/css"> + body { + font-family: sans-serif; + background-color: #ffffff; + color: #000000; + font-size: 10pt; + } + + .odd{ + background-color: #f0f0f0; + } + + .even{ + background-color: #ffffff; + } + + p.footer{ + font-style:italic; + color: grey; + } + + table { + border-collapse: collapse; + border: 1px solid grey; + } + + table.counters{ + border: 1px solid grey; + width: 500px; + } + + table.counters th { + text-align: center; + border: 1px solid grey; + width: 120px; + } + table.counters td{ + text-align:center; + + } + + table.counters tr:hover{ + background-color: #99ddff; + } + + .totals { + background-color: rgb(1,169,206); + color: #ffffff; + } + + td, th { + padding-right: 5px; + padding-left: 5px; + border: 1px solid grey; + } + + .header h1 { + color: rgb(1,169,206); + padding: 0px; + } + + .content { + background-color: #ffffff; + color: #000000; + padding: 4px; + } + + .item { + padding: 4px; + text-align: right; + } + + .value { + padding: 4px; + font-weight: bold; + } + + + h2 { + color: grey; + font-size: 14pt; + width:500px; + text-align:center; + } + + h3 { + color: #444444; + font-size: 12pt; + width:500px; + text-align:center; + + } + h4 { + color: rgb(1,169,206); + font-size: 10pt; + width:500px; + text-align:center; + + } + + .pie { + width:500px; + height: 500px; + } + + </style> + <title>ISC BIND 9 Statistics</title> + </head> + <body> + <div class="header"> + <h1>ISC Bind 9 Configuration and Statistics</h1> + </div> + <hr/> + <h2>Server Times</h2> + <table class="counters"> + <tr> + <th>Boot time:</th> + <td> + <xsl:value-of select="server/boot-time"/> + </td> + </tr> + <tr> + <th>Sample time:</th> + <td> + <xsl:value-of select="server/current-time"/> + </td> + </tr> + </table> + <br/> + <h2>Incoming Requests</h2> + <xsl:if test="system-property('xsl:vendor')!='Transformiix'"> + <!-- Non Mozilla specific markup --> + <div class="pie" id="chart_incoming_requests">[no incoming requests]</div> + </xsl:if> + <table class="counters"> + <xsl:for-each select="server/counters[@type="opcode"]/counter"> + <xsl:sort select="." data-type="number" order="descending"/> + <tr> + <th> + <xsl:value-of select="@name"/> + </th> + <td> + <xsl:value-of select="."/> + </td> + </tr> + </xsl:for-each> + <tr> + <th class="totals">Total:</th> + <td class="totals"> + <xsl:value-of select="sum(server/counters[@type="opcode"]/counter)"/> + </td> + </tr> + </table> + <br/> + <h3>Incoming Queries by Type</h3> + <xsl:if test="system-property('xsl:vendor')!='Transformiix'"> + <!-- Non Mozilla specific markup --> + <div class="pie" id="chart_incoming_qtypes">[no incoming queries]</div> + </xsl:if> + <table class="counters"> + <xsl:for-each select="server/counters[@type="qtype"]/counter"> + <xsl:sort select="." data-type="number" order="descending"/> + <xsl:variable name="css-class"> + <xsl:choose> + <xsl:when test="position() mod 2 = 0">even</xsl:when> + <xsl:otherwise>odd</xsl:otherwise> + </xsl:choose> + </xsl:variable> + <tr class="{$css-class}"> + <th> + <xsl:value-of select="@name"/> + </th> + <td> + <xsl:value-of select="."/> + </td> + </tr> + </xsl:for-each> + <tr> + <th class="totals">Total:</th> + <td class="totals"> + <xsl:value-of select="sum(server/counters[@type="qtype"]/counter)"/> + </td> + </tr> + </table> + <br/> + <h2>Outgoing Queries per view</h2> + <xsl:for-each select="views/view[count(counters[@type="resqtype"]/counter) > 0]"> + <h3>View <xsl:value-of select="@name"/></h3> + <xsl:if test="system-property('xsl:vendor')!='Transformiix'"> + <!-- Non Mozilla specific markup --> + <script type="text/javascript"> + graphs.push({ + 'title': "Outgoing queries for view: <xsl:value-of select="@name"/>", + 'target': 'chart_outgoing_queries_view_<xsl:value-of select="@name"/>', + 'data': [['Type','Counter'],<xsl:for-each select="counters[@type="resqtype"]/counter">['<xsl:value-of select="@name"/>',<xsl:value-of select="."/>],</xsl:for-each>] + }); + + </script> + <xsl:variable name="target"> + <xsl:value-of select="@name"/> + </xsl:variable> + <div class="pie" id="chart_outgoing_queries_view_{$target}"/> + </xsl:if> + <table class="counters"> + <xsl:for-each select="counters[@type="resqtype"]/counter"> + <xsl:sort select="." data-type="number" order="descending"/> + <xsl:variable name="css-class1"> + <xsl:choose> + <xsl:when test="position() mod 2 = 0">even</xsl:when> + <xsl:otherwise>odd</xsl:otherwise> + </xsl:choose> + </xsl:variable> + <tr class="{$css-class1}"> + <th> + <xsl:value-of select="@name"/> + </th> + <td> + <xsl:value-of select="."/> + </td> + </tr> + </xsl:for-each> + </table> + <br/> + </xsl:for-each> + <h2>Server Statistics</h2> + <xsl:if test="system-property('xsl:vendor')!='Transformiix'"> + <!-- Non Mozilla specific markup --> + <script type="text/javascript"> + graphs.push({ + 'title' : "Server Counters", + 'target': 'chart_server_nsstat_restype', + 'data': [['Type','Counter'],<xsl:for-each select="server/counters[@type="nsstat"]/counter[.>0]">['<xsl:value-of select="@name"/>',<xsl:value-of select="."/>],</xsl:for-each>] + }); + + </script> + <div class="pie" id="chart_server_nsstat_restype"/> + </xsl:if> + <table class="counters"> + <xsl:for-each select="server/counters[@type="nsstat"]/counter[.>0]"> + <xsl:sort select="." data-type="number" order="descending"/> + <xsl:variable name="css-class2"> + <xsl:choose> + <xsl:when test="position() mod 2 = 0">even</xsl:when> + <xsl:otherwise>odd</xsl:otherwise> + </xsl:choose> + </xsl:variable> + <tr class="{$css-class2}"> + <th> + <xsl:value-of select="@name"/> + </th> + <td> + <xsl:value-of select="."/> + </td> + </tr> + </xsl:for-each> + </table> + <br/> + <h2>Zone Maintenance Statistics</h2> + <xsl:if test="system-property('xsl:vendor')!='Transformiix'"> + <script type="text/javascript"> + graphs.push({ + 'title' : "Zone Maintenance Stats", + 'target': 'chart_server_zone_maint', + 'data': [['Type','Counter'],<xsl:for-each select="server/counters[@type="zonestat"]/counter">['<xsl:value-of select="@name"/>',<xsl:value-of select="."/>],</xsl:for-each>] + }); + + </script> + <!-- Non Mozilla specific markup --> + <div class="pie" id="chart_server_zone_maint"/> + </xsl:if> + <table class="counters"> + <xsl:for-each select="server/counters[@type="zonestat"]/counter"> + <xsl:sort select="." data-type="number" order="descending"/> + <xsl:variable name="css-class3"> + <xsl:choose> + <xsl:when test="position() mod 2 = 0">even</xsl:when> + <xsl:otherwise>odd</xsl:otherwise> + </xsl:choose> + </xsl:variable> + <tr class="{$css-class3}"> + <th> + <xsl:value-of select="@name"/> + </th> + <td> + <xsl:value-of select="."/> + </td> + </tr> + </xsl:for-each> + </table> + <h2>Resolver Statistics (Common)</h2> + <table class="counters"> + <xsl:for-each select="server/counters[@type="restat"]/counter"> + <xsl:sort select="." data-type="number" order="descending"/> + <xsl:variable name="css-class4"> + <xsl:choose> + <xsl:when test="position() mod 2 = 0">even</xsl:when> + <xsl:otherwise>odd</xsl:otherwise> + </xsl:choose> + </xsl:variable> + <tr class="{$css-class4}"> + <th> + <xsl:value-of select="@name"/> + </th> + <td> + <xsl:value-of select="."/> + </td> + </tr> + </xsl:for-each> + </table> + <xsl:for-each select="views/view"> + <h3>Resolver Statistics for View <xsl:value-of select="@name"/></h3> + <table class="counters"> + <xsl:for-each select="counters[@type="resstats"]/counter[.>0]"> + <xsl:sort select="." data-type="number" order="descending"/> + <xsl:variable name="css-class5"> + <xsl:choose> + <xsl:when test="position() mod 2 = 0">even</xsl:when> + <xsl:otherwise>odd</xsl:otherwise> + </xsl:choose> + </xsl:variable> + <tr class="{$css-class5}"> + <th> + <xsl:value-of select="@name"/> + </th> + <td> + <xsl:value-of select="."/> + </td> + </tr> + </xsl:for-each> + </table> + </xsl:for-each> + <h3>Cache DB RRsets for View <xsl:value-of select="@name"/></h3> + <xsl:for-each select="views/view"> + <table class="counters"> + <xsl:for-each select="cache/rrset"> + <xsl:variable name="css-class6"> + <xsl:choose> + <xsl:when test="position() mod 2 = 0">even</xsl:when> + <xsl:otherwise>odd</xsl:otherwise> + </xsl:choose> + </xsl:variable> + <tr class="{$css-class6}"> + <th> + <xsl:value-of select="name"/> + </th> + <td> + <xsl:value-of select="counter"/> + </td> + </tr> + </xsl:for-each> + </table> + <br/> + </xsl:for-each> + <h2>Socket I/O Statistics</h2> + <table class="counters"> + <xsl:for-each select="server/counters[@type="sockstat"]/counter[.>0]"> + <xsl:variable name="css-class7"> + <xsl:choose> + <xsl:when test="position() mod 2 = 0">even</xsl:when> + <xsl:otherwise>odd</xsl:otherwise> + </xsl:choose> + </xsl:variable> + <tr class="{$css-class7}"> + <th> + <xsl:value-of select="@name"/> + </th> + <td> + <xsl:value-of select="."/> + </td> + </tr> + </xsl:for-each> + </table> + <br/> + <br/> + <h2>Response Codes per view/zone</h2> + <xsl:for-each select="views/view[zones/zone/counters[@type="rcode"]/counter >0]"> + <h3>View <xsl:value-of select="@name"/></h3> + <xsl:variable name="thisview"> + <xsl:value-of select="@name"/> + </xsl:variable> + <xsl:for-each select="zones/zone"> + <xsl:if test="counters[@type="rcode"]/counter[. > 0]"> + <h4>Zone <xsl:value-of select="@name"/></h4> + <xsl:if test="system-property('xsl:vendor')!='Transformiix'"> + <!-- Non Mozilla specific markup --> + <script type="text/javascript"> + graphs.push({ + 'title': "Response Codes for zone <xsl:value-of select="@name"/>", + 'target': 'chart_rescode_<xsl:value-of select="../../@name"/>_<xsl:value-of select="@name"/>', + 'data': [['Type','Counter'],<xsl:for-each select="counters[@type="rcode"]/counter[.>0 and @name != "QryAuthAns"]">['<xsl:value-of select="@name"/>',<xsl:value-of select="."/>],</xsl:for-each>] + }); + + </script> + <xsl:variable name="target"> + <xsl:value-of select="@name"/> + </xsl:variable> + <div class="pie" id="chart_rescode_{$thisview}_{$target}"/> + </xsl:if> + <table class="counters"> + <xsl:for-each select="counters[@type="rcode"]/counter[.>0 and @name != "QryAuthAns"]"> + <xsl:sort select="."/> + <xsl:variable name="css-class10"> + <xsl:choose> + <xsl:when test="position() mod 2 = 0">even</xsl:when> + <xsl:otherwise>odd</xsl:otherwise> + </xsl:choose> + </xsl:variable> + <tr class="{$css-class10}"> + <th> + <xsl:value-of select="@name"/> + </th> + <td> + <xsl:value-of select="."/> + </td> + </tr> + </xsl:for-each> + </table> + </xsl:if> + </xsl:for-each> + </xsl:for-each> + <h2>Received QTYPES per view/zone</h2> + <xsl:for-each select="views/view[zones/zone/counters[@type="qtype"]/counter >0]"> + <h3>View <xsl:value-of select="@name"/></h3> + <xsl:variable name="thisview2"> + <xsl:value-of select="@name"/> + </xsl:variable> + <xsl:for-each select="zones/zone"> + <xsl:if test="counters[@type="qtype"]/counter[count(.) > 0]"> + <h4>Zone <xsl:value-of select="@name"/></h4> + <xsl:if test="system-property('xsl:vendor')!='Transformiix'"> + <!-- Non Mozilla specific markup --> + <script type="text/javascript"> + graphs.push({ + 'title': "Query Types for zone <xsl:value-of select="@name"/>", + 'target': 'chart_qtype_<xsl:value-of select="../../@name"/>_<xsl:value-of select="@name"/>', + 'data': [['Type','Counter'],<xsl:for-each select="counters[@type="qtype"]/counter[.>0 and @name != "QryAuthAns"]">['<xsl:value-of select="@name"/>',<xsl:value-of select="."/>],</xsl:for-each>] + }); + + </script> + <xsl:variable name="target"> + <xsl:value-of select="@name"/> + </xsl:variable> + <div class="pie" id="chart_qtype_{$thisview2}_{$target}"/> + </xsl:if> + <table class="counters"> + <xsl:for-each select="counters[@type="qtype"]/counter"> + <xsl:sort select="."/> + <xsl:variable name="css-class11"> + <xsl:choose> + <xsl:when test="position() mod 2 = 0">even</xsl:when> + <xsl:otherwise>odd</xsl:otherwise> + </xsl:choose> + </xsl:variable> + <tr class="{$css-class11}"> + <th> + <xsl:value-of select="@name"/> + </th> + <td> + <xsl:value-of select="."/> + </td> + </tr> + </xsl:for-each> + </table> + </xsl:if> + </xsl:for-each> + </xsl:for-each> + <h2>Network Status</h2> + <table class="counters"> + <tr> + <th>ID</th> + <th>Name</th> + <th>Type</th> + <th>References</th> + <th>LocalAddress</th> + <th>PeerAddress</th> + <th>State</th> + </tr> + <xsl:for-each select="socketmgr/sockets/socket"> + <xsl:sort select="id"/> + <xsl:variable name="css-class12"> + <xsl:choose> + <xsl:when test="position() mod 2 = 0">even</xsl:when> + <xsl:otherwise>odd</xsl:otherwise> + </xsl:choose> + </xsl:variable> + <tr class="{$css-class12}"> + <td> + <xsl:value-of select="id"/> + </td> + <td> + <xsl:value-of select="name"/> + </td> + <td> + <xsl:value-of select="type"/> + </td> + <td> + <xsl:value-of select="references"/> + </td> + <td> + <xsl:value-of select="local-address"/> + </td> + <td> + <xsl:value-of select="peer-address"/> + </td> + <td> + <xsl:for-each select="states"> + <xsl:value-of select="."/> + </xsl:for-each> + </td> + </tr> + </xsl:for-each> + </table> + <br/> + <h2>Task Manager Configuration</h2> + <table class="counters"> + <tr> + <th class="even">Thread-Model</th> + <td> + <xsl:value-of select="taskmgr/thread-model/type"/> + </td> + </tr> + <tr class="odd"> + <th>Worker Threads</th> + <td> + <xsl:value-of select="taskmgr/thread-model/worker-threads"/> + </td> + </tr> + <tr class="even"> + <th>Default Quantum</th> + <td> + <xsl:value-of select="taskmgr/thread-model/default-quantum"/> + </td> + </tr> + <tr class="odd"> + <th>Tasks Running</th> + <td> + <xsl:value-of select="taskmgr/thread-model/tasks-running"/> + </td> + </tr> + </table> + <br/> + <h2>Tasks</h2> + <table class="counters"> + <tr> + <th>ID</th> + <th>Name</th> + <th>References</th> + <th>State</th> + <th>Quantum</th> + </tr> + <xsl:for-each select="taskmgr/tasks/task"> + <xsl:sort select="name"/> + <xsl:variable name="css-class14"> + <xsl:choose> + <xsl:when test="position() mod 2 = 0">even</xsl:when> + <xsl:otherwise>odd</xsl:otherwise> + </xsl:choose> + </xsl:variable> + <tr class="{$css-class14}"> + <td> + <xsl:value-of select="id"/> + </td> + <td> + <xsl:value-of select="name"/> + </td> + <td> + <xsl:value-of select="references"/> + </td> + <td> + <xsl:value-of select="state"/> + </td> + <td> + <xsl:value-of select="quantum"/> + </td> + </tr> + </xsl:for-each> + </table> + <br/> + <h2>Memory Usage Summary</h2> + <table class="counters"> + <xsl:for-each select="memory/summary/*"> + <xsl:variable name="css-class13"> + <xsl:choose> + <xsl:when test="position() mod 2 = 0">even</xsl:when> + <xsl:otherwise>odd</xsl:otherwise> + </xsl:choose> + </xsl:variable> + <tr class="{$css-class13}"> + <th> + <xsl:value-of select="name()"/> + </th> + <td> + <xsl:value-of select="."/> + </td> + </tr> + </xsl:for-each> + </table> + <br/> + <h2>Memory Contexts</h2> + <table class="counters"> + <tr> + <th>ID</th> + <th>Name</th> + <th>References</th> + <th>TotalUse</th> + <th>InUse</th> + <th>MaxUse</th> + <th>BlockSize</th> + <th>Pools</th> + <th>HiWater</th> + <th>LoWater</th> + </tr> + <xsl:for-each select="memory/contexts/context"> + <xsl:sort select="total" data-type="number" order="descending"/> + <xsl:variable name="css-class14"> + <xsl:choose> + <xsl:when test="position() mod 2 = 0">even</xsl:when> + <xsl:otherwise>odd</xsl:otherwise> + </xsl:choose> + </xsl:variable> + <tr class="{$css-class14}"> + <td> + <xsl:value-of select="id"/> + </td> + <td> + <xsl:value-of select="name"/> + </td> + <td> + <xsl:value-of select="references"/> + </td> + <td> + <xsl:value-of select="total"/> + </td> + <td> + <xsl:value-of select="inuse"/> + </td> + <td> + <xsl:value-of select="maxinuse"/> + </td> + <td> + <xsl:value-of select="blocksize"/> + </td> + <td> + <xsl:value-of select="pools"/> + </td> + <td> + <xsl:value-of select="hiwater"/> + </td> + <td> + <xsl:value-of select="lowater"/> + </td> + </tr> + </xsl:for-each> + </table> + <hr/> + <p class="footer">Internet Systems Consortium Inc.<br/><a href="http://www.isc.org">http://www.isc.org</a></p> + </body> + </html> + </xsl:template> +</xsl:stylesheet> diff --git a/bin/named/bind9.ver3.xsl.h b/bin/named/bind9.ver3.xsl.h new file mode 100644 index 0000000..c55714a --- /dev/null +++ b/bin/named/bind9.ver3.xsl.h @@ -0,0 +1,740 @@ +/* + * Generated by convertxsl.pl 1.14 2008/07/17 23:43:26 jinmei Exp + * From <!-- %Id: bind9.xsl 1.21 2009/01/27 23:47:54 tbox Exp % + */ +static char xslmsg[] = + "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n" + "<!--\n" + " - Copyright (C) 2006-2009 Internet Systems Consortium, Inc. (\"ISC\")\n" + " -\n" + " - Permission to use, copy, modify, and/or distribute this software for any\n" + " - purpose with or without fee is hereby granted, provided that the above\n" + " - copyright notice and this permission notice appear in all copies.\n" + " -\n" + " - THE SOFTWARE IS PROVIDED \"AS IS\" AND ISC DISCLAIMS ALL WARRANTIES WITH\n" + " - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY\n" + " - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,\n" + " - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM\n" + " - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE\n" + " - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR\n" + " - PERFORMANCE OF THIS SOFTWARE.\n" + "-->\n" + "<!-- \045Id: bind9.xsl,v 1.21 2009/01/27 23:47:54 tbox Exp \045 -->\n" + "<xsl:stylesheet xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\" xmlns=\"http://www.w3.org/1999/xhtml\" version=\"1.0\">\n" + " <xsl:output method=\"html\" indent=\"yes\" version=\"4.0\"/>\n" + " <xsl:template match=\"statistics[@version="3.0"]\">\n" + " <html>\n" + " <head>\n" + " <xsl:if test=\"system-property('xsl:vendor')!='Transformiix'\">\n" + " <!-- Non Mozilla specific markup -->\n" + " <script type=\"text/javascript\" src=\"https://www.google.com/jsapi\"/>\n" + " <script type=\"text/javascript\">\n" + " \n" + " google.load(\"visualization\", \"1\", {packages:[\"corechart\"]});\n" + " google.setOnLoadCallback(loadGraphs);\n" + "\n" + " var graphs=[];\n" + " \n" + " function drawChart(chart_title,target,data) {\n" + " var data = google.visualization.arrayToDataTable(data);\n" + "\n" + " var options = {\n" + " title: chart_title\n" + " };\n" + " \n" + " var chart = new google.visualization.BarChart(document.getElementById(target));\n" + " chart.draw(data, options);\n" + " }\n" + " \n" + " function loadGraphs(){\n" + " //alert(\"here we are!\");\n" + " var g;\n" + " \n" + " // Server Incoming query Types\n" + " while(g = graphs.shift()){\n" + " // alert(\"going for: \" + g.target);\n" + " if(g.data.length > 1){\n" + " drawChart(g.title,g.target,g.data);\n" + " }\n" + " }\n" + " }\n" + " \n" + " // Server Incoming Queries Types \n" + " graphs.push({\n" + " 'title' : \"Server Incoming Query Types\",\n" + " 'target': 'chart_incoming_qtypes',\n" + " 'data': [['Type','Counter'],<xsl:for-each select=\"server/counters[@type="qtype"]/counter\">['<xsl:value-of select=\"@name\"/>',<xsl:value-of select=\".\"/>],</xsl:for-each>]\n" + " });\n" + "\n" + "\n" + " // Server Incoming Requests \n" + " graphs.push({\n" + " 'title' : \"Server Incoming Requests\",\n" + " 'target': 'chart_incoming_requests',\n" + " 'data': [['Requests','Counter'],<xsl:for-each select=\"server/counters[@type="opcode"]/counter\">['<xsl:value-of select=\"@name\"/>',<xsl:value-of select=\".\"/>],</xsl:for-each>]});\n" + " \n" + " \n" + " \n" + " \n" + " </script>\n" + " </xsl:if>\n" + " <style type=\"text/css\">\n" + " body {\n" + " font-family: sans-serif;\n" + " background-color: #ffffff;\n" + " color: #000000;\n" + " font-size: 10pt;\n" + " }\n" + " \n" + " .odd{\n" + " background-color: #f0f0f0;\n" + " }\n" + " \n" + " .even{\n" + " background-color: #ffffff;\n" + " }\n" + " \n" + " p.footer{\n" + " font-style:italic;\n" + " color: grey;\n" + " }\n" + "\n" + " table {\n" + " border-collapse: collapse;\n" + " border: 1px solid grey;\n" + " }\n" + "\n" + " table.counters{\n" + " border: 1px solid grey;\n" + " width: 500px;\n" + " }\n" + " \n" + " table.counters th {\n" + " text-align: center;\n" + " border: 1px solid grey;\n" + " width: 120px;\n" + " }\n" + " table.counters td{\n" + " text-align:center;\n" + " \n" + " }\n" + " \n" + " table.counters tr:hover{\n" + " background-color: #99ddff;\n" + " }\n" + " \n" + " .totals {\n" + " background-color: rgb(1,169,206);\n" + " color: #ffffff;\n" + " }\n" + "\n" + " td, th {\n" + " padding-right: 5px;\n" + " padding-left: 5px;\n" + " border: 1px solid grey;\n" + " }\n" + "\n" + " .header h1 {\n" + " color: rgb(1,169,206);\n" + " padding: 0px;\n" + " }\n" + "\n" + " .content {\n" + " background-color: #ffffff;\n" + " color: #000000;\n" + " padding: 4px;\n" + " }\n" + "\n" + " .item {\n" + " padding: 4px;\n" + " text-align: right;\n" + " }\n" + "\n" + " .value {\n" + " padding: 4px;\n" + " font-weight: bold;\n" + " }\n" + "\n" + "\n" + " h2 {\n" + " color: grey;\n" + " font-size: 14pt;\n" + " width:500px;\n" + " text-align:center;\n" + " }\n" + " \n" + " h3 {\n" + " color: #444444;\n" + " font-size: 12pt;\n" + " width:500px;\n" + " text-align:center;\n" + " \n" + " }\n" + " h4 {\n" + " color: rgb(1,169,206);\n" + " font-size: 10pt;\n" + " width:500px;\n" + " text-align:center;\n" + " \n" + " }\n" + "\n" + " .pie {\n" + " width:500px;\n" + " height: 500px;\n" + " }\n" + "\n" + " </style>\n" + " <title>ISC BIND 9 Statistics</title>\n" + " </head>\n" + " <body>\n" + " <div class=\"header\">\n" + " <h1>ISC Bind 9 Configuration and Statistics</h1>\n" + " </div>\n" + " <hr/>\n" + " <h2>Server Times</h2>\n" + " <table class=\"counters\">\n" + " <tr>\n" + " <th>Boot time:</th>\n" + " <td>\n" + " <xsl:value-of select=\"server/boot-time\"/>\n" + " </td>\n" + " </tr>\n" + " <tr>\n" + " <th>Sample time:</th>\n" + " <td>\n" + " <xsl:value-of select=\"server/current-time\"/>\n" + " </td>\n" + " </tr>\n" + " </table>\n" + " <br/>\n" + " <h2>Incoming Requests</h2>\n" + " <xsl:if test=\"system-property('xsl:vendor')!='Transformiix'\">\n" + " <!-- Non Mozilla specific markup -->\n" + " <div class=\"pie\" id=\"chart_incoming_requests\">[graph incoming requests]</div>\n" + " </xsl:if>\n" + " <table class=\"counters\">\n" + " <xsl:for-each select=\"server/counters[@type="opcode"]/counter\">\n" + " <xsl:sort select=\".\" data-type=\"number\" order=\"descending\"/>\n" + " <tr>\n" + " <th>\n" + " <xsl:value-of select=\"@name\"/>\n" + " </th>\n" + " <td>\n" + " <xsl:value-of select=\".\"/>\n" + " </td>\n" + " </tr>\n" + " </xsl:for-each>\n" + " <tr>\n" + " <th class=\"totals\">Total:</th>\n" + " <td class=\"totals\">\n" + " <xsl:value-of select=\"sum(server/counters[@type="opcode"]/counter)\"/>\n" + " </td>\n" + " </tr>\n" + " </table>\n" + " <br/>\n" + " <h3>Incoming Queries by Type</h3>\n" + " <xsl:if test=\"system-property('xsl:vendor')!='Transformiix'\">\n" + " <!-- Non Mozilla specific markup -->\n" + " <div class=\"pie\" id=\"chart_incoming_qtypes\">[graph incoming qtypes]</div>\n" + " </xsl:if>\n" + " <table class=\"counters\">\n" + " <xsl:for-each select=\"server/counters[@type="qtype"]/counter\">\n" + " <xsl:sort select=\".\" data-type=\"number\" order=\"descending\"/>\n" + " <xsl:variable name=\"css-class\">\n" + " <xsl:choose>\n" + " <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n" + " <xsl:otherwise>odd</xsl:otherwise>\n" + " </xsl:choose>\n" + " </xsl:variable>\n" + " <tr class=\"{$css-class}\">\n" + " <th>\n" + " <xsl:value-of select=\"@name\"/>\n" + " </th>\n" + " <td>\n" + " <xsl:value-of select=\".\"/>\n" + " </td>\n" + " </tr>\n" + " </xsl:for-each>\n" + " <tr>\n" + " <th class=\"totals\">Total:</th>\n" + " <td class=\"totals\">\n" + " <xsl:value-of select=\"sum(server/counters[@type="qtype"]/counter)\"/>\n" + " </td>\n" + " </tr>\n" + " </table>\n" + " <br/>\n" + " <h2>Outgoing Queries per view</h2>\n" + " <xsl:for-each select=\"views/view[count(counters[@type="resqtype"]/counter) > 0]\">\n" + " <h3>View <xsl:value-of select=\"@name\"/></h3>\n" + " <xsl:if test=\"system-property('xsl:vendor')!='Transformiix'\">\n" + " <!-- Non Mozilla specific markup -->\n" + " <script type=\"text/javascript\">\n" + " graphs.push({\n" + " 'title': \"Outgoing queries for view: <xsl:value-of select=\"@name\"/>\",\n" + " 'target': 'chart_outgoing_queries_view_<xsl:value-of select=\"@name\"/>',\n" + " 'data': [['Type','Counter'],<xsl:for-each select=\"counters[@type="resqtype"]/counter\">['<xsl:value-of select=\"@name\"/>',<xsl:value-of select=\".\"/>],</xsl:for-each>]\n" + " });\n" + " \n" + " </script>\n" + " <xsl:variable name=\"target\">\n" + " <xsl:value-of select=\"@name\"/>\n" + " </xsl:variable>\n" + " <div class=\"pie\" id=\"chart_outgoing_queries_view_{$target}\"/>\n" + " </xsl:if>\n" + " <table class=\"counters\">\n" + " <xsl:for-each select=\"counters[@type="resqtype"]/counter\">\n" + " <xsl:sort select=\".\" data-type=\"number\" order=\"descending\"/>\n" + " <xsl:variable name=\"css-class1\">\n" + " <xsl:choose>\n" + " <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n" + " <xsl:otherwise>odd</xsl:otherwise>\n" + " </xsl:choose>\n" + " </xsl:variable>\n" + " <tr class=\"{$css-class1}\">\n" + " <th>\n" + " <xsl:value-of select=\"@name\"/>\n" + " </th>\n" + " <td>\n" + " <xsl:value-of select=\".\"/>\n" + " </td>\n" + " </tr>\n" + " </xsl:for-each>\n" + " </table>\n" + " <br/>\n" + " </xsl:for-each>\n" + " <h2>Server Statistics</h2>\n" + " <xsl:if test=\"system-property('xsl:vendor')!='Transformiix'\">\n" + " <!-- Non Mozilla specific markup -->\n" + " <script type=\"text/javascript\">\n" + " graphs.push({\n" + " 'title' : \"Server Response Types\",\n" + " 'target': 'chart_server_nsstat_restype',\n" + " 'data': [['Type','Counter'],<xsl:for-each select=\"server/counters[@type="nsstat"]/counter[.>0]\">['<xsl:value-of select=\"@name\"/>',<xsl:value-of select=\".\"/>],</xsl:for-each>]\n" + " });\n" + " \n" + " </script>\n" + " <div class=\"pie\" id=\"chart_server_nsstat_restype\"/>\n" + " </xsl:if>\n" + " <table class=\"counters\">\n" + " <xsl:for-each select=\"server/counters[@type="nsstat"]/counter[.>0]\">\n" + " <xsl:sort select=\".\" data-type=\"number\" order=\"descending\"/>\n" + " <xsl:variable name=\"css-class2\">\n" + " <xsl:choose>\n" + " <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n" + " <xsl:otherwise>odd</xsl:otherwise>\n" + " </xsl:choose>\n" + " </xsl:variable>\n" + " <tr class=\"{$css-class2}\">\n" + " <th>\n" + " <xsl:value-of select=\"@name\"/>\n" + " </th>\n" + " <td>\n" + " <xsl:value-of select=\".\"/>\n" + " </td>\n" + " </tr>\n" + " </xsl:for-each>\n" + " </table>\n" + " <br/>\n" + " <h2>Zone Maintenance Statistics</h2>\n" + " <xsl:if test=\"system-property('xsl:vendor')!='Transformiix'\">\n" + " <script type=\"text/javascript\">\n" + " graphs.push({\n" + " 'title' : \"Zone Maintenance Stats\",\n" + " 'target': 'chart_server_zone_maint',\n" + " 'data': [['Type','Counter'],<xsl:for-each select=\"server/counters[@type="zonestat"]/counter\">['<xsl:value-of select=\"@name\"/>',<xsl:value-of select=\".\"/>],</xsl:for-each>]\n" + " });\n" + "\n" + " </script>\n" + " <!-- Non Mozilla specific markup -->\n" + " <div class=\"pie\" id=\"chart_server_zone_maint\"/>\n" + " </xsl:if>\n" + " <table class=\"counters\">\n" + " <xsl:for-each select=\"server/counters[@type="zonestat"]/counter\">\n" + " <xsl:sort select=\".\" data-type=\"number\" order=\"descending\"/>\n" + " <xsl:variable name=\"css-class3\">\n" + " <xsl:choose>\n" + " <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n" + " <xsl:otherwise>odd</xsl:otherwise>\n" + " </xsl:choose>\n" + " </xsl:variable>\n" + " <tr class=\"{$css-class3}\">\n" + " <th>\n" + " <xsl:value-of select=\"@name\"/>\n" + " </th>\n" + " <td>\n" + " <xsl:value-of select=\".\"/>\n" + " </td>\n" + " </tr>\n" + " </xsl:for-each>\n" + " </table>\n" + " <h2>Resolver Statistics (Common)</h2>\n" + " <table class=\"counters\">\n" + " <xsl:for-each select=\"server/counters[@type="restat"]/counter\">\n" + " <xsl:sort select=\".\" data-type=\"number\" order=\"descending\"/>\n" + " <xsl:variable name=\"css-class4\">\n" + " <xsl:choose>\n" + " <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n" + " <xsl:otherwise>odd</xsl:otherwise>\n" + " </xsl:choose>\n" + " </xsl:variable>\n" + " <tr class=\"{$css-class4}\">\n" + " <th>\n" + " <xsl:value-of select=\"@name\"/>\n" + " </th>\n" + " <td>\n" + " <xsl:value-of select=\".\"/>\n" + " </td>\n" + " </tr>\n" + " </xsl:for-each>\n" + " </table>\n" + " <xsl:for-each select=\"views/view\">\n" + " <h3>Resolver Statistics for View <xsl:value-of select=\"@name\"/></h3>\n" + " <table class=\"counters\">\n" + " <xsl:for-each select=\"counters[@type="resstats"]/counter[.>0]\">\n" + " <xsl:sort select=\".\" data-type=\"number\" order=\"descending\"/>\n" + " <xsl:variable name=\"css-class5\">\n" + " <xsl:choose>\n" + " <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n" + " <xsl:otherwise>odd</xsl:otherwise>\n" + " </xsl:choose>\n" + " </xsl:variable>\n" + " <tr class=\"{$css-class5}\">\n" + " <th>\n" + " <xsl:value-of select=\"@name\"/>\n" + " </th>\n" + " <td>\n" + " <xsl:value-of select=\".\"/>\n" + " </td>\n" + " </tr>\n" + " </xsl:for-each>\n" + " </table>\n" + " </xsl:for-each>\n" + " <h3>Cache DB RRsets for View <xsl:value-of select=\"@name\"/></h3>\n" + " <xsl:for-each select=\"views/view\">\n" + " <table class=\"counters\">\n" + " <xsl:for-each select=\"cache/rrset\">\n" + " <xsl:variable name=\"css-class6\">\n" + " <xsl:choose>\n" + " <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n" + " <xsl:otherwise>odd</xsl:otherwise>\n" + " </xsl:choose>\n" + " </xsl:variable>\n" + " <tr class=\"{$css-class6}\">\n" + " <th>\n" + " <xsl:value-of select=\"name\"/>\n" + " </th>\n" + " <td>\n" + " <xsl:value-of select=\"counter\"/>\n" + " </td>\n" + " </tr>\n" + " </xsl:for-each>\n" + " </table>\n" + " <br/>\n" + " </xsl:for-each>\n" + " <h2>Socket I/O Statistics</h2>\n" + " <table class=\"counters\">\n" + " <xsl:for-each select=\"server/counters[@type="sockstat"]/counter[.>0]\">\n" + " <xsl:variable name=\"css-class7\">\n" + " <xsl:choose>\n" + " <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n" + " <xsl:otherwise>odd</xsl:otherwise>\n" + " </xsl:choose>\n" + " </xsl:variable>\n" + " <tr class=\"{$css-class7}\">\n" + " <th>\n" + " <xsl:value-of select=\"@name\"/>\n" + " </th>\n" + " <td>\n" + " <xsl:value-of select=\".\"/>\n" + " </td>\n" + " </tr>\n" + " </xsl:for-each>\n" + " </table>\n" + " <br/>\n" + " <br/>\n" + " <h2>Response Codes per view/zone</h2>\n" + " <xsl:for-each select=\"views/view[zones/zone/counters[@type="rcode"]/counter >0]\">\n" + " <h3>View <xsl:value-of select=\"@name\"/></h3>\n" + " <xsl:variable name=\"thisview\">\n" + " <xsl:value-of select=\"@name\"/>\n" + " </xsl:variable>\n" + " <xsl:for-each select=\"zones/zone\">\n" + " <xsl:if test=\"counters[@type="rcode"]/counter[. > 0]\">\n" + " <h4>Zone <xsl:value-of select=\"@name\"/></h4>\n" + " <xsl:if test=\"system-property('xsl:vendor')!='Transformiix'\">\n" + " <!-- Non Mozilla specific markup -->\n" + " <script type=\"text/javascript\">\n" + " graphs.push({\n" + " 'title': \"Response Codes for zone <xsl:value-of select=\"@name\"/>\",\n" + " 'target': 'chart_rescode_<xsl:value-of select=\"../../@name\"/>_<xsl:value-of select=\"@name\"/>',\n" + " 'data': [['Type','Counter'],<xsl:for-each select=\"counters[@type="rcode"]/counter[.>0 and @name != "QryAuthAns"]\">['<xsl:value-of select=\"@name\"/>',<xsl:value-of select=\".\"/>],</xsl:for-each>]\n" + " });\n" + "\n" + " </script>\n" + " <xsl:variable name=\"target\">\n" + " <xsl:value-of select=\"@name\"/>\n" + " </xsl:variable>\n" + " <div class=\"pie\" id=\"chart_rescode_{$thisview}_{$target}\"/>\n" + " </xsl:if>\n" + " <table class=\"counters\">\n" + " <xsl:for-each select=\"counters[@type="rcode"]/counter[.>0 and @name != "QryAuthAns"]\">\n" + " <xsl:sort select=\".\"/>\n" + " <xsl:variable name=\"css-class10\">\n" + " <xsl:choose>\n" + " <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n" + " <xsl:otherwise>odd</xsl:otherwise>\n" + " </xsl:choose>\n" + " </xsl:variable>\n" + " <tr class=\"{$css-class10}\">\n" + " <th>\n" + " <xsl:value-of select=\"@name\"/>\n" + " </th>\n" + " <td>\n" + " <xsl:value-of select=\".\"/>\n" + " </td>\n" + " </tr>\n" + " </xsl:for-each>\n" + " </table>\n" + " </xsl:if>\n" + " </xsl:for-each>\n" + " </xsl:for-each>\n" + " <h2>Received QTYPES per view/zone</h2>\n" + " <xsl:for-each select=\"views/view[zones/zone/counters[@type="qtype"]/counter >0]\">\n" + " <h3>View <xsl:value-of select=\"@name\"/></h3>\n" + " <xsl:variable name=\"thisview2\">\n" + " <xsl:value-of select=\"@name\"/>\n" + " </xsl:variable>\n" + " <xsl:for-each select=\"zones/zone\">\n" + " <xsl:if test=\"counters[@type="qtype"]/counter[count(.) > 0]\">\n" + " <h4>Zone <xsl:value-of select=\"@name\"/></h4>\n" + " <xsl:if test=\"system-property('xsl:vendor')!='Transformiix'\">\n" + " <!-- Non Mozilla specific markup -->\n" + " <script type=\"text/javascript\">\n" + " graphs.push({\n" + " 'title': \"Query Types for zone <xsl:value-of select=\"@name\"/>\",\n" + " 'target': 'chart_qtype_<xsl:value-of select=\"../../@name\"/>_<xsl:value-of select=\"@name\"/>',\n" + " 'data': [['Type','Counter'],<xsl:for-each select=\"counters[@type="qtype"]/counter[.>0 and @name != "QryAuthAns"]\">['<xsl:value-of select=\"@name\"/>',<xsl:value-of select=\".\"/>],</xsl:for-each>]\n" + " });\n" + "\n" + " </script>\n" + " <xsl:variable name=\"target\">\n" + " <xsl:value-of select=\"@name\"/>\n" + " </xsl:variable>\n" + " <div class=\"pie\" id=\"chart_qtype_{$thisview2}_{$target}\"/>\n" + " </xsl:if>\n" + " <table class=\"counters\">\n" + " <xsl:for-each select=\"counters[@type="qtype"]/counter\">\n" + " <xsl:sort select=\".\"/>\n" + " <xsl:variable name=\"css-class11\">\n" + " <xsl:choose>\n" + " <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n" + " <xsl:otherwise>odd</xsl:otherwise>\n" + " </xsl:choose>\n" + " </xsl:variable>\n" + " <tr class=\"{$css-class11}\">\n" + " <th>\n" + " <xsl:value-of select=\"@name\"/>\n" + " </th>\n" + " <td>\n" + " <xsl:value-of select=\".\"/>\n" + " </td>\n" + " </tr>\n" + " </xsl:for-each>\n" + " </table>\n" + " </xsl:if>\n" + " </xsl:for-each>\n" + " </xsl:for-each>\n" + " <h2>Network Status</h2>\n" + " <table class=\"counters\">\n" + " <tr>\n" + " <th>ID</th>\n" + " <th>Name</th>\n" + " <th>Type</th>\n" + " <th>References</th>\n" + " <th>LocalAddress</th>\n" + " <th>PeerAddress</th>\n" + " <th>State</th>\n" + " </tr>\n" + " <xsl:for-each select=\"socketmgr/sockets/socket\">\n" + " <xsl:sort select=\"id\"/>\n" + " <xsl:variable name=\"css-class12\">\n" + " <xsl:choose>\n" + " <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n" + " <xsl:otherwise>odd</xsl:otherwise>\n" + " </xsl:choose>\n" + " </xsl:variable>\n" + " <tr class=\"{$css-class12}\">\n" + " <td>\n" + " <xsl:value-of select=\"id\"/>\n" + " </td>\n" + " <td>\n" + " <xsl:value-of select=\"name\"/>\n" + " </td>\n" + " <td>\n" + " <xsl:value-of select=\"type\"/>\n" + " </td>\n" + " <td>\n" + " <xsl:value-of select=\"references\"/>\n" + " </td>\n" + " <td>\n" + " <xsl:value-of select=\"local-address\"/>\n" + " </td>\n" + " <td>\n" + " <xsl:value-of select=\"peer-address\"/>\n" + " </td>\n" + " <td>\n" + " <xsl:for-each select=\"states\">\n" + " <xsl:value-of select=\".\"/>\n" + " </xsl:for-each>\n" + " </td>\n" + " </tr>\n" + " </xsl:for-each>\n" + " </table>\n" + " <br/>\n" + " <h2>Task Manager Configuration</h2>\n" + " <table class=\"counters\">\n" + " <tr>\n" + " <th class=\"even\">Thread-Model</th>\n" + " <td>\n" + " <xsl:value-of select=\"taskmgr/thread-model/type\"/>\n" + " </td>\n" + " </tr>\n" + " <tr class=\"odd\">\n" + " <th>Worker Threads</th>\n" + " <td>\n" + " <xsl:value-of select=\"taskmgr/thread-model/worker-threads\"/>\n" + " </td>\n" + " </tr>\n" + " <tr class=\"even\">\n" + " <th>Default Quantum</th>\n" + " <td>\n" + " <xsl:value-of select=\"taskmgr/thread-model/default-quantum\"/>\n" + " </td>\n" + " </tr>\n" + " <tr class=\"odd\">\n" + " <th>Tasks Running</th>\n" + " <td>\n" + " <xsl:value-of select=\"taskmgr/thread-model/tasks-running\"/>\n" + " </td>\n" + " </tr>\n" + " </table>\n" + " <br/>\n" + " <h2>Tasks</h2>\n" + " <table class=\"counters\">\n" + " <tr>\n" + " <th>ID</th>\n" + " <th>Name</th>\n" + " <th>References</th>\n" + " <th>State</th>\n" + " <th>Quantum</th>\n" + " </tr>\n" + " <xsl:for-each select=\"taskmgr/tasks/task\">\n" + " <xsl:sort select=\"name\"/>\n" + " <xsl:variable name=\"css-class14\">\n" + " <xsl:choose>\n" + " <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n" + " <xsl:otherwise>odd</xsl:otherwise>\n" + " </xsl:choose>\n" + " </xsl:variable>\n" + " <tr class=\"{$css-class14}\">\n" + " <td>\n" + " <xsl:value-of select=\"id\"/>\n" + " </td>\n" + " <td>\n" + " <xsl:value-of select=\"name\"/>\n" + " </td>\n" + " <td>\n" + " <xsl:value-of select=\"references\"/>\n" + " </td>\n" + " <td>\n" + " <xsl:value-of select=\"state\"/>\n" + " </td>\n" + " <td>\n" + " <xsl:value-of select=\"quantum\"/>\n" + " </td>\n" + " </tr>\n" + " </xsl:for-each>\n" + " </table>\n" + " <br/>\n" + " <h2>Memory Usage Summary</h2>\n" + " <table class=\"counters\">\n" + " <xsl:for-each select=\"memory/summary/*\">\n" + " <xsl:variable name=\"css-class13\">\n" + " <xsl:choose>\n" + " <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n" + " <xsl:otherwise>odd</xsl:otherwise>\n" + " </xsl:choose>\n" + " </xsl:variable>\n" + " <tr class=\"{$css-class13}\">\n" + " <th>\n" + " <xsl:value-of select=\"name()\"/>\n" + " </th>\n" + " <td>\n" + " <xsl:value-of select=\".\"/>\n" + " </td>\n" + " </tr>\n" + " </xsl:for-each>\n" + " </table>\n" + " <br/>\n" + " <h2>Memory Contexts</h2>\n" + " <table class=\"counters\">\n" + " <tr>\n" + " <th>ID</th>\n" + " <th>Name</th>\n" + " <th>References</th>\n" + " <th>TotalUse</th>\n" + " <th>InUse</th>\n" + " <th>MaxUse</th>\n" + " <th>BlockSize</th>\n" + " <th>Pools</th>\n" + " <th>HiWater</th>\n" + " <th>LoWater</th>\n" + " </tr>\n" + " <xsl:for-each select=\"memory/contexts/context\">\n" + " <xsl:sort select=\"total\" data-type=\"number\" order=\"descending\"/>\n" + " <xsl:variable name=\"css-class14\">\n" + " <xsl:choose>\n" + " <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n" + " <xsl:otherwise>odd</xsl:otherwise>\n" + " </xsl:choose>\n" + " </xsl:variable>\n" + " <tr class=\"{$css-class14}\">\n" + " <td>\n" + " <xsl:value-of select=\"id\"/>\n" + " </td>\n" + " <td>\n" + " <xsl:value-of select=\"name\"/>\n" + " </td>\n" + " <td>\n" + " <xsl:value-of select=\"references\"/>\n" + " </td>\n" + " <td>\n" + " <xsl:value-of select=\"total\"/>\n" + " </td>\n" + " <td>\n" + " <xsl:value-of select=\"inuse\"/>\n" + " </td>\n" + " <td>\n" + " <xsl:value-of select=\"maxinuse\"/>\n" + " </td>\n" + " <td>\n" + " <xsl:value-of select=\"blocksize\"/>\n" + " </td>\n" + " <td>\n" + " <xsl:value-of select=\"pools\"/>\n" + " </td>\n" + " <td>\n" + " <xsl:value-of select=\"hiwater\"/>\n" + " </td>\n" + " <td>\n" + " <xsl:value-of select=\"lowater\"/>\n" + " </td>\n" + " </tr>\n" + " </xsl:for-each>\n" + " </table>\n" + " <hr/>\n" + " <p class=\"footer\">Internet Systems Consortium Inc.<br/><a href=\"http://www.isc.org\">http://www.isc.org</a></p>\n" + " </body>\n" + " </html>\n" + " </xsl:template>\n" + "</xsl:stylesheet>\n"; diff --git a/bin/named/builtin.c b/bin/named/builtin.c index 14204cd..4604cb3 100644 --- a/bin/named/builtin.c +++ b/bin/named/builtin.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: builtin.c,v 1.20.14.3 2012/01/11 20:19:40 ckb Exp $ */ +/* $Id: builtin.c,v 1.26 2012/01/21 19:44:18 each Exp $ */ /*! \file * \brief @@ -281,11 +281,14 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, static isc_result_t builtin_lookup(const char *zone, const char *name, void *dbdata, - dns_sdblookup_t *lookup) + dns_sdblookup_t *lookup, dns_clientinfomethods_t *methods, + dns_clientinfo_t *clientinfo) { builtin_t *b = (builtin_t *) dbdata; UNUSED(zone); + UNUSED(methods); + UNUSED(clientinfo); if (strcmp(name, "@") == 0) return (b->do_lookup(lookup)); @@ -295,10 +298,14 @@ builtin_lookup(const char *zone, const char *name, void *dbdata, static isc_result_t dns64_lookup(const dns_name_t *zone, const dns_name_t *name, void *dbdata, - dns_sdblookup_t *lookup) + dns_sdblookup_t *lookup, dns_clientinfomethods_t *methods, + dns_clientinfo_t *clientinfo) { builtin_t *b = (builtin_t *) dbdata; + UNUSED(methods); + UNUSED(clientinfo); + if (name->labels == 0 && name->length == 0) return (b->do_lookup(lookup)); else @@ -353,6 +360,8 @@ do_authors_lookup(dns_sdblookup_t *lookup) { "Curtis Blackburn", "James Brister", "Ben Cottrell", + "John H. DuBois III", + "Francis Dupont", "Michael Graff", "Andreas Gustafsson", "Bob Halley", diff --git a/bin/named/client.c b/bin/named/client.c index ff4ab69..933abc7 100644 --- a/bin/named/client.c +++ b/bin/named/client.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: client.c,v 1.271.10.4 2012/01/31 23:46:39 tbox Exp $ */ +/* $Id$ */ #include <config.h> @@ -24,6 +24,7 @@ #include <isc/once.h> #include <isc/platform.h> #include <isc/print.h> +#include <isc/queue.h> #include <isc/stats.h> #include <isc/stdio.h> #include <isc/string.h> @@ -116,15 +117,26 @@ struct ns_clientmgr { /* Unlocked. */ unsigned int magic; + + /* The queue object has its own locks */ + client_queue_t inactive; /*%< To be recycled */ + isc_mem_t * mctx; isc_taskmgr_t * taskmgr; isc_timermgr_t * timermgr; + + /* Lock covers manager state. */ isc_mutex_t lock; - /* Locked by lock. */ isc_boolean_t exiting; - client_list_t active; /*%< Active clients */ - client_list_t recursing; /*%< Recursing clients */ - client_list_t inactive; /*%< To be recycled */ + + /* Lock covers the clients list */ + isc_mutex_t listlock; + client_list_t clients; /*%< All active clients */ + + /* Lock covers the recursing list */ + isc_mutex_t reclock; + client_list_t recursing; /*%< Recursing clients */ + #if NMCTXS > 0 /*%< mctx pool for clients. */ unsigned int nextmctx; @@ -188,6 +200,12 @@ struct ns_clientmgr { * recursion quota, and an outstanding write request. */ +#define NS_CLIENTSTATE_RECURSING 5 +/*%< + * The client object is recursing. It will be on the 'recursing' + * list. + */ + #define NS_CLIENTSTATE_MAX 9 /*%< * Sentinel value used to indicate "no state". When client->newstate @@ -210,20 +228,21 @@ static void client_udprecv(ns_client_t *client); static void clientmgr_destroy(ns_clientmgr_t *manager); static isc_boolean_t exit_check(ns_client_t *client); static void ns_client_endrequest(ns_client_t *client); -static void ns_client_checkactive(ns_client_t *client); static void client_start(isc_task_t *task, isc_event_t *event); static void client_request(isc_task_t *task, isc_event_t *event); static void ns_client_dumpmessage(ns_client_t *client, const char *reason); +static isc_result_t get_client(ns_clientmgr_t *manager, ns_interface_t *ifp, + dns_dispatch_t *disp, isc_boolean_t tcp); void ns_client_recursing(ns_client_t *client) { REQUIRE(NS_CLIENT_VALID(client)); + REQUIRE(client->state == NS_CLIENTSTATE_WORKING); - LOCK(&client->manager->lock); - ISC_LIST_UNLINK(*client->list, client, link); - ISC_LIST_APPEND(client->manager->recursing, client, link); - client->list = &client->manager->recursing; - UNLOCK(&client->manager->lock); + LOCK(&client->manager->reclock); + client->newstate = client->state = NS_CLIENTSTATE_RECURSING; + ISC_LIST_APPEND(client->manager->recursing, client, rlink); + UNLOCK(&client->manager->reclock); } void @@ -231,15 +250,14 @@ ns_client_killoldestquery(ns_client_t *client) { ns_client_t *oldest; REQUIRE(NS_CLIENT_VALID(client)); - LOCK(&client->manager->lock); + LOCK(&client->manager->reclock); oldest = ISC_LIST_HEAD(client->manager->recursing); if (oldest != NULL) { + ISC_LIST_UNLINK(client->manager->recursing, oldest, rlink); + UNLOCK(&client->manager->reclock); ns_query_cancel(oldest); - ISC_LIST_UNLINK(*oldest->list, oldest, link); - ISC_LIST_APPEND(client->manager->active, oldest, link); - oldest->list = &client->manager->active; - } - UNLOCK(&client->manager->lock); + } else + UNLOCK(&client->manager->reclock); } void @@ -268,15 +286,16 @@ ns_client_settimeout(ns_client_t *client, unsigned int seconds) { */ static isc_boolean_t exit_check(ns_client_t *client) { - ns_clientmgr_t *locked_manager = NULL; - ns_clientmgr_t *destroy_manager = NULL; + isc_boolean_t destroy_manager = ISC_FALSE; + ns_clientmgr_t *manager = NULL; REQUIRE(NS_CLIENT_VALID(client)); + manager = client->manager; if (client->state <= client->newstate) return (ISC_FALSE); /* Business as usual. */ - INSIST(client->newstate < NS_CLIENTSTATE_WORKING); + INSIST(client->newstate < NS_CLIENTSTATE_RECURSING); /* * We need to detach from the view early when shutting down @@ -293,13 +312,16 @@ exit_check(ns_client_t *client) { client->newstate == NS_CLIENTSTATE_FREED && client->view != NULL) dns_view_detach(&client->view); - if (client->state == NS_CLIENTSTATE_WORKING) { + if (client->state == NS_CLIENTSTATE_WORKING || + client->state == NS_CLIENTSTATE_RECURSING) + { INSIST(client->newstate <= NS_CLIENTSTATE_READING); /* * Let the update processing complete. */ if (client->nupdates > 0) return (ISC_TRUE); + /* * We are trying to abort request processing. */ @@ -322,23 +344,28 @@ exit_check(ns_client_t *client) { */ return (ISC_TRUE); } + /* * I/O cancel is complete. Burn down all state * related to the current request. Ensure that - * the client is on the active list and not the - * recursing list. + * the client is no longer on the recursing list. + * + * We need to check whether the client is still linked, + * because it may already have been removed from the + * recursing list by ns_client_killoldestquery() */ - LOCK(&client->manager->lock); - if (client->list == &client->manager->recursing) { - ISC_LIST_UNLINK(*client->list, client, link); - ISC_LIST_APPEND(client->manager->active, client, link); - client->list = &client->manager->active; + if (client->state == NS_CLIENTSTATE_RECURSING) { + LOCK(&manager->reclock); + if (ISC_LINK_LINKED(client, rlink)) + ISC_LIST_UNLINK(manager->recursing, + client, rlink); + UNLOCK(&manager->reclock); } - UNLOCK(&client->manager->lock); ns_client_endrequest(client); client->state = NS_CLIENTSTATE_READING; INSIST(client->recursionquota == NULL); + if (NS_CLIENTSTATE_READING == client->newstate) { client_read(client); client->newstate = NS_CLIENTSTATE_MAX; @@ -389,8 +416,27 @@ exit_check(ns_client_t *client) { * or UDP request, but we may have enough clients doing * that already. Check whether this client needs to remain * active and force it to go inactive if not. + * + * UDP clients go inactive at this point, but TCP clients + * may remain active if we have fewer active TCP client + * objects than desired due to an earlier quota exhaustion. */ - ns_client_checkactive(client); + if (client->mortal && TCP_CLIENT(client) && !ns_g_clienttest) { + LOCK(&client->interface->lock); + if (client->interface->ntcpcurrent < + client->interface->ntcptarget) + client->mortal = ISC_FALSE; + UNLOCK(&client->interface->lock); + } + + /* + * We don't need the client; send it to the inactive + * queue for recycling. + */ + if (client->mortal) { + if (client->newstate > NS_CLIENTSTATE_INACTIVE) + client->newstate = NS_CLIENTSTATE_INACTIVE; + } if (NS_CLIENTSTATE_READY == client->newstate) { if (TCP_CLIENT(client)) { @@ -404,6 +450,7 @@ exit_check(ns_client_t *client) { if (client->state == NS_CLIENTSTATE_READY) { INSIST(client->newstate <= NS_CLIENTSTATE_INACTIVE); + /* * We are trying to enter the inactive state. */ @@ -411,25 +458,22 @@ exit_check(ns_client_t *client) { isc_socket_cancel(client->tcplistener, client->task, ISC_SOCKCANCEL_ACCEPT); - if (! (client->naccepts == 0)) { - /* Still waiting for accept cancel completion. */ + /* Still waiting for accept cancel completion. */ + if (! (client->naccepts == 0)) return (ISC_TRUE); - } - /* Accept cancel is complete. */ + /* Accept cancel is complete. */ if (client->nrecvs > 0) isc_socket_cancel(client->udpsocket, client->task, ISC_SOCKCANCEL_RECV); - if (! (client->nrecvs == 0)) { - /* Still waiting for recv cancel completion. */ + + /* Still waiting for recv cancel completion. */ + if (! (client->nrecvs == 0)) return (ISC_TRUE); - } - /* Recv cancel is complete. */ - if (client->nctls > 0) { - /* Still waiting for control event to be delivered */ + /* Still waiting for control event to be delivered */ + if (client->nctls > 0) return (ISC_TRUE); - } /* Deactivate the client. */ if (client->interface) @@ -449,7 +493,6 @@ exit_check(ns_client_t *client) { client->attributes = 0; client->mortal = ISC_FALSE; - LOCK(&client->manager->lock); /* * Put the client on the inactive list. If we are aiming for * the "freed" state, it will be removed from the inactive @@ -457,18 +500,18 @@ exit_check(ns_client_t *client) { * that has been done, lest the manager decide to reactivate * the dying client inbetween. */ - locked_manager = client->manager; - ISC_LIST_UNLINK(*client->list, client, link); - ISC_LIST_APPEND(client->manager->inactive, client, link); - client->list = &client->manager->inactive; client->state = NS_CLIENTSTATE_INACTIVE; INSIST(client->recursionquota == NULL); if (client->state == client->newstate) { client->newstate = NS_CLIENTSTATE_MAX; + if (!ns_g_clienttest && manager != NULL && + !manager->exiting) + ISC_QUEUE_PUSH(manager->inactive, client, + ilink); if (client->needshutdown) isc_task_shutdown(client->task); - goto unlock; + return (ISC_TRUE); } } @@ -485,6 +528,7 @@ exit_check(ns_client_t *client) { REQUIRE(client->state == NS_CLIENTSTATE_INACTIVE); INSIST(client->recursionquota == NULL); + INSIST(!ISC_QLINK_LINKED(client, ilink)); ns_query_free(client); isc_mem_put(client->mctx, client->recvbuf, RECV_BUFFER_SIZE); @@ -493,27 +537,27 @@ exit_check(ns_client_t *client) { isc_timer_detach(&client->timer); if (client->tcpbuf != NULL) - isc_mem_put(client->mctx, client->tcpbuf, TCP_BUFFER_SIZE); + isc_mem_put(client->mctx, client->tcpbuf, + TCP_BUFFER_SIZE); if (client->opt != NULL) { INSIST(dns_rdataset_isassociated(client->opt)); dns_rdataset_disassociate(client->opt); - dns_message_puttemprdataset(client->message, &client->opt); + dns_message_puttemprdataset(client->message, + &client->opt); } + dns_message_destroy(&client->message); - if (client->manager != NULL) { - ns_clientmgr_t *manager = client->manager; - if (locked_manager == NULL) { - LOCK(&manager->lock); - locked_manager = manager; - } - ISC_LIST_UNLINK(*client->list, client, link); - client->list = NULL; + if (manager != NULL) { + LOCK(&manager->listlock); + ISC_LIST_UNLINK(manager->clients, client, link); + LOCK(&manager->lock); if (manager->exiting && - ISC_LIST_EMPTY(manager->active) && - ISC_LIST_EMPTY(manager->inactive) && - ISC_LIST_EMPTY(manager->recursing)) - destroy_manager = manager; + ISC_LIST_EMPTY(manager->clients)) + destroy_manager = ISC_TRUE; + UNLOCK(&manager->lock); + UNLOCK(&manager->listlock); } + /* * Detaching the task must be done after unlinking from * the manager's lists because the manager accesses @@ -524,6 +568,7 @@ exit_check(ns_client_t *client) { CTRACE("free"); client->magic = 0; + /* * Check that there are no other external references to * the memory context. @@ -533,22 +578,10 @@ exit_check(ns_client_t *client) { INSIST(0); } isc_mem_putanddetach(&client->mctx, client, sizeof(*client)); - - goto unlock; - } - - unlock: - if (locked_manager != NULL) { - UNLOCK(&locked_manager->lock); - locked_manager = NULL; } - /* - * Only now is it safe to destroy the client manager (if needed), - * because we have accessed its lock for the last time. - */ - if (destroy_manager != NULL) - clientmgr_destroy(destroy_manager); + if (destroy_manager && manager != NULL) + clientmgr_destroy(manager); return (ISC_TRUE); } @@ -604,6 +637,9 @@ client_shutdown(isc_task_t *task, isc_event_t *event) { client->shutdown_arg = NULL; } + if (ISC_QLINK_LINKED(client, ilink)) + ISC_QUEUE_UNLINK(client->manager->inactive, client, ilink); + client->newstate = NS_CLIENTSTATE_FREED; client->needshutdown = ISC_FALSE; (void)exit_check(client); @@ -616,7 +652,8 @@ ns_client_endrequest(ns_client_t *client) { INSIST(client->nsends == 0); INSIST(client->nrecvs == 0); INSIST(client->nupdates == 0); - INSIST(client->state == NS_CLIENTSTATE_WORKING); + INSIST(client->state == NS_CLIENTSTATE_WORKING || + client->state == NS_CLIENTSTATE_RECURSING); CTRACE("endrequest"); @@ -649,46 +686,13 @@ ns_client_endrequest(ns_client_t *client) { client->attributes &= NS_CLIENTATTR_TCP; } -static void -ns_client_checkactive(ns_client_t *client) { - if (client->mortal) { - /* - * This client object should normally go inactive - * at this point, but if we have fewer active client - * objects than desired due to earlier quota exhaustion, - * keep it active to make up for the shortage. - */ - isc_boolean_t need_another_client = ISC_FALSE; - if (TCP_CLIENT(client) && !ns_g_clienttest) { - LOCK(&client->interface->lock); - if (client->interface->ntcpcurrent < - client->interface->ntcptarget) - need_another_client = ISC_TRUE; - UNLOCK(&client->interface->lock); - } else { - /* - * The UDP client quota is enforced by making - * requests fail rather than by not listening - * for new ones. Therefore, there is always a - * full set of UDP clients listening. - */ - } - if (! need_another_client) { - /* - * We don't need this client object. Recycle it. - */ - if (client->newstate >= NS_CLIENTSTATE_INACTIVE) - client->newstate = NS_CLIENTSTATE_INACTIVE; - } - } -} - void ns_client_next(ns_client_t *client, isc_result_t result) { int newstate; REQUIRE(NS_CLIENT_VALID(client)); REQUIRE(client->state == NS_CLIENTSTATE_WORKING || + client->state == NS_CLIENTSTATE_RECURSING || client->state == NS_CLIENTSTATE_READING); CTRACE("next"); @@ -745,9 +749,6 @@ client_senddone(isc_task_t *task, isc_event_t *event) { client->tcpbuf = NULL; } - if (exit_check(client)) - return; - ns_client_next(client, ISC_R_SUCCESS); } @@ -1974,6 +1975,11 @@ static isc_result_t get_clientmctx(ns_clientmgr_t *manager, isc_mem_t **mctxp) { isc_mem_t *clientmctx; isc_result_t result; +#if NMCTXS > 0 + unsigned int nextmctx; +#endif + + MTRACE("clientmctx"); /* * Caller must be holding the manager lock. @@ -1985,19 +1991,21 @@ get_clientmctx(ns_clientmgr_t *manager, isc_mem_t **mctxp) { return (result); } #if NMCTXS > 0 - INSIST(manager->nextmctx < NMCTXS); - clientmctx = manager->mctxpool[manager->nextmctx]; + nextmctx = manager->nextmctx++; + if (manager->nextmctx == NMCTXS) + manager->nextmctx = 0; + + INSIST(nextmctx < NMCTXS); + + clientmctx = manager->mctxpool[nextmctx]; if (clientmctx == NULL) { result = isc_mem_create(0, 0, &clientmctx); if (result != ISC_R_SUCCESS) return (result); isc_mem_setname(clientmctx, "client", NULL); - manager->mctxpool[manager->nextmctx] = clientmctx; + manager->mctxpool[nextmctx] = clientmctx; } - manager->nextmctx++; - if (manager->nextmctx == NMCTXS) - manager->nextmctx = 0; #else clientmctx = manager->mctx; #endif @@ -2118,6 +2126,8 @@ client_create(ns_clientmgr_t *manager, ns_client_t **clientp) { #ifdef ALLOW_FILTER_AAAA_ON_V4 client->filter_aaaa = dns_v4_aaaa_ok; #endif + client->needshutdown = ns_g_clienttest; + ISC_EVENT_INIT(&client->ctlevent, sizeof(client->ctlevent), 0, NULL, NS_EVENT_CLIENTCONTROL, client_start, client, client, NULL, NULL); @@ -2129,7 +2139,8 @@ client_create(ns_clientmgr_t *manager, ns_client_t **clientp) { client->formerrcache.time = 0; client->formerrcache.id = 0; ISC_LINK_INIT(client, link); - client->list = NULL; + ISC_LINK_INIT(client, rlink); + ISC_QLINK_INIT(client, ilink); /* * We call the init routines for the various kinds of client here, @@ -2144,8 +2155,6 @@ client_create(ns_clientmgr_t *manager, ns_client_t **clientp) { if (result != ISC_R_SUCCESS) goto cleanup_query; - client->needshutdown = ns_g_clienttest; - CTRACE("create"); *clientp = client; @@ -2410,10 +2419,8 @@ ns_client_replace(ns_client_t *client) { REQUIRE(client != NULL); REQUIRE(client->manager != NULL); - result = ns_clientmgr_createclients(client->manager, - 1, client->interface, - (TCP_CLIENT(client) ? - ISC_TRUE : ISC_FALSE)); + result = get_client(client->manager, client->interface, + client->dispatch, TCP_CLIENT(client)); if (result != ISC_R_SUCCESS) return (result); @@ -2437,9 +2444,7 @@ clientmgr_destroy(ns_clientmgr_t *manager) { int i; #endif - REQUIRE(ISC_LIST_EMPTY(manager->active)); - REQUIRE(ISC_LIST_EMPTY(manager->inactive)); - REQUIRE(ISC_LIST_EMPTY(manager->recursing)); + REQUIRE(ISC_LIST_EMPTY(manager->clients)); MTRACE("clientmgr_destroy"); @@ -2450,7 +2455,10 @@ clientmgr_destroy(ns_clientmgr_t *manager) { } #endif + ISC_QUEUE_DESTROY(manager->inactive); DESTROYLOCK(&manager->lock); + DESTROYLOCK(&manager->listlock); + DESTROYLOCK(&manager->reclock); manager->magic = 0; isc_mem_put(manager->mctx, manager, sizeof(*manager)); } @@ -2473,13 +2481,21 @@ ns_clientmgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr, if (result != ISC_R_SUCCESS) goto cleanup_manager; + result = isc_mutex_init(&manager->listlock); + if (result != ISC_R_SUCCESS) + goto cleanup_lock; + + result = isc_mutex_init(&manager->reclock); + if (result != ISC_R_SUCCESS) + goto cleanup_listlock; + manager->mctx = mctx; manager->taskmgr = taskmgr; manager->timermgr = timermgr; manager->exiting = ISC_FALSE; - ISC_LIST_INIT(manager->active); - ISC_LIST_INIT(manager->inactive); + ISC_LIST_INIT(manager->clients); ISC_LIST_INIT(manager->recursing); + ISC_QUEUE_INIT(manager->inactive, ilink); #if NMCTXS > 0 manager->nextmctx = 0; for (i = 0; i < NMCTXS; i++) @@ -2493,6 +2509,12 @@ ns_clientmgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr, return (ISC_R_SUCCESS); + cleanup_listlock: + (void) isc_mutex_destroy(&manager->listlock); + + cleanup_lock: + (void) isc_mutex_destroy(&manager->lock); + cleanup_manager: isc_mem_put(manager->mctx, manager, sizeof(*manager)); @@ -2501,9 +2523,10 @@ ns_clientmgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr, void ns_clientmgr_destroy(ns_clientmgr_t **managerp) { + isc_result_t result; ns_clientmgr_t *manager; ns_client_t *client; - isc_boolean_t need_destroy = ISC_FALSE; + isc_boolean_t need_destroy = ISC_FALSE, unlock = ISC_FALSE; REQUIRE(managerp != NULL); manager = *managerp; @@ -2511,31 +2534,27 @@ ns_clientmgr_destroy(ns_clientmgr_t **managerp) { MTRACE("destroy"); - LOCK(&manager->lock); + /* + * Check for success because we may already be task-exclusive + * at this point. Only if we succeed at obtaining an exclusive + * lock now will we need to relinquish it later. + */ + result = isc_task_beginexclusive(ns_g_server->task); + if (result == ISC_R_SUCCESS) + unlock = ISC_TRUE; manager->exiting = ISC_TRUE; - for (client = ISC_LIST_HEAD(manager->recursing); - client != NULL; - client = ISC_LIST_NEXT(client, link)) - isc_task_shutdown(client->task); - - for (client = ISC_LIST_HEAD(manager->active); - client != NULL; - client = ISC_LIST_NEXT(client, link)) - isc_task_shutdown(client->task); - - for (client = ISC_LIST_HEAD(manager->inactive); + for (client = ISC_LIST_HEAD(manager->clients); client != NULL; client = ISC_LIST_NEXT(client, link)) isc_task_shutdown(client->task); - if (ISC_LIST_EMPTY(manager->active) && - ISC_LIST_EMPTY(manager->inactive) && - ISC_LIST_EMPTY(manager->recursing)) + if (ISC_LIST_EMPTY(manager->clients)) need_destroy = ISC_TRUE; - UNLOCK(&manager->lock); + if (unlock) + isc_task_endexclusive(ns_g_server->task); if (need_destroy) clientmgr_destroy(manager); @@ -2543,81 +2562,86 @@ ns_clientmgr_destroy(ns_clientmgr_t **managerp) { *managerp = NULL; } -isc_result_t -ns_clientmgr_createclients(ns_clientmgr_t *manager, unsigned int n, - ns_interface_t *ifp, isc_boolean_t tcp) +static isc_result_t +get_client(ns_clientmgr_t *manager, ns_interface_t *ifp, + dns_dispatch_t *disp, isc_boolean_t tcp) { isc_result_t result = ISC_R_SUCCESS; - unsigned int i; + isc_event_t *ev; ns_client_t *client; + MTRACE("get client"); - REQUIRE(VALID_MANAGER(manager)); - REQUIRE(n > 0); + REQUIRE(manager != NULL); - MTRACE("createclients"); + if (manager->exiting) + return (ISC_R_SHUTTINGDOWN); /* - * We MUST lock the manager lock for the entire client creation - * process. If we didn't do this, then a client could get a - * shutdown event and disappear out from under us. + * Allocate a client. First try to get a recycled one; + * if that fails, make a new one. */ + client = NULL; + if (!ns_g_clienttest) + ISC_QUEUE_POP(manager->inactive, ilink, client); - LOCK(&manager->lock); + if (client != NULL) + MTRACE("recycle"); + else { + MTRACE("create new"); - for (i = 0; i < n; i++) { - isc_event_t *ev; - /* - * Allocate a client. First try to get a recycled one; - * if that fails, make a new one. - */ - client = NULL; - if (!ns_g_clienttest) - client = ISC_LIST_HEAD(manager->inactive); - if (client != NULL) { - MTRACE("recycle"); - ISC_LIST_UNLINK(manager->inactive, client, link); - client->list = NULL; - } else { - MTRACE("create new"); - result = client_create(manager, &client); - if (result != ISC_R_SUCCESS) - break; - } + LOCK(&manager->lock); + result = client_create(manager, &client); + UNLOCK(&manager->lock); + if (result != ISC_R_SUCCESS) + return (result); - ns_interface_attach(ifp, &client->interface); - client->state = NS_CLIENTSTATE_READY; - INSIST(client->recursionquota == NULL); + LOCK(&manager->listlock); + ISC_LIST_APPEND(manager->clients, client, link); + UNLOCK(&manager->listlock); + } - if (tcp) { - client->attributes |= NS_CLIENTATTR_TCP; - isc_socket_attach(ifp->tcpsocket, - &client->tcplistener); - } else { - isc_socket_t *sock; + client->manager = manager; + ns_interface_attach(ifp, &client->interface); + client->state = NS_CLIENTSTATE_READY; + INSIST(client->recursionquota == NULL); - dns_dispatch_attach(ifp->udpdispatch, - &client->dispatch); - sock = dns_dispatch_getsocket(client->dispatch); - isc_socket_attach(sock, &client->udpsocket); - } - client->manager = manager; - ISC_LIST_APPEND(manager->active, client, link); - client->list = &manager->active; + if (tcp) { + client->attributes |= NS_CLIENTATTR_TCP; + isc_socket_attach(ifp->tcpsocket, + &client->tcplistener); + } else { + isc_socket_t *sock; - INSIST(client->nctls == 0); - client->nctls++; - ev = &client->ctlevent; - isc_task_send(client->task, &ev); - } - if (i != 0) { - /* - * We managed to create at least one client, so we - * declare victory. - */ - result = ISC_R_SUCCESS; + dns_dispatch_attach(disp, &client->dispatch); + sock = dns_dispatch_getsocket(client->dispatch); + isc_socket_attach(sock, &client->udpsocket); } - UNLOCK(&manager->lock); + INSIST(client->nctls == 0); + client->nctls++; + ev = &client->ctlevent; + isc_task_send(client->task, &ev); + + return (ISC_R_SUCCESS); +} + +isc_result_t +ns_clientmgr_createclients(ns_clientmgr_t *manager, unsigned int n, + ns_interface_t *ifp, isc_boolean_t tcp) +{ + isc_result_t result = ISC_R_SUCCESS; + unsigned int disp; + + REQUIRE(VALID_MANAGER(manager)); + REQUIRE(n > 0); + + MTRACE("createclients"); + + for (disp = 0; disp < n; disp++) { + result = get_client(manager, ifp, ifp->udpdispatch[disp], tcp); + if (result != ISC_R_SUCCESS) + break; + } return (result); } @@ -2702,19 +2726,41 @@ ns_client_logv(ns_client_t *client, isc_logcategory_t *category, { char msgbuf[2048]; char peerbuf[ISC_SOCKADDR_FORMATSIZE]; - const char *name = ""; - const char *sep = ""; + char signerbuf[DNS_NAME_FORMATSIZE], qnamebuf[DNS_NAME_FORMATSIZE]; + const char *viewname = ""; + const char *sep1 = "", *sep2 = "", *sep3 = "", *sep4 = ""; + const char *signer = "", *qname = ""; + dns_name_t *q = NULL; vsnprintf(msgbuf, sizeof(msgbuf), fmt, ap); + ns_client_name(client, peerbuf, sizeof(peerbuf)); + + if (client->signer != NULL) { + dns_name_format(client->signer, signerbuf, sizeof(signerbuf)); + sep1 = "/key "; + signer = signerbuf; + } + + q = client->query.origqname != NULL + ? client->query.origqname : client->query.qname; + if (q != NULL) { + dns_name_format(q, qnamebuf, sizeof(qnamebuf)); + sep2 = " ("; + sep3 = ")"; + qname = qnamebuf; + } + if (client->view != NULL && strcmp(client->view->name, "_bind") != 0 && strcmp(client->view->name, "_default") != 0) { - name = client->view->name; - sep = ": view "; + sep4 = ": view "; + viewname = client->view->name; } isc_log_write(ns_g_lctx, category, module, level, - "client %s%s%s: %s", peerbuf, sep, name, msgbuf); + "client %s%s%s%s%s%s%s%s: %s", + peerbuf, sep1, signer, sep2, qname, sep3, + sep4, viewname, msgbuf); } void @@ -2796,9 +2842,11 @@ ns_client_dumprecursing(FILE *f, ns_clientmgr_t *manager) { REQUIRE(VALID_MANAGER(manager)); - LOCK(&manager->lock); + LOCK(&manager->reclock); client = ISC_LIST_HEAD(manager->recursing); while (client != NULL) { + INSIST(client->state == NS_CLIENTSTATE_RECURSING); + ns_client_name(client, peerbuf, sizeof(peerbuf)); if (client->view != NULL && strcmp(client->view->name, "_bind") != 0 && @@ -2809,6 +2857,9 @@ ns_client_dumprecursing(FILE *f, ns_clientmgr_t *manager) { name = ""; sep = ""; } + + LOCK(&client->query.fetchlock); + INSIST(client->query.qname != NULL); dns_name_format(client->query.qname, namebuf, sizeof(namebuf)); if (client->query.qname != client->query.origqname && client->query.origqname != NULL) { @@ -2831,20 +2882,19 @@ ns_client_dumprecursing(FILE *f, ns_clientmgr_t *manager) { strcpy(typebuf, "-"); strcpy(classbuf, "-"); } + UNLOCK(&client->query.fetchlock); fprintf(f, "; client %s%s%s: id %u '%s/%s/%s'%s%s " "requesttime %d\n", peerbuf, sep, name, client->message->id, namebuf, typebuf, classbuf, origfor, original, client->requesttime); - client = ISC_LIST_NEXT(client, link); + client = ISC_LIST_NEXT(client, rlink); } - UNLOCK(&manager->lock); + UNLOCK(&manager->reclock); } void ns_client_qnamereplace(ns_client_t *client, dns_name_t *name) { - - if (client->manager != NULL) - LOCK(&client->manager->lock); + LOCK(&client->query.fetchlock); if (client->query.restarts > 0) { /* * client->query.qname was dynamically allocated. @@ -2853,6 +2903,16 @@ ns_client_qnamereplace(ns_client_t *client, dns_name_t *name) { &client->query.qname); } client->query.qname = name; - if (client->manager != NULL) - UNLOCK(&client->manager->lock); + UNLOCK(&client->query.fetchlock); +} + +isc_result_t +ns_client_sourceip(dns_clientinfo_t *ci, isc_sockaddr_t **addrp) { + ns_client_t *client = (ns_client_t *) ci->data; + + REQUIRE(NS_CLIENT_VALID(client)); + REQUIRE(addrp != NULL); + + *addrp = &client->peeraddr; + return (ISC_R_SUCCESS); } diff --git a/bin/named/config.c b/bin/named/config.c index 25ebac4..fa349ee 100644 --- a/bin/named/config.c +++ b/bin/named/config.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: config.c,v 1.113.16.2 2011/02/28 01:19:58 tbox Exp $ */ +/* $Id: config.c,v 1.123 2012/01/06 23:46:41 tbox Exp $ */ /*! \file */ @@ -73,6 +73,7 @@ options {\n\ listen-on {any;};\n\ listen-on-v6 {none;};\n\ match-mapped-addresses no;\n\ + max-rsa-exponent-size 0; /* no limit */\n\ memstatistics-file \"named.memstats\";\n\ multiple-cnames no;\n\ # named-xfer <obsolete>;\n\ @@ -90,7 +91,7 @@ options {\n\ "\ recursive-clients 1000;\n\ resolver-query-timeout 10;\n\ - rrset-order {type NS order random; order cyclic; };\n\ + rrset-order { order random; };\n\ serial-queries 20;\n\ serial-query-rate 20;\n\ server-id none;\n\ @@ -200,7 +201,8 @@ options {\n\ sig-signing-nodes 100;\n\ sig-signing-signatures 10;\n\ sig-signing-type 65534;\n\ - zone-statistics false;\n\ + inline-signing no;\n\ + zone-statistics terse;\n\ max-journal-size unlimited;\n\ ixfr-from-differences false;\n\ check-wildcard yes;\n\ @@ -210,7 +212,10 @@ options {\n\ check-srv-cname warn;\n\ zero-no-soa-ttl yes;\n\ update-check-ksk yes;\n\ + serial-update-method increment;\n\ + dnssec-update-mode maintain;\n\ dnssec-dnskey-kskonly no;\n\ + dnssec-loadkeys-interval 60;\n\ try-tcp-refresh yes; /* BIND 8 compat */\n\ };\n\ " @@ -292,7 +297,8 @@ ns_checknames_get(const cfg_obj_t **maps, const char *which, if (maps[i] == NULL) return (ISC_R_NOTFOUND); checknames = NULL; - if (cfg_map_get(maps[i], "check-names", &checknames) == ISC_R_SUCCESS) { + if (cfg_map_get(maps[i], "check-names", + &checknames) == ISC_R_SUCCESS) { /* * Zone map entry is not a list. */ @@ -305,7 +311,8 @@ ns_checknames_get(const cfg_obj_t **maps, const char *which, element = cfg_list_next(element)) { value = cfg_listelt_value(element); type = cfg_tuple_get(value, "type"); - if (strcasecmp(cfg_obj_asstring(type), which) == 0) { + if (strcasecmp(cfg_obj_asstring(type), + which) == 0) { *obj = cfg_tuple_get(value, "mode"); return (ISC_R_SUCCESS); } @@ -378,6 +385,8 @@ ns_config_getzonetype(const cfg_obj_t *zonetypeobj) { ztype = dns_zone_stub; else if (strcasecmp(str, "static-stub") == 0) ztype = dns_zone_staticstub; + else if (strcasecmp(str, "redirect") == 0) + ztype = dns_zone_redirect; else INSIST(0); return (ztype); diff --git a/bin/named/control.c b/bin/named/control.c index 2a1a5a8..fabe442 100644 --- a/bin/named/control.c +++ b/bin/named/control.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2007, 2009, 2010, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007, 2009-2012 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2001-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: control.c,v 1.41 2010/12/03 22:05:19 each Exp $ */ +/* $Id$ */ /*! \file */ @@ -154,7 +154,7 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) { } else if (command_compare(command, NS_COMMAND_DUMPSTATS)) { result = ns_server_dumpstats(ns_g_server); } else if (command_compare(command, NS_COMMAND_QUERYLOG)) { - result = ns_server_togglequerylog(ns_g_server); + result = ns_server_togglequerylog(ns_g_server, command); } else if (command_compare(command, NS_COMMAND_DUMPDB)) { ns_server_dumpdb(ns_g_server, command); result = ISC_R_SUCCESS; @@ -169,7 +169,9 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) { } else if (command_compare(command, NS_COMMAND_FLUSH)) { result = ns_server_flushcache(ns_g_server, command); } else if (command_compare(command, NS_COMMAND_FLUSHNAME)) { - result = ns_server_flushname(ns_g_server, command); + result = ns_server_flushnode(ns_g_server, command, ISC_FALSE); + } else if (command_compare(command, NS_COMMAND_FLUSHTREE)) { + result = ns_server_flushnode(ns_g_server, command, ISC_TRUE); } else if (command_compare(command, NS_COMMAND_STATUS)) { result = ns_server_status(ns_g_server, text); } else if (command_compare(command, NS_COMMAND_TSIGLIST)) { @@ -183,6 +185,8 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) { command_compare(command, NS_COMMAND_THAW)) { result = ns_server_freeze(ns_g_server, ISC_FALSE, command, text); + } else if (command_compare(command, NS_COMMAND_SYNC)) { + result = ns_server_sync(ns_g_server, command, text); } else if (command_compare(command, NS_COMMAND_RECURSING)) { result = ns_server_dumprecursing(ns_g_server); } else if (command_compare(command, NS_COMMAND_TIMERPOKE)) { @@ -201,6 +205,8 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) { result = ns_server_add_zone(ns_g_server, command); } else if (command_compare(command, NS_COMMAND_DELZONE)) { result = ns_server_del_zone(ns_g_server, command); + } else if (command_compare(command, NS_COMMAND_SIGNING)) { + result = ns_server_signing(ns_g_server, command, text); } else { isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_CONTROL, ISC_LOG_WARNING, diff --git a/bin/named/controlconf.c b/bin/named/controlconf.c index 73c0f37..c46a6e1 100644 --- a/bin/named/controlconf.c +++ b/bin/named/controlconf.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: controlconf.c,v 1.60.544.3 2011/12/22 08:10:09 marka Exp $ */ +/* $Id: controlconf.c,v 1.63 2011/12/22 08:07:48 marka Exp $ */ /*! \file */ diff --git a/bin/named/include/dlz/dlz_dlopen_driver.h b/bin/named/include/dlz/dlz_dlopen_driver.h index 7af325a..602b3c0 100644 --- a/bin/named/include/dlz/dlz_dlopen_driver.h +++ b/bin/named/include/dlz/dlz_dlopen_driver.h @@ -14,7 +14,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dlz_dlopen_driver.h,v 1.1.4.4 2011/03/17 09:41:06 fdupont Exp $ */ +/* $Id: dlz_dlopen_driver.h,v 1.4 2011/03/17 09:25:53 fdupont Exp $ */ #ifndef DLZ_DLOPEN_DRIVER_H #define DLZ_DLOPEN_DRIVER_H diff --git a/bin/named/include/named/client.h b/bin/named/include/named/client.h index e6414d2..98e79df 100644 --- a/bin/named/include/named/client.h +++ b/bin/named/include/named/client.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2009, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2009, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: client.h,v 1.91.278.2 2012/01/31 23:46:39 tbox Exp $ */ +/* $Id$ */ #ifndef NAMED_CLIENT_H #define NAMED_CLIENT_H 1 @@ -66,7 +66,9 @@ #include <isc/magic.h> #include <isc/stdtime.h> #include <isc/quota.h> +#include <isc/queue.h> +#include <dns/db.h> #include <dns/fixedname.h> #include <dns/name.h> #include <dns/rdataclass.h> @@ -81,8 +83,6 @@ *** Types ***/ -typedef ISC_LIST(ns_client_t) client_list_t; - /*% nameserver client structure */ struct ns_client { unsigned int magic; @@ -155,13 +155,15 @@ struct ns_client { isc_stdtime_t time; dns_messageid_t id; } formerrcache; + ISC_LINK(ns_client_t) link; - /*% - * The list 'link' is part of, or NULL if not on any list. - */ - client_list_t *list; + ISC_LINK(ns_client_t) rlink; + ISC_QLINK(ns_client_t) ilink; }; +typedef ISC_QUEUE(ns_client_t) client_queue_t; +typedef ISC_LIST(ns_client_t) client_list_t; + #define NS_CLIENT_MAGIC ISC_MAGIC('N','S','C','c') #define NS_CLIENT_VALID(c) ISC_MAGIC_VALID(c, NS_CLIENT_MAGIC) @@ -379,4 +381,7 @@ ns_client_isself(dns_view_t *myview, dns_tsigkey_t *mykey, * Isself callback. */ +isc_result_t +ns_client_sourceip(dns_clientinfo_t *ci, isc_sockaddr_t **addrp); + #endif /* NAMED_CLIENT_H */ diff --git a/bin/named/include/named/control.h b/bin/named/include/named/control.h index 24e5909..d730a83 100644 --- a/bin/named/include/named/control.h +++ b/bin/named/include/named/control.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2007, 2009, 2010 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007, 2009-2012 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2001-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: control.h,v 1.31 2010/08/16 22:21:06 marka Exp $ */ +/* $Id$ */ #ifndef NAMED_CONTROL_H #define NAMED_CONTROL_H 1 @@ -47,6 +47,7 @@ #define NS_COMMAND_NOTRACE "notrace" #define NS_COMMAND_FLUSH "flush" #define NS_COMMAND_FLUSHNAME "flushname" +#define NS_COMMAND_FLUSHTREE "flushtree" #define NS_COMMAND_STATUS "status" #define NS_COMMAND_TSIGLIST "tsig-list" #define NS_COMMAND_TSIGDELETE "tsig-delete" @@ -62,6 +63,8 @@ #define NS_COMMAND_LOADKEYS "loadkeys" #define NS_COMMAND_ADDZONE "addzone" #define NS_COMMAND_DELZONE "delzone" +#define NS_COMMAND_SYNC "sync" +#define NS_COMMAND_SIGNING "signing" isc_result_t ns_controls_create(ns_server_t *server, ns_controls_t **ctrlsp); diff --git a/bin/named/include/named/globals.h b/bin/named/include/named/globals.h index 39307f3..cbc14d8 100644 --- a/bin/named/include/named/globals.h +++ b/bin/named/include/named/globals.h @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: globals.h,v 1.89.54.2 2011/06/17 23:47:10 tbox Exp $ */ +/* $Id: globals.h,v 1.92 2011/11/09 18:44:04 each Exp $ */ #ifndef NAMED_GLOBALS_H #define NAMED_GLOBALS_H 1 @@ -51,6 +51,7 @@ EXTERN isc_mem_t * ns_g_mctx INIT(NULL); EXTERN unsigned int ns_g_cpus INIT(0); +EXTERN unsigned int ns_g_udpdisp INIT(0); EXTERN isc_taskmgr_t * ns_g_taskmgr INIT(NULL); EXTERN dns_dispatchmgr_t * ns_g_dispatchmgr INIT(NULL); EXTERN isc_entropy_t * ns_g_entropy INIT(NULL); diff --git a/bin/named/include/named/interfacemgr.h b/bin/named/include/named/interfacemgr.h index 2724c39..380dbed 100644 --- a/bin/named/include/named/interfacemgr.h +++ b/bin/named/include/named/interfacemgr.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2011 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: interfacemgr.h,v 1.33 2007/06/19 23:46:59 tbox Exp $ */ +/* $Id: interfacemgr.h,v 1.35 2011/07/28 23:47:58 tbox Exp $ */ #ifndef NAMED_INTERFACEMGR_H #define NAMED_INTERFACEMGR_H 1 @@ -65,7 +65,8 @@ #define NS_INTERFACE_VALID(t) ISC_MAGIC_VALID(t, IFACE_MAGIC) #define NS_INTERFACEFLAG_ANYADDR 0x01U /*%< bound to "any" address */ - +#define MAX_UDP_DISPATCH 128 /*%< Maximum number of UDP dispatchers + to start per interface */ /*% The nameserver interface structure */ struct ns_interface { unsigned int magic; /*%< Magic number. */ @@ -76,11 +77,13 @@ struct ns_interface { isc_sockaddr_t addr; /*%< Address and port. */ unsigned int flags; /*%< Interface characteristics */ char name[32]; /*%< Null terminated. */ - dns_dispatch_t * udpdispatch; /*%< UDP dispatcher. */ + dns_dispatch_t * udpdispatch[MAX_UDP_DISPATCH]; + /*%< UDP dispatchers. */ isc_socket_t * tcpsocket; /*%< TCP socket. */ int ntcptarget; /*%< Desired number of concurrent TCP accepts */ int ntcpcurrent; /*%< Current ditto, locked */ + int nudpdispatch; /*%< Number of UDP dispatches */ ns_clientmgr_t * clientmgr; /*%< Client manager. */ ISC_LINK(ns_interface_t) link; }; diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h index 9982e88..3ba0c64 100644 --- a/bin/named/include/named/server.h +++ b/bin/named/include/named/server.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2010, 2013 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2013 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: server.h,v 1.110 2010/08/16 23:46:52 tbox Exp $ */ +/* $Id$ */ #ifndef NAMED_SERVER_H #define NAMED_SERVER_H 1 @@ -230,9 +230,10 @@ ns_server_retransfercommand(ns_server_t *server, char *args); */ isc_result_t -ns_server_togglequerylog(ns_server_t *server); +ns_server_togglequerylog(ns_server_t *server, char *args); /*%< - * Toggle logging of queries, as in BIND 8. + * Enable/disable logging of queries. (Takes "yes" or "no" argument, + * but can also be used as a toggle for backward comptibility.) */ /*% @@ -266,10 +267,12 @@ isc_result_t ns_server_flushcache(ns_server_t *server, char *args); /*% - * Flush a particular name from the server's cache(s) + * Flush a particular name from the server's cache. If 'tree' is false, + * also flush the name from the ADB and badcache. If 'tree' is true, also + * flush all the names under the specified name. */ isc_result_t -ns_server_flushname(ns_server_t *server, char *args); +ns_server_flushnode(ns_server_t *server, char *args, isc_boolean_t tree); /*% * Report the server's status. @@ -297,6 +300,12 @@ ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args, isc_buffer_t *text); /*% + * Dump zone updates to disk, optionally removing the journal file + */ +isc_result_t +ns_server_sync(ns_server_t *server, char *args, isc_buffer_t *text); + +/*% * Update a zone's DNSKEY set from the key repository. If * the command that triggered the call to this function was "sign", * then force a full signing of the zone. If it was "loadkeys", @@ -336,4 +345,9 @@ ns_server_add_zone(ns_server_t *server, char *args); isc_result_t ns_server_del_zone(ns_server_t *server, char *args); +/*% + * Lists the status of the signing records for a given zone. + */ +isc_result_t +ns_server_signing(ns_server_t *server, char *args, isc_buffer_t *text); #endif /* NAMED_SERVER_H */ diff --git a/bin/named/include/named/zoneconf.h b/bin/named/include/named/zoneconf.h index ebaad68..0e684d2 100644 --- a/bin/named/include/named/zoneconf.h +++ b/bin/named/include/named/zoneconf.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2007, 2010 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007, 2010, 2011 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: zoneconf.h,v 1.28 2010/12/20 23:47:20 tbox Exp $ */ +/* $Id: zoneconf.h,v 1.30 2011/08/30 23:46:51 tbox Exp $ */ #ifndef NS_ZONECONF_H #define NS_ZONECONF_H 1 @@ -33,7 +33,7 @@ ISC_LANG_BEGINDECLS isc_result_t ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, const cfg_obj_t *zconfig, cfg_aclconfctx_t *ac, - dns_zone_t *zone); + dns_zone_t *zone, dns_zone_t *raw); /*%< * Configure or reconfigure a zone according to the named.conf * data in 'cctx' and 'czone'. diff --git a/bin/named/interfacemgr.c b/bin/named/interfacemgr.c index 15ffe00..84bf21d 100644 --- a/bin/named/interfacemgr.c +++ b/bin/named/interfacemgr.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2009, 2011, 2013 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2009, 2011-2013 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,13 +15,14 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: interfacemgr.c,v 1.95.426.2 2011/03/12 04:59:14 tbox Exp $ */ +/* $Id: interfacemgr.c,v 1.101 2011/11/09 18:44:03 each Exp $ */ /*! \file */ #include <config.h> #include <isc/interfaceiter.h> +#include <isc/os.h> #include <isc/string.h> #include <isc/task.h> #include <isc/util.h> @@ -185,11 +186,14 @@ ns_interface_create(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr, { ns_interface_t *ifp; isc_result_t result; + int disp; REQUIRE(NS_INTERFACEMGR_VALID(mgr)); + ifp = isc_mem_get(mgr->mctx, sizeof(*ifp)); if (ifp == NULL) return (ISC_R_NOMEMORY); + ifp->mgr = NULL; ifp->generation = mgr->generation; ifp->addr = *addr; @@ -212,9 +216,11 @@ ns_interface_create(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr, goto clientmgr_create_failure; } - ifp->udpdispatch = NULL; + for (disp = 0; disp < MAX_UDP_DISPATCH; disp++) + ifp->udpdispatch[disp] = NULL; ifp->tcpsocket = NULL; + /* * Create a single TCP client object. It will replace itself * with a new one as soon as it gets a connection, so the actual @@ -223,6 +229,7 @@ ns_interface_create(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr, */ ifp->ntcptarget = 1; ifp->ntcpcurrent = 0; + ifp->nudpdispatch = 0; ISC_LINK_INIT(ifp, link); @@ -237,6 +244,7 @@ ns_interface_create(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr, clientmgr_create_failure: DESTROYLOCK(&ifp->lock); + lock_create_failure: ifp->magic = 0; isc_mem_put(mgr->mctx, ifp, sizeof(*ifp)); @@ -249,6 +257,7 @@ ns_interface_listenudp(ns_interface_t *ifp) { isc_result_t result; unsigned int attrs; unsigned int attrmask; + int disp, i; attrs = 0; attrs |= DNS_DISPATCHATTR_UDP; @@ -260,18 +269,28 @@ ns_interface_listenudp(ns_interface_t *ifp) { attrmask = 0; attrmask |= DNS_DISPATCHATTR_UDP | DNS_DISPATCHATTR_TCP; attrmask |= DNS_DISPATCHATTR_IPV4 | DNS_DISPATCHATTR_IPV6; - result = dns_dispatch_getudp(ifp->mgr->dispatchmgr, ns_g_socketmgr, - ns_g_taskmgr, &ifp->addr, - 4096, 1000, 32768, 8219, 8237, - attrs, attrmask, &ifp->udpdispatch); - if (result != ISC_R_SUCCESS) { - isc_log_write(IFMGR_COMMON_LOGARGS, ISC_LOG_ERROR, - "could not listen on UDP socket: %s", - isc_result_totext(result)); - goto udp_dispatch_failure; + + ifp->nudpdispatch = ISC_MIN(ns_g_udpdisp, MAX_UDP_DISPATCH); + for (disp = 0; disp < ifp->nudpdispatch; disp++) { + result = dns_dispatch_getudp_dup(ifp->mgr->dispatchmgr, + ns_g_socketmgr, + ns_g_taskmgr, &ifp->addr, + 4096, 1000, 32768, 8219, 8237, + attrs, attrmask, + &ifp->udpdispatch[disp], + disp == 0 + ? NULL + : ifp->udpdispatch[0]); + if (result != ISC_R_SUCCESS) { + isc_log_write(IFMGR_COMMON_LOGARGS, ISC_LOG_ERROR, + "could not listen on UDP socket: %s", + isc_result_totext(result)); + goto udp_dispatch_failure; + } + } - result = ns_clientmgr_createclients(ifp->clientmgr, ns_g_cpus, + result = ns_clientmgr_createclients(ifp->clientmgr, ifp->nudpdispatch, ifp, ISC_FALSE); if (result != ISC_R_SUCCESS) { UNEXPECTED_ERROR(__FILE__, __LINE__, @@ -279,12 +298,17 @@ ns_interface_listenudp(ns_interface_t *ifp) { isc_result_totext(result)); goto addtodispatch_failure; } + return (ISC_R_SUCCESS); addtodispatch_failure: - dns_dispatch_changeattributes(ifp->udpdispatch, 0, - DNS_DISPATCHATTR_NOLISTEN); - dns_dispatch_detach(&ifp->udpdispatch); + for (i = disp - 1; i <= 0; i--) { + dns_dispatch_changeattributes(ifp->udpdispatch[i], 0, + DNS_DISPATCHATTR_NOLISTEN); + dns_dispatch_detach(&(ifp->udpdispatch[i])); + } + ifp->nudpdispatch = 0; + udp_dispatch_failure: return (result); } @@ -398,15 +422,19 @@ ns_interface_shutdown(ns_interface_t *ifp) { static void ns_interface_destroy(ns_interface_t *ifp) { isc_mem_t *mctx = ifp->mgr->mctx; + int disp; + REQUIRE(NS_INTERFACE_VALID(ifp)); ns_interface_shutdown(ifp); - if (ifp->udpdispatch != NULL) { - dns_dispatch_changeattributes(ifp->udpdispatch, 0, - DNS_DISPATCHATTR_NOLISTEN); - dns_dispatch_detach(&ifp->udpdispatch); - } + for (disp = 0; disp < ifp->nudpdispatch; disp++) + if (ifp->udpdispatch[disp] != NULL) { + dns_dispatch_changeattributes(ifp->udpdispatch[disp], 0, + DNS_DISPATCHATTR_NOLISTEN); + dns_dispatch_detach(&(ifp->udpdispatch[disp])); + } + if (ifp->tcpsocket != NULL) isc_socket_detach(&ifp->tcpsocket); diff --git a/bin/named/logconf.c b/bin/named/logconf.c index f02b97f..b99a167 100644 --- a/bin/named/logconf.c +++ b/bin/named/logconf.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: logconf.c,v 1.42.816.3 2011/03/05 23:52:06 tbox Exp $ */ +/* $Id: logconf.c,v 1.45 2011/03/05 23:52:29 tbox Exp $ */ /*! \file */ diff --git a/bin/named/main.c b/bin/named/main.c index f6c929e..a546724 100644 --- a/bin/named/main.c +++ b/bin/named/main.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: main.c,v 1.180.14.4 2011/11/05 00:45:52 each Exp $ */ +/* $Id$ */ /*! \file */ @@ -418,7 +418,7 @@ parse_command_line(int argc, char *argv[]) { isc_commandline_errprint = ISC_FALSE; while ((ch = isc_commandline_parse(argc, argv, "46c:C:d:E:fFgi:lm:n:N:p:P:" - "sS:t:T:u:vVx:")) != -1) { + "sS:t:T:U:u:vVx:")) != -1) { switch (ch) { case '4': if (disable4) @@ -531,6 +531,11 @@ parse_command_line(int argc, char *argv[]) { fprintf(stderr, "unknown -T flag '%s\n", isc_commandline_argument); break; + case 'U': + ns_g_udpdisp = parse_int(isc_commandline_argument, + "number of UDP listeners " + "per interface"); + break; case 'u': ns_g_username = isc_commandline_argument; break; @@ -595,6 +600,18 @@ create_managers(void) { #else ns_g_cpus = 1; #endif +#ifdef WIN32 + ns_g_udpdisp = 1; +#else + if (ns_g_udpdisp == 0) + ns_g_udpdisp = ns_g_cpus_detected; + if (ns_g_udpdisp > ns_g_cpus) + ns_g_udpdisp = ns_g_cpus; +#endif + isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER, + ISC_LOG_INFO, "using %u UDP listener%s per interface", + ns_g_udpdisp, ns_g_udpdisp == 1 ? "" : "s"); + result = isc_taskmgr_create(ns_g_mctx, ns_g_cpus, 0, &ns_g_taskmgr); if (result != ISC_R_SUCCESS) { UNEXPECTED_ERROR(__FILE__, __LINE__, diff --git a/bin/named/named.8 b/bin/named/named.8 index 222ff42..b27be31 100644 --- a/bin/named/named.8 +++ b/bin/named/named.8 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004-2009, 2011, 2013 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001, 2003 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -33,7 +33,7 @@ named \- Internet domain name server .SH "SYNOPSIS" .HP 6 -\fBnamed\fR [\fB\-4\fR] [\fB\-6\fR] [\fB\-c\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-d\ \fR\fB\fIdebug\-level\fR\fR] [\fB\-E\ \fR\fB\fIengine\-name\fR\fR] [\fB\-f\fR] [\fB\-g\fR] [\fB\-m\ \fR\fB\fIflag\fR\fR] [\fB\-n\ \fR\fB\fI#cpus\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\fR] [\fB\-S\ \fR\fB\fI#max\-socks\fR\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR] [\fB\-v\fR] [\fB\-V\fR] [\fB\-x\ \fR\fB\fIcache\-file\fR\fR] +\fBnamed\fR [\fB\-4\fR] [\fB\-6\fR] [\fB\-c\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-d\ \fR\fB\fIdebug\-level\fR\fR] [\fB\-E\ \fR\fB\fIengine\-name\fR\fR] [\fB\-f\fR] [\fB\-g\fR] [\fB\-m\ \fR\fB\fIflag\fR\fR] [\fB\-n\ \fR\fB\fI#cpus\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\fR] [\fB\-S\ \fR\fB\fI#max\-socks\fR\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-U\ \fR\fB\fI#listeners\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR] [\fB\-v\fR] [\fB\-V\fR] [\fB\-x\ \fR\fB\fIcache\-file\fR\fR] .SH "DESCRIPTION" .PP \fBnamed\fR @@ -168,6 +168,19 @@ is defined allows a process with root privileges to escape a chroot jail. .RE .RE .PP +\-U \fI#listeners\fR +.RS 4 +Use +\fI#listeners\fR +worker threads to listen for incoming UDP packets on each address. If not specified, +\fBnamed\fR +will use the number of detected CPUs. If +\fB\-n\fR +has been set to a higher value than the number of CPUs, then +\fB\-U\fR +may be increased as high as that value, but no higher. +.RE +.PP \-u \fIuser\fR .RS 4 Setuid to @@ -267,7 +280,7 @@ BIND 9 Administrator Reference Manual. .PP Internet Systems Consortium .SH "COPYRIGHT" -Copyright \(co 2004\-2009 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004\-2009, 2011, 2013 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001, 2003 Internet Software Consortium. .br diff --git a/bin/named/named.conf.5 b/bin/named/named.conf.5 index 09b147e..8d01222 100644 --- a/bin/named/named.conf.5 +++ b/bin/named/named.conf.5 @@ -289,7 +289,8 @@ options { notify\-delay \fIseconds\fR; notify\-to\-soa \fIboolean\fR; also\-notify [ port \fIinteger\fR ] { ( \fIipv4_address\fR | \fIipv6_address\fR ) - [ port \fIinteger\fR ]; ... }; + [ port \fIinteger\fR ]; ... + [ key \fIkeyname\fR ] ... }; allow\-notify { \fIaddress_match_element\fR; ... }; forward ( first | only ); forwarders [ port \fIinteger\fR ] { @@ -458,7 +459,8 @@ view \fIstring\fR \fIoptional_class\fR { notify\-delay \fIseconds\fR; notify\-to\-soa \fIboolean\fR; also\-notify [ port \fIinteger\fR ] { ( \fIipv4_address\fR | \fIipv6_address\fR ) - [ port \fIinteger\fR ]; ... }; + [ port \fIinteger\fR ]; ... + [ key \fIkeyname\fR ] ... }; allow\-notify { \fIaddress_match_element\fR; ... }; forward ( first | only ); forwarders [ port \fIinteger\fR ] { @@ -502,7 +504,7 @@ view \fIstring\fR \fIoptional_class\fR { .RS 4 .nf zone \fIstring\fR \fIoptional_class\fR { - type ( master | slave | stub | hint | + type ( master | slave | stub | hint | redirect | forward | delegation\-only ); file \fIquoted_string\fR; masters [ port \fIinteger\fR ] { @@ -544,7 +546,8 @@ zone \fIstring\fR \fIoptional_class\fR { notify\-delay \fIseconds\fR; notify\-to\-soa \fIboolean\fR; also\-notify [ port \fIinteger\fR ] { ( \fIipv4_address\fR | \fIipv6_address\fR ) - [ port \fIinteger\fR ]; ... }; + [ port \fIinteger\fR ]; ... + [ key \fIkeyname\fR ] ... }; allow\-notify { \fIaddress_match_element\fR; ... }; forward ( first | only ); forwarders [ port \fIinteger\fR ] { @@ -560,6 +563,7 @@ zone \fIstring\fR \fIoptional_class\fR { max\-refresh\-time \fIinteger\fR; min\-refresh\-time \fIinteger\fR; multi\-master \fIboolean\fR; + request\-ixfr \fIboolean\fR; sig\-validity\-interval \fIinteger\fR; transfer\-source ( \fIipv4_address\fR | * ) [ port ( \fIinteger\fR | * ) ]; diff --git a/bin/named/named.conf.docbook b/bin/named/named.conf.docbook index 2527ac3..d778706 100644 --- a/bin/named/named.conf.docbook +++ b/bin/named/named.conf.docbook @@ -17,7 +17,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: named.conf.docbook,v 1.49.14.2 2011/11/07 00:31:47 marka Exp $ --> +<!-- $Id: named.conf.docbook,v 1.55 2011/11/07 00:25:53 each Exp $ --> <refentry> <refentryinfo> <date>Aug 13, 2004</date> @@ -326,7 +326,8 @@ options { notify-delay <replaceable>seconds</replaceable>; notify-to-soa <replaceable>boolean</replaceable>; also-notify <optional> port <replaceable>integer</replaceable> </optional> { ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> ) - <optional> port <replaceable>integer</replaceable> </optional>; ... }; + <optional> port <replaceable>integer</replaceable> </optional>; ... + <optional> key <replaceable>keyname</replaceable> </optional> ... }; allow-notify { <replaceable>address_match_element</replaceable>; ... }; forward ( first | only ); @@ -513,7 +514,8 @@ view <replaceable>string</replaceable> <replaceable>optional_class</replaceable> notify-delay <replaceable>seconds</replaceable>; notify-to-soa <replaceable>boolean</replaceable>; also-notify <optional> port <replaceable>integer</replaceable> </optional> { ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> ) - <optional> port <replaceable>integer</replaceable> </optional>; ... }; + <optional> port <replaceable>integer</replaceable> </optional>; ... + <optional> key <replaceable>keyname</replaceable> </optional> ... }; allow-notify { <replaceable>address_match_element</replaceable>; ... }; forward ( first | only ); @@ -563,7 +565,7 @@ view <replaceable>string</replaceable> <replaceable>optional_class</replaceable> <title>ZONE</title> <literallayout> zone <replaceable>string</replaceable> <replaceable>optional_class</replaceable> { - type ( master | slave | stub | hint | + type ( master | slave | stub | hint | redirect | forward | delegation-only ); file <replaceable>quoted_string</replaceable>; @@ -609,7 +611,8 @@ zone <replaceable>string</replaceable> <replaceable>optional_class</replaceable> notify-delay <replaceable>seconds</replaceable>; notify-to-soa <replaceable>boolean</replaceable>; also-notify <optional> port <replaceable>integer</replaceable> </optional> { ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> ) - <optional> port <replaceable>integer</replaceable> </optional>; ... }; + <optional> port <replaceable>integer</replaceable> </optional>; ... + <optional> key <replaceable>keyname</replaceable> </optional> ... }; allow-notify { <replaceable>address_match_element</replaceable>; ... }; forward ( first | only ); @@ -627,6 +630,7 @@ zone <replaceable>string</replaceable> <replaceable>optional_class</replaceable> max-refresh-time <replaceable>integer</replaceable>; min-refresh-time <replaceable>integer</replaceable>; multi-master <replaceable>boolean</replaceable>; + request-ixfr <replaceable>boolean</replaceable>; sig-validity-interval <replaceable>integer</replaceable>; transfer-source ( <replaceable>ipv4_address</replaceable> | * ) diff --git a/bin/named/named.conf.html b/bin/named/named.conf.html index a8b35ed..23d9391 100644 --- a/bin/named/named.conf.html +++ b/bin/named/named.conf.html @@ -21,7 +21,7 @@ <meta name="generator" content="DocBook XSL Stylesheets V1.71.1"> </head> <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en"> -<a name="id2476275"></a><div class="titlepage"></div> +<a name="id2476274"></a><div class="titlepage"></div> <div class="refnamediv"> <h2>Name</h2> <p><code class="filename">named.conf</code> — configuration file for named</p> @@ -31,7 +31,7 @@ <div class="cmdsynopsis"><p><code class="command">named.conf</code> </p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543356"></a><h2>DESCRIPTION</h2> +<a name="id2543357"></a><h2>DESCRIPTION</h2> <p><code class="filename">named.conf</code> is the configuration file for <span><strong class="command">named</strong></span>. Statements are enclosed @@ -50,14 +50,14 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543384"></a><h2>ACL</h2> +<a name="id2543385"></a><h2>ACL</h2> <div class="literallayout"><p><br> acl <em class="replaceable"><code>string</code></em> { <em class="replaceable"><code>address_match_element</code></em>; ... };<br> <br> </p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543400"></a><h2>KEY</h2> +<a name="id2543401"></a><h2>KEY</h2> <div class="literallayout"><p><br> key <em class="replaceable"><code>domain_name</code></em> {<br> algorithm <em class="replaceable"><code>string</code></em>;<br> @@ -66,7 +66,7 @@ key <em class="replaceable"><code>domain_name</code></em> {<br> </p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543419"></a><h2>MASTERS</h2> +<a name="id2543420"></a><h2>MASTERS</h2> <div class="literallayout"><p><br> masters <em class="replaceable"><code>string</code></em> [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] {<br> ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [<span class="optional">port <em class="replaceable"><code>integer</code></em></span>] |<br> @@ -75,7 +75,7 @@ masters <em class="replaceable"><code>string</code></em> [<span class="optional" </p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543465"></a><h2>SERVER</h2> +<a name="id2543466"></a><h2>SERVER</h2> <div class="literallayout"><p><br> server ( <em class="replaceable"><code>ipv4_address[<span class="optional">/prefixlen</span>]</code></em> | <em class="replaceable"><code>ipv6_address[<span class="optional">/prefixlen</span>]</code></em> ) {<br> bogus <em class="replaceable"><code>boolean</code></em>;<br> @@ -97,7 +97,7 @@ server ( <em class="replaceable"><code>ipv4_address[<span class="optional">/pref </p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543533"></a><h2>TRUSTED-KEYS</h2> +<a name="id2543534"></a><h2>TRUSTED-KEYS</h2> <div class="literallayout"><p><br> trusted-keys {<br> <em class="replaceable"><code>domain_name</code></em> <em class="replaceable"><code>flags</code></em> <em class="replaceable"><code>protocol</code></em> <em class="replaceable"><code>algorithm</code></em> <em class="replaceable"><code>key</code></em>; ... <br> @@ -105,7 +105,7 @@ trusted-keys {<br> </p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543559"></a><h2>MANAGED-KEYS</h2> +<a name="id2543560"></a><h2>MANAGED-KEYS</h2> <div class="literallayout"><p><br> managed-keys {<br> <em class="replaceable"><code>domain_name</code></em> <code class="constant">initial-key</code> <em class="replaceable"><code>flags</code></em> <em class="replaceable"><code>protocol</code></em> <em class="replaceable"><code>algorithm</code></em> <em class="replaceable"><code>key</code></em>; ... <br> @@ -113,7 +113,7 @@ managed-keys {<br> </p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543588"></a><h2>CONTROLS</h2> +<a name="id2543589"></a><h2>CONTROLS</h2> <div class="literallayout"><p><br> controls {<br> inet ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> | * )<br> @@ -125,7 +125,7 @@ controls {<br> </p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543623"></a><h2>LOGGING</h2> +<a name="id2543624"></a><h2>LOGGING</h2> <div class="literallayout"><p><br> logging {<br> channel <em class="replaceable"><code>string</code></em> {<br> @@ -143,7 +143,7 @@ logging {<br> </p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543661"></a><h2>LWRES</h2> +<a name="id2543662"></a><h2>LWRES</h2> <div class="literallayout"><p><br> lwres {<br> listen-on [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] {<br> @@ -156,7 +156,7 @@ lwres {<br> </p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543703"></a><h2>OPTIONS</h2> +<a name="id2543704"></a><h2>OPTIONS</h2> <div class="literallayout"><p><br> options {<br> avoid-v4-udp-ports { <em class="replaceable"><code>port</code></em>; ... };<br> @@ -291,7 +291,8 @@ options {<br> notify-delay <em class="replaceable"><code>seconds</code></em>;<br> notify-to-soa <em class="replaceable"><code>boolean</code></em>;<br> also-notify [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> )<br> - [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>]; ... };<br> + [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>]; ...<br> + [<span class="optional"> key <em class="replaceable"><code>keyname</code></em> </span>] ... };<br> allow-notify { <em class="replaceable"><code>address_match_element</code></em>; ... };<br> <br> forward ( first | only );<br> @@ -360,7 +361,7 @@ options {<br> </p></div> </div> <div class="refsect1" lang="en"> -<a name="id2544578"></a><h2>VIEW</h2> +<a name="id2544585"></a><h2>VIEW</h2> <div class="literallayout"><p><br> view <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>optional_class</code></em> {<br> match-clients { <em class="replaceable"><code>address_match_element</code></em>; ... };<br> @@ -477,7 +478,8 @@ view <em class="replaceable"><code>string</code></em> <em class="replaceable"><c notify-delay <em class="replaceable"><code>seconds</code></em>;<br> notify-to-soa <em class="replaceable"><code>boolean</code></em>;<br> also-notify [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> )<br> - [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>]; ... };<br> + [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>]; ...<br> + [<span class="optional"> key <em class="replaceable"><code>keyname</code></em> </span>] ... };<br> allow-notify { <em class="replaceable"><code>address_match_element</code></em>; ... };<br> <br> forward ( first | only );<br> @@ -523,10 +525,10 @@ view <em class="replaceable"><code>string</code></em> <em class="replaceable"><c </p></div> </div> <div class="refsect1" lang="en"> -<a name="id2545287"></a><h2>ZONE</h2> +<a name="id2545301"></a><h2>ZONE</h2> <div class="literallayout"><p><br> zone <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>optional_class</code></em> {<br> - type ( master | slave | stub | hint |<br> + type ( master | slave | stub | hint | redirect |<br> forward | delegation-only );<br> file <em class="replaceable"><code>quoted_string</code></em>;<br> <br> @@ -572,7 +574,8 @@ zone <em class="replaceable"><code>string</code></em> <em class="replaceable"><c notify-delay <em class="replaceable"><code>seconds</code></em>;<br> notify-to-soa <em class="replaceable"><code>boolean</code></em>;<br> also-notify [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> )<br> - [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>]; ... };<br> + [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>]; ...<br> + [<span class="optional"> key <em class="replaceable"><code>keyname</code></em> </span>] ... };<br> allow-notify { <em class="replaceable"><code>address_match_element</code></em>; ... };<br> <br> forward ( first | only );<br> @@ -590,6 +593,7 @@ zone <em class="replaceable"><code>string</code></em> <em class="replaceable"><c max-refresh-time <em class="replaceable"><code>integer</code></em>;<br> min-refresh-time <em class="replaceable"><code>integer</code></em>;<br> multi-master <em class="replaceable"><code>boolean</code></em>;<br> + request-ixfr <em class="replaceable"><code>boolean</code></em>;<br> sig-validity-interval <em class="replaceable"><code>integer</code></em>;<br> <br> transfer-source ( <em class="replaceable"><code>ipv4_address</code></em> | * )<br> @@ -618,12 +622,12 @@ zone <em class="replaceable"><code>string</code></em> <em class="replaceable"><c </p></div> </div> <div class="refsect1" lang="en"> -<a name="id2545667"></a><h2>FILES</h2> +<a name="id2545690"></a><h2>FILES</h2> <p><code class="filename">/etc/named.conf</code> </p> </div> <div class="refsect1" lang="en"> -<a name="id2545678"></a><h2>SEE ALSO</h2> +<a name="id2545702"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>, diff --git a/bin/named/named.docbook b/bin/named/named.docbook index c748911..1f08e19 100644 --- a/bin/named/named.docbook +++ b/bin/named/named.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [<!ENTITY mdash "—">]> <!-- - - Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004-2009, 2011, 2013 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001, 2003 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: named.docbook,v 1.26 2009/10/05 17:30:49 fdupont Exp $ --> +<!-- $Id: named.docbook,v 1.28 2011/11/09 23:46:23 tbox Exp $ --> <refentry id="man.named"> <refentryinfo> <date>May 21, 2009</date> @@ -43,6 +43,8 @@ <year>2007</year> <year>2008</year> <year>2009</year> + <year>2011</year> + <year>2013</year> <holder>Internet Systems Consortium, Inc. ("ISC")</holder> </copyright> <copyright> @@ -69,6 +71,7 @@ <arg><option>-s</option></arg> <arg><option>-S <replaceable class="parameter">#max-socks</replaceable></option></arg> <arg><option>-t <replaceable class="parameter">directory</replaceable></option></arg> + <arg><option>-U <replaceable class="parameter">#listeners</replaceable></option></arg> <arg><option>-u <replaceable class="parameter">user</replaceable></option></arg> <arg><option>-v</option></arg> <arg><option>-V</option></arg> @@ -282,6 +285,21 @@ </varlistentry> <varlistentry> + <term>-U <replaceable class="parameter">#listeners</replaceable></term> + <listitem> + <para> + Use <replaceable class="parameter">#listeners</replaceable> + worker threads to listen for incoming UDP packets on each + address. If not specified, <command>named</command> will + use the number of detected CPUs. If <option>-n</option> + has been set to a higher value than the number of CPUs, + then <option>-U</option> may be increased as high as that + value, but no higher. + </para> + </listitem> + </varlistentry> + + <varlistentry> <term>-u <replaceable class="parameter">user</replaceable></term> <listitem> <para>Setuid diff --git a/bin/named/named.html b/bin/named/named.html index cf3cb26..fc8de51 100644 --- a/bin/named/named.html +++ b/bin/named/named.html @@ -1,5 +1,5 @@ <!-- - - Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004-2009, 2011, 2013 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001, 2003 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -29,10 +29,10 @@ </div> <div class="refsynopsisdiv"> <h2>Synopsis</h2> -<div class="cmdsynopsis"><p><code class="command">named</code> [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine-name</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-S <em class="replaceable"><code>#max-socks</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-V</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div> +<div class="cmdsynopsis"><p><code class="command">named</code> [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine-name</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-S <em class="replaceable"><code>#max-socks</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-U <em class="replaceable"><code>#listeners</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-V</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543482"></a><h2>DESCRIPTION</h2> +<a name="id2543497"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">named</strong></span> is a Domain Name System (DNS) server, part of the BIND 9 distribution from ISC. For more @@ -47,7 +47,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543507"></a><h2>OPTIONS</h2> +<a name="id2543522"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-4</span></dt> <dd><p> @@ -178,6 +178,16 @@ </p> </div> </dd> +<dt><span class="term">-U <em class="replaceable"><code>#listeners</code></em></span></dt> +<dd><p> + Use <em class="replaceable"><code>#listeners</code></em> + worker threads to listen for incoming UDP packets on each + address. If not specified, <span><strong class="command">named</strong></span> will + use the number of detected CPUs. If <code class="option">-n</code> + has been set to a higher value than the number of CPUs, + then <code class="option">-U</code> may be increased as high as that + value, but no higher. + </p></dd> <dt><span class="term">-u <em class="replaceable"><code>user</code></em></span></dt> <dd> <p>Setuid @@ -228,7 +238,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2543964"></a><h2>SIGNALS</h2> +<a name="id2544012"></a><h2>SIGNALS</h2> <p> In routine operation, signals should not be used to control the nameserver; <span><strong class="command">rndc</strong></span> should be used @@ -249,7 +259,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2544012"></a><h2>CONFIGURATION</h2> +<a name="id2544060"></a><h2>CONFIGURATION</h2> <p> The <span><strong class="command">named</strong></span> configuration file is too complex to describe in detail here. A complete description is provided @@ -266,7 +276,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2544049"></a><h2>FILES</h2> +<a name="id2544233"></a><h2>FILES</h2> <div class="variablelist"><dl> <dt><span class="term"><code class="filename">/etc/named.conf</code></span></dt> <dd><p> @@ -279,7 +289,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2544088"></a><h2>SEE ALSO</h2> +<a name="id2544273"></a><h2>SEE ALSO</h2> <p><em class="citetitle">RFC 1033</em>, <em class="citetitle">RFC 1034</em>, <em class="citetitle">RFC 1035</em>, @@ -292,7 +302,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2544295"></a><h2>AUTHOR</h2> +<a name="id2544343"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/bin/named/query.c b/bin/named/query.c index 8c58984..5093cb2 100644 --- a/bin/named/query.c +++ b/bin/named/query.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: query.c,v 1.353.8.24 2012/02/07 01:14:39 marka Exp $ */ +/* $Id$ */ /*! \file */ @@ -172,39 +172,66 @@ rpz_st_clear(ns_client_t *client); static inline void inc_stats(ns_client_t *client, isc_statscounter_t counter) { dns_zone_t *zone = client->query.authzone; + isc_stats_t *zonestats; +#ifdef NEWSTATS + dns_rdatatype_t qtype; + dns_rdataset_t *rdataset; + dns_stats_t *querystats = NULL; +#endif isc_stats_increment(ns_g_server->nsstats, counter); - if (zone != NULL) { - isc_stats_t *zonestats = dns_zone_getrequeststats(zone); - if (zonestats != NULL) - isc_stats_increment(zonestats, counter); + if (zone == NULL) + return; + + /* Do regular response type stats */ + zonestats = dns_zone_getrequeststats(zone); + + if (zonestats != NULL) + isc_stats_increment(zonestats, counter); + +#ifdef NEWSTATS + /* Do query type statistics + * + * We only increment per-type if we're using the authoriative + * answer counter, preventing double-counting. + */ + if (counter == dns_nsstatscounter_authans) { + querystats = dns_zone_getrcvquerystats(zone); + if (querystats != NULL) { + rdataset = ISC_LIST_HEAD(client->query.qname->list); + if (rdataset != NULL) { + qtype = rdataset->type; + dns_rdatatypestats_increment(querystats, qtype); + } + } } +#endif } static void query_send(ns_client_t *client) { isc_statscounter_t counter; + if ((client->message->flags & DNS_MESSAGEFLAG_AA) == 0) inc_stats(client, dns_nsstatscounter_nonauthans); else inc_stats(client, dns_nsstatscounter_authans); + if (client->message->rcode == dns_rcode_noerror) { - if (ISC_LIST_EMPTY(client->message->sections[DNS_SECTION_ANSWER])) { - if (client->query.isreferral) { + dns_section_t answer = DNS_SECTION_ANSWER; + if (ISC_LIST_EMPTY(client->message->sections[answer])) { + if (client->query.isreferral) counter = dns_nsstatscounter_referral; - } else { + else counter = dns_nsstatscounter_nxrrset; - } - } else { + } else counter = dns_nsstatscounter_success; - } - } else if (client->message->rcode == dns_rcode_nxdomain) { + } else if (client->message->rcode == dns_rcode_nxdomain) counter = dns_nsstatscounter_nxdomain; - } else { - /* We end up here in case of YXDOMAIN, and maybe others */ + else /* We end up here in case of YXDOMAIN, and maybe others */ counter = dns_nsstatscounter_failure; - } + inc_stats(client, counter); ns_client_send(client); } @@ -1180,6 +1207,8 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) { isc_boolean_t added_something, need_addname; dns_zone_t *zone; dns_rdatatype_t type; + dns_clientinfomethods_t cm; + dns_clientinfo_t ci; REQUIRE(NS_CLIENT_VALID(client)); REQUIRE(qtype != dns_rdatatype_any); @@ -1204,6 +1233,9 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) { need_addname = ISC_FALSE; zone = NULL; + dns_clientinfomethods_init(&cm, ns_client_sourceip); + dns_clientinfo_init(&ci, client); + /* * We treat type A additional section processing as if it * were "any address type" additional section processing. @@ -1248,9 +1280,10 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) { * necessarily in the same database. */ node = NULL; - result = dns_db_find(db, name, version, type, client->query.dboptions, - client->now, &node, fname, rdataset, - sigrdataset); + result = dns_db_findext(db, name, version, type, + client->query.dboptions, + client->now, &node, fname, &cm, &ci, + rdataset, sigrdataset); if (result == ISC_R_SUCCESS) { if (sigrdataset != NULL && !dns_db_issecure(db) && dns_rdataset_isassociated(sigrdataset)) @@ -1286,11 +1319,11 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) { if (sigrdataset == NULL) goto cleanup; } - result = dns_db_find(db, name, version, type, - client->query.dboptions | - DNS_DBFIND_GLUEOK | DNS_DBFIND_ADDITIONALOK, - client->now, &node, fname, rdataset, - sigrdataset); + result = dns_db_findext(db, name, version, type, + client->query.dboptions | + DNS_DBFIND_GLUEOK | DNS_DBFIND_ADDITIONALOK, + client->now, &node, fname, &cm, &ci, + rdataset, sigrdataset); if (result == DNS_R_GLUE && validate(client, db, fname, rdataset, sigrdataset)) result = ISC_R_SUCCESS; @@ -1333,10 +1366,10 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) { goto cleanup; dns_db_attach(client->query.gluedb, &db); - result = dns_db_find(db, name, version, type, - client->query.dboptions | DNS_DBFIND_GLUEOK, - client->now, &node, fname, rdataset, - sigrdataset); + result = dns_db_findext(db, name, version, type, + client->query.dboptions | DNS_DBFIND_GLUEOK, + client->now, &node, fname, &cm, &ci, + rdataset, sigrdataset); if (!(result == ISC_R_SUCCESS || result == DNS_R_ZONECUT || result == DNS_R_GLUE)) @@ -1410,8 +1443,8 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) { goto aaaa_lookup; result = dns_db_findrdataset(db, node, version, dns_rdatatype_a, 0, - client->now, rdataset, - sigrdataset); + client->now, + rdataset, sigrdataset); if (result == DNS_R_NCACHENXDOMAIN) goto addname; if (result == DNS_R_NCACHENXRRSET) { @@ -1461,8 +1494,8 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) { goto addname; result = dns_db_findrdataset(db, node, version, dns_rdatatype_aaaa, 0, - client->now, rdataset, - sigrdataset); + client->now, + rdataset, sigrdataset); if (result == DNS_R_NCACHENXDOMAIN) goto addname; if (result == DNS_R_NCACHENXRRSET) { @@ -1636,6 +1669,8 @@ query_addadditional2(void *arg, dns_name_t *name, dns_rdatatype_t qtype) { dns_zone_t *zone; dns_rdatatype_t type; dns_rdatasetadditional_t additionaltype; + dns_clientinfomethods_t cm; + dns_clientinfo_t ci; /* * If we don't have an additional cache call query_addadditional. @@ -1674,6 +1709,8 @@ query_addadditional2(void *arg, dns_name_t *name, dns_rdatatype_t qtype) { POST(needadditionalcache); additionaltype = dns_rdatasetadditional_fromauth; dns_name_init(&cfname, NULL); + dns_clientinfomethods_init(&cm, ns_client_sourceip); + dns_clientinfo_init(&ci, client); CTRACE("query_addadditional2"); @@ -1776,8 +1813,10 @@ query_addadditional2(void *arg, dns_name_t *name, dns_rdatatype_t qtype) { * necessarily in the same database. */ node = NULL; - result = dns_db_find(db, name, version, type, client->query.dboptions, - client->now, &node, fname, NULL, NULL); + result = dns_db_findext(db, name, version, type, + client->query.dboptions, + client->now, &node, fname, &cm, &ci, + NULL, NULL); if (result == ISC_R_SUCCESS) goto found; @@ -1804,10 +1843,11 @@ query_addadditional2(void *arg, dns_name_t *name, dns_rdatatype_t qtype) { */ goto try_glue; - result = dns_db_find(db, name, version, type, - client->query.dboptions | - DNS_DBFIND_GLUEOK | DNS_DBFIND_ADDITIONALOK, - client->now, &node, fname, NULL, NULL); + result = dns_db_findext(db, name, version, type, + client->query.dboptions | + DNS_DBFIND_GLUEOK | DNS_DBFIND_ADDITIONALOK, + client->now, &node, fname, &cm, &ci, + NULL, NULL); if (result == ISC_R_SUCCESS) goto found; @@ -1876,9 +1916,10 @@ query_addadditional2(void *arg, dns_name_t *name, dns_rdatatype_t qtype) { findglue: dns_db_attach(client->query.gluedb, &db); - result = dns_db_find(db, name, version, type, - client->query.dboptions | DNS_DBFIND_GLUEOK, - client->now, &node, fname, NULL, NULL); + result = dns_db_findext(db, name, version, type, + client->query.dboptions | DNS_DBFIND_GLUEOK, + client->now, &node, fname, &cm, &ci, + NULL, NULL); if (!(result == ISC_R_SUCCESS || result == DNS_R_ZONECUT || result == DNS_R_GLUE)) { @@ -2528,6 +2569,8 @@ query_addsoa(ns_client_t *client, dns_db_t *db, dns_dbversion_t *version, isc_result_t result, eresult; dns_rdataset_t *rdataset = NULL, *sigrdataset = NULL; dns_rdataset_t **sigrdatasetp = NULL; + dns_clientinfomethods_t cm; + dns_clientinfo_t ci; CTRACE("query_addsoa"); /* @@ -2538,6 +2581,9 @@ query_addsoa(ns_client_t *client, dns_db_t *db, dns_dbversion_t *version, rdataset = NULL; node = NULL; + dns_clientinfomethods_init(&cm, ns_client_sourceip); + dns_clientinfo_init(&ci, client); + /* * Don't add the SOA record for test which set "-T nosoa". */ @@ -2571,9 +2617,8 @@ query_addsoa(ns_client_t *client, dns_db_t *db, dns_dbversion_t *version, result = dns_db_getoriginnode(db, &node); if (result == ISC_R_SUCCESS) { result = dns_db_findrdataset(db, node, version, - dns_rdatatype_soa, - 0, client->now, rdataset, - sigrdataset); + dns_rdatatype_soa, 0, client->now, + rdataset, sigrdataset); } else { dns_fixedname_t foundname; dns_name_t *fname; @@ -2581,9 +2626,9 @@ query_addsoa(ns_client_t *client, dns_db_t *db, dns_dbversion_t *version, dns_fixedname_init(&foundname); fname = dns_fixedname_name(&foundname); - result = dns_db_find(db, name, version, dns_rdatatype_soa, - client->query.dboptions, 0, &node, - fname, rdataset, sigrdataset); + result = dns_db_findext(db, name, version, dns_rdatatype_soa, + client->query.dboptions, 0, &node, + fname, &cm, &ci, rdataset, sigrdataset); } if (result != ISC_R_SUCCESS) { /* @@ -2648,6 +2693,8 @@ query_addns(ns_client_t *client, dns_db_t *db, dns_dbversion_t *version) { dns_fixedname_t foundname; dns_rdataset_t *rdataset = NULL, *sigrdataset = NULL; dns_rdataset_t **sigrdatasetp = NULL; + dns_clientinfomethods_t cm; + dns_clientinfo_t ci; CTRACE("query_addns"); /* @@ -2659,6 +2706,8 @@ query_addns(ns_client_t *client, dns_db_t *db, dns_dbversion_t *version) { node = NULL; dns_fixedname_init(&foundname); fname = dns_fixedname_name(&foundname); + dns_clientinfomethods_init(&cm, ns_client_sourceip); + dns_clientinfo_init(&ci, client); /* * Get resources and make 'name' be the database origin. @@ -2691,14 +2740,13 @@ query_addns(ns_client_t *client, dns_db_t *db, dns_dbversion_t *version) { result = dns_db_getoriginnode(db, &node); if (result == ISC_R_SUCCESS) { result = dns_db_findrdataset(db, node, version, - dns_rdatatype_ns, - 0, client->now, rdataset, - sigrdataset); + dns_rdatatype_ns, 0, client->now, + rdataset, sigrdataset); } else { CTRACE("query_addns: calling dns_db_find"); - result = dns_db_find(db, name, NULL, dns_rdatatype_ns, - client->query.dboptions, 0, &node, - fname, rdataset, sigrdataset); + result = dns_db_findext(db, name, NULL, dns_rdatatype_ns, + client->query.dboptions, 0, &node, + fname, &cm, &ci, rdataset, sigrdataset); CTRACE("query_addns: dns_db_find complete"); } if (result != ISC_R_SUCCESS) { @@ -2820,15 +2868,19 @@ mark_secure(ns_client_t *client, dns_db_t *db, dns_name_t *name, { isc_result_t result; dns_dbnode_t *node = NULL; + dns_clientinfomethods_t cm; + dns_clientinfo_t ci; isc_stdtime_t now; rdataset->trust = dns_trust_secure; sigrdataset->trust = dns_trust_secure; + dns_clientinfomethods_init(&cm, ns_client_sourceip); + dns_clientinfo_init(&ci, client); /* * Save the updated secure state. Ignore failures. */ - result = dns_db_findnode(db, name, ISC_TRUE, &node); + result = dns_db_findnodeext(db, name, ISC_TRUE, &cm, &ci, &node); if (result != ISC_R_SUCCESS) return; @@ -2856,9 +2908,15 @@ get_key(ns_client_t *client, dns_db_t *db, dns_rdata_rrsig_t *rrsig, isc_result_t result; dns_dbnode_t *node = NULL; isc_boolean_t secure = ISC_FALSE; + dns_clientinfomethods_t cm; + dns_clientinfo_t ci; + + dns_clientinfomethods_init(&cm, ns_client_sourceip); + dns_clientinfo_init(&ci, client); if (!dns_rdataset_isassociated(keyrdataset)) { - result = dns_db_findnode(db, &rrsig->signer, ISC_FALSE, &node); + result = dns_db_findnodeext(db, &rrsig->signer, ISC_FALSE, + &cm, &ci, &node); if (result != ISC_R_SUCCESS) return (ISC_FALSE); @@ -2901,7 +2959,7 @@ get_key(ns_client_t *client, dns_db_t *db, dns_rdata_rrsig_t *rrsig, static isc_boolean_t verify(dst_key_t *key, dns_name_t *name, dns_rdataset_t *rdataset, - dns_rdata_t *rdata, isc_mem_t *mctx, isc_boolean_t acceptexpired) + dns_rdata_t *rdata, ns_client_t *client) { isc_result_t result; dns_fixedname_t fixed; @@ -2910,9 +2968,10 @@ verify(dst_key_t *key, dns_name_t *name, dns_rdataset_t *rdataset, dns_fixedname_init(&fixed); again: - result = dns_dnssec_verify2(name, rdataset, key, ignore, mctx, + result = dns_dnssec_verify3(name, rdataset, key, ignore, + client->view->maxbits, client->mctx, rdata, NULL); - if (result == DNS_R_SIGEXPIRED && acceptexpired) { + if (result == DNS_R_SIGEXPIRED && client->view->acceptexpired) { ignore = ISC_TRUE; goto again; } @@ -2955,8 +3014,7 @@ validate(ns_client_t *client, dns_db_t *db, dns_name_t *name, do { if (!get_key(client, db, &rrsig, &keyrdataset, &key)) break; - if (verify(key, name, rdataset, &rdata, client->mctx, - client->view->acceptexpired)) { + if (verify(key, name, rdataset, &rdata, client)) { dst_key_free(&key); dns_rdataset_disassociate(&keyrdataset); mark_secure(client, db, name, &rrsig, @@ -2983,6 +3041,8 @@ query_addbestns(ns_client_t *client) { dns_dbversion_t *version; dns_zone_t *zone; isc_buffer_t b; + dns_clientinfomethods_t cm; + dns_clientinfo_t ci; CTRACE("query_addbestns"); fname = NULL; @@ -2999,6 +3059,9 @@ query_addbestns(ns_client_t *client) { is_zone = ISC_FALSE; use_zone = ISC_FALSE; + dns_clientinfomethods_init(&cm, ns_client_sourceip); + dns_clientinfo_init(&ci, client); + /* * Find the right database. */ @@ -3032,10 +3095,11 @@ query_addbestns(ns_client_t *client) { * Now look for the zonecut. */ if (is_zone) { - result = dns_db_find(db, client->query.qname, version, - dns_rdatatype_ns, client->query.dboptions, - client->now, &node, fname, - rdataset, sigrdataset); + result = dns_db_findext(db, client->query.qname, version, + dns_rdatatype_ns, + client->query.dboptions, + client->now, &node, fname, + &cm, &ci, rdataset, sigrdataset); if (result != DNS_R_DELEGATION) goto cleanup; if (USECACHE(client)) { @@ -3312,6 +3376,8 @@ query_addwildcardproof(ns_client_t *client, dns_db_t *db, int order; dns_fixedname_t cfixed; dns_name_t *cname; + dns_clientinfomethods_t cm; + dns_clientinfo_t ci; CTRACE("query_addwildcardproof"); fname = NULL; @@ -3319,6 +3385,9 @@ query_addwildcardproof(ns_client_t *client, dns_db_t *db, sigrdataset = NULL; node = NULL; + dns_clientinfomethods_init(&cm, ns_client_sourceip); + dns_clientinfo_init(&ci, client); + /* * Get the NOQNAME proof then if !ispositive * get the NOWILDCARD proof. @@ -3378,8 +3447,9 @@ query_addwildcardproof(ns_client_t *client, dns_db_t *db, if (fname == NULL || rdataset == NULL || sigrdataset == NULL) goto cleanup; - result = dns_db_find(db, name, version, dns_rdatatype_nsec, options, - 0, &node, fname, rdataset, sigrdataset); + result = dns_db_findext(db, name, version, dns_rdatatype_nsec, + options, 0, &node, fname, &cm, &ci, + rdataset, sigrdataset); if (node != NULL) dns_db_detachnode(db, &node); @@ -3401,10 +3471,10 @@ query_addwildcardproof(ns_client_t *client, dns_db_t *db, if (labels == 0U) goto cleanup; dns_name_split(cname, labels, NULL, cname); - result = dns_db_find(db, cname, version, - dns_rdatatype_nsec, - options, 0, NULL, fname, - NULL, NULL); + result = dns_db_findext(db, cname, version, + dns_rdatatype_nsec, + options, 0, NULL, fname, + &cm, &ci, NULL, NULL); } /* * Add closest (provable) encloser NSEC3. @@ -3904,6 +3974,11 @@ rpz_rrset_find(ns_client_t *client, dns_rpz_type_t rpz_type, dns_fixedname_t fixed; dns_name_t *found; isc_result_t result; + dns_clientinfomethods_t cm; + dns_clientinfo_t ci; + + dns_clientinfomethods_init(&cm, ns_client_sourceip); + dns_clientinfo_init(&ci, client); st = client->query.rpz_st; if ((st->state & DNS_RPZ_RECURSING) != 0) { @@ -3959,8 +4034,9 @@ rpz_rrset_find(ns_client_t *client, dns_rpz_type_t rpz_type, node = NULL; dns_fixedname_init(&fixed); found = dns_fixedname_name(&fixed); - result = dns_db_find(*dbp, name, version, type, DNS_DBFIND_GLUEOK, - client->now, &node, found, *rdatasetp, NULL); + result = dns_db_findext(*dbp, name, version, type, DNS_DBFIND_GLUEOK, + client->now, &node, found, + &cm, &ci, *rdatasetp, NULL); if (result == DNS_R_DELEGATION && is_zone && USECACHE(client)) { /* * Try the cache if we're authoritative for an @@ -3969,9 +4045,9 @@ rpz_rrset_find(ns_client_t *client, dns_rpz_type_t rpz_type, rpz_clean(NULL, dbp, &node, rdatasetp); version = NULL; dns_db_attach(client->view->cachedb, dbp); - result = dns_db_find(*dbp, name, version, dns_rdatatype_ns, - 0, client->now, &node, found, - *rdatasetp, NULL); + result = dns_db_findext(*dbp, name, version, dns_rdatatype_ns, + 0, client->now, &node, found, + &cm, &ci, *rdatasetp, NULL); } rpz_clean(NULL, dbp, &node, NULL); if (result == DNS_R_DELEGATION) { @@ -4169,9 +4245,14 @@ rpz_find(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qnamef, dns_fixedname_t fixed; dns_name_t *found; isc_result_t result; + dns_clientinfomethods_t cm; + dns_clientinfo_t ci; REQUIRE(nodep != NULL); + dns_clientinfomethods_init(&cm, ns_client_sourceip); + dns_clientinfo_init(&ci, client); + result = rpz_ready(client, zonep, dbp, nodep, rdatasetp); if (result != ISC_R_SUCCESS) { *policyp = DNS_RPZ_POLICY_ERROR; @@ -4191,8 +4272,9 @@ rpz_find(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qnamef, dns_fixedname_init(&fixed); found = dns_fixedname_name(&fixed); - result = dns_db_find(*dbp, qnamef, *versionp, dns_rdatatype_any, 0, - client->now, nodep, found, *rdatasetp, NULL); + result = dns_db_findext(*dbp, qnamef, *versionp, dns_rdatatype_any, 0, + client->now, nodep, found, &cm, &ci, + *rdatasetp, NULL); if (result == ISC_R_SUCCESS) { dns_rdatasetiter_t *rdsiter; @@ -4236,10 +4318,10 @@ rpz_find(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qnamef, qtype == dns_rdatatype_sig) result = DNS_R_NXRRSET; else - result = dns_db_find(*dbp, qnamef, *versionp, - qtype, 0, client->now, - nodep, found, *rdatasetp, - NULL); + result = dns_db_findext(*dbp, qnamef, *versionp, + qtype, 0, client->now, + nodep, found, &cm, &ci, + *rdatasetp, NULL); } } switch (result) { @@ -5183,6 +5265,8 @@ query_findclosestnsec3(dns_name_t *qname, dns_db_t *db, dns_rdata_nsec3_t nsec3; dns_rdata_t rdata = DNS_RDATA_INIT; isc_boolean_t optout; + dns_clientinfomethods_t cm; + dns_clientinfo_t ci; salt_length = sizeof(salt); result = dns_db_getnsec3parameters(db, version, &hash, NULL, @@ -5192,6 +5276,8 @@ query_findclosestnsec3(dns_name_t *qname, dns_db_t *db, dns_name_init(&name, NULL); dns_name_clone(qname, &name); + dns_clientinfomethods_init(&cm, ns_client_sourceip); + dns_clientinfo_init(&ci, client); /* * Map unknown algorithm to known value. @@ -5208,9 +5294,9 @@ query_findclosestnsec3(dns_name_t *qname, dns_db_t *db, return; dboptions = client->query.dboptions | DNS_DBFIND_FORCENSEC3; - result = dns_db_find(db, dns_fixedname_name(&fixed), version, - dns_rdatatype_nsec3, dboptions, client->now, - NULL, fname, rdataset, sigrdataset); + result = dns_db_findext(db, dns_fixedname_name(&fixed), version, + dns_rdatatype_nsec3, dboptions, client->now, + NULL, fname, &cm, &ci, rdataset, sigrdataset); if (result == DNS_R_NXDOMAIN) { if (!dns_rdataset_isassociated(rdataset)) { @@ -5350,6 +5436,121 @@ dns64_aaaaok(ns_client_t *client, dns_rdataset_t *rdataset, } /* + * Look for the name and type in the redirection zone. If found update + * the arguments as appropriate. Return ISC_TRUE if a update was + * performed. + * + * Only perform the update if the client is in the allow query acl and + * returning the update would not cause a DNSSEC validation failure. + */ +static isc_boolean_t +redirect(ns_client_t *client, dns_name_t *name, dns_rdataset_t *rdataset, + dns_dbnode_t **nodep, dns_db_t **dbp, dns_dbversion_t **versionp, + dns_rdatatype_t qtype) +{ + dns_db_t *db = NULL; + dns_dbnode_t *node = NULL; + dns_fixedname_t fixed; + dns_name_t *found; + dns_rdataset_t trdataset; + isc_result_t result; + dns_rdatatype_t type; + dns_clientinfomethods_t cm; + dns_clientinfo_t ci; + ns_dbversion_t *dbversion; + + CTRACE("redirect"); + + if (client->view->redirect == NULL) + return (ISC_FALSE); + + dns_fixedname_init(&fixed); + found = dns_fixedname_name(&fixed); + dns_rdataset_init(&trdataset); + + dns_clientinfomethods_init(&cm, ns_client_sourceip); + dns_clientinfo_init(&ci, client); + + if (WANTDNSSEC(client) && dns_db_iszone(*dbp) && dns_db_issecure(*dbp)) + return (ISC_FALSE); + + if (WANTDNSSEC(client) && dns_rdataset_isassociated(rdataset)) { + if (rdataset->trust == dns_trust_secure) + return (ISC_FALSE); + if (rdataset->trust == dns_trust_ultimate && + (rdataset->type == dns_rdatatype_nsec || + rdataset->type == dns_rdatatype_nsec3)) + return (ISC_FALSE); + if ((rdataset->attributes & DNS_RDATASETATTR_NEGATIVE) != 0) { + for (result = dns_rdataset_first(rdataset); + result == ISC_R_SUCCESS; + result = dns_rdataset_next(rdataset)) { + dns_ncache_current(rdataset, found, &trdataset); + type = trdataset.type; + dns_rdataset_disassociate(&trdataset); + if (type == dns_rdatatype_nsec || + type == dns_rdatatype_nsec3 || + type == dns_rdatatype_rrsig) + return (ISC_FALSE); + } + } + } + + result = ns_client_checkaclsilent(client, NULL, + dns_zone_getqueryacl(client->view->redirect), + ISC_TRUE); + if (result != ISC_R_SUCCESS) + return (ISC_FALSE); + + result = dns_zone_getdb(client->view->redirect, &db); + if (result != ISC_R_SUCCESS) + return (ISC_FALSE); + + dbversion = query_findversion(client, db); + if (dbversion == NULL) { + dns_db_detach(&db); + return (ISC_FALSE); + } + + /* + * Lookup the requested data in the redirect zone. + */ + result = dns_db_findext(db, client->query.qname, dbversion->version, + qtype, 0, client->now, &node, found, &cm, &ci, + &trdataset, NULL); + if (result != ISC_R_SUCCESS) { + if (dns_rdataset_isassociated(&trdataset)) + dns_rdataset_disassociate(&trdataset); + if (node != NULL) + dns_db_detachnode(db, &node); + dns_db_detach(&db); + return (ISC_FALSE); + } + CTRACE("redirect: found data: done"); + + dns_name_copy(found, name, NULL); + if (dns_rdataset_isassociated(rdataset)) + dns_rdataset_disassociate(rdataset); + if (dns_rdataset_isassociated(&trdataset)) { + dns_rdataset_clone(&trdataset, rdataset); + dns_rdataset_disassociate(&trdataset); + } + if (*nodep != NULL) + dns_db_detachnode(*dbp, nodep); + dns_db_detach(dbp); + dns_db_attachnode(db, node, nodep); + dns_db_attach(db, dbp); + dns_db_detachnode(db, &node); + dns_db_detach(&db); + *versionp = dbversion->version; + + client->query.attributes |= (NS_QUERYATTR_NOAUTHORITY | + NS_QUERYATTR_NOADDITIONAL); + + return (ISC_TRUE); +} + +/* * Do the bulk of query processing for the current query of 'client'. * If 'event' is non-NULL, we are returning from recursion and 'qtype' * is ignored. Otherwise, 'qtype' is the query type. @@ -5387,6 +5588,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) isc_boolean_t resuming; int line = -1; isc_boolean_t dns64_exclude, dns64; + dns_clientinfomethods_t cm; + dns_clientinfo_t ci; CTRACE("query_find"); @@ -5418,6 +5621,9 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) is_zone = ISC_FALSE; is_staticstub_zone = ISC_FALSE; + dns_clientinfomethods_init(&cm, ns_client_sourceip); + dns_clientinfo_init(&ci, client); + if (event != NULL) { /* * We're returning from recursion. Restore the query context @@ -5652,9 +5858,9 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) /* * Now look for an answer in the database. */ - result = dns_db_find(db, client->query.qname, version, type, - client->query.dboptions, client->now, - &node, fname, rdataset, sigrdataset); + result = dns_db_findext(db, client->query.qname, version, type, + client->query.dboptions, client->now, + &node, fname, &cm, &ci, rdataset, sigrdataset); resume: CTRACE("query_find: resume"); @@ -5828,10 +6034,11 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) result = ISC_R_FAILURE; } else { dns_db_attach(client->view->hints, &db); - result = dns_db_find(db, dns_rootname, - NULL, dns_rdatatype_ns, - 0, client->now, &node, fname, - rdataset, sigrdataset); + result = dns_db_findext(db, dns_rootname, + NULL, dns_rdatatype_ns, + 0, client->now, &node, + fname, &cm, &ci, + rdataset, sigrdataset); } if (result != ISC_R_SUCCESS) { /* @@ -6301,6 +6508,10 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) case DNS_R_NXDOMAIN: INSIST(is_zone); + if (!empty_wild && + redirect(client, fname, rdataset, &node, &db, &version, + type)) + break; if (dns_rdataset_isassociated(rdataset)) { /* * If we've got a NSEC record, we need to save the @@ -6360,6 +6571,9 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) goto cleanup; case DNS_R_NCACHENXDOMAIN: + if (redirect(client, fname, rdataset, &node, &db, &version, + type)) + break; case DNS_R_NCACHENXRRSET: ncache_nxrrset: INSIST(!is_zone); @@ -6862,9 +7076,9 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) if (qtype == dns_rdatatype_aaaa) { trdataset = query_newrdataset(client); result = dns_db_findrdataset(db, node, version, - dns_rdatatype_a, 0, - client->now, - trdataset, NULL); + dns_rdatatype_a, 0, + client->now, + trdataset, NULL); if (dns_rdataset_isassociated(trdataset)) dns_rdataset_disassociate(trdataset); query_putrdataset(client, &trdataset); @@ -7340,6 +7554,7 @@ ns_query_start(ns_client_t *client) { INSIST(rdataset != NULL); qtype = rdataset->type; dns_rdatatypestats_increment(ns_g_server->rcvquerystats, qtype); + if (dns_rdatatype_ismeta(qtype)) { switch (qtype) { case dns_rdatatype_any: diff --git a/bin/named/server.c b/bin/named/server.c index 05c68b9..aef922b 100644 --- a/bin/named/server.c +++ b/bin/named/server.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: server.c,v 1.599.8.19 2012/02/22 00:33:32 each Exp $ */ +/* $Id$ */ /*! \file */ @@ -34,11 +34,13 @@ #include <isc/entropy.h> #include <isc/file.h> #include <isc/hash.h> +#include <isc/hex.h> #include <isc/httpd.h> #include <isc/lex.h> #include <isc/parseint.h> #include <isc/portset.h> #include <isc/print.h> +#include <isc/refcount.h> #include <isc/resource.h> #include <isc/sha2.h> #include <isc/socket.h> @@ -72,6 +74,7 @@ #include <dns/order.h> #include <dns/peer.h> #include <dns/portlist.h> +#include <dns/private.h> #include <dns/rbt.h> #include <dns/rdataclass.h> #include <dns/rdataset.h> @@ -112,6 +115,10 @@ #define PATH_MAX 1024 #endif +#ifndef SIZE_MAX +#define SIZE_MAX ((size_t)-1) +#endif + /*% * Check an operation for failure. Assumes that the function * using it has a 'result' variable and a 'cleanup' label. @@ -215,122 +222,129 @@ struct cfg_context { cfg_aclconfctx_t * actx; }; +/*% + * Holds state information for the initial zone loading process. + * Uses the isc_refcount structure to count the number of views + * with pending zone loads, dereferencing as each view finishes. + */ +typedef struct { + ns_server_t *server; + isc_refcount_t refs; +} ns_zoneload_t; + /* * These zones should not leak onto the Internet. */ -static const struct { - const char *zone; - isc_boolean_t rfc1918; -} empty_zones[] = { +const char *empty_zones[] = { /* RFC 1918 */ - { "10.IN-ADDR.ARPA", ISC_TRUE }, - { "16.172.IN-ADDR.ARPA", ISC_TRUE }, - { "17.172.IN-ADDR.ARPA", ISC_TRUE }, - { "18.172.IN-ADDR.ARPA", ISC_TRUE }, - { "19.172.IN-ADDR.ARPA", ISC_TRUE }, - { "20.172.IN-ADDR.ARPA", ISC_TRUE }, - { "21.172.IN-ADDR.ARPA", ISC_TRUE }, - { "22.172.IN-ADDR.ARPA", ISC_TRUE }, - { "23.172.IN-ADDR.ARPA", ISC_TRUE }, - { "24.172.IN-ADDR.ARPA", ISC_TRUE }, - { "25.172.IN-ADDR.ARPA", ISC_TRUE }, - { "26.172.IN-ADDR.ARPA", ISC_TRUE }, - { "27.172.IN-ADDR.ARPA", ISC_TRUE }, - { "28.172.IN-ADDR.ARPA", ISC_TRUE }, - { "29.172.IN-ADDR.ARPA", ISC_TRUE }, - { "30.172.IN-ADDR.ARPA", ISC_TRUE }, - { "31.172.IN-ADDR.ARPA", ISC_TRUE }, - { "168.192.IN-ADDR.ARPA", ISC_TRUE }, + "10.IN-ADDR.ARPA", + "16.172.IN-ADDR.ARPA", + "17.172.IN-ADDR.ARPA", + "18.172.IN-ADDR.ARPA", + "19.172.IN-ADDR.ARPA", + "20.172.IN-ADDR.ARPA", + "21.172.IN-ADDR.ARPA", + "22.172.IN-ADDR.ARPA", + "23.172.IN-ADDR.ARPA", + "24.172.IN-ADDR.ARPA", + "25.172.IN-ADDR.ARPA", + "26.172.IN-ADDR.ARPA", + "27.172.IN-ADDR.ARPA", + "28.172.IN-ADDR.ARPA", + "29.172.IN-ADDR.ARPA", + "30.172.IN-ADDR.ARPA", + "31.172.IN-ADDR.ARPA", + "168.192.IN-ADDR.ARPA", /* RFC 6598 */ - { "64.100.IN-ADDR.ARPA", ISC_FALSE }, - { "65.100.IN-ADDR.ARPA", ISC_FALSE }, - { "66.100.IN-ADDR.ARPA", ISC_FALSE }, - { "67.100.IN-ADDR.ARPA", ISC_FALSE }, - { "68.100.IN-ADDR.ARPA", ISC_FALSE }, - { "69.100.IN-ADDR.ARPA", ISC_FALSE }, - { "70.100.IN-ADDR.ARPA", ISC_FALSE }, - { "71.100.IN-ADDR.ARPA", ISC_FALSE }, - { "72.100.IN-ADDR.ARPA", ISC_FALSE }, - { "73.100.IN-ADDR.ARPA", ISC_FALSE }, - { "74.100.IN-ADDR.ARPA", ISC_FALSE }, - { "75.100.IN-ADDR.ARPA", ISC_FALSE }, - { "76.100.IN-ADDR.ARPA", ISC_FALSE }, - { "77.100.IN-ADDR.ARPA", ISC_FALSE }, - { "78.100.IN-ADDR.ARPA", ISC_FALSE }, - { "79.100.IN-ADDR.ARPA", ISC_FALSE }, - { "80.100.IN-ADDR.ARPA", ISC_FALSE }, - { "81.100.IN-ADDR.ARPA", ISC_FALSE }, - { "82.100.IN-ADDR.ARPA", ISC_FALSE }, - { "83.100.IN-ADDR.ARPA", ISC_FALSE }, - { "84.100.IN-ADDR.ARPA", ISC_FALSE }, - { "85.100.IN-ADDR.ARPA", ISC_FALSE }, - { "86.100.IN-ADDR.ARPA", ISC_FALSE }, - { "87.100.IN-ADDR.ARPA", ISC_FALSE }, - { "88.100.IN-ADDR.ARPA", ISC_FALSE }, - { "89.100.IN-ADDR.ARPA", ISC_FALSE }, - { "90.100.IN-ADDR.ARPA", ISC_FALSE }, - { "91.100.IN-ADDR.ARPA", ISC_FALSE }, - { "92.100.IN-ADDR.ARPA", ISC_FALSE }, - { "93.100.IN-ADDR.ARPA", ISC_FALSE }, - { "94.100.IN-ADDR.ARPA", ISC_FALSE }, - { "95.100.IN-ADDR.ARPA", ISC_FALSE }, - { "96.100.IN-ADDR.ARPA", ISC_FALSE }, - { "97.100.IN-ADDR.ARPA", ISC_FALSE }, - { "98.100.IN-ADDR.ARPA", ISC_FALSE }, - { "99.100.IN-ADDR.ARPA", ISC_FALSE }, - { "100.100.IN-ADDR.ARPA", ISC_FALSE }, - { "101.100.IN-ADDR.ARPA", ISC_FALSE }, - { "102.100.IN-ADDR.ARPA", ISC_FALSE }, - { "103.100.IN-ADDR.ARPA", ISC_FALSE }, - { "104.100.IN-ADDR.ARPA", ISC_FALSE }, - { "105.100.IN-ADDR.ARPA", ISC_FALSE }, - { "106.100.IN-ADDR.ARPA", ISC_FALSE }, - { "107.100.IN-ADDR.ARPA", ISC_FALSE }, - { "108.100.IN-ADDR.ARPA", ISC_FALSE }, - { "109.100.IN-ADDR.ARPA", ISC_FALSE }, - { "110.100.IN-ADDR.ARPA", ISC_FALSE }, - { "111.100.IN-ADDR.ARPA", ISC_FALSE }, - { "112.100.IN-ADDR.ARPA", ISC_FALSE }, - { "113.100.IN-ADDR.ARPA", ISC_FALSE }, - { "114.100.IN-ADDR.ARPA", ISC_FALSE }, - { "115.100.IN-ADDR.ARPA", ISC_FALSE }, - { "116.100.IN-ADDR.ARPA", ISC_FALSE }, - { "117.100.IN-ADDR.ARPA", ISC_FALSE }, - { "118.100.IN-ADDR.ARPA", ISC_FALSE }, - { "119.100.IN-ADDR.ARPA", ISC_FALSE }, - { "120.100.IN-ADDR.ARPA", ISC_FALSE }, - { "121.100.IN-ADDR.ARPA", ISC_FALSE }, - { "122.100.IN-ADDR.ARPA", ISC_FALSE }, - { "123.100.IN-ADDR.ARPA", ISC_FALSE }, - { "124.100.IN-ADDR.ARPA", ISC_FALSE }, - { "125.100.IN-ADDR.ARPA", ISC_FALSE }, - { "126.100.IN-ADDR.ARPA", ISC_FALSE }, - { "127.100.IN-ADDR.ARPA", ISC_FALSE }, + "64.100.IN-ADDR.ARPA", + "65.100.IN-ADDR.ARPA", + "66.100.IN-ADDR.ARPA", + "67.100.IN-ADDR.ARPA", + "68.100.IN-ADDR.ARPA", + "69.100.IN-ADDR.ARPA", + "70.100.IN-ADDR.ARPA", + "71.100.IN-ADDR.ARPA", + "72.100.IN-ADDR.ARPA", + "73.100.IN-ADDR.ARPA", + "74.100.IN-ADDR.ARPA", + "75.100.IN-ADDR.ARPA", + "76.100.IN-ADDR.ARPA", + "77.100.IN-ADDR.ARPA", + "78.100.IN-ADDR.ARPA", + "79.100.IN-ADDR.ARPA", + "80.100.IN-ADDR.ARPA", + "81.100.IN-ADDR.ARPA", + "82.100.IN-ADDR.ARPA", + "83.100.IN-ADDR.ARPA", + "84.100.IN-ADDR.ARPA", + "85.100.IN-ADDR.ARPA", + "86.100.IN-ADDR.ARPA", + "87.100.IN-ADDR.ARPA", + "88.100.IN-ADDR.ARPA", + "89.100.IN-ADDR.ARPA", + "90.100.IN-ADDR.ARPA", + "91.100.IN-ADDR.ARPA", + "92.100.IN-ADDR.ARPA", + "93.100.IN-ADDR.ARPA", + "94.100.IN-ADDR.ARPA", + "95.100.IN-ADDR.ARPA", + "96.100.IN-ADDR.ARPA", + "97.100.IN-ADDR.ARPA", + "98.100.IN-ADDR.ARPA", + "99.100.IN-ADDR.ARPA", + "100.100.IN-ADDR.ARPA", + "101.100.IN-ADDR.ARPA", + "102.100.IN-ADDR.ARPA", + "103.100.IN-ADDR.ARPA", + "104.100.IN-ADDR.ARPA", + "105.100.IN-ADDR.ARPA", + "106.100.IN-ADDR.ARPA", + "107.100.IN-ADDR.ARPA", + "108.100.IN-ADDR.ARPA", + "109.100.IN-ADDR.ARPA", + "110.100.IN-ADDR.ARPA", + "111.100.IN-ADDR.ARPA", + "112.100.IN-ADDR.ARPA", + "113.100.IN-ADDR.ARPA", + "114.100.IN-ADDR.ARPA", + "115.100.IN-ADDR.ARPA", + "116.100.IN-ADDR.ARPA", + "117.100.IN-ADDR.ARPA", + "118.100.IN-ADDR.ARPA", + "119.100.IN-ADDR.ARPA", + "120.100.IN-ADDR.ARPA", + "121.100.IN-ADDR.ARPA", + "122.100.IN-ADDR.ARPA", + "123.100.IN-ADDR.ARPA", + "124.100.IN-ADDR.ARPA", + "125.100.IN-ADDR.ARPA", + "126.100.IN-ADDR.ARPA", + "127.100.IN-ADDR.ARPA", /* RFC 5735 and RFC 5737 */ - { "0.IN-ADDR.ARPA", ISC_FALSE }, /* THIS NETWORK */ - { "127.IN-ADDR.ARPA", ISC_FALSE }, /* LOOPBACK */ - { "254.169.IN-ADDR.ARPA", ISC_FALSE }, /* LINK LOCAL */ - { "2.0.192.IN-ADDR.ARPA", ISC_FALSE }, /* TEST NET */ - { "100.51.198.IN-ADDR.ARPA", ISC_FALSE }, /* TEST NET 2 */ - { "113.0.203.IN-ADDR.ARPA", ISC_FALSE }, /* TEST NET 3 */ - { "255.255.255.255.IN-ADDR.ARPA", ISC_FALSE }, /* BROADCAST */ + "0.IN-ADDR.ARPA", /* THIS NETWORK */ + "127.IN-ADDR.ARPA", /* LOOPBACK */ + "254.169.IN-ADDR.ARPA", /* LINK LOCAL */ + "2.0.192.IN-ADDR.ARPA", /* TEST NET */ + "100.51.198.IN-ADDR.ARPA", /* TEST NET 2 */ + "113.0.203.IN-ADDR.ARPA", /* TEST NET 3 */ + "255.255.255.255.IN-ADDR.ARPA", /* BROADCAST */ /* Local IPv6 Unicast Addresses */ - { "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA", ISC_FALSE }, - { "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA", ISC_FALSE }, + "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA", + "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA", /* LOCALLY ASSIGNED LOCAL ADDRESS SCOPE */ - { "D.F.IP6.ARPA", ISC_FALSE }, - { "8.E.F.IP6.ARPA", ISC_FALSE }, /* LINK LOCAL */ - { "9.E.F.IP6.ARPA", ISC_FALSE }, /* LINK LOCAL */ - { "A.E.F.IP6.ARPA", ISC_FALSE }, /* LINK LOCAL */ - { "B.E.F.IP6.ARPA", ISC_FALSE }, /* LINK LOCAL */ + "D.F.IP6.ARPA", + "8.E.F.IP6.ARPA", /* LINK LOCAL */ + "9.E.F.IP6.ARPA", /* LINK LOCAL */ + "A.E.F.IP6.ARPA", /* LINK LOCAL */ + "B.E.F.IP6.ARPA", /* LINK LOCAL */ /* Example Prefix, RFC 3849. */ - { "8.B.D.0.1.0.0.2.IP6.ARPA", ISC_FALSE }, + "8.B.D.0.1.0.0.2.IP6.ARPA", - { NULL, ISC_FALSE } + NULL }; ISC_PLATFORM_NORETURN_PRE static void @@ -1334,12 +1348,14 @@ check_dbtype(dns_zone_t **zonep, unsigned int dbtypec, const char **dbargv, } static isc_result_t -setquerystats(dns_zone_t *zone, isc_mem_t *mctx, isc_boolean_t on) { +setquerystats(dns_zone_t *zone, isc_mem_t *mctx, dns_zonestat_level_t level) { isc_result_t result; isc_stats_t *zoneqrystats; + dns_zone_setstatlevel(zone, level); + zoneqrystats = NULL; - if (on) { + if (level == dns_zonestat_full) { result = isc_stats_create(mctx, &zoneqrystats, dns_nsstatscounter_max); if (result != ISC_R_SUCCESS) @@ -1387,7 +1403,7 @@ static isc_boolean_t cache_sharable(dns_view_t *originview, dns_view_t *view, isc_boolean_t new_zero_no_soattl, unsigned int new_cleaning_interval, - isc_uint32_t new_max_cache_size) + isc_uint64_t new_max_cache_size) { /* * If the cache cannot even reused for the same view, it cannot be @@ -1420,11 +1436,11 @@ dlzconfigure_callback(dns_view_t *view, dns_zone_t *zone) { result = dns_zonemgr_managezone(ns_g_server->zonemgr, zone); if (result != ISC_R_SUCCESS) - return result; + return (result); dns_zone_setstats(zone, ns_g_server->zonestats); - return ns_zone_configure_writeable_dlz(view->dlzdatabase, - zone, zclass, origin); + return (ns_zone_configure_writeable_dlz(view->dlzdatabase, + zone, zclass, origin)); } static isc_result_t @@ -1493,7 +1509,7 @@ dns64_reverse(dns_view_t *view, isc_mem_t *mctx, isc_netaddr_t *na, dns_zone_setdialup(zone, dns_dialuptype_no); dns_zone_setnotifytype(zone, dns_notifytype_no); dns_zone_setoption(zone, DNS_ZONEOPT_NOCHECKNS, ISC_TRUE); - CHECK(setquerystats(zone, mctx, ISC_FALSE)); /* XXXMPA */ + CHECK(setquerystats(zone, mctx, dns_zonestat_none)); /* XXXMPA */ CHECK(dns_view_addzone(view, zone)); isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER, ISC_LOG_INFO, "dns64 reverse zone%s%s: %s", sep, @@ -1654,10 +1670,10 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig, in_port_t port; dns_cache_t *cache = NULL; isc_result_t result; - isc_uint32_t max_adb_size; unsigned int cleaning_interval; - isc_uint32_t max_cache_size; - isc_uint32_t max_acache_size; + size_t max_cache_size; + size_t max_acache_size; + size_t max_adb_size; isc_uint32_t lame_ttl; dns_tsig_keyring_t *ring = NULL; dns_view_t *pview = NULL; /* Production view */ @@ -1671,13 +1687,13 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig, const char *cachename = NULL; dns_order_t *order = NULL; isc_uint32_t udpsize; + isc_uint32_t maxbits; unsigned int resopts = 0; dns_zone_t *zone = NULL; isc_uint32_t max_clients_per_query; const char *sep = ": view "; const char *viewname = view->name; const char *forview = " for view "; - isc_boolean_t rfc1918; isc_boolean_t empty_zones_enable; const cfg_obj_t *disablelist = NULL; isc_stats_t *resstats = NULL; @@ -1687,7 +1703,7 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig, ns_cache_t *nsc; isc_boolean_t zero_no_soattl; dns_acl_t *clients = NULL, *mapped = NULL, *excluded = NULL; - unsigned int query_timeout; + unsigned int query_timeout, ndisp; struct cfg_context *nzctx; dns_rpz_zone_t *rpz; @@ -1763,18 +1779,18 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig, max_acache_size = ISC_UINT32_MAX; } else { isc_resourcevalue_t value; - value = cfg_obj_asuint64(obj); - if (value > ISC_UINT32_MAX) { - cfg_obj_log(obj, ns_g_lctx, ISC_LOG_ERROR, + if (value > SIZE_MAX) { + cfg_obj_log(obj, ns_g_lctx, + ISC_LOG_WARNING, "'max-acache-size " - "%" ISC_PRINT_QUADFORMAT - "d' is too large", - value); - result = ISC_R_RANGE; - goto cleanup; + "%" ISC_PRINT_QUADFORMAT "u' " + "is too large for this " + "system; reducing to %lu", + value, (unsigned long)SIZE_MAX); + value = SIZE_MAX; } - max_acache_size = (isc_uint32_t)value; + max_acache_size = (size_t) value; } dns_acache_setcachesize(view->acache, max_acache_size); } @@ -1961,15 +1977,17 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig, } else { isc_resourcevalue_t value; value = cfg_obj_asuint64(obj); - if (value > ISC_UINT32_MAX) { - cfg_obj_log(obj, ns_g_lctx, ISC_LOG_ERROR, + if (value > SIZE_MAX) { + cfg_obj_log(obj, ns_g_lctx, + ISC_LOG_WARNING, "'max-cache-size " - "%" ISC_PRINT_QUADFORMAT "d' is too large", - value); - result = ISC_R_RANGE; - goto cleanup; + "%" ISC_PRINT_QUADFORMAT "u' " + "is too large for this " + "system; reducing to %lu", + value, (unsigned long)SIZE_MAX); + value = SIZE_MAX; } - max_cache_size = (isc_uint32_t)value; + max_cache_size = (size_t) value; } /* Check-names. */ @@ -2278,7 +2296,9 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig, result = ISC_R_UNEXPECTED; goto cleanup; } - CHECK(dns_view_createresolver(view, ns_g_taskmgr, 31, + + ndisp = 4 * ISC_MIN(ns_g_udpdisp, MAX_UDP_DISPATCH); + CHECK(dns_view_createresolver(view, ns_g_taskmgr, 31, ndisp, ns_g_socketmgr, ns_g_timermgr, resopts, ns_g_dispatchmgr, dispatch4, dispatch6)); @@ -2363,6 +2383,19 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig, view->maxudp = udpsize; /* + * Set the maximum rsa exponent bits. + */ + obj = NULL; + result = ns_config_get(maps, "max-rsa-exponent-size", &obj); + INSIST(result == ISC_R_SUCCESS); + maxbits = cfg_obj_asuint32(obj); + if (maxbits != 0 && maxbits < 35) + maxbits = 35; + if (maxbits > 4096) + maxbits = 4096; + view->maxbits = maxbits; + + /* * Set supported DNSSEC algorithms. */ dns_resolver_reset_algorithms(view->resolver); @@ -2690,11 +2723,6 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig, ns_g_mctx, &view->upfwdacl)); obj = NULL; - result = ns_config_get(maps, "request-ixfr", &obj); - INSIST(result == ISC_R_SUCCESS); - view->requestixfr = cfg_obj_asboolean(obj); - - obj = NULL; result = ns_config_get(maps, "provide-ixfr", &obj); INSIST(result == ISC_R_SUCCESS); view->provideixfr = cfg_obj_asboolean(obj); @@ -2847,16 +2875,13 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig, (void)ns_config_get(maps, "disable-empty-zone", &disablelist); if (obj == NULL && disablelist == NULL && view->rdclass == dns_rdataclass_in) { - rfc1918 = ISC_FALSE; empty_zones_enable = view->recursion; } else if (view->rdclass == dns_rdataclass_in) { - rfc1918 = ISC_TRUE; if (obj != NULL) empty_zones_enable = cfg_obj_asboolean(obj); else empty_zones_enable = view->recursion; } else { - rfc1918 = ISC_FALSE; empty_zones_enable = ISC_FALSE; } if (empty_zones_enable && !lwresd_g_useresolvconf) { @@ -2868,11 +2893,10 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig, const char *str; char server[DNS_NAME_FORMATSIZE + 1]; char contact[DNS_NAME_FORMATSIZE + 1]; - isc_boolean_t logit; const char *empty_dbtype[4] = { "_builtin", "empty", NULL, NULL }; int empty_dbtypec = 4; - isc_boolean_t zonestats_on; + dns_zonestat_level_t statlevel; dns_fixedname_init(&fixed); name = dns_fixedname_name(&fixed); @@ -2910,12 +2934,26 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig, obj = NULL; result = ns_config_get(maps, "zone-statistics", &obj); INSIST(result == ISC_R_SUCCESS); - zonestats_on = cfg_obj_asboolean(obj); + if (cfg_obj_isboolean(obj)) { + if (cfg_obj_asboolean(obj)) + statlevel = dns_zonestat_full; + else + statlevel = dns_zonestat_terse; /* XXX */ + } else { + const char *levelstr = cfg_obj_asstring(obj); + if (strcasecmp(levelstr, "full") == 0) + statlevel = dns_zonestat_full; + else if (strcasecmp(levelstr, "terse") == 0) + statlevel = dns_zonestat_terse; + else if (strcasecmp(levelstr, "none") == 0) + statlevel = dns_zonestat_none; + else + INSIST(0); + } - logit = ISC_TRUE; - for (empty = empty_zones[empty_zone].zone; + for (empty = empty_zones[empty_zone]; empty != NULL; - empty = empty_zones[++empty_zone].zone) + empty = empty_zones[++empty_zone]) { dns_forwarders_t *forwarders = NULL; dns_view_t *pview = NULL; @@ -2950,23 +2988,6 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig, forwarders->fwdpolicy == dns_fwdpolicy_only) continue; - if (!rfc1918 && empty_zones[empty_zone].rfc1918) { - if (logit) { - isc_log_write(ns_g_lctx, - NS_LOGCATEGORY_GENERAL, - NS_LOGMODULE_SERVER, - ISC_LOG_WARNING, - "Warning%s%s: " - "'empty-zones-enable/" - "disable-empty-zone' " - "not set: disabling " - "RFC 1918 empty zones", - sep, viewname); - logit = ISC_FALSE; - } - continue; - } - /* * See if we can re-use a existing zone. */ @@ -2987,13 +3008,14 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig, dns_zone_setview(zone, view); CHECK(dns_view_addzone(view, zone)); CHECK(setquerystats(zone, mctx, - zonestats_on)); + statlevel)); dns_zone_detach(&zone); continue; } } - CHECK(dns_zone_create(&zone, mctx)); + CHECK(dns_zonemgr_createzone(ns_g_server->zonemgr, + &zone)); CHECK(dns_zone_setorigin(zone, name)); dns_zone_setview(zone, view); CHECK(dns_zonemgr_managezone(ns_g_server->zonemgr, @@ -3011,7 +3033,7 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig, dns_zone_setnotifytype(zone, dns_notifytype_no); dns_zone_setoption(zone, DNS_ZONEOPT_NOCHECKNS, ISC_TRUE); - CHECK(setquerystats(zone, mctx, zonestats_on)); + CHECK(setquerystats(zone, mctx, statlevel)); CHECK(dns_view_addzone(view, zone)); isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER, ISC_LOG_INFO, @@ -3357,6 +3379,7 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig, { dns_view_t *pview = NULL; /* Production view */ dns_zone_t *zone = NULL; /* New or reused zone */ + dns_zone_t *raw = NULL; /* New or reused raw zone */ dns_zone_t *dupzone = NULL; const cfg_obj_t *options = NULL; const cfg_obj_t *zoptions = NULL; @@ -3364,6 +3387,7 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig, const cfg_obj_t *forwarders = NULL; const cfg_obj_t *forwardtype = NULL; const cfg_obj_t *only = NULL; + const cfg_obj_t *signing = NULL; isc_result_t result; isc_result_t tresult; isc_buffer_t buffer; @@ -3487,6 +3511,38 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig, } /* + * Redirect zones only require minimal configuration. + */ + if (strcasecmp(ztypestr, "redirect") == 0) { + if (view->redirect != NULL) { + cfg_obj_log(zconfig, ns_g_lctx, ISC_LOG_ERROR, + "redirect zone already exists"); + result = ISC_R_EXISTS; + goto cleanup; + } + result = dns_viewlist_find(&ns_g_server->viewlist, view->name, + view->rdclass, &pview); + if (result != ISC_R_NOTFOUND && result != ISC_R_SUCCESS) + goto cleanup; + if (pview != NULL && pview->redirect != NULL) { + dns_zone_attach(pview->redirect, &zone); + dns_zone_setview(zone, view); + } else { + CHECK(dns_zonemgr_createzone(ns_g_server->zonemgr, + &zone)); + CHECK(dns_zone_setorigin(zone, origin)); + dns_zone_setview(zone, view); + CHECK(dns_zonemgr_managezone(ns_g_server->zonemgr, + zone)); + dns_zone_setstats(zone, ns_g_server->zonestats); + } + CHECK(ns_zone_configure(config, vconfig, zconfig, aclconf, + zone, NULL)); + dns_zone_attach(zone, &view->redirect); + goto cleanup; + } + + /* * Check for duplicates in the new zone table. */ result = dns_view_findzone(view, origin, &dupzone); @@ -3527,15 +3583,15 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig, * be reused if the options specify a slave zone) * - The zone was and is or was not and is not a policy zone */ - result = dns_viewlist_find(&ns_g_server->viewlist, - view->name, view->rdclass, - &pview); + result = dns_viewlist_find(&ns_g_server->viewlist, view->name, + view->rdclass, &pview); if (result != ISC_R_NOTFOUND && result != ISC_R_SUCCESS) goto cleanup; if (pview != NULL) result = dns_view_findzone(pview, origin, &zone); if (result != ISC_R_NOTFOUND && result != ISC_R_SUCCESS) goto cleanup; + if (zone != NULL && !ns_zone_reusable(zone, zconfig)) dns_zone_detach(&zone); @@ -3555,7 +3611,7 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig, * We cannot reuse an existing zone, we have * to create a new one. */ - CHECK(dns_zone_create(&zone, mctx)); + CHECK(dns_zonemgr_createzone(ns_g_server->zonemgr, &zone)); CHECK(dns_zone_setorigin(zone, origin)); dns_zone_setview(zone, view); if (view->acache != NULL) @@ -3605,10 +3661,28 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig, */ dns_zone_setadded(zone, added); + signing = NULL; + if ((strcasecmp(ztypestr, "master") == 0 || + strcasecmp(ztypestr, "slave") == 0) && + cfg_map_get(zoptions, "inline-signing", &signing) == ISC_R_SUCCESS && + cfg_obj_asboolean(signing)) + { + dns_zone_getraw(zone, &raw); + if (raw == NULL) { + CHECK(dns_zone_create(&raw, mctx)); + CHECK(dns_zone_setorigin(raw, origin)); + dns_zone_setview(raw, view); + if (view->acache != NULL) + dns_zone_setacache(raw, view->acache); + dns_zone_setstats(raw, ns_g_server->zonestats); + CHECK(dns_zone_link(zone, raw)); + } + } + /* * Configure the zone. */ - CHECK(ns_zone_configure(config, vconfig, zconfig, aclconf, zone)); + CHECK(ns_zone_configure(config, vconfig, zconfig, aclconf, zone, raw)); /* * Add the zone to its view in the new view list. @@ -3624,6 +3698,8 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig, cleanup: if (zone != NULL) dns_zone_detach(&zone); + if (raw != NULL) + dns_zone_detach(&raw); if (pview != NULL) dns_view_detach(&pview); @@ -3666,7 +3742,7 @@ add_keydata_zone(dns_view_t *view, const char *directory, isc_mem_t *mctx) { } /* No existing keydata zone was found; create one */ - CHECK(dns_zone_create(&zone, mctx)); + CHECK(dns_zonemgr_createzone(ns_g_server->zonemgr, &zone)); CHECK(dns_zone_setorigin(zone, dns_rootname)); isc_sha256_data((void *)view->name, strlen(view->name), buffer); @@ -3700,7 +3776,7 @@ add_keydata_zone(dns_view_t *view, const char *directory, isc_mem_t *mctx) { dns_zone_setjournalsize(zone, 0); dns_zone_setstats(zone, ns_g_server->zonestats); - CHECK(setquerystats(zone, mctx, ISC_FALSE)); + CHECK(setquerystats(zone, mctx, dns_zonestat_none)); if (view->managed_keys != NULL) dns_zone_detach(&view->managed_keys); @@ -4108,6 +4184,9 @@ removed(dns_zone_t *zone, void *uap) { case dns_zone_stub: type = "stub"; break; + case dns_zone_redirect: + type = "redirect"; + break; default: type = "other"; break; @@ -5337,32 +5416,102 @@ load_configuration(const char *filename, ns_server_t *server, } static isc_result_t -load_zones(ns_server_t *server, isc_boolean_t stop) { +view_loaded(void *arg) { + isc_result_t result; + ns_zoneload_t *zl = (ns_zoneload_t *) arg; + ns_server_t *server = zl->server; + unsigned int refs; + + + /* + * Force zone maintenance. Do this after loading + * so that we know when we need to force AXFR of + * slave zones whose master files are missing. + * + * We use the zoneload reference counter to let us + * know when all views are finished. + */ + isc_refcount_decrement(&zl->refs, &refs); + if (refs != 0) + return (ISC_R_SUCCESS); + + isc_refcount_destroy(&zl->refs); + isc_mem_put(server->mctx, zl, sizeof (*zl)); + + isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER, + ISC_LOG_NOTICE, "all zones loaded"); + CHECKFATAL(dns_zonemgr_forcemaint(server->zonemgr), + "forcing zone maintenance"); + + ns_os_started(); + isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER, + ISC_LOG_NOTICE, "running"); + + return (ISC_R_SUCCESS); +} + +static isc_result_t +load_zones(ns_server_t *server) { isc_result_t result; dns_view_t *view; + ns_zoneload_t *zl; + unsigned int refs = 0; + + zl = isc_mem_get(server->mctx, sizeof (*zl)); + if (zl == NULL) + return (ISC_R_NOMEMORY); + zl->server = server; result = isc_task_beginexclusive(server->task); RUNTIME_CHECK(result == ISC_R_SUCCESS); + isc_refcount_init(&zl->refs, 1); + /* - * Load zone data from disk. + * Schedule zones to be loaded from disk. */ for (view = ISC_LIST_HEAD(server->viewlist); view != NULL; view = ISC_LIST_NEXT(view, link)) { - CHECK(dns_view_load(view, stop)); - if (view->managed_keys != NULL) - CHECK(dns_zone_load(view->managed_keys)); + if (view->managed_keys != NULL) { + result = dns_zone_load(view->managed_keys); + if (result != ISC_R_SUCCESS && + result != DNS_R_UPTODATE && + result != DNS_R_CONTINUE) + goto cleanup; + } + if (view->redirect != NULL) { + result = dns_zone_load(view->redirect); + if (result != ISC_R_SUCCESS && + result != DNS_R_UPTODATE && + result != DNS_R_CONTINUE) + goto cleanup; + } + + /* + * 'dns_view_asyncload' calls view_loaded if there are no + * zones. + */ + isc_refcount_increment(&zl->refs, NULL); + CHECK(dns_view_asyncload(view, view_loaded, zl)); } - /* - * Force zone maintenance. Do this after loading - * so that we know when we need to force AXFR of - * slave zones whose master files are missing. - */ - CHECK(dns_zonemgr_forcemaint(server->zonemgr)); cleanup: + isc_refcount_decrement(&zl->refs, &refs); + if (refs == 0) { + isc_refcount_destroy(&zl->refs); + isc_mem_put(server->mctx, zl, sizeof (*zl)); + } else { + /* + * Place the task manager into privileged mode. This + * ensures that after we leave task-exclusive mode, no + * other tasks will be able to run except for the ones + * that are loading zones. + */ + isc_taskmgr_setmode(ns_g_taskmgr, isc_taskmgrmode_privileged); + } + isc_task_endexclusive(server->task); return (result); } @@ -5387,6 +5536,8 @@ load_new_zones(ns_server_t *server, isc_boolean_t stop) { /* Load managed-keys data */ if (view->managed_keys != NULL) CHECK(dns_zone_loadnew(view->managed_keys)); + if (view->redirect != NULL) + CHECK(dns_zone_loadnew(view->redirect)); } /* @@ -5448,11 +5599,7 @@ run_server(isc_task_t *task, isc_event_t *event) { isc_hash_init(); - CHECKFATAL(load_zones(server, ISC_FALSE), "loading zones"); - - ns_os_started(); - isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER, - ISC_LOG_NOTICE, "running"); + CHECKFATAL(load_zones(server), "loading zones"); } void @@ -5889,7 +6036,7 @@ reload(ns_server_t *server) { isc_result_t result; CHECK(loadconfig(server)); - result = load_zones(server, ISC_FALSE); + result = load_zones(server); if (result == ISC_R_SUCCESS) isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER, ISC_LOG_INFO, @@ -5970,11 +6117,10 @@ next_token(char **stringp, const char *delim) { * set '*zonep' to NULL. */ static isc_result_t -zone_from_args(ns_server_t *server, char *args, dns_zone_t **zonep, - const char **zonename) +zone_from_args(ns_server_t *server, char *args, const char *zonetxt, + dns_zone_t **zonep, const char **zonename, isc_boolean_t skip) { char *input, *ptr; - const char *zonetxt; char *classtxt; const char *viewtxt = NULL; dns_fixedname_t name; @@ -5988,13 +6134,16 @@ zone_from_args(ns_server_t *server, char *args, dns_zone_t **zonep, input = args; - /* Skip the command name. */ - ptr = next_token(&input, " \t"); - if (ptr == NULL) - return (ISC_R_UNEXPECTEDEND); + if (skip) { + /* Skip the command name. */ + ptr = next_token(&input, " \t"); + if (ptr == NULL) + return (ISC_R_UNEXPECTEDEND); + } /* Look for the zone name. */ - zonetxt = next_token(&input, " \t"); + if (zonetxt == NULL) + zonetxt = next_token(&input, " \t"); if (zonetxt == NULL) return (ISC_R_SUCCESS); if (zonename != NULL) @@ -6057,13 +6206,20 @@ isc_result_t ns_server_retransfercommand(ns_server_t *server, char *args) { isc_result_t result; dns_zone_t *zone = NULL; + dns_zone_t *raw = NULL; dns_zonetype_t type; - result = zone_from_args(server, args, &zone, NULL); + result = zone_from_args(server, args, NULL, &zone, NULL, ISC_TRUE); if (result != ISC_R_SUCCESS) return (result); if (zone == NULL) return (ISC_R_UNEXPECTEDEND); + dns_zone_getraw(zone, &raw); + if (raw != NULL) { + dns_zone_detach(&zone); + dns_zone_attach(raw, &zone); + dns_zone_detach(&raw); + } type = dns_zone_gettype(zone); if (type == dns_zone_slave || type == dns_zone_stub) dns_zone_forcereload(zone); @@ -6083,7 +6239,7 @@ ns_server_reloadcommand(ns_server_t *server, char *args, isc_buffer_t *text) { dns_zonetype_t type; const char *msg = NULL; - result = zone_from_args(server, args, &zone, NULL); + result = zone_from_args(server, args, NULL, &zone, NULL, ISC_TRUE); if (result != ISC_R_SUCCESS) return (result); if (zone == NULL) { @@ -6143,7 +6299,7 @@ ns_server_notifycommand(ns_server_t *server, char *args, isc_buffer_t *text) { dns_zone_t *zone = NULL; const unsigned char msg[] = "zone notify queued"; - result = zone_from_args(server, args, &zone, NULL); + result = zone_from_args(server, args, NULL, &zone, NULL, ISC_TRUE); if (result != ISC_R_SUCCESS) return (result); if (zone == NULL) @@ -6168,7 +6324,7 @@ ns_server_refreshcommand(ns_server_t *server, char *args, isc_buffer_t *text) { const unsigned char msg2[] = "not a slave or stub zone"; dns_zonetype_t type; - result = zone_from_args(server, args, &zone, NULL); + result = zone_from_args(server, args, NULL, &zone, NULL, ISC_TRUE); if (result != ISC_R_SUCCESS) return (result); if (zone == NULL) @@ -6190,8 +6346,29 @@ ns_server_refreshcommand(ns_server_t *server, char *args, isc_buffer_t *text) { } isc_result_t -ns_server_togglequerylog(ns_server_t *server) { - server->log_queries = server->log_queries ? ISC_FALSE : ISC_TRUE; +ns_server_togglequerylog(ns_server_t *server, char *args) { + isc_boolean_t value; + char *ptr; + + /* Skip the command name. */ + ptr = next_token(&args, " \t"); + if (ptr == NULL) + return (ISC_R_UNEXPECTEDEND); + + ptr = next_token(&args, " \t"); + if (ptr == NULL) + value = server->log_queries ? ISC_FALSE : ISC_TRUE; + else if (strcasecmp(ptr, "yes") == 0 || strcasecmp(ptr, "on") == 0) + value = ISC_TRUE; + else if (strcasecmp(ptr, "no") == 0 || strcasecmp(ptr, "off") == 0) + value = ISC_FALSE; + else + return (ISC_R_NOTFOUND); + + if (server->log_queries == value) + return (ISC_R_SUCCESS); + + server->log_queries = value; isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER, ISC_LOG_INFO, @@ -6598,6 +6775,7 @@ ns_server_dumpsecroots(ns_server_t *server, char *args) { ptr = next_token(&args, " \t"); if (ptr == NULL) return (ISC_R_UNEXPECTEDEND); + ptr = next_token(&args, " \t"); CHECKMF(isc_stdio_open(server->secrootsfile, "w", &fp), @@ -6895,7 +7073,7 @@ ns_server_flushcache(ns_server_t *server, char *args) { } isc_result_t -ns_server_flushname(ns_server_t *server, char *args) { +ns_server_flushnode(ns_server_t *server, char *args, isc_boolean_t tree) { char *ptr, *target, *viewname; dns_view_t *view; isc_boolean_t flushed; @@ -6942,13 +7120,15 @@ ns_server_flushname(ns_server_t *server, char *args) { * if some of the views share a single cache. But since the * operation is lightweight we prefer simplicity here. */ - result = dns_view_flushname(view, name); + result = dns_view_flushnode(view, name, tree); if (result != ISC_R_SUCCESS) { flushed = ISC_FALSE; isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER, ISC_LOG_ERROR, - "flushing name '%s' in cache view '%s' " - "failed: %s", target, view->name, + "flushing %s '%s' in cache view '%s' " + "failed: %s", + tree ? "tree" : "name", + target, view->name, isc_result_totext(result)); } } @@ -6956,21 +7136,26 @@ ns_server_flushname(ns_server_t *server, char *args) { if (viewname != NULL) isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER, ISC_LOG_INFO, - "flushing name '%s' in cache view '%s' " - "succeeded", target, viewname); + "flushing %s '%s' in cache view '%s' " + "succeeded", + tree ? "tree" : "name", + target, viewname); else isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER, ISC_LOG_INFO, - "flushing name '%s' in all cache views " - "succeeded", target); + "flushing %s '%s' in all cache views " + "succeeded", + tree ? "tree" : "name", + target); result = ISC_R_SUCCESS; } else { if (!found) isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER, ISC_LOG_ERROR, - "flushing name '%s' in cache view '%s' " - "failed: view not found", target, - viewname); + "flushing %s '%s' in cache view '%s' " + "failed: view not found", + tree ? "tree" : "name", + target, viewname); result = ISC_R_FAILURE; } isc_task_endexclusive(server->task); @@ -7005,6 +7190,7 @@ ns_server_status(ns_server_t *server, isc_buffer_t *text) { #ifdef ISC_PLATFORM_USETHREADS "CPUs found: %u\n" "worker threads: %u\n" + "UDP listeners per interface: %u\n" #endif "number of zones: %u\n" "debug level: %d\n" @@ -7017,7 +7203,7 @@ ns_server_status(ns_server_t *server, isc_buffer_t *text) { "server is up and running", ns_g_version, ob, alt, cb, #ifdef ISC_PLATFORM_USETHREADS - ns_g_cpus_detected, ns_g_cpus, + ns_g_cpus_detected, ns_g_cpus, ns_g_udpdisp, #endif zonecount, ns_g_debuglevel, xferrunning, xferdeferred, soaqueries, server->log_queries ? "ON" : "OFF", @@ -7269,7 +7455,7 @@ ns_server_rekey(ns_server_t *server, char *args) { if (strncasecmp(args, NS_COMMAND_SIGN, strlen(NS_COMMAND_SIGN)) == 0) fullsign = ISC_TRUE; - result = zone_from_args(server, args, &zone, NULL); + result = zone_from_args(server, args, NULL, &zone, NULL, ISC_TRUE); if (result != ISC_R_SUCCESS) return (result); if (zone == NULL) @@ -7296,6 +7482,112 @@ ns_server_rekey(ns_server_t *server, char *args) { } /* + * Act on a "sync" command from the command channel. +*/ +static isc_result_t +synczone(dns_zone_t *zone, void *uap) { + isc_boolean_t cleanup = *(isc_boolean_t *)uap; + isc_result_t result; + dns_zone_t *raw = NULL; + char *journal; + + dns_zone_getraw(zone, &raw); + if (raw != NULL) { + synczone(raw, uap); + dns_zone_detach(&raw); + } + + result = dns_zone_flush(zone); + if (result != ISC_R_SUCCESS) + cleanup = ISC_FALSE; + if (cleanup) { + journal = dns_zone_getjournal(zone); + if (journal != NULL) + (void)isc_file_remove(journal); + } + + return (result); +} + +isc_result_t +ns_server_sync(ns_server_t *server, char *args, isc_buffer_t *text) { + isc_result_t result, tresult; + dns_view_t *view; + dns_zone_t *zone = NULL; + char classstr[DNS_RDATACLASS_FORMATSIZE]; + char zonename[DNS_NAME_FORMATSIZE]; + const char *vname, *sep, *msg = NULL, *arg; + isc_boolean_t cleanup = ISC_FALSE; + + (void) next_token(&args, " \t"); + + arg = next_token(&args, " \t"); + if (arg != NULL && + (strcmp(arg, "-clean") == 0 || strcmp(arg, "-clear") == 0)) { + cleanup = ISC_TRUE; + arg = next_token(&args, " \t"); + } + + result = zone_from_args(server, args, arg, &zone, NULL, ISC_FALSE); + if (result != ISC_R_SUCCESS) + return (result); + + if (zone == NULL) { + result = isc_task_beginexclusive(server->task); + RUNTIME_CHECK(result == ISC_R_SUCCESS); + tresult = ISC_R_SUCCESS; + for (view = ISC_LIST_HEAD(server->viewlist); + view != NULL; + view = ISC_LIST_NEXT(view, link)) { + result = dns_zt_apply(view->zonetable, ISC_FALSE, + synczone, &cleanup); + if (result != ISC_R_SUCCESS && + tresult == ISC_R_SUCCESS) + tresult = result; + } + isc_task_endexclusive(server->task); + isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, + NS_LOGMODULE_SERVER, ISC_LOG_INFO, + "dumping all zones%s: %s", + cleanup ? ", removing journal files" : "", + isc_result_totext(result)); + return (tresult); + } + + result = isc_task_beginexclusive(server->task); + RUNTIME_CHECK(result == ISC_R_SUCCESS); + result = synczone(zone, &cleanup); + isc_task_endexclusive(server->task); + + if (msg != NULL && strlen(msg) < isc_buffer_availablelength(text)) + isc_buffer_putmem(text, (const unsigned char *)msg, + strlen(msg) + 1); + + view = dns_zone_getview(zone); + if (strcmp(view->name, "_default") == 0 || + strcmp(view->name, "_bind") == 0) + { + vname = ""; + sep = ""; + } else { + vname = view->name; + sep = " "; + } + dns_rdataclass_format(dns_zone_getclass(zone), classstr, + sizeof(classstr)); + dns_name_format(dns_zone_getorigin(zone), + zonename, sizeof(zonename)); + isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, + NS_LOGMODULE_SERVER, ISC_LOG_INFO, + "sync: dumping zone '%s/%s'%s%s%s: %s", + zonename, classstr, sep, vname, + cleanup ? ", removing journal file" : "", + isc_result_totext(result)); + dns_zone_detach(&zone); + return (result); +} + +/* * Act on a "freeze" or "thaw" command from the command channel. */ isc_result_t @@ -7303,17 +7595,16 @@ ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args, isc_buffer_t *text) { isc_result_t result, tresult; - dns_zone_t *zone = NULL; + dns_zone_t *zone = NULL, *raw = NULL; dns_zonetype_t type; char classstr[DNS_RDATACLASS_FORMATSIZE]; char zonename[DNS_NAME_FORMATSIZE]; dns_view_t *view; - char *journal; const char *vname, *sep; isc_boolean_t frozen; const char *msg = NULL; - result = zone_from_args(server, args, &zone, NULL); + result = zone_from_args(server, args, NULL, &zone, NULL, ISC_TRUE); if (result != ISC_R_SUCCESS) return (result); if (zone == NULL) { @@ -7336,12 +7627,23 @@ ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args, isc_result_totext(tresult)); return (tresult); } + dns_zone_getraw(zone, &raw); + if (raw != NULL) { + dns_zone_detach(&zone); + dns_zone_attach(raw, &zone); + dns_zone_detach(&raw); + } type = dns_zone_gettype(zone); if (type != dns_zone_master) { dns_zone_detach(&zone); return (DNS_R_NOTMASTER); } + if (freeze && !dns_zone_isdynamic(zone, ISC_TRUE)) { + dns_zone_detach(&zone); + return (DNS_R_NOTDYNAMIC); + } + result = isc_task_beginexclusive(server->task); RUNTIME_CHECK(result == ISC_R_SUCCESS); frozen = dns_zone_getupdatedisabled(zone); @@ -7358,11 +7660,6 @@ ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args, msg = "Flushing the zone updates to " "disk failed."; } - if (result == ISC_R_SUCCESS) { - journal = dns_zone_getjournal(zone); - if (journal != NULL) - (void)isc_file_remove(journal); - } if (result == ISC_R_SUCCESS) dns_zone_setupdatedisabled(zone, freeze); } else { @@ -7642,7 +7939,7 @@ ns_server_del_zone(ns_server_t *server, char *args) { FILE *ifp = NULL, *ofp = NULL; /* Parse parameters */ - CHECK(zone_from_args(server, args, &zone, &zonename)); + CHECK(zone_from_args(server, args, NULL, &zone, &zonename, ISC_TRUE)); if (zone == NULL) { result = ISC_R_UNEXPECTEDEND; @@ -7809,3 +8106,162 @@ newzone_cfgctx_destroy(void **cfgp) { isc_mem_putanddetach(&cfg->mctx, cfg, sizeof(*cfg)); *cfgp = NULL; } + +isc_result_t +ns_server_signing(ns_server_t *server, char *args, isc_buffer_t *text) { + isc_result_t result = ISC_R_SUCCESS; + dns_zone_t *zone = NULL; + dns_name_t *origin; + dns_db_t *db = NULL; + dns_dbnode_t *node = NULL; + dns_dbversion_t *version = NULL; + dns_rdatatype_t privatetype; + dns_rdataset_t privset; + isc_boolean_t first = ISC_TRUE; + isc_boolean_t list = ISC_FALSE, clear = ISC_FALSE; + isc_boolean_t chain = ISC_FALSE; + char keystr[DNS_SECALG_FORMATSIZE + 7]; + unsigned short hash = 0, flags = 0, iter = 0, saltlen = 0; + unsigned char salt[255]; + const char *ptr; + size_t n; + + dns_rdataset_init(&privset); + + /* Skip the command name. */ + ptr = next_token(&args, " \t"); + if (ptr == NULL) + return (ISC_R_UNEXPECTEDEND); + + /* Find out what we are to do. */ + ptr = next_token(&args, " \t"); + if (ptr == NULL) + return (ISC_R_UNEXPECTEDEND); + + if (strcasecmp(ptr, "-list") == 0) + list = ISC_TRUE; + else if ((strcasecmp(ptr, "-clear") == 0) || + (strcasecmp(ptr, "-clean") == 0)) { + clear = ISC_TRUE; + ptr = next_token(&args, " \t"); + if (ptr == NULL) + return (ISC_R_UNEXPECTEDEND); + memcpy(keystr, ptr, sizeof(keystr)); + } else if(strcasecmp(ptr, "-nsec3param") == 0) { + const char *hashstr, *flagstr, *iterstr; + char nbuf[512]; + + chain = ISC_TRUE; + hashstr = next_token(&args, " \t"); + if (hashstr == NULL) + return (ISC_R_UNEXPECTEDEND); + + if (strcasecmp(hashstr, "none") == 0) + hash = 0; + else { + flagstr = next_token(&args, " \t"); + iterstr = next_token(&args, " \t"); + if (flagstr == NULL || iterstr == NULL) + return (ISC_R_UNEXPECTEDEND); + + n = snprintf(nbuf, sizeof(nbuf), "%s %s %s", + hashstr, flagstr, iterstr); + if (n == sizeof(nbuf)) + return (ISC_R_NOSPACE); + n = sscanf(nbuf, "%hu %hu %hu", &hash, &flags, &iter); + if (n != 3U) + return (ISC_R_BADNUMBER); + + if (hash > 0xffU || flags > 0xffU) + return (ISC_R_RANGE); + + ptr = next_token(&args, " \t"); + if (ptr == NULL) + return (ISC_R_UNEXPECTEDEND); + if (strcmp(ptr, "-") != 0) { + isc_buffer_t buf; + + isc_buffer_init(&buf, salt, sizeof(salt)); + CHECK(isc_hex_decodestring(ptr, &buf)); + saltlen = isc_buffer_usedlength(&buf); + } + } + } else + CHECK(DNS_R_SYNTAX); + + CHECK(zone_from_args(server, args, NULL, &zone, NULL, ISC_FALSE)); + if (zone == NULL) + CHECK(ISC_R_UNEXPECTEDEND); + + if (clear) { + CHECK(dns_zone_keydone(zone, keystr)); + isc_buffer_putstr(text, "request queued"); + isc_buffer_putuint8(text, 0); + } else if (chain) { + CHECK(dns_zone_setnsec3param(zone, (isc_uint8_t)hash, + (isc_uint8_t)flags, iter, + (isc_uint8_t)saltlen, salt, + ISC_TRUE)); + isc_buffer_putstr(text, "request queued"); + isc_buffer_putuint8(text, 0); + } else if (list) { + privatetype = dns_zone_getprivatetype(zone); + origin = dns_zone_getorigin(zone); + CHECK(dns_zone_getdb(zone, &db)); + CHECK(dns_db_findnode(db, origin, ISC_FALSE, &node)); + dns_db_currentversion(db, &version); + + result = dns_db_findrdataset(db, node, version, privatetype, + dns_rdatatype_none, 0, + &privset, NULL); + if (result == ISC_R_NOTFOUND) { + isc_buffer_putstr(text, "No signing records found"); + isc_buffer_putuint8(text, 0); + result = ISC_R_SUCCESS; + goto cleanup; + } + + for (result = dns_rdataset_first(&privset); + result == ISC_R_SUCCESS; + result = dns_rdataset_next(&privset)) + { + dns_rdata_t priv = DNS_RDATA_INIT; + char output[BUFSIZ]; + isc_buffer_t buf; + + dns_rdataset_current(&privset, &priv); + + isc_buffer_init(&buf, output, sizeof(output)); + CHECK(dns_private_totext(&priv, &buf)); + + if (!first) + isc_buffer_putstr(text, "\n"); + first = ISC_FALSE; + + n = snprintf((char *)isc_buffer_used(text), + isc_buffer_availablelength(text), + "%s", output); + if (n >= isc_buffer_availablelength(text)) + CHECK(ISC_R_NOSPACE); + + isc_buffer_add(text, n); + } + + if (result == ISC_R_NOMORE) + result = ISC_R_SUCCESS; + } + + cleanup: + if (dns_rdataset_isassociated(&privset)) + dns_rdataset_disassociate(&privset); + if (node != NULL) + dns_db_detachnode(db, &node); + if (version != NULL) + dns_db_closeversion(db, &version, ISC_FALSE); + if (db != NULL) + dns_db_detach(&db); + if (zone != NULL) + dns_zone_detach(&zone); + + return (result); +} diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c index 8d30b45..bb642cc 100644 --- a/bin/named/statschannel.c +++ b/bin/named/statschannel.c @@ -14,7 +14,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: statschannel.c,v 1.26.150.2 2011/03/12 04:59:14 tbox Exp $ */ +/* $Id: statschannel.c,v 1.28 2011/03/12 04:59:46 tbox Exp $ */ /*! \file */ @@ -43,7 +43,11 @@ #include <named/server.h> #include <named/statschannel.h> -#include "bind9.xsl.h" +#ifdef NEWSTATS + #include "bind9.ver3.xsl.h" +#else /* OLDSTATS */ + #include "bind9.xsl.h" +#endif /* NEWSTATS */ struct ns_statschannel { /* Unlocked */ @@ -187,7 +191,7 @@ init_desc(void) { SET_NSSTATDESC(servfail, "queries resulted in SERVFAIL", "QrySERVFAIL"); SET_NSSTATDESC(formerr, "queries resulted in FORMERR", "QryFORMERR"); SET_NSSTATDESC(nxdomain, "queries resulted in NXDOMAIN", "QryNXDOMAIN"); - SET_NSSTATDESC(recursion, "queries caused recursion","QryRecursion"); + SET_NSSTATDESC(recursion, "queries caused recursion", "QryRecursion"); SET_NSSTATDESC(duplicate, "duplicate queries received", "QryDuplicate"); SET_NSSTATDESC(dropped, "queries dropped", "QryDropped"); SET_NSSTATDESC(failure, "other query failures", "QryFailure"); @@ -304,7 +308,8 @@ init_desc(void) { SET_ZONESTATDESC(axfrreqv6, "IPv6 AXFR requested", "AXFRReqv6"); SET_ZONESTATDESC(ixfrreqv4, "IPv4 IXFR requested", "IXFRReqv4"); SET_ZONESTATDESC(ixfrreqv6, "IPv6 IXFR requested", "IXFRReqv6"); - SET_ZONESTATDESC(xfrsuccess, "transfer requests succeeded","XfrSuccess"); + SET_ZONESTATDESC(xfrsuccess, "transfer requests succeeded", + "XfrSuccess"); SET_ZONESTATDESC(xfrfail, "transfer requests failed", "XfrFail"); INSIST(i == dns_zonestatscounter_max); @@ -427,7 +432,7 @@ init_desc(void) { do { \ set_desc(dns_dnssecstats_ ## counterid, \ dns_dnssecstats_max, \ - desc, dnssecstats_desc,\ + desc, dnssecstats_desc, \ xmldesc, dnssecstats_xmldesc); \ dnssecstats_index[i++] = dns_dnssecstats_ ## counterid; \ } while (0) @@ -519,6 +524,51 @@ dump_counters(isc_stats_t *stats, statsformat_t type, void *arg, break; case statsformat_xml: #ifdef HAVE_LIBXML2 +#ifdef NEWSTATS + writer = arg; + + if (category != NULL) { + /* <NameOfCategory> */ + TRY0(xmlTextWriterStartElement(writer, + ISC_XMLCHAR + category)); + /* <name> inside category */ + TRY0(xmlTextWriterStartElement(writer, + ISC_XMLCHAR + "name")); + TRY0(xmlTextWriterWriteString(writer, + ISC_XMLCHAR + desc[index])); + TRY0(xmlTextWriterEndElement(writer)); + /* </name> */ + + /* <counter> */ + TRY0(xmlTextWriterStartElement(writer, + ISC_XMLCHAR + "counter")); + TRY0(xmlTextWriterWriteFormatString(writer, + "%" ISC_PRINT_QUADFORMAT "u", value)); + + TRY0(xmlTextWriterEndElement(writer)); + /* </counter> */ + TRY0(xmlTextWriterEndElement(writer)); + /* </NameOfCategory> */ + + } else { + TRY0(xmlTextWriterStartElement(writer, + ISC_XMLCHAR + "counter")); + TRY0(xmlTextWriterWriteAttribute(writer, + ISC_XMLCHAR + "name", + ISC_XMLCHAR + desc[index])); + TRY0(xmlTextWriterWriteFormatString(writer, + "%" ISC_PRINT_QUADFORMAT "u", value)); + TRY0(xmlTextWriterEndElement(writer)); + /* counter */ + } +#else /* !NEWSTATS */ writer = arg; if (category != NULL) { @@ -548,17 +598,73 @@ dump_counters(isc_stats_t *stats, statsformat_t type, void *arg, TRY0(xmlTextWriterEndElement(writer)); /* counter */ if (category != NULL) TRY0(xmlTextWriterEndElement(writer)); /* category */ -#endif +#endif /* NEWSTATS */ +#endif /* LIBXML2 */ break; } } return (ISC_R_SUCCESS); #ifdef HAVE_LIBXML2 error: + isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER, + ISC_LOG_ERROR, "failed at dump_counters()"); return (ISC_R_FAILURE); #endif } +#ifdef NEWSTATS +static void +rdtypestat_dump(dns_rdatastatstype_t type, isc_uint64_t val, void *arg) { + char typebuf[64]; + const char *typestr; + stats_dumparg_t *dumparg = arg; + FILE *fp; +#ifdef HAVE_LIBXML2 + xmlTextWriterPtr writer; + int xmlrc; +#endif + + if ((DNS_RDATASTATSTYPE_ATTR(type) & DNS_RDATASTATSTYPE_ATTR_OTHERTYPE) + == 0) { + dns_rdatatype_format(DNS_RDATASTATSTYPE_BASE(type), typebuf, + sizeof(typebuf)); + typestr = typebuf; + } else + typestr = "Others"; + + switch (dumparg->type) { + case statsformat_file: + fp = dumparg->arg; + fprintf(fp, "%20" ISC_PRINT_QUADFORMAT "u %s\n", val, typestr); + break; + case statsformat_xml: +#ifdef HAVE_LIBXML2 + + writer = dumparg->arg; + + + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counter")); + TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "name", + ISC_XMLCHAR typestr)); + + TRY0(xmlTextWriterWriteFormatString(writer, + "%" ISC_PRINT_QUADFORMAT "u", + val)); + + TRY0(xmlTextWriterEndElement(writer)); /* type */ +#endif + break; + } + return; +#ifdef HAVE_LIBXML2 + error: + isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER, + ISC_LOG_ERROR, "failed at rdtypestat_dump()"); + dumparg->result = ISC_R_FAILURE; + return; +#endif +} +#else /* NEWSTATS */ static void rdtypestat_dump(dns_rdatastatstype_t type, isc_uint64_t val, void *arg) { char typebuf[64]; @@ -610,6 +716,7 @@ rdtypestat_dump(dns_rdatastatstype_t type, isc_uint64_t val, void *arg) { return; #endif } +#endif /* NEWSTATS */ static void rdatasetstats_dump(dns_rdatastatstype_t type, isc_uint64_t val, void *arg) { @@ -668,11 +775,58 @@ rdatasetstats_dump(dns_rdatastatstype_t type, isc_uint64_t val, void *arg) { return; #ifdef HAVE_LIBXML2 error: + isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER, + ISC_LOG_ERROR, "failed at rdatasetstats_dump()"); dumparg->result = ISC_R_FAILURE; #endif } +#ifdef NEWSTATS +static void +opcodestat_dump(dns_opcode_t code, isc_uint64_t val, void *arg) { + FILE *fp; + isc_buffer_t b; + char codebuf[64]; + stats_dumparg_t *dumparg = arg; +#ifdef HAVE_LIBXML2 + xmlTextWriterPtr writer; + int xmlrc; +#endif + + isc_buffer_init(&b, codebuf, sizeof(codebuf) - 1); + dns_opcode_totext(code, &b); + codebuf[isc_buffer_usedlength(&b)] = '\0'; + + switch (dumparg->type) { + case statsformat_file: + fp = dumparg->arg; + fprintf(fp, "%20" ISC_PRINT_QUADFORMAT "u %s\n", val, codebuf); + break; + case statsformat_xml: +#ifdef HAVE_LIBXML2 + writer = dumparg->arg; + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counter")); + TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "name", + ISC_XMLCHAR codebuf )); + TRY0(xmlTextWriterWriteFormatString(writer, + "%" ISC_PRINT_QUADFORMAT "u", + val)); + TRY0(xmlTextWriterEndElement(writer)); /* counter */ +#endif + break; + } + return; + +#ifdef HAVE_LIBXML2 + error: + isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER, + ISC_LOG_ERROR, "failed at opcodestat_dump()"); + dumparg->result = ISC_R_FAILURE; + return; +#endif +} +#else /* NEWSTATS */ static void opcodestat_dump(dns_opcode_t code, isc_uint64_t val, void *arg) { FILE *fp; @@ -721,12 +875,96 @@ opcodestat_dump(dns_opcode_t code, isc_uint64_t val, void *arg) { return; #endif } +#endif /* NEWSTATS */ #ifdef HAVE_LIBXML2 -/* XXXMLG below here sucks. */ +/* XXXMLG below here sucks. (not so much) */ + +#ifdef NEWSTATS +static isc_result_t +zone_xmlrender(dns_zone_t *zone, void *arg) { + isc_result_t result; + char buf[1024 + 32]; /* sufficiently large for zone name and class */ + char *zone_name_only = NULL; + dns_rdataclass_t rdclass; + isc_uint32_t serial; + xmlTextWriterPtr writer = arg; + isc_stats_t *zonestats; + dns_stats_t *rcvquerystats; + dns_zonestat_level_t statlevel; + isc_uint64_t nsstat_values[dns_nsstatscounter_max]; + int xmlrc; + stats_dumparg_t dumparg; + + statlevel = dns_zone_getstatlevel(zone); + if (statlevel == dns_zonestat_none) + return (ISC_R_SUCCESS); + + dumparg.type = statsformat_xml; + dumparg.arg = writer; + + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "zone")); + dns_zone_name(zone, buf, sizeof(buf)); + zone_name_only = strtok(buf, "/"); + if(zone_name_only == NULL) + zone_name_only = buf; + TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "name", + ISC_XMLCHAR zone_name_only)); + rdclass = dns_zone_getclass(zone); + dns_rdataclass_format(rdclass, buf, sizeof(buf)); + TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "rdataclass", + ISC_XMLCHAR buf)); + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "serial")); + if (dns_zone_getserial2(zone, &serial) == ISC_R_SUCCESS) + TRY0(xmlTextWriterWriteFormatString(writer, "%u", serial)); + else + TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-")); + TRY0(xmlTextWriterEndElement(writer)); /* serial */ + + zonestats = dns_zone_getrequeststats(zone); + rcvquerystats = dns_zone_getrcvquerystats(zone); + if (statlevel == dns_zonestat_full && zonestats != NULL) { + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counters")); + TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type", + ISC_XMLCHAR "rcode")); + + result = dump_counters(zonestats, statsformat_xml, writer, + NULL, nsstats_xmldesc, + dns_nsstatscounter_max, nsstats_index, + nsstat_values, ISC_STATSDUMP_VERBOSE); + if (result != ISC_R_SUCCESS) + goto error; + /* counters type="rcode"*/ + TRY0(xmlTextWriterEndElement(writer)); + } + + if (statlevel == dns_zonestat_full && rcvquerystats != NULL) { + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counters")); + TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type", + ISC_XMLCHAR "qtype")); + + dumparg.result = ISC_R_SUCCESS; + dns_rdatatypestats_dump(rcvquerystats, rdtypestat_dump, + &dumparg, 0); + if(dumparg.result != ISC_R_SUCCESS) + goto error; + + /* counters type="qtype"*/ + TRY0(xmlTextWriterEndElement(writer)); + } + + TRY0(xmlTextWriterEndElement(writer)); /* zone */ + + return (ISC_R_SUCCESS); + error: + isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER, + ISC_LOG_ERROR, "Failed at zone_xmlrender()"); + return (ISC_R_FAILURE); +} +#else /* NEWSTATS */ static isc_result_t zone_xmlrender(dns_zone_t *zone, void *arg) { char buf[1024 + 32]; /* sufficiently large for zone name and class */ @@ -776,7 +1014,237 @@ zone_xmlrender(dns_zone_t *zone, void *arg) { error: return (ISC_R_FAILURE); } +#endif /* NEWSTATS */ + +#ifdef NEWSTATS +static isc_result_t +generatexml(ns_server_t *server, int *buflen, xmlChar **buf) { + char boottime[sizeof "yyyy-mm-ddThh:mm:ssZ"]; + char nowstr[sizeof "yyyy-mm-ddThh:mm:ssZ"]; + isc_time_t now; + xmlTextWriterPtr writer = NULL; + xmlDocPtr doc = NULL; + int xmlrc; + dns_view_t *view; + stats_dumparg_t dumparg; + dns_stats_t *cacherrstats; + isc_uint64_t nsstat_values[dns_nsstatscounter_max]; + isc_uint64_t resstat_values[dns_resstatscounter_max]; + isc_uint64_t zonestat_values[dns_zonestatscounter_max]; + isc_uint64_t sockstat_values[isc_sockstatscounter_max]; + isc_result_t result; + + isc_time_now(&now); + isc_time_formatISO8601(&ns_g_boottime, boottime, sizeof boottime); + isc_time_formatISO8601(&now, nowstr, sizeof nowstr); + + writer = xmlNewTextWriterDoc(&doc, 0); + if (writer == NULL) + goto error; + TRY0(xmlTextWriterStartDocument(writer, NULL, "UTF-8", NULL)); + TRY0(xmlTextWriterWritePI(writer, ISC_XMLCHAR "xml-stylesheet", + ISC_XMLCHAR "type=\"text/xsl\" href=\"/bind9.ver3.xsl\"")); + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "statistics")); + TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "version", + ISC_XMLCHAR "3.0")); + + /* Set common fields for statistics dump */ + dumparg.type = statsformat_xml; + dumparg.arg = writer; + + /* + * Start by rendering the views we know of here. For each view we + * know of, call its rendering function. + */ + view = ISC_LIST_HEAD(server->viewlist); + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "views")); + while (view != NULL) { + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "view")); + TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "name", + ISC_XMLCHAR view->name)); + + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "zones")); + result = dns_zt_apply(view->zonetable, ISC_TRUE, zone_xmlrender, + writer); + if (result != ISC_R_SUCCESS) + goto error; + TRY0(xmlTextWriterEndElement(writer)); /* zones */ + + TRY0(xmlTextWriterStartElement(writer, + ISC_XMLCHAR "counters")); + TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type", + ISC_XMLCHAR "resqtype")); + + if (view->resquerystats != NULL) { + dumparg.result = ISC_R_SUCCESS; + dns_rdatatypestats_dump(view->resquerystats, + rdtypestat_dump, &dumparg, 0); + if (dumparg.result != ISC_R_SUCCESS) + goto error; + } + TRY0(xmlTextWriterEndElement(writer)); + + /* <resstats> */ + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counters")); + TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type", + ISC_XMLCHAR "resstats")); + if (view->resstats != NULL) { + result = dump_counters(view->resstats, + statsformat_xml, writer, + NULL, resstats_xmldesc, + dns_resstatscounter_max, + resstats_index, resstat_values, + ISC_STATSDUMP_VERBOSE); + if (result != ISC_R_SUCCESS) + goto error; + } + TRY0(xmlTextWriterEndElement(writer)); /* </resstats> */ + + cacherrstats = dns_db_getrrsetstats(view->cachedb); + if (cacherrstats != NULL) { + TRY0(xmlTextWriterStartElement(writer, + ISC_XMLCHAR "cache")); + TRY0(xmlTextWriterWriteAttribute(writer, + ISC_XMLCHAR "name", + ISC_XMLCHAR + dns_cache_getname(view->cache))); + dumparg.result = ISC_R_SUCCESS; + dns_rdatasetstats_dump(cacherrstats, rdatasetstats_dump, + &dumparg, 0); + if (dumparg.result != ISC_R_SUCCESS) + goto error; + TRY0(xmlTextWriterEndElement(writer)); /* cache */ + } + + TRY0(xmlTextWriterEndElement(writer)); /* view */ + + view = ISC_LIST_NEXT(view, link); + } + TRY0(xmlTextWriterEndElement(writer)); /* views */ + + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "socketmgr")); + isc_socketmgr_renderxml(ns_g_socketmgr, writer); + TRY0(xmlTextWriterEndElement(writer)); /* socketmgr */ + + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "taskmgr")); + isc_taskmgr_renderxml(ns_g_taskmgr, writer); + TRY0(xmlTextWriterEndElement(writer)); /* taskmgr */ + + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "server")); + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "boot-time")); + TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR boottime)); + TRY0(xmlTextWriterEndElement(writer)); /* boot-time */ + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "current-time")); + TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR nowstr)); + TRY0(xmlTextWriterEndElement(writer)); /* current-time */ + + dumparg.result = ISC_R_SUCCESS; + + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counters")); + TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type", + ISC_XMLCHAR "opcode")); + + dns_opcodestats_dump(server->opcodestats, opcodestat_dump, &dumparg, + 0); + if (dumparg.result != ISC_R_SUCCESS) + goto error; + + TRY0(xmlTextWriterEndElement(writer)); /* counters type=opcode */ + + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counters")); + TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type", + ISC_XMLCHAR "qtype")); + + dumparg.result = ISC_R_SUCCESS; + dns_rdatatypestats_dump(server->rcvquerystats, rdtypestat_dump, + &dumparg, 0); + if (dumparg.result != ISC_R_SUCCESS) + goto error; + TRY0(xmlTextWriterEndElement(writer)); /* counters */ + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counters")); + TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type", + ISC_XMLCHAR "nsstat")); + + result = dump_counters(server->nsstats, statsformat_xml, + writer, NULL, nsstats_xmldesc, + dns_nsstatscounter_max, + nsstats_index, nsstat_values, + ISC_STATSDUMP_VERBOSE); + if (result != ISC_R_SUCCESS) + goto error; + + TRY0(xmlTextWriterEndElement(writer)); /* counters type=nsstat */ + + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counters")); + TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type", + ISC_XMLCHAR "zonestat")); + + result = dump_counters(server->zonestats, statsformat_xml, writer, + NULL, zonestats_xmldesc, + dns_zonestatscounter_max, zonestats_index, + zonestat_values, ISC_STATSDUMP_VERBOSE); + if (result != ISC_R_SUCCESS) + goto error; + + TRY0(xmlTextWriterEndElement(writer)); /* counters type=zonestat */ + + /* + * Most of the common resolver statistics entries are 0, so we don't + * use the verbose dump here. + */ + + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counters")); + TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type", + ISC_XMLCHAR "resstat")); + result = dump_counters(server->resolverstats, statsformat_xml, + writer, NULL, resstats_xmldesc, + dns_resstatscounter_max, resstats_index, + resstat_values, 0); + if (result != ISC_R_SUCCESS) + goto error; + + TRY0(xmlTextWriterEndElement(writer)); /* counters type=resstat */ + + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counters")); + TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type", + ISC_XMLCHAR "sockstat")); + + result = dump_counters(server->sockstats, statsformat_xml, + writer, NULL, sockstats_xmldesc, + isc_sockstatscounter_max, sockstats_index, + sockstat_values, ISC_STATSDUMP_VERBOSE); + if (result != ISC_R_SUCCESS) + goto error; + + TRY0(xmlTextWriterEndElement(writer)); /* counters type=sockstat */ + + TRY0(xmlTextWriterEndElement(writer)); /* server */ + + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "memory")); + isc_mem_renderxml(writer); + TRY0(xmlTextWriterEndElement(writer)); /* memory */ + + TRY0(xmlTextWriterEndElement(writer)); /* statistics */ + + TRY0(xmlTextWriterEndDocument(writer)); + + xmlFreeTextWriter(writer); + + xmlDocDumpFormatMemoryEnc(doc, buf, buflen, "UTF-8", 0); + xmlFreeDoc(doc); + return (ISC_R_SUCCESS); + + error: + isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER, + ISC_LOG_ERROR, "failed generating XML response"); + if (writer != NULL) + xmlFreeTextWriter(writer); + if (doc != NULL) + xmlFreeDoc(doc); + return (ISC_R_FAILURE); +} +#else /* OLDSTATS */ static isc_result_t generatexml(ns_server_t *server, int *buflen, xmlChar **buf) { char boottime[sizeof "yyyy-mm-ddThh:mm:ssZ"]; @@ -968,6 +1436,7 @@ generatexml(ns_server_t *server, int *buflen, xmlChar **buf) { xmlFreeDoc(doc); return (ISC_R_FAILURE); } +#endif /* NEWSTATS */ static void wrap_xmlfree(isc_buffer_t *buffer, void *arg) { @@ -1000,7 +1469,10 @@ render_index(const char *url, const char *querystring, void *arg, isc_buffer_add(b, msglen); *freecb = wrap_xmlfree; *freecb_args = NULL; - } + } else + isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, + NS_LOGMODULE_SERVER, ISC_LOG_ERROR, + "failed at rendering XML()"); return (result); } @@ -1032,7 +1504,7 @@ static void shutdown_listener(ns_statschannel_t *listener) { char socktext[ISC_SOCKADDR_FORMATSIZE]; isc_sockaddr_format(&listener->address, socktext, sizeof(socktext)); - isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,NS_LOGMODULE_SERVER, + isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER, ISC_LOG_NOTICE, "stopping statistics channel on %s", socktext); @@ -1150,10 +1622,22 @@ add_listener(ns_server_t *server, ns_statschannel_t **listenerp, #ifdef HAVE_LIBXML2 isc_httpdmgr_addurl(listener->httpdmgr, "/", render_index, server); + isc_httpdmgr_addurl(listener->httpdmgr, "/xml", render_index, server); +#ifdef NEWSTATS + isc_httpdmgr_addurl(listener->httpdmgr, "/xml/v3", render_index, + server); +#else /* OLDSTATS */ + isc_httpdmgr_addurl(listener->httpdmgr, "/xml/v2", render_index, + server); +#endif /* NEWSTATS */ #endif +#ifdef NEWSTATS + isc_httpdmgr_addurl(listener->httpdmgr, "/bind9.ver3.xsl", render_xsl, + server); +#else /* OLDSTATS */ isc_httpdmgr_addurl(listener->httpdmgr, "/bind9.xsl", render_xsl, server); - +#endif /* NEWSTATS */ *listenerp = listener; isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER, ISC_LOG_NOTICE, @@ -1285,7 +1769,8 @@ ns_statschannels_configure(ns_server_t *server, const cfg_obj_t *config, obj = cfg_tuple_get(listen_params, "address"); addr = *cfg_obj_assockaddr(obj); if (isc_sockaddr_getport(&addr) == 0) - isc_sockaddr_setport(&addr, NS_STATSCHANNEL_HTTPPORT); + isc_sockaddr_setport(&addr, + NS_STATSCHANNEL_HTTPPORT); isc_sockaddr_format(&addr, socktext, sizeof(socktext)); diff --git a/bin/named/unix/Makefile.in b/bin/named/unix/Makefile.in index ff2ecce..17bb43e 100644 --- a/bin/named/unix/Makefile.in +++ b/bin/named/unix/Makefile.in @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: Makefile.in,v 1.13.244.2 2011/03/10 23:47:26 tbox Exp $ +# $Id: Makefile.in,v 1.15 2011/03/10 23:47:49 tbox Exp $ srcdir = @srcdir@ VPATH = @srcdir@ diff --git a/bin/named/unix/dlz_dlopen_driver.c b/bin/named/unix/dlz_dlopen_driver.c index 98dfc5a..2ba8a02 100644 --- a/bin/named/unix/dlz_dlopen_driver.c +++ b/bin/named/unix/dlz_dlopen_driver.c @@ -14,7 +14,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dlz_dlopen_driver.c,v 1.1.4.6 2012/02/22 23:46:35 tbox Exp $ */ +/* $Id$ */ #include <config.h> @@ -143,7 +143,7 @@ dlopen_dlz_allowzonexfr(void *driverarg, void *dbdata, const char *name, static isc_result_t dlopen_dlz_authority(const char *zone, void *driverarg, void *dbdata, - dns_sdlzlookup_t *lookup) + dns_sdlzlookup_t *lookup) { dlopen_data_t *cd = (dlopen_data_t *) dbdata; isc_result_t result; @@ -177,7 +177,9 @@ dlopen_dlz_findzonedb(void *driverarg, void *dbdata, const char *name) static isc_result_t dlopen_dlz_lookup(const char *zone, const char *name, void *driverarg, - void *dbdata, dns_sdlzlookup_t *lookup) + void *dbdata, dns_sdlzlookup_t *lookup, + dns_clientinfomethods_t *methods, + dns_clientinfo_t *clientinfo) { dlopen_data_t *cd = (dlopen_data_t *) dbdata; isc_result_t result; @@ -185,7 +187,8 @@ dlopen_dlz_lookup(const char *zone, const char *name, void *driverarg, UNUSED(driverarg); MAYBE_LOCK(cd); - result = cd->dlz_lookup(zone, name, cd->dbdata, lookup); + result = cd->dlz_lookup(zone, name, cd->dbdata, lookup, + methods, clientinfo); MAYBE_UNLOCK(cd); return (result); } diff --git a/bin/named/unix/os.c b/bin/named/unix/os.c index 9637ded..4f5f55c 100644 --- a/bin/named/unix/os.c +++ b/bin/named/unix/os.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: os.c,v 1.104.38.3 2011/03/02 00:04:01 marka Exp $ */ +/* $Id: os.c,v 1.107 2011/03/02 00:02:54 marka Exp $ */ /*! \file */ diff --git a/bin/named/update.c b/bin/named/update.c index abf5c08..0df00c0 100644 --- a/bin/named/update.c +++ b/bin/named/update.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: update.c,v 1.186.16.7 2011/11/03 02:55:34 each Exp $ */ +/* $Id: update.c,v 1.199 2011/12/22 07:32:40 each Exp $ */ #include <config.h> @@ -47,6 +47,7 @@ #include <dns/soa.h> #include <dns/ssu.h> #include <dns/tsig.h> +#include <dns/update.h> #include <dns/view.h> #include <dns/zone.h> #include <dns/zt.h> @@ -268,6 +269,11 @@ update_log(ns_client_t *client, dns_zone_t *zone, namebuf, classbuf, message); } +static void +update_log_cb(void *arg, dns_zone_t *zone, int level, const char *message) { + update_log(arg, zone, level, "%s", message); +} + /*% * Increment updated-related statistics counters. */ @@ -721,45 +727,6 @@ rrset_exists(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, } /*% - * Set '*visible' to true if the RRset exists and is part of the - * visible zone. Otherwise '*visible' is set to false unless a - * error occurs. - */ -static isc_result_t -rrset_visible(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, - dns_rdatatype_t type, isc_boolean_t *visible) -{ - isc_result_t result; - dns_fixedname_t fixed; - - dns_fixedname_init(&fixed); - result = dns_db_find(db, name, ver, type, DNS_DBFIND_NOWILD, - (isc_stdtime_t) 0, NULL, - dns_fixedname_name(&fixed), NULL, NULL); - switch (result) { - case ISC_R_SUCCESS: - *visible = ISC_TRUE; - break; - /* - * Glue, obscured, deleted or replaced records. - */ - case DNS_R_DELEGATION: - case DNS_R_DNAME: - case DNS_R_CNAME: - case DNS_R_NXDOMAIN: - case DNS_R_NXRRSET: - case DNS_R_EMPTYNAME: - case DNS_R_COVERINGNSEC: - *visible = ISC_FALSE; - result = ISC_R_SUCCESS; - break; - default: - break; - } - return (result); -} - -/*% * Helper function for cname_incompatible_rrset_exists. */ static isc_result_t @@ -1174,16 +1141,6 @@ true_p(dns_rdata_t *update_rr, dns_rdata_t *db_rr) { } /*% - * Return true if the record is a RRSIG. - */ -static isc_boolean_t -rrsig_p(dns_rdata_t *update_rr, dns_rdata_t *db_rr) { - UNUSED(update_rr); - return ((db_rr->type == dns_rdatatype_rrsig) ? - ISC_TRUE : ISC_FALSE); -} - -/*% * Return true iff the two RRs have identical rdata. */ static isc_boolean_t @@ -1425,8 +1382,8 @@ get_current_rr(dns_message_t *msg, dns_section_t section, */ static isc_result_t -increment_soa_serial(dns_db_t *db, dns_dbversion_t *ver, - dns_diff_t *diff, isc_mem_t *mctx) +update_soa_serial(dns_db_t *db, dns_dbversion_t *ver, dns_diff_t *diff, + isc_mem_t *mctx, dns_updatemethod_t method) { dns_difftuple_t *deltuple = NULL; dns_difftuple_t *addtuple = NULL; @@ -1438,12 +1395,7 @@ increment_soa_serial(dns_db_t *db, dns_dbversion_t *ver, addtuple->op = DNS_DIFFOP_ADD; serial = dns_soa_getserial(&addtuple->rdata); - - /* RFC1982 */ - serial = (serial + 1) & 0xFFFFFFFF; - if (serial == 0) - serial = 1; - + serial = dns_update_soaserial(serial, method); dns_soa_setserial(serial, &addtuple->rdata); CHECK(do_one_tuple(&deltuple, db, ver, diff)); CHECK(do_one_tuple(&addtuple, db, ver, diff)); @@ -1502,1129 +1454,6 @@ check_soa_increment(dns_db_t *db, dns_dbversion_t *ver, } /**************************************************************************/ -/* - * Incremental updating of NSECs and RRSIGs. - */ - -/*% - * We abuse the dns_diff_t type to represent a set of domain names - * affected by the update. - */ -static isc_result_t -namelist_append_name(dns_diff_t *list, dns_name_t *name) { - isc_result_t result; - dns_difftuple_t *tuple = NULL; - static dns_rdata_t dummy_rdata = DNS_RDATA_INIT; - - CHECK(dns_difftuple_create(list->mctx, DNS_DIFFOP_EXISTS, name, 0, - &dummy_rdata, &tuple)); - dns_diff_append(list, &tuple); - failure: - return (result); -} - -static isc_result_t -namelist_append_subdomain(dns_db_t *db, dns_name_t *name, dns_diff_t *affected) -{ - isc_result_t result; - dns_fixedname_t fixedname; - dns_name_t *child; - dns_dbiterator_t *dbit = NULL; - - dns_fixedname_init(&fixedname); - child = dns_fixedname_name(&fixedname); - - CHECK(dns_db_createiterator(db, DNS_DB_NONSEC3, &dbit)); - - for (result = dns_dbiterator_seek(dbit, name); - result == ISC_R_SUCCESS; - result = dns_dbiterator_next(dbit)) - { - dns_dbnode_t *node = NULL; - CHECK(dns_dbiterator_current(dbit, &node, child)); - dns_db_detachnode(db, &node); - if (! dns_name_issubdomain(child, name)) - break; - CHECK(namelist_append_name(affected, child)); - } - if (result == ISC_R_NOMORE) - result = ISC_R_SUCCESS; - failure: - if (dbit != NULL) - dns_dbiterator_destroy(&dbit); - return (result); -} - - - -/*% - * Helper function for non_nsec_rrset_exists(). - */ -static isc_result_t -is_non_nsec_action(void *data, dns_rdataset_t *rrset) { - UNUSED(data); - if (!(rrset->type == dns_rdatatype_nsec || - rrset->type == dns_rdatatype_nsec3 || - (rrset->type == dns_rdatatype_rrsig && - (rrset->covers == dns_rdatatype_nsec || - rrset->covers == dns_rdatatype_nsec3)))) - return (ISC_R_EXISTS); - return (ISC_R_SUCCESS); -} - -/*% - * Check whether there is an rrset other than a NSEC or RRSIG NSEC, - * i.e., anything that justifies the continued existence of a name - * after a secure update. - * - * If such an rrset exists, set '*exists' to ISC_TRUE. - * Otherwise, set it to ISC_FALSE. - */ -static isc_result_t -non_nsec_rrset_exists(dns_db_t *db, dns_dbversion_t *ver, - dns_name_t *name, isc_boolean_t *exists) -{ - isc_result_t result; - result = foreach_rrset(db, ver, name, is_non_nsec_action, NULL); - RETURN_EXISTENCE_FLAG; -} - -/*% - * A comparison function for sorting dns_diff_t:s by name. - */ -static int -name_order(const void *av, const void *bv) { - dns_difftuple_t const * const *ap = av; - dns_difftuple_t const * const *bp = bv; - dns_difftuple_t const *a = *ap; - dns_difftuple_t const *b = *bp; - return (dns_name_compare(&a->name, &b->name)); -} - -static isc_result_t -uniqify_name_list(dns_diff_t *list) { - isc_result_t result; - dns_difftuple_t *p, *q; - - CHECK(dns_diff_sort(list, name_order)); - - p = ISC_LIST_HEAD(list->tuples); - while (p != NULL) { - do { - q = ISC_LIST_NEXT(p, link); - if (q == NULL || ! dns_name_equal(&p->name, &q->name)) - break; - ISC_LIST_UNLINK(list->tuples, q, link); - dns_difftuple_free(&q); - } while (1); - p = ISC_LIST_NEXT(p, link); - } - failure: - return (result); -} - -static isc_result_t -is_active(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, - isc_boolean_t *flag, isc_boolean_t *cut, isc_boolean_t *unsecure) -{ - isc_result_t result; - dns_fixedname_t foundname; - dns_fixedname_init(&foundname); - result = dns_db_find(db, name, ver, dns_rdatatype_any, - DNS_DBFIND_GLUEOK | DNS_DBFIND_NOWILD, - (isc_stdtime_t) 0, NULL, - dns_fixedname_name(&foundname), - NULL, NULL); - if (result == ISC_R_SUCCESS || result == DNS_R_EMPTYNAME) { - *flag = ISC_TRUE; - *cut = ISC_FALSE; - if (unsecure != NULL) - *unsecure = ISC_FALSE; - return (ISC_R_SUCCESS); - } else if (result == DNS_R_ZONECUT) { - *flag = ISC_TRUE; - *cut = ISC_TRUE; - if (unsecure != NULL) { - /* - * We are at the zonecut. Check to see if there - * is a DS RRset. - */ - if (dns_db_find(db, name, ver, dns_rdatatype_ds, 0, - (isc_stdtime_t) 0, NULL, - dns_fixedname_name(&foundname), - NULL, NULL) == DNS_R_NXRRSET) - *unsecure = ISC_TRUE; - else - *unsecure = ISC_FALSE; - } - return (ISC_R_SUCCESS); - } else if (result == DNS_R_GLUE || result == DNS_R_DNAME || - result == DNS_R_DELEGATION || result == DNS_R_NXDOMAIN) { - *flag = ISC_FALSE; - *cut = ISC_FALSE; - if (unsecure != NULL) - *unsecure = ISC_FALSE; - return (ISC_R_SUCCESS); - } else { - /* - * Silence compiler. - */ - *flag = ISC_FALSE; - *cut = ISC_FALSE; - if (unsecure != NULL) - *unsecure = ISC_FALSE; - return (result); - } -} - -/*% - * Find the next/previous name that has a NSEC record. - * In other words, skip empty database nodes and names that - * have had their NSECs removed because they are obscured by - * a zone cut. - */ -static isc_result_t -next_active(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, - dns_dbversion_t *ver, dns_name_t *oldname, dns_name_t *newname, - isc_boolean_t forward) -{ - isc_result_t result; - dns_dbiterator_t *dbit = NULL; - isc_boolean_t has_nsec = ISC_FALSE; - unsigned int wraps = 0; - isc_boolean_t secure = dns_db_issecure(db); - - CHECK(dns_db_createiterator(db, 0, &dbit)); - - CHECK(dns_dbiterator_seek(dbit, oldname)); - do { - dns_dbnode_t *node = NULL; - - if (forward) - result = dns_dbiterator_next(dbit); - else - result = dns_dbiterator_prev(dbit); - if (result == ISC_R_NOMORE) { - /* - * Wrap around. - */ - if (forward) - CHECK(dns_dbiterator_first(dbit)); - else - CHECK(dns_dbiterator_last(dbit)); - wraps++; - if (wraps == 2) { - update_log(client, zone, ISC_LOG_ERROR, - "secure zone with no NSECs"); - result = DNS_R_BADZONE; - goto failure; - } - } - CHECK(dns_dbiterator_current(dbit, &node, newname)); - dns_db_detachnode(db, &node); - - /* - * The iterator may hold the tree lock, and - * rrset_exists() calls dns_db_findnode() which - * may try to reacquire it. To avoid deadlock - * we must pause the iterator first. - */ - CHECK(dns_dbiterator_pause(dbit)); - if (secure) { - CHECK(rrset_exists(db, ver, newname, - dns_rdatatype_nsec, 0, &has_nsec)); - } else { - dns_fixedname_t ffound; - dns_name_t *found; - dns_fixedname_init(&ffound); - found = dns_fixedname_name(&ffound); - result = dns_db_find(db, newname, ver, - dns_rdatatype_soa, - DNS_DBFIND_NOWILD, 0, NULL, found, - NULL, NULL); - if (result == ISC_R_SUCCESS || - result == DNS_R_EMPTYNAME || - result == DNS_R_NXRRSET || - result == DNS_R_CNAME || - (result == DNS_R_DELEGATION && - dns_name_equal(newname, found))) { - has_nsec = ISC_TRUE; - result = ISC_R_SUCCESS; - } else if (result != DNS_R_NXDOMAIN) - break; - } - } while (! has_nsec); - failure: - if (dbit != NULL) - dns_dbiterator_destroy(&dbit); - - return (result); -} - -/*% - * Add a NSEC record for "name", recording the change in "diff". - * The existing NSEC is removed. - */ -static isc_result_t -add_nsec(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, - dns_dbversion_t *ver, dns_name_t *name, dns_ttl_t nsecttl, - dns_diff_t *diff) -{ - isc_result_t result; - dns_dbnode_t *node = NULL; - unsigned char buffer[DNS_NSEC_BUFFERSIZE]; - dns_rdata_t rdata = DNS_RDATA_INIT; - dns_difftuple_t *tuple = NULL; - dns_fixedname_t fixedname; - dns_name_t *target; - - dns_fixedname_init(&fixedname); - target = dns_fixedname_name(&fixedname); - - /* - * Find the successor name, aka NSEC target. - */ - CHECK(next_active(client, zone, db, ver, name, target, ISC_TRUE)); - - /* - * Create the NSEC RDATA. - */ - CHECK(dns_db_findnode(db, name, ISC_FALSE, &node)); - dns_rdata_init(&rdata); - CHECK(dns_nsec_buildrdata(db, ver, node, target, buffer, &rdata)); - dns_db_detachnode(db, &node); - - /* - * Delete the old NSEC and record the change. - */ - CHECK(delete_if(true_p, db, ver, name, dns_rdatatype_nsec, 0, - NULL, diff)); - /* - * Add the new NSEC and record the change. - */ - CHECK(dns_difftuple_create(diff->mctx, DNS_DIFFOP_ADD, name, - nsecttl, &rdata, &tuple)); - CHECK(do_one_tuple(&tuple, db, ver, diff)); - INSIST(tuple == NULL); - - failure: - if (node != NULL) - dns_db_detachnode(db, &node); - return (result); -} - -/*% - * Add a placeholder NSEC record for "name", recording the change in "diff". - */ -static isc_result_t -add_placeholder_nsec(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, - dns_diff_t *diff) -{ - isc_result_t result; - dns_difftuple_t *tuple = NULL; - isc_region_t r; - unsigned char data[1] = { 0 }; /* The root domain, no bits. */ - dns_rdata_t rdata = DNS_RDATA_INIT; - - r.base = data; - r.length = sizeof(data); - dns_rdata_fromregion(&rdata, dns_db_class(db), dns_rdatatype_nsec, &r); - CHECK(dns_difftuple_create(diff->mctx, DNS_DIFFOP_ADD, name, 0, - &rdata, &tuple)); - CHECK(do_one_tuple(&tuple, db, ver, diff)); - failure: - return (result); -} - -static isc_result_t -find_zone_keys(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, - isc_mem_t *mctx, unsigned int maxkeys, - dst_key_t **keys, unsigned int *nkeys) -{ - isc_result_t result; - dns_dbnode_t *node = NULL; - const char *directory = dns_zone_getkeydirectory(zone); - CHECK(dns_db_findnode(db, dns_db_origin(db), ISC_FALSE, &node)); - CHECK(dns_dnssec_findzonekeys2(db, ver, node, dns_db_origin(db), - directory, mctx, maxkeys, keys, nkeys)); - failure: - if (node != NULL) - dns_db_detachnode(db, &node); - return (result); -} - -/*% - * Add RRSIG records for an RRset, recording the change in "diff". - */ -static isc_result_t -add_sigs(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, - dns_dbversion_t *ver, dns_name_t *name, dns_rdatatype_t type, - dns_diff_t *diff, dst_key_t **keys, unsigned int nkeys, - isc_stdtime_t inception, isc_stdtime_t expire, - isc_boolean_t check_ksk, isc_boolean_t keyset_kskonly) -{ - isc_result_t result; - dns_dbnode_t *node = NULL; - dns_rdataset_t rdataset; - dns_rdata_t sig_rdata = DNS_RDATA_INIT; - isc_buffer_t buffer; - unsigned char data[1024]; /* XXX */ - unsigned int i, j; - isc_boolean_t added_sig = ISC_FALSE; - isc_mem_t *mctx = client->mctx; - - dns_rdataset_init(&rdataset); - isc_buffer_init(&buffer, data, sizeof(data)); - - /* Get the rdataset to sign. */ - if (type == dns_rdatatype_nsec3) - CHECK(dns_db_findnsec3node(db, name, ISC_FALSE, &node)); - else - CHECK(dns_db_findnode(db, name, ISC_FALSE, &node)); - CHECK(dns_db_findrdataset(db, node, ver, type, 0, - (isc_stdtime_t) 0, &rdataset, NULL)); - dns_db_detachnode(db, &node); - -#define REVOKE(x) ((dst_key_flags(x) & DNS_KEYFLAG_REVOKE) != 0) -#define KSK(x) ((dst_key_flags(x) & DNS_KEYFLAG_KSK) != 0) -#define ALG(x) dst_key_alg(x) - - /* - * If we are honoring KSK flags then we need to check that we - * have both KSK and non-KSK keys that are not revoked per - * algorithm. - */ - for (i = 0; i < nkeys; i++) { - isc_boolean_t both = ISC_FALSE; - - if (!dst_key_isprivate(keys[i])) - continue; - - if (check_ksk && !REVOKE(keys[i])) { - isc_boolean_t have_ksk, have_nonksk; - if (KSK(keys[i])) { - have_ksk = ISC_TRUE; - have_nonksk = ISC_FALSE; - } else { - have_ksk = ISC_FALSE; - have_nonksk = ISC_TRUE; - } - for (j = 0; j < nkeys; j++) { - if (j == i || ALG(keys[i]) != ALG(keys[j])) - continue; - if (REVOKE(keys[j])) - continue; - if (KSK(keys[j])) - have_ksk = ISC_TRUE; - else - have_nonksk = ISC_TRUE; - both = have_ksk && have_nonksk; - if (both) - break; - } - } - - if (both) { - if (type == dns_rdatatype_dnskey) { - if (!KSK(keys[i]) && keyset_kskonly) - continue; - } else if (KSK(keys[i])) - continue; - } else if (REVOKE(keys[i]) && type != dns_rdatatype_dnskey) - continue; - - /* Calculate the signature, creating a RRSIG RDATA. */ - CHECK(dns_dnssec_sign(name, &rdataset, keys[i], - &inception, &expire, - mctx, &buffer, &sig_rdata)); - - /* Update the database and journal with the RRSIG. */ - /* XXX inefficient - will cause dataset merging */ - CHECK(update_one_rr(db, ver, diff, DNS_DIFFOP_ADDRESIGN, name, - rdataset.ttl, &sig_rdata)); - dns_rdata_reset(&sig_rdata); - isc_buffer_init(&buffer, data, sizeof(data)); - added_sig = ISC_TRUE; - } - if (!added_sig) { - update_log(client, zone, ISC_LOG_ERROR, - "found no active private keys, " - "unable to generate any signatures"); - result = ISC_R_NOTFOUND; - } - - failure: - if (dns_rdataset_isassociated(&rdataset)) - dns_rdataset_disassociate(&rdataset); - if (node != NULL) - dns_db_detachnode(db, &node); - return (result); -} - -/* - * Delete expired RRsigs and any RRsigs we are about to re-sign. - * See also zone.c:del_sigs(). - */ -static isc_result_t -del_keysigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, - dns_diff_t *diff, dst_key_t **keys, unsigned int nkeys) -{ - isc_result_t result; - dns_dbnode_t *node = NULL; - dns_rdataset_t rdataset; - dns_rdata_t rdata = DNS_RDATA_INIT; - unsigned int i; - dns_rdata_rrsig_t rrsig; - isc_boolean_t found; - - dns_rdataset_init(&rdataset); - - result = dns_db_findnode(db, name, ISC_FALSE, &node); - if (result == ISC_R_NOTFOUND) - return (ISC_R_SUCCESS); - if (result != ISC_R_SUCCESS) - goto failure; - result = dns_db_findrdataset(db, node, ver, dns_rdatatype_rrsig, - dns_rdatatype_dnskey, (isc_stdtime_t) 0, - &rdataset, NULL); - dns_db_detachnode(db, &node); - - if (result == ISC_R_NOTFOUND) - return (ISC_R_SUCCESS); - if (result != ISC_R_SUCCESS) - goto failure; - - for (result = dns_rdataset_first(&rdataset); - result == ISC_R_SUCCESS; - result = dns_rdataset_next(&rdataset)) { - dns_rdataset_current(&rdataset, &rdata); - result = dns_rdata_tostruct(&rdata, &rrsig, NULL); - RUNTIME_CHECK(result == ISC_R_SUCCESS); - found = ISC_FALSE; - for (i = 0; i < nkeys; i++) { - if (rrsig.keyid == dst_key_id(keys[i])) { - found = ISC_TRUE; - if (!dst_key_isprivate(keys[i])) { - /* - * The re-signing code in zone.c - * will mark this as offline. - * Just skip the record for now. - */ - break; - } - result = update_one_rr(db, ver, diff, - DNS_DIFFOP_DEL, name, - rdataset.ttl, &rdata); - break; - } - } - /* - * If there is not a matching DNSKEY then delete the RRSIG. - */ - if (!found) - result = update_one_rr(db, ver, diff, DNS_DIFFOP_DEL, - name, rdataset.ttl, &rdata); - dns_rdata_reset(&rdata); - if (result != ISC_R_SUCCESS) - break; - } - dns_rdataset_disassociate(&rdataset); - if (result == ISC_R_NOMORE) - result = ISC_R_SUCCESS; -failure: - if (node != NULL) - dns_db_detachnode(db, &node); - return (result); -} - -static isc_result_t -add_exposed_sigs(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, - dns_dbversion_t *ver, dns_name_t *name, isc_boolean_t cut, - dns_diff_t *diff, dst_key_t **keys, unsigned int nkeys, - isc_stdtime_t inception, isc_stdtime_t expire, - isc_boolean_t check_ksk, isc_boolean_t keyset_kskonly) -{ - isc_result_t result; - dns_dbnode_t *node; - dns_rdatasetiter_t *iter; - - node = NULL; - result = dns_db_findnode(db, name, ISC_FALSE, &node); - if (result == ISC_R_NOTFOUND) - return (ISC_R_SUCCESS); - if (result != ISC_R_SUCCESS) - return (result); - - iter = NULL; - result = dns_db_allrdatasets(db, node, ver, - (isc_stdtime_t) 0, &iter); - if (result != ISC_R_SUCCESS) - goto cleanup_node; - - for (result = dns_rdatasetiter_first(iter); - result == ISC_R_SUCCESS; - result = dns_rdatasetiter_next(iter)) - { - dns_rdataset_t rdataset; - dns_rdatatype_t type; - isc_boolean_t flag; - - dns_rdataset_init(&rdataset); - dns_rdatasetiter_current(iter, &rdataset); - type = rdataset.type; - dns_rdataset_disassociate(&rdataset); - - /* - * We don't need to sign unsigned NSEC records at the cut - * as they are handled elsewhere. - */ - if ((type == dns_rdatatype_rrsig) || - (cut && type != dns_rdatatype_ds)) - continue; - result = rrset_exists(db, ver, name, dns_rdatatype_rrsig, - type, &flag); - if (result != ISC_R_SUCCESS) - goto cleanup_iterator; - if (flag) - continue;; - result = add_sigs(client, zone, db, ver, name, type, diff, - keys, nkeys, inception, expire, - check_ksk, keyset_kskonly); - if (result != ISC_R_SUCCESS) - goto cleanup_iterator; - } - if (result == ISC_R_NOMORE) - result = ISC_R_SUCCESS; - - cleanup_iterator: - dns_rdatasetiter_destroy(&iter); - - cleanup_node: - dns_db_detachnode(db, &node); - - return (result); -} - -/*% - * Update RRSIG, NSEC and NSEC3 records affected by an update. The original - * update, including the SOA serial update but excluding the RRSIG & NSEC - * changes, is in "diff" and has already been applied to "newver" of "db". - * The database version prior to the update is "oldver". - * - * The necessary RRSIG, NSEC and NSEC3 changes will be applied to "newver" - * and added (as a minimal diff) to "diff". - * - * The RRSIGs generated will be valid for 'sigvalidityinterval' seconds. - */ -static isc_result_t -update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, - dns_dbversion_t *oldver, dns_dbversion_t *newver, - dns_diff_t *diff, isc_uint32_t sigvalidityinterval) -{ - isc_result_t result; - dns_difftuple_t *t; - dns_diff_t diffnames; - dns_diff_t affected; - dns_diff_t sig_diff; - dns_diff_t nsec_diff; - dns_diff_t nsec_mindiff; - isc_boolean_t flag, build_nsec, build_nsec3; - dst_key_t *zone_keys[DNS_MAXZONEKEYS]; - unsigned int nkeys = 0; - unsigned int i; - isc_stdtime_t now, inception, expire; - dns_ttl_t nsecttl; - dns_rdata_soa_t soa; - dns_rdata_t rdata = DNS_RDATA_INIT; - dns_rdataset_t rdataset; - dns_dbnode_t *node = NULL; - isc_boolean_t check_ksk, keyset_kskonly; - isc_boolean_t unsecure; - isc_boolean_t cut; - dns_rdatatype_t privatetype = dns_zone_getprivatetype(zone); - - dns_diff_init(client->mctx, &diffnames); - dns_diff_init(client->mctx, &affected); - - dns_diff_init(client->mctx, &sig_diff); - sig_diff.resign = dns_zone_getsigresigninginterval(zone); - dns_diff_init(client->mctx, &nsec_diff); - dns_diff_init(client->mctx, &nsec_mindiff); - - result = find_zone_keys(zone, db, newver, client->mctx, - DNS_MAXZONEKEYS, zone_keys, &nkeys); - if (result != ISC_R_SUCCESS) { - update_log(client, zone, ISC_LOG_ERROR, - "could not get zone keys for secure dynamic update"); - goto failure; - } - - isc_stdtime_get(&now); - inception = now - 3600; /* Allow for some clock skew. */ - expire = now + sigvalidityinterval; - - /* - * Do we look at the KSK flag on the DNSKEY to determining which - * keys sign which RRsets? First check the zone option then - * check the keys flags to make sure at least one has a ksk set - * and one doesn't. - */ - check_ksk = ISC_TF((dns_zone_getoptions(zone) & - DNS_ZONEOPT_UPDATECHECKKSK) != 0); - keyset_kskonly = ISC_TF((dns_zone_getoptions(zone) & - DNS_ZONEOPT_DNSKEYKSKONLY) != 0); - - /* - * Get the NSEC/NSEC3 TTL from the SOA MINIMUM field. - */ - CHECK(dns_db_findnode(db, dns_db_origin(db), ISC_FALSE, &node)); - dns_rdataset_init(&rdataset); - CHECK(dns_db_findrdataset(db, node, newver, dns_rdatatype_soa, 0, - (isc_stdtime_t) 0, &rdataset, NULL)); - CHECK(dns_rdataset_first(&rdataset)); - dns_rdataset_current(&rdataset, &rdata); - CHECK(dns_rdata_tostruct(&rdata, &soa, NULL)); - nsecttl = soa.minimum; - dns_rdataset_disassociate(&rdataset); - dns_db_detachnode(db, &node); - - /* - * Find all RRsets directly affected by the update, and - * update their RRSIGs. Also build a list of names affected - * by the update in "diffnames". - */ - CHECK(dns_diff_sort(diff, temp_order)); - - t = ISC_LIST_HEAD(diff->tuples); - while (t != NULL) { - dns_name_t *name = &t->name; - /* Now "name" is a new, unique name affected by the update. */ - - CHECK(namelist_append_name(&diffnames, name)); - - while (t != NULL && dns_name_equal(&t->name, name)) { - dns_rdatatype_t type; - type = t->rdata.type; - - /* - * Now "name" and "type" denote a new unique RRset - * affected by the update. - */ - - /* Don't sign RRSIGs. */ - if (type == dns_rdatatype_rrsig) - goto skip; - - /* - * Delete all old RRSIGs covering this type, since they - * are all invalid when the signed RRset has changed. - * We may not be able to recreate all of them - tough. - * Special case changes to the zone's DNSKEY records - * to support offline KSKs. - */ - if (type == dns_rdatatype_dnskey) - del_keysigs(db, newver, name, &sig_diff, - zone_keys, nkeys); - else - CHECK(delete_if(true_p, db, newver, name, - dns_rdatatype_rrsig, type, - NULL, &sig_diff)); - - /* - * If this RRset is still visible after the update, - * add a new signature for it. - */ - CHECK(rrset_visible(db, newver, name, type, &flag)); - if (flag) { - CHECK(add_sigs(client, zone, db, newver, name, - type, &sig_diff, zone_keys, - nkeys, inception, expire, - check_ksk, keyset_kskonly)); - } - skip: - /* Skip any other updates to the same RRset. */ - while (t != NULL && - dns_name_equal(&t->name, name) && - t->rdata.type == type) - { - t = ISC_LIST_NEXT(t, link); - } - } - } - update_log(client, zone, ISC_LOG_DEBUG(3), "updated data signatures"); - - /* Remove orphaned NSECs and RRSIG NSECs. */ - for (t = ISC_LIST_HEAD(diffnames.tuples); - t != NULL; - t = ISC_LIST_NEXT(t, link)) - { - CHECK(non_nsec_rrset_exists(db, newver, &t->name, &flag)); - if (! flag) { - CHECK(delete_if(true_p, db, newver, &t->name, - dns_rdatatype_any, 0, - NULL, &sig_diff)); - } - } - update_log(client, zone, ISC_LOG_DEBUG(3), - "removed any orphaned NSEC records"); - - /* - * See if we need to build NSEC or NSEC3 chains. - */ - CHECK(dns_private_chains(db, newver, privatetype, &build_nsec, - &build_nsec3)); - if (!build_nsec) - goto update_nsec3; - - update_log(client, zone, ISC_LOG_DEBUG(3), "rebuilding NSEC chain"); - - /* - * When a name is created or deleted, its predecessor needs to - * have its NSEC updated. - */ - for (t = ISC_LIST_HEAD(diffnames.tuples); - t != NULL; - t = ISC_LIST_NEXT(t, link)) - { - isc_boolean_t existed, exists; - dns_fixedname_t fixedname; - dns_name_t *prevname; - - dns_fixedname_init(&fixedname); - prevname = dns_fixedname_name(&fixedname); - - CHECK(name_exists(db, oldver, &t->name, &existed)); - CHECK(name_exists(db, newver, &t->name, &exists)); - if (exists == existed) - continue; - - /* - * Find the predecessor. - * When names become obscured or unobscured in this update - * transaction, we may find the wrong predecessor because - * the NSECs have not yet been updated to reflect the delegation - * change. This should not matter because in this case, - * the correct predecessor is either the delegation node or - * a newly unobscured node, and those nodes are on the - * "affected" list in any case. - */ - CHECK(next_active(client, zone, db, newver, - &t->name, prevname, ISC_FALSE)); - CHECK(namelist_append_name(&affected, prevname)); - } - - /* - * Find names potentially affected by delegation changes - * (obscured by adding an NS or DNAME, or unobscured by - * removing one). - */ - for (t = ISC_LIST_HEAD(diffnames.tuples); - t != NULL; - t = ISC_LIST_NEXT(t, link)) - { - isc_boolean_t ns_existed, dname_existed; - isc_boolean_t ns_exists, dname_exists; - - CHECK(rrset_exists(db, oldver, &t->name, dns_rdatatype_ns, 0, - &ns_existed)); - CHECK(rrset_exists(db, oldver, &t->name, dns_rdatatype_dname, 0, - &dname_existed)); - CHECK(rrset_exists(db, newver, &t->name, dns_rdatatype_ns, 0, - &ns_exists)); - CHECK(rrset_exists(db, newver, &t->name, dns_rdatatype_dname, 0, - &dname_exists)); - if ((ns_exists || dname_exists) == (ns_existed || dname_existed)) - continue; - /* - * There was a delegation change. Mark all subdomains - * of t->name as potentially needing a NSEC update. - */ - CHECK(namelist_append_subdomain(db, &t->name, &affected)); - } - - ISC_LIST_APPENDLIST(affected.tuples, diffnames.tuples, link); - INSIST(ISC_LIST_EMPTY(diffnames.tuples)); - - CHECK(uniqify_name_list(&affected)); - - /* - * Determine which names should have NSECs, and delete/create - * NSECs to make it so. We don't know the final NSEC targets yet, - * so we just create placeholder NSECs with arbitrary contents - * to indicate that their respective owner names should be part of - * the NSEC chain. - */ - for (t = ISC_LIST_HEAD(affected.tuples); - t != NULL; - t = ISC_LIST_NEXT(t, link)) - { - isc_boolean_t exists; - dns_name_t *name = &t->name; - - CHECK(name_exists(db, newver, name, &exists)); - if (! exists) - continue; - CHECK(is_active(db, newver, name, &flag, &cut, NULL)); - if (!flag) { - /* - * This name is obscured. Delete any - * existing NSEC record. - */ - CHECK(delete_if(true_p, db, newver, name, - dns_rdatatype_nsec, 0, - NULL, &nsec_diff)); - CHECK(delete_if(rrsig_p, db, newver, name, - dns_rdatatype_any, 0, NULL, diff)); - } else { - /* - * This name is not obscured. It needs to have a - * NSEC unless it is the at the origin, in which - * case it should already exist if there is a complete - * NSEC chain and if there isn't a complete NSEC chain - * we don't want to add one as that would signal that - * there is a complete NSEC chain. - */ - if (!dns_name_equal(name, dns_db_origin(db))) { - CHECK(rrset_exists(db, newver, name, - dns_rdatatype_nsec, 0, - &flag)); - if (!flag) - CHECK(add_placeholder_nsec(db, newver, - name, diff)); - } - CHECK(add_exposed_sigs(client, zone, db, newver, name, - cut, &sig_diff, zone_keys, nkeys, - inception, expire, check_ksk, - keyset_kskonly)); - } - } - - /* - * Now we know which names are part of the NSEC chain. - * Make them all point at their correct targets. - */ - for (t = ISC_LIST_HEAD(affected.tuples); - t != NULL; - t = ISC_LIST_NEXT(t, link)) - { - CHECK(rrset_exists(db, newver, &t->name, - dns_rdatatype_nsec, 0, &flag)); - if (flag) { - /* - * There is a NSEC, but we don't know if it is correct. - * Delete it and create a correct one to be sure. - * If the update was unnecessary, the diff minimization - * will take care of eliminating it from the journal, - * IXFRs, etc. - * - * The RRSIG bit should always be set in the NSECs - * we generate, because they will all get RRSIG NSECs. - * (XXX what if the zone keys are missing?). - * Because the RRSIG NSECs have not necessarily been - * created yet, the correctness of the bit mask relies - * on the assumption that NSECs are only created if - * there is other data, and if there is other data, - * there are other RRSIGs. - */ - CHECK(add_nsec(client, zone, db, newver, &t->name, - nsecttl, &nsec_diff)); - } - } - - /* - * Minimize the set of NSEC updates so that we don't - * have to regenerate the RRSIG NSECs for NSECs that were - * replaced with identical ones. - */ - while ((t = ISC_LIST_HEAD(nsec_diff.tuples)) != NULL) { - ISC_LIST_UNLINK(nsec_diff.tuples, t, link); - dns_diff_appendminimal(&nsec_mindiff, &t); - } - - update_log(client, zone, ISC_LOG_DEBUG(3), - "signing rebuilt NSEC chain"); - - /* Update RRSIG NSECs. */ - for (t = ISC_LIST_HEAD(nsec_mindiff.tuples); - t != NULL; - t = ISC_LIST_NEXT(t, link)) - { - if (t->op == DNS_DIFFOP_DEL) { - CHECK(delete_if(true_p, db, newver, &t->name, - dns_rdatatype_rrsig, dns_rdatatype_nsec, - NULL, &sig_diff)); - } else if (t->op == DNS_DIFFOP_ADD) { - CHECK(add_sigs(client, zone, db, newver, &t->name, - dns_rdatatype_nsec, &sig_diff, - zone_keys, nkeys, inception, expire, - check_ksk, keyset_kskonly)); - } else { - INSIST(0); - } - } - - update_nsec3: - - /* Record our changes for the journal. */ - while ((t = ISC_LIST_HEAD(sig_diff.tuples)) != NULL) { - ISC_LIST_UNLINK(sig_diff.tuples, t, link); - dns_diff_appendminimal(diff, &t); - } - while ((t = ISC_LIST_HEAD(nsec_mindiff.tuples)) != NULL) { - ISC_LIST_UNLINK(nsec_mindiff.tuples, t, link); - dns_diff_appendminimal(diff, &t); - } - - INSIST(ISC_LIST_EMPTY(sig_diff.tuples)); - INSIST(ISC_LIST_EMPTY(nsec_diff.tuples)); - INSIST(ISC_LIST_EMPTY(nsec_mindiff.tuples)); - - if (!build_nsec3) { - update_log(client, zone, ISC_LOG_DEBUG(3), - "no NSEC3 chains to rebuild"); - goto failure; - } - - update_log(client, zone, ISC_LOG_DEBUG(3), "rebuilding NSEC3 chains"); - - dns_diff_clear(&diffnames); - dns_diff_clear(&affected); - - CHECK(dns_diff_sort(diff, temp_order)); - - /* - * Find names potentially affected by delegation changes - * (obscured by adding an NS or DNAME, or unobscured by - * removing one). - */ - t = ISC_LIST_HEAD(diff->tuples); - while (t != NULL) { - dns_name_t *name = &t->name; - - isc_boolean_t ns_existed, dname_existed; - isc_boolean_t ns_exists, dname_exists; - isc_boolean_t exists, existed; - - if (t->rdata.type == dns_rdatatype_nsec || - t->rdata.type == dns_rdatatype_rrsig) { - t = ISC_LIST_NEXT(t, link); - continue; - } - - CHECK(namelist_append_name(&affected, name)); - - CHECK(rrset_exists(db, oldver, name, dns_rdatatype_ns, 0, - &ns_existed)); - CHECK(rrset_exists(db, oldver, name, dns_rdatatype_dname, 0, - &dname_existed)); - CHECK(rrset_exists(db, newver, name, dns_rdatatype_ns, 0, - &ns_exists)); - CHECK(rrset_exists(db, newver, name, dns_rdatatype_dname, 0, - &dname_exists)); - - exists = ns_exists || dname_exists; - existed = ns_existed || dname_existed; - if (exists == existed) - goto nextname; - /* - * There was a delegation change. Mark all subdomains - * of t->name as potentially needing a NSEC3 update. - */ - CHECK(namelist_append_subdomain(db, name, &affected)); - - nextname: - while (t != NULL && dns_name_equal(&t->name, name)) - t = ISC_LIST_NEXT(t, link); - } - - for (t = ISC_LIST_HEAD(affected.tuples); - t != NULL; - t = ISC_LIST_NEXT(t, link)) { - dns_name_t *name = &t->name; - - unsecure = ISC_FALSE; /* Silence compiler warning. */ - CHECK(is_active(db, newver, name, &flag, &cut, &unsecure)); - - if (!flag) { - CHECK(delete_if(rrsig_p, db, newver, name, - dns_rdatatype_any, 0, NULL, diff)); - CHECK(dns_nsec3_delnsec3sx(db, newver, name, - privatetype, &nsec_diff)); - } else { - CHECK(add_exposed_sigs(client, zone, db, newver, name, - cut, &sig_diff, zone_keys, nkeys, - inception, expire, check_ksk, - keyset_kskonly)); - CHECK(dns_nsec3_addnsec3sx(db, newver, name, nsecttl, - unsecure, privatetype, - &nsec_diff)); - } - } - - /* - * Minimize the set of NSEC3 updates so that we don't - * have to regenerate the RRSIG NSEC3s for NSEC3s that were - * replaced with identical ones. - */ - while ((t = ISC_LIST_HEAD(nsec_diff.tuples)) != NULL) { - ISC_LIST_UNLINK(nsec_diff.tuples, t, link); - dns_diff_appendminimal(&nsec_mindiff, &t); - } - - update_log(client, zone, ISC_LOG_DEBUG(3), - "signing rebuilt NSEC3 chain"); - - /* Update RRSIG NSEC3s. */ - for (t = ISC_LIST_HEAD(nsec_mindiff.tuples); - t != NULL; - t = ISC_LIST_NEXT(t, link)) - { - if (t->op == DNS_DIFFOP_DEL) { - CHECK(delete_if(true_p, db, newver, &t->name, - dns_rdatatype_rrsig, - dns_rdatatype_nsec3, - NULL, &sig_diff)); - } else if (t->op == DNS_DIFFOP_ADD) { - CHECK(add_sigs(client, zone, db, newver, &t->name, - dns_rdatatype_nsec3, - &sig_diff, zone_keys, nkeys, - inception, expire, check_ksk, - keyset_kskonly)); - } else { - INSIST(0); - } - } - - /* Record our changes for the journal. */ - while ((t = ISC_LIST_HEAD(sig_diff.tuples)) != NULL) { - ISC_LIST_UNLINK(sig_diff.tuples, t, link); - dns_diff_appendminimal(diff, &t); - } - while ((t = ISC_LIST_HEAD(nsec_mindiff.tuples)) != NULL) { - ISC_LIST_UNLINK(nsec_mindiff.tuples, t, link); - dns_diff_appendminimal(diff, &t); - } - - INSIST(ISC_LIST_EMPTY(sig_diff.tuples)); - INSIST(ISC_LIST_EMPTY(nsec_diff.tuples)); - INSIST(ISC_LIST_EMPTY(nsec_mindiff.tuples)); - - failure: - dns_diff_clear(&sig_diff); - dns_diff_clear(&nsec_diff); - dns_diff_clear(&nsec_mindiff); - - dns_diff_clear(&affected); - dns_diff_clear(&diffnames); - - for (i = 0; i < nkeys; i++) - dst_key_free(&zone_keys[i]); - - return (result); -} - - -/**************************************************************************/ /*% * The actual update code in all its glory. We try to follow * the RFC2136 pseudocode as closely as possible. @@ -2686,7 +1515,7 @@ ns_update_start(ns_client_t *client, isc_result_t sigresult) { isc_result_t result; dns_name_t *zonename; dns_rdataset_t *zone_rdataset; - dns_zone_t *zone = NULL; + dns_zone_t *zone = NULL, *raw = NULL; /* * Interpret the zone section. @@ -2720,6 +1549,17 @@ ns_update_start(ns_client_t *client, isc_result_t sigresult) { if (result != ISC_R_SUCCESS) FAILC(DNS_R_NOTAUTH, "not authoritative for update zone"); + /* + * If there is a raw (unsigned) zone associated with this + * zone then it processes the UPDATE request. + */ + dns_zone_getraw(zone, &raw); + if (raw != NULL) { + dns_zone_detach(&zone); + dns_zone_attach(raw, &zone); + dns_zone_detach(&raw); + } + switch(dns_zone_gettype(zone)) { case dns_zone_master: case dns_zone_dlz: @@ -3066,8 +1906,19 @@ check_dnssec(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, } /* Check existing DB for NSEC-only DNSKEY */ - if (!nseconly) - CHECK(dns_nsec_nseconly(db, ver, &nseconly)); + if (!nseconly) { + result = dns_nsec_nseconly(db, ver, &nseconly); + + /* + * An NSEC3PARAM update can proceed without a DNSKEY (it + * will trigger a delayed change), so we can ignore + * ISC_R_NOTFOUND here. + */ + if (result == ISC_R_NOTFOUND) + result = ISC_R_SUCCESS; + + CHECK(result); + } /* Check existing DB for NSEC3 */ if (!nsec3) @@ -3238,9 +2089,11 @@ add_nsec3param_records(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, ttl_good = ISC_TRUE; } if (tuple->op == DNS_DIFFOP_ADD) { + isc_boolean_t nseconly = ISC_FALSE; + /* * Look for any deletes which match this ADD ignoring - * OPTOUT. We don't need to explictly remove them as + * flags. We don't need to explictly remove them as * they will be removed a side effect of processing * the add. */ @@ -3262,12 +2115,28 @@ add_nsec3param_records(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, ISC_LIST_APPEND(diff->tuples, next, link); next = ISC_LIST_HEAD(temp_diff.tuples); } + /* - * See if we already have a CREATE request in progress. + * Create a private-type record to signal that + * we want a delayed NSEC3 chain add/delete */ dns_nsec3param_toprivate(&tuple->rdata, &rdata, privatetype, buf, sizeof(buf)); buf[2] |= DNS_NSEC3FLAG_CREATE; + + /* + * If the zone is not currently capable of + * supporting an NSEC3 chain, then we set the + * INITIAL flag to indicate that these parameters + * are to be used later. + */ + result = dns_nsec_nseconly(db, ver, &nseconly); + if (result == ISC_R_NOTFOUND || nseconly) + buf[2] |= DNS_NSEC3FLAG_INITIAL; + + /* + * See if this CREATE request already exists. + */ CHECK(rr_exists(db, ver, name, &rdata, &flag)); if (!flag) { @@ -3379,7 +2248,7 @@ rollback_private(dns_db_t *db, dns_rdatatype_t privatetype, /* * Allow records which indicate that a zone has been - * signed with a DNSKEY to be be removed. + * signed with a DNSKEY to be removed. */ if (tuple->op == DNS_DIFFOP_DEL && tuple->rdata.length == 5 && @@ -4157,7 +3026,8 @@ update_action(isc_task_t *task, isc_event_t *event) { * changed as a result of an update operation. */ if (! soa_serial_changed) { - CHECK(increment_soa_serial(db, ver, &diff, mctx)); + CHECK(update_soa_serial(db, ver, &diff, mctx, + dns_zone_getserialupdatemethod(zone))); } CHECK(check_mx(client, zone, db, ver, &diff)); @@ -4191,7 +3061,7 @@ update_action(isc_task_t *task, isc_event_t *event) { CHECK(add_nsec3param_records(client, zone, db, ver, &diff)); - if (!has_dnskey) { + if (had_dnskey && !has_dnskey) { /* * We are transitioning from secure to insecure. * Cause all NSEC3 chains to be deleted. When the @@ -4199,12 +3069,17 @@ update_action(isc_task_t *task, isc_event_t *event) { * remove any NSEC chain present will also be removed. */ CHECK(dns_nsec3param_deletechains(db, ver, zone, - &diff)); + ISC_TRUE, &diff)); } else if (has_dnskey && isdnssec(db, ver, privatetype)) { isc_uint32_t interval; + dns_update_log_t log; + interval = dns_zone_getsigvalidityinterval(zone); - result = update_signatures(client, zone, db, oldver, - ver, &diff, interval); + log.func = update_log_cb; + log.arg = client; + result = dns_update_signatures(&log, zone, db, oldver, + ver, &diff, interval); + if (result != ISC_R_SUCCESS) { update_log(client, zone, ISC_LOG_ERROR, @@ -4221,7 +3096,7 @@ update_action(isc_task_t *task, isc_event_t *event) { journal = NULL; result = dns_journal_open(mctx, journalfile, - ISC_TRUE, &journal); + DNS_JOURNAL_CREATE, &journal); if (result != ISC_R_SUCCESS) FAILS(result, "journal open failed"); diff --git a/bin/named/xfrout.c b/bin/named/xfrout.c index 0363500..a0a617d 100644 --- a/bin/named/xfrout.c +++ b/bin/named/xfrout.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2011, 2013 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2013 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: xfrout.c,v 1.139.16.4 2011/12/01 01:00:50 marka Exp $ */ +/* $Id$ */ #include <config.h> @@ -247,12 +247,13 @@ ixfr_rrstream_create(isc_mem_t *mctx, s = isc_mem_get(mctx, sizeof(*s)); if (s == NULL) return (ISC_R_NOMEMORY); - s->common.mctx = mctx; + s->common.mctx = NULL; + isc_mem_attach(mctx, &s->common.mctx); s->common.methods = &ixfr_rrstream_methods; s->journal = NULL; CHECK(dns_journal_open(mctx, journal_filename, - ISC_FALSE, &s->journal)); + DNS_JOURNAL_READ, &s->journal)); CHECK(dns_journal_iter_init(s->journal, begin_serial, end_serial)); *sp = (rrstream_t *) s; @@ -289,7 +290,7 @@ ixfr_rrstream_destroy(rrstream_t **rsp) { ixfr_rrstream_t *s = (ixfr_rrstream_t *) *rsp; if (s->journal != 0) dns_journal_destroy(&s->journal); - isc_mem_put(s->common.mctx, s, sizeof(*s)); + isc_mem_putanddetach(&s->common.mctx, s, sizeof(*s)); } static rrstream_methods_t ixfr_rrstream_methods = { @@ -335,7 +336,8 @@ axfr_rrstream_create(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *ver, s = isc_mem_get(mctx, sizeof(*s)); if (s == NULL) return (ISC_R_NOMEMORY); - s->common.mctx = mctx; + s->common.mctx = NULL; + isc_mem_attach(mctx, &s->common.mctx); s->common.methods = &axfr_rrstream_methods; s->it_valid = ISC_FALSE; @@ -413,7 +415,7 @@ axfr_rrstream_destroy(rrstream_t **rsp) { axfr_rrstream_t *s = (axfr_rrstream_t *) *rsp; if (s->it_valid) dns_rriterator_destroy(&s->it); - isc_mem_put(s->common.mctx, s, sizeof(*s)); + isc_mem_putanddetach(&s->common.mctx, s, sizeof(*s)); } static rrstream_methods_t axfr_rrstream_methods = { @@ -455,7 +457,8 @@ soa_rrstream_create(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *ver, s = isc_mem_get(mctx, sizeof(*s)); if (s == NULL) return (ISC_R_NOMEMORY); - s->common.mctx = mctx; + s->common.mctx = NULL; + isc_mem_attach(mctx, &s->common.mctx); s->common.methods = &soa_rrstream_methods; s->soa_tuple = NULL; @@ -497,7 +500,7 @@ soa_rrstream_destroy(rrstream_t **rsp) { soa_rrstream_t *s = (soa_rrstream_t *) *rsp; if (s->soa_tuple != NULL) dns_difftuple_free(&s->soa_tuple); - isc_mem_put(s->common.mctx, s, sizeof(*s)); + isc_mem_putanddetach(&s->common.mctx, s, sizeof(*s)); } static rrstream_methods_t soa_rrstream_methods = { @@ -561,7 +564,8 @@ compound_rrstream_create(isc_mem_t *mctx, rrstream_t **soa_stream, s = isc_mem_get(mctx, sizeof(*s)); if (s == NULL) return (ISC_R_NOMEMORY); - s->common.mctx = mctx; + s->common.mctx = NULL; + isc_mem_attach(mctx, &s->common.mctx); s->common.methods = &compound_rrstream_methods; s->components[0] = *soa_stream; s->components[1] = *data_stream; @@ -634,7 +638,7 @@ compound_rrstream_destroy(rrstream_t **rsp) { s->components[0]->methods->destroy(&s->components[0]); s->components[1]->methods->destroy(&s->components[1]); s->components[2] = NULL; /* Copy of components[0]. */ - isc_mem_put(s->common.mctx, s, sizeof(*s)); + isc_mem_putanddetach(&s->common.mctx, s, sizeof(*s)); } static rrstream_methods_t compound_rrstream_methods = { diff --git a/bin/named/zoneconf.c b/bin/named/zoneconf.c index 404c238..7f36b14 100644 --- a/bin/named/zoneconf.c +++ b/bin/named/zoneconf.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: zoneconf.c,v 1.170.14.7 2012/01/31 23:46:39 tbox Exp $ */ +/* $Id$ */ /*% */ @@ -792,7 +792,7 @@ checknames(dns_zonetype_t ztype, const cfg_obj_t **maps, isc_result_t ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, const cfg_obj_t *zconfig, cfg_aclconfctx_t *ac, - dns_zone_t *zone) + dns_zone_t *zone, dns_zone_t *raw) { isc_result_t result; const char *zname; @@ -824,8 +824,12 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, isc_boolean_t ixfrdiff; dns_masterformat_t masterformat; isc_stats_t *zoneqrystats; - isc_boolean_t zonestats_on; +#ifdef NEWSTATS + dns_stats_t *rcvquerystats; +#endif + dns_zonestat_level_t statlevel; int seconds; + dns_zone_t *mayberaw = (raw != NULL) ? raw : zone; i = 0; if (zconfig != NULL) { @@ -857,9 +861,16 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, RETERR(ns_config_getclass(cfg_tuple_get(zconfig, "class"), vclass, &zclass)); dns_zone_setclass(zone, zclass); + if (raw != NULL) + dns_zone_setclass(raw, zclass); ztype = zonetype_fromconfig(zoptions); - dns_zone_settype(zone, ztype); + if (raw != NULL) { + dns_zone_settype(raw, ztype); + dns_zone_settype(zone, dns_zone_master); + } else + dns_zone_settype(zone, ztype); + obj = NULL; result = cfg_map_get(zoptions, "database", &obj); @@ -907,7 +918,10 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, return (ISC_R_FAILURE); } - masterformat = dns_masterformat_text; + if (ztype == dns_zone_slave) + masterformat = dns_masterformat_raw; + else + masterformat = dns_masterformat_text; obj = NULL; result= ns_config_get(maps, "masterfile-format", &obj); if (result == ISC_R_SUCCESS) { @@ -920,18 +934,40 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, else INSIST(0); } - RETERR(dns_zone_setfile2(zone, filename, masterformat)); + + if (raw != NULL && filename != NULL) { +#define SIGNED ".signed" + size_t signedlen = strlen(filename) + sizeof(SIGNED); + char *signedname; + + RETERR(dns_zone_setfile2(raw, filename, masterformat)); + signedname = isc_mem_get(mctx, signedlen); + if (signedname == NULL) + return (ISC_R_NOMEMORY); + + (void)snprintf(signedname, signedlen, "%s" SIGNED, filename); + result = dns_zone_setfile2(zone, signedname, + dns_masterformat_raw); + isc_mem_put(mctx, signedname, signedlen); + if (result != ISC_R_SUCCESS) + return (result); + } else + RETERR(dns_zone_setfile2(zone, filename, masterformat)); obj = NULL; result = cfg_map_get(zoptions, "journal", &obj); if (result == ISC_R_SUCCESS) - RETERR(dns_zone_setjournal(zone, cfg_obj_asstring(obj))); + RETERR(dns_zone_setjournal(mayberaw, cfg_obj_asstring(obj))); + /* + * Notify messages are processed by the raw zone if it exists. + */ if (ztype == dns_zone_slave) RETERR(configure_zone_acl(zconfig, vconfig, config, - allow_notify, ac, zone, + allow_notify, ac, mayberaw, dns_zone_setnotifyacl, dns_zone_clearnotifyacl)); + /* * XXXAG This probably does not make sense for stubs. */ @@ -966,27 +1002,63 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, else INSIST(0); } + if (raw != NULL) + dns_zone_setdialup(raw, dialup); dns_zone_setdialup(zone, dialup); obj = NULL; result = ns_config_get(maps, "zone-statistics", &obj); INSIST(result == ISC_R_SUCCESS && obj != NULL); - zonestats_on = cfg_obj_asboolean(obj); - zoneqrystats = NULL; - if (zonestats_on) { + if (cfg_obj_isboolean(obj)) { + if (cfg_obj_asboolean(obj)) + statlevel = dns_zonestat_full; + else + statlevel = dns_zonestat_terse; /* XXX */ + } else { + const char *levelstr = cfg_obj_asstring(obj); + if (strcasecmp(levelstr, "full") == 0) + statlevel = dns_zonestat_full; + else if (strcasecmp(levelstr, "terse") == 0) + statlevel = dns_zonestat_terse; + else if (strcasecmp(levelstr, "none") == 0) + statlevel = dns_zonestat_none; + else + INSIST(0); + } + dns_zone_setstatlevel(zone, statlevel); + + zoneqrystats = NULL; +#ifdef NEWSTATS + rcvquerystats = NULL; +#endif + if (statlevel == dns_zonestat_full) { RETERR(isc_stats_create(mctx, &zoneqrystats, dns_nsstatscounter_max)); +#ifdef NEWSTATS + RETERR(dns_rdatatypestats_create(mctx, + &rcvquerystats)); +#endif } - dns_zone_setrequeststats(zone, zoneqrystats); + dns_zone_setrequeststats(zone, zoneqrystats ); +#ifdef NEWSTATS + dns_zone_setrcvquerystats(zone, rcvquerystats); +#endif + if (zoneqrystats != NULL) isc_stats_detach(&zoneqrystats); +#ifdef NEWSTATS + if(rcvquerystats != NULL) + dns_stats_detach(&rcvquerystats); +#endif + /* * Configure master functionality. This applies * to primary masters (type "master") and slaves * acting as masters (type "slave"), but not to stubs. */ - if (ztype != dns_zone_stub && ztype != dns_zone_staticstub) { + if (ztype != dns_zone_stub && ztype != dns_zone_staticstub && + ztype != dns_zone_redirect) { obj = NULL; result = ns_config_get(maps, "notify", &obj); INSIST(result == ISC_R_SUCCESS && obj != NULL); @@ -1004,22 +1076,28 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, else INSIST(0); } + if (raw != NULL) + dns_zone_setnotifytype(raw, dns_notifytype_no); dns_zone_setnotifytype(zone, notifytype); obj = NULL; result = ns_config_get(maps, "also-notify", &obj); if (result == ISC_R_SUCCESS) { - isc_sockaddr_t *addrs = NULL; isc_uint32_t addrcount; - result = ns_config_getiplist(config, obj, 0, mctx, - &addrs, &addrcount); - if (result != ISC_R_SUCCESS) - return (result); - result = dns_zone_setalsonotify(zone, addrs, - addrcount); - ns_config_putiplist(mctx, &addrs, addrcount); - if (result != ISC_R_SUCCESS) - return (result); + addrs = NULL; + keynames = NULL; + RETERR(ns_config_getipandkeylist(config, obj, mctx, + &addrs, &keynames, + &addrcount)); + result = dns_zone_setalsonotifywithkeys(zone, addrs, + keynames, + addrcount); + if (addrcount != 0) + ns_config_putipandkeylist(mctx, &addrs, + &keynames, addrcount); + else + INSIST(addrs == NULL && keynames == NULL); + RETERR(result); } else RETERR(dns_zone_setalsonotify(zone, NULL, 0)); @@ -1059,8 +1137,10 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, dns_zone_setidleout(zone, cfg_obj_asuint32(obj) * 60); obj = NULL; - result = ns_config_get(maps, "max-journal-size", &obj); + result = ns_config_get(maps, "max-journal-size", &obj); INSIST(result == ISC_R_SUCCESS && obj != NULL); + if (raw != NULL) + dns_zone_setjournalsize(raw, -1); dns_zone_setjournalsize(zone, -1); if (cfg_obj_isstring(obj)) { const char *str = cfg_obj_asstring(obj); @@ -1080,6 +1160,8 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, } journal_size = (isc_uint32_t)value; } + if (raw != NULL) + dns_zone_setjournalsize(raw, journal_size); dns_zone_setjournalsize(zone, journal_size); obj = NULL; @@ -1095,7 +1177,19 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, ixfrdiff = ISC_TRUE; else ixfrdiff = ISC_FALSE; - dns_zone_setoption(zone, DNS_ZONEOPT_IXFRFROMDIFFS, ixfrdiff); + if (raw != NULL) { + dns_zone_setoption(raw, DNS_ZONEOPT_IXFRFROMDIFFS, + ISC_TRUE); + dns_zone_setoption(zone, DNS_ZONEOPT_IXFRFROMDIFFS, + ISC_TRUE); + } else + dns_zone_setoption(zone, DNS_ZONEOPT_IXFRFROMDIFFS, + ixfrdiff); + + obj = NULL; + result = ns_config_get(maps, "request-ixfr", &obj); + INSIST(result == ISC_R_SUCCESS); + dns_zone_setrequestixfr(zone, cfg_obj_asboolean(obj)); checknames(ztype, maps, &obj); INSIST(obj != NULL); @@ -1108,8 +1202,21 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, fail = check = ISC_FALSE; } else INSIST(0); - dns_zone_setoption(zone, DNS_ZONEOPT_CHECKNAMES, check); - dns_zone_setoption(zone, DNS_ZONEOPT_CHECKNAMESFAIL, fail); + if (raw != NULL) { + dns_zone_setoption(raw, DNS_ZONEOPT_CHECKNAMES, + check); + dns_zone_setoption(raw, DNS_ZONEOPT_CHECKNAMESFAIL, + fail); + dns_zone_setoption(zone, DNS_ZONEOPT_CHECKNAMES, + ISC_FALSE); + dns_zone_setoption(zone, DNS_ZONEOPT_CHECKNAMESFAIL, + ISC_FALSE); + } else { + dns_zone_setoption(zone, DNS_ZONEOPT_CHECKNAMES, + check); + dns_zone_setoption(zone, DNS_ZONEOPT_CHECKNAMESFAIL, + fail); + } obj = NULL; result = ns_config_get(maps, "notify-delay", &obj); @@ -1143,6 +1250,32 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, INSIST(result == ISC_R_SUCCESS && obj != NULL); dns_zone_setoption(zone, DNS_ZONEOPT_NSEC3TESTZONE, cfg_obj_asboolean(obj)); + } else if (ztype == dns_zone_redirect) { + dns_zone_setnotifytype(zone, dns_notifytype_no); + + obj = NULL; + result = ns_config_get(maps, "max-journal-size", &obj); + INSIST(result == ISC_R_SUCCESS && obj != NULL); + dns_zone_setjournalsize(zone, -1); + if (cfg_obj_isstring(obj)) { + const char *str = cfg_obj_asstring(obj); + INSIST(strcasecmp(str, "unlimited") == 0); + journal_size = ISC_UINT32_MAX / 2; + } else { + isc_resourcevalue_t value; + value = cfg_obj_asuint64(obj); + if (value > ISC_UINT32_MAX / 2) { + cfg_obj_log(obj, ns_g_lctx, + ISC_LOG_ERROR, + "'max-journal-size " + "%" ISC_PRINT_QUADFORMAT "d' " + "is too large", + value); + RETERR(ISC_R_RANGE); + } + journal_size = (isc_uint32_t)value; + } + dns_zone_setjournalsize(zone, journal_size); } /* @@ -1153,11 +1286,11 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, dns_acl_t *updateacl; RETERR(configure_zone_acl(zconfig, vconfig, config, - allow_update, ac, zone, + allow_update, ac, mayberaw, dns_zone_setupdateacl, dns_zone_clearupdateacl)); - updateacl = dns_zone_getupdateacl(zone); + updateacl = dns_zone_getupdateacl(mayberaw); if (updateacl != NULL && dns_acl_isinsecure(updateacl)) isc_log_write(ns_g_lctx, DNS_LOGCATEGORY_SECURITY, NS_LOGMODULE_SERVER, ISC_LOG_WARNING, @@ -1165,7 +1298,11 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, "address, which is insecure", zname); - RETERR(configure_zone_ssutable(zoptions, zone, zname)); + RETERR(configure_zone_ssutable(zoptions, mayberaw, zname)); + } + + if (ztype == dns_zone_master || raw != NULL) { + isc_boolean_t allow = ISC_FALSE, maint = ISC_FALSE; obj = NULL; result = ns_config_get(maps, "sig-validity-interval", &obj); @@ -1224,10 +1361,34 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, INSIST(result == ISC_R_SUCCESS && obj != NULL); dns_zone_setoption(zone, DNS_ZONEOPT_DNSKEYKSKONLY, cfg_obj_asboolean(obj)); - } else if (ztype == dns_zone_slave) { + + obj = NULL; + result = ns_config_get(maps, "dnssec-loadkeys-interval", &obj); + INSIST(result == ISC_R_SUCCESS && obj != NULL); + RETERR(dns_zone_setrefreshkeyinterval(zone, + cfg_obj_asuint32(obj))); + + obj = NULL; + result = cfg_map_get(zoptions, "auto-dnssec", &obj); + if (result == ISC_R_SUCCESS) { + const char *arg = cfg_obj_asstring(obj); + if (strcasecmp(arg, "allow") == 0) + allow = ISC_TRUE; + else if (strcasecmp(arg, "maintain") == 0) + allow = maint = ISC_TRUE; + else if (strcasecmp(arg, "off") == 0) + ; + else + INSIST(0); + dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, allow); + dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, maint); + } + } + + if (ztype == dns_zone_slave) { RETERR(configure_zone_acl(zconfig, vconfig, config, - allow_update_forwarding, ac, zone, - dns_zone_setforwardacl, + allow_update_forwarding, ac, + mayberaw, dns_zone_setforwardacl, dns_zone_clearforwardacl)); } @@ -1235,15 +1396,13 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, * Primary master functionality. */ if (ztype == dns_zone_master) { - isc_boolean_t allow = ISC_FALSE, maint = ISC_FALSE; - obj = NULL; result = ns_config_get(maps, "check-wildcard", &obj); if (result == ISC_R_SUCCESS) check = cfg_obj_asboolean(obj); else check = ISC_FALSE; - dns_zone_setoption(zone, DNS_ZONEOPT_CHECKWILDCARD, check); + dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKWILDCARD, check); obj = NULL; result = ns_config_get(maps, "check-dup-records", &obj); @@ -1257,8 +1416,8 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, fail = check = ISC_FALSE; } else INSIST(0); - dns_zone_setoption(zone, DNS_ZONEOPT_CHECKDUPRR, check); - dns_zone_setoption(zone, DNS_ZONEOPT_CHECKDUPRRFAIL, fail); + dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKDUPRR, check); + dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKDUPRRFAIL, fail); obj = NULL; result = ns_config_get(maps, "check-mx", &obj); @@ -1272,13 +1431,13 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, fail = check = ISC_FALSE; } else INSIST(0); - dns_zone_setoption(zone, DNS_ZONEOPT_CHECKMX, check); - dns_zone_setoption(zone, DNS_ZONEOPT_CHECKMXFAIL, fail); + dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKMX, check); + dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKMXFAIL, fail); obj = NULL; result = ns_config_get(maps, "check-integrity", &obj); INSIST(result == ISC_R_SUCCESS && obj != NULL); - dns_zone_setoption(zone, DNS_ZONEOPT_CHECKINTEGRITY, + dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKINTEGRITY, cfg_obj_asboolean(obj)); obj = NULL; @@ -1293,8 +1452,8 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, warn = ignore = ISC_TRUE; } else INSIST(0); - dns_zone_setoption(zone, DNS_ZONEOPT_WARNMXCNAME, warn); - dns_zone_setoption(zone, DNS_ZONEOPT_IGNOREMXCNAME, ignore); + dns_zone_setoption(mayberaw, DNS_ZONEOPT_WARNMXCNAME, warn); + dns_zone_setoption(mayberaw, DNS_ZONEOPT_IGNOREMXCNAME, ignore); obj = NULL; result = ns_config_get(maps, "check-srv-cname", &obj); @@ -1308,30 +1467,38 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, warn = ignore = ISC_TRUE; } else INSIST(0); - dns_zone_setoption(zone, DNS_ZONEOPT_WARNSRVCNAME, warn); - dns_zone_setoption(zone, DNS_ZONEOPT_IGNORESRVCNAME, ignore); + dns_zone_setoption(mayberaw, DNS_ZONEOPT_WARNSRVCNAME, warn); + dns_zone_setoption(mayberaw, DNS_ZONEOPT_IGNORESRVCNAME, + ignore); obj = NULL; result = ns_config_get(maps, "dnssec-secure-to-insecure", &obj); INSIST(result == ISC_R_SUCCESS && obj != NULL); - dns_zone_setoption(zone, DNS_ZONEOPT_SECURETOINSECURE, + dns_zone_setoption(mayberaw, DNS_ZONEOPT_SECURETOINSECURE, cfg_obj_asboolean(obj)); obj = NULL; - result = cfg_map_get(zoptions, "auto-dnssec", &obj); + result = cfg_map_get(zoptions, "dnssec-update-mode", &obj); if (result == ISC_R_SUCCESS) { const char *arg = cfg_obj_asstring(obj); - if (strcasecmp(arg, "allow") == 0) - allow = ISC_TRUE; + if (strcasecmp(arg, "no-resign") == 0) + dns_zone_setkeyopt(zone, DNS_ZONEKEY_NORESIGN, + ISC_TRUE); else if (strcasecmp(arg, "maintain") == 0) - allow = maint = ISC_TRUE; - else if (strcasecmp(arg, "off") == 0) ; else INSIST(0); - dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, allow); - dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, maint); } + + obj = NULL; + result = ns_config_get(maps, "serial-update-method", &obj); + INSIST(result == ISC_R_SUCCESS && obj != NULL); + if (strcasecmp(cfg_obj_asstring(obj), "unixtime") == 0) + dns_zone_setserialupdatemethod(zone, + dns_updatemethod_unixtime); + else + dns_zone_setserialupdatemethod(zone, + dns_updatemethod_increment); } /* @@ -1340,6 +1507,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, switch (ztype) { case dns_zone_slave: case dns_zone_stub: + case dns_zone_redirect: count = 0; obj = NULL; (void)cfg_map_get(zoptions, "masters", &obj); @@ -1349,7 +1517,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, RETERR(ns_config_getipandkeylist(config, obj, mctx, &addrs, &keynames, &count)); - result = dns_zone_setmasterswithkeys(zone, addrs, + result = dns_zone_setmasterswithkeys(mayberaw, addrs, keynames, count); if (count != 0) ns_config_putipandkeylist(mctx, &addrs, @@ -1357,7 +1525,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, else INSIST(addrs == NULL && keynames == NULL); } else - result = dns_zone_setmasters(zone, NULL, 0); + result = dns_zone_setmasters(mayberaw, NULL, 0); RETERR(result); multi = ISC_FALSE; @@ -1367,59 +1535,63 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, INSIST(result == ISC_R_SUCCESS && obj != NULL); multi = cfg_obj_asboolean(obj); } - dns_zone_setoption(zone, DNS_ZONEOPT_MULTIMASTER, multi); + dns_zone_setoption(mayberaw, DNS_ZONEOPT_MULTIMASTER, multi); obj = NULL; result = ns_config_get(maps, "max-transfer-time-in", &obj); INSIST(result == ISC_R_SUCCESS && obj != NULL); - dns_zone_setmaxxfrin(zone, cfg_obj_asuint32(obj) * 60); + dns_zone_setmaxxfrin(mayberaw, cfg_obj_asuint32(obj) * 60); obj = NULL; result = ns_config_get(maps, "max-transfer-idle-in", &obj); INSIST(result == ISC_R_SUCCESS && obj != NULL); - dns_zone_setidlein(zone, cfg_obj_asuint32(obj) * 60); + dns_zone_setidlein(mayberaw, cfg_obj_asuint32(obj) * 60); obj = NULL; result = ns_config_get(maps, "max-refresh-time", &obj); INSIST(result == ISC_R_SUCCESS && obj != NULL); - dns_zone_setmaxrefreshtime(zone, cfg_obj_asuint32(obj)); + dns_zone_setmaxrefreshtime(mayberaw, cfg_obj_asuint32(obj)); obj = NULL; result = ns_config_get(maps, "min-refresh-time", &obj); INSIST(result == ISC_R_SUCCESS && obj != NULL); - dns_zone_setminrefreshtime(zone, cfg_obj_asuint32(obj)); + dns_zone_setminrefreshtime(mayberaw, cfg_obj_asuint32(obj)); obj = NULL; result = ns_config_get(maps, "max-retry-time", &obj); INSIST(result == ISC_R_SUCCESS && obj != NULL); - dns_zone_setmaxretrytime(zone, cfg_obj_asuint32(obj)); + dns_zone_setmaxretrytime(mayberaw, cfg_obj_asuint32(obj)); obj = NULL; result = ns_config_get(maps, "min-retry-time", &obj); INSIST(result == ISC_R_SUCCESS && obj != NULL); - dns_zone_setminretrytime(zone, cfg_obj_asuint32(obj)); + dns_zone_setminretrytime(mayberaw, cfg_obj_asuint32(obj)); obj = NULL; result = ns_config_get(maps, "transfer-source", &obj); INSIST(result == ISC_R_SUCCESS && obj != NULL); - RETERR(dns_zone_setxfrsource4(zone, cfg_obj_assockaddr(obj))); + RETERR(dns_zone_setxfrsource4(mayberaw, + cfg_obj_assockaddr(obj))); ns_add_reserved_dispatch(ns_g_server, cfg_obj_assockaddr(obj)); obj = NULL; result = ns_config_get(maps, "transfer-source-v6", &obj); INSIST(result == ISC_R_SUCCESS && obj != NULL); - RETERR(dns_zone_setxfrsource6(zone, cfg_obj_assockaddr(obj))); + RETERR(dns_zone_setxfrsource6(mayberaw, + cfg_obj_assockaddr(obj))); ns_add_reserved_dispatch(ns_g_server, cfg_obj_assockaddr(obj)); obj = NULL; result = ns_config_get(maps, "alt-transfer-source", &obj); INSIST(result == ISC_R_SUCCESS && obj != NULL); - RETERR(dns_zone_setaltxfrsource4(zone, cfg_obj_assockaddr(obj))); + RETERR(dns_zone_setaltxfrsource4(mayberaw, + cfg_obj_assockaddr(obj))); obj = NULL; result = ns_config_get(maps, "alt-transfer-source-v6", &obj); INSIST(result == ISC_R_SUCCESS && obj != NULL); - RETERR(dns_zone_setaltxfrsource6(zone, cfg_obj_assockaddr(obj))); + RETERR(dns_zone_setaltxfrsource6(mayberaw, + cfg_obj_assockaddr(obj))); obj = NULL; (void)ns_config_get(maps, "use-alt-transfer-source", &obj); @@ -1435,11 +1607,11 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, alt = ISC_FALSE; } else alt = cfg_obj_asboolean(obj); - dns_zone_setoption(zone, DNS_ZONEOPT_USEALTXFRSRC, alt); + dns_zone_setoption(mayberaw, DNS_ZONEOPT_USEALTXFRSRC, alt); obj = NULL; (void)ns_config_get(maps, "try-tcp-refresh", &obj); - dns_zone_setoption(zone, DNS_ZONEOPT_TRYTCPREFRESH, + dns_zone_setoption(mayberaw, DNS_ZONEOPT_TRYTCPREFRESH, cfg_obj_asboolean(obj)); break; @@ -1472,10 +1644,10 @@ ns_zone_configure_writeable_dlz(dns_dlzdb_t *dlzdatabase, dns_zone_t *zone, dns_zone_settype(zone, dns_zone_dlz); result = dns_sdlz_setdb(dlzdatabase, rdclass, name, &db); if (result != ISC_R_SUCCESS) - return result; + return (result); result = dns_zone_dlzpostload(zone, db); dns_db_detach(&db); - return result; + return (result); } isc_boolean_t @@ -1484,15 +1656,12 @@ ns_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig) { const cfg_obj_t *obj = NULL; const char *cfilename; const char *zfilename; + dns_zone_t *raw = NULL; + isc_boolean_t has_raw; + dns_zonetype_t ztype; zoptions = cfg_tuple_get(zconfig, "options"); - if (zonetype_fromconfig(zoptions) != dns_zone_gettype(zone)) { - dns_zone_log(zone, ISC_LOG_DEBUG(1), - "not reusable: type mismatch"); - return (ISC_FALSE); - } - /* * We always reconfigure a static-stub zone for simplicity, assuming * the amount of data to be loaded is small. @@ -1503,18 +1672,49 @@ ns_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig) { return (ISC_FALSE); } + /* If there's a raw zone, use that for filename and type comparison */ + dns_zone_getraw(zone, &raw); + if (raw != NULL) { + zfilename = dns_zone_getfile(raw); + ztype = dns_zone_gettype(raw); + dns_zone_detach(&raw); + has_raw = ISC_TRUE; + } else { + zfilename = dns_zone_getfile(zone); + ztype = dns_zone_gettype(zone); + has_raw = ISC_FALSE; + } + + obj = NULL; + (void)cfg_map_get(zoptions, "inline-signing", &obj); + if ((obj == NULL || !cfg_obj_asboolean(obj)) && has_raw) { + dns_zone_log(zone, ISC_LOG_DEBUG(1), + "not reusable: old zone was inline-signing"); + return (ISC_FALSE); + } else if ((obj != NULL && cfg_obj_asboolean(obj)) && !has_raw) { + dns_zone_log(zone, ISC_LOG_DEBUG(1), + "not reusable: old zone was not inline-signing"); + return (ISC_FALSE); + } + + if (zonetype_fromconfig(zoptions) != ztype) { + dns_zone_log(zone, ISC_LOG_DEBUG(1), + "not reusable: type mismatch"); + return (ISC_FALSE); + } + obj = NULL; (void)cfg_map_get(zoptions, "file", &obj); if (obj != NULL) cfilename = cfg_obj_asstring(obj); else cfilename = NULL; - zfilename = dns_zone_getfile(zone); if (!((cfilename == NULL && zfilename == NULL) || (cfilename != NULL && zfilename != NULL && - strcmp(cfilename, zfilename) == 0))) { + strcmp(cfilename, zfilename) == 0))) + { dns_zone_log(zone, ISC_LOG_DEBUG(1), - "not reusable: filename mismatch"); + "not reusable: filename mismatch"); return (ISC_FALSE); } diff --git a/bin/nsupdate/Makefile.in b/bin/nsupdate/Makefile.in index f62ee34..09e6c14 100644 --- a/bin/nsupdate/Makefile.in +++ b/bin/nsupdate/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2004, 2006-2009, 2012 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004, 2006-2009, 2012, 2013 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 2000-2002 Internet Software Consortium. # # Permission to use, copy, modify, and/or distribute this software for any @@ -23,6 +23,8 @@ top_srcdir = @top_srcdir@ @BIND9_MAKE_INCLUDES@ +READLINE_LIB = @READLINE_LIB@ + CINCLUDES = ${LWRES_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES} \ ${ISC_INCLUDES} ${ISCCFG_INCLUDES} @DST_GSSAPI_INC@ @@ -72,7 +74,7 @@ nsupdate.@O@: nsupdate.c -c ${srcdir}/nsupdate.c nsupdate@EXEEXT@: nsupdate.@O@ ${UOBJS} ${DEPLIBS} - export BASEOBJS="nsupdate.@O@ ${UOBJS}"; \ + export BASEOBJS="nsupdate.@O@ ${READLINE_LIB} ${UOBJS}"; \ ${FINALBUILDCMD} doc man:: ${MANOBJS} diff --git a/bin/nsupdate/nsupdate.1 b/bin/nsupdate/nsupdate.1 index 5867597..1e2dcaf 100644 --- a/bin/nsupdate/nsupdate.1 +++ b/bin/nsupdate/nsupdate.1 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004-2012 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000-2003 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -263,20 +263,20 @@ rather than the default realm in \fIkrb5.conf\fR. If no realm is specified the saved realm is cleared. .RE .PP -\fBprereq nxdomain\fR {domain\-name} +\fB[prereq]\fR\fB nxdomain\fR {domain\-name} .RS 4 Requires that no resource record of any type exists with name \fIdomain\-name\fR. .RE .PP -\fBprereq yxdomain\fR {domain\-name} +\fB[prereq]\fR\fB yxdomain\fR {domain\-name} .RS 4 Requires that \fIdomain\-name\fR exists (has as at least one resource record, of any type). .RE .PP -\fBprereq nxrrset\fR {domain\-name} [class] {type} +\fB[prereq]\fR\fB nxrrset\fR {domain\-name} [class] {type} .RS 4 Requires that no resource record exists of the specified \fItype\fR, @@ -287,7 +287,7 @@ and is omitted, IN (internet) is assumed. .RE .PP -\fBprereq yxrrset\fR {domain\-name} [class] {type} +\fB[prereq]\fR\fB yxrrset\fR {domain\-name} [class] {type} .RS 4 This requires that a resource record of the specified \fItype\fR, @@ -299,7 +299,7 @@ must exist. If is omitted, IN (internet) is assumed. .RE .PP -\fBprereq yxrrset\fR {domain\-name} [class] {type} {data...} +\fB[prereq]\fR\fB yxrrset\fR {domain\-name} [class] {type} {data...} .RS 4 The \fIdata\fR @@ -315,7 +315,7 @@ are combined to form a set of RRs. This set of RRs must exactly match the set of are written in the standard text representation of the resource record's RDATA. .RE .PP -\fBupdate delete\fR {domain\-name} [ttl] [class] [type\ [data...]] +\fB[update]\fR\fB del\fR\fB[ete]\fR {domain\-name} [ttl] [class] [type\ [data...]] .RS 4 Deletes any resource records named \fIdomain\-name\fR. If @@ -329,7 +329,7 @@ is not supplied. The is ignored, and is only allowed for compatibility. .RE .PP -\fBupdate add\fR {domain\-name} {ttl} [class] {type} {data...} +\fB[update]\fR\fB add\fR {domain\-name} {ttl} [class] {type} {data...} .RS 4 Adds a new resource record with the specified \fIttl\fR, @@ -435,7 +435,7 @@ RFC 2931, .PP The TSIG key is redundantly stored in two separate files. This is a consequence of nsupdate using the DST library for its cryptographic operations, and may change in future releases. .SH "COPYRIGHT" -Copyright \(co 2004\-2010 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004\-2012 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000\-2003 Internet Software Consortium. .br diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c index e11f080..e96c075 100644 --- a/bin/nsupdate/nsupdate.c +++ b/bin/nsupdate/nsupdate.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: nsupdate.c,v 1.193.12.4 2011/11/03 04:30:09 each Exp $ */ +/* $Id$ */ /*! \file */ @@ -85,6 +85,10 @@ #endif #include <bind9/getaddresses.h> +#if defined(HAVE_READLINE) +#include <readline/readline.h> +#include <readline/history.h> +#endif #ifdef HAVE_ADDRINFO #ifdef HAVE_GETADDRINFO @@ -1805,6 +1809,8 @@ evaluate_update(char *cmdline) { } if (strcasecmp(word, "delete") == 0) isdelete = ISC_TRUE; + else if (strcasecmp(word, "del") == 0) + isdelete = ISC_TRUE; else if (strcasecmp(word, "add") == 0) isdelete = ISC_FALSE; else { @@ -1883,35 +1889,13 @@ show_message(FILE *stream, dns_message_t *msg, const char *description) { isc_buffer_free(&buf); } - static isc_uint16_t -get_next_command(void) { - char cmdlinebuf[MAXCMD]; - char *cmdline; +do_next_command(char *cmdline) { char *word; - char *tmp; - - ddebug("get_next_command()"); - if (interactive) { - fprintf(stdout, "> "); - fflush(stdout); - } - isc_app_block(); - cmdline = fgets(cmdlinebuf, MAXCMD, input); - isc_app_unblock(); - if (cmdline == NULL) - return (STATUS_QUIT); - - /* - * Normalize input by removing any eol. - */ - tmp = cmdline; - (void)nsu_strsep(&tmp, "\r\n"); + ddebug("do_next_command()"); word = nsu_strsep(&cmdline, " \t\r\n"); - if (feof(input)) - return (STATUS_QUIT); if (word == NULL || *word == 0) return (STATUS_SEND); if (word[0] == ';') @@ -1920,8 +1904,22 @@ get_next_command(void) { return (STATUS_QUIT); if (strcasecmp(word, "prereq") == 0) return (evaluate_prereq(cmdline)); + if (strcasecmp(word, "nxdomain") == 0) + return (make_prereq(cmdline, ISC_FALSE, ISC_FALSE)); + if (strcasecmp(word, "yxdomain") == 0) + return (make_prereq(cmdline, ISC_TRUE, ISC_FALSE)); + if (strcasecmp(word, "nxrrset") == 0) + return (make_prereq(cmdline, ISC_FALSE, ISC_TRUE)); + if (strcasecmp(word, "yxrrset") == 0) + return (make_prereq(cmdline, ISC_TRUE, ISC_TRUE)); if (strcasecmp(word, "update") == 0) return (evaluate_update(cmdline)); + if (strcasecmp(word, "delete") == 0) + return (update_addordelete(cmdline, ISC_TRUE)); + if (strcasecmp(word, "del") == 0) + return (update_addordelete(cmdline, ISC_TRUE)); + if (strcasecmp(word, "add") == 0) + return (update_addordelete(cmdline, ISC_FALSE)); if (strcasecmp(word, "server") == 0) return (evaluate_server(cmdline)); if (strcasecmp(word, "local") == 0) @@ -1988,18 +1986,55 @@ get_next_command(void) { "oldgsstsig (use Microsoft's GSS_TSIG to sign the request)\n" "zone name (set the zone to be updated)\n" "class CLASS (set the zone's DNS class, e.g. IN (default), CH)\n" -"prereq nxdomain name (does this name not exist)\n" -"prereq yxdomain name (does this name exist)\n" -"prereq nxrrset .... (does this RRset exist)\n" -"prereq yxrrset .... (does this RRset not exist)\n" -"update add .... (add the given record to the zone)\n" -"update delete .... (remove the given record(s) from the zone)\n"); +"[prereq] nxdomain name (does this name not exist)\n" +"[prereq] yxdomain name (does this name exist)\n" +"[prereq] nxrrset .... (does this RRset exist)\n" +"[prereq] yxrrset .... (does this RRset not exist)\n" +"[update] add .... (add the given record to the zone)\n" +"[update] del[ete] .... (remove the given record(s) from the zone)\n"); return (STATUS_MORE); } fprintf(stderr, "incorrect section name: %s\n", word); return (STATUS_SYNTAX); } +static isc_uint16_t +get_next_command(void) { + isc_uint16_t result = STATUS_QUIT; + char cmdlinebuf[MAXCMD]; + char *cmdline; + + isc_app_block(); + if (interactive) { +#ifdef HAVE_READLINE + cmdline = readline("> "); + add_history(cmdline); +#else + fprintf(stdout, "> "); + fflush(stdout); + cmdline = fgets(cmdlinebuf, MAXCMD, input); +#endif + } else + cmdline = fgets(cmdlinebuf, MAXCMD, input); + isc_app_unblock(); + + if (cmdline != NULL) { + char *tmp = cmdline; + + /* + * Normalize input by removing any eol as readline() + * removes eol but fgets doesn't. + */ + (void)nsu_strsep(&tmp, "\r\n"); + result = do_next_command(cmdline); + } +#ifdef HAVE_READLINE + if (interactive) + free(cmdline); +#endif + return (result); +} + static isc_boolean_t user_interaction(void) { isc_uint16_t result = STATUS_MORE; diff --git a/bin/nsupdate/nsupdate.docbook b/bin/nsupdate/nsupdate.docbook index 6378df7..c54211c 100644 --- a/bin/nsupdate/nsupdate.docbook +++ b/bin/nsupdate/nsupdate.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [<!ENTITY mdash "—">]> <!-- - - Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004-2012 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000-2003 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: nsupdate.docbook,v 1.44 2010/07/09 23:46:51 tbox Exp $ --> +<!-- $Id$ --> <refentry id="man.nsupdate"> <refentryinfo> <date>Aug 25, 2009</date> @@ -42,6 +42,8 @@ <year>2008</year> <year>2009</year> <year>2010</year> + <year>2011</year> + <year>2012</year> <holder>Internet Systems Consortium, Inc. ("ISC")</holder> </copyright> <copyright> @@ -424,7 +426,7 @@ <varlistentry> <term> - <command>prereq nxdomain</command> + <command><optional>prereq</optional> nxdomain</command> <arg choice="req">domain-name</arg> </term> <listitem> @@ -438,7 +440,7 @@ <varlistentry> <term> - <command>prereq yxdomain</command> + <command><optional>prereq</optional> yxdomain</command> <arg choice="req">domain-name</arg> </term> <listitem> @@ -452,7 +454,7 @@ <varlistentry> <term> - <command>prereq nxrrset</command> + <command><optional>prereq</optional> nxrrset</command> <arg choice="req">domain-name</arg> <arg choice="opt">class</arg> <arg choice="req">type</arg> @@ -474,7 +476,7 @@ <varlistentry> <term> - <command>prereq yxrrset</command> + <command><optional>prereq</optional> yxrrset</command> <arg choice="req">domain-name</arg> <arg choice="opt">class</arg> <arg choice="req">type</arg> @@ -496,7 +498,7 @@ <varlistentry> <term> - <command>prereq yxrrset</command> + <command><optional>prereq</optional> yxrrset</command> <arg choice="req">domain-name</arg> <arg choice="opt">class</arg> <arg choice="req">type</arg> @@ -530,7 +532,7 @@ <varlistentry> <term> - <command>update delete</command> + <command><optional>update</optional> del<optional>ete</optional></command> <arg choice="req">domain-name</arg> <arg choice="opt">ttl</arg> <arg choice="opt">class</arg> @@ -556,7 +558,7 @@ <varlistentry> <term> - <command>update add</command> + <command><optional>update</optional> add</command> <arg choice="req">domain-name</arg> <arg choice="req">ttl</arg> <arg choice="opt">class</arg> diff --git a/bin/nsupdate/nsupdate.html b/bin/nsupdate/nsupdate.html index 5c108e3..276d4af 100644 --- a/bin/nsupdate/nsupdate.html +++ b/bin/nsupdate/nsupdate.html @@ -1,5 +1,5 @@ <!-- - - Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004-2012 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000-2003 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -32,7 +32,7 @@ <div class="cmdsynopsis"><p><code class="command">nsupdate</code> [<code class="option">-d</code>] [<code class="option">-D</code>] [[<code class="option">-g</code>] | [<code class="option">-o</code>] | [<code class="option">-l</code>] | [<code class="option">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></code>] | [<code class="option">-k <em class="replaceable"><code>keyfile</code></em></code>]] [<code class="option">-t <em class="replaceable"><code>timeout</code></em></code>] [<code class="option">-u <em class="replaceable"><code>udptimeout</code></em></code>] [<code class="option">-r <em class="replaceable"><code>udpretries</code></em></code>] [<code class="option">-R <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-v</code>] [filename]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543459"></a><h2>DESCRIPTION</h2> +<a name="id2543464"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">nsupdate</strong></span> is used to submit Dynamic DNS Update requests as defined in RFC 2136 to a name server. @@ -192,7 +192,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543790"></a><h2>INPUT FORMAT</h2> +<a name="id2543796"></a><h2>INPUT FORMAT</h2> <p><span><strong class="command">nsupdate</strong></span> reads input from <em class="parameter"><code>filename</code></em> @@ -331,7 +331,7 @@ realm is specified the saved realm is cleared. </p></dd> <dt><span class="term"> - <span><strong class="command">prereq nxdomain</strong></span> + <span><strong class="command">[<span class="optional">prereq</span>] nxdomain</strong></span> {domain-name} </span></dt> <dd><p> @@ -339,7 +339,7 @@ <em class="parameter"><code>domain-name</code></em>. </p></dd> <dt><span class="term"> - <span><strong class="command">prereq yxdomain</strong></span> + <span><strong class="command">[<span class="optional">prereq</span>] yxdomain</strong></span> {domain-name} </span></dt> <dd><p> @@ -348,7 +348,7 @@ exists (has as at least one resource record, of any type). </p></dd> <dt><span class="term"> - <span><strong class="command">prereq nxrrset</strong></span> + <span><strong class="command">[<span class="optional">prereq</span>] nxrrset</strong></span> {domain-name} [class] {type} @@ -364,7 +364,7 @@ is omitted, IN (internet) is assumed. </p></dd> <dt><span class="term"> - <span><strong class="command">prereq yxrrset</strong></span> + <span><strong class="command">[<span class="optional">prereq</span>] yxrrset</strong></span> {domain-name} [class] {type} @@ -381,7 +381,7 @@ is omitted, IN (internet) is assumed. </p></dd> <dt><span class="term"> - <span><strong class="command">prereq yxrrset</strong></span> + <span><strong class="command">[<span class="optional">prereq</span>] yxrrset</strong></span> {domain-name} [class] {type} @@ -410,7 +410,7 @@ RDATA. </p></dd> <dt><span class="term"> - <span><strong class="command">update delete</strong></span> + <span><strong class="command">[<span class="optional">update</span>] del[<span class="optional">ete</span>]</strong></span> {domain-name} [ttl] [class] @@ -431,7 +431,7 @@ is ignored, and is only allowed for compatibility. </p></dd> <dt><span class="term"> - <span><strong class="command">update add</strong></span> + <span><strong class="command">[<span class="optional">update</span>] add</strong></span> {domain-name} {ttl} [class] @@ -480,7 +480,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2544702"></a><h2>EXAMPLES</h2> +<a name="id2544725"></a><h2>EXAMPLES</h2> <p> The examples below show how <span><strong class="command">nsupdate</strong></span> @@ -534,7 +534,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2544746"></a><h2>FILES</h2> +<a name="id2544769"></a><h2>FILES</h2> <div class="variablelist"><dl> <dt><span class="term"><code class="constant">/etc/resolv.conf</code></span></dt> <dd><p> @@ -557,7 +557,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2544829"></a><h2>SEE ALSO</h2> +<a name="id2542121"></a><h2>SEE ALSO</h2> <p> <em class="citetitle">RFC 2136</em>, <em class="citetitle">RFC 3007</em>, @@ -572,7 +572,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2542156"></a><h2>BUGS</h2> +<a name="id2542179"></a><h2>BUGS</h2> <p> The TSIG key is redundantly stored in two separate files. This is a consequence of nsupdate using the DST library diff --git a/bin/rndc/rndc.c b/bin/rndc/rndc.c index e4ce556..e3e6525 100644 --- a/bin/rndc/rndc.c +++ b/bin/rndc/rndc.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: rndc.c,v 1.131.20.3 2011/11/03 22:06:31 each Exp $ */ +/* $Id$ */ /*! \file */ @@ -114,6 +114,11 @@ command is one of the following:\n\ thaw Enable updates to all dynamic zones and reload them.\n\ thaw zone [class [view]]\n\ Enable updates to a frozen dynamic zone and reload it.\n\ + sync [-clean] Dump changes to all dynamic zones to disk, and optionally\n\ + remove their journal files.\n\ + sync [-clean] zone [class [view]]\n\ + Dump a single zone's changes to disk, and optionally\n\ + remove its journal file.\n\ notify zone [class [view]]\n\ Resend NOTIFY messages for the zone.\n\ reconfig Reload configuration file and new zones only.\n\ @@ -122,7 +127,8 @@ command is one of the following:\n\ loadkeys zone [class [view]]\n\ Update keys without signing immediately.\n\ stats Write server statistics to the statistics file.\n\ - querylog Toggle query logging.\n\ + querylog newstate\n\ + Enable / disable query logging.\n\ dumpdb [-all|-cache|-zones] [view ...]\n\ Dump cache(s) to the dump file (named_dump.db).\n\ secroots [view ...]\n\ @@ -140,6 +146,8 @@ command is one of the following:\n\ flush [view] Flushes the server's cache for a view.\n\ flushname name [view]\n\ Flush the given name from the server's cache(s)\n\ + flushtree name [view]\n\ + Flush all names under the given name from the server's cache(s)\n\ status Display status of the server.\n\ recursing Dump the queries that are currently recursing (named.recursing)\n\ tsig-list List all currently active TSIG keys, including both statically\n\ @@ -152,6 +160,20 @@ command is one of the following:\n\ Add zone to given view. Requires new-zone-file option.\n\ delzone [\"file\"] zone [class [view]]\n\ Removes zone from given view. Requires new-zone-file option.\n\ + signing -list zone [class [view]]\n\ + List the private records showing the state of DNSSEC\n\ + signing in the given zone.\n\ + signing -clear <keyid>/<algorithm> zone [class [view]]\n\ + Remove the private record that indicating the given key\n\ + has finished signing the given zone.\n\ + signing -clear all zone [class [view]]\n\ + Remove the private records for all keys that have\n\ + finished signing the given zone.\n\ + signing -nsec3param none zone [class [view]]\n\ + Remove NSEC3 chains from zone.\n\ + signing -nsec3param hash flags iterations salt zone [class [view]]\n\ + Add NSEC3 chain to zone if already signed.\n\ + Prime zone with NSEC3 chain if not yet signed.\n\ *restart Restart the server.\n\ \n\ * == not yet implemented\n\ diff --git a/bin/tools/genrandom.8 b/bin/tools/genrandom.8 index 38c1ccd..fd9ebf4 100644 --- a/bin/tools/genrandom.8 +++ b/bin/tools/genrandom.8 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2009-2012 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2009-2011 Internet Systems Consortium, Inc. ("ISC") .\" .\" Permission to use, copy, modify, and/or distribute this software for any .\" purpose with or without fee is hereby granted, provided that the above @@ -65,5 +65,5 @@ The file name into which random data should be written. .PP Internet Systems Consortium .SH "COPYRIGHT" -Copyright \(co 2009\-2012 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2009\-2011 Internet Systems Consortium, Inc. ("ISC") .br diff --git a/bin/tools/genrandom.docbook b/bin/tools/genrandom.docbook index 730aab9..33d5cf7 100644 --- a/bin/tools/genrandom.docbook +++ b/bin/tools/genrandom.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [<!ENTITY mdash "—">]> <!-- - - Copyright (C) 2009-2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2009-2011 Internet Systems Consortium, Inc. ("ISC") - - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above @@ -17,7 +17,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id$ --> +<!-- $Id: genrandom.docbook,v 1.8 2011/08/08 23:46:41 tbox Exp $ --> <refentry id="man.genrandom"> <refentryinfo> <date>Feb 19, 2009</date> @@ -39,7 +39,6 @@ <year>2009</year> <year>2010</year> <year>2011</year> - <year>2012</year> <holder>Internet Systems Consortium, Inc. ("ISC")</holder> </copyright> </docinfo> diff --git a/bin/tools/genrandom.html b/bin/tools/genrandom.html index f69b7ca..6b70434 100644 --- a/bin/tools/genrandom.html +++ b/bin/tools/genrandom.html @@ -1,5 +1,5 @@ <!-- - - Copyright (C) 2009-2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2009-2011 Internet Systems Consortium, Inc. ("ISC") - - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above @@ -31,7 +31,7 @@ <div class="cmdsynopsis"><p><code class="command">genrandom</code> [<code class="option">-n <em class="replaceable"><code>number</code></em></code>] {<em class="replaceable"><code>size</code></em>} {<em class="replaceable"><code>filename</code></em>}</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543370"></a><h2>DESCRIPTION</h2> +<a name="id2543368"></a><h2>DESCRIPTION</h2> <p> <span><strong class="command">genrandom</strong></span> generates a file or a set of files containing a specified quantity @@ -40,7 +40,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543383"></a><h2>ARGUMENTS</h2> +<a name="id2543381"></a><h2>ARGUMENTS</h2> <div class="variablelist"><dl> <dt><span class="term">-n <em class="replaceable"><code>number</code></em></span></dt> <dd><p> @@ -58,14 +58,14 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2543444"></a><h2>SEE ALSO</h2> +<a name="id2543442"></a><h2>SEE ALSO</h2> <p> <span class="citerefentry"><span class="refentrytitle">rand</span>(3)</span>, <span class="citerefentry"><span class="refentrytitle">arc4random</span>(3)</span> </p> </div> <div class="refsect1" lang="en"> -<a name="id2543470"></a><h2>AUTHOR</h2> +<a name="id2543468"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/bin/tools/nsec3hash.c b/bin/tools/nsec3hash.c index 6a54163..57f24c2 100644 --- a/bin/tools/nsec3hash.c +++ b/bin/tools/nsec3hash.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2006, 2008, 2009, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2006, 2008, 2009, 2011 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -14,7 +14,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: nsec3hash.c,v 1.8 2011/11/02 23:46:24 tbox Exp $ */ #include <config.h> diff --git a/config.h.in b/config.h.in index 6cef676..a6ddcb1 100644 --- a/config.h.in +++ b/config.h.in @@ -289,6 +289,9 @@ int sigwait(const unsigned int *set, int *sig); /* Define if your OpenSSL version supports GOST. */ #undef HAVE_OPENSSL_GOST +/* Define to 1 if you have the `readline' function. */ +#undef HAVE_READLINE + /* Define to 1 if you have the <regex.h> header file. */ #undef HAVE_REGEX_H @@ -361,6 +364,9 @@ int sigwait(const unsigned int *set, int *sig); /* Define to 1 if you have the <unistd.h> header file. */ #undef HAVE_UNISTD_H +/* Define to 1 if you have the `usleep' function. */ +#undef HAVE_USLEEP + /* return type of gai_strerror */ #undef IRS_GAISTRERROR_RETURN_T @@ -384,6 +390,9 @@ int sigwait(const unsigned int *set, int *sig); */ #undef NEED_SECURE_DIRECTORY +/* Use the new XML schema for statistics */ +#undef NEWSTATS + /* Define to the address where bug reports for this package should be sent. */ #undef PACKAGE_BUGREPORT diff --git a/config.threads.in b/config.threads.in index f41d68e..3f1c936 100644 --- a/config.threads.in +++ b/config.threads.in @@ -43,8 +43,13 @@ case $host in # OpenBSD users have reported that named dumps core on # startup when built with threads. use_threads=false ;; -*-freebsd*) +[*-freebsd[1234567].*]) + # Threads are broken at least up to FreeBSD 4.11. + # FreeBSD 5, 6 and 7 we have never officially supported threads + # on. YMMV use_threads=false ;; +*-freebsd*) + use_threads=true ;; [*-bsdi[234]*]) # Thread signals do not work reliably on some versions of BSD/OS. use_threads=false ;; @@ -55,6 +60,10 @@ case $host in # Linux kernels produce unusable core dumps from multithreaded # programs, and because of limitations in setuid(). use_threads=false ;; +*-darwin[[123456789]].*) + use_threads=false ;; +*-darwin*.*) + use_threads=true ;; *) use_threads=false ;; esac diff --git a/configure.in b/configure.in index 8db8dde..8e543d8 100644 --- a/configure.in +++ b/configure.in @@ -18,7 +18,7 @@ AC_DIVERT_PUSH(1)dnl esyscmd([sed "s/^/# /" COPYRIGHT])dnl AC_DIVERT_POP()dnl -AC_REVISION($Revision: 1.512.8.15 $) +AC_REVISION($Revision: 1.533 $) AC_INIT(lib/dns/name.c) AC_PREREQ(2.59) @@ -37,7 +37,7 @@ case $build_os in sunos*) # Just set the maximum command line length for sunos as it otherwise # takes a exceptionally long time to work it out. Required for libtool. - + lt_cv_sys_max_cmd_len=4096; ;; esac @@ -137,6 +137,73 @@ AC_PATH_PROGS(PERL, perl5 perl) AC_SUBST(PERL) # +# Python is also optional; it is used by the tools in bin/python. +# If python is unavailable, we simply don't build those. +# +AC_ARG_WITH(python, +[ --with-python=PATH Specify path to python interpreter], + use_python="$withval", use_python="unspec") + +case "$use_python" in + no) + AC_MSG_RESULT(disabled) + ;; + unspec|yes|*) + case "$use_python" in + unspec|yes|'') + AC_PATH_PROGS(PYTHON, python) + ;; + *) + AC_PATH_PROGS(PYTHON, $use_python) + ;; + esac + if test "X$PYTHON" == "X" + then + case "$use_python" in + unspec) + AC_MSG_RESULT(disabled) + ;; + yes|*) + AC_MSG_ERROR([missing python]) + ;; + esac + break + fi + testscript='try: import argparse +except: exit(1)' + AC_MSG_CHECKING([python module 'argparse']) + if $PYTHON -c "$testscript"; then + AC_MSG_RESULT([found, using $PYTHON]) + else + case "$use_python" in + unspec) + PYTHON="" + AC_SUBST(CHECKDS) + AC_SUBST(COVERAGE) + AC_MSG_RESULT([not found, python disabled]) + ;; + yes) + AC_MSG_RESULT([no found]) + AC_MSG_ERROR([python 'argparse' module not supported]) + ;; + esac + fi + ;; +esac + +PYTHON_TOOLS='' +CHECKDS='' +COVERAGE='' +if test "X$PYTHON" != "X"; then + PYTHON_TOOLS=python + CHECKDS=checkds + COVERAGE=coverage +fi +AC_SUBST(CHECKDS) +AC_SUBST(COVERAGE) +AC_SUBST(PYTHON_TOOLS) + +# # Special processing of paths depending on whether --prefix, # --sysconfdir or --localstatedir arguments were given. What's # desired is some compatibility with the way previous versions @@ -399,6 +466,19 @@ lifconf.lifc_len = 0; AC_SUBST(ISC_PLATFORM_HAVELIFCONF) # +# check if we want the new statistics +# +AC_ARG_ENABLE(newstats, + [ --enable-newstats use the new statistics]) +case "$enable_newstats" in +yes) + AC_DEFINE(NEWSTATS, 1, [Use the new XML schema for statistics]) + ;; +*) + ;; +esac + +# # check if we have kqueue # AC_ARG_ENABLE(kqueue, @@ -662,7 +742,7 @@ shared library configuration (e.g., LD_LIBRARY_PATH).)], ], [AC_MSG_RESULT(assuming it does work on target platform)] ) - + AC_ARG_ENABLE(openssl-version-check, [AC_HELP_STRING([--enable-openssl-version-check], [Check OpenSSL Version @<:@default=yes@:>@])]) @@ -1334,7 +1414,7 @@ AC_CHECK_LIB(scf, smf_enable_instance) AC_CHECK_FUNC(flockfile, AC_DEFINE(HAVE_FLOCKFILE),) AC_CHECK_FUNC(getc_unlocked, AC_DEFINE(HAVE_GETCUNLOCKED),) -# +# # Indicate what the final decision was regarding threads. # AC_MSG_CHECKING(whether to build with threads) @@ -1344,7 +1424,7 @@ else AC_MSG_RESULT(no) fi -# +# # End of pthreads stuff. # @@ -1975,7 +2055,7 @@ AC_TRY_RUN([ #include <netinet/in.h> #include <arpa/inet.h> main() { char a[16]; return (inet_pton(AF_INET, "1.2.3", a) == 1 ? 1 : - inet_pton(AF_INET, "1.2.3.04", a) == 1 ? 1 : + inet_pton(AF_INET, "1.2.3.04", a) == 1 ? 1 : (inet_pton(AF_INET6, "::1.2.3.4", a) != 1)); }], [AC_MSG_RESULT(yes) ISC_PLATFORM_NEEDPTON="#undef ISC_PLATFORM_NEEDPTON"], @@ -2216,7 +2296,7 @@ AC_ARG_ENABLE(getifaddrs, # This interface iteration code for getifaddrs() will fall back to using # /proc/net/if_inet6 if getifaddrs() in glibc doesn't return any IPv6 # addresses. -# +# case $want_getifaddrs in glibc) AC_MSG_WARN("--enable-getifaddrs=glibc is no longer required") @@ -2291,6 +2371,29 @@ AC_CHECK_FUNC(strlcat, [ISC_PLATFORM_NEEDSTRLCAT="#define ISC_PLATFORM_NEEDSTRLCAT 1"]) AC_SUBST(ISC_PLATFORM_NEEDSTRLCAT) + +AC_SUBST(READLINE_LIB) +AC_ARG_WITH(readline, + [ --with-readline[=LIBSPEC] specify readline library [default -lreadline]], + readline="$withval", readline="-lreadline") +case "$readline" in +no) ;; +*) + if test "x$readline" = "xyes" + then + readline=-lreadline + fi + saved_LIBS="$LIBS" + LIBS="$readline" + AC_CHECK_FUNCS(readline) + if test "$ac_cv_func_readline" = "yes" + then + READLINE_LIB="$readline" + fi + LIBS="$saved_LIBS" + ;; +esac + ISC_PRINT_OBJS= ISC_PRINT_SRCS= AC_MSG_CHECKING(sprintf) @@ -2376,7 +2479,7 @@ main() { sprintf(buf, "%lld", j); exit((sizeof(long long int) != sizeof(long int))? 0 : (strcmp(buf, "0") != 0)); -} +} ], [AC_MSG_RESULT(ll) ISC_PLATFORM_QUADFORMAT='#define ISC_PLATFORM_QUADFORMAT "ll"' @@ -2641,7 +2744,7 @@ yes) esac AC_SUBST(ISC_PLATFORM_HAVEIFNAMETOINDEX) -AC_CHECK_FUNCS(nanosleep) +AC_CHECK_FUNCS(nanosleep usleep) # # Machine architecture dependent features @@ -2768,7 +2871,7 @@ if test "$have_atomic" = "yes"; then else case "$host" in alpha*-dec-osf*) - # Tru64 compiler has its own syntax for inline + # Tru64 compiler has its own syntax for inline # assembly. AC_TRY_COMPILE(, [ #ifndef __DECC @@ -2990,11 +3093,11 @@ AC_SUBST(DOXYGEN) # NOM_PATH_FILE(VARIABLE, FILENAME, DIRECTORIES) # # If the file FILENAME is found in one of the DIRECTORIES, the shell -# variable VARIABLE is defined to its absolute pathname. Otherwise, +# variable VARIABLE is defined to its absolute pathname. Otherwise, # it is set to FILENAME, with no directory prefix (that's not terribly # useful, but looks less confusing in substitutions than leaving it # empty). The variable VARIABLE will be substituted into output files. -# +# AC_DEFUN(NOM_PATH_FILE, [ $1="" @@ -3304,7 +3407,7 @@ DLZ_DRIVER_SRCS="" DLZ_DRIVER_OBJS="" DLZ_SYSTEM_TEST="" -# +# # Configure support for building a shared library object # # Even when libtool is available it can't always be relied upon @@ -3415,8 +3518,8 @@ if test "$cross_compiling" = "yes"; then BUILD_LDFLAGS="$BUILD_LDFLAGS" BUILD_LIBS="$BUILD_LIBS" else - BUILD_CC="$CC" - BUILD_CFLAGS="$CFLAGS" + BUILD_CC="$CC" + BUILD_CFLAGS="$CFLAGS" BUILD_CPPFLAGS="$CPPFLAGS $GEN_NEED_OPTARG" BUILD_LDFLAGS="$LDFLAGS" BUILD_LIBS="$LIBS" @@ -3545,6 +3648,9 @@ AC_CONFIG_FILES([ bin/named/unix/Makefile bin/nsupdate/Makefile bin/pkcs11/Makefile + bin/python/Makefile + bin/python/dnssec-checkds.py + bin/python/dnssec-coverage.py bin/rndc/Makefile bin/tests/Makefile bin/tests/atomic/Makefile @@ -3584,6 +3690,7 @@ AC_CONFIG_FILES([ bin/tests/system/gost/prereq.sh bin/tests/system/lwresd/Makefile bin/tests/system/rpz/Makefile + bin/tests/system/rsabigexponent/Makefile bin/tests/system/tkey/Makefile bin/tests/system/tsiggss/Makefile bin/tests/tasks/Makefile @@ -3698,7 +3805,7 @@ yes) esac if test "X$USE_OPENSSL" = "X"; then -cat << \EOF +cat << \EOF BIND is being built without OpenSSL. This means it will not have DNSSEC support. EOF fi diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml index cec0b24..8625554 100644 --- a/doc/arm/Bv9ARM-book.xml +++ b/doc/arm/Bv9ARM-book.xml @@ -72,7 +72,7 @@ </para> <para> - This version of the manual corresponds to BIND version 9.8. + This version of the manual corresponds to BIND version 9.9. </para> </sect1> @@ -1237,15 +1237,12 @@ zone "eng.example.com" { <listitem> <para> Suspend updates to a dynamic zone. If no zone is - specified, - then all zones are suspended. This allows manual - edits to be made to a zone normally updated by dynamic - update. It - also causes changes in the journal file to be synced - into the master - and the journal file to be removed. All dynamic - update attempts will - be refused while the zone is frozen. + specified, then all zones are suspended. This allows + manual edits to be made to a zone normally updated by + dynamic update. It also causes changes in the + journal file to be synced into the master file. + All dynamic update attempts will be refused while + the zone is frozen. </para> </listitem> </varlistentry> @@ -1257,15 +1254,34 @@ zone "eng.example.com" { <optional><replaceable>view</replaceable></optional></optional></optional></userinput></term> <listitem> <para> - Enable updates to a frozen dynamic zone. If no zone - is - specified, then all frozen zones are enabled. This - causes - the server to reload the zone from disk, and - re-enables dynamic updates - after the load has completed. After a zone is thawed, - dynamic updates - will no longer be refused. + Enable updates to a frozen dynamic zone. If no + zone is specified, then all frozen zones are + enabled. This causes the server to reload the zone + from disk, and re-enables dynamic updates after the + load has completed. After a zone is thawed, + dynamic updates will no longer be refused. If + the zone has changed and the + <command>ixfr-from-differences</command> option is + in use, then the journal file will be updated to + reflect changes in the zone. Otherwise, if the + zone has changed, any existing journal file will be + removed. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term><userinput>sync + <optional>-clean</optional> + <optional><replaceable>zone</replaceable> + <optional><replaceable>class</replaceable> + <optional><replaceable>view</replaceable></optional></optional></optional></userinput></term> + <listitem> + <para> + Sync changes in the journal file for a dynamic zone + to the master file. If the "-clean" option is + specified, the journal file is also removed. If + no zone is specified, then all zones are synced. </para> </listitem> </varlistentry> @@ -1306,10 +1322,17 @@ zone "eng.example.com" { </varlistentry> <varlistentry> - <term><userinput>querylog</userinput></term> + <term><userinput>querylog</userinput> + <optional>on|off</optional> + </term> <listitem> <para> - Toggle query logging. Query logging can also be enabled + Enable or disable query logging. (For backward + compatibility, this command can also be used without + an argument to toggle query logging on and off.) + </para> + <para> + Query logging can also be enabled by explicitly directing the <command>queries</command> <command>category</command> to a <command>channel</command> in the @@ -1417,10 +1440,29 @@ zone "eng.example.com" { </varlistentry> <varlistentry> - <term><userinput>flushname</userinput> <replaceable>name</replaceable></term> + <term><userinput>flushname</userinput> + <replaceable>name</replaceable> + <optional><replaceable>view</replaceable></optional> + </term> <listitem> <para> - Flushes the given name from the server's cache. + Flushes the given name from the server's DNS cache, + and from the server's nameserver address database + if applicable. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term><userinput>flushtree</userinput> + <replaceable>name</replaceable> + <optional><replaceable>view</replaceable></optional> + </term> + <listitem> + <para> + Flushes the given name, and all of its subdomains, + from the server's DNS cache. (The server's + nameserver address database is not affected.) </para> </listitem> </varlistentry> @@ -1547,6 +1589,75 @@ zone "eng.example.com" { </listitem> </varlistentry> + <varlistentry> + <term><userinput>signing + <optional>( -list | -clear <replaceable>keyid/algorithm</replaceable> | -clear <literal>all</literal> | -nsec3param ( <replaceable>parameters</replaceable> | <literal>none</literal> ) ) </optional> + <replaceable>zone</replaceable> + <optional><replaceable>class</replaceable> + <optional><replaceable>view</replaceable></optional></optional> + </userinput></term> + <listitem> + <para> + List, edit, or remove the DNSSEC signing state for + the specified zone. The status of ongoing DNSSEC + operations (such as signing or generating + NSEC3 chains) is stored in the zone in the form + of DNS resource records of type + <command>sig-signing-type</command>. + <command>rndc signing -list</command> converts + these records into a human-readable form, + indicating which keys are currently signing + or have finished signing the zone, and which NSEC3 + NSEC3 chains are being created or removed. + </para> + <para> + <command>rndc signing -clear</command> can remove + a single key (specified in the same format that + <command>rndc signing -list</command> uses to + display it), or all keys. In either case, only + completed keys are removed; any record indicating + that a key has not yet finished signing the zone + will be retained. + </para> + <para> + <command>rndc signing -nsec3param</command> sets + the NSEC3 parameters for a zone. This is the + only supported mechanism for using NSEC3 with + <command>inline-signing</command> zones. + Parameters are specified in the same format as + an NSEC3PARAM resource record: hash algorithm, + flags, iterations, and salt, in that order. + </para> + <para> + Currently, the only defined value for hash algorithm + is <literal>1</literal>, representing SHA-1. + The <option>flags</option> may be set to + <literal>0</literal> or <literal>1</literal>, + depending on whether you wish to set the opt-out + bit in the NSEC3 chain. <option>iterations</option> + defines the number of additional times to apply + the algorithm when generating an NSEC3 hash. The + <option>salt</option> is a string of data expressed + in hexidecimal, or a hyphen (`-') if no salt is + to be used. + </para> + <para> + So, for example, to create an NSEC3 chain using + the SHA-1 hash algorithm, no opt-out flag, + 10 iterations, and a salt value of "FFFF", use: + <command>rndc signing -nsec3param 1 0 10 FFFF <zone></command>. + To set the opt-out flag, 15 iterations, and no + salt, use: + <command>rndc signing -nsec3param 1 1 15 - <zone></command>. + </para> + <para> + <command>rndc signing -nsec3param none</command> + removes an existing NSEC3 chain and replaces it + with NSEC. + </para> + </listitem> + </varlistentry> + </variablelist> <para> @@ -1925,13 +2036,11 @@ controls { </para> <para> - When acting as a slave, <acronym>BIND</acronym> 9 will attempt - to use IXFR unless it is explicitly disabled via the - <command>request-ixfr</command> option or the use of - <command>ixfr-from-differences</command>. For - more information about disabling IXFR, see the description - of the <command>request-ixfr</command> clause of the - <command>server</command> statement. + When acting as a slave, <acronym>BIND</acronym> 9 will + attempt to use IXFR unless + it is explicitly disabled. For more information about disabling + IXFR, see the description of the <command>request-ixfr</command> clause + of the <command>server</command> statement. </para> </sect1> @@ -3649,7 +3758,9 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa. <entry colname="2"> <para> defines a named masters list for - inclusion in stub and slave zone masters clauses. + inclusion in stub and slave zones' + <command>masters</command> or + <command>also-notify</command> lists. </para> </entry> </row> @@ -4589,11 +4700,17 @@ category notify { null; }; </para> <para> - <computeroutput>client 127.0.0.1#62536: query: www.example.com IN AAAA +SE</computeroutput> + <computeroutput>client 127.0.0.1#62536 (www.example.com): query: www.example.com IN AAAA +SE</computeroutput> </para> <para> - <computeroutput>client ::1#62537: query: www.example.net IN AAAA -SE</computeroutput> + <computeroutput>client ::1#62537 (www.example.net): query: www.example.net IN AAAA -SE</computeroutput> </para> + <para> + (The first part of this log message, showing the + client address/port number and query name, is + repeated in all subsequent log messages related + to the same query.) + </para> </entry> </row> <row rowsep="0"> @@ -5021,7 +5138,8 @@ badresp:1,adberr:0,findfail:0,valfail:0] Usage</title> <para><command>masters</command> lists allow for a common set of masters to be easily used by - multiple stub and slave zones. + multiple stub and slave zones in their <command>masters</command> + or <command>also-notify</command> lists. </para> </sect2> @@ -5058,7 +5176,7 @@ badresp:1,adberr:0,findfail:0,valfail:0] <optional> pid-file <replaceable>path_name</replaceable>; </optional> <optional> recursing-file <replaceable>path_name</replaceable>; </optional> <optional> statistics-file <replaceable>path_name</replaceable>; </optional> - <optional> zone-statistics <replaceable>yes_or_no</replaceable>; </optional> + <optional> zone-statistics <replaceable>full</replaceable> | <replaceable>terse</replaceable> | <replaceable>none</replaceable>; </optional> <optional> auth-nxdomain <replaceable>yes_or_no</replaceable>; </optional> <optional> deallocate-on-exit <replaceable>yes_or_no</replaceable>; </optional> <optional> dialup <replaceable>dialup_option</replaceable>; </optional> @@ -5112,7 +5230,9 @@ badresp:1,adberr:0,findfail:0,valfail:0] <optional> allow-update { <replaceable>address_match_list</replaceable> }; </optional> <optional> allow-update-forwarding { <replaceable>address_match_list</replaceable> }; </optional> <optional> update-check-ksk <replaceable>yes_or_no</replaceable>; </optional> + <optional> dnssec-update-mode ( <replaceable>maintain</replaceable> | <replaceable>no-resign</replaceable> ); </optional> <optional> dnssec-dnskey-kskonly <replaceable>yes_or_no</replaceable>; </optional> + <optional> dnssec-loadkeys-interval <replaceable>number</replaceable>; </optional> <optional> dnssec-secure-to-insecure <replaceable>yes_or_no</replaceable> ;</optional> <optional> try-tcp-refresh <replaceable>yes_or_no</replaceable>; </optional> <optional> allow-v6-synthesis { <replaceable>address_match_list</replaceable> }; </optional> @@ -5158,8 +5278,9 @@ badresp:1,adberr:0,findfail:0,valfail:0] <optional> notify-source (<replaceable>ip4_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> ; </optional> <optional> notify-source-v6 (<replaceable>ip6_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> ; </optional> <optional> notify-to-soa <replaceable>yes_or_no</replaceable> ; </optional> - <optional> also-notify { <replaceable>ip_addr</replaceable> <optional>port <replaceable>ip_port</replaceable></optional> ; - <optional> <replaceable>ip_addr</replaceable> <optional>port <replaceable>ip_port</replaceable></optional> ; ... </optional> }; </optional> + <optional> also-notify { <replaceable>ip_addr</replaceable> + <optional>port <replaceable>ip_port</replaceable></optional> <optional>key <replaceable>keyname</replaceable></optional> ; + <optional> <replaceable>ip_addr</replaceable> <optional>port <replaceable>ip_port</replaceable></optional> <optional>key <replaceable>keyname</replaceable></optional> ; ... </optional> }; </optional> <optional> max-ixfr-log-size <replaceable>number</replaceable>; </optional> <optional> max-journal-size <replaceable>size_spec</replaceable>; </optional> <optional> coresize <replaceable>size_spec</replaceable> ; </optional> @@ -5210,6 +5331,7 @@ badresp:1,adberr:0,findfail:0,valfail:0] <optional> preferred-glue ( <replaceable>A</replaceable> | <replaceable>AAAA</replaceable> | <replaceable>NONE</replaceable> ); </optional> <optional> edns-udp-size <replaceable>number</replaceable>; </optional> <optional> max-udp-size <replaceable>number</replaceable>; </optional> + <optional> max-rsa-exponent-size <replaceable>number</replaceable>; </optional> <optional> root-delegation-only <optional> exclude { <replaceable>namelist</replaceable> } </optional> ; </optional> <optional> querylog <replaceable>yes_or_no</replaceable> ; </optional> <optional> disable-algorithms <replaceable>domain</replaceable> { <replaceable>algorithm</replaceable>; @@ -5905,6 +6027,73 @@ options { </listitem> </varlistentry> + <varlistentry> + <term><command>dnssec-update-mode</command></term> + <listitem> + <para> + If this option is set to its default value of + <literal>maintain</literal> in a zone of type + <literal>master</literal> which is DNSSEC-signed + and configured to allow dynamic updates (see + <xref linkend="dynamic_update_policies"/>), and + if <command>named</command> has access to the + private signing key(s) for the zone, then + <command>named</command> will automatically sign all new + or changed records and maintain signatures for the zone + by regenerating RRSIG records whenever they approach + their expiration date. + </para> + <para> + If the option is changed to <literal>no-resign</literal>, + then <command>named</command> will sign all new or + changed records, but scheduled maintenance of + signatures is disabled. + </para> + <para> + With either of these settings, <command>named</command> + will reject updates to a DNSSEC-signed zone when the + signing keys are inactive or unavailable to + <command>named</command>. (A planned third option, + <literal>external</literal>, will disable all automatic + signing and allow DNSSEC data to be submitted into a zone + via dyanmic update; this is not yet implemented.) + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term><command>zone-statistics</command></term> + <listitem> + <para> + If <userinput>full</userinput>, the server will collect + statistical data on all zones (unless specifically + turned off on a per-zone basis by specifying + <command>zone-statistics terse</command> or + <command>zone-statistics none</command> + in the <command>zone</command> statement). + The default is <userinput>terse</userinput>, providing + minimal statistics on zones (including name and + current serial number, but not query type + counters). + </para> + <para> + These statistics may be accessed via the + <command>statistics-channel</command> or + using <command>rndc stats</command>, which + will dump them to the file listed + in the <command>statistics-file</command>. See + also <xref linkend="statsfile"/>. + </para> + <para> + For backward compatibility with earlier versions + of BIND 9, the <command>zone-statistics</command> + option can also accept <userinput>yes</userinput> + or <userinput>no</userinput>, which have the same + effect as <userinput>full</userinput> and + <userinput>terse</userinput>, respectively. + </para> + </listitem> + </varlistentry> </variablelist> <sect3 id="boolean_options"> @@ -6419,25 +6608,6 @@ options { </varlistentry> <varlistentry> - <term><command>zone-statistics</command></term> - <listitem> - <para> - If <userinput>yes</userinput>, the server will collect - statistical data on all zones (unless specifically turned - off - on a per-zone basis by specifying <command>zone-statistics no</command> - in the <command>zone</command> statement). - The default is <userinput>no</userinput>. - These statistics may be accessed - using <command>rndc stats</command>, which will - dump them to the file listed - in the <command>statistics-file</command>. See - also <xref linkend="statsfile"/>. - </para> - </listitem> - </varlistentry> - - <varlistentry> <term><command>use-ixfr</command></term> <listitem> <para> @@ -6658,13 +6828,14 @@ options { <term><command>ixfr-from-differences</command></term> <listitem> <para> - When <userinput>yes</userinput> and the server loads a new version of a master - zone from its zone file or receives a new version of a slave - file by a non-incremental zone transfer, it will compare - the new version to the previous one and calculate a set - of differences. The differences are then logged in the - zone's journal file such that the changes can be transmitted - to downstream slaves as an incremental zone transfer. + When <userinput>yes</userinput> and the server loads a new + version of a master zone from its zone file or receives a + new version of a slave file via zone transfer, it will + compare the new version to the previous one and calculate + a set of differences. The differences are then logged in + the zone's journal file such that the changes can be + transmitted to downstream slaves as an incremental zone + transfer. </para> <para> By allowing incremental zone transfers to be used for @@ -6979,6 +7150,26 @@ options { </varlistentry> <varlistentry> + <term><command>dnssec-loadkeys-interval</command></term> + <listitem> + <para> + When a zone is configured with <command>auto-dnssec + maintain;</command> its key repository must be checked + periodically to see if any new keys have been added + or any existing keys' timing metadata has been updated + (see <xref linkend="man.dnssec-keygen"/> and + <xref linkend="man.dnssec-settime"/>). The + <command>dnssec-loadkeys-interval</command> option + sets the frequency of autoatic repository checks, in + minutes. The default is <literal>60</literal> (1 hour), + the minimum is <literal>1</literal> (1 minute), and the + maximum is <literal>1440</literal> (24 hours); any higher + value is silently reduced. + </para> + </listitem> + </varlistentry> + + <varlistentry> <term><command>try-tcp-refresh</command></term> <listitem> <para> @@ -7633,6 +7824,13 @@ avoid-v6-udp-ports {}; <command>also-notify</command> address to send the notify messages to a port other than the default of 53. + An optional TSIG key can also be specified with each + address to cause the notify messages to be signed; this + can be useful when sending notifies to multiple views. + In place of explicit addresses, one or more named + <command>masters</command> lists can be used. + </para> + <para> If an <command>also-notify</command> list is given in a <command>zone</command> statement, it will override @@ -8099,8 +8297,10 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; approaches the specified size, some of the oldest transactions in the journal - will be automatically removed. The default is - <literal>unlimited</literal>. + will be automatically removed. The largest permitted + value is 2 gigabytes. The default is + <literal>unlimited</literal>, which also + means 2 gigabytes. This may also be set on a per-zone basis. </para> </listitem> @@ -8547,8 +8747,10 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; </para> <para> If multiple <command>rrset-order</command> statements - appear, - they are not combined — the last one applies. + appear, they are not combined — the last one applies. + </para> + <para> + By default, all records are returned in random order. </para> <note> @@ -8706,6 +8908,15 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; It is expected that this parameter may be removed in a future version once there is a standard type. </para> + <para> + These records can be removed from the zone once named + has completed signing the zone with the matching key + using <command>nsupdate</command> or + <command>rndc signing -clear</command>. + <command>rndc signing -clear</command> is the only supported + way to remove these records from + <command>inline-signing</command> zones. + </para> </listitem> </varlistentry> @@ -8799,9 +9010,14 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; the file format of zone files (see <xref linkend="zonefile_format"/>). The default value is <constant>text</constant>, which is the - standard textual representation. Files in other formats - than <constant>text</constant> are typically expected - to be generated by the <command>named-compilezone</command> tool. + standard textual representation, except for slave zones, + in which the default value is <constant>raw</constant>. + Files in other formats than <constant>text</constant> are + typically expected to be generated by the + <command>named-compilezone</command> tool, or dumped by + <command>named</command>. + </para> + <para> Note that when a zone file in a different format than <constant>text</constant> is loaded, <command>named</command> may omit some of the checks which would be performed for a @@ -8870,6 +9086,18 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; </para> </listitem> </varlistentry> + + <varlistentry> + <term><command>max-rsa-exponent-size</command></term> + <listitem> + <para> + The maximum RSA exponent size, in bits, that will + be accepted when validating. Valid values are 35 + to 4096 bits. The default zero (0) is also accepted + and is equivalent to 4096. + </para> + </listitem> + </varlistentry> </variablelist> </sect3> @@ -9759,8 +9987,9 @@ ns.domain.com.rpz-nsdname CNAME . the local server, acting as a slave, will request incremental zone transfers from the given remote server, a master. If not set, the value of the <command>request-ixfr</command> option in - the view or - global options block is used as a default. + the view or global options block is used as a default. It may + also be set in the zone block and, if set there, it will + override the global or view setting for that zone. </para> <para> @@ -9952,6 +10181,35 @@ ns.domain.com.rpz-nsdname CNAME . <command>named</command> will not open any communication channels. </para> + <para> + If the statistics channel is configured to listen on 127.0.0.1 + port 8888, then the statistics are accessible in XML format at + <ulink url="http://127.0.0.1:8888/" + >http://127.0.0.1:8888/</ulink> or + <ulink url="http://127.0.0.1:8888/xml" + >http://127.0.0.1:8888/xml</ulink>. A CSS file is + included which can format the XML statistics into tables + when viewed with a stylesheet-capable browser. When + <acronym>BIND</acronym> 9 is configured with --enable-newstats, + a new XML schema is used (version 3) which adds additional + zone statistics and uses a flatter tree for more efficient + parsing. The stylesheet included uses the Google Charts API + to render data into into charts and graphs when using a + javascript-capable browser. + </para> + + <para> + Applications that depend on a particular XML schema + can request + <ulink url="http://127.0.0.1:8888/xml/v2" + >http://127.0.0.1:8888/xml/v2</ulink> for version 2 + of the statistics XML schema or + <ulink url="http://127.0.0.1:8888/xml/v3" + >http://127.0.0.1:8888/xml/v3</ulink> for version 3. + If the requested schema is supported by the server, then + it will respond; if not, it will return a "page not found" + error. + </para> </sect2> <sect2 id="trusted-keys"> @@ -10283,6 +10541,9 @@ view "external" { <optional> allow-query-on { <replaceable>address_match_list</replaceable> }; </optional> <optional> allow-transfer { <replaceable>address_match_list</replaceable> }; </optional> <optional> allow-update { <replaceable>address_match_list</replaceable> }; </optional> + <optional> update-check-ksk <replaceable>yes_or_no</replaceable>; </optional> + <optional> dnssec-dnskey-kskonly <replaceable>yes_or_no</replaceable>; </optional> + <optional> dnssec-loadkeys-interval <replaceable>number</replaceable>; </optional> <optional> update-policy <replaceable>local</replaceable> | { <replaceable>update_policy_rule</replaceable> <optional>...</optional> }; </optional> <optional> also-notify { <replaceable>ip_addr</replaceable> <optional>port <replaceable>ip_port</replaceable></optional> ; <optional> <replaceable>ip_addr</replaceable> <optional>port <replaceable>ip_port</replaceable></optional> ; ... </optional> }; </optional> @@ -10301,6 +10562,7 @@ view "external" { <optional> ixfr-base <replaceable>string</replaceable> ; </optional> <optional> ixfr-from-differences <replaceable>yes_or_no</replaceable>; </optional> <optional> ixfr-tmp-file <replaceable>string</replaceable> ; </optional> + <optional> request-ixfr <replaceable>yes_or_no</replaceable> ; </optional> <optional> maintain-ixfr-base <replaceable>yes_or_no</replaceable> ; </optional> <optional> max-ixfr-log-size <replaceable>number</replaceable> ; </optional> <optional> max-transfer-idle-out <replaceable>number</replaceable> ; </optional> @@ -10311,7 +10573,7 @@ view "external" { <optional> pubkey <replaceable>number</replaceable> <replaceable>number</replaceable> <replaceable>number</replaceable> <replaceable>string</replaceable> ; </optional> <optional> notify-source (<replaceable>ip4_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> ; </optional> <optional> notify-source-v6 (<replaceable>ip6_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> ; </optional> - <optional> zone-statistics <replaceable>yes_or_no</replaceable> ; </optional> + <optional> zone-statistics <replaceable>full</replaceable> | <replaceable>terse</replaceable> | <replaceable>none</replaceable>; </optional> <optional> sig-validity-interval <replaceable>number</replaceable> <optional><replaceable>number</replaceable></optional> ; </optional> <optional> sig-signing-nodes <replaceable>number</replaceable> ; </optional> <optional> sig-signing-signatures <replaceable>number</replaceable> ; </optional> @@ -10323,7 +10585,9 @@ view "external" { <optional> max-retry-time <replaceable>number</replaceable> ; </optional> <optional> key-directory <replaceable>path_name</replaceable>; </optional> <optional> auto-dnssec <constant>allow</constant>|<constant>maintain</constant>|<constant>off</constant>; </optional> + <optional> inline-signing <replaceable>yes_or_no</replaceable>; </optional> <optional> zero-no-soa-ttl <replaceable>yes_or_no</replaceable> ; </optional> + <optional> serial-update-method <constant>increment</constant>|<constant>unixtime</constant>; </optional> }; zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replaceable></optional> { @@ -10333,13 +10597,15 @@ zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replacea <optional> allow-query-on { <replaceable>address_match_list</replaceable> }; </optional> <optional> allow-transfer { <replaceable>address_match_list</replaceable> }; </optional> <optional> allow-update-forwarding { <replaceable>address_match_list</replaceable> }; </optional> - <optional> update-check-ksk <replaceable>yes_or_no</replaceable>; </optional> <optional> dnssec-update-mode ( <replaceable>maintain</replaceable> | <replaceable>no-resign</replaceable> ); </optional> + <optional> update-check-ksk <replaceable>yes_or_no</replaceable>; </optional> <optional> dnssec-dnskey-kskonly <replaceable>yes_or_no</replaceable>; </optional> + <optional> dnssec-loadkeys-interval <replaceable>number</replaceable>; </optional> <optional> dnssec-secure-to-insecure <replaceable>yes_or_no</replaceable> ; </optional> <optional> try-tcp-refresh <replaceable>yes_or_no</replaceable>; </optional> - <optional> also-notify { <replaceable>ip_addr</replaceable> <optional>port <replaceable>ip_port</replaceable></optional> ; - <optional> <replaceable>ip_addr</replaceable> <optional>port <replaceable>ip_port</replaceable></optional> ; ... </optional> }; </optional> + <optional> also-notify <optional>port <replaceable>ip_port</replaceable></optional> { ( <replaceable>masters_list</replaceable> | <replaceable>ip_addr</replaceable> + <optional>port <replaceable>ip_port</replaceable></optional> + <optional>key <replaceable>key</replaceable></optional> ) ; <optional>...</optional> }; </optional> <optional> check-names (<constant>warn</constant>|<constant>fail</constant>|<constant>ignore</constant>) ; </optional> <optional> dialup <replaceable>dialup_option</replaceable> ; </optional> <optional> file <replaceable>string</replaceable> ; </optional> @@ -10372,12 +10638,19 @@ zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replacea <optional> use-alt-transfer-source <replaceable>yes_or_no</replaceable>; </optional> <optional> notify-source (<replaceable>ip4_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> ; </optional> <optional> notify-source-v6 (<replaceable>ip6_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> ; </optional> - <optional> zone-statistics <replaceable>yes_or_no</replaceable> ; </optional> + <optional> zone-statistics <replaceable>full</replaceable> | <replaceable>terse</replaceable> | <replaceable>none</replaceable>; </optional> + <optional> sig-validity-interval <replaceable>number</replaceable> <optional><replaceable>number</replaceable></optional> ; </optional> + <optional> sig-signing-nodes <replaceable>number</replaceable> ; </optional> + <optional> sig-signing-signatures <replaceable>number</replaceable> ; </optional> + <optional> sig-signing-type <replaceable>number</replaceable> ; </optional> <optional> database <replaceable>string</replaceable> ; </optional> <optional> min-refresh-time <replaceable>number</replaceable> ; </optional> <optional> max-refresh-time <replaceable>number</replaceable> ; </optional> <optional> min-retry-time <replaceable>number</replaceable> ; </optional> <optional> max-retry-time <replaceable>number</replaceable> ; </optional> + <optional> key-directory <replaceable>path_name</replaceable>; </optional> + <optional> auto-dnssec <constant>allow</constant>|<constant>maintain</constant>|<constant>off</constant>; </optional> + <optional> inline-signing <replaceable>yes_or_no</replaceable>; </optional> <optional> multi-master <replaceable>yes_or_no</replaceable> ; </optional> <optional> zero-no-soa-ttl <replaceable>yes_or_no</replaceable> ; </optional> }; @@ -10437,6 +10710,13 @@ zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replacea <optional> delegation-only <replaceable>yes_or_no</replaceable> ; </optional> }; +zone <replaceable>"."</replaceable> <optional><replaceable>class</replaceable></optional> { + type redirect; + file <replaceable>string</replaceable> ; + <optional> masterfile-format (<constant>text</constant>|<constant>raw</constant>) ; </optional> + <optional> allow-query { <replaceable>address_match_list</replaceable> }; </optional> +}; + zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replaceable></optional> { type delegation-only; }; @@ -10680,6 +10960,64 @@ zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replacea <row rowsep="0"> <entry colname="1"> <para> + <varname>redirect</varname> + </para> + </entry> + <entry colname="2"> + <para> + Redirect zones are used to provide answers to + queries when normal resolution would result in + NXDOMAIN being returned. + Only one redirect zone is supported + per view. <command>allow-query</command> can be + used to restrict which clients see these answers. + </para> + <para> + If the client has requested DNSSEC records (DO=1) and + the NXDOMAIN response is signed then no substitution + will occur. + </para> + <para> + To redirect all NXDOMAIN responses to + 100.100.100.2 and + 2001:ffff:ffff::100.100.100.2, one would + configure a type redirect zone named ".", + with the zone file containing wildcard records + that point to the desired addresses: + <literal>"*. IN A 100.100.100.2"</literal> + and + <literal>"*. IN AAAA 2001:ffff:ffff::100.100.100.2"</literal>. + </para> + <para> + To redirect all Spanish names (under .ES) one + would use similar entries but with the names + "*.ES." instead of "*.". To redirect all + commercial Spanish names (under COM.ES) one + would use wildcard entries called "*.COM.ES.". + </para> + <para> + Note that the redirect zone supports all + possible types; it is not limited to A and + AAAA records. + </para> + <para> + Because redirect zones are not referenced + directly by name, they are not kept in the + zone lookup table with normal master and slave + zones. Consequently, it is not currently possible + to use + <command>rndc reload + <replaceable>zonename</replaceable></command> + to reload a redirect zone. However, when using + <command>rndc reload</command> without specifying + a zone name, redirect zones will be reloaded along + with other zones. + </para> + </entry> + </row> + <row rowsep="0"> + <entry colname="1"> + <para> <varname>delegation-only</varname> </para> </entry> @@ -10823,6 +11161,9 @@ zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replacea with each <command>also-notify</command> address to send the notify messages to a port other than the default of 53. + A TSIG key may also be specified to cause the + <literal>NOTIFY</literal> to be signed by the + given key. <command>also-notify</command> is not meaningful for stub zones. The default is the empty list. @@ -10916,6 +11257,16 @@ zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replacea </varlistentry> <varlistentry> + <term><command>dnssec-update-mode</command></term> + <listitem> + <para> + See the description of + <command>dnssec-update-mode</command> in <xref linkend="options"/>. + </para> + </listitem> + </varlistentry> + + <varlistentry> <term><command>dnssec-dnskey-kskonly</command></term> <listitem> <para> @@ -11418,23 +11769,55 @@ example.com. NS ns2.example.net. zone the first time, the repository will be searched for changes periodically, regardless of whether <command>rndc loadkeys</command> is used. The recheck - interval is hard-coded to - one hour. + interval is defined by + <command>dnssec-loadkeys-interval</command>.) </para> <para> - <command>auto-dnssec create;</command> includes the - above, but also allows <command>named</command> - to create new keys in the key repository when needed. - (NOTE: This option is not yet implemented; the syntax is - being reserved for future use.) + The default setting is <command>auto-dnssec off</command>. </para> + </listitem> + </varlistentry> + + <varlistentry> + <term><command>serial-update-method</command></term> + <listitem> <para> - The default setting is <command>auto-dnssec off</command>. + Zones configured for dynamic DNS may use this + option to set the update method that will be used for + the zone serial number in the SOA record. + </para> + <para> + With the default setting of + <command>serial-update-method increment;</command>, the + SOA serial number will be incremented by one each time + the zone is updated. + </para> + <para> + When set to + <command>serial-update-method unixtime;</command>, the + SOA serial number will be set to the number of seconds + since the UNIX epoch, unless the serial number is + already greater than or equal to that value, in which + case it is simply incremented by one. </para> </listitem> </varlistentry> <varlistentry> + <term><command>inline-signing</command></term> + <listitem> + <para> + If <literal>yes</literal>, this enables + "bump in the wire" signing of a zone, where a + unsigned zone is transferred in or loaded from + disk and a signed version of the zone is served, + with possibly, a different serial number. This + behaviour is disabled by default. + </para> + </listitem> + </varlistentry> + + <varlistentry> <term><command>multi-master</command></term> <listitem> <para> @@ -16709,12 +17092,15 @@ zone "example.com" { <title>Manual pages</title> <xi:include href="../../bin/dig/dig.docbook"/> <xi:include href="../../bin/dig/host.docbook"/> + <xi:include href="../../bin/python/dnssec-checkds.docbook"/> + <xi:include href="../../bin/python/dnssec-coverage.docbook"/> <xi:include href="../../bin/dnssec/dnssec-dsfromkey.docbook"/> <xi:include href="../../bin/dnssec/dnssec-keyfromlabel.docbook"/> <xi:include href="../../bin/dnssec/dnssec-keygen.docbook"/> <xi:include href="../../bin/dnssec/dnssec-revoke.docbook"/> <xi:include href="../../bin/dnssec/dnssec-settime.docbook"/> <xi:include href="../../bin/dnssec/dnssec-signzone.docbook"/> + <xi:include href="../../bin/dnssec/dnssec-verify.docbook"/> <xi:include href="../../bin/check/named-checkconf.docbook"/> <xi:include href="../../bin/check/named-checkzone.docbook"/> <xi:include href="../../bin/named/named.docbook"/> diff --git a/doc/arm/Bv9ARM.ch01.html b/doc/arm/Bv9ARM.ch01.html index d12d573..39211c7 100644 --- a/doc/arm/Bv9ARM.ch01.html +++ b/doc/arm/Bv9ARM.ch01.html @@ -82,7 +82,7 @@ system administrators. </p> <p> - This version of the manual corresponds to BIND version 9.8. + This version of the manual corresponds to BIND version 9.9. </p> </div> <div class="sect1" lang="en"> diff --git a/doc/arm/Bv9ARM.ch03.html b/doc/arm/Bv9ARM.ch03.html index 2aee247..0b8819e 100644 --- a/doc/arm/Bv9ARM.ch03.html +++ b/doc/arm/Bv9ARM.ch03.html @@ -54,7 +54,7 @@ <dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2568372">Name Server Operations</a></span></dt> <dd><dl> <dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568377">Tools for Use With the Name Server Daemon</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2570424">Signals</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2570600">Signals</a></span></dt> </dl></dd> </dl> </div> @@ -532,30 +532,41 @@ zone "eng.example.com" { [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt> <dd><p> Suspend updates to a dynamic zone. If no zone is - specified, - then all zones are suspended. This allows manual - edits to be made to a zone normally updated by dynamic - update. It - also causes changes in the journal file to be synced - into the master - and the journal file to be removed. All dynamic - update attempts will - be refused while the zone is frozen. + specified, then all zones are suspended. This allows + manual edits to be made to a zone normally updated by + dynamic update. It also causes changes in the + journal file to be synced into the master file. + All dynamic update attempts will be refused while + the zone is frozen. </p></dd> <dt><span class="term"><strong class="userinput"><code>thaw [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt> <dd><p> - Enable updates to a frozen dynamic zone. If no zone - is - specified, then all frozen zones are enabled. This - causes - the server to reload the zone from disk, and - re-enables dynamic updates - after the load has completed. After a zone is thawed, - dynamic updates - will no longer be refused. + Enable updates to a frozen dynamic zone. If no + zone is specified, then all frozen zones are + enabled. This causes the server to reload the zone + from disk, and re-enables dynamic updates after the + load has completed. After a zone is thawed, + dynamic updates will no longer be refused. If + the zone has changed and the + <span><strong class="command">ixfr-from-differences</strong></span> option is + in use, then the journal file will be updated to + reflect changes in the zone. Otherwise, if the + zone has changed, any existing journal file will be + removed. + </p></dd> +<dt><span class="term"><strong class="userinput"><code>sync + [<span class="optional">-clean</span>] + [<span class="optional"><em class="replaceable"><code>zone</code></em> + [<span class="optional"><em class="replaceable"><code>class</code></em> + [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt> +<dd><p> + Sync changes in the journal file for a dynamic zone + to the master file. If the "-clean" option is + specified, the journal file is also removed. If + no zone is specified, then all zones are synced. </p></dd> <dt><span class="term"><strong class="userinput"><code>notify <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> @@ -577,9 +588,17 @@ zone "eng.example.com" { <dd><p> Write server statistics to the statistics file. </p></dd> -<dt><span class="term"><strong class="userinput"><code>querylog</code></strong></span></dt> -<dd><p> - Toggle query logging. Query logging can also be enabled +<dt><span class="term"><strong class="userinput"><code>querylog</code></strong> + [<span class="optional">on|off</span>] + </span></dt> +<dd> +<p> + Enable or disable query logging. (For backward + compatibility, this command can also be used without + an argument to toggle query logging on and off.) + </p> +<p> + Query logging can also be enabled by explicitly directing the <span><strong class="command">queries</strong></span> <span><strong class="command">category</strong></span> to a <span><strong class="command">channel</strong></span> in the @@ -588,7 +607,8 @@ zone "eng.example.com" { <span><strong class="command">querylog yes;</strong></span> in the <span><strong class="command">options</strong></span> section of <code class="filename">named.conf</code>. - </p></dd> + </p> +</dd> <dt><span class="term"><strong class="userinput"><code>dumpdb [<span class="optional">-all|-cache|-zone</span>] [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>]</code></strong></span></dt> @@ -643,9 +663,23 @@ zone "eng.example.com" { <dd><p> Flushes the server's cache. </p></dd> -<dt><span class="term"><strong class="userinput"><code>flushname</code></strong> <em class="replaceable"><code>name</code></em></span></dt> +<dt><span class="term"><strong class="userinput"><code>flushname</code></strong> + <em class="replaceable"><code>name</code></em> + [<span class="optional"><em class="replaceable"><code>view</code></em></span>] + </span></dt> <dd><p> - Flushes the given name from the server's cache. + Flushes the given name from the server's DNS cache, + and from the server's nameserver address database + if applicable. + </p></dd> +<dt><span class="term"><strong class="userinput"><code>flushtree</code></strong> + <em class="replaceable"><code>name</code></em> + [<span class="optional"><em class="replaceable"><code>view</code></em></span>] + </span></dt> +<dd><p> + Flushes the given name, and all of its subdomains, + from the server's DNS cache. (The server's + nameserver address database is not affected.) </p></dd> <dt><span class="term"><strong class="userinput"><code>status</code></strong></span></dt> <dd><p> @@ -736,6 +770,72 @@ zone "eng.example.com" { <span><strong class="command">rndc addzone</strong></span> can be deleted in this matter. </p></dd> +<dt><span class="term"><strong class="userinput"><code>signing + [<span class="optional">( -list | -clear <em class="replaceable"><code>keyid/algorithm</code></em> | -clear <code class="literal">all</code> | -nsec3param ( <em class="replaceable"><code>parameters</code></em> | <code class="literal">none</code> ) ) </span>] + <em class="replaceable"><code>zone</code></em> + [<span class="optional"><em class="replaceable"><code>class</code></em> + [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] + </code></strong></span></dt> +<dd> +<p> + List, edit, or remove the DNSSEC signing state for + the specified zone. The status of ongoing DNSSEC + operations (such as signing or generating + NSEC3 chains) is stored in the zone in the form + of DNS resource records of type + <span><strong class="command">sig-signing-type</strong></span>. + <span><strong class="command">rndc signing -list</strong></span> converts + these records into a human-readable form, + indicating which keys are currently signing + or have finished signing the zone, and which NSEC3 + NSEC3 chains are being created or removed. + </p> +<p> + <span><strong class="command">rndc signing -clear</strong></span> can remove + a single key (specified in the same format that + <span><strong class="command">rndc signing -list</strong></span> uses to + display it), or all keys. In either case, only + completed keys are removed; any record indicating + that a key has not yet finished signing the zone + will be retained. + </p> +<p> + <span><strong class="command">rndc signing -nsec3param</strong></span> sets + the NSEC3 parameters for a zone. This is the + only supported mechanism for using NSEC3 with + <span><strong class="command">inline-signing</strong></span> zones. + Parameters are specified in the same format as + an NSEC3PARAM resource record: hash algorithm, + flags, iterations, and salt, in that order. + </p> +<p> + Currently, the only defined value for hash algorithm + is <code class="literal">1</code>, representing SHA-1. + The <code class="option">flags</code> may be set to + <code class="literal">0</code> or <code class="literal">1</code>, + depending on whether you wish to set the opt-out + bit in the NSEC3 chain. <code class="option">iterations</code> + defines the number of additional times to apply + the algorithm when generating an NSEC3 hash. The + <code class="option">salt</code> is a string of data expressed + in hexidecimal, or a hyphen (`-') if no salt is + to be used. + </p> +<p> + So, for example, to create an NSEC3 chain using + the SHA-1 hash algorithm, no opt-out flag, + 10 iterations, and a salt value of "FFFF", use: + <span><strong class="command">rndc signing -nsec3param 1 0 10 FFFF <zone></strong></span>. + To set the opt-out flag, 15 iterations, and no + salt, use: + <span><strong class="command">rndc signing -nsec3param 1 1 15 - <zone></strong></span>. + </p> +<p> + <span><strong class="command">rndc signing -nsec3param none</strong></span> + removes an existing NSEC3 chain and replaces it + with NSEC. + </p> +</dd> </dl></div> <p> A configuration file is required, since all @@ -888,7 +988,7 @@ controls { </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2570424"></a>Signals</h3></div></div></div> +<a name="id2570600"></a>Signals</h3></div></div></div> <p> Certain UNIX signals cause the name server to take specific actions, as described in the following table. These signals can diff --git a/doc/arm/Bv9ARM.ch04.html b/doc/arm/Bv9ARM.ch04.html index 46cb589..e22a0cb 100644 --- a/doc/arm/Bv9ARM.ch04.html +++ b/doc/arm/Bv9ARM.ch04.html @@ -49,59 +49,59 @@ <dt><span class="sect1"><a href="Bv9ARM.ch04.html#dynamic_update">Dynamic Update</a></span></dt> <dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch04.html#journal">The journal file</a></span></dt></dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch04.html#incremental_zone_transfers">Incremental Zone Transfers (IXFR)</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2570937">Split DNS</a></span></dt> -<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2570955">Example split DNS setup</a></span></dt></dl></dd> +<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571175">Split DNS</a></span></dt> +<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571193">Example split DNS setup</a></span></dt></dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch04.html#tsig">TSIG</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2564016">Generate Shared Keys for Each Pair of Hosts</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2564089">Copying the Shared Secret to Both Machines</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571814">Informing the Servers of the Key's Existence</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571850">Instructing the Server to Use the Key</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571908">TSIG Key Based Access Control</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571957">Errors</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571763">Generate Shared Keys for Each Pair of Hosts</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571836">Copying the Shared Secret to Both Machines</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571847">Informing the Servers of the Key's Existence</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571883">Instructing the Server to Use the Key</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571941">TSIG Key Based Access Control</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2564003">Errors</a></span></dt> </dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571971">TKEY</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2572156">SIG(0)</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2564017">TKEY</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2572326">SIG(0)</a></span></dt> <dt><span class="sect1"><a href="Bv9ARM.ch04.html#DNSSEC">DNSSEC</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572225">Generating Keys</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572304">Signing the Zone</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572385">Configuring Servers</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572394">Generating Keys</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572541">Signing the Zone</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572622">Configuring Servers</a></span></dt> </dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch04.html#dnssec.dynamic.zones">DNSSEC, Dynamic Zones, and Automatic Signing</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2608395">Converting from insecure to secure</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563581">Dynamic DNS update method</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563754">Fully automatic zone signing</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563836">Private-type records</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563874">DNSKEY rollovers</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563886">Dynamic DNS update method</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563920">Automatic key rollovers</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563946">NSEC3PARAM rollovers via UPDATE</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563956">Converting from NSEC to NSEC3</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571406">Converting from NSEC3 to NSEC</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571419">Converting from secure to insecure</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571457">Periodic re-signing</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571466">NSEC3 and OPTOUT</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563413">Converting from insecure to secure</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563450">Dynamic DNS update method</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563555">Fully automatic zone signing</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563726">Private-type records</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563832">DNSKEY rollovers</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563845">Dynamic DNS update method</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563878">Automatic key rollovers</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563905">NSEC3PARAM rollovers via UPDATE</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563914">Converting from NSEC to NSEC3</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563924">Converting from NSEC3 to NSEC</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563937">Converting from secure to insecure</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572029">Periodic re-signing</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572039">NSEC3 and OPTOUT</a></span></dt> </dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch04.html#rfc5011.support">Dynamic Trust Anchor Management</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571658">Validating Resolver</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571681">Authoritative Server</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572072">Validating Resolver</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2609027">Authoritative Server</a></span></dt> </dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch04.html#pkcs11">PKCS #11 (Cryptoki) support</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2611650">Prerequisites</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2608875">Building BIND 9 with PKCS#11</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2609137">PKCS #11 Tools</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2635518">Using the HSM</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2635785">Specifying the engine on the command line</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2635831">Running named with automatic zone re-signing</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2611929">Prerequisites</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2610179">Building BIND 9 with PKCS#11</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2612283">PKCS #11 Tools</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2612382">Using the HSM</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2636884">Specifying the engine on the command line</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2636930">Running named with automatic zone re-signing</a></span></dt> </dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2572604">IPv6 Support in <acronym class="acronym">BIND</acronym> 9</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2572842">IPv6 Support in <acronym class="acronym">BIND</acronym> 9</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572871">Address Lookups Using AAAA Records</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572892">Address to Name Lookups Using Nibble Format</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2573109">Address Lookups Using AAAA Records</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2573130">Address to Name Lookups Using Nibble Format</a></span></dt> </dl></dd> </dl> </div> @@ -247,18 +247,16 @@ to <strong class="userinput"><code>yes</code></strong>. </p> <p> - When acting as a slave, <acronym class="acronym">BIND</acronym> 9 will attempt - to use IXFR unless it is explicitly disabled via the - <span><strong class="command">request-ixfr</strong></span> option or the use of - <span><strong class="command">ixfr-from-differences</strong></span>. For - more information about disabling IXFR, see the description - of the <span><strong class="command">request-ixfr</strong></span> clause of the - <span><strong class="command">server</strong></span> statement. + When acting as a slave, <acronym class="acronym">BIND</acronym> 9 will + attempt to use IXFR unless + it is explicitly disabled. For more information about disabling + IXFR, see the description of the <span><strong class="command">request-ixfr</strong></span> clause + of the <span><strong class="command">server</strong></span> statement. </p> </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2570937"></a>Split DNS</h2></div></div></div> +<a name="id2571175"></a>Split DNS</h2></div></div></div> <p> Setting up different views, or visibility, of the DNS space to internal and external resolvers is usually referred to as a @@ -288,7 +286,7 @@ </p> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2570955"></a>Example split DNS setup</h3></div></div></div> +<a name="id2571193"></a>Example split DNS setup</h3></div></div></div> <p> Let's say a company named <span class="emphasis"><em>Example, Inc.</em></span> (<code class="literal">example.com</code>) @@ -545,7 +543,7 @@ nameserver 172.16.72.4 </p> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2564016"></a>Generate Shared Keys for Each Pair of Hosts</h3></div></div></div> +<a name="id2571763"></a>Generate Shared Keys for Each Pair of Hosts</h3></div></div></div> <p> A shared secret is generated to be shared between <span class="emphasis"><em>host1</em></span> and <span class="emphasis"><em>host2</em></span>. An arbitrary key name is chosen: "host1-host2.". The key name must @@ -553,7 +551,7 @@ nameserver 172.16.72.4 </p> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2564033"></a>Automatic Generation</h4></div></div></div> +<a name="id2571780"></a>Automatic Generation</h4></div></div></div> <p> The following command will generate a 128-bit (16 byte) HMAC-SHA256 key as described above. Longer keys are better, but shorter keys @@ -577,7 +575,7 @@ nameserver 172.16.72.4 </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2564071"></a>Manual Generation</h4></div></div></div> +<a name="id2571818"></a>Manual Generation</h4></div></div></div> <p> The shared secret is simply a random sequence of bits, encoded in base-64. Most ASCII strings are valid base-64 strings (assuming @@ -592,7 +590,7 @@ nameserver 172.16.72.4 </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2564089"></a>Copying the Shared Secret to Both Machines</h3></div></div></div> +<a name="id2571836"></a>Copying the Shared Secret to Both Machines</h3></div></div></div> <p> This is beyond the scope of DNS. A secure transport mechanism should be used. This could be secure FTP, ssh, telephone, etc. @@ -600,7 +598,7 @@ nameserver 172.16.72.4 </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2571814"></a>Informing the Servers of the Key's Existence</h3></div></div></div> +<a name="id2571847"></a>Informing the Servers of the Key's Existence</h3></div></div></div> <p> Imagine <span class="emphasis"><em>host1</em></span> and <span class="emphasis"><em>host 2</em></span> are @@ -627,7 +625,7 @@ key host1-host2. { </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2571850"></a>Instructing the Server to Use the Key</h3></div></div></div> +<a name="id2571883"></a>Instructing the Server to Use the Key</h3></div></div></div> <p> Since keys are shared between two hosts only, the server must be told when keys are to be used. The following is added to the <code class="filename">named.conf</code> file @@ -659,7 +657,7 @@ server 10.1.2.3 { </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2571908"></a>TSIG Key Based Access Control</h3></div></div></div> +<a name="id2571941"></a>TSIG Key Based Access Control</h3></div></div></div> <p> <acronym class="acronym">BIND</acronym> allows IP addresses and ranges to be specified in ACL @@ -686,7 +684,7 @@ allow-update { key host1-host2. ;}; </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2571957"></a>Errors</h3></div></div></div> +<a name="id2564003"></a>Errors</h3></div></div></div> <p> The processing of TSIG signed messages can result in several errors. If a signed message is sent to a non-TSIG aware @@ -712,7 +710,7 @@ allow-update { key host1-host2. ;}; </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2571971"></a>TKEY</h2></div></div></div> +<a name="id2564017"></a>TKEY</h2></div></div></div> <p><span><strong class="command">TKEY</strong></span> is a mechanism for automatically generating a shared secret between two hosts. There are several "modes" of @@ -748,7 +746,7 @@ allow-update { key host1-host2. ;}; </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2572156"></a>SIG(0)</h2></div></div></div> +<a name="id2572326"></a>SIG(0)</h2></div></div></div> <p> <acronym class="acronym">BIND</acronym> 9 partially supports DNSSEC SIG(0) transaction signatures as specified in RFC 2535 and RFC 2931. @@ -809,7 +807,7 @@ allow-update { key host1-host2. ;}; </p> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2572225"></a>Generating Keys</h3></div></div></div> +<a name="id2572394"></a>Generating Keys</h3></div></div></div> <p> The <span><strong class="command">dnssec-keygen</strong></span> program is used to generate keys. @@ -865,7 +863,7 @@ allow-update { key host1-host2. ;}; </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2572304"></a>Signing the Zone</h3></div></div></div> +<a name="id2572541"></a>Signing the Zone</h3></div></div></div> <p> The <span><strong class="command">dnssec-signzone</strong></span> program is used to sign a zone. @@ -907,7 +905,7 @@ allow-update { key host1-host2. ;}; </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2572385"></a>Configuring Servers</h3></div></div></div> +<a name="id2572622"></a>Configuring Servers</h3></div></div></div> <p> To enable <span><strong class="command">named</strong></span> to respond appropriately to DNS requests from DNSSEC aware clients, @@ -1067,7 +1065,7 @@ options { from insecure to signed and back again. A secure zone can use either NSEC or NSEC3 chains.</p> <div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"> -<a name="id2608395"></a>Converting from insecure to secure</h3></div></div></div></div> +<a name="id2563413"></a>Converting from insecure to secure</h3></div></div></div></div> <p>Changing a zone from insecure to secure can be done in two ways: using a dynamic DNS update, or the <span><strong class="command">auto-dnssec</strong></span> zone option.</p> @@ -1093,7 +1091,7 @@ options { well. An NSEC chain will be generated as part of the initial signing process.</p> <div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"> -<a name="id2563581"></a>Dynamic DNS update method</h3></div></div></div></div> +<a name="id2563450"></a>Dynamic DNS update method</h3></div></div></div></div> <p>To insert the keys via dynamic update:</p> <pre class="screen"> % nsupdate @@ -1129,7 +1127,7 @@ options { <p>While the initial signing and NSEC/NSEC3 chain generation is happening, other updates are possible as well.</p> <div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"> -<a name="id2563754"></a>Fully automatic zone signing</h3></div></div></div></div> +<a name="id2563555"></a>Fully automatic zone signing</h3></div></div></div></div> <p>To enable automatic signing, add the <span><strong class="command">auto-dnssec</strong></span> option to the zone statement in <code class="filename">named.conf</code>. @@ -1141,8 +1139,7 @@ options { <span><strong class="command">named</strong></span> can search the key directory for keys matching the zone, insert them into the zone, and use them to sign the zone. It will do so only when it receives an - <span><strong class="command">rndc sign <zonename></strong></span> or - <span><strong class="command">rndc loadkeys <zonename></strong></span> command.</p> + <span><strong class="command">rndc sign <zonename></strong></span>.</p> <p> <span><strong class="command">auto-dnssec maintain</strong></span> includes the above @@ -1150,12 +1147,34 @@ options { DNSKEY records on schedule according to the keys' timing metadata. (See <a href="man.dnssec-keygen.html" title="dnssec-keygen"><span class="refentrytitle"><span class="application">dnssec-keygen</span></span>(8)</a> and <a href="man.dnssec-settime.html" title="dnssec-settime"><span class="refentrytitle"><span class="application">dnssec-settime</span></span>(8)</a> for more information.) + </p> +<p> + <span><strong class="command">named</strong></span> will periodically search the key directory + for keys matching the zone, and if the keys' metadata indicates + that any change should be made the zone, such as adding, removing, + or revoking a key, then that action will be carried out. By default, + the key directory is checked for changes every 60 minutes; this period + can be adjusted with the <code class="option">dnssec-loadkeys-interval</code>, up + to a maximum of 24 hours. The <span><strong class="command">rndc loadkeys</strong></span> forces + <span><strong class="command">named</strong></span> to check for key updates immediately. + </p> +<p> If keys are present in the key directory the first time the zone - is loaded, it will be signed immediately, without waiting for an + is loaded, the zone will be signed immediately, without waiting for an <span><strong class="command">rndc sign</strong></span> or <span><strong class="command">rndc loadkeys</strong></span> command. (Those commands can still be used when there are unscheduled key changes, however.) </p> +<p> + If you wish the zone to be signed using NSEC3 instead of NSEC, + submit an NSEC3PARAM record via dynamic update prior to the + scheduled publication and activation of the keys. If you wish the + NSEC3 chain to have the OPTOUT bit set, set it in the flags field + of the NSEC3PARAM record. The NSEC3PARAM record will not appear in + the zone immediately, but it will be stored for later reference. When + the zone is signed and the NSEC3 chain is completed, the NSEC3PARAM + record will appear in the zone. + </p> <p>Using the <span><strong class="command">auto-dnssec</strong></span> option requires the zone to be configured to allow dynamic updates, by adding an @@ -1164,7 +1183,7 @@ options { configuration. If this has not been done, the configuration will fail.</p> <div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"> -<a name="id2563836"></a>Private-type records</h3></div></div></div></div> +<a name="id2563726"></a>Private-type records</h3></div></div></div></div> <p>The state of the signing process is signaled by private-type records (with a default type value of 65534). When signing is complete, these records will have a nonzero value for @@ -1205,12 +1224,12 @@ options { <p> </p> <div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"> -<a name="id2563874"></a>DNSKEY rollovers</h3></div></div></div></div> +<a name="id2563832"></a>DNSKEY rollovers</h3></div></div></div></div> <p>As with insecure-to-secure conversions, rolling DNSSEC keys can be done in two ways: using a dynamic DNS update, or the <span><strong class="command">auto-dnssec</strong></span> zone option.</p> <div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"> -<a name="id2563886"></a>Dynamic DNS update method</h3></div></div></div></div> +<a name="id2563845"></a>Dynamic DNS update method</h3></div></div></div></div> <p> To perform key rollovers via dynamic update, you need to add the <code class="filename">K*</code> files for the new keys so that <span><strong class="command">named</strong></span> can find them. You can then add the new @@ -1232,7 +1251,7 @@ options { <span><strong class="command">named</strong></span> will clean out any signatures generated by the old key after the update completes.</p> <div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"> -<a name="id2563920"></a>Automatic key rollovers</h3></div></div></div></div> +<a name="id2563878"></a>Automatic key rollovers</h3></div></div></div></div> <p>When a new key reaches its activation date (as set by <span><strong class="command">dnssec-keygen</strong></span> or <span><strong class="command">dnssec-settime</strong></span>), if the <span><strong class="command">auto-dnssec</strong></span> zone option is set to @@ -1247,27 +1266,27 @@ options { completes in 30 days, after which it will be safe to remove the old key from the DNSKEY RRset.</p> <div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"> -<a name="id2563946"></a>NSEC3PARAM rollovers via UPDATE</h3></div></div></div></div> +<a name="id2563905"></a>NSEC3PARAM rollovers via UPDATE</h3></div></div></div></div> <p>Add the new NSEC3PARAM record via dynamic update. When the new NSEC3 chain has been generated, the NSEC3PARAM flag field will be zero. At this point you can remove the old NSEC3PARAM record. The old chain will be removed after the update request completes.</p> <div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"> -<a name="id2563956"></a>Converting from NSEC to NSEC3</h3></div></div></div></div> +<a name="id2563914"></a>Converting from NSEC to NSEC3</h3></div></div></div></div> <p>To do this, you just need to add an NSEC3PARAM record. When the conversion is complete, the NSEC chain will have been removed and the NSEC3PARAM record will have a zero flag field. The NSEC3 chain will be generated before the NSEC chain is destroyed.</p> <div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"> -<a name="id2571406"></a>Converting from NSEC3 to NSEC</h3></div></div></div></div> +<a name="id2563924"></a>Converting from NSEC3 to NSEC</h3></div></div></div></div> <p>To do this, use <span><strong class="command">nsupdate</strong></span> to remove all NSEC3PARAM records with a zero flag field. The NSEC chain will be generated before the NSEC3 chain is removed.</p> <div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"> -<a name="id2571419"></a>Converting from secure to insecure</h3></div></div></div></div> +<a name="id2563937"></a>Converting from secure to insecure</h3></div></div></div></div> <p>To convert a signed zone to unsigned using dynamic DNS, delete all the DNSKEY records from the zone apex using <span><strong class="command">nsupdate</strong></span>. All signatures, NSEC or NSEC3 chains, @@ -1282,14 +1301,14 @@ options { <span><strong class="command">allow</strong></span> instead (or it will re-sign). </p> <div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"> -<a name="id2571457"></a>Periodic re-signing</h3></div></div></div></div> +<a name="id2572029"></a>Periodic re-signing</h3></div></div></div></div> <p>In any secure zone which supports dynamic updates, named will periodically re-sign RRsets which have not been re-signed as a result of some update action. The signature lifetimes will be adjusted so as to spread the re-sign load over time rather than all at once.</p> <div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"> -<a name="id2571466"></a>NSEC3 and OPTOUT</h3></div></div></div></div> +<a name="id2572039"></a>NSEC3 and OPTOUT</h3></div></div></div></div> <p> <span><strong class="command">named</strong></span> only supports creating new NSEC3 chains where all the NSEC3 records in the zone have the same OPTOUT @@ -1311,7 +1330,7 @@ options { configuration files.</p> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2571658"></a>Validating Resolver</h3></div></div></div> +<a name="id2572072"></a>Validating Resolver</h3></div></div></div> <p>To configure a validating resolver to use RFC 5011 to maintain a trust anchor, configure the trust anchor using a <span><strong class="command">managed-keys</strong></span> statement. Information about @@ -1322,7 +1341,7 @@ options { </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2571681"></a>Authoritative Server</h3></div></div></div> +<a name="id2609027"></a>Authoritative Server</h3></div></div></div> <p>To set up an authoritative zone for RFC 5011 trust anchor maintenance, generate two (or more) key signing keys (KSKs) for the zone. Sign the zone with one of them; this is the "active" @@ -1396,7 +1415,7 @@ $ <strong class="userinput"><code>dnssec-signzone -S -K keys example.net</code>< Debian Linux, Solaris x86 and Windows Server 2003.</p> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2611650"></a>Prerequisites</h3></div></div></div> +<a name="id2611929"></a>Prerequisites</h3></div></div></div> <p>See the HSM vendor documentation for information about installing, initializing, testing and troubleshooting the HSM.</p> @@ -1473,7 +1492,7 @@ $ <strong class="userinput"><code>patch -p1 -d openssl-0.9.8s \ when we configure BIND 9.</p> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2608605"></a>Building OpenSSL for the AEP Keyper on Linux</h4></div></div></div> +<a name="id2609772"></a>Building OpenSSL for the AEP Keyper on Linux</h4></div></div></div> <p>The AEP Keyper is a highly secure key storage device, but does not provide hardware cryptographic acceleration. It can carry out cryptographic operations, but it is probably @@ -1505,7 +1524,7 @@ $ <strong class="userinput"><code>./Configure linux-generic32 -m32 -pthread \ </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2608675"></a>Building OpenSSL for the SCA 6000 on Solaris</h4></div></div></div> +<a name="id2609910"></a>Building OpenSSL for the SCA 6000 on Solaris</h4></div></div></div> <p>The SCA-6000 PKCS #11 provider is installed as a system library, libpkcs11. It is a true crypto accelerator, up to 4 times faster than any CPU, so the flavor shall be @@ -1527,7 +1546,7 @@ $ <strong class="userinput"><code>./Configure solaris64-x86_64-cc \ </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2608724"></a>Building OpenSSL for SoftHSM</h4></div></div></div> +<a name="id2609959"></a>Building OpenSSL for SoftHSM</h4></div></div></div> <p>SoftHSM is a software library provided by the OpenDNSSEC project (http://www.opendnssec.org) which provides a PKCS#11 interface to a virtual HSM, implemented in the form of encrypted @@ -1587,12 +1606,12 @@ $ <strong class="userinput"><code>./Configure linux-x86_64 -pthread \ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2608875"></a>Building BIND 9 with PKCS#11</h3></div></div></div> +<a name="id2610179"></a>Building BIND 9 with PKCS#11</h3></div></div></div> <p>When building BIND 9, the location of the custom-built OpenSSL library must be specified via configure.</p> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2608952"></a>Configuring BIND 9 for Linux with the AEP Keyper</h4></div></div></div> +<a name="id2610187"></a>Configuring BIND 9 for Linux with the AEP Keyper</h4></div></div></div> <p>To link with the PKCS #11 provider, threads must be enabled in the BIND 9 build.</p> <p>The PKCS #11 library for the AEP Keyper is currently @@ -1608,7 +1627,7 @@ $ <strong class="userinput"><code>./configure CC="gcc -m32" --enable-threads \ </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2608984"></a>Configuring BIND 9 for Solaris with the SCA 6000</h4></div></div></div> +<a name="id2610219"></a>Configuring BIND 9 for Solaris with the SCA 6000</h4></div></div></div> <p>To link with the PKCS #11 provider, threads must be enabled in the BIND 9 build.</p> <pre class="screen"> @@ -1626,7 +1645,7 @@ $ <strong class="userinput"><code>./configure CC="cc -xarch=amd64" --enable-thre </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2609089"></a>Configuring BIND 9 for SoftHSM</h4></div></div></div> +<a name="id2612235"></a>Configuring BIND 9 for SoftHSM</h4></div></div></div> <pre class="screen"> $ <strong class="userinput"><code>cd ../bind9</code></strong> $ <strong class="userinput"><code>./configure --enable-threads \ @@ -1643,7 +1662,7 @@ $ <strong class="userinput"><code>./configure --enable-threads \ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2609137"></a>PKCS #11 Tools</h3></div></div></div> +<a name="id2612283"></a>PKCS #11 Tools</h3></div></div></div> <p>BIND 9 includes a minimal set of tools to operate the HSM, including <span><strong class="command">pkcs11-keygen</strong></span> to generate a new key pair @@ -1661,7 +1680,7 @@ $ <strong class="userinput"><code>./configure --enable-threads \ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2635518"></a>Using the HSM</h3></div></div></div> +<a name="id2612382"></a>Using the HSM</h3></div></div></div> <p>First, we must set up the runtime environment so the OpenSSL and PKCS #11 libraries can be loaded:</p> <pre class="screen"> @@ -1749,7 +1768,7 @@ example.net.signed </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2635785"></a>Specifying the engine on the command line</h3></div></div></div> +<a name="id2636884"></a>Specifying the engine on the command line</h3></div></div></div> <p>The OpenSSL engine can be specified in <span><strong class="command">named</strong></span> and all of the BIND <span><strong class="command">dnssec-*</strong></span> tools by using the "-E @@ -1770,7 +1789,7 @@ $ <strong class="userinput"><code>dnssec-signzone -E '' -S example.net</code></s </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2635831"></a>Running named with automatic zone re-signing</h3></div></div></div> +<a name="id2636930"></a>Running named with automatic zone re-signing</h3></div></div></div> <p>If you want <span><strong class="command">named</strong></span> to dynamically re-sign zones using HSM keys, and/or to to sign new records inserted via nsupdate, then @@ -1806,7 +1825,7 @@ $ <strong class="userinput"><code>dnssec-signzone -E '' -S example.net</code></s </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2572604"></a>IPv6 Support in <acronym class="acronym">BIND</acronym> 9</h2></div></div></div> +<a name="id2572842"></a>IPv6 Support in <acronym class="acronym">BIND</acronym> 9</h2></div></div></div> <p> <acronym class="acronym">BIND</acronym> 9 fully supports all currently defined forms of IPv6 name to address and address to name @@ -1844,7 +1863,7 @@ $ <strong class="userinput"><code>dnssec-signzone -E '' -S example.net</code></s </p> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2572871"></a>Address Lookups Using AAAA Records</h3></div></div></div> +<a name="id2573109"></a>Address Lookups Using AAAA Records</h3></div></div></div> <p> The IPv6 AAAA record is a parallel to the IPv4 A record, and, unlike the deprecated A6 record, specifies the entire @@ -1863,7 +1882,7 @@ host 3600 IN AAAA 2001:db8::1 </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2572892"></a>Address to Name Lookups Using Nibble Format</h3></div></div></div> +<a name="id2573130"></a>Address to Name Lookups Using Nibble Format</h3></div></div></div> <p> When looking up an address in nibble format, the address components are simply reversed, just as in IPv4, and diff --git a/doc/arm/Bv9ARM.ch05.html b/doc/arm/Bv9ARM.ch05.html index cd35bbc..4457cbd 100644 --- a/doc/arm/Bv9ARM.ch05.html +++ b/doc/arm/Bv9ARM.ch05.html @@ -45,13 +45,13 @@ <div class="toc"> <p><b>Table of Contents</b></p> <dl> -<dt><span class="sect1"><a href="Bv9ARM.ch05.html#id2572925">The Lightweight Resolver Library</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch05.html#id2573163">The Lightweight Resolver Library</a></span></dt> <dt><span class="sect1"><a href="Bv9ARM.ch05.html#lwresd">Running a Resolver Daemon</a></span></dt> </dl> </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2572925"></a>The Lightweight Resolver Library</h2></div></div></div> +<a name="id2573163"></a>The Lightweight Resolver Library</h2></div></div></div> <p> Traditionally applications have been linked with a stub resolver library that sends recursive DNS queries to a local caching name diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html index e26bf6a..bd260dc 100644 --- a/doc/arm/Bv9ARM.ch06.html +++ b/doc/arm/Bv9ARM.ch06.html @@ -48,58 +48,58 @@ <dt><span class="sect1"><a href="Bv9ARM.ch06.html#configuration_file_elements">Configuration File Elements</a></span></dt> <dd><dl> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#address_match_lists">Address Match Lists</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574405">Comment Syntax</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574711">Comment Syntax</a></span></dt> </dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch06.html#Configuration_File_Grammar">Configuration File Grammar</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574990"><span><strong class="command">acl</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575371"><span><strong class="command">acl</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#acl"><span><strong class="command">acl</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575180"><span><strong class="command">controls</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575561"><span><strong class="command">controls</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage"><span><strong class="command">controls</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575472"><span><strong class="command">include</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575489"><span><strong class="command">include</strong></span> Statement Definition and +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575921"><span><strong class="command">include</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575938"><span><strong class="command">include</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575649"><span><strong class="command">key</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575672"><span><strong class="command">key</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575763"><span><strong class="command">logging</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575889"><span><strong class="command">logging</strong></span> Statement Definition and +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575961"><span><strong class="command">key</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575985"><span><strong class="command">key</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576075"><span><strong class="command">logging</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576269"><span><strong class="command">logging</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577914"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577988"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2578120"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2578164"><span><strong class="command">masters</strong></span> Statement Definition and +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2578364"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2578438"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2578502"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2578546"><span><strong class="command">masters</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2578179"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2578567"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#options"><span><strong class="command">options</strong></span> Statement Definition and Usage</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_grammar"><span><strong class="command">server</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_definition_and_usage"><span><strong class="command">server</strong></span> Statement Definition and Usage</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#statschannels"><span><strong class="command">statistics-channels</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2590070"><span><strong class="command">statistics-channels</strong></span> Statement Definition and +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2590613"><span><strong class="command">statistics-channels</strong></span> Statement Definition and Usage</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#trusted-keys"><span><strong class="command">trusted-keys</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2590278"><span><strong class="command">trusted-keys</strong></span> Statement Definition +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2590920"><span><strong class="command">trusted-keys</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2590325"><span><strong class="command">managed-keys</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2590967"><span><strong class="command">managed-keys</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#managed-keys"><span><strong class="command">managed-keys</strong></span> Statement Definition and Usage</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#view_statement_grammar"><span><strong class="command">view</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2590766"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591409"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#zone_statement_grammar"><span><strong class="command">zone</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2592398"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2593189"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt> </dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2595755">Zone File</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2596875">Zone File</a></span></dt> <dd><dl> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#types_of_resource_records_and_when_to_use_them">Types of Resource Records and When to Use Them</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2597986">Discussion of MX Records</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2599037">Discussion of MX Records</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#Setting_TTLs">Setting TTLs</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2598601">Inverse Mapping in IPv4</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2598796">Other Zone File Directives</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2599138"><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2599585">Inverse Mapping in IPv4</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2599848">Other Zone File Directives</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2600189"><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#zonefile_format">Additional File Formats</a></span></dt> </dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch06.html#statistics">BIND9 Statistics</a></span></dt> @@ -491,7 +491,7 @@ <a name="address_match_lists"></a>Address Match Lists</h3></div></div></div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2574103"></a>Syntax</h4></div></div></div> +<a name="id2574546"></a>Syntax</h4></div></div></div> <pre class="programlisting"><code class="varname">address_match_list</code> = address_match_list_element ; [<span class="optional"> address_match_list_element; ... </span>] <code class="varname">address_match_list_element</code> = [<span class="optional"> ! </span>] (ip_address [<span class="optional">/length</span>] | @@ -500,7 +500,7 @@ </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2574131"></a>Definition and Usage</h4></div></div></div> +<a name="id2574573"></a>Definition and Usage</h4></div></div></div> <p> Address match lists are primarily used to determine access control for various server operations. They are also used in @@ -584,7 +584,7 @@ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2574405"></a>Comment Syntax</h3></div></div></div> +<a name="id2574711"></a>Comment Syntax</h3></div></div></div> <p> The <acronym class="acronym">BIND</acronym> 9 comment syntax allows for comments to appear @@ -594,7 +594,7 @@ </p> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2574420"></a>Syntax</h4></div></div></div> +<a name="id2574726"></a>Syntax</h4></div></div></div> <p> </p> <pre class="programlisting">/* This is a <acronym class="acronym">BIND</acronym> comment as in C */</pre> @@ -610,7 +610,7 @@ </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2574450"></a>Definition and Usage</h4></div></div></div> +<a name="id2574756"></a>Definition and Usage</h4></div></div></div> <p> Comments may appear anywhere that whitespace may appear in a <acronym class="acronym">BIND</acronym> configuration file. @@ -774,7 +774,9 @@ <td> <p> defines a named masters list for - inclusion in stub and slave zone masters clauses. + inclusion in stub and slave zones' + <span><strong class="command">masters</strong></span> or + <span><strong class="command">also-notify</strong></span> lists. </p> </td> </tr> @@ -862,7 +864,7 @@ </p> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2574990"></a><span><strong class="command">acl</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2575371"></a><span><strong class="command">acl</strong></span> Statement Grammar</h3></div></div></div> <pre class="programlisting"><span><strong class="command">acl</strong></span> acl-name { address_match_list }; @@ -944,7 +946,7 @@ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2575180"></a><span><strong class="command">controls</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2575561"></a><span><strong class="command">controls</strong></span> Statement Grammar</h3></div></div></div> <pre class="programlisting"><span><strong class="command">controls</strong></span> { [ inet ( ip_addr | * ) [ port ip_port ] allow { <em class="replaceable"><code> address_match_list </code></em> } @@ -1068,12 +1070,12 @@ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2575472"></a><span><strong class="command">include</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2575921"></a><span><strong class="command">include</strong></span> Statement Grammar</h3></div></div></div> <pre class="programlisting"><span><strong class="command">include</strong></span> <em class="replaceable"><code>filename</code></em>;</pre> </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2575489"></a><span><strong class="command">include</strong></span> Statement Definition and +<a name="id2575938"></a><span><strong class="command">include</strong></span> Statement Definition and Usage</h3></div></div></div> <p> The <span><strong class="command">include</strong></span> statement inserts the @@ -1088,7 +1090,7 @@ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2575649"></a><span><strong class="command">key</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2575961"></a><span><strong class="command">key</strong></span> Statement Grammar</h3></div></div></div> <pre class="programlisting"><span><strong class="command">key</strong></span> <em class="replaceable"><code>key_id</code></em> { algorithm <em class="replaceable"><code>string</code></em>; secret <em class="replaceable"><code>string</code></em>; @@ -1097,7 +1099,7 @@ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2575672"></a><span><strong class="command">key</strong></span> Statement Definition and Usage</h3></div></div></div> +<a name="id2575985"></a><span><strong class="command">key</strong></span> Statement Definition and Usage</h3></div></div></div> <p> The <span><strong class="command">key</strong></span> statement defines a shared secret key for use with TSIG (see <a href="Bv9ARM.ch04.html#tsig" title="TSIG">the section called “TSIG”</a>) @@ -1144,7 +1146,7 @@ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2575763"></a><span><strong class="command">logging</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2576075"></a><span><strong class="command">logging</strong></span> Statement Grammar</h3></div></div></div> <pre class="programlisting"><span><strong class="command">logging</strong></span> { [ <span><strong class="command">channel</strong></span> <em class="replaceable"><code>channel_name</code></em> { ( <span><strong class="command">file</strong></span> <em class="replaceable"><code>path_name</code></em> @@ -1168,7 +1170,7 @@ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2575889"></a><span><strong class="command">logging</strong></span> Statement Definition and +<a name="id2576269"></a><span><strong class="command">logging</strong></span> Statement Definition and Usage</h3></div></div></div> <p> The <span><strong class="command">logging</strong></span> statement configures a @@ -1202,7 +1204,7 @@ </p> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2576009"></a>The <span><strong class="command">channel</strong></span> Phrase</h4></div></div></div> +<a name="id2576322"></a>The <span><strong class="command">channel</strong></span> Phrase</h4></div></div></div> <p> All log output goes to one or more <span class="emphasis"><em>channels</em></span>; you can make as many of them as you want. @@ -1663,10 +1665,16 @@ category notify { null; }; </p> <p> - <code class="computeroutput">client 127.0.0.1#62536: query: www.example.com IN AAAA +SE</code> + <code class="computeroutput">client 127.0.0.1#62536 (www.example.com): query: www.example.com IN AAAA +SE</code> </p> <p> - <code class="computeroutput">client ::1#62537: query: www.example.net IN AAAA -SE</code> + <code class="computeroutput">client ::1#62537 (www.example.net): query: www.example.net IN AAAA -SE</code> + </p> + <p> + (The first part of this log message, showing the + client address/port number and query name, is + repeated in all subsequent log messages related + to the same query.) </p> </td> </tr> @@ -1780,7 +1788,7 @@ category notify { null; }; </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2577326"></a>The <span><strong class="command">query-errors</strong></span> Category</h4></div></div></div> +<a name="id2577777"></a>The <span><strong class="command">query-errors</strong></span> Category</h4></div></div></div> <p> The <span><strong class="command">query-errors</strong></span> category is specifically intended for debugging purposes: To identify @@ -2008,7 +2016,7 @@ badresp:1,adberr:0,findfail:0,valfail:0] </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2577914"></a><span><strong class="command">lwres</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2578364"></a><span><strong class="command">lwres</strong></span> Statement Grammar</h3></div></div></div> <p> This is the grammar of the <span><strong class="command">lwres</strong></span> statement in the <code class="filename">named.conf</code> file: @@ -2024,7 +2032,7 @@ badresp:1,adberr:0,findfail:0,valfail:0] </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2577988"></a><span><strong class="command">lwres</strong></span> Statement Definition and Usage</h3></div></div></div> +<a name="id2578438"></a><span><strong class="command">lwres</strong></span> Statement Definition and Usage</h3></div></div></div> <p> The <span><strong class="command">lwres</strong></span> statement configures the name @@ -2075,7 +2083,7 @@ badresp:1,adberr:0,findfail:0,valfail:0] </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2578120"></a><span><strong class="command">masters</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2578502"></a><span><strong class="command">masters</strong></span> Statement Grammar</h3></div></div></div> <pre class="programlisting"> <span><strong class="command">masters</strong></span> <em class="replaceable"><code>name</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] }; @@ -2083,16 +2091,17 @@ badresp:1,adberr:0,findfail:0,valfail:0] </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2578164"></a><span><strong class="command">masters</strong></span> Statement Definition and +<a name="id2578546"></a><span><strong class="command">masters</strong></span> Statement Definition and Usage</h3></div></div></div> <p><span><strong class="command">masters</strong></span> lists allow for a common set of masters to be easily used by - multiple stub and slave zones. + multiple stub and slave zones in their <span><strong class="command">masters</strong></span> + or <span><strong class="command">also-notify</strong></span> lists. </p> </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2578179"></a><span><strong class="command">options</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2578567"></a><span><strong class="command">options</strong></span> Statement Grammar</h3></div></div></div> <p> This is the grammar of the <span><strong class="command">options</strong></span> statement in the <code class="filename">named.conf</code> file: @@ -2122,7 +2131,7 @@ badresp:1,adberr:0,findfail:0,valfail:0] [<span class="optional"> pid-file <em class="replaceable"><code>path_name</code></em>; </span>] [<span class="optional"> recursing-file <em class="replaceable"><code>path_name</code></em>; </span>] [<span class="optional"> statistics-file <em class="replaceable"><code>path_name</code></em>; </span>] - [<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em>; </span>] + [<span class="optional"> zone-statistics <em class="replaceable"><code>full</code></em> | <em class="replaceable"><code>terse</code></em> | <em class="replaceable"><code>none</code></em>; </span>] [<span class="optional"> auth-nxdomain <em class="replaceable"><code>yes_or_no</code></em>; </span>] [<span class="optional"> deallocate-on-exit <em class="replaceable"><code>yes_or_no</code></em>; </span>] [<span class="optional"> dialup <em class="replaceable"><code>dialup_option</code></em>; </span>] @@ -2176,7 +2185,9 @@ badresp:1,adberr:0,findfail:0,valfail:0] [<span class="optional"> allow-update { <em class="replaceable"><code>address_match_list</code></em> }; </span>] [<span class="optional"> allow-update-forwarding { <em class="replaceable"><code>address_match_list</code></em> }; </span>] [<span class="optional"> update-check-ksk <em class="replaceable"><code>yes_or_no</code></em>; </span>] + [<span class="optional"> dnssec-update-mode ( <em class="replaceable"><code>maintain</code></em> | <em class="replaceable"><code>no-resign</code></em> ); </span>] [<span class="optional"> dnssec-dnskey-kskonly <em class="replaceable"><code>yes_or_no</code></em>; </span>] + [<span class="optional"> dnssec-loadkeys-interval <em class="replaceable"><code>number</code></em>; </span>] [<span class="optional"> dnssec-secure-to-insecure <em class="replaceable"><code>yes_or_no</code></em> ;</span>] [<span class="optional"> try-tcp-refresh <em class="replaceable"><code>yes_or_no</code></em>; </span>] [<span class="optional"> allow-v6-synthesis { <em class="replaceable"><code>address_match_list</code></em> }; </span>] @@ -2222,8 +2233,9 @@ badresp:1,adberr:0,findfail:0,valfail:0] [<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>] [<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>] [<span class="optional"> notify-to-soa <em class="replaceable"><code>yes_or_no</code></em> ; </span>] - [<span class="optional"> also-notify { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; - [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>] + [<span class="optional"> also-notify { <em class="replaceable"><code>ip_addr</code></em> + [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">key <em class="replaceable"><code>keyname</code></em></span>] ; + [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">key <em class="replaceable"><code>keyname</code></em></span>] ; ... </span>] }; </span>] [<span class="optional"> max-ixfr-log-size <em class="replaceable"><code>number</code></em>; </span>] [<span class="optional"> max-journal-size <em class="replaceable"><code>size_spec</code></em>; </span>] [<span class="optional"> coresize <em class="replaceable"><code>size_spec</code></em> ; </span>] @@ -2274,6 +2286,7 @@ badresp:1,adberr:0,findfail:0,valfail:0] [<span class="optional"> preferred-glue ( <em class="replaceable"><code>A</code></em> | <em class="replaceable"><code>AAAA</code></em> | <em class="replaceable"><code>NONE</code></em> ); </span>] [<span class="optional"> edns-udp-size <em class="replaceable"><code>number</code></em>; </span>] [<span class="optional"> max-udp-size <em class="replaceable"><code>number</code></em>; </span>] + [<span class="optional"> max-rsa-exponent-size <em class="replaceable"><code>number</code></em>; </span>] [<span class="optional"> root-delegation-only [<span class="optional"> exclude { <em class="replaceable"><code>namelist</code></em> } </span>] ; </span>] [<span class="optional"> querylog <em class="replaceable"><code>yes_or_no</code></em> ; </span>] [<span class="optional"> disable-algorithms <em class="replaceable"><code>domain</code></em> { <em class="replaceable"><code>algorithm</code></em>; @@ -2826,6 +2839,68 @@ options { }; </pre> </dd> +<dt><span class="term"><span><strong class="command">dnssec-update-mode</strong></span></span></dt> +<dd> +<p> + If this option is set to its default value of + <code class="literal">maintain</code> in a zone of type + <code class="literal">master</code> which is DNSSEC-signed + and configured to allow dynamic updates (see + <a href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called “Dynamic Update Policies”</a>), and + if <span><strong class="command">named</strong></span> has access to the + private signing key(s) for the zone, then + <span><strong class="command">named</strong></span> will automatically sign all new + or changed records and maintain signatures for the zone + by regenerating RRSIG records whenever they approach + their expiration date. + </p> +<p> + If the option is changed to <code class="literal">no-resign</code>, + then <span><strong class="command">named</strong></span> will sign all new or + changed records, but scheduled maintenance of + signatures is disabled. + </p> +<p> + With either of these settings, <span><strong class="command">named</strong></span> + will reject updates to a DNSSEC-signed zone when the + signing keys are inactive or unavailable to + <span><strong class="command">named</strong></span>. (A planned third option, + <code class="literal">external</code>, will disable all automatic + signing and allow DNSSEC data to be submitted into a zone + via dyanmic update; this is not yet implemented.) + </p> +</dd> +<dt><span class="term"><span><strong class="command">zone-statistics</strong></span></span></dt> +<dd> +<p> + If <strong class="userinput"><code>full</code></strong>, the server will collect + statistical data on all zones (unless specifically + turned off on a per-zone basis by specifying + <span><strong class="command">zone-statistics terse</strong></span> or + <span><strong class="command">zone-statistics none</strong></span> + in the <span><strong class="command">zone</strong></span> statement). + The default is <strong class="userinput"><code>terse</code></strong>, providing + minimal statistics on zones (including name and + current serial number, but not query type + counters). + </p> +<p> + These statistics may be accessed via the + <span><strong class="command">statistics-channel</strong></span> or + using <span><strong class="command">rndc stats</strong></span>, which + will dump them to the file listed + in the <span><strong class="command">statistics-file</strong></span>. See + also <a href="Bv9ARM.ch06.html#statsfile" title="The Statistics File">the section called “The Statistics File”</a>. + </p> +<p> + For backward compatibility with earlier versions + of BIND 9, the <span><strong class="command">zone-statistics</strong></span> + option can also accept <strong class="userinput"><code>yes</code></strong> + or <strong class="userinput"><code>no</code></strong>, which have the same + effect as <strong class="userinput"><code>full</code></strong> and + <strong class="userinput"><code>terse</code></strong>, respectively. + </p> +</dd> </dl></div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> @@ -3246,20 +3321,6 @@ options { <acronym class="acronym">BIND</acronym> 9 always allocates query IDs from a pool. </p></dd> -<dt><span class="term"><span><strong class="command">zone-statistics</strong></span></span></dt> -<dd><p> - If <strong class="userinput"><code>yes</code></strong>, the server will collect - statistical data on all zones (unless specifically turned - off - on a per-zone basis by specifying <span><strong class="command">zone-statistics no</strong></span> - in the <span><strong class="command">zone</strong></span> statement). - The default is <strong class="userinput"><code>no</code></strong>. - These statistics may be accessed - using <span><strong class="command">rndc stats</strong></span>, which will - dump them to the file listed - in the <span><strong class="command">statistics-file</strong></span>. See - also <a href="Bv9ARM.ch06.html#statsfile" title="The Statistics File">the section called “The Statistics File”</a>. - </p></dd> <dt><span class="term"><span><strong class="command">use-ixfr</strong></span></span></dt> <dd><p> <span class="emphasis"><em>This option is obsolete</em></span>. @@ -3451,13 +3512,14 @@ options { <dt><span class="term"><span><strong class="command">ixfr-from-differences</strong></span></span></dt> <dd> <p> - When <strong class="userinput"><code>yes</code></strong> and the server loads a new version of a master - zone from its zone file or receives a new version of a slave - file by a non-incremental zone transfer, it will compare - the new version to the previous one and calculate a set - of differences. The differences are then logged in the - zone's journal file such that the changes can be transmitted - to downstream slaves as an incremental zone transfer. + When <strong class="userinput"><code>yes</code></strong> and the server loads a new + version of a master zone from its zone file or receives a + new version of a slave file via zone transfer, it will + compare the new version to the previous one and calculate + a set of differences. The differences are then logged in + the zone's journal file such that the changes can be + transmitted to downstream slaves as an incremental zone + transfer. </p> <p> By allowing incremental zone transfers to be used for @@ -3687,6 +3749,21 @@ options { <code class="literal">no</code>, this option is ignored. </p> </dd> +<dt><span class="term"><span><strong class="command">dnssec-loadkeys-interval</strong></span></span></dt> +<dd><p> + When a zone is configured with <span><strong class="command">auto-dnssec + maintain;</strong></span> its key repository must be checked + periodically to see if any new keys have been added + or any existing keys' timing metadata has been updated + (see <a href="man.dnssec-keygen.html" title="dnssec-keygen"><span class="refentrytitle"><span class="application">dnssec-keygen</span></span>(8)</a> and + <a href="man.dnssec-settime.html" title="dnssec-settime"><span class="refentrytitle"><span class="application">dnssec-settime</span></span>(8)</a>). The + <span><strong class="command">dnssec-loadkeys-interval</strong></span> option + sets the frequency of autoatic repository checks, in + minutes. The default is <code class="literal">60</code> (1 hour), + the minimum is <code class="literal">1</code> (1 minute), and the + maximum is <code class="literal">1440</code> (24 hours); any higher + value is silently reduced. + </p></dd> <dt><span class="term"><span><strong class="command">try-tcp-refresh</strong></span></span></dt> <dd><p> Try to refresh the zone using TCP if UDP queries fail. @@ -3722,7 +3799,7 @@ options { </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2583834"></a>Forwarding</h4></div></div></div> +<a name="id2584393"></a>Forwarding</h4></div></div></div> <p> The forwarding facility can be used to create a large site-wide cache on a few servers, reducing traffic over links to external @@ -3766,7 +3843,7 @@ options { </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2583893"></a>Dual-stack Servers</h4></div></div></div> +<a name="id2584588"></a>Dual-stack Servers</h4></div></div></div> <p> Dual-stack servers are used as servers of last resort to work around @@ -3983,7 +4060,7 @@ options { </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2584590"></a>Interfaces</h4></div></div></div> +<a name="id2585149"></a>Interfaces</h4></div></div></div> <p> The interfaces and ports that the server will answer queries from may be specified using the <span><strong class="command">listen-on</strong></span> option. <span><strong class="command">listen-on</strong></span> takes @@ -4204,7 +4281,8 @@ avoid-v6-udp-ports {}; </p> <div class="variablelist"><dl> <dt><span class="term"><span><strong class="command">also-notify</strong></span></span></dt> -<dd><p> +<dd> +<p> Defines a global list of IP addresses of name servers that are also sent NOTIFY messages whenever a fresh copy of the @@ -4216,6 +4294,13 @@ avoid-v6-udp-ports {}; <span><strong class="command">also-notify</strong></span> address to send the notify messages to a port other than the default of 53. + An optional TSIG key can also be specified with each + address to cause the notify messages to be signed; this + can be useful when sending notifies to multiple views. + In place of explicit addresses, one or more named + <span><strong class="command">masters</strong></span> lists can be used. + </p> +<p> If an <span><strong class="command">also-notify</strong></span> list is given in a <span><strong class="command">zone</strong></span> statement, it will override @@ -4227,7 +4312,8 @@ avoid-v6-udp-ports {}; not be sent NOTIFY messages for that zone. The default is the empty list (no global notification list). - </p></dd> + </p> +</dd> <dt><span class="term"><span><strong class="command">max-transfer-time-in</strong></span></span></dt> <dd><p> Inbound zone transfers running longer than @@ -4442,7 +4528,7 @@ avoid-v6-udp-ports {}; </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2585664"></a>UDP Port Lists</h4></div></div></div> +<a name="id2586366"></a>UDP Port Lists</h4></div></div></div> <p> <span><strong class="command">use-v4-udp-ports</strong></span>, <span><strong class="command">avoid-v4-udp-ports</strong></span>, @@ -4484,7 +4570,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2585723"></a>Operating System Resource Limits</h4></div></div></div> +<a name="id2586426"></a>Operating System Resource Limits</h4></div></div></div> <p> The server's usage of many system resources can be limited. Scaled values are allowed when specifying resource limits. For @@ -4564,8 +4650,10 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; approaches the specified size, some of the oldest transactions in the journal - will be automatically removed. The default is - <code class="literal">unlimited</code>. + will be automatically removed. The largest permitted + value is 2 gigabytes. The default is + <code class="literal">unlimited</code>, which also + means 2 gigabytes. This may also be set on a per-zone basis. </p></dd> <dt><span class="term"><span><strong class="command">host-statistics-max</strong></span></span></dt> @@ -4646,7 +4734,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2586350"></a>Periodic Task Intervals</h4></div></div></div> +<a name="id2586917"></a>Periodic Task Intervals</h4></div></div></div> <div class="variablelist"><dl> <dt><span class="term"><span><strong class="command">cleaning-interval</strong></span></span></dt> <dd><p> @@ -4948,8 +5036,10 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; </p> <p> If multiple <span><strong class="command">rrset-order</strong></span> statements - appear, - they are not combined — the last one applies. + appear, they are not combined — the last one applies. + </p> +<p> + By default, all records are returned in random order. </p> <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"> <h3 class="title">Note</h3> @@ -5073,6 +5163,15 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; It is expected that this parameter may be removed in a future version once there is a standard type. </p> +<p> + These records can be removed from the zone once named + has completed signing the zone with the matching key + using <span><strong class="command">nsupdate</strong></span> or + <span><strong class="command">rndc signing -clear</strong></span>. + <span><strong class="command">rndc signing -clear</strong></span> is the only supported + way to remove these records from + <span><strong class="command">inline-signing</strong></span> zones. + </p> </dd> <dt> <span class="term"><span><strong class="command">min-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">max-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">min-retry-time</strong></span>, </span><span class="term"><span><strong class="command">max-retry-time</strong></span></span> @@ -5148,13 +5247,19 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; </p> </dd> <dt><span class="term"><span><strong class="command">masterfile-format</strong></span></span></dt> -<dd><p>Specifies +<dd> +<p>Specifies the file format of zone files (see <a href="Bv9ARM.ch06.html#zonefile_format" title="Additional File Formats">the section called “Additional File Formats”</a>). The default value is <code class="constant">text</code>, which is the - standard textual representation. Files in other formats - than <code class="constant">text</code> are typically expected - to be generated by the <span><strong class="command">named-compilezone</strong></span> tool. + standard textual representation, except for slave zones, + in which the default value is <code class="constant">raw</code>. + Files in other formats than <code class="constant">text</code> are + typically expected to be generated by the + <span><strong class="command">named-compilezone</strong></span> tool, or dumped by + <span><strong class="command">named</strong></span>. + </p> +<p> Note that when a zone file in a different format than <code class="constant">text</code> is loaded, <span><strong class="command">named</strong></span> may omit some of the checks which would be performed for a @@ -5171,7 +5276,8 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; statement within the <span><strong class="command">zone</strong></span> or <span><strong class="command">view</strong></span> block in the configuration file. - </p></dd> + </p> +</dd> <dt> <a name="clients-per-query"></a><span class="term"><span><strong class="command">clients-per-query</strong></span>, </span><span class="term"><span><strong class="command">max-clients-per-query</strong></span></span> </dt> @@ -5216,6 +5322,13 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; zones is controlled by <span><strong class="command">serial-query-rate</strong></span>. </p> </dd> +<dt><span class="term"><span><strong class="command">max-rsa-exponent-size</strong></span></span></dt> +<dd><p> + The maximum RSA exponent size, in bits, that will + be accepted when validating. Valid values are 35 + to 4096 bits. The default zero (0) is also accepted + and is equivalent to 4096. + </p></dd> </dl></div> </div> <div class="sect3" lang="en"> @@ -5554,7 +5667,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2588612"></a>Content Filtering</h4></div></div></div> +<a name="id2589223"></a>Content Filtering</h4></div></div></div> <p> <acronym class="acronym">BIND</acronym> 9 provides the ability to filter out DNS responses from external DNS servers containing @@ -5677,7 +5790,7 @@ deny-answer-aliases { "example.net"; }; </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2588738"></a>Response Policy Zone (RPZ) Rewriting</h4></div></div></div> +<a name="id2589417"></a>Response Policy Zone (RPZ) Rewriting</h4></div></div></div> <p> <acronym class="acronym">BIND</acronym> 9 includes a limited mechanism to modify DNS responses for requests @@ -6026,8 +6139,9 @@ ns.domain.com.rpz-nsdname CNAME . the local server, acting as a slave, will request incremental zone transfers from the given remote server, a master. If not set, the value of the <span><strong class="command">request-ixfr</strong></span> option in - the view or - global options block is used as a default. + the view or global options block is used as a default. It may + also be set in the zone block and, if set there, it will + override the global or view setting for that zone. </p> <p> IXFR requests to servers that do not support IXFR will @@ -6151,7 +6265,7 @@ ns.domain.com.rpz-nsdname CNAME . </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2590070"></a><span><strong class="command">statistics-channels</strong></span> Statement Definition and +<a name="id2590613"></a><span><strong class="command">statistics-channels</strong></span> Statement Definition and Usage</h3></div></div></div> <p> The <span><strong class="command">statistics-channels</strong></span> statement @@ -6199,6 +6313,30 @@ ns.domain.com.rpz-nsdname CNAME . If no <span><strong class="command">statistics-channels</strong></span> statement is present, <span><strong class="command">named</strong></span> will not open any communication channels. </p> +<p> + If the statistics channel is configured to listen on 127.0.0.1 + port 8888, then the statistics are accessible in XML format at + <a href="http://127.0.0.1:8888/" target="_top">http://127.0.0.1:8888/</a> or + <a href="http://127.0.0.1:8888/xml" target="_top">http://127.0.0.1:8888/xml</a>. A CSS file is + included which can format the XML statistics into tables + when viewed with a stylesheet-capable browser. When + <acronym class="acronym">BIND</acronym> 9 is configured with --enable-newstats, + a new XML schema is used (version 3) which adds additional + zone statistics and uses a flatter tree for more efficient + parsing. The stylesheet included uses the Google Charts API + to render data into into charts and graphs when using a + javascript-capable browser. + </p> +<p> + Applications that depend on a particular XML schema + can request + <a href="http://127.0.0.1:8888/xml/v2" target="_top">http://127.0.0.1:8888/xml/v2</a> for version 2 + of the statistics XML schema or + <a href="http://127.0.0.1:8888/xml/v3" target="_top">http://127.0.0.1:8888/xml/v3</a> for version 3. + If the requested schema is supported by the server, then + it will respond; if not, it will return a "page not found" + error. + </p> </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> @@ -6211,7 +6349,7 @@ ns.domain.com.rpz-nsdname CNAME . </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2590278"></a><span><strong class="command">trusted-keys</strong></span> Statement Definition +<a name="id2590920"></a><span><strong class="command">trusted-keys</strong></span> Statement Definition and Usage</h3></div></div></div> <p> The <span><strong class="command">trusted-keys</strong></span> statement defines @@ -6251,7 +6389,7 @@ ns.domain.com.rpz-nsdname CNAME . </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2590325"></a><span><strong class="command">managed-keys</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2590967"></a><span><strong class="command">managed-keys</strong></span> Statement Grammar</h3></div></div></div> <pre class="programlisting"><span><strong class="command">managed-keys</strong></span> { <em class="replaceable"><code>name</code></em> <code class="literal">initial-key</code> <em class="replaceable"><code>flags</code></em> <em class="replaceable"><code>protocol</code></em> <em class="replaceable"><code>algorithm</code></em> <em class="replaceable"><code>key-data</code></em> ; [<span class="optional"> <em class="replaceable"><code>name</code></em> <code class="literal">initial-key</code> <em class="replaceable"><code>flags</code></em> <em class="replaceable"><code>protocol</code></em> <em class="replaceable"><code>algorithm</code></em> <em class="replaceable"><code>key-data</code></em> ; [<span class="optional">...</span>]</span>] @@ -6389,7 +6527,7 @@ ns.domain.com.rpz-nsdname CNAME . </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2590766"></a><span><strong class="command">view</strong></span> Statement Definition and Usage</h3></div></div></div> +<a name="id2591409"></a><span><strong class="command">view</strong></span> Statement Definition and Usage</h3></div></div></div> <p> The <span><strong class="command">view</strong></span> statement is a powerful feature @@ -6517,6 +6655,9 @@ view "external" { [<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>] [<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>] [<span class="optional"> allow-update { <em class="replaceable"><code>address_match_list</code></em> }; </span>] + [<span class="optional"> update-check-ksk <em class="replaceable"><code>yes_or_no</code></em>; </span>] + [<span class="optional"> dnssec-dnskey-kskonly <em class="replaceable"><code>yes_or_no</code></em>; </span>] + [<span class="optional"> dnssec-loadkeys-interval <em class="replaceable"><code>number</code></em>; </span>] [<span class="optional"> update-policy <em class="replaceable"><code>local</code></em> | { <em class="replaceable"><code>update_policy_rule</code></em> [<span class="optional">...</span>] }; </span>] [<span class="optional"> also-notify { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>] @@ -6535,6 +6676,7 @@ view "external" { [<span class="optional"> ixfr-base <em class="replaceable"><code>string</code></em> ; </span>] [<span class="optional"> ixfr-from-differences <em class="replaceable"><code>yes_or_no</code></em>; </span>] [<span class="optional"> ixfr-tmp-file <em class="replaceable"><code>string</code></em> ; </span>] + [<span class="optional"> request-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>] [<span class="optional"> maintain-ixfr-base <em class="replaceable"><code>yes_or_no</code></em> ; </span>] [<span class="optional"> max-ixfr-log-size <em class="replaceable"><code>number</code></em> ; </span>] [<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em> ; </span>] @@ -6545,7 +6687,7 @@ view "external" { [<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>] [<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>] [<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>] - [<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em> ; </span>] + [<span class="optional"> zone-statistics <em class="replaceable"><code>full</code></em> | <em class="replaceable"><code>terse</code></em> | <em class="replaceable"><code>none</code></em>; </span>] [<span class="optional"> sig-validity-interval <em class="replaceable"><code>number</code></em> [<span class="optional"><em class="replaceable"><code>number</code></em></span>] ; </span>] [<span class="optional"> sig-signing-nodes <em class="replaceable"><code>number</code></em> ; </span>] [<span class="optional"> sig-signing-signatures <em class="replaceable"><code>number</code></em> ; </span>] @@ -6557,7 +6699,9 @@ view "external" { [<span class="optional"> max-retry-time <em class="replaceable"><code>number</code></em> ; </span>] [<span class="optional"> key-directory <em class="replaceable"><code>path_name</code></em>; </span>] [<span class="optional"> auto-dnssec <code class="constant">allow</code>|<code class="constant">maintain</code>|<code class="constant">off</code>; </span>] + [<span class="optional"> inline-signing <em class="replaceable"><code>yes_or_no</code></em>; </span>] [<span class="optional"> zero-no-soa-ttl <em class="replaceable"><code>yes_or_no</code></em> ; </span>] + [<span class="optional"> serial-update-method <code class="constant">increment</code>|<code class="constant">unixtime</code>; </span>] }; zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] { @@ -6567,13 +6711,15 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" [<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>] [<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>] [<span class="optional"> allow-update-forwarding { <em class="replaceable"><code>address_match_list</code></em> }; </span>] - [<span class="optional"> update-check-ksk <em class="replaceable"><code>yes_or_no</code></em>; </span>] [<span class="optional"> dnssec-update-mode ( <em class="replaceable"><code>maintain</code></em> | <em class="replaceable"><code>no-resign</code></em> ); </span>] + [<span class="optional"> update-check-ksk <em class="replaceable"><code>yes_or_no</code></em>; </span>] [<span class="optional"> dnssec-dnskey-kskonly <em class="replaceable"><code>yes_or_no</code></em>; </span>] + [<span class="optional"> dnssec-loadkeys-interval <em class="replaceable"><code>number</code></em>; </span>] [<span class="optional"> dnssec-secure-to-insecure <em class="replaceable"><code>yes_or_no</code></em> ; </span>] [<span class="optional"> try-tcp-refresh <em class="replaceable"><code>yes_or_no</code></em>; </span>] - [<span class="optional"> also-notify { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; - [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>] + [<span class="optional"> also-notify [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em> + [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] + [<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] }; </span>] [<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>] [<span class="optional"> dialup <em class="replaceable"><code>dialup_option</code></em> ; </span>] [<span class="optional"> file <em class="replaceable"><code>string</code></em> ; </span>] @@ -6606,12 +6752,19 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" [<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>] [<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>] [<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>] - [<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em> ; </span>] + [<span class="optional"> zone-statistics <em class="replaceable"><code>full</code></em> | <em class="replaceable"><code>terse</code></em> | <em class="replaceable"><code>none</code></em>; </span>] + [<span class="optional"> sig-validity-interval <em class="replaceable"><code>number</code></em> [<span class="optional"><em class="replaceable"><code>number</code></em></span>] ; </span>] + [<span class="optional"> sig-signing-nodes <em class="replaceable"><code>number</code></em> ; </span>] + [<span class="optional"> sig-signing-signatures <em class="replaceable"><code>number</code></em> ; </span>] + [<span class="optional"> sig-signing-type <em class="replaceable"><code>number</code></em> ; </span>] [<span class="optional"> database <em class="replaceable"><code>string</code></em> ; </span>] [<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>] [<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>] [<span class="optional"> min-retry-time <em class="replaceable"><code>number</code></em> ; </span>] [<span class="optional"> max-retry-time <em class="replaceable"><code>number</code></em> ; </span>] + [<span class="optional"> key-directory <em class="replaceable"><code>path_name</code></em>; </span>] + [<span class="optional"> auto-dnssec <code class="constant">allow</code>|<code class="constant">maintain</code>|<code class="constant">off</code>; </span>] + [<span class="optional"> inline-signing <em class="replaceable"><code>yes_or_no</code></em>; </span>] [<span class="optional"> multi-master <em class="replaceable"><code>yes_or_no</code></em> ; </span>] [<span class="optional"> zero-no-soa-ttl <em class="replaceable"><code>yes_or_no</code></em> ; </span>] }; @@ -6671,6 +6824,13 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" [<span class="optional"> delegation-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>] }; +zone <em class="replaceable"><code>"."</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] { + type redirect; + file <em class="replaceable"><code>string</code></em> ; + [<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>) ; </span>] + [<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>] +}; + zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] { type delegation-only; }; @@ -6679,10 +6839,10 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2592398"></a><span><strong class="command">zone</strong></span> Statement Definition and Usage</h3></div></div></div> +<a name="id2593189"></a><span><strong class="command">zone</strong></span> Statement Definition and Usage</h3></div></div></div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2592406"></a>Zone Types</h4></div></div></div> +<a name="id2593196"></a>Zone Types</h4></div></div></div> <div class="informaltable"><table border="1"> <colgroup> <col> @@ -6914,6 +7074,64 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" <tr> <td> <p> + <code class="varname">redirect</code> + </p> + </td> +<td> + <p> + Redirect zones are used to provide answers to + queries when normal resolution would result in + NXDOMAIN being returned. + Only one redirect zone is supported + per view. <span><strong class="command">allow-query</strong></span> can be + used to restrict which clients see these answers. + </p> + <p> + If the client has requested DNSSEC records (DO=1) and + the NXDOMAIN response is signed then no substitution + will occur. + </p> + <p> + To redirect all NXDOMAIN responses to + 100.100.100.2 and + 2001:ffff:ffff::100.100.100.2, one would + configure a type redirect zone named ".", + with the zone file containing wildcard records + that point to the desired addresses: + <code class="literal">"*. IN A 100.100.100.2"</code> + and + <code class="literal">"*. IN AAAA 2001:ffff:ffff::100.100.100.2"</code>. + </p> + <p> + To redirect all Spanish names (under .ES) one + would use similar entries but with the names + "*.ES." instead of "*.". To redirect all + commercial Spanish names (under COM.ES) one + would use wildcard entries called "*.COM.ES.". + </p> + <p> + Note that the redirect zone supports all + possible types; it is not limited to A and + AAAA records. + </p> + <p> + Because redirect zones are not referenced + directly by name, they are not kept in the + zone lookup table with normal master and slave + zones. Consequently, it is not currently possible + to use + <span><strong class="command">rndc reload + <em class="replaceable"><code>zonename</code></em></strong></span> + to reload a redirect zone. However, when using + <span><strong class="command">rndc reload</strong></span> without specifying + a zone name, redirect zones will be reloaded along + with other zones. + </p> + </td> +</tr> +<tr> +<td> + <p> <code class="varname">delegation-only</code> </p> </td> @@ -6942,7 +7160,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2593019"></a>Class</h4></div></div></div> +<a name="id2594009"></a>Class</h4></div></div></div> <p> The zone's name may optionally be followed by a class. If a class is not specified, class <code class="literal">IN</code> (for <code class="varname">Internet</code>), @@ -6964,7 +7182,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2593052"></a>Zone Options</h4></div></div></div> +<a name="id2594042"></a>Zone Options</h4></div></div></div> <div class="variablelist"><dl> <dt><span class="term"><span><strong class="command">allow-notify</strong></span></span></dt> <dd><p> @@ -7017,6 +7235,9 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" with each <span><strong class="command">also-notify</strong></span> address to send the notify messages to a port other than the default of 53. + A TSIG key may also be specified to cause the + <code class="literal">NOTIFY</code> to be signed by the + given key. <span><strong class="command">also-notify</strong></span> is not meaningful for stub zones. The default is the empty list. @@ -7066,6 +7287,13 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" See the description of <span><strong class="command">update-check-ksk</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>. </p></dd> +<dt><span class="term"><span><strong class="command">dnssec-update-mode</strong></span></span></dt> +<dd><p> + See the description of + <span><strong class="command">dnssec-update-mode</strong></span> in <a href="Bv9ARM.ch06.html#options" title="options Statement Definition and + Usage">the section called “<span><strong class="command">options</strong></span> Statement Definition and + Usage”</a>. + </p></dd> <dt><span class="term"><span><strong class="command">dnssec-dnskey-kskonly</strong></span></span></dt> <dd><p> See the description of @@ -7396,20 +7624,44 @@ example.com. NS ns2.example.net. zone the first time, the repository will be searched for changes periodically, regardless of whether <span><strong class="command">rndc loadkeys</strong></span> is used. The recheck - interval is hard-coded to - one hour. + interval is defined by + <span><strong class="command">dnssec-loadkeys-interval</strong></span>.) </p> <p> - <span><strong class="command">auto-dnssec create;</strong></span> includes the - above, but also allows <span><strong class="command">named</strong></span> - to create new keys in the key repository when needed. - (NOTE: This option is not yet implemented; the syntax is - being reserved for future use.) + The default setting is <span><strong class="command">auto-dnssec off</strong></span>. </p> +</dd> +<dt><span class="term"><span><strong class="command">serial-update-method</strong></span></span></dt> +<dd> <p> - The default setting is <span><strong class="command">auto-dnssec off</strong></span>. + Zones configured for dynamic DNS may use this + option to set the update method that will be used for + the zone serial number in the SOA record. + </p> +<p> + With the default setting of + <span><strong class="command">serial-update-method increment;</strong></span>, the + SOA serial number will be incremented by one each time + the zone is updated. + </p> +<p> + When set to + <span><strong class="command">serial-update-method unixtime;</strong></span>, the + SOA serial number will be set to the number of seconds + since the UNIX epoch, unless the serial number is + already greater than or equal to that value, in which + case it is simply incremented by one. </p> </dd> +<dt><span class="term"><span><strong class="command">inline-signing</strong></span></span></dt> +<dd><p> + If <code class="literal">yes</code>, this enables + "bump in the wire" signing of a zone, where a + unsigned zone is transferred in or loaded from + disk and a signed version of the zone is served, + with possibly, a different serial number. This + behaviour is disabled by default. + </p></dd> <dt><span class="term"><span><strong class="command">multi-master</strong></span></span></dt> <dd><p> See the description of <span><strong class="command">multi-master</strong></span> in @@ -7846,7 +8098,7 @@ example.com. NS ns2.example.net. </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2595755"></a>Zone File</h2></div></div></div> +<a name="id2596875"></a>Zone File</h2></div></div></div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> <a name="types_of_resource_records_and_when_to_use_them"></a>Types of Resource Records and When to Use Them</h3></div></div></div> @@ -7859,7 +8111,7 @@ example.com. NS ns2.example.net. </p> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2595842"></a>Resource Records</h4></div></div></div> +<a name="id2596893"></a>Resource Records</h4></div></div></div> <p> A domain name identifies a node. Each node has a set of resource information, which may be empty. The set of resource @@ -8596,7 +8848,7 @@ example.com. NS ns2.example.net. </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2597465"></a>Textual expression of RRs</h4></div></div></div> +<a name="id2598517"></a>Textual expression of RRs</h4></div></div></div> <p> RRs are represented in binary form in the packets of the DNS protocol, and are usually represented in highly encoded form @@ -8799,7 +9051,7 @@ example.com. NS ns2.example.net. </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2597986"></a>Discussion of MX Records</h3></div></div></div> +<a name="id2599037"></a>Discussion of MX Records</h3></div></div></div> <p> As described above, domain servers store information as a series of resource records, each of which contains a particular @@ -9055,7 +9307,7 @@ example.com. NS ns2.example.net. </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2598601"></a>Inverse Mapping in IPv4</h3></div></div></div> +<a name="id2599585"></a>Inverse Mapping in IPv4</h3></div></div></div> <p> Reverse name resolution (that is, translation from IP address to name) is achieved by means of the <span class="emphasis"><em>in-addr.arpa</em></span> domain @@ -9116,7 +9368,7 @@ example.com. NS ns2.example.net. </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2598796"></a>Other Zone File Directives</h3></div></div></div> +<a name="id2599848"></a>Other Zone File Directives</h3></div></div></div> <p> The Master File Format was initially defined in RFC 1035 and has subsequently been extended. While the Master File Format @@ -9131,7 +9383,7 @@ example.com. NS ns2.example.net. </p> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2598819"></a>The <span><strong class="command">@</strong></span> (at-sign)</h4></div></div></div> +<a name="id2599939"></a>The <span><strong class="command">@</strong></span> (at-sign)</h4></div></div></div> <p> When used in the label (or name) field, the asperand or at-sign (@) symbol represents the current origin. @@ -9142,7 +9394,7 @@ example.com. NS ns2.example.net. </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2598835"></a>The <span><strong class="command">$ORIGIN</strong></span> Directive</h4></div></div></div> +<a name="id2599955"></a>The <span><strong class="command">$ORIGIN</strong></span> Directive</h4></div></div></div> <p> Syntax: <span><strong class="command">$ORIGIN</strong></span> <em class="replaceable"><code>domain-name</code></em> @@ -9171,7 +9423,7 @@ WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM. </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2598964"></a>The <span><strong class="command">$INCLUDE</strong></span> Directive</h4></div></div></div> +<a name="id2600016"></a>The <span><strong class="command">$INCLUDE</strong></span> Directive</h4></div></div></div> <p> Syntax: <span><strong class="command">$INCLUDE</strong></span> <em class="replaceable"><code>filename</code></em> @@ -9207,7 +9459,7 @@ WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM. </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2599101"></a>The <span><strong class="command">$TTL</strong></span> Directive</h4></div></div></div> +<a name="id2600153"></a>The <span><strong class="command">$TTL</strong></span> Directive</h4></div></div></div> <p> Syntax: <span><strong class="command">$TTL</strong></span> <em class="replaceable"><code>default-ttl</code></em> @@ -9226,7 +9478,7 @@ WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM. </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2599138"></a><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</h3></div></div></div> +<a name="id2600189"></a><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</h3></div></div></div> <p> Syntax: <span><strong class="command">$GENERATE</strong></span> <em class="replaceable"><code>range</code></em> @@ -9650,7 +9902,7 @@ HOST-127.EXAMPLE. MX 0 . </p> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2600091"></a>Name Server Statistics Counters</h4></div></div></div> +<a name="id2601075"></a>Name Server Statistics Counters</h4></div></div></div> <div class="informaltable"><table border="1"> <colgroup> <col> @@ -10220,7 +10472,7 @@ HOST-127.EXAMPLE. MX 0 . </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2601596"></a>Zone Maintenance Statistics Counters</h4></div></div></div> +<a name="id2602716"></a>Zone Maintenance Statistics Counters</h4></div></div></div> <div class="informaltable"><table border="1"> <colgroup> <col> @@ -10374,7 +10626,7 @@ HOST-127.EXAMPLE. MX 0 . </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2601979"></a>Resolver Statistics Counters</h4></div></div></div> +<a name="id2603099"></a>Resolver Statistics Counters</h4></div></div></div> <div class="informaltable"><table border="1"> <colgroup> <col> @@ -10757,7 +11009,7 @@ HOST-127.EXAMPLE. MX 0 . </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2603138"></a>Socket I/O Statistics Counters</h4></div></div></div> +<a name="id2604121"></a>Socket I/O Statistics Counters</h4></div></div></div> <p> Socket I/O statistics counters are defined per socket types, which are @@ -10912,7 +11164,7 @@ HOST-127.EXAMPLE. MX 0 . </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2603579"></a>Compatibility with <span class="emphasis"><em>BIND</em></span> 8 Counters</h4></div></div></div> +<a name="id2604494"></a>Compatibility with <span class="emphasis"><em>BIND</em></span> 8 Counters</h4></div></div></div> <p> Most statistics counters that were available in <span><strong class="command">BIND</strong></span> 8 are also supported in diff --git a/doc/arm/Bv9ARM.ch07.html b/doc/arm/Bv9ARM.ch07.html index 664b2e3..fd1747e 100644 --- a/doc/arm/Bv9ARM.ch07.html +++ b/doc/arm/Bv9ARM.ch07.html @@ -46,10 +46,10 @@ <p><b>Table of Contents</b></p> <dl> <dt><span class="sect1"><a href="Bv9ARM.ch07.html#Access_Control_Lists">Access Control Lists</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch07.html#id2603806"><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span></a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch07.html#id2604722"><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span></a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2603888">The <span><strong class="command">chroot</strong></span> Environment</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2603947">Using the <span><strong class="command">setuid</strong></span> Function</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2604871">The <span><strong class="command">chroot</strong></span> Environment</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2604999">Using the <span><strong class="command">setuid</strong></span> Function</a></span></dt> </dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch07.html#dynamic_update_security">Dynamic Update Security</a></span></dt> </dl> @@ -114,7 +114,7 @@ zone "example.com" { </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2603806"></a><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span> +<a name="id2604722"></a><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span> </h2></div></div></div> <p> On UNIX servers, it is possible to run <acronym class="acronym">BIND</acronym> @@ -140,7 +140,7 @@ zone "example.com" { </p> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2603888"></a>The <span><strong class="command">chroot</strong></span> Environment</h3></div></div></div> +<a name="id2604871"></a>The <span><strong class="command">chroot</strong></span> Environment</h3></div></div></div> <p> In order for a <span><strong class="command">chroot</strong></span> environment to @@ -168,7 +168,7 @@ zone "example.com" { </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2603947"></a>Using the <span><strong class="command">setuid</strong></span> Function</h3></div></div></div> +<a name="id2604999"></a>Using the <span><strong class="command">setuid</strong></span> Function</h3></div></div></div> <p> Prior to running the <span><strong class="command">named</strong></span> daemon, use diff --git a/doc/arm/Bv9ARM.ch08.html b/doc/arm/Bv9ARM.ch08.html index c22a5af..35d6bbd 100644 --- a/doc/arm/Bv9ARM.ch08.html +++ b/doc/arm/Bv9ARM.ch08.html @@ -45,18 +45,18 @@ <div class="toc"> <p><b>Table of Contents</b></p> <dl> -<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2604027">Common Problems</a></span></dt> -<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch08.html#id2604101">It's not working; how can I figure out what's wrong?</a></span></dt></dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2604113">Incrementing and Changing the Serial Number</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2604130">Where Can I Get Help?</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2605147">Common Problems</a></span></dt> +<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch08.html#id2605153">It's not working; how can I figure out what's wrong?</a></span></dt></dl></dd> +<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2605164">Incrementing and Changing the Serial Number</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2605181">Where Can I Get Help?</a></span></dt> </dl> </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2604027"></a>Common Problems</h2></div></div></div> +<a name="id2605147"></a>Common Problems</h2></div></div></div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2604101"></a>It's not working; how can I figure out what's wrong?</h3></div></div></div> +<a name="id2605153"></a>It's not working; how can I figure out what's wrong?</h3></div></div></div> <p> The best solution to solving installation and configuration issues is to take preventative measures by setting @@ -68,7 +68,7 @@ </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2604113"></a>Incrementing and Changing the Serial Number</h2></div></div></div> +<a name="id2605164"></a>Incrementing and Changing the Serial Number</h2></div></div></div> <p> Zone serial numbers are just numbers — they aren't date related. A lot of people set them to a number that @@ -95,7 +95,7 @@ </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2604130"></a>Where Can I Get Help?</h2></div></div></div> +<a name="id2605181"></a>Where Can I Get Help?</h2></div></div></div> <p> The Internet Systems Consortium (<acronym class="acronym">ISC</acronym>) offers a wide range diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html index 2d6768e..83578ad 100644 --- a/doc/arm/Bv9ARM.ch09.html +++ b/doc/arm/Bv9ARM.ch09.html @@ -45,31 +45,31 @@ <div class="toc"> <p><b>Table of Contents</b></p> <dl> -<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2604192">Acknowledgments</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2605243">Acknowledgments</a></span></dt> <dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch09.html#historical_dns_information">A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym></a></span></dt></dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2604363">General <acronym class="acronym">DNS</acronym> Reference Information</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2605483">General <acronym class="acronym">DNS</acronym> Reference Information</a></span></dt> <dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch09.html#ipv6addresses">IPv6 addresses (AAAA)</a></span></dt></dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch09.html#bibliography">Bibliography (and Suggested Reading)</a></span></dt> <dd><dl> <dt><span class="sect2"><a href="Bv9ARM.ch09.html#rfcs">Request for Comments (RFCs)</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch09.html#internet_drafts">Internet Drafts</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2607712">Other Documents About <acronym class="acronym">BIND</acronym></a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2608695">Other Documents About <acronym class="acronym">BIND</acronym></a></span></dt> </dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch09.html#bind9.library">BIND 9 DNS Library Support</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2609824">Prerequisite</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2609833">Compilation</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2609175">Installation</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2609206">Known Defects/Restrictions</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2609283">The dns.conf File</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2609309">Sample Applications</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2610282">Library References</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2610921">Prerequisite</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2609361">Compilation</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2609385">Installation</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2609416">Known Defects/Restrictions</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2610380">The dns.conf File</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2610407">Sample Applications</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2611312">Library References</a></span></dt> </dl></dd> </dl> </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2604192"></a>Acknowledgments</h2></div></div></div> +<a name="id2605243"></a>Acknowledgments</h2></div></div></div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> <a name="historical_dns_information"></a>A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym> @@ -172,7 +172,7 @@ </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2604363"></a>General <acronym class="acronym">DNS</acronym> Reference Information</h2></div></div></div> +<a name="id2605483"></a>General <acronym class="acronym">DNS</acronym> Reference Information</h2></div></div></div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> <a name="ipv6addresses"></a>IPv6 addresses (AAAA)</h3></div></div></div> @@ -260,17 +260,17 @@ </p> <div class="bibliography"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2604619"></a>Bibliography</h4></div></div></div> +<a name="id2605739"></a>Bibliography</h4></div></div></div> <div class="bibliodiv"> <h3 class="title">Standards</h3> <div class="biblioentry"> -<a name="id2604630"></a><p>[<abbr class="abbrev">RFC974</abbr>] <span class="author"><span class="firstname">C.</span> <span class="surname">Partridge</span>. </span><span class="title"><i>Mail Routing and the Domain System</i>. </span><span class="pubdate">January 1986. </span></p> +<a name="id2605750"></a><p>[<abbr class="abbrev">RFC974</abbr>] <span class="author"><span class="firstname">C.</span> <span class="surname">Partridge</span>. </span><span class="title"><i>Mail Routing and the Domain System</i>. </span><span class="pubdate">January 1986. </span></p> </div> <div class="biblioentry"> -<a name="id2604653"></a><p>[<abbr class="abbrev">RFC1034</abbr>] <span class="author"><span class="firstname">P.V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>Domain Names — Concepts and Facilities</i>. </span><span class="pubdate">November 1987. </span></p> +<a name="id2605773"></a><p>[<abbr class="abbrev">RFC1034</abbr>] <span class="author"><span class="firstname">P.V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>Domain Names — Concepts and Facilities</i>. </span><span class="pubdate">November 1987. </span></p> </div> <div class="biblioentry"> -<a name="id2604677"></a><p>[<abbr class="abbrev">RFC1035</abbr>] <span class="author"><span class="firstname">P. V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>Domain Names — Implementation and +<a name="id2605797"></a><p>[<abbr class="abbrev">RFC1035</abbr>] <span class="author"><span class="firstname">P. V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>Domain Names — Implementation and Specification</i>. </span><span class="pubdate">November 1987. </span></p> </div> </div> @@ -278,42 +278,42 @@ <h3 class="title"> <a name="proposed_standards"></a>Proposed Standards</h3> <div class="biblioentry"> -<a name="id2604713"></a><p>[<abbr class="abbrev">RFC2181</abbr>] <span class="author"><span class="firstname">R., R. Bush</span> <span class="surname">Elz</span>. </span><span class="title"><i>Clarifications to the <acronym class="acronym">DNS</acronym> +<a name="id2605833"></a><p>[<abbr class="abbrev">RFC2181</abbr>] <span class="author"><span class="firstname">R., R. Bush</span> <span class="surname">Elz</span>. </span><span class="title"><i>Clarifications to the <acronym class="acronym">DNS</acronym> Specification</i>. </span><span class="pubdate">July 1997. </span></p> </div> <div class="biblioentry"> -<a name="id2604740"></a><p>[<abbr class="abbrev">RFC2308</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Andrews</span>. </span><span class="title"><i>Negative Caching of <acronym class="acronym">DNS</acronym> +<a name="id2605860"></a><p>[<abbr class="abbrev">RFC2308</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Andrews</span>. </span><span class="title"><i>Negative Caching of <acronym class="acronym">DNS</acronym> Queries</i>. </span><span class="pubdate">March 1998. </span></p> </div> <div class="biblioentry"> -<a name="id2604765"></a><p>[<abbr class="abbrev">RFC1995</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Ohta</span>. </span><span class="title"><i>Incremental Zone Transfer in <acronym class="acronym">DNS</acronym></i>. </span><span class="pubdate">August 1996. </span></p> +<a name="id2605885"></a><p>[<abbr class="abbrev">RFC1995</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Ohta</span>. </span><span class="title"><i>Incremental Zone Transfer in <acronym class="acronym">DNS</acronym></i>. </span><span class="pubdate">August 1996. </span></p> </div> <div class="biblioentry"> -<a name="id2604858"></a><p>[<abbr class="abbrev">RFC1996</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>A Mechanism for Prompt Notification of Zone Changes</i>. </span><span class="pubdate">August 1996. </span></p> +<a name="id2605910"></a><p>[<abbr class="abbrev">RFC1996</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>A Mechanism for Prompt Notification of Zone Changes</i>. </span><span class="pubdate">August 1996. </span></p> </div> <div class="biblioentry"> -<a name="id2604882"></a><p>[<abbr class="abbrev">RFC2136</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">S.</span> <span class="surname">Thomson</span>, <span class="firstname">Y.</span> <span class="surname">Rekhter</span>, and <span class="firstname">J.</span> <span class="surname">Bound</span>. </span><span class="title"><i>Dynamic Updates in the Domain Name System</i>. </span><span class="pubdate">April 1997. </span></p> +<a name="id2605933"></a><p>[<abbr class="abbrev">RFC2136</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">S.</span> <span class="surname">Thomson</span>, <span class="firstname">Y.</span> <span class="surname">Rekhter</span>, and <span class="firstname">J.</span> <span class="surname">Bound</span>. </span><span class="title"><i>Dynamic Updates in the Domain Name System</i>. </span><span class="pubdate">April 1997. </span></p> </div> <div class="biblioentry"> -<a name="id2604937"></a><p>[<abbr class="abbrev">RFC2671</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Extension Mechanisms for DNS (EDNS0)</i>. </span><span class="pubdate">August 1997. </span></p> +<a name="id2605989"></a><p>[<abbr class="abbrev">RFC2671</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Extension Mechanisms for DNS (EDNS0)</i>. </span><span class="pubdate">August 1997. </span></p> </div> <div class="biblioentry"> -<a name="id2604964"></a><p>[<abbr class="abbrev">RFC2672</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Crawford</span>. </span><span class="title"><i>Non-Terminal DNS Name Redirection</i>. </span><span class="pubdate">August 1999. </span></p> +<a name="id2606016"></a><p>[<abbr class="abbrev">RFC2672</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Crawford</span>. </span><span class="title"><i>Non-Terminal DNS Name Redirection</i>. </span><span class="pubdate">August 1999. </span></p> </div> <div class="biblioentry"> -<a name="id2604990"></a><p>[<abbr class="abbrev">RFC2845</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">O.</span> <span class="surname">Gudmundsson</span>, <span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>, and <span class="firstname">B.</span> <span class="surname">Wellington</span>. </span><span class="title"><i>Secret Key Transaction Authentication for <acronym class="acronym">DNS</acronym> (TSIG)</i>. </span><span class="pubdate">May 2000. </span></p> +<a name="id2606042"></a><p>[<abbr class="abbrev">RFC2845</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">O.</span> <span class="surname">Gudmundsson</span>, <span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>, and <span class="firstname">B.</span> <span class="surname">Wellington</span>. </span><span class="title"><i>Secret Key Transaction Authentication for <acronym class="acronym">DNS</acronym> (TSIG)</i>. </span><span class="pubdate">May 2000. </span></p> </div> <div class="biblioentry"> -<a name="id2605052"></a><p>[<abbr class="abbrev">RFC2930</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Secret Key Establishment for DNS (TKEY RR)</i>. </span><span class="pubdate">September 2000. </span></p> +<a name="id2606104"></a><p>[<abbr class="abbrev">RFC2930</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Secret Key Establishment for DNS (TKEY RR)</i>. </span><span class="pubdate">September 2000. </span></p> </div> <div class="biblioentry"> -<a name="id2605082"></a><p>[<abbr class="abbrev">RFC2931</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>DNS Request and Transaction Signatures (SIG(0)s)</i>. </span><span class="pubdate">September 2000. </span></p> +<a name="id2606134"></a><p>[<abbr class="abbrev">RFC2931</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>DNS Request and Transaction Signatures (SIG(0)s)</i>. </span><span class="pubdate">September 2000. </span></p> </div> <div class="biblioentry"> -<a name="id2605112"></a><p>[<abbr class="abbrev">RFC3007</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Wellington</span>. </span><span class="title"><i>Secure Domain Name System (DNS) Dynamic Update</i>. </span><span class="pubdate">November 2000. </span></p> +<a name="id2606164"></a><p>[<abbr class="abbrev">RFC3007</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Wellington</span>. </span><span class="title"><i>Secure Domain Name System (DNS) Dynamic Update</i>. </span><span class="pubdate">November 2000. </span></p> </div> <div class="biblioentry"> -<a name="id2605139"></a><p>[<abbr class="abbrev">RFC3645</abbr>] <span class="authorgroup"><span class="firstname">S.</span> <span class="surname">Kwan</span>, <span class="firstname">P.</span> <span class="surname">Garg</span>, <span class="firstname">J.</span> <span class="surname">Gilroy</span>, <span class="firstname">L.</span> <span class="surname">Esibov</span>, <span class="firstname">J.</span> <span class="surname">Westhead</span>, and <span class="firstname">R.</span> <span class="surname">Hall</span>. </span><span class="title"><i>Generic Security Service Algorithm for Secret +<a name="id2606190"></a><p>[<abbr class="abbrev">RFC3645</abbr>] <span class="authorgroup"><span class="firstname">S.</span> <span class="surname">Kwan</span>, <span class="firstname">P.</span> <span class="surname">Garg</span>, <span class="firstname">J.</span> <span class="surname">Gilroy</span>, <span class="firstname">L.</span> <span class="surname">Esibov</span>, <span class="firstname">J.</span> <span class="surname">Westhead</span>, and <span class="firstname">R.</span> <span class="surname">Hall</span>. </span><span class="title"><i>Generic Security Service Algorithm for Secret Key Transaction Authentication for DNS (GSS-TSIG)</i>. </span><span class="pubdate">October 2003. </span></p> </div> @@ -322,19 +322,19 @@ <h3 class="title"> <acronym class="acronym">DNS</acronym> Security Proposed Standards</h3> <div class="biblioentry"> -<a name="id2605221"></a><p>[<abbr class="abbrev">RFC3225</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Conrad</span>. </span><span class="title"><i>Indicating Resolver Support of DNSSEC</i>. </span><span class="pubdate">December 2001. </span></p> +<a name="id2606273"></a><p>[<abbr class="abbrev">RFC3225</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Conrad</span>. </span><span class="title"><i>Indicating Resolver Support of DNSSEC</i>. </span><span class="pubdate">December 2001. </span></p> </div> <div class="biblioentry"> -<a name="id2605248"></a><p>[<abbr class="abbrev">RFC3833</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Atkins</span> and <span class="firstname">R.</span> <span class="surname">Austein</span>. </span><span class="title"><i>Threat Analysis of the Domain Name System (DNS)</i>. </span><span class="pubdate">August 2004. </span></p> +<a name="id2606299"></a><p>[<abbr class="abbrev">RFC3833</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Atkins</span> and <span class="firstname">R.</span> <span class="surname">Austein</span>. </span><span class="title"><i>Threat Analysis of the Domain Name System (DNS)</i>. </span><span class="pubdate">August 2004. </span></p> </div> <div class="biblioentry"> -<a name="id2605284"></a><p>[<abbr class="abbrev">RFC4033</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Arends</span>, <span class="firstname">R.</span> <span class="surname">Austein</span>, <span class="firstname">M.</span> <span class="surname">Larson</span>, <span class="firstname">D.</span> <span class="surname">Massey</span>, and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>DNS Security Introduction and Requirements</i>. </span><span class="pubdate">March 2005. </span></p> +<a name="id2606336"></a><p>[<abbr class="abbrev">RFC4033</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Arends</span>, <span class="firstname">R.</span> <span class="surname">Austein</span>, <span class="firstname">M.</span> <span class="surname">Larson</span>, <span class="firstname">D.</span> <span class="surname">Massey</span>, and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>DNS Security Introduction and Requirements</i>. </span><span class="pubdate">March 2005. </span></p> </div> <div class="biblioentry"> -<a name="id2605349"></a><p>[<abbr class="abbrev">RFC4034</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Arends</span>, <span class="firstname">R.</span> <span class="surname">Austein</span>, <span class="firstname">M.</span> <span class="surname">Larson</span>, <span class="firstname">D.</span> <span class="surname">Massey</span>, and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>Resource Records for the DNS Security Extensions</i>. </span><span class="pubdate">March 2005. </span></p> +<a name="id2606401"></a><p>[<abbr class="abbrev">RFC4034</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Arends</span>, <span class="firstname">R.</span> <span class="surname">Austein</span>, <span class="firstname">M.</span> <span class="surname">Larson</span>, <span class="firstname">D.</span> <span class="surname">Massey</span>, and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>Resource Records for the DNS Security Extensions</i>. </span><span class="pubdate">March 2005. </span></p> </div> <div class="biblioentry"> -<a name="id2605414"></a><p>[<abbr class="abbrev">RFC4035</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Arends</span>, <span class="firstname">R.</span> <span class="surname">Austein</span>, <span class="firstname">M.</span> <span class="surname">Larson</span>, <span class="firstname">D.</span> <span class="surname">Massey</span>, and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>Protocol Modifications for the DNS +<a name="id2606466"></a><p>[<abbr class="abbrev">RFC4035</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Arends</span>, <span class="firstname">R.</span> <span class="surname">Austein</span>, <span class="firstname">M.</span> <span class="surname">Larson</span>, <span class="firstname">D.</span> <span class="surname">Massey</span>, and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>Protocol Modifications for the DNS Security Extensions</i>. </span><span class="pubdate">March 2005. </span></p> </div> </div> @@ -342,146 +342,146 @@ <h3 class="title">Other Important RFCs About <acronym class="acronym">DNS</acronym> Implementation</h3> <div class="biblioentry"> -<a name="id2605488"></a><p>[<abbr class="abbrev">RFC1535</abbr>] <span class="author"><span class="firstname">E.</span> <span class="surname">Gavron</span>. </span><span class="title"><i>A Security Problem and Proposed Correction With Widely +<a name="id2606539"></a><p>[<abbr class="abbrev">RFC1535</abbr>] <span class="author"><span class="firstname">E.</span> <span class="surname">Gavron</span>. </span><span class="title"><i>A Security Problem and Proposed Correction With Widely Deployed <acronym class="acronym">DNS</acronym> Software.</i>. </span><span class="pubdate">October 1993. </span></p> </div> <div class="biblioentry"> -<a name="id2605513"></a><p>[<abbr class="abbrev">RFC1536</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Kumar</span>, <span class="firstname">J.</span> <span class="surname">Postel</span>, <span class="firstname">C.</span> <span class="surname">Neuman</span>, <span class="firstname">P.</span> <span class="surname">Danzig</span>, and <span class="firstname">S.</span> <span class="surname">Miller</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Implementation +<a name="id2606565"></a><p>[<abbr class="abbrev">RFC1536</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Kumar</span>, <span class="firstname">J.</span> <span class="surname">Postel</span>, <span class="firstname">C.</span> <span class="surname">Neuman</span>, <span class="firstname">P.</span> <span class="surname">Danzig</span>, and <span class="firstname">S.</span> <span class="surname">Miller</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Implementation Errors and Suggested Fixes</i>. </span><span class="pubdate">October 1993. </span></p> </div> <div class="biblioentry"> -<a name="id2605581"></a><p>[<abbr class="abbrev">RFC1982</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Elz</span> and <span class="firstname">R.</span> <span class="surname">Bush</span>. </span><span class="title"><i>Serial Number Arithmetic</i>. </span><span class="pubdate">August 1996. </span></p> +<a name="id2606633"></a><p>[<abbr class="abbrev">RFC1982</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Elz</span> and <span class="firstname">R.</span> <span class="surname">Bush</span>. </span><span class="title"><i>Serial Number Arithmetic</i>. </span><span class="pubdate">August 1996. </span></p> </div> <div class="biblioentry"> -<a name="id2605617"></a><p>[<abbr class="abbrev">RFC4074</abbr>] <span class="authorgroup"><span class="firstname">Y.</span> <span class="surname">Morishita</span> and <span class="firstname">T.</span> <span class="surname">Jinmei</span>. </span><span class="title"><i>Common Misbehaviour Against <acronym class="acronym">DNS</acronym> +<a name="id2606668"></a><p>[<abbr class="abbrev">RFC4074</abbr>] <span class="authorgroup"><span class="firstname">Y.</span> <span class="surname">Morishita</span> and <span class="firstname">T.</span> <span class="surname">Jinmei</span>. </span><span class="title"><i>Common Misbehaviour Against <acronym class="acronym">DNS</acronym> Queries for IPv6 Addresses</i>. </span><span class="pubdate">May 2005. </span></p> </div> </div> <div class="bibliodiv"> <h3 class="title">Resource Record Types</h3> <div class="biblioentry"> -<a name="id2605662"></a><p>[<abbr class="abbrev">RFC1183</abbr>] <span class="authorgroup"><span class="firstname">C.F.</span> <span class="surname">Everhart</span>, <span class="firstname">L. A.</span> <span class="surname">Mamakos</span>, <span class="firstname">R.</span> <span class="surname">Ullmann</span>, and <span class="firstname">P.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>New <acronym class="acronym">DNS</acronym> RR Definitions</i>. </span><span class="pubdate">October 1990. </span></p> +<a name="id2606714"></a><p>[<abbr class="abbrev">RFC1183</abbr>] <span class="authorgroup"><span class="firstname">C.F.</span> <span class="surname">Everhart</span>, <span class="firstname">L. A.</span> <span class="surname">Mamakos</span>, <span class="firstname">R.</span> <span class="surname">Ullmann</span>, and <span class="firstname">P.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>New <acronym class="acronym">DNS</acronym> RR Definitions</i>. </span><span class="pubdate">October 1990. </span></p> </div> <div class="biblioentry"> -<a name="id2605720"></a><p>[<abbr class="abbrev">RFC1706</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Manning</span> and <span class="firstname">R.</span> <span class="surname">Colella</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> NSAP Resource Records</i>. </span><span class="pubdate">October 1994. </span></p> +<a name="id2606772"></a><p>[<abbr class="abbrev">RFC1706</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Manning</span> and <span class="firstname">R.</span> <span class="surname">Colella</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> NSAP Resource Records</i>. </span><span class="pubdate">October 1994. </span></p> </div> <div class="biblioentry"> -<a name="id2605757"></a><p>[<abbr class="abbrev">RFC2168</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Daniel</span> and <span class="firstname">M.</span> <span class="surname">Mealling</span>. </span><span class="title"><i>Resolution of Uniform Resource Identifiers using +<a name="id2606809"></a><p>[<abbr class="abbrev">RFC2168</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Daniel</span> and <span class="firstname">M.</span> <span class="surname">Mealling</span>. </span><span class="title"><i>Resolution of Uniform Resource Identifiers using the Domain Name System</i>. </span><span class="pubdate">June 1997. </span></p> </div> <div class="biblioentry"> -<a name="id2605793"></a><p>[<abbr class="abbrev">RFC1876</abbr>] <span class="authorgroup"><span class="firstname">C.</span> <span class="surname">Davis</span>, <span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">T.</span>, and <span class="firstname">I.</span> <span class="surname">Dickinson</span>. </span><span class="title"><i>A Means for Expressing Location Information in the +<a name="id2606844"></a><p>[<abbr class="abbrev">RFC1876</abbr>] <span class="authorgroup"><span class="firstname">C.</span> <span class="surname">Davis</span>, <span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">T.</span>, and <span class="firstname">I.</span> <span class="surname">Dickinson</span>. </span><span class="title"><i>A Means for Expressing Location Information in the Domain Name System</i>. </span><span class="pubdate">January 1996. </span></p> </div> <div class="biblioentry"> -<a name="id2605847"></a><p>[<abbr class="abbrev">RFC2052</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Gulbrandsen</span> and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>A <acronym class="acronym">DNS</acronym> RR for Specifying the +<a name="id2606899"></a><p>[<abbr class="abbrev">RFC2052</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Gulbrandsen</span> and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>A <acronym class="acronym">DNS</acronym> RR for Specifying the Location of Services.</i>. </span><span class="pubdate">October 1996. </span></p> </div> <div class="biblioentry"> -<a name="id2605885"></a><p>[<abbr class="abbrev">RFC2163</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Allocchio</span>. </span><span class="title"><i>Using the Internet <acronym class="acronym">DNS</acronym> to +<a name="id2606937"></a><p>[<abbr class="abbrev">RFC2163</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Allocchio</span>. </span><span class="title"><i>Using the Internet <acronym class="acronym">DNS</acronym> to Distribute MIXER Conformant Global Address Mapping</i>. </span><span class="pubdate">January 1998. </span></p> </div> <div class="biblioentry"> -<a name="id2605911"></a><p>[<abbr class="abbrev">RFC2230</abbr>] <span class="author"><span class="firstname">R.</span> <span class="surname">Atkinson</span>. </span><span class="title"><i>Key Exchange Delegation Record for the <acronym class="acronym">DNS</acronym></i>. </span><span class="pubdate">October 1997. </span></p> +<a name="id2606963"></a><p>[<abbr class="abbrev">RFC2230</abbr>] <span class="author"><span class="firstname">R.</span> <span class="surname">Atkinson</span>. </span><span class="title"><i>Key Exchange Delegation Record for the <acronym class="acronym">DNS</acronym></i>. </span><span class="pubdate">October 1997. </span></p> </div> <div class="biblioentry"> -<a name="id2605937"></a><p>[<abbr class="abbrev">RFC2536</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>DSA KEYs and SIGs in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p> +<a name="id2606988"></a><p>[<abbr class="abbrev">RFC2536</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>DSA KEYs and SIGs in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p> </div> <div class="biblioentry"> -<a name="id2606032"></a><p>[<abbr class="abbrev">RFC2537</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>RSA/MD5 KEYs and SIGs in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p> +<a name="id2607015"></a><p>[<abbr class="abbrev">RFC2537</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>RSA/MD5 KEYs and SIGs in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p> </div> <div class="biblioentry"> -<a name="id2606058"></a><p>[<abbr class="abbrev">RFC2538</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span> and <span class="firstname">O.</span> <span class="surname">Gudmundsson</span>. </span><span class="title"><i>Storing Certificates in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p> +<a name="id2607042"></a><p>[<abbr class="abbrev">RFC2538</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span> and <span class="firstname">O.</span> <span class="surname">Gudmundsson</span>. </span><span class="title"><i>Storing Certificates in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p> </div> <div class="biblioentry"> -<a name="id2606098"></a><p>[<abbr class="abbrev">RFC2539</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Storage of Diffie-Hellman Keys in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p> +<a name="id2607081"></a><p>[<abbr class="abbrev">RFC2539</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Storage of Diffie-Hellman Keys in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p> </div> <div class="biblioentry"> -<a name="id2606128"></a><p>[<abbr class="abbrev">RFC2540</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Detached Domain Name System (DNS) Information</i>. </span><span class="pubdate">March 1999. </span></p> +<a name="id2607111"></a><p>[<abbr class="abbrev">RFC2540</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Detached Domain Name System (DNS) Information</i>. </span><span class="pubdate">March 1999. </span></p> </div> <div class="biblioentry"> -<a name="id2606157"></a><p>[<abbr class="abbrev">RFC2782</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Gulbrandsen</span>. </span><span class="author"><span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="author"><span class="firstname">L.</span> <span class="surname">Esibov</span>. </span><span class="title"><i>A DNS RR for specifying the location of services (DNS SRV)</i>. </span><span class="pubdate">February 2000. </span></p> +<a name="id2607141"></a><p>[<abbr class="abbrev">RFC2782</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Gulbrandsen</span>. </span><span class="author"><span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="author"><span class="firstname">L.</span> <span class="surname">Esibov</span>. </span><span class="title"><i>A DNS RR for specifying the location of services (DNS SRV)</i>. </span><span class="pubdate">February 2000. </span></p> </div> <div class="biblioentry"> -<a name="id2606200"></a><p>[<abbr class="abbrev">RFC2915</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Mealling</span>. </span><span class="author"><span class="firstname">R.</span> <span class="surname">Daniel</span>. </span><span class="title"><i>The Naming Authority Pointer (NAPTR) DNS Resource Record</i>. </span><span class="pubdate">September 2000. </span></p> +<a name="id2607184"></a><p>[<abbr class="abbrev">RFC2915</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Mealling</span>. </span><span class="author"><span class="firstname">R.</span> <span class="surname">Daniel</span>. </span><span class="title"><i>The Naming Authority Pointer (NAPTR) DNS Resource Record</i>. </span><span class="pubdate">September 2000. </span></p> </div> <div class="biblioentry"> -<a name="id2606233"></a><p>[<abbr class="abbrev">RFC3110</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS)</i>. </span><span class="pubdate">May 2001. </span></p> +<a name="id2607217"></a><p>[<abbr class="abbrev">RFC3110</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS)</i>. </span><span class="pubdate">May 2001. </span></p> </div> <div class="biblioentry"> -<a name="id2606260"></a><p>[<abbr class="abbrev">RFC3123</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Koch</span>. </span><span class="title"><i>A DNS RR Type for Lists of Address Prefixes (APL RR)</i>. </span><span class="pubdate">June 2001. </span></p> +<a name="id2607312"></a><p>[<abbr class="abbrev">RFC3123</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Koch</span>. </span><span class="title"><i>A DNS RR Type for Lists of Address Prefixes (APL RR)</i>. </span><span class="pubdate">June 2001. </span></p> </div> <div class="biblioentry"> -<a name="id2606283"></a><p>[<abbr class="abbrev">RFC3596</abbr>] <span class="authorgroup"><span class="firstname">S.</span> <span class="surname">Thomson</span>, <span class="firstname">C.</span> <span class="surname">Huitema</span>, <span class="firstname">V.</span> <span class="surname">Ksinant</span>, and <span class="firstname">M.</span> <span class="surname">Souissi</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Extensions to support IP +<a name="id2607335"></a><p>[<abbr class="abbrev">RFC3596</abbr>] <span class="authorgroup"><span class="firstname">S.</span> <span class="surname">Thomson</span>, <span class="firstname">C.</span> <span class="surname">Huitema</span>, <span class="firstname">V.</span> <span class="surname">Ksinant</span>, and <span class="firstname">M.</span> <span class="surname">Souissi</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Extensions to support IP version 6</i>. </span><span class="pubdate">October 2003. </span></p> </div> <div class="biblioentry"> -<a name="id2606341"></a><p>[<abbr class="abbrev">RFC3597</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Gustafsson</span>. </span><span class="title"><i>Handling of Unknown DNS Resource Record (RR) Types</i>. </span><span class="pubdate">September 2003. </span></p> +<a name="id2607393"></a><p>[<abbr class="abbrev">RFC3597</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Gustafsson</span>. </span><span class="title"><i>Handling of Unknown DNS Resource Record (RR) Types</i>. </span><span class="pubdate">September 2003. </span></p> </div> </div> <div class="bibliodiv"> <h3 class="title"> <acronym class="acronym">DNS</acronym> and the Internet</h3> <div class="biblioentry"> -<a name="id2606373"></a><p>[<abbr class="abbrev">RFC1101</abbr>] <span class="author"><span class="firstname">P. V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Encoding of Network Names +<a name="id2607425"></a><p>[<abbr class="abbrev">RFC1101</abbr>] <span class="author"><span class="firstname">P. V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Encoding of Network Names and Other Types</i>. </span><span class="pubdate">April 1989. </span></p> </div> <div class="biblioentry"> -<a name="id2606398"></a><p>[<abbr class="abbrev">RFC1123</abbr>] <span class="author"><span class="surname">Braden</span>. </span><span class="title"><i>Requirements for Internet Hosts - Application and +<a name="id2607450"></a><p>[<abbr class="abbrev">RFC1123</abbr>] <span class="author"><span class="surname">Braden</span>. </span><span class="title"><i>Requirements for Internet Hosts - Application and Support</i>. </span><span class="pubdate">October 1989. </span></p> </div> <div class="biblioentry"> -<a name="id2606421"></a><p>[<abbr class="abbrev">RFC1591</abbr>] <span class="author"><span class="firstname">J.</span> <span class="surname">Postel</span>. </span><span class="title"><i>Domain Name System Structure and Delegation</i>. </span><span class="pubdate">March 1994. </span></p> +<a name="id2607473"></a><p>[<abbr class="abbrev">RFC1591</abbr>] <span class="author"><span class="firstname">J.</span> <span class="surname">Postel</span>. </span><span class="title"><i>Domain Name System Structure and Delegation</i>. </span><span class="pubdate">March 1994. </span></p> </div> <div class="biblioentry"> -<a name="id2606444"></a><p>[<abbr class="abbrev">RFC2317</abbr>] <span class="authorgroup"><span class="firstname">H.</span> <span class="surname">Eidnes</span>, <span class="firstname">G.</span> <span class="surname">de Groot</span>, and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Classless IN-ADDR.ARPA Delegation</i>. </span><span class="pubdate">March 1998. </span></p> +<a name="id2607496"></a><p>[<abbr class="abbrev">RFC2317</abbr>] <span class="authorgroup"><span class="firstname">H.</span> <span class="surname">Eidnes</span>, <span class="firstname">G.</span> <span class="surname">de Groot</span>, and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Classless IN-ADDR.ARPA Delegation</i>. </span><span class="pubdate">March 1998. </span></p> </div> <div class="biblioentry"> -<a name="id2606490"></a><p>[<abbr class="abbrev">RFC2826</abbr>] <span class="authorgroup"><span class="surname">Internet Architecture Board</span>. </span><span class="title"><i>IAB Technical Comment on the Unique DNS Root</i>. </span><span class="pubdate">May 2000. </span></p> +<a name="id2607542"></a><p>[<abbr class="abbrev">RFC2826</abbr>] <span class="authorgroup"><span class="surname">Internet Architecture Board</span>. </span><span class="title"><i>IAB Technical Comment on the Unique DNS Root</i>. </span><span class="pubdate">May 2000. </span></p> </div> <div class="biblioentry"> -<a name="id2606514"></a><p>[<abbr class="abbrev">RFC2929</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>, <span class="firstname">E.</span> <span class="surname">Brunner-Williams</span>, and <span class="firstname">B.</span> <span class="surname">Manning</span>. </span><span class="title"><i>Domain Name System (DNS) IANA Considerations</i>. </span><span class="pubdate">September 2000. </span></p> +<a name="id2607565"></a><p>[<abbr class="abbrev">RFC2929</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>, <span class="firstname">E.</span> <span class="surname">Brunner-Williams</span>, and <span class="firstname">B.</span> <span class="surname">Manning</span>. </span><span class="title"><i>Domain Name System (DNS) IANA Considerations</i>. </span><span class="pubdate">September 2000. </span></p> </div> </div> <div class="bibliodiv"> <h3 class="title"> <acronym class="acronym">DNS</acronym> Operations</h3> <div class="biblioentry"> -<a name="id2606571"></a><p>[<abbr class="abbrev">RFC1033</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Lottor</span>. </span><span class="title"><i>Domain administrators operations guide.</i>. </span><span class="pubdate">November 1987. </span></p> +<a name="id2607623"></a><p>[<abbr class="abbrev">RFC1033</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Lottor</span>. </span><span class="title"><i>Domain administrators operations guide.</i>. </span><span class="pubdate">November 1987. </span></p> </div> <div class="biblioentry"> -<a name="id2606595"></a><p>[<abbr class="abbrev">RFC1537</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Beertema</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Data File +<a name="id2607646"></a><p>[<abbr class="abbrev">RFC1537</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Beertema</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Data File Configuration Errors</i>. </span><span class="pubdate">October 1993. </span></p> </div> <div class="biblioentry"> -<a name="id2606621"></a><p>[<abbr class="abbrev">RFC1912</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Barr</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Operational and +<a name="id2607673"></a><p>[<abbr class="abbrev">RFC1912</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Barr</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Operational and Configuration Errors</i>. </span><span class="pubdate">February 1996. </span></p> </div> <div class="biblioentry"> -<a name="id2606648"></a><p>[<abbr class="abbrev">RFC2010</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Manning</span> and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Operational Criteria for Root Name Servers.</i>. </span><span class="pubdate">October 1996. </span></p> +<a name="id2607700"></a><p>[<abbr class="abbrev">RFC2010</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Manning</span> and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Operational Criteria for Root Name Servers.</i>. </span><span class="pubdate">October 1996. </span></p> </div> <div class="biblioentry"> -<a name="id2606684"></a><p>[<abbr class="abbrev">RFC2219</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Hamilton</span> and <span class="firstname">R.</span> <span class="surname">Wright</span>. </span><span class="title"><i>Use of <acronym class="acronym">DNS</acronym> Aliases for +<a name="id2607736"></a><p>[<abbr class="abbrev">RFC2219</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Hamilton</span> and <span class="firstname">R.</span> <span class="surname">Wright</span>. </span><span class="title"><i>Use of <acronym class="acronym">DNS</acronym> Aliases for Network Services.</i>. </span><span class="pubdate">October 1997. </span></p> </div> </div> <div class="bibliodiv"> <h3 class="title">Internationalized Domain Names</h3> <div class="biblioentry"> -<a name="id2606730"></a><p>[<abbr class="abbrev">RFC2825</abbr>] <span class="authorgroup"><span class="surname">IAB</span> and <span class="firstname">R.</span> <span class="surname">Daigle</span>. </span><span class="title"><i>A Tangled Web: Issues of I18N, Domain Names, +<a name="id2607782"></a><p>[<abbr class="abbrev">RFC2825</abbr>] <span class="authorgroup"><span class="surname">IAB</span> and <span class="firstname">R.</span> <span class="surname">Daigle</span>. </span><span class="title"><i>A Tangled Web: Issues of I18N, Domain Names, and the Other Internet protocols</i>. </span><span class="pubdate">May 2000. </span></p> </div> <div class="biblioentry"> -<a name="id2606762"></a><p>[<abbr class="abbrev">RFC3490</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Faltstrom</span>, <span class="firstname">P.</span> <span class="surname">Hoffman</span>, and <span class="firstname">A.</span> <span class="surname">Costello</span>. </span><span class="title"><i>Internationalizing Domain Names in Applications (IDNA)</i>. </span><span class="pubdate">March 2003. </span></p> +<a name="id2607814"></a><p>[<abbr class="abbrev">RFC3490</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Faltstrom</span>, <span class="firstname">P.</span> <span class="surname">Hoffman</span>, and <span class="firstname">A.</span> <span class="surname">Costello</span>. </span><span class="title"><i>Internationalizing Domain Names in Applications (IDNA)</i>. </span><span class="pubdate">March 2003. </span></p> </div> <div class="biblioentry"> -<a name="id2606808"></a><p>[<abbr class="abbrev">RFC3491</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Hoffman</span> and <span class="firstname">M.</span> <span class="surname">Blanchet</span>. </span><span class="title"><i>Nameprep: A Stringprep Profile for Internationalized Domain Names</i>. </span><span class="pubdate">March 2003. </span></p> +<a name="id2607860"></a><p>[<abbr class="abbrev">RFC3491</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Hoffman</span> and <span class="firstname">M.</span> <span class="surname">Blanchet</span>. </span><span class="title"><i>Nameprep: A Stringprep Profile for Internationalized Domain Names</i>. </span><span class="pubdate">March 2003. </span></p> </div> <div class="biblioentry"> -<a name="id2606843"></a><p>[<abbr class="abbrev">RFC3492</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Costello</span>. </span><span class="title"><i>Punycode: A Bootstring encoding of Unicode +<a name="id2607895"></a><p>[<abbr class="abbrev">RFC3492</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Costello</span>. </span><span class="title"><i>Punycode: A Bootstring encoding of Unicode for Internationalized Domain Names in Applications (IDNA)</i>. </span><span class="pubdate">March 2003. </span></p> </div> @@ -497,47 +497,47 @@ </p> </div> <div class="biblioentry"> -<a name="id2606888"></a><p>[<abbr class="abbrev">RFC1464</abbr>] <span class="author"><span class="firstname">R.</span> <span class="surname">Rosenbaum</span>. </span><span class="title"><i>Using the Domain Name System To Store Arbitrary String +<a name="id2607940"></a><p>[<abbr class="abbrev">RFC1464</abbr>] <span class="author"><span class="firstname">R.</span> <span class="surname">Rosenbaum</span>. </span><span class="title"><i>Using the Domain Name System To Store Arbitrary String Attributes</i>. </span><span class="pubdate">May 1993. </span></p> </div> <div class="biblioentry"> -<a name="id2606910"></a><p>[<abbr class="abbrev">RFC1713</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Romao</span>. </span><span class="title"><i>Tools for <acronym class="acronym">DNS</acronym> Debugging</i>. </span><span class="pubdate">November 1994. </span></p> +<a name="id2607962"></a><p>[<abbr class="abbrev">RFC1713</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Romao</span>. </span><span class="title"><i>Tools for <acronym class="acronym">DNS</acronym> Debugging</i>. </span><span class="pubdate">November 1994. </span></p> </div> <div class="biblioentry"> -<a name="id2606936"></a><p>[<abbr class="abbrev">RFC1794</abbr>] <span class="author"><span class="firstname">T.</span> <span class="surname">Brisco</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Support for Load +<a name="id2607988"></a><p>[<abbr class="abbrev">RFC1794</abbr>] <span class="author"><span class="firstname">T.</span> <span class="surname">Brisco</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Support for Load Balancing</i>. </span><span class="pubdate">April 1995. </span></p> </div> <div class="biblioentry"> -<a name="id2606962"></a><p>[<abbr class="abbrev">RFC2240</abbr>] <span class="author"><span class="firstname">O.</span> <span class="surname">Vaughan</span>. </span><span class="title"><i>A Legal Basis for Domain Name Allocation</i>. </span><span class="pubdate">November 1997. </span></p> +<a name="id2608013"></a><p>[<abbr class="abbrev">RFC2240</abbr>] <span class="author"><span class="firstname">O.</span> <span class="surname">Vaughan</span>. </span><span class="title"><i>A Legal Basis for Domain Name Allocation</i>. </span><span class="pubdate">November 1997. </span></p> </div> <div class="biblioentry"> -<a name="id2606985"></a><p>[<abbr class="abbrev">RFC2345</abbr>] <span class="authorgroup"><span class="firstname">J.</span> <span class="surname">Klensin</span>, <span class="firstname">T.</span> <span class="surname">Wolf</span>, and <span class="firstname">G.</span> <span class="surname">Oglesby</span>. </span><span class="title"><i>Domain Names and Company Name Retrieval</i>. </span><span class="pubdate">May 1998. </span></p> +<a name="id2608037"></a><p>[<abbr class="abbrev">RFC2345</abbr>] <span class="authorgroup"><span class="firstname">J.</span> <span class="surname">Klensin</span>, <span class="firstname">T.</span> <span class="surname">Wolf</span>, and <span class="firstname">G.</span> <span class="surname">Oglesby</span>. </span><span class="title"><i>Domain Names and Company Name Retrieval</i>. </span><span class="pubdate">May 1998. </span></p> </div> <div class="biblioentry"> -<a name="id2607031"></a><p>[<abbr class="abbrev">RFC2352</abbr>] <span class="author"><span class="firstname">O.</span> <span class="surname">Vaughan</span>. </span><span class="title"><i>A Convention For Using Legal Names as Domain Names</i>. </span><span class="pubdate">May 1998. </span></p> +<a name="id2608083"></a><p>[<abbr class="abbrev">RFC2352</abbr>] <span class="author"><span class="firstname">O.</span> <span class="surname">Vaughan</span>. </span><span class="title"><i>A Convention For Using Legal Names as Domain Names</i>. </span><span class="pubdate">May 1998. </span></p> </div> <div class="biblioentry"> -<a name="id2607054"></a><p>[<abbr class="abbrev">RFC3071</abbr>] <span class="authorgroup"><span class="firstname">J.</span> <span class="surname">Klensin</span>. </span><span class="title"><i>Reflections on the DNS, RFC 1591, and Categories of Domains</i>. </span><span class="pubdate">February 2001. </span></p> +<a name="id2608106"></a><p>[<abbr class="abbrev">RFC3071</abbr>] <span class="authorgroup"><span class="firstname">J.</span> <span class="surname">Klensin</span>. </span><span class="title"><i>Reflections on the DNS, RFC 1591, and Categories of Domains</i>. </span><span class="pubdate">February 2001. </span></p> </div> <div class="biblioentry"> -<a name="id2607081"></a><p>[<abbr class="abbrev">RFC3258</abbr>] <span class="authorgroup"><span class="firstname">T.</span> <span class="surname">Hardie</span>. </span><span class="title"><i>Distributing Authoritative Name Servers via +<a name="id2608133"></a><p>[<abbr class="abbrev">RFC3258</abbr>] <span class="authorgroup"><span class="firstname">T.</span> <span class="surname">Hardie</span>. </span><span class="title"><i>Distributing Authoritative Name Servers via Shared Unicast Addresses</i>. </span><span class="pubdate">April 2002. </span></p> </div> <div class="biblioentry"> -<a name="id2607175"></a><p>[<abbr class="abbrev">RFC3901</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Durand</span> and <span class="firstname">J.</span> <span class="surname">Ihren</span>. </span><span class="title"><i>DNS IPv6 Transport Operational Guidelines</i>. </span><span class="pubdate">September 2004. </span></p> +<a name="id2608158"></a><p>[<abbr class="abbrev">RFC3901</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Durand</span> and <span class="firstname">J.</span> <span class="surname">Ihren</span>. </span><span class="title"><i>DNS IPv6 Transport Operational Guidelines</i>. </span><span class="pubdate">September 2004. </span></p> </div> </div> <div class="bibliodiv"> <h3 class="title">Obsolete and Unimplemented Experimental RFC</h3> <div class="biblioentry"> -<a name="id2607219"></a><p>[<abbr class="abbrev">RFC1712</abbr>] <span class="authorgroup"><span class="firstname">C.</span> <span class="surname">Farrell</span>, <span class="firstname">M.</span> <span class="surname">Schulze</span>, <span class="firstname">S.</span> <span class="surname">Pleitner</span>, and <span class="firstname">D.</span> <span class="surname">Baldoni</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Encoding of Geographical +<a name="id2608202"></a><p>[<abbr class="abbrev">RFC1712</abbr>] <span class="authorgroup"><span class="firstname">C.</span> <span class="surname">Farrell</span>, <span class="firstname">M.</span> <span class="surname">Schulze</span>, <span class="firstname">S.</span> <span class="surname">Pleitner</span>, and <span class="firstname">D.</span> <span class="surname">Baldoni</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Encoding of Geographical Location</i>. </span><span class="pubdate">November 1994. </span></p> </div> <div class="biblioentry"> -<a name="id2607276"></a><p>[<abbr class="abbrev">RFC2673</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Crawford</span>. </span><span class="title"><i>Binary Labels in the Domain Name System</i>. </span><span class="pubdate">August 1999. </span></p> +<a name="id2608260"></a><p>[<abbr class="abbrev">RFC2673</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Crawford</span>. </span><span class="title"><i>Binary Labels in the Domain Name System</i>. </span><span class="pubdate">August 1999. </span></p> </div> <div class="biblioentry"> -<a name="id2607303"></a><p>[<abbr class="abbrev">RFC2874</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Crawford</span> and <span class="firstname">C.</span> <span class="surname">Huitema</span>. </span><span class="title"><i>DNS Extensions to Support IPv6 Address Aggregation +<a name="id2608286"></a><p>[<abbr class="abbrev">RFC2874</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Crawford</span> and <span class="firstname">C.</span> <span class="surname">Huitema</span>. </span><span class="title"><i>DNS Extensions to Support IPv6 Address Aggregation and Renumbering</i>. </span><span class="pubdate">July 2000. </span></p> </div> </div> @@ -551,39 +551,39 @@ </p> </div> <div class="biblioentry"> -<a name="id2607351"></a><p>[<abbr class="abbrev">RFC2065</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span> and <span class="firstname">C.</span> <span class="surname">Kaufman</span>. </span><span class="title"><i>Domain Name System Security Extensions</i>. </span><span class="pubdate">January 1997. </span></p> +<a name="id2608334"></a><p>[<abbr class="abbrev">RFC2065</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span> and <span class="firstname">C.</span> <span class="surname">Kaufman</span>. </span><span class="title"><i>Domain Name System Security Extensions</i>. </span><span class="pubdate">January 1997. </span></p> </div> <div class="biblioentry"> -<a name="id2607390"></a><p>[<abbr class="abbrev">RFC2137</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Secure Domain Name System Dynamic Update</i>. </span><span class="pubdate">April 1997. </span></p> +<a name="id2608374"></a><p>[<abbr class="abbrev">RFC2137</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Secure Domain Name System Dynamic Update</i>. </span><span class="pubdate">April 1997. </span></p> </div> <div class="biblioentry"> -<a name="id2607417"></a><p>[<abbr class="abbrev">RFC2535</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Domain Name System Security Extensions</i>. </span><span class="pubdate">March 1999. </span></p> +<a name="id2608401"></a><p>[<abbr class="abbrev">RFC2535</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Domain Name System Security Extensions</i>. </span><span class="pubdate">March 1999. </span></p> </div> <div class="biblioentry"> -<a name="id2607447"></a><p>[<abbr class="abbrev">RFC3008</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Wellington</span>. </span><span class="title"><i>Domain Name System Security (DNSSEC) +<a name="id2608430"></a><p>[<abbr class="abbrev">RFC3008</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Wellington</span>. </span><span class="title"><i>Domain Name System Security (DNSSEC) Signing Authority</i>. </span><span class="pubdate">November 2000. </span></p> </div> <div class="biblioentry"> -<a name="id2607473"></a><p>[<abbr class="abbrev">RFC3090</abbr>] <span class="authorgroup"><span class="firstname">E.</span> <span class="surname">Lewis</span>. </span><span class="title"><i>DNS Security Extension Clarification on Zone Status</i>. </span><span class="pubdate">March 2001. </span></p> +<a name="id2608456"></a><p>[<abbr class="abbrev">RFC3090</abbr>] <span class="authorgroup"><span class="firstname">E.</span> <span class="surname">Lewis</span>. </span><span class="title"><i>DNS Security Extension Clarification on Zone Status</i>. </span><span class="pubdate">March 2001. </span></p> </div> <div class="biblioentry"> -<a name="id2607499"></a><p>[<abbr class="abbrev">RFC3445</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Massey</span> and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>Limiting the Scope of the KEY Resource Record (RR)</i>. </span><span class="pubdate">December 2002. </span></p> +<a name="id2608483"></a><p>[<abbr class="abbrev">RFC3445</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Massey</span> and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>Limiting the Scope of the KEY Resource Record (RR)</i>. </span><span class="pubdate">December 2002. </span></p> </div> <div class="biblioentry"> -<a name="id2607536"></a><p>[<abbr class="abbrev">RFC3655</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Wellington</span> and <span class="firstname">O.</span> <span class="surname">Gudmundsson</span>. </span><span class="title"><i>Redefinition of DNS Authenticated Data (AD) bit</i>. </span><span class="pubdate">November 2003. </span></p> +<a name="id2608519"></a><p>[<abbr class="abbrev">RFC3655</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Wellington</span> and <span class="firstname">O.</span> <span class="surname">Gudmundsson</span>. </span><span class="title"><i>Redefinition of DNS Authenticated Data (AD) bit</i>. </span><span class="pubdate">November 2003. </span></p> </div> <div class="biblioentry"> -<a name="id2607572"></a><p>[<abbr class="abbrev">RFC3658</abbr>] <span class="authorgroup"><span class="firstname">O.</span> <span class="surname">Gudmundsson</span>. </span><span class="title"><i>Delegation Signer (DS) Resource Record (RR)</i>. </span><span class="pubdate">December 2003. </span></p> +<a name="id2608555"></a><p>[<abbr class="abbrev">RFC3658</abbr>] <span class="authorgroup"><span class="firstname">O.</span> <span class="surname">Gudmundsson</span>. </span><span class="title"><i>Delegation Signer (DS) Resource Record (RR)</i>. </span><span class="pubdate">December 2003. </span></p> </div> <div class="biblioentry"> -<a name="id2607598"></a><p>[<abbr class="abbrev">RFC3755</abbr>] <span class="authorgroup"><span class="firstname">S.</span> <span class="surname">Weiler</span>. </span><span class="title"><i>Legacy Resolver Compatibility for Delegation Signer (DS)</i>. </span><span class="pubdate">May 2004. </span></p> +<a name="id2608582"></a><p>[<abbr class="abbrev">RFC3755</abbr>] <span class="authorgroup"><span class="firstname">S.</span> <span class="surname">Weiler</span>. </span><span class="title"><i>Legacy Resolver Compatibility for Delegation Signer (DS)</i>. </span><span class="pubdate">May 2004. </span></p> </div> <div class="biblioentry"> -<a name="id2607625"></a><p>[<abbr class="abbrev">RFC3757</abbr>] <span class="authorgroup"><span class="firstname">O.</span> <span class="surname">Kolkman</span>, <span class="firstname">J.</span> <span class="surname">Schlyter</span>, and <span class="firstname">E.</span> <span class="surname">Lewis</span>. </span><span class="title"><i>Domain Name System KEY (DNSKEY) Resource Record +<a name="id2608609"></a><p>[<abbr class="abbrev">RFC3757</abbr>] <span class="authorgroup"><span class="firstname">O.</span> <span class="surname">Kolkman</span>, <span class="firstname">J.</span> <span class="surname">Schlyter</span>, and <span class="firstname">E.</span> <span class="surname">Lewis</span>. </span><span class="title"><i>Domain Name System KEY (DNSKEY) Resource Record (RR) Secure Entry Point (SEP) Flag</i>. </span><span class="pubdate">April 2004. </span></p> </div> <div class="biblioentry"> -<a name="id2607670"></a><p>[<abbr class="abbrev">RFC3845</abbr>] <span class="authorgroup"><span class="firstname">J.</span> <span class="surname">Schlyter</span>. </span><span class="title"><i>DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format</i>. </span><span class="pubdate">August 2004. </span></p> +<a name="id2608653"></a><p>[<abbr class="abbrev">RFC3845</abbr>] <span class="authorgroup"><span class="firstname">J.</span> <span class="surname">Schlyter</span>. </span><span class="title"><i>DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format</i>. </span><span class="pubdate">August 2004. </span></p> </div> </div> </div> @@ -604,14 +604,14 @@ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2607712"></a>Other Documents About <acronym class="acronym">BIND</acronym> +<a name="id2608695"></a>Other Documents About <acronym class="acronym">BIND</acronym> </h3></div></div></div> <p></p> <div class="bibliography"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2607721"></a>Bibliography</h4></div></div></div> +<a name="id2608705"></a>Bibliography</h4></div></div></div> <div class="biblioentry"> -<a name="id2607723"></a><p><span class="authorgroup"><span class="firstname">Paul</span> <span class="surname">Albitz</span> and <span class="firstname">Cricket</span> <span class="surname">Liu</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym></i>. </span><span class="copyright">Copyright © 1998 Sebastopol, CA: O'Reilly and Associates. </span></p> +<a name="id2608707"></a><p><span class="authorgroup"><span class="firstname">Paul</span> <span class="surname">Albitz</span> and <span class="firstname">Cricket</span> <span class="surname">Liu</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym></i>. </span><span class="copyright">Copyright © 1998 Sebastopol, CA: O'Reilly and Associates. </span></p> </div> </div> </div> @@ -648,7 +648,7 @@ </ul></div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2609824"></a>Prerequisite</h3></div></div></div> +<a name="id2610921"></a>Prerequisite</h3></div></div></div> <p>GNU make is required to build the export libraries (other part of BIND 9 can still be built with other types of make). In the reminder of this document, "make" means GNU make. Note that @@ -657,7 +657,7 @@ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2609833"></a>Compilation</h3></div></div></div> +<a name="id2609361"></a>Compilation</h3></div></div></div> <pre class="screen"> $ <strong class="userinput"><code>./configure --enable-exportlib <em class="replaceable"><code>[other flags]</code></em></code></strong> $ <strong class="userinput"><code>make</code></strong> @@ -672,7 +672,7 @@ $ <strong class="userinput"><code>make</code></strong> </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2609175"></a>Installation</h3></div></div></div> +<a name="id2609385"></a>Installation</h3></div></div></div> <pre class="screen"> $ <strong class="userinput"><code>cd lib/export</code></strong> $ <strong class="userinput"><code>make install</code></strong> @@ -694,7 +694,7 @@ $ <strong class="userinput"><code>make install</code></strong> </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2609206"></a>Known Defects/Restrictions</h3></div></div></div> +<a name="id2609416"></a>Known Defects/Restrictions</h3></div></div></div> <div class="itemizedlist"><ul type="disc"> <li><p>Currently, win32 is not supported for the export library. (Normal BIND 9 application can be built as @@ -734,7 +734,7 @@ $ <strong class="userinput"><code>make</code></strong> </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2609283"></a>The dns.conf File</h3></div></div></div> +<a name="id2610380"></a>The dns.conf File</h3></div></div></div> <p>The IRS library supports an "advanced" configuration file related to the DNS library for configuration parameters that would be beyond the capability of the @@ -752,14 +752,14 @@ $ <strong class="userinput"><code>make</code></strong> </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2609309"></a>Sample Applications</h3></div></div></div> +<a name="id2610407"></a>Sample Applications</h3></div></div></div> <p>Some sample application programs using this API are provided for reference. The following is a brief description of these applications. </p> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2609318"></a>sample: a simple stub resolver utility</h4></div></div></div> +<a name="id2610416"></a>sample: a simple stub resolver utility</h4></div></div></div> <p> It sends a query of a given name (of a given optional RR type) to a specified recursive server, and prints the result as a list of @@ -823,7 +823,7 @@ $ <strong class="userinput"><code>make</code></strong> </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2609409"></a>sample-async: a simple stub resolver, working asynchronously</h4></div></div></div> +<a name="id2610506"></a>sample-async: a simple stub resolver, working asynchronously</h4></div></div></div> <p> Similar to "sample", but accepts a list of (query) domain names as a separate file and resolves the names @@ -864,7 +864,7 @@ $ <strong class="userinput"><code>make</code></strong> </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2609462"></a>sample-request: a simple DNS transaction client</h4></div></div></div> +<a name="id2610560"></a>sample-request: a simple DNS transaction client</h4></div></div></div> <p> It sends a query to a specified server, and prints the response with minimal processing. It doesn't act as a @@ -905,7 +905,7 @@ $ <strong class="userinput"><code>make</code></strong> </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2609526"></a>sample-gai: getaddrinfo() and getnameinfo() test code</h4></div></div></div> +<a name="id2610624"></a>sample-gai: getaddrinfo() and getnameinfo() test code</h4></div></div></div> <p> This is a test program to check getaddrinfo() and getnameinfo() behavior. It takes a @@ -922,7 +922,7 @@ $ <strong class="userinput"><code>make</code></strong> </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2609541"></a>sample-update: a simple dynamic update client program</h4></div></div></div> +<a name="id2610638"></a>sample-update: a simple dynamic update client program</h4></div></div></div> <p> It accepts a single update command as a command-line argument, sends an update request message to the @@ -1017,7 +1017,7 @@ $ <strong class="userinput"><code>sample-update -a sample-update -k Kxxx.+nnn+mm </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2610218"></a>nsprobe: domain/name server checker in terms of RFC 4074</h4></div></div></div> +<a name="id2611248"></a>nsprobe: domain/name server checker in terms of RFC 4074</h4></div></div></div> <p> It checks a set of domains to see the name servers of the domains behave @@ -1074,7 +1074,7 @@ $ <strong class="userinput"><code>sample-update -a sample-update -k Kxxx.+nnn+mm </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2610282"></a>Library References</h3></div></div></div> +<a name="id2611312"></a>Library References</h3></div></div></div> <p>As of this writing, there is no formal "manual" of the libraries, except this document, header files (some of them provide pretty detailed explanations), and sample application diff --git a/doc/arm/Bv9ARM.ch10.html b/doc/arm/Bv9ARM.ch10.html index f2fe6b8..d25c0dd 100644 --- a/doc/arm/Bv9ARM.ch10.html +++ b/doc/arm/Bv9ARM.ch10.html @@ -55,6 +55,12 @@ <span class="refentrytitle"><a href="man.host.html">host</a></span><span class="refpurpose"> — DNS lookup utility</span> </dt> <dt> +<span class="refentrytitle"><a href="man.dnssec-checkds.html"><span class="application">dnssec-checkds</span></a></span><span class="refpurpose"> — A DNSSEC delegation consistency checking tool.</span> +</dt> +<dt> +<span class="refentrytitle"><a href="man.dnssec-coverage.html"><span class="application">dnssec-coverage</span></a></span><span class="refpurpose"> — checks future DNSKEY coverage for a zone</span> +</dt> +<dt> <span class="refentrytitle"><a href="man.dnssec-dsfromkey.html"><span class="application">dnssec-dsfromkey</span></a></span><span class="refpurpose"> — DNSSEC DS RR generation tool</span> </dt> <dt> @@ -73,6 +79,9 @@ <span class="refentrytitle"><a href="man.dnssec-signzone.html"><span class="application">dnssec-signzone</span></a></span><span class="refpurpose"> — DNSSEC zone signing tool</span> </dt> <dt> +<span class="refentrytitle"><a href="man.dnssec-verify.html"><span class="application">dnssec-verify</span></a></span><span class="refpurpose"> — DNSSEC zone verification tool</span> +</dt> +<dt> <span class="refentrytitle"><a href="man.named-checkconf.html"><span class="application">named-checkconf</span></a></span><span class="refpurpose"> — named configuration file syntax checking tool</span> </dt> <dt> diff --git a/doc/arm/Bv9ARM.html b/doc/arm/Bv9ARM.html index 69a2e55..039aa9a 100644 --- a/doc/arm/Bv9ARM.html +++ b/doc/arm/Bv9ARM.html @@ -83,7 +83,7 @@ <dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2568372">Name Server Operations</a></span></dt> <dd><dl> <dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568377">Tools for Use With the Name Server Daemon</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2570424">Signals</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2570600">Signals</a></span></dt> </dl></dd> </dl></dd> <dt><span class="chapter"><a href="Bv9ARM.ch04.html">4. Advanced DNS Features</a></span></dt> @@ -92,64 +92,64 @@ <dt><span class="sect1"><a href="Bv9ARM.ch04.html#dynamic_update">Dynamic Update</a></span></dt> <dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch04.html#journal">The journal file</a></span></dt></dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch04.html#incremental_zone_transfers">Incremental Zone Transfers (IXFR)</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2570937">Split DNS</a></span></dt> -<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2570955">Example split DNS setup</a></span></dt></dl></dd> +<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571175">Split DNS</a></span></dt> +<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571193">Example split DNS setup</a></span></dt></dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch04.html#tsig">TSIG</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2564016">Generate Shared Keys for Each Pair of Hosts</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2564089">Copying the Shared Secret to Both Machines</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571814">Informing the Servers of the Key's Existence</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571850">Instructing the Server to Use the Key</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571908">TSIG Key Based Access Control</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571957">Errors</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571763">Generate Shared Keys for Each Pair of Hosts</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571836">Copying the Shared Secret to Both Machines</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571847">Informing the Servers of the Key's Existence</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571883">Instructing the Server to Use the Key</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571941">TSIG Key Based Access Control</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2564003">Errors</a></span></dt> </dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571971">TKEY</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2572156">SIG(0)</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2564017">TKEY</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2572326">SIG(0)</a></span></dt> <dt><span class="sect1"><a href="Bv9ARM.ch04.html#DNSSEC">DNSSEC</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572225">Generating Keys</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572304">Signing the Zone</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572385">Configuring Servers</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572394">Generating Keys</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572541">Signing the Zone</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572622">Configuring Servers</a></span></dt> </dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch04.html#dnssec.dynamic.zones">DNSSEC, Dynamic Zones, and Automatic Signing</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2608395">Converting from insecure to secure</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563581">Dynamic DNS update method</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563754">Fully automatic zone signing</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563836">Private-type records</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563874">DNSKEY rollovers</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563886">Dynamic DNS update method</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563920">Automatic key rollovers</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563946">NSEC3PARAM rollovers via UPDATE</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563956">Converting from NSEC to NSEC3</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571406">Converting from NSEC3 to NSEC</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571419">Converting from secure to insecure</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571457">Periodic re-signing</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571466">NSEC3 and OPTOUT</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563413">Converting from insecure to secure</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563450">Dynamic DNS update method</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563555">Fully automatic zone signing</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563726">Private-type records</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563832">DNSKEY rollovers</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563845">Dynamic DNS update method</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563878">Automatic key rollovers</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563905">NSEC3PARAM rollovers via UPDATE</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563914">Converting from NSEC to NSEC3</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563924">Converting from NSEC3 to NSEC</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563937">Converting from secure to insecure</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572029">Periodic re-signing</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572039">NSEC3 and OPTOUT</a></span></dt> </dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch04.html#rfc5011.support">Dynamic Trust Anchor Management</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571658">Validating Resolver</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571681">Authoritative Server</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572072">Validating Resolver</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2609027">Authoritative Server</a></span></dt> </dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch04.html#pkcs11">PKCS #11 (Cryptoki) support</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2611650">Prerequisites</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2608875">Building BIND 9 with PKCS#11</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2609137">PKCS #11 Tools</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2635518">Using the HSM</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2635785">Specifying the engine on the command line</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2635831">Running named with automatic zone re-signing</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2611929">Prerequisites</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2610179">Building BIND 9 with PKCS#11</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2612283">PKCS #11 Tools</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2612382">Using the HSM</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2636884">Specifying the engine on the command line</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2636930">Running named with automatic zone re-signing</a></span></dt> </dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2572604">IPv6 Support in <acronym class="acronym">BIND</acronym> 9</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2572842">IPv6 Support in <acronym class="acronym">BIND</acronym> 9</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572871">Address Lookups Using AAAA Records</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572892">Address to Name Lookups Using Nibble Format</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2573109">Address Lookups Using AAAA Records</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2573130">Address to Name Lookups Using Nibble Format</a></span></dt> </dl></dd> </dl></dd> <dt><span class="chapter"><a href="Bv9ARM.ch05.html">5. The <acronym class="acronym">BIND</acronym> 9 Lightweight Resolver</a></span></dt> <dd><dl> -<dt><span class="sect1"><a href="Bv9ARM.ch05.html#id2572925">The Lightweight Resolver Library</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch05.html#id2573163">The Lightweight Resolver Library</a></span></dt> <dt><span class="sect1"><a href="Bv9ARM.ch05.html#lwresd">Running a Resolver Daemon</a></span></dt> </dl></dd> <dt><span class="chapter"><a href="Bv9ARM.ch06.html">6. <acronym class="acronym">BIND</acronym> 9 Configuration Reference</a></span></dt> @@ -157,58 +157,58 @@ <dt><span class="sect1"><a href="Bv9ARM.ch06.html#configuration_file_elements">Configuration File Elements</a></span></dt> <dd><dl> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#address_match_lists">Address Match Lists</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574405">Comment Syntax</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574711">Comment Syntax</a></span></dt> </dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch06.html#Configuration_File_Grammar">Configuration File Grammar</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574990"><span><strong class="command">acl</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575371"><span><strong class="command">acl</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#acl"><span><strong class="command">acl</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575180"><span><strong class="command">controls</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575561"><span><strong class="command">controls</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage"><span><strong class="command">controls</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575472"><span><strong class="command">include</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575489"><span><strong class="command">include</strong></span> Statement Definition and +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575921"><span><strong class="command">include</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575938"><span><strong class="command">include</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575649"><span><strong class="command">key</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575672"><span><strong class="command">key</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575763"><span><strong class="command">logging</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575889"><span><strong class="command">logging</strong></span> Statement Definition and +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575961"><span><strong class="command">key</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575985"><span><strong class="command">key</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576075"><span><strong class="command">logging</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576269"><span><strong class="command">logging</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577914"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577988"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2578120"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2578164"><span><strong class="command">masters</strong></span> Statement Definition and +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2578364"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2578438"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2578502"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2578546"><span><strong class="command">masters</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2578179"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2578567"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#options"><span><strong class="command">options</strong></span> Statement Definition and Usage</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_grammar"><span><strong class="command">server</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_definition_and_usage"><span><strong class="command">server</strong></span> Statement Definition and Usage</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#statschannels"><span><strong class="command">statistics-channels</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2590070"><span><strong class="command">statistics-channels</strong></span> Statement Definition and +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2590613"><span><strong class="command">statistics-channels</strong></span> Statement Definition and Usage</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#trusted-keys"><span><strong class="command">trusted-keys</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2590278"><span><strong class="command">trusted-keys</strong></span> Statement Definition +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2590920"><span><strong class="command">trusted-keys</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2590325"><span><strong class="command">managed-keys</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2590967"><span><strong class="command">managed-keys</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#managed-keys"><span><strong class="command">managed-keys</strong></span> Statement Definition and Usage</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#view_statement_grammar"><span><strong class="command">view</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2590766"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591409"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#zone_statement_grammar"><span><strong class="command">zone</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2592398"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2593189"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt> </dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2595755">Zone File</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2596875">Zone File</a></span></dt> <dd><dl> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#types_of_resource_records_and_when_to_use_them">Types of Resource Records and When to Use Them</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2597986">Discussion of MX Records</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2599037">Discussion of MX Records</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#Setting_TTLs">Setting TTLs</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2598601">Inverse Mapping in IPv4</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2598796">Other Zone File Directives</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2599138"><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2599585">Inverse Mapping in IPv4</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2599848">Other Zone File Directives</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2600189"><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#zonefile_format">Additional File Formats</a></span></dt> </dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch06.html#statistics">BIND9 Statistics</a></span></dt> @@ -217,41 +217,41 @@ <dt><span class="chapter"><a href="Bv9ARM.ch07.html">7. <acronym class="acronym">BIND</acronym> 9 Security Considerations</a></span></dt> <dd><dl> <dt><span class="sect1"><a href="Bv9ARM.ch07.html#Access_Control_Lists">Access Control Lists</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch07.html#id2603806"><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span></a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch07.html#id2604722"><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span></a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2603888">The <span><strong class="command">chroot</strong></span> Environment</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2603947">Using the <span><strong class="command">setuid</strong></span> Function</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2604871">The <span><strong class="command">chroot</strong></span> Environment</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2604999">Using the <span><strong class="command">setuid</strong></span> Function</a></span></dt> </dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch07.html#dynamic_update_security">Dynamic Update Security</a></span></dt> </dl></dd> <dt><span class="chapter"><a href="Bv9ARM.ch08.html">8. Troubleshooting</a></span></dt> <dd><dl> -<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2604027">Common Problems</a></span></dt> -<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch08.html#id2604101">It's not working; how can I figure out what's wrong?</a></span></dt></dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2604113">Incrementing and Changing the Serial Number</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2604130">Where Can I Get Help?</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2605147">Common Problems</a></span></dt> +<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch08.html#id2605153">It's not working; how can I figure out what's wrong?</a></span></dt></dl></dd> +<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2605164">Incrementing and Changing the Serial Number</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2605181">Where Can I Get Help?</a></span></dt> </dl></dd> <dt><span class="appendix"><a href="Bv9ARM.ch09.html">A. Appendices</a></span></dt> <dd><dl> -<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2604192">Acknowledgments</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2605243">Acknowledgments</a></span></dt> <dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch09.html#historical_dns_information">A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym></a></span></dt></dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2604363">General <acronym class="acronym">DNS</acronym> Reference Information</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2605483">General <acronym class="acronym">DNS</acronym> Reference Information</a></span></dt> <dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch09.html#ipv6addresses">IPv6 addresses (AAAA)</a></span></dt></dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch09.html#bibliography">Bibliography (and Suggested Reading)</a></span></dt> <dd><dl> <dt><span class="sect2"><a href="Bv9ARM.ch09.html#rfcs">Request for Comments (RFCs)</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch09.html#internet_drafts">Internet Drafts</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2607712">Other Documents About <acronym class="acronym">BIND</acronym></a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2608695">Other Documents About <acronym class="acronym">BIND</acronym></a></span></dt> </dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch09.html#bind9.library">BIND 9 DNS Library Support</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2609824">Prerequisite</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2609833">Compilation</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2609175">Installation</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2609206">Known Defects/Restrictions</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2609283">The dns.conf File</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2609309">Sample Applications</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2610282">Library References</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2610921">Prerequisite</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2609361">Compilation</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2609385">Installation</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2609416">Known Defects/Restrictions</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2610380">The dns.conf File</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2610407">Sample Applications</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2611312">Library References</a></span></dt> </dl></dd> </dl></dd> <dt><span class="reference"><a href="Bv9ARM.ch10.html">I. Manual pages</a></span></dt> @@ -263,6 +263,12 @@ <span class="refentrytitle"><a href="man.host.html">host</a></span><span class="refpurpose"> — DNS lookup utility</span> </dt> <dt> +<span class="refentrytitle"><a href="man.dnssec-checkds.html"><span class="application">dnssec-checkds</span></a></span><span class="refpurpose"> — A DNSSEC delegation consistency checking tool.</span> +</dt> +<dt> +<span class="refentrytitle"><a href="man.dnssec-coverage.html"><span class="application">dnssec-coverage</span></a></span><span class="refpurpose"> — checks future DNSKEY coverage for a zone</span> +</dt> +<dt> <span class="refentrytitle"><a href="man.dnssec-dsfromkey.html"><span class="application">dnssec-dsfromkey</span></a></span><span class="refpurpose"> — DNSSEC DS RR generation tool</span> </dt> <dt> @@ -281,6 +287,9 @@ <span class="refentrytitle"><a href="man.dnssec-signzone.html"><span class="application">dnssec-signzone</span></a></span><span class="refpurpose"> — DNSSEC zone signing tool</span> </dt> <dt> +<span class="refentrytitle"><a href="man.dnssec-verify.html"><span class="application">dnssec-verify</span></a></span><span class="refpurpose"> — DNSSEC zone verification tool</span> +</dt> +<dt> <span class="refentrytitle"><a href="man.named-checkconf.html"><span class="application">named-checkconf</span></a></span><span class="refpurpose"> — named configuration file syntax checking tool</span> </dt> <dt> diff --git a/doc/arm/Bv9ARM.pdf b/doc/arm/Bv9ARM.pdf index ad261b5..b38b393 100644 --- a/doc/arm/Bv9ARM.pdf +++ b/doc/arm/Bv9ARM.pdf @@ -1275,120 +1275,138 @@ endobj << /S /GoTo /D (section.B.3) >> endobj 856 0 obj -(B.3 dnssec-dsfromkey) +(B.3 dnssec-checkds) endobj 857 0 obj << /S /GoTo /D (section.B.4) >> endobj 860 0 obj -(B.4 dnssec-keyfromlabel) +(B.4 dnssec-coverage) endobj 861 0 obj << /S /GoTo /D (section.B.5) >> endobj 864 0 obj -(B.5 dnssec-keygen) +(B.5 dnssec-dsfromkey) endobj 865 0 obj << /S /GoTo /D (section.B.6) >> endobj 868 0 obj -(B.6 dnssec-revoke) +(B.6 dnssec-keyfromlabel) endobj 869 0 obj << /S /GoTo /D (section.B.7) >> endobj 872 0 obj -(B.7 dnssec-settime) +(B.7 dnssec-keygen) endobj 873 0 obj << /S /GoTo /D (section.B.8) >> endobj 876 0 obj -(B.8 dnssec-signzone) +(B.8 dnssec-revoke) endobj 877 0 obj << /S /GoTo /D (section.B.9) >> endobj 880 0 obj -(B.9 named-checkconf) +(B.9 dnssec-settime) endobj 881 0 obj << /S /GoTo /D (section.B.10) >> endobj 884 0 obj -(B.10 named-checkzone) +(B.10 dnssec-signzone) endobj 885 0 obj << /S /GoTo /D (section.B.11) >> endobj 888 0 obj -(B.11 named) +(B.11 dnssec-verify) endobj 889 0 obj << /S /GoTo /D (section.B.12) >> endobj 892 0 obj -(B.12 named-journalprint) +(B.12 named-checkconf) endobj 893 0 obj << /S /GoTo /D (section.B.13) >> endobj 896 0 obj -(B.13 nsupdate) +(B.13 named-checkzone) endobj 897 0 obj << /S /GoTo /D (section.B.14) >> endobj 900 0 obj -(B.14 rndc) +(B.14 named) endobj 901 0 obj << /S /GoTo /D (section.B.15) >> endobj 904 0 obj -(B.15 rndc.conf) +(B.15 named-journalprint) endobj 905 0 obj << /S /GoTo /D (section.B.16) >> endobj 908 0 obj -(B.16 rndc-confgen) +(B.16 nsupdate) endobj 909 0 obj << /S /GoTo /D (section.B.17) >> endobj 912 0 obj -(B.17 ddns-confgen) +(B.17 rndc) endobj 913 0 obj << /S /GoTo /D (section.B.18) >> endobj 916 0 obj -(B.18 arpaname) +(B.18 rndc.conf) endobj 917 0 obj << /S /GoTo /D (section.B.19) >> endobj 920 0 obj -(B.19 genrandom) +(B.19 rndc-confgen) endobj 921 0 obj << /S /GoTo /D (section.B.20) >> endobj 924 0 obj -(B.20 isc-hmac-fixup) +(B.20 ddns-confgen) endobj 925 0 obj << /S /GoTo /D (section.B.21) >> endobj 928 0 obj -(B.21 nsec3hash) +(B.21 arpaname) endobj 929 0 obj -<< /S /GoTo /D [930 0 R /FitH ] >> +<< /S /GoTo /D (section.B.22) >> endobj -933 0 obj << +932 0 obj +(B.22 genrandom) +endobj +933 0 obj +<< /S /GoTo /D (section.B.23) >> +endobj +936 0 obj +(B.23 isc-hmac-fixup) +endobj +937 0 obj +<< /S /GoTo /D (section.B.24) >> +endobj +940 0 obj +(B.24 nsec3hash) +endobj +941 0 obj +<< /S /GoTo /D [942 0 R /FitH ] >> +endobj +945 0 obj << /Length 240 /Filter /FlateDecode >> @@ -1396,32 +1414,32 @@ stream xÚ•OKA Åïó)rl›N2Éü9ZªRA¡27ñ°´[)¸[ºÖïïlWË‚^$0ïý˜y[Š *Z—BTK ÛÖXx+Þ½¡oFÔ¡Šsåð‡[ LÁ+T\@1M±_8±Eo=C¥BÈÌ~À—Ù,C yÄŠƒÂ•Ë»—Ùrý´š——ì,ãf× ºÃǹ¯ÏÇ~”ž›}Ó7ݶ™¿æ a$/¾äKc¼\óXwŸõûà›Û|
§â1'p®äðqH'`Ô ð3‹zšüßÚ±y±n VG³1°™ž07l(%tî [þM^Xúendstream endobj -930 0 obj << +942 0 obj << /Type /Page -/Contents 933 0 R -/Resources 932 0 R +/Contents 945 0 R +/Resources 944 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 939 0 R +/Parent 951 0 R >> endobj -931 0 obj << +943 0 obj << /Type /XObject /Subtype /Form /FormType 1 /PTEX.FileName (./isc-logo.pdf) /PTEX.PageNumber 1 -/PTEX.InfoDict 940 0 R +/PTEX.InfoDict 952 0 R /Matrix [1.00000000 0.00000000 0.00000000 1.00000000 0.00000000 0.00000000] /BBox [0.00000000 0.00000000 612.00000000 792.00000000] /PieceInfo << -/Illustrator 941 0 R +/Illustrator 953 0 R >> /Resources << /ColorSpace << -/CS0 942 0 R +/CS0 954 0 R >>/Properties << -/MC0 943 0 R +/MC0 955 0 R >>/ExtGState << -/GS0 944 0 R +/GS0 956 0 R >>>> /Length 843 /Filter /FlateDecode @@ -1437,7 +1455,7 @@ BqÕ•l9uš !=§ ¨Œø†vGc £I#/'~<1‚ÀÔRPy±´ýl1½Í¶w1 чd
}¡ þa Ë9b :žÎÞF" ‹>64”~0IGD˜Ë Ø°$ÙtMâ¯%Z½Gð¾¥Úñ§aÑÌ‘ I¼ ý—/øýzü+À endobj -940 0 obj +952 0 obj << /CreationDate (D:20100303120319-08'00') /Creator (Adobe Illustrator CS3) @@ -1446,24 +1464,24 @@ endobj /Title (ISC_logo_only_RGB) >> endobj -941 0 obj +953 0 obj << -/Private 945 0 R +/Private 957 0 R /LastModified (D:20100412113400-07'00') >> endobj -942 0 obj -[/ICCBased 946 0 R] +954 0 obj +[/ICCBased 958 0 R] endobj -943 0 obj +955 0 obj << -/Intent 947 0 R -/Usage 948 0 R +/Intent 959 0 R +/Usage 960 0 R /Name (Layer 1) /Type /OCG >> endobj -944 0 obj +956 0 obj << /OPM 1 /BM /Normal @@ -1477,22 +1495,22 @@ endobj /SA true >> endobj -945 0 obj +957 0 obj << /RoundtripVersion 13 /ContainerVersion 11 /CreatorVersion 13 -/AIMetaData 949 0 R -/AIPrivateData1 950 0 R -/AIPrivateData2 951 0 R -/AIPrivateData3 952 0 R -/AIPrivateData4 953 0 R -/AIPrivateData5 954 0 R +/AIMetaData 961 0 R +/AIPrivateData1 962 0 R +/AIPrivateData2 963 0 R +/AIPrivateData3 964 0 R +/AIPrivateData4 965 0 R +/AIPrivateData5 966 0 R /NumBlock 5 /RoundtripStreamType 1 >> endobj -946 0 obj +958 0 obj << /Length 281 /Filter /FlateDecode @@ -1503,10 +1521,10 @@ H‰b``2ptqre``ÈÍ+) rwRˆˆŒR`?ÏÀÆÀÌ ò‹KRS€j!îAˆBPˆi endobj -947 0 obj +959 0 obj [/View/Design] endobj -948 0 obj +960 0 obj << /CreatorInfo << /Subtype /Artwork @@ -1514,21 +1532,21 @@ endobj >> >> endobj -949 0 obj +961 0 obj << /Length 981 >> stream %!PS-Adobe-3.0
%%Creator: Adobe Illustrator(R) 13.0
%%AI8_CreatorVersion: 13.0.2
%%For: (Brian Reid) ()
%%Title: (ISC_logo_only_RGB.ai)
%%CreationDate: 4/12/10 11:34 AM
%%BoundingBox: 247 367 366 413
%%HiResBoundingBox: 247.0869 367.5654 365.0859 412.583
%%DocumentProcessColors: Cyan Magenta Yellow Black
%AI5_FileFormat 9.0
%AI12_BuildNumber: 434
%AI3_ColorUsage: Color
%AI7_ImageSettings: 0
%%RGBProcessColor: 0 0.658824 0.8 (ISC logo blue)
%%+ 0.372549 0.376471 0.384314 (PANTONE 425 U)
%%+ 0 0 0 ([Registration])
%AI3_TemplateBox: 306.5 395.5 306.5 395.5
%AI3_TileBox: 18 33.1201 594 786.96
%AI3_DocumentPreview: None
%AI5_ArtSize: 612 792
%AI5_RulerUnits: 3
%AI9_ColorModel: 1
%AI5_ArtFlags: 0 0 0 1 0 0 0 0 0
%AI5_TargetResolution: 800
%AI5_NumLayers: 1
%AI9_OpenToView: -381 793 0.92 1268 743 26 0 0 117 75 0 0 1 1 1 0 1
%AI5_OpenViewLayers: 7
%%PageOrigin:0 0
%AI7_GridSettings: 72 8 72 8 1 0 0.8 0.8 0.8 0.9 0.9 0.9
%AI9_Flatten: 1
%AI12_CMSettings: 00.MS
%%EndComments
endstream endobj -950 0 obj +962 0 obj << /Length 11082 >> stream %%BoundingBox: 247 367 366 413
%%HiResBoundingBox: 247.0869 367.5654 365.0859 412.583
%AI7_Thumbnail: 128 52 8
%%BeginData: 10932 Hex Bytes
%0000330000660000990000CC0033000033330033660033990033CC0033FF
%0066000066330066660066990066CC0066FF009900009933009966009999
%0099CC0099FF00CC0000CC3300CC6600CC9900CCCC00CCFF00FF3300FF66
%00FF9900FFCC3300003300333300663300993300CC3300FF333300333333
%3333663333993333CC3333FF3366003366333366663366993366CC3366FF
%3399003399333399663399993399CC3399FF33CC0033CC3333CC6633CC99
%33CCCC33CCFF33FF0033FF3333FF6633FF9933FFCC33FFFF660000660033
%6600666600996600CC6600FF6633006633336633666633996633CC6633FF
%6666006666336666666666996666CC6666FF669900669933669966669999
%6699CC6699FF66CC0066CC3366CC6666CC9966CCCC66CCFF66FF0066FF33
%66FF6666FF9966FFCC66FFFF9900009900339900669900999900CC9900FF
%9933009933339933669933999933CC9933FF996600996633996666996699
%9966CC9966FF9999009999339999669999999999CC9999FF99CC0099CC33
%99CC6699CC9999CCCC99CCFF99FF0099FF3399FF6699FF9999FFCC99FFFF
%CC0000CC0033CC0066CC0099CC00CCCC00FFCC3300CC3333CC3366CC3399
%CC33CCCC33FFCC6600CC6633CC6666CC6699CC66CCCC66FFCC9900CC9933
%CC9966CC9999CC99CCCC99FFCCCC00CCCC33CCCC66CCCC99CCCCCCCCCCFF
%CCFF00CCFF33CCFF66CCFF99CCFFCCCCFFFFFF0033FF0066FF0099FF00CC
%FF3300FF3333FF3366FF3399FF33CCFF33FFFF6600FF6633FF6666FF6699
%FF66CCFF66FFFF9900FF9933FF9966FF9999FF99CCFF99FFFFCC00FFCC33
%FFCC66FFCC99FFCCCCFFCCFFFFFF33FFFF66FFFF99FFFFCC110000001100
%000011111111220000002200000022222222440000004400000044444444
%550000005500000055555555770000007700000077777777880000008800
%000088888888AA000000AA000000AAAAAAAABB000000BB000000BBBBBBBB
%DD000000DD000000DDDDDDDDEE000000EE000000EEEEEEEE0000000000FF
%00FF0000FFFFFF0000FF00FFFFFF00FFFFFF
%524C45FD1F52285252A8FD04FFFD05A8FFFFFFA87DFD4F52285252522852
%525228525252285252522852525228525252285252522852277DA8FFFFA8
%7D7D525227FD04527DA8FFFFA85252275252522852525228525252285252
%522852525228525252285252522852525228525252285252522852525228
%52525228525252285252522852525228525252285252522852525228FD21
%52A8FFFF7D7D525227FD0752275252A8FFFF7DFD215227FD2A522E522752
%2E5227522E5227522E5227522E5227522E5227522E5227527DFFFFA85252
%27522E5227522E5227522E5227522752A8FF7D5227522E5227522E522752
%2E5227522E5227522E5227522E5227522E522752277D7D7D275227522E52
%27522E5227522E5227522E5227522E5227522E5227522E5227522E522752
%2E5227FD1A52277DA8FFA87D2EFD11522E527DFFA853FD1D52A8FFFFFF7D
%28FD285228525252285252522852525228525252285252522852277DFFFF
%7D522752525228525252285252522852525228525252275252FFA8522752
%285252522852525228525252285252522852525228525252277DFFA852A8
%FF5227525252285252522852525228525252285252522852525228525252
%285252522852525228FD1852277DFFFFFD1B52FFA8FD1A527DFFA8275252
%FF7DFD265227522E5227522E5227522E5227522E5227522E522752277DFF
%FF525227522E5227522E5227522E5227522E5227522E5227522E52275252
%FFA852275227522E5227522E5227522E5227522E5227522E522752A8A827
%522E527DA9275227522E5227522E5227522E5227522E5227522E52275227
%5227522E5227522E5227522EFD17527DFFA8FD1E527DFFA8FD17527DFFFD
%0452287DFFFD155228FD075228FD08522852525228525252285252522852
%5252285252522852527D2752525228525252285252522852525228525252
%2852525228525252285252527DFF7D522852525228525252285252522852
%525228FD0452FF7D5228FD0452FF52522852525228525252285252522752
%2752527DA1A8A8FFCACFA8CAA17D5252275228FD3C52A8FFFD145228A8FF
%53FD0652FFA82EFD0C527D7DCAFD04FFAFAF85AF85AFAFFFFFFFA87DFD05
%522E5227522E5227522E5227522E5227522E5227522E5227522E5227522E
%5227522E5227522E5227522E5227522E5227522E5227522E5227522752A8
%FF275227522E5227522E5227522E5227522E522752FFA827522E5227522E
%FF7D522E5227522E522752275252A8FFFFAFAF603CFD041413FD04143C60
%AFFFFF535227FD3A52277DFFA827FD11527DFFFD0852A8FFFD0952A8CFFF
%FFAF3C3D1414141A141A141A141A141A14141461AFFFA8FD045228525252
%285252522852525228525252285252522852525228525252285252522852
%5252285252522852525228525252285252522852525227A8FF5227525252
%2852525228525252285252522EFFA85227525252285228A87D5252522852
%27527DFFFFAF603CFD07141A1414141A1414141AFD041460FFA8FD3D52FF
%A8FD10527DFF7DFD0F527DFFFFA9611414141A141A141A141A141A141A14
%1A141A141A141A14143CFFA827522E5227522E5227522E5227522E522752
%2E5227522E5227522E5227522E5227522E5227522E5227522E5227522E52
%27522E5227522E5227522E527DFF525227522E5227522E5227522E522752
%A8FF27522E5227522E5227522852275252A8FFFF3C1413FD191436FFFD3C
%5259FFA828FD0E52FF7DFD0D527DFFFF8B1414141A141A141A141A141A14
%1A141A141A141A141A141A141A141A141460285252522852525228525252
%285252522852525228525252275227522752275227525252285252522852
%52522852525228525252285252522852525227A8FF7D2752525228525252
%2852525227A8FF52275252522852525228522752A8FFA93CFD05141A1414
%141A1414141A1414141A1414141A1414141A1414141A1414FD1552285252
%7D527D597D527DFD065227FD1852FFA8FD0D52FFFFFD0A52277DFFFF601A
%141A141A141A141A141A141A141A141A141A141A141A141A141A141A141A
%141A142E5227522E5227522E5227522E5227522752527D7DA8A8FD09FFA8
%FFA8A87D532852275227522E5227522E5227522E5227522E5227522E527D
%FF525227522E5227522E52275252FF7D522E5227522E522752277DFFFF36
%FD2314FD0E527D7DFD07FFA8A87DA87DA87DFD04A8FD05FFA87DFD15527D
%FFA827FD0A52A8FF7DFD0952A8FFAF1414141A141A141A141A141A141A14
%1A141A141A141A141A141A141A141A141A141A141A145252285252522852
%525227527DA8FFFFFFA87D7D52522752275227522752275227522752527D
%A8FFFFFFA87E52522752525228525252285252522852525227A8FF522752
%5252285252522752FFA8275252522852525227A8FF85FD05141A1414141A
%1414141A1414141A1414141A1414141A1414141A1414141A1414141AFD07
%52275253A8FFFFFFA8FD045227FD0F522EFD04527D7DFFFFFFA87DFD1052
%7DFF7DFD0A52FF7DFD0852A8FF8B1414141A141A141A141A141A141A141A
%141A141A141A141A141A141A141A141A141A141A141A1427522E52275227
%7DA8FFFFA85252275227522E5227522E5227522E5227522E5227522E5227
%522E52275227527DFFFFFF7D52275227522E5227522E5227522752A8A827
%5227522E52275227A8FF5227522752525227A8FF6113FD2714FD0652A8FF
%FF7D7D28FD22527DA8FFFF7DFD0C5227A8FF7DFD0852A8FFFD06522EA8FF
%61141A141A141A141A141A141A141A141A141A141A141A141A141A141A14
%1A141A141A141A141A141A14285227527DFFFF7D52522752285252522852
%525228525252285252522852525228525252285252522852525228522752
%52FFFFA8525228522852525228FD0452FF7D5228525252285252FF7D5252
%52285227A8FF611414141A1414141A1414141A1414141A1414141A141414
%1A1414141A1414141A1414141A1414141A141452277DFFFFA87D28FD2952
%287DFFFF7EFD0B52A8FFFD065227A8FF7D2752525227A8FF8B141A141A14
%1A141A141A141A141A141A141A141A141A141A141A141A141A141A141A14
%1A141A141A141A1428A8FFFF525227522E5227522E5227522E5227522E52
%27522E5227522E5227522E5227522E5227522E5227522E5227522E522752
%7DFFA87D275227522E522752277EFF52275227522852A8FF52522752277D
%FF8BFD121413FD0F1413FD0914FFFFA8FD3352FFFFA8FD0952FF7DFD0652
%FFA8FD04527DFFAF141A141A141A141A141A141A141A141A141A14613C3C
%141A141A141A141A141A141A143D3C3C141A141A141A14FF7D2752525228
%525252285252522852525228525252285252522852525228525252285252
%522852525228525252285252522852525227A8FFA8FD045228525252A8A8
%27522852277DFF7D27522752A8FFFD051461A9AF848B1414141A141436AF
%AFFFFFFFAFAF36FD04141A14141461A9FFAFFFAFAF601A1414141A7D2EFD
%3552277DFFFFFD0752A8FFFD05527DFFFD04527DFF3C14141A141484FFFF
%FFAF1A141A141A85FD09FF841A141A141A14AFFD08FF841A141A1427522E
%5227522E5227522E5227522E5227522E5227522E5227522E5227522E5227
%522E5227522E5227522E5227522E5227522E5227522E52277DA8FF52522E
%5227527DFF52522E5227FFA852275252FF60FD061485FFFFFFAFFD041460
%FD0BFF36FD0414AFFD0AFF60141414FD3A5253FFFF7DFD04527DFFA85252
%527DFFA8285252FFAF1A141A141A141A84FFFFFFAF3D141A14FD05FF603D
%60FD04FFAF141A1461FD04FFA96136AFFD04FF141A142852525228525252
%285252522852525228525252285252522852525228525252285252522852
%52522852525228525252285252522852525228522752A8FF5252285252FF
%A8FD0452FF7D5227A8FF3C141AFD051485FFFFFFAF14141460FD04FF3614
%141460FFFFFFA91A141484FFFFFFA91A141414FD04FF611414FD3D52A8FF
%FD0452A8FF525228A8FF7D277DFF8B141A141A141A141A85FFFFFFAF1A14
%1A60FD04FF3C141A1461FD04FF141A14FD04FF8B141A141AAFFFFFFF601A
%142E5227522E5227522E5227522E5227522E5227522E5227522E5227522E
%5227522E5227522E5227522E5227522E5227522E5227522E5227522E5227
%522752A8FF5252277DFF7D2752A8FF2752A8FFFD08141385FFFFFFAF1414
%1361FD04FF36FD04148584856014133CFD04FF60FD0414FD04FF851314FD
%3D52287DFFFF525252FF7D5252FFA8527DFF3C1A141A141A141A141A85FF
%FFFFAF1A141A60FD04FFAF141A141A141A141A141A3CFD04FF61141A141A
%3C616061361A145252285252522852525228525252285252522852525228
%525252285252522852525228525252285252522852525228525252275252
%522752525228525252277DFF7E2752FFA82753FF7E27FFA914141A141414
%1A1414148BFFFFFFAF1414143CAFFD04FFAFFD091461FD04FF3614141AFD
%07141AFD2B522852285227FD075227FD075227A8FF7D27FFA8527DFF7D7D
%FF3D141A141A141A141A141484FFFFFFA91A141A1485FD06FF603C141A14
%1A14143CFD04FF61141A141A141A141A141A1427522E5227522E5227522E
%5227522E5227522E5227522E5227522E5227522E5227522E522752275227
%FD04527D7DA8A8FFA8FFA8FFA8A87D7D52522752275227FFA8527DFF277D
%FF52A8AF13FD0A1485FFFFFFAFFD0414138BFD06FFA860FD05143CFD04FF
%36FD0B14FD2852A8A8FD07FFA8FFA8FFA8FD06FFA87D5227527DFF7D7DFF
%7DA8FF7DFF3C1A141A141A141A141A141A84FFFFFFAF3D141A141A148BFD
%07FF8B141A141A3CFD04FF61141A141A141A141A141A1428525252285252
%522852525228525252285252522852525228525252285252522752275252
%A8A8FFFFFFA8A87D7DFD065227FD04527D7DA8FFFFA87D2752A8FF52FF7D
%A8A8CAA914141A1414141A1414141A1485FFFFFFAFFD071460A8FD06FF8B
%1414143CFD04FF36FD04141A1414141A1414FD2252A8FD04FF7D7D525228
%5227FD0B52275252527DFFFFFF5253FFA8A8A8FFA8FF61141A141A141A14
%1A141A141A85FFFFFFAF1A141A141A141A141A60FD06FF85141A3CFD04FF
%61141A141A141A141A141A142E5227522E5227522E5227522E5227522E52
%27522E5227522E5227522752277DA8FFFFA859522752275227522E522752
%2E5227522E5227522E5227522752277DA8FF7DA8FFFFA8FFFFAFFD0C1413
%85FFFFFFAFFD061413FD0414AFFD04FFA9141360FD04FF36FD051413FD05
%14FD1D527DFFFFFF7D7DFD1E52A8FFA8FD05FF601A141A141A141A141A14
%1A141A85FFFFFFAF1A141A143D363D141A141A14FD05FF3C1A3CFD04FF61
%141A141A60AF85AF601A1452522852525228525252285252522852525228
%52525228525252277DFFFFA87D2E52275252522852525228525252285252
%52285252522852525228525252285228527DFD06FF3C141A1414141A1414
%141A1414148BFFFFFFAF141414AFFFFFAF8BFD04143CFD04FF3C143CFD04
%FF60FD04148BFFFFFFAF1414FD1752285259FFFFA9525227FD2352A8FD04
%FFAF141A141A141A141A141A141A141484FFFFFFA91A141484FFFFFFA91A
%141A1461FD04FF3C1414FD04FF8B141A141AA9FFFFFF85141427522E5227
%522E5227522E5227522E5227522E52275227527DFFA87D27522E5227522E
%5227522E5227522E5227522E5227522E5227522E5227522E5227522E5227
%522752A8FFFFFF60FD0E1485FFFFFFAF14141485FD04FFFD041436FD04FF
%3C141484FFFFFFA8FD0414FD04FF611414FD16527DFFFF7D5228FD275227
%A8FFFFFF3D141A141A141A141A141A141A141A84FFFFFFAF3D141460FD04
%FFAF363C3CFD05FF141A1461FD04FF853C148BFD04FF3C1A142752275227
%52275227522752275227522752275227A8FFA82852275227522752275227
%522752275227522752275227522752275227522752275227522752275227
%52275252FFFFAFFD0F1485FFFFFFAFFD0414A8FD05FFAFFD05FF36FD0414
%AFFD0AFF841414147D527D527D527D527D527D527D527D527D527D52A8FF
%FF527D527D527D527D527D527D527D527D527D527D527D527D527D527D52
%7D527D527D527D527D527D527D527D527DA8FF853C363D3C3C363D3C3C36
%3D3C3C363D85FFFFFFAF3D363D3685FD0AFFAF3C363D3C3C60FD0AFF6136
%3D3CFD16FFA8FD49FFAFFD11FFAFFD09FFAFFFFFFF
%%EndData
endstream endobj -951 0 obj +963 0 obj << /Length 65536 >> @@ -1802,7 +1820,7 @@ sÓ
·ÓíÑ·OÒ„ŸuMÊ’ÏyÒÁQÊ—*V€)-z=¦Hèªmƈœ~ÅñÓ×z…Sý[t¸c&4 ŽªªA j^råº;ņÜ(cçç Dx^QÜ×}Ì ˜ ØyY‰Ÿ‹©
¨zŽ…N¬V¥%™‚¨™@“£ =HU˜ü¢³l0¼Tq_PIÐ/u,dÆö¶fý"íŒØ¾MMæu [endstream endobj -952 0 obj +964 0 obj << /Length 65536 >> @@ -2044,7 +2062,7 @@ qlÞ¯ò×âô`> ¶“¬ûVG=# [ül&wJ΂fkíY”&{öñß1øÀ ÛÄ%'DSì F?؆Fß®U
E2,„Ò -[‰Ðð~Eô׈bˆ¨<Þë‹uAhÜš:®—Ú[ɬëxÏ*}ñ endobj -953 0 obj +965 0 obj << /Length 65536 >> @@ -2267,7 +2285,7 @@ uALŽk‹Š=ŽÉÀÇš?é ì•ëðå0ƒ¨Ua¦7S“«ÙŽ®&éÀÓ˜çÈî¹m(‚4„Ћz35Ãùd2pnSø׸®÷—fSµNP™š ]×g1ͼ‘ô AÚF¥5³ò(ª®Í endobj -954 0 obj +966 0 obj << /Length 53114 >> @@ -2464,18 +2482,18 @@ Y‘φ㧻Ç'ÇÕpV— ´Š›·§/ ó ü8 œ;ø# ñ<Ý°'€å‰ íö Ð"W€ Ö^IYïc endobj -934 0 obj << -/D [930 0 R /XYZ 85.0394 794.5015 null] +946 0 obj << +/D [942 0 R /XYZ 85.0394 794.5015 null] >> endobj -935 0 obj << -/D [930 0 R /XYZ 85.0394 769.5949 null] +947 0 obj << +/D [942 0 R /XYZ 85.0394 769.5949 null] >> endobj -932 0 obj << -/Font << /F21 938 0 R >> -/XObject << /Im1 931 0 R >> +944 0 obj << +/Font << /F21 950 0 R >> +/XObject << /Im1 943 0 R >> /ProcSet [ /PDF /Text ] >> endobj -957 0 obj << +969 0 obj << /Length 1075 /Filter /FlateDecode >> @@ -2486,21 +2504,21 @@ xÚ¥V]ªH}Ÿ_Áã˜hÛ ÐÀ¾1ˆÊÁ¼“ÍÞ}`G’1Â\3ÿ~«éD'“Ín|èÓtYuêTõÑ0üˆfpÄmjk¦#CÛ¾? ÅùîR–êüu‹zp9¹Ù[ͱȺÏQvקŽtÏ„{:$v¨ëÓoÓéår £¢Ú¢²!õ:½»µÕ[—H¼fÿõK÷ ùõŸkendstream endobj -956 0 obj << +968 0 obj << /Type /Page -/Contents 957 0 R -/Resources 955 0 R +/Contents 969 0 R +/Resources 967 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 939 0 R +/Parent 951 0 R >> endobj -958 0 obj << -/D [956 0 R /XYZ 56.6929 794.5015 null] +970 0 obj << +/D [968 0 R /XYZ 56.6929 794.5015 null] >> endobj -955 0 obj << -/Font << /F22 961 0 R /F14 964 0 R >> +967 0 obj << +/Font << /F22 973 0 R /F14 976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -967 0 obj << +979 0 obj << /Length 2886 /Filter /FlateDecode >> @@ -2510,1773 +2528,1807 @@ x6$a»N9pšÛCcÓ®³ŒhÉ\HŸE.õ]y<çö°þ4ü|U/6+›Íã¹2ù±?l¾žå™Éÿß$5>Ó;²}Ž `¸+äîù?CO$ êœqNLžYç<'\_³È¾já6 Vü„×›êªè†ˆâ¶3ŒØ»*䉘øL&c 1L R&‘00LPç#&,#LQ 0á “~$q7“¢ºŠ/ös¡å³¤bŸ±d €!†TÁ!†ê|ÄÚ)¢â"à ¯«^lÊŸõ¬æŒ.>ãÉ8C '¨(‚S$ 'ÔyÀIåœäJ†r¥/X:œN6íMÝ,[;ã¹/wÊ•²¹/›þž”íc]²–Š4DØREL" AwΔ$Y–å3e(1JuÉP™Xžo–«¢y~y[Øâµ±9|¯†¨d €!F¡ Fê|¤@’©L ¸£àⶸ<(nöçNñ9.|ê’¹ -¿Z×U½n— ÷Ð̈ƒ2fûHBÎ’ -‹µÁPá_ù™óœ˜ØûÆ»Õõ Î…~‰‰&Áº"15s_êb["_ø3yoÿ>ªendstream +¿Z×U½n— ÷Ð̈ƒ2fûHBÎ’ +‹µÁPá_ù™óœ˜ØûÆ»Õõ Î…~‰‰&Áº"15s_êb["_ø3yoÿgTªendstream endobj -966 0 obj << +978 0 obj << /Type /Page -/Contents 967 0 R -/Resources 965 0 R +/Contents 979 0 R +/Resources 977 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 939 0 R -/Annots [ 970 0 R 971 0 R 972 0 R 973 0 R 974 0 R 975 0 R 976 0 R 977 0 R 978 0 R 979 0 R 980 0 R 981 0 R 982 0 R 983 0 R 984 0 R 985 0 R 986 0 R 987 0 R 988 0 R 989 0 R 990 0 R 991 0 R 992 0 R 993 0 R 994 0 R 995 0 R 996 0 R 997 0 R 998 0 R 999 0 R 1000 0 R 1001 0 R 1002 0 R 1003 0 R 1004 0 R 1005 0 R 1006 0 R 1007 0 R 1008 0 R 1009 0 R 1010 0 R 1011 0 R 1012 0 R 1013 0 R 1014 0 R 1015 0 R 1016 0 R 1017 0 R 1018 0 R 1019 0 R ] +/Parent 951 0 R +/Annots [ 982 0 R 983 0 R 984 0 R 985 0 R 986 0 R 987 0 R 988 0 R 989 0 R 990 0 R 991 0 R 992 0 R 993 0 R 994 0 R 995 0 R 996 0 R 997 0 R 998 0 R 999 0 R 1000 0 R 1001 0 R 1002 0 R 1003 0 R 1004 0 R 1005 0 R 1006 0 R 1007 0 R 1008 0 R 1009 0 R 1010 0 R 1011 0 R 1012 0 R 1013 0 R 1014 0 R 1015 0 R 1016 0 R 1017 0 R 1018 0 R 1019 0 R 1020 0 R 1021 0 R 1022 0 R 1023 0 R 1024 0 R 1025 0 R 1026 0 R 1027 0 R 1028 0 R 1029 0 R 1030 0 R 1031 0 R ] >> endobj -970 0 obj << +982 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 688.709 539.579 697.4212] /Subtype /Link /A << /S /GoTo /D (chapter.1) >> >> endobj -971 0 obj << +983 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 676.5858 539.579 685.5919] /Subtype /Link /A << /S /GoTo /D (section.1.1) >> >> endobj -972 0 obj << +984 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 664.4876 539.579 673.4937] /Subtype /Link /A << /S /GoTo /D (section.1.2) >> >> endobj -973 0 obj << +985 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 652.3894 539.579 661.3954] /Subtype /Link /A << /S /GoTo /D (section.1.3) >> >> endobj -974 0 obj << +986 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 640.2911 539.579 649.1477] /Subtype /Link /A << /S /GoTo /D (section.1.4) >> >> endobj -975 0 obj << +987 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 628.1929 539.579 637.0495] /Subtype /Link /A << /S /GoTo /D (subsection.1.4.1) >> >> endobj -976 0 obj << +988 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 616.0946 539.579 624.9512] /Subtype /Link /A << /S /GoTo /D (subsection.1.4.2) >> >> endobj -977 0 obj << +989 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 603.9964 539.579 612.853] /Subtype /Link /A << /S /GoTo /D (subsection.1.4.3) >> >> endobj -978 0 obj << +990 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 591.7985 539.579 600.7547] /Subtype /Link /A << /S /GoTo /D (subsection.1.4.4) >> >> endobj -979 0 obj << +991 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 579.7002 539.579 588.6565] /Subtype /Link /A << /S /GoTo /D (subsubsection.1.4.4.1) >> >> endobj -980 0 obj << +992 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 567.6019 539.579 576.5582] /Subtype /Link /A << /S /GoTo /D (subsubsection.1.4.4.2) >> >> endobj -981 0 obj << +993 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 555.5037 539.579 564.46] /Subtype /Link /A << /S /GoTo /D (subsubsection.1.4.4.3) >> >> endobj -982 0 obj << +994 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 543.5051 539.579 552.5112] /Subtype /Link /A << /S /GoTo /D (subsection.1.4.5) >> >> endobj -983 0 obj << +995 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 531.4069 539.579 540.413] /Subtype /Link /A << /S /GoTo /D (subsubsection.1.4.5.1) >> >> endobj -984 0 obj << +996 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 519.3086 539.579 528.3147] /Subtype /Link /A << /S /GoTo /D (subsection.1.4.6) >> >> endobj -985 0 obj << +997 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 496.5559 539.579 505.288] /Subtype /Link /A << /S /GoTo /D (chapter.2) >> >> endobj -986 0 obj << +998 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 484.4775 539.579 493.4338] /Subtype /Link /A << /S /GoTo /D (section.2.1) >> >> endobj -987 0 obj << +999 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 472.3792 539.579 481.3355] /Subtype /Link /A << /S /GoTo /D (section.2.2) >> >> endobj -988 0 obj << +1000 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 460.281 539.579 469.2373] /Subtype /Link /A << /S /GoTo /D (section.2.3) >> >> endobj -989 0 obj << +1001 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 448.1827 539.579 457.139] /Subtype /Link /A << /S /GoTo /D (section.2.4) >> >> endobj -990 0 obj << +1002 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 436.0845 539.579 445.0408] /Subtype /Link /A << /S /GoTo /D (section.2.5) >> >> endobj -991 0 obj << +1003 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 413.5759 539.579 422.1635] /Subtype /Link /A << /S /GoTo /D (chapter.3) >> >> endobj -992 0 obj << +1004 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 401.4527 539.579 410.3093] /Subtype /Link /A << /S /GoTo /D (section.3.1) >> >> endobj -993 0 obj << +1005 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 389.3544 539.579 398.2111] /Subtype /Link /A << /S /GoTo /D (subsection.3.1.1) >> >> endobj -994 0 obj << +1006 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 377.2562 539.579 386.1128] /Subtype /Link /A << /S /GoTo /D (subsection.3.1.2) >> >> endobj -995 0 obj << +1007 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 365.0583 539.579 374.0146] /Subtype /Link /A << /S /GoTo /D (section.3.2) >> >> endobj -996 0 obj << +1008 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 352.96 539.579 361.9163] /Subtype /Link /A << /S /GoTo /D (section.3.3) >> >> endobj -997 0 obj << +1009 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 340.8618 539.579 349.818] /Subtype /Link /A << /S /GoTo /D (subsection.3.3.1) >> >> endobj -998 0 obj << +1010 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 328.7635 539.579 337.7198] /Subtype /Link /A << /S /GoTo /D (subsubsection.3.3.1.1) >> >> endobj -999 0 obj << +1011 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 316.6653 539.579 325.6216] /Subtype /Link /A << /S /GoTo /D (subsubsection.3.3.1.2) >> >> endobj -1000 0 obj << +1012 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 304.567 539.579 313.6728] +/Rect [527.6238 304.6667 539.579 313.6728] /Subtype /Link /A << /S /GoTo /D (subsection.3.3.2) >> >> endobj -1001 0 obj << +1013 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 281.9139 539.579 290.7706] /Subtype /Link /A << /S /GoTo /D (chapter.4) >> >> endobj -1002 0 obj << +1014 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 269.8356 539.579 278.9413] /Subtype /Link /A << /S /GoTo /D (section.4.1) >> >> endobj -1003 0 obj << +1015 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 257.7373 539.579 266.8431] /Subtype /Link /A << /S /GoTo /D (section.4.2) >> >> endobj -1004 0 obj << +1016 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 245.6391 539.579 254.7448] /Subtype /Link /A << /S /GoTo /D (subsection.4.2.1) >> >> endobj -1005 0 obj << +1017 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 233.5408 539.579 242.6465] /Subtype /Link /A << /S /GoTo /D (section.4.3) >> >> endobj -1006 0 obj << +1018 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 221.4426 539.579 230.5483] /Subtype /Link /A << /S /GoTo /D (section.4.4) >> >> endobj -1007 0 obj << +1019 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 209.444 539.579 218.4501] /Subtype /Link /A << /S /GoTo /D (subsection.4.4.1) >> >> endobj -1008 0 obj << +1020 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 197.2461 539.579 206.3518] /Subtype /Link /A << /S /GoTo /D (section.4.5) >> >> endobj -1009 0 obj << +1021 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 185.1478 539.579 194.1041] /Subtype /Link /A << /S /GoTo /D (subsection.4.5.1) >> >> endobj -1010 0 obj << +1022 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 173.0496 539.579 182.0058] /Subtype /Link /A << /S /GoTo /D (subsubsection.4.5.1.1) >> >> endobj -1011 0 obj << +1023 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 160.9513 539.579 169.9076] /Subtype /Link /A << /S /GoTo /D (subsubsection.4.5.1.2) >> >> endobj -1012 0 obj << +1024 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 148.8531 539.579 157.8094] /Subtype /Link /A << /S /GoTo /D (subsection.4.5.2) >> >> endobj -1013 0 obj << +1025 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 136.7548 539.579 145.7111] /Subtype /Link /A << /S /GoTo /D (subsection.4.5.3) >> >> endobj -1014 0 obj << +1026 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 124.7562 539.579 133.7623] /Subtype /Link /A << /S /GoTo /D (subsection.4.5.4) >> >> endobj -1015 0 obj << +1027 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 112.658 539.579 121.6641] /Subtype /Link /A << /S /GoTo /D (subsection.4.5.5) >> >> endobj -1016 0 obj << +1028 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 100.5597 539.579 109.5658] /Subtype /Link /A << /S /GoTo /D (subsection.4.5.6) >> >> endobj -1017 0 obj << +1029 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 88.4615 539.579 97.4676] /Subtype /Link /A << /S /GoTo /D (section.4.6) >> >> endobj -1018 0 obj << +1030 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 76.3632 539.579 85.2199] /Subtype /Link /A << /S /GoTo /D (section.4.7) >> >> endobj -1019 0 obj << +1031 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 64.265 539.579 73.1216] /Subtype /Link /A << /S /GoTo /D (section.4.8) >> >> endobj -968 0 obj << -/D [966 0 R /XYZ 85.0394 794.5015 null] +980 0 obj << +/D [978 0 R /XYZ 85.0394 794.5015 null] >> endobj -969 0 obj << -/D [966 0 R /XYZ 85.0394 711.9273 null] +981 0 obj << +/D [978 0 R /XYZ 85.0394 711.9273 null] >> endobj -965 0 obj << -/Font << /F21 938 0 R /F22 961 0 R >> +977 0 obj << +/Font << /F21 950 0 R /F22 973 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1022 0 obj << -/Length 3272 +1034 0 obj << +/Length 3273 /Filter /FlateDecode >> stream -xÚímsÛ6ÇßûShæÞØ3' ñ ¼t §×6q|‘r3wm_¨6ãhªW–’ºŸþ@‘ ®$pmä’4¶ÕÎD´ÄÕ®öÿ#vA‚ïáÞÓ†/|ÏzÅtÁuïbzPô®Âkß ðfŸ>ìÔÇ{= üã…´=ϼ¦7|×SZ3¡×oæXá ï
/:<y}6<=Ž~þpp:ŒïŠ=óBVoùûÁO¿½ËÀ“ÞéÞÇðGÁ¸÷¢7=PZ2¤„g&ƒƒÅ7D¯®M“Ÿ„LH# EôQª5ïY홑B®?ˆbŽñ£>Eqø]9+£åxvuÔº8ü±¼½9ê;#ÙQ_‡ Þƒòþ³½Ù¶ÔEȺ•¦ÍçŽ6‹«^½ñ«v}l¸«ÖîûWz ±¨ŸŠƒb…ô¬(ËLQ˜ÈŠhXŒ¯f”åû²Þøï|¶laöÄÄ@V³‰A†1X5!»‰IÄACzb¤fÚ8 ‰‘
1'óÙÏE!®V‹ÈÍ \|(ÕÃåSE¥“Èc6#ÈbëD1’ˆƒb„ônyrL("T5iE‰ˆ‡çgƒÁéÉßk8žßÎFÓñE;°Ü4/Œf—õÆñj9Ÿ†zÕì‡$eÕ7
@§ä•lÉ‘!%9κÐÝ’'â $'½Ã°ÀyèL4 ›Ž0,„1 m:Þ-Ž¸;œOë¿Æ³›òbµ~ª)1ËyýˆŸ÷V>ØÑ HX6 È‚ BÁˆƒ‚ôÞÀ`¼gÊJ a€®b㘣A½±º¾ -ù§åòý< ÿÖ˧Qb®r9À†ZÓÉA*‚Ú;pà,SJÄ2{…«Éä¶í7ù?× æz -ED"ŠÒ;a5S¡ˆD¨†ˆóÅøCúËÛëFÿz𿘯 /CiÝ7‘[¨@:³QA†*X. -•D *¤w@ÅH&k‹ˆ†"r6øñô?’ùd2¯ç¶û)išÈf6)È"«%l7)‰8(RHï@ŠæLªv¶Á̾Ýèä +xÚímsÛ6ÇßûShæÞØ3' ñ ¼t §×6q|‘r3wm_¨6ãhªW–’ºŸþ@‘ ®$pmä’4¶ÕÎD´ÄÕ®öÿ#vA‚ïáÞÓ†/|ÏzÅtÁuïbzPô®Âkß ðfŸ>ìÔÇ{= üã…´=ϼ¦7|×SZ3¡×oæXá ï
/:<y}6<=Ž~þpp:ŒïŠ=óBVoùûÁO¿½ËÀ“ÞéÞÇðGÁ¸÷¢7=PZ2¤„g&ƒƒÅ7D¯®M“Ÿ„LH# EôQª5ïY홑B®?ˆbŽñ£>Eqø]9+£åxvuÔº8ü±¼½9ê;#ÙQ_‡ Þƒòþ³½Ù¶ÔEȺ•¦ÍçŽ6‹«^½ñ«v}l¸«ÖîûWz ±¨ŸŠƒb…ô¬(ËLQ˜ÈŠhXŒ¯f”åû²Þøï|¶laöÄÄ@V³‰A†1X5!»‰IÄACzb¤fÚ8 ‰‘
1'óÙÏE!®V‹ÈÍ \|(ÕÃåSE¥“Èc6#ÈbëD1’ˆƒb„ônyrL("T5iE‰ˆ‡çgƒÁéÉßk8žßÎFÓñE;°Ü4/Œf—õÆñj9Ÿ†zÕì‡$eÕ7
@§ä•lÉ‘!%9κÐÝ’'â $'½Ã°ÀyèL4 ›Ž0,„1 m:Þ-Ž¸;œOë¿Æ³›òbµ~ª)1ËyýˆŸ÷V>ØÑ HX6 È‚ BÁˆƒ‚ôÞÀ`¼gÊJ a€®b㘣A½±º¾ -ù§åòý< ÿÖ˧Qb®r9À†Z ¤â 8 ½Î2¥D,±Wx±šLn›Ñ~sÿsÝa® D ¤w É„@S^Tã}0» <n UÙ C ,…A" Ò{ƒöœqçÚZÀù}0è:]¹y"ó1ž°Œ Ë…0lBÀŠƒ€ö0Ø ¿¶miࢆá¼\Œç—Ð8ÖòöÛ3SÜ=ñ ¡°@B³aA†,X0 –D ,¤w€ÅØÀ‡V-,²†•ˆx
ëõù°‚æõÛaŒßŸ ,H" -Ò;\þÔZ³ÂÇyFÕ`èí+žÃ#_
(îpu³l.wÎ.ÞÏõö«ÑltUNËÙ²’Ã>J^:Ñ€ìe£ )4°:‰8(4Hï0v(É -ç Á¸é:þ]M>G“ñ%ZŸõ¦¼™OB/rÔ—BïÏk¦a„f )X°`,‰8(XHï -t^Ïnê_oÆ˲:ïé ðbÏ¿®,A–³ B†AXEYt”ˆƒ"ˆôÎ…aJrÕS%/ã ¨b¨¢È…ñäÙj<¹Œ Ìëër6¼lN¤@s— ŸžÇ•è×eóê|V?¾ ÏV„7•ê¯iCã‡Ì•n$QòN SqÒÞ[ `¾K(>AÂÁÉq½aŠ¢Øp0ŸŒã0„x)þÒá<~Öl%‘!¥$Î%¥d"JIÒ{«¤-˜‹¿×BÊû 9˜¿[þsðªZeå r“YÈ–¸µ£F9–Ýwh$‚ ô¥\7ÕZiÇœ*d«n3ØÔöÙ÷gÏë-_?| /ß×[U'X÷€F=~?æ,›dHÁ€5¡hHÄAá@zowe˜+PÃÏÔÞÄ ;`Ä¿)¯›°tWf£ÌW+¼ð ³õC†”~8ƒ”~‰8(ýHï~R1k7äŸ _,® nÕå{Ìî>·ŠÍç̱µ£4DY”Ý7·$‚ ¤\· -Á¬ÒxH†‚›© T^® æ8 ‰È–RãDS"'â T&½CÝ
»[.M+rs'qbeXºÏ'á`4…ÛO7 dH¡ƒå£ÐIÄA¡CzoБÞ1ã¸oÑQ5:oovo¨ - Ò;Œº:žàpÁæøò²>ÖošiàËùü·Õuóê6ŽÃ°¢ -ÎÆ¿þ:iöy1_„ÚQmûo^fHE¶ÌÈ’§š’9%óŽwŽ½7_#%¹aBÈš±êþÆ"äbMÜιƒ—ã«÷ËeõïÖ -¡ÎìƒÆý²† qï¼ï:kÝwñà·£²µã5YI‹p(x^/×ëo˜¨¾U$æ«;=ÍË¿.F‹ÛPN ÈR‡Ï}$Aú²$dH IX Š‰D ¤w`CøPµw
¢ac£ ¥¨x>*§ÕôÉ[½_ÿÒ(“™K -6$HÙ‹ %AÊ®÷Ô˜+ŒgNûSÓŒ¹;Cm{*7̱`zý¦|W.ÊÙEÙ9xóûŽ·Ø€o7‚–Ý+†ðÛQ™Úñš<¦´eNØZ&ÇÛdj^Œ¡·8¬×-W÷ÓrûTç+|@J³,dH YX2Š“D /¤÷¦iJ3ë
\âW@í4¯FË‹÷P”o*TŒû9í*ÎlT!… -–Ku¯ZIÅA¡BzWÑ„”Ì¥[XÖ¸Èê|Èíl9úã¨/½ÞŸ¿(ÊlP! -–Š% -é½Epf¥pÑ€ò¼¬êÐlÜV¡xÊûíÍèªüF5K#1KÙ CŠ¬Å@"ŠÒ;Ô•Â3[𶮈xßþ´¾CJ QC;» 5HT Ù¨ C -,…J" -Ò{ .¸·Ì¯ZXöuåA‰©Ì lH¥º×a¥â @¡½· 8 f9Í¢”}]Ùe +Ò;\þÔZ³ÂÇyFÕ`èí+žÃ#_
(îpu³l.wÎ.ÞÏõö«ÑltUNËÙ²’Ã>J^:Ñ€ìe£ )4°:Âw£‘ˆƒBƒôc‡’¬0qŒ›®ãßÕäs4_¢õYoÊ›ù$ô"G})ôþ¼fHh6,È‚ FÁ’ˆƒ‚…ô°HÎ +Y¨–¦+9^-ÃH1^V>”x©MhI´Ú÷"[ˆ@³A†"X& +‘D "¤÷Xj¸cÞ; ŒðºÔœÿxÒœíþ[õTµñs¡‹“ÅíõrþÛ8l7ÏÞ¬®¯ç‹Pe¬zzàtIÍ&RÄ`ÑdÑML"ŠÒ; *… OÅ©çPÎëÙMýïï«ñÍxYVç=Ý^ìùו%Èr6AÈ"«H”ˆƒ"ˆôÎ…aJrÕS%/ã ¨b¨¢È…ñäÙj<¹Œ Ìëër6¼lN¤@s— ŸžÇ•è×eóê|V?¾ ÏV„7•ê¯iCã‡Ì•n$QòN SqÒÞ[ `¾K(>AÂÁÉq½aŠ¢Øp0ŸŒã0„x)þÒá<~Öl%‘!¥$Î%¥d"JIÒ{«¤-˜‹¿×BÊû 9˜¿[þsðªZeå r“YÈ–¸µ£F9–Ýwh$‚ ô¥\7ÕZiÇœ*d«n3ØÔöÙ÷gÏë-_?| /ß×[U'X÷€F=~?æ,›dHÁ€5‘Ý+ëSqP8ÞÛÃ]æ +Ôð3µ7qÆñÀoÊë&,Ý•Ù(óÕ +/|Âlý!¥ Î ¥_"J?Ò{«ŸTÌÚ
ùÄ'È‹k‡€[uù ³»Ïbó9³Elí(
Q) wƒ ¤\· +Á¬ÒxH†‚›© T^® æ8 ‰È–RãDS"'â T&½CÝ
»[.M+rs'qbeXºÏ'á`4…ÛO7 dH¡ƒå£ÐIÄA¡CzoБÞ1ã¸oÑQ5:oovo¨ +Í÷ç LÓÂ%˜z Y¢oô‚ï ä8 dH„5”Ý·Ì¥â +ÐýtÎ؇¼L$æ%[sdHiŽóNižˆƒÒœôšKÇ´h§ "^ùßÖ<®E5‚¦àlü믓fŸóE¨ Õ¶ÿæe†TdËŒ )™qª)™qP2ïxçØ{ó5R’&„¬«îo,B.†ÐÄíœ;x9¾z¿üXVÿnêÌ 8aÜ/kÈ ÷Îû®³Ö}~;*[;^“•´‡‚çõrq½þ†‰ê[Eb¾ºÓÓ¼üëb´¸
åô,uøÜG¤/ûHB†Ô‘„塘HÄA±Az6„uQ{×°!66úèQŠŠç£rZMŸ¼Õûõ/’1™¹¤`C‚”
±RRq¤ìzO¹Âxæ´¯15͘»3Ô¶§rà ¦×oÊw墜]”Ý™ƒ7¿ïx‹
ˆñv#hÙ½Æ ¿ •© ¯ÉcJ[æ„e2q¼M¦æÅz‹ÓÉzÝru?-·Ou¾Òɤ4ûÈB†Ô‘…%£8IÄAñBzošV¡4³ÞpÀ%~ÔNÓúj´¼xEù¦BÅX±ŸÓn¡éÌFR¨`¹T÷ª•T *¤÷xMHɬQº…e‹¬Î‡ÜΖ£?ŽúÒëýùðû€©ÌR `©(PqP Þ[PgV +‡@
(Ï˪ÍÆmŠ§¼ßÞŒ®ÊodQó׸4³”Í +2¤PÁrQ¨$â P!½Çá‚{ËŒñª…e_W>”˜Ê\P°!ʆTª{Ue*Ú{ ŠÓa–Ó,!ªAÙו] KÙ CŠ¬Å@"ŠÒ;Ìo¹•ÌqÂ"î7¿ýn1šNGÕÙ#+÷ÓÛ-\ £Ù¸ C +¬…K" +Ò{Ó†pÙ>ÐÂÖ¥më„ä̹BÕ^£‹I³ÏƤ™à¡ç©÷,G˲mc"]Vì¿Œ¬Íy6OÈâ kªº×‰¥â x"½OÊ3„<‰/ÁÓݵÌyþøÆ!Èm67ÈâkGq“ˆƒâ†ôÜHËtœ
UkïÂæb>[.ªõ©»ìHÏ +.Å c‘vó‹K:ñiRœMOkGÁƒTÝ« APèP® ¡™²¾`ê‹¡sZ‹‡@J'"ËlF! ÖŠ¢$… é 8á’)eÛʤïäd<»˜¬.Ë&†YÏïêv O«Q†gム)|°„ª{Åc* + Ò;àSp¦¸‰ô˜/EÏ݃Ì×¾¨ÿ™Wl@&³!ií(FN"»AP„P®@œgÒ)±wR}cs¢ñ
È;yÇÐ"¥ÛŸô…”ç’„ì’° I‰ ’H×ð«C–I-Ú¡Æ} ’î ftñø¦PÚìŸ'jí¨_'BÂÄ$‚ ~›ˆr +€IÑNžüÀLæWWÕ +²Dm +îŒ×wÇùÖ¿ë3׬&Áù?/ +Ì8×±ÎU¸‚i£uO†&]ÖÃéxL,<_ï…Bÿ ÙëÒ’endstream endobj -1021 0 obj << +1033 0 obj << /Type /Page -/Contents 1022 0 R -/Resources 1020 0 R +/Contents 1034 0 R +/Resources 1032 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 939 0 R -/Annots [ 1027 0 R 1028 0 R 1029 0 R 1030 0 R 1031 0 R 1032 0 R 1033 0 R 1034 0 R 1035 0 R 1036 0 R 1037 0 R 1038 0 R 1039 0 R 1040 0 R 1041 0 R 1042 0 R 1043 0 R 1044 0 R 1045 0 R 1046 0 R 1047 0 R 1048 0 R 1049 0 R 1050 0 R 1051 0 R 1052 0 R 1053 0 R 1054 0 R 1055 0 R 1056 0 R 1057 0 R 1058 0 R 1059 0 R 1060 0 R 1061 0 R 1062 0 R 1063 0 R 1064 0 R 1065 0 R 1066 0 R 1067 0 R 1068 0 R 1069 0 R 1070 0 R 1071 0 R 1072 0 R 1073 0 R 1074 0 R 1075 0 R 1076 0 R 1077 0 R 1078 0 R 1079 0 R 1080 0 R 1081 0 R 1082 0 R 1083 0 R ] +/Parent 951 0 R +/Annots [ 1039 0 R 1040 0 R 1041 0 R 1042 0 R 1043 0 R 1044 0 R 1045 0 R 1046 0 R 1047 0 R 1048 0 R 1049 0 R 1050 0 R 1051 0 R 1052 0 R 1053 0 R 1054 0 R 1055 0 R 1056 0 R 1057 0 R 1058 0 R 1059 0 R 1060 0 R 1061 0 R 1062 0 R 1063 0 R 1064 0 R 1065 0 R 1066 0 R 1067 0 R 1068 0 R 1069 0 R 1070 0 R 1071 0 R 1072 0 R 1073 0 R 1074 0 R 1075 0 R 1076 0 R 1077 0 R 1078 0 R 1079 0 R 1080 0 R 1081 0 R 1082 0 R 1083 0 R 1084 0 R 1085 0 R 1086 0 R 1087 0 R 1088 0 R 1089 0 R 1090 0 R 1091 0 R 1092 0 R 1093 0 R 1094 0 R 1095 0 R ] >> endobj -1027 0 obj << +1039 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 758.5763 511.2325 767.4329] /Subtype /Link /A << /S /GoTo /D (subsection.4.8.1) >> >> endobj -1028 0 obj << +1040 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 746.445 511.2325 755.4012] /Subtype /Link /A << /S /GoTo /D (subsection.4.8.2) >> >> endobj -1029 0 obj << +1041 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 734.4133 511.2325 743.3696] /Subtype /Link /A << /S /GoTo /D (subsection.4.8.3) >> >> endobj -1030 0 obj << +1042 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 722.3816 511.2325 731.3379] /Subtype /Link /A << /S /GoTo /D (section.4.9) >> >> endobj -1031 0 obj << +1043 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 710.3499 511.2325 719.3062] /Subtype /Link /A << /S /GoTo /D (subsection.4.9.1) >> >> endobj -1032 0 obj << +1044 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 698.3182 511.2325 707.2745] /Subtype /Link /A << /S /GoTo /D (subsection.4.9.2) >> >> endobj -1033 0 obj << +1045 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 686.2866 511.2325 695.2428] /Subtype /Link /A << /S /GoTo /D (subsection.4.9.3) >> >> endobj -1034 0 obj << +1046 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 674.2549 511.2325 683.2112] +/Rect [499.2773 674.3546 511.2325 683.2112] /Subtype /Link /A << /S /GoTo /D (subsection.4.9.4) >> >> endobj -1035 0 obj << +1047 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 662.3229 511.2325 671.1795] /Subtype /Link /A << /S /GoTo /D (subsection.4.9.5) >> >> endobj -1036 0 obj << +1048 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 650.2912 511.2325 659.1478] /Subtype /Link /A << /S /GoTo /D (subsection.4.9.6) >> >> endobj -1037 0 obj << +1049 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 638.2595 511.2325 647.1161] /Subtype /Link /A << /S /GoTo /D (subsection.4.9.7) >> >> endobj -1038 0 obj << +1050 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 626.1282 511.2325 635.0845] /Subtype /Link /A << /S /GoTo /D (subsection.4.9.8) >> >> endobj -1039 0 obj << +1051 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 614.0965 511.2325 623.0528] /Subtype /Link /A << /S /GoTo /D (subsection.4.9.9) >> >> endobj -1040 0 obj << +1052 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 602.0648 511.2325 611.0211] /Subtype /Link /A << /S /GoTo /D (subsection.4.9.10) >> >> endobj -1041 0 obj << +1053 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 590.0331 511.2325 598.9894] /Subtype /Link /A << /S /GoTo /D (subsection.4.9.11) >> >> endobj -1042 0 obj << +1054 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 578.0015 511.2325 586.9578] /Subtype /Link /A << /S /GoTo /D (subsection.4.9.12) >> >> endobj -1043 0 obj << +1055 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 565.9698 511.2325 574.9261] /Subtype /Link /A << /S /GoTo /D (subsection.4.9.13) >> >> endobj -1044 0 obj << +1056 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 553.9381 511.2325 562.8944] /Subtype /Link /A << /S /GoTo /D (section.4.10) >> >> endobj -1045 0 obj << +1057 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 541.9064 511.2325 550.8627] /Subtype /Link /A << /S /GoTo /D (subsection.4.10.1) >> >> endobj -1046 0 obj << +1058 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 529.8748 511.2325 538.831] /Subtype /Link /A << /S /GoTo /D (subsection.4.10.2) >> >> endobj -1047 0 obj << +1059 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 517.8431 511.2325 526.7994] /Subtype /Link /A << /S /GoTo /D (section.4.11) >> >> endobj -1048 0 obj << +1060 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 505.8114 511.2325 514.7677] /Subtype /Link /A << /S /GoTo /D (subsection.4.11.1) >> >> endobj -1049 0 obj << +1061 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 493.7797 511.2325 502.8855] /Subtype /Link /A << /S /GoTo /D (subsubsection.4.11.1.1) >> >> endobj -1050 0 obj << +1062 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 481.7481 511.2325 490.8538] /Subtype /Link /A << /S /GoTo /D (subsubsection.4.11.1.2) >> >> endobj -1051 0 obj << +1063 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 469.7164 511.2325 478.6727] /Subtype /Link /A << /S /GoTo /D (subsubsection.4.11.1.3) >> >> endobj -1052 0 obj << +1064 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 457.6847 511.2325 466.641] /Subtype /Link /A << /S /GoTo /D (subsection.4.11.2) >> >> endobj -1053 0 obj << +1065 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 445.653 511.2325 454.6093] /Subtype /Link /A << /S /GoTo /D (subsubsection.4.11.2.1) >> >> endobj -1054 0 obj << +1066 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 433.6213 511.2325 442.5776] /Subtype /Link /A << /S /GoTo /D (subsubsection.4.11.2.2) >> >> endobj -1055 0 obj << +1067 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 421.5897 511.2325 430.5459] /Subtype /Link /A << /S /GoTo /D (subsubsection.4.11.2.3) >> >> endobj -1056 0 obj << +1068 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 409.558 511.2325 418.5143] /Subtype /Link /A << /S /GoTo /D (subsection.4.11.3) >> >> endobj -1057 0 obj << +1069 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 397.5263 511.2325 406.4826] +/Rect [499.2773 397.5263 511.2325 406.6321] /Subtype /Link /A << /S /GoTo /D (subsection.4.11.4) >> >> endobj -1058 0 obj << +1070 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 385.4946 511.2325 394.4509] /Subtype /Link /A << /S /GoTo /D (subsection.4.11.5) >> >> endobj -1059 0 obj << +1071 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 373.4629 511.2325 382.4192] /Subtype /Link /A << /S /GoTo /D (subsection.4.11.6) >> >> endobj -1060 0 obj << +1072 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 361.4313 511.2325 370.3876] /Subtype /Link /A << /S /GoTo /D (section.4.12) >> >> endobj -1061 0 obj << +1073 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 349.3996 511.2325 358.3559] /Subtype /Link /A << /S /GoTo /D (subsection.4.12.1) >> >> endobj -1062 0 obj << +1074 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 337.3679 511.2325 346.3242] /Subtype /Link /A << /S /GoTo /D (subsection.4.12.2) >> >> endobj -1063 0 obj << +1075 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 315.0477 511.2325 323.7798] /Subtype /Link /A << /S /GoTo /D (chapter.5) >> >> endobj -1064 0 obj << +1076 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 303.0359 511.2325 311.9922] /Subtype /Link /A << /S /GoTo /D (section.5.1) >> >> endobj -1065 0 obj << +1077 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 291.0042 511.2325 299.9605] /Subtype /Link /A << /S /GoTo /D (section.5.2) >> >> endobj -1066 0 obj << +1078 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 268.684 511.2325 277.4161] /Subtype /Link /A << /S /GoTo /D (chapter.6) >> >> endobj -1067 0 obj << +1079 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 256.6722 511.2325 265.6285] /Subtype /Link /A << /S /GoTo /D (section.6.1) >> >> endobj -1068 0 obj << +1080 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 244.7402 511.2325 253.7462] /Subtype /Link /A << /S /GoTo /D (subsection.6.1.1) >> >> endobj -1069 0 obj << +1081 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 232.7085 511.2325 241.7146] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.1.1.1) >> >> endobj -1070 0 obj << +1082 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 220.6768 511.2325 229.6829] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.1.1.2) >> >> endobj -1071 0 obj << +1083 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 208.6451 511.2325 217.6512] /Subtype /Link /A << /S /GoTo /D (subsection.6.1.2) >> >> endobj -1072 0 obj << +1084 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 196.6134 511.2325 205.6195] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.1.2.1) >> >> endobj -1073 0 obj << +1085 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 184.5818 511.2325 193.5878] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.1.2.2) >> >> endobj -1074 0 obj << +1086 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 172.5501 511.2325 181.5562] /Subtype /Link /A << /S /GoTo /D (section.6.2) >> >> endobj -1075 0 obj << +1087 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 160.4187 511.2325 169.5245] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.1) >> >> endobj -1076 0 obj << +1088 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 148.3871 511.2325 157.4928] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.2) >> >> endobj -1077 0 obj << +1089 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 136.4551 511.2325 145.4611] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.3) >> >> endobj -1078 0 obj << +1090 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 124.4234 511.2325 133.4295] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.4) >> >> endobj -1079 0 obj << +1091 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 112.292 511.2325 121.3978] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.5) >> >> endobj -1080 0 obj << +1092 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 100.2604 511.2325 109.3661] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.6) >> >> endobj -1081 0 obj << +1093 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 88.2287 511.2325 97.3344] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.7) >> >> endobj -1082 0 obj << +1094 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 76.197 511.2325 85.3027] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.8) >> >> endobj -1083 0 obj << +1095 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 64.1653 511.2325 73.2711] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.9) >> >> endobj -1023 0 obj << -/D [1021 0 R /XYZ 56.6929 794.5015 null] +1035 0 obj << +/D [1033 0 R /XYZ 56.6929 794.5015 null] >> endobj -1020 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F21 938 0 R >> +1032 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F21 950 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1086 0 obj << -/Length 3431 +1098 0 obj << +/Length 3428 /Filter /FlateDecode >> stream -xÚíKs7Çïú<ä ˆÅû±§µ-Ù¥T";²\»å$5–X¡H…¤üȧ_ g - 3*êwüsç×ßéàÔûÿq‡á¬|ñ¡„9Ç;R ¢¤á'Ó÷;¿Ä7ÿº6Í}%,Q–›Ì'á |Æ9±Îøè”#Zp±þ(šp jýAüå \.±–Jl:?;›ÌÎÚëàÛ -C„vº½îýj´ª.ªÙjoÈÝݯ~£”Ï&«É|Öüd4;m^|XŽÎª½¡cf—ì
¥÷ó‡tî±»&´â–hNYÊå
egƒæÅ1Ô*Ø
¡áMn¾\©oÄ´ÏÅ‘‚zgJcŒiˆÖLRÛó¿:t÷ä¼Ê@£)¡Lš†ñùh6«¦9h,‘J…ëÞ/FKÏ‚è^Y¸NÊà é-†bð@ù0x2q`ð Þ<Bí¨‚ððxü@r6_|ËÐ#)Ñö:<’ÚϽŒ<!½Åð -¤y‰ø£¥¦—“ÉbN€!Æ TJÑ~N2q`œ ÞÓZ†1b¤ "'lóZæË¢ÊQÁýJÆ–_ɼYŒ..F‹ú/úa3ßeë¥)付&`ˆÑõT¬Ÿ¦L M¨÷H“v®~"MünhÚ¼.–ÌmÏ\óZJ
4D¨éè¦x/5¹8jpï‰kˆ¥`¡¹-WUvjªË)ÙWNÅAÈ<ôAè{Ô¦¸˜Ÿd‡áÄè¹æ:±c±B³¼+xnS‹»ÇÀJ/$!—Å” -é.† b0A9]ÿóvrq`0¡Þ#LÜqb´I}®ï¦ÍãŠvz{ ÒÓZ -
4D éȆ@“‹÷ž ±”îâ››¶õ{ jܦ§`(kŸðöNLw1LÀƒ Êéúo!ÈÅÁ„zO0ùõˆ÷¶s{',m €ŒbÛ3k…¬#“ì0b€f®Ë(Æ æ:îr¥‰U -´ælx0ƵԾ]Vë›ÄS=ÖËFHa1 À£J„ᑉãõž -ŒÌw‚C:ÂX|æŽX/Fk:ÞW«ô\•““ŸÖ Èçåe9;!ÃÅð -U& *Ô}‚Šú¢G
âPýðöøðÍáQîË
,>4¦3Pí
Ý"ë{„ z†„ó 1^ `(/™@0^P÷‘ë×Ü +xÚíKSIÇï| + æ +Ñʼn‘„ óé·ZÝU•
Õ)j×0 GØw*Sùÿ)«*»º›
¨ÿÃV*œ '‰¢L
Æ;tpæÿïÍk†ƒ†ð¨—';ÿx-ÌÀ§¹ œ|ïe µ–
NNÝ}õöèäàèäýÞï'?î œÄ7…Žõ;þ¹óëïtpêýÿ¸C‰pV
¾ø (aÎñÁÅŽT‚()DøÍtçýÎ/ñ
Áÿ®Ms D K”å&óI8Ÿ„qN¬3>:åˆ\¬?Š&܇Z8‡ F¬¥Òû¨›ÎÏÎ&³³ö8ø¶Â¡n{¿ª‹j¶ÚrEw÷«ß(å³Éj2Ÿ5¿ÍN› –£³joè˜Ù%{CEéýü#û_ì® ¸%šS–ryC™ÅÙ yq µ +vChxS«›ï_'Wêqísq`¤ Þ™’ÄãF¢5“€ÂöüW‡îžœWh4%”IÓÂ0> ÍfÕ4%R©pÜ»óÅhéYðÝ+ wÀI<!½Åð +žÛ¬ÅÝc`¥’ËbJ€!† Ô +ã$ +ê=‘¢±ZñDŠÚHÊü²;KŠöp2³¡ÌXÆžV™ 9.&bA
1‚2q`¡ÞAÊÃá$èûé»"èµÆÈG]kB.‹I†)P+ÕߺÉÅ‘‚z«o-ü/¹ +äzñÈÅà{OxXJ¨îС:~©Oà45ãÅééºd¬‹ˆ0æ¹f„´3‘ì0$ (7ƒÀ€À\' ´%ÔY0
糪áádÏÑÝÅh¶ü´žN(Þ‰ˆ‰+FbL@aLÿ +$Fê=a¡üò“±°
öß5T¼›/ÚÞÃO“åªæB>WŠ”¹b.€!ÆTƈ~.2q`\ ÞR¦4lh×pñö²ZŒVëEézññm¹ª.š×ÇÕr~µ QÆU æbR#c¥z\gccŠå†˜¼0Á˜¼™80yQïI^áµJuºPÔÏâjr“ †é-ùž÷rTL +øîhÙöÖk‹Ï£iýnÛk|HR1ÀC +x; ìO–ã«ŒÜ?ÿ'S!$}’C +¶),$Ùa| +¥õa öÿU œqendstream endobj -1085 0 obj << +1097 0 obj << /Type /Page -/Contents 1086 0 R -/Resources 1084 0 R +/Contents 1098 0 R +/Resources 1096 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 939 0 R -/Annots [ 1088 0 R 1089 0 R 1090 0 R 1091 0 R 1092 0 R 1093 0 R 1094 0 R 1095 0 R 1096 0 R 1097 0 R 1098 0 R 1099 0 R 1100 0 R 1101 0 R 1102 0 R 1103 0 R 1104 0 R 1105 0 R 1106 0 R 1107 0 R 1108 0 R 1109 0 R 1110 0 R 1111 0 R 1112 0 R 1113 0 R 1114 0 R 1115 0 R 1116 0 R 1117 0 R 1118 0 R 1119 0 R 1120 0 R 1121 0 R 1122 0 R 1123 0 R 1124 0 R 1125 0 R 1126 0 R 1127 0 R 1128 0 R 1129 0 R 1130 0 R 1131 0 R 1132 0 R 1133 0 R 1134 0 R 1135 0 R 1136 0 R 1137 0 R 1138 0 R 1139 0 R 1140 0 R 1141 0 R 1142 0 R 1143 0 R 1144 0 R 1145 0 R 1146 0 R ] +/Parent 951 0 R +/Annots [ 1100 0 R 1101 0 R 1102 0 R 1103 0 R 1104 0 R 1105 0 R 1106 0 R 1107 0 R 1108 0 R 1109 0 R 1110 0 R 1111 0 R 1112 0 R 1113 0 R 1114 0 R 1115 0 R 1116 0 R 1117 0 R 1118 0 R 1119 0 R 1120 0 R 1121 0 R 1122 0 R 1123 0 R 1124 0 R 1125 0 R 1126 0 R 1127 0 R 1128 0 R 1129 0 R 1130 0 R 1131 0 R 1132 0 R 1133 0 R 1134 0 R 1135 0 R 1136 0 R 1137 0 R 1138 0 R 1139 0 R 1140 0 R 1141 0 R 1142 0 R 1143 0 R 1144 0 R 1145 0 R 1146 0 R 1147 0 R 1148 0 R 1149 0 R 1150 0 R 1151 0 R 1152 0 R 1153 0 R 1154 0 R 1155 0 R 1156 0 R 1157 0 R 1158 0 R ] >> endobj -1088 0 obj << +1100 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 758.4766 539.579 767.5824] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.10) >> >> endobj -1089 0 obj << +1101 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 746.5057 539.579 755.6115] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.10.1) >> >> endobj -1090 0 obj << +1102 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 734.5349 539.579 743.6406] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.10.2) >> >> endobj -1091 0 obj << +1103 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 722.564 539.579 731.5203] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.10.3) >> >> endobj -1092 0 obj << +1104 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 710.5931 539.579 719.6988] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.11) >> >> endobj -1093 0 obj << +1105 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 698.6222 539.579 707.5785] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.12) >> >> endobj -1094 0 obj << +1106 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 686.6513 539.579 695.6076] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.13) >> >> endobj -1095 0 obj << +1107 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 674.6804 539.579 683.6367] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.14) >> >> endobj -1096 0 obj << +1108 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 662.7096 539.579 671.6658] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.15) >> >> endobj -1097 0 obj << +1109 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 650.7387 539.579 659.695] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.16) >> >> endobj -1098 0 obj << +1110 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 638.7678 539.579 647.7241] +/Rect [527.6238 638.7678 539.579 647.8735] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.1) >> >> endobj -1099 0 obj << +1111 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 626.7969 539.579 635.7532] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.2) >> >> endobj -1100 0 obj << +1112 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 614.826 539.579 623.7823] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.3) >> >> endobj -1101 0 obj << +1113 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 602.8551 539.579 611.8114] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.4) >> >> endobj -1102 0 obj << +1114 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 590.8843 539.579 599.8405] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.5) >> >> endobj -1103 0 obj << +1115 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 578.9134 539.579 587.8696] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.6) >> >> endobj -1104 0 obj << +1116 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 566.9425 539.579 575.8988] +/Rect [527.6238 567.0421 539.579 576.0482] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.7) >> >> endobj -1105 0 obj << +1117 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 555.0713 539.579 563.9279] +/Rect [527.6238 554.9716 539.579 563.9279] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.8) >> >> endobj -1106 0 obj << +1118 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 543.0007 539.579 551.957] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.9) >> >> endobj -1107 0 obj << +1119 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 531.0298 539.579 539.9861] +/Rect [527.6238 531.1295 539.579 540.1356] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.10) >> >> endobj -1108 0 obj << +1120 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 519.1586 539.579 528.1647] +/Rect [527.6238 519.0589 539.579 528.0152] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.11) >> >> endobj -1109 0 obj << +1121 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 507.0881 539.579 516.0443] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.12) >> >> endobj -1110 0 obj << +1122 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 495.1172 539.579 504.0735] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.13) >> >> endobj -1111 0 obj << +1123 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 483.1463 539.579 492.1026] +/Rect [527.6238 483.2459 539.579 492.1026] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.14) >> >> endobj -1112 0 obj << +1124 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 471.2751 539.579 480.1317] +/Rect [527.6238 471.1754 539.579 480.1317] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.15) >> >> endobj -1113 0 obj << +1125 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 459.2045 539.579 468.1608] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.16) >> >> endobj -1114 0 obj << +1126 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 447.2336 539.579 456.1899] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.17) >> >> endobj -1115 0 obj << +1127 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 435.2628 539.579 444.219] +/Rect [527.6238 435.2628 539.579 444.3685] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.18) >> >> endobj -1116 0 obj << +1128 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 423.2919 539.579 432.3976] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.19) >> >> endobj -1117 0 obj << +1129 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 411.321 539.579 420.2773] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.20) >> >> endobj -1118 0 obj << +1130 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 399.3501 539.579 408.3064] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.17) >> >> endobj -1119 0 obj << +1131 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 387.3792 539.579 396.3355] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.18) >> >> endobj -1120 0 obj << +1132 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 375.4083 539.579 384.3646] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.19) >> >> endobj -1121 0 obj << +1133 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 363.4374 539.579 372.3937] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.20) >> >> endobj -1122 0 obj << +1134 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 351.4666 539.579 360.4228] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.21) >> >> endobj -1123 0 obj << +1135 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 339.4957 539.579 348.452] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.22) >> >> endobj -1124 0 obj << +1136 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 327.5248 539.579 336.4811] +/Rect [527.6238 327.5248 539.579 336.6305] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.23) >> >> endobj -1125 0 obj << +1137 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 315.5539 539.579 324.5102] +/Rect [527.6238 315.5539 539.579 324.6596] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.24) >> >> endobj -1126 0 obj << +1138 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 303.583 539.579 312.6888] +/Rect [527.6238 303.583 539.579 312.5393] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.25) >> >> endobj -1127 0 obj << +1139 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 291.6121 539.579 300.7179] +/Rect [527.6238 291.6121 539.579 300.5684] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.26) >> >> endobj -1128 0 obj << +1140 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 279.6413 539.579 288.5975] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.27) >> >> endobj -1129 0 obj << +1141 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 267.6704 539.579 276.6267] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.28) >> >> endobj -1130 0 obj << +1142 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 255.6995 539.579 264.6558] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.28.1) >> >> endobj -1131 0 obj << +1143 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 243.7286 539.579 252.6849] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.28.2) >> >> endobj -1132 0 obj << +1144 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 231.7577 539.579 240.714] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.28.3) >> >> endobj -1133 0 obj << +1145 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [522.6425 219.7868 539.579 228.8926] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.28.4) >> >> endobj -1134 0 obj << +1146 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [522.6425 207.8159 539.579 216.9217] /Subtype /Link /A << /S /GoTo /D (section.6.3) >> >> endobj -1135 0 obj << +1147 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [522.6425 195.845 539.579 204.9508] /Subtype /Link /A << /S /GoTo /D (subsection.6.3.1) >> >> endobj -1136 0 obj << +1148 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [522.6425 183.8742 539.579 192.9799] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.3.1.1) >> >> endobj -1137 0 obj << +1149 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [522.6425 171.9033 539.579 181.009] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.3.1.2) >> >> endobj -1138 0 obj << +1150 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [522.6425 159.9324 539.579 169.0381] /Subtype /Link /A << /S /GoTo /D (subsection.6.3.2) >> >> endobj -1139 0 obj << +1151 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [522.6425 147.9615 539.579 157.0673] /Subtype /Link /A << /S /GoTo /D (subsection.6.3.3) >> >> endobj -1140 0 obj << +1152 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [522.6425 135.9906 539.579 145.0964] /Subtype /Link /A << /S /GoTo /D (subsection.6.3.4) >> >> endobj -1141 0 obj << +1153 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [522.6425 124.0197 539.579 133.1255] +/Rect [522.6425 124.1194 539.579 133.1255] /Subtype /Link /A << /S /GoTo /D (subsection.6.3.5) >> >> endobj -1142 0 obj << +1154 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [522.6425 112.0489 539.579 121.1546] +/Rect [522.6425 112.1485 539.579 121.1546] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.3.5.1) >> >> endobj -1143 0 obj << +1155 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [522.6425 100.078 539.579 109.1837] +/Rect [522.6425 100.1776 539.579 109.1837] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.3.5.2) >> >> endobj -1144 0 obj << +1156 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [522.6425 88.1071 539.579 97.2128] +/Rect [522.6425 88.2068 539.579 97.2128] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.3.5.3) >> >> endobj -1145 0 obj << +1157 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [522.6425 76.1362 539.579 85.242] +/Rect [522.6425 76.2359 539.579 85.242] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.3.5.4) >> >> endobj -1146 0 obj << +1158 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [522.6425 64.1653 539.579 73.2711] +/Rect [522.6425 64.265 539.579 73.2711] /Subtype /Link /A << /S /GoTo /D (subsection.6.3.6) >> >> endobj -1087 0 obj << -/D [1085 0 R /XYZ 85.0394 794.5015 null] +1099 0 obj << +/D [1097 0 R /XYZ 85.0394 794.5015 null] >> endobj -1084 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F21 938 0 R >> +1096 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F21 950 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1149 0 obj << -/Length 3424 +1161 0 obj << +/Length 3432 /Filter /FlateDecode >> stream -xÚí[sÛ6Çßý)ô¶öÌ -Á• v vl§é¦—´k»³3Ûí-Ñ2'éŠR<ÙO¿ @Gxj$iÇj¦cÙâá9:ÿ q#ÅFÔþc#•‘Ìp3ÒFE™MGt4³ï}}ÄÜ1cÐ uvuôâ•Ð#CLƳÑÕÍH*E¸Úœ,'4ÏÙèjúóñùo®¾zsuyòËÕ7G_]…³BÏŒŠî”¿ ýü Mm -Ò`~ü ;ØÈ`g'2Ƈüàù°|칶 ©ˆÐÆå# vΛŢ+ž]£ù±¿PÛÜ,ºá¼”‡±Mz£òiNnTÀkTPFžH D¨{eÂF¡™g(t_¯þâÌuã¦ï›å[ÛºþÞÿvÛÜ÷/&…ƒíuÿã¿”òÙzž+ÝÍڟᶧ½w}ÈÙ?lEgùŸ@Á à>'É‚CLp˜sTðH ˜à¨ûP5¸íÍ3åç®j¼®'½d]Ÿ>t꺑j?kr[Ô³¾ž_ ¬üî¥7ëÅu·Ø`<¡R0OS2Àƒ - χä`ßm¬)I-‰4y?Ñ}Ú]?µ¶i˜¼›ûy9uõ´[dåæÐ÷Jn:!¹©m"gG<™H :¨{×÷’'’eœŽ Ó5¡¾Êž-«òÆܪ]5K·°ÓÜ<¸¿|sùàjÝ/
e”}9E4$+™`ˆ‘ -¼/"_—u¹ôÝ« òEyã.ÓagÎëúf³a|3i–™/³b ’ás—L0ÄÈ€Ú0>¼ï#FêÞ׈Ír`øñúÇw™kôÓiOCÛ– )zjÿ³?Y·ˆ¯’ÇdH€! Ô …$ ê>”ž¦©§Dôå㬺žWÍlYÜݾ߂.—ëÙ¬lWåÔ—•bjx=3‚óçÑ7™Kæb\@eP."`\ î}ñ`²»ƒJy,|ñ¸(][å{Ýí•ÃoŒX¸¾ªGåâÕyÛó‹çƒOY2ÀãJ‚ò ãuïy œPšmyàîbÒm÷ªýèþ岸é(0† 'AÆg5`ˆ!Uc|xÑ%† êÞ!#rû'.e@FôÈü°ºõ‹_6“5( §×aº· †(ÆŸG #ä*hˆ€°£B,ܽïcI.¹'Aº>ÆÃMˆa˜ò]u½,ü˜õr}w×,-3‡É
¯§Ïh2/Àã*†ò ãuï G¦ˆÎ¨ð¸ø¾G¿"é°¿®«¶êø5;L‹} -"` î=L)8 ¨ž‚ð -8+*'ܬ\u‹ãU}Ót«YýJÖÎ>{D],Êý#VaylÒLèJ¨ß_9ÿÑ’•†˜r0u¨r‘@0åP÷[å¤$FxíS»Ê7wû ·º)¼5h
n
ò®{}××ÂÙ²XœŒõβå§Ú >I²PÀ -fŠ‰ágÅÁ„BÝo…œäJC¡2'Tݺô^{™¦Í¢¨êux:T ž5¹-'oý/Uí›ÖrÑîîd»xuÞ¿TËôû»uò $Y'`ˆéÅÄð–±X ˜N¨{7Úàœ•*é~´±³ì²³UÌ&]SuØhgŧ3™`ˆ±åBY‰‚±²ç>¶Q›™œp.ú%ä³n;‡8þ¾¨×~oá]1CökëÇî׆È~í¨˜~¦ -< ’‹}·±uLÛI$LºÇ8m–¥„9žV³/cÇÓ› -z¤¶<hˆ´¼ ½QÊ"`´¡îmZªŒ§÷´Ý6]÷Rén<n^dÜ€!†œÉṇX n¨û€[ƈÑZ8Ü„+nuÛ–“ñ´½é{o‹·¥í ˆ<?ÐôÁùD'c 1Œ Lb`¡îFÒÜ(‘ÜÁÈÂã9š×åü‰?/øO`Çg7™ `ˆ±Õcrxi,Œ Ô}`Gh’ûÏ6ëf;ìÌÊn߆T‡ëÚ'¢Éç;™&`ˆÑõd2¦)Fê>ÐÄÑÂ=Yãl³¤¶¥© Ú¾kÞvk¯Š ˆúDDùœ' 1¢ ¦L!]¤H Q¨û@$“Æ¥wˆjËժꦲêÓá䞌0Äp‚‚25<¯ à u p¢Œ¨Ì=ÌãŒä»8U³ú›ªK) },H>ÕÉ C $(%SÃst±@0P÷ ¤Ü™+Ï‘é9êæÕ§ãÍ<z¿Ù(Sü +xÚímsÛÆÇßëSð]¥™ê|8\û¢#Éqê4qRI™Î4í ˆ„(ŒI@!HkÜOßqwXŠ‡.vËf<Q"»Üÿï÷M¨ýÇ&*#™áf¢$Š25™.èdnßûúˆ¹cNýA§ð¨ó룯„žb2žM®o'R)ÂÕöd9¡yÎ&׳ŸŽ/¾sý՛뫓ÿ^sôÕu8+ǫ̂èNùóÑOÿ¥“™
à›#J„ÉÕäÁþB 3†O–GR ¢¤þ/‹£«£†‚w·¦ÑOÂ(á"ã‘Â9ø(Ý›ŠM´2$\l?HFÑ'§ŒSz|6›U목‹ÅÉ)WôøUµ(Ý«fµ,ÖíÉi¦³crrªìÑŸôi̇Ÿå‘¶ÒXŒÍ[Hàž«ù¤q ä v§Ðp_žýów1&ö ózÇÁè@ÝkfßÌ,ºR[L(wxH µœ¿~óÒô4\‹uÕ®«©Bqú,€ø¤yòOæ b<AE“ã<EÁxBÝ3náLN´PDfy +‹15NJ$ŒÔýP9#‚JÀJ¨ oŠ¥/ åê]¹Š—‘!Éóç ÷¨Ð>ÉBCLh˜iTèH ˜Ð¨û tf ᜹ÓùßMítþ®¨¬–uQOË_Ûhù©è:&¨ÿÄ©z;DN˜OƲQ5#Q b¢¾-sMìAJ᤼,Ûfñ„¦šgüùêQûl$Ë Ì0•‡L£"ï…€iŒ8 $ÖŠP¥
Y:‘¯šéÛrÝKúúÅ÷¿¤uFåç ²ÏG²ÌÀæ›1=.u$LlÔý wƉ±ƒG ·rr_4Ë{«íMµ¨Öï{q ªõ]à‹WÂìœMihfcèNÓ
'û£v|Úƒ„Ñî˜|ñ©uG‰ð)K&bD@IËljˆ‚±çž÷~v+“”H.ôÖ{7{Di?AÐ æ§ Êéf°¸h궚•«¢›ajÇçOmxZ€Á~ÄûçífÆ·%jÏml.%ã9’e}¢¶×n.ål:-ÛP ëõê„åÇ›uûÖVÊí{ò0£’Þî|Â“Û 0ÄÚ Å(†ê>àÄ2•ñ8qW@!ðܶ_&™« w«¦YGꬄJîŽ*êYäLÌ¡´tÇ\•ëM5‹)·!I_²¿€©ÀM¬×4™X`ˆ ™aœŽ #uï&{l÷Ž0•6LötûÈ)f©Ì…ci: +¯ jîûª~Wõ´^–µízŠL|9Õq+Ÿùd¬€!†TÅ*†êÞa¥ 'Ô¨+î°ú±êy]G ÓɯŽíhM£DÓPÓ^mêi×i±ªè/©õT¤ !‚ÔŽªR±@¤p÷þÚªrJ(Ò1%\WíåûºXVÓž© ïgź|Ü»Õ*;ôÆâÄøœ& 1b f(1‘@0böÜÇFAJÙmƸ «nGA×'Œ±ãU³¹Y”í½~ui4?þ O ì@d°³ãã Èð|X>öÜF[TDhãò;ÍrÙÏ®ÑüÐ_¨mn–Ýp^ÊÃØ&½Qù4'7*`ˆ5*(# +O$ "Ô½¿² a£ÐÌ3:Œ¯×ræºqÓ‹Íêm]í»k úÓÂÁöºÿñ Jù|³Ï•îfãÏpW„Ó>¸>äüo¶¢³ü `TpŸ“dÁ!&8Ì9*x$LpÔ}¨Üöæ™òŠsW5^×Ó^²®O :uÝHµŸ5¹+êùN_ϯV~÷Ò›Íò¦[l°NžQ)…À§)`ˆA +Œá‡ÁÉSñYMFbÈ@Õ˜_t‰‚!ƒºwȈÜþ‰K=2߯ïüÆâ—Ít +ÇÙM˜îí‡!Šñ/£r• +4D@ØÑ!îÞ÷1„Ö$—Ü“ ] ãñ&Ä0Lù¶ºY~Ìzµ¹¿oV‹Œ™Ãä†×Óg4™`ˆñCy‰‚ñ‚º÷…#SDgTx\|ߣ_‘tØŸ7U[u üš ¦Å~@>ÇÉ +"` î=L)8 ¨ž‚ð +L Ì÷ NfºÇÄ ŽØUÇOLخݸFa’k½*궘ú1=ž.ªí=Q†Š?¨aùO˜, 0ÄÔƒD勂釺 TšPÎ €rWÀyQ9áæåº[ ¯êÛ¦[ÍêW²vöÉØ#êbYî ±ËcÓffEWBýöÊù–¬ 0Ä”ƒ©C•‹‚)‡º ”“’aàµOí*·ÙÞí3ÞêfðÖ
¸5È7ºîõ}_ ç«byrªw–-?ÖÖàðI’…†˜P0SLŒ?.,&ê~Jp’+
…ÊœPuëÒ{ãeš5Ë¢ª_ÔáéP-x:Ôô®œ¾õ¿TµoZ«e»»“íòÕEÿBR-ÓïïÕÉd€!¦Lã[Æb`:¡îÝhƒsJ´V:¨¤ûÑÆβËÎV1›tMÕa£iœŸÎdV€!Æ +” e%ÆÊžûØFmfr¹è—Ï»í âø»¢Þø½…÷Å Ù¯ ¬Ÿº_ ûµw¢bbü);ð|H.öÝÆÖ1m'‘0é ãt¾]–æxVÍ? ÏnN(è‘Úò !ÒòvôF)‹‚цº´iI¨2ž6ÞÓv×tÝK¥¸ýþ¸yA’q†nPp&Ç{Ù±@0ÜP÷·Œ£µp¸ WÜê¶-§§ÛîØlûÀ?qÀéC9ò™Næb A%™ ÄÁ8BÝŽ¤!¹Qž#¹ËQc{ø¶ÇÐ-¿›H +’Ou2HÀ JÉäxÏ3ê>€$4Éýí‰çÛU´¤Y{Û'—oK;by~ÀèWcäŒ0Ä0‚B2‰t£"`¡îF\-Ü6η+kF ÏÑ¢¸)Ïüæ +°CX‚j25~W$ +„$Ôwø")M$õ=mFûᙩš×ÿÛ~µƒ”‡Áÿ;HŸéäï fØ7ƒ *25ÞUÚûVÄqxÖ±"~眥‡íÐcÇûÕm·¦”ËìäÇ}qŸõä‡Æ3쑱ƒ¢,ŸˆÜa¤ð¥ˆ§ÜúóèƒsìÿŒ¥ø‡ãðU‘R‘}Á׆pJõ¤û,72Þ!7l¡ÿ ÒŸæ(endstream endobj -1148 0 obj << +1160 0 obj << /Type /Page -/Contents 1149 0 R -/Resources 1147 0 R +/Contents 1161 0 R +/Resources 1159 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 939 0 R -/Annots [ 1151 0 R 1152 0 R 1153 0 R 1154 0 R 1155 0 R 1156 0 R 1157 0 R 1158 0 R 1162 0 R 1163 0 R 1164 0 R 1165 0 R 1166 0 R 1167 0 R 1168 0 R 1169 0 R 1170 0 R 1171 0 R 1172 0 R 1173 0 R 1174 0 R 1175 0 R 1176 0 R 1177 0 R 1178 0 R 1179 0 R 1180 0 R 1181 0 R 1182 0 R 1183 0 R 1184 0 R 1185 0 R 1186 0 R 1187 0 R 1188 0 R 1189 0 R 1190 0 R 1191 0 R 1192 0 R 1193 0 R 1194 0 R 1195 0 R 1196 0 R 1197 0 R 1198 0 R 1199 0 R 1200 0 R 1201 0 R 1202 0 R 1203 0 R 1204 0 R 1205 0 R 1206 0 R 1207 0 R 1208 0 R ] +/Parent 951 0 R +/Annots [ 1163 0 R 1164 0 R 1165 0 R 1166 0 R 1167 0 R 1168 0 R 1169 0 R 1170 0 R 1174 0 R 1175 0 R 1176 0 R 1177 0 R 1178 0 R 1179 0 R 1180 0 R 1181 0 R 1182 0 R 1183 0 R 1184 0 R 1185 0 R 1186 0 R 1187 0 R 1188 0 R 1189 0 R 1190 0 R 1191 0 R 1192 0 R 1193 0 R 1194 0 R 1195 0 R 1196 0 R 1197 0 R 1198 0 R 1199 0 R 1200 0 R 1201 0 R 1202 0 R 1203 0 R 1204 0 R 1205 0 R 1206 0 R 1207 0 R 1208 0 R 1209 0 R 1210 0 R 1211 0 R 1212 0 R 1213 0 R 1214 0 R 1215 0 R 1216 0 R 1217 0 R 1218 0 R 1219 0 R 1220 0 R ] >> endobj -1151 0 obj << +1163 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [494.296 758.5763 511.2325 767.5824] +/Rect [494.296 758.4766 511.2325 767.5824] /Subtype /Link /A << /S /GoTo /D (subsection.6.3.7) >> >> endobj -1152 0 obj << +1164 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 746.4943 511.2325 755.5003] /Subtype /Link /A << /S /GoTo /D (section.6.4) >> >> endobj -1153 0 obj << +1165 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 734.4122 511.2325 743.4183] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.4.0.1) >> >> endobj -1154 0 obj << +1166 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [494.296 722.3302 511.2325 731.3362] +/Rect [494.296 722.2305 511.2325 731.3362] /Subtype /Link /A << /S /GoTo /D (subsection.6.4.1) >> >> endobj -1155 0 obj << +1167 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [494.296 710.2481 511.2325 719.2542] +/Rect [494.296 710.1484 511.2325 719.2542] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.4.1.1) >> >> endobj -1156 0 obj << +1168 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 698.0664 511.2325 707.1721] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.4.1.2) >> >> endobj -1157 0 obj << +1169 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [494.296 686.084 511.2325 695.0901] +/Rect [494.296 685.9843 511.2325 695.0901] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.4.1.3) >> >> endobj -1158 0 obj << +1170 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [494.296 673.9023 511.2325 683.008] +/Rect [494.296 674.002 511.2325 683.008] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.4.1.4) >> >> endobj -1162 0 obj << +1174 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 661.8203 511.2325 670.926] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.4.1.5) >> >> endobj -1163 0 obj << +1175 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [494.296 639.3926 511.2325 648.1048] +/Rect [494.296 639.2482 511.2325 648.1048] /Subtype /Link /A << /S /GoTo /D (chapter.7) >> >> endobj -1164 0 obj << +1176 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [494.296 627.2856 511.2325 636.2917] +/Rect [494.296 627.186 511.2325 636.2917] /Subtype /Link /A << /S /GoTo /D (section.7.1) >> >> endobj -1165 0 obj << +1177 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 615.1039 511.2325 624.2097] /Subtype /Link /A << /S /GoTo /D (section.7.2) >> >> endobj -1166 0 obj << +1178 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 603.0219 511.2325 612.1276] /Subtype /Link /A << /S /GoTo /D (subsection.7.2.1) >> >> endobj -1167 0 obj << +1179 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 590.9398 511.2325 600.0456] /Subtype /Link /A << /S /GoTo /D (subsection.7.2.2) >> >> endobj -1168 0 obj << +1180 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 578.8578 511.2325 587.9635] /Subtype /Link /A << /S /GoTo /D (section.7.3) >> >> endobj -1169 0 obj << +1181 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [494.296 556.4302 511.2325 565.1423] +/Rect [494.296 556.2857 511.2325 565.1423] /Subtype /Link /A << /S /GoTo /D (chapter.8) >> >> endobj -1170 0 obj << +1182 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [494.296 544.3232 511.2325 553.3293] +/Rect [494.296 544.2235 511.2325 553.3293] /Subtype /Link /A << /S /GoTo /D (section.8.1) >> >> endobj -1171 0 obj << +1183 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [494.296 532.2411 511.2325 541.2472] +/Rect [494.296 532.1415 511.2325 541.2472] /Subtype /Link /A << /S /GoTo /D (subsection.8.1.1) >> >> endobj -1172 0 obj << +1184 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [494.296 520.1591 511.2325 529.1652] +/Rect [494.296 520.0594 511.2325 529.1652] /Subtype /Link /A << /S /GoTo /D (section.8.2) >> >> endobj -1173 0 obj << +1185 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [494.296 508.077 511.2325 517.0831] +/Rect [494.296 507.9774 511.2325 517.0831] /Subtype /Link /A << /S /GoTo /D (section.8.3) >> >> endobj -1174 0 obj << +1186 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 485.4053 511.2325 494.2619] /Subtype /Link /A << /S /GoTo /D (appendix.A) >> >> endobj -1175 0 obj << +1187 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 473.3431 511.2325 482.4488] /Subtype /Link /A << /S /GoTo /D (section.A.1) >> >> endobj -1176 0 obj << +1188 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 461.2611 511.2325 470.3668] /Subtype /Link /A << /S /GoTo /D (subsection.A.1.1) >> >> endobj -1177 0 obj << +1189 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [494.296 449.2787 511.2325 458.2847] +/Rect [494.296 449.179 511.2325 458.2847] /Subtype /Link /A << /S /GoTo /D (section.A.2) >> >> endobj -1178 0 obj << +1190 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [494.296 437.1966 511.2325 446.2027] +/Rect [494.296 437.097 511.2325 446.2027] /Subtype /Link /A << /S /GoTo /D (subsection.A.2.1) >> >> endobj -1179 0 obj << +1191 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [494.296 425.1146 511.2325 434.1207] +/Rect [494.296 425.0149 511.2325 434.1207] /Subtype /Link /A << /S /GoTo /D (section.A.3) >> >> endobj -1180 0 obj << +1192 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [494.296 413.0325 511.2325 422.0386] +/Rect [494.296 412.9329 511.2325 422.0386] /Subtype /Link /A << /S /GoTo /D (subsection.A.3.1) >> >> endobj -1181 0 obj << +1193 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 400.8508 511.2325 409.9566] /Subtype /Link /A << /S /GoTo /D (subsection.A.3.2) >> >> endobj -1182 0 obj << +1194 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 388.7688 511.2325 397.8745] /Subtype /Link /A << /S /GoTo /D (subsection.A.3.3) >> >> endobj -1183 0 obj << +1195 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 376.6867 511.2325 385.7925] /Subtype /Link /A << /S /GoTo /D (section.A.4) >> >> endobj -1184 0 obj << +1196 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 364.6047 511.2325 373.7104] /Subtype /Link /A << /S /GoTo /D (subsection.A.4.1) >> >> endobj -1185 0 obj << +1197 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 352.5226 511.2325 361.6284] /Subtype /Link /A << /S /GoTo /D (subsection.A.4.2) >> >> endobj -1186 0 obj << +1198 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 340.4406 511.2325 349.5463] /Subtype /Link /A << /S /GoTo /D (subsection.A.4.3) >> >> endobj -1187 0 obj << +1199 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 328.3585 511.2325 337.4643] /Subtype /Link /A << /S /GoTo /D (subsection.A.4.4) >> >> endobj -1188 0 obj << +1200 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 316.2765 511.2325 325.3822] /Subtype /Link /A << /S /GoTo /D (subsection.A.4.5) >> >> endobj -1189 0 obj << +1201 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 304.1944 511.2325 313.3002] /Subtype /Link /A << /S /GoTo /D (subsection.A.4.6) >> >> endobj -1190 0 obj << +1202 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 292.1124 511.2325 301.2181] /Subtype /Link /A << /S /GoTo /D (subsubsection.A.4.6.1) >> >> endobj -1191 0 obj << +1203 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 280.0303 511.2325 289.1361] /Subtype /Link /A << /S /GoTo /D (subsubsection.A.4.6.2) >> >> endobj -1192 0 obj << +1204 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 267.9483 511.2325 277.054] /Subtype /Link /A << /S /GoTo /D (subsubsection.A.4.6.3) >> >> endobj -1193 0 obj << +1205 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 255.8662 511.2325 264.972] /Subtype /Link /A << /S /GoTo /D (subsubsection.A.4.6.4) >> >> endobj -1194 0 obj << +1206 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 243.7842 511.2325 252.8899] /Subtype /Link /A << /S /GoTo /D (subsubsection.A.4.6.5) >> >> endobj -1195 0 obj << +1207 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 231.7021 511.2325 240.8079] /Subtype /Link /A << /S /GoTo /D (subsubsection.A.4.6.6) >> >> endobj -1196 0 obj << +1208 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 219.6201 511.2325 228.7258] /Subtype /Link /A << /S /GoTo /D (subsection.A.4.7) >> >> endobj -1197 0 obj << +1209 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 197.048 511.2325 205.9046] /Subtype /Link /A << /S /GoTo /D (appendix.B) >> >> endobj -1198 0 obj << +1210 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 184.9858 511.2325 194.0916] /Subtype /Link /A << /S /GoTo /D (section.B.1) >> >> endobj -1199 0 obj << +1211 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 172.9038 511.2325 182.0095] /Subtype /Link /A << /S /GoTo /D (section.B.2) >> >> endobj -1200 0 obj << +1212 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 160.9214 511.2325 169.9275] /Subtype /Link /A << /S /GoTo /D (section.B.3) >> >> endobj -1201 0 obj << +1213 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [494.296 148.8393 511.2325 157.8454] +/Rect [494.296 148.7397 511.2325 157.8454] /Subtype /Link /A << /S /GoTo /D (section.B.4) >> >> endobj -1202 0 obj << +1214 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [494.296 136.6576 511.2325 145.7634] +/Rect [494.296 136.7573 511.2325 145.7634] /Subtype /Link /A << /S /GoTo /D (section.B.5) >> >> endobj -1203 0 obj << +1215 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 124.5756 511.2325 133.6813] /Subtype /Link /A << /S /GoTo /D (section.B.6) >> >> endobj -1204 0 obj << +1216 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 112.4935 511.2325 121.5993] /Subtype /Link /A << /S /GoTo /D (section.B.7) >> >> endobj -1205 0 obj << +1217 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 100.4115 511.2325 109.5172] /Subtype /Link /A << /S /GoTo /D (section.B.8) >> >> endobj -1206 0 obj << +1218 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 88.3294 511.2325 97.4352] /Subtype /Link /A << /S /GoTo /D (section.B.9) >> >> endobj -1207 0 obj << +1219 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 76.2474 511.2325 85.3531] /Subtype /Link /A << /S /GoTo /D (section.B.10) >> >> endobj -1208 0 obj << +1220 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [494.296 64.1653 511.2325 73.2711] /Subtype /Link /A << /S /GoTo /D (section.B.11) >> >> endobj -1150 0 obj << -/D [1148 0 R /XYZ 56.6929 794.5015 null] +1162 0 obj << +/D [1160 0 R /XYZ 56.6929 794.5015 null] >> endobj -1147 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F39 1161 0 R /F21 938 0 R >> +1159 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F39 1173 0 R /F21 950 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1211 0 obj << -/Length 764 +1223 0 obj << +/Length 898 /Filter /FlateDecode >> stream -xÚíÙÍOÛ0 -Áø é ¡‰Ò< ¾å³Þ,ëêyæ6G‹æè®Þâå0˜WˆñŠ JöóJ‚ñBÓ^\ÍÀz^¢ãµjê©;ó¿Ó:´·¼ùŽ öbÞ⎃²ýÞ…`ÞÐôÁ›+C+e¼·î§¢±Œ ¢MÑj)’颹ëF¾šUA;™ÞŽ Ô¡ïÔ`‡Q æ0– -|<Ç •ßöÁ¨¢@ UÜVЬ U¢ šÞ£RîÀH%<*Ý¡ªëf½Ce” 5 FSØï¡šâ@DÓ«~‚î¿òO‚hÂÓMFK!Ü8šNSµZVíÍã¤`j¼;æ'`hÀ`^Q Æ+n0èþ+ÿT!/4}à¥%±B…KÛñrç¨UÕÔ‹yûñ§F_Gå·~0¬(ƒ·´ê‡•(ƒ…¦°'ÖRKÉhëq=- æÕ´øN)û³Y:_FQå÷|°¨(÷•(…¦¢$#”KÓÈÀ?›MùCµ~˜–óñTuX~ëÊ1XqkAë~X‰Bö`…ç÷…Euq‰GøÞÿ…Áîk
¡ 7†¥—Ë©q̕ι$í\íbõ.u;(ªü/Ðiì—endstream +xÚíÙÍRÛ0 +“8!Й8hýTF9¦¥ë39a E)ÝQ]Í&ãb4Œ¾ŽæõÍ ÐJ ±A¡8›Jçž?Ë +¤xáƒv^‰B(^dúÀKû«tx™
¯e= ù#°ÿ;׿Ǝtõ† oO:¦ý+UáN ½Yà ‡¸í³Múã³ÐX!˜ƒ²IÑ j(²õ^p=òɬš+¨ÙŽì ÔaèTg‡(rˆ%€Ñí…PÉôÑ¡QÌ•:î ÝîºW4Øn'õ ûkÜaQ…eïŒ +R¨p[Á¸vT‰B(TdúˆJKæ »IÁ7¨ÆãzµCeµé5 HSXïΚP ¥ ÷lû“ªJ™>jR‚q©ÂÆQÀFSµ\TÍæqPÝ?‰½è 04 3/HñÂ
ÛþäŸ*„âE¦¼Jθåac)¶ ÀûkÔ²ªÇóYsûÓ½¯–¾3,HÁÂ+Úa% +¡`‘é#,a¶”bû±üÝjTLgÕ¨ø̹øù¸ð¾ ô¢$*¬ygQ(…{ +V¶‹JB‰"ÓGQ 6"|J¿šŒä´ZM…“²¿T½¬°ôa¡@ +n- +QÈ ¬øEu¡,gF‘ú®ÚÿsJÁó¿ß}_&éÓ•Üú>mr©˜Ÿk³=ùÞz®aªý7B¬endstream endobj -1210 0 obj << +1222 0 obj << /Type /Page -/Contents 1211 0 R -/Resources 1209 0 R +/Contents 1223 0 R +/Resources 1221 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1226 0 R -/Annots [ 1213 0 R 1214 0 R 1215 0 R 1219 0 R 1220 0 R 1221 0 R 1222 0 R 1223 0 R 1224 0 R 1225 0 R ] +/Parent 1241 0 R +/Annots [ 1225 0 R 1226 0 R 1227 0 R 1228 0 R 1229 0 R 1230 0 R 1234 0 R 1235 0 R 1236 0 R 1237 0 R 1238 0 R 1239 0 R 1240 0 R ] >> endobj -1213 0 obj << +1225 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [522.6425 758.4766 539.579 767.5824] /Subtype /Link /A << /S /GoTo /D (section.B.12) >> >> endobj -1214 0 obj << +1226 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [522.6425 746.5215 539.579 755.6272] /Subtype /Link /A << /S /GoTo /D (section.B.13) >> >> endobj -1215 0 obj << +1227 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [522.6425 734.5663 539.579 743.672] /Subtype /Link /A << /S /GoTo /D (section.B.14) >> >> endobj -1219 0 obj << +1228 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [522.6425 722.6111 539.579 731.7169] /Subtype /Link /A << /S /GoTo /D (section.B.15) >> >> endobj -1220 0 obj << +1229 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [522.6425 710.7556 539.579 719.7617] /Subtype /Link /A << /S /GoTo /D (section.B.16) >> >> endobj -1221 0 obj << +1230 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [522.6425 698.8005 539.579 707.8065] +/Rect [522.6425 698.7008 539.579 707.8065] /Subtype /Link /A << /S /GoTo /D (section.B.17) >> >> endobj -1222 0 obj << +1234 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [522.6425 686.7456 539.579 695.8514] /Subtype /Link /A << /S /GoTo /D (section.B.18) >> >> endobj -1223 0 obj << +1235 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [522.6425 674.7905 539.579 683.8962] /Subtype /Link /A << /S /GoTo /D (section.B.19) >> >> endobj -1224 0 obj << +1236 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [522.6425 662.8353 539.579 671.941] /Subtype /Link /A << /S /GoTo /D (section.B.20) >> >> endobj -1225 0 obj << +1237 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [522.6425 650.9798 539.579 659.9859] +/Rect [522.6425 650.8801 539.579 659.9859] /Subtype /Link /A << /S /GoTo /D (section.B.21) >> >> endobj -1212 0 obj << -/D [1210 0 R /XYZ 85.0394 794.5015 null] +1238 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [522.6425 638.925 539.579 648.0307] +/Subtype /Link +/A << /S /GoTo /D (section.B.22) >> >> endobj -1209 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F41 1218 0 R >> +1239 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [522.6425 626.9698 539.579 636.0755] +/Subtype /Link +/A << /S /GoTo /D (section.B.23) >> +>> endobj +1240 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [522.6425 615.0146 539.579 624.1204] +/Subtype /Link +/A << /S /GoTo /D (section.B.24) >> +>> endobj +1224 0 obj << +/D [1222 0 R /XYZ 85.0394 794.5015 null] +>> endobj +1221 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1229 0 obj << +1244 0 obj << /Length 2174 /Filter /FlateDecode >> @@ -4285,56 +4337,55 @@ xÚÝYÝoã6÷_áGXëø%‘ìãî¶ÅÅ î’¢½>(c kK®>’ºý
9C[ŠåÍö6ÀE€ˆ¤†äpæ7¿Ê|Éà/M–2iÕR ìn+×í
7Éz[‹ Žî‹º3k•¼iP ÿ¦½1É°ó›ûE†Î•8þдØ(ÝÎmŠ¾ª7´ÏÐo›¶êAÍ#Ž4ŽdÃáh‡¢¦•h+F žœˆ‡UûÃÎíÁEðëJ€¢ý¶ðîÒYR¬û¡ØíŽ8¾/ ¶¢)A$Ø †F~öË2XÂuëRPÂȼŠ¢eÑ(Vuqå 4¨joßñË`wÖj†Ž‚÷f|SHÚê~èÃ"Ùœ?ü¨ßü¾ZEÌs•J• B±b©È%bž§ -<ð|߬o¹ù`&͵KÞºö85ØÓNBƒÅp€ñs°o?||Oñ -½¢|, äÊ“d?|˔ȆzR笸µÀù³`™P¯7¢ -
•"$D‡N=¥JsN¶ä ±ú%=%h Óqžr™r£Í…¡`Z6 FØ|†Œ‰ °'XIvÕfÛ?9ÿŸh‚å)ãz–&ºf÷ˆå¨j©©6ÉlpQô°Æzîyî/L\ &äóŠq %I{I0TÐÖÁ²¾œõ€u‰ -ý“NWA÷yŒ)
ÄgM>)¬º¿¬Ú”TmBqþèÙ·©©´ü©‹×»ªþʲ3”Ñqî¹ì Ý'Šuð÷³‚1H\Â’«øPèx@¯à '`'ªÿ×jñíÝéûÍ¡¤ðÌ@Ý(…ÿxóÛâ—_Ù²\°å –Jk²åtX*ÅýBIh²ÌÄ‘Ýâvñ¯ÿqVÔcT(\Õ -Í·Í®¼¥WSýo
%«Sf¹} I ®i¶8ÙðeId£¡ÿ ˆF[¼†žk}…‚ÆZ_@èp^MÝ¿ -nܱ™æP;ƒa¤jüÛßÅo€"P°¿½‚úƘ٠-ãïp[Kýω³è‘R0µ$¡P‡_˜=þäx^)îö_ó ]endstream +<ð|߬o¹ù`&͵KÞºö85ØÓNBƒÅp€ñs°o?||Oñ +FŠüäuܹê;´¡’<ÕY®§6<ÁG‰ÐB +žD8^øú &®*‚îóSˆÏš|SXuYµ)©Ú„âüѳoSSiùS¯wUý•eg(£ãÜsÙºOëàïg7b¸„%Wð¡Ðñ€^Á;NÀNTÿ¯ÕâÛ»Ó÷›C HᙺQ +ÿñæ·Å/¿²e¹`Ë ,•ÖdË'è0°&TŠû…’Ðd™‰#»Åíâ_ÿ㬨ǨP¸ªÎc°5#º§Kâ™V܇3üôEjŠfø +–Q£¢+O(Ÿèº³ß…Ù¤ +µ¾€Ð5༚ºÜ¸c3Í¡vÃH-Ôø·¿‹ß endobj -1228 0 obj << +1243 0 obj << /Type /Page -/Contents 1229 0 R -/Resources 1227 0 R +/Contents 1244 0 R +/Resources 1242 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1226 0 R +/Parent 1241 0 R >> endobj 6 0 obj << -/D [1228 0 R /XYZ 85.0394 769.5949 null] +/D [1243 0 R /XYZ 85.0394 769.5949 null] >> endobj -1230 0 obj << -/D [1228 0 R /XYZ 85.0394 582.8476 null] +1245 0 obj << +/D [1243 0 R /XYZ 85.0394 582.8476 null] >> endobj 10 0 obj << -/D [1228 0 R /XYZ 85.0394 512.9824 null] +/D [1243 0 R /XYZ 85.0394 512.9824 null] >> endobj -1231 0 obj << -/D [1228 0 R /XYZ 85.0394 474.7837 null] +1246 0 obj << +/D [1243 0 R /XYZ 85.0394 474.7837 null] >> endobj 14 0 obj << -/D [1228 0 R /XYZ 85.0394 399.5462 null] +/D [1243 0 R /XYZ 85.0394 399.5462 null] >> endobj -1232 0 obj << -/D [1228 0 R /XYZ 85.0394 363.8828 null] +1247 0 obj << +/D [1243 0 R /XYZ 85.0394 363.8828 null] >> endobj 18 0 obj << -/D [1228 0 R /XYZ 85.0394 223.0066 null] +/D [1243 0 R /XYZ 85.0394 223.0066 null] >> endobj -1233 0 obj << -/D [1228 0 R /XYZ 85.0394 190.9009 null] +1248 0 obj << +/D [1243 0 R /XYZ 85.0394 190.9009 null] >> endobj -1234 0 obj << -/D [1228 0 R /XYZ 85.0394 170.4169 null] +1249 0 obj << +/D [1243 0 R /XYZ 85.0394 170.4169 null] >> endobj -1235 0 obj << -/D [1228 0 R /XYZ 85.0394 158.4617 null] +1250 0 obj << +/D [1243 0 R /XYZ 85.0394 158.4617 null] >> endobj -1227 0 obj << -/Font << /F21 938 0 R /F22 961 0 R /F39 1161 0 R /F41 1218 0 R /F48 1238 0 R >> +1242 0 obj << +/Font << /F21 950 0 R /F22 973 0 R /F39 1173 0 R /F41 1233 0 R /F48 1253 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1241 0 obj << +1256 0 obj << /Length 3187 /Filter /FlateDecode >> @@ -4352,63 +4403,63 @@ H•²/hÊ ®£fw"®höx׺©;°Çn|>”°ÃÓ¶PˇýjÎÖzýÁ”rþ!È £+Œ$üE™ Bö‘Q™… Ê"ôãÇœ/Áò±r=?5M[ô°ÌÏ[€Ì°u¸Âz
ÆmÜo<)¶ó=P¿+{’‘OíRzwdîØPÖ6ôV`0ÐhõðlÓã>§¦|êv=£lÁá“xý1‡š[ÚÍ„C9ßšÞ4â¦Å7ɵkù ’ß ÿe¬ˆ¦¯¸Çÿ¤ùâãý×þ{Ôñ¿Ä T0iª_ð‡)¶ˆÌ€ @Ÿ! þê ó4Ï©Êendstream endobj -1240 0 obj << +1255 0 obj << /Type /Page -/Contents 1241 0 R -/Resources 1239 0 R +/Contents 1256 0 R +/Resources 1254 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1226 0 R -/Annots [ 1247 0 R 1248 0 R ] +/Parent 1241 0 R +/Annots [ 1262 0 R 1263 0 R ] >> endobj -1247 0 obj << +1262 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [272.8897 207.1951 329.1084 219.2548] /Subtype /Link /A << /S /GoTo /D (types_of_resource_records_and_when_to_use_them) >> >> endobj -1248 0 obj << +1263 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [190.6691 179.6723 249.6573 189.0819] /Subtype /Link /A << /S /GoTo /D (rfcs) >> >> endobj -1242 0 obj << -/D [1240 0 R /XYZ 56.6929 756.8229 null] +1257 0 obj << +/D [1255 0 R /XYZ 56.6929 756.8229 null] >> endobj -1243 0 obj << -/D [1240 0 R /XYZ 56.6929 744.8677 null] +1258 0 obj << +/D [1255 0 R /XYZ 56.6929 744.8677 null] >> endobj 22 0 obj << -/D [1240 0 R /XYZ 56.6929 651.295 null] +/D [1255 0 R /XYZ 56.6929 651.295 null] >> endobj -1244 0 obj << -/D [1240 0 R /XYZ 56.6929 612.4036 null] +1259 0 obj << +/D [1255 0 R /XYZ 56.6929 612.4036 null] >> endobj 26 0 obj << -/D [1240 0 R /XYZ 56.6929 555.4285 null] +/D [1255 0 R /XYZ 56.6929 555.4285 null] >> endobj -1245 0 obj << -/D [1240 0 R /XYZ 56.6929 530.6703 null] +1260 0 obj << +/D [1255 0 R /XYZ 56.6929 530.6703 null] >> endobj 30 0 obj << -/D [1240 0 R /XYZ 56.6929 416.0112 null] +/D [1255 0 R /XYZ 56.6929 416.0112 null] >> endobj -1246 0 obj << -/D [1240 0 R /XYZ 56.6929 391.253 null] +1261 0 obj << +/D [1255 0 R /XYZ 56.6929 391.253 null] >> endobj 34 0 obj << -/D [1240 0 R /XYZ 56.6929 164.815 null] +/D [1255 0 R /XYZ 56.6929 164.815 null] >> endobj -1249 0 obj << -/D [1240 0 R /XYZ 56.6929 137.4068 null] +1264 0 obj << +/D [1255 0 R /XYZ 56.6929 137.4068 null] >> endobj -1239 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F39 1161 0 R /F41 1218 0 R /F21 938 0 R >> +1254 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F39 1173 0 R /F41 1233 0 R /F21 950 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1254 0 obj << +1269 0 obj << /Length 3415 /Filter /FlateDecode >> @@ -4428,60 +4479,60 @@ txÕÁ(1Âùãqt 0úØÇ‘C×µLm›§:ÂÄ$è’y¦ ·o¾Àbº¦úž&\Õ=¯d‚Ó÷aŠKѨðÀæ@pð –þvA•c«ÇøÀ†û,¤ÆAg€hCõoœ€}¼ew8ýš*çÐð‡#çô/œÿn1]/‚0Pé ú\í8 °ef´>+sŒBOD‡+^ .ùRéØ{ endobj -1253 0 obj << +1268 0 obj << /Type /Page -/Contents 1254 0 R -/Resources 1252 0 R +/Contents 1269 0 R +/Resources 1267 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1226 0 R -/Annots [ 1257 0 R 1258 0 R ] +/Parent 1241 0 R +/Annots [ 1272 0 R 1273 0 R ] >> endobj -1257 0 obj << +1272 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [519.8432 463.1122 539.579 475.1718] /Subtype /Link /A << /S /GoTo /D (diagnostic_tools) >> >> endobj -1258 0 obj << +1273 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [84.0431 451.8246 133.308 463.2167] /Subtype /Link /A << /S /GoTo /D (diagnostic_tools) >> >> endobj -1255 0 obj << -/D [1253 0 R /XYZ 85.0394 794.5015 null] +1270 0 obj << +/D [1268 0 R /XYZ 85.0394 794.5015 null] >> endobj 38 0 obj << -/D [1253 0 R /XYZ 85.0394 570.5252 null] +/D [1268 0 R /XYZ 85.0394 570.5252 null] >> endobj -1256 0 obj << -/D [1253 0 R /XYZ 85.0394 541.3751 null] +1271 0 obj << +/D [1268 0 R /XYZ 85.0394 541.3751 null] >> endobj 42 0 obj << -/D [1253 0 R /XYZ 85.0394 434.1868 null] +/D [1268 0 R /XYZ 85.0394 434.1868 null] >> endobj -1259 0 obj << -/D [1253 0 R /XYZ 85.0394 406.5769 null] +1274 0 obj << +/D [1268 0 R /XYZ 85.0394 406.5769 null] >> endobj 46 0 obj << -/D [1253 0 R /XYZ 85.0394 301.1559 null] +/D [1268 0 R /XYZ 85.0394 301.1559 null] >> endobj -1260 0 obj << -/D [1253 0 R /XYZ 85.0394 276.6843 null] +1275 0 obj << +/D [1268 0 R /XYZ 85.0394 276.6843 null] >> endobj 50 0 obj << -/D [1253 0 R /XYZ 85.0394 200.1512 null] +/D [1268 0 R /XYZ 85.0394 200.1512 null] >> endobj -1261 0 obj << -/D [1253 0 R /XYZ 85.0394 175.6796 null] +1276 0 obj << +/D [1268 0 R /XYZ 85.0394 175.6796 null] >> endobj -1252 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F39 1161 0 R /F41 1218 0 R /F21 938 0 R >> +1267 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F39 1173 0 R /F41 1233 0 R /F21 950 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1265 0 obj << +1280 0 obj << /Length 2457 /Filter /FlateDecode >> @@ -4500,39 +4551,39 @@ S¦…€Äüœºã2±öŠ
41ÑÍ–,÷úBäí]¨u›«˜úDOâ‚ÙLë–3žatÙ±º÷5vxnïH‘š ªmÝóìAߌå M ZãŠÜƒ[æž.ÇñS!L%:P–ô˜¥Hé!”·i"®"!Gš¼ü…3Ãø(M¶æÒ?/ÕºðõwÕNïÉzê-çÕÃÿ@úÂ?Dþ ÇD÷ÿï2ýý¥Ê2¹ü—ŠÌ OÕÈŠ%ºaÜÿ?sËùy;:»endstream endobj -1264 0 obj << +1279 0 obj << /Type /Page -/Contents 1265 0 R -/Resources 1263 0 R +/Contents 1280 0 R +/Resources 1278 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1226 0 R +/Parent 1241 0 R >> endobj -1266 0 obj << -/D [1264 0 R /XYZ 56.6929 794.5015 null] +1281 0 obj << +/D [1279 0 R /XYZ 56.6929 794.5015 null] >> endobj 54 0 obj << -/D [1264 0 R /XYZ 56.6929 717.7272 null] +/D [1279 0 R /XYZ 56.6929 717.7272 null] >> endobj -1267 0 obj << -/D [1264 0 R /XYZ 56.6929 690.4227 null] +1282 0 obj << +/D [1279 0 R /XYZ 56.6929 690.4227 null] >> endobj 58 0 obj << -/D [1264 0 R /XYZ 56.6929 550.0786 null] +/D [1279 0 R /XYZ 56.6929 550.0786 null] >> endobj -1268 0 obj << -/D [1264 0 R /XYZ 56.6929 525.2967 null] +1283 0 obj << +/D [1279 0 R /XYZ 56.6929 525.2967 null] >> endobj 62 0 obj << -/D [1264 0 R /XYZ 56.6929 393.0502 null] +/D [1279 0 R /XYZ 56.6929 393.0502 null] >> endobj -1269 0 obj << -/D [1264 0 R /XYZ 56.6929 363.1913 null] +1284 0 obj << +/D [1279 0 R /XYZ 56.6929 363.1913 null] >> endobj -1263 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F21 938 0 R /F39 1161 0 R >> +1278 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F21 950 0 R /F39 1173 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1272 0 obj << +1287 0 obj << /Length 2097 /Filter /FlateDecode >> @@ -4548,66 +4599,66 @@ hZã|jY/ýE‰áÝN6“dy 8xp]7b~{é0h”~’e±½„3×rÓ,Ã,*r¸2Ư{ë³½ŸØøÎê±×꛼cµ¬Ë" Ìk âþî^̲EÑÅk˜èP <sgÕ1B ÚÖP!žÅj˜K±dx ’;mêá6¨BÐ ¾I½Ÿp endobj -1271 0 obj << +1286 0 obj << /Type /Page -/Contents 1272 0 R -/Resources 1270 0 R +/Contents 1287 0 R +/Resources 1285 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1226 0 R -/Annots [ 1278 0 R 1279 0 R ] +/Parent 1241 0 R +/Annots [ 1293 0 R 1294 0 R ] >> endobj -1278 0 obj << +1293 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [519.8432 268.1131 539.579 280.1727] /Subtype /Link /A << /S /GoTo /D (acache) >> >> endobj -1279 0 obj << +1294 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [84.0431 256.1579 143.5361 268.2175] /Subtype /Link /A << /S /GoTo /D (acache) >> >> endobj -1273 0 obj << -/D [1271 0 R /XYZ 85.0394 794.5015 null] +1288 0 obj << +/D [1286 0 R /XYZ 85.0394 794.5015 null] >> endobj 66 0 obj << -/D [1271 0 R /XYZ 85.0394 769.5949 null] +/D [1286 0 R /XYZ 85.0394 769.5949 null] >> endobj -1274 0 obj << -/D [1271 0 R /XYZ 85.0394 574.3444 null] +1289 0 obj << +/D [1286 0 R /XYZ 85.0394 574.3444 null] >> endobj 70 0 obj << -/D [1271 0 R /XYZ 85.0394 574.3444 null] +/D [1286 0 R /XYZ 85.0394 574.3444 null] >> endobj -1275 0 obj << -/D [1271 0 R /XYZ 85.0394 540.5052 null] +1290 0 obj << +/D [1286 0 R /XYZ 85.0394 540.5052 null] >> endobj 74 0 obj << -/D [1271 0 R /XYZ 85.0394 447.7637 null] +/D [1286 0 R /XYZ 85.0394 447.7637 null] >> endobj -1276 0 obj << -/D [1271 0 R /XYZ 85.0394 410.3389 null] +1291 0 obj << +/D [1286 0 R /XYZ 85.0394 410.3389 null] >> endobj 78 0 obj << -/D [1271 0 R /XYZ 85.0394 348.7624 null] +/D [1286 0 R /XYZ 85.0394 348.7624 null] >> endobj -1277 0 obj << -/D [1271 0 R /XYZ 85.0394 311.223 null] +1292 0 obj << +/D [1286 0 R /XYZ 85.0394 311.223 null] >> endobj 82 0 obj << -/D [1271 0 R /XYZ 85.0394 189.9853 null] +/D [1286 0 R /XYZ 85.0394 189.9853 null] >> endobj -1280 0 obj << -/D [1271 0 R /XYZ 85.0394 156.0037 null] +1295 0 obj << +/D [1286 0 R /XYZ 85.0394 156.0037 null] >> endobj -1270 0 obj << -/Font << /F21 938 0 R /F22 961 0 R >> +1285 0 obj << +/Font << /F21 950 0 R /F22 973 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1284 0 obj << +1299 0 obj << /Length 591 /Filter /FlateDecode >> @@ -4615,27 +4666,27 @@ stream xÚ¥TKs›0¾ó+t3AÕtt’:3N ƒû˜4Ç()SŒ\ÀIóï+!°Iâž: ³«}|ì~Ú… ÕºÕõ«3uEó»$hô®ËZ«¤iëâa׺BÿÚ*Æ‘]…#;`ÞþÒþ{ã¿¡0FLzX¦ñÐS‘ŒÙ¾(Klô¡ða3?VþP%6 endstream endobj -1283 0 obj << +1298 0 obj << /Type /Page -/Contents 1284 0 R -/Resources 1282 0 R +/Contents 1299 0 R +/Resources 1297 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1287 0 R +/Parent 1302 0 R >> endobj -1285 0 obj << -/D [1283 0 R /XYZ 56.6929 794.5015 null] +1300 0 obj << +/D [1298 0 R /XYZ 56.6929 794.5015 null] >> endobj 86 0 obj << -/D [1283 0 R /XYZ 56.6929 769.5949 null] +/D [1298 0 R /XYZ 56.6929 769.5949 null] >> endobj -1286 0 obj << -/D [1283 0 R /XYZ 56.6929 744.7247 null] +1301 0 obj << +/D [1298 0 R /XYZ 56.6929 744.7247 null] >> endobj -1282 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R >> +1297 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1290 0 obj << +1305 0 obj << /Length 1159 /Filter /FlateDecode >> @@ -4648,45 +4699,45 @@ JxI1|«ÄR{}Ö8!S8 ÆM§,ývrö‹çf¨qdü)G%§ÀÚÉ®×r›6H–¬Ú‹½‹…¿ðÃJNXV„ÐO^nóëÅ¿_æ’£ Ó–ÿ¼\g¥» ÜE ¾qÂôrœº=ȘZ\
ö\FØÿxd²ó‘ód¦·$4%9‡‹{¦úÃ9šfؼ!¼‚¦ÿH ËI)xáõ8kØ;ߥo…<©»çÃ¥ÛŽ›>L/‰ÁÌ ²”Š,`îö$àžÇV”ðl×ØæÚ,˜Lá5]Ö·[öhLs&¾Ñ¡0ÌC/—U5U}hõö5¡æ^uº…®û]}á¦×=}»ž^êáý-Rb_ósoù _dð! AK"8YXù½±é_Á£µ endobj -1289 0 obj << +1304 0 obj << /Type /Page -/Contents 1290 0 R -/Resources 1288 0 R +/Contents 1305 0 R +/Resources 1303 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1287 0 R +/Parent 1302 0 R >> endobj -1291 0 obj << -/D [1289 0 R /XYZ 85.0394 794.5015 null] +1306 0 obj << +/D [1304 0 R /XYZ 85.0394 794.5015 null] >> endobj 90 0 obj << -/D [1289 0 R /XYZ 85.0394 769.5949 null] +/D [1304 0 R /XYZ 85.0394 769.5949 null] >> endobj -1292 0 obj << -/D [1289 0 R /XYZ 85.0394 575.896 null] +1307 0 obj << +/D [1304 0 R /XYZ 85.0394 575.896 null] >> endobj 94 0 obj << -/D [1289 0 R /XYZ 85.0394 529.2011 null] +/D [1304 0 R /XYZ 85.0394 529.2011 null] >> endobj -1293 0 obj << -/D [1289 0 R /XYZ 85.0394 492.9468 null] +1308 0 obj << +/D [1304 0 R /XYZ 85.0394 492.9468 null] >> endobj 98 0 obj << -/D [1289 0 R /XYZ 85.0394 492.9468 null] +/D [1304 0 R /XYZ 85.0394 492.9468 null] >> endobj -1294 0 obj << -/D [1289 0 R /XYZ 85.0394 466.0581 null] +1309 0 obj << +/D [1304 0 R /XYZ 85.0394 466.0581 null] >> endobj 102 0 obj << -/D [1289 0 R /XYZ 85.0394 201.2466 null] +/D [1304 0 R /XYZ 85.0394 201.2466 null] >> endobj -1295 0 obj << -/D [1289 0 R /XYZ 85.0394 170.5419 null] +1310 0 obj << +/D [1304 0 R /XYZ 85.0394 170.5419 null] >> endobj -1288 0 obj << -/Font << /F21 938 0 R /F22 961 0 R /F41 1218 0 R >> +1303 0 obj << +/Font << /F21 950 0 R /F22 973 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1298 0 obj << +1313 0 obj << /Length 1768 /Filter /FlateDecode >> @@ -4700,41 +4751,41 @@ tèErÆ )LÌ ìÔ)ÂpÉ!è©n½ˆ4ï8Ky^ëéMšezºÈs k¿²å‘µÎ”k1…éÔ‹T©¦ô0j }z¬¬Ó%ÿn¿ô¡ô1µ ÊTˆiivíÚÔ«×eΓ=5’´Š£.mÃU;GÝ©ÔE^à9"–JØCàxy ¥™Zÿqdkà“µ› jÝ Na>¤¯xÁã/jY»—|‘´7ŠÂ-Ý M¤³•PQŽŠ2Q£ýëq€:Ž¦Ö÷£J\„¥r8.ù ¬ "~AªíŪNAÕ 1̃`àùFŒ!Mr¡äå‡~-zP©Ä¢VÊKu¦}?N[êÃFÓ=¦SYl‹3¼îb¿§ ”Cˆ¹Ê[öOÂ]Có¬ûœ„èéÌEc½â°õbz|í/×<ÇG,„i¸Ï(ôY«•P=x¢ºù7Û£û_`#~›endstream endobj -1297 0 obj << +1312 0 obj << /Type /Page -/Contents 1298 0 R -/Resources 1296 0 R +/Contents 1313 0 R +/Resources 1311 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1287 0 R -/Annots [ 1303 0 R ] +/Parent 1302 0 R +/Annots [ 1318 0 R ] >> endobj -1303 0 obj << +1318 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [55.6967 61.5153 126.3509 73.5749] /Subtype /Link /A << /S /GoTo /D (rrset_ordering) >> >> endobj -1299 0 obj << -/D [1297 0 R /XYZ 56.6929 794.5015 null] +1314 0 obj << +/D [1312 0 R /XYZ 56.6929 794.5015 null] >> endobj 106 0 obj << -/D [1297 0 R /XYZ 56.6929 372.6686 null] +/D [1312 0 R /XYZ 56.6929 372.6686 null] >> endobj -1300 0 obj << -/D [1297 0 R /XYZ 56.6929 334.1957 null] +1315 0 obj << +/D [1312 0 R /XYZ 56.6929 334.1957 null] >> endobj -1301 0 obj << -/D [1297 0 R /XYZ 56.6929 266.1213 null] +1316 0 obj << +/D [1312 0 R /XYZ 56.6929 266.1213 null] >> endobj -1302 0 obj << -/D [1297 0 R /XYZ 56.6929 254.1661 null] +1317 0 obj << +/D [1312 0 R /XYZ 56.6929 254.1661 null] >> endobj -1296 0 obj << -/Font << /F37 1026 0 R /F41 1218 0 R /F21 938 0 R /F22 961 0 R >> +1311 0 obj << +/Font << /F37 1038 0 R /F41 1233 0 R /F21 950 0 R /F22 973 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1307 0 obj << +1322 0 obj << /Length 2693 /Filter /FlateDecode >> @@ -4755,252 +4806,266 @@ v‚_Ñ&-Ë÷–Ðùs’LŒ“é¨úcº¯ç½¿ªîzWnBˇ¢—ålÊOøQ‚x# £cÇl»„“¬ðܯb¼ocàÁ p¬xJ´§¹=vrB þ²¡ðÙ£,ˆ †— N8çŒd¬`—·Àvÿ¤?í.îü›¾ü2õÃ%0'üµµQ†Ìè‘2ÂÒTúÄ„íû&·×ˆã<dÏÄŸ¼÷?²œÿ¿Gd„çùÌ9#×çŒ,ñJiõ‹©âþ ^.5ÿ +Lendstream endobj -1306 0 obj << +1321 0 obj << /Type /Page -/Contents 1307 0 R -/Resources 1305 0 R +/Contents 1322 0 R +/Resources 1320 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1287 0 R +/Parent 1302 0 R >> endobj -1308 0 obj << -/D [1306 0 R /XYZ 85.0394 794.5015 null] +1323 0 obj << +/D [1321 0 R /XYZ 85.0394 794.5015 null] >> endobj 110 0 obj << -/D [1306 0 R /XYZ 85.0394 769.5949 null] +/D [1321 0 R /XYZ 85.0394 769.5949 null] >> endobj -1309 0 obj << -/D [1306 0 R /XYZ 85.0394 744.949 null] +1324 0 obj << +/D [1321 0 R /XYZ 85.0394 744.949 null] >> endobj 114 0 obj << -/D [1306 0 R /XYZ 85.0394 744.949 null] +/D [1321 0 R /XYZ 85.0394 744.949 null] >> endobj -1310 0 obj << -/D [1306 0 R /XYZ 85.0394 721.0357 null] +1325 0 obj << +/D [1321 0 R /XYZ 85.0394 721.0357 null] >> endobj 118 0 obj << -/D [1306 0 R /XYZ 85.0394 672.3079 null] +/D [1321 0 R /XYZ 85.0394 672.3079 null] >> endobj -1262 0 obj << -/D [1306 0 R /XYZ 85.0394 647.0603 null] +1277 0 obj << +/D [1321 0 R /XYZ 85.0394 647.0603 null] >> endobj 122 0 obj << -/D [1306 0 R /XYZ 85.0394 136.5325 null] +/D [1321 0 R /XYZ 85.0394 136.5325 null] >> endobj -1314 0 obj << -/D [1306 0 R /XYZ 85.0394 113.5963 null] +1329 0 obj << +/D [1321 0 R /XYZ 85.0394 113.5963 null] >> endobj -1305 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R /F53 1313 0 R >> +1320 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R /F53 1328 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1317 0 obj << -/Length 3508 +1332 0 obj << +/Length 3556 /Filter /FlateDecode >> stream -xÚÝ[Ýsܶ×_qo=Íøâ‹ -©œä‹ëÛ/‰2)ñâzó~IE—À![¾}ù·W—+³åÕ«w—œ/ÿ?¦ÿÓϯ޽¼lyý槷W—+‘)¶üî//¾öçy|÷ÓÛ×o~ø¥çsùáúÇ‹W×aÕâŒê%üvñþC¶ØÀ‚¼ÈU’/ ¡“!¬Yì.§ˆ3JýÈöâêâïáà©y5¥9Æ3Ä9ã‹eHÂü)*œ#Esí rcI ÁÊ)¡Aù”/1âJñE ÒÊÿ¥-îÊ‘"€@b±L \ü%"
X‘XR$O¥Eª‹]¹YïËõ§uSß^®ò,[¾_}|øüÁ·;-ñ7¯9 ðÂ9-3 h.›êP®»æðdI£i9C9áØQz®)žI<ËÛj[já A~I²<p<U(Fã|!€¡ „¤Ï#Z
©ÆÛ¬ÔSèìsS6S Šæl^€@•€ µÂÀ¬E.b®ïb"i±B8Ê)&!æ oÉ`©ßšýáËesw(vö ›W[Û.ìÏ®h»ò`Û¿fÙ–¶}Û¸Áö©îŠßÝ;õÆ1j궂ëõÓ%Æx‰¦Î@®Œð/8CÓÇ2P=–¹µKA¿D¤‹éc¨R{çŽâæão߇ƒ¹N "ððÜíèz[´mâ -³¡oÂH²p¤>&˜§™9‚ÇâP'¸Š”ŠÏär[T[ -Omµ<]dý.rlÏÿL -‘Hd’yCÁÿ•å>SÐÄùuÖk)z¿=Ã&K9RBäÏ
¥â\(Í)ձχÒ!Õt(
T?×ìö c2˜2ˆi˜‹yUB†(˜Â¡Ï@ŸHˆ«jWm À(_vM"°2Ž² OÖ©ÈšƒE½Þ€Ï4Ì+óË–Åö±xjíØæ¸Û·v¸»/í˜õùzB'ÄÍ.Èf_·Ýv_®+ …Ëa±"C$Ïpì‡qZÛy÷´¯ÖÅvûd‡ª:Šð›êVÀÛÒ ;µ
ð»¢Óf¦Œ„+‚2zn
ˆ¦MÄiéõf}:£€s¸šÑÓŒgŒö‰ Ì æg¼6» ÉÒj`×t®oδðrSÀpmGõYä´µZÇ)p«ËX8Ú~]'‘ iy‚Æ–gŒÍ` -QëOe¿¾/êºÜZæ»fS‚qQ°ú7·Öf5òËsžÇ[ðÔ ã:\Êå1%…,˜H~ÆÞ4©û±êî›cç³ç@›½>.OªÜÓÇJ[£u¨í~[<ENöh2›Q•mß)ZïmÍñþóTRÂ!yÄ"—_” YLçIêlžÄIŽÿ"
XLçI*lÛL:Ä)JzûÖŽê.•¾äˆQJOd{&;——äH#§ ÷g9꣔‚|XüžÎòûT¦’ ˜«üÙ@ÔyÒ‚”ˆ`…Ÿ‹Eg”íÈB Rî–J@Bh„#’J<»M û@(!~¥•;‚éÆýµQ6 Ϊ¾ OoÉL€R¤˜·ö‘5v™0vOdl½Ü6ÅfA,‡H=7i Í;`pwŒå,šöÖr4š¼;z<pZ -% `[4© °Ê&À|¯¡ÕŒŠ<U¬#0B>™Ã
ò*9•,¿Op1¦œª®ÈÉó7ÉÆŸˆ‡ª|LÉ øQjF ~e`ßóº TceÆqN£ %q¬ÍáÖó¿« Êºßäé= C• göx@5³ÇžÊîñ- -õuä%¸`5«Ë@4Rf {@=ŠSiÓ… ð€F -y`â„ÒzÇÙøëÎ š“„èÿ|Ùòendstream +xÚÝ[_sܶק¸·žf|ñûæ$vêtꤒÒNÇñuGI´ïÈË‘gEþô]`8‚<¥žN; = +’2I-¥ãã™Á"™cyWmK-\„#ȯX’zŽ§ +¥$£4]dÀ0ãŒÅÏ%Z
©ÆÛèÔQèìsS6”rŠ–b^ +S$K”p†Bÿ+Ë}¦ ‘ók)z¿=Ã&K%ɳ,}n(ÍÎ…Ò”s ›é|( RM‡RO5ðsÍn2Fƒ©€˜Fe6/‚§ŠÈS8ôIÐ'âºÚUÛB0.—] ¬B’$¡õE,²¦`^¯·à3
óÊüŠe±},žZ Û wû‡»‡ÇÐçë!7;/¾ŽÝv_®+ …Ëa±b‰ ,Mhè‡qZÛy÷´¯ÖÅvû„CU DøMu§aÀ]iÐ +Œ»Pnp¼ª'Œ_i8=§L€Ó2÷QëO-²_?u]n‘ù®Ù”`\ ¬þÍ Ú¬F~i*Óp žš#:®Ã¥Z c"qÈ‚™’gìA“;± «î¡9v.»±´Ùë³aó¤Ê>}¬´5¢Cm÷Ûâ)p²G“q`FU¶}§h·5ÇûÏSI‰„ä‘f©ú‚¤dÈb:OòTgó$ÉR¸ø/iÀb:OòT~ÛfÒ!ÉI–+gߺÂQÝÇÒ—”Îù)€lÏÂdëò¢ ì”ãþ,G}”b/ +s€œ!gþfê©Æ
Í”ëRX Ò«^¥³›mmÉÝ ýN`RÁ)› +r¹Lœ±‰ÕŒM8*ƒÉªû:¢ÿÀ¹ÆÀ$$ë +³ÍõÊV$ +¤Š†ÑaS‚l§³O8Y$ËϤç¢iÜáˆô¬:U2á0íƒ*Ôב—(àBóY]z¢‘2ÃØêÉ%g6 ðÈ© ÐðÀ#O ð€Q ¹=Šú™ 0f}µ&ëGOK]y &\æ£ G,âHå âH….²<q +©ÓˆeV©=di5ŽYµ^ Û}i(Ëã~ ¶ÅŽ (xsGÿx¤¯;X9]É”aðãÚ÷°UYFæÎÏj²à… í snÓW¦$¢(¦gkǼ1B§EáËÎø©p9¦ƒ»&³õ±°œ †tv³is d›røï,)³ Zµ¾Q¤ƒABc€BÝiE&‰xbÒ#ð4VoÐG"SŸ Ë7 [·uqlúuÛäô-¾‡u +?¡ñ¡9 êb‹ ÷5KSv–Õ%lŸêµ“Ê‚„„úÛ3'e€ñUi}q&Ë—þf€Ï÷ô• +}U·fÃSÕû–æxÚ`°Àn¿ã8Ü[ <´~‡Ûêž~^7ý# ©,cíwœÛ'Tr‚¦+ïwôÍ/ô;‚eèwS,úõCú‘÷Cz¼4kÓ^HAÀD/¤ÇÝyÖ/#׃öþ68†ÌðËe@Œ«È²‹ùžMÕ~4ÞÓ‚-¦<ÄBÑZ C]ê‹RØï÷:Å ž}å°4ì·TÅ–…%Ó_·e‡>7QË—ýkþ8Éq' ¿â±ÄÌ&öÿT`âúŸ "—ø; _ü¿Vý¿ éËJM}oÌ´¥ endobj -1316 0 obj << +1331 0 obj << /Type /Page -/Contents 1317 0 R -/Resources 1315 0 R +/Contents 1332 0 R +/Resources 1330 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1287 0 R -/Annots [ 1322 0 R 1323 0 R 1324 0 R 1325 0 R ] +/Parent 1302 0 R +/Annots [ 1337 0 R 1338 0 R 1339 0 R 1340 0 R ] >> endobj -1322 0 obj << +1337 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [219.3839 342.7466 281.1025 354.8062] /Subtype /Link /A << /S /GoTo /D (options) >> >> endobj -1323 0 obj << +1338 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [401.2123 288.8914 470.1877 300.951] /Subtype /Link /A << /S /GoTo /D (dynamic_update_policies) >> >> endobj -1324 0 obj << +1339 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [243.8464 235.0361 306.1963 247.0958] /Subtype /Link /A << /S /GoTo /D (options) >> >> endobj -1325 0 obj << +1340 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [368.2917 181.1809 436.8984 193.2405] /Subtype /Link /A << /S /GoTo /D (dynamic_update_policies) >> >> endobj -1318 0 obj << -/D [1316 0 R /XYZ 56.6929 794.5015 null] +1333 0 obj << +/D [1331 0 R /XYZ 56.6929 794.5015 null] >> endobj -1315 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F41 1218 0 R /F53 1313 0 R /F22 961 0 R /F14 964 0 R /F48 1238 0 R /F55 1321 0 R >> +1330 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F41 1233 0 R /F53 1328 0 R /F22 973 0 R /F14 976 0 R /F48 1253 0 R /F55 1336 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1330 0 obj << -/Length 2924 +1345 0 obj << +/Length 3160 /Filter /FlateDecode >> stream -xÚZÛrÛ8}÷Wèm誃+/µOÙÄžñT3{o•É-Qw)Ò#Rv¼•ßn4 -îo>Ü^.c–*øòü· ~½:~wwùùþ—‹«{?‹îL9“8…?.>}f‹5Lø— Ê4Ñ‹x`!OS±Ø](-C¤t=åÅÝÅo~ÀÎ[óé”å´LBˆxÂtBtLÇ%“H&‹X§a$…4¶ËªõåR -ì/yäË¼Ê Ê¼Á> ¬_«lW¬pxZg-½A¶ió=ÚmN}eÙ±¶™ `UïžÊ¼Í×hX¡ƒ·î3þü§®rÂvèv›½äë áA1Ð`‰F†™.9S…ÑÚª…+âÕ‡—¢,©UÕô·¬«G‰í‡œþÒT7‡õ,!g -,¦âEÌ£PÈ8™´¹G-»0cs•tmÎ ¢ã`Fùº-6¯(ø굅 ´‚R… ÌXÆ€zCŠ4L’8µ OÃè0ãÈVeÖ4ÃH
Î -õÝ竺Ú#Ñ:ã(:'Ú¡Æ¢ûÑ ‰0ez¢?æ£BFÖÐ -&A½!{ˆH…‚§Þ ܳDãèm•§ÑCÑÒßì¹.ÖÍÀõ«<·ÓZšÌ¿ -2¤£V])±‘¸O‡,í†fM$ $z²‰¨×¼ùÓÔ,á#Îã®ål\NZN¥‘Kšê'4HsbLÆ£‘åˆ3'-§•Pßb9ÈÝãX;#Ïðƒat– <h†ƒÒÖ‡ÝÓúár1|Zfeùu¹ÊVÛüë‰ÿ³}1‘Jò(eì'h’IÃp"«T1,1sæ%•¶XΣhnŽ 3œc`¡X -Étg’ïa’—KžZnƆ#r`÷ ê2ó¶íß™fë|“ Êšœ:!izƒ~mÚig$Š÷yc´¬Ç}àTk"!n?GÓ¦ ÌÅ‚›Mÿ(Df7ÉA3úüG›.¸ó“Èöù¼Åj6wlRi -<XÌ{^vÚ÷<ʆѾ®ag?éfýØø6/‹Oy™€³ŒÏÏÈ£Æ3ê ]D‚GsÕŸùšT‰=D«tèkø&~€¬â•žÌb ®ÓÀ çBøÖ¸P_`Ç…Œ‹¦°9•ö=ô{ýê8 -8ÔXAn”„±Ð
¹µc‰sð,—ì²—<0¹ ƒµ=8ã!:«^©asœ¼j陎K
=ì²uîÄÐ: ·Ôq,ÁÕ]¨
ëG;0ì{d -L~O -|Øiì¾/Äñh Åì]€ãÃ!’ê -uÂþU ¬ß ¥Y¦RãÀ5goóØ’bǤpvßS[ M’MªÂD³y®Qaì‹¿$ =G5XÑå7QMÔ¡ ¹ô8$•ñÜ<©àÔl%
@ŽT˜wµ=±á©•ƒhîKîC:tcŠùÓtÃÇúܤe¨%»lƒc ÙÆ<bpÏó - -‹ø¹t¶ ›á‡29ÿ>[å'«Tór}•j$wºJÕ|SQ‚˜ïˆ zç ãã[Ž‡ƒ˜›”ü9·éÙƒÍãf+è"-EΘ® ;m:ê™nÿ÷ï4Hß¡v±£4Ug´s¨±v}',Œ–ôÕ»ËÛfÒ®>«Ÿ·® ‡¬rµY*RÙÔ8+sV×I(q®¬Ú…ÍXÝ¡ìµÕ¤Ë AÅÏHv¨±ä¾Eug8¦ú¢ÿ_e3vLYž«˜ta3vs(T~S šíÉ@Ÿ—ë}$w:Ð{‚¯Qpþ
†3ŌӦᩆ³«:—[ua§MãQÞ4ÈàS‡ù(IÒM£G -¦,äJË3 -:ÔXÁ¾
á-Ñ@Ãi>t
…‡`TŒN±>ãø^{CÎÏ¢s[N5cm r×"‡ñ½ˆÒXÿÔóR h$u¼ rw‘ôľ/š§2Ã
ƒ §ƒi›Û#æ’Z&:§YslSÁmÝÚWí6k]Ëvù+2‚†þþ šEµ*k÷ä¿*ªc~2<ƨ©ÇU– ŠjýæÝÏ©$¾n7qŽ¸×Ãz •'¤B†”jæö¬ðÍÍí„D.Ì”Ky¶…Û·"‹ãU\·^â -2t{rOqõ˜á¨Ç«a3æLá…ƒŠQÌÎÑg6ãµe¯ËûÆÞL ½æeû£×HöôÑ«'ü½¯Ãú¥,‹¦í_º[Ÿ‰T•%aš¤Éÿ”«º5ƒi“Ù+s=uüኳ‡MÁN/ -$%Bòs¼ÝA^2µÀ¬,ÖöFØœ‹ëêk½ÙÌÕÿPªð×XßYÿÇdKÄRÏÎσFóëG Ì„Vio‚Wæªj÷®†¿.šcçûÛ»»«wÔ>Zð#Öšð…kҹºjš|em5É1éࢀ®5ÝþàøôàwœÖ¿ï[•¿z{Í›i¾QÇ#Öpü|ƒn¸Á[çÜÕ„Û Ñ
4³w¯á©ßËAâŽ?r›XGøo§ÿÝ¿¥;þÄüK&ɉœ^²¼/Rh·šû ÝUÿ/Ý—endstream +xÚÕZK“ã6¾÷¯ð-">$Šµ§Ùd&Û©Ú™dº÷U“9ȶl+‘¥Ž%wO§òã H‰zXž©ì%åƒ) +$ø€b‹~l‘DA(´\(-ƒ(dÑbs¼ {x÷Ý
³4+G´ò©þöpóõ¡:Ð1;o®$“„- ¶ –ßüýÕ¯ßß®x.Ep»ŠâpùöÕ?^SÏ=¼Š¢å¿ Å7ïÞ¾¹ûîŸï_Ý*¹|¸{÷öv¥B-aäõ±ï~xÝ»¿ýøðýÍë‡V +_R +á×› ÃÅþþ& „N¢Å3<„Óš/Ž72A$…p=ÅÍýÍí„Þ[3tJs‘H‚(ájBuœ{ªc‚I,’…Št .Œî¶/ezÌ7·+Éøòü¸M›¬¦‡ç¼(°%–eE=EUî³µ×ýŸnY²Ìvç:Û‚ò”VË» ½i–ä·ªÌh¢CjçÞ R˜jKi¹íF€Foæñ-b „±a‘ßüÓÎ,¹Úªã +É+G±b,ÐQÄI°|‡t»ì”•‰&öÉ€'<²WM^•·+©e^ã¼Ìí3H÷h%Y´}F<$ú¹:ŸÊ´ ޟµIH²¶=¤ß-u6u’a È6
u‘zLXíÀ†[¾{⢒aÊÓsnxF›E˜Ã16hC°e6vC숴|¡Fö)¯›¼ÜÓS+)>8I±M’bkm{H¨cõ„f1ðJØ©*Œ¥Ô¤U·D+ʵL|£¡-ãv*TEýR‚=Ça¸ü°ÚYZ~´OdQäã ¸úDØ*‘ˆz‹p $‰Ò–hjš(ÐJÅ–`S¤u=1ˆÀÿ¢ès§yʳç)fD [ˆèãÇCõ +¦ +Ì©·%©·ç"‚Ižôô{oô ½âÚ)þ“ßC£5|pæ‚í]u¢FJ„A·l¹!gš ô=2p°o)Éq¤° Ç´n—°Më Žkf ÈŒp”?q.É&°EÓ´ŽïãÃý˜mrœÊ¸„ˆU7Eçî0¶uwolZÔµ†N +˜é-ý>+ªU%b«h +±˜ÅÈÆbÞS•oëé—Yf ¦©\(gŒÃ×–îXm
¾nœeàËü謦B§Ú€êËÅIÀ8»ßød— ¬¥2N“6õh]¸)„¾²®£¯Û÷.)ƒ„Möþ7¦>§¼q'LvzÊ,ê Oh󛺯÷VuCwR_T ä5LÅ׎'ŸlF}Ž +¥øõœ^Šj?áà/cî?€I&{ª)…;Ÿ~žò$ + +;Ù6'ÀÜØ£º¦s`®° +R37µ1k˜Õl‹âeï^:®üU@óà~‰§y f‚—¬þëÔj0DJÇØè†R‘zZ7!õ@7E(ˆc™ÔýSsRc@À¥RŸ£±HC¾¹/£´Œ +/'¥TpmkOÔ–”?ŸÒ¶‰¬™h"‘EÎæYÉÀ½!e¸fƒ ÙŒ
:*ëh§ª‚X뢱‘Ÿ$_dkê’qÈ6# ²y‰Zª±Dýd’'X–}‘ÈÖ„L\ICm
ßàç íæÉléé© +ïÑäC à(üšã{d3Žï¨ˆÑ¢ù ÇŸe sü! ßç€ N{îsÞ%ûЙ Aß9~AÉ ¢tÈ–ïƒ# 98 endobj -1329 0 obj << +1344 0 obj << /Type /Page -/Contents 1330 0 R -/Resources 1328 0 R +/Contents 1345 0 R +/Resources 1343 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1287 0 R +/Parent 1302 0 R >> endobj -1331 0 obj << -/D [1329 0 R /XYZ 85.0394 794.5015 null] +1346 0 obj << +/D [1344 0 R /XYZ 85.0394 794.5015 null] >> endobj -1328 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F48 1238 0 R /F55 1321 0 R /F21 938 0 R /F41 1218 0 R >> +1343 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F21 950 0 R /F48 1253 0 R /F55 1336 0 R /F14 976 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1334 0 obj << -/Length 4157 +1349 0 obj << +/Length 3792 /Filter /FlateDecode >> stream -xÚÝ[[“㶕~Ÿ_ÑåÚª¨«F4®˜y;ãÙN²ãìLÇ.ÇvmQ[bDvDjÚTþûžƒ€Aݽ»o[ý 8Äå\¿sÀæW þø•Î³¼Å•)T¦×WëÃ+vµ…±÷¯¸§Y¢å˜ê›ÛW_'ÍU‘¹È¯nïFsÙŒY˯n7?/d&³k˜->¼ýw×K¡ÙâÓ»×Z/~€ ÷üý_Þ}|{mÔâöæûŸ®—†jñí¿¿ýËm x~Žo¿ÿðÝÍû¿ó\ÿzûÇWïnã)Æ'åLâþþêç_ÙÕüÇW,“…ÕWðÀ2^âêðJi™i%eèÙ¿úôê?ã„£Q÷jŠs0œåÜ^-¥Ê,,Ÿ$29Òhè"Ë¥‘½ÊŽØky¦‹B_E*doßÕÛå¾îúùq¹Ô°-c¯Æ“ž- ©Î×b´6WpHSðéâÆu—"—‹~WQ£)UGÍöÅ¢Üï©ãöÓÍ{j}® =Ñút<^s»¨š~ÿè»ÚæÆÄöDê½k4Ý©óK ñÌ°Q>Ú¨0EƵPp<Ü!ngãÉÆçqb‰TuC3VåzG/uõp]ˆE†ï¢ôàÔ"×À0žZ ÷Ú;4èÞžø -´c"úuÎ !ì[˜§™©Î¹1Ñ!ŠÌ0°ãÄ Ð½(ñG-¶õ—ª¡ž´ì€8CwNÚ=yR‹®:~©ŽèÇÀëI¿0ÍnwuGt›,Ì©%yÆmn¦jÙ´^Ëûû }}û?ÑJo¨AÍ`y~IÕr£3Ëuñ´ª©.«Z¤ÂS”›Í?Ú&¥fÊdV0ã?MæyYkŠ'tLg…1¹'XïË®KLîÑæZ¿tšAU§›™ªê¯‰i@ -)‚M€Xîj -«m欗 õÜ2ý4ï#Õ9ógžg9†¨ ÷ßn@$g¨Öø㸼”¬X<ìê}ENa±áÖµQKñ÷xm§¦©¯ù¢Ùz7*„͸RjîFI³
ûp ?˜ç ÒÈ¿Ÿjjx\óÜpà°ÖÑc€~·`vKÜw—ðÿ"ºPAlí½ã3-ÐÒò«Šž»ª§8—,¨namP³ÇäZ$Ú ¯hÒ -ø›M0uÙPã¾:vž–w=úiפŸÑ¹³hŽ»¨ý¢]y¸ß§œ¯ÖYnXpZ“¸=a¼â™ Á¹¿ƒÇðž‚ÎY
O—&SVå¯~sûWpH¬=…¦};[bSÝ•§}?ˆæ÷‰A»Ás -ŽÍ %g,òÆ=Œ7ì:~÷Oúí ï=É¡ì@^oèáÎÅ]l}5z5Û¬¾òÿzó»Tð{ñ{¶nK(?´}5cÃêX®?Wý<#éªC½\·ûÖ«TI|j’’J)µ§ƒñ$˜Ô\e låi09¦º &#žR–ÿ×`r’ø@€, -%Ÿæf¤:gç4 -£ó)?Câ#™uqpa@ˆ6"Dèì!Rî|;‚D q1úHD„¸TV/¾o ‰wwntw»!uTÚÊ©S:ÁöXogÄgä¿Ôe -<r`»ˆÎÌÕ¿yÁ•å*ãEÄ Ñ×®¢;Aö Æ[I𤇲ïC~G± SÌN Ë[8½M˜’´|á!Šã³%´†´3ÌŒLq¹èêf]…+Æà+èO
ä‚aRðÂ5/°EÈ ¨¢Ð,‹‹”'n0tgD2÷æÌQä߀(ú㥰‹mSö§ÎK"ŒR·ô;—½%=v»rHPqªjMÏ=†K™{_å& ” Ëá·iiø¡|¤ŽÞwÜ“/ûRoüaGr´´nî°í&^‰ƒúiãz±¾FÈ=s…ÐOˆs¦| z‡03ìÛu|Aùò4Ò ì0ÛT‡À 3ËGIæ|cj€:Ю»D´&“:hþ×U¿þ»„À„$4 :uWX¶PùTUV'<·*Á˜Ê= (LEÝ#vDxÝÁ䦉 xQ¨bàØ_ –)aË2Å/pyJEWKYbFØðæn˜üBÄSC>€í`ýTžŽ;Œ ¯ÂtØÑ欘rè’Pe¦Œ›$x -8 ø‡[û¶ýLdBeT¦s®ÏDŠeªdælXŒ…$Ú#Mþ -ÌÙ‚"?” M¾©—s8n-¬²a‹\4¾¹ùð‡! É5ŸAïÕ©vÝÎ*ìyù Á F"&†]Í
¹Rrdgø¤À•ÜD>yEðÎ §Eнz¤ß!&& `Ä+¸þy¹uEGx{Y&ö\+¤Ã#K»õ±^Q’\3 -<sÅ~W 7\Ã] ”ÚÀàhA¶Ñ®ñ~Á£I8´ÅúÒÄ)PÙ| -k¬ WP6'L„¿Dj<;ü¨¨ØÚÕîžÌ:?Rç°7x8Te㧓®ÂòÊ¡£å…G?@ék„c¡«á c& -Z×Ý…{ÊÚ -•ÞSÀ/„ —ˆô§. TUhûÙ<( åMnñ¡ŠC·…VÆ2Ι,Ñ&.^¬0àŸ Ýs*V,nzØîÜÞo!Õ@FήÃÅ1¸'·-Lc9'ì/cηÙ(c9N$†±„HÜj©ŒXcÍ“éÿÍãRÜg°yØЃ‡5‰J.È/·ÅÓ®Fp`}¬ ݵxÃí :§Ì1ÞÕsÒ'|Æ¿)±#°³j•ÇqÂ.'%…/¨WÖÅŸ/å¾ÞPsÓ Jg@ESû‚Y{Ú©*ÿá2œoÝŸ|Qv´Ê®†Ø1h½C™¿¡BX¿;¹BÊ°x©
/ïëÏU -þ"„J°Ye…årf%“$&ax‹/À¡¹ ò‚o^üÛô—Ë8ãr<åùeçÎ…Ùaå'Ôxò;뤮TÒc˜"!ùrUÚŸè¿Ÿõg¬<áÏ`‚»èÎ Zêy -èÂT¹ŠP ÜoÛ#ø›Ôm ¤á’G£º˜mI ÓCLjªTH98!F _ -+Ûä¹'*•¨êå‹ûòØ9¤§ò€ï U®×Õ}ïÛÍ#5¢Ú*M`D…ôJås´©|†#9hÊœ}% $””Oæó‹%êÒ/±ŒÝ¡\/–Çè’Ì«žfƒüé¼xµ‰ Ýæó7ˆ£œs„ ü%ôªìªeî'šuol"ÿ¸K•zG áãwßú¯…µ²>¼#,dâEÁÝBsHËŸÈ7Š\ê„AH6dâ yª’º)ÂÃó‡Bÿ©£ÃÉKá -+
hJÅ ó2 Ž#ei¸ .áübà̧jØA9¶\qI†T
?ò"D³Xü0/ -`1§×Øp~
O&ð€°X̼.ºQËÔÓõ£¥ÆšYIíB¦€2çÅÈå–_à(l>d -â!@Yýì½ øœ³üŒn|~6ÚÀY’5¶yJz dšÒÕúG…±·“}ÈŸ×M}p¸—>êˆ7c·îÉÚ»ÔÇ4ÌÕ6Àmñ¨–î#äÀŧºí†Ï/&r ð}Â×WoRpÀWa’Él_åÇÇ•ÐÍÍû N+ùCS~ûÍa%o¶?}ú¦ÿéGµý©ùݼ绿½ÿëöo‡âñæý»íF8ö'¿$Øof•äÓ™ÿõæÒ?¢Há$.,XÜäÿùŸT†ÿÝAPe¸ð™‡±ø1• ›Âsq¶sÎ2!¥žoý¿Û0:|endstream +xÚÝZmoä¶þî_a²¼<‘"%*) +\ï.É¥ÍÝ5ç¶(’*¯d¯]i³ÒÚç4ýïá©ÕÚW(ŠÚ DQ#¾ÌË3ÏPËÏøçç*cY!Šó¼L%\¯¶gÉù-<ûúŒ[™¥Z†R¿¿:{öUšŸ¬ÈDv~uŒ¥Y¢5?¿ª~X¤,e0B²xóü»WK¡’ÅûWß_(µø \ÌýÛw¯¾~‘ËÅÕë·oÞ_,ó¤‹ß<wå$ž ãÅÛ7_½þúÏã8 ®¾={uåwî”')náç³ >$çløÛ³„¥…Vç÷p“0^â|{&UÊ”LS׳9{ö'?`ðÔ¼:§9xÌ2®A…‚iUÌÊäŠhHÎ2)FíJ hWs¦ŠB{)Ôn?”áŸn•óœÉLñópÄ£y½ÔñÄBs!˜”™Œg~Ùô»Mù +÷º¯W‡}ß´·G®›*ˆ¦\?>µ—:ž;v] ±™ƒE£É_ ¶»‰!7MoµÔYÿ|¨÷MÝϘ–'šºÐÖlm¹«ãBäK-S+å,Û&¥·Ãæ!°’×-¢=m’ vRäÙ& ¤ 1‰“ÂÞ•›¦*‡¦WÊ’dñC×þÚÝÜ|°w´C¥"`PL‰Âmñ®©ïI˜1FâѬ‡Z$¹•þ0Ý ÈVˆœ?¾C/u¼Å8´2ÅŠDËx¯Úòz&çèxOתéÇΗoÞ¿õ‚Ú£B n%„[3þPp¦Sí +¾* oª8%^ Ãæu7¬hV°÷‡ùdC½VaV `ÑÍŠn®þðêo¸Že[ßvCSá‹'½Miˆú'½-”:ím^Ê{[Uoj‡ +Qû36’’¥iêÇ ¤[æ0e +Ér!òǕ᥎µã… +ñ‰êS°z¦õ¸î½Ô±ò'HÕ Öf‘öŸW¥½’.DšÓ¤Xܯd Øi ÖaM½¯û ½8´msÁí…Q!4ã˜~ä¯Î³sØövK8˜e–þ|h¨aEpÎîVÊ#øwwaw¿¤’éÿ5” B:³u;â{f‚Ž¦7\ +>qÀC& + f=¸#ƒ†! ¦eˆcøhdcK©ÒÅ_×u;G’„å™þ„‚´Èx¸;œÂ‚ÌPîa—¾áCgVlß7†ÎBË D‘/6]Y¹½5-Á`] +Ì"Mò86}¥MUbœ‚·]ÚDݹҼ Î-úiç}t 9Ó…ÎÊ …ìj(¨ =-os¨¤Œ9ǪÛì›ùpÌ©°ÀWTnw›9ðUŠeyâ@+ÊÛ‘â%g"—pàæp·a‘‚ö09”2|„ùiΤö5\ýѬ `;3wLM‡îÄ–7Í3‚wr +ýT€«ÿ œÈUÎ ÖPOøš“:v¶¸ÈIR|*¡:ÕL™N{@ˆ„FCº«×4'yàýµÛ{[kHüŒmï°æf(+sãFñoMj iŒ„å–ö¨ÎŽ`>ÑAÛðL¼¶·ý3FÜJR© J¬)›õtNÙ ðÄïJÛë×k^ÙÓÕ2`ßÿM©¹Z—MÛ“ûá}ãÆ:&cú[ºRÑ-3¸ôhfé6+kÔrm•Û:wE
Ëþ::þYÕ$f¿ÄØš'Q÷.B:” Õ)FˆsK<*´ÊXã¡Óä +á` õ# ¤:#v-sÚ‡ ëpØ%É–}?Á~T98»ä¼S5+gzxÙѸ B‡¿ØYº†7“#q” +ž§Âɱ1<†@Ûôk—€eM¸Úå„èÙµaÓzè¤Iβ@Ç k?ÃʪÃ'Àn –îÕœ©“˜¢ZcCìŽë‡›0+ÅÖÖŒ'™ŠR2ÈG÷¥³½ÝØ.:Ž…† èD4§ôÝ7v|•êTh¡•M!¦…ç(Óš4ã,áE\ +„›òŸ8ˆÆv<åׂc-ã(ë¡74I™*¸æø%~’€Í€Ð‚NÉs@Âä[|J_–Yš,^·ÔU7æ#»‘[•}í^%bPtì,½AëÄ*tb•…Æþ½ìÁVÆvýÑfãxsÌi ¸ì-ýé45Öåô— +·ÂbŒÂ"ä9æžR!4J7—÷ÒÜ—ïÅ¢™H5ë<ìv ž{X’íÖh[Cðƒ"1•ˆÄÎ ƒý\ÏÇ% +Ôâ°žK*a²ÊwÃÇe Sž3÷硦$ÀK{ê@„h ‰ƒXX.œ½EBAl½1gRðɯ]\hó‚›Ìn®-]Í6ßáyÔsÈ…ß?ÿŽºséØëüú "@æÀŒÆt´ù’~ê‹NËÛÞÞ5ƒc —ôû ƒÔø^_n'd—嫤I:°SÇÔc_D ‡snN¥ýª› +é¢ ZUmÊD?ÜÞ•›ƒ•1
Ú ¶Æ¢ÀÜ6ýÜ9§Á>OšùÜ1nÈvíÒhÁ;«tX9¥G˜åý7Ï— '—Šñ”=>9ÊÇÓÿ›
h|öx +-NPy‹ÈÊ eà’>`‡ÿ@Í`s®ìHæHÐt_Luû¹õr–rÿû¨OÑH2°Ô® +W¨â ´DXÇSÝfëß묈ýPø.ÞÞ¯Íg]h\Þ +ûbö‡X˜Ñ<—°|†ùŒ±àSN»XZ´^à”4æÀŸ“q òÛ™eä,—úø`5€Xùc´ßÍ‚c0ˆý€'üážE?ÆÁ„Œ 8O »°A ÞVxãl…#-¸¢Î ÛÀ@øÌ ¶n`J»øì„ò1É„§‘òÍ«¾„ƒ›HùØÁã‹]ÓrFeK?CädÿE Ìýš<U >s‚”œ»eþÇ¿4 €/s€A-N Yç? ¥nQ&ÅÑÊyÂDš‰™¥ÿ âæWendstream endobj -1333 0 obj << +1348 0 obj << /Type /Page -/Contents 1334 0 R -/Resources 1332 0 R +/Contents 1349 0 R +/Resources 1347 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1337 0 R -/Annots [ 1336 0 R ] +/Parent 1354 0 R >> endobj -1336 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [91.7912 411.2559 148.0099 420.4713] -/Subtype /Link -/A << /S /GoTo /D (controls_statement_definition_and_usage) >> ->> endobj -1335 0 obj << -/D [1333 0 R /XYZ 56.6929 794.5015 null] +1350 0 obj << +/D [1348 0 R /XYZ 56.6929 794.5015 null] >> endobj -1332 0 obj << -/Font << /F37 1026 0 R /F48 1238 0 R /F22 961 0 R /F21 938 0 R /F55 1321 0 R /F53 1313 0 R /F41 1218 0 R >> +1347 0 obj << +/Font << /F37 1038 0 R /F48 1253 0 R /F22 973 0 R /F21 950 0 R /F55 1336 0 R /F53 1328 0 R /F41 1233 0 R /F11 1353 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1341 0 obj << -/Length 1558 +1357 0 obj << +/Length 3478 /Filter /FlateDecode >> stream -xÚÝXKoÛF¾ëWðЃ„ë}?š“8‰ÔIm¥(#ÒŠtE:®Qä¿w–³¤(ŠnÜÔ(‚Bícfvvæ›Ç’E~,²ŠPáddœ$Š263]ÁÞ‹ 4qG©~XÎŽž 9â4×Ñòr Ëj-‹–é»ù³—Ço–'狘+:d+MçgÇ?žàÊl)5ÿ¹£xöúìùé‹·çÇ #çËÓ×g‹ØP'ó˼¯ßœìø.ï—¯f'ËþÛ2*ü~Ÿ½{O£.üjF‰pVE·0¡„9Ç£ÍL*A”¢[)f³ŸzƒÝ–uÊrJX¢,7¦“l`:Fa,ud”#ZpÑš®ºnòª¬±¦tþ§¿OÄ ±Ö¸(fŒ8¥xK—f—ÉMÑÄu¶ý”m‘œqC(üØÓ–Ns|ÌîÀtè·eºú
¦H ÎAW~n7žs>ÐœbÛ’,×yÎø•R^dOp’_†ÿ²n’¢ÈRœ&5 - ™‚GÁA´•x”5«#¯ YUåå„Vm5äáÀÛê¦è)Šê‡Í:ÃÁªÚl’2ý~âø˜Yp”Õ -F†8¾ór¿ ¤v@ªˆ3F‡ƒ½ŠhúmVTI:¡i ‚`´XSJFJe™œt‹½qz]mSp‹ÀŸÜÔYà^‡A™l¨ƒÆPøvÁì¼ÕÕÍ2ô’—ùwÜU9:¤¨VI±2„Ë&Yó2Xü6Ããp¶]ØùMYæåUØÍ›5Ž.+ï®~¬Ò´ŒUp -E¶
ÖUÝ<Åùgüƒxª÷èvQ†d!Ú #F° lè{ V
þ¯“óeØHÁP¹÷O;Åp ±3úv*-%œs6ø(§ -&‰6|JQ"™¶Éªœ8ƒÉœ÷ã¡ÈÄ) †4iOåUô÷;4Zmx
WD+f÷£ü¼¥3-ÂQÚð`eÁ(B
ŒûÄt••GkA¸±2_#’¯¶ÉO¸Í ï§=P?ee )îpo…ñ~BŠdÊC ÓZ”¹/K*MŒ %&g<È;¿=ᮺD ¨óðaó·“¢®ÐdBh"9ENš××Eâ•f<$&à>[Ô¿¾®ÊÔ›ôÐ’Œi€rgÉ>Tu‡ª…ë‡ØmL<ôÇ¥2k ,µ©V’t·0aF f |ŸöÒ{ÍèˆÝc©5ÑqÑdÛ2iòOx1U-þ—ÜÈ}‹¡ž>¹uaŠép -lŠÎ§°ÖòÅÉ„Šê!í=ÝZÀG|býæ:¤ˆ CøÔ¨Âi:¤ ècbŒ¦6ó„TVáÀM•æ—w§YH´Ž«‡˜]sÂ}´#iÒô•ôFë- uVRF„ ±P„1ª[6ßBòE ý´ŽùU™L‚ͧX ½“ؾfÛ&É[{³ùÛ³Ó_pT~˜ð¾ôÂzè0XW<=iW<ýv… Mò±Û½ÎV¹7à -çɪíùž ]RãjšÕ«mþû&(Ôåè´½ªéÅ(22Õø-×Y <5¸Â -
48ûžÂ)(¼wà½AS -²ð™ÏÄ»O† Ù@ù¿ +xÚksã¶ñ»…&Óò̉Á›dóéîz¹:^Ò;ç2yt:4EKœ£HG¤Îñtòß»‹@R‚l§íèƒðX,‹}ƒ|ÁàÇ™N˜ÌÕ"ÍU¢×‹rwÁ˜{{Á ÌʦP¯®/¾üZ¦‹<É0‹ëÛ ®,aYÆ×럗¯ÿúò»ë7ï/WB³¥L.WÚ°å»—C# `JëåGñúÛw__½ýþýËËT-¯¯¾}w¹JY®`åÓk¿ýî͸îÃå?¯¿¹xs N1=)gðëÅÏÿd‹5 ø› –È<Ó‹{è°„ç¹Xì.”–‰VRú‘æâÃÅ?Âɬ]㜖Y¢3‘FX'ø„u\ò$32[¤:OŒÒònß®ËËl½ìëM[·ê¬Ú¾*å]±/v4Ðvm…ǤbŠT‰D±T)Û%Ï–Õ®û\õ´¬hé¿úý݇7¯%5ËmQ· vM
Âr×¥GSô_ÛE‚-VܨD +- •%Ê +{=Åp Òz “°Q1Ð,
74Ž$áhAÝ~[¸9TUIýáâ<!¬h† +Oä}mµ›qà_ßQ«éºOÔªÛ'R0¸†›“+ýT=Än”%)K3ý Ó %‘߃ÚTh*N·0à¤òRÓ?ô(.ëz ÁoD’¦šûã=!_WÈËÖZ»WÕR‹ì4^]½û Éô£y:gßÍ¡nP6ÐV!V13¬dZà8 .X1a•òô ¸m”’E;Ã'Í`jøäÁYjÜ|SµÕž (ß<Ðÿþ2[ ZëÅNEƒ (ÍÒÉþ+äåÙ«WE„¸aNÎ-¢Ã#Kûr_ßÀþĵT&¹Ðù\-Ib¦ñ .Sæ còDÉÌ §¦ÉýfA÷× àWÓäÚgÊv‚÷ÿP•£Ö› õ =©N¤a|FÏI€ ž¢âR᜴æsÅç>ÚZoi¬‰Þ¡ãœ×-
~òÔ…”— +°®þûzW7ÅÞ-ï<Žt·1[¦A…÷JÓ»j}Î"CÜú•‹¼’¹ ã‹èØ\úd÷®EŸLG<ì´€m”Ü ™¨~ +S Uô}WÖè*íÝ8t&r9×dòT™™5YŠŒëiÆFDøO ©c‡›u [ۺ܀>ÐàHtvUÑ:ô éß>rhiyî €ììøÚFX +l„U¡³gÜmν +åìL( é(c†?u%)c‘+±»ÅRbÐÃ<eúÇÓx蜻œ +Ñ’÷*`\MQÚtsFš-= HÍØ#b B)CœhÏ:+,Ôõ¦è’\½*nÏr´ßOÚ3– ±g°…»hÎï;y,ÐTF…P h6Ý ìÍ.²©J!ó Ju6Û’:¤‡˜ÔT1—* !FýDnü°}YΙ•ÖµÉrÏŒR¤¬g–wž·‘ž2>¾ƒVQ–ÕÝàÚí5‚Ø*MÁˆòé•2ÇѦrÎxæ ¨tY öx¶Cã0SV>Ãç6û/5c»+ÊÕnã÷‘‰s8уk÷Oç…&~@ÃDê()›æœ“È ¿›¢¯VÆ!Ú²s*ù‡À}¬Ö; ÞýÚ½Ÿi•9÷Ža!Ïrî4Ç´ü‘|#7RGB²1ïÉR4L úÓ8Æ= Nžso<‡ð9Íåã*š%Y®eœ"—µ´¸ƒ¥Ê*“þù=ᬰҀª”?3/ ÈL¨K[Ç%øÔq ç¸à —`.UÃÊ °e«Ë2¦jøÀ)äÙ-ÃâGúŒ 0KÇwÀfV®±aí6 Mà!Âb!ó:kF3¦ ¯ 06MçèL¦€wÎó‰Y3?ÃX3f +ãìÏ´äÊfÐ +…Ç r÷-Ðú½:Þú’×#«NO7ÁW÷&&e lÛP¬¹ ?¸Ðlú€I³s&°J%ÉÆGv¡Ôÿ “a—Û¥£ù@u&Û@çp¤9¤p2Éñ §#³b%ŠPÚ?Ë M¾¢þïôGÏ&¸QÍÌ©[ +>}´ Ï׶àÆêÁÛ^èåJ°ëÊ¥lZ®Çžä9¤;B„Ä.–ãŸIAû Måÿ!+WŒ”OI“éb½Î=7%ö¾Mh|þÏæªø>ˆd~îYRgÀ©coëÑg‘†Ú›+oì§f¸ƒK sƒbú¹jkŸ¹ÁœK…èÓ€(b×£±^c¦µ½³(“¤Zªã/
`#úhvxèömÇ~]×kš¶_ˆ¸B®Ü÷ø‹‰uÝß5ök)û¢ž/\*ÚßuíúÌg +ø‚š ¨‘(<KŒÌcÉÔìè§!WWâ®V +#„! ÛÏ(äåcD,zé>Bª?ãwiœszp‹}/)u‚ 9F>>`!äøŸ¿¥ ?1ÅI–‰øW ’J‚ Qx".) ]ž’þ ]Mïþendstream endobj -1340 0 obj << +1356 0 obj << /Type /Page -/Contents 1341 0 R -/Resources 1339 0 R +/Contents 1357 0 R +/Resources 1355 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1337 0 R ->> endobj -1342 0 obj << -/D [1340 0 R /XYZ 85.0394 794.5015 null] ->> endobj -126 0 obj << -/D [1340 0 R /XYZ 85.0394 490.579 null] ->> endobj -1343 0 obj << -/D [1340 0 R /XYZ 85.0394 463.2745 null] +/Parent 1354 0 R +/Annots [ 1359 0 R ] >> endobj -1344 0 obj << -/D [1340 0 R /XYZ 85.0394 433.7571 null] +1359 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [120.1376 668.2829 176.3563 677.4983] +/Subtype /Link +/A << /S /GoTo /D (controls_statement_definition_and_usage) >> >> endobj -1345 0 obj << -/D [1340 0 R /XYZ 85.0394 421.802 null] +1358 0 obj << +/D [1356 0 R /XYZ 85.0394 794.5015 null] >> endobj -1339 0 obj << -/Font << /F37 1026 0 R /F41 1218 0 R /F22 961 0 R /F48 1238 0 R /F21 938 0 R >> +1355 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R /F48 1253 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1348 0 obj << -/Length 69 +1363 0 obj << +/Length 905 /Filter /FlateDecode >> stream -xÚ3T0 +xÚÍWKoÛF¾óWðHåvߣk8ŽDvcº(æ@“k‡0E¦¢ÜÔÿ¾C-—ZYtl¤Bè ]ržß~3œ%1† ‰…DÒP+ÑÀDÄå*Âñ ¼;È(“y¡,”ú%~~ÃTl‘TÆùm`K#¬5‰óêcÂC)XÀÉòäýYšQ“«³©Éoð·Ý_\ž}8IOòÅÅò*Í6<9}{r™{‰—mœ^,ß,ίwvÒOù»è,Ÿ²3%˜
)ü}ü„ã +~aÄŒñWØ`DŒ¡ñ*â‚!ÁóOšè*úu2¼ÝªÎ"G0¢LÒè(
Ó cD¬„A’Q¶…î±{p¹•EëëT'íè“z¥ƒÛAqÝVeVvíí ³bT +*†$f|TÚtN´··xøâþGU úã +iitàÝÛÇ À!ÄûøcÚØÑl[¹EÛW]Uß>ÎxÓ +aCÅh¤-V¶BCz3þ$ETJ/ZŒ–‹¦Aj„ # ¤3Ž b +ðΘ@„`5q–¦ÁxVßµEÓϸÂqF92 ²”NízSÔ[¼Ir½\üîVý¨ +ùÐ[÷|óy\ 錢vý—]¯;§±)îýÛ/¶¬ +R¸xãßÚÖ¦ íâ¿C– )×þpî릙•h$öŒ)»Õ +˜‚žV³–ˆ¢b©(âP_¯¨f¶-|¡÷«ùû´|h߈Àéa°5.½Æ¾©Ì§”I‰¡UH½k!ˆ†"¥•Ž¥äPÌ‘ïjqþöúò)HD¤¤`qhñß9™œ‰rÿ%"Ciì…y:ð¿ßQd$§=žšÐ:%:±E5Ó a`«ïè¾ã8ëMWTOB© +(ˆ¢·tã`!æˆ@2à+€Ü}>þW“c2˜kD£/0X¤À‡g0|íß?OáÀäÑ(|æ<…Ã8_Má²±¾UN_RO@ûw½yžcGËô‡ãØQ»$|±Õ03}›cÌ ¦%ñ [,óç)X<Å¢œ§Xæ@±£eú£PŒÀcE$Ìd0,ªýqü`,‡Qò‡K@&`~ÐÚð¹é Ç/vÆ×ÞvW(˜œ™ÖÏ´ ª4 HPúp>`ËÑðƒ«Œ¿Ux± ø endobj -1347 0 obj << +1362 0 obj << /Type /Page -/Contents 1348 0 R -/Resources 1346 0 R +/Contents 1363 0 R +/Resources 1361 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1337 0 R +/Parent 1354 0 R >> endobj -1349 0 obj << -/D [1347 0 R /XYZ 56.6929 794.5015 null] +1364 0 obj << +/D [1362 0 R /XYZ 56.6929 794.5015 null] >> endobj -1346 0 obj << -/ProcSet [ /PDF ] +126 0 obj << +/D [1362 0 R /XYZ 56.6929 741.6375 null] >> endobj -1353 0 obj << +1365 0 obj << +/D [1362 0 R /XYZ 56.6929 714.333 null] +>> endobj +1366 0 obj << +/D [1362 0 R /XYZ 56.6929 684.8157 null] +>> endobj +1367 0 obj << +/D [1362 0 R /XYZ 56.6929 672.8605 null] +>> endobj +1361 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F21 950 0 R /F41 1233 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1371 0 obj << /Length 2407 /Filter /FlateDecode >> @@ -5019,29 +5084,29 @@ SDôçÃÃ@x´»'¡w˜+
"1f¼ ù¤È,Üì £ù™0Ž–ïé3€>5áwâ„K¤`Á.ä›&‘¿——0*«í*
{ÿvÖœ¦º ΄ £Màõ¿|ŒÜHÖôA-08×I@t98ÔÌÁˆÏùMã혽B†·Ã³å `æp„²Þ "°q—o—^ÇãsÇM´^„ |UÀ1ø XžÆÛŒØ<âr“ü–«üû¦G Œ—¼{÷Ö-m»ðhŽ |€Jä¹ùç_4’ÏŸï>~xEë·°•z…)AÃK,¹pÝ׶½ÿ¬&TdÍ9³à¤Õ‚w:|d…êäÛ £dZK&œÈªVŸ±*Œ£_KSÐ=5m8#<ÌÁ,–JÍ#D±”îI—€-`ñcóÝÓ|Ä—×Ç:—üK³›”Œ üs ý1àÖº@TÿyÀp.ª…aGØ…~æII¨L>óznvFš¥Â¦ˆBE D¨3SÏ>º^ ÷µµ^endstream endobj -1352 0 obj << +1370 0 obj << /Type /Page -/Contents 1353 0 R -/Resources 1351 0 R +/Contents 1371 0 R +/Resources 1369 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1337 0 R -/Annots [ 1357 0 R 1358 0 R 1366 0 R ] +/Parent 1354 0 R +/Annots [ 1375 0 R 1376 0 R 1384 0 R ] >> endobj -1350 0 obj << +1368 0 obj << /Type /XObject /Subtype /Form /FormType 1 /PTEX.FileName (/usr/local/share/db2latex/xsl/figures/note.pdf) /PTEX.PageNumber 1 -/PTEX.InfoDict 1367 0 R +/PTEX.InfoDict 1385 0 R /Matrix [1.00000000 0.00000000 0.00000000 1.00000000 0.00000000 0.00000000] /BBox [0.00000000 0.00000000 27.00000000 27.00000000] /Resources << /ProcSet [ /PDF ] /ExtGState << -/R4 1368 0 R +/R4 1386 0 R >>>> -/Length 1369 0 R +/Length 1387 0 R /Filter /FlateDecode >> stream @@ -5054,12 +5119,12 @@ qª„Ñ«ò^ÿï>‹«>÷—
.13×…Óƒ!¶3¢SËAÕ”ih¥Å¨Š^…(€<Îm䦽ªšÛÆlLÊâ³ò7Ù n*Œ1½÷¨¾x¥Æˆpîâ‹&Xîܧ³±è\í D¤ß ä0}#XŒûž˜ ‹¸À>#^V °¡|2Îi‰9ÊÎr ) `˜¢Xh¡Ò& „hb—H°Œe"Ãê þrÓGçX 5¾û û8‡´ÕªOª«t–Ô ³$Ây°‰—BÒ›ÀÄ5©/¨vp÷o`kA“ôr ±ñœÓ4N.4Žæ endobj -1367 0 obj +1385 0 obj << /Producer (AFPL Ghostscript 6.50) >> endobj -1368 0 obj +1386 0 obj << /Type /ExtGState /Name /R4 @@ -5069,973 +5134,1043 @@ endobj /SA true >> endobj -1369 0 obj +1387 0 obj 1049 endobj -1357 0 obj << +1375 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [470.3398 467.2776 539.579 479.3373] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1358 0 obj << +1376 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [316.7164 455.3224 385.3363 467.3821] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1366 0 obj << +1384 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [304.6433 163.6578 373.3153 175.7175] /Subtype /Link /A << /S /GoTo /D (dynamic_update_policies) >> >> endobj -1354 0 obj << -/D [1352 0 R /XYZ 85.0394 794.5015 null] +1372 0 obj << +/D [1370 0 R /XYZ 85.0394 794.5015 null] >> endobj 130 0 obj << -/D [1352 0 R /XYZ 85.0394 769.5949 null] +/D [1370 0 R /XYZ 85.0394 769.5949 null] >> endobj -1355 0 obj << -/D [1352 0 R /XYZ 85.0394 576.3463 null] +1373 0 obj << +/D [1370 0 R /XYZ 85.0394 576.3463 null] >> endobj 134 0 obj << -/D [1352 0 R /XYZ 85.0394 576.3463 null] +/D [1370 0 R /XYZ 85.0394 576.3463 null] >> endobj -1356 0 obj << -/D [1352 0 R /XYZ 85.0394 533.5444 null] +1374 0 obj << +/D [1370 0 R /XYZ 85.0394 533.5444 null] >> endobj 138 0 obj << -/D [1352 0 R /XYZ 85.0394 299.6823 null] +/D [1370 0 R /XYZ 85.0394 299.6823 null] >> endobj -1365 0 obj << -/D [1352 0 R /XYZ 85.0394 263.0631 null] +1383 0 obj << +/D [1370 0 R /XYZ 85.0394 263.0631 null] >> endobj -1351 0 obj << -/Font << /F21 938 0 R /F22 961 0 R /F62 1361 0 R /F63 1364 0 R /F48 1238 0 R /F41 1218 0 R >> -/XObject << /Im2 1350 0 R >> +1369 0 obj << +/Font << /F21 950 0 R /F22 973 0 R /F62 1379 0 R /F63 1382 0 R /F48 1253 0 R /F41 1233 0 R >> +/XObject << /Im2 1368 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1374 0 obj << -/Length 3442 +1392 0 obj << +/Length 3579 /Filter /FlateDecode >> stream -xÚ¥ËrãÆñ®¯à-PÕf0˜Ar’w¥X®Dv$åQ¶÷0@^ P\íק{º -öV%Åü{zúÝ
Æ«~ñJ¥aš‰l¥³$TQ¬Vùî"Z=ÃÚ_/bÞ³ö›ÖÓ]ß>^|s#õ* ³T¤«ÇÍ– #câÕcñs„2¼Qp{÷þþúï×w—: ®þv¹* -~úáîšz÷Ww7×÷4ü%RÑínî¡/×R'"xÿÝÕ×÷´ž0Ô«ÿºŒã8¸º{ý–>Ü1Œ›ë+¼ëñŸ÷×— ¿¿¸~ 5}x I|Ño?ŒV¼ÿû‹(”™Q« ¢0Î2±Ú]$J†*‘ÒÏÔÿ -Ž@Õ¦.»Ž†Ý¾Ì+\'^"Ö±Qa¦AžgÔh{‡ª(Ê'þŠž¸~Å—dF$óQðT5öÀôDÛž—›‚‘ڶǚûMË«O ´,*2èïlstx£™ - fa¢#å°&$S=Š ôO•SRèÙºk©×æ¹Eþ±Hã®CÕóa´˜¿‘ÇÝ [²œ¸Ò{øy»Û×e?Œ‡¾cØ›³Í$Ï
˜O©!¦ÃLåº¥É 8‘Ê+p&ßÍ Sh\Ú(Wp©{]vÓ;rÀZió-ï ÉwÀìH -M§œìW ’bb0JjjþyoGó Ïì†!¼B‡M>R±þÀì蔇J2ز?Ÿ:å¢1><y¶ô~^ÏG ÔéK'QŽd ¬uÉ|Ä›é`×:6g^^s2Ù4¤†mch+àÏ5M÷Û–,Ä4ІAÛÓÔÁ› GéÏ&au1Ñ|vúä”'cÕ€ 0¶G¾há‰1÷b<JÐ4Ì"ö
r1áâô„ÆœŸsºÃÛ9»wø•Ã¥SËFyj¹…JBˆg½é>4ß)É~Áˆ'"”2ʼ¥'Û£L蹨Þâ[Œ^Û#u¶öÑ3ìAafG ÔLù¿li÷H3„Xîð$b|7å&œÙ´£w‡½ƒ×-Žƒ8˜!zÄ^{øôg°ýF ªÎ>Õ‹| 0Œ† #hD' Ø!<q‰²Á·¤SHsÑ3ÒãÑÍ¡,¿p~ªÔ´t„à3 ðå ºYac8°DàôdÄ‹¬Î.súˆ8òiçR ¨dqúÕ<(ËD›¼œã
F€[‰1æúS¿:$‰Bx÷$€ß y!&i/dù×9¹É^ xÎvÆÁý²DÀˆL§s pàìi
‰•‰ôW؆±ôŠÜ¤NêÖg“üçØ“Ý ®Ëf͵ÐIEQü;":ñµáðèØ–¤‚‹ ‰ -“ÞÍ(.šÜ‚Û9»ŸÃóètmîñf%¨ÅšŠŒÂL9ñ_fÉšÁÄ™xp«4?/sá +tßæ-Ÿu&NZ’…6.-¥NW³ý‰8äâdm¢³+ÙÖCod
lzÚwK¦¡¢Œ…J4dÆS´x G¨¡Z4¹F©±ÂT¨¦%!$ÅPÖá9$õΞ?TyÔX˜×’Tpóž&â,Sr<”åyÅ/IUg*]I
¶<RÖÞhñð¼¢Îý¤X7ì_OP±næ8ÞÀEªýü#=dîÚ[„È„*rÎdBÞH -råE÷ñ é8J -‘ŽP éuñ¶Xƒïz ¯B.o%óòT:ìú ·Ôt5¤àÀÙwTÔ#
©@
Æu_Ž„}_îö=
¨(Êœ ÃŒÁ)_Á o¯øÒòó¾®òª§2¦ -ŠL ½TŒçÞglJb ¨CTƒe¶®_û°‹çª¬\ aj3„2,`î©à µ79ZÑq<à[”2°«BéÿUpT(M< lS“ââ…»v°Z1˜°Oí±§DE²Òšœê;ZéJ>î«keë376EÙ凊é0MÛ–9O«Ìœ1âwˆT˜ÆC‚•×>ÛþÚ%J‡R%>7àšÒ[ð‹Åiêu¦ëÁÚb -ž|G“Œ…–œ4hv—š
·Æx©`ð›‘"ìÓ:ÕsÃ+CiqéÛœÇBýKjH늾7I
CC“lañËî/{´ZMÙ«NF¡íÚ ÏåET -endstream +xÚ¥ZIw㸾ûWèú½‡.ÉÉÓmg:/ñLlgy³ ’²8M‘.V{~}ªP”ÙÓ‡< ˆµ +6ÏÐ÷׫Çlí ;êÛ§«oîd²Éü,ñæiïÐJý MÃÍSñ“ùÒ¿ +÷ñþýÃí?n“È»ùûõV¨Àûñûû[*==ÜÜ?ÞÝ><Rõç@ ÿ{÷ +ì´ † wÐn ЗÝKÙQù|(›‹n\¼ëª®C/§úÄœ¡?®BñTë !²”¥0“Kíþb™ ¼`Í pÚÅɾömw4lj2:¨>ʦ IA3‘†Bùy(›¾jÒ(t4$MSIŒªŠdý_›zED Ê I dÔdZ +ÞÔ¡ k.7-÷î˜hYT¤dP>êf4ûF˜ò'&~&EjvM›Œ“Yý |®Œ‘BI×}K¥6Ï5ÊUGuÕÀ“1"*Æã ¿„œØ3Xúy{<Õå0ÕЇ¡gÚû‹Á¤ÏUXNqJB‡–ÊN4]+š9p$•5àLxöK<ƒBA¤±ëª\Á¢ætYèéý`Ø}¥Î<~ ¨Ð&ß°ÜÏõØ3±á y3 +îlgÛR¡¯Û3"s‡’^ƒ’š`í ˆIo¡dÎß™]PÙ“®ÿ6'É›=~lú¡ÔìXȈ™-R…¶¤W”µ~µôŒe›Eèk„ +ÒÝÐ#XXDË+Ó”Ç~ÐMn$‡Ú§´úË ÊĤ´ÄŸ#`\±TÙ¹ƒÆAâpìÌÚ<¯@ø…íº!$¤ §pè…ZX ëõž¬ò¹±ÎüÆ3ç?´ ¡ †Šx†3h"µV|8uÇÆ+‘w\£qýa ŠöÌ[îÌ;Ý ŒvÁv곚3mPÙWêaq ¨Là/8ÐÁÝ5àŸNmGÜ4PE*+vcc"ôÌŸÙ” Âðƒ¥¶ýD%cL<‰‘ÍŒä¶Z÷<e&Žò\õïçÈÍ]ŒÙ;Ö\' jÖÇ6pgj¬R`¢Ö5ÎKëÝ— ¯á„uuI³_·»p£}u¬:Må¬W`â8A%§ 0JÊ… ÛS;è3»a¯Ða“Tl?Ð:;eÁ¡’ôìÏ]ç¡L4Æ“cKëç…÷<jàÎP9‰z´¢#è`µaHf#Þ,ñŽsfõ5'€Ì܆͡9ô€?O¨y8´„n
•¶!§™xoœµ?sÂêb.âùböÙOƦ
+ˆG—2È,Ò6ü
]ØÞG<Kšx¯íH…ƒ~Áí¥ìA¡åH 4uåÛiôÌ…t +±Ìd'b|çJæìÛÙ»ÃØÉëã¤é=b©í>ý°?UÞ‡ª×»zΦ +j=§’úq’IÇ¥kn5 .
'·JíË4¶°AmÞò\y0SS•:5×R*ô5ãOÀ!O ´ .–d¬‡Ò, üÔïÖ ¡¢ ¥hÆcD<Ž#Ô”-r–QjÎð +´Úl8 <ëfXžŒ (Ñ q– zxûȦÐOžüö^þ‡9žï
Ä'“’G³¡ÄÝ?õ‘³ŽÞj¶š
%&êÀ*½ñâ Wð]Gjä]$’cä„ D"é€ FoŸH¬a™ú™®¼Àè™2i+ê‚ó1/=Ó’ Ü|ꊞW°Òâ“I¿| À)%í6N”+qìxfß ¹¥(wF$Œà ÃpbrÁÃÁÄ'¸M¾ +Gg\ªà
8"À`xbíl gC‹›d¬.â)h¨Ký©§¢cDߣɑb ÃЯ¿Tš*%„$¼Âî`ªˆ ™qÄgylþ; endobj -1373 0 obj << +1391 0 obj << /Type /Page -/Contents 1374 0 R -/Resources 1372 0 R +/Contents 1392 0 R +/Resources 1390 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1337 0 R -/Annots [ 1378 0 R 1379 0 R ] +/Parent 1354 0 R +/Annots [ 1396 0 R 1397 0 R ] >> endobj -1378 0 obj << +1396 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [464.1993 375.6003 511.2325 387.6599] +/Rect [464.1993 393.2115 511.2325 405.2711] /Subtype /Link /A << /S /GoTo /D (proposed_standards) >> >> endobj -1379 0 obj << +1397 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [55.6967 364.6613 105.4 375.7047] +/Rect [55.6967 382.2725 105.4 393.3159] /Subtype /Link /A << /S /GoTo /D (proposed_standards) >> >> endobj -1375 0 obj << -/D [1373 0 R /XYZ 56.6929 794.5015 null] +1393 0 obj << +/D [1391 0 R /XYZ 56.6929 794.5015 null] >> endobj 142 0 obj << -/D [1373 0 R /XYZ 56.6929 769.5949 null] +/D [1391 0 R /XYZ 56.6929 769.5949 null] >> endobj -1376 0 obj << -/D [1373 0 R /XYZ 56.6929 748.7225 null] +1394 0 obj << +/D [1391 0 R /XYZ 56.6929 749.4437 null] >> endobj 146 0 obj << -/D [1373 0 R /XYZ 56.6929 444.9381 null] +/D [1391 0 R /XYZ 56.6929 458.7525 null] >> endobj -1377 0 obj << -/D [1373 0 R /XYZ 56.6929 409.3397 null] +1395 0 obj << +/D [1391 0 R /XYZ 56.6929 425.4132 null] >> endobj 150 0 obj << -/D [1373 0 R /XYZ 56.6929 234.0098 null] +/D [1391 0 R /XYZ 56.6929 270.5184 null] >> endobj -1380 0 obj << -/D [1373 0 R /XYZ 56.6929 196.2021 null] +1398 0 obj << +/D [1391 0 R /XYZ 56.6929 234.9696 null] >> endobj -1372 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R /F55 1321 0 R /F48 1238 0 R /F39 1161 0 R >> +1390 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R /F55 1336 0 R /F48 1253 0 R /F39 1173 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1384 0 obj << -/Length 3163 +1402 0 obj << +/Length 3172 /Filter /FlateDecode >> stream -xÚåZÝ“Û¶¿¿Boáe,Ÿ$˜77¾4Î8Ž_ÛLãÌ”'ñ,Ž%R©“/}w± -ÛI´»æ&*ò†ú:º¯wô¢)Ú¶¬>Òè~KϜ޽߮˖FˆŸ8ÿñšGM[l¨[6ô¾©Ÿ¯×õ†Êª-vU¾¦^U´‡z÷©¡ií*w„sÚ
ß«²Z¢€sÎãLkaö1±zð½LE„»ÇgYÑó—ï¾ÅxÆ
5Û|QPóÓŒ–iŠÝC±¤Ñ×/®çŠ‰(wô—õb¿)à -\®UŠŽÑ¬H‘pë.ÃÄÑm±(ÉرèÇ_iðHî8h£{W§á±–FÍ Ø1›—Z¨™[.º¨Í3Âæß_åÁ¥¦À¥¢m
nÊÕx¥óÊÛrØrxël9x+íͺG©*Š¥õKøY±È÷ÖËÀ„ÀƒÀ+¯ -ªSï‰ gisáSeáø‡-rLÐð¹4¹ ³iŒÖuý‰ƒ¶p4¨ê)\f$ ^—ž†/…ö¯[8¯[4̵EÏžDÿ¼Ö:¢ª¬ëò%1ÇÄG²x1J·úº¬Ë.ƒ‚®ßµ¦jO½Ø4ežnŸx2ÆUáZƒÄ‹²C—-Žê¾ÃÒÃiÿ½ÛæW¾dæèa©wTvY“’àsȳo&”+Á ˜œfvù¯ížÀfxAÃãTIª¸½~{=OQÆ'gôôH ÄýSÕ¸¹':(ä½E€I¼ð š«mÔÂÊÒÖ’x±e#«0«|}ïÆÜn].õì-ƒô%™ÁŠì¯PÐdꤟԇEÐq•lº¨È~XL"ÔÆC,‹>UöT,#ýé -GÌôúƒƒîLÝëlÿvà\™„ =–u†){ïä+PCZTÒÁ–K¶Ån}Í£G{·g#oÕW«Æ¥>_AbÙ©;–#…iÆêgù4,¬8 -× ¡yË&üà¡Ý,mÅó8qMG,M—Û÷Dü“Å&‘>($Þñ ù¥ˆ”a¼§F±þ“ï -'®‰ '€ðãÞïíLŸ¡ó—žáÝÖ7§þþÀ
‹›<ûgŽp–ý·$Aš -wŒƒî¯±Ç[ÿâ=l†endstream +xÚå]sãÆíÝ¿Bo¡3'v¿¹LŸ®9§¹Lr¹äÜ6Ó$3¥%Þ™=™TDÚ:ç×Xì’KŠ’ìfúÔуö° +ú[5w—<Ùµ_®‹»rMe aäøÎr
¨£çìÅå„‘¼®Wé N¯÷üÂ4# X€d*yЖ„6E®fðé4ÓR
ø8ñ|[„Õå®ØÐdÕì¶Í®èJj«®ô`ÝmÑ…' JZ+j$b":Wz±ì´ªº+w5b™Nê²Û7»4ÙWÝ-v—Ü&e[î @‚nåµ{¬De&yë +–³/êÕ+ò¤¢´†Ë«MUö0Èþß”JLÇ;^›ÍæÁƒ +ÀíÛ¦íð®x|N]Ã㽺-ê é È…ì+p=RÙ4Y²-wáqŒJÀ'>·@ºÏgŒH®Ã2\aRlÚ†FA"0¬úÁ ˜EGÜy€Î?ì/"\ÊÖíÚ~wUªçl+PX6õæ‘´Ž†ÙNM¦ âÞ®šnÖ€zàÍÆÛ#I`lœ½yE·t0Ö´çr°¯×(YÎð" + ¶z[n=Þ0,y¨-¹ÍOÎGÍ Ö!šÚתð.¬+6 Çîè¦q } © SP}]UOl
üëœeÑ¥Ô£›3¯`œØ MX¾ñÀ«¦þ…1ñážÎ¾¦UgŽðÿ¾ÙíI*kBP„ç»/wUélÓ*t9å¶íôæ¯ÉRiLp yÚ³}èo„„ÂþbãRiž2™O¬ Ä,þæ,å—#NO§ +œŸå6ïq.UFö{ˆ\Øl-–ƒxö rT—†LD¯è•Ž«h@Ñ® üŠH%ä€Aj<XR <ýÎz´8![Âyl 9çUve + °®‚ê¯÷ȃr P1¡N^~8¢¸ƒP‰Áp_„5WÔÈdÓ4 éP°ˆ•©ÃáÂ# :}]nª‡€Ãómwp^O4.´Å n’\jPG èújIŒÕ1"&ºx1)¶3!ßuUœß \‡,`®ï4¨MSÝé „²sT/Þ–~4ª»¨6ôµb=¦3î; ð_{.? Ý2¦Œ»¼“ŽÛÄŽ5Ýü ‹ì‹™»‹M`ÁÂ’ÿܱ¾0ÇN8O3%5ù™7—KÃ3þsFÿÁPGYÿ\'nŽÜ×´/)uh·ºQùH#ì*mý*iG.aq÷å¶Ø¼÷kþ ÝE\šUu1,ôY“ÔQñ.µ€†¬&¾m€CŸ¹ËõÜ
téË“µ;Ëéúô]#f‡ëƒ‹þLýv>Ê~û4p©¬!?=q7 +3ƒ¾ý4ÆEý ùa[î6—<yt/Q\Þ†VÕ´ÍÚG,?Ö>:¸/íôö99»*Þ€góÊù×#·tÒ¾sõu¤CÞC—rò¤?Þ=ò<¹x¤½ ú¼ßJÁŽ¼˜•qC7CKú&zÚv ùÜy¤ÿ>×c Rw‘‡Þ,EˆOÿÜj<3Ë9Íg]aä°‚ÜoŠÕǾuzDîÑÛ¤HÐM}Ή¶ÇZ«AdÌ8¥srík1n¼U»QCÿ¾K £í¥Ë2(ƒy‚¶Ý¶2–2Àöm}‡‚dÂu0н“>ph =”vÚyœyAéF*m_»îöLö“§ÖÈ’èxTùR>Ê0ÛSöP³O²wo?)5€}âá. Õ)®_ÞNne‰= <ï*XÆCUr|åóà!Q6`×ç 3†pª±î£¾‡ îÚ™KÑ~Bt¥v1º„Á…5ϼ~ÔY +åk~ðú1 yAä !
Qwìeë»7ÊùÅ/µ¾8ö–Y +CEÕ0´2ÂE¥Ï¦D1ÑÎÊNSí¡ÉNÒv+3&û-¤thÊYÈ6ÙÈ[NÚã3õˆÔ©6Lž¯ñefõj.õÌ‚NgÆ5þ1
J“f"³g4AÐ`€:¯ÁST#
NÉÎk0&û¿Ôà™~ ÏŒ}Fùü”# ÌÇ-Æ㊧Q÷œ"#¨Š PçyŠj¤È)ÙyEÆdŸ®Èw >B8*+µ<øIYÅPÇeÕC•ÕIªƒ¬ÈÎÊjDöjè)MjÇðÞox8Ž”£igc¡ÜKùдΘ1ãóë!G>*ÿcYÛ“B 7?¿1gtAÐQ€:¯£ST# MÉÎë(&ûÿZ¸Â¯¡Ä™êb¨ Pç5xŠj¤Á)Ùy
ÆdÏß2Ð(}’t^‹Z¤áeOÒ¢yvTù/µ¸XJ ˜³<Ÿ\ö²ÿD!SÔïË”ÿNKEÝ ˜ôµ4þ+®SVŸ…Îb¦ü—|n¸÷Kÿv¯Âp´.ÛÕ®º¡¯3€ÔMó€_A=’¼iº2 *º0 +L…ÿ1NÌÑlyÙó¨G¯‰ÿ<©EFoc§wòæPdNŠ-Z|lîwçAQÙQ†Î_[–S“V «¤]púÒô1'mî>,hðcdÜ=ü2~àиñ¢ ÞÅ_ÁÉ” pã> 3sp¿Ð9¦¸¢WÄÒ²Tkk¦oâð4©ßÇ‚?QÀqâw¬3|³þÕ?ü¹ìàØÔoÖŠy HfR+ò,0…g<tjýwµ‡¬ÿ íp~endstream endobj -1383 0 obj << +1401 0 obj << /Type /Page -/Contents 1384 0 R -/Resources 1382 0 R +/Contents 1402 0 R +/Resources 1400 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1337 0 R +/Parent 1354 0 R +/Annots [ 1405 0 R ] +>> endobj +1405 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [417.8476 110.3446 466.5943 122.4042] +/Subtype /Link +/A << /S /GoTo /D (sample_configuration) >> >> endobj -1385 0 obj << -/D [1383 0 R /XYZ 85.0394 794.5015 null] +1403 0 obj << +/D [1401 0 R /XYZ 85.0394 794.5015 null] >> endobj 154 0 obj << -/D [1383 0 R /XYZ 85.0394 714.7215 null] +/D [1401 0 R /XYZ 85.0394 769.5949 null] >> endobj -1386 0 obj << -/D [1383 0 R /XYZ 85.0394 685.6298 null] +1404 0 obj << +/D [1401 0 R /XYZ 85.0394 749.3028 null] >> endobj -1382 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F21 938 0 R /F39 1161 0 R /F41 1218 0 R /F14 964 0 R >> +1400 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F39 1173 0 R /F41 1233 0 R /F14 976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1389 0 obj << -/Length 974 +1408 0 obj << +/Length 735 /Filter /FlateDecode >> stream -xÚ½WKSÛ0¾ûWx893µ¢‡ŸÍ‰Bèc:LKÒ^ ãHDZRË!¥ ÿ½’e;–C§”Nf"iµÚýv÷[ÙF6?dûb Ûaì "ßNW´¯ÅÞ[ Õ:®VrÛZoæÖø„„v â -HÖ> +;
:Dá~î©Ú¿" zª{HäKa¾kM´àY¢s×g6±ÿ-+*WÆ°[¤àã¾câdž Fdo«ýa…Ñ \-/[á^k›Ïî^4Ô½‡Éë¥ç÷Îs‹ÿ*±¦ÀC
Ðͫ鳈ø@~ËÞ.aƒäÙŸL_‹âýS¼bbók*#àEÂH
J…¢ rýmÕ‡þþÏÄÔendstream +xÚÅWMs›0½ó+˜œà Y €a|r§m¦“IcÚKšÅrÊ Gïɯ@ ܤNÓÉL‚–§ÝÕ{om›Hü`Óõ À tvÍ83y!Þ}4ð´Q BctHÇf +:=øncŒéñþì µ¥z8œMí±c…ßNgsû<<2faÓiû4ѪÍKãì ™ q¨#Aø®y#â ff8.…®C©Š¤ÆÜøÚ$l½·jÙÁê
=ÖÑãУ„ÖôDqj!+Y•Œ¯¢´Ëù Ä ¿Ñˆ8“M0¨‚>Äíàã¤"Ct…FN7=»Õ¥ÿe’¯@².ÀE~1ÎÒÉnóuorTU
` ×%5B¨¶Ë0Ö‡%z™ó›ˆ/dÖ|•ÞMt¨ÑH:è2ï O® +Ư/t-lvWo{‡ Ý‚Zr*4Р'ºzªë"ÊÖ)“ÏQšæ7 äѪX2.c?‹V¹¢€‰%Ö‘ ÛºÑr%¶õÄÓÈYQò$.åêòŠñ»M_qÌ +-k²l úðÌ´“g.û‹F8‹¯x! >÷d[z!¼§Â@ëcýè4Í„Y” ÷B ]:^#öŠ¤d²Û:Œól¯mGµ©s€ònÝ©¥¥v™¨†ö²Q¿ÈV9¹2ÏÔ$‰ <*“kÖ(–§We£@åÚ§meg@û šÀ-Vy[ãm™žúÏZ-Š4RÜõ]u® /uy抺ԟLQŒú5´ã"=6ôeD·Òü_Æo¤ð¶Áï
°Êù^7½M…É»ÍÒî³óêÑéÍÀKˆÅ» À¯d÷ÿ MÞMÝ5šº°ºûj.½¨cç+öÓÎRß'Íí™Ö홌}èø"ɦ©ªsì÷:Wwñ~ë¿ÈUendstream endobj -1388 0 obj << +1407 0 obj << /Type /Page -/Contents 1389 0 R -/Resources 1387 0 R +/Contents 1408 0 R +/Resources 1406 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1392 0 R -/Annots [ 1391 0 R ] ->> endobj -1391 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [389.5011 743.8714 438.2478 755.9311] -/Subtype /Link -/A << /S /GoTo /D (sample_configuration) >> +/Parent 1410 0 R >> endobj -1390 0 obj << -/D [1388 0 R /XYZ 56.6929 794.5015 null] +1409 0 obj << +/D [1407 0 R /XYZ 56.6929 794.5015 null] >> endobj -1387 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F41 1218 0 R >> +1406 0 obj << +/Font << /F37 1038 0 R /F41 1233 0 R /F22 973 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1395 0 obj << -/Length 1076 +1413 0 obj << +/Length 1364 /Filter /FlateDecode >> stream -xÚ¥WÝs£6÷_Áä ÏYˆæ)wq®¹‡ÌõBûrw“Q@ØL18â¸þï•°Á–}I3ž1Ëj?»Ò -dAñCVH -"ˆˆ•¬&ÐZˆµO¤eœ^ÈJ}ˆ'³7°"ùØ·âl`+0 ‘§ßì¿]}‰ç_§&ÐöÀÔ!>´¯®ÿœ"„ì«»ókµt}w¯ˆ›ùÕ4ðìø¯sÉA8’zDkÆ÷·Ÿ¦?âÏ“y¼‹o˜‚® îiòí´R‘Êç nk#^ @Q„ÕÄ#. žëöœbr?ù}gp°Ú©š0!nHˆ( €ù Š<b$¾‹Ý”å
«ùÔñ!´ÿQ`€| þÝKÅù÷Rf*Ü9ˆÜéfU½¡uz¨n¦EQmœ§–ÕÛ‘t^ -ÿ%-¸Y
”›š–<cµY¿µÓßibPÆg7`®\|ßëDæ/Êœê€ïÀGP^•Š±¬x#˜è S8«Ÿe\’Nªò;„xñ«ò5*ÁΗN+)Œ Õΰ§óC‘d† -ú ÄQÐ%ÑEÑaä»Ï‘ãÐÿÔ”fendstream +xÚ¥WÝÓ8ï_ñÔJ$µóÛ§…]¸åqл@È›8mtiRâd— ºÿýf<N7-î‡*Õ“ñx>~3öØÜaðãNy,ÈB'ÉB/b<ròíŒ9k˜{9ãFÆ …Ü©Ô³Õlù"HœÌËb?vVåDWê±4åΪx?þûå›ÕõÛ…ëGl z 7ŠÙüòê¯ç|~ùúùõM]½~GÄ‹ëËEÎW¾½F÷3\™•«w7/ W¯f׫ƒÓ8 йϳ÷ ™S@(¯fÌ ²4rîáƒy<Ë|g; £À‹Â 9õìÝìƒÂɬ^jÃ$ +R/JýÄŠïÛ@‰2/ü@ƒrý¥—]#jŠø‹ØP}Õ6ÄØ´ª&?AFÉîNvDçmó1ý‚±|ò‰Iæ¸ï± ü@c";1cóª!«Š>¿ÒÀßã±ÿl釆™!3õø”ùïCõ~àeˆô‘zùŦÞæV;å®[w#;yF]¨Õµ;?è@ ν,Š|Ç%‚êÊó¼qù8ÿ{¹$…Jlwµ$ZÔu{ïöhT‰°"SÑ´D·ÔI8RGÆmKM¼
,û&@›+…,ÅP÷ôñyÝÞ¸•çR)ÛJ²:5&E³?c‘ Yì¤ê»*7&s‘oäO˜t' ¾žÔÅIü +¼¼Ý>y¤üÉÑ~¿3«·°Ádg
²¬Fžl—d¤l[màâ'ËúQvÎÚŽ +غ–›ÅØ‹cQRtù†p9³e±•cg<îgþω¶’8/ À¸ÃC/cߤú|4ºƒ…Ë{¸·XRÖxB[bµ© úü8ž£ AmÚ®G2š¯‡ªÄí[3+û¾jÖô1ìh\-àâ„õ'r“`‚è‡nÁÓ¹4&0+èžÉ$˜€Äɘ8Õ ð®ú½qÓpŸÝ¼¾òˆ¼ém°Rå]u‹6 ÍóhÖㆡG, =k.7C'È02‘SaVÞ˺>álDo1!(bú *˜ˆ‚¸%Ö6EU" ·-N7F_) €{j+•ªÉë¡ <L·ÁN/ju‹¥Rš; iýÚ#´ñ·Ü›E¢)ˆÔyqUÓ ¼ûªßEIOb¸ùÂí G>H$¸ZmEWÕ{úTÃnu‡Š’˜JXó5TZ`¼‘&”ECނω C.·Û¡©rI(‘ Æ2Obƒ™vTPGÐÊƃ^O•úp±ê«r¯Ÿ
O'®(e&½úª€=Yæ΄$lg% .À•ñù[} +ÑKL æ—Ä£´ïéãÓ© +ñ¦lÌ.Ù´C]çÚ¦§‚7nœ¿\ê}Ÿ¤fß'Ùƒzä’£4>U¹„J9$iè‰}óÆ5 ÃÆž9ò'+eÆF
z{ãq’W°»Š8ƒê&' €n¿ëÛu'vre‚íÙD ¾-Dv¸ºüò“ôá
&^¦¾ýµ°ØKý,B˜yvêùáíúëÿ¨6Eendstream endobj -1394 0 obj << +1412 0 obj << /Type /Page -/Contents 1395 0 R -/Resources 1393 0 R +/Contents 1413 0 R +/Resources 1411 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1392 0 R +/Parent 1410 0 R >> endobj -1396 0 obj << -/D [1394 0 R /XYZ 85.0394 794.5015 null] +1414 0 obj << +/D [1412 0 R /XYZ 85.0394 794.5015 null] >> endobj 158 0 obj << -/D [1394 0 R /XYZ 85.0394 146.2062 null] +/D [1412 0 R /XYZ 85.0394 223.4026 null] >> endobj -1397 0 obj << -/D [1394 0 R /XYZ 85.0394 108.682 null] +1415 0 obj << +/D [1412 0 R /XYZ 85.0394 185.2496 null] >> endobj -1393 0 obj << -/Font << /F37 1026 0 R /F41 1218 0 R /F22 961 0 R /F21 938 0 R >> +1411 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F41 1233 0 R /F21 950 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1400 0 obj << -/Length 2431 +1418 0 obj << +/Length 2265 /Filter /FlateDecode >> stream -xÚ¥ËvÛ6vï¯Ðé¦ÔIˆ -²˜ð¡” Íœù÷¹¤(™yÌŒ½ pÞ÷“â³ -‡Öÿ8A™G,‘¢§ŒaùX †šÃ? 9‹0q;…s§ðª¢P0¾¬ÂªÙu.2qÓÒ³¨Ð -ø„ -ÇRÀQÀUµ7sN}ôE»0Ã%[†ðJÓ9Ã#
Ã&|ì,Cˆ=ž }lð²Å¾k*(Â9!qN1󇡲ƒ<…R€–eóPÔw´ 7EYÒênðfhY°l ‹Ô}Óæ} -«æ^³©Ôü{Sßa “„ÈÐÊy+mÀY»¡É‘t•N ¢µÝ7ÞÖÊý - éšµFw‹bïMÓ¹ËÝVuýÊ*õ¹¨öÕ@ƒ¥®ïÐÔˆ -Ži#ââèqØ—SÌÀ¶‹‡„Nû®¿E¼œ*T™„ô rü¿xÂcù$À?}ÏýtùäiÄ$8æ1{„’£9·6 -jʳ©d)Y†ÓJ0$4BJæ(EéÏ6ó®çgCEu–¿œ]ìz¨Ö{Ó¿¥\YSN¨Q
±û¡=›ÈçIÂx*³S—µ‚Yoû]ýt]~x•ýñ¤1üç@‰ëÅ/¿|¯ç©ù zÇNì¿ ÉCÉÂX|[Õõu¬_ÔØTaðy=Ì‘SB¸ñZÕ{UþOÕAÈä”#Ÿ´xnãáEµ³ñ0E˜õÖÖƒìk0«Õ¹Cj;€bÖ¼Ž£AÆ”àž‹;ÔDÞëÆ8¢‹ÛË›‡ØZÔ8ÂCn„ͽ*‹õTn=F¡LOßǦŒÙWä$Ò0xÔ§of$g -õ¾ìŠ]y"[ê9ü%¯I=©cÌsÐ.FSñöX +xÚ¥Y[wÛ6~÷¯ÐéK©“% +@aQÔyµ£iïŠ8yÈ‹‚F» Ïx=M‹\$>hœ&W]sN³ë7‹Kÿöz!”}mԆݽMÖ®çÜkòU¶± Võ}fô‚íò[]í2 ±D¨¥‘Å+M +Nƽ“š2:Š` +„®ìNgx8»u+–ª‹8¶3й=¨ ©¶Õ;w"ßU„¨Ø~ ŠŽRâ×êçSîˆ(•AHÅ +€u¾}¤1¡ +/ ‚3ÉÝýsÑÿdiÙendstream endobj -1399 0 obj << +1417 0 obj << /Type /Page -/Contents 1400 0 R -/Resources 1398 0 R +/Contents 1418 0 R +/Resources 1416 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1392 0 R +/Parent 1410 0 R >> endobj -1401 0 obj << -/D [1399 0 R /XYZ 56.6929 794.5015 null] +1419 0 obj << +/D [1417 0 R /XYZ 56.6929 794.5015 null] >> endobj 162 0 obj << -/D [1399 0 R /XYZ 56.6929 662.3153 null] +/D [1417 0 R /XYZ 56.6929 726.8027 null] >> endobj -1402 0 obj << -/D [1399 0 R /XYZ 56.6929 634.3021 null] +1420 0 obj << +/D [1417 0 R /XYZ 56.6929 697.6944 null] >> endobj 166 0 obj << -/D [1399 0 R /XYZ 56.6929 587.9857 null] +/D [1417 0 R /XYZ 56.6929 648.8841 null] >> endobj -1403 0 obj << -/D [1399 0 R /XYZ 56.6929 564.9659 null] +1421 0 obj << +/D [1417 0 R /XYZ 56.6929 624.769 null] >> endobj 170 0 obj << -/D [1399 0 R /XYZ 56.6929 418.0778 null] +/D [1417 0 R /XYZ 56.6929 472.4047 null] >> endobj -1404 0 obj << -/D [1399 0 R /XYZ 56.6929 395.0579 null] +1422 0 obj << +/D [1417 0 R /XYZ 56.6929 448.2896 null] >> endobj 174 0 obj << -/D [1399 0 R /XYZ 56.6929 306.0653 null] +/D [1417 0 R /XYZ 56.6929 356.0575 null] >> endobj -1405 0 obj << -/D [1399 0 R /XYZ 56.6929 275.4022 null] +1423 0 obj << +/D [1417 0 R /XYZ 56.6929 324.2991 null] >> endobj 178 0 obj << -/D [1399 0 R /XYZ 56.6929 229.0858 null] +/D [1417 0 R /XYZ 56.6929 275.4888 null] >> endobj -1406 0 obj << -/D [1399 0 R /XYZ 56.6929 201.0727 null] +1424 0 obj << +/D [1417 0 R /XYZ 56.6929 246.3805 null] >> endobj -1398 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F21 938 0 R /F41 1218 0 R /F39 1161 0 R /F48 1238 0 R >> +1416 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F21 950 0 R /F41 1233 0 R /F39 1173 0 R /F48 1253 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1409 0 obj << -/Length 2729 +1427 0 obj << +/Length 2935 /Filter /FlateDecode >> stream -xÚ¥YYsÛF~ׯà[¨*s2ƒ\›'Ù–%k'‘èÚÊæ$@ (hZ»µÿ=}
²*•âæìéùº§/š™†Ÿ™%¡Ò6u³8u*Ô&œwzvsß^Y³ð‹ÃU¯—_¿³ñ,UiD³åf@+Q:IÌl™ÿ2óÝÕOËëÛËEê¹S—‹0Òó«·ÿº4Æ̯>¼¹~ËSo?ÜqãÝõÕeìæË·×8¢SXçT$;—?\ÿûò×å÷×ËŽ¿á Œ¶ÈÜ ¿üªg9\åû lš„³#t´2iÌv.´*tÖú‘íÅÝÅÏ ÁÁ,mÂ$´‰ -“ ž -Û Œ<ý{ñÄ
¿ji’y±®ï«ò¿EØ /…H4ßY%+Û‡LÎ(7~D¨6ÅþS±ç¶,ÊO…lÌ<©¦ÉîýŽò¾*rž_=²Ž\¢0_¡\ -TE¡,EÛŠD6õž×ƒ´ûõÖ(›TÖ#f‚j`T'~Õ+¹ÇæDæ7?u-–›Ö›‰““TÅ6H'S';¥£ÔßÇCgÀ.ª@ÙL *mT†)èZª’$fåöòt¿{ÿ#™y¾žÆ/¢´ f|óÿohÿâ„ -8¶éÚ“±pnÂêà< -%ZÞÝ|ÛG3Ôx5^+¯(¦ãö0ŽûzûrÄóúæ&‰™g<vœ8ÖË…@À¡*çÆ>«XÏ -¢Î@‘ ,þe‡LŸöZ–¦’ë¤R‡¯`E˜ C{Þ5ôÜ/
-[j5°& -˜Òb,ÜðIËHU ¯7õï¯
þe;‘:è.¢þÛÿ ÷…»XÙ$y&˯’ =Sh`N9ïþB>gýOJ|endstream +xÚ¥Z[sÛÆ~ׯà[©ÙnÍ“l˱’ÚI%º34‰ˆI@!@Ëj§ÿ½ç¶à‚„¬Étø°÷³g¿sö\Ô3?=ËâHÙÜÍÒÜE±Òñlµ=S³{ûáLËœ…Ÿ´g½^ž}÷Φ³<Ê“Ì–w,RY¦gËò×ù›÷¿,/¯Ï&Vs/âDÍ/Þþã\k=¿øøæò-½ýxÕw—ç©›/?]_bÊaž‹Y¹üéòŸç¿-<»\ü…gÐÊ"sœýú›š•p” ÏTdó,ž=BCE:ÏÍl{æbÅÎZß³9»9ûû@0¥¥S˜Ä6‹â̤ =Ó:ÊãØŒP‰ó(±Æ*°"rç ”š_5]¿Û¯úº¹gúuÅ•›j÷¥ÚIgË姮:šõSõ„ˆÀ¾&†šÁ`ät–Ò†7u³‚ùVeóÏÕSǵbw®³9uçón-Í’o«þ±ªnô-WÖm×Ëê¶Ù<‘_AÛXf:aëÛ}×3ý[íÛìð¸öäŸa©o=+\=pY<_Âfph<æ€5 ó®ÝlÚÇɺã²(K<VˆcϾ{çt€šÖ„”€ä‰\SlaÇUÛÜM œ˜È$I,Sÿ¥”ÙˆDîÚ Ï·y0ßêȦ:—ù¤ž jt§™ŸõJÎqw$ó«_†ƒ1`œ´½›Ø9Ë£Ôš,ØÙLíì"•äþ< :
7$2‘ýëZ ët”Äq5
[àR/ÿD –së?$3/°‘äXxЂ˜¸çûÿ~OëGØÐðàé-`Îršóa¿éëSšË–&--ž¸ëV† ÕªéQ p·ûž‡Hí©ÆÒ€å(û]'ã ”¢¬6O@YkÙ¨¬™0Üö/²UÙV²¢i{ž +×uýE#ÛuÕŠ÷ ñ”Ì»v|ˆºgÉñ¡ r+JCQi¸xlw›rÁ$‹²¸õÚËš
¤³ÈÄ)[‘«)íÊ#g3û’Z»È:èQ¢!MI‡N‰” +n2³ì«N¢Û<ZÜBÉ Ä4Úã±Þl¸v+Ã]}ß• Ñ~-;¬eA÷PjÄæZ¥™ŠOÔ˜lb4”wblò2RÁ56A,ÕW`@DË:9êCÛtU76pÃqPøäG3¼^„3åà¡éÀrmt¸ÙÂLs«½Š$Äð_—®ÞÖ›b'¾è«-Ü%n²O KUq\7î +ï~¿+úºm¸s0ÚT~bc
ÇÎrû}}„ 4wN;ˆ$Fcª_6ÓàÕý6$KÂû¾©^â8ëåøæL©ÄÄÅVplÿÔ±EïÇ!p~Â*°Ø6€+uCK´¼¹úáÎPåuÑy¼X÷Œã®Ý¼ ò¼¾úˆ±e¦ç$Þûr!°«)¹²+Fæ3ÀZTUÌ +oþÆ•²Âá¦F5"HÙãà=`'З ž§]ˆp¥‡Àán‚R +–ÈÉ8Èx÷4E%‡ðc~Ÿ ÒH½ZÝ]µ› q¯Ñ¹û…‹pŒaAè—ö%˜)Š¶§Þ,ÞO6=°6r¡ zØØz›ÄóuAÃèkÕ× ü
É &@¡—àæ.Q>蔀†»–ˆ;Š5¹ï¶%¯
K>“–Bßc»ß”~G ++ðäU9‰ŒŽÒ\§§>ƒT{òLêwèŒ/ïŠíƒwÞí÷Ûg˜Ï¤éHßB© ‡·™rz +u ?ðÉÉ“L†‡ÚÙÈ(ÃÃѾaÄG8|3ô{.ºc¢xzá¡^>A_¯¸Á» {Ê=˜oj$¼› +ºOlècÑzÐÛ§Q”5—r ‰°ŒqSö G{0\´!Ƭ3ö’ Ü2\äÄ%cm¹©ªã¼Y+Ì•‹áJÛH¥Î`˃»ûW®ƒ”w˜¿pÊrvJ—X‰ãÈ À¬¹–’,Ê3ðBá'¹÷0ë%FR ¹1‚Î7”PYw«}×
¼µÇr߶>)•ðØV_k —OE¨c°ÕÆx[Íê¶xh7õj*IOÐäZ!‡0iÚ‰ZÈ¥RK·éȉ&âD/w»v×½ìÙ éTâ®+çÌÐGÇ׉7ŠÐ3h7Ôƒ°Z«¢áÉâJ!½ârŠ¸´‚L°Øp£Úñv;´Ú&Ï0 âÙ}„ZÇ»H|=tu+›¶YL¥Br¦ûqxYÀ¦¤¨©£ ÛäDúßý|ýáòúš‚²l)µ€öÀ¿rÐ%á¹ã¥¤hû Ehwüö‚£¬SŽˆp•=ø+È(9"‘uÏ b“Y?)ÛTÆ›AÏ}Y„¬‰ ›$
å.À8:FÆ:0 {Æã€ñ!7ÈC I +¨zÝ“
5aÔퟖˆXëi5eÀ¡8â‰sNä2c.WyÎÄÜ Ä|”Î&>]XCÙ%¬-Ö¤¡¶àÀð u¼Âà#X h,†±Žæ5\î›ÏMûØð*ŸRáš“lûÃÄŽ—±–ÁÊ’m&ã<ÎZ-$¡"dz*ˆ°Pkn®Ú²âi]Õ ‰–Ë×oñù•S@ê!¡,x…ßB„æ€ Ô´ŠWë +»¾›m1½U*ÿVy‚3,œU*ÏŽÉgêÆhC!"dž® +öÒ÷rÜò0F ;Ráû“Œ43€-Ȩ£ìæäÃÇ€q–ï"¥´O2žÁ +Ò*†'Qg Höî‰kÌŸòZ–ç’ìäò¥`E˜ C;^PttÝÏ5-[ k`N.0§Å`¸ã%’—!‘¦ +7[døÙ/ÏŽl©\˜G¨Ð½7Þf«ù[Hï4?ÝW‹÷Õf³¥ëèSª¯¨÷•g±¥§Q:xçÙ: ú}‚X Òäfàªâ‹ì]pÇ4 8A„òípc´Œ®W±é×íþ ¹³h„k +ò-?ÎCño _iòvËõT‚du¹|Hyž¿ª1¾ð¤ Ká$î´ô‘…»‚H½R”hcð|æB±=„” Wào8¦Í9} ‚Aìie:l5œÑJ"eò£Ðú™›g 1O•Ñ/žÝ©tôÎç'ù‘‘ÉŽŒLîo*ÔØ»ù¤eø{”Ljeñðflðe]åÉø +Ÿˆ_–œœž/Ëâ÷âñÌCysI/6ÝÑW‰}wüɶ¬6Uï?J„@ >Žù콟㿇 ™+Šü¥n÷ì UôÜ¿ ,$ÐÖN½G¨!Mÿ¿ÿypø«…K#›eÏ<lÀýŠ2“§ž)„Òèc·¿(œ²þ?G°±endstream endobj -1408 0 obj << +1426 0 obj << /Type /Page -/Contents 1409 0 R -/Resources 1407 0 R +/Contents 1427 0 R +/Resources 1425 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1392 0 R -/Annots [ 1413 0 R ] +/Parent 1410 0 R +/Annots [ 1431 0 R ] >> endobj -1413 0 obj << +1431 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [101.3082 326.601 169.9802 338.5012] +/Rect [101.3082 379.428 169.9802 391.3282] /Subtype /Link /A << /S /GoTo /D (dynamic_update_policies) >> >> endobj -1410 0 obj << -/D [1408 0 R /XYZ 85.0394 794.5015 null] +1428 0 obj << +/D [1426 0 R /XYZ 85.0394 794.5015 null] >> endobj 182 0 obj << -/D [1408 0 R /XYZ 85.0394 718.5038 null] +/D [1426 0 R /XYZ 85.0394 769.5949 null] >> endobj -1411 0 obj << -/D [1408 0 R /XYZ 85.0394 691.1994 null] +1429 0 obj << +/D [1426 0 R /XYZ 85.0394 749.2913 null] >> endobj 186 0 obj << -/D [1408 0 R /XYZ 85.0394 491.8561 null] +/D [1426 0 R /XYZ 85.0394 546.785 null] >> endobj -1412 0 obj << -/D [1408 0 R /XYZ 85.0394 464.5517 null] +1430 0 obj << +/D [1426 0 R /XYZ 85.0394 519.0032 null] >> endobj 190 0 obj << -/D [1408 0 R /XYZ 85.0394 313.1885 null] +/D [1426 0 R /XYZ 85.0394 364.477 null] >> endobj -1414 0 obj << -/D [1408 0 R /XYZ 85.0394 288.6895 null] +1432 0 obj << +/D [1426 0 R /XYZ 85.0394 339.5007 null] >> endobj 194 0 obj << -/D [1408 0 R /XYZ 85.0394 127.0564 null] +/D [1426 0 R /XYZ 85.0394 175.6792 null] >> endobj -1415 0 obj << -/D [1408 0 R /XYZ 85.0394 94.9508 null] +1433 0 obj << +/D [1426 0 R /XYZ 85.0394 143.0963 null] >> endobj -1407 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F21 938 0 R /F41 1218 0 R /F39 1161 0 R /F14 964 0 R >> +1425 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R /F39 1173 0 R /F14 976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1418 0 obj << -/Length 3319 +1436 0 obj << +/Length 3227 /Filter /FlateDecode >> stream -xÚ¥ZÝsÜ6÷_á·[O³*ÅIlžÜÄiÓÎäz±ïn® Ú]Ú«©VRWZ;î_ -!Ýú{Wׇ²!ößÝ3±¸OÛ}Ù<8°6ÅêÛvØǾ퇞xÊ#ΠQûSE ± -* yí’Ë" Ã7ÿÁ -GQÖþ== tÊ‚ŠUO}Kü¡¯ib)4v{¡á¹qô쨷w
«ê(éñgÛ8ô¾ÈVw`fP -qj_ÆÉ_áÇ}ûþÃ[([Yzø…˺öbâ™î tíÑ#7 -š*Ð6eÄ m`€‹ Q£É’(ò˜ÜùÌ+CxVŸWTÐ1#ô²©ƒµÜáyÅ`{ J!ÈÔ6 t -Ò6,ì\î1„Y6Ïã,K;äSäë33…ÄIˆÏ‹Œ6kC•ÃàÝ0ÇeuKÎåšÝ×ak ˺ÚÅžÙN`º´ g6GÀæ‚qWïÙ§ -¦<ÁÇ`’_Œ¾oŽÏÝÐÂíöÕ–É$öT”®3ÚBkøÎÁf3€A„žž]Û÷Õ¦vô6@$ÚSl"l‚´=wÆÉnÝöt¬†gzC3“àÊNíg3Ð8Ö ¤àzm=»XP -Å ‘ -!!’<Ëóù)YL“‰L>EÐ@
W ë*‚Ÿ+Ó̽m Ä0Ê ³ DÚ !ŸÇ©1Ñ‹dá^¼)\Ge >3\÷pjÆTfL\:$" ·ƒâœÒ}{ì©“@Ë„©+§âeÌËì«zGlòx$Ëâ+’ Ê…ãÉZ‹Õ5f?íÇÿÍçREá”ó¢†Pe ÷°Î@õšZoBvL~&2'[5Ÿ×¡ž{¯JzÇHÛ²+9™«p%ÓÖ„5¡T\P*@Úp‘ǨÐN‰Ç>! N0ގ͆1Å S¯²·n^N”›)‘áf¹t¶ -Õ—¿%¤ES29ЕR @×’À ’üQƒguèj‚ÈC¤M`Á¢×QûýÍÝ»×Ôœ +xÚ¥]sܶñ]¿Bo¡&>ŒŸ[NœLÝÔRÛi> x$¤ã„GÒGžeå×w»À‘'ÚéLG3°X +Y\æEk‘èËj!. `îû‹„q6 i3Çúîîâ›7*¿,â"“ÙåÝýl/ c’Ë»ú×(óø +vÑíÛïZø—\m¤ÈU ½úáúç»›÷0ÔP ñúõ¿®’$‰®ß½ºyMS¯ßÝRçÍÍõUžFwÿ|s{õûÝ7wÎ9/‰PH䇋_—5°ôã…ˆUaôå# Dœ…¼Ü_¤ZÅ:UÊCÚ‹Û‹„
g³néªlK•ÉáH¹& ]Ä™’Ê çng‘ @Mf¨vÔ:‡ý ÎO7ÿa¤ù~JĹЊ‘†ÃUb¢¾²ãxµQºˆßvÍÔ”“i¸}‚D\Ò°jÛMÔïÔŽöðÑ –製J¢®nº‡Åò±yè`çò,.„ÈþRFúp´‡'ÚͤéªöÈ'¨ìžp‡K˜Xgùå&IâBkéÖ– `8 ³°$É#8t$[ÃÑÔS[RãH*d´) K·”1÷`bhŒ`„¨¢ùŒëÓŠqè;Ëh_ +îšöttº( +vDw’§Eá£ÐÕ&â, +=pÖ˜ç áwoß½F‚²¨ Æ \¶#ïô +¶<wÁ†]0ûÈ/8_ºð¯OÃÔà vME ÉÌõ43Ò`¡¹F(²E~A€‘Ú¡ ÇfÛZMàˆväš(5AØŽ'Ãf·¶: šé‰F(f"\sùpl|ÊN n¶AÖ‹B@A‘{ ú0²ÒöKm–NÏ~šl7'£»ü8'¼Öì3¤ó™Øº˜ •ŠR¡£2L",e_m¹˜Ôà·•€ªŠr<Øb5‹0j;V‡fë,†ìBÀµó•8a†Ý!¤(gÅQø(ynªö ×îÏ[
ep>ëòp¡)"xt9 +!šs +9ÅZ˜oàwu¾€ˆZb¹ó ŒA.ÁÑ9'úè‚â6GlxÉ,föñùrûih¡0¡²°Õ¾Ÿ#Az^6LØÖŸXU9N
k
v§¿bÄVgÖYqJ¹ÓEN›Æ2-|M³Ù\'p<ºH}FÛlŒ™ÆàO…HFñšû£ ?ÐkÔ’ÌRr ˆ^ ŒCYŒÒ:z×»8“iïx3 >³“e9 é»$™ÇÆ‹O‹03±¼ÞâÖŽt÷¡¦5©:KõqKCf$Y•Òp‚
€ÇþðÈ +Þƒ v‹è—•ýXªÐãgÛ9üø½.ôV©\çæòK¡7=
Ü£áÌ(3"”S¿üýÝÍúƒ·’…w†/h; +ü&„!èmù¤ãÈñÂøÀbÔYA‰ñN@ÞÊ+9ô»ßÛ®¶| +/\øŽó8«úÁjÜ(,ÿñÃ=½•8 «þXÒЙ v¦ò sð \}6 óiÁ@È»Ÿ¾û¥ü%Èã;VÅ —A.T¥föµ4ó$N井¯™QqfÂWCd +<Å^Ÿ"ßX=³°ŸDáS¢“+(}€¦þº7IL ç©ð ¯¿`yZÐ÷+/a´~¨EJG:š3&<¯§væa´üP„ÁNr9M|zvÜ Îî!}Ì3-%Üeàñ³ 3×>e~æfC‚™Šd¹Õt0øè?ü¶ÏŸ,|(þ̯;”Žñ'+¿Å!}þ¿ùqúÉKšÇʹþ£™›85° å>µÉg”ûŸˆ<'ý¿w€=endstream endobj -1417 0 obj << +1435 0 obj << /Type /Page -/Contents 1418 0 R -/Resources 1416 0 R +/Contents 1436 0 R +/Resources 1434 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1392 0 R +/Parent 1410 0 R >> endobj -1419 0 obj << -/D [1417 0 R /XYZ 56.6929 794.5015 null] +1437 0 obj << +/D [1435 0 R /XYZ 56.6929 794.5015 null] >> endobj 198 0 obj << -/D [1417 0 R /XYZ 56.6929 626.8646 null] +/D [1435 0 R /XYZ 56.6929 678.9507 null] >> endobj -1420 0 obj << -/D [1417 0 R /XYZ 56.6929 593.5117 null] +1438 0 obj << +/D [1435 0 R /XYZ 56.6929 644.5195 null] >> endobj 202 0 obj << -/D [1417 0 R /XYZ 56.6929 468.186 null] +/D [1435 0 R /XYZ 56.6929 514.5361 null] >> endobj -1421 0 obj << -/D [1417 0 R /XYZ 56.6929 436.0669 null] +1439 0 obj << +/D [1435 0 R /XYZ 56.6929 481.3387 null] >> endobj 206 0 obj << -/D [1417 0 R /XYZ 56.6929 238.9445 null] +/D [1435 0 R /XYZ 56.6929 279.5586 null] >> endobj -1422 0 obj << -/D [1417 0 R /XYZ 56.6929 211.6265 null] +1440 0 obj << +/D [1435 0 R /XYZ 56.6929 251.1623 null] >> endobj -1416 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F21 938 0 R /F39 1161 0 R /F41 1218 0 R /F48 1238 0 R >> +1434 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F21 950 0 R /F39 1173 0 R /F41 1233 0 R /F48 1253 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1425 0 obj << -/Length 3360 +1443 0 obj << +/Length 3255 /Filter /FlateDecode >> stream -xÚ¥ZÝsã¶÷_á‡ÎDž±àÐ7çìK.m¯íëL›æi‹s”¨” ß_ß]ì")øΙŽ /ÀÅb± ¿]JœÇð'ÎuÅÊ$ç¹I¢4éùz{Ÿ?ÂÜg‚×,Ý¢åxÕ÷gß¿Wù¹‰L&³óû‡/ ÅZ‹óûò—Å»Ÿ®þqs{±”i¼H¢‹ešÅ‹«ë]!W ßÝ\ÓÔõÇ;¼¿¹ºÈ“Åý§Û “¦ -ÞÓü&,»»ywñëýÏg7÷^Âñ)D¬P¼ßÎ~ù5>/á0?ŸÅ‘2:=†âH#Ï·gIª¢4QÊQš³»³z†£YûjH+©ÒQªe P‹”!µ¤&Ê”TV-»b[],U¢ÿÓÏóýûDŒÞR"RKØ -—¯7uSFÕïÅvßT-Ÿn¢¢Lg‚—Oq ìs¹(šÇ¶«‡ÍwËínŠ6®{"]ß]]E&ôâöîêo×)óIOæî~ºr›TÃ:ï¹+iõ°áC~®^˜R<¢ôçK!àRE¢pÁ%K'x,¤J`7)Å¢ÞáS Ü)뢯p'0Ç‹{Ü -6H( NÐxž*y¢O0»€&³ ÄÐÞcXJˆã9ˆzz}K¥cç±v Œ1Ljp÷M{Àƒ#uÅ+ë]FZ•î?T!® «/íŽG¤~ýŽ°ne½{<¾È RE*NÕ7œ>2z {}O» zÜáT“ 3ïüéÃÇwýt}à½Lâ82y¬§~Ðàä[ð´>òÜý? s@´K
¯Æ¼/Äêï ÒØS»@gÿA]î| ¢ÅJ&_w2‘åfjо„™æ9@… {c¤u
‘4*èìÙ¨L©D˜ØÔÕî%p¥R¨’Î(ÑÄÀmO…P¢ScNî4†ÜÙvœwöí®¬!.Z#Š)WáàC9¦×þ°Baù}oÌ1s,XU7 -žšd‚=¦ØŒcÒ - üÍ
YEq ú2À.”V.6"ÒŒrí’ Æ® -_éÌttQÔM)ö®)ÐÕÉÃ:Z/¹ãè_üíPõ -·d«KþJÿ üSVÕÖÉf<«ßk›æpcÝînIÈP¥L̬zqàÉ vÚ†¨]“bõj'ÁrÇœ¡øF”›/ü(Ø«pè(dà3÷p‚ ?·k¸Ïݽ
ŽFºF¹¾ 'o`ÆÛBLXS=I/í ö̶%&ûòT4¸}ÿŽi,ÄTÞ€bº½*’{ö}
* -ߎÛ*=
!ÊûuW¯œu¸/¹Ûvºh(j6´”×M ó—íú°µ½xÊéIe ½éé?íšú3CÚ >|Ä `@¤ÖŒª E- M”mŸœÂ;ðïà ƒâIkŒh¡!U·EÉl{†ýÜ̃Iö"Äû-ã{°¢
þZ é‰W¹N+Ì–-‘PŒÉ'VrÕ×±£Vð\q®µë1Ëk¾û3ûjK)ãê.Af£ê0Ã/©= –„‚£î7Ô}V¶W$„æ ±xÙ£ŸÐÿã×O¥ -O#Õ\rÿ ³SÑÿÎ)Bendstream +xÚ¥]sã¶ñݿ“éLèö„ +)·‡ù±éò R–UOÏC_4ZznÊ9=øúi°Ï«ŽFk¶›¬[uO{‡c›ÛÅ#=K^ØðQËCU»S·åñdð):ÍÇ1bÌOR†uÙƒÎk%ƒCO¦qèóMIÊA}µ«ê¼£ h†Àñ4Öá?Aíf8™$@h<L%èp +¤ž‹o¡3ì˺ZÑ÷8RA¿mxq„.yeÕô ¤eáÞ…¸vp¨~k xû“Û°ªEÕlŽ»ì
¢ñ…ÁÄ„–±vW`^ŸÜ3LEb€ïrÌp:åÐã 県p˜Þò‡ ¯ÿúíû›Ü‹HJaR™Mí ÀÈw`i½ðØýüCÇ°M‘‡@Ÿ‚”RwÕ¦±·¶RÞ²üyu~:à c¡•Ñ/™JR3UŠ Žùm iš‚ÜgÍk¤Œl^¤‰¬ž›†F9==+•I„Ž„‰N½mžfD†PB§”¨b`¶çD‚CÎbcÎd*ø¦ŽŒ³ß·MQ_´J3Vá 88ûÕÀóþ°Dby¿WfÉÊ °=c‰‚¥F‰b‹€)VcI @oŽÐǪ®iÄ. ȘÓàEê…ÑÔ)|äÀwªÈZŒyté73è@2í|#bÑs¼ Eš)^„¾ë è Ä0‡èööîÃWÏ!’ΰˆEÀ}ë!QOŒ Ö-:,Ãfä×bM΋ KdŽ +•±,PMt|˜;a¡Y +Žzâ4ž?*’j|dlvÇ#ßx§Á†øžó¬Û[0"ÞH¬û–±5à»cU|d Xžü’×çEᦠü òº~² Û>“?NLÔÔuûH^ ^!ØÙ`Š/hN=
)f˜Ô)r6ïûÃÎï¬~ö´°jè=§‡0xPX³Ñ$‚ +ü¸ÕsXGëCîµø¿ ÊÞf +>é|Ê™ ½Ÿjµ†œÏIÞºFxçOF»Ž ';0ÞíÀ#¬¨–¤MûF‡=£m ¥|y¨rÜ~yMƒX*5%‚ nEtŸ|Yƒ*¼fU¾Ä•WÛ» ýß>ýl ãÔù„O{m Ÿ;JÈûUW-nTܼڵÓEC^±šÕÀ¼nºxðù~Ñ®;Û…§ˆ %"îuâÛ¦®~ædö݇øѼtÆù´ƒèÀÐDÑ–œ‘“k„çjýÄéð¤%F0Jž!L·yÁh{Nø¹‰“lA˜é·œÙƒˆ+ˆiÕ¯r V˜-Z!3ŸVŸoÀŽZÀ§ls-]Ÿ¸˜æû>Ó¯µôafM“QU˜à÷ÓžFPCB¡Qõ[ê9keÛ*!8å+<íÑFè}¼ýœ + =º§u|ü¤ 3ìt¹§v½g¸”Óþ=!ãö "È‘ÞæK<‹Ã—xöôÃÐS_hŒ•HÙäMõóÅN·ô\–s7ôîSmìÃÄ»êDºvZl\Û8Ájô:笉oùìP
³2ñ +dlVÕïóU9†ãÂ3ê +¢ èêuÏ$º¾Zrôô“‹‘ÛÚ–GÁbB„½žþ0séÄaeø¨(üTŽ=þ( W>€²Úí”hKæ½ý·VvU_º…
/Ú21NÅÝP¶fèi²‘æŶ‹U
O~šœXŠ0;탆þ[Œ˜É±•%…ŠŽÁ8zjÛtÿ¯=&JEÊ“¨ò…ÂFXŠiºH#M¬?Ú '›ÑÄ-ºí7üdžض³ôÌvÆ;‚á{¨©<- >Ÿâª©†*¯öÂ8¥ž<>{÷ñ‡è±û×ßTs½þúO×ß²ûîû§ vírHû››õ7zUß.¿Êï ïžû‘Žþ÷gæO?Ò· ÿï¿ ÿUBÐYÎÿ{Hc54©# +™êSÊý‘ÎIÿ ݳÊZendstream endobj -1424 0 obj << +1442 0 obj << /Type /Page -/Contents 1425 0 R -/Resources 1423 0 R +/Contents 1443 0 R +/Resources 1441 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1392 0 R +/Parent 1410 0 R >> endobj -1426 0 obj << -/D [1424 0 R /XYZ 85.0394 794.5015 null] +1444 0 obj << +/D [1442 0 R /XYZ 85.0394 794.5015 null] >> endobj 210 0 obj << -/D [1424 0 R /XYZ 85.0394 626.7436 null] +/D [1442 0 R /XYZ 85.0394 671.4386 null] >> endobj -1427 0 obj << -/D [1424 0 R /XYZ 85.0394 595.698 null] +1445 0 obj << +/D [1442 0 R /XYZ 85.0394 641.1061 null] >> endobj 214 0 obj << -/D [1424 0 R /XYZ 85.0394 395.3576 null] +/D [1442 0 R /XYZ 85.0394 444.8166 null] >> endobj -1428 0 obj << -/D [1424 0 R /XYZ 85.0394 366.9621 null] +1446 0 obj << +/D [1442 0 R /XYZ 85.0394 417.1342 null] >> endobj -1423 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F41 1218 0 R /F21 938 0 R /F48 1238 0 R >> +1441 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F21 950 0 R /F41 1233 0 R /F48 1253 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1431 0 obj << -/Length 1600 +1449 0 obj << +/Length 1913 /Filter /FlateDecode >> stream -xÚ¥WI“ªÈÞׯ0îæUµ!™Œqã-(œ˜TèèÊ ¨t¼ÿÞVQU]ÕM¿žÂ…ižé;'ó;'âþŠÆhr†#1Š -~|$1{º{ ŹiJÂÓp… …_Z’ñ4‚qWêTxqõ -~x¼«~EqéÜjaÓY#ì~.°ÇüÍï§ý.Þˆa0†`éw, ðoØ·Îq’'—ÄK_2è6 Åt ôåëÛxî·r=¹°S‡Â& ÊÕ¦q²Â¿0gIÚih›¾ìY7³K‡ä0qôרu) ju]¸WzÂ,[õŠK\T“¶ -Ðæ27>ö1 -°KEÞ§ÞêâT<Í)—?î¨/z¼Ò;)-³é!ðÚ®.3 .„œ 0â39 {Œmà~(*ͱϕ¬ÍÚLèMV¨S_æÌíiˤ ¡‰§´Úh†§¶½2üCØ—A&KÕL‚LCn#¤iLnLÍ߇8I™Úu«Dùͦöánv9õE§éH+}?œ%<üÎ^…Ì•ãÖ5½×í”Öb\;º‰g½ÏœcÌáT³£¾=AÆ`x á+*6ôÚÜNæ§Û¶%÷ÎÉáNï Dµ¿-!µ ÁI6ÓÙ¼ÝÈèÛ÷Á }§þ—°ÿûþî
"Œ{é /»—òz¾ü îQĽN ½bW”Ý¢¸¾/ÊÈË“Ö»$EþŸó‡ÖÍ+ƒîG[äÝéAĽt2Ôò3_©Ï|…4€~“@X{Ù1
±m‘aýD¥ÞˆÊß$ž÷êålkÀšP|}E®CwL’¸–„>£»”¸w;šýzD”æÇÖ¾\×ãlK®"‡Kv‘t=1•‹·}÷Bví@’çëf¨ºíõL¤öñr‹öò-¶M@Q¬â÷Y‘ªfûþÂÚÎØãm“î )Ù B|^e{eA’d4í»D‡ñÂÖì ž ŒRínŽ‚Cå\HË$×Ô#XôÅŠÈæÖ.¸u”ÎÌÞߊlJJK)!%O³ÏÊÒívìSö¹¾°i”7–œÁ©7Á¡bÍ¥…S Âç:ãWîId%u’ã`º-£
®Í$9ÀýäZõÅz&OªÐ×$T®‡«ƒr3ã·Æ°N<˜Oìe•õYáE³6Øñ×A»¨rS°âTÙ¡:qÒPô/xч,,àxâ¿ ¼û¸ ÃÈ8°þiÊ° -Ësø+A°Î Ea$¸Ó¿1Ñ -VìgøÐ =“ñÐÛÉ6êS>'Þ"0‰f1¡ÇÑò|:nЦÎÌëƒ1Qå 9#ƒ¦Ð&q¸}G/÷MŸgœŽ‰T`¼E~ž5Ž¦(NhTËzߧ<Ñ7YpŠª|Vç°’ º]AÝ[
G¹R˜ìò È/܉êéR†ÕÆêó,âF>Ý Ed!{Ê(ª£¨1ïŠÔ´ws«jo.Ï®ª„¢`7k§¬–nxvû`ˆ£ŠE‘‚¦VùqZªÑR|èíƒÍe>‡æœ£uãÀîñdÂ&þ;Å B€ûWF[q|->Õ0 ë³ùù nGaîùéášðü½ñ›jå¥Ið:Ï~£>êÛ¡î{º£;›ê{h ýâ_?ëý'sG‡X~¼Ø!üôb‡ ‹‘ìÝɨ×&Aþùûûÿ÷ÐÏ ~endstream +xÚW[“ªH~ï_aÌËê:B](.qb Plñ. +^˜AQQؘÿ>¥h »³—8 Ñ•·/³2³²` Ð?X"<ÃKH* Ç +5kó}p‡Ö¡š ¤ølV…×Âh,:ž7Úëp[·Úq¯½Q %s½†ÂŽÃÞ¼ª` =Aí,ÔŽ'› +)ì Dš&›ÉèhvTGiél'#Ó9šEÌJ{œxŠBФ›,=ÇÑ;ÆŽozÛÂ>˜ž4H¼6ÞŠÖo‹þòYbc"ò¥ß~½Úò‹ö·«åßÝj¹4Ã0…÷lx<:«šZËàQp©süV„øÁšXoßï³/ìµB»9ê¢Qò ½¼8þ¿šE!b$‰pų(*P¥ @+—T×cù”ø¬êû$/ + 8îcbE裋ё•G” +iÇ!€D.÷upsõÎ)1„§#.e¤#0l)ð;ÇÆ –uú •›_Cu T„b ¹3¥mj€“$œ3½¬ï®~Á}ƒmïPI‰¨C¥ŸžŠk¯šïNñèe §ÊEíC‘†FÌG§Ám>©!A*GëÛ¯X>ym²sûw›ªn¤À¿Y9ÕŸìþ1ßq*”óÙ$'YñCSRA¤|Ë+Úƒ1GÊí0ßß[ôFà@ùä¯Î]ÓGί_@ÄQtÊ·^à<<P…”£ õ_Œ~9Ž—$Jbé%~.«nùK$ž¦Õ÷çÒÏåüK¢òôò#Òk¢þøâäéý„€tw|æ9·ø"ñãÁy[¿Öõíû =ú›·;ÿ°Âû‚žL\"m>N Tà=àts…ÿ endobj -1430 0 obj << +1448 0 obj << /Type /Page -/Contents 1431 0 R -/Resources 1429 0 R +/Contents 1449 0 R +/Resources 1447 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1433 0 R +/Parent 1451 0 R >> endobj -1432 0 obj << -/D [1430 0 R /XYZ 56.6929 794.5015 null] +1450 0 obj << +/D [1448 0 R /XYZ 56.6929 794.5015 null] >> endobj -1429 0 obj << -/Font << /F37 1026 0 R /F41 1218 0 R /F22 961 0 R >> +1447 0 obj << +/Font << /F37 1038 0 R /F41 1233 0 R /F22 973 0 R /F62 1379 0 R >> +/XObject << /Im2 1368 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1436 0 obj << -/Length 2638 +1454 0 obj << +/Length 2465 /Filter /FlateDecode >> stream -xÚµYÝsÛ6÷_¡éuS! -Q¤q:™¯Y¹y®&óå¯ÑÅwç?Î/ßNg±‘Q"¦3“ÊèüÅÏS¥Tt~}qù‚¦^\ßÐàååù4K¢ùOo/o¦:Í ¬*x 0Ý\^|Í+Þ]ŸÿpuA?~ys}yÃç×,óü§ùTåÑ› H¢ç½¹zu}uýjúÛüû³Ëù`fè -%5ÚøûÙ¯¿ÉÉ<òý™ºÈÍä~H¡Š"žÜŸ%F “hí)õÙÍÙßÁ¬[:æÚ4Zõ_m«bQ&ßVÂ9¥"Mdü´,Z'AýŠcQ‡“O‹X“ÆÃÉÇñD)QãÑRd -N<3àÒÑ_£‡ g!Lš(dTR ƒæŽãÍt–ªhÿÇÑåéy€ÌD¡j°O®ÝΓß'JȤ(4ñcgêÁŽðìê>ž¼hÁ I`“—; ;“Ò8 -Ôa
X«8ÀÓ:@:¬`Ó“sHŠL¤:Õ“Ÿ+°)Òb2;\Ïý1R•É²©ŸÆ¨4‹E"eælÿûÚ¢‹ãœ Ðe_µ<ç _Û”·µ;WøQ6n -— lVnç¢Þ-«æŽ7¬º~¸É8²lªàü€ÝoS5nÞ¼]ÎÆ®VÏŽw»%iTâÇD ìžÞÿ0\¶Îè$q×Ô‘îËÞÏ’ï`ð↾oßv–Ù\€ y0Zà®MOñÀY§?°”_{„ °Âîˆ2 -E/ÖU½<$£ ÐçN+L!ÊcS™lºû˜š -@2ƒÕËj×#ŒÌ)°Ùgb £ËqŽ¶Á½!š$Pо—Fþˆ&@MÔn‰ Ï }{…í8Ž -‘&´G%’¼‹p»É‡X?pŸOš‚¦·˜UÑPæÌ×¾ÑÙZç:ë¡oON|¸S|u¸=zÀ$ÀRõdƒfôϬþŸ R"sú!GÇj¢¡“4[$æB«‚`’ˆŽWÊÓ7˜}SÞW ~ƒÁ–â´O8ßõ-”°žç²Ö‡2ƇD8Ú¸€ §žì¼£D…×@ëF@ IDR U̼i¡p¿Å†g ºX—Í ÓJ"-½Þøã#åX˜=¹NêQY Jô9ÇÎRœ¼- ˜t¹Ÿ¬2°44cÜ•\áî:¦X¨\wãkjN
'0¦h^ºÆ (ص*¬%a{B„’¹?L¡ø8/ÚZ£~¨Í¹~ÂêüN‚šiãçgD–pO}N'©ZSQ{;´ZŸ6 @qÛÁŠS:ù.üÃrYñLÿØÒà±Üwß` QàÍSU a°Ûø^Ws›„×vpꑽᑖ€óÙ²é@áç˜CÁùþpÚík8N¾ÌsÔ ¿t:@)? -w³ èiÁ¸·7W/ -Ç_®g¿³ÏŸÄ‹g'V‘Âÿz>âYfÍŽÝv岺æîÚí×7¯‰Âé4ñS:ú…¦ŒÒ¯¡í¹|G?Ýû2Ð=@ݤ
÷ -çLè<Çÿ² e -@/²A+t\lNu7SXœ)ÿobd”endstream +xÚ¥kÛ6òûþ +¡Àò¡VDQÔ£p7›t›ë¦Íº=¤M?heÚÖU–\KÞs¸ÿÞÎP¢ ¥w@°Àj8 g†ó"-¼þ„—© ”yì¥y ¨P(¯Ü]…Þæ^] ¦™[¢¹KõõòêÙK™zy'Qâ-ׯ,³LxËÕ/þõ7‹ï—7ogóH…~ Ìæ* ýÅ‹ŸfBqw}ó‚¦^ÜÝðòf1KcùãÛ›û™LR«r^D÷7×_òŠww‹ïn¯iðó›»›{žXÜ1ÏÅË™Èü7ßGK{ûêîöîÕì×å·W7ËAM×"”¨ãïW¿üz+°È·Wa óLyO0‘ç‘·»Š• T,¥ÅÔW÷W? Y³tÊ´JfÊ¢t¶Q4e[•‰Œ¤±mWm½b;] ¨®¦ñ‡¶Ñ O۪ܸ.ªš ¾¥ïcQW«¢×̦hV¼¨ª™’¸öÇCÃöƒãTÊÿé%ZuqûÏs~ý–(ëJ7}€f]ç" D–§Fð·ºÛ·MgäËbWœ`é2EÜ +„YT»ã•ôAžçST¬Ç”ekÖ²} _¨zöÀQVëÛöX³§m‹Gv™›Ko>§ +–Ë ¢t&BÿØ™Qâ—mó> #” § ÅSÕoiÖh‰(âd‘³¦GQ‘à G($NUM+«¶)êúDóµ^3ƒc3Ÿ +JÒJ¥”‰‹j«!á( ê÷0‹BÿD0 Í«õ‰³"ÔÚǪ ŠÁ¸JÙê Üó³swPšŸá?Ic8Ïö°êP«/'³& Mš±W +ë‹ï£(¶Å×DXbO?´¦u±þ +^!õ™l¹a°iY+×j£6χؙlN(…)¬^U%„+f˜0£Äh[‰F“ã mƒ{C6‰eä¿Uø=ª +>!W"Êš°‰=æ:à>Ø
Mgs&Š„6gIiÌÀ˜ØÚCèÛ‹ bŠCÇäŽþSnDh*.«jœ§Ðt'Òs+úgv Ø‘¨<ɽùx;ø¼.æ¼ñP"kt$<2N"÷.'9ô‚,
—,8Þ0¼¼dšbW•|ÉÂ+Åå=aqì[ha-Í=T ìÇ6ƦD8Ú6T EÑ¢£B…a åàF€7 +BB'TÅÄû÷‡ZÓ¬ñ@À–Û¢Ù0® ÔÊʃTcavlr
׳¶Øåhk ÂFSœ|(ÊßµZ„wÒôŸòÛ©Ëߊ +îp c4ô
ú@0–O‚Z#yé+`À¦n/ ÛK膓<·‡>Î붫Q?ôæÜ?aw>¦§ggÜôù©@ŠŒÊæ5¸JIMUdõ„sòò³ ¬¸Ä“} +cT ‘öí/.v“;8¢[#‰'¤Ñum:ùÄ_4SÞ5ö ¦É¸|~ààu“®˜;¹Þ/½jª¾*˜Mǽ!-¢¡ÔÝ_¶4éÐÐD¶?u[Òág +&‚©~þïfirÜØ Y-ÜdÅ*òkHè´Ã¦SÙd2(þFq×t,ì„›ýƒHú¾&@¿O=€‚yð×…‰ŸÂÁŸý#Æx« endobj -1435 0 obj << +1453 0 obj << /Type /Page -/Contents 1436 0 R -/Resources 1434 0 R +/Contents 1454 0 R +/Resources 1452 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1433 0 R +/Parent 1451 0 R >> endobj -1437 0 obj << -/D [1435 0 R /XYZ 85.0394 794.5015 null] +1455 0 obj << +/D [1453 0 R /XYZ 85.0394 794.5015 null] >> endobj 218 0 obj << -/D [1435 0 R /XYZ 85.0394 386.1448 null] +/D [1453 0 R /XYZ 85.0394 486.5796 null] >> endobj -1441 0 obj << -/D [1435 0 R /XYZ 85.0394 353.5014 null] +1459 0 obj << +/D [1453 0 R /XYZ 85.0394 454.3582 null] >> endobj 222 0 obj << -/D [1435 0 R /XYZ 85.0394 310.2645 null] +/D [1453 0 R /XYZ 85.0394 412.0822 null] >> endobj -1442 0 obj << -/D [1435 0 R /XYZ 85.0394 279.5106 null] +1460 0 obj << +/D [1453 0 R /XYZ 85.0394 381.7503 null] >> endobj -1434 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F62 1361 0 R /F65 1440 0 R /F21 938 0 R /F41 1218 0 R >> -/XObject << /Im2 1350 0 R >> +226 0 obj << +/D [1453 0 R /XYZ 85.0394 150.1125 null] +>> endobj +1461 0 obj << +/D [1453 0 R /XYZ 85.0394 122.4306 null] +>> endobj +1452 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F62 1379 0 R /F65 1458 0 R /F21 950 0 R /F41 1233 0 R >> +/XObject << /Im2 1368 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1445 0 obj << -/Length 2874 +1464 0 obj << +/Length 3336 /Filter /FlateDecode >> stream -xÚí]sÛFîÝ¿B/7‘¦Íý —¼»vFu ×Mâ8¶œ8iû@‰k‹Š”MÊŽýëXìR¤DÇ™ë=ÜÃMfB‹Å ¾2øð
‚Ð c T,½ÀgÁ`¾Üó×°v´Ç,ÍØÛT¿L÷ö_ 5ˆ½8äá`zÕây~±Á4ý}(½ØøòäüüðàÇјðòédòöø€^>¿;9<· ““—¸˜ŽX4|÷v2Rr8u´çÇG'Ç'G#ª`xðëätzxF+Òž3yùaÄN‡– MÀ«Câvqvx>úsúÛÞá´Q³m -æ Ôñfï÷?ýA -ùmÏ÷D ƒ{xñ=Ç|°Ü“ð)„Ãä{ç{ï†U³µ×´Ì÷¸ym90æÅAÀ;Æ
b/\4Æå£1ó}Ðñ¡H–Ù|Káõ*MjMðR׋2Eµ9o}8 -?ÌXtç×úõT >LŽ®~¹zé÷Q’‹àñQX¦Çl¹>yÿË×ã›·Woêãû›§éu½¨Ö"L ÞO.£ŸþËZ¨'µH÷U™^쇲äoŽªìjö¦~¿¬ßEé«—õtòùòü’ÿp)ôþÅI~ ÿz#>ù´û²>ð×É}¾ó%yýáë¥æy Ô?¤oà ½x8¸ùòÓ7¾Y¥‹>—w=ÅfÏÇE–£ùÂ: -¢ûL!„F!P#Ñ"ÁÈR> -p‡ÓHX\ó…ö´$¥5|#Žh‰ÓjΫÞÂëz¿Ø¥ïØo¯˜ê¿)·øBÍKDißU¥xS•â¦2Æ1Ü*z.’ÕJ#+Ô"±4=„Y¢²tIÓXÀ˪¬ªl–÷æýÄ6 ÷:ϽÆã[—7 ÇB5×6a¯m¯Ö¹é)±gY×åäµ·(ÛÓÍ¿ÿæñ¡.’™1h$:œaÉòÃmçhÛAl…+ C/`"¶ˆ¬ÆiQUzÞ#ÜReÄ]3[®¬ñ‘yI¢Ð·„UPÆ¿—#²¢§$3é{±Š¤ål’†7/‹«>!bOÁ5Ù’z=:F2îhD±)!ç‚G¨îç}R[Á½˜…²Óºc÷qo;ÖÆgèówº^£¦Ußå˜q 1'WŽáÛ{ªPͅ⹇ó¢0p‚-!"êÄ™µÃË›–©Ð£„Çü˜¹øŒ(>GA -åÖRÍMÿ §Vš >Çî)›£`á‹~ ÍlÚËÛ"¢<ID¡ næ jóßpA÷Åü!D3#±§,ÉŠL†žqÔvð%L‘rò -̈nwƒS©o%æs‰Æ Y1Ïשq åœOEÃdF à®ÖÅ 3~’gu3kÓ@CV…uKÜ–‡\SœS Íbú¯uUo „v{QÙà"Ñ‚np¹K†ÛíjEH,Fø¬æ ®11K§Í ™ s$À`3Ï…& -7³RÀõ
c#¼?Õ‹rí8$Ðõ›F_ÙŠŒ@o%âØCDM3dÓµjW¢®«B³ 4™¸¿ -} Rñ&í—uáR]ÚütÓL@‹k]ÙkëÞï¹8Ù¾ ]Tö£DOÜÀ¸¾ÿ¢ -QÒÒ ®ñš@¸ k_¯ioÚ&Œl j7?WÞ^úŒ+ÃÙ‘ÀµÈÞ¹¨Üø,d[×¾>dBÞîáÇ›‰á¶ç¨÷>Æ ¡¼9$NãU™gó‡~WäAì©ÖÅJ0*jæI=llm)°In G i4%#ÚUÑ6˜ H3Ó¦‰(u qØÌ¢Ç,@T°=蜶ýsÀU’}÷5ZÚkô)ÍjÆ4¦1c^,þiõ —fK7gë $K7H–áC m.纪ˆœ~uö' -Š5Iž4s¤F6±Ûœ &̃ô–Ð#ÕWÉ:¯i›c ‡wI¾¶ 5 !1v½¾ÅGJ* -&CÁâ®ÀJ6™>hæþ$6 Š²x¤¬TÞ k6£;ã~Úl9¯Íï ø-êò)iz†¬÷‹l¾°¹„Ûü(Ô.h™àÅœßر¯} Ä_õ{:¿ñÖ¿üÇ›îîè"ŠxËùË“0±B¡î<Ü‘Üý•Á®èÿì#Á +xÚÝksÛ6ò»…¾ÜTžV4ð…ë]gÇqÝ$ÎÃr’¾>P"eñB‘²IÙq~ýíb|‰I;Ó~¸¹É8\.–‹Åû„ÄÄ…bâN ¥ž„Ús|Wø“ÕöÈÜÀØù‘`š™%šu©ž,ŽNž©p¢ È`²XwxEŽEb²H~zŽvŽƒ;}zyuuvúÝñLúðòóåüåÅ)½üòêòìŠæ—O¸^ ‹húêåü8ô¦ K{uq~yqy~¬‚Пžþ8½8{K# Ï3úîXœNϘLMÀ³3âvýöìêø÷ÅOGg‹f™]UWáo~ýÝ$ ‘ŸŽ\GéÈŸ<À‹ëåd{äùÊñ=¥,&?º:zÓ0쌚OGU+\Gª@ŽèÖ Ý +F… +&¡¯@Ie”ûÃñ,pÝé~—ÄuJpœ$¤Ÿâí.O" Jx~ö3ÁÒPôé18›Ï)D¸»~æ>ß-_Ïå*<ÿ ï–"ºwëôùB=ÎÏ×OÖ/¢ôMçÊÿüY1Ó ±=¹š¿yòéâöåúE}ñpûþurSoª½ +âÏçoæ ¢£Òaå3! íûò¯®"üâ*’“°L®O¯”/Ϋl½|Q¿ÙÖ¯¢äÙÓz1ÿåÃÕùí•ž\_æ·úâÇ[õ³K_¨OÝ‹}üŸÜ~ŒŸ¿ûô!•yÖß&/ƒëtóxzûñk«¨Ò"Áá“gRvöoæ…N$Ýp2SpÜ€Œãý&ËaÅÒUÓzÀUÂwhéí>jB<dyŽœ®JÔ‹%Œómii²í6M2à‘?;@òàsY¤}njZ”üñ’‡,{àaÞ«ì¦H–°¨³œ×Ø=£BhqE rŒ¨B)'ˆ F¢M\ÓÐ ! ζ(C(¦uI˜‡8ÿÈcf
+^•æ™TàAP.† ×æ ÌxA½Ó@óƒÇ‰wé'‚XÛ +¿ ñ›8+œæØFŽò]m½XÚÁk>–{ˆYm…‚ !̾ʊ‘·¢ñ¬¨ê·ñåš—äë;¬aE›rŸ'4n, ‘qÑ~ ^ k9¿¿¤±¡Ö»R¡†GÌ0+²:3j tkKÍ[Âm"³t¤2ò!@Ko x™ˆ3:$¬Ù"xnâûtðÁ«×¶ z™÷eVE•š
†èS¡/Ã1;Ô°µL~s]ß°eÀ‹Lódl±¨l>íŽw•ˆ¸¾ ²È^pø&Ãú äΊŠuøeW×9{aøïoöïÿQJüÿE©?· +:Mt’ð]ô .Ë"¤òü Œ´ûwÅÅù
˜Z‹‡Fa|œ×±f€û‘ÑÓÖ»zQ×¾‰Œ +š¦t—þpö® %@!ŽÝ¦/jA( âJwŠ54T ‰P¾@uÝ“Äx`Œ–m¢jÚ: lM.çXɆ¶‚ö…}ÛýZÓÍËáb)§¿febíJQ/ 7%" +$ˆDÑ2ˆ¨"THz\ØýK(;(§…Ál}8Z’aÃÖÓ¶Úpƒ–.€ÒXðÜ+CQ<€EÓéÔè¦ …xÓˆƒç6NRû1VÎÈŸV{£ dXH!9Ÿ„á¦NhQF@OC÷åGÒr êÒöf#f‹±ž-E ÐÕŠ‹ !¬ƒ¬)U๊ïî2S¦Àp¹Ç—§ýé“GNÒu¼Ïku›Ì@ØÌ@ fÒÔHNpõ‘8Ûª +ç3úd, ù«À¥'8¿=ìÇ÷cÅÕó +|*=„CÎcm "Ƚ›™û€™˜š¤Ý&íBjsÙ¾ó2Nð(Í |¥w÷q>À<åxl²2êsîH“„(³køº?eÛý–p¦4…§ôhŽÕ Wzàµãk!û+_Œ×ÚAØO.LG˜… ‘ ÓÆÜ5yŽUZ媑ãI%ÿ(§ Džb*Û€6{O`ã¦È øÝÊÝÕàÊÁ±9a|¡29è8K—µ…'¼ì襢úÙ±˜’uÒ· }Q—§wsák…v<²NÁ‚ ÎÓÄt‚D˧¥c¿ Ð’1ͽˆ²í¥ÙhÅÜ»1íªLM «‡Ê~ã!`„TíE㹨¡#uãÈù¸ endobj -1444 0 obj << +1463 0 obj << /Type /Page -/Contents 1445 0 R -/Resources 1443 0 R +/Contents 1464 0 R +/Resources 1462 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1433 0 R -/Annots [ 1452 0 R 1453 0 R ] +/Parent 1451 0 R +/Annots [ 1467 0 R 1468 0 R ] >> endobj -1452 0 obj << +1467 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [411.5778 224.7212 489.9929 236.7808] +/Rect [411.5778 302.2913 489.9929 314.351] /Subtype /Link /A << /S /GoTo /D (man.dnssec-keygen) >> >> endobj -1453 0 obj << +1468 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [55.6967 212.766 134.1116 224.8256] +/Rect [55.6967 291.0037 134.1116 302.3958] /Subtype /Link /A << /S /GoTo /D (man.dnssec-settime) >> >> endobj -1446 0 obj << -/D [1444 0 R /XYZ 56.6929 794.5015 null] ->> endobj -226 0 obj << -/D [1444 0 R /XYZ 56.6929 769.5949 null] ->> endobj -1447 0 obj << -/D [1444 0 R /XYZ 56.6929 749.3199 null] +1465 0 obj << +/D [1463 0 R /XYZ 56.6929 794.5015 null] >> endobj 230 0 obj << -/D [1444 0 R /XYZ 56.6929 358.1001 null] ->> endobj -1448 0 obj << -/D [1444 0 R /XYZ 56.6929 327.7578 null] ->> endobj -234 0 obj << -/D [1444 0 R /XYZ 56.6929 131.9404 null] +/D [1463 0 R /XYZ 56.6929 436.3593 null] >> endobj -1454 0 obj << -/D [1444 0 R /XYZ 56.6929 104.2481 null] +1466 0 obj << +/D [1463 0 R /XYZ 56.6929 405.7905 null] >> endobj -1443 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R /F11 1451 0 R >> +1462 0 obj << +/Font << /F37 1038 0 R /F41 1233 0 R /F22 973 0 R /F21 950 0 R /F11 1353 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1459 0 obj << -/Length 2589 +1473 0 obj << +/Length 2453 /Filter /FlateDecode >> stream -xÚ¥Y_“Û6ßOá·“ob•")‰º77qÒ4Ínn×éM®íƒÖ–ךȒkÉû§Ÿþ -+¯amÛ¢ W[Öër&¶nVÞÍú«©¹WźÅÝÍ¢(ÌâXÚõv SÉ,¸-°5A[ÞÕÅšhe·%ª•ˆ¤¯ÅQ`Á«mYß™ÇÍ™<Jg|±´ùóªêÕåÝ‘¦µN±±’†Œ5L£ w’Ûms¬Ö~-#+¥‰»æ¾X‡8þÃ[ Dƒci&FQ4äÕ]s -± Öp¼''Þ±‹Z e¨ ôÆØmÀ4¾ù¶£gîÈŒŒkl‰Ÿ¦„èõüãXX!*\—bÁçÇ÷e;c㲨*ƒT - ×ì‹CÞ•
«Ca T,Z §y[° Ï7¦í¶ìÚïÎœâQD”=®>-¯ -Æì éiHz_ìn ‰î™ ɺŽID± @Š?Íп¾niÔnRüFÙóa7* YœÒI¨“È°¹ß·( -6Ùœ© í$#Gqb6TФÊÜñ -ã}°£!68PL×…ÜJ›±Õû’ä#ö `?rSÛþ®,µ?AŠ¯ÔØYU%Æø * –ï¶âžµZ(dåæ‰ä9iUAçwÓEÀà®Îâ9ÖœßU6¸Tõ¢1*F -*e6¸ `r± [ñðpÂß(Á}ÖbÀÔ³OÞa¤’Á6o©S7 uè}¢¸/›ckmT -’ e_ HÞmèQR—6
0…ʲ´;…UR% #œ’XW3$× lŽä–ët9#ÿ<–«¯Î¨¼ Ëò€wÚ*¿füÔ<ì2®Û¹'u8ë9[g¾ö3‚ªòc€Ì?§eÛyªŸÙœ o!@8Ñ9Ç¿ò,õsKµž©Ø·ƒ×ïÙézY¯¸&AQ¶á……â=“õìÏßÁ›PtíΞØzæ6î-Þƒ¡ÞôÍóGüïÓ1²<¾Zð% žÝyc/Žå¡¿žœ¢ ÝçU¹.;ž×é²YóÄÆÑR?>ÑÀºØäǪÃÝȇáÍðÚÍÛ• ¾ËÔÔ*Á‚ò§–¥P1‰Ê‡m‰ÿ/Xœß½ø|›oŠá` +xÚ¥ÛvÛ¸ñÝ_¡·R=+$@웚hÓl;µ•íI7û@SÄŠÔŠ” ï×w3àE¦»îéÑ€Á`07Ì… +f~ÁLG¾©š%©ò#D³üp%f;Ø{w0ÎÂ!-†X[_ýåG™ÌR?Ãx¶Þhi_h ÌÖ›_¼7_~Z¯nç‹0žòç‹(ÞòíÏó ¼åõ›Õ[Úz{}G“ WËy¢¼õçÛÕÝ\ÆI§R>Hw«7?ð‰/×ËïßÐâß7׫;ÞX^3Íåçõ<ÐÞÍG¢èpïÞ¿»~ýnþëú§«Õºs¨Š@H”ñ·«_~³
hä§+áËTG³GX?HÓpv¸R‘ô#%¥ƒ”WwWÿìvíÑ)ÕFRû‘“ ݆Á,ü4ŠÂ‘r£Ôe(rQ3j¾„Þ§SñµfÑ>
Éy2y}Ú4('P –3@ðã ‰-™õÞžP^ÓœJ¯Þ¨íöŠ]UT;Z O¨Ø:7MCèEÓce¥ÙÐêþÉ¡y“ž=üá¸áÃ_E$ ‹vO«Œ†Ùfç²¥cŽ€ò ²òÌSÇj ERÀG‘QÈN ä¿ö¦<𧦘žÖ–ws +©ì™¬ÜÕ'ÐÂa¾ˆ!¡¿²q M]eµ„ņNJÆÊ´õé- zÙ§‡4d —/]tByбk[f»Irêùq2~ÎñàÎGîüEœíXYHÈJSÔ¾©Jô%ž©|2Ûí¬NÖÐø5 •cç„œgm[÷ìHZ#ÆC‘ÑÎæ©ÊENÐóq>x3«½eۚñ廬ψѩœì4¥æ>@üd çQ^¸ Ï86Eiª¶|âX´«è +øk +uÝ#ÁÕ=.†vîaAœ‚’a +JzÊ$ðžê³‹Ÿ†#iË×dpÊ ½.)_Ä‘b•}°F‹ü4ŽŸ(Iúøó„pÐ=I¥f,Œ¥a¾måínfî ;q©© Ĕ綇èú*IÔØ@fJÝRú:HÆ:t¨%õrW`æ +¹¡kÄ®õm)mikÝ @lTÅoJ¥N1Ê)F9Å`ízG#D
늵âjrŒìßÑå· +û½·##Ö9LÛ„Ô—ÖS5ù~,ˆ>"†âÔ”ÂMß+‡ª{B’[jœäeŒñ~‰’Š‹w_òÌr
#d²bûDô µÒÐCDk:õêLž}Íé]¦£¦ª÷8 ^1]qô>òâ ±WéxÛ#—b“ѸAD +ªvpùŽ2þû‰ endobj -1458 0 obj << +1472 0 obj << /Type /Page -/Contents 1459 0 R -/Resources 1457 0 R +/Contents 1473 0 R +/Resources 1471 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1433 0 R +/Parent 1451 0 R >> endobj -1460 0 obj << -/D [1458 0 R /XYZ 85.0394 794.5015 null] +1474 0 obj << +/D [1472 0 R /XYZ 85.0394 794.5015 null] +>> endobj +234 0 obj << +/D [1472 0 R /XYZ 85.0394 769.5949 null] +>> endobj +1475 0 obj << +/D [1472 0 R /XYZ 85.0394 749.2278 null] >> endobj 238 0 obj << -/D [1458 0 R /XYZ 85.0394 464.1469 null] +/D [1472 0 R /XYZ 85.0394 398.6362 null] >> endobj -1461 0 obj << -/D [1458 0 R /XYZ 85.0394 435.7636 null] +1476 0 obj << +/D [1472 0 R /XYZ 85.0394 370.8109 null] >> endobj 242 0 obj << -/D [1458 0 R /XYZ 85.0394 385.2856 null] +/D [1472 0 R /XYZ 85.0394 321.6035 null] >> endobj -1462 0 obj << -/D [1458 0 R /XYZ 85.0394 356.7468 null] +1477 0 obj << +/D [1472 0 R /XYZ 85.0394 293.6228 null] >> endobj 246 0 obj << -/D [1458 0 R /XYZ 85.0394 181.1837 null] +/D [1472 0 R /XYZ 85.0394 120.47 null] >> endobj -1463 0 obj << -/D [1458 0 R /XYZ 85.0394 152.645 null] +1478 0 obj << +/D [1472 0 R /XYZ 85.0394 92.4893 null] >> endobj -1457 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F41 1218 0 R /F21 938 0 R >> +1471 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1466 0 obj << -/Length 2407 +1481 0 obj << +/Length 2247 /Filter /FlateDecode >> stream -xÚYKsãF¾ûWèHWzûÁçQ±5ÉdË ¯-o*•ä@‹”Ä ‰ÔˆÔ8ί_ æC¢=®JJ5Ñh -}¯Ùä8¼2& -«A¬h‡K{ù²²ÿ¼’ôÂÊì¥LwÅ’¨Ç}–69 š Œ÷Ë&/j|§& 5D[nÒ‚ù6iMƒ§œ–Þ:/s«wŠÛ´„€²ìh3Štœí -lO¼ú¤¸à¸‚ ¦ríˆîl{™ªÃC„@¾z ;&𜠴§T7yÊÑò» dÅ`/šÓ𠧘€Q&ù) ?¿ô5§ú»üPT™Mž(“äuùëdnÏ9 -!¡¼ÐÀ‚ž/*|检Ñó¦Xn˜é¸ßW‡¦¦§6sã…1æ)_FF^NÕŒölM –Òóîï!rê¾Þ‘RŒª<í‡^Y¡cýȵWþ@¤Í[@²=þ/§ˆã¶!rµ¢ÿºÚåÄѦ$\´Ä0TòP‰€¼ý4N¤m±Ê›b—³2>jkKÊ°šwFÕͦõØ}äòI½'TmÖ x ÛÊñ`/ÍÜÅα§°²Í¼)¯I SÆgU.ówצßÓ³œ’mø|·øü¸ ¯“>ˆprŽVã ß—®8¬J -w‰jlÊ°òÉADµ÷¡H»7/g6I²‰x0k ɾ'ç¢ÌŠoEvL·DïIØz$â82o½ÁKMiÖ A7_Ñ"Uv=B’Ø75Qññÿ©ã¢ë
ùì-e's -h!j‰Q¸°Ý†Æ²ó]Ï@Êè¯- ªk뱃+\‡F:¸RhdS žs‡†1äã²|ÛpËù©$ízçœ>YØQãÚÂ¥«t\_¶ªŽ®D¡~¤ÿmÅÄpEE¾ž„€žàGš;¬'4¸ï}iÙ§=~ú(2ˆ¾S©¸‡|Ù™ -
MЩ5¾INQßš³/3-ÓÛ6œÉj»À±oKøAhDŸl£çowê>ÉùЅƱ ·\G±ðcÂF¡á:>³Ü} :7ýÿ:¬*íendstream +xÚY[—Û6~÷¯ð£}NÌ%E] ݉›¦{2™Î8»§ÛöAcÉcnlÉÉ3qý¨‹¥I¦§{ü Aø +¦›ÃDN ïÝD±Ì -ºR?¬'ÿøQGÓD$¡N×ÛŽ®XÈ8VÓuöÛ̉˜ƒ9{{}w·ºz3_x4~½^~xEÿ|¼^ÝqÇòú-ŸÖsÏ>~XÎ#¶v²wïß]¿¿~7×aÌ®~ZÞ¬W·Ôãó<Ë·ÿš+¥@ÓÕŠuÁÔDü¸"mŸnWwó?Ö?OVëf™]W(©q_&¿ý!§xäç‰:‰ƒé34¤PIâM?Ð"ðµvœýänòK£°Ók‡ŽºVIáéÐñçù6HD¨=m}›î ÊGSï°8íÍviEDQÖD Ñ…ù“)OÕþŒ<=»Ïó‚zOUžU—ôÌ÷Õ»œˆ?Ë"ÇÐèyc½¤öÙì÷Ä»ç¾íiOs’^7—3òËÉl>;£€ Ñ +ôçüÌ"}ÉÇ}º1ű҂d󯦪n3²¼T^¥‡œF4ŽÓˆÂ춞Y úI{1[¶p>Ò ]lˆ{È‹:E7" a2íÇ ¯ÞÑH ’Ö'ˆ·µò@Š¬9È.÷vyØuŸÛ%· oœuŽÞò(ñ)qÄCŠ<0`€y$²§XOéÞd¦æ1Çüє̿
‰"|OÎ~8SG–oÓÓ¾Æh$ˆSÃÈÎý¾DØX}›òpÜçuΦ ¯–¬(=W¬%ÝÖ0h$nÏ;³ÙQhMÝ ±¥î9èUºeÊæ|9 ` +ówLØд˜¢õoOªØ?W¿}{[åµ@ó P¨icßõ}! 7õ7ž/””rv
õWß`þ,o— Ø,vOEÍ'“ñéæíržx³õŠ'éV#˜Ã‹E ‡c™á +BŸM
>pxJPÄS<±)í—GÒ¼02;éÁlˆ{:fimÓ?гS’µÓønš€¦!Þf—–£‚×<|È‹Üλ -L–a–iÅ™£‚Á +÷»”:}hh/·Ù
R÷<üOš®ÄÍI³eMlÂ(RÇÒÌ<—'$ +çÖ–¦ìèã“¢Õ ðå”Wœ"Mâ½´ ƒöª, +æ¾ `•‹š)}š#¶jΞÀyÄ©hû¡U‘y·f»… 0Þ†,DzÃX'£²]ÞÈÑAD¡@uˆql×Hv§Çü+ÖF-â:P€kí¿×ž§Xë‹Í–¶Byúâ0kÏÓ®,àì°+Æè@–EI*.’ ÞaªrcgÍ +눔$À‚’`Q—‹o$„R±#‡òXóvÙfSsøÎë¦Ãêñ㎞X úNÏ9¯Fæ‚uú^ƒ7ªB FõÌ*ŽI¸fs;¢
îìQÄ
(-4Ôj(ä^ß©ïíñxapoèì‹]Íï¡OcOQâô#PäXÒu +¶áãÍúã§õHz]Àp2D«ö…ïKw<, ¿@hñ#UJ§ äØ 9n E)»…ý¼ËcH,4}¾Ù\Œœ,i¯7Ýœ'@ñõƒ;©Æò2z±åg¼X£—ì3xʶmÑ#^KB‘¨¸[êÇ|uKiç³ÖS¨Ù¾¦àÃóêŽ`ðEóY¦ã+±cÂÅ7Ö#‡-`ÒVg€;Ñi}B'h-E¤UØOåƒùJgÙs†öÔËÎPR‹H*ý=wø°?:od%½ J*V?9ˆ¸v_à÷H÷ö2°I’M$ƒUYö¥Ú¦ÈÌ“ÉNéžøíU– â#݇Aß—¸©)~ØÖT°ó™©²½%$‰} ¨ˆ‹QÄï}+EÛÊÙ=[ÊVgn àV]%ËÚÕHÙ[
Šº´€®ñéÇ ÐñÒÿ :øçÄÈ¿²)=û?ö¿# Ž;qìÿ½áE±ðcPÂF¡ý^<°ÜýY24ý–æÆendstream endobj -1465 0 obj << +1480 0 obj << /Type /Page -/Contents 1466 0 R -/Resources 1464 0 R +/Contents 1481 0 R +/Resources 1479 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1433 0 R -/Annots [ 1476 0 R ] ->> endobj -1476 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [379.778 61.5153 440.978 73.5749] -/Subtype /Link -/A << /S /GoTo /D (managed-keys) >> +/Parent 1451 0 R >> endobj -1467 0 obj << -/D [1465 0 R /XYZ 56.6929 794.5015 null] +1482 0 obj << +/D [1480 0 R /XYZ 56.6929 794.5015 null] >> endobj 250 0 obj << -/D [1465 0 R /XYZ 56.6929 769.5949 null] +/D [1480 0 R /XYZ 56.6929 687.5192 null] >> endobj -1468 0 obj << -/D [1465 0 R /XYZ 56.6929 752.3958 null] +1483 0 obj << +/D [1480 0 R /XYZ 56.6929 659.2346 null] >> endobj 254 0 obj << -/D [1465 0 R /XYZ 56.6929 692.682 null] +/D [1480 0 R /XYZ 56.6929 590.6286 null] >> endobj -1469 0 obj << -/D [1465 0 R /XYZ 56.6929 665.3376 null] +1484 0 obj << +/D [1480 0 R /XYZ 56.6929 559.3791 null] >> endobj 258 0 obj << -/D [1465 0 R /XYZ 56.6929 608.5887 null] +/D [1480 0 R /XYZ 56.6929 493.738 null] >> endobj -1470 0 obj << -/D [1465 0 R /XYZ 56.6929 581.2442 null] +1485 0 obj << +/D [1480 0 R /XYZ 56.6929 462.4885 null] >> endobj 262 0 obj << -/D [1465 0 R /XYZ 56.6929 536.4505 null] +/D [1480 0 R /XYZ 56.6929 408.8026 null] >> endobj -1471 0 obj << -/D [1465 0 R /XYZ 56.6929 509.106 null] +1486 0 obj << +/D [1480 0 R /XYZ 56.6929 377.553 null] >> endobj 266 0 obj << -/D [1465 0 R /XYZ 56.6929 404.482 null] +/D [1480 0 R /XYZ 56.6929 258.7201 null] >> endobj -1472 0 obj << -/D [1465 0 R /XYZ 56.6929 377.1376 null] +1487 0 obj << +/D [1480 0 R /XYZ 56.6929 227.4706 null] >> endobj 270 0 obj << -/D [1465 0 R /XYZ 56.6929 320.3887 null] ->> endobj -1473 0 obj << -/D [1465 0 R /XYZ 56.6929 296.0091 null] ->> endobj -274 0 obj << -/D [1465 0 R /XYZ 56.6929 211.2169 null] ->> endobj -1474 0 obj << -/D [1465 0 R /XYZ 56.6929 175.5135 null] ->> endobj -278 0 obj << -/D [1465 0 R /XYZ 56.6929 119.4006 null] +/D [1480 0 R /XYZ 56.6929 161.8295 null] >> endobj -1475 0 obj << -/D [1465 0 R /XYZ 56.6929 92.0561 null] +1488 0 obj << +/D [1480 0 R /XYZ 56.6929 133.5449 null] >> endobj -1464 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F48 1238 0 R /F41 1218 0 R >> +1479 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F21 950 0 R /F48 1253 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1480 0 obj << -/Length 3064 +1491 0 obj << +/Length 3154 /Filter /FlateDecode >> stream -xÚ¥koÛÈñ»…€ÕD,—ä’Ëë'_ì\rn×òÝáp¹4I[D(R©(ê¯ï¼–™F-x‡³»³3³ó\E-<ø§F»^„‹8 ]í)½È¶Þâ æ~¸P²feÆ«¾¿¿øë» ^$nùÑâþqD˸ž1jqŸÿæ¼}y{}·\ùÚsBw¹Ò‘ç\^ý¼TJ9— ß^_ñÔÕÇ5ï®/—qèÜÿtw
˜8Ñ>lSJvÞÞ¼•uRŠÏžöÞÞ-ƒØùõö~©ŒóéæàdvýÓíí'š½_þ~ÿãÅõ}/×Xvå(Ô¿.~ûÝ[ä ‚ /<7HŒ^ áÃsU’ø‹íE¨W‡A`1ÕÅúâŸ=ÁÑ,mÓ¥Œ« Ï(ÓW 3ÑÚŸhS'nøiuýåJy hñÐmš}Ù¥]ùµi‹ý×b‚9t7Þbå×6ѹ_&¾Ó,WA;mÑ1pØñ˜Ö2Né#êßM-Ðc³gàîÝ[@ÅP·_çÐv–\¶±‹·iYwE
¨â
`’Èy*êbŸvBµ; -Sx©ý& -Ÿ¸z -(sáÀecàI ö „&rÓ *†Jü‚BÁ‘;/ÂPFQTù3XÊ:É[¸²”©t·+Ò=Î ¥Ý„I‰á3¯.¸¶ MzJ9±†|шJ)Àr”Ð ´l) mÎKeK”NŒ“xqÖöÅ!•:tÞ7ÇB0ýLß/6ÂSÆ ];;.³‚ùÒp0Þý©mm8<xŒ‚öF½ñ&•ð#ÑðYIùp:ë”Ïú$¥…ÝZŠ‰ Sksb²Cɼ áÍ©ëBŽá¾ - W»¯=O¿Æ7o&º« vC†“¢ŽíöÚö¡ÚwéSÃÜ¡ ²?v¨$” ¨Öc{÷ ¨\7Š_×|c« DmRò$€>\½ ð‘uÔˆº4Ʀ;ˆÔ¨V#m!"9¿©½:· clënl– -S™åš0¶ TÌÏ%ôhÚÐ fÛ‰-J!•™ïú¾2óo…·¶ ºü¶$U!, G y×ëoÔš,pM– ö —ʺ—²:JYËRã÷F¤·/»Žì@)éŸÕÐ6·éVÖå¥48]³—cYˆ™¬·iªÜ†câä(M÷6®¹?‘ûõqÀå kßIgãæ§*'Š!äÊbßB&kù‹ -¿ÿðñŠ¡„‡œjÊÝFœ,Ô¶j m,À¬1;Êóïõ7~öÊÊV6È<”räAb+€l¡î ¯o¶‘ź_ÔΧVßDαèoË oò9Rü6=Ë_ËæÐò #*öœ -AÕ‘/=4TE‘1ýoXJ~Ázé×¼ýi×AÏ3üŠ× v»fÿrƒ %ÿ°%C_(€oé Š¿oØe|‡y‚dC˜ÀYc=—Ú·¡"\ÀG^`ûV“)ÂgÊîJ;ˆ(Û–u^ì -øC—· à° -¹¹»²½ÎFX:N:!ÈG«'[;懪¯7@ä÷ë´ƒûv|!³A~ÒÍHÏR€~-³b¾œ”¨¹(á eSÓ—º9Öòô!9÷Øì¿0ƾÊ}ˆB6¿ÃWÅP r·>Ô¼jýö’1V_„:g“)ö,i3ÀÑ¥2MÑ¢gÏ$¨5I ʲ‚ò™ÊÜÄùf"ÜJׇó|k0w¹TÎõ-Ã`L;K .:u•v òXÁþð/=é“Ð`ÝÒže&DE°þªx(©]ìßËúðm¶ð ¸†®Ï®û—¥ÆX’7Çvò 1Á¾çîK¿ŠCÅ?eÏü†íõ?Sÿß¿˜ÿµ ŒÝÀø1|ìä¹êË -î'çœ÷??gý?û”ƒendstream +xÚ¥ZÝsã¶÷_¡‡ÎœÜX,@ühŸœ;_âxr—Zºt2¹<Ð"mqN"U‘:Åýë»_ +¬Òv¶Þ]¨ÙŒ}w¡eÎÂMZ g}»ºøË{“̲ ‹Ãx¶z ðJ•¦z¶*~¿ýþú§ÕÍýå"´j — «ùõ»Ÿ/µÖóëooÞñлK¹¾L¢ùêÓý
Pt&°L+Yùî—×?޾婫ûOËwÓ÷ e— ¯?\wóã͇Õåo« .nVþ$ÃÓjeðÿ¼øõ75+àÐ?\¨Àd©àC:ËÂÙî"²&°‘1Ž²½X^üÝ3 ŒÒÒ)íY“6
“ õ…z¦£ÀDq8ÒŸÍ‚0MBÒ + +jP +Îþ\ç»j-g' Žm' +¨×›æ +Èëü©Ü•u‡ +€mÂÁ-©Ù€´ ñÿööÜ€ÕfAÀVÆfóªî—:7Åq]¶<Ü ÷ûæÐñÇ#n…3ïß¿e +ðÓWÐM“yáäD:0Jç$%NÏEJ Ùy)ánc“Í?µUý$«6•lûXæÝ‘„)ñ0(¾ÖAf-«'ßn›S+ÇÔƒc˜ óqTÊ0 ÞXñ¬®=a§/e¹Ç^Òçë/Ll ¹]oòú‰”‚ã²b}¨ºjoù lyyó–g|)Ÿ[¦žªnÓ ;þÈëg ¯KŒH¬Sèt›’Çš}yÈ;OnH‹8FïJÆzØå_J¾|/ ~ |DlêÏJ…OGàW55‘²-ÛÀkÏ3d+IƒLÛÞ +-vȾ›o«˜á!³û²m¶_ËôŅqëy.³pŽrE½\—zî.™è97_yå}€Ä³d¯EhøpäØ–L ›D +Ú$÷h ír0møßï‚ ¼‰‘M è + z »€tG¯.ž0ÔcëU•O™kDF9se×(d</§à¿:4¹íòι‘Ñj~[ƒ%í÷œ?Ù‘=_‘Eä2ú vóØ ë‚» Ÿ3àŒTèP%³8L +Zµ¼‚Ì^õØ
Mè?ºŽç+ £c×nÓj'£¢7^A8aQƒ PÞd + +ÇØwˆœ
1:pwCâê<m·ß–pPT[è$Î¥p¹)6cçAf± ¾6_„AÊ—L»9N…¸ÙùrÎç·ÛRÖ5 R:äÒL™ª+0í³ ¶,<0‘éM‚[:d$eÞV%¹=8Ø)f*ã Øñ6GÕáXΔCkgŽ*cÖÊÍOÀvÌ‘‘Ke¹Vwù¡“
8 ÀÂÄA•!¼ +ŒÖŽóð1já¼Î+êºO¨¼qÆ-ù
ù,ˆ›óˆ6ÎâvœgRˆgìý_&žÔ‡†{&ƒ¬€G8'Ï) J’;í¤›ðR.vØ^¬ZJ´´ª¯ÞÈ> #÷OÃÊ…ÒòÑ”©
¾Côj@•Þ(U`Í~äìÉPä†ÓF£$… +{öFç¦5” +üB¢‡9#PÊa3@m RæÏÝJæIÜ™• åû}™ (q¶È(ïFB +†O¨´.9·¡Lzâg'ðnºh$õ©P%,£•u™-¡A_6á¸{èENÏL¼8+û’ˆÒÍ¿oN¥PýR_/6"?‡='Šë’å²òp5q¸avèrÃþÁc endobj -1479 0 obj << +1490 0 obj << /Type /Page -/Contents 1480 0 R -/Resources 1478 0 R +/Contents 1491 0 R +/Resources 1489 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1433 0 R +/Parent 1451 0 R +/Annots [ 1495 0 R ] >> endobj -1481 0 obj << -/D [1479 0 R /XYZ 85.0394 794.5015 null] +1495 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [408.1244 623.7385 469.3244 635.7981] +/Subtype /Link +/A << /S /GoTo /D (managed-keys) >> >> endobj -282 0 obj << -/D [1479 0 R /XYZ 85.0394 769.5949 null] +1492 0 obj << +/D [1490 0 R /XYZ 85.0394 794.5015 null] >> endobj -1482 0 obj << -/D [1479 0 R /XYZ 85.0394 750.8067 null] +274 0 obj << +/D [1490 0 R /XYZ 85.0394 769.5949 null] >> endobj -286 0 obj << -/D [1479 0 R /XYZ 85.0394 180.7476 null] +1493 0 obj << +/D [1490 0 R /XYZ 85.0394 744.1913 null] >> endobj -1483 0 obj << -/D [1479 0 R /XYZ 85.0394 140.0669 null] +278 0 obj << +/D [1490 0 R /XYZ 85.0394 684.3648 null] >> endobj -1478 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R >> +1494 0 obj << +/D [1490 0 R /XYZ 85.0394 655.3895 null] +>> endobj +282 0 obj << +/D [1490 0 R /XYZ 85.0394 606.8822 null] +>> endobj +1496 0 obj << +/D [1490 0 R /XYZ 85.0394 580.8718 null] +>> endobj +1489 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1486 0 obj << -/Length 2644 +1500 0 obj << +/Length 2887 /Filter /FlateDecode >> stream -xÚ¥]oÛ8ò=¿ÂÀ PˆQßêÝKšf¯ÙÞµ¹&=à°ÝZ¢m]eÉ•ä¸î¯¿ÎP¢¥[\ ‡Ã™á|‘3þÄ,ŠÝ8ó³Y’…nä‰h–oϼÙæþ~&˜faˆ6Õ«û³‹_ƒd–¹Yìdzû•Å+u½4³ûâw't…pçÀÂsnß^ÝÍ~ä9¿AÀ'/ò®>̃ÄùÏíý\¤Îû·7€ãÙ»··ïõìý öŽ|çêÍåíýõš™ïåëÏ…Î廫ë×4õú ïôëõå< û ®ïæÜÿvv}?èeë.¼ -§EüWŠ¾u®&½ó^»oš9;Ùç0‘ ŒnƒBÁ¨èh€‘†_8|?ƒ„éû!» )"³QõIàB Òæ¦d6æ+éÓm$‰YÛª\¶²=ò–K<g ‚ 8Ï…30§ z9e€ -ܸŸÐ«§žÏ~ -¨²îU»’¹"¼>8@“ßB'$Ä°xÅÅD}âœè´[Yq¬å¶Ì¥5œ¨Y N8¹dÜ€”Ì¡§Î¾îËuJ–*÷&ÉLÔ,ÛÖ„É›N‘ Psœi)¨¡½ ’9t;•ëðÉ™Gó /3³TFŒšSiU©â9ï#ƒÂ -°§´ý¡! -s½o¹liËés×A=œtÞ´dܬÜ4eΓcHÂ`àòäD »íËçZŽ( Ý8N³ï·[6•îDh•÷D@_[¼ÐŸ<‘<Þ4~"õ¿¿©!zºéIO‘ -7ʲètÓ â•Ò…ÌsU¡§a¾ø -0auCVÒ[k p+×-6À£¸ç„v?ÙŠZØ»&àÙ½‘¬f`%;¨ßSM6q蟶Ҁ Ðü5ÍqtùNw6[š¾ºýHH¨3 AͪW5ŠêŠÁ|FY‘´Ôs4ÞôDE1©÷âv¬×Йv,¨Z!Z—ÙRwzzUCdÏS§L·,bmšK„Þ±é8{<‰eð«A<2·Vx‰³ÕÃSï:;‰ØÖŽ³ -ðÒÙó,ú¢¹Â€&ÔæjžÝ”Jߨܦ@ Ñ@5?Ü•¤l’”L¢’#µN15§ -2[lTuq”XŠÃ”çfnJ 7²±#\Ïõ7&˜*(Õüd¬}Åq6FëĪNídKî
#£ KHî •|\ÙÉW@ŸŽRgÕ/¨ž¹çzƒ—tŒn軂þ¹9Ì3__¼!å ˜\Ö•Â#hJŸRëÉÜ*ºzÀ‹wSðå…ï»Þp˵O “6ë³>H#7 ì
Kø.ÔÔpú
vÍ„$Ô -»È[O]±ËE< ßõ…OW•wÖ‹V„kPxnø ¹¦x?_ÄŸcß¹~làé%À*ð#×A[ØzöeV ³, " ÖºŽ6Ј‹›?{Ý€F3K)ÃxasÖJÅvç’AXaæzih]+C¨W&æ œ s?rÈi;ÂH&ëÍZ¼¼„z2Ei%ôb§¥\Â,Z´«¾uñ¬›æ‡¥5 -"~§:s(1§PKvm3‘Ã-ØÕÖ4±ßR·´ˆÔ—<Âë7øB±ñÁÝiþTÕ@W~šÃ ׶¼I«& É´žØ•Çßæè ,戜z—½ýv‰ JÆ÷f…Ö# U;è—œWˆ Ó®ì츓Æ0£ÌäÐó@|žÄkg®Ÿfé̉Ÿ‹2Œç(ƒÎ|1>;ÿ\°7€k^Owç†ÌO€JxT1_Ù=WæAJ,+óp$Lá|FnÙ³á©%ü®
—¤s~=ê KŽˆ„KÞô¬GꦧqkBUëdÏžnq™ñÖ ÿ*¹£ØUÒ¼Œo65e„ûÓfcx -kÓ_´ÚôýîåÅÅápp¡U«»®r›v}Ñ5û6WŒZ·—»þ6ý£„½Ëõ×¾•æÅe° ¬^B‹ø )[F 'àÛ×ÿ§4—» ]zNÏtÏ<î±OGäÓ‘g7s?nhÞÁÅN0PL©C¸O"õÉÃÅ< Ä©Óþh–e]dðÿb÷9ï„xtJ‹Áé'[ -è(‚`êöî
Åû§2SM˜¸AšúÓ™ÚW7L …:ÞÉÍokOEÿ IuQendstream +xÚ¥]oÛ8ò=¿ÂÀ PˆQÔgï)›f¯Ùîµ¹:½Ãa»´Lۺʒ+ÉqÝ_3œ¡$;Jv"@4 ‡œá|ÒbâÁŸ˜„‘¥~:‰ÓÀ
=N²í…7YÃÜ?.ÓÌ,ÑlHõóÃÅÕ/2ž¤nùÑäa5à•¸^’ˆÉÃòw'p…p§ÀÂsîßÝ̧3?ôœŸ„ à³z7 §2vþ{ÿ0‰óáÝ àxvþéþþƒ™}˜ÂÞ¡ïܼ½¾¸ýHÓó½~óï©Â¹~sû†¦Þ¼ç~¹½žÆóðéãí|úÇï·\CÙ…'Q¨¯¿ÿáM– ‚_/<W¦I89ÀÀsEšú“íEJ7 ¤´˜âb~ñ¯Žá`Ö, Õ¥ð\_Fþˆ2}1+˜ j3L]?‰ýN›Ó™ð¼çµY wmõ%ïµØìw»ªnQzØà \˜7™ù©+ã04Ì™cà3G +Õ®ªz;£a^.õNÿ²%Äõý @DÛ´Sál4ÁYU¶fê@éP 0¶4 IYÕŠ°áS è«Y-:Û×y{¤Ñ¶Zî s8ÖãÛù?›^‡ U»Ñ5Y¯£žªÍ`© óL7nw´Ä
¼(6Gûùî=Zj;)~"'ohø¥¬%¡ÚŠP‡ªþB˜CÞn× *Bá1_Og2 +ãðÙ7Æú +|(u69³±_EŸ†ó˜Ù Øù¢Võ‘·\à=£¤À"lÇœœèÕØÍ`ÆØlVm-]z\ */[]¯T¦ o.Ðdw€0 1çiå‰2: 3f dËc©¶y¦Œ«áDQ©%Ê„“ Æõ~ +*s½ïŠÔœ¹wãÔÝMgUMÚÈìÊM•gÚÖ_Ö%±n+Ÿ»‘s³}ý\›„¡ 5ôr‹4¤2U½é=Û£/TÁgOÄç›ÆÀO$þË›Z¢§›žÔ‰pÃ4
O7ýÔ°"^Q*q¡â0u6f%°úWDÈ¥éΔñP lìmÔ£&Üx¹}^xáYážÆüK[Rƒ%DnÕpñGÍ€àb0\쪫cMÎîB+ÐdŠ Œ`sq‰ñO@R¬á¶(É.cœ 4¶cy˜wÎ,ð”#ÆoË¡QsÒâðÏÌm@õ‚¹Yª?5·—6íÍí|ÓqsnJæÇΫ&_—³ª,ŽhVq×Ôı5+À±Y®·!@/5.6ê‡)sU€]íËŒM°»:ßB
dê8˜4fhÓíu¬bn+€ o+ +ÛrTHåiÍV +R[dEuq‡)ÏMÝ„@.d#G¸žë1®0dPÊùqŸûþŽã´÷Ö‘UÞ©šÌFV:>!™pÔê<³“l OC¡3ˆ åÄÕ³}®×YIÃ芾+¨Ÿ«Ã4õMã
!÷ÀäÆ ´ éÀPúZO¶hÔVSë_LÞÕ’›îw½®Ë 0 1{£Ög3¼ Ån{é_zx>Ôna0þð ۦ•qò/Zç/íŠSV}i! ß@7Hòƒ7®È‡Õ"šøaàFG/Èï/Za$žJ n(>Lg‘ÀçüÈwnÏ<½Ø'¾Cå ÍÖ“¯Ðb¦’ˆ°µWA\ÝmýÉ› +š d²ŒgCÎF¨hX¹¤‰ T°¿„F ºÊ +%Ì¢fÀXªå[Ž¾Î+[M¥‡™5”!?Ó@š9äÒ%>´×ÕT„¿³˜wYšØï–ÊT´ˆ4= áÍ |!×ø`í4*ª4‰Ÿfzïµ5oRëÑ÷A#'å‘äfNBY0`Žé”SèõöÛæ $ÈßÚFft|í` :p^#º¸²Î@³NÃŒ‰ 0“AÉU ðyâ®A„?À¤Édà?æbèÌa +uù¬ÿ¡èÇÀ©×z© ÇksK& endobj -1485 0 obj << +1499 0 obj << /Type /Page -/Contents 1486 0 R -/Resources 1484 0 R +/Contents 1500 0 R +/Resources 1498 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1489 0 R +/Parent 1504 0 R >> endobj -1487 0 obj << -/D [1485 0 R /XYZ 56.6929 794.5015 null] +1501 0 obj << +/D [1499 0 R /XYZ 56.6929 794.5015 null] +>> endobj +286 0 obj << +/D [1499 0 R /XYZ 56.6929 769.5949 null] +>> endobj +1502 0 obj << +/D [1499 0 R /XYZ 56.6929 744.5025 null] >> endobj 290 0 obj << -/D [1485 0 R /XYZ 56.6929 769.5949 null] +/D [1499 0 R /XYZ 56.6929 659.1833 null] >> endobj -1488 0 obj << -/D [1485 0 R /XYZ 56.6929 749.1444 null] +1503 0 obj << +/D [1499 0 R /XYZ 56.6929 628.6281 null] >> endobj -1484 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F14 964 0 R /F62 1361 0 R /F41 1218 0 R >> -/XObject << /Im2 1350 0 R >> +1498 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F14 976 0 R /F62 1379 0 R /F41 1233 0 R >> +/XObject << /Im2 1368 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1492 0 obj << -/Length 2124 +1507 0 obj << +/Length 2097 /Filter /FlateDecode >> stream -xÚ½koã6ò{~…;`e bøÒë€~H“ì^ºm6Ýx[Ýâ Ër,D–¼–œ¬ÿýÍpHYr”6w‹;‡œáp8oJL8üÄ$W‰žD‰fÁ$[ŸðÉ=àÞKã;"¿OõýìäìŠ& KBNfË ¯˜ñ8“ÙâwïâŸç·³«S_ÜÓlê!÷Î/™ -!¼ó›‹«KB]ÞÜðöê|ioöéã¬DI a›vçíû K÷7!øÌ~ñqª"ï·ÛÙTÄÞ‡÷×°f±wŸno?ìlúÇ쇓«Yw¯þÝWx©/'¿ÿÁ' PÁ'œ©$&O0áL$‰œ¬Ot X •r+åÉÝÉÏ Ã Öl ÓeGãë˜I<^s¬,I=~,ÃD, Ã?¹íãÀË‚nÇÕÁÔa³P„¥¥œ€’ hꄳH€…#¥Ç%°ô
ê×&,µ@:ÁY $Èm(>LýP€ üPzWÇÖ -eÏw…Œ4è…Ã-5ˆŒ£kÝÔm>õµV^»J[„4@vi“¶ÙŠÀÏœË2'ü:*îí QÕ-s»)«×°¯˜O%÷ÜŽ§¢]¹S,Ùg)µá -2 ]…Ýg4tòÏÓ¹QP4ààF€…Ú׻ś -¦¡à¶ÊqªÜ½OvùØåma–l†ÁŒ2MdŸ¹åÒšXÎéê!-Þõ¡ ¨š£Õm·PÛi±vU`™6mÞé7µZL+›ë¡M<*† _³JÝ3gîzD’Öï ꃤoF+Ûuuü6êz«AQJû/¡awyìfò5‡XwÇóŸ.C«÷’üÿÕ²†D„~äû Yö§uKŒÖ-W¬Býªz%GêÕ˜þ—… Ô[ç4ÑFuïeÌ\Vc¨/P–ÍÝÆœ6ñŒ–îîSѱ»¹:xcÛjZ&S@ÇÊ&‡ »+U/•Í’$,Š8Â)a*ˆô°va -cKÎ^ú¼¬†ß{G>óî“ê7z>|ÇÒpÑ8–ã…JñÅ2‰œP(¸zöá.P1 bˆþo½Òendstream +xÚ¥X[oã¶~ϯЬ D oº ´Ù$»M·'›³ñž¢èöA–i[ˆ,y-9‰ûëÏCÊ’£´iF¢g8ä ¿¹PÌ£ðc^*RéÅ©$!e¡—¯O¨·Þûfe'ô¥ÞNOÎÞ‰ØKIñÈ›.zºB“„yÓùoþÅç·Ó«O“€‡Ô—d„õÏ/ÿ7aŒùç7W—Ⱥ¼¹CâÝÕù$–þôó§+‰ÓÃ4ÆìÌÛVî;ÆøBCzñi"bÿ×Ûé„%þÇ×0f¹wŸoo?îtòûô§“«igWßvF…6êëÉo¿So.øé„‘&¡÷/”°4åÞúD†‚„R7RžÜü·SØãš©c¾ EB„Ç#ΔlÌ™2&Q £3ÿ5 "Jý6Û"ñÇÓ‰z£ª¦)JR’4ÈòmïÙ;Î{Z©J8ºóͦܣ›Ú•Bb“µù +ÉÅV{³^ I¼½¾±g–âÈ©Reú7®9°d¸¦5Á.£É`Ã,1 3Ǿ0!µn/f$àG@D†Üèü efE5OÏàÿÙæ>o;* +pÍ@ F¢4J_…ÆIš†r `o gE‚(œGA—%ÝŒ¡ªCä…¡ŠF XàX;,¼”’˜AÄE,!·Üô +Ÿ²õ¦T
øˆSî?Z©|U×¥ÛŸ ôðÅ
ëÈ€¼Ûº¼k¶zˆŒÙòË$å¾-*…1P»F¹‚S4H nDÍÊJæu¥c}¹sž8*SÄ&Âãª$ —6¯˜~`…RòvWXähÝÁ˜ªXo +âùÕ- Ô^‡¸¡Ýn.ªÝÓx%æ!‘"²8ÕÊç¨ 0ß)ÓƒÚú™ácU,Wºpk±FåÙšw¯öH4m½Í– +¥æê¡ÈÕ©N1P'w-Š @5ß +Hqh0 ;Ïx(ìö?ËfÆA Ñ +–`’Ñ,¿@Ù´r:æbçÀMi’±&õ™êçQ 9ƒ-¿º¿Ì7¶Ï4ÓÉû‹ („“¦&@„È Y@ÿÙ9ØÿªžZYßÌwƒúä‘Ê ²¢Lr›C` ³ŠØI>fÆ@CK«uë“ö1xôz ã==©Ë|ð¢»èJ°Ç`˜‰Š#yPÜ-ÏmŒ ‘;—Ž+•«¦AkC¬.1Â&Ü)føèìp0·3³³
xûüÁZp»\uNfºÍ®XšÑyÞ*Kt×é‘Š~†> Yw‡ùº+hÜ<|ÍæÕÔÔø_ïšv`ˆµbs˜J^ÙñûÏÈ‰Ø ä좮Ô=…¥>Ï`©*µ-ríGsZw”ÞìèWª ØÜ3€ªl~øËHjì¶ËúÊ¥Î}?tIñ¥IݶjQ< ¯=”³ ·]´æ eØk +áÅ@+…¦Qò%ípÝŒ©ä}åf^« +ÚÝL3Am£X¨»› í²±ËÚÌ Ù£o/Â4}åVKkbYá +Ø?Z¾ëAÁ=P3GkÛn3<@i_‹µ«‹¬iUçßÌz1«l¦‡ñ¨4t‡0ìöšUæ®83× ânƒþFØé›Ñºv] ß‹º¾jP’²þ-hØY cÀ¼<%Ñël<ÿÏedýán‘ß\ÉÆ>½
:1öµ”v߸¾ùÛìá«‚Œ!Ç%|<u‘„§±Û”6J<ûŽÒ}Ä}¾õÿã}Ó{endstream endobj -1491 0 obj << +1506 0 obj << /Type /Page -/Contents 1492 0 R -/Resources 1490 0 R +/Contents 1507 0 R +/Resources 1505 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1489 0 R +/Parent 1504 0 R >> endobj -1493 0 obj << -/D [1491 0 R /XYZ 85.0394 794.5015 null] +1508 0 obj << +/D [1506 0 R /XYZ 85.0394 794.5015 null] >> endobj 294 0 obj << -/D [1491 0 R /XYZ 85.0394 603.0093 null] +/D [1506 0 R /XYZ 85.0394 491.3865 null] >> endobj -1494 0 obj << -/D [1491 0 R /XYZ 85.0394 576.4312 null] +1509 0 obj << +/D [1506 0 R /XYZ 85.0394 466.1094 null] >> endobj 298 0 obj << -/D [1491 0 R /XYZ 85.0394 268.713 null] +/D [1506 0 R /XYZ 85.0394 166.668 null] >> endobj -1495 0 obj << -/D [1491 0 R /XYZ 85.0394 242.1348 null] +1510 0 obj << +/D [1506 0 R /XYZ 85.0394 141.3909 null] >> endobj -1490 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F62 1361 0 R /F21 938 0 R /F41 1218 0 R >> -/XObject << /Im2 1350 0 R >> +1505 0 obj << +/Font << /F37 1038 0 R /F41 1233 0 R /F22 973 0 R /F62 1379 0 R /F21 950 0 R >> +/XObject << /Im2 1368 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1498 0 obj << -/Length 2224 +1513 0 obj << +/Length 2160 /Filter /FlateDecode >> stream -xÚ½Xmoã¸þî_aÜ p2Ñ"©×®@Ö›ííí6Ém¼-Š½ÅA¶éX,©’ 'ýõ7Ã!eÙ‘Ó -Ã9C‡Ã™g†äc~| „,LD2ŽŸ ÆËíÈßïÏ#nƸvÛ õv>š¾—Ñ8aI(Âñ|Ý“3/Žùx¾úêøŒs6žsûqv7qEà9ßsNß¼À›}žÈÈùûí|Âcçæã îÝ—ÛÛÍO`í@8³Ÿ/oçWŸ‰í¹—ïþ:áœ;—׳«wÄzwmVzu9‰|gþåóÕÝäÛü—ÑÕ¼ÛWïÜ“¸©Ž¾~óÆ+0Á/#É$Æ{èxŒ'‰oG~ YàKi)ùènôk'°ÇÕSmÉ=&d(Œ)ø1ƒ„…Rȃ19“—{žç¼Ýeù*+îi«7•*îî>Qg]ÖƆåºýùî/¸wXAôVðÆ0€ù" µl;Е‰ïd
~'¥O¼}Zã)g‹:Ÿ‰]iNù˜ÔŠØ Ãi7Š¨ ÊÝÕŒ˜)ÿPË– 'lÚ¶z3î÷ûI" VÂœUÑ4jÉJ=ü^»ìuK$A ´îûM¶Ü€ Ïïë‚{ðhÀ@ïÓ~‡¬hU½N—Š†´%‘ÍÐǬnwiN<°É…™´rµU0ue¥˜éz—@ -ö4±³, tÐû]šøÕ)]ö
¼ßO!nA:ÂT#!çð˜ ü$Éc G±}Ól]H+Ì:‘nBY¬3X[Ñ<×jµÎž~š–U; –
çÓ]SÁš±M ÔkKh¾–ŽN øÚ`ˆ°²ni¸q–ßñ4Ž2»c¨ükš©å¦$Qßyo†¬ßÿOôù¡¿äkjž˜gºÈ -+ÔÃÊmË„¤x–Ñäe{B -%'¤8ÖD£,FÔÙí— ¢‚·w ‚¢“I9ª¼Biðá,H…ˆ uà&ya#-žÛ
!°Im 7Ù}TÌd Gä¤Õ-”¡V"töŠFƒg”vÊô@üe¸¸Ù ‰a(ÓG»0Á:¶¶Fp>ˆl v½Aöb+£¦É]%,nÎx dÓÙqÔæY±{rŸâð÷Ð7.Uµ›Z¥Fòo\úZ^ÄY$ù±PùÎ]¨+Št«N -tü…5å‰Ä“Íaë öSgÎs“:
΂ÎI ¸v};^®¡î;S8 ¢érÄ⪾Û?îÌ“>$-Ð"ÚÉâ*/ Ì -Ê$ùÕ«Ò%g1÷¾pÊ -ÇËe|É|&½e¨4phÉ1åõK„ -V‘Pµ‚MúhHè§-5{yzÖ&RÄgmLÄp$=Òªj¦ÆEI†*î³Â,D‡6°."–ð˜
gè8‡¯91
YHÞ¤FaºX¢‚Tà©ÙU:;5É„Çã“KCŠð$¡º+·UFÅŽ ¨¨×Ôšà`Ù‚WâýR_7}SiÁˆr×VR`Våp¾"º.¤$B¡ ¸&Bkg®K¬# ˜€A©kNDÅ•Â[OÇ*6fjpÀ™Áz;mÕj¨ð# /:¼tÑyÐ¥CŒ‰-mLlØãÓIÇ–ÂæcäT‚ðµ7´Ó` \þ¦þ¿jJ©úér Æ‚´VÖÿ•Ê×ê©E°ˆãXÄgÃ9€™" -ã§Yu±mâB·Ý¡`ç2dìÇÑw1<Rßb¼eäFtÚB¢Zêè²2özõ»¡oLÃ<ÍÄöi.~ Ü@=½w>¬ #Ódi -‘ôLǸ1Þ¬_±`÷°ø +ÉS«v÷ÖË«[j|TÏp}xÍ̽_à“ŸÈ‡g%¼"÷ž‡j|í½°SÈéª9½~/”½³#4˜š,+N–z±yíìÜ;²„íH9ôêëu^ü?¿1 ã!?É8Ã"Š™ ƒ£šXŠšÛÇè—ªÿ::,±endstream +xÚ½X{oÛ8ÿ?ŸÂØ[`e ¢ùõ(ÐÒ4¹íî^“Ým±m9ÖE–|’ '÷éo†CÚ’«¤»·À!LÍÃá<~œ¡qø# ²0‘É(J¦¹Ð£ÅæŒî€÷·3açøn’ßõfv6¹VÑ(aI(ÃÑlÕ‘3 Çb4[~ò&ƒîÝþ|9 ûRsï/BÐà3×üòÃXEÞ?ogc{7?¿šåN?ÞÞÞîl {ké]þxq;»ú@ìÀʽxû±Â»xyõ–XoßÛ®¯.ÆQàÍ>~¸šŽ¿Ì~:»š ÎÕ=»à +õï³O_øh &øéŒ3•Äz´‡ÎD’ÈÑæ,Њé@)G)Φg¿ v¸fé -gR…rÀ˜2¦NX¨¤2Æü~쇜{lrY•«ünWgDhª"ó& üÇ8ü
~ b|*Àc"Á"Ûƒ3¥‘æûÛ{!ü"Ÿ—é&{=Ù5õ>&a€?ÛûE³›êD ²*Ò‡ª~½¨Ÿ¶m始EVduÚVõs«…[]g«üñõ¤Ú¶ÚõÀ¹“k);ñÝX7¢å>׸º:¥ %ýyÞÒx¾Ë‹å9wMfcNÊÀ ͶBŠ•Q.ip0F×Ì„¦;FÌ¡c£ÇŪͬ‹ªü̹ßäåݺ ÇÞ®´gê:YpθV䡘MzŸ
œ\FN‘°“PÅI S: +º‚ÌÖmÖ´"ÅÆv:è‹5b0x +l9Ò*dW¿«n,‰ãx¸jðý®HSôðRÈ +=¾‘Ž1ø’0È°ªniº•ßÐ=…ìé*ÿ¢°ÅÚZßñWC–óïˆÿWúù¾»åKg:1Ïdž—N¨3$f•ßV÷HáŽÑU{B +±~€Õ 9ªÄ+šŒ23Ð#(Ub +K$ „½»p–OíšðHp«6›ü®*^d‰@Ü¤Ý ¡V2ôö͆À¨ÜtÑñ”áãa $¡Â +œØ„ê8š» +màHÙ@æ:ò¤Ûw¸”Ũi +Ÿ³„ÅÍ3a=بy¹{´MŠ¨m»®³tù?ô+'}Z³óèô-s~³Ùù3íÊïkMÊ`à WAü†!` ]W1ÐÝ<#] þ±&"élC…/AK÷]¯@¸¡d• +8X§–„qÚÒ°sK×3Š’ñ³F 5“±Š\ƒ´Ý6¢$#+ïòÒnDN8€6+±èY
W˜<‡_ë2YH^§Vaz×@©¾R³ÛšËÌ‘(&¹ˆOz†áIAqWm¶9•:JSMo¨5ÁÁ¢…¨Äç
óÚØ: fT»vk V5P
K¢›2J!º‰+"´nåªÂ2’€ 蔦äDT\fØô X•ÕÆ.ÕGœÈŽzþ´C¥@±Xòè«îÜAO>˜ydK [âÀyÏ\9Ö®”¥° ׂd¯ëÏNsqh÷›úÿ©'ÝkôÝy ù# +¿Ï [DŠ8>"Eül.kèÞeæ.sÚâØæ„ûC™. à„Lï§:´a ¢Ñ´ 16…¶pÉn[ú0eÌ;•»¥¯íÀ¾ +ÆîUz>Ð
êPÏl"¼w++ÃÊ´74 KÈté~ «]WÌ.íoã~wà¦Yí +›Z€óC¯dŽb S\iS
Dˆ Ð…C OÖÏ®_¢Ï/†…uÃÕ€i W}EC¨Ðe2 Ú7 u㜠; +Üç0TIE'H8¿SŸè®#¦@Á \Â÷‚CcG£›•Ò×~S-s„Tƒ}¡>> áG³ËÛŒVƒ ¿¶¹TŠéÈ]ræB&ÓR±Pë /^Ö:ÃëÞsØÐC±Ò, æìôYþí^úùøÚ âX7ƒ2‚¸ˆAˆU +Wò+ÍÝkóתÿ +ú*sendstream endobj -1497 0 obj << +1512 0 obj << /Type /Page -/Contents 1498 0 R -/Resources 1496 0 R +/Contents 1513 0 R +/Resources 1511 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1489 0 R +/Parent 1504 0 R >> endobj -1499 0 obj << -/D [1497 0 R /XYZ 56.6929 794.5015 null] +1514 0 obj << +/D [1512 0 R /XYZ 56.6929 794.5015 null] >> endobj 302 0 obj << -/D [1497 0 R /XYZ 56.6929 769.5949 null] +/D [1512 0 R /XYZ 56.6929 655.8524 null] >> endobj -1500 0 obj << -/D [1497 0 R /XYZ 56.6929 749.8188 null] ->> endobj -306 0 obj << -/D [1497 0 R /XYZ 56.6929 169.0885 null] ->> endobj -1501 0 obj << -/D [1497 0 R /XYZ 56.6929 140.0535 null] ->> endobj -310 0 obj << -/D [1497 0 R /XYZ 56.6929 106.2012 null] ->> endobj -1502 0 obj << -/D [1497 0 R /XYZ 56.6929 80.934 null] +1515 0 obj << +/D [1512 0 R /XYZ 56.6929 630.3608 null] >> endobj -1496 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R >> +1511 0 obj << +/Font << /F37 1038 0 R /F41 1233 0 R /F22 973 0 R /F21 950 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1505 0 obj << -/Length 1981 +1518 0 obj << +/Length 1877 /Filter /FlateDecode >> stream -xÚÕXKsã6¾ûW¨’ ¨ª!„_HÕ 8“µ½¶œÊV&Š‚,Æ|hEÊ ýûm Š¢9“Ì&—Œk -PènôãëÙ„Â ›$!¡B“X$¤,œdå<ÂÚ÷gÌîñÝ&¿¿ë»ÅÙìRÄIdÄ£ÉbÝã•š$l²XýêÍ8¿]\ÜM} R/ S?Œ¨wþîç)cÌ;¿ž_¼Ã¥w×÷8¹¼8ŸÆ·x¸» -öÈ+Eô®ÙeÀzag#,¦‘9óÍÔ(õ²Ž„ÌÀ+9ÆÞn%3Pgƒ2 - óùÛ¯ ³ èke§¾ªÀëÊo7;•®¤~`•B‡"8•áû/y»ñ몚¦x;Û̶OYÃØlßì :ýXÿ,n AtëÿH!M¦á}ÓøJ$" -ÁNøÔgT߶ó…q·6õwW׃$˜<;ê"Ý™ Z;œaNéõù9Nà^ÔjÄOÅ#’ð0ÆìJîÕŸ>Éwä¶&vêç|¹ ðøÆ Á˜2þÑL=[ZfèEVy5õêò&7>yñßy]à}LwÙæmZ®¢àÏ`ÌH,Øh }aüñ±øsAcq×÷²ï4é›G¥KG) N:3['Ö¥£‚E `døSÅ@™5Œ^#¦´9ý%á, Dƒ³`´qÄr[¤¹†).…—.ë}‹+7`«ûûŸðGU[êK½{‚ÑK…w¨÷H.Ó2ؤϖsŠƒà3ІjõÎ[•µ=M„WæM™¶Ù†Œùঋí8²Rc'5fN*Ìò*«mÉÊ°d±Ùª,×w7ÑŒr˜lS“cšTãx¼6ÐÎ2šk&›z_ØóK5àÓ¤¥™Ø_ßD[ ð ÂGäŒvxÜûcˆWB¹µéXÒò¨^ØÇ,Ë>ddÿt‚Æ$ ‰ìŸøÿ€oÝþpÿ¯O @Bâ„Ê¿ þu†Ö™~Ÿ¯[e—õMms|7M¼½_× -êÄkî ˆ’ w‹`®/ù„°D 'ŠÄiÓ¢‘F„…’õ$!"èÔ'\²äÝtŠ^×úø&Ô€ “¨JÓ¿ô¥Pgýk
mkƒS]ö̆:žC ÷7‡¦Uå‘“¶+åCšf`HO†Œl5 ë¶UNDm¹©v óþæra“ªÿ - 'qÄØ„'X .þ'Þ!œÈ$IÆ_!~ÇÑï³|ýÄr åQ²y°Ý\_¢'AI Qyš{ªzα©Ž -¦Ç¯ÝßâÔ¾°#¥5Rl$ÃLâ[ƒžn…TûrÐÒŒc“îBLyƒ‡*Ú -éøH%cõÐ ëÍâB#+4_¦„±ãÔ±‰í÷1`‚íThðô ?4®"%̃èݘš¨7nÒªÄ}™€‰kÎÌÆþ’E˜}íT{%&´+T¥;Ü:øv"/9T$hc°Á3#z§v‚Ox˜œH4Ç€w -µ¶ÇöÕÊ4€•‚W” C÷üШG¿Ä½bç;äØmÒwglX- ¶ Mâ -P` ÐCÓõÄ ã®ýý\é¹ÌwØ'èw¼¾À1K`²ß˜c7Øæe÷F ±PóÙGAבTOü˜+ûM K«ÓOE®ÔêÛO}! 0 -†_/igÑ¿üôøQ9ˆ‰H> uº’&\ÆN)mu!^õPî£êkÕÿy”¼Üendstream +xÚÝXÝoã6÷_a´}•LŠúâûõ&mº½$]{{-º}e9Vc‰®%'ëÿþf8¤,+Jo¯= ÐÆH
ÉùâÌCò1ƒ '¡Ç„ Ʊ ¼ñpœ•#6¾‡±¯GÜÌqí$·;ëÍb4½ñXz2ò£ñbÝá•x,Iøx±úÙ™}sq·¸|?qý97qÈ9o˜p΋›Ùå[z{3§ÎÕåÅ$œÅ‡÷—@‰eèÃ2ÎÍÊ»w33ïKΩó‘…lö~"b移ń'Îí»k ™Ñù‡»»[=º˜ü²øvt¹híêÚΙ@£~ýü ¯Àߎ˜'dŽŸàƒy\J\Ž‚Pxa „¥lGóÑ÷-ÃΨ^:äËP$^˜øñ€3}>;eúgÞ ¥ _hojOø—3Æœ7‡b»*ª{2ôÍõq¥¤æ©h6ÔC§¡»À~âw¶Œa‚N–šý¿6yÌ¥p–-oü"ÞØ“¯€% f“a«²´)”Y¦ÖÔšáÀÉu£JÙ54t»Ë«ùü;³ºXîÓý‘>J˜k¤æõ.ÏŠŒùùŠEjøª +é÷‡=îxîÛø¹m|‰¤ã:çÍZ/{pöÔù®¨Ÿú^Õ6bçâòŽ:ïòã.ßÿž›I•ÅDúŽ¢5Û¢zx‘ó@´ï´Áê±X$È“Wv 9"]ÕD gboi˜åUºÜ¢#ñ£¨z¢ž¯#@ûÕçµ<I}½†V=.Œz@j7©ä? 6v¹ +†Œ«4±¨‰– ödDÕl4¤*ÛK Ób L¸cx¥µiiµðÝeÑiYT¨B à†/çzM³žìb’d¦Û`·Æê,$üÂÈ<D)‚GN$mTÝ€û…ð5[ &¯ã Ú²ül¹UIZ*‘—G3kE9‡´¾ ¸¥ð±¥ÑFÑH>س© &aMD«scg!^Æh¶göúÚÞL•eZÚà´©ôS‹yA$#½æ«‰AJe+j=o +°’CìÍTo +ê¬ P&'Âlöú‹û,£4û Óu)l]p +n¤~ä‚” «Bœo™ëb*¹ +€¦®·¯§à›éî!«9Ÿ ê}CO?³–¦÷—N!ºñŸ(^PÇmU +bqÙÅ ÿ`Ï\mÓ}Q¿ˆóÙuÀ,ö·ÃžÿKàµq÷)Ýg›×i¹Š‚Ï‹¿˜{±àƒ!ô_† +?sQ0vÝ]v&]÷`eteã(¥¦…Iëf³‰ª´TðˆÆ‹Œ>Ñ)ÉŒcpÌÓõÕÙÑh‰f!Àz`c‰ån›ˆR>œåéR ikü¨”¡>©ý$B,ÎQ ˆ\¦Gb°I
ç”áO->kªÑ»hò¬éh•FQ—i“m¼¡H¹mc;ŽŒÔØJ¹• +½¢Ê”9±2:±€xV² ¢ :»Tç’µ'³A +Ä€²ü‰SÆ <eºù~±nr㼬ëi“âûIâ öÚã¿·}œá#H@a éC> +ó :<)Ðr8&žs„ˆ(ép7 +!M£v…´*4ïUÓäV„2Üò¦'s~{µ09Õ½ ‡Ü÷âˆÃýSßIÿsî¾'“$¾ »-G·Ë’®¹g[À!)O’õ£ÁíÍíD +6ð?VUÅ„Ô(&<¶‡U^1%bYTE™n‰¦7©xgFB£E™®‚;RÚ䆨q¨°¯ˆDRÌÍ¥Ÿ £Ûf šû ï!JžÛI/‘ør¡g“|éÀÜV„¬N•?ÑÞÈÄâ Û@ ØP-¦‚‘”ººÄðG*YDmÅ endobj -1504 0 obj << +1517 0 obj << /Type /Page -/Contents 1505 0 R -/Resources 1503 0 R +/Contents 1518 0 R +/Resources 1516 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1489 0 R +/Parent 1504 0 R >> endobj -1506 0 obj << -/D [1504 0 R /XYZ 85.0394 794.5015 null] +1519 0 obj << +/D [1517 0 R /XYZ 85.0394 794.5015 null] +>> endobj +306 0 obj << +/D [1517 0 R /XYZ 85.0394 769.5949 null] +>> endobj +1520 0 obj << +/D [1517 0 R /XYZ 85.0394 749.1709 null] +>> endobj +310 0 obj << +/D [1517 0 R /XYZ 85.0394 714.4776 null] +>> endobj +1521 0 obj << +/D [1517 0 R /XYZ 85.0394 688.8412 null] >> endobj 314 0 obj << -/D [1504 0 R /XYZ 85.0394 638.5372 null] +/D [1517 0 R /XYZ 85.0394 535.7123 null] >> endobj -1507 0 obj << -/D [1504 0 R /XYZ 85.0394 609.0615 null] +1522 0 obj << +/D [1517 0 R /XYZ 85.0394 507.2665 null] >> endobj 318 0 obj << -/D [1504 0 R /XYZ 85.0394 430.1605 null] +/D [1517 0 R /XYZ 85.0394 332.8138 null] >> endobj -1508 0 obj << -/D [1504 0 R /XYZ 85.0394 403.4942 null] +1523 0 obj << +/D [1517 0 R /XYZ 85.0394 307.1774 null] >> endobj 322 0 obj << -/D [1504 0 R /XYZ 85.0394 256.4314 null] +/D [1517 0 R /XYZ 85.0394 163.8619 null] >> endobj -1509 0 obj << -/D [1504 0 R /XYZ 85.0394 229.5399 null] +1524 0 obj << +/D [1517 0 R /XYZ 85.0394 138.0002 null] +>> endobj +1516 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1527 0 obj << +/Length 2117 +/Filter /FlateDecode +>> +stream +xÚXmoÛHþž_aàXùP)šÑ{€ý6î5›^ëMÜ]m±q¬‹,ù,Ù©{¸ÿ~ä#˶úìÁ ÄáÌpHùc1pá'A脉LQâ;+‚Ályæîaî g‚×Øf‘Ý]õ|rvþÒ‹‰“„2 Læ Y±ãƱL²–ïá A„ko^Ü
m¸Öß„ ⣸/n‡^d½ O†"¶ÞÞ\gïÞÇoõìdgÒzñêr<ÝÒ´Ïr/¯~ +!¬Ë7/FW4uõ†Oz9º F¾5yw;º~šüz6š´vum®‡FýûìÃ'w ~=s /‰ƒÁ# \G$‰ ,ÏüÀsßó §8»;ûØ™Õ[{})\Gz¡ìq¦”}Î 'ô¤§ù˜ÅÐöbaM7yÑ’‰fÁ“«5º´Úæ™ZÇ€BÍyÛ¦ÌÔGו¥ÊÀ±‘ëYïju$Ñ^Ò·Z5yU2½&‰í"¼g¸à#oûAàD¾Û±èü-$Žã~oÛD»+òÔ•~;‘L¢C_Žoßþ~}±z‚,W:®ÆÂ5 ©×¨r›“Ë¥* +©mºÎÓi¡hÔTôWj–ÏwÌ\ðì*m‡ëöSÝËut܃2 ½´ZÌÁVÛN7³O(h ×uá†òòþHð«»²˜®@ŠŒœ(¾–ò2_×Í3ÚðÈ—›šM¬›Õ‘ðõ0†@iò%{=T Ûúv¥Ê»»×4HËŒˆ <(òéÜ«jÎÒ’ˆ) *ª4SÙÙç‹Cû<áÄ2Öæý4´Áa–ú¼ªÖ
ѯ¯þ|}ýüöòöýŸãËÉ«_Î!†ÏW³ZˆóM½>‡£/~úÏѪÿö{²sÒ …:†˜j6t 0L™}9q£v+ºjô{è[yC9ZJ+-´ã€Sª™ªët½£aÃì}Œ…œ“HÕ,¥lÔZ̦¥õQJ™Îy©¤YÌóB± ‹|¶Ðià †ÝTúnñ:<OZy9¯ÖK> é´Ò ãyœýÀc35=¯˜ØÔ<;ÝÑ—î 7ê»GÖZ‡¢a§Á ±>ëùÑql
È,V¶Uº'Z|?r‚0ˆÀb4ôœAÀpÙ TÁ0NȨsB¶ñš”<7gŸÆˆH"G†PSH>'x¡/tívõwBøfô~<ºí ã^õ¾ºdÙd¡ô½$Éi ·HWÓÂœ˜ò.H<B¨¾7˜&(u*àlZîˆhªª %Í"åà”ÚðX, Ø3¢òrVl2d€ñÀ˜î5Q*Ûjw¯Ê ÛC¸[íœ +Ärì ^À⊠l>æÇNEâ‰Â2U7ëjק tL¡/¿'Ï,ÈʺV3´u¾®–E:UEÐ$pD,å*ÉBëü¾üRõFuäCO’øOøõ áöbs#Ø +î‘rÑsBᇈDý çROÝÓ„F ]¬ ÔTK¢ËÍrª˜êh¨®J¬¹ÏöeéÔ jÉeºTY%žë$‰ò*‡,à® ŽBÌo'ŽL½&ÒÂ8wMyƒ0/«GæÞ¦
¯ ZIYB ðfMTΛ)m\í +¿Ï¯ß\• L=Hí`z¸Xb™
QÞ…m]k ºu[Ös×›&/òNúVVé2)=m,vCžÐyŽ“œç0iòÜç<‡I~ó¥Ë6,bÏÑNæiôD¥8§YJ+Óúh+ìÐU£ÚŠÀ ë1 e©ÏZ´SªæI +endobj +1526 0 obj << +/Type /Page +/Contents 1527 0 R +/Resources 1525 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 1504 0 R +>> endobj +1528 0 obj << +/D [1526 0 R /XYZ 56.6929 794.5015 null] >> endobj 326 0 obj << -/D [1504 0 R /XYZ 85.0394 110.5453 null] +/D [1526 0 R /XYZ 56.6929 725.1329 null] >> endobj -1510 0 obj << -/D [1504 0 R /XYZ 85.0394 81.3565 null] +1529 0 obj << +/D [1526 0 R /XYZ 56.6929 694.9784 null] >> endobj -1503 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F41 1218 0 R /F21 938 0 R >> +1525 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F21 950 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1513 0 obj << -/Length 2308 +1533 0 obj << +/Length 2294 /Filter /FlateDecode >> stream -xÚYmoãFþî_aà -T.ÖŠfô à>d7ÙÛ4½ÔM¼=,v…lc5²äzdg³‡ûïG9²l+m}W8 j†ä9²è{ð'úaäF©Lûq¸¡'ÂþtÙóú0÷ž`™¡¶¥^{goý¸Ÿºi$£þxÞZ+q½$ýñ죸B¸XÂsF7oîCzÎß„ â“zoî~ì|"q~¼¹ ÏÞ¿ ~4³ãì JçÍ»‹Ñøꎦ^÷âò繸}suIS—·¼ÓÛ«‹A 8ã÷wW÷ƒÏãï{WãÆ®¶íÂóѨßz ?{ý¸àûžçúiöŸ`à¹"MeÙ Bß
ß·œ¢wßû©Y°5k^íô¥ð\éG²Ã™èrf»Q “3¿ #ÏsÔ—Uµ®‰þáò— ®_ß]Ü}øet1~÷÷³jUŸ §Zˆ³^Ÿùäü› Hý]qöVÊÖ†^(a©Ùê_ U‚ #áT+µÎê¼| aÆì‹«7ê$Ð˯8yM¹Æ§t²BWÄ)ÕTiŸiX3[¯Ô4Ÿ[æBQTSض²ZÌ÷¦¥óIÊ`™My©¤ÙOž' Åz<-òé-EÛ -Ó0”Æ6]Wk 6 -ú¾tòr^—¼2²Iµ©‘ôi?ä±™†q"6šg'Ïô¤ÇMŒ#keöª¶ù̾g²F'`Ðb ‡‘s=?ØŽM£™ÅÊ6JÓ!îEM -Ea¿½>d-/Ç—Áa—7¦j¶±5ÀÇÆmRm
ÞÅaƒj!51ð˜ås”+zÅ\mÈ‹6Ì{‘ÖB…¹ÅØo¸ùW»>e8ðªe^×Í^ˆ^1HÄ0Nb+Ê#¸”„clš!¬+€k÷§†õ°Áë™þKú%á¡š °ù•ú¥CÇŸ¾_-øž„µ4@%4ç[U4ƒö›Fb™qëEA¢æ¶¯«½öžó%kZº-âBUfìЪ ÎrÔ±UÍU³ÓÛ¿Åü/%ªñû‰5‡¾`¤í#?Ì$a -vÙ¬©Eðͽº$>=mÒ£‘çLèÓ
, - ú¨"æF¥«%K€ñ-& -}ãGšÛ 4ŽUÿ/¬TÜ endstream +xÚ¥YmoãÈ
þž_a N>¬F¯Áµ@.ët÷ruÒØw@owqåq,¬,yõâÔýõ%‡”,ÙêÞE>˜âp† Î|8þÄ$ô,[Fî$ˆ\˳…7IvWöäÆþv%XÆl…̾ÔË«ë{L"+ò ²ÜôÖ +-; Åd¹þ`ܽ»}ZΞ§¦ãÙ†kMMÏ·Û·¿N…Æíünö–†ÞÎDÜÏn§k,yž'ˆ<¦ Á3Ÿ îXîOBñÑöì»ç© Œ>-§"4 ÞG¿<==êÑåôÓò§«Ù²ÛWï–¸©/W >Ù“5¸à§+Û’QèM^áöD9“Ý•ëIËs¥l9ÙÕâê Ý‚½Q=uÌ—ž -/t‚gºbÌ™n`ùA@ÎüóÔômÛXçU¥ó³:¾¨œXê_ñnŸ)+W5nóúÞqz‹ÙSÚ–'<©—YnÓjjJû V Ò©0ÖŠ™™ª˜-M™ÖGü +zçħßÐx·ø;1À} oàNiÕÔ¼@š'ª“åU“vúJ±TV¼§(Y¤ÙTY;–¨ o*fl@ö‰;ƒ»yž£wv2؉|CoNÅU‘Wh˜ iM#»˜EÐ'òŒ]AÂÄUüøhÛN’ªœç
§U+U x®öŽ€*¢Ð<Mhƒ‘Hs®·Ì /kaZñKÓ©‚…Ì*}ÉÓüe¸KºÅ^•q¹…î†XÑkú¡ñï"WÝDÍÁƒÑ„vºã´c`ÐÉg™ZÓwÏðÕ·)ëÎÖ ¤‘nHâX4´àkZmyL»•»½Ê«¸nWÓî +J#ó¢V7ôù~C¢yQÑTäT˜ÅÓmÃä\TìO6ƒ( +‡0h‹P +ì«ÌJòÍ%xÇf,=ÇWñª8¨A怃¹L Æuà´¨æ"áš"㺩ÊkÐyÝ×}y‘<IèºFÄc lº.oxÃÊ@í·ÌW$1W])(éËÖ~y¾cèv,Û.UrK‡Óª,ÓõZµü#ýBæÄ/Åiíǧ٠«ØÙ— 5<t¤?q\pŠ÷Mo\ŽA ¿p™Ý‚foEýz5ÄyN`…Î •ÒOó{²V凔ÊY¾£B {9ÄejrÓê:ÂÄÁe:U¤óÖŽÒêYÂ} XèksqÇ*´¡cŸµ<çwè–7TeþB?í +ÂqgUÑRú-IFÎá© !65 Dò¤6_ögQžÔjÚ¢ ”Ñ ËöÊ”‘§SÖ²LQɪÆ^½Ú4GŠ5`å +Òë?IQ¡8aX ¯Šîí’ðéÙ¨ªÏ^Úbõ¥aë!¦ë°4X¹ëžNÆ Ó¥gá øÈÓ·Ýaÿû¡ýô ¸"2 ñ,$m .P´F¡›¥wny÷"iú endobj -1512 0 obj << +1532 0 obj << /Type /Page -/Contents 1513 0 R -/Resources 1511 0 R +/Contents 1533 0 R +/Resources 1531 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1489 0 R +/Parent 1504 0 R >> endobj -1514 0 obj << -/D [1512 0 R /XYZ 56.6929 794.5015 null] +1534 0 obj << +/D [1532 0 R /XYZ 85.0394 794.5015 null] >> endobj -1511 0 obj << -/Font << /F37 1026 0 R /F41 1218 0 R /F22 961 0 R /F21 938 0 R >> +330 0 obj << +/D [1532 0 R /XYZ 85.0394 519.9229 null] +>> endobj +1535 0 obj << +/D [1532 0 R /XYZ 85.0394 488.8874 null] +>> endobj +334 0 obj << +/D [1532 0 R /XYZ 85.0394 326.6298 null] +>> endobj +1536 0 obj << +/D [1532 0 R /XYZ 85.0394 298.4037 null] +>> endobj +1531 0 obj << +/Font << /F37 1038 0 R /F41 1233 0 R /F22 973 0 R /F21 950 0 R /F11 1353 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1518 0 obj << -/Length 2186 +1539 0 obj << +/Length 2424 /Filter /FlateDecode >> stream -xÚ¥koÛFò»~; TRûà3è àØJã¦gë,µ‡kµ²‰P¤"’rÕ_ß™%EILS 0à ÎÎÎkçµâƒ?nE¾ËdìYaì¹>㾕nFÌz„½ FÜÐ8-‘Ó§z½MÞÈЊÝ8µX÷xE.‹"n-Vïíë·W³ÅôaìŸÙž;vü€ÙW7¿Œ9çöÕÝõô†¶nîæ¼™^CÏ^üü0LûŽqnNÎÞ]ºpNÀæ³ë‡± íÿÏc Ù÷ïngvç?Ïf÷zw1þ¸øq4]tvõmçL¢QŸGï?2k.øqÄ\G¾õ Ìåq,¬ÍÈó¥ë{R¶˜|4 ý·cØÛÕG‡|éËÈõ#8ÓãCÎôB7Cræ?ÇNÀ˜½*ªJ¥N•=”…"¤3§Uýžl¶¹r U£Á Õïž/4‹iQ« QÎnï^’”_Ô.[ ²â‘Èê'#á(«©.w×ež—Ï >É Ë]V?mªWCjÜͧ×òa~5{W;@ðk' Íìئ%W«AůZ™¯ˆ¸/Ä ~¿« È_Òú®‡2º§u¶Wf›Ñ²Sûò“Z"«:)VÎò0d@ï \4AjòFp«#[ã! ¢%€€ÀC:Òý±ÃpŸoUÚ^†²v5ªxÌ -—ÅÙ&xhZÑGŽt$Vô‚ ¤ŠÀ•Q,µÔž•h÷[UÌç?á‡ì¤àFš,mV¨ÛƘ¥7²¢3ï(‡Csað£œ"Ùt^è«#1<ÏPiå‘e’ç$¬\¢~2Ò_ßÞÝ ˆ‹¥+X$
“%ß
ô8æTKX—e^ó$ÀxO¨°?á9SâÆûba `æI4~? 8tC/ -\ãàK†"vý°#û÷×ø bpÝP4w út÷]në¬, ‚ÊHÚ·kBj j(&ú¬¢Ïe“å5ÏL´Iá( ÚÙ~J+]‚;"â@š¹]Ñ9Ú!ª•Z'M^W:[ -\ðÓ¤©Käj“H -oUånZ¬Û÷]Ñ·Ev>a%Ër¯NJ\ÌeíØ~(Ú±f©0¡Ô˜4Õn2'}Ù—„Ó“„‡LÛætMïä>Ô ÈÓ¼ãRí¼LÓv%§ª/[ýå¹Å@ÑY,™ñ< - ^qœcÍ~UžÌ¾] 6þÒ#Y.» BQŸ#su:×uó4h¹qõ=_ø]‡ã³Œ…Þßúa‡Cµ‰}o¸Ú€"éF,¾Ì‹Î1àeÀöÄYá:þ˜Æܱ¨_¶zÓQ »<‚ ÞªœIúyà½Ðô¨Ø%8v™À4‰+ˆca?èÿÓܾí`aÿpî*âqÐ5Ü8dÚSÖgðAÌ=Ojš>¬m?úD#&·iÝ”`¡Õ3²åëôk#ƒ“µîí†~‡TØfmC—Âä -] -Í+wF!èèšÇÖ ’Ïí8>ICr ¥®æi‘ä6˜Öm÷¢éÇ¡@Ûµz‘þm¹ƒYêÇAl9Ç_X¿9³% l üZˬ¶ã|óoÃǼ‡V"£H +’ÐhâÐ’¾ ¼¨ÕIÿܵݯÈ-YOù?Øùwendstream +xÚ¥Y[Sä¶~çWø!UÇSÅ(ºY¶yc¯!•° `“‡l ÌXÎzìٱ̈́üúÓ–= cÈ©Z¨B-©ÕjõåSˈ€Ã¯"ÃL*Ó N5‹¸ˆ‚Õæ„÷0÷ñDxžeÏ´ s½¹=ùñƒŠƒ”¥Fšàv=’•0ž$"¸Íÿ5’-@/®~3‹¥ŒxxóùêêÓõBÅá-
\\Rûæâò Qéb)„à*|ûÓùÕíûkÕ^Ôù»ß0 ž_¾}ï¼»¼!âÃûóE¬ÃÛÏ×ïoÞþ|òþv8Êø¸ Ïñíä?yé>áL¥Iì¡Ã™HSlNt¤X¤•êGÊ“›“ÿG³néœùž¥N˜ ãÿÙÌ–¦‘žß–ËD±„ó²,ZÇA–'ûÇ¢Þ5F2 Gñà])!XEÝ ³*&ˆ•dIœçÞßÑÂŽ3e‘ÑaMCHpÇq¾X^»¿àe#‹–áÇ©‡` Ë80IÂb° *|+¤Bkå˜Æ´;ýÁ*nàÇ‹ +ÞÕpÆ`tÌ^ðr,Ù ÓÈQCìW Ä<f&–‘;ÃU™Šê~±T2 ÛKÄO7¿þg×P÷ +ƒ‰¢¢6óüv¡xøwK½/œËÒ 3¶…—±ÉªÊîz×=Qggóne' +4vÕ³ˆÂ¢õ|Y¾D‹b€ ®ƒ<.dfU›ÝÃRiâ°^SÛ5î\Hfµp,FÔÇ ûÀ."ô R§ûvÿµD=-$ëÎ/„Û“zmMmîÛ;»ÆãÕ;¯Ðª®Ð4÷ý@«£sš|ÚÚêææX“ù°õE[’Ùç!›F—6)“IšãXÿ¾ôÁDRùs€€ïKîãŒäq,)¡™ÒFŽ×HÅbÄ• pÁ„œ#à>ö€Ûm·õ®¥Ž³ÛlYÜ'X^&©rb=3™±Yweù„¤øpÒšÈÊ’Nˆ›$´UKœà}‹N®lîeÔ»MC2\@Âר*ÛX¢\ì ä<'_”UùìÌaÉAHY×_»mÃæÒãÂ[f_8ÝÊʦ&ªk¬¿£kŽv³
µž{“}õìß:»+úéýƒõFß-’°«*Ê:è×~<«¦»¬²mvWziÍSÓÚÍAù˜¥îNù5¤Œ” +¹Ïœb9
ø#Ÿb/é=ã)5ÞmÚ
Ô•óPçðC tU“\0ßRq^xKÓJETn· ɳgõ:8°B‚숻¬ý fv‡Ó¹¼'G›4\•„Ó²)rKÍÙÐY;S +µW +lÝì페A ²îŒèyÏÉ‘ç0ÀW+»õyæ€y³ƒíÖn;èÑÈ<å;: ôÏMŸN“ð<Jx” XxPn™~ÚÒÔ(UŒœìÊPœ ! RLÃ0hŸmQWYI3_¤ÔUqi‹1!ÈÑéÀ$§QÂ(âÁøªt¾*JµA5T±5,Ûm³˜V0ŠÔ3æõ¬DŽ€›)f<âzâwWÊpo]hÅj¡cQ—ù(žLíq^?WWh…m”ŽÔ-àâ®Ä*Qª#m1â8üä6uû£_À¨
©çðF½S€JiÂ;ÅYt¬>šþ®¨²Ýñ•Ù-?œYDÌY 'òa¾€¥<è›(üZÕûŠH 㥶M»ƒ ĬÄB >%X¸ëZ !Säë( ô‰%¤$ªæ7x €ÇZ¿÷ªÞlKÛZ¦hŠMQ¸u&ƒÅÈ3Ù‡ðŒöÕ&ü5«œfÛmY€+½‰a„‚q0±‘}ÜSµ&ên‰è*ðRÓz<îÄá`’ Nä!øaß¾-ýä цòמz“÷ÒÝ}<s,ân» Ð:u—'¶–
ó »ÅšÚ{€a 3ƒõ…gÝf»¶XueÖºÂLèå ¸"Ó •RCA6ÑTA¸y4„ÜN,5„jHùÇÀÌ…7Å»Á¼@;ó6¯Ô£rBe÷Xؽï=ê>ØpÉ=n‰Gjq,RVmGv>^ûBtê×Z;¹UÄ™N ßà ÌŒ†B5K“»{ÿj» =—þåxAÿ #ßT.Zàî³¢/ªÎ™dâÙ +~È:ûw†€}JÑbâ”%Iœ:µ~øt}ñ?>,c +€EâØ¡îÕíµ§ðá„Ãkˆa =ÃqvöNm÷xá €øŸƒ™ +…ÈñÝÿÄ8|pÔ1SXRÍ–:ðÄRGõJ¹†y¦¹ endobj -1517 0 obj << +1538 0 obj << /Type /Page -/Contents 1518 0 R -/Resources 1516 0 R +/Contents 1539 0 R +/Resources 1537 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1489 0 R +/Parent 1545 0 R +/Annots [ 1542 0 R ] >> endobj -1515 0 obj << +1530 0 obj << /Type /XObject /Subtype /Form /FormType 1 @@ -6055,87 +6190,40 @@ xÚm”In 1 EOPw¨u€$ÅIg0²Êľÿ6¤¤êV5 oʯÅésÀóή¯ƒÖ×O²Î Ž¢‘ÿ¨#h8Çùø:„5? ù 6\>RgÈbÏWÖ¹j[†› WŒÏ¢®{6;»²þFÃÇñ÷ø]š¨)Õ/Ô¬Mu;pk; Ì©Ëdh<åE–ñ¬AÏw³ð¬±±Nê¦ó¡Ä½t•‹ùD„™Â²]°Ä(‡;„ ·åŽ°Šr²ÂÙÄLûˆ
T¥Í¡èª‹ŠŽt’¹w_ =Î]ˆ‹=¦uSä÷—ä"ï ±yl±‡µÃ-ËkHsŠöreOÚ³êvg›<7ºt,‡Ýe—;ãÒèÐ/I…B÷&ê(ýê³ö󻉨YÙ¹Ç,çkRÔšÚ' ^
m" ^˜h±ÎW9AVªy ©/fýÆ"•œãûFy-Sng \Çdª¼˜©Æ¥†Í}B©• µŒÎ$âw1.¶&Øíþ²C¶O–ÃVç X×9g¹E{îÇ< •ãóP)!ÍZÜÅŸLÞª~ÑÔ'¯UâXLµüc“ÅXsЖõÚ ¯½˜Ó’~òBL–§èªÆ¹O¦ºNZ_[Èü.øšŠû*]3QôçÇñ !Ö-žendstream endobj -1519 0 obj << -/D [1517 0 R /XYZ 85.0394 794.5015 null] ->> endobj -330 0 obj << -/D [1517 0 R /XYZ 85.0394 646.4943 null] ->> endobj -1520 0 obj << -/D [1517 0 R /XYZ 85.0394 614.9326 null] ->> endobj -334 0 obj << -/D [1517 0 R /XYZ 85.0394 450.402 null] ->> endobj -1521 0 obj << -/D [1517 0 R /XYZ 85.0394 421.6496 null] ->> endobj -1516 0 obj << -/Font << /F37 1026 0 R /F41 1218 0 R /F21 938 0 R /F22 961 0 R /F11 1451 0 R /F62 1361 0 R >> -/XObject << /Im3 1515 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -1524 0 obj << -/Length 2039 -/Filter /FlateDecode ->> -stream -xÚ¥XIwÛ6¾ëWèÐõž…bãæ››8©ûZǵ•öÐä@‹P̆"U.VÓ_ß H‘í * 0 -½
ÜÜRûÃÍí[¢âÕZÁ•÷æÇ«»Íõ=j'êêío+˜ö®nß\»oo ˆxw}µ -µ·ùxý°ú¼ùiq½é2<.Çsüµøã3_¦pꟜ©8ò—Gèp&âX.÷ í+æk¥º‘|ñ°øµ8˜µKgÍ'8“*3ö“b)4S&‡ôcêû½Áœ£Ÿ;¶‡CY5ÔÉŠsãÁ¹Aº x‡/×2bA++Ö1ó-Í®ÍóoH^MÒkšHòœˆm[U+y¦hˆ3ôRó‰sY˜ÔÉ(«}M2Ê
9*’½!ª)ä4%µ[”éìÌiÉIH^–_ÛCÍð¨x8!XìûÒ îÆYæ˜YÝJòº$ª‹¹ÞšƒÝLMCãÞ'_ û_©²núødœÑ«UäµE‘_¨_ºñ¤˜î²MÉcî¤ÕßêÆìOʇ,V2²Ê¿++à‘ -yL¬b)
¸#_`/ê<ã15Îm+áÕ4PÖO@]Á(:è¶$¹`¾µâ»÷†¦• -Q©9€$Çž4ÆéÐ<"ÈŽ¸ËÎíÌîp1v¡9:ˆ½mžA8ë,54P÷‘
5V6´Ù4xL ‘l»p‡=z¿d_>·åÎŽ”{è…}ÒÀxŒ¶BïÇòhžM…‚–†&i›§²Êš¤ÉžÍ\¼u®ˆÈQ¦@Õ¦aµë4@æe’õOY8^Ì¥Ü8ÞmY4Iæ údÞ¨79'$+HÈÎÒeç³ÁµW -l] ME‹OA ²îŒèyÏÉç0À·[spy掀ySÁv;» ôhdžòNý« K§IxŽ$ $H ºÜ -ºehhCSƒT Tïd{àô -M¾w°&ƒÅˆÇ3ɇèŒöÕ÷KRX)ÒK‡<W:ÃÅboâ@vaŸ–Ô-ʆˆ¶ -<[lïNl
!¦;v³ µ_ -3¡“7Âo;D¦A*¦†)Bl¢©€°óh2$¸XjÔ"üž»ï¦p×›hkÞú•R`PM@¨TÏ™9ºÞÎî“éñ–Üc—8 †Çe öµv ¯}¡ -ºpk™–ÐÊçLG‘„j5f:‹Yš¬¾,‰¸ T¿=ÿz¸€ªß1ðMå¢ à:˺šêŠI&¦úh Â:À¯¡ø³¼çú-Î¥¡Ìa Të]ØîèdalÈà©œÞ;ÂìW`R*aAûŸéJ¢ÎÇútõQmÔ=^|pŸÏïšÅÚ鳡"Ìï¼È yþ䥱¬¦6¡æ€•%æ®Mm°/¶ÙxãIíÍJµÕ…
3GµEž}5#!zzתÁ+òêƒÙf˜H¦žƒŠ>Ô¡j̆ñ<Çã÷‘+BÐò]>V¡UðSÖ™¿ì rˆ‡Ä,ŠÂتõ݇û›÷øˆ
x¿ŒÜϾNžÊr4”Àª€ öÒœžÀØíâÇ€E\¦Ñå¥x!(:|ÄÚG)mS[)rà:+ÖdœÙÃ]^@zòèÁ¡¬¦…„u0Йg¿7pQ¤öñ¼›“@
×Ù+ÏÎÔRáÔ`7gߧ÷ÉÂâå«a#຾N E‹]t/¾æiÆ]Bð>ï+•ËË ü.E ©DL;X™Øñ@GnQROÐvp¦y€J2í‡r!ä BtÎ[z=¼‚·¶&uß;ôÿ4~·oVÅé iEa§=P›¸ÉQúà@æ& -·'Ò}‰¤àb
2» ¸ ‹Æõ“.c±Sg%߈ Ôï©•x¶6¬¸¶†wŠÌ½õ!Æœ"xåû^CE-b5)½ÙŒÁ|…HtŒÎ2ü¤ ºGû3»·yã,ªm)©¢C%ÈÖCÉØb»2ÏËcï‹cÙæn#‚Íò ÆTçrÍ b&uîøჹÑÇ=æ b”³}ÂœáæLż tè¬ó:2> }Õe›‡Ï2耵_ÆQÎÆÿˆ=²Za{’\9
ÁøkH?Ä_¡5°ˆ -_V8¼†ÆÐŽ³Ø[µíCâ…ø±p¦Bá=rüïo’§ïµ:d -KªÙRž‚Xê¨N)ûÀÎ4ï>^ž«þ/»œdendstream -endobj -1523 0 obj << -/Type /Page -/Contents 1524 0 R -/Resources 1522 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 1530 0 R -/Annots [ 1527 0 R ] ->> endobj -1527 0 obj << +1542 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [349.4919 566.941 408.4801 577.7254] +/Rect [349.4919 431.1147 408.4801 441.8991] /Subtype /Link /A << /S /GoTo /D (ipv6addresses) >> >> endobj -1525 0 obj << -/D [1523 0 R /XYZ 56.6929 794.5015 null] +1540 0 obj << +/D [1538 0 R /XYZ 56.6929 794.5015 null] >> endobj 338 0 obj << -/D [1523 0 R /XYZ 56.6929 769.5949 null] +/D [1538 0 R /XYZ 56.6929 640.7425 null] >> endobj -1526 0 obj << -/D [1523 0 R /XYZ 56.6929 745.0977 null] +1541 0 obj << +/D [1538 0 R /XYZ 56.6929 609.2714 null] >> endobj 342 0 obj << -/D [1523 0 R /XYZ 56.6929 552.7519 null] +/D [1538 0 R /XYZ 56.6929 416.9256 null] >> endobj -1528 0 obj << -/D [1523 0 R /XYZ 56.6929 524.1722 null] +1543 0 obj << +/D [1538 0 R /XYZ 56.6929 388.3459 null] >> endobj 346 0 obj << -/D [1523 0 R /XYZ 56.6929 397.0585 null] +/D [1538 0 R /XYZ 56.6929 261.2322 null] >> endobj -1529 0 obj << -/D [1523 0 R /XYZ 56.6929 368.4788 null] +1544 0 obj << +/D [1538 0 R /XYZ 56.6929 232.6525 null] >> endobj -1522 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F39 1161 0 R /F41 1218 0 R >> +1537 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F62 1379 0 R /F21 950 0 R /F39 1173 0 R /F41 1233 0 R >> +/XObject << /Im3 1530 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1534 0 obj << +1549 0 obj << /Length 1913 /Filter /FlateDecode >> @@ -6147,59 +6235,59 @@ xÚXQÛ8~ï¯È£h\K²-û±½Ù[tqW,º³O×{Ple"Ô¶²‘=¹ù÷GŠ’gœn ¦)Š¢Hê#e¶ÉàÇ6U‘f¢Î7²ÎÓ"cÅ ¯“Ä `ÄЖœè• Hg‘…žEÎJŸ°ÕËûkŽ½.{²úöúâ-Tšz§mØÀ"'©3V‡+úJZ•ø?Õ“²Û¦t¾¦¿
,çóýÃì(êTÊ¢ºîUÞýò4KŒ_E‘â÷Ƶ¯Qd{‘¡O‹“‘ä endobj -1533 0 obj << +1548 0 obj << /Type /Page -/Contents 1534 0 R -/Resources 1532 0 R +/Contents 1549 0 R +/Resources 1547 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1530 0 R +/Parent 1545 0 R >> endobj -1535 0 obj << -/D [1533 0 R /XYZ 85.0394 794.5015 null] +1550 0 obj << +/D [1548 0 R /XYZ 85.0394 794.5015 null] >> endobj 350 0 obj << -/D [1533 0 R /XYZ 85.0394 769.5949 null] +/D [1548 0 R /XYZ 85.0394 769.5949 null] >> endobj -1536 0 obj << -/D [1533 0 R /XYZ 85.0394 576.7004 null] +1551 0 obj << +/D [1548 0 R /XYZ 85.0394 576.7004 null] >> endobj 354 0 obj << -/D [1533 0 R /XYZ 85.0394 576.7004 null] +/D [1548 0 R /XYZ 85.0394 576.7004 null] >> endobj -1537 0 obj << -/D [1533 0 R /XYZ 85.0394 544.8207 null] +1552 0 obj << +/D [1548 0 R /XYZ 85.0394 544.8207 null] >> endobj 358 0 obj << -/D [1533 0 R /XYZ 85.0394 403.9445 null] +/D [1548 0 R /XYZ 85.0394 403.9445 null] >> endobj -1538 0 obj << -/D [1533 0 R /XYZ 85.0394 368.2811 null] +1553 0 obj << +/D [1548 0 R /XYZ 85.0394 368.2811 null] >> endobj -1532 0 obj << -/Font << /F21 938 0 R /F22 961 0 R /F41 1218 0 R >> +1547 0 obj << +/Font << /F21 950 0 R /F22 973 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1541 0 obj << +1556 0 obj << /Length 69 /Filter /FlateDecode >> stream xÚ3T0 endobj -1540 0 obj << +1555 0 obj << /Type /Page -/Contents 1541 0 R -/Resources 1539 0 R +/Contents 1556 0 R +/Resources 1554 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1530 0 R +/Parent 1545 0 R >> endobj -1542 0 obj << -/D [1540 0 R /XYZ 56.6929 794.5015 null] +1557 0 obj << +/D [1555 0 R /XYZ 56.6929 794.5015 null] >> endobj -1539 0 obj << +1554 0 obj << /ProcSet [ /PDF ] >> endobj -1545 0 obj << +1560 0 obj << /Length 3198 /Filter /FlateDecode >> @@ -6212,47 +6300,47 @@ q@ÏÉÉ ÖgM± q^Pב"Ü*ïJ¬}9ÊôÅ9u•½Ma®¨«„¬ÖbP„sÉ
dKFè±2dw£CF:ñPïBFã!¤C‘Ÿ·(9˜p@Ê@èë‹òˆq6F™‰xT¨âTD_ZÈœW¡¸8öõëýGz<i=Ô°…¼¦BNƒñø¸ˆ=º†s/ÞÎß0^pw$Vóz]®®;¼¿‡ä ‚6žq)^i·¥‘ºé«' Ìaüs¹Ú… ÞðøÉþð…`¤1ô¦«6å¶ì ÞÆ Ú×åüÜ/Rü‹ý‘êb:ÅÅ#¡.³©k @;“‚®*kÌÌkå7V° *3ëÛk endobj -1544 0 obj << +1559 0 obj << /Type /Page -/Contents 1545 0 R -/Resources 1543 0 R +/Contents 1560 0 R +/Resources 1558 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1530 0 R -/Annots [ 1551 0 R ] +/Parent 1545 0 R +/Annots [ 1566 0 R ] >> endobj -1551 0 obj << +1566 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [356.2946 363.7923 412.5133 376.6291] /Subtype /Link /A << /S /GoTo /D (address_match_lists) >> >> endobj -1546 0 obj << -/D [1544 0 R /XYZ 85.0394 794.5015 null] +1561 0 obj << +/D [1559 0 R /XYZ 85.0394 794.5015 null] >> endobj 362 0 obj << -/D [1544 0 R /XYZ 85.0394 769.5949 null] +/D [1559 0 R /XYZ 85.0394 769.5949 null] >> endobj -1547 0 obj << -/D [1544 0 R /XYZ 85.0394 576.7004 null] +1562 0 obj << +/D [1559 0 R /XYZ 85.0394 576.7004 null] >> endobj 366 0 obj << -/D [1544 0 R /XYZ 85.0394 479.565 null] +/D [1559 0 R /XYZ 85.0394 479.565 null] >> endobj -1548 0 obj << -/D [1544 0 R /XYZ 85.0394 441.8891 null] +1563 0 obj << +/D [1559 0 R /XYZ 85.0394 441.8891 null] >> endobj -1549 0 obj << -/D [1544 0 R /XYZ 85.0394 424.9629 null] +1564 0 obj << +/D [1559 0 R /XYZ 85.0394 424.9629 null] >> endobj -1550 0 obj << -/D [1544 0 R /XYZ 85.0394 413.0077 null] +1565 0 obj << +/D [1559 0 R /XYZ 85.0394 413.0077 null] >> endobj -1543 0 obj << -/Font << /F21 938 0 R /F22 961 0 R /F41 1218 0 R >> +1558 0 obj << +/Font << /F21 950 0 R /F22 973 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1555 0 obj << +1570 0 obj << /Length 4323 /Filter /FlateDecode >> @@ -6277,21 +6365,21 @@ t…U.†_ñ ‚±ÖVt„àj] ‰¹gÚ¨lo(kth…gÚÊliÒYìûˆ‚ApzÚRŒï4E£ÑM ¼¿íEü€iª@žOEÛàIÑ¢Ðm¶õ‘ëâJ©ƒZË8lgƇŒå}µhTꀗ3åª õ!–ð ÔiÑ̲@¥ðöó ¤ù}ºr”<â ÔèNÉ êqPY Ìóþ&¿(O8½>Å[Þ4 z_ °<^„V—£ÎT‚˜P{ÐQ:÷ôžBò#ºLtèùî™P¥³¯ñsÔƒoFyè?amÕךºbhûºí µâŪãšo S.uOo÷%öÙO»á7Ž»½O»ÿo¿ê“Sàoxf "jˆ¡E~~ði¸À̽Æoq|éûqÞ ý›¿Vß}˯ S~p9aÏà{¬DZ#¬xi” |K/À<+ÛÏ þ¿x¯õendstream endobj -1554 0 obj << +1569 0 obj << /Type /Page -/Contents 1555 0 R -/Resources 1553 0 R +/Contents 1570 0 R +/Resources 1568 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1530 0 R +/Parent 1545 0 R >> endobj -1556 0 obj << -/D [1554 0 R /XYZ 56.6929 794.5015 null] +1571 0 obj << +/D [1569 0 R /XYZ 56.6929 794.5015 null] >> endobj -1553 0 obj << -/Font << /F37 1026 0 R /F41 1218 0 R /F22 961 0 R /F21 938 0 R /F48 1238 0 R /F11 1451 0 R >> +1568 0 obj << +/Font << /F37 1038 0 R /F41 1233 0 R /F22 973 0 R /F21 950 0 R /F48 1253 0 R /F11 1353 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1559 0 obj << +1574 0 obj << /Length 3057 /Filter /FlateDecode >> @@ -6311,45 +6399,45 @@ l˜MôÆ'AŠ¿ÇqÙ„{ûÁZaß P" ÌGÊ–© Di82:—T¡Ëµ >¤[n¤,ÍÆTË–èŽýaeìL-±sòÙ‡@*Z¢\k?’h[ °³cŠ$ØÎçîƒišd;qî®+rw«Q÷å iû½àŒ+h=óàâCxÇ
þª`P‰8KBÿùÙ}|~Y¯û’hø'ƒcß›ù[¦v
“ñ
•/-‰£K%WÒ ÂÛmãn}ãÔ†H‰— *–³«³ Ûa”4ÒΞ 8·M65-m¾Á%sßPÛŸÓ÷Þne¯( ›îõ Û^7Àó¶bg˜Xðt(¤€ðòœŸß}wNy©n&¯W¦,ŸmLãoQ Ñœ_ T$ð¯1_ Kÿ÷?pŸ1(ÀÒpús‚‚ž†Yâ&…Ö软ˆþ¯:ûSÿ +/yÑendstream endobj -1558 0 obj << +1573 0 obj << /Type /Page -/Contents 1559 0 R -/Resources 1557 0 R +/Contents 1574 0 R +/Resources 1572 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1530 0 R +/Parent 1545 0 R >> endobj -1560 0 obj << -/D [1558 0 R /XYZ 85.0394 794.5015 null] +1575 0 obj << +/D [1573 0 R /XYZ 85.0394 794.5015 null] >> endobj 370 0 obj << -/D [1558 0 R /XYZ 85.0394 769.5949 null] +/D [1573 0 R /XYZ 85.0394 769.5949 null] >> endobj -1552 0 obj << -/D [1558 0 R /XYZ 85.0394 752.0459 null] +1567 0 obj << +/D [1573 0 R /XYZ 85.0394 752.0459 null] >> endobj 374 0 obj << -/D [1558 0 R /XYZ 85.0394 752.0459 null] +/D [1573 0 R /XYZ 85.0394 752.0459 null] >> endobj -1561 0 obj << -/D [1558 0 R /XYZ 85.0394 723.5337 null] +1576 0 obj << +/D [1573 0 R /XYZ 85.0394 723.5337 null] >> endobj 378 0 obj << -/D [1558 0 R /XYZ 85.0394 642.6584 null] +/D [1573 0 R /XYZ 85.0394 642.6584 null] >> endobj -1562 0 obj << -/D [1558 0 R /XYZ 85.0394 613.9312 null] +1577 0 obj << +/D [1573 0 R /XYZ 85.0394 613.9312 null] >> endobj 382 0 obj << -/D [1558 0 R /XYZ 85.0394 133.1977 null] +/D [1573 0 R /XYZ 85.0394 133.1977 null] >> endobj -1563 0 obj << -/D [1558 0 R /XYZ 85.0394 104.7573 null] +1578 0 obj << +/D [1573 0 R /XYZ 85.0394 104.7573 null] >> endobj -1557 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F41 1218 0 R /F22 961 0 R /F14 964 0 R /F39 1161 0 R >> +1572 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F41 1233 0 R /F22 973 0 R /F14 976 0 R /F39 1173 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1566 0 obj << +1581 0 obj << /Length 1991 /Filter /FlateDecode >> @@ -6360,92 +6448,93 @@ Dűô›Ñb+ž¶]±íhà±ìVÔÙ o÷ØPÏrUl‹eg¶-
œ¾¦þ_¸æmU´«hk‚ƒ>A\Ö¨Èfˆe¼>¥ ‹ 2´èî‰]xBH&Žáì²¾‡«/vž.ˆÀ`oFÐáÄ 7]«¶»AÑE³3óÑR?E*É™Ìò, ýôe®A¦ó|x·zY`îG“–© ¹„b±JdøÊ%tîÌsÿLè^7ÎÇž.Kú¹Úëu±=R]3–¤yì£OB˜¹w rú<~HbìlËÖÖM`±…¾v›|=MÜ‹ endobj -1565 0 obj << +1580 0 obj << /Type /Page -/Contents 1566 0 R -/Resources 1564 0 R +/Contents 1581 0 R +/Resources 1579 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1573 0 R +/Parent 1588 0 R >> endobj -1567 0 obj << -/D [1565 0 R /XYZ 56.6929 794.5015 null] +1582 0 obj << +/D [1580 0 R /XYZ 56.6929 794.5015 null] >> endobj 386 0 obj << -/D [1565 0 R /XYZ 56.6929 769.5949 null] +/D [1580 0 R /XYZ 56.6929 769.5949 null] >> endobj -1568 0 obj << -/D [1565 0 R /XYZ 56.6929 749.9737 null] +1583 0 obj << +/D [1580 0 R /XYZ 56.6929 749.9737 null] >> endobj 390 0 obj << -/D [1565 0 R /XYZ 56.6929 670.1208 null] +/D [1580 0 R /XYZ 56.6929 670.1208 null] >> endobj -1569 0 obj << -/D [1565 0 R /XYZ 56.6929 644.0935 null] +1584 0 obj << +/D [1580 0 R /XYZ 56.6929 644.0935 null] >> endobj 394 0 obj << -/D [1565 0 R /XYZ 56.6929 176.1924 null] +/D [1580 0 R /XYZ 56.6929 176.1924 null] >> endobj -1570 0 obj << -/D [1565 0 R /XYZ 56.6929 144.3484 null] +1585 0 obj << +/D [1580 0 R /XYZ 56.6929 144.3484 null] >> endobj -1571 0 obj << -/D [1565 0 R /XYZ 56.6929 85.5791 null] +1586 0 obj << +/D [1580 0 R /XYZ 56.6929 85.5791 null] >> endobj -1572 0 obj << -/D [1565 0 R /XYZ 56.6929 73.6239 null] +1587 0 obj << +/D [1580 0 R /XYZ 56.6929 73.6239 null] >> endobj -1564 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F41 1218 0 R /F22 961 0 R /F62 1361 0 R >> -/XObject << /Im3 1515 0 R >> +1579 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F41 1233 0 R /F22 973 0 R /F62 1379 0 R >> +/XObject << /Im3 1530 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1576 0 obj << -/Length 2519 +1591 0 obj << +/Length 2555 /Filter /FlateDecode >> stream -xÚÍZMsã6½ûWè¶rU„Å7ääx<³NÍ8³¶sJR)Z¢-n(Ò+Rãu¶ö¿o7¤(›’ìX©šòA`h‚¯î×
‹‡?1r†qåõ(ñš.Ìhº8â£;èûp$â˜I;hÒ õýõÑßß«dä™·ÒŽ®o{º ãΉÑõìçñé?N>_Ÿ] O¤ácËŽ'Æòñ÷çïHâéçôÇ‹÷ç ~º<9NôøúüÇ _ž½?»<»8=;žgÌ—QÖ ïÏ?žQëÃåɧO'—Ç¿^ÿptvÝ}Kÿ{Wø!ÿ>úùW>šÁgÿpÄ™òÎŒ à3á½ -Ž´QÌh¥ZIqtuôÏNa¯7L ÂOKŤôj4Qš9 :^ðZå%óÂÈá×òÑ”zÁõv]4ƒ®Ø¤ê‰ª‰†)£Ð¾Ê°D -ßÙWŠž}…ÐëÍ(1‚I ¶G§ÓA†±²?–;&t‚ïÀA³ìÎe™ÕÇeý8…Ÿ„Ët‘ÍHrþ™Dél¶<nœÕqè"m¦ó¼¼£î"¯›o éýø¶ZFeÓ)†þiU6a~…0 Á¼ÃZË펪™gKj®ê¬fO·‰á s £>"oCíi„MÚ‰W¨l¿a»áॉµnŸádBŒ€UUÔ/±Þ´H£Y´>Î$˜§e™±»©è÷&ë0ŽÀß<Æó,¾wc¡ž3m•‰ï]–³éÀê$ Ü}4hÕäEÞ< !Æ;ìØèm ?µ£<¨ a„Âî³#NðŽ6u^N‹Õ,ÛoÆ80Ú(¥ <—E¶¸ÞŠ\{B蹬K˜çBíŽ+¦µ -püž=îǬ¾Ï¦9b`ƒÀƒ³ -ml‚±K Æ1¤ï¾“nÜ&ùé¾k‡Y{x}͇Jk¦Upv™U;ÀÁ8b!ËD…ÙR‡×´(/Ý8̧çwWWg§ÔF…;í-õ+ÎÜŒäÌH·/ºeOxÙA ¬û¥ˆbÐG4“ z‰è‘4”+@Ê âzßPkuO=4‚l2’´é/ߟRÃp!âøhµá"ÔtÞFž¸Î&+A´#ï#ô5
@Ý$jo¼’ Ë)Þ|ɳ‡W ‰;Â\/w}ú+:lÑç Å;í-³ÂíK« çLò>åü“ÀáÜí õWs(ÐÖµñ?Wõ~[\xÁtb!(É|Èf‘þY±^qËœô°jm=€Ù/ÆÉg· j¤±Î ¹úë-eMØñI—ùm-b¨„AžÙ¦~Èfu)Ó%¸Ûi6¸Ë@Æy‰Ö¶~ç±åcEÛšNW- w´ægCÌŽu+ë<Û-niɬ‡}¢ òR|7^Ú€[œópYô]µ Š·5Ët±H#ñÔýïŋͼº»m˜XÒ4ABOÿ
Ž¶õz›îv6ƒL»þ-\$üÀÃ?L9üÿ¾ú0Xƒ†cc<Ç’{>è ¼|Mƒ»»‡Ÿ°b4`±'_º}+ ×n¥-w/ -GuEp4Ò€ª›U^4“¼üöi€B³$I€IL we{ýÀ¢Â$ym8šÕ»º= ûŠ 5Ä”6;a”IT¤„‹fèÄ+¦„i£Ð'ÜÁÑŠx`æU=X!qLkðÿýż•C(fñÆü¯ÀLxÌ9÷ ª`Ÿ[Šeå0íÚYY½±õR…×Sµ¯D‘òÉ>Ä &¿1ŒÕ4-ðã_[¢âmK"Ç矿hQ -EÄEȵÙÕ‡¯ª@C`)©iج"aY5Ô¸'–ðvK>‹3Rúy
tÆy³ ^³ÈËlûŽ’:*
Qþ?$)²”Ü5óšžÃ F9Z€šqÏCkcÏÆ%Æç%õÕ«@}$Ӵξ¬ç%äAà{M=éÆnò¯.qXôÝ]wnÚµC3®}“¬eá¾dÿ - ˆèÚïC”Wbf*ê¯u‹CÑ ø³mIÑŽC»>
o;`ë3ûš÷ðœB@Ì4Xõ‡øîw§¸K - s é™s‰ ú¯5>Ú[êxéÿÈÿ`TÎÉጺ˼!{]tl´zfEå˜qr=¬·øÿ>6rÿendstream +xÚÍZ_sã6ϧð[™šÇÿ"Û§t7»—Înº—¤Om§£ØJ¬[YÊYò¦éÍ}÷J–ÙNwf'¦@¢ +Õ$óÔöZÎÈ;ªfž-i¸ª³š=vÃæ.F}¼NËhO#lÒîH¼@dû
Û
/M¬uû 'Z€ÊºªŠú9Ö›i4 )¯g"ÌӲ̊8ÝTô{u:ŽŠ¿~ˆ ó,¾wc£ž3m•‰ï]–³éÀî$ ô>bZ5y‘7ÇBˆñ;öô:¥?¶£<¨ à a÷ÙxGN—Ób5Ëö›12F¥ôƒç²Èv(®·£C)®=!Œ\Ö%Ìs¡ö)Ž+¦µ +êøœ=ì×Y}—MsÔQP$ \Šó Mˆ@òª¤™p¼(yœIWàîe“O[n`¢P'«ÉP´Zæv ð …(ˆÃ«Ë³÷Û-ÖWÅ¡BÖßk¬Ï÷å›xf”¤\ST··¨…šM%ãûyÚÐ# ܸΖ_B +`™öÍagÐÒ°íD¡COʪÉo†r¸L¢;^üæ ·oœ¯8]ysoºÀÏâ‚ÒEu‡éóyѧ…³Ê½ßÕuŠØ*.Q +8 DŒ|ZOº¢î…¢±¬°X¬ÊòRW#âæfü½Í´u¼± N$P-G\±L:¾MÖ}׳öôõ5 *™VÔFÚeVí@ÆZ® ûÌ&P¿¼,«†j}yìÆa==¿=¿¼<}Cc¸C£½~Å壑œéöe£,ã Ob:/ú?W£! ƒÆ’žö´GÔÐ3Jè™$¨×»†F«;š!8´ÉˆÒÖ„@¼x÷†† ù£Õ†;aÓy›y:›¬ÒŽ>@_C_óÑ + ŸtåçÖN +Ö"¶«EÍÊR¦«²·Ãl—Œó.¬mãÎC‹ÇŠv4®Z< áhφ ëvÖE¶tiɬ·àÒÊ0! 8ÆwãÍ„EÁ97AÞe»¡xe´L‹4OÝÿ^¼mÑÌk¡»+‰%I„!ôôßhÛ¨·ng3(÷ëßÃmÆï¡ +
„GÌÔHøß÷C {Ðà96æsü ¹çƒÞÒÉË×0¸» +Ô›JÙ ¤l^¡©NA8‡›ù&’I
H]¬ê(ã:RÚ˜=#ò}Þ̇ endobj -1575 0 obj << +1590 0 obj << /Type /Page -/Contents 1576 0 R -/Resources 1574 0 R +/Contents 1591 0 R +/Resources 1589 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1573 0 R +/Parent 1588 0 R >> endobj -1577 0 obj << -/D [1575 0 R /XYZ 85.0394 794.5015 null] +1592 0 obj << +/D [1590 0 R /XYZ 85.0394 794.5015 null] >> endobj 398 0 obj << -/D [1575 0 R /XYZ 85.0394 433.214 null] +/D [1590 0 R /XYZ 85.0394 433.214 null] >> endobj -1578 0 obj << -/D [1575 0 R /XYZ 85.0394 408.8744 null] +1593 0 obj << +/D [1590 0 R /XYZ 85.0394 408.8744 null] >> endobj 402 0 obj << -/D [1575 0 R /XYZ 85.0394 340.1059 null] +/D [1590 0 R /XYZ 85.0394 340.1059 null] >> endobj -1579 0 obj << -/D [1575 0 R /XYZ 85.0394 309.992 null] +1594 0 obj << +/D [1590 0 R /XYZ 85.0394 309.992 null] >> endobj -1580 0 obj << -/D [1575 0 R /XYZ 85.0394 232.654 null] +1595 0 obj << +/D [1590 0 R /XYZ 85.0394 232.654 null] >> endobj -1581 0 obj << -/D [1575 0 R /XYZ 85.0394 220.6988 null] +1596 0 obj << +/D [1590 0 R /XYZ 85.0394 220.6988 null] >> endobj -1574 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R >> +1589 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1584 0 obj << +1599 0 obj << /Length 4374 /Filter /FlateDecode >> @@ -6464,48 +6553,48 @@ q ‚½–JLk*)5KÉã6ºJfÂwóL V¤K*z\R)|IESIEÏüpõwêXµÛ²n¨u¨¯èi}¥ðõ Š zR\p#¨4Œ]œ [‡
"}9Dˆˆ¬ jw>@³zæÛ‡† âëÛ gxß©[ñ>l^€7à&¥èÞvñ¬ «^ µp¬"©â¥ €.LðÃÀë”za¨°IšLž¤éïÜ%ó~ضþ딶fÒæÅ8 JrU†ÿ6–(æñÖä‹ÿ;m¨v‡”œŸ¨ij“@)d\Ê#Îÿ± ³þ?tâbendstream endobj -1583 0 obj << +1598 0 obj << /Type /Page -/Contents 1584 0 R -/Resources 1582 0 R +/Contents 1599 0 R +/Resources 1597 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1573 0 R -/Annots [ 1587 0 R 1588 0 R ] +/Parent 1588 0 R +/Annots [ 1602 0 R 1603 0 R ] >> endobj -1587 0 obj << +1602 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [55.6967 314.0348 256.3816 326.0944] /Subtype /Link /A << /S /GoTo /D (rndc) >> >> endobj -1588 0 obj << +1603 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [268.5158 314.0348 332.4306 326.0944] /Subtype /Link /A << /S /GoTo /D (admin_tools) >> >> endobj -1585 0 obj << -/D [1583 0 R /XYZ 56.6929 794.5015 null] +1600 0 obj << +/D [1598 0 R /XYZ 56.6929 794.5015 null] >> endobj 406 0 obj << -/D [1583 0 R /XYZ 56.6929 769.5949 null] +/D [1598 0 R /XYZ 56.6929 769.5949 null] >> endobj -1586 0 obj << -/D [1583 0 R /XYZ 56.6929 752.2372 null] +1601 0 obj << +/D [1598 0 R /XYZ 56.6929 752.2372 null] >> endobj 410 0 obj << -/D [1583 0 R /XYZ 56.6929 610.516 null] +/D [1598 0 R /XYZ 56.6929 610.516 null] >> endobj -1338 0 obj << -/D [1583 0 R /XYZ 56.6929 579.8656 null] +1360 0 obj << +/D [1598 0 R /XYZ 56.6929 579.8656 null] >> endobj -1582 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F41 1218 0 R /F22 961 0 R /F48 1238 0 R /F14 964 0 R >> +1597 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F41 1233 0 R /F22 973 0 R /F48 1253 0 R /F14 976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1592 0 obj << +1607 0 obj << /Length 2364 /Filter /FlateDecode >> @@ -6520,73 +6609,73 @@ RœØŸˆNlt¤ ´k®„á‘+ÝNŽÏ‹Œ+Y]&¹ßïËE€öUþÇÞ¸ºF¦ª68`ÅÍ£ñŒ±¥sM¾¼iq]€ûŽžum,ÒÁãcyÎQá…¤]YäëØ/¥„2>÷r²q #Dšô¡K ±éÞ‚Í ëq;ãOÅÙzµ`_¾î'L¸7÷AªS‘S? £—eÈKãñˤM7>¸€è‘ͤÃ2¶È‘ex 9V´^op;~™^ ué IúT`Xß$×î©p®`/Œv•¤@kÀ±ØSö¢jÕ[Y¬ŽE|7öåÐLÅ(é—_tk[(+ѹõñ¹pêܸ(Ž}KH¦o÷mO0RœqíH«ÁÁç][‚*Xÿ5†”YuÛ¾hÆ[
ÁÅ\§ÞŒ®YÑà\·Á@é’·‡wÉ <6õˆ#Ú© \ªªå-ÜUæ÷í·ÛÚöD¦O¹ Á(ßÚ¦LÒ ÌäŒDð–Òœª>XMIB±'ûºÁQ‚ ›!%Q±/‘Ò'¤8gˆE·8½š/.£³ÄäKLèYÎ kF}Yêýä„ P…ò„ždü,½.ú‡#Ù]ÉT=+C‹!ØÙX]Æâ<+˜Ç, BØh6®W#Eߧp ÞŒOøfÄôíŠ4Œ0í“»XÚ Q¹/©Ú—÷.À‚«¨å1DçýóÕ‘Í]ü‚õ-Îsq%5Xƾ);¯²Ã Ø·°{CÖdFÙ1ÔÇLðS
4ѶbD‰®6´"ÈÍg¢Vy,ê3¶.NB–`‰ `¶¥½=buô‚ÁiÀ¶ 3Ý ‹)ÔEŸÙrXI-1˪¯5f£ö‚[¨ý5øu_ä.Æo¥Ãœ] (õ„ ¸£öP×lqGÛ*Ñ·ÄÚ¾Žô ‰¯6“ÆQˆÛ<Í:D”ñµ
±Ø÷…Šz½öæü¿7Åz"ÇfSPÚ †Ò~AŒ¾]0|Ãrm@Àïùµ}Š [ým“vƒ»Ï6áü¹PY4 iuþjáãg_y™»K𸠡¯sêé7ù?Íúf“ÛpS0+’?°94 Å!üÍ÷¤s'v»ÚÌìvÏ Tû¢8Šð~ÈóÑÉ`lýÕ Ž:JmÏ9MŠ‘~àÔz¬±§dWõ6Ð^ÃNÓMÙ³}„9©— êѶÌÜï=!Ï•oQ .G¨¸ù< Š8ÔøÜqžä¼¥
l* endobj -1591 0 obj << +1606 0 obj << /Type /Page -/Contents 1592 0 R -/Resources 1590 0 R +/Contents 1607 0 R +/Resources 1605 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1573 0 R -/Annots [ 1598 0 R 1599 0 R 1600 0 R ] +/Parent 1588 0 R +/Annots [ 1613 0 R 1614 0 R 1615 0 R ] >> endobj -1598 0 obj << +1613 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [406.6264 463.8552 456.8481 475.9148] /Subtype /Link /A << /S /GoTo /D (tsig) >> >> endobj -1599 0 obj << +1614 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [140.5805 452.5676 196.7992 463.9596] /Subtype /Link /A << /S /GoTo /D (controls_statement_definition_and_usage) >> >> endobj -1600 0 obj << +1615 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [103.6195 409.8565 159.8382 421.9162] /Subtype /Link /A << /S /GoTo /D (controls_statement_definition_and_usage) >> >> endobj -1593 0 obj << -/D [1591 0 R /XYZ 85.0394 794.5015 null] +1608 0 obj << +/D [1606 0 R /XYZ 85.0394 794.5015 null] >> endobj 414 0 obj << -/D [1591 0 R /XYZ 85.0394 769.5949 null] +/D [1606 0 R /XYZ 85.0394 769.5949 null] >> endobj -1594 0 obj << -/D [1591 0 R /XYZ 85.0394 752.3146 null] +1609 0 obj << +/D [1606 0 R /XYZ 85.0394 752.3146 null] >> endobj 418 0 obj << -/D [1591 0 R /XYZ 85.0394 717.6455 null] +/D [1606 0 R /XYZ 85.0394 717.6455 null] >> endobj -1595 0 obj << -/D [1591 0 R /XYZ 85.0394 688.3332 null] +1610 0 obj << +/D [1606 0 R /XYZ 85.0394 688.3332 null] >> endobj 422 0 obj << -/D [1591 0 R /XYZ 85.0394 619.0499 null] +/D [1606 0 R /XYZ 85.0394 619.0499 null] >> endobj -1596 0 obj << -/D [1591 0 R /XYZ 85.0394 591.4512 null] +1611 0 obj << +/D [1606 0 R /XYZ 85.0394 591.4512 null] >> endobj 426 0 obj << -/D [1591 0 R /XYZ 85.0394 513.0222 null] +/D [1606 0 R /XYZ 85.0394 513.0222 null] >> endobj -1597 0 obj << -/D [1591 0 R /XYZ 85.0394 482.614 null] +1612 0 obj << +/D [1606 0 R /XYZ 85.0394 482.614 null] >> endobj 430 0 obj << -/D [1591 0 R /XYZ 85.0394 275.2452 null] +/D [1606 0 R /XYZ 85.0394 275.2452 null] >> endobj -1601 0 obj << -/D [1591 0 R /XYZ 85.0394 247.6465 null] +1616 0 obj << +/D [1606 0 R /XYZ 85.0394 247.6465 null] >> endobj -1590 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F41 1218 0 R /F22 961 0 R /F53 1313 0 R >> +1605 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F41 1233 0 R /F22 973 0 R /F53 1328 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1604 0 obj << +1619 0 obj << /Length 3170 /Filter /FlateDecode >> @@ -6604,33 +6693,33 @@ C£3W h UF–Ù/—ÒÄKûò€‚¯¶‰ÑÙIyØõ-ƒ3„v‰4§ù) ô\ˆˆ‚TàSÃlè™YÅ`˜*õ…ø•²§.‹dÇ ÿÝñ,y üW‘‰>·ÕžÿÛâÞŠÕÕ7„BŽ4}H )Q_ϵ‡ªé¯¨cÅuO®»>÷ÿ+ÐMá?Ìü·‰ˆ?
üÏÿÛ2üãOš%:ÏUü·•©b³<Is ÂLá]RûŒóðO0ÏYÿ/.ˆÅendstream endobj -1603 0 obj << +1618 0 obj << /Type /Page -/Contents 1604 0 R -/Resources 1602 0 R +/Contents 1619 0 R +/Resources 1617 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1573 0 R +/Parent 1588 0 R >> endobj -1605 0 obj << -/D [1603 0 R /XYZ 56.6929 794.5015 null] +1620 0 obj << +/D [1618 0 R /XYZ 56.6929 794.5015 null] >> endobj 434 0 obj << -/D [1603 0 R /XYZ 56.6929 696.3453 null] +/D [1618 0 R /XYZ 56.6929 696.3453 null] >> endobj -1606 0 obj << -/D [1603 0 R /XYZ 56.6929 666.0554 null] +1621 0 obj << +/D [1618 0 R /XYZ 56.6929 666.0554 null] >> endobj 438 0 obj << -/D [1603 0 R /XYZ 56.6929 459.1977 null] +/D [1618 0 R /XYZ 56.6929 459.1977 null] >> endobj -1607 0 obj << -/D [1603 0 R /XYZ 56.6929 436.7104 null] +1622 0 obj << +/D [1618 0 R /XYZ 56.6929 436.7104 null] >> endobj -1602 0 obj << -/Font << /F37 1026 0 R /F41 1218 0 R /F21 938 0 R /F22 961 0 R /F39 1161 0 R >> +1617 0 obj << +/Font << /F37 1038 0 R /F41 1233 0 R /F21 950 0 R /F22 973 0 R /F39 1173 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1610 0 obj << +1625 0 obj << /Length 3640 /Filter /FlateDecode >> @@ -6656,29 +6745,29 @@ püLk °Þ±€@Q)Æsþ°ru50 $+O¬ÑÒÌ^‘ISñcf-á€
¨oíV‹Pz±– «)î¢(Ù@»—TB3@Ñ@’ Õ-¨„²ÓÀ„Q©ç»êTY7$aøuq-ìwJU‘ðÍhnæêIïH“’¢ìR™ù¤d€…,Î%sºçªÂX*Œš…¥l=õ6ÒÎßVwsp³œ a^ró›)êYWMÕ•[à%x=î+rá©›„ÜòbØv;bR¦FôfX+8tÔ½÷×^TFvâ†ÞÅ)þÌdˆ?§‹¨p-ï ¨?¤…/>•rV1y¤b «ò° ˆ Átž¹/íh°[_SãÃèÓ¼8>~Á}š7Í` ¬‹þT-BÝ‹»gòœ$pËLqa'$=øF0Îú!W£¼+¡ß endobj -1609 0 obj << +1624 0 obj << /Type /Page -/Contents 1610 0 R -/Resources 1608 0 R +/Contents 1625 0 R +/Resources 1623 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1573 0 R -/Annots [ 1612 0 R ] +/Parent 1588 0 R +/Annots [ 1627 0 R ] >> endobj -1612 0 obj << +1627 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [173.6261 190.3209 242.2981 199.7305] /Subtype /Link /A << /S /GoTo /D (the_category_phrase) >> >> endobj -1611 0 obj << -/D [1609 0 R /XYZ 85.0394 794.5015 null] +1626 0 obj << +/D [1624 0 R /XYZ 85.0394 794.5015 null] >> endobj -1608 0 obj << -/Font << /F37 1026 0 R /F41 1218 0 R /F22 961 0 R /F21 938 0 R >> +1623 0 obj << +/Font << /F37 1038 0 R /F41 1233 0 R /F22 973 0 R /F21 950 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1616 0 obj << +1631 0 obj << /Length 2058 /Filter /FlateDecode >> @@ -6688,67 +6777,63 @@ VØ5¹qTaR(c¼ û‚7áq¨äÚ˜Œ9‹Š•îXÅxßd\Ýüæ € ëÂmÇ®ºº9Í•R ï„2Qš&>×S'ÿ¾Y:‹@.”Mlü"y v èÚæ…Âç«K(t«óAŠf|¬V `\’%çóiƒ’*F3 H_oÍã'KØr¿ÂE ÂG–EQ-N‚¼ìì\
}qù™Ç¢ì®Àâ2%¦³oJ*¢¯§š¡§#»ŽÔº€}½¯×ÅætQ»}'@§Q½ÝöUû‰YuQu=u€ÜB§æOžœ—l *ßåŸ{E½ƒ®1,]´”\d°‡ë‰„vi¹³#ålØ»&oíÚ¡Hd‘Š|?äÁfPÎ &Ø»"„äóÆ æQmMn/Èë ‰êZ‘DG?Às-‘˜ êUŽ
Žºš¦ZËÜÏÞ"ëUl ù¦.Ëú¹Ç!–Óvùã\f}?‰MÉ_&*¸ Æó^WE _ O-óÛ1ÑáL{ñŽ’fNÝ-ÂECFLé$°¿çûCi/ Ͳݫ–&ÚüDœìèÄ Hò˜rË1÷ #’^UÇb<kNŸtP°6W3G*ò²e~¯, ~³öÀj ê4È¢K„ŽK©…:÷[|8ážþŸóLÃéýŠµ3þ†Å¹ù‹ñK¯o°ûÓ'ïŠO£‰Éë¾¾|ü.GòåÈŸ»w©ã¬;‡ïž&&ö7)þ2e_`áþ£–ë¬ ‚hé¢êo=}³ÇGeÉ7½ADœV£æ²4LfÇD¯b‘†çÛ >a\› ][8¾7Oeì?…3l«ß7¶Yàñ4,ôz1(/ÇÚ!·—$¼\FîUQFç³ ?FHýœeþTBÃÅ”Qƒ ®
…ÁÐ64\ÛvÕ®We®z3 }øé`/æ蘃â®ëÜêÒªk¯«./*1å ÷u¿…‰nkŸŸ|Eá¤Y¯ízœG›ãà²ßq‰Z ڶâêíGfЀÉlf´HÒ0ýš· 8¶D*Ó/<×.b-"ef‹(…F\¦Sïµ²¿%üé×áóÓ9è Ñç·¦R×ÅPãA²Ð鑹z»öÏÈÌ50ý¾%+endstream endobj -1615 0 obj << +1630 0 obj << /Type /Page -/Contents 1616 0 R -/Resources 1614 0 R +/Contents 1631 0 R +/Resources 1629 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1620 0 R +/Parent 1635 0 R >> endobj -1617 0 obj << -/D [1615 0 R /XYZ 56.6929 794.5015 null] +1632 0 obj << +/D [1630 0 R /XYZ 56.6929 794.5015 null] >> endobj 442 0 obj << -/D [1615 0 R /XYZ 56.6929 436.7807 null] +/D [1630 0 R /XYZ 56.6929 436.7807 null] >> endobj -1613 0 obj << -/D [1615 0 R /XYZ 56.6929 411.9988 null] +1628 0 obj << +/D [1630 0 R /XYZ 56.6929 411.9988 null] >> endobj -1618 0 obj << -/D [1615 0 R /XYZ 56.6929 95.0274 null] +1633 0 obj << +/D [1630 0 R /XYZ 56.6929 95.0274 null] >> endobj -1619 0 obj << -/D [1615 0 R /XYZ 56.6929 83.0722 null] +1634 0 obj << +/D [1630 0 R /XYZ 56.6929 83.0722 null] >> endobj -1614 0 obj << -/Font << /F37 1026 0 R /F41 1218 0 R /F22 961 0 R /F21 938 0 R >> +1629 0 obj << +/Font << /F37 1038 0 R /F41 1233 0 R /F22 973 0 R /F21 950 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1623 0 obj << -/Length 2752 +1638 0 obj << +/Length 2918 /Filter /FlateDecode >> stream -xÚÍËrã6òî¯PÕ BW"$çæø1ëÔŒ=kk«v7É–h‰5©ˆ” åë·
R”L‰vÙ®²} @¿»1àð/¡f\Eþ ˆ|¦¹Ðƒñüˆ¦0öùH¸9ÃzÒ°=ë—ÑÑÏ*D,2Ò F÷-\!ãa(£ÉoÞé?O¾ÎoŽ‡RsÏ°ã¡6ÜûåòêŒz"úœ^_]\~þ÷ÍÉqà{£Ëë+ê¾9¿8¿9¿:=? ŠP €—à €‹Ë/çÔú|sòõëÉÍñ £_ÎGÍYÚç\áAþ<úí>˜À±=âLE¡ <ÂÎDÉÁüÈ׊i_©º';º=úWƒ°5jA»èçsÁ„Ôj0T>
àxƲÊYÀƒ=ËrÀ¥—Öûq \®YCl£ -0_È_©X`LØðWŠ…¯X¨” Z0i€÷ÈàIr ¯² -
óek>8Ð~ -©E -¿ gÉòX„ž æ^^Pw¹HÆ)®>v`EŽ¿¦«eŒËQç,.·W#¿K’œ¤®>À„í -ž’¤•ƒ6_Ç7”Š6ÊHpÿ( BíE,ÔÆï¡q¢ú4É“eœ=ODä#oƳaœe Õ2Þ×8_ÓH5~—Ô.«4˨ëò *‡ ‹ËÒ²-™POšWEƒ|Ø%N~"ŽÅù„ lk×…«a#©ÇV úÖ¢³Ÿ»m²½Ž»ÜUoÊÝ@³$º‡»&̃ˆ=®â»Ôª½_“²Œ§¨oJk(– u;‘Gö‹’ ´ß w@«ù‰ÀÏd™KÖ4r·îÖ÷„8”Çs×*“å°‹x[¸¾ª¨u þ]äÉŽŒãq -·t€Ñ- -¾£ë= e
±ŸÑxÔÇh0 Ú³LÆ«eZ{}²XXrq¶CÇI’§ugqO_"ýŸ«¤¬Ê„míøuTx_Âj ‘„ú«53R*K¯Ú§ôöt×ù ù°'s²¹ˆ—¥uˆ[Dw܃þÁà·öþV$~#%C ›ú\È/‚eRê} ‰Ï®n!’äÊI%@Ô?axxåj<Ãað8%M³;h>hH™>$4–Å÷Õ¢¤ñùˆN×ÑÊ<q̪Ùz—Ìâì~[SÆYšäUé&Ônic¡Ö?1w
à{‹ Ùf ÃDÀe ßE …@ -)û×½#{š÷²þÙ¯–q^dÙ„ -Ý -c -8‹Bn“µ¹÷pw»d§tÙ]P÷bà>ë>b÷¢XVn᪤xâ×}ù6O&®òâP';îV#ºr nw~—l ¾vZ¬¤[J‰f8bL7ÏEØ»Y/ˆ» zGôWwPaÔ·s2ì -Éɯ?u’ÿñ‘%ÅóE–°q1',—Wô=?jýx{ÞµãöÒŸ>Ñ¢ÁËÍ“jߢCZ´Ów·]â+ý컆I2Ì—Z÷¸n‰ „Ç1„,©XöûïË «ÓµLBRßaÏ67þ[Jñmˉ,$[V¡ÇÚÈÇËÂÖ¥¡ç>N³Ußiûp øBBB ¨…î+LKȧ¹v¯#ÒrÕ‚þØÞM¤è -Í,¨“ëÞ" Oª²ÑþmcÑ”T¡=/&«,);Õf;:kÝ|ouÛ1ZëvéÐû†6‘>ð%ƒô5Ó}Išô#&|cˆ•9 |üœ‹%òVí<ct{ùùi¥öe·v› ¿•Š¼Ã "É#f"¿×L +xÚÍ]sã¶ñÝ¿B3}=| +®ð žüö ÍàØ¿œp¦âH áƒ3Çr´< µb:TªéÉOnOþÙ.Øu }ô ¹`Bj5«EÖxŶ*Œ˜åö…m9¬¥a-_^‹à8¬å›
ÄîRc¡, µEþJŬ1QË_):ü¡b‘Rzdµ`Ò +&ŽY¤M8$ +Bã&DõyZ¤ë$(ˆ8DÞLã$ÏA«e,‚IñD#õø]Q»ª³<§fB¬+~¨ýyRUŽméŒz²¢.ÛÅÇ}²á¥áGâXR̨Âöä»p7l¤ÍØfE¿è¼ÌÝ.Ù¾ûÜUGå®Õ,‰ உ #“¢'ur—€Z
±÷cZUÉ õMi ÅrТS c'òÈý¢$( ¶‹{ M…üÄàgº.€%O4r÷Ô¯ï)q¨H–¾U¥ë`ñ¶ô}uÙè>~þ¯,Ò=)˜&Óf)Dé +cW@p ‹ }¾"Õ¤ n$ñ°X+@G”Ÿç•\q¸ñgxÈÒÇžƒJÉ„2±ŸÉ¯áqpF'2dQ¡øÎ ÈšZäYÓª6Ëe‚•üp~“¼*ýÄr>w±†%ª¹ßEÚƒ³°ŠÙ¨¥û‹ª„уnxØn„r +¬~²®7+0ùaÄ©hÿä¯Tsa ¶ž¦ÇÛÈ ŒhLõËTãV´Ñˆ«AãÚÎÅz'™RRïú»Ô‡+ÒƸú©ÈIÇÛk üØ9DN}JËd(£‚O +¡viË“üX%k× +)
µ
l9“Š%%Ó(²&B_ùHR6We¡îägû§êÈÑOd9•ŠËéÚÎbà –'[ ™€Wt¥VzRp¤ „*«Ïöt—¥è™7wFJp’›€e[ Àîö:ÐÙ +0Ó/i]µ&|×â·Uqh/ËÙ&O«^·bw /ìt—»vç‚ðЕ.•Ž{OtT…±e s
0“ ¦°yYÀɧ¯¹ ¤˜£›+Nn¯><¯¶ÝÍkåc©É¼F°ð ¬ˆb¦,§L1³=&é 6U¿:¯tìå½Â¨²˜oT~ Ù–`ã`™U{²ÐMîÌN ÉË’ª(ûÚâ7Á¬QTèiùnãóX¸â!þÒËDlÅôŠVP ’ rÆØ.é—<TO”ã mï¹|P6Û¬Û‹‡Ý›çBÓáƱ^Œ½…ÐHÃ8†ÔQàƒI®½mMótîø9.‹|¸”sÑÎÇ´Qˆ*Ðcyå¯å¼¢‘óªqxÐZ$)µü£=hÝÓ£ )UËÕ³°šdèúߟ>ž]¹‡¦Ö= Ú4·™¶ãI雪I–níͳƒº±æý‘
ö_1’%=Õ ¶mjÃÔ³! CÞÔ:²bç%8*_ý.×Íû¨ÍÝþÓ¨Y +4éÜíðþÛä)äœYi@DcδժïE-
º“×¾ßÝ>n-SQÔyu°S â†E2¶ˆvˆWHÏ0Þ'ˆVÓ‘ÜNë ÿr3Çkendstream endobj -1622 0 obj << +1637 0 obj << /Type /Page -/Contents 1623 0 R -/Resources 1621 0 R +/Contents 1638 0 R +/Resources 1636 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1620 0 R +/Parent 1635 0 R >> endobj -1624 0 obj << -/D [1622 0 R /XYZ 85.0394 794.5015 null] +1639 0 obj << +/D [1637 0 R /XYZ 85.0394 794.5015 null] >> endobj -1621 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R >> +1636 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1627 0 obj << +1642 0 obj << /Length 2959 /Filter /FlateDecode >> @@ -6770,33 +6855,33 @@ G‹@8I¤Ø ©ßÔ Õ ö>wæP˜†í6kŠ¼möÅ0neLÅЦ>œ í=S×LÛ5–t_f…¥ýéî=ygð0°íR?…‹Ñþ´6J½ ;tŒê›4ß·Ña×ÇŠ!Êxð§’Êv¹Ö[üoÃÒd9g@@Bm{äd‡ìyPXv2p[“‘úÏ4¾û6Ϥ›„qÈ…šém¹•ÕNjp“ÏF|VJG*Õl<SK¨µrÆSÍßæs7T 0^ ¨ïÖØYk
°¼ÁÌ£|§q Æ!_cBP–ÎL´kpké’({Η˜¥s¯³ Ðû\•¸[“A表8 ø‰ìû éæª t ¡«gÑ–
5§awYåb‡ÂœÇìÙ|Ußù´
™IñHnŠ§z¥2ù¿y´eÄUàhñÀùèª?׎ý ’ò›ö¿™†Ô}¢AÖG9õqì4 Âb oï I¯KPíoZ– È©™&YM·Ûe‡âwWQÕ ‡±—E<Z×7Ý£¾ §àòCý÷[=ÃÏ衯v*ñ§çTÏýT ÿ¬²ýðÓïö*ñ¡Æ ‡¦ÏXóúæŒ|ä…ßül.?”qO5:úÿ<{aEendstream endobj -1626 0 obj << +1641 0 obj << /Type /Page -/Contents 1627 0 R -/Resources 1625 0 R +/Contents 1642 0 R +/Resources 1640 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1620 0 R +/Parent 1635 0 R >> endobj -1628 0 obj << -/D [1626 0 R /XYZ 56.6929 794.5015 null] +1643 0 obj << +/D [1641 0 R /XYZ 56.6929 794.5015 null] >> endobj 446 0 obj << -/D [1626 0 R /XYZ 56.6929 474.28 null] +/D [1641 0 R /XYZ 56.6929 474.28 null] >> endobj -1629 0 obj << -/D [1626 0 R /XYZ 56.6929 446.6886 null] +1644 0 obj << +/D [1641 0 R /XYZ 56.6929 446.6886 null] >> endobj -1630 0 obj << -/D [1626 0 R /XYZ 56.6929 81.8965 null] +1645 0 obj << +/D [1641 0 R /XYZ 56.6929 81.8965 null] >> endobj -1631 0 obj << -/D [1626 0 R /XYZ 56.6929 69.9414 null] +1646 0 obj << +/D [1641 0 R /XYZ 56.6929 69.9414 null] >> endobj -1625 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R >> +1640 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1634 0 obj << +1649 0 obj << /Length 2586 /Filter /FlateDecode >> @@ -6808,3140 +6893,3253 @@ HïM9]™ÑLç*¹7N£ðŽúø dý ÷ ýp‘ º|ĆŠ¡I™\éÝ¥÷~0- =Ð_å·’šu2?.];©žÐê–º<O¨ßT IFÕ]qû¶#_¤:fš‰EÄ„ËbÚó
+(¹iªq.gÙ_ûb©„òYĪmíþ<ñÂøßN•Biß1“k¢˜åU# MpM¾øìòb×¹^”˺Ácçõ~vÜ#Á"µñfzýml\Ø¿åöèÿü º®|ë~¦³‡û<{XCŸñ`;syï¬*K—è£[Û¦,ä3•w¥]?=üôÊyïÑ“²öB¢Ú¡=§ï?9á izþAÃC{öÿuÖfÒ¨ä±ìO"šdÃ/ ÷eÄæÊ
TÜ&–QÏÒÿ Z†Tendstream endobj -1633 0 obj << +1648 0 obj << /Type /Page -/Contents 1634 0 R -/Resources 1632 0 R +/Contents 1649 0 R +/Resources 1647 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1620 0 R +/Parent 1635 0 R >> endobj -1635 0 obj << -/D [1633 0 R /XYZ 85.0394 794.5015 null] +1650 0 obj << +/D [1648 0 R /XYZ 85.0394 794.5015 null] >> endobj 450 0 obj << -/D [1633 0 R /XYZ 85.0394 189.8991 null] +/D [1648 0 R /XYZ 85.0394 189.8991 null] >> endobj -1636 0 obj << -/D [1633 0 R /XYZ 85.0394 163.5217 null] +1651 0 obj << +/D [1648 0 R /XYZ 85.0394 163.5217 null] >> endobj -1632 0 obj << -/Font << /F37 1026 0 R /F41 1218 0 R /F22 961 0 R /F21 938 0 R >> +1647 0 obj << +/Font << /F37 1038 0 R /F41 1233 0 R /F22 973 0 R /F21 950 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1639 0 obj << -/Length 1989 +1654 0 obj << +/Length 2051 /Filter /FlateDecode >> stream -xÚ¥XKsã6¾ëWèHW0 -G«öÕÙü Τ Ê™*1—À a¡/}›Àÿ}‡1|¸b)K‚@¢(_®TÄâІ, ™ãœ{ÅscZÊÃM§;Sšª£ÇÏæÎe•wy]GW?·zcœ%9ò É€ÉDDÖÐíÖ î „DÂâHa¼(CöOUI€E‚™²RíÁ5_ -/+ôm³oÎDì¡ÿÈíÀœ%*]ZŠ{ižLã–kúÕEÛS©Ó§M?E¾ÙvÏÿÙ© §lP 8B°Ißû…üƘc©D2•øË0™Š"µ¤µf³$âzTü^|5–·µŸ$çD+æèƤ+4Zü€Åœƒ¾°Nu‰ò DÇ~Æ1S!—a˜“"™…f/´Kzw¢ 3H -w -Û›‹Ž«u -=ã]®‰QÕô‹Á•;ÑC¢²¿a·‡#™D -²Ð ï[“ ivY@M£ -¾â66êۺ̻ΚÂÑ:õ 9ÏyQ…
bç°Ô¸aÜOg!#0aÂi"§íö'ÅÖü×ç³JB‡¡§Ü<Ï5˜Bÿ£S ÉØ÷ ó*k‰¤T u -Æ%s'ÚѶ2ؘôYä3Ž77Á¡³²—fl(™ ÃÞ„]aþ>£îÉœIN·®!±ÔŸØ|Òg ~›š4ß Iè®Óév•Â?×ì–|@]oÝÏ ›Üëxݵ-1zx€C-œ5çßã··uÛ ¦Lÿôêûëtß^åÙøñ!ÏÞ®!Ë“vuã& ŽèWBŸ8Óhõ¾×'–á4s#[šö[ôX,~Ç ï¡Ã6m«w9úÑéÇ÷Û ëH“ACäx±z -i¾ÓÅ[õôÛ·-¥ßI¶ odáS§ß‚ þÕ:/Ìû3‘íËÝÛ_¸×a „¿f¹5iSÃ!éÏ^Ÿûp
¿6Ï|ËãÃHÿæÚ‡/þ°ûúq,ç¿ -Ê&q JœSbpò røú}êúÿõ’\Fendstream +xÚ¥]Sä6ò_1¦*£•dùëò´Ù…
©„ä€<Š¶fÆLl„»Ü¿nµì±g lQ5n·ZýÝ– b„,Ld²ˆÅ.‚EZžðÅÖ¾œG³ì‰–cªïnN>œûÑ"aI(ÃÅÍjÄ+f<ŽÅâ&»õB&Ù)pàÞ§Ÿ/Ï/¾üzõñ4RÞÍÅÏ—§KpïüâÇ3‚¾\}üé§W§KÂûôýÇ_nήh)t<¾»¸üL˜„ /0½:;?»:»ütvzwóÃÉÙÍ`ËØ^Á}4ä“Û;¾ÈÀì N8ó“8X<Á g"Iä¢<QÏåû=¦8¹>ù÷Àp´j·ÎúOp&ýPÎ8P‰9 }é[þï[´áù !XIùb©"‡~0xYHð çÜ+žÓ’ ®;Ý™ÒT ½~6¿q.«¼ËëŠ0ºÊøµÕkã$É‘N HL&"²‚n6fPgO$G +íE’ÌJBZ$è)KÕîUó¥ðÒºBÝÖ»æTÄ êØÄY Ò¥…¸×šæÑ4n¹¦§.Ú J ?í8hzùzÓ=ü%„SŽÙÀò“MúÞo<à×Æ ¦J$S‰¿ã©(KZkÖ ®FÁïÉ—czû‰sŽ¸¢®MºDñÀÅXÌ9ð’ +îþ±3- Wë + +jÆ»X¢ªé‰Æ”;Ò½£²o°ÚÃM"Iè‰wÉ8;/ §QH@ qkÕm]æ]gEakjŽ˜§¼(±}ØZj\3ƒ4aÂq"¥íñ'ÅA®ù¯÷g•„.‡ só4W` +õŽMƾ÷WYK ¹¡}Bà&>5=ŠüTx£œ@Ü´ÓÞ2®' ¬šNN/Ù‰ú|yM +mß!Sˆ¦ØêÔ ïüØÃBÚ„ÆÔ–6É
N¯m]µ†ˆ @ ~A/Ž šLÛ5§±·K)R¶(z®Ž¨µB¥®*k'ÖeK8MªnJí¸“1€„ižû]º±Lö%8É2¹d"íqÅ…ËU5䪚æªïõè}vú>wG,,gf¥¡M
y ¡~V…„†»6ˆ ÚÿXÕ£:à ŽuŠ;
tE+¦¡^Ú ‚gŒîš|½vÒ²w´[(¡’!½nÒÍLø‚I¥ÔL¨ØÚ…O¨åüQÞf®J¬+g$Ï0ôÅ׉v'Ãá¼8œ L—~hlq1HÔÕŒ€$`¡ýÈŸ'ÞEGº»sì1ÏŒ³RӃ΄êUš £H ôó¬.5t×à69ØHÏ û²Ýš*ëÛœõÛÐ ÝåŽÎ6¹ë…X ï;a!äÈÜ*«»Ù¹"bIœˆ¯”û2¦<) ¼ð$Rá›$Ë$¿ï8øþ£ˆÃXk# `ëÊò„¶Î&ÛÁ +i¾ÕÅ[ùôsˆ
…ßcI¶Ÿy÷ûÌ·N¿% lò/WyaÞï‰lWnß¾u¢>Þëm"üÍö¹OèÐbñ»÷ÌWE>4å¯þ¼¾ÿßÌ~ Ëùï“2‚V§š } ¾Ã «þþ°}Hendstream endobj -1638 0 obj << +1653 0 obj << /Type /Page -/Contents 1639 0 R -/Resources 1637 0 R +/Contents 1654 0 R +/Resources 1652 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1620 0 R -/Annots [ 1642 0 R 1643 0 R ] +/Parent 1635 0 R +/Annots [ 1657 0 R 1658 0 R ] >> endobj -1642 0 obj << +1657 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [491.4967 682.6714 511.2325 694.731] /Subtype /Link /A << /S /GoTo /D (lwresd) >> >> endobj -1643 0 obj << +1658 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [55.6967 670.7162 89.457 682.7759] /Subtype /Link /A << /S /GoTo /D (lwresd) >> >> endobj -1640 0 obj << -/D [1638 0 R /XYZ 56.6929 794.5015 null] +1655 0 obj << +/D [1653 0 R /XYZ 56.6929 794.5015 null] >> endobj 454 0 obj << -/D [1638 0 R /XYZ 56.6929 731.9325 null] +/D [1653 0 R /XYZ 56.6929 731.9325 null] >> endobj -1641 0 obj << -/D [1638 0 R /XYZ 56.6929 701.4683 null] +1656 0 obj << +/D [1653 0 R /XYZ 56.6929 701.4683 null] >> endobj 458 0 obj << -/D [1638 0 R /XYZ 56.6929 475.6865 null] +/D [1653 0 R /XYZ 56.6929 475.6865 null] >> endobj -1644 0 obj << -/D [1638 0 R /XYZ 56.6929 450.9966 null] +1659 0 obj << +/D [1653 0 R /XYZ 56.6929 450.9966 null] >> endobj 462 0 obj << -/D [1638 0 R /XYZ 56.6929 381.4304 null] +/D [1653 0 R /XYZ 56.6929 381.4304 null] >> endobj -1645 0 obj << -/D [1638 0 R /XYZ 56.6929 350.9662 null] +1660 0 obj << +/D [1653 0 R /XYZ 56.6929 350.9662 null] >> endobj 466 0 obj << -/D [1638 0 R /XYZ 56.6929 317.4209 null] +/D [1653 0 R /XYZ 56.6929 305.6252 null] >> endobj -1646 0 obj << -/D [1638 0 R /XYZ 56.6929 289.8617 null] +1661 0 obj << +/D [1653 0 R /XYZ 56.6929 277.9066 null] >> endobj -1637 0 obj << -/Font << /F37 1026 0 R /F41 1218 0 R /F21 938 0 R /F22 961 0 R >> +1652 0 obj << +/Font << /F37 1038 0 R /F41 1233 0 R /F21 950 0 R /F22 973 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1649 0 obj << -/Length 1111 +1664 0 obj << +/Length 1132 /Filter /FlateDecode >> stream -xÚ½Xßs£6~÷_Ácü ÊcÃô)—:inz¹ÖuŸÒŒGak"$N±}×ûß+,ÀààŒs´°ßî~Ú] Ù†¥~¶á{¦å#cŒLϲ=#L–±RÏîvñ(_õ·>̿ܺ#0ƒ±36æq
Ë7-ß·yôxuóûõŸóél Ϻ›Cà«÷¿iI /7Ÿ nïïþ™]'£«ùýç-žMo§³éÃÍtlß³•¾S œP¸½ÿcªïîfן>]φOóƒé¼Š¥ ¯m¹y _O–©°?,Ó
|ÏبeÚAàÉ`书7rÝRBþª -=ê8#§0Ïü -É®{½³ •Â‘ÊRE48ê¡ ‡Žkù@îRdŸŸd™PU”1ÒcjTgêð6æ` ErÙ«Æœ% ÂqŒ8¢a9ÉÿZžÕ>azn"Aà Rv‡ #* -¢pIz¸\¨¿@‚#(«9?í®j¥ì´kmØ„±g¨ò P%vŽbÛ©¢›4ã¤wŽ,Õ;ºä™Ê<HÃ5+è¬?}å386×æ{’C.Õâ“—zzNz0 Q*Õ*’bŽzIÌøòè˜Ì¼¶c.ä‰ØˆŒx‘³ßô¥Lît£¨`ö1e\Vò|ð¤G…Ó4K{ûË÷.üdª¹ª >+ºùKåÆI[ßö`Žkù†¶Ñ=[‹ÃÆï$\™„¥×-öœæ’…"ÃX:ÚŠš&' 5Ž‚šp+µ5ãß©öÑ”KVÍÏÔ©d Í”‚˜4xEG§ -ìÞ~ Q”¥j9
^Åu¡që<&Ûw4¶Á$ -«z=§_h}µ*¡•úÒè±ó+£Õ»wŒYð—Ÿk³…'—D}¢ôeI¤ñ»”Hl +xÚ½Xßs£6~÷_Ácü ŠÀØ0}Ê¥Nš›^®uݧ4ãQ@Øš‰“Dlßµÿ{…elp Åär“É +)"‰¤m±\p±`ü\õî4Ö¢ÈHÜ3G¹„-û&ð®å ƒSþ’œRs÷¹(,$®I˜Öëà ÊÕ +°MÌSDØùɉ1¢”GHa ‹oˆê„Q‹0&ˆæYõ~Á3¥‹®ƒý=a@¾äXlÏw>Á*Z%ÍñùN'4—+P$G‘ËU®b¾îÁà +i +ÆIN‹ Öx“Q•º¦HêÞÑ)¤ÛîÓ€÷ȳÀºJ5ÑL’øüèD¹ž +ºƒV>7úaÂLPn2¾¯« B:•ï‡üF·ØP1™”Ãû»ù|²}?·é4Êóíâ©áìÈ9,–o>©: ã&¶îáÊu+‡Pž3¶7œ”N±ûÞ©ç‡#—®ÿ¿^fendstream endobj -1648 0 obj << +1663 0 obj << /Type /Page -/Contents 1649 0 R -/Resources 1647 0 R +/Contents 1664 0 R +/Resources 1662 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1620 0 R +/Parent 1635 0 R >> endobj -1650 0 obj << -/D [1648 0 R /XYZ 85.0394 794.5015 null] +1665 0 obj << +/D [1663 0 R /XYZ 85.0394 794.5015 null] >> endobj -1647 0 obj << -/Font << /F37 1026 0 R /F41 1218 0 R /F22 961 0 R >> +1662 0 obj << +/Font << /F37 1038 0 R /F41 1233 0 R /F22 973 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1653 0 obj << -/Length 1184 +1668 0 obj << +/Length 1207 /Filter /FlateDecode >> stream -xÚ½XÑrâ6}ç+ü‘*É–eMž²)I³ÓͶ”>¥Æ±Ep16k™dÙnÿ½22Ø6°†±%Yçž{t%] Hý°AmhsÂ
Æ-H¦†7ë ãEµÝupþ
XÊ_}v~¾5™Á!·‰m Ç%,"ÇÁÆÐìÚÀžB@ݛϷ÷w
®{Ìêï??ô -bΉ1ëXÔ„Ô2ÍuMØù³óÇ°ÔºêZ« F˜6©ÐÂ% m¤ åÐ6‰¹ð±l„ºnÆo`1÷ÝTèšóßO„”£™›z“QÈT×ÿw¥ŸO™ŠÀrJÉ>P0Ž“77ñƒèåbø9²7ÞLåT×.… ÅÉ(ŠëpÁ¤ P©Xfq.Áõ_$¤1"ý¾¥‹W‡ Òd Ro1VºLÚ»¤Eµ\FéDÈ@^LïçÐõ¦“8¼\„,¤ -¶ììä2Á×qÂøÈà›8!‘ùG
y¤6ä¢{ö6’sá5@ðb•Žìö<4Õ[17u[ö¯Ø á:‰hßY¦®7=‡½ -7 -¢pbJ<n’> 7= -PwókR˜]×ÖÜÓ¢ÍÁäì[áâÊÜR‹“ãÍ…/!¥ _ uLS 9©ÌIjí0__ ïRÿ Œ¿$<endstream +xÚ½XÑrâ6}ç+ü‘jI–mMž²)I³ÓͶ”>Ñ ãµEâb,Ö2ɲÝþ{edll †±,Yçž{t%] ¦ú!ƒÚÐf˜³ 55üYÇ4žTÛ]å߀õG úÕ‡açç[â 2ÛÆpRÁr¡éºÈ£®
1ì)³{óùáöþî¯ÁuϱºÃûÏ=€©Ù½½ÿ¯KwƒëOŸ®=€\Šº7¿^ÿ>ìt“c|¸øE×0ýØ:èßöý‡›~ïqø±Ó ¾TýE&É ùÚ=šF ÜþØ1!a.5^Õ‹ cؘu,J µY×D?;€•ÖU×Zý 1±q€ªèšÐ6”C´ &+G=`›f׋"ñ +î/ŠˆX×ÿ›7AÂ¥ Ï¼Ô G¡LuýWúù˜ ¡Ø +¦rªk—\ŽE2ŽE†A,%÷×g"ÈÿÛ¤¦.ͼ0NÕ_¿ýÐX¨QáS\|šS)_f|E -qF50‘ð…#âÇ“/Ê©-f_xҜ̢‰ƒT( ]Þb¤_¯A¥É¤þ\i2Q²<·wIÊ‹
ä2NŸ•²òb1ø%òü鳈.Õ ÉÁ‹Á ÌE’nRÍjZF±÷"Âà\Ä]†öåðr†öå|ξæå6*t)œË—Ç‹
]aV9ó¾–¿.¸š$R,g‰)KáÜgVÖ‹M†‡ v¨‚…ŽE¬êOº)·SiÈ–¢U@¶‰ƒZýK«Æ+žç¶‘ÚØ µ?iÛtŸmZÚ®êö#g‚)¤˜‘úØÒ¢6R‚8Ðr-«=MÃbÐ"Ì®¥qš M£*HYquÚ:EÜÖG½«s ¶MÜB3ÍÈ¥¨· Šõ®Ñc ‹žCw|ˆÞG¦Ñ³³¬"(#£oµÏ’6ûWw€CÙ: +™ãØõkãh'u{¬]#íg[<76Ù›*yªØ$‡í9R§ •¬´ím¯ÊÕ:•+ƒQºçT·Ãõ¨´#ˆ Ón.튇ã@Çt·wÀ†¡qlûÜ«y›#n,Òp²¼åzýòE ÈJõ“1Gh4—ÊÜ¿VEzÞ\r$cÇY ŸIå´|ƒèD AìbçЀ¤Bqõêï<šÜpI4ÒÆQQ±Z¹šõdÚ"
cs4å9”*ÄÞŒžíµµÃÚìG^= „Ùææ©Ô{Q¦1á·I"ñdøŸý£&VÛyÙ=+åœû
f—/²û¸žÇQe£^£þu÷È„Âìò·æÖ×,òú³ï˜Ë xKÍm×ÅÅõ1Æ•ëcì¸ê”£@rR™ÔÚa¾¾ŒÞ¥þ?š!<Íendstream endobj -1652 0 obj << +1667 0 obj << /Type /Page -/Contents 1653 0 R -/Resources 1651 0 R +/Contents 1668 0 R +/Resources 1666 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1655 0 R +/Parent 1670 0 R >> endobj -1654 0 obj << -/D [1652 0 R /XYZ 56.6929 794.5015 null] +1669 0 obj << +/D [1667 0 R /XYZ 56.6929 794.5015 null] >> endobj -1651 0 obj << -/Font << /F37 1026 0 R /F41 1218 0 R /F22 961 0 R >> +1666 0 obj << +/Font << /F37 1038 0 R /F41 1233 0 R /F22 973 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1658 0 obj << -/Length 1094 +1673 0 obj << +/Length 1069 /Filter /FlateDecode >> stream -xÚXÝ“¢8÷¯àQ Âñ! -5Oî¬3çÖ³çyO³–•¨©Â&ÁÕÙÝÿýš/e ÐÁ² !ýKw§û—&º¢ÁOWlKÕL§¯ ¾jiº¥¸AGSÖðî±£çcP1•G}˜wþx0‡Š£:c ÌW%,[Õl[WæÞs÷þÏÑ—ùxÖC†¥ujYûa2ý˜õ8Ùíþiú0yüw6ê
ûÝùäišuÏÆãÙxz?î!ݶt7r„ß<LþgO³ÑçÏ£Yo1ÿÔ϶”íÕ531ä[çy¡) ˜ý©£©¦c[Êwhhªî8†tú–©Z}Ó,züÎ?¿€¥·©hÿ,ÓV-ÛÖ8°¯— ¨k¶êô¡2´ u`fêÁç hZ—†’ðv JŸ¶ØÏúÃ8x!ü.k,{aR¤ëªcYF@H,©Ô×"H1Ÿ÷YëGvÃžÇ‰Ë -¥W”a\ Ƕ…ªhŹ 1î^AK{–""nÖÎ
|¾øVUÕÂåÛ¯K -ø8 HÊÞ¬¸ À;ºØÝ46N…¯•t`ñ©Gå¾6rGeEÅ?— Jpá ÒpBæqŽÙP»%¹ców€’ûˆ4©.
gLŠ–^Ždên•O´'bÉø2d•8ÛR¯£Öœ|‹‰Í¥«‰Î –Èå $"àœkHGV°€$ipå -@¬_R£‰äû R=ÚBTL‰€ör:–I£Á´ÀŠTRb 8 ŽåæÚõ8ÅJ)¤X5Æpè†G¶´ˆËÍ2Ä…wZ™ ¯¤ÈÛWrNÍ—Q`Ç@Ž"â¡|)H£MÚ¬¨tˆ0\ˆ…hÛϺ¿j–V륟Ùíòå?ä…0©{Ðè]š¯ÙNØ -üâ„ý5ãTn‚<ÃÀ1
«éT É"K Ushôk]Q{R.—ø¢º%eìOÂD¿«÷µ Äõ N«½æ 8g•¾}7Ê9E@íéÂ]]n\tb–H¾ )¬ÿŠq ÉcbJ²“?9þžd\cÍHÁ—C=4ÿ
»40'“e!7†M‘GĬ?yjWƼÎ࣠†_díKª˜ÖõÙÉ%˜¿-"'-ZY,/GPÝY‰i©ÉGÍÉüóio>G9 2õ,lÛ8 ‘FéˆÄÔªm8ÃB©Ä\Ë:Õüpàr®úÿn³ü8endstream +xÚXK“Ú8¾ó+|„ƒ¼~cלÈ,3KjÃdYö4KQ[€*~E’ d“ÿ¾íØà!¶g (!Yý©ßÝ–*)ðU%Û”Ý1¤±cȦ¢š’ i Ï j±•›Puׇåà·},9²ci–´ÜT°lY±mUZzÏÃû?&Ÿ—ÓÅi¦2´ä2-eøa6ÿ=_qòáþiþ0{üg1árö4Ï—Ó‡éb:¿ŸŽj›*ÐkÂ+³?§ù¿ÇÅäÓ§Éb´Z~ L—'YªòªŠž +òuð¼R$Äþ8PdݱMéLYu M +†©Ë¦¡ëåŠ?ø{ð× °ò4#mÒŸ©Û²ikãjEªbˎጥ±éÈ–®é™ŸGÈR”á†ú„ç9ýNÖ<&n>½Ë‡U*+ ˆTUvLS«sÝ/)Y_ +p e¤L] z H‡ÃE!Úùò¿Š©4jéG>¼@¼|A^‡º' +µÛyí*a ] +ˆC/sÔ96éBÈBèšÅ/ëù
|0A¸õr<“ZÐLàS[˜?ͧ¢‡ +øg½ù^ä|id€çÚ¶vºòдʕ‡®X²9ã’©TFÓ¼äütrÍúÿ²›íÕendstream endobj -1657 0 obj << +1672 0 obj << /Type /Page -/Contents 1658 0 R -/Resources 1656 0 R +/Contents 1673 0 R +/Resources 1671 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1655 0 R +/Parent 1670 0 R >> endobj -1659 0 obj << -/D [1657 0 R /XYZ 85.0394 794.5015 null] +1674 0 obj << +/D [1672 0 R /XYZ 85.0394 794.5015 null] >> endobj -1656 0 obj << -/Font << /F37 1026 0 R /F41 1218 0 R /F22 961 0 R >> +1671 0 obj << +/Font << /F37 1038 0 R /F41 1233 0 R /F22 973 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1662 0 obj << -/Length 2714 +1677 0 obj << +/Length 2456 /Filter /FlateDecode >> stream -xÚ½ksÛ8î{~…g¿T™©TêA=¶Ÿ’nÒëÎn{—ÍÞ}èv:´Eǚʒ+ÊIÓ»ûï$-ÉJÒÞk:A€ žtÃႧAZDÅ"+’€³/VÛ¶¸o¯OBCã["Hu~}òâ2ÎEP¤Qº¸^xåËópq]¾÷Ò -Nó^½{{ùæõïWg§Yâ]¿y÷öÔ8ó.ßürAÐ뫳_=»:õÃœ‡Þ«?ýùúâŠ>¥†Çù›·?¦ ÇL¯../®.Þ¾º8ýpýóÉŵÛËp¿!‹q#ŸOÞ`‹¶ýó â"ç‹;xaAXÑb{’ð8àI [L}òÛÉ_ ÃÁW½tÖ~! ¢8f ˜„æ,H°Êx¤qk¾?õSƼR6÷¾hÔì|Q–TJ*úôwzìÇèW›u¥zÂÿ“ †ü²’»Þ_wív´º[y´æÃËh@Ø… †AÁyô Ju%¦ -Ͳüï«›Þµ’þ®«ÕýˆÝ׶‘ ‘§^ ÅA‡n¸„C.ÃÅ7Õlü‡Ùj¥Ä²–å¹Jõ›n?B6_Êv+ªñò¦-E/F¨•ÖŠ˜<¾ÑÕ¾S ›ß6µQõ^ªm÷±iíò¡‘·â‹1Šß÷µQe¿]ÊnDýRËô'Ö!ÑãSû hðÔ¹,;)>ùeî¾úUã7Ê/Û^=²ßl?É‚<bÙdÛÚ&/.£páÐk< Žâ0s©-L!]1àÖîú -¼ÒÏo½èåV6=½þ$ÿ`,j*¤ ŒhJ~WâFYÑ €¨ˆ,LHŸët - ˆÂ<(Š"b¤± 3‹!éÅqbèÔ@¹8ö”DS!´ßÑó¦n—¢&ø°-xé[|&ÞRš -#¡å==1?^o*³l"p+ ±Øí¤èŒ íO(Z}ÎQíp|2(qšz ™·j´í;d]ü†˜Z‚ )/¼7kBöpƒ0÷$-Då
n4cØ4ò¢Ÿ¶l ˧–}¼ §L²œQà²nWŸ¼«ú
QH±ÚŽh †£¡ÏhxDT½2±ÊÒ çE1™R®Å¾6NwWÕ5Aú¸à‰Ç Ä0ÈÂ0]ð¤ - ’ªÉK.¿pпƒÔ £›Ýñx”„x¤“`µ0‹ñ„\qDÞ¯Ži ¤ -¯Ù[Ô8 ¹Í«¸^§Ú1ÒuÊÈ£²‚P»vtJŽ3Ü„ËJÚ>Æ&Ó.‘Æ‚¦Y †Ì -fΦ£FBAî¬ï‡ë×údpa;a jcÒ,8XË´¾ÚL“ ™híß5:eáyo·ºbñL§ÇèÐð9¬ÛðŠu›%®Væ®Ý×%K9^+°Ap ¶r>)bPœœÄ`®†\»Ò@ånЗ•m#Ç%EûÈú~PWfÉ'PŠäßI~Â(#èáZ~WºìÙ“ÿ2Ï*-ºeÕw¢3š¢óš -¡E!ŠÇ9ô¬iuç
ýŠ«Äh¬(=´ ôQwä‘éÅàÝžKD}`Ô~I-1Àè±ú“>2@Ø#p 2¤¯Ö+ -»Äe$ªÝÒ¢CãU˜ðñ±?¶Ùñàÿ?Ò.FWyv!ˆ -0õ¡™Òw?œý`ï©P 5ÿHÞ‹DBM%B‡õz®@ ²÷ ÚóôÅ’›+&ç&Pg¥ÑÇÔÕŸ?¦qø¤Æ šÜ`{susöL=¨stì+Ör/¿cát¯þŸ† 5|8¾j?ë?=åܳ3]ú‰ž a¢ƒWA—èÌ…ÊÚA°°ƒ`áÁb0÷AƒÞ.‡ºK™éDkzÊ“#Mhþ -]š0à ôsÃ3S.4zqnE•]ë7¯Zñª ï¿,kÛŸ ‹ÆöÛ¶×EbcxÚ$&¤¿4ÛÐj”FLÌ*l‰÷Ê,„øZï2Pÿƒ‹äýQëcV3ˆGý磙À,+“k¹zq×Ã;µ°_ vñ uñüpÁwháý$‹LãÈCãÃb¸fKi`,¬¤Û~óáåèÖ !ÝÈ2Ú Pøsõ뎔.Éγ*Bš&eºÒ}gÞçè`ø{¢Åt·W˜±
S -
ÊÓã_%Ì/æǪÿ h™~Õendstream +xÚ½]sÛ6òÝ¿BÓ—Ê3!‚I4OvjçÒi“;×½{H=H‚,N(R!)ÛÊ]ÿûíbŠ”%é}Œ °\,‹ýN8ü‰LX¢„š¤*f’‡r2_ŸñÉ=̽: Mà‰‚>ÕåíÙóë((¦‘Ln—=^ãYNnï¦ ì 8ðéË·o®_¿úíæâ<§·¯ß¾9„äÓë×?_ôêæâ—_.n΃0“áôå_.þz{uCS‰ãqùúÍ„Q4|†éÍÕõÕÍÕ›—Wçw·?]ÝvgéŸ7ä äãÙ»;>YÀ±:ã,R™œ<Âg¡Rb²>‹eÄd E Sœýzö·ŽaoÖ. Õ_È™ˆ1¢À8ì)0ã,áÀ*•Š%‘ˆ¬ß çS³Þ´»àSUš&0¥ž†ð;Ó¼¯ê÷eEŸ/h¸ÃsÃæA2%¥èsZä
.ö ÐûR¯ÍWsúdê*(« ©tжÅ7ž`Ìõ|õ§OW›¦* L |Üšz´ùÚTÛ–æÊízfê¯W”)w.›Gঠàܘ†¦þIƒÃ¾_ëv¾z_äÛè¼éžæfÓ˺ZV£®Öܽ8¥ªHE®eù_ãPÉ›ªlL°©Š|¾°Û»®Sgc\ú‹ïóSø¯›.ÈnšvUoÈòiQu>\^V Ýêj¾wîþ‚Sú®Í|[7 [P•ÅnÔ'ïJ^ë'§”}DôÝîÎ{ îŒjghµÿ_²Ë¬6úC°(ÁÝç_³a^e,ª¶9qÞÞÞAœ²Lðt¨ñ?¬Nž_‹pÒÉ´D³ÄSQ&ºj&P!8p«6m^Hÿ×V·fmÊ–>4¿s.Ê )£Ë¿5úÞ¸½D/ûÂVB²4š†[Ý®L'О(a”Ji¼ÇÌ"¨3Q;º¦'\MƒªBh»¡ñ¾¨fº x,øh+ ãé̸
FB³ X·«Ü-;Øp ±ÞlŒ®Ý>ÖŸšS´R¢ØáÐ-0P¢$™j Òé¼*Q·÷ÛZ“vq1…9©¦¯—„lWàa65´…C4¸Ñˆb“ŒeJ…_Öl + Ï5û x+ V¦½:%↳¢š ð1oWDa ÊŽh ÓÐ4* yÛ¸Xå ˤRC¯]˜¥ÞÎé ó¢ Èš F4;êAB–†a2‰³”…!?Ó3QЧ²-Ã@m¾Ÿé¨P(ݶp8WG6CÁ OïÞQlß7HñÄÃý/Š¢zDÝgÉt
ÚÉ7Øà×Cnü„U0ŒÍJwN’‘“!6/ïý"× ˆ9}U -…5WdCǘ •¶¤ÖrS=–}FÖš‘„v-QCG÷Ü:¤ +‡Î×»Iõàž:
™Â,‘³Ê<7%*ƆÕ·H`K9OúrÀ:n‹•§r9tÙ ÷9ú0h<]f,â2 ¤'ØW)J®vƒES +à 1ÍÆÌs<„MÚ0‘—crÄë11ñ¶®|, +é;àC+&Œ‹®xuî.ì… +ïk…½^ø:DDñq›wM R¶žÇ²ÂºacñGâóÔlz•‘î’D´MÞ´¸ûصZd*B×wèšÏ F²ž ®t>%æ ÌÍxÎKâî-ïÙ7 }Wéç…Ñ%œ0ÈK°ÁCw7ê³LSãUà ,¥# 7Ö@Ïí˼yÚäõho®“™üV¶ b¾Ðþ†}À2ãL@>Á2ˆæãƒk!>/[·¯ËÇ|¸gñîásŒo e©»g »ò$¿îm<ù~Ä®É?º$cpßË×½
\t¡Ñ‹2¿õáŸ]#¬ÁRxÖìs=F’áÿ…#Ïn¼+`ÿñß’ûÿl¡
ˆ²LŒ¿ß‰šÆ ˜8¡Pp™ ?Xºÿ/Eÿ73sѺendstream endobj -1661 0 obj << +1676 0 obj << /Type /Page -/Contents 1662 0 R -/Resources 1660 0 R +/Contents 1677 0 R +/Resources 1675 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1655 0 R +/Parent 1670 0 R >> endobj -1663 0 obj << -/D [1661 0 R /XYZ 56.6929 794.5015 null] +1678 0 obj << +/D [1676 0 R /XYZ 56.6929 794.5015 null] >> endobj 470 0 obj << -/D [1661 0 R /XYZ 56.6929 648.6893 null] +/D [1676 0 R /XYZ 56.6929 587.7171 null] >> endobj -1326 0 obj << -/D [1661 0 R /XYZ 56.6929 618.5026 null] +1341 0 obj << +/D [1676 0 R /XYZ 56.6929 556.781 null] >> endobj -1660 0 obj << -/Font << /F37 1026 0 R /F41 1218 0 R /F21 938 0 R /F22 961 0 R /F53 1313 0 R >> +1675 0 obj << +/Font << /F37 1038 0 R /F41 1233 0 R /F21 950 0 R /F22 973 0 R /F53 1328 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1666 0 obj << -/Length 3727 +1681 0 obj << +/Length 3745 /Filter /FlateDecode >> stream -xÚ¥ksã¶ñ»…¿…žžpx’ÀôÓ=|7Í¥½S§ÓI2SJ¢-ÎI¤#Rçs}w± -®p#¿]üü+¿ÜÀ¶ÿvÁ™rÖ\>ÀgÂ9y¹¿ÐF1£•ŠÝŧ‹v fý«sòÓÆ2#uz¹0’ÙÌÎ ™3n@h‹L –JÕ YŠ9!G,ò¦<ë¶><N·+¤aÎu9\ô„t‡5C[h Å™ËÒtL|¹-®Jšä¡>|.«;z -¨U]-òUSïŽmÀ½ÏÛm•ï‹ uRV“µÖuõ çòîxÈÛ²³Ù(—Ë… ;Ç sÆ‚>”» j¬p ’6ÿ\TÊú§½ì`Ý/Aü¶Âp[´~Ó¸c!„ß•AFˆQÜæÇ]K„võ:r -S·õûºii¤ã‘ëc{ pÚT /Ø Ã=¾|§‡ÊÂãV¥ß* -oÃÇŠPGg j v jì1aMvÇ‚[ÃÚ$Žf7©¬Lnn !ŸÃ-VÕ-
šûb]ânŠÍ €XN§‰S6Í® -VÀ xa6hkÂýïŒ TªXÊy¶Çæ -³Ê=í©Hç UDB’Ÿ‹ÇÅy_¥á$×OÒîN‰<•OÅ… Qÿ÷Ö›µàÉ}q -Ô- =ï“ŽES#kŒÈ”AqÊ ”rƒdÎó±¡i”'Î ›‚ -—
-òÊ+QÚíÇ÷(Y à!ý‡.)roLÔ‡8ZHÐÏ4ùôý+ø£1Dˆ° FèëW
üÝÖ»]ýàÍ—~ìß…':Åâk[Tè"ç¼2ÀVÆcû3î]ô¸f˜nÎzP.ÁˆSõŒ `=áA#Vgt‹¯Þ§^SeŒ§=I»Ã:%À6jɸ¹¨/)ªƒÃê¢:¸·†9iÑsI¸sLBi ävÓÒ”%Ã`ö‘5ÚÐIÀ9K -Þ×$ï¼4 -V¹„R©Z—÷ [扗§“ÕѨœtgŠé4{¦$ bWÌkª˜ëC'Ú©r»™~†ˆ4ÃÆH5!w̤Tc>¼j»Þðñiz⣣ñ#ÊuqØöïSRåÇ¡ Åq~Ä -×¾žEe&8""¿ ‹¦-B9 2Í2ˆ(#5ô¡[„JZÂ;½- 8ø¹¶^×;0é\ò¦¯_wá庢‘M~(+*ë†æ ý
xõƃÈe@É¿äå._íÞ„<¹©Èf”/&ß^sÝ”
˜é²ëJŠ._×®3×¾lÇ׿ Ë®ÔÐÈ{¼›¾ßµ"½g~Áïi‚¬ÌÄÎB¨ ªú°û||¾Íø²h×/? V†õ~vç
KµÐƒ$ÖÄ&iª‡}QxêücªIµ¦=«T…\V'5ˆãPn6ExñØP¹ŸÆ
f£ - `ÉÞýEJ ¤h‡ù¿“F¨õ^ÎÈšª«åQئÞçå\W7ËXÆmLa°ßMš,¯œÄþ5ræ ¢-½˜É=œdFÉ¸Ò Zhn˜¿ ê÷Y† ¯TÆÅeöÇ&è_¾kjº\!Lù–U°„G¿½ ºíqMK‘h¸H&¨ÿ'pÞås
~ÒÊg\þ -Ìf7ô†?†SåRR‚ñ¨Ë ®ÿ3×3˘€ê wH 4uq ¡
gQçµ›òzWú¦ -¼FB±l‹¯4Ø”wX¤Íµ…4ŒyRB`îIȤΗ®È|¸žTØÖjèÄdgjhìœ1-Ô$°a/Ãâ’A6wÒ_h¸p¡Û§¶O ü®!Ptjˆ@¢¹ ˆ®7à9 7=âu@ñµ„ ˆn9À¥ WýR.Ù•ŸC‰Ùm(†ô‘'ì Gj8#¿écÉœÅË…¹O
ÝŠ‹á’3~_Xf„r=åxä}'wšVÀ1YµãÉó1òrcÇ9…Û÷÷¿Ü%õó`ˆØ]"Ê]ÌÆÞç~&äR0ñ%?”1±æ1;àáàñ†ÀÀ_Ñe1T¯ÇjW4áÝŽjô¥TDXfe:¹òÿ†L"rûûÉD{õL?oˆu>aè°zs݆+›Ó~ž~štDš!-O»yjL{Il–¼¥;C_3/¾/v»½·¦…tZHßîÊ®E -ŸÒ&ü75‘:SA€gÖ¥“´ ¿f \mVóÉ“4© ÔHh«·Ó²xüÙÕÐ G]¡rî ïS„˦÷»ÃVÊB. 5†àƒ³ù³™O·Þ¢_ЫÂøÛ -˜D©¤¨…lVT€lµÏÝÑe°T–>ã\HO|²|ç£Ø7mÞBÆY®›sV’jpÞÎ=ÉB‡tÊÃÈJRÇR+䈉eüƧ7|ò«á'@ÝUmƒ¸!ãP¶ñ $Ø}aÑïäwá½~·a: ßAö݆O‡n}TW Å0ãTFžíßÿ †Ç:7TaŽd®º² -„7°ª3 ƒaèù Œ_F;þÓ ÷_cãm =×ûQ<…̬40…Œ›lʹ»2Vf3¬ÿ ãu‚Àendstream +xÚ¥]sã¸í=¿"o§Lc-I‘’8}Úì^îz{í&Nçîf*Ër¬Y[òZòfÓ__€ +–ýÓ…#›šËGø¡´V]î.´‰B££Èc¶wë ´º®sò3QšT%3Tj @) +€^Â?o2ñÑl |¸»[ÜßÝ~àv—£àQoDêÒo×›£éxMÇÇ5EKcbÂAô(Ú¾8µÀÄj¸},¶œ`È +Œ´G¯Š6õù°4aïd§'¼ÁRŒ ®Æ—Gc=¬ˆÂWç c=¤5ß²Äǯ:¨A ‡rµ*¸ã±¡?öuf +…`’)çݳÚSÖÿ JYendstream endobj -1665 0 obj << +1680 0 obj << /Type /Page -/Contents 1666 0 R -/Resources 1664 0 R +/Contents 1681 0 R +/Resources 1679 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1655 0 R +/Parent 1670 0 R >> endobj -1667 0 obj << -/D [1665 0 R /XYZ 85.0394 794.5015 null] +1682 0 obj << +/D [1680 0 R /XYZ 85.0394 794.5015 null] >> endobj -1664 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R /F39 1161 0 R /F48 1238 0 R >> +1679 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F21 950 0 R /F41 1233 0 R /F39 1173 0 R /F48 1253 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1670 0 obj << -/Length 3701 +1685 0 obj << +/Length 3662 /Filter /FlateDecode >> stream -xÚ½]sÛ¸ñÝ¿Âo'ÏD0$8}ò%NêëÅIc_§»{ DÚæœDêHÊŽû뻋 ðCrg:Ód‹%°Øï]ŸGð—Ÿ«„%™ÈÎÓ,f*âê|½=‹Î aîÓ·8K‡´ ±~¼?»ü(ÓóŒe‰HÎï ‚µ4‹´æç÷ů‹„ v+D‹÷_n?Þ|úåÛÕE/îo¾Ü^,…Š o~¾¦Ñ§oWŸ?_}»Xrøâý_¯¾Þ_£©Ä®ñãÍí‚dôsdÑo× ¯¿]ß¾¿¾øýþ§³ë{–ð¼<’x?Ï~ý=:/àØ?ELfZ¿ÀCÄx–‰óíY¬$S±”²9»;û»_0˜5¯Îñ/Vš)'ÀIɤäÙ<—9K9¤4æŒ'Yâ¹,ø — ryWËߢHlÊñuÆ´Öò<\t²µCšÙZ[Ï4N¶¾*/–R¦‹]Þ?ÕùÖ<éEó@ÐÞM[ò̤veû\¶4~i«¾ì¡ê;»h{Áa±uÙYÀÍ‹Q£J¤bqc7ª›Þ®¹+×îVï - KÎY¦”0“Ïy{ÙîëK<tAÿ3:` —)‹u ÛUò$É,ç`ðÕ *<`Õlß•V¯4cyòØæ[‹Ó?å=ͽäuoa
Aº²¶ïwÕco:?mŽæI³G#«5 Z-Ú ½Ø×uU?âs¼ ㌠˜ 'æñâùþðŠ¨Ä¯<‰YŠŒ‹Æúj«›ºœá[™J¸¶/U—¯6¨"øŠ%1FUs‚®âóa£xñ›©Ûr:ûRm6]•Ä !&y:’<ªj_Ö€š‰EŽü¥Á+ø¢ü^u=± Àx43°«Ãhe!Få¶yÍ&Jµ¸mz;gd:e¤P1‹Séy„qB±$Ò"¡*éçòõ¥1[‰ÙN€A<AY[<#ñCG,Aù² £<к%ya³/üÒò0(ëõ¦1úl¦kú-šýjc_ùs èØÄm[ߘ$‚e’óÓ4Ä:î@=ž -×û¶™ q£œ§,Šqš5CÂÀ `žNÕã„R'Å'£Ö -þ‚/,Ì+r† ¼Ešq±ßîºÑüŸûVh«ÒOä=òƒÔÔAu¿y%=[èå ôŸœ#D>fC¨ê®7¾cÝ;q£C"qÓog_*8ٌLjRÆã$³:ÜÖÅšð½¨æ †b*•Ÿ•<2b †Ãah{²úç#„Õßi„àl‹g©3@ãöOÑÁ5I¤ö4 Sm1¥ôš}@:¡Ø ·ëú¼Gg´îŽ*¶„Цӓû{¤)µæš%qÄP”‹â0?€'“ DV;àc Œ=Ð瀙ïvÊ:;áÏeßhèר¥A i`ˆTØß®!Ô}7 ´ P²(ŽÔ06’&Ê„ˆèf$ C–¬²,ˆöÏš<^¢<ß æ)Æå—4uÈSyD ãòWž
´ð= ä4iêBº]ÜÄî&=“!”ÿÐÑ\à,E•õ}Ó¾^pÎݱP¼ˆ rä lskMÍÃÈÖNì*Š²[·Õ*#}òmøs®2P÷8MQi²}<§Á·@u=þ2|aª»Óu‘þ;8pÕÔ®‰Ô -‰©s3˜ -’‹²Ï«Mg‚qlƒ1wÁXL‚1wB„Á˜ qƒ˜ŽByýß”ke¿¾DfFÐSòÓ”¥‘NÞŠÓ -׌xú†ÅX',Îa™P]®Û¦é[ èÏNïïfö j³ ÜdoqÚ[L•<BI, -|‘—Õ±h -r?Ÿ^;c–¥èwçzcJ±˜§bHâo‘Š0FŽ»™œAb ÃF;ÒòäÏ¡/Cü©ÚMV ¤~RpÓÅšÅõ5„^.MÕßa½AÇt5$%"3j3Ax¥ü hÚå-Ô?ûMÞœDa΀ÆPw©Æ8ΧƒâÀñŸ4j¹k6ÕzN\˜ ù ‰G¹…"á§:Ô= ¨¾é¹iÖùœ†JÉ¢,rªÓì\r–’1
yÀ¤¤ » öšjª5|¶ž¯š}ï ´+/ ʼßÓk TŒ u¨Ð +ù†C
°N8T‡5r¨Æ“õ ¢WÊ!ÿ=I€Çš¡`ØvÑFœI 0ŸIòn8°±>£ -!ÔS…qä -¤t8Oq
æGJ篣D«! åj •¡mÇ,J˜Šã7Ò!Ö sX憤iûñ¦©bÀ~zS‡4³é¨Œ37µ½:½øåÃ×Ëû÷_éÁ£tQï·+jǹ;¼H=:,§Í
RB Û7*«gÓ;FÉϼZ úáöŽ^µåw߬›Ý«Í †¢\£‡Ñ±o<qð ÉHÅ‚D<µ%½€p„: -ÐíÀ³•¶ëy¬¥9Ì@\¾aõÁé(} ƒÄ-sÙ§¢Û/·×Èžãj†7*qö–šX'ÔÌa›oš ,~S>;[6˜â•MEL€×?M…Çš!cÜÖ\$C:î/0khkº2
uðEm•amú)71W£†„`e¹ÿùCGèÈâ¾ÙxS>—ûzƒ9mg£§võ¼áúñ¤O)”£|\™?N"s§S»PÝÊïë;°òF›a>BdHÝ2|¸£ò °*íõ½/(ñ¡ü¦8¹´_ÙÙm^”Û¼ P »y)½ï33¯öæßsÒ~…@ì„‘ÏeR¹¸³¹ÓÈ™ü… nš
̧#Ðá{xèm.b/³Eî°L4×È·Ò…™Ô^xÀïDê ¾‡¤€“fJÛÚ\ ÃÁÃïn?ü¥&·ÿüðåóÕÍíÔ#t¡‰û;у#y{õùúˆÀN$Þņa(ïG…Hà‰°ÅŽ}²+ÃïlgŒþYÁüÏŸó ¾u†ÌGj}ĺAl,Ö°ˆ% -Y¨ôÔ¡¯HÄ éÿóB endstream +xÚ½]sÛ6òÝ¿Âo•g"Ÿ9÷”&N.wW7—¸7sÓöi›S‰TDÊ®ï×ß. @Š”;Ó™&“\,Å~ï‚â’Ã_qi–d2»´™f† s¹Þ^ð˘ûx!<Î2 -c¬ïï.®?({™±,‘ÉåÝ}´VÊxšŠË»âçEÂ$»‚øâÝ· >}üéËÛ+«wŸ~¼½ZJà >ýë†F ¿¼ýᇷ_®–"5bñîïo?ßÝ|¡©Ä¯ñý§Û÷ÉègfÑ/7 n¾Üܾ»¹úõî 7wýYâó +®ð ß.~þ•_pì\p¦²Ô\>Ãg"ËäåöBÅŒV*@6_/þÝ/ͺW§ø§MÊŒÔÉåRi–ÂþÓ\Ì +HÖd,QRõ\–bŠË ¹\ ¶»å/œËM9>±à‚›ÇËžlÞcMì.£ÝO˜ÎÌhû»Çòj©T²ØåÝcoýSsO¿]˜öÂØ.º+±xôã¶Ü?•{ÂÁ£´£÷Š¼ËWy럺†~Ÿ ËšFUÝvû«tqXwe1D*¿Ex©ê ‘E#®.%H&K4pB°Ìéε¯‹5)RU¬ü‹1CɤI$p_ +O_oâÎæV.ïóÃÆãU-m¡cÚ„2,™õ{ ‹±”G|!.¶,±VüÍ–,KÓtZ¯—ýŠËxI§ê”€et– w +É&¦Kµ=ÃÆêÀŠöK9"1„ÛmËmÛå]ÕvÕº3•0e”>KBtJÃÀ\à´Ji; ÂY‹Lyd-ø„Ö‚¿]˜ÖEo*|ÞW]ÙÒNÖì_h|hóÿÞñ´~ÆoVÓoù{ÕÒj.HiSRZ` °9cV% LâÏi2W`eY¬ÈÌ‹¤P•T±$lkFU «rœÕ•k^Yz,ÜqW3:’f ,Gß: Ml Ÿ2s1!n}\cìQSïQmðŒ6ò¨éxt§¶×D¨ºÖ/º¿°Øºl=àÓ{Qc µÒ)N8æÖ È]%ü¸]/w|˜”»_¢Ò,ý5é—–’%&AÁÈs<åûëý¡¾vÚAÿ3Ä„ze™Nµ>úÞ$É<ç`ðÙ Ê íUK°CëŒV/4ãyò°Ï· §{Ì;š{Îëδeíßo«‡:ß´ý´;ZOÚÀv¼›…‹Uu]Õø¬Á ˜ :HfÐ*…^|E¾ß¿ êiÔ‰fWçc}u‹ÕM]N…,õ‰HýKEÕæ«
¹HÔÈ ‚[2‹œàŽ«ø|ÜH/~‘Ò†-OgŸ«Í† «’Ø#%xOaÅ=¨ª †t™ÉEŽü¥zµL «GæX`<šøÕa´ò'Hp‡O 9ÀDe·MççœLO)fÚªÀÈÆIˆÃ R BBUrÒÏoåËsã¶vÂ¥þG â ÊÚ#à‰ )g 9´ åžÖ-{Ï:L.Êz½iœ>»éÚ{ãæ°ÚøW¾ €í¬5™a\òô¼±æ håò§r}Ø· ³¹P+,ã <üY +z¬ þ@óRk†4P´5&Ž¶Æ«µA…‡<ÔÃz¥5ÁŒ9\ûÜt0ÿíP +ûªì'òŽFùQjfŒ Ǻۼˆž=‡äRZrŽ°¥6ZÈ(ÏuÑ· âö™¦ÿÉs· Òü‚ n/ª)‡a˜±JÿÕ9.;G×$Qék¹pê<c^QíëŒj,—½šF +È^LjÏ“ÐcMÐ0Ðm‘²²´!븎³xrY÷:Š€>¸öY`æ» ´ÖOD9£{£¡__oú¸ÞŠ +ÿëê-@=´Ó¡ Â%ãš›©‚K%DÄTN¨53¦O!1æJ]ñ%ÊVðía¶â ISÇl%Q3º¨`±¦©sô$ÙX:_ÜÄï¦z&C@ÿ®¥¹ÈxŠ*ï :Ìà…áX(^Š Ä•
ÃD…mîmª¹ YÜÑ• FQ¶ë}µŠÅHe¥TÀ\Ð-#S¨ ëSÐäþá’_"åíñ—ñ §Ê{º.Òÿ\5uhðhuè E©òZ%ŠNŒ¨ÇzŽ“ÕÎúY&Õ+®#Bš÷ ·[Uu¹B{>$ê³»÷H§ÛOD;ØŸâ¡Uq<´ä3šÓc¯? + ÓáÀ€/êe5
€òc5ê(8o©Àç¹n&÷ГIÚ«O{Ø7ö/,7S:-1}ˆO"¡$Ô(Ÿ„žø`È=Sc Œ/TP?Nç¡Pƪ>½ vÆ<KÑïNõÆŒaZX9$ñn8ÆÈq7S0H©Í¥²Pè©4{%í èËÿTíNV $}J +w7™˜>QBèj@Щú¬Wè8]
A‰¨ŒÚL^)sšvù *ŸÃ&ßœDq΀ÎP¤©Æ8ÎÛŒAYøOµÜ5›j=%®XÑI,5Ê-”ßHcÝS€Ú7=7Í:ŸÒP¥ÏxPf’ ò© ·õ}^ÁÛa¯©¦*£ÏÓóUs肃…Å}™wzŠ‰Y‡ª ƒê•F}ŒuÆ¡¬‘CužìäFGÃÚYzž€ k‚‚aÛDË…’@a>SäÝpàc}Fµ1B¨§ +â6 (È +¹Jõ®2,æ B}ØÌTè,ª±‹ å=N Ãf¦|¯Ò5jµS™¥¿âI±Ò ᤥˆ8eŠ HÕy9ÆXórì±FrÌ7§Q{%`Èg÷ï±&FÅ/°“!NŒZ@ ´yh =n©
"D°!œÒ…7H„8׋Á‘SÎÿ¹Â†0äû„ +©ÿ;‡nË`yøð¸Í×Ëö1 Wm =ûD Š?5u€ +"{C×8áei’7t- * ã!Ñ‘ñà +Íl ƒWA’”ç)®ÁüHéúë(åjˆG¹He@hDÛ¼‚áwʾҎ±Î(XÀr7$;oŠQ*å󛤉MG% Δ nê»téâ§÷Ÿ¯ïÞ}¦G +Œì¢>lWÔˆ wx<ºsXN»<@¥„@¾cTVO®wŒ ’Ÿ{µ.zèûÛ¯ôª/¿»fÝlü^ûü a(Ê5z˜T÷-'~!©X”ˆ[ßTJŽP ÙóáÀ†hã¦l›W5õ½± é€BjCÙylÔhÒJwÕó7xJ„ëIŒ¡gnÃ,ñçwqâ€Ýc^:§”Ñ_ ŕȪ ‘.ôÏB‹}Ýl·‡ºZ»Ü°ï±‹•‡M³Êý’ÀúY
Çü Kì+.4Æš×ð ËÕd ÍvY”OÕz²®°‰ç·ï±&ö ×”fH€Óv‘áMåkÿŒ þBbCª¸{! +‘P§£û–f‡õ (sûÆ×1Wõ€ Ï[ú½ûçÍiæT·¹Ko]´
É%L˜–Tkzè« Î}§ž.‘Kü¿¦Æ»:ðú™7*‡¹ó ;tôÀË¡BSIîÜrKM!_ÂaËÛ)Œ•+œ¡Éç26÷|O¬ÜÒS_â)_âiïuò‚žbAúgüw$´}å ¿y ·u¡ƒG,Ž·øv¨öäÂFûÌÛ°Áæ• ùÞ‡
m¯è+ endobj -1669 0 obj << +1684 0 obj << /Type /Page -/Contents 1670 0 R -/Resources 1668 0 R +/Contents 1685 0 R +/Resources 1683 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1655 0 R -/Annots [ 1672 0 R 1673 0 R ] +/Parent 1670 0 R +/Annots [ 1687 0 R 1688 0 R ] >> endobj -1672 0 obj << +1687 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [222.5592 595.4921 286.2499 604.9017] +/Rect [222.5592 527.0395 286.2499 536.4491] /Subtype /Link /A << /S /GoTo /D (statsfile) >> >> endobj -1673 0 obj << +1688 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [80.6033 441.8126 149.9876 453.8723] +/Rect [80.6033 371.7332 149.9876 383.7928] /Subtype /Link /A << /S /GoTo /D (dynamic_update_policies) >> >> endobj -1671 0 obj << -/D [1669 0 R /XYZ 56.6929 794.5015 null] +1686 0 obj << +/D [1684 0 R /XYZ 56.6929 794.5015 null] >> endobj -1668 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R /F48 1238 0 R >> +1683 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R /F48 1253 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1677 0 obj << -/Length 3642 +1692 0 obj << +/Length 3717 /Filter /FlateDecode >> stream -xÚ¥]sܶñ]¿BÓ'jÆGƒA€I§3Kv•Ä²+Ém3I ¨;JÇšG^Ž<ÉJ§ÿ½»Ø žx²ÒÚ3º%°X,ûMFÇþGÇF…BfɱΒP‰H /ÖGâøæÞ EŒ3sH3 ë»ë£×o¥>ÎÂ,Óãë[– …1ÑñõòçàÍ_ç ¯Ï.Of±AžÌT*‚ïÎ/Ni$£Ÿ7 .Þž¿ût9?ÑIp}þႆ/ÏÞž]ž]¼9;™EFE°>f -¼=ÿñŒ w—ó÷ïç—'¿^tvÝŸÅ?o$$ ä·£ŸÇK8ö÷G"”™QÇð Â(ËâãõQ¢d¨)ÝHutuô·ž 7k—NÉOI*ë Ʊ'ÀH -¯ß&‘—m -3„ÄA–÷¯Q„I¬Ý‚
ELnZÚ‡î€û¼*—ygUx| -Ò:' k¨"š%i¬œ‘I`ãh¬œKZ¤Kî-<‘š²¥À$ë -´ -E - 僖׋É4î:f«–hÕE½$!²¾(§| -,Ÿ2K¹vDËxkdš4s›@5ÙLŽe˜aCª·ºDZ=i‡›]Yu³’Ÿ–Åm™ à&wöaÿ[[ÆfÜý@`P\Ç Qž[T–[›JC™˜=:ÙTè„ ÎZ
É+^Ø“¥Ôp|bÓÄ3ƒçxùfa”ªô…%%´òîꬮש‰ûS¡‚üˆ×ÔS·ÔâUŸ†ðYŸ06]³ Cçôt©$ ‹À¶$b´%§ -©^¢(i˜Å‘ K*µ5aÃÛfWcX ¬Ç¦è¤â0ãÖs'q›õ¦$ãEnkí}ÆH½ÁµÅ5ÍÁ‚Ü3™Žå™ÄX¤ïéèeQ=RRã» úí¨¥¡Ð¥‡—ëµM·1š8XAyŽo¢ ç‘œ–£u¿íœuO
*V(üâ¯DN69ú6Eñùc‰â!8AÑ6{µ§gBÑ@€(LœŽ ZŸ±L4%½*ÁKm<·ŽR_¿ùáú웉cÃyTª^pè4q‡æ–¤66b¶.ŠmGe%<ŒÚ ðl5ÛBc766‰4 £¸O`_ž|ƒ Õ¦±mrÜÅæz -£+ UÚ/Ò³0Rº±U ©)L`3!Eq˜ý×ÛC®’&üuIWá<žiÛTÏãºï luꛜãdºúò_ð²7Ž:hEz˜ø*¿g¼ª¨ïºU;þúAÆìLá -«Ý¸c¼O¡è{ÛDõ¿ñ¥ã“ù/¶FŸ¿ í•Ôl·&;ß÷™ôúµ%ïjÀû¾YÒNHäb6?=½<Lh×ö¸íc Ç”¿Ûsñ7ó÷g©+»X©BüÎqÂkŠ¾ÿùN9|kšèPO»_)ÒÐÄঙ)”¤Êö9ï¿»|Êú—\åðendstream +xÚ¥]sä¶íݿ“'yæ–G‰¢D%Î8gßÕIΗھ¶™$ò.íU£•6+}n§ÿ½ +gæ‘fC¬ooŽÞ¾Wéq&²$JŽoƄÇ7‹Ÿƒw9ýñæüêdi$âd¦|{qyF=ý¼ûtùþâÃç«Ó“4n.>]R÷Õùûó«óËwç'³ÐèæGLáÀ„÷?œôáêôãÇÓ«“_o¾;:¿éö2Üo(nä÷£Ÿ•Ç ØöwGR¨ÌèãGhHfYt¼:Šµ:VÊ÷”G×GíFÝÔ)ùÅÚ ÅÉñLÅÂ$@cRÊRH
R›¥:‰ŠT'å(œ’²ÇB)oêº-liï󶨫Y]•O»[Sà"MÍñþ ÖÑ€ÐÀ¾uŽù¸9Éd°ÝT'3edP»ß0°'aPÝÕ›“Ðs»²UKýõ áí2î: &róÃYCè¿H-ÛzMÝ¥}°%O¯WyQ50 RG^-h†[Dƒ¢€
)‘„ +÷ŠLëÈqü¯º²
©ÌcÑ. Ê+ú×ÈT^RË~™—Û…¥FY4pt% +MdÈ ž]ÃÚ2~ßÚM¤±‘;N,5ì—µ·vA¶¦ß[ ]å ; ¡í Pòªy´DÑ<Ño/Ij³8rûã‰S\oçË1“~ Á¸U£4#!Úf]W“tuÛÁFKÜíÈz,”bjPnvM<9üš~÷N ;×tdsÛ4Euïé,&–àX 0¯«»éVò»¹üÇÙ§§ì&v·]¼ðC±p„P Ø5]ž~dŸR0.-
À¢hæõCnµKÖ”ñOÌWvRi.з¦JÂñ1&Ò #@xŒ5vƒ+;ü¼lêAo3 &ƒù²(„×Ï.ZþmhÄmÉM* ó'&°®ánKžâÔÑ1×Úͪ +à~¾:x^¯œÈ¼#‘¯¨Eò`¸yl³r +Þñ÷t,z™jn=žº£³ä.o0ŽÖ¤wîÏIEOŒLgëÐÇ'¥c œ:rÇuËr)EYoÕ<Ýí ny|¸ q®:»åŒr”É’_AÎz/Íä'4ò/-H2gÐ.Zö¬y‰7sœu¢ÑÛÙùoM×Ýë»oènÚ¢,G>ž ]Q¨´ì«ë;ú½ƒS·4±r~é¡‹–¶š¼9='l5Þk¯[Ë&Ç.{±s-dŽÒu±*Ê|㜠{VŽÁ…‡qƒ=sô¶ä›Âc
Zvµvê +8–…Ÿ‡QUU¼gÇŽ^K¿¤d8n1¶ »¨FãdâˆÙeŽ„âyðÒlŸÖöÀý{zùÓI†Á¤ð.k§'18
¸s¢`BñWn"Àèî6s ŠÉŠ{VÃ_¢(>;Ç¿oxÀ N²(ø[×i\ççküËkºû€±?~¾>ÿü!”%Ó½Y’’¦.¾$È÷T Çîh›ý²Ì·
ª¥“ÂÛ÷ñ0[ +·Û¢lg·ö.‡«˜p’[wŒ°þË_3.{ Ð+Îcƒ¨T3DT–[›N„ŠÍŽílêÒ„ØÍY»ŒkŸµ Š¥ŒÞí[lz’xF ÷ ¯?ÀL„‰Nþе¤eªçG VÛéÔÄùi¡!2â9ÕÔé…#µxÓ ¼×=Ʀ“”£ðN/¡Æ¡\-"B[ò +íõ +FH¬’“ømÚº¯>¶“¿·áÈÙ¹Œ|Ø6Ê ÂT ï궨ÈO…kpɤYwÉ|3@ˆ‚ a¾¢zÓ…ŒòX¬gÀaYçÌ<׿†ûô #nZçmq““Æ® @SQ6Ö’7DdÂdJÕþ9M‚ÜD÷÷jÁµò‘é5iÈ ªIÍ«<—‚+Ð$Á)—SêõÑw/#}a'óÇè=7ER)K_RaãD 2N줗6„²7˜žö W£°2³Ý +¹g™ˆê÷ø[ß±¶ÊL(•Nøt•øçÒæ
wà½ûJÃeí¬Gîý•°_Ö{É,£Ò5\ `É$ž© ÉG:±z.fªSƤ¢ ½õÌ×*¤j2({9JápQHHb<Ëd,˜?í…÷`ã` æ8Š_Žïiø·c}?ˆõýŒÙpŠ öÇ&¼GX¶íºùúíÛÇÇGQ4sQoîß6u¹u©ÿÛEùðv—CˆrE¦€æ˜Ã ¤ÃÚçj$—}jÈÕŸ§bQ‘Æ&íLÁ)[‘*Æï#Ü ê`ˆ*Î8ìélû2ÏUC(Å”¢„Â_©ôk%Yï¤JõLXð®ÞVx-öV +cStRqñ󹄌¸õj]ñ"·õv>c¤ÞàÚ"ˆš_r° ÷L%cyƦç;:zeË'~^Kz—Cïë.•TÓå=üÄÖ¿:¬V.ÜÆÐDÁs|‚‚pž{ržXŒæý¾õÖ=µ7HX!ñ‹^¾<Ò8ô 'Ä„B”!,QÜ(©‹^ÝnÀ™Ðm A&Ú‘I±LT#Y ´¸-1 +}Š{ùéæüë‰mÃ~t¢_±é$ö›ö¤Æݘ
s»i)„ƨ +z³ à רaw¨†Q, »¡ZÝ|é¾tÀÎÇe ˆÜä„¿N 8’3 :ž†Û™?ȧ©üæmÒ +k6á8ü5þm ¡|ŽßIøo øÉ\1ÁHÿ&jäøKˆ^fX/rzÏ‘Tàh£ðåD'œØ´[µ+ +Ù… ¥v'aàƒmé ÊÎw6]ÑßA\Ö• +5xé2Š9ÅE +
Wî³kvHû‹ŽM Cö)1§ð
´‡/ü9¿½R/&b®Ì2o›É2dŸq¨^òh6©„8H›ÖkÑ‚ŠºVXö\|ñãCL‘c¾Xp0â¾iÂÁ–CÍSøG=ýGiÐMŽCì Ê)ድH¤JvL 3F÷½þJ&=;õv4Ä8 +.Zu!%~oTµ¾b ½-S¹eª|9#~E#óºú続û‚sèÃ:üè‰0.éPˆbhÅó €+I1xI{ý'=ÚMÏ3ê´{̲è:*Û úŒTiß~Nè›ìªFÿ÷'¦ý÷·q*”1 •L„‰@Á™)Ü€Îv9×Ê€~Géëÿ6ƒendstream endobj -1676 0 obj << +1691 0 obj << /Type /Page -/Contents 1677 0 R -/Resources 1675 0 R +/Contents 1692 0 R +/Resources 1690 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1655 0 R -/Annots [ 1679 0 R ] +/Parent 1670 0 R +/Annots [ 1694 0 R ] >> endobj -1679 0 obj << +1694 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [116.6985 307.3783 321.9289 317.5401] +/Rect [116.6985 242.3486 321.9289 252.5104] /Subtype/Link/A<</Type/Action/S/URI/URI(https://www.isc.org/solutions/dlv/)>> >> endobj -1678 0 obj << -/D [1676 0 R /XYZ 85.0394 794.5015 null] +1693 0 obj << +/D [1691 0 R /XYZ 85.0394 794.5015 null] >> endobj -1675 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F41 1218 0 R /F21 938 0 R /F48 1238 0 R /F11 1451 0 R >> +1690 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R /F48 1253 0 R /F11 1353 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1682 0 obj << -/Length 3355 +1697 0 obj << +/Length 3596 /Filter /FlateDecode >> stream -xÚ¥ZÝsÛ6÷_á{Š<S!Ä'AûÉIœœ;Ós|s7Óö¦¨ˆŠtEÊŽzÓÿýv± -Þ åL'‰>uÂŒÒ pQ5FÍ›|ó˜op70Gôæ\Z „ƒÓjáÇô×å °h´ C fuÕ¦Y;µ¢bFÅÜÎÒ -Dj’Ù}Nßm“/¨ÔÖôm ò¬Xî|ãÊ«Òµ/ÕËQ—ߌ+#Ç®r•e½ÙÏOç\)¦D 2äœ%Z ÇÝŸu•7`’G³»UÞä¤þtsÆíÌWš¼mÓû2tµô%f ðXäOTzMŸú¡-ꪡJ™?æå ªº¢TW~,} r7gþ@S‹"ñ•zîÓ¦€Mà6#Ø žÄíî*ÍVê`C±ˆûêœP£H˜UÒj¶õ¦…MI2‡¯ ;MË ‰a2†õ¼”E^ÁìçT¤d\GÊ»|ûQhW(g¤±ÈÛ|³.@MÔó´*`S®+¬J<‰bOºÄÊ2ÏZ´5ì¾ßQO»*oV²DZ94ˆEAëdmñ˜{½]/GzZ8éWùâª]û2Ý–W=˜·Û¯²ý£d _Šî¼í.¦d¬ñN*Ì3œDLY8ªß¢bɤŽõK*¶ÌˆØ>Ó±ˆb§cÙ£:,&L_§ùbJÅ ãÊŠ¾Š‘ -–¢¬Ž‡ñOÂ~õäQ'˜ødXÇ!flòl»i -X¦çÇÉw£&è˜3 5d`ÒˆËNîÇlØölXt6ŒIU>…Ç4ûì2\J'A§6< ¹Ç|ŒŒ|LÅdRù”î|™â+¦¹*j¸ù÷»?_^ßPmŸ‚Û·gPŽ[pI_ŠÞ.‘EyiOÍç9± yNŠn Y»u ª*ë
0ÌáhRRAÐ'{…þ½½Z;m¯Ü‚÷µÚ|»Á^i»(
DÂ7¥O¶J«Ï9‘\Ò5dM=þ1JÖ1jè¶
õ]½õktÐÂb柰 ,ôˆÐÄg5\r#;<Ðué¡ -€;%êeûä—ó8ƒ¨@aúœA•Ó Ž{Y¹éË">«X+¿Ã\Ÿs3n•yáœ÷F 9ça99 X€e¸ÅÍó¯Eû<bÅLʼn:ÎC7j‚‰!‚LÐÌ€‹»U@s7;d—ºF ^wPà¾kÿäfiZwMżÚcÉl•g_:ðJ8¨Û|]ov4 ×4E18¯Î‰³)1køè©Ç?øí3dã\R? TοÀ -#YÜ=·ë]S}.SrôÔ{7y=â tî]{'9¾ fU÷žÙ!ŸÄz,î€D Mî½¾£m)Ä$É›×ðcwwv¿“™x¶@YýÒï¬ìÐù›>þªÅDÁ8äkLÊý@z -¼†pìûpˆié[?ú ÙxÁÛv€H¹„6Åâvü\Ö÷“Ox1¬w)ûcúÆõÁýö Ÿˆ¤œ -mQg@ÿ÷ïÒö?ÚS1“Ö @†pµÅ ¥ÈÀ”ËõEÏÑ€ÿÛsÖÿ ƒ×ƒendstream +xÚ¥]sÛ¸ñÝ¿Â}:y&B€ +.pQ¯Öy[ÞFìW_ ìÓÈïó†[Õ]{ÏÓõ‚~µzEƒ4‰ÇcyiÏ«9K›÷Ëٺذ ?\ð+‰Q£ÄŸÏçe[ÖU¾\î€UÊOrüq"ý¡Ø4Í_}±âüúË™W“sù30 × Ëå’F·Íèý¼-æ´°¨74hï¤Ï ^ªé—Vê‡rÎ 9ͯòõº¬î!ºSIáQáT´G’
3U¾BQà0l—˜=ô¬ÞMͺ®æ´"ù<=ÿþúiDÛ¦ƒmv kÊ?ùùÅçóO—Mà=è³ìéóÍóª±é´)6Às†îk¿E#ÑÞB`ý1FéÁجaB8««6ŸµcSaÓL24)½% âï¶Á#àù„¿Íº˜•‹ OÞ3 òFA‡ûK|˜0&e…A$(<ˆï §2MEª2™C~Ua[¾þ² å$.zhŠ¶Í;+Ì[ú%b`ðP4zÍ&·FÅo¢1>Ë6¨êvl§š½E¾7>xg:TïàNò¦lFð2ŸÝÈS;ÌTÖ—çˆ •.Õ Ôl×ëzÓ6lË@šÖñ¨ùrdo…Î +±95±pŠ çõ*Göà¹a ±IÂzýˆî
ç(RãÔ†&Vug†ðt´ÎFE«óæ-Ìúyßcö +ƒ²iMôsÅ·Ùr;/Æ”8˜%öý`V×
S…q a–ãv¼õ‚égY6-AÇ…Ö‘@S ¤ìõ”BÔ¡æ
Ǥ̜£œ2”w‹`N å‚PÏådGh ù†*ž£Ç(|œBáÿÀ›’,qt œàMÌõ> fòFÄ`TÁ2ZM0á~î–w¤ «Ý“›Ä”c'hèw8ïuð™Èdâ¾G tê#Ü‘¥ó–UÁƪµ‰M|7‡µÏ©§‘"K•é tˆkûG½¹WÆö3/DŸ/´oKÞgzþ +§ƒùÃ4x8PæŠ/”!¼âÔ&/—”Žâ÷Œ‰ýl“·ÆåžÎÒâyXã'ïvÄ—k¡\ F_â#JγwC¦Cõ2'œ&‚¥"Ô‚Û4+3?Þ¼aYÜ<zV¨]ôݶK„vvOÇ—]‘ Ö’óQzƒ9#}ä ’?à ‚m>ÃmÌTAURg²ƒL•Ò¿z4Ï ÉÚ‘dY ›b¶Ý4ÓLëj¹KÛÈë¼ ^1‡SÙqx°…vBYÉ]1–à +¢%Îâ.&É®¶á-ÙÍÃB 4ÌÝ3Á{=RÑö
ád¸N³l‹MòzãLfÇXí•~BåBänFN™j‘BÚÆ'¨êq5‚‘ híIŠ
œE¬·6JêvSä¿O!ckŠÙ˜œ$¤åYOLJ&$& Œ‹)PíºçÅ”‰D›˜_tæ¸Ç^LøÈ¡G&A8( C¹ÒFOqG&{T¬÷ÀkŒ0Žù²œcEÏóõvS7’Ê ˆl–o©{Å®ùõò‚¦ E`x^€ãÚÒæ¨ p%Ôá}òÀ4Ks«¾rã<UVaO+{V+Rá\yúkbv YÔ:˜“˜¤¥Ñ¥ÂÒûŸût¸HG6‰v5Ê2aÜÐO”Õ¬^uÉ+ZB— +z;€¤_ƒ +Òëë¯W ›aÚܳgû2u,àüb_mL§6ý€LúÃŒt`y™p +ƒ¦N„K2ʇfð¾M`ãÅLzéèá_ô#“×î-¡8‘Ö½–6Nd8ñZ*~þ÷ÛèJ)½Ö½J) +%5ˆø©Âdªc‰š^¢ãà à·ã[€¬Çü_ˆÐ]£±ª§›"ÊéÐj‘ù®×ˆÊãÌ“Êã…‘‰|YwŒM²¡î +P´f¬u"ñZоÄN%¼r~ÀNDM”ÿ³À+ |î | ¡¦Éœ~ N‘u ìcH=%µ™lv<TSÈše:d3x£n§½ƒÂÞX .艮´*€¢‚r`\$d/Þ¿Ä`ºë7¬O´ áìœ0¯—yE!·¹§Ë‰9‘A¶ôjÔ^¤Ðºkß ~ïûKê(ÃÎz沯ÀaGÖ æ 7ó@™3!µ=èPt¾”Îõœ=Ä&v|ÎÄpŽÃX³áDdè9jë4ÛÛUÙ†k |í¯%MÜqôPòÔ|—W+"#ªö›½¿ü9p‚ÑPº’dWĆÀj½,VÙƒõ„HõD¶+µDA¦Ïg»}¨§³Ý*ÞPN›øÚ + Ý’zgØÚ=Ôn*¾éŠD™î66~«`é–‡;â‹mö<Gîrgßõçå µá3‰cÎBÚt÷j½õÆÂJoŸÃŽíé1äxs¨u¿„P66 Ž#h’¤®·Ë˜ ¤ÂiÝ]2¶X¶qI™À6‡e1˜ÚxÃ|PèÆ*çz:çºNÝP+-^zÆàÿ÷ðbÛe¾§—>ë}ÂNËMVeU®‚êÁCŸyø ÐeÞ9ªBÊ + òßHÀˆ= ¤[¾f¬ÚØã‚b!5p02’íêô-Kcs†¡Ã¢FåiXÓñæ¶B&3GbÿMì°ËÁù´Thìhá–(ͧŽ¶"g‹Óãz!3üx@ÊžÌ ù3¢ªsNö¿ ±ðÓ70#MÙ*ŸNÔ›j>ÛŸc¬¿™† + 猰“+Ux/^.ÊÉ|»ZsœK
ÞÕ»£€VÃ{ž®7† &öÅ𦯻î5ÑÆLU ç»>aYŒo$Ë…Ô·Oð¦ëk[txás(4˜šN¥9µFhØþùJ¸ƒžîÁÃÅ!ÎAL ×ÅQÐÔÖ‚0|Ö£å(du0ÏSp€©ë¾}}ˆ÷*z´”t÷@ÿ÷—‰ûÏ6!µ‚’ó‰Ê]e¿åБ¨ðÑfrœ]ð'ŒÇ¤ÿîG²úendstream endobj -1681 0 obj << +1696 0 obj << /Type /Page -/Contents 1682 0 R -/Resources 1680 0 R +/Contents 1697 0 R +/Resources 1695 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1684 0 R +/Parent 1701 0 R +/Annots [ 1699 0 R 1700 0 R ] >> endobj -1683 0 obj << -/D [1681 0 R /XYZ 56.6929 794.5015 null] +1699 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [406.7896 280.3845 476.0457 292.4442] +/Subtype /Link +/A << /S /GoTo /D (dynamic_update_policies) >> >> endobj -474 0 obj << -/D [1681 0 R /XYZ 56.6929 378.3537 null] +1700 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [303.3452 64.1455 367.0359 73.5749] +/Subtype /Link +/A << /S /GoTo /D (statsfile) >> >> endobj -1370 0 obj << -/D [1681 0 R /XYZ 56.6929 350.6124 null] +1698 0 obj << +/D [1696 0 R /XYZ 56.6929 794.5015 null] >> endobj -1680 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F48 1238 0 R /F41 1218 0 R >> +1695 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F21 950 0 R /F48 1253 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1687 0 obj << -/Length 3312 +1704 0 obj << +/Length 3375 /Filter /FlateDecode >> stream -xÚÍ]sã¶ñÝ¿Âo•gŽ $ðx¹ØWgz¾Æq¦“&y %Êb#‘ŠHÙçþúîb(QÒ5½™Þx<\K`w±ß€¸LàO\ 'ʦ—¹Mc}9]]$—Oðîý…`œÈ#E!Ö·ßܨüÒÆ6“ÙåÃ<˜Ëĉ1âòaöËäÝ_ßþýáúþ*’:™dñU¤³dòííÝw4béñîãÝÍíûŸîß^åéäáöã
ß_ß\ß_ß½»¾Š„Ѿ—<ÑnnÿvMÐûû· >¼½¿úíáû‹ë‡ž—_‘(dä‹_~K.gÀö÷I¬¬Ñ—/ð#‰…µòru‘jëT)?²¼øñâ‡~ÂàûtL~Z™X™PÊ@€"8Í.smãLIåx;¿Š”Ñ“nQðï¦f¨jéYÐcU´]¹Ù!½¹ŠRañÃzoŠ¶Ü<{Ì—j¹ô£õŒ fÛ
f¾ûøp{ó3Á›+a&å Û²eœ®a\?Ïn™eñ\¶¸ ‡HˆØj- S¿&:™•ób»ì -<Æ+|km¼JmàSüì‘ÎeÈ‘°‡4â˜'
áÒpƒÍ¾q±Ç ×nF’ÑÑ{ÃÄ dn››J1ï°ú¿1·¨ÿhÀt`xo8îx§<®Ö±1ÖòŠ'”$•RùPIpÚm[Ž2³ª- —%G /Ö’ÁÁ¡XãýÄOHà&Qâ2 T|Vê§r¡í0õûs_yB‚ {”ú.¹ô[1œ*Ꙋ²D€›Ìå‘ÄRšXæ0O–@þiy³¤M.p€ôVÍÌ%m©>-i•EŠ¡& Á¹Ê°v.-Üðȱ’ààCþ7© üS™A¯Á_PÐ`q¢9‹19k+!ƒ7{ÓP¯ÿ{é0äíÒçWÔ}‹á ‘QFñT£ò ûšÅa.±™9'?“Ä™Q©“Î+Õ{„J*ߥt½„vBãÏÆ…ñe¥õEZg¢=¨Éie&Î¥Q§3‡¡ÀF”ë¤ÀJ¾fõ‚j\˜LŸ˜†Àž+q&8«b§Ì1 äk$CR uN`¯È홨~D`Ÿå¾B¾f‹”PIæÙYÿ¯dl2®8›þób;i˜A_Jn»VÖÿ#A6ÃE 8i@ zj½5%€p}QjÁ aN·ÖR\:UÜ¿iº¾Ë²ËRvÙOXîgíag6˜sâ9"ÍËiw² "¡D‚2Øo8ça‡z[kòÜ„]‹A/Ä£€\Ú -¹Ñɵ{¬‘Å[«4liÈ ®N^™™Ýb3Çñ aS3S¤0Ì‚ÈŒö0 öLò=Œ€A¨Ž’#Y$TøJc÷Þ}3-¶Ó Xƒ[oyЫ3ÜX2“¢ëÊÕº »M†Vä^S–ÇFÙ¡N-Ò.˜Úfë€é`tÚ¸'vpûÐøœU³ú/ /¨ï7Ü -‚Ú¾§ ?\³ØÚI1 s
S—ñXç·qà -_ú–p[ÍJš‚aÁ>±àßð¾Ø5 pp24jHUwÔ`”†<ÂfgœaˆuÜ`z,ªÑµm6]Û¨©£v±ífÍK½O‰„Ð,SiO“ÒcÐ2ˆ`6‡ÄüƒÎt”â–˜‚\´X•ý¹¼(?U]K¯fÛ’ÆXÃÊê™Î9àÝ·ï ®ï?¼!f’^5<Ó¬á0Ì…XNÕ-З9TŒ¢~å°É ØýŽMÕ•íþ¡—À½Fôü±K*TÚ×Í'ödß=g6»,k¤(gÎ\•˜8Mó3N9Ä:¡c Ëuè -àb9‹¦Ëª¬»ƒ¤Bdl1!8I@5BÁ€Y(‚ »Cø .ÏzÏŒðKÁƒÕ•˜Ôà¢X“:×sÆñÕzY®€h×ïÆþ’ !ŒÞiÂÇ ÅÏùT7½ŸÀGXäuÿs‹‡„ÆL ®,¨&é^ -U¼À´| {Ôwß5F €-ÏzVr›µì5ú
ŽoDÙ$Ê¥OÓF6gOÅ 7J¤A…=¢bî8Áω M"'íºœºóÀÉÝKã›ÂëbSt<Lû2j )v_…×ßbÛ-¢úÓ¬YÕ˜E@p`ï ˆŒ“-“8•½Ý:ó±t3ŸJЬÓ)1&,¨zY k‘¥©ö½ä -â[YÌŽ¥„‚;KÕÇ b 7Ê Ëí{ÓvQÛAžÖvÕôÐ(S0#“¥§ è±F(%lE–çC\¤E ]*¬…O…¢ô—äïe¹f·+øXL ÒÜZâ§Ï”üˆÌK"±;‚ÆÃSùœ`w˜PLùˆ<JeœH‘ï™TÝ‚½ý/–.Ã
Ô9ÀñÝIœcAwz·¬»í±R´•þ£ê5´£Ç¢=Ì‘ÁÔm–ž&Ã# ’™aèdÈzŸZ¥» `S»*f$£5±ÎÛÇ°HI1¹íè{çÇà<§ä©½Ô¡Ì¢5è®B -QöwUQèN1å…ØЂ ݦ¨[PðÛ=©Ë†Ï]…–H‘ÚÓGI*@U]
é# -Ïw&?â\òƒe–µÉ?b ·¼ ËY^UW«bm¸â8ô´9PAù4 =Ö
Ã@œÅóÁ·óáYÈ9MöaÝa]çþâ‡Ö¾Nè tlã:ÔX-¡°¿Õ—õ×´ð ¾…cPÕpX9 )b0]±å}›BØßð’*w‹’rœR}ªÇ”ŽJúÂQ _8¶4Î *-ü$D
û»Õ®"Tt3¥ŒŸœ¡§Y–O® âT_i0+üíª]%‡²¢{c'‹ÒUñÚ‡¾áµ«Š/²õ´ Þ—ÚÝÞ¢M`?s¶\(Ž{P‰N¿@Í! ^ôç 'Ì.À:av Ë™ °PA$Ž¦®‚<Œt"VVêÓôX# ˜Í²XåÊ Ià ³A?`Š6ó± -†*~Å® C(Nצx Òƒ³_‡Åù‹Õ=¾ï¤è^ „ùîîí‡k2¨’R‰ÕT¨c‡'Q'åä¹j¨«GÃN£¤¿ËÔt”x[ ì¬à9œ
ô) ¼¯ÃÔ/Å`¡bùR¼¶~ŽMEe¾)ëyÃ=¥voÕ KÉ>/f²í3ÇǦ[ Ó1a(¸eÚ7mf¯ ÙjÊÑj—ÏÚøØÍ[¥c¼.;¢EÉåٮϽ•»»² %¢2æȽ•@ 6÷D¡82qpÖâ¯ï ’þ íÿµendstream +xÚÍZYsã6~÷¯Ð[äª!qÔ>9‰ujdzqœÚM%y $Úâ%:"eGûë·‰’<Ù©Ú)= 5€F£¯A² … ›˜”PaåD[IRÊÒÉ|uA'Oðßw,ð$‘)és}ýpñ—¡'–XÅÕäá±7—!Ô6yXü2ýæoWÿx¸¾¿LxJ§Š\&©¢Ó¯oï¾õ=Ö7ß|¸»¹ýî§û«K-§· î|÷ýõÍõýõÝ7×— 3)ƒñ<ÌpdÀÍí߯=õÝýÕû÷W÷—¿=|qýÐ_Fnä÷‹_~£“lûû J„5éä (aÖòÉêB¦‚¤RˆØS^üxñC;aï_7tL©0$5\(óžZª‰N-Q‚ §À›js™)§³lþñ5Û\23]øžyµzΚbV”E³ó]¯E³ôTžmÊ"c_òM]TëÚ?U¾õÇ€”}2Óf™£Æ@.Ö“‹[NˆO@ÿ©ÖyR7°pÝó:ð÷÷¡4I¿zn`é qˆ¬¬+ 9e)á ˜0Flšr7(›ÏóçÆÏ-Monzæ© sïò±õ9%’ ×ߌLk•F–u52Kdz¼ófõº,æKO.³—ÜS¨5GÔÙ*Pù#žÓc>oüsV !41”Ù°Äã¶,Çv£ˆ¤,ðdëÅØD–ˆTG…7pØùØD–£ípCΞòú$-^òrwÉ›’#HãÄr0ÏDÂXðotI¦¥<»ªÊ çþàN¾>ðAJh +ÕÖD).ÇcN`Jú\ÞeØHÌi¹œ’ʲzMÖùk‚¶z°>S œÐÈÓ´\# ̬]«‡"Ü>Ž X:â¤í2M¬à¦;$aúMª¦~C@¦Á—€˜å¾Í‹|ÈÆ·›K3Ý®›b•ûá/Å%›f#§Ë,è[¶²mÖ‹y;)®9æåpôVö¼Ìñ/ò2o¢/ÅØZ0 ÅúK¹H ©Sj `Â#ˆ”X-£=CbŒN ¢/.òÇl[÷+ÆÜO¹åÒ·Ç +4sªñx]›•¯Ù.ÐuÞøÅ\}ûáýÕíŠqâS^ó—<ð¾u‘ '©óÍ‹K¦~5g¯L2µÑÑ^Y°#´9c!…5[ˆD»ð'Ym@`ð?Œ´`®’ë`®ðg®ÆŒ›+3œh“ª·Ûë_£¶Q?¸Hl3ßÌ—Ùú)÷K>:…T+ÿO +¨*9ÎíжÆì$R¦yl×e^Óù*YõqõÜä⫆øÐ5PKÏæ;Ë«V«ÖRËb=¯W†Ì³: ÆÁÑíA" BRþ iû¨ÝK(ð… +‡4@j]Ž£˜ÄK‡à¯^èB°×®ëÙ=Êù§`°ÿj=‡56¿ÃL 7Æ!‚o +«ï¨«Èëª5 ŠÐ:ƒ@b™=?çë0'ú>®–
÷â©péÜŸOq™ÍKV¾ó•[©<B³ýÚÃoÝ~™g›fæ™Ä™Æ‚¯ &•ªw+á–XVÏ9^cìüãb» iŸÇІbût Ðe ÖbN1øPoŸŸC>¯óˆ¹Ái¹Ö{·Euï]ðjkH¬`VGq°²wŽ¿oŸ^Jr%ˆÖæ<4gýØ:I¸N¡–¾Bèõ@, -щ’&&.TîWÅœiÓ½Ë7nMÀÒJ§bèšå¾ÝËÓÆ'šÀFDI
‘]éüRä¯c÷M)aÔ¤û7Wû›2¢EçG +}^ÑhŸˆ
òø›+ÛmeIÄI7Òø¶zñ± Š‡4%Þi÷íhS,°ãSYÍZè‹Zj©ßp B™áy„ÓgÏJðáéc¥%L +í™eDèv®«Õ0â%P(u6VˆTÇ*ƒXrt>i O¥Þ‹¶VÁ+®$¶èo\ÅD8 œ& ÅûÅÚs… WÃB[7ÛY7 +S®JƒæŒˆ´w@7a/Ãí
ðÝOÛ2 £~å\v’! rü•o‘#ð‚‰û ’±s k.ƒ%+=÷Þ.öÁƒOç@Tk—É +² +KzÄÝ„ÄÍ-ø{“»%í Á¦{Ž÷®»8;TnšclD¥'ŒDB±-ôÐHpÚoëeEw†õ!p?ÐŒ»³¨õಂqØ
hÍSE(‡C}û~¡2¼Ùé¿ëÿs£¢ ½à{T?ŽÂ\ŒG1œ*i7@¤2Ǿ$àX&Á<\j¢¢ ÇJÞU@ÕÂ6™žÖ´ LxCJÐ’Žp1-ôWÒú百¿ƒÿM+¨ÉtÌNE€gøÖvô«S´H‰²Öž¼4d,:À Æw,€ŸñŽ)1j_˜!ÁÂ(L5®Àžd_²9pâàr(¡¥Ô'.Ûð}RêZuZÛ ¾ìï´Õãójëóú5}гÖóhcÕiè0Ô׈qÔW'Èl\ 0 Ä8sF_01BÊ3 endobj -1686 0 obj << +1703 0 obj << /Type /Page -/Contents 1687 0 R -/Resources 1685 0 R +/Contents 1704 0 R +/Resources 1702 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1684 0 R +/Parent 1701 0 R >> endobj -1688 0 obj << -/D [1686 0 R /XYZ 85.0394 794.5015 null] +1705 0 obj << +/D [1703 0 R /XYZ 85.0394 794.5015 null] >> endobj -1689 0 obj << -/D [1686 0 R /XYZ 85.0394 625.316 null] +474 0 obj << +/D [1703 0 R /XYZ 85.0394 729.6823 null] >> endobj -1690 0 obj << -/D [1686 0 R /XYZ 85.0394 613.3608 null] +1388 0 obj << +/D [1703 0 R /XYZ 85.0394 704.98 null] >> endobj -1685 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F21 938 0 R /F48 1238 0 R /F39 1161 0 R >> +1706 0 obj << +/D [1703 0 R /XYZ 85.0394 268.3773 null] +>> endobj +1707 0 obj << +/D [1703 0 R /XYZ 85.0394 256.4221 null] +>> endobj +1702 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F21 950 0 R /F48 1253 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1693 0 obj << -/Length 3723 +1710 0 obj << +/Length 3924 /Filter /FlateDecode >> stream -xÚ]sÛ¸ñÝ¿Bo'Ïœxø8}Ê%Nê›Æimw¦»{`$ÚæD‘²ÏýõÝÅ)RtÒëd&ÁÅîb±ßùŒÁ?>Ó&3¹Èg6W™f\Ï–glvß>œñ -²þ^x'Ø”u¸}ô¤÷û] µ”ÞàgÌ¢F-}"·‡s/õžÏ5pINß -”6ª‘íI¦»äý) - ê ×z¦p£ýÞºÐÞ,°E³8é´³åŠO»§.Ôiÿ” pS»r¹ß5èf(çl™°Ó”#Ðåžsb*Nõ)ŸÈµczÒ9Ë¥pŒ «|¹ðjsªñýë¾ôq†”^ÀDÓ6²~À© Ø< Q.R2KžIeR ‘‹ -B‹¥Î¤ÂxU{U‡ÏÁñÂ5¡.V/ôå˦~>â*°
—sJ›)ÈQ¸ÀmHà½èNßArSô - ]4¨ƒ×ÞrÙv£¢;§¹¯{ˆ å®òždfþÐ-€ô >¢ïG,K8#š¥X§AsDP bై$Ö`6^YáÞ–ÜB¸möÂm-Ĉ”µ`HY‚®Ç -\¯÷Ô'ò1”'öPž vè²âçChhÆRJo¥–Aâ(UŒ6dZø$ŸÄzñãÇäòŽ¡05~¬Û“°h†÷÷ä¨ØÇëmØ,°iQ -GÔ󶃞·_Z¬ëÈtð#Ä6ô©¬¿6¶ËQ«l>róáË¢ò>˜¹]>MŒ!í;të ´"50þåƒM繞I©AîšËÝ øp¼ªtãw{à˜,Ï 3ú4.ZÇ -\@Íɨ%D4‚ésé@MœK„Š× ì±WPŸ,›ÁÙ@p†ÛiÔ}cÓ™C[ërp¢+cÀ2¿·+[†¹îtPtê (HµÖk*$îÚWP0*Ç Mz†¦Š¦û;©ó~³¦R ÑÄkš¥ïû9L ½“@\¡â#X4TGyO¬ ˆ9Ôq¸b 柋ÆGs#çŸ_hÊS½{9qý¦8?+:WAÝ3öFØ“¤+¤*ðu*ã̬äúÕë&ž§NCºËÁÂlÉ(.áag)#Éñ@ i°Ò~g NÙ' ¤Ÿ>ájÞWáVþ.Žƒ",ñBÉ_ÄÁìÉkO« V¥ëÝfµ<à ÓaðÆðî].K—o°.$]ÀÀ -› [zy$ +xÚ]sÛ¸ñÝ¿BoGÏD<|ü˜>årNê›Æimw:íÝ=Ð%qB“ŠHEq}w± ˆ¤(ù2×ñx´Ø°ß€œ ø“3‡q¦²Y’E¡ÒÌÏWb¶†¾W’qæiÞÇúéñêÇ÷:™ea«xö¸êÍ•†"Måìqùk‡*¼†DðîÓÝûÛÿ¼{DÁãí§»ë¹2"xû·‚>Ü¿ýøñíýõ\¦Fïþúöï7÷Ôó ?ÝÞýL-ýœ™ôþæýÍýÍÝ»›ëß ¹ºyôké¯W + ùrõëïb¶„eÿr%B¥fv€Ê,S³ç«ÈèÐDZ»–êêáê ~Â^¯ :µ‘IC£¢x6×Q˜ýé]–a"% %& c´ße%§vÙaá.¯Šn±™¯«}1^°*Œ¬´?ë m5A\õˆK‘„± +ò%Æ œÇB/EKƒì¥q¨
ž… ³È÷m±$ݦ ®Úb÷µØqcC¿y×ÏÛŽ\£¥ˆ4fØ ¦ä_Ê03FÙÙ‰•¥ÁîZ¦AÑ6{ ,‹Æþ.[j,;ú]–Ëú†7ùW rØ5A‹¦n»Ýuì]Y¯©‘Ö +3"zÐã+F1Õð,öžüY_« +:Ãr´ ª‚Ù´ÐÁb“×À 2,ÑsÍÆ„*Ž¢™÷yµIPçn=#à¾oS þ¼?`¨œÌ‹|=¸’&òþ}Ì
äÝT€ïO~" ë NgãØ;ŠSòÈFïÀDÏ;b ˜ ¨»»ïÂÓi飂 ÎI +!
…ÀM"è© _[~ôZÌqvLë–ùU‰çÅú“ ÷fB£µÛ ¬=Ùd+ÀZy +‡M¹Ø¸À:‹…ð¶ !XßíÀÆ´—¸T݆ž£*°«’ÎUšß®8 ½ðxÑj«˜*&0øÐì«%œx¥©Ý:;s±@›nËgðiãJèîö»š‡P¥™»)ÐÅfèrɽ%ô÷Ð×V¡¶~r+5Äô`µ‹]ÞnΆ\*N¯ËúXçC.uÃy×ÌÛ&?-ŒFa* \¸HÞcMÐ ê[&©I† Lj/ôG™¼ { зØÅgx¯¥DJ÷Z,6Åâ3‚ÇÏØéoÖZj°ñ±H6¬‡ßûû¶èht¾ÆêS7B´>ëC IhEþomÀ?«Qi>§Þ…€sDA %Çü´ï,0ú·‚yLó +Š +ó}•D›,ØãËÕ5$àûËž.o2å+lEÛµ„ÅÁ?mÀŸWÔ„ÏCÔ±ÌC¸Ìˆ”üó–LrÅD‘ÄNÂ’ÇIÍî3Íøâiºd2(ÿ Š÷d)yÝ ,"rv2â¥I)QéUf#ZÛ1XM`uºŽþVD¼i.C¿R,6ÒKèfÃ*š:_¾PÏgzÊÒçŠYeC#u@ÑóX™x •{@Ã!|çýæ„8ù +‚µ(ú3wwl´ ±8<¡ÚÂOñ§Ÿ” ßÛG ¤é™Xr endobj -1692 0 obj << +1709 0 obj << /Type /Page -/Contents 1693 0 R -/Resources 1691 0 R +/Contents 1710 0 R +/Resources 1708 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1684 0 R -/Annots [ 1695 0 R 1696 0 R 1697 0 R 1698 0 R 1699 0 R 1700 0 R ] +/Parent 1701 0 R +/Annots [ 1712 0 R ] >> endobj -1695 0 obj << +1712 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [154.2681 743.8714 203.5396 755.9311] +/Rect [154.2681 390.6622 203.5396 402.7219] /Subtype /Link /A << /S /GoTo /D (notify) >> >> endobj -1696 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [180.4479 170.0583 244.1386 179.4877] -/Subtype /Link -/A << /S /GoTo /D (statsfile) >> +1711 0 obj << +/D [1709 0 R /XYZ 56.6929 794.5015 null] >> endobj -1697 0 obj << +1708 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F48 1253 0 R /F39 1173 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1715 0 obj << +/Length 3535 +/Filter /FlateDecode +>> +stream +xÚ]sÛ6òÝ¿BòLÄ +7òçÙoijlûç³8R¹IgÏðG"Ïåls–¤*J¥<¤:»=ûw ØuS§ä—¤&Je¢g‹ägÔ´ã(NAh‹LH…9YŠ)!{,òn½”*6‹îekÅñ–E’FJËlÖ'<Z>`M¬/{ë‹6š k»®¬ Î*ÎæÝcÙr¯A^ÞJL€N¢LÇ)¬Š3_lK8ƒEd å6I8ÏeUÁe±o_Åuô¼µ»'» º¶µõŠz×·ÔîÎ…™ÛeãÚUKS‹ªñL?—Ýã€p6¿ýzAhùÈ.ˆKêH$Y=åi* §kÀqÖWÛ‡¢+Ÿ,}uûlw-˜®ñüî‘Á+».öUG e;!+‘æQ&rÁ‚¨› Yùõ %i?T0=
oò\ÿˆÅ+ã ØL[| &"" ëôuZ4/ZÜõ3†¤ž»…–*’¹}£ ’ÅM¦‘–I6Óé\¹Í^÷Ä‘êD8Ì8J•ô¦óõ|¡Åüþ—óË‘h€¨’©™i•Á¤ÔùåìÏ™ˆâ$‡% V¯ïv{‚¼¿ÚÈÙÇö4ëoËS^ôI»}é¡3ÁM $2ÐŽÛVƒ6‘™ù˹Œç–?ÊͶ²[wvÅ€šZ¦ÐËGÚOò,ÒJ«Y_¾MeÊ +Ñ“/ÀƒãG‹÷q{êr[dP ¨Xœ¾ÝF•†ƒ5&(Rå+aJ"nmw‘ bŒ¯tR2{÷–®Þ vë£-O;\÷¸ñ=§#f…wýƒlÔ3ˆW¹Ó y,È¥ÜÔ˜$ öaA /k—p‚›'þ¶÷ôîh¤o®J¥Ýœå VuÀ8hÅmõBpz À{;e.—UŽÃ<§ò#7PPúËÃNØ» 8˜ˆ+:``è,nEÑòhÍÄûó
3 `0 w%iJ¹ `m³áѶìö MsÑ0ÏùUà8·îk(çË Þ'½Ã|¨æí Ý
¢U È“âöÀˆ´Dõ-íŽq*®|ì ñ ?|t°M¦ê4A4 7ÆL4L¢d¢|Køa.&ÔV.HH}ª6ò_vÏc`.N‰Ú `›fU¢~-ß¿Â c"*¹ó# U~ÁqîªÍºGçUÛ uBÝT<5%WFÚ«P£ER p‚†o|ë™Ø +ëÎÈ¡qá FØ^ÖnÝE!÷[jC¥k0 aĆ$;j‰)@Ø6m[ºkEÛï[[·<äT5bC†8=U³5}÷j›Ê?`=S1‡½f_qwÎñ\¶6¸ Ý%“à%Å*Ü +ADзºy®fŸ\Ì(äŠý +á"ê “ q>j÷Ê2ÌᑾQ9 +@®Š‘Z ª©U¨Wup&#e¤:ù¾œà톯çgŒ–à`Ô•&Â9:+w’¸–`!À!‡µËáÚ¯’ŸÒa`,`€Ã¨V|å%¿Ž´œ—CÁRvƒçøá{Ødµè+n¥z!| *B…lt¶v¦‚_ŽoììÛ0Ží°Ü†Àd´y :¼ç¨”ò(Bi¢– a–š?•ö¹Wåö6ÑÁ©|ÛáeJa]j*] àÑnÂÐØ(DœD^sŸ² +<rŠÃ/4Ðà™º{Ü ·vY®_Ø^'Vn.—û]K% ™\45QŠ :. óÏBpIR;À‚•õp8[9°#^vT ܧzš‡ÁÛés±«©Z€
„¿âÁNÓí)i$&2Bû3Áôyj]ùÚo@²Hháãc±„z²¢êXö]6ñn Y"¹ºî Vë©öäÈ1vL0dòM:Vè4Êo¹Èa•FÑ5ßö[ô¡ +5´„’½`jV DL:Õ +¢?åTSnHÕ [š+”lÿ6$¡q1í5,üjpê݌ᦤÝÛ‡[—i(õÔt›(’“‚O +]ïɺ •ˆœûHß +endobj +1714 0 obj << +/Type /Page +/Contents 1715 0 R +/Resources 1713 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 1701 0 R +/Annots [ 1717 0 R 1718 0 R 1719 0 R 1720 0 R ] +>> endobj +1717 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [265.4578 124.1537 326.6578 136.2134] +/Rect [293.8042 549.7735 355.0043 561.8331] /Subtype /Link /A << /S /GoTo /D (server_statement_definition_and_usage) >> >> endobj -1698 0 obj << +1718 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [367.5441 124.1537 416.2908 136.2134] +/Rect [395.8905 549.7735 444.6373 561.8331] /Subtype /Link /A << /S /GoTo /D (incremental_zone_transfers) >> >> endobj -1699 0 obj << +1719 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [280.9692 92.8345 342.1692 104.8941] +/Rect [309.3157 518.1046 370.5157 530.1642] /Subtype /Link /A << /S /GoTo /D (server_statement_definition_and_usage) >> >> endobj -1700 0 obj << +1720 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [277.6219 61.5153 338.8219 73.5749] +/Rect [305.9683 486.4356 367.1684 498.4953] /Subtype /Link /A << /S /GoTo /D (server_statement_definition_and_usage) >> >> endobj -1694 0 obj << -/D [1692 0 R /XYZ 56.6929 794.5015 null] +1716 0 obj << +/D [1714 0 R /XYZ 85.0394 794.5015 null] >> endobj -1691 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F48 1238 0 R /F62 1361 0 R /F39 1161 0 R >> -/XObject << /Im2 1350 0 R >> +1713 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F48 1253 0 R /F62 1379 0 R /F39 1173 0 R /F14 976 0 R /F41 1233 0 R >> +/XObject << /Im2 1368 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1704 0 obj << -/Length 3924 +1724 0 obj << +/Length 3757 /Filter /FlateDecode >> stream -xÚZKsã6¾ûWø¨©1ÀçÑ™ñ$ÞÚ8Ù±S›ª$Z‚,–)R!)+Þ_¿ýHJ”7[»ö`î¯ ºá_]gqš<ºNó(ˆC_¯vWáõ3ô}w¥dÌÒ
ZŽG}ûxõÍ“^çAžèäúq3š+ Â,S×ë_Ÿ¾¿ùéñö뇥ŽÃE|XÆI¸øöîþ3Sr~|úñþËÝw?½ùF‹Ç» ï™üõöËí×ÛûO· –*‹|¯e† |¹ûû-·¾ûzóÃ7_?üþø·«ÛG¿—ñ~Uhp#\ýú{x½†mÿí* LžÅ×Gx •çúzwÅ&ˆ#c ¥ºz¸ú‡ŸpÔKŸÎÉ/Š³ ÖQr½„ÁYéy)‡AƒÔ–i‰N—²VsRv£PÊ}k‹~¹j?¨l±,ºe·/Vötï*Nƒ,‹“ëñgløQ3|è *ÑA–$ù”‘ÇmÙÁDjÑìû²©¹},„xèì[ᢔ.Qheüè~îŠ+”åo:Û¾ÚVˆ´WØ5¿®Š¶-‹gù‚ûúC+‹üÆáoZG(‘o¾¨h´
££À„a›Gþk 2‘xä™rZ0 jld -'MdŸiºèŠeÒ±xã º -~åó¥fÓrO_<1—„iÑ4>-3,TèÛ«²*û¢—«¦X—õ3ÏÐl˜ø¯¦–îßÂPWV–¦ÃDVøñóýÝ/Âî[×Û m1t{cãï·|>°ËgÂo϶¶-0AºóÌ@.äyÿÈOÚ<?ÿøÀ]±Ú–µ 0a¶¸“áN…’Eþ‘ŸOM¿å–p Kç¯Ò@gyöŸÎßœ Ÿ?œj–êÑù»í¬Ý~¾‘-Ä—ØHãÀ¤*ÿ«\´s;A-Œþ¿û µ´ ’¦žèmmœEÇp[øãÅ— -ôÖu¬Vv'ýQ^I&Ð`e‡†Ç h—òQù\7<á:8CpÉ$…
‡*y KÇ£.c© …+ÖëY*ªå¦mvËâÐo ÷']+ÐÇ3˜ÕY„:ÔïsèGÍ°8>ë ÄÞ [Ûü€w‘_Ç/«¦f`l*$3ö<ÙmñZ¢EÑG~¢ÅÑöØ´ å«åSW, £ [´ƒàH‡‹ãÖÖØR0MN@‚ à5ƒG•«-7+ xArϺè q”2úñìábÓTUsô³º¿ùáÖ»žÂ«æg '`XÖ]àGå ̘ý“æ7J Z`‹ÄÏ^Ä«ÔH¼@÷ZŽ/íetöec÷˜†6¡kzqœœV¨ÎêÑKñyÁ¤k»)UÏž„ÖFË¡3†B~cJ)ì=Yî äÊgÖ‹ô Ä'©\:=qI#] -Q8þŒ yíæ4ýP¯mW¶ÅSe?¢S4‹î€Ö¨Á!@ -£Š$YÜT]ƒÚ ÁSñÚ” %îÔHÆ4¼ošv>ø!gzªÜ™rJ=¢¯@ëö–ØâaÏO îfC0‰bà”=?™)°oº®5`²ýsoëNºè¨ÎØÐ ¦gŽÁY. T×T¯boGŽè°Õ *ñåd Dz³Þôè¹g x-ù¬b úÇÎÿÔìÅØçðú *$`°·b·'}×!ØÅ©¢"v -*b³è^:nmš˜0µæç¿ðS4»q -smÜRÛ¦ëÛÇaƒ6&H³<ÜÞ4M L«f7ƒóY $‰q1¦pNŠ‹«4pÝs^÷ƒ'°4AÚŸ@›,£‹É n: Ã… -ù¹+Êʳ^Û~†ue¤üI6Š -‰½€mWTI;t› #é˜0Ý•ÑÜȼ¿pqìïðM¬êTôÜjê¼ê„Nœi iúI°:·7˜+ ŽElQE¬Àð<Q` ¦Âóh« -Å -RcÞW -Ì:=¾ KÔw™½ -~=ɃFµ‘Â×Jºƒ½œØ’›a¿Ss9QEJ¢r?õR˜BÃ{µ´!Àá¡8>>n ò•Ìi\ýW'ë9‡öd!o÷¾OxÚÛ?¹EûÆë·w³ =B7‚¢É»GѾy$ÇD!Gæ'F-‡ý±ð!yÓÛ¶EÅE;£¹üŒ½¬,nXÓȲ>“ÁR˜ñØiï†g¤ìnF‘$¥4àÊ(vàæ^|JÝó;Íâ¼&6\ÞM<Tý(]<”õÊžŒt§E£5Ë#Á c, ŒeÁˆ9¬tŽ*‰ñ`yrD>ýKbá 2l3L‡&&Rg!¡ ¼[$}xŽ"/&L9Ž¦ ‰pã SÒA–Cû]P5—@ué¿ŸìwK¡`œÁ&ÈÜ -—|tû†J&yWî²x øZIumðõöËÏ·Ÿ¦Ë ~¸uiY&vçâç°¬~›¤jp;™Ž -›ÙY¡—ýYýWvÿ8 hK‘VÓž žO3C©GXZN^¬ë ƒ}h¼[ º\ö£8±èWÛå®Øïíz‰
pÁ™ò¤Ò†A’Eùû|øQ3ŒL³‘²Dk&œÜmfŠ‹%ÄþÊj¾´¡@nô8åä@‡\CÆ^žw?½F²O$äHHdÈ8‘C‚Kr›èigÃGƒª’óhÐ>! rW6&@;§ä¡s(EÉ ³.”¬Æ\¸_Rp|̇òÎT†‹‡L.(c*Z²Þ+Ö×Üå±i_x8k;gæØSðãŶµœÝ–<ZÊŒ±/óÑÒ+E/üçr‡&L8 ˆåÎVhxÃÈŸ~r]×\?¡ "W#„ü æ$ˆÜD Ns#ÙF.Ž8ùB.n˜ÚL<ˆ5ÁV׬^0éùUj©†r>R«9ÜΈênQ»à-ÌxÓknO´Ê„^õ°µJ>Áˆî¹æòÅø!ß æNN!c+>7EYqŸ£ÐœÂÆ÷ÍѾº»Óg’§Ab£^Ï:
7nZ† pÑ+j^ß]h7BaW/ëA¥(ÌQJa˜kTˆÙ¨ -ð¡óò5:ÿBD‰IÞgÄšádúD@ï„ -Ç&ø*uthÉ…3´rþÆÍAÓ¾äëü€½µÑ.f:AqæA”'Ç—K[ãjËM‰‚r¿0:ÈóØL 8WÐJ‚Ìø»l¿;¼ð“§”ë# -‰Oîmäæš®w;¹Èˆß¸G ÝõL⛃hTò ¹~nmµ?YÀ¦ Ø_ŽD¼sW‡ -3ÜI<ÂóóýYU%x é=Ô»/èÀœ– vðÂ7—8d²2Nfä½NÖ¿#óµ}0‡‚w±\ßÅ..Žµ¯˜îv® DǶ‹'Š•(U£/-†IEëa"Q ÃöÊU¢_ì\ŠÀN’w =r<d´Ä9Fj,b(ÿ;‚ˆšq h¥O~h0†2¾Š]µ`|Û0Š¾ýeÃLµÉdAš¥ÎD°t6gGX’J]©³ÃßËìDKeee¼*k)C™D(ÏUóÄ•Óµ£Â_éúë‚Iã WQ>1ë`øI‘1I>‰qfcÆ /Ô3¢Âp2 F&ƒ
6n“î¾2Fq| +xÚ¥ZÍ—Û6¿Ï_1·õ¼W³"©Ïc’NÚéÛ¦ÙdòöÐö KôXYr-iÜé_¿ +¼ÕÛ‡ßSëǯ~ùåÕ‡»µŒ¹zóÓ«÷÷ h(ä9^?¼ûzz\˜ôÃýÛû÷ïÞÜßýñøóÍýc/ËX^éiäÏ›ßþðnsûçOè$nOðâ ™$êvãZ¾Ö®§¼ùxóŸ~ÂѨýtQÒJ‡jAJK$Ip‰µÒV»´A™âÕƘ +[ɪ9˜¬øÝó”ÉA/Z«‡ªiMšã¡\-}q*Ê’¾8ÞÉxešC]å4ÔÖ<U—í¨çÏÎ Ó¸/Û €&?}¼ÿAPÿã®høÃ]Ý•<YU·Ô™¥]cPå ÷ZJ‘²B¤Õ mÌÁrRoJ³o¨§)ªÌP³;œR;žó±½5ÇcZrð¼°#ü³+¨‘Sï¶>R£Ý™1]S—][ÔÕ„¥Ì483)")ÃÛHF"R¾¼°½D´ SÑîÊ%÷pT¨˜}Úf»õ>= L¾Nóü\À&ÌØ‘Zƒu]壧Z`dlf2Š„–I<åäa‹«~ÿÖÇ)âÀ `z¤x!ÆÎf‰VÓ ª +<MûS;4UëŒ "eóq3ŒM%«#¯)ª'êF9Ø>Doó Œ$ŠíZƒ¯Ôgm [Ê°b
/ï22ؤ÷ÊS}üLädîuW1EJÏæX™Ò9nAÔ8';g½7né;¹2Ç´e`ìBÅž™p*`×m–|—$Ö¡^=¾y
º©*“¡P
l¸N$Ç Cùøïº2ÔÓ Óª'v´(%Rlx<Í2shQØ‹Š²½½“`«©3æ³iéµk¬LØd»Z +<Ã&ئµ ¼1Ú‹IèœÚ³Ò^o{8†fÅŸä¦)ž*÷‘0HÌJò(²Ú¡´(iÌõØ ™‡Ÿê“y6G<µ¾c§Ç +D"ô5;U•îIº™ë ‹LŽ\Õ'Ž¬uù<ØzÑœE`ê +®GÓ1ÕåhÚS¡èx&–
J¸Náo]Wkؘy8Õp”C´¼ÎHOµÀÉ$ +éúÔ ^rS‹¹ðe)ጬŸ…dÁଔ;Ö`ÐéŽB"N8”Å2„tÆLœy˜Ù%vU>Kêøı®ÝÕÇ\¤x6 3,âï ö•ófnŽ&ý¼Î+ˆÜÙ’G +3âi4?©YßØ:Ó7vöúÆ—^ßZª@?ž‚Î{K@lØvÁ3ÐYI¾ŸÄ«WÜÛtOO¦ið®±j æñÌ ^¡ä½8Ò–|à`tŸ~6Í„PÎ Ø~j7† [ +ÿ<ÕÆPÊ?]«·]èd¸ÙÖY]ru‚W 4~“ƒv²vÉx¬æð(¼še…«½ÉviU4Ö€í+ê7”ÇA:Rw
YT¸rla
| ©·1G‘ç#£
œ=ÚóßP‹
Ï ÿÒºhÁ3s4ƒD ñµ‚Í\•g뎔ÚÀ®2KÔf¬MíZ ç&R=ÒÀN%•?ÊwÉ ´†Ú¼X½á|ìtÀ´ó;èe~˜ç|lš"L6Ń£0§Ñ®H5 ²¹© +w¾:M{KšöØ‘ìAÌÙIáPw~Œ““‹¨·+¥ˆŽx×>Ù-vSœËéÅæv08‹P–ŽéO¨ËU9í¬à>ûF΅Ī'$‹¯è›þD„6Ir1[·0—¶Z„¤%†8 ùgN½#£#äì|ç¾vŸà‰þÀP›·)Yrû…ó7Ë7zÓ&„é‚á4Êv&û<«ô-ËâF¤"‰ìÏM =ç^ŽÏMx8¡%ƒr.mQÏ€ó¡»`²§²3‹³cM5I.}ÎÛ7_Qø«®Y0° À…؇'ms2ÇiáÔ4ÎoU^w=î4 |Á¹/&ÿÚEèë¹ÿˆèrêïˆPÐâ/Â0ëí±Þ¯sˆð²5GSe åÔ@ /òõU^z¢sf&h6 +x;_C‡lh8Ü°ùµ¦ç†‡©†Œ-Šð- ïù `î"£œÌfn:vèz‡Ò œ†Náj¦´^ïTä-IkJ…áÉÛ ¹Â_C9§ç³éA°”ëÜzõæý'ž¡âž½Ù×ÇjHlº=³µ°Žï‡U0X+œ_L nÖhøƒCFË.¹“²5¥5z Ī4+ºìPn#¸ˆ…OtjL§èDÓƒŸÜ9EÈO3[WeÀÆÔíš•MÆDÖc~ô²;"
7 Žµq·0ÛÉíMSümè—G@ÌC‚›¢r÷CîÃaF&KwC䮊X·I¯¿Äi™¯‰{Ê~µ ‘á Ô™LŒÉÌ ‡µf¨é±è8Wfã ¥ + W:g˜ wóäëàÀìÔMb¡‡"×ý’ˆ¯¦š…ƒ +e8”îÍÊÒPh>8ìõ.TC‘k~iÓ×½¶6ü…ª¿$ÂR>þDbZ’š'ä<Bdí XÛO"/ cHú븯ûIÅBôZö“\º ŽåL˜ë,‘»ÐŠ0x¢«<rñ$²¥°"u tûÕ ´ë)áN`Ûî/NL\–,8€ˆéÑìºí„¸rávLJF_Ðû[ò¬;ºípÑ.mæ×Ùý=ûéùa¢ãAîó-U—\B»D¯»òˆêŠ+;*k€¶XÌw¹g¾ ÞG2¹¾|Oµ°þÔ—ZM¸¯´Ä£r/´›î +ö@Ô1ΘµŽzcÆöˆ%û~á²dú +3™ÛsÉÕ»º]ºÛFäEΤÎ|}6s‰ Ÿ˜ +2‹8½¡fË]–‘J4pn1x=!"?QÓH}¡\å*
ÇøNÅt¤+<Mé”´HIP–ø°¥1r_/ó =Oø2–_ŽÁjôÃC‡X3·ßíéϼhܵÚ7p{"ô|ÇQÚµK<)-üYñ×ðtá—É:øsâ÷z‘ÿñ¯–‡Ÿtû‘Ðq¬–½² 0 3eÐ퟇þyó9ëÿhRíÏendstream endobj -1703 0 obj << +1723 0 obj << /Type /Page -/Contents 1704 0 R -/Resources 1702 0 R +/Contents 1724 0 R +/Resources 1722 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1684 0 R +/Parent 1701 0 R >> endobj -1705 0 obj << -/D [1703 0 R /XYZ 85.0394 794.5015 null] +1725 0 obj << +/D [1723 0 R /XYZ 56.6929 794.5015 null] >> endobj -1702 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F14 964 0 R /F48 1238 0 R /F41 1218 0 R >> +1722 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F21 950 0 R /F48 1253 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1708 0 obj << -/Length 3746 +1728 0 obj << +/Length 3591 /Filter /FlateDecode >> stream -xÚ]sã¶ñÝ¿Âo•gN ñèÜùRgçj;mf’<Ðe±G‘ŽHÙçüúîbIAr®éyæ,–Àb±ß€8áOœë4J´çÆ&‘Ž…>_lÎâóGûîL0ÎÜ#͇XßÞŸ}óQ™sÙT¦ç÷«Á\Yg™8¿_þ2K#]À ñìý7 ¯¿ûéöòÂ$³ûë o.æRdz×ÿ¸¢Öw·—?üpy{1™³÷¿ütuKC)ÏñíõÍ‚Xú92éíÕÇ«Û«›÷W¿Ývußïe¸_+ÜÈïg¿üŸ/aÛߟő²™>N kåùæ,Ñ*Ò‰R RÝý³Ÿp0ê>
òOÄ‘T© 0PÊ3ikõ¹Ñ6J•TŽ÷ë²ÅM¥³M±XçuÙn°«g‹¼&x±Ý^ˆlÖÔE³k«W.ò][bÓ‹-AÛbû\ly¾®¡ñºéðX>Ôº„4è¦.û]Ž¾„ßuQòÌ‹ª,êîBÌZ8*%³Ù%² ö?"²ZK·žm·mËú>” “Dí—²[Së¡ñëOÏ)¶ô,¯—=(¡V]t/Íö3uM]‹®lê– -Ðü¢ZÔ4! “
é…û«£‹½„‰£Í‘d
Œ£t5|Âëbñ™š«fËò–àAß5$DO= RÃ9A ÃoàŽ -?pç䨀4L 0³n_ŠíQ`Z¯7{VžV=Àe@¹£#"#DzžJð G<!͇XäDÀ£öX¸×òËÊÑ4_m›Í| :«b[Ô‹¢R#´Œb_ž$§Ç -Ð3tPB›(Ö: ôo>”o>&Ù -<¿;œMÙužgRáwÙ¼ÔmGôç^E¢¥ó6´—ÜÇS‘@ ‰„ó ‘z†oÑP¢,¢×¡ˆz‡³ö‚&‚Ör·¡ß ÷·¤XTÞåkoÊàdí;lg>„B…zêÈ1£Z0 àë¥yˆ /åcD« þ’dB£øòTÔë$$c -îY[õ×Õ öû¦fqï˜ Š5ÇñU VüË/ªHfFʼÍÈÊìy ¢JLŽ¨ó5Òœ -6YØš(Õ™=½°G -,<:ÏXFi–t´òÝS± -g³š Œ&ƺê#ÖS\¤'S½2ù G -J¾e¯Ef"cDvZò‡XÇ%¿Çr™:ÞîÏQÚ#u¨7ﱫêP“åý3Û›0Å'†0ºÍQl1Â'ÔmËEÇ#ÎøÂÐboóß¶Æ %\„ÇFûZwùu—2øQ±íò’—]6jà -gÁÏjÆ5VÓe•‹]–QQ-YùR´„€æÑQ¶nÚŽ G¸&@–ËŠ@d -xŠýË KNÜÆ:÷žÛ€wûñ=áœøK_íæ!5ˤàEyòM³,ƒÌäîÆ®Š¦† ;oß½M¬û43‘‘ª#'ÐîÁ C/”ñWÍ -ò·–8t}sv):ö[ÓPÁçhqŸyýå×Ùû§ë‰¥ÌŽÔ@!É…l &a¢ÜÃõä0äg܇¤ÿ=µ +xÚÅZÝsã¶÷_á·Ê3'ß úàÜÙ©;=Ÿk»Mf’<ð$ÊæœD:"eŸû×w» H‰’sMfzž9‹%°Xüö ”<ð'O½M„ÎÌiš™Ä +iOg«qú +,›³©Î²IQ埗ÅüÝÙÔh7É«9’ý$§Ñy±È7Ë–:íúÌO6M;Í«Ùc½&Æ5`ô± Ƈë;ZŸI?©k~û?uÅ ´4NUÌAï©M'W "5E\«Fwi|o#Ú™D¹ ”¶ðZ4Ä4ÜmšdZyæá}Lwï‘ûtª½J”P @)“ÌZŸóe9ÏÛ²®@ +!4€WT:#©ˆ²=ÐÁ½y¬7Ë9
¿ ´6_·Å¼›¥;:£• ùöÙi/ÌÖc[„º#ψŸõ‰q."µ¯Ê‰aymUDa +ú ¤ð µërÖòHð¿04{Ì×ù¬EóAzSœÉ óPª<ÍkÕæ_‰ˆgÞ+Öm^òÊózEm ¥@U̇’T³›4´*$OˆÑ%•!~Wó +Qn² |pE=Ú"4ª¢}©×_BîcäqýÈã 9 H#f³:Ì4çxæ8@ÀÑñ¨DØ4Ä +·TY4yÌjZ„ì)íM¤–cÇûD½Ö"/—cáÒ&&“¾.aîqÑ\–ºèß–èÆ¡…LÊe¢ä/ùº[œ²é¼bOò°H^5/źaðA2i3L‰úè‚ÝÒ<×Åà¡Î/Š‘¥R‰µqÛk†é˜3µVt[0›ÜYm4£ ¬ Òn=$¤Võzô$²Dë,í;ÈS˜4÷*PòfiÆÎwj*`†Êi*»¼, ò%Ñ ë¦eûÆ‘à ¾B|yž‚‚GÀ—“²¡ÓS6ðÝ^¾'288~³bF Ò¯$/Ê“¯êy9 Z¥bµbÀ+šRtFÔ*¢Nü˜ß-OTx‹ç?=-Éw@E <nªÙù +rö¦¥4NEC‡FÇDYåíì‘nx‚hõºl W´ +äþNØ9. §j3A-âúõ¦Ö‹nš´7ÍÈ6Íh²™&BJÓÿ0
+†Y÷=‡‡…²=ÏvfX+BNðrS‰‘³ÃAÞ? Çíñs±¬_ˆÚÖO̸ oZ[¥ÙS +Œl•‚/ö”›ù$“:Û/1c:(\æ×U +~xeSaÑy…Ðbõ·/5QÐU5ýCOQ`P¥öM½,g|Æ—kP_4 +9Ž<¼ûŸîp„ïN†¡÷!˜ Âðó_›§…ÄÖäéhQÀ›Krà‹’Ó|h®i¶Î%„m¡$Ín|^WiydeØÿˆW» à´X•-]¬ÀH¹Õé+QºIe”•¿ãá¶7Oñ#T³ë”ÄA# €‚„ÒD“¦øZÿ —Bà|+VB'B¼õ±µÏu8öv\ýÂo: W>{W#"ñƸãëw\# ¿Â)›
%ýŒ™%V 7Ðß ?Ø™Ðv%{úð“ åmü: $ÌIßlB©FNœy(r:·o9¸¸ñ0Âöéí Úô|Ÿä÷×ç /îØÜ¥v‰·~çcÁA?3øñÀÐß +Ôí‰óhR¢ ÔûÒëoMKÆNÒg‰Òòƒì1 >ÇÈ´w/ SüL{lÝŽiáÝëÆT¹áÊt~ÚûÁùa¿w~ØíÎÏ( O
é\òøø»Q$ab†
NÌ°¾ÄÁ3&fØŽ‰¾Œ‰YÈ˨XIñg>cß’ûu“Þ&kØåÉäOü#ÍùZxy˜¯×rz›¡a‡².lu…šâ +±?ÈÙÓ€¯7%_2ÚhúDi;'þuý «¢ýö„\Z‘iä scñšÂ&øÉgƒ¢ûMà þÁôö×äoýÛG- …ÀŸo°P(¸³»’w¿¬Þý¿/œ|endstream endobj -1707 0 obj << +1727 0 obj << /Type /Page -/Contents 1708 0 R -/Resources 1706 0 R +/Contents 1728 0 R +/Resources 1726 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1684 0 R +/Parent 1701 0 R >> endobj -1709 0 obj << -/D [1707 0 R /XYZ 56.6929 794.5015 null] +1729 0 obj << +/D [1727 0 R /XYZ 85.0394 794.5015 null] >> endobj -1706 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F21 938 0 R /F48 1238 0 R >> +1726 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F48 1253 0 R /F21 950 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1712 0 obj << -/Length 3292 +1732 0 obj << +/Length 3626 /Filter /FlateDecode >> stream -xÚÍZAwã6¾çWø¶Î{c(’µûö¦É4m'3›d·Ýv{Pl9ÖYòXò¤é¯_€ -ÊÍÌûH†!øVDnÂ׌Óä¼Å¥¥iŸ¡Ñfçn„œúÐ -ù<B -m††!£C)šfÇ‘%£Æ.0õÑ=¬aŠ8IOïa_êø î¤ú=\TmþÞ}9ÜÄ2ˆ5Ö'è¤F4nb¨)$ì… - ò-X×â*ĸk-¦e-ˆ‡X ª×ÓŠXåj²› žDØî@„~ãP}/Áµ rm¢ƒ'ï 1½¿;×zúoÞÄ ¸‰÷6ñaµ(…Ÿÿ¤Œ¦-@¾&ÒËy$Š¾ Ò¢ žðGxÄ £X‘ຨ§á4:Çèù¯EÃ] ×Ðs‘—ù“-fG¶t·Á@×6jš˜,f¶0œÅ,÷`b”¨+[¹BsQÍØÀ^Ó«lm3,Ø.h³ÞÊÔ‚[ºùë];«—Ý0‰7ÌÈ0hdÚ$…pÙ;/fvF;êaä00bi/r`…*¶J(¦·÷ø ñ 6òú¡Ù-˜yY?·…I‚Kbðâ€ê -Ï(ÐÒ;zF±È…3o*d:D®›]‡}P"!5¯« - 6B¬ét¨ÁÍrÄ€i £0 ØoP 쌻PwGú&GÇÞ®ˆ…5é‚=ªQç`n9]Øל\âñ4ÂûÄüÓ¦‰©pöåíÅ»«{ÞîBÆÑF7ÇÑ8cŸ£çÍðwG·ßyÜ<*aÀl*zTžÔ P9)ðÛÏ'Q¥O+ÐIh0‚*3T᪤‚‚ï PŽ>ªbèŠS‡*`9T%Ò¡ -˜Uð -ºõ -4 B+v—}}3A g¬‰} -ò5ò¯- -ÃÏLa¤Éžœz%{HJmý J¥²w€mµ ¾ˆ_sU¯±^A% ãWö]¤² õÏ%á.ŸKÝOýÝýwD<<Áêæ€S¢>âå¯ø"§ëx¾ïŠ¢$Ð*Œ†˜YÙ6? Ùql$ZÕ»’£ÖcÞ]r1ç™"5ÞåU¾ÍÚ.YÞÝÝ߼嚞®ßúë|ˆný×M7ØA—~í¥SbõzOQ´¨²mQ¾œ ˆ¾oèç -+.‚ì7Ò7ôË‚^ -—Õ¿ñM—â* » -¸Þ†,£(k—Ó€p[i»µÿv>Óø“–xNg ;‘ h ¥ü¦Ÿ\ӆΕžÚ +xÚ¥Ùrã6òÝ_á·•«"..^;OÎÄ3qOÖãÔÖæx %Èf
E:"eòõÛn@$EÙ3µ•š¸Ùh +`k8ú\T[ƃ—p—jä`› ô0‘/Û]åZ¥Ló
,Ç3wÌ‚ßúÇ?p_òþ%³kAO úd÷CÆ—¶³›uY[R…þÖ5Ô™Çf7rGn çˆ ›mÅNëž·wc;rÔ +œ!9¹àܶd8ìךÚ:ƒ;€€ ‘~ ZÖŦ¬ö</^Nš;úy[>Ôn7 kd·%è‹î±èè«lÝ”¬G°+ÁÑnyœî +j‚M$y$€³ \¿9¯AN%>\,ú¯z9•¤‚—L½‡žÊG[gröØ{ý¢ï3ï 5›½ãdÊì e*K¿Àê³^äÐ!„Âý íŒQ›<ʲ¡)rèNã^~5å'à{ ÛSNü ˜”r⇘Clw3œšâ8OàRè&PHHÍaÕÖ¦°îÆ‹n´;;r€(OØçoƒ„Lå>!C¨—¹ä½ì ?h‹œ³/è€y/û¢Iî€8Îø€\n¹ tÀþªlÿEY/Ñ !ÊÕò}JÄ&ò™ûm7ò!7çÒ\à4ÔãÞ‰ø¿‡@ګ⧩5¹–')Ìœž²PÏ4yÞÄO ú‘HU2Œ£_ÑMHTgƼ^NšPNº º^M,&
”à&ù*³WIê+ÕpÕ¶ ×|lç:Æ.“þºñd\b>Dƒ“¾Þ û0ùË®¾GtÚÓ{¢žzTM±DÛš—ã7P ùúT€LÒÙDÇ| ý` I‘
øàä+‹±´Ã?s.Àyü]4õ B¨‡mˆ›ˆu^nBbmCß„*¶]3§³Ò44æþ½™ ¨µ1¹×¤²c¨$ÎBÎÔ´e×lög 3´}Êá”a‡ +™¾ÓG*•\rS6ËrQTTFQ×ÉZk AU
å3n¤¶;Âø"ÎÌ ‹gëw¡2êÌåÒïâ‹þösÙr}Íëüƒw/ÃÁgä—!Á)Àž°ìÎ2ØwÎr¿ ÈÜ–ôžO0Ò!¬^$öTtŽ)DKPÜ<œpÛS§@?ïO8Ö§ãu{š
Ç{°5r”¹80âIC¶ç°\‹#ÅT¯p¢E™TzÀ ')ƒmU)aô—^E £uû1Àv a{ò.ŒPèkÓ—ï"P½ÂÊñjÈ +î NܨØʼn‰ð•ãM§ÃèÜÛw"óQjÔw]ãkªF…Њ:¡ÐÛ£u ßpÔÊçý¶^ìi £=¡)ºrA_#7à(}»^‘䮂Um;Û⹓Œâ#¢ @øðñqm’<¤ðÑ/'ºíIê +Wò£T¢ZÃȨC·Ý \{Pùž ã±\o×ô1É ºEm2¿“œà%‡B\
Yñ‹Ãô¶¥ŠO‡ý%8äϯío ÉÈ…W
iÌÔu€/P2”ßȃ2´(ž¼E Þ`'O‘?tåã+3Xϸ¡\D)èCØ–ÔƒÕ¾_*.·‹8ü„¼W"xŸêtTÈJ·ÙÏ»ÅÓ|cWÛ> ¿³ÛÔC/2¨&8¾³J&Y2dáî"‡Kp ÉÍL)lNí#R_Ó·õ´ësûUÎîÞþB +Dp¥ŠCOö3A®V‚¿Nv‰u•ÊH´ÜÇë÷<Ç• +rÓt–^S˜S‘q ªŒ…WD¸: QT‡!j¢H†ñE²Šž“¦Šdq(’'kdHŠ„ðþ€ ðoÌ°åÓ¦|.üYøEЇVšo!ipÀb”\ Ôèò ß3¡°¦DÚwÎ4½g0ÊÁC”7l9ƒY|sîÝÓiË1xø5æöTŒ#*Ä éCá˜ðÏ™ÔösÇ;@Y5q¿#Í‚˜g—SÕ $™9êCuŦãtr´î<Î" È\t ô?j“ð¿‹9G`b´+6K.èG[gX)Ê8>´ìP<+7‰ŸË Hx«bA)”£X¬i÷<… ±ÿR +‘h endobj -1711 0 obj << +1731 0 obj << /Type /Page -/Contents 1712 0 R -/Resources 1710 0 R +/Contents 1732 0 R +/Resources 1730 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1684 0 R +/Parent 1737 0 R +/Annots [ 1734 0 R 1735 0 R ] >> endobj -1713 0 obj << -/D [1711 0 R /XYZ 85.0394 794.5015 null] +1734 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [226.1733 390.233 304.5885 402.2926] +/Subtype /Link +/A << /S /GoTo /D (man.dnssec-keygen) >> >> endobj -1710 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R >> +1735 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [325.208 390.233 403.623 402.2926] +/Subtype /Link +/A << /S /GoTo /D (man.dnssec-settime) >> +>> endobj +1733 0 obj << +/D [1731 0 R /XYZ 56.6929 794.5015 null] +>> endobj +478 0 obj << +/D [1731 0 R /XYZ 56.6929 146.0228 null] +>> endobj +1736 0 obj << +/D [1731 0 R /XYZ 56.6929 117.3366 null] +>> endobj +1730 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1716 0 obj << -/Length 3468 +1740 0 obj << +/Length 3122 /Filter /FlateDecode >> stream -xÚ¥ZYsã6~÷¯ÐÛÊUB ¼jŸœÏ¬s8³¶S[Ù$EY,S¤"Röxýv£IQv¶¶RAF£ÑèãkÈrÀrF"JU:‹S#Â@†³|{Ì aîó…dž…cZô¹¾{¸øö“Žg©H#Í Ö=Y‰’DÎ V¿Í#¡Ä%Hæ ~¾ýtóù—»«ËØÌ n~¾½\¨0˜ºùñšFŸï®~úéêîr!“PÎ?üãêËÃõ ME,ã»›ÛDIéãŒÐ»ëO×w×· ®/ÿxøþâúÁŸ¥^h<ÈŸ¿ýÌVpìï/¡Ó$œ½À—@È4U³í… µÖŽR]Ü_üÓ ìÍÚ¥Sö3a"Be¢ÙB‘ÀþÓV–"–˜â0‘VÚ[YÉ)+;.´òªnÛ"_ÀÇSñºxjŸšºz Ÿ]FF:fý
NÔð\z¨ž 2JE -%/Èö—2™´Á²é6´m[t¬IC"LËH‹D%1‹x-Ú‰md,Ræù¥¥skX»Zº- ë²~ÄÅx¹©H° i*» -˜Ð q8ÿ=ƒn“¡Ràªe‹òÙcx)ê0ê6
~¸ÿØ—eG8’nEUñ</8´ÅŠe4¼ -RÊkmËœhì0²ŽÓÝ>«Û’â éäBÍ–fíA¸¶ûUðÉGt3À‰¥¦…À{‡ŠÉË„Ý¢!Hˆ†£â|¨‰“ -ŽNâù=;IÀ9ª¢#gj†UXEpš|®"à˜Ê)1¬ZpÛX)Ê®$ý탾Oºœ$@ˆä/dX}Ì°¸ÍÍš”°ÙЪØLytðÓ#¿âÑ`QâmeAù%ïãCKƒ'èËúJ©´‡0´ÄQEUÚA œˆA#›dáÓÞA±Â„¬ºwó™×ØzƒÛûë$yt 4Í0B1ŒP !4ÏK8z ~s§AƒcAθ¼UuF½¢Š÷ˆŸO -^k,Fk‰†jk<Ÿ±‰j‘~¶ÄŸUmC”ºÈ‹¶Í0ýZÙL&C
ö Iö—ËTͯ ¢Iw0ì÷DË œ‡·ówtWáœlV å Š†QÏÄ3ÙàÏ̯jö\2vM½¢h‹è2u_F?¤"“Úh¿éˆƒt1óâ뮀ØÊ;÷¢Ý¬sQ¨o“„ÿy(YÓ¢æbÀî£%_wQž«3+Ü– Æ}¬OGÊ×êÈÚBØÜ2á ·
^ 2§iQp%£¯œ/°ACÒ²@/ARÞÔ¿zäW4o{ˆ Œ -U†P¹ƒÿ§ÒAˆ8\> Dp—€[îöåsæÎBx ÉG î°' ·0#¿ÊÑ£Ëe…ëMj
« äF¤ÉÛ5P.š}¯ÊŽœÁ*¶ ŒØGù.‘‚‡ß\ÈÁY¶¯x¥™UÈ^\]|íx‡r;…áGÑ5¯XMØR HÌ €í²}Ç@r$w&B§ -ošú' ÿ\.àrF/Ù~ÅmèhKÐLaBã±>^ÏÚ.²aE—·Îr‚P–#ÏØÓ–¼„Z/{÷
³Ð¥ðíGä·á¼"ÁL…+/åŠ]$Ïr§DSü}]¼ðŠbÿ\ì±CÆrÏ~ÈYÑaÉ -¤ -™BpªX -i¤ý)Ž&÷3Üõ‚Þó/ú NƒþT®
z -©õÛ*8¦ †¥FHøg¨Ã rj²]°ýr=m[…o{Ã*Š\ÖLè¬È èÇaœ÷
ŸáFܸ_½‘BWfE[g‚I{g¶ÎáÏwÒŒžjí<:‚}^K#zJŽÛ•C#Œús“ '„ÑŠA€Y:tsáüö`O
TÛ-%£Gž8!ãÔÇEõì&6ÌëöÃ}JˆÛTÆîÇw ñrÄxŠžRás“ááLÓ»lâ^ aÀffþ–>Ñ‘p¤çÖ›j «s¿å† +xÚµZKsÛ8¾ûWè6TUÈoòèIœ¬§fœ¬ã=lÍÌ’(›ŠôˆT<Þ_¿Ýh +ÊT @”7îý==mÃÁ`/D(Ü ¹{§+Ëi !è€H‡Òm´´1L“ûû
n1 øãá §A*×}¹¦ÂNŽ'Pz& +AuD›™‘B§8Ès½¢Æ©4T#™9ªX@Š6ŒA8 ÄaŠXQI¦°1MÓèý¡¨ã®/Ö_i_l9èfœ†«„A±r†/ +¡©Ž`¥èè7\I?( @"E7`'^eƒ‰ua!
P\žl÷=Í ÿ#ý©Ý Êo͆~?âÚ–´ªË[#Ÿ$®X?«ª®0FQØæàÔóUm÷u°Šfô·Ãã£ÕÉù'
Ê +¸ñõçorìÏ@Ñ>BèI¹ mçdí@·ª)ÏVL§Í˜þÅŠ9ä:_1—fáãîxô£Ê©
Tú\½¬CàšQbT;
àfc-FµSHå,#¤Žšbç‰hQ|Nê(rY‚)gG÷ Íë5pÕúÐV-Í*whV´u'˜´§f+æ‰b2›à¿=€7tLî:×Ùba2Ì¥ÂäVÔœˆ à +û9°FmáØVeÙøÒÙáImÎÄùºÝí¨ 5FÄÊä~.yó,O´4OÄ£u¯ÇrÆ ÐtšL0Ç `ÚIEPø5”﹊ ]E¸ â]Ûôû¶~½„—$'ëIBZ îÙ•›tþÜï«uo÷4Àw4ddKÉÂ,˜–#0M6G 9]5(©³hUyîúr‡€ ÜúË)z™L¤ÈÔYm[á—ÁC`ü3E{*u @/ðÈ„M•Q GÆÍP™“Ę^VÁ'h/ÍEîñ›óß²/ªº»ïCû4ÛEnŸ}Ys12:ëß]¾õ` +HÿüåB6ä:_È—_ìb +iÿ…bD÷+‚‹Wqàš$Þ˜ÐÞÈÉ”u¾J>HžkFQIB<‡ßFŒk’8Ö$ÖíÚ^sò]Dd®Mä +6Eí_êñæÕ¬Ñ%A“Á— ›¶·]¸¢O®3 Vu}Šœ«Nü ñ²HÙ0“Èð•RjhtJ¼q"2µµR
ª“ÔþÛ/^ò $í÷¥]Õ»« žç
¤ÍÔ0õ}ˆ"Fr¯ªõÇ ?À£ôðå“TªÉÇ6º¤Ë¥A±õ—?+wftu‰£Ëw¿v“(UïÝW`/‹ö½Åœ;ܪï>É̺1é¿óÁÈ.˦ 9ÆÄ9PÄ!C‹ò +J€œæ0šïtÙ£±€Ñ˜Ãhð ´jøóŒ.ÿ®#ø©ht‚¹ÄÜ8é¿Ë•Vg ›Ÿ Äÿ ¹ù+Ÿ€ÙN#|î/…´ÑBÌŽ4€¤ þ+¢ãŸXI(-Ù¹[ÈúIÆs㕲7›æì•Ú©êÿü&vøendstream endobj -1715 0 obj << +1739 0 obj << /Type /Page -/Contents 1716 0 R -/Resources 1714 0 R +/Contents 1740 0 R +/Resources 1738 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1723 0 R -/Annots [ 1719 0 R 1722 0 R ] +/Parent 1737 0 R +/Annots [ 1742 0 R 1745 0 R ] >> endobj -1719 0 obj << +1742 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [339.2005 267.4951 400.4005 279.3953] +/Rect [367.5469 618.1183 428.747 630.0185] /Subtype /Link /A << /S /GoTo /D (zone_statement_grammar) >> >> endobj -1722 0 obj << +1745 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [455.0966 73.4705 511.2325 85.5301] +/Rect [483.4431 422.7733 539.579 434.833] /Subtype /Link /A << /S /GoTo /D (address_match_lists) >> >> endobj -1717 0 obj << -/D [1715 0 R /XYZ 56.6929 794.5015 null] ->> endobj -478 0 obj << -/D [1715 0 R /XYZ 56.6929 499.1607 null] ->> endobj -1718 0 obj << -/D [1715 0 R /XYZ 56.6929 471.7434 null] +1741 0 obj << +/D [1739 0 R /XYZ 85.0394 794.5015 null] >> endobj 482 0 obj << -/D [1715 0 R /XYZ 56.6929 253.2977 null] +/D [1739 0 R /XYZ 85.0394 603.6296 null] >> endobj -1720 0 obj << -/D [1715 0 R /XYZ 56.6929 230.8219 null] +1743 0 obj << +/D [1739 0 R /XYZ 85.0394 580.9712 null] >> endobj 486 0 obj << -/D [1715 0 R /XYZ 56.6929 117.3496 null] +/D [1739 0 R /XYZ 85.0394 466.9592 null] >> endobj -1721 0 obj << -/D [1715 0 R /XYZ 56.6929 95.0332 null] +1744 0 obj << +/D [1739 0 R /XYZ 85.0394 444.4603 null] >> endobj -1714 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R >> +1738 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R /F63 1382 0 R /F62 1379 0 R >> +/XObject << /Im2 1368 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1727 0 obj << -/Length 2817 +1749 0 obj << +/Length 3416 /Filter /FlateDecode >> stream -xÚÕZKsã6¾ûWè¹jÄà
°rrf<³N%ž¬Ç{Jr %ÊfD:"5^ï¯ßn4À—(Ù»“©Ú-W™`£n -›9u £M4`,\êÀ¼ÍžiölSÑwA^Ýî늸Œ¨Û¡\Š„)04šØë}(]èDé–©n²&ßæeû¨`ƒ¢„p‚Ø\fu ö‹›Ä¦ÜÆ
~Š¢>+æ Ò®Xá–ãksÎç“jZ‘X“ÆåWx aÌ ›Ì±cÕ!(«çWA"LV•›gjmó¬,Êûõ~ƒï|¾®vA =¼!Q7-η&¨CËç–%©4b¸üÞ!½¡àã-«|í7
½xkÆÞŠžÞªe^‡ŽÖø¡½jFÖ o´liЖÞ2z ÎßV2Qô•ä ø…kK§£PéxŠLÍÿ¹Ïw! ÞquRrËt(z€tG`²‡ñ§³^áÒ6þ ƒµñè]üAª±þL„ʳ®Š2Û=S×»ëOÔK¬½ÉN…‘êD' Ý”ÑZ /nD?ˆÈß DÆùÐà0:8àAt@‚rðœŽNÀ\*}!8(Mm ëáX+ n/4}p é
=+ðû. ׇƒY¡Ô8àˆÓû{Ì9?ŒaÏ$šðÈIÑ—ƒQã¿õZ¯5Q½"ºèÈ17jxë;ðDÎ`1‚
‡§æékpÚÀ*7C$nžeÔñ¹h ƒ¹B3ŽNµˆÚ-´r‰dZ÷=±ÝT8@®#¸"ƒ´ -¼ B{#ÓÞĬ?óaFŠ\ - Râ9fÌPƒaN’]N‚æ¦Zf ¤E@JY©®#ã2+©ðØP{”€B ¦è%¤è1¿%à,¯~Ž“ažÇª^P Ô 5xîÌw„Ô‚0¡$…¨‚l¹ŒtUC!6ÛPˆ/UIOÈ€ìó]™mël -‡-/–A Ëc H@†+Ê (
ãÌF‹7]Þa4Þb4 0<{W5|=¢‹…ë±ní44:ÁTal Ý_eÊÖè#Ð-öNâ›#7Œ.ÌvèáSØMB‚·:µÿ£ØMâ r)_ÂnY¤ê/ÅnR -Ð\Ëo€ÝúSŸÀnR¦ÀÖsæ¿ -¥Oaíéô P‚Köê¯pG?)ºýHá}¤ -¡#w)çøeíXÊáp;Ü0‘rpÔÉ”ãÕj¿®PÊéÇ¢“É…C4‘êØ"ZoíqðÖÈ5abS©P½4€ÐNêÐrM(!F—x‰ái ÅÐeE›Z¤hS RG©{}jñ}¡8‰Ä±» -Ýbô)U„l‚ÝÃK¼T&Ö fà³ZÆæôÚl2Òäk/ûñ¤áBùEž¶† ÓqcˆL-ì WYsxáÁïœp1?)ºe:”=°,õJ%ÂG被OC®ßLYÿ›)ëEmdò»Äz·õu%h¿{.³m±$*P•V±‡/Õ±øc -jc«Èã6‚ÿ <þ× Y -JÁà}•{° -ƒ†ŠÓ^‡‡0m˜/ÊãR!}F]ý:U¸îYàм‹²FKö}!àÕù¡@ÎÌ*=3X"ñ¿-¢®Ý}¨ªÜô,¦å^tì‡3žÓÛK¾ô?œñzØD èaà~"œíéq`¯-ÏiéF&’ãÏ :éëXà]åMVl&<5ø—`"'½…µõ¯¯þÕW÷“8eÉF'‚7w'R•Â…;Ö\KÀÑNØ Õÿ
—‘¹vendstream +xÚ¥ZÝsÛ6÷_¡·“g"ߦOi“´¹¹ºmâ{jû@K´Å©Dº"e×wsÿû-° ++‰¢L-Öû+ºx€¾ï®XàYE¦UÎõÍíÕW D±°Äj®·÷ÙX†PcØâvóËRN®aºüöÇ› ¿û÷§·×…\Þ~üñæzÅ]~øø¯÷H}÷éí?¼ýt½bF±å·ß¿ýéöý'ìÒaŒo>޼Ë?gýôþÃûOïo¾}ýÛí?¯ÞߦµäëeT¸…üqõËot±eÿóŠaZ<Ã%ÌZ¾Ø_I%ˆ’BÄ–ÝÕç«ŸÓ€Y¯uN’¢….€2„3ã ¦ÆkÑÌOKa3ÑRËócá{Æ +d|c<ÔÊ0¢¬U‹•.$È©lÚ^ÎŒ«wûk + ÃA¨k‚í½q +öŒ–(-™ãc”(Á% î8~¼^i¶¼…ÿùòd;Œ&¶b¡a±–7ñâ#TZ+'£ýJ
ø†¯>îùâ] ëYäK +㮲ýŠ´È +Nl !¨ßu×øPõ¡·éž«CxïÞ¿×îñÉ#Ã~±Î*±üx Œ/W— š·ËôDQŽ¶d‹Â-?š6ð%%NÖžKRi2l Å—MÛ#ÑU +³2ðo¯À5㺠+ŸR] qÍH0BªÏÕD„qäÔ&y3 cärˆœî!ENù’ûÝ—¿‡ndõkz +M þ-bøø°
uèêªÃ¤yp| +2® Pˆ\Ž›²?=í°NHú/Ξ¸f¦ ဃ:MQŒçŸäfÈ/Šèµ]kòÚþ!zmÇä÷ +–já cøÄq{›vÛ^³ö]…Ϩ8'×Æ ã +m`Ýžà 0¬ð~Á÷d! !¿ú M ®!@ʘ¿ÿAJñٓÿ›Ëw)à€ÞyƒÃG:*8EaÑG@cÄ~Ü÷:”ÂÒB}†–ÆÕX9qùè^$„áÚ»%iPIÐòX `¤½KRV‚ÚåíµåËyª¦¼Û¾4µ,rÅÂÈo9Ö)gôdáÔ¤ø8 œ·«z^1v^AµpL‹šýúUÕúrCüÞ¿x
¸úÙS¹;bí-䌡¬¶-›Ñ]9‚‚‡úk[\¸*g\.lÓ̸œhüÓåÍ +ŠÌ:/»—^ AŸ/ø°n
ùÑ渎Å;š'§hÈ`\nDÁÈêfíöÖFË +˜¹‡ptc‘©ëÓûªñõ@ÉÒ 1µÒßyA'@»Ç–u¨7þ +?»ºë‘jïCÇ´ZhHUH¤|ópÜrT(Lò¬¬É³ËxÈ®îÝœa„£Ï9 n]C Ý=UQ\<8Ib¬žD9,º3Æ–T?çµÊ,®"˜bñ|zÛç}ÄHÂã]•—DÝAa#E߆ùnÏ!ôôH$À dA‹ìöùŒÑ3*^»c®œÃõ+•õœëT#ø)ßõ«W%üÍAV%.‹¸fd˜BV +Td˼È[‚«¢>X»dÕÖCH‚xç½îý·qì„ c>l¼ ñ~É(8GMo[Ð/ù:ö]u?œ¥ +pJp’‚ù|Á<Vã +:.Èc2
ľnêý1TÜŠF7ö`7ZŠˆFç@侉Kõš4x çÞ—†Yð2àt ^I¥ObÄì$aù©8ån‘?W}ŸJÿu¸è¯Ù²™DYR"ÚÃÜ ð“*D~CÃw/ endobj -1726 0 obj << +1748 0 obj << /Type /Page -/Contents 1727 0 R -/Resources 1725 0 R +/Contents 1749 0 R +/Resources 1747 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1723 0 R -/Annots [ 1729 0 R ] +/Parent 1737 0 R +/Annots [ 1751 0 R 1752 0 R ] >> endobj -1729 0 obj << +1751 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [213.0783 62.7905 261.825 73.5749] +/Rect [184.7318 419.6605 233.4785 430.4449] /Subtype /Link /A << /S /GoTo /D (dynamic_update_security) >> >> endobj -1728 0 obj << -/D [1726 0 R /XYZ 85.0394 794.5015 null] +1752 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [369.8158 298.4384 418.5625 310.4981] +/Subtype /Link +/A << /S /GoTo /D (dynamic_update_security) >> >> endobj -1725 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F63 1364 0 R /F62 1361 0 R >> -/XObject << /Im2 1350 0 R >> +1750 0 obj << +/D [1748 0 R /XYZ 56.6929 794.5015 null] +>> endobj +1747 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F63 1382 0 R /F62 1379 0 R /F21 950 0 R /F48 1253 0 R /F41 1233 0 R >> +/XObject << /Im2 1368 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1733 0 obj << -/Length 3353 +1756 0 obj << +/Length 2832 /Filter /FlateDecode >> stream -xÚËrã6òî¯ÐÞä* ! ÀÊÉ™Øɤ6“‰Ç[{Hr $ÊbE"‘²£ÝÚߺ’eÏTb 6F£ßŸ$ðÏ'©f:ÙÄdŠ¥ O'‹íU2y‚oß]q™¤Y ë›Ç«¯î¥™d,ÓBO W=Z–%ÖòÉãò—©f‚]…dúî§÷ï¿û×ÃíµQÓÇ÷?}¸ž‰4™Þ¿ÿç Ž¾{¸ýñÇÛ‡ë·)Ÿ¾ûþöããÝ~ÒDã›÷ ¾EH† D îîï î>¼»»þíñ‡«»Ç¸—þ~y"ÝFþ¸úå·d²„mÿp•0™Ùtò/ ãY&&Û+•J–*)dsõéêçH°÷ÕO “ŸJ-K…Ò IÁ2aŸ”93œ’Qœ¥FÊ(eÁǤ °œ”óͦ~™ v˼-f«zÿ’ï—eõtº{n8³ l»¿Ä#k„Ñã„ÍŒŽ¬|Ú‹ò×$Eg¡åôe].Ö8\×MKÐ|Íí´ Ç~±Ä—¶Ægs˜oËÇß «|[.èåÃ' à~›“i›ü¹pŸÌ²”q+ÜŽ8ËÒTxþþSW~JJSR1øŽ‚s|-=3ð Q -CHM :½-ªÖg£<®2k.òÆç¯ Ú-BjÔ¾\úúá27Æ2‘Ú 1´±&lµ'>
\®¿D|YbÔé‚]®‚=’ö„xCaz P,U:CŽAÜñH NN0pàõ²õB™½Qëv8¯X.â¸MÏ7_¬ëÍYbÁ(A!ܼ¶hÄ9[u`®‰f*KËŒU -áÓ6xlJ—•ºQ½¢] -p)yô£1Ç‚*,7ò'ç‰@®µ£ñ ‡b_Rû5‰ÂÁg†ëY êÍsØÅZI1›i5,•ÜÇkÎù”éç°¢;á^,EjŠ³\1àRØ×Á9awµÁ2D‡¶¦õ /iåy$Á”IBT]6t×Û eÝõTÆIˆ½ª }¬Ë*±|® -ÖsZ£CÎôµæ`
ƒmY•ÛÃQ¢.ñAsN€¸dОŒ©’bZÆFM$Þ†µ·ùŸ´ -@GWÉÀ7¥YðMrtÚ~ìJIm¡šmQ¸žr‹Ëµ×|Z,’f̬bl
[Cþ@ý(X[ËÄ#agŠÕkéļˆù=¦åXNéQ–€ÇšI×<OÒxSÀ5K¯Áó%ϸÎÔ*_ÍÿPÑ@VÍ…¶R‹Ìeqq’ï áÁ‡]½÷gR—4¡Äc<vcŠb~ró 1 »—^Pôݧ#‚çÔŽf¯ðáÐ Hüâc)£‚Tƒ;qã8 ]TàDGv>‹¸;Á,s47ªô3H+É, Âlóß}Ú¡\1ŠO\$wÖ¯R/Òð}ϵ‘\Ë m.ܸNÒigÜ´´©šH1>‘æs®fˬµã3³HqÖ'éýä€? uœ4Jt+cuÒbè0™BÉ—fÙßÈd ø“) Ž²fȤæo'@³4#é©k0êàËa„ŠAç\á çÁ/HÁØë‰Î
Œ-!½› OœÄYs% “’“2†ÒT²a¿áb}Ó!§ò4%
™hôI'ÍÞ Á•»Í¨u& FÙçX`ÖÄ7VhA>ý ‹v} …ÅŸù¸¸±£™g™¤vÀvÇ¿ ‹(Ù™avp÷qÚ:™‰²s#¨¦Õ€Ú?8xfÉ‘ƒ·¯¸~í^V’‰»éâ]|€¥ºû!º÷ -8Š¯Cg/IW¥¡pdQZSDlE ®‰\½+€Q´@xmŽ ®-Ž×9Ñ)ªúðD|Ý~|O˜‡÷¤ƒøÂ{ÑŒ6a“é¯P6G+[àí¾Ãðü*¿¶u¿ÜhêÅЇûw*“ý@9ø–*Ëp—®d°ç -v’û8aI8€„êÐàT “±6îó Þn¹ ò±Ú;¿^†q/Q” +xÚZÝsÛ¸÷_¡>Uî |@òäKìÔ7/çºÓéÜÝ-Ñ–Æ©%û<þïÝÅ)QŽ3ÉøAäX,~ØoZŒ8ü‰‘3Œ+¯GÖkf¸0£Éò„îaì㉈s²4)ëÎúñæäÍ…²#Ï|.óÑÍ]‡—cÜ91º™þ:~ÿ÷³Ï7çק™4|œ³ÓÌä|üãåÕ¢xúyÿóÕÅåÇ]ŸZ=¾¹üùŠÈ×çç×çWïÏO3ጀõ2r8²àâò çôôñúìÓ§³ëÓßo~:9¿iÏÒ=¯à +òÇɯ¿óÑŽýÓ gÊ;3z‚΄÷r´<ÑF1£•J”ÅÉ?O~ivFÃÒ!üŒrÌ8i + +¾t rÇ +4è™Ï0?”d·ð$Bz‚ÐÿÍ|²]kz'\qF·PÁÁà$”pðP,ššfaBŒ”~ÐWÒ†œG h¡±Ðú¦¤eáa]*#¢táƃ€i«4¯c©üˆ…v¡ˆ&ÚÏGjˆ˜ Ðë}Ô¢E[\Ô1Mzš• ñz/›™–ÍœVFƤ\,*ÈÑj†ï;G='^ßóœQºp‡UÍë+ o™ÒêX%òtÓÿNÀ¹h¾TKHÎÅÛé{ûö’ï†wxM9¡¸iË Åc1€D*'Ôê(PƒZ-¶-€‚ù)R‚æ!¤ ‡hK0¶oK0ˆžöi¾™Å DÄ + Òók4ô 'šÐ©cBR
ØÉõ~„Ox 4)$>íɆ“ȳàà<RB
„Š~L8²¢Åh_ÒPïfˆ´;,.im9ŒÑ©â>D¤’ùâSHˆÊ/ºv„eÈŽnN½ שWðP¾P‘´•ÓPAn5e¿ÇüЗóߣRÕUùú˜Gk8ËÍë}D.¥;(k92}PÓéÔõÔ®§êƒ°R‹e[Ljˆ¥n±Ôb/]‚¡mµˆ¹ú~Þ(4s<¥‚ÙÐy8Hot·.EA;q ä{š'ˆ5}¥zj‹˜> –yy4ñDç0 ØYi&±)>ÖÁµðÞÙçš)ë_<äß9÷{¬{ÁMÉ1‰…ŸÖ½JüÔcviÛz°Að€@‹ (Á%´,%Ç„À®Üň„”rkÇw² ¦å]áo¨6 +|ðÐlC¢ƒ±‡ +ŸK¹Nh[ avh-àìšàZL˜ÔçÄ9ó$IZ¼K5¤{Ê.6ÃÞ/õDxïH¸‚ASÕª{uØSØ·%Ë´ 'tÈÉ3«MúRò·!Ñ×&I†A´ +°& +w/$<SÆê~Gƒ¥ÑùP7!~–|{ì_H mÃÿûø‡>Jøó¿—ìþ÷!wNîÂE/6C4s`cI¨Júƒp–þåPôÿp¦‡endstream endobj -1732 0 obj << +1755 0 obj << /Type /Page -/Contents 1733 0 R -/Resources 1731 0 R +/Contents 1756 0 R +/Resources 1754 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1723 0 R -/Annots [ 1735 0 R ] +/Parent 1737 0 R >> endobj -1735 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [369.8158 647.9776 418.5625 660.0372] -/Subtype /Link -/A << /S /GoTo /D (dynamic_update_security) >> ->> endobj -1734 0 obj << -/D [1732 0 R /XYZ 56.6929 794.5015 null] +1757 0 obj << +/D [1755 0 R /XYZ 85.0394 794.5015 null] >> endobj 490 0 obj << -/D [1732 0 R /XYZ 56.6929 399.7353 null] +/D [1755 0 R /XYZ 85.0394 769.5949 null] >> endobj -1736 0 obj << -/D [1732 0 R /XYZ 56.6929 377.2387 null] +1758 0 obj << +/D [1755 0 R /XYZ 85.0394 752.051 null] >> endobj -1731 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F48 1238 0 R /F41 1218 0 R >> +494 0 obj << +/D [1755 0 R /XYZ 85.0394 219.3808 null] +>> endobj +1759 0 obj << +/D [1755 0 R /XYZ 85.0394 190.7166 null] +>> endobj +1754 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1739 0 obj << -/Length 3037 +1762 0 obj << +/Length 2802 /Filter /FlateDecode >> stream -xÚµZKsãƾëW0'S©ŒyƒÝ“lk ¹bÙÞÈUIÙ>@ÄHD- Ð(y“ÊO÷tP£]ÙIŠ z^==ýøºA±Èà'Ö¤™*õ¢(uj2a«íY¶¸‡¾¯ÏI d:ê‹›³ÏߪbQ¦e.óÅÍÝd-›fÖŠÅMýÓòË¿\|sùî<‘&[æéybòlùÅÕõWD)éñåw×o¯¾þñÝÅy¡—7Wß]ùÝåÛËw—×_^ž'Âó%¯ðÌ„·W½¤Ö×ï.¾ýöâÝù/7ßœ]ÞŒg™žWd -òëÙO¿d‹ŽýÍY–ªÒšÅ#¼d©(K¹Øži£R£• -”ÍÙßÎ~œôú©1ùeSce ”1š2Í•T^€ß 6C³Û8< Œ“ñ:K¡UÂ&8pÓôƒk“®M r <]Üäi!ÆÁÝnhº¶'Yª–·Žž‡ÞÕ h%@¢Ýžhî·j l¼¢¥õ”¤,R¥•]À-¥EV”OùIò,[þ‹ Uûá
µþýW–!ÒÒùÌÄ]· ¨%¤Ò³Åþ$³L¼®oíëן+ù&¾Ã‰(`?¢ËIÀÍfgÍÌÒµÕ-Úz9¬ ÛjˤÞí Üž¨]K4â )Få®ã!À5®¾Çs`_U×ûsa—®ï]O?g&{l†5 bß´÷`¯^U~ZͽÝê½`¢x…wda§zä*"OâQ”†¥'J½ìîˆB¼aë„7 4¬+žØ0¥í¡¥§öìhòÏY&£®ÙÅéxXœÒ»]µ¯G}t*ÞÇ ©®Z©µ†ÕÚÕó’™°ž¢XÆ1m¼9/å²#UÞVïYÑ=ûØw‹mHl"R»ã§¿Ulä<é¸ý«Ñ~"f’½Ð>Ú®u/Wß+¸I©ÌŠx)a?ór‘Kig ‚ÖÆë—¤´s«¯ØÕxR-Y€0d ´É¢p‰H£(5‹h$J=ŠIGQRסÝ`ûéÉ”Ð©Í -f6‰G€J£yALÏàõ$Ѭ¤„˜ÍãÚµ1i© КèêÈÎJ§Ò˜b²³’ØÌC÷Þ;VxoO—ÏuªŠò£‡)Ä¿òdéé¡€`ñ^bì‚@a_Ä~ΣØ?Â.áqï -hOò gŒž$vǹ¶ÁŸzó‰p$Ò¢T ÓˆgY9"ø¸ª¨²A‰Q)JKJQ–¥€`ç•:÷`ÕÝ–ìÎÁ ¡iãK{ØÞ:^áÎkGÆ3ð%«®Eÿq ÷šÁº÷n¾ÿ®€Wí°ãµZ&°„tëø&,DZB³‹ ‡ãy¢ãŒ‘D¾TÀáÀr!/[Þ¬™… « ¾P½{¶ž‘Á‚á.RfáÔiÃ&U6vL&:9Ô»7Žù›¥2¦‰Qß…ë÷§o…P&@¢X5Ý/OXl2Kmy*¶°rΤ6§¬()¼'&V””!eDýQ%¤ƒ«Í¡†<…:)lÀ /àžˆ'¨Dx1†Ñ1ˆâV¯ º¦þ” KÀxZÉÇ¥Éò²˜/;Ê ¬ª”ÊÌ3Š - ¬LH9O¤ø³…s̓Ûm¤xÞ<- ƒ ÎÈ1= ùÉÓYFˆ—þ üJf?* Q¦Ê:²Þ³ÁÒè<VI ðâ^ÇŠ -°˜£ç[ýžtϺejmQFf™´,Š|:‰J‰(TzÔ‚8lxÊžV©Îåÿ›»S('J‘J_Ošç±Àc„¿Ë/ŽN"HDYd*Ř£°ïyùšÞÙZ€Ží,™Œø¸|êSŸMUän¹¥*¸üjíVï±™/›;"Qª -nç -µÇØí[¦õ‡; Šv¼j ›Û| ú†BÁ=¯ÈUQïV‡}3 qšÕË ê³B“؇", nþéBßε5ïMÅW»|¨öMw`â®JbÅO°IZí´ËÛêà—GT… ¶à
6È6’éÜ«n»u šÂˆ†g -ÆwR¾¼q÷ôtí -`Lu ¸Eð<ÉÞbñ^Á²²¿ Däy‘“Ÿf0/_Ôýb^5ämà= ‡tZOà) N @|²(æöógþ[ÀÑŸÑg€z†x§ð¿ê;üÄ›–|—¯t!a’MO¿@>Cuë
¼ -ýŽ¨b«Ê£î4ö©ƒ]úˆy&ÿ„y€±
Ž_Q ‰c½-¢6O„‰O©D à!YO«{ÓÇã¥usÛ D!)dô儾£gßm™
¤TMDâô«$ -øo .¼S$„¢·d˜Š%ŽëG0àÉ´j€{Ü1†ËbÅ:: +xÚµZmsÛ6þî_¡oGÝTÞI6ŸÒÄιsur®3s3m?P"ds"‘ŠHYõÝÜ¿],H‘2eç“\, `÷ÙTÄ„Ã?11–ÙT¦“8ÕÌpa&‹õŸÜBßÛ3tfÒ¬¯õÓÍÙ‹ OR–Zi'7Ëž„ñ$“›ü·È2ɦ`G¯ß]]\¾ýpýjëèæòÝÕt&
..ÿyN·×¯~ùåÕõt&#¢×ÿxõþæüšºl°ñÓåÕ’¤ô8aôúüâüúüêõùô›ŸÏÎoºµô×+¸Â…|:ûí>ÉaÙ?Ÿq¦ÒÄLöð™HS9YŸi£˜ÑJµ’ÕÙ¯gÿê özýÐÑýœIeåÈj1¶&eVIå7ðÓÎm fuµÛ.Ütf9²<ߺºÆ¥M„4ÌÈTMf‚ÅZ?äïÔ%XjŒœô:6Õ¶ñ}2eI§#£ KãØö½ôò™ˆÉ¬5{ìÛìÞŽ¸§Ó¸ð¿Ö»Rööq&RÁd"ãÉL &¬%o/—A·¿ç)3"Á“B]
Ëг]¾™¡3õˆíÎYÈv@µ 1)$“ÜïÙ´_`³¨!†íÊzãÅïœK—ÿ02µL%V‡ae¶vùˆq¥X¢l´öÅjEæwnñ›6*–$jî 5ªÛfMQÞRýP7nM]›íT$Q5£ €Mf&9‹û"w°¥L”áC·£n·ÙzíÍb_Q6n*¢í2ÃÈFISÑÓk»f[@·»o;ïBû=ë¿…Ir·Ìv«&ŒÍÀ> £·%œo¸Í[;0 e+’øÓð¸¢14¼Ÿõnq /ý +ùpeèrðWàø£ŠAù>+VÙ|åÆŽ)… yþ˜b™èá1Á>4 HÕ–ö§ÞTeN‡›Ã!J·!Øâ^âéÅQV¶û¢GáGEЙ¯ P…õC:*®Óv'׫}IP檤E
+.5µ¬1ʼ¤öÿ^ŽÈ£ôú +›GGÁ‡°qU5îÇéLK³W<†@¡3À·$„&4ü„5µçAVï–¨Šy¼(\Ù¬ H¾Ê¼‰Û`‘"õÝb·-š‡)l[ñ© ½¢.H+L‰-†ZP.þãÚ¾+ó0wUÒó>ÛÕ.7Ùll!' Du!¡E4ßaL¨4Úc (t°4X¡Û(¦u/ªõ¦#"ŒXTe“%½d
u®\V‡~aU¢©Î +~çPƒx^4ª%õ†vl @Q0\Šõg¦YÕµš»¬®¢ŽG´0† ðÜËè +‚òý+I¡•Sk=Pç<˜jªŠõ:ó™2€(kî<.€h³Ûn*J6© +ÝŸÙz˜ 6Ø!ùaûpuùoLq0²¦—À + UV
5 Ÿ«ý(çM`íZ=Ÿ²’Ûx°ö’(ŒŸ¯¹«víLô h§ßl‹{À9 c€¨˜£(&Ò‚ý¡¬@s…wß‚/©…$ÀWáŸ_02>â9VÀG ƒ=TÒ âXI`~åbµË +É’4¤±s§ ,r¾ÀK¤«[4.ÇzF½µk¨ ÏþbE"ïT@ñƒýx4,kà 7à :WO:€·¢ív£]
%‘ÌAoXDèªV;J„vd€Äš$-ÉÝ*ë‘IH‹æ‚bÓæV̉*Ö¸Ô¬ Ú áyŒ¿}‡ÃÙ—ä´èx¼èPt Y ®ó +L’<íN§5â Ü +¡°i.†}íFµ‹Ó ãÊÚÏú5D@ø¦Fÿ` åÞj}Ú
ã`*4ý +F,g±JÄ3("$P¦„ëï‰"€Ô\[ýýA¤gø4†¤ ?.¢»¿Vž• +¢ý*á„Ôô ì°á‚dЖ$y傾çëØ KK›s^âšðé Ÿ«¼4üpígh _:˜ÀL¸2_W ÌöøÇ5!COeG-dþšäÐ,åv´øó.¿ù# Â]ÇL%‰<Á"â„éŒ(ÃÐîuÌ ó¨ðß‚VÏõÿGç“rendstream endobj -1738 0 obj << +1761 0 obj << /Type /Page -/Contents 1739 0 R -/Resources 1737 0 R +/Contents 1762 0 R +/Resources 1760 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1723 0 R ->> endobj -1740 0 obj << -/D [1738 0 R /XYZ 85.0394 794.5015 null] ->> endobj -494 0 obj << -/D [1738 0 R /XYZ 85.0394 565.2444 null] +/Parent 1737 0 R >> endobj -1741 0 obj << -/D [1738 0 R /XYZ 85.0394 536.6737 null] +1763 0 obj << +/D [1761 0 R /XYZ 56.6929 794.5015 null] >> endobj -1737 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F21 938 0 R /F41 1218 0 R >> +1760 0 obj << +/Font << /F37 1038 0 R /F41 1233 0 R /F22 973 0 R /F21 950 0 R /F62 1379 0 R /F63 1382 0 R >> +/XObject << /Im2 1368 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1744 0 obj << -/Length 2614 +1766 0 obj << +/Length 3271 /Filter /FlateDecode >> stream -xÚÍ]sã¶ñÝ¿Bo¥gN¾ ¶O—;ûêLã»ú”é´I h ²8‘HHÙõýúîbAš”(;©¯3 Ϙ `±»Xì'$& þÄÄXf3™MÒL3Ã…™Ì7g|rk ÎDÄ™¶HÓ>Ö÷³³ï.U:ÉXf¥Ì–=ZŽqçÄd¶ø9±L²s À“w ¯/¯>ütóö<ÕÉìêãõùTž\^ýí‚ 7oüñíÍùT8#’w}ûivqCK6Òøþêú=Ídô9AôæâòâæâúÝÅù¯³ Î.fÝYúç\áA¾œýü+Ÿ,àØ?œq¦2g&0àLd™œlδQÌh¥Ú™õÙ糿w{«aë¨þgRY9¢@)Çh2f•TA×Uãÿ §ÊºÓó,ɘa @Á“¢lvçÂ%Õb?÷ škV äE¼ÐŠ k,…„÷µŸ~ÙûÝã¶Ú5ÓmUãž¾H‡«L]ÜRm›¢*#ŠD©÷[$@“9Íba¢ZÒ·ÞÏW´¶ËËEµ¡YÜX¿AØ%·ûùO¦R)&Ò“©,3FÖͪ¨‘€}‚›¤+«‡¸x[WkßxZ¾õó ŽIKAK~_å M –Zo"NˆÀ"²ˆX¶=@›ü‘Öʪ¡™ÛˆSï—ÈåÎå¼ðe³ŽˆµŸï‰?ë´Éeµ §å‡§DBZ´"DÛòº*QQZ&EC áìð½ó¥ßåëÀ -wFs(ïh†'‹¢žWû]~ÌPÂÕ!êÖÏ‹eÜ—Óg›ïšb¾_ç;Ú ïV–Õ.n µ.å$Ãc¥ÃšÖÀvîGÌÊ -f…m-‘tq@oª5¸¨u¶Õ8"<½·#´Si[ÿ…ÂBP ~7Ûu1/èzLÐP~»ö5è - ÉS™NŒæ ¾¡â™|™Æu–)BêÁá¬O:ß]mää}'šôÕžö)‡CÙAápøCM“ÊLÆ[†À -^’ä‹ÅÎ×5¥#L^qS0~»„cUßÓD,P{/ã@éÈÊç’'mêdS¨Å´9¨h»(„Ô(Àò\qÌNap[5+‚~zÿ‰0! ÄšŒÙ‡¹jöð¤ÓlP¯@ŽfrU -¹Ç âÚ:·!¤!šÏ·«Bj‚µª ) Ñ+š ²àÄ!(4”U'd ÊëDÌñ‘¦¼‘º‹ƒÔa-“¶~ƒñ¾ÜFš÷ÅÚS}ÓÝ ŽüTÛŒI—¹Iß^ç\èÆ&³à]Oø«]_Z¦]ª¾ ¼?•æœ”vØ“aDƒÿ;—éˆN5SJØoF´BSûíÃHŸòé0)ŠBhPâÏU(SõÊñL Ñ7à#xÑŽf•ø¡€G€º˜ÖïÂŒošÐ*¨4#ç ³Tч6xá 8@§ñ¢ºš£Çÿ†ÿ|½ô”‡ô/ùuvóÿï!P)aºû'
;ôIQÀRA„~ÁCT -©+Uß4Ñ*ÐŒUÙÿ Ñö)Ÿöí³É NñžBr¾®«‘ ªœO¥ñ|
ô7õc¼ùóùD -}–Ò]SáaŽÎ˜r-yp6è6_ÈÎ`*\µÙù´wô/øu6óí½£o†`sZ¹ç+r¨ -¼vJnsÔŒq¦þþ,ók„û k…@wÄý½Çb¼ ¹R:¬•L“»uu ½a˜ZuCP¸HX½ú‘!7†‡«º¦ýiDqIž¶ª¡Í$+’ñâi/íŒ \¡öeD¸þ8»ºü'Áàßù:Öáodvðtø°ò¥¿É߆'JQ|Å[Ñì¼Ú>D&)Z{åÝSŠKh~ñs½‹Nª‚z ‘ õ¨<¨7¿ Œvÿ€ßŸ"§ëÏC_ ¾‚DŸWá» -à GÌ×Ø2… Ÿ¹öÇàŠáC\xæ4ô ©»÷G _]ð ô‹8ñP ;„|>_¼)JfžjÕ次{ ¾ÆC¾p¦Íý=ƒ&ôˆªÑ,#ûøx«c¢‹R·ö9Ø”Gs5’Y“¥C}´G—’áÑÕá…•4ÙÀÍûe¾_·¨Kš4 - Ï’«%-À¶‘Ÿ¬cRv?¼¨ˆÜˆK>”é.¾¸÷Q¶ðh® ï€'ä_Èìmj^uÌKjÆMwA5fŸ
øý"[DÎd‹8SUíŠ5ð
ò8x2>ñkHʤàéðT‡Oá: >Žÿ*¢Œ8’¤r2ùÇ -Õ¡4 UƒË˜NyÖWC`zZýT˜Ñ.LÒQjʾô¼?ÂVCR]%6ÂG„÷ÊÖÞßÐóE »æ´®áHRÚ¡‡¸&Z - -¿m´yDÆ› Õ™£ç:ÃAQ? 0è‚3 êß üfÛÄÚ"º@¿À–±ÒhjøÎ ~<ÊŸ ?qà‹“åX”TÔ>®>zH§‹ åÞäÿž¶¥^ø´)6~Z”ÇÏçÐ#¹g…ˆ(Ç2 Î
´]°Ú⪼…b14òºõ€ú¨Sñ)ª¤n –×UyG½¾Žq“ z%ÀLR>ÒÎMQî §£
9Ê0a‹ßmŠ)Ý.陡ºg\ VšOq¹÷t-$' cÙÚ$pmQM÷<$QlöÜçë½ R–.²Í {T5W Çm(Þ¼2 Ä ¹=Þ5ίþ¼÷‚•B_èä‰_RÇ´"Q(TtÊ?þ¨~,ú +xÚÝZÝsã6Ï_á·*35Ë}sOÛnv/kÒÛõÍÍ]ÛÅVbÍÊRÖ’7Mÿú(KŠìÝ^ n¦“™¢@~ +Æø±J ç’x^¬g(‘¦*>=õ“0“¡Çx¨£{Ó,©–®w¯Ö ¥„KþuRd +Üš#$6{oÐÀžÑ‰$ò))£AqÏq{¹LU´‚ÿ:ºšº†ŒÑ ©µÂ)‹‚ JÈØ9C<ÚÏôhßðÍõN/^70ŸÅ`JaÜå``?£T +÷MU5OeýÀ½ »²©y´üñ±zæQzþÖ¾—üŒVBê€ ’d"4Iç×fZ¹Nƒ¡çò1A»¤¨™ÊV Î>/¼çš‘>J Æ %ñ¯‹Ÿ¥ÔužÔBð‘EUs—WÔT•mG”÷$|½þ‘™7›ý¥²QѶ¡`©ó]A-m±ÿD0ÒìyêK=ù—gh‹šnnW×oþCô$ä…ˆ +/h·bC ¡ÿHÞW,éæý8(IêëÆ?7 +f^Ìíçî¿2êÂߞʪ"êã¡\À€¡î5šF~à>Þð„)æU·åš¾˜‹í[ ‹yCbŽ»ê8A?é8Ž ›}GÔ.&â® gûX¬K„(šžJ‡T‘¯·œ#‡QiV¸,6aÍÇ×$(X0l–þ I„ϨEQ³xÊ@@ð¤uÀç¨SÎpM´H—íÁSN d`È=‘à°:P›â>?TõžžPžÅ‰^1{ÃÖ¥·Õûë·D}(ž‰X‡)Ôºc c C[(oaê6² *ØÌv Z Ö‡:½¡€ +YzÞ1g[>ÔÅæoðbÐÐ%³‘î>q¨ˆÆ¸çÞà#Jý,ÔÏi"j¶, + èSY<ÍÃõº~¹ÝÓ³øõ±*×eÇËÊ0~ V«ÐeOÏ]Âß07næ€ …”MM +áæIi A ª:ÑÀÞ‰ð|(?yGa?ó‘©àÅÃø¬üR–6"U:Ø©ÅòeëZ_éÈ{Fb¢¨°º¡—Ó¾Ü$±ùR¶2P£iÆ=V¨ëÙÉÛ J¦ +±åÅí‡ÕãPù7×ÍÛ\¬ú´Äu +°ž6»Ã4žj@½¼àék7$ºfF¤ÕhzÝ×ñ3R@ ‚pm”!#¨XøùŒË¯Ÿê€— Œ9'8¡â4ù2ÐA %Ét0:-cl0vB{|cÜ8ÌCœPÙT(;|Ø ³•/.÷¡Í»c9A ›Š‰QÝZì ;®BY] ~–‰¬¹&
•—OœÄÖ9Õ ¡ð«“…j å‘KÌg +Õ!×éBµç¢|ôë2ÔÉèÞeWîŠeY¿¨ZÁÒN§ñyMz®UFƒàq2³c]®ë;Ø``qeãP»5Ü´X%”uíü\5õƒ¯‘Õ/µDù’ÊbñQ?SÏ]Y º‚›¹(²T”ø.Å~W. XPL»TÙ1®jˆ¿Í!CiÉ` ""4‘[ØI·äññpàrwØÑ˧¼:㑵e±ùó`ÔXš‰Ä³h‚âW(%“óhrFSÏ5‹¦rSÍ£)…L[÷³šô\3ªŒÑ¤„2ŠGº Ѥz4©1š¢ã!IañGÏG¯{óp¬°ÕWûªG–ê‘¥otX–\ª¯¸ƒKMÀê:ÿWp¥§°¥ŽØúÿA+N…N³ø3ÐpVà:¨šC÷[6°Ô¤çUé¹ftcˉ8F¤•¹=t .
[=^ÉqÏ88ë€×aªÒ~÷ ¡lå¹icà©’»¦<Õ»^xíê.ˆÊAI'Ý_5[Ip•ŽÍg 5à:©Àu:[ÍB +J$XΫÒsÍè2†T*Ò,›(s„”‘RFÊQ¾’꘯€öù +ž3ù +:ú|%¶¨¯ÏWRó• ðBÊç+éáåM +=׌#`¥ l× ª)ñ¾Ê?¡ÕŒ>ždiÓ§h~5›M¹öç8þ›×˜>Ò†•šý5m¾áéO7Ä€±ãË{jàÔH²ËœÖ‡Ý o‚KØäs,µh µ%‹ðàûÁ£,ÖitEgÐÞ ”ò@{ rzû¹‰¯µå3h£ ‡«z‰4ËËeG_ñhuÑ=5ûôr—×›§rÓmgÏV—NGhXôýi:’|.‡m½@{-°H#/îïqÛ«U¸¢ 7²Œé¡E£³¸§-^¬y@´?)ô,ý©…òG`°¡…M•å˜n +³™©yu¥>±ÑÖ©H ,Bò4ô'xÍ2XQ5Ú™ûí¾Šü¢ʺ+p½_ð:zàãYd9¦E AÝãì¥ +{BéQ šÖM½´—]ÑÜ`âÒ‹õÁ–³¹MË#†‡08“
N—ñ¢ÆâákGi»ª¨>0át
v(Pïo_q“÷ÚàìS3ƒÃwüR¶íÁ ý¡Ýœ»ð²Ñªìù+ÕrxKãæÒ†}¹ŠdRáöÛež ž³±)®t&yn«žÛŽ{{2IÃkÄ]ÓmÃÒÁ‰ »ú…Ý8Ìy›úfH%±p6Îί C®ÓkBÏ51tIw £!΄”êÏÊï¹f-°è9 ÂHLíBnÑ6²[æÔ ZŠÓPö%PXÿ‰Ð4:ŽãQT“@:©Òá ZŽ± }ì »Ú‡Éú°'Ç{‡ûax%¡>\¢(ØU™éŽÝg 6ú@1¼Oô—8ÆÒ5‹¡ƒs|ÂÖv9 :{îŽ>Pñ zâ7܃àOA²$ÜÚÂwGMCò¬?®òì¼ x±[–fßaÖ3Çï#(i³^¤vsÜ«>Ô|8=X*fŽå¡.1ÀµJêtäZ^=®k¼4¢e‹OkG«U8%]¦«UÌáOÚ±ƒÍqæN¤ŽãtO'„¼
…(]‚n©y…|™ ˜äeÄ,ÎìÄ 'R +ì$¡$úÌ6fÀt:¡¦áõº¯Öï›ý.¹}è‡~ö¬=ÓKÆ)Å ëðHúƒrÉp·‚¯þê‰;þN^BŠÝá;=5Dl l„iðlzVšUûõÜ*f2a]Ÿlêb òŸ ÿ̱r Þí«þG/“€Vºã]MýÌãÍF, ‰ ýàÏ=S<éžÔ„óx ÆýÑü ?N§D’N.3èꎪÆ7~ÍôÖñ¸"f}‘Ë·~|+éjfïåŒ=À‚ø‰7s´~No9úÄ|¦‘VdJ%ãìvÒ_&ZõÕUöÆOËßVgÑë›÷ÔÂeµú²[9ÿ5tyî&Ó·† xêLOß6ssÒI*@ÿø ‘áð§ùúëîÏýNüÄoM"ðGz31*ûŸÁýéß é¥„±öÄŽÒÈTXí² N'SS͉ÓêlFõ߶ò‡»endstream endobj -1743 0 obj << +1765 0 obj << /Type /Page -/Contents 1744 0 R -/Resources 1742 0 R +/Contents 1766 0 R +/Resources 1764 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1723 0 R +/Parent 1737 0 R >> endobj -1745 0 obj << -/D [1743 0 R /XYZ 56.6929 794.5015 null] +1767 0 obj << +/D [1765 0 R /XYZ 85.0394 794.5015 null] >> endobj 498 0 obj << -/D [1743 0 R /XYZ 56.6929 289.0049 null] +/D [1765 0 R /XYZ 85.0394 654.332 null] >> endobj -1371 0 obj << -/D [1743 0 R /XYZ 56.6929 265.9485 null] +1389 0 obj << +/D [1765 0 R /XYZ 85.0394 633.0122 null] >> endobj -1742 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F21 938 0 R /F62 1361 0 R /F63 1364 0 R >> -/XObject << /Im2 1350 0 R >> +1764 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F62 1379 0 R /F63 1382 0 R /F21 950 0 R >> +/XObject << /Im2 1368 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1748 0 obj << -/Length 3618 +1770 0 obj << +/Length 3272 /Filter /FlateDecode >> stream -xÚÝ]“Û¶ñý~ŽE7c¡ø$‰GÇ9§Î4¶k_¦Ó&y $Þ‰c‰TDÊçë¯ï.vA‘¥³ÛÎt¦£.€°Xì7¤®%üÔuæ„4Þ^§Þ -'•»^n¯äõŒýx¥g ‘æ}¬ïï®þôÚ¤×^øD'×w÷½µ2!³L]ß~½úóË÷w· næÚÉY"næ.‘³ïß¼ýz<}^½{ûúÍ¿|xy“ÚÙÝ›wo©ûÃíëÛ·o_ÝÞÌUæÌ׼™ ¯ßüå– ?¼üùç— n~¿ûéêö®;Kÿ¼J<È W¿þ.¯Wp쟮¤0>s×ÐBy¯¯·WÖá¬1±gsõñê¯Ý‚½Ñ0uŠÖeÂi›\ÏYkLrY -é€kóÔy‘m:.k5Å刅\Þæ_æí>¯šûb£²Ù¼\mŠyY¯ÒD(—øëþ '”tX¤è )*SB™LiyS-êCµº™egÿ¬«‚ H^CÍmþ©¬ ®júîíõCø
cÂ)huÙÍžr³mY nÔ¬-j?–›
á,â¶Å~[Αp ×à æJ ïœäVy[¬"ËÙݺ éY÷ùaÓR·
Ò+é‹›† ±ñ›… p] öÐTãÅàrÊíaKÏùæP ×Õoš?õµÒèᆴöX YjR• -•hÿŒhõ°.ˆVÄš¶ÜóúОÈVf…M\r™”k‚–¡lya-JjŸ˜w‡–…K'Š… ¡žpas“ÍU Û›„¤z€ö:¯"Tò’© -f%ÏÒaMÐ2©D$i:"æ(RFF‘2Rì•TG{p°Wð°W01Ø+e‹æ{%ÕÐ^É(^{%ƒx–°€%"+Œ\*,òÿa³ÀezFÀzX,b!‡šb_æ›ù ‡bÿ4ß³N+‘BûÄ]&¡Ãš a X‰:M³! 7ùgäšÑHÏg2N¦3)н2ëU¹Ì7›' Óà6oÚ`° »7_ÏÚš¾¿I©ƒ%ÔÐYÞS›FÚxApuØ.p [Î cT6”5ÑœùÙŒäC2«“Ùm¾\SsˆP$ÀCd œ>týܵýBú2P–{êk×<Ølº é”7sˆè¾ãÕª¢}¬÷Ÿ¨±È«Õc¹j×A àŠf÷îÆ벜þ¦Ü–¸!D´ôuT -¦î]ÄkŠe]làBKˆÊE†ñA_,'m›–GA€ -{:ËW«OF-Òšl[¶d¶7Šp0œ -ÍÈ7MMë÷ÎÂ:mRÈF¤ 2¯FOPάq
² -àÛwwo^ÿ78³ü!º‹ãù Á÷±¤f ±¨Ûut l¸pj0P8Õ @4MÍYŸà´&uÏø„>ÖyŸÐa77v6R‚©¿¸‡5AÀÀ!€Óó8„A0µ¶Eg³ u˘3Šà1À@Ë3ô6M¬ÐÖÚVÓ†MÑÒ~$ ÐsÔ]èít‚îê &ËÞ.>\xX†= ÍáEAVÕs#d±Âzt£ScÀl6õ#*Ž Bâ7>ðÖ´ /e!vK<ðP~.*à +©cn⸧Ϫ¦ý€Èº%töaÛ5ïOãpê)³Û§ˆŒ63àÄ´1Ç\õ¡ªÙR ]ÅéÍ*”PïÌ7\’ -´-'·f» {+½•;ñV–Õ?\£¶ ’ãÔŸ1 Çãž7yÑš¬ú‡†àn¤`½%ßfS›f#†œ1)Ö%Â{g/›”>Öy“Òaîôs˜ûz¿ÍO3gqbv™ˆk‚Š¡]ñB‚3 ’ñë)ïú9 6—èÍXð8ÝB|)aÒcMÀ -‚G8 ¨C¥ƒ5/¦|™IEæ;“SsØÿæŸÞœÐ©.æ@…™R ‘I µ³&^oR'À: …†" U…²É(2œ–:æ0䥫 ‹.ÉÌØĺŒc’4„ÔGX…²ž_L»P7 Ôô]¡´P1zçšS¾Þˆ¿p•+ò¢£s…w’õî„Y#3‘*冼9{_&Zu1Å÷& í'õÃÛÔÃÁõ†à{Ù -Bz‰À²è÷.ÉF®hJd=¦Î¤AÜ~û•’á…U.JÆ._~bÚó†v ù8ÅK‰Å³£€é”vÒí
uæüÝÕMS.6Œ -ÑsÍãôa ‰I9Ô~ÔgB*ƒý’wßÖÇÜ"…`hƒ—%hqp
f¶)"Ç“ê*d -!ÇŠä3¯ö}¬óRØa
¥0ú±ê´0¡ošùä2 Ö× -%ÒTú! \î¿ú@ãXÒå²’GsŽ
~cPƒ·²Ð\STIJˆ] Æ<‘½Áü=Í빬ÇqY¯âè)€W…¤e·u(s@Ã&‚Ø£ƒ…ïžìûBåBåÏ•¶à“®v«§l¶ðišô¼‚‘_å€[þÄ+ Åb 8YprY:ˆœð¨Á;°2KðÝãšNðŠ ùFé Ÿ¡¨ˆƒ]D¯Ž>C§ì3ðY %<òØC~Jé‘wèm©Ø; R]¨é_"Ð%Rz—xÊÃQñîk™èðáÀ\l¦)úÈÌ üÄþš¿9
ÃÏ0•ÂÏ -+õ¸ Œ; L± 6ÂC.5rNôÞl@ßðiÜXü ÇÊž þs‡™uÿíuè - nà[9¢„Ô‰ »Ï(tØl–=–íº¬.©lŠ˜ÈæpâÓ5D…:ÔÖû©Š3ÄÖ‰‹ÄþL®#S Ù8¬OïKçÀô è= öy|‘¡ú¼)Ĺ¿_'ð?Ó~ZvYÙü×ìãÿÖs&ËÎäDF& ‘>DáyS5¦ÜAfì2Nþ/Y Èendstream +xÚÅ]sÛ6òÝ¿Bo'ÏD(> à1Mœœ;×4—ºs3×ö’(›S‰TEÊ®ûëo P¤DÉÉ$37ž1ÀX,öbb2–yé'Ökf¸0“ÅæŠOîaìý•ˆ8³„4ëc}wõÝ;e'žùLf“»Uo-Ǹsbr·üuš1É®a>}óÓ‡w·ïùôúÚêéÝíO ®gÒðé»ÛÝôþÓë |ýéz&œÓ7ÿ|ýñîæ
eqïo?¼¥ OŸ3‹~ºywóéæÛ›ëßï~¸º¹ëÎÒ?¯à +òçÕ¯¿óÉŽýÃgÊ;3y‚gÂ{9Ù\i£˜ÑJ¥žõÕÏWÿî솩£üœI•ÉJÙc Ìxo&Öx–)©w×ÂM‹¦Þ`QÀ…½‹:|—
uæñ»›¦œ¯#jYµu §Ï¦hšü¾`È @ô(^2¸98MØ{“Wϳ¼jžŠ]±ûôfpÏBùˆ\ÆÝ7DTܽXaã7Îå¢,ªöôJ5ïÛH\œTWëg‚šýv[ïÚb‰Nf2ãÌy¼‚y +!0˜}BÔ3*Dšã˜°™Þüæá“M-ZâÏ}Ñ´Mú- ä‰÷¿:¾ÿrS¶>•ëõÐâÓš«}S,¹ù»4ïàë 58l:¦Á +¢Dî…ü>#…ÆgÌK%/Ka ë¼vXC)LŽ¬jN„Q:°»J\¦¢Ã!cpbV\j3¤ƒ8,øA±‘„QBÔîPðƒ9ÇÉ"B=Y Í +‹¢,b×<bžÈÞ`þ.ÍÀV'C“EJHŸ§ +!=ŠÄgQq,LÀ4ëRÔ¸,Úb·)Ag@1Á +<=”˜#˜" %¦ùrë
\¢Š6¿Ñäv¨+ Eùø¨ º{ó‘ +®s•/âœß¤Ô‹uÝÌÆî ‚Dä,P# Âq;ì X}(* ÿ ðâî!˜SÀ„H›}Z3ßn‹|G½e÷yˆk
×V¸ö?F+%"cFdÉ
sê§Y§ù#Å8Ë4—ÉwøÑ(SÑ+æ˜ë¡o +LV*EP +ùO% +èl¿CåC©PÙ´\B7)Ô9 \þ¢Ä‚ ÅÌ\G¦…±dºi +ÈX wŠCê,ÍX ç’Ù“¼‹´IŸ`ƒœì˜Lq1ÄJì29”üM˜˜þ‹Œ 0t 0¶ãxNÍä€ K*AÂŽÒH¬9ÀHrÌ>D(ëý’œ3tç£BnC~)Gã2ÓÇÞ3ÉÄ Ú EeOeûPV—ŠTÚ2kxbs8ñéÎàä2iµõn¬â ¡ufq?£ëpëS ;‡õÇ0Ãë²90=(z÷û]N +€Ø³.N¢…Tn×\1•ùìs ÄÅ·
7þ +“K-I× +X.»¥ë‚[‹* ÄŒH—SÏ”°FˆH qL)î†Ô¼’Àûž ›½×+h
JNVPzmSfcy̳-ï<Â㞉;&D—ŸgÄñÏÀ +-‡Þ)>îÀ> ~€*Kº¡9\¯´êø½öl¤pL†ÉíÞ™/y§$"
|öBtÓC:/E éÔ]ŽoðÞí)éNIÈP²Æ¡«OË/áEÛ%áü@˜œë “ó=ajh¸Ž`Ö““¡ê Œ`æÞÄ%»Hú{U m©ˆã\¿ˆýõX} |³å2VªzìÙSƒ°ve®¸• SÛÁck”…Ñ-dñVvE‚çbì½b6t*HüÆ
×þO ]*%l¶y[ÎËuÙ>ª`ç~L¨ Ã_ endobj -1747 0 obj << +1769 0 obj << /Type /Page -/Contents 1748 0 R -/Resources 1746 0 R +/Contents 1770 0 R +/Resources 1768 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1723 0 R +/Parent 1772 0 R >> endobj -1749 0 obj << -/D [1747 0 R /XYZ 85.0394 794.5015 null] +1771 0 obj << +/D [1769 0 R /XYZ 56.6929 794.5015 null] >> endobj -1746 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R >> +1768 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F21 950 0 R /F41 1233 0 R /F62 1379 0 R /F63 1382 0 R >> +/XObject << /Im2 1368 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1752 0 obj << -/Length 2482 +1775 0 obj << +/Length 3358 /Filter /FlateDecode >> stream -xÚÝZKoÛH¾ûWð¶0êéw7‘“'±³ dœŒ£ 3s %Ê&"‰ŠHÙã]ìߪ~P¤DÉ` »‹ÕÕÕ_½Zf …,QšèŒg‰É$Q”©dº<£É ̽=cg ™Æ]®Ÿ&g?^ -“d$Ó\'“yG–%ÔZ–Lf¿§šp2 4}ýþúòêí§›ó‘‘éäêýõhÌM/¯Þ]xêíÍù/¿œßŒÆÌ*–¾þûù‡ÉÅŸÒAÆOW×oüHæ G„Þ\\^Ü\\¿¾ý9ùùìbÒ_FnäËÙïÒdÛþùŒ‘Y•< %,Ëx²<“J%…ˆ#‹³g¿¶;³îÓ!ûIn‰Ú$ T±—,+¬³¢ ^–ÂaÀV Xþ¨,ÿ YŒ_ôE-#*ËT2ËÅ…m—ó„1’)Åñ|!ÜX£œ¹öç{vœQZ2dd”(Á%HGŽ÷£±féþçéÁyXM28‹ÄÀ:Vp\9ù’0Be– ÏÓ¡ÝVw&p?^-yò¦‚
%Ý=¹ãŽ`·%Í;ˆe\ÀÁH‘ Lf¬SøcµÈ7€B•–õh,t–‚Yód¾šy¢<‹²Øø‘YUþUÕx¢Þ®×LKšÆ‘¢iÊÕiî‹0Zm7Ó@ç³Ù¦¨ƒ¤ùHÐ$€ÙðÌÛÓ -ü×ZïWgJÓ'Ì:ÕÖ¿Ì*|²ÿ`౬ï=åa„s„A<'E0xÂtç<¤´I9*ÿ¼
ï€ÐÙHê¾õ}µ]Ì]4ÞðZtv³—E#Ô=œQ
X :H#aÝ7 ã -C=u>Õ#…ÍzÂñ ¤lÖTí§«0Á`DS.aàÌCY<ÖAd[oÂx½.¦%†#8‹ÍQ„ÍŠy¾]4á+ˆa‡Ám(Ð=$¬ªCgÐù3 kê -6¸4ªÞ2ÔÈ% ^’Qèy¦ƒ §¢ ZÌ)¤ -<PEçÎ4ª{—aýcZ-×ySÞ–‹²yVv…"ƒ¥
Ôø'QØå:ŽÂ–ˬ)çOÇp›¡Ï ™žYq8¦ <÷ôòû
@Ui¬9+ -wQàs.>ëÂ_ ˜ôúýäêò7?º=ò»¢/ÑZ@_èï lWÏÀ¹›0µ^»Û¤Ë•—®`™EþÉbó€ jdú·¡æR@ -g¼-B—9DûÍŠ¡ÓU\Ä8éúÇ!aKµçuÓE¾EBº8€O§¦Xª êjHÍ¢#ý«Ç±‡Â€.*¼ˆèQ~-w;È¢ñ`¹º@µ,VMxÅkG¡™\YBé(ô0ÔÒ¶½UÜcîÈKJ¶A‡i -:0É,•ý‚î6dœØ¦œÍŠPÓUî ¥¤]‡Ìzx"mgã«ÿä6¯]Å*ðÉ?ËÕt±í -Ç¡”n >*©_n šÑÈݱ;Ê,!ˆ‡
[ ¬YGrzŠÛ[ŒKBMqýµØþQB‹¢U„´3Æ ÍM<î[ˆŸCø_…€ ¯g¦Õ -sÒÝv“clðƒ8²(Žv°‚M”5ÿ¥·¼\h"öêÊ–gX[Yù=;XècðšA|ÿ¶+ùDË5Þ¤PöÿÏÛ=åÿñ{^H“ú¹:¦å:ˆZƒ7¼”Xˆ]Ñ—„ži@ ¸„"V(Ñ×à]ù¹¼Ê#{apÛrÁúW¹.£¸ëÚõ@¹+QÝ3äMGÇÚ"¶5«¦Ï‹¹AÔ®ØÀRd N3ÍW ;(À¡Ú_÷˜&PÀ2J©/˜PÞ(˜<õZÈ:š"Ý]¼<Èñv¶ cy5Tv(žµÍÚí4†ìm¬Kò‡ªœ='À,¡õ|©L§¥þ*-!ÀfGúXÌ_Vîé{Zº…r§“_±IrÇ+´+ àM:R*æ~ÎU†ZC+(³éÞÕ‹mœÛ -t -bAEú±8èC¤Ä–A s¢}žõs›»0nº¿¾Föq‡ÿФºQLCÚÍØõaWF¡q†„Ó‘?ÍÓi-b4cœPÆÿ ™ßVÑçï«Ç½ -%ÈËE~»ˆ?ÛÛîÿœÓ6K34,£éeìC‹¿òåzQ„è‚%ÛÞ -ó -+òöçŸý’ÈaV²þ«€jƒR5ìCc
±âŸþ±ÉWw…'7ÚzR+%Ô+OÿëÕPV pž®X ሾ:XBápX¢Ãá—ú;ˆíøãþÀ‰Ò¶húæ¿!Øý…„ +xÚ¥ZÝsÛ6÷_¡·Ê3‹o’—§4qrî´NÎQ nz} $ÚæDU‘²êvî¿]ì‚ "e'×dÆÅb± +aW%žúø˜mòÕX"†AÆ)ÎEa <‘8‚O³àݧ]ãˆ{
í:b½wKõà,Vߣ˜OZ¡]§ðïሶ[ò$ÛC'Ë~H1Ô‰öŸ‡K®>‘ó <hp™€h§¾Ó!‰4IpÍ8ô‚Ò$Öî¡Ô†PIÜL I(TÀ9A Ú ¸G\õ¡)° Û†þsË •hð¾Ù6~œåCYVta4®P[øó° +Úa˜XQiÜ_° b*a,1I§‚Á J>‹„§O”ü”
§”Pù„} 1æôÙ0Öyˆ1”¾ö†jgovT—°qY·g:K7Õkîw×1<þ~È÷O}œ äúHGÐ@tôé¸q qX•Ñ£wOd'¶4sö/O^îd¯ºD …¶ÕÑç P>–‡õŠ:Q +²ˆµ1¢bÑ ,dëª$ñ7Q>…¡{¹]óÈ~)ÆA ¡ö"H[v†}á‘€„èÿgvþªÇ/…<w¥aT”(ÕÇ™±cÓ32¨¦ÛÇŠô6a_Øí‡í*óûª<ÐË@Ï°|[å¯yy ò§¾ p v%iÿlÐÒ”Å*_…PϤ`‘-¿ IÃ*„ýÍNà¢XõÓ ÀTß•UU,ÖÜ\À+šd¤¡»&7ðl·; í3á`$ßH9ßø¸Ë‘„fòù©ªó
ßüç!Õ¦,dSŒ.ñIR2`~Û¿?eÊ›Ýs«'Ú@d7Ùö‰åÃÐPæ
߀ +÷§ +ü܉¸7‹grâF~ÄÆÞÖèígÅþ“¬ $èx«/MÚ³føQ3H½`ÃPÚñ¦ƒ£/ckûYÁ¸Ö½Ô^›8«èËP¨m£¼6På!tbO‚Î0ž +u“¸À;j9ÖB4 ›
3ý\¹Ö€ô&s$ÀÄÊíw_‰äçšê+¯ K Èáé#Êy˜K›K:À ;ý¸eÿýK4 `‘:˜Q%P-%ŽøB¹gB©ÖUuðÈŽåÎx#|ü°eÃåà‚ß_øðc˜\l‡¯ÛÒøïåÏï¿2B>T•û| ¤Â¯9êùa¡á¸½à¨ 6öžDkAÞS§?ó׈kÖ»Ô9lv ‘ó çƒG‡×3 +ÌIâ^ ˆi®ŸÏ¯ˆb`¤{aI:RϬIò–eu6¾(xU'Ôó#7R#C÷—%ŽD*mlòg*;ë/m©ìW&ÞJÍ7%æTX®Cÿ¼.n¥×F«vœvÝàetÝðëqœÆß¾n0PøyA« ƒ€ŠâÄ©þõs±06ä?m +b© ÜPºv奓ð£¬å…släá‡=—Ö¹O}ePßNÓà1YC’ž€÷76ôòîæsÛ«Xý || ü9ó)䊜iÖ3íÇ6*‡º='>Ývžß »ö×GX—Ñ㘱ŒŽÃÀ ÑÅùtEÃñ+`KûDÅ3±€Ý95Y p;ÐGŒ‚Ÿ”6ÏôiTðM‘fwBË>+*n$a×é¶Ó]8¯Pb”í2\×0\Gá9oY²ü†n¶ è/© ¡é÷û™Ÿ‹iáo¼FpJ4ŸßÿöOÉÚßÙAî¡“D!uˆ'Þ
²Q¸±>ûUchúÿ endobj -1751 0 obj << +1774 0 obj << /Type /Page -/Contents 1752 0 R -/Resources 1750 0 R +/Contents 1775 0 R +/Resources 1773 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1756 0 R -/Annots [ 1755 0 R ] +/Parent 1772 0 R +/Annots [ 1778 0 R 1780 0 R ] >> endobj -1755 0 obj << +1778 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [442.7768 128.8813 511.2325 140.941] +/Rect [471.1233 483.7823 539.579 495.8419] /Subtype /Link /A << /S /GoTo /D (query_address) >> >> endobj -1753 0 obj << -/D [1751 0 R /XYZ 56.6929 794.5015 null] +1780 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [389.4645 212.4953 438.2112 224.5549] +/Subtype /Link +/A << /S /GoTo /D (configuration_file_elements) >> +>> endobj +1776 0 obj << +/D [1774 0 R /XYZ 85.0394 794.5015 null] >> endobj 502 0 obj << -/D [1751 0 R /XYZ 56.6929 188.6884 null] +/D [1774 0 R /XYZ 85.0394 540.8756 null] >> endobj -1754 0 obj << -/D [1751 0 R /XYZ 56.6929 164.0083 null] +1777 0 obj << +/D [1774 0 R /XYZ 85.0394 517.8101 null] >> endobj -1750 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F62 1361 0 R /F21 938 0 R /F63 1364 0 R /F41 1218 0 R >> -/XObject << /Im2 1350 0 R >> +506 0 obj << +/D [1774 0 R /XYZ 85.0394 293.4989 null] +>> endobj +1779 0 obj << +/D [1774 0 R /XYZ 85.0394 267.9627 null] +>> endobj +1773 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F62 1379 0 R /F41 1233 0 R >> +/XObject << /Im2 1368 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1759 0 obj << -/Length 3547 +1783 0 obj << +/Length 3373 /Filter /FlateDecode >> stream -xÚ¥Z_“Û6ßOá·zgj ÿˆu}JÛ$—N›ô²Û¹‡^ d[»«‹-¹–¼›Í§?€ -;ªUf ‘u
ë þ}‹’ÌJŠ$ÍŒ-¤Lrc”"BHÚf| SzÉ·‹zÍÇí”ΣM2¡
,\"MJǶxlªõâ1] Ö»iþT5.OÒÔÕ Û -»ÄeÚšÖþ…iS~eU€‚•^áJ¨ù¡-×Ôã=;¿Éå#îú©yž(ãÜKÛ¬ÐV³?6žÏê¡iZ¿Èh©·êZê€
]Ó ›-´‰Py6Þ°¶9ø W¸„4÷G™Zþ¸¨£{(¸Uµô»Ü4«O~É@¸|¦ÎgœÑ·þ+„¢õ?x6±¯ÙuqÌîtvÖf4u—ç.v»Mµ*ºª©Ûïø½»Hð|þç¡Ü?û¥‹°d:@Od‚©™7ß°`;Ýuô« HN é×ì ž£·ìÑ‚áÌk›³±!QÝ>¡øØ~j›5½T7<ó}ÙųÚáÍcEÒlëj´JÕŸ& -¿OKžeƒB•k0<-ôüfUlü6ÀÈc±9„×úãà 0‚U>z(yF¯È»gTÄ„s8–ù)âÞóÔÚùÜw
Á¤ü\À¦•ßNEPØiTˆ‡òí„:%B™LÇ!y-™'9ylU5è«àPç;¡åÁ’¤Èt–J§Ò ¶x¸•Öä= LËZ¡‡"Z5-Õã#ä^³t÷Õ}±|îÊ©sibS¡Æt¨y'„J³$©Y(Úpº×ÚDïÒc["nÒŽ¢&ôÅ@c[|®¶‡-=Eµ)– +¶Í¡î¦DVV&Φ†X—wÅaÓM#ËÜ93øÅöˆ?+ú -n=Lþˆ G -˜Úê#È % 0D>³±?¦æ‡ý¤ØÙ{¶
†]–G/AHZí+ï6©cò Á@bt–ÖV_ÊãDDCÞà2§f&K@¸Ù_IE*ÌM'"‹~ÆE<%e±pÚXØŸl`ìE„3;±EJ%©0;’ÆG«ÈŸ[‘VAƒûû5>F™PO?!ãèhœÌ‹üoÊÕ x›ÈciR%J¦ùHš“l¬§zA†ÓÙP†„ ˜¾ÌŒg
äƵŽS |ì㬂@Þ–]è ¢<ö® Ú§®ß$×8ì©Ñž„ňŸlèåX Ñ õ?ß4n`Â{“8ˆ
±¦þÝ— wØ1N…þÖÏ…-ïÈá×G&¤ónÎ4ç"ÇŸ 3ÿPó‡Õ·ˆ ø¢à`A -yš†p_®û¶z,ìs €ciôøt¯6UYOæç’@Ó×`ü†±RȳaIƒ´Vks9,ÅTçÃRO…R`ÅbS¶'QIÀÒR—]fÜSMp E%á€#Æ k³8!Ìæõa»$”™Ñyß ¢èÂk ÍØ£A¶I•AÿòÎçfÐZ55lùŽºï!¥œû3n!†€³T`¸“1+Ó@è¹\Ê—
F7H›^@:…œN¥/ -" èÅdÚàÎ¥Ó´É„¨¿ 'â ‚²Î¯Â‰Çå“Ü‚±6,çIÁõ¼›Hö¿QÀÓ* _v¹¨ÂªrÊü°9OQS_f8*bWHá°GÅ4 -!“» î!´ßq]¥G)ž5+¿‰Öe_4«˜ê¼YõT!¨TŸé"k±iî“&f%@Q‘_£§šc\…´If¡k$`ë*å •°oÙ6›²Ã2zjS>âábµ*wtOþ -%¹ IÐ5¯¿"ìCR@(õÈ™ì(c]|ñ,t©ØVíy¯‘ê¨^ˆ@1Õ¯¨p1MÛ- -·ÜòÝýWÇ!ñ›¥—â@DuaGÕ8«Œ2ÇÑ~š<É Ì‹"ôT2Œ¤É"ÏÇBLAv9lR ÙaxÓuÙ Z¢"«æEp ¼i> víÄÉñåy2-® ù¯)>€V yÀeùPlP ¾ PàWYgX£š—ábwâÎ %À)‡•Òp%+ÄÔ]•Nrü¤o¨> -5ÿ¾\TŒ€É)"b+҃ǩ½t4Ìw‘Ð*hð®¨öÔ±¬ºxU}ñ•wâ®WŒ´ré& 5~GA +xÚ¥]sÛ6òÝ¿BoGÏT<|‘çž’œÓs'M{Ž{}èõ’ ‰ŠTE*Žû뻋]P¤LÉíÜtR-K`ý^XÎü'gI§¹ÊgYnâDÈd¶Ü݈Ùæ¾½‘L3Dó!ÕÛÇ›¿¿×Ù,óT¥³Çõ`- kåìqõK”Æ*¾…Dôî‡ïï¿ýéáÍmf¢Çû >ÞÎU"¢÷÷ îúöáÍ÷ß¿y¸K›ÈèÝ¿Þüøx÷@S)¯ñöþã? “ÓÏ…E îÞß=Ü}|wwûëãw7wýY†ç•BãA~»ùåW1[Á±¿»±Îm2{‚ˆež«ÙîÆ$:NŒÖSÝ|ºùw¿à`Ö:yRÄJ§jâ•\ •q’çÉ,Kò8ÕJû |nŽp&‘GOe»EÈF]C˜ªÜ• £¶ŽpÅ®9ÖŒlÖ„Û¹]sx&ܱu+Â.žÏ>mÝá‹;àE~™!í‰.Ø•v &Ó9 Ý_çËb¹uó¶ü=ЗÁj™3yQ¯&Ö”6ÎÑLspËã¡-¿¸9’ÎæÚêØÊDÏæRÆy’(Oµ¬JWwíÄŽZÅ:±†Wkö]ÙÔ-iHY·+Vñ ‘q&e:Ëd› 7-P"š©HžrÊ rñ_!TåÚó}³D~uß@4±ïHDl¬NÇû>z1ë åTîŽ;ÔÇÝdîa¯.ð8ôƒ.|ÆÚÁK îhm‹/<Ýì]Mв©Aj‡[i#Kõ|+¥ŒÀ~µHNL¬Üº8V
J–^žÎtlRp0$¼cíµÝ&Ä &>'(ÍE‘¦6‰µ’¯ˆtHuY¤=îØvÅòsPúáÎy§ +îÿêÎhbçá!¥Pq*E2Þš.ôù$UôN +è¶+„ѧï®mŽ‡%sû•fÊ5ˆÙ\¥1XIrºGòhÝTUóTÖ Ú“ÏÀ¹ÖuT´*QÔ„ë +á"Áþ?$c +úˆ6qõºáW4]Ö;ÔEöåÇàÍÑEŠ±kœ”î¡ +㯠zOÏ“‡H +Kïù'<>ù–]óÅAn;WyÆ‘BxE!eCì€;‹†8æ}¿Õ‘Iщ!JÑpSnŠÅsçÚñ’r È É€Ê!mÔïO§qŠ)}
b£§m‰æ€›UÛ´sp,H9®²ÙØ*r8C¾)‰)Û³ ‡hчÊ9Õ#W·åÃÑïMÍ”‹¢-Û‹>ͤYœi®û´!ÕeŸÖSáá¶MÛÍ!ëÊ¡ƒCyáÖŒˆ³,µ×™è©&¸96“ÄYýˆ{¼žÔÿžf‘E™ej`)-‘vpÊRÓAí‘r© +¿x6š= f –8”´`F0 ¼îgµ(ãTG ›Ž4#… +?Š|d ån_¹ ¬å•þ/F)£Lœ +ÐÐë P]‘h ×¹ƒZv ¦ v[Xè* =Õã@•ÆpUfÌÄT)!OB–0]uEíšcKTäuøDT5Íçã¾ %—r”‡²w#ÓÂÔ‚H(w /Ÿj;–ßÂm‹ +Ù°’Ø¿Ïwò‡ÁÇ°ÃBh'}“ÔylsúXJL¸%¥!!¦¯R`½uË‚Ú#°8El„÷àóçž;š†/Z‚ +š\勲žJ†"
Ó> dl12ÕP_I;vyó0xy&VxËZR@B´4þ\V÷‰°ªÖIø. îß/±&ÔtßGZÌ•Eú¢Is¹IµMT>jÄÐVÞã^ÔJ@7b<^¹%Ýká{WþP|*…R0ÕgFŽN¤
:ÖmY 9î +`Ê©/X»N2(=MvÝÚ‡T—½§ò’Zî/Ú9ä8™€Œþêæ=ÕÄîã–S›%ãíÉ@òt`ç0èí `¯‚ð{fç€é•àÇw?2²©k×'5€ "– GCo÷€d»ˆj¤˜e™a×x,É¿ÐuHUœX“œlyB
%ÔvPN¿Ö(ÒÒ@Íx©ÞK~@uEòŠLÅßÃjÞ6ËÏnÚÍçÉõý™fbûsŸk©Çûûë„2·—¶‘$mÄ…aHY—‡rß5‡–ÜÁðÜÓg¾^Á)Ô©rôR8l»UÙ œd‘ë–à/H9óò[;·b
Ž–\”výI¬µ<ÓW7Ç
³1ÿ
–ȤUˆòª@¯É0ï5p¾[².–®ôg*Îó,x§ºØM¦§ØHÀ¶QU›8¯ð°|S3±.d¦iÚŽ3«?/nòØ4³àuŸœ·8HÀÐÁMÄuÊ—r刀ÆÍŽ³b Ö „ ‡/2¥AäÇnÓP„ÒÁøíè8Å‚ïX PÖËf×sö /fÖîà“k/bžôvÓ B‘B¥ÜÞDª‹Æšâî Ϋ¬C;í+—K½d(÷ ˆ§FŽ5J*;ï&QzðL \™ºMsÚÙ$R ™cŠš?³cåÚ6lé›s´gp~Œ
€ù'®}qs®l`*Wú와ó>¨ QÖ§Óqr!@s²3Û[ »#}÷Eg +¥†2j ž@Û¢
¡·ë*vänˬ!^Œ‹¬Ÿo¸ÂzÕ<]®¨”„hÿJûþDsÙ'3Íô£ÕÈ C~œ™L_Û¹§y±õH™è²époê9;ì ðpÂçaHÀ
{œ÷Ù‘±ô8‡ +½“ü¤ ¾é“Ÿ™Lÿ²*®ÙT´*º‚ ¯MðËõž¢m äŽ+©"¯40åS3LrÓäôiŸ1 +úñ…—Å*¹-AÒµkÃRÑ ÷ûæÀƒ]Ó+‡
ïEiE¿ z ³Ô ð_o…Kí!éÂg !@Ò“ Ë}Ó–]IÅŸ¦ËÇ¥áHˆo óêû·„Ÿ +º9x«Cí*‚Ù€Zú´¨‰‰•8®£…ÿò¢óú‡#¥ ÆVŽœ«gDÐÅN„¨”á ùéŠç¶Í»¢~&ÈçúL}*ÚiÉ‚¹ h‹7+kéþV„+ë)…§Çî¼·yŸŠ’_’a@åÐk ¾ Pê lµî
Î,\ÿݾhÛðFÑñ @è øæÂÐ(Øoà$gÐHN4@š¢LÂoÈÌ”ý™ÊÔcJQ¶nâo„ú®þI”Ã?^æÿþ³Ó_ß™ Ê„K=]HÙñ~t` +ÙÏÌKÀ‰ö’õ? endobj -1758 0 obj << +1782 0 obj << /Type /Page -/Contents 1759 0 R -/Resources 1757 0 R +/Contents 1783 0 R +/Resources 1781 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1756 0 R -/Annots [ 1762 0 R 1764 0 R ] ->> endobj -1762 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [389.4645 570.951 438.2112 583.0107] -/Subtype /Link -/A << /S /GoTo /D (configuration_file_elements) >> +/Parent 1772 0 R +/Annots [ 1786 0 R ] >> endobj -1764 0 obj << +1786 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [375.4723 193.4648 432.5882 205.5244] +/Rect [347.1258 530.9792 404.2417 543.0388] /Subtype /Link /A << /S /GoTo /D (journal) >> >> endobj -1760 0 obj << -/D [1758 0 R /XYZ 85.0394 794.5015 null] ->> endobj -506 0 obj << -/D [1758 0 R /XYZ 85.0394 651.2334 null] ->> endobj -1761 0 obj << -/D [1758 0 R /XYZ 85.0394 626.1263 null] +1784 0 obj << +/D [1782 0 R /XYZ 56.6929 794.5015 null] >> endobj 510 0 obj << -/D [1758 0 R /XYZ 85.0394 322.0105 null] +/D [1782 0 R /XYZ 56.6929 664.3011 null] >> endobj -1763 0 obj << -/D [1758 0 R /XYZ 85.0394 299.3741 null] +1785 0 obj << +/D [1782 0 R /XYZ 56.6929 640.0948 null] >> endobj -1757 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F21 938 0 R /F41 1218 0 R >> +1781 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F21 950 0 R /F41 1233 0 R /F48 1253 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1767 0 obj << -/Length 3322 +1789 0 obj << +/Length 2719 /Filter /FlateDecode >> stream -xÚ¥Ërã6òî¯Ðm媂' ÉLÖ[ÉdÖq6‡$J‚lÖP¤"R£Q¾~»Ñ -XíkÞFÈï•Î·ÿ É ‹²$(_Ü®e(…ÙB¦¨‡p:Á2cä€WP‘µÛäÀ u -/·oÞ롨ɌÕ$„ ç„3HÊ2%mÀaê.DŬIôí› b]¿ù wÜ;/‡õ¢©WŸÜÄõ+<ûíýÎÄö£“ªŽ*Ôx/N-LwÛZÐmãØïœË2̯]³Ú»¶Þ74°¿v ¸§e›zOS¨Bfó7ÔmÚuQ#lÒ¹kWà -,ey-¥Ê¹u -äëêÍ]
*p œYýq1yÔÌ<Ð=:o)p8B×ó¿ús±v„@ýzKT¬Ar%HÞÝ_™Tpå‡ö¥.ªê‘!ðçÁí ×P'¯ÖÕªÞvÈÕ•#¨ÝçU³qû®Xù+½âê)[tÆ•ˆ¢1B^5Ö´3VØÄô› - Z¥Êß?Ž-OCCNÀÆ~}uUOÅk…¶ ø>3ŸÈL$9Zh×y›ä5 Z² -¼Ôô5ÿŒ Z N -£‘Ç@7§nô:8t,ÚWÅ’¨Ø•‘Å ô¥ŠwÞòìL±ƒøw»’,è4n—£Ë(OÔ÷îÊðè%xç0
6ϽÏ$7¾åð¬óë…’oùÕª3Î0/ºQH×jDŠ¹.%È È)—Uqf!m¹¹}‡t¹ÿ¸Ò1P¥;b „Ó,¤é+ 奴k_}¸³=n': z«5]¢©‚@qP…µ›Q¸ÍÀOí+W L§¡¥],5ö}ñ>Š¥¾F;I©k½æaOJQ5ÄÌõ hŠ¢&By‰!(Æ[òÐe˜{lóêDÏøv_ºÉ<pAq!oPÖ’üÖ4Ñ}"dÆÓC™DÖNà1£öt¨A„zæCÒ $lµé\ Î,]·n—7kö¦m|?ðO ÿCs 'C è”G¤C”Cø
3E •Y9é”öyÑ`<¾¬ð ufOR(0ãƒ74‘0!«ûEU½.VdŠÏ÷o>Q÷ SðsÍ5UÒJðù7
t€tÝ@#ò¸*)?XaÿK Õp(Áoíß!]20¶ÐŒ Ĉƒç »rÞ±@½0ÚG.>Ÿ€ÁzÙԥÜŠâH2ÿHÚò¹¨
`¡lÃ;Dˆ†}òˆð±>”kûR(lØ%#ë.Ú’3] RSæ¸òî$›H¤`p(™è! -+ Gn&µ10§ÙйÁxïc¼mfá= §úä:qu©?°gXóäò¦®òe–vi2À}õËá -Åà”¡RôV&¼]Ð}†PJS -RXðFpžEÿÛŸ¦Háõ'é 7Å;=øÇ?^êÙ¥¡V±VNû;(§!g"-¼™T_úyÈUÒa
Xÿ?d‘£|endstream +xÚ]sÛ6òÝ¿B÷tÔLÄà‹ 9yrS§çÎÕɹº§¶´IœP¤"Rv|ûï·‹(P¢”Îä&ãX,»‹ý„ø„Á?>É’˜É\MÒ\Å ãÉd±½a“5¬ýtà ÎÌ#ÍB¬ æ7o?Èt’ǹz2_´²˜eŸÌ—¿Eïÿqûi~÷8‰„E:žÎÍ¢ î ~$HNŸ÷ >ÜÿôïÇÛiª¢ùýÇ?Þ}¸{¼{x7ñ,á°_8 +6|¸ÿç ~z¼ýå—ÛÇé óŸoîæ½,¡¼œIäËÍo°ÉÄþù†Å2Ï’É LXÌó\L¶7*‘q¢¤ôêæ×›õƒU»uL‰Ìâ$éˆ S`’ÇZ +iˆ2s s:`ŒEŸÌ¾l–å‚ÄœO9çQÑ~¦é}Ý™ýsQµgr³˜%p%©à1—Bß³Cš…XWØôXÈæ¢2E]ÖëYéX8å€k¢gò: =Ö"àë4VY®‡LÌ7e;ÉLD=4sP³šò,Z™EW>›ê•€ÍSÛT¦›òÈ€q¥LGŸöˆfžËæÐjøÍt¦xuC›Z nö4~iÕ’†´qÛ<;4óuWl‰ú +j‚«žb]öÄ y´Æ±*æŠ'ÊXsu4ÂÂ0Ci“'rÈÝ*ÄLï‡B µÐEQÓ¨óˆµé^šýgÂìE µ +‚>.å6!¤U¨Øœ'7ždg¹MÊ̲oS–L¡ªKô‰[ö^Åsmí¿èUø=R¹ EX°7ož§Þ¼ÃíhÞø%óÆQ`Þ]gÞHÍW¬yã +ã$Zq‹ Ù[d2ƒPðñhÿ‹èîL5@T +È‹ŠiàÚ58|òe‚`žK +ÆVÚ£,àíýVL~l@¦I(–§< I[¹ôÀµ@š<cÀ—1 C¯ á²èu* ?r“r»«ÌÖÔ¶ ´€š¾î FùÙí«<µÔrê÷û® *ÙXçLNfÇW ï3¨¡€›~ã-FBMêàÅH¸#z#jv
¸ÃëH” +›/‡¢Â§‘„»
aö] +#çQ‰ýØþεⰂ +Öùu‡ßµ¦Zao¥úzò4Û30š$÷2Ýå R +.9üÖäÝyPãŸã®¨GÎÁÂ\§Þû‹%UL3%s(€S9¬—{Ó¶cñRaR \ìí¯Ø· +ªYÑ£¥íMúŠ[0ÂÉ3÷'@2 ;,Û±FȺ°ÌÜ ,ï;‚a¤A[Ëz.4 ð7ÍÞö8*èÒ=ÆH,»cjB)Ý)Î*‚c\|´ +pÑItKð£êeÞKpWcJl˜Æ"bpߢ?&¨æÞÕàá9Ü1d b Voãx'¹“—j7œ[^QqÊ`±\º‡,‡íÄ€%gHô2,CîeS¢ Â2tuØS2smL훢W_Rfì;"÷K}ÚFyÛºD0$æH¸úöƒD2_ ¬_ÞP”P|˜’y 3¡ø07Ì4äó?Ðb
þ‚5³·Ù»1üCQ ß +õnÌäÿ$€ó–ëw4‘HÉŽþûÎ=àH‹ç±/O <ȹ4w™™žãlÛ Àã[L8£¯{Ѷ± ‡«Æ÷Öˆ½5~7€p•"hzMš`7«[ú
¶ˆ$‰ñ0°'u kJd•Œ$2¥¶ÛÐ2± óuaü¯ +Õó.˜ƒüíÀ"Ç~וIŒ?ÆŽôö¬ï¾û7ßãâ*¡ŽãúœLä©g +ÅM“SÎû ‡ÏYÿ Þ£éendstream endobj -1766 0 obj << +1788 0 obj << /Type /Page -/Contents 1767 0 R -/Resources 1765 0 R +/Contents 1789 0 R +/Resources 1787 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1756 0 R +/Parent 1772 0 R >> endobj -1768 0 obj << -/D [1766 0 R /XYZ 56.6929 794.5015 null] +1790 0 obj << +/D [1788 0 R /XYZ 85.0394 794.5015 null] >> endobj 514 0 obj << -/D [1766 0 R /XYZ 56.6929 439.4679 null] +/D [1788 0 R /XYZ 85.0394 769.5949 null] >> endobj -1769 0 obj << -/D [1766 0 R /XYZ 56.6929 414.5066 null] +1791 0 obj << +/D [1788 0 R /XYZ 85.0394 751.9325 null] >> endobj -1765 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R /F48 1238 0 R /F62 1361 0 R >> -/XObject << /Im2 1350 0 R >> +518 0 obj << +/D [1788 0 R /XYZ 85.0394 369.5823 null] +>> endobj +1792 0 obj << +/D [1788 0 R /XYZ 85.0394 344.1885 null] +>> endobj +1787 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F62 1379 0 R /F41 1233 0 R >> +/XObject << /Im2 1368 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1772 0 obj << -/Length 3429 +1795 0 obj << +/Length 2949 /Filter /FlateDecode >> stream -xÚ]oÜ6òÝ¿bïéd «ðS"‘'7uZ Z§u|¸‡¶ò®l ÑJÎJÇ(î¿ß ‡ÔRZCÃ?†Ãáp8ŸË þøÂè”I«¹U©f\/V›¶¸ƒ¹ŸN¸‡Y e õÃõÉëw2_ØÔf"[\ßF¸LÊŒá‹ëõ ÉÛŸÏ~»>¿:] -Í’,=]êŒ%?\\þH#–>oß_¾»øéßWg§¹J®/Þ_ÒðÕù»ó«óË·ç§Kn4‡õÂc8²àÝÅ/çÔúéêì×_Ï®Nÿºþ×Éùõp–ø¼œI<ȧ“?þb‹5 û_',•ÖèÅ#tXʋ͉Ò2ÕJÊ0RŸ|8ù}@ͺ¥süÓÒ¤Úˆ|†‚Ï1PÛ4“B:â™y–r<`Œ%קœó¤}hëöî HD„„-–"K™b™[~VקK…+úûr‹M‘ô÷Us×ÑðM m.?íŠú´Ó÷e€K‚ìÊíç€au߶]éQôiŠMI³{Hžô-}Ú•Û'ºÝžr“´›hµHêªë=¡·4âðÁùðDœ§VkáNDØ; TZžT°Jf"ypHË[˜ÁItãLÛ”a¤ðÀU€!6V«¢®ŸhjUãÁú0ïáû®¬oAô2e’ëûÒ³=¾;Éò4ÓÖµHdü‚”‚[ö`]_ôå¦lÂ~§À¥§®hfö1yª²\ùõÅzéX´TÒ¦\çr̪õ¶ìºéà̦Jäù"‡FføW=‘ZcÌüX—1ÊCùæ\¤Šgz¿3¹)úÕý‘Šß‘È€ñ%"•L³Ìò1‘N<ï’çi.·Ñ¬áædžTM_n½Dö ëà ~3”{ìvåª*jê<Oîu£’Ëyr^ -Í0aTŽPIÍ1™ -¹ó&êÃñ»‘<ιè*çà-دóÑÁ³°V«yÛ‡\™ ¿{ c€Ë7ʉ1ÄBÒÚ4·¹Ù{b1HÖí²4çã“rcɼF¯KgÀOô Xª¥þÜ{` - Nçù”1€ø!Šƒ©ÝYŸ |}k%ÁDmwÒ=ÜÀë‹XüØÂyÑ‘Þe„Ø(¹:"OY®`{ÁSÎ•È *“1,4¥žu…³‰+l$€mxW9YTü6mïP¹¢Þu*<¤%¡eÓ)Ç”§ \éE|Yßvÿ(iÚfv±Ü|ß&c‘’ÖÊç£CH€ð¶ãèP†è0<è¼–½Ùû0Ä/Œ„AªÄéÜ…C8SP÷ÇËÔ÷± 67ÅM®`m£N
ÁàTL÷8Ú Ý¹Æj4ºjÝwÝÑBÔ™WWÓâê¶Ýn\àŠ³Åÿƒo6¢D: -Û”=n^v&~À$Å·Ø -ñ-¶½=Äy ‰âHìyç·m¨OÄêð‡•‡fUâv§f˜sÞ,¬ 8lÖ%ø¢pr¸Nõçrf,žçf‡øDeI~6€…C`ºÝ ËvëODF³Tp>Ä"úª™>C0r)ãÙBÂ;ÈTæ^!Ímï¼rºŠÒ%|Ù )V¤åC¹òJ( CM ’ è„2cŠÒ6Ô „ bó¼G6ó"êj`SÖšD gÛµ‡ƒ˜cW¯c¸b»-š»è]e‰¼9aSÁP‡ãTŒ®=ßÐ>l+¸*t/ò̧Cp¾êÜPžì:zS¸Æù¾ØØ»ñ¥ÇGJ:øqÐpFšMz ÈMį AÜâÖ#ó®üt+ô¯!ùœB “¼š{»d T)Ü;„FÌØŽ†Vî
Ac›º ¥òSÎ}Çå!¾qð÷¯V½{Ïn¨ù“1q·óŽ’Çlò —'sópÅÊ1ø¶(30LÅÁà«@›§U8.œyØt “c@è¾åU"ùÏ”d& žv>ÙdÒGë8×z\0០õ¢[A•(ÐÈT]Xêøc‚˜~ÚU Öc¸F ˆwy9¿G±\?¸°!>+CІdvÇvì–ŒS;6Í2|ÁB ê7©RÍžIÒ‰E¥êt)vnJˆZ¼Y²pw>{ÇØ|öŽK“k³!}7›¡“\¦:79¨8Ô^pçßšü0.c”‡>†u©³\ïw>š¡“伉ïHdÀø‘*O`|Läñ 8€ã c‡: ëéAß44²i‡¬ô\ªÅ™ÒŤx
œEÉI ͧ2~ÄÖ¢€oú¹b0q‚‹C ¸×{f* H ]iÁ©S D ÍØ—¬n€_Æ fÌîÞ±ÝÍxT²8l–nF$͘]zŽ\‘ÑIòÉSwí5|96aeõìuq8i‡8åyÅÁå a6».àwŸªg€)=Tä2ÎÛ“` Ë/uµªúr2•* -84xi&”ð¡AG‡Pš|_¿]*!)ý…Ph *ÓIŽUY9¢ ’}!ݘý*gcâÍ&Y4Dv -Ò§£9ÌìË»ÌðϘ÷ 9ŸÅñî¾}l¨ývÄýè®ó SH ó[k™ü>&ÀOSÆ?²Ã^A /aÒÿBG· -¹ë)åÃ//Iÿ …ÌÝendstream +xÚÅ]sÜ6îÝ¿bßNžÉ*â—DMžÒÄiÝiÖñÍ=´}we[Ó]É‘´q2þ÷PKiµ¶ï’››Ì„ ‚ +/òñä·?’Å®ýãI«ÜšÅ|$±Ès¹Øžh£b£•ò3›“'¿ƒU·uN~ð«Äˆg +dœçFÏ ›€2DœJÒÅ<-Ú— +P€Êð•úæ¾Ù4·_/$©5 '<bsßWM
6™Ù¨êh¬›ž'¶÷›r[Ö}¹æ Æd+(§Ói K›ÛE¨¬¯Ó?ZšÉS0€½
uŽMJd©Þ›”˜ñ©ù'p†÷"…G$‰Ó‡{Ô]Óö›ªëéëC_ôNzzºð:d +ªeŠDAé¨=6*»û¦îÜŒMÒJAŸo/>Ð÷Ç]Ù~!p[|¡Ål£ãa¶¹¡ÉínÓW ÇÑÍΫÑìªq㺣¿'&¹¼ì`„uÓ´Ûª¾¥Õâ?¡À+O®Ü•Èg®ý1eÕZ±<`±.¶ ueû©l ~¨6^–ŠÍæ }ѱý®é»'2&ú~gWWuäN'Я5m¬NET¯Ë¾Ä›ƒ:i–ïìŒ.Fþïs½CzI\—ôþÍŽÍ ž¾1ŠßbÛ Ë¦e“1I,…ð¸Ý`\Ž<ð=y†Rè8Ms³H Öšghà´ØÞ²sº BÀ€¿ 7x'»gã.²ó¡\± füûÐ<YðË H <â
XOqr@ÅV$ó”ZmªARÞ`7dM¸Ú¬¯»kv›uˆW´mQß:t +TŠžÖ«ÎMeÑ®£g…{ê/ ¬×ÌjW2=òÓ‚ù +0[RCsOÀ”»!¡M¤Y=ª1¡ÁŽò¡ZyÜu¥=âv×yú}WnnÈjtÔ`xäøЗ«LºœÊǨü|¿©VU?ÃNªc
¨{Eƒ±PxP é¯~¡ÅeHòð… +%nf²ýÉG݈°”à¿ “žâSLæIl¥Uc&¹ Uò0{']5uIÊÂ<'ú‡†€’*VŒ™if(DDt -E€äWLòpW˜´«¦¸æd2:ÿ…¬H ™¸žä|ûh
TA඙ ·¹‘½ òñy‚òúÍOP¹ƒ»ŒP’— á‡)%¶2ÌMA1œZ`Õ$&VJËo4˜â2$94LœfzðñÀN7W™ý†<zŠOñ¨Ó8—i:fò˜EêXe&gySâvCcéœ BÎù!ÀÎÏXP:+„Ìæp\Ý•«?I»ÀtõU’O|Tq[Tµo,ôû~CPvc®¶7Bšp=€p‡ï +•J„ò6FE¿† øÃìÀ0á« -LQ#×QwÆFÒœ»‰¿®2™·I€‚‹¹oîé"85yC:Ä%NSL6&ëR
ã#¢™êÃu±ÕLBŠ—ÏŒ9í¥eò©´Ìèï+ –fÖ5Í0cùpºæÓ}µ4ƒb¦ Ò²¡õ9á¾>caæ,ÌeLß2:ÄzpˆUKີ²±o¼`ì°†{ùN‹ñŸCï¹ÿ»bš$Ñ_Ž) µ
þ>`ÄÚË—„rþŽF'¸ñ 쌒üÞ« Î.º©ZæMÅ endobj -1771 0 obj << +1794 0 obj << /Type /Page -/Contents 1772 0 R -/Resources 1770 0 R +/Contents 1795 0 R +/Resources 1793 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1756 0 R -/Annots [ 1776 0 R 1777 0 R ] +/Parent 1772 0 R +/Annots [ 1798 0 R 1799 0 R ] >> endobj -1776 0 obj << +1798 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [242.0197 308.8411 315.2448 320.9007] +/Rect [213.6732 604.364 286.8984 616.4237] /Subtype /Link /A << /S /GoTo /D (rrset_ordering) >> >> endobj -1777 0 obj << +1799 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [238.0484 230.3842 311.8142 242.4439] +/Rect [209.702 525.4389 283.4678 537.4985] /Subtype /Link /A << /S /GoTo /D (topology) >> >> endobj -1773 0 obj << -/D [1771 0 R /XYZ 85.0394 794.5015 null] ->> endobj -518 0 obj << -/D [1771 0 R /XYZ 85.0394 769.5949 null] ->> endobj -1774 0 obj << -/D [1771 0 R /XYZ 85.0394 749.6227 null] +1796 0 obj << +/D [1794 0 R /XYZ 56.6929 794.5015 null] >> endobj 522 0 obj << -/D [1771 0 R /XYZ 85.0394 377.478 null] +/D [1794 0 R /XYZ 56.6929 674.157 null] >> endobj -1775 0 obj << -/D [1771 0 R /XYZ 85.0394 355.0589 null] +1797 0 obj << +/D [1794 0 R /XYZ 56.6929 651.0501 null] >> endobj -1770 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R /F62 1361 0 R /F63 1364 0 R >> -/XObject << /Im2 1350 0 R >> +1793 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F62 1379 0 R /F63 1382 0 R /F21 950 0 R /F41 1233 0 R >> +/XObject << /Im2 1368 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1780 0 obj << -/Length 2109 +1802 0 obj << +/Length 2649 /Filter /FlateDecode >> stream -xÚÍYOsÛ¶¿ëShz¢;Œÿ$›“›Ú©;Ó*zó¦“æÀX”Í)E*" ǯó¾{X€)Jvâ :ž1Åb±ûÃbw±)…?6Ušè”§Ó8•DQ¦¦×ë ÞÀØ« s<3Ï4 ¹~XLN/D<MIª¹ž.V¬„Ð$aÓÅòm¤ '' F/__]\¾úÏüì$–ÑâòõÕÉŒ+]\þrŽWó³_=›ŸÌX¢Xôò§³ßçs ÒNÆ—W?"%ÅÏ¡óó‹óùùÕËó“w‹Ÿ'ç‹Î–Ð^F…1äÃäí;:]‚Ù?O(i¢¦÷С„¥)Ÿ®'R ¢¤žRNÞL~ï£vê(~Œ.4 ó1 -ⰇЀR> fêÀ ±f -×0–ö$¯ê²¬ï‹ê»`UÓ—Ž!àï@£Á‹ÀÑW$d5⎰úmf°Í/Ž,ºò‹>IìHÿßÿ‘3“„S} jÌu™5
6_öWbC|ï‡!aß9![Gàƒ¾Û±q;X±Ïâæÿ:àøaàø8v ¸#^ñyP<•›}
àØ'' Ž?ÁãÄgA!¾À?9á³<ŽÈjˆÓf‹y -Ó
ðT±-1£h‰•Xã÷CWµA'¨Ñœ#þëêOžˆnûŽÛ¤ ?/ -‚k[M¹„ I“ÄÜîqp{3ÅÆ<xèøgá„ýç€}¹F7. éô'Qìé”B´IRÑÓiïa¢ãzL“=iF¼ïÏ„¥iÙpgÕôšPåí|5T VÒIO9BBkö”ÊN£ï33/pJD{ªQJt «ÝÂvÓ7ùõˆcpN$Uþ4.1,ssp*ÉÏ ë±æ{taOSªú`½Å:Þ.¤D¸&JSæê¸BÀ$1ªˆB<±Nâ,i!ë)Ç`;cn ól¶t39w2W×¢%ïš·íÃ& 1"ÓÜû‰gêYŽ4Ñ_Ñj/ñ1«ÓÜ=–Ï°zÇÜ·ZASúxþͲ^gEµw°)#š õõ ï$>b¸ ’hÊžáߌYž8uißò]ö ±žnÎiÆëí‰Ý¨ð]®ð鮪ñqÏÝŒ
©€¤îšæ<æ”æK¸‹DûgC£Õ*ƒ¼ã¦4£Ñ îq:ötvõÇxhЩôf‡Ê%N9(³ @¥MÞeê–†º%t‹‘¼KjÇtÓÇu³Î,xC <IôÕõéÖB§®éøèø'çrLqš€£Pá”úvDm – †¬H͚ܤù ÚÌ¥#½qß=^·2¿É\ùþ1+ïò.HoG”K Äã> )0N»òÊU«ßï-šÿ¦LB‘©zÊÙ2!1”ÞýÓûe³¼"Ô¿3 ‰ 8‚,×ô3†qÓÈÃùÀ9ž`D
8ßÌTUîÇ!ã>Ÿð` -Qïjùnûí®M½ö<¸Ð ‰Ä2:úΚç$¡2Œ9ܳf1”%ŠUÒtúè~<õÅݯ݄҄—ä<N`?@ˆ°ÉØâ 뽟;ý/Ž+Pý ·n)Mendstream +xÚÅ]sÛ¸ñÝ¿B“'¹sBðI¹''g§¾¹sZÇN'—Z¢mÎQ¢"Êqt™þ÷îb¤¨Ø©¯ÓñØÁÅbw±ß°˜pø“Ì0®¬ž¤V3Ã…™Ì—G|r ßÞ 3 @³êõÕÑË3•N,³‰L&W7®Œñ,“«Å‡é›¿žüíêôòx&
Ÿ&ìxf>}}~ñÍXz¼ywqvþö —'Ç©ž^¿» éËÓ³ÓËÓ‹7§Ç3‘ë¥Çp`ÁÙù/§4z{yòë¯'—Ç ¯~>:½jy‰ù\!#ŸŽ>|ä“°ýógÊffò +¾Çƒ¯šwvøÍû¥e¾£‰kæ¾)nî+šs¶ OÐÅß8—·÷ñ~Þß™©§©ð~Ðù\|w€ô‘#YWùÜQPí¶ÕÚc€)¯ÒN9Ñ߀®¢Gß?¡g“~D»ÙÀ Ìjþˆä
g&•ÖÃ6Û|[,ÉmÁ–ëb³,±! ÿù¶töŽOx¶T¶r ðëö@ÆDq]°LBÌ뉄Ü-w ‘6À[ O<× IðéûÂÃçUSÓh;.·,…®ME°Ã}¡)Í8L döÃ0ÉPF³$50$&9×íéÛævBƒË(=à³Þeý͇X‘ˆ÷à%éP\zE6¨†i™0¥LÖ£h/Mi¡ !d RÂè<•%´‰îû¶“Õ˜ÜÌÅR/ÎVQcÂ…DP +À2IÓ§$l’Ù,ËÆÓµY‹q£$&{ÄI g»Ý‘¯‹ùˆZHÉ47ÁîJ š
ù#ÔB?MIXóÊû[¥åi}˜WyÓÐFFÅ% ’_á7j¡zÓ’oàOC®”¶Ï—XÀ8‹Q:‰õˆ. ènc—®a´ ‘˜Ïe‰‘$™ÛݺáÜšHdГ +W +Ì3ƒeáK¹ú{åçÝ®BóªÜ–.\(>,x%õßzð¡¢ÚL.óíün¬·ÔÆKt*¤ì]LíŸG úG û˜Ë‰”êyzÚ©~×ñþ-‘X¦R© v%X ˆ¸¦Ý«mO|›AIÃ Ò ¨mÃý€â)㢨tVûžŸï˜¿z¼™7_¢~^HQ{ïsS„:¿ §+rÜè„ ”†áè¶ü˜§„¿ ùh/r£í¿Š¬Ù÷ý„}ûr!dóÓÝÌóû¦=·]Üýê«I]8 qtr°Ë—´m</$ ¢“ïéâµB ®,º´²w:ÒJPR·¡GØ´êºv÷)Èš'"§GsƒÔ:„Ž#¡s yrƸƒ<9¯ ò]Óo v¼ßr®ÇuÚÎQcz_ŒOwô±‡?àÈEV¯=·Ÿ2k ¶©ŸÜ’LÐöíµÀÁz]䎖®¾Ø0×6àá\!(áÓóÚ<.lR•EãkH2®eß²_ïzUÍ¡ÇX=_úOOi‚›ZC-&Å“î1TìÖèƒ5@¦¨•ñôV BD{_œp–y±«mmL ¾ŠL¸¾µ0‚tê"R HE!3JÅxîKL¯à¯œž8µ@ÊR°=êíM>MãÚZE0ÑØqÚIÀM¼<_ÊÉO5ð3‰X +xgbÇR"{MÃ[`À%„.¬78^-ðN +¼žÝ~ÒfSð„pèd?âù‰¶o,èÌw$mú ¼¹ãI2v—À[;ö?XtÞDcß©ïM¢†aHð”aÚßI¦éP²íbx¨ˆôÿ endobj -1779 0 obj << +1801 0 obj << /Type /Page -/Contents 1780 0 R -/Resources 1778 0 R +/Contents 1802 0 R +/Resources 1800 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1756 0 R -/Annots [ 1782 0 R ] +/Parent 1772 0 R +/Annots [ 1804 0 R ] >> endobj -1782 0 obj << +1804 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [325.3322 237.4931 398.9856 249.5528] +/Rect [353.6787 530.3947 427.332 542.4544] /Subtype /Link /A << /S /GoTo /D (the_sortlist_statement) >> >> endobj -1781 0 obj << -/D [1779 0 R /XYZ 56.6929 794.5015 null] +1803 0 obj << +/D [1801 0 R /XYZ 85.0394 794.5015 null] >> endobj 526 0 obj << -/D [1779 0 R /XYZ 56.6929 308.0833 null] +/D [1801 0 R /XYZ 85.0394 600.9849 null] >> endobj -1304 0 obj << -/D [1779 0 R /XYZ 56.6929 280.4919 null] +1319 0 obj << +/D [1801 0 R /XYZ 85.0394 573.3935 null] >> endobj -1783 0 obj << -/D [1779 0 R /XYZ 56.6929 154.8032 null] +1805 0 obj << +/D [1801 0 R /XYZ 85.0394 447.7048 null] >> endobj -1784 0 obj << -/D [1779 0 R /XYZ 56.6929 142.848 null] +1806 0 obj << +/D [1801 0 R /XYZ 85.0394 435.7497 null] >> endobj -1778 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F41 1218 0 R /F21 938 0 R /F53 1313 0 R >> +1800 0 obj << +/Font << /F37 1038 0 R /F41 1233 0 R /F22 973 0 R /F21 950 0 R /F53 1328 0 R /F62 1379 0 R /F63 1382 0 R >> +/XObject << /Im2 1368 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1787 0 obj << -/Length 2725 +1809 0 obj << +/Length 3271 /Filter /FlateDecode >> stream -xÚYÝsÛ6÷_¡¹'j¦DñI×'7µ{î´Î£»—¶´ÛœR¤"RqÜ›ûßoHŠ¢œ¦i2 !p],vûA¶ ð—-rE¨0r¡$Š2µXo/èâÞ}ÁM‰Ò1Õ·«‹¯¯…^b2ž-V£½rBóœ-V›Ÿ“7ÿ¸üçêên™rE“Œ,S•ÑäÛ›ÛïpÆàãÍÛÛë›ïÿ}w¹Ô2Yݼ½Å黫뫻«Û7WË”åŠÁz v8³àúæÇ+ }wùÓO—wË_W?\\ú³ŒÏ˨pyñó¯t±cÿpA‰0¹Z<ÃJ˜1|±½J%…ˆ3ÕÅ»‹õŽÞú¥sú“”Æ• -gŽ V’É~A -Ò˜´ëª)Wé©”p¯±í‰Nù £‚"’ëìˆñ;Û…"£/"êÃöÞÇL˜ô¹;<[ˆ›µ™®ÜhBYR¬q
÷Q ÞT>Ãûq“²Þ”ëÂÕ ÎÇhžPœß”+S®n7·,y T¿PEWO±‚çi9ŒYÉ·oW3áÀCo!c׊ÙÀðgc7¸1Ì V188`™@;“>1!‰É{þ=Îðw·•S̘àTŒ†ü ¬m‘µ³õf‹·ÅÇr{™Î‡¢:Ø×ÄäœCXA]3+OF P ‰#NÅ!!Uƒbš 'ð?FK…[‘µµ
ŽÀ>:,y+c*m¡ îpŒ%#Âè»Ûwï®ÞàXnŠXªä¡(«Pô¶a¯>¥q<n‚¹¬\¢7¼+ãÜ ÎV¦sÛ+· I[ÔÆ`ò}þ/§ ij&¢#¸J´PÚ°ª|8ɬzåá NÝñÆàm\YÔ³b‘³øD!ögüø4½‚OÈk©ø˜Öþ˜³(#¹1¯2ï‰N¹ ¡”ódP`ŒÙ¯–°È5 -TpÜÍaí» 2©m÷Üì×ݾèëŽ5¾GŸâ.€¯qOyÜÌÎî¡ê‚H¸öÝ
nbB
ø;´]3Ø ¼«í#Øè‡@YÔí³Ýã…L4™J8KæúaGw¢Ëis*'ëÃ[ ‘ y3'Ú
-”sÀ -˜ µ Ø#z“[‡>#¬5¹ï µa.œ”uÿ>òŠúˆ/%š" -¹¥ç‰Þ +xÚ½]sÛ6òÝ¿BòLÉà“ ÝÄɹ×:w¶ïfnÚ>Ðms"‘ŠHÙqý-° ~‰’{ÍÌÅ3áX`‹ý¦ø‚Á _è$N¬° cU¬×‹|sÆ0÷éŒN¢!Öwgï>J³°±MD²¸{ì•Æ,Mùânõë2‰E|;°åûÏ× ¯>ýëæâܨåÝÕçëóHh¶üxõó%BŸn.~ùåâæ<â©æË÷»øÇÝå
N%´ÇW× pÄâãȦ7— /o.¯ß_žÿ~÷ÓÙå]w–áy9“î _Ï~ý-VpìŸÎX,mª/ðÂbnXlΔ–±VR†‘õÙíÙ?»
³~é¬ü8‹…LÄŒ +”M²tÉp|U6Ùýº ]ÝnNô|IX¿1ÍîžJbž ›‰,e +0äàsýùŽ†çŽÓ Bjq […ÇÝót §ÚlŠjU¬b Æ.=ð‡]_Ù~ÝâK ¯†ô¹T±MAŸ~ÂØ }Áb%¤" w*ÎpÏMYíÛ¢AÒn «V´‡MöÜì7øòœ÷Å)vŒ‰…• žÎó“ÄŠñ;òØ[DìltŒ§`8
çç ¬p1j™›!P‘Ö‹µ^ûKÓA§ +‘ô^(’ÂGDÔY´I'*Ó'8)EKxÖ•#šêåKQ|Á!GÌ è”Í R\./p4$&)EwXý†âG7Ù+y¶o3óÔ¯û‚&Œ¶´‚ÜÖ~Wáû-T, ªtõÈÅÕÏ?àÚûw …ut9Ž)ÓåºnZY”hƒ£8kÁ‡oŠU ÚŒ377¿V»“7{wa7£Ñë[|úˆâ& ýñÝÐü{wpH1ñò(ÍCšˆàÀ
PT©×{ï¤gr”-J3‡´à¸q 'J½eg¬v°¼•U´«ë¶9°1Æ`¥³±S¤;¬Ú#ƒ<Ý*cÆÄ)r¤>#˲}‘¢SJÛHÞ5úRKFÕà$Q-B˜q‘Ý—”Fà,™iŠž®Ç*šv‚@ÆkGTÓ ÕQîÉ…Š¥êÕ4ËóbÛbûvõ‘Žä•Ä©6)1j4:-D8Pœ”ÇÚBèSÆU„°ðOí2õ=ˆt¾h…½´±üø^¸ŽÁ^âŠéVQà| +ɇZÓÙD_(zL*J§1œÄb)8†N +ðòŠµ!ú| % Ê(˃nF +QÁ@ɨ8\™4Ö‘^|]ð˜)k%"
`Ö^~àÝÕF,>Ôp¢ÅðP´q4ÜÙ *‡ õ–’ qGj¸v(¯e”x³]P¸b(w>©=¸m•ØX¤6] åù}W$Aö‰e`Ù}“æû(6NS‹3–„+{Ú™I£!Û7Z- –ÏðÊÇÈ™eûyïoŽMÈ +¹Y :¶€5ÃÇè6µp-€1 ·Û"/]yâ#Ÿ é€1½oƒAïÛL—°\ã-€äbßî»Â׸ £¨¥«¬a^eí –†ùlßÖ¨a°.Ž ‹Sáj³aèÉ!P»è
öcQ;J áÕÅCÿÄíŒN‹‘_†çêµÊ6eŽ/û-T÷-táu*z:•Â ™@A •W*œÜ=’yÝ .¡Ã† /áp_Ìàrª‹€ ‹)7Rª˜'zÄÌ ¤788Ø‹0 ©SæPñmKa ‚‚°É¨±Á(†9¹ßõÖ!£ÕXÂPÄÍÓ‰žÜ¨×ºµË] ©›¡Jº§úu]="t_<Ô÷îy}E£,B4=U:OÑ 7Ã'NwÚå’ËD.¯ pÖ—G¿h.ÕC¦WJmBZu¨ñRê@ fï kB ÑüA`’¿S`¾«|ÓÀ¡ßá;è·§Šò÷p/i· !„NÌ„UΦ|Áä5Öc&´Ó + ö{,Ÿ]ÙÃÎ1YC7 9uè¦ÆLxWOƒ ø;ïn[§ZÒa¬¯ðàÅW>D¹oL‹ïñÂV¯E¶k¨1•£´ÉXu}!IX_ƒ÷ýW6î»"BŒõ‡ÊÊe‘Ôá]‡GP×H¸Ê ´²DGáýyß8ÔITüàn¡¡Á{ÔÀE¾ßáxÕN‰†í€’ó ¡Ó4£ ÔQX—›²ëKtÍâAK6_×ùêJ|)^\ð¨Œ4 2 ÚâG€é÷C¶’ç$²^…|ÞUŸ [fTk¬‹¬ii¬) +à-a\œÎã†XÇó¸+\#YtTÕ«â°8•hJ#N³ÐaÍð0v72f ’Ù>‰{p‚à! ãCÁÙ ÀþþùÅE5>ïimñ
r¥Ê›Œzgë¯Ñ7`äë>«Ú°7%z€à$AI\ÂcÅS;õ¹£Þ hé +uXS +>uF´qýZqšk†‘Ñ™! +XúcNz=r èÆ%.Oõš¾\tº°×%×|Ÿ¦õ~©÷L"¤;~¬Øbù.—ÿäÑ7”P7zÂNÅH— —ròå´
ŸËHû|§9DÖÿ§†ÿ%‰w*6§aÄ÷[&’X3ýF±9Ä:¡akªaíë¶8ôQPq)%NsÐaÍ°0:ÔPâ@¶?â¡×-‹ßBá±Ý•Ï¨ +ðróäá;«8äyEÈù'«Ñ?Á;}}ˆ® Ê)·RË/Qd\jÚui•’}‡ZCõîX‡ú˜€[V< QJ ©æ¾ySWa PíB€gJˆ+GŒS;œké DD¬‚ay(`l³]¶)0Õæ¡Õ
endobj -1786 0 obj << +1808 0 obj << /Type /Page -/Contents 1787 0 R -/Resources 1785 0 R +/Contents 1809 0 R +/Resources 1807 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1756 0 R +/Parent 1813 0 R +/Annots [ 1812 0 R ] >> endobj -1788 0 obj << -/D [1786 0 R /XYZ 85.0394 794.5015 null] +1812 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [286.8324 359.3488 335.1613 371.4085] +/Subtype /Link +/A << /S /GoTo /D (dynamic_update) >> +>> endobj +1810 0 obj << +/D [1808 0 R /XYZ 56.6929 794.5015 null] >> endobj 530 0 obj << -/D [1786 0 R /XYZ 85.0394 429.6422 null] +/D [1808 0 R /XYZ 56.6929 769.5949 null] >> endobj -1789 0 obj << -/D [1786 0 R /XYZ 85.0394 406.031 null] +1811 0 obj << +/D [1808 0 R /XYZ 56.6929 749.6432 null] >> endobj -1785 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R /F62 1361 0 R /F63 1364 0 R /F48 1238 0 R >> -/XObject << /Im2 1350 0 R >> +1807 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R /F48 1253 0 R /F62 1379 0 R >> +/XObject << /Im2 1368 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1792 0 obj << -/Length 3654 +1816 0 obj << +/Length 3972 /Filter /FlateDecode >> stream -xÚ½ZYs#·~ׯÐ[¨*s×\ë]³N¼ëHrªR¶ F$(M–œ¡93:üëÓn`©T¥*¥*Mh - ùãâ×ßÅå–ýã…ˆtžÅ—ÏP‘Ìsu¹»0±Žb£µ¯Ù^Ü^ü# 8hu]çöÏÄY+“ÀNêH%RÏﲌR))52RF¨°ËJÎí²çÂ]nʇåS±-×eûº,«Ö 4]»4idŒL/‡ ‰¸fäP9d¬"£ôXŽÛ½]•¿ ¡l‘&‹öÑ"‘.ªnwoTYo¨n]¼2ˆ\S wH›®íW2[pùùÑVÄòñËííõª……W…gl¨½èÚzW´å7 -4¥ôé¯aÔÃslÇC„¥éûXw‡Ö®³˜ÖŽó¬í¦ û樂;^æÜxÞ}2CÍ
ŠUÉ4ƒžØA b+UåJæÌÂëñ ʧÁŠ4*¦<å^" BÓX§ªà›RùNQ‡E4Æš×u»â¥Üu;*À噋pG¡
õj‹CC—1Q‘Ôy2½‹±ÐI"Èã|¨¢°oØJâ$”ÚªÊje÷¬È Ø–;ßÐз«”%é §Î•¤¶Ì_Ó·®¸ .QÃûîX½«î@õU;Ô3¡Á©p(´ìm¹+ɪ@¡ØÕhw.ð]mëÕ7"›oöù*W‹S[DH‚I‚º5å¤ùŸÀ+בF?„{Á†l|9ìè VÑRÅÖMËu}5²¥† \…r¿uøˆdPM[·_ßSM¯ð©Lr]É… Éí(|iG š¤Õž¦éxCqŸÝ6±hà¼ï·–êÜ°…7xPqoÛgk¹Àb Àô¡¬»†káTyÈ¢âò:Ÿ Ö<:ò ÙA‹Ó,2Išœ÷â†\§½¸Àå‘ïó²ª×¶9òà4xÖ:UçE\32Œ•ŽøÚc!œ ·ÁÞ“Cý ¾ Ðîüä¥N5}﹯}O©r7jªuLjkþ芪õc³› ¸ìÂ%222ËǦ„´ !}þ¤‹ÔsÙ>Žš*ûL¸Ž»þו”rQÍH¯åTsú[‰$Ê¥âÛ#ŬO£\+¯ãOCH'è5½ ¹Î@ÈsM!äUê Žb3ÁÏʸfl@&,I#»sPhëÙmy¬âª€% –”9vê]W§™”wv\= -b½Ûpb': 'jCgðÊ‹rë€ t{(ªfc)¦ñâ—¦s¨ ´ƒà\”JÓæù ÊY(ˆ‚È)‚^Pƒ()wú£v0÷]Ku- ÀtÌQtE‘ ÔÞ¿†NDìÀ‡Ã€³àqûx0_4Ûâ‰ùü¡¹¡×³Y -†»åã% :Õ“ÀjœKq‘â{‚
ÙGûZ¤°H„CIù·ai¨±ØïÃξà˜Lz{ªžg,e&0û.CÞEÐ4”Ò‚=<ž#Î"0»ÆO1QõsSHðÛ”Ÿ&ËÕdR¡:Ž£ÔôîgH— -ÃŽ¥µßœ–›Ë$Q*Œ|hU&B%ydLæ7*œŽ ëG~<S -3™‡:¶_“™R ‘¤ÞmU"O&³Qª& =iÑÁÁg&y#Fr¶èËÝñuÕ,»õ ÜØ?ÝWŽi*óóÓ®™ùGî«÷5Öj,Àm]²Û'ž€(Ö hÛ’<Q(_C AÔ/ &â¾ÛàÜ8õ$@? ô®Å¹_ÈñÊœ‚ïX¡gì»Ó“è»bõ-HÆ®-Ÿ0uíÀk ¦œ&¹™¢dí¥Æ͈†ƒ†X*"œdÐj -Õô -üîT‡4?g+ÒüÒíö¾p_|¼¨©¶ã\T‘ -(”W§‹Û]±åd2+L Únð?ýà| -@Þs]VºÏ_Ïùƒ/.ôÄðé;Îáß}øùJªüt FBHžé7rŦÓ6Ì3y‹|Ò‚F¥TúìÔéxî±ýÒ‘Èu2šœÌ—ÎØ Ô EÐL‘/e:
d¡» -x;w, ÔÜ4ê„ôÏ'o˜‰ÒL©Ñ
s£Zçí£Þa*"ù6/S!‡Æ -ùÙèpp«"“¦ñ Ý1ƒ» :‰9H1lš0,æØ Ãj6aH²Ô eU·_¡ý -Æ+ñuØ´=XÛ#IÓÄl®f -ÖŸræWTýü’ŽF ý† -ÅI"p~Ž„É ÔZŸÝÕÀô†Ó±úk -ïx¡âªä•¦QxZë
;Šúº/ùX´/ËS?ÅÜ“žM ˆð0÷?ÿ¤´ÿ½‰³ìÄ0¾Úh¼P¸¬4;V>p_Ñ ‹þ &í#¾endstream +xÚ¥]oã6ò=¿Âoç +iWÛÝ•XÝÃØ÷W’q6i3Æúææêë7:[I‘ªtus7Z+ODžËÕMõëúÛ¾úùæõûë²b&×›Šõ7oß}G‚~¾ýéÝ›·ßÿòþÕufÖ7ozGà÷¯ß¼~ÿúÝ·¯¯72·æ+^á„7oÿõšZß¿õã¯Þ_ÿ~óÃÕë›x–ñy¥ÐxOW¿þ.V û‡+‘è"·«'èˆD…Zí®ŒÕ‰5ZHsõáêßqÁѨŸºÄ?«óÄæ*[` R#Jm“®2[$©VÚ3ð©|¦
ý ®e¾v»îÑ1üÁõn<´íüoÕðÎ÷º ²6”ã
J”È + ·ªÛ¦nݦ¯ïÛº½gü1i–(•Fÿ£k]ŸœqX$ÂÂågªH”4fY¢i3Æ"†È%‰ +X¸í®n7wwpýÃf¨wî+:æ®ü¼öØÃáù 7 +!|h•D
uŽ½«@ +mÊ–Z$¡Ððš´ä}f-w®Z¸,“LÇÛzª½ fbÔ¦¹-ñ*KéJ +,ʹ/>Ö„¹m‡Ë[ˆ[ š]4UÈꊀ:k×n»#ܹ£n_Ó># ”Ï +qg1—(¤Wgë»ÒsØhB‹dÛ/þGXœoZ ô¶@ßÛOÚk)xrŸ·®ïë Cìy
¿7ßþ|-U±¾èÉLŠ:•§/{²1ÖeO±‚c¾ìÈÒÄØ<{y÷ˆµ°ýÔ‘I&¦»“Ó9ƒL ä X“CŸnQHa¡‘dïï ;#[7>¬i¢„ €‹Zf’ìuÑýúUúÑø1-5Y¥7™c…øìy8ÙU‰É2;h@0wð¢SËÉŠa?†± Ã~ôc Ýû1³ Ã&S
[F;91ʑЉE–Zö?8M>vØäc“¶±ì³ì! mð`Ø {0ì{†<˜Ê’<á‹Ò8w`&±6³#†«—ô3ñ`Ç‘–Ž#mœâí 6H¦pö`4ï«üB4žÎ +†ñÎ؃)aÎ="‘óèä°9ö`83:% l2Ç„¸NO‘OËŸ| }ÖbzwɃ'À@Q +õg£ ˆ—£ßŒéÁ +Å9‘*ͦî÷‹&“^ÏrÔ’+ Xxˆ™)§ ì ÄÔṫ³ô²9wZôPú£Tl/äÂh¨¸“™Ëþ@g*ɱÀù¢?c]ö‹4 EHaã6 À; +‡&n!ÕIªtþ2kŠ‰[H!S P2>Ä’€WI.™if^Ãm¦Ï·Qüð—Jj'Ì>t¬èÝy²+ˆTÔä,4x¸_Qãý¸–ð¿pªóuIض(DQš@(4§ì-Joö2o#Ö¨8_í¤+M°âùÈ@'Μö¯ß˜‰Ñ’õP
ÜçaA
•N +|· ¤¯8ùS)ä°éÔŠ>=Ô[Ì +º† S û•ê¸Û'””gIjÄcEpC…NãEQ`‰Ò©žz•wÝàK*xch==ø¨ +3ƺœÂD,¯MoË›póŸŽîð<úžbq|N%$ŠI‘ÈËdF¬:§aÄßRSBû®Hùå^„« +UWE,e ~ÊæODx¾…Ñøœö¸»ålƒOyz*¼’L“ó
åÌíñÀ5Jÿ²ƒ ·l]wd£Á|£aþ΢€Ÿ©qS[jGã³ ‰–œX8üÐ(‹å¹¿/½&ÙééñÚÀ¯>AL +ÿ·
×ef‹æR¥Ñ‹þãÒšÙ¨6À¯Il¨Ãzô! Ügúä!ŒH ~"3}ØR¢¡,ÄwÝé© XWTÚï¹ÈÏÊ‘‹Õp¢TèüË~À¦±>ê°Ó +FQ7ó|šž-K)f¥sÜtó¸sa·’/»æƒÔLSåʆUB†Ë×ÛHÊÀ^jta³g¢và Ûwm0UiL¤2– + +Hð‰òéxõ }DâY«ùÆ4Ƈdîèêu¼/Ü=ìxG€08SuäÕ¿Z|ÆX´oJFˆgkÿÝSøn a®9‚_ lNŠ4†×à‰-aÜòXÓ=ÞÐpÀÇØ0 õÁ™ ýóñ¡Ð#1uËzâè[βn9Zž‰ê±%3Q-**0v!–I >‹Ñë%§| MŽl<I“a÷i5[9³þƒ–é¼Û·Ì ðE”`jt\ åyMM)ªåï zfFzfXÏôÈ'Zú´Ë7‚ÿ³á»+ÚbËŒu.§Â0RW±`L£dýöJ‘ÀªÑËÊŸå±k# Å •y #`Äcˆ‚ƒè©|Ìcì†ÚŽæ ÷žQºíŽÈ lry‹æ—-¡Ö»}çß<òRéØhÁ!©™C:„`& z)€ð6/Ô¸ž³ô6~,¦õRø'VaËÿûãìÓ—ëiiüRv¹¬,R,êe($<+æ”ǯ¸ÏIÿ Ú!Vendstream endobj -1791 0 obj << +1815 0 obj << /Type /Page -/Contents 1792 0 R -/Resources 1790 0 R +/Contents 1816 0 R +/Resources 1814 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1796 0 R -/Annots [ 1794 0 R 1795 0 R ] ->> endobj -1794 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [286.8324 725.4794 335.1613 737.539] -/Subtype /Link -/A << /S /GoTo /D (dynamic_update) >> +/Parent 1813 0 R +/Annots [ 1818 0 R ] >> endobj -1795 0 obj << +1818 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [324.9335 73.4705 381.8296 85.5301] +/Rect [353.2799 369.0217 410.176 381.0814] /Subtype /Link /A << /S /GoTo /D (zonefile_format) >> >> endobj -1793 0 obj << -/D [1791 0 R /XYZ 56.6929 794.5015 null] +1817 0 obj << +/D [1815 0 R /XYZ 85.0394 794.5015 null] >> endobj -1790 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R >> +1814 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F21 950 0 R /F41 1233 0 R /F11 1353 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1800 0 obj << -/Length 3893 +1822 0 obj << +/Length 3338 /Filter /FlateDecode >> stream -xÚZmsã¶þî_áò̉Å+6Î\.¾Ä™Æi}n§$ ( ¶8¡HHÙq~}w± -ŽýýËdaõå3tXÆ‹B\n.”–™VRFJ}ñéâ iÁÁ¨tJ~ZÚL[a&(Ä@€œA[å—FY.…ôܺeïVp(8hß⯞- õ ]ãveòK˜¶vxnXW—2SÒ(à ×mÊ[Í—íf[Õî÷¶‰ *tƵÑቾmk¿´rvÛöŽöì×eO»>¯]C´’~QOø™1Qž«ñ¤UõpÅíìÁíðÇ5=²q9DV¨ârÎyVh-<ínCÛIܸ!–Õð”ZeEÁLdÙýÖOœKä _i䪣ë¶\¹Õ» Ñ)I«åPr«‚|
7"ÌÚ”/´l»©‚„ºvãí! "He¹vË_ Ïëj¹2m÷W|V‡ë_„§·n‡’ˆZmÏYfP͆2C9+~¸%è -€–ôd,A–YÎí›” T•
îuƒ™ÙMX}[îúj¹¯Ë Úè”XÁ$°ñ"˜£p»‰
sž1-‹áÜŽöYµtª¦í‰Pn·õ 5Q4~pú¨\ðL MbW>O ,[š©“Þ¯«Ž$f“Š¤®„}W6Ȥ–þ´ˆ&„t Ðö÷¡å9&™Îl®Š·˜Tšé—´èfßõ´ù"l7D
è>Wýš&6©+7¡åMÍÚ=¹š&–]d8îÒLUx&² ƒ×ÆÊHš'Ï ”0™ÔEþ¶™)®“&´
nû¸‡UmXž„ëoÉÒ-yr×é7ˆ1Ôu}÷;ÜJÐÏ›²ëÝŽ–ž ŸrgAOY>PÚ¡¬kj tï°
x½œ,ËÀøÂ}à§l>^ûäv»jµò0+ÍÌŸVZ¯[ð³% à »ñÈSåžidQv^(0èªfYïWUó¸ m2?&'`ñº†W -›Ð? Fý;>`ÄE9Êl|2Ö -sæƒI)ð‰P+Nò–PW ×n oûóÞí^ÞC›ò·ùäø1‹"7™í{•Ç4é”É‘ -‡Ãê4ûÍÂ% äæ(ˆð¾W3 -8–û]W=9"u°NÝ—k÷Á:‚Ðh˜¬eóBGx´¡&‰Ó7‘]R*>2
ª÷— ½3™Q6ÎgDÀwŸû—-ü¿¬Ë®›XÔÌæ)4ùë¹5# ñ“»}+ ßí -‚Hy2ÁDĶ³ ù4„`<i“ -î£ð–¿Ó2÷ù:ˆ u€™hÂsuE* µ‡'Âœdg*Ø™ øD nãhô˜ì†ù ¼jÛÀÚò±2 Ì•M€iÒ¬ñž—.‡X$•âÓW‚ž“Ò‹Ê@Ÿ"VÂ’ˆ•0^ÄHˆX5OØ¡ˆ±hZz~¿õrBҢݣx°Ùú§ÂóeCS«Í¶í\˜±x™ -‰9×àÄ‘?ÚÅX& z*€¸Ö1€? ª ƒäâu8ë|ˆšfšõÕÃË|åêò$ôä -o¯¯ïžfMl?ºP¥³Âñþä”
¤ç€s>Ck±!7”BD¿òšÅŠKÿì\jB~ „äZTËÉÃÙˆ¶q]W>zå6Ñ™¹¤ Än_H+† Å(:©¬ -V ¸:íþJ×ò -PpaFU\Zü%¦Úh_
†kÁA$9ø¥ñ»±àÌÝoÛºZV±FV‹•…óÁ˜#·_€jœQ‹‘xòå:W1xÖƦ‚s¡-¾åÓ¯çÃYçƒó4ËKÑ%SùÐ&Ë„z}ã4kbç1‚ÊÌXiÆ[‡0Ø& |§Ô‰a;–º Möµmw}xº*©~bN -MŠÒkú2Öi -–\¾ºkœsºëH½¤ÊD¡ÆÛ’ùåùaßë#9Ù_>(5çfl0Fö—Sé0Ï“ýAÓ x¸æ9ûƒ@™<úúÈÐ9ô¥±±ùá&ÓæÙØ~È12¤/²CxVŸ59É°Ö ÿ°ÉÁ’TÎÆ¢ÍuD÷a˜
ïÆpøp5H¦¤.
kð%ËuÕ æzÕ M‰OçƒdTã»|ªÑÙLYuü½¯U eȱªˆŸÊ׉#K«†"ÌxØ7>7ñõåXံ»jSzuÀÎ~‡e.zÂ뻽ÿîEÙAmP*!(*Âá „M(µ -7Å1çé«îSÖÿ –‚þendstream +xÚZÝsã¶÷_¡·Ê3'–ø"€ôɹó¥Îô|©fÒ&y %Úâ„"u"eÇù뻋(P¢äË´sž#> ìb÷· @l’Â?6QY’Yn'ÚÊD¥LMë‹tò}ß]0O3 D³˜êÛùÅ_? +=±‰Íx6™?F¼L’Ã&óåÏÓ,áÉ%pH§ï?ß~¼ùî_wW—ZNç7Ÿo/g\¥Ó7ÿ¸¦ÒwwWŸ>]Ý]ΘQlúþïW?̯ï¨+ó<¾½¹ý@-–>'˜Þ]¼¾»¾}}ùëüû‹ëy/K,/K +òåâç_ÓÉÄþþ"M„5jò•4aÖòÉúB*‘()Dh©.î/þÙ3ŒzÝÐ1ýIeÅešb¥²q-³D3DZ¦‰•ÊöZælLË +µ\7]ùø:[Uþz(2c<Q–›IÌ÷höžjdz MϘN”–l8ÿ|U€âµžÒ +cÓwÐ`Ä´¬±#›¶Å¢©—k•Ó‡¢{)Š¾«^–õ1h‹®¥RóHÝ$µ‹¶ÍŸŠ–z ›-5çôù£© 0al¼ Ç|WuT)[TÎd&Tb5îc‰UŠ;~ISþ\ýü’ªTÁŒª~ñ‰Â0“d&“‘è@Ô<Û¼ª¨²Í;ßÜòŽJ·Ÿç7 ÿMåH¨åÛKf¦E˜¬öH>ìlQB?¦ô_XYç†7UU,©íÁÁáa•pÝm±-ójöeWl_gn¹4$Þl®4ó#’#gò›i›dØÎY³Ž©N›uO…3®óßgÛ6Ÿ¿o@𺛵å Å‘}£w±Tž_FO5²Ž}g"‘–™áBh“m†+*×»5Uî §a}ÔŒ‹;©!뇦‡²k}“·h|)ݶb·çž/Ŧs»ˆý+ç!Àÿ9¯ÊeÞÍÈz
KŒ…E¬ L?cvúã¥åS +R{ˆô^•=P
àÌ&Bi1Pw]¼ÌN¡?$VÙ~{â|-¯^ò×6DŸºQ 5ÃtJˆÌôJ³CoHQÆqG@•Z9L<o0?†ƒÒk³£B]„ü·[–e›?TU:L,:)ßQy×îû}"Ì[ +P7¬SJʦ+ˆqƒq@z Ü<°Ž§ŸFöÛr)׊œÜ1õ"è_5ž¼ qiàƒ¹æ˜Uå¢ô›¸¥t¶P§!ƒ¥àŽÌ|¬1fƒí3}ˆä‹UŸÜ‡ä}Q•ã´'Óhi “ɘ8ŸFÇT§ÓèžÊi±è]%ž×¦‰ToLëiFfõ`U"xÓ`V3ýô®Ò…Ö> ÃòªÙUK*“kmšmçG—9ü‡@Ñé„ñ¬óu1’»pÀižŒŠÖ“œÈa4Þq¤*Ī²[ùY^7ciŒD§¶Ácç?ÍǼŠBÅ(…l’ žAO†0‰Éà )å>Q…Â>zBÅ… +ém–½1sO52õÀÊP·R ÌMn˜eûE¸Zš{?ÄrðÃLýúÈ¡à?Á¡è ó<å‡H…p tÊMšô>ëÝ'wC8ð€?%†VòUþcÕI×]ZžŠ?ízÀrNNb²à{-µ»L ¿t†Œ·›é\×w+'‹UYG´ÎÄ$atGÕ4÷÷]Æ$ +Ò N‡÷2§Xt;Êi‰¾}µ9ü€*$V[*õÀáîeÎ Ø7\ Ø8ñA„ûÛXȉV&À{l”àX‘¤2ÕÃÝû¿à€ +?†TÑí¶5ÕoúðùÓÕÍmÜÛnšº
Ò<#T5$%‚
íâlloºr±«rwì}× ~\Λq·vw¢áH EõD± H@½PÈ—K¿ê–úxt Žw ßS3D5ãg÷mb*™Ã6>UZhÏÛY‡ç1"V¦¬q‡{è®Y¤ÈÃRY/ª»÷Ó2ܺÈÑ´Ú‹Fýþ™ ûÃsF%g²D ‰K}èˆ{“Æù!Ô<ÕÅ]Íý~ 9•õoĈxŽ b…¾;È‘='(UM³yÈ¿ù[»Á²°¡^ž º««›—úhäè<Tq. 0^´w ÂUœïq|s—[»“ VKÌï¹t (A
kˆ-žUåïr–¯ÔPü^¶îGø±õ¼| ÒŽòÙDÅ“épỢIa/_È-–3„¿1#Šhú³É²€äÞDö?«èUêõ +}þWT1•;Ò@lŒ’/A2‹xÑ›DʃIµ»¢æç'
DÇ“¯Z â[«†“²4¹¹]}øp—\Ýý€o endobj -1799 0 obj << +1821 0 obj << /Type /Page -/Contents 1800 0 R -/Resources 1798 0 R +/Contents 1822 0 R +/Resources 1820 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1796 0 R -/Annots [ 1803 0 R ] +/Parent 1813 0 R +/Annots [ 1825 0 R ] >> endobj -1803 0 obj << +1825 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.0431 340.5527 145.9475 352.6123] +/Rect [55.6967 566.349 117.601 578.4087] /Subtype /Link /A << /S /GoTo /D (view_statement_grammar) >> >> endobj -1801 0 obj << -/D [1799 0 R /XYZ 85.0394 794.5015 null] +1823 0 obj << +/D [1821 0 R /XYZ 56.6929 794.5015 null] >> endobj 534 0 obj << -/D [1799 0 R /XYZ 85.0394 410.734 null] +/D [1821 0 R /XYZ 56.6929 638.6405 null] >> endobj -1802 0 obj << -/D [1799 0 R /XYZ 85.0394 386.9945 null] +1824 0 obj << +/D [1821 0 R /XYZ 56.6929 612.5722 null] >> endobj -1798 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F21 938 0 R /F41 1218 0 R /F11 1451 0 R /F48 1238 0 R >> +538 0 obj << +/D [1821 0 R /XYZ 56.6929 275.0395 null] +>> endobj +1826 0 obj << +/D [1821 0 R /XYZ 56.6929 246.5203 null] +>> endobj +1820 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R /F48 1253 0 R /F14 976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1807 0 obj << -/Length 1892 +1830 0 obj << +/Length 1319 /Filter /FlateDecode >> stream -xÚ¥šÑ’Û&†ïý¾«<SAïœd7ÝN㤎;Ói’ ÅÖf5ñJK›múô!¤cC4LF€~ÎÏXÉñ «ñœqÄ%‘óT&ˆá˜Íw÷3<ÿ¬î½šÅfiEK¨z¾ý|MÓ¹D’>ßÞ‚Xa!âùvÿ>∠…Š€£oÖ×7¯þܬimoÞ¬KÂpt}óû•I½Ú¬^¿^mËX°8zñëêíöjcnñ.Æó›õKS"ÍåBÐÍÕõÕæjýâjñqûÛìjÛ³@ÞS
òuöþ#žïöo3Œ¨lþ¤2ÅR’ùý,a±„R[r˜½›ýÑwÛªÎþ‹1"”G’ØÕL"N í;0æ(NU¿`¬ºà±84Ë¢4 W÷Íw“ü»*óZóª¨DÅsu[5=6²ÎîóýbIî²Z'’¨®îsSô©®s¹‰®%ÿ¶ÑÛÒ˜áwoV¦<+»`ëwæz\Ä"ÊwU{ÝwUyø®ªÅj9ÁÑö.¯;ÃÌèMæVÕ»5wYÓµò®z<ì5¡fŠc$#-SY ï³ÃAw„äѧÜ\³²~ÊMø½)9T;+c¦åºôé®ØÝ™ä×ÇüXhgéüÚtY5§Áë¼ìJšÊÄkîº[7e“ ˼ù©‹Ó6¡²êüø-?Öª'’Dèž82ƒTÝê: 0&»";(|,lE“éÚL±ŒvÕ·|GG“kº®UšRtýíò®ŽéŠæñXšüú¯—o^¯nÖðnýP•µ ÉF1»Ò‰"5‚3ŠK×Ø4Åîñ î«çó™êÎm8ÂIÛö£NÒ®û¸@µA-hg‰Ndû}×êÚÜ#Ñéì{#Ø\¿0Åjö‹Î½+£QKzZF"–Ò´‹ÝÎŽ.†‹3µÊ)zAõê)¥ -{M{ð3S'ø‰i{0!?¯´±äi -&ýðPu¾W…ས=ü™©þÄ”ÄÓàU.( À•Þª‚ð>Ó~lꆇ¦„Lƒçêbo ÊoUAxŸé -ÂûLø±© š’i'<J9<ôâ ª<ðV„÷™ðcS7<4¥ÓNxTý-2Øê ÊoUAxŸé -ÂûLø±© šÆ\=ôòÇé‰ ˆ1Øë ê2}¯ -Ñ{M{ú3S'ý‰)×_ƒ~ü%Qú„áÀ{ ¨òÀ[UÞg:ÀMÝðД³ið G4 <ó@äAïDArã -ÂûLø±© šª–L‚§)JÕ) -ÂûLø±© šê÷Sàc‰8‘à Tyà*ï3 àǦnxhª IðXQG„ +xÚ¥šKsGF÷üŠY‚›~?–XB +®X¶ Y9^Å•lâEVùûiŒzøhzîUWÊ¥2’s8S-æÒ 'Uþé)yR6»)fG^i?ýñ}¥¦¿ÊïžWú•ÙVh‹Ô»Óê§'§L9˜0þ„c%R)ééôíËúáçݧÓþ¸Ù¯Ö6[ ÔúÝáåñò“|ùïáãËÓáù·ãnÝútøørùñqÿ´?î_ ö›N^—û›×#,ÜáéðËþrëù¸ûðawÜ|=½_íOs öjeÏ!ÿ¬¾|UÓ·’ý~¥Èæä§Ë7ŠtÎfú¾rÞ’wÖÖŸü½úuõy> üöÇ]{çof¶ÖQ +åüYö™‚5v>ËÚÁYÎåf²¥ Rç³ü»Ò±MÕÊ•;¹8áñî¬3u¯5´Z•Û.Üju"
^¶»ÇÇ#펟6Ù¬w‹'Ýi²Ae! (&¿Rr>g…üVÛÏGÎcùÆ–¿‹ „| ˜üJÉùœò[m? µFåWÒIZü@1ù•’ó9+ä·Ú~>j Ê)”' ,~¤–ógJÌg×ü;m7ÿFkÌX~Hd¢.0H1ù•’ó9+ä·Ú~>jË ÂP¾W¤”?RL~¥ä|Î +ù¶ŸZãÆò¦hMòbò+%çsVÈoµý|Ô?–¯-¹ MWH1ù•’ó9+ä·Ú~>jMÊ÷¹œ®¬4ŸÔrþL‰ù¬õš§íæßhM ˲NÂâGŠÉ¯”œÏY!¿ÕöóQkƦ>ï•òbò+%çsVÈoµý|Ôš±©Ï»òÊ iñÅäWJÎç¬ßjûù¨µcSŸ?Ï ª¸ø| ˜üJÉùœò[m? µvlêóÊR²VZü@1ù•’ó9+ä·Ú~>ju™t~{¿+7|Æ €–ë+$ÆsÊk{ë즣3œ7 ÔÛÃC$“•°î‘bÒ+%·sVˆoµýzÔ?–ï2)“_)9Ÿ³B~«íç£6„±üò,pň‰…ävF é³_β†Âµ!ƒ°Ç“^)¹³B|«í×£öüt7_¾È(/,{¤–ógJÌg×ü;m7ÿFòX~ô”ö8bò+%çsVÈoµý|ÔF5–ï#…óñø| ˜üJÉùœò[m? µQåÛL6káb“_)9Ÿ³B~«íç£6š±üó† ÎÒâŠÉ¯”œÏY!¿ÕöóQíX¾2”\ö8bò+%çsVÈoµý|ÔƱyÏ$G>Fañ#µœ?Sb>k½æßi»ù7Ú86ï™2 Yå…‰)&¿Rr>g…üVÛÏGm ›÷ŒKå†?RL~¥ä|Î +ù¶ŸÚ86õ“)+ìq ÅäWJÎç¬ßjûù¨cSŸÑš\ÖÒâŠÉ¯”œÏY!¿ÕöóQǦ¾ò‰ŒQ RËù3%æ³Ökþ¶›£McSŸ.WŠ\Γ_)9Ÿ³B~«íç£6M}Ú +1 + H1ù•’ó9+ä·Ú~>jÓØÔ§m"§‚´øbò+%çsVÈoµý|Ô¦±©OŸ?`…ë @Lü+$·3JHoœýrp¦±yO+M)XiÙŤWJnç¬ßjûõ¨Mcó^Y&>aŸ åø +‰íœòšÞ:»åèLc“^ðT^%IoãW†{ÿó†·ð}øþpáíûY˜âà¶?¼ÖyåKSöÞüÿÏÑÁæ`$›–>‰cU dr¬êrÁj ¹/Ïh>™Øyèÿ–†b3endstream endobj -1806 0 obj << +1829 0 obj << /Type /Page -/Contents 1807 0 R -/Resources 1805 0 R +/Contents 1830 0 R +/Resources 1828 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1796 0 R ->> endobj -1808 0 obj << -/D [1806 0 R /XYZ 56.6929 794.5015 null] ->> endobj -538 0 obj << -/D [1806 0 R /XYZ 56.6929 769.5949 null] +/Parent 1813 0 R >> endobj -1809 0 obj << -/D [1806 0 R /XYZ 56.6929 749.894 null] +1831 0 obj << +/D [1829 0 R /XYZ 85.0394 794.5015 null] >> endobj -1805 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F14 964 0 R >> +1828 0 obj << +/Font << /F37 1038 0 R /F14 976 0 R /F22 973 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1812 0 obj << -/Length 1323 +1834 0 obj << +/Length 1333 /Filter /FlateDecode >> stream -xÚ¥šÍ’7F÷<E/a¢«-ñ 3Ác‡•ãU\É&^d•×0£æC¨ï*åš2f}útÉô¥štùCSòJÛ즘òšüôû·•žþ,¿{]ѳЩwçÕ/6NYå`Âtþ¶•”N‰¦ó×Ïë§ wŸÎûÓfk¼^µÙú ×ïÇçë3ùú×ÓÇãËáõ×ÓnÝú|øx¼>}Ú¿ìOûãÓ~³¥ä©¼Þ¼maá/‡Ÿö×G¯§Ý‡»ÓæËùýjž[°—´½„ü½úüEO_Köû•V6'?ýSþ¡ål¦o+çòÎÚúÌ_«_V?Ï„ß~iïøÍÌÖ:•BÙ”}VÁ; erp”sy˜l)¨Ôå(ÿ¦)¶©¤]y‘‹nïÁ:SZc@Kº<vá^c9ˆZ ŽÛÝóóIíNŸ6Ù¬w‹Ý‘²Ag! (&¿Rr>g…üVÛÏGmLcùÆ–ÿ9ù@1ù•’ó9+ä·Ú~>jc Ë/®DIZü@1ù•’ó9+ä·Ú~>j“ Ê)”7 ,~¤–ógJÌg·üm7ÿN›h,?$e¢N0H1ù•’ó9+ä·Ú~>j“Ë÷Zií„Å“_)9Ÿ³B~«íç£6Ù±|K*Z“„| ˜üJÉùœò[m? µÉå“U.HÓRL~¥ä|Î -ù¶ŸÚ²Ë#ù>>kâó‘ZΟ)1ŸµÞò ´Ýü;my ÊAeJÂâGŠÉ¯”œÏY!¿ÕöóQ›Æ¦>ï“**'äÅäWJÎç¬ßjûù¨McSŸwå“A ÒâŠÉ¯”œÏY!¿ÕöóQ›Æ¦>o.'Êââóbò+%çsVÈoµý|Ô汩Ïk«’µÒâŠÉ¯”œÏY!¿ÕöóQ›Ç¦>W ø L= -ù@1ù•’ó9+ä·Ú~>jóؼç¬VÑ '|€˜ø7Hng”Þ8ûåàÌc“ž#£\ Â%¤˜ôJÉíœâ[m¿ µylÒ+?Êh/,{¤–ógJÌg·üm7ÿN›Ç&=½ÊÖ -—8bò+%çsVÈoµý|Ôæ±IÏú¨Âe{|>PL~¥ä|Î -ù¶ŸÚ<6é•£¦l&ád“_)9Ÿ³B~«íç£öÒ>ÔoÊlDYZý@1ý•’û9+ô·Ú~?jIÍzV•\.r ÅôWJîç¬Ðßjûý¨%=6ò™ä”QXÿH-÷Ï”ØÏZoýÚnÿ–ôØÌgBPV{aêAŠé¯”ÜÏY¡¿ÕöûQ{yñP¿KåÖ?RL¥ä~Î -ý¶ßZÒc³Ÿ1YÅ`… H1ý•’û9+ô·Ú~?jI
†H¹LÒúŠé¯”ÜÏY¡¿ÕöûQKzlú+Ÿ•”1Z¸ÔÔrÿL‰ý¬õÖÿ íößiI‹¬ =¡ (¦¿Rr?g…þVÛïGíåÉ¡~ TˆQ¸äÓ_)¹Ÿ³B«í÷£–hlþ#›”ÓAZÿ@1ý•’û9+ô·Ú~?j‰Ææ?2åxYáôSÿÉñŒÚg? œDc“ßeRNÁJ+ (¦½Rr<g…úVÛÏG-ÑØä—¬òÙW= +xÚ¥š=s7@{þŠ+É‚,¾QÒ¥ÐËÃTŽ+{œ&.RåïG ‡%ˆÛ ŒÇã±,>Ýã»uK qRùN΃O:M!Yp +ÝôõÇFMçÇž7øÆì ´§Ô»Ëæ—'¦Ék?]¾“cEP1âtùöyëAÃ. Am >¾<žÿ< vÁn/§/»½vjûtúíøúÕóùðáÃá¼Ûct¸}øõðér<¿>äߎñîôòøúôúÏÊAÏǧãùøòpÜ}¹¼ß /K íEeæ7Ÿ¿¨é[Î~¿Q`RtÓù? +0%=ýØXgÀYcÊwþÙü±ù}9 yôú£½ó·0{c!f¿p–]o´YÎ2Zr–æ}.(Ô|–ÿRÚÔ‡QOôpwÒÝKµ&ÒˆàRr·Òó)TpzÙ Ïp8Ú%½=¬žr‹`¼JB<¡˜øB‰ñœ´Æ·Ò~<•Æ4¯M~M$/ÄŠ‰/”ÏIk|+íÇSiRcñ*/ûÙÅÇŠ‰/”ÏIk|+íÇSi¡x }~ñ{aÙSj=~¡¤xVºÄßI»ñ7Ò¤Çâ} œpY¡_(1ž“ÖøVÚ§ÒdÆ⥬°ì)ÅÄJŒç¤5¾•öã©ôzÁ ˆ7Áè(ÄŠ‰/”ÏIk|+íÇSircñhÀziš¢_(1ž“ÖøVÚ§Òä‡âÝ|²’B>žRëñ %ųÒ%þNÚ¿‘¦0Ÿ] £°ì)ÅÄJŒç¤5¾•öã©4MxÎEð6X!žPL|¡ÄxNZã[i?žJÓØ„çl~¼´ì ÅÄJŒç¤5¾•öã©t. ª×ó``ƒPO(¦¾Pb='õ´_O¥¨Æf<§ Dc¤…O(¦¾Pb='õ´_O¥¨Æ†< 8/Œ9Zo/”ΗòÖØ
§FTcóõtRš§S^(1“ÖöVÚ§Ò¼øÇêm…Éõ„bê %ÖsÒZßJûõTŠjl³FA°Âež@Lû$¦3ÆZÞûáĈjl¸³¨Á/ìcPŠ)/”˜ÎIk{+íÇS)ª±éÎä7AZ9aÍSj½~¡¤zVºÔßI»õ7RTcã ’1ÂN¥˜úB‰õœ´Ö·Ò~=•¢›ïŒ àçòõ„bê %ÖsÒZßJûõTŠ86ßå³&¡p‘§S_(±ž“ÖúVÚ¯§RıùÎèÌc’V>¡˜úB‰õœ´Ö·Ò~=•"ŽÍw&σÑFa7ƒRL}¡ÄzNZë[i¿žJǦ< -¸„•O©õú…’êYéR'íÖßHǦ<í=å„A‡RL}¡ÄzNZë[i¿žJǦ<m#(c…•O)¦¾Pb='õ´_O¥ˆc³žÖ ‚7ÂŽ¥˜úB‰õœ´Ö·Ò~=•"ŽÍz:_#lBi助/”XÏIk}+í×S)âج—ßÖJØÑ ÔzýBIõ¬t©¿“vëo¤ùÒ7V ,¤|î„zB1õ…ë9io¥ýz*E=6ëáüE¾¥˜úB‰õœ´Ö·Ò~=•¢ ›õÐD°ÊK+ŸPL}¡ÄzNZë[i¿žJQÍz×µb„ ˜ö7HLgŒµ¼1öÉõØ”7ïøFo¤5O(¦¼Pb:'í´ O¥¨Ç¦¼hòA´°A õöIéœq)oÝpjD=xŸÖA~g$ÝŸ/ wwþÊÈ÷æWuäÎünå¾ü¢Cíw1`þ Zç)ä¿É9ýóŸ‰#L\ûtùU4º<©ëǪôÝ3GÚxÝyêÿˆY™endstream endobj -1811 0 obj << +1833 0 obj << /Type /Page -/Contents 1812 0 R -/Resources 1810 0 R +/Contents 1834 0 R +/Resources 1832 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1796 0 R +/Parent 1813 0 R >> endobj -1813 0 obj << -/D [1811 0 R /XYZ 85.0394 794.5015 null] +1835 0 obj << +/D [1833 0 R /XYZ 56.6929 794.5015 null] >> endobj -1810 0 obj << -/Font << /F37 1026 0 R /F14 964 0 R /F22 961 0 R >> +1832 0 obj << +/Font << /F37 1038 0 R /F14 976 0 R /F22 973 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1816 0 obj << -/Length 1730 +1838 0 obj << +/Length 2325 /Filter /FlateDecode >> stream -xÚ½š]sÚ8†ïùL¯ÌLQ-ÉòÇîmH—Î6íRöªí…¦ñ 1“d³¿~,É>8B‚éÌN&ƒ>^éÕs|$D †ðC‡"&qƲa’ED„T —÷ƒpøúÞ¨ÖŒhŒUoƒ7×<f$‹Y<\¬Ñ\) Ó”«¯ALÁ aðîÓÍõìýßóÉ(‰‚ÅìÓÍhÌD\ÏþœªÒûùäãÇÉ|4¦© Á»?&ŸÓ¹êŠõ og7Wª%S/'&O¯§óéÍ»éèûâÃ`ºhY0/
¹ù9øú= ® -G¦pÇù¥ŸÙçØ ±Xn2Ï'_$rÄK‹¼ár8vÑê9Úƒ… éÿ+8DÌ={ « Ñ2*o¸\¦]¼ú¦ö€aÓ”¼%Wò
¦ágçE -hîâ}ÕV5®ºåA«Y t˜åAk½+–å·0dÆ» £2P
:Œ\‡Ðy(‚…|~ÚgûXì÷åªÇ¨¾ÓUÓˆQ@eSÖݼV¯hPkøZ•Ÿ·ª°Ì«#ª´*fÛC7ƒ*凞PÉeH m³ÞîU¡ø'¿ßmŠß$Í›ëˆ o¥„Ã6à -]^ÊgÒô®TƒI—×òñ%S}·}ØhM¾Qš|%ó$Á]þ¨ÍTÌYë“BÆëh}–\G«•ã¸ˆÔdá¡. «bƃY¥Zvû|y(—…ª îJ=¶j‘ïuEnVùZÉg. ·^§®lXæµ.=•‡;UºÏ«gUúù -U~_趲R¯0umÆìàAçË¢–[,áÁ—jW+ÆƒÖ 3<×¥:_,óeO^_U«&5ä [Û»Õ»eUì6Ûg³1›RîÅ»¼ªš3ï,Ñg½µ¶¹ ’?åº
kxÔ©0B—& 'ï‚‚Dö 9üj˜_þ·
ô¡=!<MOÜñX’’(åÌ,ª¹ã±+§pÃç1³,ý?¦êªIendstream +xÚ½ZKsÛ8¾ûW°æ²TU„/Ø=9±œÕÔŽ“u´§É h‰ŠY%QŠ öx~ý6Ð +Î}ËêêëÕ¿ë ƒ^;´‹¿ZgÌQ)ÌÑϲÔ$åŒ×,S°¬AT x-Ãò·„f§Pi"`È¢p¾3«µÖ¹YƳ4Y¤m³”eÀbB¦wãë››{r}ÿe¤Y|}‘u‘Ee:€?ÐêÁ﵆ñ÷Y
ðŸšíÆ šý 䌕@ hõ ÷ZÃÈû¬ÈOÍv#Íš•5ö„ª À hõ`÷ZÃØû¬ØOÍvcÍ2 ¹#կƟ*Ax*E?þPë2þZk¯Õÿ™ÙNü-³Œ˜LÈ^?•þT6€?ÐêÁ﵆ñ÷Y
ðŸšíÆ š5OR @½ž‘’Œäý@©‡ +‹ªØ˜„†]^}/œ<7 b{ØàcåY»¬1³Ü WN'_¡N¾xA³ù“3† 0çÞ5øøñ¶ZþuAàÇ¥@ ŒpÜR)ãñ´Â–í.Ÿ Êyo‡ÇÒ
}Zä;÷bvªyVfÁð`õ]Üš†y¾wÒsyxDiW/(ý8‚ÛÞ™‡Â"@EZ—0•Õr—ﻑŠóñ^°ŒB^Ú²ðã +„*_®¬ð Sïý˜íˆÆù¼Ø›ý•ñøëÛÑãpÐØñÃs'íóùÎîây™¯:œx.Bÿª¢XØÐ0slÚà°N}p[eQlW›¿+mv4ñ1¯*›PÃme}qûj“»!ùsîÚ‚œŽºD#t9äÒ iˆ$Þó?|SF´–¢ûÃ7 WœÈL°Ësá¸ær¢ Ñžª9›£D&¢õ
º 8œaÿSE#¦)QÂÕwAÆ)ä {œÉxn5>Ã^¡}aÇÄ“Sf`NAÁ5&2˜ ÑD?"¸m9*²ÅÚp`ÞO×,ºÙ +þè%? ;ŽÕ¢Ø¡xa›×ž*ŽU˜ÀØ ¾µQE³‘SßÖ@”?TApT ¬³)€˜Ä N*sIÐ(ù'bS»ŒÇruÛ¡šƒ>ðxuà›áÌ@ÀsYÓUµy¯×NÚø•4[vi\ù»`PŒ(ìúÕ¾¿(Š'º¬ÂQØEí_ÎBg$å)Âô¶Ýiò€Ô©ŽÆÍo\oË c(^嶊ʹèþeJÁu_*SCÀӰr¦ ¿:ÖZf…°°ÀdxV¸ 3ÔÚá¼ç…»×ê0ßÚ¾B©Ûö¿š +qiŽM®ãg{äÉ9des´¹~DFÂÓe³äæ‰g3˜æ!†*s¶˜–¯Ÿ¯Ã®ùÆ>]§=CàBÛˆ¶1¿ BAýd/\C*Õº áU] –®ú jÞwõqT Lfþ¿¹ˆÏHn“€äH¨_çG”[oj~-UBE Õ^« Šù¦:˜jà,*4alÈ|Õa¿R–œ:PG…ÉA&áxl³£
š mJÔaadŸ°\V'aaºlX4]MX˜N,Tsóч…€ ™ –Â=ø
añÁö6ÿüoa +t·½˜TÍuÌߢZw´Ü³åÊ_ñÌ çŇ_n.óãêаïÚó°,Dœ—É6O%¶\ t™j¯tášwÆ´$L$i¯µÒ¹mžØ›p; ]¸©)åæ6°(ŸÊÅÑ–ð^ßîiÃl"Yh ˜µ *7MðÝ€Öwp;–ûÒ€3sw‡Û \ßñ/â0àK¦qÞfR·ïí/ °pkp ÜÖ÷ör]ôÔö’˜ÿdÒAaRÑoþÿ.áw4ÂÕ¥¯y<I‰b:óNÙ¹üÔsÉdG–u¸þ_ÑyP,endstream endobj -1815 0 obj << +1837 0 obj << /Type /Page -/Contents 1816 0 R -/Resources 1814 0 R +/Contents 1838 0 R +/Resources 1836 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1796 0 R +/Parent 1813 0 R >> endobj -1817 0 obj << -/D [1815 0 R /XYZ 56.6929 794.5015 null] +1839 0 obj << +/D [1837 0 R /XYZ 85.0394 794.5015 null] >> endobj -1814 0 obj << -/Font << /F37 1026 0 R /F14 964 0 R /F22 961 0 R /F41 1218 0 R >> +1836 0 obj << +/Font << /F37 1038 0 R /F14 976 0 R /F22 973 0 R /F41 1233 0 R /F62 1379 0 R /F21 950 0 R >> +/XObject << /Im2 1368 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1820 0 obj << -/Length 3220 +1842 0 obj << +/Length 3646 /Filter /FlateDecode >> stream -xÚ¥ZKsã6¾ûWè¶RÕ€$Ž“Œ'q*ëÙõ8•C’EQk%RI{œ_¿Ýè 2eÏLh -&|¼ùåšZ?Þ½ÿç?ßßþ¼ÿùêú¾?Ëø¼R(<È_W¿ÿ)8öÏW"T65‹'x¡´6Z ®´Q¡ÑJùžýÕç«÷ ŽFÝÔ9ùõ4ÀY¨„‘_µŒBkžßV€V`ÑDG—×¢yÖ⦟1]jPo 8Š¢^½Ð”2´ÆD¨_+ÂD‚Zc@ç1é÷%ì(mhb-‘PŠÐ¨8wŸVA,—÷ð?Z^ŸëÖÔXK`ŸT¹-d(´µŠhFmwÔA®ã»›C´øPã3ùuƒÑÂîHq4B¬Œ’P Dg‹µr ßï -ÀP’.OE¶Ç–] ³SQµÔÛ§U Äòq™eqj¨w»‚®úDäí®hx¿WÒ,ëª`²fWwû
QmÊ&[¯"±Ü3m¶ßS£8 Ûg"òói «6ʼnš° -‘Ðë˜ï9MÍx.¼áØì™Þ¦§@B°,ëåÇþ <Ç5Xتëvn ,ò‡˜W6DäŸt¶T/݉»rßeECþ´#Žbhæ|÷´2à©ìÅUMå\ ¸U{M¶ É,+ßáVœN+)€¹fJ¿)Š£tY
§Æ©(zþÆ`Ö6 c«ÅؾÍ6Ñ ÛE0ø—oó m*É9™õø"L=ˆ
S¡ ÉßS¡†œ: -âÅ÷Ü·)¶Y·oésFÚç5Ün¯[Ë0Q½!ìÕ+ÂöTxL>R0ý¥°Mi¿ÎCO5ÃÄTØ TÚ) zÁ* ´) ËMç’ x÷ò…f/_¡I¾Ð7’¯2Þ /Ñ7WùAEËúØ®`˺¢×<«hš§ vÓ{_ÊgGFEê; -Q”*ÎÚ37}†—bV’X&ãõQ䎡Šv)«¶81[Ì
´5u•‡£ÓaýÈGi=©¶9ÖUÃC‰mɤ¸HêPÈä'òUyAIs½EçÚ×™Ðc 6]þF ÆPv -%·P&é%Bg:ÉÄV]N§FIEû!Cƒ– ò‘UQô…÷CY‘}êQü§!Z©ÏH eLÔ7M˜\–ÁûöùË4E2ž;NN~[pùí.˜3’ºkg&‰J¿®ÔJûRëåBŸËØÇ¿ü9ß—ùÜ:ihà L6΄% -œe=÷kr‡—7Vžè.oBÑGjùSýT`6©ˆ+ â³Ø6’ F0Óü⼿ñÀ -Ïÿ¸ª[ݸ~—çEáj`?m vÞ˜ú èÆe³/š†7ÝNøѽ;ö£ofy§L êÓ†>œaV§PSöIÞ›4èâCÆW2¡GÆüÝ {ü‡6ì]ó,ò¥Ôr7öøôNRùŠ“X“Øt ´L<œ§hÃ÷Á êùÈ8ög™àãêÞA د|ËÝG—UCo=šCF•,«î°&âC ,è™ D¶ª„˜…'Õ ní¬)˜¡ü5ƒB÷…ß…«¿ñâO»2‡$ã^gã¹iù fR¸û †nÞòÝl:yï—ÜÖ{¨Jûõü5@Æymw8d>ú¸X }áuáš`&ð»R%ÿ›»¾xß+!÷1üIúò}ï˜êò}oO5›çL¿±¤aœ@ -óêö=ÕÌþÓ’Iaþ–N¸™³z‹·¡>ix…ϤN|5Ĺ·«”É¥W{ÑîBM¾D¦—Ǭ¯¤ËfN×±ÄOöíLO¿©g!C™Ææ
=¨^ѳ§é9ß4W+Bà`/Tn
^ÃǯsÒSÍ°2A·a Yõ”’r4|^Å6‡ŸÈ2ºBª6£OCݽP)ŸJq"ðÁkp ëM¾?…ç/w¿ÒäM¶Àäaw "ù©ÕÙ7Utóϳê¦ïÆâMÁ¾À@¦‘ô3!²tû|YSăz L¡3ô>s³¥QJ0|ÔÔ!P,‘F(ºwHúËzyž£ò¼r¥©,BszöáÛ_ç‹vᥟE)âï”fp"ú_}óO¦† é$TizÁÇ(ʉlâ™Â³¤êœs£R¬’Öÿ •$Þ/endstream +xÚZKsÛF¾ëWð¶T•9;o +rþöã‡wWßý|}qžØùÍÕÇç íäüÝÕ—Túîúâýû‹ëó…Jš¿ýþ⧛Ëkêò¼Æ7W ¾¥–Œ>'½¾|wy}ùáíåùï7?œ]ÞtgžWIƒùóì×ßålÇþáL +“¥nö)T–éÙúÌ:#œ5&¶TgŸÎþÝ-8è
S'ù§¤ÐÆë j5Å@— o´é¨¼P)ðEJ9¿Xʶ¬7yEGýT,±ÊìÈ—åæ O
këÁÚr¶Ð‰Ðk°êÍCq¾0ÖÍóÁrÆÚy—ÃÎ%,W¼²OçyÕÔ4d™WU±â=†ô«˜ªS ›á y˜>A‹ÎDš$)ãõˆ ÚÐ.å¦-vLSB mMMåz»;Wé¼~䣴qDh.šm½i¸k[ìîêм@z€Ê +)ñJ”™s:²Î7K˜¡“l^ßÁ7í$Z2A¸âù/ņúwçjÞÝ4uìÃK¾ÐƒçÃÆb“ßûÞ`k2\ž>OeÅKñ‘±1ç{ž„½ ê]»XîÛp$Bz‡\Ò:!¦`axÑZ§J¡sYÃÊ›–*È©P(€œoš§‚[¯¯>Ôm7ÉÛ yЉ Ëîsò`@Šò…3mƒC%=O¡k], òMÙ¬éRLD&•_j¸I7² oè›oVT[ÂwS·T ªò¶àø
ì„· >Q¡'Èáõï Ÿ |·ß‹îz2aÑ€ QC-6p³½Ú
åÆÀ-¯ê¢¡æ@]è‡CßT&¡‡Â‘У +öÞrJüÉ"aär¿£ÁIYЄ*ð,g› +x®Û‚PPsQíö@½§Í‰J¤Hm6&bAÀm‚ï…•Ö¼jE”°^ºWˆPŠ«RÐฒ´Â±e[7M‰ô„Z€'x¦m±,ïÜÈ\`&\Ú ñ¿ÝF¨R•ëòHÉ;¹uG÷ tºæ‰ù@{oyô¾™æªvJ8c|¼´üyÁœmÊ¿¦øš!K:ŽÐY4DP>3§áÔ +Œ7!ëµ™_?ˆÆ +Òëï—Ë¢pœ6t;
oLm÷9íQMÛÞè±9Ž½ŸEy» LYÔ;”Ä—2kSˆ);P†é#
Êz(?Rp£Šq:æ ÎÐØg_¨õ–g‘… a1ÆÌ Fâƒ-Þ) +_qß$€VIç±´a½W uز dzŒäýjD ÈßÄò + ‰¢ü%Ã…VEÜ…£¿áâO% ‡ IƽŽã±jE 3 +Ü#† e@%“pò&.yWW•vëÅ4@θv¿^çÑF¿Xocàu"M0áøÀ\Ke’¯3×âEêR±V~f¥ZDšN5Ò ÅpÔéLc7jç wWZ +ð½êõí»QûÀŽv¬ƒ p5¥õ™PÞEÐp€ Ÿ€N +T*7#Hi\„qXïÐmÉ¥(¾!ÚÍí“Þ r„R,*2"¸Õý=Å"…êÀ‹Ôq¯¼íi›@]¬ªØpëèýÕ ³ÛÅŠM¸
9MlÎéÓÓ©cÊZ× `å6X¨=–ÅS0$0†¨†[æÛmU_pÁm¾çOgÐüH ú‰=W5CÚ™fzbAÏ;Ÿgzþªû‰>ÇŽ“ +œn—3Qþý”ÁIDfô\ iÞB9 ¾V¢Š¤`ÒÓÑócÆÏo»—"|»-«–ðØ+Ž.¬CYsĵ}br¸\íPi„Å€ oËŠÂ9¶cøŨ©¢üÎÛ3ryD,Œ‚j$›±ï¹{P Î#©àŒbéíæ,‹]È{OÅZ‡mƒÄ“~%IÔ¯„>~I’¤@Kü0üO³ù'LÙгEůámÐP¼˜ø˜ÏŠ™ÇÿPZ" OzQ“h +A†çwgÏ'b=¦T=»ç˜öÇY'É;€©Ý3nsB +zƒlÂO¯Ò` ˜€ A íí¤Ç˜g̨ .>õ_$…™MÜðAÐ\ e±¢†€á^ÊeFÌvÂN?xïÀS;Yüa–üÉL˜Œ°ÙC @»2Qc±•EJÙ^#±ÂHÆ£™Ø‚ƒé·Ì?á˜N Ešùé
ÆÁêéì©Õ¤™–ÃlèÑÖ8— Òùå ÅSÙà¹pNy<7/(²‚RÀÖ0*ç{é÷> †u¡C¶ß€Dx{¤X-œñö2)ºËœ
xF‘# ÃO þð/,Ç ;Aoñœã³;ÓW<†¬= ì‚~43aÌ9…XÖköž™cG"Š ¸úÒ6‰€sê±ê|ÅyAót÷’öfB×qÈ(ñùôô$øœx endobj -1819 0 obj << +1841 0 obj << /Type /Page -/Contents 1820 0 R -/Resources 1818 0 R +/Contents 1842 0 R +/Resources 1840 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1796 0 R +/Parent 1845 0 R >> endobj -1821 0 obj << -/D [1819 0 R /XYZ 85.0394 794.5015 null] +1843 0 obj << +/D [1841 0 R /XYZ 56.6929 794.5015 null] >> endobj 542 0 obj << -/D [1819 0 R /XYZ 85.0394 508.2158 null] +/D [1841 0 R /XYZ 56.6929 769.5949 null] >> endobj -1281 0 obj << -/D [1819 0 R /XYZ 85.0394 481.2174 null] +1296 0 obj << +/D [1841 0 R /XYZ 56.6929 749.239 null] >> endobj -1818 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F62 1361 0 R /F21 938 0 R >> -/XObject << /Im2 1350 0 R >> +546 0 obj << +/D [1841 0 R /XYZ 56.6929 258.4984 null] +>> endobj +1844 0 obj << +/D [1841 0 R /XYZ 56.6929 228.7653 null] +>> endobj +1840 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1824 0 obj << -/Length 3716 +1848 0 obj << +/Length 3431 /Filter /FlateDecode >> stream -xÚksã¶ñ»…¦_"ÏX<âÁW®q.vê4wI}nû!ÉJ‚eÖ©ˆÔÉN§ÿ½»ØRÔùšœ5 ‚ `±Xì“~bÅAœÉl’d:ˆBMë³p²‚¾oΙ¹A3ÔWwg¯®U2É‚,–ñäîÞÕašŠÉÝòÇi Èà 0„Ó7ß¿»¾ùæ ·—牞ÞÝ|ÿî|&£pz}óݵ¾¹½|ûöòö|&ÒHLßüõò‡»«[êŠÇW7ï¾&HFHo¯®¯n¯Þ½¹:ÿùîÛ³«»n/þ~E¨p#¿œýøs8Y¶¿= •¥Ñd/a ²LNÖg:RA¤•ròìýÙß;„^¯:Æ? ¥A$u<™) ¤°þ8—Eƒ’( b%UÇe)ƸìF!—×ùÓ,_ä‹3kŠ_Íp×BfA"Óxâ£>" 5Bô(°‹$Ì$Ü=˜ó™ -ÒR¬wkzÉ×õ®j©]ßó -wdç,ÌßDZ}ÞXAHbR°$q -«`ð$Q€®¼jöVø -b¹ÆyITØîX(°`º“t 7íì~ 1ÀÈJ:ªD”25b/ìbµ
Ù…rêŠP–'huêˆ/ Æhb4[–4}Îü“¶‰¬oóÒk-ƒ–LÊ*'RJòòZ’ZjNpð1m îË0~W<š}ј šS ç:ËM6?в‘5ŒÊãA?ë;úx¡
F ߯ NHD¬OØ-ƒHÅú7Ù™¸ÐÖãXDÎGb—$ÄÂ?¿ÆvBùöš§|
I -ÉÁnH‘~Fè0¾À_•«
´ m²ôój9VÈ%Dzr«x¡åç”öã [Åú ñ`«›¹/žF6 ! ¡3m9‡{ ê0•}«‰ ø›û]ùÚÙ1YHt - --šNŸëÝ–ZõÞÑaÚ}½}d¨£·+Õº@9r?Á z„z„Zô¶ân·Œ‘¸s“!KçÙfN°9ís߸:z͘šÅ¶ØpA|QïÊeW{¯¼â; uzEÓ]Õ‰ÒÈAqùõéPq½Ì˲ÞsiÏÝ„ÑA<웕wx®LKã0X³¹‰×i‰µ•f*º"´ª—Œ’jK Ó -# w ø%5{NÚ4ÖÅêo~l²{ÿ<ð|÷õÁ€X_™Nw¥i¾ ÉŽÑK¼DÀ¦¥ÿ¡‡OØký— ~•ÇŸñ•pS^mº·:'ÞŸ†é8?V§bdìb+k0*z ® ÈŒ8³Šo¥i†ÓÃzlô¼ -FGÂ`'“ñÄf' ¯¹µÛôI!‰°ßgZÓÈTÛ¢¸ƒDþbôZÌÉÂaw|—@± ¥ÿαùÑU/Vë!)‹Gㄯøs䌔@.û&>V÷ sµ…»1Æ»ÞS½ë½8M§ï‹ja£)–µ—…Š¯©ßÆ€ÝEŸ+B o!: tzvåÃéÑõ€J¯ é/Û¯¡à´-§lû`ìLŽƒå£ dÀÇïñ˜¥»R†õÊØŒ§`ópQÅæÔ Ö—`0ÊyC}(èøÌéQšUÑÀžê™M˜G˜Lòm”íýžnã1¢¶ÖX&Çw<‚ýÏÀ 9ÕçáG“‰£ï‚˜Ò|tTîêÇe]¾\ã³·Ð{óéJE§+•_–²O+èØÁç¤ÐíS•‹™¡õ{•w¹%Õ‰J’’Q “®Ê÷B?tÇý›
-™v wæ®5D¨áÇ4 …£YÝ»ºíŒ‘
Vuæ) -Ó3÷™Š;u -L±ÃÕJÉDQ»® ã[N€lœÙ´¡+~+rÃcïóEÛ©©9|sÓ#á¡Ë=)‘}ÅÙ.çí—nI[ìጆ×6 o³Â„Âr|_ç›
Ù™ˆû\°-Äç4‘3Tg³8èígq ¥C8 K!“îö Þg ‰«-@ƒ²cèßԅ͚ͦVû_ÛÄ©ÆÛæ5váN yå¢ÝñÅ) - áÛßÔr¼p½ô¥Ð‰¤Ïœ(ª×;®a£»Ë¡LœSa@&•¢I¦ ŸÄ -HxÍáWU^ ¢ÂäÀLïs
û ßk. -Xúà× :T Mµøs@² ½Ê K2ŒqªŒÃÖ»†o¶°ì¶(ŸéuÎxøTZ*¦• ìnSHø3´…MÉ\ñ¿?šHG¥+ ÅUÐSRYmeÚ-‰f4}¨÷æƒwî1Ÿ;~zðL9£_‚{$ö¦ Þµ§
ýíñâÖ‘ÀˆNbN|Ê -é~:’>†wÞ¿û3×Ã7À: TšÊñOCe’:$LžKª(!Þ)ËÒÿüú`‹endstream +xÚkoã6ò{~EÐ/U€XE=»÷@º»iÓk³{ÙÜáÐÇY¦m]dɵäxs‡ûï7/Ê’¬th $‡äpf8œ—¬Î=øSçIèz:
Îã4pCO…çùæÌ;_ÁÜ7gJÖÌì¢YÕ×gW7:>OÝ4ò£ó‡eWâzI¢Î ?9¯¿½~ÿðöþb懞¹³0òœ¯oïÞ0$åæõ»»›Ûoþq}ÎÃí»;ß¿½y{ÿöîõÛ‹™JBû}Áð†›Ûïßrï›ûë ~¸¾¿øåỳ· /}~•§‘‘_Ï~úÅ;_ +ÂO1šDn u}»3Ëâã«`´ò"Ë*é) x`à@¥Ü4 }~4&«ŠjµÜ—¯Ø¾eÕ”Ä`^ÒÔªÁ£y>ygqâª(mb7Šcõûß™Å8룜xg‰rÁ øÇ“éSú ¸AÚ;>eÉ<Ï
·MQšª…w@£bUÕ,¿…ËTÊÝ "è¥n ˆÈŽÂcÕ‰r2nxG³«Æ0dÏ1[É húËþmòÖ,²ØË’¶–v-€Ÿ=Ï/[³ƒ{‚Ǩà8ärÇ/Ÿµ(šœ5aa;íºÞ·<˜ÀL zCåȳ|m—V1Òáæ8ß0tþyƒžòúö{†š ‚£á©Œ™Úv¿«ŒàC~©]Ë’¼,€/·£ˆdÍ×ú°&¦¢PÀ¾ST©˜ÑH„ í–Ï}IJß÷ƒ7w xO΋jÑ¡ËÚ6Ë ›K\'TÜ ÖøÚ—UýÅ`A—(Ô´[=Ò‡Ž$Ø<93øëÞì@ÿ´—8K¢öRÒ,/êMFXTeÃPV\Õ^ +tƒlÒ»òqœÌt6ÅjÝJ¤±5y±| 9¾e}´ ä*g_šæ«‰€l(Ç^ÐK +A¾Ç$Ã(T£öõã×J!¯78w9%ÊNŽÜÁÖ/R¼Bêƒ^ˆXÖõc«A¤6 ARÆê^ñúe©éóàòE^õKM_k?†£p"Ž$rŽd¯Ôo "FC X“ÄùPT¹æ@6k3 ¢¸yž@»Àälº ûÙ ½_ |¼<X¡s Á4£céÅâ³7‚òeK ^²Lãô•œFÊ'ùÇHŽïð–ýXt:ä’±9k°xx¨cÚ_6 –`1ªyÃs¨çØfÜ”fU´D¶öŒ&ìãð À:B Uûp8\¤þQã¶Q“-‚&žÀ‰ Kj(ÃßÌ$NêBé§ô è?êþg¨:š{ˆ»år¡G— -S[Êý|߇ēô 'äš4ú<–©¶ñ2ô>!]}T^‹ë´~¤ýÐõ㮶׷ÿ§ …6„‘'˜Òl ƒBÍò“ÎÝÎÄûC" k/>ƒ …“Z|W·)¢@5H{ï„Z€TuÛ¿tJq"«úö’ûueј¾ÝÈÖM +[µò¤ +š:Ë,o»WjlÔ3"aÝiåß
q·Íw-9,~,t9Š.9 ØwÊcÉq¼É¶[63¡ÌÙ@ {ˆÏ>DÉNa ep0;ÌàbN…pA—>ÆAwtè,™‘² +83†ùm]PÆŒˆ–Ü>†mtàܶSÖÏÆ:ä”y»— ‹R~ +kȤ¿ eG }tƒ€Ub çb`Ð¹Ý hj®Ž¦]4Ù¦Öë…6ðIû¼£˜täÜÇÇ ¨Lƒ É ÓQ‚Ô0«Å tÛìå¥Ãˆ‚ˆ +xI›Æf¤gåä£Nܽ{ÿì V ^÷ÁJž +‹ýÿ€ÂÒÍê£ÁB¸Ô4±ËÁ”ÿB.‡ ?¥í‡Ùœ4“CNu=@ÂÞð +4T_L•“}7H;Uw_úÅ–]ü™ÕÄ7ïÜrþ»Íuü©[»:Iüé j²º‰ŸÆ–($< Ç”w?û:%ýÿÙB‰endstream endobj -1823 0 obj << +1847 0 obj << /Type /Page -/Contents 1824 0 R -/Resources 1822 0 R +/Contents 1848 0 R +/Resources 1846 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1828 0 R -/Annots [ 1827 0 R ] +/Parent 1845 0 R +/Annots [ 1850 0 R ] >> endobj -1827 0 obj << +1850 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [63.4454 380.8297 382.2499 391.644] +/Rect [91.7919 633.8696 410.5963 644.684] /Subtype/Link/A<</Type/Action/S/URI/URI(http://portal.acm.org/citation.cfm?id=1315245.1315298)>> >> endobj -1825 0 obj << -/D [1823 0 R /XYZ 56.6929 794.5015 null] +1849 0 obj << +/D [1847 0 R /XYZ 85.0394 794.5015 null] >> endobj -546 0 obj << -/D [1823 0 R /XYZ 56.6929 708.0945 null] +550 0 obj << +/D [1847 0 R /XYZ 85.0394 189.4262 null] >> endobj -1826 0 obj << -/D [1823 0 R /XYZ 56.6929 680.4573 null] +1851 0 obj << +/D [1847 0 R /XYZ 85.0394 161.9629 null] >> endobj -1822 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R /F11 1451 0 R >> +1846 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F41 1233 0 R /F21 950 0 R /F11 1353 0 R /F14 976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1831 0 obj << -/Length 3786 +1854 0 obj << +/Length 3959 /Filter /FlateDecode >> stream -xÚ¥]sÛ8î=¿"ÊLÂ%E}î>9Mº—mšMr“›Ýîƒl+¶¦²äµä¤í¯?€ -O›yº‚±_OÓ\X¢ —êòñä§:>MEùÑéã³Ã+2IÔéãò/ïÿfw×÷g~(½Hœ]„‘ô.on¯“RóáóíÇ›_ÿ}?;‹ïñæó-¡ï¯?^ß_ß~¸>»PI¨`¾Ï ŽLøxóû5A¿ÞÏ>}šÝŸýýøÛÉõcw÷¼Jj<È?'ý-O—pìßN¤Ðiž¾BG -•¦þéæ$µ-¦<y8ù£c茚©Sò u"ÂÄ'èûS Si_fÛmY,²¶¨«Ž%^ÖR[W‹ Ä¡#í=® ü"¥_¶ù®¨V„xγv¿;S‰—#"ö,åÖ ë—b™/-Ãò;AmMí:/·5ûÅ™òÖ¼ƒŠ'lóÙYV"¯^ -b[mòªý°1¬Ø¢@J‰4 }s0³Xy«¼.¥YºË¢YÔû]¶2»„Ù ¶û]EPÑR[›¾ïí«2o˜Û÷zO@Ö:/ùŽÙ7{ßQ¯³FU¼\Ý®ó ‹u],x8«–´( 3¦m³Å×£'[̨¡…¨ ×®¹ßRÿ¹Þ -.ì:Ös -GЩç/E½oÌq ûÅ÷ƒ¢kDø Ñ¡7ß·4¾É*¦ Ý"À,êêLÔ¯åGKÙž9'Î%®W·–ëvK× :ÏdÓ4õÆ0õªÌB$ÛïÓš s™°íÏŽbÒ‘÷±èo2ÔæX -„íršMV€c-©W°¸˜”ù6Ûàù†7/Áí”,€æâ‡8ge†ìBOF^FÉCo™›+94 -p'ÊO½sšxû0ì›lÉn ®p’ ´aÐ/5a‘]ËÀ à -éÎοÓéÑ€èrxzX¤G£€7†<I«¼e÷EsïïQÓ›aCKHœ!kgn5µ”Ó·9cדɞëLb(11dWüZY‡ms§>`p>ÍR4I*¬Ï±íV gÓð.±°†Ì9÷ƒdæ¥ø‘óTŠ’ÎTXh22˜ë -–æ -¬2+KÂ<SÈhþ½ÍMŒ€dã28§GÜ¥¶Ÿ1 ¯KÅC´3Ã"§Ö‘(¯wЈq*e{`™/ŠMÆ›yÉÊ=ãÏñå¡÷%³/óÌ,ªC¯)VUB[˜ -婈ÚyA‰…äMYG(Éšî! g` #ëÒl]ší@[‹ Fj4CFyM+ÆÈ´ugzh&‡ ¨šÔ³zp–/§vLØû„mÇïå„šW·|Óy)çÝîlÞ>Ðù–á×5ôLA ‚ø ‚ÏûA©b=±Œ‹¡ÃB*³%>!=.
\G)h*èRñ ?ÄTº Ø èÔ=L•¡f•§±2 ü²ÞÏËÜ>àËÚ}ñÿü30O´ïúÑû ,í9’‚e6ã,s/ -`¢{NxŒ/RÅã• `¸‡·–ìˆÖ $ÀA4Xóú®›|$Ñ;Z ËñG÷u“ƒ+}Jͳ]—îJg“σéÓŸRP!æSŠ8¦
•$BC¸}[ .Õq}tTï*äÍU{ ,;©’Á²w$ˆg[(vêÁ6 Ø}¶ßGä²#s.]/x.7³Ïé4x\ÎðH -•¼#g‡ê
9[ª÷åüÖªŽœÇËNËÙ]vFß -}åæu*ì¤uNYÊÖU‡²ß“UÔ׺ k, Ð&¯5é+Ò1Hü F_ÅTdËó€ßWKbõŒ!F=\˜¬éZ×:;®'ˆ8‰¢wôäP½¡'Kõ¾žÞZÕÑÓxÙi=¹ËZ=9vo¿h šøùàÜÝ¡ßf:}2ÙÃÛ|•[å¾£‹[¡¬¢w~bèR½!nKõ¾¸ßZÕ÷xÙiq»Ë²¸!ývüö@ZôS93„C 1¦ŒP'óoÔ§š*D…8ó}£RDÔ<@*uV'2º_ˆîî×pö~MÜš‰ŸFØDä$£QžüdJO:âÏõºÿMáfRÚñ·/üÑ uG™tÄŸ¿ú‘6ÛÑÏq"þ•L” >6š[U‰Ê e?XFñDÊ Ù¯dýî'ê> Í ¥ ¼ XgüûɪfÌœJBQ:LP¡1¿ž» -üMëÄ,©ÿû§³ý¥‡×³N’#阖¼ÓØn -O‘„ãw¿±=Üú–NŒ¸endstream +xÚ¥]sã6î=¿"o§t–¤¾;sÎǶét³Û$Ü\·ŠØšµ%×’“ÍþúP¢dÙ¾¹ÛÌF$ +Ò»út÷áöç?î'gqà=Þ~º;»Ð¡ô>ÜþvCŸï' ?NîÏ.T*ïê—ÉçÇ›{ꊘÆåíÝ5ARzì!zóáæþæîêæì¯Ç_On Ûµ¸ëUÒÇ…ü}òç_òtËþõD +?MÂÓ7x‘B¥©>]¡/ÂÀ÷-dyòpò{KÐé5CG姤Ð~¤G¨õ˜ +ÃFª+jz6–8 «OœF.³¦x-¾ç<×Ó +ŒD»–Œ˜–bæí‰Wo#Zh-¨“LkWаš4/8?ÄÊJz2Ïl6cՌȄ{ûÊ 'ðZC1 ¶ ÝعNî žÐe𼛢*ÇÔd¤žFFêðh-Ì wÂèöNÃnßaW»ïð§ÖÑv ÍYd
µÙkN¤¬y +Nñ@žnáðáqß)R¬Fظg1¼°–Ù”â À.Àkî¸ ¥ ©À¸øþ]ŒX§Ž… +졘•Ù²šW[æ ¶F*Oc!e<0øYµ}^r¤5–°"j‘¡üé'ø(L4ñÀ8ì6°´8ä“,³ ™ƒó íym« ÉšÝÉ€/ŠcÑ’9+ŒE† øc”•ºy¼—2;š6fØo#ám³€
âëל u¾ym ¼˜c?°‡4lÀ$Ñ„!Ó˲f¥'o9µ£Û¸xÄf™–£Æ(0i³lšY`ÆÕIà°½<о›è²ëº°Z“(á+¨Š)v /]ð˜˜PÃ<0ÏRÞµà@c²è; Ù£…÷\PYÁ`#(_í‹ü´äÜAÚãFÚ$Ev‘ ¶QR‚‚)“<Ò.n†7¶lZ„a\&yOÀsÂ%Oƒ’Ãÿ¾Æ,ÖËóï©™5yŽ cUxŠq(‚̆@À"Ÿ~%=@ú2Ç1ŒÚš=öØT ;!>ž]¬ðÒ7UGlG뱫õÈ[_ #GLÖ¡£ƒÎej¶=°íïI‚P„*v쥬Gä ‰–qw$ã×IAsÊ
^¬“ì /hqjåòÀ¤"m³|£K•úÂȸo¼Æ…“‹j¬sæ®ú…Ùæ:«¢„%^̪¦ Ye ÝùDúÔYþ’m—Ì‘ÃQÎÝw9+ÒCý?ð¶I½ê'ê èåv–[àÚ®ü5_òüHå6îJ"¡?².[9Ù¼ßUUü —ö¤àˆµÕ”‰‰í&0/&G€ì| +' خԼqƒR·Ð[U]ätÕ+¬üÀiÆAÇ3‡°ëÝFÌ# À é]æÓlk–‡ÆõÝ6ü bM b 3óç
Ž«&ç®ljgLA!`™@žhˆ²ªŒ¤bŸcÑØYwKÔRù’Î2À«è2?^9£ØÈF +ûÓNØC¦ãÂv™²°!ôv<¾‘¬$¾FVª
c«÷7z§rêB=]º4^m" âÒ¦ÃÚòÃ…àvc9düncMÖ<œ¼ÒFÈHeõjO¦èäG1—¢„'_Ma …{ßzA_F¯ƒ:⋯®§É6æþÀ®Å½e4 ¶š}&r½©Œâ‘P9²÷cЛñ\é´üobÇ(õ g¦ÆÂ$Ž0¾¬òLÅ (í¨Ï˜£ÄÇèŸÐºH _0U &Öî iÊ™%%yWf„uº +-¤˜.øÚ !ø~<VÊÀêC^ H“!?Î?ƒÂ_“~¼4¹»úôÇÝã?Õ~ S ýÌÅ:`Në¨9 bÚ™Óé¸9¹L÷xH´àìg•üVMñ +#ë¬ÉÆkâqèž +i@QÓsôsì@÷ èv æÌUty@¤lÃæéh9G½9'¾lk˵oºËúÍN®÷?½ˆàP ‚¤oa¿ +ÝdÒµ‹ÜÍóÆ' 6MœàÛ‡
Š%R'ðM©ÞÌ¥ýªËÜØê[© à„©áN¤kY3©•{ÑŠ!úÔvÎPa¦UÔcGcF_Ù@ +šìN°éº“ÞçJŒÙs&©·tÓ) ùAäß²Õz™‹iµÂb#^ÿ6üY㎺QÐó òVZÎWR=ÓY“õ1ø¥1©Ll ÂjˆÙê¯ôb| »8x¥H/–6À‹åðŠ4n“"—¦½ + ¹ý +Û,lÈ0•R^4ÛT?Þý°ÕÜû· VªúFŒ½ô§¦IÓÒIÀœZÈ3Ó©À§lŠÙ,g8»ÑTyÙ˜I‡±ˆµûjäƒ(%”/-ÚtI×XÝÌÔž(Ò"ˆXÚküA=}—O ˆ$ˆ,¾SjÇêµ:Pƒ/)'FE6™geñ½Uœó&§ ³ä +’%+íMÕ ÂÚ[óEcy䳧ŒòVùtêwTôä¤à°¦;…ºs'”&ƒ¦¯¶8ûkƒ¡À? +qèðŸ¥ùÿíSw…Ÿ$zühÐ1¤Ê áI᪓hgæöv§þ £Ÿ–endstream endobj -1830 0 obj << +1853 0 obj << /Type /Page -/Contents 1831 0 R -/Resources 1829 0 R +/Contents 1854 0 R +/Resources 1852 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1828 0 R ->> endobj -1832 0 obj << -/D [1830 0 R /XYZ 85.0394 794.5015 null] ->> endobj -550 0 obj << -/D [1830 0 R /XYZ 85.0394 661.0278 null] +/Parent 1845 0 R >> endobj -1833 0 obj << -/D [1830 0 R /XYZ 85.0394 634.9717 null] +1855 0 obj << +/D [1853 0 R /XYZ 56.6929 794.5015 null] >> endobj -1829 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F21 938 0 R /F14 964 0 R /F48 1238 0 R >> +1852 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F48 1253 0 R /F21 950 0 R /F14 976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1836 0 obj << -/Length 3512 +1858 0 obj << +/Length 2739 /Filter /FlateDecode >> stream -xÚ¥koÛ8ò{~E°8àœÅZ+Ro œ›¤mmÒMÜÃa·ûA‘åX¨,¹– 7{Øÿ~3œ!%Ù´½‹CÑ9äÌp^´8wáŸ8B'Ldr %¾¸"8Ï–gîùŒ½=Œ3ÖHã>ÖëéÙo¼è<q’P†çÓyoØqãXœOg¿BG:°‚;º¼»}sóöÓýä"òGÓ›»Û‹± ÜÑ››÷×Ô{{?ùðar1q F—ï& §×÷4ò¯on¯’Ps`Ñûë7×÷×·—׿O>»žš³ôÏ+\òõì·ßÝó ûç3×ñ’88߇ëˆ$‘çË3?ðœÀ÷<
)Ï Î~1 öFÕT+ÿ„ëH/”Jic`8¡'=ÅÀû¿Â™B9Z_ˆx”gµjgkò¶¡^JÃø!zàzÎÃÕ uÚ—U¾3vuûp˜Bþ-ËW--{u;ùpÍs×fîÃõ%/½H[žTeõ,gÊY[ÔUc¦@€+c!œ$¤:"ÑmV€¦ölkj¿nòu‘7ÎA9J`UÇ'ô¶‡¥Ø.ü Û#Ü{káž>»"Ú%Áz"–ljj¤}¢YÇ ’$.r¤ ¨¢‡*G„QË#Îí®î>Lnn±¿fè9‰HbFìs•˜Y0sI<3úx|¡6å Å2†îvQë™-©×SÞWjŒ †ëš‡gõ2-*êv×?â A"éž2==¬#"ÔX'ExŒh'Â]¢vö‰NàÔnÇFW6º;l„!ÅFW³:Û¢œe©¹€ÒÖ«q™?ç%!ÎÂrö{bíX&Þ¨YåYñÙueÞ[v_<)XFRëÓÝÕä"‘£)þ™X´Ê 醣ÓuþÔ"[¨=ö"×q=ð–›½]mnÕ˜zê;¯v„æ ÿL¦ì
´“ÛË»O·ÓŸÄA‹‚X¢tá¨:õ±«“Á:¥NG‰uÚ#jU§Ñ!T7d‘¼¯³ÔC€ü®Ò6µ‰0q¢À—ÒÔ@lI+J^µh p -’€ûnQ“ PÖOOEõÄãՎܦe© ñ‹*¯þÉˤ›vQƒíä¥(N PY×ÏÀ6лÃVPNG§¬`ëˆÔX'à1¢Ü%j·‚}¢v+(]@u\ôQÝLJé»ûO!µK¼ªË"¶z‰Oj>pŸ3x|¡”>õ „®¾ƒ08¸ƒ´še§ÒwBßtd¶úc¼J›¦]¬7Ž-Ž‹ _Ú¼ßðÊYºQá±¢J A· ÎÂÛ±‰C×깉2®Ø²áKàþPÛ9è/‚ÒjF Åh—uóê¹Áb£Ð[û3œrUá…u™7‚OAš`Åx¶×‰¶×Éèòæêž7Æñ [ü »¶ -pYý +C-ÆQes”_¥–òIÀÌ4ä‘שÁ¨¬‹Ù,g8ÛQ@Mm: DõÊ`x£ö•ÙŽð\–•¨Åý‰aj -¯1£Ýë@VH²‹{šY´0`mPÑ[žÊ$ÍØhD?ñD¸©Y X˜\ÁDˆš&YÞH…†c¾Á|–a"Na#Úy -ÊçÙ|kãfµÊèDS¨D“s8 Ú<kOÖÃæ„Ë å17i$†O|š'@pIr¢(ÞÇ:¢yë¤æ #ÚiÞ.Q»æõ‰ž,x'{Zçjs9h \›fta’òÌs–‘!ØEäÇž |òPyêé¬u„Ûë$·í¸½KÔÎí>Ñ¿RŽ\Wó\ÇBÌO}Ózzm«ævA¼¡^,ñIíDŒÓÇ:ÌPƒuŠ¡G‰†îµ2t@´÷ ÂÅ{Kî’8—ñ_ÒãÎŒžÐéT›˜”ŠÎ\ñü¾¥`7ãt×ì–Rx 1΄ë;®ŸøÃÜôõ •gù<Ý”èÞ½HpµÕ»ŒqÌk”ª,VŒQÑ·:¶*.v•Æ#ˆ²ÐSêªdjªÃ_MMØ×±
U/¿Ð8• |ã-6ëFÅèÂ"ÃýÕO“okbÊáb¬‡ gÓ -Š -ÏE¾¥¾sjÈöÚƒoÏ~bòhuÚç|LlÃiUmQIÐe?ŒâAÚ®‚_8Àµj°/ŒŒvê¡yÚnº2:’ÝóÝù¦$—~BUÌTž
¡\¨RCaI0 ¸J* Aˆ\S!>Æ4*C(×®ÂQ½iûPÞ¿¹$€HDL½¬¬7<…çFœú[DÏÊè²¢ÁÉ©þƒ}z+h•NŒ¶÷"P•¶EòºjSÒw—· ÞôžÓr“ózu¥×åÉù·6_W &/Dæ¹Àòu¡‚üV×Ør. ÞÔ”*µïÔ½w“'e‡ÁåФw§}/fžàɾӈkn«ú0·ÐHíÜòº*Â!š—·iyb#öò‚ê*j<Qe -ž˜RC¶ -{ü|¦†,¶*ñœ(6Fçq§_ƳªiòŒ«Ýa Ó—¼±0Q¼y#í XŽn§öB/K› sÐ8ÐU¾žB«N¸I§Ð2Ò µ®¤}âTúMXo Bæ§Äˆ½Ãc±Ç]‰U“=- ÈòÀ–уŒb÷‰}žvYFÚÒ rÓt•†ÞOBLÌѱ³´2¥0°%6«rµÍzpÂÉé{ì:®”äÆÄþOŽ`hYϺ*à¨íH]¹@÷ˆ€à‚[zÂ…á^Þ$%sÀ¼þÝ“zDWWËü9ÚÃÛ",{õ'Aõ:ôêÕÔboÔæBUZª¨WËB½®+pMmJÍ2ýV,7KúPö ‚ƒ?NâBÜK:³¹<>nÛÒ–.…ŽŒÜx·´èf›½Òï¸vöÓck¨ŸJ £M?T@$I9´J:Ovt„j²o´ â—è èë¥ÞPG×â »1?Yè‚ ßÊâÚ´Í—yÕÒÙýÁs¦Š®7TÏÝW…qÎã¿Ô½ÅÞwé¬,šö»Wôýç+ oÇV©.uf;þ÷¶Kœ²l‰·Œ¿m î2m 2à΋RO ø;GÛ]oÇ\ƒT+U@ãÕŸÿ¤ýÌoÿ¨ºYιc/þ¡.)’ïl×é_cáÅ0üp7!¼÷w—“÷ïî ¦}£a—Oëþhý¦àÕÜ<æ¹3êÈ…yv¾1ðΫ‘ú‘‹ >”ÇX>³%”ðŸ—ü¿Ú«0DŽÇÒþ¬ŽÅñcX„7…G‰Ã½ë ªîoýSsÖendstream +xÚ¥]sÛ6òÝ¿BÓ¹ù¦B~³Îœb;‰{‰ÚêÍM›>ÐdqJ‘*IÙqoúßo» @‰’¯sÉ$\,ØïÅR# Õ( …ôÓ`§¥ +Góõ™ =ÂÜ»3Å4K4q©ÞÌξyëÇ£T¤‘fKg¯DÈ$Q£Ùâ—ñÅûé§ÙÕÝùÄ å8ç“0’ã7×7—„Iésq{óöúÝOwÓó8Ï®oo}wõöêîêæâê|¢’PÁzw8²àíõ‡+‚ÞÝM?~œÞÿ:ûáìjÖéâꫤŠü~ö˯r´ + +§ +ãV@?T¨5¢ó²1W1Äfؘ!²Ú¶.–wo/¡R•4/ª-/áµ1ˆ‰ò ¸žƒQr AŠèB·šà¬l &à Sãgêy ëú9oxÁ¼*ÛŒâ]²h +»x °4_K§öÊ Ð<k4Þ?“ÚØ h3Ø97Ý´ÛËô#, >ñ +s9€/Å bz3 +¾}ÖÙ—|½]ÓÀÔÜ< óE%žH%t¾ã°zBÂMÚ¶º2E‹eÿL'^”Ù¬&XöåqÌ +£¼ej[2LŒzt²10íÁÞ“ÃÁykÏ!ý%[o +“‡0z©¶Øw8 +|è÷b›åõSy¶ÔÖ<HÍvü‘‘Vc…Á›íI^³»2 `÷a–A¡°Ó°ŠêY ñ²ÅÖ(’\úàw(k‘fð*S~¡;žà±”/a
_ZšÄKǺì^H u†6¯°Ïêm xÝÖƾ©^bn"|ú9àïf*i G#R$#Åíåt6=a¢ÒXx‘ N'l ê{‚D¨Ï”RRà_0fìÔz‘×æ•.â^Õ˜š>Ï7šNþ….Ìþ@ ìÀM}ë}ûz=b•õkåÁ#Zïà?ÆîâàöŸ‚\#.n?¹¤úo…hÏÓõæÉ&kšvUo»€q…{0ç]Ï¥ÉÞ d7ùöv +\5ûVþ"¸Ö?œ‡ì:Å}¥It$¨B +ªC~~ÔÑ$>X˜c4<½Ý1å°ôC‘DaèáúÓÑÒ`³:ŠÓxÀ^=Mͯ8ï•“¨¿Ìõ¦íÐ ï’N ÂhÈ7=‹Ø‚0°Ò÷„:\*ÿj„Ùô¾¿Ü•Lsˆö”©Ž¼'‚Áñwìw=øÇ +üß?©ï &ƒXøIâí {?2ËH$^[¡ŒÉ %C?!ÖÅCÑÿ ±IÌendstream endobj -1835 0 obj << +1857 0 obj << /Type /Page -/Contents 1836 0 R -/Resources 1834 0 R +/Contents 1858 0 R +/Resources 1856 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1828 0 R +/Parent 1845 0 R >> endobj -1837 0 obj << -/D [1835 0 R /XYZ 56.6929 794.5015 null] +1859 0 obj << +/D [1857 0 R /XYZ 85.0394 794.5015 null] >> endobj -1834 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F14 964 0 R /F21 938 0 R /F41 1218 0 R >> +1856 0 obj << +/Font << /F37 1038 0 R /F14 976 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1840 0 obj << -/Length 1919 +1862 0 obj << +/Length 2641 /Filter /FlateDecode >> stream -xÚµXYoÛ8~÷¯ðËÎ"bERgûä&Nšîæ¨ã‹MƒB¶hGˆuT’síö¿ï IÉ’-§Éˆ r†3ß <hß„ í{61¹oõ]ß"¶Iíþ,î™ýŒ ÷¨žcT“Œæ¬÷“Þ›#îö}â;ÌéOæ
Y 1=ö'áÕààÃðb2ïÌ6Ù3lÇ ¼?9;T_}ÎÏŽNŽ?‡{®5˜œœŸ)òxt4ÎF{õl -üLKØÁptòçHµŽÇÃÓÓáxïzò±7šÔ¶4í¥&GC¾õ®®Í~f완ûžÝ¿‡ŽI¨ï³~ܳlNl‹óŠ²ì]ö>Õ£’µ ?›{Äö˜Û E» -Ά§óìÉÈ‚¢(oòU 0Må¦Oi"Ú.õ6d(8ˆxâl)pÒ†$«ifå²½@ýíq²½\m8'Žï9;‚ÊVAµ½ wÚ1 -iÍa £öóâvßKnϱí&';KC•ÕAW@êFRÜ‹\Ož§:ï)sßxª) f"+k²Ž÷ŽñˆN˜„Ñe-Dª‚ÐÁÉ¡Û¬æk#¬JïËÃuÉ ’°¢>UW
*š±‚‹'EˆõP«óŒUªpX yz‚} 3Wó£]BÖ`~sÄXcC@Ë çQ¥Ëøâo(ÔÌ‚D5‚ù üŸËðÇ~!ò;,Ú؆zŽŒƒd& ò1ß Œ‚Ù&_L“-V9òc BªêYšBËÐ aã¼9ïÛ*Ò Š*7ŽM%0ïÊt–Ë™ÊQÎ(„ ¨%)AFe”&ÁRõq;˜…ž¿LÓÛUV(¦©À¨Eu4«ú|[‰üQÍ !mZM‘1¯ -~Ê´DÿÀ6¬ôuõPדõâñQµÖÎDÖÚ™ÍÉz…"Š£e«ŽtrÔaD
´ð´ƒß
ˆ€²ûœ!B°ÖX¸¥3Nå Ϧ¼±õ:Ð -BÀ#À:Šsb§grD" -D•/@ÙÐ(uHÀ´§zÞZº>íá°GeGºÚ芽…,àM -n°"x Íì&wä@Q¼ŠU3$…‘©T0 -¨…rI`ΕÈ9MW¥j2ó·Êe˜>pþè,Ó–Ðy´á—:°½:ž¡ÕB£Ã56pŠ—žQM-Ê®ÂØTàØjÄo•ªWá -èma¬6õ¢cqñÌjjQeT”Ѭ µØû9ì6.œE˜'Ïcꌷ.ÌhŠ[qí]PX$¦ã<ˆã W‚[ÜÇànãzêäVÉÀ7ʾB•Ï¯Þd¹˜GK‘\«$ÄÕÆÞŠ+5cš.VúÄò(Š¯iþµºêè#ÀuW–hæ,Oï¢PÑÃ<…Œ–9” -Û„ét€\!Ó‰r¥žå‹ûN'Žk [*¬É@¸±Û®Ewª@w¨°v>aÔ¶:Ui"U{ôõ`q ß W·4µ^ý`±——ujy¬¬U! .ndiºÜØë^P:Ûü¶Z»Í ö™
« î "‚ÓV~,wʪ_›ZZ}·ëMÏLœw½ +xÚµ]oÛ8ò=¿Â/8‡ŠIQ”°OÙ6éuqMÛ$ûrÙ¢P,Ú*K^QvšÞí¿%KŽ²M["r8 ·3c> áÏTÌâT¤3FL…\Íë£p¶‚µWGÜã R0Äúõêèù™Ô³”¥±ˆgWË„…IÂgWùõ<f‚ …pþâíùÙëW¿_œ ëh~õúíùq T8?{ýïS½º8yóæäâ8à‰âóÿ:ywuzAK±§ñëëó—IéóÑ‹Ó³Ó‹Óó§Ç ®~;:½êeÊËC‰‚üytý!œå öoG!“i¢fw0 OS1[ EJ2IÙAʣˣ÷=ÁÁªÛ:©? 2!c1¡ÀˆO)P¥,–B:V–åõ:+*¶¨×¬Ù| *›WÙÚ žBÐÀùÉ›S?f(.œpÎR¥„#%ìË°‚Cî÷›ã S›ŸŸ 1àHILp2æÅ»ÿ€~y2_d
²å1ü_šEKskših¼1ͲnÖYµ0`>‘¦óÓlqë ÔÕ a(VÛ÷›œ 4±›º²ÆÓ¨ËbqOã/ue†xn ¿ íyÈD[˜™R#+EèpAÖù²¶ $Ëó¢-ê*+ižgmv“Y_Öõ§íÆÒ¦ô ;~+}þÜšæž0œÒvÓ¡TöÎx ƒÎYíO6Ÿ³õ¦4Ï`&“ŽØËóK"å% C&º+ZTq(½"{%•hŸ¡NÄÜ9 +~ÚºEûˆÄó ®ýR±î‘ýüñžF{câÖÞ˜Cd‚-ÖE™54qFÀ ½›Ð+FUMßÄ›aB<gð +FrT蕧 øv÷€f `x›9%(ÜZ¯$ùî’^bDóÃP9‰U8”¸c<a2Ž):{™üÙ$æ]S´©t㥢8Žgt '‹z[µÆËSø-Té]¾T"LX*"`À? î 8úá –„ ªm³¶°m±°¬'Ûë~9 „æL‹ž˜)•Æ}7š‡ðLõÖæ.šY›Ê«éU“×YC„G/+(J(¦´Nˆ O#zÅæ#Dùæúù¦1Ëâsiª´ð_§b!YÊý‘‡\ÆM½ÚZÞû±n>âåÇé/ôù0uKüæMSïŠÜÅçeó
4F 4Œmˆ†É«ï–÷Û|Øâ‹!Pµ]ßtª}Âép ~Œ@ÛÀ+ºtîi»ùÔîÀ%*-ÿUH#¸ü¤Ýü ÓÕ½‡Û~ úw<2÷¶ó1÷±5ªÕˆÀõã+Œ±ÞGÿúf=âàÂì%-6‘» +}ŠØ§LÉ×S¦—Ëðʹíï6[™éžÀ0—ºšL!-¸Šá0ßzHK¤,Ö©$‡ o!ŸçÄ›Ëgaº¸Íšl*£ü‘€®¼¹+©ñ›Y[/ŠŒÒØ°¯hp…>”ð®ëÖ×ÔIÁÏ$•"…ºu9Ú¹¡ÈÓgÚ[šc>¯Vp‚³è_ªTUX*žìÆ, +Ükr,|¥Â̺ò–¯Ò²jå 1WÇÊŽ'Kh ©E½t
°f|[•¾ö£ ÖµmN^<,'e¶íJÂl³) c‡ãŠêƒ¼t1Å•”Ë)/§SÁg¨’wÎEÄÃ\\Së8õ6Gýç *¾å„{¨”i:TæC„
°FÔ>xaŠM¹èk^ˆ-®Tó /ÔÒ·º`P/®‚„aæ×Hnð˜¶Þ¤„R·ôøË’ ô¼2Ý +³Ø”.7Ël[¶vÜð€˜€‹N…‘šß×[ä…¥èèfí-^TÅNÇ + `µå÷^ øX’Ú…”„®™ó—Ü〢̮۱©-nJÃȯý;íC:“‚ ©™ +û>æ| O?¨` °ïT¹i=JÄ83uü4»C!¥òÖº +|‘ endobj -1839 0 obj << +1861 0 obj << /Type /Page -/Contents 1840 0 R -/Resources 1838 0 R +/Contents 1862 0 R +/Resources 1860 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1828 0 R +/Parent 1845 0 R >> endobj -1841 0 obj << -/D [1839 0 R /XYZ 85.0394 794.5015 null] +1863 0 obj << +/D [1861 0 R /XYZ 56.6929 794.5015 null] >> endobj 554 0 obj << -/D [1839 0 R /XYZ 85.0394 370.6221 null] +/D [1861 0 R /XYZ 56.6929 608.2484 null] >> endobj -1842 0 obj << -/D [1839 0 R /XYZ 85.0394 346.1456 null] +1864 0 obj << +/D [1861 0 R /XYZ 56.6929 583.2725 null] >> endobj -1838 0 obj << -/Font << /F37 1026 0 R /F41 1218 0 R /F22 961 0 R /F21 938 0 R >> +558 0 obj << +/D [1861 0 R /XYZ 56.6929 285.9067 null] +>> endobj +1721 0 obj << +/D [1861 0 R /XYZ 56.6929 255.1565 null] +>> endobj +1860 0 obj << +/Font << /F37 1038 0 R /F41 1233 0 R /F22 973 0 R /F21 950 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1845 0 obj << -/Length 4205 +1867 0 obj << +/Length 3830 /Filter /FlateDecode >> stream -xÚ¥;]wÛ¸±ïù~”ωXâ‹ -\IÓtÕ§‡âD›üÜå]q(êŽ>,þž¦².»²© ’×[jüÚæûY Êщ¥Wk™%V{ Vº½ƒÄhpIæÒ ã&à—’-°‡‡hKÅjK´-}nîóS¾éŠSÙvå†]C¿wýæmÛlJ@³¥ïDz»ç ú9] ·*M&ÈU x* "r#½ZÝì&34iúJs«âZ¬ê=¬ -=ê—~I -ª¡ RhÕj“×Ôh6›ó‰š9÷ѾAbºæHªx(* ¿› LMÇ°?ŸrV7 -fç’{Æâž» öƒ_nÕÔÃNp Y<;&Îš× žÔâbùµÌxX2¨¬ÕÝ7-/¢ ¡
X„ í’F‘%tÐxâAÍqM'L¢èMâ„ŸêB –JAJxoAEË}Ý J«mN £%\?¶áˆºYâµ`;Áy¼ÌŸÌ;¹Ä %,í
™ìm¾–ЉtZþÖµøfgËà–¸©À0€ýSvn‹]~®º6éíNÐz: µY=5gjlË–¬cøêîQQ•Î06þø M!¶Ñºâï¾|(ë=µ›3Ï¿Ë·¼@Þåȹ̯ùéK?²ìè7g,wÍþÌÍDzª¨Å ä!h¢ÝO w§%“ú¯38º`ÁŽ’‚=
Ú+Ò`î„ÙC yuŽ†x·¨R.1 ×|>Dãâ)Š,‹£Êv¸mÑÛŸ^<åDdh©™íö0 -Ñt¼æ’UR.Ÿíù žŠ%ùcⵊcxåùÆÉ$€µRú© ˜€Î’Ø.¤ ¤fA^¶<U<ÄǦmË»ªHè oØO‡!žÅIe!Oõëe Ï+Ž"Ù-6“ð@N#Ó@Ïéa¾IÅ›„¸µ©×Ä$©A—$èë· Q -Ú«³0»£léô,BŠVš
ï–£+k#Œ¥Š‚»2*êssä°—õ° -Q@.Øqœ -é±µË7Ýï¡¥£ù†®þx•Ee8{)Ó -"ïÍ7 åº 5‘±ö¾9WH%¡yõ˜?µÔ~lN_Ps²ŒãC€ ϧ#¥=™'ÉüsæÜÉD+e^mε•1HD®-J£{%zYã¬÷;Éû*ù7œt¼¿„
¹u‡]²GïÇQô -2dNq¼…£îšPVÐ&ÙF°¾4vR x±†{{Ƀ’ü¯XíÆR|Í:FK¦ˆ °S=‰|ŒsU¤|dPîÎûýÓ¬À·9åí}L1¢•Ú4§Óµ[ w`ÆC-Þ>´˜93ƒµh”žu¡N‹h‹‹mÝ>SXн<öA}(0
®“Ø!¢Žca€Æˆ `}¢mŽÓ1÷í ?=v<¡_^Ä®Þÿøñ3Ï 8[`9ãp8×`ô‚ã%? !§237ÀeGLÝ¢C˜xA“NËÏçt‹é—Èl’J¡¿#ÌŽ˜*³@î«20Ù«$ Òú¼=®ÛòßKea É‹f SÙc†œ)¦)¶ç-€~ýñ …hC‹Óvôµ-Aò-°ª+©d -!vv÷%ƒ¹€Œ@rDI,+ˆñÐ?"¶ÿ<ƒáÚf‘,Õ n «N‡£T~a $»sE0f!@¹ –¢lï©3lK§Ã ¶Ï ¼ãÌر秺O`þ(®Ã¯ˆƒ7Ú;òÍ™8’.Ý×A"I »ëɇfÀyü[‚í¢E ö¸*ÞÎà¯L,!K¬ëR÷#…EØÕ½dÊØâÐllÁ1J¤p ¾*’¢ýQ¨ß_"cVäý¦~ó%ÔL¿S õ[¤± .úky8 è#Ò”• û‹6Ü.ÑüaÁiÆ-¡}YŸÓá’€å>PU‡J«sSeL£2rÑŒœ“ó±?X)IE¥ä»& -dCe<¤€ý%|IHkñ#Ü·– Íè64dÄx“€ƒi’Œ÷R -'ëà`-û‰k?[Ó`Z¹¯óîÜW[L_ú3,`ð»/êâDÏñóÜL¬&À$”cB8q¤ -áVh {ÆA îh‚Òaé:Svõn)?›^Õ…m¹/ë¼ëíÈݼ¢Î81âtÍc†ûþ’cý© ¿ëËû:öÝ=Åõ"2äÖMË¿ï*ˆÿÎ{åtÊDbcÊÈ
ÃzÞØ»äê<H±É^°Ý&IÅÅ5+b…\µyl© Œ6çª+Aœ˜l)|¡VÁy=!<$Ø21J
ôZÔËüÅvÉU‘éÄ^¼ …s‘³Ï‹Úù U‰ýRDˆ©Óf©x9¨’Þ½t[£D_À]À»~ÈPCD-²þ=çpqƒÏ«bR u¼èÍ/š@œ PÆSÆÉ Ùn9+dœ”"eœ"™Ñm¿ð+Ð3³O~#Õý#3yD£c¢‘šX½Ò³—3fþrÆõ|Ðœ?U”ÿµö¡á×9!5l´_„LñêK¼!)\Êu 8—}ב¯ûYS! ÏY%3~GV-T™äê3D}U~•CU¼ž’ÙŠæÛxfrv¿/gÂkæåmIA‰‘æ»% Gf¼b? ˆt;ym -üQ’:g¦Þd[tyYµo£ñ,fæu[´›Sy ÞË/¿´Ã7tø¯ß«¤Ãƒ×ç•ÔXõ”T -QÓ†qà¡,°@Yy•A¤ +xÚÅ]sÛ6òÝ¿ÂòMÄÃ'NžÒ6ɹsM{‰{ Óv:”DÛ¼H¤*RvÜ»þ÷ÛÅ.(’¢b»}¸ÑƒÀ°X,öç~òÜÛDèÌœ»Ì$VH{¾Üœ‰óè{{&yÌ<š÷G}quöç7ÚgI–ªôü꺇Ë'Â{y~µúaöå_^}wõúýÅ\Y1K“‹¹MÅì‹Ëw_$£¿/¿}÷æòí÷ï_]83»ºüö ß¿~óúýëw_¾¾˜Ko%ÌWŒáÄ„7—}M·ï_}óÍ«÷?]}}öúªÛK¿RhÜÈ/g?ü$ÎW°í¯ÏD¢3oÏïáC$2ËÔùæÌXX£u„¬Ï>œýCØë
S§øgµO¬Wn‚JM1ÐfIª• ¼º-p0Tö†Ê,1^+ÀcvÅ/û¢içå§ë îãµ6ÉTªyðräÕlU´ÅnSVEƒßrv[´·ÅŽ:¡EÐu½Ì×kŠÝ ôÓ_ +uË]Ã}0Í0n“7-ÁAдOg—×ÔQÕmœÙ¾èóúîòõžñÖ׎OM[—¥ý“ͧÖòàzÛ–5怜ˆKF긫‡l"º”Ý•Å=¶ÒY½#Èͺ^„£DX@ØPÇÎø#5ˆúAHVÉ’Ó窸Î÷ë$Ôì²%è&àQë¦f¤L°ŒºÊŠ +]Ý¡B7‹(ϾžPEƒ69Ë¢v=ÀÇ8ïF
xÑÜÖû5R™¹ëûü¡¡ö}½ûˆZ‘¦ÁjØv¿ÛÖ
ë +ã†Zº*›œ†úxzÐè\Rà‘ïd ZYqh{ªhÔ¢no Æ;´Iv \„”^¬æÞNò࣠æ<“¬é¸Þ§|³½ +XÕ–!"ÀïÅùp:µQ¨ª|S¬&èÔ(U]4ÊG 8Á8í ‚ßÕ‡ +ŒHŠ†N»áùöSËlx˜ +0Ëd*˜¹"¬F ŽR“)F(Éõ~M0f!@ ê=5îËæ–:öŒ8œ`CðœÀ+0nÀŒköüUKà;0ÔâWÄÁí y„æL IN?ÌE’&ldGN? ÞH)CDÞ¼‚=^/ÆFð¯ ,!Ë …PÔ}ŸÇp0Fp§mBÙãp¯³à¡vqᚤèf€h».‹æyVr½hE6ù§Ïê7§Ž#ýYÔoÉCà*7û
}DC*XÙ±¿hšü†÷ è³V‰4Ö=®ÏÂuZÏr ¨ªÀ#Í÷CeQI½-9¯ÌH<ºƒUŠTT)Iþ +{’¬”}LÇ`ZÉ$D¥Ä~S€ i +Ñí˜ú(ªg#lg8ªÞÔT ’úÄtI$†
- ²zXg÷‰ù<‰£ÉýÀ K9”"È ²ˆ›ø3µ
Öo”Z=¾H0x/Aâ!ÜÔÒY-~ @,KPfôâ}Kƒi¤UPs€ "V ÔhÁ¸öÕ +èhëzÅð‚sý ã?@|ò‰açÃðmÞ.oIyÎç¼…Á®1] ZŒv>¤øO8±dbAæÓÌÌþ…¶4øyèX× f[,ËëúàÌ›¤/ÔnÜÅ +¦xÞbN%Â+ÝôJ¡À‚N(p ŤÀj“VæÄF}†éÅ X¹·‘€RõñzNƒf3póSª ]¢³ŽÿM›·¡€JK×F¶(”KܸE1ÊGDŒ¢—C¹õ˜6S+ß×I'bñбÓȺ܄j‹á4ªýfrwG•SÌ«å~wGVV‹z ´É‰® +,‡U`1¨÷ð §
?A"™$oeÀªªž²¿`º”7#©8Á … ×Þ{{(ˆƒð4ò¬?º`@¾Œ&¹söÕö”`)H'žŽæù–ÅyRÊœI”é/**Gn2Y&Ÿ˜ÉJ«"¿>'Ê
V¤j\n0õ¬@ˆG
Aò)MÕ‰9Ð +‹Œ/Ä*Ú@D£3Ÿ8
‘í®T’yï§/æ Æy %Ýì CiÐjåaå ,Sñ”T‰? ÓªÀ]WÁt6 æT\‹×vÄ€1“Ú&?6hæL/£œþI±E¾—FÁÁ[Ÿ}ŒóA_ALåìDC*2Ÿ_}¸|ûb|*R¦A¦)¸”4q^„Ë1êÜÝœSã}ï6?ïO8¾M;Æ‹d|("éÞ_µGÔ¤6‘Rˆ9ºÐ‹ƒ £`Œ‹ù iuÎÛ}:kó5…ìgà çrÐÔ:`ôÀ~9%fÿ`D.8ònß±! x¿0µj?» +œb\È
.ÉÂÉz8X±þ0WƒÁ6i1«¼©òvß[lWù³,`ðSTÅdpEŸû†Ø`c1&¡ Â#À![¯n…Æv ©g „‚YPf‡°tžj7{5•ž
¯)C}¶¼)«¼w3tp7O(3Œ8ÝòtƒÙ— ëíø¢«JÜT±oñ׋È?X6™¬;¼ZCü·¿PÎ&7»|³Ô0| ç½S®.K\jÓGl·M„<ºbF¬ªÖ÷
µƒÁÆf¿nË횇 NL¶4°³ÂÂûÂCÝ(½¡Ô@¯E½Ì_l—\T©…“£(»V¬™‹œ}>·t.!¯ŸŠ1uZNÕn Õ*ó]Öh°Y§ñÎïÒ ÔQKŒïÆ÷6Æ ’eâ8@/¿»3â%€RžÒOþpÈjÅY!ã¤)åÉ’‡ ¦g + УJù
abF/l?£&&ÂÆâ•<1º¬Çû +¼gÕøFýD}ë|׫†êx;…×ëa¾‹g¦FoT:zÛ +¿»H¡¥zbf®S-S¸ƒý¬:eB¤ŸU'@hM—¿öžÜÓoí´IÇÊM(j¦1xw"úsÇ)°N%LéiSÒ×&ÍoX°cÁzñ‹”Û¡¿¦øE§a'%Ýžº˜G8àÓC'Œß æ”Ù”§Ð5j7¨Ý ¤1`±§–oî:+ùø©ÚtèÐq±E«bL ? +¦ÿ +¤Ðþ:ût ³p®©|ªþ„åºb '€›Ó^P]¡=1 øÍìb.&!-$†M[.›ùò6¯ªbÍÉÙ‡C]6¼Jæ¼+,cFWÜWšª®0s„0…•þEâ[q¥òQVX"Ä–\¶ý9hBøø/¡:±Î`5_ù˜€âOÜEòßë ªÎæUèã>|üĺù U‡‡©²O`Èãn`¨ 5ýyƒ7%?ÓÛÁÐñ£}ÙG/ Ùw’$/‡ävžüöòÔãpmñ ÞT¼#:ÁøÃǯêK´÷j:p›T¯2‰BÊ}6¦¼{a~Lúÿ endobj -1844 0 obj << +1866 0 obj << /Type /Page -/Contents 1845 0 R -/Resources 1843 0 R +/Contents 1867 0 R +/Resources 1865 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1828 0 R -/Annots [ 1847 0 R 1848 0 R ] +/Parent 1845 0 R +/Annots [ 1869 0 R 1870 0 R ] >> endobj -1847 0 obj << +1869 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [87.6538 171.5741 137.7628 183.6337] +/Rect [116.0003 382.9749 166.1092 395.0345] /Subtype /Link /A << /S /GoTo /D (tsig) >> >> endobj -1848 0 obj << +1870 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [370.941 61.5153 439.613 73.5749] +/Rect [399.2874 273.03 467.9594 285.0897] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1846 0 obj << -/D [1844 0 R /XYZ 56.6929 794.5015 null] +1868 0 obj << +/D [1866 0 R /XYZ 85.0394 794.5015 null] >> endobj -558 0 obj << -/D [1844 0 R /XYZ 56.6929 769.5949 null] +562 0 obj << +/D [1866 0 R /XYZ 85.0394 170.053 null] >> endobj -1701 0 obj << -/D [1844 0 R /XYZ 56.6929 748.8663 null] +1871 0 obj << +/D [1866 0 R /XYZ 85.0394 143.9886 null] >> endobj -1843 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R >> +1865 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F21 950 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1851 0 obj << -/Length 3040 +1874 0 obj << +/Length 3891 /Filter /FlateDecode >> stream -xÚÅË’Û¸ñ>_¡[4) Á›ÀúäµÇ^oe½ÎX{Z»\”ı,‘2IÙ;IößÓ@|ˆÔx ;•šñh4ºýÖ°…?63ŠPaå,±’(ÊÔl½¿ ³[Ø{qÁÌ"-úP?./þö\$3K¬æz¶¼éá2„ÃfËÍïó§?=y½¼º¾\pEçš\.”¦ó _¾z†+?O}õüå‹ß®Ÿ\&r¾|ùë+\¾¾z~u}õêéÕå‚Åà<Î xþòïW8zqýä—_ž\_¾[þ|qµlyéó˨pŒ|¼øý m€íŸ/(Ö¨Ùg˜P¬å³ý…T‚()D\Ù]¼¹øG‹°·ëNÉO C”áÉ„ -ã5@í9É=e" ä–=>øöÕÁÍ;Êœ5 ¥ƒ¹#îaÝ70×L#
:æðž3 x(&[/ùåWU:Ñ}ýr—²`H\’„å‚áíÿh@ÜùßD=\ü«fµ ]«7`N¤©„†‘!\1ëñ¸Ì Š3JG“6yÝäëz±Þ¦E‘íjDþ6²=º[œ«t¿O+¼Fö¹¢³ð%8EcD¨á¦ùGa ±‚›¡ªþŽy‘58zK
k‡÷Þüä߈‚AüN€†#‰Ê£økØÂwîm -áa¾ÉÀÝׄ+ër¿?ù:EÚrǪðî¾Þ}“·ºÃ•ú®†;pœnöyDVé"<UÄ(s¢MYIút¾·Yeº^c"ÔÛì8Çy^€—Ù§¸Ë›p`L¼H÷#'CZUÄÈÜ!eº/*7Í‹&+6aÏÂô 0‡çÙ ùj—õ÷Çñ€–á&ûã®ÉäDÐnéà_¢lÊu¹«ã¡gn¼96ß2ç#9¼Ã±Á5®/†‚òÅE³óÉ BÇêG?-—¯qÔ -ÆyøúÑÃÈc}ÒcÝÇcÞꎃn¶iƒ£PåÀÈâÇ -¾Àõ!ßùôfŸóf‹£]¾úc¿ã`´ÜÏíXû%£0j¬þ!LÅýo¸Ç4¤ \r66
n4ŠÀ@ oòÝ—œ„' 6²OY@o·Á < -ñó˜ïÂ’ã´<Ôø˜° -\WiÕ…K«ÂsÂ^ZÜ!tx¡p]G„‘ª›4ßÅ„ù<}q/ -V|vŠ+G½‚¼žäêŒ9hà jÚ³‚åJ¦-°G5qõзʵE¸èa ‹•+ÉjbÛ{€rNFs…¨9NKAžòß$Ê.I<Í3 ¬CÎÔƒrÉg -æ[åõÌ xÑ9Z O+ŒxYð© ûº -ð~Xªžg>:â®wÁ~á¿¡U!ÅùKp± ´n2§=ÚÈùòÒòy‰ûèÎðÞÒCkX5äu"œ÷® •da“ 몶àÛ“ó~iI,ƒd]8Ó5&ùf]m1.ú(ÇÊÊ4$æàŸº›ï×VÅÛ6È9må2‰ ?ü0¢‚ „ÄrÅe…ÆÁ—!,BÞr9—qÖ£ÒñÑ)Œ¡CØжë×Ä!¶Ã(¦)¡”^ÆÄ5ÎÞr.'¸PÉIMí¸’;á]›@ß/ë F¤ -FÙ ä -ƒ¡Q0Є»öÎ&ÍÃ…Àb»n°›rLˆœyûMßÒ8[Ïc¯#Dœü$&móÛ/ïÛ«ë5dÅ&úòØFé{“~Éà7©^Ce ´ÅÇ#` ·§‡ÐÆ8T9Ôm§{¢Ìì…ש&/x4ùu.PpÕ*W=ìÉEé|A¿,'I[gœS/áÖȘú‡RÜ3.s æcwQrÃ~Ï æO5¹DiÃbÓÙtýHú‘Mu„ô`³øÝý×ÝftCL]›ÙîÇâŸ_ù(çÀŠã~•U÷ûðïéß~^ìMBÞ…žï$íîùò‡ÊøØì•:‰Ú< c"±³@±QS,:ß …¾MÓg¯Þ¼¹zŠã:[ «¼¹ÃnÙø—²d^GdõºÊWX±¹Ö먡à~z²ÒøߘdÚ…#ܬng8¸îý‹@ ¿è ÿ‹À¯cõMë€IÌ8ÉH; fü_ -è ŒpÅØjò$ÊsÑýfï{ZŠFa Ö -g˜ ²ö|H矷ޑˆ\`p8®vùÇ
8ÀŠ)~Š²X¤Çf[Â}iˆ1°üϲÈq¼ïCQ~öDÄÞ#,¶¥ +xÚµÙrÛÈñ]_Á·¥R"Œ9 +úÞœ 3sƒfÝQßÞž¼x¢IìÅ¡ '·w \Æó“ÛåûièIï0øÓ‹_Þ¾¾zóëõùi¤§·W¿¼=ÉÀŸ¾¾úé’ 7×ç?ÿ|~}:&Ó‹ïÏßÝ^^SWÈ8¾½zû µÄôwéõåëËëË·—§ n8¹¼möÒݯðnäÓÉûþd ÛþáÄ÷Tl‚É|øžˆc9Ùœè@yVʵä'7'mvzíÔQþ ß“*”# ”b"„ìq0ˆ½PIÕpPúÀß÷§UÔYUg‹j¶X'E‘æíø:ÒMZÔôù]ú›ïË"«³² –¤Xðk•¬Rä ¬.;ÇçOfÖò ÜíÚ
A"ö"§îÛ1cÔ ›Ðó# væ0¡JÈé2]äÉîT˜iZQË¢ÜlöE¶Hˆv%Ä´Ý*¨KúŸ§ô¿¯Ò%›?RKõXÁ'ËMV +¬g)Æ ãE±™ñ"a—Uø™uZ,¹Ï""Ëü†ãVéçlž§Ý~À±ßnË cØìó:Ûº!ŒÆ¦=‰².e^¹U¡Ý¬x·¯÷t`gÐ á ö5õ,¨}ÖìªÃ_šQÔ9 ‘Œ‚iY8èûÛÛw5Œ8ã¦?]‚P&˜^áZQÈø>í³Fvpt½Nj‚XS +ì¯Z`G¹³2¨ò– òV–|žíY½"A +• ç7ÒAl¾ZZŒ³.Ê¡´ +{A(¢v姥5 +V,<a"qܾD‘§`°ÖS¡ùz-èκG¬‹Ì>HS3ì 'nD,û¡µô´ +Åa|’õIj¸ÿÛš>l¼¡à’o³‚#诬ÀwëÁ„Œù2×»lAªÚ0žÂR…;ª°$ 9ÏÄ*æ-$y^>ŒÝŸÈ‹¢Æƒ†ØŽåÍ×Ó‹®Ž´Ë–íò–!JìõAèÖÛ^lx{§bšÓ7‡—ô±Mw›¬¦ Æ>%$]ÐcÝhwý¥ï{‘lÌjô„Mn,AË)8óPz¡êëM®Ã8ë¢ 1¹18Ç7ÃLˆHÉAéùœÜ#ê?ŽÈã3D*8}p dŸH4HcWB{`‡âæJ€[§HÂ!6 A@-åsh<-LÜ“@’ +s¿ø‡{ÅŽ¡FÂ^¢!D´ÀegEú€;ÃØV…Ò‡ •0‘²€–j±N7I.H B?ðïÓ]E• èR6 1²'f¼’6€GDR#”±Ãm{þU)õt¹nç`u;`m×D
X@¿bG”
M
±yS:…‰Íé ~ «Uj`È6}+ä6øä6 +ÁæöÈƼ„Vº°R@ÄIéühzS–«œá‹u²³6 àówW<²¤. ,q#ø½Lê„ ’8 ë ‰©AE•/ +[âAFŸÕ±ÍŒYwÊPÇ1?©c_° * " +Ùçü½<¤;„€PCh*.Ôq<ªÝ YwÔPp 5i¾'MìbXN¤Óæ¢ã‡¤?rZçՅÀ;Ü¡â¬Q+GÀ #ŽšI£l ðâ)3éf Ó7“ÌO á½æø¥ç‹Ð<}Nͨgjˆí<)ʲø¸sJ÷EMÙzcH®oä*fQнgäÒ†íÑÕ-iÈüÑ(SžÓ_+œ_q¯I·ÅÎj[K®OÚ‚ ŒoßΗGgÕû]ÁåUjÆlÛ–Ÿ +îŽ5¦øßÇý~¼öï½çy >¸«G;-õŸWG˜¬7ÊD-“å—2ùÿø$D‡Mº»GÆHò7ŠM0VðöÁZ +SŽá¾{{ssyÁ!^ºØï²ú‘¾HËÚÖÇÀmìŽtÑç2E>§ªŽ‹ùz: "h£‚
/ÐAˆÊ†:w+V–×]íäÆϺ(ÉÕ¯é âÅÞ4) ,â€ã{±NùPCºQÏÑ0Àærh )玥îÕ‚ÔpÆñaÅÊñ[‰†ßôEcÑ —MûΣRι`»ŸƒãC0¤…• ì´ +v5MYdKØVSÃÇ¢Üuœ.ôDVN*®o«ˆrk<#};°f~¡ÒF›ç mj
°/ÓtãV¢rM4M?cBß‚4tÅeäœÞA;U«"Ð ìH>YE‚ø°Ôc÷ 48P‰Kë΄?7Ù&ƒHÉ&¡—” +MÙzsF) NÍ8#À· ØÞPÓQ§$àÞ½BŸ}óÑIú\VÙLŒ™Þl“Eêè©“¹‹ô!Ï +Ê…–Š‹±Hv» ¿Ž¾ÄˆÁURyEm·*Ê6•ßQMɆ…Uä™+ã jíNGÛRyª#|Õ6wE¥ýÖ-çªF Q°’P¤T¿{éŸgxS~ãZõ+ðö‰¼Ž<eŒ wË$–
a¢ðb@¹{.>$ý¿æôývendstream endobj -1850 0 obj << +1873 0 obj << /Type /Page -/Contents 1851 0 R -/Resources 1849 0 R +/Contents 1874 0 R +/Resources 1872 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1828 0 R -/Annots [ 1857 0 R ] +/Parent 1885 0 R +/Annots [ 1877 0 R 1878 0 R 1879 0 R 1880 0 R 1881 0 R 1884 0 R ] >> endobj -1857 0 obj << +1877 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [134.0621 486.6122 267.5615 497.4265] +/Subtype/Link/A<</Type/Action/S/URI/URI(http://127.0.0.1:8888/)>> +>> endobj +1878 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [297.4503 486.6122 448.8825 497.4265] +/Subtype/Link/A<</Type/Action/S/URI/URI(http://127.0.0.1:8888/xml)>> +>> endobj +1879 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [353.8228 406.7994 511.2325 418.859] +/Subtype/Link/A<</Type/Action/S/URI/URI(http://127.0.0.1:8888/xml/v2)>> +>> endobj +1880 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [55.6967 396.0896 69.6444 406.9039] +/Subtype/Link/A<</Type/Action/S/URI/URI(http://127.0.0.1:8888/xml/v2)>> +>> endobj +1881 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [283.6482 396.0896 453.0131 406.9039] +/Subtype/Link/A<</Type/Action/S/URI/URI(http://127.0.0.1:8888/xml/v3)>> +>> endobj +1884 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [461.1985 109.336 510.2452 121.3956] +/Rect [432.8521 194.7399 481.8988 206.7995] /Subtype /Link /A << /S /GoTo /D (DNSSEC) >> >> endobj -1852 0 obj << -/D [1850 0 R /XYZ 85.0394 794.5015 null] ->> endobj -562 0 obj << -/D [1850 0 R /XYZ 85.0394 672.7429 null] ->> endobj -1853 0 obj << -/D [1850 0 R /XYZ 85.0394 647.0238 null] +1875 0 obj << +/D [1873 0 R /XYZ 56.6929 794.5015 null] >> endobj 566 0 obj << -/D [1850 0 R /XYZ 85.0394 551.2038 null] +/D [1873 0 R /XYZ 56.6929 769.5949 null] >> endobj -1854 0 obj << -/D [1850 0 R /XYZ 85.0394 519.7104 null] +1876 0 obj << +/D [1873 0 R /XYZ 56.6929 749.0409 null] >> endobj 570 0 obj << -/D [1850 0 R /XYZ 85.0394 269.9108 null] +/D [1873 0 R /XYZ 56.6929 357.3808 null] >> endobj -1855 0 obj << -/D [1850 0 R /XYZ 85.0394 241.2269 null] +1882 0 obj << +/D [1873 0 R /XYZ 56.6929 326.1646 null] >> endobj 574 0 obj << -/D [1850 0 R /XYZ 85.0394 160.3269 null] +/D [1873 0 R /XYZ 56.6929 245.5328 null] >> endobj -1856 0 obj << -/D [1850 0 R /XYZ 85.0394 128.8335 null] +1883 0 obj << +/D [1873 0 R /XYZ 56.6929 214.1573 null] >> endobj -1849 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F21 938 0 R /F41 1218 0 R >> +1872 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R /F11 1353 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1860 0 obj << -/Length 3525 +1888 0 obj << +/Length 3651 /Filter /FlateDecode >> stream -xÚ½ZÝsã¶÷_¡·Ò3'† -*-ÍÙÂ1ÆXî\WžƒvS7ùxé^vðrh<Nrð|ÊÊb•µ¹Ÿ‰oßßÿíú_,¥C+´=•ËÝ]“·( n˜E/Ò¿4Ôòí= v'òX8UÕÜ´àñÈ_èV`5ËÆ©[
W˜Ò©0J{¾Ô„öú×´°é-ž=ìÏˬB€¶WmVTÔº=”m±+szƒy‰€Qû"oÞ ¨DgËM7¶ƒf±¬r–¥J38¹@ßU½í–©²mþ†d¦¡Ier*ê_¢He¸žŠ“`çD\·õ².¹)+ ë}Ñn¶î=œí*Éç‰Ä7Y“ÏuL/tF;¶jØMÖuEßç“‘n×J&hI†^˜¿ßeËÜóÓf OVù±,œ¹àHä ¥Û
9ìe¶ßÙ#Ÿ81Ñ ö+L¯¯ðR<V5½¯¸¡¢gë5Ždï
‘M=ê2”‡=ï·Ùó©ò5»²`}<ìür-Ï5Pxs» '4r¤¶_VI+"É*I ņ‚'Y ÎcÅ^‘ ¡wD”ùS^ 'çVˆO,D‚_I#¯õ¨i«Ä±žàFËæÞìiÚ#è•“:òA§"?^Z°õß®©¹`n‹fÄ>
·Á¢n7Ô²+YÜf6p†äibJiFžfàÁdVE[<å_£îýœ„°€G\‘S,2éE&½Èd/2y:sQmr0"š@‹gž¨äθkbY‹CKÄ+ëKÞ³$‘Ñàk*òÝ'6B[f?íœ%‹ßésÆúÙŸ€WÁn´ÓAe -#æhóôövJŠ èÛÿaq÷ø†áÇ>fžH<ßïo_9®°]%ýqÅç ×·¤uEïÖ·ñsƒNö¥™wçhþ{d“¤sL.&ü† u ÅãÀŠ¦bú|šZ@§¡‰83të0V©ó<±78Lj±Ü_¿#ºÉ—8-´àÔPˆ©ë¶AeSF+ÐmU¬ñÓ:gвÌi@ÁS:{{Éú\Âé™ØħÚöe)©a<Áê4ø|Êw£Øã#£3<ÚC ¨¡-–à“‰¾éD}h»˜•ïŸà -£#ŒPÔ@˳÷ø?16¸ÂV9#ö;n -„„HÃIêrÕÏæt ]SQ ¦qœœi'64I<q WõÁ/½Èép•ÆŒÇŠS7u¨² ¥„SB|öi‚kÝ ‰ Å’*«ž‰(ëê1ß¿EÙK‡ °Ñ/¤—/wGÝåèq9y’ÿ¼A-¼ºýa8 -SІ\Ö« O"¼¼ã‡Ö™8nÄõEuðy¼”盃{sGIŠ’XõÃ_ ›TàÿUgg&<ÚDf¶=â´rX‚Á/)$ +a¢Ôžëí½„”Á¦>æ¸7+·ÐŒ"ácDê˜wøÞº¼h‡Bà9¥¦B €™JŸ 0¢¨Óéá~Ý2°d¶ê9äe'xecGrIúåø[Œ‚T$d‰©£œJÊV®VóÅ3Ò£ - ¦OÝxU |Ö–ž2ád6¯BaÓtˆº'ä -á"”Öè/oRËD6 ³»ÈOr6H9¡k8ê}‰4Ç/ho¶½7®ÊÑõbŽ‡þbVpÛRó`ͬlêáÞ–5ÄŸßr^–Ãýlnc°£XžjL—“—©O5{yhYäy5̱YvàtuŸ”/ó¬á©
E?Êá²Ï¸©º…
çëÒꌴáY· -™vI!"ŸÎŒ¡Ù)nÊŠON?@ÿVÔ*ˆÃ™áî]e[‹-<e„‡°Êÿ†³ù|Ýæ€ Wô ±¯Íù!
¸}›O–i\
Å’pd¹:Ž-6LȪ¿ø¡h&FˆF€\| $[S矄i¢|»ŒMâÃ:̿ͳŠy™¸i -d Ÿ ¬JÒ eƒù·§W°hW -ÄæÌ·íž;™†Š’0²ÆL8 ™ Ž…ª‚É©—‚‡r¾9´‡¾ìåS‰~¢¡.V¡+¾ÑDü•RÖ¬d¬YøÁ†ˆ |íyF§® ò¼H•µ —â½ -›=D ÜB§^á ‚µ_¤q ©TœN"ˆ4¥’g; !ÍÔùI8¨Ý.Ïö
½4T¢ ºS3
`”$Ü•âþh>Š»ê³IvÆTøÂ';eô5×¥‡àXª1cõ!ƒó£3ÚÚÅhD§—Ήþ°–Òšýƒêq$±š* Ú4”èËþ¤u*òA¸ÐTíEÃ, 7ü)kFÛbO
MŒ4 –hFÊŒ`‰Ã]VN „«ÔÙY’êýÒ 1°’, žÎ’,d:ûK C»O ¬¤²%qÔÙ®õéà¶~¢!¢Ï¾_ BSÄggé4MÌ@å"X˜E2r2ÐÒA<¥SÈ õ¨VÑáú„ñ,<§ä'!äWç»Õ8ŽíTc©¦OX›h/Eàþ«eOðƒuÒ]Öl2£ElÏJßék23 -¤»yU -ôn—ÜR0_mö)ç&–€,êŒEÃ^ÜúÓKŸc¼šµ£Û¬ . Â;)Ç<öcØuwóŽˆ$bºðz¨Í«ŒªRx·Fz´Ì›æÕ+²¹°²
ø‚ aâ`AÕ—°;ä“QweæÎ Ã0ÎK€I8{tND‚ÕÏýÍ‹¿ÅN_§<R*B£“?g
2ŠÝ‘âìë¼]nræ³õRáMGÓe$Ù‡ŒC!”=õ5+oKÂJÚ khÚ§…@pZ¨1îäŸßì¢3‡6Üzu:§Gý'ѹÑìòeá\<OâìS¿|”Ä`˜š³M4QêE©¡äD· Ò@lÐZÈIHu’ ]ë\¡v›.Y‹±Àçð6ë=W$‹Ñ˜þ¾#kF6¦ä{})&ÕAæ}Ü[⤹ÜtªdÔe_`fuQ1YWèg!}ƌڕN¦€8 Ñ3^µ$Ð2Óá¶$ž½àåšœnN_+*¥*„45=#E‰”Ey\ìcùÉ/VÓs›¹R(2âÁ(iƒˆ±T¯G×ÿ躰–H® ¡]AóÄuQ´¡.YÉ@`õì+‘.aŽå)fÅOTVîK§òÔ4ð ]¢ãž´Ï¯q¦5}mjþRpÐànú¾
Ã5²(0£B|c-ãá µ@œ®/¸r+Ô+ç%t&‘úI‰é.j æÆýC ²·XMÏAU@(_xK +xÚ½ZÝsã¶÷_¡·Ê3g H$OÎ}uš\ZÛi§sw”D[ÌQ¤"RvœNþ÷îbüéœréè,‹ýøí‚r&à'g©‰„vñ,qqd„4³åæDÌîáÝÛÉcΠ³á¨ooO¾ºÔÉÌEÎ*;»½ÐJ#‘¦rv»z?ý×ó¿ß^\Ÿž)#æ6:=3VÌ¿½z÷†z =^ÿøîòêíO×ç§I<¿½úñ u__\^\_¼{}qz&S#a¾b +/L¸¼úþ‚Zo¯Ïøáüúôãíw'·Ý^†û•BãF~9yÿQÌV°íïND¤]jfðGDÒ95ÛœÄFG&Ö:ô”'7'ÿèÞú©Sò3:Lª’ *9%@ã"«•ölwû¦ÍWgŸò§wsÔ`ŽI#'…‚…pð&{‚íÇé|‘Ó³É[jdþéæíšß´õ–eþ—Ô¬ïh…xÈ•Tpœ‰°¼D•mòU´¬«» n¬Š€Žä¡õŽÈ>íº¨˜z<ùã©Ss8N-Åüꎺ æ¶hاén¾¨Û5õlËl™7¯x3ëü Ù™á H©ÔÍΤŒœ1Ês’íNe:÷;Wólµ*Úâ!ÿÖvîë_¬òB¨*_á_Í"SAd*ˆLõ"ScÊEµÎwEKÔ|ñÄ„J Œ»&–õ|±o©ñÂúŠ÷¬Hd4ùÙšz^W%m]Œ·¼o< 0…NüÐn×~WÐêO€ŽQκÙwHK[<Jãi¡Ý)
F(„ +&éíí9ëg +N/Óx|ºŸ—’6jüàeÆÇå}½AÚò‘î·lí5=AÏxL¶oëMÖKðIO§RJ/ +võžçU›ï à +ô¸ÀiÌüŸ—¨…çWßg5ÛºjxÁe½Êñ$ `ÈŽ Zgâ¸ó´EµgÕßßòxsðÿüQ’¢$VýôçǦ4øçô‘Ç0<Úóc ¶}Ài屄wA!)è8„76Ö«;ôJÍ×õcŽ{±rQ”†[y‡Oà_Y4´Sh{Ï)5•VÌÔöè€!D§ÓÃýúe`ÉlÕsÈËNðÊÆŽÍ%é—çoµ0 +RQxKåX >(ÃÊÕêlñ„m˜¢ Ù$6¼óÕ)¯ + ¼*´¼ à™ 2Ñ”8
éF’ Q÷„ @IÀF‚ ØDtƒJǧ ìnÃ=³!Ä’?ô?’̆»ÜUVöI4ÂF&d$ï~•.Žc"„ËH¹Ô~~“V{°I î# <ÉÙ`Ë ÝÂQﲪ ú›
Dï5:Œ~{l9ØxèŸ!fͯZê ¬™•M=ÜÛ²†øó[ÎËr¸ŸA¢ç +T'pé!Þ‹°ù—}A
”[äõ`Â+¼F°öËž4Ž#•Ž“I‘Ä‘Òêhg!U:u~ +j»Í³]CØU™í†î40Xås])îÏ棸«>›dgL…/|²SNç[™>×$õ…uš ø2¸0Q$˜ÑÖ>~@':…¼ôN ô‡µ”Ö짤¨ #VS…A—D +}ÙZ§& „ M¥ÑØ_4Ìâãš_eÍÁ¶ØSC#M‚%VGB§ñ×ã.§¦Â‡Óúè,I÷~i8E–OoI2Ýi:ß3†þ88EeK⨳]ÒÁMý@SdŸ}??„¦ˆ3Ž(ÎÓIbÒÊ X˜Eràd §ƒxÚ&ÚƒZE‡ë
ãYxNÉ56äWÇ»Õ8ŽÝT㨦OX›½hOå< üW—ÚðƒŒ¬Ir¬Ùd•°=§Â ¯ÉÌ(bìæU)Ðû]rOÁ|µÙ§œ»X²¨3
{qvNzø ãõ3cÙb]páÞ¨ òØ Â®ëË×Ô0BÊеɰSeT•2‚}G½Ì›fƒy{”Nõ ÿ h˜8XP'cþ v‡|RØ \^†‘.&éíÑ?:IV?ß +µßtÉZŒ>·Yï¹"Y Ìéï;²æÀFÀ”¨»PŠÉê óó¾V ,ql.t3wÙ§V¢K¾ÀÊê¢âf]¡›…ìj_9™Â
àdWËxÑ@ÉÒÞ°!1õ‚—kò¼ ÜLB\ A–š
‘„Qj¢&K‚y,?…Åjzn2_ EF%e1VêíX¼çÂR"y.¬ƒvõÌ‘ç¢"hCC²’qÀê)"}¾ «1dÅWTUî+§jløfUãR¸'Òk¤tGo›šß\ +`Õ5&Oˆ½$xÙÉ7±ß;ë«cÏ®2`±`M‹§{ìT0ÆÞÞº²Õ*ÜD ÌýSv: kXž©ò_[.ÔLÇ4‹’ê#êQZ=‹iH7»k}v„M^Ó_ bk Šb^”hEÉHöheˆ'x°‘R ÃÐb^P¦XD±8ÚøSüNÁN]ÈY××Í–5WÎTÔफ़éŠWIïü.À_Œ'ü¹B¸gëoâ†KB¨ƒF¯IÚÕJÒN üõ ßò`?$h0HJB°L »À'AŸglâ6¸âû4ºŸß¾õñ§‹1}•ŒÜÌTw RþÀù÷GGøs Ï;—µB=uÉ T'¨qª…Æ®-B¬çY¶ÂTå…«W-Ud¤³_–ëN`ÉȺä0u'•ŠE%R&ã“xa%hZÉdô5 ú™*€‰pZ äxVǤ<ðù##^ø.ÆH»ã/Ú=êöù÷ÙÄÇø) +¿{-hð¿<PÔádµ‘ …Á‚þù@‰%êuVqa7 EpèæëÉn —w¼Ð9Oçò¯Ïמh •Êü vLŽs„'P›b‰6I÷ ¯(Â+
õ“—Ä–/AcÏ®h[¿=ø ¦VFŸëýÎßÓà ú«©ÂI"%Íê÷’Ž~®Ê)i+Èç•SƒBŽõ…œ'f"2´ðw!0¤*Jâƒ4wƒÛXq}« Õ¹\Ð'ßTÇ—ÞB]®öÕu庞mÝ4Å¢‡‘ø‘ØY¡Ÿ³ Ó\_L[ò5 +ק‡u¶Þs*îSFFûïÎKœ¤· ÙRLÔöþS ÿ§^‚R³3zhkAOªÐá7&±2óŸÊ%”;(-á4Ž¸?Km,À8£ Íî«úK±1M‡0Üó‚®›ü¥*µ‰ðKȉO E÷µÒÿüÁeÿ5jœ`ÙSõßRŽö,l”‚ôS¸s'9ï¾Ì|ÎúÛ“Wendstream endobj -1859 0 obj << +1887 0 obj << /Type /Page -/Contents 1860 0 R -/Resources 1858 0 R +/Contents 1888 0 R +/Resources 1886 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1863 0 R +/Parent 1885 0 R >> endobj -1861 0 obj << -/D [1859 0 R /XYZ 56.6929 794.5015 null] +1889 0 obj << +/D [1887 0 R /XYZ 85.0394 794.5015 null] >> endobj 578 0 obj << -/D [1859 0 R /XYZ 56.6929 632.4244 null] +/D [1887 0 R /XYZ 85.0394 719.5795 null] >> endobj -1862 0 obj << -/D [1859 0 R /XYZ 56.6929 601.0274 null] +1890 0 obj << +/D [1887 0 R /XYZ 85.0394 689.1253 null] >> endobj 582 0 obj << -/D [1859 0 R /XYZ 56.6929 519.984 null] +/D [1887 0 R /XYZ 85.0394 610.2286 null] >> endobj -1477 0 obj << -/D [1859 0 R /XYZ 56.6929 488.4276 null] +1497 0 obj << +/D [1887 0 R /XYZ 85.0394 579.615 null] >> endobj -1858 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F21 938 0 R /F41 1218 0 R /F39 1161 0 R >> +1886 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R /F39 1173 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1866 0 obj << -/Length 3826 +1893 0 obj << +/Length 3406 /Filter /FlateDecode >> stream -xÚkoãÆñ»…¿UNì>ù@>]’»ÔEã¤wn 4 ´DŸÙH¤"RvÜ¢ÿ½óÚ)¯Ï40 -‡ËÙÙyÏìêsú¼ô™²•;/*—y¥ýùj{¦Î?»oδÌY†IËé¬/¯ÏþøÖçUVå&?¿¾à*3U–úüzýÃâ«?½þþúÍ»‹¥ñj‘gKŸ«Å——W_3¤âŸ¯¾»z{ùÍßÞ½¾(Üâúò»+¿{óöÍ»7W_½¹XêÒkøÞ†g>x{ù—7<úæÝëo¿}ýîâ§ë?Ÿ½¹Ž{™îW+‹ùå쇟Ôù¶ýç3•Ùªôçð 2]Uæ|{æ¼Í¼³6@6gïÏþNÞÒ§)þy[f¾4E‚F§è«,·Æ»zÛ¬q0ÙL&[—)_À8©ï6K«ŠÅ¶n»þ|,5C‡¶û¸i´»ú# ¤?72s]õM=4_À£Í«¾š_M7fõâÀY ºMûs#ôL‰·Úd^W¹P4îÃج—´ÀSê}ž9[T2ùUŸÏòª02Ah^â¼ó¥SeVh
üÔ:«¼74癕 ÈÇè""zdý`Žáè¦áß¡yPËïx'oÆ~ǃMsßläû[^ËMiÖ ´ t²I.FÞ¦PeEáËÈ ->ˆ–OøaUbúaJ™Tqž«5øÙõÍþö@.IJ<6!wG&Ä83ôorîßäâžp´iÆ9VRdúzhö˜±òËnxˆcþùúê=~94œDAÕ ±–¿•"RÊŒ-ÅIÙÄ -N›]Óc^ò»‡;ÉB9ĪÓ9Jíârœ¿ÜÕ{/ƇËÌñmH'¹œ†ÅãrÃnÓ -.Þšñ°Ä˜ä÷‡1¥àwõ=£¡žÿî/`eÑ›ía3¶»MìW ;‡,bšävoêÕ]:©³•Ac|fœ®žjŒÕXKºLe¨æê ¬ú8¢ŠI‡ - -Ñ™ÊA¾S -)ö$Ô9ÏŠBïor¡ªî †TzZeE®Ž \¢\ÆdÞS5õD»†t L@à>Pt†â -°0ñxH²Ì½†t€¦J~‚ˆÂ’¼g Ý1K))A.Ãî^®kÚ C9=ò)òÀ eú¶©»‡’Oñœ -`Òaä%¦ È—‡Q>Œ•1c ¶@¨b1ˆ¯¤—&M–%»Rg»œ0ÛR×C_ðКÒy|¼åßt»ª*³ÒXÿbÕ‚¾ù$ o+¿Cû±#PGýhL#G9 -/H£çs[ù
Êk´›¾¾¼šOƒ‡-ÝA¼Wý(«‡ —KuB‹uËðùý‘èí2¤¢§»^)£' ~G|¬\%!/Û å¯AÅlåò*øî:œÿÜÕ2XõÛ]»iÖË Â£úÊb§ýÈòxÖìéHêØOž\ Áw]ê< *¡R©ÏðŒÎU©|ð2©Á¡ -Q¸…JŸR ¯?%ý·ëpendstream +xÚ]sÜ6îÝ¿ÂÓ—“g²Šø¡^ŸÜÖIÝiÝ\âÞÍ\šÉÈZÚÖD+mWZ;îÍý÷P+鬯íìƒ(@ +xž(ÊI^)à PsɃúT.wêS¹ õ!Ô©!îÈ#UØÉ\ °ÕQËæ.®û*î67=€]ç©ò{ +\
‘ªÊÞ¢Ëщôô'¬
·å@ ÔB¶=ñ/§t3S¥o&XœL„Éc b÷2!G°*ëv°mÙVì„ÖdŸ•íÙWÕÞgmëf`P;ê}&
@òY®*̓¼cËî’"ÃÄGvwv³©—KËðkbpb +0XZÔO9ËøXg.¦ÁcÝÝÛÍõ]l +±Ì‚ÇÑ–‚u×´Òç°å°»' 5v˜cu†ì¾îíÎ1O¶ýý8¦ÇwïhðÛÖR•A^uä¯ãbA +Ó[r3×5lÊELíÚ¶Ë1/ôùÝý-g¡” +Øtç¹ð†ß]ï”ãh¿ëC9*ð’%Þ{Rôb “2NSWRMœ·ÁD6Q™ç +ì<È¿Iñ“F@7gñ)S˱ÔSóºqƒ'M
ÒЬ3â/™w ¦Ùc6Àr…)ôÌÞ°•W÷+¥¢ëO ôk[Õè×í+ÎTSUÊfbÆäÓ6ŸéXdc&Žv ˆH ˜"c<°5ƒŸŒji¯ËmÃ;q•< ߪì=µTr~VKWK‚<&§Êb Q*såÏy›á˜l"8s÷PžoxB[G•cM|Pz*Ö*‘_” ¤€Z§éÿ#½?‘£#*ýF›ž77”ŸBÙ&$I9úÙ½<k«'ÒÎIƒå¶®°ÊÍ´/-ï°3 +0‰™×Aò]KNznÐi¦±w¶!†äÉ"1Šx»áVÎò5œšçÕx]M ¥O©ó8O÷êv— |7OlÔÓˆúz‰ÿ‹G1µÌ|¡^PŸ–‚eñ”¹dž;cB7,€›Ó^ù[$ã¸ÿèÙ<ã¢÷i,M:8ˆ¢eö3¤MU=kÓ +|cò?ø ONæèØ{Ÿm$ÎE…þŽ€ÀB 0@]²ì ÂìÜÐ5UPëú€1ù;ãßô9a¡úHG»âmâ±¾·S øKp9Í©13z=Ëk‡‡5žöI.ãõWH–ÓèmÏuÇ~]u3äVlŸô†a×*N +=n[îÝDå“ý¯¦7Í{¦$«—/iÉ¥;|8ò€Â1×l8Ä{7ð¸éµþ¿j:žu™-’Øý^_ï_<û¿ L¹{³áÖ¾lvǯÝÜÕ¿ Ý “®<Ò_Lã§þ²’ÃÿÙþ`—Œ×Ìúï|»ÿ:ê<†rR†ÿ©'s°¦0S¸## qîÿ÷÷˜õÿõµ»6endstream endobj -1865 0 obj << +1892 0 obj << /Type /Page -/Contents 1866 0 R -/Resources 1864 0 R +/Contents 1893 0 R +/Resources 1891 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1863 0 R +/Parent 1885 0 R >> endobj -1867 0 obj << -/D [1865 0 R /XYZ 85.0394 794.5015 null] +1894 0 obj << +/D [1892 0 R /XYZ 56.6929 794.5015 null] >> endobj 586 0 obj << -/D [1865 0 R /XYZ 85.0394 584.5645 null] +/D [1892 0 R /XYZ 56.6929 675.8159 null] >> endobj -1804 0 obj << -/D [1865 0 R /XYZ 85.0394 559.6651 null] +1827 0 obj << +/D [1892 0 R /XYZ 56.6929 651.4464 null] >> endobj 590 0 obj << -/D [1865 0 R /XYZ 85.0394 429.8459 null] +/D [1892 0 R /XYZ 56.6929 522.8339 null] >> endobj -1868 0 obj << -/D [1865 0 R /XYZ 85.0394 399.1723 null] +1895 0 obj << +/D [1892 0 R /XYZ 56.6929 492.6901 null] >> endobj -1864 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R /F48 1238 0 R >> +1891 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F21 950 0 R /F48 1253 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1871 0 obj << -/Length 1188 +1898 0 obj << +/Length 1144 /Filter /FlateDecode >> stream -xÚWKWÛ8ÞçWø°J² ¿†¥Ò3ÐNȬNŽ±eÐÔ±\É&¤¥ÿ}$Kò#H: /¬ç§ï^ÝOW² È?Ëp=à…vhøá¸Ðrx5‚Æ ï;YjŒ©™ÝQ £ÃSÇ7Bz¶g,ÒV -+2\ÊâÇË+ՆʪP¸e…ò%²¡b8¿Þã G›oîÔõ…m‚ÝFk5ªk‰=ží»j+£²gȱÓ.¢É-åñ2õ Ó -ô¡Ý"› „ãÌiÑ<Êdý§ -Ñþ½æÝÅ:ôŒå©R¼= °I“ÿû‰Û¾ÿ§>p‚À ~½Ú> D‘. -ígÌõ[ø9õÿ +xÚWÍSÛ8¿ç¯ðp" ËŽ{8Q6°tÚ¦é‰2Ç–A‹m¹’’–ýßW²dÇ`|Їõ~ïû= Y¶üå{Ðvƒ5 +г‘gEY϶nå¿ó 2g@u4O}šöŽÎÜ‘À`è iÒÀò¡íûÈšÆׇ§Ÿ|Ž'}àxöáö7´?]\ý¥w=œ~¹:»8ÿ19é‡Ó‹/Wz{2>OÆW§ã>@¾‡$½cž!8»øg¬gç““ËË“Iÿfú¹7žÖº4õE¶«ùÕ»¾±Xªý¹gC7ð=k%6DAàXYoà¹Ð¸nµ“ö¾÷¾Õ€¿%i—ý<ׇžïŒ: 8@
"dž=¬‘À¡ë¸¥ŽŒš÷Áжט +$4p\ {P ;:Òÿ¿2º$1Ö‹PÍŠ ³¹$x¥g4Ñ£¸3¿ðC¨NBIPñ@ž‡Z<~ÓÜ<J1Éo
¿8f˜sÌÛø$˜åaªWw” ÛøN‰¿Á=hHr ·þ”®ý¡çµéĺ0tYÈ%«ã.á’nƒJ.Ï4
èÄÿo‡Ÿµ;´×6F–Ü4—×õ¨ì{ŠèÎX45V‹R‚sa ›SQé+OâX/æë;_ð^Áð’ÐßDC§3JhÐbûÇÈ”¯õ¬[÷ŠÑ' nln¢xi– ³%‰ÌBÐ*úšab8wʶ•9}QŽ®”a*‰De»·$…óLRD4!Éë¬ yj<S,æ)‰ªUE2YȼŠËw%†@ß m—¿’Îs‰Qy¢‘[ø/&jü<:sUÓ$Šù`$‹àHûH•tg$ë»]›P•ïï"8“þ7Õœ…Y2ת™Êå D®çnJÍfy˜™åu”†œß´,fBeÿRr]ç&]_ ÌÖíüÐUpVfÐ,%\ÔÙRŽ7]^xŠ ªðþ0XÁÂœ'˜½¶Ã‹"«æò²j8 ëZtîù}Ý÷f”ÍTª¿Šç²E@÷x 6ø + ê€IiK ®ÛŲªOù"›«øØUŸ‚ÊÔ7R¤4ª` [vÓggúìŒ-ªÌ¼†ÞìãnNl$iG&)fÊ3³ LÔûja8è˜÷]8ô‡N§evÅ))z%q‡`‹OK *‹Múi{ö*dùc’ô‘Üæ”a¹‡Z _²ŒFÌ Þ‡žÂHG!‹÷TMÏ‹d#ž)©Z¢$lmhik:´37Æ·ŒˆíŒØY阄é¢hÎg´u7ÞAMËQ]¸ê“;ꢬÈAB™¬.» Ù´ Y¸ÚËÿÒÅæƱ·,ÀÐN~W +ÉÙŒ8ÚÅ ”ê°Q:¨:õ˜ÆÅ^Z ÌÚ÷´OÖn5ÈCÂÀ<äosiI0š˜$²9á<ª²}Ÿb]ˆ¬ endobj -1870 0 obj << +1897 0 obj << /Type /Page -/Contents 1871 0 R -/Resources 1869 0 R +/Contents 1898 0 R +/Resources 1896 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1863 0 R +/Parent 1885 0 R >> endobj -1872 0 obj << -/D [1870 0 R /XYZ 56.6929 794.5015 null] +1899 0 obj << +/D [1897 0 R /XYZ 85.0394 794.5015 null] >> endobj 594 0 obj << -/D [1870 0 R /XYZ 56.6929 352.0993 null] +/D [1897 0 R /XYZ 85.0394 445.2582 null] >> endobj -1724 0 obj << -/D [1870 0 R /XYZ 56.6929 323.2794 null] +1746 0 obj << +/D [1897 0 R /XYZ 85.0394 417.9153 null] >> endobj -1869 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F21 938 0 R /F41 1218 0 R >> +1896 0 obj << +/Font << /F37 1038 0 R /F41 1233 0 R /F21 950 0 R /F22 973 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1875 0 obj << -/Length 1168 +1902 0 obj << +/Length 1201 /Filter /FlateDecode >> stream -xÚÍX[Sã6~ϯð#éŒTËwO,
[vºì6MŸR&#lT|[IÙÿÞã[â$†µv:™ŒeÙúôãs¾#‰h:üˆæÙX7}Ks} Û:±µ éÚ5<û8"õ;¨y µßú0ý|fºš}Çp´YÔÂò°îyD›…ó£Ó_O¾Î&Ó12lýÈÁcd;úчó‹_ª ¿ºœ~¹8;ÿøçôdìZG³ó/U÷tr6™N.N'cD<›Àx£FxfÀÙùo“ªõqzòùóÉt|9û4šÌ6¶´í%ºYòm4¿ÔµÌþ4Ò±é{¶v7:&¾ohÉȲMl[¦ÙôÄ£?F¿o -¥‘Û0€ M×åñ¾w&Øv%Òç[q/óv{‘åŠ7©Ûá
;”b] /RÒkk’bj-èý Sþ†U]Ú,o†Vo(xõøÖ§h-d΂ ÖÔê±µ¡ÈuÄ…Tƒ¬¨q˜;‘úþöÂÆsÈ"ˆü_v¿Æ»í~;¢TþÀãO‡ª\kÕ‹õî,7¶-âîkJÇ$]–n¶sиÜêüŽesˆn™ÙŸ›ü[þ¦J=Ôu‚dOÓì:ï=é›O—¶GolN=ÏØ FëàÈÔ ì¾Û*ŒõÍ}æ›c¨Cêÿ +xÚåXÉrã6½ë+x´R„àÎòÉãÈOe<‰¢œ• +&A1·! Û²5ÿžæ&‘5CÊÎ)¥b ñÐ
¼~h(*üˆbZØr5W±]›*1/©Ê ô} ‘êT„š_}˜~¾ÒmÅÅ®¥YÊ,h`9Xu ¢Ìüù™…5<õìòËÍÕõÇ¿¦cÛ8›]¹#ÍTÏ®®›”¥Ó‹ÏŸ/¦cD “œ]þzñûl2-»¬ +ãÃõÍ/e‹[¾Ž€N'W“éäær2^Ì>&³/M‰ªçŽ| ͪâƒÛŸF*Ö]ÇTž ¢b⺚ SǦ¡ëuK8úsôÇ°Ñ[ í\?¢bM·´Ž4Hc [*@Ù¦‹-]Ó‹œ‘¥ªg}Fü9ÈP˜Ü!Á_XÙ ¯¢[–•åóòµÈ}†‰!Ø5Mm Ef4Ë÷C†’•|;’äÑ $ÒDŠÉƒuY^3±L²eœ”ÕMùbÏiÈ=.[¦NâpÝÛèr*ä³Vƒó’ØCd‚DB÷lîákºº}`ëÃe:V2ãñÝPëD²Ê¼Š «¦ÊScI}?«×/ –u8†¶
Ý,`~*ºLìÚ¶¥4Ú„”ƒçi’UûÀÓe^YtX‡ˆcÝpÝ [‰ ¦¡Ö¡¡Ž‰u˜¿2Ô8b¨q¢¡.Áš£Ù»õ’Ä I%’{I‚U¶ˆ,¬Õø »%ø z¤!÷¹\# Ô90/+‹Þ,Èqá‰9(N|&N +Ë&Jþ¦r•õ‡:j\§§I—O%½¥õJÿ80ZÎD<F ÀûB¬N–¼·ƒ–Èl=‚ Ú1¢eˆòyÆ<™d• ¥TÞ/cõa.] endobj -1874 0 obj << +1901 0 obj << /Type /Page -/Contents 1875 0 R -/Resources 1873 0 R +/Contents 1902 0 R +/Resources 1900 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1863 0 R +/Parent 1885 0 R >> endobj -1876 0 obj << -/D [1874 0 R /XYZ 85.0394 794.5015 null] +1903 0 obj << +/D [1901 0 R /XYZ 56.6929 794.5015 null] >> endobj -1873 0 obj << -/Font << /F37 1026 0 R /F41 1218 0 R /F22 961 0 R >> +1900 0 obj << +/Font << /F37 1038 0 R /F41 1233 0 R /F22 973 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1879 0 obj << -/Length 1087 +1906 0 obj << +/Length 1187 /Filter /FlateDecode >> stream -xÚíX]oâ8}çWäV²ë8ŽÕ§N—v;ÚavYæ‰A(ÓF&6Ó2Cÿû: @hM ÐÑH«BqìøøÜã{m_c™ v˜=A„Ã… ÂÌMȹ3m×
\~V êWïz³+Ê …G<§7©`ùù>vzã~Óƒ¶ j^~ì\Ý\ê^´¸ÛìÝ|ì´ -©+Ä~–ûã`T?!°Àø„[çå{K t C¥Ã‘².×5fe èà6Pò¨åmÆ •“Tªû|Ë9j»É6®c@,Ltº8"çq(Ķ)óH‡ Øï2M@œog@ëh? -œ¯Å´§óÕ«æ¬6sšû ã`ehJ•^ø£Xˆl°z1+{܇±>·i1 #«7½âƒ2’wÆ‘“¸rz8\¹Ñ½ }™MjµA/'A-û8Iå&׈ùãì¬xv’20o¦³HNe¬åZuÆVÝSuÆÏtVz~ûšxA%àë\¦‹jQo–*©ÔpèÑý02«DQÿTCÉ -¦™‘S`ñ[LÐ+žÑ|V-“YæHõŽö½-Óv9}U'[,²î`’¤FÕ2Z>êe< ¤ˆ1ŠŽ7(™UËI˜*½[pdª¶¦¿¿Þµ6[á¾Ý B¸jOµeQ{ø±1s«[Å/—Û„óM›1èbNöŸ•lò¬ÓS¬Ç߶oL¶ vŒ½+«|³\°>ÐÿéѯHlgx|О0Ȉ uóÿrÎTWoŸBÏ÷Èqz»ºž=Žß,e:þŒÑßv»GÍ’G©í.ÎüËO¾ùÛ\‹º&wô}²¾Ô#¤r©G¸]߀”¤2C…û‚ùêŠð%õ¸°”Ùendstream +xÚÍX[oâ8~çW䱬d7¶ã$VŸ:]Úíh§3˲Ol…\bZkrabgZ¦ô¿¯sJèEZ!dlj?çó9ÇdÙæ‡,ŸB›0Çò˜©¨5z¶ukÞ]ôPõ
X}ê_}õŽÏ‰g1È\ìZ£Y
ˇ¶ï#kŒÎþ8ý6 û +™ç¹VÝ€ ²óxž¤ÕLÈù$¸ná—Ç,$¦Sžà§[§ê>§Ê<ˆ]²%UgUçuT±M & k1 jp¬5´Û bDi«¬-\÷J‹1‚ȳÝît ž=Ûw·htt
‡A‡0·UïL °Só=¡Ö©"Áõ ñ°³Kú¶Hð$cûYîƒMP}@ † .–ª–yù•Ä(͵TZN«„9Ë°‘”MFV¢Ñ›~ fKÉ[ð“‡2za–$ƒcžžçÃqùpÝ9#æ¸æ ›, +â$êUKT %/¹ÎÒîP; éÅ\¼ +$àšßð•Òû‰†1‘ŒA*fÆ€»bá~õòÿv‚‰NA ç<…h°0 2d*¦:I«¥yÎõÝ$æQÏå™Ù ±2;‰U“ûeÄ›ÿ2™Í:Ø!ãPæVzÆáÙ.ÊB-A¹'jÝJuÀø%ÒÄI¾³Z‡ûa +Ï“EÞ Ì’Ô¨ºQF‹½Lùý>Eö£h°AÉZÎdªôAÊV8f'јþñz³ÙíÛØ@¡öÔYµg€Ç™n5¿\6 û7J¡ƒ<¼¥_Ë müÖ'GS¹^ßvlLn5l_¾`è~-€>ä~á|R~ïm÷ÖI½ãIùãsmlÄx!m×aæ_
ðæË·ÍͤcNo¾×÷j×îÕˆíB 3oE*7ŒÑmæë[ºçÔÿô |endstream endobj -1878 0 obj << +1905 0 obj << /Type /Page -/Contents 1879 0 R -/Resources 1877 0 R +/Contents 1906 0 R +/Resources 1904 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1863 0 R +/Parent 1885 0 R >> endobj -1880 0 obj << -/D [1878 0 R /XYZ 56.6929 794.5015 null] +1907 0 obj << +/D [1905 0 R /XYZ 85.0394 794.5015 null] >> endobj -1877 0 obj << -/Font << /F37 1026 0 R /F41 1218 0 R /F22 961 0 R >> +1904 0 obj << +/Font << /F37 1038 0 R /F41 1233 0 R /F22 973 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1883 0 obj << -/Length 1994 +1910 0 obj << +/Length 1066 /Filter /FlateDecode >> stream -xÚÍËrÛ8ò®¯Ð‘ª -<ø,ŸœŒñÔÄ™u”Ë:.%‚w)RCRV4»óïÛ(É¡3Éø²¥Fw£ß˜rø‰i2®Ò`§ ¹§Ëõ„O `ïÝDXßùÇToæ“×—*ž¦,d4G¼Æ“DLçù÷öçóßæ73_†Ü‹ØÌ#î½¹ºþ‰0)}Þ~¸¾¼z÷éæ|ÞüêÃ5¡o../n.®ß^Ì|‘„ÎKËá™—W¿^ôîæüýûó›ÙÝü—ÉÅ|¸Ëñ}Wx‘ß'·w|šÃµ™p¦Ò$œî`Á™HS9]O‚P±0PÊaªÉÇÉ?†G»æè˜ýB•°0‘ñˆqd@Á–i<ÔEJ*cÁÛ™ qî³/~«‹Vw+¿/ך°õv½Ð-Ágô¹Ã;ƒ`_–†¡<aRÖÀ¤o÷/`aôøQâ„ŶêKu½;´×Ý}ÓÞ×Í_*–¢¯N´ùóÌ pÛˆý£©JÝ×™ÓðvYe]wG‹ÿ˜££lûýÆžèú¬/—~×ogß0GVUÍÎÿ}«Û½cNø<Wu÷ë¬_®î«²ë ÿçwاÓí£n}ËBw'Œ-M¹¹Çý{1Æ óoÉ’#²ÐR£rpã ý0Føƈ رûq?‹Q?/õ³xâç¢iwY›ËÇ–„ŸyÈ›ºÚÿ·(Û®‡•øîÔ±|tû× ½Ý4m?àqq÷w\}V¹®ôø£©}¼Àÿmæ=Ñóì/uy})Åt@¨P.éöØ4d „[å¨A|„ÐÔk]÷´üIæ\Ö%Š%LVç|ê²=È9”k´@ -"ê ‹<ëíÈN†=,ÈÓÄ veU´Ðc™ž-*ëõ¾¡ï¦‰Äk ËÜndÛ~Õ´%VÆG‡ª»© -¸ = -æda¸ËåŠ%èWYï +ÄpK¨¼cÁÝgËÞ10Ñ yÛ
$=VÒfäÒmP$rR+Ž÷Öz†ÀÚ( øcUv¬²šÐYÕ5c½
ÒÐW`Z;À ˆBͤ¶&ƒ§ eu xÈ{³'\®‹ ¦ÒWäý¾…Œ,†™3»2“f~Ay¾ucáQû–±ôBEÓVàK¦ -B«$"Ü -yx‹¬3¦ -‘™îšx`ãôèø¡Å<5’±»…šLp ˆ“ŠˆÙ•ýŠ §ª#nþñê AÿÖ{T+ä©wUX¶Ä 3¼²Üðžø5þ1©Ÿ¿M<¸× ;ªu -B˜; NMå‚°Ý•y¿Â Ü»n …«ánb -Ó/¥ä%)Ou[¶ÞTúÕaº„r=Œ Gh—¸*ŸX¹f@8 ~BÁx:ØA12„åÈ4%, 馎òaÕ“”M•-µë ÚÎ’³ ”OÞ»6“¡.Cs奔⪬Ma -=2xDû@2 ËpÐþõ·/Ä ªLdÉw+mûËל• -ÏDg@h¯øÔuÿÚš@‚êD +xÚÅWÝsÚ8ç¯ðô nƪ$˲5<¥)äÒ¹¦w”¾ Í0DðŒ±©,Bé¥ÿûIÈ_HÒ› X}ýv÷·»ò +9PÿãS@fNÀð!òé²;½vÕBù ·ØäÖw½¶Þö½Àa€QLἆ†ÈÎFm +0èhؾütÓ¿¾ú2¸è¤=¼þtÓq±Ûýë?zVº\|üx1è¸(ôQûò÷‹?‡½]¢9Æ»ë›÷v†Ù¿'@½~oл¹ìun‡ Z½aéKÝ_=ãÈ·Öè:3íö‡ }g£ Æ°³lß>ñ¼b&n}nýUÖVwGùC`â ªB@¡† +|¨‡½ £ŽK!lóX¹Jò$› éféZN…]ø +}ȘÏfÒÎ<§ =4 €xþì·Ý’XP§6¯A=<Z¥RY1ZÍàÖŽºöïv‡àbÈ + =ßÜ ¡hh˜Ý3ã< ñ +ì²-Ví*îã„Ž¦1ϲ<
ÿ±ß«¶«2Æ:g¦:uÖ“î:x §÷ÛZÈmnçu}‰,/¹š.ƱÎ>;ÿó ~2!ïuÊç"Û •…U•pŽ +‡¬Íí¸øTyš®¶VJçv“* L“d%]nV(×òT1˜»LÐS›(Ž4MÏ'q s•Úÿ•ì °ÞG³|¯Õ"•‘ùÊÜSI¶ÙÝ°f`íÐB¤Àa¾€zº±±ûº€“± ´ ¾v$ðPÓ{–Õõê×Oõ4$ð—²r „€„ÄóÁ2ì2úèmV<“ò]5ÓÿÛ«¤Kendstream endobj -1882 0 obj << +1909 0 obj << /Type /Page -/Contents 1883 0 R -/Resources 1881 0 R +/Contents 1910 0 R +/Resources 1908 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1863 0 R +/Parent 1916 0 R >> endobj -1884 0 obj << -/D [1882 0 R /XYZ 85.0394 794.5015 null] +1911 0 obj << +/D [1909 0 R /XYZ 56.6929 794.5015 null] >> endobj 598 0 obj << -/D [1882 0 R /XYZ 85.0394 445.5677 null] +/D [1909 0 R /XYZ 56.6929 278.1954 null] >> endobj -1885 0 obj << -/D [1882 0 R /XYZ 85.0394 415.4538 null] +1912 0 obj << +/D [1909 0 R /XYZ 56.6929 248.0815 null] >> endobj 602 0 obj << -/D [1882 0 R /XYZ 85.0394 415.4538 null] +/D [1909 0 R /XYZ 56.6929 248.0815 null] >> endobj -1886 0 obj << -/D [1882 0 R /XYZ 85.0394 391.0424 null] +1913 0 obj << +/D [1909 0 R /XYZ 56.6929 223.6701 null] >> endobj -1887 0 obj << -/D [1882 0 R /XYZ 85.0394 391.0424 null] +1914 0 obj << +/D [1909 0 R /XYZ 56.6929 223.6701 null] >> endobj -1888 0 obj << -/D [1882 0 R /XYZ 85.0394 379.0873 null] +1915 0 obj << +/D [1909 0 R /XYZ 56.6929 211.7149 null] >> endobj -1881 0 obj << -/Font << /F37 1026 0 R /F41 1218 0 R /F21 938 0 R /F22 961 0 R >> +1908 0 obj << +/Font << /F37 1038 0 R /F41 1233 0 R /F21 950 0 R /F22 973 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1891 0 obj << -/Length 3279 +1919 0 obj << +/Length 2618 /Filter /FlateDecode >> stream -xÚ¥ËrÛFò®¯àª2áÁ`0 -³ !’…@[¿2 -œ*´VYjÉÃ1VG
êÇ<|ˆ?¨äG`™f7ÃÌ?L8bT”\Ï - 'qLˆ ?Ø¢Û8>Eä‡#åÓåÓ ¾[ïÑ¿†Y§sèëòè¹yA‚à¢Ã0‡pA\BÜ #¡áXŠÌPšjOi ¾S à x4¢Û«n×`ÒðR{椵Ýqœ·y æLæ3DA·ŽýÀº§f¯ S¶»æER ˜R¯Ýî~Ù÷óét×·6z¸û”IÁ/£°+˜¼ñ ‰ ž§zÀXq|6äÖ°ìœÎÃ÷É¡7í »ÝÖMÄð2!j'Ã)µ² ,…8àø”J|À'$2õ®uk¦–¡g©¤`Rsø÷› '4Dz&k † /l¸™ò1 Ö±ø´23…‰ ›ÚÙ¸žùÆɨl¹K–Ä*ãúì¯.ê§\*¼4”~¥.ìtáUXffJÈš bæÊ/(MóQùU˜£)€H½§ƒ!ÊÕ -N°éütžg¼T”“ˆW‚Zvëu÷Ê -)ZEÛµ#zHƧ9ÞÁûq¼ÓÊ·OS¨wï˜6‰°ã²,Kçy] è輸 ¨O·hª©c‰Ä„ë¨? -Ráa¨7[ìn¤:¸(Hr[ žv)¥Jli5K©·6趞k `Ù -6ß±ùO]¡"LHK1Oâ—mÝÂûì%?ï~ÄO7¿<þ0YIÞ:vn' ÄI [šÞ5‰.½5Q¿]¹÷¡„z®ÛŒÝÓ‚3Ÿ*[©ˆ½kGøصJ €nä–R°3§/4ýÅ -`œXc²~¨ --$ŸÞxXèòЙË)Ÿ%M±Ñ§¥ º©d9Iã ÷þ+<€,7â' xáØ,†”;;VÝ|’lž[‰2 9ó¤:‰Ÿ8Þ\7½-'…—Xp
!üúÁ5ú8ÿýÅ †ù.|€”0—fX‹Å6IË“êêĘS“$N‘Ê`k¢„‘Î8¢8©2ÒöÃ^ï¸_aø_‡Å„ÎBTåv5ô<r¡¯Ø¾É§‹ÃÉ8£¤O ‡ ç ,‹ ¿¯¥¤ ™²f—ÏAó1°¤Ð{¿Ù’7{ëö ¼:þ(ÃþQK·ŒU ,Oç‰9ù:ºò…(ùŸ¹6eˆÙ‡ÊËw”+H‘ŸzÊ@þT¯ÜKãC Ÿ ZÎÏXèwOn=e p&“*Ô?J(%Tø ”‰M^š“ÄÓ}é·´+LJˆÙ—1çaG1Šìú#N :"OEQi½©‰øñdqb _Ja¶ Ý»)MzÚüm•å†¹ÄJ—3±þË•Þ=A¡‘‰N½÷HYáyÜ^K¾‚Räëóhv“Q>«cžx"N’¥ï~ŽôÿrËsœG|cn‚¿5jBR&RS¿HÿÂäoþýËáÇA&Ó¢Ð!:~y›IÉ)ÿJ{öëœDÅP–hO5:úÿ +xÚ¥]sÛ6òÝ¿BôLÄ€ +<
c›Å(°0QíïJéo¤_)–÷ŒØ¶|þºÿ…g‹å’Ñ]çW®d» uåþ™¥‰~Sô’Cœ0·hfR3׋ÞmÐâhƒa·,zYVñ¤…õ»ã˜ëNñ"6F_EzD 2Š².·eã·*FuמóÄ^ümSlñöâ¡4©{3¯)ÂãY 0 +> ·,WÅP÷ Xûý¾hº•_P8±2˜e9%œµ[`7‚]»Çû¤:H cÚ†G + +Éœ»‚ªf%éO¹8 +ˆ ž~ð¨#ãF»ûMWeÑc¼¯“rl]2?9= endobj -1890 0 obj << +1918 0 obj << /Type /Page -/Contents 1891 0 R -/Resources 1889 0 R +/Contents 1919 0 R +/Resources 1917 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1893 0 R +/Parent 1916 0 R >> endobj -1892 0 obj << -/D [1890 0 R /XYZ 56.6929 794.5015 null] +1920 0 obj << +/D [1918 0 R /XYZ 85.0394 794.5015 null] >> endobj -1889 0 obj << -/Font << /F37 1026 0 R /F41 1218 0 R /F22 961 0 R /F21 938 0 R >> +1917 0 obj << +/Font << /F37 1038 0 R /F41 1233 0 R /F22 973 0 R /F21 950 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1896 0 obj << -/Length 3218 +1923 0 obj << +/Length 2502 /Filter /FlateDecode >> stream -xÚµZYsã6~÷¯Ð[䪃“$ ‰gâTÆžxœÚ#É-Q‰THÊŽ÷×o7 x‰šìdËå"4ÐׇFãà3|ë€I£f‘Qf\Ï–» 6{‚¶÷ÜÑ,<Ñ¢MõÍÃÅ×ïd43 E8{X·ÆŠÇ|ö°úyþö»«×÷— ¡Ù< .:dóonn¿¥CŸ·w·ïnÞÿtu©ùÃÍÝ-Uß_¿»¾¿¾}{}¹à±æÐ_¸NtxwóÃ5•Þß_}øpuùëÃ÷×.m}9“¨È ?ÿÊf+Pûû HëÙ ü`7FÌvJË@+)}ÍöâÓÅÍ€VÛuÌ~JÄ
”À2Bòè4[bÁ€+F<ˆ$ï1]pÎÆe8[„Œš¸q‰â-—pe 5}µ B)¤õÉ&Ëk4Ì×ï„h‡q)Ü‘èa“‚%9ŸgyVgÉ–~TiM…b_1//y</ -W›'»Ô–ÏiY¹!Ü·Ú§ËìÆDº¢ŠC•åO4PB5¿¡¬|ö׊<Åš - ôpFئOIù¢È·¯#!„3 „Ü4!ÄÂI‹¹ÿ&VT²“ -¾iŽÈß.BÚc ZúÜl%Lêúà³sÏ×eRÕåe<?,ëMž1'"̱/ƒ0Ã4K/ù<xà£`Aùð†šn¯ pQ±¿Øüîþ=Ðò€Ú®òWªNòêÅYlÕT›¹ÑýüÍž…Õ*_²zS FÑn±©¢yúç~›-1FIh/©6Ûµkfqîkí†Éø”YýJõUºôÄ1È°ÝRõc:j’<©Qhn`êVø•óÛ~{÷áêæ6 jò,–VEêHrœœ¶Ï~îÂ"zÛ¬pXA‘†¨Ò?í96À^ÛM9;: Sú"—,u„&6ߦɚJÖ×A´íÁÄ>‡i³PK¿,nÐ"Ò -Dßt&[ƒ•ñ7œê !Žø”kÖÐvÔÉÍ…µÂÂsì¸æ%±$+ÝGŒõ)u†YB`K|¤¢hÖŽR"æ¥X< ™‚Œ€Ë§î[ÉKC¿hw°!C´í: ¥*!d/FlÜ–HF -Zmƒ$ª¡‘£í®áh(ÇÉ`Ý -ƒ_ZÑú˜ žM-¡6º›YþO¼ Aóý¦A¿H´m9´)ja¢ÙBGsûÖgÍZ‰@† š“qHlLg±Ï®¼#Ó` -ù›Q\ ÓJnh‚~UQ™ò,í’W*{ÄK²ÝºßŽ`]l·Å …'¨u }lnbƒ -³¹O¿‰Š™çJ‹µ“ õ…£ +µ<tÁ -I€wóˆÊPdÚ›f“VY±QXš€é³ç9)” ¿ˆ—ÐX°k(Ò`B±ó $T`®˜avaÉa~}¸yøÊ
ù‘~£8W`…<Áí¦ó›º+ -›Ù _«:ÝUÔ²Jêä
Ø”GT‡åÆuw MIlþDz öž|_f-72m? OUзÈAE%¹ÛïAÍïéë -G«óËçwŸÆf€ -”Ò±ó_ƒGúT¯y‘¿îz#,”¾QW¹Kç!Z£ã° `9|N·Å~G[%h±Üàûv“Ì'œÐ€$TûÃÕ-õÛ“™êbYl©iÙN}ìH9‘Òl€Š]¶‚p1Œ0Îæÿ¦]´ ‹ˆ˜ŠÝF‡Mò±DËg1Ý}T`–xœ…CûCn ™7íÛï®îÆ !LGqØž@.ê„õ‡E"ŽCØ@P)ÙìÒv§&Htgcr58S=xK†°Þ‚&ãGHD³h^g*› cÀ_€÷³õ uà -"` ñiæ
Õû.nÃ@…q“X5aq•VË2Û»yLñph]L( ÅúZôXc¼ÀÙM™AÖ&aUUØQt"kkèϨ< —T^ •C8ÀvP
DŸ -cÎؾ¡:'È`´Ñ´pTR’‹)°!ËÕÚ<ÕÑO ÒrlŽÅ\M3o¨F¸wÁ¦!—‚õ¿Ãþï[£D kOÈ&ñÃLÖ3ò$Ö ý‡ã~>Ö"<RŽÂiÓ7TçŒ65ØH(¡ä¬µ¨&°æ©zn‚Ñ -ËÁ´íªs‚ F›Fìï¢È§ÑÖ¢š@›§BŽä¡Å¾ØfË‘ì-`©WÓìªþ]¸I¼?Žº|jvsÝ=/^a~Âc|B𑿦°¿²‚#ývpÎçîøÜ÷!¬è\BÎ×–t -VžþŒjÃqGa;Äá¢)ðôV·I7TgŽ6 + « ŽÄXµ©Nê¡êOÿlð_’r…×Öýƒuvƒíã´
Õˆ$måÓ +xÚ¥]sÛÆñ]¿‚ÐŒ ã>p +Òv¾+Wó¶;,QAïï´ ±¤@éÀ²ÑÞ€FS{ÂüÑÔ/•-cÚr[V~ÏÈ®a¤ïÙ™Ï|&x)»oµnªªy)ë'Æ¿Ïñ|p’¹RaÇšŽ´*v]ÙÔí_®ç&Ízîl¹ïpã,’Ãer~_U¯<_5õ·(ÒO‡ýµJƒ"‡äY°÷ mϬÝÆ×LÜí}ÝN e]ìEÀ5˜9Ö4k¶8³xyDn}Û¡P„Ûbÿ\ìÿ +î¬tð²)j¦d!«Ã¾…‹1%ž ǺXmë÷¯L¹nD’?=?·ßÅ^nÇïÚúnµ)Z¾• ëc°'+O”À +Úª]«€”ós¥”=¡›oQ Õ~[ð•V™€æ ú:gà©:‚Ês–ܶE ìŠÑdCê¬^ü«p ÚBØ‹gT"ÑyÌËõ[Æ"éuÇQ ºM³/QÏ£Êô ú"+¢åqåA…y8¥ó‘ÛÅ&·‹uFlˆ¹Ô®>—ž—QÓü +"åL=["±µÂ„Ú½”¬u¨(X ¦{ÁEÓÐFYzª6¶Ùå†F…©Žb&TÕðëd]Í{ª‘èa&ê£B¬;„Pw8n}Ywð‡Z#|Íc Ùó£µjÖ<>|á‘Ü tÃR‡·DÎ5aKöEïì‡8À×FSøǘŢeœ®Ø×R”R< c!ªmÊÕ†)W?rY0¢-Š óʘü°Ýa¸›ðVVë j– NSུl +‰Å¤½1öu¾^Ø _2<‡³N9Ž #ízVÈ´)¼5²2]z0bI V%g4ÛZ%$º3[ƒ€¶Ì‹cÈ +ÑzÒxÊApÊÁÿ}p fÐÆ iRä;Žì µ©ˆe-Í° 2Ù©¿?fc“‘Å)W&ç<ÊшⲊÖÀ”hçDáëXÕ Lè äUª¶ ßµ¼os2Q ¸t|2®)]Fí®M÷`YêÔõÝ”´4S¯rÄ çÁó±°p1ч~³5oöÚ xñV ÇGÄ@G+®/O'Êž•9›¾¥ø3×)%÷ {/†í*ÉO=n#äËbãŸË> ö̼Lé4ß,}5õàL6>w¨)}dÐLDÙ ·!@ÙÐ&™=u)ø-ßòÁÂ*pB¬¿¬½L;¸ŠYdßvœy¹kˆÜˆ£’¼)Ʀ®^qA„“" +[0 ¨M@ÄF€Â‹@Ôa·<ñm Oj»’Š1ä Ô•@£m88L7»bE•â™9É–ŸúøfÉ3®$¾³:9–<‰‚¤ªþ„Hax³Ü¨œDörGGabfrä\F*Ú`yé.
«ûøN=¯†V¾¬Ë®äU±¹àü/dÓ¶&c3¡›DÈH¶AåÖW»ðçMäƒ.Iç£Y_TM–ßÿdWý7: endobj -1895 0 obj << +1922 0 obj << /Type /Page -/Contents 1896 0 R -/Resources 1894 0 R +/Contents 1923 0 R +/Resources 1921 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1893 0 R -/Annots [ 1898 0 R 1901 0 R 1902 0 R 1903 0 R 1904 0 R 1905 0 R 1906 0 R 1907 0 R ] +/Parent 1916 0 R >> endobj -1898 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [280.2146 599.6322 375.7455 612.3694] -/Subtype /Link -/A << /S /GoTo /D (root_delegation_only) >> +1924 0 obj << +/D [1922 0 R /XYZ 56.6929 794.5015 null] >> endobj -1901 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [312.6233 360.3945 381.2953 372.4541] -/Subtype /Link -/A << /S /GoTo /D (access_control) >> +1921 0 obj << +/Font << /F37 1038 0 R /F41 1233 0 R /F22 973 0 R /F21 950 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1902 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [310.4119 330.5066 379.0839 342.5662] -/Subtype /Link -/A << /S /GoTo /D (access_control) >> +1927 0 obj << +/Length 3024 +/Filter /FlateDecode +>> +stream +xÚ]sÛ6òÝ¿BÓ—ÒˆÅ'?rsªã$î4vÏöÍtÚô¦(‹Dª$eW÷ëo P˽K‰¹\,€Å~/h>aðO 2™ªIœªP3®'ùúŒM aì÷4SG4 R}wöí{OÒ0D4¹_ ÖJB–$|r?ÿ%¸ø8ûñþòö|*4 ¢ð|ª#|wuýŽ0)=.n®ß_}ø÷íì<VÁýÕÍ5¡o/ß_Þ^^_\žOy¢9Ìv…&¼¿úá’ ·³OŸf·ç¿Þvyߟex^Î$ ä³_~e“9 ûû3Ê4Ñ“gxa!OS1YŸ)-C¤t˜ÕÙÝÙ¿ú£fªO~J$¡ŽR€$—¡*~y_ÚƒÁ¾I¦B¶rÎBÆe«'<dq”ôJQ| .ãPr.&±NÃH +i´Òó²)òÅóí{!†Zda”Æ +vAÂ[$<çI€ÄS‘êà?uU´FAF#„߶ŜÐ]M˜®ŸÊ¹%ɪö¹hÚCª?¶ESºŸ—EEèª6³§È!ðç
S…aj€H¤íßÖ«mWÖážëíj~0¼]uô^Z’ëŸÞÝ|š]]ÓÛCQVà ݶ©Š9šd2¸©V; 44iç HI+#%/[z¶Ûͦn:#$ Ø
áŸÊâù<Ahuq ¼8
c©.²Õª~ž¢¼v ½é8L¢È’æYE«?´Ñ c*À "ÆÝiÈK2Àk¬Äº¦¤ƒ0ÐH™/ ÌWeQu-½´EA@·,Z Zý†>y]-@žB!9´Áˬ%€ö‡#¶FPˆzw}wwy°¶Ã9™ÆÜÎùÌ4{wóOON˜¬š6»þÉkH½ì¾©+wœÒ µ|¬Hmæ´A•Y»}h»²sˆ"+W+‚ê<ß6¡F"!¡ß£Úa•˜1EiŠ§á½Å"zÈjK¨@ â †ý/h¥á9»`Œ¿]àJƒ_Lj·+¾è+S2~ˆ;ÎÙÌëê3câqë‚‚JDÑX·ÛØ GçôpF¾#S TÙÚ˜AÊ‚ÏB¨ J@¤(»%’ÚÍb`de±ÀW—••ñq íÌsŠ\s¢[•GUÝ2CˆD°©ËÊ€œœP†DÌ‹Ö lN#Ù|nuŠzKN{Ákc [¯ýÊlÃ4Ž!®ó0Vàû8ðÍp`€‡ÅA1 xÎè1T9= øÇ/Mà+O á@ l¹˜CÆ3bT¡E,þ6¶á‡ 2Jø¡_oO¢£¥ ÿ+±ÌîI‚°H¯#Jé çˆ5ŽˆÀÝ&«ÊvI/hž-„¶Õ ƒ:¾†—w6 Á ™% +=$è =Ä#“ƒi R~Qå&T~¿”NfÊÃŽFÐ ~KmŒ×[Wõ[)¡i+¨—ƒß‹MG(¬á”Kíˆ ñ#jU׿o7„í2#pD“ÃÐr) »ÎÀ+¿!ÛUö„Æ ’V„q\˜ +cáZá 9çÁ$KŒ>Elk>˜føG”VJF&8¶· +|3Z). ×"JÂX³ÄƲ¦šç¶˜sÊmŠUÙ¸õ` ÉC¼.¶ã¡P#¾bB®N]ái˜“®ü2k›÷ ÊWKÒ‹©¡uð±~.ž +S¡ dâê|‰…)fæã#O¡« e,sò©TâàŒ‡¬C‚ˆ´´¬£òk:aN»)òr±£R@™êDª¾nP{ûŒ´Ï'”è}f™*¯OI¸ã§ÅБWçÀÙª6ý†‰i
’5ØsC µµQ㪡s
›½/k “0 AWŸê0R\þKº/ö¤úlÈöú…ž”G¡LÒh¢bÆ,!‰Í‹Uñ˜a=mÓ5ÎèŒCm’ZÕÞ/©@{ÚT[w‚gQ-( 涣Z
FÆ»dÛeÝÖ.†™Ò,^-ˆÍylóÎU·žêcÆMžÃ>†ØÍ*ÌtohèúòÞùÔ;7· 0ý…46«v„¦FŠ¶ôd¶ a}½Z”O°…91㽡ûBj…ÅŸ›U™›œ£ /o[®‡Ø½Xì¨}R‚l û4e·#| ®a‰Ûø ú¡ð1Òç™Ée ê
lûx*ûö&$4i¡y]XJÍœÍÕ… jÇ sˆ O&ªâO#{N«yôÕ.÷Uj +ݾ?X‚Ewlž˜)[ñ™Ñ#G LPaæ:k<D`év¥€Å¨êÀ‰bn¢¾°ÔÇÁCÆàq‚»K<h=9P†‰Š]e†‰½Ûs³‡)®Ô»ª Ø +ß}¯ŠAI}MˆÙè
Å y ,] +w)'خ閔³>ï/Í ýÞˆ2„ÜOV Zg¿Ùœbj¡… 5m1ˆF)X¤õ7T³çÈ +fx‘˜aï
mÑUwÈ +©NÂ4Å2š²†6š=˜ÊsàSÖ”µ©lÐ wÐú¬[™gÐ*¡ ±î…:¢Ýšë^œn)€›†FYðHçØn ù¦)Ñ´ìÊԌœ¶¦g]Á•ä䘈ù½Ø=ÛÎôõôùñÎç*TJ»^¨·G{»«êj· ™ Ù‚»²óEÑN³ÊUà‰FÅ! >Aé¾Y›‹j 1»Áób™Õ-ø:4 a˜]Ó<û士ózECù°ô1+UDJÞ +h ÃñÖ\ALb~zóžÊ³ý¡ÝF¡Š’Ñþwƒï(Ì‹6oÊÍþ{ÄÃcé¦1dT• |ÚŸbÜC¼‰û¦w\µágIh¬¢ƒƒž¨ÚzúWŽ|¼. 9ß Íò¾:b t*ÒôÙ÷T¯1r´š·l#;1MɶÀ€èe[sDžïw‡–µXÂÕÉ{¢ãíL‡2‚Ô?Üûï4³S_ e_rø¬ … Š÷¤‘YòÓÇ=Zõ¯›XŒ§G'…Þ½ÂÅx“ö†^hDzóÚÓ¼l]–f¤hƒŽìK#%dÕ;÷4G[ XWFÈ ¨öþ2ãJŽËž`´5^Å‘~Ù¾ ‹òÀžÿSæå¨O w¼æ_6.Å +endobj +1926 0 obj << +/Type /Page +/Contents 1927 0 R +/Resources 1925 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 1916 0 R +/Annots [ 1929 0 R 1932 0 R 1933 0 R 1934 0 R ] >> endobj -1903 0 obj << +1929 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [340.2996 300.6187 408.9716 312.6783] +/Rect [280.2146 384.4392 375.7455 397.1764] /Subtype /Link -/A << /S /GoTo /D (access_control) >> +/A << /S /GoTo /D (root_delegation_only) >> >> endobj -1904 0 obj << +1932 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [328.1051 270.7307 396.7771 282.7904] +/Rect [312.6233 123.81 381.2953 135.8697] /Subtype /Link /A << /S /GoTo /D (access_control) >> >> endobj -1905 0 obj << +1933 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [320.3548 240.8428 389.0268 252.9024] +/Rect [310.4119 92.6626 379.0839 104.7223] /Subtype /Link /A << /S /GoTo /D (access_control) >> >> endobj -1906 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [359.1386 210.9549 427.8106 223.0145] -/Subtype /Link -/A << /S /GoTo /D (dynamic_update_policies) >> ->> endobj -1907 0 obj << +1934 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [429.9426 181.067 498.6146 193.1266] +/Rect [340.2996 61.5153 408.9716 73.5749] /Subtype /Link /A << /S /GoTo /D (access_control) >> >> endobj -1897 0 obj << -/D [1895 0 R /XYZ 85.0394 794.5015 null] +1928 0 obj << +/D [1926 0 R /XYZ 85.0394 794.5015 null] >> endobj 606 0 obj << -/D [1895 0 R /XYZ 85.0394 560.3013 null] +/D [1926 0 R /XYZ 85.0394 335.882 null] >> endobj -1899 0 obj << -/D [1895 0 R /XYZ 85.0394 535.1807 null] +1930 0 obj << +/D [1926 0 R /XYZ 85.0394 308.9113 null] >> endobj 610 0 obj << -/D [1895 0 R /XYZ 85.0394 416.2201 null] +/D [1926 0 R /XYZ 85.0394 182.7451 null] >> endobj -1900 0 obj << -/D [1895 0 R /XYZ 85.0394 391.5178 null] +1931 0 obj << +/D [1926 0 R /XYZ 85.0394 156.1927 null] >> endobj -1894 0 obj << -/Font << /F37 1026 0 R /F41 1218 0 R /F22 961 0 R /F21 938 0 R >> +1925 0 obj << +/Font << /F37 1038 0 R /F41 1233 0 R /F22 973 0 R /F21 950 0 R /F55 1336 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1911 0 obj << -/Length 3073 +1938 0 obj << +/Length 3198 /Filter /FlateDecode >> stream -xÚ[[oã6~ϯ0ú²PqER¼=N»™nŠíÌn&Å.ÐöA±åD,¹–Ü4ýõ{x“EI¦fÐ „&? ùñððR¼Já?¼b qEÔJ¨ ±³Õf•® ¡í»+ì0‰%CÔ7÷WOÅJ!Å _Ýï²$J¥Ä«ûíOkŽº éúÛ Þß~÷ãÝ»k‘ïo?~¸NK×ïoÿucKßݽûá‡ww× – ¯¿ýç»ßßÜÙ&îd|sûá ¶FÙ?„Þݼ¿¹»ùðíÍõ/÷ß_ÝÜ÷¾ ýÅ)ÕŽüvõÓ/éj n•"ª$[½Àa¥Èj•1ŠXF©¯©®>]ý§8h5ŸÎö N¡œÌt !ƒ”1¥ØJ0…8%ÔtàŸM]\'T¤ëîõP@?p®Öö ¾ÇƒïFJ ”ê÷yÛ 6TCÁu,©ƒiùSð¤5øm±ËOUgkËvF•"º3„“±ËËjFf(S؃¢¦#ØAÛ*ÿ½˜H8R„±7°œ;/ù±žSDÉÈÈòÛ³X£«n:ýé*¡’"•b˜ F€1b¾*÷‡ªØuWl-)wóƒÆ½çOeÝÍÙƒQ0^hÂkŒÆ (À‘P"»ÀC J†(KC<7=J«Ý<›çdÿÇX±RH²TÆ{ÐŒâ€/i†$[ÍŸŠÂöŸd]ØíæX º²©mE³›hR’I×mCûGj3†x&=#Êzì"a:„f¶ñø¸²…»·=~ÁÝ©\ëîæ옎žÐˆÇ&QÂd¡Û{Ô‚!Si–õ8Æ%C0EœcCÔeŽõ¨óµ‡ÝX3NMtqÕ=jFwH3pW†ªß’dÎ1Ë`Ï",SHH… £,søo§r¿€e e\.ŒxZ0d*-Î2ÆPJ…Z`Ù -[¬ÔOˆÈ/`/–km=öšAÿ…-÷ñ`Z -s—@‰\ç®1·ª²ílÉô -®7 Õ|`ÄeÿüÌo:fzÁ¼æð½ðÒœ*§?×›1g“©›ã^çrºÊw‡ñ±u>AP*y6Ê9e±½È{ ™¶ÊØÂ>{ˆºÌü 5 ¾îßÉsý& ¨ ÕÝ£f”Ñ |Í$L@ûv…Ý>Fºüó=Wûä -vk©Kzk©Uó`zêB¢ ù•]Š ±t šú›Š~¿äm0I( rûÓ-,½N»wœ!Õ['þ â9šLW£„÷KšÝÈÈ~²Ñ¤nú×zÞ3KöÁZ´íÓjsÄdžSîz;jë{N'•&ÁœKøm71{’q™—0?`hhyEXé@&AýcgLI.œ +xÚµ[[sÛ6~÷¯ðôeå™ +Å• +¾`KxÁkN‹‘}•ïÒêh}í¬w¾ÚóÚ.5H"ð§Î(Xœun@Õ~{¨m)-Ž¶pó««X¯í8ÔuVÛ÷j¿„®-æ%ož&(Fa×EEr: ¦Çxà \:¬9%*¹xçÌ+«Æ–v©3ï!ÙrE`ŽíèAÌù§?ö‘KÊù"æM˜ËÂZ‹WY a"Ѹ‹¹½>²šÒü +ÔbíjÚy +4ŒMB¡ºa3VŸ?V3 þñ¤®-<Bˆ(N®ØMY8„ ó€¾vˆµ¤É)òÙ°B
·Øh®»à
B/<Ûà…º9<Ø’™uµÛ2ÞŸ¶Ý ÂC^6Ùnß mѳ+›`° Àæ>¾²õQçW62þž²ÕóÒ«:ܳ rF¹GMh îÙ¡•²‘ú{y9DU·‹b®›L °omk gL›ŒM•¯×bcžOÒ +V¯6²šaÉ[Ÿk[¨E“þe[Ûn^ʪ&ÍÚu¹³enÃwí¬)|,–0‡3ÍÆb +ĸ›…_\*´PióSæ·h²jo3˜öâ U‹Ô5¦öǤµm©í# +é_J!>ÿ Qtp#›Ü}·û®zh¾›¾~¦”¿~ö½‘Ǻ¿ Éú WdQÛr‘º;iFc±Üe»²:ÚGÛ ëåÃ6…³Pc ;Kgí}é®ÐÁ$maeÖééÒmWîÔ4é³ë¤Á€NöÖgwËñÅ×t{°)yv¢ŠiØ—µù"•Ù¦|ckÓõ:7±=ÝÚú~@á‹u•»«dÐôdRØmõCfîȘºm^<Û{Ü𤴵.`qwÍü N{€,îÊ]6u' NO÷¥½Ò“ïYGºÕö°î(è®a
È•›Xõp8VP¶…¢
qÈÎ>§ Žƒ«4èÜ 1Ì_ùLøçœûÛLtúK+.Sê\rL +¤M¢Óe:BS¸dbDYB'lÿ ŽÜendstream endobj -1910 0 obj << +1937 0 obj << /Type /Page -/Contents 1911 0 R -/Resources 1909 0 R +/Contents 1938 0 R +/Resources 1936 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1893 0 R -/Annots [ 1913 0 R 1914 0 R 1915 0 R 1916 0 R 1917 0 R 1918 0 R 1919 0 R 1920 0 R 1921 0 R 1922 0 R 1923 0 R ] +/Parent 1916 0 R +/Annots [ 1940 0 R 1941 0 R 1942 0 R 1943 0 R 1944 0 R 1945 0 R 1946 0 R 1947 0 R 1948 0 R 1949 0 R 1950 0 R 1951 0 R 1952 0 R 1953 0 R ] >> endobj -1913 0 obj << +1940 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [257.6971 712.9917 326.3691 725.0513] +/Rect [299.7586 737.5313 368.4306 749.5909] /Subtype /Link -/A << /S /GoTo /D (boolean_options) >> +/A << /S /GoTo /D (access_control) >> >> endobj -1914 0 obj << +1941 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [258.7928 682.112 327.4648 694.1716] +/Rect [292.0084 707.2808 360.6804 719.3404] /Subtype /Link -/A << /S /GoTo /D (boolean_options) >> +/A << /S /GoTo /D (access_control) >> >> endobj -1915 0 obj << +1942 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [310.7975 651.2323 379.4695 663.2919] +/Rect [330.7921 677.0302 399.4641 689.0899] +/Subtype /Link +/A << /S /GoTo /D (dynamic_update_policies) >> +>> endobj +1943 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [401.5962 646.7797 470.2682 658.8394] +/Subtype /Link +/A << /S /GoTo /D (access_control) >> +>> endobj +1944 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [257.6971 460.3869 326.3691 472.4465] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1916 0 obj << +1945 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [308.6055 620.3525 377.2775 632.4122] +/Rect [258.7928 430.1364 327.4648 442.196] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1917 0 obj << +1946 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [294.1999 589.4728 362.8719 601.5324] +/Rect [310.7975 399.8859 379.4695 411.9455] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1918 0 obj << +1947 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [303.0862 558.5931 371.7582 570.6527] +/Rect [308.6055 369.6354 377.2775 381.695] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1919 0 obj << +1948 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [332.9347 527.7134 401.6067 539.773] +/Rect [294.1999 339.3849 362.8719 351.4445] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1920 0 obj << +1949 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [386.0748 496.8336 454.7468 508.8933] +/Rect [303.0862 309.1343 371.7582 321.194] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1921 0 obj << +1950 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [301.97 465.9539 370.642 478.0135] +/Rect [332.9347 278.8838 401.6067 290.9435] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1922 0 obj << +1951 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [231.137 306.5695 299.809 318.6291] +/Rect [359.5147 248.6333 420.7148 260.693] +/Subtype /Link +/A << /S /GoTo /D (options) >> +>> endobj +1952 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [386.0748 218.3828 454.7468 230.4425] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1923 0 obj << +1953 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [143.8055 244.9695 239.3365 256.7701] +/Rect [301.97 188.1323 370.642 200.192] /Subtype /Link -/A << /S /GoTo /D (root_delegation_only) >> +/A << /S /GoTo /D (boolean_options) >> >> endobj -1912 0 obj << -/D [1910 0 R /XYZ 56.6929 794.5015 null] +1939 0 obj << +/D [1937 0 R /XYZ 56.6929 794.5015 null] >> endobj -1909 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F21 938 0 R /F48 1238 0 R /F41 1218 0 R >> +1936 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R /F48 1253 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1926 0 obj << -/Length 3034 +1956 0 obj << +/Length 3103 /Filter /FlateDecode >> stream -xÚ½ZKsÜ6¾ëWÌmGU o¹)ŽœÕÖÆÉÊÚS’5¤$Æ3¤2œ±¢üúíƃÃ7Š³V¹ -[v .þÓLØêuCÇì'•!ŠK½Ú -=Y‹: ½Te>µÆKq|BÀ¦ Ab-ªL¬RÜ©ð3绿z'ÛV–Ä{ê0ä×rç1 “p·—2€ÜDŽyéós^fy:FA'/tÄ -Á‰åšXZfcsY"TÕ©wé§|L E!" -mZ“ûŽj Ò!
g‰ÜFM3¹Ay=ßÖlêâ|Ài͈¤\ÎKÐ FDè°Zk"Œ0]>äqcžB%Ëëí¡x>U骇3à °¦ivl¨IoùÄ£ „úEÙWV@¸ŠòŽ²¾óð¸ò•Û–Ú
~Aíá¼^ííYAŒ´LCˆìË$&Œ-0 ‚äÌå¼m’s°YZŠÊA3Œ ¸MÇCZÖà^̬7ÇbŸo†{Á`³ÀÑä¬
h(G‡vBMLG/Ǻ)uzRXà~’Ì°Ï"ámçÈáóºf¢^2`ž¶ Às;Ѐæ¥Ì5Ï<¡ -½••!ÂR5 ÆÀIÿnÉ?Å"|^ßÁ¬“$SÃ,SÈXô¬ÙЂý¹f)&¡¢!í›çX5M²ÕÚ¢cµ©«tH3V f~ù5²~—h^%8ë -ðer¸½µáÄД³ªib1¿l«0˵€_Ðy8ïç‡4xñ×x?0küµ$È`¶y¾áë†6 ïmÔ ß" -W|>ÝÌGMFš_·A,ܽ–Äkº+ß ½¿'@ͼ‰÷Ñî¶ZªÈ:¨¿¤¡±(Ôú¡:øæú9ßçŠòÑ?§¾ -*øðz&= ŠÑ®FÑpùpó]† -ŒÎê¶#…ß®Icºšh¶ùµQÓ$nPñ¾{S açêc±‡aÓŽ·³4¨ :lVxPXÕá&ÄD8k[1\\ÄÃ÷Õº?[9˜7¸I0¨Õë:?À¶ùúK±ÛùÚÇ<ýQç4t%z )
žßP N5´–[È -á÷¡ÝëXøÜV%Ò÷ñÔ„ò6wÓçüw_{ÿ!|, ÙÝO©ëj[¤Çè -oâ¸QŽP»Ïc„jážûV##Ÿª7²Mndw¿Z›ÔÕÔÓËNψ‰†#¯|q¶úçrœÂÚp[zFìqíî)¯Á "Ñg}®Õ¾±Émð¡m2|>ÕH.¬a(9ÏNþ) Á „©N üÉuË EÈúP¯ÄzOð+²Ü¢+H*ÑFìâg•¬9k° ´Ê!Õ¾%õ†ºW_uA+èK///—–¯ÉÀÅàýBHz^ìö[_ÞG_q¤ZŽË㉈µ¢,Ž0ºªø³º ?ŸƒøÙÎñ ‡ZŒàñ×®l9qöU G]ÂL É +T,üš¦š>’TÏ÷=WÉ œBFˆy ÔˆÝdïædÒ•Á ÇBÓÎq,tdttŽcì‰Ç±†ôÇ1¶@æPMý@TažÈØ’Uûc#¶E÷Ð4t‡&g”p KØ9f’^2÷”:º™uºÇïdžŽOÕ¡@BWœÏ=¸… ôLzºAOô@*šø +xÚµ[[sÛ6~÷¯ÐÛÊ3–¸nêtÝÙM»Ž;»3m ‰²ÙФ*JqÝ_¿Wñ +¶Û4™ !ð#Îß9¸¯2ø‹WŠ£Œj¶’š!ža¾Ú>_e«Gx÷õö˜M +¯ v?¬ßüã滇Ûûë
áÙZ ë
ÙúË»w_¹í o¾}÷öîëïïo®%[?Ü}ûÎUßß¾½½¿}÷æözƒÇð=ñ-Ì|ðö®ôõýÍ¿þusýÓÃ7W·Ñ–®½8£Æ_®~ø)[íÀìo®2Dµâ«ø‘!¬5Y=_1Ng”†šêêýÕ¿cƒ·öÓ)ÿ1®'L¬6 +“^ÎPÆÁkÉ0¢Tèèe‚§¼ PÆË»2¯Î‡¡±3¤±$«n‹#¹5!˜tc¬‘2&ö$¿/ +çðÓ“/ìŠv{,§²©]E³7Š
ÌÐe„iP¡¯ÿ@(%ˆ +é`e=4‘ˆ 1©eÏD÷òø¸r…ûŽ±¿`ì¸]gìöb–!#U¢D"Ìõ‚×#jA‘qkF4âµ'ÄbO°†uP †”í¡¢* scý¦©«×Õ¸@Zé´ü +âÆŒÅiJ”Ç|q½¡™4ÁQ{Õ‚F¼“õRV•7¢j½æ +Ó4Ð$Ó(ÓJ™0Ešsb[= ¯±Zù©Ø9.æ{–{ÿ<ù§¯÷
›RÒ~wº~=ø6ÊYŽz¨Iûá¾Í?ü v—XB¦cŠ®NQ¾—¿é~0ææ¸]£Õ±iN›†!PBö4Q4¢&ôèç‡akÉ°<C\ñ…°ì¢æÃ2¢ŒÄ}s|É»‘û F\b Q’{”&qc\Oô·–7”òõs‘×eý¸?Wæ7³,4õ–ë¦à¸n^=¦šªÜ=œþ†Í»âØ:LU¶';Ì3ôã±(‡dÎw1z{ØE),±}‚Æk³ÍÏmáeE«¦ù#Ó»q/÷yY¹0$#L1î‡a¾?Gˆ +Ž¨ ÉýäD!0=ñsâHûöù¹:¹Z¯ÛßZ÷ÓñÀó°–ÒÊÎHìÓ»»¢6빌ûÅ"¼éµjG óyxkè>'ã¥<=ù$&Hû18Æ°ÀÅaV†¦\¢1,o‡ê…,k žÂHWqf»Í?TEŒìñpŽ™DB°ÐüsÞšIêäΊ¾Œú& N´¥dß`N[ÁšoÊ Iš”_Vϱ™€v^p»¨›ÊÙùëƳfÓ–¿“†Àˆe„¥5ˆ¨ ú[QEU_‡?·¦b-ˆ— +&TÎîŠQNãé›X}Gü‚ÙãvgwŲ¡N h‚ñhAQ[ÉÅ7ÿRŽß]Ô<ç"*ô”þì ?f•ÏÅfj3D™XciM"jB• ÷äLª¾.Ÿ{s
Ô€…•2ÁA¥ÓŠôŒNq0àÌ ·;ÇA9¢ 7C=èœì‡ˆZPdÜZš…BBTd ™¯‹J°0 &û¬ÜUÓ,„°äB§5‰¨ Uú,4;"¦ºº|žÓ€”ECRH +{PØß´'è¶öTnÇW`ÑN̶EJzÅ÷ˆÌÍ ¡yOþÝ~âúš†à¦êÿº¼nÇ ?Ù /P¾\ZûX‡p·ÎœûWe½7wJ<y¡Â1Û^ƒ+ÛË=8+H™Ë.Û'W»ÍëxÎ>wççC±st—©,\9è sNÜ—‘ˆ)&—žé 1§ 1 ¿ØXð"Ë¢k.—f)§ _)^¦; yʵÉi`Vˆùnw,Ú¶ó†8l®ú¦Tˆ ±ý#næ$¼§„»FTÿNQ¡çá…õývãïaªÎ=L,™ÀÜSØŒ ?ý
¨°ùjî¾sOc¬ |{©Ë@Üñ |‚ª_Îi|VÙ˜[NxŸ?퓿Ť# <ÛÂÞ eÂu8Ô8QÛó±-?ݪ¶©ÎžçLzkYˆ &üJsŸs}ã^Õ\< N¯®èÍd¢Û‚u”âÀe ~LÚ‘Çœ¹;pÔ¹mjCÜÇs÷nLdm~(~u¥wïý{Sßž~ú«¥m³-/WM í=:Sºñt÷´¿?¡‘ ò‡íŽÌmù âÁ?ß úRþå,0‰¨Rdf¾“1D©ÆA)ã0œ&Yœ*Ä‘ºÿŒ7t’endstream endobj -1925 0 obj << +1955 0 obj << /Type /Page -/Contents 1926 0 R -/Resources 1924 0 R +/Contents 1956 0 R +/Resources 1954 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1893 0 R -/Annots [ 1928 0 R 1929 0 R 1930 0 R 1931 0 R 1932 0 R 1933 0 R 1934 0 R 1935 0 R ] +/Parent 1916 0 R +/Annots [ 1958 0 R 1959 0 R 1960 0 R 1961 0 R 1962 0 R 1963 0 R 1964 0 R 1965 0 R 1966 0 R 1967 0 R ] >> endobj -1928 0 obj << +1958 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [259.4835 737.5313 328.1555 749.5909] +/Subtype /Link +/A << /S /GoTo /D (boolean_options) >> +>> endobj +1959 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [172.152 677.1897 267.6829 688.9903] +/Subtype /Link +/A << /S /GoTo /D (root_delegation_only) >> +>> endobj +1960 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [352.4539 693.8338 426.1073 705.8934] +/Rect [352.4539 423.7962 426.1073 435.8558] /Subtype /Link /A << /S /GoTo /D (server_resource_limits) >> >> endobj -1929 0 obj << +1961 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [387.5019 662.8374 456.1739 674.897] +/Rect [387.5019 393.5457 456.1739 405.6053] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1930 0 obj << +1962 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [381.9629 631.841 450.6349 643.9006] +/Rect [381.9629 363.2952 450.6349 375.3548] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1931 0 obj << +1963 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [398.5803 600.8446 467.2523 612.9042] +/Rect [398.5803 333.0447 467.2523 345.1043] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1932 0 obj << +1964 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [393.0412 569.8481 461.7132 581.9078] +/Rect [393.0412 302.7942 461.7132 314.8538] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1933 0 obj << +1965 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [255.0796 538.8517 323.7516 550.9114] +/Rect [255.0796 272.5437 323.7516 284.6033] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1934 0 obj << +1966 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [311.5276 507.8553 385.1809 519.915] +/Rect [311.5276 242.2932 385.1809 254.3528] /Subtype /Link /A << /S /GoTo /D (tuning) >> >> endobj -1935 0 obj << +1967 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [315.9507 476.8589 384.6227 488.9186] +/Rect [315.9507 212.0427 384.6227 224.1023] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1927 0 obj << -/D [1925 0 R /XYZ 85.0394 794.5015 null] +1957 0 obj << +/D [1955 0 R /XYZ 85.0394 794.5015 null] >> endobj -1924 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R /F48 1238 0 R >> +1954 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F48 1253 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1938 0 obj << -/Length 3196 +1970 0 obj << +/Length 2798 /Filter /FlateDecode >> stream -xÚµ[Ksã6¾ûWè¹j…àIÉi2ã™ÔÆÉz¼—Mr %ÊâF"'"eóë·A<LèTœr¹‚ Ýèn -" d!2”)ª¹âH`"ëÃ^ÜýÄbV´¢¾»½øú=Ë -©Œf‹Ûí@–DXJ²¸Ýü¼ÌE— /ßþxýþã‡ÿܼ¹Ìùòöã×—+*ðòýÇ]™Ö‡›7?üðæærE¤ Ë·ÿ|óÓíÕ¹•Yß}¼~gz”ù8#ôæêýÕÍÕõÛ«Ë_o¿¿¸ºõ¶ í%˜iC~¿øùW¼Ø€Ùß_`Ä”‹G¸Àˆ(E‡ .œ1׳¿øtño/pp·trþF”etb9L $H(%¹P(c”õX~)Ÿ÷%Z7˜„ ãåõ'óY·¹»uÙ!m+ ¸")!èìÓ4zúë÷”ôY £ Ó¼—u»+Ûæ7'Ëã%‘ËrÝôŸ›Öt¦×\TuW ëb¿2ק¶Ü˜V× e´ÍþÁ>R‡ÒŠ:Õ›òhá;{»íŠ®Z¯Úîtg:þhêŒb9[¾oŽnX€Õëò ú2_VÛg!³Ó–LJ~ •;“Êê¡WBÉeanü~*O¦¹m,øJùãã㥢K4˜bÝmž}¬ºý¡qóÎ|ÞUÁ45hÉ°z† õ©êª«Š®4X«ÝéØ‚~S¦øÙ<u•œeá3Îz½G´1:ë›E½ùZÈ8µ@:
Ô ÔŸ ²n6v¤¶líÐ Ì‚wemZm }ê&Dè ®úI‡•Û³>ÁƒÍE?íðyh<Åtï@Ä>f¹ Í@ -4HZ3RA1ˆpŠÛ§ªzl0ƒ0)sàêÐsóx¿0›é ?cz,×ؾ~¶Rï@$CDŒuâT Áf¨à@3zD²´çÉG1˜ñò
P ò9”sü×U}¿ªpxD<{3ËiZšÐ! gÃn *ñט'Ì‹L/ÁùÌsu‚uL œ7†f¤Xçð3vÇrÿëp†rš©´<jF“XZ’xB*Ä1ÎÒÄ¢ÎÏ£ÆÞÒŸEw:N°OäöÁ€¤ 5¡HÀ¾Œ"ÅXjòúì í+ÊÅyæ I•±Àâ ~ÆöXîŸ` Ï9I{Á£f4‰¥¥($ÊU®f8@%èPcuOŸË8òa$9§i
<jB…Àí$"Ôáõ¹ç,
ŸÃ p’|
2‰I`lŠv?cv,÷å´cŠ"ƱJ;À£æ4‰¤¥iG%To'¤i7@%hçPzÄîXÔí¶ì3ÎUÛœŽë˜yŠ¾<ŸQ£&´˜G¬·‘¯C¼3¶Œ¹•n.© Ÿ;RÜsøÃc¹ç¸—OFaš‰´<jN‘HZ’z &Y(:“ì
Qç©çQgܵzȦ2>NÄŒ 5¡È8ãc*ùÛØgÍg} QÂx2ë“”‘À♬¯ÇÏØ Ë}19¦H`*ÒNð¨EbiifRœ–&à -ŠpØœä ÅÏX Ëý äàCÎÒnð¨Ebii² 19GÁgP‚”ð×T·¸IE<(Ö$|Ý"ƒÝ(Påo%àt TJï‡ f¦l ç <m}$õåd²å˜%}àAi-"YiöarÉg²¿!*Á?‡Ò#žÚrõÒ(¨YCõ¼¥”ñ¨ mÂÚ¨Š¡+Pçu6⣢˜#Bd–(0°w†'K`‹Ÿ™‚XîË™È=„¥]á@3jD²’LÔJyî{6ÇÄ!ê<=JX7]µ}:Ç=žÝ&Fë‚”ÊY8ü넿ȈÑØE’°ü,Õ¨b ŽÉÀÐÕ<~ÆæXîËK¡Ä)–ž{šQ$––f×5åܶ;D%ØæP‘£&‹Œ$ÔˆI hBèU ,Ôào Üô.«_µ’§_µ(%[ç^µhüŒÙ±Ü—sNæ°9*–ž~šS$’–æ aHå3o˜ ã,Hw¨êÕ±Ü Ëv·êªCÿý®þB°ø2ÙÝ£»ãSŒuq²Dô7<©¿Å„)R†„ÌóÀ‚ž°DYÂêF@XÝ“‹Ã€$#r¨U‚[ žÖ/’0Kkrö%ž€¼‹êT!éfJ«ÉJòŠJÈxrÆÒÄ¢Î3Ë£ú%ýekRœí±9¬6ÕV_@ÚSÖë©o0(Â9”=Iu<jBŸ°’€h$D*Ô3ÒlÖñ)úÎdh#XŸ ñïEæÌŠ« (,Y¢š -ª3cí·S¯…á©L¹ã -ËPŽBÄ9Ma -^Nd †xâ\Xˆ -IçÂÀHPåä® fíÄðŒÀfH\å£em¦Ò[Øt0ué9†N—û¦Ø˜–‰ÐºeÒôæ`®:g¿Ù…üÑuØOª> ëoö{hóB¯Z°HL§—¹ìZö´8´ ¦˜“ëN™ÌýÍçöp)ÖC9)I&(ÂGÞÈzS]ðyD‰ÇHö2äþäQÒ#’‰x„û—qÆ#™÷H6˜ï“>€ -óQÜ4[ž°~Ò±ŸtŸÙ`Åsx =Óï `=Ôd¦öÔºßĵé]6ëõéhšUmo¹Ñ·§Î&]ú(|.Í ÒCíç¦)<]IMý.ASh¸Ó~ïów€iÕ¿€}ˆ¢kU!äRשß\® {dm±.ý`Ë]ñPº¤?šÏÌ"py„É¡³çs -Y ÛÎöšWl&GLü6a°\ ax¬z¦CëÎ'd†ßÚ-¦gëÎý¯wE}ï²Èªªfc·_m¶}¿gF¹7B6û²m}ueFÜ•ÝÎWÐY©‚ZK‘(« LXpéˆ÷\pÙ±ô¯\l,eJ Þ drôÖ¥Xö »rý›éð‡ëÍ•¸³æ¬ÖÍÆM‹û‰„/®w
.çõŽ{“ -ªL¿ 먿üK¨çŸ‰A2Ǥ<³Ñ\ x8sJéY!Ç¥šýÍT¬ûÿ‹œÐGendstream +xÚÅ[[sÛ6~÷¯Ð£<¡¸“È[š:Ýt¶I×ñ>5} %*æ®.®HÙqýžƒ EèLÙv: +"ëòðPZ²‹bµ:”u]Öþ¥îdeQ&ܽ´¿oªýî•£¹+]e½ßlöÕî‹WÅuí*Õfãj· Yíšò°+6›'÷<œ5âÈ.í…qó\‚£1¹–Ig1@´šÒù‡O®ìõŒLQüæWœf½÷;÷üãjñ² &‘ö¹ßÜ•5LˆÈÄÜù½ÜÛrU»Æµº‡î”áó±FqaÙwmÔû̓eWlKoê¸[Á";øí–V… Â*¨ÛP…èWfÜNp#r·Ä ©Ä02›ÎªdAO¶î½*«ËZ +Wüy,O®ºÞ{0î¥ÇÇÇKÃç$ÚbpûBHzìú'WÞV«XQ +-Çù8!bÚUMU4å˜+žõñPW^¯íÔ Q÷~kánÄJ]†ºU•^õ¸,Xv6±ítë}Á(z2’1¦gZ`ÇØ™hç@‹.Ê;6rZ´¨ÁÞwZ +]õ3ÎHÎrÞçðqg
§Í¶,v<ÖG\# ” 6\¶*… Ti2…•¼¹ÃЋ®¤VcPlªºq ûµkYí·Fl {š]·o²3b'bj'œåÙPè…ÕZ>/–¡bÅÍ‹cs·?TÈÖnAè +öìƒ J¯Ílàô„íGE 5p…jPpnC)Úèìú•7¿wåûß<½ÕbLæ+ÿfmËõüñ®Ü šÁiš ù‘Ëj$´Á’r)[TY®¼U»
ô»j§]Òénœ»œ«0g0‚òù
Úÿ-¼òêã=DŠm¹kŠklV»”È ˜öby}\.Á
J[††9ÇêöˆB²{_¹õ¨Âõñ6h q±t#6 ª/¡
÷a=`ƒWTPø!«úÕØ*ÚEòýÔdW6>nbÀFíPåe
Ž¯]Y¸¢¯HêÓ6Ç ‚YE£»:„çÓ6" ›¶E
GfˆQ q`YàÄhãæTÖ¹/—f¨gì°3§Ý¶Éf(%*ã"NgÚ6ªæ$ç”E© u·ÇÆÙwô4ŸÈƒìÞslõINǧÃÿ”Ë&xrûäÔÈ´€ô•Ë¾ Û<ê”
§ãæ¾8Ô~VÛiìä‚pf@¡çýlï›'Wu{mDÅ&¿} ɹïZ½ Ìôó3 ågäøBoq_~uM˜{aËõµ{vG¶Ñ¿Õ_^îwÚh†æ3¼“‹KFm..²l<G¸<”q.Ž…ï-œ•¾â³Ü'âXó GtÏb=XC»ÕX¦èÞá#² p"?§œpÔ7)Z ©ÿŸÉ9Ó’Hgž›fó™úém ½ çÚ žD®»¹6ÏXœkcc›kãCoàÙåÚX³ÇUkÃçÚØÎ D»\ÛÂï|w?Æg,Äx̯ÌÝ°m¢ÍA™¨ó`dD_!±å&$ÚÜäîdÊB¢U·ùM–N´ñ]¿kêO°Ì&ÚXÚD1.ѦæéòiÓk‹í'Ôg3îpbÛ ^®3R$6!t†´ZH~~ç!ÐeGÂgGð⪓ù¡Ýq&í]içj6}¡>šò¦ŠÚ(‚!Ùßî[‰aë@¬Ý£µoî±9{!Îh ’‚.êü… EYMU_ŦZUÍÓÂîxŠn2#R²,M£EðèÝ +'Žï Oe9_«²^ ªûÓy¸_„N“Êeûiãœ7 +rWÞ¿Uí† %Hžµ®'®óðeæ*× ×[ü„ë±]çûòä%~σëSCN’+¢Ä„h‚Gd iœ DúŒj=!¾*!¾€ +Ëÿá p±Û¯F®£"'Td<M¡Epè O +BY®ú$þžòòŽò"W†Ÿ añE«ÕÕ E€ëy›R]ÀOø ÛýÕQM2ÈdÓ+Т&˜ÄÖÒ€Òù„îN „ì<h¸TXÍñ0"=Yö)-(fÑ ¤kFÝ£ñòºë;3ä@ÉÔyíe’äF‹®»)éxÚñÈê7Oj¢TÆ’óß‚Ò4"[iÕQ Íš]•Ð]@
תyº/ãhGI.%O3hQ#z »>çp©èqxyÕO†>€,ì8%:‡ëC׋”â~ÂíØîó57t"$5éhQSL"kIÙq»W +b»Ï£ù0‘^Š endobj -1937 0 obj << +1969 0 obj << /Type /Page -/Contents 1938 0 R -/Resources 1936 0 R +/Contents 1970 0 R +/Resources 1968 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1893 0 R -/Annots [ 1940 0 R 1941 0 R 1942 0 R 1943 0 R 1944 0 R 1945 0 R 1946 0 R 1947 0 R 1948 0 R 1949 0 R 1950 0 R 1951 0 R 1952 0 R 1953 0 R 1954 0 R 1955 0 R ] +/Parent 1984 0 R +/Annots [ 1972 0 R 1973 0 R 1974 0 R 1975 0 R 1976 0 R 1977 0 R 1978 0 R 1979 0 R 1980 0 R 1981 0 R 1982 0 R 1983 0 R ] >> endobj -1940 0 obj << +1972 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [352.879 646.8005 426.5323 658.8601] +/Rect [352.879 390.8395 426.5323 402.8991] /Subtype /Link /A << /S /GoTo /D (tuning) >> >> endobj -1941 0 obj << +1973 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [334.0699 616.1977 407.7232 628.2573] +/Rect [334.0699 360.9009 407.7232 372.9605] /Subtype /Link /A << /S /GoTo /D (tuning) >> >> endobj -1942 0 obj << +1974 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [373.9 585.595 447.5533 597.6546] +/Rect [373.9 330.9624 447.5533 343.022] /Subtype /Link /A << /S /GoTo /D (tuning) >> >> endobj -1943 0 obj << +1975 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [319.6839 554.9922 393.3372 567.0519] +/Rect [319.6839 301.0238 393.3372 313.0834] /Subtype /Link /A << /S /GoTo /D (tuning) >> >> endobj -1944 0 obj << +1976 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [307.1508 524.3895 375.8228 536.4491] +/Rect [307.1508 271.0852 375.8228 283.1449] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1945 0 obj << +1977 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [334.8268 493.7868 403.4988 505.8464] +/Rect [334.8268 241.1467 403.4988 253.2063] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1946 0 obj << +1978 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [337.0185 463.184 405.6905 475.2437] +/Rect [337.0185 211.2081 405.6905 223.2677] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1947 0 obj << +1979 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [364.6945 432.5813 433.3665 444.6409] +/Rect [364.6945 181.2695 433.3665 193.3292] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1948 0 obj << +1980 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [374.6372 401.9785 443.3092 414.0382] +/Rect [374.6372 151.331 443.3092 163.3906] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1949 0 obj << +1981 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [292.0276 371.3758 360.6996 383.4354] +/Rect [292.0276 121.3924 360.6996 133.4521] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1950 0 obj << +1982 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [319.7036 340.7731 388.3756 352.8327] +/Rect [319.7036 91.4538 388.3756 103.5135] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1951 0 obj << +1983 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [460.1655 310.1703 533.2211 322.23] +/Rect [460.1655 61.5153 533.2211 73.5749] /Subtype /Link /A << /S /GoTo /D (tuning) >> >> endobj -1952 0 obj << +1971 0 obj << +/D [1969 0 R /XYZ 56.6929 794.5015 null] +>> endobj +1968 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F21 950 0 R /F41 1233 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1987 0 obj << +/Length 3618 +/Filter /FlateDecode +>> +stream +xÚ]sã¶ñÝ¿Bo‘gN,¾ ¦O—‹ïêLã¤>gÚi’Z¢-ö$Ò);ίï.€ø%É3Éx<K`¿±» Ÿ1øã3«&35K3•hÆõl¹½`³G˜ûtÁ=Î" -ºXßÜ]üí£LgY’afwµl¬峻ÕÏóÿxÿãÝÕíåBh67ÉåB6ÿæúæ[‚dôóᇛן~º}™ªùÝõ7¾½úxu{uóáêrÁæð¾ð+ yáãõ?¯hôéöý÷ß¿¿½üõ«»ÈK—_Î$2òÛÅÏ¿²Ù +Øþî‚%2³zö,áY&fÛ ¥e¢•”²¹ø|ñ¯¸`gÖ½:%?¥m¢…2³…I&¬˜–2K˜©-RÅJ¥,ø””J¹üýawÉí|ñ°«·‹Uù€Å®¨–E3”‡”`鬻шœˆ5AèЊI}z>ÅåB=o×n æ«¢Yîʧ¶¬+š© ®sœÁ"™B"ÞÄÖ€–,KW2¼]
9
%R1Ýãœ&w3ÜvdñÏÈ`¼. ay`M—›„IR€FÈÓʈXg¯†„€Ïæ¿0Ínê6j&oI5¨£±*RÍÜÀžœ'™Öâ*Q¶«’4±©ðÙæM[ì&'A~Ú´¼ZM¬Ä3ÀIƒr›Mþ\L$™Zã±–ëºDº\HÈ á=Tuë¡Ïy¹Éï7 ž{°3\ üQW~´)ž‹MR )1¸®4à§ý»‹uÜ¿#òñ¥xYïÀ êÝëÈŸ•†¨ÂÔéí#ÖÄþ=Ö,É·}œC÷äÒshL:4¨Ÿ P#›fc°·‘ <ž ÷_!eÁNº,œò߀†çñº=ÿ¥£ ýwDå‰Éà<)úˆuŽŒÑjä½Ç¬Íd‰¶YzÆÚ:X'¬-`9ÿÛ·õbU5M± ÙxjÊR{zóˆ5±{ÏÖ”LŒÍxûÿ‚ÇËJY˺ú…1ñ¸'×]ô¡ÞÑ`õZåÛrIßÞ|Ɔ(óJ|ÓÔ4Ú7
Úué—®ÃY„Ð:¼°©_høœï^Ëê‘VÜ\ò9:Cdé W™¤Jò yÞ6o‘*´ êóÕƒùÓ`›Wùc±-ªB³äl~·.ºÁ©©Ú5=ùǧºiÊ®š¢mÌæë ßcxˆƒd#¥å’˜ýû„Z›€>´÷§b·-Û†ÞÜÈ‹ ÷ýîŸVyë„KW+µöÓEqô°ßl^i–øZ4åcÞ|YHzGOñuÐߎd ˆë JM³Q>¨e½ÝÆ“¤ ”àUÓ„]µòºBB]ë+xrV7uö(8ë0cb¿ ªÜ*ðl£«FöQV-üOiS$Ãø!ÉYnö+Ç<¼HÌ ° ûú¹x‡ãt~¿oi–üÁ‚‘æNîÕÿöMÛ_‡;n¿òÀhÊ‚‘!8…DzzqaSˆy³\«ý&’/—µÓúÊùb´uoKá–þÊÃÊmÄÛm&–Óæ2MQŒâ1dÚFA ×pð€œÅ¹"à/º/LDæѺÈ$©l?Rd§’%!Æk{43¼€u†%ÓD¤)ïSâí¼·-¤oR þVQDüsŒÖíˆÂ…£mqTÒ³4Uú´,"ÖRÆ«!)¸oB¶©à\·Â¢Å³´TœˆF+nÓ~„€7ŽEmåù¹•YXw™C\k&¶— ʉèâ¸Öj*Յ㇉°˜ó# qSç+Q°Æ¥ìõ–žÚÀ?G)÷N–Ò%fnÒÅð.Ï3ô`àKÂîç—3!S†ÑKÙ®iñi$ÆøÂÃMÆc Ùz.¦‚&7L^¨6Œc5¢F@™äæmIyöX©ß ¥²žFLÔˆé!j„ —s«A ¥ÓO{=á`¨'„ÑY«¡vðŽ;K€{¨Ï +;•B"ÉÎt ;HÇ˺€äœì,ß,(Q_@:µ®WãÖ @Ñ«“$D¤1
ýÆ`Šã´G„¯íxÆ&j;„: ÁA¬íðÁÕv8pµ \E‡ªèp*:é”Ð<>ñïW‹B˜-R° nÒaý ±£o üz¢iDR÷=§ýö¾Ø÷¼òù‡÷=OòyrÐÁnÿ} E( ±SûÄÙt¬ +†™é^+7`±×:i n)(1v®X,GdÆ1n`è’1—O=SŽ / &Šà^¬ +
Ç8 ¿"ôõaðÓÍõp¤ð@\®ñàT +ø¤óª‡Çq +®}tQý›œD@²èùuòº†Ã!E'vH«c‡.CÒz¿¡ÌÒÎBÝï·O4EIª
Iªã'µ ¡¸iÌ™˜Ó#Æ +»ú´à#Ö9:F«LÀE +XœéÓ¦ÖÅ:njëpŠiï¦X@Ú¸¥£ªgqZ€æ$k‚ +1èÎÜ#㯹Í;ÂÌð6',Õ' OCuÉ »';¶„~†ïѪG
O§P=k}Në !ãÕN[ œÄ63òŒåu°NX^Àê5h—û]±€Šµ¬h<¤D0žHÄO“±&hé²/È™
hùkÞIŽF ¼ê¨*)–1ÛcúT³<àŸa¼î› Ê0'ƒ²ù¤ "Ö9BF« ½¢R b¥DÞ$~ÚÊCT$SØ’+Îä¡:G~ò%5Ž¬7岜L÷ µ:áÂPmå?SÆ}?Íþé©Þ¹+(yàKMà|Q¦Ê±;L +$оÜät{ÏÒùK½ûÒÐr^4ØקYwïƒÜã¸ä›™ù1™¨Ÿñi´ry4ü¢E&4¼né×™•G{T4 ÆEWÒ2ª‰æ½oïn˦‰þNµø¡åîû«×©ÞO¿ß‘ÜMÆtéP‚úG´‚wé¼ÝH˜±Cµð,#}¢›@`ØÖ¡œÂjö.@ŠeE ¾ ¤¥ÊgC€ÚÝ÷ãË/®Ý†°èznýî’n3ìÖ,D&çïéEßæsÍ ÷»»„"nS 4DÿÑ +òq–eo>Õ¸9B½ókØç¾8ö½ºÔx±5•Â¿ôŸþ–ýð¡¿Jií±a˜J¤Ìx +âLŽ¿õ°‰¶P"Œiÿ? +endobj +1986 0 obj << +/Type /Page +/Contents 1987 0 R +/Resources 1985 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 1984 0 R +/Annots [ 1989 0 R 1990 0 R 1991 0 R 1992 0 R 1993 0 R 1994 0 R 1995 0 R ] +>> endobj +1989 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [368.9978 279.5676 438.8121 291.6272] +/Rect [397.3443 737.7676 467.1586 749.8272] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1953 0 obj << +1990 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [293.1435 237.0097 354.3435 249.0693] +/Rect [321.49 695.7982 382.69 707.8579] /Subtype /Link /A << /S /GoTo /D (options) >> >> endobj -1954 0 obj << +1991 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [329.3035 133.2463 407.7186 145.3059] +/Rect [357.6499 593.8005 436.0651 605.8602] /Subtype /Link /A << /S /GoTo /D (man.dnssec-keygen) >> >> endobj -1955 0 obj << +1992 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [427.0093 133.2463 505.4243 145.3059] +/Rect [455.3558 593.8005 533.7708 605.8602] /Subtype /Link /A << /S /GoTo /D (man.dnssec-settime) >> >> endobj -1939 0 obj << -/D [1937 0 R /XYZ 56.6929 794.5015 null] ->> endobj -1936 0 obj << -/Font << /F37 1026 0 R /F41 1218 0 R /F22 961 0 R /F21 938 0 R /F48 1238 0 R /F55 1321 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -1958 0 obj << -/Length 3401 -/Filter /FlateDecode ->> -stream -xÚ]sã6î=¿Âo§ÌÄ -©Oªû”n³Ûí]³½$››¶ŠÅÄš•%×’“uïî¿ @€”dËNnz“ɈA -„,竼íôfs…~¢”:½»ÃšØ~()دŸ¤BŽ÷¿Ó¬ð®×|»Ø”ÖvHy -O}Dëm_Š}%Kð Ñ;ð¾ !Z -!\ž6µÖ S³XæÌñü*DPé9¸ê*ï,.[ -Buš ‡5ÁÅÈâ°8A`ÄÆŸ³8ë©G„Ù¿9¤/Òø„ác* Gâž2<FEîªG
/Þg( -2?Ž_; -#‡ÔN[^ -†º.5Ãz;hiò‘° -ðæt 'cîýݧì!z -–«%„’÷À>™Tú¶GG&E‹*ýœ£:&¯<gÜJðñ :~au9/4]QS9¤Ì*ryÖô¨ÒÀsM(¼ÖJs}(CÇx¶/e·XR÷âÏp'óÊÕj:× HØ£P cì)~”ˆp¬ÁªYäÕT³è‰$‹]Cü(óî £ÔD 1MÕ ø3š•j 2¼PÏUuÃã ;¦
“Mà4öƒÈUw§ºÀI’ŽºÀÊ{Ò`…Üv›ò#Ø‘0à˜»¿Š£ ÖU¾°|w“üS“ã‚ÓÞ0ð#%åØ;‰Z,9Á“D— Œhó8pX}(í#9›‡24wæ·;sCö‚)XlbŽÆ¶3 $…j@Ö@.ŸóÍåf[_ _²r|dm¢rŽc?’iÀk/zN.¢‹Å±]CiÕP¶ äW°UcvóÊw|#¸Q (—²'’WOÍÜaE¯–Ò÷?^½Ÿß}Ä ¦lAB_ ˜†)`øœW[Í+Ü]‡äáÿ¡ÒSé»àÑš-Ì ÔØ Ë:œ×|"õc,¬"IF~¦äI£Ç‰Îšðcðš7ÔÑ!MPët+¾wAJÚ#… &S¶NT AÌÌÓ˜+%›Q×CÒ˜b<ùnˆ)"Ñ°ÝA¦±2¢ÍW - ¢—ÿ¥Ý_RPä6ã—²ªhôÀDM©3ÜÛƙȉ£Ë¼~â
¨’t ºrs$©t^p¤Ê4NuÕ¶Û•û.ä08ÌjÕ–ž‡!À¥äÅ)`° -¼™lÉ”ÑßLDºq -0¾ ç Šÿ¢‡)ÖhØóBï&Ý>Ð hê þónº£B(£`üåìø]I¬²Á´n‡M€y5±C B‰®bç¿uÑ ¶•X;n2á–MÛ]Ø BÑ×5;´•ý(xx’ýÕÉÇ:èÿHˆ.I,â‘Ò?sÙfø²)–L¦Uv\îš/<*¿èÞ -ŽœìPÕx- å¿é Ÿ6‚8êË<|C«ìvkMo¿ô@ý6‚#bk'^µkê$É@ú$é»Xgq1åº ¶¨Êç²ÒOTQÅÊû\/xiN¾º†¥Ëœ×µÛÅ& R£Ú
ðr›Oök™SýÙ³EFÖÚU?IʹÃ~¬+W$`ˆ5¨ŒD¡„Õ–JÉŸ ÉÈðyÃߤ·6 -¥úÎ áö9zfk úªž˜DeÃT:s Ñ{)Ø•çl9³uÉDD£•&ìÚ.G¤†m -ÇYþ…ÂåÈž†m¨ŸBèºÅzÞêjê×u„t½êIZ”b±EIº&:J,õ¬, sÙ¼èg‚“qäJâºÈmG¶— {ÈŒ²‚lÄ„Nœ½¤W˜¨º¯¶nHý0”Éøì ån4 ܶíGx²]uâ\î§,;¦˜ -ëœ -ÜààŠ¿\Ð:¾Ó#þñJoæ£M ÷¦¸pì?êì KÈ0¹‚Ì ^È¥fBŸ 2wwâxpwbØÐbzYf.ç„í¯×ÿ¤‘þjÓ(|3A·xÀ Ï,’bŸx¢4 Û.óÞ/Q͈ÝÅTÜ" à›ùv‰~zD6’åå-/ -endobj -1957 0 obj << -/Type /Page -/Contents 1958 0 R -/Resources 1956 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 1893 0 R -/Annots [ 1960 0 R 1961 0 R 1962 0 R ] ->> endobj -1960 0 obj << +1993 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [317.0267 683.8431 385.6987 695.9027] +/Rect [317.0267 306.119 385.6987 318.1786] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1961 0 obj << +1994 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [356.8967 653.8289 430.5501 665.8885] +/Rect [356.8967 276.1048 430.5501 288.1644] /Subtype /Link /A << /S /GoTo /D (tuning) >> >> endobj -1962 0 obj << +1995 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [432.0945 623.8147 500.7665 635.8744] +/Rect [432.0945 246.0906 500.7665 258.1503] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1959 0 obj << -/D [1957 0 R /XYZ 85.0394 794.5015 null] +1988 0 obj << +/D [1986 0 R /XYZ 85.0394 794.5015 null] >> endobj 614 0 obj << -/D [1957 0 R /XYZ 85.0394 609.3296 null] +/D [1986 0 R /XYZ 85.0394 231.6054 null] >> endobj -1327 0 obj << -/D [1957 0 R /XYZ 85.0394 584.3621 null] +1342 0 obj << +/D [1986 0 R /XYZ 85.0394 206.638 null] >> endobj -1956 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R /F53 1313 0 R >> +1985 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F48 1253 0 R /F55 1336 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1965 0 obj << -/Length 2924 +1998 0 obj << +/Length 3395 /Filter /FlateDecode >> stream -xÚÍZ[s·~ׯàdú@uDw`û'‘S§‰Ó*êä!ÍÊ\Y[“\F\Zv}ÏÁeKbEÚ’ÛŒGÆeàà;WM(üc¥‰.x11…$Š25™¯Îèä
|û1³8h–ŽúúúìË—ÂL -Rh®'×· -K¨µlr½øuª 'ç@N¿ùéõËWßýóêŹ‘ÓëW?½>ŸqE§/_ýpékß]½øñÇWç3f›~ó׿¾¼òŸt ñõ«×ßúžÂ#D¯._^^]¾þæòü·ëïÏ.¯»³¤çeTàA~?ûõ7:YÀ±¿?£DVM A + ->YI%ˆ’BÄžåÙÏgÿè&_ÝÔ,ÿ%\hža ç9ª‚hÁ…c`{WG -5ý[uSÝŸ3;m¶¾gs_¯çõ¦\úfsëËnÆ|YWëöXBõt»›ßùîr‹\ùò¥´ÉÚÌXœ°c\õ‹Ý¶ºÿê®Ù¶dѬÊzý…Ÿ3Ø/£†¨B«0îˆ|úË]µî7âf)‘Ì’qürsêì°n?d¨Ã8£e ø/Jyµ\xÂÛM5¯];Êd&€¯ÒJ3™1F -¥¸›S†¬ž>ÔËżtœ[`™®ËU…lRuëÕ[_nw7ÿ®æ ×6¾óÛ×?çIéiõ~S®·u³vô`~˜â.+÷çvº[Vž Ì_úîr³Y~CÔÕnÙÖ›84p¦®¶Ä‘Ïvå-+Ó¦8Î\pe쀹(;«Ý¶õµy³náê}£ôÅín¹ü0û}W.ý„I $¾ŽÜõ{ži¸k23c†‚·ÚËæþ|&´vÛ›*â‘%4°A®uØàÛû5ÛVËÛÜQr‘¡¥‰ìI¶c„$#V -v*!¿§ÝM8ú!=+ˆ¶ õ‘ „o½Èæš’²d‹Ð5ŠÓ]r^È€ßRƒ€ ƒFïÁ] H)1ÊØ!ðRÙs×í‘•_ÎÈÓzÑ<„/xÏX5ö¸FU.Waàí ©U9¿«×¡qS-›õ›¸ZÓ‹C‚©q°D™Žn#º† }¨kèô®Üú -¾|W.wÕö/™[´’p.T²\f).H–g eh":>„ãÈ -Êk‘;¿!–Ssò¦òä&?† - ï“$ñ€ îé{šž™IÃAC€4
$æ)G’Âvjú£5ÎzÇô #æô͵óÍè1O¸„„’nùé—0 õŸf]1oãòÊY!lÜ~õ¾î×àsSwîОïÉ(Xgøo¢5'”Û“¼O!-1ÔìyŸŸ6+ntgÔB£;ðó(Ð -Õ8cHjÖ j¦……ší\ÛSà ™‰† Ôª°iH0ýÅ—ïËy;[•-º¯ÂöU Öl~ÑL[ -ª }7üÒ¹ZØp3ªðåÁù¤bgb°+.¾ïXÝTõú‡Ãn³(ÛèáÔÁ -* ˜B æ9 -Q8?ÀuVëòfé×èø°a»- -®ôù,K_À!׋˜+8äŸ1D›NròOØeqÈ?\Éé(“´ Ú÷¤ -|>"x€si»¤ö¸à1q(w°ß:ì¿~³n|mqT<@Ë"å‚ovN6Á¦÷«€XÆP?zqÐîiÀ•#j[‚6UV–UDÎï3F+Ù3f¶úh—Ô ÁØ5ð:8ÛK°t‰= 6:cÕ` {À Ýî–C}NürÙ<ý€c:Uáè{[}ð=›ê>‡© F¬ôªÏF ”›dËþŽÂ˜»Pñda´K->…›°"¡Ê(©µ=mÁ5l|õ&tí6Ðç$˜/¨ Ë“2N¨¥ö¤wTÓ!¡è1å„uš}‚Ø}KÞ›Òû.À!¤/"<¡ ½?g¯\„*‰¾ õbé!¥h_&¶mu_oßB þÁŸ2/·Õ#z9ÑxÏå&|† YX¬(Ž„<’r¢)ãGr¬ÙY<ºb;»;ì™ûT¤€`áH‚<ºþ½0†H¼ ‘z¸„¥›ÛÌjŒYdÿǪ /1ó8ËmŸŸq¤¤Wð¼éù¬HÑàðK— EŠ0Ö¿ù I¢ç "hê•ÑàIAÙAy¨@(§”< -•ÎºGÓAkÍŸPÝ¢ hÜ— h ˆ”¤0Jì=hcµ‹>:Èœ”äž ( Q £¥âŒq PA„âP”$Ôõ‘çŒ Nlš—µ®¯|[…þÒƒwC Ò½þá×äGØDÅ¿*gY'ýé««Ë?üèm(ÜbâMSÑSņK£øªïǺ¸ ûº -¸ÙµÞU÷ΗdÒåtëè“äm?'n‹ùèîvƒ`¹±êÇd“‹{Ë ¿i˜³ì3!l<!"Æ{|":Ê ßp åÀ^#—fÄ ÜcÄÇþÆà‰I ø4xV‰áRZäq‰á`)•æ¤w¶?šØ`æˉàÉS<ö:h@1Õ+syë(Üg:C.› ?®‹DV°åƒk¨ô¿Ð…p2 - -ÖõŸ9 Öíá¢è‡HÍ
§ÂªÖ1AßÛ^r°Ó;•vÏÓUNr2ëS1ª?ñ§:ãb”âóyŨxN1bà@[tÍ #¡ç¶8ú8ŸÍ4ÈÔGq E®^†rïwuØÕεzQÊ\. -þLîË0'•#Ë…—#¬ôÒ‰ñ»7?X
Ã!1¶·„—0Ø_"aÐòvçÖ@z忤¦ÇFÓcSÓãŽån“µ5QÆL^zt°;8 JOÈbyÓÍÒ£ƒôè¡ÝÉœºá² L“FÏ'=),ÿÀF=Y*Õ‘ 3P*qÚoGþÄþWÔ ‡Aî'Ÿœ{”ò¬ã†ŸcăãÆÓ]¤$‚1Ê,=ˆL¸ ™G'%ipã`@gbƒÇ}VÛQœrÏw!ß±gšèq‚@ÐB>¿8%8}ö%¥ÄpoZ·¹_ZÃ_`ý“×Ýÿè]"¬åùŸls1˜¬1Q´+ŒòƒŸÇ_€‡aÉÞÿ £‰endstream +xÚµZÝsÛ6÷_á¹—“g,†ø$x}97uÒ´×ä.ñMç¦í-Ñ6/©ˆTœÜÇÿ~»ØJ”í6½É8ÁÅb±Xüö§)ü§Æ&6—ùi–ëĤœ.V'éé-|{y"˜f ˆæ1Õ×W'Ï^¨ì4Or+íéÕMÄË%©sâôjùÓÌ&29éìù›×/^½üûÛ‹³LÏ®^½y}6—&½xõ—Kj½|{ñÃoÏæÂ1{þíÅ_¯.ßÒ'Ë<¾~õúêÉéq„éÛË—o/_?¿<ûå껓˫a-ñzEªp! N~ú%=]²¿;I•;sz/i"ò\ž®N´Q‰ÑJ…žúäÝÉ߆ÑW?tR"M¤²rBRN)Ðä‰URy®7gÂÍÊ®lzP‚ʲÙÕ]‰Ë‚Á" ì™ +ÃÚ®—E_Î×m]->3u<•5I–g9Sw=¯`Ð^&gmSÆ–š•ŸŠUÕ” õ÷0±ïîªÛ¦Ü0ñ
õôº*»®¸-¿‚7§£íÖ¯cQY±\òº:"¨xŽ¦íQÜÓ¹*ÉQßs!’Üé%¥Auù±@u a +Y’+é<(‡hP€”س +s¾,NSÙ”Ë Eæyâ´OW¤Ë¤fêÍ™›mkžûþ®ZÜQsQ4Ô¸æoÝ}Õ/î`~ÿÖòWèä¤8 Ù®VE3%§”:É´rÇ=«<M´+gÒ‰¬ÛEQ5±à—ÚÜ0?06™ç³w^Ъ¹…WP—Tä Ÿ×,ôì– /UCÏ‚ ÿjþ°(¶ ˜Ñá*Df©u°Ä¦X
›Ë¦T"¬Í˜ªo‰ëm f« MzõîÕKjÁŒ]$~_~f²fIu],‚Üý¤üh$uyNÚ”J&Ú 16Hâxåe‚gQ×í=wÝ=µhr#*Ú@Æ
Tžq¡`f“~ý™º—åM±ûsæ¨I8jW¬Z=2,O”Á@ž},6Ï6Ûæ™×ñ3VN‚¢ ê[“h‘I {¾“ÔëB+°=5Ö„_£©ßCly±|ÏÏ`«ÞìæËeÓáõ{åaÃ/ +G LŠú¶ÝÀqXÑkàôíÏçﾽƂLJÚÙõ¶ xt%5?õ¶äE€d¿hTÛívS\×å€ Ñéà#hÒ°Ø={Uy’š€²¬Ã9HÍ»1 ¾Õƒ"Yê$wb‚¥×ã!C—&N
ÓOcƒ€7™>ä j’1OvG°]÷@Ü“¥×墯>–5¬Óˆ„H⬶c +H×/Öó®¬o¦ Q$JŠLó’™@bûV e–%³K¢¼kïË´ŽÇQ^H‹›eÁN2ZPvL²‚xÄc'~}FN2QwŸBê%J ;Þ<F‘Ó +"ôç4ŽÝ:Š1>.£Inö>qòÍ ˆù©‡ôc1ÆW¼-©…NÅ¢èÌ÷ø-E"öžØŽ¼'€Ë Oð[Á1Û÷—ÿ Vù)DRøæa§¸Æ0Ïé¾ð\pø¦d¶Ý]±;(hÉ„ýùÑS®tlø†ÊÃçðyÄVÇlyxÇ@æa %kÐ*º=vÌFŠ×ò5E žÕ¨`ì‚ òXcЯ·(ËŠ— )Ò(w»v”ËYSÞ¶} žÆ²¿k—Ô&©°u͹÷Ëwïæh_œH‡ò 4Á ¬:ÆM9+˜a|èéRzuà4Ån«Dnfß—›kªDµ õ€§oÕ |E}âsA +—z÷~GÝEHí]Œs.Klž†Ôþ°ØÍŸ1ÜK–íª¨š?L¥ô)d¢¹ Õw$›|äQ5¤†*$§ƒ:¹]fu °ÇXÃu)h§³½J +:p»4Žü"ªXù:
Q4€jºþ'd¦Dçc_èüæõ»iV¬l]4ˆ¸ž Œç! >ı›ËBÝ€òÙa–Õ¶î«u eÍTÆMX÷Õ¤n!Šv(Â> \“&JˆåŽ¸“¾¾¼ ‡ç ¶E=òød$»LÃz,d¾â¹ùÄ +‚ÆžL•š2På¹÷›ksÔïª$Û%Bç¼l1 e‚UwŒ‘‰ÓJ<•É´½æ¥O”U ár6*x©Üìª+ãšMrŠHÄøf&QÙ°ÉÓ‡ ôvO0„™Ý3.ÉfMæƆ7öóq<ñã™óÔ,Û{þÒrî6F®]šYÔœ-z§ ³ZX!æ—ë²n›Û! —˜lPë
OcPökRrÌØŠžT +œÊ+N¤ âÎ#Å6¼„À{¢ãV†:ƒ>ddùOfÅà5U ×Yâdš=Y¨éDKÓ¿† –G~ËI<`„‹ûò…=Ž3i{®3 ‘íEå_‚8£Jî¯FœGø=†3"Éž.ÜiÖS6!âô`’õ“X… +Ü㪠jZà¬!ÕrAüòS_nš¢>ºN;„C{7Å"ï ÿJgSó”»b¥]’¥ÙÞ]ñoÁ:£ÐQ h\ +¼¸FŒY͇EÍ¥‰Q© n¢GJÄœ\ƒe–%i& BHpý¹TÁŠ/?‹~Îù«Â‹ßrU`&€å-ë þ÷i!~B-|ªøBe •ñý1v…É÷«ër¨\Rj· —É—ÒíBT íwÛ¦/›P==Û¡’0±Ü¹éc ÂŽÁ‰Åizl\Ú€Ç9(8Ú†/ÛZ4"•:÷ÿ±ù>b-oi…}ÔŽmæŠ/ endobj -1964 0 obj << +1997 0 obj << /Type /Page -/Contents 1965 0 R -/Resources 1963 0 R +/Contents 1998 0 R +/Resources 1996 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1969 0 R +/Parent 1984 0 R >> endobj -1966 0 obj << -/D [1964 0 R /XYZ 56.6929 794.5015 null] +1999 0 obj << +/D [1997 0 R /XYZ 56.6929 794.5015 null] >> endobj -1967 0 obj << -/D [1964 0 R /XYZ 56.6929 674.382 null] +2000 0 obj << +/D [1997 0 R /XYZ 56.6929 297.7942 null] >> endobj -1968 0 obj << -/D [1964 0 R /XYZ 56.6929 662.4268 null] +2001 0 obj << +/D [1997 0 R /XYZ 56.6929 285.8391 null] >> endobj -1963 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F48 1238 0 R /F53 1313 0 R /F41 1218 0 R /F21 938 0 R >> +1996 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F21 950 0 R /F41 1233 0 R /F53 1328 0 R /F48 1253 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1972 0 obj << -/Length 2380 +2004 0 obj << +/Length 2363 /Filter /FlateDecode >> stream -xÚÍYYsÛF~ׯÀ#XeŽçÄ‘}bdÊË$¦µSµ©$1”P&š -Æ"2,æ‘|y_ڃþž*e’ódß±P1Ó&¯D2aqjTç-z^Z±D)Ä&e‘’ʹ¥YíƵݬÑ>o/¤ìMˆ9K¥Bpàd³©îÁüi vyÖØIØÜf
±o³;KÔµµ%õÖ¶ô½wEFÄòü’ˆ¬ÌiкÚçþ¶XÝÙÜZ 6 ÁRc¤“¢n`V¶ ‰$„ÉR©p›ívEyCµë©¶ÔÂ5€aQM‘5Ý°Ù%}³<wl]£(›êd.Œ‡™¼{·`“Åå(•á„"ÍéƒÄì2êwé4,³wÙ -†#¶YƒŠ"Ic<«:Ý‘èÚ÷’õsö4¢¥Ð,6QÄ‚3-¢äkbZJÍtq2Ó A ±Hóo‰ÓvÆ“0íÄGJ±8ª
SˆºÎ´ë@J_AGiÌD§ý¼ &1¢93Jj GãH„Kø/Ãé3ãÀ¢BÁZ¤)7Òågð9Œë4U4ªG;ufpŒ·³ ÞU TÐ׫]yÜ_Úéõ³Iš’Sè ‚Ôç†ÇNèYƒ0WãWc4T{Û«l³y¤®]U×ÅõHòpc‰ƒ1ŠßzWUë¡à„UjŒ–8¡lC¢† /ª² >‹ –h0®÷Mü -þ†È≠ñû¢QÆà!žÂŠpø$2}ìT:a -Ž(DQ?â5Y'¬Iš|#ŒxQDDM¥¿ ‘œ‡D ¬0›X;B¶?8—~PEc®-µ Hˆ¾~¤¾¬|$†‹$VUYÚU¡3JGÀSz1 -¡þ©8®±Œ…øŽ³ÔW¯ãF@îèøÿ€â½•ÿÄæa”O‚×qñ ÞwÌ? Ä“WqHWÆ~¿aÑnÊ‹ .eÖŒÄ@\'R؇ÆîËlóE '¨R2€H‡’)!Síg÷·‹
\ R?+Æ|` ¥™ŒL»…ƒ}Ø ·k»§å q oU`@Q âÐußßZ±'¦/FÇ‚§`E-Ÿ@ž‡P<:èsSÜañ¬TO1ó}…\+Ïì¶*ÙP,QVmÒp BU - :ÉVÖ†¥q7饕S&œ'ÞŠˆ¡Þâ@H'¶«>
ƒÜŒš¿Îgÿ {» -’y|’ÖmZ6ÙÍ>Ûú&¥ÖIY³® -ÊÇî¡nÀG‚0¬¿»ƒºÌ£bÑ~ëç¥wbX ÁU¡_,~gz,k¿¾öÆ91Ÿ<Qÿ½Y "‚Š‘` i–`½Ó{Ú~öÄxÄ™b} œ÷¯‡Ï# -Êæîî"åÏ"¨*‰XeµËÅǫ̈ÁàΣ„ìUÄC%FÄ4R~ù‡ØCí½êBjýxRË®i ÇŸÙælx,öŽMÜ‘êÖqjömÀxªüݲ\r Fú"bdqy<À‘o W…;—°Ý‹pÔ_`ð»À†¾îª€
÷”l}îtû°²»†Ø‹ÅÕìý¢çWž¸ú8éXÓs¿{ˆÙÈRl(]–£”‡~›Êó %Oéy §9Š Ô&ƒ
Ç\[môÒƒ=XoMæ¿QÙå -Üæ(B§)°½*‰ÿ™¡e©7CøãËl©ˆ8t¬)+¤ç4Ríï 9B5¾4ñ(œWïó0£¡ öKÐRI˜öl`Š. ÈÜfy;µ"Nn7¶]ŽÔS‰÷•‡ÛÚ÷ÖPtø¹-©0Þ!Oyƒ?yr1äAt·N¤¼«èü…-k±°EÝt%ß©€~ð {é7¸nh¥ÄÐd<h½òÝ?Ç «Ô1SI"‡aHqÍ”JE'•;¸z*¼Q >WÄCÒÿË÷ /endstream +xÚÕZMsã6½ûWè°i+Âààm{ÖIÆãU¼µ‡l”DX#‘ŠHã¿Ýh¢dʲ˚ªl¹ÊßÀ{¯ ĀßxøJôÀ%š.Ì`¶:ãƒ/÷ñLÄ2ã¦Ð¸[êÇÛ³w—Ê
–Xi·w¶<ãÞ‹Áíü·áûžßÜ^LFciøвÑØX>üñêúYz¼ÿ|}yõñß“ó‘ÓÃÛ«Ï×dž\\^L.®ß_ŒÆÂõelá@…Ë«_.(õqrþéÓùdôûíOg·í\ºó\áDþ8ûíw>˜Ã´:ãL%Þ à…3‘$r°:ÓF1£•j,˳_ÏþÕ6ØÉ
UûÖOsÁ„4j0ñÖ î—úàÐoLzŬ·ûÝŽ…rL›b½fJh×nŠMZ1¯”8“0«¤ +»ReË;\šw—Rv +;Ω°{,t»È+XøÄ
7#?¼_føb‡«´ž-²˜ó°È +JÕ‹˜_¤«ŒLÓ,/¾ñ~=OëlNö° Œú„Õa‰12t>+‹:+j(¤¤ –wôŒ…ß]Âbn‡m&…pqØù êåõcÏüŒ`\'*ü/ç2[ÎQJÂlûšÖ°Ê^75ÂÔž6+ *Ùm•Æ›Çñç_Šr3~˜Í³…©kæ±åYOïk¨`Í°Z”÷¡HO3|Òä)3¬0¦ÒŠžýë"4gÆ +œŒ[±DpýŠ&©†zF™-gškuD™3,ÑV´Lªî§/g ®°gXùac¬òU¾L7d´÷l(tª¼|žÀÒ2ØF@²?gÙº¦êEZSë0Úy¹Jó"v]Þõô&„Çõ^D_Ð"gY•” +„gô+Ï@¥³oÛ×}¨¨“BEáJëcH1À{e|»†9úePQ\n¡‚/±… +¾ôCâ9côQ¨$0×=¨„6T0UËÇØi4!§4c!5KœÙs’Ï`•‹Ø ™—e»§Â (¡sæ5Á^Sã NŒ³Ì í H'Éôª¿"ÞóNmqâ l_ú5‹ö” ÿš=/ **²Jg‹¼È(w½É‹Y¾N—ôŠÊ¿Jǽ1 VúÛ?&ç¿|"g` +w)ABm[E+º4†ÂdJ‹9ÙÚ{ ‘¨~Ë6!’‰!EÛ8#Ÿ.W”Ý 2 ùy0·CÁ—è·1I¨jÊ žä¶Œ6~}¬”o棔£ D9Š÷T&Ïé%°ž;ÞÀ… µ{#…½Á< )(!žÄƇèÒâÛÀ½Ï—ä¤| KZ sÁÆÂÀÓµ|iäéÿ4J +"’¼ƒT°lÀ³$W° p¥¡–¬éIú¿ÏŸ ²H›tÈ‚o,˜h‡¬%=¦`º#þ=ijž4þi§ÇƒZ(g…ÉЋqQíý–:h¤˜Òïº&P§§ÿg)‹ µ/Š¸_Å£@OË£“ú ø kŽñˆ{fœ¢˜ÿëfj^ãyà¸Ú QÂ[¤QH§ñùs¶™ÒAl²ZÄ…·-—z ŒÌZÀIó]¬Ó%’—Šˆ„‰-=ñü’_P2¢‹ —z +7Þ~|¥ƒ âp" kf¼LN OÙœTñŠb{DA!˜–aëR¿J‘•10ÆÏÉP›LkR6ônÆB%• ÞÛ›HO )/- Épƒ ;ŠlVtúDi+¸°”q wq`*²ú¡Ü|%s8‘ƒñ@Y¹‰r¼.‹yü˜åAN¿i*Îû#üFÄY {ü c t=+æ¾ëÛÇ›-*pý+™p„øüp}þ邲&“*««ÝšÓ^çTêrOÝiˆÀUÈ“%;¬ã’sf¹'ÔqyJ xÛkyrLÇ…‡øÉqR GòHeÝwÐñnÓÏè¸0Šéä»è¸x£Žw÷æ/®ãþ’«*NZÐq¿=¡ØgÿG'¼Eç›â²ýýlûÎLJ ½V\3ˆÆÄ@†máž +nöwÍÀ®ÁB¸¦Xgìÿm¯³ºendstream endobj -1971 0 obj << +2003 0 obj << /Type /Page -/Contents 1972 0 R -/Resources 1970 0 R +/Contents 2004 0 R +/Resources 2002 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1969 0 R +/Parent 1984 0 R >> endobj -1973 0 obj << -/D [1971 0 R /XYZ 85.0394 794.5015 null] +2005 0 obj << +/D [2003 0 R /XYZ 85.0394 794.5015 null] >> endobj -1970 0 obj << -/Font << /F37 1026 0 R /F41 1218 0 R /F22 961 0 R /F62 1361 0 R /F21 938 0 R /F53 1313 0 R >> -/XObject << /Im2 1350 0 R >> +2002 0 obj << +/Font << /F37 1038 0 R /F41 1233 0 R /F22 973 0 R /F53 1328 0 R /F62 1379 0 R >> +/XObject << /Im2 1368 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1976 0 obj << -/Length 3031 +2008 0 obj << +/Length 2887 /Filter /FlateDecode >> stream -xÚÍZYsÛ8~÷¯Ð#]qqñÚ7Çv&žÍ8YYS[»3ó@QÍŠÔŠ” ϯßn4@²ŽÌÆ©IRe‚|} »!>bðŸ¢8Œ3‘’L…ãѨXž±Ñ=ôýpÆ-ÏØ1}®·Ó³¿½“É( ³XÄ£é›+
YšòÑtþK‡2<‡XðŸ·×çc±àÝÍhq©"\¾¿ø4½žPGlYßÞÜ^%£ÇåÇÛw7?ü<¹8OT0½ùxKäÉõ»ëÉõíåõùoÓ Ï®§ý’ýmq&q½ÿ=ûå76šÃî~<c¡ÌÒhô/,äY&FË3É0RR:JuvwöÏ~B¯× Ý g¡±Øƒ“à#®B© Ó*ÊB‘&˜0@5µ¶@••ÆÑ<Ì¢ÈLÀFcÉÂ8ái1·ƒ§ç žWº¥š…EJ·Íf]h÷V4ë¹eÉë95þõ kju
=ní€éƒ^Ú…Oâ°¡ÂLqeÖ1}(aNeŒãAÑ•Mýi Tùúœ§Á½®ž‰cÖ¬
¥yÒs¤¤Á‚Þ—Ô?ywIdŸ²“Ìu[¬Ë™n©§{ÐÄ[4u¡W QqÇHÌé•6Ž3–Ûl ö»¿²ˆM&ð—Û€l7×C›ÓŸWU^Öøm.‚'ƒ•ä2Ðyñ@´ÒömZ=EVYÜ•µù,Piµ0`µ™Ue‘#8ÔcV OÚ24Ü–E -@>êu^½ÖO4Ådb?õ?ÚégÚ-¨œëº+eLèEöò.—«J/Y;‚ÿƒûÕí]Ø+€Ó’¤{©ÚÆ
.ªÍ wîv 'T”{>÷»_5O*Ûì–›eŽëÆv/
–ø´Ô—[–f®Q6© ®Ip–H‡|ÈÞêŽ&42í} R@-ëE³^æNßêGéf_æÏÔ˜Yn½\uÏçœó ܧhS£(ŠÛCÃ| ž{>®˜ÿqbËÛ¶)Ê܈ߟÊîÁöÐc•¯»²Ø Mšw‹´Œ -ÃœE³\5›À}¿Õ0æ¥7PBt×€$®xÏF¬•iü -Ë,„™U^hØÈR9sXg´xÖ%´å}m„Yäµ%%6LZÏwØ ç,XY¼ôúÑðÀ7fÏ–×j -z*è]·FlªG¸òh[?˜ÅzŸA!œèK9 ¼dA@°¤÷àé`V<À`bÁ“ m@ õýpärSu%Ø%Q
VÂb‚„•^/ËŽ,^¸8ìoV]¹,ÿ°Z`87kak?ÖsêÏ9Úý›}s~¿]é¢\<;owÖØé᫾×:_Ï,3ÁIí™5én]:ƒB\·]HÒ¸Óz÷ঠ–%ÐH¥9B©s}?¢ÆÄ;s{þ±?€Î\ßy¼œ÷{§ ˜ >DÈãËkJ£P%ñ`I/Çtj ií8 ®Ã 9þGKBо/ÅÁ±Ÿøü‹Y¢ ^,(IÃ,Uéqz®S y1®„üáX ŠŒCÀÉ-8·~—hœS
~'ÆÉýPÇyÈþL±'¾w‚ý}w‹œepH±l)&i’|IÜ(U&,Ù‰ÿ¿Qn!žY \c0—mºÃ©Æý¦Æ‘HÃTŠá 8MF‘¡â¹¶æ©vÖL.S¤Õô’p‡¯×'ô“Û¡&&6Ê/Üͦ¦pa gQ‚߇…xËý:l8xA)… ³£ùÀ‹)݈è2J„'P,T±ÌÈÍB|~>ŽU ˆ^º. AýÌ¢€ÇãYÙQÇc^m45#ãŸ]tC]ŽÇL<Æ*ü.’ÉؘX* ¨Á9¶k64À™ÎAy| ª[A©$LKþÄ”nÄAAázù )Û'(•Åaɘ\ÎôÈ)ʘUùà,—z ç$ÆUùh‰ëÄaD ê!Q(%B’W5'²#æô*…8JˆÇïÑ!_½O\tXoêÒx@IÑ)>[V=7G¾r‰ K˶Z—Ë|]b -†¯àakf)ƒð‡H&ÑÙôÀVqP i ÄÑššJ%,^@2bÃKÞðõ¡y ªÆ„@±‰Ni7oMÙÞèÒ|vî"E㻜Ò,íC³©æÃhd^¶En#Ó#JíkË×ià7õ> -󪌟ð> -O)Èû$ ÖR)ë~2ßý¤žûɶî'íÝO¶“]a_N q7]S4Qùõí ÏiÖ.{l»¼vžgçD÷§="1Š×rCÄ ^Ub ‹>,=!1HuS!È
M®¨î….°°+›%¦b_RÔyÞå`Š ‹¶œ”&RÛ$c)·U ;€Z&ý‚' %Ø -‰«ŠìuEm³ÔèíÁn4Œ -*}6aÒ·#ÂóPy-ámKuE Çã,”‰ DIÈ’aÍðEÜ, Ví`"ÁÔÉúáJ‡2†°9á|/šªjž(§ô*5¦–±Çvš—œÂÊûxd_ÅŽ-—3Jp åÜEtíá šàIÿÂúø[HžÂ$£Ìà°õJÈ ¤ÌúBUœ¨Ø¬„„ƒ¯í¨•ÏçÖxM!EdÁMM=d•Ð¸¹¥§±¨7Twé¨Ê -Tz*S@WE˜Ÿö|í7Q{ì÷ÊžÍ;u@SÄ@ ¶] “ײÝoþH.ÂTJ$$¿JØôçþ¿U\ -{tñ rCH¶yp14k6Ð~¢Te_7Þ…}ë‚!-?è…ÁÏ CÙ[þkyáo²€VË(K&Êæ{—דsHä§&q`Áû¦êo~]F|_vÎÁzÝÙ»–NŸ8ß -Â~øôñÒéìÝàbÔ÷Z÷U3s1îªiKÌøÜÏP6+ü¹â†þBÉÚᇗ‡áôúu{W BJÈO±ø ¸Æ|ßO+Øè$Ö_úcÖízÁÊ4=p{ÑfƒcLêq. -0_ü0¤ÿÙ«eóÖþ?ÖÖRpendstream +xÚÅZKsä6¾ûWôQ®šføÒ+{š8vâlÊ“mwj7¯ƒ,ÑnUôèHj{¼¿~‚TK¶lÏd[S5AüÀ¶Xqø'VaÄ¢T¦«8Õ,ä"\åõ _ÝAßw'Âɬ½Ðz*õÍöä« ¯R–F2Zmo's%Œ'‰Xm‹ß‚ˆ)v +3ðà×Wç§kòàâòG „Ò¡ ξÿÓö|C ‘ýæòê[â¤ô9ûpuqùÝÏ›÷§±¶— ®ˆ½9¿8ßœ_Ÿþ±ýáä|;ª<Ý–à +õýëä·?øª€Ýýp™J“põ +sk:š~ØÏË˾ljµ·Ôý°3 цà +d•j ”`iÓãäVQŠ‰Œ>wå½iˆ<ì‹l0D£VÊõ²"3uÛ0»Ÿ¯°E]u˜5(Õ@Cœ¢¦ÈËÛº>4ež
esG¬‡rØ‘ÐàGÒìD£¹±³ß›|=_ÎMù;ç̺Ž¥ +ʆ¾8•µ3ÙÑÎ9)×Þeaš¡ †ŒK)œ ] *Þ®-HK\ã¶íêl ÷‡ß‡]™ï”¨8ùA$@ñÜH¿K©iÝYlbÜ +å–Ú<«¾^؆ +Y…¡Ûg`¿ç[°WÁµß¬ú‡©À`éNE,H‡,¹|cf<gQäþ ÅVíÁ†hè ƒÜŒš?_]þgíì¢R–ÀÉŸÙ¥hë }¨uômþ§ Ñ¥\B~vèHóf¨ O…lI§±Ýµ–5« lþS@´
Œ¡yû}Û
tŸFSmò]Ö”}Í`E±ßó×ÁôÎ/´=&ök×âxN°5F2Й3»mô° ¤Â ½Ç“;›ãh%¾l <‚d wH{,‡ì®Ëjפ£eOóÎ ëÛ€=|ÔÄþz!1âhnœŸºvhóöq €Þ”Š°Ñ êÜÒè+MäÍã`úwäðùŒ´¡Æ m÷çQ˜¨¶+L÷Žè ¼N ·MaýbIç‰%CU¦¹Ã½/«C¿²ôsß“®Ë»fºËæPUkðw]6”íè‡ì{Tó +²þ’ŽŸ<Áöì'×Ñ º|q®¬(:Ó÷Ÿ©ÙãeiŸÃãÞ|æ\ÿ4_¶ÉžÿBÔÐþi\T97¾0ïßqêâZ Àù;ƒ§ðÇT†ß}†Ï‡È“ä(”t2æ]{F¡A‡ŽòÀ¾*MOtN#{'»Üèf™íùÜC×´1 +Å–.ðJÇí`sØáµH”!oïñ¢FÆ5p¸×´nØ ce€PA=ã0Èb®”æ«ÛT—¹¬XúoÏžÂ^ ÆL‹4^M±âP¥¦ +Ø€û6ß×C†›/c>æf?{³¹¾üî ÑW׎¸þð~dŸ¹‰š‚F#K-óÓ”n™ày†šëÆc~F±ã‘:Ðd° âxÖòêPP€ Ä[ï¯~!Øe6Aã;MR·SàGÆÛm%›âÈRï–N¾ƒÙÛqèXZ ¤gw,J2¦j†úGÁU;¸>—&@ +?´%Na*㧣í©Ä%÷Ü¥ÛÞõö€ÖJºüì’Ì°gÉSÎà3àæbÈ%¹c(â¡Û¸‘ŠÑ¹‚-Ëw¾t+ûa„|sÝ*à6V¯B3¥#‰‘c±YA%þâ +K„_ÛÆ~QVæ8ÔïÂUœE±‡2áO#1¤‹Õ>Rp\ t,ü~§é¿w¾XõêϽ +*<yXñ ¿14Åfã–Úe÷núã¢ÚÛ%›%<ëý]ÖûÊÔ ìãÛçññ`|{uÍÆ +š…pˆŠ=ïRú,Šö2@âÆIcþ£›-%`‹k•nq ìâZ,-®ùtq›fDlSF´=ôÙgÝPæ<“¶íì¦ .âœy[ïÛÞOà×ï
Œ´Ð[„øR +–Üî §#,†m§Î„© ^ ÈmtR÷¶¦[¿³"ÑCih ’cÙ ¶BÆOÄÉÎi°wö2ݽ•tíZY)˜©:,¶ÛôhájÂk½þÀ/ìÍiñ% ÉÝ£"2Ü Ö÷éî%‚ˆ¡äìÜÕ1Y ª¡ÜWn¸µ•t6AÆß©I7*· ʺü¯‹+yèÐ…½[l”4 3<÷‹w¿Ïû3üwý NÃÇÂ>“u7N˜ÌIôîìJŸaЉ]OèkcžÀX"À°°sEöÕœ:»»› Ä å×ÓÏ!öóy훃ÉÁ컿d"bB=Ó) +…\º6ùêÍtÿ©#pü; PH%‰\Žw5ƒ#üÁç²o¾<zö' ‚3©"éÅ&ºÿŸéj2endstream endobj -1975 0 obj << +2007 0 obj << /Type /Page -/Contents 1976 0 R -/Resources 1974 0 R +/Contents 2008 0 R +/Resources 2006 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1969 0 R -/Annots [ 1980 0 R 1981 0 R ] +/Parent 1984 0 R +/Annots [ 2012 0 R 2013 0 R ] >> endobj -1980 0 obj << +2012 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [312.8189 570.0778 386.4723 582.1375] +/Rect [312.8189 175.0606 386.4723 187.1202] /Subtype /Link /A << /S /GoTo /D (the_sortlist_statement) >> >> endobj -1981 0 obj << +2013 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [406.3277 570.0778 479.981 582.1375] +/Rect [406.3277 175.0606 479.981 187.1202] /Subtype /Link /A << /S /GoTo /D (rrset_ordering) >> >> endobj -1977 0 obj << -/D [1975 0 R /XYZ 56.6929 794.5015 null] +2009 0 obj << +/D [2007 0 R /XYZ 56.6929 794.5015 null] >> endobj 618 0 obj << -/D [1975 0 R /XYZ 56.6929 769.5949 null] +/D [2007 0 R /XYZ 56.6929 385.3709 null] >> endobj -1978 0 obj << -/D [1975 0 R /XYZ 56.6929 748.2826 null] +2010 0 obj << +/D [2007 0 R /XYZ 56.6929 353.2653 null] >> endobj 622 0 obj << -/D [1975 0 R /XYZ 56.6929 748.2826 null] +/D [2007 0 R /XYZ 56.6929 353.2653 null] >> endobj -1250 0 obj << -/D [1975 0 R /XYZ 56.6929 718.4268 null] +1265 0 obj << +/D [2007 0 R /XYZ 56.6929 323.4096 null] >> endobj 626 0 obj << -/D [1975 0 R /XYZ 56.6929 661.7689 null] +/D [2007 0 R /XYZ 56.6929 266.7517 null] >> endobj -1979 0 obj << -/D [1975 0 R /XYZ 56.6929 639.4577 null] +2011 0 obj << +/D [2007 0 R /XYZ 56.6929 244.4404 null] >> endobj -1982 0 obj << -/D [1975 0 R /XYZ 56.6929 553.1414 null] +2014 0 obj << +/D [2007 0 R /XYZ 56.6929 158.1241 null] >> endobj -1983 0 obj << -/D [1975 0 R /XYZ 56.6929 541.1862 null] +2015 0 obj << +/D [2007 0 R /XYZ 56.6929 146.1689 null] >> endobj -1984 0 obj << -/D [1975 0 R /XYZ 56.6929 361.0617 null] +2006 0 obj << +/Font << /F37 1038 0 R /F41 1233 0 R /F22 973 0 R /F21 950 0 R /F53 1328 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1985 0 obj << -/D [1975 0 R /XYZ 56.6929 349.1065 null] +2018 0 obj << +/Length 2923 +/Filter /FlateDecode +>> +stream +xÚÍZÝsÛ¸÷_¡Gz&Âá`ûäØrâkNv%g¦íÝ=Ðms"‹®HÛqÿúîbA‰R,1©•©ã™` øÛïDßèyøJuÏ¥š.LorwÀ{7ðîÈcúÍ ~{Ôû˃_N•ë¥,µÒö.¯[kyƽ½ËéïÉñÇ£‹ËÁè°/
O,;ìË“÷gÃêI©9> žž}ø<::t:¹<; R÷hp:
†ÇƒÃ¾PÚHX@Å%þu> Ð Ó³OƒÃ?/=\.·Üþ,Áî÷ß¿ÿÉ{Søº_8S©7½'xàL¤©ìÝ h£˜ÑJ5=³ƒñÁß— ¶Þ†©/Á¤¹`BÕëδە~ïFR*–â>×>Ú1m "¯5ã)_!/e y¡óJ™ž3)³Jª +?àˆ·æGœa3c+~Æ;æU]ø vO‘\ dV‚ìoGO€ù*Ç‘E䮂AË [ÔE6ûfÜSt5×ø +ÍוBßEËÍ_RòaÅ|Zк“º(Q!²¬ËØ}bžÝEêé6æ ÅjDÜ[MOÁ϶XÛ=vàîñ-nŒ¯k%>yûk +™Š‹fùt|ò ”[zž|*'q "õèé4Ž Ž®²*§î*_<æ‹ ½R|ƒ8tßjp¿5"«í\X}Þ¶°ð’qÁ»,¬1†™ÔE {ñ \ŸQ"9Z×k¾&þÔ3+ª:šÜMØWVøP$[
±rÊýïË7&fŸ0kθ1]1$¦ÌjIòv ɶrB`öÀ“ålZ%YÓ⦨;É”àVä >ànÐUñ;Ðmm{_èþ„ +=-ï² +uþ§œ¯ìM»…ê0E\íÈ Z(ì׋ìÕ«ÔB°©º2Èð™P&š¢1fÒ¬1J¤QGDj’Û¬º% +µÛŒF4<Ä®ÀÃðnÍkèÈÃå,³ä!ÒÈæi¯¯a^–ýf{
u! +Aâøâ3TpÅAN`aH( Á#CµÞ†¯tÛŸú†]ŽÂ ו6+ÈN•Imøð³‹ñà8xé”N.èˆì"ÛjÍ Ýåõm-KŒÁÜ€Y‹±¯•ª|e°–Ýw`®¡æ†OÈŒhœ^QEÖ\îâV †·Ì-ð)w&Iz¦!Z'nO†‡}ÃÃÐ6º,]PÍÉH*¬ÛÓP¹V)Ì1ÂϲGèÛâáåwxøÝU§ö§î‹#?¡0-ƒ@«ëDUqÍŒòdЂæ +yS̃G¢u@½ÿJ´½M©'ØPF&€oM½*ð°H*Ÿ\=Ô/åU]Ì¢û‹¶¨[5>û€uiŽUçÎx£ZVÌZ½ ºRµ#—mñm¿•å½úKø,ˆ EW +$šÚA½qË"‚Z/ +Á]’µJ½¤â;˜ÑúÌ7\b–Z0álWî%!‘ÄC +B‰bFT#ìôD²Þœvã„eÅ:£1’ªYfy/ èèC¯w8¾x:G—Š¼X^eòt`8+Ÿ‚Îy Š{Ø}•×óă6x¦ÛAðí3µ´Y˜FçøØ‹3@¡r²Ì:"@5H|g2—:ýä[ŒÜ—mý Ú,R!éŠ|$«©–d[‡G—#¬ñ*ž xt9ç.Šú¹IéŠ9ð/LýÀñE*v ÚÞë~‡ö ©LsÞå®$«©w$ŸÃñÑ ê|¸£êÕyýT.¾ÄCõ|ñX4wó²Édu@‡(oà xn
6 ßq ¢½ñý¦Ï{
ÿ…*å]¥má㪣ëã=-å–Òša™º¢
ŠŽ—‰&©|4!ª)€ßcÖ„Zm Äz°Ûn´?ï
0ž2kÓN)×)R¸È†Áq¨ ù&&ײÐ.Ãfz ÷> …Ô˜îUR©?L˜x*Ç…K±HFqjL +€ÊvÅûOsä±–÷Ðàþp3Ø“Qƒ§°õÉå(‘Ëöˆ©‚.3®RÖDä_‹ªÞ\ï… +an<Œ7^ºfXkïÿdûá endstream +endobj +2017 0 obj << +/Type /Page +/Contents 2018 0 R +/Resources 2016 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 1984 0 R >> endobj -1974 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F39 1161 0 R >> +2019 0 obj << +/D [2017 0 R /XYZ 85.0394 794.5015 null] +>> endobj +2020 0 obj << +/D [2017 0 R /XYZ 85.0394 671.961 null] +>> endobj +2021 0 obj << +/D [2017 0 R /XYZ 85.0394 660.0058 null] +>> endobj +2016 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F39 1173 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1988 0 obj << -/Length 2817 +2024 0 obj << +/Length 2982 /Filter /FlateDecode >> stream -xÚíZÝS#¹ç¯ð[ÆUgEßÒTž8ö¸ 6›lrwƒ=à©5 Ç3À’¿>Ýj=öa[@Šª¤¨B I–úã§VK¢ÇáOô¼a\¥ºçRÍ ¦7¾=à½øöñ@Ä6ƒ¦Ñ Ýêû˃?Ÿ(×KYj¥í]^·ÆòŒ{/z—“_“£ /.‡ý4<±¬?0–'ߟž} NJÅÑùÙÉéÇOÃþÓÉåéù±‡Ç'ÇÃã³£ãþ@(m$ âÿ<?;¦F'§? ÷¿üñàør5åö²W8ß üú;ïM`u? p¦RozPáL¤©ìÝ h£˜ÑJ5œÙÁè௫[_CקĤ¹`BÕδ»•~ïFR*–â<7í˜6%¯5ã)_K^Ê–ä…VÌ+ezΤÌ*©‚è8=;9ï´ð29äóºøs™W 6á’zšqtñ‰ˆl>AÂ'ç#bÜUù„¨«Gú’QuZV5èA¦iò!¯ÆËâªiXÌ©áðäuÒsš¥ÆàR2L VjضÊ4èÌY+{í¥¾L|J{¦À{ƒ¦ÁkjDBKÏe—F`©NŠ4,üôbt|ôÓñ?@FNéäbÙQ•÷Å•"Rƒò©NnózZNˆu].‰¨êrYÌo¨rzQåc"¿ä+ömVçË"›Q
•å‡³{Jä¡m
‚;
¢ï¡¹Ü§–^W[ú5µeSˤM}—¶@0^KÚ} -Ü(«‹„d¤LÊk,UÓ8Ùd[Vy>"„ôÉñרåûÎÞ‡|°ÛCökD¯vk¤½Ô×Ò±·æ[\²é±[#@’kÕ¡ë K¹ D ®2âÉœÄÜ @3t ,wW³bL4øEüVUå¸ -PÏF‡ PçmrH’˜çõC¹üB•*_ÞãFÎã1„¤-!o‰Ä¹3ÜtÜîïzÞ¯%Ý7ˆŒæÌéºÄk,üˆÖQ¼XŸ\ Pne¬p¸¬ˆ!@¡¸4M©|„àD†ÍÇlØ´zf Ðõ½V ó’ËMjЩ‚p«ëÌl”dÚkµp €ªobr $ÊUØLÕº¤ÎÆw´Ì ›“b G€ØnšÕD
‡±k< -økº"Y0WfÒ+ V Rõ?oÂâ}˜°\›°–+[Z© -ÈIqc_çˊה»¥Úl˜„L’Çåò¨”À‰eœà=L°ÚãÎîäó»Û| ýAΘ^B f¬ÃAH^®VÜqy»¸£tT6 fâ0V_äó -÷§'D ½\•ÁT”sb5ÛÒ¤)š¯<Ï -’q`fq£-çWÁTžZí - -Œ0{6³¶“½Ìqß4¦P0_LWN^sÎRçä .ú©L‡‡¿@|amƒ 6b‚ÝÄ1Ë “? -zb+"AÖJ‘@?L‹ñt÷Y+š;jŽ5Å<Ƈ+ •{8üdW³XŹÄôÓ3a¿®ÛB|ÀŤÌ9“~ÃÔÃïѵ4̈»÷ëZ9Ǹµ”í?û|2*jX{JIhßh˜x(R,7!ŸZ7°Úº +xÚíZKs㸾ûWè¶TÕ‹ 09y=öŽ÷áqdm2•Ý=Ðl1+‘ŠHÙãüút£A‰ÒH”gÇSñ!å*³ÑxèFèn@ô8ü‰^œ°$•iϤšÅ\Ľñü„÷î¡îûÚ šFƒv«ïF'ß^(ÓKYšÈ¤7ºke·VôF“_£„)Ö‡xôÏ÷WçýŒytqùPBéXFgïN¯GçCªHBÓï.¯Þ'¥ÏÙû«‹ËïžöŽF—﯈=<¿8 ž_÷ ýpr>ZO¹½,ÁÎ÷ß'¿þÎ{XÝ'œ©ÔƽG(p&ÒTöæ':V,ÖJ5œÙÉÍÉßÖ¶j}×}bÒ\0!cÕƒØÄ þ]ú
¿H«Xb“ÝŸ ž2
dŸXÍ”Ðf-{)[²"fÚšž‰S–(©¼ì¯nÎÏT •¶Ñ/•›ôHå}ß^Ý@ým^Q±.é[¹ñjÙ6r³§¦Ã$ gµ í¦YMÔpº>æõ”¨¬@MôŒfi K8›ò±pK˜Q‘Í RÒO9}ÆnYgÄ“ëVZÕnù͈?)Ã(eM„û˜Wõîx8¾=ƒÿ”."N`ž"ZkƒÒ#
¨á¾õÓÂá*ce$â/¨P¹"t¸+—ÍÐôõ“lOƒL"/îq’Ü/v¼²Q“üǾsËŠwþ·Ê9”Dê[ŸÖʃF<'|Ãì `vU‡ À–\±šƒV@`u^Ä»]ÕDøaT4/×K/VµoŸÍü &îãÂUþàöýœ ”r[ú}â§ìˆU^qW MJ"Ôòh<ËIÀž™…aPŒ¼uÕx™ßºÐ1/öÉ{xqFp‹8f»P¡cÃ@®¦×6°/3Z°¦ +Æ^½6/_xÈòYv; Eœ ~WÚ‹[ŠÇ +\ƒ?ž©ê– ¿L/Uðä7=«šs–H Qu,W0Žî‡ ¡Z¨ `mS Û(˜x(Qün£=µnÑ·#lÊ£=„öHý ퟋö2Õ
Úk-ƒné7nª"0§û¼À5#—4õW*Ðo/fÙ¸étûD_: +Â0{$°¶èg
ø.]FÓÚ_¶ÃwñQ½$>Æ&aFXÙm4q*™ŒÓÔËéz4D¿S¥Ñ)º1:Z”~R #
ª†ã«a.²eMTyšytbRÎ3ò±tØÔHU Ð º· ì·npØpºUKïPQ{í/…k_ქ2Ë=¢¢¦ Ó„TôŽ-ØŸÑ59Cù-UZͳŌ,”n]ýè\AVJ"< ñ +hZ.ÿUÛ89°an,Ï»>Ývü /1Ƕ̿L_wk(NErÄ 5 &V$oŒ±MÓ–1 lƒ¯ŽôŽ%"«±D¤É™4!!`À ^;“‡²ÆÁT"Þq0!ö&Ö°@–÷h€µF‰7PV"$ AUç>P„6+œÑž-@Û´
£þÆcÎáŸ8Š×ÕÆ9
Áaã,:6MK/µi¾‚3¤R:>â i©™µ†ðäæý)y€—°¼ü7Î¥÷†ŒØœŸUí]T ßÑ7£&mU„€þ©/„ˆü™»…ðØ&gy'Âw»§í¥¾âSUY¹Š¸@à>²ÔZ÷Íõš±j›±æ6ªû"B… }㊉‰¾.gùø‰è‹% e9¦cZN2¼Õ ‘ ö}îó,ÆÛ4#rãB=Ã!¸·‡U×–É+Ž,T"ÀÕ¡tª<JÆ“„ ¢›a?Ž£¿c +‡ónXpÌn~ ]÷…L£7!YO +¶h CDW«Å¢\ÖnßåU
ŽÇƒ‡ƒl‰æš„C €n‚ÇÊ”åÆ‹òƒŒÑiˆM4t ssøXE¹Eø~`Ø©Íq…Ý€Ìðt' ûÓ¹¬îx¬µÖ—ÒÈæ^ýØE=ö1Üì\Ôÿ¹^ÍD˜ÊH…jdÜl_ðrÑ0hSHATL +øšGRI¦eH–¦áN뮜ÍÊG ùAÊß^€47=
“´~
»Œg*˜Úmý‚ª}P;ïͯa´*é@»½àºçÒ
N@*µ?*õÍò-R7 €Hð/»;dm‘*IÄÿJ¡ÈóÏ:Éc¦ÄïRò;D\^õ ^õ~‰7 `Æ Öµù•—:±¾B²MFëcQ’H–Bðê…qöï? endobj -1987 0 obj << +2023 0 obj << /Type /Page -/Contents 1988 0 R -/Resources 1986 0 R +/Contents 2024 0 R +/Resources 2022 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1969 0 R +/Parent 2028 0 R >> endobj -1989 0 obj << -/D [1987 0 R /XYZ 85.0394 794.5015 null] +2025 0 obj << +/D [2023 0 R /XYZ 56.6929 794.5015 null] >> endobj -1986 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R >> +2026 0 obj << +/D [2023 0 R /XYZ 56.6929 229.6198 null] +>> endobj +2027 0 obj << +/D [2023 0 R /XYZ 56.6929 217.6646 null] +>> endobj +2022 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F39 1173 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1992 0 obj << -/Length 3344 +2031 0 obj << +/Length 3019 /Filter /FlateDecode >> stream -xÚÕZÝsÛ6÷_¡·Ò31Ž -¥âG lcR§Êw*µ§q\ç;òý6¯:¶£NuPßÐ÷À©ØÌ…lµâemŽMB\~ØåM±E>¤Ói3>z©dª?b’ýYŸÊ"ûðõX<Ä5I˜ ÅÃÿn•D+4<#arG ÄS•@M5¨Ô¤¡H¢tÚè>Ö£D*cŽ}›œ4|S—e}WTkÔ2$,;Zi 9Ø4‚ÝpɲÌÐÀ4ï`e…Ò`š‡Þ²£mÝ»Æ2Ÿ ®|C‰JeßP·êÊ{"Ýfeqä"?ÀË7oÿ~ì!Ãu0©bödÐpïîO˜ë dc IuFƒURmœM® -\•ñâ5Ä; ëÅ&«[ÐfŒD¹<a’àë爞LP0¬»zY—DY’cf X0×¥øæjNçž@ ÷„ƶX]€6Ãö#Qðšýß¹»ÔAß:þRÁílˆTt-56Cª¢þ®ovu›ãT,0ß"™N0Bèø™»Ä{ç¤D¾è‹²»2$äà¼ñwn”Ø‘ð[]avví\¬Å3 - -‘ «>³B8¡ -Š¿Þ#‘ÒÕDi7CÐvÇ"â8c? »Íš¢î™S{ß^Ly_—o9¬².[díà`¡ HÓøÑ5ßy®)0´ùÌRqÞhkú‚žv¯½ÝžÊ»þ?ñD¬
´ìÇñD,SÇFíñ„†ˆ Ã6«lËDr#¼éòŠIÛ]Y, Œ½Z§A“ûñ:@î< } -¡‰ëx"šwÝ`üÃÞ.k:ÏÜ/ç]¯¯5^ÕÌ9ÿÁ¶9ï¹Íªû)W$¹ñRDWJc·oSe¥‹Ò0ˆÂQ«£›Ó<iºÉÚ
QZ˜ý²ë
xý†—ŽvÞeKÔf ârC ̼¾f&pj`yCª^9 ÉÈYäàpd(’ -5±""$ ðš(”‹ptá7&ízÞ°)7lìjŒN^vôȉÃ9Ñ°ð¿œ{ÙͲ©ð·m±®œp@u’ØhÏ#[A¨ƒk - ¹Ñؾn¹ÍÊþÁ3Ça §Íâs:z"1!_)lQuç3"’ -‘Z@ÙÔ
ç œçÒµ¡€…„eÖ4U‘Œk
=TâX½]àÅe.rà‚Ôæž·éP±~aÅœ†7NX…`¢S ÆO¢núÄs ÇÆ_ûÑ{L?XÂCòŸ”Šv5!ol Z§&pçÑýé— Áµá¸áµ†Êjôƒ‰ê ê0ÍK)ñé¾w1Ö£ vMÞ¶CêÓ6šàaá ÌTC -
Ÿ (TP¿`zF †ÉèÕ -‡à úÔ†46à»Í Šñ|^N.ìÜeÜÈAØúþxÝ8 [IÌ#w~S B%B^ææ’|Á¿ãôC ŠÉ窷ݻO lëÖ=ü¤ìÁÒŽ<>¸EMw/$ÙG Š”9‘Ê¢¢‡$@#% ²~½¡”µ¨z ’`Nm©9ÚÌVÃÕ[”¼mßRÄÅÌ?êb¢m?q5XŽ »Ñ û´wívÆ– -Ö -„oû-=¯P”Ôø ¥¥¦·ÕqdçjœslÙ¯|P§l¨p²U¶( -dzøè®`×É~:56èԣͰ“‘[yç3¶A0„Æ:Œ88À<ü-c/õTø÷’Ìãà#W † -¶n -@ÆæÄÅIÆ!/šzL -yþnPÇImŒ6úëj#5Â$©yÄ[, -À—ýÐÜïO!ªÄ¢‚T*¬ +xÚÍ]sÛ6òÝ¿BôŒÍ# +D4Ë×gÁl }ß sé]ŽG½¾?ûËJfÚ×±Œg÷#Z© ¤©˜Ý¿xWõÓýõüüRFûç—Q x¯oïÞFÓÏÕÛ»›Ûï~ž¿:OBïþöí ¡ç×7×ó뻫ëóK¡ÂHÅ$þýöîšÝÜþp}þÛý÷g×÷Ëãm‰@!¿¿Ÿýò[0+`wߟ¾Òi4ÛA#ð…Ör¶> #åG¡RS½;ûÇ@pÔk§N‰)R© ¥2™“”SrŠ´ +©¬œ6Ù¶£ýüDÁü
Iÿ½„ ®n•
ƒÙµ[P—eÁ¸æá¨o{.R¯l›Þ9c¥©—e›oÍ¢,|&ìèR$¾V2µìÝ# ܬˬ¶sTÙUÙQoäÝßÿ@䯬 +j˜–z3 mÖ<¼2kÓ²©éwÕ츯¡UB/« 3ŸS;Ïxì‚É|(7LÅÔ+åY¾*Á`âTÁ ´ªÛ¤ðuI»É¢)íáÕ%xÙfS=®kÕw«fkº¬3%uY—D Þ§¦.Û¿_† +p ÷1ñ¬j™J¢ dÓw0<Þ¢çµna’®Óá«rÅjÞ¦©Ln ïÍöpsäˆDE‡–5I +Ö*àHošU¥•—µYÖ–9ÀZNt¸§‘kS›¶Ûf ¬fQ¨Ã…ÚJbú€Œrrtiê¬+[Ëšôþµ2U9¥¤„N +äº%ÈšhøÛ·È;B¨6üE†×æSé&ä(¿ li°0 œÑÏ'b·–!`CØ•Y˜®¢CÞhÚmV™ÎªQÖ#á÷¶îÊm]Nà¦Ü‚×Yþ©¤ôÚ~¹,ÛŽäý•-@jyðªé˼ànëV4ƒ–µ¢Üró~‹ì‰© ÇSº§É³Š«¦í0ËØ»å¹ý䫬^–S¦G+5s…òîÀ`7 î$§ÂÔ-¦Ùx6‰dZô¹µJ@l¶†xÕä›rD†™uê‘`ËÔyS·`Ãe?ªè·äS’T9¡!¢{A!“̆¢lMPeÝ“bŒÍò<¬áA.r£²Q?fU_:tU5»!21œ?ŠÏÉ>>KÈ‹äRa(’1‡D $BµeÞ™¦¦†µP 7oi¦i ‘gÛ±ÛFÆH^%oÖ t\¦"*ˆÝ>ñ2 +ÖM¬™RѬ3ÇdÑõ'$~ïv? ÇL—Y«·Jp‘ÅJŽ¿÷eÝaÜF\?h"ã)¿JnƒŽØ"|¨¦[9°0#æXoîÞYv!·‹Qnæ•ò…àêëáK(_‚ +†¾¾úv]=½È¤ecÂVf¹²Scí»6£vüCnÜ‘ ®íÔ6ŒÏèM‡¦´åöÑj°
ÿº2©Â ðu*N hÓö%àâc¶ÞTÖcí„ðhŠãEç7W4ªÐðb*8bô xwOUÉ D©*ÛRï`þKmˆ³Åü®3ˆb< /Ë6v%0Û< Ïç‚a)ydçe– TBœì˜šMð ò ãØʇ&˜vJ6«a#eäÌh–& zd)ðƒë×Z¿¤;ì(R•„ªLmã°„j¤‚Š¬_®¨y5uïBLá-£…@m
¸Þ¢âeû–".vð°Ú&ÚötE,cš£Ò @Š}Ê™‰²+#$½%‹íQ/l“ìobæ|îpË=ÑqäE¨˜˜äÎt«Ñ0謲úŠ”ÃÙéÄʆI@Å×c5:U:6î´p[ò¥QhÝŸPž@ØÛ MÓ·.Êù¼Fn tº:ŽìÍC7ʱU_¸ në•ý '+²…ºëÉÆÚIÍÝìÓ+ú69 +ö×há¸Ô*ñÓ(Ò°ywB‘ðöÝýæg¼ôQiàýøþü2Q‰„ú 0PƒÿóúîzþÊ † I4ZI¨@¢£µÿÜ~Pr`ƒ{3ûšJ"?J"5-!j_†õT¢} m%ô\$¯Þ9-ÑJß°<båÇ2Ÿ³˜8ñe“ ZVë`72’©¯}`Iž– )¿qÉDü7úœ¡D‘/#[Á 2€5@Ñ "Øÿ†% ´Ÿ +R‘Éi©Œü†Å"?‰Âøs– Ü“‡–á¼C‘O¾¢öO0ÿT' ªPë +?Hß‚ž½ © öS©„ÐX’äå7!™J êÑ£‹T6d+RÑ€ˆUöÈ]tKú¬Ô®¡ÔÂÆneò
å{O&E7ÀŠnqCOÄ— û`¨º_/è¢Xñ$]½òƒ€›¤†«9ìÂû•—/ò²¢àB¬=ª…ì©gTÿÀѺ.¨äéö§4è†áð&o²£’JIÚßP ãUü1ɪ߈OW•ß¾ÊcnZóqØš+ 鈎ì횣};ÆË,_ Ÿž‰§Sw “Üwtä.@§ +Ò²|^LÊØפоŠ…ü2ÓÈÃô—“_#ιM]Ê ñà >ý•¯0úKë@Žàû÷þWïü o﹤G¦# –Màeq$l"À¿0| cˆGKÿÙ¨¿v ä#tä‡Qp"=ÊH¢Æô ˆA¤JB~Ü ‹Bx{I!òFpR&ãå¾’Pþ—¼ðõV@º¼ 0ôeyA@-š0½ó‚€< CÊåHdÚ—ãÏbFAÜGJz[8ô€DúB‚ƒ ÓŸx‹H¡èMcÁÃ/NÅ/Žº…y@. Jw¯:Ü8p°µÏ(C¶x +WT… žSÜcÊÓæýÄÓ æJ\˼٧žQ@¬qBqý•½…“û °©†;4¥÷añôjÀs†·ê35¥!ʺПñ¸l˜KÏô1_¢îù] +ö6çKµÖò!X¾ãÙ”Ö§ *)÷Ù«)z×Vöª3yo lÛ”öòFñ³ ~¬0Þ‚ºhðƒ©GÅÝÇ +@ø ×–$3á^€ð~é‚®ÇDš?¸°ËÙ µ“/%BÙhü$Ÿ tÂEà[cï½°vøôñDhûª!ìÓÞ1#Ê +OHGÐ~WMûíƒP¤4AÅ°ÏßÖ& +ô’H‰‚8„ç(Q5@«œøv ?8šøÒ(˜}6þéwMûo»BˆZi*§Ã +BˆiZ8¦P "ÐǬ_@=çý¿ Pfúendstream endobj -1991 0 obj << +2030 0 obj << /Type /Page -/Contents 1992 0 R -/Resources 1990 0 R +/Contents 2031 0 R +/Resources 2029 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1969 0 R +/Parent 2028 0 R >> endobj -1993 0 obj << -/D [1991 0 R /XYZ 56.6929 794.5015 null] +2032 0 obj << +/D [2030 0 R /XYZ 85.0394 794.5015 null] >> endobj -1994 0 obj << -/D [1991 0 R /XYZ 56.6929 660.0058 null] +630 0 obj << +/D [2030 0 R /XYZ 85.0394 622.0858 null] >> endobj -1995 0 obj << -/D [1991 0 R /XYZ 56.6929 648.0507 null] +2033 0 obj << +/D [2030 0 R /XYZ 85.0394 597.3835 null] >> endobj -630 0 obj << -/D [1991 0 R /XYZ 56.6929 345.1443 null] +2034 0 obj << +/D [2030 0 R /XYZ 85.0394 411.8393 null] >> endobj -1996 0 obj << -/D [1991 0 R /XYZ 56.6929 320.442 null] +2035 0 obj << +/D [2030 0 R /XYZ 85.0394 399.8842 null] >> endobj -1997 0 obj << -/D [1991 0 R /XYZ 56.6929 134.8978 null] +2036 0 obj << +/D [2030 0 R /XYZ 85.0394 231.7148 null] >> endobj -1998 0 obj << -/D [1991 0 R /XYZ 56.6929 122.9426 null] +2037 0 obj << +/D [2030 0 R /XYZ 85.0394 219.7596 null] >> endobj -1990 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F39 1161 0 R /F41 1218 0 R /F21 938 0 R >> +634 0 obj << +/D [2030 0 R /XYZ 85.0394 131.5008 null] +>> endobj +2038 0 obj << +/D [2030 0 R /XYZ 85.0394 107.0349 null] +>> endobj +2029 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F21 950 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2001 0 obj << -/Length 2992 +2041 0 obj << +/Length 3197 /Filter /FlateDecode >> stream -xÚÍ]sÛ6òÝ¿BòL…Ã7É{s§çNãô w&sM h‰¶8¥HHÅñýúÛÅ.HJ– 'qgÏ °Àû½ ©‰„?5I&³“$³ÂIå&óÕ‰œÜÁÜO'Šafh6†úñúä oL2ÉD浟\ߎöJ…LS5¹^ü>}õ¯³_¯Ï¯NgÚÉ©§3çåôÇ‹Ë×4’QóêÝ囋Ÿ~»:;MìôúâÝ%
_¿9¿:¿|u~:SÆ:
Þâ?ï.Ï èÍÅ/ç§\ÿ|r~Ý y|-%
ž÷¿'¿ÿ!' ¸ÝÏ'R˜,u“{øBe™ž¬N¬3ÂYcâHuòþäßý†£Ù°ô™¬L -ë\z -¡€–»J‰Ì¹}¬pk%,ÐHï¼Ö%=é‘^ÛLh«ÓIâ2á6ög§À±DO•NE& -žìýôÑ Qï£t’ã°% bÛnó -œ’KcÜô†¶†Å
wòê>€ûî\I‡+!Ä>MÛVÆf I0Þ–¨ --Æ.`•aÆ` -„„^`¯¡X/@4M,Š -ätó@__ÐÀœ -3=gXr˜H½v<š— ¥ÔC`&bŠà»Çc xJjÖ›²Ù” #ü¢Ù¼îÆ& <ïI§ƒ±Ñ^ÖïÙÒ|ù@!b‡OÚÓ÷‘? …ÛSwD „m 6ï€Ýë®X L'*Šé f dø ÓmÒ)pÓ›ÑÓM/‚qÉØ-Á4ß)Cü ‚·¨>d+,Û°”í/”¼|6LR:Ý -aõ ²‚cëË/ªW½yˆEb$A‚«³QÜ8zTÏÈ
ƒ´ub0ÓL!‡zNVgÂ%*ùºÄððªGå õý¹n¼DŽJ¤Æš#å i„•ÊLŒr²p*'2¡Ä¼Y¡‰1¹a-Ãh  -YÕô(y:K$›,±³lÆN{8oj'ãó|ß‘˜*1ú‹ =Õt9z’©#5ƒ96äœÉç &QÆEXè0yL ~ }ƘÿÆôIÁÚBäóúèL §¤;B =¦À(f»Íæî êŒð¾,u^Rçtâ€iúÓ X稸ðXƒ + ÖêÓ T¡Š¨ŽÓh„ýo,A Beü—häIŽîi´§F@ë'ˆ¤i„þ¥ˆôü²â_á=@¡D*ûÚ²¢6^8ãýÓeE
‡ ¥ß h=JµV1X€ñ,@Û§‰ôIÞ{Ÿ×N %½‘êž" ˆZAˆR'cÔÊáÏþ®Áe£MõvE™Kuªy Æ«!TÁkÔ|Ã>sÆ°õÎ[8üÂ<X¤^©Ýؤärc]”œ›ì¼Ú4ñ%«ÝÎçEȧC t ¬“GèæA ÐÊŽè6ØÐCdÓB9éÌÌr Ù…Ç%fÖ‘B«WXÉ5±ÒêûJ«áJëû¢ë(Ńݮ¯yFM•ßÊü´+WŬkf¥t0B4JbPç¹LäCì_T ú "tø ^í|xµ»#Š{Ž,ל§ Q(Ú`[—];Æìñ]uz—‹Ñ}Òc½Ê7%½ž%Tj:œŽê·WBQ–ÒÓ`èÍ!M,¨{uÕ¢°)“ †€ªÔ‰EhÞiÙÜS§j¼¡œ…Š–´/£º)Fˆqì¶2 3
$Ä:ô²ÙV=Ì¡ÜxQ¶s~x
Y…Qrx -3ã&d‚)àGàwà5-X’È7;òP$‚Èl¤k†Im£FZª¹Ø]Ü¡.îr®Î85–‚ ‚€âó”Ù+Vâ -4Š›w$k;*ÅBî\_ïîP«ÝŒÖÍõúݺ™•]ΆÇqÌüå‡×ïÞž]\ÆZ„Õéð5ì€RßÒiW$jÍöé_2¬òÏåjËÐhê†6v¹ä˜\CÄP -¹i‡ŠŠYÒ Ç~œ#S¡½×“‘8|Ÿ„YHŽµöi0ßÚgþÐää‹âsî4üä dÒT –h#-H4¤Kà“p/¤:(ö#z@FâRD°ÑÙÿ>Îendstream +xÚÍ]sÛ6òÝ¿B} g* ¾H‚}s[§çNãä\ÝLç’>ÐdqŽ"u"Ç÷ëo» H™v’‹;ý +ù*ÑÑbÃØ€¶õÚÝ9À,Ë÷B¨°CYóN||< +§¤f·/›}Ùñæþ½hvD&’‰UgÂ=LÕÅÖÁéR!øt06ÀeÒá=[šï Èíé“p¦ðNårCCþöÔ a[‚-:xî]çVÀi:“ÌP£]ªæÞµÝÔ{ׇí-n®´€ûžy®E]q4ºû†¦ùN¥ké»\üð[!x Ô€÷ð\ïI‹³Û ]râ,[nšÖ3#ô÷@íf[=œK)£Ñþ6ªFìq„½;n©¹²ÔÖS~â²Ç[Í ÑîšzUÖwxÞ\ñ5¬‰ˆè×Áá +î‚WØ Z†Ù@"OˆÞ·)ˆÀ`““Ôž°tÛ6˲è¼5}
–ƒßd¤ÀŠÇÞ‹D\P×Ó Ú øƒaÉ +ç<Þ“' upq7¬£š‡;Í›ƒøªÞŸ4r ûYsÆÎ’\?iSOL&S¼l¶¨]48mWà5k%è c#)Îç™`M–œP×äYl™Ï'ùº»!e¦Õ B®,‹AÚiz bÀlà."N6ž`§ÔÉu´§ŽúLò v~YúÈ—¤OšÄÒ +“Ì€$±ÈÆ †G‰•ÙØX<u"uœ%F?Ÿh0y[%É0¼&— +k^A͛څS(öS `A¡I‘Ï´5qfäçhkƒ†™þ2m=½jàâÐbJ|‰#VœX p%ðÒ8Wâ UòŸƒáÕÈl¦Hþ~}Ó€ f¢ªðI!ðÉ‚¦™Î&ˆ£¦¥Š“8Ð µ»+8“Ÿ1 xþ h± ëÆÉIœCnF^WÏ‹ÑHž˜Ã“¤Ïï@÷˜›Á ª-é… ºu3»™‡\
Ž¡Ž¿þíÇ7¯/®®Cî!äåZ×NñüšN»%>{hñ”Ü÷R°->–ÛC£ž ±–áH.1$×1ã¡©iÜ·Ç ŠÞà¡ »Ê¼¹Ìá¥ìðu †¼¬…µ ¼5àþ"”aÅ“L þ‡Ï³¬²1Ÿò9ßx%a0'I 8°Á4¦Uúˆ3DQœÄœžVœ!F˜®ÙшÏ﫦†Ò Ø#íAÓH롆 !1 ÖÁQÌ-µ¼ëÓ ¼rëâPu'*¯çw4ü¡‚õæÐ4]ŸKYž j]÷ OôÔþºç;åó‚ ¡0?çéó<!Lœ7"ÐÉ; àÛf:º,0—ªTB“*a žN<)¡!ÒáwK-©2•° @ý£:„²>¼¹ñþ`_9Á±à'£BÓ“|AF ®Tœ8ª81Tq‚ïÂêÂä¼ÊgÞHÛ—â€Ï{þK*sp»3¥¿4îñþ,<Øóq2¼ÞœâÏ ŸÏ¹0HÕôßqˆXWX~b ÷@
A°‡‰C´^<LãÕPs¸Ûœ +‹ æ´6 QÆ¡Ã<Š GW5².³çëb·;Z8æã«· ̧ÅÇxt.B¥ÅæG×ú@eiœE¥Mõ „(‰Æ Ó*._ãÌј㪫·4:ªbhNkãnÊú>'ûìÁÁfÃÑV4Š ?Žb•‹—Óƒ‹Pô>©Ïœ<EYÏýþ™‰âb¿+&è‚ž< ±j_²—m½]ÜPç¤æþW¦Dt +ÉWRq-NÙªù“#øéÑ>½5„‰m±rcL•7ºmÃußy8óÈ—jË»š¬÷¬T¤¹¬‘‡êy±"ˆÊ»aSEûònƒuc#²àYÂ(µ}PïvM[v\€ ”¾q2àbhÏŠA®ÀvÀŽQ*º +¢’CQU\0½ß—Ý|Ê1ì\í+.Ö Z.·¡ØÂuAª·ø’ò—Iè '쩘¿pB‚ŠŒFä Go0Á6/ïw~ CAæôás}¿ÑÄ•4ì‰Iœøt¹ObªÞÙ·ÄË}l™ôãÇ[b^ü¢}ð¥£éÇ5Å ì.çR,ÿ4!Œísl(‡‡¡ endobj -2000 0 obj << +2040 0 obj << /Type /Page -/Contents 2001 0 R -/Resources 1999 0 R +/Contents 2041 0 R +/Resources 2039 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1969 0 R +/Parent 2028 0 R >> endobj -2002 0 obj << -/D [2000 0 R /XYZ 85.0394 794.5015 null] +2042 0 obj << +/D [2040 0 R /XYZ 56.6929 794.5015 null] >> endobj -2003 0 obj << -/D [2000 0 R /XYZ 85.0394 660.0058 null] +2043 0 obj << +/D [2040 0 R /XYZ 56.6929 613.3608 null] >> endobj -2004 0 obj << -/D [2000 0 R /XYZ 85.0394 648.0507 null] +2044 0 obj << +/D [2040 0 R /XYZ 56.6929 601.4057 null] >> endobj -634 0 obj << -/D [2000 0 R /XYZ 85.0394 560.3373 null] +638 0 obj << +/D [2040 0 R /XYZ 56.6929 465.8716 null] >> endobj -2005 0 obj << -/D [2000 0 R /XYZ 85.0394 535.9977 null] +2045 0 obj << +/D [2040 0 R /XYZ 56.6929 438.5672 null] >> endobj -2006 0 obj << -/D [2000 0 R /XYZ 85.0394 336.1431 null] +2046 0 obj << +/D [2040 0 R /XYZ 56.6929 397.0946 null] >> endobj -2007 0 obj << -/D [2000 0 R /XYZ 85.0394 324.188 null] +2047 0 obj << +/D [2040 0 R /XYZ 56.6929 385.1395 null] >> endobj -638 0 obj << -/D [2000 0 R /XYZ 85.0394 188.6539 null] +642 0 obj << +/D [2040 0 R /XYZ 56.6929 216.4249 null] >> endobj -2008 0 obj << -/D [2000 0 R /XYZ 85.0394 161.3494 null] +2048 0 obj << +/D [2040 0 R /XYZ 56.6929 186.4354 null] >> endobj -2009 0 obj << -/D [2000 0 R /XYZ 85.0394 119.8769 null] +2049 0 obj << +/D [2040 0 R /XYZ 56.6929 97.1422 null] >> endobj -2010 0 obj << -/D [2000 0 R /XYZ 85.0394 107.9217 null] +2050 0 obj << +/D [2040 0 R /XYZ 56.6929 85.1871 null] >> endobj -1999 0 obj << -/Font << /F37 1026 0 R /F41 1218 0 R /F22 961 0 R /F21 938 0 R /F39 1161 0 R >> +2039 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F39 1173 0 R /F41 1233 0 R /F21 950 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2013 0 obj << -/Length 2796 +2053 0 obj << +/Length 2117 /Filter /FlateDecode >> stream -xÚÍZÝoÜ6÷_±÷ Y† ¢(‡CÓÄî¹ÈÙ9g‹Mó ïj½´Òf¥ãþõ7Ã!µ’,Ûé%À -TãápHçã7܈‡ÿÄL',±ÒÎŒ™æBÏ–Û>»…±ŸO„—™¡y_ê§ÅÉËsef–ÙD&³Åº§+e<MÅl±ú%L±SÐÀ£ß¯.ÏNçRóèüâ-PBÅZF¯ÿùêÝâìš/úÓÅåâXú¼¾º<¿øù×ëW§&ŽW—ľ>;?»>»|}vúqñËÉÙ¢ÛrÿX‚+Ü陸 ùl§ûå„3eS=»ƒ?8ÖÊÙö$ÖŠéX©À)OÞŸü»SØuS§ÌKÅ©Œ³XˆÇW¥8¬êI˜iqŸÃEç) Cp4| 3nùÑðRö o%³©™mY¢¤rvÿÛbñö¶”ªh±ÉOçJ¦ž§¤‰VÅþT¤Q¾l‹Ï~0kéÛ’´‰ÚzGœzíAÏŸuå©?8—¥—ÿƒk~“¯kÒ<RöþêŒ âÞ¢_on–hfµ–³¹Dà Vù:;”-Ý´Û9¨ßùç|ïÝÀ»Ï]Ñnꃟ‘ѧÙåË·¹ )jò–Ý&6`TaÁ”={Û*«˜‚h˜ÍƒÀwô - ‚)—O{…ÒÌHaMƒ¥À -pÒeË
RÓ |—YEÄ&Cç@*£ÿnèëî‰&_ÖÕŠh´v^ú?Šj$y}ý‰$ºÛa廢,ýÚuÕ:ªË)Ï œ²©ïèe]ÝUƒþ}¸Ø=¸FCÐY ±t; -¯SYA©ÃJ4y“‹\™«üTD>ÆPM‡ªh½ÍÞ½š˜Ñ0Õ‡ÛÍHXÐ]㬿TþeWË¢-ï‰ßå‚|å4%”Mp(ÿ’mweþýáåy,z'äCçÅ·$60„´,Mq”b^Ì RÚŒêeæ“BpÓUÈÊ!ç<º¨Ðu½{þ+ÛíŠàà…÷ã‹wŸã‰Õa“2f6t×¹×£,ªl‹Tj#JÍM] Ú¢®hÓv»qÙ $ -²1Äë>«š2ór0²¦°ÜÒ¬‹wÄÍV+¯´¡w‰0€‹úŒÜ¢ñâËM[[÷æž¸Û Ö"]8Ũ;¥²_EQÍÝú€ X¶ßev²-¬–þVVõ6+ÜyL”aºRi½[\áK"°UX’@t ©på -&ÑäÄ×5ÇmÁ
Öéê! l³U>ÔTæYÓÎÛz¾›Ö¥¼yØó 6ÅmEu,«°Â¥ ´ÑÜŽI\žËV$Qæk'«Üµ g_Ün ëÍcn -@¤l< ª” W¢Ó I›¨ÙøÝ×ï¸1œóâß!´ŽXæ4<ti’¼ÛÔ ^emFÌcÍ6íÁ„BÙߌ³ŸNC|Ž¯¬w-Î?É1GÂTân]A\m!ù»ÒO à -à6á9å‘9|ðÒlYo?‹bþ‡1 `M ÍR¨”ÿ«êß;É×#š0ã1 -¢5ý+-|˜12j÷v¢ ¥Ly,ú0º‡
(FF$³òD ‹ÔyÇeÑèæ‚ ŒV2öˆæ -¼05ü_F^A@'7ÒÌ@1\¬q.2û4ŒÇÖ*êÑî¬G8ÆË‹œ½©áD³Þ¡‚ây_³;T2è@Sè<
¬o9㩦°È.Q}ô Ñ"œ*¤ ’ë«D#jH&$WBñÀ±¨ŽÀÑù)„Éö~hC„üy´ÛקBGŸ ªíÈÂ&”¦·=Pû¨rÚ°Qå#ÌVW®ó -@•ž¿ªé[Õ'ò%` -0hën¸wG¥xåE[ Ž
- ‚d Ô nšüÓ!¯Ú í&Ï+¢ò/€ôWùŠQçùÛw5á“ úêŽ0°Fw÷²ÓäåÚÓá)¨Ìš&4Ó«|‡kVá±Ð½?ñyözïì©å·‡Æ+»ñœz=zoj<Œö{aÝ!-ãI¬Ý!§•¿é¿×v»Z–‡UÞ=4 ¯^(pu“ˆ©l*ÇÙT -íå^L¨Š²]\¾~û뛳©>‚ÈÈ£&²WµšP)c¦ :‹·dpW(m–#I ™ª^<0á#blù#}ðõ"kçØ »×†gãà·s;%)õ¥è~Uè,€(³›¼¤1\ÀµJöÞ4hĵLxVÞ75»|O \DÜ·Í£Ú ƒ.5÷Û›Ú¯H7½ó
¸h3ÚÝòà;Rç½ -ûó.YŽ;–WíØÛlß>âŸv9†Þõ_„`R÷6#NÙLrœîï/i†™¸»x·Ø(½ËnZø€+R®¾ -Ë!ªÐ:Š;ó¾Ê‡Ø\Æ)1 - ¡Â…ï><'†£ òBïPû i´KbÝË ²úÒo(ITlé=}ªäw«)Äî&Qò›²„Ž!¦¡{4†I,sßœ$‚ÂyOãDŽÐrŒ©gS„¥ˆÇLG? J*3øcît -Ñ>…èA -ÑÇÝp‚ ”Œ‰Ë3 ð‚‘Ïâ…y̱¥éè Þ†¾‡sïá½òr Þÿ)fˆ±ºâ2ÜajÁ‰z Ñ ò=:ß ¶ Ð+ÖÓ5Í5`î 7îç‘œ=öO - ⿘ø +xÚµXÝoÛ8Ï_¡‡{—Ÿy8 6›:=/šd/õ^ÛöA±•D€,¹–Ü4û×ßCÊ’£4Ýë D49 Îço†d…?iE¨02ÊŒ$Š26'4ºƒµ×'ÌÓ$(Rý¼<ùñ\d‘!&åi´¼ ðÒ„jÍ¢åú}|öÓ_—óëYÂS2KTJ㟗¯pÆàçìêò|ñú·ëÓY&ãåâꧯççóëùåÙ|–0!³øýêrŽDç‹7óÙÇå/'óe/òP-F…•÷ÓÉû4Zƒv¿œP"ŒVÑü „ã͉T‚()D˜©NÞžü³g8Xu[§ÌÄ#™Q"$Ñ)°=%æ@l¨¥„“~“ŒŒc”œ–‘‚§œ ––î£ÀËÃŽ1«ƒËSɉLeÚ»œóˆ1b”âÖ熒ŒÁöŒ 04—Îç—Ö ŽÒ•Jf %JÀ:uW³$eñþóø‰ó€§d Zšjˆ--íÑѧˆ*H4;]6p?.6<zÕ€FÑ@©À8rvJ¥|ÇŒg„fÐÉ$¬Y‘—÷ª•Š-x‘*ÔúËÕõâõ«?â)!$M=]UÖE;K„¡qYã·önPÌ¿ä›mHò_ºµKÍlwÍŒ©øs¹.ë;œZ5u‡Û;Ï´ùsL¡ˆ¡`’Þ§ ^SW@Ïhüó G–§±Ÿ_7ø›ÎŠUѶ9È2•a{¾ÝvN0†Š² ‹]\uû¼Âñ¾Íï +«d·”Ôûp +бè÷…¥å™vºÛoY¯ËUÞ…Ùû¼ #?5°‰ßÑâwWTyW~žq ñì÷VeÛ nÜxåïÊš ‡´4IDÎ0¾/C-(“š(9@Ò÷áÇ8éiš²CÒ³aÒ:e ¿5@—µ¼…f ”ÆW` ¢óïM]xœ.+?zUîŠXcÐEÈp(䟡’õi—pã‹ L½Ã±g¥M|Þì6Σ0û·8(ë²+óÊÆŠý¹.>PÊkç'·Š[¯ÏÏp +„ÂQ^{š{deâvÓŸöEÝn7EQã¨øÒõºXÛ˜…ywo¥šˆIŒÐ»Wad^—][T·~ÜâwUå B,[{fíéAI ìf Z5î»îÉ=Õ׎ßì[ÏìÆÏ4^€^î6ßYH¯$xMz÷O3O£`èm/ÕªÚ¯=˜B`
€J¡ÎR6…¦üM9´!H÷Ã+IŒf"0Z\ž½ùíÕ|‚“‚$ÊøÚ«^O°ä’¡³Às¹|ƒ†Hx +µÍPH a U¥<äa>#–Á–?áçU4ï’¶¼«aÈ^΃w÷.ìG胑@ÿ : +U~ST¸f°ˆd§kðŸ;ůP^Tk««Pa¯ˆóv[ì0` n…ÙnÆb'æíOÛÇÍMãODOoñÓBˆ¶GÒö;\tÑ ;š]–Ç9sÚ Ç`—ïºgâó c¬nUñCH¦q"u¡‚³QЩ”pÊCÐý
IäÄv½ãÝaGðÎ3A¤Ñ"’ +Teß‚Å€ÄZëg¸g˜ 8:$ Ƴ”€d¬?× +h½=¡'ÄØVµøûDÄA‹Æ-¬#…õômSU̓ 7‹ÞŽ»¼¬\Óa›ÎÆ™ÈhrdF&Cf¨AfðãÌé>./gÆÛǺ˿üuâ|§³t²9SÃ&NfD0Î=ݺÙäe Ì8: :G.eˆ–÷Ü0Ë¢¬šÍÆÆû†1¢¥Œ>N™M—ŽÒ~A.C ¶…Ë@ÅB¢0¯š #(„e,?,~(±ž0_ ¸ëàló”
~óúûúôp¥ƒ”5î8ªDÄök"À—åˆ;CÎ2ŸžÌåî®íSƒ*#P@Ö¹;Hùêæ üt‹ßÜ-§q ]¹*»©zÃ2ðS2Ê +M*øwA„†JCá¾, U…ÿŒ “!Ë €vM¨q=Ù‹(!PâYMÉTI%™àâQ EÔEÔEÁÓ€ jT2&ü—Qè2þb¿HªIÆÙQ<…Â0 rêƒ|P^Yeh[¬á~è±úâ2–P°Fú²„cÊÒwûMßè•·Ó5Í]Àœ7mSí»‚L'[¸ÑJmq˜YàÔ#i’`¸ÀÀš,ÈïÞ½ßXÀ>»<½°2Ƨ‹Ëäíüú_óëi Æ󲑹¡Ÿ.?çU¯ü©Ìt,+ Oæÿ>½øõÍœœ]]Ú‹’Ž%>u +°†HÓlxq!âI9 +Mãÿ ºÒQ QpÁ:àÍ-´ÓÏT#Íú>÷Åj„
× L§JõÅÈé<ÅÎÆUöß7| £’gãrv€.ÂíKd1ö}QÀßBjßßM„ ƒXU‚å[LÆt`¹?Áå íò ~? jŠ]Å+‹¯¬ DLÈå–ó.,–žù¶-Úh/n§®Lª{Ð|ÞMÐåIa<Y`?Ä$,žÔ¾6™ì™kh/ì +ÊÛ•¿Ë‰,ƒ–‹êqŒ"(H <ãÆ®2D4G Xé+Œ}¿#¤ù\ì<•³ÈFƒ´È& qö>÷çmw¥»ž mÀ›”‘¬Oþ¯Ý‚o¤ qÕÔ«bÄÖ>6¥0Í8¢†„/&‡oùš<÷:¨cŸÔ'ÞÒiÿÜôÝ/÷‡W-ë|ùð%{˜ZözoXÊê¡~,ºš(
öTöÿ endobj -2012 0 obj << +2052 0 obj << /Type /Page -/Contents 2013 0 R -/Resources 2011 0 R +/Contents 2053 0 R +/Resources 2051 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2021 0 R ->> endobj -2014 0 obj << -/D [2012 0 R /XYZ 56.6929 794.5015 null] ->> endobj -642 0 obj << -/D [2012 0 R /XYZ 56.6929 647.5054 null] ->> endobj -2015 0 obj << -/D [2012 0 R /XYZ 56.6929 617.516 null] ->> endobj -2016 0 obj << -/D [2012 0 R /XYZ 56.6929 528.2228 null] +/Parent 2028 0 R >> endobj -2017 0 obj << -/D [2012 0 R /XYZ 56.6929 516.2676 null] +2054 0 obj << +/D [2052 0 R /XYZ 85.0394 794.5015 null] >> endobj 646 0 obj << -/D [2012 0 R /XYZ 56.6929 321.585 null] +/D [2052 0 R /XYZ 85.0394 617.17 null] >> endobj -2018 0 obj << -/D [2012 0 R /XYZ 56.6929 297.1352 null] +2055 0 obj << +/D [2052 0 R /XYZ 85.0394 591.42 null] >> endobj 650 0 obj << -/D [2012 0 R /XYZ 56.6929 227.8928 null] +/D [2052 0 R /XYZ 85.0394 518.3317 null] >> endobj -2019 0 obj << -/D [2012 0 R /XYZ 56.6929 200.1731 null] +2056 0 obj << +/D [2052 0 R /XYZ 85.0394 489.3118 null] >> endobj 654 0 obj << -/D [2012 0 R /XYZ 56.6929 151.1547 null] +/D [2052 0 R /XYZ 85.0394 437.3327 null] >> endobj -2020 0 obj << -/D [2012 0 R /XYZ 56.6929 126.2246 null] +2057 0 obj << +/D [2052 0 R /XYZ 85.0394 411.1024 null] >> endobj -2011 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F41 1218 0 R /F21 938 0 R /F39 1161 0 R /F62 1361 0 R /F63 1364 0 R /F11 1451 0 R /F53 1313 0 R >> -/XObject << /Im2 1350 0 R >> +658 0 obj << +/D [2052 0 R /XYZ 85.0394 208.889 null] +>> endobj +2058 0 obj << +/D [2052 0 R /XYZ 85.0394 179.8493 null] +>> endobj +2051 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F62 1379 0 R /F63 1382 0 R /F21 950 0 R /F11 1353 0 R /F41 1233 0 R /F53 1328 0 R >> +/XObject << /Im2 1368 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2024 0 obj << -/Length 2015 +2061 0 obj << +/Length 1844 /Filter /FlateDecode >> stream -xÚµ]sâ6ð_ÁC ÌLÓ·í>•&äJ'!WB{^ïÁ<8‡Íåòï»ÒJ`ß5™k‡´^V»«ý’XŸÂõSE¨Èd?É$Q”©þ|Ó£ý{˜{Ûcž&Dq“êçYïÍ¥HúÉ4×ýÙ²Á+%4MY¶øÿ2|7M1W4Òd+M£ŸÇ“ Äd8œßL.ÇoŸ‰Œfã› ¢§£ËÑt49
b&¤âÀ@xÝLFHt9¾
>Î~íf‘›j1*¬¼Ÿz >Òþ´ûµG‰ÈRÕ„JX–ñþ¦'• J -0ëÞmï·ÃƬ[Úe&%R¢RžtØI².;É„è$A;ÝLÇoÇ ·¦42_òÍÃÚy¹!V5à 3F2¥¸#~ÿþý (Ï'Ãkkàëáxߎ¦€¹aÑ›Kλ AI"¨v,Š -g>í‹ÏùÚlkü®K\Û’ø°6 Û“ÑŸÃëwW#r~sMPh/ŠnKÒ&D±ž±3¤Žµ=`Ehdµ› Ju6žœ_ý~áOü¢Ø™y]|6ÝjrMœ€ãwû´ó/?vl,QLKXàÌ 6p„J4 —Ü. °U¾éÚZo0&<á‡Vå Ê]q_l;ø€d©Vì#êÜÅ.#Œ«ÄÓ¯lì)žò“Œ¤R°?ëP1ŒPi•¥$I`;;95ùöi”o D»K£rnª -gjw( - œ3$‘ HÀõt•9F;Ž«Üc ìÍ— åL òÀ|¿Ã9¸[K¦N?‘¯•)(¿1éÅ"I4mû(&™†“q0º« ^ ³–nfQnò@îÜÑAHóÙì<•³È‘OŠ©' Ÿ»Êý~»¢Ü.íÈ7šY :óM;& ßHüªÜÎM‹-xÓ$…Õö¨¦#roÌ;c¶¡ž9š¶«T*ª‰¦üE¥’q’eJv—JÈÀ™ œëìë¼p ^ +Ú¬Ž‡„ ‰b‡Š -&;h™ªƒŽCf–Œa™júœÒ¡¬sR¢YÿÊ‹fðÏ£“ xJ¢I©ˆL©´[÷?õmÚÌ2D
Øéz´C¼oxÿ¢ú
¥ã¸ÉÙ)¥›~ÀxB¨#©3Ì .C_ž bf´5 - ”6RN…Sͤ±Ñà"ÁbÃ2aôXDµ*÷ëRÞÄíLU—;ã±ù²†$ì&rŸ u«² N´:=Ô Ãa¢å¬
ßoé,¤-¡¡TAEwiÁÊ.µ« iÓ… «{ —[¤y\›¹‰& -.Udþì™_Ÿ X;?q’(-šÎ•» äúj®£¹ïakƒø ‡Êì -ã¹@…)«rï -nž¼¸Úa›½öͯ¹Ö Ë Z±ojõ -Fü+ŒÐ[Ø·5Lƒt/<>þB¦ü5L ùêJ›}UîxN¦‡¢ýÝמ7!"MyóÝ|Ђ Ž€ÎÀ åŒL³ç¢ ž¹Oeÿ°žÖ1endstream +xÚµXmoã6þî_!N*._$Rì§s'M‘uö ·(n» ›ŽØr"É»ÝCiËÅç»E ‘ÃgÞ‡¤YDáE™$Rs )’Œ²,šo4z‚µ›ó<I`Jº\?Ïï®…Š4Ñ’Ëh¶ì`å„æ9‹f‹±$‚ Æÿ¾ŸŒ‡ Ïh|}{iÆãË_F fã).HÏúóíä +g4—÷“ëۛߦ£¡JãÙíý§§ãëñt<¹ ?Í~ Œg{•»f1*¬¾/ƒŸh´ +A ”B¸ öó‹Ùì©«²6ó¶ül:}' B8xJtÊëákÕý仢¨Åd*É‚;¦¬[o\’<ÕÌ3-̲ØÛ¤m×=’eNxšÞ=h[‰óífcëä5ø"OE +þ»]¬ËΊ¥X\ (NÛb
Æ •–ïEõäs&œ¥*Í…LÎ4 XµhHO¤é±Ï¡>òúq¨m‹°°]“àÓö2w·p
p´ìevÊ$à%hŒQ¹Oméûpy_4®í»ë4Z¤Æµ¦j ü}‡…ÛB¸OÆpÛ—ÎÆ_E IyÌRJE8à;±Y¯š -2NrÊÏ-Žþ + Q …áÄõaiÂx¦B¡‹¦O#®Iž+Ý-³o`2P9:·_Ÿ½u¯)Äêÿo)ÿo•ªá¦C^«·vÜŸ8Q™ÝçpÊ5.·jmkà2žcIÁù‡ÆÔ¥ñ›\¡ÂˆœÍv爹A€×}¢»Ë’Û\¿"µ(—–eér ¾—n‡;5Æó•ß× K>úE…c …SÀÉo¯þ}µŸ«éÿê*xHB0·Â„”xIÊûÌÎXŸÙÑpAúŠô“©¬Nž×UnLÛ åî$°ôÊOv'_v%Gr´äççmÝzÄÝ#ïxÚÝüÙÔ¿KCŽ¬_˜µy*ìEeßäšy]>žhrLù&ti‹im¿îŸ£««)M?XgŽ^àC’ö¶cŸ¶÷ÓÛ›[x³I艔ØÛ' Üé»fùÚþg÷±„#ñO &8>Œ§¿§düÇèý‡»ñyPŒ+$/p¸œŒÞûÅ Bû;l×¢pvØ(~.ðÞl¿!ˆ'¼‡“u@Ÿ z¬boXÅþW ~Ò=ìPÇ5Èwføø™ ü<P4™~¸:×Ïù†¼žsÕ !VÌ;ì9¾ìиû™Âš·#¿\-xÿŽßôÐMä2žl þnÃ?„Vx[®¼€Õ ²)ž×%âA™— À- 9eõäÄdþŠ 8<ü—r½îsç£?-Âósèðô]cM©½r@zåì.TÎv_%ÏØôçÐSìó®·Bº~>êÿ_]ÿrÿ0K|qBör¸š]ô¥Õy86vüâH~8Õ(òïhØdœìN HXŽÖ0¾7‡õ¹¥cP?hÿæN~Z$ïó`ÿƳEŠÓ"ÅùO‹<ÙEÐmÐ òµÃ!3ÎßÛ§M÷¡ŸÃã˜Q )E¤ù9r|EÕ¿SÚ:Ò,‡÷>‡§*Íû~¨¤ûGÌwÿ,zø
UDä9ïþ¦Ø¹‡ÛŸ14Ððþ°X®g3þêW[F ’¶Žîÿø×WËendstream endobj -2023 0 obj << +2060 0 obj << /Type /Page -/Contents 2024 0 R -/Resources 2022 0 R +/Contents 2061 0 R +/Resources 2059 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2021 0 R ->> endobj -2025 0 obj << -/D [2023 0 R /XYZ 85.0394 794.5015 null] ->> endobj -658 0 obj << -/D [2023 0 R /XYZ 85.0394 645.1438 null] +/Parent 2028 0 R >> endobj -2026 0 obj << -/D [2023 0 R /XYZ 85.0394 617.8288 null] +2062 0 obj << +/D [2060 0 R /XYZ 56.6929 794.5015 null] >> endobj 662 0 obj << -/D [2023 0 R /XYZ 85.0394 390.8337 null] +/D [2060 0 R /XYZ 56.6929 655.4043 null] >> endobj -2027 0 obj << -/D [2023 0 R /XYZ 85.0394 367.3195 null] +2063 0 obj << +/D [2060 0 R /XYZ 56.6929 633.1281 null] >> endobj 666 0 obj << -/D [2023 0 R /XYZ 85.0394 281.8762 null] +/D [2060 0 R /XYZ 56.6929 552.1893 null] >> endobj -2028 0 obj << -/D [2023 0 R /XYZ 85.0394 253.4771 null] +2064 0 obj << +/D [2060 0 R /XYZ 56.6929 525.0283 null] >> endobj -2022 0 obj << -/Font << /F37 1026 0 R /F41 1218 0 R /F22 961 0 R /F21 938 0 R /F53 1313 0 R /F62 1361 0 R /F63 1364 0 R >> -/XObject << /Im2 1350 0 R >> +2065 0 obj << +/D [2060 0 R /XYZ 56.6929 90.0274 null] +>> endobj +2066 0 obj << +/D [2060 0 R /XYZ 56.6929 78.0723 null] +>> endobj +2059 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F62 1379 0 R /F63 1382 0 R /F21 950 0 R /F53 1328 0 R /F41 1233 0 R >> +/XObject << /Im2 1368 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2031 0 obj << -/Length 2817 +2069 0 obj << +/Length 3608 /Filter /FlateDecode >> stream -xÚåZÝÛ6ß¿Â(œX³üDñÞÜÔI·H6½(.̓lѶp²äZr¶›¿¾C)K^ÚÙkr¸‡ƒ Dñc8œ/þfd6¢ðc£8!‰âj$UDbÊâÑr{EGk{}ÅÜœ‰Ÿ4éÏúa~õý+!GŠ¨„'£ùªG+%4MÙhž'Dk @Çÿzw7»žð˜Ž_ݾQÌÇ/šþ2ŸÝã@â¦þp{÷#ö(|¼|w÷êöõ?ï§×2ÏoßÝa÷ýìÕì~v÷rvýqþóÕlÞ±Ü?£ÂðûûÕ‡t”Ãé~¾¢D¨4 =À %L)>Ú^E± q$„ï)¯Þ_ý£#صKƒbb”p‘ð€œ"’S¬H"¸°rb\JÌÞœÜÞM¦?þxO¦÷¿LA" ÜMßΰég†æ‚¾Åyo3:špEÒ4µ»¼Ö•ÞgñÉxœá£Ñi$ãz… S7\åØxû+>÷×, ëemŸy¬‰4ßÕž^»Ñ~Áß$ SÇÅzã6Øt$›"ws‹fÀÌï —ãô¦ÝÕÚn瞸áÈ?eimŽÉQqŒV·Ðh †ÂngéÁÛÃFWØBN¡±wÌAÓ1gV!sвÌÁsg\/uÓè܉y S/f©ìþ/ÞÝß¾¾½C…Í~¾ýåÍŒ å8ñõìnv?{ÝN@»ØüéÝûù䶧n”pð¦ŽQ¤y~GñI¾ [ “D .-e/ýû¡ø”•ºrâjë°p-š›Ý›‘N -ÁŒQ5ŠiJ˜ZϵB "©< µm•çN#b’&q|ž\G–kúCR¦I$A`TÉ.Žó¾±CôU© E - Ÿ&‰•â>«Ö:àT2BIS;k¾±^•¤ãeVaÃF,xÖ•mH ÆÐÑ>ÔØXÕûmów†‘‰ŒÙ¾4m½s«öø<öß´zgBg"Æ·žÔÆmò¥|ß´!2»À$¥Ðñáy€w„3 »Êl¤wÃix‹@£ñÉ`÷(NÆSѶÞÈÌ4L:Šî@£¯ ö¤·‡ÆÑ\èÉîê¦h‹Oú‰QF$Ï@o}~Më€j ÎSˆ ýóivKÎO¡’©Ë†–¢"†g/7Í3ÍL0:Îu³Ü ÝtzÄþúð -Ûæ¬O÷fÀWÙÉ3,s–˜ãÄnb$šááñÛ»2[ 1’˜pzep¡Ë£6ÞY¥ lÖá®àƒ6~Äx~ø¸Æþ5‚¸q”AÙ7s¾µúÐîÆû8`ªÇú€Ã•FÌ%Ñ{¥Q÷2Ûéãâ§Â9E AÍðÐ7JæÐ `¸2<šÇ"[þ»)³fƒKYÔ_ÊÀ
/ù*@ L=ež¸ '‘k²&b<!’ñô„;%]0²Án&M‰¤…¤OIÁª(.,ˆÅOØf(z×u••¥{·.ÏXsý`ôc{ ÑxXÛDGãA%lë¼0Á]ïÈæXnLüvcï&Û® Ù˜ f¹²ÁÛ¼¯ènqI7³AH¿Œ¨¥°wˆ.s·M‘·lš8 BäYcÌVr| LBZpäSÉž«¨Œ¶E6òÃÒž&·0cY@½LB6”0o,« È•`I/F”zÕ"ÅÅ \҅بØnu^@À*ÝŽ ÿ‰“¹2 -ìh sPŽ5l ñ3ž)³ø’EH"LÂŒ²&Š\\ i ¤0°ÐÕ9÷ŽŠÿpcµ÷áƨèãÇ - -398KøžšJ| ò”{Ùä
èUu‹BÉM] Zíü “H Ô®xÖmàNÁ:Aº‚Xà˜yç}†€tªr_¸³ ´_¶3É -æSlŽáî XÆmujø©Ñ¿s µÂÅb쳕DÛZ¸Áö˜ºà€
Ä0P¬ð½hñý¤ÐðÀuŸ -ÄýÂ@«eyÈus"KÑKq+ĆÁ ÏÁãñ²ÞXeÑZùs Îöea“Qè6Â0Ü„0“’¤ª æ/BxŠ bÒÿ£M™ šuÌ£.w]WÅgDÖ1ŠžE• ðò¡*‰†çYÂ,à3vêäa²“È /º¡áýy¾XÑ/|eaáXøöE1.`O -B¹T«€ëŸH*ðÛFÛ–_¬U¼ße[Ó³!ÉU l£ØêI[OÊâ“ë±°%¢Ç)k÷Y#Ç×Àw -À£;™uà$Ý–¹ßï„SÆØ`Tè¿+ÕFï‹ÖÇ'—ÚC $oóù›Áº¬Zúï×éøPê†\J°ÑE—)‡": -™^TÑ%S¹·áÖÛ>kãý±¾CÀÆ™ô…e˜îj§0s›µË
v¶v{zŸM¥9`ì Ô^töÙ¿†õ çÿËnûñìÖËþù$ýŠ³v›ÆÌÆ—¿Z°4%JºÏíãîË -l©Ö PSá,¼ ® #_w¶ÿª¸¤ ‘ ñeqè L¢EïYOšRÛ -dz`µ;V&… «{ +xÚÝËrÛÈñ®¯àÁUªDì¼ðÊMëÈŽ¶våÄVªRñú +„úçó ÞÏ×7£™„š×ïnÞ\¿ý×ûËóÈx·×ïnhúýÕ›«÷W7¯¯ÎçR›@ +ôl® ‡ +¤¹~@þØÙ ácä˜ ›:+о细òpW,ï° z{gÝ“&Õ6Ö,ƒX®¬ýÆñÊŠi½¡-ݲN!ô@RGÚº‘¼Ìø˜"k廓¦|Â\/ÒÅ6‚`ä7@ò\z=žI4P•$¡m l¿´÷†¨ø-`¯Œ„/Bé„e5IòDËp`#Ê|ÕÄÅT’M Tl6yV€Á*ùD ÿœi ˜ähDs`ŽleÔ M1‰ Èà)‰ˆ|Á -H›)S$}¸¡ ÃQa$¡«S2îôŒÿxa¹÷ñYôéÓäÎg‚×/Ð-"ï5Y@”üKºÙ–ùÅJaàKÝÙΓ·2/½øç }‘M™€Ä×ú‰Œ8ÐìÌrƒu72³¼‘iQrãØS‚ÚæÄNs ³ÜïH´«–&¬ 2Jy[ðN·ƒ½í¾ä
)/H©Éòe±IKX÷e¿M¨ÜלPšoÓ,³ö r‚NmU(9ÌN}±‹¹ƒ6Ò»DßrŸeº(s^m]-³ñ(u;ÕÅ5 vtV ¦ ¤M8ŒÓÆl‚!$G‘êÕU^;´À J i`½l-AttòÈ$8qbTOœøNÆ'BZ‘xw ½=Éu|ê„õ3töeÒiÓ)0èÆ„Ž+?Òžý{*Ö +¨¡
À£#5|tmkyë—Áò„ «Ôêz߈ãs—‰¡ Æ:ùn;ëdM\ˆi{$!û–ò›ljBÉ ÜeÚÏhÝD?ªX9Ùü
àUuKDIM]îÛœõMiØ)åØ®P, Ž|hÛ&wÂÐòÝûë·×7S×Ë+•" S`mEF+ ¬Â¶îdLV(Ÿ˜c!%j,×Õ±àÇÈV2µšm1Í=%›lûÔ…>XC Š‹–Æô!²Úw±
íŒÑˆÌ§²Ÿe±é°K „ÍMh6Om +â$'··¿Žö¥Õ’WíÎco_æÿ|š½„|yÊ®+f0q1'aǬ8ˆœ˜f 0ÍíÌ1U(WSO.7ÏÆRžƒ"[ÏŠ‚N$Ï{“0)ïC9úQõ¹?CÜMìGIô\uÎDàY?É¥§>PNl4ï·sV҇߆bób.#Wd†å\G…•›´]ÞÑ$SÞW,9OØìaÝm[ny~ 8OÊü¿“Û@ü(¹u´9H·ã´ÜêÐ
„zÏȾøšh{Ø>ÿ€ak¶H/Ÿ +¡ÁÆ'(6@åû®wL1ùC)ÂÇQø ÅTŒ%iR” DÙóPÄÂö&²>]#û*¥•³¾Ò'!XãÙ?öuçJ(|‚ LAûW»ÿí=îû^ñ0Ô‚”_£ÜB"Ëáóá£gD-@ Dxs CÐDb@,S¯`= +l^!šæ^½: +&2*·ð®¯ôbÈQ{É},Τ-çG1Daä‘s¥°BAÖ¸Ç'¦&«]Œß!Ò@z];\ú –e÷(¤éîñú×Ë F‰Ä ªé<Œu˜ F\#Bøh ϥ»̲bxÈ›Â]ì½Ø”šá#0’zÿZ ŠFöqJ —ÿ Ô~þì©Ôãèh AŽ…8ðf¢Os3íÒ›Á‰œJò!T¶¢ï7Ûñ:â'öˆŸ“¨-úA¢R“çÂ.aŠÎ?ÐA/áf$áBøÂtO*»ôaÊ K”–¾üP9+âìhóÓC$N}™p˜G¥Œf:`g+£z}>¥fQTéî0\Ï à§dt”íóÓN³. ü‰â/.œÁH “,mÓÎäb¾l÷]=¿wª=6Ö–ôøaqp!<Ž6éî3P‚çŠ
áTß?N Ê:ÍúÙ•3ÄXO©†V(¥f»ƒì £Lòw÷y÷$#ºEl ×èÛ€'<QŒ…#Ò?Éèiá~¬»XÍI‡ÞP›øAzKrdxZM킱¯0ì‹æx!Æ¿ÓÁÉËpbn|…Õ±‘ X^€ÄLWÇðÀto
XAÊæX‘ +
ô0~ä÷U¹ïÛºiŠ ™1G`\ PØ ÃËekØßö·Ðî÷¥€¬#Ëû¿)X”û§/‹~÷ÿ«ãRPs +ÃkúÏaGêþö‡Ó€ŒMp.¥)iaÂ4œµ1l˜œ°-~ å³ +óHb endobj -2030 0 obj << +2068 0 obj << /Type /Page -/Contents 2031 0 R -/Resources 2029 0 R +/Contents 2069 0 R +/Resources 2067 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2021 0 R +/Parent 2028 0 R >> endobj -2032 0 obj << -/D [2030 0 R /XYZ 56.6929 794.5015 null] +2070 0 obj << +/D [2068 0 R /XYZ 85.0394 794.5015 null] >> endobj -2033 0 obj << -/D [2030 0 R /XYZ 56.6929 520.5289 null] +670 0 obj << +/D [2068 0 R /XYZ 85.0394 306.3415 null] >> endobj -2034 0 obj << -/D [2030 0 R /XYZ 56.6929 508.5737 null] +1819 0 obj << +/D [2068 0 R /XYZ 85.0394 275.1221 null] >> endobj -2029 0 obj << -/Font << /F37 1026 0 R /F41 1218 0 R /F22 961 0 R /F21 938 0 R /F14 964 0 R >> +2067 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F14 976 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2037 0 obj << -/Length 3180 +2073 0 obj << +/Length 2797 /Filter /FlateDecode >> stream -xÚÝZKsã6¾ûWhO+WE ^Éã<<Y§jíÄöVmm6J‚,ÖP¤"Rö(¿>Ýh -iÕ¦#%—ο™Ï‹¶¨«¼¤(Jã¨z³ÊÛÇ ŠÎ\°ÑD¨(S\Ù殫ˉ”lœ»¦(ÕÖî»4D4m^ÍóÍ%OÇs—e>µ[ì Û݈ý ";s•·ëu½iúmæÓ¢,Ú]¿GÛ…É]'õ†¾óíjÝ/÷g]¹fþϘ( *.èWàpD<®¡Ï
‘$iƒ`‘ñød±*R¼£"ÐmĔР¶²ÉŸô(xÄîŠP«ÔCÑÐw¶ÝÐ`ª¶Ü+Ê‹2Ÿâ$Ù¤+™;1óÎtîeu¢^ 4ŸÓgZTùf×-o1á Ÿà‰ð -!›#Öôi@²¢z$Àt ïŸ
EÕšMÀÖ<os¢švs™Ž·³vKí¸ü‚R3 -ç|üñê1cº#¥Vùæ#hÂñŠÉT?,L(ë|¾ç+…©N¢LŠÔŽìBEdõ‚Ÿõ¦XYňŒ³y)À DY(D BŠ@D4¢¿í08)Å“Óà`Q*3}€ÛxC_óim.ùxÖš¹ë¦ïÔIñh*³ÉCö‚ô³¢9ùƒ
†p -ãG -œ0åó×uÓS™RÍø °A†¢%×·Ê·Ê·ð幜¢jŠ¹ñ2©x8ñÁo¹ÕõÀ`› øöX–ÖšköT3Š_
ÂÀˆ—Ë…´Àð
¹6†ÅŠƒ€ßÅ`E¯!F3u„hÔÆ×ÐÉ*ÿhz²ìõÌi>û¸]»ñ,öòXF°sØðØ)ÀÜ¢q¦ ’ˆóX
…¡h?¦£v¶~`áÁÇ™wb³‚£
g'êµN- ->+ˆw´p»#Å"¡eê6[ÊmµºÛJ¬ß@”ñÒö*t’ÑnÍ…ÕšÛý¬Hƒ›háß·¬í: -¨Wä4ûÖ-¿¨hÂÈ
kg¬˜Bæ¹q54gGm+¼Èg>“‚*m‘¾q<«IÁfëŸá2@LÈ|aU‚à+ëj=m7S“v·9ý‚”.ªY¹û²v(5«·¬Ÿ-É*3ï.€z6aãqÜ›
-ö iÚ—šð“dãj»šZ˜&äÁ‘W쇩÷7÷”MØtã³Yè9ŒÅäÒ±ñí/ïnß_ áB p¥±>£6*’%z4Ù °} ˜”)¬”‰ˆ_Á$Q•Àä¯[³)ÌËìvp.Hž:@²+´…¤Ld€$Ò6¨€ï ’˜úÃÈ&ìò…„…]Ž„õ;w”ÜîÖæe(žO ß a6R Ɉ|— ³(cé+P”I)Ó1òí¶}¬? Š¾NäO -í¡ØÚBQ1 ˆ4BÑ~È -¹ÑÖ¸yóÒ wsÏgSÝ÷ja·¢_Á³Èd I{â;¿.~.„»}œ+Ú8-·‡pOî.„•V + {犕]E€ÝèÄ -®’Hòìà=Ûµk»©ýÌ,·!z÷^-º]÷c½*ÚðÊdá %…æf‘oËv`á±óšÂ2£´y|»Rwt‰Ã‡¡zx®)ïf‰ê^ßJwU‹EíUì\Õî3ý»Þ-2ÆøJŒo+—S4¾}×µ¯².sâq÷ˆGÒ¥±{¡6ôl0¤È› ; úIõþ‘9N}šŠ¼<S°HeÜ …³À9?öÅîñõ±ì‡6naendstream +xÚÝZÝoÛ8Ï_á{sÐZå‡DJwOmšì¥À&»I8Üî>È6 •¥Ô’“¦ýÍpH™²§»5pEQ¤¦†Ãápø›áðƒüã£DE*ÙHgq”0žŒfË#6ºƒºŸŽ¸ã™x¦IÈõîæè͙ԣ,Ê”P£›Û@V±4壛ùïcÅÑ1H`ãwçï³ã‰HØøúæXÇã·øßÍùõÍùÉõñ$ËR1>ù÷Û_nN¯ˆK
‰âšŸ\^œÿôÛ•pyAä«Ó³Ó«Ó‹“Óã?o> ÞtÉ™Dí? ýþ'Ía¬ ŽX$³4=‹x–‰Ñò(Nd”ÄRzJyt}ôk'0¨µMÆY$¤V|ÄãHÆPš-É@h’x³ O8c}³µy[4m1kp„ GÖg£‰H#¥3i8£)n¦Äx™U
Q˺m¨¢¾%J³‘néEu[¯–@«+bÈ«9ÕܯŽy:® Š¹qÒó`Vyé¶fu›Ï|%ˆ¡ŠucVŽÖÖDº3>~×3TÂøpDœGY’;¢va Zf¢ +5Ú:¢ |½¿¸¦j§ ÂÐ1à-&Ÿ-È —¿œ\¾?ÝKaL? 9,`’d4Ùýÿ#*ãC¢R$‘ŠYú*c ñi;¨üumV…ÙÊ ƒƒr¯ÒP†Z[PJ-;PbA‰¿Pâ×'7$ûaW0,Xà
+8$S nê’:L±£¡^~vù¤_îï}2òP˜ÇãLŒŸ÷ƒÃÍÀw”™* +–>Gm¥;LÂù<+s‡„e¾úH¥?XÂþÿqjZ4ƒ®»BçDïJý-rú±ZøÅ= <¦é¸h‰„G•«¥cF(Ýç+ˆ,ƒKܺÌíîY»
‰tAH±¦§bÑPÕǪ~¬ M¤©¡okçÁ@á/
¾]Xq‚Ž'ñ7/”&x× …Õ6"¾øÏÕÕõé
Ñr‡Þó Î~àSf*⌿p<Ô¨XÒ9ãu=ûhÜY÷ù›Ë¯^•Ã®•ZîW™zú‡«r¦–q¦»U**Ó>ÖÖÁN!¥ÌчÎG Àö䆇ü÷FΕjÏDèˆ#”‚¹›9¡Ó(N¥„ Si”dľ;aþbN&°K5Ú¼„1ÉùÔF.,ÛSmÆýþ(ÝþËá +|îwV—¥™Q +6
º]䮟®6_·‹zU´OCôqa*w©È 9uœ +os¥»¹EV{s+ƒ›ÛM¥ƒ¤ì]*c® ‹ñeåjŠÆËw]û&÷eN4c>»NèÒq(ÖÍ×Ë{k)•º[e—\!áÆDéÊͽ™H îl<}r(ÿÚ‚>÷×\yìo2qBwqšd‘’™o1«+ä¼[¯º;tH|†íÝ‘&þ*¬Ó(¶¬[S>Ù¹˜R×ƸŠd¢ú~üPäA 'ú®äÙ"¯*SR¥uz—È
š N¢ Ï@vLàÄ 9k +i·*hc–67Ã~ìèPÞ\¤„¬ ™CEw¬µÝt¦y1ϽõZD´ÁÐNu«»®†ž¶„üÏ/ —]ºéúÚ?V°2mkùµ`ÜSggAê¸^ÐbWš‡6Ñß½ ÀQØ¥YʈoÞ•D°„º·%Ý-ÿõV=+ŽI_ `ÓIÿ‘ +ÌåÃ0³…Ÿòë×¾øÑüs`h[AîÕ«WÃÃxßõر l2-u–fqXN</žn
™ÞÜ2Ma‹¥¸ñq1×£ÆUºßœ~ÀÕÜ R«ßªâ3¬¤O¥“Ü°´ùòþ5íQ`Õ¬»}#¶ÈÈÆ€gÌýGaO±ø!¯Öùꉘùë¡HÉ3ÍÜ‹™³à!FÌ‚.h|÷œÅ½~ɉ…qø¶ÙÎö³™Ø= Í2íHqãM–È뿉Ýé&TÌM3[Sã ËLëÑàNwnº(Ú5¡ TÄþâŠÃ×Ë8:¥W \zsE/sèÅTYóÂ/*Ü ÆBúç@^ÜÒÄÁ7…K®û³Á»mU>äåÚñÑ kcà²+ P ß;:òھ゚ûá“9¿Š¡Yì*Ò ˆÆ¢öO¾TïTppîšžy¶)aý³SÈßÇ8pÍÃDNiR`_ä†h9ü•3 ˜cèÒ* UuKTŸ*E+Ò~ Üvší FKÐs¹zoÚk#…vk ¹.СH£ÄGhç{Hz ²¶£ @"u0wsˆ=ÅÌ ± +JÜzezmÀ?«žÌ”ÜÆ"j`ô¨Ò¿¶²PóâTI.4´òBBO#:øs²¿ùæfáÆ<<}nÅ:Áp啲aÇ;ªû·š»ºÿ‡Û_þendstream endobj -2036 0 obj << +2072 0 obj << /Type /Page -/Contents 2037 0 R -/Resources 2035 0 R +/Contents 2073 0 R +/Resources 2071 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2021 0 R ->> endobj -2038 0 obj << -/D [2036 0 R /XYZ 85.0394 794.5015 null] +/Parent 2079 0 R +/Annots [ 2078 0 R ] >> endobj -670 0 obj << -/D [2036 0 R /XYZ 85.0394 769.5949 null] +2078 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [55.6967 269.7901 116.8967 281.1822] +/Subtype /Link +/A << /S /GoTo /D (statschannels) >> >> endobj -1797 0 obj << -/D [2036 0 R /XYZ 85.0394 752.4085 null] +2074 0 obj << +/D [2072 0 R /XYZ 56.6929 794.5015 null] >> endobj 674 0 obj << -/D [2036 0 R /XYZ 85.0394 542.1781 null] +/D [2072 0 R /XYZ 56.6929 769.5949 null] >> endobj -2039 0 obj << -/D [2036 0 R /XYZ 85.0394 510.0725 null] +2075 0 obj << +/D [2072 0 R /XYZ 56.6929 748.5408 null] >> endobj -2040 0 obj << -/D [2036 0 R /XYZ 85.0394 447.7453 null] +2076 0 obj << +/D [2072 0 R /XYZ 56.6929 686.2137 null] >> endobj -2041 0 obj << -/D [2036 0 R /XYZ 85.0394 435.7902 null] +2077 0 obj << +/D [2072 0 R /XYZ 56.6929 674.2585 null] >> endobj -2035 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R /F48 1238 0 R >> +678 0 obj << +/D [2072 0 R /XYZ 56.6929 255.5751 null] +>> endobj +1689 0 obj << +/D [2072 0 R /XYZ 56.6929 232.5802 null] +>> endobj +2071 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F48 1253 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2044 0 obj << -/Length 2603 +2082 0 obj << +/Length 2914 /Filter /FlateDecode >> stream -xÚÍZMsÛ8½ûWèHU",>H€˜=%ŽqžDVv§v2J¢mÎJ¤F¤äx~ýv£AŠ²eQ±=[ªT…`£Ñh¼n<4h‰ ‡¢i¦´=cCqõ&óÞ»¾'Âë j¥A[ëýèä çÊô,³ZêÞèºe+f<ŽEo4ý-Ð,d}°Àƒ÷— l # \ú& Þᣋ«ÑÅéU`m,ƒÓŸß}
IK·’Ä?ýåòüâãס7ðË%‰‡gçgóËÓ³þï£O'g£fíE -®Ðû?O~û÷¦°ÖO'œ)G½;xáLX+{ó“0R, -•ª%³“«“/ÁV¯º4Á™TZî@MÊ]¨E–i%•Cmºš/Ò),KÇAUàÓÕmJ‚oœË™o—‹t’¡€´m0¾÷£@`€ÉDk2³¡#p§)«¤ÊÊ*›”o”†lù‡nYíGLŠ 5oVKYä4W±À6DKé(‘›6(À…%)d%=—}鼨ÒÙ=)%“IZ–Ù˜¦î
¤ÐLEð‚Ù(’nÖu–€z,÷-¿I<¹Mò<QçÝmš“ø ˆYÎíc ¼™r -qÄŒ‘¦5&§yEó¸å¡[[ÁÀŽœ:(tèè#ø ·‰'(|ã/ÓôÉ Và‡S‰ú–7=j wnØ–þžÔ«µpmWéÄ»æ¶ „üèÁpËG Ñêðâ±5tƒbGô’›¨7PŠ ÑbØ©ýàœûDžiç ¼Ÿg;SœCޅ̆"tÆšáUú½¢Öu±œ'¾]>0Š{•Zãô&˽ô.«n©•Ðc–åéÛºùßô§ k?„aVAž¡ oÞ¼Ù½ŒÍŒ -æ5 -¨×†¶Üe>Þ,Sqä«ùw*¶1cƒEB{5‡Ô-ÓÒwúgB -d™dyQ‘´¼-îr’¹£G›ú |¸Ð‡$FgkT[ñ%žñÖèôć=)m]Q†¢¬¢aÆï=ÝaA@noi4$©T@Y6îÉ&4§[¸ªÙû3ß²Ó¶qµcõèÒ?f§Fú xjv/“ÒtóFç)fÆcÔ{äf€ÃOnšã¬>Ì ÎqZ'Ïaç˜Rw T3#J*Ì]DZ‰ \Íç umEYµ“Õ
tÉŠrªÊQfI°p±-Ö9ÜQÑF@Úê¨EJw$ƤFaU{J~½ÝEŠ¤#€èÒëj^”è†@÷f«yN=.w¯U¡\ 7;è0˜’¼¼Ÿ‹)玱弢^#Hjºk¬(´1-½:)ýLMbcmCçR^Û<`Z:mæMiÍ}}ìˆ
º©†Fâ» >“dËôøZIÅuIcƒevsëÑsZ.3 €øz“SmðNº$JsôdêJwÃqc=Ó šÆÌ ÌÊ‚$5s_4·Mm-͈M½l¤Û]ãUå¦Ð¡™×“êÞ‡Eá.÷ÔéSPΗ]i7/¦®¤Ÿø ¨Hg`cœVî4Â6%@2MÆÙ ø w:€¯…
ÞM§v\š@×nïAsžÜSƒ ›ôlm§)I2?=[”ü8äÁ¿Ý½ÇÛ«y6:Ô¤i6
¶Óïþ”†6¬ç.u·'©ƒŠR åÕ]Ñ èpØYEÒ:mhP¹$DÊvt²;q}€#ïS
"ýéVÓ;6 »ìXEü°÷ÕOvíë¢Åb§ÆØŸe‰üáA4D{XEÔ¦ßöH f”Ò=%#‡&<è#C¨X¨åö7†g
ª½h¡õäü4Žƒ)߬Gl›Ô+þR,¶Rn¾úئ:f¸ž‚#241U™Wž`uh¥‹¥[-WXE fqûêá}—‡ÌX#zí¹_¶ ÄkG©˜Ýûè‘ÉzÄSÉðˆÛ\± ! ±H‚>"4Lÿ\ÁÝh ¹bT ¿ì8ÐØ…ê!ôŸ .>“zèÉÆY(/™¤°§@àMp <óS`¢ØSêÑ
·Kj炇äàÝ #מ‘=®6/Ãöo
—ÖŒ¡÷‡KÆ‚i¡ÔV¸ô…KÿŸÂ%Ÿ®¯®×ç M v„+2Ìð&ZgÓ¼äÝ16QÙ¾_Ÿ}¸¼ÂÚ‚»Š½i ²'!m9ûZ„õ7@J&´ †3Àé5Rï“)âò/w—…òÙè®òrµXËŠ -[‚›Zpð–Í·!o-æˆ!WœIÞÅ9Pž+›#btuññù0»Ñ?äÆÅ×ÅQ¼&Ž"f°¤Ž³VJÁbe¢ @âl -N³uºI^,Ѳt ÷?ÒIµ÷ÖŠŽ8‘
g¡â …0!ãB׍Æ=Œ„Ü©ª‡5¨Ï´åêÅpŸî"-ÁAõ¯×K¦Ž <~ýõ|Ø押þcç2ÉËëú³ÇS$щíÆë#æˆP³4;°À ×TB|]L“*¥\ÕR¼ é†÷Ã}žÌ³‰¯zâÛrýˆsW…,ÒaGE!4"QWø¡?8¨àê]^ Â4ÈCX¦yµº–SG ”LsÛµï¥sZ4(ŒÜl¹ÊñïÐ$æ¨o1åâ ÑÊÁ Á´åíïwÁ™ŽÂ®š@„L†HñNÊ8÷~Bè +xÚÍ[Ksã6¾ûWèHU°xÄÞœ±=q*ñÌÈšlj39Ð"=fJ"‘²ãýõÛ@ƒ%S¦e+S* 5€FãC£ +#ÚH¢(Sƒéü„¾A݇æÛŒêF£v« &'ÿºz`ˆ y8˜Ü¶xE„FL’߃÷?ž~šœ‡#®h’áH…4øáòê )?ï?^]\~ø2> jL.?^!y|~q>>¿z> qè/[ |ßë‰íä{^O.ß_ÿ˜ütr>i&О$£ÂJÿ×ÉïÐAsýé„a"5x€ ”0cø`~"• J +QSf'×'Ÿ†Z×µ 4%"¢"®;P㬠5eH(¸p¨}å\ûÙUq••U6-ñ÷Ùj¾ÀÒºÍWª¨Ñp7ÒÀfpÃ0FŒRÜŽC#¡cT»,”l8b”> ã}±Ê«tYz6¼%-pá’ɤã2¹K‡#!xp[̆,˜Yþ
)U|3KK[fA¹šÏãeö?߸lg«§õxØñ.®Žjbi ‹åEAqŸ%iiA©à¢Xb“4žÞa+lô€äâ‰U-)ÊõÎÎÍÎB]Å6Œ³ô¶š¥ƒYñf«yŽ5Y‰_ß”ñÍ/½Ïâ* ¤—óÀÄ5Îã¹gì¤a¬ž#PüÜöÂŒ¤aÓÒ7G&¥ Çñ5wÅC-R^óL7'ÅݤÊÅ5Ðü¶XÎV@?[)žNÓ²L¬†i`!öÕ?N&Ÿ²Á j¦wqž§3bqPl³eöíΣçZ9Íp +"C¾éÄ^Õ©–¡…ÕÎñ± V¾X÷Ød5Âù€;„ )×A…iái +CqõÚÛÖPî–Ñ/YM\òà ŠÛR[@*»BR„ƒöÐo›‹†À´–˜gƒŒ',ë ;à†À„XwôÐÀ£$‰B9|Æé_«´¬î%8-d0þÜáÉA‡ *Àƒº>—Ÿ°¹ôVÆq( O™¦°°&bÁ˜GZEÞVØvha,·K,ç¸ +†NEaÏbQM¨ô8Àb'yIû—hÜ,ŠÍ‡P:?»º¶uqz ÑzÅv"Ú’öP¶êЦ ÂWÀ@Èç•R S£ôCœXL~ 2ˆaÁ%¾ÙU^®‹bYa(‹Pc \m‰qä‹ánOåháÖ +E“!œ®ª»ÏËÇqú'ä!‘TÁøË :Û«Xf6¼Oלoù¬¸±ût¹6,ËÒ
ØÿL§Õ³°·¦t´ZÌ Ñš÷…0 +UÇÓt©Ð_FkD_fKÒ£E؈é¾(˜H*0Jøívé° Ädã/¿]ŒûÁüo‘{ «eœ—·õéÆ.ûÐ mKìc…V@$…=È +cˆ”¸[”¾,’¸JQQC. +øìaA–(çQ{wHE µˆÏc© y´VÎæ;\ç= +/âíwQ_Þ«r㬰Ül×z±²[åÛêô6ýüçRZHý Y¥=Ö—kC"ÔoÓÓ…RŸŸ¦PµÆã¿B}šî¶µ}'¾-ÙÕ8óPBVªzŒ3µ}DÕ +[>N!Q]Ƴ}Œ¹”[P[Š3æMgê(v\Q[A)ŸXÁ.‹^ø¤ºÛ&BîAXŠ".wOœ1ØïÐ7ü¦°µ‡ºÿ6eÝ˺Ö=vh •DiÓg +'T‡¢Ùª/—eZí³7¹ÞÞ›@Éü㘵ï]7k"0 yçkß²ø2ýǤKWP±˜yªXŽhUÉ};U Ç=ŽÒç;§ K,µbÛªd9[±ßMU²ûØHøÄkÄ@ #k½F¼Z×Zëø6ÅøçÜ3 ÒÙã8£[¸> [»ñë…=–?½ü ˆ(x‡‹8› Ì9ØA€= bŸÑ^þ¼èö$ŽÕÿ²ˆ’°ï̈EÌ¡j¼ÀÅÇñ/° - ¡xϗ˃Áëy?ƒêZâcõL…2ž%¦9”ªÆRþvöñ—ÓË«¡í°Âï}Ü,Ûn–y7 55o‚?½Ke¢#±`ÎòíH–:ì Ę·6f0)æq–w.#"yÄ¿›Km/±ºTÆ)ä
¢ÏÌtÂP¶ÂÜ=Œ{ûjmÇÉç=UÅg¹NâU‰ú"êwÚ"(ýƒKG,ð»H—ö-t[×jA:ÔÅ©ž0ö2Z&Ž™¤È Èöožx>6÷D éV ¨ë„Þ¶{ªµÈyÇ#õ>]¶ç±¶Š0Jå÷SÛ–J Ê;+{릢=XÖ=ºÕ6d„1Ý2Ɖâ²qg+÷ØÞÄ.T0Â>ZËCӜ̈́ÍkxÓhª-ÇU•ÎèSl›¿k]õ}nV’¬ì|F?-|†‡O¡{Þo¿îm¶{;mÙc£! ñ†ž¶ä„³…Ò½`¶¥ËOžQ’xÕíþ§ +û"Ë=æ–Í¡7Á噣áÿFøêêq‘bml7’Îâ²ô´YýüýënR|ò-j…-ºgîþ¹Á>`7Í”îÚqñußî=f+ Cí2iÖ¿c“ÁvÔMËf“YÞ°y0¶¯à¤›Ò tëµÔúmÛDÂÌ…ÀF$a$E×<ÑAïYÕKÿ¿jý gRµ_¸md"øƒõ´—x¡¾1¦žâÿ«n×’þÿ›ãvendstream endobj -2043 0 obj << +2081 0 obj << /Type /Page -/Contents 2044 0 R -/Resources 2042 0 R +/Contents 2082 0 R +/Resources 2080 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2021 0 R -/Annots [ 2046 0 R ] ->> endobj -2046 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [55.6967 732.5838 116.8967 743.9759] -/Subtype /Link -/A << /S /GoTo /D (statschannels) >> ->> endobj -2045 0 obj << -/D [2043 0 R /XYZ 56.6929 794.5015 null] ->> endobj -678 0 obj << -/D [2043 0 R /XYZ 56.6929 718.3947 null] +/Parent 2079 0 R >> endobj -1674 0 obj << -/D [2043 0 R /XYZ 56.6929 695.4159 null] +2083 0 obj << +/D [2081 0 R /XYZ 85.0394 794.5015 null] >> endobj 682 0 obj << -/D [2043 0 R /XYZ 56.6929 492.5344 null] +/D [2081 0 R /XYZ 85.0394 741.8766 null] >> endobj -2047 0 obj << -/D [2043 0 R /XYZ 56.6929 467.9557 null] +2084 0 obj << +/D [2081 0 R /XYZ 85.0394 717.2979 null] >> endobj 686 0 obj << -/D [2043 0 R /XYZ 56.6929 360.5123 null] +/D [2081 0 R /XYZ 85.0394 609.8545 null] >> endobj -2048 0 obj << -/D [2043 0 R /XYZ 56.6929 338.2011 null] +2085 0 obj << +/D [2081 0 R /XYZ 85.0394 587.5432 null] >> endobj -2049 0 obj << -/D [2043 0 R /XYZ 56.6929 338.2011 null] +2086 0 obj << +/D [2081 0 R /XYZ 85.0394 587.5432 null] >> endobj -2050 0 obj << -/D [2043 0 R /XYZ 56.6929 326.2459 null] +2087 0 obj << +/D [2081 0 R /XYZ 85.0394 575.5881 null] >> endobj -2042 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F21 938 0 R /F39 1161 0 R >> +2080 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F39 1173 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2053 0 obj << -/Length 2944 +2090 0 obj << +/Length 2532 /Filter /FlateDecode >> stream -xÚÍ[Isã6¾ûWèHWEìËÜ:m;ãÔÄîÈÎT*Ë–ènf$QMRv{~ý<l$Q’ÝV§\: -óyB!̽¹µ“ÂÌ›ÛË÷7§Þþxr~Ûm Ý$ÁÌrÿùä÷?ñ`{ýñ#f´<ÂFÄ:˜pÁàŒÅ–éÉÍÉÏ Á¤×Mís
XQ¨qÄ(Ù³¬_ò¡ÊÒ«U‡®@Â0iw -”$§` -‘½»ü7 ¡1ø†‹¼œ Í5ØE€<,b#ÿËïÁ9ÙÄq½/9 Є"¡!•Ú4‘ˆ(Ü9‹ëÑO …© -‘TŒ €sDIÐfk*=»þéÝ%$ Äá -Ï/q³„mºYÜ,ôDÚÈ?— -µí¼‚8Ó·#Wê1„1¬eg'Õ,‡U·‡¤”SMþ6—š Â[u© -D0æŸØ&"q,ÿ, RJ¼„dœÑ/¶Ü -Cwû´(|onÉöŽ§yÓ„¶©_&Ÿ<ù¾»Â±m«^`«aßúöŽ¨˜€ÆIÓÝ?©>S _WöëX|)¥ -9éοGÉ@ U7²S2K”ÇÁF Ì_?§£ª^"Ö¯S“•æÓ’¿è6Îè×<fLÅ6®9 ϺÈø¬® äƒÊ<‹½ë` -;ô ÀôÛ -é\‡Š†*»€:èÔšúØ9y¯‹(¾XióË1šÍ—³;G„wp¶m¥oö)q:~Ix„~Ï#T‚DnªµWGAeÔ#H¹ƒ ÙF§G¶ôhí1ìÈ?5Ë»¦€µçíô©ok^É ì K„^™ KŸÄۺݹ- -¶aµÓ¾Õ–áæÙ_ÐÕ½v0¿Ñ²x.¦Ÿù°{uSMwúIHs%5Q3§%ì¸.B~ê-TÏr7o
~‹eÏ¥ Aš’è‹gù—ás—˜ jb^-Z¯ù L× XরÆ×è`¡uR4ãº\ÄÄšJ¤„Õ«µˆÁEV¦åwÕ²Ý4Œ_S”
8d"†Q—6øÎúãÀWFÉÛ˜nü0°¼Ût÷"ž²dg0lôKÛ¯…⨠FÖŒñ5Ë@ €(xd ЖW°NèÛ§í@g`!7õe—‰âA¸ð÷å
ÁÄÊ×Ûìoè0A -ÜÕ~7ÀÀ¸cJ»Ó^„,ëâ°¸†£³†TŠƒ0)³{7Ý ·„ŒñŒÛŽ`†‹ sÇe,ÁHI mËýNî†ÝÈõH%ŠgÌ 1ÿ. -¶g% -¶ßcAl ˆÂP ]UmñOØ–²ü–½f6 LHæ#£¸bõPN¢³³ ðôÉ÷v^ó. ÿ÷1÷¹ïW³EÞ–wå´7-Û'Ÿ{íòrŸmÞÚt,îÒ¦J˜ÂfêY> -¹/fUô`öÉåZEo ø±Ž.B©¸éÆ?5K€C-oúü…½‘$ -’}æÖ¿zŽ‚'Šu úú}1HR%VáÉNj P'%7ӿ܆úBdÕrê¼ à1m*ßx ù¶rÞ†¶Ö›7!Rc“"x¶'=ôïÜEXÜÀVÈau -¡¼–° - Ìšp|Þ ž³'ÈùʱGn™ -äBÁ2iNÈs d\Ã>{†ý³"#øˆ1o·) ba@p™¾¬`n‚ôÂÁ=Qïožfw$ˆ`¨hvæïÛðžpíHIi™èÖx Û †µ>¢iX!a "e»dm……"Ê®WU[Þ?]/ÛÞc GJð˜Ê_~€AáCʶ´÷ Ñ87żE;ÁKØzÃàie?è’À3Œ¥ØÉç`'¿»„«7Œ‚p“b~ +xÚÍ›YsÛ8€ßý+ôHW
±¸}s|ÌzjÇNdÍV*3ó@KtÌY‰TDÊŽç×oƒ EH¢DÉvjY©Š@Gãc£»Ñ¤É +V°– óhÝ•A +¥Ÿ hDP¼Ì«Ê(¸ÂxåùFÝsµ"w•/ïóæN‹éËúLNû'eã;(3¡À`ô˜Ø1Pý[â³…zå¶lWn½lE³Ò–uM–±Ý ,(2ûëÖ_V8™£<KÝøû|%© ÓÞ~NŠÇ¦‡Ó_£ˆdˆIØAN?ÆÓVœ‡sÇ"´"½´¨U¸ê·&¦e¹=%HS"«)fÑ÷ðÐiæ¶7ºfó"ÉR`Ë +þÀçql/´Ãak'q>^$ó°„E"%°^tv`Ý¢ûlYlÚ†%"TØm +LJ«ân.¾\a虃UûÐï°½y·ÇÝK|M$Í`Æ×DÚ²K«V-‚øT·G³‚ +Ð%eø&ömV‰°dbÖ
ÞϪK4Ýï$lCc°© ÁU”L—‹¸ÛÜÂó¦TŠÀi eðPvw ¬š²ÒÛnKl« öf».P‚‘’¼¶.;¥ W-×”f¥ à‘ˇÌÁô¯+ƒ½Ó(ƒ½ïÚ±Jl
(C¨…n²"þ',KYy“¼Í¬¯f´N\¹ªgÌž’Iíîf`b§/îîÊoÞGãÿ>GeÛ‰»5Îfó¨Hî“iØfÕ“ÂAxe¥mÉ9\(¬¯’‘f•6v³˜EÓi5Bä~fYíÃìÕ Ó4núë¢vJÕ‹ÎÝU¾´Þß–¢¼ÍcŠ„$µ"-‹GP¼aüWËc…0…bª¦íÞ@(C•h”£…ÄØPJn˜óǨ°›^ÏÙrZú=à1Í3Wù +÷±û-£ ø•ÌÁCÉ) ʾåN+ªÊÔ5›/¢qëã,’q¼Ûâù¶ä½,^=ûáCÖ=vZ< âJ¶ßà (0nd¹êÏ‹aüí"KãC"_°syáâ" üm;•¥b¥ùƒÓ~¸´[v6ªÛ‰³ômKÿ¡4E+ÝPÌp^"úm>‰Š@]= p”p 4§%à +#ÅÚîEéIÙc– #
‡‚–œ#Î ]c™Ï_ Ó:Ù<>’¦'çûÒ$ïI“j¤ê8â +Fלxx€¤oºi^¼Àé/;vKDZª€ñöõdí±~‰ §]¦“bë1 ÑÃLg Î#Œ¥'[ Úƒ¦V¤ƒ ÖH(¦||Bæ* Œö 706ë8«€×F’héÑûM>.âEüí-½ü+ ¯œ{•-ÁU¶du~¬ÝT’'+‹Ðœxv?oy=~š ¬d‡Ã“Š¤=û—1ÑÇ/Ãøy‘q~H +‘JàMCÃI!=†íùÈ
„)œ†Ê™»1º uÆF¾>«"’2Ý‘hD ®ÜêíÙ±Žº¸ÂêðÑ“¬Ï +x<>O®>ãƒ8OcÖኩ‚9´q®øúÚw}4>O®>o^ô4ïð TÀ)™q¹Fïå;ž^#VŸu<mh=.W†×oÉî–cû!V'¾/[oÅv½ßÉíˆñd/POÔ>…pÏ0ÕáŒ)ãHÀŠj¢;ò¾¯Å¹#
Ü°ô„|/–‡§Ì~DƇHƒ˜¢¬NšÉC’fJ#Í°ØŸ4#R#®>tI3V%͆qžMŸêGqhž¬N³Xqÿ?™Fü#Ç„AœI„lÏ’Õ‰c 8J·³dö;]Ѭêì”}Ù³U*ØŸ»¿o, åˆJÜñÆ’PD¹pó“ý¨Êzr!¤ 'ŸºSìïïÙ„žpý};a¿‚]ÛñŠÒZ[mˆñÊ£ÊãzÂõ!X>&pÇ;J‚x +©ÖÞÙXµâXª`8<F [¾DØ›j€z¢ö¨ÖöÛ³Ÿ§Atõöe…S ‡S¾g)hÏ7¸’öã—Ž·#L¥ Ko>_Üþzv}c¿çç"Âu7̦Óáô<Éú‹OrûµKÇFð‹!ªq.ørhÿFæ?W§Bg×ÿ¶_nk û Áö†~ÐÛþµŽí}8OOÔ·ò´ëâ´ ± ²í«v<è„}èßö4íÄ Íýo«}TT å€AèÏ\IˆÜâA0¢ "µª™'ûÿ endobj -2052 0 obj << +2089 0 obj << /Type /Page -/Contents 2053 0 R -/Resources 2051 0 R +/Contents 2090 0 R +/Resources 2088 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2021 0 R -/Annots [ 2055 0 R ] +/Parent 2079 0 R +/Annots [ 2092 0 R ] >> endobj -2055 0 obj << +2092 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [333.4761 409.1267 413.3061 421.1864] +/Rect [305.1296 684.0956 384.9596 696.1552] /Subtype /Link /A << /S /GoTo /D (clients-per-query) >> >> endobj -2054 0 obj << -/D [2052 0 R /XYZ 85.0394 794.5015 null] +2091 0 obj << +/D [2089 0 R /XYZ 56.6929 794.5015 null] >> endobj 690 0 obj << -/D [2052 0 R /XYZ 85.0394 160.8154 null] +/D [2089 0 R /XYZ 56.6929 435.7843 null] >> endobj -2056 0 obj << -/D [2052 0 R /XYZ 85.0394 135.6948 null] ->> endobj -2057 0 obj << -/D [2052 0 R /XYZ 85.0394 135.6948 null] ->> endobj -2058 0 obj << -/D [2052 0 R /XYZ 85.0394 123.7396 null] ->> endobj -2051 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F39 1161 0 R >> -/ProcSet [ /PDF /Text ] +2093 0 obj << +/D [2089 0 R /XYZ 56.6929 410.6637 null] >> endobj -2062 0 obj << -/Length 3122 -/Filter /FlateDecode ->> -stream -xÚÍ\[sâÆ~÷¯àíÈuÂdî—Gg×Îq*kg“J$2ÈkeArØñ¿?Ý
ĤŠÚ*£ËtO÷7=}™-ëQøÇzJí¸ë'‰¢LõƳ Úû﾿`U›~ݨ ¶úntñí0=Gœæº7z xYBe½Ñä×HI.¾»½ûè.û\Ñh8º42ºÂ?£ÛáèöÃð²ïœåчÿ\ý4º øV: ôO*ò÷w7·ßÿwP1¸¿ó×7׃ë»×—¿~¸¸ •dT ô^üú;íM@× .(ΪÞ+ÜPÂœã½Ù…T‚()Dýdz1¼ø¼b¼-IÛ@“”Æ•èõ…%R)»»[ß…n«KƈSj³×>£Ž0ø*Q©Ìj 8 ‚1E¤5=£ Ñ‚‹r îòEúø6Hþ@t€€€‹QÒ@/Øò6ç³4ûâQÍ€î7JyRøûù%³QòG2^$²‰4ˆD$sØu#àû”ÒæêW
N‰£”„:ª:p”†hc¼Aï¯î—‹Ù
ãOÐÈ›ûý•¿øs™ÌÓÈ"É{ -a$;Ý«1ÄYígÐñ ÍPŒºåu'²ž¡›$ÓäKŒF| –^Ê3/N„æPÇÉŽâDhM¨`¬ªö9K0‡.X~øÜ[Þ¢YƒxNæù|¶Ê@È3†RQ"ë¨R`zj”kp¹zh÷Í-®@‹‘¦žî“e½šž×¹M¾¨]lž-|Ò8݃o ù©ð -JsuÌÕ;ñe’iÑåN%'ŒSÓà;ÌÇ_Ko‚Dà£ÝüoþœTÁ‰6©#ÅDbü5Y@Ö±PF÷å¶< ç³Y^‘z~qáW{7óšGÌW˜¸qô„W|- õïÒ¿‰ýmÐÀ?Ç°Š/VR³äÕß{QýC´˜–<£¶ŸÊv¦é,]ÄAô®~1 ™®œ£_̆šd}#÷>cøGç/åDkÛV¨&¼¬´¯.¤³$_.Žò„ O³·@¢ó]J€l’HÑB`~A©·úï§Ëä&D×T…2ߊ£vÊmµ)ªjùÖ~2Í^ò¯ûBK(üù†Üæƒäµ#´pˉ€ânb}4Äú´ÂŸ1ÄâXÚU:CùJ a7›V|X|9Ôz÷î}7¸Ÿ±w€|ÇvÕ@\Y"…Ô›–{0¬ú„°6Ÿ±µB–c ï‚Uj"ó¥åÏeiO¯|iÝ
ëÇ»áðúƒí%ž¦“ ¨êó½8"ž1‚'LGÐçB -yÿõ}î>*Ô`Hw* ¹ nï¹õ-–5ÅN ©!”›®èÄ9Qº:zRcx—|9F#ÝŒ¦ÊJñyVé/‰šfXTÍ -˜ÕÄP¡ÌæçoåFáh”e”—«ómÙ¸\MÑ"~(+),Þ2_Dúj}™MªP]UWP/þו—Â@Ǹ -ç <DëÚ”Ö=Ç®(¨-ÞY®45Ðá ªœþ‹‹>”t–àqapþtÙæ×)´×Yè ú|ó¿HCdƒ\;΂ßwa¤Ö…?œ ³jkT rœ U³@öÿËëgfendstream -endobj -2061 0 obj << -/Type /Page -/Contents 2062 0 R -/Resources 2060 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 2067 0 R +2094 0 obj << +/D [2089 0 R /XYZ 56.6929 410.6637 null] >> endobj -2063 0 obj << -/D [2061 0 R /XYZ 56.6929 794.5015 null] +2095 0 obj << +/D [2089 0 R /XYZ 56.6929 398.7085 null] >> endobj 694 0 obj << -/D [2061 0 R /XYZ 56.6929 615.1118 null] +/D [2089 0 R /XYZ 56.6929 185.6451 null] >> endobj -2064 0 obj << -/D [2061 0 R /XYZ 56.6929 589.9912 null] +2096 0 obj << +/D [2089 0 R /XYZ 56.6929 160.5245 null] >> endobj -2065 0 obj << -/D [2061 0 R /XYZ 56.6929 589.9912 null] +2097 0 obj << +/D [2089 0 R /XYZ 56.6929 160.5245 null] >> endobj -2066 0 obj << -/D [2061 0 R /XYZ 56.6929 578.036 null] +2098 0 obj << +/D [2089 0 R /XYZ 56.6929 148.5693 null] >> endobj -2060 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F39 1161 0 R >> +2088 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F39 1173 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2070 0 obj << -/Length 2407 +2102 0 obj << +/Length 3456 /Filter /FlateDecode >> stream -xÚÍZmoÛ8þž_áP³|Á hÝd× l’&.p‡Ýý ÈJ#œcy-;Ùþû¾H¢lÙJZ'{‹Ôp†œyf8äˆ 0ü‘3ÃÊp$0ƒôá¾Â»ŸNH UD£˜êãôäý9SƒŒ¤r0½‹xi„µ&ƒéì·áøçWÓ³ëÓx(ÑéHH<ü8¹øä{Œÿ_^œO~úrýáTñátryữÏÎÏ®Ï.Æg§#c4…ñ<âÆÞLí 0òf:ßœþ1ýåälZ/ ^$ÁÌÎþÏ“ßþÀƒ¬õ—Œ˜Ñbð
Œˆ1tðpÂC‚3VõÌOnN>× £·nh—Ò(#H 61Ž´Ñ1Ãij¨X$eµŠ)éR1•HNŠVâ§#‚1¨£Hÿ›½j&ï/ƒŽÖÉ:/×yZ}›Å:[•VS ‚F"0L#à wÌ+vÄvö¡ŒØÙvZ±sduJô0óYö;Æt‘Í|s™‹ˆïúÛ2+ßÁÌ0 >Ýçé}›Ÿc¬ -“JZõÙ9~ùtÅ;VB
„TD¿cðýäê‘Ã3y×ÁW -BŒ~KxçE™½ lyS;dvÀ(Ñjµ•¼†Q$œÅ„î³ $yœsù–6ù˜/fßáòÖ6Öåíï-° ,n\~¯ÅUü?LÀ)Ó^‹ÁéŽkó¦{ÿ¸X,~Ðb)°ÈÒõ Œ©ã¸V#Gµd¥†«¾ŒMp‰¿±Õz-6v©O/Yi„yy_ [:R·½6‹”q,›1´â,«ûm†ÂšöîWŒ#¡Ì›¦C R{–ü_ƒÉ:_Œ
ÇĹšíÎiñP·ÒÚà¾í9ü¹»{oÜ΀BŠN¸Ë¡NÉÐgéЮú}–N˜O£ªŒ ^¸Œ ú»3&"$2Fò枪ûj†ÂÙ-Ðt_¾
|xê5¢ÎM‚³ö Âå€:BË!ðUAÍA”Ⱦ@Ä
œï “oê^@OjœJ¦"œ–¶C×qèB‘ëôP·éÚˆpE=X»Òø*ýçʧÿö×áÖ>ĸµm‹[÷»·)¬Íaܶ±”qK ‚5èWÂm ˆcáÖŸ.ø1Ϧœ+`.Y n%Ešë7
Æ7Ùbv¶Zõ×Ò@-ìe#SÌ]ô1Åë CÛW/ÿÇÕUâp
•W‡TxÕ R•¶žmÖy.-—ÅbVÖÓÝ•pX+5ÕÅ÷M÷:(EœˆJkÍŒOÜ:˜‚$©y[ÿê¬,H\›B @hdúc o_#²‚Þ9Ç}‰9g°
ÙÚÄ"ô:K _ŠPŠ=Bm™ª¾Ò†>¶4Ë 3ÿ²Tjx• ¸ñé|3ËB+k¸w\Ðù€ - `ïßÆþ¿þVþŠ¿ŽüY ¶ñÕ3¨ïß•
ݹ»-Ÿu9Çí·p îÕ'ã_¯Bv[MÕ7 `CI¾ ¸‰m¬ ÚT[ÿŽ+|"
bŠÂ^B!¯Qí²ïŠ.Óàz6;XÑeC˜*ªèŠPÑ K°úm>Ï×Á>Où:ìw2®À˜™EÏN”iyŠF‚ÐjƒÕ½á‘M7!ØÈvaø×¢´šÒV5˜QìÛõ}èž²ª¾c©šZ’{™/º¦ŠmØ”âpØd`KJ›õXvIKÔ¼,ÂT7Ëe±r ²W(ËqÎè „š 4( ¼/žµ„ …ª©8DG¶U -Nn‹Çê²ÔêÄ{½ús—ÄvêcUÝì¶Ø„òZ‚VÕÅASÇÃÁ ®xVÔ Âðå2KV;¥¶rkBÛ U`„¤Ts@¡Ý_Ž¢QLµß j*¢ÏŸf×ïnìÿ²ž€ pqPxMÕ!½UF•0Kªt[üÔk€qZ
´¸áÐ# š·YšlÊÎ$ظûnÙ / Šà<gE¦¤Ša2+–a®8^º3ª}®r‘ ½ðʫO”`¿†3£À¦Í§då® ;&)œUsRv2u#É‹òž +xÚÍ[ëoÛ8ÿž¿ÂßNÁY¾ ¸ÃÝ<ö²¸MÛÄ{Àaw?(¶Òµ%ײ“ö¿¿‘²hG¶’Æ-‚µD‘CÎo†ó"Ãþ±U„ +'ÆI¢(Sƒñìˆ>·_ŽXè3l:
ã^?ŽÞœ 3pÄi®£Ûˆ–%ÔZ6MþHNþýöýèìêxÈM49 *M“Ÿ/.O}‹ó?'ï.Ï/~ùýêí±‘ÉèâÝ¥o¾:;?»:»<9; :g9Œ—…0öz„ƒÂÈëÑÅÉõñ_£_ÎFkb&¸úÏGüEàõ×#J„³jð +Ñ´L®>¬ F_ë¡] Ii+nCa‰TÊîžÖOAaÚðÈqJmÏ:tp)(M¨Tf-Î")8 +E g®Æåìôòšž§ù´ Bìú'U”ÂÌC÷y•-¾úÇ[ ±òPV{Pô+”‡D6— ö ’~„Ý¢6œåú”’ b´¶54¿åÕ,]Žï@%2ÉÕéj~Õh;ŠÔ°š—E•¡fšmÍ +ÓÑ]æ¿0ü¸‹ÓŸ ø[…ÓÃ<k à «ÒKhŒ4KÒÉ$ ª†PIZLÞ ³7vXÞ…ž[´ë¶mjór±ôO“2뜿(±ƒÖIÃ6<>Ü¥¡ñ!üCöež—žeeÔ9Ï6| “ Užnêo&Q¿—‹Íɽᨩ;šL²?)åE6ÁW–Ü|õÍȪ—X,mãC÷éVOþX¬œÃÀºûNå|™—ñ›D£»¼òsÍÒ0Y½bøM ÿ!/&ù8 ÖË 2J‰£Tnb‡DýN+oýoêÆé¸ çe^•E^| –Ël6_îÞ±¦¿lë|?›¦5%’Ê ›¦µ ÎQoÓFÇ üÂbUŒSТþ}8:v¸×lÒŒˆÜB» Ÿì)â ÖS°Ã¡ +‘”Ž÷ ª8DkÊÛ¸ÿ¤3P3CÑåÖϽ¸úÜ$›f STáç!òµú\- +ÿ +ßoï*£! +'HåÖSùì ¤KßÏRðkÂïK½.÷v3¤ jÌ}—jžsÌüpYV]—Õsì.Ú2ã¤Î?ñûí +M¬äæ)ç´ ¬¯µÝ§´Ã†à0¦øX{„2\G41®u@Œ¶ž5Bø©ƒEM˜•r7‡`¬´Qú€,6ûx´’h
KÛà‘÷ó9 h!]Ü2P »s»’s•= »kŠ=ìJ®—f‹ÝY»G*m6Ùõ[Ej´¥«}‘Ôð +&„'Åjvƒ'Û¬5lûÜT;ñåᮬ2ÿ=6…þcÚÔÂðå&[>dYÑeòÀ Ikö€+ ç´ Œ£µF +Í· +úþPÝ®
,W& ½ÛÖÀbc0°Ø¾i`ñãÚÀâgˆËÒ©o÷çÖß´ÀßûlÑ!‹í dÁÅ€I(DŠ/wkkŠÃ˜d‡Q¡Œ®e;ó.¿ +È +§Z²ú9dõ.²`‹ ?ÆnnîÑI÷²ëŒÈDô¡ãþeCH¤'õs¨ê'Qý½È¿tQMÑ6†û
9¸šÓr–æ…'^gàÝA”£b¿x~úP_ëÈŒ„Êk“‚3…ãd?žæÖüø¼ZVù$ó/mâ, ÐcÔn_k6‹Jfåd5à r¸®“o®tãTr[N§åC¸n¥C¢^+Û𧌅Z†ÿìºf¦Á6¸þ÷þ¬ƒ ¤QRËÆ+ÿ«;v`›y 9ýʯ:õ«YÅ
˜¼¬¯èÁ÷t:õ ÛÍ\nýô¹OóiÃ5Ø Ht ƒ ÇôuÜS¤ÑÔa¯ÿ#\Ìý2ÎæÑ%¡h.Šw›+y(§-ï¶NÒóø˜=›>®´1aˆT 7 ’Wó)¾@HpˆÔˆç9ƒîQÍBè+›k¦@ endobj -2069 0 obj << +2101 0 obj << /Type /Page -/Contents 2070 0 R -/Resources 2068 0 R +/Contents 2102 0 R +/Resources 2100 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2067 0 R +/Parent 2079 0 R >> endobj -2071 0 obj << -/D [2069 0 R /XYZ 85.0394 794.5015 null] +2103 0 obj << +/D [2101 0 R /XYZ 85.0394 794.5015 null] >> endobj 698 0 obj << -/D [2069 0 R /XYZ 85.0394 744.4469 null] +/D [2101 0 R /XYZ 85.0394 316.2326 null] >> endobj -2072 0 obj << -/D [2069 0 R /XYZ 85.0394 719.3263 null] ->> endobj -2073 0 obj << -/D [2069 0 R /XYZ 85.0394 662.8979 null] ->> endobj -2074 0 obj << -/D [2069 0 R /XYZ 85.0394 650.9427 null] +2104 0 obj << +/D [2101 0 R /XYZ 85.0394 291.112 null] >> endobj -702 0 obj << -/D [2069 0 R /XYZ 85.0394 368.7785 null] +2105 0 obj << +/D [2101 0 R /XYZ 85.0394 234.6836 null] >> endobj -2078 0 obj << -/D [2069 0 R /XYZ 85.0394 341.1871 null] +2106 0 obj << +/D [2101 0 R /XYZ 85.0394 222.7284 null] >> endobj -2068 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F11 1451 0 R /F39 1161 0 R /F67 2077 0 R >> +2100 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F11 1353 0 R /F39 1173 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2081 0 obj << -/Length 69 +2109 0 obj << +/Length 1514 /Filter /FlateDecode >> stream -xÚ3T0 +xÚ½XmoÛ6þî_¡20³|†iê´.Ð4M\`C׊Ì4 ɵäý÷;Š”,Ù²½¬E "©‡wÇ»çŽ'“à ‰„DÒP)ÑÀDDéÓG_àÝë ˜IštQ/ç£WLEIe4èÈÒkM¢ùâS,Gc€ã—³ëWf<¡Çwó±âñ…û7ŸÝÍg—wã‰1šÆ—o.næÓ[’~%l¿|}5{ýñ6xí—o§WÓÛéõåtüyþv4·è ’`æ¬ÿ:úôG 8ëÛFÌhma‚1†FO#.œ±fe9º}hvÞÖ[‡œÆ1A„ +M$ELJz\WAm2´bOë„`ƒüƒ@0Š¬
!@"×*R É(«ñ»óÊ‹+Ú*¤ ×€ù_7Sé £ Kr @œ“r‘¦vUí²ƒ!å‚àa³<-ž²üËx"™ŠÓ"ÏmZeE^º —S–co–Ëï~1©EÛЂpEãùcV:E rB2BÐZvZlòʮǮL ú™• $«Õ2K“û¥õóªÏG;p6"RX7f|u3p4*‘ÁRL’/Q¡Ð:`®^m“*} 5¡# +ä꟩ú¾²%Ú'6 +qb Ò >üÇ׈Aö‚! ™“Ùr ²Ùqœ¶X#JÅÖ‚%¥þ•¬½³ùbº^Ÿ¥Ã k`S,Îr÷äqY¤ÿØʯ• ËŠ•]'5«²RcÏØúUËQ·;-¼X;¢s¹*òEéK õð$ ÎJëHÔG>¥ÀÑœ·Uï„CB-Òðµ.ÁB¡¾àÖ‰ú?wÿ1.íèÙð÷'VU© R s†ŸÒ¤…ä¿’Ÿ·6ýö\~RìùI1mùéÖ<ÕR›}³þe¦Ôð@S¿?]n6ÌìNz§þ¦Tà?²#Ø¿)rÿLü#T}Ю¶z±0†²ý1µ‹¡Ô¸ÿîœäþ9»|wãG©~ú—IòÅ 'h7ô?«€îšƒs݆ۣ°Úë6þß®Æ"
bPK¡+„U¿K9èV¨Ò@nF! 8GZwŠt•M+%! ʸéñp-c ÝYñ´‚¨ßgˬ +ñÙfU¸ëd·a$`™cÏAéeŠF€M ¯_åÐJÀF ] Š#É·ñ]QºúL!*°®¬²Ô•bJšZXú·Õcp[ë3Å£’oI¶ô]ƒ{ ‰5`*vE³mŽM±¤tw '.é©Z–E0u³Zë:CŽ*%ÜÏ}†R””Å6o5/ÔÍPä®'Ý®îç]r_ÔÅÃÝHÎ'®p0‚ã7Ëê¬ìN ‘m¸Ä`÷¦ +W( +)º C-¶ƒ-ŠV@ؾZÙ$lÊònË=ƒö¿€¯„ÈH +¦÷6M6å`ëk(n|ŽX +LZEœ,ŠU0Àq«y™¹+Á› „™®œ Ì¹Ò Šµo&ÔÐ#»+»ËÊm²^¸OŠ#%ÀYSC’rè´àZ#ɳú@Ðlqœm˜A_½ìi¶uP'ØÖ j¶]üyuÀ3î"ÌœÖÚ€´vj2 ÛÓƒ]¶†,l»þhËê"¹—á~n¿úÜìÃÆ®³¦(”þûï¨'¹bˆr}&o»¨ãžlQµ'g öu*w`rZgÐÙõ£v†”íéü¹~¼µ_7¶¬þ«#9sý?î@'Ü@µß¯ªr_¥ªOªl0‡*{lÄÀFNz*Ï8±½/:ÏMO<蘄&ê95À4—”ÝW›ö®¿Î7 -*Ħ5 ±kz×eزZ&éaóÚÄQ÷[Ô€wqÔÔÇ þÉk÷# û2„q8PT¹ºã`”ó!úŒQ&é€íÿVоendstream endobj -2080 0 obj << +2108 0 obj << /Type /Page -/Contents 2081 0 R -/Resources 2079 0 R +/Contents 2109 0 R +/Resources 2107 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2067 0 R +/Parent 2079 0 R >> endobj -2082 0 obj << -/D [2080 0 R /XYZ 56.6929 794.5015 null] +2110 0 obj << +/D [2108 0 R /XYZ 56.6929 794.5015 null] >> endobj -2079 0 obj << -/ProcSet [ /PDF ] +702 0 obj << +/D [2108 0 R /XYZ 56.6929 629.6971 null] >> endobj -2085 0 obj << +2114 0 obj << +/D [2108 0 R /XYZ 56.6929 602.1058 null] +>> endobj +2107 0 obj << +/Font << /F37 1038 0 R /F11 1353 0 R /F21 950 0 R /F22 973 0 R /F67 2113 0 R /F39 1173 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +2117 0 obj << /Length 1242 /Filter /FlateDecode >> @@ -9953,140 +10151,144 @@ xÚ•WÝoÛ6Ï_aäÉ*Z¤¨¯å©M×-C1 kö´î‘iKˆ,j•Ô ú¿Ç#e)V³†ÁÓéø»ï#EW¡ùÑU“0Êù*Í9‰C¯ 3í} MÑâ+Ûz̦.«Þ—†.=O.Ö+ï¤p†éiko8ÜËîy:Ø< Þ Ÿ
»|!öw óÈ Žñm1ÚªÅëé$³þõÌfBú{z_šZéMÿŽItñFó -€:]C¦ˆcq¿h“‡ ž‡-ÖXd¹_UãT]º9GLs^¾jw…9¶nßAôæ_ôqWy?.›)ü !=χhŽs·_òïâÇ»ñ[ËAÁ¥É|-}y‘à$ƒŸb³;Yh>‡¢œz ; +€:]C¦ˆcq¿h“‡ ž‡-ÖXd¹_UãT]º9GLs^¾jw…9¶nßAôæ_ôqWy?.›)ü !=χhŽs·_òïâÇ»ñ[ËAÁ¥É|-}y‘à$ƒŸb³;Yh>‡¢œz ; endobj -2084 0 obj << +2116 0 obj << /Type /Page -/Contents 2085 0 R -/Resources 2083 0 R +/Contents 2117 0 R +/Resources 2115 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2067 0 R +/Parent 2079 0 R >> endobj -2086 0 obj << -/D [2084 0 R /XYZ 85.0394 794.5015 null] +2118 0 obj << +/D [2116 0 R /XYZ 85.0394 794.5015 null] >> endobj 706 0 obj << -/D [2084 0 R /XYZ 85.0394 769.5949 null] +/D [2116 0 R /XYZ 85.0394 769.5949 null] >> endobj -2087 0 obj << -/D [2084 0 R /XYZ 85.0394 571.259 null] +2119 0 obj << +/D [2116 0 R /XYZ 85.0394 571.259 null] >> endobj 710 0 obj << -/D [2084 0 R /XYZ 85.0394 571.259 null] +/D [2116 0 R /XYZ 85.0394 571.259 null] >> endobj -2088 0 obj << -/D [2084 0 R /XYZ 85.0394 538.9404 null] +2120 0 obj << +/D [2116 0 R /XYZ 85.0394 538.9404 null] >> endobj -2083 0 obj << -/Font << /F21 938 0 R /F22 961 0 R /F39 1161 0 R /F41 1218 0 R >> +2115 0 obj << +/Font << /F21 950 0 R /F22 973 0 R /F39 1173 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2091 0 obj << -/Length 3286 +2123 0 obj << +/Length 3285 /Filter /FlateDecode >> stream -xÚ¥ZÝsÛ6÷_¡·£f,šø Þ›Û8ûäyî:m (Š–x¡H…¤ìªýíb%ÓçÌt:©Àår,öã· ‹Yÿ‰Yœ„I&³Yšé0ŽD<+vWÑlï~ºÌ³pL‹1×Ë«›÷*ea–Èd¶| É2adŒ˜-׿i(Ãù Ë_nÞ'ÙˆWFa,ˆGž þüñã’¸Î$jja$³Ý~x7%) ¥šy¾Ü- îßMˆ¥U⧼ý´¼û<_È8‚5ÎaQðÃ=Ì`)ý|¹ûñáóýòWzúñã‡/÷ïî>ßÎS ,ïá 繺[zMµ)"…júvõÛ Ñl
Jýå* -UfâÙ3<D¡È29Û]éX…±VÊQê«/WÿòGoí§“§#"Ð@"'ŽGʩ㉳0Q |ÔÃr[õó…*Èëº}æq7&(‹C×WO%‘¾ Ê®*ù}ûˆ¿:¶ü¶/»§²£ñ£ýºÝÑ“giC_ùáÐÔeÿr²¶!Ò6çw«²lhª=±=Uía.‚¾>y]õ <PÅBˆ0‹ci÷•¯êr͆'ÅLèPiP¨µJ½}Î"Šàx·]ÛtÔy³f (‡Cµf9cm‚™…*h¾°LiâàáÃýp”°JúkxÊtP
DEm#ß¾íû -ÖHÔ¡%j77 ¢±1µbÙ9›õ™õ‹4Ä5U[Ò};”SkVIg©c.›§ŠØ›]Ù 4ÇïQ úªÙðÂàôœG¾%¡ÑÞ} «8üþ‰©yM(“(cöÇCS pÔ–ÙNº:Ú#\¨, u$õùQöû²¨ vMJ§lQÚ¿K©i6=^]*B!#Á³-†‰9ñÄbåXÑí~ ém7±up"“¤†¿lòÝ´¢£0Ë|¬è’DÒ¹ˆ.ò†æÛ–õžFÕŽ ¼}âÍõÇ~(wô²G暴#=ŽÄ±¯óÂ+…¬ÅJâõç¤S‘ÂZT’: -¿å Œ|Õþ‰Ãk2öçmUlyXÕ5êjW±WXÍã`ïò·
ªGv úq1Á¾êé·hÝ>wUÏj]}¤hm·M á‡: -}ùxÀ•h<–ùp 0@/cÀ ZØû€„3C˜°§‰Ï±ƒ½ -(vIÚm -ùªª’-µ¥_ï‘ãiÖy¹s‚s“óó¡ÙwÕSU—²ŒËÀb ÃL˜¯„ˆ¤ÒØ™ïXb56_ j ;²_Ú äEí½ -XhÇ© Ž€ølF£œ„£¦D[À‘µmL—å@ƒ'ÔœÓà …Ù¯¶9ª¦¨ë’s iã8l9«šQVÅûó)Élr×Á{zíÎÝ^ÎÜ…ýcj–ü«ìZÀølfÒSU>chžR1à¢Ôdâ{BA"Ã4N]جx>ÂLQ8|Hd77e6ü E¹Å °3 ›àW\ ¾ç# -Û”‰ÓX/[îK…@Õ8qbPœ -k§R)bÀ~Mu Pwù‘¸YÆBË \h˜M—{o=ͦ¿t‚óJ2ˆpéöf]>ÝüUví>Pašù>ÊT„шÉôXT®Bñì2ÂÄa”~K˜ «ÛÍ”kbŒÒlq¥÷*ÖöXf9†j7å¥F¡—J_€MÀ°)Š41 ÀQ .p ‡s,ËU?vüž+Ù·ñÁ§®j»±És¸ÍÕÅK—Ê¢2aò=.•9Ç£òÄF…è‹æ›–ŸB)!å)ž -wܤ ¹%`•‚Á+.L.ùat‚qaÁ¶ ÂXùêð#€0,áÿ2¸»Ô HŒR™BA ŸÇv+³o3F:ËñŒÆv£'XÂÍýNÎÞµ°ÙhGNîb$Øn(›Zf -0è\Æ!CˆØŠÄŸ[PcsÑpšÒ@0 êß³}ô2 ƒñŸÚøÏ3ÇîdÀÛA¹ÞκݎOF`‡*N8Ç)ÎpïŽ`JUAaåa¿Î‡Òõ½¹åøfçû–ƒ»mö·gM¬|Ûôgùö’ /8èÚëƒm{¨×®åOŸÂ‰Ãa×Ìa»xZ ðT[n#Õƒeüà–OWÊå󫈦>Na°g Ö2Å%Ö-?o©{·]1 òž - E±=Ó®ŠRÁý'"äë5áÓž?¢zK9N l[ª˜Ü-È7(–RŽÙHs×ì_¼Èºò¬ššt¯L}¶S1Ê¡èe5
d Eé\à2 ØŸSþþ“è¶Í›W/ÒP§™ÃZöiÁG=YžããØ_Ü;6\ý!W1wÊ‘¼+‡m»æe0
-4N× -À´¢<Ñr÷-±¸çg3>žä*ªåÌXŽñF‹ã‡w¨Ý»'ÅWÂÆ/«ÌûÊ11Ý À\k°ƒÛºoYãíà—š;g‹OéÏ]ò4V¿Ô€5d -¯žŒÊT(¥‡…oœÌ³O”å0í!Ùf =Ðbap®Y X+ÇôÓ×ù³ú+lV1èÁfØ[ÙÒv=`øL¥ `#©>¤àíÆ^²)qZÒ.‡Z¬›2ü‚ºÙfd N‹=m.?œžíš^®˜ÚûJ0vn «‘ih†fÎe`w}McWÑã=Ò+ºe™Å»áïm£ ÆÅ~*†!à%ðzæ +xÚ¥ZKsÛF¾ëWð¶`•a xíM‰åD9Ø^›ªÝT’@$Ö @ æ×o÷tÏ •«R)‡ƒF£g¦§ _÷H,øO,ÂÈR™.âTûa ÂE¾¿ +[x÷Ó•`ž•eZ¹~X_ݼWñ"õÓHF‹õãHVâI"ëâ7/ö¥¿ücýËÍû( ñÊÀ¥ñÈóãÏŸ?~\×D¢N|-Él· ÞÍIŠ|©„fž/wë‡ûw3¢„€Ei¹)o?ï>/W2 `KØcàýp3JJ?_î~|ø|¿þ•ž~üøáËý»»Ï·ËX{ë{xÂy®îÖNScmŠ@¡š¾]ýöG°(@©¿\¾J“pñ /ÒT.öW:T~¨•²”úêËÕ¿œÀÑ[óéìéˆ +~86uÙ¿œ¬mˆ´Ëøݦ,šê@lOU{\ +¯¯OD.ª~…§ +¶€r8VËkÄÈÔWq@ó}„eÊ$ô >ÜÿG«¤¿†§T{Õ@TÔ6ò Ú¾¯`D Z¢vËTC46F V,;c³žX¿ˆ}\Yu¾#Ý·C9·fùa[æ²yªˆ½Ù—Í@sü „Á±¯š-/ NÏêpäKAä'Ú¹on‡_Â?17oâË(H™ýñØä µa6“nNæW*M} H==ÊþPæÕãɬIé˜-J'ÞïRjšMW _È@ðl«afAV<±9Ft{ÈAúcÛÍl œ(‰â„¿l²ý¼¢?M]¬èÒºˆÎ³†æÛ•õFÕž ¼}âÍõ§~(÷ô²G暴=mNÄq¨³Ü)…¬ÅHâõg¤SÃZT[ +·å Œ|Óþ‰Ãk2öç]•ïxXÕ5êj_±WÍã ÈöÙÖŽÛ†GÕ#;ýؘ`^õô›·vŸûªg5® >P´¶Û¦…‰ðC xǾ|<âJ´ð Ël8R —Æ1à ì}@™!L˜ÓÄgŒXÈÁ^³$m7„lSÕFɆÚÒ¯óÈñ4EVîàŒÅdü|l]õTÕå–,ã20Á†X'è03æ+!"©8´æ{$–PÍWûZ‡ÖŸŒÄ—6yQ;/@_ó1bÞ¿—©ôøÄúãv[ö|º´Õ†| ±·±~';#ŠÛËó®´\½0 <d úi"’Ið˜ó!áËXÚ¼>:{ŸƒÈQ*‰¦Æósi
D‰Ô£Ü–š-àoùg¶?Ôülqoâ<>ÔUÃd<yCi3~Ǿb+–“ÍíKAZMµúŽ}¥ajÏ—ðzF V~ +ïæ)ën^‹7p¸2‰-+x³R‘çöfwĶ<ÔÂ$Q—A
¥” +ñ¦½€(—k_$m”ŽšÆéžÛî+Q8È Ê¾«»bȺ¡ÊuÆ+-*†aCÛˆã“Û +C=M=¯Ù0 ©$‰ÓQÀB;Ž¥wÄg2å$ 5%ÚŽŒmcº, 9¡fœ_(Ì|µËxT5y},JNÌ%¤Ó°ã¬šŒ²*ÎØO§$w2É]{ï-è5;·{™¸
+ûÆÔ4øW™µ€ñ™Ì¤§ª|ÆÐ<§bÀEq’Šï ‘ôã0¶a³âù3gñ!‘íÜ”Ù`ð{H@æ{ÀÎt˜x¿â¢ðð= ¢#0 ·ô›ÿ=öÃÅ|OY},{7A’£JNÕCØ«· ãk9½tž¶)#«°^¶Ü— +0ªq2âÄ 8hÉŸ•v¨Š)bÎ Áë“è"ÄeyÞ Æg(ÿU½oQDhM"ÜCûÔð\
;ÂeÖÕ¡ ƒbzVŠfK*Ò5
o¼r:T+ë“•ç4S-hX}*ìò›Ù€#€'vÉ„ÏáC"ÄpUýÊ¡„2| +¨e]5ÐÙ0^yÓvÜÁ+Únˆ×I]$¢]FQ WcßtU©2AÀb1¾!OÐlŸ‰b QQšx?·ÏèüXÙ£j“‚ø¡l +3Àoð +c¥/E÷Ë‹U;PÕ>ÏŽ’~*#õb?\•Ù°î|ÒþËZ€ýÜØm)¨X® +nqÀ¸m¬x“`Ylû¢î¦À´Ìæ“sWÒñwÕ@eÐ\óQAå—Êïì> +ÐD +m¶ûF !&L£èuYô] +0„›û½\¼ka;‹ÑŽ¬ÜÕH°ÙP46µ4 Ãì $GD´£v0øH[$ +#ìž…Í:—üQBZ}¢ p"°×3Ž,½§_°Tº¸ƒÓj
fxÆ2ß0k}CFËÛ»¦.BÅ«¶€P0a›’1O +¯˜R ¾gzèÊ~àEåCÉœS›€WôôlÚO(aǯ*À Kz„BÄF$øÜ‚›‹†Ó” Ó±¡þ=ÛG/:ÿ¹ÿ÷<sìN x;(×¹Ó¤Ûmùd +>ÐnÌ%›ç%í3¨Åº9ÃÏ©›MaF†à´ØÓæòÈÙ0àÙôrÃÔÞU‚¡uóPLC34³. ³ëk;|§Ü½Š ï‘^Ñ-ËŒ(Þ
o!Þ(ös1 /׉lSÁ¥#@=Ÿ gêœó¤gÜ™ F—Táö¶ÜôÈÃЙg.wÞ·&'óé
Š9ôe=Än q˜öKb¬oZw[“ /¶îKÓÞ6’B9k ‡
KÏ»Óah·]vØÙ>¾ÎŽ°‚[CÉ‚6<Ǿ̚yÝ¢ Ä 6 #Â{¦mãî'zbÂBbýåþ'¾zA¶5y<¼¬ŒÉFúµ˜šF¾Ö®,{;¦¦Â¹¹sX˜ÆæUœ ÓQMú£Áúˆöµ<Ñ _ÇÞ ’–ÚNµú#yÑÓ±-[ãØÚh”i{™orLÙóÅÔm
j¬žJXŸÂvœMbóf¦âœDÊöIM«C[Wùi¾}ÆînÖiË86çj¯x½Ì +}üÃŒ™¿È\=ó·ÿþãŒó4€¶$‘óÚaîÔ ¢µ‹Â ¼XºýK‘—kÿ 2¬2Vendstream endobj -2090 0 obj << +2122 0 obj << /Type /Page -/Contents 2091 0 R -/Resources 2089 0 R +/Contents 2123 0 R +/Resources 2121 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2067 0 R +/Parent 2131 0 R >> endobj -2092 0 obj << -/D [2090 0 R /XYZ 56.6929 794.5015 null] +2124 0 obj << +/D [2122 0 R /XYZ 56.6929 794.5015 null] >> endobj 714 0 obj << -/D [2090 0 R /XYZ 56.6929 730.0613 null] +/D [2122 0 R /XYZ 56.6929 730.0613 null] >> endobj -2096 0 obj << -/D [2090 0 R /XYZ 56.6929 694.6148 null] +2128 0 obj << +/D [2122 0 R /XYZ 56.6929 694.6148 null] >> endobj 718 0 obj << -/D [2090 0 R /XYZ 56.6929 556.3845 null] +/D [2122 0 R /XYZ 56.6929 556.3845 null] >> endobj -2097 0 obj << -/D [2090 0 R /XYZ 56.6929 529.3116 null] +2129 0 obj << +/D [2122 0 R /XYZ 56.6929 529.3116 null] >> endobj 722 0 obj << -/D [2090 0 R /XYZ 56.6929 413.847 null] +/D [2122 0 R /XYZ 56.6929 413.847 null] >> endobj -2098 0 obj << -/D [2090 0 R /XYZ 56.6929 385.8516 null] +2130 0 obj << +/D [2122 0 R /XYZ 56.6929 385.8516 null] >> endobj 726 0 obj << -/D [2090 0 R /XYZ 56.6929 226.4875 null] +/D [2122 0 R /XYZ 56.6929 226.4875 null] >> endobj -1730 0 obj << -/D [2090 0 R /XYZ 56.6929 193.9525 null] +1753 0 obj << +/D [2122 0 R /XYZ 56.6929 193.9525 null] >> endobj -2089 0 obj << -/Font << /F37 1026 0 R /F69 2095 0 R /F22 961 0 R /F21 938 0 R /F39 1161 0 R /F41 1218 0 R /F53 1313 0 R /F48 1238 0 R /F62 1361 0 R /F63 1364 0 R >> -/XObject << /Im2 1350 0 R >> +2121 0 obj << +/Font << /F37 1038 0 R /F69 2127 0 R /F22 973 0 R /F21 950 0 R /F39 1173 0 R /F41 1233 0 R /F53 1328 0 R /F48 1253 0 R /F62 1379 0 R /F63 1382 0 R >> +/XObject << /Im2 1368 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2101 0 obj << -/Length 533 +2134 0 obj << +/Length 534 /Filter /FlateDecode >> stream xÚ¥TM›0½ó+|©¸6ÆÄ>fmY©iš°‡Õj¼ *Ái e}MÆùЖ=¢ˆyã7o><@1?ŠÇ„Édˆ9¡ ‡ •9ûîPËñÏ$ÿ–u—9_¿±’XFA„²—-‰eå“;ù1žeÉÜóNÜö| ÷.Æà‘ðX$“‡yš=šüš.Ò8™½Qèf©Až "L<³ ñãtü3 -Wµ² ý2Ôàv¿¬«öî –`Ø‘¾ý¬Ví^Õ®Ð(e îlH]ë˜öâ +Wµ² ý2Ôàv¿¬«öî –`Ø‘¾ý¬Ví^Õ®Ð(e îlH]ë˜öâ endobj -2100 0 obj << +2133 0 obj << /Type /Page -/Contents 2101 0 R -/Resources 2099 0 R +/Contents 2134 0 R +/Resources 2132 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2067 0 R +/Parent 2131 0 R >> endobj -2102 0 obj << -/D [2100 0 R /XYZ 85.0394 794.5015 null] +2135 0 obj << +/D [2133 0 R /XYZ 85.0394 794.5015 null] >> endobj -2099 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R >> +2132 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2105 0 obj << +2138 0 obj << /Length 69 /Filter /FlateDecode >> stream xÚ3T0 endobj -2104 0 obj << +2137 0 obj << /Type /Page -/Contents 2105 0 R -/Resources 2103 0 R +/Contents 2138 0 R +/Resources 2136 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2107 0 R +/Parent 2131 0 R >> endobj -2106 0 obj << -/D [2104 0 R /XYZ 56.6929 794.5015 null] +2139 0 obj << +/D [2137 0 R /XYZ 56.6929 794.5015 null] >> endobj -2103 0 obj << +2136 0 obj << /ProcSet [ /PDF ] >> endobj -2110 0 obj << +2142 0 obj << /Length 1965 /Filter /FlateDecode >> @@ -10098,86 +10300,86 @@ i ·¥Ý3éÀ–yíˆùðŠ&Â8K<æcø¡› ‚hï Cû™<»úÐŒêhüýÔï Æס\@•‰ó÷w= vV ýf3GÕ51b‘æi‘diNŒ‘Œâ±ˆ±0·"ð0àâÄßZÕ7’\sÂw"ó‡&0ÍåþF—?$cRÍZº”í(õåŠ:éH^04g¢°û(½À ÙWáÓ7˜¿S,[>°úŒ¹…;î3`ô¦'bÕÀ¤Ö^ ïöEy˜]¹œÞv‹íçÞa¯Úák@n@þzh|ÇütÓOÓ0J¿mºã—¿ÞeÚâ š(°ÁiÇEðá
êÍâÀz҃ѣm§žæˆ§çOŒ$ è×ØÚ:‰óÎÐÃBYn?z·XdÌqâd¾©Üä¤ÚNí:ørðï»QÕaáƒL·CÕMucVìâªV.Wª4 Û8Hü» Uoy)”@» Zìo+B)ˆ×©ôD9ƒ©;B.ÊõTyå vÂ)Î6™îZds§¡ÁÓÏMíµ°r=¶öä&vÓž®é^/yr€¡ ¶¯ÓP;«y Â1{9B€FãŸà{ËוÂM>p\×-ž‘7>å èWˆÌ¨W ¥Ìrcø-Š¼ûãËü -“¤%œ¡i±I æ² —â~ÚøÑŸ/¯6³Âv¡á mÒ¥ß;»è½‡CÀê/aïoãã<,EQ^Çsór4 ÝÅpµö;[ÃïVÎy7G)JΑOü©5¿|hW°hpk·IQ„"é5¶ÏÍŽû ª‡]Ù)C™‹_Ú‘Âõ%KÄQXDñ¯oʬ±]ªÜïʽe×SX{üâññ|>‡¼+¾, }w¸ÉÀdñ:Æ›š¥îãºÊǽµÿ¶Uø]5èTíŠË°ç§ð6hÿ˜ÈŸ%×"ö"Û‹ ½H.ƒH"h<H# a("·îæÎ{ÿùŒþendstream +“¤%œ¡i±I æ² —â~ÚøÑŸ/¯6³Âv¡á mÒ¥ß;»è½‡CÀê/aïoãã<,EQ^Çsór4 ÝÅpµö;[ÃïVÎy7G)JΑOü©5¿|hW°hpk·IQ„"é5¶ÏÍŽû ª‡]Ù)C™‹_Ú‘Âõ%KÄQXDñ¯oʬ±]ªÜïʽe×SX{üâññ|>‡¼+¾, }w¸ÉÀdñ:Æ›š¥îãºÊǽµÿ¶Uø]5èTíŠË°ç§ð6hÿ˜ÈŸ%×"ö"Û‹ ½H.ƒH"h<H# a("NnÝÍœ÷þþùå endobj -2109 0 obj << +2141 0 obj << /Type /Page -/Contents 2110 0 R -/Resources 2108 0 R +/Contents 2142 0 R +/Resources 2140 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2107 0 R -/Annots [ 2117 0 R 2118 0 R ] +/Parent 2131 0 R +/Annots [ 2149 0 R 2150 0 R ] >> endobj -2117 0 obj << +2149 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [348.3486 128.9523 463.9152 141.0119] /Subtype/Link/A<</Type/Action/S/URI/URI(mailto:info@isc.org)>> >> endobj -2118 0 obj << +2150 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [147.3629 116.9971 364.5484 129.0567] /Subtype/Link/A<</Type/Action/S/URI/URI(http://www.isc.org/services/support/)>> >> endobj -2111 0 obj << -/D [2109 0 R /XYZ 85.0394 794.5015 null] +2143 0 obj << +/D [2141 0 R /XYZ 85.0394 794.5015 null] >> endobj 730 0 obj << -/D [2109 0 R /XYZ 85.0394 769.5949 null] +/D [2141 0 R /XYZ 85.0394 769.5949 null] >> endobj -2112 0 obj << -/D [2109 0 R /XYZ 85.0394 576.7004 null] +2144 0 obj << +/D [2141 0 R /XYZ 85.0394 576.7004 null] >> endobj 734 0 obj << -/D [2109 0 R /XYZ 85.0394 576.7004 null] +/D [2141 0 R /XYZ 85.0394 576.7004 null] >> endobj -2113 0 obj << -/D [2109 0 R /XYZ 85.0394 548.3785 null] +2145 0 obj << +/D [2141 0 R /XYZ 85.0394 548.3785 null] >> endobj 738 0 obj << -/D [2109 0 R /XYZ 85.0394 548.3785 null] +/D [2141 0 R /XYZ 85.0394 548.3785 null] >> endobj -2114 0 obj << -/D [2109 0 R /XYZ 85.0394 518.5228 null] +2146 0 obj << +/D [2141 0 R /XYZ 85.0394 518.5228 null] >> endobj 742 0 obj << -/D [2109 0 R /XYZ 85.0394 460.6968 null] +/D [2141 0 R /XYZ 85.0394 460.6968 null] >> endobj -2115 0 obj << -/D [2109 0 R /XYZ 85.0394 425.0333 null] +2147 0 obj << +/D [2141 0 R /XYZ 85.0394 425.0333 null] >> endobj 746 0 obj << -/D [2109 0 R /XYZ 85.0394 260.2468 null] +/D [2141 0 R /XYZ 85.0394 260.2468 null] >> endobj -2116 0 obj << -/D [2109 0 R /XYZ 85.0394 224.698 null] +2148 0 obj << +/D [2141 0 R /XYZ 85.0394 224.698 null] >> endobj -2108 0 obj << -/Font << /F21 938 0 R /F22 961 0 R /F11 1451 0 R /F41 1218 0 R >> +2140 0 obj << +/Font << /F21 950 0 R /F22 973 0 R /F11 1353 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2121 0 obj << +2153 0 obj << /Length 69 /Filter /FlateDecode >> stream xÚ3T0 endobj -2120 0 obj << +2152 0 obj << /Type /Page -/Contents 2121 0 R -/Resources 2119 0 R +/Contents 2153 0 R +/Resources 2151 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2107 0 R +/Parent 2131 0 R >> endobj -2122 0 obj << -/D [2120 0 R /XYZ 56.6929 794.5015 null] +2154 0 obj << +/D [2152 0 R /XYZ 56.6929 794.5015 null] >> endobj -2119 0 obj << +2151 0 obj << /ProcSet [ /PDF ] >> endobj -2125 0 obj << +2157 0 obj << /Length 2544 /Filter /FlateDecode >> @@ -10189,42 +10391,42 @@ FXЂdƒ\#åS¯ÐyOpBŒšÈª†¨n4\Tòi¹^¿È=õvÂÀ3v·Ù”¹<ƒZˆLPO–`š8I9³€øQ &ŽÀ6
CÆg”ñ ¼ –a“p ¯Gkଯ ëÃá5³îǪÿêÄ- ÜȽ¬Í|µ/^ÄwxÒH‚ D¤<ÐÎÿ—yÇ‘sU@E…ÎqÌ*Š‘×8P”Ì Ë¿/@f4áRÊ}^º¦ÖÒRº#›Úv°/×ˈÖFtÅŒ‚þ[åSr Òéú@Øèªé)ŽL½"Ÿûæ¢@ù<ñpJµÙ>~æÜpËLtGYFgá±[A
—(-̃ÅÙ¶Ä ˜Þ°)Ëx™AaíF¼¨‚ ÕáPâ¥V)§8·º>@ÌÔ4ûôÜÄP‰BÍÞ(dv P&máªëæßFD3zœ`·“¢ÂEàÛ=ÃBj{
†rh®ÔÐq½ ‘® ³«zß&Å(uùJ¸8…B×ò5ø?Š²9Òp#ªf'Ë’•ú&_æ ùM_—¢±J6iðU£ª#E}ïãÏ^5X*‰eà ÏÖJ©>KF\¢P¯SS Œo&Œ>Ï! ·LÝ– è@±¸ˆ¤ægH@Ä9 ³ZI( Ž:ž()6Sq -UŸiQc¢õFêƆEiX*×5ÔÏ]OÕ-ãÖXXE p³Í‚¥¢o¹‡šMÔºõÁùˆ4òs®øbðج–× +UŸiQc¢õFêƆEiX*×5ÔÏ]OÕ-ãÖXXE p³Í‚¥¢o¹‡šMÔºõÁùˆ4òs®øbðج–× endobj -2124 0 obj << +2156 0 obj << /Type /Page -/Contents 2125 0 R -/Resources 2123 0 R +/Contents 2157 0 R +/Resources 2155 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2107 0 R +/Parent 2131 0 R >> endobj -2126 0 obj << -/D [2124 0 R /XYZ 85.0394 794.5015 null] +2158 0 obj << +/D [2156 0 R /XYZ 85.0394 794.5015 null] >> endobj 750 0 obj << -/D [2124 0 R /XYZ 85.0394 769.5949 null] +/D [2156 0 R /XYZ 85.0394 769.5949 null] >> endobj -2127 0 obj << -/D [2124 0 R /XYZ 85.0394 573.5449 null] +2159 0 obj << +/D [2156 0 R /XYZ 85.0394 573.5449 null] >> endobj 754 0 obj << -/D [2124 0 R /XYZ 85.0394 573.5449 null] +/D [2156 0 R /XYZ 85.0394 573.5449 null] >> endobj -2128 0 obj << -/D [2124 0 R /XYZ 85.0394 539.0037 null] +2160 0 obj << +/D [2156 0 R /XYZ 85.0394 539.0037 null] >> endobj 758 0 obj << -/D [2124 0 R /XYZ 85.0394 539.0037 null] +/D [2156 0 R /XYZ 85.0394 539.0037 null] >> endobj -2129 0 obj << -/D [2124 0 R /XYZ 85.0394 510.2426 null] +2161 0 obj << +/D [2156 0 R /XYZ 85.0394 510.2426 null] >> endobj -2123 0 obj << -/Font << /F21 938 0 R /F22 961 0 R >> +2155 0 obj << +/Font << /F21 950 0 R /F22 973 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2132 0 obj << -/Length 2812 +2164 0 obj << +/Length 2811 /Filter /FlateDecode >> stream @@ -10241,66 +10443,66 @@ EÐ ™OÆܨŒÚ›-—e]s÷Z_ÔU×.Ê‘zE)míë¹®¸ÊWñ•¿ÉUêº0¢Æ÷jbqå¤7‘Ð ‰’-9ŽÂÐák â”mÖöÑëC½Ã cåàföí÷¹àRõvùÀw²½šÈöëvuyùòò‚*p ]8*?\ÕÂXé[}ãú &?kÚþù+üM\O:‰p-’Ó~å‡1ÎCN("ÛÿùøÓ‰øN”±iÙE˜øôƒ–¿ÌìèÇþ»G·c1Üb¾{øÃO)Ô1T~ß!¯½<æÏGþã8:âïè[L‡uÊÓH§Ô§¿Lå]ÀĈ90&ºÒK÷ðxj7ˆ†žÄ ˜-t|×âÚv ª{ô^Ù¶Ä>±t‹à-Ö‹i¦'¾}¤¥¶Ÿ4žÓÂ>©]¶£÷OtJµùï‘ÊøÙJ„b¤‡7 -}Ç÷èUHÇÁ {‘Ý°î8u¢º¦Nh{'RíÚ©›Íe³ÎN|Çs#'qå1WG¾Óa²2RÄ)µ·|'r"?Ž†<ÇéÜ4†`“6MKÎü=B¿õ…S~–œÃíóÿüõ³ÿ +}Ç÷èUHÇÁ {‘Ý°î8u¢º¦Nh{'RíÚ©›Íe³ÎN|Çs#'qå1WG¾Óa²2RÄ)µ·|'r"?Ž†<ÇéÜ4†`“6MKÎü=B¿õ…S~–œÃíóÿüõ³ÿ endobj -2131 0 obj << +2163 0 obj << /Type /Page -/Contents 2132 0 R -/Resources 2130 0 R +/Contents 2164 0 R +/Resources 2162 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2107 0 R -/Annots [ 2136 0 R 2137 0 R ] +/Parent 2172 0 R +/Annots [ 2168 0 R 2169 0 R ] >> endobj -2136 0 obj << +2168 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [253.7995 149.3637 417.685 161.4234] /Subtype/Link/A<</Type/Action/S/URI/URI(ftp://www.isi.edu/in-notes/)>> >> endobj -2137 0 obj << +2169 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [63.4454 110.455 208.8999 120.6168] /Subtype/Link/A<</Type/Action/S/URI/URI(http://www.ietf.org/rfc/)>> >> endobj -2133 0 obj << -/D [2131 0 R /XYZ 56.6929 794.5015 null] +2165 0 obj << +/D [2163 0 R /XYZ 56.6929 794.5015 null] >> endobj 762 0 obj << -/D [2131 0 R /XYZ 56.6929 662.0717 null] +/D [2163 0 R /XYZ 56.6929 662.0717 null] >> endobj -2134 0 obj << -/D [2131 0 R /XYZ 56.6929 624.1661 null] +2166 0 obj << +/D [2163 0 R /XYZ 56.6929 624.1661 null] >> endobj 766 0 obj << -/D [2131 0 R /XYZ 56.6929 624.1661 null] +/D [2163 0 R /XYZ 56.6929 624.1661 null] >> endobj -1531 0 obj << -/D [2131 0 R /XYZ 56.6929 593.0972 null] +1546 0 obj << +/D [2163 0 R /XYZ 56.6929 593.0972 null] >> endobj 770 0 obj << -/D [2131 0 R /XYZ 56.6929 294.2701 null] +/D [2163 0 R /XYZ 56.6929 294.2701 null] >> endobj -2135 0 obj << -/D [2131 0 R /XYZ 56.6929 255.4568 null] +2167 0 obj << +/D [2163 0 R /XYZ 56.6929 255.4568 null] >> endobj 774 0 obj << -/D [2131 0 R /XYZ 56.6929 255.4568 null] +/D [2163 0 R /XYZ 56.6929 255.4568 null] >> endobj -1251 0 obj << -/D [2131 0 R /XYZ 56.6929 226.1045 null] +1266 0 obj << +/D [2163 0 R /XYZ 56.6929 226.1045 null] >> endobj -2138 0 obj << -/D [2131 0 R /XYZ 56.6929 53.5688 null] +2170 0 obj << +/D [2163 0 R /XYZ 56.6929 53.5688 null] >> endobj -2139 0 obj << -/D [2131 0 R /XYZ 56.6929 53.5688 null] +2171 0 obj << +/D [2163 0 R /XYZ 56.6929 53.5688 null] >> endobj -2130 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F21 938 0 R /F39 1161 0 R /F53 1313 0 R /F11 1451 0 R /F41 1218 0 R >> +2162 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F21 950 0 R /F39 1173 0 R /F53 1328 0 R /F11 1353 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2142 0 obj << +2175 0 obj << /Length 2825 /Filter /FlateDecode >> @@ -10319,693 +10521,693 @@ Zî–ÁÅ“ž„N(ËEHq¤;#UO«E;õ4:É$ £ÇgöHm)7™FJ“>2½Ð-™'ØÃdvÀ› ã3¤%ä¶B-dU™Ï}¸
ö‡MÐFžŒ¯ -3wÊ,Ÿw¢^
[ÖŒ*…ÅÈ´<Øû©ÍØ/cŒ ±ïÖÙN>Ë^vå›~¾Ñó åçú«d>C¶K¡`Œidå7ÆÁâU<2³ û»I_å Cæœ:& ôÚäLcjKy¨ÖRמZ/´Ev ÛÁ¶
>-÷{¹ëŠõfëÀ·@09—¬–‡JÊH…‰Åq³N¬é„`ü]þmøèœÆ(æØ>F¢aóù XäýqŸêSW±ïÚôy°Úc +ïÔàT
>d mâŒ^·Ãs§÷œ¥Å ùÆgîóÝÎœø~ŸIð‘0Šüa ¹
B µ T$žƒ nk}àak°‘Ù!×G%ǶÚ4[Y¯†ªLÆ,<=5G±Žö\ ×~ïGI ¶àÏÔÿ–[áZ¨Íø¾Ï¾|¸ÂûÀà ·‘÷AŸWÏÙ6}ÍE5#P}m kkôÓÒ9áBŸÔ6"²€ÑÛÇ×H^MÖêD2ì #FEÐ|X|Ö~ѼJyÈ«m^§DRãKá%Jæ./öY®P¯ÙÙC²7Ü… ¤jñ î€j“Ûÿò—¾ÖÎaŒh’8Ó(4Ÿ”r¬_Jü -LXÿÕÍ7Á§ïþ_$Ÿb”endstream +Lâþ«›o‚Oßý¿$÷b–endstream endobj -2141 0 obj << +2174 0 obj << /Type /Page -/Contents 2142 0 R -/Resources 2140 0 R +/Contents 2175 0 R +/Resources 2173 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2107 0 R ->> endobj -2143 0 obj << -/D [2141 0 R /XYZ 85.0394 794.5015 null] ->> endobj -2144 0 obj << -/D [2141 0 R /XYZ 85.0394 752.3015 null] ->> endobj -2145 0 obj << -/D [2141 0 R /XYZ 85.0394 752.3015 null] ->> endobj -2146 0 obj << -/D [2141 0 R /XYZ 85.0394 752.3015 null] ->> endobj -2147 0 obj << -/D [2141 0 R /XYZ 85.0394 746.3107 null] ->> endobj -2148 0 obj << -/D [2141 0 R /XYZ 85.0394 731.5461 null] ->> endobj -2149 0 obj << -/D [2141 0 R /XYZ 85.0394 728.1497 null] ->> endobj -2150 0 obj << -/D [2141 0 R /XYZ 85.0394 713.3851 null] ->> endobj -2151 0 obj << -/D [2141 0 R /XYZ 85.0394 709.9887 null] ->> endobj -2152 0 obj << -/D [2141 0 R /XYZ 85.0394 651.9592 null] ->> endobj -1381 0 obj << -/D [2141 0 R /XYZ 85.0394 651.9592 null] ->> endobj -2153 0 obj << -/D [2141 0 R /XYZ 85.0394 651.9592 null] ->> endobj -2154 0 obj << -/D [2141 0 R /XYZ 85.0394 648.8377 null] ->> endobj -2155 0 obj << -/D [2141 0 R /XYZ 85.0394 634.0731 null] ->> endobj -2156 0 obj << -/D [2141 0 R /XYZ 85.0394 630.6767 null] ->> endobj -2157 0 obj << -/D [2141 0 R /XYZ 85.0394 615.9121 null] ->> endobj -2158 0 obj << -/D [2141 0 R /XYZ 85.0394 612.5156 null] ->> endobj -2159 0 obj << -/D [2141 0 R /XYZ 85.0394 585.7959 null] ->> endobj -2160 0 obj << -/D [2141 0 R /XYZ 85.0394 582.3994 null] ->> endobj -2161 0 obj << -/D [2141 0 R /XYZ 85.0394 567.6349 null] ->> endobj -2162 0 obj << -/D [2141 0 R /XYZ 85.0394 564.2384 null] ->> endobj -2163 0 obj << -/D [2141 0 R /XYZ 85.0394 549.5337 null] ->> endobj -2164 0 obj << -/D [2141 0 R /XYZ 85.0394 546.0774 null] ->> endobj -2165 0 obj << -/D [2141 0 R /XYZ 85.0394 531.3128 null] ->> endobj -2166 0 obj << -/D [2141 0 R /XYZ 85.0394 527.9163 null] ->> endobj -2167 0 obj << -/D [2141 0 R /XYZ 85.0394 513.1518 null] ->> endobj -2168 0 obj << -/D [2141 0 R /XYZ 85.0394 509.7553 null] ->> endobj -2169 0 obj << -/D [2141 0 R /XYZ 85.0394 483.0356 null] ->> endobj -2170 0 obj << -/D [2141 0 R /XYZ 85.0394 479.6391 null] ->> endobj -2171 0 obj << -/D [2141 0 R /XYZ 85.0394 464.8745 null] ->> endobj -2172 0 obj << -/D [2141 0 R /XYZ 85.0394 461.4781 null] ->> endobj -2173 0 obj << -/D [2141 0 R /XYZ 85.0394 446.7135 null] ->> endobj -2174 0 obj << -/D [2141 0 R /XYZ 85.0394 443.3171 null] ->> endobj -2175 0 obj << -/D [2141 0 R /XYZ 85.0394 428.5525 null] +/Parent 2172 0 R >> endobj 2176 0 obj << -/D [2141 0 R /XYZ 85.0394 425.156 null] +/D [2174 0 R /XYZ 85.0394 794.5015 null] >> endobj 2177 0 obj << -/D [2141 0 R /XYZ 85.0394 355.0758 null] +/D [2174 0 R /XYZ 85.0394 752.3015 null] >> endobj 2178 0 obj << -/D [2141 0 R /XYZ 85.0394 355.0758 null] +/D [2174 0 R /XYZ 85.0394 752.3015 null] >> endobj 2179 0 obj << -/D [2141 0 R /XYZ 85.0394 355.0758 null] +/D [2174 0 R /XYZ 85.0394 752.3015 null] >> endobj 2180 0 obj << -/D [2141 0 R /XYZ 85.0394 352.0499 null] +/D [2174 0 R /XYZ 85.0394 746.3107 null] >> endobj 2181 0 obj << -/D [2141 0 R /XYZ 85.0394 337.3452 null] +/D [2174 0 R /XYZ 85.0394 731.5461 null] >> endobj 2182 0 obj << -/D [2141 0 R /XYZ 85.0394 333.8889 null] +/D [2174 0 R /XYZ 85.0394 728.1497 null] >> endobj 2183 0 obj << -/D [2141 0 R /XYZ 85.0394 309.8192 null] +/D [2174 0 R /XYZ 85.0394 713.3851 null] >> endobj 2184 0 obj << -/D [2141 0 R /XYZ 85.0394 303.7727 null] +/D [2174 0 R /XYZ 85.0394 709.9887 null] >> endobj 2185 0 obj << -/D [2141 0 R /XYZ 85.0394 278.3282 null] +/D [2174 0 R /XYZ 85.0394 651.9592 null] +>> endobj +1399 0 obj << +/D [2174 0 R /XYZ 85.0394 651.9592 null] >> endobj 2186 0 obj << -/D [2141 0 R /XYZ 85.0394 273.6565 null] +/D [2174 0 R /XYZ 85.0394 651.9592 null] >> endobj 2187 0 obj << -/D [2141 0 R /XYZ 85.0394 246.9367 null] +/D [2174 0 R /XYZ 85.0394 648.8377 null] >> endobj 2188 0 obj << -/D [2141 0 R /XYZ 85.0394 243.5403 null] +/D [2174 0 R /XYZ 85.0394 634.0731 null] >> endobj 2189 0 obj << -/D [2141 0 R /XYZ 85.0394 173.5556 null] +/D [2174 0 R /XYZ 85.0394 630.6767 null] >> endobj 2190 0 obj << -/D [2141 0 R /XYZ 85.0394 173.5556 null] +/D [2174 0 R /XYZ 85.0394 615.9121 null] >> endobj 2191 0 obj << -/D [2141 0 R /XYZ 85.0394 173.5556 null] +/D [2174 0 R /XYZ 85.0394 612.5156 null] >> endobj 2192 0 obj << -/D [2141 0 R /XYZ 85.0394 170.4341 null] +/D [2174 0 R /XYZ 85.0394 585.7959 null] >> endobj 2193 0 obj << -/D [2141 0 R /XYZ 85.0394 144.9896 null] +/D [2174 0 R /XYZ 85.0394 582.3994 null] >> endobj 2194 0 obj << -/D [2141 0 R /XYZ 85.0394 140.3179 null] +/D [2174 0 R /XYZ 85.0394 567.6349 null] >> endobj 2195 0 obj << -/D [2141 0 R /XYZ 85.0394 113.5982 null] +/D [2174 0 R /XYZ 85.0394 564.2384 null] >> endobj 2196 0 obj << -/D [2141 0 R /XYZ 85.0394 110.2017 null] +/D [2174 0 R /XYZ 85.0394 549.5337 null] >> endobj 2197 0 obj << -/D [2141 0 R /XYZ 85.0394 95.4372 null] +/D [2174 0 R /XYZ 85.0394 546.0774 null] >> endobj 2198 0 obj << -/D [2141 0 R /XYZ 85.0394 92.0407 null] +/D [2174 0 R /XYZ 85.0394 531.3128 null] >> endobj -2140 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F39 1161 0 R >> -/ProcSet [ /PDF /Text ] +2199 0 obj << +/D [2174 0 R /XYZ 85.0394 527.9163 null] >> endobj -2201 0 obj << -/Length 2889 -/Filter /FlateDecode ->> -stream -xÚµšMsÛ8†ïþ:JU1† -< -}w„°i5LX[iÂã¶J7„O´{ ·´Xøé«M|§–=w¦í½˜A;ˆ‚ÈÀ öHü¿HiþM|˜øh²÷²ÈX–%òž.w˜C -†•…‚²Ò`¯·P°IºÚýLíù&?ýã⯲s¬Ø,¯dSšwç]ù?ý -?â7?Òù1Щsàží’º( -ü6¡¹$´HÊ*K^˜l¦µ£ïÞ©s±ðûgM,&†af0 †•…˜²2ˆb6iƒXW»Ÿ˜©½ÞÄÜÎ=ØYEXž(E_q@ü¿Ø&ÁFQã‚Z}ƒ¤Æ¯G¨ù -\'4v¹@`ã£Ø\ÇÄÆ?5ØÄaFÔÊ'0ÝÐA>Lº ¦i5 S[0-»Uºy¢Ý ³¥½©ŠC½KáˆN/ÙAlapød%osk†¼¯fÈCÞ(ò+Å[Œ0$aH;†ü~Îßkºžã)†Â¦^aüâ“4¾:îöG8ÔÊà ¹Å´‰´ÿÄs]8Ç4 #°
+ leeÀŽ,°mÒì®v?lS›ÃNÄ>ŠsÁÙô©>µœ_³º2#zas,E*[dè
ÐéС7[ -id„ý4¦Õ0m¥Ñ¡¥ -°I+ «Ý¿Lí{Ôu]î‹5e×¥ÓøX=ö[½‰®»"ååÑÇ¡®â»ûµðOÞ_3æ}í¬“wÉä¤?ÈúžÛð†hÁSÃú.•®‘Wä‘ÊïlEÕ
{…ø¡Ó;G -ÛðÈ‘·±±06Š ÅØ^-¢¿¶j?½F• t7×ñ90d6BäQ—Â-D‹L^àJj±ªÞ£z‹uõ7®G¶Ëx8›c°ˆ¿¤uæåE\#þò‚tò&™ª1ZP" ¦}Ä Ç‘…£4j@KÝΦkì÷£4„ã&]ÉøZ?$üÑ`'¿¿IËJ¦ž"ö:íb o¸ ùáé+‡²w7Jcðì··T#ôB^UlŸOj4V`qÅ‘ ˜a4 Li`^d)
Øt`]á^`¦°¨¡†p"üU±¼¬ŸTÂ숚*ü/¯¯Å¡FË;Ñøƒ JQ6‡F¿¯2`äø‘±ºÄ›n¸ãþ¹Ø‹|·^ÊÖëc -¾šÈÖϺ`] Ë4OòJv‰šU
N«µƒiqLË2í«ÿ - ŒÛÏiueK×±ôƒƒæÏBŽãŒÄaÓj˜¹¶jÞLpð0s«tÃüD»—yK[ÏÇ"ß»ø+Vý,/MÓ ~‚é;üd'DÄñCK˜ýl~h½u Äë!ÍTò'/Ø‹PˆÇª¦•…’²j(ÙöK«´A©«ÝOÉÔ^³ïÇTìq{–«íPo‘Í#/þéºÐ湚»×,Ý…ô¦¬+#wŸ[<¹ÂùÅ!Ù±r¹
-… º#õ:ÓÊEYi(^ds ›´¥«ÝÅÔ Oï7Õá¸D˜d™7žmôl‘‡ü€ºíÉÿ ã -.Wçñ|¾FñZD—øw¦~TЙìkUUIw9SAèJ6î$Í«z꾅щlÍ£ü~dÃÏu1dwG Û›VdÊJ# ‰å4i•6uµû‘™ÚËøBm¼DÁ¶Ï9„§L½Î´ç1NîC݇MyúýȺ‡ лéz~ÐÛ–±DÇÊŽ§^I§‚ö;•“~f8ö–…a4LK5eb©TÛtV]á^T¦°Žqn¨bœñ7ƒ´ºsnÔ©b‚å2^Åâêr…tÇÉÐû¼¤é“ÖÓ?±N©áv3¥†f#¥æÒè¢.lå¹x òüßµ·eYšìÕ‹Z¤uö×ÎÚyÍnð i©³xˆ¿OÛ3ùŽ>“þϯíUñ -endobj 2200 0 obj << -/Type /Page -/Contents 2201 0 R -/Resources 2199 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 2255 0 R +/D [2174 0 R /XYZ 85.0394 513.1518 null] +>> endobj +2201 0 obj << +/D [2174 0 R /XYZ 85.0394 509.7553 null] >> endobj 2202 0 obj << -/D [2200 0 R /XYZ 56.6929 794.5015 null] +/D [2174 0 R /XYZ 85.0394 483.0356 null] >> endobj 2203 0 obj << -/D [2200 0 R /XYZ 56.6929 748.5056 null] +/D [2174 0 R /XYZ 85.0394 479.6391 null] >> endobj 2204 0 obj << -/D [2200 0 R /XYZ 56.6929 748.5056 null] +/D [2174 0 R /XYZ 85.0394 464.8745 null] >> endobj 2205 0 obj << -/D [2200 0 R /XYZ 56.6929 748.5056 null] +/D [2174 0 R /XYZ 85.0394 461.4781 null] >> endobj 2206 0 obj << -/D [2200 0 R /XYZ 56.6929 743.7078 null] +/D [2174 0 R /XYZ 85.0394 446.7135 null] >> endobj 2207 0 obj << -/D [2200 0 R /XYZ 56.6929 719.6381 null] +/D [2174 0 R /XYZ 85.0394 443.3171 null] >> endobj 2208 0 obj << -/D [2200 0 R /XYZ 56.6929 711.8197 null] +/D [2174 0 R /XYZ 85.0394 428.5525 null] >> endobj 2209 0 obj << -/D [2200 0 R /XYZ 56.6929 697.0552 null] +/D [2174 0 R /XYZ 85.0394 425.156 null] >> endobj 2210 0 obj << -/D [2200 0 R /XYZ 56.6929 691.8868 null] +/D [2174 0 R /XYZ 85.0394 355.0758 null] >> endobj 2211 0 obj << -/D [2200 0 R /XYZ 56.6929 665.1671 null] +/D [2174 0 R /XYZ 85.0394 355.0758 null] >> endobj 2212 0 obj << -/D [2200 0 R /XYZ 56.6929 659.9987 null] +/D [2174 0 R /XYZ 85.0394 355.0758 null] >> endobj 2213 0 obj << -/D [2200 0 R /XYZ 56.6929 635.929 null] +/D [2174 0 R /XYZ 85.0394 352.0499 null] >> endobj 2214 0 obj << -/D [2200 0 R /XYZ 56.6929 628.1106 null] +/D [2174 0 R /XYZ 85.0394 337.3452 null] >> endobj 2215 0 obj << -/D [2200 0 R /XYZ 56.6929 601.3909 null] +/D [2174 0 R /XYZ 85.0394 333.8889 null] >> endobj 2216 0 obj << -/D [2200 0 R /XYZ 56.6929 596.2225 null] +/D [2174 0 R /XYZ 85.0394 309.8192 null] >> endobj 2217 0 obj << -/D [2200 0 R /XYZ 56.6929 569.5028 null] +/D [2174 0 R /XYZ 85.0394 303.7727 null] >> endobj 2218 0 obj << -/D [2200 0 R /XYZ 56.6929 564.3344 null] +/D [2174 0 R /XYZ 85.0394 278.3282 null] >> endobj 2219 0 obj << -/D [2200 0 R /XYZ 56.6929 549.6297 null] +/D [2174 0 R /XYZ 85.0394 273.6565 null] >> endobj 2220 0 obj << -/D [2200 0 R /XYZ 56.6929 544.4015 null] +/D [2174 0 R /XYZ 85.0394 246.9367 null] >> endobj 2221 0 obj << -/D [2200 0 R /XYZ 56.6929 529.6968 null] +/D [2174 0 R /XYZ 85.0394 243.5403 null] >> endobj 2222 0 obj << -/D [2200 0 R /XYZ 56.6929 524.4686 null] +/D [2174 0 R /XYZ 85.0394 173.5556 null] >> endobj 2223 0 obj << -/D [2200 0 R /XYZ 56.6929 500.3989 null] +/D [2174 0 R /XYZ 85.0394 173.5556 null] >> endobj 2224 0 obj << -/D [2200 0 R /XYZ 56.6929 492.5805 null] +/D [2174 0 R /XYZ 85.0394 173.5556 null] >> endobj 2225 0 obj << -/D [2200 0 R /XYZ 56.6929 467.136 null] +/D [2174 0 R /XYZ 85.0394 170.4341 null] >> endobj 2226 0 obj << -/D [2200 0 R /XYZ 56.6929 460.6924 null] +/D [2174 0 R /XYZ 85.0394 144.9896 null] >> endobj 2227 0 obj << -/D [2200 0 R /XYZ 56.6929 436.6227 null] +/D [2174 0 R /XYZ 85.0394 140.3179 null] >> endobj 2228 0 obj << -/D [2200 0 R /XYZ 56.6929 428.8043 null] +/D [2174 0 R /XYZ 85.0394 113.5982 null] >> endobj 2229 0 obj << -/D [2200 0 R /XYZ 56.6929 414.0996 null] +/D [2174 0 R /XYZ 85.0394 110.2017 null] >> endobj 2230 0 obj << -/D [2200 0 R /XYZ 56.6929 408.8714 null] +/D [2174 0 R /XYZ 85.0394 95.4372 null] >> endobj 2231 0 obj << -/D [2200 0 R /XYZ 56.6929 382.1516 null] ->> endobj -2232 0 obj << -/D [2200 0 R /XYZ 56.6929 376.9833 null] +/D [2174 0 R /XYZ 85.0394 92.0407 null] >> endobj -2233 0 obj << -/D [2200 0 R /XYZ 56.6929 350.2636 null] +2173 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F39 1173 0 R >> +/ProcSet [ /PDF /Text ] >> endobj 2234 0 obj << -/D [2200 0 R /XYZ 56.6929 345.0952 null] +/Length 2889 +/Filter /FlateDecode +>> +stream +xÚµšMsÛ8†ïþ:JU1† +< +}w„°i5LX[iÂã¶J7„O´{ ·´Xøé«M|§–=w¦í½˜A;ˆ‚ÈÀ öHü¿HiþM|˜øh²÷²ÈX–%òž.w˜C +†•…‚²Ò`¯·P°IºÚýLíù&?ýã⯲s¬Ø,¯dSšwç]ù?ý +?â7?Òù1Щsàží’º( +ü6¡¹$´HÊ*K^˜l¦µ£ïÞ©s±ðûgM,&†af0 †•…˜²2ˆb6iƒXW»Ÿ˜©½ÞÄÜÎ=ØYEXž(E_q@ü¿Ø&ÁFQã‚Z}ƒ¤Æ¯G¨ù +\'4v¹@`ã£Ø\ÇÄÆ?5ØÄaFÔÊ'0ÝÐA>Lº ¦i5 S[0-»Uºy¢Ý ³¥½©ŠC½KáˆN/ÙAlapød%osk†¼¯fÈCÞ(ò+Å[Œ0$aH;†ü~Îßkºžã)†Â¦^aüâ“4¾:îöG8ÔÊà ¹Å´‰´ÿÄs]8Ç4 #°
+ leeÀŽ,°mÒì®v?lS›ÃNÄ>ŠsÁÙô©>µœ_³º2#zas,E*[dè
ÐéС7[ +id„ý4¦Õ0m¥Ñ¡¥ +°I+ «Ý¿Lí{Ôu]î‹5e×¥ÓøX=ö[½‰®»"ååÑÇ¡®â»ûµðOÞ_3æ}í¬“wÉä¤?ÈúžÛð†hÁSÃú.•®‘Wä‘ÊïlEÕ
{…ø¡Ó;G +ÛðÈ‘·±±06Š ÅØ^-¢¿¶j?½F• t7×ñ90d6BäQ—Â-D‹L^àJj±ªÞ£z‹uõ7®G¶Ëx8›c°ˆ¿¤uæåE\#þò‚tò&™ª1ZP" ¦}Ä Ç‘…£4j@KÝΦkì÷£4„ã&]ÉøZ?$üÑ`'¿¿IËJ¦ž"ö:íb o¸ ùáé+‡²w7Jcðì··T#ôB^UlŸOj4V`qÅ‘ ˜a4 Li`^d)
Øt`]á^`¦°¨¡†p"üU±¼¬ŸTÂ숚*ü/¯¯Å¡FË;Ñøƒ JQ6‡F¿¯2`äø‘±ºÄ›n¸ãþ¹Ø‹|·^ÊÖëc +¾šÈÖϺ`] Ë4OòJv‰šU
N«µƒiqLË2í«ÿ + ŒÛÏiueK×±ôƒƒæÏBŽãŒÄaÓj˜¹¶jÞLpð0s«tÃüD»—yK[ÏÇ"ß»ø+Vý,/MÓ ~‚é;üd'DÄñCK˜ýl~h½u Äë!ÍTò'/Ø‹PˆÇª¦•…’²j(ÙöK«´A©«ÝOÉÔ^³ïÇTìq{–«íPo‘Í#/þéºÐ湚»×,Ý…ô¦¬+#wŸ[<¹ÂùÅ!Ù±r¹
+… º#õ:ÓÊEYi(^ds ›´¥«ÝÅÔ Oï7Õá¸D˜d™7žmôl‘‡ü€ºíÉÿ ã +.Wçñ|¾FñZD—øw¦~TЙìkUUIw9SAèJ6î$Í«z꾅щlÍ£ü~dÃÏu1dwG Û›VdÊJ# ‰å4i•6uµû‘™ÚËøBm¼DÁ¶Ï9„§L½Î´ç1NîC݇MyúýȺ‡ лéz~ÐÛ–±DÇÊŽ§^I§‚ö;•“~f8ö–…a4LK5eb©TÛtV]á^T¦°Žqn¨bœñ7ƒ´ºsnÔ©b‚å2^Åâêr…tÇÉÐû¼¤é“ÖÓ?±N©áv3¥†f#¥æÒè¢.lå¹x òüßµ·eYšìÕ‹Z¤uö×ÎÚyÍnð i©³xˆ¿OÛ3ùŽ>“þϯíUñ +endobj +2233 0 obj << +/Type /Page +/Contents 2234 0 R +/Resources 2232 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 2172 0 R >> endobj 2235 0 obj << -/D [2200 0 R /XYZ 56.6929 321.0255 null] +/D [2233 0 R /XYZ 56.6929 794.5015 null] >> endobj 2236 0 obj << -/D [2200 0 R /XYZ 56.6929 313.2071 null] +/D [2233 0 R /XYZ 56.6929 748.5056 null] >> endobj 2237 0 obj << -/D [2200 0 R /XYZ 56.6929 298.5024 null] +/D [2233 0 R /XYZ 56.6929 748.5056 null] >> endobj 2238 0 obj << -/D [2200 0 R /XYZ 56.6929 293.2742 null] +/D [2233 0 R /XYZ 56.6929 748.5056 null] >> endobj 2239 0 obj << -/D [2200 0 R /XYZ 56.6929 267.8297 null] +/D [2233 0 R /XYZ 56.6929 743.7078 null] >> endobj 2240 0 obj << -/D [2200 0 R /XYZ 56.6929 261.3861 null] +/D [2233 0 R /XYZ 56.6929 719.6381 null] >> endobj 2241 0 obj << -/D [2200 0 R /XYZ 56.6929 199.468 null] +/D [2233 0 R /XYZ 56.6929 711.8197 null] >> endobj 2242 0 obj << -/D [2200 0 R /XYZ 56.6929 199.468 null] +/D [2233 0 R /XYZ 56.6929 697.0552 null] >> endobj 2243 0 obj << -/D [2200 0 R /XYZ 56.6929 199.468 null] +/D [2233 0 R /XYZ 56.6929 691.8868 null] >> endobj 2244 0 obj << -/D [2200 0 R /XYZ 56.6929 191.7053 null] +/D [2233 0 R /XYZ 56.6929 665.1671 null] >> endobj 2245 0 obj << -/D [2200 0 R /XYZ 56.6929 176.9408 null] +/D [2233 0 R /XYZ 56.6929 659.9987 null] >> endobj 2246 0 obj << -/D [2200 0 R /XYZ 56.6929 171.7724 null] +/D [2233 0 R /XYZ 56.6929 635.929 null] >> endobj 2247 0 obj << -/D [2200 0 R /XYZ 56.6929 157.0677 null] +/D [2233 0 R /XYZ 56.6929 628.1106 null] >> endobj 2248 0 obj << -/D [2200 0 R /XYZ 56.6929 151.8395 null] +/D [2233 0 R /XYZ 56.6929 601.3909 null] >> endobj 2249 0 obj << -/D [2200 0 R /XYZ 56.6929 137.1348 null] +/D [2233 0 R /XYZ 56.6929 596.2225 null] >> endobj 2250 0 obj << -/D [2200 0 R /XYZ 56.6929 131.9066 null] +/D [2233 0 R /XYZ 56.6929 569.5028 null] >> endobj 2251 0 obj << -/D [2200 0 R /XYZ 56.6929 117.2018 null] +/D [2233 0 R /XYZ 56.6929 564.3344 null] >> endobj 2252 0 obj << -/D [2200 0 R /XYZ 56.6929 111.9736 null] +/D [2233 0 R /XYZ 56.6929 549.6297 null] >> endobj 2253 0 obj << -/D [2200 0 R /XYZ 56.6929 97.2091 null] +/D [2233 0 R /XYZ 56.6929 544.4015 null] >> endobj 2254 0 obj << -/D [2200 0 R /XYZ 56.6929 92.0407 null] +/D [2233 0 R /XYZ 56.6929 529.6968 null] >> endobj -2199 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F39 1161 0 R >> -/ProcSet [ /PDF /Text ] +2255 0 obj << +/D [2233 0 R /XYZ 56.6929 524.4686 null] +>> endobj +2256 0 obj << +/D [2233 0 R /XYZ 56.6929 500.3989 null] >> endobj -2258 0 obj << -/Length 2542 -/Filter /FlateDecode ->> -stream -xÚ¥Z[w£º~ϯð£½Ö˜Jqé›'Og’ÔÎô´kÎy ¶â°ŠÁœ9s~}·Ð‘<=]yH>Øß¾c<Að‡'1õI‚I” E˜N¶‡+4ÙÃÞý–2s%47¥®Ÿ¯þrG¢Iâ%¡ Nž_{Å Šc<yÞ}›.žžn –«Îæ>EÓ…7›S„ÔêÍíf6„o¾¢éõêúóêñ~½xúø/qѯˆ¢ÅÃRœl¾Þßßnžoåéúv±\=܃žýöüéêöY?¶ùjþÌÿ¹úöšìà
?]!$1|‡äá$ñ'‡«€„¨•üjsõw}Cc·½tLU”Ä ýhDW>ž`ì%”ú=eÑÄ ‰OZe- 6âµ ¬J›¬,jë[ Oq.-# À #KÈpôoë»Pùmˆ‰)òâžßªe†¨pØ¡bJ½8"Ô„]–‡4+Ä{§»CVdu/_VµX+;]´çûS¶c ÆÁ+ázA Æð@ü¾ „øOüÿ\6pÏY¨‡ò ^X%ÎpGžUÙ@œ/mÈ¡nCÊ¡p%¥UNIäP¹ ÚPúÛ¢vü¦< J©xmyË´IÅÑ]–3qtS¿"äïO‚±x[U3 O9M#T€2ƒ0 }*žfØO¦’kƪ† R¹÷¸mJƒŒ„XÉ èB¨2¥ìdh)MF‚};N莌3ìq2zà£dè0æÒ?ŠÝŸ¥ÄÇÔ ãØïS²Tl¤•éw쥚ÅÓSZýÐŒ„vF"xsŠâ ŒRF””bÄG9qAŒ ±-Œ˜àgÊ¿©²†U™t×Rëº,QÒƒô˜
«ÞYUF©(ŒÃ>×’‡/iQdÅ~ÀvÏqþ1£tšýž1‹ç8x}„¾@S'ä`I -i’|œ8Hrà
€-È_k©îòuà8‹<KkV˜z`Í÷²úwGQ¶eã …±ùA0žI>¦‡,o”Ói’ÖrûîGU¶k,E -²WÌ}’x”B]1| DX᪠-)ÒI8² ×à| -D}`k°ùzH‹v;–<óç‘<k˜¹mP7,ÏKÍt ²}Ó|Û«" -éÿBp7¥ Œ+)ƒrì Ümp>Ķn‚sF…‹±#ø4¥ w}vÓT`j¯K‚^ñÒ•‹µ±ŸïÄQ¾¯Ì‡‹è8:4‰8Œmúp€ÂŽq~ƒqq¯–p¾óE®nÒ#ü:O‹íkþáAL ƒº”ÍM);áZÊ ÜQ;¡;ÂÏ°Ç ï?Š ÛrÇx -ÈLíª¯ÝƒïüÂÙ)óWy~„{¹ÿý_ýò£
Šòr,4æ0[ÄV>ýˆzQx)]˜Rv>µTÇ'uNèŽÏ3ìq>{à =}gE7½S.%«‚ó©êÏrjÇtå¬Q„Gõ1þYoÓm»›x1xé„ ´H!]Ò£ÈÑùp
RÀN ä5ƒnŒ°Q3+ZÄpEdôºP•:¢ þ0 yCA»/ÁóêÁЯ%k”"J¼8 õ÷'IQ猣o(À±&B½ -endobj 2257 0 obj << -/Type /Page -/Contents 2258 0 R -/Resources 2256 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 2255 0 R +/D [2233 0 R /XYZ 56.6929 492.5805 null] +>> endobj +2258 0 obj << +/D [2233 0 R /XYZ 56.6929 467.136 null] >> endobj 2259 0 obj << -/D [2257 0 R /XYZ 85.0394 794.5015 null] +/D [2233 0 R /XYZ 56.6929 460.6924 null] >> endobj 2260 0 obj << -/D [2257 0 R /XYZ 85.0394 748.4854 null] +/D [2233 0 R /XYZ 56.6929 436.6227 null] >> endobj 2261 0 obj << -/D [2257 0 R /XYZ 85.0394 748.4854 null] +/D [2233 0 R /XYZ 56.6929 428.8043 null] >> endobj 2262 0 obj << -/D [2257 0 R /XYZ 85.0394 748.4854 null] +/D [2233 0 R /XYZ 56.6929 414.0996 null] >> endobj 2263 0 obj << -/D [2257 0 R /XYZ 85.0394 743.3452 null] +/D [2233 0 R /XYZ 56.6929 408.8714 null] >> endobj 2264 0 obj << -/D [2257 0 R /XYZ 85.0394 728.6405 null] +/D [2233 0 R /XYZ 56.6929 382.1516 null] >> endobj 2265 0 obj << -/D [2257 0 R /XYZ 85.0394 723.1655 null] +/D [2233 0 R /XYZ 56.6929 376.9833 null] >> endobj 2266 0 obj << -/D [2257 0 R /XYZ 85.0394 708.4607 null] +/D [2233 0 R /XYZ 56.6929 350.2636 null] >> endobj 2267 0 obj << -/D [2257 0 R /XYZ 85.0394 702.9857 null] +/D [2233 0 R /XYZ 56.6929 345.0952 null] >> endobj 2268 0 obj << -/D [2257 0 R /XYZ 85.0394 688.2211 null] +/D [2233 0 R /XYZ 56.6929 321.0255 null] >> endobj 2269 0 obj << -/D [2257 0 R /XYZ 85.0394 682.8059 null] +/D [2233 0 R /XYZ 56.6929 313.2071 null] >> endobj 2270 0 obj << -/D [2257 0 R /XYZ 85.0394 668.0414 null] +/D [2233 0 R /XYZ 56.6929 298.5024 null] >> endobj 2271 0 obj << -/D [2257 0 R /XYZ 85.0394 662.6262 null] +/D [2233 0 R /XYZ 56.6929 293.2742 null] >> endobj 2272 0 obj << -/D [2257 0 R /XYZ 85.0394 599.7666 null] +/D [2233 0 R /XYZ 56.6929 267.8297 null] >> endobj 2273 0 obj << -/D [2257 0 R /XYZ 85.0394 599.7666 null] +/D [2233 0 R /XYZ 56.6929 261.3861 null] >> endobj 2274 0 obj << -/D [2257 0 R /XYZ 85.0394 599.7666 null] +/D [2233 0 R /XYZ 56.6929 199.468 null] >> endobj 2275 0 obj << -/D [2257 0 R /XYZ 85.0394 591.7571 null] +/D [2233 0 R /XYZ 56.6929 199.468 null] >> endobj 2276 0 obj << -/D [2257 0 R /XYZ 85.0394 565.0374 null] +/D [2233 0 R /XYZ 56.6929 199.468 null] >> endobj 2277 0 obj << -/D [2257 0 R /XYZ 85.0394 559.6222 null] +/D [2233 0 R /XYZ 56.6929 191.7053 null] >> endobj 2278 0 obj << -/D [2257 0 R /XYZ 85.0394 534.1777 null] +/D [2233 0 R /XYZ 56.6929 176.9408 null] >> endobj 2279 0 obj << -/D [2257 0 R /XYZ 85.0394 527.4872 null] +/D [2233 0 R /XYZ 56.6929 171.7724 null] >> endobj 2280 0 obj << -/D [2257 0 R /XYZ 85.0394 502.0427 null] +/D [2233 0 R /XYZ 56.6929 157.0677 null] >> endobj 2281 0 obj << -/D [2257 0 R /XYZ 85.0394 495.3523 null] +/D [2233 0 R /XYZ 56.6929 151.8395 null] >> endobj 2282 0 obj << -/D [2257 0 R /XYZ 85.0394 420.5376 null] +/D [2233 0 R /XYZ 56.6929 137.1348 null] >> endobj 2283 0 obj << -/D [2257 0 R /XYZ 85.0394 420.5376 null] +/D [2233 0 R /XYZ 56.6929 131.9066 null] >> endobj 2284 0 obj << -/D [2257 0 R /XYZ 85.0394 420.5376 null] +/D [2233 0 R /XYZ 56.6929 117.2018 null] >> endobj 2285 0 obj << -/D [2257 0 R /XYZ 85.0394 412.5281 null] +/D [2233 0 R /XYZ 56.6929 111.9736 null] >> endobj 2286 0 obj << -/D [2257 0 R /XYZ 85.0394 388.4584 null] +/D [2233 0 R /XYZ 56.6929 97.2091 null] >> endobj 2287 0 obj << -/D [2257 0 R /XYZ 85.0394 380.3932 null] ->> endobj -2288 0 obj << -/D [2257 0 R /XYZ 85.0394 365.6884 null] +/D [2233 0 R /XYZ 56.6929 92.0407 null] >> endobj -2289 0 obj << -/D [2257 0 R /XYZ 85.0394 360.2134 null] +2232 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F39 1173 0 R >> +/ProcSet [ /PDF /Text ] >> endobj 2290 0 obj << -/D [2257 0 R /XYZ 85.0394 345.4488 null] +/Length 2542 +/Filter /FlateDecode +>> +stream +xÚ¥Z[w£º~ϯð£½Ö˜Jqé›'Og’ÔÎô´kÎy ¶â°ŠÁœ9s~}·Ð‘<=]yH>Øß¾c<Að‡'1õI‚I” E˜N¶‡+4ÙÃÞý–2s%47¥®Ÿ¯þrG¢Iâ%¡ Nž_{Å Šc<yÞ}›.žžn –«Îæ>EÓ…7›S„ÔêÍíf6„o¾¢éõêúóêñ~½xúø/qѯˆ¢ÅÃRœl¾Þßßnžoåéúv±\=܃žýöüéêöY?¶ùjþÌÿ¹úöšìà
?]!$1|‡äá$ñ'‡«€„¨•üjsõw}Cc·½tLU”Ä ýhDW>ž`ì%”ú=eÑÄ ‰OZe- 6âµ ¬J›¬,jë[ Oq.-# À #KÈpôoë»Pùmˆ‰)òâžßªe†¨pØ¡bJ½8"Ô„]–‡4+Ä{§»CVdu/_VµX+;]´çûS¶c ÆÁ+ázA Æð@ü¾ „øOüÿ\6pÏY¨‡ò ^X%ÎpGžUÙ@œ/mÈ¡nCÊ¡p%¥UNIäP¹ ÚPúÛ¢vü¦< J©xmyË´IÅÑ]–3qtS¿"äïO‚±x[U3 O9M#T€2ƒ0 }*žfØO¦’kƪ† R¹÷¸mJƒŒ„XÉ èB¨2¥ìdh)MF‚};N莌3ìq2zà£dè0æÒ?ŠÝŸ¥ÄÇÔ ãØïS²Tl¤•éw쥚ÅÓSZýÐŒ„vF"xsŠâ ŒRF””bÄG9qAŒ ±-Œ˜àgÊ¿©²†U™t×Rëº,QÒƒô˜
«ÞYUF©(ŒÃ>×’‡/iQdÅ~ÀvÏqþ1£tšýž1‹ç8x}„¾@S'ä`I +i’|œ8Hrà
€-È_k©îòuà8‹<KkV˜z`Í÷²úwGQ¶eã …±ùA0žI>¦‡,o”Ói’ÖrûîGU¶k,E +²WÌ}’x”B]1| DX᪠+)ÒI8² ×à| +D}`k°ùzH‹v;–<óç‘<k˜¹mP7,ÏKÍt ²}Ó|Û«" +éÿBp7¥ Œ+)ƒrì Ümp>Ķn‚sF…‹±#ø4¥ w}vÓT`j¯K‚^ñÒ•‹µ±ŸïÄQ¾¯Ì‡‹è8:4‰8Œmúp€ÂŽq~ƒqq¯–p¾óE®nÒ#ü:O‹íkþáAL ƒº”ÍM);áZÊ ÜQ;¡;ÂÏ°Ç ï?Š ÛrÇx +ÈLíª¯ÝƒïüÂÙ)óWy~„{¹ÿý_ýò£
Šòr,4æ0[ÄV>ýˆzQx)]˜Rv>µTÇ'uNèŽÏ3ìq>{à =}gE7½S.%«‚ó©êÏrjÇtå¬Q„Gõ1þYoÓm»›x1xé„ ´H!]Ò£ÈÑùp
RÀN ä5ƒnŒ°Q3+ZÄpEdôºP•:¢ þ0 yCA»/ÁóêÁЯ%k”"J¼8 õ÷'IQ猣o(À±&B½ +endobj +2289 0 obj << +/Type /Page +/Contents 2290 0 R +/Resources 2288 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 2172 0 R >> endobj 2291 0 obj << -/D [2257 0 R /XYZ 85.0394 340.0336 null] +/D [2289 0 R /XYZ 85.0394 794.5015 null] >> endobj 2292 0 obj << -/D [2257 0 R /XYZ 85.0394 325.269 null] +/D [2289 0 R /XYZ 85.0394 748.4854 null] >> endobj 2293 0 obj << -/D [2257 0 R /XYZ 85.0394 319.8539 null] +/D [2289 0 R /XYZ 85.0394 748.4854 null] >> endobj 2294 0 obj << -/D [2257 0 R /XYZ 85.0394 295.7842 null] +/D [2289 0 R /XYZ 85.0394 748.4854 null] >> endobj 2295 0 obj << -/D [2257 0 R /XYZ 85.0394 287.7189 null] +/D [2289 0 R /XYZ 85.0394 743.3452 null] >> endobj 2296 0 obj << -/D [2257 0 R /XYZ 85.0394 272.9543 null] +/D [2289 0 R /XYZ 85.0394 728.6405 null] >> endobj 2297 0 obj << -/D [2257 0 R /XYZ 85.0394 267.5392 null] +/D [2289 0 R /XYZ 85.0394 723.1655 null] >> endobj 2298 0 obj << -/D [2257 0 R /XYZ 85.0394 252.7746 null] +/D [2289 0 R /XYZ 85.0394 708.4607 null] >> endobj 2299 0 obj << -/D [2257 0 R /XYZ 85.0394 247.3594 null] +/D [2289 0 R /XYZ 85.0394 702.9857 null] >> endobj 2300 0 obj << -/D [2257 0 R /XYZ 85.0394 223.2897 null] +/D [2289 0 R /XYZ 85.0394 688.2211 null] >> endobj 2301 0 obj << -/D [2257 0 R /XYZ 85.0394 215.2245 null] +/D [2289 0 R /XYZ 85.0394 682.8059 null] >> endobj 2302 0 obj << -/D [2257 0 R /XYZ 85.0394 149.4956 null] +/D [2289 0 R /XYZ 85.0394 668.0414 null] >> endobj 2303 0 obj << -/D [2257 0 R /XYZ 85.0394 149.4956 null] +/D [2289 0 R /XYZ 85.0394 662.6262 null] >> endobj 2304 0 obj << -/D [2257 0 R /XYZ 85.0394 149.4956 null] +/D [2289 0 R /XYZ 85.0394 599.7666 null] >> endobj 2305 0 obj << -/D [2257 0 R /XYZ 85.0394 144.3554 null] +/D [2289 0 R /XYZ 85.0394 599.7666 null] >> endobj 2306 0 obj << -/D [2257 0 R /XYZ 85.0394 120.2857 null] +/D [2289 0 R /XYZ 85.0394 599.7666 null] >> endobj 2307 0 obj << -/D [2257 0 R /XYZ 85.0394 112.2205 null] +/D [2289 0 R /XYZ 85.0394 591.7571 null] >> endobj 2308 0 obj << -/D [2257 0 R /XYZ 85.0394 97.4559 null] +/D [2289 0 R /XYZ 85.0394 565.0374 null] >> endobj 2309 0 obj << -/D [2257 0 R /XYZ 85.0394 92.0407 null] +/D [2289 0 R /XYZ 85.0394 559.6222 null] >> endobj -2256 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F39 1161 0 R >> -/ProcSet [ /PDF /Text ] +2310 0 obj << +/D [2289 0 R /XYZ 85.0394 534.1777 null] >> endobj -2312 0 obj << -/Length 2928 -/Filter /FlateDecode ->> -stream -xÚ¥ZKs㸾ûWèºjÅ -á -/ágP´¸hmÞŠ† —ö´z, ¾ j枧Dãª;®cÝ"±ts/r/êë¾®Ö2//§¾Çœ;¹Î°Åù®i³5Q÷„#7?Ú¬lòªTÇt°; 37Š£Ö…²‚)¡p®]=U6m!_³KN#¾#êK ; Ò#KݸÒüŸåöe-K-å“,·²Þ¡VزQ4%Øi/`W‘{=§Ä}ï z×z†«C‹h½1Õz‡º‡Ñ³u+lð 3mÕMlšÊÄ5šŠcWÊužRç·ÍB¶Ù w}/±€Ts]ú 5Y£¨{³MÔ Å#Œ…ÂÆÇñ°¹NãÑquxbÄ›FUïñ8Ò=ˆGO÷ùóqoŠ„›$Áÿ€Á¯RuÓU‡Cr‡Ðw!žFgp°¸Fp0\ÁX<‚Øj ‡CÝÃ8غ
"Ž5Ø28¨v‡ƒˆ#ç d„ùÍ´¸æÈ—e^.©3Û¶«Jñ ãä… ’Vb=Ïs>¸4ñŸ—^³¢ -þU6M¶#šªÔ’\£j0 -p¹ë,µ]ÌÈœve"ù˜wÒ ö]Á‚3õ‚ÍuÒŽ«ƒ4 F U½‡ôH÷ ¤=ÝÙ"Cç)sr q¾ÊÿDÄT¬ËÊ6ÃjYÉVR ¡›]ë( ýç¼ ÂÅnÁ"÷1‘qŠ‰0§ ‰FXBã^3ý²]¬·å¢i0jˆFhÄ.–/§!…K†ŸÐueR‹kRÃeA:’êFU[ ê †ÔÖ}ÙÒŠ…˜¶Ìi¨´6'°Ôí¦ç•D!¯4Ü'½’Ç¡ëû1ïÇÍ{ 7{`Qbüï/À"|¸¦±3• Í5‹áê`‰F=mLµË¡îaXlÝ_ -*Ñ"§¬ZºêoƒP¡™Ki^Ü<0À‚R}…cn<ù›,Жb"UÿYUÛBS•Vl<gôýc[Ñ+0ª¬´4×$_ÒXja/hõm|¡»- 8fÍŸ¦Õz:„ÏF–¹’Ιó¼£/Y4y“2_« ªdÛ±hæ½Bç›çùhs
uÕráK(VKbmùhˆ+ù¦…HúùKÖÀò¨§¬¾MþƒëªlWz.Ø»Yâû*‡+çÀFõŠ{ÅÐYdÖ«vwdØV{zàYO!¹®'¤zÒhƒ; -B…{aª / ;ÏÕVÇ -õkD'. ~ØÉõ\°«H_G^²ýèä›»y.‹#<›Ø\ÇÙ„sæ›Ø Sé„ŸN$£Z÷‰äHí`"éi¥DÂíW,´Ê^tÙ'Vȇ9r[ФY÷®?$]Y8yúª ô¿ä[œÈ}(97»:_®Tv™ð(†
ø1þÖÂô-"¥% -اÅ÷ñ`èv -`+•Z1†^ž@¼lÐÛeg˜sŠ÷Ó¬[M”›M‘ÓëY3gÖU^ -â§.|Rƒ¶Im 3ìê\ñ–/²ƒI/UQTïT`7“.›ŸO@6á™Ë±Í¥"QÏ‘#÷ÒÐ’¥=9:T< {ãJ
Ó±ÒžÓÄÜ
ð׋žÒ'uIâ”Ù»:_h¦t4 ñ‹âh‘£e=A]-¶…ªÙ‚H{"’ÍWÒgÁNe)hXXQ̺€–…–Qj‘è˜/2Õ+ .«Jº> -® ,¸è«ª íEšN¡hKÂsÚZ–LµYÃÈ{Þ®¨%éƒÞš§ÛBÖÔo²úm_á óAÖ¢û9Ø(ããûÃ÷VSì¡Á
ø9-]@
v´tŸa€¢Á†ÂbC=¹x“¯Á§D°ØLÀ'sŬ(žCW$¢Ae™/¤y}æÝσ€ug¹ÄÚ7JÙÁà„ð“ÿìW¦*œªÕ/õÍ®LWkYm›ƒ» ¹ÙÉ+mœ¸p¼gž
-¦Ó h˜Î9à˜ÆÎÿ5ºŸQyŸz 5Яn çä^Š€W´Rå# >f-„·7ÌQØ¥‡ý ýBgQιƒÿ9ÁÕ¥¥¡¾w!Ej™–wa#»š ëÆÌjÁ_+Ê jUq²7â7ZHZ•/4‚Þh3"Ñf€Ä}–Þ6ë…ú}ÎW¹¤Ùd)ýÐD, {ËmmNæ@´zÄC"-|¿¤–zꢗ0Ê{¡d#ÓW¸î_ šì0À)¦u¾Ù¿v‡{–²Ñ['1´>å p½|§{ÂÎEàâ¿à ë.ÿ÷úXo@‘+âøÄO'^¸094‹Ru¥ -ÝüOÐñÚÿ ÔÑ
Nendstream -endobj 2311 0 obj << -/Type /Page -/Contents 2312 0 R -/Resources 2310 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 2255 0 R +/D [2289 0 R /XYZ 85.0394 527.4872 null] +>> endobj +2312 0 obj << +/D [2289 0 R /XYZ 85.0394 502.0427 null] >> endobj 2313 0 obj << -/D [2311 0 R /XYZ 56.6929 794.5015 null] +/D [2289 0 R /XYZ 85.0394 495.3523 null] >> endobj 2314 0 obj << -/D [2311 0 R /XYZ 56.6929 749.0089 null] +/D [2289 0 R /XYZ 85.0394 420.5376 null] >> endobj 2315 0 obj << -/D [2311 0 R /XYZ 56.6929 749.0089 null] +/D [2289 0 R /XYZ 85.0394 420.5376 null] >> endobj 2316 0 obj << -/D [2311 0 R /XYZ 56.6929 749.0089 null] +/D [2289 0 R /XYZ 85.0394 420.5376 null] >> endobj 2317 0 obj << -/D [2311 0 R /XYZ 56.6929 745.2843 null] +/D [2289 0 R /XYZ 85.0394 412.5281 null] >> endobj 2318 0 obj << -/D [2311 0 R /XYZ 56.6929 721.2146 null] +/D [2289 0 R /XYZ 85.0394 388.4584 null] >> endobj 2319 0 obj << -/D [2311 0 R /XYZ 56.6929 714.4694 null] +/D [2289 0 R /XYZ 85.0394 380.3932 null] >> endobj 2320 0 obj << -/D [2311 0 R /XYZ 56.6929 699.7048 null] +/D [2289 0 R /XYZ 85.0394 365.6884 null] >> endobj 2321 0 obj << -/D [2311 0 R /XYZ 56.6929 695.6096 null] +/D [2289 0 R /XYZ 85.0394 360.2134 null] >> endobj 2322 0 obj << -/D [2311 0 R /XYZ 56.6929 680.9049 null] +/D [2289 0 R /XYZ 85.0394 345.4488 null] >> endobj 2323 0 obj << -/D [2311 0 R /XYZ 56.6929 676.7499 null] +/D [2289 0 R /XYZ 85.0394 340.0336 null] >> endobj 2324 0 obj << -/D [2311 0 R /XYZ 56.6929 652.6802 null] +/D [2289 0 R /XYZ 85.0394 325.269 null] >> endobj 2325 0 obj << -/D [2311 0 R /XYZ 56.6929 645.935 null] +/D [2289 0 R /XYZ 85.0394 319.8539 null] >> endobj 2326 0 obj << -/D [2311 0 R /XYZ 56.6929 631.2303 null] +/D [2289 0 R /XYZ 85.0394 295.7842 null] >> endobj 2327 0 obj << -/D [2311 0 R /XYZ 56.6929 627.0752 null] +/D [2289 0 R /XYZ 85.0394 287.7189 null] >> endobj 2328 0 obj << -/D [2311 0 R /XYZ 56.6929 603.0055 null] +/D [2289 0 R /XYZ 85.0394 272.9543 null] >> endobj 2329 0 obj << -/D [2311 0 R /XYZ 56.6929 596.2603 null] +/D [2289 0 R /XYZ 85.0394 267.5392 null] >> endobj 2330 0 obj << -/D [2311 0 R /XYZ 56.6929 572.1906 null] +/D [2289 0 R /XYZ 85.0394 252.7746 null] >> endobj 2331 0 obj << -/D [2311 0 R /XYZ 56.6929 565.4454 null] +/D [2289 0 R /XYZ 85.0394 247.3594 null] >> endobj 2332 0 obj << -/D [2311 0 R /XYZ 56.6929 550.7407 null] +/D [2289 0 R /XYZ 85.0394 223.2897 null] >> endobj 2333 0 obj << -/D [2311 0 R /XYZ 56.6929 546.5857 null] +/D [2289 0 R /XYZ 85.0394 215.2245 null] >> endobj 2334 0 obj << -/D [2311 0 R /XYZ 56.6929 531.8211 null] +/D [2289 0 R /XYZ 85.0394 149.4956 null] >> endobj 2335 0 obj << -/D [2311 0 R /XYZ 56.6929 527.7259 null] +/D [2289 0 R /XYZ 85.0394 149.4956 null] >> endobj 2336 0 obj << -/D [2311 0 R /XYZ 56.6929 501.0062 null] +/D [2289 0 R /XYZ 85.0394 149.4956 null] >> endobj 2337 0 obj << -/D [2311 0 R /XYZ 56.6929 496.911 null] ->> endobj -778 0 obj << -/D [2311 0 R /XYZ 56.6929 464.7873 null] +/D [2289 0 R /XYZ 85.0394 144.3554 null] >> endobj 2338 0 obj << -/D [2311 0 R /XYZ 56.6929 439.0859 null] ->> endobj -782 0 obj << -/D [2311 0 R /XYZ 56.6929 352.4521 null] +/D [2289 0 R /XYZ 85.0394 120.2857 null] >> endobj 2339 0 obj << -/D [2311 0 R /XYZ 56.6929 326.7507 null] +/D [2289 0 R /XYZ 85.0394 112.2205 null] >> endobj 2340 0 obj << -/D [2311 0 R /XYZ 56.6929 290.6891 null] +/D [2289 0 R /XYZ 85.0394 97.4559 null] >> endobj 2341 0 obj << -/D [2311 0 R /XYZ 56.6929 290.6891 null] +/D [2289 0 R /XYZ 85.0394 92.0407 null] >> endobj -2342 0 obj << -/D [2311 0 R /XYZ 56.6929 290.6891 null] +2288 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F39 1173 0 R >> +/ProcSet [ /PDF /Text ] >> endobj +2344 0 obj << +/Length 2928 +/Filter /FlateDecode +>> +stream +xÚ¥ZKs㸾ûWèºjÅ +á +/ágP´¸hmÞŠ† —ö´z, ¾ j枧Dãª;®cÝ"±ts/r/êë¾®Ö2//§¾Çœ;¹Î°Åù®i³5Q÷„#7?Ú¬lòªTÇt°; 37Š£Ö…²‚)¡p®]=U6m!_³KN#¾#êK ; Ò#KݸÒüŸåöe-K-å“,·²Þ¡VزQ4%Øi/`W‘{=§Ä}ï z×z†«C‹h½1Õz‡º‡Ñ³u+lð 3mÕMlšÊÄ5šŠcWÊužRç·ÍB¶Ù w}/±€Ts]ú 5Y£¨{³MÔ Å#Œ…ÂÆÇñ°¹NãÑquxbÄ›FUïñ8Ò=ˆGO÷ùóqoŠ„›$Áÿ€Á¯RuÓU‡Cr‡Ðw!žFgp°¸Fp0\ÁX<‚Øj ‡CÝÃ8غ
"Ž5Ø28¨v‡ƒˆ#ç d„ùÍ´¸æÈ—e^.©3Û¶«Jñ ãä… ’Vb=Ïs>¸4ñŸ—^³¢ +þU6M¶#šªÔ’\£j0 +p¹ë,µ]ÌÈœve"ù˜wÒ ö]Á‚3õ‚ÍuÒŽ«ƒ4 F U½‡ôH÷ ¤=ÝÙ"Cç)sr q¾ÊÿDÄT¬ËÊ6ÃjYÉVR ¡›]ë( ýç¼ ÂÅnÁ"÷1‘qŠ‰0§ ‰FXBã^3ý²]¬·å¢i0jˆFhÄ.–/§!…K†ŸÐueR‹kRÃeA:’êFU[ ê †ÔÖ}ÙÒŠ…˜¶Ìi¨´6'°Ôí¦ç•D!¯4Ü'½’Ç¡ëû1ïÇÍ{ 7{`Qbüï/À"|¸¦±3• Í5‹áê`‰F=mLµË¡îaXlÝ_ +*Ñ"§¬ZºêoƒP¡™Ki^Ü<0À‚R}…cn<ù›,Жb"UÿYUÛBS•Vl<gôýc[Ñ+0ª¬´4×$_ÒXja/hõm|¡»- 8fÍŸ¦Õz:„ÏF–¹’Ιó¼£/Y4y“2_« ªdÛ±hæ½Bç›çùhs
uÕráK(VKbmùhˆ+ù¦…HúùKÖÀò¨§¬¾MþƒëªlWz.Ø»Yâû*‡+çÀFõŠ{ÅÐYdÖ«vwdØV{zàYO!¹®'¤zÒhƒ; +B…{aª / ;ÏÕVÇ +õkD'. ~ØÉõ\°«H_G^²ýèä›»y.‹#<›Ø\ÇÙ„sæ›Ø Sé„ŸN$£Z÷‰äHí`"éi¥DÂíW,´Ê^tÙ'Vȇ9r[ФY÷®?$]Y8yúª ô¿ä[œÈ}(97»:_®Tv™ð(†
ø1þÖÂô-"¥% +اÅ÷ñ`èv +`+•Z1†^ž@¼lÐÛeg˜sŠ÷Ó¬[M”›M‘ÓëY3gÖU^ +â§.|Rƒ¶Im 3ìê\ñ–/²ƒI/UQTïT`7“.›ŸO@6á™Ë±Í¥"QÏ‘#÷ÒÐ’¥=9:T< {ãJ
Ó±ÒžÓÄÜ
ð׋žÒ'uIâ”Ù»:_h¦t4 ñ‹âh‘£e=A]-¶…ªÙ‚H{"’ÍWÒgÁNe)hXXQ̺€–…–Qj‘è˜/2Õ+ .«Jº> +® ,¸è«ª íEšN¡hKÂsÚZ–LµYÃÈ{Þ®¨%éƒÞš§ÛBÖÔo²úm_á óAÖ¢û9Ø(ããûÃ÷VSì¡Á
ø9-]@
v´tŸa€¢Á†ÂbC=¹x“¯Á§D°ØLÀ'sŬ(žCW$¢Ae™/¤y}æÝσ€ug¹ÄÚ7JÙÁà„ð“ÿìW¦*œªÕ/õÍ®LWkYm›ƒ» ¹ÙÉ+mœ¸p¼gž
-¦Ó h˜Î9à˜ÆÎÿ5ºŸQyŸz 5Яn çä^Š€W´Rå# >f-„·7ÌQØ¥‡ý ýBgQιƒÿ9ÁÕ¥¥¡¾w!Ej™–wa#»š ëÆÌjÁ_+Ê jUq²7â7ZHZ•/4‚Þh3"Ñf€Ä}–Þ6ë…ú}ÎW¹¤Ùd)ýÐD, {ËmmNæ@´zÄC"-|¿¤–zꢗ0Ê{¡d#ÓW¸î_ šì0À)¦u¾Ù¿v‡{–²Ñ['1´>å p½|§{ÂÎEàâ¿à ë.ÿ÷úXo@‘+âøÄO'^¸094‹Ru¥`GK7ÿt¼öÿÓž
Gendstream +endobj 2343 0 obj << -/D [2311 0 R /XYZ 56.6929 290.6891 null] +/Type /Page +/Contents 2344 0 R +/Resources 2342 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 2172 0 R +>> endobj +2345 0 obj << +/D [2343 0 R /XYZ 56.6929 794.5015 null] +>> endobj +2346 0 obj << +/D [2343 0 R /XYZ 56.6929 749.0089 null] +>> endobj +2347 0 obj << +/D [2343 0 R /XYZ 56.6929 749.0089 null] +>> endobj +2348 0 obj << +/D [2343 0 R /XYZ 56.6929 749.0089 null] +>> endobj +2349 0 obj << +/D [2343 0 R /XYZ 56.6929 745.2843 null] +>> endobj +2350 0 obj << +/D [2343 0 R /XYZ 56.6929 721.2146 null] +>> endobj +2351 0 obj << +/D [2343 0 R /XYZ 56.6929 714.4694 null] +>> endobj +2352 0 obj << +/D [2343 0 R /XYZ 56.6929 699.7048 null] +>> endobj +2353 0 obj << +/D [2343 0 R /XYZ 56.6929 695.6096 null] +>> endobj +2354 0 obj << +/D [2343 0 R /XYZ 56.6929 680.9049 null] +>> endobj +2355 0 obj << +/D [2343 0 R /XYZ 56.6929 676.7499 null] +>> endobj +2356 0 obj << +/D [2343 0 R /XYZ 56.6929 652.6802 null] +>> endobj +2357 0 obj << +/D [2343 0 R /XYZ 56.6929 645.935 null] +>> endobj +2358 0 obj << +/D [2343 0 R /XYZ 56.6929 631.2303 null] +>> endobj +2359 0 obj << +/D [2343 0 R /XYZ 56.6929 627.0752 null] +>> endobj +2360 0 obj << +/D [2343 0 R /XYZ 56.6929 603.0055 null] +>> endobj +2361 0 obj << +/D [2343 0 R /XYZ 56.6929 596.2603 null] +>> endobj +2362 0 obj << +/D [2343 0 R /XYZ 56.6929 572.1906 null] +>> endobj +2363 0 obj << +/D [2343 0 R /XYZ 56.6929 565.4454 null] +>> endobj +2364 0 obj << +/D [2343 0 R /XYZ 56.6929 550.7407 null] +>> endobj +2365 0 obj << +/D [2343 0 R /XYZ 56.6929 546.5857 null] +>> endobj +2366 0 obj << +/D [2343 0 R /XYZ 56.6929 531.8211 null] +>> endobj +2367 0 obj << +/D [2343 0 R /XYZ 56.6929 527.7259 null] +>> endobj +2368 0 obj << +/D [2343 0 R /XYZ 56.6929 501.0062 null] +>> endobj +2369 0 obj << +/D [2343 0 R /XYZ 56.6929 496.911 null] +>> endobj +778 0 obj << +/D [2343 0 R /XYZ 56.6929 464.7873 null] +>> endobj +2370 0 obj << +/D [2343 0 R /XYZ 56.6929 439.0859 null] +>> endobj +782 0 obj << +/D [2343 0 R /XYZ 56.6929 352.4521 null] +>> endobj +2371 0 obj << +/D [2343 0 R /XYZ 56.6929 326.7507 null] +>> endobj +2372 0 obj << +/D [2343 0 R /XYZ 56.6929 290.6891 null] +>> endobj +2373 0 obj << +/D [2343 0 R /XYZ 56.6929 290.6891 null] +>> endobj +2374 0 obj << +/D [2343 0 R /XYZ 56.6929 290.6891 null] +>> endobj +2375 0 obj << +/D [2343 0 R /XYZ 56.6929 290.6891 null] >> endobj 786 0 obj << -/D [2311 0 R /XYZ 56.6929 241.4457 null] +/D [2343 0 R /XYZ 56.6929 241.4457 null] >> endobj -2344 0 obj << -/D [2311 0 R /XYZ 56.6929 201.7704 null] +2376 0 obj << +/D [2343 0 R /XYZ 56.6929 201.7704 null] >> endobj -2310 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F39 1161 0 R /F14 964 0 R >> +2342 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F39 1173 0 R /F14 976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2347 0 obj << -/Length 2294 +2379 0 obj << +/Length 2293 /Filter /FlateDecode >> stream @@ -11021,47 +11223,47 @@ bsب– ²y< ChR µJH%âWÇ«jØb€;WP§ªbu8›ZÎURC—iÑÁ„&L^š P#¢
&6æ0wV}-±b]íO«–í%9µ2¶žTû¾Ò“žAäíEÑѣ̀~ã Ê»Ì^¹¾'åe ±)ìúŸ`Ö nqaSx¿áÄ«¶´¥$ÓÕå„á#áQàY1Ó½|Os‘ï¤Íw¿”Æ æƒ’ÊáNšë¥jÚZÓ‡„—8@Ääܘêån zs€{Uêq€»;9Àˆýp2 ßh0á–ÂCP˜XÃg‰±ˆ€ âLî€× Û Èwƒã´‚ðYÝ26iàÞ.‘ØO|)Úˆ8ñKD˜‰••@Åt"'%M_ñX¨Ù«9÷}WúL¾qŸ#ªWzû>_“:ºÏs±Ó÷9K ^"áÐtÀ¼¿TF¹ ‘Ë¥é:$ã˜b¯¦m‹ì ›ýpG'ßNìWšèäúÍÖ’žm/zèᢋÛYìÜå´dF+ö‰™Ú¡¾™ 8¢oX/dîpŠ³:áØ8Ò WÐBi :–Ž™ .Ó>÷7ŠCßfœÈ²‰œ#„‰¸§Ú¯ua‡H;B£x“kéƒÞqàõÁûxÁÏD‚…¶êÚ³IÙªJ¹’Ì
Exêìc…±dÐż³@©ß•%±3Hqøñ….oÔ~½9»åη¨ks“ÓÛ;‚W%0þ5=ÿ}Ï ÷Âòÿ?]¾}¾‘Ž_§œòÕVx*åW1ùQž
%ìoÿ{☻dèŠ(ò¦sˆ€\Sï… -q/>?º/ PG^8qöÿJœ»èendstream +qÁÏî (Ô‘Nœý¿Ii»áendstream endobj -2346 0 obj << +2378 0 obj << /Type /Page -/Contents 2347 0 R -/Resources 2345 0 R +/Contents 2379 0 R +/Resources 2377 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2255 0 R +/Parent 2172 0 R >> endobj -2348 0 obj << -/D [2346 0 R /XYZ 85.0394 794.5015 null] +2380 0 obj << +/D [2378 0 R /XYZ 85.0394 794.5015 null] >> endobj 790 0 obj << -/D [2346 0 R /XYZ 85.0394 662.3711 null] +/D [2378 0 R /XYZ 85.0394 662.3711 null] >> endobj -2349 0 obj << -/D [2346 0 R /XYZ 85.0394 634.4781 null] +2381 0 obj << +/D [2378 0 R /XYZ 85.0394 634.4781 null] >> endobj 794 0 obj << -/D [2346 0 R /XYZ 85.0394 566.8617 null] +/D [2378 0 R /XYZ 85.0394 566.8617 null] >> endobj -2350 0 obj << -/D [2346 0 R /XYZ 85.0394 536.3186 null] +2382 0 obj << +/D [2378 0 R /XYZ 85.0394 536.3186 null] >> endobj 798 0 obj << -/D [2346 0 R /XYZ 85.0394 411.7882 null] +/D [2378 0 R /XYZ 85.0394 411.7882 null] >> endobj -2351 0 obj << -/D [2346 0 R /XYZ 85.0394 386.7645 null] +2383 0 obj << +/D [2378 0 R /XYZ 85.0394 386.7645 null] >> endobj 802 0 obj << -/D [2346 0 R /XYZ 85.0394 230.2565 null] +/D [2378 0 R /XYZ 85.0394 230.2565 null] >> endobj -2352 0 obj << -/D [2346 0 R /XYZ 85.0394 203.9874 null] +2384 0 obj << +/D [2378 0 R /XYZ 85.0394 203.9874 null] >> endobj -2345 0 obj << -/Font << /F37 1026 0 R /F14 964 0 R /F22 961 0 R /F21 938 0 R /F41 1218 0 R >> +2377 0 obj << +/Font << /F37 1038 0 R /F14 976 0 R /F22 973 0 R /F21 950 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2355 0 obj << +2387 0 obj << /Length 2527 /Filter /FlateDecode >> @@ -11078,49 +11280,49 @@ A! zBΪª zÊaÄwIl3H’ ²R7IK#«pˆ1‚¾‡JʤM.“]²È‹¼=Ð <QÊF,\zÔya`,öºu1ƒâA ävXíÐð0Išõ› ±ÕFM-‡ÇJ
ðk¿ãètw«é¬÷˜Øšwg=§ H¨ã -e0ì>Ùr${ÑÁãÍðÍtÜŠzéÙüDñùîÏ¡9rP#nßÔ“±ÏOè(µ”GµMo£g~ÿÑèþ¾–Ž¥ 4úøôyyyI´î KyÅK¶˜¦C7c§±¯ë)ÆãØ£‘8hyøíÎ,|¦ïO ðOcŸõ;²2ˆm–h CnÚwš‡i3ÁE HèówUfÿ4ûðU‚ð`¡É×%Ý(í6O!•î‰%[VÏ¥!Ø£Ò` `Û.X»+ÛÚÐÝUù‡ž×]DÎï a38îÈË-Õ6oé +ª&i6‰ ‰yÊÄ_ì E\ áê⃣òþR5âѼ«Ãÿï ÄŽ/— T•Ñ¥^A†Ð±Ä06B¡„âç‘Ôütv.û<8-›endstream +e0ì>Ùr${ÑÁãÍðÍtÜŠzéÙüDñùîÏ¡9rP#nßÔ“±ÏOè(µ”GµMo£g~ÿÑèþ¾–Ž¥ 4úøôyyyI´î KyÅK¶˜¦C7c§±¯ë)ÆãØ£‘8hyøíÎ,|¦ïO ðOcŸõ;²2ˆm–h CnÚwš‡i3ÁE HèówUfÿ4ûðU‚ð`¡É×%Ý(í6O!•î‰%[VÏ¥!Ø£Ò` `Û.X»+ÛÚÐÝUù‡ž×]DÎï a38îÈË-Õ6oé +ª&i6‰ ‰yÊÄ_ì E\ áê⃣òþR5âѼ«Ãÿï ÄŽ/— T•Ñ¥^A†Ð±Ä06B¡„’ç‘Ôütv.û<-endstream endobj -2354 0 obj << +2386 0 obj << /Type /Page -/Contents 2355 0 R -/Resources 2353 0 R +/Contents 2387 0 R +/Resources 2385 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2255 0 R -/Annots [ 2358 0 R ] +/Parent 2393 0 R +/Annots [ 2390 0 R ] >> endobj -2358 0 obj << +2390 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [344.9397 501.3201 406.1397 512.7122] /Subtype /Link /A << /S /GoTo /D (trusted-keys) >> >> endobj -2356 0 obj << -/D [2354 0 R /XYZ 56.6929 794.5015 null] +2388 0 obj << +/D [2386 0 R /XYZ 56.6929 794.5015 null] >> endobj 806 0 obj << -/D [2354 0 R /XYZ 56.6929 609.3932 null] +/D [2386 0 R /XYZ 56.6929 609.3932 null] >> endobj -2357 0 obj << -/D [2354 0 R /XYZ 56.6929 583.208 null] +2389 0 obj << +/D [2386 0 R /XYZ 56.6929 583.208 null] >> endobj 810 0 obj << -/D [2354 0 R /XYZ 56.6929 484.1849 null] +/D [2386 0 R /XYZ 56.6929 484.1849 null] >> endobj -2359 0 obj << -/D [2354 0 R /XYZ 56.6929 454.463 null] +2391 0 obj << +/D [2386 0 R /XYZ 56.6929 454.463 null] >> endobj 814 0 obj << -/D [2354 0 R /XYZ 56.6929 405.4622 null] +/D [2386 0 R /XYZ 56.6929 405.4622 null] >> endobj -2360 0 obj << -/D [2354 0 R /XYZ 56.6929 378.8348 null] +2392 0 obj << +/D [2386 0 R /XYZ 56.6929 378.8348 null] >> endobj -2353 0 obj << -/Font << /F37 1026 0 R /F41 1218 0 R /F14 964 0 R /F22 961 0 R /F21 938 0 R >> +2385 0 obj << +/Font << /F37 1038 0 R /F41 1233 0 R /F14 976 0 R /F22 973 0 R /F21 950 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2363 0 obj << +2396 0 obj << /Length 2458 /Filter /FlateDecode >> @@ -11129,41 +11331,41 @@ xÚÍZ[oÛ:~ϯðÛq€c–w‰yKÛì"»9Ù&vÑöA±åD¨,¹’œË¿ß!‡TD[¶Hv±(ZÓähøif8ó
k6¡ð‡MRE¨0r’ ‡P¡‹¾¶Ù}ÈœC¡‰¿…d:žÁ8gD =QüL¾=}³Â‘RU˜Œé·
é˧‰ {‡ƒ/_vpJ©Ìû 7‚$B¦òîe{ÈEµÞì&!ç“wÛ+< VHM4$ì¬QWŠ¹o%š‡€2NâÏuWÔUÈ.Œ-¹vι߬ ¿¶gû¬Œ¤F ¡¦C©ý ¶—RÓ=…˜[ú,U´ÿÛ*qÐx,ã ˆ{„v_){ Ãåa3õR#[Gõ@ H IŠ·¶9Kj(ÅGqý• f=XðNïÔ_©0ÁL s¡þÂðµþÚ
úúë ´õ(ŸqY`è ¹ tÁÄBò$‰aUûÐnÖëºéòE8g¡ª>0\²Á™Ùèuy|OŒÊÔ@3æpŒ¥öÇh/åbtoºbÔÀù‚`j}[|G€2Æ ‰Ž‘ÚŒµƒQpB5OÛ§—Ù7&+ ¡R²xß×ndÈHÀ^8aQ3D oËÜmÏyòe¶)½ÙC$ôõ{ù ¤<Hçé±PH … e_t´0Fm®ÐѶoì¼Æ#m_¡ êÆ _KAœKbh*§—Ù9ŽNÒÔ¤ñΞ5z"6pø6‰mãà.j §Zø˜È³Ð”EåÅæPÆ`‹¶£§¬Õ}¹‡;{Ͼ-uÌTFl,ŽË p
ÅÜûôôDMë³[=; ¨ò.@ UKžŸŸƒš1ž.4I5³'P‘$õi ‰ºˆ‰z“ùi»ýT½¿üꚬj³¹MÞte¹ô8%¿td6í/œ9îÃ|Ÿá†è¾~¥¿/ÀlÎC±I$v ,°>]7E…þcá\³àý5x7G±§¢{ÀµUQ«¬Ä/kdÐs(9àlçTÕ#^Ôy[ýæ¿À«{ˆã|ÜòuŽv7ðm„]3s£§E‡ËmW¯[ zÂÏ· ¤px—í¾¾ã bzéQ×Nñˆk¡!µíïÛŒbÓeÑùbq¥‘G åþ`…¸Þ=·,M‰N( -É)´ ½
n»v—?dE È€Ò‰£~v›.û™±)8 ±sY©F)á ¨ +É)´ ½
n»v—?dE È€Ò‰£~v›.û™±)8 ±sY©F)á ¨ endobj -2362 0 obj << +2395 0 obj << /Type /Page -/Contents 2363 0 R -/Resources 2361 0 R +/Contents 2396 0 R +/Resources 2394 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2255 0 R +/Parent 2393 0 R >> endobj -2364 0 obj << -/D [2362 0 R /XYZ 85.0394 794.5015 null] +2397 0 obj << +/D [2395 0 R /XYZ 85.0394 794.5015 null] >> endobj 818 0 obj << -/D [2362 0 R /XYZ 85.0394 650.8348 null] +/D [2395 0 R /XYZ 85.0394 650.8348 null] >> endobj -2365 0 obj << -/D [2362 0 R /XYZ 85.0394 625.7398 null] +2398 0 obj << +/D [2395 0 R /XYZ 85.0394 625.7398 null] >> endobj 822 0 obj << -/D [2362 0 R /XYZ 85.0394 378.0874 null] +/D [2395 0 R /XYZ 85.0394 378.0874 null] >> endobj -2366 0 obj << -/D [2362 0 R /XYZ 85.0394 350.2627 null] +2399 0 obj << +/D [2395 0 R /XYZ 85.0394 350.2627 null] >> endobj 826 0 obj << -/D [2362 0 R /XYZ 85.0394 153.7325 null] +/D [2395 0 R /XYZ 85.0394 153.7325 null] >> endobj -2367 0 obj << -/D [2362 0 R /XYZ 85.0394 128.6375 null] +2400 0 obj << +/D [2395 0 R /XYZ 85.0394 128.6375 null] >> endobj -2361 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R >> +2394 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2370 0 obj << +2403 0 obj << /Length 2393 /Filter /FlateDecode >> @@ -11174,30 +11376,30 @@ xÚÅY_sÛ8ϧðtîAž]sùWsOé5·“Ý6—xgî¦ÛÅV]m˵”¦î§?€ eÊ–Îv(Aø€ÅˆÃ12)K´ =GƒjÁ‘žÓ`§y½„´ÏŸV‡;äf‘9}¢Øƒ"Ÿ26Ç ¨rÅR®ÒÓŒ¹Ž°ãBåW`’CØ+¹W€‰o(À΀3+2qz ×À.úg`XŽÖÛÆ-Þ(AÐn×{‡»r½.7…OQ0£¸¬¨Äå#˜ÅUŒÄ Møvs˧ !V£ îhL(£˜0ù ÙdÌuâH—;Ò¥o?ÕàPÀʜԤãP¥Ÿj(ØSÓ×¥;%C“¨‘'Õô¼ó3¤÷ K È.<Óv]ÍŠ½”_ j[á ëÉϾh’Y²¨¡ò«?ú—ê£çE›Ì€ÈWL+¸½zØ;þF6¼¹ÙùÒÍ› ¬¦øç…°cGÈ\™Jõ7ÝÁZÀ-l ¾…¡pqÇeÑw dùaøbïBïš¹Òõì²^ u»¿ Ám¤2ðAiS&”²Î"o£FŒIáÎuU3J xõ«À¶m*“Ë}Ë€LžÉlW ìÖ:_} @S,ì S4v{ÝÙÀ~ºZÊÑ›v4Š6ObÉnSi쥬Ÿq@ß÷q-6ž»¼³Á¶š•c¸½±½&²¤ô¸€,ØÁg½¡ºdâéKüÒÁ ÔGÏ^¬×›zí¿éú¨
™"ù<–&qp‰¬¡që?ÖÉW4` Vö·!ŒîÇÊé@5Nßfy -—„oÍ98ŒÍ již–î•.¡UÔèj”ëй^ÖQ›ENj¾×¡ËÚB-3s½h˜£üG®ù…ßQ‹GC.ý9 òÃtRr.Îçwùù9”ªúG
½ÿ«dZgNÂ_ +—„oÍ98ŒÍ již–î•.¡UÔèj”ëй^ÖQ›ENj¾×¡ËÚB-3s½h˜£üG®ù…ßQ‹GC.ý9 òÃtRr.Îçwùù9”ªúG
½ÿ«dZgNÂ_ endobj -2369 0 obj << +2402 0 obj << /Type /Page -/Contents 2370 0 R -/Resources 2368 0 R +/Contents 2403 0 R +/Resources 2401 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2373 0 R +/Parent 2393 0 R >> endobj -2371 0 obj << -/D [2369 0 R /XYZ 56.6929 794.5015 null] +2404 0 obj << +/D [2402 0 R /XYZ 56.6929 794.5015 null] >> endobj 830 0 obj << -/D [2369 0 R /XYZ 56.6929 740.3318 null] +/D [2402 0 R /XYZ 56.6929 740.3318 null] >> endobj -2372 0 obj << -/D [2369 0 R /XYZ 56.6929 714.7319 null] +2405 0 obj << +/D [2402 0 R /XYZ 56.6929 714.7319 null] >> endobj -2368 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F21 938 0 R /F14 964 0 R /F62 1361 0 R /F41 1218 0 R >> -/XObject << /Im2 1350 0 R >> +2401 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F21 950 0 R /F14 976 0 R /F62 1379 0 R /F41 1233 0 R >> +/XObject << /Im2 1368 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2376 0 obj << +2408 0 obj << /Length 1890 /Filter /FlateDecode >> @@ -11207,55 +11409,55 @@ xÚÉnÛ8ôî¯ðQj–›¶™SÚ¦ƒE›IR`i²DÇBµ¸’ 'óõóÈGÊ’$t’ƒžÉÇ·o$›SøgóÈ'TÄr Æ’ø”ùó´œÑ Ÿ 8k…“,C#µÓ-¯¶»îXnÁ Êþ?¹{Š¯È-xL"Åc¹¿SÊ ug|ù*IƾóedP¾nµ›Û“*M õ¡Ø:Xh<Ý},Îr€„’±‰’ê4Óev̪²”òe~ç”ßÐqL$÷ÇüšEäíª£¢ç*ðwÎe¦V»{
àRYgŠ` îónãä®H›!|ÿûÜu‡lWnRP¿žŽZFÞá×Ö(} %Ϲz¡œ±—ý0ÄzÞ=–ñÄÉ'‰âà–i‚åȉÂðˆ%TMÔ9iÉÀ:«ºÍ»§qªÁE¶SUuS&Ö¬Em{h é…¨µžºéýcŠ¡œOÚJs ®Â•»¢ËM-6žÍÔ³¦÷9aBðWL?ÀzÁô˘þ¥ È8%aàÙÿR%é)¾"+ã‚„þ‘¬º `4‰i_õÞÛ‡Xx Ÿª|.ò9ºõ
€2°ÅÖZUe¦ „¦ óÁ–Å°ós§šÜ¤,›á&èZ…û‡«.¬c±Ö¤ëÒîŽæBËMdghR½‹é7M»*s“T?öj‡þ~4 ¥IQàÄ{̲þɺç0%ýÜÎºÛ v´f'Ìì$2 8z¯ñ=PW…O ȆýCGhŸ9>» ¯™£ÕZ5ªJQá—_'δ·1ýµY# 5y -jm¥ -·Çª¿k7„ÂAk™T»¤°ZÈ[xC[úê1UÛ 8tIMw%DEÚ¨%\±nÝŸšH˜p°™µ}k²Iò +jm¥ -·Çª¿k7„ÂAk™T»¤°ZÈ[xC[úê1UÛ 8tIMw%DEÚ¨%\±nÝŸšH˜p°™µ}k²Iò endobj -2375 0 obj << +2407 0 obj << /Type /Page -/Contents 2376 0 R -/Resources 2374 0 R +/Contents 2408 0 R +/Resources 2406 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2373 0 R +/Parent 2393 0 R >> endobj -2377 0 obj << -/D [2375 0 R /XYZ 85.0394 794.5015 null] +2409 0 obj << +/D [2407 0 R /XYZ 85.0394 794.5015 null] >> endobj 834 0 obj << -/D [2375 0 R /XYZ 85.0394 741.6375 null] +/D [2407 0 R /XYZ 85.0394 741.6375 null] >> endobj -2378 0 obj << -/D [2375 0 R /XYZ 85.0394 716.9352 null] +2410 0 obj << +/D [2407 0 R /XYZ 85.0394 716.9352 null] >> endobj 838 0 obj << -/D [2375 0 R /XYZ 85.0394 420.5643 null] +/D [2407 0 R /XYZ 85.0394 420.5643 null] >> endobj -2379 0 obj << -/D [2375 0 R /XYZ 85.0394 393.2598 null] +2411 0 obj << +/D [2407 0 R /XYZ 85.0394 393.2598 null] >> endobj -2374 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F21 938 0 R >> +2406 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F21 950 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2382 0 obj << +2414 0 obj << /Length 69 /Filter /FlateDecode >> stream xÚ3T0 endobj -2381 0 obj << +2413 0 obj << /Type /Page -/Contents 2382 0 R -/Resources 2380 0 R +/Contents 2414 0 R +/Resources 2412 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2373 0 R +/Parent 2393 0 R >> endobj -2383 0 obj << -/D [2381 0 R /XYZ 56.6929 794.5015 null] +2415 0 obj << +/D [2413 0 R /XYZ 56.6929 794.5015 null] >> endobj -2380 0 obj << +2412 0 obj << /ProcSet [ /PDF ] >> endobj -2386 0 obj << +2418 0 obj << /Length 2016 /Filter /FlateDecode >> @@ -11264,44 +11466,44 @@ xÚµXK㸾ϯ0=¸‡oI{ʼ’é¦'Øé ‡™>¨mÚF–´¢Ü=Fÿž"‹”%·¼F°h“ÅâÇb½)¶ ðÇ™"Tär‘æ’ E2"äª*fyN²,ÍÏ7W7eeêÁäS!S’qšžc~ÿ?`î‡Q;ƒžçõ*ËÉà?°»mºþ/—t‘ ñûU±/ˆÌÉçxýU¼þØþx?®â9wšÃ“„ë–?^…ûºÛ«_ ÜùnŽ3È9%2§ú Z#ýà3H" qÍ´ 2eàq+_Ö.Æ«êèf^Ýk¤?—ýi«f¿í'UY\ÃØ ö¦î3â`\ä.*Û ×®°„óÇ¢_È}³PÞÎîÂSW€–B©œºýB0bŠ5&92(ä\„@²}ȧu³S¦â•ñ¹E/ß íboƒC{€KwGœ4è Ø1U‰G «$¼7¹í»˜ æLD·K‹Ž_ËåóÎÔ8réäe‘Os˜–ÁÉnÞ«T¦c € ¤OØð»-ŸLí®¯ÄòŸuU~7H7EW•>P`âÒ¯ýg7M1»q–ooïÞ#G P÷-?ܽ8Ôlfc^clè£/Ö%•ªèÍàÍ3j-‘îi•39
þý¡ê˶2ãè¶ÓH~ ‹¥µ¢|ä>ˆK0n ©¦õ 5#úO´õÈû†µªYÅçÿŠ{ÐÇ’™âSû¦žáÍy:òL †Ü£óÜ$Ÿ)aÇ)õ |a“ÿY“Ô •_u0Ƴ©: -c§ý Eú’ ðéãö.&Xž ÐêB£‘ž= 㻑 Ü1ôZ¡mÀ†ÒÕ˜vðf »iãSÀ{‰/!çŸN_ +c§ý Eú’ ðéãö.&Xž ÐêB£‘ž= 㻑 Ü1ôZ¡mÀ†ÒÕ˜vðf »iãSÀ{‰/!çŸN_ endobj -2385 0 obj << +2417 0 obj << /Type /Page -/Contents 2386 0 R -/Resources 2384 0 R +/Contents 2418 0 R +/Resources 2416 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2373 0 R +/Parent 2393 0 R >> endobj -2387 0 obj << -/D [2385 0 R /XYZ 85.0394 794.5015 null] +2419 0 obj << +/D [2417 0 R /XYZ 85.0394 794.5015 null] >> endobj 842 0 obj << -/D [2385 0 R /XYZ 85.0394 769.5949 null] +/D [2417 0 R /XYZ 85.0394 769.5949 null] >> endobj -2388 0 obj << -/D [2385 0 R /XYZ 85.0394 573.0107 null] +2420 0 obj << +/D [2417 0 R /XYZ 85.0394 573.0107 null] >> endobj 846 0 obj << -/D [2385 0 R /XYZ 85.0394 573.0107 null] +/D [2417 0 R /XYZ 85.0394 573.0107 null] >> endobj -2389 0 obj << -/D [2385 0 R /XYZ 85.0394 538.4209 null] +2421 0 obj << +/D [2417 0 R /XYZ 85.0394 538.4209 null] >> endobj -2390 0 obj << -/D [2385 0 R /XYZ 85.0394 504.6118 null] +2422 0 obj << +/D [2417 0 R /XYZ 85.0394 504.6118 null] >> endobj -2391 0 obj << -/D [2385 0 R /XYZ 85.0394 432.7569 null] +2423 0 obj << +/D [2417 0 R /XYZ 85.0394 432.7569 null] >> endobj -2392 0 obj << -/D [2385 0 R /XYZ 85.0394 303.3232 null] +2424 0 obj << +/D [2417 0 R /XYZ 85.0394 303.3232 null] >> endobj -2384 0 obj << -/Font << /F21 938 0 R /F22 961 0 R /F41 1218 0 R /F53 1313 0 R >> +2416 0 obj << +/Font << /F21 950 0 R /F22 973 0 R /F41 1233 0 R /F53 1328 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2395 0 obj << +2427 0 obj << /Length 3818 /Filter /FlateDecode >> @@ -11324,1872 +11526,2092 @@ J‚8
Z;s¥4«ó¡°ªj–h¿ZûK€àãS¾ 7Äa>e yýýÅé„ôcÙE¯ ÒýQÄ8Ê <CIè3`s!ÔŸ³¶Nx“·ü-® êÞÞ¼#Bhä’Ír¸}®V}ý¡ÚøwSä. Èf˜óÎœç jºk<ë•'·GWüÐtô†Á·PáX4ŸRSßÒk ãyуħkzµ‘ûÇ 8i–\¼£·“¼(8õ_G@S7XÑrw‡!ó4™+d»¡áÓbñî«/ÀQdô±úJ-a•iá½~á–pyuC 4;•=Ícyy—© iãúÄu—™toÖØÅ+÷R§ê÷aa›ò¶ÚtTF4 ›N¾B û ”¦öî Ä”ã7W`l™ †x»ë9u4ÃqÀ’ëûfr˜çTòbüð'ÇÌMOäÛ±§QNiij¦!—áN‡¶@Oæj–¨á
ËìpØØÁh¹bk‹‚Õ—='P¸=2ûæúò
rú%o2ˆ -ÔȢ뾫6wD$Veƒ®r‚—¨œå
›;ñèYcÀ}g"ÂUôÿü zxîml¢ó\Å Q( ð»€2/ÊYw ?á§ÓÇkÿ/¿ÐÅUendstream +ÔȢ뾫6wD$Veƒ®r‚—¨œå
›;ñèYcÀ}g"ÂUôÿü zxîml¢ó\Å Q( ð»€2/ÊYw ?á§ÓÇkÿ/À(ÅWendstream endobj -2394 0 obj << -/Type /Page -/Contents 2395 0 R -/Resources 2393 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 2373 0 R ->> endobj -2396 0 obj << -/D [2394 0 R /XYZ 56.6929 794.5015 null] ->> endobj -2397 0 obj << -/D [2394 0 R /XYZ 56.6929 752.2855 null] ->> endobj -2398 0 obj << -/D [2394 0 R /XYZ 56.6929 474.2043 null] ->> endobj -2393 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R /F48 1238 0 R /F53 1313 0 R /F11 1451 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -2401 0 obj << -/Length 3255 -/Filter /FlateDecode ->> -stream -xÚ¥ZßsÛ¸~÷_¡·Êsü¶sNœK}s—øÎδœ h¶8–HHÙÕß], --|©÷ïé, ²$Lf÷OÞ\2`RòÙ}ñ}~u{ûéËõÍ?/aÌæ ‚ËEÌØü׫/ß®~¡¾ÛË,œ_}þtIÌBâ(–°ùõÍçˇûŸ/>Ý;c|ƒ9hÉŸß Ø¬ -v—À8ï(ª4N¡ZµÛ”•y´þ€— ÜX;;¥
-ÃÓ•WÍ‘±–p¬ªVïÌi#`óæØHûêcf¹åFÕûvð&9¢ÕË‚Gˆ¤p@žKÕÎ&ÈδMŸrÚÚ´CtÁ»5u@ H‰[ Œ<éœ áÜ¿ÕZ¹Ù~¬Zªbâízo&oÊg£cËÈ<2‘–µ;¸A–¦–(îÃAÍ,Œ¸ô-lHÁ…ñ>ŠÐP,%ƒäܤÕĘìhl²Ž®“Å: -6$¼{&ÜaB'›*@£Qä äc‘`ÒX‘š~‡Û 7»ÿ lÞÚ´i]c—~ ’Ñ,²E¤¿ðµD¡Ð]ÀáåbÆèjæ/ŸÈ¶f«–.óÖƪ|¤¸\¼è‚”gP\y¶ö«i Œ›%îÊĤªm©³«„Ôq(l©þ^µË÷;ÕÔëש²:ƒ]Á<¡[¨4•".ÜCT ¯¿3ÜÛC‘KÑDï0Ú÷ïîã÷œ2€ZÀÚûêX®F̳ Wô®ÅÂÞíœâÊ?WÏà§jòLa¨ÀHqòHyBÓ'Ê -9Žì–0Ê‘§4w9T=ξn ”‘ŒtP†èFA{((cËTYo/q€öG -…€®¨247¸ãošw¸É¿à×`™æé‡G Ñ Ú±ýÌ`Àjª»Ñ=Ÿ -endobj -2400 0 obj << -/Type /Page -/Contents 2401 0 R -/Resources 2399 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 2373 0 R ->> endobj -2402 0 obj << -/D [2400 0 R /XYZ 85.0394 794.5015 null] ->> endobj -2403 0 obj << -/D [2400 0 R /XYZ 85.0394 654.1216 null] ->> endobj -2399 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F41 1218 0 R /F53 1313 0 R /F21 938 0 R /F48 1238 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -2406 0 obj << -/Length 2748 -/Filter /FlateDecode ->> -stream -xÚ¥ZÝ۸߿Â^$QÅQR>$HäÐÞm/>´@²Z‹ÞN– KÎbó×wÈ!)R_¾^áQäˆ3œ™ßÌ4ÙÄð#›DD"§ù&Íy”Ä$Ùì7ñæÆ>ÞCóƽñ©Þínþòw–nò(Tlvo®,Š³Œlvå—í»ˆD·0C¼}ÿéãí*’˜nßÞÝ}øùý§ÿÀ{ ÄñöŸoþíí?°ïî6² >ßÞï~ºù°sÂø“˜)I¾Ý|¹7%ÈýÓM ±<K6ÏðG$ÏéæxÃ%œ1ÛSß|¾ù—›ÐÕŸÎ)€'Y”P.@,ÊI¼ &¥„ -g“ó*ï!;O˜Ï§ç€{?r°>‚9#˜3rëNÐ(e- ãÚ@p*ú' 9hÛ´Çà–kU¶WÝÆõrßõrëz@íø „èAÚ |YµQ:[)ϽœT¥G˜Z8]ˆƒ`6cÝûðbz1Ó詃sæé›B6z†9$³8€„^G²Ë@Çâwi -Š†ºÆ—C[×í³Ïä Ïç¢îÌð`s pL=›‘±´Jã RÿSû챑fLÈîÏ» éÐòñ=D‚ç¢2‘lýbt ^©C©a ÷ŒBIeý:î=ªÜ[*‡ûýqZ’Ç° "ì -gG5e ºdžóïõJaÂx Ì/³¡[ -]Õ?(#1%¡Ý·Xo|0Ì\ÄYp:ž©u¥W¶+>Õ²Ó9*çt -m¾s»!õ‚mˆ0]¯ÊØðßd œÙg‹jWËkQ r–&aðê´ÝOïڋ涷žï›¡`šF ÁÓèØwO8›^O|Ëy¬iØ.! 2V,ø•³-ŸjI–jH¤{»e$±÷4æ¿€$_ -cQÊ×j3Jº®ú! ƒ¹=ͨ<AŸê—Š;cî¶YõŽ ÕKe·¹$ezõаôebqÏ+ˆö©V<ÈR9úv óͳ(aWØš)×QUÌ zNYÈönÐÈô¤Z«ë~Y_vëQ Ù•Þ…ÕßëåÉìÇ!÷•Ó5š«C¤ø -˜}ªeS8ªÁ*‰) -hh›² Cõ] e2ã÷t›à#üþmc„Å+>'§!íg~å+l
Á2/8ì«ì ©M[µ;%€¾IŠÄœ§WÖËÌqÂûÂó4¯t Öê%Wâok÷0ÞÕ ;O]úóFÑT\Á¶G´ò×
Cdn¾+ÙM}Öaví -endobj -2405 0 obj << +2426 0 obj << /Type /Page -/Contents 2406 0 R -/Resources 2404 0 R +/Contents 2427 0 R +/Resources 2425 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2408 0 R ->> endobj -2407 0 obj << -/D [2405 0 R /XYZ 56.6929 794.5015 null] +/Parent 2431 0 R >> endobj -2404 0 obj << -/Font << /F37 1026 0 R /F48 1238 0 R /F22 961 0 R /F21 938 0 R /F53 1313 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -2411 0 obj << -/Length 3179 -/Filter /FlateDecode ->> -stream -xÚZÝsÛ6÷_¡™{¡§B|‘ÀC œÚɹM7vz½iû@I”Í©Dª"×ýëo P¤HIöâÉ -Ó˜Ç%ùýâç_ãÉäþö"fÒ=y†N̸µb²¾PZ2¤ #«‹û‹ Ú ;oݧc -PÚ0-T2™1—: WSÌb
Ëž¦Š3™hÓªI™15*TÓWÛ¼Ù¾¼~8\.—‚™$æ“îœÎ-Õµ Ö\¦Ì(~Àû>ojнäQó”S£Ügù–ÚÕÒ¿,Öy «è¹½ä&BÁ©ûùúŽ¿ïòmqH\çÛ/aNƒ…¾z«eG:¡KReaM(Ö‘ô`˜HÃû¢¬›<[ V°È—ÙnÕ|= -ûU,ü—íÖ™Z ÷'Zû Àèo¤'e¡d -¾õ4ÿ–j(@ ©diœØ¾wÛó %Œ×Ó¼rÏEMƒîäZNŸØ¸ÿx…tüL ð™ÑT;«jÿ¥[éÔ-Õõ!;Ygž;¥RØzÚ³rJ¨K@æ$>pßÄ7[d³NsH†×˜¿aPHMAÇÛ;èXU, ±¿ñK‡¡<›?Ñ`M4†æˆTu1°cáZ UÒ¶Ó.³9ì&&ÀD²†¹ýæî 5™ÏÀê
0¦àÓÍ»D× @ŠsÝfA#¶ÀS¦¤ -4V6»ãÎUÁTíILw©Žcº¥j1]•le@ë‘gN3o©†ÜûËG–¦Š÷Ù{@ û¶rnGàR$…ö/±Ž!éߢëƒ6'Zjl -TÌ”Qg@°':OÔB`™«a -‡g ubQÊ -ËJeßQ´1̹žŠ¹‡F1 ê0œå}§R¢§] íf]r<…ÉgùSö¥ -©[ÏFƒ“Ì÷Ñ`À}<ôØÊ!ù¬q¸Õ$|÷7ßP{¼p*«¸gíŠAnä%Œø\;‡~üÎQøO1Ð\¤Ã]ŸÉþëwc²œˆ -ƒ*N¶X
¤®mã³*‡Å_K.Ôg€Ð¡:„@Õ¡. çOY=’é -– '¹¢!÷>’òa+ûì¿ql§òË°iB`ýâ±Ìš]kš‹gXs× -p.)—éžó_òWÜJ'É™ú|—긿j©ÚøÕTWL d2 ä ±:ͽ¥²?`œ¥š§}þÿ¡3¨»ÝÉ|Õ€Û}0ƒ‡ÁŒ‡`Fmv¥NFŸÃ‚¦¾<Ì] ±Xd+…ƒ±‡p‚¼½N¦š3ë´Nù{ãXëƒæ\çé?ÇX˜qÚrc`ÕZ ½çü×0)é¹[õ=Í |M‹.¼Ð=zb>Át`>à:z^îp½íþÌ Tø÷eQw×íÓÊýùóöº{xtéu8˜æe[ÕÝ×$²ÑÜÓ…ÖÝ-OŒâóTâ¥5íÄ÷ŸßãAôáöîý
ÍòÃç›O·7÷# ¡€ GúM¤ ¬ßÜ~@•,
ëÍÊÝöf>SVîâg¨P:ülÍÛ©êÝfך8ÕTë'M -± -ò9‰Üøø oÌÅq£Ó±ëR®˜MmÐÍ,k0Aø/y„«ÄnµA)ð„·ç)÷9 2w¿Õ -Ž»dÅÍø\zJ÷#âA -â ‹1È÷ÜÈ*³ÇÚÿ"‡DÊkË OÀŽýÒL"þ䘉Æ-Ôÿñ¯Ðö¿±S)“xk:jí &¥åA(\.—öPt7`nCÙÿEú7endstream -endobj -2410 0 obj << -/Type /Page -/Contents 2411 0 R -/Resources 2409 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 2408 0 R +2428 0 obj << +/D [2426 0 R /XYZ 56.6929 794.5015 null] >> endobj -2412 0 obj << -/D [2410 0 R /XYZ 85.0394 794.5015 null] +2429 0 obj << +/D [2426 0 R /XYZ 56.6929 752.2855 null] >> endobj -2413 0 obj << -/D [2410 0 R /XYZ 85.0394 105.2981 null] +2430 0 obj << +/D [2426 0 R /XYZ 56.6929 474.2043 null] >> endobj -2409 0 obj << -/Font << /F37 1026 0 R /F48 1238 0 R /F22 961 0 R /F53 1313 0 R /F41 1218 0 R /F21 938 0 R >> +2425 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R /F48 1253 0 R /F53 1328 0 R /F11 1353 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2416 0 obj << -/Length 2274 +2434 0 obj << +/Length 3270 /Filter /FlateDecode >> stream -xÚ¥YKsÛ8¾ûWè°UC×D0^|Í͉Œ§2Ž7vjvËñ"!‹ŠTDÊŠfkÿûv£š’èõlmé@ 4ýøº‰ ‡Ÿ˜„‹R™NâT³‹p’/OøäÆ>œ7gê'M‡³ÞÞœ½Wñ$ei$£ÉÝ|À+a<IÄ䮸Þ2ÉN~ýt{w:•a$yp~ssy}qõìs˜38~?¿þrþ‘h7§© Î?\Þž>Üývry×K3”Xp…¢|?¹à“ÿí„3•&ád ÎDšÊÉòD‡Š…Z)O©NnOþÞ3 ŒÚ¥£œIÉH9¦‚0e‘’ʪઆ#)t‹²¥Vžµæ
6£Àdùxö>TFq»D°92ø¾1ë MÚÛMI&y"ܬl}*’àq³4uGÛX‚YѧíÉ™“§¬‹ò©,6Y…}é¶qC^dã$n–ˬ.¦UY;J»«»ìµ Óæërf -r2<f±Ð 7!X†’ä›5O--ÒàO=Uà yS·eÛµÔkæð…ñ¬Þ
ðµ‚`£í@ :jAs›UW†Aj|å\e-hY©øyy-]«khùÌõ«¦ùfÜâÍÊCUY1ì (< ß?—W8m·[jY9°‘WYÛ Ðìé°1XÚŸÂòYd µÚE³©Ü²™ç½ZU¥qD<Æþb*„X/n¢$L¸çäwU3#ÃÇAk:"¢¶ñÛ{Bäå²ÞšÛE‰†³‹¼d0ÉJßgÉPç#VÕ3×ÒxV9¹!Ž·
ðlÚ
ñgQ< îà¼4ÃIý²‡à2XnÚŽÈ.rS"§€ð¹¦i@ݬ*G·Î$tt¡Éœ®Ö¶Íp % ø ôÈ%¹|QD8îtÿH^—Z
êJ‡. à⑨”VWIpn] &ôö…qoNdԻпò› ¹Yu4ˆÜ-Ê@è>£ŒLRÆ… Ìü|_7ù²Á£@2Œ”›H[Á ‰œ¹CÌÜ -–¢H°¹5J‚ ëð@hÍú eÂvã¾N½ ˆ ‰´Ço…'Äî ¯#oLÀÜñ„üË('^Íi`×l~*hrUÚäÞ‹ßͺ¦i
`;ßãš:7C‘ÉcÆJv‚^) %Ð¥L:‘³¶©í Ng,îš–fŽW¨* ÷*î}ðh 9„l -7 £ÃhýWž
$K¨FG
¦=Çé¥}ØÏãp–‰ŽŸwF/®nÏß~¼ ÀA{ 2õSIf«éZJxÊÀsg•½KKŸ¡@yVçVŸNç¶c³0Œ‚Ÿà¢ÂQçDu -ä!TSˆëw"`+ÛƒbÛbùHNºLÈWñK+í-¶>M‚Mݾ -¸A¡n½EUÈb¼àŒkDãqñSàƽehó¯RÆԺ𵅿`{Ó•UÙí^÷Œ]ݬZ“ôQ6…9qÅ!#/Œ¤”!æ¨ñçG Á9àp 5ý㣛ô|F¼mÞO³wEU¯Û»íÓƒ'åc5§ÂÛö9• °Æ.(Ì¢£Ô3¼ a–I¢Ð{a]4Ý‹üâôáç×n–33zsŒ˜”Z rì^åhŸñF$T,\ òûãU~Û¬ì^ä§z~t7KAÑa]t?]Žì²/Ð¼Ê ÇvÑ âõH ºoE®E%Œ¥QMððÒÓ;œßËG<•÷±ñ?Ë?ÿë ±ÖMäø‹»ŒC‹#/ Rh~$ºÀ?–ý?ΧLšendstream +xÚ¥ZßsÛ6~÷_¡·“§üÞM œ8͹Ó$níÌõ&õ-Â'©Š”}úïo € EJ½¹ÉLKìbñáÛ]Ð|Æà ŸÉ8`"‹fi1ãñl¹¹`³gûxÁÌ +-|©w÷oé, ²$Lf÷OÞ\2`RòÙ}ñm~u{ûáóõÍï—‹0fówÁå"flþéêó׫_¨ïö2 çW ?ÜÁc³„8Š%l~}óñòáþç‹÷Îß`ÎZòçÅ·6+ÀîŸ/X 2Ï^á<ËÂÙæ"ŠEGBØžõÅÝůnBoT¿:æ€XÈ –a:â0 ó@œ‰…ö@»R¸ˆ·?EÜå)š Ãü(³8Ho6 aĤ©·mYWÿ ¹Xxr" +ÀðÐÈ6ùrd²ôeqf„Êær!Ó¶Qã°ÅV˜Íë§ÁÐýÝÍÇ7Ô,ÔS¾_·$øÏOWã7#&…, XfM¯òúßMÒoM›DïJ{nri 9‚”ó ‹Á 8i^#Öñ, +–Ì﵌é×Âöíœ~ óF-’ˆÆTµ¬ UÐHÓîÊêù
ŽpÜ’r™¯×f’gU©]Þ^ò¹–†žÇ½UTM£– P2°˜IøŽù% â$ ¸å}¾G0¡½é¼YÕûuAíGE¿mþ]™áוmí0ÎŒcZF”,9jÆïšæ´¿@X¹Ø7jgì;4Ú4ô7º¡Œn_æU
/eS>®ÍCY‘;€ +1!ä–v»Q¸NN +]Õ~ó¨É):` Âð`º4˜W^W%ære&xÂ)ŸÔ²¥g‚$t½ææe} ±cUÚ—Öuý}¿µ&h£Ì[›¼P¦[#™K;c6'¹è¬1äc×_Q6Ûu~ DÝÕ ?$-Lh®kLW£Z3¶£1£ÃvÈü™Ú¥‡HiEÂZ&:WÁØJÁ +v—À8o(ª4N¡ZµÛ”•y´þ€— ÜX;;¥
+ÃÓ•WÍ+‘±–p¬ªVoÌi#`óæØHûêcf¹åFÕûvð&9¢ÕË‚Gˆ¤p@žKÕÎ&ÈδM rÚÚ´CtÁ»5u@ H‰[ Œ<éœ áÜ¿ÖZ¹Ù~¬Zªbâízo&oÊg£cËÈ<2‘–µ;¸A–¦–(îÃAÍ,Œ¸ô-lHÁ…ñ>ŠÐP,%ƒäܤÕĘìhl²Ž®“Å: + +“'’¥§-pRÇ&ô÷lH x÷L¸Ã„N$6U€F£È=ÈÇ"Á4¤±"5ý·9nvÿ=ؼµiÓºÆ.ý8$£Yd‹Hák#ˆB¡»€ÃËÅŒÑÕÌ_>‘mÍV-]æŒUùHq¹xÑ)Ï ¸òlíWÓ7KÜ•‰IUÛRgW /¨ã(PØRýj—owª©×/Seu»‚yB·Pi*E\¸‡.¨@_g¸·3†"—¢‰Þa´ï+ÞÝÇ
î9e +]QehnpÇß4ïp“Á¯Á2ÍÓ,¢9´cû™Á€ÕTw£{>dHi"Æ»2“!ò(_<˜ª³‡{.ˆ ¼ÄŽ h2<ñ¶ò×ü?/(‹“˜§g endobj -2415 0 obj << +2433 0 obj << /Type /Page -/Contents 2416 0 R -/Resources 2414 0 R +/Contents 2434 0 R +/Resources 2432 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2408 0 R ->> endobj -2417 0 obj << -/D [2415 0 R /XYZ 56.6929 794.5015 null] ->> endobj -2418 0 obj << -/D [2415 0 R /XYZ 56.6929 526.8607 null] ->> endobj -2419 0 obj << -/D [2415 0 R /XYZ 56.6929 415.3623 null] +/Parent 2431 0 R >> endobj -2420 0 obj << -/D [2415 0 R /XYZ 56.6929 332.9987 null] ->> endobj -2421 0 obj << -/D [2415 0 R /XYZ 56.6929 269.3209 null] ->> endobj -850 0 obj << -/D [2415 0 R /XYZ 56.6929 229.9211 null] ->> endobj -2422 0 obj << -/D [2415 0 R /XYZ 56.6929 196.709 null] ->> endobj -2423 0 obj << -/D [2415 0 R /XYZ 56.6929 160.9458 null] +2435 0 obj << +/D [2433 0 R /XYZ 85.0394 794.5015 null] >> endobj -2424 0 obj << -/D [2415 0 R /XYZ 56.6929 94.3462 null] +2436 0 obj << +/D [2433 0 R /XYZ 85.0394 654.1216 null] >> endobj -2414 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F53 1313 0 R /F41 1218 0 R /F21 938 0 R /F39 1161 0 R >> +2432 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F41 1233 0 R /F53 1328 0 R /F21 950 0 R /F48 1253 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2427 0 obj << -/Length 4190 +2439 0 obj << +/Length 2877 /Filter /FlateDecode >> stream -xÚÍËrã6òî¯ðm媃I€[µgf’x7qfÇÎ&[I´DY¬‘HHÙq¾~»Ñ
ð!j4S¹¬}@³ F¿ÉKÿòÒ&‘ÐY|i²8J„L.Û qùï¾½Ügî;Íû½¾¾¿øêm.³(KUzy¿êe#a¼¼_þ:»~÷îíí››_®æ*³¯£«y"Äì‡ëÛŸ®¿'Ü»«LÍ®¿}{‡©ÂN -»¥böÝw÷W¿ßÿóâí} ¦O±Iùxñëïâr „ÿóBD:³Éå3<ˆHf™ºÜ^ĉŽ’XkÙ\Ü]ü; Ø{ë>â@¢m”Xe&X 䥔Q–$jÀƒ$‹R´ãÁ›·w¯ßß¼»¿ùñWã¾éØ&.çÊDJã:¯ë¦å^ª×KÉHÇ:cŸ²¹šÃJf95M¹Ým -„íìЖ›²}¡«zOÀ®Ø¼-«Gz~s{GÀ¦®? v
ð[ezvÓÒ ~ü -¾É7 íÐK‚ÚšÚE]={þ¨Ê·E3|óŽé\.÷WÒΊ¦.°8X2g xËÊ+_¥vöT. -†Š}“u:Õ³Ÿ×EEت¦6w£> ¶EÕ6„»v×–uÕôû¹!Íì±|*ªWÒ‰8‰™É§6BÁ'~'vû2LSÓ¬kd‰Ûm¾¡yë!KßQÃ[X2ñà ÒHå9BÚ³)«‚´d¼TD9vÀkˆÚD…KfQlX¸p¦Ö IO¸”³v]°¬·y‰œ—’à×yKPø ¦>Üe %áÃΉ˜q"†ˆE^ošÑw¹Ÿ¶m‹å|Y,JBÂݼ{Š©sO¤è•ÛøîëE½©«9ó––7µe±)·e‹ôi™âÀ)BIàW€Ñz†kÇ7Ïër±¦î‹¼)&$HÅ*;+@‰TžÛÏåfCc>¼Ð4Ëb• 6-!Yqé!§D jFAxRb‚Ê#@û3ZÑ”ˆ€€ÄQ˃šbSLЯ³HJ#{ҢІLR†e÷Ëa{RKÏDèê?-Jµ=áœÐ!’
¡š_¡1qcöwÞuXü–Á¯óvbÏt&;9³góXƒ·1© ª'¨úaÃJøñP8M°¬š¶È½r®¨%uÀÓä^îû8ÖëMÙ8¹¤¡ˆšx`¨t
ŽŒhþªh_틦Þ<E`‘WôÃÓXjþ "µÐZEÚ:Åp&º—÷ëbbJè!Sã¹4Ï'æqÇÁ0þ&®Ù7R¼*^iññP>å' ŽGµgGÛ:_å7AP -V„%ÍŸÎRÔ' ˜Î¼ù€ ‹…U‘ÔRQeÙÄø <õÛüƒ7ÚG¢¤áeÇ}®oÿ{%Á ùM1Ó8³C»M®OK}‚q -; á 3ãõ3@ÌŒGÌÀ! B‹þ}Ê/§…Òê¬U‹m,GVMÏr0âÛ]ËÄ×تٲlv›ü¥[‘î~¼&€Ô{Q»vÉÔ±aÓ³?몘0c -"îypÊÓX‹ñkY¹ê-“êif ƒÖ Ö>´Œ^?µŠgù¡w_¶y Q¡¼õI:F4Ñ -íb“7Í”IÜnš¼×m(CYdm°…¸‰‚å–L•‹lpš‡‚ZŠ›û‡
¸ïŠ¦¬—LàÞƒId¥ƒ¯×yÝToQç@v‡õÁ‹¢
ŽA4ÄE÷~ãB˜1ÌÛæ›[jÑßTm±‡™Ñš6›ìÓœ +öuㆇ8àÐî-Á4$DÞEUìsömEu"„‚ð"I‚ˆœ6¼™²ÁÚPb˜SÖQG)ø /uËiW‘ÈÔKÝ~JraJ¤gü
"üMÇ…ˆöš7h~®™e!e‡žšžŸd/¡Àà‹4åO0$º™ØÌÖ9Z#[BÇÀíÈØ=•K·€!mÆNùâÃs Ì-¾ƒädFí²IrPs- § W<•õ¡¡QÐ6• m°†W„™ÞÄàR}f?b"œÀJ˜·y.ÛÅš– -p˺ëæ‚[À‘ r8ô >ð > EðI‡<ãt -"¯@îÇ.Äï
ð |ðw>sÛ(Ž™êâØáÐíp} -*b‚
¤ •EÜp“y~b`wC©è‹óüWdu…)%5劦tEÔ ¢¸h¦ IˆÆ†ì`Š•eGe} иàæÓ³[*ãKg· ´*žÉÜ[–„º Ä “GcÇGZ†/ ½á4 1U7 Ù]73oÊ’¥‚¶)hŽzïç£)|¶7J†HקK2ã‚ŽŸcXÔ uS„K6¸¼€“¥ ЋG±´ƒÉp¬Žíh€B¾ÂôdO¤ÅjöÓ¬°ÅÞ7´û²hÁz¦\~Í5šSx¤Œ -Ó]Ví5À; R²ä®O%+͉Ø=K#c¬íùþ„ô ‡î‰µ³;_(¥ J&§sá œ0OŒo½xÿ†¿AÔM˜Þ"}N¥ i‘qzä›2øS%$¡„˜= F”³zÂï“A|¤€‰Ä ‚|cÏ\u’/—®¸s¥Ø'10i(ÊÃdÛ"¤äL %üY BI^„À¸(ŸÈ /ƒ2º4æ;t\÷†4® -.>ÖWl6O“ù,SÅ:þœ|§3üóØÊS1 ‰„ 锌‰®zh¥wÊÐ¥ ]|þ¼4†@¦W#ÇA·å¶\0OœPðP@ÌX:W#è¸ÔñùIUPazSX(ƒ)KF"êj &Cù å0x”}¬È€Æ %-†Gh+fÅ ;ôÔþ[G4´hþ4²Í°W»v5€£Ñ94¶½ê*¢ÍÁ ±BZuƒÌuŸoFYAMGfÎ’w§H“ÉÁ×/¤'l§êüƒêLÉó~+ uþCC "¦à.ÆÓðìG,s¥4>%¥x¤£UWºŸÎf•c1ŨváÀ’} ¥N€ÈÙF¼f!”ªpƒk¦ÔÑL!·Íb5ܧ÷$þ` Ka,“2œé™˜ô0£©°? ä -úÜ{°Ÿtˆžø„óv|ObññP1ÂCøö èZ¸Ø[_U9*÷wE®ó^ÿòÍûîÄÎÏS4mó%©>ì¢ )Ú<žÞÅ4‘GÕ=C‘¦«aOÚIžP‘†é¾¬I"¯•ñù4 ø.éÎç -«Ò£3XË $´t<¢,YPÄ:L¾ -ÙcUþI ñw´çföúöú‡·¯UA²$‹@d4Š†ï~¼v Õìîæ[†þõ–N€Ý£œ¡òÈþОˆÄß}²ŠÒvh)Ê &[®J -ì`WAŠõÉóõ82Ò þÀ˜Ï9Ì7ÏÜÌÞ¶óMŒŒ® N“:å“ÄÔgÚ_ó€Íu2±@0 °_¹šT‡ÉÙ’›ê’o:æ¤ËHÐŒoi!Ž,«ë4¸«Tz²ézVÿ–N{ÖJf†Nb‡÷ûW³¦nòD&3çMg,Âù²×/‹op…}ŽRcpõ7+z› @ -‰PÍ}n@© rüƒva¢ ±}qM›ï9îîþ@™3}]}9O!£…ìX"B¾gøzPТZ†C1ÿ 8ú|ãOù7›úyü]Wï -DrÐYúûé8ÆEôȵî9'ÝȇH¥ã$5öäq2U*tìJ, ÕÔ>çÎh¾P@N
WNœq‚Gbˆ¦š³CÔUK–iC'vb ×<Ítþ”¨È¤q8`ûùÄ9‹íÎY&ñUfÂ0ϧ†!»³{i' k’fŸAÛ‘ÖñÉ¿T‚“L?óVÜHi‹ðæäÊŸ¤‹t˜™„Ã{ì=mtÀNr§”¯rŠ—$Ùtõ)Ñ’u×*?gT2ez¶aóäjkA3;ê•Pݺ\©ú‰ÌÃ4¿¦k n ÿÉgêù.—Ö'ë¡I¤cm?%%˜EE‰µ£"]x•r(`Nß겑LSs>ÛSbxW/V¨6+*gS8`¼jÚÔG¸UáúäôÜé*ß,ˆeÆZXë¡ E„ã¡ Óv;ÐþÆSi8¤KÝÆ8ىⵑ¸ú”ú“EE@zp~ü„q\ó5 -¾NQüñ—ÿ(·‡-_às¤þ*o‡Q¶ ýô`“«¶»€qâ§ÏÍôÔDømÂ_þ™D÷+Ø -Äendstream +xÚ¥Z[sÛ¸~÷¯Ð£<‰Q€A²3}H&i&Û6u× (‰¶8¡HE¤âõþú ààÊ›ÒÝÉL qÎý@f+ +ÿØ*DäQ¾JsNÊ’ÕöpEWO°öáŠiÌÝø¨·÷Wúkœ®r’‹H¬î ½½2B³Œîw_Öo #×°]¿ûøáú& Öonoßz÷ñ?ðžP€ +&΢uWöý5[+‰É÷ö1 +ÚS&#ŽÍ ˜ýë ³e4',J“e»Í %e}_ Ž½Þ¶oñù ¥Q³3Œ”8 +Ýò·¶‘êæùzÛ6}Q5ƒ˜ HAŽ6¥]Ûö+xš> ñYH~½4€³vŸ»¾™ +òUè R*2„ñh¸¾/T´ +¢šâD,‚ÄTöŽËÕl’2ƒ‘ÙTE Þ”¦ƒXaLf®’s^´/ŒlJc¯ÅñXW²ºƒØDum/ç0<CV5¸y LuÖèxšŒçò«š7:‹²FqçÔÏæ×EÚ.¿ŽˆOç×€ú-úáw°…ÀÁ±;3ƒñNy¤ï”{éšè ¤<ˆ~謚€ ˜Ü¦5$!ã æ5Á’$ +u´
²j0 1[¦/ÑvUúøt‘îS¿Û«<®÷Eàvò.BN¨»9!sÓÎa.ƒÁÇ[\+v;A:\P¥«\9J÷My2f×3ºN°17šÂö7%iÇaÄ\'|®'„ÃqaÛ8kàÃÜÂÈ3
¡iK`[UÐÀS4`{"bë8‹û©¡4 !Óú;ÛúÉ ClézYAw¯2NbgÆ>Y»<^‹RÈ8ÉãtPÞuJowíYQ3é3P
:=¨•ø´jTÔ{ n8YK ãl)…‚Ì¡}Ž’e'òQó^dQ.…bÔífÝh‘¼ó£ýiG +ð†°ñoúŒƒüPW)Oªfð5æÍß +‘³ª•ƒç±Tv}3l©åš=„ú\]ñ¹ý¨-mäX^bÛÈò×âp¬KåöÙz>Í
ú´ÈIgŸFÒÅN† ì¾–/ØT 6¦Á„•bÓžu#ñîÓÝßÞÿ×oF ÷¼ Ô}Ìý^÷@.è endobj -2426 0 obj << +2438 0 obj << /Type /Page -/Contents 2427 0 R -/Resources 2425 0 R +/Contents 2439 0 R +/Resources 2437 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2408 0 R +/Parent 2431 0 R >> endobj -2428 0 obj << -/D [2426 0 R /XYZ 85.0394 794.5015 null] ->> endobj -2429 0 obj << -/D [2426 0 R /XYZ 85.0394 751.6872 null] +2440 0 obj << +/D [2438 0 R /XYZ 56.6929 794.5015 null] >> endobj -2425 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F53 1313 0 R /F41 1218 0 R >> +2437 0 obj << +/Font << /F37 1038 0 R /F48 1253 0 R /F22 973 0 R /F21 950 0 R /F53 1328 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2432 0 obj << -/Length 2037 +2443 0 obj << +/Length 3119 /Filter /FlateDecode >> stream -xÚµËrÛ8ò®¯Ðm¥ª!‚A‚G%–³šÉØ^SÙÚL´I¬¡H
I9ãýúm<H‘,';µ¥ƒ€F³»Ñï™bø‘)PÑhF>â˜ðéæ0ÁÓ œ}œ‹ãµH^ ëýzòî–…ÓE
¦ëm–@X2]§_fïCs €g7wq¼üàÝÄ·÷¿þ²ü÷Ü#¡ÀÑlñð°¼»YýkîQŽ °1žýº¸û¼ød`óˆÎ —ñüëúçÉrÝIÖ—ž`¦Äúcòå+ž¦p‰Ÿ'±Hðé7Ø`D¢ˆNŸ3Ä}ÆZH>‰'ÿèöNõ§NmŒ( ¨C ”ºÔÁ#0Ê´:Ö{©.ñîÖ'=T -}?ú -Ç«
Ê€áˆS*,Jyl²²˜{Œ‹Y#ó¼ý¢O® Ø/öeÝ$õ9S1¿%[”‹u€„ †§)
ÛZ© -š¥WüDˆaç—Q|äû¼5Ü&)Z†æÿTËÔ^¦´bÊft»ƒ<”Ê^?ÙYp*ŸN»]VìÌö7ŒY²³ÆYßwX>´ŽQÉMY¥QG"àÜ¢ýä 䃧fŒ(2±°óç¤H „@qŒ‡-¥¦J6.Jà0B´ªC]ètî³z,b(  .é3l¢wusg”~x¸×¶vÐS;lRàjëˆN1…ÅEpå$àØŒ´H‰rO‚¥²6øÚÓ)Ë4a¡€FH -È¡'‚1Š|ö–¦(ÂA—¢’ãQ‡by¬²Òã‹á±) ̦¶»}îÑèH…,6ejœ v:Î "šÕ“Ü–&ÖÍ^¥Bõ©MG aEÁ^Ûø@˜Ad3äɺ1 -òÌY‰x³Šï?- Îês„}ŸÚ«Èâ93f+²hŒžðܧ\ªfÂp½·ÊÓ:×ú´:×›¬6§à'ê£ÔB·j -†‰84"ÁÐ1[Nà -Ø‹o{È5Žì-
¡o§/Á»*VÍÅìTÔît ™ù!‡éövõÉô|#…òë;ÙlÞUºî"ˆñ‹ RŽ—Ks¿Å§øþí žf;•L‰J“¶mPÙ U@¡€½[ùˆùAËÓ§ˆ ÆÛNZ^ ½mZÔµÜxi½ÊÃïò¥ (”AÈ}§²[0Ð}$Œ\gB&ð1Sµ)
ÍÊ´Ýv ›ÿÇGó¿“…¬ÓJš^¡Ì¿G{/Ey¬³z ‚Œ (Ð þ!ˆ{˜€£ˆrU¡Ý½µú\´Oâ2âÚÖºÃ)Ã*" -9ôx¹«/WBçÁ_[Š¤[Ñn•8¸¨xó»¾&Éw®Ä&`„ÀÁ˜Eî 7ì£liº¤8D³A Û,—¯Z ÙÀØÁb=W,Öb½n1~PÏ3˜È:;ý¢y[Ñt¶ê”/‰r ZyNþßÖûâÕÝjã &,„9ó‡¹}“'uýýn½}SêÖ…Æô`ÒTã÷ˆÞâëµ 8 -9ãÿK‚ßçô8¬$TMç„Œ*ÉÍ2þð¸zX¯îï Õlœí éy”†G&$ô0~jŽ'ÝVRnÛ#Ìnd.wmn…ƒ8Ûº±ƒµª7±mº· Oz±‘Ë@7¦ÕLÏ_>>¶u>M,߶‹²xºi…ãÇÛÀ.ÌÊNNSÏ^bа|(>Ç‘-uº‰LŽ»ìYÚ’úQ2Õ£*øjí¸×F¸|ɱi„0¸"ºžkúXæáÅ•k:,=D“1Ë - ='ùIœrë¬É! -ê¼áø55D$¤m¥=œZÞO–UYœé +xÚ¥ZKsÛF¾ëW°*¨Ž1oààƒ É^'YÛ)©l9>€äPD…h´£üúíž„R»Tó@cº§ç›~t–Â:Ë$Iy.f:D¦TΖ»«töÏÞ\QO3Dó.Õ«‡«¯¹žå$WLÍ Öµ2’f=¬>&7 >ܽ»}ûÛõœÉ4yE®ç2M“ß¼ûåæ'7÷á:gÉÍ›»{*™2 ¢H¦Òäöí›ëO?\Ý=DaºÓ”£$Ÿ¯>~Jg+û‡«”ð<“³¯0H Ís6Û] ɉœ‡™íÕýÕ₧öÕ1™É„šÍ¥ \r1®¦”¤¶=×8 è5‰lLM +ÕôíǪþTl·çÛ¥œ‘L¥tÖ]sÀ9R
Y3ÖaM¹&™ g¼ïMëN¢>¸v¹5…ï¢H¶³*›ý¶xrƒßÓ”
Ž×€N3Ù3jêPM¨)PY5µåμ|h‰)’eLN3ŽTCÎgZ¢ MžõYƒ–ؽ`I»1¾Â\Ó¤>¶n¼¶ +„NášÏGsxò¤5Êüâµä=F‚h©ˆ‡ IO–ŒðL‚Æ,ëjjŸóT'AŒ•YÇm{’É D“ÒK,]Óÿ¦ò¶ÙíÛ(§'mGžS§¢(ƒ %¹”tBp¡2î·«n¶¦i\¯Ý•ëQ×|-Ò×4KLãvãÒ® JÅEâ^¼ëÞzn¯®¿0eõèÙï·¥Y]D®‚
r*ž¹à]ªËÈT¹‡Ò4#Ð
Ww’óé‚X_ð oÝ\yèB§:îæàúVsøÔèjßZUCç—Û®ƒê/ÏÉsøVE:#›Sp SHÏ™Ì<AY5)Vgòá=à¿s8æ€g!²äízìŠ1¸Ëòïóm >¼&)—çÌ> ƒo°™æó±ð +|©ƒwmÊ•³ph’ì~M½=¶†8#Ê2E£´S¶p©Oa ¾Û£ŸG\bë5g)!àd•eÃcSâíx dþ½Ê+ ºM[@LÖÓ¯è+hWe™ °å7ü´ËøB`oë1I¢å§{Ä3aí?ò ž@‚¸ÎDò,`ò¢²\ZQa7^Zœ)ý“ýµµ[:AŒ4ðØú9‘¼+¼›–4µì‰dm¾:,“°¶@`áéøe«Ö öÞZ'‚~!7½-Úò‹qOª—¢òÔ>Fƒ©…!h¢w´q —›à¤ÖÁ=† .“U½+À0ú¸°lÚðJ—rxjîbFµˆqqXnÆl Î2Î ÅÈRåË°’“çâJájJ§ª¥×”x¸¸d„*®þ_p]¶© 5c©~Ʀv¨&lj ²6uq\7å_æå«UTG<É;R
™÷ªÈ‰Î•ìs÷)¨øÐÞEC`Ø~„Dõ¯]ø $ÆžJŠøì¶l Œ¬‘p1¿Nînßݧ~ùQw®4Ö+X^ºsÉcž¶xjM¢À{?ywÅŸåî¸s¼1îúSI„–yÿžìÀ“:ZÛ-4®kch½o†^o¿0>Ýh€OçÒÏÛ+ +Ô5>‡Ú;œnƒ£žó\'¿b½ÍmàzlÑ’÷Xgp ?jyÁ¨Ç¸‹öÌ€³n!2
wUböåÞÝ J°Ð ¹hÚ— _, ÎÃíSŸ'Ëâؘ^žˆ§>Ìë†,Íê…»&$NšÒé»Ö¥º|×"•½kfU5/¿¹XŘd|ªb 8W1z¬ïåÚj# —-‹ºÊ¸DMYWþyíÚ¨ÀÌz }Ϋ\ù7ãÑe ´À í/”_ +Är[,o„`Žuo(BœŠB«òqä†QM|ÕþxÓ@H¨¦ÏÔ»T—1 ©"¦ë +"¸b endobj -2431 0 obj << +2442 0 obj << /Type /Page -/Contents 2432 0 R -/Resources 2430 0 R +/Contents 2443 0 R +/Resources 2441 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2408 0 R ->> endobj -2433 0 obj << -/D [2431 0 R /XYZ 56.6929 794.5015 null] +/Parent 2431 0 R >> endobj -2434 0 obj << -/D [2431 0 R /XYZ 56.6929 684.0716 null] ->> endobj -2435 0 obj << -/D [2431 0 R /XYZ 56.6929 572.8605 null] ->> endobj -2436 0 obj << -/D [2431 0 R /XYZ 56.6929 509.4701 null] ->> endobj -854 0 obj << -/D [2431 0 R /XYZ 56.6929 470.2699 null] ->> endobj -2437 0 obj << -/D [2431 0 R /XYZ 56.6929 433.5878 null] ->> endobj -2438 0 obj << -/D [2431 0 R /XYZ 56.6929 401.47 null] ->> endobj -2439 0 obj << -/D [2431 0 R /XYZ 56.6929 335.1577 null] ->> endobj -2440 0 obj << -/D [2431 0 R /XYZ 56.6929 244.1508 null] +2444 0 obj << +/D [2442 0 R /XYZ 85.0394 794.5015 null] >> endobj 2441 0 obj << -/D [2431 0 R /XYZ 56.6929 168.8052 null] ->> endobj -2430 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F41 1218 0 R /F21 938 0 R /F39 1161 0 R /F53 1313 0 R /F55 1321 0 R >> +/Font << /F37 1038 0 R /F48 1253 0 R /F22 973 0 R /F53 1328 0 R /F41 1233 0 R /F21 950 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2444 0 obj << -/Length 2161 +2447 0 obj << +/Length 2543 /Filter /FlateDecode >> stream -xÚ¥Y]{›8¾Ï¯ðÝâ§c„$$z‡§“Išvã´;; ÄÈ O1d N&ûë÷è &Nf·½@Wç¼çC™`øO&’#Lc61C >YmNðäÞ}<!Nfæ…f]©ùÍÉgTLbGa4¹Ywö’KI&7ÙoAòåËâêôü—é,ä8˜£éŒc |J®¾&—víË4ƒäãb9!q BT‹E88½Z. f§Ë³ëÏŸ.ÿžþqóóÉâ¦EÖEO0Õ°þ<ùí<Éà?Ÿ`DcÉ'O0ÁˆÄq8Ùœ0Ng”ú•âdyòÏvÃÎ[óé˜5—ˆ‡,šÌ@8b8 ·F˜ƒ
f‚a$# µ6 ɘͼ”¶ÙìB ôÇ3Î;’ñ6×Y¾U«¦Ú>-BxÈ£hÒU{ -ycumÒçÖ,ÆÀReÄHè-lKBµÉ›Fe/SÄ9bq$SWêå`j¥L0%C•quCˆã*½ÐˆÊ^˜`e/î«</WÅ.ÓD¤qðëòâ µ >ãéÑ*Õ6mòòÎÎO—öi)µªÌ3«‘¶¬þ5å -ipsïö¬ Ô*×N -—W×p
ÅD_!©€æ0²wÃÅ/ɧ/—‹‘$'Ð|#"¨¼ÑùÑ4$¸Ýå…Ƀ¡ÇA‚åO <#»j;â’h§¿6«ú[{d¯Ñ†æ3_U.Ô_éæ¢uUmÐ;èpÞ…ŠðPtŽe ï/ž{‘}’i±œª(ª'g3¸ T›™/HPÙbƇ ßó<U»"ë÷Py]ïTö~ä@`@¸¯ A¬³²®Õj–Õëmµ1÷ïã`ÚçÛ;ض-zðá(PÓ§¹RYm´Ÿ-Wòïê
À»È¦À_¬£Ý¢Ö~ÖO‹Õ ¹[±šEršˆD°¹<ÅóDF"ŒæøCŠ$‘<™Ëùü4œÃ¦ Zx-ÎÎ̹
ŽŽ>ðE‚ç1#7î³úìür±<Æiѱ %=ÎPw[ ©½-ê(þù]ij?ÌnŸí³é|nÐf”ɦ+Û_ŒµXztæóþE ÿл4Mßåúßh¨Â1kãÂdÌ®rÈ´…EkŽ0%²SSH¤¢§ß²Ÿ©FÈþåo
és â“Ú¢‘ÿ='u ÊÝ’|¿t늀‹Ø t5‘¶n +xÚ¥YKsÛ8¾ûWè°U+W"/¾ææÄJFSŽã‰ìÚÝÊä@‘Å +E*"eÇ»µÿ}»Ñ +nYÚUÝ"u6Az–:éf/}Y`ŒA*ŤmãV|¬ §i»=È@"d\&ÁaðYUzß¼&l‘¨w‡¼Ü>ƒ0âM€9xà\ X´h¨•¥Á…U86¨²5a z&ŒHÜ¡³ msjg%!®ÅÞΩõºû —¶!7ܸˆÝ‘S'OžøP仴ľ촱C^dã$&ÈM Ú€Ò<—ü vnšl[,Lî Ê#ˆzZ 4]ÔKÈî %æˆp=$èÙc‡ñ´zêàkÁFÓ‚¤jN¼ÝÑà°=lìO©h?â–]±¦é ×/ëú›q“w7Ï¢LúÓCùÓíéÕAû´1GÉÊ´9†Õn?nUêg³ªw¥›æÓiê‘nYëã)GÑôŒ»û²^йGäHDcã·BèŲ`M Œxnv’ ˜¬`ðÝ †&¯ ±,÷«‚ÿº¥2B!Ž75ÍðËxWfè¦FëƇ“úùCP\ôð +(78üu˜Ñüv¹ª†‹•þöàhx`Pë@k ûç<~© #8žÌ¹.,i¾»Æ8ÊÒúI½¦ !.ê#:. àxMßuúÍSVäh®‹au·i~ó1¥ ^\ÿ‹þ pãz;p0 À + +#^¤ƒ’DƒDÜCèÕ t%Ô†\t2Ób.+ É%D»š¨6_‚9–,ˆÕ euŒÉó8ÿ 5
5Šªh «9÷qè-}×iî8é¬ a\é»ÃÇŠ4ÖtUP<²I¢:\’j0`ÒåaÔ‚;9f,‹ü”uFÙvx¥;“ÛöÉ…UUy›?0° {ñ9œÒ¤•“ã9s¢!0¼;À=}-úX”N‘ªn©±ÙUë·1ÔèNàHewijõ¦©¿9!Áå¬M%Ü¿ƒH…‡ +È]”ö*-}†ãY›[{:›ÛŽÍÂ0 +8ÁI¹£.‰ê Š7Ä +:¾aûJˆ¡:Iu|{÷aþröèuÿ.àßqQvøñ#µ{ªXÿäýƒ=÷ÿ‘ +þé3ðÐÍ;uþòKûÎ4&ØX¿˜Ë(`09ôB¡-„–§À…X…r@öÿSÛendstream endobj -2443 0 obj << +2446 0 obj << /Type /Page -/Contents 2444 0 R -/Resources 2442 0 R +/Contents 2447 0 R +/Resources 2445 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2408 0 R ->> endobj -2445 0 obj << -/D [2443 0 R /XYZ 85.0394 794.5015 null] ->> endobj -2446 0 obj << -/D [2443 0 R /XYZ 85.0394 463.2352 null] ->> endobj -2447 0 obj << -/D [2443 0 R /XYZ 85.0394 318.8302 null] +/Parent 2431 0 R >> endobj 2448 0 obj << -/D [2443 0 R /XYZ 85.0394 224.0131 null] +/D [2446 0 R /XYZ 56.6929 794.5015 null] >> endobj 2449 0 obj << -/D [2443 0 R /XYZ 85.0394 159.9229 null] +/D [2446 0 R /XYZ 56.6929 663.9757 null] >> endobj 2450 0 obj << -/D [2443 0 R /XYZ 85.0394 83.8775 null] +/D [2446 0 R /XYZ 56.6929 361.3763 null] >> endobj -2442 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F55 1321 0 R /F22 961 0 R /F41 1218 0 R /F48 1238 0 R /F39 1161 0 R >> -/ProcSet [ /PDF /Text ] +2451 0 obj << +/D [2446 0 R /XYZ 56.6929 244.0091 null] +>> endobj +2452 0 obj << +/D [2446 0 R /XYZ 56.6929 154.5575 null] >> endobj 2453 0 obj << -/Length 2556 +/D [2446 0 R /XYZ 56.6929 85.0109 null] +>> endobj +2445 0 obj << +/Font << /F37 1038 0 R /F48 1253 0 R /F22 973 0 R /F21 950 0 R /F41 1233 0 R /F53 1328 0 R /F39 1173 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +2456 0 obj << +/Length 3447 /Filter /FlateDecode >> stream -xÚµÛrÛºñÝ_¡™>Tž \I"oŽ$>Il×r¦M“<Ð"esL‘ªHÙu¿¾ ,À›()ÎϘ `±»Xì¢t"?PLMB%|I¨œ,V'dò -®âUªç:ëè°˜òE QÓ]b§4š:‚F? Âk@pxH‹t×YYà¸.ËÜr„óP_IÉ,K ø‘R‘a9-Êu•UÃKáÔ£€O
HvD‰Â$¨y†ýÒ`âuI :br
ÖPP·gÏ\[”‡¾ˆ„ -•vG‘ ÖáP|Ù‚‚FP*„˜!ï ÇŒ 22å"ê8øÈ…°ÀçÃ)—ÀH„¨y&[PÀLVá·Z§‹LŸÀ -dt4VÛª¶P\/ ³Ùoä4JÓYúOYXHߌY{yÌ€‚¹$!¡rcQÿ’po·4ÊìEܧYñЫ–ÒÄÿéÚøÃnÝj žÄ—@
Š+0wë DÑìšrDvo–@=¦äX9Ò•‰2 -U*„ÃýB5(C©º6BÁHÀTó4‡¤5ɘÕ1 -¨±T³ð ç[ –˱@FC(ÛÅž’«' (P—ò¬qÙ{G¾hù˜ïíüìë…|c2øð -ûf(óOgÆw ›^ÌÏ -ôê![òè°h
Öˆl½8J$ -¤m¸`É5\¸m¼á¢¡d£ïý~‹øBqÞo¸€l -‘ e´…>pýçõÕ gtÄÃ
±+9CÍŠõKÎ&+æZ~eŸhô”&ôyöý- ÁGGL÷ÌXŸtoeÐ +øήî.ï¾ãj+ƒÂ¬ß¥WU¹È¬yÃØÖ¤Š"&›>–æ¤-ï‘rïÛ|v«Ëº'G®³\ƒ× áP‡ ‰z3à‡ Žâõݧ.§V->Nºö0`m{¨7í! l{iGë×NÏ8æ²aè³0 ‡=¶ƒ´ßa ’ñ×óÊV ù9œ]~];™O#õø÷{fWe’¾Ãß•¶ˆm‚.óÄ«ê×ÜævW;ÚŽ_ßh¹ÝG5ch>b›íßÛé¦
Þ}oå-rç ¿÷Þª 5}¦Ú ð˜¶3¥Ðý‹|›¤8°é˼ûýµÂ¹Ú‰ý1QÏ$¦pÆ̓}îT8]Aoe6'8¶O»í ¹+{¶ä‚®â8w/µ€Tb\Ñ(‰ÑþžßŒõo¬|ô‹4zÿ÷ïÉí¯ç"ôy±qãb!Ô -`+”Ö:b×{ì/Ï»²ÿ{ÉTendstream +xÚ¥Ërã6òî¯ðQ®qðàóèÌL§²Ž×v6ٚ̒ ‹ŠÔˆ¤¼Î×o7º‘%û€fl4ý†äµ€yFÐYxda ]/·WâúÞ}w%yÎÜMš÷g}ó|õþ[\gA«øúyÝ£•"MåõóêóìöááÓýÇ»_oæ*³o‚›y$Äì_·÷?ßþH¸‡›LÍn¿ûô„±ÂI +§ÅböýOOÏ7_ž¸úôì¹és,…FV¾^}þ"®WÀøW"ÐY]¿Âƒd–©ëíUé +µv˜òêéêßž`ïýtJ‘Nƒ(UÉ„”¼–a ÃX
deJee +-‡pÙ ÌþË”ÖÏ ¨,’CåÿøééÃãÝÃóÝO÷þ£¡ñ@tªŽ:yj¢J‚í»ó;šƒ‡™å44ÅvW„So’öźް3{€·EõBÏÖš knÀªLÏîZ"âèWðM^–LkÌŠ ¶¦qYW þ%Ô ßß=0Ÿ«ÕþF¦3Ó4¦¡“äýð9’ßÉ+ ¯âtv(–†!³oràNÇzöËÆT„jsKõ¥Ûš +ŒÆ¢pÇvܵE]5ýy–d2{)¦z7qFNåÎ „G¹“Øí ¿tNC³©Q$ì¶Û|ÿFëÖkBnþ²†·°e’G‚ÁLª¡f—EeÈÕŽ·Š(+. +õ–Yu<³ŒÁêЄ½ƒ2Ù§Vá,ïZ÷E›·UÊyŸèhÕˆ&þ`Ç î+Pˆ1Ïþ‰Ó×äÖŽôÂ!=òž.~BUŽ!Eì*üfz8o,T®û.ŸCºÏ6XC×uçÌeí –÷f´Gì¯ø‘ÌÇW`õT…ÙXMµ´^uî É]à28Ää„°é-hy7röFOV¢0öŠ¶¡ +I$xÜ'µÝP‡µ `¤`»se3\fah¤¼¹Ï°Ø€ûÞ4E½b÷.„‚@ŠQ2øa“×Meøˆˆ; r8¬; ,M ë “hÈ‹žÝÁù4cDÌùæ»{n€#¿«Z³‡•Ñ›O ö¬ 3ûEÝXòtí®k &’y›ÊìsŽm ªêD +éEy9ïx3•zoC…A”œóŽ:ˆ!^8[M‡ŠHÆNë¦êe< Åâ
‘'ñæ(T…€Îšx~Yd¾d‡ž&½8ÉQBÃq–Hb˜ “Ù&Go¤Â”ÐÊp;rv‡be +«{Ä ;QD‹8nqÒž2wqpwÿL®b{Züù1ÿâü=ˆR µ«à²ãñÛ2cú³Pì⯫&:çP“ÛGºÅø—ȼYºô8åÒIt’s… 1ÌjB—OŠÊi*ÀÙž5O³É-à(Y ÆLÄ•µ£ > +B_gœOൟC95Òky©šž¼4”Ã
Ä;:ò½ËP)wͼ3é¤1T^ÞCˆ;;ÄàO>³Ç(Ιê%â8¡kÈwØ9† +6š3¹{Iâovçû3ÚšºGi:{rRZ `vŽ! Œ³÷ÄøÖy€Ç„ û}Äô6éj*E‹ ã“€Ø>ž*!Ýo„˜-0 #Êz=áÎIH¯¾ +¼R‰;åèâ ]xù¾4„D¦×#G¢Ûb[,Y&V)XÈ j]—Zù±<© *’ÞÅ6Ê CÊ¢‘ŠÚ h’¡~q$x•}jÈ€Æ%+†›GèTÌÌÿv©Ý·–iªaÜèd›á¬vc{ endobj -2452 0 obj << +2455 0 obj << /Type /Page -/Contents 2453 0 R -/Resources 2451 0 R +/Contents 2456 0 R +/Resources 2454 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2460 0 R ->> endobj -2454 0 obj << -/D [2452 0 R /XYZ 56.6929 794.5015 null] ->> endobj -858 0 obj << -/D [2452 0 R /XYZ 56.6929 769.5949 null] ->> endobj -2455 0 obj << -/D [2452 0 R /XYZ 56.6929 744.4739 null] ->> endobj -2456 0 obj << -/D [2452 0 R /XYZ 56.6929 712.5891 null] +/Parent 2431 0 R >> endobj 2457 0 obj << -/D [2452 0 R /XYZ 56.6929 647.0402 null] +/D [2455 0 R /XYZ 85.0394 794.5015 null] +>> endobj +850 0 obj << +/D [2455 0 R /XYZ 85.0394 769.5949 null] >> endobj 2458 0 obj << -/D [2452 0 R /XYZ 56.6929 551.5126 null] +/D [2455 0 R /XYZ 85.0394 747.9963 null] >> endobj 2459 0 obj << -/D [2452 0 R /XYZ 56.6929 446.5077 null] +/D [2455 0 R /XYZ 85.0394 712.4426 null] >> endobj -2451 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R /F53 1313 0 R /F55 1321 0 R >> +2460 0 obj << +/D [2455 0 R /XYZ 85.0394 646.5299 null] +>> endobj +2461 0 obj << +/D [2455 0 R /XYZ 85.0394 574.5487 null] +>> endobj +2454 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R /F53 1328 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2463 0 obj << -/Length 2973 +2464 0 obj << +/Length 2714 /Filter /FlateDecode >> stream -xÚ¥ZKsÛ8¾ûWèfºÖb€à£öäÄvâqüØس»S“9Pe±B‘ ‘²ãùõÛ(€¢èÝä -¥ðe(„) ŽþÑmhͪ¥C‘"ñeÂã‰pnI„УI,S?\(‰¬³7¸¸H¼YNm“·Ø‰½v•oNXâéñ¬¡ö5/Kê}dð¼•Å<k‹º¢ÁEÖæ§Ð
/›·ÅËðTÞÎa5ÁŠ ò®ó7½y»ÊôéE5/·‹Ü M·GF=›qЈbʘŸJÉÕ½`}½~†ÓgeNš}-ÚõêrWSÝ—|Ó -
ÕË©‰ î‘0çµj49¯«6+ª¢zêú‘¿Q§YÕÛRS¯²—Ü¡ã^óœÏ‹ïAÀs³#JBA6ñ®–4VÕš)E=UHœr4å¹€¤NIÛ$TÕ½º¥¶Ð¿·M¾8„(æ¾dà%F`S BG¥€° -bì| - Ynêu™Íòr V§¨ÈˆhÍa
EÒ‡ì)}GCÕˆ† •ÒÐõP †ÔO¦æ Å&Ÿ·5ïƒ%‡Ô0ŠÆ™ë¨¸sÌN‚ãÄå\pÓÓ°C.O±¤Í@ƒUÌW=ò ÆŸ¡.MÎãø¿V›ëÌØЦhÛ¼:¬ br½£ ‹jD†JéâÇAk;rg-{GZ‹}¤ë×TôÁŽ}´Ð€ne²Wȉ´ÐMÐXvX‚„Y¿“LØT#4TJ‚ÏChf˜1{ÞÔm=¯Ë=4‡!àN†ãÌuTܹ)xêÇ"Š]öÎÂäzr=JÇ5Kjê%+·9u—#J“‹.ä`a˜$:!€ñþ6\Ŝɨ©¶ëY®w›åíkžW4h2ôvØáRZ›«BÀ]Ò vSˆE¾Ì¶%fH@ªKROÐOL$¨f5µÌÝzpþ¹nŠY8¡.ÜÐ Ý©ðÂ!ÛýÒ\g½8
µU‰L¨ ƾ]~¢.…Ô»T†¦mܪêóf;ŸCQTo£6 c?¥ GMuµ •Bm;˜CcbIûöœ¥ÀP²„ã|uTŒõSà@` ÎìJˆ¯Ê– -4¢Bèn&° -€eÇ${ ç`ûöάõ‘<";ÃN‡zü¡Ò0híÃüÝö¤ö‰K¨öiFElÍ–Ù¬(‹öÍͶ0_µJøúä¬ÍyÁtfcêÐ0wÑo··çòj¾y{6¹*l{ñ"e¾"G¼Muñ •BüË°ŸPåhÍ—ùK¾ï¤ <†Bm”³Žj€5·úg>—‘ËÚPʑ϶OO]1¤8;,3 ¾#3‹jDf†JÉl/K¶è#
ÑÀ‘NvøI ÷Ž<+ËúÝp ô$ö9%U8Ø%U8ŠøÂÁYNí“Î-4
R«h¢Xê+MÙíwuN3¯ô>‚CÐÊb‘ëqUÞà0=Êà•ÒÁ¨ÍBD@e¡a -†öjÌTŠ© ô¶ªòó—º|ɨ7S8uYN¦<ôÓ -"êI=áW˜j5~n1xýenFñÎ"o†öÁb ça@‹ÅšMh¶j[ô=?•®aò,ÚS2â¡w¼®©+¼ã×®·èz+ÓSwÂÕë aØ¥côy±{ ¦E-¾½lIæ,&$Áè[žm4Sè9òYÕ€I’žOD’:<œ®êí†~,²·F‰´üTÕ2_˜(óì™zê0´*M·®«v¥7uOWCÝyÁ㬠BøaŽ·8AzÓ×ITO뢩4§vIˆ§ma³«^ðqë_'®Ö–û^c)ø´ÿDc+Ãz -³”a½4PŒV#…(KŸ§é;)½Mu8XwT*Xß¿[ˆâG©õR]¥ŸæDÜ’÷øë¨tÒœ(ö£f už“ÙBi´ d†ÔCcº{QÁ¢‹F(øa eV×ÔÎô&úSišîù Ÿ³yê-[=Ô´rºš‰SŒäf>T¥ë2öc.¤kE¯…ú.síè¹ù„·0¿¨Õ~Ž+ô…¼XX{УµÙ¶1©»@«_lqkõN žü¿µ´zª®2|,{|L?SÛ=íBE6Jßw¬k¦ -wó¹æt/S5å‰eßÁ'Võ+6‡
Ap?Nâw2}›jÄ •2„³wßÇì ô…dÉ8{ Õ -IÌ\ØÁ]‚;¶´î8D Â`ZQÕÔ¦‘\aZJÂ4N)Lã aZÈn#Êï#Lck0}…ig'B±áDm*Ìï>âÿgLÇ1TPùŒºÞ|¹ÖD -Ð߆ Œÿ7ˆ~lí8Œg¢ÙçÍEsâÇ1D›9
æD»ìh0'äÔ±5`¶©rI _òÈo#(gøÕ’ºnƒƒ6ˆNŒ7‚FCÆ÷¶gÑI°C4ž<.¢é æ“ çYc'»*+ð®ZS“(ÿm½â[1ÀJ:O©c€ýgíú·“ÝÇ:4“ƒ#¤83 Û «zþï¿ÏÙý5RƒOH<D‹ -¥ËBÙg½ûKž}Þÿ£zò‡endstream +xÚíYAwÛ8¾çWø6Î{1+’"%í{{HwÖ3iš3îëô X²£Yr-9™Ì¯ € Yf’ÎÎe› L‚À€â£ +H Õ–gAM#c?ø]€‚Ó2 äØ´é¶-ª•}I~Õn}“oÉ:Z +9aRE]§½MÞ +9aqìLǺÐéÜ +ðViÐOŸÎÏf3ºë蔀±æ±–<%×—îW:€t´¥½)‚„ +þ@ë}¼?ŸÎÏ>ή®g .=9§CåÐâ‡pAö~ú]®b®Ll àÖÞ·]+Á¬¹†Éó d"}^¬*Ә Âÿùœ*góŽ¥;ÈEÚE]ߥM‘Ùµ>á‡d¨Ã3i çÔÜ+ì äþdKó^s¹³ #ûÔîª{pIgÙ¸k +{mñÌm3 {î7¸ ~íðDiÐ ëßþøýô• Xâ]™÷»¶ˆƒ—µS +íÅÃð@u÷™üP÷?¦ù#½endstream endobj -2462 0 obj << +2463 0 obj << /Type /Page -/Contents 2463 0 R -/Resources 2461 0 R +/Contents 2464 0 R +/Resources 2462 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2460 0 R ->> endobj -2464 0 obj << -/D [2462 0 R /XYZ 85.0394 794.5015 null] +/Parent 2473 0 R >> endobj 2465 0 obj << -/D [2462 0 R /XYZ 85.0394 287.1527 null] +/D [2463 0 R /XYZ 56.6929 794.5015 null] >> endobj -2461 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F41 1218 0 R /F21 938 0 R /F55 1321 0 R >> -/ProcSet [ /PDF /Text ] +2466 0 obj << +/D [2463 0 R /XYZ 56.6929 523.9144 null] >> endobj -2468 0 obj << -/Length 2099 -/Filter /FlateDecode ->> -stream -xÚµYKsÛ8¾ûWè°©f…àI -?ÊÂz³âöñJþéœY©(ý«¿l[‹v³öYgEXŽèì9“h8üubõµŽ3«Ój©u¡±µ#ßBAFøëáuZ‘øöÈÅ 5¹ c¥ÌC‚c—•,»(¥]{Zmê…õ¥{¶©€E “›¦eÃ$°Ê™°” -žl’©ŠØõY©ð–ó²x#ŽS°1 â>§ ÞÀ-ÁãoXàkÏ¡uúâWë4,<0àbì47e5eõ2Ú {Ò®ÊgóÁJ>Fà„8 -S¥mÝ 9z…ÂHRybjèkµ½€ð @’ „%=[Ÿo˜È¡S öˆ¢¯;
J‡N÷ò¨ ÿh-öÚdF2HÄ1ñð bY¤ks ¨#¡4;TOë ‚ÖI ^sºjè4Tß)ð=†Fœvõy -¶|j§òÖ¦½…ûäh‘„ÝJ×ÊÝšøF‡bZÀh£¤<Òª‘;»áÜFšr¾x[@œw°6+†¹Øl òÀrk¦wC‡ÄIìÉKŽE ›}²3Ða4„ ˜Êáøõ{ñø½SM Ý év{¿_™X”ÚöÉà (k¯ä2mG®¤ý”Ú‡´B÷¹ *¬àX3/Ã9hß¹5bÏ<+´—0 -Ñ$ M?4EB?º½ºp9f<b®\Ôž3žfÑK -&!û£Q’„Šƒ²ü£“>ÿ Ùœ„dS•M9/ÿ$vÒíÿ8h7 b‚ `ûuZE|Q蟇õ\ ÊõÂ< Á â÷–Nã®w}Ò Œ1Pø0¿íæ¤Í#]ÛÆöžNÚËÍ“ÉuP5´÷ÃK…Ÿ!b¿+€}û÷ È‘Œ»1à¿þ³Óî -@’)Eã¿™S ÷=
²Ên†ðäðÏ0•2¬cÿ7 Éoendstream -endobj 2467 0 obj << -/Type /Page -/Contents 2468 0 R -/Resources 2466 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 2460 0 R +/D [2463 0 R /XYZ 56.6929 414.7474 null] +>> endobj +2468 0 obj << +/D [2463 0 R /XYZ 56.6929 353.4012 null] +>> endobj +854 0 obj << +/D [2463 0 R /XYZ 56.6929 315.6213 null] >> endobj 2469 0 obj << -/D [2467 0 R /XYZ 56.6929 794.5015 null] +/D [2463 0 R /XYZ 56.6929 283.1208 null] >> endobj 2470 0 obj << -/D [2467 0 R /XYZ 56.6929 632.7441 null] +/D [2463 0 R /XYZ 56.6929 248.0689 null] >> endobj 2471 0 obj << -/D [2467 0 R /XYZ 56.6929 393.4246 null] +/D [2463 0 R /XYZ 56.6929 183.8008 null] >> endobj 2472 0 obj << -/D [2467 0 R /XYZ 56.6929 322.7553 null] ->> endobj -862 0 obj << -/D [2467 0 R /XYZ 56.6929 278.4974 null] ->> endobj -1455 0 obj << -/D [2467 0 R /XYZ 56.6929 239.5941 null] +/D [2463 0 R /XYZ 56.6929 95.2626 null] >> endobj -2473 0 obj << -/D [2467 0 R /XYZ 56.6929 205.2551 null] ->> endobj -2474 0 obj << -/D [2467 0 R /XYZ 56.6929 131.664 null] ->> endobj -2466 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F55 1321 0 R /F22 961 0 R /F41 1218 0 R /F14 964 0 R /F39 1161 0 R /F53 1313 0 R >> +2462 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F41 1233 0 R /F21 950 0 R /F53 1328 0 R /F39 1173 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2477 0 obj << -/Length 3070 +2476 0 obj << +/Length 2274 /Filter /FlateDecode >> stream -xÚ¥ËrãFîî¯Ð-t•Åô“ìɱ=cgv<³#¥jó:PTÛfE–‘ÇùúhŠ¤hÍaËU&º‰n ÑxSr"àON2 ›Iš›Ø -i'åó™˜<»÷g’q¦iÚÅúq~öý;Nò8OT2™?töÊb‘er2_þ]~þ|s}÷ßó©²"ú1>ŸZ!¢—÷?_þ›æ>Ÿç*º|3;ŸÊ<³9 YDKDt}?›Ý\M?ÜüòþæþüùOg7ó–.ëRhä鯳ßþ“%œà§3kØmòË<W“ç3culÖafu6;ûO»aç_:& -«³Øf* ‘…’)ãÜZÕ†ÍãD+í…q}3»úr÷y~÷ɟƯ9ÈOL¦*E¢2¼\×µ+§º×G·ftÕAOElS «PÜ®h\}>Õ‰Ž`C› $K‚VÌ\¹ßË,rí{˜–4*xùÒý.„Z»%
«5=¿¼ã”Õ–W¬—ƒwFh™˜<ºkð - -X/ Ü4µQ±ª7…ÓЈ“> Lík~÷R5OÍgwï ÂÓÍÏsíŠu]”Mµa³êq]4ç2âƒ×x`¦]Ó³{^V¼’΀ʌ‘D—9¨§?èŸk”
Tøî•ã -3”†"wဴàõèEÕ=÷5L -¹ +F3„¸yq_I1.È0ý…iI6¡û9‡æ( O÷÷vU•Uƒ± Çý‹‡õœahñF>©¬ŽµÈÛ|²c›F(Ì ç¼´q›rkÙ²æi-:ª£CX^u°VñB„Ê0–yšö•¦µÊ7RaH -¥kŠeѨ "~dbmïøK"Ø@,òô¿õ!"*XGš©¾Šq¯MâW°rµ_:pñš ïßÕ4W’*lœ0³$3—ü ». ‡¦ëfC‹—4æz‡6Ú¼]Ò•˜Ö2¤í6ÚP”F”¥ûXÅVø‘ã8<ɺuÚO43ú(Ïç-WSœßîàø8‰„ðæ $ÑeƒLŽ½rMÉqK‹?þñæÜgê|iºªÛ= -‚ºŒœ Ö³.®Ü°û -ç8hAPƒ Ý|Š…Ÿäïî¯ÿu*VÂb -2#2µÑl8ö…aÏz¿Ýò×Ö:ôÑÎó›>"ËcÈâõiÑAzÛC$Ïu9þy BÙU® k9JŒ•¥‹?ÅV‹tÌWOHZÄÒÙcìn½Dò¢1:(… ßÈŒÿ0€j›¡þ¹¤—åfÝ•¢½U”ŠPƒGY1öSñÕõðÔ ¬Ã Q 1Å2ÿåæ¨/€›!6·÷þˆÂÈáçN_›$êÁ»û~v¼<⋃ò †1"jÑ~yý¿íqøU‹IcejüÒ´0+å20…‡”& ²Þþ.ä˜÷ÿÉÔendstream +xÚYÛrÛ8}÷Wèm骈ƒ+/óæqœYÏdíl¤ÌÌV’˜¤,V(R+Rv”¯ß @Š–«v·R&pЗƒnšÎü£³D†„§b§"”„ÊY¶¹ ³G˜ûõ‚Z¹SšûZ¿,/~zÇãY¦‹fË•·V’$¡³eþ9¸úðáæîíí_—s&IðKx9—„ÿ¸ºûtõ e .S\ýz³¸œÓD0$´ZD‚·w‹ÅÍõüúþ› qùuùÛÅͲ惧„kTÿ¾øü•Ìr8Ão$äi"gÏð@Bš¦l¶¹’‡Rpî$ÕÅââŸý‚Þ¬yuÊ’'¡LX<a
Fg”†©”l`™†gܘãþÃòöþnqr ‹
’i7X¥¹¯å6žpƒÓÒûÎWzËŸÞIéi®„KX\k¬ÊªÃ¢4è`³¸z `ÌÛŽ2 FTDCd·+ƒ” + +ÿ(4E’$#„£eY&,Š¬RÙârí¶ÈÊ/„°"s9ç„ݺ¨qFzÀ‚ M] Ƚ¶»¤IP¨ ŸVæ±Ù v·V Êõº•}³kpVËê|°×üûÍ¿ü¥³Æüæ-„¸à‰=> ê¦{£‡i"´Ym(Á©,vÈ\Z’ãÒ0 -Â<_±Ç…‘Â7ð¡jšoEŽãýˉí—¢6Š“ÇœŸZ_ëå¨íµLÔV“QK™Œ»óf£ +`(/„ |Œ Àþ…H’ÀÔ²ŠÕ™Ç¢~a²- kMDÞôf2Äzõiù÷û¯ƒ¼»bW î¸8ÀM±±.»nê¶Ùuå~sÜO„\Dn?ZŒi +U8ä„ô ³æ©Ø©ÇÂQ,B*%b»S›bܱ4NØ€KÝBpyŒ#ñ®xÙw{¿Fñ«áû½û•Wä¼nÍÅ¡n¶mÙŽS)¼ ª{I‹É™ÔÄY2ðV09&¦¸À)MšG§ûçùï– ø€ÒS TÚSD¹+²®Ù &jh)ˆIj5¿ºUW«B“DRž”Ûƒõ€ÊSÝlÖË_]ϹPë/—ï§ ¦a"d4^zóêÒõýܺ¢€²d¼înb]ˆJ²A QêœzRÕÔâ@–Œœ€Î^
õÁLŒE¹Ïì£
R $LÅhýÚ×i¦#º+Á†ñþöfqýñÖtŸô<Ís~Æ2;ŽB"RwP;^
BºNIØâQ‹°•G!pc‹#L^˜VøüX>™F$¶YáH§5ÔϺîÕi7^«'ûRWnL)¬¥›¢S¹êÀú +³ þÔýÚÕà8»òÑKð®gJ³ƒ]JÕRh¢áòìËc<¯Ël‡ b_Yi¦ ÿ¡5Þ‡
þ~ M¼8©PÒv +êýæahòc¤]£ùbÃ^ZÕD…µ°Í<a‡ emh^¨ ›]Ù78“[b²/ÁïLŒÆ"t»9¤ªßc‡y!i +?ÌÑÈò endobj -2476 0 obj << +2475 0 obj << /Type /Page -/Contents 2477 0 R -/Resources 2475 0 R +/Contents 2476 0 R +/Resources 2474 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2460 0 R +/Parent 2473 0 R +>> endobj +2477 0 obj << +/D [2475 0 R /XYZ 85.0394 794.5015 null] >> endobj 2478 0 obj << -/D [2476 0 R /XYZ 85.0394 794.5015 null] +/D [2475 0 R /XYZ 85.0394 751.93 null] >> endobj 2479 0 obj << -/D [2476 0 R /XYZ 85.0394 751.7313 null] +/D [2475 0 R /XYZ 85.0394 546.4203 null] >> endobj 2480 0 obj << -/D [2476 0 R /XYZ 85.0394 629.4849 null] +/D [2475 0 R /XYZ 85.0394 481.4562 null] >> endobj -2475 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R /F55 1321 0 R >> -/ProcSet [ /PDF /Text ] +858 0 obj << +/D [2475 0 R /XYZ 85.0394 441.1625 null] +>> endobj +2481 0 obj << +/D [2475 0 R /XYZ 85.0394 404.0002 null] >> endobj -2483 0 obj << -/Length 3191 -/Filter /FlateDecode ->> -stream -xڥ˒Û6ò>_¡ª=X³kÁxð…ÍiÖžØÎÄŽcM6»•äÀ‘ Ë©ˆ¤'“¯ßºA%¥jKÐhô?1‰–h©'©ŽXÌE<Yl®øäÆÞ^ ™y¤Yˆõ¯û«Wߪt¢™Nd2¹_keŒg™˜Ü/™þ‹ÅìVàÓ7 çóÛ׳»Ûÿ¾½ýx=:‹õôæÓ§ÛoÞÿçz&cÈ€ÊùôÃÍÇŸn¾Gاk-§7ooç׿Ýwu{ß“’.¸²4ý~õËo|²„|wÅ™‚ &OÐáLh-'›«(V,Ž”òòj~õc¿`0ꦎ±"Š3Ë(™ÌTÄ2Øœa‚¥B -¿Ÿç7 Þįà3w#fE@1}‰Ý®14?%Jå#AÍ Ûº2U{’‘I*YÄùN†X§YÙc9^®F t,S é÷ªÌ ÉÒœÉ,ÉΓå‘FÈ -9®c&°Ï²æ¦µº¡ÐÚF³5‹âWÎ¥ÕÅcPe®€27XTØûA‡(¯ÅÔ”4±^ ƒxþ -›Û]aý°m® =6ò°“?ûÁ2V[OEYbë¦ -©šbOi-¿3÷H’rÎ 1
ÑÉÇ8{pï ›‚eîO¯ŠÞ}2Zi¥¹}2.•…Nh`ÇœÇSš¥š§C'ã˜aæëv”RÎ:ÎyÀWÙƶXo±,ñ ¬O¦÷VØóÎYzX :wÛ -
k¡ÙåµÝ ¥ÕRRá×ùQÛ -—sÅétS/Í?A¢¤šÎ»-™€‹-0ÜU•±œq.QÅÉ´îÚm×Úà&³©Ø¢ì–ÓÁIâ£_—(ªe±ð%B’Ÿ¯ãX¿®;¢¢9h¡}éîJpK~P¹:̈gM‰ø«ŽU3•öᱶHA†—Áq±
¨Þ¢-¾+dÏÅJ‹ê{9Íù<¿±
‰i -íMŒÄt»‹µ6KnLLçb¶h -ÓVµ’SñýLÀÜîSr»Ð3øÒ
-k¿+±ØaR÷¯Å’¦ç#FA´ ´ôØ+`Ö+ \d,²ì@È{•>4A6îO}ª„±X™ß»bØ–/Æz#ÕK®ÞÇ'vÊ€=ö -tì>¦l$qtFšèŒˆÎÈ .²¡Õ`chãˆ6‘ƒ“Øaûæh´}j´ÕöE¿˜ó±¬þ D$Y“þ1`STÝaÁ‡2•!%NÉÁ4‚‘yyTü ^MƒòŽâ4š?ŸÎýDbÿ}]¨î„X§µ¿ÇrÚߌi?D¶¶äåƒô© Ûõq
# -p–¸ k„ºAÌ! ÷—I4$ï èàÞ=qK•ã¿£ÌA|)ƒsrv¨ ÷ -=¶J±ä·Ÿð1~_º€ï è±!b÷ ¯‚bFÆ„LôP¦ÝŽvlK -818ž¹—Æž¸ò5°m·ÛÖþE×Ä°ÂqZ^ ÒË´¼ð댼x,'/÷cò"íÿ*¼çÜíœ;ú‹FÌøEÒz¬Úÿ¢¡ˆJ‹ì+YÚÿß ŒÄz¨zµ°Œì³›\ã—Þ|4ÈÂe¹ÂA<Y.p%JŽ¸r gŠÈónÓ5-.ý@[˜KW¶Ý?ø˜RƦ3} fû¢(˜må¿ - -gÐq©|ý²RGô7 ír%X@<9…îÏÆm_”¾‹œÖy ë¯êË¥_ =™{ ó(+_ïíÿÌ°÷œ¿k«| |~2Ø gô_ào¤f÷0‹@žöýcø»7¯g >Ú¾y· _Õ$8½{³õ&ýtIÚ—ßbfÿl5¢|â¯ñÿþO×þ¿kQÊT–P%™ÆV•O”埈²cËbB"Ghÿ ﯓÒendstream -endobj 2482 0 obj << -/Type /Page -/Contents 2483 0 R -/Resources 2481 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 2460 0 R +/D [2475 0 R /XYZ 85.0394 371.4021 null] +>> endobj +2483 0 obj << +/D [2475 0 R /XYZ 85.0394 303.5162 null] >> endobj 2484 0 obj << -/D [2482 0 R /XYZ 56.6929 794.5015 null] +/D [2475 0 R /XYZ 85.0394 229.5618 null] >> endobj -2481 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F55 1321 0 R /F22 961 0 R /F41 1218 0 R >> +2474 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F55 1336 0 R /F22 973 0 R /F41 1233 0 R /F53 1328 0 R >> /ProcSet [ /PDF /Text ] >> endobj 2487 0 obj << -/Length 2936 +/Length 2682 /Filter /FlateDecode >> stream -xÚ¥Z_w۶ϧð[”ÓZERΞ²%í²Þ¤½Kvv{Ö=ȶœèÔ–<KNš}ú MÙ²“³µ¤I -ØðdÁ»—‡ùy[ò⹡o–;{·Öq*wÕ²„
Ê, Þ[U¦MýXÖ8CiTŠƒjN3ífúp\nµ³}º÷æÍbÑ<ÝELÐëDÊñ -L¼‚RÚaû5Šâïæ¬aò¢g`l«àtÙPW§O®7s½Û3{ÂÕËÊaø 1,/íïB°é¡6ËÕ†lT/{.‹5+õ5ÒѬD=k 8x:§,‰¦N¬ÆÍfM?fÅskL §|_7kr$˜X”ÅŠzFˆL·lêî™ö¥›!'/: ÎcõT–߬xO¤·}¾ v6µ¬j°Š¡ÇeHÊiWûÛKn,Eü~¦ak °ä ZPã ðÛ˜Ò; ø]qÐñGkæT\gíÁ@
™S¨âô…Ôħ: ¨ • ÔŸ‡u–k¨á)ß5s³•ÝpÄa’½¤Ÿ£P°®“4L’\÷5äx[Ûf¹Ñˆ†ššÚ§‡Êø4L4‚yŠù]ÙÕ
µf²ÚLUû`N›vBþdžóWq œÏ!vÙitY 8tÙ5,Ô¤ :
ÓXêÝð¹X „cô‘êéb3#ÔÇ ãcçb£/0ÈK¥Ç£nº>³Mk™½@Û‚;2ë¡ ‘â¿·Nõ-;]mõ˜ïè1þ@m³êª†9>JÃi XNÊ’±z½Ý»qmšå¹ÆWˆ‰uó„ÍaGˆ4<W’ìGð¨Ž8‚¥2Žp>äðzÐùkü@…R‹ì¸zŽj@¿¾ ä¡”Rô$?šïAì `OEjeý Ge<;•]ßP;a‚C °šF¸–îÄáne!ÜájßçL¨džä -aÚâ:³aÜ -„sU"Þc/,®³h‹kÈûã\öq
€,îïí¥^´~Ja5ÀDâŠÑÁQ\ómdwxi‹—| ózvˆ_ -Ê®o¨¥úX ×Ì¢¤»ZFÂ¥¦†…IMY’y&f|ù”cÌܨ]4õ}¹v÷vPÜÍå^ ¤8Ðá›Î»eñìÇÃeaî1 åªi«®YÓSŒAû - £ ≢Àoð•YhdÊ"èù…“’ -d04¥3a\ÃœI 3.LÂïòû -¤™ :3…ËiÙ¶ÆUaÒ ½!n@Úz+ÎÆËÜ• }…¶ðɣà -ê ;ù'UÑa íìï@]tïc <©óhû1† úáòæò×süRwwyAL>^~yÅ™ßñ4¬ïk%ÜíB'6«¬[Pi Nvï¨}ž ¦ÊN±Ô‹¹š)”åÖ{ç›Å6xÆYJNOÌլô
µ-¦çôyÁ>‚q - Ý#Õpw¬«iï ²ýÒèÕ¸¢¿²XÜ7k…˃¦Mt‰úqËni–i^´ëy[³î ´ª'ðPü1>K^ÄÞÖóm2…ÏDëìó¦éLÄgÝA;J âŸó ì+rwÿþ«¡í‘¨4”Yv ¨$ÁRB¤e¥p÷B廪k¸žt§ºÿ ×üDöendstream +xÚíZÍ—Û6¿Ï_á[4ïŬHJ¤´=¥í´M›M²™é~¼¶Ù–Çz‘¥©%gêþõ -Ù²»_‡=ôÍÁ ++¥™Yi…ÍlvA3 ͇R^ñ„¼ê¯Qåg_§é@ìÊ´ÉQb]Õå©Y9,53Ùu³¼Ð„Yj¨,ÊÀ¡™õz
.V&*Ⱥd¸i„4i~bÞÉ¬Ê )ª:š®{*—ÕOq¬ÊÕK hõ›²AžÅ ýÖ6<¢×l´»•YT+¢®Ýc»¥§~Sô$…óÖåç8orœ.œøcÙõDxxxCòE³òS°,DÂ÷wÿ .ŠÁ²À»©ÈóÜÎæt„(zhR|M›hUöån[5功+â.ûú@”É:e}:¬_)úÂíHÎfi2ë|÷•‚ ¶qÆ;;ßNl¾L„ŽÃæã„^Ì…’&L³úÝiÚ§¾j›Žímé·i{ ”´zX ³¼´ÏiC•ME–g~CÍÞPN¡½Á²Ýni+ࡆ͗bÓ˜X%õõØ J]ŽÍ å6åû‰Ø”‰ÂáOƒ—ÛÝáÔ6©§±ºn\š°nä•‹XCB™w_öà
È–´i2Ï'mr¼ª!Öó¦Znˆô±<ð‹Ë‚¹‹’ëv߬ Õ«\G_•ëb_“ŽÌ¹u¤k¹ß‘²¦'Îs»ûX5ô0¶DJ]öŸ²Bc®¸î¿Ôÿy©alŒý—cïÀmñkµÝC\¨m ò#?j+ÀxuÝÈ 5aå8 ”ˆs•ŽÍ$?ªÄ'†ÄDŸŠz_2¥ß³ö 4 §o…Å •Ò ÖíŽØ,—ú´$b¥ózœ‘[4E}ø͇- ½$×ã¨}¦ìÚéåÔ îˆëFœ0áÑåõ«‹{|j»®ZTuÕ ˆÐ®‰ÛPAf¬ZV².ªzOÁÕ:Žþ (è\ɼ« ½!O{Њ ‰Ç™|U˾úTô®$iÕJEÛ=V¤sRʦÝ?nˆÖW[¦º}v¤
S8Z÷»"†ãHˆœ¤çªß™2ªÛ† +RGÝ»-6ŧr¼$òJùëG *Ũ埈յõ'tOY,7èä.Êu–ïâ 뫦´áÅ/K¿O{®±“úÜjð=_^‘øáCWöàD ŽA°|§jb=˶YUþÄP{ÜY…U OO5e™—L Ÿçbç<TuM£×˜Ç²)wèyáÕ* %ƃ —LGuÙ<¢gT¦èd÷L +3¸MA‘s`}4¨OÀ…tha.)ô2¸§ìèyßT.-À”*>kHY è·Xhy8&¡n¿Æy°àþú'Økk¢ÛêÉ k'b +J<åãä¨%ñ€iSð„‹²dí”™’–(ú¬D,ˆÆñ«k ðz=eZfE +ùŸšær·Î2‘%2 ÇÕ wè«âÐòÛêœT hÐõg!„‹þœ†Ug-dJ~å ºóÎ9{ïa^u +y‹`sä%ôØ\Xkäuô0”ºŒ ‚Ôу„Ný9ñ íx +¦gz¥x¾1-KÖ[ŸðŽLñøÇ\,ãGÚ°\[³òÐׂ˜+¼,ØÒ¯Ã4ó +掓X]·3HM::zF +€ÒéØR‚PøɃ:U¶>Áf\ÙÒpÁ\ŠK §/r rëÂWº ×¥¡‘<9GžÅpŠôa.v§ _KEg€XsH4Œ¦p4BS̺e垇 †»&ã2þŒ +ìxômû\"бIÄVUkVÅ*©ïÒÒ·„`ÒrS4t+‚äÃÑàóÌ9W‰øåkÜ¢Us·ïàù0HÎnˆ3Ë< ÝÕ‡„q®-Q"ܺm +Ä͹Ȳ\Ñ4~Ë«aWæÛY<šÄ]u¾u¤nwJ†ðÝ&VTÜ•ÀžZPìB–½úááÛw ®€üÓHSr&»?t}¹e‡~Ù6]»ë«ýöÒ¿8èTàÿ%L 8˜ö_ÿûÃñ =+t–]ø¼„ VáeãÂÅÉÄœG/ÿ£Ä¹íÿ‘l¤[endstream endobj 2486 0 obj << /Type /Page /Contents 2487 0 R /Resources 2485 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2460 0 R +/Parent 2473 0 R >> endobj 2488 0 obj << -/D [2486 0 R /XYZ 85.0394 794.5015 null] +/D [2486 0 R /XYZ 56.6929 794.5015 null] >> endobj 2489 0 obj << -/D [2486 0 R /XYZ 85.0394 658.0977 null] +/D [2486 0 R /XYZ 56.6929 750.8289 null] >> endobj 2490 0 obj << -/D [2486 0 R /XYZ 85.0394 153.2806 null] +/D [2486 0 R /XYZ 56.6929 162.6734 null] +>> endobj +2491 0 obj << +/D [2486 0 R /XYZ 56.6929 86.4068 null] >> endobj 2485 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F55 1321 0 R /F22 961 0 R /F41 1218 0 R /F14 964 0 R >> +/Font << /F37 1038 0 R /F21 950 0 R /F55 1336 0 R /F22 973 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2493 0 obj << -/Length 1726 +2494 0 obj << +/Length 2389 /Filter /FlateDecode >> stream -xÚ¥XOWã6¿çSäÐCòvJ²$˽ÈîR P’íÛvw&Vˆß&6;ÐôÓwä‘ l[8D’Çó~32ëSøg}©ˆŠyÜbA$e²?_÷hÿž½ï1G4DA—êhÖûù]õc+®ú³E‡—&TkÖŸ¥ŸGD‘!p ƒ“Ét:>®Ç¿_ž‡‹c!£««ñääôÓ0à’1R:¸M>ŽÎñìjóÁèýx:ü:ûµ7žµjuUg4´:}ï}þJû)Xðk’0Ö²ÿ -v·]+¸ -ID9såðGÞ$Iò&³,ñ˜LCÇ,ꌑXJŽöy•dy‰a¬*vq·½Yes\[~Œ±Á[Ü&yêQŠqAâgUËîÁe µ˜ ÷>£Ž{ÿ@ŸÚ7ý€C€´§DðHÕŒfKãÓ2&aÏxŠ+XÒØaX!&Tu´³»ÄþD¶‚p6þ˜"ó¢þMñ¬Z&•c’丸1È -Öu¯€<[Ý°c ”wfžYÂ9ÒÙ¥Y¥¥Å%Íïj«á¼¸¹ÏŠ{ jz ¯ïð‘«Ú²ÈëU!$+÷ìÒ¸÷ó¢B‡E ¯VìÐaËäÞe#€†Ù$+Ü81©ËZ³Yge™¹×GÉãHABörŽFD ÀJ$ò—$ÈRTª Šˆ”-Â9 /Dr Ev£œ©˜©ðlQû ån½6 -ÒÞ!.Àk«ÀÂFN„DH ÜøÓèâê|ìñ¤°¯+l-3Û%¡šyÈÐy -ˆ<7P0d þÖ.¨nð ä 埗“1®^6у^uÈ÷ÖÀ¦±³%¯\Š4¸A ÀºX<Ê8ˆÌÚgò#±g %ÉJÃ7\1E_Ò}tZw Ùà¹oÛDíÌ*‚6møµÉFÁ2޷ރɦ–hP`ƒO!°‘²¸Áªgl|˜ea²zà aÇ´íÅ -XæRecî‹o¦™BMBÎtM:ë„_±{qq˜5«Z©/œGN×FéÈð -è²
[‘Å»ü -ñº¸ï¤¯öÊé./îʬ||O„²Š4x‘‰˜„¡¾{-~È;Xû/}$b̲ õOøî|-U×=Î5¶‰|–›¯Íò
ÙÝ› -X¥š‘kƒÈÊ7tÅDë¦z[~g ~!ä’
vÂ,s|±ÙyxJAoÓ¸e:~•©Éo³Ü7¬ ’µ íêÚ Æ‹leü•\dd#Љ÷Éxz|}z5;½œxú“ ÷Éþ¸AE²v0m†k[` -3R±}Fªf¶ƒv,;ÎÀ¤_šÊ½‚¹®º¹ 0וËõ.™ãÇêAÕ ¤ÆrÎíl·™{qè$e¬–Ê›~Ö#›T·Ùvê+7n -I²ÍáÄѮ퀎SL}gj瓶œóâ¡Sþ©çêìûl!µßZ<õFÛØÿïO:ûOW|£5ß9¼ãH;Ÿ¨F)ë7&éÕ›?OuÿÛÅÊ2endstream +xÚµZÝsÛ6÷_¡éËÉ3& äÍœëÔÉYjï®I ‰²9‘DÕ¤Kçþø[|Š@ºiï&3.v¿]ì2ÁðL$G˜©|R¨ qLød±9Á“;x÷ú„8šÌe}ªïç'}ÅŠ‰BJP1™¯z¼$ÂR’É|ù~zþîÝåÍÅÕ?O3Êñô{tšqŒ§?žßütþÆν;Utzþúrvš‘BbD\“ <½¸™Í._f³W·o¼¾ü×éÇù'—ó Y_{‚™Vëד÷ ñd ›øá#¦$Ÿ|ŒˆRt²9É9C<gÌϬOf' {oÍÒœIÄ%-pP2!9b¹ \!* jð€ÍÁ>1`°Ü¶mµÈ–íê¡Ù|®¾êÍ„Œq$a†ú¦ÜTz XÓ Ò@Eà×T=N§DN-7ƒíJ ;²PºñÌþÞÞÚß»j[=”]Ýlís×4k'6Dâœ:±¬ ++vöuÛìÚº=´Š +T Ÿ+y?XcTHÅ÷©Ò9ÈrüNÐâíUB½>˜DçI Uz¤ß "Ú`bLYìÀ.;=ÙÃ.ã…˜Î=ÑS¹~¬,M³Jf¤*sšÜåj¼@¤ >ôn ½ìONT³Ý 2¿î èwú<Á#±áÓÄ@*Ἢ‚ĉ8r·Ê_¿ÍíÈÇF½†É<ZÏö¬eŒ`
‡÷GˆsÃÒÆyû°(=I½m«m[wi‡]1×Y²Ý¸+ö¨F\ÑSWœ§\‘"èâh\[DNH8?Hó£zª„b‘RŒr,D¬ÙlW-jêªÃS¬²Y ¼ñ]YœPÛaXAC"ŸIA=¢P ‘Áô:…)tÅ\¥*×XN!j(F4 DǪÅg’1ÔÞ}ÕÞ4ÍçƒT¿otëµ[û5PùôÌ{i o+B7Ͳ:KrQ ‚(ï@vI–8ã9túp^ SÀUKVf¢Ï¡•=@ A*”ôMã P 1ˆ|Ü úTÃn¨Œ ¬~`î ëìølI$ +aG"¥‹½;Ôþ!ßÙ†ô8 ·¾P\RìóÏ]® R°£Y4›Mè'|%m¶uv8÷ÂÙGöo>¨N)Éc Ñ’}o .–ª—›ÝºB
¬žøO I]CÜïñâO` rÁÆ#|Ÿj8Â*áÏ: †xT¤'JˆŒì Ân"‘WÛÅúq©í%ï/³ë¿´vøź5ŒüUôöÎ>›¢ˆ©ã¢Ž{1ýÇ)‡¨ÜÝ7ÆLÁ_;–ÍN_j˜cC Ü^µÓ:{™&ªêá}ùTùõÆ—ñôzvmg ³Ò8ÜD·lEìÕᘩ×k×Ûú¹Ù>U]µŒ{à*ï Þ=Ô[©Ì„qõèØ»ôŠ +Ä ²ôäQ +¬ÊÅ}Êc— +1ÚnÒµ…Ç ’tE^¶õÒ½úYcY®ëeï[’¹D´ ïkcÿáÉ_-«vñPªÔØßòålø*Hq$ +YÓQyžæX^t $•HÞõAkòÂÂî¡ðµlªqìײðèkÙ>ÉA-Û¿›ëÙÕÃײŽW,µ<ðAûŽÀ=þ™'Ð [ÇÑã,ÒwPÊe_ø¯Q˜¡\WtrL§@s¤T b0"9&}†›þ€Õ* ŒäméÕ»Ñã¡¿oßK:ðý?Gú›w
®Èÿô§õýÿ"È¡µ—C7¤ ë¶Z¯”–äÅ¡êá#ü±îÿÒ¹ìendstream endobj -2492 0 obj << +2493 0 obj << /Type /Page -/Contents 2493 0 R -/Resources 2491 0 R +/Contents 2494 0 R +/Resources 2492 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2502 0 R ->> endobj -2494 0 obj << -/D [2492 0 R /XYZ 56.6929 794.5015 null] +/Parent 2473 0 R >> endobj 2495 0 obj << -/D [2492 0 R /XYZ 56.6929 598.7685 null] +/D [2493 0 R /XYZ 85.0394 794.5015 null] +>> endobj +862 0 obj << +/D [2493 0 R /XYZ 85.0394 769.5949 null] >> endobj 2496 0 obj << -/D [2492 0 R /XYZ 56.6929 432.9509 null] +/D [2493 0 R /XYZ 85.0394 744.4041 null] >> endobj 2497 0 obj << -/D [2492 0 R /XYZ 56.6929 360.8886 null] ->> endobj -866 0 obj << -/D [2492 0 R /XYZ 56.6929 315.6627 null] +/D [2493 0 R /XYZ 85.0394 712.3006 null] >> endobj 2498 0 obj << -/D [2492 0 R /XYZ 56.6929 279.8921 null] +/D [2493 0 R /XYZ 85.0394 646.0353 null] >> endobj 2499 0 obj << -/D [2492 0 R /XYZ 56.6929 241.5703 null] +/D [2493 0 R /XYZ 85.0394 555.085 null] >> endobj 2500 0 obj << -/D [2492 0 R /XYZ 56.6929 166.5861 null] ->> endobj -2501 0 obj << -/D [2492 0 R /XYZ 56.6929 97.4887 null] +/D [2493 0 R /XYZ 85.0394 479.7864 null] >> endobj -2491 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R /F48 1238 0 R /F39 1161 0 R /F53 1313 0 R >> +2492 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R /F53 1328 0 R /F55 1336 0 R /F48 1253 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2505 0 obj << -/Length 1929 +2503 0 obj << +/Length 1584 /Filter /FlateDecode >> stream -xÚµY[oÛ6~÷¯0°¨Y^DJÜžÒÄéÜK’Åî6 íƒlÓ¶PKò,9Yöëw(’²$Óΰ¢(PSÔá9Gß¹3¤á éG a&ƒ~(Ä1áýyÚÃý¼{Û#–f舆Mª7ÓÞëö%’‚ŠþtÙà! E¤?]| \Þßn¯Ç^ )ǃ7èbÈ1 |¼¼ýtùÁìÝ_H:¸|;š\ ‰Œ¢P“ <¸¾LFWÃÉh: ]|¾ë¦µ^MÝ fZ©¿zŸ¿âþ>á]#&#Þ‚Œˆ”´ŸöÎs;›Þ¤÷[Í°ñ¶:ê³ñˆ† 0(é‚$ç´…—H0Ê*4îî§ã»ÛÉÑ—`„9 -–hؤr‚=VpTZîpÝ ÊAð‚HGäI"¥Då ‘£4)÷E¼Rf™ªâðg ³P'%:…‰¡ç1iRƤ¦ª0y¯E¾¾á¼AIÀ¸æšb‘ìÔ¼ÌwÏ]ݧà!Àç¬r5•G»&|„‡ˆ…Q[»‰* ƒN¹¶x:$X•ª$3¿Oëd¾îS–è Æt£,·Øð°´¹ù5{E²P§Í ݘFì34¨Î˜ÁQUfØ ¹&ETÌY‘ŽÈ#²åš!¢„‰¶ÈËe©v¸]R&Ùª]¦žj Uz`4ˆ¥ù£ê ÍwÉ*ÉâÍÉó§¦/8oMs]CSaûèsqÒ dÖÇ7êQmŽü› -DÃ@œÓ©¦9RªåÛŒ ÊES)Ÿg«Ù~µªíPét'6•Œ¼€T“ê4V5U…ÖÈV$¹CKe ¥:‚‹QuÏ«VSytkCTPWZÊ}*”®Â€Fd8X%*3{w[•M& ̃Ñ*(•lðÇÚÑÌót›lÔÂ<=%åÚ°¹5ù‰³]ì·Û|Wš‡¤4 µŒ÷m´J~nv·ßæ!¿h,úC¢ˆnú -9 ,u…7H«$™¥1 ¦6ÂŽ©%°ØÆÉάTå}z•,
ul Mž3ëxcÌ /ìy(õEeqX§q9_ë ¯\ˆí¸Žß‡âÍ -Rk¹N;½C]åÆ×6/;ÉÅh ±h !„ Nû¡ºy)Ã4¨Îø”£ª|êáȧ8tœRžéˆ<"[‰cÄ¡m™÷»$+Oµe¼:ZMb2EëÝÃè÷»÷#³ž¹¸ëÜlo‹:’Ë®%<Âj‹tiè£P !
¡õvôddå_~˜Üy| CNˆqJ›!rV*û‚9Žà?òÊ d²i7‚0œ
Ž7ã[ëVÒŠ[¤I.¼‹¡ ³h¨¥2_–Íí÷|Œ³}¼ñ¨ED„¨€Ï°÷) ‚\½y¸¹2 aÐ ~T×€K퇂ûDRH‡ŸË>M½{8‡œ¡gÐ+eζ“ç¢T©ÍØWyV@±HöéAn -™endstream +xÚµX[s›F~ׯУ4›½³Û7dˉÛq-¥“Ž“,!‡ W 'î¯ïYvA m#wÚ83a³ß~ç~bøG†B"©© †š#‰.Ö<|€woÄÉPЕšÌ¯ÏY8ÔHK*‡óUK!¬Î—w£ ’h xtv=›MOƒwÓ?Îoß_]F“éå8 B)9Šnn¦×g ǶÀŒGWÑõ‡èÒ>»k:ŠÞLgãÏó_ÓyK®« +9`0Hc6J|fk¤ŒÙ‚'£èës!:’„ ÆCèF$Kž’lß :Dš*:ì y@¬ò£Ýã0EkÑg6KªÒú¤ú’ØÅ2¹ß><¤ùƒ½‰!Ë 4ÖZj.%LÂ4 +a5âôctus9uº ð0 éËZpn‚ 0‡Ñý6Í–fI d4{ÁUÚ§g3ûðöÖÞ¯6c¢FÅÚ>5{êó¸êj,Rüj-ü.ù ¯ ³-Š5:Á˜PI$ö% VZ»_“çOÓÌñÊãuòªÇèYV|s6##8!0¸`¬³á +‘ +UØ;ßF?'!’a¨úfßqCFÏC~J"Jå +i…,¾·ƒf ·0*iËâµ?ßF!VûáÚB Øä\hWöçA›Á½ +nÚ˜M´¢È^’PÏyñXB)Þ›Ž¡ï…J²z²
ö÷;wýp¦ïBÔ£3÷ÍôÔ¾!Z#Ô˜Ó N펔:Æ5nÚoœpXƒ•M+¿ Øg‹yÄ Ð~󈳇b“V_Ö \Ô¹N²< } +Kh¸¯‹ÕÊôÉCXhs¡`| vá
˜€1ÃÏ—e6èY\–¾¡FC$«}೟Ãwz6ÉáQrÔa-âê(â*‹}r¨°Šîã½iW ä¾ZÿÎöWŠæ7>ïWÀ»àk{컣á·7åôÃÃ< ȾV—GTU¾,©R3z ùQ83ÒTÏ>GrˆNŠ2ä扸ƒøxôfpTîMË›¢*EöœÃ}ðÛŸ“%ÕqoùMK¡ø|€÷t¯ý&â+¡Þ|v«fpõ}X‚Ì× O3ÀmúÏ vŸØÀCL)êÿ"CC`³lHeWÔ F”A?äþ7˜Ðéendstream endobj -2504 0 obj << +2502 0 obj << /Type /Page -/Contents 2505 0 R -/Resources 2503 0 R +/Contents 2503 0 R +/Resources 2501 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2502 0 R +/Parent 2473 0 R +>> endobj +2504 0 obj << +/D [2502 0 R /XYZ 56.6929 794.5015 null] +>> endobj +2505 0 obj << +/D [2502 0 R /XYZ 56.6929 692.8049 null] >> endobj 2506 0 obj << -/D [2504 0 R /XYZ 85.0394 794.5015 null] +/D [2502 0 R /XYZ 56.6929 544.1607 null] >> endobj 2507 0 obj << -/D [2504 0 R /XYZ 85.0394 751.9581 null] +/D [2502 0 R /XYZ 56.6929 446.1895 null] >> endobj 2508 0 obj << -/D [2504 0 R /XYZ 85.0394 466.3276 null] +/D [2502 0 R /XYZ 56.6929 379.4876 null] >> endobj 2509 0 obj << -/D [2504 0 R /XYZ 85.0394 401.6524 null] ->> endobj -870 0 obj << -/D [2504 0 R /XYZ 85.0394 361.5595 null] +/D [2502 0 R /XYZ 56.6929 300.8306 null] >> endobj -1456 0 obj << -/D [2504 0 R /XYZ 85.0394 328.0431 null] +866 0 obj << +/D [2502 0 R /XYZ 56.6929 259.3294 null] >> endobj 2510 0 obj << -/D [2504 0 R /XYZ 85.0394 291.9754 null] +/D [2502 0 R /XYZ 56.6929 221.6367 null] >> endobj 2511 0 obj << -/D [2504 0 R /XYZ 85.0394 224.3783 null] +/D [2502 0 R /XYZ 56.6929 188.5084 null] >> endobj 2512 0 obj << -/D [2504 0 R /XYZ 85.0394 138.7576 null] +/D [2502 0 R /XYZ 56.6929 118.8847 null] >> endobj -2503 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F55 1321 0 R /F39 1161 0 R /F41 1218 0 R /F53 1313 0 R >> +2501 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F55 1336 0 R /F22 973 0 R /F48 1253 0 R /F41 1233 0 R /F39 1173 0 R /F53 1328 0 R >> /ProcSet [ /PDF /Text ] >> endobj 2515 0 obj << -/Length 3013 +/Length 2924 /Filter /FlateDecode >> stream -xÚµZKsã6¾ûW¨j¦+‡ -÷.·LT˜e:;¿¥#Ù²‰’,Ì’T ·ü–0?C+á…@{æi°ÛÌ- -†ê†Fzî.ÏüÝC¸iür¥u -êÊõ˜ç˜ªD€¥35„êsYU -tæõŠm$γ½&O(«0¯³8Lòá}xä½cêŽ3V÷.J§QGêÕ§:í¢<•uQ?Ò%Óº ž!‘Ò¹»’åÖÌ ”¾ Ê&d ‚K–ç…óT#Ò
“‘<ŒäcñîM× ä¡Ëceâ@C¿Ï«r¶: 'ÌÛðá2Ã`æΆO¤œŸ9•ƒoÎ^9†=Ñ™S`"{«£8‘„QžžßÏÑ ï×·k*Â(͆ûݬKÝ®-–l…5Djß¡[ -ìðwV<O5"ß -gúµG‹æ¦2ùT$|êdYØÔ‰wº¦¯«Ç|ù”%¿>ÃoÕÔK³õQ0ÇŽ¦þ„Ÿb_‡µŠówëâ¥ï×…[xÄÀ?gå¦iKûŠ%ƒv…å ¥yh¿¬žB D98™×üZê ò •EÞý«Éüfkæ¿
b9šD>m `b‰óž•ÓÈ9@`¢B©” -z8™Ù#ˆ©"rŸH ¿°…2¦AîQÙ½tèØQafÄï~1Ô¡sþöÀëØUð[Œæ'è›Ï›ªœ•¼q»›±!ðÀ -Ï:ê¶ZB‘ÜÖ¶Ÿ‚ËùÃOÙ@˜€Ô/ Ñô¬8=’ؽ~ìI9h¬wmG ÍgpÇQV/Ô_µ‰åÕ´Ìíˆ=srf+œ½Ñ°ÎIR÷ÍZ>¿¨È¹œ¡ê. ©½í8 —.2DäpÄÖ¿8`ãÑž‡´ßª¿xC6ÛtL#oK>Mó5^¶Þó ›´‹¦€_ÁhîÓ‘äp" úÄðË8.¾C´Ô,ìÁÞ’^ÑžŠêzì}ª÷%eÿ€Úmö9ž ¼´á©?íÁ¼wü³Pä_Bÿç?ûÙÿ}SœBy’Éq S ÂâÄ …Z --#ÿбìÿ’8Aendstream +xÚ¥]sÛ¸ñÝ¿B3}¨<áðÉôɱu‰Ï‰íFNÛôî h‰–9¡HU¤âú~}X€(Ji§ãs ,€Å~ïRlBáME¨Hå$N%Q”©ÉrsF'k˜{Æ,ÎÌ!Í|¬wg?ý,âIJÒˆG“‡'o¯„Ð$a“‡Õ¯Ó‹ûûùíÕõ?Îg\Ñé;r>S”N?]Ü~¹øˆc÷ç)Ÿ^¼Ÿ/ÎgL%IH‘F‹èôêv±˜_Înæ_þ|÷éãÅ»ùÇóß ~9›?tÄù`ThÊþuöëït²‚{ürF‰H5yJXšòÉæL*A””g‹³¿vz³féC”HˆJx<ÂÎ&Œ‘T) °D¥$\–\Í—Ÿ¯ï ®ïnõmÌšž‹t\!qœDyU5M¾œ}Ë_Ÿvõ¦Ì óÒ.âÞ"àx”P ‹õšuÞ6ç3¡Ø–Yè¥hŸjŸsÖÅ÷¼Ò Ÿê}ÏÙ´Ä·§Ý9K¦õÑ2|,w¯Û¶Fø93«|Úý²j…Àã¾(W=üF)/óÆžPïô-&3Gø¬cšf;jÇoTÑE¾Ü»ƒôÌÃ0{ƒoYƒÏU®¨ò¾>?ÿlwâJ(»¢Z
æ$’Š€ý „K9²ÿ˜eØ-}±”0!Ëî*Ûä#2á‘éŸà #ó¹Œ/z¤hðÙlóe¡o`. +\×™¹GŽQzåPE"þk¦2ª™ÚXe7lµzžù>i™9”¢jòª)Zð®£.åZs)N¦UŸ©Çz3l¬†?8G¿™¯ôåc°¢Y !îKQ–8ldÏ}cÜÌ=¾âÈ*Êöek7ÚWà‹œiG}œ +9_t÷“42N[ÄÊ: "c5äë†E3÷ÖУÅÁ{ >ˆ¡Í3p<³(Q&Œ\ÚA“X±“·T`–]pÕ7óOR6îÀ>{‰êWX ‚HÉÁÎóû6 µÏYk5ÌS
xµb6.ÖjÝs¾üæ"Þ“ÓbÛ¬- ‹²h_ÝR þ5d¸Htü SÎÛºÍQrì-P ¥ŽÁýÀøl4‰†ŠèÄžáC‡«¬w¯ˆÚZ/6Û2ßäU;0 + +‡¨¬Ìâ¾Ûo¿@Aä*¾Ûí"ŸqB¸v- ÕèX4ÊÊp¬¶Ò1‘ ëzà‰I³0íÉN×aÜ&x¾ä&!蚶ûGH¹í%õ >H P‚Ì–&rl*o—ÖÔ¦7¦™QlM +§wüÅá¢éöÈò ñ#°Þªd™+eлÜVÔßó]Ú k¢‚þšq}{õ—¾dñúTéÀçœ9šÛaEJ• {(:€äY ªØW¤›ãNnFõ¶§½„‡uÂM8,Cør¼QÊA},áË|íaò¨ˆþ¦sš²k„´°~ „IÊBÚ®«•Ö,à )œj(G +ªÎ“G:¤‘#Ã,ƒÒÄá‘ï½æSW=ùiƒ®ö®Z·õ9š( +ö¨l"E vú#e‡sâ#%âÁÜŒÅ^A”r_äVÅ._š.ûÐï*ND +Fq‚¬ç€®ðäðqâÓµ8ì’!èàlËßëOØ:z÷á¸ûiÀÁW5×<sMÕ—]ѶyEŽý +D(¢º1rQÚ}xþ¿!Òÿ FêÊ&áã<‡O„H™#J3ÉtHz÷[’CÚÿ€v«Iendstream endobj 2514 0 obj << /Type /Page /Contents 2515 0 R /Resources 2513 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2502 0 R +/Parent 2473 0 R >> endobj 2516 0 obj << -/D [2514 0 R /XYZ 56.6929 794.5015 null] +/D [2514 0 R /XYZ 85.0394 794.5015 null] >> endobj 2517 0 obj << -/D [2514 0 R /XYZ 56.6929 679.0396 null] +/D [2514 0 R /XYZ 85.0394 752.1413 null] >> endobj 2518 0 obj << -/D [2514 0 R /XYZ 56.6929 422.1751 null] +/D [2514 0 R /XYZ 85.0394 646.9327 null] >> endobj 2513 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F41 1218 0 R /F21 938 0 R /F55 1321 0 R >> +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R /F55 1336 0 R >> /ProcSet [ /PDF /Text ] >> endobj 2521 0 obj << -/Length 2295 +/Length 3027 /Filter /FlateDecode >> stream -xÚ¥Y[sÚH~÷¯àÍPÚÝê‹Ô3O$q2ÌÎ`¯!5[›øAa4‹„ ç×ïé+4&ÙTEÖѹ|}.Ÿ0éaøGz G˜JÖ‹%C Þ›¯/pïž}¼ Vf脆m©·³‹«4îI$E$z³eKW‚p’Þlñ¹?º½½ž¼ ÿk0Œ8î¿Eƒ!Ǹÿçhòiô‡Ù» Ȩ?úx= I“„%&pÿýd:½~7œŽ?Nþ}3¹ ÜÏ~¿¸žyÇÚÎL•Wÿ¹ø|{ ˆá÷ Œ¨Lxïn0"RF½õãqF©Û).¦ÿô -[Oõ«!0O˜è
9C -û*ŽéûPÔž E‰)OÕµ¬ÚÐÀªEÛ-uïÞ% @eÖ -‚7RQÇ׬ÔÊå¿Ú«–ê½%@V«À¸Í:j«P §Zõãn•y¤1‡'˪(ªgfÔtµ[•{ÝzÃj‚’ßik*7¿eVÇåË¥6,ú—ëÊ/Ÿ/7— ¿·r+8¦ -©náK¡Àç¹v Ûrhở·œË2Np A¯ÒŸ¶Ôiúã¥4ýÙ švÇ;cÒ L¶– -a~`ò¶… LÝMOÇ^³Må:7 »uÚœD‡% Á(8CÛR§ÑñRM€ B¾&’S›6ï®n¯FWwWã«÷WiqL¸"·¯úè¥NvH¢$ˆáïzé -d…*sÍË…žöçU®S 8ð”âmk«ó¾m¿pˆŽqäÒ' -0…ñË(éò°Ñ§Ùo7wç‘ +FXf6y¦/u“í”W•ðÓä»õÞ.L2&"«‡Aª`;×Þ¢d0$ ‡£®4F”GL OÒ ÇSRјu9¡S¤úȬÌ/`öÃÆ?WÒžÙ5UU„0ÃÉøRV›:¯ù€ÀˆÀG±@B`¢ð%M«z•Ï´UhªÀB|ÆKÃWuøy˜Þ»ÕÜò Ú™ÚÀâ¨t 8/€Î†ª æ»ì5.»5¾È·ðeRm_JÕ~‘OV¯ôú¬Ò¬|ÌËP3êŠyÙh\ ÷ Ý™í(òÔçÞÎkŒ’¸; -pzè:§ â •cßÿ €ç%Šendstream +xÚZYsÛ8~÷¯Ð›åŠÅà x<:ñÏÄvÖÖÔìÔd (‰²X¡HHÙãýõÛnP¤DÉ©ÝÍT
F£Ñ +†ß¾]Ý_Þþól¤Œ€)0AˆáÝÅýo_‰öí,VË›«§³¿Æ¿œ\åÚB£fÿ:ùó/1˜Á>~9žŽ#3x… “q¬ËßhÏøZ;J~òtòF`kÔNí;ßDžQ~ + mG©§´†ÔʇSK©3KçÉ&¯éÇxü•‡Kj7³Íá$ybÆ"~¤oÔy]¤õ2–ãX¦eñ’®ëtÆäÂÉM¨q7†ýÇG:·ó ›…@,œ×`»*Œ`k±1´µl¹*i%^I…®„„—EzÝHñ,WE<v%$Øý%©‰ôšå9õ&)Á™ð*öP”ÕV¶ nŠ<¶R …,(az’9™½ÑHBt> Ü¡p{#'öøX¥V6FíêLódJ{ +òë"›.¨;Mª”z¼=Xòשׁ³â™È¼Y˜Tnò³&?˜wÅ”ÎÒbšâÕÄ!âÇÍœØx ¡ŽT¸ +¸Ù 1*ð|!™‡ö²,_Rv Y}Ð#¾ñ¤‚ã ¡ÍuØ#4\Ö#¬Þõ«uY—ÓrÏ-À’°›(>®\ÃÕ£]ûh¤B·+TW=ö
¾fÃóc€U²C/I¾I©K ÁWŽ][;•R1~FÑpìè»bùI¨)6ËIÊÒ&iýšZ‚ÙŠu”1-áÖèØ cvqµujÀj‹â¡¦Ÿß…” @Oz4ö@ñÇWeUe“<¥»áŠFhÇQì| »µçÍ2-jKœÍãpöf_D–‹´ÇëÏDPF–R8žºê³ÿj3‚[)ׇã˜/´”ÇQÛæ:ŒÚ†Ë¢¶îAmìIeBÆÞVé^ ƒ[QQ|\-ÇÔ£V'’ù =¤V µn‹Y6…líY öEJRÀBJ9:{<ŠRžŽühgGû.E +Ã<ËMU“à /~¨³ôÅoã/Ÿ î¯1w<'Òýà Q2‘9ÈãÁýÒ ,×AÂýƒ›ë!{@F†† 6°AÛ^ÌÛ’°gØ)ÎÓ53Ûˆ©\4„N2Éò¬~ëŽ&/j{ø¼rR'¨¼–d¤ÙE;H&Ã$Ùà€·²1…+©…H³~[ÕôÅ †»¼!x î-®#pw\î/ýNZû¡ 8yú’îyè8‘:®˜cêQ¬ãŸ…‚'6]ÍÈ?SÆˇ8K'›çg +ÈðÓ*vøÈDà…Z¼×Ú\GŽÌqÙ#{Û« ”0ñ;K:¦ž%;µ‚ðŒ;K^äyùŠ.Xh®ë°¯8Sâw!Tný6PmÒ D4TlŸ¹Ò˜Ñ0œZAÙœ',˜³‘w{I#œ*! ‚YžÍR¦gõ‚È”9"œ%aéMö…vAtù(´&£(©3ÒÝ·´šÖÔµ>xÒÌUB’´ÅÎ$eLH6ò—òG:ÃP'}ÿÆ”ŠÄV^‘óä*™órd–Š}*²9µoå†Fš`g'nÚ¿˜G‘§5±OÒ>Ÿ°©Û؈ ¨ò%ƒ}}
É×¢Û(¦‹’ ¿eY~Z +,]󶚲,áÁ„wwãs®n‚áœ2ÅåÎÞÝé4*×ÙÒ–$Pù\;UlYdXp¡gá +#>-Ž¯›õ¦]óÝŒÕ]à ڇ 9ÌÁ ¤&ª‹¾ço{×0x +=´gõë鲤® ž¾6½YÓ[¸žÝÎ^fŽTÛ"—áõÂî.$ =´Ór¹ÚЙWÆÓÞÒdÍJ¡ ˜¥¨g\=O÷
u`¨£üѢܬéÇ,y«ìÃ-?庩ó4YQÏ.†VÅ|˲¨,´»º%5ë‰ËµDAuðÃ-ßÒù]Ÿs¨M-³NÅò4DÕ*քͦrÑR ?3°µD:·CMû‚Ïw¼Jç2з°i]†õ8,)¸ y–‚bÇS¡~'X·¹ë†Ëëoï¡x¥ ˹ÝÊn ª}È„dx\¿†«GÁNžµ›Vº« §9±;Z¨Šf”j©,¨uÏ Xo…b –PnvIí„…¬6¨Æö"ZÃÍ"ø@×ï«xx1¯mð°ÃÖç²çÈÝ ^Ô&ë&„JFû»Þ“^Žûy èÓ|3#Ðsx•ssʪÀ,ðBÝ’Q”uW˜{†¢üÛ +¬‘E׈dpläþ[³áRÏÙæ +§Ç|GÑ
µåªÎJ–¸ ÕVR¯œØš ¡zï%ª®8iYÆwp‰EùŠÍA;€“÷d½ó<Ûæ:l
—µƒ‹>;О1ñϘAàAi¦«×põè×1_xq„]ù9ÆpÄÙöðV´ñ t¸(g5ôºiGJj'Ì ÇÃô0@Tb¸“›¼òZ÷HöH&T²L2 +“§ 3ø—}?+<¥á÷uÿÀhendstream endobj 2520 0 obj << /Type /Page /Contents 2521 0 R /Resources 2519 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2502 0 R +/Parent 2525 0 R >> endobj 2522 0 obj << -/D [2520 0 R /XYZ 85.0394 794.5015 null] +/D [2520 0 R /XYZ 56.6929 794.5015 null] >> endobj 2523 0 obj << -/D [2520 0 R /XYZ 85.0394 567.3101 null] +/D [2520 0 R /XYZ 56.6929 439.3142 null] >> endobj 2524 0 obj << -/D [2520 0 R /XYZ 85.0394 399.1134 null] ->> endobj -2525 0 obj << -/D [2520 0 R /XYZ 85.0394 330.2279 null] ->> endobj -874 0 obj << -/D [2520 0 R /XYZ 85.0394 287.2095 null] ->> endobj -2526 0 obj << -/D [2520 0 R /XYZ 85.0394 248.8505 null] ->> endobj -2527 0 obj << -/D [2520 0 R /XYZ 85.0394 215.0559 null] ->> endobj -2528 0 obj << -/D [2520 0 R /XYZ 85.0394 143.2486 null] +/D [2520 0 R /XYZ 56.6929 95.301 null] >> endobj 2519 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F55 1321 0 R /F22 961 0 R /F41 1218 0 R /F39 1161 0 R /F53 1313 0 R >> +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F55 1336 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2531 0 obj << -/Length 2973 +2528 0 obj << +/Length 2297 /Filter /FlateDecode >> stream -xÚ¥ZßsÛ6~÷_¡™{¡§?I }rm_ê&v|‘Ó»^ÛZ¤-N$R©¸Î_ ,@‘Ee¦É¡ÅX,>|Ø]šM(üg“Øp3IŒ$Š25™¯ÎèäúÞž1¯3
JÓ®Ögÿü—H&†˜˜Ç“‡§ÎXšPÙä!û-ú‘hr#Ðèên6»¾œÎnÞÞýïÃÝõù”é„%ÑÅýýõÝÕÍϧ\QPeJ£Û‹»OïQvnxtñözvþÇÃÏg×a]ãÖª?Ï~ûƒN2XÃÏg”£Õä~PÂŒá“Õ™T‚()D,ÏfgÿnìôºWÁ(á"æÞàlÂ1Jñž;”!±à¹ãêzvùñæþáæÃ]{gçA:™ò˜hAµSÎʺÎçÓºx.¿Veî_à’„.xÑê[Å|Ë(µÙ×À£B±è¦AÑs^更ɽâ ì v¤e†¢ aP¶9g:Êç•{falTÑÚ‰«l;ÏûÓZCr?Ú—|SU‰ Õ“]¸ÎÛ=E!TšEZFG_QuÎ"g¼Tqô€]&l7E}¯^ФͶÆ÷`t'Ëòeþœ60«ïxBCWØÝÎÓš Bç`'ý*Ú,ÒåEý=ø±èe‘ËÔi‚=óE±Ì¼Õ0BÒýæÖJÃ"9î‘] -4~?¾â§‡î@^çå|o¼ô±+|òB„ìböˆpÀ¨ÇÐçüµÎ›¨ M„Ø£Úï”ò¥ ý)Ì™§ó¶‚[ ‰ X Ü 8SÂÉ8‚þƒ; ‡g‘„±x jÕ±³‰JÓ®V8š‡DÕjÙy§éþ”àc˜ Ÿ2(
LÙõ^ ÍD°þ”¿œ3 -à-#÷¸ ŽeQ>nmõý /në¼ÏßÕ2Ë}Ÿ¿ w -˜a„ÁVy:* -{ -ÿÌòéP\ü”n—M¸Ã+ Ý~ž×Œý°wgç«uãyÔ±¸k…88 á ÛªôOÜ®ãç -ð&FZûgOÎ;·WW„Õ¦§åë^?L!Òg‹ÅEô°(üèÕÚç Ð^¥~ŠÇüÐ8X 庇à¥X‡ÊFS¬FÒm`\I–9±Ý ‘íZn»—ÛmãªåÙj•bdØ™ .Ô@ª£–µZ¦õc&°ÍF¯=Ûv·J[ïSÑÕ{[¢ýe¶|ä¤Eé•Ú<ÎJ݉)ž8h¸]µ=6¶‚ÃþîúW NíjÊ‘¹ ½vMá‹‚Ðç½áú]é d颴,l5Dÿ4Vf¯Þ¸öwáÄA¡`ï9Š ÇÀ2æD -A›…- 醵\ÌxtZ}/YutÂ@à \¢½K´sIëíý¡£ïî\vd -cr12Xƒl‹SÄS+‡´YvX¸Í³£ B!ì K)J·X¼éíbgŽ"'†{Ÿ¨ëïtF¾•£ŽÃÌâ –j’ÑÉ‚ÊÁd½:&#nüîd÷›¢ E]ÿ‰^Tï€z»Z¥›×#I–ÂË¥ÿ˜Že¦çí*/;çÃÏn\`º]ióovk+;Äþ‰Ñ€“hûçû/™v³%"ô±ÂO—ã`”5œ)y&ÿ7O‡¶ÿ 2‰?tendstream +xÚµYKsÛ8¾ûWè°º&Bð$€£bÉIb{-¥j·œ h‰²Y#‘ ‘vÊùõÓxѤYžÝšä Ðìn|h4>Àd€á?(0Ó| 5G1˜¯ðà ÆÎŽˆ×¥aWëÓìèã)“tJÓÁlÙ±¥VŠ f‹Ûdt}=¹ _üçxHN>¡ã¡À8ù:ºü6úâú®5MFg“éñh%4(I£–âd|9NN†Ÿ'ÿ=›\ ÿ˜ý~4™µauC'˜™˜þ<ºý ˜ÁïG1°6ø
ŒˆÖt°>â‚!Á =«£éÑ¿[ƒQûi ŠVgÈ8R)Øx0¡QÊ(k#¼˜Q1˜AÐ2€}ÇDnO•` q9èÚÛñÚjíºå¤ã–`yÚw[Â?ãöã)¥ ]š"Ž£SÔnÅš‡Ü ä/N(³uŽö.'(ÅôPnu´Þ€*h †ê-¯ ¨¶ÝÆ¡êºÍ²,†FœB„{ *ŸÖù¦˜»Æ昨$t?u^6YST¥«–[_f«ûjS4ëý +‰¨f…ŒjeÝ-ʺÎçCp²ÜTëUv—¯"!j‰$K¥qîV8krkš4?+#ÈÄ·Ê릥’Ÿ°¼NÁl¤Ú©Üeu~L’…k¹ôHÃleb§/\oÝ@ëÞO¦0P • }6û ý)ü›EÙ~ŠДC–„pµÛ +"Ö^Éôñá´ieæGšCεá˜s‚Ëšye®¯yÈo$+p—;`0ßØT0½UÇ~šüªJﾊًÂ{jV/ΔÙ#fÔ%dÇÈ¿..‡.ž¢TÁ&ô™Bí$O¾|O º5³|w¶ +•5¡ßäËÜMµœ{¾fåS«¨$Uˆ¦i¨ú± r( +ÒÍ鉳È1ã{p’S.B¥‰;dŠ#©©ê<ú6;¿º9ŒìÔåM™7.ŒéK
ûÁ¤ÈŸjÓOëW¿ 1ž†å ¥ % ”cÜ_«°¥˜‰Q;Jr ÇÆžÀR”¨Ý%÷#¥ÒIŽko¤.9_ÉISU«÷¤âKY=Ö°?¶¸C +¼›Af\"kaPa5œY GÉ 7‹aÇÂ.©”'(E枪·CÏãë1‰„N…O¶ŠDJÜ4—!3«w«€ŽJE0 +QÔůX„ìTœ‘m“åA“†84/Q›€ÅrÛ&k¥QÄ: ‹P²Íí WèP“?VËe7O©@R0±í餕æOO¬²ºŽ )%õ¶éñA`Þ1ß6;9h6/ï‹2†v_µ¸<hq¹ÊîcçˆKE[{Ž¯iSoï/Îíð¬õw ñù +wópÄú½
59’Ù@EºƒöC+] \Èÿ ÷â J†ônžÃIñž<ÿ|8EŠ
p jóG"¥‚ôáç„ÁÍY©þ™~;üqmž'œ¦‰EN$ÒŒªíÈÿh¥ëîǃÐ<nª¦šWî?[éæŸ z«V°Hpªûbwj½ÈŸ÷,,;•vúžâ [BÁê³ >hˆÔ ÛïF¸9hsÏAÐOÅÖÞóA{«ü9_í+Ê;iûËKå+)Ù¢Wœ! +¼OÆ“éÉÍÅõìâê2r)‹½F˜pR!E¿ÒYfÌÝœ¾NZZæB ?F6dwjÈ¿%¨í¸gǦ•ùϹ¡þ¥½yA³(ݯe F pú/ÊÅÖ˜a§pÿH¹N.ÂEÁÅÜË`wÙ“xH]9)ÌƵüd$÷“®§Úù[ H³éÅ™“ÌìfÇ›½QgsGíÌÀ¸>\1Iâ'^› {ßµûíΚ…ÿÒÍ ª¸ +áK*R;¬}vî‡~Ùq 8999»šÎŽ¡\}™Bغ†ï×iQm™â0hÞ`³BP§aØTն…çM hAƒè7tovTÊd| ÏTÅq±4õ×U’!yž¯VP5Âó ¦Éù×ÑÉУš¢N›R¾ÝãpêôÀ´>Ä +t¨A5Ó‡œƒšZûÂ`§èkBÎKÓ˜gAÅ<N–uÑÏûÿ@dKDôoZ¸-&ÿ÷_÷^ÿ´ +è"oP†9b *¦Ê`Aà<Ú +]0à›Ê<eìÄþX Ôendstream endobj -2530 0 obj << +2527 0 obj << /Type /Page -/Contents 2531 0 R -/Resources 2529 0 R +/Contents 2528 0 R +/Resources 2526 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2502 0 R +/Parent 2525 0 R +>> endobj +2529 0 obj << +/D [2527 0 R /XYZ 85.0394 794.5015 null] +>> endobj +2530 0 obj << +/D [2527 0 R /XYZ 85.0394 590.9135 null] +>> endobj +2531 0 obj << +/D [2527 0 R /XYZ 85.0394 530.3944 null] +>> endobj +870 0 obj << +/D [2527 0 R /XYZ 85.0394 493.1893 null] +>> endobj +1469 0 obj << +/D [2527 0 R /XYZ 85.0394 457.3833 null] >> endobj 2532 0 obj << -/D [2530 0 R /XYZ 56.6929 794.5015 null] +/D [2527 0 R /XYZ 85.0394 426.1417 null] >> endobj 2533 0 obj << -/D [2530 0 R /XYZ 56.6929 751.8053 null] +/D [2527 0 R /XYZ 85.0394 362.7008 null] >> endobj 2534 0 obj << -/D [2530 0 R /XYZ 56.6929 661.6515 null] +/D [2527 0 R /XYZ 85.0394 257.3259 null] >> endobj -2529 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R /F55 1321 0 R /F53 1313 0 R >> +2535 0 obj << +/D [2527 0 R /XYZ 85.0394 142.9115 null] +>> endobj +2526 0 obj << +/Font << /F37 1038 0 R /F14 976 0 R /F41 1233 0 R /F22 973 0 R /F21 950 0 R /F39 1173 0 R /F53 1328 0 R /F55 1336 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2537 0 obj << -/Length 3169 +2538 0 obj << +/Length 3322 /Filter /FlateDecode >> stream -xÚ¥ËrÛFò®¯àm¡ª™^G;vRNvm'Rj·6É"@ 1 0 Ð2óõÛ=݃ª\[:p¦§§§§§ß\ ø“«4 -…ÎÌ*ÉL 6û±z„µ n$ã¬=ÒzˆõúþæÛïu²ÊÂ,Vñê~; •†"Måê¾ø-xõñãÛ÷oÞýçv"¼oבÁ¿^½ÿõÕ? öñ6SÁ« ÞÞÝ®ešÈRD‹EðæýÝÝÛïÖwï~xÿßïßÞþqÿãÍÛûŽ±!óRhäꯛßþ«îðãu–F«g˜ˆPf™ZíoL¤ÃÈhí!»›»›Ÿ;‚ƒU·uN&JÃH™xµŽL(¢TÏ‹Là #Bc´êD¦äœÈ<Šl]áE¿ý>Š˜Y(U” -·5 óµñDݶ9´U÷U*
ì¡ÜT¿ ¡JK€ÎtƒÍy³ãaw„›åŒ™3‰f‹œomÙÒ|ënÒìq–í ˆdlNGºeͨmµç#~‘¨<O «º° -æ:(Êm~Úµ8Q^ -©ÙzีÓÂKë‰ÐA˜”›9ZÈAr%ÇèµX…Þbs_d¸7ÀâÞ6<!&#ygQƒ§Ù8wäÜÐå1Ij¥#Æ,ëò˜·Nó㉸- ª}Ê['е–i+ 3lϬNЊ -XÇÁ¶9L ùÙ¢ÎTÊö‰€9áxóÈÀ—ÀêB“0" -¿½û ¹sRð»+ȩœat xY¸Õò̦ڜvÅ ¶:Ê8ÜÆð.:É®‡äÒrDöH. ¿›
ÈqÚ) aküž4d”ã8„Ä"»Ê\‡tÉÝ($'24ÔmÈžóRZFŸcã´a_t,Ò…e¢1íJ—”™àccmõ°+ ‰ˆYÂhÁD^ …I, âw¥L[~iñwÆäH-‹¼‰b cÏŠŒ"'>µm )¥6ƒSŽùóÒ!I(eê9"¸6*!¡‘c‹½r'‹ú@c; «}~¬vgƒ9Ö…‹J0sJŸÅ¤Ÿ0?Y¿Bæƒâ\çûjCŸá €Ï°
“CßÂ#¦XœöÚÞ…Mm -=!s3äH`Z7õŸ‚f^7p Aƒ2ù -Bº—¶Ëy):WÕ×DZIW0 Ì{kEÑ—È“+AŒ o -¹^ŠÕÙ5¶:¤K¾Æ!Îc¾îFÎÇø$ÛV3º Ü-z
·„伌q#fÞ™ ^Ÿi…“atëqFm·¡£@+>ÖÑÎwC)BË _GEÙB¦V Fá"Q:Öµï>þºø¦ØS"Š¯?êkùU;,÷¬ïçž[¸>W²M¾oQå»…šJ UhÁU&;¬.GƒˆÂÄÄñ˜M—Ó‘w ^á ˆ%ú—ƱÏ_ aßí3\ÄL -–&ËÅÖ:ƒh#Ĥí€eЧ²<,”CÚ„Q&ô|Í5×G1 -‚s:¬µ0.¹˜´pDÅhÚ½Þ|aHG‰ P=ÕÕô*KDE˜‰®at¡¦R@5 ÜOƒêÄ ™³ÇZÑ.U -›¸'6'Øq«]…ÂDñ Ç{¬™ãÇö$*ÎÆç¿i|‘Ó¹è¢ÚN]´SOªH=ÝROȯ•(1¼ ¸ÚÁy¬E÷D@‘uü Œ4ÃÁ¸'"ÂT&fÌ»a*õsã“íR²_¾ÿŽ2KÌ#J{Èš6vY¸ø#Wé  ¢- ·ÃZ2±l92é ,x¬FÒ¥GPc îʯ–©Ï?º ÃÅfë7»Ï>ñu-q×Y<4›§ÅH¹b'ú…H5ÄZŽT –‹TÍ|¢MçÈšcõXÕ—e½ -!ýS×Yë°fxç I¨´ŽÆÌÝ{Ar‹bt̸LXP¥;ô £öùä-º4Ï¿D{I½ë5E\+£-@)¿Ÿ¦˜>ƒíhx¾–ÞOâ'Uþõ÷`]y?åÞïÃK™ÔW:· ¤ˆ°÷* i†¿Ñ¦íH¤Öm"úÖm")qL|™
b’Æþ‘ûx·ø!î‘@Ý Ÿvà˜ÓŽÖ=ÞîTK[¯¤ æÜB\¤ ×[½b¹Óëtg6Oˆ²0´ˆ¿¶Ó;§_2‰B£…¼®_C¬eýê°œ~ ¦Gf?„½p¤Gš9rx», Š&GþŠ-P`$8ØòT4kjU òý¼ÍiñÙµü4·I;2ÃÚÁ
hLDæ¸æ¶7bmsÛvý%£eðà”0¨$E pÔ§î3âPMŠK <ŸË*s¥ - -gK Áçóþ\9heÇ÷çb¹|̨}/é;SLmÑ™ûö C>ìYvwÅaZÃt¯Á¹ Û?¦‡^wì§êÐ}H.ý· ^£æþ7L£ïœ-ÎÄÊsýÿßXÿ rPÇé4]ø‡*
i¿Ö™ôL¡´dMY4d©Jfxÿ 2Zß endstream +xÚ¥ËrÛ8òî¯PÕ F®Š8x|Ìœ<¶âx<ãx#gwçu %Øb…"µ"óõÛnP¤Dɇ”ƒÐ@7€~Sr$àŸ ™(ˆR•Žâ4 Œf4_‰Ñ3Ì]ŸIÆ™x¤I맇³ïßëx”i¤¢ÑÃSg¯$I"G‹?Æ?qp;ˆñÕÝl6½œÜN»žÞOdš˜t|q?½»ºùÏùDÈ€*Äø׋»Ï¿ÐØýyªÆ×ÓÙù_?ŸM Z¶º¬K¡‘§ÿžýñ—-à?Ÿ‰@…Ñ tD ÓTVg¡Ñ µö#ÅÙììŸí†Y·tð*¤”ŽÔÀ](Õ¹‹D&MÍ(6ii¥Ý]Ü<Á‘âd\Vئã¬x®6y³\Ñp^Óp½¶óüO!Ô¹ ÛÅ;L¢q³´%¡}š]Ì>\HÂ}É‹‚† -µÛÚ.hîñ•Fö)Û
o´- [×4›â~ÿ>” Þu˜± œ¹žhÂéO†A¬’˜Qªu“Wåá)&¸r4ÑQ„Z˜ÑDÊ 5F¹Eîˆî|¡ˆÆ9,×±¿,óù’ÀyV[‚î@pt{n‡æÎÐ#ãйu ÂVuc³ÈR”˜ñŸÂ¸øÃcûAläÉS12 +ž¬KÉŒ³²¸Ý½(va]€ÐAÊ°í;Ó#ƒ¬7ˬ!¨+ÐågÈ=3´ó¥q/
§jãÕj5ùc^äÍ«_Ú, r·À}HÇ• +n%„7½úðŽüžØ5šeAkgI´féx¯¶ÏËÎ:˜7RÑ‚lÛT+xµyV¯„SÛƯ¶„4yè œ¬+S: +i`p`#eK¢PZÈ#&p& $2hrÀ¸{$§3¤3ÆtuFIj4ëÌûZçßì>_Ìh¨¥>ÉX‹tÈYOIAKC©â k³V·j’ +ºH +x‘RvÉ]¬ã>¹År¬–o:å-ÅëzÀ+GA(’ô4s-Ö +Õg¯ç˜UD9ˆª—ý²ÂÈ™£Á§ (ú¸Ö ëÈ°©¯Y±Ý-Fз¢Ö½…=Ö
©Öý—…mmîÄÑÁLõ÷wSAͧH9BÈ‘ „RÍžìQ
ˆÚ’¥R©dñ…!gB¦¿}hÐ &ãß;Âúðqö@hŽ´Ó»‡›‡ßhvÇLd{ûfu]Ís²EØgõ”Œ–•;鎅 í?þy6ý„‡UÝ“ÕH1ÕhjÔR¤Ç=ÙìÑ£ ¿ãLJ]J»k h$ ¶:¨™pk8 CÉ$B Úr0¨ó&ÿjÙ1_‘ea÷ê| ´üÚÝœ‹Ø!˜ý©P<4&PRç“ŠßÅ:®ø-Ö.ƒí’„H&MÁûŸ$é‘HvU"0Ö²Oò3%è’ó_E)ædž³ÇÂOuSbé.1½[d$ôz¡ã^Ô çÂÚ‰[¿¤4\µE ¥1Ù¦æʧæÒy +7 +Ú'{‹ËmÒ€õœÛ…¥g±2ÿ]Mcs…Œ•F¤ænñÞ: ®›Š/¨Ož¢³ÀŒ×›ü+ou¯Lkéãw3®ÈK#ÊÂÝûPê–¹X‘ý8´¤Ý:îGœàÈkj_¬Ó\M~~½}ÛÀ‡ÄA$„OB4=oÉ¡)ÛÌÙoio9£N|©
¨·÷KÃyÝî‘Ôe|À)ÃzÆÂî +Žc¨¶Õ¦±~E‰^<mö>ëtC`XžŽÿM¹|»¯yA‚{»&ãûÛËÙ?¤¤a¦FœÛÅ.‡ž ÆaÝú˼–òGê°Çc»Z;' ¦x±Ù±´E‚8 å—ÜÒõ —Kï+Ãð
¹ì`Kµ+ÿìÉeD‰ŽX,ŸŠìùÀ8ýJ¢ä4[ i€®H¦åG‰ì³5s_%DÈµÐ¿¶ =Ó¤óö]ìݤCtß7 ^è +è]ä]Lý¾µÃ +¾€ãˆ¶¾
:ŠÇJF4¼úÆ—ÊÁbA׆]ò¯E‡¬ë7éÞxM‚Œ_Êê¥$2Ž•%ð‰¾ä®hñ§÷—4¬ŒN â4IS
[.H +{‡I³ +S¦ö[Ê[I3 15‰O Ž„7„úo|ƒoqN|‚' ÷$·CæD¦ýr±È7vî~ãp`M endobj -2536 0 obj << +2537 0 obj << /Type /Page -/Contents 2537 0 R -/Resources 2535 0 R +/Contents 2538 0 R +/Resources 2536 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2502 0 R +/Parent 2525 0 R >> endobj -2538 0 obj << -/D [2536 0 R /XYZ 85.0394 794.5015 null] +2539 0 obj << +/D [2537 0 R /XYZ 56.6929 794.5015 null] >> endobj -2535 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F55 1321 0 R /F22 961 0 R /F41 1218 0 R >> +2536 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F41 1233 0 R /F21 950 0 R /F55 1336 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2541 0 obj << -/Length 3085 +2542 0 obj << +/Length 3245 /Filter /FlateDecode >> stream -xÚ]sãÆíÝ¿Bo‘g¬½ýàò#}rçz¹Ôwœ¹¶I him±'‘ŠHÙçüú ,EJ¤®éu<c.±X -zP"³VwTJ„zJ0™&I˜Nµ–ÀÝý¾/žòµ+Q&•M|±pWðb,ïËC òýº¡%=õà é ‚5Á?º—û*÷K–<Sn÷Ú¬±"•2 r£íÌLnkÀ¹{Û¯ûV‚mÌ´Ì7Ž@dÏÔí ‹U¾ËÛ i€1wôD‚k†-ª²É‹’l‚ÂýÜ2o˜hSÑóž¹ïk·$HQ‚Sä˾((%U†ÝPÒa½ T›œÞáV0‘øMækzëíÝ€.•²Â*P é’° P¥…,¡Tð°¢\‹¼Aý!ùf•74êÛ!ÞŽ,ÒªÚ¯|ÏbâžÅI®ã„éBÄ8›uºXãY§ÅòYç$½Æ±Yò–i€eWW‰2IXÎ7ùõ&ÓºxD×ø,–B‚ -Œ‚R|X9¤£}xkmX ðŽùŸÕ¾ô²élZ45a5ņ¤„krŠdœ Ëܧ P0ŠñÍïEc¶€Äp¯ªgfÖÐ|šr>1.˜¾XTQ³~ükŽÅǾêZÝ<TëuõÜÎ{'[»š3ÅMØ/‘‹'×CdjùÇæ ÐjW4/ôV=a6ì1ô< 9þëã —ˆUª'ðO˜$Š±Hd©O3Cñ—*a³ ²y‡Àiø¥±°©ÌZ.¨$<…u‚ç*=[S¸cJx[å5
îwÕ
•H‡„s ã(¥¦hª$îÃý `jÛýýº¨WÞ5\ b?†… è8ðX,5†Œw‹ÌÄGÇZ/&Ęîmb…N²øW~—˜öÓŸVý]Oý|¼ -5‡IQqlƒ-BH3 - ›&ÂÌI>Øæusuʬ¿ªkŒ±¤2®À -pc£/P`‡Â¬VW*:3u ”g¬¿, -úË8-„ô‡¨^YD[ ¦½i{<›étõó¿J+éÔxä#í ;D :Kغ£ž‹1udd€Njóðgl%á(6_âëg,ÅHÁPÐl±|²õt„‘®žªÖÙepvœõJ–èì—ñ4öªð“ŒîÉ" ø¹ê uy hzì`8^Òøp|
‚´ qÕ¨é÷ª==Úu#á÷åvl‚²|a»Æ-ÛbÓèÎ]BB«G¯ƒ©‰ÈT°8Âöeëÿ° -‚J÷LïnçooþI@²O¨(kB(6Ûj× Îˆ3[Ë剧NÅõ¦'—õ¾Fu¿Q,“£ ‡~oÞ}YCAeÂ… Í9&+cÃÍ L n û´‘‡Y(èŠÍ~C/¤&Pçë‡ ÉM‡*nÍÇ+Œçï®iÐ×’ª»ïV$‚Nƒò¹1z`#´Ø+&ž}ÊÅ)nÿ ɤ‚ù´7×2Iœ…–›ZÖãK+–‡P®ýÒßM -|ŸVQŸ Ö¬†[Ì4ÅY*Ï°3ƒü$òóƬr E˜g‹ÅXEÏ@†Ì FKÈb çNaþ~ ÀÛ|—oðίjl¤Z ãAATIÍȇÕ|zqˆÎ‘ÅòO] f6 Ÿ](ï ï³ù›BªE¦ÒÁ -ÀÕ¦h\ò†¾[ùº[õª]EUðQ HÕ!¸læ¨;ƪ{×YŦXç»Ó[ÛÓ Î,tZ÷c ¸»õÇÊ«—¿¸ú/C¢Î ˆÔ– J–P³rÍrÊ9¶`’ö³~ú,d$Ø·ýT+ü%Έk*8î!¾²ó®ÙÅwÍË»æ c®y–e뚧,‡\³ÇòM[ŽR‰üvþþ# É ¹-àzŸÚp˜<´ -KÏ,š^Óô2¯™ -: kÅtÍ-+$ëcµ íF¨jd8ÿé:‰. |üø¦¥®¸"²¦¥<ªˆÂGòãoäe¸GC9zC8 º Çk§GÒïá«_¨XÅmÑ5þUÝâåÏ|SoqÎ|Q' ïŒ rFü¡Rø-IÑx©«²>ùD“MlzN®çD°^üCƒhm¢º’}U\^ëíªÕ}Pp0Ϧ½»„Þ3lçøwí%U×°—c¿ç™ñGX»–íõÎÿÖëð«¶(& ë+u‡~c -¨l|êHRhëÙÿ(y¬hendstream +xÚ¥Évã6òî¯ðÍôŒÅÆBp™99í^œ‰Ý Ky3yI”Ù|M‘j.vœ¯Ÿª@‘%Ï{Ó} +…Úa~Îà??•ÏdœGIà+ÆÕùjsÆÎ aíÓ'œ™Cš
±~Xœ½û(£óÄOBž/ÖZ±Ï☟/²ß¼ë¯_?ÜßÜþçr&ó~ð/gŠ1ïîúþ—ëŸöõ2Þõ§óËOb• +z >%0‡e6û¶P8_ü|Hì`K‡4±¥l™$~`G[Þèm}ÉcO¯ÒVgx+y‰ã:}®jœVk g áZ.9çžp3tüˆÁn¡”oÈh€uBFËÊè'³å»J
09÷ãDÁíY”¶-öÙâ<ðã0R§ùê±&£í?âxÌÙ\·ÍåLŠÀkŸ4N2½N»¢Å ‹ÅO´\áØ5„¶6bÆs"ñM¿âäåI—8ˉŽCYUå³®íYpéè¦8€™k²ó‡ '·ë=û€,
´ÉO˜ˆ0üD)a–o¶î$"E;‰(4;À_U©¯` :ÅjÇîd +Ïöà—§|õ„ÓUÚhœÑñ`Ë?ó¦ÍËGÓaᣪ+2BM¿®³9ér¥ÍÕ$‘Ñ ÷}ìÈ&;Q… °V í¥?º_†(#ÍA]cg' àC"Æ”BpˆRÂÍN¡ 0N8x–Mõ¬ò íQ·ÂWRE§ÝÂë¸[豬[ؾé¶uÕV«êÐ7 )œf®Çšànä‚ÄdÙ#ßÀgxŒt€X²KÏiÑÑ"z„!ú£.u>ÚÀÙ¢ž) ³8Nݳ^~–Ýf©k-uû¢{Fhe†~@Â9E(e´Â¸ÝQ>PPøa FiæýÎÃ@3îãÚk»vºš&_DÉž¿Á/ÑúHf©=Úc·Ñe;„hü¢ +¼LU7G•XÅ‘¯ÞŒmC¬ãJÜcY%þ~,þŸÜ²ÿ‡[NÅÿÑ–?w¹ñ~ §Þ¦Êô?@„ôæÝ–\TÓ˜1Ë]Yj#™´6C…^ÕµÛÎøf›è³*ºÌº/³Fjøèˆ ‰¼ÌrÈ3òªU%óþ}© P´O@ +1( +ê³I‹¼}%là˜•AŒq@yÍ œ×HÕÈzD¿0·'°äéfž6Ò„»OÌnÍ”—MKWb·MÉé‚:4k°²ª~EÈ.¾ q˜@t¬"êðë¸î±¬®'2‰Ä‡´I¹„Çê_¦Ÿ3 S!rqš¹ k‚»Q&ajR&Ô˜½ùV¯òßÖ/3NRgÂkªÎª½VX°š#²[‚e‚½¡Â`÷%`nAZçm½B$ÝàRV¹}ʪÅe²÷ç<£ÏÓ #!Qà‰p¹×;Ö;—WÄ~dŠ§±–÷6½ïƒ¸£(Ú¥¬ aàf¾w9¤ 60É Ïm¾.e¯ºƒÜÙ|29À‘vâAxÞôֲ #£•â?uX©ü˜±xJ?öŽ3“Ô˜2Vãã7ã[uõ“^™n4‚ð>±¼ƒaõ”š¸dMðP„Yãhƒj±MÁá%K'p»–¥-µ%$ŒKÚ Ë1ÉKPŠ4³b¸œ0s’»qïÜeŠÆÊÍ!3… ˜ìNÕ ÊW Ä‚²¤[È&D©˜/9—ãðäj +èI÷ˆýmG‹Í•gŠa +£9óq·#LZ Åo¸Ö ·ã°¬Û™¿YÀŸx¬¯q’¯]_ã±É¾Æˆ³÷TQ·V'0€0($ô þÆëëc³F GÍoýç¶ÈW¶ƒÐ>ÇÆETº!²«¤
tPé±¢J°Œa\Qãx¬jH#7ö7dJù_úêx7£PJòºÕ8³ÙJ첕„Q¶ÊÈÒ±]'˜`“¶6‡0Ý÷ƒn@ÂFg YÀm^iS!üa* ´-CC‚V܇œM$ –Ï !>â3p‡ L‚5Ú’Ú8 ‡Èƒ“˜åR̾ÝvË‚ÒzÄÙsélò?05`iÊ¥ M0ÏM^v½‘ŒŠ•1'ÖÒÁ?‚§¹ÂŸ.Ùƒ)¹(G¨ÂQ2ZM_—2~ 1qÚ ±Ž»€ ˺€fÊ@~ 9UŸª×º|lŸ3 eO3×cMp7îaÄ>‹D2fo/ó`.F1Õ•¿åÌB\+ƒ1Šì¡1„Ìô•œ6Jqè3Q6l]ÀFh6G† WÆp9hfÄ>á^•°êjÚ±-(íÄ &eåôÄœ¸tñmWo«FûäØá8®/Æ«*æi}`Їeõe1¥/”tá³®Û×)}ù&k=Öo#máÊæÆÚ"úNVBýÂQ:ÖCWUŸp‰˜ü³ý¸Â‘Zæ‰k™ÈŽ*†½¤j]J Hå0Ùä“ݦkZ$½¤-tŽ+3ßu×cj¤‚œXè'ÉØqí^JÀiKçúå m?l9£#*×ø7Ю¡@‚ +J†v+ì¤iq!|÷]¢#†%BP 52,!(¥‚Í+Ãhëë_Ÿß¹ÿhÞ‡¯tÿå +F‘«` +mº¨û:Ê!"pÎ'9ë±&XG#î ŽYÃç—Qʘée÷øØ;'Ë™ß÷“{ÅŠ=€yÚ&c¤¸¸½»½'/öåëâöËý|Bíá +í0 ñ£²ºH‘SŽzøT¦Bê;î.ợڽ ‚ïÛàÓiàý +ÿîînnpßJwÐÏŸïîæs M¿Ç,ötö^Rìó+ˆ¢™òþäëÝKª¢fgÒž +ÉŠnù±¬êþáºÐégv3¸ oS•í ïnAý~ìÈvRúsÛ81ønNÁ`ïP¦x¤zT +2Uû¼Ó—%¦¼ =M
[Õƒ ¾Úó)£Ët¹—1(ÈvËl¢Ît¹¾òƒé?Öû§ÿûŸvàDÇã#^K“ãsÇ”‘%WrŸu¥€ŠE4Áûí„uendstream endobj -2540 0 obj << +2541 0 obj << /Type /Page -/Contents 2541 0 R -/Resources 2539 0 R +/Contents 2542 0 R +/Resources 2540 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2543 0 R +/Parent 2525 0 R >> endobj -2542 0 obj << -/D [2540 0 R /XYZ 56.6929 794.5015 null] +2543 0 obj << +/D [2541 0 R /XYZ 85.0394 794.5015 null] >> endobj -2539 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F55 1321 0 R /F22 961 0 R /F41 1218 0 R /F53 1313 0 R >> +2544 0 obj << +/D [2541 0 R /XYZ 85.0394 143.9886 null] +>> endobj +2540 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F55 1336 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2546 0 obj << -/Length 2027 +2547 0 obj << +/Length 2985 /Filter /FlateDecode >> stream -xÚ¥XIsÛ6¾ëWèÒ)55Qì$Ž²´iÛ”i:i´DYl$R)'ίïp¬dÚñÁðð–ï cø#ãX Ì GŠ#‰/w#<~€³_FÄÒ„Ž(ìR].F?¿`ÑX!%© /Ö ^1ÂqLÆ‹Õ‡`zw7»¹~ù~RƒK4 ÆÁ›éÍ»ék³w7Q4˜þ2›OBIÆHi2‰ƒ›é›ÙuxõëìêÕÕíÍ‹ÉÇÅo£Ù¢Q¬«<ÁLkõÏèÃG<^
¿0b*ãÏð#¢ ïF\0$8cng;š~ovNë«>0¸ˆ‘ \ŽCAQ,ãØFX -o¶Ü˜åÞ˜ü˜Çrk/o’•Yô„ßéè¤þØ$—R¡HÆô|%èR=_ *mê×"OÁ…t›E -YL8;/»¡òïLÄ7äPOúbc3ª` ,ò -Àì9µ^h]ûN¹·¿Ëì!OWϣNJ ß@¯Cu=G¥õÿ”>ÀÅOòè¼LGä‘Ù/¤I³¾Ðù>]šP”² 6X‚2¥Y•›â¸]™u
ü‡Œ²;5xš -@³;K¤†´d"^®ÍV^ ¹'M)ÓL´2Ú{éêv¢Ú]5Û¨ÏÖª›ÕÅÀè¥sš!F¢¨ŸÐé—d—嵺ÌÕª‚ë›ù«ÙŸfó´âAR™C#—5£öémæÆ0تÒÒµÁþº8æVtâ@Û%iéál—TË V¦3>{tM÷†Fðµ„AhC0<óʶˆÌšX‡§ !$¸h®´—K{ÝÂÚÉëîn Òþ=‘-ªóõ8¤ ),¡²2ãµÂ³÷Ó7w¯gžr –Q›mK²¶Ûâ³C -ÈäÝÎ`gZ|i–m™Ž»Ñ£Å1·EXGÁ~›"`âÑ@ƈÅRXZ` ¨6Fx唺žOÍBgk½p}e(ïŸH:ÚH@$V®%¬òºx, L7è‚6HÄ\õCYwçW KÐOÐ."å‘n³z¥2¸L—ÉQû’QÒ‚ÓWGA™jZØÜ×Â(’0
Z£´nªú=ÚèÅ}Z»HKÓq‘Ÿ
F}¬ÑüÑÞ1i¯W»cÙ\·|óžÆt x뤬ÒC3-˜:_¯ötk˜y#!©Ãý „˜!7äÔz®h&§,,–I;=m‹âSÙ)¾¡‰! ‡åªÔCè©hšÂà MÓΰÍðvn"ƒ WÏd¸¾ZîjRY\H•½zr=?3}.ÝŒâ -B¶Û‡ª) -51 -f 7¾í¦—Ùz“äÇdëKrº \ðÉ×3qUàí‹+ÑcÆ<ü8A” ÒÔ ï\ªŠUÔCoúnñëíÛs°¹ª ‘§6.çO0†ìl=º*òÚavܵR9b\:gq @d<‰ - mßø*áÔ/\îÿ&QÓx±Ñéù!Ü|t«Çfõw³²ã™` Þ+D‰hzgv°5É3sr˜[›H´\×Ù6ÕÊ8ûFÚ×Ï}'`õÇ] ¸qÁÿþ†Ü~-çÐ|âç>¹Àc¼¬ˆSJ›FD4T]°XOd‘G÷ é±endstream +xÚ¥Z_sÛ6÷§ÐÃÍXžF$Ø>9µšK“ørµ;×^ÓJ¢,N%Ñ);꧿]ì"%JÎ\“@Àb±Xüö h9ˆà¿ ˜D$™Êi I3˜®.¢Á̽½L3òD£6Õ›û‹×?èt‰,QÉà~ÞâeEd ÜÏ~¾©¸Ñðæöînüýèýø×·ãÛ«‘̬Ɇן>ooÞýr5R&b ¢áÇëÛŸ¯?Ðا«L
¯ßŽï®~¿ÿñb| Äj‹.#2ýyñÛïÑ`'øñ"v<ÃHÈ,SƒÕEl´0±Ö~dyqwñïÀ°5ë–ö©"6V'ƒ‘Ž……ýû&E*%¥&‰V:(LÉ>…y*TØè ôõÆ´(¥63 ™#™åMñºšÏë¢9TŠ±t,ÓA{ç#ùU€ª½ÎNv¼+š®&‹†Í¢€ŽÍœ@4T©}^”ÓMæ4òG±£ß¥_]Q;a&Ûɲ¬Å¬; 6ù«Z€XjæM±ñÓy³âÕÕHG~
o +‚IEªt G—"3F¹“<—Ë%Ð¥Šd€¶\O—Û™Áý¢–ØAEà[Ü5Õ- ëªé2ÛÖž‘; ´uùÀ,ËŽ¢Ódøn~°.õöì0_{9ærŒÞR[=6eÅ yM!'<sÔ=ì¤(ÖdQ(×+êGèÌŠy¾]6ôÃÝ´Ÿ•Š×Õ36âÈúâid„}É +Í g×} +Ò¯¯¨uW‹fŲ h#RÇÂ%¤¼^²²=|ù–ækÔ.«õ0ñ‘Ž 3¸¯öSìë>G&òþn•ïÚ.q•û…G HÆ@ùXÕeSmvW`¼Cí¢z.ž@Ø4 +ØDžDžJD¬“ø䵨ΠÏS9䕽~M*ã‘W®áJžòåì ö&ÂÇYÙUp ØI+%]évIÂJMÌ𑕉EÎ4ç´ ‚˜Žj^mh8§ßx¨v¼O“R± +Žqt•œµAÛQ,8Åb§-þökeP nK +ì£ç¸)9(ã^EC @a=‡bõ¡»"õ¡_"õaÞÅ^ºQ*²8¡œÖáËzhØØ??P†“¢\?ÐДî„q
s.{„‰|M¿‹/°› Ð0Zo§Ó¢®©Â¤»zG\Án›ývÞ_fÚc¬-Ð >¶×;ôh§å+ZÕŽ¸„ÏwõwÔu‚<—uÑÍ,üŠ¿ +·]u 9ë6¹vé–“K¹âA…;ÇuÌëW\ÎÎi†s&Pcý°]놦(?‹Á·-—6f4:ÙÑ(—›Ž·`N¨f·óKÁ<.w—nãdx¹ªB÷ù’¥¹œ…±…ïU›>Wp¹*/ýÛcû7 § “Ú ]wÛr6ééhfW䛚٪u³ð?ž‹âßÇûáî¢Ú2}:$n²\oÁ 3mƒ– åÍ\ôâ?Wx
°ä[Î93l©ï𵧠Hçk¥u^hV Š¹ +ƒ( 0 €ãY”à‹¨´>¥ÄëíøvüÓ5>ÝÞoˆÉûñ¯wÌ A#âðið2ü.{"¡]šP²¬kh6ö¨Û,“L¤±,V«GLÕÜëXæw¾]î}§²)Ù™PÓæ4T7r0TÍiŒŸâ2ŒØ+!î¬#èg’…x¿†â›<Ï¿)ñ_Й…Ò<¼pÑ‹až9FP¶ etÒ…qÝ@p'“ã+<nÎÿîƒ;õmاsú!Ì™ÖI¡O©Ho^èýÉÂWÙp
ņ ¯N<Òk™«>ÿ}¡Mår-·4”JHÉ’/ªûez¸i +ü¤Uç7õDÇ›v.ÒBY‘e¦»)ÞfÏb +ù+÷?Vß:Ç4è„¢àÀZû‡˜6ÕiEª—uvÓ ¨£M{ÕÙ +í„¢Ö<6å´Sƒ°?жàꌱ½2_>Tð…«Óêµ`—øåã¼z[TgÔë©^Tï¹M÷ê=Ü´_½íMOù„Nmò"÷^ÀçUX1zßWUãÜ!Vx¢Ç+ãWÈ^T7õzÉ;§,ʼpûÜ‹C|ó\QüG±–…O4öéšç(“œŸ¦c~*2ô¨Ã„Þo}¾:Ñ"…ê焯üéàø4-² ?¢µÃ1ÊJëC•Sf·W«–ÆòìX(‰Añ¤Hp2üXÐ#–Œ
£ÒýúÅáõ y(½À²RØD¥Ý´ð~QôI ‘V¥~³š·˜%‘ltX&-éðWŽMŠß‰é7$ Ô!ˆL+ çpŒ_‘ Æ4ì¸ +Mg}{&ÿxw;âÀ ökíA\þþÃÏ7c SAј
+:̸ûU N2J¥ÏbÎÜ8pU2¶‡êe[½qË9ŽBÁ7%:ç +Ÿ=Ž¼M‡—
dûçh– +ÜÀ„ZP0åÿu;¦Þù# Xݽ‡Êþ4øƒOc¸¢ê–¦2ã(‡Ã‚êÛ“e„ø:=yTàõ·ÿhŸÆ©ÐöÔߨ"m} +•!M|üùŽ endobj -2545 0 obj << +2546 0 obj << /Type /Page -/Contents 2546 0 R -/Resources 2544 0 R +/Contents 2547 0 R +/Resources 2545 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2543 0 R ->> endobj -2547 0 obj << -/D [2545 0 R /XYZ 85.0394 794.5015 null] +/Parent 2525 0 R >> endobj 2548 0 obj << -/D [2545 0 R /XYZ 85.0394 573.4038 null] +/D [2546 0 R /XYZ 56.6929 794.5015 null] >> endobj 2549 0 obj << -/D [2545 0 R /XYZ 85.0394 309.4358 null] +/D [2546 0 R /XYZ 56.6929 364.4689 null] >> endobj 2550 0 obj << -/D [2545 0 R /XYZ 85.0394 249.0624 null] ->> endobj -878 0 obj << -/D [2545 0 R /XYZ 85.0394 211.9585 null] ->> endobj -2551 0 obj << -/D [2545 0 R /XYZ 85.0394 179.7548 null] ->> endobj -2552 0 obj << -/D [2545 0 R /XYZ 85.0394 144.9999 null] ->> endobj -2553 0 obj << -/D [2545 0 R /XYZ 85.0394 81.7046 null] +/D [2546 0 R /XYZ 56.6929 119.0358 null] >> endobj -2544 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R /F48 1238 0 R /F39 1161 0 R /F53 1313 0 R >> +2545 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F55 1336 0 R /F22 973 0 R /F41 1233 0 R /F14 976 0 R /F48 1253 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2556 0 obj << -/Length 1971 +2553 0 obj << +/Length 1715 /Filter /FlateDecode >> stream -xÚ¥X[Sã6~ϯȣ3C´ºY²úƲiK»(dÛN/ÆqÀmbS_è¯ïÑÍ—Ä ìt˜!’üYçè;W™L1ü‘i(PTM¥â(Ä$œ&» žÞóï&Äaæ 4ï£Þ¯&ï¾erªTLW›Þ^ÂQD¦«õïÁ{D0šÁ8XžZ|˜_|¿¸øñ·«åb6'’Pœ__/– .Íiˆ`ŒƒOçËÏç íÚõLÑàü»ÅíìÏՓŪլ¯=ÁL«õÏä÷?ñt
‡øa‚SQ8}‚ FD):ÝMxÈPÈó+ÛÉíä§vÃÞSóê(p Ê ¡ƒ’)!H…! ð*$e†‹Û‹›ËëÕåÕRŸÆ¼ÓQˆ§s* )5à<Þ¥ëyò&'E¾q/ÐÞ èËH/j¼AV³9c$¨ R=ÀAõ’×ñóLBÜ5µ]Í‹z —îâ¼Î’ÊA‹Ä#zR,¡\:¹FÏíG4ÊkWä`Lï›2®³"·»ë•íŒ©¶{Hƒ•UÇ=pªe•Þ|:g”#ÅŸÎ[šaßǸ¬@üœÄ¹*üê¦(õ€.@Xül§iYÎH¥93•A¼-ò{ûÎSV?XT¼ÝÚ%«Re'Yžl›µ—p÷âVk8W"¸ÜØ—ó¢ÿ®¹-ªÇ4Éôƒt}fÙã}’9eH„!wô½Këäå¡}âx ÐGQ!B·—Ö@G–9~¯íL Bÿ®ÓMÜlá$F˜sN")f9_uú
œ”E}V8xS\ø‹Äsòº·Š½Š^5·q–Ûß*sÇujgÆôζpð:}®)µ;7ɃÅÕ¹$’HòV§2_'èïôeDƒÏIá€ÚÁFvƒ¡b s—åk½Y5¶C ™C:]c{X«®ŽLke „ƒqVŽ›ºØA -CgñOqe÷LÒªÚ4[4"ᳯâ•Jbw€»Tÿ2w>»V¸_gý¸µˆ^OŸ ·Y’ÕàO„àÌ%[ ´I*‡ü=OÀV9ƒ×ºSôŠ T0!_í®L¡;¬ÛIBÄ4”©Ë#uÖ‚æ}”/³‡]G‹Òrçû"…@XÉWDzЈHºg*퉼.3¨-&š’ªMß»aÕìvq鬩Rz>g6ÍŽ²Ã¡ÈBÉ{… ê; eØq): {HÉ7ô}•iRå˾n2 BV®Eh×'ZªˆÕ»x° Åt(Xé )Ž! -#!ÆôÝϸE2ô-RU¸Mu¡2#WÈí62É4©³/&ai -‰ ý«WÐH’QÄØ°7?F”!E0ï‡Ñ~×>çp·'rлß,VŸo–Öi~ž¸Ùül¿Áýï¯Vƒ:j½¸Ÿ| íʨëvê¸nªa&"Cÿ~[Nß+ÔØm ^P>eU:NŽW×±c#õv±°/Ÿ¼½9cKJïãÌ pËà 9ëõh–)Úíc³ S}Ï—`Œx3¾¿\~°›(§Æz—åÚ྅KË7éÆ‘'Ž‡OqÞÄÛu ¤#(»â¤—0˜@¿>$âüóêû«›S X·¸Ì¡^䩳èí ”³ÕE‘WEYgÍ® ] þJ gçRÐö‹òl~ÀŸ‰
}…ŽFHÛ¡,]Â9Ôaè{0ÙwY½ÑÐ<Åî1Û¦F€í=(•]>î÷#®·Ù:«ÛÎ 6m¹7
4ªu»^ÅöØ×m7ÆƲ"nó¿¿|w ùá*Æt«6š_© õ·á•Òä‘0:¬&îù¡îÿ:ê#endstream +xÚ¥X[sÚF~çW0Ó< ›½kÕ>96N '¶kœ¶3I X@(8î¯ïÙ‹„$/0m'3aWþöœ£s¾sY‘>†¤¯Â,æý(æH`"ú“U÷çð·w=â1à +4l¢Þ>öÞ\±¨ £XRÙœ5d)„•"ýÇéçÁùýýèöòúϳ!xð
ƃ緟Î?¸g÷g1 œ¿Ï†$Ž920‰—·ãñèbø0úýîftöõñ}oôX›Õ4`flú«÷ù+îOá
Þ÷0b±ý'Ø`‚iÕã‚!Á«ž,{ãÞoµÀÆ_íÑ+SH(|ÁUÈ"F’Qf}q£$«õR£I¾B¯0f¯¨$›{sEiã8î‰B‘ Ή×ÙÙa1(iaV|à%½ögIãlÄÇÌXlŽN³¢Ð“áwý<×Y@“„e ïãГÍQ”º¨4j§ð Æt OÞÒG&±ð¼#Ú‰c©Šýá$›Xb wdÈâE\@hA±Ô½G[ùz“îàB0Q”Ê Gµ?ki3\†,BJn±ãÑÈøüÃø. C*ᢇ"gç™þ‚Vð ñdq“< +©XT6½½¾½tŠb¯oºJ³´(7I™oÜ£=Ó.tÙD»G “l›,ƒ>WˆJ)½ø ÅŠ0x¸ºp©`q@ 'ˆš +]ú#Ží²ÉvàØ.=Û›0/ /`ªäLOÝ6õ\! Äj¥U?ë«—h7©f³mdX¦ŸÜb¤¾¾ç³}¹4öíØn&yV&вy'¡³ü©Q +#-´ü£ÆÕ¨€uB +eðyAMŠ¨ñª¬@•-jFˆ&Û*Ïg0bxÇmÒ2çUÅ +ýŽ‰No®Ã«WëÒץ̌ÝÍúS“¡ê U}Êüoõ:‡Ø@0ŠbªN°¡:† +eÙ0;T£Žª¬kÔK•¡ÕRy•[§ØÛ'&(4S«ôÏ°Wrp‘l‹êëAË~‚#ÄU=SŸœ%ŠD}ù³þmV“[ºÀaêk"<q}~œ‚•¶ì3«tæЉۺšçÖɲ6ýyhû…8¬WI9Y˜¤·"Ò| ô endobj -2555 0 obj << +2552 0 obj << /Type /Page -/Contents 2556 0 R -/Resources 2554 0 R +/Contents 2553 0 R +/Resources 2551 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2543 0 R +/Parent 2525 0 R +>> endobj +2554 0 obj << +/D [2552 0 R /XYZ 85.0394 794.5015 null] +>> endobj +2555 0 obj << +/D [2552 0 R /XYZ 85.0394 683.4656 null] +>> endobj +2556 0 obj << +/D [2552 0 R /XYZ 85.0394 619.4692 null] +>> endobj +874 0 obj << +/D [2552 0 R /XYZ 85.0394 579.8478 null] >> endobj 2557 0 obj << -/D [2555 0 R /XYZ 56.6929 794.5015 null] +/D [2552 0 R /XYZ 85.0394 546.5386 null] >> endobj 2558 0 obj << -/D [2555 0 R /XYZ 56.6929 751.9581 null] +/D [2552 0 R /XYZ 85.0394 510.6781 null] >> endobj 2559 0 obj << -/D [2555 0 R /XYZ 56.6929 608.6139 null] +/D [2552 0 R /XYZ 85.0394 443.7598 null] >> endobj 2560 0 obj << -/D [2555 0 R /XYZ 56.6929 322.9834 null] +/D [2552 0 R /XYZ 85.0394 382.7282 null] >> endobj 2561 0 obj << -/D [2555 0 R /XYZ 56.6929 258.3082 null] ->> endobj -2562 0 obj << -/D [2555 0 R /XYZ 56.6929 193.633 null] +/D [2552 0 R /XYZ 85.0394 306.7766 null] >> endobj -882 0 obj << -/D [2555 0 R /XYZ 56.6929 153.54 null] ->> endobj -2563 0 obj << -/D [2555 0 R /XYZ 56.6929 120.0237 null] ->> endobj -2564 0 obj << -/D [2555 0 R /XYZ 56.6929 83.956 null] ->> endobj -2554 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R /F55 1321 0 R /F39 1161 0 R >> +2551 0 obj << +/Font << /F37 1038 0 R /F48 1253 0 R /F22 973 0 R /F21 950 0 R /F41 1233 0 R /F39 1173 0 R /F53 1328 0 R /F55 1336 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2567 0 obj << -/Length 2595 +2564 0 obj << +/Length 2420 /Filter /FlateDecode >> stream -xÚÝZ[wܶ~ׯØGê Á•—GÅ–S¥µ¬Dj“S×Ô’’èpIyɵ²ùõ ` -<eH"NÃ!ÏõO_„”Œrçì+„ -[7Û"›;GÑßõ‘ÁlòKóu¶lªõv‚©’$àŠ
™Þ Yȧÿ„oì±±N!ÁèØÿòmÇ~ „ÇÆ%Í[×A§²GÆ„qàúõÙ£Ëb>{´TìQ A¼éüñYC1-‘úº¬ñúȱíÏÉB¾ˆB¨?‚°ïS/e YùÿõÄsìD±>2¿£År,7(%2Žø0î4³qGþÿGd;šŠ½"¡ò+<k²bèœ=ƒ/dD„A¿ ˜èÃþÁç’ÄT'QBTÐß¿9¿~ýóÅÕÍÅûËö£Ý¦¾RPm‹éº ?àÝ€.‰äa[›kÊZ÷eÂk 2=^½-›äwœLÊ'ó²Éî×y³Åùêήã*&=ñ/Jy‘A;' ³»hpò1[ë˜6ÚÈÀ¢§vrH/©'ôЄ1ÎÜFÏ í|É9Ôx¤Ó*ÓÌ#é==d%ŽŠ*Ióò^¿ ª¢Kƽ›‡¼ÆµUò[6% ÁÑ »" ‚>ä±ó¤MÝm -ÜÀÁù¼•Ê¢ -óˆªÕá6Óô,òìâ²*õú½ñ‚Cq %@°Y#[hÀÿŽÀ¨Ž|”Ö"Ô«³õ—l}JL» ‹H ã™z`¬|¬g;ʈ-ì’¯ò"1Ê3¯©&v‚q? dЙr\^iΑw»ip¿¼Á’â)ÙZÒÍêÑÑ3aÝ!O5¸MV6Ž ²ß[ñ ³¥C]ÀÆR¨>ê¹6 xª/¨²FÔã -u Šq©ÌE÷~1ç_³^%åÆ -X?åu¦±èöx„K]9w£¼ÅYŸ ‡³ ¯6ucXãV7ukZb‰Ñrý¹æ¡ªÝ‰ìŠˆ§·=ÏS(1¡, ¡$ˆŒd›l(Ù¬ípÈß…ô©”%(×Wbq?g½7éêzt}g{ )+ -!§îmLºTî¶mܘ´Tz_? nCºƒ`¸KG4±e/„Å:Õ`Ëó2¹-¬…Òìvsq–Ìi.t E°_ó.Õ¼æ-•ÑüaNó½[¶š·œÒ¼·åd”fçf°©“{ç®›Õ*Yo;—Ög³ßóf -ˆÊY:o É¡²âê€1:T{Œá¨Œ1ò cèEúôž) Ç ¡’ûåj©&ë™z~ª-Гì -[S€VBŸZÕ¯¾ÚúTöº_½€íª.)£Ø»ªê:75€¦ÔzÔH•Ø&m¢6 ¨Mcç‡ÚPÐ Æ`ãàÅa¢¶l‡!{5Á^B¤b1àîk)á¤Ïì@U„¬mœÆl¡< -À™Öï4¿¢Z&sâCc¤$S{KGLvÄ5ìÉ YW¸¾Pð‰4¡Â.ã,:'&‡0Ù,ö™ -{s?kÚ],ößµwJ|pyôüùF%Üé[/Ý+h_z÷+Î -±éOëîäiô€Vw¦zú _«µ}…ÿ¦˜ •ö¥[èt"/}çñ -S¢á´iüêÎw‰uá+&ýþÚ”F§áZû¤
T30™\Ì£¡¹ç̾,¸ÕTI,Û#jpÚ¥§Nzòé!_>t×
d&¸V®òwé®UÄy -˜4Wk†ƒùŒ{;1VI£] -²…Ö£Ék¼ ^tÝŽÊ´‡¼H¸·"¡ Ù‹Ü›íuo´ø‘=ÛÖšŽöÁÝQÕÕ*sN “0Œ¿lÀM>or Øv -8V(SñPôö÷cÙÿ
ìsC endstream +xÚµY[sÛ¶~÷¯ÐÛ‘§Š n¬ô¸q I¶“ä–(‹SŠÔ)»î¯? ,À‹D+™éI:S‹Åb±—o0Qø¤"Js=ŠuD$er´Ü^ÐÑ#Ìý|Á<Ï$0Mº\?-.~|'â‘&Zq5Z¬;²B“„«O㟈&— Ž¯ïæóéÛÉ|ºXÜ|˜^N˜N _ÝßOï®o~¿œpIx) ¸ºûõêi÷—Ø~žÎ/¿,~¹˜.½ºº3*¬Rÿ½øô…ŽVp„_.(:‘£gø „iÍGÛ‹H +"#!%¿˜_ü§Ø™uKmÁ(áBñcp6bŒh)yÏR%¸pÖ˜O§x¨«ÛùG{ XÅ;&¤#˜%"BîUQUérògúò˜Ÿ©¤ ü½ÁuBwÖ%ŒD(m~swÛh¿Ûj›YUïM]î‘4K×éþ’%ã´X¦Hú`ŠƒÉ´b*!\)åÅ)ðfäfïÞ¢D01Â#É<7ñ =ëM¸–$Ññh"¡\:Ϋ_ÿþ8ûªÙnŠ:Ýi:Ì_ª:ÝVøñ¶,ªr_g‡m»i ÷b@5'<„.D)…pôŽ¨ÒºÎ¶©]jy…$T&¨ÚAú€b’ê®Cƒ §ÒgÎc¯iP¹Þø9ð¼§dàÀG oÓÚ¬Lmðk ê¿1ËÚ嶥=£Î_ŠrWeÕqv FâD‰‘¤ +^ÆCÙÀà¤\B¾¼’*$fLÁ #ÂeJÄ`£á²”/|š¬¿„Ñ{<ìÝ ÓHëI «U¶O—îÞý-#¢x€ÐÛ¡àäDIéYë: Çb¢OŽÅÝU ¸1ý±\¯á˜b•$±Ñ±Ø«±ØžH C¾ £Ù7Ë—ÇògßGí›ï#öúûˆÝ|qY>1%ŠQ ìŠÈðiò4°-D3DåéS:,€Iëã
§_=GZ<fE: ±Ïæ%B< ÄV&)‰„Ô= ¸žÎßÎnî7 ïšE_)L <<Â=°X" ¬3f ,`dð' •`ñx·ÏžÀM8áPÏ>SÊsO4Å +°i…‹ Lö˜´ã&-¯ñ{W»t™Y¹©÷–n†L; é¹?dv¿Hz†^ì£à ‹=CHã$cöqó
2 +ÛFGã…ó!Hï¸ ¾–¦°nÝR éÁ3 *ç:˜{xTè* ë$¿Ôì±ø»,CÀ›ÒF»=îRÂÆ{ÜÆ®µQ…x +ŸUý…~ÅîðgÕ&]½i$ jn‘oªMyÈWý…h§^‹NÒUÀZÅ‹Në% ½
ƒŽ* ÷›5 ¥°„XÇS@“*ÐHÏü¯…\œ-šHX–Û-¦4PóÌé ˜@Ÿz•C“ ¤PG^} N²í.Á½ + „×Æ{ÁQ@ÐÕ ú‘<Üsu¿û2yÀ6ïÆÊ6Ø–âmŸ- cl|diþ†×>.xÆ,Ù!WnÔ~µ Ë) 1L„?@ +QÃ%S@Mþl^üDÕ\ŒŽÀ1+Ìr™‚ gœ.‡)^Ê +·;Äk$eÚpC. "[©-Š ãéý‹K,QEŒ1 +p‘Õ¯"‚’Dð¯ô‹-Ïëhày lNºEh`u|v³Àr²Yï…'½Í¦Ûð4q¨ÌcþpQµ X í«Ã_Cvðú IìßãT£M7þÿì×þ}3Š‰H>|LÈ‹UPÊž“IuêBÿÂSÝÿÞIfendstream endobj -2566 0 obj << +2563 0 obj << /Type /Page -/Contents 2567 0 R -/Resources 2565 0 R +/Contents 2564 0 R +/Resources 2562 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2543 0 R +/Parent 2572 0 R +>> endobj +2565 0 obj << +/D [2563 0 R /XYZ 56.6929 794.5015 null] +>> endobj +2566 0 obj << +/D [2563 0 R /XYZ 56.6929 752.2803 null] +>> endobj +2567 0 obj << +/D [2563 0 R /XYZ 56.6929 690.9123 null] +>> endobj +878 0 obj << +/D [2563 0 R /XYZ 56.6929 653.1174 null] +>> endobj +1470 0 obj << +/D [2563 0 R /XYZ 56.6929 620.6102 null] >> endobj 2568 0 obj << -/D [2566 0 R /XYZ 85.0394 794.5015 null] +/D [2563 0 R /XYZ 56.6929 585.5517 null] >> endobj 2569 0 obj << -/D [2566 0 R /XYZ 85.0394 749.1077 null] +/D [2563 0 R /XYZ 56.6929 521.2619 null] >> endobj 2570 0 obj << -/D [2566 0 R /XYZ 85.0394 598.1922 null] +/D [2563 0 R /XYZ 56.6929 438.9484 null] >> endobj 2571 0 obj << -/D [2566 0 R /XYZ 85.0394 456.267 null] +/D [2563 0 R /XYZ 56.6929 269.4372 null] >> endobj -2565 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F41 1218 0 R /F53 1313 0 R /F22 961 0 R /F55 1321 0 R >> +2562 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F39 1173 0 R /F41 1233 0 R /F53 1328 0 R /F55 1336 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2574 0 obj << -/Length 3016 +2575 0 obj << +/Length 2823 /Filter /FlateDecode >> stream -xÚÝZYsãÆ~ׯàCªBU-Çs3k Î:^ycÉñVl?@$¸D$d´¬üúôœ88 -aA</x•¯³CÙÀ¸•v«È*B¡TµÂäûìql"©ãEG -!ˆñ”ŸÀ -C - 9-ZàŠÈÖG‹DR¦¤/\@ “Ü‚IТ‰-šænáÐ< K´x±ôZO¥ ù - - î˜ÉÏÂ#ŸÀc‚KÅ3ñ»Gñx–§ Ïò8N‡!ëµ †B9Ì–i—ŽÉÀr÷¢<hJ¨ Ë‚ºBµe%cÆÙž“¹ñ·úúæÖþ ù[Êhð·šAû[M þV5N
cž[‚Ƽ&X«)ÁßjòÐß2,ºµ*óþ¶÷d`éRb~ )\§Hqñ -Äke>ê3<ºPÿÿ©W0`I2m“]®q£ \Æ*«Óe<ì¨ÖÒQ!¯‘–`5-\àŠH× #ÉA=ñ~:Où|_4Ú¥3âê9Æp[®3“Ù˜wàÝ·…H%SJ#ï0X˜§HRœ¶Õ/ØÌüÝ:2%+ŠŸž6^Û' E › 8 b³DÓÐ -æ™"‚
«„T±´/Y›’Iå:y -;a Í4ú»÷tçÏ]ÇF¡éÏ©² D[ úùjË9ÕI"‚y¯:8”åxÛŸs6Þ÷×KE±“`$ -
nàÚÎs®ü;Z{î=Ölµ‹¬ÀL«âõçùªhœ"ˆ{kl$uq7Þ>Çý¶ü3rO± -Ó˜Æyª|ã F¶qžÊÐ8O•kœÃ ß8BhœÃ¸púÆyêM*
f£¶q¾`*™¿kÜe]uD1 -DzÇrEe{‚µ @}×~p +xÚµZÝsã6Ï_á™{°3·ÖŠ¢¨Ù§´›mÓk²¹Ú;½›¶²MÇšµ%×’“õþõ -Ù²mç’Q €ÀO +/PQÛ´‘®+ +Z½ÐÔ˜éÉöé)/žèÕXæ EŠÝÃ4â8 /ø¬ÁuÆg–Ëøì¶ÛgIª¬ÏtVê#§Iˆ¢ïçMs\ ¶µ{qßG˸O•FhGä4‘ƃ§üYDû¸ÖÅhô3½ +݇]yA]4EhÌËÍ*«©ó¿ðwÿþ=õ”›6õÇ ïïG#:ïæÔéädFÓÓv¥‹š(
󯌛}ë_ÊŠC3Š ýö±±N ûo •ò.ôä<ɼ¨õ†§UÓ¬@ wf<»rŽýsˆ
žþru0wë gr¯2‰ ¬)Ó² +=©DrÞ<ÇÕa_X©'¥m Y°ü cƒ…-D–T¡EV‹Ë` ¹ _Òs f 5 +)!lOÅ ‹”Äß#%ñ`Ï$ÛHê&³§'ü¬jÖKkV»£LóÍÙÊíXÆ_…ŸŒýзg:>f2Ø»ëÀ^ +• +2÷+ ç{a ©äœmŽéظ6ô”ª8nYÇÈ“6=@ƒ‘'y@±Èkr4 ‘Ûñ%
š0/ßszbà•’zÒA5b’R]òzЪj×t(Tž"n¯@_¡7/ÿ¿U>‰JA|¡ò5¹NÃÊq\½ïÊixN¿®ò%išœ7ÏquØwXù`á%ÚòšŠö Ôà5îRÐsAàÖTM.ZUA#·ãKzšPÀ ™^jª{ÒnádD˜…k2»Ÿ¤C.GZK^–Å“Þ¸˜Û˜ú†ôÄ)·*6Ͳ]3®2;ðH + Z£E x³ pA}¢åd°R„9ˆ¨¸ÙØÝ £=gË7]qq ÷G¨ÍêfÎSÌ®:YÝ‚8ôÒ0¸pÜÝä:c —É1yçªIÊV7;»£´Â,`;k›ãê0®•VÂÚ±h[Ç¥-²j‘ê083
å gôŽH¶‡G*¦W 2ð}{tÙMz¤‚ó€jÃ:fæÜؤ{~ Šþ!í)a7Š×Ù&£#'$ïè™1ÛRg4'nª3WtDîVý”fZ«ÃÛB» FIVž§íó+jßÖ-!í©w`šeF¸r(ú5gLëB—¶ä¡ ÃÆHþL‘FŸ‘ÍWaDsÂÓFZ¾âÁF ð(›'Û‘¡Ôó#,ðì¹3Í@‰¯ìÙ".Že¥qiAiJPº¼í¦‚4Îj‚÷„ðl9 ƱØheDá6B8¢Zr`?ç_Á«~Ôeò¯0ÛŽ±ûpI´µé‡Ý‡[:^ÉA³!Ï Šá Lé D|É€¿?Ä\‚¸p#‰Œ +èzˆúè ë5¾S½¾¦›$4 Nc\»‚…f¢ývÑKæƒ0^ÚÛí„c;DGÔé¢qÜÌÅïøÌ
yÉí¡n~ptüUÓuH§ónÌ–Mñ ”¡Ûó5¯7ª7|þ4§ Þš…×@ØE{À°qëÔÉŽ¨fËβ
%©£[ììïúFqd¯<Ló¥ÏÖЕ‡¡-l«ûÌÞ^€DÉq +P¼ ’ÛpA nËK&ËG=æV‚ÅÑ¿¸;…h»Mw§ +¯¾Ê|üåîa|â2Sœ¾ÌœèÀ̇|ù ›É0H—yºðÄ9/«òÒŽ|½É‹úÀ ÅÝݯtÔ3{<U•Ó<s,|e¹÷ï¾:ŸXþDÊ“0׳‹Ÿ=Ïé¥ó˜…ÏöPì©Ã0<«Ì² )kú5E¿ª–²Ç†¿ UŸ ìZ` j³5Ý%{§~© endobj -2573 0 obj << +2574 0 obj << /Type /Page -/Contents 2574 0 R -/Resources 2572 0 R +/Contents 2575 0 R +/Resources 2573 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2543 0 R +/Parent 2572 0 R >> endobj -2575 0 obj << -/D [2573 0 R /XYZ 56.6929 794.5015 null] +2576 0 obj << +/D [2574 0 R /XYZ 85.0394 794.5015 null] >> endobj -2572 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F55 1321 0 R /F22 961 0 R /F41 1218 0 R >> -/ProcSet [ /PDF /Text ] +2577 0 obj << +/D [2574 0 R /XYZ 85.0394 657.4255 null] >> endobj 2578 0 obj << -/Length 2008 +/D [2574 0 R /XYZ 85.0394 112.9597 null] +>> endobj +2573 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F55 1336 0 R /F22 973 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +2581 0 obj << +/Length 2239 /Filter /FlateDecode >> stream -xÚÝY[oÛÆ~ׯЇ#æfïÜ}tb¥ÇEâøXr[ Í-Q‰TEÒNúë;ËÝ¥Hjm(úr RùïÌ74cøGÆJ Ì4 Çš#‰/v#<^Ão?ˆã‰<SÔåz; ½yÏâ±FZR9ž¯:²ÂJ‘ñ|ùyruw7½½¾ùý"¢OÞ¢‹H`<ùxuûpõÁ>»»Ðtrõót·L3 L„>‰'·W §×_æ¿Œ¦óÖž®Í3cÌŸ£Ï_ðx ¦ÿ2ˆi%ÆÏpƒÑšŽw#.œ1ÿd;šþ× -ìüÚ¼Š - Êå8)Làp<Š9ARëc ( Ês™@ý1ݦy²K‡þÊcD»ROt·\å´£œPa´¯}¾Im6ªXÙkåú«È emEÆÐÆ5È—‚ñçˆÆL#ÆQL‰‚ûéüáþÖ¾üë˜0¹úð - Hˆ×á9+_7·žÙtj_¾ú0ûð1”?°À -þ#—ÇĹH-Š|Õù¹‘Çt· õŒ(í‚vÿþ f" ¸)>Ä!`œ"Ì1¼½¹½¶ò´ój¹Ëò¬¬IU ì£ûtåbš/\X?&ylê‰TˆJ)øp\™HSþÝÀ^=Ìÿûéþ|Doò*=ä©«Ù÷²Jw.÷,UVïŽz!‡\R'‡i¤bάëк."‚±Ë‡y¥ááH -©ž[wÄ)$cÍŽ9v§ÒØR}3—Å.Éòá±-ÓÄ6#<(ºïy±/³rØn$ôHFã1Óàd9Ðl˜MúÕ.Ø‘Ðô! j‚ž©ã´„ð}ŽøOÉ–ZX¿ë–X#‰]y˜âÏÖÑ*Ûº(÷´JbÁ¸ãmå.r”±.ÓÇz mÓ§tûãb§gŦù:ËÓ(okâGÄ®¾4u1É„ÿ ùû,ÛçhÝrîÀ°ƒ íëj›¬šápðX‘¡æü¬C?-öuYV± -ÜŸ¸‡Ã’Ç&ø$4eKÍ’ûñüi—|‹Êbñ5d¯Ð(Ž…ʯÎJv€éP ¾‡„B âÕ&‹ êWQxße‘¸,ÖUÖkŸ»ºô}˜;*O"ýÔR¿¶Ô·€ --äm/_$0Q^:L6FºëÎI_¦ÐÔ ¼ëéìÝýÍÝüæÓíb€@Çœcî¡‘ -9IìåÚ5GC7 ·¡lg·´™×·33#í×9c#.b1žì(½æ'ƒÌµÁB†°3ÎPÚ^–f¾eu•NëÊb§íföYê½™†ØUØÃì¼éå,_‡]b…6è" €2ðàÒ7~÷ÆyÙÎsvÙ’ür€X̸G~D‘iÓöÚß6i£GƒOÅW;ˆÔä9«6E]Ù_’Æøu½Kóª¼ d‘ˆ1û±ýb{ÇØÑs¶ÝZù66‰SíüÕЇWI½u6@¯7Pt] Ú)NåJbŒ8k{Æ›´Z¼i¬Bff„ ¥FR2ÕÅ=f 0Þè Q]kM„¿;@™gU–lݼNªd˜‚-”MêrºòàèÏ:=di‰~`ˆjÎÐìdEr#˜b³¬À¤~uNw¹^ÞVZ.£7âC•šÁú¡èë*=S@e7ð°@Â&#ú* JWß7wOÜŸ† 4Ìå¼áÛ²)J˜vÐÌ2¿ÃdîŒ,’}ò¸ ì< B¢Pk”©Uì;¸Â®šƒÜN“é@)Â&b_‰‘</¦»€ìê -rëú·Å¶.³'»p„ª€ÄÆF,^¯‚.×ËUÐr
UÁ«*Û*8Uª‚žÊnÈ¿ -øÿQp†0ÕòLt¸^©ÏÕîQ¹èŽeD„Ayï놄~JazÕ¾–+``W”c÷-4E -c€XªÒFzc«¹TÞ8`‘¹}T§–0æt¯‰½ì‹²Ì ƒH‚2Œ4Æ2 ù{!ËŸƒbïÊÃꮶ -X +xÚ¥YÝsâ8Ï_Á#©}Y–ö-“d²ìÍ’ °W[736‰wÀæ°Élö¯¿–õmdï*U±ÚÝŸZýe2ÀðG‘@BQ5ˆG&Ñ`±¾ÀƒgX»¿ –fäˆFmªó‹«O, (¤ƒù²ÅK",%ÌÓ/È`t ,ððv2›ÝÝŒfãûÉ¿ &w—#")‰‡×w“Ûñï—#a bŒ‡¿^O~»þlæ / ^ßßÍ.¿Í¹¸›{ÍÚÚÌ´Zÿ¹øò
RØÄ/1%£ÁøQŠÖ<b(⌹™ÕÅì⟞akµy5„$Š(€ Cã8ŒA1!@sŒÆÒcFI3G¥1môF¯>EQ‹’$Uš5$7WW×WÓ«ñÕíU²Zõ! #è -ü@EGP‘¶ †(L::>nó¢†ã¡ñ0Ñ9¬6Ù"ÿŠ1]˜éuV'iRÛÕ×dµËÌB¹5Ï*«ÍZ¹<úFæÀ0 Î_2ƒ o£G…B’à àn]õ9¢”6$å¦ÎËŠKÞŒ¤§†÷`ÄD§ +3p|Ù‡€±B˜ÂÐð *S0ø½
?/j³{Zip¬¤è¨$‚˜kL,§ëc¢øQQÉ¢Î_ß%‰‚¹gZÓ¿¿)ßkù¾}E(bÄá8 mÄ)h)Ò7àñ£F. ò¢³G˜1R›¡9û¾tàL„· Ûà^¹´³×¶Ì4›ïÈÓW›àá\{÷ÒLo¬W¡öjFŸe“sVß]t
L Î1ß»†øê¡õ•=ÕY„¤ðç„,xlcð5°e1Š%e
íìîÎhqýyöàŒ#*!.4yZTU¶}ÏÞž³â+Ž°„ÄnÄ.Vùsñ¸—ÖrשöyÄQ¥œí} On
eÕI×y‘Wõ6©ÝIL³ef ®XX$MŠ]„
B¸ûÒ€#%½5N?ÝŽ +!ÈŒL^dÆûuMmÂ…¶ý²\…@Ã=k|+ÊM•Wýt€A2"ƒ8 +ðì¼ëD¶I–˜f¯Gn!>¼…3?ªÎº¿ªN¶õ1/)Ç‘ìóŸŸÅ¬®CFNbˆÞô€]íG;?z=ê\"³Ê^³ÕûãÌïaW¡KÕ5ÐìÏ<·.#õ«'œø1+ýÓþò#vvCU²ªƒé1R ¸ôŸÏ{¸ÀMÝP½ÿd¯íHGb +Þ´9k6¡+—ˆ ǵ™‚\^ƒ’Y‰Éæ`.™™šNgã{3gRð…餎·!dP endobj -2577 0 obj << +2580 0 obj << /Type /Page -/Contents 2578 0 R -/Resources 2576 0 R +/Contents 2581 0 R +/Resources 2579 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2543 0 R ->> endobj -2579 0 obj << -/D [2577 0 R /XYZ 85.0394 794.5015 null] ->> endobj -2580 0 obj << -/D [2577 0 R /XYZ 85.0394 699.7547 null] ->> endobj -2581 0 obj << -/D [2577 0 R /XYZ 85.0394 640.0922 null] +/Parent 2572 0 R >> endobj 2582 0 obj << -/D [2577 0 R /XYZ 85.0394 580.4297 null] ->> endobj -886 0 obj << -/D [2577 0 R /XYZ 85.0394 543.9387 null] +/D [2580 0 R /XYZ 56.6929 794.5015 null] >> endobj 2583 0 obj << -/D [2577 0 R /XYZ 85.0394 511.833 null] +/D [2580 0 R /XYZ 56.6929 659.6547 null] >> endobj 2584 0 obj << -/D [2577 0 R /XYZ 85.0394 477.1761 null] +/D [2580 0 R /XYZ 56.6929 595.7578 null] +>> endobj +882 0 obj << +/D [2580 0 R /XYZ 56.6929 556.2057 null] >> endobj 2585 0 obj << -/D [2577 0 R /XYZ 85.0394 414.5918 null] +/D [2580 0 R /XYZ 56.6929 519.369 null] >> endobj 2586 0 obj << -/D [2577 0 R /XYZ 85.0394 333.9838 null] +/D [2580 0 R /XYZ 56.6929 487.0966 null] >> endobj 2587 0 obj << -/D [2577 0 R /XYZ 85.0394 232.4782 null] +/D [2580 0 R /XYZ 56.6929 420.2778 null] >> endobj -2576 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F39 1161 0 R /F41 1218 0 R /F53 1313 0 R /F55 1321 0 R >> +2588 0 obj << +/D [2580 0 R /XYZ 56.6929 287.6148 null] +>> endobj +2589 0 obj << +/D [2580 0 R /XYZ 56.6929 199.8075 null] +>> endobj +2579 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F55 1336 0 R /F22 973 0 R /F41 1233 0 R /F39 1173 0 R /F53 1328 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2590 0 obj << -/Length 2767 +2592 0 obj << +/Length 3585 /Filter /FlateDecode >> stream -xÚÅZëoÛFÿî¿B@¿P@´á>ø8‰¸—¸¾ÚA ´ý@K+™g>T>â¸ýÍììR¤DI9$Àµ@8œ ÎÎÎÎüfve>óá> B&"™E‰bσٲ¸ðg{ÁÌ -†Roî/^ÿ(£YÂ’P„³ûõ@WÌü8æ³ûÕïÞÆ9›ƒ -ß»¹üxõn¾2‘¡wy{{uóîú7x|ß÷>^Þ|ºü@¼Ûy"¼Ë÷Wwó?ﺸºïíÚÌ}‰ÆüuñûŸþl¦ÿtá3™ÄÁì^|Æ“DÌŠ H() '¿¸»øw¯p0j>ò -b‚7bRG<ÅYÄ9E2Û¢ÞQ‚O9Ê -¡ŸW¸Ì×?Á@\'ØeDt¹ÉJ½(ÓBﻄKŤâÑl0ïq½Ð¡ub8©L˜rdݧFÏÀôR|(oY¿lÛŠXi=ç±·z¦§üÃüŸ·º¼»û@ ² ØœT¬«šÚGûÉPiµÕuÚfUÙtÖ¿é¶Ûªn›Wðª„Q® -Åé$J Ï¢^ʤÑzÊP²8âÓS:¡‰)÷œ‡ OùKWîy®Ñõg][í®mˆl(²ºrE|L˜ŒaäHî{«ÞŸÖÁ«TU™ým2è¸_gBÂBNûu u¯NÊøusà× -FŸ¿×wo÷S»I2 €gß_Óé –ïOõy §p1Ôxĺ‰0ŽâÝĸ®W Œ%‚O Æs&Æ!ØL|wõæÓûßà?WRlz˜¢›e=èUŸ‡@ñ„ƹ˜úGÖ,_C–²ÇNu˜àò,ÚØ/ó$:vC©ãh×K´+ÏvÌ?,·]s -¢`lÙ[Švl''š7\²Šö-ÜÏ~É|»JRÏUý„…Orl—öâ W&“Ì@ú¤‰“®>§eK€ -Õšžt~Ù6·Boo?5öÔumL³cÍV/3ˆ ¡WxFÛ!9ÖÃÞ:ì§ \È#%ùhž3Sy±[DC - Í*à‰«°wj› ¨|¹ýÂí;©˜Œc™k` Ìö«] ÍFˆ89C©ãÙØK™lÜžÍFwš%£` æŒ]Nh®a¼A´©(Ù³ëCÖ´ºÜu€†ø«Óu¦-0VvôÈa‹C%v©¸“:Qgm ¼^ï5ñ£¼‡=™Ypn&*Ç·/JÅg.$†R'¶ÔI™-=€ÎP1%e|zJ'41å¨|$LqȘє¿Î#åÕYkâ:D¤m‡hÜئ-lk¶lN4í\ -ïêÀ3!K"hú%lªð)?gÍ J¨$‘$4 ÍZw>0Œ××…˜½«`E³á¢¬âÅP³YT8*Ã~!œ`7 ¥=u<R E^µÅ«$¢‰zEš•ù‹ _Û±[7-½Q‹yo®oÞÑ7 1Vz.}ïó\žÎñ¦ÊNcšèFúˆà9‚N¿¨æ<°ßÆ•ƒJ£Á§Î¨i¹1¼˜“.<Sz¬»¶«5ѵÎu -]6h=ˆV… ‹“x6Œ‡o 1 ±&Ðè/v¥ß– -dVß~ò÷R
,°ÙY]•…9¢¤‰|*M~.‰mNÏÀ¦_[pRÏ~ÐÏ1Þx-qF{˜3F¬§<(‰f<á?ø{ uò7Uk¶:†¼©ÂTI[âÙM‡ÁeÛá’pÎ -š–Cðöø•æ4ÇîÆè¡Gžµm®§,5ÛªÑÎgÔjNœÆié(MÄÈ\ár -«}=ÚhÂÊÝÆÚQÖ"BHCˆRo!üˆÅ -ÊË8|L|™nª‡+ì´ÚƵ\- »=SÈêεYÚòuêÿÞgq.X„gú¬^ÊôYíDŸ•0¯ûí1«õ²ÅóÜ~—íPÈÃÂÉ.ËIMX7.k -ª|,Ææ½¥Û“ÊœÄE8Ýáí§É”½{“€ |;ÉtMázé.ªÂºH¿) H,«¢ 3¼ätA„éc¾ÙtˆUæ2Hr†>h÷ý»K Ôn" ã.‰ý½Ÿ¾û{… F§î äÛ¤aÇþ°Bx‚ŸÚ¿o“¾ù.vU¢"Ñ{ì¢; -| :£pq<‡—!> ü +xÚÅZM{㶾ûWèi{Ÿ¬P|’@rrÖn²Ù]ïvåm’&9ÐeñY‰TEj ÷×wP¤DÉÛôPû@h0ÀÌ; qø#kWNR§™áÂŒfë >z€¾ï.Dà™D¦I—ëÛ»‹¿þM¥#Ç\"“ÑÝ¢3–eÜZ1º›ÿ2¾zÿþæöúÕO—iøø[v91œß^Ý~¼zC´÷—NŽ¯¾»™^N„•"&Á‘/áãëÛéôæådúê»Û¾»½¹üí›»V²®ô‚+ë_¿üÆGsXÄœ)gÍè~p&œ“£õ…6ŠT¤¬.¦oìôúW‡vCËŒÔÉhÌJ 7¼gœq{0Iµ`"qI»gR íYäÂ=›\ .Ô%,1& u;š22
L);S +.X¢Òþ”ïvÍf×\N”MÇU¹z– 7˪Ή¸½vœÏ*ÿœyÚä5qf»¦ZgM1ËVôr:^geöÖû'\ÒÁâeÊYÊAîe˜—uÏ&uñPþ»*óðBWôT³Ä9ø_\N´”ã‚å -)´>| + N çÕÖÇ¥í«Ã£ÓÍ*èBS¬óúäik€<žÉÞ:L§O;2ùÓ^
œ¶cBšôÏ!Q*Êã ¦T<9+VËt,W?>ÁàÐ{‚í݈L´7çÄŒ¯ß`²ó¢NcuÏ4Ÿt"Hõ¦–„ þ<±Ã(JEBä„ïbN姘¶£ã‰+R +ì [áûQ –m ›ÇC–°’ĸgŒ~ 9T‹ƒ®£ôí”6A3W‡×}ˆ\^!ê!óçà#Ûä +„·RôÝz±ªÏ‹$ª\xÞ×ÕjçÅ‡è» +½$Æ +âõÏ9Qp=ŒÂØ«’˜»¯j:—=/µ¼|d^\Bè Ö ”û§0?=Ú”MRö‹,?ÃßÛ·×13iõõ÷ß¿};R†NÑgß Åˆ±äðg@R
çÈ[™S }¡¿ÖæëØõ»{Im¨ÀñÖ*o–¾~ ý°¾ !ÇWÝ*BÜ%d§M7n‰
[bý–´ûaÃ~ØñW·>r 6…:¯ÜÒr–ªœÚ>«Á_¤aÐè{vì‰ç§(– +ÅOùc@[LˆX: qXá°"î³×å:
q-—‡¸|âRqÚ²À|à° ¦í¬p-×€t=€Ó–%Š»¾x-À 6à°åÎ÷ùCÂ\¿pø3 +<2“§è_¥ó4¿Q~Eá D"êË%#=N3mîoHÈôØe$* ù äL sªõ®>¨ÛÂéÅj³ÌÊ©,˜åö¿·Á“˜+ñÆÌÚgÂÊ.×iÌm¹<æþ4„¹’i£Úú½¡HÚWžO"°ƒì ÕgEm¹dín lŒ;HËzÂþ_Ø{ÍÞ +»À n*Ú$qé¾>?°š\•„8Å‚È-óëékjAˆOù¦ b,pR¬à%‚'¡n EŸ1Ô¢Ñ0"ê.¯ Ř꾗.ÂN,ãUÎ:+wþþ²ùY-Ó‰Lé6»¦ÒØ)'ž2gµù#> ìÊ‘·ÆÛÔ½·†É‚‚V¦ï:Eÿ“žGÞÚÚ®·Ö2õŽ-Iv²4áQÃA`HïP÷ üÁ ûü
ÙruÝš1ÑAË;mäN{ÿ’A§íŽNÙ:žÇ˜Éš Ok볘H °…ƒÐD§¤:*'4ú.\'q÷uPW|vv ~†D§ÓƶÏH<mèؤŒskŸê£«{@×Ôênzs NÃr(OI Ó·éAÕ2îW)‰7 ÇF'êË\n"]7¦À1üA+ Ú^h´~~¢¹9uK.8Ī5Ž3óëÂ|žvˆs€IwÛ2ÚB2uTôÄHÇ å# i»j=©÷90ì.ä5ÚÉã\˜ùtlà°a3…Tä¬Åþãˆ? Τ_Gî¹pF`~,å3%ò.×ép¦åòáÌb°lšX•«ò_¨LÅê8„I8Ói¢Î‹×r
Èׯ’ˆ¢Ò´/ }!’qyéËàb¼FL´jAO(HŠªø9
ýÍÖžÐÉŠø¥H5è@ÿåSÐçþS©t?qÐab AÂe«¦ƒÑs +N{ÍÆB²(%KŒÇ—Ïù|øûkãAø)¹Š_r(°7Z+4é˱þŽÙ! }'!¸ >Ùʌ͔®›¶ÀD>NóRTÃ~XÿO“?
Ùøj%;8 `y°ºöX¸n¿RQ Û¢iÚwªx³¯`~•œˆXð#€y?¤òUk¿/: ”P (Ü`Ń߳¶u¡uÖô ß¿BŽ·ØVø<mÆ<e‰{¦Ôa:cÄÉÛðòèb R=ÏÏyŽçë]Œ;¦¥éÏ÷~[”ñ °Uõ²Ú†
©wëu¶}:q-@WMñå2œ ÊÃn—¯>\ÓréVÁ¾ôÃ5ý ¼¦)“i"žù pÏtæ{ÂÀäÏ¥xîJ +ö1ßBPp\ýµøÝáÁZ¦cÉúµ¹Ú©è‰öc›åeôØPðõ¹¨võêi»Èø°U„ o“ÕuìÍ̓Z—Ãi¡¿XÄÆ}ÞM i¦P«»[æC¨§î¤Ö›v°Ö‰²°X½ÿ¸‡Vï7û%åú°Îý4[ÅÂzœÂÿÊg† diA)ëAÝ B|p94¤.S C°¢ìUá1ŽaôÍO¬«g4N¼Õ‘‡ cœú0W+UjHmø(bãÿüÑîþûd•µ'ü: +ODw(ºgg,Øö±ìÿÐÀ ˆendstream endobj -2589 0 obj << +2591 0 obj << /Type /Page -/Contents 2590 0 R -/Resources 2588 0 R +/Contents 2592 0 R +/Resources 2590 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2592 0 R +/Parent 2572 0 R >> endobj -2591 0 obj << -/D [2589 0 R /XYZ 56.6929 794.5015 null] +2593 0 obj << +/D [2591 0 R /XYZ 85.0394 794.5015 null] >> endobj -2588 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F55 1321 0 R /F22 961 0 R /F53 1313 0 R /F41 1218 0 R /F62 1361 0 R /F63 1364 0 R >> -/XObject << /Im2 1350 0 R /Im3 1515 0 R >> +2590 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R /F55 1336 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2595 0 obj << -/Length 2428 +2596 0 obj << +/Length 3487 /Filter /FlateDecode >> stream -xÚµYÝsÛ6÷_Á·R3Š §OÎÅɹ“8¹D¹»™¶´[l(ÒI;þﻋ%R¢Ôë¥ÏˆøX,‹Ýý-Ö"âð'¢T3®²$²YÂ4:Zn.xts¯/D ™÷Dó!Õ‹Åů”2–i¢ÅÝ€WÊxšŠh±ú9¾|ÿþêæåõgs©yü‚ÍæšóøíåͧË74ö~–ÉøòõÕGèªL é o.ß^½œýºøéâj±“g(³à -…ùýâç_y´ÑºàLe©Žž ÙÈ2m.˜N”êGÊ‹ÿÚ1 Ìú¥S:HdÊŒ26™™âZü/ÛªÔk"Þ–GóL±$M²Ó¼h ^¡Ù¯³š ÷˜hn¬fV ®HÊÔ™i-ñŽ`†™ØÈj ˤõ—ô T±'͘6‰ J¦-\,§kœÍŒ?øßøñõ®-ãׇW„Û(©ÓÈrËRymE¿ƒ 2‘$ÊS
Ûþü{½ø ®7*zYÃ)£áA{Îó!kR#Æ(4 :å ’ ¾tÐźhÀÌ2×mQWØ6q³®»rEã·Ž¾]ãÂH¨–uõ[W-ûe6~*Ú5µÚµ#
‚êö"H™0™íT8ïˆf,fZI !¡¾ŸÍq $]®·uÝÕ=.ÐG˜ä j"Ü*,Ìa‰Pñö^º¦¡Îv6:îª -—ú‘¼Ÿ~Ø’ñªvMõ]KîZçÕÒQ§qËŽ8í3
á¹ñ»©›°¢ynZ·i~„žâ½Ð®I6Š -,3ˆ…ó}ûºà¦ÇpÃ6›¸<tE£Gª÷®(Å.ì¨†Þ õÐK3Âå‚ n ØKšèh¸ã‘X=Ñ„\#߃£¥Ò öѵ]á]_âÕ“j°,‘Ì yÀ[–Š,
Dù] Tžå²Þ<”λ³ï?lƒµ…-ë·Í1 -4> ȸé–kš¢€ âåv&ÒØÍZœˆ[hvà‘õò3ô]hÛuÞÒê² -|ñ¬$;ª QFê³´ p©±,ë. çª~ªÎ+ Rµ„I‹\ +xڥ˒ã6îÞ_á[ÔU±">ôànía’™¤&ÉöÌNwj·6ÉAmÉmelÉ1åéq¾~”%Yr'µåƒ)!OBbÁO,â$LŒ4‹Ôè0ŽD¼Xín¢ÅÌ}w#gé‘–}¬¯ n¾úV¥ šD&‹‡uVFY&ÅÏÁסˆÂ[ ¯ïîïß|³¼ûÝÝßݽ¹]ŠLŠ4xõþý›»×oÿs»”qø€ EÁ?_ÝýôêG‚½¿52xõÝ›ûÛ_ ¾¿yóÐqÖç^D +Ùúýæç_£E/ñýM*“Å‹gxˆBaŒ\ìnt¬ÂX+å!Û›û›u{³né¤4à…¤Jä„8¤ì‰#alL¼Hc&J*'Žòó¾:ÜŠ,(-¼[&‚|Ý–¶›’«ÓjËê†éOùöK|Ì‚ªe0¯&Rm^Õe‚Ó‘ +Þ™ÃseË™%«¦¶UQÒÊ‚wnèÿ‘wu\Võ=Ù¦© 1äug +š8–îÜ pPÏÕvK#G þi›ý6_!ƒ~iÒ¥•øΨ (×ùqÛâƒô@¸ +¢~õ}›‰C“
œvÔÅ©â@›â(ÔZgŒØLÑBLfÅ1:G-‘¡ß3÷ï‹ Û}¹ª~‰"Y_ò²þ 0‘jÁ+‹ÚÚrµD±ýr¹Mš† ø1ã?•uyÈ[§ùÉHÜ–ÕnòÖ t©@I d‚=3«Ò +#X6äÐù*%â€Y€±v:ƒ°ÖO:.iÎY…¢ImKÚt𾱶zÜ–„DÄ,áõta$3©“0M"ɲøEJÝ–Ÿ[üŸ0< ‚3Þî~‰âˆÝ+ ïDž|làÞ[éÞ&‡üyn4Á—üàRË$zdµ|L 4û¶jj{ØþPíòCµ=1L².\d‚'§ø&! …ç£õ3dò0(Nu¾«Vô€NÅc øyÛ09ô/<bŠÅq·§IàÝØØŸÓñ¡µ§dršœ <ÖM½Äƒ '¯8†@‹™ü +™$î(éÔ“Ô©Išå +¬ºŒ+0_Y{ôdNŒ´ +\¹‡xòøßzÞ-!
tKpì)$©çꟉPõóÕÿÒ@öE£º}ÒDzÜÏè ½±9ß o¦®÷´„d1‹{Õ?æI.GšÙ"†”'ëpúNA˜PÅ©êQ=ÖÕgŒrsD£ÐDYÖ¿Xèk†ï ”†P‘I5© iÙǺÔTGßaM‰u ‚Bnq}÷kbû +â%göÝøª»KŠj=Nœ~^ sbƒó +4èºØzXWÄæ±fõexG—™ä: ÖÃ;:0ó42C&Þöû¿ 1Ž”]üðí74&“œ¾Aê±ÙA¿²³Â•Y®$».Û Ò¼h=ÒœÍ +Ã8ÊôÕí;¤Ëýb%ñ§îË¿,KŸ…t+ú“ÍÚ/†Œ»ðeZåú3.¡Ù7«Ílˆ’àu´Ž²ë!ª5 ¢:,¢šéäCé´+ÕSU_æÀ +\Vœ]gÚàm˜da†iÇ€¹/H¾JA1:f85|» yA/gt]±áO¢½¤Þ]zö2ÍÜÚãn.Ñìhx¾æÎOfadTòÂùõ°®œŸÇrç÷î¥*Þ+=¡…Ä×ì°&8 œb¬Ð²!‹ÔCH£s!”4¦þºÄ&ý1 ¢¿R†¼ÃÕ@©8¯éª 4òéFó½fC·«¥¥WÒ3îH]¦×{B%sM‡‰l# +c9è5¬Ûí ñ$ŒÏÝÔçDÏ›ŠjëŒÔ|/C„R›Œ®aª»¥=VmþHzžù’Èß26«Òú˜ÑMJLw2‡šœ À€TûÖ~I)·IB)#1j\N¦F2 +“D¨?ÕnQ ™ŽÀÃLK…"1#rÿ¸›!¨T9ZEª…ö"UxÛ6þEù¯pÀ%¶û8þsú{¬êüp¢q§Þ4&Š‡|
[„m¾‡r OS²øcbíÛÙ貊±˜®EN)ó¨'%þœtT˜ Ó•&ý⛶äëTO—°!] ,Ý Á5“;ÌÞþ™fØŪ”mûot‰Pñ‚;ªx§ˆ»ÌÝŽL'=;håûI0ûXö[ÍyÁPîLc‹šútüz%=óO‘aÂf¼QéLþ>¼A»F1ŽMý°³ò×oÃuîק>t[æ¾q¬„‘Eô¿©ž6ƒ«”.žv_ž Øš^Ruƒ
§«Ñ«5 ½:,½öã-“Gú– ibËÁ§"ŒÒl´åO(0et°·å±h–t 8(ò6§Égº}ãî*Yñ—^ÜgÅâV+îô*îî"Ö:·m×CÑ +ŒÝ6À kWÄ4ðØ}Q8tïŠSœ’#>Ÿ=]å + ãzس/SéØÇ“NSß~NÕ¹9 +»üD§[0y´åú®|KôÖˆÐk‚ÉÁu7`ù 3Ì8Mƒ¿ÐßcjŠ'{޳͈˜•º ÞV»ª½ò-†‰!|dòº&öæÑ#9=|?§‡×öëÔðb¿)-ìï÷º²> endobj -2594 0 obj << +2595 0 obj << /Type /Page -/Contents 2595 0 R -/Resources 2593 0 R +/Contents 2596 0 R +/Resources 2594 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2592 0 R ->> endobj -2596 0 obj << -/D [2594 0 R /XYZ 85.0394 794.5015 null] +/Parent 2572 0 R >> endobj 2597 0 obj << -/D [2594 0 R /XYZ 85.0394 243.4864 null] ->> endobj -2598 0 obj << -/D [2594 0 R /XYZ 85.0394 96.2114 null] +/D [2595 0 R /XYZ 56.6929 794.5015 null] >> endobj -2593 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F62 1361 0 R /F41 1218 0 R /F21 938 0 R /F55 1321 0 R /F53 1313 0 R /F63 1364 0 R /F39 1161 0 R >> -/XObject << /Im3 1515 0 R /Im2 1350 0 R >> +2594 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F41 1233 0 R /F21 950 0 R /F55 1336 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2601 0 obj << -/Length 1795 +2600 0 obj << +/Length 3141 /Filter /FlateDecode >> stream -xÚ½ÛNÛHô=_‘G#ÕÃ\mÏ#ÚµÀB*ÔöÁØânbgmÊ~ýž¹ù’¨´«U <sæ̹ß&dŽáGæ"B‘¤r KŽ&bžmfxþ -¦³ó»÷·7‹‹ë«‰F<Ž¨—$¹YRÐ…Ä]W¬¦ïõ¾×´ªWKûM_uu?SönOßö>²“‰ - -"„ÛAùÒÓg\öã޸‘So’ ÝÁ M1K×z -Òç£áR&‡K’@Ó•ä)†#(‹Þ^O+U: «´|˜h“æÊ‚õ@¥¿ù3P/2»Ñl¼R+ô€ ²˜MKRJ‘²›cí»ªlvÛ œªäTϽ¤ ø â\FºUj¨ÌFܬ2ßÜÂTª'c½Jó¼°C†Þéê©¿¹Z«tép‡ð˜^èêzÈFkIc úð¾(ÓÚÉ£C!m
8t½®žŠòÁ ¹ jžSkTö;/ÐÈϯÒNÉ°·ìÃt 3²™q=NÔ»ôñ ëÛþª Um‹fHÕÌÈžhºl=Vê.®vm^=9z¦Á7«Óf¥_EL§ÏæÆ–w¾Rµ³r`b‚S¯\6¤;ê³6]¦‘`Ú¶FPXß?Û30‰*scã1õ_¿c¦ /‰~aÇ~žG?Ê©¾IêRÊغ';5È¡$Î°Û -$; ¬ß<¶1¾£øïËÐþX7ªŽÃzòkå‘Á -ñm *!ø_WB»7¯^ôRïL*Ä6 ‹ ŠGS# +xÚ]sÛ6òÝ¿Bo•g, HöžÒÖͤ×sr±;½»¶´DÙœH¤*Rv|¿þv± ”H¥io<c‚À»Øï]JÎüÉYj"¡³x–dqd„4³åöBÌ `íÍ…d˜…Z„PßÜ]¼ú^'³,ʬ²³»upV‰4•³»Õ/ó×ïß_ß|÷ö_— eÄü›èra„˜ÿãõÍO¯¤¹÷—™š¿~s}{¹©’ +ø™·b1seíÞê-½},^:nå-ªšž›ºz(ö4.>•MëÄ2Ng ¥ ÊἩ÷Û|³y¹”Rί`G’Ο I¢æ9=vDÆSY šÍË¢“u¢½: +mL Iš¢K}` Òª>‰Üªh€™‹ØšùÛõ`'@îŠ}ªüÀ½4m±¥¥UíñTuKËä÷ê§rÅÛóýÓÆ€(¯¯€[¯œ¾/ +p 8OÓõ3#ki½³ E¾ + úÊ+òbJW‹sZ–Í $‚Ð[ø•· +O8#ÌKKf):…Ç9nhÔÎ ¯ó¸ê8-Pç¡®niìøáÜ ‹^Ýe +ÿ ÂÅ"Ïêô/78áœp=˜.dó¢D2¡ô£×š§©¨È¤—9Î ªÎ `JÝíà«bS V”bë°Sƒ':3Ö¾‹„3eu„”5"V‰ŸãƒæCoÞÝMËòÈ;úÀþ‡Åu*À‘_Àó|ºVù|v3 Œ' -l¤¬ŒÏ!ÔtaÐA¹Âàn¤ !U틤¶Ýœ("”QñëótuP#„
´M‰(Ö)´"”¦æ <îî~¤<]©}5‰#ÊX´o$ÂL×ÞÒÇýL>¼Üîê}ë(+8IXw
:=h;† +—Ö7·aÄ• Oƒ ©¡Vžè/ +_ÒQñzâ¢!\ùã«eAÃNâ0>•8L`K\ÇA ðv˜}ž NlPBzYcÛÀÆê(Guõ¥ÌRç¶ðIE%Ž–yŽÞeoyŠÂV:Ï7MÍA)ä¨Yûs +
·cðR1Rþ”°p_% ÷qÖ3Ç' B¤žBº)›€;zW|B– šGÍÏ¥+¶âÌ]FdqvŒî+r‚dØ°ìô¶¡ñ3µèatϧPJg¢ðôeyìÂùö*pß0åªdx’Û…A½î`¢yß Që¿‘Bá´¢óNIoš8Ç®*¥a*ìümEì80YpF :ÚúÃrz[Öø].ê¾hŸ©Lëq$=×4©™{^-u=«‰o ]Ãj ÿº’ö4s™ Q +’™ju>D…PÓ!ªƒræßžô®dd“8>Ò ô®ld
”k”ï÷eå{x-ä.`6Kæoü-ëí³—ºšäˆLt”êÏ4ó i~x ÇŽÃT+ï ¾®“w‚o¬‘âûiGIº6v~s{ýí+ü§ñ=Á.±KÄŒ÷ñ8boÓ¹zÌiiøQ“æü—M£¬waU6ÿùÒ˜¹û¼…@-‡ Ëá#bªéØ ¡Ö¨>Ôr÷Û#H0ÃÞ‚F˼¢kK§m>cNÚÒ5œp}kÞ£1É”œÃ¦Ò‘ú¶ Ž¦ÑéQ|ñ9ƨFÜ) ¹C‹9nMO. ŒVàô€ÏkŽ
î3Lïò}¾ÅÖ vÄL,; c¦S‰Íˆ‡Ù|ڟծɗôg3Ó}c!‡Ž(ú¤üé&UQ&ÓxÂ7õÑË™ i 9»èRo¯yÓv)’ÈB¦öà ÎX¦‡r¦ù4–LËHljÿ°ošN+È{(ËÎRÖA6ÈŒ´Œ”±CÒn‹¶9ªYVÅýáá¡ã¨£lúG ඟûÍGtæ' äöéÄ—éHƒ"œÅçaNñ
|Yi™™¾w•ó:ÏR
§¥ÿS>!±ûNëlV0 ñ3ðjnüÆÔ…ÖÜÂÄéz[¶=–ðW x^ŠÚÌñ¡/ô]5îb†® endobj -2600 0 obj << +2599 0 obj << /Type /Page -/Contents 2601 0 R -/Resources 2599 0 R +/Contents 2600 0 R +/Resources 2598 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2592 0 R +/Parent 2572 0 R >> endobj -2602 0 obj << -/D [2600 0 R /XYZ 56.6929 794.5015 null] +2601 0 obj << +/D [2599 0 R /XYZ 85.0394 794.5015 null] >> endobj -2603 0 obj << -/D [2600 0 R /XYZ 56.6929 688.8814 null] +2598 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F21 950 0 R /F41 1233 0 R /F55 1336 0 R >> +/ProcSet [ /PDF /Text ] >> endobj 2604 0 obj << -/D [2600 0 R /XYZ 56.6929 580.117 null] +/Length 2361 +/Filter /FlateDecode +>> +stream +xÚ¥ËrãÆñ®¯àŪ,Læ
|â®èµ¼»’"jËNl $‘%E ¥•¿>Ýó +·”ÛâiSVeåp_VÙÖBÛÚ"7å²ržp¿*»9ÏvMÑ´4#KnYäö Pjº·s‹ÝËÖkTÓˆ1’©Q@ª7òXYæV¦¼¹ +FBÎvy¶-¢ùª˜¾6_íѪþÁ 횊QJâXrwôϺrÌÖÛaXªD#Þ …f^-6«lª=$$(¸ŽÐŽ™ÙA¬9‡Ö‰$š*yÚë»Xǽ¾Å2^/,cJõ4@â$UŽ±&[o‡|¥ B•'§ùòH¾ºjH5±d}¾>Uñ&¯‹“qVÙï5¤2`<ž¯²Ò¾”Û•…Œ_!°,Ÿ ·»*¾ÙE5¯sãã°ŠB¯éTŽ'v;Ïw :ŸÓŠèš‹£L
Õ2† ’2* ’±©¹tîex(,=AÇ x2†T$”"”ÂÙ^P•U^Î&0+oM„#TÕökø0 Äq;„M -~Mæ°÷:d§bŠÉQ—”Œ0&ßrÉÖ —ôXÆ% +¹$ÖšØiµÜÞëª2Ç ¦T¬’ÓܵXöz™@(¢TÌúüýrT‰YÖáEk¯loªMV½:ãUPà—‚a¾vèy±ÈvC#c?fš‚x‰~Ã2 ¬–ñXÆ2“ƒ“X3qš¤G +ìj;æ²®î“tÊNE_ÙКdnÝ+–\NÀU(%°Ž
›7·÷X–n¾ÜÛ
_cq¯v§°º
/ 5‡Xåv7¯í‚-r{6MM%$Qq?œ;¾qx3,.ê'ïM1ßùöÀúÁºXzÁë)\
ºJ¨ÕÕ—Æ)§õ0€Ú¢…«/åÜhƒ™ Wž³1)È…
7Ù5?ã1°®pÑd*”1IOz©ÎÙ=U磰@_û´£}6®¸µ°V~ +MOØ€æ챘[7Ôºu4 +F¥ – +êSÉÆ×ao“¾÷ÅšÄ\y…DË!°ÃŒ{v8ÔlĘÁ.ûîw0ºƒä.È0S؈ÆE f¿µývÝÁžê»ˆYû ÙOÂVgGb1„Ú¿–Ø#”Ø¿ 'H+_l_û Ÿ³‡úÚu÷Ÿ£sÐ|šÂ¤šÈ~jtH8Ž K¹7ÃÜú¤ºfPqö
ßÀBZPI ¿Ž’˜æ%ÿø…#o‚ƒþ®mO@r×D†JÊ =@.\ñæÞ{}ý̆}a³Q7mÝãb _gÒv$2z cµÓC[l¬,Ä…&Ã:(Dߟ½àiñ ?{F¾¢ ØÃ!¹žÖÂ^Bîë¬užà‚ì €4k_¤ï¬YÛ‘4×Å!áý$ +³wÓì6Cç¶&vÚ¥u %‚A€¸0 …´w»P´ãñD2ù “È_˼—z í·V³éÔjkòivsªÁb‡Ýæè¬Ë"ífaFdû\ùîêúÒ’I µ ^h¶Ðüø¶ð®_vésVí²u(Ê¡ë‚@ðOÜ!úØ41Ÿî~|oo”TˆÀ}’.k“F°3M1ó~W}“/÷?Ýܽ·+|…« +癳WhD6.#½¯« +b¹Û ûAL(‚¿bæ7ÚrøÿX¶ÿ]PßIÂÓ ÃÚ3…Â1Í^J8H àý¿Öháendstream +endobj +2603 0 obj << +/Type /Page +/Contents 2604 0 R +/Resources 2602 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 2609 0 R >> endobj 2605 0 obj << -/D [2600 0 R /XYZ 56.6929 502.4221 null] ->> endobj -890 0 obj << -/D [2600 0 R /XYZ 56.6929 461.5895 null] +/D [2603 0 R /XYZ 56.6929 794.5015 null] >> endobj 2606 0 obj << -/D [2600 0 R /XYZ 56.6929 424.1905 null] +/D [2603 0 R /XYZ 56.6929 430.5757 null] >> endobj 2607 0 obj << -/D [2600 0 R /XYZ 56.6929 391.3558 null] +/D [2603 0 R /XYZ 56.6929 152.6716 null] >> endobj 2608 0 obj << -/D [2600 0 R /XYZ 56.6929 322.6942 null] ->> endobj -2609 0 obj << -/D [2600 0 R /XYZ 56.6929 259.9194 null] ->> endobj -2610 0 obj << -/D [2600 0 R /XYZ 56.6929 84.2201 null] +/D [2603 0 R /XYZ 56.6929 84.6865 null] >> endobj -2599 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R /F48 1238 0 R /F39 1161 0 R /F53 1313 0 R >> +2602 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F55 1336 0 R /F53 1328 0 R /F41 1233 0 R /F48 1253 0 R /F39 1173 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2613 0 obj << -/Length 3006 +2612 0 obj << +/Length 2351 /Filter /FlateDecode >> stream -xÚ¥ÙrÛ8òÝ_¡·¥«"ÄÁcÞ<±“ñÌÄñÆNÍî&~ DXbE"="e§öã·Ýà!ÓŽ«¶R5@£ÑwƒŽfþE³Ô„Bez–d:4"2³åöHÌV0÷á(â5s¿h>\õóõÑÛ÷*™eaËxv}; •†"M£Ùuñ58¹¼<»8=ÿ×ñ\ü ÏÁÇ“‹/'¿îò8“Áɇ³+JbX)\‹àâêËåéÉq¢ƒë³ã›ë_ή;¶†¬GB!O }½³nðë‘U–šÙ De™œm´Q¡ÑJyÌæèêèŸ ÁÁ¬Û:% -£ÒФ2™…ŒfQfÆÈ‘0LÆJ*Æ—ë_>}Æ‹Àr9˜(Bm`®;¯Z»«lKºzlZ»mh𮮚z×–û-“Su¨t,™ŽŽB—@:(Éãy$@âU³¿+òÖâ.\¦L%:sË.ò}†© •±Ž‚ãã›” A§U¾-—<¸¸"`¸vß–›²}ìîÅ„œÄ¡Ì„tg\=Võ]S6‡ºŽAa -¤nâ8ŒE’Né&봄 -»Ø¯ø¸º@}ù4È; -7÷ pÆ´»|I1Ý‘¹wÛœy–`ð J¸pÍæiW<¨Éž‰æMoÙ×óaÞæ…=poÒcGänSúÀZ³¥s&Äô™l´“²°K7Y¸S²zYÉQœx›ŸN)YC¯Ó•e^Ét£g”,¡W|•C ÐÒ“f!@ãÕ¥¹óñÕé{åô‡Ã‘þ8.N]PA,^6cV-- }ec3“¼ÒU”ȼ±ÎŸ–"Ó‡RŒµO -µÙô´\_˜Š¬ÉT¤a–píã ÏBZîÊ…å Á„/²!KÈTB¹dŠ{×¼¸ø&Œð_ôüQ/ Ò(>ÀŸñ\¦¢©‹:V´ >\]Í0`¤©o -`¾WõSöAá°V/G(ˆ„Ý–·V>+ ~Ÿfþ4x·ßóU üEQ iÝo&ÆÝæý Æ=ËämµÜ=úã|³ªw&¶4¼¹Ú Á"ŠŠ üòñäÝœ›0f}\¯žÇE<¬Ë%Æ H™´9 ¶‚8tˆfCA@FP¹áå²àSåš@Ö-… -èóÂ4V>ËÎWÏÔÏZúo|QÉWÌæ Ñ®êÊg>!B}(Øfp™f¾¬·à§yÅÆ}¾ë®¾6ãË -.>Ý»Ë#ýþql°î)Ü[&"¤âàEÏ¿Ñ #ß±ôoAÓ‚Æ3LtW~Ìë ¶g^0O
ôzilÆÕø Øt÷tßô“JÌB
QÞ³ú8ý\é$î_ì&:)š8ñ å¿°¼DÅ?:HÁÔÑ°ñï9v3£Ó= -L˜ÇÃÏ5¬lå `¿/r€Ä“j fo9ŸÏ#™„F%ùíIqeƒ|8p ø -?§Ã–‘f8¥%Š‚VâŸ$k™d®ðyÊ1¤ ØxW~þ ñæ>Ç‹kpb åóšO_ä5 ÍKíœ'†‡“½Ã¡D’4øÒ0¿tõŒIÂO’ Qœôß¼%²ã¸(›%´íùŠúˆ©¿sP&Ärtâã¶èž‰þï¿èÿÖC'¡JSÙÿyƒ<x'‡üy¦ðZQlYïþZâ)ïÿ
ÜÜìendstream +xÚY[sÛ¶~÷¯Ð#=¢Ä—é“Ó( 7ãc¹§§“ä– ™ŠTEÊŽóëÏ @¤É™9g<c.Á%v±—ow):IàNrI^ˆIV"*'óõE2YÁ³_/¨å‰ S<äz{ñÓ{žM +R¤,Ü/{å$És:¹_|Š®no§7ï®ÿs3™DoÉe,“$úãêæÏ«ßqíö²`ÑÕ¯ÓÜ&I’¥š/M¢w7³Ùô—øßÓ»ë÷_~¹ÿíbzïõêN®•úçâÓ—d²€#üv‘^ärò 7 ¡EÁ&ë !9‘‚s·R_Ì.þå7 <5¯†l!yNdβ€1PA¸HÙȲ ,Ϙ±†>ÚeLá˜Ñ¢é:5ŸÔ¶Z¾è£Áþ1—„KnXoʵÒË°/˜XAx&…áïbìù™± )´ ÒßÛF!¥y?' ›—}Õ6¸Ö·mm…Á!()¤dVOIZÈÌH›½4í¦«ºCO¤`N6I9#ŒÉ4d9 +g` u±„$B& na¬*h Ä<WÀ)÷S<Çã€1÷oÓ$#²H%ˆÔïÍë²ëm$ì›çYa¹¾¸ § Á_y*݆ªYU +ì8fó;^¿ºcÕlv}¼l·ë²ì›Q’qz¸mûê¶í¶M\ѧÀŽœ¤ðoû€wjõ¤ê 7ê7O}·”ÔeU«P8ÆRH»t •ï¦³_î®oï¯?Þø—Æ #AÑL‚å8¿àP<qjºTQ ¤‰Qÿn +ä +ãô †ŠQ*óü¼fž+ Ú0®(Œ ë6Û¨ù>†î +J8§ù+ p1¨ã2½´ iÎOÁÖȬiJ Ðçõó\Gfk +ñ6Òð^ÜY€Æzzw–ø óX/jgÔÊ´)"ºm»®z¨2áf ò¹48 &R’¥ ³¶€r,zõ×× +ÁRˆÈ”ŽÑâþÑ Y!£vcûƒÂ¢\7Ûj]n+ƒpz¹éU³0w}«¯iô ð~×¹'T@,^šr]ÍñÆãc@jetÝ1ª° 3¯ïÖ|#E—Ù¶ @ µ'ã¤3h
·MÛÄÚ¸èbC?™·MW5+|¶Û,ÊÞ(¤ –
æ`ðÔ—……³Pmˆ¦ËPJÁÄ1Ï2ŒCͦÀWM +ÃBfÊšyttÅ¢u¨Ð´×åW›úë©#@uªéì"ÚÙ¼ÐÄ{[[¤èNBGè …<C®ÓPá¹ T´!ì…L?êEF(¡< A|V5ÏÐm ¾À=ÀÓH¹û!ŒZ„5ÊhïÑ$º^ X¿óh½xs€ÄîÖOƒ´íÌ]h]¹rÚu»µre¹Åëƒ:ØÃéuÊú"
øyÿ
¸ÎøÏqÿ=½ê?ßðkgJXÚYÍ<W@µ±û(ÑÍþHµ™êkæB=ìV+Lb¸5š¶™žÕrh–ÎÛlÀuÆfŽËØìۡȺ2ð{V¤c +ˆ ÚfkN 9ù±ÁžSD~|ÐÚFR I>l$±y僎UDÏК"õU½Äú Ø`¡Ó9’äÑ_—Ê@ÿØî¼(·D;/WolK;’$|Øk؃x‚ÃÉ1ø¡òœ2W¯¹W^/Zå5ù\Õ5R–Ñ Ã¬½àµtL弯ž,£=ˆ(²è¯GÕ8yU‡ž +¥¶¦w@¬.¢j‰WÆÅÞIiâ¤ù:¼Z8*öÞúá¯l΂ç,ž»Ú‹óuPݦmvѧpÓÄáhÁÎôWd凉*ˆä™cT¶˜0ÿTìfÐQRÝOŠv^ÓGrÿ@h& ƒ*Ä°¹ å;94ê¯ÍC®Óù%¾ŸÊ÷³"}¾ ‹ åûHäõªiÝÆ…E@M|˜}@‡.к‰qé@ê£^hììÕvm[ û^Ø ¼je tØê«¥¹n~̦î¡ód„g²Ýä{Å6ÆyäžùZ©o,@Jycpáò‘c¿fÞËnŠñ©ýjJ8Õ:U/c|‘zA+ 4ñ^Ó@‚cÊn@/üÔÔpê×·ÍbÜí +Lùé] I`hòøà˜‘Äsk +p1h°=œøéB÷Òà@°ÅÒÚ®éC-¨åôÙÃü°æsØæÆ8[Òžøír"’ãÖÅ‚î|¥ïåþÝLZ€e9ž®´XÝ€BUÿÙUþDæ-—¹1kîlð‘Åî9ˆýØÚ ¨»âöªUÙõN¾}v@‹Ã‰ùª¥§‚7¸‚[¬p‚\ÔJ÷z½½¤ÑIŒ6 0ÚßçÐ]ÉÞLP |ÅäƒÞÇæ-c>–ô²Í fó‚
ê¤^{Ák +胃ã8 (‚UΘ]¯øJÝ™nX/
ÂÝpÀ Ý@^5óz·PÝáË# ¢ Ÿõaýè.¼ +(I¨àçe{®€ð‘™$…þ¸8’á°5ïóÙáèåjXè+´H€Ö ¾G¿L§øæÕï³'~¸9þíü¨?üäú“Ï|•C3ç$/|¸¼½¾y‡’ ++p¡ëv×oËÞ…öò¸>·ú£lve +Æ4',„ÆíC +ˆhê¾»÷ö;±H8ì'`Xþ‹9õ« —DÿÔˆ€ÄûþEoÿÓ¥È`\ÊO„O`˜âuJiÅiÊU÷¿ý ëþ_& +¸endstream endobj -2612 0 obj << +2611 0 obj << /Type /Page -/Contents 2613 0 R -/Resources 2611 0 R +/Contents 2612 0 R +/Resources 2610 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2592 0 R +/Parent 2609 0 R +>> endobj +2613 0 obj << +/D [2611 0 R /XYZ 85.0394 794.5015 null] +>> endobj +886 0 obj << +/D [2611 0 R /XYZ 85.0394 769.5949 null] >> endobj 2614 0 obj << -/D [2612 0 R /XYZ 85.0394 794.5015 null] +/D [2611 0 R /XYZ 85.0394 744.5025 null] >> endobj 2615 0 obj << -/D [2612 0 R /XYZ 85.0394 752.2432 null] ->> endobj -894 0 obj << -/D [2612 0 R /XYZ 85.0394 714.1831 null] +/D [2611 0 R /XYZ 85.0394 712.7073 null] >> endobj 2616 0 obj << -/D [2612 0 R /XYZ 85.0394 678.1164 null] +/D [2611 0 R /XYZ 85.0394 647.4522 null] >> endobj 2617 0 obj << -/D [2612 0 R /XYZ 85.0394 646.3846 null] +/D [2611 0 R /XYZ 85.0394 576.1287 null] >> endobj 2618 0 obj << -/D [2612 0 R /XYZ 85.0394 581.7132 null] +/D [2611 0 R /XYZ 85.0394 501.8403 null] >> endobj 2619 0 obj << -/D [2612 0 R /XYZ 85.0394 499.0182 null] +/D [2611 0 R /XYZ 85.0394 83.5125 null] >> endobj -2611 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R /F53 1313 0 R >> +2610 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R /F53 1328 0 R /F55 1336 0 R /F39 1173 0 R >> /ProcSet [ /PDF /Text ] >> endobj 2622 0 obj << -/Length 3862 +/Length 1956 /Filter /FlateDecode >> stream -xÚ¥]sÛÆñ]¿Bo¥&&„û7%VR'µãZò¤Ó$ ™¨I€!@Ér&ÿ½»·{‡ªÛŽGÆaoq··ß»Gq Ã?qnld3™'™ŽL,ÌùzwŸ€¹ïÏã,=ÒrˆõÍíÙåw*9Ï¢ÌJ{~{7X+â4ç·Å/‹o"¡¢ X"^¼¹yÿöåÕE¢·×K)µ²‹«·o¯ß¼|õx71 f /^_½yõ7‚½½Èäâêû뛋ßn8»¾
d
I±Bš~?ûå·ø¼€üpG*KÍù¼Ä‘È2y¾;ÓFEF+å!Û³›³¿‡³îÓYVˆ8’ÊÊ^H9Ç “EVIåx±*×ù±-á\©Xt7‹v“ .Dº( šhË5½w4_µ ?î÷ÛŠ°ä"ghNu³Ûå5Ïm«š7¡•? weíW«ùƒm “Ô•Ÿ:`¼ŽA0¿Û.¤Ù/u_µÕj[†U@À’¥QfŒtç£#Ìšc·?v4¾s$4;zÛ·¿ÆÀ5øO0ꞎ.xæô -’[뱚Á)Ü!È#Ú8Š¥JÇòC…*ª6_mé8Ùà8#¾[¥`ÐÞQOO¡Êd‰
¨ç´dŽ¬Ì4 ! !› -ƒœ ·`{4"å†Á]s¬ÙÿTõlD‘€äYqyŸ .ÇúÒ…ÖËÎ -TG'¢¢1@^"OxDK†„äqÔó
@ì/e?à-gÝ#¤ª2z3‰Žº9¹ê(Í„w„%•AÐ iÀ\VPŽìò¶CÁ"øsƒÉ6Ž6˜“ã -–ðˆÞL£#o¿åÏØÇH -þˆ„±ÛU -êT¾¹y"²pßÏK_ª -˜{L¼©ŽÂ… !ÞѸhü.\úJŽvÍ}U”¡$òÌŽY7׫K"©½ò\±/‰´¹D9bJYd‚¬À¨í-SДûjíªxåõÎA½þÀ'#¦À»c - õL!xÅOÈW
å[aBv${vrÓ>²„HÈ|NœZgQ¢˜xå‘,UâMH·Ò -:HíS“øðPÕ…ëµ´×ë°ÏD16«éú=ý¦9n¼b*9›¥há#C }4§}ÁÃëQ—ˆÊ‰F›MÇ 0¨ÚoνíûCÑ5ˆT‰Ñî³WoÞ¾¿¥o¾ûéÝë+¼1»ï+IÅZè/¹‚¡2¼‚ià CXzê¿™Ìë;^%85R–…–ÓKX²í@ùz™ø]]v/®s— £±†{/Da7eH]MÏòØ5¹2öý -ûÚýP 7?]pìzi²¿·B`¸{ôKñžþ\ì/ ÐÓM£…™&×Íñ˜=¦/ªœ±{2`à[ÀzÐw2˜V>Ý.K# õ%êiÁ¢„öÚñ°){‡3Ø»èý¦ ¸Kó¤cn \ÚeŒsØ·IÍÍãÔ: …$Ÿ&Qlõ¤'7l¬ùÆó ¸¾x®S ¼ú|ËÜ÷éŒ/O•ç ‡ŠuqbÅóþt€tÚz¤þb‘<{Q ¨
rÚ“jkõ³Ä¤§ÔȉO0:IFä° •IL~T&b ÷d&1•;Îr*’ø.ÀW§cÿ)‘Ìp#àOÿ%¿ˆƒå¦[ 9} -û8ó’á§o Üfz%Ç.Thr¡BýGšÊH‹ì‹ ¨H’±ÿÚûO¡þShÏ0 ºkßé¯1h¢ )3â¬ñw_5AWã¢Qs×0:õƒ^e"üîŒæÄ¡ òÿØ·ÿQ³Æ¨žÊy ”‰‰àcë‰Bž kŸš ÿ,ø)íÿ_uÌ.endstream +xÚ¥Y[sÛ6~ׯУ<!¸ƒè›ã¸»ã•¶3I hŠ²˜J¤—„â8¿~€ ’Ýñƒ +‰¤¦zª4G1Ͷ<½‡g¿LˆÇÌh>D½YL^ÿÌÔT#-©œ.Vƒ½„“„L˳7ˆPt[àÙõù —oç¿^^üëâÝõÏgs¢ã³ó››Ëë·WŸÍ©À€0Ƴ?ί?œÿîÖnÎ4ÿry{öyñÛärÑi6Ôž`fÕúÏäãg<]Â!~›`Ät"¦0ÁˆhM§Û ÎXXÙLn'ÿî6 <m_²A0¢LÒ ”L AZ:âCh$e- ç ¿¾{op:`OçT"&`Ñâ®J“×en ·OÉ·›\TeSÕ¦Ømý6 •#Æ%õûp†¸’´ã ˜Æ@i™nóå<[çÙ?YU®ìËÍ$ÂR©}
¸n #¬±³éþFVŸ(UnÔ>vCxü cz¿«SST¥GÂÊ&wãæ©4é7¶å½›™ªÚôçëYµº$ètºÜ>•ÕCS4û®ÁR‰dS!¤Ö1S8!`ì#vFŠ ƒÁ™9‰x}‡Š2$ÿóõç0úÚ¾t#㎠+õ»S¬%B€JvßeQ癩ê' +‘¤‚x¤ßuUlr«LñÐIûþ9Æ.ø C ÇrÌòÛËÛ‹÷W7‹«w×Ý[G]7âg{þ”@”1¢½ª-|›123ëÜ‚c¼‚‰ ³»q«eeöqù6-M‘5 Z èI±‚hàÒËu~z¨ ãˆ&²Ónß…íîÞ…ÉÌf+Ag §N÷ UÍ9%I9ÒœñéÜí(}HëƆ #t––~ÐRVWUm¬ådÙ8±Ó¼®ÏH2«êöÌTÍÒMe£Æ¾óX˜µC¥›[r*5nR”Ùf· îžüªsp-gW+÷rY
ßõ ¿Eóg…}/_EÜS†¤ÜÓ÷:7ÙkÇC÷dÞ9\°:â(’"*eðþÂ'ÀöøyêsŒ=„ý]æ«t·“´Â›s’ D{7¾®Lþœ”%CV8xSj"þ¢ çqò¼·ŠƒŠA5¿qQºß&s§&w³ÖôÞ¶pp“3);ï²µ¥M„\’(¤x§S].3ôOþQK`ð9\Ý:Xd7j0wE¹´›5±Ý‚ªÎ<Ò뚺Ã:umd:+Hˆ œ|dåtgª-PniŽ&+ÚÙÝSÄ +*ðiK QÇMÑ¡Z[|9°ƒ®FéÓ"("rd
è°fc‘󲧾ûz“ö<?÷Œon]òûRíê2øðúÂtY©1Íq2¹G„?Cæ +ĺÆD’á¿/èö##…DÊظ}8F”!M0 †ÑÁw*×z¢ÆmûûËŇ÷×Îkþ<#p«;ÿýƒûj|ì‹ùŸJ¨scNÛ„ÚWPßî˜Ôìšq*"cY:ß«ÑØo nP?MŽŽ}gЮ±è}wDþßßËû
p…˜”Q'§JØ»¨ JY‰ä‡!í¿¬ êþ_Hcð£endstream endobj 2621 0 obj << /Type /Page /Contents 2622 0 R /Resources 2620 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2592 0 R +/Parent 2609 0 R >> endobj 2623 0 obj << /D [2621 0 R /XYZ 56.6929 794.5015 null] >> endobj 2624 0 obj << -/D [2621 0 R /XYZ 56.6929 337.8412 null] +/D [2621 0 R /XYZ 56.6929 751.9581 null] >> endobj -2620 0 obj << -/Font << /F37 1026 0 R /F22 961 0 R /F41 1218 0 R /F21 938 0 R /F53 1313 0 R >> -/ProcSet [ /PDF /Text ] +890 0 obj << +/D [2621 0 R /XYZ 56.6929 711.8652 null] +>> endobj +2625 0 obj << +/D [2621 0 R /XYZ 56.6929 678.3488 null] >> endobj -2627 0 obj << -/Length 3120 -/Filter /FlateDecode ->> -stream -xÚÅZYoÜ8~÷¯è·miOI|ô ™ ‹Ý {0 dò w˶nÉÓ’íxýVñ’¨«íÉb,Šª&‹u~E’(ü±U¦Z®R-‰¢L¶‡3ºº…oïϘ£Ùx¢MŸê竳Ÿ~éJðduuÓ+#4ËØêj÷e}ñéÓ»o?üû|Ã]ÿLÎ7ŠÒõ?/>þzñÛ÷é\óõÅûw—ðÊ¥H€ˆ ¤Kèúã察Þ^œ§r}õîüëÕßÏÞ]¶ú¬3*§?ξ|¥« ¬àïg”©Õ¼P´æ«Ã™T‚()„ïÙŸ]žý+ Øûj~:% -%2¢2žNÈB‰ž,…¶LV©Ò$\YÜ×ÇWñÓ/œ÷hyB4LjH¶yu¾T¬óÝ®l˺Ê÷ûgÛs]ØçCSìl«íósߎç,[<MÛ`\oëƒûvc>Ö7¾}4÷ŶüR¾µïÈ"È^&zýáÆvUu÷Éõ< ®‹£m—
®hµ±‹Ø0F´Rܬ%Œ]ìÞXU·w…m4ÏM[ lû©Üïm+ošò¶²íº*ÈHã”Pv•²”¤d8i¬ŽhÓ§2 -âlÊX=rü ˜ÕN*Ñ
X`J‘„I¹ÌC š`¢¯y–P¢´Êb..ƒÜ@‡<Q ¶¼Å–\çFTÐõp¿Ë[ÿ=·jwĵ%½vï‡|}QN @b–kì1²].^g’}Q ø—)É8M !ØPÒØ
Nv31¶&ðÝzÚ!” DM +=Uk
M€æ”Ìtlk%Š"Óë{käåÎÝW»Jã‰ç¸j¬ §–&Áž™t„ÎFa‚¼fî[û²+Úâx(ÑÀ«,4¶õѪdëa!MmŸnbÓ¾ÎKc³®CÙq7N}Ó}6Ò`”9s·Ò°A·¬î ÚY÷IA²4]öž Ѽóx"¹öà¾ÖyLsÎ{T*Å" hÌÃÈw”J"&ŒëÜ<¢Í®¸É öm94UF©Bߤ©2!ˆÖÞ ìòÆv"8)$ Ú™!Æ·ùÐ7fÆ6Ëf’‡„¤°J7ü‡ x7ðN8§u\Ž -•¿ • D‡8!ÍÚ@½Lx8¾©gÍBÿˆYÈ4à ¼l=¢y£ðDÈʱÈ÷®„ýbÛCÓ -Ø¥„ËPF s°Û£]7 -êU¡N,I!DÉSÅhŸjA¯žj¨Øç×(Vhš-³¨&øªV¤Ð16Ô°º ‹[i’fÙ ¥’$ÔRÅúwªè]î^ÂÓ˜’\ƒ×5í2ÛRؘ2+10«7.¿¼Ì4n÷CK}3(ÐÚ€
6kP¶ò?´{Dóà‰Æž}<6E;Ö¿MÚfóåkÇíÈ,P¼ -€ô§hÌjœ8I„T¯±MpÁ|µ --vá9VL×Ûù;öyýcÛhÃŒç~ÐÓS;¾w\}mä…±˜&ÞLŒ³‘ -glFáû³4Ãù+q‰¤bÎyÑ©f'œDCGvÄ3¶~:bèìKéžî(™áAzµËdÄOÅww8bGqþÝU›·v1s`²?Ð&͆˜ôoÎ Ë b*¶ÇÏîRþ»˜ú”ƒ8q"ê÷¨¢¾§ÂéÃá»9Ý¡= -úm»ÿ:ÿ¿t à‹Ë -endobj 2626 0 obj << -/Type /Page -/Contents 2627 0 R -/Resources 2625 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 2592 0 R +/D [2621 0 R /XYZ 56.6929 642.2811 null] +>> endobj +2627 0 obj << +/D [2621 0 R /XYZ 56.6929 574.684 null] >> endobj 2628 0 obj << -/D [2626 0 R /XYZ 85.0394 794.5015 null] +/D [2621 0 R /XYZ 56.6929 512.9737 null] >> endobj -2625 0 obj << -/Font << /F37 1026 0 R /F53 1313 0 R /F22 961 0 R /F21 938 0 R /F41 1218 0 R >> +2629 0 obj << +/D [2621 0 R /XYZ 56.6929 369.6295 null] +>> endobj +2630 0 obj << +/D [2621 0 R /XYZ 56.6929 83.999 null] +>> endobj +2620 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R /F53 1328 0 R /F55 1336 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2631 0 obj << -/Length 1965 +2633 0 obj << +/Length 1920 /Filter /FlateDecode >> stream -xÚíYQoã8~ϯp/ ¶Q%K²å—²ÓÌ\wÛ^o›ö°»®í$Æ$v&vÚéþú£DÚµ'-îúx( -QERä'ŠrÄßjŸù¡ƒP1Í… Æ› .aîË@Ϥfš´¹~œ.?Ë`²Ð÷üá|Ñ’e7F çÉï£ ™l "øèîá×û«é8P£ùl<ñ<%ýÑôþ~vwuýô5fàä|t;½ûuzƒc÷ãÐM¿Ì ÆÎÌæYmÓ—Ö¦oƒßÿäÃvðÓ€3=|†g" ½áf ´dZIY¬ƒ5[³niŸ+”6L{ʧ(ø"ìw˜`ÀÈÁ¿ß8Ì}«¹¬Ã¢¼|Nw‡›5!“ -6Ùx¤¶fêQëµÔ‚¿¤ÖuÔ^eåv ½”èôj•"AÖ@ÌØ‘ÿi“˜ …yÃ-®3ž¨¹¬IIú¸_ 9B3¨ð¼Öš©GkÇœ)í{]óqÈGû]Žû/¨u¶,³|éÜ0œH ѨLDK=ôáM–§äÀǘsàÇîsVÈ¡Ø”é&‹‹u->Ú…‘Ïãb³Ióª¬#ôðd˼À~â,rþ‚…Z{vk *˜ïûÚY6ûmz{ƒgèÀ ÀéÁö=Žœsy#Gé÷h³]»ýö³.žq¢\!å,Që~(”Çt læå~›DUÚ£Z)füÀc\ì× ªxLQÁ¾Li¤*p$ËËtWázˆ$]§-A§”ÅÞ1mGctYB{Z¸^±!
«C+LÀ”ò4PΟ˜ÇÈ ,vü ýUä)¤+iüÑ]QeN W«¨ª)ÊòíÞù@âPÅ+¢P.vâ"¯"Ø"ö"’³‹²5" $<®£ü+NÀ +‹Cår/q‹ûÛ¯·ä¹-‹W¼/Ë ˜•€C.ëASÉK †±C!v4®ÿ¶OKZêb×N*›¨¬ ©8„4ºvOõè¢ ¢åv¹]ðJÁŒ -ðìþm<ñáúhCîpÓG–Ú`K×ð±t±NVEY±N¸íÄô¢$!#Òç~IÆWœ×B]# Ÿ &ºJD[ „"é?¾mLóÀ$—V´mŽ€/¹‡Þµ³½»µ
lýyf¢|âÉ[š¼M8Õ(êu†p‰±Ç³×÷»$¡Møkù -aÙ0:¥à”ô‹Áúeâ¦ÚØ|5ÒŽjhSj&ÁIô‚Ä|N•È \s - âŽkR¨øPhnwé.ýFìß“bÙ¬ázYüÕž—ŽO#¦ –}2qùénz;#Ø›ô(t§ J1@Ÿ¶:edeV½¦Â$«2wAÚD–ºû¨ª^K™Ã¦¿:sØéÛx•Æ_ë”Üd7˜ˆÚœö\ °òøV—@ {蜦—mod)™^ï[ÐJ5ºvÙ8ìØ+ÈÆ èùM -5„k®-àÂ(XMb
¬Ä“bšŒ û(Òz¬ ¥é÷¬¬HY„!NîÊÀ¬¨-±Ï¢âB]¦€}r.P\€z^¥6ÎFÐMÁ#±Ö6c•q”£í–.ò?8—Y\KÅ¢ËÔnñPp-'e·½P{ŽÎn ¾u×±O·5´¿|þ„<3Rd;P6äU 6û’¦Ð2 œW‰½¤ÖaˆÂÜ‘GÙÉ'H¡5 jÛBË©Ø8ç1¤mÖÂóæ4àöz¢éÒ ôm©gƒa)™Íå~Ëaôêîáaö éŒ8‡,ái©‘²Ñ¶ÑÚUŽV„3«ìN¯¢§”düòpýå¢Ññóìß$ ' î¬Ú ËÎ&³ùlM¬Ü²Ï×7=Jz¯xPÄJîëóš6—{^(Óó¨i¸¬ÖË´Š/w_ÖOpøóÅ¡B³Tò¼
×± ¼+tÀ¤Ð~×*«[¥Y–@¡—-^êÇÎ"Ú¯«Ú) ûš2Á kqñXÍå<öí.wûüÒZ’\–P -ÀµÀ¾¦/‡¦xjÁÅy[®cc:¾óDÀx(Tך2ßÈ wÍÄHY»Å,øÜMϾuGëI‘¯‰sS$é)ÿŠÀ0_ð7>8´¹Nû·á²;úÏ -l´ÅÈ ðéa¶ ê¦-I±ÐY?ñ,DŽ…x’…‚+bZ¾%…ý`ÑúC eK)ÞkÎ2)r¤†÷¦ÖoT[Ü 1n˜ðà²8Ž†ë8 “LpÈG€<Fe:ñ=€ò¸Hšïõ“í ·ÓO“Û+}€´S!&m÷¢>Ñy åê—iîêئlíÅšòíç7 öÊtiÄô Úv—=Ñ£ 6é1.µ:†é( ]¨IÈfÂ7ˆ4Hai¶g‘fÛW¤ÙžCš%:H³4qi‡÷ñDΤ'Ãî½ü0›!h§7ÿÄuÀròƒg¡Áaòû>2^¡ô#W_ôÔL]®jÄI΃—ˆúHqFéç -Û´ÎVÿµ8ÿH\(Å;ÄÁS¸‘4¸»À rb«6&/èK®§mê
ºï€÷&LJspàí=ç“7ˆÿŸŸxý FAUgŒwâ¤Tí'i2Ênþq®ç̃úºÇöÿ +xÚÕY[sÛ¶~ׯУ4sˆƒ+ <:¶Úº'±ÝHvšæ)› /IÙUýY +òOÞ&²žlÙâ`Wvyfï«ÓÞ×›4>´1宼ù™í«OÊ‹’2^BiÜ ùT]¡‹3ù2¸à꺂âÔÛÿ¯°öª¥~Ðã Æ_±5uJ7Ágžº¡8X T3†å÷T Žˆ#Èqu*P·RïÖ WT A´Eâu•çòÌùñSÉ 88ûA? ¿UtrfçÿéÅëŸ_lÎVì¡ûˆ"Ø=´T'-ßV&þoÓúwù5Ùü5æ 8uHŽ(Qä« Ð^J:Ù‡KÄ^ H`®úmÍÕl~ùþúnq}{Ó¾t¼“î7};Í 8ÃiÐv šÓ4šlR?š OªM^‡ÙÁ0ì` êCÙtnlR¬šy;ëš=Ö4{hê1J&×µ |ŠK%÷XôÐÖ> «?“à%uÉÅø9à 4ÃR´ÚÙ|Qká’O^ ãÜRiF¶Å”Ö
iÝ +r(4áÓ€w®;zaG X¨GŒ}ï•€]份lÁ5I–¤¡ñž@£? +r€¤\}=Êà4¦nûëÛ +)'÷ëÚêKj«*L_ÂMcC´ÎžÒ†&Ì;èÍmD çµc(š÷óŸâ¥ƒbÎvº“D¯ „ªÇ°h/Böz;ÚG-¨ÇkO:ƒ`rEIy˜¦›)!D»Åˆ2Þ!OOi¢ÃȪËdYÃÚ™)•Hãç8ìðýÆþFñ*\§µ–Gõj˜Ë0=aÐoitÜåQwOëúI£Êìª$M-u Û_ˆîÈRaÕüæÍï²Ö·l†¶(kª…†ØéÞ¾ß „… +™BœH #¥ØöÖΘN~3 @‹ÎÌu_º±Oý€(_’J_xÁYÚ endobj -2630 0 obj << +2632 0 obj << /Type /Page -/Contents 2631 0 R -/Resources 2629 0 R +/Contents 2633 0 R +/Resources 2631 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2636 0 R ->> endobj -2632 0 obj << -/D [2630 0 R /XYZ 56.6929 794.5015 null] ->> endobj -2633 0 obj << -/D [2630 0 R /XYZ 56.6929 638.1898 null] +/Parent 2609 0 R >> endobj 2634 0 obj << -/D [2630 0 R /XYZ 56.6929 273.9392 null] +/D [2632 0 R /XYZ 85.0394 794.5015 null] >> endobj 2635 0 obj << -/D [2630 0 R /XYZ 56.6929 96.9537 null] +/D [2632 0 R /XYZ 85.0394 752.0294 null] >> endobj -2629 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R /F48 1238 0 R /F14 964 0 R /F39 1161 0 R >> -/ProcSet [ /PDF /Text ] +2636 0 obj << +/D [2632 0 R /XYZ 85.0394 688.0859 null] +>> endobj +894 0 obj << +/D [2632 0 R /XYZ 85.0394 648.5014 null] +>> endobj +2637 0 obj << +/D [2632 0 R /XYZ 85.0394 615.2083 null] >> endobj -2639 0 obj << -/Length 2606 -/Filter /FlateDecode ->> -stream -xÚ¥YKsÛF¾ëWðª* σ£ly½Jm$§¶ÊÉ"Ae`ЊþývÏÀ€ åªÌ4zzz¾~’Í(üØÌ(BE*gI*‰¢LÍ–»+:ÛÀÚ§+æih1¤zÿtõî_"™¥$Õ\ÏžÖ^†PcØìiõu~óððñþöî× ®èü=¹^(JçŸoî¿ÜüÇÍ=\§|~óéã#¼J“J bé4ÿvûáúϧ_®>>uâ EfT ,]}ý“ÎV ù/W”ˆÔ¨Ù ¼PÂÒ”ÏvWR ¢¤a¦¼z¼úoÇp°j?R†(Ó p6cŒ¤JñH *%Zpa•ðþ˧G<óÂè @Ò4á–êi›ƒ -@O×lþx÷ɽ|Ë_qÀæEã&×ÌÌóÕ±ZeU[úŦý¼#**÷lÕKíÆM¾ÏYë7ùƒR^æ°Ü€®¥P°}ØÁ=Ù<s¯Ëºjò¿ŽyµÌÝ|½v Usܯ<C6?6Eµñ»ÂIà¸x@§‡…ÛÇ'wåeñ|ȯîe
’ÛAÑ6n°<¼îÛzsÈöÛbé¦ê}¢ ÉÏn"«Vn°Ë<Ÿå6«6¹gUyÞÇöèôâÞݸ̳&‡c»ë“DHÍý•HN´NŒ»8€âõ‚Q€ì¡Z-á„" 0 É}¶ËÏÜmJ¡,‘ýØJðç‰Uø¡ 5ùá{î• -ª™–.D£Í;šà¬<ÓÌo÷’ù}öî@ß‹•
T0S„3”~âýÝýõ³ 0%àJxŒàØ…Cä2ó»õ„ðàƒŒäAøsD˜ pöˆô½þéKÑnÝtU‡pè°a'Ë¢òñ´ÞÛðä¦mHƒgf¥Ý wyÕbäØ·îƒý¡¨ZOŸ¹G³EótÁú»Ø‰ìÖN#‰$\P GU‡ - #Ç=šw¾ -‘ÄÊÙŒâeGž}ÏŠ2{.óaƒü#êÂG¦è,däˆÅÔE•Ã Èw»cU,!‹€E¢¼Âqd%‰ö€Æ©)q\w£Ì=ž><8z°œ*_¶$7uZ—4/«•ÍO²Wýü;Ubå¡ç…Œ ç«bS´èd*6UÒ I)æw•£tÚªåñà(ªÖ€ôM -«°Í± æ°æë2Kà$óUÞæ‡ 50½_ܼ[·ŒÚlÙúÉ' †<¸vdº„»ñ‹ Õ¸ÜY©3eŒE]tpµ©-ݼ·õ±ô‹G„楪Å%N¿Úœéñ¤Ê÷%O frær]2¤ -Eùi]ÒQá¾]1¢†~’“*q¶JÈ`wÍizYÄŽjBÆ8RDS˜Š„üÒä‰7§€ju¡dŠXƒÝ£B ’Ù¨ÇBtåö{„ç2w ÈȹOé|YÂÃ'là<=¯zD0²$TD)cd ¤ÏDz-öeW´7mV-óf˜oøµ=â¿ír›`ºYY:[@ãm[×€@ï¶ö~ª¶!{häwßå(É)í™ taIz]ø†Á$F¡|S—1: º€Ñ@e1ºœÂ(…$)k#€jF(—â²| Õ„€@µ&”Œ" §ŠþQæÏTÞ_`»EÐÉ|ÉN|$ë{WvŒ¨Ïê^ðÞY*úÏWù:ý<UóR¸™„)ßåíò :s‚òN™QÔy8*á“sÔ ª `T ßÞtXÃfD„)¡TWò²p Õ„t$6¶t‹w i"ùd³$bŠ-#™¤p Òg.|¤™.<rÑ_=.X“ç!üÁÄ…«gʃ>v|õ>‘É–$$¡Fw7©1óÝZØÇ‹†âLl¥ ÂÄþÃ`'ç!û! ¸ÄQu{^ -ÐzjXù¥À|³Äågð„x»r#ë á9,lpFkB–„lpð…S ësN ë~q"%‚¨„ý¨§L×µªs/HU·A)ŒHŒ*‡üï¢iÏ Så7¤:op •5¸æMïÛwê"sŒ0¨:.‹ÖQʛЄ±$‰…öã: -;‹s=4riH -aäzi ïíÂzôMûú ‡»¬]nsÿQvJ -ѼÍw¾àMý_¶€•…»v
êg*o=vûÂôn_—”œæ膼Q.ƒÑÛrB6,SlñàF]›Á¸¿]ì Ô½eaKOxs"…,Ê ºB8‹]!ì;°ÐÄ€¹mmk=Ã}n'±ŽÂ©ð‡É‚QN˜ 5 ¼'[Dÿ”|üoG—ãD½œá5 R£3-?u™o¨Š-’ÞäÇU T14¸ªA)‰®ê¬=§Š¤Ü5vÏ›ó€è¼5"kÌû7£gèG¦Ì±¨. -hN…Š¢&‡ê‘ëXªÇ¼šìÖ…üÖ¶´lþÛõícßÀS"’®kÓSÅ÷¥‰¤ÁC÷As -endobj 2638 0 obj << -/Type /Page -/Contents 2639 0 R -/Resources 2637 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 2636 0 R +/D [2632 0 R /XYZ 85.0394 579.3639 null] +>> endobj +2639 0 obj << +/D [2632 0 R /XYZ 85.0394 512.4986 null] >> endobj 2640 0 obj << -/D [2638 0 R /XYZ 85.0394 794.5015 null] +/D [2632 0 R /XYZ 85.0394 361.0478 null] >> endobj 2641 0 obj << -/D [2638 0 R /XYZ 85.0394 752.0715 null] ->> endobj -898 0 obj << -/D [2638 0 R /XYZ 85.0394 700.8318 null] +/D [2632 0 R /XYZ 85.0394 218.5873 null] >> endobj -2642 0 obj << -/D [2638 0 R /XYZ 85.0394 667.6704 null] ->> endobj -2643 0 obj << -/D [2638 0 R /XYZ 85.0394 631.9578 null] +2631 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F39 1173 0 R /F41 1233 0 R /F53 1328 0 R >> +/ProcSet [ /PDF /Text ] >> endobj 2644 0 obj << -/D [2638 0 R /XYZ 85.0394 565.5242 null] +/Length 3302 +/Filter /FlateDecode +>> +stream +xÚÝ[[sã¶~÷¯ð[虂+ ´ÓgãM7Í:ÛÚm2Mò@K”ʼn$:"µÎö×÷ +š]RøŸ]ª”¤†›ËÌH¢(S—óͽ|„{_]0O3 D³>Õ÷Ÿ¿Ù¥!&åéåý²·–&Tkvy¿ø!ù‚0A®` šÜ^¿»ùröúÏ7¯ÿòÏooo®f,cœ%×ïßßÜ~ùöû«Wè˜ÒäÝõí߯¿Á¹÷W†'×_ÝÜ]ýtÿõÅÍ}ËYŸ{F…eë—‹ ~¢— ØÄ×”£Õå3\PŒᗛ ©QRˆ0³¾¸»øk»`ï®{4&
©4Q\¦ N´‚½GeÆHÆe’‘TjÓÊŒ³˜Ì••Ùln7úù¥z”Œ.@ôÔ‘Ì×y] ŠÃ¤D3./û¯<b,Eãƒ×Á èwÀÙÝS1/— Q-ͪÀ2ã†ÕòàÞ¿ªm*Œ&oý½mÕà ¶«ýH)/¯pæGÎåÛ[û/^—~YX¿)ä +D¶úŠ +Üö@@<K‰1Fú[--÷ëµÓR÷ùæ0ÌLÀëTÑE±Ì÷ë†ìUdy)Ákq°úÌrYn GÞ’2fÌ?[v&yJ˜5W QŠ·Ë¯«y>ƽ`àZk‹²KŒf}nÝr§Ø5D +ØÍ·‹ÈÂÌ¡²þÊ[Ð蟜¤* *qöUÈ>µ[†ÒÝ|çz¨U@³ÊøùJm€x²¨Q`ïyƒPz÷=Î Œæ•û]ÔýÉe±CÚ¦Âék¼¬vþþ‹-‚TJU³BŠr; €WN ¸Ò¾™UK¼ãD¢ì. ÀØ´ÃÙ曢¶ôNjDJZB@àúPÝcZ( dZm×Þc‰Ùñ; ðŽäd'ŸWå|Õ¿ïDæ kå=cØ·½h7 +\OÀUš,Šuñ˜7eµÅ;·wøÙ¨î.õ»sžÁþT~Qq¼Îu¨°W=Á¤ˆ +· ÂÃ!#"£j‡ +Eë:Ôµ])ÕêÖñb +Ê IiÚÓqSüÚLá–Åk)ÿ¦(–!í…¬oæ»üyì t÷K‰TdØ<Qhw4ã0ñ4$obýF„lÍp %‚ªôS-ÍWCŒ@r¨!øõØj"˜ +qYµ±c‹ÁMÈ.žöþ&bǽN‡ëo©ä
°*ÀðS%Œßµ
0‹™³ÝÆ ðÁ÷QÞÕ©3!l–PÖøÞEUø‘kºØÁ<ß×>N +‘
õè0uÈ·Þ(Š¥ï|™Gó~».B£§ôF²ØožêQ;™WÛ¦Ø6u4æõZZtvc/ÆíÆHГäç™ â¥rÌnÜ›¢v“Z_ÌYv/1¢å(ªV&3T—ûÓíÈ‚’©ÚA§’¥![²,×M¨½Dðé¶ñ#—LÚÍáÏC¹Íw Qç< @ „ÍÖíe© ã`—?• ÚîF÷LÙÜ2²E.I&ï#wDX¦HLô}yv®¨ Õ¡<詳²ÙFDâžÚýAºVcM’¡(ám8ð †ò @–)OÊ¥—#Mm–uP>ÜÂFb"¿Ô$õþÁNàêF¶ÎÁŽçùÊi×öó8T .•‡Y´Kt€‹js#ä&Óg)#„ ?ZÿÚ
º…¶Â·2±1Ølw€³ë"\ðÉäЃ„³üUùYâU& sñ=LÀÙhô6 ÓV&ãWŸj<‚µT.†ý aÚ(1Ñ)6°„Ñ'ø +D¾âŒÈÌ ð:Å‘&%”µ¡Ã˜ 43¬xãö–ÁÊŒ 6€4KžK׌Ñ<¸#Öy8±ÌËõ¾ó\Ì ô™Q9ˆ¬mGÃrSíh™îoÀ¾a„ó™„< +ÁÇûÇåâÌãr›† ý"<Ê <¦„‰L‰GÐ §f´ð•c…ïLd”Hš‰ã¶ê'A&x?c“Îidö¨&¨ 2·¿+ýžä«M¿ùŠ¥ß¾º.£Îå^±Äy]{íŽG„ˆ Þz]Kðà;á×uòʾcî*7Á½×=j´ z][ÍõZ—"xÝÁ“±Æ»"ZSé»O ;#FªO»~ªœÛ¼À¯+óÿŸt³L@5¥È¤aö©Æ
³¥r†Yîí‚F”ŽÒn‹´”šiæZªwƒÀÁ)Ñ$1`ï;›†îʦÀΩϲí:¹Âå7nrЈ„ð“µ?ý= ö¨ Aæ´kyÍÀfì·pÇKÚæ¨2òô’ ØvHÊ:¶¸qÖ†‹YÌZÏX€vƒålö9Hsn;U7 +4Ç<
6ïË€>O>â†ûJÈÄâ‹áá„Ûô£„ö;,¼Œ;}uT‹Ò Á¶ÁÛØÛãÉ—·ww7¯}ÇrïoöV§ +c ²ö3õ¾lðSO‹ƒ''£j)¶»`.ß7¬dÝ„õvêÁÿæ~±â)ßå_¬žïÊ'Œ2•|»ÅÉ&0è>.‰} µ¡Ù~™ +_\‰ðÊgº]±$„¹Mwø³«=8µY8î{¤þ+ÄÞcÍj_ûhºÌtò`A 4)eãÁü®©ãÔÇZf û ð-öÏ"fC/ƒê~÷_Gt9Ðz¤Dç™"ðp˜²òfiz숬[€þ˜÷[¾endstream +endobj +2643 0 obj << +/Type /Page +/Contents 2644 0 R +/Resources 2642 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 2609 0 R >> endobj 2645 0 obj << -/D [2638 0 R /XYZ 85.0394 493.0222 null] +/D [2643 0 R /XYZ 56.6929 794.5015 null] >> endobj -2646 0 obj << -/D [2638 0 R /XYZ 85.0394 308.5213 null] ->> endobj -2637 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R /F53 1313 0 R /F55 1321 0 R >> +2642 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F55 1336 0 R /F22 973 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2649 0 obj << -/Length 2135 +2648 0 obj << +/Length 2271 /Filter /FlateDecode >> stream -xÚY_oÛ6ϧ0°e‹’"%±oišnÚ´k\`ÀºÅ–ca²”Yr2ûÝñHY²™fÅŠ5u< ïïwŠ˜pø'&:a‰‘f’Å4z2_ŸðÉ=ìý|" ÏÔ3M‡\¯g'çoãtb˜Id2™-²2ƳLLf‹?¢×Lhvúçì×ó·: 0K`\ÂÈõéæÍ%»üpó–8Gbeš²TÄƱ^|üxuóæú÷Ó©Ô ÄŸN5çÑû‹›ÏïˆöñÔÈèâç«[vr5ë
+xŒVü}òÇŸ|² -`Jg&S¢w±!{.ôÈtçü«œB°XÁaä´¿ŠÝ¡3²„锧“á/yCg–…}1õM)–¦µIÆ&”‹Cõà-5ÖïÈm=WÀorè
ž0e1>õs[@Æ$:êVnáüt«Z/¹~Þ—"5,N¾£/½À€/‡Š‰L²¼ræ¡ rMâ‹h¹9YԬ̟7õÎåýv“weS)Uªa!áxaÒç Ç)Ë Ò¾›c¼À áb©Ù7;f½m;2ûΧDÝ<9OÜíð7‰ê|],ˆôTv«½Aúd*Ó˜¥™Á( -f´–Vp ï <é(¯î›
¼¶võ‚m1·Q):÷ÜmÊúžÖ%j UÔXŽE±!ò²q \G!ˆ°.Ú6¿w'>æU¹ð…ç®q'lçó¢X -«,”@q ûö VU ~|m»²*»Ý©"òéXkðºrùOÅ<ó•ÇKC8 -¿óíÆ¥PWíˆdQ~ŸrGè 0·y,Vˆ‡3Øá“4ãVž œa‘“Ajdµ6,å:ùZ—§Ð/0dp÷qó º<8 J´ÿH3lH³ýÁ_ëòd ÀämK]:Òûëþ8èƒ'xÍЉ£ Þ{P,(r¾ ]µ>{̽ó©Y.J›ÓTEÁJã¾ÄR:ïêŠÞ½xwû!`u ¸Ø¶üÂ5×ðŸ8s`SÜ -$
˜iš7Ãl‚‘…sîëc_pÆYr€£@:ÄQ íqô0ΠТûH‡áJiŽLfŒWŸg¿|øô²¯ë®ØÔ onw-ô?.ª—Ђ - ”Lª³ O¦:ÖÑ zZwôP@©ª±}},Ím@½Ûäó¢=ЀÐÎö÷öÙ~Mp^à Æm9ns ]ÐñëàºjjÐGÅ*º´£‘~$}+0ÂÏFr?¢µ´±Ÿ@ð¡jÇÖKuï÷ʹSf^à¶ÝÚK˜°Ÿr3 èÕí*¯…?$0„õ½ú«~wp‡^º>e½¢IåüG¢ýx>~Ä]þôSà•óqkKSÕ å«Êº ÿ¹.ÿ9÷Ôv +xÚYßoã¸~Ï_a` Ôj–¿E>fï5‡Ý\.v¶ìíƒ"Ó¶p²”Jr²é_C‘’%›¶S\‘
©Ñp8ü曡CFþÈH „™æ£Hs$0£dsG+x÷Óñ:“ViÒ×ú8¿øç'4Ò’ÊÑ|Ù³¥VŠŒæ‹oã«ûûéÝÍío—*ðø#ºœŒÇ_®î ¯>»¹ûKMÇW?Mg0dšIP"ÜêI<¾»ú2½¹ü>ÿùb:ïüéûL0³ÎüçâÛw<Z€ë?_`Ä´£W`D´¦£Í ÎX;“]Ì.~í öÞ6Ÿ†b ˜BBÑ(JzA d.G‘ÐH2Êš äñÆ,&ÉÚ$ü·ÈÝ|Fû±ãH*La-«_¯Ó +¢éñ¢0^Ê‹Ú +jœÄÛʸ¹8s‚Y^5^š¤öÚÛ<3•—Sÿáb»yöSõÚ[hÜi¤¤Èk“×Dži9¾ýYUô\ÏÞÙ !H AÝ ÿà<×ñ‹q’s„‰ó4_¹AºtOçŶ~Þú—E¹‰½ÜÄ +ˆá$<ûZÇáÙi5ð¬ðÔ Óa‘–@ Eùv +1ÆXÿŒ&I±yN3sä"¥¡:QªÎ 4Þ˜ŸkÇúZ'ŽªÕjŽêß!†Úö“%“£ˆbqÚ±N+àÙ°d`1`{àÚìÙ$éòÍÝï^×Ò§tƒ¦ý‡g⋪Žšiæàx'ç›4·gÜ|šf‹$öåŽ:âj|wZËMíÚ(X Î6EU{B +»£y˜Î îÜÇ_/Á…ñÕçÇé,€wHD +á‘ïÿ!ŽiÖ¦‡KÕz[æmòz@kïÛo •z[
wH†m»)Ý}®ôj¯¦£( .SCãÒBÇP `oÒ²ôkZ N뮎ëgÓ©ûøêóì—À }H„Ö» XQ®‹ßÝ8]¤lSÔ{ÝØczÐ#@€jû#Ç6 ˜‰Àò MyÇ@!ƒ iEÚªÿñöîÆÙÓ~W (3p³‚Ûzá;Âû[VÓ<ñaýç[¨E‡Ë©•Rö)í ® nEŠXð÷{õ8ÿ×/Ç#ê@v›C%ÌÇÇì
Úä?ùë"¯Š²N·›Ýªp‚\RoyÁ˜»âÚßÁ/'cm]aÜv£¢Ñ¹óé ðGÏG½ö™Fi䤡›aŠ«LùbÊP„ð äÞòâ¹J«}ª‘5D#<‚m*M…0'°g¡á "ÀV©·i áû6áß[IvRâ;56ø]W#!H{á³ÐOW“eš™ÀBB[ÕÅëvv»+½x{C3OÛÕ$3/&{¿ÙéY³&_¥¹™ä &ÞcvùÝõ`L2¸H6ì[¾MVæ&à€`€2Õ¦ê2‹W¡«G<Rdåüì†>$ÏÛ*dP#¥"½oðù¬ÁgH¾=†ô®ñêìU4 X ÆóÃ&þ1©Šä¿îþ¨öí×ç2¼Êr$©ØEµ9EøUTˆýS| ,åvݞ݇ (Õäö_Ç6pðíÙ
À ¼ #‚Ês/ôµ“~–ÐÐúò®>$1T©c)º ù#ÿJ§íÿÿ„;ÒûËÿfÜý }¦Ô‘ë8öïÒ¤uÊ:Nd´ïz÷ÉCßÿl #Øendstream endobj -2648 0 obj << +2647 0 obj << /Type /Page -/Contents 2649 0 R -/Resources 2647 0 R +/Contents 2648 0 R +/Resources 2646 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2636 0 R +/Parent 2609 0 R +>> endobj +2649 0 obj << +/D [2647 0 R /XYZ 85.0394 794.5015 null] >> endobj 2650 0 obj << -/D [2648 0 R /XYZ 56.6929 794.5015 null] +/D [2647 0 R /XYZ 85.0394 393.5547 null] >> endobj 2651 0 obj << -/D [2648 0 R /XYZ 56.6929 605.5421 null] +/D [2647 0 R /XYZ 85.0394 333.114 null] >> endobj 2652 0 obj << -/D [2648 0 R /XYZ 56.6929 504.7499 null] +/D [2647 0 R /XYZ 85.0394 272.6734 null] >> endobj -2653 0 obj << -/D [2648 0 R /XYZ 56.6929 441.2539 null] +898 0 obj << +/D [2647 0 R /XYZ 85.0394 235.5228 null] >> endobj -902 0 obj << -/D [2648 0 R /XYZ 56.6929 401.9804 null] +2653 0 obj << +/D [2647 0 R /XYZ 85.0394 203.2986 null] >> endobj 2654 0 obj << -/D [2648 0 R /XYZ 56.6929 368.8239 null] +/D [2647 0 R /XYZ 85.0394 168.5232 null] >> endobj 2655 0 obj << -/D [2648 0 R /XYZ 56.6929 333.1161 null] ->> endobj -2656 0 obj << -/D [2648 0 R /XYZ 56.6929 266.6983 null] +/D [2647 0 R /XYZ 85.0394 105.1607 null] >> endobj -2657 0 obj << -/D [2648 0 R /XYZ 56.6929 206.1673 null] ->> endobj -2647 0 obj << -/Font << /F37 1026 0 R /F53 1313 0 R /F21 938 0 R /F55 1321 0 R /F22 961 0 R /F41 1218 0 R /F39 1161 0 R /F48 1238 0 R >> +2646 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F55 1336 0 R /F41 1233 0 R /F39 1173 0 R /F53 1328 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2660 0 obj << -/Length 2593 +2658 0 obj << +/Length 2963 /Filter /FlateDecode >> stream -xÚ¥]sÛ6òÝ¿B“—Ês‹o‚—郓8©ÓÆqßM¦½>ÐeñÂU¤¬q:ýï·‹(R¦ìdnô@`ì.ö{!>aðã«#&5‰iÆõd^ž°É-¬½=á~Ï,lšõw½¼>ùþŒ'I”a&×Ë .1kùäzñûôìêêüòõŧәÐlú2:iƦïÏ.ÿuö3Á®N1={{þ¦BÅ6q þqýîû7ZöðË$‰b¥‘-ÄüëåëWÑ«—opëÉùuÇoÿNœIdöÏ“ßÿ`“\íÝ ‹dbõdñ$“òDii%e€' O~éöVÝÑ1ii#mE<"$!Æ„¤“ÈH!ÝU®WÝWñÞVוFøëÖë6¯«†ö
P*%L„}M›¶Y™UíéL²x:¯«6Í᜛ý‡1q—ù•"Ý6YQ– cÁ¨ˆi£=îE¶L·E;k²Í]¶aÅÔP`…(µÜs°¬‹¢Þe šÝÜÓ·]ùmUZ:>&3 F Ñr %:)l`ŸàÓt±Øœr;Íš† - G1ÓñSâ1LÉC=NbÖ‚ž·L^(¥i™¶ó•&è(²†Û¡ÉæÕíXLì : ‹$£¶ü0¨ÁÕ— %ÇŸåÁŽiBÆeYpfëÙvÎ kmMt ²{›j‚ìaKphˆßy:^ ~F¢‡„¼t D¬f
Q›Âl qMÃ1¨×\×›vD2±Šâø¡o2ãc¬ ÄXãc¬1ÖL ^7j}4ƒ!ä‰*›xMGœQ✎jݲn=*ïæ0ò"s1Ö ƒK)f‡îå|Š ñ)¹FÉ ŽÜ^€ãAî $EÂ2Lç^ä[°vtYÆû€ö¾Åö¾%Ä´ƒ áT]Øý*V÷Š²½d¸
trÏcJ+ιÆý3 ÞG.ñ¤'i¨GÆ< *1ïI1ëyÆ(²‘¸s%9W‚¯w¥Ø»|ÉxÀ˜\ìÀ‘ vžÈ®€ëª‰z»™g3Lé˜Î Þ€K
eþº‹ƒ3˜b'2»3ct´ˆ¸ÑÃpÒ`Õ>]‰XNç˜È†A -;xªöõ –õ†g¡¤Z"%/UŠ „/(³`ZéÕÓpdEÕœ -Þ -h„ÌA>,·Xq #)ÆÑ´k”ׂ°nÄoJ ‡ }[‚7{¤kqŠ Ø“šâƒR<ÃQµ-oœ]".p ª7›,a¿wi€t Òí«=HhÁÙzn b¤î‘3,ùIÐIr˜á… ª ¿Ív½.ru¨ê†‘Ã(€ãèÆoòñ -ñUM›¥~â$ ŠxG%¸0ŒQ1xg&§ç©SÛ© ú®Ø³Q¼ ÊôsF#‚hÌß5 …§PîŽ wµ‚ß;&LÅ¿Õí“)Úî„w"7c(±îìû«ò“‘Õ]P{†ûÊq êF¤&M:!'‘1¤gqP9;Méjqä̾Îd—÷ ¸òû|ve¤Ÿ]pËhö
yäHfgÐK)ñx¯!"Æûð™B14Í[÷Hã]Þ®°ÌgÎLBáòÞ%P²À&¤ „RðÀªtKÈÝi[Kq
ØpÑ í®mbu`Ðáåä¡ °Ø²2˜eZÜÖ¸M9æ䜹 ¶Ók}1¿H Š¤Ó¬šoîC {¤nº Æ<x<à1”L¶ëŸŽ= @HßorÕœtåÌ ¬ëÔt¾ÝeTmqO‹uE#1ýñýÙ«Ùûךä$
Õ—Ã@HÙÛ8— -Ž´Ôò
ÿþv!:–L_OÞ¢W‚(TùªLç³r¡_Œ5C˜(2â”MŸ™7ï—ÿUòCóE÷7B}¸ÈDþöüKR,yQ¼ûðâ˳o×FÇ´—ê·ÜÀ ¿€\À©íÙ¯òÇ {e^þ´K~Û}Ú]ÊÿöÓö— ~ ®Çþ‡Ã?Gþ5d sÿ÷”û?iU IkÅøß +xÚÝZKoÛH¾ûW˜ÃJ€Ùa¿›ÀbÇvÏ$Ž7r0ÌÌ–(‰ˆDjDÒŽ÷×oõ‹âKT€Ì^69°Ý,VWW×ã«jáIÿñ„ $"MdÄ1Ÿ,vád
ïÞ_`Gx¢ IõöñâÍ;*'Š“ÇUƒ—B¡Rxò¸ü}úa†fÀ"œÞ_}¼½™„FTL¯ nïoî~ƒ¿yT@†ÓW÷_®>ع‡YD¦Wïoç³? ¾¸}¬åiÊŒCª…ùëâ÷?ÃÉDÿù"D4R|ò„G™ì.§ˆ3JýÌöb~ñïšaãùtP8D„ +2 ‚'£ˆsÒÒ „-ÜÜί?ß=<Þ}º×»1ß N"@OÌÐfñ.Y:*Ò ¢ 1J ÖTi1 (ÓØ>nò]œfv| ìhþZ”ÉÎŽÿyxs?‡¶ErxN3ɦ—0!Ãé>>”öU¾²Ïrã½½»¿±£È>–iQ Ò§ªLs·êê0Ãjš»Õîæ×ÈŽÞå;Øå†"Ñ[›~7A:½©l• v±eªmÀ? z +ª ý¥='Æ1 +9©ÊzuSZáW;H³´Lãýc—q÷¶`6‰;Ó•6 =ø«JiR Z©
o‚“¢)™e?êŒ$Æb" Ô(©Ø ¶DA“Êûo?ˆÕTzÝ€u— EVãKz¢%›z0”·—üR8ó¾{xfÞ¶NÏɳWbºê8È&/J;ÚÅ‹Mš¹éÔ¹È"ÞÇO[7™¯ê%° Â9Š”ÄÎ"¬:ÂcíÇÜ>èKŒå’z6â$ﱋv UYÅÛzëßÛªHŸtÊ +¸‚´ Aí£VФ:m5ÕQð!+]²¶‚þ’CVÐZ²iâoìÿÈ + §3AdÜ +T#Và©Œà +8çMÁ58 +è +z ¨C>öñò) Æ …0ݱÂOSy3iG?å>…ÇE'I{Ui\lUe1ô¡ëÂaâAdLgœ3P·I5b€žÊàíYL2ÐyhÅ6À1ùØpÐ +Ð)×…îUëxé³!uïì ñ±ÓÙ ´â˜z,m×(]"2j¶â:Œt¿¸fcÏ)6ê{¹ +1 +Ì
ÖwAQÄÛ’]»Z¢ +FTo™É®„ýB(Ä¡oé>ƒN|k¸ìïtÜÃÌöô‹økbgâåsœ•6 Â Ó ‚ç_ºß:¢ë‡/…» + endobj -2659 0 obj << +2657 0 obj << /Type /Page -/Contents 2660 0 R -/Resources 2658 0 R +/Contents 2658 0 R +/Resources 2656 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2636 0 R +/Parent 2662 0 R >> endobj -2661 0 obj << -/D [2659 0 R /XYZ 85.0394 794.5015 null] +2659 0 obj << +/D [2657 0 R /XYZ 56.6929 794.5015 null] >> endobj -2662 0 obj << -/D [2659 0 R /XYZ 85.0394 420.6717 null] +2660 0 obj << +/D [2657 0 R /XYZ 56.6929 752.0246 null] >> endobj -2658 0 obj << -/Font << /F37 1026 0 R /F53 1313 0 R /F22 961 0 R /F41 1218 0 R /F21 938 0 R >> +2661 0 obj << +/D [2657 0 R /XYZ 56.6929 645.3699 null] +>> endobj +2656 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R /F55 1336 0 R /F53 1328 0 R /F62 1379 0 R >> +/XObject << /Im2 1368 0 R >> /ProcSet [ /PDF /Text ] >> endobj 2665 0 obj << -/Length 2225 +/Length 2763 /Filter /FlateDecode >> stream -xÚ¥Y_sÛ6÷§Ðô¥ôL„ÿàú¤ÚNêNí¤¶rÓ™$´[œP¤*Rvss÷Ýo)R¢-g:z ¸\,‹ÝßîBtÃNdBÃÌDAdLåd±:‰'ðíÝ
<Ó–iÚçúe~òÓ[®&†˜„%“ù}O–&±Öt2Ï>E¿šSG7×çgÓ³÷×oß]\ŸN©JD³ .®Ï/ÿ<23pÆqt5»þ8û i N
‹fï.nO¿Ì;¹˜wjõU§1w:ýuòéK<É`¿Ä„-'Oðj ›¬N„äD -Î[Jqr{òG'°÷ÕO 5 ã ±… =[F¤Ôb¢¤! gÜÛâ?»=üô–± ç”K¢)a‘0éY/Kؽˆ£fiaÀM”ÞUiöïtµ.ì› l°¬&ŠRº:!›2[Œ¬ÈÑÒÈÀô”ʽû†Keö>Ý
·uP -\EµH‹eU7Hþ ƒe˜"1ü(¼PäJËlOÖWÖ„é…ÍÂéjêÔžL)£Dª<Rb¤d^cØ»›G)À_8øËYµZðæ35UxúU hônð)ì ¨¸Ñþ´Ú›Uz»æ÷ª¢§e¾Xâ—ÕEÓ(-ê°ø]’ÙÏqÌJ¿7 çån·Å¸ÝFK«DÆn7JE‹ªt ¶›´É+7]éÈQ -‹ Oy³ÄjŸAóð±ìFh|÷Ñ.6§TG¶qÖƒàš/ nÕ±4icW¶lž—Y¾ -¯# ò&LÝ)‹ï‹"ŃrãªlÒ¼ôœj·È]ZÛi"ðÅ–‹*ËË|«îŸShDÿÁÒ -ØD`þrÝÇwB5} ú¹ñ{‘ª -6„C,韱â·Þ_ U7Ͳë×[ 9*r±ÜTU“åcu ôaTvîÒ Ý - Þ˜<& -0!•èì€è%†ü3§É|Û·¯£l/Ž}‡zhn@ˆÌý*—ŽiwW³WVC°W6¾qm yîÏ@c¹#GÜ¡í?þ#b÷‡‹pè¢YW» Íåjã ”ÛUì@õö/‹CÝÿ'y”endstream +xÚÅZÝoÜ6÷_!à ª²*?E÷ä6¹ Eëó5öÝm ä]Ú«X+mWÚ8þïo†CÉ’V»i/-Š +ÀüöþPÒÌ[åxž'ó:àl³s«âgÆ„ ,I©òÖ·ù‚Ì€»üqŸ–c‘)âW( X+.ã²ØmNrãj…ó@€×Ž,V>Õ6ÏMë¶Dpyý.¡Ùw ·4D“„sö.\L8±qm8ª*Ÿç û´A;)–!`°& ù¡libUWh‡Ã~Áa>È h¾†Æd‰
̼¬{ý˜ŽqwÙsoVÁ)vm½»ój=' ] +ÄX½s/‡çxl ¹€Ë.öuµuUK”Þ?`ñ±ªÑ¿ž*šnkšn» :¥bqØП1¾x ðÄÃö¯Ä q?wÏM½B1 ñ‡k;§6@U·þ xOSãC%oi.\:,®Úª„ãmþ©ØÒ±41”¿é®a¾Þœ—p±Ä‡~•EÛ–³Aä¯Õ¡œOÈY +o€¼êFŽ#S0EàtŽfºàñù2•Ã„cdÂ¥1!aVùÖÙ0/I•ÎÑÞ5Žò Ån䨷A¢Î…p<t! +½¥`&ÉTf&îãýK˜aº‚¢
³EÕ:2£÷)œB•ü
Nò¸²ëžŒ†eå K•Ì€§…ʽ|)¸_VJ!…&¸ª +! ïAÎ;w_ûõÀƒÆù¹{÷æJ`
W3Ù¡ãK‚É')bŽ ¹ÃGÚà )ÿüfe¢2õ{b¢Ûq +½)ˆ8V}½i±•Ú?½)ldú'€·ç3ØMÙì¥Óv3ì–°› ØÍ`6 3E Wùp¨VÝ6?í†FèNÞ~j˜„P‰°½—‡™T}Šå\êfs`˜¯6{ËÞ¡¡ÃIÄÔŸ¡€IÀ,»½-ú <ÔGÎäÝŠs Øf]»¦úª¥iWA9[9úhÜê0@ 8å1#üÞÖMØAøªù;":ÖYaZ埰*ä7c$H©Ìˆ` +{œ@xÆžÙl,«y ËJ«;’ϬÀúÎyk£Ö.¨ï¯Bi ËðkS<l:ñ>úF–r°äfÁ„£DºÍ^àE¯ Œ½zðzÕÓUs*a^} t¡2UI©žd›?Ç»p0xMp2ªc0嵆ߨÓx†:+ y ƒp„±P‰úe#(cÔ1ƧDÀ#©U’AU?“-0[
¨N§‹žjX<ÇéBÌöΈ#G™ÊK¦ôy¹:¢¹F#z"Ø{× +Ä Ð,"ä„·€ÎˆÛ)`–û»Òµÿð½Û‡âŽÄîÞ#×Æ£ìÒ} +€%Â2Ž +õSóßÓPv[N¡gnEÂŒü,zV'Bddƒ«9ôÌ +2mÑlñÓÐûL¯÷õŽF9Ö x F®+À'0ÆÇ®;{ Gx[¹]Kßá‘ËÆ/2àl=›·M"¤êÀì]QÏAY6yÁþôÌ–y(¿Æ²I„Ñû[æŸþüÀ—/ÚU‡g žaÞÑéXc‚¿J¦ølT öˆö•4ô¼Ú=ÀA&Šo«þÝÏ;TyëÊgðC¢QF‡÷dܼuy¸†7:™žj‰Rˆ +–o‰ B™à£–ˆxö/±ˆË!a2sÔiÈ Ç#^§°ôJ{ìµÐF(nÕç½Vf"4Ȳk¬ð+£®f'L‹" endobj 2664 0 obj << /Type /Page /Contents 2665 0 R /Resources 2663 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2636 0 R +/Parent 2662 0 R >> endobj 2666 0 obj << -/D [2664 0 R /XYZ 56.6929 794.5015 null] +/D [2664 0 R /XYZ 85.0394 794.5015 null] >> endobj -2667 0 obj << -/D [2664 0 R /XYZ 56.6929 513.8248 null] ->> endobj -2668 0 obj << -/D [2664 0 R /XYZ 56.6929 427.0967 null] +2663 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F62 1379 0 R /F63 1382 0 R /F21 950 0 R /F55 1336 0 R /F53 1328 0 R /F41 1233 0 R >> +/XObject << /Im3 1530 0 R /Im2 1368 0 R >> +/ProcSet [ /PDF /Text ] >> endobj 2669 0 obj << -/D [2664 0 R /XYZ 56.6929 364.279 null] ->> endobj -906 0 obj << -/D [2664 0 R /XYZ 56.6929 325.4767 null] +/Length 1824 +/Filter /FlateDecode +>> +stream +xÚ½XßoÛ8~÷_¡G¨þ‰{rÛ$ë¢ur‰ƒ;`w ‹ŽukK^IN7û×ßP¤dÉV’= DÔp4 Î73 i`ø#HjªƒXs$0Áj7ÁÁÌ]Oˆ×‰Z¥¨¯õq9¹¸bq ‘–TËuÏ–BX),Ó_È48\̾]~Ž¾Ü<Ü-f_oïæ‹å4""–"œÝÞ^.>Ïÿ=¨Àð èc ~›- f_ìvªi8»¾¼Ÿþ¾ü2¹\vÎõ7@0³žý9ùõw ¤°/Œ˜V"ø/i°›pÁàŒµ’íä~òÏÎ`o¶ùt, œ*$™Œð
1,È,ËT5¾,†èÆH1ýº)÷S~è?ŠABkDRÄDÌ;´(
AZjáR1¢±+B XÓ¸ë_6¾¦FBrbáÃ<n4fÓHÒð®ù¿€ÿ$œwc^Ÿâ£$Ò€Mƒ)tãLð'Ä@ÎY£Ô 7›?Ƥ\Ìw,ø\À ƒþ6½á¨o¹Ù¦¤½¤$”T`=¦ IÅT³‰å&«¦',öuVän¼› ªÚ½å… <÷<T&µ©©`Ë~ª³’o_ühígòÚ”ÆÙ’a]8éÇùâ³i÷HÍ”áðyJEh¶ÅÞ”•
͆)p7ÉS(ƒX…»Äª¿¸ë—}–fWL‰ðV¼fQºçj“äO0ËÝ3qõ¡>”‘I*cí S ¹Ôˆ*‚~FýTŽ2H>©¡\£c•ý\ýôÓ J(}L{ÒOû¶aHAfÄø~~
=é¾—ümþ + ý—6ÜÈf‰}®Š¼v lÝ7õÆëæÉÎT¦|6å?¼¯¤ç+£1Š©â¾RË<]ìˆRP’Ò+ ];÷ÈfqU›$=ËA” ì ¨¨ §
¯õµZDÎi£Óò€üòp{º¬ŽÖ„¼½l«4²ì 1`À šÂpÝ«¢ üÊ8ÚIÜ£‘A}&©{·EnŸ8L¦1_•d(Ž¹z'T=7BÕjùPY*~üàœÁòòîÛ©#„ ¤ï›žtZ#® Â' Ê$TãЗ͡vN¤Å÷üí R HÀ¹‚((Oæ;³éǼ:lëaÌ+“§YþäñÉ_ü,¬Rz…®òìâŸÍ8óJ‡<5¿aLsã2ý´e`Û° ̹øéfq5¿~¸›Ù˜/ç7‹÷Û†ÝÕy½
pB[u•hk; 1Å8ÂDR¯½ÁºútpÝX³ÐJ¶–¥0w”²º(Ü`Uìö[ó—›½05ÕªÌ ÛoòVZ'ÙÖm<-Àx<Æ–ö¦3V›¾•ýÑ·8÷®}Eg8QÅ6¹û”öœ¥ÆWSÖK”fûÀ½œˆKÂüö Zmí ³t—åYUC8 +ëY{ß󶎿%ù!ÙŽ—H… ¶Ý ü§ñ0O_E NX´îf9„1«›<£Ç
òAQSÄ o=8ì’ê1»(èÍiý†nA·–Wn¿>%¬dW¤~Î}âÞÖ™ÝÑ#°pŸøˆÕn¸2U Àˆ çk7ã–NÖuXÒðñeŒ—0´7¦å{‰ E³öœùÁå‡Öˆœ>}ö¸zª«
,¨x˜XO”ÿS J({'ô>Ú~¨Y˜›Æ;å²ß*o’gã$+8î5Á€10ø.«*aûå8`TR¤±Ôï#S Ÿò,,Ôð,¸Q™Ú Ì_ûm¶Êj{ˆ´ïME€‚ƒ®Ì\D¨HÒø¤ž<g÷Z^U'e}RYXb).ÞC…!®x›Ðƒ¼i•ÁÀQ1ð e^Í¿Ž\Ý<é1®¡„½ÍŒ}†Ž€rΙ±Ó²«^˜zuÑì AÛ\Ÿ¢„Ó,ÜâÞt Ó:÷à„ál ׋ ›¥ftTvÖÃÐåì«ÇFàºFy'H=7‚Ôj5AzNÊ‹ò»@ùpí³ôÔŠáÜ-¸~Û“NëÜ•á! D˜dC_ÆÃÕ˹(KÏ¢už‚€ +endobj +2668 0 obj << +/Type /Page +/Contents 2669 0 R +/Resources 2667 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 2662 0 R >> endobj 2670 0 obj << -/D [2664 0 R /XYZ 56.6929 288.9693 null] +/D [2668 0 R /XYZ 56.6929 794.5015 null] >> endobj 2671 0 obj << -/D [2664 0 R /XYZ 56.6929 257.0263 null] +/D [2668 0 R /XYZ 56.6929 644.329 null] >> endobj 2672 0 obj << -/D [2664 0 R /XYZ 56.6929 191.2867 null] +/D [2668 0 R /XYZ 56.6929 498.5963 null] >> endobj 2673 0 obj << -/D [2664 0 R /XYZ 56.6929 119.4786 null] +/D [2668 0 R /XYZ 56.6929 378.8143 null] >> endobj -2663 0 obj << -/Font << /F37 1026 0 R /F41 1218 0 R /F22 961 0 R /F21 938 0 R /F48 1238 0 R /F39 1161 0 R /F53 1313 0 R >> -/ProcSet [ /PDF /Text ] +2674 0 obj << +/D [2668 0 R /XYZ 56.6929 270.9876 null] >> endobj -2676 0 obj << -/Length 3036 -/Filter /FlateDecode ->> -stream -xÚ¥Z[Û¶~ß_áG/pÌð.ç)iÒ E»ÙÓlm ´– ±%×’³ÝþúÎð"KZÊNqàQÒˆ Î|s¥Ù‚Â-Œ"TX¹È¬$Š2µXïoèâ3¼{ÃÍ*†To n^}/²…%Vs½xØ æ2„ÃÅoË×÷÷ïîÞ~øõvÅ]¾!·+Eéò§×w¿¼þÑ?»¿µ|ùúý»O·+fe&ˆi¤ÓtùóÝÛïVß}¼ûþý»»Û? ~¸y÷г5dQ<ýyóÛ tQÀ~¸¡DX£OpC ³–/ö7R ¢¤ñÉîæÓÍÿú oݧ)Q(aˆ2<KÈ‚³cÄ*ÅGÂP–hÁ…ÆÇû‡ ï>½Ø %T¼2Îà#˜<©„@´RÅ…JˆT¸î*Ÿ.iÂðËKF¢Ä’|°$¨[0«ÆK¾m@»F/óS×ìó®Z#^5'&“Ã/Žu‰†³s`‚sˆÖMý;¥üóés65ÀD2³|ØV_n}¼…û2ïÊð ÷ühWúéå&‘™æ&È—ò9Áˆ¢DgTªNMÆ -¦Î÷e‘˜IpbÏâkÂ6Û.?v§€ˆƒ zئð²äzˆQ‚T e€}&ÍDÊiè0 öL,®8•Ë¢Ä»Ú¡•*‡V÷t“Ÿv¿Y7û=îݬ·y]—;ÿ¦ -FvË– >°3gþ12ã w»æ©ª?'ä'˜"FZuUŠÚ¨®®9svªqÉ2ÈD+à™Š2ñ!à©Jc€ƒü¤¼¦9A¤‘b 9ŒÝ¶ôƒ]³Îw~¸mÚÎÜ‚nT7þº9 á“£¿yáC ïJÎ
8vPµÜ³þó©®Ór“àëTï–Pl+4ÉÏ¥ã0 .w²™LLdLN+'÷Ç•^Zÿ vLj¥®zL*ÀüÊ‚ K?ÿ©E»wK„µ gºÍaUÞ½) vùºÜ¦Zÿáƹ©¯ÙÒxÑq.!àë‰)ÌØ«%BeQŸé
@øW6ËÍ攊¶ðÙY"¢™ £ü«j;ÔO<ÏÔó<õÛp•õruX$¨Îs´À ¨‘-ñ,CÆÇú°Áu3mÈhö—®XîòÇæˆöãn'ÈôÁÕžGŸ`Vâg…ñøœ²/iIf…˜¨‡¨É"x\XRÏóŸ§Ê -ԉ氿òýa½ -Þ¬änÁ}Ó•»ç[ÆÂAH³|nNž Ý6§]O _×)Y0Jø9”Œd‘P1ðoûÀkÀÁz^cMÑ,N*æZE@7¯\œÏ¹p·2¬p:„7 œÂÎ1 9‹–Ÿ£Ò \Ñ™>ôô6)_Ú¤ü÷èσñk@$™Ën2Ÿ¨Ïg·Cªù춧r"ôŒ‚ýŽDnl¯pˆ„mõw9eA6Ÿe€ö‹¼õT æFZ–`;ʲ1wŸút á.¹÷P8p ¹Q³™¼‚€>ŠæøÌEs TáÁcÕµX'AæøÓ cŸ{XÆk÷T–’…Y Ø` ÇpSü†¦G6`LÃÄbçŒÔ]µ3næµ-2B5í²¶T´ ©œ¶×)mƒyC&sÖö¦Ú%´ÆäeÖ"Q‚µ±®9¸xÀ׈·_Bl F«´ÇÐNïfÓNƒ‚'î³è4†±Îeò›g“‡—ù®+u)>A:‰;aÿ ½ëÌ ¦ÑÍ«žjB9ÕWT? º úHåÄ´}QÆJ)ä•%#QbÉQk‰äj²äý± - u ¥¾mŽÁÚ¤æÇ €f3É@¼ÊâÇu@Fî\åçSŸY9}¦Ã7ç<ûÆE!ñüšjd&‰ÍÄ <¤šWMOåTóå[|0†–Y |‘·³~É\Ò¸ù`ÌeƒŽt(‘`àXs#¯ÇÏXp4uËqÌKˆÛ¡/ö'_è>õÎýåk¾« -?,š}^ÕgÈüq5õʼn¢Ê5#‡eÂê’Eë«°ÀGFíØ ¨.À&R9Ø ®Âæ€Ö6Å §÷w‘¯H”àk„®°ÂŸ06ŽÚ6 }9.ì Ç7ŽS7zÂZÓeù »¦Âq-®Õ½ -,¾NÙÙøJnŸª»%Œöåö\éH‰ìDgÒľȑBÌã¯f ¾Y0A²ÝuLCªy0õTLǘ,ÑFô– -Ñ\Î1‡BËUÞ*H#P ýµo0*ç#:1¡¢—gácPµài'æ쀆BtY¦¦>zÁ}h Á“ª\ä…ìeÓ § § âK
µtHV]¯h@Ÿ§T·•Kõå0‘G
én¼dºïSÔ…kCˆž% Â;§ÃЯ±ªi#&¨
ôc!äâÞç C×z-ß R]ph‘Ê9´öj©“Å1À9Uê\d/u^²–,uF¼S* õÏÙòý€¬¹ ØŠKQ‘A¼£’e×»ÁÌ=Š8»ïEÁúç~9§ƒ~9§ãxé¾™—nÅ¿‹—Þ•rM˜Ôߘ¼MÛÙÍá1_ ¥ÂH‚®à†b~l‹\……ÁE,©æ±ØS9,vÉà -ÙSÔÙz{lš.œIÀY¦ÕŠ_d®§Jp7ŽœX ò ±*okcåmí\å
éž0êJ»ŽgZN+oœ²ñ×såm}gךA¬9†79e’]G¼Íï{‘»Ÿ:´:Ý$ïpܸöÛJ‚› ^åÅ*”L ´Ì8ÔîÍ{eöqx Lqá8ÚÛ4Ù· ™JÑ›k` ¦õ!E,ŸŽ \u®#
÷^X;ÈK¾ - „g+è'b†—mOäݾXVá -KÂü“U7Íɹ|ô|Ž„ -®'B±â8†¬åÐ@Zž<=gÔu¸Äù_=ݱٵ)¯ ¨Í¸¼ü 2=(ÒÁÐç3®¶ Xä¹ { ›ñÊDÓÀ»ªŽA”3Lí&¹ 8Í.âÞ$Ä åµ¤ßtÀV -.ΎϾç‘Ã(®ÌÚ Ð™ùÛœPD¦›´·Ìÿû/uç¿Bv'Œáé¸ ¨Dø±ÈîebÊzÿç»—¼ÿžÈô?endstream -endobj 2675 0 obj << -/Type /Page -/Contents 2676 0 R -/Resources 2674 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 2636 0 R +/D [2668 0 R /XYZ 56.6929 194.069 null] >> endobj -2677 0 obj << -/D [2675 0 R /XYZ 85.0394 794.5015 null] +902 0 obj << +/D [2668 0 R /XYZ 56.6929 153.7758 null] >> endobj -2678 0 obj << -/D [2675 0 R /XYZ 85.0394 751.8648 null] +2676 0 obj << +/D [2668 0 R /XYZ 56.6929 116.6136 null] >> endobj -2679 0 obj << -/D [2675 0 R /XYZ 85.0394 153.4294 null] +2677 0 obj << +/D [2668 0 R /XYZ 56.6929 84.0158 null] >> endobj -2674 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R /F55 1321 0 R /F48 1238 0 R >> +2667 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F62 1379 0 R /F21 950 0 R /F39 1173 0 R /F41 1233 0 R /F48 1253 0 R >> +/XObject << /Im3 1530 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2682 0 obj << -/Length 2296 +2680 0 obj << +/Length 2175 /Filter /FlateDecode >> stream -xÚ¥Y[oÛ¸~ϯð£Ô<¼ŠäÙ§l“öd±M²µX íƒjɱP]\KnšÅþø ÞI¦“ -@ö P#IHZ°°˜æ$âß=ÕñÝÐé§Eênç
à JXÒÁ#-ï›}Ñm½½Æç0¤¹ @ú¸nûÑ·ÿD )÷›@×uoºsNâŒL™ï#,™@*“îÓ:kªMQƸ -c§Þµz®í‹\OHI5R*°ûDZ[ü áø"À‹ 9°å年²ÍšP9ó{i¾D —+¤ÀÝ#ÒÅöË«åÛ×w«ëÛ›~Ó)çzÚÄ£À|Ì@ÊIæ=$7ž£ø<5?Ì;Ì76>ÁàÐæîÓ×Lj -5”_ýP“'/ÆÌ’^ -Ï ¶¶LVÄ%v<¯š^[0ËËôkãÜÃL#)’¸cá£Û÷ýP¸Aö_p) -s ׇ+"™¬0ÅCñ’¿@—`ä&x¾Úz˜eù&=”¾£.Ú#Þè¬H ßÂ/ÀjHuV=•…Õvz$ø Öò…#QäÈ!T$ؤ&GÞ틺ówO½ûm›½×J{€4·÷»-ÍMË ØìLPj'wv¿?˜Ú®
M~,”s
-•¯Œ¼ &Fq<jFO{Á4ªgL¨¬i¾Å< úi-Øqß=òwóìÃ{^¶ž*"ÜÈ߉@œ€ÖFÒ žî+IØˈÕ*q-ÖˆÆ%dC” `±îŠµO7ƒw{™s ³Þ»™m¤ãfP†ÍG¹Õ—ÂÓ,
£ }µ¸õR Ž¡i7eä$ŸBË÷.°tPom£ÏÄ<Äžá9b¬LŽ´ìkܺÙGØ@ Mt -'[²µn8èM~ÞcîðP´¶!¡¯ÀCÅ‚º£Š ¾“¯Òë ßL½,©cÝæ»ÔWâ°a</}–æP¡ÇÕø¦)ËæÁ¶4Â>:Ø_'5 †nïV,Ά$N5æºRÏstÞÄži°4Ìzr¹a‰bF`¼¶]…3 þaàñ£êÐvþ¢L!ÍØ^ÛôG>‰t«´‡A -¤eá#_èNÓ´ONÔÚ¢íúÆ:0(ó®Ë÷§ÊŠ{(ªC>{ÜL#ë.ßMÖž ~æ ‰¾•žhN>OcÿýTFzæ°> M‹e£Áa ŠðÀ]5™ _Û å5g -í±eBtòŠ³mƒ3@ž/veZ›gý°5ÿØùNêЦ÷ùè±#¢c¯á—EC8îëÔÿû1OtOdJѸ -©6'A(£C"ù1<üŸmŽeÿëÿ±Àendstream +xÚ¥ÙrÛÈñ]_Á·PUvœûF[ò®\kYåªT´z#kÐ ¥òñéžîÁAA¶’->ÌÕÓÓ÷Ê™€Ÿœeq(t ÍÒ< +c!ãÙj{$f÷pöË‘d˜ÀC¨÷WG?}Ôé,óD%³«»®,Y&gWÅõ|qqqz~röã@Åbþ><b!æŸç_¿ÑÞÅq®æ‹_N—°T‘N +©ªÌÖÁ õ~W™Íî¬Z¤ï§± Ü”„“Fø Þah s t ŽÃ,‘»qrºüpyvquöå¼»Õ£3°…PP¿K’Rƒ;¹ +“\¦L‘ƒjȤڵ¥Éª®ZÛm×w4þ]W æ¹q‹ß…P>(«Ñõ~kª`w,³¹5…¹õ`wõn"…³ÀÈ ÌX厶O ¿ŽrÆßÐÂ2\ds³oëiË•Ùlžé|ŵ¶ Ûç éÉ <.÷ºq›è<J2/¯§µøµ©î' ÚšÂÒv[ÓX<örE `㙊…
ïÃw°Lõ4•àÞ*Œã …ãÍÉmö08Aq¤Àª•ç Þ¢<™_- +Hª9‘»ªÝXО5«5ÍLQ”mYW´ 7vc»w ;DØ€Æp²²SÏ —*uÖ‡·eevLš‚i +'ã2û/pü•ìÌjU†#ÕlWá ÕfÂø u.ådÝ£ ò%`$,؇(;žïIïZB”–ðîH4}"žÃéðHñ$û £s‘%ÌDBÐ?FB’)ºI qå\!%W +!FÐ)& +s~í ãÌ4M9Æ’hœB)Œ(•ÒìÄgk·8_Òd»oËMÙ>¿ÅB~P»ª4 )þJí:DñzíÚA9O@×Aqãg'Ýìž&ÿ¡!¨ÇËÍxù<Qû‚<CeŠêz½5«Ÿo¾Y”®ý¹±«m'ÒŒÔ:„$ãkþ…oS/ä hˆïÊÀö“E>mÝp1!â0B¿ …—ë`ªˆWl±Uâ¤Vnm½o_}Gv± ÷(ÑD’8fÐ}ñð:Vè„Rh‡±îÞ‚$¼+mó*Öìëå±î L×ÛÂ>N!ÂJ´C¤,s ¥¤ÙQwZC“¸™Ž:àÕ"ÓÿÓÅ?¬”ãPËȇ=,˜°@Ý7®m€JÔ%iØiö·Û²¥½.:à‹¸û•ý 7)êþ ¹ÊUXÑ2æÂbž©=WÂp|ùñm(©“ñˆ–T89R¨"…ÞžKÏÃȯ֎™P1Íó©"=9È êÞ‡ñÖÅ>{ãõþÞ¶~ôwn§ÞòÃ4P†3LÙhân±u©Èõk°²ØoPÁŸp•å¯ŽŠ +Æ¡ËU{X%ÃœNlòu.;Ñ2ÀñÚ´fl·|²©›ö@Y{ ²Õë„“u»C's…³Ój<ü~w_ Ø=Ñ9 —Î=>ï|Xg#«/U¬¡pŒ³®pü¾ŠÁð|žY›G¦ÆEnªµk<ñ¼Ñp±…!Z„J&:«H¡&í\,R=Ó*’`:UKÛNäw[x„þÆw¸dwóa(tè)êár^€¶Ä€áz8q päOØø|¾ø|JSçl)âµ'Cy2&º’å—Åœº·“‰¢§Ú;b0õ J¢ JŸ†ëþ£±ùæsüH÷‰“<ÍÞ¤z³ µÝQ.ÓÔ*áXØÛý=?W¨Ï8Ê}šÍ +7 pÞ^dE1Ý¡¡¦ŠhV`ð·” +´è?ðÈ(Bj²W¢y÷ÍÒ°¯›a¦Op#÷>èñ“P3Òš- -Ãö™lt“?_Äâ0 O}`‡z¿ŠO”î¢+pþòÇ÷þO¨t–©þ»º:ˆZçÒ…r•©<$½ûLÿ’öÿPÌ[‡endstream endobj -2681 0 obj << +2679 0 obj << /Type /Page -/Contents 2682 0 R -/Resources 2680 0 R +/Contents 2680 0 R +/Resources 2678 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2691 0 R +/Parent 2662 0 R +>> endobj +2681 0 obj << +/D [2679 0 R /XYZ 85.0394 794.5015 null] +>> endobj +2682 0 obj << +/D [2679 0 R /XYZ 85.0394 749.3357 null] >> endobj 2683 0 obj << -/D [2681 0 R /XYZ 56.6929 794.5015 null] +/D [2679 0 R /XYZ 85.0394 691.1408 null] >> endobj 2684 0 obj << -/D [2681 0 R /XYZ 56.6929 751.7548 null] +/D [2679 0 R /XYZ 85.0394 521.9242 null] >> endobj 2685 0 obj << -/D [2681 0 R /XYZ 56.6929 684.9927 null] +/D [2679 0 R /XYZ 85.0394 460.7643 null] >> endobj -910 0 obj << -/D [2681 0 R /XYZ 56.6929 643.4496 null] +906 0 obj << +/D [2679 0 R /XYZ 85.0394 423.114 null] >> endobj 2686 0 obj << -/D [2681 0 R /XYZ 56.6929 605.7386 null] +/D [2679 0 R /XYZ 85.0394 387.2272 null] >> endobj 2687 0 obj << -/D [2681 0 R /XYZ 56.6929 572.5919 null] +/D [2679 0 R /XYZ 85.0394 355.6754 null] >> endobj 2688 0 obj << -/D [2681 0 R /XYZ 56.6929 502.9079 null] +/D [2679 0 R /XYZ 85.0394 291.5937 null] >> endobj 2689 0 obj << -/D [2681 0 R /XYZ 56.6929 427.1554 null] ->> endobj -2690 0 obj << -/D [2681 0 R /XYZ 56.6929 238.0538 null] +/D [2679 0 R /XYZ 85.0394 209.4884 null] >> endobj -2680 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F39 1161 0 R /F41 1218 0 R /F53 1313 0 R /F55 1321 0 R >> +2678 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F41 1233 0 R /F53 1328 0 R /F22 973 0 R /F39 1173 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2694 0 obj << -/Length 1802 +2692 0 obj << +/Length 4060 /Filter /FlateDecode >> stream -xÚÅXÝoÛ6÷_áG˜Y~ˆµ7wɶ kš% 0 ݃jÉ0[ò,9Yú×ïŽGÊ’¢$ lRÇ#yŸ¿;ZÌ9ü‰¹ÕŒ«4ž'iÌ4z¾ÞÍøü3¬ý0žg˜}®·«Ù›ïU2OYj¤™¯6½³,ãÖŠù*ÿ-¯¯/®Î/;[HÍ£·ìl¡9Þ-¯~]þL´ë³TFË .náS¤I LÂ"ŸáÑò†V¯–ï.Î~_ý4»XubõE\¡LÎ>üÎç9hðÓŒ3•Z=€ÎDšÊùnkÅt¬T lg·³_º{«në”)bm™–±™/€Ù$tíSƒqÆ5`‘ÄœY%dg0)¦ ¸Ð`‹*úæ{{œ)3Vi8 9Y•×»M¹-Æ&:fqjí¼ïé:® ñdïR¡S[.†òÝî‹uù‘sY4g ¥ã(ÃAGM}<œ "×IZâɳ6#ê¦>ÐäsQ‡¬-«ÏÄÒÞùýÙ±½«åX«+#UtéÏôL:ª÷a3X¼“2bTQ°TkŠÀæ±i @å5J-ˆªº%ÒÞI]ß—yA„Œì ÷=% "Ušz¼É‹û7^/Ç;0›VóPO<µøóXÞgÛ¢jé~8¢\ßà‡WÚÉWl²ãÖ³ô-Š‹hQ éæªhÒZXÃê 6ù©DEµ‰þ( ?Õ™;('JYí-›ÐÒbüK13sBGm˜Š“`¦ xé“*Ûù™ ÆŒ†õ]vÈÖmÖÁÀpÖðœñÀ§ëªÍÊÊE ~ŸŒJ«”Ùt¨<±qäѧ‚¾M‘¥¬ .²œÈd[ <!‚' ðT,£‘9©šm‰üy,&ì(cË`=„€÷@>eGÎba¬g,«¼\gmÑö.kéÖ‘aÍùô— -CLÅ:º«›–f»:/¾¥:åüŽ´â¯l·ßzgt±b¢âž*9ƒxÝL§ÏÙù ÁWMâ&·nðLYEãqÁí¥Ú×ÛrýHsBÔ˜À„C$ j2ÌŒS®úxÔª'` Æ9!@pËH i`êYŽ
!7÷I“RƸG¢àWû¸/ › -_]6TÄv£cIƒ€În û VwT'8”R,´4ï4Í ÊöŽf>ÔÆÅÒ -½+·$ÁòçÛ÷Ç6¶R˜”b·!|äðæ„âÚ}Ši\Ñã$Z"º+TÚ× ôP6t®o/¯Îikê%ËwÐf6-¼*(~ytS ̼„Û@z—UGh' d°ó3¦ïÃ'¶ -¼¢sÈ61i»üuõãû›×rYA×\ÞÏ·îqãƒá»ºjêC[ w§{chÔôçÄ -š ÿ0ÇWöÙBpèr²Ã> %Ùà‚’Ô"]M—R -¾tl Ww‚“ò-ñ¡z³õøÀ£Ëk³<'‹6Máe'|
8Fs}ð<ûúbêüO¿œ ÞL™ï±ª÷MÙŒ B^ àJº$ÂLá8 x -
#Ì_¬>ý# ÆÇSÕ§ãí)^hÅ’ÔÊð.Ø£Áü{ot2qv ÁžIGž0=°ÊùÅíw7—׫Ë÷W…¤ ;;!ì â„YèC .w½›÷yšŽ}ŽK˜©—×÷±g¨ò°ãÞ`þÙ5Â<&ÃíºZ,ÏÏoX/@€Ù5ÅîLsZ!`õRª‹'öõÉ032Þÿ3 S_ð×QÆþ3”™úEðF›ÈÞIø¯;ý* žTÖ>ó#– *A(TN$z,ºi PðTö¿Œs<Xendstream +xÚ¥]“Û¶ñý~ŽUžX4>’ț㯺I\7>OÚ&y HÞ‰c‰TDê.J&ÿ½»ØHJÔÙ™ÎÀ‹ýäµ€?ym’(±Ê^§6ŽŒæºØ^‰ë;è{s%yÌÒZŽG}ssõìµN¯md•\ßÜŽæÊ"‘eòú¦üiñM$“è L!ï>||ÿòù“4^ܼz²T*ÖÉâùû÷¯Þ½|ûohƒa¤‹ïŸ¿ûøü;‚½bÕâù›W žüró«W71êRhÄé׫Ÿ~×%ìà W"Ò63×Б´V]o¯b£#kí!›«Wÿ +Žzݧ³¤"R:Q3´PjŽÆF‰VÚÑâf]á&ž½Žåh¨´@¢ÔÂü8fù’†Lf“qÇ&ã!í®¯Û†¨³Í?U 1ž4Q@“$æ/šî°+󾚙:†]ÄÊO½"³Eµk÷=MŸ—e‹åj—ÕêpwW7wÔ¬›Ûv¿Ítúvvƒ:Êb‘ø –s;”‘5FñG\/uœDÂdéõRÉH)™<NE-¬ñk|7OE˜,>¥b/ ê~MµÜA 쬯îª= YîÛªé ÒÞRù{åºZ†îéãu}·ößvUßQ¼]eÓzBÃQ”>ÛT÷Õ$@µx{²ÀSlfáS"Õ& –žx¸ºã“ª»|µ©J"¥8!á+û¼éò‚ˆ \tõ]“÷bŽ`EΫŠÊCW•Tƒ£ve~€5}] QÏš+/M¾ n¼ûÀS8Vì`£©ÖxšÝ0÷É7 Þ¾ñøÓ&åˆM»–-p´ÈZ´®, Ö wÜ[V]±¯WwÔ
•?¼~•t¡²ØÑ}»æO‹Ÿè%ø'//õøÙBÍ äMyÚgµœn”NÓ¡›Å› –ŽÐ~ì:^16´"tÓ¬ +Üã`×òÜ$³Âx•“ÐIÁr¢×3aR¿ ºÃ¬ä]×tJØt“qG¦™ž!öŽ¶ ±Ü,H,WN›d„'¿}Ï#Ë’U~G +# Áùz›_Ï` ò“e^Ð~™™FGZ¦^Àô¡ÿY¬ê#Šó8GD6Í<~+ÞÆ.A¶"iá“iäB&-Õ¤´RÅÖ*#cRë ŸsŒÁ%Æ‹a:ƒ›Î"“‰ j°bîóšW_å]•Ä´0/"ì v‡I³ÅÇŽñ¥
è L¤?M?ÃDI*ä)¥*`\Ö]a{~ÇqÄR›4J3m¦D]UEîœ!•Iïä«éN c¬:°ß-‚ðz€4Jq¬àÔ`v¶DBߦnx‘“ ÎÖð›*ߨ¯~C¢Åà@߬ýjÛüH½+žê¾îj#ð,3 Úš¡C¿;°Ñ ´v º~’\?7tï“nœ›£ð +á<Δ¹Qíhn¤ …ÙŠ1S"CÑÅE£íL¯u”@¯Õ!0㵊ÈؾD>§)s/ù4¼ mÁžn +RagxB …×$‰ÔéT+\¤†PYðeú éD‘œe‚tâ)£½4Ce›ÿVo[†Ö[çüE8QœÈ +?ªÎ¦Úªâˆ™Û5u[Öf‘¯Ü=¿“²„É£“yÂØd¡…äÑúTqC Ñ6eÇ„þïðhîþa¸½ðgÇotNø Ð ú¿ÂY®¥O.|K!ÎÞ>¹+ë¾›hWãõ´+Ò»ì’ GQûû|ãœRÔcÊá ŽJí§÷$BwÄ=kèøY“Œ‡•ý +4/kG¾0ÇïŒ}È *Üw6uÛ¦Y´SªúZXÆ… å¹(zuB´º¤ß×øté¯(•ª î/\«‘œ=Káí˜O&#Éé +N;ä ½1Ã6±…âUp7œð§DCã“ÿ8r‡Ž7?•„‰Žào©Î·ÔPãÐWMîË|HáÙÉê\®.Tì™çlû¡6ç(g‘!q–E¥x‚5ˆ¥½>º¯Ý{¥=ß9¨ç ødBh;¢À (¯¹ßxÕ—Øʽk’‹ +¹Ó<²KÐ|ì8Áµ¶Q›“\èô,uê
Mp5§Ò +÷¡ýêþ™ù9îÿ§É^Šendstream endobj -2693 0 obj << +2691 0 obj << /Type /Page -/Contents 2694 0 R -/Resources 2692 0 R +/Contents 2692 0 R +/Resources 2690 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2691 0 R +/Parent 2662 0 R >> endobj -2695 0 obj << -/D [2693 0 R /XYZ 85.0394 794.5015 null] +2693 0 obj << +/D [2691 0 R /XYZ 56.6929 794.5015 null] +>> endobj +2690 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F41 1233 0 R /F21 950 0 R /F53 1328 0 R >> +/ProcSet [ /PDF /Text ] >> endobj 2696 0 obj << -/D [2693 0 R /XYZ 85.0394 526.0765 null] +/Length 3185 +/Filter /FlateDecode +>> +stream +xÚZÝsÛ6÷_¡·“g* >IàÞÜ©›Iç⦱3½™4´DÙ¼èé¤î_»X + Ò|zsûñýW—¥žÞ]_~¾ûéâú.‰•‹.¸B™~¿øô™O°ƒŸ.8SΚÉ7xáL8''ë m3Z©Ø³º¸½ø%1ÌFýÔ1Ue™±² Ñ…!˜3F”a +”T^ooÞ¼£]ÿøó‡wW¸ó;Ü—ŸÝk’Of²„7P/NÛ´û§EÕÕRf”Z3)M 3pw)ì´®-¬fó´ï¨¹ôCÛ5±0*cQfœ –ͪÞTëÑ¥ é´ +„Û 1n»j³¨<÷E¶*ØO¯«ù#õηë5P’ ìëiÕÔ¡w»¡gýG5ïVÏøâ ³¦ÞU³ñRMf¢pÌ +0FR7ʳ„¥L«i¦·[؈ï
«·ôFâú!1]âN|ïbÝlš¶ÛU]ó5Ì{Úm݆w¡Û=Ö»–dÜä´np„ÚÁhA,`|i§ûy×l7ß;I£Jˆéñ£ÿ¿ï›¶ñLŸÎ ëù—–¨PYøì ãàvÓÕ›./†ÿEÂ.4zÜcÝÖ4œslë.qZ4$fàQu„ +4ÞGh¥]?}°«Þ.²PÁ5ÛíÞ7æhÔB‡Þù–ü§%Ò߸á > +Ï?ëKA´Û0°£çz›" &I 8y|Aš?ëc>Å€O$ÄÈ.¬Wh"“Õjû ³l…lÔtÕýÊo<nú“Ï+o$è÷.÷N–ÆÚÆM Í’BŒáBOõ¼ùsIŽc' Å’ö ”Öª)4p +ÐŽØuÝ´m³y +<²‡l´`§U[Í”2/ jNuQntµW«€î‹Å®nÛ³hZ‚Ž„´çåIT#å–eÁ¬Ób(Q@SYrBSYŠÌúe–-Kqh}
IŽ2ØG› AQ ç÷ÂÊà{Q#À$˜ÕJôª€½‡P¿÷ª´ŽïòX9 «ÀÅ
^‡ Š'R¡ H…zHdZ¸WÁ¨(Ë!ŠÂ2E…ÊPºƒÂ°Ymh A`Ô —Fšù# s7Ô{ÿL}áìK=`Çph&dÉŒ+^ G}ýæ…ã^8Ò +G°êK;N»s*›a¬¯\=z¤hŸÓ;Šˆ¹ p L°k³í‡BOˆsl7±fô›l÷ ’æ¨ ò‚/¼Úæa“jÉÓ0! +f$€Ùy˜È¨ÎÀD¤Š™–ÇVDò4à +¡õyÕˆh(8x -)n“Þü¡;å=8[T¦÷m|é«W$ÞæçsαŒÄl$~»#x¡(2ž;rU †`ɬäe&$¡Â'¡ÞŽÁ—± £Q_̀匶‡Ÿ^à¼ú¸˜‚ Y”¯@
þœ*Ïࣰ@Õ0O ½,j(XÖáHçâùÊ
+/ß i¶ôLðíûª¥ƒ˜£»¾œU@¨ÀÇgÕ0Ly‹àî9è†Ë¾á£ÀëŠÂÉóá“SŸDåÁkUÅÄꛧȔZ—"Qˆq@Rê@ @¾¼<Y½xùÝÙ½
¥Ê¨Ã +¥à¨cvxì-˜úJk%åëK©LoM;*œÇa›ýÛ› b0ÄP<e{iá Ü ¶Ï¨ÎØ>RùÛn¬xKÖ Ù ô¨u©ÏK¨FDìVÁaKZ;”¡·{<gb£W5ö6ëÐíž+©-!UÒ9# ^óÛ׌þ>̇í/$ñ`r×úZö£ +¥Ÿ“.U5'pÏ€
¥bp¯êjwbW¡ôrL U÷`’“~€Y©ôy?È©NûA¢ÂE¿ÔÏÇ÷7ó ]‚ +]0ˆ&3SÒȘf…•æ¼žÕÈÂà 0µ¹²Ã…é^I©þjFånIciUHÉlÑ>ªe¼‹r†»ÿŸ–ÇãͤS¯*·oÔòXÁW2Ùÿ¼±«Â7 +ãÏ_©ø{ t¥:_Â-èkHÔlÆò †X)–¾ìî
‹?†@Õ¬íA½uûrLH8 +…;¥:=}y,û +endobj +2695 0 obj << +/Type /Page +/Contents 2696 0 R +/Resources 2694 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 2662 0 R >> endobj 2697 0 obj << -/D [2693 0 R /XYZ 85.0394 461.8446 null] ->> endobj -914 0 obj << -/D [2693 0 R /XYZ 85.0394 422.0598 null] +/D [2695 0 R /XYZ 85.0394 794.5015 null] >> endobj 2698 0 obj << -/D [2693 0 R /XYZ 85.0394 385.2356 null] ->> endobj -2699 0 obj << -/D [2693 0 R /XYZ 85.0394 352.7463 null] +/D [2695 0 R /XYZ 85.0394 751.4437 null] >> endobj -2700 0 obj << -/D [2693 0 R /XYZ 85.0394 285.5926 null] +2694 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F53 1328 0 R /F41 1233 0 R >> +/ProcSet [ /PDF /Text ] >> endobj 2701 0 obj << -/D [2693 0 R /XYZ 85.0394 224.3257 null] +/Length 2550 +/Filter /FlateDecode +>> +stream +xÚÍZmoÛ8þž_aà>œ¬¹|•¨/ x¯ÙEmk½ÀÙ|P,&*K®%ÇÉýú¾Z¯v¶]à*Š ‘ÃáÌ3ÏÐ!3 ÿÈLD(Jh2‹Ž&b¶Þ\àÙ#ŒýzAœÌ -ÚR?¯.~ü…ų%f«‡Ö\a)Él•ÝÎF$B—0ž_þýæÝò2æóÕÕå‚R΢ùòææêúÝû?à]`IŒç —׿/?ؾ›Ë„Η¿^}¾¼[ývqµ +jµU'˜i¾^ÜÞáY;øí#–H1;À F$IèlsÁC‚3æ{Š‹Ïÿ¶Fͧc¦àB"Ay4[0Ž$¬?n0‚bB@( ŠeÁ`”ŒÌKiƒÝnwj§¾ÞÙÝ—/»]û’U›4/eºQ¶ãv]¤uíD›×êÛˆrNâY[‘ºAjD_ÚÒVA e¤«ð'õuŸï.‰œ«úrAÐä)ml«¬ìÓ
W{ÓX«vïº2ÏÌö©—¼nÜ<ÕƒŸÏ}PoÕ:ÿcª2½Ó ¬ HÆT¦´^Þ ýM0”ÌÐ#ó,8MÀ£"°!(‚Qcë‘ E,w±¦å˜j$ALÄ~Ñö9ç‹Šó²Œàùû‡±Y9Š9ø"~ƒ~^*¯·T›¼iTöƒ}{mŸbó²Q»R5Ð&¶×óï7*CƒHtî “q"Ï„ÄQèDD8¡a@¼~@°`ë”®Ah¨l? X,HGÛÕ“¶£‘óîvl0»ØÐãi[¬ ÇÞchèOu8è1ºq. â¦o v: "D4äýO¢A"Ê9q²›}íŽÞàÄ©à +\2NÈÙàñÀ¨$óÃNcoi_r÷´¶†FÝÀžRŸÍzÑG*=›tñ]«²I›¼r˜ãnO4̺Ç^ŸuÿéÜ‘‰ ‰®?~r¥Œþo9 û"‰¡ì 'jKMÃ~2°¿ß‚m•ÃòL·êø6Àý¦)îFRÀí1ܺ$pw×ß +#a€}r/Ajd3Œ \ *HÒÝÍ;U¨Æ—iùúöªÁ}£÷:J5 ^£T°obÞæô9 –pÚ
—QÊ!ÁóC NÅ{„( kLò#%ñÙjMd2óézÎ3Ë_ m©QD´ÇFC€‘¡u)£óC^vø¾#¶©ž5å<ä
ÌçHö- +ös@쌙 #N»æ׊?–Ör=êîEw z¨(ªƒß2dJÛ€DºäºÏ‹¼y½$ +{³-Ì~$…ý ++0Vî±® ¢›$½‚_"c(i¯tæ@k{ó$Ì=† ͯ«&·.ܯm¹®¼Üî]š1e.tùk+áçµ/.ïÔö-uóìR`ˆ>y|‚O¶UWýÅS+ýh·¸ßšáî–L2sþ–œí¸Y @3
¤Ö3¾W`‡ùÚ¾¸#6mŸ UÝÃÛ +ë¶w Ý®Šì©ªÔ9n=°ìNF¦&3Ú(¡ã3Ɉcì'5SýÛ)Aä„Æ>ÿ÷meiîĘžZ?ŽÏ0µÖÕ££»ÕÇ ?ìÃKR<’°BædÊÖJtø; ……F¡ 0ŽlúýM¨H\D;ÿkÙª{+ŸeZÏ:—:¯ 3ÔöÍ÷‡¾'ïÚš‰¯h\ñ¶Z}8þ,àÏú+„kVë þV×´·üNüÅVbî-_ÑñÒ1ãÛ|üè–csôýò_×ËWÎíª Ýt(œóRÚJ2ô9@a–»k=
dªésx‡ þ<rèáÊ1ü'µþâ¿hAr@7ÍÐÛ/¥ûp$À—ÃÒªÌ5–YÉÝõÄÁ™ µ¾vZÆõ=ˆ$ á §£.L¢ +7ô?uh âÂ>*åû*÷©¹ w‹¥V!ë #Gnw%!ݽ¬YA c‘câé¸Ôt»Þ‡ Hu‡;h žT÷þ7¸à`ZS¡É°ä:-îº]•PX±|ígµ¤Kâãe0®Ç…¹ZÖ uâÏLÐ!6ú÷8P¬ïþ”ãŸÚð1)éÔ•‡@ðqä•Òv'1 rqˆ.¦©ì@÷ÿ
…éuendstream +endobj +2700 0 obj << +/Type /Page +/Contents 2701 0 R +/Resources 2699 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 2704 0 R >> endobj 2702 0 obj << -/D [2693 0 R /XYZ 85.0394 148.1387 null] +/D [2700 0 R /XYZ 56.6929 794.5015 null] >> endobj 2703 0 obj << -/D [2693 0 R /XYZ 85.0394 83.9069 null] +/D [2700 0 R /XYZ 56.6929 335.9533 null] >> endobj -2692 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F55 1321 0 R /F22 961 0 R /F41 1218 0 R /F53 1313 0 R /F39 1161 0 R >> +2699 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F53 1328 0 R /F41 1233 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2706 0 obj << -/Length 1183 +2707 0 obj << +/Length 2326 /Filter /FlateDecode >> stream -xÚWMsâ8½ó+|„ª±V Öב$l&S’
¤j«29xÀ×b›±ÍdÙ_¿-K66vvg‹¶ôÔÝzzÝjÃx\ ¡©ö¤Ç„{‹d€½7˜» ‡ñkßF]Í¿üʤ§‘TxóUË–BX)âÍ—/Ã+D4 <¼LŸÆÓ›‡û‘Oa^
Ç“éÍÝïðÎ1 †ñð~<} ¶c#M‡ãÛÉlô:ÿ4˜Ì›˜ÚqÌL@ß/¯Ø[BøŸ1¸÷/ÐÔKgˆŒÕ#›Álð[c°5[-íå`D™ =DPâ‘ -”G»<ÕçH)É\LµŠ‘Ï”4R`J4R0CYÞš’Ã"*-&[Ù‹uëÛº1 zÑ6ZÄ-íÀ·]˜–q¹ïšÚÑn™ùõ™!#¶Uøuà¾%ËVŽ÷u¼X;͆©}øêD¼+Œ»JáEGéE¶ËGD
hü›ÿ(-«ñl»·+³ù -Q®£¼N$ -2CNζnñ¦`Uú^´h‰þ4©‰¢ˆ+Æ{’¿SHR¢ ì æxeµ“XÏÔú-3ûªAì£KK¸ÝFéÒÜ £pG -õïb—U¾¦Ššw„ì¤ õQˆ¨€þƒ°Z¨ ªQM
<r*áNÔ"¸ì´õ8mS!5bRÊ®Óy½g[Û)ßÐq¼Ä.«ÿˆ7Ù×}iË ³îýy–?¨jˆ v™¾è<{5ȪÌÄX_ m¿š#èG‚‹~kÌ©ßnÊABv Ï», TÓUÓ*Ç'-ƒ=u¶Û,»uú=Ë2J{+¢ ˆÊªR´{‹ÉÄ. ž=ô÷Aö:´Ã„b2”™$tGÚ °a6³?R•Ÿç ž.y®L•QžšëÒø›µ/ˆë,-²¼ŒwÉÁß¡14þ‚×RìZ¸Xøë$\øæ þÜmÿsgxbè¨A¬†#íÇûñµË‡h_t3 >Jwaf›e}O~ò"†}vóíênzó4zþ3ccàBãh1 ¾V±£ý¸eÔHV—àpó–¨×¦Ë$ z¦E:8óuÂ82Ÿ=á↡Ÿþr9|ž1¥Î”O*¡HhxvA™Í)NËœûÆ9ýoÓà^Žendstream +xÚíYKsÛ8¾ûWè¶rMãÉÇѱ¬g7òLÍV’-B+©I{üï·(’¢äìNŽ[:àÕl4_¿ 6¡ðc“H*b9 cIej²ØœÑÉ +ÖÞŸ1G3óD³.ÕÛ‡³‹w"œÄ$x0yXvxE„F›<¤Ÿ§—÷÷7w×·œÏ¸¢Ó·ä|¦(~¼¼ûíòÎÝŸÇ|zùþfCňXhè:ýtw}uþõáç³›‡Vœ®ÈŒ +#ËŸgŸ¿ÒI +’ÿ|F‰ˆ#5y†%,Žùds&• J +ágò³ùÙ¿Z†Uûé˜ +”ˆˆŠx8¢ÎÇt b.¬vçÑ´É5œ/¦Yí§wWØ3HìÕë¤Æ^‚M‘lÜW›¦rKEé:ú¯ÌÏ%•k‹ì”õZï°»;gÑT/JÛ¦n£——féÚ.ÓjÀ›«»Ë7û_¨¢kíwÀãÁ=²fŒ‘X)nO¾6<DÀ§ZØk¶iRëÔ Ät bÙÙë»ùüæ +û™£´2 ®„Â^]b›äyùŒ,¬XUy<iÇãÓüöý›v_nþíN‚;³íˆä}µUNÌ Ü7›´„Kó™¥ql?{wû€<D,%T='’Ó#Fæˆf]* 0 +ëPP˜§² +{Jv»¦¸0’¤•®ª¬,È7ý2…KJ¤ +‚Ó²´T‡ÂôTÇ¥"R„q_šJ[“3º[ëu= +ÉO#Œ$#‘ì{ÅÙ·(7#|„"Q Ôky>£øï!Cœ¼‹–èà2èb€B ÷nã1©ô,],Ê4+V8*—ØþóãåÕìãµ`l>½µ™xô¶\T•^Ì€p¥ +"ã É1”©Ð¸KÊOìKu g-Õÿv +hÛ]ö÷v +c’Ùu=ZH\Ï \z“=î’Ý0 Ê|µØ½lërµK¶ëlá¢ÜVƒèÞUopÂæþ65J|¤['ÅjG-›ºA½àû¹÷VunM!k€ t:¦Š÷E¡ÚÝé +<9\{dIîÚèsp±1¡¡tÕ£ùÚŠð…óðHÇ(‹ÚŠYæ.9¬³<«_N`Ì9È—¢ÜVpwƒx€ (z¹ŠHÈ@ê‘pÁ@p®L(<Þ»,0¼³‘ðÞRí €?Ï ñ JtM[0Ž¸³Öªlv =KÒ +¡ÊEÈÞ ª›À“õœ#œûáÖ˜y¶š-³\°… *!‡l¿½Ê¬óO’ˆÓpȳz•ç¾œp„»æ 9nG8.`rÕ·Àm¹«G÷S¥–ñïmïed‹¾ÎƲb&-—Baõ ¯< R (㙵 g]–‰=Ñ8Ÿ´ßÙˆ˜¥#Ggœ%‚þÑåfc Ìhn"#"ÍCSϽ_ß̯>ÝÞ?Üþz×~5âååÞ&]çD÷=`½ 0n‘*WWB§u†n¸Ä6Áƹè9 …rj^|b9½ÝB Ö× Î‡RsÃyÕŒË ›Gïª ÓÄm÷œ¸}¶x §,µq +f2†ÜM¼½½»ÆÌcJ”IH ‚YçIÇ{p\Ñôv9"¼¢´s/ü1 È‘½Â1ê é©üæãèsV¯qº(}4DlØÉ<+\8-·6:á´hÐ&VÚU³ÑEm— éàÈî‹ÚÑ'ØTkcž«ØÅFHÃn‰ %á‚}“n_àRyû:ÏÉY
ÂeKž<%Yž<æÚX/ÿ€:sq©w2r@§,8©r8kk #dSd H"Ìë_¨œÂMÏJ*Bÿ€j¦|œ4ý²í%Ø<\Ý#=XN¡u¹MY€Ö%
áËKC¹Wý¼ŠÚ +‘:è9!{ŠöPÓ4[eubÂs 2e«"ñY†…¤ÓÛ)QÛ@µhvHQÔ¸ÒW 0ÊÝðÐþÀ!ð(¯bXÒÀ+´ëµ:V“¨S,§#l%qÜúA‹ÕÀ‹/§î% +z]”Å=åä 7 2 +Dßp“|Uî@…|²Í*l}iv„$ò2¾5®4•v4 6Õ:is\;֮جq\ØêijÐø@,‹4ˆ)èxŒ”ÜX c—ýš¥Ž“ªÆ²X“šÏªú%·¬¢¡ +ìœ{ý†ÑÞm˜Š
)uU; ~¥¥w ÂôàÆÿQu¿¯¶&17òà /ó¼·Ñ¨èÂϘ{›o¶ÁäÏ…vI§û«Â¼y÷8 ¾!%ûǦaìBH) endobj -2705 0 obj << +2706 0 obj << /Type /Page -/Contents 2706 0 R -/Resources 2704 0 R +/Contents 2707 0 R +/Resources 2705 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2691 0 R ->> endobj -2707 0 obj << -/D [2705 0 R /XYZ 56.6929 794.5015 null] ->> endobj -918 0 obj << -/D [2705 0 R /XYZ 56.6929 769.5949 null] +/Parent 2704 0 R >> endobj 2708 0 obj << -/D [2705 0 R /XYZ 56.6929 743.9119 null] +/D [2706 0 R /XYZ 85.0394 794.5015 null] >> endobj 2709 0 obj << -/D [2705 0 R /XYZ 56.6929 710.2666 null] +/D [2706 0 R /XYZ 85.0394 692.3622 null] >> endobj 2710 0 obj << -/D [2705 0 R /XYZ 56.6929 638.9488 null] +/D [2706 0 R /XYZ 85.0394 528.5904 null] >> endobj 2711 0 obj << -/D [2705 0 R /XYZ 56.6929 573.5178 null] +/D [2706 0 R /XYZ 85.0394 455.289 null] +>> endobj +910 0 obj << +/D [2706 0 R /XYZ 85.0394 405.554 null] >> endobj 2712 0 obj << -/D [2705 0 R /XYZ 56.6929 493.1666 null] +/D [2706 0 R /XYZ 85.0394 373.0534 null] >> endobj 2713 0 obj << -/D [2705 0 R /XYZ 56.6929 337.618 null] +/D [2706 0 R /XYZ 85.0394 338.0016 null] >> endobj 2714 0 obj << -/D [2705 0 R /XYZ 56.6929 269.222 null] ->> endobj -922 0 obj << -/D [2705 0 R /XYZ 56.6929 226.5437 null] +/D [2706 0 R /XYZ 85.0394 273.7334 null] >> endobj 2715 0 obj << -/D [2705 0 R /XYZ 56.6929 188.4488 null] +/D [2706 0 R /XYZ 85.0394 203.3969 null] >> endobj -2716 0 obj << -/D [2705 0 R /XYZ 56.6929 154.6889 null] ->> endobj -2717 0 obj << -/D [2705 0 R /XYZ 56.6929 83.3711 null] ->> endobj -2704 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F41 1218 0 R /F53 1313 0 R /F55 1321 0 R >> +2705 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F21 950 0 R /F48 1253 0 R /F14 976 0 R /F39 1173 0 R /F41 1233 0 R /F53 1328 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2720 0 obj << -/Length 1946 +2718 0 obj << +/Length 2639 /Filter /FlateDecode >> stream -xÚ¥X[“â¶~çWðsjÑÑÅ×Gvf²C’e7›Ê©Í>xŒ -VÃZ—zŸ6&48NiíV×uº¶ŠÒø©lò 䪒ä²jigÁ†xÇ´¾<U,î¾ÝÁÚçBS… s *м'ò~6'"ßî -½…
Ív5kuÆ,ä é\lrLÚ Bh9Z—H9.ÿB' ;/ék³¨„E *ö «£~C @àeü®;:H~›žˆÀdÖN«;\^äÍÉYÐ ¡WK<"’XH=‘/õ‘ y/m…J?¤4.šü†ÈãF—4ië ™˜0Da1‹¢ƒRHa[›ÔÙx³M³±9 Ôû-~„1‹ýXÙÛj™£¬®iŸfSÕšìpyÙŒ<Ê´º©ÚJ1릱qÀXÆ‚E Α)Ö‡˜žýQGd7›pcÑêD´IZ–œS[‚±w({œ‘HD€µÿÆQ¬B»ÀÀ!n[ïtÖÚ@PBVüP[»K ø¼³Pg䚆ÆTT à¬m+]䥆<U<ò¦+rŸS赋<¢åñ•~c€Ç½PÍa -¶Äü¼²L [ÀŒé®èŠ‹£ 12ô‰~>5&M€\U{",hšMiÕlYoˆG ˆa‹#¯²Ö ÷¡‰Õ®¸$튛õ*ö‰I—1! ±¤…)é’¦R…º#¢ë/œ?æEA3ˆ¥È±0i°Ø”h^jâØ\¥gÅt› Ãùó,${P - Èa†îj{ÓcÏ’X¸>ÀD5šhßêóƒNЕë;?ÔƒÏüD]BÂäÓâñÃÓ÷ -@´/ èÍOu£·µÅ -XpßÈÍÒ~Å*xôD2¦®Ua,ÐGD¹{ƒFæõI¤Ûï{Hy*« \5×ÏÕÞœ - ŽRЦA_×ó¼`® Ïzßàœñ -óôôEϼ•º<®9A : à…EAl3 N UÈ/z¡P êXXªizYmÓ¼ìͧñÂ1·_ñzÒ\Ù{™±ÐÛEqdíuñ”RpŸ—ôuSp½ŒÌ5/<l˜{Né¥õqÊÌã§6iŠümÕo—î!³À µií”}Ñ Tæv5×/|í¦Ã†o¶ÑÙW˲ÝÄØ äâBxI‹|iÞ%æµµºÉCû*¤V}Y;À³ÐzEwûÿ]a3úýÄ<½ûôþa¶˜ßüÑbó. ˜’<ùvnv„Ü¿"·©é„Ú|»Ú®hÆ£äÛ[¶B·{^à%ù妋¶'3ÙN “¹°_ò¥sœ ]÷ê8ÃE[ìµ¥ +xÚZ[oÛ:~ϯðÛ:@Ì’/âcÚ¦gsÐ&ÙÆ],pz [Ž…ÚRÖ’“Í¿ß^$J– œ¢@M‘£áp®ßPa +ÿØD*¢ 7m‘”ÉÉb{F'°öÛó4³@4‹©ÞÏÏÞ}JôÄ£¸šÌW¯”Ð4e“ùòé{ÂRrþçü÷wŸds f”ÃHõõæãòáöæ“£ì±åZÍãI/ïî®n>^ÿç|Æ%öç3IéôËåÍ·ËÏnîîÜðéåoW÷ÈììjÞ $>,£ žâ¿güI'K8óïg”$&•“x „Ã'Û3!"E’„™ÍÙýÙ¿Z†Ñª}uTyŒž(>¢=Î&Œ#%ï©O¢žØÓÞÞͯooOÂ@%LM4ç$aT ÙÙÍbª°ñˆÙî;{ð6“%›°¢3D]íw‹|–-—»¼®‡2É ×Bœ±¥‘‘Ç;KM¸”º/ä·: ó,J„Pò¨”Ö©&I +œ yVŸÏͦÍ:ǷtºÈÝ2Âgdf'VÕÎQúWØtQ•e¾hŠªô¼ªAïžóݹS †4!"MA
?€,_ö›¦xÚäΫ‹²n²r‘×î1sR¸‡§|·-š&_ºGÜÐÒl6Õ‹ÖyÓå£{¨Vî÷¡jÖþµçt}÷,üËå²RžI¤ KÒé"¯É1 U)ÄŽNùi ©ŽûhKe}t1æ£m,X L±* g«b“ 8h‰ÒÚœ–¯¥°ç ‰&JB‚èI8î •¢f\Ä_l•‘w2ã= ðòwJùã~—9ÃIœÙxôš<[º´;3I÷ú2_eàdncÁzQD Õ,Hù.oïvårAPÞ±0JˆJUÈçÇA[ÊÞð…Žè„+x"ë ?ÞÌV?ò×q7`Ššš“’µD‡¢õœ€3¨PÔbÙŽú€Ñ‚7à‰œ„6‘p.|¼òßt3Áè8Ù l°ó$¼"NÉ”¤Ü¤FÇmeÃÂLSÕÚ|–P6‡}¼h(ÎÈVP9£U¼“Ë…PH‰†dØÏ…'¤0LYù¥Øl`[¦§¹ûÝ×6/ÂÈæEøÍö Œ²)YciÄÑv ¯vë5,ößpʳK6uÛq±êGÊl ÙÏF¹a"$e•{Aʪ JaD(ô•’ÿ¯¨›£¡&®‰8 k1Õñ`k©l´Õoæ]¯¦a¬QN´9-˜§9”« >\@a_°n×~pkÑF[Ú5Æe¶õ#¬åøÛ«òva5x§u¿¬‹ÅÚ
·Y³Xçþ¥ìjx“oÁ#„FŸ-øÉÌ™\IXÑô-ÞOöIÚ%û$uPÄ >¶aÊ ‚ù£cè!“Nº8ÖTN¯WŽiY¹Â)p5hçöOO›Ã ŸœH;¥<D•›Ýe~q>L6]WuãHÑžðáÕMù°r.ÁÄÀ÷}›µÊ<²Ødì.
Mõ„Jóè)6CˆÚHî)' +9 Ý…{ßTȽMÑ0öi +A˜ŸÁ4u<–3.ßÀù1Õ‰XT6–ŸÞ¬œOÕ®Êe8&}C®@4"W¬9£ÁùÌ@®û<ÀÏ(5GÐvþáÎC_/Ý0ApC¨Á†Fò RtW5#x}óÑÌ?¼Þó‚tec3Eå͹Xg€þ7pþu(xG +Wâhÿ¬Q°n ²Öý÷pK¨4ZaÞ<µe Ù²Wþ!S ®ú[^•ÙCpṙ*ä¦z|„ä¨ä)¡ÙmBLu\ -•UÂ븋'¢ÅÕ XÄb¥ +ª7ô™ñ†o]@ +H¸Œ^ÌÃÃ#ôK
‘Ò¨þŠåa)eD2¡O«¥Ñ[¸R£X×oÖtÊçk ´ +PBµøÓµõ®S® 4Ö-ìsöe ì ßwÈé“o-Ú秃$óSˆŒ/P…’–nÒw m ?s-6¼Ø"_ã~#;êù™\‹Aû†FA ©éMecj‚D4õì¨É‚°Úb[GÐd…ÝV굿ª\ºÕ.Ž=Aèž`»Ô„yß·£•gå@!F ürì0‡¸lFúÎO7¨1Ø^{xW¯«ýfÙ6N¼Uß½bnëìÙO=æe¾ËüÆŽ¶Å•¾UynQ!ËÔµ¿ æF+ƒ°åÜùÚ'û–×ÂÞW<mrËAà¥Dã¦éa":,Ìb—@Ôj ^Çz í&•ì/ô‰aó| œÇÌ0eÜÄår[”$ì¬ 'ùš¯¼6Ë…íKVîAiN
‰„R6sV¥à åÈ) Q£LóŸéÔT›„°q_ª?î1žâŽ‰eXYç›'7òÕ„´E_uf³8M¡6+Buêðçë/×sû™ +ÿk?ñ Ž>Í% +¥£M²" +ÝßpüÞ}ì3&×’ÀË*…ÇdZ ÞÙø¿i8”ýÿ7_Uyendstream endobj -2719 0 obj << +2717 0 obj << /Type /Page -/Contents 2720 0 R -/Resources 2718 0 R +/Contents 2718 0 R +/Resources 2716 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2691 0 R +/Parent 2704 0 R +>> endobj +2719 0 obj << +/D [2717 0 R /XYZ 56.6929 794.5015 null] +>> endobj +2720 0 obj << +/D [2717 0 R /XYZ 56.6929 752.2728 null] >> endobj 2721 0 obj << -/D [2719 0 R /XYZ 85.0394 794.5015 null] +/D [2717 0 R /XYZ 56.6929 348.0801 null] >> endobj 2722 0 obj << -/D [2719 0 R /XYZ 85.0394 752.0914 null] +/D [2717 0 R /XYZ 56.6929 250.1909 null] >> endobj 2723 0 obj << -/D [2719 0 R /XYZ 85.0394 555.924 null] +/D [2717 0 R /XYZ 56.6929 188.746 null] +>> endobj +914 0 obj << +/D [2717 0 R /XYZ 56.6929 150.8976 null] >> endobj 2724 0 obj << -/D [2719 0 R /XYZ 85.0394 468.7059 null] +/D [2717 0 R /XYZ 56.6929 118.3669 null] >> endobj 2725 0 obj << -/D [2719 0 R /XYZ 85.0394 405.3981 null] +/D [2717 0 R /XYZ 56.6929 83.2849 null] >> endobj -926 0 obj << -/D [2719 0 R /XYZ 85.0394 366.2553 null] ->> endobj -2726 0 obj << -/D [2719 0 R /XYZ 85.0394 333.1561 null] ->> endobj -2727 0 obj << -/D [2719 0 R /XYZ 85.0394 297.5057 null] +2716 0 obj << +/Font << /F37 1038 0 R /F53 1328 0 R /F21 950 0 R /F55 1336 0 R /F22 973 0 R /F41 1233 0 R /F39 1173 0 R /F48 1253 0 R >> +/ProcSet [ /PDF /Text ] >> endobj 2728 0 obj << -/D [2719 0 R /XYZ 85.0394 231.276 null] +/Length 2932 +/Filter /FlateDecode +>> +stream +xÚ¥]oÜ6òÝ¿b{¨Üz~ˆ•<9ŽÓsѸ¹Æ +ôú ìʶPä®´vÃý÷›á\I«uR ü°ÔšÎ÷Œ, þÄÂjÆUž.²<eš ½XmNøâö¾?þÌ2 ZO½½9yõ^e‹œåFšÅÍí +7õ}H ‚ Ô¡jO»ZÏP‡bMë\k%“'T~<V`•kwS +ªo¬‹'
®ž +RrüYì˜ È¸,žl½'ÛèÉ–R#BŠ Èìm¨ B²‡#Á¡!\|ãéx%ø'=œ¤ä¥ +¸ˆa÷«XÝ+Ê2á.Щ<í8çš÷ Ì€x¹^ò$
ýîœ'A§ï=)ãOÂE6’EW‚•s%øõ®”yWʸ7 0&;p$ç*b)Ñr‰ù sùá
„ÒÐö‹à ¨›±@•Æ 惑ûÍY>š9:Z2aô8 byVíÓT¾ÉÊÕ +¼”îO=€çB½Q‡&v¦¾<¿í÷EùœrRÁ2 ^_ŠËút›î³ÊSë˜XŸ…Ú;TÝ¡D ÖÖôXAß¹[—¾ð.|ßÐoÑÞ (;µ±Áˆx±\£°ãJxOaT "ÀÜ€EHÚSôòP¥¨Qø‚úÐP‹ávÅ4¼BC +ý… +ñ5]_þÁI<ñŽJpaX£b\÷’Ë©mLT}ƒHùÄÙ(^JeñGI+‚hÌß5 …»)
+¦ [ LS’þî¥àtOÀ-„ÐvCë ß3z¤j3ÛWÐcŸË-“<v…ø¹lœó}ɤ塈 ˆÇÓñŸ:¦}j<{Ý MnYªÒ€jS½@T1¡"Ñ3/b-×øYô0c_1Ä–!TåCÑe4ëÆãÑìÍ ‡ý[ºâ†vÂ¥ÜLéa׳™‹I£™Ž ûeY¦°=eK¥ Åz¢ÝÝW¢Ä‚+2QÜÍ=ç»>Ìœ-㹜‹c˜: ‹ª.¢†0°)š0䆂jÓùxð©,'‰úò×ó ¼ô‡1Ý Îà ´À(´Žã‰ð馛 .¡c_ñù7ÐÉXÐIì ³ÚÊÑ—†¥á<ù“LÀ=2”É×€¥p¾nWEmÚ›¹: <CtàáÂðüÆ·ºcJ¤ÿFd˜‘ùø3ŒRý"ÓŽrf(ÏýHÿ±`æË=Èÿïÿ_ØÿGš1eíþ +endobj +2727 0 obj << +/Type /Page +/Contents 2728 0 R +/Resources 2726 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 2704 0 R >> endobj 2729 0 obj << -/D [2719 0 R /XYZ 85.0394 170.9331 null] +/D [2727 0 R /XYZ 85.0394 794.5015 null] >> endobj 2730 0 obj << -/D [2719 0 R /XYZ 85.0394 95.6701 null] +/D [2727 0 R /XYZ 85.0394 749.0409 null] >> endobj -2718 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F39 1161 0 R /F41 1218 0 R /F53 1313 0 R >> +2731 0 obj << +/D [2727 0 R /XYZ 85.0394 687.8191 null] +>> endobj +2732 0 obj << +/D [2727 0 R /XYZ 85.0394 186.4649 null] +>> endobj +2726 0 obj << +/Font << /F37 1038 0 R /F53 1328 0 R /F21 950 0 R /F41 1233 0 R /F22 973 0 R >> /ProcSet [ /PDF /Text ] >> endobj +2735 0 obj << +/Length 1767 +/Filter /FlateDecode +>> +stream +xÚ¥X[sÛ¶~ׯÐø¥Ôœ! +Ž’Óóåÿb~Ù|ŠË‡_žV¼9ù¤Ë%-Ëw—ÿ)? ÛÀ>^iïÕgã0° yÚ +Š\i• ÈB +ªñ‡ßx!¹ù%ŠXålrQíE ª&ãà+k”AVWVÂíf¶Em·KXJia G¨9,ƒæ~±êGè|»yFU`Zë=HЋ;Ï‚¦Z–6mÍÊT-Ò‹*/2 4Ý1.ìxŽ÷Ð`6.s±XuáVÁÛóùqxþZà,-g4èè(NGߺSçY™b 츮ڴ¨ §Ü r“6&Lbœ˜*«ó¢ºÅY½|J¡'2V43UÖ $Ì\ á×› ÜÔà$Ò cP‹UˆçåZÑP‰†`,Ð ´q6,(A,Q1÷{‹wnP=îîW5r¢ˆ‰ŒùóùAJy @:ø»2Y먑¸Ë4p·“ïã
X±DÙ[¢:M1(¼ÃÐ|2 }úF„c&Hᶾïyuaû‹k*ñ¡Hñµ†U¯p|O‡›Ç.¢1x6éû!ë£,_Þö ú*mÀÏü_äˆÕ0¿³HCçNßSý¹ýõ‘ØjR%dÉÚâ5þ˜½È +’Ä{™ŸXé#¢…„œ*¨çÄL9-gpÅ7{œ‹ WÞ +ÝžÔ B|Ž:¼é‰Y›}FähÂ…ìxlÎY×e3æWˆèíûÚàm[ÖëáIL [í f“uþTØFX’t¬èî²cÕÑýº°.ñ áLÊ%ý‡ Ù%Ђš„¥¤Wφ¯±#ÖDQ¦>‡ªÛö|Oo“ÝÕا ýVÕÛÊ÷¿ejMþÃ7ÁÖÍnúnÖumG8ù _ÊѾ7DÜÅœðÈjg^ÌÏOÐîë“«Tå àåæöéì͇«¹õæâìòâ +"¸ÂžÎÕYN_”9}ö´Tì"ìèƯîJ¿‹@Ž«>ðN³ÌܷȉÅÃR}’†N¡ñlUŽ<Ý>–Õ·UñÉ+„H —‚-¥¹7YaïN-ª±éÛ˜CÈ$DÛFö rpRù(q¦» +Á)ïÔãˆ>«¾E £ :;-ªQuà õ% ƒ/>¨|æibƒkcôh æ®ìuËcyˆÉcù| ãHÉ`²ß‡ š±AãeÓ~xŸ]¼Æ‘Æ×<_UÑ´ +endobj +2734 0 obj << +/Type /Page +/Contents 2735 0 R +/Resources 2733 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 2704 0 R +>> endobj +2736 0 obj << +/D [2734 0 R /XYZ 56.6929 794.5015 null] +>> endobj +2737 0 obj << +/D [2734 0 R /XYZ 56.6929 253.0811 null] +>> endobj +2738 0 obj << +/D [2734 0 R /XYZ 56.6929 157.3292 null] +>> endobj +2739 0 obj << +/D [2734 0 R /XYZ 56.6929 85.4876 null] +>> endobj 2733 0 obj << -/Length 807 +/Font << /F37 1038 0 R /F53 1328 0 R /F41 1233 0 R /F22 973 0 R /F21 950 0 R /F48 1253 0 R /F39 1173 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +2742 0 obj << +/Length 2868 /Filter /FlateDecode >> stream -xÚ¥UMo£0½ó+8©ñú¬=Ñ4ýR·í6©´R·H‚
°UÿýŽ±¡$¡ÙÃ*RÛãyožglâbøWH$U®¯8˜w‘9Ø]ÁÚ…C¬Ï¸u÷½Nçηsæ» -)I¥;_öbqçñ“wŠ(A#½ÛÙtÂ.ÃÙåhL‰Ï˜ÞßOoÏ®~ÁX`ð7Œ½ áícxcæîGŠzáÅt6zž_;ÓyÇ©Ï›`¦ ½9OÏØþµƒSpßa€QŠº™ÃC‚3ÖÎlœ™ó³ Ø[m¶éÀE€å¡(ÀtX,‚|BÀÇç8ªO±(«õÒbE›U±M«u¶Ÿ.ÁD#3· ô -ûÇ¡[§èÝ*ä(`tzÞÔ -(Е!ØÅҪǩ¦m¬^i–”tvŸ-%°ÊuQobc¿ØÕ×d jgIüµ¨Ðã@æ_¢ö¼ŽˆÚzéÌâ"‹Òü@PèXIÔqØÖi -›Þå„›çàêöÌø+»-ÎÒ<-+(¸¶
’ebï…¥õ#Êk8uÃj§ˆd€¨”ptø“€ @u‡‡ó‰‰(ˆñàB¤\ë=¬% qµ§Cø8¿¼{ˆ¸'ÀUÍ•'•a1û(«$³5<†ƒK1³¯^; +xÚ¥ZKoãF¾ûWè(QO¿ÙÄž&™I0ÁÆ3›q€’ d‘¶ˆH¢"Qvœ_¿_?ER-ÉÁ¶šÅêꪯ^ÝfŠ?61ŠPQÊIQJ¢(S“Åú†Nžðî‡hf‘hÖ§úöþæÝ÷¢˜”¤Ô\Oî {¼ ¡Æ°É}õëôý—/ ï>|úïíŒ+:ý–ÜÎ¥ÓŸÞßýòþß~îËmɧïøøõvÆJYH±ÒÒi:ýùîÃw³ï>ß}ÿÃÇ»Ûßï¼ùxŸÄê‹Î¨°2ýyóëïtRa?ÞP"J£&/øAÁ°ä“õT‚()DœYÝ|½ùObØ{ë>Í©B C”áEFœM˜$Bj>P†* 7wÊ°;Ã.)4°ÛT‹Ù¢Ý<>Õ»3°Ÿ E +µ#½›¯k;¾¼§cPñ’éù
˜8eþÆyáGö ýQ¿ú¨êݼkÚ@ܵí*¬Ù)•âaQB~}Ý´Û}³ @C‹ªÐ¨ÐBæK–\IŒ³À¢„ÚUf}N™’e€•¨N÷®¡Ò_góßãèÁïK‰ &,¦
Ö¶ –}ówPò`=É aÁ]â¹Èð´&ÓJ Y>6«Àr™Fd˜k#yd¾I x óíUy·í®Ëðã‚”Ö£Füv~3QÂi8ð8K +É#ž½¾<gx (·„›Y´»Ý-3Óz¿m7•!£NhŠ«2"«v»vµÏ¬,J"uaoWËpCº`Œ ƒH†h •Ègßkhxïen6õhx\i"[˜ªsúÑœ<…“‡WÏu q‰·´y³”e´O¨ Ž–]½Þ2ƦßàK y¬é¥ ‘ʃ»[3=„¹—¦[úÙdÞ¡Z”!ÌÈ"H5›çÔBI!T¼Ý§ +†ÿ™Ðu +E¥æìŠé9‘,E¾3‰{¥¦ìg€œ?sR Õ׆m¯wÝaKl*à ++øBŸ íº¾sÐtºn½výd½š?´¶÷ñ?O[ L"Ô Gç[¦Ê¿xxÍù—D‡[z‡>DËó5EK« õ2ÿyhü ²6Ñ<Bûøk¾Þ®b + }ÍíœËævЄ‰‡¦ÛÛjTŽ? lîs“u|v/u (YàêÀ†bÜ„cñ/ MB66)Ъ‹ÄŽ Ìݳ3nÎZ›Ûó5]êËÖîS·v¢rÖ^ä¬
÷F%sz + ê2¸ÕúÒžWûá¥ù. } U Þdûñ¹„ •O‡TY9{æÓ7ç¼xcÊ¢(¼ÓÅYÓ04-’¡6¼hš>ÕyÓ$*gš?ÞƒãÍA6_”íƒO…ËÆàtƒlkÙ`# o¥´Ëz~äíØ£‰wXú$,G¶.!>m‡£¼X |?¢Sé=÷çùÊžaXµëy³9J@.„àûˆ«q,Î4h×Œì· ³K ¯Âƶëöä2lzT`© l¶Wao‡˜á”Øý]”+eäâ£Itø#Á†Y; Ï»AjÇEÙkÇí'©½Ø^ÓUù¿¦(á¸×ú^IJ‘ú¤z™zDqU·‹/B±â<úNn뻵×3òŸÝŽÒÄs‘ÉL¢¬¡œÉ7T0ßy01A˜dW*ƒ>Õ0E*¦]L%ÑF$O\¥$Jc.K—¨2â
0ɢ@栘
1¥ìù8 jºoÎn‹ÚO»jO/§©æÝÜÏzëcïÑm‹kI<B-[D©v×ü OH5® µï‘BrŠ {Û–D Ɇ‡YûW ní[½ªu±S3´ßŸÚz´=7Uí'²çýè…EºEzWÕÏï¾2I ¤:°ºÞ\mÛ‰éß±>X4‹Úu ñúÁÊ—`’¾FíKÒñô+oÂííӵͣóªÀ2 ZŸ®C¸n6ÛCG2»4ö6ŽÇ™nÈ™ïÇ„,ÒAîÙÄtšBö@ÈÙÍÑh¹Î[mÊ ïC\ŒèbÂAˆž •o“j‰H;rg4«DWejê³~‡ƒ#Ì4àb^ùi¯ÛXö8û8Kßjø¬¥C±êÎê@{ êìå´AÙ/äªüi<ü*Sl*w z<(Ùïœ
Ãy
j]1B}8P°qì!¤\»wrî_„"öŠ60hºú¿ÿ-èøïOÒ^#›3ÙLP4Âö ^(»!V”cÑÓ?Êþ?Ò'4øendstream +endobj +2741 0 obj << +/Type /Page +/Contents 2742 0 R +/Resources 2740 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 2704 0 R +>> endobj +2743 0 obj << +/D [2741 0 R /XYZ 85.0394 794.5015 null] +>> endobj +918 0 obj << +/D [2741 0 R /XYZ 85.0394 769.5949 null] +>> endobj +2744 0 obj << +/D [2741 0 R /XYZ 85.0394 744.3535 null] +>> endobj +2745 0 obj << +/D [2741 0 R /XYZ 85.0394 712.0918 null] +>> endobj +2746 0 obj << +/D [2741 0 R /XYZ 85.0394 645.3077 null] +>> endobj +2747 0 obj << +/D [2741 0 R /XYZ 85.0394 572.4552 null] +>> endobj +2748 0 obj << +/D [2741 0 R /XYZ 85.0394 472.7274 null] +>> endobj +2740 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R /F53 1328 0 R /F55 1336 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +2751 0 obj << +/Length 2216 +/Filter /FlateDecode +>> +stream +xÚ¥Y[oÛ¸~ϯð£Ô\ÞÄËcÚ¦=YtÓœ&èöA±äD¨,y-y³Yœ fx‘%›‰{p ¢È9 ~3ó
ÍfþØ,SDYngÚJ’Q–Í–ë3:{€±g,È,¢Ðb,õöîì—BÏ,±Š«ÙÝj4—!Ô6»+¾ÍßNÉ9LAçïß_ß.Þ}¾þðñòú|Ál–ñùÅÍÍåõû«ßÏ<£ ’”λ¸þzñÉ÷Ýœ[ûxy{þýî׳˻A±êŒ +Ôéϳoß鬀 üzF‰°&›=Á %ÌZ>[ŸÉLL +{ê³Û³ŽFݧ)SÈÌŒKF„fêƒ1¢!-‘ro/ÎRö +Bh®E‡ÛüåC–%\€Õ©É‹b[vÝ¡95D+ÍFk )6 kÆÇ 2A´4SÕn7å²úƒR^vp2œÎûÇl~uã;P³sfæ¨ëxz,}‡ßÔd÷LHB%ÓaWM¾.‹ 6VEÂŒQAª®º¾lÂì«vë×_¶ëuÞ¾wù˜7MY‡—Ú˾j‡oœ>í:¡§Šp+dXjÛË„>€f©E!( +ǵŠGßn1aÊÖ?;DÿêÙ¿äø0sÜ9 Ö²o·aäUÄg–P&ÙiÄ[ÍxzªêÚO½=7ó]Ð +,ïpÜöe1Sfj~†òbáQ)À‰©5&Â’»ùŠ +÷–ãœJ€lPqÅçíÊ÷ &”cÕ!Êh>r
ò£|N(Ÿ{ˆÁ]ƒò0í}éŸOÛª?gspbÿîUç}õWpwŠ8_ÕÍ ƒÝ ”÷¾U…', ó ¬ºjw.<`׳·Êfê´ƒ[Ž
œ8ÊLCå'c%Ö +5I– iNxðHêŽRê»T2aÄØ,F°]W y¯åDZsB¯(”Ðkl«!\Ú½‚ëºÓr®«äK®+‰Ö{ÕuÁÈœÙC× $ç]Ùï±ííSSnCsu°¾œ&)NöëŸÀ½˜%ë°ÖC kåÞO ëj•Ø§Î€WÑøyŒ¼SK@kÔÄ»†˜çu79dç"¸?D›LÐ÷o›úù
Êbzj÷~”wÅÜ¿=æ!MU}hDËf>?à¶ãv=V³„tK•F5a‡Ìãâò÷‹ßn>y¦w°{ +ŸdHPH®H +Û R]·O ›JȚ²éœCs8·>Ly v¿ó@…V +H
åx4Ø
Љ¨áfZ=`pT@ƒ“x§ñ+>±„ j¾ÙVMtùzS':#BØ1®qå°1 ü×nŒ¨ØX¶ÛÀY6mSTÍC*õQA ¸¬ÕoÛºKÅL@æ1<á"‰Ù ÉTLèi‡Dn‘é¸`׃®ËaŠ:÷Áb÷a3þ0Ñ5ðjb +å ‰šú„Ì>â Þ&Ì+-‘TŽÓËöµáâIœD£¶0 N@0NÂÝèÔÏn//ý:Ÿn?Ÿv6œýšQÿXÔ0B²Ñ€ÛìHÚÍHŒä y1õöêú½ÿÔ¥ŠuÕ +`*F‰gŠd 6œ
è¹Ü‘W¹Îx +Ç)dŠë RÇ{Çèù-†OXo ‰ &:\^?´@I × '† +ßJ ô=Îú8´~$æ‡bCgC [7ÃÑM#Ð0)ØáäÛÄ”`|£²î¶ÛõªJ†u MÌá¬ÝÉY_ÐÐeLœî?!+ý“˜m!,\([&¡òŸ¶IN –Å+›5ÿŒ-Ôæ{Òq¥<‚%ã‘ï/oß}¹º¹»ú|ÈÎ{èj.ç'ÔP}Eò†®c¤«ûŒ ïþ@üÐýs*_A¬†\‘Ôt»M“&V—’mNf?ÿÿö€ÀÃæW½W·«€ìïrŒ8d0^Ìqcxâjés"×¹ª:>èÎ ÷¡ŽáÁ¾h¶ÁxøîJ2(£7žbþUƒlºà”#×g?aG;OÚÑÈÚ¼ž¤fO&ž›>ÿ;*ê +Pw uÇ áÙ”eï(<K@F!!ù‰ƒ»" Ç£ßD^±¬wÁ ÈqCˆ.ÿ ºén8C=0Yo™Å¦«åsæ#é … -Õ “°á Ë€Êô׎[r5‡(”c½€].|¸^¬L°g\¸6ˆºÒà ŽÖUSÂÖ!QºJ »¼AQò>|áé¸[e:™Ð´Ø3¬3`þ5ÐEÇ£G +@šp.Ä@à“ššùŒ!¸`8Û7Iú ¬ÁÆϧ©nô)¬¾N1"Ž¡ÙÆPÿÔîê°×hÿ–ˆj ,ZfSûx·UplÀ“}ùn^H§Í9s b )ƒãh̓·Ã÷/š“3M¤µì' ’×Qûë_¥‡!Ý;¼ + +ªú« ˆ!l¹ZF€ ’Æ8îÁØÔK‹ñÜT{Æ´Š7z°oòÒï¹ðG†¢Cªû¿ËØÿf#5Ä.ÃÓ×3\CµÐJá6™¡Ç7Uø 0cÝÿ yÚ|ðendstream endobj -2732 0 obj << +2750 0 obj << /Type /Page -/Contents 2733 0 R -/Resources 2731 0 R +/Contents 2751 0 R +/Resources 2749 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 2691 0 R +/Parent 2760 0 R >> endobj -2734 0 obj << -/D [2732 0 R /XYZ 56.6929 794.5015 null] +2752 0 obj << +/D [2750 0 R /XYZ 56.6929 794.5015 null] >> endobj -2735 0 obj << -/D [2732 0 R /XYZ 56.6929 615.679 null] +2753 0 obj << +/D [2750 0 R /XYZ 56.6929 590.0348 null] >> endobj -2736 0 obj << -/D [2732 0 R /XYZ 56.6929 555.6269 null] +2754 0 obj << +/D [2750 0 R /XYZ 56.6929 462.241 null] >> endobj -2731 0 obj << -/Font << /F37 1026 0 R /F21 938 0 R /F22 961 0 R /F39 1161 0 R >> +2755 0 obj << +/D [2750 0 R /XYZ 56.6929 400.964 null] +>> endobj +922 0 obj << +/D [2750 0 R /XYZ 56.6929 363.2323 null] +>> endobj +2756 0 obj << +/D [2750 0 R /XYZ 56.6929 327.1951 null] +>> endobj +2757 0 obj << +/D [2750 0 R /XYZ 56.6929 295.7222 null] +>> endobj +2758 0 obj << +/D [2750 0 R /XYZ 56.6929 231.5234 null] +>> endobj +2759 0 obj << +/D [2750 0 R /XYZ 56.6929 161.2561 null] +>> endobj +2749 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F55 1336 0 R /F22 973 0 R /F41 1233 0 R /F48 1253 0 R /F39 1173 0 R /F53 1328 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2059 0 obj -[930 0 R /Fit] +2763 0 obj << +/Length 2602 +/Filter /FlateDecode +>> +stream +xÚ½Y_oÛHϧð£ÔÓù/éî)½æzYlÓl“ØÝÅÇÂÚ’kÉIÓOäpF–ÅÙÇ"õˆâÌ òGr$f þ‰YjW™ž%™f† 3[nÏøìÞ}:g™}®wgïÿ©’YÆ2+íìnÕ[+e<MÅì®øm~qssyýñêßç iøü;_ÎçŸ/®½ø™h7癜_|º¼…G‘%˜¤@>Ëç_éíõÅçËó?î~:»¼ëÄê‹.¸B™¾ýöŸ ÁOgœ©,5³'xàLd™œmÏ´QÌh¥"esv{öK·`ïŸ:e +£RfR™LØBÊ)[˜ŒY%•·ÅuÝ:PÒ¦óv·¨Ì½YZ3ed[!{•o]¸úk+ŬU6p•mã6+Zv™WaPW¿s. ûs‘Îæ9ýlêe¾¡áÇ×·4úÓ=Ó`Uïiph´§²]OÈ*¥b*édm»"ê-6bÊ%"L`KZ&„MCQTÍôX=¸jb5k˜ä:n_6´q]mž‘y¶ÐR3žh5[Á2c$‰é\6]Ȕϟ֕ +o lëÎZðä6ù}½'•àñhѼ-ë0Ño /iÞ·CIƒâoç •ð`Kä«š6¯–î >¦ór5¡¼§—V¦cƒ¾T ¼$ÕÚöUÚšöºÃùEW^ªzKO9ÙGY°6hh ’K~ +±Ù<7Û Ïªã]Áî
a„‘‡3¿ÜÜ]}o)gÜ +!—)5J:ëüÑ òá6o‡ø`ò1ß”òŠz›—q»• +VÄr{xJ©‚}ó@‡QÓ¯û¾ÛäUÞÖ1—µî{\nO¿‡&p‘Û{ÜëöÖ)dP›ªÓöîs½nïŽËÛ{?‘i L»Ô·§¨·«ró2×@)¨³4=-]Ç5!Þ°°„ÃI¹Ê7L7†Å˜ySSÓ·tD&ÐAZâÆ"'ª/2q +yZ°ŽkB²–I
ãh·àPèbJ›ùºnZ…œƒ÷…TJ +ä±6L2¦D:Œ¨¤Q/¼û$ý¤U~ô~™W!»¨ +_`¦¶CúÄkóßÄëøz~! ¥KŒï.z×ô·——$ÂÅÏ·_&ÖX’ *ƒ¯¿sÃü/‚NoÌø
S"ú-TÖW!øPi,Z?\]¤©Y¬ØB…Ù´{ì‰ôÕ!Ââ6A6>çÕ!ŸúÌe }Ý%Ä´q 9a ·çâ×»}ùzÊ*žíª‚z¹Šñok‚3ü£®šzß–‡íq[
%ºí>™:H¯9“â|!8Ç‹Ú] “%² ¥FÛõtE.ÎÒ„˜º¼nIð4¨Ð›M ¿ç\݄댢 {6;^ ;ùe½<» +âxs?É »yíˬ2 ?§N endobj -1908 0 obj -[930 0 R /Fit] +2762 0 obj << +/Type /Page +/Contents 2763 0 R +/Resources 2761 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 2760 0 R +>> endobj +2764 0 obj << +/D [2762 0 R /XYZ 85.0394 794.5015 null] +>> endobj +2765 0 obj << +/D [2762 0 R /XYZ 85.0394 687.6869 null] +>> endobj +2766 0 obj << +/D [2762 0 R /XYZ 85.0394 264.7716 null] +>> endobj +2767 0 obj << +/D [2762 0 R /XYZ 85.0394 197.5243 null] +>> endobj +926 0 obj << +/D [2762 0 R /XYZ 85.0394 155.6441 null] +>> endobj +2768 0 obj << +/D [2762 0 R /XYZ 85.0394 117.8997 null] +>> endobj +2769 0 obj << +/D [2762 0 R /XYZ 85.0394 84.4903 null] +>> endobj +2761 0 obj << +/Font << /F37 1038 0 R /F22 973 0 R /F21 950 0 R /F55 1336 0 R /F41 1233 0 R /F53 1328 0 R /F39 1173 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +2772 0 obj << +/Length 1275 +/Filter /FlateDecode +>> +stream +xÚ¥W]oâ8}çWä¤‰Ç ±c?Òé2šR¨´R§) m´0$LÕýõ{ Û!ÀìªêC±}ì{||îµC< Äã E•ª +æ…Œ¡€€” ¡ ¨L9»À …„ ÕX¢¢®óq(Í*Úï¢,Ú&šÕ篢gŽRÕÀtÅñ>) +ƒl¯\!©E"„ ¦-ŠOpˆ¸Üó„’ BÆ‹/óÉl9¹ŸÖ³Ž+cϧQ¢Â¶”6Aˆ$ŽC¹²b•I1ð˜j2C)Õ×{Ù‡}¸¡ ˜ãÉìW`Yìfü0DLw™›Þò51 «|oÚåYœf/vÖÔ ŽFs4œëp¾wkŠãlÁó kßerFï°èÔ·µ[ŒÇ&O†ß÷ÏÔeõn&Ó‘Á+;-Þ¦YZ€X¥¦¨»æÉ:1ËV‰éº‹²C´éœ‰¨Â{÷©;P‹ùðaùÇý¼cÍÊ“¬LöYR&‹÷¢L¶…i|ɳ"ß—éa{Œ §TÀ ^—¡8á%ÉÀ q^M«åH1ÍpÓnsiVÐâ¡Išã“ ”†æ $ ¦.²ÃÓíZåYæÚ/ºÝ\&ŽÊè¿ úoêã ”«Ô‘æ—ëH:‘D€È~ÖQQ$CBÖ9š ¶ÏàµórÂÀ +IÁ?RZÞ9ñ¨!eèÊ¥s‚.22ÔV`RÔVÐ]UQpCa¿Ð&ט|m: ÖÎoúFƒÜ¤]²J50‰MÇÏC”•iùÞ^jW$‡8÷Ýé.m¶O¦9â~-ð{MW¯Ö³Qf~<[ + ®rxÑrz‘ ªÚá*‡Ž¯ÿ'YYõç»wÓ±vå&‡‚ºw©±ÝA»bncÍ”KKË)Ë;ò'ù•®’ëuÓ\ÅÃùíÃÝxº<VØ ˜!ÌXp=Mš(÷ +8O“¥#×iÁÛn–Š³³´h2#8@ðF‘שըnÊ +\7-r¹¶Ë&ªNÐ:HwY;›º¥Í›Y€qé'}ω†éÏ“šHŠ¸d¼#ù[ÔàœBJ¤…éËym¼³5‘©‰«/dÝTöŽ>&Œåív‰¹˜;¸0 +/T!ÿ iîl]EÅÛ c^ÚšPÐ%cïKŠÉuc5Q—U£êx4„ëP‰àzPêÚ”"Tˆ…aغt{6¸™òµ Gƒ@#µYýwºÉŸßKsX·ïÏËúÁ5Ìá¹.ßtE= 2.Ó ÝÅÑŒ«àm yp5®ÃœÇm§ †ß"l^¶U:ÈÉå„i”ã³'ƒ9×ü°‰ÛuúmŸ–e’u¿Ë‚ +endobj +2771 0 obj << +/Type /Page +/Contents 2772 0 R +/Resources 2770 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 2760 0 R +>> endobj +2773 0 obj << +/D [2771 0 R /XYZ 56.6929 794.5015 null] +>> endobj +2774 0 obj << +/D [2771 0 R /XYZ 56.6929 749.0356 null] +>> endobj +2775 0 obj << +/D [2771 0 R /XYZ 56.6929 687.7594 null] +>> endobj +2776 0 obj << +/D [2771 0 R /XYZ 56.6929 611.5631 null] +>> endobj +2777 0 obj << +/D [2771 0 R /XYZ 56.6929 547.3221 null] +>> endobj +930 0 obj << +/D [2771 0 R /XYZ 56.6929 507.5308 null] +>> endobj +2778 0 obj << +/D [2771 0 R /XYZ 56.6929 470.5891 null] +>> endobj +2779 0 obj << +/D [2771 0 R /XYZ 56.6929 438.2117 null] +>> endobj +2780 0 obj << +/D [2771 0 R /XYZ 56.6929 371.0488 null] +>> endobj +2781 0 obj << +/D [2771 0 R /XYZ 56.6929 309.7726 null] +>> endobj +2782 0 obj << +/D [2771 0 R /XYZ 56.6929 233.5764 null] +>> endobj +2783 0 obj << +/D [2771 0 R /XYZ 56.6929 83.9088 null] +>> endobj +2770 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F41 1233 0 R /F53 1328 0 R /F22 973 0 R /F39 1173 0 R /F55 1336 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +2786 0 obj << +/Length 1769 +/Filter /FlateDecode +>> +stream +xÚÅXK“Û6 ¾ûWøV¹3|èyÜì#ë4ñn×ÞN:IZ™¶5‘)Ç’ãøß (ù±JÓ´‡Ž†@ +8Èð#bO\ÂÄ+J³°€º^¦¦¡Üò,_èªv¢Ú,ê%ÑmÇ‚Ë´rK.)áa^ó‘<gš½€ÇÈ÷ÀoA íßuC„œˆ§¼®Ú2»æ¬ùþÁš 4Ö€‹j–ÕXR×x'œhI‚Ošþ·•>X¼• +[V{ gÁÕ©M
>§¤»ÒU•.œ¡t q2už\iH.+gn<¬‰·K«ÓƒNq÷ÕtŸ +ME¾Ëm"°ìÁ²ëWã ùj]èlh·«Xk‹M—9E†a@@ + GkƒTàºÔŒØ¹¡‡Z á%¤bï¶ÜièGHÄEÙ¸ë#$¿J÷D ˜ucµ9\^äõ¾ñ Þ9'¦å!‰…Ô £w”îè¸)ú!Á¸èò "wKmhÑÕ20D!ˆXÛBÝ@ +ÉbèU®ót]gý#ŒYìÇÊ)¬ÊYŽ²¶åÃ>õ²¬4ùÑà6r +öRä 3ÈÎ DóŠº&>Û«ô`˜nd4ñ<IÃŽ. +endobj +2785 0 obj << +/Type /Page +/Contents 2786 0 R +/Resources 2784 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 2760 0 R +>> endobj +2787 0 obj << +/D [2785 0 R /XYZ 85.0394 794.5015 null] +>> endobj +2788 0 obj << +/D [2785 0 R /XYZ 85.0394 752.3326 null] +>> endobj +934 0 obj << +/D [2785 0 R /XYZ 85.0394 714.9106 null] +>> endobj +2789 0 obj << +/D [2785 0 R /XYZ 85.0394 679.124 null] +>> endobj +2790 0 obj << +/D [2785 0 R /XYZ 85.0394 647.6724 null] +>> endobj +2791 0 obj << +/D [2785 0 R /XYZ 85.0394 583.9192 null] +>> endobj +2792 0 obj << +/D [2785 0 R /XYZ 85.0394 526.0527 null] +>> endobj +2793 0 obj << +/D [2785 0 R /XYZ 85.0394 333.3907 null] +>> endobj +2794 0 obj << +/D [2785 0 R /XYZ 85.0394 248.649 null] +>> endobj +2795 0 obj << +/D [2785 0 R /XYZ 85.0394 187.8177 null] +>> endobj +938 0 obj << +/D [2785 0 R /XYZ 85.0394 150.3956 null] +>> endobj +2796 0 obj << +/D [2785 0 R /XYZ 85.0394 118.0522 null] +>> endobj +2797 0 obj << +/D [2785 0 R /XYZ 85.0394 83.1575 null] +>> endobj +2784 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F22 973 0 R /F41 1233 0 R /F53 1328 0 R /F39 1173 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +2800 0 obj << +/Length 1123 +/Filter /FlateDecode +>> +stream +xÚ¥WMoÛ8½ûWè(Ëo‰Ø““8 EãdcX Ûƒl1¶°–äZr‹ì¯ß¡H)’-»‡E€" gÞ<Î4ñ0üOH$U^¨8˜o•°·†¹»q˜ ]ÔÕbôù–…žBJRé-Þ:¶"„£ˆx‹ä›…(Gc0ýÙ|zÍî'óûq@IȘ?y~žÎn þ‚o 0ŒýÇÉìuòÕŽ=õ'wÓùøûâËhºh9uyÌ ¡ £oß±— + w† + ‘@«c¢¦ÅÉÐþ4(Ã*/õŠmârch}¾ +…81È2ÞVã@ÂÅÛu±O«MŸDøi¥÷q•yi§“"‹ÓÜÚëë4&!XÖ†o¦óë—‡çÅÃÓ¬]ôA{dâ„ñ¥´åXBÇwsÃK+ʈ 綳Ðt©_›©—q©Û- .¶M©+7þfµë‰¿‹÷q¦!úR—aæ/6iiQ«ÆÝRÛöÐ:¨ +Û®6zõÚhŽ4hÈÏx›&iõnK¢æ!p˺û1‰|½*ê6)í`šÛ6¶M™®óšôÿ-r†ö÷7fòr÷ú8-N«Ï%œPÉPŠËYÙE5Årš•-ªÍµ#§!E!£¿qÚ€œv3% ;rºØh§U馷«%-~¦I£]½{¦mÀ.‰D§,ÐY½$†Zäoôê .èÕ õŠ<òL0A‚rvÙu‹ðÝ•
Ž=!ûÎ'¾~~È–zoú ’/IWp&äk;gÕ‚ § uÔ +8çþõaoó8¯¶ïG«Š¼*»]±¯êÝ6g?ß êŠ2g–¤_Q®vŽ|S°¦ßOò ú”ù¿6éjÓŸv¿æsùnÛš¡é4Á›>ùZú+8õƒ ÈÌüM)'æ_ßxkÅÆizp\¼ ¶¶õ°çî‡a‚tɘºªk
ׇ ¼žOCØF¥ìy!
;¨ iØ ¡ÎMpäZ) ^vÝ€\÷³£ˆÑ¾ë¶xÛ4윕qç'Њ·N¯4ÓåÙ:.7ÅaëÊ}éfwzjg:9+*‡3…`Ê/‹ÚEµE™È>®Óž P±’¨ËnЀۮ Jš§í»muþ¸pßõÏÁeG>§ÎÉÏê}eýËe>Ú•“¯ó'» ä³÷þÕÃìÆâ•[–diž–$\S/úM»3dåh=Æùvýô@d„¨”Ò=>
0 +"ÄÐÛƒÀCW‡ ÖŽ¸:Òaòº¸z°x$ÀCÅ•kw1ÍßËJg.‡¯¡ààPLÙ¹g284oÛ Á-Ãÿý„þøÀCÄ¢ˆg
”-ô ) ‰øi]¹Çö)÷ÿ +endobj +2799 0 obj << +/Type /Page +/Contents 2800 0 R +/Resources 2798 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 2760 0 R +>> endobj +2801 0 obj << +/D [2799 0 R /XYZ 56.6929 794.5015 null] +>> endobj +2802 0 obj << +/D [2799 0 R /XYZ 56.6929 749.4437 null] +>> endobj +2803 0 obj << +/D [2799 0 R /XYZ 56.6929 692.3565 null] +>> endobj +2804 0 obj << +/D [2799 0 R /XYZ 56.6929 620.3493 null] +>> endobj +2805 0 obj << +/D [2799 0 R /XYZ 56.6929 434.768 null] +>> endobj +2806 0 obj << +/D [2799 0 R /XYZ 56.6929 374.716 null] +>> endobj +2798 0 obj << +/Font << /F37 1038 0 R /F21 950 0 R /F41 1233 0 R /F53 1328 0 R /F22 973 0 R /F39 1173 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +2099 0 obj +[942 0 R /Fit] endobj -1589 0 obj -[930 0 R /Fit] +1935 0 obj +[942 0 R /Fit] endobj -2737 0 obj << +1604 0 obj +[942 0 R /Fit] +endobj +2807 0 obj << /Type /Encoding /Differences [ 0 /.notdef 1/dotaccent/fi/fl/fraction/hungarumlaut/Lslash/lslash/ogonek/ring 10/.notdef 11/breve/minus 13/.notdef 14/Zcaron/zcaron/caron/dotlessi/dotlessj/ff/ffi/ffl/notequal/infinity/lessequal/greaterequal/partialdiff/summation/product/pi/grave/quotesingle/space/exclam/quotedbl/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/backslash/bracketright/asciicircum/underscore/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright/asciitilde 127/.notdef 128/Euro/integral/quotesinglbase/florin/quotedblbase/ellipsis/dagger/daggerdbl/circumflex/perthousand/Scaron/guilsinglleft/OE/Omega/radical/approxequal 144/.notdef 147/quotedblleft/quotedblright/bullet/endash/emdash/tilde/trademark/scaron/guilsinglright/oe/Delta/lozenge/Ydieresis 160/.notdef 161/exclamdown/cent/sterling/currency/yen/brokenbar/section/dieresis/copyright/ordfeminine/guillemotleft/logicalnot/hyphen/registered/macron/degree/plusminus/twosuperior/threesuperior/acute/mu/paragraph/periodcentered/cedilla/onesuperior/ordmasculine/guillemotright/onequarter/onehalf/threequarters/questiondown/Agrave/Aacute/Acircumflex/Atilde/Adieresis/Aring/AE/Ccedilla/Egrave/Eacute/Ecircumflex/Edieresis/Igrave/Iacute/Icircumflex/Idieresis/Eth/Ntilde/Ograve/Oacute/Ocircumflex/Otilde/Odieresis/multiply/Oslash/Ugrave/Uacute/Ucircumflex/Udieresis/Yacute/Thorn/germandbls/agrave/aacute/acircumflex/atilde/adieresis/aring/ae/ccedilla/egrave/eacute/ecircumflex/edieresis/igrave/iacute/icircumflex/idieresis/eth/ntilde/ograve/oacute/ocircumflex/otilde/odieresis/divide/oslash/ugrave/uacute/ucircumflex/udieresis/yacute/thorn/ydieresis] >> endobj -2094 0 obj << +2126 0 obj << /Length1 1628 /Length2 8040 /Length3 532 @@ -13199,7 +13621,7 @@ endobj stream xÚíte\Ôí¶6Ò ˆtÃÐÝÝÝÝ¡Ä0 00Ì ÝÝÝÝ ’‚R" ‚´t ÒÈ‹>ïÞûüž³?³?½¿w¾Ìÿ^×Z׺î7¶ ‡Œ5Ü ¬‡¹rðpr‹ t´P(ÐWç…CfL9g0ЇÉ]Á¢ -Äü{fX E +Äü{fX E 0Üú÷äè¹aÖÃöOÃoäæìüØã?ûÿxýœÿŒ=ì a.ÌÁAb¡ö™9Y®
Ä£ò/z{xÂœ*Þè—ÖÁ»2#×Dj,ïêÃ8›ÇEµyÍî;Ýoª²n
öA™ºÓÁß‹(üèX>ã.3v±ms™W`g Åú Ϩ¯"› rnêèš—ß¡RŽwð9£ _²Ò¹Ð_8=óe4%v>oFÀk(Ù?`LÙ½¼`ê ú4ð±ûåÃ&9[~ƒ˜;26cLà«|r)Sƒj…×Íl(ßÛ b¬Å7ÎßÊçÏVð™h9Žù,¢I‚°RÊ• e®äß·RÆ%=²ìÙ
êt›œ(†Ì%³LÇî)®Ž>1Ù¥‘„µ…^Ñ2¼éˆO£Ý %õ‰>•pjÕr{2–ÂwÍ<–g¬™-j—!3cäáakIè,AŒ$ÁLˆÇÆ‹J¯³nöùU» Ïm›Þ‰D3 @@ -13222,35 +13644,35 @@ $OíœàÅ€DÈ t‡Í=žÝbóÆÃwî6ß"£“˵?”JËOP2RÐ oQo+†â1) ©w†¦ÜèådîI½È Z¿VÍ(e÷åû È"[vQÔüFØs(úF$'‘qL ®/¶!õÔ
¤HvkÖ‰Œh¼È‰¬ê؉á¶o?Ùa:Šÿ±qêcŒ° gã!_QÇ~ÏWê¡1üaœ¯UÝGmã§Yñmn%ìRãr9÷¬ß0qˆ5†/‚E…(êÚ“†,W‚˜$Ù½ï¶åçLxËÎÔ|ú 奕£w†Z|ÂV€ãž÷,éOd ÞyŠGÝ
ŽÎ¨Ý3lÍ4©¿Î\×T2Zª½Ag—.7Ù#ÏPæï™v¼eŦQLÞ»±Oþ¼Ô\’ ¬ÿĵJÅñ¾(š3Ç].Å*,MÎ>ÛBx(ÃSÃó|D³uû‚Þ¡ï†{:Ò‘Á¨2G9¡Cê{É•<|?ÒK áéá@F)Ø,êw÷ó?È ¸ ¢Ëa„Çh%Ù±o ^Œñ{‹6™Ý @¥-«ä%Å~jÉwXjz1îi´·î¬%uÕ3^¿±g¸`d+ÎK[ŽDe—„]âò†YèÖýÇ?Ï>£³HjË,èkѸÍhÔ8Š” ™v_Å
[ªJÖ®²9m=·âú?\‹k>¼à¬‡¤*³Ñ³ž,Y
ê<‹ý¹uÓ Z/ZV$S·é#ƒmNOš¨5M@¿§rãÝ0Hõ7¬&7[àçŽAØñêOõƧÈêÚ5±pE6~d»Ž^.x¨T1¬µ¤$£Í7¿ÿ4òÆêüj§‹G1¬èípoóÌ3³QýÐZ:œNÍÆéç,0½‹ Š‡Zg‹ðâ£à)‹Q©¯³‹X""œÛÆ0ÏÁ¾äBvFA‚)Y9(ÎYÖý…ì¬S…|¸Ôü¾“qbæÇN.LÔX§…_ï‚¿œ%%½¥åŒìé|°D>W²7}C –Í#—ZR¸$º`bÛGο…a¿9gÝS%\”Á/œ îñhC|?s§ Ø…šg¯ÎÙÈ)ª¬m}ÐvÖËk†Ÿ.bÉ&O üõí+uqfº`Îa‡„°£â,I§ã¯½/‘˜÷ÇÝ›Á¤'P6ߢH‚Ú?÷›½šÙ¹˜Žà9¦ŠmHr7:pMRYŸ#£ 'æW¥¿ðKCß|-¡mWÝ躖nᲶË0–«ÞÐ3äÛÙ=j’¸Ë-,n–³e±€¢üb½iÙ;‘˜Hâ°l<)žL.ßÐYÖÿ°Ú·)wL=(‚Œ£± L|)=å'ÀÆ-Å@²öò¾µ<ÃNrä³6îµEôʃ3±d¶kÓ»¬ÿ‹%ôµøü·(kD~ô(¬_yñ‡Í; ¯åä²fùOî{&*‰äyÒ¯9ÛB±T¨d>è.<Sâ¢éX3p7«Á~ ª"럽Ÿ“lË´ÍÔDQÿfŒ°Ì -*s"}Y
;Ò‰¢ú{YÌÝÇí]p¶Òݯ€ Ž¶Xo³êÙ} +*s"}Y
;Ò‰¢ú{YÌÝÇí]p¶Òݯ€ Ž¶Xo³êÙ} endobj -2095 0 obj << +2127 0 obj << /Type /Font /Subtype /Type1 -/Encoding 2737 0 R +/Encoding 2807 0 R /FirstChar 67 /LastChar 85 -/Widths 2738 0 R -/BaseFont /YHDCUL+URWPalladioL-Bold-Slant_167 -/FontDescriptor 2093 0 R +/Widths 2808 0 R +/BaseFont /DOPODV+URWPalladioL-Bold-Slant_167 +/FontDescriptor 2125 0 R >> endobj -2093 0 obj << +2125 0 obj << /Ascent 708 /CapHeight 672 /Descent -266 -/FontName /YHDCUL+URWPalladioL-Bold-Slant_167 +/FontName /DOPODV+URWPalladioL-Bold-Slant_167 /ItalicAngle -9 /StemV 123 /XHeight 471 /FontBBox [-152 -301 1000 935] /Flags 4 /CharSet (/C/D/E/H/I/O/R/S/T/U) -/FontFile 2094 0 R +/FontFile 2126 0 R >> endobj -2738 0 obj +2808 0 obj [722 833 611 0 0 833 389 0 0 0 0 0 833 0 0 722 611 667 778 ] endobj -2076 0 obj << +2112 0 obj << /Length1 1630 /Length2 6133 /Length3 532 @@ -13262,100 +13684,57 @@ xÚíVuTÔí¶VA!¤†n†n”.IéΆ˜f(‘N)én$†FJ Á!¤[:%•$.úÝï|g}÷üuÏùë®;kͬ߻Ÿ½Ÿýìø½ Òy¦§aáèha
…«pJà •Ž H ±@Bá0Y $D¤±ÉB¬@¼¼ µµC‚XnxXÙÙ9þ²ürYzý‰ÜD" ¶0Ó̓;Äîì!o(þ×ZiÙ@ ! u
%5‹‚šHƒ¸Þ¡áf鵩@ 0„dw9þq -³rt³þ%àÆnÿ-ÈÙ~ãátƒÝiÀH„•+Ô ºÉª!+ÿ‡N¤òWnôÁmn<áVn¿JúÝÐÜ H ( BB<‘¿rYB@ÖP„³£…×Mî2gWèon(Ìö/ Wˆ…«µ#¸¡¹áþÕ¿êýSõÎÎŽ^¿£á¿½þ¡ŠD@ m¸ -ÿóü{é!Oˆ`zn%lŸš‘†¬"Ïéé—5úÐÁƒÑâ\\£ý:ß¿Þî—¾(Rf~QÂU;(zÕä5¾í|¹ªÌ¶ÖÛAæÈÜž ÙË£ò¡g}ŸO4ÏôNˆ}-lZŒŸöU/Ê{LeÓP[wm©_ó™iÑÅ=àà;>WìýSVz÷|R†g_«”·¯ ´ÖÞ"®*ØþÊ”°yzÂÜÕ÷±§»ýðîûUJöìW8Œbî˜øL‘þ.Ù”O uJåÊߪݎË;BbubÁï<_^Ë¿Å`i¢KÙÅy¨yc@–‰Ÿ'\;ø$·®Q;S-”âs/,
9D¦Ô#,9ƦïKv²±SÐúê¿»èçö‰%…÷²õ-âÁ]3ëãÝ“±Ñ][™CæºÊlëŠÑLü‹¦ëÀ¢ €5‘ؽrô›ìç3üÜ°˜üDÑSjÛðôä)Wï 8Ž*öÜŸèž“3@'}~+ÏÝ 6‘žˆ•Ø\Žpµ<züuÚ>AbåPóبLbZ÷a3ÒYÍEœVÁ= ¾‹{·^®2<¿}5aq€©ÿ_5¹Ûðòµ÷>›À¥´ê$C}ÀXŠ¹ œ Õ÷ji—û€G‡/§Œdû-!j¹;Ë6#ÔÜŠ.Oé×ôÎc´¼$z¾I(ñØÇ/ Wj®½"¹ßKÒÿ¾ð{Lš¿ÞH¥hÔ»Ã:iÓFRF< g] Û39} — ÞÞF™8|à0‰å -bÝ ‡ a›yKÜ£%t×TcaÖËF˨?B:äÐ 3ÚZP ‚ÌÆŠ}
fñφôˆ ƒTU‡J鉽žj:»«Ï‹ºôN)/ÂÕ äE½¬^gº‹ ^/«k¯&6Ö7%³"”-ήQËòÍ“ ñÆ‘r¾“'# -ñÀèHvo»Vüy½¼Òç³³”ÎjÁÕŸ,_Âh^§–p³/â#Ó„HÊÀç„»ûÄŒ[ ‡¤Ê»B8Ò¬’%PË ™#¹&}Ô7uo(à–îu•úµÒ95ÀŒ¾?ËêcÕ8—ÄñâθÑ,™ê:f”†.‡Ðà¡ÝõÁ 41hÀ›3):«;Íc ƒ·ú‘¶Þ,èðY½:Nç5u…QEð ‰rŸ–²ÌûŠ!&.ÜYâü×É ú;á$ ¤`×yme~b©@{•3*¹ -·³®pBk¾j0ĵ¹Žjœ ßç]ZÙŸB dŠÌÓšU• -ÂIÛ9ä‚· œãƒÂè©õß½ n^(Á•Ýh´7C¶¦2„K~V')Ïï±^š}zTÉúÔu?£F-!z_‚¬šÉÉ/U‚og4²Š’.§N™EhôáÍÎËåÔŒL^ѽð¹œfCÛïPI†^ÔLʸðˆ§/çÓö±’¾¿Ÿ\S
³©»ï™Î®0‰Ú·˜O%”çp×ù1ÔA?P(åÞ.¤gÔ> -ó¥ªÕl^Œ¨Ý)e»ò3Pp[´dbõ¬ðVŠÿÒ³Ü4Å+β&VÊBÔ eŒCuOé‚¿# U9fiêCl·\r«ÒzÃÐWü®6êb1~i“EÉ5ÚÒ A¦¹§üÑœNƒÇ=< l””íyIæj%‡¨äÄiñ(<ÈO› õ;Zõ}¾T ªL’[î^åÛA€Z…êþHKJühØûñœq/fóÄf¢8³?€æ¢%K]TkcÑøKEÄL1‡•·FÆîšÃºåØ KCÂCkÇxG®ï[v“ -‰ÌÙd%JW ܽóµÈT¿È$ÿ$H~@²&j M¤Iòüé.‡¿÷ywúÜB½ÐÛŠFög„”p¾áÚÀ7sº‰&RDî(ŠpÅ3¯ƒgƒL«Œ˜–)\°¯b„îeý¡u1ì9ÔaºÔ0•i
l]˜dÞÊNºwÚøw T甼T 31&Óãâ å"q
è{•tjIõOÙ#u‰Uð¤û/qA©SˆËÕ[ 7Š·oÑ4Ʀ^žÔ™Q™¦¤îŠ»Lzò9QT1q †}«caK"ªQv[‘,P.£d¡ù:üœFª±î¤R=éY@A -‡¶úL9’00#†ô}à…Ú¬ëè¾>€à)…fbˆû†7sÓ¿×ÄÅ}ä׊³ÒgÍ¿?FІæIP›˜ké÷2è´à2|Ö§™¥£[¶WBMåt è³<èù:28¢Ä;Xf1S§³EŠ&´×å0Ä 0d—5ŤÐ4|ylæ©@Är˜léË@È}±}µ\"òSÐd5ŒÓkùp ü3ʇÏÎ -+˜^h€&9I‰òÝ3¥–\—qaâ)&J™NBb0šNí`Ò.' 39ë4^€îg(}*v– õ -d ¯òˆ¦:ôw -ýL¡T÷Æ{ši®G3È¥ã"y+â3’§[cͽ<å†Q@òæì+ }·÷¼Íñ0þ’ Dâ%ßéfL¹7®‡SìD nŸe‹ïãF
cé¯ÿäφ=jýúÑ…fìÁµAÌ^He±œÆÌ€PP‹@Sò˜ÈÈ5D7Âþ˃¯íãìoÎ64ÒŽY›]l_o%а¤ÒÉSŽšŒæ©óAüŸhöUù»ÐyèvíS¬ÐD=ËOÃxýa“²I;ÊÃÖ‰do“LÈÁd<±~ŒÞg®¨ÙÏØÃî pðzÕ±5õ*¨2Ò1·2BÏ`«ùñG8nå^{ bh…Þƒ1K÷©éVZ˜gí"2eF˜ˆA4”ÈTøxzrA¤ÚØ?ß]íÝÇKÚ -ö”bÇЃ 9µ³+&ì“[8Y) - ‘x£´J 60>y®ê$´ 7An¦“_ƒúµZ³ +i5ºÅ‡Á) ¿{iR`FªFý“Sð™ñå»ÿa%€ðeå÷uì†Ò*ড়ÅÊÎ9
|ÀÑå|,´Hƒèn_ÙË%i·˜³¼Ã'µ+c% ü麖‘Ý@;¶zu@
Ëf#[2aPàØÄë ü SÑò“ëùIý1›„túÉb¯Mˆ·gÃÞç+kÚ:ÙîSRc;¦ EKZªâ¤ØjU¡ª†ziRûRž2ã ¾~ æ9 ¶hKI<üORdÑ*ãAŸYëê à“ºñp0Ÿéj<°÷8KgQ»$`¹ dÌù4à|ÐÈ¥ñ„î±ÃäÂñœð*S - (Z¢`‘®~VpùEaAzy÷UwJs÷Œ?´½‹š |: }ÒH»a‚º¾g)o}³=‹rrµM3v-ï€Ä@ Ùì'pÅXßÒ–× -ÕB¾ª\h~8©$‰¼¼·ý˜7!g;É¥ƒ\®cf>}7›ùâžÐÙZسãÁÖ–Ü^-Už&( -ÖËÓ»ÜIFÙØS˜õOV_ºhýÐn-® -X{$¢½‰¼û£@–rlZ™âɞˊ1o(¶¨mèö¡Ðé»÷ÝõäIŒ]Œ_-ô‹ ¸Þû ò'zŸT¶n76Gت–·& úìIĆ‹7 ÎÔ‰‰f¾<B‡›&ª½úŒ×ž´)„Æc+¤ œ?µÆ(_¹à™ñ0áNZ¬/ˆ_c24íŒË¢—'{.ö¥dÖî§Çz̓¯ÛKÃ{u`‡:s±¹ Á<º'—0— HMq±LåRnC@x›ôs̈W6ß>uä3¾õˆ;)EO4,Źk& l‰#õŽ¾„˜¬Ù¶³ ½höâiF] ‹œx'´ÅfÊb\ñê{Ý?¬¹¶=ê3¤XTÕW©*®§‰\ E e¶©x‘@†Dz:ƒ!¡X¾ÂK ”G½ èß>c{BŒÍC Œ±¹0šUÕ¼ƒ ¿ªÝ•5xfœéÉU“Nhèòã» Z–$8û훎·òБÞåú¸;ß¾2~%~QÍ÷*|6οÀ.©ó¶H&l]ážçµÐ[èù%¥ κƬ !ÙrOxÆ!.B˜“zuW,Ôêr‹9å ™ÊT°CHÖ‘_e‘‰ÿð:û5r€û3.ñ4v—W”ò]ª[)ïó–äÙÀ—݈H¾ÌûùSŽ¸+¹º fS4çHõ¿ÞzyàÂ*/ç% Šâ×»Í Ï8ôæãmº'7…\ì°Å÷K)8ÐÁ@£bÅî\ç ±ÄÝÊ‚×[g“©»5é«ÅÖ¡’'¯ÔíÌ¥ºégˆ<‚â¢Ï8TŠqùœ_U å=¢¦#fœÞ*ª6í¶²*æ ›\oi›–•`ûlj[ÛW*ˆ»ºœ2Ž(ËtŒp{ˆ ¥6Í]š†}„¯>{?'CÆà§5zíEëÝÚÓÞ&vø¾öŠ
÷dYcØL‰8àÇÉu°à•GËÝšÎñtûëV²ˆ’eÓëû&KÅàჃ‘oS*.m•»8ÕîŒWQì3ÊDÌûj OpHY²ï®f>×¼ù‰ _ôŸö‘Ƥ‰´»ø|EÀ’=PzêîXDƒ%½+C£ˆ1_ù¶ ‡=AýYœ:&Aaú;æ¬U¾öÝ*“ÍXJ·=à²ùˆ1¦ ¬ý<ð»©,|#
O'Cƒµë“M ]í¼æf°ºÜS4‡AÇ÷Mj€“Ò·ÐökxõÊáž™ËG‡ÞÕéú,óÔ 92‚¬
߸gp0o9)ÁM£«&ChVF=Vv¯ñõÅž¡üÜÈT·Žïvä(Ê´ãé¿7jzä ¾¹Â6]E³ ÚŸÉÞeIGOIùç…&˜+ÊZ Sl© -Í`ƒ©c ½G¯Lsé:JθÿÍàÿ þOX9B,\‘p' WÀOÓy©endstream +³rt³þ%àÆnÿ-ÈÙ~ãátƒÝiÀH„•+Ô ºÉª!+ÿ‡N¤òWnôÁmn<áVn¿JúÝÐÜ H ( BB<‘¿rYB@ÖP„³£…×Mî2gWèon(Ìö/ Wˆ…«µ#¸¡¹áþÕ¿êýSõÎÎŽ^¿£á¿½þ¡ŠD@ m¸ +ïeë[ă»4fÖ)Æ»'c£»¶*2‡Ìu•ÙÖ£™øM×E; +at +½’•sJÜkŒ "êC 3ó®cUÉÙ4eHÎH~0+¾÷ì +£Šà> ä>-e™÷CL\¸³Äù¯“7ôwÂI:HÁ®óÚÊüÄRö*gTréïI (J‹ÕÏÀÒˆª1! øRb’>¹`ÕÕâ13W@‰MÔïÒ335,Gƒ÷î Ã'V? 9ZŽ fjW] èUªŠÛ¬[ßÑY@ÞCLAíŸjÙÙ*+òæÅõ ÁÉÏ5~šj }‰Ûy]ç¼cñvË‹ Bxi9]'±|¤“²w/±2X®‹‚8w^+ÐKºDœ~$ìl‚Ý‚I®J5`žV¯ipw/¢6’ +}ˆçã õF´£ögºts£ng]á„Ö|Õ`ˆks Õ8;¾Ï»´²?…&@È™!*¦54[«*/„“¶sÈo?87Æ…ÑS)ê¿{=ܼP‚+»Ñho†lMe$—ü¬NRž3(Þc½4ûô.¨’õ©ë~FZBô¾Y5““_ªßþÎhd%\N+œ2‹ÐèÛ—ˇ)™¼¢{ás9͆ ·ß¡’ ½¨™”qá
'N_Φíc%}#0~?3¸¦fSwß2 œ]aµo1ŸJ(Ïá®óc¨ƒ~ P ʽ]HϨ}æKU«Ù0¼Q[»SÊvåg à¶"hÉþÄêYáÿ/¤g¹iŠWœeM¬”…¨AˇêžÒGªrÌ,ÒÔ‡ Øn¹äV¥õ†¡¯ø]mÔÅbüÒ&‹’j´¥‚Ls Nù£97œ{xØ4()Ûó’:ÍÕJ QɉÓ4âQxŸ6êw´êú|©:T™$·Ü½Ê·ƒ +Õý‘–”øц1 öã9ã^Ìæ‰ÍDqf +pR°‚šL\(<uØÔûÐéV‘‡ ᣩ
ež¨ÓE§vìA7nEŸbü ¤6ÌÑ
ä¡ÁDÈ;Cŵ½AŽcήšÏêYcg)äµU4ø&š˜,9D +V1-S¸`_3ÄÝËú%6BëbØ
r¨Ãt©a*Óغ0ɼ• uï´ñï¨Î)y©@[gbL¦Ç)Ä?ÊDâÐ÷*éԒꟲGê«àI÷_â‚R§—«·>noߢiŒ!L½<©35¢$2MIÝw™ôäs¢¨bâ< ûVÇ–DT£ì¶"Y \FÉ …Cóuø9TcÝI¥zÒ³€‚*lõ™ s$a`F é úÀ µ
(X×Ñ |
| +5ÌÄ÷
o榯‰‹ûȯg¥Ï.š%~2Œþ
Í“ 60×Ò3îeÐiÁeø¬O3KG·l¯„šÊé:ÐgyÐóud6pD‰+v°Ìb¦N f‹ Mh¯Ëaˆ >.`È.kŠI¡iøòØ"ÌSˆå0ÙÒ—ûbûj¹Dä§ Éj§×òáøg”ŸV0½Ð +½c–$îSÓ5¬´0ÏÚEdÊŒ0ƒh(‘© ðñôä‚Iµ±¾»Ú» :—2´Ä!<|^Þ‚X2›/¾5obÿd¬ë¥KºÃwƒø‰Õ˜ÞMG0C&ÊØjãž;áÔ+=ÃÜãÍEXr#à]Cg
"}Yá¾.¶aýìY³ÆIˆ/^Y»}$oί8 lU†ø„=O'aFX²Åï9hRÔ¤[ÞÞ[ ù~ˆ[ró—M~“j…<·ÑVG½‹Xî//¨šá‹ÉVà²hÑi·¢·æÉå6I?,·%F\œÖô™–@êõ~ø†Yý E>eUλGwü^‚}«
2ë$¶Íð‚ +ïcñ•ñZ×™b”[DÌÛ³>Â&Õ—ÂaY
Kê{@”¹¸’QeUSæX6»ð¯CvòàªÇ£hœ½a¢ª§é›ßôó ƒòêªÎ1‡(‡(-Ô±ßV”ÓyCC..& +®Æã +7/ƒ[\ÉcçtFqóÍÍhF4®¾¡õz»Bö ¯ ÐØóÜE™Œ®
#ôÃëÅš[È +ŽM®Aµì)ÅŽ¡ArjgWLØ; '·p +²R +Øêa³!ß™ŠxW_FÅyë"3Lêû¸Ž>ê‚*8VŠ í_ŠÀÊëó<"•{•îÛá[w õ(FïVqQß¼óq–Qõ vÕ’Tw͇\÷Yd›fÜÞ>ÄO¯Þû9÷aZjüm µ=!À›œÝ>ÜüïQ3Ù¹åÔ«^ ü9â@"ñF/h•>þl`|ò\ÕIh=n‚ÜL'¿õkµf9VÒjt‹ƒS~÷Ò¤&ÀŒTú'§$à3ã!Ê5vÿÃJ +ƃ>³ÖÕ;À'uãá`:?Ó+Ôx` ïq–Î ¢vIÀr= +ȘóiÀù ÿK1â Ýc‡É…ã9áU¦ +ÐíC¡Ówï»ëÉ“º¿Zèp½÷ äOô>/¨lÝ4nlŽ°U-oMôÙ“ˆ
o:œ©Í|y„7MT{õ ¯=i3RÇVHA9jQ¾rÁ3ãaÂ3œ´X_¿ÆdhÚ—E/Oö\ìKɬÝOõš_·— &†÷ê$ÀuæbsAƒytN. `.šâb™Ê¥Ü†€ð6é瘯l¾}êÈg|ëwRŠžhXŠs×L84ØGê } 1Y³mgzÑìÅÓŒ$ »9ñNh‹Í”ŸâÕ÷ºXsm{Ôg" 'H±¨ª®RU\O¹<Š>ÊlSñ" + ‰ôt.CB±|…—(z?п)|Æö…›‡8csa4«ªy=~U»+ jð*Ì8Ó“«&ÐÐåÇw?´,IpöÛ7 oå¡#½Ëõqw¾}eüJü¢šïUølœ]Rçm‘LغÂ= Îk¡·ÐóKJ;œuY8:B.²åžðŒC\„0&õê®X¨ÕåsÊ;2•©`‡¬#¿Ê"ÿÿátökä +¹Ø+`‹ï—Rp 36‚FŊݹÎ%:b‰»•¯·0Î&SwjÒ V‹C%# N^©Û™KuÓÏy,ÅEŸq &¨ãò8¿ªÊ{D LGÌ8½UTmÚ5leUÍ?6¹6ÞÒ6!-+Áö Ž·¶¯T(wu9e Q–éáö :Jmš»4
û_}ö~N†ŒÁOkôÚ‹Ö»µ§½Mìð}íîɲư™qÀ“ë`Á+–»5ãéö×d[%˦×÷[M–ŠÁÃ#ߦT\Ú*wqªÝ¯¢Øg”‰˜÷Õž à$²dß]Í|®yó9¾è?)ì#IiwñùŠ€%z :õÔÝ3°ˆKzW†Fc¾òm={‚ú³8uL‚ÂôwÌY«|í»U&›±”n{ÀeóbL=Xûy* áwSYø"FžN† j×'›<ºÚyÍ7Ì4`u¹§h‚Žï›Ô +M0 V”µ@¦ØRšÁSÇ8$ {^™æÒu”œqÿ› ÀÿüŸ °r„X¸"áN®€ÿkdy½endstream endobj -2077 0 obj << +2113 0 obj << /Type /Font /Subtype /Type1 -/Encoding 2737 0 R +/Encoding 2807 0 R /FirstChar 66 /LastChar 78 -/Widths 2739 0 R -/BaseFont /CYFTJP+URWPalladioL-BoldItal -/FontDescriptor 2075 0 R +/Widths 2809 0 R +/BaseFont /HTMZKV+URWPalladioL-BoldItal +/FontDescriptor 2111 0 R >> endobj -2075 0 obj << +2111 0 obj << /Ascent 728 /CapHeight 669 /Descent -256 -/FontName /CYFTJP+URWPalladioL-BoldItal +/FontName /HTMZKV+URWPalladioL-BoldItal /ItalicAngle -9.9 /StemV 114 /XHeight 469 /FontBBox [-170 -300 1073 935] /Flags 4 /CharSet (/B/D/I/N) -/FontFile 2076 0 R +/FontFile 2112 0 R >> endobj -2739 0 obj +2809 0 obj [667 0 778 0 0 0 0 389 0 0 0 0 778 ] endobj -1450 0 obj << -/Length1 771 -/Length2 1151 -/Length3 532 -/Length 1711 -/Filter /FlateDecode ->> -stream -xÚíRiTSבª¡¬2©¤j=,ŒiF
!¡€D ¢až$æÞ[’{éå’2ˆ8PIU–EltÉ(*J…UE (µÄ*´€iá–χTŠ€Ó»`]]¥?ßûõÖ;çÏÙßþÎÞßùΦ¹EÈ"Ûc(Áà09B(•J8l@žÙl -ˆÃrÁÐ 9 G ð«µjÀ]Ø|!o…ǧÐ@ –®Ç‘T<é“$>i` QÈQ •*XCÖPÈÕ@†)˜Ð3Hë'od€õpŒg“Âá -ÇÈn0©å¿!kzñ`Z .×L–Ÿrêoy¹Qëÿ``št-ã@ŠA0ŽN§ÆÀoÅIaÑj¦g%„\(Dhª ÎJ&{å[ ÉFt0 -PÊÕð£Ðt%¤S:X’øµáqž|íT2BŽ D¤> ì?ÙS1çϘ4 Gt Íd³9$‘ÜïNIÓš‰Q!h*àò¼€ Çåz -9DdÄÙ € ¬°ŽTÌb¢A^¤3¹@‰á”Éõb–ÎȘDß\ÀJœ=Ò½IìïO ÀtÙŒ\ÀàòÈVì•Þ€Ïcçþ…¨Ðâ8ŒSãCô.V"¤§0¬ƒóMLá³õÓ}§·×扫»ŽÙÒ3lí8¿í”ч9Üçãt oú9þèwÇmŽŸ"Ç JG¾aAJ^?õ´(Ç”-cmëu4Ù»Ð+÷Ëf=T '&ϸ\ÞÞöæàŽ{æÅ–ô&χ¿¸?»›yÞ¶~Í}¿Š:R4³öÖÍWOòÒ6uö›í¾†Ü‡J)IågÖì…£ÿy·øêă¬3×\žŸ¸ÿ™ók3µíNOÚm{£ÀP.µ¹aô}9‡M×):)œi‹Í±e‚Õ2áì…^×£+ŒÀêC_7c¬_Ks˜ô·ÙƒÝtÁ ›ñý IAnihŒ$jtÁ±J'EíµoH
Õnh‹oÕø¡ -
ë -œÒº¸¾%œô¦½´õ)ã¯h¿/Ù9óiÒ‹}ÏߨÙnV®'fÄxz ðÏôð ¦w°©¶×¾0¹ÅÉU_Ý#Dþ¡}v« 횟ürZƤ Vp#ßåæÑ/ÜÍ\Ê}á¸f_ÅÇÒxÏo›M{Å:+AÜ%ô“ªGÿºÔj8ÀMLèK9yËór]ã…ê çºÂ™I¦æààê%ͳ±ÞÁ€ùn~Î }æ:ˆ-‘@µË|±GWü@u.lj71¾è¸Ðë`ÏKŸ¡ŸK£LM#G¼åÙmY¶‹ù ry¶÷o6çÃêRô]Þu'M?Î[¶ŠÌa¬Û—v¼6¬v»FÿX0gï1AÃ#ŽMEι§¢æ ”åx1¨÷Ûôl9½¶áJÝc¡8âEU -ó?ÛÚ†â¨åÄxv&÷ìÚ
<ŸÄÔ×=~GÖ ªÉÞ½éáã[+íØ@Ú
ô -¨éâÏKóÞl í
ÑÚ9Š›;Ìè½cÆ;?ö#‚Á-ç9jÝ}c¿Yê×J¿ð±Uë\Ged6[ çYd=0AƒZª4u.4ÈÅr9@žêav5I¿—<uEM-é†íÁíð«“եѬ<KïªS^nÄš±*!*[*9^n5ãÎ̱'¥®–gøæƒ×Bù» ÿÛ•ñ£•¾w»'´ùÎWFŠ:=³Bª”¾IíM™¯ÌÒëºæe5w—-p¨Ð2<¶žY›ý%÷«Ó†¦ÍVóðpIôµªcûuç«¡ÑöΖŽûühlgÍû¹E«©ÔÏPÃÒú1ÝþúÐ2KÿÑ—²¢>,4Ýõˆv-—¾¶Ž‹® ê°.O<Ì:5)š {.V•ØÄË" í·“·¬ –Ö7žØm·ƒsH•SÒ=·°eÖ›qy¼,SVùu¼ßy~Afô¹`^¿ÿœïÝ«(9÷äP±¸æ`ê=qohÎsÿ >€Þ³
]ò$欱¨ð…EÕwÆ»¢D2|¥Kt«m®[Ý\SV¸G:·ÖiÃ{!‡;®¯9øîî(éà}Ö>N]F¼|pj¹Ë·ú”bNPáQHëš,=ÒŠÙ‡÷59µû3óóEeÝ7v¨’;¯—çÿŠFÉ©íÕûçp¢òY~í³ðÅ›Y÷?º÷ùw)5üÁ± âÖ¤k½_Ž®ÛÉiNbÑ“ŠrbUožyãÓ¬ˆÃÕÔºö¸(ÿ/ð?Q@¡†å8iäxåß7“Œ«endstream -endobj -1451 0 obj << -/Type /Font -/Subtype /Type1 -/Encoding 2740 0 R -/FirstChar 60 -/LastChar 62 -/Widths 2741 0 R -/BaseFont /IZONYB+CMMI10 -/FontDescriptor 1449 0 R ->> endobj -1449 0 obj << -/Ascent 694 -/CapHeight 683 -/Descent -194 -/FontName /IZONYB+CMMI10 -/ItalicAngle -14.04 -/StemV 72 -/XHeight 431 -/FontBBox [-32 -250 1048 750] -/Flags 4 -/CharSet (/less/greater) -/FontFile 1450 0 R ->> endobj -2741 0 obj -[778 0 778 ] -endobj -2740 0 obj << -/Type /Encoding -/Differences [ 0 /.notdef 60/less 61/.notdef 62/greater 63/.notdef] ->> endobj -1439 0 obj << +1457 0 obj << /Length1 1199 /Length2 2269 /Length3 544 @@ -13363,112 +13742,126 @@ endobj /Filter /FlateDecode >> stream -xÚíWi<Tm2e$"˃8daÌØMe_{ÂhìTÆÌ™q3Ìbß"Š'[YÚ$K Ù*EeK´˜("4Ú)‰’%KôÔ{ÔS½OoßÞoïï=çùïë]ÿëºþ÷u8*Šx‚–9™áÚ0èl-,ƒ ¡ ?‹@¤ïÐÚ R9öl"
€}"REÅbÓÀ_ºÀ %$²!݊Ȇ}\ü9€‘ è` -š²µÕábédKFÐ2 ¹¬ŸÄIpcÚ¿Ò0ΣGý¢@tò—öÈœ`mW:Âíþ€MÈ 6*Èô1:cŒ -HÞ8êoßSØTµi¾N•ñâôÒwW6XÏ{5õßÞosê(= -Vî8YdøÊ"žyšªµ•jÞÝI9àòÐáIÿ†9‰œF-É0Íu]KÝ« •dÆ–rEÕ¯yžWœ ã–ÿõ|ÿQsý ¶ì£¹‹Vh*ªÉè7‡ëˆ3 i¸ì j^ïc©H÷Ï}Øy”Á„½N V»|ÜûÒ|æÅšõÅï_álêébïO§ú”ˆÉõÿù§¢Ã Dlª hd˜éݬ³›Q |oËo¾·†õIæ~Üjt -ÞëxÓˆÚ‚íI•¸¤èqÀûÂe=l‚{Œ²¹d~Dó/ƒœcë㤂¨ñXÑ©F‹HÇ{uæ¥a'Øz{ê×åÈðešäMÙMJ»*Â|CRÍ„£~Ûf榑ʘ.fÛ)wJ*¼¤_Œ*¹âÿÜX;Öyñ¥ùLñRºyvix·h‘®»7%J&±º€.®¼»Ø#…¼ÿèºÿ–¬”‘lLoÀ.±ˆçUWŠ³|U©Þ£µ µÃrq7ËĶI ÝÊUxmÛ*Ê\y"™t¶_¸ŸãC´ÒŠ v15¹Ñfß#¼ãJkÀÞ0‡LŒr¡ÉaZAC@TNô„«²ÖWÏض…·¢anN{p¶¨Lê`»….„ëvz¬ô‹êo6½µfq®u,ÃÒž{°z뼈 ¿š¿á¬©ÁÓ=Ã`^®¨©7߶”G2ÿlªDn’{%g7Yk,1Tna˜ -±ÑÝ“g G77ó¥+C? -þ1r:Ðqôcí!G¾y\ãv^¤ûá •m9˜ƒÊ‘G¯Y{öÆñ¤ª† %Çð·Gü[ŽzÜÚ† 8ƒÌÈsnÿØÞY¿¾÷ OÃÜé.FM|ºÛ„õQi!ý¬‰YbçIò{$^d•—ÚÅw¥AhÂáÖÁÂÍÌDãA›·…Ÿ>X¥ŸHºVp„ãw' 1KñkζoÏtÈ U6v¥ æïŸ5鞬6§ØD—®sïžâ¦¢?J‰oë=~SÄŸ…(D¶)_6SQÃÛy=8ݬ,D²Ýº{ó²|Úë#B˜Õê̪•ÛKqKŠ5!¹'oÃV¡òä¸{3¸¶ò|#Ï›O©OÊ7„ôK:Oɺ| Ò-Ó:™y4Kýd‹•ÌSSÌÎ’“
ÊoÓUŸ'œú¬íä9ïã$¢_"D8æz á¾óOè€Yü÷\ø ,eêüž«íÙzÆþA‘ó ¸ûœßÇîkD‰:ÞFíò)ʾ ¿è<Àñ—ÏpÕ{ Êï|ãÔ½Fîê…ҴŤ=ʦú/ºö «_Ž¯ ã¡žn&çw!
FHó‚Ϧ~ b?»lyG|ë…K¢ß -sò´
2ul‘y!ç·WuÇFóËW3ê|²¯ —p -Ì@ ó+ÝÜc¹53˜Y)†Ä^©>m7U¢µÛã³b÷¦“13ÔW®‹I‡ÊR\Gø=o¨cõ»Ÿ•
«G÷X¢bC‹Ëbzöºú}pIXÀœáÔ|xz/¯—™™¾á ‚vºmNªB(U7¼² ¸ï4x˜¶²˜yçúÇj×Ì8Éä¡ËO&lè+©}/ñ9OçÝ%º\㌄@øéŠ í̘×ÇÓ{…½{ˆyÄW±aå·õ ÆDŒåâÆRÅLâÉ¢ü›óYí‚[¢E²8òx²³Lêï“o ,ùEZ¤º{m¯ŒìÖ-¬é¾uSà©þ¸iá± -çâ¤ïxk¶?µ H’/Á*K݈]› ípÌé|R_µ× -ç² -ó_>ÈÿüOh ‘Éf™È(&È‚(—ÿÍÿìÝ@¼endstream +xÚíWi<”k2e$"ËA<daÌØ)ûØ:a4v*cæ™1Œf±oÅÉV–É’#[‘6[¢Å„ÈJE©h±d‰N½ê=½}{¿½¿÷y><÷}ý¯ë]×ÿ¾î‚,§fJ¤{ƒ–tK
D +
‚0tÛ ¤±pì€ +™(B‹ JXÍQX4N\õÅ’ðD +kµm +$@…ªÿJC?=˜þKˆD¡×Ú#²Ôh”@6hƒù; +…P«ï÷Õ~èp‰t5ô‡» Þ Ô÷îµt·³VùUÿß=ÍÌèZWPÓÐÓÐh¨O}mÍŸY¿ëñM‹5+Où»VÔJ‰èm Òò[[A ƒ Í*€XmeàŸüvt… +ïO¡†þ"îgGðë…ø›îgø+»)L5´ÆW#…iI ‰X +‹àóuv¾ÉM\» –Τ¬^q(DýæèC!øÑ@&:”5¤JjA#ЉÀ± Å3ˆß
«0Í`@:ûmO¢@%‚`H€
Ð »ûÖ nXºh*¬öâ¾f«ŽÓ¶Œ<™Ê5Žän±÷;/©U0¯—™‡Á¶ûUy¬·]Ï•&i‘¬ì§oÖˆÜ($ /Äm(ñyi·ÁæéMˆîT«Dú1ñìü×æ¡w¬ßË–/¸)™w +áè"ÑÛ—Ü_¾ +´‡IJ—UòÚ¿PÖ]Ž}goMr0€õqš0(ßØ#Ù|{n\yðQi;ß•7‹Â•B^ý·Ìøµ£û¬à¬šioI·óºM74–}ÊêIË9EÚ{4÷Œ¨v]rA$¿m2S9µí"ûåñ8×Cår-Å‘eÅïšK t^VV@¿P”~¸Ò|¤™_h¨±™G:P½/ Ö¹ŠÛ´&,™Eb´w›.›e#5pÙÎyž?-ý!; (mâ+›×aÙ–Ú&ϼæ euG\y'qÔø–jnϳ)×í¶›æyo¸á¶MÊèº,ØL”‘
º ~§B…(¹%¾¤}âË’#ÞÊ–¬“1|é,‘Ÿ(×^S{ª¹-'lV¼ñðg>áÄ)7T%¹'ŸÓBœsKüÛ‡ »áŸ%Ó¸\v¾Ù¬s<35ÚHtd³Ìªîfñ$²j«ºŸfež[–z#¡©?ŸPp«E˧k&þ"bªÐYohzß–Óêúí<äFFsPC¯‡×Û±sFgz0èX*–;%eŸð¹8c³ÿÖ®ôÊXúËCóR__ Êmñ +MS™™<ìyç
‡9ÜutÈ9(¯®¡C&s©z«˜ÆîÏ^®Z®¯¯f›<G‰ßêze9s7÷ÞщZËŠÎí<Å%±ÇX+zTóÚ„¿“M!r†?á‰JRšÕáêP˜*Jy˜/~}“ŽÅ¢{=_áÀ½#–g?‚â¯ÀJ\§½Yª—$쩇Ÿ±Rk‰êý}¤£Ž#¶£ÛB¥4æ$D2ÔŒDƒU·ttûn,“˜\9ÆT¾éV-»Ì)ûëÙ‘S¦Ú=,ÉG µ$Ѩ÷›í-Øù¥dƒŒç®Jî ¢Èp—/ýèE„Î;f´zÙf©1—•Å´ÚšµÂÁð×/
,ëhB Î%y I
üù§¬í°• „í¨{5Ø@7ѺsÅzNyrx$Ææ®÷bo
ó³D_ôF¤/ }ÐŒÊ+K |÷!.<Ö}˺-.W·ÊÁ)ùzï&ãT} +ï +Ë90RŠå gýö|ãÍ\ «4p’>x.É’êjwOË< +6qVI¢Ï±¬å;Ä6\Õ.B_·‹y¦¯ å°üÂt®h%…8¿2~ÀS°ÐÌ »71\"®*Ÿ&¬¼¯íƒñÞ‰ytËgWúQÒDª×w¿Pè³ÊëE鞸Ê$W-—鸛'¤¢ï” +ŠŸÚÍ‘ymÕ"ÈXŸ £u´]ê‹‹ôÄcÔÂÆ n·Úôðï½Þâ;ªÖl›†’/0åw½Ì« JñF9 +›½´ôš‡ÖÕ/,¨Ï× +Mw=h–%µe‹ã¼
ñÁö|nVþ:A.ÏáÏ¥¼)îÝnzíFêÏŒ›ü%¾ì|PÄôz7''«f5/F9$Ö¯îl«ˆ·p~|AèÁljŽüÒi9þxi¢Ó·Ûme´v½l÷ÓÒqåˆ sDT`CQidÏ!'K¨óìšO d÷2ÒR¶ “QO±ÊL’ "k†T”}>p‘äõE¬´Î[ŸªœÒ¢DÆ®=>»¿øò‘/Ùï¯Ò¤ºèçExBΕïmcD¾>ÒËïуÏÆ¿Œ +.»§¥3) /=™$dl CäÞ™ÇlãÝl)”4 N%8H$ý>ý6ßœ[ Y¬+®×ªáú+œõ–¥MÝ}7vø ˆžµäŸ,wÈÇO{Mu1ç’ò E¹b1éÊzŒˆª¬ŒÛ ûêøþ*÷u¥¾æã;ç +£ÕòLŒi’ÓZ…ŒDÑvÁ‘“£ò¹X²cµ¼_Á¶…ª‘†ŽJ÷C6‘·¦O¦šP2ãgû Š¹=g ÖŸYææqq¬üŒ¸¨ðÉã1¤õ‚hW)V ºà^¾#Yå/æ³gY'p ÃIË„ÓAÒ>D é^éõ ÷+^)ä7Ú /coÚ‘VÊ{{oP6…§¿ C õ_>ðÿüO¨ žÁ¢ûã~ðpÈ„~(WÿÍàÿ Ù@«endstream endobj -1440 0 obj << +1458 0 obj << /Type /Font /Subtype /Type1 -/Encoding 2737 0 R +/Encoding 2807 0 R /FirstChar 97 /LastChar 110 -/Widths 2742 0 R -/BaseFont /KSHSXN+NimbusSanL-ReguItal -/FontDescriptor 1438 0 R +/Widths 2810 0 R +/BaseFont /LLFZNH+NimbusSanL-ReguItal +/FontDescriptor 1456 0 R >> endobj -1438 0 obj << +1456 0 obj << /Ascent 712 /CapHeight 712 /Descent -213 -/FontName /KSHSXN+NimbusSanL-ReguItal +/FontName /LLFZNH+NimbusSanL-ReguItal /ItalicAngle -12 /StemV 88 /XHeight 523 /FontBBox [-178 -284 1108 953] /Flags 4 /CharSet (/a/c/n) -/FontFile 1439 0 R +/FontFile 1457 0 R >> endobj -2742 0 obj +2810 0 obj [556 0 500 0 0 0 0 0 0 0 0 0 0 556 ] endobj -1363 0 obj << +1381 0 obj << /Length1 1608 /Length2 7939 /Length3 532 -/Length 8790 +/Length 8789 /Filter /FlateDecode >> stream -xÚívgPTݶ-HPPÉIhrM‘œirNlèZº›,Q@¢ 9G%#A2HÎ9ƒäŒd âC¿{ιõ½óëÞóëÕÛU»j¯9çsÌ9æZµY´tyd K¨"ÂÍäåЀÙ[:£tÁj<²8pk&`a‘CBÁhÂA Œ†>B! - ³‚: -uû
€¡ - sDn³jÉ+þÅm Fÿ΂ݺëÛHÂÊùwI|·0·^4æ€ ¡nèß¹,¡ -‰zý›|€€ÿZ«ƒÑH˜àùmÑüÀ?¥ÿ×û¯•Ùß` ¬ßs¢‹;@nG럆ßn+g$òVÑ?§ý¶ä¬ÿ 9êµ"ø2…° x™˜’„.£ÈèÞÖÄê -tÌû¤÷>Û÷#¢Ù'1xY´èÅui oåг›:÷É ÇŸë*œ=-äp¶æxèAGkö£Ö®
>ó<¤]ÃpÏà µ%l“'ü+Ú:æ¹×w 5"ñ¿sø2¹dû’2Ÿ;y[%TD’5>¬Ä .ËÙÙeùúýœ£·»«³ù§u†+=ŸEÌ›5Ì×)FÊD¿È3Â2Óñ1¶%¨UŸ]pa昼jI`²…ÿ©ÐjÖs· Zôó÷T¾2ŸÛ¿“õ¡ÅM³ÓKèÍì‡8@ý,ÍÚUBœu³ -w^™YËí§‡¼ÕùÆ!}i¡Õ2@{OºEÜwò¡ ™Úâe«H`¨Þ“m=JõbF?–àhIì ‹µ(t€7¦\ŸÎ™°B.júÈW“ýÂ"áå‘Ç3Ÿ²·ZëÄŽ³[‡9 ÷‚{AÇšGOÂBeíú4Wò’–‘Q0A´–£;, 7¯.Ÿáã«b÷´yS¸‰Jï*írñq g -ò¤
²Nl¼iB¦Z;D§
`wœCb>¼T÷yelc¾s¡)¨oWpHÖË Ë³†jQ%ÍyýÜ6÷œ>ï õ±z¤MW%òi~A´¯îS/È -¯š±Ôöcxu-¢¨’8ïÔ™‰ Ä K¬³";±]âÕ4—A©æñi¦uÅ{µ*Ï^àœø}IͲjz¶u1-勸ƒ Èš© »Ä_
(PÈâü¡]Vââ,í2åÒW,îÿh¤¡=@*Ðyª^ƒ=±joµnÚ ShðµüÀ2¬÷l¹Lh‚+*±ôQn¶î#§Å‡˜o/Öo'2+^JÒUjàsqÄæ0ÿ3"^ r÷–Çs…ˆ€Žc û›žŒ9°-M=ÿðïÊ&ŠÀòŽ¦¢û_Àº#K´Ä•{î¥¤Ê ][-Ûþ´‘? °•®‡R%Qó[ÍzÖR\S†£EãòšædÓÏøÔB¿ -™BØõ$Í’A©•ZäÜ÷RÁ¡)Ïó¶Jõ
@ -N/DW~¶LùDÞ£Ññ|سpdÝî,½xAb/L, XsÔæͲö¨ È_\Ìo䟺¼BE–D1 ¼/\asáÊJf¢¡Õ^Ö¾G#5¾=Š×j.Ìï9Ï|ÖË> ’(Æð47ý Z’7ž^{©ŽÊ²Ú‘N‘*ù²R9 ïÄ¥ÿ…øážm°£)‘I $W±eÌ›«ŸYóËòÄkç•Šu„v|ÛWzK†–î$‹=Ĩ²€, !|a1ÑûH ¯—@èôe öpohdÖþ:ÑÃôÚ y¦ -·×ù8Å8°*ý¶Gùâ°²£€™_¹µ„Ù·ž¶-ßf±úÕQb÷¢Š =Xž\szå˜3Å ]†N0£Ü"¼{ÊÅ)Ÿ¢‚£Cº5´µüþ¤š¤õªhŽÁ&· -áæ°iE€‹£ƒãO?àýp«ñò~ß‚õ|…yūסtÛX@WzÂTeö´îc´L„Ù›“NQd -štü–ž/¿€—JÌx|D¦ -¹²ð IÇì›—nš;¯™@öÁþã¯ú3T&“Œ½-òÆqR\šežØ$ÐÞ*À(¹+”0)u•VÕ”>Ò={îüyÍëê¾€©¦[ý\Jt OeD¿zK9QB:!k(éËZ"Л©ÑðØ4ÿ§V Ò¹È2\û½EŸÉztã;…Ì6nº+ŒŽŸ²CfEìc)¬îOÛÕ†8h'|±º”‹…óï–ëÓ Ñ ÜDÈdM OÅÏØ '53×Á §áŒweNªÍÂüwÍ ¶ˆÉ»+Á]ý› õhM.Iâµ yC]Ó|/ÍŽ¿õĪ÷¹H—‹Ý7ÔeUþ°&³¹æ’+±•W|_fØŸ|>„%ýHÎÌÚ` =6"æW«ô9#Ñ\ Ó#3z-\ô |%þ¨$¶Gc ^¤‹M ]÷²³Ôú[¢_ýDÒû ñÍ*õ,θðêØãüe•Gƒg¸ŒMaÒ‚ †»é»Êü+M[Tϵlm§ 2!ž7V¦Ôˆ·n -摸†pj7ŒYù?ò $š˜ëÐ:{—¶^˜u^9L„‡DW,9%%^ôÑËåÌW0ß²¦ÜÝ™ZÒ×ý/õ{xûÆ>²Þ” à/"ŽDjúmy1§_ì>WPãâÑéƱœ ‹› -zƒ½Ê%%
¯O`¿L5“ƒû’ªV,î½øÊîÃr‡.ò&Ïw¼´rVÇ—ÆŠwŽGƒ ±Â*ÜA5ƒòëšSùSÕi…Ÿ*z~Öå{OrÙÎâ¿z»—’M®dæ|Pû”î"‹ã üi®WòæˆWü›#Ð'ñëgÏbíbœ´ÉQùb³ .Ã…ñk›ÌBd¬ilü–w_ãcŒ䵾,ã
Ž -`2ý
¯dà ÇÅ^vÈØ—oROq]{½î·«›B?b³Rqª+e¼}RÜ)ªüqQûÁ_Xù¾Hž¾;"ŸÄÀïÖ•žyS]³›Ú^÷éñ ‡ëU ‚ ŒÚ"ÿ¦â*à©;}Å–h6¶ÈÏÉPòûå£Ð ¹Viè—aGR3Eïù<=…>¿ç¦1 âs:Ÿöj'’±{VR}NPý 7ãT·3ÿzÏrã¤"¯jkÅ -k=n ²/Š[–xà•º±ÿ†g•¶rIA 0ȧ ìûdt-qˆú“_=«-‚Ã<&ÌŒX_{ éþàçï7Â?L„ ˜]*P™14åMwp…2f -#sûTÌz8GŒ$/üÔîTÙÄZ”-¾U£N»³]¤— -Ÿ¯þeõÜ·±£Ò’âd†¹šIˆJG·ã_-ÁçîOÒXx¥Ô~MÏãn®ªe}ûÐ÷Oåöƒo™}Ù(<Býý¹ÈÞW ìÕ ¨*,r<E·'…¤cHrÎ{÷æˆùŒfô;yš~ø†¡44*xïGYØci³IG - -ï«ú™Íá^-c„L“n4b6eï%®70?¿sºJÃy”ð‹ŽÒSº¸„,C[H±õh¹™‰m"uù°- û¯yŸ”`ꢛ±§ œF È\ jšjU •e«õºŸ•Õ4K¤^?͸‰]¼‹Û>’q]åð•P+ ¾þÁìH°ãÔÙ&ùkgðòcüˆ¨î“÷Ù2y/%¬zO ñןߋµø9Êí¸«sW³0PEIÆþŸSÐã ý¼.î ‡¯#2)Š`ýäJC1·Rs³ÓóA®¨|Ù˜Ù›Í -]ÁvþõÑ–U†CEgw87{FZh¾eÔ”¼8zÓ©ž;[aÉoŽµ$O›°MŽGb—§©¼.ãxÿ©Ó·0[êUDæXñQÅš¹Ý’71~8dDŽ"hñSnäjû$ye8RvAôWz+ÙöV'óó4¬WjÙÝæóðà ’Öè2¢=ù "ßÏýÃÓ –ë3Óʉ5®ˆ@n£ð´™
Þ8Ü(ÿR&H -ýÄ×€ËFNN)K(4 †ï}i|]pˆ‹»ÀvûèšÏûñ¼ö®‰ÙzKôçpåf‚Ã,sQm1ùÜþ®:±_ÁrRÔúü–â¹â% D K †ÉŽ 5ŠÄà1õû.”òg´[ºœ|…%c$Ž°Þ•çÊòNùÿhéx<С´43¾–´À9P®EÓ@¾Æ -›Ø6ÓæxEОÉr°%¯¼ eæï$5¬ûO,¤'¿}¦~öUNd£»K‘ùw Z«L„-=±L×jmš‰I -•þ{&ZUGNËW=’\ÅAB ð=Ÿª´§Ùþ¢TÙuó{J:Ó â wÀW`š N:À9ª²üÍ¥´ÜDÜKǨgÚß¼iZ”µ,ÜÙÞ& ¬Eˆ9zˆ8à4¹hàYœáüêç)@Ò)‰v’ù‡âV©ûèJŽ°6¨f’Ÿsê3ÊåOL«G²Aǘå´c‚'X ì¯RÛ’¼Hè Îp-Œ‰F—Í2DzR,‹•$ ù=””zʼn/^_õ«{]ˆí…Q¼¾µqßñq+êYë
ˤæÚ“"n{Š£4Áza«ðòç_ìk›Ì•n’äNÏ„½~*{‘hNò»+’f6aï×UÕ¿Í -³Æ~LVõ—9Sà!õ§‹n¸øŠ®wÁT}æJñ=MoÁÓ¶nÉùÙô`‡¶ûZ¸›ïïóNGã(Œ>ñRÎø¦a
ô1#7Øq$[d¤ßÖ?"¯=¢/$iNx¼aLÚ¬s¯R’a't ¼É9õ3£e oUfÖd¿b¨ üáÃ=‘©ºt™—Sz[8žf£^® à>Ç+ü˜Õ½Æö8M 9®Ô¦ - )_ò¥¯tIYº²ŸzIܤŽ¾ÙïT3Š -Þ…«F{RlˆBí…Ôˆš(hœÿÚ ÞÙió _½Ò‡ð -†ÞY˜¦øc@·‹Ž/ _U‘Dš§øû†Ìe‰X§£êmì+ »ê <£ÌÇ£&g=ò¾Ît=í óž×H§•$:ͯßåµÀû€÷¦5†õ3pi€µ/).¦¹£DÙT
…™ñÞzoåÊûÇ0D6UÐg·kË'¡;uf"ûA¯pŒÄA@\)·\M2ÑŠ×âiù©i:2Wf ?½¦It)« º¾zí•ÌC¿¾Ú{ؾ‹ÙvmÍ-*ðÚ¾bÉ(t,õYmçnŠ ‘pùsª;ÈYäE²Û_(z òd bö‡é"qy¼'s÷\ƒá„ò‹ç$,*1Œ¯?Yþ¨TüT/®zš›ñã*ÜZ“ÆYxȱ†yÆ U°pêþZÌËLOæÈRćïÛÑ<C—)=ß&Y4pÏÛñ~Øù³ˆ’©ÿóâ§àõgp!üˆ¼qÓšrOÅ8”'nñA¦€‘Èï—qìU•}þÔWø¬Nó”7¶ëé¹- &“Y2Úüÿˇàÿü?`‡‚‘h„=iGð +xÚívgPTݶ-HPPÉ™&çÐÉ™–œƒº–††î&K(HÎQÉH ’sÎ 9#$ˆ€øÐïžsn}ïüº÷üzõvÕ®ÚkÎ¹Æ sŽ¹VmVF-]^Yª„p@óùž4`ö–Î(]°ƒ¯ ÜEXYå‘P0†pP +G8ÚC зÿãºP( +²B р۬Z +JñDÛ‚Ñ¿s£`·n +œ6B†NšVµúz9S,nq2 BÙYÒ_+Ÿ¦Þsà›`n'.@b%iî§ZüwœJ¯îsúð {^¥’¸úCHW —Z “èŒÁ v,!ieí1«¥O˜–©í[oF‹£ ‡y‚öƒÛ¢Aùx@”SÜeMIƒ Z| +úˆJý€•<.%sõ JŽÅ?ANïÝy¯2}oÁ[+B”z1’áž ‚`Ïtf¶¢tÈwŒ° ÏŽ·xÀ©þ™Ììè)‰ë{ çqéœÅâêsn¹ÁâÑÈ!áLâ|®Å–êjÙµXùPüðáæN …:ÍâŸi ËÉ#V +.¡Þ&ä± .µÙ:á%%¯ÆƒÀ+Ùì£àrÒôdxå ~åj}vøñÅ +E“õî
÷*\ÔíÀ5´Êµ³nÝ¥¿ìv°¦Õ°“@<˜ÐÀÁæ„|º‡¹Uº–ÒSCö¡•Z„þîýÐni¯0q¡~‘ +5¿Õ¬g-Í=¥á`8Z4~ iN6ý”@}!ôk °)„COÊ,”úP¹EÞ}/ šòÜ:o«4QßФháôBlågË”O„á1
QÏ—= GÖíÎ2‹$ö"Ä‚B5GmÞœ!kÊ€ÅÁFþ9¡Ë+TdùGô“Àû"6®ld&Zíeí{4BQãÛ£xæ +Çžó,g½ Ã!‰âŒOòpÓª¥øℱ—ê¨,« 镨’/+U²ðN\ú_øH îÙ;š2™´@r•zPÆœ±¹ú™5¿,Oì°v^=³ŽÐŽrûÊ`ÉØÒd±‡U”£'„/,&z ‰â£óõ¾ Ô áÌÚ_'z8ƒ^»‚!OUáö: §˜VeÞö¨|B VvÔ0ó+·–0ûÖÓ¶Ú,V¿š J,â^´S´+kNï¯ s¥8¡ËÐ f´“[„wO¹¹Ržáè.ÁFFM„l-¿?®f$i½*Z§g´É-@$ˆð‰´…G©3ªV;eW„ôÆwœÃðÇkÝüÓï«Ï0¾B¸9lZàâèàø3 x?Üßj¼¼ß· E=_a^ñêu(ýv +-gھ蟖¤§I„²kZKéä”ð +›û,¥ñº“Ûý ÙU@žXÒÖrÝ}Â;´w`D.à™Œ«ž¥ÅÇ3\™»ølð…Ébñƒ¥‚U³¢ÌöMÌœÞÎÛJ”…¶WkÓhý j¢’«qµD¹Kz瑳³B|óG\Caî+þ¹*ÊÛ~¡ñ¥ ÎGÙ§}–ΪJæÄäû§ W÷HíÚ>ÛÀaòœúò4ó üN$ÕYYšžÇï_œ••W+vqƒÛSš:± 0ZÌ©„›a‚â[‹”%sˆ{¬ Þd?zä7~ÞÛsý3M{öži17ÍÖ‚\"éýGeã3mì7 +Kygm/®SÉ çÍÄ\ÊqÈbO;z¸‰ð «-4'¤§€+k=ž~(6¸hLìÈÒúô<6»¯´yjÊ^"þxNLÝ°Ç%3jz˾‘e2 ÃÏfĺEÎ>_žÝ(¸š¤²uy•“®ƒ›{!Þ4l"ùíóQtñÚIÝE°ºÙu² ¯‡Ån¹¹ÄùÂGˈÃÄ › +?y“w¾ G$ÜË×ß™‹<Ê™2ãtÏ¢Þ}ÿ† @´yIGbc‚²Kê·HŸ|ëÖ
x°–Ñx½Ùþ2—€_M”+=‘Û~d˜„“•/tŸ†ò³vLFd*°Ä¾ù±b«&} ¢¥çË/à¥2 ?‘©"B¾,|BÊ1û楛æŽÈkf}°¿Åø«þŒ„g“IÆÞyã8‚© .ͲmhïF`”ÜN‚”ƺʨjÊ éž=wþ¼æuußÆ?ÀTÓˆ½~.%º·2¢_ ½¥’()“5”ôe-èÍÜhxlšŒS+é\d®ýÞ¢Ïd=ºñbfýFÇO¹!3‚"Ž±6÷'íjCœ´¾X‰Œ]Š*ÅÂBùwK‡õiŽ€hn"d²¦…Œ·âg쎓š™Îë`ÎÓp¦»²'UJfaþ»f[Ĉ]ˆ•á®þÍz´&—À$ñZ¼¡®i¾—fG‹LßÇzbÕû\dÊÅï격|X“Ý\sÉ•ŠØÊ+¾ÿ fÜŸ|>„%ýHÎÌÚ` =6"æ’P«ô9#Ñ\ Ó#3z-Rô|%ñ¨$¾Gc ^¤‹M ]÷²³Ôú{'¢_ýDÊû1éÍ*õ,θÈêÝþ²â³Gƒg¸LMa2B Æ»é»*+M[TÏ•´lm§ 2!ž7V¦Ôˆ·nŠæ‘’¸†pj7ŒÙ>ò"$›XêÐ:{—¶^˜u^9Ì’„‡DW¬9%%^ ÑËå,W0ß²¦ÜÝ™ZÒ×ý/õ{øúÆ>²Ý” à/"ŽDkúmù0§_ì>WTxìÑéƹœ ‹› +zƒ½Ê- %¯Oà¸L5“‡û’ªV,î½øÊáÃz‡>ò&ïw¼´rY6Ç—ÆJwŽGƒ ±Â*ÜA5ƒ +ëšSùSÕi…Ÿ*z~Öå{OrÛÎâ¿z»—’M®læ|Pû„î"‡ã üi®WêæˆOâ›Ð'ñëgÏbíbœŒÉQùb³ 3.ã…ñk›ÌBd¬ilüÖw_ãcÂŒ´¾,ã
Ž +¢&tG÷ü©Ï¾2¤ûôþÌÓ(v'«.Š +òôÿÑü0íû¾€Žˆtß +sožbrÌûvE ²ÁÅ/ÍWRÙu/w¦ØÒÕÛïòxœ‘ h<LšøÖ‘pí Çâa
®”Y +Kqh|>6œÊ³(æÀ’ßë. + a‰ñµoWkrŸÔgÔ ÅÖº›Ð˜wÜ6î ÂÞN¾Ùö
i± XüÐ~ýÅ´á´ÙÞVó Þ³6÷³Ý>EŽ +‹^±Šî±nl#šñ‰65%,ç_°Oê”+µNý%Ùz¯>W7¶]•fzã}A}H›ÎÀSÝÀ~ƒQrNÉ)îs¬þr]Lf¸á“ +<á¼ØËûò
Aê)¡³k¯×ývuSøGlVªs#Nu¥¬·OŠE•?.j?ø ÿ©ÓwGä“øݺ23oªkvSÛë>Ñ=¶ Ðz¸^"èÁ8¡-òo*N¡žº3Xl‰eÓk‹þœ %¿_> +Ý‘o•~~æHj¦ä=ß‚§§Øç÷üÁ4fA|Nç“ž@íD2ÏJªÏ ªßãfœêvæ_ïùQÎ`œTäUí`Ø@–¶Y™i"Çø¡Ñ=¸M×g •Õ´1š:Uпƒfèò©ü¢hçˆ Šl`‡N¤·èç«s¼„klbhL˜:g6(皊…KQ}ÈÞ] Ÿjƒ+ÅÁ7„,IL$¥<³
Àãyª1ÕÓ¬^Ubó¥s¼=õ¤¯æ-_ãº"/·ÒøìX¸¶å¤)"<XŠxÜ*%Å•€,Kß‹?¯‘¬’ÿ„Ç#8,Gi§ñ +D¯°4Õ4øO‰ h§ª‚Ã*÷)É›%ŠØb~ø-GÈs“I»øNà9-ŽSqÈÓºD
{Ú½S\pzùÃuyjD¡«†k!ÈÅ¡ùð4yªQemˆÿÉX‡Fiomß¿»jÑÄŒŸ*m—´Ã”8Fèc…ךÆàAÔÉÜî°’Z¼5è篫a¸”dñF~²á)ž!“F³ò±Ëâ7£gªØjB}X€‰/‘'™“š"ZtÍCöEqË’¼R7ö¿Õð®ÒÂö@.)¨F…t ‘½uŸ¬®%Qò«§µEp˜Çd€™ÑÛkï#Ý ýFø‡‰0A³KE*3Æ€F ‚é®0BÖLqÄ`nÿ‚Š%P爉䅟Ú*›X‹²Å·jÔi÷b¶‹ôRáó"¿¬žû6vTZRœÌ°T3 Séèv\ã«%øÜýI ¯”Þ¯é¡ëæ®ZÖ·mpßú”Qn?ø&Å—Â#Ôߟ›ì}ÅÀ^í° ª"Á"çt{RH:†×¼woŽ¸ÏhFO°™§éç€oÊC£B÷~”… + sœçã¸!q?Oƒ¶•G¯îW̳ŒÔ)HænÉøoÌF–A£Êå{Ç‘æä8£jýäUu;W+Aà¢ïóÇ;X;{¥ð”ÇÎwÆ}x"
Æš=×N¿nc}& ±Éy[µ ~œ ¿öµh¨»š«¢³ñ©"Ì‹üEmÊ`;µ +Lj +â³ß +Ì Q=w¾?‰¦6ª~ûá¤àõd‰xW/aéÒÛ‹†Cú\»UÒâàfÒ~…¶‡Í +¤´HNú2HBÃ8—GÂ+zq(6|£}h`wŽXn‘ÉÖ\ƒd0ÖŸ9yEúQ§lõ8þ4»G“‘Èh(1›‚#Tšl8ùñ\ ^ß/Jö\¥H§¼ ¿Õž‹r2Σ}‰RÕ»Y€|áCžÓ |ƒi
xCª ݪÌZ-›Çð0ÜJ LÕ—D9dkùåΞ‹üÀu !!‘}U?³9Ü«eŒiÒF̦ì½Äõ–çwNRi¸Ž~ÑqÂzÊ—eh )¶ M# ±M¤µ.?¶%aÿ5ßóÀ€L]t“ö´ƒÓÈÙ‹CM³Sꣲlµ^÷³²ÚfÉÔë'7±‹÷bqÛG2®K œ¾’j…Ã×?“ vœ:Û¤~í ^~Œ Ó}ü>[6ï¥Ô‘Uïi!~£óú“á{±±?Gy wuîj>S–µ¿ƒÆçò8CëD?¯‹{ÇéëˆLŠ"X?¹ÒPÌÔÜìô|/*_6fñfw +=ÂRŸó>Íj óðÔv)Ùyÿ¹[G¼Ü5)…ðwÃä¼Ar«òqsV +…üЦ^o{<´p–…p¤(„¬Ý¡òž#% +o– ›.%§ª¿ƒ àêÕÎ*4Z®÷„&§xás=G‡ü<ṼǕoÜRŠÂò7ð|lä”güâ(l€Â(Ù‘(8Å|)ÿ¿wÆô/þQL™ uG«ØâÐÏœÎÎ~N*{cÀt(û6HÝB=viˆÀ%ŒÐ/ÌÐà>^P䶊ŧ¡¯ÕrȈ=ÂÆé2¾ ldÔD4“kêœÐw§3\Wd†@$B}vÓmwÝK&à#ýÁ?¡e6êœÿ¸¥*IÖÔ*Àií¨²Q„É¿åAFÜd@+íy‡í j¡×Ré¬üž±àV{ñ)„ÓÜy¸K þÍç*ï¬%3Ã6ÄÐqO®Vîz +Pdž·ÕŽÝKcì" ÂñקÃ߸Ð|÷”:
úaAÞffñ~þµGµ³+ìMk{çg1Û»tîO±¶)0ÞÊœ<vŸj5Uq"¯}h‘ïÎ[
ã^ýŒwXcsÝX YVW³Zxg/ÁÍ& YÜÔŠþ6¾ÿ„×ÔĈäUu&S·+0›Ý)§LI4îÄR °v ò[_ •(ÉëOJ¼‡ŽÛXÄbÉÛú󅟃HÙ¾üª½[!+ØÑ™õd¶¶¹c
¡µìÉŠaüð L²ëb_Àå¦RnMúY6F¿ÅýíÕ<úx*¸÷â&?ñiÛJÌ¤éŠ Žô·Î±¯‰Ò%§¤+Ž pñýïê=Ú02á=o !“®…-‰NØ ží2_Ûš,l|% ÕvW”v¨q$M1‘]–OmÍöèÂg®eÝ/Ý»ÈÔß1x ±]Ô'ÎÝíÎ<± úa’'0x{&¿µx¯ùí©wÏ.o†l¬AÁ +Øο>Ú²Ê.ÔZlvp‡k³g¤…æ[FMIÁ‹£÷0ê¹³ÕvœøæhPKò´ ûäx´!vyÚ³×eœï?uúfK¿ŠÈ +>ªX'·[ò&&ÇŒÈSm"~Ê\mŸ$¯ GÊ-ˆýJo%ÛÞêdyž†õJ-»Û¼` ~DÒ]FB´§Aäû¹xx²Ãò`}fZ%±ÆÈr™6³Á‡å_Êf +í&2Pƒ óuíIŸ[^|uÊàïíŽl«0x¦ŸøpÙ(ÈÅ%mé…ÆÃð½/¯ ±sqØo +ŠÉËQfþNÒúðÄCzòÛgêg_åD6ºq¸I“ª¸ÊFØ2ËvÖ¦™˜¤Pé¿g¦Uu䂱~Õ#ÉUz$¼ +ÇHÄ•vËÕ$«x-‘–ß™š¦#{eöòÓ`ÐhšDŸâ°º ë«×^9ÁB0¤ñ뫽‡í»˜m×ÖÜ¢Ò ¯-‘+ÖŒ!ÇBPŸÕvî¦è ·?§¡ºƒ¼E^$‡ý…’*O*n˜.—Çw2wÏ5N¨°xNÂø,†éõG#Ë Õ€ª“ŸêÅUOr3~\Å[kÒ¸! 9×0ϵ +CÝ_‹{™éÉ YŠúð["šgì2eàß$‹îy;Þ;Ú +_ƒ
ÃižòÆv==·%!Ãd2KVûBàùü€ÿ' endobj -1364 0 obj << +1382 0 obj << /Type /Font /Subtype /Type1 -/Encoding 2737 0 R +/Encoding 2807 0 R /FirstChar 36 /LastChar 121 -/Widths 2743 0 R -/BaseFont /IJNFNJ+NimbusSanL-Bold -/FontDescriptor 1362 0 R +/Widths 2811 0 R +/BaseFont /IFQNBV+NimbusSanL-Bold +/FontDescriptor 1380 0 R >> endobj -1362 0 obj << +1380 0 obj << /Ascent 722 /CapHeight 722 /Descent -217 -/FontName /IJNFNJ+NimbusSanL-Bold +/FontName /IFQNBV+NimbusSanL-Bold /ItalicAngle 0 /StemV 141 /XHeight 532 /FontBBox [-173 -307 1003 949] /Flags 4 /CharSet (/dollar/hyphen/semicolon/C/D/E/F/G/I/L/N/O/R/T/U/Y/a/c/d/e/f/g/h/i/l/m/n/o/p/q/r/s/t/u/w/y) -/FontFile 1363 0 R +/FontFile 1381 0 R >> endobj -2743 0 obj +2811 0 obj [556 0 0 0 0 0 0 0 0 333 0 0 0 0 0 0 0 0 0 0 0 0 0 333 0 0 0 0 0 0 0 722 722 667 611 778 0 278 0 0 611 0 722 778 0 0 722 0 611 722 0 0 0 667 0 0 0 0 0 0 0 556 0 556 611 556 333 611 611 278 0 0 278 889 611 611 611 611 389 556 333 611 0 778 0 556 ] endobj -1360 0 obj << +1378 0 obj << /Length1 1166 /Length2 8911 /Length3 544 @@ -13480,7 +13873,7 @@ xÚízU\\kö% ‚»înA‚»»;PHî®!x 8 îîîîîÁƒ<$ýý¿ÝÓ·{žæm~Sõp¾o}ÖÞ{}ûœz) U
1Kˆ9Pveá`e „8 l)qøCÀùÏ$AÎ@‹×¦¼Øþî› âöùØ -¶ü³%K7G6-0ÈÉ
('ù?Á¯ò¿0k +€‡“Ÿ +¶ü³%K7G6-0ÈÉ
('ù?Á¯ò¿0k +€‡“Ÿ qýñ$X8x8þÆiÚ€,ìÀ@—׳ø“‚-ÿ–R l±®¯SiælùOàÚÂÍÙùÕž?èõÞ¿öV ×@O òÊ"ÄB0Ô¶6´ý¡ZŒØƒe’«Wëî·97rŒ=ô7V˜^e»bîÜÛwŸ³$UÇl„+
`•`¡Ã㉥bø<ìøÅ;X°°Ã°`d#‰NYë„”P/駯Øûˆ¢ R¾ Kx
Ê^P”ÝéÑKL`i„CpH ôœTà‰ÉÊò+TŽøñž‚ÏUdíýÕàçG:%Ùmƒ#RPä»g éäõQOï±+:°LûÅÑxæÃe]k/͉õJø:'º8ŸlJÛ¬žªG óy乌 טòQK6‡
Ñ+íLvþ˜ð‰Å16(ÎñkX„Éßš†+…¨pœ º–QÄ´Ô ß^î)RêÔ[W,,¨Þ‘õÉ»ãp%n×)iuGYÖǚπñZ¬Õˆv4¹›îµ:®uľõ«GZýÖ:„<=Ÿ@‡ª˜yÝ—l:GBÎÚOAs½À:rÁ Uuiw™ª¨,w‘ʽVç±ÌwZ6ç]ºš½žWßÆe ͹„縤h£öÙ8âØYWÑtÔ¸c}ü5æ?°5&Jt” ùËÞ ¨—OÉËÛòÁHÌîZ‚pr_‘\OœÅ±„4šß²~òIÝbâí‡y"ûÊ“¬4òŽZ¦¿;‚Àždz™RÑ t[ ^cíÆ=ðàæ÷Ÿ‘øÜÏ•ä
=X}§^ÍóâÓÌ:Ë;}ß %[µ, ýÉЛ>µÞܱ^4AXç%ä#¬wÛ±W:eÅNã¥S¶SÈ“H f÷ÖϦŠKuP ·}.óF!Ö§•"k¯“/ ågö«ÉФÁ ê2³Õ°"Ý ÝkÇÃñJ @@ -13510,280 +13903,355 @@ g~nM"up^ÅÃÓíÓêè” ,{!5ÿ8¿UËn Ðú‡ä9¬PjK¢!zóÙ!ñHaŸ´Þãïÿ¼£êOß,?€úVÐz¾’¢Œ¤ñ¸gTW-Š«XÑèƒðN¨PÊ94X}chAc~‡ ^ÅûI8Y½-°Ji ¾á.˜<®¯ÇIâšo,¦ÙNì¥#ÊͽÊûÊàùk¤lùnýh2³ÒþÝu< Aíâ$FŒþ¦ÏD!þ:ƒêj%FDõŠ‚QúPÀ„´èÖ#מbG¡³°ï\ùe%mËf›‘g'CÕ䦨 Ñ)Ê $‰‡x`A%*›H« ¶#Ì'å;…p‘ûÚ9ß/iÔ¤ N…ï #‰yà E×Óz˜8ƒÄÛ¼êpXe€N®Ñ †µ§r%ç˜û7¯¼Çé&ï`Foùª’׬ó›}tW™ë',4Ó‘õÊ™‘8‘ À`Z*\-šðú[Ü‚JåÕ®{i!Ux„T
û•ˆ ¼‘‡ômÙ85û)îÛ¼e¢ý¾KµÔÌ;¨žè{ÜÈ¡¾è{´Ñe¼Žò»~!–±l ˜×R¡^n`žTG?ÂŽÎCMž—û[©s¬ ;ZWÀá¤ì`±3iSw-iUÉCW ÚVâ>xj„E‹ŒwêIo³}‚üH—ã Örú ãkÑnT‚e¿S< ¢x
K»«- 1 …‹54ËÆa«÷-ÕÜ@ÚUóªîÐsL/}8ÀѶ›Ñl¡ò‰ó9È+ß©O¹È¨qD‹£RKˆ7hëÀûÚë,l³Ž[‹x³#‹³ÆÒ4 -¶ÿÚ®½–ZJS•ñ~´õÓp+S!¨yWC6Æjy.Lä“X 5 ^g˜Â£˜ýÿòƒüÿþŸ°°š9»B Ìœí}œ.®ç?þ€‡ü¿ +¶ÿÚ®½–ZJS•ñ~´õÓp+S!¨yWC6Æjy.Lä“X 5 ^g˜Â£˜ýÿòƒüÿþŸ°°š9»B Ìœí}œ.®ç?þ€‡ü¿ endobj -1361 0 obj << +1379 0 obj << /Type /Font /Subtype /Type1 -/Encoding 2737 0 R +/Encoding 2807 0 R /FirstChar 2 /LastChar 151 -/Widths 2744 0 R -/BaseFont /ZVQCAF+NimbusSanL-Regu -/FontDescriptor 1359 0 R +/Widths 2812 0 R +/BaseFont /VAVHZL+NimbusSanL-Regu +/FontDescriptor 1377 0 R >> endobj -1359 0 obj << +1377 0 obj << /Ascent 712 /CapHeight 712 /Descent -213 -/FontName /ZVQCAF+NimbusSanL-Regu +/FontName /VAVHZL+NimbusSanL-Regu /ItalicAngle 0 /StemV 85 /XHeight 523 /FontBBox [-174 -285 1001 953] /Flags 4 /CharSet (/fi/quoteright/parenleft/parenright/comma/hyphen/period/slash/zero/one/two/three/five/seven/eight/nine/semicolon/A/B/C/D/E/F/G/H/I/L/M/N/O/P/R/S/T/U/W/Y/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/quotedblright/endash/emdash) -/FontFile 1360 0 R +/FontFile 1378 0 R >> endobj -2744 0 obj +2812 0 obj [500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 222 333 333 0 0 278 333 278 278 556 556 556 556 0 556 0 556 556 556 0 278 0 0 0 0 0 667 667 722 722 667 611 778 722 278 0 0 556 833 722 778 667 0 722 667 611 722 0 944 0 667 0 0 0 0 0 0 222 556 556 500 556 556 278 556 556 222 222 500 222 833 556 556 556 556 333 500 278 556 500 722 500 500 500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 333 0 556 1000 ] endobj -1320 0 obj << +1352 0 obj << +/Length1 771 +/Length2 1151 +/Length3 532 +/Length 1713 +/Filter /FlateDecode +>> +stream +xÚíRiTSבª¡¬2©¤j=,Œ‚4ÆPÀ0"FÑ„I‰¹7ä–ä^z¹¤ "T¨Ê²ˆ.EE©°ªÔ¥–X…p""<ÂòùªUpz¬««ôç{¿Þzçü9ûÛßÙû;ßÙ ·Sã1Ž‘Lˆ AT*8€:s84#ˆ@$ŠcÁ +H ð+uÀ]8|!o™Ç§1@žj Ðd5 <‚<'H| Ò"ªT`@ª Õˆ–ª¡Th€ W¢i`‘FÖMÜHë4„HG`
‚ +-ª1üÁÀµ©:!€‡›JFÞŠ“"0ªÓNÍJH…UŠ°d
˜Ðrgù[ M£zŽ@I¥¨š4dG0xªÊ¿I ì`ñšy¬× _;™ŒP )7¤"€ó'{2†þŒ)“Tâ8,¢ˆÔ~wJ˜Ò,Sâ0Š%.Ï(Ba QCDE< ƒ=@ô”b6 ÃIê + œÉ*œ Mü«7°5HZÚúàvòÄìQîM`Z` ®Ïd.ã&—Gµâ,÷| 'û/D¥Ž Œœ Ê w± +¥<E=¢¤™oâJߟî;½½&'¤ªó˜gÚ|ã‘íç·2ú²†z}®?Ë‘~wÜæø)zÜ¡d8ü6¬âõÑO‹²L™2ö¶ G“½‹gÅ~ÙŒ‡Ê¡øÄi—ËÚZ?Ð ÜqϼВÚèõð÷gwÓÏÛÖºñ+éÃÓknÝ|õ$'eSGŸÙîkØ}°„–PvfÕ^$êŸw‹®Ž?Å«psõå¹ñûŸ9¿6Ó[ït§Ü¶7 + +ˤ67Œ~/gq<õªþt e¡9¦T°R&œ9ßûzT¹X}èçfŒñon +—þ6s ËS0àf|¿[’—]-‰ ™w¬ÂIY3OãZM·Fê[×·hý±‹ù–úµyN)õ\¿b(µq/c]ÒØ+Æï‹vNšðâEïó7…ô–‡ÊL7+×Ó¢½|¤{x
y¶sè¶×¾0¹Å*Ô_Ý#Ea½v+ +Û´?ôg5JAŒàF®ËÍ£_¸›¹´ûÂ1í¾ò¥ë½¾m2í‰Ñ[ b/aŸôW>ú×¥–ÂÜDqP\oÒYù-¯Ëµ
ª‚kó§'˜šÄâªEM3ñžÀ¹nþÎó}g;ˆâ-r Þe¾Ø/z >—åÄ [p\è}°û¥ïàÏ%‘¦Æá#Þ rl·ÌKÙÅz _šéó›ÍùðÚ$C§OíIÓs–ìƒåY̵ûRŽ×„×l× fí=&¨Ù”g{*júAUF:ðMÏ–z¶16\©}L:E¼¨Lb±g[Z1³œËLçž]³çŸüºÛÿȺCÕ™»7=||kù‚ hB»þž=5äó’œ7[GzBuvŽ!MíqfìÞ1ã ûPÁÀ–s‡ uî~1ß,öo¡×]øÇ芵L®£JžÉÑÄzX÷3àæJm v±\T${˜]MRçï%O]1Ssjáv1É8üêdUI;Çҳ┷¹j´RˆÉKNk–ZM»3}ôI‰«å±ùàµ0~Cù.8àvEÄú‘Šq¿»]ãº\ç+à ¿žY&UIßÄÉö&ÍUeôs2šºJç9”냘 [ϬÉü’ûÕéÂÆÍVsˆÕ’ø;kuûöëÎWâìµÐ–hžûühLGžÍûÙ+éôÏ°ÂÅu£úýua¥–¾£;/eD~˜oºëåZRòÚ:6ªn°Ýº,þ0WèÔ¨l¬/Üs±²Øþ“(MQ*ÏS¶ÝNܲrHZ×pb·Ýè:«¸kv~óŒù;7ÿâòxIº¬âëõþçùyéQçļ¾€Yß»/,R“pböÉÁ¢êƒÉ÷Bz²žüðüžmðÈ¢'Ñgù/,êÞ3>åÅ’¡+¢[{µ]š¦êÒü=ÒÙ5NÞ u8Ü~ExÍÁow{q;ﳶ1úòåë¸SK]¾5$AÁÝ…B[VeÀØ‘<Ø~uo£S[ +(5ˆ‚ q‚H¡ýN4Œ®endstream +endobj +1353 0 obj << +/Type /Font +/Subtype /Type1 +/Encoding 2813 0 R +/FirstChar 60 +/LastChar 62 +/Widths 2814 0 R +/BaseFont /DFOXTY+CMMI10 +/FontDescriptor 1351 0 R +>> endobj +1351 0 obj << +/Ascent 694 +/CapHeight 683 +/Descent -194 +/FontName /DFOXTY+CMMI10 +/ItalicAngle -14.04 +/StemV 72 +/XHeight 431 +/FontBBox [-32 -250 1048 750] +/Flags 4 +/CharSet (/less/greater) +/FontFile 1352 0 R +>> endobj +2814 0 obj +[778 0 778 ] +endobj +2813 0 obj << +/Type /Encoding +/Differences [ 0 /.notdef 60/less 61/.notdef 62/greater 63/.notdef] +>> endobj +1335 0 obj << /Length1 1624 -/Length2 9769 +/Length2 11252 /Length3 532 -/Length 10633 +/Length 12119 /Filter /FlateDecode >> stream -xÚíveP\í–.î xÒ¸Kã.ÁÝ -T!æ®.*PGe¶7P{K5s{ààÅ £“rƒ`¨£4è-Ò` -bH©©(¨ÊåTu -…=»0þϺÌþïkò¿¡Åÿ–ÿ[Úû¿kî¿öè¿\âÿí}þWjYW{{UÃó -PüÙ3€?‹æ+øÿ²9@ì=ÿ«UÔÿ é ²Å` çrH:Z?·„
ÈÅÎù·â" ñ -Š,ÿÝnýKSýy`ÚžN`Àÿq£§µüÏà ž7o - Ÿv==noŸIÐßÈËKÄDÔŸf1ù'ALа™°y¾ù}ï4(Y—
ôUrüBpSû -Äâog;ðµ[¬;QŠˆŒ¯Ûwîó=Ö¯ ¼`ó¼W¯åçL¾q3>ÅW‡èS{àVýd‹&ï•Ï<—ÏÔ=7D|Ãý ¬ZTô0 èÿ”¨ŸÇUÓ©äó{š±Ý®$&“vÙ|G~ðy›VØ\™+ -Í1ÆŒCïÈ`"&¿g!¦¬¢5º vIN§¶L/òëñ‰S£MÀËTpÛ.KŒ…¾þÚÒN‰ µ§g CèÆåa€hFظ´GôÆJ#Ô8VZõ»tHÉÚ8Eq”B×…‰¢uæI-?msÙrP™–v)Ú·Ð4v<Š½úš×t¯(æôuƒœ;0®¬R ºkIãcŠg‹euÁ–'¨'QÉn§·º>š‰A«Ãö?‚¥/ö‹ìÞÖ¼¶VOl\š6óšƒó345ÅškniP1 ‡Úž¯g~zysJ´ ¤–æOWñ² H“-À !º “rá<”LyáD—Fo•€ ݲçÞbùÂKê[H±3JÊüògŠpcêÖZÂÍឨª¸’Þ ¤íoÕKŠU¢s›Ñ—¸IßíÔá5½0ßç -’Q(øf´ÕÆv» Îîócqà25•:Hø8™ïd‘_¡Ý’ö¿ˆd¯,Š!*éïÈ?ºf›]æU -cíÙÐââD <%d)‘Y€äû#TG™z‡7[¦3BV‡•Dßµi%³M‘›á -ê»WosDV hHd¯ãå¿~òôÛ ¦¿üíKýت@Î5¤Š¼ -—±wOhW]k(òW¬õëÞÝÞX!Þ]?sÀ&yh7v¡¹×Ÿ˜‰á<Ä$½AÍŸBŒí8»©ÒÍ%ýDûÝIÃ%®¢x!EÐ:¸ çB«eVc^*mÔOþBÁs
:òµ ˆVžÍ<Šfs=Q‹•]Ò8mÊ~)„Ò…ß<òY§ ó‘˜ -„í€ÎÑ—ð€\&.Mý˜ØÝ»ôÚ¦„é¼¥&lÕ,,8Õº£Qr…™ª&¼œÞ3ô'6ZÝm¿Ä÷ošý—>tÚ{º*¶]¯dh•Þ -Pâf1|Ô݇çå;Úd{$ƒ×FêY̖ѤÁÚL›¼.g“J{Ä!Æ@ýM1¬û~k÷Ë˪s'1ú㑽ټbÒZRåMýž… •j—Z;Õ¬N>ÈS÷Õ$Úº/”Oï~|EÐ1†± fñiå·tKÈkâ%UÓâ,“ä@ÆreÝá$„H‘ç„+mäOʦêmÁ0¸0W
IôLÛÐ븫™ÜÔ0¤÷ÕíE(Ÿµ¶¨ì,:wQØé¾¼¿]ÚD¨Ô3Îz²œÖ¯æQæ\ -Œ¡Žb¤I÷ûz¢ è4ñ -×Å>zÙ/=Ü›m an¬3m WÎ…ªKd;8±¹Ž“ ~ÛÖzåXkNëþ5 ,±u«°<F‚ƒÀÓðíGqOZù²ÙØc9•xrL¿d'Ë«Áv»;»n}C|×`-Õ‡U\ïñŠÆLÿìHíbô°²ƒ‹¢c¶¦¸xsñi«GB72û¼âW`c컦éÇp¤˜RMÆ… ´ 4)äTIrûŸcÈ‘¢¦]ç|QG®««{y-CøMózã±(™ho'>Äž“
,'8Ь ›áµßaÀ ¤Ò]ˆc·_e–K¤ÓdS~z˜Àl2 Sù´©ëÓ 4•nThS(²loŸ®´fSYSÀ:¢{e„©–lÇâ¡éÍ ýˆîõ †ž–‡<H¿sºñ½UÙ§:ø°¾"¥q~I ÌM ±¾»-§âB2³clJ[/ Ü¥SN|<Thk©?áDÍ)ÂÓ}™+„|(“e]ß<ñ0iu+Ö%nϳUÎzÿãS‰#yă]weÂdêk <÷ìö›_ò¿ñZ:
U¢–ႦyfÝN݇ŽT:Ó@ƒøYš‡—{ÝŸ—ÚB èÙ~³Mc -Z:•¾LçlçDUr"´2Uú…癉{JÖvEãÖã¦Çõ ûDÃD„ …ÔOŠ9ÄÎX\ç.–6 ÝŽôþÝ
äüR8¹’ð½c -ôõ¸¥)•3Øß{•ÈñªwÏ·¼ƒ‘Ïþ»õ’ÑzÏ“
¬e†?Ó³:›Šãír s èÓáæ- º«¹¾0Ó§±ÙÙa^Êä„òˆ7ÜU·FCò ðbŠj }ﻺd.·#BWhô¼œŠYÅetäPÓœ®çí#+¥—C™Ó%ºÒ6&‰ Cn°Ñ|;)oòÕo vf*#J‡ŽÃ'´f„D‰HÖd?¢PµUb ê9&ó ªüJÎ)Œ6kù6jħء"’džmC–(#©™$cŠ“ecPµ«—¢}c0‰õÕ$ÎÏujeF¶Šä \ÛÏ—ùÂc×*ý -ýîë£ôSG$7ZB‹• ·µ§ç´’%ëêDŠ!¦¤+Ž¨P^à' à -^+êÃP[FñKrùÔÑôÕp‚ªà/—ÀËtH 0Nòëù¯òñm‹”siÐüLcie:®”^¯ áS;Sõ/ôªÑ™ -ÖûJ!x;ïRÛÍ.É«™Œ”©$CBu%’`’X¥Ç„¾hvü<LµÁiµbÊIï1ãìC ¤éDely‘r÷y‹F¹k `ÊU]®TÜ}#§Ún%<DôÐ?<N”ý£}œ+‚ þõ ‘ó÷°»ûGèë´Kªp®FeþF±R[¦þ#C·t ´A<·ƒ´¢ =3Ëï—^h£á%C-Y*½ô"ÑÞ¥±ú¢ò;ãˆÀÉvX9ÍØÖ!¿Ü$ží—½qbÕš9y3ˆ7±s0”ÈiH&zqÜ?·ï)òŠ ÛX§y÷áœ5‡æ‹?ÌD@üw‹CG¿æ@…€?¥òëÕÔT¾-
º
Š»¸¬_T+ÉùÈH)=åV„ ñbcg„¶&Ä“œ
7HÞ¢…_B4YÕ)¿â·ô: ªßöÈ6”4øÐ-˜¿vÕUvMGk?0vï¦F4Ñ—‚ÃrL óÍw¦¤ &˜hƒªØ R²X"
NÞPe&YLʱÖǼðˆ#I¸YžU¢ºŠpHz3\'ÇêZ:‡òd~QF…vy°*ößÿ 0åRˆ¸äM ¥Ôµ¨v6 ÁÞBý…æª Bmp9%u±ÏnŠ<yc&ä@³×ÞuŸ¬%%Ðñö—'þý S”ÅbÄÉм„p´`ÁD夘æÕx÷Â^Ã;„‚é}¯‘˜>¸íW*‹]M½.¹$'戄M…y¸"X˜Ûèù(0ªu¶v ˜ëù1{¦/›[
Wղ󜯷å9þ&¶ÌiS >÷O\Ô÷¶M…Q}füFJå
„÷áÅ¢puÑ5);B&çëÎT¼ 5°ñÈiþ±nе`[/qsÙÑqµßt¶xªÀÂ€Ê ¦y¹ÒÚšI§.צó2 î 4¦ì°¸á¼µžlߟe¼|ët Ý07l[oÙ·QåÈ¡óãÅk¤k¸ÌfývUî]h$]¦Y5\œ¾iNBy›…vÊ G²…tæI¹:¡Ê)j§ 7½Í¬ØË2ñ'‹ÐÏ%ŠxOÃì4ïÓðÜ!ÍŽ‚d÷l¬Ñâ&ÜÎÌNÐ
CT$Î,?oªr•À¨›oš0¾N‡ø^ áŒ)~ù€ò'S²ˆ\ѯúÞ\j—`ÚõEú1·lñKp?JÆÈŸ›È:¯ÊötãWÍ löBÍßň.䋈OÕ¢ 5‰Ä«¥º5̲ùÁ L4r·ýÁÔŠßL lƒ“T¸ï1wùFWÃÅ(¤û ×pcö§Xè¾p,ÌØG JÁÐfûÜUM©9›îtzÌC#4Ýy?à|ÿöù‹¨S§‘¤a˜ŽåÊ -£4+@bÂ_`±:Þï¯dÞÎ8/ë†xcJ œ†I™žëµv°¶‰!ÞOðˆVñúajB³Ð÷r‚&ó F¦ìô0Iî3ë/6°÷¥ñ,y0&¹>jxSñú_7úXêáõóä~„ÁÂD§°BsëN¢·p4
ñzãöRe©ŠÈΧD7áG÷ˆ!©K² b‚Ú} RŒŠê|v¨]£¿HšR¿z«]åjdmÎN|ïÌ$ Ž>¸¬ êš&Q4ÑV%_øv0:ÐÀäÐÎ>¹¤5Çà“ŒŒ}ŸU;™ ìŽc9”_=¾1õŒWŽá©ƒ¥™¡›ŠJŸÚèÍÚ Æüæw@üøš'þ–º#Fñ”9'$Û
IÙ€drÍ݉aáuY†M¡tsj&Kz§XU€]ü‡õê4¨Øûà&„Ûàø¸u>J",ÚÈB…÷U»•næ;$l„˜Š'Ãxh‹Ž^#A -vi´×®Ø®(OÁή<'ð&öç¶Åý·ßã¾4câ¤é¯èD;ˆÒ$#¶ïCü^¸(÷´À{KÅš·JPw1®;‚744Ú·Î7FŒæêÒÔáðêÈ$šWFÕïæ„ÄXâ×á2xÏ×™²°.ÚYØqø 2?Ç C©K%> ¡—:€KÄò Ï›\׌I6ìúex“s/°±}zsÜn‘¸%=Ði–‘ð:[ë·^aQ”Šd0¡D1šØLA€LÃäq“¾qö»Úþn ˆ „ZIDd”¨ù†èª1RXHVtà˜4ã kÐû
‘ú´÷ÅQßÉÌKè¬(FOªü˜#P#ÎBÇ›ŒU"Ëìë¼D>êE›ëþšÎ"A’gAˆÏÍy:–ËÚê^ÔMdm&rS î Àoda. ”í)½&ž˜Q6`¬0ÏôLÐîÀZº ›vdãÂZÈ‹ä%1üå-cÒ¹žâ÷=SÉ4B*Ç‘Lä/Žý¤ßwʪíú5J›úŠ›Ýñ J£¤Ž.ÖGîn vr^ä¾3ï`Uººž µ@ …6.Ì”$4}ßÂba7ÌÛ™Æà¬4
ž%ó÷7Þã, Î[Òüë$' <t0¶ä‘ˆŒŠ×BNuíéD&qgµ¯9Xû÷÷ÖŒE¬l&«ùÛL_SòŒÆƒ./ýJ=‰Å~êó5Éá}|;s~àÔš†óÓÑ]+VÔB |~†óZT»æçq4ŠÖØ"ûeÖ¤s'm¼Ù`룿õÅPh7¾ Y‘>!H«“oà~d ™øóóiÁM†*æ0‡Ä/öR¼M\”ÔÖ:š^_•¿áS‡[~èžÚXò/Pûq ú×U;“_UWÆ,Ù8*ݬ±¼–C·§·ôÝQj¸ø¢ò°|šœùa£dHÖ4ã} -Ä8ü.)>³"äŒãÇë]°¤ºÜˆÁœ,:x3RÑù{J]J¬åôMÐÖm7 -\§mG‹ŒDO¬äI<3Œúó§´°_«6Ï<k…TÞ+"tª.¼ïyÈa´…ž ’Žâï*…æ|)!®M2heùÜÒâ¢Hxþëýs8Þ8(ÿêfÖ]zvf“Œ4…Lëáç¶;q -R`«å¾V®xÙ0*¡{òeñ Á5®a±ß*[‡àñ3ûo»( ´–°ùJ1NÙ‰ -žØ=å1žâX™eïÉÇ©Õä¤<\½Ú'N•44Eíe6)Ý(î8pù ß{½ÙÏI8*ï¡Ý2ŸKÚ>£<ô ù’iVªøÙf ý9÷“Tâj¤¥]†ôBøÓõöa"unáQaÝ,«v”FÝÑûÃ)'Ñ£»æ[¤$ëêj€ÞFuÙ¡>dò–M×~Ÿõ½Bœ–™k½®èMƒGµ -‰ÃG”0µé éØЀBBV…BZ_Âë /m9Lú‚ßkˆÏ–œ2}Â) :ª2}2jUd^=èΨoDÒœ6š_›ÊXÒÞÜêÚÐÓx¢šÌn M¢Á+ª[ÍäŽî$9Jœ )o¥ÇH÷“q\£³œ‡_žÝÛg -,^?yŽÁI×Ïú\³ì'´A›C4îs_çj%Râ „*ß ã£3ëúµ|”²Œ$ßÔ•¦9yóY½7-áB”[—^çÎv5u$®MžÚ E¢ˆârBvŒt2 jLArôvCÒìzAŸON¿_ä‡t©Ï°Ò‹šâ=Êíµ"ËŸÞÜîár–ý%*<#ö¡îˆ¼'!éJ Y^GjŽÞ`¢ !’+”¸yx,å„èò1ý=,ö@Pí€*þÈÛ -ÓL=M{*ä)qÒ( iI"\ÄuSý 6[þËÕ¨±Ób¦eˆ
UγÔnºÅÂÑB4:èuDé…$“dtevö0¸¸ÑéÕÑg¶³ ¼¥NN2îƒi@6 ´š<-Ótfù·@Èjã¬Í ׸>Ïš/|YMV©Mù¯Ta"cw,\†êÔþõÞ* ˜÷Ý~U¢Ò’Žr{ ^ý·U™”ã6ÄÕÉ ©ÞE\5$¥fX²A…aíÁr³>zgé¹Ù¬u=ñ¦Ó=_ˆíÙHÏ@ÚãË]Ý»žmD ©IŸ<¬æ—©J¦k w˜ã¤Ç:½—ƒÚ•ÊŠµŽè8ÕmT)-‡9Y¡¾:ä–Ç!øŒk£YwŸ=âd|æêDÇ.±hìÍä4Îb¹Ô2:HH3buì•fïMwKµ®õ-ãY^ -é2£äª.WÁP¸kSÞI!ÜÊ¨Ô -#çtûui˜"Çî½ÝSk·×éS?€+xû)dQ d‘uä+Û!f.D¬Ö ».œ©’u0ôU0â±6$5‹¢&&ãæÛ±¯AÙfsDŒ)d ?Óܧâ¢Òæ8LmGpÛŸxºË6ÇiÇ(¾7<t§êõ·óRÏ -/$]näû?J$ÔÛÞmö!’Ÿ&ð²P‘c§e“[v $Â)+»NNçérÖuÓ_®…Í@+²H¶_÷÷»Rfžhãs“^Bj˜wrˆ€[‡–í ª%ñuƒ4Ü»Fì«¡lñ,Ö±JL¹ì¦Ç2áÂͨŒñ}WŸ$î'`47 ‡vP]චÁp ì í°iô]ˆ0W -El‹RŸ KRÁ—&ù$JSü4Ÿ–F…×Á™Ù®8·`ðLïÀå "i½ihDÈG4¼K»ÙT2þ D§Œ©ž}s<µÇHzÊ<WÓèÃÖ Öf¼TãI½ÔqßrPµSTn\´ Ž?3 p¡àNØþdÀ¡=Ž³-7J> 4Ú[PšyjÈ |ý¹ñöàxÊ;/8{!£…gÇœ³"ÐóØ‚öW6¦¹ÀÞJb%°`ˆ&»x`w{A¯šlvŒ‹‚RRí–[Û`U)(—A1ܹ—“waræ4ëÀÙ`Vm§²ý¾9§¬ü–éå¢ I—ÆfU}s )O5<Ž ¡ì -Š–Õ¦IsÉ|³±jã¸yª7Ÿœ7‰a ²CTx»+ß¹ÓÀUF\÷ -/qZƒ(ï¿UbfG\}Â)¶jo -iRŸ*"ß‘Ö_ Hþ¬2X³EDµFÞo[]ù¼ æP.×ÀC³JOQ1pßŠ× ?NU3öŽº¿N‡JHÓN»›ºVk4rDQ¬á×›GO–ËOœrJòíp@rw;tzjgùZ¶ Ô là/^eœY{è§F¤‡Äåì}»ªßØ“äVEP»ãÊ „‚i"û‚o6%‡•‹ýšý¡Ì-”fÛ¹òœiekAö8UË“ç–¯69ï¿Ë'AÚøg¿.:»œÈnéñb -¬œ6¥á7Â…Ç*WÅ DA‘
djj n {3=˜³ntœ.a°ÀxDúKw1 HPÅÚI§wò;áŠS$-íG²$ñþÀí%RѵìÜäi -½T/>V‡™»Eº ãÁ¦–ÓjÐAúî²ðÙÈ ¯ –Q^^ŒŒMJŸ9Ö¹X -?âf,œÿ4“áÈE’3i‚è;++ÞˆÛ—p °tl1/JŒBnbbÛ ÁÚ¥¬*<½Lc¿üA‚ú éjô G…» +xÚíxePœë¶& ¸Ú¸;Á‚[p—à4Ð85 îîîîNpwwww A‡½Ïœ{n¹¿æÞ_SÓUÝõ½ëYëYú®ª¯©È”T™DLl@’¶`3+ @ÁÂÆÈÉQÞ,Ç$jkm¢hdmx>!QQ‰9€€ [°8âh‚L + fkçê`afЪ«hÒ100þKò— +ÀÈõŸÈ›¥£…@ýöà ²¶µ³!oÿ׆ª +_ +0™"±(ØBÞ\hÿïºÌü?×äÿÿ4ø¤½ÿ½æþ{þÓ%þïÞ秖t²¶V +¤/k`T\§§‹íÝ@€]QZ~®w¥m§Wrðo™áSU +ºî\ÌUêVn†]_ý"Ô”cÍp÷ó¹uXm.VÝÍQeýÂ'xâ_ ç¿é¼)œs½q(ïìÐ<“j£pÛ0ê¡°ªóŽŽ©ã~ßÑô
ôw^Âuï2dF!R}v†E¥ó¶Ï$ÒV/s¡” ÁDÖùE¾ìŽêâÌ MºÌ©œ}‹9YBb]™ºý^C÷§"mÇá
åPÛ{ö»XPð´Ó1ðegçB˜ú”žpDØj]Éy&W¢…>* *g›çL·V醤¯‡¬oöÓŸz ƒ—•å4Lm¯`o¼.W¯9ú|ÞÊ †¿Ñv. ©Ô¼~íkLMÀWrôêk¦ÈiÂ~©ŒK© Kíw¢ ÏŸŠ ŸÇ}½^ã¿æ²—BÔ«¸<_g-wªðÄ ·ì ŸC RkÞµTå³u‘£»ÒéðŸðˆ«)unG%E="Ó)“%KÜ_½‹¹„È& %*9, …’Ö¶v£†íkEà8³»haøâ4-ï㊚*êFŠ+̈”®•„I÷\é˘eœÕss×·”¯ø•«ª•!´¦2cí7Ôaý¦"!šÿªáçÐ…tgšòî¹·þc|LDÉ\‰¤ÈäìýYX’sÈùƒÆwe•x¿µëSñ«ƒb+½:’3¥”ª¦åiC·IA(Om”9ž_-í•òÚÁ¶–— žþœã®°‘‹s§É»™x§J¢àÞ‰9² úŠ$cÙQ¥R›Æa†·îk5Árk (q€O^XÉ# +Ö%o¯ÇRé «Ž*í÷ÛŒþØ©§TZ" žÓr‚¸ÌñÑ~÷FËO,£àBŽ¯ýÐ=ê±+¯×ïˆhÓ”‘ô2š$ÞæJ•œE¥ œÉ˜ ®‡‰ z<ÒX?w’¥n°@2øÛ,g7wå‘N è3 ™ëýmäƒS ¯yèøN½¢Ø¯K>™G +D<ð±ý.¤ÐÐ2Ž)—Ä =Z%W\tõ߮ +¸y´á+û8pÚÇf$J ?®&NÌÌTü%þ<Ä
–0&uÿ [?æËJÜ®'ý +¾®¿BD™¸?7””O™¢×4¾CEsqa¨¹¡
y³äÙµ±¯ÖÀ¤+½öûSøˆÑ&3¼ËDl:—´s•n wùƒOYeÞþ·/¾RB#cŒÑ˜àc×¹Ç\ .ÞM J)ª6¥ +âë_G€ãü4 _ëN9£û‘@§4@d^Òq·Í݉Å*ƒÊã(·_–-ùâǥʃbÐÄ»@e ÷ÂÊ6â]aî{#õ¸ ‡eà%pû}M¢'þQ]Ö @YålY š• ÏÏÕ†„vBF^ù+º“1m§Ç$"Ú0Ñ?L«Ú
+é IƒóÍÇ)Õ²ÁÆs}ü¿ + +Ðõpe¢°®Ij8¦YnU –é…Ψêk=<ñ¶r¼cô:¦ñïÎÑ3~eâ|@—‹‹{ %k,ŸÙ—ÅÀbmI
ùÅýH +¡b¥XíÜ®[këîr‘Yê¡Ú«A(üÚ“¿4¸ ŠÞU—Ì>ä°,ò3M|xòã
Tô7Á–tu`Ã71 '3¢1}ãA/±¶æÚ+]Ÿ¿%âÅ]w>’Dúg9ͧ¢xF3<¯!F˜ ¬\ì:É æË{,â–Ù¿¶m—2¨˜y‹,‹gëŸÉ‰mUR‚ìíåÄON‚vyÆ°CÑ¥˜GÕ+Æ`vVÂÚ)ê4s¤‚”ò#æ͸1‰ r/™ßIò²Nh Øo ú!uçÚÊÏ~ ¯1Œ7ˆk9 ÙÃ5 SªþáiÖžW¦±ìÚ<!ŒóåIq)¨Úßéà |•Í‡|Ì+ƒB§’É )[‹8YåÑ´VoÄ×° n–èͲp% ¬†Ço„X‚ÕÅ•§ÂU«rʪ F¦ FŽ—·Ýé,öü
ü+žxMœÐy”É
<æ$rʨ\ zC +Ç»p°cc46Os–WóY½Üøù dT‰Éþ²†ÇÛl;eùý éÓ'd8WYèö„34W®ª/ð̦÷õÃÐM£—УXßC¬Ýœ1»Gül°ª£Xæo¤`Áª+ë"»ìYX…{Öß08røú 6¶ÆÚ-M"(’Ì`ê¸:Aá +¿ëg†ó(ÄzZM>$甃Õ*/œ_˜Çk»üs> sàráÛü.$Ûr~@4rÛtÑfîð¿¿äbNþœ©zEðlø¢7‹)õ ¸¨¬¹‘Nåül¤:Kb˜ôÉ‹ÍÆòÕÊÄ«_ðA”%3ãáº* ȇ¹H0oO혙±}¿Nv‘;3’6Ñ7ˆ ò«#úBÅ®Õh ÄH‡)¤@r†sóz±]$Wy“ù¹{?á¦ÎƒæÒKÐSÃbª´+оR€$ÕÇ\e¶W¹go)Ú“Yµãš´7ç›qâ#I…ñU:'.r@ù
õ¼hšGRŽWy@é2 AT +ΨáíÚÓ+b7Ð k8B½4ÕE7$ Ji *”ŸAQ@k—ÇÎR·©ê Qœã”=ÁÛD=who7U î{>Äe'¾oõß¹,tÕ¯¶r!Ç—ÈÒ‡š€öíÆäÞ¦4¢C~¶Hí}NYù†?H $§ _”!‰YzVÄàJDžãËlnË‹ý’Úë1ŽP~ÔÆž|½¢ñˆ);R¦¯žÅgÙ1F†”þÞŒS8À ;Y²›˜áܾó”d¹š£p æÙ¾ê<rò,2³¡xB‹¾àÔؤ zäïÛÎ;àÍk~>Ç]"Å…›þ¦îj=ûp- +Ä9݈ [lÄgaœs6øßwï
ظY“AóŠbÜ´Ú‡F™,èÔǧÁfvX°Ô‚IX÷åc?ËïA eÉ—« +° Æ›Á#âÚöÇM r|ÑgøZæ}u³(£AñS„J؇1N•RÆMö9 ÝVyðL×£]²šòÃO³5ÕÉô@µ¸vÓùú×x|ÕgÐåŒt
¤^õÞ‰¸A6(¤ïâ¡Tê#ØEq ðIÕTÅ¢2{HÉ*± +Ýhâø¯H¤ÅÈ)–“âÊ Šñ# + Û¬´–äx¾w®›ª-éè‚g•\<%ËÃ~`–/\Õ?¨b‘’õ+öxJ2N½LSèsc“>nmTé2ëìÜ?d]>øÉèâtë;!J~á„)| ´hð€WΖÖISÀÌt:5NÉomÍ9êlo|ý:oJåhY´=î#.Oû¨‡(*/dïÄ’cŒ’Ái£
Í·lM[ËCßóª_ø0Šý¹ÞÛôÊT¬¾ž=ÚäÇϼèP/©O¾†ú +b‹-b“CFgS²‹7rÑuÌ]~Lj:ãÄ”µùII†„{ç„ú®B(EÑëÃ&TžÂd@ñ¯ô½XÃ#¢qÏKžùö–‰„û|-¼ê[¨n_Ø0‘MH»`Ó†ê¢Z. JšÜ…[€©«Ç§BsñB©»>wÝ=$*kƸ¼ „Ö+ãÛmIŒ’pœàõrš¶ ¶Y;5té>¯å5:‘OjQ³
{÷ +?v˜;~Jr^"ìž}0ýª£HZä2=Ô&sËeD¶ |£—øq ïxL\XWÈL'[¢x!µ?ì +ÛHØ™|½,µßzðlVz7¤ûd•Ïx7øóCvß 1YniŠÊÆI³ …y%"ÿ=bÔœ">ÁÀü'=yí¢eã—ÈÈæ”U—D©IZ\pcLiÿc L…´ +lÊ©4Ù@TaÊ ÉvX-còtéÛDÓó—¡S×4‚º¯ …´14Á:÷ ˆÇ6•_û·!ïôèì.ë¼Õ½Ýø"}Én’0èfeT ée„‰"|£:ß?wV°>‰c¬Ç^µÛØ÷PD“‡sŽÒãS²d£«a"ËàŽ°«VIØÒyl-¢Ð¸õ½ëȱÒÈ: sø0Êî° ×ò¸u\ÍM%¸$¼Xi£!?¸„øSâø=žLÌ ª±»»²Œ¤ˆIÅHªÔŽ.ÞâªÁ2;Ý]´ÞU ÜóP†_aô·.Ê…ï·Ådp7Å +k병-.€í9ž¿L&šš ¸£G÷é6?¢†¹^SÀŠMbcÏ 7ó¸ äÎ÷%† +¢Ý+=°„ãðí…>sΡÌÔ‹ãåBgíâï°ëW~“¼{井²TgKW±s]gÄƦ‚Í; â&Yî¸ý s\ñ°î~ÚŽ&yDo·ÐC€Ë’,JKºAÇÇŵr§Q °´åàÞF4tÍ5aFD5^È}ØT‹e!MÛ•K}Ö¤œ_P{ß~197ÿàÚ"“¬^ñá.¡dlˆMqã¼èzïësÒ\Žç%„¬²†}jv ,¦ºD§ b"¥)ìÃÚ; cgÿðjþï=pK0˯ å3
}ÉüË4&“¾®bNfþj QMô½s·Ü!;Wª²ÇwŠÛÔ„ÂFÚAüÉ f£þœ°nÈÓjX’†„-öÓ¤Êk Œ}z¿gËmêon¶ÅsŒ_a½#}AÆßЖWWWW†×‚oš(ùÜu•
©uKË©Kiƒ¹ T28"É…é…¹´án HbØ#Íö~¬ }µ“‰ ŠMÉ*·ÒêÊø3îÖÿŠÐ·ý ?ÞÀR0LA™uHA“eãƒ*£ì“dÊË\YÅ~ô¦º4¿÷Œ«¡ ±OL6›^‘" à©êìΞÞä#Dø‹„l÷Ñ ì6 ÅÔ]_7ºÌ®D¥Ê +_Œßåø_Oáêù0eØPTN¡TàÞµ]wÂX›ö%7-ß2™û•´Ý›×|»ÌÖ%8P
Êß”ú”PŤL×{óû=ªáöù;H4×OÑ5 ¯)
à°”•ß§ÔþÛÇQ¶‹nŒ"ÅZÓ +Ð&`ØlW¼w{oFÝ÷‡=ÁßCò{z©¼'Ö„+!“ÙŠ=RÉo¬Ö˜ÿç …Ë›2w€Ÿþ¢>‹Ó±c“Ū°´™ÇdŸqLCyÓ
…$³¶È=B+Zäü‘ÿ[G’€kÏZJ]faO½òá×ÝúLæc?£nè×”LÚ–´. +ÿž. ד¥’ ÁJ™8ñ*éûº‚Ò§á)v9ÜkŠ™”úîõºô!Ùé^ÞhÂÕ£öcèmà~ (8vfá–=2c˜´…4Š>æ³hõuKéËÅ1,EòB|jiˆ-ú)ħ|1¯é½Æ!Ml&Øñ”ÍONÔ§H[àÈ:eVT”†ACÏÙgîï³É©LÓyn³€CB Km÷¢¥.=kƒ õÐl@Ü¥ã6òïI'ßßýô]”Ãã²ù õÓ•³'¶ ßOótBHäëpÀ‰µšôn +öÏz¡ªÄ€CŒù|®ñ½j÷ã§íÚ¾>©*ýfÀÏŸµd†ñô$ó¯ã
" ¨s ‘‘Tèó÷}(¤Xn¿~}B-±œ ªm|búš`Ôü1XV±ÏžïB{
šúÚ;–7\L`™oƒ +ç„œ8•õýçjÒL_y|9gfˆ®#—Ϫ¾O“ÖøË
¦ü²C+˜cIBÈ °·Y ‹~,†{T“N*e÷çwB¥Š|ÇÆmÂ>B,ô1eQ„¾þ¢ön]…毶úƶ-œ‘ +¥Ìò*<É5ŠÔ7Þ«™ˆÁ_P^wqž§Ä?ËŽaÂœ_ûÔî¿u»wÄFø¨A*õ‹Êe…¡©ðÆhõ}¬—SF‚‡Î +x uãÀ4£C+Ý¥‰?hŠzÑ2AzoÉUÜþx.å3òO ,ÒÚ]˜“* ½]4O¶‡‡H¬Ê¢Ä ÄÕ¶.y“nŒrÐ%¨ê#cúÌóÔu÷mÀüfYì×M,fÑîÙÅì㪆›ý6«ûÛœû‡®÷‰ t29ÈÂЩÝíTg“õ—1›Q)‚¬ýE´q*(ôƒ#€U n?OCkaÙÝ\FÂÇÎX¦èÞ +5³Ï.]Œ>ø¿£, -î\yªbñ…v›ûÛ®-.‘ÚŒ?2< +û)<»Ï-Ìň¸áøÃÇF®¨Vö^ñV% ”š ¶Q‘+`µ@–ü=?®Ø —&òÜ’Ü?XÁT~ _E»Gmx9[P¤€zPžÕd¡ƒãRÏ\OÊcwøh@²¡ áÒ¬-DkO¦=p4)OC²¶
ŠXÓñíUÎd-êóA&Ó…ÝžºÉJ-ú¬ðÆ—5šãuvä…‹FRùIÅ©¨Z7/ƒ„k¦7‘!Tꃵ=Kßò;]d+gO±òâW‰;};ƒ +eïÏùÑ¦È 4Øk’ØÞ±Ô× äÖ¢HH ÝÞ+†¤fÝå¯Íc
–«<}³ö^ñ âi“ó”RÇR×z.©ÙAeJo¿tW 1¶¤ˆaψ¶9ÖK]m(Þ,唘¸?Qw†çÆb°.³û HëZ[îÇN×N¸ÓÏ*W +,éâÌ +ÿ¸ÆfMLhˆ
¶9«žlßgøi>ª¶
„
³"ïG"~D&]4ª³¤n§Bú †É»sŒ^ö.Òt6>M‚kZzH~w`ê VU:wË üG‰úçè
¤½DÓ¯@Î#{Áà—¥…?&z —Ý¥-"—ÕkFQÆvÂ[vYf&»Õv%îGÈ·›óÅ#H¼~æë:‘_$¢U‡<ôÐdØ]Ž7hɾŽ#;E’²:ðãmvÔ +}zÝÎz¿†Arq ˆ{I*_ÛÌ9ŒnO dÆ|jÚzó-Éó-eI‹žmÐæ|»ô¬Š·ÿ kï…rÜÚjö nLR¼ßÔF*8ÈoAõû%‰ý›·ß$RC„:ߘyÁ•›~Û ê…J'ÁÖB#÷^ÏÀ}W)å¼…nšÌ È>åĘj€Bv91†b +– øÁæK7g"‡æ֪ϋÎÏå0öø¨ö="–‹>¦ç*ÑÑ"ö(
½æÊÃ}3“jëëc7{ör1½5YIG`Ñ|á´£ñ±Í=Gâj(ü¥¥
Êe íeƒD5±Î§ùöG{lD•)æ5Ue‹ú2F>±ŽÜ¶aëW!‡MÐÒññdÖ j((ɱ(„‰Ô‰ XžcZÌ®üg¡º®A¿³¹®nË$ýJ˜e¯nØ^¸%ÃHXtH-Á'Ø¥ÐMÈkd¿‹r¥ÅM œŠv^vÙ»Þ°‰TÞÅ°ëá@¯dŸÏê ™e{ž9w¸ŸºÑ2ÌÃ4ÃÜ·Å×*!´Êaó£Dž÷¡|5¥Rõ®4Òa!Lª>]öCGø\Öçôù&V?ð~ÄUÂü19V?îúEìÇ@·€†U;'ªe/í²r3=›&£§7¤òZÖ“þø΢:ÄÉAë+ŠßsÝŸ`wØÁ›"¾ Kínl'¶
Û¥VË §Èí&/„:ïN(wX’Bç6YÜ{Ì#V; „l ú]¡à\O“Z8ó—¤>@%ÂçÎ…ñNŠj,[–ðöžè2ÿZ¥ÀJèe½üNnš0Ç[7·×±¿ÂWü‰J +”7LãH¨žÿmÒtƒüûÔÏÅ.Û`–_Dgç3—Þ¨ÍÜ®®,=P:>ãËt—sÕuL*$Ýs¯¿i¡ÁyÂi®6#9š3}3ôŠ$ÍÜ<>UÇótôf¯œ'HF #ÖÕKw$©ÏbùBeáù([ Ó85=¥†Š£üä +ÖY9Îü`ÉÝ4Á’k;÷¶îæø`ȃ#vÔ5*r>c¢œ¥ö³hòwNkCÅ÷3çé.èÔS©Ã|©ÄõÂ0dAEóÄ\ÍH,vYíÉs_‚ÒÂé>˹fPwË&B;lû…f‹ñÝ6{¸ùíÄ¥¾ÿ ¼Çg\7›-jÿÔ°·†i~>ú™›Îuù6¢ÿ å×r®›-i°ÿçÅhÏp 4u{ýËXnÒEô¨Y†l<Þ«`[Mèø÷MgšŽ]‚½³¼_Kοywø¸ Á÷A´J’T놰§—Nµ™DŽ;f£¿ ØûüP2
y•Xm#±6jÅ;`ÔV_ÚAéÀ i@g>GëÍÌSòK ̶UÐó¤á¨-ReŽM‘Ž\ýè¦)›L¨³ï-šÝI†:» lŸ^>k²“ú¼œ¼Ågä<\F-U:üDˆ‡Úû³qEùÅQæü›¦UBw18„²¥àÉŒ–žyJßÊ +ª²´Æõ÷>Ö눎í•Eâx¹èµäW<X1é ‰þ¬'®†{¥#Óxјt¨LUÒÒŸ3”Ï´„6¹wrøxÍwÃò†¤k²Ä͔׋–è:NÓë¸OKî¤bôÊêFmH¤ã\Œ»Ð€&1nÒ^M<úJiÜC+W˜‡D- 'X,þr¢T ßÛek)}sÊKI‡£à"ç¾›OzÕ¯ +c•|z{Ù†B ¨À‡·íA?̓9¨„&Þ¯žg¯ƒQÞl6 …²t1£ Â[€DÕÙ°| $–,㞸. y j;ˆ O<<¡u«"Vù!C‡ÛÆî7+cÌ.™ ÔHý‡H¯F'®¯lšöÝ) I³…ÕŽ"î…µÄÛ¨¿w ù££ÍŠ(É¥ØKhùŸaP{‹jáÁQ.’OHÔÃñ <ˆìŽ¥>Þ¤0á¸mïÜ„ÏuìTyÃ"›Æ£]C;žëkXÿ› ¤ÿOðÿ±5è endobj -1321 0 obj << +1336 0 obj << /Type /Font /Subtype /Type1 -/Encoding 2737 0 R +/Encoding 2807 0 R /FirstChar 35 /LastChar 122 -/Widths 2745 0 R -/BaseFont /OFGDIJ+NimbusMonL-BoldObli -/FontDescriptor 1319 0 R +/Widths 2815 0 R +/BaseFont /NBERZJ+NimbusMonL-BoldObli +/FontDescriptor 1334 0 R >> endobj -1319 0 obj << +1334 0 obj << /Ascent 624 /CapHeight 552 /Descent -126 -/FontName /OFGDIJ+NimbusMonL-BoldObli +/FontName /NBERZJ+NimbusMonL-BoldObli /ItalicAngle -12 /StemV 103 /XHeight 439 /FontBBox [-61 -278 840 871] /Flags 4 -/CharSet (/numbersign/hyphen/period/slash/A/C/D/I/P/R/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/r/s/t/u/v/w/x/y/z) -/FontFile 1320 0 R +/CharSet (/numbersign/hyphen/period/slash/A/C/D/E/I/K/L/N/P/R/S/T/Y/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/r/s/t/u/v/w/x/y/z) +/FontFile 1335 0 R >> endobj -2745 0 obj -[600 0 0 0 0 0 0 0 0 0 600 600 600 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 600 0 600 600 0 0 0 0 600 0 0 0 0 0 0 600 0 600 0 0 0 0 0 0 0 0 0 0 0 0 0 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 0 600 600 600 600 600 600 600 600 600 ] +2815 0 obj +[600 0 0 0 0 0 0 0 0 0 600 600 600 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 600 0 600 600 600 0 0 0 600 0 600 600 0 600 0 600 0 600 600 600 0 0 0 0 600 0 0 0 0 0 0 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 0 600 600 600 600 600 600 600 600 600 ] endobj -1312 0 obj << +1327 0 obj << /Length1 1630 -/Length2 10888 +/Length2 12198 /Length3 532 -/Length 11760 +/Length 13075 /Filter /FlateDecode >> stream -xÚíteT\ë–mpw÷‚àÜÝÝ-@€ -(\ -www4Xp×àNp×à®yœs»ûö¸¯u÷¯7^±kìo͵撹öGC©¦É"nî` -’q°‡°°³² -° -˜Î K ³¹-ÈÅåæû¯éü³OÀê èèhëùw´Ãß^ÿQâ²µ`EfçxËiyËm ¶GþðײÈÛ[8 -Œ»C]ø¶ti ÓRß÷ Ý…X«´m¼L»A ŒJÑ2uc¼Ïf•ÖaõyØtv7GÕ5ŒJžáÉÆÛ8ÏîÞ»àRß:¢û™¥×Åãµc6¼Ãþöåè˜6ùàî–®oxp ¿ó®{‡„)7 ‰FÐ
6:À)—DT_»Â;’iºv—"®;)ˆmq*ó‚?˜1û5_ÝN[ë’ǯ=×ç³"/LIê}Ä£› k¼¶lBñ«¨¯¾-š|oRkÜó&[Þ&±ÝñreéòDQnßô?ª[K79Ð7/Ù/–_!ýmÛÑŸ ·¥Ê“žHÕ]Çy÷A8\¼ÙŸ.¶h¬æèú†ô“Bj£Öè®{ŽúÈ£÷ öÖt=¿ !æ¢DÚ–¶bO„t8&óïû·ù#¿-L.Ii§¼µ\’îžhRºª®
xïN -®°V -(Š0¢™PÁ´i—µ…½g`
äÒWDWN=%&j c6–K…Á ×M囑êæ>vEÂëÁ |Ž¹Eʯ#«îu€U•ý9å™x¼.dávÈ!ý: 8ò¾€Ù€;pñJ#WT ¢Âª^Û à'áHðmAFr4”,=gK3M¨Ì(R -ª¦S0†¶5§(ƒç•ÒÃòÙ#ÀÀîœj›Ó=âéÈmoßÐ -¸wÛõeä7ÊüÈ‚Wª¤I„ÜGñaquÂŒ†!q”ŠÂ ÓúF›ºNÑvw=É€ˆ
ø?©þ¤ÝÊCÌõ ýß{?~µCâ¤ÝXœì†q&ç1j;¯ãI¢™Ô§U$´ö2s«Q6·oÛ†±Œ•°ëãä'n¢ªÌ( " iÅ ÚPV Ý£BªÎµ qt¸Ö•Ým™Y•d>Ã[¶‰’¿¦ÛV¸‰õ»ë+WÓP¬Å`,kE}±_Ys™° -ä’Þ›«+;Wœ‹ò,ïV‘äîIº9^Ü¡U½0~˜ðâÝ^ ^ñܤOgn}Â]^¿¡%K(îù˜§½ÉõUÙó˜×òÁ -îÑâ §Ó/ÆÔ€P +°-¼ÝyתžVý(/} _#™mѱ¦€*¥f~[ópÏ8V† ÉÑ8ï„$gÿ" N:<3Uwñò›ðžÂp6Ö‚ËI&Rü¬ÜŠÊ“‹pžÓo/8)Ô+~Û Js§\¢öÊlöí»i{UŸÈ»Ã»4´½ÌM_˜š?Å]FÌ©•A·Ö_\"Óƒ‚’Þ}#FG ïK}g|ÿñÌà ë":ŠEù×%ñ’õ.C!+6‹¼R±ˆà!Qê˜_};¼È#Ëö]¿?Ü~d'My*½{·8¿á+ ínßû·/ŸuG«ø0¢ß§ÒÍéÌ–àb“'¥ÿî¤ûm>‚ÿ«?‚´Q õÞ([ºÁfMÛÿŠƒ´–?Â…?¬Žžš.Tùô+ª©ãJ¦eUq8jrÜ … Yp?Á ½Y~H…#úò=*Ïqí·Ï™‚T蓦ò¡E‡üA‚⫘Lm=ÏÊ72Ø÷]‹Õ™+eÉ¥½õ¦ ½=¾¼Eó@•3.¹w¹Gãd“•.Å/‹f\ OFJ$Qó:Ñâ -ýòÃ)8ȉÅ)7è_£Œ·ÆT÷ô壌mMÌœ+¤ -G¦ ©J¨ç$î}0ÿx¯R7ë&K.iË P6RÔ.<,ë㺥1~4XÛ¸¥>÷Æ ètž•>¢Â:Ñ#)á> æk[¾»ïÛ'Îåõž¬Ž"¥à P¼Ê!B5ÿi‹ÒÌÒ÷ÀI¯´æ6‰ïíÚK²j?uFéi‰W!Ü’½ NÒ.TEtmúÖF°tŽ¹.†}-¾ü%`úµÙVîC¢p?VúŽÎëÏ-jû-fÃrÅó$î‹Ï„¬ \AËÇlä¡NÉWô˜, -Ÿ`bêTèÖ6çCÅx+Äèô@›þ`ÙvªlÐTw »J·ô+²ùøp4Tâî]” ðâú>êóXÿfßdO¤Ï£\Ï”H:[PC‹Ä²¡-‰Çó|—ÕÏñÊŸ0ï³iov%§Ž=Æ ‘»ñfLu³$ŒX«Dm|BØxz’‘: ÍDï¾T–[&n'îóšZ) ¶L`z˜÷Î(1ܦ—Éc¥œ˜*`ï3Ÿ+F(ò¿gVà/_JcÄh‡ÛÑ|¢Üm:rGæ-Ãì]07‰±?×›‡ ¶0RK4åÀí+—‚`îŽDÕÐLºÎ’ùˆ9>ñ¯ëwe£ ¯ÓÑ©<Ôº:n;=]7¶cm$Ïjô¨âÉåx¸Õ8>Ãp:'`=2’¬~'¡·:é 'î•üc|±#úvN< -É‹|9 -PÙ·åI,™ËúP5—ã´"ªYžBRÒ!¿Ñ)ÑEï…ÅEUÁO»« Ñ ¾ 0Å)Û»9Q‡‚áT¥áååh°¹íeýè²bOäo¿*Þeº}N5à„M=*,".}º.ØÒ
>Dï7¼¤O¯·Äštéþ"Ìs¾Á%ÞÌø-".#S„ÚOXõNèWÇl„Ò]8T‹0üPÔ}zZÝ^„ð!¦Jr½fî:5…€c6Z¸ãGvÝ~Õ¦ÉþÍOqøÛÃÂÈ5Bl’÷eÆT 5ª–ü€ÜØÖzä€üÛ W–ÎòÏÎBÝî”}]Äè »vµ}V&–h Ô0;5#ÙB탟{ˆ >â‚ éñ¯/bú3 13„;6é:®ƒ"|sjü”;“ã´iK—‰Öcˆ^#kJÚ•üMCG&³
Ú #©Áœ¶}äe-Yò -iÓpn¥ISÖÎ.DŠkÞë‹eªñÔY’ªU -{&p–è°ÌO@¤)ˆ -á(ÉÐ'k‚ï¾}ZuqåÙaÕa àuß+•?®Ò ,ç<Ü¢p)Lå¶c§z7ƒÜÇc®{Öß° UþÝûÁÞ_)Pùîã0Nh_4SÌbÉ- Œ”²:ã%¹îL¯EÑ)ƒªÇ7D.÷{¸>ÈL¾¯“G‰óEZ:|ÇL÷ -ƒÉ/¡ ¤èïiÔò;ÌóêôÿLšUïÑ[læQÎaœ¦Ñ>ñ³G÷™=}!C‡áóoΤ…ÃTD^ê~÷Yñ5l{ž³×(᳓* ŠŸÏgé?»ñ\²Àå'Ç…îñµþ@vǸŒ‡¨óÀ9šæ‚Ã?ŸŸ¾èxŠBœZ÷ö´köö†dqÏ‘"$!ˆ
íxðÿ"` £þmÍÓK›ë.¿ôe|ê:Ÿ†›%u@éœo('_ -¸=Äõ¹Â¨ìW|ÝóúõyÆ壹Œ O<ã–H¦¾kû»TCT•3SQú˜8EŠ9·[Éi{ªðãá²Çäve=§ûïŸ$)e Ù(ïöyï6bU_>`R¨ÿ™2Qt˜çR?=ÝIêbĉ& ¦yÍèZ÷;Ø%U¼å͇⌌àÊ·«6ŠnËLJ˜S2tqŠç+ÚóKÄ0H ûÓ'½ª~ Ï”aLø˜±ºÙ‰l½,£ ;ˆ$ùubq¹ñÝ8cC¨.b /άKÌJáÖR7£¸§ôŵRì`çzËb“³Z ' º½$ éëý€Õ÷ÒÞù¡À.(?ü<Óo' ÂX£¹ -½‚ü\Oãl}çÏ rÉ^Ü ë cërhÁÄ{£ x.;9¹ž³¸#ÛO}+ ö H‡Gz øå%
Æ®¼ð§AjS2kí;<)Ÿ@ZÍÆ»È`n#çPglv<C[HÀB -ó>çxž –HhÑo°þ¦¯£mÉ،Ģo»L£ÇQ“0íñÅùuâ#ø2†Nü®{Q[V¯Àj¿¢»þ?ƒNWô¨?ƒt›á%¦qGGö:¼®*x¼ÃÀÌžÙÍÙ^?£õgf‰ •çûúpïîLÂT Å7^\ý?0[ÅÃèQÄè$†À×}ÝŠIÃP±ªÇdYvgä‰e¦w©Þ$àŒ¢_™ ×¹Žéß™†Ø'DÂ9ËŒ?h2ó¸%¹ß̆Ó6UÖ¾—õ„¯m“±(ò¨øÈþÉæD¥«‘÷§½ºwõ¦$MMó:2ž“ú©‘ƒ=‡3Ït]ÆF±°i\Çã“%N¥ŠaÿÝ£ÛEK¼ôÑ×îŒ 6y.G†(®AM†<ï¹Ö~Êyõ.‹ï—²À.õ8'_e#åBâ[7Q:¿žßämø"mƒbìS ƒŽÆZáÂ
4¨YŒ•{t¿Op¡Æ¨à‹!| ‘õj—/™§ÐLve§eŸ(ú]<Žqž(Á¨ð칄…ÏÀßù¨;ïAJGZ0ý7ùˈ¾†[(-®P+Uìp¤ëñ|\—;ï<?ÿTlX8ÎíDò§ ê÷ç·ÐÄßÇð“QÛ¡ª›¾ž[,d‰É;´Š±¦IÄW -²
ðêwòoÀ -=+Ñ ºEg¢ŠÖyé5,˜bQÚ¥x®Û:>ùÝ27r¤v¨x©t¯½ <¢íæVþ–(ù’]”Û®ÂãBB²ßâ ïE›Üä ?•ïd -ž¥ ̺”k®ÖPú-F3{^.|àƒM],¿Òck&Ïý"§^{9D_o·ä Ë•ÄgDwŸÇ>B_6õ¦F§zJïf¬E§9åGÆŠ(IK6na mü¹¢äßúta\‘±+O|oÛn™ÔĺàÙ_
$üÔ>Šäkës±7¡{^´2ÐX
úñ©ã³¼€¥=Š&I×}µîäØsU5u¨ÿ’àï"VB”—~²rön‰Ã/A“¯>k]苬’)ŽÄìÂèÌ?vYèäF8ìúš -M,b?Sœ†è ‚-\ ì‰ûdVwÑIôœúá~Ö7ŽÄke Aø€›ÂG9”¬ ™C:¶œ<_}9TïrTÒ^%M…íŒC,[E -tÓÎ@½*¯g :_‹»o]Ÿ°’cü‰·ÑcM -}+^ÂÂí¯e‚³é)À+-[‚fß7 j5$‡=á›®bÖ;tZs<u%/é*¶Èø²EÌèÁþRå´6*Fõ0N纄Z
Ä4÷€4rð¿_ÓktV{zd¨%Î`n
»Ú3NrÁ'ÉHŠ¡Q1Â\®©9à -$2ÊÓ‰Ÿ (¹ -+ä—JEšÇ—éáJÝËÅGq¥½oP—Z{@LŠõÈ_ -L„³Â”%$6$n”% I1YÈcó³:Áì/÷HÅ -uÎÂüÕÏÍ{1T¨—t+jªNìpC4ç@ÖîÅfÙä:)0ýôðt<P‹b¥7ŠÔÒ·š‚ù(23¬õÙMö+&c Ól.^85^Z £ L uü‰ -ê -EªÊqÓëTéCòâ¯yÇõ•+«ûv©FZpÇZòU1ì´‚îâD¨4ùÓ£Bªg9Œ¤ÁÆ{¾Púé™S›vÑ$ ‡¾\ñxllË5çÍiéõ$éTlFÚ—}GÈØf<ü È -ü%ë2bh{açògôCÿ£ÜïW{e1¯éF¾'GŠ)Æa.¨³BG=(”ˆüªCÞÛjHk_×iêPtkºé7ïze›¶ý“tå9¬)U1M¯ž6¾¬ 4*k?¦‘<ꮢ±²àN|×P’.n¹||£ÜU+¶3F”MhÆœ ¡¦9Ÿ?hHû›ç—nr Þ-ä0±Å‡ÝÖà’U·¢PA7ÄÜFwæ°'ŽÁìÓÖ ‘–º@çPú)B²àFpéœ=ç(®é…àÎÂL „N·Í-þÄYØÒ .ŽF¹ÏîÀ1ÇN4.ì—{œH¶/ªB¥0¿Næ%@»&ZëÑ»Bh Ùœæ¹áí„WèºÑ$Kí[Êit9œßë;*ø¢FÜíƒPk—×xøOyŒüøŠ¼ÂÛ/¯OwÙóp»B"6àl:ˆ›ŠÕ ‚U‘eP -Ç^; áµ³†˜¸ÔÕñXðÞŸÀ»b’¨®k€*G/·O3( |ý hÉ›ÐÅØ%§Yæ6ÈËM‘~OŽ¿Æñÿü
½}»—%Kƒï¦|º9W¼ø+[Xìè¤P˸—úòbhê~ƒÐT¥:J‹ìÛÔ +xÚíueTœí’-îîNãîîNÐ ÁÝ¡±†Æàî‚[ ¸$¸Cp‚»{pw¸|ß™™3ëÜù53¿îº½V÷zŸÚU»ªž]o5
…ê' ™¥,ÈÑ•…ƒ•]ðè`ææ¢ rTbQ·´vS1³Þ $)°¥©+ä(mêj)ж´ + ×T×f`bbþ§å/€™×¿#ï‘.@kG +˜`KkS°…½¥‹Ë;Í;÷_·óÏ>ÿ©{S''{¯¿£A{ýG
@WK{+V$Î÷œæ®ï¹ŽHl
‹¼£ÀÁþ»…›Ó¿cî–à¿/ˆþ¯™ax/ÂÔähï°°´Bbûr}O ÿï©Ìú¿'òÿ‚Äÿ+ÿ¯Èû?÷_5úO/ñÿô}þWjY7{û¦ïð%xß2 €à¯=co +üµkœÝ,ÿ¯0S ½×ø¯ŽÚ–ÿ(ößøþ–w5}¿ GëwaX88YÙÿaºÈ=--T®æ6 +zôÙYÙÙ9 +G–f1–A‰°9áZm|vjeÅNÖž^X¥-‚¤a‘7°w+}÷ôqâ¡—vqžÈ• ) +šQk¥§”æLpÌž8;¿+é‰?ÝÁÂä‹Ì© 'üöîÇX»X•¢¢ï ,TË‹¼v©°¢4)a½ %ˆµT— é"Õé HRDæÜa÷?}M»‚“‡ÝÚ ÖÃL—ÑÑR°¡Ïò5å7…ø^{E®êÄ~už v dR ÌÌU\. ¬}¶`!Ø•[üˆÅ=%Ѹ3m4©$¢t¬ »Ôñì_È ëB«{J‰ƒÏU—¦®NBÈzN¸œ +wôr®rl`¡©.Ê*Q\ÔâŸ7:’Y’µ›q:¾/-G›1Âèù#ëÀ•(¥jå 0©{ôšª_Ú’gÅ| +l»>Ï ÊÂôóí›QöMóð6$H3–k Aãm5Šk‰t}1»ü–’¦ÈdcÂ’txv³~ +kÉ8y!®løÅ‘Ðdª$ÂvQH? "ËŠfìSN2óõ%0ºÖ÷fÜKF^N,G;¦‰K:ÄÇ’Ç v¶/Á,¨*¶¥s ‘ÆWùUD•M½p‰: +¦¢‘H†©~J 'O=é“«=/èWñ³<]º&r©õ\a:áwÎúÒ§/„YÛP˜8áiFOýßÓ"`e di¸ÏpzOŽãªÏsek rýv~›D…0!4* ^¼C;† M˺Æô¤ü~ᘹu¸±7`èó3^r9Æpá óvýˆ ±' ™Ósóõx+I'|²1¨®®Érò*?+”0½©ÈýñÛžYL¡ú¥ }ѵÒȼjW.½dfÛHû ~“õ =~# ÆR•ãÄÃR{±ˆÀTèq£ÝáÚ
g *¯<© +OYS0Xµm¡„sˆÅ»Š C&?ÐEƒUtÚ¾BiÑþrDm–0;{¼ADwm;€N5žz b ÀLˆmª=° ÄÅÁiuѧ‡Ž£Ÿ=^r)ê¥Îý³w•M'ƒ"ÀÈû €™š>‰,(víkâüsÎ \æˆ<}z‘eCx± 朮äyXé쳈 +>‘sB+)±°¦pšô(;¤v“–±eMÎE¢Ä~.¶áC¿zØ“2ûgÞëiIoÒ‹ÑÇ2Aò´{!±d:X\Âjá´…¦0ibb¬¯Â‡Îi8½Ý Iç9m7™"A9;‘G勇¨Z?qq3:,´ŒwyÍ%ɱµø(M¸0l +GTt л¾ïGÃ9ˆ/¹MÈH£F±ŠËûÝaÎŒÄ7såL¤Q°=þæ—PfšÇŒªfdjœ_Œ “‹ÂYõ§iwV"œQ0XáRyöÑÞah!e5Ŷ'Ê^”¼ŠVȈæ¡Î=±L>ŽåÛËê
=_ϧ HUáï+"W-6 „ƒÕc’)õ”” ãˆWaÌiÝÝÃì}¤2©ëe§c tMÐsÛ#&Ix²Ñ Z ªÚÚ™O¹¹JÍMç…e=WCŸ£T*bå4ÈËü_–3š)¹á'†8Ý„›HÖã\Ÿ$`}[ŸçÅ5Óyô©Ó¸7Ú¹4ÕÃýÙL;N5–œ§ã<G¢bŒPfÚQÁ§”`ÿðµÃó…a”x¬¡!²0HQ7ÜŸKEô–nŠS‡¦OƒÉ"n7™£8S£»xuìkeñ(¬ç{ŒÝ5{±ç.i÷?Ðd¾“دèñýÐ_nm×q€=ŠLîV5¥ò5æeh;ö|éõ Ù¨ÏøÖ -¦½(£*LˆçÏ׋æø¦‡õv[=†q;æú߃} . ~à¶Oš«Ek.}Áqá¦|e˜íK¢"ïÆï¾Ü§PWÛÅ¥þ‚滆p7§¡þØ4 òbEÑ&Ç_JHïÀêýÖ¿¯
õ9GâO5‘Dz_úÞ.ÿr «ƒœþ§xäÜyåø_²/#XnÒ÷ ïW˜
ò¢æ”J?‡†™ßœ¼cNµÎ~lî͆MÉ=µ‹Ðn¿Lø9“VÈ\ + ª~º`Ù`}ô•×rÜj¥Ìg‰¾öB}Š,'E/¼‰AàkÆðæ!r9KŸ.¥Ü\~B˾£ÅO¥I# +2Ç—Ž.vŽBglI¯Ë—:€‹ËÑA +ŒlÌLC{ ¯ÚÆ1*4þ³u«Ha1½‚6CÞ¹å ê^$•>äN™-¡OsÃÀH«iËb³—¤õOþÑ:”ZÛ„ôeŠ%,0XÈ îÛ ™óMas*ý¹±K–%„ ]¨ë ò½&é@¾¯® +–»Ñ«¤ße+©Æv}%Dý!BÛórãÓAT^°üUé„脲ì@È7”ˆÙ~åGè]Ìd×Ä)ãÍ$ƆJ +ÝÑ+¸TÉ)©ÔýPí)ˆ¥æÒ
—–€¦ Ä’ÛEÇØ:(«„>ÿ½ïÏÚªÎòžÛê×ÓÍ6qî'z¥-ǹMîÔ-E2Á×½:åR%¿¥?5袪*ôIü¼
Fµv¾PeH`_ ÈtðÞ• ÏX@+€ÜÐÚ"03|7Ú¢®ÒÁI”W?_é q0Õk¡¼}ñ؆ƒˆK]e_cgòð
ä 1Wê F) …‘ž¡hc¢ˆr;ºhíLÆkÜ“td20Õø±_ +üFùA³‹F-ªè+ú¡ÛïïÈPŒYº«Ã¾$m7 LŒQð(xsQ v²–DÚHϦƒû3Ø"Å·ôT¬Ò¸FAØ ‘K4öFJïlJ,*¯¼F†§ Ççêk‘}¡nªE§}NOëG|1Š¸sÒb®hÓh½KÙÔ† Ì-%Û°1ë"m½ÚÒÁéçš2Ì·åTóËYÙ +ŒeaBÂY tLü,WæFOÄ̓ÊüÕ=e[¦™ÉÐ9 +dçSk3Ä7ìj¾s>— Íw¡l×h‹Oœ\L
4€wéد¶¯„˜‹¾+Zz ùv#Æ-}ÅúlWüê+îÐo€þöh˹}ä¨s!¬íÍJl| ê³Îìx{fYý*0#Os¬tmn"𬨠üN^ÆÖ0V£@›_ªë²=ƒXñ¹£uö¥N`Î%„ûS¯ ÎœE¦ý‡zBá•ü»qµ[<îqBýE¡%oDU±Sw¤˜ÀïE#-´Ÿ‘½
¼•Œë²9mpòbû¸ú[‡yím÷ôµ¶ ðüÁ;> +Å8ÏJ;¯xð²r~ýI +Dƒ2=7´ þ\}Åf{2vÍχ{¦óÚ!YDž©j 4íÐáÎÆ)JƒT’Ž4a ˆJ Ê„Ë ãÇÖE0á/U +ÔÕbìÔkJ~,ZLøAÒ‚´*éjô»XåÖìþQh{5íAN<ø•|é1*¶—T‰þ ¡©DM €ÚA2•q Q. ©'÷ ø›§ÅðÉ>ļtÆH×8åŸ äÔ€ŒN
+ÌC=Üa·Þ±û +zÄ}µ:á?Qãô‹ÙX£ŽS+83¦u6Dx@±[– èï‚[-^ˆâßëIÔ¸²z€Z«BP‡»‰EÍÍ»f䧓Hø#?ézߥMóÃœòÛ©Œ'oLH‹ð„ö)²^¹±à/˜²Ÿ‘¼F"xAà,e(ôk°.¼^¤Ÿd4Z&ª€&ŒÓîHgCGrZHÅ„o=ô¥’+nø› +(«ÅQl¼™½ezžmÒ*ÁRYòþA2óé»pŒþÌÑþS•òÓvëÁâqhtøð™ô ++{M%¡„÷É-ghѤí¸Ê~hT”«ïÛ¾¬¶ÓÙÀ, +ÉÂ‡È +à ¿ v’d®oì@Ç;‡cM».VÍŸÓsd\«Püˆ +%ž‚qýJNþd=øˆ"áQß$ò7JQ‚¶KEK[†üPn#¦ÕÛ5¼Nž {î/M]²õ{oú³Š›‡M%3Ÿž~nEãF äü…Ÿ[cƒ¶º U»Mw~”– pM3’âJA©OlÍ?Yö +éi<ÆNÉßOê.s}Ëï°–<rnCœ ÍñÎçÌ`ñì¼rG7.Ô sG_í›#6¦ðêþz"D¨:mÔÀ~±ÑBsFš?'µŒÎÛîudÆz¸n .çÚIh¶4„–*=®—FåÓü@3ÛœõÆ kÆæ]tiÿÚ 1êòÍ\…óùãj+3e¿ý “a +Œ²ñ¯„1*Ýê-§ˆu«¸²ÝñÑà¡õnËí}Ç XA×–¥ ȾJ[³W™Ðžúœg(DœYT¢¨¤%• Gvç[Žbª±³ú>|Í}vk´åÙeñ ¹Ÿó\\Žã¹Wúö°? ‰§ºùâwDS~18¤”ÒÝÙ> +üà¿#pîpÄ—°¬–s…¶’¸ky¸Ê£³»šzÚ
]Zî$sŸpÿì¯vUý'tŽ¦c“è1B¤#ìÖ¬K¶Èö8̲©McÀG¬ ò²èÆÙ=ÖD´fKßy2Ô ×l=kMuâ˪ÉYÔQûQi8ñr>Ãħû™†]ëóõš ãâà&óP€;„rW¨z]t}B ã깬>GûÑ[qCÝsTE-f+Jy:#ȺÊ'a ¹ø1V Ÿ8Ê‘°èÙGP òµ!"Š‡Ýw§0Ãv¨3‰Ìäþ„Ã=÷ã[i<:}dÈÖ!9? ›:ôrj775b“2î«Ò+(W{Sù§‡Ð…Äe¯=áz1O¦)?^t7Tª»RX:%äDèW…6O8c$IÁ±xýá³nÆ·|õTÕYCitJòº[èF8 È!}—á²Ù´-(* –™ˆÇ†£ÉNIOK½ÏDÙS¡£X{ØqÌI`ghˆ‚·j.©¯sX÷ã—³”OIb»Ð\È tYfÚ²Cßh}m’¼™zwó=·>vÕö4Þ0 ÔÈ<wfºCéŠßäïƦ¯™ñ?Ñ´a+&¹Z2*ø'ÏGrŠ\ÇØ—Ùž× }‹òq~ç¢[! +!øã +ó(]ÝLœäªõ…ðC!àá?’H{'1ƒÙ$‹ÌœÌXO7 Œ®ÙLûX¯E´ïà äã1÷ˆûYº‘Ý®ìŽj#7™¹!a|Jã×ã?‰pÃo;óLsÒÏû:_M.•uÀ²%bßy É<Yõ_ɲj–KDVÖ«„i0&|‹ûT‘þ¸â MŸ¨ #”(¨RæÖ®--“3?ÚŒµ.ò“Ÿ
Å*ù\;õr°ca¦ò””¬²7ÿý¡|ð,ûc é¬n Á"É·3Cu0üw|ÄÍÂG%¢p|ë_2—;\^µ fEô¿Â¥uXÓŒñ·p3+MxKÅ>بY _ù¯Öe$gOÎë$Æ⻈3•MÏf™;oŠ-›‡D h¹¸êQ +j*c#$Š•ø¾}Aú¿bLˆªïLŒ¿¢wž³£ ÕŸ–½z§ZëŸÓœà"í!u½S“Š‹÷áÉÇ+ ºzs»Ö÷’
®Ÿ .c=å¤H!‚Ȇ?&73Éìl–Aµ*¾ #] dàJ4ÂhÍOúá•]ápq3\zr˜Mj&šDØSø³XyöÃD HÙÞÑÚó:º
Çæe´‰`}1K-‡$ \ÛÌÎr^I—z¨M$9ÑgP¶BC…
ʆË?ëz¦´ƒ™>,êÔnùŒÌ¿th^ôWàéìs¹ÖÇ°Œ Ç +!à÷'wM¦è–ÎèP½ðûkð&&ÐûQËØÙ¢÷¶§ }Qvf/S:K¦\o¿h Ÿ4‹ÚïˆP°¼Q¤sûb÷×–úõÙ<(¯sU8¶tËB{üKæØiFÆêÛÄ›±Ò)d¸:uò½ÁÖÓ5NócáÏ6ÍÁóSDôO§)•’WÙQjç×øÆu±U0~®ZrIÚ4 *Î Ýü9ˆ¤š/kÁ[C¢Šç#¶ Yí D½j„õ¥ ×8ª#J85¸LbE»ºå‡'›vÞ~]TžÑ•‰³²<IIwÛª“àsø*F Vx¨:χÓ5¼?¤
³·ÝI͆–3ÆCŒK·*6WÒÙ +½Â£Øé• ésûãA úIÕ #2»ÓŠ’„?eZF¨›íêp½µ¿hã—F‡<=éz梴|ÿi
™ +sÒ-çvŸš "ç«ñ¢q2À¢ªšäÁvƒ8¹„ÇW?ºI/4j ûé-& ;S>Ø x«æZ—Eª6¼l9 ÐŽy:¸íV"ëow +÷8˜6Ö¯!u˜Ø¡±ž@}Y_¦ŒW$5bìüyá}{ÄaÇ`Œ9ñ¤õ"®2ç ÷´(/³èD8ˆÿªÒUì»@ØÒ]Ú!nµy( ãûEÎõÈ +ÇJÏbì^*@vEÈXcæk3¤ÒWË3F„°0í;Æ·:™œd»Ïã°×²‹Š2Q¥"ÝW”ïê[b£î°)瘙{I³b-ÜükÈá¼J ûJ
WJÔ}U[j×ì«tž¦#¥y`Ìp žÒ ûïÈòYb4èP¢zç íûrú\7øBcäqRItb‡ŸëNÌ C¡£þÏ èþÔ¾œJ²W)o5q?#ëÆ–íú¢
ùÞšÜ=”«@UZ—š(7‘ìŒçÛêß¾ag¨¢” –Fâ¶Çí–*âìÇ &f"bü ä×ÓÐI1ðÊb ¼É5(+pGh ß¾¬Ã¡®ÿU«n4P®48•@š!LnÆÇnàxsÜ8®dŸAÆ7ÏË‘©
D¹Ó2…+oåqeSŸùð+û˜ˆüÓñV5¦‡K"„ž¶”%Æ<FÙ‰*(ùWpÌÝô·û²ÍúÕ`u)ð8 š2¹UB÷ÚÅ*lïdI nÙÝÜÐ4Ük”ôÀnòíššL œâpzæÍ ÅøL›9àÄ¡]`QÐ,8óô}ël™ñè
=ƒ¾ ?°ÞðxéVgS¿úÅ®ùE˜˜ÓmnÓÅ +úÆmGž4ñ 8WÁHë0Ž
ºNãR¯´4o©ÙØ_Oéë|Ï‚ªôÓ‡rÙÇjÔO8˽²¿€…þ”Ë#”¶«µ‰$
ýX&3³Fn“±wmãÈØGœô4Uu‡°‚•ÛÔî i¯/eÆ«Ô4Âm’ÇÆÏãé# \Ã'ßÚup9‹;øôÈžb™Ž™0Ií¸³´ÏV>Gl0:?¾1 ±ZŸþ ;¶Ë ¸ßb~ó¯E®âòðH›ê=!?öŠ§sƒò»|*þsMÔ;s&/€¥òñ£òè +€Ÿö’_ +°>:%tÝÿ’hàÜåA®(E,FKrùÁò#5>©²"E÷èó9»¼úÌ$ÖdfGp±&â/yT/öËsš½ öÊmS;+æñd„}Ñ%ã ¯ø»Î¥Õ²ZTÎR:cí‘àÆ×e¼â•ŽËf_úy+§úŒ‚9Žr£Òþu!Îi¦’õ¸<¶“Ÿoö„b†™Ò ¦€Ò‚7 ö?$¢˜`ôBï +j
•Ûœ k3¦¼ï™F²žÚ2ð‘Ö¦Íú¦N†.!‘GÛt?×½U‰`Ùˆk«¾vØGnaq9G´—• o‹ÃC"¢¾.œ\ýaÃ4Ù œ¶X~8uSÝs›]`ÉDš£ºžoñð•À•Øº)<8– v\гcê¶ã¤’ ”àôzÛ.”¸¹;ù\ªÓE` BFP墬ý&M azÍY""”݈ú v¤(´ëïü8ùœâŒeë¶ Q*ÍÅ£þ³GIçRh¯¿×øO{Š— ·?:û }ƒôÁ~ÿéi²>¹}Íì̦¾A25_6…½ÄŠZ*ÑÑž4ÆGD +»¡Î¿FÍÓ8ø©oc¾°ü$¶<;¯ÍÔl"’±*³¨Ðf°„SÞuwÏ$ðÑ(Á‡Âé+8ï’ÛèTÍ•oÙUîák,„ÒU8 ‹ÝLboº¯ Îr§ô‹D ‹´<(Lêcv°\xš˜ncÅEÈÍk‰zh?Œï¥.Àí{Ê(·IipIw®M9FJÛQ¹rg"ˆP×ËgÝxO˜ËÚÛêp8…Ýk¸Û‡6
’ K(Ãùœc4ê‰MñÉ´²¯ÞÒ¬“É*C-ëa‡’y™Y0DÊ#×iPZ³;ñhäî 3¬é×ç’ø]&?"4ÞÕ<Ò×ùùg›¾ýš45É©Xÿ-ªße¶UNOàΨíÆå•õ…@bŽþ¦½DÛš¶D¿ñ91š¸M’úÓÌ>gÐ5ÕOZ'ÇÔÍ2gµî_uØE(lü
#È:=Ÿ~ô¹Vþê”ïô[ƒž×jE%zJéçÛX»8Ÿ7ZKØŸÎÀf fך¢7«í×wÉp#–J R«‰»3øzˆúðþ`ÆÁŠºÀ:M Hdk#Äp‡Dê«l¿’‡b éð«P[FÐǹ!;@ò×eüJ£Fw8 qì5ØÕZË‘òÉ’;4þùÁ¾µ”{í.æê~؉³™KB ¤T¦yxÓY‚¸!e{®«E¼…[.ˆœ€±’9UÇW)\ÇÉSÜî”O6^OX8û멶Öt1¯›Cé‰4ƒbþ¡ÝwfÛLq®0ó#üu~ä„ ¡Èr °¶ñBwÕ\¥,K›1q¿0V ®•¹ë_g_Œ³Þµq°û[2"iÝJ¨¤,¡ÙìêWgµÍ¹øÝU ¬r•]ˆÉƈŽ§ËÜu¿2Î5öHÁfáÙüÕÏ¡^bÉj¯ðÁjÝÕ5tûñÎ2vljè¼üU€?~á4›‚eÀ¯ñ~.¬Ðfv–¤ÊO½“gß@Úé—W´/À…)‰Ã( )r¼Îyr2’LƒžÕº’‰cEòšª«®à[±6 JfHïÌÎ$å
¤/íüWj3ÈÒW<íõå ¥7 b#ô}EÖgÂ=g Rº‚JÅe×LÛƒ¬3
_ö6„J}᧘~[IûÜžQKxÍmJíB2)GMGìûñ{´ín~LSW2Ââ&?®/ßÁ}Ò-Ÿ1ÛØ«ÄüXÝÕm^©“•Ç“ŠNÄ(
>¶å_¨Ì• +5”0;vVʇ‰\Û=¥Ç‡ÐÅ»/8n¦”².ÜÔRzÚD"‰‘$é»$3mXiB%ˆ#öùÓnà„u²|#Á?¬ 8¨‚ßK¬Š-Íf¡k®XÓ“
2+ÀªtÙ¬c xJKÕUtêôÑL,qúòÑÏt/(d¹j¸ãy ÿÏ÷Óáû$˜Ô q3-]ZëGœ|ø":R`/‘ Û¨B¸,ÑU8 À knϾ8JÓáÜÔ†]iÅ&ÑÎ8ÚÈ>kÆCÒnÙéØD0¥O K|ö,ØKùPëcú¸ÿÓ~§¶´5%D5=¸ÍžgP7“l† r]™¬%¥®Ê !EŠ]âþŒçH(FŒÿµµH?pˆpî8‰(3žG goaô9Ë×òÛót
«Zø²&Œ¿,…Øç¼tÑöÐôD΀ qP(8XÝÚÓ‰‹½DÉO'69bA» +üFÓ}UZ6²ðlRÛ +ßB÷,øìõôàÞtKÊA ‚Uö…úØ€Ã7Ú—”‡¢ê¸då|%Qß´“¸6ÂqoÙãWí.Š,}U/)¤ÏÚ Ò°= PjcaÌé}V_[ÎQ`9Ó¿‘ #Ù
Ú„é½Á6|-Iû}„ýþ—¶jl£¶%"åh/ã6s ï%F¯‹k/€¯¢‚BÔpÔÉ]¿O•Ø{I…O”æ‘»üéæ"ã¦8Éð uÛœ ýOÌŸoÊ8ÛÑ·MðTt8JbD?ÌOÚ…Í(󸢔s%<…ÌlGåšžÚĸº¸1}˜ž¡uæØ" +ñ… ‡òÐæbð½¶õŸÝjSÔüCàâäC*œ`E_™[‰ä,%R•X ™«b¨!-áêS?ø
$´^G ªíëvH¡²ûI\PM_ø)c#!#Î ¯¹ž=³6Ú°ú
?Ç`k}RƒÁŒfC©È¤“ïÌ{5ùµ<Eû»á°DçàÀÇóÊÍ›ï#üb
ë× É¸‰ç¼§˜ém.ÍEì g:†´ +Œ:n/wùªb:¾D‰§ƒ˜Þöª…%¼&z[C÷¼cÛ+Ô(Žö=7ÇöCtmÖ“OHÀbÞ0j],G6!µèik|GÐ÷é°ÚÊ~Øfóf~´ˆHn‚§§:vƒCÙ˜9žn ͺ¬ÎO‰Ž ’§&esþY¼ZµL†¾AE?íz¹¾è™AvX +;ñŸ*Êí"
þ:»,RñŵJ&¯‘JîWå¯ÔžøÙÉÇÈó<ƒ8 Ù!rÆ +äwÞ8!¼w§š–³à0an‡Æþ?ü ý‚ÿ'Ìí-MÁ® S° Òÿ8 Àendstream endobj -1313 0 obj << +1328 0 obj << /Type /Font /Subtype /Type1 -/Encoding 2737 0 R +/Encoding 2807 0 R /FirstChar 34 /LastChar 122 -/Widths 2746 0 R -/BaseFont /UZLPVW+NimbusMonL-ReguObli -/FontDescriptor 1311 0 R +/Widths 2816 0 R +/BaseFont /MFAGBT+NimbusMonL-ReguObli +/FontDescriptor 1326 0 R >> endobj -1311 0 obj << +1326 0 obj << /Ascent 625 /CapHeight 557 /Descent -147 -/FontName /UZLPVW+NimbusMonL-ReguObli +/FontName /MFAGBT+NimbusMonL-ReguObli /ItalicAngle -12 /StemV 43 /XHeight 426 /FontBBox [-61 -237 774 811] /Flags 4 -/CharSet (/quotedbl/numbersign/parenleft/parenright/plus/hyphen/period/slash/four/six/colon/B/C/D/F/I/N/O/R/T/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z) -/FontFile 1312 0 R +/CharSet (/quotedbl/numbersign/parenleft/parenright/plus/hyphen/period/slash/zero/four/six/colon/equal/B/C/D/E/F/I/K/L/N/O/R/S/T/W/Y/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z) +/FontFile 1327 0 R >> endobj -2746 0 obj -[600 600 0 0 0 0 600 600 0 600 0 600 600 600 0 0 0 0 600 0 600 0 0 0 600 0 0 0 0 0 0 0 600 600 600 0 600 0 0 600 0 0 0 0 600 600 0 0 600 0 600 0 0 0 0 0 0 600 0 600 0 0 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 ] +2816 0 obj +[600 600 0 0 0 0 600 600 0 600 0 600 600 600 600 0 0 0 600 0 600 0 0 0 600 0 0 600 0 0 0 0 600 600 600 600 600 0 0 600 0 600 600 0 600 600 0 0 600 600 600 0 0 600 0 600 0 600 0 600 0 0 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 ] endobj -1237 0 obj << +1252 0 obj << /Length1 1606 -/Length2 17262 +/Length2 17489 /Length3 532 -/Length 18167 +/Length 18402 /Filter /FlateDecode >> stream -xÚ¬µc”¦ÍÒ%\¶»Ì»ªË¶mÛ¶m]¶.vÙ¶mÛ¶ñõsÎ̼³Î7¿fÞ ×ZWFDîØ;2“„P^‰FÀØÎÐDÔÎÖ™†–ž kacèâ$cg+M#hgm økd!!r41p¶°³6p6ᨙ„MŒ -Ú¹¼h˜™ -ÿ ßtþFÄÖÈÎøŸ)Qr6°5þ;XÿËðÛÈÅÑñ¯žÿ:ë þŸë¸‰‰»‰Ìê’W°eZfºs
FîЄ°V_èPˆ}I½rQ•]·_Ú¯ Ž -ýêÚ†)ίVÅ3ûÏIÊÑ tk²î“«|\ŸŸ½È›¤ílT‡tº%ðéçjQ^× ÒÛ`š¬ôª‡» -Šº¿? ð¦Ú™ ¡®Ÿ)üºø£?Ù#ø¥ÖÅ¢u 5 -p¼¹ 'M/&&ˆ ”$PÆã`¡Ž’küˆÀ7:~†ù“EœGå¨ð@[&É—çZø±Hæ³mÇ•)û~õŽ/š§§{<V
U—Ê®]¡Ïº+ã>!¸£C}²§ªM‡×Žì ÀòYÞx°¤þQá¾ÒžX ¸Éªi8M;:6ÂÂ~>egš1 âCP2ƒ÷M·]òþ2Mÿ½ Áø‡Œò!0‹v'¬tHèúøÁ“zQ<†ó3í²è½*샶_Z¬ÌòØ ƒ,bzLC âZˆ`R u„¦åý´ØMŒ23øGt~æ§Æ[G˜bCŒ¦8¢:f˜8,Šðjze¨ÂÈ.ŠCFÿ9Xé°ÍÀ#à ì¯?–@FÒ*^€ë¸§áì•îŠv>S -Vs£€·Ý‚ª M½§Ä0š!a9QÛáù5ýGdõ÷u8•ô
_ Ä;+·¹V«18önQ±ù-Í“ªT†ã~í-oò„lèq#]Ïè5>ÙI]n'„ç
±š»-¡ØÃF޳ˑ#¨VFFàѶ|Â0§öN=Í}å Ì_$ -t•úÂ2"ÄB=Ž‡Ãýw=ÓS«;vbƒŸ¼5µX@_»«“E¾˜}e)Û.B2*·µcÊ~êJ“õïðªÝ -HÅ”7dv“Ÿ¼uAeR§ÎŸµ~·" ‰š~(w·äpÍÂØV±Ð¹ÔškYòV¢¤‹|B>æ¾s²œ¿m@e¼É¿ý†‰K¯ã+ aØFÁå0~¨¥?V· £f@;ÔK)”wrïÕ3“ÚîdܲDúP(ØÔÔøœ™ Ð]yžv8Pé¿]Ú½ýÚêPÖÀ ¨Ôl6À·¿ÔÅ ÷.Îe‘š»¸‡³ÉˆÎà'Ãf 9õ›e -ÿ økÄ×\²)1]8ƒ‹h ¥OmfÈßaÃé“ÆS“V ò ùëRç«W <³˜&ДÏÖády¡¹,˜÷r¢ógoº1Fî×ô ;Ë•˜,ÓÚ»W,¦j?úÑsvÕàÚž.fê"Sp/2²+hÁä.èö ú¤ õ´ÙUÏÕŠ<J@öÜGP`rèº)Ò¾7Ý# ‚•ÐvN D!§-„d/ ¬tXzzÔótß †å~à(H5vèÐéA+ºË\ƒcù;0·ä8†RVµM+Ž“€=ªIÝJ´H«’ Yì‡ÿ3IS¼,µ‚úî@r —ÜMhŠ”žµ•ŽÑ·X˜2O}ôuͨõ0ÿL˜îáw£[’òœƒëúÀvWp„ù-H$÷Ä]øŒ“ÜmyïèúAêñë þ£ë†‡^Çe:rg1pæeg¼60¢Œ½ž÷ s¸Ûü²èIü#-(öÞÆHTŸÒƒä¦ôp fñíBOÞµ âU1C)áÏ3&E&>êîì–‘PÑS~†þjêÏC ÔÆ…O(Vô|:ÌΧ¶™¼ Õ†k Fr6MmvY4I.m‚à8¯ä‚Yúl—¹SqÁH«³a²þìz$
¬jÿÁÛè& ”— - ]Ké<# -ç©^–v©K}³ÆëY‡ŠA%E FÉ‹PßƲÍDäÖ›‹ÄÖ¤ÓMÕ"]™¾ÒÀ‘;Z H·Fh ÀÕQK-‡a³ýý¥¬ÝÒŸ%¥1”NTæ¹$Å#¤aîáÅ3Áë•F?Ê·ØcªjÇc_Y0Zì÷–PÒLÕÃ( --wã0!s ž-,¼‹¦Ò—t]§Xü²Eùh€ˆ -ñ~–Ä-®ŽÈ$`òôtMÐJS]âÁîâÙö,se, -+©ûцò½Šs`Ü&—lÁ8å²£âDÊVÜ´È”'ãÈŒžTFû"ìçÀp‡LÒýêÒÊl -Ê^þ¾Œ* Ð,Ú!4\õËs¾‡Vn
Ý ‘^gnaž](+P>—[¡ õöã¹Z¾Áx š.¼—G ü3 “Û\+\™~ó–F]µêß+IU½*7»àd#ØÖbãBî *m‹'g¹D²m)• SA‘X¬0Ñ<HX°‹aXtͤlýaIG™V~¼#) $IœÀÖŸôv"Sóy3¦³NUáÒ0鼯k‚%(jJ0g.3¦JR¿£°ø¡Z€®ûÆÔŠxI t¢J){CXí 9Í^ <ß&p3Ü5’¬*|$õ/ Š¤³†ÐXjšÁ -¿ÑÙã]šÑI‹óC’(¸-E\ôHˆ.çÎoBŒT…ž®5:@¬PNkþùò§r¬‹G³ï%馒ü“8™¹/qî1ðBÅWXBÕ½¿ý¢†Ùј©µ?‚\Jík.ê}êS¥Ë€¶‡Õ ØâÚL> $©Ärå`\í ww¤ƒ¢¶óŠŸÀe -p‰ïå¬tpy(¶ÅŽ²Wå+\FEÝÔóG9 _AóÃDYß=N¿×€õÙ]EÒ8çÍŠ£…<M®Ó";\ÿÐæŸÜræ¹”ÏY`¸0oÜ{sêËXsïrìjƒx—d½+øh¯µ%â!\êR-±COÑà9ñ^ -n -t^B… ’ y‰ÜD·@µ˜¾Ó ÷¡°_z¶2µ$㱘Jó¢a“ÖóƒTp;ÕTšeIM•t¾Õ5Šñº
u4¦ù>†ð<î>Õj Úh á:â—À–Ü;Æ¤ß ïáî¶ô„¯²Óyú6±¯ê«¤—e\>‹.Ò¼Ãz@Š=ü¹v³œ¬àr †¸/„:΂1 “³r_ûÖ‰½^oa~ sïªÌ(¸dœúvüa$ OÐU¯Õ’ -Œ:¡G=ñ›–
æ@,º€5µ³äj²é49èC’Fˆ´d|cp¢ˆC«°'»M~” -3¤î§Æ¦ ÊgZ ÉSe–¤õÕo0§Œ"N%¢.ZV×¾(ÜÊ1*”ë´Z½Se´™·Jè¢]¦Ûq¾½EÆ.Ó»wÈ N÷§`|Å»x¡ÃEGoVH™à÷˜br Â$µ=¯m
ec¸—Ÿ¥wlÏÓ²æ<-û,ÖzÅ/SwCþĺuŠ¦4˜U…ÇtÚ3grâÖjR\!ŽóãâhÂÂÛ#²3ðtâ‡çe… *‹ÍãQÈ8òù)ñ&Õxô€Ä ŸcŒDTyÔ€ùkÞÒd8ÁE Ñ`Š:›±ŸS°J™ûçÕ -+fÃS뜊”]W¿œŸ_êÓj™# íþkËÏáK±7FMM:Ö— -ß\
~á^/r$Œ Àô”¢_ÆAµ¹*ó«·töˆðNœ0Â2g¾I›qŲ˜\øÃ(6ý}Ýÿ\M¦]~Ãv œ'eð©.&räxR¥*ÿ>´ BSR‡í -’†ž~÷/˜ºñwhVñTÞp8Åx–’lò´ñGÔ'ÏÕX¦ÙeÈý KæpRY7ùüsd©R2{øzuì×S®‡/Õß¹Ç$†nN×”rp›šdYÈ6^^„ñÀiaõ2œñ§;½³ -Ӕͼ“¹hÕ®û\,´§É4.O65%FMuCC\ŸìO·:›’Ï)_7><›[ü}e‹ '\Jöè@Lˆ¨kÜóqY b½âõ~ÙM¹®¬e|IóÎj+”ÏÕcb8-šÎr`FžËÁ -?“‚ø½› Cäãµ¾Kd¥¡~–?aÒs‘Dûó¿ øuÕ0Õ¼ÿÑ2_QW #¡JÕHH˜"ñjc†"”â,à9¢]ŸúPq“à9Øjuã <!ŽÃ‹-¥Z׋Tî-E›š v0mœ×^ºÂ€ujWâ#¡€(ÖÛñî:ã~~y -AÙF˜/¬³cv
¢ -°adÓ@µl¯b3@³õ5ÈqâÛZÐ…DÜöýø}`OÜtq ¡FºlàÐ’6!–wÈ «ö g¢ÈcÁ !ÅkjòQØ{½“‹õ -MX†“VSÛoV ù‹®áG<>ôÚªæ1&×m›NyüÉxÜz®×ø½©Æû™@ Z<ør²¹Œ‰HoskëQ0·ž–v€“ 3…¯»‘ê ðCx,§¼¶cïÖü»~¨cR½áœ W-îyN}i§éÜRYÖ¨P!fØÔ²M£Ñ<äÚé2c|µìÉž7àòà ÊXî4Ó±V.‘z%‡ã -²f â9Êï’Œ’f1èÓCsî\׋Wí¦½tM.Ð^ÙüÖÌÚ¡xÃÃtƒD&'íÈx`iêHÌ þM‰ë™=¯í‰Ó˜>"üEº4kÖOŸ¹Ø.r!PÛ0*J ˜± ø j]YåȤ;uYÓlcÂX¹±*©§ªw]#kÎ?úÀ=‘3·;û %âÒV/ôÑuŽ. äLSN„󅆘sOó{QA~ÄòŒ+JþùîÃv²ÇM•Ì`Ipå'±b@{FÞ" kä6”5š Ë[{`þóbHsýÛÝÙJx£ -þ¤ûër½Ÿ Ì©‚³fÎÝtw4N©á*r¾‹m€ œ*
í³3Íõ±(‘V[‹.[³ïäÙ“ÄƇGh ÀÜF~pðmïÒÎ ŽCeG±üAÒó¤>ò(wnB#Ñ6±Ø#fV‰è·Ú¸ù0 e/ù:Ò!î^ÍA[£¸
ª ñmD04µ3NDԺɌ-~zÏ_ÔªçõIÈ q#"u2íõªîð¸ç…¬Gûó„ZY5ÿs«^ÉpAþqêÆè§ÜÆ
œÐÓxwwå£jåhZ3 5Q««Ü‰k «²Ÿ9O8²škVä™Úh˜R¯‹å ã *Lã B ÊP³‘³]OA¡P†´¢ÖŒúK•»ù –É›ýøR ÒÍXäôõ*B
ÅCòýÚbŸ.v[¥Þy#½0oÆo}5št+zÀ˜²³JA1-Z_{µè*DBC®O’>Íárt MΟ;#âø³
õ¸ì×Z{©â -ï¤ÕŒæZP=¬Y}«’änzÈN$OÞzœ Ûyµ¨•f“ytªT¨å2û“©ô®©oZÈ) ß৩Ÿ›§ Âæ·3TuöºäZ¥T^--Ýú£ÛzµI8çu`##Pô9ðQ£¦‰*²J3ŒøoÙÛjûÜ÷øË
¹{ ¥ïÑómÕå}j*$ õž$Ó;¶£B -·K=‚'h²@ßóh‹•ÊŒ7¯µŽà8X€› šÞÇvÐkÊ]àŸSü=Η]äÖ¥ajË+*¤¾o²ë”¤0K>ûÊV$öåÄgÞ·y[ФÈèYW5")JÍì!h¼¿di|!6]$ÄÕXT}| -È›`”¸5² å!4/VqT,ù’ºÄ÷·Ýg¡»Ý?€¸Ò?FE£tK´²uÀü,… LÁ‹VoùÅöÔ©:Ë\ݯÓ&§¶*á—s ÉB½hšYiÉÐlóƽ"΢N -ióÜG4ƒ˜Y8åË -²á²‰Š.²%§:‹™»‰A{okÂÏM›—ßçB/Èñé”ïÓ²fOk¬ù]ìŸá©Ú$UGÏ y›j‰Âx0NùSîg3V8BCúZqœh‘àÃÜ8#ìêLÂÃ-]ñ0OŠÕMærÏø¸MÉ“h Z&ÙÒ¬¦Qõ5eJí"oëÙ¤è ]yƒ³ÏãRÒu?åþ>®Ó(žR ‘²LŽA†»vÐnØz²)‰Ä "’xœìd‚W[f¸$àµF]ˆl,1 ‚Y_jžæ$Rå›:ˆGlå)^ÕÈÓ;3ò šã«ÔJ˜ +͘ŸVlkˆšu‰ýÍA¼ fO""©íˆ&&L}sjÖü¢|åõI™m)ýïÃkDÒ…~@XpY>+À8cæ¾8©=<VMò/<@Üš©í½éëõéØS1CöJEï5Öb“QÛ0o·eárÀ¼ð6Ý)#/ ÎyMð„½%t FhSTD¸ €>_£Öý‘Dbws»÷³KøbíBw§ªi†#sXꇈz¶Óe¹M„[ÎûÑzjÇT¦o𨉱Wr§'Kýeö<¥„v³;¼(§ŠÝ™] -Gzߦ@ª9L惣}r#f9£¬÷B/o´þç~ B3l?9uB¢˜”ìÎé‡v’ëƒó¢²‚»ß02=·2IL./4í ²ã…±>…SùÇÕðý|žO`s}ëë
ˆ“yúóŽzè7§@„¹‡ÊòÙ ntæÌYv‹\¡¸Î&Ê™º4¼XObæŽ{´N ¢ý)< ‡¨ï ûß‹TºA|夯¾Ø†ôak×J¥0 SPÆÐ>*®á7—æµTå`ƒ_j¿iþ <ßB -,«ÁË&^“V—[* % -LãDÉæú5š³YèûÜw'Dà†<ÖP²?iȯb2‘sÓ'Þ»ÈDcûˈ‹b˜\]ƒgLâ1Ú÷sâÖ³þé|Í+Gæxïô’RÉÝ8V³-Ñ iÉJëÑbÄq5¸kr‡¾éÃø}$ªÎaunj”M*qœsÎàFi7pîßp¥ŠF2çØÀOªAŠv’/|(¹ï~ g$dß¼¡ïñâG*†ètÛ*»_xö«|l‡|¤¯<ÒQ’ …µ·BÏÒbˆÈçSæ|UX¥¤³ƒö‡kmƒK.¢^>^XK¶Z“–—õ"Ùj‰\O__y¿U2N3•ÆúÁÝùæ²v3© aþêâVùóìM
$EÆs^+îÉ%ºœ¶ÉP.LY…Ätï'FøHÜvq¡ÉoV'¬ûˆÇÕÝ3Òm¹Sì¾ÀÌÅEKð'í~Þ*žÓñžÒCȶvZÕJ^õA4m²\ƒKýa Ž³7_‰ˆþÚÁvdª®”ÄÇ0=£m" =®b."nÈ_§XŒH/zþóÕ›Uí M ígOV,¤yU—.* ±™\QšcÀü˲²>^å„
ÀüÏv ÁbÀ ï q[QFÐhXô.q±îõ _=B’¿Bƒ0qù™àú9Ã@ß\1É2Xü¡öaã4réZ¿¬î…ý`$Wü‡ž††˜ño§Iì¹÷ZŠfåmñÕwû‡òk%¥g©Á®j¢´ç¿¢Dù¥ÐÐÈáFyßÄOt‡á¾<1‹©Mq.Ú¼}-æöáA*zw*üË3{ È%äè‘x¢¢ ÒÉe)õµ–—òð€ÃŒÎ~£'ÜÜ$Ëÿ¾±†å‘?`âÕa+ºéòw¢äp¨ 3ÒÍVèe=å’vˆó\pSìy÷X²ud;oª 7Ím²óù+÷góuÆ'â«‚â´d|ÇÕÝ S>ÿ>\í8âUö¼´Œ¶G=Ù\ݘîÂqX¢¨ -œ_ðÀ,9°(öhgû¡o¯jÌÖ
o4çþ‚‰f…]Óì ¢™žÅm)ÜUþ µÞíQSßïקãW
m‚dôåvqMàÙkN‹u¶üû‚‰L£R©i nAÝ t] «¬9éT±fNûh}¼#ô ÃHNº *Tñ³WÅ.}*ZùöA0ô‡©Áše¶`v¢ °ªC <Î<š”¯Šì6-MÂÁr¹Èhݾ’ÎHR= /«ƒ<öí€i"@[®/“pR¯óùwUëz¡••zÌÌ%»Æq -ÁoP!
~}(™ü5ÌÅ9Æ;Õ±Û´[H.¯Ÿ³ìdÔÑ`“ ÍÙJ¦S1<šH
ë¸ÙìÛ ¼°Å˺Ì}Fµó¢¨(*XÎò~¸‚„Ø€gؤqÀìSUhyxZœª. -YwBæ‘ 03ÐÞŒ}NÔ‚‹hÀ WºœÌ+wß Ñl“1Ë’CQС6]áÐw\‘’¦…Sqpi& â?sv«=ë¨z øÅ£ðí½;Ω\º c=E B/›´™ý‘“5eª~D§ãƒŽ&Þ)^LQézåÚÈ»„` ¼'8ÌçvŠ ÔPææV•Ìz(ÞjrHOZªî,ôÏzÃ7í,₸ t!>Õ¸¢¯Ò»ûÄ&MÌ6ª!ÛaÏãJñ¼oÖ{aA¡ -XúoLaùÐÚt¦@a³Ð"—„S ½ÍϹÎóSß©×C¬ÞML[IÁÄL¢Jð>¥lg¼‚v›ddÆ0¬Åü!½ÈœKis÷ŽúÃ’bk\¿È†€ŒsF -ˆ;övû.Õæzi”Áí¹œä`f “s(éA¶R¼¨ 2á^: Ä!=Žfý¾‰;ŽW§c~µÁïnS¿‡ï 9âÉLšß<Úφ¹Rëä0Gcvѽ I±¦€¥('§q 9õŒË -ªþ® æ¶Â´]›†fŸÔd:šþ‡|B<ƒ?X2¾6ñIãpËxCCMS?ILÑE[¤Ÿï9 _ýïN òsª¿pÜÜ E²A™µ,¦/ŽAd-ÝÌ¥®T[c—[Œ”ƒAN‘íë…»Í …OXUÅÑã¾3ýªõwåߣ ¨çïSR ™¶µTJ]íy©:ˆÍsÆ[@¥*sÑÓSyKÃOhÏ»E'”ˆÛ?ˆf’‹¶2楄pL’ -»BÕ=Hv1eÛ¦š¤ÎûÂÊt Û>– ¶,úÅÌÞ$¬Ü¸éì}-160Šð ÿàÏ“t¶û»i$¶ñ@]¥4‹µyñahïwn -F×Ë0Gn‹ÄŽÕmâ믔õÜ“T^-ú
9]5pšzxë½!‘ PÊ Ü§`;¿¼TŽÌN ®aÒŽà C›½/Qð -¤}V£×ÑÈv®_`Î …,$
ò£3¶â[ Þ¦¶J,‰Ìߺ‡ÃFŸ°¾ÖÀªÄ‘˜qhíÖ Ö˜5/$æD*ÔU›Þ‹]áÙ´*Ìz6£¹©2Êõs+ÈÓ#'R”±(d…ã½ït"-HúGÏ\!j´çzóPêû7žœF´Áë¼&·æ›Á™\} 6tê ¿ØÎ9Ðe4¨Í´ô• ±B’}¿O„,/±²X1Én·ñ8o'’¤¾5Ð-± „'j#^)\ ³¼ÃŠ–Ì?äNªŸ²$+ïц Žñê…‚Ýxš™C>b1¯):ÉÃÐ]|¾ÇÊìóÂý=(eѼmoL=Ë
ÈŒžÙíÏÕ*9Jö–à7J’GKé/cLò L>[úHAÆÞª©µÄŒ '°‰i5b¸ «‚ݧß=ˆ†ÅïJŒ"J¥É±K¢>Úûˆ_1]@hünH%|Ñ:²¸ew·ý¸90ôBK&×åw5Bzh¦’æ¸YdÜóæg}D -V;Ü#R™'Ž5ž%g|!@1žG½Gø†aU!Ðs…R÷+‰µ\[€gÙ]gÑŒ:) -Ô‘ LN¤@ÉÌh"OîD½’(ko]¬cúÔ=Òü¸…&TΨD´mÊE%JƒÉÞ›’~9Dªô˜21xBou×,ÚÔ
™Q -Z®ËoÛ4ëŠ*s³°ütg†©NeÔú#‡ßìF¹¤¹K¸]C•f/ZЪ}¿@ôFêbM̼¦K ´ØËJ®?L›^ëåɼo¬àÜ^Såõš¾qD¬E¨ÁOÙC¦ª†#¢HGd
·ó¡Æ‰APHöʬãÒ_I -Þ°S, LqÎ*™C •– ëüðÓ¨Ájl>ækø ƒó -þ„ÑŸœ¥*´ƒÃÜ! Àr™ 27lÛNâøò,% @/üùjÇëf„ @´RÛÛ¹Õ:#DôN tAÊ_‹+fQ$'ß“_ 9ËW„~cŒ“üŠ¶aÀ-Í<Õçx î~)Bfvd%¦Zýd4Â*Œ^ÓÐÎõ(“ nÖ•Á7†Îr{S¦æ”‹ÏF/h8“¤s$ÁN…t´æzi› -¡â¸0Çø$øÖ;¬šƒyëMŸžü t ý LïXºªA- ø]·ö•9£ö˜À[æË#oÏ}ô<°F—ŸA¤Ì Èúë…¾KUÇÅÎ}Žøv^¸úͺÛá´„W…Qo;,@o˜ùQ@&× _}=. š×Š˜c¯(¬t\™z±g¹8§Ú±ŽŽÞ¦LiR™‘KÇ>\ - -“;· !iÍ1w4!Iõþˆ÷Ûû¼ï ðy¤’2¶ -¼–I㊙•oh†ÿ9œ¡–Îí°Å`û>C¼]ûÖ
ãP[iéº5o™òS·ÍÚ¦b¸ùP7xÊp]_x+Rl¥Ã×z/CUO² âRÀ¨lX ;² -VÍ]êAy³XH±ÔŒèyÒLåýkoù"-Õ6_XŸs(GÕjØwOÎÃIÕÕ\‘›"NÚGvB<dÎ2æUøõÇͨa'nœ"dáõj›K†·…éÀaµ*»Üz^YCOs´’âUerÕ3“®©¿*Ì ¶^qèåSøm Ä“—´¿Ìm+V#.MïäîuS³°¢º ½7Rz·Ú•DÊ£{ót§UYEzØ”Qù-t²y˜’…[ O[UÜW¨‡³!¨ï 5ý
¹yK=n¸±u».5®°Rë¡fð¨,¸V2›è>ÓˆŽ…¤Yô·ØfàÄØ(ßÁx‰!´à‰%žM>¯Z) -å"UØð;z¯Ãg«Ô«¼L’"¤Ú-Û‚ Ÿ‚xwÒ×~ e]bþL‚¸=V›Ïóð¨-ÁÅû”Cª³;ÓÖoä®Í ¨ÐÒ&CdÊÜÞ<_}9Ížsßú–M©’£ê˜Eä‡S+ø{ðåÅ1Kg¥V£2¾ÒÁ5«È–eé ýê õÏŠ½SÅöÁ…®ÙK¼TùГ®°zc†\wír,Ö™yÆTôfDÇãF^±–ýtÚ|¶«w]’ÂйP -¿,:Fp\îŽr|0`Ï!ÛÍéy¾.Nï è ^(%×½ñ>Ü0Ø]^ÒC ‘$®Çž5~<ðrpÊÃz>ŠPãuÍx{¿šècAÊûß·™ÍZÆ~œe·9^|Ø™ª´:öÛ9½0 *ÿ}ôõW'¼D>½ ³}=à -zžûcêÈ^‡õsa`ÔúþçBº&¿¯ÈÀ}Ü–#üÝ×õ,¶…ð€5nXœ`KÃ|Úªup´ëqª£¦Ws•³Fþ»‰ûë»Õ nË·+1§!NqM;Ú¦”+1Åôä@2Z
œXÞ%ÉŠû:bj -XãÙS9´½ AÄŠ›˜ì \¿j‹Gq‘ñ
YÔ4Ûûª2x"…þ€¦Æ">5IåñOù¼Ðù)þþbZòZj ÷Ö›ŒEŒ×©8Œ†–BY‡tç÷]Ü þ×™¢Ë€9£ýd%ut o¥tÃØ_‹Òs¼#Žp9Ä RsˆNóÊ Aα›‘my_êB[öéNU9Wɶ¿~›ê? +xÚ¬µcx¦]Ó% Ûv®Ø¶Ù±m_±mÛ¶ÝI:¶“Ží¤cul»¿¾ŸgfÞ9žo~ͼ?Îã8wUíU«jÕÞ›‚DI•AÄÌÁ(á`ïÊÀÂÈÌ P°²3qs‘w°—cu°5ü5rÀQPˆ9] ìÅ]¼ +`e°ðððÀQ +ôtý'— `fåâhkìõ7÷_0Gg«Ñps±²·ø/ô +ĬsÍXŸë%¹ Nfß{SÊ*å P„3]lÎ0×Ï4dîÅäOŽHþ¦ ˜Ý(Í hõ%gç”)'ÏOTCã£#Ã}·‡øtù °|1NùøB:êÕ>Q´ËGÙS¶XÂçÌ}#ÒÜXœ‘,‘|[Õ# ~WØw'Š„ªð£Ê#$n6ÎÞÁ)óýxCÉ]ûAÍæ”=$w?º>1$S®ÝdÎ ÖÙPN< 3±ÌWêGâ¤Ý£âò +ã@]á~ ?ÅñïVìÁ¢ˆJM†³„‚ô_G)|æ¦jœ:ªSÛbÈ ~,˜(£ÜÖº“£xõdñÔ¤3ÂW¢säbÖûº.Ÿ†Ç“Xœ¡f-TûnÝö†hRâ/2z}•wKª{ ?…†|ëþ ÷(¦¤I{Ôħjäß{ôb²4ªR{È2Ý· 5ꮋ®¥o ¼WÐÂÜöš¢ ª +¡s,ÀñÙ燨×qZðo ñS-Ýì…|7€°4\±uhò2â·t–û + C…Cmkj"úðÝãûò? ¤L›_LM‘>¨J£M&Âà ¥¹Ö›Bnv“EREŸÇæ« ÀZ§*ŒVXpÈqí$~Wóÿ˜\¶œÌÊòz¬ ©«TX¿Â4›÷T#x0E òÄ‚ùäNÕœjÛEƒ²¾ñâÈø¡Î¥7µ<t“[ß|šytl"†‹÷|ÊÍ6g"„¤jèŸe¿âûežU~¤ÍúƒŠö!8—q7¢rDìúøÁ‡~Y*ž÷3ó²ô½6"’E/ 3A~uâ„E9«X¾9y½ L45˜>ZÇú~Vr—Ž!^Qê#®¨çS{„«;B¥9NG +Y 'B + MüWVM¸òØšSöÏsˆÊQ;ôà#tîWôÕd°±ÌêÐãFþY[G5Ó»ÒÝÏtãâ_± ; !µK°æ¾3’ØmÐð¼]ˆÂ:c +Fú¼ªF&/0R=5;|¿ê°yöo1ð„-ÓkÕG#w©V·‡Â6
ùQ®ÇÊæ [ H d/w’#B G8MÌÉ=VÐ ácn¨¹)Ë4j†c¢ Û?áØ3fž¾òçƒG/’Am
eDz!*ýáY‘’áÞR¾£Q»ÈÞYuÝÍ» ¡O¾:¶º à¯}uiß¾Øýh;/²kvôâ¿“ÈQýÜÔ¼ýܳôŸE£ùÕ gá2vP…——&âÐ{–ë|þVÑŽ@YaJX°e>(§*³ãay!^™Rq5i—öS·Ý¯¸£ïW]V€Ó±¸ŸmŽZŸúûW†Ùf.
´¬%h§ÿB¶N@—B£(ŸK×koZb±3ìó ÊÝâO±‚cõ®wíë¨F9j,¡dÇ*¹´ dà Ã:ôgý½oZúi`Gg|e¶þȯ Ë eX:?æ˜ö•~#3úºéµã<;‘ƒð35&EAžmJ–á6;©Aæ‘;î '’#ÊoÛD]Ñ,À£’}¿wá<˜?&HA%VÅGŒÇÒ›Ü7³„ÊÒjE +~˜›ñÑ $¡ØAÔŸü;\F$Ìß<³kNÔÒ5‘~“Oç|ŒmýŠFøãR@E_Êw4Þ"X!ižøNqÝ[åûÄôë'ˆ +}ìD"`ž,èÛ˜AfU·oÚà·¨TÛ[³'œM £L²Î;òèeñ UU=O¤ÃZÞ4@Z3uò7ÈñyßÓªsÔÚR0’ö¥1¼7/‚¹R:ðw›@»Œb â¬ßÞ> 0éÀ©ßŠ‚ß˼n8—¨9KÚ$>NÎŒyJŸ¡ÀE/àoGÂù4°·#îoî–êi7uòý~ý€¨¶Öá÷0\‹@x:ò§tà^c¶Zí=`±óoö"´“BY7±ÕLf¶û2HöþQZd«‚mßha.—wf÷ û¡ÂF®0ó l8áîcä +…Mußɾå" Bû«CŽ¸ß¬Ìqq/سÖn%Œƒ´û°&è +ÉFl§?Xº„× Jf€^."+«^öyvðKÛú x ¬/|äô0“Ëm¡Ù¹ê ”_f[5·Î®?°UÄظ‰÷CÕ*a…Ç.ð™¢5I^Yko(mOq†!<]ÖÏÐÖFßôd„š@SÜuýÒ¸íÝ7$PâÀ¹ƒßZ<RÕîÜ7†vzC3¡,oÁbø§¾˜¢æ\o, fôüÇ7û5Ž_‡ Ý7í¼ »'h³P{Ê@sn½»éõ@‘å e¹}Ø£<WõÁO’ XÁñö7ÇbU d¶äFÛqÊn—ú ¯E‘¯ÊX*IÈÎØTØ„èûòÚÇÂ%N…Y~ÖÑþÀhYú„áÄ*bÂéyê\’/ Ñh¾öc¥æÒÑãÖŸÇ”áÓ#MôI+þ˜gÎs[¸1—±9¥ú™×„¢[8|×úÍí%÷ÊJ÷ŒÐÍUÿᙨ‰ã=¹di‘¸Ô8 L5]£°+<õóî Þì+Ö •‚C´áõ…fiMŽþ<!}>ÖÆHJré|·ï•ó’’*Lö‡]KÈ®wÛ'7/š + “OÆèïb”£»$„ß#´ï_åË^BYUÕò£b z•âÁ¾M«Ø)E r)àÆÀQ¨¾i—¯J× >¨F;.@.Œ +œ¹Ëì™J‘Œ?±¸Â0í ,×fƒš¥‚®Pú±•´a ¨ Ž¦&¼/N"Þo,SÙžÚ©¶ Õ~2FN¥r¹#˜Í õm€o¬æCðfÓT…ÉPé¾IÁ~#ˆ)oÛå´\s=QÕ
â/= ¤4{ PÎ` ÏYuJN•¼JÄ/à +%¦j ý–Ïy´c땘ï,ÅàŠ3ž“þc3c$a²…{s†¶Ïƒ¢Òë6ùßÜ@¤c™2Ù½’ "Ód—§$ºNŒî%З¤K÷"#w>RdÝ<4O‹ ñoÞªÏ'¯>{´C=ÑåØ?”>WFƒ{ ËÁúydlõ«0U})¸Úl‘pì)¬ýα˜žIÙ<°¤kñÊG!å
tˆ ?ÚmÈP¢Í8z‘—uw¡Ðêaî¦ß³)ïe¦Ž¸bQëÆvÄ‚VU2㓆ÔÔ k)|j6t¿ße.
ÙË"èŒQƒMWP[ÿ\òHÙõd<½C– Î!›ÉIÉuô
ê»Üƒ }cr$¼´`’“†¦PöX‰¾è—–X-Xü³5V~ºÞVâµF;«ó#ìGÍD¯€ÎàKêM
õ yû`ÊÂcð…º¿¸´6†çÏ®ß4õìÎfl ?£i!e5¿bßg>Õ{û9A ® ”rÁ +Ù*¬×'5 öƺiz®„‰Ýf ++Hê!±
®Ëö'Óä +ÄŠ§h÷„Ü{É=Âݶ¡øU^–ÀàžèUSœíê±¼ÛgéE¦oDs?X™W ß^®‹
B¾Óÿ…X÷Y(6ËCÊqZnÁëà¹Ïë- ú1ÿžæxñ˜²[ö©÷VŠ¨dm1i0½ûùPšÒNövHûs úat=§ +©gÖ<L®CRÁÐöŠn,ÆXcñµ;W«`S¶"Sÿ·ˆò¥“O‡˜E +eð5²v'úå„a(»¤Æ#r)†‰çðøË6 -E£Í5øÊ÷5†ßý+f¨] ¾Â.ª…¥ábAðó³òþ7_†« ¡Å=ÚEÎ _k•-ó%AQIH„ ¦Æ.%í‚Dêä\n4[*37]ÈÉr4é*–›
V7m‡n¿‚òF#²À›ô,y*oö#¨“÷©$Î9f¬ÒÏRÒÙþ\ͪL0¥Ü¦Ò>6 1ðòê/6]³äv®µZ +_ ¸¨Àé«ì1ßRmþåEÆ„üPñ s KªP=.¸#`@—ˆ>Qô›ð»Â¯_ƶ„íd¢ôN3×'M˜.ÆFrÔQ?žI$µ _«°ú ã¸åÓ 1æOÊÊ; "ŽÀîÈ?²îw ó:FÅ“|/{;þ¯º”ðE*´V÷$ ÷PŸ†¼ï' E›£u!¾ $Hù+BŽ:´æô ˆŠ25íøµh Ö¦2Â1¿úO€¼ŸÙ§hémFƒjË [ÊÁsFó…ì±\.cá>—ócÛ—Ô+v©Àâ"Tû¸hõÖÉÅýLQH+VÊ +
jgìzï½È=dql£1ÓÖYkû^PÔ1 ¦\µU1…$:$a^טôNyãLl˜9‰ “Ý\Uäñ’E=Ì«}üñc×(Ÿ² ä»r¿Á¥E—j/&è;»Rß»•Sé#4¶ÇeQõ\G'.*ÞÁ8@g ` ÉWQ>æ‹—qåÍ6K±{ž0BÏMc×ûëжÜf¬¬¼ÑQر!kᣇ‚§›-9\: R‘ Må‡ C¶ Q›ÒRÛdšÔ$9WzC&Àç=²LƒzWuØ–`…IL €©
úÀ!Ç NãCZsüô J^ã"–ë ÂçíïY @ËA(>S9| ]|u
À+‹~³±ïL˜°Pš”ú®W ‘€ +õ‘%ßÅ Ù/»"
)´žTŽÑÙ^ì¿%.óR/ß2{ß¿)½†ÍŒÖúà
ýÆìuQ̼¶Ç¤±/×ÊWŸµÂÖ~¢® ¨ªÓDGë »+é,®ªÕòºY9ç#yÔÊý ²ûX£Ì9þMd4u_‹´ÜÁïy¢¿˜¢Ñ#é©jr¥m—Ÿ¹iŦ—劒*Ã!= C˯ëCÍ>*78ö<žã$`V!”¹äÞÜÁš¯Ä®x8ˆ"‡cÍúÆâB“ˆYíHu›ö(
Áz
¢ +ïà`í ír⺰¹ò4r–ú¥ÍÃ_»øf¤¤ï§cžç¢&ô˜BoÂÕ¤7YÜ;ôXæëõsb‹W…«L9 ž:=\Þ« jö¾2–œÐÍ¡§³T®n1‡VtÈÓ¾LÌCôŽÕì=Ë÷ù”°tT¥×ÕÖz…ñ$YZ<*4<†¯i¤&A&Ùõ.˜n•ÇDÿ,égüáHÄ|‡ñ¶™µ“EÙ:O¹™6§ª ŸHÚVW̨VˆSLĺð˜ÖH9%Ä®qdÄÍi²Ý¸faîxqvÅøw»…d%uó¢0ÉÝœÖ|U’vKãº6öøÌ@!wJE÷²t!Ä möˆ ûjVÓç[Brøj'Y×öÂNY +ˆ ƒ÷ÎÁõs½/’ÛÖ[0ø´ÊßxÃ/¢µÚô"ü(Nc&uy âEB:\>è³€v¿/èzw–>Œ¸¸ÙŸ3©å5¶é¿U@<!%^>ÓÁ£*8Ë•ÇN#ü^.¡ èFj$eoq`Ì^r¦ è8OoLe¾À ´¿öùh `üLêEW*« +uóÁBˆ‹Ûª–õ›ãðü†Ké|^ŸØ$ ÉÃö¬:ÿÊêÞYdäÌZõ[nðIZ¥ïƒ&ýMp‰£5ž×@ÄqÙ·dsá×mSY#Oô‡àáiÅÅžØ'u0övFä„ùžP( 1•}äG&ý&Ûrô€ÂŽXtc†BZsÔŒ¹h
Mvi1ž¡!„ÍcýI‚#Z«ÆOv5„±^0)ùû¼™T8
ÿLñ/÷ßÓª"cÉ\Uå»°8Z›8´ŠÂcçÞ +Î(ÒÚO¨²?1ÐDµò r8!´õ™D±h’ úÓM~ϟǽ²…ë†î~µôqÜEÌ Ã7)e§Ì£ÏâCÆ'C _{/[ߪÆ>O +º íää +ŸNvYÞb¡‘±#Æ™uiÃØþáòD„Jº
õJÌ)±ùQ'óŽéE½•+lx—.U!’o4Pe†»> ½güÏ/ hß÷
VŽO~^ÔÌðåHàj!Ï_®!‰7¡†:£L[‘xs¡°öJƒu-{—mR” ãÜ>1]ÃdKFq¸7}æ@,¶¼-Ç¢ÎÀCþ¨Ù³GìA YJ§øÕöú (Í¥ãX¶2À{ÅõÚ¬Çú=A$ÓbPI²4¯‰x¾V„÷c½áÄUŒì‚ü¸Úº»H!õ +.ø@úo‰.Aµˆ¤l”é +ZC¾“üxŠ>èï‡P‡ˆ%<ý`TTþ<¸¹Ã¨ò~ROI¯Hµ•·?}ñ7lymþÕ‘¼%-€†|~‘ @˜†l +û¬D¤Aôù ÙL—[€EfZæTV û=ÞžWðó‹OõtG 6ódìøÒfÜ _J‡ÁöR*iÖƒ¶_Yx}|!.ü9l½~ÓËöžû–4)¾ÜS¿4ØX½½ïü1Xš¹•.Ä!O 8×û…m^üÞ£ql1. ü‘B&xdûÎ !<ÏH›?©³ Kì›ÇAà’° ü‰‡3ÌXo² °2fËÔáê.•I¹Fÿqš.ÜJ’ŽŽý¨Ï;µä€Ø”ue ½ãVX ä¯u¢èLJ{BÖ´Æ ±ˆèŒ×°ìÇíç&íò-MÁÏÌ b²á—“U df»[{¯â…LˆÌCü¬¸"ƒƒ‹ '‘‡x’cEµõ]G¶ò¦‘îiæs*Íd&„ç•ÝÖskÍ6ÓåøQsèNíË°k—ËìÉ_ßoQ ƒ.ßaÌ/ÁsœSè×òy® ëW žc.©h–C>½t>!
|x 4oÊ°úÀ׃ Õ,o-LaºA7Í°Í7)äó3̆VfŽ$ 0T¸Ÿ9 +ÚŸ¸\@!#^dcÉqæ’ù-$ õR‹ÛGÐÑ‚ÄOL!¢köæV¡Rî6æÎrMˆã'¨_dœjÜõŽ»¢'Š@z£æìôü,–NÌüua„¥¤|a¬hž~"^$6Â^°|ÒR4€†ž 0©Vb"óãÏ ž‹#A†L6G²»0…
Â3ê6ùD ¿‰‚9È\Dá:ÄûR(¸ë?}= $7zOª ‘—?…!<تyë<Í÷Æ
Qš?ab{¹F +Mp.Þý©\B„$–AìÔ‡‡ }Õ»X¤ ñé £×B?¢)ÚãŸ@´Æ ï 4pÒSËý +±5Á¿Z¶ & +Æ<H)]Ì{Á}꺽0<aÔÔ.’mWâ#ªš,)=Îܘ’)nÞ ˆ=@öõÕ<jÔÜId¶QГörº+ž¸7rªXb D¡jºçÆœùaŽG¨¸Y/°kÀµl"%¢´™º:ô7“ˆucË©èÎi½ÔzZãß 'W‚Qn&Z¡gßè!ÕÓ<¤Ý¯/Ú€àuÖXž·0‹ f_6ÕaZÀv`M¨¹ª—1bvÕIü‚Jn.ðK5bø½ÏÿãΔ<élS+1ïµÁQ¶ì…Æ7õWv[¸!MEXZ 3tŠ·`~¶ý¢fìZp‹.fõ»c2 p&«7^ö#ô ¾èÓ ÙÖ)xµ¸åí ]££Áµnešc›JÛŠÜ|g³v$BÀ!W’Œ ¸U¯èÎViÝ +§vÉ×%’Hð«.3„ŠŽX.òï˜ÀlŽ²HñÍgÅ«ÊFýri4(}õÑH!çDCOÌ|Iuúà%%Î%³“r)¹X!’ =t’ ¡“S£*b¼iV½è6À.?ªQ7¬¦}jRÁšm‘ œÇäÖ•ÇpyNL0¤ÝñÜ öè@³Î¾áµ’2רcíågE*ÉR™Ò\'›˜bàáÂw½v0Å8<'Ì÷’B'Ýg‚§ îŒÁÒ›=¹Bäw^ûÝ¿`³Ø<9øMä\5ö5ø•ÂñWÈ=˜XV’¸ …yô„i 6-úDA8qN!ÍŸ$ öÊ“ó1 ÔV¯çÁ¡(³h—µM±wæ=Ò>zoØMé`w%óäû›Õ R÷bO飅Žê >‘ÍZtuùª£F&¼O¿NAJȼWêÉïÁJƒ6‹¨ÌjéE¶~‚ÇÑAxH:ð0î֦̽×A{5ë?]ñ-|Ùë{É·"|ÆÑQÿŠ D™X<èkeà 8êª=§fÀ¦ •[ä<wÐÍ$YÆeÀWw©Ž…Nƺä
÷}‡è4 ×ä+Z—¥dáh½óÙ¢·Ö!WŽt×…³\|çû3[ÇÍÊ´ú«ÃyÓ +6 eœn&`±Òj¿ŠäzM’äÙõDè.TbaY˜‚ì!Ɖo36ðõ‘nFk„§‹pi›ÇýÄŠ»iÈt‹Ç®:Ó5º²0“¼/ºI´„S yÕïɤrJÝyúì¡áùU4¤éB,¯˜”éZö} +Y4=ÊB<7ïm覯üë÷¯Ji/¶ Ov¾“…8·-’¿láöiEçh¤3Ókɹ[x)ŠcÝk™½¸CþÑy…Œ ¨Ÿå3j¦§Õ5͈WÝç 9XÁ,2n<ÓK{ (¶P2“ÀŸ^Ši’;VèìVúJ)'¬ð°<ô¸O±Ó_ì'Ñ« FX7Ó +4çv웞îãU:ûò¤]ªzrÔîtäÆ?+ÂÀ½ÀÚŸ“rñ\2V,†mg«@bøÂBòØÄ*†N½àgÓb~õÛ_æ<žo²,Bÿ§X``âN¿aÕ )`Ѧàt8hOÐ=Ð
‰CálC4ƒÌN©Éce)Aù1éËua‹¿nôDW“ôÁëªj!±”/À·vy²ôI¾ 售݉¨hß[sÌÌóo|ð›êÃß.£VƒžóG½|VÚš\ä‘®X+¶J`sEsߧ¬Ðû´Ú0§Ø ¥‚ÔÑ {8–À}µ‘~
;¶M”¬A?¨Èˆ +‘MËÂ)ÚJìyï’ ç›¾°+ÛAX•¡<UuÆEÁ°ý”Ï©S«³ óõå0þ +èP…ÃR œüZþ¸» ÈÚ—F*þ/\<>c 43‰0ÿB¯u !u•ŒA¿8ÊNÎØÙùªycPÏ¢/’ ü䄆¬äÊfI˜vÐi}°´ù
1Úd„fÍ9~%Ù ’Ã"´ÕÅkƒR†à<Q9˜ñ&å÷ìôNJì +ü•Ä;÷´ìCc6g¨FÏ 6Z¸ñOÉ4nFíÌæ@Ÿ(’j½9ÌRi|ûÄ«ÎÙ 8-J_ŸW䛉n¤ÜLá J¯:³Ú l
j])Tʸ—iÉd8r×KÕT˜²†÷A«—h,‰BuÖƒ}͹‹Sðé€mWõv¬Âë•h
+Úþö…G «I.& â ´<¼Xh +¿ˆi_þ´° z`?ªÃÖRf|°¦ˆŸÆúµ~š^Ú¯x¸m)h³zã%ÚºH—ªíAéºl…Ý”ç68c`Gàw©XŠï[=Ƹç(àï–†ãß/ìת}ÅÙ+¹†¥!\ +ÒTÅË£A}f–ü™‚Ï$±*AËý¬zï„ži'É ‰kê–8º[ÎÂ!w@ìfsñj àd€‡XH+ýèNY}a K:Pä + Š€øÞ à ÕƒöEñnhóJ×T—öД‡B!p±•ù¦—l“{^.¯Ð ±LíìØK˜Ê9ˆGxC‹€U¼VX–ììÆ©škð*û}¡ó ŽÌTÝF[|¨ÔõÙa—UÃÔÆöIœ¯ÁVÔ æ é„7½&$¡N‰pˆ®Ç}E÷Å r{UchX•è'Mí¶Ì—ä$,ŸëeÞ·ž1ÍK™•aFïá{, -ÓÀ‹*øg• ŸÚ6`F…LÎsîã$’tdÜÜØy”®Ç¢%šð¶1W´ËL
Ñ, uþ©löW' ¸nºó ³«öÒpÓºåÓfŽ¶ª¿sKn?]j‚°Ï Ó¿¡gæGˆÀhfÙ{Ô¾ Ô‰í’MPŽEoødx€Q²t•y Q
”î§V¤óMÇL9‘5òh°À!eŸ•¶¸¶ù8¬«”{†ÔuQ°b‰¹BM‹sÙ²É “ÿÆÌ]ƒ Î ôvÍ&Ì‹Ï‘'½8«“’ã*I5«6i²Ë iw ®š@¯Œ! e$}‚s¾{‰ÏÑëŽ!!cPGÛD<À-€s_|ùbò´ùAðËQó‡ú-š"ñŽÓ&”Ø5‚µ3~‚Šz½òh!Îi‚é!ƒ³ÈÒ"s‡¹;o˜n¨Ë¼
8þßÆ ”$'U© +v.Z[våe±àÞ¦§°†`G‡·^—‘žÄR…ÒǺOƒò^ØÔ bŽeõþ™ŠÄÀ.2¿AÏ»bÁ²¨¹zYÛbÛÙR8ÕohrZG’Äý2 +’ k~ºk ´, x™-宬¬HÖì FÉÞ NžŒ„_ ð3¡¬yÀ=ΑYÄCç²(/ï?çïIþÝRˆ²¨è‹[_³r'Ÿ‰T™' ´7”X‡€ *ÿ| xÖrlŒIìèUFìžovñBW¨é±½5à+[™ƒã·¼Éú×»„&+åœÀ´±Ùg/<R4:ë&ŒCG"ëiŒTâM•3_ßw¥èùiExZÔt»ËŽ´Š<«7@µzi|ÜŽÄmÜb3]²?4¯ƒMÐê)ÀžX~j8«'Œ½sWst’g9èáѨVóìëî À–Ës<|ÚËò!Ø!í®©±¡–¸ªŒ6Õ¸ð‡Ê…²¡ŒîÛÊX©|¨_=›Lè£ØÏÇÿ\RS³îwŸ";Og0N¨ã/Tl0ýu[£HÕú¹ðλœ}¾f-õaÌâ{ºGüyèQÔïÊ‚´q¨Gγ *{b¦¸¿ŸÞ¤~+6C¡¤Ê:j]9Ýô¼w©Ûبþ4õ6Ä^
@+µ ¡‰¶°l;âÌdýdRCúN'æ“DÀ UzF9ù ʳ>XJ ²éžÿõs.noÙa“’cÒ;c»öZ:ckJc£S… +Ò§ôSëÓ&áî` âìð2«oÜ“ýÛ²z6µÚÚ±] 9̲MŒ¸#úSýª½©@Âs]¥`Þt :õ¢q“ÙtìwnÒä˜×j¡ +Ò¨tWj¶q,£Oí×Aò*úüßMî´tùó—ã´Q)VÅ1Íѽ»y§ÑÁL™¸Áì$Ó~ݯãvÔå\ƒóû ÝÓTùœJ̹`¿ÅŸ +ÛÎØ,kc4Üò9¨3~`"Q€p
¶¥Î6…y»L3ñ|h k$XÀMÁ=3Èš„ƒÆ8¯ó÷øúãÁW æ§ËH‘þ#9Lñ>Àü‹t ú“ïüú†Çåħ Ù§=Gß™nÚ[ù²kcñ>þþci˜˜0±½ ýÖ$dï4ï–7ƒIÉ=&ß’(LaË<ü;±!
O$caf%ïâõžvefÁþc›k ?2H·Dâ"V•Áó §›#„ M韤ãب—ý™Å¨A·”€JJmu`Uß K±ýj”ùŠ÷Þ£Ê ä€ÛïÖ/ÊÞ?H_]x3áÂýsÞV +v£–%·;®ÄÙùÈ[Úãèß( v~݆¥À ¹ &=/{±¡MJ‡³ã™ # ªCò¤›SOæÈ :I»ñ£WX{Ì5ö%{›ñp2‚D{j)Ë©‰ë8tT˜FËûU56…¸×¤à 6ž]¼Æ˜6sÃ2ôk£ªXÙ?"Wª¨T&ãUÖÒÊŽU&iÃÓØKwzK‘^ :àra‚_Ò‡mJ¯H d—&—q̪·Ïöz—7QÑÂÅ'ø ¡‘Ô”|w»Xõ©·>uC·Óè/™¾¨öƒ¦»Úéî–÷üoýËYtpqSù¡l¥®qõãõª9¿"Mq†ï³€xºôEÅŸK·š‚¸ x÷O¢&Sƒ:À!ÏbÖñP|iÁSG³hlÌ0Ðl†˜/?Êg°‘ê§4F ½ OÒ +¬5]“–Bþüd?Ã!Èa)±Ÿ UwW¬•×½é·@LôƒoÑ|p¨ôÞŒú˜Ë°Ôð¢‰OØžfŠ\ãà9]ËšJȪÈZ¾P„ðôùPŒ&†®_vǢ噗b;ú-aéÆÉJ
ºœÕ7 ÈZœZ'ó¥ ÂSïtj‹¬¯ÌÉÊ[3Ù?–¤2 ßli|˜µ…Ü©†ÏÉWßg9D ‘ÉÞÌŽüß×âÙ¶üô&‹÷‹òBø»&‚áa!ìëky`¢4¬[(TP¤[î_ ±K"b·q>ë†L/ozÍ°~ŠFp@8uªÉJ;EFn$Œ© +€^A%CÛåÜLrjùY¢žÜn\4ìZàT2'c6ê +½‡?„i¬yè-†ÇŹ(Tv–lè4Ä¢TÁÀô>\Jf>jϘøaøÀ1•Ü< m§afæ»'Nê8¹kðèR ž;|(¦b.@nz# g[Á°½™nÙ¸œLz¤Zõ’Êáa+ÿ|ÿ)\ØÇKΰ‰b0ÕªcÓ,îó5Q5²Fg:Ë$nÅáÕÒõÎ €Ð<‹OŠsº²ÝÙÿDÃO´0yw·„¥ÇÊ2ø½=
Ó{ú¾í‰±Áh%‡òRsÛUc"g×>ÈZô3MÃà^ÒË«gÔQ™¯£—k½5ÖCÍôòíyÇtÛÔ¨Ù`X¼’ã$’¦½$85Éi7ÍdWꙩ/A BI±Õ燷Ö\šÃbEPE «Î~øxâ;p6Ú5´£„ÂÄ|öÊ~Û`¶\3þ'q¤ÃsáÖZ wüÈé.4v/'Áxjµ¾%Y3†
#óÇ6¬æìy|^Aj¯ä–Û4ÒÆÕˆÉ é +V®ØäÊÕtßJ¿Ú™\z?K*¸6¥!ÑH³Á½Ù¥‹Lº|_‹MœMI¹ $ Ö›»Zƒ¼ ¡¹ ’uºKÅ“ž +·ìÛû 'ãD¸Ø“²x};èþÓ–‡úŒ4D'P{”òeéø÷ÊÏÍùøëjˆ¬“q~½©ýë¼ñ<ZxàM>Ê€·ÅV¥V˜OëüÃwK,-èÄJ„¨Ôq®ÐÍ°î +sþo§ý™ +#¶cër!¡W = „´*¯g±+¡‘À#es_‹,2™ÊãœP+ÒpuMYÖP/ºÈ˜ü‰ ‰;°>Û[¼”ZDñ½"ºßoÅq™Ü +èEHÁU 1u”mLz‘ìåÃh p;ÞAåO‚¼ïw2}íÞ–!F¦†Ÿ’)fmûì‚Àü M½ÿÌ{<ÇRÚÖ[…§—Ëu
Íc_Tž†t¾Ö“Þ©Û÷ŠUé„òPZÜ~›…–nX õCg › +ÌãR7ù†æ9`ŠÌy8”5bX%2Z}ššÖ<.Ÿ3 9‹o§œgéJ€’Ï Âá·‡GæõÙI°g Ù[ããÅ)d½ T¥1vÙÍÅï<wú¤ãïWÖLœš‚ œ†ÇØâ3:Wª}ѪìpH¦Ü|œ@l¯÷ŸS8 ±åëz,††ý;x âMJšÎH#œxå8Ÿˆ„‘Þ¬ÝçÎQøù—ÈÞyK|8aç*Asabvª†ž˜L)"Ù ÷¾¤B,ƒšqe>>þ$h(O®Ó=Æòè:ià·ãa(×ÆÞc1}œSBª=9›öÁï‰âòí§ÇØã®LYÛÃ%¸ö9¶Z³cçÔ%ו<7oø÷¯÷pn=¢+‚t³@wFQ´-Zå§;VIÿòÉòœ›¯ÀémÂYªíÎ)[HZe4;ä]æIÚ1Ô +ë¶ÓÍeÖå W[ v»óœ ¨ý³®èM6W(Js:L9þfzoÇÕÊåÄôq7ùX›§¥å;#=)GMjÓ§§°ó>7W7WB±Ú[·ùÿz¨w&"L>bq\½·„Ѫ~yQÕák Í«.·úû˜¿W?¬>¥¢¡@#r’ô-”‹Ea]eãò£»JÅ™|šŒ3’ÞR£ˆÉ½ÕÐüJåñDáÃhºÂ’ð‹²wíª[*Øà©r‚kº4\¾`fÜ^î
?d:ÍûEËf™³¤‹M”ÖCÓ„osCü>Kñ• ¹4ÉÀOõ 62|3ÑÎyõž=¹»ú1¿¾^ž®´—Ÿ5 x´ !'„ú÷On,‡ÒoÝy€ùbº…q²{m Ì ±ÓOkÏx†E+ÆÖÒ7ó!xìòŒF™³0¬·«H{¨˜þMû¾É^Ù^ÍIösìëôòC¨Ÿ/`u¨QwO¸øˆ”zŠãDÆFgÃî43ö¼š…¨{ÑÐ÷ É`²lAoÄšCÅôìc #sˆƒ6>Êjv*AjNeMx‰@³ÓÆÅ£4ìæh7ÀP–gÂýÿµ3çÿL0 +Áiz“æÚæ†Á‰²ÍÕ²Ïm7ZÄUé×4(ê6•…zÌŒ¢PMpêÑýה¤ù†Ô(Y«»kªWÀî! `Ê£mbÄ¥„qgˆœíF2X3ó£æo_ÞdõÍd¥:»T˹’E€-ä{.1ëÉ +dÜp®ÈVã _¨¦ 1³å{?î:Wõß~Šœ©"LùQjƒÖ±:KY5bx„6Úb ÿÃÖë lƒx¢¥
~¥,£Y§Ê½I|çȨ!VÃ3µÓÂzG#•¦n4’£Ç¦ßÒù»oôu¶Ô~«Ó +7Ÿ+ó²Vï„(a=ÔÅ>\M!†rµmè÷È% +^&ÍËâJ €°—Ô²?\9¼h¢Y§!¥EÇÊ·<§ý#QÇÿ9ÚQ ·nº Ý's,ÂøŽ”¢y–’Þõ¥«½ËÆ ð›_ÙïϳŠ5NÒë%Àv<¡¡ûÈ<{šOS*%älõËU¤¿\"•e †tçù›ß© s°tvܘ´t»Ç(Ìv« k‹qµ÷³ƒø™l9^÷k%}+o µ©´£‹rü R·JôQ3ül^{´v;¥ r‡³°åg3¯¢Æ†’¢Ó¢\[#²Z̉ˆfû½Ç|(„›°ö 5ÏL‹d•ŠîhŠÆ.5TËúé䦆zp׬ó•Ó rMΩÄq¥r.œðÜ´›‘À4€áÜjÿ%®ÿÿh endobj -1238 0 obj << +1253 0 obj << /Type /Font /Subtype /Type1 -/Encoding 2737 0 R +/Encoding 2807 0 R /FirstChar 34 /LastChar 125 -/Widths 2747 0 R -/BaseFont /SKQYOC+NimbusMonL-Bold -/FontDescriptor 1236 0 R +/Widths 2817 0 R +/BaseFont /KDQUIR+NimbusMonL-Bold +/FontDescriptor 1251 0 R >> endobj -1236 0 obj << +1251 0 obj << /Ascent 624 /CapHeight 552 /Descent -126 -/FontName /SKQYOC+NimbusMonL-Bold +/FontName /KDQUIR+NimbusMonL-Bold /ItalicAngle 0 /StemV 101 /XHeight 439 /FontBBox [-43 -278 681 871] /Flags 4 -/CharSet (/quotedbl/numbersign/quoteright/plus/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/at/A/B/C/D/E/F/G/H/I/K/M/N/O/R/S/T/W/Z/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright) -/FontFile 1237 0 R +/CharSet (/quotedbl/numbersign/quoteright/parenleft/parenright/plus/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/at/A/B/C/D/E/F/G/H/I/K/M/N/O/R/S/T/W/Z/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright) +/FontFile 1252 0 R >> endobj -2747 0 obj -[600 600 0 0 0 600 0 0 0 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 0 600 0 0 600 600 600 600 600 600 600 600 600 600 0 600 0 600 600 600 0 0 600 600 600 0 0 600 0 0 600 600 0 600 0 0 0 600 600 600 600 600 600 600 600 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 ] +2817 0 obj +[600 600 0 0 0 600 600 600 0 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 0 600 0 0 600 600 600 600 600 600 600 600 600 600 0 600 0 600 600 600 0 0 600 600 600 0 0 600 0 0 600 600 0 600 0 0 0 600 600 600 600 600 600 600 600 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 ] endobj -1217 0 obj << +1232 0 obj << /Length1 1612 /Length2 18918 /Length3 532 @@ -13795,7 +14263,7 @@ xÚ¬¶eTœÝÖ%ŠCpw),¸www÷ wNpww÷ økd‡§¤u»€ìíÄŒ]€< `e°pssÃSDí <@–. -tøÇEp +tøÇEp ÐÖ¿¶qÒí2”"¥ŸjFy_ÎÉmBép0kìo)«”¼ÁM´}s‚»|¤ñ'w+ðǤxp@ö5Mý‹ÕŽÚ†^Wxrú5ñèñêÏðà@×5tÏ ]NìJ^7(¤¯‘þŽ9‚:ê•Þá40éMˆ×— $šÞy”ø¶r/Jù+vroIÐé‚|‰òNR-{UZØW3‘|‰ÜÓ¹Ÿ«®”âÎ8|M„ãA½7SÖA“™°?‰î!®¨{üëlkh_zsg'•ÛKº7ÃìQ23 †»V!‹¶88Szé-ŠÈZßʲÃìb“ÿ<Ìišð·uO[מʙåê;Õeâ*1žü =Æ:nâ(4n¼ë—jºÒQ•"/>Uöló½ˆtë% ˆ/÷€{`‰ÔÒE¨N»cj,Uoo–›U{Lê,þòÛ’`>8[œÂ—;1Œ"Ž Ûd6k$T÷ó¤ï0ÃcÃ=ò8Àëø‡ë l2ø©ÙB ÿ-NE>…°VQ?SÛ׊Û_ZßjcxÊSH£k‹ _G–‘'²Âøøc±£ ~´½ Àë5ر3ìä=Í’ù9õC[¿êŽX? Cz!‹YÀGóµgàÝzŽD7 8’(GD¹‚Hñ%.fjM ýÈ#§:Ð YœƒN o‰ÓûFp=)I%ú&Ç.½Ù™£J©³k´ ¾< ý6K†#„Rcxü¸ @@ -13870,153 +14338,156 @@ M¡„£ÉãB¤&vIA{}ɨüØ?òXcçR&YØÜ„*3cµ,;S˜©fKnLXӌȊeL§KSü,‘Ó .ýï)•òýX©"pnüÁúþ î_æ7KbËͤ\Þâ?MÃòõ¬Î±Iž9ˆSïfâúó’Í¢qÖcU…D”R&ºP8ÐÌÉq‘púÛS¦™¾ì§Ó@K¹¥í2y4,à nzñ~†Šù ÝB‡âw¡8²X7Õ…VËƶê
ÿ/HñÛ‡8ž4ŸŒ[½‰;[ ]άT ¼HŠ¢oŒRUÚ÷q§X ‘ôö }‘÷S·‡¨õ`Yœød2¦ÐyÔ¾õ\¼Ã1?a#ò£uÄT!šÃZG=Q’›ü×Î]ÐÖc›9/±§dÒœ…i¬¬ õZ§¯‘6’4Lv+åÆË È/¾{Vsü ¡æ;¥5Þ‹ÉÙ“÷°KqÐ@-Âú¥˜UJð¹;ÑÓn ïŽéU/ "%ó<Ä Ý{ŸÉÖéFq+£ ¿
ªÎòêžëÍxì¯÷ŸQg›a+q%²½[ƒFe$™Mí%¸³År@ ]CÆ"pI“:%?0F»X¸_¥fÌN1¶Î®HŒ¹\Y2¾{Íï!"¹´èÊ6fB®“»Åõè¤ÑO0–0¿Hú^˜4WíagUv;Ö—FñIôüzçõYˆØýÂè`²ËÁ¬€óÈ5è”CPWžà¾2‰ssFHâzS汕˳ŒÍ¤ }<.ëÙiµD{ä \Ì£º9! özד!î0Š²÷V;Ö&Ké¯(MœV}îüøQècL“ÈÒÎ3ïAT‹ ëê×ŸÌ &Ê'g®çÅVÆ´FÚÞùÊy¢tc¬óºøÒ-yfgA‘zTz¼ì®øŽ-:y@ƒ¥±ÿ\¸"•?PVÏWÕE†È3Ê lDK\$UÔw¬>rß©Dè%<»Õ ìÚW”åv\ÏÓŒ ø¿€§Jœ‹ê¸ -A}Ü[®L¼«#²GŽ_aâÍ¿KH¤ŸŸ‰‚h
¼ª»,_&½òîoy£pB7vKŽ£¬NhÄO1û_¦¾¶®rD™91Üð)ÍÞºsùTAÍöæ÷Ý¥éëc5?Í‚ÒÚ.îçþy;4Ûú/¡üà"€ps°óòñxeç…¤ü hq?endstream +A}Ü[®L¼«#²GŽ_aâÍ¿KH¤ŸŸ‰‚h
¼ª»,_&½òîoy£pB7vKŽ£¬NhÄO1û_¦¾¶®rD™91Üð)ÍÞºsùTAÍöæ÷Ý¥éëc5?Í‚ÒÚ.îçþy;4Ûú/¡üà"€ps°óòñxeç…¤ü?qCendstream endobj -1218 0 obj << +1233 0 obj << /Type /Font /Subtype /Type1 -/Encoding 2737 0 R +/Encoding 2807 0 R /FirstChar 33 /LastChar 125 -/Widths 2748 0 R -/BaseFont /FFPUNJ+NimbusMonL-Regu -/FontDescriptor 1216 0 R +/Widths 2818 0 R +/BaseFont /JNKLIU+NimbusMonL-Regu +/FontDescriptor 1231 0 R >> endobj -1216 0 obj << +1231 0 obj << /Ascent 625 /CapHeight 557 /Descent -147 -/FontName /FFPUNJ+NimbusMonL-Regu +/FontName /JNKLIU+NimbusMonL-Regu /ItalicAngle 0 /StemV 41 /XHeight 426 /FontBBox [-12 -237 650 811] /Flags 4 /CharSet (/exclam/quotedbl/numbersign/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/backslash/bracketright/underscore/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright) -/FontFile 1217 0 R +/FontFile 1232 0 R >> endobj -2748 0 obj +2818 0 obj [600 600 600 600 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 0 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 ] endobj -1160 0 obj << +1172 0 obj << /Length1 1620 /Length2 20127 /Length3 532 -/Length 21036 +/Length 21035 /Filter /FlateDecode >> stream -xÚ¬ºct¤]·. Ûv*I§cul' ÛFÅNÅFǶm۶͎í¤cwý¼ï·÷>cŸóëœý£jÜk^s^×Zë 5FQ’)ª0›Ú%ìí@ ,ŒÌ< -ükì{ýÒÂv¹+
?j06Íðün÷X>wø<”¦=ëñ¡êM^çùPÐô o}íä¤; -dÒ/EN¿ÐˆòºY’ÝÒæ`V?Ú›RRÖ/ù€!žédu‚»y¦ñ§p-ðÇúòä€âk’Ú‹Ý…Ö†QWx~ñ5ñôù‰jh|td¸÷ºÿ.'ž’× -ùk¤¿c¡ ¶Z…xUó«óö”ê&BÏØ>Ÿ¿ù‡PvE‘妷‚ïÕàO͘ƒá†Àl¬„ÔÈW"æþx²
ãŽïIx%Q¼Kâf† Îo¿møWcwúŸò‚‘ßÄÎ׊ü;L§Ö‘;æT° £6®ãGvíÌÓ.õ=n¾Õ.7èX¬JÌ[ÃZUýùbªÜ Á+_®›xF»-b¨À( ¥ã©ƒw¸ÜÄ$Ì Ó…
(_,Ó ¡Ã4ŒS4r-Ù“©¾ˆ3‚2Ž‰ŒŽ$¿ dô“„}¼Dä9%G¹<á¬;Ö6®£ÛA‘œ´Øpÿ (wßöìWŸ .S?62=ú0z ‘ßãš@΀ƒëì˜ç3¹>9È%æÒðOÞ`zŒ—6"Aïܪ“³ ÖSª Ò¼qRÉŒ!ÝMë–›Å/˜6 pöpò>ÙOBˆÁrêO<õlb‚‡ˆà\jÑhŽ!··qè™•íº”…u=5±—ª——‡³ŸG¿:×KÎ{òɵÅéKœJC·ÒBµ¾/) qpgŸ”µí‚ ¨•ŠgœuºœÚ]_ÕÞ´c¸Cûô¿Y‹ü n¿3Ç aÉ»ðSr -o(:¨Ñ_‚å¤ñOFõØI)Q’l¤®‰Í;TÜ*kÀ2ñ´Ò(ÏË2+Õ»ÐÝé¾›äAM¾×Q?A"tto¯$ÏÊAœÇ;tÎB¾ã¢ü1jþUxq¨eÓÒäþtþcÉTI€3!š@X芆eÎ^í'a‚†:U+“òÀÅ$˜ ‹EÕùÆ -a®;?o®åü+L7O7¹uv¤ÓuÞ̸¶çŽNóæî™Éñ¢ÊÏC°¶ŠæЂÚ\„P¼®ˆ™ß¢ ’ 1âÊ¢Þ zO&É·c튩ȗ©7•Á¼G}Žúäñʬ!FŠd1‚_mÅ€th¬×Ÿ2°?X¶'91îî»(RŒæËÜF1”P (Ê·úí¼eô<syôA$”¨…³Z‡j?¡»½¤`y×Ê ›¤»€–ä…@3 éŒ 2äa MÊàT¬6¶†ÙÁÜßñÁ.ïs—f }ŠrõEKæË–4ÅJmþHž6î€ï^çÔtV-O4ë"²$ì2ƒë†`zê %ž¦,"þ¢ý_…Ù÷4Ô›øãö•÷ï¼f=hR àˆ¼®<|Ó$ddð£Ì…ÌËÖá‰ñq¸WœQÈGðdȾ×-&üäJ6fëÏurþq^KÐk\#º“4”ÿ8rÝäRlºQ -Æ9vrQÚûaÞßïèóQÝiç·Äjí(^& +
MÌäkRÐ<7÷u¾!+o¹-}iC¼ HBb×*1'O. Íþ~6'j ïó˜ñ+gt5û¢PV4घ¿Ô ÚóÔR¨s(S¡šq¹"yV‡ôîHvhp„3ëÜHG¹çòšu¼ÉÅQ›8 Ô%âÛU†w>ðÛgã‘Ûˆ}H}öE÷2 OöÑgí -‚7I•{œP¾©3½¥Œ/Ä[Ö[ªp«Cƒ’½f±cB8|* ×vÞ’(2M´:G‹çeƒ Àü‘H7þ 5'is=½ó{LXwÜëiì>Aº„ï=Ëo?F—Aµb©ÜħcL·¼ž…×›ÂY_‰g Ï¿¦©èe‘O5ÙÀܧâí/96]d±ÊPàH]~+B†<Ô•R–… €õ\ͯ©sðÑþrOŒ…[’½¸m+ þ¶ ø¶ý©>þ½ØRkn„´VÁÁE.ÉYSssF‘kÿ©Tââ.ŸŸ3hÈŽxÒµ¦ö–Ñ9õd¨HÎ6 -á]ô -ØI:ý}Ÿð…îŒr \Òv-`÷’¶»j³œ³·í} -]rSÓ|¬U]Iƒsuoé$½9¢c÷U¹“äx°Ð¶¾Ø¤Û‹«bÜIÅQ¶?³…á6.S¼à‡n|ÑG{×BõwK¢ »™( ‡§òq° 4Nq éåé»iÁ;í¶¹öU‘PÈœ¯æxÊ&ô•¤1S¶2ó¥w\·+zê›DJ´v¸$ÌLßò Èîk>^µ².L±¿²!ð4^¸“PÔ¿¦.¬äïŸ(¿'Ú¶£Pb¥i‘÷êzÝûDUoÀõQ -0E†IÃZ^ŠÿŽ¦Ö‚0›2%“ýJ§^ˆVÄÉk"y -4ÑÃ¥Ë2š=¥«UkW3G{—ð̪K¦¾(ÞØ–WŽÓÓü ý® 9’ã‘<džâö—ŠäÓ^Rƒÿ°PŠÊ·Zl—›Tj5¾9.¢"¥³f>89ùIÆvp3Ýé9çáCDq
€¯¹/W4=¹¶dopso´‘‡À1¶¬´’ møÚÉ6]ó|"쮘V»ÃJhO5‚°2Ó˱ ‡7Nß¼hC; -®@ê#^>«\×Ȳp‹Ç *, A_ÓðtÅ
âqÙb1?&}=Ä2ãÒ]óð€ÆžoÑG¡PL.]Bª¢E3ý7z®Æn¸c<®žepNwd¶\ñú"¯kÑ;ïX¨‹Ð€BgN}®²û àóÃÌòhkrŸÀ¶Gâ{°l:&j‘ñ™û
^òÕPkNÉ«±LÖñü«DÙj‹+Y9‚dÌœòÖ„Ê—6<€ôVcŠ§‹Íš‘Ýþ³¥SÕsiÚÚ¤Ûò>vü[Âë -Ð"$©p @zŸÖÐGƒ›‚·^_fñžtDPiÂñøËɘ.yÖÆÐó†·ÅDã^!¡¥ 1âóÜ,óšªiÖc.â4£ ÷LÛ}cN6\ÈÛ ÐC •Å?ÐÖÔØ5÷Ü tbgipO
‹¹shÛ tƒt{ J'uYÌ„ÕÑ’Z6è¬wßù/NÐÈy0¬Ö‚;g‹ÖZ 0….R; -*Èí´âT¸žfWÓ 3Õ'7)ÔYß= á!`ƒSé‰7ˆv¤U¿È!~{£Ø1Çœj÷àºßŨžG ]¬ßg•,½[
W,{ukRÿÔj•Å‚èÒ<’…æp_íÖ©ÛRV·((þ22ß Švó ÇÝl.ˆÏÜs/¬U¡¥&‚ko¾÷ñ@ÆÇÊ5V…jj¬a
`N}ÕÆêŽáOú -–ÙýÉvuöù ‹ª¥'NP -SèÇ´FÞ¦…ÛÏΚ13±©É'æz tƒÞm~ ¹Hº&¶Ñ~ñÍhŸŠpu ¢h^ Âc0xÆ(ë7\×[:‹¶q¢Íš-µj“’"z¾r §YJ÷-Ù6ÔïnnÔãõÍÌI·n ïS7ýö4¦ ¦ì¾•ôÈ@؈F9x&« s î|×`pu¡eF`{i~¶ÙƒË!$jmJt†œ/üaâ\èÎÅNià"û*±z˜Ãt3¬Gs€µ/Yn ~³1&¾âÆ0tYœVáqð(ê™w†—V†Ÿ÷ :·ÉóÇotxøí…*˜®ñ§õ‘á#Ms 9½C¨9ðtIL³òXˆ×íŠçÝ€îWÞ«Ê.’Âå݇Ӝ,7§©Ù7‚ÆQƒÄéèd`³Ú³“ t÷¾k
œM÷ûx}Pïïo\5Ö÷ ôC§Ÿ®Z*ïÏkm Rã̽oÙ° ?1DêñeÄ'Ÿ Æ à6…©jb6LÒë¦Xšá|—?÷tKÒ:6™Ëühï;¬p€Gˆ*z µ-Ox—oÂܽš°¶çÈÝÔÆ Ñb„,I£±½é¸NiÉõÇ{^èd–PL[‘îc±Ø™Q¯dZÃÙ&ËŽA¯î/Ú;!òùpÁBßÙsÝO‘ ΃3ײ³2¨%ÖuzøÄ[cé‘Ù§‰ÂïŠRfUÔ gçúW ·ºì;§Øø8ÍLŠ¨ék˜"¢¬tµ2¹ešò K¬ Á¾9c $rMe©€€Ô˜6T¡Ð‘1QçTè{O–ÅË]Ñ’f³ÕÓ9-©þR[0£Nk¾·ýµ„ ŽÏߨNïçÂ"?Gw~\“¬…XH”ã\lã¼Å_¡’”*GwQQBÁ9+§ªÁ¤Â¥à(-n›_Òx3“mì‚gU‘wµéíâߪv6ºÈ¯pÓ[óæ¢ I´2Ö6ß ‡×ÇëŸíIGûƒ—e<ªð1}xçªÀéž~ôá*@O€ô…¹É¶s—ê>‡Ú{#ØËz߈¹ç!žå<×Ó‹¦g=‘ÑGHö'²Ôe ȱóŽõµ“:…Ÿ‚ëR,q@õû´ùüqhŽN\VeÆdh„ɘB™Á m*QZ!cJeåMj…Ïòá#éå8;¡H‚ -¾zT…¢gôOÿ’‹Óo0-šÎ० ²ÂŠ ˜hÈ›9ÉÈ%m-ÜC7‚µ$©OãzAp9%mëƒf 7ìÄîâºÞNÍíOKB¯Wˆà/°´e¡ìÔáo~f›]{ˆðEŠ˜*ƒûN·G®²ÎÏ«Eô[‡ðQðu1ªÑÃ(X²ÁZû¨Âx5¤ 6™œ¹¯$ß's. 1߬)Ç^r‘au5nUG‘áŸÕÔ÷TÁzÀ½¦¬ÜÌ
léLd i\”aÐZj(ô ¬õ\œñ,ôS–W2ƒo³‡CÜ`eæí㦃F$êuÆz{†ÂÎK!K#$ -bÉbðúuÙ9ðeÞWs S†ÚINñE$ŒcD3>ä:ÝÔ%žÐçIr<Û½;åµV}$1â°ð ô£õmõ“¶)L£BòùP-PîÀ™ÑD|=ÜF—dã;õ…R^j ºßsÒcþRÖ'šîϳH¥¹¼+jìF+ò˜ªB~ÈCgÙ5ûë €UÓ(6 û˜Ý#̼v À£Äòq¥þ…äž“ZrtjŠoe|‚+ gÈb
ÇXxÞÈÍGŸ ÆÜ/bøc§èüv+ø²òkbˆ BFÛ;l'a¡|E]éü×6téC¿×0q‚M™±I0êÇ`ÇsZ+£.ÌgŠÊ)ùcs³½-ãVé¨Ý³· ††²¼&D̘ô”@¶Ý”ï³Oœ öø]¥ÿ]ƒÒ˜,±Î -q œ -Çp\=Nü¬4·· -d;uÌ’‘ÜsÛ„÷_]e pxßÁÀ: Ïhâî|k±·¾ö'nTdÇ2å2fu·0¼e}XÇc*IÃoô}xFe6;acÑÈîXúúË¥áær,–êœh¤/º9;`©®GÅ–°
,ÓH>%Oà"û|?éJ3iὓQ!Ef b«èDCõñd±Mðhˆ–Xµæϸ6ô#ñ†l»È…±ûsLóæßgél;µñÌ#% -‘¼GøCAÌÑð}¾€¶6Ç¢³V»þ\ƒ diKB´«ÙQïè.§~Þ‚´ÈÌ=ìäm’yS$ý-Ñ¥ªŽ¹P‚´)ke ÅÓnM¡Gã¶Ëu·5%¬_ØEçMŠKÒcƒ†Œ8 î5€Ã|5wìóµ Ô"öů£„²3ÇŸ³’œVÉ÷ - žóø.Ѩ\éd¥(š˜>¯–LãPÚ Ôš3,¿Ô16še¬»Û²˜BG»OåÜÏænPƵW‚®eoÁP×½'”@çßÒ KLýº-/ÞJ[ýŒxw]öG8förˆVƒÉsvÄþh;Ìšé£HÛFÏæ8w&_a†¶j¡ã÷q´r©Ý}~9ÃQ‡³¹ÃñQËöš‚¸¸ÅÒRŸv7Ý/ì ƒƒð+BgN2ãâj Òz ÂE‡`õfQ •8{ÆÁ9û»¨½qN5mc¯
gÀ<Åj½`ž@.vS;눂DÊknDÔš™˜±ºOZÖµÜÑ–HJ”ää&¶[óX= -<ÊîòÈYŸØìZ
Ê£÷íé™ùÈTxÇSêhD¯Óe{Ð’ÖMÂÒé* ’D#ôTtهͼÔ<~WêšÏ¯ ,Äѵ—úH LÆücœcyµ¼‡ÅÒîÇ<Ï EÇvž¹tú“H;:±[æ¥@B³CoјI3åÕŽ+´s«©Æ?™À“0”VðÍíÉ ¾¹Ùì ʃ¼ãAœ'7¶Æ Á&¢GL6öÝ¥ -Õ.¹YO¬êªœ©Û×™¥
o;å -ˆçŒ¼™¬ï›»E|ÜÌÐðXuãý–üÂ˨µÎ¯ˆr ‰¯ûV™ÆZù -ÙòsøeìÕÙÂ1Y¤tYv~ -³L7,òH -É_AWš…*QÙk4‹† ÊSg ïë}“æý
ÝH>•b5?þ‘ÄœbÇ‘þ[½²%?QÃÔu2NѼ5¯|F„=ktåÂnïìÈòæ‹ô'†<³Ç‡_Æn|Vœ “mpéU÷YX |NHô¥k Ê r O6ágÌf -SS˜K" -Ï~~C®x®'ñ0yÉ#ñÚºƒ.UŠq/öÑŸ˜*Îö¥ýµ 4 Çï `àImŠ´¦Ç”Ní.zßF6ù‰‘ ¡Dž³ ¢,t°Í(¸™8é±%iXK{Ëlò\‘Vñ}gx7wÏbðb¬½‰jÁ½`û'üNf ÌB ̴Я1fBÈŒ+%¹7¾CäKv ÇÑŽŠ¨'¶,³jvZÛÚ•¢lD¤È½Å‚…U? /rªìuGш¤5 9+òúøF´'Éûu£÷ÁO^C.¶ºó×?D¡ ú -Ë!«O$!*_— ‘} qufÖä2¿ÐAQ”¤ÂâWH,‘Z8gmÈÞ¨gA‘¸¶vaõ È”YÖ¹›‘k ( -á„%F<5Ÿ¼K»ç´Åö Û3Ó΄ÕÁŠÂ~çD7/âšÅ Œˆ¼êÇ™© E½ŽîûFí<gðSL2R\”˜um’|Ø¿ I"-‘ÊQ:‡‘w˜°ƒ„~U—ÒÛãäÚ"(ùy—k1WÀq r±·}§MNÉðɆa0’~åBnJèÔ$¶\
áyq!~Y!Ê`Eõâïá$ìµòs¹íÒfØT\à\þL -Pb”< pÂ*1oAjV±üVªñÖÃÚt”9oÕ H½”8OÝ#q‡æ€ÿ÷ ŒÚ‚€@·äV̶x xOždhìQ[Îÿ _ ¨£òDà1Ös?õ~-e^¹Š‡ºêëé¢>3vŽ,€ -Ôù´6Š8äÔÔs‡ÎCý—ó<n!äö™…ãÖ…T«Ðùê“—J8R…’Ðæ(Qå|?Ç:¹6ê< ™úÈüÙ :ò‹G8çü;k»Z[·É}ñ b¦ND‰)Ÿ_ÚT jÄØ*à+5µÐ.‹j´aµ”n^@ì]•yE}±Ï» Ÿ ù¬w©…ò;ô'ÓÛéû#N䪦(…Yògvì™%c·ëµIˆÛÖ$J×E+¬ÂVbx*5uÃl}¦öKZ#Èóq%ñÜ72ŸÃ‹øiXu €á•©~Öá
œÑð\?"«§Ó-ªˆ„ƵK ÑQˆÔÀMH@}ÎîkVÉP" ñZß4l§\Ê7w'œˆ£‹cÝjԽ?P…qƽ¯Ý ÑtךY{;¡8FÒ£N ªÛÝè&~GýI¤ò’Á-M¦ Qìb
pÚÀÒ”{»äüóMgyôجؒ/9…Áj(—¥x1ž}*Ú•ò£"jðr„-!…ÎÂÀ=ûð$eþš‰¢©c@“ Ÿi.÷Ñ 6*älBK±cn -‡fð¦ZUiÎã0$¿Ü|MïШC¼ìí29†ÀeðOµY(FŒÔ³ù-^¬–ŽŸ>Ó:2±èë5/•l†%†ÖhCÓ ˜]¨w'hX6Í— ¹Sº†U¬Òú|“LAÒÁcçpÏ:i³ˆc¤ÖûúÆIX—m¥ù |(Ÿ:²zS¶ÃÁ˜¦ß–ãòßÆîÖjb- -à §—Û"ÛX›?ÕSDâJªÌGú¬Ú‘o °Ùð¤®÷ÐȳžñÏKv×F$-ã `÷5 -a-‹PšêÊi^(5aò÷Þ8œÆ—†rmëÜ0Û™//UªŸÑbVPp©ûÉ` i.‰ –§Á’¤Þ¡áû ÇϺ»ijì‘"f[ºtköÁŠ”È|^g†Í„ZÏš¥2ÝDÜyÓ—À>ü¶6•thâàoì\Á -z¤ ûŠâ uÐyçøé›1irÝžã‘é£äX’Eßa›×ˆÕÇ“;˜/¼’>ì[ö±™³ FcFÒªgãö‚á‹©G -oL1MFr-ÍŒ™a =áÖVV FÎwÎ¥Xߪâs¿Ü”<¤ Ómpö{g~ű -Ϊ¶yY5Tl´«œ+Ã2Ê$WÄ0Ñ3˜K _Óm£âç¡^‚Ü<çëþ,õ˲
šDÐ)ôà”2Ÿå \[EªâW&Ç'ÒN³…Í(JJÚØ~;Î×ÚÍ+噞¼ULJ;Œ¤3ä%…Óô
X¼©ê+ÎbTØ+ E¸¸Ä ßpzeÅ^÷.Ê“ îìÚA–£Ì‘lH¸“iM«™Àþ (ÊnS1¢e…•,vû© œ+½Ôä0euT¯w}Ý.8 -^ ÝúãÝ9ÑF˜.ÛgÛ«q\Vßr_g|œx[D&w—=€wÑ6ÊÐE’tœ>-LEøbµ˜öbo…ç
m»7oÕ–7æWÀG»Já oÔbÐ5z^oDB °w\<à /r¸Š\רrRjþBõâ ÿÂèù!&†Ž h„Ž6‹$˜WóˆB-3ã½ä— K`¼ò‡‰”zó°™ò‹N`zd åÇB™£+s ÕýN<‹-8‡òŽ0;ë)Eµ&Ì.P¹$ݾM€ñ’@ݸ¦/Ã2HœQ…„IJEzïe‚q™ŸÑzÆ-tàQÍÔ¤rÆ‚}ô˜8kí±ÊäXë‚ël²iÀ DâñJ”FR‡AÏŽ-H›2²ãXÒç+Ý"ÃðûÍ Óšÿ+;Wó¸_G±.OÒxè"ƒ%u°¯“¿>Wû^ï.7 åòƒ ž0ôuS¼2 ©'w²áÁ™ãi¨šFNù6ýUv“-«>]
xñÕ—*æ®çÅÔv‘?‡Ýâ–Ü©.M +0·dæ´ëžÿÇTcz¡JÍÜæŒ.5aö$¿¥Ê°D
ÜE…q3„f›ÊœÎ.lªdX±îÚûp}˜•7M“Èœ ÀÓªkQ4N5Åç-…@²!G©¢6š
VœiˆR7\ÐMj „d cäî€doû4~<”Òe6 äm?Ð0I×€ŒÔK ›ÛS£ò£Ê%Šv¥Õï^+„¬Æ³ÒÛø!&à1:¥Çã‚'„D=ìà «&€©IãY
¯€äÂWƺ¥„RÒŠHw²ˆsë.üÙgäè÷mïyoµ©ltxebmH÷fïêïo&Hì*âj]¦Î¾kÒrX›0 —
ó=ø^‡,›.Âõ˜/Z —[’áXýõ~™?4ÒdÈÅ7€äñq ´¤ª^JÙ[K™†OøDÊW÷ãºò"îf/’’u.3éªZšœ˜Â9µÀµ ”…”Û±†m ùl Ë—‡Ï³'´4/Éu×µF±‹gGŽ‚Ç;`Žøç:í·úGj¹ÃÊH‡Íi¤Î@É÷²ÇÖiFèÅžoºÃ‹… õXWAúŒF˜g =çÇ$¥¶¸i\üh¸Ôè¢ë9ÃËñüw<d;BvŠÄŸ„Œï6È™*cf[š—ÇImAÌžëIdM8R«DVUê‚úx×aÊÁ]Ÿ±þ%ܵ>¹UÇüv"¢îjÕiÐ S+4ã%⎩ñaoä{Zg=!$Î3åõ1'Éê\ªWä¼sÖ†Ílâ4,N9Ã4¼½þÄ‚;w ½'U‡z~”Š¡+É6ÉÎù¸©õ—õ€ðËÂT‡4çjôA¢ÞŒ Ó[‰ôïqWűd‰¶Û Ÿ€¢Kªî1šÒÉ|Ö´øÐÉøKœ-`@XƲœ»Þj”§§¡øð©Öµ„ËÍñšüÀ¨É¯¡žßÒ
#ZV öÏeÁr²lã[cѽ·aײ‡xþѿnÊí"p¯½6Ö8wK -†‚™!Y5ª¬h›Âø -Ü`¹}ÊWÆÖý&_cWs£åÔlÓ¿› -.«þvÐŽ–%u‰ ¯¤’¨]5H4Øe"›ƒhQ‰‰ôM“ªRM-D>í¡)rüˆ(Ëê©è¥ÔYÇ9ÓQH ŽÝ\(] -Öð5,(x J)ÜÀÞÁg0ý{wýçêŒx” -Ô&‘#àfîÉ×kBq‚ÂõÅ{à1æˆè#žwKH×\’Ëœ!w[‰‹Ë)ƒ?q[ø,YçÔYÿª²‡¶Ë•:Žè“tG½3èÔ* þmèÊžÜ`m -(¯-üü2ÉòFM:ãM¨sv¶Ä÷Ðv"¥}kædJî -×cºŸËã+DoÇ–ãÉ)ýe¯¶ôŒã¢—WÖ™eBdeìºf|íö˜-Œ‹Zw4Vçvž&Ê=®ýÂ¥H‡,d|Làâ3N‹'¹²,šK°#L„Ô]øm³)n-@Ü´¬N&…¬$ÿÈçÃíKðt|]Øl‡¢ËJ>h– -’9„ ©²Í¦i=ÿ¨ nuþò©'x¾N»˜4Õ07<±–¹ûIíÓî†ÏÕ=Î)iÇN{à$dQñãTË0¿§h¹kÝçµùÚÒ9äóÌèÍï ¢ËG¢ $éðf+vHÀÑ:ÓÝ&îûAoÐ `ž®³DGO?Ìd¨Î3ìŒ+Â̪Y¢ì'Y"-¨öíG3qŸZê…[|i<B‡{5mä ši’ù%ù— DqërŒh¤c碫Z´BÁGE y"Ïž·Ü‰ü¼ tu ¦…³´Ü¸Œ Hþ›Zó-%bˆ9S‚®;…þŠG‹ŽÄÇ0¢æÑP±TôÕ••¿|P( ×ïVŽ38áôQülõâóüý÷}ΦPÔÃsM’È6¢±dRŒ<ÅBq´—áHW¡°XŽ0ÌQðê5e8ç tKÌÂÔ«UÑ\XîH£W ƘŽ+úe@ Ã\
-~º8Çùˆê¬ä{„W<:î9ëÏaùÉ -–YæikQ9èúÞÍ…¬Ar¢$ sCK¡¬+ÏHbwó¯n‘aÉ çÀ$.Š_ºœ0‡â Ð~jîI²Øˆ!<Ù3<í˜mÐ×µø} ãuÂgü>øb£HÇß·¿lè t#æh'¯¶ßk‘¿ -ÎòÑÁÌûøjTL, -gRH`\Âê‡%Aþ‚¸ÿ•LTa†ø¤6T:ùQè^·.¸Ê´DYAž£µ$À <ô{ÃiçŠKl¿XæŠÔÄ%ã»<ºr£²‰ÉÇI§ßðÒ÷®ó¥©XX;|¨‰êbuÊ X‡jÂÕX£Ô†ØÒïI7Ù¡™
G;³*‡ Òe÷ŽnInî‚(¿æ2ÞÅ¡æbE§4!0{šÕ?ÞñŠ”’nô0g™²ä} »O4,ä]Èhö3g"l˜\¡Ì±Óp•Í»6²Z“šÿêŠ/¦¶ƒûeÝ$³®"tÕ¤È:ô ƒòõ
‰›îxÿœŒ¥?Àh[MND.ÇðL7|S ɶtÑð„ö&øyDZÌû*Gmpr8\UÛ¬gTÀX -h†“Ì]õ5ˆ%?»â'º˜M¾×ž/•[C2°‹ð}j…Ž.ˆ&•µ7ˆˆÁ õÖ
ÿ‰r¸‰*½Æ¡rsC¥‡ Áà¼qãl§ž_€Ôv¿vwŒSX~K™Ê” Ç›¸´5"_¢»åzW‰8LB‡ôÚÄš+H*Ƃ߯@K„/ë·Á)¹²%Í%]Üå–=È«V,è
{«RW‚:ik>•HŸSTÇÿÉ%6vô¾ö\áñ-R•@BêÔ“fÊø²øÕUrÇ–÷ëSv¾] õáåG:ƉÐì%* -ÖäJ¶$÷AB:{~PŒ|ˆÊ
©¸/N˜¼wéàý‰ØaÊ9ÕÒ”®òM_u*u ~0Ã׊éào‰èX0Êr‡ÖÁÙqh[ýl½®ØÑîáÃe7æMà€;æ,—"íFóTIû ¹ ²ÐŽ÷_â05#¸.cœY‰]j˜ª:Ç ¿ùö:Qqæ!å½¾iÀÁÈéo‹¡¾{£6jÆ Ñõ({öû^Á èéWÝ{ƒHÈ%ŒéK!zþox
µ˜˜¦°ÖûˆÄll¡Y:Ðÿ3ìvz6G0†Ç&QÚ äŠ«‚n‚}uãaI#߃y>g—/¨` .n+/Ð^ q›‰t*+ˆâõa+uF¼ý} ˜Ž¥ï>à£jŽÄ˜;â¤ÏLUáÀ˜ÍPÒ¬ü“žÖkm",Á(\~éGP»Oªt[‚ÜŽŽ6nxf³lTÆíØH'ºSÍõw<²qs)‘‘Ç~*Ún¥
ÑBëRËÏ++¥È›!®)™øÄ•™þîêñþœCåaIyÃγ<–äxßsG²)¬•¢×®8zÅJäó`ãn©ÌsÌ™æEHœX-zoè=O! å™B?Êóíwö» -†»·=z/¢ÇCï¥ä‡`RðÏ!¤Ù·)žíú!Œ·zÍ áí;LZ|FÕGì%«¯ˆÅÖ¤H6}+8ã¹ðú¸°ÐÀÑ/Žë)díˆz°W‚úX ƒX¶¾m«Ø½•„»ù5g R›žF¹{‚$³*ú)u\=(Ñ-‚"Ð…÷±,â¢|]ǹý?9¿YÐOØ[L‹&ãÀŸrS*AØfši -t)ÌXN9¥D±z¤‰-D0Œ8àª; ÁEÎ+p“ùhJ½:–Éîföâ}©PýSücd?àó <ÌÈ“|Šˆîç }®rw‚RÕ:Í$å·=„~mÉ]]˜RòöÖ„½®íX((—€¶Ä?Éž¸‹e»¿èœ¬ÛXÄ -Ü ¯*˜Œù¢V}ÒD¦ÿôð£ÎÈ -}ˆ2àq=G/¦8õ1ÝüÍ/]Z?ó {P>yêU•œµú}éÇ2&@žÊå6Þä¡þ;TÆ -Ý‚Æo -©õŠÊ§üyž+¾û™’i†2£]Þá•\÷¤Mç ó:µš•wbÕ‘…Ù ˆ×hg¢Iµ#ŒºÛà@ïuJ*³É<¸S!ÙÖdNPÂD )×cÅk ø2æòò›b«ë -JÎtŒ.a½AöB¿×n
8b¦”w»VŽn$øÍé)4Üú¤÷VçËÌŒµµèN‰R£ëÐŪ—Ãÿ×>Y¶5( QD‰!%ÝHîfà¨Ñ9º‘n i’"]Ò-Ý1ºKÝݵ÷þ‡÷Û}îùçÃyžã•”4|œ"ïñ`Ûý]_€ßÿ¼Ý²í\£$«:ê¯{¶F†Æ»lìÏ3¢?ÑL$G@Öóå×vmôãŠ#Ž ª×°tή4ËFIñê\é±¹†òã–ÊcLÏBÙðn¶²e™i¤ÿs;<¶ ¼ÿñÏ7JŸ¨ie/þ5÷“FàEZUuç!í¯îðœJMþ•³ŽôÓ }Ëß–~¸ -Âòé€z{JE‰FªM Û„u–æG0i ž³ÍÀ†^µYkúzþ'ôÍòH¬n“È([ÒKFR}ÿ^÷ôdk -±5b$ßì}Cd%#vﱓ*š°ßÉ
‘ú°»¥8hñÀÜ_Œ»Ð7¥U½2f -b›oÒm÷ãÅY…½jãnQŒ˜fýÊm½ªm&*þ8”Èç1|ñ˜a¬~– F‘«•¢ûÎòXQ;( _ÆSI0ü+p˜ý&á¸$BF -ý1ì_v#ZâÍ,µgªìVØ -*‹š@i‰úû¿ž8ëäCî3luRŽ n£ÒsbX‰É ýÚNã0Lb£?yrK—Søƒ=ÕˆáÜá@Æ žÀlþ
¦Ã<˜'•AÅ87gñU˜ -Üxäø›Š•XGŠyº'ü á9vµ,Õ½OÓà¬KÏýØIC` ” ¿¸9Âò§é¸ˆ ßcZ”Âh.RÕŒI8¬_$òfIKmÌXró–€àÇê Ÿ%Ŭg”ÆÂüˆßY'ºVR, ¨B~
ÐÔAQäϲ¯u£s¢€Ý_˜Œ\@øt-ò©Ÿ’>ö‡Q÷FÉÎUŽ«l$Ô.ËW(¦8*³Ÿ{>B7@ -7쑘ôy™Ù7º!„³ ¶ QèÌL}*Ÿ$‚WVÉÉ®š±Èñ×´//2ZA$¼§¥ªb;>~T6EÕ<Õ¿¿Vj3ps[‡Ú[ë #.JìñåY¯ª0ûì©'™„±ŸµQÖ8}Q¥ÞÒš½.HÒý¤ñ‘õ$=¨â¯oñöaZ]‹#6ž/¿¦Ðô¹e¸ÞZ‹ÇM{ªh= Hp¿œ¦-Õôš£ åežÂúz‚€ÛÆ«ì(Onû÷söQY²æ‰Ï&¡I(Ja]U›-fø´ Û[ˆÿÞóݦ6vº%š.[Íá§KpyJÖˆàêh2nösjJ,©VŽ&EͯU¨•x9øW+0éOžÜX‰3„\ -‚¾¡ÉzŒ:s[+ž:[´‚r 7À«_ó熈ÑFÂ2Õ:¨Ù˜-Aè -œÆâOŒ,Eß÷;XM« â U†æüìeçÎ &¾¸cë2“.D£T«h8&Ëe7nV"ÎCøpÁ¨Ö# }&_ot-ç2ÃæXL¦ºŠðï"’‚Áf&Ñ탔w¤éʼŽE9Ãê¶Y|t\dà=_©Ÿiµª¯ 9ÅÝU5½<}âoCʬe±É·mQJ_”–õx-º Dïä»3¦Ÿëï"‚_ -{8þFÑÇæ–éì é–sEcø ôc /
¥Xne£ß Ip’XÌ,X§x©oÞC§C7}yñ8㟑KÓ•F<Ø—¶cÚùc§>É÷"ÊåæÔYxVì#³í³9y«bTjýé‰NÜáù„…ªjŽ\«WÍX!Ì[Ê뺧b'ÞŒÆ)<$1ôÊÚ[,ৠƒ@ŽWÃc3/—°WnY"¬Æ4áé [_Šüå–#xÎöf3I¹[V¦;ñ²è2f’a_ÏãX ;q)ö& Öö4FØ …È ÷Ÿ -=X¤9 ƒ:Ø•ñÒ -†*Nñ(ßc“À“ -ÎQÓp/6è~ -ê™ã2ú»‚îY$óµÉ•ßª2^IÑPYm3ïÜÚ×Juý¼=ÕùÌ~9Äÿ 2©”pmP kDÉ Ç¥)DcX¨Ù콘ûk*+ ÇMC Æ{Ù´~͵)²è5¿¯ÅL|yÿ1ª5u‡Êëñ÷Òc9„ÍrU ¶óBDøò3TyÈ嘙 SzH1ß+`Îð¶+ §`½°W5Ó㎎²ÁÑÃiÁ™,÷ò}cýö3!§ïÒƒŒ‘Pu aÛ›”Ë tòÍ|T\ÅL,pÈBHðì9çÑô)8H-úäjj*ê=êOŽ -Œ†<\a/r¼ˆ v ÈxµfíÉCvP€ÕóuóföÈy§Åm4ÍÛÆajùlW¤JÕ4pñûZ¢ Aÿ6Ñ®–B][¢µš×´B©®¦Ö -åUÔwUMõ»gÕ"& -C•Á&ûA×"4ÂÌ]iÅ Î|,›ž(mÍ…pêÖ.‰ý³oRŽÕ] ¸kŽ¬¢PÖ¡ZÛZŒŽT2Ê©‚pC¯–dô.Rn ®f™ 7£žØærð k®–-!OõŽž1t¿9~‚ó–‰æ·q¼mx Yæó”9gK’}ÃÜÕè×å HéÏAf™\pCÊˬM‚._óBâÚ jq
À¶]qL÷‡ Âa¯¡n—ˆ›´¢('â¥&Cvpñf–¿‡OFÙ2ö -# ð:øF(‰¥YäsäLèÆùxÂJßÓ%ÌgæÂîˆñe :‡¯#0®ÿëÊ»3¯‡óíLM¤\“wŒgßRkHäŽÅ_KØwÓªÂìni–ŠØ±
¨wŠlNþj sßÑ8v<o¸ÞâÖ²ãU8^ë|Wš -ÆúÁÿ%ž†ëÿ öÿÿsK¨«»³#ÔÕ ûÿ +xÚ¬ºct¤]·. Ûv*I§cul' ÛFÅNÅFǶm۶͎í¤cwý¼ï·÷>cŸóëœý£jÜk^s^×Zë 5FQ’)ª0›Ú%ìí@ ,ŒÌ< +…ü5Òß1‡PP[B¼ªùÕy{Ju ¡glŸÏßüC(»ƒ¢ÈrÓÛFÁ÷jð§fÌÁpC`¶ +f†é”/–é„ÐaÆ)¹–ìÉT_ÄAÇDÆ@G’_²V
ú¿IÂ>^"òœ’£\žpÖ k×Ñí HNZl¸Š”»Ào{ö«OŠ—© ™ }½ŽÈïqM gÀÁõ@‰Î +vÌó™\Ÿ äsi‹ ø'o0=ÆK‘ wnÕÉÙë)ÕiÞ8©dÆî¦uË͈âL8{8yŸì'!HÄ`9õ'žz6±VÁ‹Ã Dp.µh4ÇÛÛ8ôÌÊv]ÊB‡ºŒŒžš¿ØKÕËËÃÙÏ£€_ë%ç=ùäÚâô%N¥¡[é ¡Zß—”Ž8¸³OÊÖÚvAÔÊ +ųÎ:]Ní®¯jï‚?Ú1Ü¡}ú߬Eþ·ß™ã…°ä]x‰©9 +¾@£dJî'¾T¨× +z õÊøjØNE'·M¼¼² _ÉHËq zÎ9W±O´à¼¢\Y`Gà^ùa“ñóQýÕùÒ^mš¿RDÓyYÕãľ¤w§fküV¥_d•ôúÁï¡qUåM»n<%ò„é±D}^õ…ï9ÜÚ™/˜zšâ.Øè×)ú/…0×Ο· ×rþ¦›§›Ü:;Òé:of\ÛsG§ys÷ÌäxQåç!X[EsèAm®¿NB(^WÄÌoÑÎÉ…qeQoP½'“ÀäŠÛ±vÅTäŠËÔ›Ê`Þ£>G}òxeVÈ#E²Á¯¶b@:4ÖëOØ ,Û“œÖ˜ w÷Ý@)Æ óeîG£J
(P å[ývÞ²zž¹<ú JŠ ÔÂYCµŸÐÝ^R°¼k eMÒ]@KòB ™ŽtF ò°…&eð +îïø`—÷¹K³†>E9‰ú¢%óeKšb¥6$O÷Àw¯sjºN«–'šuYv™ÁuC0=õOS‘GQ‰þ¯Âì{êMüqûÊ¿ûw^³ 4)pD^W ¾i
22øQæBæeëðÄø8Ü+Î(ä€#x2dßë~r%³õç:9ÿ8¯%è5.Ý‹IáÊ 9ƒnò )6Ý(€É7ÇÅåÑ Ú:T÷ ¼$Ój æÏI,n›Ýƒ0C5r ¦Ð{Û ôù4uJS·1Q¾àIÞ[°šùq™B·ã§ThBŒ¢$¹*3„ +j)ÔˆÀ9”‰©P͸\‘<«Cz„ w$;48™un¤£Üó +yÍ: +Þäâ¨Mœj‚ñí*Ã; øí3ÈñÈmľÎV¤>û¢{Ž'ûh„³vÁ›¤ÊŒ=N(ßÔ™Þ‡RÆÇâ-ë-U¸Õ¡AÉ^³Ø1! >•…k;oI ™&Z£Åó²A`þH¤Žš“´¹žÞù=&¬;îõ4vŸ ]Â÷žå· £Ë Z±ÔNnbáÓ1¦[^ÏÂëMᬯij
ç_ÓTô²È§šl`îS ñö— ›.²XˆGe(p¤.¿¡ CžFêJ)ËÂÀ€z®Œæ×Ô9øè¹'ÆÂ-ÉÆÞGܶ• [|ÛþT ÿÞ l©5· BZ«àà"—䬩¹9£ÈµÿT*qq„ÏÏ4dG<éZS{Ëèœz 2T$g€ E‡úÅ3P&¶ãäQ,À‹é$‡(YÐF¥›Ýúg¾ÙþËœ;HGŸ€UÏ0/ˆF®A¶¢ºhÝÂüÏɬSŠ›?…ð.zì$ƒþ¾‰OøBw
F9.é»°{IÛÖ]µYÎÙÛö>….¹©i>Öª®¤Á¹º·t’Þ Ñ±ûªÜI
r<Xh[_lÒíÅU1î¤â(ÛŸŒÙÂp—)^ðC7¾è£½k¡ú»¥FÑ…ÝL”ŽˆÃSù8Ø'ȸŽô‹òôÝ´àvÛ\ûƒªH(dÎWs<eúJR˜)[ÈùÒ;.ŒÛ=õM"%Z +H;\æ ¦oyd÷5 /‚ZY¦ØßY‚x/ ÜI(ê_SVò÷O”ßmÛQ(±Ò´È{u½î}"ƒª7àú(˜"äa-/ÅGSkA˜M™É~¥S/D+âˆä5‘<šèaŒÒeÍž€RŠÕªµ«™£Ö½KxfÕ%S_olË+ÇééG~Žá^׎ ÉñHž‹cCñ ûKÅ r„i/©ÁX¨ Eå[-6áËM*µÖ‡ß Q‘ÒY 3 œœüÎ$c;¸™îÎôœóð!¢¸†„À×Ü—Ç+šž\[²7¸¹7ÚÆȈ€Cà[VZÉŽ6|íd›®y>vWL«Ýa%´§AX™ée‹ÇXço^´¡ €KE-éÍBòŸ’Þ®ü1Ò^Þ€8ä„áU„4‡Ü46 +`YzY,lsÿtψSòé’üZQ”²8 !Êó@¨`öžnBîà ñÃ`N€¥Nw§©Ç!ô$ÕæõÎ%¢ˆ(Ùâ ÐκÒC$‚é‹Q +=öRþ÷y:×S¨‡ÎG~.Ílñõ¤1Õß«Øg½ ?o!==çxQWP8?®~|˜Üÿ¸¾x¿¾tW õ/ŸU®kdY¸Åã–„ ¯iHxºâñ¸l±˜ “¾ž?b™qé®yx@cÏ·è£P(&—.!ÕGÑ‚¢™þ=Wc7Ü1 WÏ28'ƒ;2[.ˆxý‘×µèÀw,ÔE h@¡3§>WYˆ}ðùaæNy´59ƒ‚Oà +Û#ñ=X6 µÈøÌý/ùj¨5§äÕ‰X¦NëxþU¢lµÅ•¬ A2fNyë BåK @z«1ÅÓÅ¿fÍÈnÿÙÒ©ê¹4mmÒmyŸ;þ-áu +¶ŠyŒØœX6$ XbLÖ¯Æë6SÅGó´»k%¾PjãdÉ\c_¼œMMâ›7IJÑ1è‡ÛÒŒÆî C¡oÖ)ëÆ +‰}
âx†Ü²t¼Væ–67Î5 ¥ðž)‹ô Ç“‚õ\æb—qå‘!̸øglnëNò4ü ˆ +/ô Ä@þåí‰e2bƆwU†ŽUöq`æïâ ðÅF ŽÓ⊂™¼ná{™š¢5¿áPƒ +\ÅT»à^7–4N’’Ÿ»$$ Tƒ-L3éΚ¹¼Ìè- h’T8 @½Okè#ÁMÁ[¯/³xO:"¨4áxüåäL—<kcèyÇÛb¢q¯ÐRÐŒñyn–yÍ Õ4ë1qÑŽ{¦í¾1'.ämŽNèÇ!Êâ hkjìšû?nP:±³4¸§†ÅÜ9´mºAº‰=¥“º,fÂêhI ôNÖ»ïü'hä<Vk +Á³‰Ek-˜B© äöVZq*ÜO³«ișꓛê¬ïžŽð°Á©ôÄÄ ;Òª_俽Qì˜ÎcNµ{pÝïbÔNÏ£….Öï³J–Þ†+–½º5©jµÊâ?ÁGti ÉBs¸¯vëÔm)«[™ïE»yŒãn6Ägî¹ÖªÐR“?Áµ7ßûx ãcå«B55Ö°0§¾ê cu Çð'} + +ä+N‰Ø5ÞNj4xÐ]›€¨áàݵmï+Zf;ˆ?Çåe³ÝöPà·oŸÒÃüµ—¢I¹ë¼“F<{½*-5 …)ôcÚ +#oÓÂíç ç‚ + +8À#D=ÐÚ–'¼ËÆ€7aî^MXÛsänjã„h1B–¤ÖÑØÞt\§´äŠúã=/t2K(¦H÷±X
į̀W2ál“åÇ W÷íÀyŠ|¸`¡ïì¹Æî§È…çÁ™kÙYÔë:½ |â±ôÈìÓDáw
E)³*j³sý«‹ÛV]öŠSl|œf&EÔô5L‘VÑ
V ºZ™ÜŠ2Mù…%VÐ`ß¿ 1¹¦²¿‡T@@jLªPèȘ֨s*ô½§ Ëâå®è +I³ÙêéœÆ–T©-˜Q§5߇[„þÚ@ÂÇŒçoT§÷sa‘‚‚Ÿ£;?®IÖB,$Êq®G¶qÞâ¯PIJ •£Æ»¨(¡àœ•SÕ`RHáRp”·Í/i¼™É6vÁ³ªÈ»ÚôÎvñoU;]äW¸éysQ†$Z k›oÀëãõO„ö¤Î£ýÁË2 Uø˜>¼sUàtO?úp '@úÂÜdÛ¹KuŸCí½ìe½oÄÜóÏrž‹ëéEÓ3ŒžÈèÎ#$ûYjŒ²äØyÇúÚIÂOÁu )–8 Çúƒ}Ú
|þ84G'.«2c2´GÂdL¡ÌàŽ6(1¥²ò&µÂgùð‘ôrœP$A€+ÒádˆÐíçÁ¼_äÓôèä8\áä'wÇT`S^JkÊ_HÿΡ ÇÐïK”.±®:¤vì ÓîÓcˆä"AŽ¥Øm¤.l¬È¤÷4³å)¸ +4=_A€ï CÎyëºnlT÷SI ÆlBŽãÇD‰gÿ¸e‡Ýl‚È¢s›y|œRJ¥sáŸÆ%÷›oßú§gªDT+êg&Ÿ‡ +û +ÀáRLæÃ2–6çW0*¯bö"QÛ 8Òœ3,´~~ý¨yܵ±®ƒ!èk÷}“IU?û +^ºö.ÕÊ;â˜<\éæjB† :æ‹ãk‡o™ùžËýta˜A=«(ÓÔ'ŸÔÐH•ÄN!z^“kðw¢ëKËŽÌ´«öߪ&ZÎØS³_ž!¡ÑÐ9†˜mx,by5À,Ù{Ô´9s†s_=ªŒBÑ3ú§ÉÅé7˜MgðRSÙ
aÅL4äÆÍœdä’¶î¡ÁZ’Ô§q½ ¸ ‚’6ˆõA3†Švbwq]o§æö§%¡×+DðXÚ2ˆPvêð7?³Í®=Dø"EL‰ÁÀ} §Û#WYççÕ"úCø(øºÕèa ,Ù`}Ta¼R›L΋ÜW’ï“9Ž˜oÖ”c/9ŠÈÀ°º·‹*£ÈpOˆjêû‹ ª`= à^SVnæ¶ô@&2†4.Ê0h-5zPÖz.Îxúƒ)Ë+™ÆÁ·ÙÃ!îˆF°²VóöqÓA#õ:ãF½À=Ca祥…1‰d1xýº¿ì ø2ï«9Œ)Cí$§øV„" Æ1‰F¢ rnêOèó$9žíÞŠòZ
«>’qXøŒúÑú‡¶úIÛ¦Q!yˆ|¨(wàÌh"¾ n£K²ñúB© +/5ˆÝï9éŠ1)ëM÷çY¤Ò\Þ5ö £yLU!?䡳ìšýõÀªi›Ž}Ìn‹‘f^;àQb ù¸RÿBr Ï¿I-9:5Å·À2>ÁÐ3d±†Fˆc,<oäæ£Ocî1ü±St~»|Yù51DP!£í ¶“°P
¾¢®tþkºô¡ßk˜8Á¦ÌØ$õc°ã9•Qæ3EåŠü±¹ÙÞ–q«¿tÔîÙÛCCY^"fLzJ +ÛnÊ÷Ù'Î{ü®ÒÿŒŒ®AiL–Xg…¸N +£2„‡Œ°±hdw,}ýåÒps9KuN4ÒÝœ °T×£bK؆F–i$Ÿ‹‹'p‘}¾Ÿt¥™´ðÞɨ"3±Ut¢¡úx²Ø&x4D K¬ZógÜVú‘xC¶‹]äÂØý9¦yóï³t¶Úxæ‘…HÞ#ü¡ æh +ø>_@[›cQƒY«]®Á²´%! +ÚÕìΨwtŠÓ ?oAZdæ vò6I‡¼)’þ‰èRUÇÜ (Á@Ú”µ²âi·¦Ð£ñ ÛåºÛšÖ/ì¢ó&Å%é±ACF ÷Àa¾šƒ;öùZjûâ×QBÙŒãωÎYIN«ä{Ïy|—hT®t²RML ‡WK&q¨aMPjÍ–_ê›Í2ÖÝmYL¡£Ý§ÎŒrîgs7¨NãÚ‹+Aׇ²‚·`¨ëÞÊN óoé…%¦~aÝ–o¥~F¼».û# 3{9D«Áä9;â ´ æÍôQ¤m£ÆgsHœ;“¯0C[µÐñû8Z¹Ô€î>¿œáƒ¨ÃY„Üá€ø¨e{MA\\ˆbi©O»‚›îöŽÁAø¡Ö3 +'ˆqqµi½á¢C°z³(†Jœ=ã€àˆœý]ÔÞ8§š¶±×†3`žbµ^0Ï »©uDA"e‰57 "jÍLLÇXÝ'N-ëZnˆhK$%JrrÛ‹y¬ ewyä¬ÏÖlv-‡åƒÑ‚ûvô¿L‡|ä‹N*<‹c)u4¢×é²=hIë&a‰ ét•ÎÉV¢z*ºìÃfÞaJž¿+uÍçWâèÚK}¤¦ +cþ1α¼ZÞÃbi÷cžç„ Š¢c;Ï\ºFý‚I ¤ Ø-óÒF ¡Ù¡·ŒhÌ$‹™òjLjڹÕTãŸLàIHJ+øæö‡dPßÜlvÈåAÞñ GΓ[ãŽ`Ñ#&ûîR…j—ܬ'VuUÎÔ‡íëÌÒ†·r€"˜Ž†(¾WwPßSè¤u‚3ØRUê·€¥~²ýbæ³u«jJäþnÏ×íºÁëi¯™ê'‡¹IÀ&JIÔô0>e¾dÞ>#Ç<®å³Ü±éú Þv‘¹‚Ϊçñ æWêÕ‰½˜¥‹ÞÛd ³ªÐçÄsFÞLÖ÷ÍÝ">nfhx¬ºqŠ~K~áåÔZçW +D9ÐÄ×ý«ÌNcü +4Æg÷Îü ôL¬¾¾Ò?Âlœá¶_± Ã؈õ†ëî$àÝ-: ÇDpBÝu£Cbî›#13º;Ï +*‡Kò·¶‡;¾-’"+ܦ˳-ý<ÎÈôXüöYëÁ’áJÁ‚¡$üé¥Ò.&>Ùe¸R¸¡3ŸÁÿ]u7üaÂõ ñ.R8‹zAµÓã~nTLûçpYT Óìª[7ÒøUÒð=|¹üº*ÚÂ_AŒ/–*CØ ¿?CÞúh67÷
Wáïx,V[ýªŽ?RÆò^oH–èÈ;Ǩ=k äàkáÕÊu3®ÉẇNbnN’²‹Y)êctž-yá¬JHÇd`‹“mó®úí}KÕ4¬½9«–øWù… YÚá•M3
|•Ð§D N¿"æµdYDé@ÖáÄúÑ¥õÇ*1öEÒ.úMµü–r± ÒüØ +Á4õ5’+Äó}†#‘.礋R‹ë +õS׸oïÖ‚•fx{ì—?]Ž{øjA}øé{v$õFBÇÃh¾/oF"U¹»ý´P‡SkwUŽçî0 €8â …lù9|2öêlá˜,RºÆ,;?…Y¦y$…ä¯ ‰+aÍB•¨ì5šEÇ婳Ž÷õ¾Ióþ†n$ŸJ±š ÿHbN±ãHÿ^Ù’Ÿ¨aêºV§hÞšW>#žµºra·‰áWvdyóEúC
‰ÙãÃ/c7>+΄É6¸ôªû,,V>'$úÒµe P¹…'›ð3f3 +J̺6I>ìß
$‘–HåÇ(ÃÈ;LØAB¿ªƒKéíqrm”ü¼Ëµ˜+ู؂۾Ó&§døäNÃ0I¿r!7%tj[®†ð¼¸ ‡¿¬e°¢zñ÷pöZù¹Üvi3l*.p.&€Ñ· Kóâd¹¨É +ÃŽ¿N õÆç*匶ölIUQ8(± J 8a•˜· 5«X~+Õøëam:Êœ·jP¤^Jœ§î‘¸ÃsÀÿ‰û‡FmA@ [r«@æ [¼¼'O24ö‰¨-ç¯Ô‰Qy"ð빟z¿–2¯\ÅC ]õõtQŸ;G@ +ƒmÕR¯
Ö$õì ÔÛ6Áò´K·8} bS5Û €UÞXÈs^ƒ=$Bÿ©†Þ‚€`õ©£X& ýµ§=²w3ØÔ]ö§ã^êÌNóÊ»Aøðc0ÎäÚ5¯uÈòtœ)
¼Ã؆Fê|ZE ò‹Vjê¹Cç‚¡þË€y ·rûÌÂqëBªUèü õÉK% ©BIhs”¨ƒr¾‰Ÿc\už…L}dþl ùÅ#œsþµÝ +Ûä¾xP1S'¢Ä”ÀÏ/m*5blð•šZh—E5Ú°ZÊ‚?7/ ö®Ê¼¢¾Ø‡ç]Ï|Ö;ŠÔBù úéíôý'rUS”ÂŒ,ù³Ç?»FöÌ’±ÛõÚ$Ämk¥kˆ"ƒVa+±<•šºa¶>Sû%äù‡¸’øVî™ÏáEü4¬:ÀðÊT?ëðÎhx® ‘ÕÓéUDÂãÚ%†è( +Djà&$ >g÷5«d( +xáO¶S.eƒ›»NÄÑűn5wÔÖ‹IêÞ (ˆÂ8ãÞ×Àn†hºkͬ½P #éQ'ÕíîaT¿£þ$RyÉà–&S(v±8m`iʽ]rþù¦³<zlVlÉ—œÂ`5”ËR¼Ï>íJùQ5x9–Bgaàž}x’2ÍDÑÔ1 IÐÏ4—ÆÇûèr¶ +´¡é
LŠ.Ô»4,›æË…Ü)]Ã*Vi}¾I&È éà1ƒs¸g´YÄ1Rë}}ã$¬Ë¶Ò|>”O Ù‰@½)Ûá`LÓïËñyŒoãwk5±ÈVð…SŠËm‘í ¬Í‡Ÿê)"q%U æ#}VíÈ·ŽGØlxR×{häYÏøç%»Œk#’–ñ +°û€‚ ß_7ÖˆýõƯ¤øÖe÷®eßêT\qÓýÖ®Épswþ +Ü$( Wgœî‘·xeµ§²Þ ¢Q« :p¶ÐšaBš³·ØÄ ô¥7'‡Îò Ì[H›†{ ±_‡*ºŸñ´í!NTúû[ìD_lïñ (bÂ/Ý}¤)m R¼™~pÁþØL®†PèK¶ M5”ð?Æ®*äQF2±g™#ªûغ à>~‚;H°‹¨-ƒô9ü·—5ûÎG 9„õKƒ[Óc÷~@H" …°Î–E(Mõˆ@å4/”š0ù{o NcáKC¹¶un˜íÌ——*ÕˆÏh1+(¸Ôýd04—DËÓ`IRïÐðý„ã‚çNÝÝ45öH3‚-]º5û`EJd>¯3Ãæ BgÍR™n"éK` ~[›J:4qð7v®`=RŽ}EñŽ:è¼süôŒÍ˜4¹nÏñÈôQr,É¢ï°ÍkÄêãÉ Ì^I ö-ûØLƒÙ£1#iÕ³q{ÁðÅÔ#…·¦˜&#¹–æÆÌ0žpk+«£ +†é68û½3¿âØ
€ÙAehD¡–~ØioÔQbØFÈöy ÍpR<‰˜ÈfÏâŒ&a›æ(z +YìT”ÄÐ_ïCŽÆ} _zA-nuò®Z˜ÄögúvXPô‹•5tº ÁúOÌ]šÛæÞÄUhN'u6V‹3án[ }¶ŽMïm9¤‚Ü.QÒ(Æ‚Ølšõ3EȽ¹²FÕ7CÇ¡¥ŸµÂü‹›¸¡• Ò†Ô·X>ÅrV¤«´þœùÈ87‹Ðæ^’Ü#ž³Ä…*[Ã00Άºª\-zÂ0³•CÄx:M«»ÄãVNcÇICÃOgUÛ¼¬*¶@ÚU·ae’+b˜ÀèÌ¥¯é¶QñóP/Anžóu–ÇúeÙM"èzpJ™Ïò®"U‰
ñ+“ãé?§ÙÂf%%íl¿ çkíæ¿„òLO^‰ªãà FÒò’Âiú,ÞTõg1ª +l•"\\â„o8½²b¯‰{åIPwví ËQæH¶$ÜÉ´¦ÕL`e·©Ñ²ÂJ»ýT‚Ε^jr˜²:ª×»‹¾n +¼ë0åà®ÏØÿîZŸÜªc~;Qwµê4è©HšñqÇÔø°7ò=³ž‰’ ç™òÆú˜“duˆ?.Õ+rÞ9kÃf6q§œaÞÎ^bÁ;ÐÞ“ªC=?JÅЕd›dg‡|ÜÔúˆËz@øeaªCšs5ú QoFÐéDú÷8È«âX²DÛíŽO@Ñ%
U÷Méd>kZ|èdü%Î0 ,cYÎ]o5ÊÓÓˆP|øTëZBŒåæxM~`Ôä×P +Ïoé†-«ûç²`¹
Y¶ñα‹èÞÛ°ëÙC¼aßèß7åv¸×^ +뜻%CÁÌ‚¬UÖ´‰Maü€¤Ï¹uñçó„áÜê :œð؃C»(|cºÉ& §ëéòɼ¯È8'Ùx被 Šóp<]BÌý «›[¤„ +¡à£"Ð<‘gÏ[îD~^ººÓÂÙ?Zn\Æ$ÿMŒù–1Äœ)Á×Bň£EGâcQóh¨X*úêÊÊ_>(”ëw+ÇœðaÚ¨F~¶zñyþþ{ ‡>gS(êá9‡&IdÑX2)Fžb¡8ÚËp¤«PX,Gæ(xõš2œsPº% fajU‰ªh.,w¤Ñ« +cLÇý2 Ža® +LysN<q›Žé;u %ý¡xCߥi67k]ýÔ•ðÓ*‰I +Ñ\‚°îÙª
[ˆ|¾[4Ã_ ÆvNy|ü(—æl ²½Fï· ïÊ»i¤ºõ–l +]ë4PH§rüIbÕä-àIæ<Œf)$Ü=¼ð~WÝ>Rú?]œã|DuVò=Â+ ÷œõç°üdË,󴵋¨ t}ïæBÖ 9Q’Ž¹¡¥PÖ•g$±»ÖùW7‡È0‰dÐs`Å/]N˜Cñh¿5÷‹$YlÄžìžvÌ6èëZü¾Žñ:á3~ |±‰Q¤ãïÛ_6tºs´“WÛïµÈßFgùè`æ}
|5*¦ +…3© ¤ 0.aõÃ’ AÜÿJ&ªƒ0C|R*ü(ô¯[ \eZ¢¬ ÏÑZ
à ú½á´sÅ%¶_,sEjâ’ñƒ] ]¹QÙÄäã¤Óoxé{×ùÒT¬ ¬ >ÔDu±:eƒ„Ž¬‹C5áj¬QjCìé÷¤›ìÐ̆£Y•Ãé²{G ·$7wA”_sïâPs±¢Sš˜=Íê ïxEJI7z˜³LYò>‚Ý'ò.ä?4û™36L®PæØi¸Êfá]YIÍuÅSÛÁý²n’YWºjRdúAùú†ÄMw¼NÆÒ `´Š&'"—cxŒ?¦¾©Žd[ºhxB{ü¼ãXæ}•£689 ®ªíV3*àV,´NÃIæ®ÎúÄ’Ÿ]ñ]Ì&ßkÏ—Ê!ØEø>µBGD“ÊÚ DÄ`ŽÀzë†ÿD9ÜD•^ãP¹¹¡ÒC`pÞ¸q¶SÏ/@j»_»;Æ),H¿¥ÌNeÊ„cwLˆ^ŒM\Ú‘/Q„Ýr½Î«D ¦F¡CzmbÍ$cÁïW %—õÛà”\Ù’æ’.îrË äU+ôŠÖ½U©+A´5ŸJ¤Ï)ªãÿä;z_{®ðø– ©ŒJ !uêˆÉ3e|Yüê*¹ˆcËûõ);ß.†úðò# ãDhö€ö‹G¸èFyç;u=2_–\?c«î¤~‘ +ƒÅÊ~Ïz_úà)ë¨R÷Ãfæ4Vf™k+{Çc–®ŸSxéüýpŸÀ –éò¢Žú‘ ›B6Uß\•AM{ƒo—áŧÜùþ1÷¹ž ƒG‹K Õeºd´fÙà&ö÷-
¹÷ŸÞ
ŸLHÁ¹‰àTLq> ã3ïçÙuÐ3õ.°ó»ÏDkr%[’û V!
=?(F‹V>Då†TÜ'LÞ»tðþDì0åœjiJWù¦¯:•º?˜ákÅtð·Dt,e¹Cëàì8´~¶^Wìh÷ðá²› ó&pÀ s–K‘v£yª¤}ÜYhÇû/q˜š\—1άÄ.5HLUcß|{¨8óŠò^ß4à`äô·ÅPß½Q5ãŽèz”=ûý¯`ôô«î½A$äÆô¥=ÿ7<‰†ÐZLLSXëNŠ}Db6¶Ð, èÿv;=›#˜‡Ãc“(í„FrEƒÎUA7Á¾ºñ°¤‘ïÁ¼ Ÿ³ËÔ
0 +·•—Vh/†¸MƒD:•ÄÇNñú°•:#Þþ>PLÇÒw ðQ5GbÌ ñ
Ò禪ð@` Ìf(iVþÉOëµ6 ‘ +’Yý”:® ”èAèÂûXqQ¾®ãÜþŸœß,è'ì-¦E“qàO¹)• ìG³VÍ4ºf,§œR¢X=ÒÄ"Æ
œVpÕ Žà"ç¸Éü 4¥^ Ëdw3{ñ¾T ¨Œþ)þ1² ðù fäI>EÄ ÷ó…>W¹;A©jæG’òÛ B¿¶ä®.L)y{kÂ^×ö
,”K@[ âŸdOÜŲÝ_t NÖm,b +É´ C™Ñ.ïðÖJ®{Ò¦sŽyZÍÊ;±êÈÂìÄk´3ѤFÈZ‰FÝmp ÷:%•Ùd + Ü)„lk2'¨ á"”Öë±âµ|syùͱÕu€\çÊZ'YýMªI‘_£ƒ~Æ)bfÓíÝt=–ÙáÅbSÅ#Uk.`« +S‚DÍ( »(ë% ªU Î)7%g:F—°ÞÆ {¡ßk· 1SÊ» „]« +G7üæôÆn}Ò{«óef‚‰@ƃÚZt'ˆD©Ñuèb
ÕËáÿkŸ,Ûš +ÅGÕkX:gׂ še£¤xu®ôØ\CùqKå1¦g ¡lø 7[Ù²Ì4Òÿ¹ [PÞÿøç¥ÏFÔ´²ÿšûI#pŒ"ªºóöWwxN¥&ÿÊYGúéÆ„¾åoK?\aùt@½=¥¢D#UŠ&ÐmÂ΃:Kó#˜´ÏÙf`ÃN¯Ú¬5}=ÿúfy$V·‹Id”-é%#©¾¯{z²5…رF’oö¾!²’»÷ØIáMØïä†H}ØÝÖR ´x`î/Æ]è›Òª^3±Í7é¶ûñâ¬Â^µñŠ +·(FLH³~å¶ÞÖ@Õ6 Jäó¾xÌ0V?K£ÈÕJÑ}gy,‹¨ †/ã©$þ¸Ì~“Æp\!#…þö/»-ñæ
–Ú3Uv+l•EM ´Dýý_O ‰uò!÷¶:)
G‚·Ñ é91¬ÄdÐ~í@§q&±ÑŸ<¹¥ËŠ)üÁžjÄÆpîp ãO`6ÿÓa Ì€“Ê ‰bœ›³ƒø*Ln<rüME‰J¬#Å<ÝþŽð »Z–êÞ§é + Ö/y³¤¥6f,¹yK@ðcõÏ’bÖ3Jca~Äï¬]+)T!¿hê (ò‹gÙ׺Ñ9QÀî/LÆ. |ºy‹ÔOI ûè{£dç*ÇU6j—áÅ+”S •ÙÏ= ¡ …–› öHL +ú¼ÌìÝÂYÛ…(tf¦ƒ>•OA‚+«ä¿dWÍXäøkÚ— ÞÎÓÒU± ?*›¢jžêß_ ++µ¸¹Cíu†Æ…¥v‹øò¬WU˜}öÔ“LÂØÏÚ(kœ¾¨RoiÍ^$Hé~ÒøÈz’ T ñ׿·xû0®Åψ_ShúÜ2\oEŠã¦=U´ž$¸_N Ó–jz͉Q +Žò2Oa}=AÀmãUv”'·ýÆû9û¨,Yó‹Äg“ˆÐ‰$¥°®ÇªÍ3|Zí-Ä +ïùnS;ÝŠM‚fˆðÓ%¸<%kDpu47û95%–T +G“¢æ×*T‹J<È ü«˜t‡'On¬ÄÂ. +ðž¯ÔÏ´ZÕ׈‚œâ^ž>ñ·!eÖ²ØäÛ¶(¥/J‹@Ëz ¼–F]¢wò¿ÝÓÏõwÁ/…= £ÆhŒcsËtö„t˹¢Æ1|Pú1—ŠR,·²ÖÑï„$8É +,f¬S¼‚Ô·Nï¡Ó¡›¾¼xœñÏ‚È¥éJ# ìKÛ1íü±SŸä{årsê,<+ö‰ÙöÙœ¼U1*µþôD'î¿ð|ÂBÕF5Ç .‰Õ+‹f¬æ-åuÝÓ±oFã” ’zeíðÓ„A Ç«á±™—KØ+·,V cšðôŽ/EþrË<g{³™$ÇÜ-+Ó xYt3É°¯‹çq¬¸”‚û@k{#lŠŠBäƒûO€Ä¦ù%ÛèúC Ýt@AÎ]7DXÒþƒÅuOî¾[©ÞÌ
m_'y… ,Ò ÈŽA ìÊxi +K› ÀöYt^¬evQ&57Ñ„t9Æ©‘;ØQLV2²ûËI2U^¹¨%Ô~ŸŒ×ˆzW +—wyÑ7a﨑Ýâ‚\Ð8Ó}`\%êp‡có'Æü-ú稛ù2ü@/øç0´ âs]1Ñ “ì³ h«Ñˆs.:5üókÔLžQdBöǺs+úof´Ôë§hÖ"³ÍÞ„ôî¥J¬ °aÿì·µid´¯<îûöÞŸpÖ=×&¸ùï|A½WKÏÓ}‡õ2yÐ2f:oü0Á¹=}”% 4€%³ì~46¬“âNÑq›äøáõéí”Ú,VÞyš0ÐYjš¿c\êàøªà躮´Cg6Çh¥8=’Š%hU åí™Sî·’|Ì¡)‡{—zBÅŠº¿ð"qج5å§\ +p +íSß»bò7+Ö˜ß áænÍwˆ'£#µE°n x‹¢PšL~|ö4KQ¦–!¯jn£ÕªîØãVBGE”}œœ ŽýÐ{ƒéV³”Vã0¾ô.¶Tv‚Ì|` °SU[¸U! &ýø7 >hI£YÉì0 …òÇ*껪¦úݳj€í¨ž¨ß`Ù?8sGx9g3ÎîèñÙt÷:n:—S úluHx‹œ›ÍÉPo·«ÃJAüÕh€ß¾ÅW'ˆÃô´B ¶q…¡Jˆ`“ý kaæ®´bg>–MO”¶æB8uk—ÄþÙ7)Çê®Ü¿5GVQ(ë¿Pm-FG*åTA¸¡WK2z)· Ž×?3Ì›QOl +s¹ +¹ƒ%ÔÕÝÙêjýX/â +endstream endobj -1161 0 obj << +1173 0 obj << /Type /Font /Subtype /Type1 -/Encoding 2737 0 R +/Encoding 2807 0 R /FirstChar 2 /LastChar 151 -/Widths 2749 0 R -/BaseFont /JHLZNM+URWPalladioL-Ital -/FontDescriptor 1159 0 R +/Widths 2819 0 R +/BaseFont /IANXSZ+URWPalladioL-Ital +/FontDescriptor 1171 0 R >> endobj -1159 0 obj << +1171 0 obj << /Ascent 722 /CapHeight 693 /Descent -261 -/FontName /JHLZNM+URWPalladioL-Ital +/FontName /IANXSZ+URWPalladioL-Ital /ItalicAngle -9.5 /StemV 78 /XHeight 482 /FontBBox [-170 -305 1010 941] /Flags 4 /CharSet (/fi/fl/parenleft/parenright/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/a/b/c/d/e/f/g/h/i/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/emdash) -/FontFile 1160 0 R +/FontFile 1172 0 R >> endobj -2749 0 obj +2819 0 obj [528 545 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 333 333 0 0 250 333 250 296 500 500 500 500 500 500 500 500 500 500 250 0 0 0 0 0 0 722 611 667 778 611 556 722 778 333 0 667 556 944 778 778 611 778 667 556 611 778 722 944 722 667 667 0 0 0 0 0 0 444 463 407 500 389 278 500 500 278 0 444 278 778 556 444 500 463 389 389 333 556 500 722 500 500 444 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1000 ] endobj -1025 0 obj << +1037 0 obj << /Length1 1630 /Length2 16214 /Length3 532 @@ -14029,7 +14500,7 @@ xÚ¬¹eTœm“-Œ»kðÆÝ ‚{pw×Æ¥qwwwBpwwwwn‚÷/Ïûž™9kÎùu¾ùÕ÷U»jW]µë®^½š’TI•QÄÌÁÄ\ÒÁ ÄÈ R ššÛ»˜Ó, œ¶ÿ> üfîajîøÄ -hjcÿOó9ÿ
™Û›ý÷úÿÊô¯ê™ÕµDeéÿ½Ê¨jûw¾ Y¹¸ÿ ¡ôw@jžŽæ€ÿ•NSÞÁì?ÿð‰Š:x +hjcÿOó9ÿ
™Û›ý÷úÿÊô¯ê™5Õå¥dèÿ½Ê¨jûw¾ Y¹¸ÿ ¡ôw@jžŽæ€ÿ•NSÞÁì?ÿð‰Š:x 2¶7û;nÿiø6uuvþ«ò¿6ÀßëÿÇù_ƒonîanŠ°¾â`Ê b‘ ªÃÍ ™× èc… u,mT+* ¨qèõψØå4z«
ejšáûh÷\>s|?üFw4Ö‡cKÝ›f~ùЗœ¶¿ý'U'7ýQ³A)ræ¹fŒ÷Õ’Ü”‹ÆÑÞ”²ŠAÉ ÑL'»3ÜÕ#m ‰ªV¶ý^]n?É÷oŠ üÐìæÇÕQÿÑŠ´Këñ¯0AÙ ¬ŒÚ#Ûõ½ü¶Sz_“Ò¶Âæ°Â¯£Z¬ 4¦×âÚpj~¿H]c}jÇyŒ{ì|yz0Òä$·‘×ù³›'È úKåWµ0wïèåóä»÷ ¦¤†®ßë ÓôäNg@«ÔËfR~7øX3X¯§º<†ž‡:;D݇ Y‹’‡±ÇƲ ¾qv"©Î.嶱8Á[Ö†¸gÛyŽ ‡Ø @@ -14083,80 +14554,84 @@ T S!õ\¶ZãÒJ)¡#¢:sÌæÀŽ_îR·è¢#Ô¦Bò êOqÚô¡9U¤ $Ö=6Ððü|Hò‹°s%nS,{¨üˆ&õÊ’—8$²cå’6¿ p[Žx7íj£\k@?®ð¶ "Ü<4s=3Ña½BÚ_Z¼–âç0h^×IÓ¡gÀDFÌû"O,v}V%t ïæûüH¦¼¯¸Êi¹ò¢Œ Vº<3ÿiúü`+zв±ƒõ¤âBy¿e5m¨á^[ÄyaS©aŠ€()ÞŸíÆÜ=7w3ÔV³Md& ðÑÈå’½Teöä´þe¢QŽh¬õ äØîαÿ”øg ´>»6¹”¼g´(>\PóÔkºßo†‘vÝ8‹¥‡HZR¯±˜(rÔs•Ì7R¶s×»LíªøŠæüz!ÁÈ
U[–Õ²69§QŽƒ.[¿’6çÏhüS—Wse®÷±dßbfïyîI‡dÁFbNþ%ÕgÔÆGœ¢,bœrü(šÙÂ%+'‹
Òl£g"îuªrC`Wro¦1€5Ç CÈ…çpû¶šÍÄ]sG¹ÑOnäàrqœìZI=…M}…)äCQÊ~ ê!µŸ¾Dz9·%eÞ!û©ÆÁ”,Ý,>׿¿âb‰lGûrs
RøV0' uV·ƒÔ) É ²;^%! #úㆹå"à÷È“µ ‚i4Í p#Öo·¤_Œä%±!¥Óæ`…(`¢ix¸ü={Pìr {[£3þÝɶ*\Ôvµv ÈÆe~0{zŠJ"É®Ñc µÄÀ‹í_~ …U¢÷íýwõœÅ6o¸JÚè¨OÊÿ7E®Õ?ÿm]~»úàD¾?œñ Ž¹,à¾$ôƒc2‹™‹ãé¸æß‹M|&ìšp{³×Ó\Ì «e
•Œ¤·Æý:®s”CrªÞr±[G^…_x[ ´?ÒØæå'®Öܬž ¥Škv5‰GlŸ 뽺>QÄè5ó†…¼ ~šÒÙŽÝ ÙvnÂ|*ÑÐaòÝ¥ÉÿÞ^á=tønÚÖ•_ÎïxPðdòùCß•bRæw WbgÖJ?~årοþC¬[BýädƯ{ñ h§úÍwÓ‰Ï'}2~Ñ]Ø6å°âÙŒ9û ²&ÜÔîNÖñûö¡î±`luî‹)G2O=ßùEßCùä”Õùù[ -¹ÓÏ™wŸ˜sìÇÆâ@•»¯M·åöMXvºóEÿÿu9~Û¤k²¹¶…ê¼ ª?yÉg“º”òÌÜ{ç; OÛ«YŸ$3iÕæ#ÛÏn•8²oväóŽ7¯ã}ËÏëÕýÜá?÷þ¹ësÿ„æÕäÈ© Ù÷pö.Õ`¹fýO©a›K<ÛNîêè=|ˆuÖïD©â¹µßýÝ^Ú(šDªM?T¹CÂxÝ;)ñ´g¥ÙE NÓ/Û¾}õ%×ÊÛJ®Q†…É9©‰E%ù¹‰EÙ\ +¹ÓÏ™wŸ˜sìÇÆâ@•»¯M·åöMXvºóEÿÿu9~Û¤k²¹¶…ê¼ ª?yÉg“º”òÌÜ{ç; OÛ«YŸ$3iÕæ#ÛÏn•8²oväóŽ7¯ã}ËÏëÕýÜá?÷þ¹ësÿ„æÕäÈ© Ù÷pö.Õ`¹fýO©a›K<ÛNîêè=|ˆuÖïD©â¹µßýÝ^Ú(šDªM?T¹CÂxÝ;)ñ´g¥ÙE NÓ/Û¾}õ%×ÊÛJ®Q†…É9©‰E%ù¹‰EÙ\ endobj -1026 0 obj << +1038 0 obj << /Type /Font /Subtype /Type1 -/Encoding 2737 0 R +/Encoding 2807 0 R /FirstChar 35 /LastChar 90 -/Widths 2750 0 R -/BaseFont /UXBIOO+URWPalladioL-Roma-Slant_167 -/FontDescriptor 1024 0 R +/Widths 2820 0 R +/BaseFont /WUMGIN+URWPalladioL-Roma-Slant_167 +/FontDescriptor 1036 0 R >> endobj -1024 0 obj << +1036 0 obj << /Ascent 715 /CapHeight 680 /Descent -282 -/FontName /UXBIOO+URWPalladioL-Roma-Slant_167 +/FontName /WUMGIN+URWPalladioL-Roma-Slant_167 /ItalicAngle -9 /StemV 84 /XHeight 469 /FontBBox [-166 -283 1021 943] /Flags 4 /CharSet (/numbersign/parenleft/parenright/comma/hyphen/period/zero/one/two/three/four/five/six/seven/eight/nine/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/X/Y/Z) -/FontFile 1025 0 R +/FontFile 1037 0 R >> endobj -2750 0 obj +2820 0 obj [500 0 0 0 0 333 333 0 0 250 333 250 0 500 500 500 500 500 500 500 500 500 500 0 0 0 0 0 0 0 778 611 709 774 611 556 763 832 337 333 726 611 946 831 786 604 786 668 525 613 778 722 0 667 667 667 ] endobj -963 0 obj << +975 0 obj << /Length1 862 /Length2 1251 /Length3 532 -/Length 1860 +/Length 1861 /Filter /FlateDecode >> stream xÚíUkTgnõJÀ+Å€€¸ -æ2%(Ë © É„’ L P. (‚€`P¡r¨´RZ/Àåb°¢à©¡ 7‚ V®º¢î -°ÀL~`Ùˆ °aŽä†`{Á˜“ÿ†©åÍ%|¾$Xh¿˜Ò_xHÀãG¾U ‚0‰FW„
£ÂåR_xÉœ+ÌæIËY¦âóXŽÂ`> @"ÙšºDðDÎ<)Ìöà‰Y\€ñEð" ÙË`ñ-!íscøìÞmõv®‹¤ÄŠ÷G†Á -ø“‰d2ˆ ±÷ÝWÀ²Ív Y›' (T[ -4 ËϬU1HNû
†ß…ý]ÜÂälnÔTêÙßL_Ä
þ1ùÝú¢ÂÑ–CÈͽÙ3q#®'ʸϔîuöÕeÆ&Ä^»qZROHΕ%µ+W=Áß°ì<´÷>Å8<.ëHø˜‰‡†®{¹ì²½vB‚@ÍuÙDy•Ù :šóÏJÅ´°Õˆú©G¸ªwó¶]“ k_*ð9¹íG5ÅRÒúmÍ~vàýéjŸ
o2<ë`èç~úÝY?õËð¼ù#Ãêc*wYŸüîÃüFé÷‚?þ6T:¾6ÿêMùU9Ñ™Ð:ÑڳȖª8ú`Ryòú˜¤á†½¹Œ¤¼EñI8Åö/Íó½ðƒÚ=’uYeñ¨ª©±§n>%pPô* º«¨ú”>rž:WØOV–úÓ?÷Þûk UÌ9áøü—“¤7‰ÝÏ5êZ¥Fe¾Œª”©éÖ7›=²Ú‡ÜõdsV– Jõ*ÉÞff·³ßpÛ.ÎÜùߥv-kÆ}‰Ñv:^ÁN8Ëužüt§yçknþÓcÑ)òá">qÿ=Õ -•ú”Qýž< bŒXW˜vþW· …Ê”äùˆMùC×+v Èc6{·< [7Ûô2ÑBõMf•‡éJãâ¾W%• +æ2@ ŠMË%€ +ŠT†dBI& ¨ÀŠ T¨\*”Ö °Àr1±¢àY#BAn¬\uÝôØ¥?wíÙ™?ó>Ïó½ß3ÏûóY˜1} .l$vC„bHi€«‡ïA €D2ÎÂÂ…!1î‚Ä0
+‰d2ˆ ±÷ÝWà²Ív Y›' (T{ +‡ ¬¢1 À²a) +Ly£ÖÞXû¢ ++¨É5Ýõ4:âûúí³ûñLj_VŸ>ø¬´^®ÛUo +VÝìè ¨Ç2çÄ2&i¹!×` 9ޱʺy½¬Î »æ¬LÞ«gªÝ§ÊŠ6PšÉ*ÅA<ÎÝ™Ìô f §·ÿ—Zq‡›ó’½Ÿk4½/*ž•!g·nJõÓ$3N(^ŒÛLŠÆ|ui—:KýSŒ-£àK
ÎvÓÚ.ågתJ$§í&Ýÿâ¾Nnar67z2õÜ?Ì_Æ
ü>ñýú¢PÂO1ÖƒãZȽÙÓqà F'˸ÏU^uNÕe¦fÄ Ç1‡¤îÐHœ3*KjSzŠ¿iÔqhïŠiD\Ö‘ˆQ3¦–¾W¹ìŠ“nB‚@ÃußD™Ïì +Ëùg¥rJ¨0¡~ÊÌ +U)És‘›ò¯7Vì8Çhömyèp|ÝLÓ«D+õ·™ULó•¦Å½ó%• endobj -964 0 obj << +976 0 obj << /Type /Font /Subtype /Type1 -/Encoding 2751 0 R +/Encoding 2821 0 R /FirstChar 13 /LastChar 110 -/Widths 2752 0 R -/BaseFont /JNBUEE+CMSY10 -/FontDescriptor 962 0 R +/Widths 2822 0 R +/BaseFont /LSENRB+CMSY10 +/FontDescriptor 974 0 R >> endobj -962 0 obj << +974 0 obj << /Ascent 750 /CapHeight 683 /Descent -194 -/FontName /JNBUEE+CMSY10 +/FontName /LSENRB+CMSY10 /ItalicAngle -14.035 /StemV 85 /XHeight 431 /FontBBox [-29 -960 1116 775] /Flags 4 /CharSet (/circlecopyrt/bullet/braceleft/braceright/bar/backslash) -/FontFile 963 0 R +/FontFile 975 0 R >> endobj -2752 0 obj +2822 0 obj [1000 0 500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 500 500 0 0 278 0 0 0 500 ] endobj -2751 0 obj << +2821 0 obj << /Type /Encoding /Differences [ 0 /.notdef 13/circlecopyrt 14/.notdef 15/bullet 16/.notdef 102/braceleft/braceright 104/.notdef 106/bar 107/.notdef 110/backslash 111/.notdef] >> endobj -960 0 obj << +972 0 obj << /Length1 1616 /Length2 25435 /Length3 532 @@ -14164,7 +14639,7 @@ endobj /Filter /FlateDecode >> stream -xÚ¬ºc”¤]°%\]î²,Û¶mÛvuÙ¶mÛ¶»lW—mÛúú}ïܹ³î̯ùæG®õœˆ8;vÄ>'Öz2“„@^‰FÀØÎÐDÔÎÖ‰†–ž ¢¨&o`mm`la'M£hgc +xÚ¬ºc”¤]°%\]î²,Û¶mÛvuÙ¶mÛ¶»lW—mÛúú}ïܹ³î̯ùæG®õœˆ8;vÄ>'Öz2“„@^‰FÀØÎÐDÔÎÖ‰†–ž ¢¨&o`mm`la'M£hgc áàUûZRR Ž_&½þ’ÞŸfx¯%Ê3® ôEþsÈC®” ô“‘Bå0²TU’?…šÜ¡ˆhÍÒVùòýåm»T úÃ8Z§ä‚Û°ý ³:I?Ôöz"6›Èbœ^% yá×h}×¹Z ypÓ‚u=jëé 3\xœa(74nŠïRýƒ&cx£aYKÜ¿‰~ػբÉI·XiêS¨“2ø ú›G²¨†lkÕ›$ñé³øI ñƒ<½*;:̽¤PœT1]š«ÚowŽ0~,A¸ÕO˜Ó%/‡ìdccÅ÷‹k×{GKÌ‘›j™(+ÔBUÞD# ¡6ª:Mð%¿s¾†I¼;v #wïRUèB&%Ô øªÕ(cÊïZB™ª³/7í¿ '|8¾—}Z£ 6Ã*DLi´¯kâ'/rn¶èXÐ60µ!~Èaïގا*\Dxc(uè³?^NWù ±CVØñ Áá´ÅÚ Q[´¬5üŠvȈ0Kïø^•vµÚ*V¦°cœ
(p3“¸µMÖiÒ|#Óƒ}5ãByE¦Ç•yÖÌÞ¢º<^×<;>3ý ÎÈ;V<g5j‡ùôIH ›C„ÿæaTÓ€ @@ -14267,411 +14742,438 @@ PÔ3)lmŒ;œ¸—ü“5|—î”+ÀTÅv‰¼Ô_òF^›b QãLT?yÇ¥ðb²èewïA© !ÅdYò]mÝ ÏÈÍ[Ÿ ‡)Í1p’}l‹ÈÙ¤û¨¯šð1ônQ“Öü:”ƒ‘96êì(…+õƒ<“4Ã7Q|ÿF1°²¨üñ#\õl1ï ,äÝ?7Âeì7®Œ½nØ<É„3ÄÓ›rhNBRòÂÑC ^[ÜÀ!ÄŠxMcOÝ—ÙPFt>l¿‹JF¢‡ßÂöð1’£†°åïxDÑv hÇÚ ¥åã—r¢fY—òU·zifÁUÆz*JfU¤ËÞ ½ ýä|ÿ:Ð(Pk<’¥WÝìo*Á]ö…gP³Šþ,ÚFjî¶%™;ɘ¹á9L9.DœÇǦÝ@sOµhòÚ³Bãt ÑsÒ~ˆ®›×)-ÉA -ÇГöÞVMýͲ:“®³m›ÓWBÖþü/ùÁÿ ±©¡“‹½¡“5Ìÿ +ÇГöÞVMýͲ:“®³m›ÓWBÖþü/ùÁÿ ±©¡“‹½¡“5Ìÿ endobj -961 0 obj << +973 0 obj << /Type /Font /Subtype /Type1 -/Encoding 2737 0 R +/Encoding 2807 0 R /FirstChar 2 /LastChar 216 -/Widths 2753 0 R -/BaseFont /XZMMFL+URWPalladioL-Roma -/FontDescriptor 959 0 R +/Widths 2823 0 R +/BaseFont /JOXPRG+URWPalladioL-Roma +/FontDescriptor 971 0 R >> endobj -959 0 obj << +971 0 obj << /Ascent 715 /CapHeight 680 /Descent -282 -/FontName /XZMMFL+URWPalladioL-Roma +/FontName /JOXPRG+URWPalladioL-Roma /ItalicAngle 0 /StemV 84 /XHeight 469 /FontBBox [-166 -283 1021 943] /Flags 4 /CharSet (/fi/fl/exclam/numbersign/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/bracketright/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/circumflex/quotedblleft/quotedblright/endash/emdash/Oslash) -/FontFile 960 0 R +/FontFile 972 0 R >> endobj -2753 0 obj +2823 0 obj [605 608 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 278 0 500 500 840 0 278 333 333 389 606 250 333 250 606 500 500 500 500 500 500 500 500 500 500 250 250 0 606 0 444 747 778 611 709 774 611 556 763 832 337 333 726 611 946 831 786 604 786 668 525 613 778 722 1000 667 667 667 333 0 333 0 0 278 500 553 444 611 479 333 556 582 291 234 556 291 883 582 546 601 560 395 424 326 603 565 834 516 556 500 0 0 0 0 0 0 0 0 0 0 0 0 0 333 0 0 0 0 0 0 0 0 0 0 500 500 0 500 1000 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 833 ] endobj -937 0 obj << +949 0 obj << /Length1 1614 -/Length2 24903 +/Length2 24962 /Length3 532 -/Length 25789 +/Length 25846 /Filter /FlateDecode >> stream -xÚ¬zcteß³mlÛN:¶“ŽmÛö‰mÛN:¶mÛ¶ŽÙq^ÿþWoÜ÷>½w?ì1öªª5kVÍZkœ3Æ&'VP¦4™Šìœé˜è¹‰T•Ô ml M,2tB -Ѫ&ðëöÜ(ÞÃÇ‘œåRMyû©i¯MH>c¸¤bq›‹bgÜë㤸>· +Zµ‹¥{ü‹q=v¾ ™«O¼—«Ñ )X!íÁ/$ä±)$§ÁØ^‘w?í¦‘ù]€§“X.2)§©Êer[¤ .©»¹™ ;þÄýI‰ŽBà A¦¸¯»àÐaÁôÞ®|û³ 5 ï8sêÓ† -"ŸÍëã-ö .TÞ; ”Ïè*Yp§«© ‹ÕÀKÀk" !œÑE¾[O žKA3æTv7‰.ѧü™"Ç S"V™bIÆ@Ζӧ - -áê¡טÞO¿UæÝ¥šÑ<ÑmËs]T+¤O˜¶1¸¶ðææ#¶V0BøkÅø‹‡ÙÔ•º]Ö²$ò}‹ZZ–$ëe1¯¥P¬É}éîjÀ(RŽ›¡ÛDZù4 P™
bw×4ªeÜêI™A ¿RñŒ24§iÒƒo•æ7…j,;Ù:Œq«úÑNèHåÊÓBuNí|ÚÌ -6q!#z~`i# VEô yA
ã -5?Ä…J‰¡?‘–x°Š:p´xî@ŸË*£WƒõNQŠÃómƒË@ bÙ‚ÄÛ6=_ïc¨Å¨üÐIûVs/D–)h=[¿°J›ÔðV]èB¨öK 6J‰ôÍî=®µ5ðç"YAr1äc¶Ð ô¢.é1ÄéÀy²†_Õ-ÿ)¥º*™ïH €Ò°@¿¿ßå|Ç1SsüîóFXF¢ÙB¤þŽ0¶m粿R‚žPï[#@U4K£»åí8c¨tÜÙÇUmÌ ƒ z‘HÌkËKÙœ¨ÈÏC—ÝœÏÈcí¤šö‹›ê -Ú
1ËÔå -Éqž— êhËÏFÇ=êO”ù+Š<cÁ·.üIƒF&Tfj%v}Hæ®»º/Þ‹:€…tq>ÆSþRL|žíl}„¨IVâMˆ³¹¬|övW£UEqݲ–^`)d_„¯×aå0áï' -µãJc 0Οó•wê(á·ŸK£êÅ¥Ç<ÌDø¨n {AVÈSb˜1’Qêg aW¾ ¿á¨À+:Q˜šš“ñ‡m¼º…·mÔ îy©¤»\pºAŸœ,)üE»Ï Êüœ‰Nó í—éEgB†Ý·ÚdŸu5C -<…:0µo$V éÅŽi•Ú¤ËöÑÇÑ.f ó³X©f‡¹5JQ·&–
%CDÌ\jö˜B‘u/‚§~;kµ$&yU]ôʉۿæIÎE¤Š”[šÜ¤ŒèGœç³>JýjˆÌUÔ‚* - e«1‹ïm Í°–7p¤+’qy+EßÄ[·ü5ñŸòÀ^îF „}fá•I û~c”sÄŸ[&ž¼‚Ÿ?/žaÑvãEÎY\T{‚ëv<ŠtcûpÚ¥AgÒg ]`Ãʉ JÛv§ltê- \5©1&ë” ä¸¯¡¨ Mٰ݈?T™ðï.™mëßýߘVý4ÄK/Ññ“ê4„ T² (óìï@ -ŠuüìKœã!¥}=—à|ÖÀ¬B®ÈJH‰^M(B ¼µÂN8`æXG_æó"XÙ´èr6á`MÞ5f¨tÓ:JëiLÙÓ{ôx -קµ÷YÏÛP–™Î›ä‡¸-f: ƒrõñò;57ì>\ǵ¶ ®Ã¼}8&;DPí…eªî¢W¼' -aèqÁr1t ˜9f»+ (*‘³- ÃòèRö£½gè–ß~ n)véâlOŠeøÝܨë?PÃ-L¿Ol‚€qäµê=¬ŸR ©Ì…×9°zG B¸w{&=GHÑa*ù£8uÊBâŸèÎ 6ZÔöŠ¸ÇÑ>Õ‡žC«ß ]ü®A‹—Ú!2|XIœµr®5è (’v¿+ãïùF\4“®=åpß¹Û Ót8RÎÀàx“š›„ÇÕL9[ôiÎ.¶¦ð Ri£´c=S‚<›1ÍÆv¢§6õÈ™\Þ²©Ôÿª -Æi 2 ÐÓB¥·åÒ
îÕ±Þ:D!€ÊW"²À˜òÞÅ¡èüxÈ÷|¡á3 2y÷n/D #PÖ2’©Èk.؇Hd†£Lv{ÛñöûüŠ½lµt@ïH¨”;áBÑ2«C¬aCõIð #_”½ª†'î ,ÏG¯ û)—DÆ*~Ì2ÐüQDyô¡ºôå &ßB êf†³Ê²è˜:³ tu ñ»þ9rK*8]©„·]ÆîCŽÜiŽJÆf§Ô
0ëRi× ð¦h a&¤·—ϲSz… õhßÝ0ÎÔH—Ì-zÑmžÛû
S úQóÕFòב,<yt†¤ç“jˆLU\WóaSà¤hµR$@IÔ³®kð†®ËÅœéçºq+¹¤å`” -þƒÁUÂæWˆÌ#Ü\Ò€h®&ŸÉ5é=úPȆ›Q4¢ÁÎJG¤Þ^¿Ò½ -…Œµ@w‡þKLàí÷‰ŠÆŸ -çÈz%ÿjv꡼½ŸY/fyŸ&ž<tj«öÒlò?ÖŸÑqÕMêÕA•Ž—ÅïƼQa¸á;
d:…Ö`‡-^uI&¯,ªÆ‘ÜÏÆ¢VÚ57Ç´Ú¬3W'¿/ ÊŒ£Œ¤ Ðyû°n~œ?xÿ棄ïr6ßÛS+#ÆB£Ï=¯Ui ƒ¢‰w5ô,· -Cà—qžàî´Ô›‘õÔÛ÷5ÇPÍrÃ#Ä^ÄïŒå—“¢¡“ôâm‡{£ÊÛìF^¿¬¥V -ÖY¢ï㸠‚çõ(‚Ê7º¦šßaYY®ƒµ‘î¯ -Z[Ä…‘ÇÌ®
g{S”v -…€˜!0"ªó:¤¢¯“‘ -£{t¯TÁ>žµÁ½ ¢¯.šIw™Rçè²óm+5؆+2¢¶¤Qûg ©!“Q¨¿E&·„•º"²Zhu‚è (4¡JRE†âþ [,›·äbU8ì`Hj¬F(Á2"Lã<û}蔸ÙÌívØ_ƒ8Z¢Ý|„Àh›œ_á³b Ž¾–F Èe/í‚œ6¿ì~á0€l è'oÖßN‹¾'tK à©H
øêÇQud8ÖVX“'K \¸ÈÍ€‘•Û¬d Ô‹ßÜhû¹ÏýýWÅάJT¨dÝ'›h° ÙÞ @Ò«û3pw+Ä÷–ÆŒÅÎés—øj¢:\ƒ;mBÔí—¦ ‡Î®÷É€’N#ÒÀØóÍìÍ~êe¶!oEγqi{ÎÍ ÙDoM¬ÏÇEðMFðêã_Ïã8°©ý«¯Jw-!<À~e•\B+SÝP3èŒ"ð= 5}Ö;QÍõ Ë^ŠïÊ¿[qªsâ#Ï·ÈXs© Å!µüôÕdx´@Æ×<8[õ^ìMÌVhx²ýç@÷Ô»¤‘ÏÙõCYÝ–«<PµÈØ…„ùå=° Üœ±üÞ¤Bk‡‘ ŸôÓ: -Ž3^ïîtl7éE ÐR^™UY5.ÔÉ<ÙŒ?tLúdN¬OÔÖ -Ô>Ä*â-æ6Ò}É›@C Ì=ÒžæPÛÏÓUmeX†0>¥Š;qA0hºxôÌ%šæ¡îËÀ÷·]³c^þå˜[¶Iî4÷,_#5é¡ñ;X“g+É1¨ê#=µmuþm^G˲K‹c¦éÆ3 =U_²Ÿ}{óÉɶ=éÜ~Ã*Ly¾•µ1hÌ âÇ„'Šƒ{ŸôHrHOðŸûû“7„æ
¿Z6ÐL4Ó÷€»Qª4™Ö®ÍåY»s¿¥¤Ò'w²¸q;F¸5ûfå9$X†/ñ‘2—¹nl¡-'jU¦wíû E¿•¡¥\H[‰Úû¦ËÞSŒâ¼ @¹8>Üp¼îf©óXŠ+6§Ú ¡¥0”j9Ímp\`Y¥¢«§ -–0@JèÝõ5@9>ÐmçæsS£pð\OÏJðôEXŠ±É¬Uâ”Û͆B¨Ç—ùYʦ˜nà^`nn$ÛLÆ® ¬ÂÇýã?µòÔ 5™ŒQË ™Jƒ×C‰½Ñ=´³q™»môûrlîÆ"HµÕÿý· ”TÑ
Ð)§^nL¾”¦–ãiõ@¨Î~†+ÆÂÆkinuyÄMò.-ÛŃ«×åÝ,>áa•¬ -…>èc‹ÿµï"¨ÈIÓè Û ÝÔÆ./>À"¸x »øÙ^ªç-RR¨¥ ñR-Åå\-‡´¤DoÞå±($ú&—øôV°â½âî”Ä`(f þQ̤Ön•W†&mr¦ òäéŠ7K¢ðUVž¼)(E3ô9€…Ûn’ª“mÎ U@âÒS²ëÔÇ@×gÜÞÒ—Ppþ -¶¨f»Ü–õ|Ï bžcÞ2¡„<¡N„_“‚ÂÕÉÜ~ `$@ÇдvW›çBº¼6&»SÊv¥Ü “¬[S‰×òñÞõT9Žþ¼K”)‚Zû)¸pÛjCŽÚN+ï'hssµ½6ýIa…äS4XäHA -^”Ô~Ïœ(Xt -zÿÖc:›#é¦,‹ l¾1M¼ï™áŒ
¶èIÊ¡5Díœ
]Í T%f'Á”^…+>l$& úÃå ú[úHõCÿ»_»ßðsÀG¹ zÇ%Á¦«ËªIš ÚF=/÷ó~Ãç‘iç*Oéâ¶;¸‘_ºNê½&úÓ©8õÏh°WäÒýÒ±wÒð3Æ©á¸X‰„»¸ˆRÛz99Ðø|y2+·º¸ôôÅò‹> &cc{¸mÜl|³„ýˆÈ7^€§;{í:`ØÏÓpÏ>ø0#Çù^|V”ñÚÀUéé,±[ý&¸¤ h«¸YÊArÇó×J{D†:ðëÒÚ&ˆßæée¼ü×+[ŠÔ;¾ Ç- áTWQßmtÖUü Ç^ÒlÆ‘jpnå) Vi²+b¨¤ïëìl÷ØéØaK´x4èD0ž}Ó$Óï <¯l<>~ÚXvŒ‘¶5ÙüF;¼RåÅ-NS ÎÖÏ)P¶’ maKËîf×èËÀÊX4ø®ó·œè—ôÑ–`9dfÍ·µÄÉmbc°k›íŽ¾¶‘nªºtw³ ¢íÛŠ²ÞY®%ÈBV¥*(<=Èn®±ˆ¢8w#Ðù÷–ºÒÑ$1wB ú,1AjÕÅ#)K¼kòãùmË¥4ÚHkÛM\áfyÉ7ϽfšWp…ŸDÇÛ8ªÝYqRyœ:+äóÞ™?
HÔošÃ»ÎJÅi5ÍERP†\¤äbchÚJé -n‡¤˜o|YÇœ! ¾ÿ|`VÓsÕ'6¾ZÃ:‘ˆ†XµX–Oß•vnwspÙ DbE:Þ]Õ– -ÊлwB…È1ƒþ”¯úäUoà.ó+i‘ =ÈÕýŠN¬m·þÃxí.= Œ5®óš®H¿><ǤíÅ6‰W¢óÕ³NPùg›ÊXtItàó -ÂÞeî£Ñ|ïÁþlÒ3ë «a3È2À¦¼‹¢;œWË|ºaƹ’å|ßkõ@Rín-Àø A©mr# <]b‰åô÷eœõ,Öœv ŠdüeÛ¹0ð0û .};“Íá“Jƒóû$(f ”-b4ÅVÂDk᤼; àSZR«ä*å½ß¯;l@‰8îXïLÁa¥(S}×9ú ´‹¼EYaý
‚Æ©+g«¡f›"P>ç =pyEµ$C®,s§™eÛ¤O«¹·lœXì.ÅðÚP¢rnÏlƦi _‰æÕ(ûíÌñùh '³¹Ž‘Q]i-> 8F /'›\„@ Hù½Ü{\dß—§S"Ç
i8<hÀîÛÇAÉtã´¦÷ -m 3¡¹ø—)zõ%<§ -³ -ÓÛ‰š SNÕ— =·ÞGæQ\iB~L rb+×ŇbÄÐÙ•+¤Wi2ªhWä. -oÉ1Ê0웘àÍk.sD•}?*åVMVÇp%:h¦·ˆú]9RG®å3/¥ñÛ@f 3öÁª®‘ÙµÿxTº‡W† ×qNë#èô‡F0ôxƒO =E:5½´è.Ü&>Sï$§ØrY§r–¹qJ -i8WÚ ¿\N[Ž”!öL,Œ'nâu¸våtÌ¢–£a¡ŠãµèÁ%œÀ /*w.ˆxé:”~5K(¬mg}îu1Ý3ï㫽ûõW¤®48P‚JÈÐ_¥3UþìÊtÖ÷Á•C3s-ãYYvÓ‚²Y ±µxÈk½S¢¦U·yÔ5ôÔb\z34V£r ,w‡~ˆå.… CYϾ5„]×Úµ'Ó›øs+qˆ)‚‹v«tüc(“Rlh -ï|?ÕFð &‡Åi%DáWª®)slŒAè-¾Â¼`]‚þ¥Ÿ¹´¿½Úî ‡˜çp¦ÀÅó)†–z«.µ°½ã+fç.Ye8ÚzF‚ô³îü AÅ´ãñ!GÔ~0Ѻ<| -#æk›\B23/°|‚ÖN—’ÞÒXtEiÄé(â8]€ -\J®=EÊ~¤¯€k/Pßõ—´”÷æýÖ 7öÝ× øòœ†eô毒¨> ¾hÓ;(°äõ²4\–¸©?
ePiJ~m×뛇£hb3d¹n½gŠŠ=¬ÓˆlQ,~KBN”† WÅ^"Œ“zÞT‘nNÖ®ÿZƶžßiýb.z<!qr.ÂË<J®p^ÞG5’!ãh¦- UøŠ‡vOòÓI#§¿,žà6ËW±þ$ä‹!ôBeÃyGGl »§ÄMIRö-©¬[益Œ@¯}8K¢ÖĘ•àˆ×Gj4×NOÓøÕ¶¯õ‘†Â§íj¾¨Œ(Æ%mÑåÎDÕš9h> þ$®…Î\“©ªm´‚ŠÆ¨Îò&aa.òä^çšàu~{ •q¯2 ]}‘G@åŠä×aÑU®ó:`’PX@h&õx†HˆâóÒf†Bz˨¨_ïI@B&f4Mš¬.aƒ¢KBzê«!ªÿ3NP‰É¥9*š1zÆ\–|wQS…59f¶Øinµ¼IîË -ýÑ
×òÈ_ûAówVäïjq'!1 mS<œ¶»Í² À "áì7 zóÇHnØ¿jU‰f~-Õ·SÊvöñÀJqg”`ÇjY Ô˜.N\ø ý>èây\ÖÛ ˜ÎôAЫXÀþPË#-Ęéý†õ¾ð¥2 0ÄÙß‹„i=óYÃ$¢5Â'5D̸”ij٪ u昬iåOjãa!øêÊL™-ƒ c
ÐøD‹ŠÕ ««Ç•c#Ù= -n®±ˆÊž¶ ®áJ<©ö; €îÜ x+ø÷µ –'IטáŸoŒY™(± ¦¬óÓE_3µ #d1š‘jsÅû³Rñüä~ -«…ÛÁ0|ØÛ¨rž[ñÅ -n£Œˆàwƒm5†‰u“
Ž°‘£óq -/U¼;Ö}â$X…ÚÓ´Kç«fàÓ*MM‘9Œ}ì‹À@ÄèßSš³« <Gëw²¾×+TR–òŽÌöQ„ g @Gs ¡ÀÆ£E½4µl -MÞúÅ>Hd‘$ã^ÃÌ[¡û/äX+Ít ~ÅßþS$3Ùß—~z]ôúYhí²ä!Ô"'ðÕã:t¸ÛÏÅK`ƒ[‡Çxý4õìÐ!#çˆ/jÎpÊ\£ØiæÍÁÆ‹‚- ^è‚…''¿O òD¹Ê·êÞaw•ïí)0 õP`Q?x9š ü°šh x‰?·Ø c~ûZ6ÒQ@ -keG - -Ÿ‚ „¨Õ/k‡
]Ñ º/ÍxÂp¬\>™Lê}û(ù'™y
^d1] ÀGò¤K\ÙL·(Û×9Ʀ i‹cÝ› õN ™¹n,:m$øçhÚV‡.¬ -ÈÙ!z»[úœD ¸¡\™V\aü <I'bÜšÄÎgw—ì£;ÞüÒÙ
¤#~™6HùYS’‡•å蓳6Ò9f|Ðl}çšß‚¥/d¥Þ…vXËpd&—H~T
§ÅÔ—s¬:×÷öÚèžnžŠÕ¥á¢ý\ñóÖr4íô+³»¥XÐvel›¢žŠEJ&vÚw·ðÌ:˜6WG'K9¯ j—‚l¦xÃ逖LÖ^Žqþƒ='\ŽAï é/*‹`~&Ë}UïV…ÆMlƒÙ÷‰x^³CI“=_k<S_óØÝî DÍ æªê.úõ ®3[ù;ìÛ. $šÓžæSá2ZЯ -ß¼'ýPb€XÑFM¿ÊœJ» '“ˆ¸Î„J‡ÄÜg*Ÿµ¤õµ§C*•ñ -¦Çƒç†«4 yãöæšã§>Κüè¯>šbºØýúÅP¬ -ælî tV¸û‘–3qû%ŽY7‰‰p’u1$q…ˆÑÙÈ
ƒŠÙǾ¼\‹uûK¡&˺hûD'n"Q¢&¯iÊ7Í¡ú»šØiµ ÿҨ퉇Ka¯Ñðò(`hò쪆G6XðMÈ ²ß±à;ñÖ¶{õ°”H$3isCÁ†`Ã#: ^üëäçÔ{T\žCÙì¥öD.íðbU'çMPä Γ&.A0(œ”ûéò ût?…7Ÿ4;î¹ÁîRâUÀ0cQ¨œi)‚\ò_\òùÁ±§Ôí"‘Ïn¡¨çW¹@ -4mbA‘., +ù3ÞräÉ7zz¸xº„vFà5Åï ÷`>ƒ¿ Ê3¢jÐ1 _òÿMšÎQ1Y©à$SÁÎꨄó‘ð,?/øŒ#q¹,•Mþ@š7Èlf§¯•1NK¨æ×$£`ÈxE ŠÕ 6èr%ò1+Éà÷
†Cp³pÜo†WiÎë*$•FxO.†@Mñ¹™å «i;Lg{ã v -„,˜›"óšœT&iÙÎà±n”: Èt'
¢ª¬õA©AúÚ†ô ˜ìëI¢ÔJÏöG)MûüÅÁù½¬‡f¤Õ<mÊ¡žÄ«|d‚ÉŸr¨Ù/•‰NµÇYû‹Hª¹®|)³Œó^£»¯Ù¤0B¯+Ìxƒôt~乃FÅÖ–þo¹6”¿x‰ï;M ܪðXB“ô¬,‡C#)bðùð VÕwЙ"§Êh—UZ ‚žÕë}S§ðl¢ @vM 9Jà½é¹Tò}(ú¶±©Øb«çsÈIS-( -G-ƒcD¶–:ß^è†ëÚ8¹g¯y,9b~¦œáV{pî“O'þ’G1¡½à1–ü¾"ÃQíFV©wVŽ¡ÂΕÏa;k²„¼5tÕK®¿ÈÄ´ -&{b¾é\QÊcèâåKŠ¡Û€•\±"Ó{E),ŸŸË#E‘·iUHš™·'6 &<i[ÞÀÑçºËÔg+éA¼Töl¬n´•ÿRÔ—œÄù²4ˆ/å Öƒ
ZÓoíضSG‡EŸÃqÉÛ³í±FÁéÛn´!19÷÷.
ý¥+õh¨Üíïs´q×0
2|—…ÃtBƧ´ä ¾œJ 3›n`m$Ä;Pž=Ì!·þö»$Q¯I
cQÞò>u¯_«÷–¤ËÜ‘ÛàÐðÔKÛ?¼ û©)ÑQTóQUm`¦iø<uè¿>:Ñ[—§sø®á ›)%
¤ç7 óD¨×K×F´XÖŒAHØú¸a—/« 5:›†Šú™ïn¼#`‡+»Þ[øjXZNiåJx)T»\—ØãÚšæs÷DlIÚb`·:eÛÄôöïT£º)£&ïyd„ãì°3e2ò–/@ - .Ó0']Ó _Odqâ®Ä–üå…>#ÞWÖ³cRªv×Sž¼XΧ!8$õËàí
3D=ón“~·ÁŸD㕹=’ô™h¿IÒîÇvƒK>A ¨sÎÞtݘÏZ¶G
U^W0åõ®’•¤¡Íš’ -/<˜“}ß;ëOжrš³<ˆþ–hMèj‹â×òų@W
4tú:©ë•×`±–T¿/à#]ÛÍN›‰öÍQ«ÕÇØÑ£ƒžoŽzB}ˆŒ¢ÁõSÞ˲ÛA!YÛahZg¼¤u|W¾qþ~âWt`us 2yX‚ -¨El* Å3/ZÑÿTãi.)ÑÍ¢G÷8•{ðp œ¾!î4½á´ÞfÍ+ç9'LF¡»^É¿Nd*¹ÆhÇ Ž g¥n)ZR¾œ2/@ KŒµK¨øXI6ÇRÉ ëaµ$ÅîN»- ¢'¼%+iâ?h%Fbs„òj\¥¡uËøÄ
âÂêáÄí(- ¯!Ö0\÷è|žÀ -¶ ƒ
¢E2Ltãæâè¾I;Æ|ˆ»µ]0ÊÈ!çÛ J¢b^ûÙ& ×à}»'0qT[}yë&P½1ÞAæá^™ 0qŒk7 Ù¥±ßbª0Äüh«N±D3Gˆ¾_²ßý&±UG·b`üÂO|=ÇÎYדnj‡üG tÆδ/Œ±§ÚÖ%t}šø hPÀgzÍ †ª©d•î2^G¡¥o¯¡Óü‘UC‹)Ö”ÖSˆ*Ñ’È:k@o‹ý})f°+LXnÅ@ê_
ß2Åiâ(ªt…Þ¨¶–+ÈÛk¿(ŸQg䔈Šfl.¬¤þË8èÖâ¥> ø|gúÜ” -TpŽ‰ß¾®º]+.;+¼•Ý Ÿô6¶èhÕmØóÚ¹ ˆÿwkÍn‹ØÖæaðÙFu—k\!Ïé“>í}Éþ²Ò S°ÅìC½ïPUÈÉÁ¾Fö,éà¾eö4°Gñeá ºÑ¢Å"w)œ çzO§$#g^†¾I†b¡lì4e—8&áâÄ«ðÔc‰þo˜iw¨ ={€õôI=wlº·(n'˜}ü;h|-Pn%Xª²ˆ~~»'›ò!é@Õ]͹à*îªDÝ*õæO͵˜ý¨¡Ò-s‡˜ÐIò3)‘™{¦_ÇWu†ùµ°\°%ßï7iåÜG¥DÞ ñ?’|%ÆüiG—lGê¾L‹`1îDx,½‹ŒÊp—š‚D~e'K™…V,u¤>ŸâìçF» nLFäè”.1° FÖˆ-oË”pÊøcó;6³ùFma7ACÕW'éÞ¼<«1„6œ&³ƒF5Ì7Òo`¥dº%<‡|W¹[õTú'ÿX '3§ ]…±åvR§ó(›ÜO æÿD³¯ir §ðßù¾¿¡Â¯ŽˆV!"ñ/Ô‚VcYén‚§ F#ütñé¤DÞ@Ä` ] gO»{¬íWxj+.ª¶(XNô`bŠ§Êé.W QT2³Ù‡y©X¦Ž(÷|Α‘Ýv*¤†Õ¤D˜Ï‹ÏâM[E Ó -ëá0íá3õFt;ÉÁš¼‘Þ<ÅyÕê©–ze¢lÒft£?ÿF%݇¤G[dÊ°ó2¯|?s‡·‚ÁÆ9—¸,k/KÁØÖI_ GÂ+Š$ý v$¡G|7FiÃoÑLØS‰µ¶‰V6bBš×F¬zÓä·Wè߆Û#¢š»°žq"® ¦<I6Ãèýñ4 -Û–åÃ{>;³Ä¬²ÔÙþSXqå§%Œo…
Š¥]ôêûæ‰ÁyP ;Bi)Omq”©{‡+™ Y=Ëv—0ÒË+AŸ´ë Ó&5Š÷ÓP„R'ë-â+ „ÛƵq›Ý“<–áC“Þ®›8ÔÁhîÏ#íÞ ^tG†°QbŲ)N#†·î ?±°ù¦„•›£æˆa$(H쵄…PZsÑ&†®é¶àb’ã°¤Œ0‹§§ï»§óD‡~3:+éØÕä}÷ 8ñ`î©?ßÓo›wºFWÐéO´© 0Èò¹½¶BÄÛp
=d²ÿP-âëÅèTÊÏÞg~®ýú=£gl´þC}—&³¯ÁŒÊ÷ššIîä™é9©±ùÉ•àõ+#ž¢˜£ºþ\Öƒ#ÞkÝŒë&t0ÊÝá¦7Ö¶¡ä”5jÌÔ²ÉwvxÙ–î›à`¬ç÷ì¡"a¡f*í`–zL©b¤5Þ+6=jô{zÌ9ùŠ÷´zû¤dI7ý¢éaù gÌ]rä–ºúhl=M(jtn˜3à ¯L2èféòÞ¹’IPË—~/+$c ª‰Á½ˆã+Z ºù -Ï{ªsåšU# ô½V¼oØ6‚ž€‚êƒ37•(S¸nÛ\+5ˆððr~ÉžLO5Ÿ?žUaÂCs`~I®úb®E»IÏZ0<LPÛ~²|gUkìFÒ`×0ÖþÈÙ
[Â3䀳ýÜ;ߢšìµèÓxƒÊ 'ÉÇWõ©>¸y‡(.Uôë ´ŸG}µ‚wëN<heÕn']D³C‹u„̯ä?O V†w9àÊHýžt;ƒÀv7v ŸT¸[xNø%²OfpIø_$§é5.¾‰ìZÌ -çßQ- <F_¾Aºtï=Wxi¿'SŸ{Ç4 ¡†[PǦØÊ v±o*SÚ®²2WÿWûæ° À(ÐضÕØnÒÆnl6lc[íL&ÎÄæÄFcÛžØNcÜ»¹Opwÿ÷Ÿ8«³=ÝÃR.ÅE…E‹UöÁÎtZ‹¸»4Àâ)³SdÖÑ´S p@E‹iɳ×aBk®$^‘½ùèVŒ×
µæv1’qpVnªra\KJÃ02øÏQ?”KñµyTˆ"\ºg‘K®™Ö„Ê›Tc/¾- ª«1ïkÄó çôç%E ׿ÖÃŒ±Læ‹ØÞ¨€áýf¡g·/7Å¢¼R[õâ7ï™Æz’ø/Nzoàû¬åäckƒÇ›˜Äù˜Võð:)ÿýãµüþéJ - 3n -ÿýûAL”2àC¼IÑ2VÃ$:9Ûö¹o„rcl¼Î]üÉ%ä[&=ë6…ï¾ëiÈ¥øOŒ‚ã$K¿h«•uÕ6Iå/8dÉwMNNX’ÔZ1(Ö¥ô¤`ÑkÙ°Ô‚7U%bŸMWž•:+úa™šíù´Ïè΄Ÿ,^Ç0Š!qù«N6@ñË«µ°¤”¯S©iÝÆ{ÝÇ>_À -ÿ?!Cçcæ^‘O}ÿƒ5 “Cü!ØÉ»®?í|”+¨4ÂöªlØå½û$†,øá¾/ùt£ËzÒ~ج¡1ш—~DÕ1ˆ%ÀlÑ„A·ïª©þ5c ŽŒ·(ˆèß…®tÞ6ž«¨ý+>ù¤" µÕØ®¦?¤Fn®¤ðÂÀ¯BˆCÍoä ÛV ü¾‘«`$¸+°"¤u¡%f ?ýãŽVãüZékK
²}_î™ééË@©éŸz™xzWáQ&gvL®ÎØÕÏ Æ‰ÈP¨î¬/uâ¤á£ §XdýÿÖ•fB] -:À€•áŽ±¿X8Ñj‡Œ˜>Ág{ZÐ×Ø°i«‡ºyDj"Å
jµK–D¥«œ.¯üç”äàd7X‘7æ<¶’ Û*¢†ED6 -” ]´±1Ü?“¹FÁ&¦¡l—FJÐs²!½‹Dãpù!/dÔˆOÄŽ]{TÖƒ:_IîÖáíŒãH%#ˆ1`@®Ö|Èuåñ¢O¾.$YP'jŸ?¿5×^Ü‚î Y%’ >É,MŒ20 HÒV ™H³ÊÎÒ—àýŽ³Ñ]E}Tyƒ¿Õ´9•&ÝÝ -¾²Sî¹”s¬
¨Ë¶´óEñźA/Me‘Å -é >Ÿ¼Ã<»ê -8‚ã*[KEUè)ùa$¿N¢µ øïÍÇ>:Ç4Ø-,¾Ÿò>Þ¤¹µÀžSƒ…n5É¡è7»~² §bí–L -•¡–¸CŒ#¶ž©Þ.ί迷zÆQè}ÛÌŒ6™Äò"ò¼h÷üõ2ÿ²,› û}‹0~77_J¼SÕdj 1ø7nÅëH‘óx>/'7ÅWWâ7'Žú yÒ>;Fç:ä{g'àÉ.C»4H%ì²õ8ÃñÒj
MæúmÒ“<ïPѤ}RÐQ}Gý.\Ìûþïã Ú/X…$Ѧ{ЗÝØMÉaúèÜch¨$D -‹ÁcB - -AàÃÐ> 4.Ðt’ÁýŽ`¡ õ1uĬS‰aÏ çF^V-š>¡ý ØN ñ‡0åT¯Ù -·è‡7ëéBñ(9™ÀcY+k$þŶ«Œ=ðµ¢QwL
ä<(ró`,XeG÷¦ÝY–‚®ù ÕKé÷ÈÞHC°£ää$=üæ…q -_Ñ=d´)î`Åœ¬~ sÙ:Uµ ´§ÞV¶_K!Ô¦`‘EùcTñYŽdÊæÎx¹ÓÀÏÕ7s,|äºS†ííRN]exÀq”›ý-Ë`ë` ‰¨ÖÄc±¸.u¹g9ºBµfœ:îïæ2HV1ÒÎ<lš”¶Øµ±HiœQ‘5ü»ž¹Rª»ôB€î.VÂ˵ävŽí®)üfÄ?æˆ,ÞÄoà¤È Íæ -ôéeÉþ&‡2"$8¬íÛãO˜ˆ7SÆ,é -±õñ¨E'Oƒ¦ò¸Žœ²„Œ¨ISŽ§ìº2!²³’D‡H¶ê;”|‹!¶jè²_rDꀩžÖ ¸Øã}ˆ8——T²|+Å׋8¾ûW÷šo -†?Å, Ô±™x ¬ç¥\3*Ï©C¶q0ëß½«™Ž>jâÄ>Kt¤)¦k>(ªK·#:›xMµ–Ð2²ßñ®ÄýRò¡ì‘wz!î,±•ÁÌõ -DŒ–¯ØØ®0o´×\Ú²{löjâ°C ¨õ3Lu3¤RLyz§ 1ÛÁÂË6 ».} À|?ò{,j¢:µæû#-ÝÑ"åHbˆGžaæÀ~À_tݶÛàE• -óc Æ -ݲ+‡S?è oJ£K¤ -ÓþL5ºÐ$p •ü›yBÃ|5»w^þl23(ËÛô€åµm‘ï7ì·5v°“’._ô]ÕDO¸XR6ö}ÇÉÉ -Û7Ñ8úŠßî7;°”—\&›ˆÏæÄeâê.s¤ÆÑŽ…Y0´ÊéÞÀ âžì ‹x4ÜÁw\•fèöê°¼Ÿ3pÇOy³Í4ù”-†¢£À ÂN¿ËþÙP³z[´‹üò®¯˜ Æ®-×I£+”–öH34PçM÷|´wÁ°Qv@2vºŒR¶f¼Ÿ4È,²,BÓœ“Uêä~ó‚ù·•6oáéA+K?ó FC¤h¼ÍRÚ_±L²"çªÒÍ“÷û³ÔBKŒÃ(¼shEŽmä_ÞÙSI
f8¢lEúKAfð²ÜeM¥ ÐŽ™Ü*ÝS‰§d#…$3u}!jÌïƨCaô‚”¿•Ú Q,Ü4ŒT=AÅ?AUJ” e –×S<)UÇ‘¡„cc lÛ mvØsÖË(?ú¸D˺¯xì/Pç/·‡ð bÞ -ËÚ."dšñãí·<ÈAmMãsåýëà½Æ™ûÓKæPú iìЇÖó!œi " -RY,ÀrÚ° ݧ-¦£<@$•N\×:6EwFàC´Y«Uvvµ×çên¿ò\Vê6â~òT¥•½IýA<_½µ™íb+ö@öxž>o´x(°‹àšƒû‹ÿ'õeÓloZK’8´†á'ÔpøºÔfžni(|"¨,ÿ°®u ¨‹êûÔˆ,Фè¾9 {+¸$°w/ž‰’&3RÀ¯„„cÁ šOmÏHµ] Ú!ÝÕJ$Žá -V‘<}6j]'» EVîhû‚}6¡ÝÀ6àÛ·o÷CfÀ¿ièﬕò1e·)(+‚§l¦…ãƒÖˆç\àíÈìk}/y»—ìǸoÕóÑ#Žuo'i”FG œpÖCfïÌŸ¢7j½W¨évôœ FaÇ ¢~®|Z][pÔÖù(Ž¥å
– pÖ– œL®€î2Ÿd#FñD§ðïƳK“UðIó‘½ØÒ^¿ºýO4Jh%9rCØ\\ú+Þüæ8[…}Ú ôu¨›ÔV¤J»ˆ¢<#¡%ÁtÇ2å 7ÙIŸÔ®O™oßpÙêÈ—µ9 §.†* iTáŠNG‚÷Yk (ÅiJÌÇgÖ'gOZU\òo®\9F®hÛŽ²v@›”P N•ªþ|z¥»"^‘—ËN§³$Ë'‡kWØœ.Þe#ÄÚä/ª«:I!îò@F.Ù§N,X!Ϫ% µpºDÖEÐ’6å5eFÙ™ÂôÛ’EöqäœØ+R²Ÿ] C~ =ëÿÖxP„»w(ŠÉTn
ý£êöÅëGÏ!_/Ä!„ûݸЩîçCs›äJ §±üð@ÔÖfË4 á
ü%å/«‚ÎüTï;MKð"3¢Îæc7 -Ú–þb$ˆF›š× 4ÌGÂw6 JBÊA©R"±#ªvw>!*3ûLß´ÖaxqUR±™^3îjÕƪ®vOÍ+ê] N
nìþù‡Õ¨¸®âƒÑ±ÕÉíÍU -`õØ
i:ey/ÓT“îüÃg{qª}ŽTr 3ý\:×îY6Ò °’Ù<eÚCÈ_üiš–Qm–›#öïÎTº9\œëyíŽ&$ÞñeÞ I4ðúl#ÿ¿{ 2/ô)™®#0„ÇB_ò l•û©¥×ë¥ê:&T‡í¨9WÚ!’q¨ÿÁTˆÛ¥â«×™a9¦ˆRPÕ½¤Ô_i&U—M“X<ÜôYÈ«¶ª&v@¤àÆ2˜1j 9 -ƒÖù9üÞë%CßšAÛ±·ÁÿxHí´ËúD®Ãn6j°øc„-± ‘F®mð€äÓz#ìA;L {&a0%j8ÊÔó£{Gµ¢=4‰¤)Ú[ôÐÓ°ÏOw¥Ç÷MªºA:X¹Í ¶Âv4ihìä×s¾ø,‚ÆP’㉖ Õù™\†@¯Á±ÆÎßC
—èœFì§M¹"â“Êonn_Ö³ÿLBfFÄ >;xŒoù3‡ý%¤àö.ÜÍ‘8iòzÍ´ÎÈéÕCùÔîÉ(ŒŒ«ªû-äd˜6í‹(ÇJT*L_4 ¥öÍü…°í¡M¶¤íâ‹1Ö`×xÜe²lÜá†Ö/®;Gæ+àÆÛÔÜÞ釾{å -2K( ¾àÈrG€éI^ݯ§ËœE;ÉëZ$„)½J %† * ÷%„.Jr–&*¹Ü¯M s¶°_k„îš ¿NÆS»‚wX*ÿïfƒ=ºð W=›±7Zx‰’d #ó’1ãZ˜5'`N
@@Ótq¶¥ÙƉ›–îà—%Š7ûÙ¹%.Ìx¤D—ãðÁ³b‰C5ø Idõk/ÅQŠ?èxãê5³¯ÄÖ>Òðuowõ=–è9Y'àã« Õ‚zɦ±¶Ô‚>N
; }`÷*Ž¿ÃÞƒ$“ƒ†Ï|£ã·Ä#@ºêÊͪ²Æ.ˆX³¤ ¾àŽG¿¯ö„«‡w‚MšZögsÎÙQ1ª¡ï±ª;_þSì?“áx´ Ÿ‚^¯I«˜E2•“§–κÛw!l¾:‡_¼sªÔNÿ˜~ù™Û݃[²3ùULiµeižÀìe%¥½˜¨üß’O¬/°”:¿èx>D@þ¦ùòá=9'»|»Ä½Œ©L²Ä/–ê-‚½ÎìÃsœ” ~(áà,åpƒ¡ËRs,Õ:Ž±ÿÃ6hÆËÔDÞï^ÑêI¬'k𽠱ĞÙþ÷ŸøŸ…ÜÈ Æ › ;™l+äñy̼Ú(g`ý s}ÔÖ’×åù$Ï–c†ƒvjlHM»kœÄ^ý08ùqS}ã!<¢¥mPYm¼ÑјÃs:öhª6¯!Û(sD¹16ä Ñ?«r.o ™Éûòˆ ¾SšÉí³•õP1K²EreS‘(§AðÖ?žÔo§G,C<òΔ½kuló µkX“ÁñÓ—WOGˆ‹v$ÔÃÁ×a¶D´ƒæé<xç x÷DÉ ºBõoÙòQ3ª‘GÞŠgMyÎëæ:ç
èWƒ’¥oáµ=£öb2ð»±K<6ö%J{ -‹ÅK0}´zc?¹
L£Z^ FªËï;—þ d%CºŸüÂ¥ü¨)0óšâ5µû|#ñÊ1¤Šµ– Pgm _R„®z1ÙïO,îSò[³ÃY[Z…-¶2 -{å]è«X• ²ßæF]T%9FáT âþ¥}qÚxo‚{w;w+h|ŠÏíaq ˆíX7ŒÒz¡î±vñ¨ˆæK܉bs6Ÿ±™"‚¬|;¯mš®u˜4bƼ ý¦þ 7õ™• »Ð¯l(hõ)&I—¼¸óÝ ô#Fê%yDôêWÖëÏäôD‡߂ù‘|}Å99Q}â> uôÒ§«h †:úVLãÖzBžÅŒå’F'üÕÆQÓ/9ÎFÝҰɵ#6snœjGöXã~ÃéPóLpJýœ&wB˽óÂób17aªÓHj;è•ßÐðS½]þÅÝpÌÚò“
ªAë8Kžpªä¦<ëñ-ùS¢äëÊõ&}9càÒo˜òt3aëc` St ŒÔDr3œ–ic#Ñ‘x"£ž7ý³–þlÊêIF)^ˆ×LÌŠ[h£IµA _#ƒc«¬LÔ'PŒ ö–Tñ™»,Š x´År -‹;dTx¢CŠÚµ'x^3$|ÀȽ¬4ì^ᜥ$0ý'©´s
ác@ÓAÙouÖŒÎ@@‹Ù[¨ñÄ#rµì‘ö9s¤Nè2êš>8*û@‹hËçESæIh’V\ºw+›øYET Žë楋ÆEêæcfCoŠåÚM¬·Ôþáéw„IiD¤^‹J÷T¹J†a±kãÂú ôꟶÊçÆck€-T ÿŠ×Ý¥èÝû -¥`M/\oõÛþJXSù6”¿ü'ŽOØLaà¨oÍZNõµáø÷P³¬æ#À«-’·^=èCp§“´ñ»wÓ^»±òž,àìÎ-3à rg‡lÖ:G> -‡ û$Ëú*Ï[¾'е5Ø̽þ^¿‚@rG{XÎN3?Ü&Óvj½ìÖfl3OˆÐ¥\á" ÝJ)P\°7À«J&zgT‘š|†ñhÝh^r×X&âhŒç]CŠÒ÷ˆÂú%#ÅŸß’ïçUUÒÙ$ïRDäü¾Rk¤zwŒñã—Z -UßD„j%‘{7¹’&LoÅLó´T0‰* -Ë—ÌF+uå| ã_ìŽ'¬gk"¸qáD] ² -endobj -938 0 obj << +xÚ¬zceß³eÙU]¶ÕeÛ¶m[·lÛv—mÛ¶m³ËìrMÿþOoæÓÌûp"ÎÎ̽re®Ü;î8dD +Ê´‚& +CF&ìhjèl °1t6å"T75!15&db"däää„!#Ø{8Zš[8RüÅ ¤¦¦ù/Ë?!„F ÿáù»ÓÉÒÜŽüï‹«©
ÀÞÖÔÎù/ÄÿóFeSSBg SB3KSBayMI9qB +q9UBqS;SGCB#KcBKcS;'SJB3€#¡Í¿-v&–ÿ”æD÷KЉÐÐÉÞÔØòï6SwcSû\4„ö¦Ž¶–NNß -Í
íœÿöÀ@higlãbò¿v3À¿Ù;þFØþõýS +fH{ð 1Ycgl +ñi0–Wä ¯}Ã4¿ ðtóE&Åt¶Z \&—Ešà’º››¹š#/(/25©â¾î‚C‡ã{»ò-o8J<îqæÔ§
- +㼑a1Š¯@x×" ÙÍÕƒHQzHÈÈH<àtáŒË{â,ȸ†ÍÊ·K3”’/Y”Ôty®žˆW"So¼¥¯Úh‰í}oSOw½MOY%9 +Ü~ü¬1ÑYpy(Û©˜_H÷²YÔïÄd¤P\Ó8xü0°lmçä+öôkç9cí%ˆ5ï׫M‡G}«/¶»+¡CUa.44@BØ^»÷GQê-îØ-¦e©%C§,µpj s—„„¦?l•%Ë1àLx‚wcŠ2c Q: +\´Ò+j|.÷`ÆiNººÏ¥Í iÔnÌÔp=fu˜…îF×vÉVv¥®‡ÞÑ¥ÄÚ ÃòF-C?Iƒ3q +ºë¡8yŸ^q[bÏÉN-w¿*÷üAfÊR"ì-vkìi:‹¸±ª±8±ä‡¿
T`ë=ÎT(V¸ýw¿96@â2b4¨ñùƹ°+÷é0Lݽ=¯¨üÁÏò›¬<²Ka‡Y|:Ò—žú -E¤M…š;Wl~(ب âüuù‚½E¿û˜ÐÅÂœ‘ƒ(ub°†Ñðâ%Cä%«xzªÀ¸Èûj§¼.²_ǵ'Ô–=m7ÛBÀÆ£¨{×ÄÍ꼫ÂVÅè4ïÇ.M¦À³ì†´= Ò1 + +áê¡×ßO¿UæÝ¥šQ=ÑlËs]T+$O¶18¶ðææ#¶V0BxkÅx‹‡YT•º]Ö²Äò}‹ZZ–Äëe1该P,É}éîjÀ(RŽ›¡ÛDZù4 P˜ bw×4ªeÜêI˜@ ¿Rq24§iÒƒo•æ7…j,;Y;ŒqªúQOhIäÊÓBuNí|ÚÌ +6q #z~bj#ü¨Šèò‚Æj~Ä •C{")ñ`uà*hñÜ>—UF«,뢇7æÛ–8*Ä´‰·mz¾ÞGW‹Qù©“öæ^ˆ$SÐz¶~a•6©áºÐ…Pí—>l”é›/Ü{\kkàÏI¼‚èbÈ Çd¡!èEUÓcˆÝýd
¿†#[Î+¥º*™ïˆ¯€Ü°@·¿ßå|Ë>SsüîóFPF¬ÙB¨þŽ0¶m粿R‚–Pï[#@Y4K £»åí8c tÔÙÇYm̃z‘HÄcK KÑœ¨ÈÏM›ÕœÏÀmí¤š–ÍEy +<…:0´oè%V èÅŽi”Ú¤ËöÑÆQ/f ó³X(g‡¹4JQ¶&–
%CDÌ\jö$„"é^-NývÖj)HLò¨ºè•µÍ“ œ‹H)·4¹
HÑ8Ïÿú(õ«!4ÿѨŠ TQ`([ÑX|oãh†¹¼-]‘ŒÃS¡(ú&Þº
௉ÿ”ör7Z è3 ¯LêØ÷k £˜#úÜ2ñäüä½x†EÝû!rÎì¢Úƒ\·ãQ¤›ÀЇÝ.
:“>Kà¶PNøPÚ¶;e£SoIáªÁ@…>Y§%Çu
EåhÊŠåFô¡ÊˆwwÉd[ÿîÿƸê§!^z‰†—T¯ ¹ \ òË"Ïþ¤ X÷½Ÿ}‰s ¤´¯çœÏ¡À˜5/䊬t ”èÕØ„"Â[k!ì„FŽuôe>‚•M‹.Wa6æ„pà]c†J7´žÆ”=GÇ p}JP{Ÿõ¼Ý E™Ùê¼I~ˆÛb¦(g ¿SsÃîÃu ik›à:ÌÛG³a²Cå^X¦ê.ZÅ{Ò +`'æA!˜üåöhzBåFüÂO/ Ësmu«¤†,óHë‘c¶»²‚lq 9ÛÒ1,&Õh?Ú{†fùíÇî–b—.Îú¤X†×Í…²þ%ÜÂôûÄö([žA«ÞÃú)µÁ‘Ò\x ˪wÔ!„k·gÒs„
¦’/`0Š]AP§ !$þ‰öÜa£Em¯ˆk õS}¨á9´úÝÑÅï´x© "ÃG…ØY+çZƒ‚<i÷»2þžoÄE3éÚSçM«Í1M‡# å Ž'©¹Ix<ŒAÉD£EŸúìbkz?•&Jû7&Ø3Õ È³ãll'*QjSœÉå-«J}ö¨PU0vóá€>0˜Ú+-§np¯ŽõÖ!2>T¾¡ú”÷.6yçÇC¾ç 5ŸÉ»p{á0|õg-#™Š¼Öê‚}‰€D&8ºÀd·· oßxð°Ï¯ØËV;AdðŽÔŠÚJ¹Nd-³º 5¬(> Þcd‹²bCÕðD½ƒåù¨àua¼rI¤,âÇÌÍ EG ªK_bò-T¡þ`fØ«Ì‹Ž©3ûH@W¿ëŸ#·¤‚Ó•JxÚ…aì~ÒG` Áæ©dlv@Ý +b>l +œVŠ(‰zÖu
ÞÐu¹˜3ý\7n%“´ Œ@TÁ{0¸JØü +‘y„›K
¢UÃÑäs ¾&¹G +Ùp3Šþa°³Òi£·×¯t¯B.ãA%ÐÝ¡ÿxcû}`¢¢ñ' +fÊIû þÏ‹±hÒÏ£èÛ9û½ú¸v7òr蟮fA‚åêÛËêããYaŽ ïuSi?eXAO‚8ôÿÜ +;ßýBtÆÅ3{’ù¹Iøõº9Í”\V†õ+ÛÇ€¶‹ˆn„ÒdK;h¢¢ïïñXOÕ ŒÆBW÷ƒd#öMDâá¹{F&Æü¹*|ö«:È^?\
ʽK–ôÜa›\KR1§8_üŠ·å’&G¢±H]š+ÜFÇÝ>µ[zY¢àÈ‹|N™Í·C¼ý8H?»¿ §5BfØLÅÇ£O œõ +vN±1¾{‘/IÖ‰¡ƒÿÛa/¦Àl+oDNk1Ç~â tjÐâS*Ó<Ï|µßCqiÄ™àå^Ös‡oôT»ãœTEÁ«£É ®3¥Ý õ}>²–7²@éã#ÂÖÝb'§8zðã3ÖÂlÞ¸oW¶Ïκa«ø%ýÈ1Éa€%ë굶疉£ÊÎ0z À!>÷º˜µÒÿ"qW îàdÝjê}_ +7ÿéqó*Bjû’€’ V(HóŽx +/ƨÏÏ9êc$§Ôcµo©Š~D xÀrßõ¡%´ÎSݪ5H•ž%ß· ‚S|úKžÜÃ9²^É¿šj(o÷׋YÞ§‰'7í…Úª½4«üÏõg4œcõƒD“zuP¥ãeñ»1o.øN™Na«5Ø¡F‹W]âÉ+‹j£qD÷3…±¨•öÅãìææ˜VÛ‚u¦êä÷™qTƒ‘´Zo VÀÍÏÓaàïß|ð]Îæ{{jeD˜¨t¹çµ*aPÔñ®†žåVaü2Î\}‚–z3²žzû¾æ調Üp °ñ:cù夨i¥½xÚáÞ(ó6»‘Ö/k©ÀKÏÖÃj©Ågâã4*&Ä‹Ù%.‚¡b¬‚Ću–èúØï߇ày|Ê… ò®†©¡æw˜W–ë`md…û«‚Öq`ä1²jÃYߥB! fð+Ƽ)éêd$@X{Lé ·ÃfEƒšíº DKÖƒ)®H| dëbÆèá’«§ å3C b—ƒz°>ïzAìÕhõ.‡[Ð ^ +~†sR–ðþögØ=΂/Qqqˆ! SíC幄{ìyÇÄ—¦‘¨êVeÚ& ò<\4Xõ#¸òYȵ²„Û¤
ŠfÇ/
Èa‡óm‡SyZAð‡°âŠŒA ÝÈ{ûßüxm¤=Í=ë?ªâÛ9fÐ
‚;’RóJ4Y§W#($EóqÃ.ÃöŒ€VCÐcÓ
-| &dòÒô’ÇÃA +~x¢˜¾eÄ6ž Ÿpã"ˆtBù( iQ\mBj7}¹íƒ®€rfLJÀ)q&*»2K¾%c£Ø“Hâ®!?©°ÉJ½¹è
¥& ´3o:ðKÞ†c§Õ¡©Fì¶$ʧ@ºO¹D¿ù)ûÛ—»³Þr µ0ºG÷J… +2™ê[drKX©+²áW nC-¹&TIªhÂPü! Ó_t‹yó–L¬ +›
Q‚Å9XF„qœ{¿'‹©Ý‹ük[K´› +Ž3^ïîtl7éE ÐR^™UY5.ÔÉ<ÙŒ?tLúdJ¬OÔÖ +œ$#Ä ªôÔ¶Õù·y -Ë.-ŽAš¦Ï$ôT}]Hyû$öæ““m{Ò ¸ü†Uó|+kcP™>Ä N÷>éå4Ÿà?÷÷'o̲[6PM4Ó÷€»‘«4׮ͳó¬Ý¹ÞRRé’;™Ý¸ #Üš}3‰òìÌC‡—xˆ™Ëœ7¶Ð–µ*Ó»ö}†¢ßÊÐR.$D
í}Óeï)FqÞø œì î +ÅX¤Ö*qÊífˆC!TãËüÌeSŒ7p
/077’m&cW +VáÆãþñÇŸZyꚌÆ(e‰GHŒ¥ÁÖë¡„Þh ÚY8LÝ6ú}96wc$ÚêÿþÛJªèè„C/7&_JSËñ´z ÔVg¿NÃ}aãµ4·º<â¦?y—†õâÁÕëònà°JV€5…\ ô±ÅÿÚwTä¤iô…uvjc—`\<U|ŒÊd/Õó))ÔÒþãR-Åå\-‡¤¤DoÞå±($ú&—èôV â½âî”Ø`(f þQ̤Ön•G †:mr¦ âäéŠç—D᫬<1xSPŠfès +zÿÖc:›#é¦,‹ h¾1M¼ï™áˆ
¶èIÊ¡1Déœ
]Í T%b#Æ ”^…+>l$Â'üÃé ú[úHõCÿ»O»ÏðsÀG¹ zÇ%Á¦«ËªIšÚF=/çó~Ãç‘qç*Oéâ¶;¸‘_ºNê½&úÓ©8õÏh°WäÒýÒ±wÒð3ú©á¸X‰„›¸ˆRÛz9Ðø|y2 —º¸ôôÅò‹>.CC{¸mÜl|³„ýˆÈ7n€§;[í:`ØÏÓp×>ø0=Çù^|V”áÚÀUññ,±[ý&¸¤ h«¸YÊArÇ3{%-"C øuiíÄÀoóô2^þë•5Eê OÐã–`ª«¨ï6ú×Uü Ç^’,†‘jp.å)tiÒ+"¨¤ïë¬,÷ØéØaKÔxjTèD0î}Ó$Óïn\¯,\>~šX6ô‘¶5ÙüF;ÜRåÅ-SnŽÖÏ)PÖ’ maKËîf×èËÀŠXTø®ó·œè—ôÑ–`9$&Í·µÄÉmv"c°k›íŽ¾¶‘n|ʺtw³ z ÂíÛŠ²žYÎ%ÈB¥*(\=È.αˆ¢8w#Ðù÷–ºÒÑ$1wlºL1AjÕÅ#j)KÜk²ãùmË¥4šHkÛM áfyÉ7ϽfêWp^ÂãmlUüî_qRy :+dóÞ™?
ˆÔošÃ»ÎJÅi4ÍER‡\¤äbc¨ÛJi n‡¤˜n|YÆœ! ¾ÿ`TÓqÖ'6¾ZÃ:‹†XµX–Oß•vnw³sÚ DbF:Þ]Õ– +‘c啯úäQoà.ó+i‘ =ÈÕýŠN¬m·þÃpí.= Œ¥5®óš®H·><ǨíÉ:‰[¢óÕ³Ž_ùg›ÒXtItàó +ÂÞeî£õ‡ùÞƒýÙ¤ç¯sÌ†Í Ë +ëo4†H]9[
5Ûü¢ð9OàÃs(ª%re™ ¼8Í$Û&}Z͵eãÄlw)†Ð† m”s{f36MSøJ8¯FÑogŽÇGó8™ÅyŒ4ˆâJcñÁ>bxx9Ùä"< +P ZB¢«tÆJÞ®Lg} 9d11×B0î•e7!(›Åð +,y¼,
—ånêdAéUš’_ÛõúæáÈ›X
™¯[ïãƒb†Dë4¢[‹ß’R¥áÇÅU±—ã$ž7U$›Ó°¥ëÙ+ÂXÖó;_LE'Ä NÎE¸™GÉÎËòh±F2¤ìÍ4%¡ +â_ñÐîI~:idt—ÅìÒfù*ÖŸ|1^(¬x"ïh(“
Tc÷8)Iʾ%•u«õ]Õhµ‡ cI” +Ægè-—“a´(ö«]A™°u¥$k¿ùí tAz;@;3ò‹¡M]w£6IãnxWd?7¨'ãv¼ã| åço¾>U%€`µæ~a¬P?ŒŒàpŽ¯H¿{5ìà‰=ºZõPìa®”|0r±ø(öÇ =„€ ×÷Áà 86oÖþ%KdX]‚Â}x9ó5ÜÄÛ0® +¢Go± +‚Ùr"ƒÇ¦Û¹gš¡ÄÑ‘ºö6èl•*?õ×{Û'´£·b„éLÚþg&ÂW$„ tçñŒiû 0÷wÂî±í‹IP7 \¼m£ºe&ÿsá "¹M9Ÿ7dò?æ¼ÜFº´È¡ö?í_¨Ô§Ïj–[‹x‡—/{=Y2-vÂݪ-Uº_ä¸ô" aHÍÿé,“ÂÓQv‡ŃG•qƤu±!4 ·³Tú¬@R¨3³š¬z(7vÖ¼Ëï)h“Ü &° vŽa$:„W?Sv©ÿ¢Q“Fn[·‰ýª‘;]£óØ[ºâ&üe¼—N…6 ˜ZSFÄ¢üÊĤ£” [q’EÓ•ìxd§rP?.tÕG¤“|áÝkØ!× $ ñ:º?ûü ËéW,#½çÎ=©EèåE.t]}©váG^,š; I!{¹Ú½X[ÙÚJå_3¢-ÿûaÌp2~銃ÜG«ÂG +on®±ˆÒž ¶ ®áJ<©ö; €öÜ x3ø÷µ ¦'qטáŸodôY™(±Ÿ¦,óÓE_3µ #¤1š‘jsÅû³Rñüd~ +«ä…ÛÁ0|XÛ(rž[äñÅ +n£ ?ÀïÛj ë& a5"Gçã^ªxv¬ûĉ1 µ§i–Î+VÍÀ§Ušš"súØ€ˆÐ¾§4gW¸Öïd}/®W(¥Z-å ™ì£ÎØŽæ>BG‹z©k[Yš¼õ‹}2I#‰Ç½È‡™6¶B÷_È0Wši?>üŠ¿ý§ˆg²¾/ýôºèô¡¶Ë’…P‰œÀWëÐâl?/
n ãöS׳A‡Œœÿx‘P»p†Sæ ÅJ3o6^lIðB,<9ù}Š`'‚(ÈY¾U÷»«|oOŽn¨‡ ‹òÁÃÞ
ä‡ÙD-€ðÀCô¹Å + óÛײ‘– RX›0+R +èùú÷ f©ý‹‚Îzø3ºd”ó‚oˆŽH×üÅöOé% @¥¢ ч"<ÓR:Ï£‡±|Ò-#%<õxZö:YÊö;¿;OL;S¹~ózA´®#Òhc0lúÙ1™ÔéÆ‚·(ímÂïi¸„ +ž/rÿؼ@“ž\±mbçQR†Aɽ»C|ÛÛ$÷cdñW&Áe_¾y©Öó»Þ?cîŽsç°t.Dì]¿ÇË„ Yv¬@ôVêèïiå]?—ÉŸ¦i4ß
©\¬Òœ0æÔ=þ «, +i ‘
fÚ åg5NAV–£OÆÒHë˜ñA½=ôk~ –B´ð+õ.´ÃZ†= 0ѸDÌ[P5xœS_ξê\ßÛk£{ºy*V—†ƒÊ»âç!åhÚéWf5vK¾ íÊÐ,6E5‹˜Lä´ïná™ $t*0m®ŽF,–r^Ô.ÙLþ†Ý-)˜¬½ ãükN¸ ÎAÓ_T ÀôLšûªÞ +“سïñ¼g‡œ&{(¾Öx4¦¾æ±»Ý9ˆ’9ÌYÕ]”ý ®3[ù;ìÛ. $šÃžúSá2ZЯ +ϼ'ýPb€Hù‡š^•9¥vv&!Q ¥±¹ÏT>KIëkO‡T*ÃL÷
giÒÆíÍ5;¯>öšühö u1mì~ýâ (f +Dbôô´¹¡`C°á P/þõ +6‡@%ì„gùyÀgl‰+Èe©,²’4¸A&3;}Œq5¿&³@†+*´PÌ^°A—+‘YIz¿o0lü›…ûã~3ÜJs W!©„0‚{21ì + +†äÝk¤…–ZZØE€,Ã+ nÊÑÄø œ2ã(À|ÐB0ÌnAÏ +jr •Ï„¦ÁÔO‰p¡¾Ÿ°á¡_YM)—‚Á–˜ozWÔ†üºx¹Áœbè6 D)W¬Èø FÞDËççòH^ämZ’¦Cê퉃OÒ–7pô¹î2õÙJr/•õÓ ³uåß¿5Ä!#6dGº,
âCàKy‡õ`…Öô[;¶íÔÑaÖgw\òöl B}¬Qpú¶ù‚˜œû{—šîÒ•j4Ô +Të¥k#ZÌkÆ Ä¬}\°ŠË‡‚—ÕMCEýLw· +Þ0?†+»Þ[øj˜[NiäJ¸«v¹.±ÅÑ·!4Íçî‰Ø·ÅÀnuʶ‰éíß©Fu“/FMÞsËÇÙaeÊò2ð”/@ +¾žÈbÇ]‰-ùË [}F¼¯¬gŤTí®1¤<y1ŸOC°Kê—ÁÛfˆzæÝ&ýnƒ?‰Æ-s{$î3Ñ~“¤Ù1Ží—|‚<P瘽éº
0Ÿµlª¼ ¯`Ìë\%-IC5%<JPS‰V’ ‘çOµŸ>]žÁÞ÷å*„È…³Y£Ž®Íïå>÷Ô‹eÜ.å¿38ö§hgXWü„{Xß%ƒ5*˜Ä…›Ô¸«úÊ*1²ñ°Ö’&þÑgºl× Dàpk•o¤ògªëk«NËcqÌ ;#Øa‚b'H3ßè´x¥ÓqWŒƒ¼ÖíÏGH8P–Gm¸xÙæ¼^#©‚TNØ ´Þ7ÜU¢·f±¿á>÷j¢+Ö@׸—oÏH‡çR=2Ž¥›»»?y…AbäÖlTòÜBgⵑńÄëV ¢@í8XÔìÈô‘±ù EMIÚV‚àµðµ¸ËìiÜ*¼ð`Nö}ïT¬?AÛÊiÎò ú[¢5] «-ŠS\Ë×ME4ÐÐéëh¤®W^ƒÙZR=þ¾ €‡8vm7;m&ÚC:GõV cG‡z¾9ê =ô!:0Š +×Oq/Ëf…hm‡y¢iñ’Öñ]ùÆñû‰_ÑMÔÍyÈäaMx3,Hr»sGù®TñƇÛd;Ò6±nô‚âÑ ‹'Ÿ’5ÝGê +¼,…I;q©h…o {“ T Dz aZÚrÒºŒ¼?»A~v+œ6•ÎF¨)¥V˜ŒÓÀ7Ò©|
¶©Ê`ô‹S+ÙWZ·†-à9/°9Pû£©0×¼hEÿS»¹¤Dö šÇ©|؃‡Åô Q§é
‡õ6K^9÷9AÚ02í
ôJþu"3PÉÝ0.@;îpíWê–¢%ÅË)ÓÔ±Ä(a»„Š•ds,¥œ€° fKRìî$‘Ûò ZÂ[²’&ÞƒVb$×@(· ÆEPÚj·ŒOÜ ¬ vÜŽÒÂ0ÑÚú+ã ÏàªèšúœJ0LöØ}‡‘åʲY¢Š†„WYø‡õê9VäêüÖX‡ˆ‹Þ`÷§9Q±GÀ6a°!PÔHú‰nœ\lÝ7iÇüq·¶ @ùä|ûCITÌk?›uÃÃã¼o÷d¶j«/OÝr 7ú;È<Ü+£¶qíæ#›4Ö[Lõº˜ `Õ)¦ÈÌÂï—¬w¿I,ÕÑ¿ð_ϱs–õ¤›ÚáÅÿ±3mÁ 㬩¶uÉ]Ÿ&¾šdð™žA³‡¡jJY¥»Œ×QhéÛßkhÔdÕPcŠ5¥õ¢J´$~¿5 µÅþ¾3ئúQnEOê_
ß2Å iâ(ªt…Ö¨¶–+ÈÓk¿(ŸQg䔈‚jl.¬¤žm tkñR P|>Š=}nJ *8ÇÈ„g_WÝ®Œ—õ+¼•Í ä6¶ðhÕmØóÚ¹ ˆÿwkÍn‹ØÖæaðÙF=U§k\!÷é“>Í}Éþ²Ò 6c°ÅìC½ïPUÈñ¾Á¾FÖ,Éà¾eö4°Gñeá šÑ¢Å"W)œ ÇzO§$#G^†¾I6ºb¡lì4=E§8ÁâÄ«ðÔc‰þo˜iw¨ ={€õôI=Wlº·(N˜]ü;h|-Pn%Xª²ˆ~~»'"«òÉ@Õ]͹à*ΪDÝ*Õ&¯æZL‰~TŒPé–¹CL
è$Ù‰™”ÈÌ=cöñUa~-,'lÉ÷ûMZ9×Q)¡7HüÏ$_‰qšÑÁ%Û‘º/Ó"Xô{nKï"£2œ¥¦ ‘ì¬d)³ÐŠ¥ƒÔçSìýÜh× ÁɈ Ò%zæÃȱåm™,~ÇfVߨ-¬&¨u¨úáê$Ý›7üg5úІÓd6Ш†ù¦Sº
Ì”L·„€çï*w«žJÿ䟋ã¤æt‚¢«0¶\Nê´ e“ûéãÏüŸ¨ö5M.áäþ;ÿÑ÷7øÕq‚ª ˆ@ü uk… Õ˜Vº›à)(Ѽ.¾1½€”(ЈŒ£ ´¬)¢bwµý +OmÅE5à Á‰ ñT9Ý%ઢ#òJ&Vû0/ËÔ%ྀÏ9RÒÛN…Ô°º‘”óÙÀañ< i«ˆajàX±‹¶"A—•ÁødÙdµ`Ö?ɸӿaûÐ#7Îò ¬'Z0ñãèhm£ªš`”±<g¯xì}t)âK(91£íÐê‰)vïïzf·4"òJ
sx Èvz=ùºœæ󒪾ß\-±ôk +=Ú‰i7˜F¼Ž†_+JÒðôÚØKgµh4
(Ür,ÌÓŽLÃzEœÑOpÁ‹hè©Ö’•^ÌűuLB+}ɹ!=Ýúm’.?Ä?¯•±Õõ¢/f –VVÄJãÇì~ÒÙÀx®áÎœçËÏô:Ö‘¼Õ|·¯Ô Fðe/¨£jB3º/]É{LæÛºl_$”¬÷[p}¬A¼<å÷Ï»-@Ù?³¯QÔ‹»â8€cyæÙ#èrJ‡šhúGˆ`‰õ¯µ°JÓlCúQþ•& i¥=¡R,Ð/@…zÂX0MŠ4Ùþz„”Ù®p8çˆS±·šê÷q(þSGD¼1'æSÒT2j¹ôi<¤é½ˆ½ÔA)YÎÑDµ5Þ“_âÚàð‚ ždOÍ †ø€’ਟœ‰ßï“ãùí„í½OK¤;]â:fßQ#—Ýåy°˜1ŸÜ¨^.Š`ϯȌ)Ƭ!°îÍÓ¤~@Ü›Z’ÈÄm]R½Ì±lÉ–ˆÛM=‚è»o]%î5H8ÉñðJ¬s˜{ÕmoRÝœ”Ü%¶¡A€mžXŒNzÓùxî~ÓXS ª>wh Bú#Û>öcðÁ§yÿÍÓËì z>½ûÔCÏÌç0¤d‹÷èóx@©%p‡;¾Ë0ÄîÞ›ñS"GÝ8m°>I» Þq|=…ÍÞºÖÁPŽÙŠ `*¾âõ•W±2å —Ê„s(ҨʑieM¬î3ò ° vÓ .ÈøÛæê:‡d}ȃüÂF[ËM¥þC‡e/Eœ·ß¼¢Ca-(PÞB‡‚_ŽO¶ó:Z•žŸOXM³¹)@õ'
¬(–3ºéìجDæ7"|¶Òp +¬>; äò4 +H +,¿TPÚ£>Ÿ°8ÛWò¸¹‰ÜÁ0›ZÂÚ`íL^ìRIs +s #—Œó¿å26Bbm@*Qæó Wv™zħ;ŸÃƒ¼%›mÄ ¨)•ÅD²›õÇ™5Ïçiöäô2dÏÈ ¢üˆÌú£KgîVËœ÷Ð ºÜöÀÉbÂQ]±·aáPüøòÀ!~&58¤ UéìôvlüÚtÅkCYwO(Z’èøãɆ¤ÎJ• î«ç@Íw÷È ÞàµcNÛu +‹w~öÍté-7µ³{-¬§±È +Jèä?$üyüÎGnŠÙVËz—‰ãÒòARáJSIðÊ}D“Ä(íŒäˆ²«ØÇ–w½SwR᱌ú½ ©ŒiDÂœéî[“ä:¯–â§ù‰Æ–äAlw’.ò >ªìJ•gv X9Y#òêjèžW.Ò*W®.1õ× ÛF)7Àa^¤»<š‹44E ŠXòî¯Qœt ¨þ‚+Wrëu¿ßœp@[Ç7ƒ}§È‰6y”ò‰Q#Â~e;r¬bxSîæ(|åaôÉ·ŸËSÇ·IYÎl'7W?Ø`m,ËÉŠ9³–-Ähr lWÓ½òõa… 3 Gˆ Q³âuÚ«Z`é¨[†‚šÀqHkU<¸‹µøDhW&?׳fךîOŠ£Ù'UÜ¿5µ·Y<Ÿž™ÞúýyìÖgJ¯bès õŸ:†‚† ÐNòÐÜ«•£»Î ØWÚ| ¤º(R.g8u$=Vâcø”§„áä¿‹¶I+É«Xg•Q8“9!®î )Ò¥mjô\oBÓc<y< ffµqñ>l^Ü‚¹=aä–>T~E¸ Í+ý&¤ iX£¬mý®Ê‹†TÆ fx¬ÀjΈ]þ !ˆ„ô„¹Ï +|
WfìxV'ÆSɈ·ë c–&øY +ŸÅ¦Rþ¨ò[,rhtDx㤣ڶ +ì” íÑj#]… —°¦škSÑNf†#bÅ·.ÆÚð°ú™ ò«P!›è„1Aü’v‘ — dBDv'OWs˜:n +*vÛ ³ðX±BgŠ¦wµ3ŽþXÜC«¸ñÊE‡œ.ô«Ö¾
޾ˣ Ü<”¿;³©µËä‘PT åðã°ñ\þüo*ú¿ŠÿÄ\5•Yt™‘ÖÎhý¹j¦aµšS` ¨ÓÁBÃryx/7 KèƒAMñÍs;žØ‚+Ÿ<È{/yq C³‹3¢«;šk`ŠÓùõƒ,Ï«Ã1Cdæ}ÝÖ“!ƒ#©á+³g› á–{r<”æÄÀ? +”p²‚Ì’>›®Ì!—Hûç ¿Í»LûJ,Æw‘É/S±l{;0bòÏß™V®héá[æƒßOX8÷Æ ¸x&Ÿ§8GÔL ‘-‰ÕÿhÔ~Å°Ó_vÅ;]hyÞy ¯Co¥ßä<ç|˜ U +¾×¶±ýX:½ë£`Íò|Ï/\Û0wwN†½-Ÿ©,‘ýœp`ì…Ζ
4C–ŠÅ Îm’s]ßxÙˆ´Šà&ð®²É)ÑêûÄ«.å}#2,dþ"( y¦–Ai|N[TðjÄðº/†,d\rjÏæ]?öt¼wÖ¹œ
®æ¬è›Ná—Ÿ 8çÇ"OðùÁ›‚jÚw +‘T ï’«ºàmf¬®–ˆ‚8VÙ17f“®If)¶˜ÉÇ{§˜µ†¿o ¼É î0–HÓAýñR6b5} c¼àoÌM r*'WèU+”z±öÍÀl#GKfaÆéQôTZÉqNÕﬨàdg‰÷i+3|ª#@Ýì&ÞM„ÙÝÑ>©LV¼«¹wJöº/$pžG ¾†6ªìk¿ÏÈ6úXð7ä´/3²† +{¿RÓ„ ¥cp çÊ´(§× "¿îzQ cöê0ÖóŸ\¸PCåYsP¥ä+}›Tã|ìÔ:Pd¨~½9iÜü1I4]‚Ýdë´m¼°ÃÞ¥íhqËÖD€•6Ñ©M,XJ:ß,ú´÷z k¯IÿÅ´(„ª¡Z©#äÒH]Sø?BĦcêO–‹Â†òö-À<q»×ëMX,SŒáy±ÍôwWf2%n§./[v }|5z|{ÿºx«:CB'ÇC^._C®u ++ŽáoÑÑo JÓoä€à).D¦\u𼓠+m|-zÐ#çbûŠ×—†rÿ
ì ¥ ‘ Zèñ‚%Qú¥.¦™?úgÚC)àhÄf‘ ¢qÿŒ‘ +Øwh¬ƒÁ’ãl„«$I<e.qÄz/9ŸV’±L,âNÓ/Ú¤:c¥èó¥>¦‘5œ]±RžχäÍ(GƬ/áOtgO(P»Scí!|@¬¿|N0É¢"¿±íq¶P5R@hAiËDì[pêñjÀgÕêõ¢¦‘ÿ@‰Tn£6Fz¸;GË‚5‘r0çÔcÁ[ï(þ;ÎÙØ0d»UÕz<ºÈ&ÇZô¾¾
`§ù§€×NåÑ99* ‡ ñôˆÌÒ"â©üsÈLSM^÷›MÇݦ¸é¹ùc!CFEYÝO§_F¦À¡1¿ÂÑ ï9oú˜}SSQ¼ôìCÁžÉ¡N(²õo¢áÐ윅Dé}ñfi¹“ël¼&‚m~¸«¸òÂÇM´9t‚VTQêƒÕ~뻀Ÿò1AjEñÚ¶ÁP6#V ¡ÜJ5äàýµ›{Þöþs|¥ P9bT¦ºX4Yp’P;ÎÊõëYý —†½w@4*4¥¢y§©‘(ƒ‘Om:Η² ¬ÀÐÇô™§¯yC öÉEá S:äúK AüQwÞEè³4Í,ya;dÈ”/#ðƒ“co;Æ©¡ £«åhÙ ÛÕÐJ¹¡0q½Î• +C§Gußx{ÛÄœ„B;ÀÐ\g•~—àèiœlðv¿¹ôõÇ™‰7ßZ F¢¹fŸq:ƃ¿øëC +}bÉ„•Óµ Vß¹ D¶53Ÿ¸‡ vðGПO*&æ\ŠÛ+>h-s›N¾)h2ÞGŽ>hÌÂéG:süFeæV6Êœ-ª‹¼¦)¯tà‡\§óŽŸ2E}˜Äç—å1£¹VY…4È)‹®x¹ +5Cð +hó¾èmÆ€‡qŒÆá:4›ùÆaB-ª-nÍØðneVŠÄÖL$Œç _68ý0¿gዶ‚›ž´ýÅ©< ^W¹?·eÜ/ + +l¥&,C†Œã ·ÖQŸ8RÔV»ˆ :»ß
¢ÿÕ°¥¦o…Äóô¢&›Dñ„æ„ñ>%åqUEV +Jã(†N`
/õÍþ`ôV’(H…ó¬ÐC>ø¢H §A®æIØO¯õ–0ÄhfÙý˜)š_x〘ÄIMme}Wì‚|Èà¾NÅÁä2¼Ô°yÅÑ¿_ÑdrEˆ »ÙŲVÓ¬w#ºÞp}§ —;Å_G°n\OªˆàPcŽ>n?ÿcpåÈñò‡VA0] +ƒÂóqI¾ÞŽ´n‹TèÔ=ZÓBÿü:åT(a
v|(‚bV~Qù`N~‚ñÑÕÓéáîÞ¸
RƒÀöðša ‡ÄP@xD|i`-.O&~F` 4y£UÓÿ
HÉMÌöÞ8Y€T¯B"y”x†\äñŽmÄ´Õ ¤Ê诰¹ì·÷O±,‰D¶8–ëÈá
û0Ñô<¡;+BP¡juÛ4¡ú…wÒý}"íç…ïÌ +ùÄì©¢"£ÂŒÚ1§@ÓÇ% ìÏ ã:ptu2DØ/jÏNÚ‚âî +þ ª×“?ŒÎ^TEul ^´—çq<Üÿ-¯+ž4ÛŸ^êJìZá¡'+ŽÊÕJuˆá‚Ç+~¨ìóh~)à‡A¤ž¢(ÚçèÚØJUË€/)²|(8îñ¨¿‚Å_ Ñúõ@ +€Ërs»îX
ˆ—#®#>|:+CƒMü\ûÅðêUT°ÎšÍOa\ŸÊTÅId`Éÿ!)µkâºüzw ˆÔ|êˆ •Dà^ + «9“ö¯#ÕQÅô/•p±ëtTu¦ŸÑoÕoÑF2ÎçÖºó¨F¿xüþÙDQ) ‹€®¨G.eáÔ÷ºÙh®o¢_ý/_íÃÕ£ T\‘YÂCû->×kl,¨ÊEX›Ý¯¾ÜWÀSÇ«GôV +h›À +JJ”ðú»,aüø‡´Oe=²§ùsõB.-9É?…–ZEè·v"‚‹ÏCÿ£3N©eçí û9–¹ŒäˆÊæ9a#Þò4)CË;ùW¦5Á™-öO¥DÉ¢Ra‰¶µºçiN¿°4ÿ!VV(䂸„ih%tL_ܶ?ó&·ç\cT +´1r Õ¤‹©Â–C|YÙEoç“âÙšFæm†‰bégâáH:ÏwüØ'Ѐ±ÇPzüܯ*ªÍÅë¯Ö:N/jÛÆÜ„PÏHEÆSsÏùo’OÜ¡³Þ+"¡&íÌß èæEÍÞè„Ðg &ÜMÖOßõ!pú7Øɯ2Ž!l3YÅB!6tÓº²vo›· ãfÜg+/“ácÒË`Èq èa;žñËxù<ý}(ìšLÐöB ýÊ”ˆ;ÍÖL„ê(õ~D™êq¢˜M©Çá5b*àÎöæÞúŸ{ôÚ8iøxÃk|ƒ¬n ›Ôš…ÒÚE_SXï=ˆ÷ãf+¤m"ðÞ Ð·s®õ:é‹ÜKÎÑ4åÖ·!D›ÕñØúÀHþæ1}’ C ej»ÌO²oDª2Œ°š@ÞªÄhGO‹& fÑ Œx\q¨åÓH*“«×EãñÎŽ`ghÕ`U ð1í$!7³NN¬âä–NM•)ña{®yµWϺç)®‘nS˜~Ø€gÆI ôÈû8³¶}ÊàL‡Tòí ÌF¯C0‘;pŒ/h° [Ç.ùõ§¨²B4 '…¡ºtdˆÀ4¡~0$îãò†W`T Aj@qy‹2 UÉl\²lå¯ì×½T¤Š]×ÈÌO“b q<1~úÂfÍÊ’ì—W¨8’…¶ÓÃI¿ÞK?›@‹§² WSuÝG4W¿! ÍrÞø§ˆ(ªyô[üÚ´æ»Ú•ã¨öï¶aÎû Bá±j{6úMóT÷¶×9—0 :'@:5+¹×ñ®¶ëde=—'’M•~‚†L=F¾‘d cƒ~N¬5s²czçR5$þ'6«3yi@1¼¢r¤y¬ƒÒNXr˜‡š¦ù‘÷·HQ¢H9=WZ8 ¦ú;M/åEÔ±²ïp ʹ1M„òÒñžT;¨Ù Ÿ[bÙøøáïj ù¶–è.h¶íùÂ’í1§O d6ä2Ó•€Sõ„ Ò ¸oMîî›@¢Ÿq<rØX?+e¨aÃE› Ó zŸÂÓˆ¾/¨”% wÇŠ¢?ÛŸ‹À›® +‹'Ô Öe‹Âo†÷L~¿ñþ\ì<h¿g¡‚™ ýcJCK¥wA½pƒ ï#“ÑD$_´âÀÞÍ¡ˆN5Å?¯Uµ‡å?7`ÿî crâÊÜç<¾¿ˆ\ I}¤xÝšN.PõÈ»Œ ê½pRUõ– Ÿ®ð$öµ©!ê£QÅÑØäkØ´ŒÂ„j¬@v”Â’ÑlLÌnmUEX ’æ±}mî´z*l9Úï^IöqJJaþLÁäc“Ñ&júi`•¢%×î—ÛØÝAA‡Æâ¿ñ +emÓÉÛŸ«3^4TòÓ¶¬@È jA1ÝiQ·ˆ ‰Ý÷ĘtÙö¢KB:Aÿ¸‹ÿ~…¬QN¶è•]à^H£î8‚x÷7^LMûžÄh5ý‘y.ïë`Ï $G^ãÒt°x\àü¹Qµ +¢“˜.]âeŸýcxŒHÁ‡¹mbÞ
¾
#{Z¯ÆSŸÕ‚¥¨žÉºølõíý73\»ö&ÛT¹™Í`9 Í}¤™å¦ï[ê¼<N5z ½_|ïh-óÔ)áäâöl?Þ9)9š°¿c(¤GE üÛŒëÈjK°ÍÚ$ ¨ñ¾ž2»ÓŧbžÙ,½_‹ÈIT>RMº(v¬|ŒQ|Þ¸V-'±é·ÞóVÈTú¦Jeˆ«Ôa‡ˆur Ûõ¤)gˆµæÂi{Ç¢VP€ææp¸D7ý™ÑÍH¸p½÷öÙt£¿# rKاjŠ-üòPýñöÕe©,´“
föö’ + ^~ +à å‡8q¤Â麈^ñLŽq–}¨Bƒ
CáÛ–åÊ—
>²–{lõᾃËS×ê&“U +9èpa0õƒÑßœÀƒwsi‘÷ëÛÇ* tô†tŸš… [¥wÝÙ.Ÿ+$ è+ÚÓ_ý¤iÌÕKÕ6(ý"o ˆ¦—2 'å™GÉž?IHééæóP´¾÷‡Ê§)ê^pA9"?kòowÖÕ—Ÿ†_²;tÊ+ioáÜ‚•êú +_ÏfZYX/JÿŠPžUºÐ±;Äó ™Ã¾¨5ÃÎ~¢M~;-5”äÖ$„€`3’’˜à0ßnpöã¤ÒE›ðÆúb89qÄZ¥| ž½¢ MæƒVþu– +!µãmYgKà ”‹ù÷ÿ•£B}ôçüÂÛZ
= U³W¯Û䉊ù¥tàC½^¦W +QŒÝ›îl6;¹E& ˆÈš .®*·Kcî):+©†¸uó‘=t‹b'´á": +EúPjAõ¶Õ ª±E@
ûõo`¦ iqKQ`_`+§|,33yºGÖÿÚæa#^¸“¯™ÆÀ¤Çð—àBÝ®éãó8OÝòUÐÇ3&]¥§J°Æ$h
‹YH<(|í HhtÊcµ YjCorpôaá‘Ögnj/#;ÌèâCŠ7±]c¥£ÿ|I4aü½ï¯kÅ3|M&ïæ†Àh¿}®²L¸¿‚fµÝ¤TíR8g¤=Œë&í‰A¬ >ª¢Ûd÷C{z‰-6ð7Tœçܧž
p"ÿ²±(¯Ÿûº`h/áw»7¢»ªîÈ”
û½ U6´‹°ÚS
+ÑT~¯Tç°Ç&µÖªñ˜ü¶×êI z {çNÊ€‘± 6qZü(úX(ø¢ZyÁ´~´ãÅ¥ÙÛØ §°ÞÊ›H#æ +½¨©5¯O3þU¬–.œ)
@X±®Kàð`ç0’’A ©2ã?Â’§¤1à*\Ü& Ï×ò•Es”òœ³e»`Ž-Ä_ø£½—†›}t`òC;]t:ü#?=*rež‡¾ZNžÿµ×Þ ÞÏ -aæ :-ƒ;ž""·È¶ êÝ'(ž¶b—PÝò$&¦‰É&ŸydÌG<‡#{BŸí’Tdõ/úYýþª·Á è` þÜ(Jæsm jžãdàѦÞ#¶«âÝ]¹CÑdH€
Aþ–/“6óN#å +endobj +950 0 obj << /Type /Font /Subtype /Type1 -/Encoding 2737 0 R +/Encoding 2807 0 R /FirstChar 2 /LastChar 151 -/Widths 2754 0 R -/BaseFont /CUGYHF+URWPalladioL-Bold -/FontDescriptor 936 0 R +/Widths 2824 0 R +/BaseFont /JOBNRY+URWPalladioL-Bold +/FontDescriptor 948 0 R >> endobj -936 0 obj << +948 0 obj << /Ascent 708 /CapHeight 672 /Descent -266 -/FontName /CUGYHF+URWPalladioL-Bold +/FontName /JOBNRY+URWPalladioL-Bold /ItalicAngle 0 /StemV 123 /XHeight 471 /FontBBox [-152 -301 1000 935] /Flags 4 -/CharSet (/fi/fl/exclam/numbersign/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/question/at/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/quotedblright/emdash) -/FontFile 937 0 R +/CharSet (/fi/fl/exclam/numbersign/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/question/at/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/quotedblright/emdash) +/FontFile 949 0 R >> endobj -2754 0 obj -[611 611 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 278 0 500 500 889 0 278 333 333 444 606 250 333 250 296 500 500 500 500 500 500 500 500 500 500 250 250 0 0 0 444 747 778 667 722 833 611 556 833 833 389 0 778 611 1000 833 833 611 833 722 611 667 778 778 1000 667 667 667 333 0 333 0 0 0 500 611 444 611 500 389 556 611 333 333 611 333 889 611 556 611 611 389 444 333 611 556 833 500 556 500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 500 0 0 1000 ] +2824 0 obj +[611 611 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 278 0 500 500 889 0 278 333 333 444 606 250 333 250 296 500 500 500 500 500 500 500 500 500 500 250 250 0 606 0 444 747 778 667 722 833 611 556 833 833 389 0 778 611 1000 833 833 611 833 722 611 667 778 778 1000 667 667 667 333 0 333 0 0 0 500 611 444 611 500 389 556 611 333 333 611 333 889 611 556 611 611 389 444 333 611 556 833 500 556 500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 500 0 0 1000 ] endobj -939 0 obj << +951 0 obj << /Type /Pages /Count 6 -/Parent 2755 0 R -/Kids [930 0 R 956 0 R 966 0 R 1021 0 R 1085 0 R 1148 0 R] +/Parent 2825 0 R +/Kids [942 0 R 968 0 R 978 0 R 1033 0 R 1097 0 R 1160 0 R] >> endobj -1226 0 obj << +1241 0 obj << /Type /Pages /Count 6 -/Parent 2755 0 R -/Kids [1210 0 R 1228 0 R 1240 0 R 1253 0 R 1264 0 R 1271 0 R] +/Parent 2825 0 R +/Kids [1222 0 R 1243 0 R 1255 0 R 1268 0 R 1279 0 R 1286 0 R] >> endobj -1287 0 obj << +1302 0 obj << /Type /Pages /Count 6 -/Parent 2755 0 R -/Kids [1283 0 R 1289 0 R 1297 0 R 1306 0 R 1316 0 R 1329 0 R] +/Parent 2825 0 R +/Kids [1298 0 R 1304 0 R 1312 0 R 1321 0 R 1331 0 R 1344 0 R] >> endobj -1337 0 obj << +1354 0 obj << /Type /Pages /Count 6 -/Parent 2755 0 R -/Kids [1333 0 R 1340 0 R 1347 0 R 1352 0 R 1373 0 R 1383 0 R] +/Parent 2825 0 R +/Kids [1348 0 R 1356 0 R 1362 0 R 1370 0 R 1391 0 R 1401 0 R] >> endobj -1392 0 obj << +1410 0 obj << /Type /Pages /Count 6 -/Parent 2755 0 R -/Kids [1388 0 R 1394 0 R 1399 0 R 1408 0 R 1417 0 R 1424 0 R] +/Parent 2825 0 R +/Kids [1407 0 R 1412 0 R 1417 0 R 1426 0 R 1435 0 R 1442 0 R] >> endobj -1433 0 obj << +1451 0 obj << /Type /Pages /Count 6 -/Parent 2755 0 R -/Kids [1430 0 R 1435 0 R 1444 0 R 1458 0 R 1465 0 R 1479 0 R] +/Parent 2825 0 R +/Kids [1448 0 R 1453 0 R 1463 0 R 1472 0 R 1480 0 R 1490 0 R] >> endobj -1489 0 obj << +1504 0 obj << /Type /Pages /Count 6 -/Parent 2756 0 R -/Kids [1485 0 R 1491 0 R 1497 0 R 1504 0 R 1512 0 R 1517 0 R] +/Parent 2826 0 R +/Kids [1499 0 R 1506 0 R 1512 0 R 1517 0 R 1526 0 R 1532 0 R] >> endobj -1530 0 obj << +1545 0 obj << /Type /Pages /Count 6 -/Parent 2756 0 R -/Kids [1523 0 R 1533 0 R 1540 0 R 1544 0 R 1554 0 R 1558 0 R] +/Parent 2826 0 R +/Kids [1538 0 R 1548 0 R 1555 0 R 1559 0 R 1569 0 R 1573 0 R] >> endobj -1573 0 obj << +1588 0 obj << /Type /Pages /Count 6 -/Parent 2756 0 R -/Kids [1565 0 R 1575 0 R 1583 0 R 1591 0 R 1603 0 R 1609 0 R] +/Parent 2826 0 R +/Kids [1580 0 R 1590 0 R 1598 0 R 1606 0 R 1618 0 R 1624 0 R] >> endobj -1620 0 obj << +1635 0 obj << /Type /Pages /Count 6 -/Parent 2756 0 R -/Kids [1615 0 R 1622 0 R 1626 0 R 1633 0 R 1638 0 R 1648 0 R] +/Parent 2826 0 R +/Kids [1630 0 R 1637 0 R 1641 0 R 1648 0 R 1653 0 R 1663 0 R] >> endobj -1655 0 obj << +1670 0 obj << /Type /Pages /Count 6 -/Parent 2756 0 R -/Kids [1652 0 R 1657 0 R 1661 0 R 1665 0 R 1669 0 R 1676 0 R] +/Parent 2826 0 R +/Kids [1667 0 R 1672 0 R 1676 0 R 1680 0 R 1684 0 R 1691 0 R] >> endobj -1684 0 obj << +1701 0 obj << /Type /Pages /Count 6 -/Parent 2756 0 R -/Kids [1681 0 R 1686 0 R 1692 0 R 1703 0 R 1707 0 R 1711 0 R] +/Parent 2826 0 R +/Kids [1696 0 R 1703 0 R 1709 0 R 1714 0 R 1723 0 R 1727 0 R] >> endobj -1723 0 obj << +1737 0 obj << /Type /Pages /Count 6 -/Parent 2757 0 R -/Kids [1715 0 R 1726 0 R 1732 0 R 1738 0 R 1743 0 R 1747 0 R] +/Parent 2827 0 R +/Kids [1731 0 R 1739 0 R 1748 0 R 1755 0 R 1761 0 R 1765 0 R] >> endobj -1756 0 obj << +1772 0 obj << /Type /Pages /Count 6 -/Parent 2757 0 R -/Kids [1751 0 R 1758 0 R 1766 0 R 1771 0 R 1779 0 R 1786 0 R] +/Parent 2827 0 R +/Kids [1769 0 R 1774 0 R 1782 0 R 1788 0 R 1794 0 R 1801 0 R] >> endobj -1796 0 obj << +1813 0 obj << /Type /Pages /Count 6 -/Parent 2757 0 R -/Kids [1791 0 R 1799 0 R 1806 0 R 1811 0 R 1815 0 R 1819 0 R] +/Parent 2827 0 R +/Kids [1808 0 R 1815 0 R 1821 0 R 1829 0 R 1833 0 R 1837 0 R] >> endobj -1828 0 obj << +1845 0 obj << /Type /Pages /Count 6 -/Parent 2757 0 R -/Kids [1823 0 R 1830 0 R 1835 0 R 1839 0 R 1844 0 R 1850 0 R] +/Parent 2827 0 R +/Kids [1841 0 R 1847 0 R 1853 0 R 1857 0 R 1861 0 R 1866 0 R] >> endobj -1863 0 obj << +1885 0 obj << /Type /Pages /Count 6 -/Parent 2757 0 R -/Kids [1859 0 R 1865 0 R 1870 0 R 1874 0 R 1878 0 R 1882 0 R] +/Parent 2827 0 R +/Kids [1873 0 R 1887 0 R 1892 0 R 1897 0 R 1901 0 R 1905 0 R] >> endobj -1893 0 obj << +1916 0 obj << /Type /Pages /Count 6 -/Parent 2757 0 R -/Kids [1890 0 R 1895 0 R 1910 0 R 1925 0 R 1937 0 R 1957 0 R] +/Parent 2827 0 R +/Kids [1909 0 R 1918 0 R 1922 0 R 1926 0 R 1937 0 R 1955 0 R] >> endobj -1969 0 obj << +1984 0 obj << /Type /Pages /Count 6 -/Parent 2758 0 R -/Kids [1964 0 R 1971 0 R 1975 0 R 1987 0 R 1991 0 R 2000 0 R] +/Parent 2828 0 R +/Kids [1969 0 R 1986 0 R 1997 0 R 2003 0 R 2007 0 R 2017 0 R] >> endobj -2021 0 obj << +2028 0 obj << /Type /Pages /Count 6 -/Parent 2758 0 R -/Kids [2012 0 R 2023 0 R 2030 0 R 2036 0 R 2043 0 R 2052 0 R] +/Parent 2828 0 R +/Kids [2023 0 R 2030 0 R 2040 0 R 2052 0 R 2060 0 R 2068 0 R] >> endobj -2067 0 obj << +2079 0 obj << /Type /Pages /Count 6 -/Parent 2758 0 R -/Kids [2061 0 R 2069 0 R 2080 0 R 2084 0 R 2090 0 R 2100 0 R] +/Parent 2828 0 R +/Kids [2072 0 R 2081 0 R 2089 0 R 2101 0 R 2108 0 R 2116 0 R] >> endobj -2107 0 obj << +2131 0 obj << /Type /Pages /Count 6 -/Parent 2758 0 R -/Kids [2104 0 R 2109 0 R 2120 0 R 2124 0 R 2131 0 R 2141 0 R] +/Parent 2828 0 R +/Kids [2122 0 R 2133 0 R 2137 0 R 2141 0 R 2152 0 R 2156 0 R] >> endobj -2255 0 obj << +2172 0 obj << /Type /Pages /Count 6 -/Parent 2758 0 R -/Kids [2200 0 R 2257 0 R 2311 0 R 2346 0 R 2354 0 R 2362 0 R] +/Parent 2828 0 R +/Kids [2163 0 R 2174 0 R 2233 0 R 2289 0 R 2343 0 R 2378 0 R] >> endobj -2373 0 obj << +2393 0 obj << /Type /Pages /Count 6 -/Parent 2758 0 R -/Kids [2369 0 R 2375 0 R 2381 0 R 2385 0 R 2394 0 R 2400 0 R] +/Parent 2828 0 R +/Kids [2386 0 R 2395 0 R 2402 0 R 2407 0 R 2413 0 R 2417 0 R] >> endobj -2408 0 obj << +2431 0 obj << /Type /Pages /Count 6 -/Parent 2759 0 R -/Kids [2405 0 R 2410 0 R 2415 0 R 2426 0 R 2431 0 R 2443 0 R] +/Parent 2829 0 R +/Kids [2426 0 R 2433 0 R 2438 0 R 2442 0 R 2446 0 R 2455 0 R] >> endobj -2460 0 obj << +2473 0 obj << /Type /Pages /Count 6 -/Parent 2759 0 R -/Kids [2452 0 R 2462 0 R 2467 0 R 2476 0 R 2482 0 R 2486 0 R] +/Parent 2829 0 R +/Kids [2463 0 R 2475 0 R 2486 0 R 2493 0 R 2502 0 R 2514 0 R] >> endobj -2502 0 obj << +2525 0 obj << /Type /Pages /Count 6 -/Parent 2759 0 R -/Kids [2492 0 R 2504 0 R 2514 0 R 2520 0 R 2530 0 R 2536 0 R] +/Parent 2829 0 R +/Kids [2520 0 R 2527 0 R 2537 0 R 2541 0 R 2546 0 R 2552 0 R] >> endobj -2543 0 obj << +2572 0 obj << /Type /Pages /Count 6 -/Parent 2759 0 R -/Kids [2540 0 R 2545 0 R 2555 0 R 2566 0 R 2573 0 R 2577 0 R] +/Parent 2829 0 R +/Kids [2563 0 R 2574 0 R 2580 0 R 2591 0 R 2595 0 R 2599 0 R] >> endobj -2592 0 obj << +2609 0 obj << /Type /Pages /Count 6 -/Parent 2759 0 R -/Kids [2589 0 R 2594 0 R 2600 0 R 2612 0 R 2621 0 R 2626 0 R] +/Parent 2829 0 R +/Kids [2603 0 R 2611 0 R 2621 0 R 2632 0 R 2643 0 R 2647 0 R] >> endobj -2636 0 obj << +2662 0 obj << /Type /Pages /Count 6 -/Parent 2759 0 R -/Kids [2630 0 R 2638 0 R 2648 0 R 2659 0 R 2664 0 R 2675 0 R] +/Parent 2829 0 R +/Kids [2657 0 R 2664 0 R 2668 0 R 2679 0 R 2691 0 R 2695 0 R] >> endobj -2691 0 obj << +2704 0 obj << +/Type /Pages +/Count 6 +/Parent 2830 0 R +/Kids [2700 0 R 2706 0 R 2717 0 R 2727 0 R 2734 0 R 2741 0 R] +>> endobj +2760 0 obj << /Type /Pages /Count 5 -/Parent 2760 0 R -/Kids [2681 0 R 2693 0 R 2705 0 R 2719 0 R 2732 0 R] +/Parent 2830 0 R +/Kids [2750 0 R 2762 0 R 2771 0 R 2785 0 R 2799 0 R] >> endobj -2755 0 obj << +2825 0 obj << /Type /Pages /Count 36 -/Parent 2761 0 R -/Kids [939 0 R 1226 0 R 1287 0 R 1337 0 R 1392 0 R 1433 0 R] +/Parent 2831 0 R +/Kids [951 0 R 1241 0 R 1302 0 R 1354 0 R 1410 0 R 1451 0 R] >> endobj -2756 0 obj << +2826 0 obj << /Type /Pages /Count 36 -/Parent 2761 0 R -/Kids [1489 0 R 1530 0 R 1573 0 R 1620 0 R 1655 0 R 1684 0 R] +/Parent 2831 0 R +/Kids [1504 0 R 1545 0 R 1588 0 R 1635 0 R 1670 0 R 1701 0 R] >> endobj -2757 0 obj << +2827 0 obj << /Type /Pages /Count 36 -/Parent 2761 0 R -/Kids [1723 0 R 1756 0 R 1796 0 R 1828 0 R 1863 0 R 1893 0 R] +/Parent 2831 0 R +/Kids [1737 0 R 1772 0 R 1813 0 R 1845 0 R 1885 0 R 1916 0 R] >> endobj -2758 0 obj << +2828 0 obj << /Type /Pages /Count 36 -/Parent 2761 0 R -/Kids [1969 0 R 2021 0 R 2067 0 R 2107 0 R 2255 0 R 2373 0 R] +/Parent 2831 0 R +/Kids [1984 0 R 2028 0 R 2079 0 R 2131 0 R 2172 0 R 2393 0 R] >> endobj -2759 0 obj << +2829 0 obj << /Type /Pages /Count 36 -/Parent 2761 0 R -/Kids [2408 0 R 2460 0 R 2502 0 R 2543 0 R 2592 0 R 2636 0 R] +/Parent 2831 0 R +/Kids [2431 0 R 2473 0 R 2525 0 R 2572 0 R 2609 0 R 2662 0 R] >> endobj -2760 0 obj << +2830 0 obj << /Type /Pages -/Count 5 -/Parent 2761 0 R -/Kids [2691 0 R] +/Count 11 +/Parent 2831 0 R +/Kids [2704 0 R 2760 0 R] >> endobj -2761 0 obj << +2831 0 obj << /Type /Pages -/Count 185 -/Kids [2755 0 R 2756 0 R 2757 0 R 2758 0 R 2759 0 R 2760 0 R] +/Count 191 +/Kids [2825 0 R 2826 0 R 2827 0 R 2828 0 R 2829 0 R 2830 0 R] >> endobj -2762 0 obj << +2832 0 obj << /Type /Outlines /First 7 0 R /Last 843 0 R /Count 10 >> endobj +939 0 obj << +/Title 940 0 R +/A 937 0 R +/Parent 843 0 R +/Prev 935 0 R +>> endobj +935 0 obj << +/Title 936 0 R +/A 933 0 R +/Parent 843 0 R +/Prev 931 0 R +/Next 939 0 R +>> endobj +931 0 obj << +/Title 932 0 R +/A 929 0 R +/Parent 843 0 R +/Prev 927 0 R +/Next 935 0 R +>> endobj 927 0 obj << /Title 928 0 R /A 925 0 R /Parent 843 0 R /Prev 923 0 R +/Next 931 0 R >> endobj 923 0 obj << /Title 924 0 R @@ -14815,11 +15317,11 @@ endobj 843 0 obj << /Title 844 0 R /A 841 0 R -/Parent 2762 0 R +/Parent 2832 0 R /Prev 751 0 R /First 847 0 R -/Last 927 0 R -/Count -21 +/Last 939 0 R +/Count -24 >> endobj 839 0 obj << /Title 840 0 R @@ -14981,7 +15483,7 @@ endobj 751 0 obj << /Title 752 0 R /A 749 0 R -/Parent 2762 0 R +/Parent 2832 0 R /Prev 731 0 R /Next 843 0 R /First 755 0 R @@ -15018,7 +15520,7 @@ endobj 731 0 obj << /Title 732 0 R /A 729 0 R -/Parent 2762 0 R +/Parent 2832 0 R /Prev 707 0 R /Next 751 0 R /First 735 0 R @@ -15062,7 +15564,7 @@ endobj 707 0 obj << /Title 708 0 R /A 705 0 R -/Parent 2762 0 R +/Parent 2832 0 R /Prev 363 0 R /Next 731 0 R /First 711 0 R @@ -15677,7 +16179,7 @@ endobj 363 0 obj << /Title 364 0 R /A 361 0 R -/Parent 2762 0 R +/Parent 2832 0 R /Prev 351 0 R /Next 707 0 R /First 367 0 R @@ -15699,7 +16201,7 @@ endobj 351 0 obj << /Title 352 0 R /A 349 0 R -/Parent 2762 0 R +/Parent 2832 0 R /Prev 131 0 R /Next 363 0 R /First 355 0 R @@ -16096,7 +16598,7 @@ endobj 131 0 obj << /Title 132 0 R /A 129 0 R -/Parent 2762 0 R +/Parent 2832 0 R /Prev 91 0 R /Next 351 0 R /First 135 0 R @@ -16170,7 +16672,7 @@ endobj 91 0 obj << /Title 92 0 R /A 89 0 R -/Parent 2762 0 R +/Parent 2832 0 R /Prev 67 0 R /Next 131 0 R /First 95 0 R @@ -16213,7 +16715,7 @@ endobj 67 0 obj << /Title 68 0 R /A 65 0 R -/Parent 2762 0 R +/Parent 2832 0 R /Prev 7 0 R /Next 91 0 R /First 71 0 R @@ -16322,2812 +16824,2882 @@ endobj 7 0 obj << /Title 8 0 R /A 5 0 R -/Parent 2762 0 R +/Parent 2832 0 R /Next 67 0 R /First 11 0 R /Last 23 0 R /Count -4 >> endobj -2763 0 obj << -/Names [(Access_Control_Lists) 2088 0 R (Bv9ARM.ch01) 1230 0 R (Bv9ARM.ch02) 1274 0 R (Bv9ARM.ch03) 1292 0 R (Bv9ARM.ch04) 1355 0 R (Bv9ARM.ch05) 1536 0 R (Bv9ARM.ch06) 1547 0 R (Bv9ARM.ch07) 2087 0 R (Bv9ARM.ch08) 2112 0 R (Bv9ARM.ch09) 2127 0 R (Bv9ARM.ch10) 2388 0 R (Configuration_File_Grammar) 1570 0 R (DNSSEC) 1421 0 R (Doc-Start) 935 0 R (Setting_TTLs) 2008 0 R (acache) 1281 0 R (access_control) 1721 0 R (acl) 1579 0 R (address_match_lists) 1552 0 R (admin_tools) 1314 0 R (appendix.A) 750 0 R (appendix.B) 842 0 R (bibliography) 2135 0 R (bind9.library) 2344 0 R (boolean_options) 1370 0 R (builtin) 1802 0 R (chapter*.1) 969 0 R (chapter.1) 6 0 R (chapter.2) 66 0 R (chapter.3) 90 0 R (chapter.4) 130 0 R (chapter.5) 350 0 R (chapter.6) 362 0 R (chapter.7) 706 0 R (chapter.8) 730 0 R (cite.RFC1033) 2263 0 R (cite.RFC1034) 2147 0 R (cite.RFC1035) 2149 0 R (cite.RFC1101) 2244 0 R (cite.RFC1123) 2246 0 R (cite.RFC1183) 2206 0 R (cite.RFC1464) 2285 0 R (cite.RFC1535) 2192 0 R (cite.RFC1536) 2194 0 R (cite.RFC1537) 2265 0 R (cite.RFC1591) 2248 0 R (cite.RFC1706) 2208 0 R (cite.RFC1712) 2305 0 R (cite.RFC1713) 2287 0 R (cite.RFC1794) 2289 0 R (cite.RFC1876) 2210 0 R (cite.RFC1912) 2267 0 R (cite.RFC1982) 2196 0 R (cite.RFC1995) 2154 0 R (cite.RFC1996) 2156 0 R (cite.RFC2010) 2269 0 R (cite.RFC2052) 2212 0 R (cite.RFC2065) 2317 0 R (cite.RFC2136) 2158 0 R (cite.RFC2137) 2319 0 R (cite.RFC2163) 2214 0 R (cite.RFC2168) 2216 0 R (cite.RFC2181) 2160 0 R (cite.RFC2219) 2271 0 R (cite.RFC2230) 2218 0 R (cite.RFC2240) 2291 0 R (cite.RFC2308) 2162 0 R (cite.RFC2317) 2250 0 R (cite.RFC2345) 2293 0 R (cite.RFC2352) 2295 0 R (cite.RFC2535) 2321 0 R (cite.RFC2536) 2220 0 R (cite.RFC2537) 2222 0 R (cite.RFC2538) 2224 0 R (cite.RFC2539) 2226 0 R (cite.RFC2540) 2228 0 R (cite.RFC2671) 2164 0 R (cite.RFC2672) 2166 0 R (cite.RFC2673) 2307 0 R (cite.RFC2782) 2230 0 R (cite.RFC2825) 2275 0 R (cite.RFC2826) 2252 0 R (cite.RFC2845) 2168 0 R (cite.RFC2874) 2309 0 R (cite.RFC2915) 2232 0 R (cite.RFC2929) 2254 0 R (cite.RFC2930) 2170 0 R (cite.RFC2931) 2172 0 R (cite.RFC3007) 2174 0 R (cite.RFC3008) 2323 0 R (cite.RFC3071) 2297 0 R (cite.RFC3090) 2325 0 R (cite.RFC3110) 2234 0 R (cite.RFC3123) 2236 0 R (cite.RFC3225) 2180 0 R (cite.RFC3258) 2299 0 R (cite.RFC3445) 2327 0 R (cite.RFC3490) 2277 0 R (cite.RFC3491) 2279 0 R (cite.RFC3492) 2281 0 R (cite.RFC3596) 2238 0 R (cite.RFC3597) 2240 0 R (cite.RFC3645) 2176 0 R (cite.RFC3655) 2329 0 R (cite.RFC3658) 2331 0 R (cite.RFC3755) 2333 0 R (cite.RFC3757) 2335 0 R (cite.RFC3833) 2182 0 R (cite.RFC3845) 2337 0 R (cite.RFC3901) 2301 0 R (cite.RFC4033) 2184 0 R (cite.RFC4034) 2186 0 R (cite.RFC4035) 2188 0 R (cite.RFC4074) 2198 0 R (cite.RFC974) 2151 0 R (cite.id2512742) 2342 0 R (clients-per-query) 2059 0 R (configuration_file_elements) 1548 0 R (controls_statement_definition_and_usage) 1338 0 R (diagnostic_tools) 1262 0 R (dnssec.dynamic.zones) 1441 0 R (dynamic_update) 1365 0 R (dynamic_update_policies) 1327 0 R (dynamic_update_security) 1730 0 R (empty) 1809 0 R (historical_dns_information) 2129 0 R (id2466570) 1231 0 R (id2466594) 1232 0 R (id2467484) 1233 0 R (id2467494) 1234 0 R (id2467734) 1244 0 R (id2467755) 1245 0 R (id2467789) 1246 0 R (id2467874) 1249 0 R (id2467966) 1242 0 R (id2470272) 1256 0 R (id2470295) 1259 0 R (id2470393) 1260 0 R (id2470414) 1261 0 R (id2470444) 1267 0 R (id2470480) 1268 0 R (id2470574) 1269 0 R (id2470609) 1275 0 R (id2470635) 1276 0 R (id2470716) 1277 0 R (id2470742) 1280 0 R (id2470753) 1286 0 R (id2470785) 1294 0 R (id2470801) 1295 0 R (id2470823) 1300 0 R (id2470840) 1301 0 R (id2471245) 1309 0 R (id2471251) 1310 0 R (id2473366) 1343 0 R (id2473378) 1344 0 R (id2473879) 1380 0 R (id2473897) 1386 0 R (id2474398) 1402 0 R (id2474416) 1403 0 R (id2474454) 1404 0 R (id2474472) 1405 0 R (id2474483) 1406 0 R (id2474519) 1411 0 R (id2474577) 1412 0 R (id2474626) 1414 0 R (id2474640) 1415 0 R (id2474893) 1420 0 R (id2475098) 1422 0 R (id2475177) 1427 0 R (id2475258) 1428 0 R (id2475479) 1442 0 R (id2475653) 1447 0 R (id2475689) 1448 0 R (id2475840) 1454 0 R (id2475877) 1461 0 R (id2475890) 1462 0 R (id2475923) 1463 0 R (id2475949) 1468 0 R (id2475959) 1469 0 R (id2476037) 1470 0 R (id2476050) 1471 0 R (id2476087) 1472 0 R (id2476097) 1473 0 R (id2476202) 1475 0 R (id2476225) 1482 0 R (id2476394) 1488 0 R (id2476558) 1494 0 R (id2476628) 1495 0 R (id2476745) 1500 0 R (id2476964) 1501 0 R (id2476972) 1502 0 R (id2477004) 1507 0 R (id2477041) 1508 0 R (id2477089) 1509 0 R (id2477120) 1510 0 R (id2477523) 1520 0 R (id2477569) 1521 0 R (id2477623) 1526 0 R (id2477685) 1528 0 R (id2477706) 1529 0 R (id2477876) 1537 0 R (id2478023) 1549 0 R (id2479053) 1561 0 R (id2479081) 1562 0 R (id2479424) 1563 0 R (id2479438) 1568 0 R (id2479468) 1569 0 R (id2479611) 1571 0 R (id2480077) 1578 0 R (id2480120) 1580 0 R (id2480267) 1586 0 R (id2480627) 1594 0 R (id2480644) 1595 0 R (id2480667) 1596 0 R (id2480691) 1597 0 R (id2480850) 1601 0 R (id2480976) 1606 0 R (id2481028) 1607 0 R (id2481721) 1618 0 R (id2482482) 1629 0 R (id2482544) 1630 0 R (id2482933) 1636 0 R (id2483006) 1641 0 R (id2483139) 1644 0 R (id2483182) 1645 0 R (id2483197) 1646 0 R (id2486685) 1689 0 R (id2488853) 1718 0 R (id2489048) 1720 0 R (id2489609) 1736 0 R (id2490819) 1754 0 R (id2490878) 1761 0 R (id2491233) 1769 0 R (id2491872) 1783 0 R (id2493699) 1826 0 R (id2493825) 1833 0 R (id2495157) 1854 0 R (id2495297) 1856 0 R (id2495344) 1862 0 R (id2495853) 1868 0 R (id2497417) 1885 0 R (id2497425) 1886 0 R (id2497430) 1887 0 R (id2498038) 1899 0 R (id2498071) 1900 0 R (id2500110) 1967 0 R (id2500842) 1978 0 R (id2500860) 1979 0 R (id2500881) 1982 0 R (id2501049) 1984 0 R (id2502424) 1994 0 R (id2502552) 1996 0 R (id2502573) 1997 0 R (id2503004) 2003 0 R (id2503141) 2005 0 R (id2503159) 2006 0 R (id2503563) 2009 0 R (id2503688) 2015 0 R (id2503703) 2016 0 R (id2503815) 2018 0 R (id2503837) 2019 0 R (id2503853) 2020 0 R (id2503914) 2026 0 R (id2503984) 2027 0 R (id2504020) 2028 0 R (id2504164) 2033 0 R (id2504675) 2040 0 R (id2504973) 2048 0 R (id2505047) 2049 0 R (id2506683) 2056 0 R (id2506690) 2057 0 R (id2507066) 2064 0 R (id2507072) 2065 0 R (id2508156) 2072 0 R (id2508188) 2073 0 R (id2508598) 2078 0 R (id2508825) 2096 0 R (id2508906) 2097 0 R (id2508966) 2098 0 R (id2509046) 2113 0 R (id2509051) 2114 0 R (id2509063) 2115 0 R (id2509080) 2116 0 R (id2509142) 2128 0 R (id2509382) 2134 0 R (id2509570) 2139 0 R (id2509572) 2145 0 R (id2509580) 2150 0 R (id2509604) 2146 0 R (id2509627) 2148 0 R (id2509664) 2159 0 R (id2509690) 2161 0 R (id2509716) 2153 0 R (id2509740) 2155 0 R (id2509764) 2157 0 R (id2509819) 2163 0 R (id2509846) 2165 0 R (id2509873) 2167 0 R (id2509934) 2169 0 R (id2510033) 2171 0 R (id2510062) 2173 0 R (id2510089) 2175 0 R (id2510164) 2178 0 R (id2510171) 2179 0 R (id2510198) 2181 0 R (id2510234) 2183 0 R (id2510299) 2185 0 R (id2510364) 2187 0 R (id2510429) 2190 0 R (id2510438) 2191 0 R (id2510464) 2193 0 R (id2510532) 2195 0 R (id2510567) 2197 0 R (id2510608) 2204 0 R (id2510613) 2205 0 R (id2510739) 2207 0 R (id2510776) 2215 0 R (id2510811) 2209 0 R (id2510866) 2211 0 R (id2510904) 2213 0 R (id2510930) 2217 0 R (id2510955) 2219 0 R (id2510982) 2221 0 R (id2511009) 2223 0 R (id2511048) 2225 0 R (id2511078) 2227 0 R (id2511108) 2229 0 R (id2511150) 2231 0 R (id2511184) 2233 0 R (id2511210) 2235 0 R (id2511234) 2237 0 R (id2511291) 2239 0 R (id2511316) 2242 0 R (id2511323) 2243 0 R (id2511349) 2245 0 R (id2511371) 2247 0 R (id2511463) 2249 0 R (id2511509) 2251 0 R (id2511532) 2253 0 R (id2511582) 2261 0 R (id2511590) 2262 0 R (id2511613) 2264 0 R (id2511640) 2266 0 R (id2511667) 2268 0 R (id2511703) 2270 0 R (id2511744) 2273 0 R (id2511749) 2274 0 R (id2511781) 2276 0 R (id2511827) 2278 0 R (id2511862) 2280 0 R (id2511889) 2283 0 R (id2511907) 2284 0 R (id2511929) 2286 0 R (id2511955) 2288 0 R (id2511980) 2290 0 R (id2512004) 2292 0 R (id2512050) 2294 0 R (id2512073) 2296 0 R (id2512100) 2298 0 R (id2512125) 2300 0 R (id2512163) 2303 0 R (id2512169) 2304 0 R (id2512227) 2306 0 R (id2512253) 2308 0 R (id2512290) 2315 0 R (id2512301) 2316 0 R (id2512341) 2318 0 R (id2512368) 2320 0 R (id2512397) 2322 0 R (id2512491) 2324 0 R (id2512518) 2326 0 R (id2512554) 2328 0 R (id2512590) 2330 0 R (id2512617) 2332 0 R (id2512644) 2334 0 R (id2512689) 2336 0 R (id2512730) 2339 0 R (id2512740) 2341 0 R (id2512742) 2343 0 R (id2512898) 2349 0 R (id2512907) 2350 0 R (id2512932) 2351 0 R (id2512963) 2352 0 R (id2513108) 2357 0 R (id2513134) 2359 0 R (id2513143) 2360 0 R (id2513234) 2365 0 R (id2513287) 2366 0 R (id2513419) 2367 0 R (id2513434) 2372 0 R (id2513565) 2378 0 R (id2513698) 2379 0 R (incremental_zone_transfers) 1377 0 R (internet_drafts) 2338 0 R (ipv6addresses) 1531 0 R (journal) 1376 0 R (lwresd) 1538 0 R (man.arpaname) 2698 0 R (man.ddns-confgen) 2686 0 R (man.dig) 2389 0 R (man.dnssec-dsfromkey) 2437 0 R (man.dnssec-keyfromlabel) 2455 0 R (man.dnssec-keygen) 1455 0 R (man.dnssec-revoke) 2498 0 R (man.dnssec-settime) 1456 0 R (man.dnssec-signzone) 2526 0 R (man.genrandom) 2708 0 R (man.host) 2422 0 R (man.isc-hmac-fixup) 2715 0 R (man.named) 2583 0 R (man.named-checkconf) 2551 0 R (man.named-checkzone) 2563 0 R (man.named-journalprint) 2606 0 R (man.nsec3hash) 2726 0 R (man.nsupdate) 2616 0 R (man.rndc) 2642 0 R (man.rndc-confgen) 2670 0 R (man.rndc.conf) 2654 0 R (managed-keys) 1477 0 R (notify) 1356 0 R (options) 1326 0 R (page.1) 934 0 R (page.10) 1318 0 R (page.100) 1939 0 R (page.101) 1959 0 R (page.102) 1966 0 R (page.103) 1973 0 R (page.104) 1977 0 R (page.105) 1989 0 R (page.106) 1993 0 R (page.107) 2002 0 R (page.108) 2014 0 R (page.109) 2025 0 R (page.11) 1331 0 R (page.110) 2032 0 R (page.111) 2038 0 R (page.112) 2045 0 R (page.113) 2054 0 R (page.114) 2063 0 R (page.115) 2071 0 R (page.116) 2082 0 R (page.117) 2086 0 R (page.118) 2092 0 R (page.119) 2102 0 R (page.12) 1335 0 R (page.120) 2106 0 R (page.121) 2111 0 R (page.122) 2122 0 R (page.123) 2126 0 R (page.124) 2133 0 R (page.125) 2143 0 R (page.126) 2202 0 R (page.127) 2259 0 R (page.128) 2313 0 R (page.129) 2348 0 R (page.13) 1342 0 R (page.130) 2356 0 R (page.131) 2364 0 R (page.132) 2371 0 R (page.133) 2377 0 R (page.134) 2383 0 R (page.135) 2387 0 R (page.136) 2396 0 R (page.137) 2402 0 R (page.138) 2407 0 R (page.139) 2412 0 R (page.14) 1349 0 R (page.140) 2417 0 R (page.141) 2428 0 R (page.142) 2433 0 R (page.143) 2445 0 R (page.144) 2454 0 R (page.145) 2464 0 R (page.146) 2469 0 R (page.147) 2478 0 R (page.148) 2484 0 R (page.149) 2488 0 R (page.15) 1354 0 R (page.150) 2494 0 R (page.151) 2506 0 R (page.152) 2516 0 R (page.153) 2522 0 R (page.154) 2532 0 R (page.155) 2538 0 R (page.156) 2542 0 R (page.157) 2547 0 R (page.158) 2557 0 R (page.159) 2568 0 R (page.16) 1375 0 R (page.160) 2575 0 R (page.161) 2579 0 R (page.162) 2591 0 R (page.163) 2596 0 R (page.164) 2602 0 R (page.165) 2614 0 R (page.166) 2623 0 R (page.167) 2628 0 R (page.168) 2632 0 R (page.169) 2640 0 R (page.17) 1385 0 R (page.170) 2650 0 R (page.171) 2661 0 R (page.172) 2666 0 R (page.173) 2677 0 R (page.174) 2683 0 R (page.175) 2695 0 R (page.176) 2707 0 R (page.177) 2721 0 R (page.178) 2734 0 R (page.18) 1390 0 R (page.19) 1396 0 R (page.2) 958 0 R (page.20) 1401 0 R (page.21) 1410 0 R (page.22) 1419 0 R (page.23) 1426 0 R (page.24) 1432 0 R (page.25) 1437 0 R (page.26) 1446 0 R (page.27) 1460 0 R (page.28) 1467 0 R (page.29) 1481 0 R (page.3) 1255 0 R (page.30) 1487 0 R (page.31) 1493 0 R (page.32) 1499 0 R (page.33) 1506 0 R (page.34) 1514 0 R (page.35) 1519 0 R (page.36) 1525 0 R (page.37) 1535 0 R (page.38) 1542 0 R (page.39) 1546 0 R (page.4) 1266 0 R (page.40) 1556 0 R (page.41) 1560 0 R (page.42) 1567 0 R (page.43) 1577 0 R (page.44) 1585 0 R (page.45) 1593 0 R (page.46) 1605 0 R (page.47) 1611 0 R (page.48) 1617 0 R (page.49) 1624 0 R (page.5) 1273 0 R (page.50) 1628 0 R (page.51) 1635 0 R (page.52) 1640 0 R (page.53) 1650 0 R (page.54) 1654 0 R (page.55) 1659 0 R (page.56) 1663 0 R (page.57) 1667 0 R (page.58) 1671 0 R (page.59) 1678 0 R (page.6) 1285 0 R (page.60) 1683 0 R (page.61) 1688 0 R (page.62) 1694 0 R (page.63) 1705 0 R (page.64) 1709 0 R (page.65) 1713 0 R (page.66) 1717 0 R (page.67) 1728 0 R (page.68) 1734 0 R (page.69) 1740 0 R (page.7) 1291 0 R (page.70) 1745 0 R (page.71) 1749 0 R (page.72) 1753 0 R (page.73) 1760 0 R (page.74) 1768 0 R (page.75) 1773 0 R (page.76) 1781 0 R (page.77) 1788 0 R (page.78) 1793 0 R (page.79) 1801 0 R (page.8) 1299 0 R (page.80) 1808 0 R (page.81) 1813 0 R (page.82) 1817 0 R (page.83) 1821 0 R (page.84) 1825 0 R (page.85) 1832 0 R (page.86) 1837 0 R (page.87) 1841 0 R (page.88) 1846 0 R (page.89) 1852 0 R (page.9) 1308 0 R (page.90) 1861 0 R (page.91) 1867 0 R (page.92) 1872 0 R (page.93) 1876 0 R (page.94) 1880 0 R (page.95) 1884 0 R (page.96) 1892 0 R (page.97) 1897 0 R (page.98) 1912 0 R (page.99) 1927 0 R (page.i) 968 0 R (page.ii) 1023 0 R (page.iii) 1087 0 R (page.iv) 1150 0 R (page.v) 1212 0 R (pkcs11) 1483 0 R (proposed_standards) 1381 0 R (query_address) 1741 0 R (rfc5011.support) 1474 0 R (rfcs) 1251 0 R (rndc) 1589 0 R (root_delegation_only) 1908 0 R (rrset_ordering) 1304 0 R (sample_configuration) 1293 0 R (section*.10) 2272 0 R (section*.100) 2604 0 R (section*.101) 2605 0 R (section*.102) 2607 0 R (section*.103) 2608 0 R (section*.104) 2609 0 R (section*.105) 2610 0 R (section*.106) 2615 0 R (section*.107) 2617 0 R (section*.108) 2618 0 R (section*.109) 2619 0 R (section*.11) 2282 0 R (section*.110) 2624 0 R (section*.111) 2633 0 R (section*.112) 2634 0 R (section*.113) 2635 0 R (section*.114) 2641 0 R (section*.115) 2643 0 R (section*.116) 2644 0 R (section*.117) 2645 0 R (section*.118) 2646 0 R (section*.119) 2651 0 R (section*.12) 2302 0 R (section*.120) 2652 0 R (section*.121) 2653 0 R (section*.122) 2655 0 R (section*.123) 2656 0 R (section*.124) 2657 0 R (section*.125) 2662 0 R (section*.126) 2667 0 R (section*.127) 2668 0 R (section*.128) 2669 0 R (section*.129) 2671 0 R (section*.13) 2314 0 R (section*.130) 2672 0 R (section*.131) 2673 0 R (section*.132) 2678 0 R (section*.133) 2679 0 R (section*.134) 2684 0 R (section*.135) 2685 0 R (section*.136) 2687 0 R (section*.137) 2688 0 R (section*.138) 2689 0 R (section*.139) 2690 0 R (section*.14) 2340 0 R (section*.140) 2696 0 R (section*.141) 2697 0 R (section*.142) 2699 0 R (section*.143) 2700 0 R (section*.144) 2701 0 R (section*.145) 2702 0 R (section*.146) 2703 0 R (section*.147) 2709 0 R (section*.148) 2710 0 R (section*.149) 2711 0 R (section*.15) 2390 0 R (section*.150) 2712 0 R (section*.151) 2713 0 R (section*.152) 2714 0 R (section*.153) 2716 0 R (section*.154) 2717 0 R (section*.155) 2722 0 R (section*.156) 2723 0 R (section*.157) 2724 0 R (section*.158) 2725 0 R (section*.159) 2727 0 R (section*.16) 2391 0 R (section*.160) 2728 0 R (section*.161) 2729 0 R (section*.162) 2730 0 R (section*.163) 2735 0 R (section*.164) 2736 0 R (section*.17) 2392 0 R (section*.18) 2397 0 R (section*.19) 2398 0 R (section*.2) 2138 0 R (section*.20) 2403 0 R (section*.21) 2413 0 R (section*.22) 2418 0 R (section*.23) 2419 0 R (section*.24) 2420 0 R (section*.25) 2421 0 R (section*.26) 2423 0 R (section*.27) 2424 0 R (section*.28) 2429 0 R (section*.29) 2434 0 R (section*.3) 2144 0 R (section*.30) 2435 0 R (section*.31) 2436 0 R (section*.32) 2438 0 R (section*.33) 2439 0 R (section*.34) 2440 0 R (section*.35) 2441 0 R (section*.36) 2446 0 R (section*.37) 2447 0 R (section*.38) 2448 0 R (section*.39) 2449 0 R (section*.4) 2152 0 R (section*.40) 2450 0 R (section*.41) 2456 0 R (section*.42) 2457 0 R (section*.43) 2458 0 R (section*.44) 2459 0 R (section*.45) 2465 0 R (section*.46) 2470 0 R (section*.47) 2471 0 R (section*.48) 2472 0 R (section*.49) 2473 0 R (section*.5) 2177 0 R (section*.50) 2474 0 R (section*.51) 2479 0 R (section*.52) 2480 0 R (section*.53) 2489 0 R (section*.54) 2490 0 R (section*.55) 2495 0 R (section*.56) 2496 0 R (section*.57) 2497 0 R (section*.58) 2499 0 R (section*.59) 2500 0 R (section*.6) 2189 0 R (section*.60) 2501 0 R (section*.61) 2507 0 R (section*.62) 2508 0 R (section*.63) 2509 0 R (section*.64) 2510 0 R (section*.65) 2511 0 R (section*.66) 2512 0 R (section*.67) 2517 0 R (section*.68) 2518 0 R (section*.69) 2523 0 R (section*.7) 2203 0 R (section*.70) 2524 0 R (section*.71) 2525 0 R (section*.72) 2527 0 R (section*.73) 2528 0 R (section*.74) 2533 0 R (section*.75) 2534 0 R (section*.76) 2548 0 R (section*.77) 2549 0 R (section*.78) 2550 0 R (section*.79) 2552 0 R (section*.8) 2241 0 R (section*.80) 2553 0 R (section*.81) 2558 0 R (section*.82) 2559 0 R (section*.83) 2560 0 R (section*.84) 2561 0 R (section*.85) 2562 0 R (section*.86) 2564 0 R (section*.87) 2569 0 R (section*.88) 2570 0 R (section*.89) 2571 0 R (section*.9) 2260 0 R (section*.90) 2580 0 R (section*.91) 2581 0 R (section*.92) 2582 0 R (section*.93) 2584 0 R (section*.94) 2585 0 R (section*.95) 2586 0 R (section*.96) 2587 0 R (section*.97) 2597 0 R (section*.98) 2598 0 R (section*.99) 2603 0 R (section.1.1) 10 0 R (section.1.2) 14 0 R (section.1.3) 18 0 R (section.1.4) 22 0 R (section.2.1) 70 0 R (section.2.2) 74 0 R (section.2.3) 78 0 R (section.2.4) 82 0 R (section.2.5) 86 0 R (section.3.1) 94 0 R (section.3.2) 106 0 R (section.3.3) 110 0 R (section.4.1) 134 0 R (section.4.10) 274 0 R (section.4.11) 286 0 R (section.4.12) 338 0 R (section.4.2) 138 0 R (section.4.3) 146 0 R (section.4.4) 150 0 R (section.4.5) 158 0 R (section.4.6) 194 0 R (section.4.7) 198 0 R (section.4.8) 202 0 R (section.4.9) 218 0 R (section.5.1) 354 0 R (section.5.2) 358 0 R (section.6.1) 366 0 R (section.6.2) 394 0 R (section.6.3) 618 0 R (section.6.4) 674 0 R (section.7.1) 710 0 R (section.7.2) 714 0 R (section.7.3) 726 0 R (section.8.1) 734 0 R (section.8.2) 742 0 R (section.8.3) 746 0 R (section.A.1) 754 0 R (section.A.2) 762 0 R (section.A.3) 770 0 R (section.A.4) 786 0 R (section.B.1) 846 0 R (section.B.10) 882 0 R (section.B.11) 886 0 R (section.B.12) 890 0 R (section.B.13) 894 0 R (section.B.14) 898 0 R (section.B.15) 902 0 R (section.B.16) 906 0 R (section.B.17) 910 0 R (section.B.18) 914 0 R (section.B.19) 918 0 R (section.B.2) 850 0 R (section.B.20) 922 0 R (section.B.21) 926 0 R (section.B.3) 854 0 R (section.B.4) 858 0 R (section.B.5) 862 0 R (section.B.6) 866 0 R (section.B.7) 870 0 R (section.B.8) 874 0 R (section.B.9) 878 0 R (server_resource_limits) 1763 0 R (server_statement_definition_and_usage) 1701 0 R (server_statement_grammar) 1842 0 R (statistics) 2039 0 R (statistics_counters) 2047 0 R (statschannels) 1853 0 R (statsfile) 1674 0 R (subsection.1.4.1) 26 0 R (subsection.1.4.2) 30 0 R (subsection.1.4.3) 34 0 R (subsection.1.4.4) 38 0 R (subsection.1.4.5) 54 0 R (subsection.1.4.6) 62 0 R (subsection.3.1.1) 98 0 R (subsection.3.1.2) 102 0 R (subsection.3.3.1) 114 0 R (subsection.3.3.2) 126 0 R (subsection.4.10.1) 278 0 R (subsection.4.10.2) 282 0 R (subsection.4.11.1) 290 0 R (subsection.4.11.2) 306 0 R (subsection.4.11.3) 322 0 R (subsection.4.11.4) 326 0 R (subsection.4.11.5) 330 0 R (subsection.4.11.6) 334 0 R (subsection.4.12.1) 342 0 R (subsection.4.12.2) 346 0 R (subsection.4.2.1) 142 0 R (subsection.4.4.1) 154 0 R (subsection.4.5.1) 162 0 R (subsection.4.5.2) 174 0 R (subsection.4.5.3) 178 0 R (subsection.4.5.4) 182 0 R (subsection.4.5.5) 186 0 R (subsection.4.5.6) 190 0 R (subsection.4.8.1) 206 0 R (subsection.4.8.2) 210 0 R (subsection.4.8.3) 214 0 R (subsection.4.9.1) 222 0 R (subsection.4.9.10) 258 0 R (subsection.4.9.11) 262 0 R (subsection.4.9.12) 266 0 R (subsection.4.9.13) 270 0 R (subsection.4.9.2) 226 0 R (subsection.4.9.3) 230 0 R (subsection.4.9.4) 234 0 R (subsection.4.9.5) 238 0 R (subsection.4.9.6) 242 0 R (subsection.4.9.7) 246 0 R (subsection.4.9.8) 250 0 R (subsection.4.9.9) 254 0 R (subsection.6.1.1) 370 0 R (subsection.6.1.2) 382 0 R (subsection.6.2.1) 398 0 R (subsection.6.2.10) 434 0 R (subsection.6.2.11) 450 0 R (subsection.6.2.12) 454 0 R (subsection.6.2.13) 458 0 R (subsection.6.2.14) 462 0 R (subsection.6.2.15) 466 0 R (subsection.6.2.16) 470 0 R (subsection.6.2.17) 554 0 R (subsection.6.2.18) 558 0 R (subsection.6.2.19) 562 0 R (subsection.6.2.2) 402 0 R (subsection.6.2.20) 566 0 R (subsection.6.2.21) 570 0 R (subsection.6.2.22) 574 0 R (subsection.6.2.23) 578 0 R (subsection.6.2.24) 582 0 R (subsection.6.2.25) 586 0 R (subsection.6.2.26) 590 0 R (subsection.6.2.27) 594 0 R (subsection.6.2.28) 598 0 R (subsection.6.2.3) 406 0 R (subsection.6.2.4) 410 0 R (subsection.6.2.5) 414 0 R (subsection.6.2.6) 418 0 R (subsection.6.2.7) 422 0 R (subsection.6.2.8) 426 0 R (subsection.6.2.9) 430 0 R (subsection.6.3.1) 622 0 R (subsection.6.3.2) 634 0 R (subsection.6.3.3) 638 0 R (subsection.6.3.4) 642 0 R (subsection.6.3.5) 646 0 R (subsection.6.3.6) 666 0 R (subsection.6.3.7) 670 0 R (subsection.6.4.1) 682 0 R (subsection.7.2.1) 718 0 R (subsection.7.2.2) 722 0 R (subsection.8.1.1) 738 0 R (subsection.A.1.1) 758 0 R (subsection.A.2.1) 766 0 R (subsection.A.3.1) 774 0 R (subsection.A.3.2) 778 0 R (subsection.A.3.3) 782 0 R (subsection.A.4.1) 790 0 R (subsection.A.4.2) 794 0 R (subsection.A.4.3) 798 0 R (subsection.A.4.4) 802 0 R (subsection.A.4.5) 806 0 R (subsection.A.4.6) 810 0 R (subsection.A.4.7) 838 0 R (subsubsection.1.4.4.1) 42 0 R (subsubsection.1.4.4.2) 46 0 R (subsubsection.1.4.4.3) 50 0 R (subsubsection.1.4.5.1) 58 0 R (subsubsection.3.3.1.1) 118 0 R (subsubsection.3.3.1.2) 122 0 R (subsubsection.4.11.1.1) 294 0 R (subsubsection.4.11.1.2) 298 0 R (subsubsection.4.11.1.3) 302 0 R (subsubsection.4.11.2.1) 310 0 R (subsubsection.4.11.2.2) 314 0 R (subsubsection.4.11.2.3) 318 0 R (subsubsection.4.5.1.1) 166 0 R (subsubsection.4.5.1.2) 170 0 R (subsubsection.6.1.1.1) 374 0 R (subsubsection.6.1.1.2) 378 0 R (subsubsection.6.1.2.1) 386 0 R (subsubsection.6.1.2.2) 390 0 R (subsubsection.6.2.10.1) 438 0 R (subsubsection.6.2.10.2) 442 0 R (subsubsection.6.2.10.3) 446 0 R (subsubsection.6.2.16.1) 474 0 R (subsubsection.6.2.16.10) 510 0 R (subsubsection.6.2.16.11) 514 0 R (subsubsection.6.2.16.12) 518 0 R (subsubsection.6.2.16.13) 522 0 R (subsubsection.6.2.16.14) 526 0 R (subsubsection.6.2.16.15) 530 0 R (subsubsection.6.2.16.16) 534 0 R (subsubsection.6.2.16.17) 538 0 R (subsubsection.6.2.16.18) 542 0 R (subsubsection.6.2.16.19) 546 0 R (subsubsection.6.2.16.2) 478 0 R (subsubsection.6.2.16.20) 550 0 R (subsubsection.6.2.16.3) 482 0 R (subsubsection.6.2.16.4) 486 0 R (subsubsection.6.2.16.5) 490 0 R (subsubsection.6.2.16.6) 494 0 R (subsubsection.6.2.16.7) 498 0 R (subsubsection.6.2.16.8) 502 0 R (subsubsection.6.2.16.9) 506 0 R (subsubsection.6.2.28.1) 602 0 R (subsubsection.6.2.28.2) 606 0 R (subsubsection.6.2.28.3) 610 0 R (subsubsection.6.2.28.4) 614 0 R (subsubsection.6.3.1.1) 626 0 R (subsubsection.6.3.1.2) 630 0 R (subsubsection.6.3.5.1) 650 0 R (subsubsection.6.3.5.2) 654 0 R (subsubsection.6.3.5.3) 658 0 R (subsubsection.6.3.5.4) 662 0 R (subsubsection.6.4.0.1) 678 0 R (subsubsection.6.4.1.1) 686 0 R (subsubsection.6.4.1.2) 690 0 R (subsubsection.6.4.1.3) 694 0 R (subsubsection.6.4.1.4) 698 0 R (subsubsection.6.4.1.5) 702 0 R (subsubsection.A.4.6.1) 814 0 R (subsubsection.A.4.6.2) 818 0 R (subsubsection.A.4.6.3) 822 0 R (subsubsection.A.4.6.4) 826 0 R (subsubsection.A.4.6.5) 830 0 R (subsubsection.A.4.6.6) 834 0 R (table.1.1) 1235 0 R (table.1.2) 1243 0 R (table.3.1) 1302 0 R (table.3.2) 1345 0 R (table.6.1) 1550 0 R (table.6.10) 1983 0 R (table.6.11) 1985 0 R (table.6.12) 1995 0 R (table.6.13) 1998 0 R (table.6.14) 2004 0 R (table.6.15) 2007 0 R (table.6.16) 2010 0 R (table.6.17) 2017 0 R (table.6.18) 2034 0 R (table.6.19) 2041 0 R (table.6.2) 1572 0 R (table.6.20) 2050 0 R (table.6.21) 2058 0 R (table.6.22) 2066 0 R (table.6.23) 2074 0 R (table.6.3) 1581 0 R (table.6.4) 1619 0 R (table.6.5) 1631 0 R (table.6.6) 1690 0 R (table.6.7) 1784 0 R (table.6.8) 1888 0 R (table.6.9) 1968 0 R (the_category_phrase) 1613 0 R (the_sortlist_statement) 1775 0 R (topology) 1774 0 R (trusted-keys) 1855 0 R (tsig) 1397 0 R (tuning) 1789 0 R (types_of_resource_records_and_when_to_use_them) 1250 0 R (view_statement_grammar) 1804 0 R (zone_statement_grammar) 1724 0 R (zone_transfers) 1371 0 R (zonefile_format) 1797 0 R] +2833 0 obj << +/Names [(Access_Control_Lists) 2120 0 R (Bv9ARM.ch01) 1245 0 R (Bv9ARM.ch02) 1289 0 R (Bv9ARM.ch03) 1307 0 R (Bv9ARM.ch04) 1373 0 R (Bv9ARM.ch05) 1551 0 R (Bv9ARM.ch06) 1562 0 R (Bv9ARM.ch07) 2119 0 R (Bv9ARM.ch08) 2144 0 R (Bv9ARM.ch09) 2159 0 R (Bv9ARM.ch10) 2420 0 R (Configuration_File_Grammar) 1585 0 R (DNSSEC) 1439 0 R (Doc-Start) 947 0 R (Setting_TTLs) 2045 0 R (acache) 1296 0 R (access_control) 1744 0 R (acl) 1594 0 R (address_match_lists) 1567 0 R (admin_tools) 1329 0 R (appendix.A) 750 0 R (appendix.B) 842 0 R (bibliography) 2167 0 R (bind9.library) 2376 0 R (boolean_options) 1388 0 R (builtin) 1824 0 R (chapter*.1) 981 0 R (chapter.1) 6 0 R (chapter.2) 66 0 R (chapter.3) 90 0 R (chapter.4) 130 0 R (chapter.5) 350 0 R (chapter.6) 362 0 R (chapter.7) 706 0 R (chapter.8) 730 0 R (cite.RFC1033) 2295 0 R (cite.RFC1034) 2180 0 R (cite.RFC1035) 2182 0 R (cite.RFC1101) 2277 0 R (cite.RFC1123) 2279 0 R (cite.RFC1183) 2239 0 R (cite.RFC1464) 2317 0 R (cite.RFC1535) 2225 0 R (cite.RFC1536) 2227 0 R (cite.RFC1537) 2297 0 R (cite.RFC1591) 2281 0 R (cite.RFC1706) 2241 0 R (cite.RFC1712) 2337 0 R (cite.RFC1713) 2319 0 R (cite.RFC1794) 2321 0 R (cite.RFC1876) 2243 0 R (cite.RFC1912) 2299 0 R (cite.RFC1982) 2229 0 R (cite.RFC1995) 2187 0 R (cite.RFC1996) 2189 0 R (cite.RFC2010) 2301 0 R (cite.RFC2052) 2245 0 R (cite.RFC2065) 2349 0 R (cite.RFC2136) 2191 0 R (cite.RFC2137) 2351 0 R (cite.RFC2163) 2247 0 R (cite.RFC2168) 2249 0 R (cite.RFC2181) 2193 0 R (cite.RFC2219) 2303 0 R (cite.RFC2230) 2251 0 R (cite.RFC2240) 2323 0 R (cite.RFC2308) 2195 0 R (cite.RFC2317) 2283 0 R (cite.RFC2345) 2325 0 R (cite.RFC2352) 2327 0 R (cite.RFC2535) 2353 0 R (cite.RFC2536) 2253 0 R (cite.RFC2537) 2255 0 R (cite.RFC2538) 2257 0 R (cite.RFC2539) 2259 0 R (cite.RFC2540) 2261 0 R (cite.RFC2671) 2197 0 R (cite.RFC2672) 2199 0 R (cite.RFC2673) 2339 0 R (cite.RFC2782) 2263 0 R (cite.RFC2825) 2307 0 R (cite.RFC2826) 2285 0 R (cite.RFC2845) 2201 0 R (cite.RFC2874) 2341 0 R (cite.RFC2915) 2265 0 R (cite.RFC2929) 2287 0 R (cite.RFC2930) 2203 0 R (cite.RFC2931) 2205 0 R (cite.RFC3007) 2207 0 R (cite.RFC3008) 2355 0 R (cite.RFC3071) 2329 0 R (cite.RFC3090) 2357 0 R (cite.RFC3110) 2267 0 R (cite.RFC3123) 2269 0 R (cite.RFC3225) 2213 0 R (cite.RFC3258) 2331 0 R (cite.RFC3445) 2359 0 R (cite.RFC3490) 2309 0 R (cite.RFC3491) 2311 0 R (cite.RFC3492) 2313 0 R (cite.RFC3596) 2271 0 R (cite.RFC3597) 2273 0 R (cite.RFC3645) 2209 0 R (cite.RFC3655) 2361 0 R (cite.RFC3658) 2363 0 R (cite.RFC3755) 2365 0 R (cite.RFC3757) 2367 0 R (cite.RFC3833) 2215 0 R (cite.RFC3845) 2369 0 R (cite.RFC3901) 2333 0 R (cite.RFC4033) 2217 0 R (cite.RFC4034) 2219 0 R (cite.RFC4035) 2221 0 R (cite.RFC4074) 2231 0 R (cite.RFC974) 2184 0 R (cite.id2513817) 2374 0 R (clients-per-query) 2099 0 R (configuration_file_elements) 1563 0 R (controls_statement_definition_and_usage) 1360 0 R (diagnostic_tools) 1277 0 R (dnssec.dynamic.zones) 1459 0 R (dynamic_update) 1383 0 R (dynamic_update_policies) 1342 0 R (dynamic_update_security) 1753 0 R (empty) 1826 0 R (historical_dns_information) 2161 0 R (id2466570) 1246 0 R (id2466594) 1247 0 R (id2467262) 1509 0 R (id2467400) 1510 0 R (id2467484) 1248 0 R (id2467494) 1249 0 R (id2467734) 1259 0 R (id2467755) 1260 0 R (id2467789) 1261 0 R (id2467874) 1264 0 R (id2467966) 1257 0 R (id2470272) 1271 0 R (id2470295) 1274 0 R (id2470393) 1275 0 R (id2470414) 1276 0 R (id2470444) 1282 0 R (id2470480) 1283 0 R (id2470574) 1284 0 R (id2470609) 1290 0 R (id2470635) 1291 0 R (id2470716) 1292 0 R (id2470742) 1295 0 R (id2470753) 1301 0 R (id2470785) 1309 0 R (id2470801) 1310 0 R (id2470823) 1315 0 R (id2470840) 1316 0 R (id2471245) 1324 0 R (id2471251) 1325 0 R (id2473610) 1365 0 R (id2473622) 1366 0 R (id2474049) 1398 0 R (id2474135) 1404 0 R (id2474636) 1420 0 R (id2474653) 1421 0 R (id2474692) 1422 0 R (id2474710) 1423 0 R (id2474721) 1424 0 R (id2474825) 1429 0 R (id2474883) 1430 0 R (id2474932) 1432 0 R (id2474946) 1433 0 R (id2474995) 1438 0 R (id2475200) 1440 0 R (id2475347) 1445 0 R (id2475428) 1446 0 R (id2475581) 1460 0 R (id2475619) 1461 0 R (id2475928) 1466 0 R (id2476100) 1475 0 R (id2476137) 1476 0 R (id2476150) 1477 0 R (id2476251) 1478 0 R (id2476278) 1483 0 R (id2476288) 1484 0 R (id2476297) 1485 0 R (id2476310) 1486 0 R (id2476347) 1487 0 R (id2476357) 1488 0 R (id2476462) 1494 0 R (id2476485) 1496 0 R (id2476724) 1503 0 R (id2477211) 1515 0 R (id2477430) 1520 0 R (id2477438) 1521 0 R (id2477470) 1522 0 R (id2477507) 1523 0 R (id2477555) 1524 0 R (id2477586) 1529 0 R (id2477852) 1535 0 R (id2478035) 1536 0 R (id2478157) 1541 0 R (id2478219) 1543 0 R (id2478241) 1544 0 R (id2478274) 1552 0 R (id2478489) 1564 0 R (id2479520) 1576 0 R (id2479547) 1577 0 R (id2479753) 1578 0 R (id2479768) 1583 0 R (id2479866) 1584 0 R (id2479941) 1586 0 R (id2480345) 1593 0 R (id2480388) 1595 0 R (id2480603) 1601 0 R (id2481031) 1609 0 R (id2481048) 1610 0 R (id2481072) 1611 0 R (id2481163) 1612 0 R (id2481254) 1616 0 R (id2481380) 1621 0 R (id2481500) 1622 0 R (id2482125) 1633 0 R (id2482819) 1644 0 R (id2482949) 1645 0 R (id2483338) 1651 0 R (id2483412) 1656 0 R (id2483544) 1659 0 R (id2483588) 1660 0 R (id2483609) 1661 0 R (id2487332) 1706 0 R (id2489504) 1736 0 R (id2489699) 1743 0 R (id2490123) 1758 0 R (id2491409) 1777 0 R (id2491468) 1779 0 R (id2491959) 1791 0 R (id2492530) 1805 0 R (id2494333) 1844 0 R (id2494459) 1851 0 R (id2495723) 1876 0 R (id2495962) 1883 0 R (id2496077) 1890 0 R (id2496519) 1895 0 R (id2498299) 1912 0 R (id2498307) 1913 0 R (id2498312) 1914 0 R (id2498983) 1930 0 R (id2499016) 1931 0 R (id2501322) 2000 0 R (id2501917) 2010 0 R (id2501936) 2011 0 R (id2501956) 2014 0 R (id2502124) 2020 0 R (id2503363) 2026 0 R (id2503559) 2033 0 R (id2503580) 2034 0 R (id2503875) 2036 0 R (id2504011) 2038 0 R (id2504098) 2043 0 R (id2504502) 2046 0 R (id2504627) 2048 0 R (id2504642) 2049 0 R (id2504754) 2055 0 R (id2504844) 2056 0 R (id2504860) 2057 0 R (id2504989) 2058 0 R (id2505059) 2063 0 R (id2505095) 2064 0 R (id2505307) 2065 0 R (id2505750) 2076 0 R (id2506117) 2085 0 R (id2506122) 2086 0 R (id2507690) 2093 0 R (id2507697) 2094 0 R (id2508073) 2096 0 R (id2508078) 2097 0 R (id2509163) 2104 0 R (id2509195) 2105 0 R (id2509605) 2114 0 R (id2509764) 2128 0 R (id2509913) 2129 0 R (id2509973) 2130 0 R (id2510189) 2145 0 R (id2510195) 2146 0 R (id2510206) 2147 0 R (id2510224) 2148 0 R (id2510490) 2160 0 R (id2510594) 2166 0 R (id2510850) 2171 0 R (id2510852) 2178 0 R (id2510860) 2183 0 R (id2510884) 2179 0 R (id2510907) 2181 0 R (id2510944) 2192 0 R (id2510970) 2194 0 R (id2510996) 2186 0 R (id2511020) 2188 0 R (id2511044) 2190 0 R (id2511099) 2196 0 R (id2511126) 2198 0 R (id2511153) 2200 0 R (id2511214) 2202 0 R (id2511244) 2204 0 R (id2511274) 2206 0 R (id2511301) 2208 0 R (id2511376) 2211 0 R (id2511383) 2212 0 R (id2511410) 2214 0 R (id2511446) 2216 0 R (id2511511) 2218 0 R (id2511576) 2220 0 R (id2511641) 2223 0 R (id2511650) 2224 0 R (id2511675) 2226 0 R (id2511744) 2228 0 R (id2511779) 2230 0 R (id2511819) 2237 0 R (id2511825) 2238 0 R (id2511882) 2240 0 R (id2511920) 2248 0 R (id2511955) 2242 0 R (id2512009) 2244 0 R (id2512048) 2246 0 R (id2512073) 2250 0 R (id2512099) 2252 0 R (id2512125) 2254 0 R (id2512152) 2256 0 R (id2512192) 2258 0 R (id2512221) 2260 0 R (id2512251) 2262 0 R (id2512294) 2264 0 R (id2512327) 2266 0 R (id2512354) 2268 0 R (id2512377) 2270 0 R (id2512435) 2272 0 R (id2512459) 2275 0 R (id2512467) 2276 0 R (id2512492) 2278 0 R (id2512515) 2280 0 R (id2512538) 2282 0 R (id2512652) 2284 0 R (id2512676) 2286 0 R (id2512726) 2293 0 R (id2512733) 2294 0 R (id2512757) 2296 0 R (id2512784) 2298 0 R (id2512810) 2300 0 R (id2512846) 2302 0 R (id2512887) 2305 0 R (id2512892) 2306 0 R (id2512924) 2308 0 R (id2512970) 2310 0 R (id2513005) 2312 0 R (id2513032) 2315 0 R (id2513050) 2316 0 R (id2513073) 2318 0 R (id2513098) 2320 0 R (id2513124) 2322 0 R (id2513147) 2324 0 R (id2513193) 2326 0 R (id2513217) 2328 0 R (id2513243) 2330 0 R (id2513269) 2332 0 R (id2513306) 2335 0 R (id2513313) 2336 0 R (id2513370) 2338 0 R (id2513397) 2340 0 R (id2513433) 2347 0 R (id2513445) 2348 0 R (id2513484) 2350 0 R (id2513511) 2352 0 R (id2513541) 2354 0 R (id2513566) 2356 0 R (id2513593) 2358 0 R (id2513629) 2360 0 R (id2513666) 2362 0 R (id2513692) 2364 0 R (id2513719) 2366 0 R (id2513764) 2368 0 R (id2513805) 2371 0 R (id2513815) 2373 0 R (id2513817) 2375 0 R (id2513973) 2381 0 R (id2513982) 2382 0 R (id2514075) 2383 0 R (id2514106) 2384 0 R (id2514183) 2389 0 R (id2514278) 2391 0 R (id2514286) 2392 0 R (id2514377) 2398 0 R (id2514499) 2399 0 R (id2514631) 2400 0 R (id2514646) 2405 0 R (id2514777) 2410 0 R (id2514841) 2411 0 R (incremental_zone_transfers) 1395 0 R (internet_drafts) 2370 0 R (ipv6addresses) 1546 0 R (journal) 1394 0 R (lwresd) 1553 0 R (man.arpaname) 2768 0 R (man.ddns-confgen) 2756 0 R (man.dig) 2421 0 R (man.dnssec-checkds) 2469 0 R (man.dnssec-coverage) 2481 0 R (man.dnssec-dsfromkey) 2496 0 R (man.dnssec-keyfromlabel) 2510 0 R (man.dnssec-keygen) 1469 0 R (man.dnssec-revoke) 2557 0 R (man.dnssec-settime) 1470 0 R (man.dnssec-signzone) 2585 0 R (man.dnssec-verify) 2614 0 R (man.genrandom) 2778 0 R (man.host) 2458 0 R (man.isc-hmac-fixup) 2789 0 R (man.named) 2653 0 R (man.named-checkconf) 2625 0 R (man.named-checkzone) 2637 0 R (man.named-journalprint) 2676 0 R (man.nsec3hash) 2796 0 R (man.nsupdate) 2686 0 R (man.rndc) 2712 0 R (man.rndc-confgen) 2744 0 R (man.rndc.conf) 2724 0 R (managed-keys) 1497 0 R (notify) 1374 0 R (options) 1341 0 R (page.1) 946 0 R (page.10) 1333 0 R (page.100) 1939 0 R (page.101) 1957 0 R (page.102) 1971 0 R (page.103) 1988 0 R (page.104) 1999 0 R (page.105) 2005 0 R (page.106) 2009 0 R (page.107) 2019 0 R (page.108) 2025 0 R (page.109) 2032 0 R (page.11) 1346 0 R (page.110) 2042 0 R (page.111) 2054 0 R (page.112) 2062 0 R (page.113) 2070 0 R (page.114) 2074 0 R (page.115) 2083 0 R (page.116) 2091 0 R (page.117) 2103 0 R (page.118) 2110 0 R (page.119) 2118 0 R (page.12) 1350 0 R (page.120) 2124 0 R (page.121) 2135 0 R (page.122) 2139 0 R (page.123) 2143 0 R (page.124) 2154 0 R (page.125) 2158 0 R (page.126) 2165 0 R (page.127) 2176 0 R (page.128) 2235 0 R (page.129) 2291 0 R (page.13) 1358 0 R (page.130) 2345 0 R (page.131) 2380 0 R (page.132) 2388 0 R (page.133) 2397 0 R (page.134) 2404 0 R (page.135) 2409 0 R (page.136) 2415 0 R (page.137) 2419 0 R (page.138) 2428 0 R (page.139) 2435 0 R (page.14) 1364 0 R (page.140) 2440 0 R (page.141) 2444 0 R (page.142) 2448 0 R (page.143) 2457 0 R (page.144) 2465 0 R (page.145) 2477 0 R (page.146) 2488 0 R (page.147) 2495 0 R (page.148) 2504 0 R (page.149) 2516 0 R (page.15) 1372 0 R (page.150) 2522 0 R (page.151) 2529 0 R (page.152) 2539 0 R (page.153) 2543 0 R (page.154) 2548 0 R (page.155) 2554 0 R (page.156) 2565 0 R (page.157) 2576 0 R (page.158) 2582 0 R (page.159) 2593 0 R (page.16) 1393 0 R (page.160) 2597 0 R (page.161) 2601 0 R (page.162) 2605 0 R (page.163) 2613 0 R (page.164) 2623 0 R (page.165) 2634 0 R (page.166) 2645 0 R (page.167) 2649 0 R (page.168) 2659 0 R (page.169) 2666 0 R (page.17) 1403 0 R (page.170) 2670 0 R (page.171) 2681 0 R (page.172) 2693 0 R (page.173) 2697 0 R (page.174) 2702 0 R (page.175) 2708 0 R (page.176) 2719 0 R (page.177) 2729 0 R (page.178) 2736 0 R (page.179) 2743 0 R (page.18) 1409 0 R (page.180) 2752 0 R (page.181) 2764 0 R (page.182) 2773 0 R (page.183) 2787 0 R (page.184) 2801 0 R (page.19) 1414 0 R (page.2) 970 0 R (page.20) 1419 0 R (page.21) 1428 0 R (page.22) 1437 0 R (page.23) 1444 0 R (page.24) 1450 0 R (page.25) 1455 0 R (page.26) 1465 0 R (page.27) 1474 0 R (page.28) 1482 0 R (page.29) 1492 0 R (page.3) 1270 0 R (page.30) 1501 0 R (page.31) 1508 0 R (page.32) 1514 0 R (page.33) 1519 0 R (page.34) 1528 0 R (page.35) 1534 0 R (page.36) 1540 0 R (page.37) 1550 0 R (page.38) 1557 0 R (page.39) 1561 0 R (page.4) 1281 0 R (page.40) 1571 0 R (page.41) 1575 0 R (page.42) 1582 0 R (page.43) 1592 0 R (page.44) 1600 0 R (page.45) 1608 0 R (page.46) 1620 0 R (page.47) 1626 0 R (page.48) 1632 0 R (page.49) 1639 0 R (page.5) 1288 0 R (page.50) 1643 0 R (page.51) 1650 0 R (page.52) 1655 0 R (page.53) 1665 0 R (page.54) 1669 0 R (page.55) 1674 0 R (page.56) 1678 0 R (page.57) 1682 0 R (page.58) 1686 0 R (page.59) 1693 0 R (page.6) 1300 0 R (page.60) 1698 0 R (page.61) 1705 0 R (page.62) 1711 0 R (page.63) 1716 0 R (page.64) 1725 0 R (page.65) 1729 0 R (page.66) 1733 0 R (page.67) 1741 0 R (page.68) 1750 0 R (page.69) 1757 0 R (page.7) 1306 0 R (page.70) 1763 0 R (page.71) 1767 0 R (page.72) 1771 0 R (page.73) 1776 0 R (page.74) 1784 0 R (page.75) 1790 0 R (page.76) 1796 0 R (page.77) 1803 0 R (page.78) 1810 0 R (page.79) 1817 0 R (page.8) 1314 0 R (page.80) 1823 0 R (page.81) 1831 0 R (page.82) 1835 0 R (page.83) 1839 0 R (page.84) 1843 0 R (page.85) 1849 0 R (page.86) 1855 0 R (page.87) 1859 0 R (page.88) 1863 0 R (page.89) 1868 0 R (page.9) 1323 0 R (page.90) 1875 0 R (page.91) 1889 0 R (page.92) 1894 0 R (page.93) 1899 0 R (page.94) 1903 0 R (page.95) 1907 0 R (page.96) 1911 0 R (page.97) 1920 0 R (page.98) 1924 0 R (page.99) 1928 0 R (page.i) 980 0 R (page.ii) 1035 0 R (page.iii) 1099 0 R (page.iv) 1162 0 R (page.v) 1224 0 R (pkcs11) 1502 0 R (proposed_standards) 1399 0 R (query_address) 1759 0 R (rfc5011.support) 1493 0 R (rfcs) 1266 0 R (rndc) 1604 0 R (root_delegation_only) 1935 0 R (rrset_ordering) 1319 0 R (sample_configuration) 1308 0 R (section*.10) 2304 0 R (section*.100) 2629 0 R (section*.101) 2630 0 R (section*.102) 2635 0 R (section*.103) 2636 0 R (section*.104) 2638 0 R (section*.105) 2639 0 R (section*.106) 2640 0 R (section*.107) 2641 0 R (section*.108) 2650 0 R (section*.109) 2651 0 R (section*.11) 2314 0 R (section*.110) 2652 0 R (section*.111) 2654 0 R (section*.112) 2655 0 R (section*.113) 2660 0 R (section*.114) 2661 0 R (section*.115) 2671 0 R (section*.116) 2672 0 R (section*.117) 2673 0 R (section*.118) 2674 0 R (section*.119) 2675 0 R (section*.12) 2334 0 R (section*.120) 2677 0 R (section*.121) 2682 0 R (section*.122) 2683 0 R (section*.123) 2684 0 R (section*.124) 2685 0 R (section*.125) 2687 0 R (section*.126) 2688 0 R (section*.127) 2689 0 R (section*.128) 2698 0 R (section*.129) 2703 0 R (section*.13) 2346 0 R (section*.130) 2709 0 R (section*.131) 2710 0 R (section*.132) 2711 0 R (section*.133) 2713 0 R (section*.134) 2714 0 R (section*.135) 2715 0 R (section*.136) 2720 0 R (section*.137) 2721 0 R (section*.138) 2722 0 R (section*.139) 2723 0 R (section*.14) 2372 0 R (section*.140) 2725 0 R (section*.141) 2730 0 R (section*.142) 2731 0 R (section*.143) 2732 0 R (section*.144) 2737 0 R (section*.145) 2738 0 R (section*.146) 2739 0 R (section*.147) 2745 0 R (section*.148) 2746 0 R (section*.149) 2747 0 R (section*.15) 2422 0 R (section*.150) 2748 0 R (section*.151) 2753 0 R (section*.152) 2754 0 R (section*.153) 2755 0 R (section*.154) 2757 0 R (section*.155) 2758 0 R (section*.156) 2759 0 R (section*.157) 2765 0 R (section*.158) 2766 0 R (section*.159) 2767 0 R (section*.16) 2423 0 R (section*.160) 2769 0 R (section*.161) 2774 0 R (section*.162) 2775 0 R (section*.163) 2776 0 R (section*.164) 2777 0 R (section*.165) 2779 0 R (section*.166) 2780 0 R (section*.167) 2781 0 R (section*.168) 2782 0 R (section*.169) 2783 0 R (section*.17) 2424 0 R (section*.170) 2788 0 R (section*.171) 2790 0 R (section*.172) 2791 0 R (section*.173) 2792 0 R (section*.174) 2793 0 R (section*.175) 2794 0 R (section*.176) 2795 0 R (section*.177) 2797 0 R (section*.178) 2802 0 R (section*.179) 2803 0 R (section*.18) 2429 0 R (section*.180) 2804 0 R (section*.181) 2805 0 R (section*.182) 2806 0 R (section*.19) 2430 0 R (section*.2) 2170 0 R (section*.20) 2436 0 R (section*.21) 2449 0 R (section*.22) 2450 0 R (section*.23) 2451 0 R (section*.24) 2452 0 R (section*.25) 2453 0 R (section*.26) 2459 0 R (section*.27) 2460 0 R (section*.28) 2461 0 R (section*.29) 2466 0 R (section*.3) 2177 0 R (section*.30) 2467 0 R (section*.31) 2468 0 R (section*.32) 2470 0 R (section*.33) 2471 0 R (section*.34) 2472 0 R (section*.35) 2478 0 R (section*.36) 2479 0 R (section*.37) 2480 0 R (section*.38) 2482 0 R (section*.39) 2483 0 R (section*.4) 2185 0 R (section*.40) 2484 0 R (section*.41) 2489 0 R (section*.42) 2490 0 R (section*.43) 2491 0 R (section*.44) 2497 0 R (section*.45) 2498 0 R (section*.46) 2499 0 R (section*.47) 2500 0 R (section*.48) 2505 0 R (section*.49) 2506 0 R (section*.5) 2210 0 R (section*.50) 2507 0 R (section*.51) 2508 0 R (section*.52) 2509 0 R (section*.53) 2511 0 R (section*.54) 2512 0 R (section*.55) 2517 0 R (section*.56) 2518 0 R (section*.57) 2523 0 R (section*.58) 2524 0 R (section*.59) 2530 0 R (section*.6) 2222 0 R (section*.60) 2531 0 R (section*.61) 2532 0 R (section*.62) 2533 0 R (section*.63) 2534 0 R (section*.64) 2535 0 R (section*.65) 2544 0 R (section*.66) 2549 0 R (section*.67) 2550 0 R (section*.68) 2555 0 R (section*.69) 2556 0 R (section*.7) 2236 0 R (section*.70) 2558 0 R (section*.71) 2559 0 R (section*.72) 2560 0 R (section*.73) 2561 0 R (section*.74) 2566 0 R (section*.75) 2567 0 R (section*.76) 2568 0 R (section*.77) 2569 0 R (section*.78) 2570 0 R (section*.79) 2571 0 R (section*.8) 2274 0 R (section*.80) 2577 0 R (section*.81) 2578 0 R (section*.82) 2583 0 R (section*.83) 2584 0 R (section*.84) 2586 0 R (section*.85) 2587 0 R (section*.86) 2588 0 R (section*.87) 2589 0 R (section*.88) 2606 0 R (section*.89) 2607 0 R (section*.9) 2292 0 R (section*.90) 2608 0 R (section*.91) 2615 0 R (section*.92) 2616 0 R (section*.93) 2617 0 R (section*.94) 2618 0 R (section*.95) 2619 0 R (section*.96) 2624 0 R (section*.97) 2626 0 R (section*.98) 2627 0 R (section*.99) 2628 0 R (section.1.1) 10 0 R (section.1.2) 14 0 R (section.1.3) 18 0 R (section.1.4) 22 0 R (section.2.1) 70 0 R (section.2.2) 74 0 R (section.2.3) 78 0 R (section.2.4) 82 0 R (section.2.5) 86 0 R (section.3.1) 94 0 R (section.3.2) 106 0 R (section.3.3) 110 0 R (section.4.1) 134 0 R (section.4.10) 274 0 R (section.4.11) 286 0 R (section.4.12) 338 0 R (section.4.2) 138 0 R (section.4.3) 146 0 R (section.4.4) 150 0 R (section.4.5) 158 0 R (section.4.6) 194 0 R (section.4.7) 198 0 R (section.4.8) 202 0 R (section.4.9) 218 0 R (section.5.1) 354 0 R (section.5.2) 358 0 R (section.6.1) 366 0 R (section.6.2) 394 0 R (section.6.3) 618 0 R (section.6.4) 674 0 R (section.7.1) 710 0 R (section.7.2) 714 0 R (section.7.3) 726 0 R (section.8.1) 734 0 R (section.8.2) 742 0 R (section.8.3) 746 0 R (section.A.1) 754 0 R (section.A.2) 762 0 R (section.A.3) 770 0 R (section.A.4) 786 0 R (section.B.1) 846 0 R (section.B.10) 882 0 R (section.B.11) 886 0 R (section.B.12) 890 0 R (section.B.13) 894 0 R (section.B.14) 898 0 R (section.B.15) 902 0 R (section.B.16) 906 0 R (section.B.17) 910 0 R (section.B.18) 914 0 R (section.B.19) 918 0 R (section.B.2) 850 0 R (section.B.20) 922 0 R (section.B.21) 926 0 R (section.B.22) 930 0 R (section.B.23) 934 0 R (section.B.24) 938 0 R (section.B.3) 854 0 R (section.B.4) 858 0 R (section.B.5) 862 0 R (section.B.6) 866 0 R (section.B.7) 870 0 R (section.B.8) 874 0 R (section.B.9) 878 0 R (server_resource_limits) 1785 0 R (server_statement_definition_and_usage) 1721 0 R (server_statement_grammar) 1864 0 R (statistics) 2075 0 R (statistics_counters) 2084 0 R (statschannels) 1871 0 R (statsfile) 1689 0 R (subsection.1.4.1) 26 0 R (subsection.1.4.2) 30 0 R (subsection.1.4.3) 34 0 R (subsection.1.4.4) 38 0 R (subsection.1.4.5) 54 0 R (subsection.1.4.6) 62 0 R (subsection.3.1.1) 98 0 R (subsection.3.1.2) 102 0 R (subsection.3.3.1) 114 0 R (subsection.3.3.2) 126 0 R (subsection.4.10.1) 278 0 R (subsection.4.10.2) 282 0 R (subsection.4.11.1) 290 0 R (subsection.4.11.2) 306 0 R (subsection.4.11.3) 322 0 R (subsection.4.11.4) 326 0 R (subsection.4.11.5) 330 0 R (subsection.4.11.6) 334 0 R (subsection.4.12.1) 342 0 R (subsection.4.12.2) 346 0 R (subsection.4.2.1) 142 0 R (subsection.4.4.1) 154 0 R (subsection.4.5.1) 162 0 R (subsection.4.5.2) 174 0 R (subsection.4.5.3) 178 0 R (subsection.4.5.4) 182 0 R (subsection.4.5.5) 186 0 R (subsection.4.5.6) 190 0 R (subsection.4.8.1) 206 0 R (subsection.4.8.2) 210 0 R (subsection.4.8.3) 214 0 R (subsection.4.9.1) 222 0 R (subsection.4.9.10) 258 0 R (subsection.4.9.11) 262 0 R (subsection.4.9.12) 266 0 R (subsection.4.9.13) 270 0 R (subsection.4.9.2) 226 0 R (subsection.4.9.3) 230 0 R (subsection.4.9.4) 234 0 R (subsection.4.9.5) 238 0 R (subsection.4.9.6) 242 0 R (subsection.4.9.7) 246 0 R (subsection.4.9.8) 250 0 R (subsection.4.9.9) 254 0 R (subsection.6.1.1) 370 0 R (subsection.6.1.2) 382 0 R (subsection.6.2.1) 398 0 R (subsection.6.2.10) 434 0 R (subsection.6.2.11) 450 0 R (subsection.6.2.12) 454 0 R (subsection.6.2.13) 458 0 R (subsection.6.2.14) 462 0 R (subsection.6.2.15) 466 0 R (subsection.6.2.16) 470 0 R (subsection.6.2.17) 554 0 R (subsection.6.2.18) 558 0 R (subsection.6.2.19) 562 0 R (subsection.6.2.2) 402 0 R (subsection.6.2.20) 566 0 R (subsection.6.2.21) 570 0 R (subsection.6.2.22) 574 0 R (subsection.6.2.23) 578 0 R (subsection.6.2.24) 582 0 R (subsection.6.2.25) 586 0 R (subsection.6.2.26) 590 0 R (subsection.6.2.27) 594 0 R (subsection.6.2.28) 598 0 R (subsection.6.2.3) 406 0 R (subsection.6.2.4) 410 0 R (subsection.6.2.5) 414 0 R (subsection.6.2.6) 418 0 R (subsection.6.2.7) 422 0 R (subsection.6.2.8) 426 0 R (subsection.6.2.9) 430 0 R (subsection.6.3.1) 622 0 R (subsection.6.3.2) 634 0 R (subsection.6.3.3) 638 0 R (subsection.6.3.4) 642 0 R (subsection.6.3.5) 646 0 R (subsection.6.3.6) 666 0 R (subsection.6.3.7) 670 0 R (subsection.6.4.1) 682 0 R (subsection.7.2.1) 718 0 R (subsection.7.2.2) 722 0 R (subsection.8.1.1) 738 0 R (subsection.A.1.1) 758 0 R (subsection.A.2.1) 766 0 R (subsection.A.3.1) 774 0 R (subsection.A.3.2) 778 0 R (subsection.A.3.3) 782 0 R (subsection.A.4.1) 790 0 R (subsection.A.4.2) 794 0 R (subsection.A.4.3) 798 0 R (subsection.A.4.4) 802 0 R (subsection.A.4.5) 806 0 R (subsection.A.4.6) 810 0 R (subsection.A.4.7) 838 0 R (subsubsection.1.4.4.1) 42 0 R (subsubsection.1.4.4.2) 46 0 R (subsubsection.1.4.4.3) 50 0 R (subsubsection.1.4.5.1) 58 0 R (subsubsection.3.3.1.1) 118 0 R (subsubsection.3.3.1.2) 122 0 R (subsubsection.4.11.1.1) 294 0 R (subsubsection.4.11.1.2) 298 0 R (subsubsection.4.11.1.3) 302 0 R (subsubsection.4.11.2.1) 310 0 R (subsubsection.4.11.2.2) 314 0 R (subsubsection.4.11.2.3) 318 0 R (subsubsection.4.5.1.1) 166 0 R (subsubsection.4.5.1.2) 170 0 R (subsubsection.6.1.1.1) 374 0 R (subsubsection.6.1.1.2) 378 0 R (subsubsection.6.1.2.1) 386 0 R (subsubsection.6.1.2.2) 390 0 R (subsubsection.6.2.10.1) 438 0 R (subsubsection.6.2.10.2) 442 0 R (subsubsection.6.2.10.3) 446 0 R (subsubsection.6.2.16.1) 474 0 R (subsubsection.6.2.16.10) 510 0 R (subsubsection.6.2.16.11) 514 0 R (subsubsection.6.2.16.12) 518 0 R (subsubsection.6.2.16.13) 522 0 R (subsubsection.6.2.16.14) 526 0 R (subsubsection.6.2.16.15) 530 0 R (subsubsection.6.2.16.16) 534 0 R (subsubsection.6.2.16.17) 538 0 R (subsubsection.6.2.16.18) 542 0 R (subsubsection.6.2.16.19) 546 0 R (subsubsection.6.2.16.2) 478 0 R (subsubsection.6.2.16.20) 550 0 R (subsubsection.6.2.16.3) 482 0 R (subsubsection.6.2.16.4) 486 0 R (subsubsection.6.2.16.5) 490 0 R (subsubsection.6.2.16.6) 494 0 R (subsubsection.6.2.16.7) 498 0 R (subsubsection.6.2.16.8) 502 0 R (subsubsection.6.2.16.9) 506 0 R (subsubsection.6.2.28.1) 602 0 R (subsubsection.6.2.28.2) 606 0 R (subsubsection.6.2.28.3) 610 0 R (subsubsection.6.2.28.4) 614 0 R (subsubsection.6.3.1.1) 626 0 R (subsubsection.6.3.1.2) 630 0 R (subsubsection.6.3.5.1) 650 0 R (subsubsection.6.3.5.2) 654 0 R (subsubsection.6.3.5.3) 658 0 R (subsubsection.6.3.5.4) 662 0 R (subsubsection.6.4.0.1) 678 0 R (subsubsection.6.4.1.1) 686 0 R (subsubsection.6.4.1.2) 690 0 R (subsubsection.6.4.1.3) 694 0 R (subsubsection.6.4.1.4) 698 0 R (subsubsection.6.4.1.5) 702 0 R (subsubsection.A.4.6.1) 814 0 R (subsubsection.A.4.6.2) 818 0 R (subsubsection.A.4.6.3) 822 0 R (subsubsection.A.4.6.4) 826 0 R (subsubsection.A.4.6.5) 830 0 R (subsubsection.A.4.6.6) 834 0 R (table.1.1) 1250 0 R (table.1.2) 1258 0 R (table.3.1) 1317 0 R (table.3.2) 1367 0 R (table.6.1) 1565 0 R (table.6.10) 2015 0 R (table.6.11) 2021 0 R (table.6.12) 2027 0 R (table.6.13) 2035 0 R (table.6.14) 2037 0 R (table.6.15) 2044 0 R (table.6.16) 2047 0 R (table.6.17) 2050 0 R (table.6.18) 2066 0 R (table.6.19) 2077 0 R (table.6.2) 1587 0 R (table.6.20) 2087 0 R (table.6.21) 2095 0 R (table.6.22) 2098 0 R (table.6.23) 2106 0 R (table.6.3) 1596 0 R (table.6.4) 1634 0 R (table.6.5) 1646 0 R (table.6.6) 1707 0 R (table.6.7) 1806 0 R (table.6.8) 1915 0 R (table.6.9) 2001 0 R (the_category_phrase) 1628 0 R (the_sortlist_statement) 1797 0 R (topology) 1792 0 R (trusted-keys) 1882 0 R (tsig) 1415 0 R (tuning) 1811 0 R (types_of_resource_records_and_when_to_use_them) 1265 0 R (view_statement_grammar) 1827 0 R (zone_statement_grammar) 1746 0 R (zone_transfers) 1389 0 R (zonefile_format) 1819 0 R] /Limits [(Access_Control_Lists) (zonefile_format)] >> endobj -2764 0 obj << -/Kids [2763 0 R] +2834 0 obj << +/Kids [2833 0 R] >> endobj -2765 0 obj << -/Dests 2764 0 R +2835 0 obj << +/Dests 2834 0 R >> endobj -2766 0 obj << +2836 0 obj << /Type /Catalog -/Pages 2761 0 R -/Outlines 2762 0 R -/Names 2765 0 R +/Pages 2831 0 R +/Outlines 2832 0 R +/Names 2835 0 R /PageMode /UseOutlines -/OpenAction 929 0 R +/OpenAction 941 0 R >> endobj -2767 0 obj << +2837 0 obj << /Author()/Title()/Subject()/Creator(LaTeX with hyperref package)/Producer(pdfeTeX-1.21a)/Keywords() -/CreationDate (D:20130516011107Z) +/CreationDate (D:20130516011446Z) /PTEX.Fullbanner (This is pdfeTeX, Version 3.141592-1.21a-2.2 (Web2C 7.5.4) kpathsea version 3.5.4) >> endobj xref -0 2768 +0 2838 0000000001 65535 f 0000000002 00000 f 0000000003 00000 f 0000000004 00000 f 0000000000 00000 f 0000000009 00000 n -0000348651 00000 n -0001188206 00000 n +0000349585 00000 n +0001223461 00000 n 0000000054 00000 n 0000000086 00000 n -0000348778 00000 n -0001188134 00000 n +0000349712 00000 n +0001223389 00000 n 0000000133 00000 n 0000000173 00000 n -0000348906 00000 n -0001188048 00000 n +0000349840 00000 n +0001223303 00000 n 0000000221 00000 n 0000000273 00000 n -0000349034 00000 n -0001187962 00000 n +0000349968 00000 n +0001223217 00000 n 0000000321 00000 n 0000000377 00000 n -0000353320 00000 n -0001187852 00000 n +0000354254 00000 n +0001223107 00000 n 0000000425 00000 n 0000000478 00000 n -0000353447 00000 n -0001187778 00000 n +0000354381 00000 n +0001223033 00000 n 0000000531 00000 n 0000000572 00000 n -0000353575 00000 n -0001187691 00000 n +0000354509 00000 n +0001222946 00000 n 0000000625 00000 n 0000000674 00000 n -0000353702 00000 n -0001187604 00000 n +0000354636 00000 n +0001222859 00000 n 0000000727 00000 n 0000000757 00000 n -0000357999 00000 n -0001187480 00000 n +0000358933 00000 n +0001222735 00000 n 0000000810 00000 n 0000000861 00000 n -0000358127 00000 n -0001187406 00000 n +0000359061 00000 n +0001222661 00000 n 0000000919 00000 n 0000000964 00000 n -0000358255 00000 n -0001187319 00000 n +0000359189 00000 n +0001222574 00000 n 0000001022 00000 n 0000001062 00000 n -0000358383 00000 n -0001187245 00000 n +0000359317 00000 n +0001222500 00000 n 0000001120 00000 n 0000001162 00000 n -0000361368 00000 n -0001187121 00000 n +0000362302 00000 n +0001222376 00000 n 0000001215 00000 n 0000001260 00000 n -0000361496 00000 n -0001187060 00000 n +0000362430 00000 n +0001222315 00000 n 0000001318 00000 n 0000001355 00000 n -0000361624 00000 n -0001186986 00000 n +0000362558 00000 n +0001222241 00000 n 0000001408 00000 n 0000001463 00000 n -0000364571 00000 n -0001186861 00000 n +0000365505 00000 n +0001222116 00000 n 0000001509 00000 n 0000001556 00000 n -0000364699 00000 n -0001186787 00000 n +0000365633 00000 n +0001222042 00000 n 0000001604 00000 n 0000001648 00000 n -0000364827 00000 n -0001186700 00000 n +0000365761 00000 n +0001221955 00000 n 0000001696 00000 n 0000001735 00000 n -0000364955 00000 n -0001186613 00000 n +0000365889 00000 n +0001221868 00000 n 0000001783 00000 n 0000001825 00000 n -0000365082 00000 n -0001186526 00000 n +0000366016 00000 n +0001221781 00000 n 0000001873 00000 n 0000001936 00000 n -0000366159 00000 n -0001186452 00000 n +0000367093 00000 n +0001221707 00000 n 0000001984 00000 n 0000002034 00000 n -0000367818 00000 n -0001186324 00000 n +0000368752 00000 n +0001221579 00000 n 0000002080 00000 n 0000002126 00000 n -0000367945 00000 n -0001186211 00000 n +0000368879 00000 n +0001221466 00000 n 0000002174 00000 n 0000002218 00000 n -0000368073 00000 n -0001186135 00000 n +0000369007 00000 n +0001221390 00000 n 0000002271 00000 n 0000002323 00000 n -0000368201 00000 n -0001186058 00000 n +0000369135 00000 n +0001221313 00000 n 0000002377 00000 n 0000002436 00000 n -0000370650 00000 n -0001185967 00000 n +0000371584 00000 n +0001221222 00000 n 0000002485 00000 n 0000002523 00000 n -0000373988 00000 n -0001185850 00000 n +0000374922 00000 n +0001221105 00000 n 0000002572 00000 n 0000002618 00000 n -0000374116 00000 n -0001185732 00000 n +0000375050 00000 n +0001220987 00000 n 0000002672 00000 n 0000002739 00000 n -0000374244 00000 n -0001185653 00000 n +0000375178 00000 n +0001220908 00000 n 0000002798 00000 n 0000002842 00000 n -0000374373 00000 n -0001185574 00000 n +0000375307 00000 n +0001220829 00000 n 0000002901 00000 n 0000002949 00000 n -0000389238 00000 n -0001185495 00000 n +0000393344 00000 n +0001220750 00000 n 0000003003 00000 n 0000003036 00000 n -0000394862 00000 n -0001185362 00000 n +0000398572 00000 n +0001220617 00000 n 0000003083 00000 n 0000003126 00000 n -0000394991 00000 n -0001185283 00000 n +0000398701 00000 n +0001220538 00000 n 0000003175 00000 n 0000003205 00000 n -0000395120 00000 n -0001185151 00000 n +0000398830 00000 n +0001220406 00000 n 0000003254 00000 n 0000003292 00000 n -0000399492 00000 n -0001185086 00000 n +0000403339 00000 n +0001220341 00000 n 0000003346 00000 n 0000003388 00000 n -0000399621 00000 n -0001184993 00000 n +0000403468 00000 n +0001220248 00000 n 0000003437 00000 n 0000003496 00000 n -0000399750 00000 n -0001184861 00000 n +0000403597 00000 n +0001220116 00000 n 0000003545 00000 n 0000003578 00000 n -0000403470 00000 n -0001184796 00000 n +0000407515 00000 n +0001220051 00000 n 0000003632 00000 n 0000003681 00000 n -0000406624 00000 n -0001184664 00000 n +0000410529 00000 n +0001219919 00000 n 0000003730 00000 n 0000003758 00000 n -0000409569 00000 n -0001184546 00000 n +0000413309 00000 n +0001219801 00000 n 0000003812 00000 n 0000003881 00000 n -0000409698 00000 n -0001184467 00000 n +0000413438 00000 n +0001219722 00000 n 0000003940 00000 n 0000003988 00000 n -0000409827 00000 n -0001184388 00000 n +0000413566 00000 n +0001219643 00000 n 0000004047 00000 n 0000004092 00000 n -0000409956 00000 n -0001184295 00000 n +0000413695 00000 n +0001219550 00000 n 0000004146 00000 n 0000004214 00000 n -0000410085 00000 n -0001184202 00000 n +0000413824 00000 n +0001219457 00000 n 0000004268 00000 n 0000004338 00000 n -0000413548 00000 n -0001184109 00000 n +0000417493 00000 n +0001219364 00000 n 0000004392 00000 n 0000004455 00000 n -0000413677 00000 n -0001184016 00000 n +0000417622 00000 n +0001219271 00000 n 0000004509 00000 n 0000004564 00000 n -0000413806 00000 n -0001183937 00000 n +0000417750 00000 n +0001219192 00000 n 0000004618 00000 n 0000004650 00000 n -0000413935 00000 n -0001183844 00000 n +0000417878 00000 n +0001219099 00000 n 0000004699 00000 n 0000004727 00000 n -0000417795 00000 n -0001183751 00000 n +0000421647 00000 n +0001219006 00000 n 0000004776 00000 n 0000004808 00000 n -0000417924 00000 n -0001183619 00000 n +0000421776 00000 n +0001218874 00000 n 0000004857 00000 n 0000004887 00000 n -0000418052 00000 n -0001183540 00000 n +0000421905 00000 n +0001218795 00000 n 0000004941 00000 n 0000004982 00000 n -0000421955 00000 n -0001183447 00000 n +0000425703 00000 n +0001218702 00000 n 0000005036 00000 n 0000005078 00000 n -0000422083 00000 n -0001183368 00000 n +0000425832 00000 n +0001218623 00000 n 0000005132 00000 n 0000005177 00000 n -0000427223 00000 n -0001183235 00000 n +0000431155 00000 n +0001218490 00000 n 0000005226 00000 n 0000005294 00000 n -0000427352 00000 n -0001183156 00000 n +0000431284 00000 n +0001218411 00000 n 0000005348 00000 n 0000005408 00000 n -0000431157 00000 n -0001183063 00000 n +0000431413 00000 n +0001218318 00000 n 0000005462 00000 n 0000005513 00000 n -0000431286 00000 n -0001182970 00000 n +0000435680 00000 n +0001218225 00000 n 0000005567 00000 n 0000005621 00000 n -0000431415 00000 n -0001182877 00000 n +0000438662 00000 n +0001218132 00000 n 0000005675 00000 n 0000005721 00000 n -0000434533 00000 n -0001182784 00000 n +0000438791 00000 n +0001218039 00000 n 0000005775 00000 n 0000005817 00000 n -0000434662 00000 n -0001182691 00000 n +0000438920 00000 n +0001217946 00000 n 0000005871 00000 n 0000005922 00000 n -0000434791 00000 n -0001182598 00000 n +0000439049 00000 n +0001217853 00000 n 0000005976 00000 n 0000006025 00000 n -0000437889 00000 n -0001182505 00000 n +0000441808 00000 n +0001217760 00000 n 0000006079 00000 n 0000006136 00000 n -0000438018 00000 n -0001182412 00000 n +0000441937 00000 n +0001217667 00000 n 0000006190 00000 n 0000006245 00000 n -0000438146 00000 n -0001182319 00000 n +0000442066 00000 n +0001217574 00000 n 0000006300 00000 n 0000006356 00000 n -0000438275 00000 n -0001182226 00000 n +0000442194 00000 n +0001217481 00000 n 0000006411 00000 n 0000006472 00000 n -0000438403 00000 n -0001182133 00000 n +0000442322 00000 n +0001217388 00000 n 0000006527 00000 n 0000006573 00000 n -0000438531 00000 n -0001182054 00000 n +0000442451 00000 n +0001217309 00000 n 0000006628 00000 n 0000006671 00000 n -0000438660 00000 n -0001181922 00000 n +0000446315 00000 n +0001217177 00000 n 0000006721 00000 n 0000006777 00000 n -0000438789 00000 n -0001181843 00000 n +0000446444 00000 n +0001217098 00000 n 0000006832 00000 n 0000006878 00000 n -0000442381 00000 n -0001181764 00000 n +0000446573 00000 n +0001217019 00000 n 0000006933 00000 n 0000006980 00000 n -0000442510 00000 n -0001181632 00000 n +0000449975 00000 n +0001216887 00000 n 0000007030 00000 n 0000007087 00000 n -0000445669 00000 n -0001181514 00000 n +0000450104 00000 n +0001216769 00000 n 0000007142 00000 n 0000007182 00000 n -0000448364 00000 n -0001181435 00000 n +0000452772 00000 n +0001216690 00000 n 0000007242 00000 n 0000007315 00000 n -0000448493 00000 n -0001181342 00000 n +0000452901 00000 n +0001216597 00000 n 0000007375 00000 n 0000007448 00000 n -0000451274 00000 n -0001181263 00000 n +0000455618 00000 n +0001216518 00000 n 0000007508 00000 n 0000007565 00000 n -0000451403 00000 n -0001181131 00000 n +0000458010 00000 n +0001216386 00000 n 0000007620 00000 n 0000007678 00000 n -0000451532 00000 n -0001181052 00000 n +0000458139 00000 n +0001216307 00000 n 0000007738 00000 n 0000007815 00000 n -0000454026 00000 n -0001180959 00000 n +0000458268 00000 n +0001216214 00000 n 0000007875 00000 n 0000007952 00000 n -0000454155 00000 n -0001180880 00000 n +0000458397 00000 n +0001216135 00000 n 0000008012 00000 n 0000008071 00000 n -0000454284 00000 n -0001180787 00000 n +0000458526 00000 n +0001216042 00000 n 0000008126 00000 n 0000008170 00000 n -0000454413 00000 n -0001180694 00000 n +0000461158 00000 n +0001215949 00000 n 0000008225 00000 n 0000008265 00000 n -0000460733 00000 n -0001180601 00000 n +0000463967 00000 n +0001215856 00000 n 0000008320 00000 n 0000008388 00000 n -0000460862 00000 n -0001180522 00000 n +0000464096 00000 n +0001215777 00000 n 0000008443 00000 n 0000008514 00000 n -0000463653 00000 n -0001180404 00000 n +0000468157 00000 n +0001215659 00000 n 0000008564 00000 n 0000008611 00000 n -0000463782 00000 n -0001180325 00000 n +0000468286 00000 n +0001215580 00000 n 0000008666 00000 n 0000008727 00000 n -0000463911 00000 n -0001180246 00000 n +0000468415 00000 n +0001215501 00000 n 0000008782 00000 n 0000008852 00000 n -0000466353 00000 n -0001180113 00000 n +0000470900 00000 n +0001215368 00000 n 0000008899 00000 n 0000008952 00000 n -0000466482 00000 n -0001180034 00000 n +0000471029 00000 n +0001215289 00000 n 0000009001 00000 n 0000009057 00000 n -0000466611 00000 n -0001179955 00000 n +0000471158 00000 n +0001215210 00000 n 0000009106 00000 n 0000009155 00000 n -0000470881 00000 n -0001179822 00000 n +0000475428 00000 n +0001215077 00000 n 0000009202 00000 n 0000009254 00000 n -0000471010 00000 n -0001179704 00000 n +0000475557 00000 n +0001214959 00000 n 0000009303 00000 n 0000009354 00000 n -0000479434 00000 n -0001179586 00000 n +0000483981 00000 n +0001214841 00000 n 0000009408 00000 n 0000009453 00000 n -0000479563 00000 n -0001179507 00000 n +0000484110 00000 n +0001214762 00000 n 0000009512 00000 n 0000009546 00000 n -0000479692 00000 n -0001179428 00000 n +0000484239 00000 n +0001214683 00000 n 0000009605 00000 n 0000009653 00000 n -0000479821 00000 n -0001179310 00000 n +0000484368 00000 n +0001214565 00000 n 0000009707 00000 n 0000009747 00000 n -0000482354 00000 n -0001179231 00000 n +0000486901 00000 n +0001214486 00000 n 0000009806 00000 n 0000009840 00000 n -0000482483 00000 n -0001179152 00000 n +0000487030 00000 n +0001214407 00000 n 0000009899 00000 n 0000009947 00000 n -0000482612 00000 n -0001179019 00000 n +0000487159 00000 n +0001214274 00000 n 0000009996 00000 n 0000010046 00000 n -0000485817 00000 n -0001178940 00000 n +0000490400 00000 n +0001214195 00000 n 0000010100 00000 n 0000010147 00000 n -0000485945 00000 n -0001178847 00000 n +0000490528 00000 n +0001214102 00000 n 0000010201 00000 n 0000010261 00000 n -0000491302 00000 n -0001178754 00000 n +0000495885 00000 n +0001214009 00000 n 0000010315 00000 n 0000010367 00000 n -0000491431 00000 n -0001178661 00000 n +0000496014 00000 n +0001213916 00000 n 0000010421 00000 n 0000010486 00000 n -0000494901 00000 n -0001178568 00000 n +0000499484 00000 n +0001213823 00000 n 0000010540 00000 n 0000010591 00000 n -0000495030 00000 n -0001178475 00000 n +0000499613 00000 n +0001213730 00000 n 0000010645 00000 n 0000010709 00000 n -0000495159 00000 n -0001178382 00000 n +0000499742 00000 n +0001213637 00000 n 0000010763 00000 n 0000010810 00000 n -0000495288 00000 n -0001178289 00000 n +0000499871 00000 n +0001213544 00000 n 0000010864 00000 n 0000010924 00000 n -0000495416 00000 n -0001178196 00000 n +0000499999 00000 n +0001213451 00000 n 0000010978 00000 n 0000011029 00000 n -0000499115 00000 n -0001178064 00000 n +0000503698 00000 n +0001213319 00000 n 0000011084 00000 n 0000011149 00000 n -0000499244 00000 n -0001177985 00000 n +0000503827 00000 n +0001213240 00000 n 0000011209 00000 n 0000011256 00000 n -0000506045 00000 n -0001177892 00000 n +0000510628 00000 n +0001213147 00000 n 0000011316 00000 n 0000011364 00000 n -0000512785 00000 n -0001177813 00000 n +0000517534 00000 n +0001213068 00000 n 0000011424 00000 n 0000011478 00000 n -0000516012 00000 n -0001177720 00000 n +0000520761 00000 n +0001212975 00000 n 0000011533 00000 n 0000011583 00000 n -0000518850 00000 n -0001177627 00000 n +0000523661 00000 n +0001212882 00000 n 0000011638 00000 n 0000011701 00000 n -0000518979 00000 n -0001177534 00000 n +0000523790 00000 n +0001212789 00000 n 0000011756 00000 n 0000011808 00000 n -0000519108 00000 n -0001177441 00000 n +0000523919 00000 n +0001212696 00000 n 0000011863 00000 n 0000011928 00000 n -0000519237 00000 n -0001177348 00000 n +0000524048 00000 n +0001212603 00000 n 0000011983 00000 n 0000012035 00000 n -0000526974 00000 n -0001177215 00000 n +0000531546 00000 n +0001212470 00000 n 0000012090 00000 n 0000012155 00000 n -0000543721 00000 n -0001177136 00000 n +0000552718 00000 n +0001212391 00000 n 0000012215 00000 n 0000012259 00000 n -0000569340 00000 n -0001177043 00000 n +0000574745 00000 n +0001212298 00000 n 0000012319 00000 n 0000012358 00000 n -0000569469 00000 n -0001176950 00000 n +0000578746 00000 n +0001212205 00000 n 0000012418 00000 n 0000012465 00000 n -0000569598 00000 n -0001176857 00000 n +0000578875 00000 n +0001212112 00000 n 0000012525 00000 n 0000012568 00000 n -0000577092 00000 n -0001176764 00000 n +0000586524 00000 n +0001212019 00000 n 0000012628 00000 n 0000012667 00000 n -0000580658 00000 n -0001176671 00000 n +0000586652 00000 n +0001211926 00000 n 0000012727 00000 n 0000012769 00000 n -0000583787 00000 n -0001176578 00000 n +0000593683 00000 n +0001211833 00000 n 0000012829 00000 n 0000012872 00000 n -0000591012 00000 n -0001176485 00000 n +0000601678 00000 n +0001211740 00000 n 0000012932 00000 n 0000012975 00000 n -0000595490 00000 n -0001176392 00000 n +0000601807 00000 n +0001211647 00000 n 0000013035 00000 n 0000013096 00000 n -0000595619 00000 n -0001176299 00000 n +0000605914 00000 n +0001211554 00000 n 0000013157 00000 n 0000013209 00000 n -0000599456 00000 n -0001176206 00000 n +0000609162 00000 n +0001211461 00000 n 0000013270 00000 n 0000013323 00000 n -0000603805 00000 n -0001176113 00000 n +0000609291 00000 n +0001211368 00000 n 0000013384 00000 n 0000013422 00000 n -0000603934 00000 n -0001176020 00000 n +0000613144 00000 n +0001211275 00000 n 0000013483 00000 n 0000013535 00000 n -0000606805 00000 n -0001175927 00000 n +0000616554 00000 n +0001211182 00000 n 0000013596 00000 n 0000013640 00000 n -0000610188 00000 n -0001175834 00000 n +0000620724 00000 n +0001211089 00000 n 0000013701 00000 n 0000013737 00000 n -0000619248 00000 n -0001175741 00000 n +0000629377 00000 n +0001210996 00000 n 0000013798 00000 n 0000013861 00000 n -0000621682 00000 n -0001175648 00000 n +0000629506 00000 n +0001210903 00000 n 0000013922 00000 n 0000013972 00000 n -0000629226 00000 n -0001175555 00000 n +0000639857 00000 n +0001210810 00000 n 0000014033 00000 n 0000014089 00000 n -0000633711 00000 n -0001175462 00000 n +0000639985 00000 n +0001210717 00000 n 0000014150 00000 n 0000014197 00000 n -0000638026 00000 n -0001175383 00000 n +0000644156 00000 n +0001210638 00000 n 0000014258 00000 n 0000014326 00000 n -0000644384 00000 n -0001175290 00000 n +0000654835 00000 n +0001210545 00000 n 0000014381 00000 n 0000014432 00000 n -0000649443 00000 n -0001175197 00000 n +0000654964 00000 n +0001210452 00000 n 0000014487 00000 n 0000014551 00000 n -0000653172 00000 n -0001175104 00000 n +0000659651 00000 n +0001210359 00000 n 0000014606 00000 n 0000014670 00000 n -0000653301 00000 n -0001175011 00000 n +0000665169 00000 n +0001210266 00000 n 0000014725 00000 n 0000014802 00000 n -0000653430 00000 n -0001174918 00000 n +0000665298 00000 n +0001210173 00000 n 0000014857 00000 n 0000014914 00000 n -0000653559 00000 n -0001174825 00000 n +0000665427 00000 n +0001210080 00000 n 0000014969 00000 n 0000015039 00000 n -0000657599 00000 n -0001174732 00000 n +0000669607 00000 n +0001209987 00000 n 0000015094 00000 n 0000015151 00000 n -0000657728 00000 n -0001174639 00000 n +0000669736 00000 n +0001209894 00000 n 0000015206 00000 n 0000015276 00000 n -0000662082 00000 n -0001174546 00000 n +0000673670 00000 n +0001209801 00000 n 0000015331 00000 n 0000015380 00000 n -0000662211 00000 n -0001174453 00000 n +0000673799 00000 n +0001209708 00000 n 0000015435 00000 n 0000015497 00000 n -0000663928 00000 n -0001174360 00000 n +0000675472 00000 n +0001209615 00000 n 0000015552 00000 n 0000015601 00000 n -0000669438 00000 n -0001174242 00000 n +0000680187 00000 n +0001209497 00000 n 0000015656 00000 n 0000015718 00000 n -0000669567 00000 n -0001174163 00000 n +0000680316 00000 n +0001209418 00000 n 0000015778 00000 n 0000015817 00000 n -0000678489 00000 n -0001174070 00000 n +0000690574 00000 n +0001209325 00000 n 0000015877 00000 n 0000015911 00000 n -0000678618 00000 n -0001173977 00000 n +0000690702 00000 n +0001209232 00000 n 0000015971 00000 n 0000016012 00000 n -0000699552 00000 n -0001173898 00000 n +0000712487 00000 n +0001209153 00000 n 0000016072 00000 n 0000016124 00000 n -0000709763 00000 n -0001173766 00000 n +0000723009 00000 n +0001209021 00000 n 0000016173 00000 n 0000016206 00000 n -0000709892 00000 n -0001173648 00000 n +0000723138 00000 n +0001208903 00000 n 0000016260 00000 n 0000016332 00000 n -0000710021 00000 n -0001173569 00000 n +0000723267 00000 n +0001208824 00000 n 0000016391 00000 n 0000016435 00000 n -0000717446 00000 n -0001173490 00000 n +0000733869 00000 n +0001208745 00000 n 0000016494 00000 n 0000016547 00000 n -0000721226 00000 n -0001173397 00000 n +0000734258 00000 n +0001208652 00000 n 0000016601 00000 n 0000016651 00000 n -0000721484 00000 n -0001173304 00000 n +0000738100 00000 n +0001208559 00000 n 0000016705 00000 n 0000016743 00000 n -0000724939 00000 n -0001173211 00000 n +0000738359 00000 n +0001208466 00000 n 0000016797 00000 n 0000016846 00000 n -0000725197 00000 n -0001173079 00000 n +0000741133 00000 n +0001208334 00000 n 0000016900 00000 n 0000016952 00000 n -0000725325 00000 n -0001173000 00000 n +0000741258 00000 n +0001208255 00000 n 0000017011 00000 n 0000017056 00000 n -0000725454 00000 n -0001172907 00000 n +0000741387 00000 n +0001208162 00000 n 0000017115 00000 n 0000017167 00000 n -0000728083 00000 n -0001172814 00000 n +0000741516 00000 n +0001208069 00000 n 0000017226 00000 n 0000017279 00000 n -0000728212 00000 n -0001172735 00000 n +0000743959 00000 n +0001207990 00000 n 0000017338 00000 n 0000017387 00000 n -0000728341 00000 n -0001172642 00000 n +0000744088 00000 n +0001207897 00000 n 0000017441 00000 n 0000017521 00000 n -0000735453 00000 n -0001172563 00000 n +0000748410 00000 n +0001207818 00000 n 0000017575 00000 n 0000017624 00000 n -0000735582 00000 n -0001172445 00000 n +0000751916 00000 n +0001207700 00000 n 0000017673 00000 n 0000017713 00000 n -0000739025 00000 n -0001172366 00000 n +0000752175 00000 n +0001207621 00000 n 0000017772 00000 n 0000017819 00000 n -0000739154 00000 n -0001172248 00000 n +0000755604 00000 n +0001207503 00000 n 0000017873 00000 n 0000017918 00000 n -0000739283 00000 n -0001172169 00000 n +0000755733 00000 n +0001207424 00000 n 0000017977 00000 n 0000018036 00000 n -0000743058 00000 n -0001172076 00000 n +0000759096 00000 n +0001207331 00000 n 0000018095 00000 n 0000018159 00000 n -0000746825 00000 n -0001171983 00000 n +0000759355 00000 n +0001207238 00000 n 0000018218 00000 n 0000018274 00000 n -0000749876 00000 n -0001171890 00000 n +0000763456 00000 n +0001207145 00000 n 0000018333 00000 n 0000018391 00000 n -0000750135 00000 n -0001171811 00000 n +0000765628 00000 n +0001207066 00000 n 0000018450 00000 n 0000018512 00000 n -0000752303 00000 n -0001171678 00000 n +0000767413 00000 n +0001206933 00000 n 0000018559 00000 n 0000018611 00000 n -0000752431 00000 n -0001171599 00000 n +0000767541 00000 n +0001206854 00000 n 0000018660 00000 n 0000018704 00000 n -0000756231 00000 n -0001171467 00000 n +0000771340 00000 n +0001206722 00000 n 0000018753 00000 n 0000018794 00000 n -0000756360 00000 n -0001171388 00000 n +0000771469 00000 n +0001206643 00000 n 0000018848 00000 n 0000018896 00000 n -0000756489 00000 n -0001171309 00000 n +0000771598 00000 n +0001206564 00000 n 0000018950 00000 n 0000019001 00000 n -0000756617 00000 n -0001171230 00000 n +0000771726 00000 n +0001206485 00000 n 0000019050 00000 n 0000019097 00000 n -0000760876 00000 n -0001171097 00000 n +0000775986 00000 n +0001206352 00000 n 0000019144 00000 n 0000019181 00000 n -0000761005 00000 n -0001170979 00000 n +0000776115 00000 n +0001206234 00000 n 0000019230 00000 n 0000019269 00000 n -0000761134 00000 n -0001170914 00000 n +0000776244 00000 n +0001206169 00000 n 0000019323 00000 n 0000019401 00000 n -0000761263 00000 n -0001170821 00000 n +0000776373 00000 n +0001206076 00000 n 0000019450 00000 n 0000019517 00000 n -0000761392 00000 n -0001170742 00000 n +0000776502 00000 n +0001205997 00000 n 0000019566 00000 n 0000019611 00000 n -0000764833 00000 n -0001170609 00000 n +0000779943 00000 n +0001205864 00000 n 0000019659 00000 n 0000019691 00000 n -0000764962 00000 n -0001170491 00000 n +0000780072 00000 n +0001205746 00000 n 0000019740 00000 n 0000019779 00000 n -0000765091 00000 n -0001170426 00000 n +0000780201 00000 n +0001205681 00000 n 0000019833 00000 n 0000019894 00000 n -0000768774 00000 n -0001170294 00000 n +0000783883 00000 n +0001205549 00000 n 0000019943 00000 n 0000020000 00000 n -0000768903 00000 n -0001170229 00000 n +0000784012 00000 n +0001205484 00000 n 0000020054 00000 n 0000020103 00000 n -0000769032 00000 n -0001170097 00000 n +0000784141 00000 n +0001205352 00000 n 0000020152 00000 n 0000020214 00000 n -0000769161 00000 n -0001170018 00000 n +0000784270 00000 n +0001205273 00000 n 0000020268 00000 n 0000020323 00000 n -0000794003 00000 n -0001169925 00000 n +0000809112 00000 n +0001205180 00000 n 0000020377 00000 n 0000020418 00000 n -0000794132 00000 n -0001169846 00000 n +0000809241 00000 n +0001205101 00000 n 0000020472 00000 n 0000020524 00000 n -0000794521 00000 n -0001169728 00000 n +0000809630 00000 n +0001204983 00000 n 0000020573 00000 n 0000020623 00000 n -0000797343 00000 n -0001169649 00000 n +0000812451 00000 n +0001204904 00000 n 0000020677 00000 n 0000020715 00000 n -0000797472 00000 n -0001169556 00000 n +0000812580 00000 n +0001204811 00000 n 0000020769 00000 n 0000020806 00000 n -0000797601 00000 n -0001169463 00000 n +0000812709 00000 n +0001204718 00000 n 0000020860 00000 n 0000020898 00000 n -0000797730 00000 n -0001169370 00000 n +0000812838 00000 n +0001204625 00000 n 0000020952 00000 n 0000021004 00000 n -0000800966 00000 n -0001169277 00000 n +0000816074 00000 n +0001204532 00000 n 0000021058 00000 n 0000021101 00000 n -0000801094 00000 n -0001169145 00000 n +0000816202 00000 n +0001204400 00000 n 0000021155 00000 n 0000021200 00000 n -0000801222 00000 n -0001169066 00000 n +0000816330 00000 n +0001204321 00000 n 0000021259 00000 n 0000021325 00000 n -0000804208 00000 n -0001168973 00000 n +0000819316 00000 n +0001204228 00000 n 0000021384 00000 n 0000021472 00000 n -0000804337 00000 n -0001168880 00000 n +0000819445 00000 n +0001204135 00000 n 0000021531 00000 n 0000021606 00000 n -0000804466 00000 n -0001168787 00000 n +0000819574 00000 n +0001204042 00000 n 0000021665 00000 n 0000021750 00000 n -0000807374 00000 n -0001168694 00000 n +0000822482 00000 n +0001203949 00000 n 0000021809 00000 n 0000021890 00000 n -0000809835 00000 n -0001168615 00000 n +0000824943 00000 n +0001203870 00000 n 0000021949 00000 n 0000022033 00000 n -0000809964 00000 n -0001168536 00000 n +0000825072 00000 n +0001203791 00000 n 0000022087 00000 n 0000022131 00000 n -0000812864 00000 n -0001168416 00000 n +0000827972 00000 n +0001203671 00000 n 0000022179 00000 n 0000022213 00000 n -0000812993 00000 n -0001168337 00000 n +0000828101 00000 n +0001203592 00000 n 0000022262 00000 n 0000022289 00000 n -0000831153 00000 n -0001168244 00000 n +0000850488 00000 n +0001203499 00000 n 0000022338 00000 n 0000022366 00000 n -0000838711 00000 n -0001168151 00000 n +0000854121 00000 n +0001203406 00000 n 0000022415 00000 n -0000022455 00000 n -0000844995 00000 n -0001168058 00000 n -0000022504 00000 n -0000022547 00000 n -0000851530 00000 n -0001167965 00000 n -0000022596 00000 n -0000022633 00000 n -0000864820 00000 n -0001167872 00000 n -0000022682 00000 n -0000022719 00000 n -0000867695 00000 n -0001167779 00000 n -0000022768 00000 n -0000022806 00000 n -0000874480 00000 n -0001167686 00000 n -0000022855 00000 n +0000022453 00000 n +0000857325 00000 n +0001203313 00000 n +0000022502 00000 n +0000022541 00000 n +0000863728 00000 n +0001203220 00000 n +0000022590 00000 n +0000022630 00000 n +0000866453 00000 n +0001203127 00000 n +0000022679 00000 n +0000022722 00000 n +0000876590 00000 n +0001203034 00000 n +0000022771 00000 n +0000022808 00000 n +0000890239 00000 n +0001202941 00000 n +0000022857 00000 n 0000022894 00000 n -0000887974 00000 n -0001167593 00000 n +0000893620 00000 n +0001202848 00000 n 0000022943 00000 n -0000022982 00000 n -0000890955 00000 n -0001167500 00000 n -0000023032 00000 n -0000023072 00000 n -0000900381 00000 n -0001167407 00000 n -0000023122 00000 n -0000023152 00000 n -0000909494 00000 n -0001167314 00000 n -0000023202 00000 n -0000023245 00000 n -0000913381 00000 n -0001167221 00000 n -0000023295 00000 n -0000023328 00000 n -0000927209 00000 n -0001167128 00000 n -0000023378 00000 n -0000023407 00000 n -0000930342 00000 n -0001167035 00000 n -0000023457 00000 n -0000023491 00000 n -0000936585 00000 n -0001166942 00000 n -0000023541 00000 n -0000023578 00000 n -0000943343 00000 n -0001166849 00000 n -0000023628 00000 n -0000023665 00000 n -0000946092 00000 n -0001166756 00000 n -0000023715 00000 n -0000023748 00000 n -0000948156 00000 n -0001166663 00000 n -0000023798 00000 n -0000023832 00000 n -0000948673 00000 n -0001166570 00000 n -0000023882 00000 n -0000023921 00000 n -0000951550 00000 n -0001166491 00000 n -0000023971 00000 n -0000024005 00000 n -0000024378 00000 n -0000024500 00000 n -0000289301 00000 n -0000024058 00000 n -0000289175 00000 n -0000289238 00000 n -0001160695 00000 n -0001134610 00000 n -0001160521 00000 n -0001161733 00000 n -0000025809 00000 n -0000026002 00000 n -0000026082 00000 n -0000026119 00000 n -0000026200 00000 n -0000026324 00000 n -0000026583 00000 n -0000026942 00000 n -0000026974 00000 n -0000027068 00000 n -0000028101 00000 n -0000039237 00000 n -0000104827 00000 n -0000170417 00000 n -0000236007 00000 n -0000290741 00000 n -0000290556 00000 n -0000289401 00000 n -0000290678 00000 n -0001133374 00000 n -0001106755 00000 n -0001133200 00000 n -0001106070 00000 n -0001103926 00000 n -0001105906 00000 n -0000302483 00000 n -0000293792 00000 n -0000290826 00000 n -0000302357 00000 n -0000302420 00000 n -0000294346 00000 n -0000294500 00000 n -0000294657 00000 n -0000294814 00000 n -0000294971 00000 n -0000295128 00000 n -0000295290 00000 n -0000295452 00000 n -0000295613 00000 n -0000295775 00000 n -0000295942 00000 n -0000296109 00000 n -0000296274 00000 n -0000296436 00000 n -0000296602 00000 n -0000296764 00000 n -0000296918 00000 n -0000297075 00000 n -0000297232 00000 n -0000297388 00000 n -0000297544 00000 n -0000297701 00000 n -0000297856 00000 n -0000298013 00000 n -0000298175 00000 n -0000298337 00000 n -0000298494 00000 n -0000298649 00000 n -0000298810 00000 n -0000298977 00000 n -0000299144 00000 n -0000299306 00000 n -0000299462 00000 n -0000299620 00000 n -0000299778 00000 n -0000299941 00000 n -0000300099 00000 n -0000300257 00000 n -0000300419 00000 n -0000300577 00000 n -0000300740 00000 n -0000300908 00000 n -0000301076 00000 n -0000301239 00000 n -0000301402 00000 n -0000301565 00000 n -0000301727 00000 n -0000301890 00000 n -0000302046 00000 n -0000302202 00000 n -0000315989 00000 n -0000305921 00000 n -0000302568 00000 n -0000315924 00000 n -0001103338 00000 n -0001085917 00000 n -0001103152 00000 n -0000306571 00000 n -0000306735 00000 n -0000306898 00000 n -0000307062 00000 n -0000307221 00000 n -0000307385 00000 n -0000307549 00000 n -0000307713 00000 n -0000307877 00000 n -0000308041 00000 n -0000308205 00000 n -0000308369 00000 n -0000308533 00000 n -0000308697 00000 n -0000308862 00000 n -0000309027 00000 n -0000309192 00000 n -0000309357 00000 n -0000309517 00000 n -0000309682 00000 n -0000309846 00000 n -0000310006 00000 n -0000310171 00000 n -0000310341 00000 n -0000310511 00000 n -0000310681 00000 n -0000310845 00000 n -0000311014 00000 n -0000311184 00000 n -0000311354 00000 n -0000311518 00000 n -0000311683 00000 n -0000311848 00000 n -0000312013 00000 n -0000312173 00000 n -0000312338 00000 n -0000312503 00000 n -0000312660 00000 n -0000312819 00000 n -0000312978 00000 n -0000313134 00000 n -0000313293 00000 n -0000313457 00000 n -0000313626 00000 n -0000313795 00000 n -0000313959 00000 n -0000314128 00000 n -0000314297 00000 n -0000314456 00000 n -0000314620 00000 n -0000314784 00000 n -0000314948 00000 n -0000315112 00000 n -0000315275 00000 n -0000315439 00000 n -0000315601 00000 n -0000315762 00000 n -0000330149 00000 n -0000319601 00000 n -0000316089 00000 n -0000330084 00000 n -0000320269 00000 n -0000320433 00000 n -0000320602 00000 n -0000320771 00000 n -0000320939 00000 n -0000321103 00000 n -0000321267 00000 n -0000321431 00000 n -0000321595 00000 n -0000321759 00000 n -0000321922 00000 n -0000322091 00000 n -0000322260 00000 n -0000322428 00000 n -0000322597 00000 n -0000322766 00000 n -0000322935 00000 n -0000323104 00000 n -0000323273 00000 n -0000323441 00000 n -0000323611 00000 n -0000323781 00000 n -0000323951 00000 n -0000324121 00000 n -0000324291 00000 n -0000324461 00000 n -0000324631 00000 n -0000324801 00000 n -0000324970 00000 n -0000325140 00000 n -0000325309 00000 n -0000325473 00000 n -0000325637 00000 n -0000325801 00000 n -0000325965 00000 n -0000326129 00000 n -0000326292 00000 n -0000326456 00000 n -0000326620 00000 n -0000326783 00000 n -0000326947 00000 n -0000327111 00000 n -0000327275 00000 n -0000327444 00000 n -0000327613 00000 n -0000327781 00000 n -0000327950 00000 n -0000328108 00000 n -0000328270 00000 n -0000328438 00000 n -0000328605 00000 n -0000328768 00000 n -0000328931 00000 n -0000329094 00000 n -0000329257 00000 n -0000329425 00000 n -0000329592 00000 n -0000329758 00000 n -0000329923 00000 n -0000343329 00000 n -0000333754 00000 n -0000330249 00000 n -0000343264 00000 n -0000334386 00000 n -0000334549 00000 n -0000334707 00000 n -0000334875 00000 n -0000335038 00000 n -0000335206 00000 n -0000335374 00000 n -0000335541 00000 n -0001085026 00000 n -0001063691 00000 n -0001084850 00000 n -0000335708 00000 n -0000335875 00000 n -0000336031 00000 n -0000336189 00000 n -0000336347 00000 n -0000336510 00000 n -0000336673 00000 n -0000336831 00000 n -0000336987 00000 n -0000337145 00000 n -0000337308 00000 n -0000337466 00000 n -0000337623 00000 n -0000337780 00000 n -0000337938 00000 n -0000338101 00000 n -0000338259 00000 n -0000338422 00000 n -0000338580 00000 n -0000338743 00000 n -0000338906 00000 n -0000339069 00000 n -0000339227 00000 n -0000339390 00000 n -0000339553 00000 n -0000339716 00000 n -0000339879 00000 n -0000340042 00000 n -0000340205 00000 n -0000340373 00000 n -0000340541 00000 n -0000340708 00000 n -0000340875 00000 n -0000341043 00000 n -0000341211 00000 n -0000341374 00000 n -0000341530 00000 n -0000341688 00000 n -0000341846 00000 n -0000342004 00000 n -0000342162 00000 n -0000342320 00000 n -0000342478 00000 n -0000342636 00000 n -0000342794 00000 n -0000342950 00000 n -0000343107 00000 n -0000346169 00000 n -0000344288 00000 n -0000343443 00000 n -0000346104 00000 n -0000344516 00000 n -0000344675 00000 n -0000344834 00000 n -0001062712 00000 n -0001042585 00000 n -0001062537 00000 n -0000344992 00000 n -0000345151 00000 n -0000345310 00000 n -0000345469 00000 n -0000345628 00000 n -0000345787 00000 n -0000345945 00000 n -0001161854 00000 n -0000349292 00000 n -0000348525 00000 n -0000346270 00000 n -0000348713 00000 n -0000348841 00000 n -0000348969 00000 n -0000349097 00000 n -0000349162 00000 n -0000349227 00000 n -0001041768 00000 n -0001023303 00000 n -0001041593 00000 n -0000353829 00000 n -0000352688 00000 n -0000349420 00000 n -0000353190 00000 n -0000353255 00000 n -0000353382 00000 n -0000353510 00000 n -0000353638 00000 n -0000352844 00000 n -0000353038 00000 n -0000353764 00000 n -0000709956 00000 n -0000769225 00000 n -0000358511 00000 n -0000357453 00000 n -0000353957 00000 n -0000357934 00000 n -0000358062 00000 n -0000357609 00000 n -0000357772 00000 n -0000358190 00000 n -0000358318 00000 n -0000358446 00000 n -0000374308 00000 n -0000361752 00000 n -0000361177 00000 n -0000358639 00000 n -0000361303 00000 n -0000361431 00000 n -0000361559 00000 n -0000361687 00000 n -0000365210 00000 n -0000364044 00000 n -0000361866 00000 n -0000364506 00000 n -0000364634 00000 n -0000364762 00000 n -0000364890 00000 n -0000365018 00000 n -0000364200 00000 n -0000364353 00000 n -0000365145 00000 n -0000629290 00000 n -0000366287 00000 n -0000365968 00000 n -0000365296 00000 n -0000366094 00000 n -0000366222 00000 n -0001161979 00000 n -0000368330 00000 n -0000367627 00000 n -0000366387 00000 n -0000367753 00000 n -0000367881 00000 n -0000368008 00000 n -0000368136 00000 n -0000368265 00000 n -0000370909 00000 n -0000370279 00000 n -0000368430 00000 n -0000370585 00000 n -0000370714 00000 n -0000370779 00000 n -0000370844 00000 n -0000370426 00000 n -0000606869 00000 n -0000374502 00000 n -0000373797 00000 n -0000371023 00000 n -0000373923 00000 n -0000374052 00000 n -0000374179 00000 n -0001022620 00000 n -0001010558 00000 n -0001022441 00000 n -0000374437 00000 n -0000379109 00000 n -0000378219 00000 n -0000374630 00000 n -0000379044 00000 n -0001009985 00000 n -0000999051 00000 n -0001009806 00000 n -0000378393 00000 n -0000378548 00000 n -0000378718 00000 n -0000378873 00000 n -0000527038 00000 n -0000699616 00000 n -0000382474 00000 n -0000382283 00000 n -0000379278 00000 n -0000382409 00000 n -0000387252 00000 n -0000386854 00000 n -0000382616 00000 n -0000387187 00000 n -0000387001 00000 n -0001162104 00000 n -0000491494 00000 n -0000389495 00000 n -0000389047 00000 n -0000387408 00000 n -0000389173 00000 n -0000389301 00000 n -0000389366 00000 n -0000389431 00000 n -0000389964 00000 n -0000389773 00000 n -0000389623 00000 n -0000389899 00000 n -0000392659 00000 n -0000395249 00000 n -0000392494 00000 n -0000390006 00000 n -0000394797 00000 n -0000394926 00000 n -0000395055 00000 n -0000394302 00000 n -0000394464 00000 n -0000998145 00000 n -0000988125 00000 n -0000997971 00000 n -0000987561 00000 n -0000978474 00000 n -0000987386 00000 n -0000395184 00000 n -0000394626 00000 n -0000394131 00000 n -0000394189 00000 n -0000394279 00000 n -0000543785 00000 n -0000583851 00000 n -0000399879 00000 n -0000398943 00000 n -0000395420 00000 n -0000399427 00000 n -0000399556 00000 n -0000399685 00000 n -0000399099 00000 n -0000399265 00000 n -0000399814 00000 n -0000773256 00000 n -0000403599 00000 n -0000403279 00000 n -0000400035 00000 n -0000403405 00000 n -0000403534 00000 n -0000405175 00000 n -0000404795 00000 n -0000403740 00000 n -0000405110 00000 n -0000404942 00000 n -0001162229 00000 n -0000406752 00000 n -0000406433 00000 n -0000405276 00000 n -0000406559 00000 n -0000406688 00000 n -0000410214 00000 n -0000409378 00000 n -0000406866 00000 n -0000409504 00000 n -0000409633 00000 n -0000409762 00000 n -0000409891 00000 n -0000410020 00000 n -0000410149 00000 n -0000414063 00000 n -0000413166 00000 n -0000410356 00000 n -0000413483 00000 n -0000413612 00000 n -0000413741 00000 n -0000413313 00000 n -0000413870 00000 n -0000413999 00000 n -0000418181 00000 n -0000417604 00000 n -0000414204 00000 n -0000417730 00000 n -0000417859 00000 n -0000417987 00000 n -0000418116 00000 n -0000422212 00000 n -0000421764 00000 n -0000418323 00000 n -0000421890 00000 n -0000422019 00000 n -0000422147 00000 n -0000424212 00000 n -0000424021 00000 n -0000422340 00000 n -0000424147 00000 n -0001162354 00000 n -0000427481 00000 n -0000427032 00000 n -0000424313 00000 n -0000427158 00000 n -0000978199 00000 n -0000974840 00000 n -0000978020 00000 n -0000427287 00000 n -0000427416 00000 n -0000431544 00000 n -0000430607 00000 n -0000427652 00000 n -0000431092 00000 n -0000431221 00000 n -0000431350 00000 n -0000974485 00000 n -0000972488 00000 n -0000974320 00000 n -0000430763 00000 n -0000430928 00000 n -0000431479 00000 n -0000851594 00000 n -0000867759 00000 n -0000434919 00000 n -0000434342 00000 n -0000431672 00000 n -0000434468 00000 n -0000434597 00000 n -0000434726 00000 n -0000434855 00000 n -0000438917 00000 n -0000437521 00000 n -0000435033 00000 n -0000437824 00000 n -0000437953 00000 n -0000438081 00000 n -0000438210 00000 n -0000438339 00000 n -0000438466 00000 n -0000438595 00000 n -0000438724 00000 n -0000438853 00000 n -0000437668 00000 n -0000657791 00000 n -0000442639 00000 n -0000442190 00000 n -0000439045 00000 n -0000442316 00000 n -0000442445 00000 n -0000442574 00000 n -0000445798 00000 n -0000445478 00000 n -0000442753 00000 n -0000445604 00000 n -0000445733 00000 n -0001162479 00000 n -0000448621 00000 n -0000448173 00000 n -0000445968 00000 n -0000448299 00000 n -0000448428 00000 n -0000448556 00000 n -0000451659 00000 n -0000451083 00000 n -0000448778 00000 n -0000451209 00000 n -0000451338 00000 n -0000451467 00000 n -0000451596 00000 n -0000454541 00000 n -0000453835 00000 n -0000451773 00000 n -0000453961 00000 n -0000454090 00000 n -0000454219 00000 n -0000454348 00000 n -0000454477 00000 n -0000457235 00000 n -0000457044 00000 n -0000454655 00000 n -0000457170 00000 n -0000459742 00000 n -0000460990 00000 n -0000459616 00000 n -0000457349 00000 n -0000460668 00000 n -0000460797 00000 n -0000460925 00000 n -0000464040 00000 n -0000463281 00000 n -0000461161 00000 n -0000463588 00000 n -0000463717 00000 n -0000463428 00000 n -0000463846 00000 n -0000463975 00000 n -0001162604 00000 n -0000768967 00000 n -0000466740 00000 n -0000466162 00000 n -0000464168 00000 n -0000466288 00000 n -0000466417 00000 n -0000466546 00000 n -0000466675 00000 n -0000467181 00000 n -0000466990 00000 n -0000466840 00000 n -0000467116 00000 n -0000471268 00000 n -0000470502 00000 n -0000467223 00000 n -0000470816 00000 n -0000470945 00000 n -0000471073 00000 n -0000471138 00000 n -0000471203 00000 n -0000470649 00000 n -0000479498 00000 n -0000475963 00000 n -0000475772 00000 n -0000471368 00000 n -0000475898 00000 n -0000479950 00000 n -0000479243 00000 n -0000476105 00000 n -0000479369 00000 n -0000479627 00000 n -0000479756 00000 n -0000479885 00000 n -0000482869 00000 n -0000482163 00000 n -0000480091 00000 n -0000482289 00000 n -0000482418 00000 n -0000482547 00000 n -0000482676 00000 n -0000482741 00000 n -0000482805 00000 n -0001162729 00000 n -0000486202 00000 n -0000485626 00000 n -0000483026 00000 n -0000485752 00000 n -0000485880 00000 n -0000486009 00000 n -0000486073 00000 n -0000486137 00000 n -0000491559 00000 n -0000490771 00000 n -0000486316 00000 n -0000491237 00000 n -0000491366 00000 n -0000490927 00000 n -0000491078 00000 n -0000953467 00000 n -0000495545 00000 n -0000494145 00000 n -0000491700 00000 n -0000494836 00000 n -0000494965 00000 n -0000495094 00000 n -0000495223 00000 n -0000495352 00000 n -0000494310 00000 n -0000494462 00000 n -0000494649 00000 n -0000495480 00000 n -0000499373 00000 n -0000498924 00000 n -0000495673 00000 n -0000499050 00000 n -0000499179 00000 n -0000499308 00000 n -0000503601 00000 n -0000503222 00000 n -0000499501 00000 n -0000503536 00000 n -0000503369 00000 n -0000506109 00000 n -0000506302 00000 n -0000505854 00000 n -0000503715 00000 n -0000505980 00000 n -0000506174 00000 n -0000506238 00000 n -0001162854 00000 n -0000509440 00000 n -0000509249 00000 n -0000506416 00000 n -0000509375 00000 n -0000513040 00000 n -0000512594 00000 n -0000509554 00000 n -0000512720 00000 n -0000512847 00000 n -0000512912 00000 n -0000512976 00000 n -0000516141 00000 n -0000515821 00000 n -0000513154 00000 n -0000515947 00000 n -0000516076 00000 n -0000519366 00000 n -0000518325 00000 n -0000516255 00000 n -0000518785 00000 n -0000518914 00000 n -0000518481 00000 n -0000518634 00000 n -0000519043 00000 n -0000519172 00000 n -0000519301 00000 n -0000520863 00000 n -0000520672 00000 n -0000519480 00000 n -0000520798 00000 n -0000522420 00000 n -0000522229 00000 n -0000520964 00000 n -0000522355 00000 n -0001162979 00000 n -0000523887 00000 n -0000523696 00000 n -0000522521 00000 n -0000523822 00000 n -0000527103 00000 n -0000526783 00000 n -0000523988 00000 n -0000526909 00000 n -0000531230 00000 n -0000531039 00000 n -0000527231 00000 n -0000531165 00000 n -0000535702 00000 n -0000535154 00000 n -0000531372 00000 n -0000535637 00000 n -0000535310 00000 n -0000535467 00000 n -0000739089 00000 n -0000539952 00000 n -0000539553 00000 n -0000535830 00000 n -0000539887 00000 n -0000539700 00000 n -0000543850 00000 n -0000543530 00000 n -0000540094 00000 n -0000543656 00000 n -0001163104 00000 n -0000547691 00000 n -0000547371 00000 n -0000543978 00000 n -0000547497 00000 n -0000547562 00000 n -0000547626 00000 n -0000552917 00000 n -0000551623 00000 n -0000547819 00000 n -0000552852 00000 n -0000551815 00000 n -0000551969 00000 n -0000552126 00000 n -0000552311 00000 n -0000552485 00000 n -0000552669 00000 n -0000649507 00000 n -0000557284 00000 n -0000557093 00000 n -0000553088 00000 n -0000557219 00000 n -0000561443 00000 n -0000561252 00000 n -0000557425 00000 n +0000022981 00000 n +0000900145 00000 n +0001202755 00000 n +0000023031 00000 n +0000023071 00000 n +0000917722 00000 n +0001202662 00000 n +0000023121 00000 n +0000023159 00000 n +0000920624 00000 n +0001202569 00000 n +0000023209 00000 n +0000023249 00000 n +0000923539 00000 n +0001202476 00000 n +0000023299 00000 n +0000023339 00000 n +0000930509 00000 n +0001202383 00000 n +0000023389 00000 n +0000023419 00000 n +0000940141 00000 n +0001202290 00000 n +0000023469 00000 n +0000023512 00000 n +0000943226 00000 n +0001202197 00000 n +0000023562 00000 n +0000023595 00000 n +0000957608 00000 n +0001202104 00000 n +0000023645 00000 n +0000023674 00000 n +0000961270 00000 n +0001202011 00000 n +0000023724 00000 n +0000023758 00000 n +0000970689 00000 n +0001201918 00000 n +0000023808 00000 n +0000023845 00000 n +0000973901 00000 n +0001201825 00000 n +0000023895 00000 n +0000023932 00000 n +0000977464 00000 n +0001201732 00000 n +0000023982 00000 n +0000024015 00000 n +0000979620 00000 n +0001201639 00000 n +0000024065 00000 n +0000024099 00000 n +0000982335 00000 n +0001201546 00000 n +0000024149 00000 n +0000024188 00000 n +0000982852 00000 n +0001201467 00000 n +0000024238 00000 n +0000024272 00000 n +0000024645 00000 n +0000024767 00000 n +0000289568 00000 n +0000024325 00000 n +0000289442 00000 n +0000289505 00000 n +0001195528 00000 n +0001169386 00000 n +0001195354 00000 n +0001196574 00000 n +0000026076 00000 n +0000026269 00000 n +0000026349 00000 n +0000026386 00000 n +0000026467 00000 n +0000026591 00000 n +0000026850 00000 n +0000027209 00000 n +0000027241 00000 n +0000027335 00000 n +0000028368 00000 n +0000039504 00000 n +0000105094 00000 n +0000170684 00000 n +0000236274 00000 n +0000291008 00000 n +0000290823 00000 n +0000289668 00000 n +0000290945 00000 n +0001168150 00000 n +0001141531 00000 n +0001167976 00000 n +0001140846 00000 n +0001138701 00000 n +0001140682 00000 n +0000302775 00000 n +0000294059 00000 n +0000291093 00000 n +0000302649 00000 n +0000302712 00000 n +0000294625 00000 n +0000294779 00000 n +0000294936 00000 n +0000295093 00000 n +0000295250 00000 n +0000295407 00000 n +0000295569 00000 n +0000295731 00000 n +0000295892 00000 n +0000296054 00000 n +0000296221 00000 n +0000296388 00000 n +0000296553 00000 n +0000296715 00000 n +0000296881 00000 n +0000297043 00000 n +0000297197 00000 n +0000297354 00000 n +0000297511 00000 n +0000297668 00000 n +0000297825 00000 n +0000297983 00000 n +0000298139 00000 n +0000298297 00000 n +0000298460 00000 n +0000298623 00000 n +0000298781 00000 n +0000298937 00000 n +0000299099 00000 n +0000299267 00000 n +0000299435 00000 n +0000299598 00000 n +0000299754 00000 n +0000299912 00000 n +0000300070 00000 n +0000300233 00000 n +0000300391 00000 n +0000300549 00000 n +0000300711 00000 n +0000300869 00000 n +0000301032 00000 n +0000301200 00000 n +0000301368 00000 n +0000301531 00000 n +0000301694 00000 n +0000301857 00000 n +0000302019 00000 n +0000302182 00000 n +0000302338 00000 n +0000302494 00000 n +0000316282 00000 n +0000306214 00000 n +0000302860 00000 n +0000316217 00000 n +0001138113 00000 n +0001120692 00000 n +0001137927 00000 n +0000306864 00000 n +0000307028 00000 n +0000307191 00000 n +0000307355 00000 n +0000307514 00000 n +0000307678 00000 n +0000307842 00000 n +0000308006 00000 n +0000308170 00000 n +0000308334 00000 n +0000308498 00000 n +0000308662 00000 n +0000308826 00000 n +0000308990 00000 n +0000309155 00000 n +0000309320 00000 n +0000309485 00000 n +0000309650 00000 n +0000309810 00000 n +0000309975 00000 n +0000310139 00000 n +0000310299 00000 n +0000310464 00000 n +0000310634 00000 n +0000310804 00000 n +0000310974 00000 n +0000311138 00000 n +0000311307 00000 n +0000311477 00000 n +0000311647 00000 n +0000311811 00000 n +0000311976 00000 n +0000312141 00000 n +0000312306 00000 n +0000312466 00000 n +0000312631 00000 n +0000312796 00000 n +0000312953 00000 n +0000313112 00000 n +0000313271 00000 n +0000313427 00000 n +0000313586 00000 n +0000313750 00000 n +0000313919 00000 n +0000314088 00000 n +0000314252 00000 n +0000314421 00000 n +0000314590 00000 n +0000314749 00000 n +0000314913 00000 n +0000315077 00000 n +0000315241 00000 n +0000315405 00000 n +0000315568 00000 n +0000315732 00000 n +0000315894 00000 n +0000316055 00000 n +0000330440 00000 n +0000319891 00000 n +0000316382 00000 n +0000330375 00000 n +0000320559 00000 n +0000320723 00000 n +0000320892 00000 n +0000321061 00000 n +0000321229 00000 n +0000321393 00000 n +0000321557 00000 n +0000321721 00000 n +0000321885 00000 n +0000322049 00000 n +0000322212 00000 n +0000322381 00000 n +0000322550 00000 n +0000322718 00000 n +0000322887 00000 n +0000323056 00000 n +0000323225 00000 n +0000323394 00000 n +0000323563 00000 n +0000323731 00000 n +0000323901 00000 n +0000324071 00000 n +0000324241 00000 n +0000324411 00000 n +0000324581 00000 n +0000324751 00000 n +0000324921 00000 n +0000325091 00000 n +0000325261 00000 n +0000325431 00000 n +0000325600 00000 n +0000325764 00000 n +0000325928 00000 n +0000326092 00000 n +0000326256 00000 n +0000326420 00000 n +0000326583 00000 n +0000326747 00000 n +0000326911 00000 n +0000327074 00000 n +0000327238 00000 n +0000327402 00000 n +0000327566 00000 n +0000327735 00000 n +0000327904 00000 n +0000328072 00000 n +0000328241 00000 n +0000328399 00000 n +0000328561 00000 n +0000328729 00000 n +0000328896 00000 n +0000329059 00000 n +0000329222 00000 n +0000329385 00000 n +0000329548 00000 n +0000329716 00000 n +0000329884 00000 n +0000330050 00000 n +0000330215 00000 n +0000343626 00000 n +0000334053 00000 n +0000330540 00000 n +0000343561 00000 n +0000334685 00000 n +0000334848 00000 n +0000335006 00000 n +0000335174 00000 n +0000335337 00000 n +0000335505 00000 n +0000335673 00000 n +0000335841 00000 n +0001119801 00000 n +0001098467 00000 n +0001119625 00000 n +0000336007 00000 n +0000336174 00000 n +0000336330 00000 n +0000336487 00000 n +0000336645 00000 n +0000336808 00000 n +0000336971 00000 n +0000337129 00000 n +0000337285 00000 n +0000337443 00000 n +0000337606 00000 n +0000337764 00000 n +0000337922 00000 n +0000338079 00000 n +0000338237 00000 n +0000338400 00000 n +0000338557 00000 n +0000338719 00000 n +0000338877 00000 n +0000339040 00000 n +0000339203 00000 n +0000339366 00000 n +0000339524 00000 n +0000339687 00000 n +0000339850 00000 n +0000340013 00000 n +0000340176 00000 n +0000340339 00000 n +0000340502 00000 n +0000340670 00000 n +0000340838 00000 n +0000341005 00000 n +0000341172 00000 n +0000341340 00000 n +0000341508 00000 n +0000341671 00000 n +0000341827 00000 n +0000341985 00000 n +0000342143 00000 n +0000342301 00000 n +0000342459 00000 n +0000342617 00000 n +0000342775 00000 n +0000342933 00000 n +0000343091 00000 n +0000343247 00000 n +0000343404 00000 n +0000347103 00000 n +0000344719 00000 n +0000343740 00000 n +0000347038 00000 n +0000344974 00000 n +0000345133 00000 n +0000345292 00000 n +0000345450 00000 n +0000345609 00000 n +0000345768 00000 n +0001097488 00000 n +0001077361 00000 n +0001097313 00000 n +0000345927 00000 n +0000346086 00000 n +0000346245 00000 n +0000346403 00000 n +0000346562 00000 n +0000346720 00000 n +0000346879 00000 n +0001196695 00000 n +0000350226 00000 n +0000349459 00000 n +0000347204 00000 n +0000349647 00000 n +0000349775 00000 n +0000349903 00000 n +0000350031 00000 n +0000350096 00000 n +0000350161 00000 n +0001076519 00000 n +0001057819 00000 n +0001076344 00000 n +0000354763 00000 n +0000353622 00000 n +0000350354 00000 n +0000354124 00000 n +0000354189 00000 n +0000354316 00000 n +0000354444 00000 n +0000354572 00000 n +0000353778 00000 n +0000353972 00000 n +0000354698 00000 n +0000723202 00000 n +0000784334 00000 n +0000359445 00000 n +0000358387 00000 n +0000354891 00000 n +0000358868 00000 n +0000358996 00000 n +0000358543 00000 n +0000358706 00000 n +0000359124 00000 n +0000359252 00000 n +0000359380 00000 n +0000375242 00000 n +0000362686 00000 n +0000362111 00000 n +0000359573 00000 n +0000362237 00000 n +0000362365 00000 n +0000362493 00000 n +0000362621 00000 n +0000366144 00000 n +0000364978 00000 n +0000362800 00000 n +0000365440 00000 n +0000365568 00000 n +0000365696 00000 n +0000365824 00000 n +0000365952 00000 n +0000365134 00000 n +0000365287 00000 n +0000366079 00000 n +0000639921 00000 n +0000367221 00000 n +0000366902 00000 n +0000366230 00000 n +0000367028 00000 n +0000367156 00000 n +0001196820 00000 n +0000369264 00000 n +0000368561 00000 n +0000367321 00000 n +0000368687 00000 n +0000368815 00000 n +0000368942 00000 n +0000369070 00000 n +0000369199 00000 n +0000371843 00000 n +0000371213 00000 n +0000369364 00000 n +0000371519 00000 n +0000371648 00000 n +0000371713 00000 n +0000371778 00000 n +0000371360 00000 n +0000616618 00000 n +0000375436 00000 n +0000374731 00000 n +0000371957 00000 n +0000374857 00000 n +0000374986 00000 n +0000375113 00000 n +0001057097 00000 n +0001043720 00000 n +0001056918 00000 n +0000375371 00000 n +0000380091 00000 n +0000379201 00000 n +0000375564 00000 n +0000380026 00000 n +0001043119 00000 n +0001030698 00000 n +0001042940 00000 n +0000379375 00000 n +0000379530 00000 n +0000379700 00000 n +0000379855 00000 n +0000531610 00000 n +0000712551 00000 n +0000383692 00000 n +0000383501 00000 n +0000380260 00000 n +0000383627 00000 n +0000387911 00000 n +0000387720 00000 n +0000383847 00000 n +0000387846 00000 n +0001030343 00000 n +0001028344 00000 n +0001030178 00000 n +0001196945 00000 n +0000392039 00000 n +0000391640 00000 n +0000388081 00000 n +0000391974 00000 n +0000391787 00000 n +0000496077 00000 n +0000393602 00000 n +0000393153 00000 n +0000392167 00000 n +0000393279 00000 n +0000393408 00000 n +0000393472 00000 n +0000393537 00000 n +0000396369 00000 n +0000398959 00000 n +0000396204 00000 n +0000393716 00000 n +0000398507 00000 n +0000398636 00000 n +0000398765 00000 n +0000398012 00000 n +0000398174 00000 n +0001027438 00000 n +0001017418 00000 n +0001027264 00000 n +0001016854 00000 n +0001007768 00000 n +0001016679 00000 n +0000398894 00000 n +0000398336 00000 n +0000397841 00000 n +0000397899 00000 n +0000397989 00000 n +0000552782 00000 n +0000593746 00000 n +0000403726 00000 n +0000402790 00000 n +0000399130 00000 n +0000403274 00000 n +0000403403 00000 n +0000403532 00000 n +0000402946 00000 n +0000403112 00000 n +0000403661 00000 n +0000788365 00000 n +0000407644 00000 n +0000407135 00000 n +0000403882 00000 n +0000407450 00000 n +0000407579 00000 n +0000407282 00000 n +0000408792 00000 n +0000408601 00000 n +0000407785 00000 n +0000408727 00000 n +0001197070 00000 n +0000410658 00000 n +0000410338 00000 n +0000408893 00000 n +0000410464 00000 n +0000410593 00000 n +0000413953 00000 n +0000413118 00000 n +0000410772 00000 n +0000413244 00000 n +0000413373 00000 n +0000413502 00000 n +0000413630 00000 n +0000413759 00000 n +0000413888 00000 n +0000418007 00000 n +0000417111 00000 n +0000414095 00000 n +0000417428 00000 n +0000417557 00000 n +0000417685 00000 n +0000417258 00000 n +0000417813 00000 n +0000417942 00000 n +0000422034 00000 n +0000421456 00000 n +0000418148 00000 n +0000421582 00000 n +0000421711 00000 n +0000421840 00000 n +0000421969 00000 n +0000425961 00000 n +0000425512 00000 n +0000422176 00000 n +0000425638 00000 n +0000425767 00000 n +0000425896 00000 n +0000428274 00000 n +0000428083 00000 n +0000426089 00000 n +0000428209 00000 n +0001197195 00000 n +0000431542 00000 n +0000430964 00000 n +0000428418 00000 n +0000431090 00000 n +0001007493 00000 n +0001004134 00000 n +0001007314 00000 n +0000431219 00000 n +0000431348 00000 n +0000431477 00000 n +0000435809 00000 n +0000435130 00000 n +0000431713 00000 n +0000435615 00000 n +0000435744 00000 n +0000435286 00000 n +0000435450 00000 n +0000876654 00000 n +0000893684 00000 n +0000439175 00000 n +0000438471 00000 n +0000435937 00000 n +0000438597 00000 n +0000438726 00000 n +0000438855 00000 n +0000438984 00000 n +0000439111 00000 n +0000442580 00000 n +0000441617 00000 n +0000439289 00000 n +0000441743 00000 n +0000441872 00000 n +0000442001 00000 n +0000442129 00000 n +0000442258 00000 n +0000442386 00000 n +0000442515 00000 n +0000446702 00000 n +0000445943 00000 n +0000442708 00000 n +0000446250 00000 n +0000446379 00000 n +0000446508 00000 n +0000446090 00000 n +0000446637 00000 n +0000669800 00000 n +0000450233 00000 n +0000449784 00000 n +0000446816 00000 n +0000449910 00000 n +0000450039 00000 n +0000450168 00000 n +0001197320 00000 n +0000453029 00000 n +0000452581 00000 n +0000450403 00000 n +0000452707 00000 n +0000452836 00000 n +0000452964 00000 n +0000455747 00000 n +0000455427 00000 n +0000453186 00000 n +0000455553 00000 n +0000455682 00000 n +0000458655 00000 n +0000457819 00000 n +0000455861 00000 n +0000457945 00000 n +0000458074 00000 n +0000458203 00000 n +0000458332 00000 n +0000458461 00000 n +0000458590 00000 n +0000461287 00000 n +0000460967 00000 n +0000458769 00000 n +0000461093 00000 n +0000461222 00000 n +0000467005 00000 n +0000464225 00000 n +0000463776 00000 n +0000461401 00000 n +0000463902 00000 n +0000464031 00000 n +0000464160 00000 n +0000468544 00000 n +0000466858 00000 n +0000464353 00000 n +0000468092 00000 n +0000468221 00000 n +0000467931 00000 n +0000468350 00000 n +0000468479 00000 n +0001197445 00000 n +0000784076 00000 n +0000471287 00000 n +0000470709 00000 n +0000468715 00000 n +0000470835 00000 n +0000470964 00000 n +0000471093 00000 n +0000471222 00000 n +0000471728 00000 n +0000471537 00000 n +0000471387 00000 n +0000471663 00000 n +0000475815 00000 n +0000475049 00000 n +0000471770 00000 n +0000475363 00000 n +0000475492 00000 n +0000475620 00000 n +0000475685 00000 n +0000475750 00000 n +0000475196 00000 n +0000484045 00000 n +0000480510 00000 n +0000480319 00000 n +0000475915 00000 n +0000480445 00000 n +0000484497 00000 n +0000483790 00000 n +0000480652 00000 n +0000483916 00000 n +0000484174 00000 n +0000484303 00000 n +0000484432 00000 n +0000487416 00000 n +0000486710 00000 n +0000484638 00000 n +0000486836 00000 n +0000486965 00000 n +0000487094 00000 n +0000487223 00000 n +0000487288 00000 n +0000487352 00000 n +0001197570 00000 n +0000490785 00000 n +0000490209 00000 n +0000487573 00000 n +0000490335 00000 n +0000490463 00000 n +0000490592 00000 n +0000490656 00000 n +0000490720 00000 n +0000496142 00000 n +0000495354 00000 n +0000490899 00000 n +0000495820 00000 n +0000495949 00000 n +0000495510 00000 n +0000495661 00000 n +0000985113 00000 n +0000500128 00000 n +0000498728 00000 n +0000496283 00000 n +0000499419 00000 n +0000499548 00000 n +0000499677 00000 n +0000499806 00000 n +0000499935 00000 n +0000498893 00000 n +0000499045 00000 n +0000499232 00000 n +0000500063 00000 n +0000503956 00000 n +0000503507 00000 n +0000500256 00000 n +0000503633 00000 n +0000503762 00000 n +0000503891 00000 n +0000508184 00000 n +0000507805 00000 n +0000504084 00000 n +0000508119 00000 n +0000507952 00000 n +0000510692 00000 n +0000510885 00000 n +0000510437 00000 n +0000508298 00000 n +0000510563 00000 n +0000510757 00000 n +0000510821 00000 n +0001197695 00000 n +0000514189 00000 n +0000513998 00000 n +0000510999 00000 n +0000514124 00000 n +0000517789 00000 n +0000517343 00000 n +0000514303 00000 n +0000517469 00000 n +0000517596 00000 n +0000517661 00000 n +0000517725 00000 n +0000520890 00000 n +0000520570 00000 n +0000517903 00000 n +0000520696 00000 n +0000520825 00000 n +0000524177 00000 n +0000523136 00000 n +0000521004 00000 n +0000523596 00000 n +0000523725 00000 n +0000523292 00000 n +0000523445 00000 n +0000523854 00000 n +0000523983 00000 n +0000524112 00000 n +0000525695 00000 n +0000525504 00000 n +0000524291 00000 n +0000525630 00000 n +0000527275 00000 n +0000527084 00000 n +0000525796 00000 n +0000527210 00000 n +0001197820 00000 n +0000528717 00000 n +0000528526 00000 n +0000527376 00000 n +0000528652 00000 n +0000531674 00000 n +0000531355 00000 n +0000528818 00000 n +0000531481 00000 n +0000535819 00000 n +0000535628 00000 n +0000531802 00000 n +0000535754 00000 n +0000540252 00000 n +0000539704 00000 n +0000535961 00000 n +0000540187 00000 n +0000539860 00000 n +0000540017 00000 n +0000752239 00000 n +0000544577 00000 n +0000544178 00000 n +0000540380 00000 n +0000544512 00000 n +0000544325 00000 n +0000548943 00000 n +0000548396 00000 n +0000544719 00000 n +0000548878 00000 n +0000548552 00000 n +0000548723 00000 n +0001197945 00000 n +0000552975 00000 n +0000552527 00000 n +0000549071 00000 n +0000552653 00000 n +0000552845 00000 n +0000552910 00000 n +0000557460 00000 n +0000557094 00000 n +0000553089 00000 n +0000557395 00000 n +0000557241 00000 n +0000562172 00000 n +0000561204 00000 n +0000557588 00000 n +0000562107 00000 n 0000561378 00000 n -0000565121 00000 n -0000564930 00000 n -0000561557 00000 n -0000565056 00000 n -0000569726 00000 n -0000568784 00000 n -0000565235 00000 n -0000569275 00000 n -0000569404 00000 n -0000568940 00000 n -0000569533 00000 n -0000569662 00000 n -0000569110 00000 n -0001163229 00000 n -0000663992 00000 n -0000573118 00000 n -0000572738 00000 n -0000569840 00000 n -0000573053 00000 n -0000572885 00000 n -0000756681 00000 n -0000577221 00000 n -0000576709 00000 n -0000573275 00000 n -0000577027 00000 n -0000576856 00000 n -0000577156 00000 n -0000580787 00000 n -0000580467 00000 n -0000577349 00000 n -0000580593 00000 n -0000580722 00000 n -0000583916 00000 n -0000583596 00000 n -0000580901 00000 n -0000583722 00000 n -0000587963 00000 n -0000587772 00000 n -0000584073 00000 n -0000587898 00000 n -0000591141 00000 n -0000590640 00000 n -0000588077 00000 n -0000590947 00000 n -0000591076 00000 n -0000590787 00000 n -0001163354 00000 n -0000595748 00000 n -0000594940 00000 n -0000591312 00000 n -0000595425 00000 n -0000595554 00000 n -0000595096 00000 n -0000595683 00000 n -0000595270 00000 n -0000599585 00000 n -0000599265 00000 n -0000595862 00000 n -0000599391 00000 n -0000599520 00000 n -0000604062 00000 n -0000603266 00000 n -0000599756 00000 n -0000603740 00000 n -0000603869 00000 n -0000603997 00000 n -0000603422 00000 n -0000603584 00000 n -0000607063 00000 n -0000606423 00000 n -0000604233 00000 n -0000606740 00000 n -0000606570 00000 n -0000606934 00000 n -0000606999 00000 n -0000610316 00000 n -0000609997 00000 n -0000607191 00000 n -0000610123 00000 n -0000610252 00000 n -0000614779 00000 n -0000614236 00000 n -0000610501 00000 n -0000614714 00000 n -0000614392 00000 n -0000614553 00000 n -0001163479 00000 n -0000735517 00000 n -0000619376 00000 n -0000618867 00000 n -0000614893 00000 n -0000619183 00000 n -0000619311 00000 n -0000619014 00000 n -0000662146 00000 n -0000621810 00000 n -0000621491 00000 n -0000619518 00000 n -0000621617 00000 n -0000621746 00000 n -0000623518 00000 n -0000623327 00000 n -0000621923 00000 n -0000623453 00000 n -0000625620 00000 n -0000625429 00000 n -0000623618 00000 n -0000625555 00000 n -0000629355 00000 n -0000629035 00000 n -0000625734 00000 n -0000629161 00000 n -0000633840 00000 n -0000633295 00000 n -0000629498 00000 n -0000633646 00000 n -0000633775 00000 n -0000633442 00000 n -0001163604 00000 n -0000638155 00000 n -0000637835 00000 n -0000633968 00000 n -0000637961 00000 n -0000638090 00000 n -0000642066 00000 n -0000641875 00000 n -0000638282 00000 n -0000642001 00000 n -0000644513 00000 n -0000644193 00000 n -0000642193 00000 n -0000644319 00000 n -0000644448 00000 n -0000649572 00000 n -0000648913 00000 n -0000644627 00000 n -0000649378 00000 n -0000649069 00000 n -0000649220 00000 n -0000653688 00000 n -0000652807 00000 n -0000649686 00000 n -0000653107 00000 n -0000653236 00000 n -0000653365 00000 n -0000653494 00000 n -0000653623 00000 n -0000652954 00000 n -0000657856 00000 n -0000657408 00000 n -0000653802 00000 n -0000657534 00000 n -0000657663 00000 n -0001163729 00000 n -0000662340 00000 n -0000661891 00000 n -0000657984 00000 n -0000662017 00000 n -0000662275 00000 n +0000561563 00000 n +0000561737 00000 n +0000561922 00000 n +0000655028 00000 n +0000566399 00000 n +0000566208 00000 n +0000562370 00000 n +0000566334 00000 n +0000570376 00000 n +0000570185 00000 n +0000566513 00000 n +0000570311 00000 n +0000574874 00000 n +0000574197 00000 n +0000570490 00000 n +0000574680 00000 n +0000574353 00000 n +0000574517 00000 n +0000574809 00000 n +0001198070 00000 n +0000579004 00000 n +0000578191 00000 n +0000574988 00000 n +0000578681 00000 n +0000578347 00000 n +0000578810 00000 n +0000578939 00000 n +0000578516 00000 n +0000675536 00000 n +0000583235 00000 n +0000582672 00000 n +0000579175 00000 n +0000583170 00000 n +0000582828 00000 n +0000582999 00000 n +0000771790 00000 n +0000586781 00000 n +0000586333 00000 n +0000583420 00000 n +0000586459 00000 n +0000586588 00000 n +0000586716 00000 n +0000589969 00000 n +0000589778 00000 n +0000586895 00000 n +0000589904 00000 n +0000593811 00000 n +0000593492 00000 n +0000590140 00000 n +0000593618 00000 n +0000597512 00000 n +0000597321 00000 n +0000593968 00000 n +0000597447 00000 n +0001198195 00000 n +0000601936 00000 n +0000601122 00000 n +0000597683 00000 n +0000601613 00000 n +0000601742 00000 n +0000601278 00000 n +0000601871 00000 n +0000601438 00000 n +0000606043 00000 n +0000605547 00000 n +0000602093 00000 n +0000605849 00000 n +0000605978 00000 n +0000605694 00000 n +0000609420 00000 n +0000608971 00000 n +0000606171 00000 n +0000609097 00000 n +0000609226 00000 n +0000609355 00000 n +0000613272 00000 n +0000612607 00000 n +0000609577 00000 n +0000613079 00000 n +0000613207 00000 n +0000612763 00000 n +0000612924 00000 n +0000616813 00000 n +0000616173 00000 n +0000613443 00000 n +0000616489 00000 n +0000616320 00000 n +0000616683 00000 n +0000616748 00000 n +0000620853 00000 n +0000620350 00000 n +0000616998 00000 n +0000620659 00000 n +0000620788 00000 n +0000620497 00000 n +0001198320 00000 n +0000625451 00000 n +0000625077 00000 n +0000621024 00000 n +0000625386 00000 n +0000625224 00000 n +0000748474 00000 n +0000629635 00000 n +0000628998 00000 n +0000625579 00000 n +0000629312 00000 n +0000629441 00000 n +0000629145 00000 n +0000629570 00000 n +0000673734 00000 n +0000631367 00000 n +0000631176 00000 n +0000629776 00000 n +0000631302 00000 n +0000633072 00000 n +0000632881 00000 n +0000631467 00000 n +0000633007 00000 n +0000635769 00000 n +0000635578 00000 n +0000633172 00000 n +0000635704 00000 n +0000640114 00000 n +0000639666 00000 n +0000635939 00000 n +0000639792 00000 n +0000640049 00000 n +0001198445 00000 n +0000644285 00000 n +0000643740 00000 n +0000640228 00000 n +0000644091 00000 n +0000643887 00000 n +0000644220 00000 n +0000648657 00000 n +0000648466 00000 n +0000644426 00000 n +0000648592 00000 n +0000651795 00000 n +0000651604 00000 n +0000648784 00000 n +0000651730 00000 n +0000655093 00000 n +0000654644 00000 n +0000651922 00000 n +0000654770 00000 n +0000654899 00000 n +0000659779 00000 n +0000659118 00000 n +0000655207 00000 n +0000659586 00000 n +0000659274 00000 n +0000659426 00000 n +0000659714 00000 n +0000665556 00000 n +0000663865 00000 n +0000659893 00000 n +0000665104 00000 n +0000665233 00000 n 0000664057 00000 n -0000663737 00000 n -0000662468 00000 n -0000663863 00000 n -0000665611 00000 n -0000665420 00000 n -0000664171 00000 n -0000665546 00000 n -0000667071 00000 n -0000666880 00000 n -0000665712 00000 n -0000667006 00000 n -0000669826 00000 n -0000669247 00000 n -0000667172 00000 n -0000669373 00000 n -0000669502 00000 n -0000669631 00000 n -0000669696 00000 n -0000669761 00000 n -0000673491 00000 n -0000673300 00000 n -0000669940 00000 n -0000673426 00000 n -0001163854 00000 n -0000678747 00000 n -0000676904 00000 n +0000664232 00000 n +0000664410 00000 n +0000664590 00000 n +0000664769 00000 n +0000665362 00000 n +0000665491 00000 n +0000664950 00000 n +0001198570 00000 n +0000669864 00000 n +0000669416 00000 n +0000665684 00000 n +0000669542 00000 n +0000669671 00000 n +0000673928 00000 n +0000673479 00000 n +0000669992 00000 n 0000673605 00000 n -0000678424 00000 n -0000677114 00000 n -0000678553 00000 n -0000678682 00000 n -0000677282 00000 n -0000677444 00000 n -0000677606 00000 n -0000677768 00000 n -0000677930 00000 n -0000678092 00000 n -0000678263 00000 n -0000953434 00000 n -0000684108 00000 n -0000682015 00000 n -0000678861 00000 n -0000684043 00000 n -0000682252 00000 n -0000682415 00000 n -0000682577 00000 n -0000682740 00000 n -0000682903 00000 n -0000683066 00000 n -0000683229 00000 n -0000683391 00000 n -0000683554 00000 n -0000683714 00000 n -0000683875 00000 n -0000688921 00000 n -0000687351 00000 n -0000684236 00000 n -0000688856 00000 n -0000687561 00000 n -0000687731 00000 n -0000687892 00000 n -0000688053 00000 n -0000688215 00000 n -0000688377 00000 n -0000688540 00000 n -0000688693 00000 n -0000695218 00000 n -0000692326 00000 n -0000689049 00000 n -0000695153 00000 n -0000692608 00000 n -0000692761 00000 n -0000692915 00000 n -0000693065 00000 n -0000693219 00000 n -0000693381 00000 n -0000693543 00000 n -0000693704 00000 n -0000693866 00000 n -0000694028 00000 n -0000694190 00000 n -0000694352 00000 n -0000694504 00000 n -0000694667 00000 n -0000694822 00000 n -0000694987 00000 n -0000699681 00000 n -0000698842 00000 n -0000695360 00000 n -0000699487 00000 n -0000699007 00000 n -0000699170 00000 n -0000699324 00000 n -0000703134 00000 n -0000702814 00000 n -0000699809 00000 n -0000702940 00000 n -0000703005 00000 n -0000703069 00000 n -0001163979 00000 n -0000705928 00000 n -0000705737 00000 n -0000703276 00000 n -0000705863 00000 n -0000710410 00000 n -0000709211 00000 n -0000706099 00000 n -0000709698 00000 n -0000709827 00000 n -0000710085 00000 n -0000709367 00000 n -0000709537 00000 n -0000710150 00000 n -0000710215 00000 n -0000710280 00000 n -0000710345 00000 n -0000713613 00000 n -0000713422 00000 n -0000710524 00000 n -0000713548 00000 n -0000717704 00000 n -0000717125 00000 n -0000713700 00000 n -0000717251 00000 n -0000717316 00000 n -0000717381 00000 n -0000717510 00000 n -0000717574 00000 n -0000717639 00000 n -0000721743 00000 n -0000720905 00000 n -0000717832 00000 n -0000721031 00000 n -0000721096 00000 n -0000721161 00000 n -0000721290 00000 n -0000721355 00000 n -0000721420 00000 n -0000721548 00000 n -0000721613 00000 n -0000721678 00000 n -0000725583 00000 n -0000724748 00000 n -0000721871 00000 n -0000724874 00000 n -0000725003 00000 n -0000725067 00000 n -0000725132 00000 n -0000725260 00000 n -0000725389 00000 n -0000725518 00000 n -0001164104 00000 n -0000728470 00000 n -0000727892 00000 n -0000725796 00000 n -0000728018 00000 n -0000728147 00000 n -0000728276 00000 n -0000728405 00000 n -0000731874 00000 n -0000731553 00000 n -0000728655 00000 n -0000731679 00000 n -0000731744 00000 n -0000731809 00000 n -0000735841 00000 n -0000735262 00000 n -0000732001 00000 n -0000735388 00000 n -0000735646 00000 n -0000735711 00000 n -0000735776 00000 n -0000739542 00000 n -0000738653 00000 n -0000735969 00000 n -0000738960 00000 n -0000738800 00000 n -0000739218 00000 n -0000739347 00000 n -0000739412 00000 n -0000739477 00000 n -0000743317 00000 n -0000742681 00000 n -0000739656 00000 n -0000742993 00000 n -0000742828 00000 n -0000743122 00000 n -0000743187 00000 n -0000743252 00000 n -0000953401 00000 n -0000747083 00000 n -0000746634 00000 n -0000743431 00000 n -0000746760 00000 n -0000746889 00000 n -0000746954 00000 n -0000747019 00000 n -0001164229 00000 n -0000750264 00000 n -0000749685 00000 n -0000747197 00000 n -0000749811 00000 n -0000749940 00000 n -0000750005 00000 n -0000750070 00000 n -0000972207 00000 n -0000964923 00000 n -0000972027 00000 n -0000750199 00000 n -0000750747 00000 n -0000750556 00000 n -0000750406 00000 n -0000750682 00000 n -0000752559 00000 n -0000752112 00000 n -0000750789 00000 n -0000752238 00000 n -0000752367 00000 n -0000752494 00000 n -0000756746 00000 n -0000756040 00000 n -0000752673 00000 n -0000756166 00000 n -0000964602 00000 n -0000955389 00000 n -0000964416 00000 n -0000756295 00000 n -0000756424 00000 n -0000756552 00000 n -0000757778 00000 n -0000757587 00000 n -0000756973 00000 n -0000757713 00000 n -0000758206 00000 n -0000758015 00000 n -0000757865 00000 n -0000758141 00000 n -0001164354 00000 n -0000761520 00000 n -0000760294 00000 n -0000758248 00000 n -0000760811 00000 n -0000760940 00000 n -0000761069 00000 n -0000761198 00000 n -0000761327 00000 n -0000761456 00000 n -0000760450 00000 n -0000760622 00000 n -0000761975 00000 n -0000761784 00000 n -0000761634 00000 n -0000761910 00000 n -0000765220 00000 n -0000764642 00000 n -0000762017 00000 n -0000764768 00000 n -0000764897 00000 n -0000765026 00000 n -0000765155 00000 n -0000769418 00000 n -0000768199 00000 n -0000765306 00000 n -0000768709 00000 n -0000768838 00000 n -0000769096 00000 n -0000768355 00000 n -0000768534 00000 n -0000769290 00000 n -0000769354 00000 n -0000776308 00000 n -0000772480 00000 n -0000769574 00000 n -0000772606 00000 n -0000772671 00000 n -0000772736 00000 n -0000772801 00000 n -0000772866 00000 n -0000772931 00000 n -0000772996 00000 n -0000773061 00000 n -0000773126 00000 n -0000773191 00000 n -0000773321 00000 n -0000773386 00000 n -0000773451 00000 n -0000773516 00000 n -0000773581 00000 n -0000773646 00000 n -0000773711 00000 n -0000773776 00000 n -0000773841 00000 n -0000773906 00000 n -0000773971 00000 n -0000774036 00000 n -0000774101 00000 n -0000774166 00000 n -0000774231 00000 n -0000774296 00000 n -0000774361 00000 n -0000774426 00000 n -0000774491 00000 n -0000774556 00000 n -0000774621 00000 n -0000774686 00000 n -0000774751 00000 n -0000774816 00000 n -0000774880 00000 n -0000774945 00000 n -0000775010 00000 n -0000775075 00000 n -0000775140 00000 n -0000775205 00000 n -0000775270 00000 n -0000775335 00000 n -0000775400 00000 n -0000775465 00000 n -0000775530 00000 n -0000775595 00000 n -0000775660 00000 n -0000775725 00000 n -0000775790 00000 n -0000775855 00000 n -0000775920 00000 n -0000775985 00000 n +0000673863 00000 n +0000675601 00000 n +0000675281 00000 n +0000674056 00000 n +0000675407 00000 n +0000677188 00000 n +0000676997 00000 n +0000675715 00000 n +0000677123 00000 n +0000678748 00000 n +0000678557 00000 n +0000677289 00000 n +0000678683 00000 n +0000680575 00000 n +0000679996 00000 n +0000678849 00000 n +0000680122 00000 n +0000680251 00000 n +0000680380 00000 n +0000680445 00000 n +0000680510 00000 n +0001198695 00000 n +0000683579 00000 n +0000683388 00000 n +0000680689 00000 n +0000683514 00000 n +0000686467 00000 n +0000686276 00000 n +0000683693 00000 n +0000686402 00000 n +0000690831 00000 n +0000689686 00000 n +0000686581 00000 n +0000690509 00000 n +0000689860 00000 n +0000690637 00000 n +0000690766 00000 n +0000690028 00000 n +0000690188 00000 n +0000690349 00000 n +0000985080 00000 n +0000696838 00000 n +0000694238 00000 n +0000690959 00000 n +0000696773 00000 n +0000694502 00000 n +0000694664 00000 n +0000694826 00000 n +0000694997 00000 n +0000695159 00000 n +0000695322 00000 n +0000695484 00000 n +0000695647 00000 n +0000695809 00000 n +0000695972 00000 n +0000696134 00000 n +0000696297 00000 n +0000696451 00000 n +0000696614 00000 n +0000702071 00000 n +0000700150 00000 n +0000696966 00000 n +0000702006 00000 n +0000700378 00000 n +0000700541 00000 n +0000700708 00000 n +0000700878 00000 n +0000701040 00000 n +0000701202 00000 n +0000701364 00000 n +0000701526 00000 n +0000701689 00000 n +0000701843 00000 n +0000707284 00000 n +0000705078 00000 n +0000702199 00000 n +0000707219 00000 n +0000705324 00000 n +0000705477 00000 n +0000705631 00000 n +0000705781 00000 n +0000705935 00000 n +0000706097 00000 n +0000706259 00000 n +0000706421 00000 n +0000706583 00000 n +0000706744 00000 n +0000706906 00000 n +0000707067 00000 n +0001198820 00000 n +0000712615 00000 n +0000711097 00000 n +0000707398 00000 n +0000712422 00000 n +0000711298 00000 n +0000711461 00000 n +0000711612 00000 n +0000711777 00000 n +0000711943 00000 n +0000712105 00000 n +0000712259 00000 n +0000716554 00000 n +0000716233 00000 n +0000712757 00000 n +0000716359 00000 n +0000716424 00000 n +0000716489 00000 n +0000719331 00000 n +0000719140 00000 n +0000716696 00000 n +0000719266 00000 n +0000723526 00000 n +0000722457 00000 n +0000719489 00000 n +0000722944 00000 n +0000723073 00000 n +0000723331 00000 n +0000722613 00000 n +0000722783 00000 n +0000723396 00000 n +0000723461 00000 n +0000726978 00000 n +0000726658 00000 n +0000723654 00000 n +0000726784 00000 n +0000726849 00000 n +0000726913 00000 n +0000730463 00000 n +0000730142 00000 n +0000727079 00000 n +0000730268 00000 n +0000730333 00000 n +0000730398 00000 n +0001198945 00000 n +0000734387 00000 n +0000733678 00000 n +0000730578 00000 n +0000733804 00000 n +0000733933 00000 n +0000733998 00000 n +0000734063 00000 n +0000734128 00000 n +0000734193 00000 n +0000734322 00000 n +0000738616 00000 n +0000737779 00000 n +0000734501 00000 n +0000737905 00000 n +0000737970 00000 n +0000738035 00000 n +0000738164 00000 n +0000738229 00000 n +0000738294 00000 n +0000738423 00000 n +0000738488 00000 n +0000738552 00000 n +0000741644 00000 n +0000740942 00000 n +0000738744 00000 n +0000741068 00000 n +0000741195 00000 n +0000741322 00000 n +0000741451 00000 n +0000741579 00000 n +0000744345 00000 n +0000743768 00000 n +0000741843 00000 n +0000743894 00000 n +0000744023 00000 n +0000744152 00000 n +0000744217 00000 n +0000744281 00000 n +0000748539 00000 n +0000748219 00000 n +0000744530 00000 n +0000748345 00000 n +0000752304 00000 n +0000751544 00000 n +0000748666 00000 n +0000751851 00000 n +0000751980 00000 n +0000752045 00000 n +0000752110 00000 n +0000751691 00000 n +0001199070 00000 n +0000755992 00000 n +0000755413 00000 n +0000752418 00000 n +0000755539 00000 n +0000755668 00000 n +0000755797 00000 n +0000755862 00000 n +0000755927 00000 n +0000759614 00000 n +0000758719 00000 n +0000756106 00000 n +0000759031 00000 n +0000758866 00000 n +0000759160 00000 n +0000759225 00000 n +0000759290 00000 n +0000759419 00000 n +0000759484 00000 n +0000759549 00000 n +0000985047 00000 n +0000763714 00000 n +0000763265 00000 n +0000759728 00000 n +0000763391 00000 n +0000763520 00000 n +0000763584 00000 n +0000763649 00000 n +0000765757 00000 n +0000765437 00000 n +0000763842 00000 n +0000765563 00000 n +0001003853 00000 n +0000996569 00000 n +0001003673 00000 n +0000765692 00000 n +0000767669 00000 n +0000767222 00000 n +0000765899 00000 n +0000767348 00000 n +0000767477 00000 n +0000767604 00000 n +0000771855 00000 n +0000771149 00000 n +0000767783 00000 n +0000771275 00000 n +0000996248 00000 n +0000987035 00000 n +0000996062 00000 n +0000771404 00000 n +0000771533 00000 n +0000771661 00000 n +0001199195 00000 n +0000772888 00000 n +0000772697 00000 n +0000772082 00000 n +0000772823 00000 n +0000773316 00000 n +0000773125 00000 n +0000772975 00000 n +0000773251 00000 n +0000776630 00000 n +0000775404 00000 n +0000773358 00000 n +0000775921 00000 n 0000776050 00000 n -0000776115 00000 n -0000776180 00000 n -0000776244 00000 n -0000782956 00000 n -0000779392 00000 n -0000776422 00000 n -0000779518 00000 n -0000779583 00000 n -0000779648 00000 n -0000779713 00000 n -0000779778 00000 n -0000779843 00000 n -0000779908 00000 n -0000779973 00000 n -0000780038 00000 n -0000780103 00000 n -0000780168 00000 n -0000780233 00000 n -0000780297 00000 n -0000780362 00000 n -0000780427 00000 n -0000780492 00000 n -0000780557 00000 n -0000780622 00000 n -0000780687 00000 n -0000780752 00000 n -0000780817 00000 n -0000780882 00000 n -0000780947 00000 n -0000781012 00000 n -0000781076 00000 n -0000781141 00000 n -0000781206 00000 n -0000781271 00000 n -0000781336 00000 n -0000781401 00000 n -0000781466 00000 n -0000781531 00000 n -0000781596 00000 n -0000781661 00000 n -0000781726 00000 n -0000781791 00000 n -0000781856 00000 n -0000781921 00000 n -0000781986 00000 n -0000782051 00000 n -0000782115 00000 n -0000782179 00000 n -0000782243 00000 n -0000782308 00000 n -0000782373 00000 n -0000782438 00000 n -0000782503 00000 n -0000782568 00000 n -0000782633 00000 n -0000782698 00000 n -0000782763 00000 n -0000782828 00000 n -0000782892 00000 n -0001164479 00000 n -0000789131 00000 n -0000785693 00000 n -0000783070 00000 n -0000785819 00000 n -0000785884 00000 n -0000785949 00000 n -0000786014 00000 n -0000786079 00000 n -0000786144 00000 n -0000786209 00000 n -0000786274 00000 n -0000786339 00000 n -0000786404 00000 n -0000786469 00000 n -0000786534 00000 n -0000786599 00000 n -0000786664 00000 n -0000786729 00000 n -0000786794 00000 n -0000786859 00000 n -0000786924 00000 n -0000786989 00000 n -0000787054 00000 n -0000787119 00000 n -0000787184 00000 n -0000787249 00000 n -0000787314 00000 n -0000787379 00000 n -0000787444 00000 n -0000787509 00000 n -0000787574 00000 n -0000787639 00000 n -0000787704 00000 n -0000787769 00000 n -0000787834 00000 n -0000787899 00000 n -0000787964 00000 n -0000788028 00000 n -0000788093 00000 n -0000788158 00000 n -0000788223 00000 n -0000788288 00000 n -0000788353 00000 n -0000788418 00000 n -0000788483 00000 n -0000788548 00000 n -0000788613 00000 n -0000788678 00000 n -0000788743 00000 n -0000788808 00000 n -0000788873 00000 n -0000788938 00000 n -0000789003 00000 n -0000789067 00000 n -0000794650 00000 n -0000792254 00000 n -0000789245 00000 n -0000792380 00000 n -0000792445 00000 n -0000792510 00000 n -0000792575 00000 n -0000792640 00000 n -0000792705 00000 n -0000792770 00000 n -0000792835 00000 n -0000792900 00000 n -0000792965 00000 n -0000793030 00000 n -0000793095 00000 n -0000793160 00000 n -0000793224 00000 n -0000793289 00000 n -0000793354 00000 n -0000793419 00000 n -0000793484 00000 n -0000793549 00000 n -0000793614 00000 n -0000793679 00000 n -0000793744 00000 n -0000793809 00000 n -0000793874 00000 n -0000793939 00000 n -0000794067 00000 n -0000794196 00000 n -0000794261 00000 n -0000794326 00000 n -0000794391 00000 n -0000794456 00000 n -0000794585 00000 n -0000797859 00000 n -0000797152 00000 n -0000794777 00000 n -0000797278 00000 n -0000797407 00000 n -0000797536 00000 n -0000797665 00000 n -0000797794 00000 n -0000801351 00000 n -0000800594 00000 n -0000797986 00000 n -0000800901 00000 n -0000801030 00000 n -0000800741 00000 n -0000801158 00000 n -0000801286 00000 n -0000804595 00000 n -0000804017 00000 n -0000801478 00000 n -0000804143 00000 n -0000804272 00000 n -0000804401 00000 n -0000804530 00000 n -0000807503 00000 n -0000807183 00000 n -0000804709 00000 n -0000807309 00000 n -0000807438 00000 n -0001164604 00000 n -0000810093 00000 n -0000809644 00000 n -0000807673 00000 n -0000809770 00000 n -0000809899 00000 n -0000810028 00000 n -0000810534 00000 n -0000810343 00000 n -0000810193 00000 n -0000810469 00000 n -0000813317 00000 n -0000812673 00000 n -0000810576 00000 n -0000812799 00000 n -0000812928 00000 n -0000813057 00000 n -0000813122 00000 n -0000813187 00000 n -0000813252 00000 n -0000817651 00000 n -0000817330 00000 n -0000813431 00000 n -0000817456 00000 n -0000817521 00000 n -0000817586 00000 n -0000821399 00000 n -0000821143 00000 n -0000817807 00000 n -0000821269 00000 n -0000821334 00000 n -0000824561 00000 n -0000824370 00000 n -0000821541 00000 n -0000824496 00000 n -0001164729 00000 n -0000828205 00000 n -0000827949 00000 n -0000824689 00000 n -0000828075 00000 n -0000828140 00000 n -0000831410 00000 n -0000830702 00000 n -0000828347 00000 n -0000830828 00000 n -0000830893 00000 n -0000830958 00000 n -0000831023 00000 n -0000831088 00000 n -0000831217 00000 n -0000831281 00000 n -0000831346 00000 n -0000836079 00000 n -0000835823 00000 n -0000831552 00000 n -0000835949 00000 n -0000836014 00000 n -0000839098 00000 n -0000838325 00000 n -0000836207 00000 n -0000838451 00000 n -0000838516 00000 n -0000838581 00000 n -0000838646 00000 n -0000838775 00000 n -0000838840 00000 n -0000838903 00000 n -0000838968 00000 n -0000839033 00000 n -0000842011 00000 n -0000841496 00000 n -0000839254 00000 n -0000841622 00000 n -0000841687 00000 n -0000841752 00000 n -0000841817 00000 n -0000841882 00000 n -0000841947 00000 n -0000845384 00000 n -0000844804 00000 n -0000842167 00000 n -0000844930 00000 n -0000845059 00000 n -0000845124 00000 n -0000845189 00000 n -0000845254 00000 n -0000845319 00000 n -0001164854 00000 n -0000848836 00000 n -0000848580 00000 n -0000845526 00000 n -0000848706 00000 n -0000848771 00000 n -0000851788 00000 n -0000851144 00000 n -0000848964 00000 n -0000851270 00000 n -0000851335 00000 n -0000851400 00000 n -0000851465 00000 n -0000851659 00000 n -0000851724 00000 n -0000855429 00000 n -0000855108 00000 n -0000851957 00000 n -0000855234 00000 n -0000855299 00000 n -0000855364 00000 n -0000859020 00000 n -0000858829 00000 n -0000855557 00000 n -0000858955 00000 n -0000862486 00000 n -0000862165 00000 n -0000859148 00000 n -0000862291 00000 n -0000862356 00000 n -0000862421 00000 n -0000865143 00000 n -0000864434 00000 n -0000862627 00000 n -0000864560 00000 n -0000864625 00000 n -0000864690 00000 n -0000864755 00000 n -0000864884 00000 n -0000864949 00000 n -0000865014 00000 n -0000865079 00000 n -0001164979 00000 n -0000868019 00000 n -0000867309 00000 n -0000865299 00000 n -0000867435 00000 n -0000867500 00000 n -0000867565 00000 n -0000867630 00000 n -0000867824 00000 n -0000867889 00000 n -0000867954 00000 n -0000871590 00000 n -0000871269 00000 n -0000868175 00000 n -0000871395 00000 n -0000871460 00000 n -0000871525 00000 n -0000874739 00000 n -0000874094 00000 n -0000871718 00000 n -0000874220 00000 n -0000874285 00000 n -0000874350 00000 n -0000874415 00000 n -0000874544 00000 n -0000874609 00000 n -0000874674 00000 n -0000878270 00000 n -0000877949 00000 n -0000874895 00000 n -0000878075 00000 n -0000878140 00000 n -0000878205 00000 n -0000881853 00000 n -0000881662 00000 n -0000878412 00000 n -0000881788 00000 n -0000885338 00000 n -0000885147 00000 n -0000881981 00000 n -0000885273 00000 n -0001165104 00000 n -0000888232 00000 n -0000887588 00000 n -0000885480 00000 n -0000887714 00000 n -0000887779 00000 n -0000887844 00000 n -0000887909 00000 n -0000888038 00000 n -0000888103 00000 n -0000888168 00000 n -0000891145 00000 n -0000890440 00000 n -0000888388 00000 n -0000890566 00000 n -0000890631 00000 n -0000890696 00000 n -0000890761 00000 n -0000890826 00000 n -0000890891 00000 n -0000891017 00000 n -0000891082 00000 n -0000894348 00000 n -0000893963 00000 n -0000891287 00000 n -0000894089 00000 n -0000894154 00000 n -0000894219 00000 n -0000894284 00000 n -0000897778 00000 n -0000897587 00000 n -0000894490 00000 n -0000897713 00000 n -0000900769 00000 n -0000899995 00000 n -0000897906 00000 n -0000900121 00000 n -0000900186 00000 n -0000900251 00000 n -0000900316 00000 n -0000900445 00000 n -0000900509 00000 n -0000900574 00000 n -0000900639 00000 n -0000900704 00000 n -0000903964 00000 n -0000903773 00000 n -0000900925 00000 n -0000903899 00000 n -0001165229 00000 n -0000907006 00000 n -0000906686 00000 n -0000904177 00000 n -0000906812 00000 n -0000906877 00000 n -0000906942 00000 n -0000909882 00000 n -0000909109 00000 n -0000907233 00000 n -0000909235 00000 n -0000909300 00000 n -0000909365 00000 n -0000909429 00000 n -0000909558 00000 n -0000909623 00000 n -0000909688 00000 n -0000909753 00000 n -0000909818 00000 n -0000913705 00000 n -0000913125 00000 n -0000910038 00000 n -0000913251 00000 n -0000913316 00000 n -0000913445 00000 n -0000913510 00000 n -0000913575 00000 n -0000913640 00000 n -0000918032 00000 n -0000917776 00000 n -0000913833 00000 n -0000917902 00000 n -0000917967 00000 n -0000921552 00000 n -0000921361 00000 n -0000918160 00000 n -0000921487 00000 n -0000924111 00000 n -0000923726 00000 n -0000921680 00000 n -0000923852 00000 n -0000923917 00000 n -0000923982 00000 n -0000924047 00000 n -0001165354 00000 n -0000927598 00000 n -0000926953 00000 n -0000924266 00000 n -0000927079 00000 n -0000927144 00000 n -0000927273 00000 n -0000927338 00000 n -0000927403 00000 n -0000927468 00000 n -0000927533 00000 n -0000930666 00000 n -0000929956 00000 n -0000927740 00000 n -0000930082 00000 n -0000930147 00000 n -0000930212 00000 n -0000930277 00000 n -0000930406 00000 n -0000930471 00000 n -0000930536 00000 n -0000930601 00000 n -0000933766 00000 n -0000933510 00000 n -0000930836 00000 n -0000933636 00000 n -0000933701 00000 n -0000936909 00000 n -0000936200 00000 n -0000933894 00000 n -0000936326 00000 n -0000936391 00000 n -0000936456 00000 n -0000936521 00000 n -0000936649 00000 n -0000936714 00000 n -0000936779 00000 n -0000936844 00000 n -0000940503 00000 n -0000940182 00000 n -0000937065 00000 n -0000940308 00000 n -0000940373 00000 n -0000940438 00000 n -0000943732 00000 n -0000943022 00000 n -0000940645 00000 n -0000943148 00000 n -0000943213 00000 n -0000943278 00000 n -0000943407 00000 n -0000943472 00000 n -0000943537 00000 n -0000943602 00000 n -0000943667 00000 n -0001165479 00000 n -0000946545 00000 n -0000945771 00000 n -0000943888 00000 n -0000945897 00000 n -0000945962 00000 n -0000946027 00000 n -0000946156 00000 n -0000946221 00000 n -0000946286 00000 n -0000946351 00000 n -0000946416 00000 n -0000946481 00000 n -0000948931 00000 n -0000947965 00000 n -0000946701 00000 n -0000948091 00000 n -0000948220 00000 n -0000948285 00000 n -0000948350 00000 n -0000948415 00000 n -0000948480 00000 n -0000948545 00000 n -0000948609 00000 n -0000948737 00000 n -0000948802 00000 n -0000948867 00000 n -0000951937 00000 n -0000951100 00000 n -0000949073 00000 n -0000951226 00000 n -0000951291 00000 n -0000951356 00000 n -0000951420 00000 n -0000951485 00000 n -0000951614 00000 n -0000951679 00000 n -0000951744 00000 n -0000951808 00000 n -0000951873 00000 n -0000953287 00000 n -0000952967 00000 n -0000952079 00000 n -0000953093 00000 n -0000953158 00000 n -0000953222 00000 n -0000953500 00000 n -0000964844 00000 n -0000972433 00000 n -0000974732 00000 n -0000974701 00000 n -0000978419 00000 n -0000987860 00000 n -0000998595 00000 n -0001010291 00000 n -0001023008 00000 n -0001042242 00000 n -0001063304 00000 n -0001085455 00000 n -0001103711 00000 n -0001106557 00000 n -0001106327 00000 n -0001133975 00000 n -0001161241 00000 n -0001165595 00000 n -0001165720 00000 n -0001165846 00000 n -0001165972 00000 n -0001166098 00000 n -0001166224 00000 n -0001166304 00000 n -0001166414 00000 n -0001188316 00000 n -0001212549 00000 n -0001212590 00000 n -0001212630 00000 n -0001212764 00000 n +0000776179 00000 n +0000776308 00000 n +0000776437 00000 n +0000776566 00000 n +0000775560 00000 n +0000775732 00000 n +0000777085 00000 n +0000776894 00000 n +0000776744 00000 n +0000777020 00000 n +0000780330 00000 n +0000779752 00000 n +0000777127 00000 n +0000779878 00000 n +0000780007 00000 n +0000780136 00000 n +0000780265 00000 n +0000784527 00000 n +0000783308 00000 n +0000780416 00000 n +0000783818 00000 n +0000783947 00000 n +0000784205 00000 n +0000783464 00000 n +0000783643 00000 n +0000784399 00000 n +0000784463 00000 n +0001199320 00000 n +0000791417 00000 n +0000787589 00000 n +0000784683 00000 n +0000787715 00000 n +0000787780 00000 n +0000787845 00000 n +0000787910 00000 n +0000787975 00000 n +0000788040 00000 n +0000788105 00000 n +0000788170 00000 n +0000788235 00000 n +0000788300 00000 n +0000788430 00000 n +0000788495 00000 n +0000788560 00000 n +0000788625 00000 n +0000788690 00000 n +0000788755 00000 n +0000788820 00000 n +0000788885 00000 n +0000788950 00000 n +0000789015 00000 n +0000789080 00000 n +0000789145 00000 n +0000789210 00000 n +0000789275 00000 n +0000789340 00000 n +0000789405 00000 n +0000789470 00000 n +0000789535 00000 n +0000789600 00000 n +0000789665 00000 n +0000789730 00000 n +0000789795 00000 n +0000789860 00000 n +0000789925 00000 n +0000789989 00000 n +0000790054 00000 n +0000790119 00000 n +0000790184 00000 n +0000790249 00000 n +0000790314 00000 n +0000790379 00000 n +0000790444 00000 n +0000790509 00000 n +0000790574 00000 n +0000790639 00000 n +0000790704 00000 n +0000790769 00000 n +0000790834 00000 n +0000790899 00000 n +0000790964 00000 n +0000791029 00000 n +0000791094 00000 n +0000791159 00000 n +0000791224 00000 n +0000791289 00000 n +0000791353 00000 n +0000798065 00000 n +0000794501 00000 n +0000791531 00000 n +0000794627 00000 n +0000794692 00000 n +0000794757 00000 n +0000794822 00000 n +0000794887 00000 n +0000794952 00000 n +0000795017 00000 n +0000795082 00000 n +0000795147 00000 n +0000795212 00000 n +0000795277 00000 n +0000795342 00000 n +0000795406 00000 n +0000795471 00000 n +0000795536 00000 n +0000795601 00000 n +0000795666 00000 n +0000795731 00000 n +0000795796 00000 n +0000795861 00000 n +0000795926 00000 n +0000795991 00000 n +0000796056 00000 n +0000796121 00000 n +0000796185 00000 n +0000796250 00000 n +0000796315 00000 n +0000796380 00000 n +0000796445 00000 n +0000796510 00000 n +0000796575 00000 n +0000796640 00000 n +0000796705 00000 n +0000796770 00000 n +0000796835 00000 n +0000796900 00000 n +0000796965 00000 n +0000797030 00000 n +0000797095 00000 n +0000797160 00000 n +0000797224 00000 n +0000797288 00000 n +0000797352 00000 n +0000797417 00000 n +0000797482 00000 n +0000797547 00000 n +0000797612 00000 n +0000797677 00000 n +0000797742 00000 n +0000797807 00000 n +0000797872 00000 n +0000797937 00000 n +0000798001 00000 n +0000804240 00000 n +0000800802 00000 n +0000798179 00000 n +0000800928 00000 n +0000800993 00000 n +0000801058 00000 n +0000801123 00000 n +0000801188 00000 n +0000801253 00000 n +0000801318 00000 n +0000801383 00000 n +0000801448 00000 n +0000801513 00000 n +0000801578 00000 n +0000801643 00000 n +0000801708 00000 n +0000801773 00000 n +0000801838 00000 n +0000801903 00000 n +0000801968 00000 n +0000802033 00000 n +0000802098 00000 n +0000802163 00000 n +0000802228 00000 n +0000802293 00000 n +0000802358 00000 n +0000802423 00000 n +0000802488 00000 n +0000802553 00000 n +0000802618 00000 n +0000802683 00000 n +0000802748 00000 n +0000802813 00000 n +0000802878 00000 n +0000802943 00000 n +0000803008 00000 n +0000803073 00000 n +0000803137 00000 n +0000803202 00000 n +0000803267 00000 n +0000803332 00000 n +0000803397 00000 n +0000803462 00000 n +0000803527 00000 n +0000803592 00000 n +0000803657 00000 n +0000803722 00000 n +0000803787 00000 n +0000803852 00000 n +0000803917 00000 n +0000803982 00000 n +0000804047 00000 n +0000804112 00000 n +0000804176 00000 n +0000809759 00000 n +0000807363 00000 n +0000804354 00000 n +0000807489 00000 n +0000807554 00000 n +0000807619 00000 n +0000807684 00000 n +0000807749 00000 n +0000807814 00000 n +0000807879 00000 n +0000807944 00000 n +0000808009 00000 n +0000808074 00000 n +0000808139 00000 n +0000808204 00000 n +0000808269 00000 n +0000808333 00000 n +0000808398 00000 n +0000808463 00000 n +0000808528 00000 n +0000808593 00000 n +0000808658 00000 n +0000808723 00000 n +0000808788 00000 n +0000808853 00000 n +0000808918 00000 n +0000808983 00000 n +0000809048 00000 n +0000809176 00000 n +0000809305 00000 n +0000809370 00000 n +0000809435 00000 n +0000809500 00000 n +0000809565 00000 n +0000809694 00000 n +0000812967 00000 n +0000812260 00000 n +0000809886 00000 n +0000812386 00000 n +0000812515 00000 n +0000812644 00000 n +0000812773 00000 n +0000812902 00000 n +0000816459 00000 n +0000815702 00000 n +0000813094 00000 n +0000816009 00000 n +0000816138 00000 n +0000815849 00000 n +0000816266 00000 n +0000816394 00000 n +0001199445 00000 n +0000819703 00000 n +0000819125 00000 n +0000816586 00000 n +0000819251 00000 n +0000819380 00000 n +0000819509 00000 n +0000819638 00000 n +0000822611 00000 n +0000822291 00000 n +0000819817 00000 n +0000822417 00000 n +0000822546 00000 n +0000825201 00000 n +0000824752 00000 n +0000822781 00000 n +0000824878 00000 n +0000825007 00000 n +0000825136 00000 n +0000825642 00000 n +0000825451 00000 n +0000825301 00000 n +0000825577 00000 n +0000828425 00000 n +0000827781 00000 n +0000825684 00000 n +0000827907 00000 n +0000828036 00000 n +0000828165 00000 n +0000828230 00000 n +0000828295 00000 n +0000828360 00000 n +0000832759 00000 n +0000832438 00000 n +0000828539 00000 n +0000832564 00000 n +0000832629 00000 n +0000832694 00000 n +0001199570 00000 n +0000836522 00000 n +0000836266 00000 n +0000832915 00000 n +0000836392 00000 n +0000836457 00000 n +0000839813 00000 n +0000839622 00000 n +0000836664 00000 n +0000839748 00000 n +0000843332 00000 n +0000843141 00000 n +0000839941 00000 n +0000843267 00000 n +0000846613 00000 n +0000846098 00000 n +0000843474 00000 n +0000846224 00000 n +0000846289 00000 n +0000846354 00000 n +0000846419 00000 n +0000846484 00000 n +0000846549 00000 n +0000850812 00000 n +0000850297 00000 n +0000846769 00000 n +0000850423 00000 n +0000850552 00000 n +0000850617 00000 n +0000850682 00000 n +0000850747 00000 n +0000854444 00000 n +0000853735 00000 n +0000850940 00000 n +0000853861 00000 n +0000853926 00000 n +0000853991 00000 n +0000854056 00000 n +0000854185 00000 n +0000854250 00000 n +0000854315 00000 n +0000854380 00000 n +0001199695 00000 n +0000857649 00000 n +0000856941 00000 n +0000854586 00000 n +0000857067 00000 n +0000857132 00000 n +0000857195 00000 n +0000857260 00000 n +0000857389 00000 n +0000857454 00000 n +0000857519 00000 n +0000857584 00000 n +0000860939 00000 n +0000860554 00000 n +0000857791 00000 n +0000860680 00000 n +0000860745 00000 n +0000860810 00000 n +0000860875 00000 n +0000864116 00000 n +0000863537 00000 n +0000861067 00000 n +0000863663 00000 n +0000863792 00000 n +0000863857 00000 n +0000863922 00000 n +0000863987 00000 n +0000864051 00000 n +0000866712 00000 n +0000865937 00000 n +0000864272 00000 n +0000866063 00000 n +0000866128 00000 n +0000866193 00000 n +0000866258 00000 n +0000866323 00000 n +0000866388 00000 n +0000866517 00000 n +0000866582 00000 n +0000866647 00000 n +0000870208 00000 n +0000869887 00000 n +0000866882 00000 n +0000870013 00000 n +0000870078 00000 n +0000870143 00000 n +0000873763 00000 n +0000873444 00000 n +0000870336 00000 n +0000873570 00000 n +0000873635 00000 n +0000873700 00000 n +0001199820 00000 n +0000876979 00000 n +0000876269 00000 n +0000873891 00000 n +0000876395 00000 n +0000876460 00000 n +0000876525 00000 n +0000876719 00000 n +0000876784 00000 n +0000876849 00000 n +0000876914 00000 n +0000880742 00000 n +0000880551 00000 n +0000877148 00000 n +0000880677 00000 n +0000884452 00000 n +0000884196 00000 n +0000880870 00000 n +0000884322 00000 n +0000884387 00000 n +0000887967 00000 n +0000887646 00000 n +0000884580 00000 n +0000887772 00000 n +0000887837 00000 n +0000887902 00000 n +0000890628 00000 n +0000889918 00000 n +0000888122 00000 n +0000890044 00000 n +0000890109 00000 n +0000890174 00000 n +0000890303 00000 n +0000890368 00000 n +0000890433 00000 n +0000890498 00000 n +0000890563 00000 n +0000894009 00000 n +0000893299 00000 n +0000890798 00000 n +0000893425 00000 n +0000893490 00000 n +0000893555 00000 n +0000893749 00000 n +0000893814 00000 n +0000893879 00000 n +0000893944 00000 n +0001199945 00000 n +0000897390 00000 n +0000897069 00000 n +0000894165 00000 n +0000897195 00000 n +0000897260 00000 n +0000897325 00000 n +0000900533 00000 n +0000899824 00000 n +0000897504 00000 n +0000899950 00000 n +0000900015 00000 n +0000900080 00000 n +0000900209 00000 n +0000900273 00000 n +0000900338 00000 n +0000900403 00000 n +0000900468 00000 n +0000904546 00000 n +0000904355 00000 n +0000900689 00000 n +0000904481 00000 n +0000908433 00000 n +0000908242 00000 n +0000904674 00000 n +0000908368 00000 n +0000911974 00000 n +0000911783 00000 n +0000908561 00000 n +0000911909 00000 n +0000914929 00000 n +0000914544 00000 n +0000912102 00000 n +0000914670 00000 n +0000914735 00000 n +0000914800 00000 n +0000914865 00000 n +0001200070 00000 n +0000918175 00000 n +0000917531 00000 n +0000915099 00000 n +0000917657 00000 n +0000917786 00000 n +0000917851 00000 n +0000917916 00000 n +0000917981 00000 n +0000918046 00000 n +0000918111 00000 n +0000921075 00000 n +0000920368 00000 n +0000918331 00000 n +0000920494 00000 n +0000920559 00000 n +0000920688 00000 n +0000920753 00000 n +0000920818 00000 n +0000920882 00000 n +0000920947 00000 n +0000921012 00000 n +0000923928 00000 n +0000923218 00000 n +0000921217 00000 n +0000923344 00000 n +0000923409 00000 n +0000923474 00000 n +0000923603 00000 n +0000923668 00000 n +0000923733 00000 n +0000923798 00000 n +0000923863 00000 n +0000927644 00000 n +0000927453 00000 n +0000924070 00000 n +0000927579 00000 n +0000930768 00000 n +0000930124 00000 n +0000927772 00000 n +0000930250 00000 n +0000930315 00000 n +0000930380 00000 n +0000930444 00000 n +0000930573 00000 n +0000930638 00000 n +0000930703 00000 n +0000934289 00000 n +0000933968 00000 n +0000930924 00000 n +0000934094 00000 n +0000934159 00000 n +0000934224 00000 n +0001200195 00000 n +0000937509 00000 n +0000937318 00000 n +0000934474 00000 n +0000937444 00000 n +0000940334 00000 n +0000939627 00000 n +0000937722 00000 n +0000939753 00000 n +0000939818 00000 n +0000939882 00000 n +0000939947 00000 n +0000940012 00000 n +0000940077 00000 n +0000940205 00000 n +0000940270 00000 n +0000943549 00000 n +0000942775 00000 n +0000940519 00000 n +0000942901 00000 n +0000942966 00000 n +0000943031 00000 n +0000943096 00000 n +0000943161 00000 n +0000943289 00000 n +0000943354 00000 n +0000943419 00000 n +0000943484 00000 n +0000948023 00000 n +0000947832 00000 n +0000943691 00000 n +0000947958 00000 n +0000951673 00000 n +0000951417 00000 n +0000948151 00000 n +0000951543 00000 n +0000951608 00000 n +0000954688 00000 n +0000954432 00000 n +0000951801 00000 n +0000954558 00000 n +0000954623 00000 n +0001200320 00000 n +0000957931 00000 n +0000957223 00000 n +0000954816 00000 n +0000957349 00000 n +0000957414 00000 n +0000957479 00000 n +0000957544 00000 n +0000957671 00000 n +0000957736 00000 n +0000957801 00000 n +0000957866 00000 n +0000961463 00000 n +0000960820 00000 n +0000958100 00000 n +0000960946 00000 n +0000961011 00000 n +0000961076 00000 n +0000961141 00000 n +0000961206 00000 n +0000961334 00000 n +0000961399 00000 n +0000965032 00000 n +0000964646 00000 n +0000961633 00000 n +0000964772 00000 n +0000964837 00000 n +0000964902 00000 n +0000964967 00000 n +0000967393 00000 n +0000967008 00000 n +0000965160 00000 n +0000967134 00000 n +0000967199 00000 n +0000967264 00000 n +0000967329 00000 n +0000971078 00000 n +0000970498 00000 n +0000967549 00000 n +0000970624 00000 n +0000970753 00000 n +0000970818 00000 n +0000970883 00000 n +0000970948 00000 n +0000971013 00000 n +0000974225 00000 n +0000973517 00000 n +0000971220 00000 n +0000973643 00000 n +0000973708 00000 n +0000973773 00000 n +0000973837 00000 n +0000973965 00000 n +0000974030 00000 n +0000974095 00000 n +0000974160 00000 n +0001200445 00000 n +0000977657 00000 n +0000977078 00000 n +0000974395 00000 n +0000977204 00000 n +0000977269 00000 n +0000977334 00000 n +0000977399 00000 n +0000977528 00000 n +0000977593 00000 n +0000980073 00000 n +0000979169 00000 n +0000977813 00000 n +0000979295 00000 n +0000979360 00000 n +0000979425 00000 n +0000979490 00000 n +0000979555 00000 n +0000979684 00000 n +0000979749 00000 n +0000979814 00000 n +0000979879 00000 n +0000979944 00000 n +0000980009 00000 n +0000983045 00000 n +0000982079 00000 n +0000980229 00000 n +0000982205 00000 n +0000982270 00000 n +0000982399 00000 n +0000982463 00000 n +0000982528 00000 n +0000982593 00000 n +0000982658 00000 n +0000982723 00000 n +0000982787 00000 n +0000982916 00000 n +0000982981 00000 n +0000984905 00000 n +0000984391 00000 n +0000983187 00000 n +0000984517 00000 n +0000984582 00000 n +0000984647 00000 n +0000984712 00000 n +0000984777 00000 n +0000984841 00000 n +0000985146 00000 n +0000996490 00000 n +0001004079 00000 n +0001007713 00000 n +0001017153 00000 n +0001027888 00000 n +0001030590 00000 n +0001030559 00000 n +0001043439 00000 n +0001057508 00000 n +0001077014 00000 n +0001098080 00000 n +0001120230 00000 n +0001138486 00000 n +0001141333 00000 n +0001141103 00000 n +0001168751 00000 n +0001196080 00000 n +0001200561 00000 n +0001200686 00000 n +0001200812 00000 n +0001200938 00000 n +0001201064 00000 n +0001201190 00000 n +0001201280 00000 n +0001201390 00000 n +0001223571 00000 n +0001248515 00000 n +0001248556 00000 n +0001248596 00000 n +0001248730 00000 n trailer << -/Size 2768 -/Root 2766 0 R -/Info 2767 0 R -/ID [<AB7D8FE7604A610EE0A87A3E923B9339> <AB7D8FE7604A610EE0A87A3E923B9339>] +/Size 2838 +/Root 2836 0 R +/Info 2837 0 R +/ID [<E1541D0B72B34C8C74B211C7F67883CD> <E1541D0B72B34C8C74B211C7F67883CD>] >> startxref -1213022 +1248988 %%EOF diff --git a/doc/arm/dnssec.xml b/doc/arm/dnssec.xml index f89e174..7fa9aa7 100644 --- a/doc/arm/dnssec.xml +++ b/doc/arm/dnssec.xml @@ -1,6 +1,6 @@ <?xml version="1.0" encoding="utf-8"?> <!-- - - Copyright (C) 2010, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2010, 2011 Internet Systems Consortium, Inc. ("ISC") - - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above @@ -15,7 +15,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id$ --> +<!-- $Id: dnssec.xml,v 1.7 2011/10/13 23:47:10 tbox Exp $ --> <sect1 id="dnssec.dynamic.zones"> <title>DNSSEC, Dynamic Zones, and Automatic Signing</title> @@ -100,8 +100,7 @@ <command>named</command> can search the key directory for keys matching the zone, insert them into the zone, and use them to sign the zone. It will do so only when it receives an - <command>rndc sign <zonename></command> or - <command>rndc loadkeys <zonename></command> command.</para> + <command>rndc sign <zonename></command>.</para> <para> <!-- TODO: this is repeated in the ARM --> <command>auto-dnssec maintain</command> includes the above @@ -109,12 +108,34 @@ DNSKEY records on schedule according to the keys' timing metadata. (See <xref linkend="man.dnssec-keygen"/> and <xref linkend="man.dnssec-settime"/> for more information.) + </para> + <para> + <command>named</command> will periodically search the key directory + for keys matching the zone, and if the keys' metadata indicates + that any change should be made the zone, such as adding, removing, + or revoking a key, then that action will be carried out. By default, + the key directory is checked for changes every 60 minutes; this period + can be adjusted with the <option>dnssec-loadkeys-interval</option>, up + to a maximum of 24 hours. The <command>rndc loadkeys</command> forces + <command>named</command> to check for key updates immediately. + </para> + <para> If keys are present in the key directory the first time the zone - is loaded, it will be signed immediately, without waiting for an + is loaded, the zone will be signed immediately, without waiting for an <command>rndc sign</command> or <command>rndc loadkeys</command> command. (Those commands can still be used when there are unscheduled key changes, however.) </para> + <para> + If you wish the zone to be signed using NSEC3 instead of NSEC, + submit an NSEC3PARAM record via dynamic update prior to the + scheduled publication and activation of the keys. If you wish the + NSEC3 chain to have the OPTOUT bit set, set it in the flags field + of the NSEC3PARAM record. The NSEC3PARAM record will not appear in + the zone immediately, but it will be stored for later reference. When + the zone is signed and the NSEC3 chain is completed, the NSEC3PARAM + record will appear in the zone. + </para> <para>Using the <command>auto-dnssec</command> option requires the zone to be configured to allow dynamic updates, by adding an diff --git a/doc/arm/man.arpaname.html b/doc/arm/man.arpaname.html index c57540b..45391da 100644 --- a/doc/arm/man.arpaname.html +++ b/doc/arm/man.arpaname.html @@ -50,20 +50,20 @@ <div class="cmdsynopsis"><p><code class="command">arpaname</code> {<em class="replaceable"><code>ipaddress </code></em>...}</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2617315"></a><h2>DESCRIPTION</h2> +<a name="id2619538"></a><h2>DESCRIPTION</h2> <p> <span><strong class="command">arpaname</strong></span> translates IP addresses (IPv4 and IPv6) to the corresponding IN-ADDR.ARPA or IP6.ARPA names. </p> </div> <div class="refsect1" lang="en"> -<a name="id2617330"></a><h2>SEE ALSO</h2> +<a name="id2619553"></a><h2>SEE ALSO</h2> <p> <em class="citetitle">BIND 9 Administrator Reference Manual</em>. </p> </div> <div class="refsect1" lang="en"> -<a name="id2651272"></a><h2>AUTHOR</h2> +<a name="id2619566"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/doc/arm/man.ddns-confgen.html b/doc/arm/man.ddns-confgen.html index 3555d51..fed8fbc 100644 --- a/doc/arm/man.ddns-confgen.html +++ b/doc/arm/man.ddns-confgen.html @@ -50,7 +50,7 @@ <div class="cmdsynopsis"><p><code class="command">ddns-confgen</code> [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>keyname</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomfile</code></em></code>] [ -s <em class="replaceable"><code>name</code></em> | -z <em class="replaceable"><code>zone</code></em> ] [<code class="option">-q</code>] [name]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2645394"></a><h2>DESCRIPTION</h2> +<a name="id2657925"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">ddns-confgen</strong></span> generates a key for use by <span><strong class="command">nsupdate</strong></span> and <span><strong class="command">named</strong></span>. It simplifies configuration @@ -77,7 +77,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2645481"></a><h2>OPTIONS</h2> +<a name="id2658012"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt> <dd><p> @@ -144,7 +144,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2653328"></a><h2>SEE ALSO</h2> +<a name="id2658418"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">nsupdate</span>(1)</span>, <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>, <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, @@ -152,7 +152,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2653366"></a><h2>AUTHOR</h2> +<a name="id2658456"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/doc/arm/man.dig.html b/doc/arm/man.dig.html index b2d2b54..556e34b 100644 --- a/doc/arm/man.dig.html +++ b/doc/arm/man.dig.html @@ -52,7 +52,7 @@ <div class="cmdsynopsis"><p><code class="command">dig</code> [global-queryopt...] [query...]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2610344"></a><h2>DESCRIPTION</h2> +<a name="id2611368"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">dig</strong></span> (domain information groper) is a flexible tool for interrogating DNS name servers. It performs DNS lookups and @@ -99,7 +99,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2610515"></a><h2>SIMPLE USAGE</h2> +<a name="id2611470"></a><h2>SIMPLE USAGE</h2> <p> A typical invocation of <span><strong class="command">dig</strong></span> looks like: </p> @@ -152,7 +152,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2610641"></a><h2>OPTIONS</h2> +<a name="id2611596"></a><h2>OPTIONS</h2> <p> The <code class="option">-b</code> option sets the source IP address of the query to <em class="parameter"><code>address</code></em>. This must be a valid @@ -256,7 +256,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2663207"></a><h2>QUERY OPTIONS</h2> +<a name="id2664641"></a><h2>QUERY OPTIONS</h2> <p><span><strong class="command">dig</strong></span> provides a number of query options which affect the way in which lookups are made and the results displayed. Some of @@ -341,7 +341,8 @@ policy of the server. AD=1 indicates that all records have been validated as secure and the answer is not from a OPT-OUT range. AD=0 indicate that some part - of the answer was insecure or not validated. + of the answer was insecure or not validated. This + bit is set by default. </p></dd> <dt><span class="term"><code class="option">+[no]cdflag</code></span></dt> <dd><p> @@ -360,15 +361,13 @@ </p></dd> <dt><span class="term"><code class="option">+[no]recurse</code></span></dt> <dd><p> - Toggle the setting of the RD (recursion desired) bit in the - query. - This bit is set by default, which means <span><strong class="command">dig</strong></span> - normally sends recursive queries. Recursion is automatically - disabled - when the <em class="parameter"><code>+nssearch</code></em> or - <em class="parameter"><code>+trace</code></em> query options are - used. - </p></dd> + Toggle the setting of the RD (recursion desired) bit + in the query. This bit is set by default, which means + <span><strong class="command">dig</strong></span> normally sends recursive + queries. Recursion is automatically disabled when + the <em class="parameter"><code>+nssearch</code></em> or + <em class="parameter"><code>+trace</code></em> query options are used. + </p></dd> <dt><span class="term"><code class="option">+[no]nssearch</code></span></dt> <dd><p> When this option is set, <span><strong class="command">dig</strong></span> @@ -380,18 +379,21 @@ zone. </p></dd> <dt><span class="term"><code class="option">+[no]trace</code></span></dt> -<dd><p> - Toggle tracing of the delegation path from the root name servers - for - the name being looked up. Tracing is disabled by default. When - tracing is enabled, <span><strong class="command">dig</strong></span> makes - iterative queries to - resolve the name being looked up. It will follow referrals from - the - root servers, showing the answer from each server that was used - to - resolve the lookup. - </p></dd> +<dd> +<p> + Toggle tracing of the delegation path from the root + name servers for the name being looked up. Tracing + is disabled by default. When tracing is enabled, + <span><strong class="command">dig</strong></span> makes iterative queries to + resolve the name being looked up. It will follow + referrals from the root servers, showing the answer + from each server that was used to resolve the lookup. + </p> +<p> + <span><strong class="command">+dnssec</strong></span> is also set when +trace is + set to better emulate the default queries from a nameserver. + </p> +</dd> <dt><span class="term"><code class="option">+[no]cmd</code></span></dt> <dd><p> Toggles the printing of the initial comment in the output @@ -418,8 +420,25 @@ <dt><span class="term"><code class="option">+[no]comments</code></span></dt> <dd><p> Toggle the display of comment lines in the output. The default - is to - print comments. + is to print comments. + </p></dd> +<dt><span class="term"><code class="option">+[no]rrcomments</code></span></dt> +<dd><p> + Toggle the display of per-record comments in the output (for + example, human-readable key information about DNSKEY records). + The default is not to print record comments unless multiline + mode is active. + </p></dd> +<dt><span class="term"><code class="option">+split=W</code></span></dt> +<dd><p> + Split long hex- or base64-formatted fields in resource + records into chunks of <em class="parameter"><code>W</code></em> characters + (where <em class="parameter"><code>W</code></em> is rounded up to the nearest + multiple of 4). + <em class="parameter"><code>+nosplit</code></em> or + <em class="parameter"><code>+split=0</code></em> causes fields not to be + split at all. The default is 56 characters, or 44 characters + when multiline mode is active. </p></dd> <dt><span class="term"><code class="option">+[no]stats</code></span></dt> <dd><p> @@ -514,9 +533,10 @@ <dt><span class="term"><code class="option">+edns=#</code></span></dt> <dd><p> Specify the EDNS version to query with. Valid values - are 0 to 255. Setting the EDNS version will cause a - EDNS query to be sent. <code class="option">+noedns</code> clears the - remembered EDNS version. + are 0 to 255. Setting the EDNS version will cause + a EDNS query to be sent. <code class="option">+noedns</code> + clears the remembered EDNS version. EDNS is set to + 0 by default. </p></dd> <dt><span class="term"><code class="option">+[no]multiline</code></span></dt> <dd><p> @@ -587,7 +607,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2664290"></a><h2>MULTIPLE QUERIES</h2> +<a name="id2665643"></a><h2>MULTIPLE QUERIES</h2> <p> The BIND 9 implementation of <span><strong class="command">dig </strong></span> supports @@ -633,7 +653,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr </p> </div> <div class="refsect1" lang="en"> -<a name="id2664375"></a><h2>IDN SUPPORT</h2> +<a name="id2665729"></a><h2>IDN SUPPORT</h2> <p> If <span><strong class="command">dig</strong></span> has been built with IDN (internationalized domain name) support, it can accept and display non-ASCII domain names. @@ -647,14 +667,14 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr </p> </div> <div class="refsect1" lang="en"> -<a name="id2664540"></a><h2>FILES</h2> +<a name="id2665962"></a><h2>FILES</h2> <p><code class="filename">/etc/resolv.conf</code> </p> <p><code class="filename">${HOME}/.digrc</code> </p> </div> <div class="refsect1" lang="en"> -<a name="id2664562"></a><h2>SEE ALSO</h2> +<a name="id2665984"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">host</span>(1)</span>, <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>, @@ -662,7 +682,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr </p> </div> <div class="refsect1" lang="en"> -<a name="id2664599"></a><h2>BUGS</h2> +<a name="id2666021"></a><h2>BUGS</h2> <p> There are probably too many query options. </p> diff --git a/doc/arm/man.dnssec-dsfromkey.html b/doc/arm/man.dnssec-dsfromkey.html index 6d8eeab..bb8d136 100644 --- a/doc/arm/man.dnssec-dsfromkey.html +++ b/doc/arm/man.dnssec-dsfromkey.html @@ -22,7 +22,7 @@ <meta name="generator" content="DocBook XSL Stylesheets V1.71.1"> <link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual"> <link rel="up" href="Bv9ARM.ch10.html" title="Manual pages"> -<link rel="prev" href="man.host.html" title="host"> +<link rel="prev" href="man.dnssec-coverage.html" title="dnssec-coverage"> <link rel="next" href="man.dnssec-keyfromlabel.html" title="dnssec-keyfromlabel"> </head> <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"> @@ -31,7 +31,7 @@ <tr><th colspan="3" align="center"><span class="application">dnssec-dsfromkey</span></th></tr> <tr> <td width="20%" align="left"> -<a accesskey="p" href="man.host.html">Prev</a> </td> +<a accesskey="p" href="man.dnssec-coverage.html">Prev</a> </td> <th width="60%" align="center">Manual pages</th> <td width="20%" align="right"> <a accesskey="n" href="man.dnssec-keyfromlabel.html">Next</a> </td> @@ -47,18 +47,18 @@ </div> <div class="refsynopsisdiv"> <h2>Synopsis</h2> -<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] {keyfile}</p></div> -<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> {-s} [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-s</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-A</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {dnsname}</p></div> +<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] {keyfile}</p></div> +<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> {-s} [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-s</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-A</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {dnsname}</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2612124"></a><h2>DESCRIPTION</h2> +<a name="id2615475"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">dnssec-dsfromkey</strong></span> outputs the Delegation Signer (DS) resource record (RR), as defined in RFC 3658 and RFC 4509, for the given key(s). </p> </div> <div class="refsect1" lang="en"> -<a name="id2612138"></a><h2>OPTIONS</h2> +<a name="id2615489"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-1</span></dt> <dd><p> @@ -76,6 +76,10 @@ SHA-256 (SHA256), GOST or SHA-384 (SHA384). These values are case insensitive. </p></dd> +<dt><span class="term">-T <em class="replaceable"><code>TTL</code></em></span></dt> +<dd><p> + Specifies the TTL of the DS records. + </p></dd> <dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt> <dd><p> Look for key files (or, in keyset mode, @@ -83,12 +87,23 @@ <code class="option">directory</code>. </p></dd> <dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt> -<dd><p> +<dd> +<p> Zone file mode: in place of the keyfile name, the argument is the DNS domain name of a zone master file, which can be read from <code class="option">file</code>. If the zone name is the same as <code class="option">file</code>, then it may be omitted. - </p></dd> + </p> +<p> + If <code class="option">file</code> is set to <code class="literal">"-"</code>, then + the zone data is read from the standard input. This makes it + possible to use the output of the <span><strong class="command">dig</strong></span> + command as input, as in: + </p> +<p> + <strong class="userinput"><code>dig dnskey example.com | dnssec-dsfromkey -f - example.com</code></strong> + </p> +</dd> <dt><span class="term">-A</span></dt> <dd><p> Include ZSK's when generating DS records. Without this option, @@ -120,7 +135,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2612327"></a><h2>EXAMPLE</h2> +<a name="id2615860"></a><h2>EXAMPLE</h2> <p> To build the SHA-256 DS RR from the <strong class="userinput"><code>Kexample.com.+003+26160</code></strong> @@ -135,7 +150,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2612568"></a><h2>FILES</h2> +<a name="id2615896"></a><h2>FILES</h2> <p> The keyfile can be designed by the key identification <code class="filename">Knnnn.+aaa+iiiii</code> or the full file name @@ -149,13 +164,13 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2612610"></a><h2>CAVEAT</h2> +<a name="id2615938"></a><h2>CAVEAT</h2> <p> A keyfile error can give a "file not found" even if the file exists. </p> </div> <div class="refsect1" lang="en"> -<a name="id2612619"></a><h2>SEE ALSO</h2> +<a name="id2615947"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>, <em class="citetitle">BIND 9 Administrator Reference Manual</em>, @@ -165,7 +180,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2612659"></a><h2>AUTHOR</h2> +<a name="id2615987"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> @@ -175,13 +190,14 @@ <table width="100%" summary="Navigation footer"> <tr> <td width="40%" align="left"> -<a accesskey="p" href="man.host.html">Prev</a> </td> +<a accesskey="p" href="man.dnssec-coverage.html">Prev</a> </td> <td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td> <td width="40%" align="right"> <a accesskey="n" href="man.dnssec-keyfromlabel.html">Next</a> </td> </tr> <tr> -<td width="40%" align="left" valign="top">host </td> +<td width="40%" align="left" valign="top"> +<span class="application">dnssec-coverage</span> </td> <td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td> <td width="40%" align="right" valign="top"> <span class="application">dnssec-keyfromlabel</span> </td> diff --git a/doc/arm/man.dnssec-keyfromlabel.html b/doc/arm/man.dnssec-keyfromlabel.html index b691828..dad8837 100644 --- a/doc/arm/man.dnssec-keyfromlabel.html +++ b/doc/arm/man.dnssec-keyfromlabel.html @@ -47,10 +47,10 @@ </div> <div class="refsynopsisdiv"> <h2>Synopsis</h2> -<div class="cmdsynopsis"><p><code class="command">dnssec-keyfromlabel</code> {-l <em class="replaceable"><code>label</code></em>} [<code class="option">-3</code>] [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-k</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-y</code>] {name}</p></div> +<div class="cmdsynopsis"><p><code class="command">dnssec-keyfromlabel</code> {-l <em class="replaceable"><code>label</code></em>} [<code class="option">-3</code>] [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-k</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-y</code>] {name}</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2613242"></a><h2>DESCRIPTION</h2> +<a name="id2616617"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">dnssec-keyfromlabel</strong></span> gets keys with the given label from a crypto hardware and builds key files for DNSSEC (Secure DNS), as defined in RFC 2535 @@ -63,7 +63,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2614013"></a><h2>OPTIONS</h2> +<a name="id2616637"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt> <dd> @@ -154,6 +154,15 @@ <dd><p> Generate KEY records rather than DNSKEY records. </p></dd> +<dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt> +<dd><p> + Sets the default TTL to use for this key when it is converted + into a DNSKEY RR. If the key is imported into a zone, + this is the TTL that will be used for it, unless there was + already a DNSKEY RRset in place, in which case the existing TTL + would take precedence. Setting the default TTL to + <code class="literal">0</code> or <code class="literal">none</code> removes it. + </p></dd> <dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt> <dd><p> Sets the protocol value for the key. The protocol @@ -183,7 +192,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2614859"></a><h2>TIMING OPTIONS</h2> +<a name="id2618535"></a><h2>TIMING OPTIONS</h2> <p> Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '-', it is interpreted as @@ -230,7 +239,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2616323"></a><h2>GENERATED KEY FILES</h2> +<a name="id2618633"></a><h2>GENERATED KEY FILES</h2> <p> When <span><strong class="command">dnssec-keyfromlabel</strong></span> completes successfully, @@ -269,7 +278,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2616417"></a><h2>SEE ALSO</h2> +<a name="id2669176"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>, <em class="citetitle">BIND 9 Administrator Reference Manual</em>, @@ -277,7 +286,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2616450"></a><h2>AUTHOR</h2> +<a name="id2669209"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/doc/arm/man.dnssec-keygen.html b/doc/arm/man.dnssec-keygen.html index 2852022..8f846e0 100644 --- a/doc/arm/man.dnssec-keygen.html +++ b/doc/arm/man.dnssec-keygen.html @@ -47,10 +47,10 @@ </div> <div class="refsynopsisdiv"> <h2>Synopsis</h2> -<div class="cmdsynopsis"><p><code class="command">dnssec-keygen</code> [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-3</code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-C</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-e</code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-g <em class="replaceable"><code>generator</code></em></code>] [<code class="option">-h</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-k</code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-q</code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S <em class="replaceable"><code>key</code></em></code>] [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-z</code>] {name}</p></div> +<div class="cmdsynopsis"><p><code class="command">dnssec-keygen</code> [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-3</code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-C</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-g <em class="replaceable"><code>generator</code></em></code>] [<code class="option">-h</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-k</code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-q</code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S <em class="replaceable"><code>key</code></em></code>] [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-z</code>] {name}</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2615154"></a><h2>DESCRIPTION</h2> +<a name="id2617453"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">dnssec-keygen</strong></span> generates keys for DNSSEC (Secure DNS), as defined in RFC 2535 and RFC 4034. It can also generate keys for use with @@ -64,7 +64,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2615174"></a><h2>OPTIONS</h2> +<a name="id2617474"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt> <dd> @@ -157,10 +157,6 @@ support it defaults to pkcs11; the empty name resets it to no engine. </p></dd> -<dt><span class="term">-e</span></dt> -<dd><p> - If generating an RSAMD5/RSASHA1 key, use a large exponent. - </p></dd> <dt><span class="term">-f <em class="replaceable"><code>flag</code></em></span></dt> <dd><p> Set the specified flag in the flag field of the KEY/DNSKEY record. @@ -191,6 +187,15 @@ <dd><p> Deprecated in favor of -T KEY. </p></dd> +<dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt> +<dd><p> + Sets the default TTL to use for this key when it is converted + into a DNSKEY RR. If the key is imported into a zone, + this is the TTL that will be used for it, unless there was + already a DNSKEY RRset in place, in which case the existing TTL + would take precedence. Setting the default TTL to + <code class="literal">0</code> or <code class="literal">none</code> removes it. + </p></dd> <dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt> <dd><p> Sets the protocol value for the generated key. The protocol @@ -269,7 +274,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2669210"></a><h2>TIMING OPTIONS</h2> +<a name="id2669682"></a><h2>TIMING OPTIONS</h2> <p> Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '-', it is interpreted as @@ -340,7 +345,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2669332"></a><h2>GENERATED KEYS</h2> +<a name="id2669872"></a><h2>GENERATED KEYS</h2> <p> When <span><strong class="command">dnssec-keygen</strong></span> completes successfully, @@ -386,7 +391,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2669508"></a><h2>EXAMPLE</h2> +<a name="id2669979"></a><h2>EXAMPLE</h2> <p> To generate a 768-bit DSA key for the domain <strong class="userinput"><code>example.com</code></strong>, the following command would be @@ -407,7 +412,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2669564"></a><h2>SEE ALSO</h2> +<a name="id2670036"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>, <em class="citetitle">BIND 9 Administrator Reference Manual</em>, <em class="citetitle">RFC 2539</em>, @@ -416,7 +421,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2669732"></a><h2>AUTHOR</h2> +<a name="id2670067"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/doc/arm/man.dnssec-revoke.html b/doc/arm/man.dnssec-revoke.html index b1eb691..c6490ef 100644 --- a/doc/arm/man.dnssec-revoke.html +++ b/doc/arm/man.dnssec-revoke.html @@ -50,7 +50,7 @@ <div class="cmdsynopsis"><p><code class="command">dnssec-revoke</code> [<code class="option">-hr</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f</code>] [<code class="option">-R</code>] {keyfile}</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2616000"></a><h2>DESCRIPTION</h2> +<a name="id2617950"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">dnssec-revoke</strong></span> reads a DNSSEC key file, sets the REVOKED bit on the key as defined in RFC 5011, and creates a new pair of key files containing the @@ -58,7 +58,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2616013"></a><h2>OPTIONS</h2> +<a name="id2617964"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-h</span></dt> <dd><p> @@ -96,14 +96,14 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2616134"></a><h2>SEE ALSO</h2> +<a name="id2618085"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>, <em class="citetitle">BIND 9 Administrator Reference Manual</em>, <em class="citetitle">RFC 5011</em>. </p> </div> <div class="refsect1" lang="en"> -<a name="id2616158"></a><h2>AUTHOR</h2> +<a name="id2618109"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/doc/arm/man.dnssec-settime.html b/doc/arm/man.dnssec-settime.html index 541223c..3e121c4 100644 --- a/doc/arm/man.dnssec-settime.html +++ b/doc/arm/man.dnssec-settime.html @@ -47,10 +47,10 @@ </div> <div class="refsynopsisdiv"> <h2>Synopsis</h2> -<div class="cmdsynopsis"><p><code class="command">dnssec-settime</code> [<code class="option">-f</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] {keyfile}</p></div> +<div class="cmdsynopsis"><p><code class="command">dnssec-settime</code> [<code class="option">-f</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] {keyfile}</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2616615"></a><h2>DESCRIPTION</h2> +<a name="id2619165"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">dnssec-settime</strong></span> reads a DNSSEC private key file and sets the key timing metadata as specified by the <code class="option">-P</code>, <code class="option">-A</code>, @@ -76,7 +76,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2616742"></a><h2>OPTIONS</h2> +<a name="id2619224"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-f</span></dt> <dd><p> @@ -93,6 +93,15 @@ <dd><p> Sets the directory in which the key files are to reside. </p></dd> +<dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt> +<dd><p> + Sets the default TTL to use for this key when it is converted + into a DNSKEY RR. If the key is imported into a zone, + this is the TTL that will be used for it, unless there was + already a DNSKEY RRset in place, in which case the existing TTL + would take precedence. Setting the default TTL to + <code class="literal">0</code> or <code class="literal">none</code> removes it. + </p></dd> <dt><span class="term">-h</span></dt> <dd><p> Emit usage message and exit. @@ -109,7 +118,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2616836"></a><h2>TIMING OPTIONS</h2> +<a name="id2619346"></a><h2>TIMING OPTIONS</h2> <p> Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '-', it is interpreted as @@ -188,7 +197,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2616974"></a><h2>PRINTING OPTIONS</h2> +<a name="id2620167"></a><h2>PRINTING OPTIONS</h2> <p> <span><strong class="command">dnssec-settime</strong></span> can also be used to print the timing metadata associated with a key. @@ -214,7 +223,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2617123"></a><h2>SEE ALSO</h2> +<a name="id2620315"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>, <em class="citetitle">BIND 9 Administrator Reference Manual</em>, @@ -222,7 +231,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2617156"></a><h2>AUTHOR</h2> +<a name="id2621372"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/doc/arm/man.dnssec-signzone.html b/doc/arm/man.dnssec-signzone.html index 4f73bf4..290e770 100644 --- a/doc/arm/man.dnssec-signzone.html +++ b/doc/arm/man.dnssec-signzone.html @@ -23,7 +23,7 @@ <link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual"> <link rel="up" href="Bv9ARM.ch10.html" title="Manual pages"> <link rel="prev" href="man.dnssec-settime.html" title="dnssec-settime"> -<link rel="next" href="man.named-checkconf.html" title="named-checkconf"> +<link rel="next" href="man.dnssec-verify.html" title="dnssec-verify"> </head> <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"> <div class="navheader"> @@ -33,7 +33,7 @@ <td width="20%" align="left"> <a accesskey="p" href="man.dnssec-settime.html">Prev</a> </td> <th width="60%" align="center">Manual pages</th> -<td width="20%" align="right"> <a accesskey="n" href="man.named-checkconf.html">Next</a> +<td width="20%" align="right"> <a accesskey="n" href="man.dnssec-verify.html">Next</a> </td> </tr> </table> @@ -47,10 +47,10 @@ </div> <div class="refsynopsisdiv"> <h2>Synopsis</h2> -<div class="cmdsynopsis"><p><code class="command">dnssec-signzone</code> [<code class="option">-a</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>] [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>] [<code class="option">-g</code>] [<code class="option">-h</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-j <em class="replaceable"><code>jitter</code></em></code>] [<code class="option">-N <em class="replaceable"><code>soa-serial-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>] [<code class="option">-p</code>] [<code class="option">-P</code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S</code>] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-T <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-t</code>] [<code class="option">-u</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-x</code>] [<code class="option">-z</code>] [<code class="option">-3 <em class="replaceable"><code>salt</code></em></code>] [<code class="option">-H <em class="replaceable"><code>iterations</code></em></code>] [<code class="option">-A</code>] {zonefile} [key...]</p></div> +<div class="cmdsynopsis"><p><code class="command">dnssec-signzone</code> [<code class="option">-a</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>] [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>] [<code class="option">-g</code>] [<code class="option">-h</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key</code></em></code>] [<code class="option">-L <em class="replaceable"><code>serial</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-j <em class="replaceable"><code>jitter</code></em></code>] [<code class="option">-N <em class="replaceable"><code>soa-serial-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>] [<code class="option">-P</code>] [<code class="option">-p</code>] [<code class="option">-R</code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S</code>] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-T <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-t</code>] [<code class="option">-u</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-X <em class="replaceable"><code>extended end-time</code></em></code>] [<code class="option">-x</code>] [<code class="option">-z</code>] [<code class="option">-3 <em class="replaceable"><code>salt</code></em></code>] [<code class="option">-H <em class="replaceable"><code>iterations</code></em></code>] [<code class="option">-A</code>] {zonefile} [key...]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2618290"></a><h2>DESCRIPTION</h2> +<a name="id2620935"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">dnssec-signzone</strong></span> signs a zone. It generates NSEC and RRSIG records and produces a signed version of the @@ -61,7 +61,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2618309"></a><h2>OPTIONS</h2> +<a name="id2620954"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-a</span></dt> <dd><p> @@ -85,6 +85,17 @@ Look for <code class="filename">dsset-</code> or <code class="filename">keyset-</code> files in <code class="option">directory</code>. </p></dd> +<dt><span class="term">-D</span></dt> +<dd><p> + Output only those record types automatically managed by + <span><strong class="command">dnssec-signzone</strong></span>, i.e. RRSIG, NSEC, + NSEC3 and NSEC3PARAM records. If smart signing + (<code class="option">-S</code>) is used, DNSKEY records are also + included. The resulting file can be included in the original + zone file with <span><strong class="command">$INCLUDE</strong></span>. This option + cannot be combined with <code class="option">-O raw</code> or serial + number updating. + </p></dd> <dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt> <dd><p> Uses a crypto hardware (OpenSSL engine) for the crypto operations @@ -136,12 +147,36 @@ <code class="option">end-time</code> must be later than <code class="option">start-time</code>. </p></dd> +<dt><span class="term">-X <em class="replaceable"><code>extended end-time</code></em></span></dt> +<dd> +<p> + Specify the date and time when the generated RRSIG records + for the DNSKEY RRset will expire. This is to be used in cases + when the DNSKEY signatures need to persist longer than + signatures on other records; e.g., when the private component + of the KSK is kept offline and the KSK signature is to be + refreshed manually. + </p> +<p> + As with <code class="option">start-time</code>, an absolute + time is indicated in YYYYMMDDHHMMSS notation. A time relative + to the start time is indicated with +N, which is N seconds from + the start time. A time relative to the current time is + indicated with now+N. If no <code class="option">extended end-time</code> is + specified, the value of <code class="option">end-time</code> is used as + the default. (<code class="option">end-time</code>, in turn, defaults to + 30 days from the start time.) <code class="option">extended end-time</code> + must be later than <code class="option">start-time</code>. + </p> +</dd> <dt><span class="term">-f <em class="replaceable"><code>output-file</code></em></span></dt> <dd><p> The name of the output file containing the signed zone. The default is to append <code class="filename">.signed</code> to - the - input filename. + the input filename. If <code class="option">output-file</code> is + set to <code class="literal">"-"</code>, then the signed zone is + written to the standard output, with a default output + format of "full". </p></dd> <dt><span class="term">-h</span></dt> <dd><p> @@ -202,6 +237,12 @@ validators need to refetch at mostly the same time. </p> </dd> +<dt><span class="term">-L <em class="replaceable"><code>serial</code></em></span></dt> +<dd><p> + When writing a signed zone to 'raw' format, set the "source serial" + value in the header to the specified serial number. (This is + expected to be used primarily for testing purposes.) + </p></dd> <dt><span class="term">-n <em class="replaceable"><code>ncpus</code></em></span></dt> <dd><p> Specifies the number of threads to use. By default, one @@ -235,7 +276,15 @@ <dd><p> The format of the output file containing the signed zone. Possible formats are <span><strong class="command">"text"</strong></span> (default) - and <span><strong class="command">"raw"</strong></span>. + <span><strong class="command">"full"</strong></span>, which is text output in a + format suitable for processing by external scripts, + and <span><strong class="command">"raw"</strong></span> or <span><strong class="command">"raw=N"</strong></span>, + which store the zone in a binary format for rapid loading + by <span><strong class="command">named</strong></span>. <span><strong class="command">"raw=N"</strong></span> + specifies the format version of the raw zone file: if N + is 0, the raw file can be read by any version of + <span><strong class="command">named</strong></span>; if N is 1, the file can be + read by release 9.9.0 or higher. The default is 1. </p></dd> <dt><span class="term">-p</span></dt> <dd><p> @@ -257,6 +306,22 @@ This option skips these tests. </p> </dd> +<dt><span class="term">-R</span></dt> +<dd> +<p> + Remove signatures from keys that no longer exist. + </p> +<p> + Normally, when a previously-signed zone is passed as input + to the signer, and a DNSKEY record has been removed and + replaced with a new one, signatures from the old key + that are still within their validity period are retained. + This allows the zone to continue to validate with cached + copies of the old DNSKEY RRset. The <code class="option">-R</code> forces + <span><strong class="command">dnssec-signzone</strong></span> to remove all orphaned + signatures. + </p> +</dd> <dt><span class="term">-r <em class="replaceable"><code>randomdev</code></em></span></dt> <dd><p> Specifies the source of randomness. If the operating @@ -315,15 +380,17 @@ </dd> <dt><span class="term">-T <em class="replaceable"><code>ttl</code></em></span></dt> <dd><p> - Specifies the TTL to be used for new DNSKEY records imported - into the zone from the key repository. If not specified, - the default is the minimum TTL value from the zone's SOA + Specifies a TTL to be used for new DNSKEY records imported + into the zone from the key repository. If not + specified, the default is the TTL value from the zone's SOA record. This option is ignored when signing without <code class="option">-S</code>, since DNSKEY records are not imported from the key repository in that case. It is also ignored if there are any pre-existing DNSKEY records at the zone apex, in which case new records' TTL values will be set to match - them. + them, or if any of the imported DNSKEY records had a default + TTL value. In the event of a a conflict between TTL values in + imported keys, the shortest one is used. </p></dd> <dt><span class="term">-t</span></dt> <dd><p> @@ -397,7 +464,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2672630"></a><h2>EXAMPLE</h2> +<a name="id2675701"></a><h2>EXAMPLE</h2> <p> The following command signs the <strong class="userinput"><code>example.com</code></strong> zone with the DSA key generated by <span><strong class="command">dnssec-keygen</strong></span> @@ -427,14 +494,14 @@ db.example.com.signed %</pre> </div> <div class="refsect1" lang="en"> -<a name="id2672709"></a><h2>SEE ALSO</h2> +<a name="id2675848"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>, <em class="citetitle">BIND 9 Administrator Reference Manual</em>, <em class="citetitle">RFC 4033</em>. </p> </div> <div class="refsect1" lang="en"> -<a name="id2672733"></a><h2>AUTHOR</h2> +<a name="id2675873"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> @@ -446,14 +513,14 @@ db.example.com.signed <td width="40%" align="left"> <a accesskey="p" href="man.dnssec-settime.html">Prev</a> </td> <td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td> -<td width="40%" align="right"> <a accesskey="n" href="man.named-checkconf.html">Next</a> +<td width="40%" align="right"> <a accesskey="n" href="man.dnssec-verify.html">Next</a> </td> </tr> <tr> <td width="40%" align="left" valign="top"> <span class="application">dnssec-settime</span> </td> <td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td> -<td width="40%" align="right" valign="top"> <span class="application">named-checkconf</span> +<td width="40%" align="right" valign="top"> <span class="application">dnssec-verify</span> </td> </tr> </table> diff --git a/doc/arm/man.dnssec-verify.html b/doc/arm/man.dnssec-verify.html new file mode 100644 index 0000000..d8a0bf0 --- /dev/null +++ b/doc/arm/man.dnssec-verify.html @@ -0,0 +1,156 @@ +<!-- + - Copyright (C) 2004-2013 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2000-2003 Internet Software Consortium. + - + - Permission to use, copy, modify, and/or distribute this software for any + - purpose with or without fee is hereby granted, provided that the above + - copyright notice and this permission notice appear in all copies. + - + - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + - PERFORMANCE OF THIS SOFTWARE. +--> +<!-- $Id$ --> +<html> +<head> +<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> +<title>dnssec-verify</title> +<meta name="generator" content="DocBook XSL Stylesheets V1.71.1"> +<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual"> +<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages"> +<link rel="prev" href="man.dnssec-signzone.html" title="dnssec-signzone"> +<link rel="next" href="man.named-checkconf.html" title="named-checkconf"> +</head> +<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"> +<div class="navheader"> +<table width="100%" summary="Navigation header"> +<tr><th colspan="3" align="center"><span class="application">dnssec-verify</span></th></tr> +<tr> +<td width="20%" align="left"> +<a accesskey="p" href="man.dnssec-signzone.html">Prev</a> </td> +<th width="60%" align="center">Manual pages</th> +<td width="20%" align="right"> <a accesskey="n" href="man.named-checkconf.html">Next</a> +</td> +</tr> +</table> +<hr> +</div> +<div class="refentry" lang="en"> +<a name="man.dnssec-verify"></a><div class="titlepage"></div> +<div class="refnamediv"> +<h2>Name</h2> +<p><span class="application">dnssec-verify</span> — DNSSEC zone verification tool</p> +</div> +<div class="refsynopsisdiv"> +<h2>Synopsis</h2> +<div class="cmdsynopsis"><p><code class="command">dnssec-verify</code> [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-x</code>] [<code class="option">-z</code>] {zonefile}</p></div> +</div> +<div class="refsect1" lang="en"> +<a name="id2622443"></a><h2>DESCRIPTION</h2> +<p><span><strong class="command">dnssec-verify</strong></span> + verifies that a zone is fully signed for each algorithm found + in the DNSKEY RRset for the zone, and that the NSEC / NSEC3 + chains are complete. + </p> +</div> +<div class="refsect1" lang="en"> +<a name="id2622457"></a><h2>OPTIONS</h2> +<div class="variablelist"><dl> +<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt> +<dd><p> + Specifies the DNS class of the zone. + </p></dd> +<dt><span class="term">-I <em class="replaceable"><code>input-format</code></em></span></dt> +<dd><p> + The format of the input zone file. + Possible formats are <span><strong class="command">"text"</strong></span> (default) + and <span><strong class="command">"raw"</strong></span>. + This option is primarily intended to be used for dynamic + signed zones so that the dumped zone file in a non-text + format containing updates can be verified independently. + The use of this option does not make much sense for + non-dynamic zones. + </p></dd> +<dt><span class="term">-o <em class="replaceable"><code>origin</code></em></span></dt> +<dd><p> + The zone origin. If not specified, the name of the zone file + is assumed to be the origin. + </p></dd> +<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt> +<dd><p> + Sets the debugging level. + </p></dd> +<dt><span class="term">-x</span></dt> +<dd><p> + Only verify that the DNSKEY RRset is signed with key-signing + keys. Without this flag, it is assumed that the DNSKEY RRset + will be signed by all active keys. When this flag is set, + it will not be an error if the DNSKEY RRset is not signed + by zone-signing keys. This corresponds to the <code class="option">-x</code> + option in <span><strong class="command">dnssec-signzone</strong></span>. + </p></dd> +<dt><span class="term">-z</span></dt> +<dd> +<p> + Ignore the KSK flag on the keys when determining whether + the zone if correctly signed. Without this flag it is + assumed that there will be a non-revoked, self-signed + DNSKEY with the KSK flag set for each algorithm and + that RRsets other than DNSKEY RRset will be signed with + a different DNSKEY without the KSK flag set. + </p> +<p> + With this flag set, we only require that for each algorithm, + there will be at least one non-revoked, self-signed DNSKEY, + regardless of the KSK flag state, and that other RRsets + will be signed by a non-revoked key for the same algorithm + that includes the self-signed key; the same key may be used + for both purposes. This corresponds to the <code class="option">-z</code> + option in <span><strong class="command">dnssec-signzone</strong></span>. + </p> +</dd> +<dt><span class="term">zonefile</span></dt> +<dd><p> + The file containing the zone to be signed. + </p></dd> +</dl></div> +</div> +<div class="refsect1" lang="en"> +<a name="id2622606"></a><h2>SEE ALSO</h2> +<p> + <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>, + <em class="citetitle">BIND 9 Administrator Reference Manual</em>, + <em class="citetitle">RFC 4033</em>. + </p> +</div> +<div class="refsect1" lang="en"> +<a name="id2622632"></a><h2>AUTHOR</h2> +<p><span class="corpauthor">Internet Systems Consortium</span> + </p> +</div> +</div> +<div class="navfooter"> +<hr> +<table width="100%" summary="Navigation footer"> +<tr> +<td width="40%" align="left"> +<a accesskey="p" href="man.dnssec-signzone.html">Prev</a> </td> +<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td> +<td width="40%" align="right"> <a accesskey="n" href="man.named-checkconf.html">Next</a> +</td> +</tr> +<tr> +<td width="40%" align="left" valign="top"> +<span class="application">dnssec-signzone</span> </td> +<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td> +<td width="40%" align="right" valign="top"> <span class="application">named-checkconf</span> +</td> +</tr> +</table> +</div> +</body> +</html> diff --git a/doc/arm/man.genrandom.html b/doc/arm/man.genrandom.html index 596ddda..e7f0eeb 100644 --- a/doc/arm/man.genrandom.html +++ b/doc/arm/man.genrandom.html @@ -50,7 +50,7 @@ <div class="cmdsynopsis"><p><code class="command">genrandom</code> [<code class="option">-n <em class="replaceable"><code>number</code></em></code>] {<em class="replaceable"><code>size</code></em>} {<em class="replaceable"><code>filename</code></em>}</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2653420"></a><h2>DESCRIPTION</h2> +<a name="id2619662"></a><h2>DESCRIPTION</h2> <p> <span><strong class="command">genrandom</strong></span> generates a file or a set of files containing a specified quantity @@ -59,7 +59,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2653435"></a><h2>ARGUMENTS</h2> +<a name="id2658794"></a><h2>ARGUMENTS</h2> <div class="variablelist"><dl> <dt><span class="term">-n <em class="replaceable"><code>number</code></em></span></dt> <dd><p> @@ -77,14 +77,14 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2653496"></a><h2>SEE ALSO</h2> +<a name="id2658855"></a><h2>SEE ALSO</h2> <p> <span class="citerefentry"><span class="refentrytitle">rand</span>(3)</span>, <span class="citerefentry"><span class="refentrytitle">arc4random</span>(3)</span> </p> </div> <div class="refsect1" lang="en"> -<a name="id2653523"></a><h2>AUTHOR</h2> +<a name="id2658882"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/doc/arm/man.host.html b/doc/arm/man.host.html index f4f0ef8..2166dd2 100644 --- a/doc/arm/man.host.html +++ b/doc/arm/man.host.html @@ -23,7 +23,7 @@ <link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual"> <link rel="up" href="Bv9ARM.ch10.html" title="Manual pages"> <link rel="prev" href="man.dig.html" title="dig"> -<link rel="next" href="man.dnssec-dsfromkey.html" title="dnssec-dsfromkey"> +<link rel="next" href="man.dnssec-checkds.html" title="dnssec-checkds"> </head> <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"> <div class="navheader"> @@ -33,7 +33,7 @@ <td width="20%" align="left"> <a accesskey="p" href="man.dig.html">Prev</a> </td> <th width="60%" align="center">Manual pages</th> -<td width="20%" align="right"> <a accesskey="n" href="man.dnssec-dsfromkey.html">Next</a> +<td width="20%" align="right"> <a accesskey="n" href="man.dnssec-checkds.html">Next</a> </td> </tr> </table> @@ -50,7 +50,7 @@ <div class="cmdsynopsis"><p><code class="command">host</code> [<code class="option">-aCdlnrsTwv</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-N <em class="replaceable"><code>ndots</code></em></code>] [<code class="option">-R <em class="replaceable"><code>number</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-W <em class="replaceable"><code>wait</code></em></code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-4</code>] [<code class="option">-6</code>] {name} [server]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2611090"></a><h2>DESCRIPTION</h2> +<a name="id2612042"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">host</strong></span> is a simple utility for performing DNS lookups. It is normally used to convert names to IP addresses and vice versa. @@ -202,7 +202,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2611877"></a><h2>IDN SUPPORT</h2> +<a name="id2613034"></a><h2>IDN SUPPORT</h2> <p> If <span><strong class="command">host</strong></span> has been built with IDN (internationalized domain name) support, it can accept and display non-ASCII domain names. @@ -216,12 +216,12 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2613954"></a><h2>FILES</h2> +<a name="id2613131"></a><h2>FILES</h2> <p><code class="filename">/etc/resolv.conf</code> </p> </div> <div class="refsect1" lang="en"> -<a name="id2613968"></a><h2>SEE ALSO</h2> +<a name="id2613145"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>, <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>. </p> @@ -234,13 +234,13 @@ <td width="40%" align="left"> <a accesskey="p" href="man.dig.html">Prev</a> </td> <td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td> -<td width="40%" align="right"> <a accesskey="n" href="man.dnssec-dsfromkey.html">Next</a> +<td width="40%" align="right"> <a accesskey="n" href="man.dnssec-checkds.html">Next</a> </td> </tr> <tr> <td width="40%" align="left" valign="top">dig </td> <td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td> -<td width="40%" align="right" valign="top"> <span class="application">dnssec-dsfromkey</span> +<td width="40%" align="right" valign="top"> <span class="application">dnssec-checkds</span> </td> </tr> </table> diff --git a/doc/arm/man.isc-hmac-fixup.html b/doc/arm/man.isc-hmac-fixup.html index 9c2a961..5b35c38 100644 --- a/doc/arm/man.isc-hmac-fixup.html +++ b/doc/arm/man.isc-hmac-fixup.html @@ -50,7 +50,7 @@ <div class="cmdsynopsis"><p><code class="command">isc-hmac-fixup</code> {<em class="replaceable"><code>algorithm</code></em>} {<em class="replaceable"><code>secret</code></em>}</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2617529"></a><h2>DESCRIPTION</h2> +<a name="id2659345"></a><h2>DESCRIPTION</h2> <p> Versions of BIND 9 up to and including BIND 9.6 had a bug causing HMAC-SHA* TSIG keys which were longer than the digest length of the @@ -76,7 +76,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2653602"></a><h2>SECURITY CONSIDERATIONS</h2> +<a name="id2659372"></a><h2>SECURITY CONSIDERATIONS</h2> <p> Secrets that have been converted by <span><strong class="command">isc-hmac-fixup</strong></span> are shortened, but as this is how the HMAC protocol works in @@ -87,14 +87,14 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2653618"></a><h2>SEE ALSO</h2> +<a name="id2659388"></a><h2>SEE ALSO</h2> <p> <em class="citetitle">BIND 9 Administrator Reference Manual</em>, <em class="citetitle">RFC 2104</em>. </p> </div> <div class="refsect1" lang="en"> -<a name="id2653635"></a><h2>AUTHOR</h2> +<a name="id2659405"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/doc/arm/man.named-checkconf.html b/doc/arm/man.named-checkconf.html index 9a2f687..d120cb4 100644 --- a/doc/arm/man.named-checkconf.html +++ b/doc/arm/man.named-checkconf.html @@ -22,7 +22,7 @@ <meta name="generator" content="DocBook XSL Stylesheets V1.71.1"> <link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual"> <link rel="up" href="Bv9ARM.ch10.html" title="Manual pages"> -<link rel="prev" href="man.dnssec-signzone.html" title="dnssec-signzone"> +<link rel="prev" href="man.dnssec-verify.html" title="dnssec-verify"> <link rel="next" href="man.named-checkzone.html" title="named-checkzone"> </head> <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"> @@ -31,7 +31,7 @@ <tr><th colspan="3" align="center"><span class="application">named-checkconf</span></th></tr> <tr> <td width="20%" align="left"> -<a accesskey="p" href="man.dnssec-signzone.html">Prev</a> </td> +<a accesskey="p" href="man.dnssec-verify.html">Prev</a> </td> <th width="60%" align="center">Manual pages</th> <td width="20%" align="right"> <a accesskey="n" href="man.named-checkzone.html">Next</a> </td> @@ -50,7 +50,7 @@ <div class="cmdsynopsis"><p><code class="command">named-checkconf</code> [<code class="option">-h</code>] [<code class="option">-v</code>] [<code class="option">-j</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] {filename} [<code class="option">-p</code>] [<code class="option">-z</code>]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2619428"></a><h2>DESCRIPTION</h2> +<a name="id2628740"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">named-checkconf</strong></span> checks the syntax, but not the semantics, of a <span><strong class="command">named</strong></span> configuration file. The file is parsed @@ -70,7 +70,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2619498"></a><h2>OPTIONS</h2> +<a name="id2628810"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-h</span></dt> <dd><p> @@ -109,21 +109,21 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2619633"></a><h2>RETURN VALUES</h2> +<a name="id2634474"></a><h2>RETURN VALUES</h2> <p><span><strong class="command">named-checkconf</strong></span> returns an exit status of 1 if errors were detected and 0 otherwise. </p> </div> <div class="refsect1" lang="en"> -<a name="id2619646"></a><h2>SEE ALSO</h2> +<a name="id2634488"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">named-checkzone</span>(8)</span>, <em class="citetitle">BIND 9 Administrator Reference Manual</em>. </p> </div> <div class="refsect1" lang="en"> -<a name="id2619676"></a><h2>AUTHOR</h2> +<a name="id2634518"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> @@ -133,14 +133,14 @@ <table width="100%" summary="Navigation footer"> <tr> <td width="40%" align="left"> -<a accesskey="p" href="man.dnssec-signzone.html">Prev</a> </td> +<a accesskey="p" href="man.dnssec-verify.html">Prev</a> </td> <td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td> <td width="40%" align="right"> <a accesskey="n" href="man.named-checkzone.html">Next</a> </td> </tr> <tr> <td width="40%" align="left" valign="top"> -<span class="application">dnssec-signzone</span> </td> +<span class="application">dnssec-verify</span> </td> <td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td> <td width="40%" align="right" valign="top"> <span class="application">named-checkzone</span> </td> diff --git a/doc/arm/man.named-checkzone.html b/doc/arm/man.named-checkzone.html index 78fade2..b828f19 100644 --- a/doc/arm/man.named-checkzone.html +++ b/doc/arm/man.named-checkzone.html @@ -47,11 +47,11 @@ </div> <div class="refsynopsisdiv"> <h2>Synopsis</h2> -<div class="cmdsynopsis"><p><code class="command">named-checkzone</code> [<code class="option">-d</code>] [<code class="option">-h</code>] [<code class="option">-j</code>] [<code class="option">-q</code>] [<code class="option">-v</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-f <em class="replaceable"><code>format</code></em></code>] [<code class="option">-F <em class="replaceable"><code>format</code></em></code>] [<code class="option">-i <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-k <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-m <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-M <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-n <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-o <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-r <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-s <em class="replaceable"><code>style</code></em></code>] [<code class="option">-S <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-T <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-w <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-W <em class="replaceable"><code>mode</code></em></code>] {zonename} {filename}</p></div> -<div class="cmdsynopsis"><p><code class="command">named-compilezone</code> [<code class="option">-d</code>] [<code class="option">-j</code>] [<code class="option">-q</code>] [<code class="option">-v</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-C <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-f <em class="replaceable"><code>format</code></em></code>] [<code class="option">-F <em class="replaceable"><code>format</code></em></code>] [<code class="option">-i <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-k <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-m <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-n <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-r <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-s <em class="replaceable"><code>style</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-T <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-w <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-W <em class="replaceable"><code>mode</code></em></code>] {<code class="option">-o <em class="replaceable"><code>filename</code></em></code>} {zonename} {filename}</p></div> +<div class="cmdsynopsis"><p><code class="command">named-checkzone</code> [<code class="option">-d</code>] [<code class="option">-h</code>] [<code class="option">-j</code>] [<code class="option">-q</code>] [<code class="option">-v</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-f <em class="replaceable"><code>format</code></em></code>] [<code class="option">-F <em class="replaceable"><code>format</code></em></code>] [<code class="option">-i <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-k <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-m <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-M <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-n <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-L <em class="replaceable"><code>serial</code></em></code>] [<code class="option">-o <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-r <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-s <em class="replaceable"><code>style</code></em></code>] [<code class="option">-S <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-T <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-w <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-W <em class="replaceable"><code>mode</code></em></code>] {zonename} {filename}</p></div> +<div class="cmdsynopsis"><p><code class="command">named-compilezone</code> [<code class="option">-d</code>] [<code class="option">-j</code>] [<code class="option">-q</code>] [<code class="option">-v</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-C <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-f <em class="replaceable"><code>format</code></em></code>] [<code class="option">-F <em class="replaceable"><code>format</code></em></code>] [<code class="option">-i <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-k <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-m <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-n <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-L <em class="replaceable"><code>serial</code></em></code>] [<code class="option">-r <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-s <em class="replaceable"><code>style</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-T <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-w <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-W <em class="replaceable"><code>mode</code></em></code>] {<code class="option">-o <em class="replaceable"><code>filename</code></em></code>} {zonename} {filename}</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2633210"></a><h2>DESCRIPTION</h2> +<a name="id2641051"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">named-checkzone</strong></span> checks the syntax and integrity of a zone file. It performs the same checks as <span><strong class="command">named</strong></span> does when loading a @@ -71,7 +71,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2674630"></a><h2>OPTIONS</h2> +<a name="id2678170"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-d</span></dt> <dd><p> @@ -146,14 +146,24 @@ and <span><strong class="command">"raw"</strong></span>. </p></dd> <dt><span class="term">-F <em class="replaceable"><code>format</code></em></span></dt> -<dd><p> +<dd> +<p> Specify the format of the output file specified. - Possible formats are <span><strong class="command">"text"</strong></span> (default) - and <span><strong class="command">"raw"</strong></span>. For <span><strong class="command">named-checkzone</strong></span>, this does not cause any effects unless it dumps the zone contents. - </p></dd> + </p> +<p> + Possible formats are <span><strong class="command">"text"</strong></span> (default) + and <span><strong class="command">"raw"</strong></span> or <span><strong class="command">"raw=N"</strong></span>, + which store the zone in a binary format for rapid loading + by <span><strong class="command">named</strong></span>. <span><strong class="command">"raw=N"</strong></span> + specifies the format version of the raw zone file: if N + is 0, the raw file can be read by any version of + <span><strong class="command">named</strong></span>; if N is 1, the file can be read + by release 9.9.0 or higher. The default is 1. + </p> +</dd> <dt><span class="term">-k <em class="replaceable"><code>mode</code></em></span></dt> <dd><p> Perform <span><strong class="command">"check-names"</strong></span> checks with the @@ -164,6 +174,12 @@ (default for <span><strong class="command">named-checkzone</strong></span>) and <span><strong class="command">"ignore"</strong></span>. </p></dd> +<dt><span class="term">-L <em class="replaceable"><code>serial</code></em></span></dt> +<dd><p> + When compiling a zone to 'raw' format, set the "source serial" + value in the header to the specified serial number. (This is + expected to be used primarily for testing purposes.) + </p></dd> <dt><span class="term">-m <em class="replaceable"><code>mode</code></em></span></dt> <dd><p> Specify whether MX records should be checked to see if they @@ -272,14 +288,14 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2675429"></a><h2>RETURN VALUES</h2> +<a name="id2679079"></a><h2>RETURN VALUES</h2> <p><span><strong class="command">named-checkzone</strong></span> returns an exit status of 1 if errors were detected and 0 otherwise. </p> </div> <div class="refsect1" lang="en"> -<a name="id2675443"></a><h2>SEE ALSO</h2> +<a name="id2679093"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>, <em class="citetitle">RFC 1035</em>, @@ -287,7 +303,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2675476"></a><h2>AUTHOR</h2> +<a name="id2679126"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/doc/arm/man.named-journalprint.html b/doc/arm/man.named-journalprint.html index 2869cea..5c1f3db 100644 --- a/doc/arm/man.named-journalprint.html +++ b/doc/arm/man.named-journalprint.html @@ -50,7 +50,7 @@ <div class="cmdsynopsis"><p><code class="command">named-journalprint</code> {<em class="replaceable"><code>journal</code></em>}</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2613857"></a><h2>DESCRIPTION</h2> +<a name="id2616467"></a><h2>DESCRIPTION</h2> <p> <span><strong class="command">named-journalprint</strong></span> prints the contents of a zone journal file in a human-readable @@ -76,7 +76,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2639434"></a><h2>SEE ALSO</h2> +<a name="id2616513"></a><h2>SEE ALSO</h2> <p> <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">nsupdate</span>(8)</span>, @@ -84,7 +84,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2639465"></a><h2>AUTHOR</h2> +<a name="id2643372"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/doc/arm/man.named.html b/doc/arm/man.named.html index c7371d2..02d6135 100644 --- a/doc/arm/man.named.html +++ b/doc/arm/man.named.html @@ -47,10 +47,10 @@ </div> <div class="refsynopsisdiv"> <h2>Synopsis</h2> -<div class="cmdsynopsis"><p><code class="command">named</code> [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine-name</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-S <em class="replaceable"><code>#max-socks</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-V</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div> +<div class="cmdsynopsis"><p><code class="command">named</code> [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine-name</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-S <em class="replaceable"><code>#max-socks</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-U <em class="replaceable"><code>#listeners</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-V</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2633550"></a><h2>DESCRIPTION</h2> +<a name="id2641300"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">named</strong></span> is a Domain Name System (DNS) server, part of the BIND 9 distribution from ISC. For more @@ -65,7 +65,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2633581"></a><h2>OPTIONS</h2> +<a name="id2641331"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-4</span></dt> <dd><p> @@ -196,6 +196,16 @@ </p> </div> </dd> +<dt><span class="term">-U <em class="replaceable"><code>#listeners</code></em></span></dt> +<dd><p> + Use <em class="replaceable"><code>#listeners</code></em> + worker threads to listen for incoming UDP packets on each + address. If not specified, <span><strong class="command">named</strong></span> will + use the number of detected CPUs. If <code class="option">-n</code> + has been set to a higher value than the number of CPUs, + then <code class="option">-U</code> may be increased as high as that + value, but no higher. + </p></dd> <dt><span class="term">-u <em class="replaceable"><code>user</code></em></span></dt> <dd> <p>Setuid @@ -246,7 +256,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2641303"></a><h2>SIGNALS</h2> +<a name="id2679261"></a><h2>SIGNALS</h2> <p> In routine operation, signals should not be used to control the nameserver; <span><strong class="command">rndc</strong></span> should be used @@ -267,7 +277,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2641353"></a><h2>CONFIGURATION</h2> +<a name="id2679312"></a><h2>CONFIGURATION</h2> <p> The <span><strong class="command">named</strong></span> configuration file is too complex to describe in detail here. A complete description is provided @@ -284,7 +294,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2675740"></a><h2>FILES</h2> +<a name="id2679361"></a><h2>FILES</h2> <div class="variablelist"><dl> <dt><span class="term"><code class="filename">/etc/named.conf</code></span></dt> <dd><p> @@ -297,7 +307,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2675784"></a><h2>SEE ALSO</h2> +<a name="id2679404"></a><h2>SEE ALSO</h2> <p><em class="citetitle">RFC 1033</em>, <em class="citetitle">RFC 1034</em>, <em class="citetitle">RFC 1035</em>, @@ -310,7 +320,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2675854"></a><h2>AUTHOR</h2> +<a name="id2679475"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/doc/arm/man.nsec3hash.html b/doc/arm/man.nsec3hash.html index 11df518..bdba8a6 100644 --- a/doc/arm/man.nsec3hash.html +++ b/doc/arm/man.nsec3hash.html @@ -48,7 +48,7 @@ <div class="cmdsynopsis"><p><code class="command">nsec3hash</code> {<em class="replaceable"><code>salt</code></em>} {<em class="replaceable"><code>algorithm</code></em>} {<em class="replaceable"><code>iterations</code></em>} {<em class="replaceable"><code>domain</code></em>}</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2653680"></a><h2>DESCRIPTION</h2> +<a name="id2621016"></a><h2>DESCRIPTION</h2> <p> <span><strong class="command">nsec3hash</strong></span> generates an NSEC3 hash based on a set of NSEC3 parameters. This can be used to check the validity @@ -56,7 +56,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2653694"></a><h2>ARGUMENTS</h2> +<a name="id2659465"></a><h2>ARGUMENTS</h2> <div class="variablelist"><dl> <dt><span class="term">salt</span></dt> <dd><p> @@ -80,14 +80,14 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2653756"></a><h2>SEE ALSO</h2> +<a name="id2659527"></a><h2>SEE ALSO</h2> <p> <em class="citetitle">BIND 9 Administrator Reference Manual</em>, <em class="citetitle">RFC 5155</em>. </p> </div> <div class="refsect1" lang="en"> -<a name="id2653773"></a><h2>AUTHOR</h2> +<a name="id2659612"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/doc/arm/man.nsupdate.html b/doc/arm/man.nsupdate.html index d7f164e..6793b42 100644 --- a/doc/arm/man.nsupdate.html +++ b/doc/arm/man.nsupdate.html @@ -50,7 +50,7 @@ <div class="cmdsynopsis"><p><code class="command">nsupdate</code> [<code class="option">-d</code>] [<code class="option">-D</code>] [[<code class="option">-g</code>] | [<code class="option">-o</code>] | [<code class="option">-l</code>] | [<code class="option">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></code>] | [<code class="option">-k <em class="replaceable"><code>keyfile</code></em></code>]] [<code class="option">-t <em class="replaceable"><code>timeout</code></em></code>] [<code class="option">-u <em class="replaceable"><code>udptimeout</code></em></code>] [<code class="option">-r <em class="replaceable"><code>udpretries</code></em></code>] [<code class="option">-R <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-v</code>] [filename]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2639765"></a><h2>DESCRIPTION</h2> +<a name="id2643632"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">nsupdate</strong></span> is used to submit Dynamic DNS Update requests as defined in RFC 2136 to a name server. @@ -210,7 +210,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2641532"></a><h2>INPUT FORMAT</h2> +<a name="id2644170"></a><h2>INPUT FORMAT</h2> <p><span><strong class="command">nsupdate</strong></span> reads input from <em class="parameter"><code>filename</code></em> @@ -349,7 +349,7 @@ realm is specified the saved realm is cleared. </p></dd> <dt><span class="term"> - <span><strong class="command">prereq nxdomain</strong></span> + <span><strong class="command">[<span class="optional">prereq</span>] nxdomain</strong></span> {domain-name} </span></dt> <dd><p> @@ -357,7 +357,7 @@ <em class="parameter"><code>domain-name</code></em>. </p></dd> <dt><span class="term"> - <span><strong class="command">prereq yxdomain</strong></span> + <span><strong class="command">[<span class="optional">prereq</span>] yxdomain</strong></span> {domain-name} </span></dt> <dd><p> @@ -366,7 +366,7 @@ exists (has as at least one resource record, of any type). </p></dd> <dt><span class="term"> - <span><strong class="command">prereq nxrrset</strong></span> + <span><strong class="command">[<span class="optional">prereq</span>] nxrrset</strong></span> {domain-name} [class] {type} @@ -382,7 +382,7 @@ is omitted, IN (internet) is assumed. </p></dd> <dt><span class="term"> - <span><strong class="command">prereq yxrrset</strong></span> + <span><strong class="command">[<span class="optional">prereq</span>] yxrrset</strong></span> {domain-name} [class] {type} @@ -399,7 +399,7 @@ is omitted, IN (internet) is assumed. </p></dd> <dt><span class="term"> - <span><strong class="command">prereq yxrrset</strong></span> + <span><strong class="command">[<span class="optional">prereq</span>] yxrrset</strong></span> {domain-name} [class] {type} @@ -428,7 +428,7 @@ RDATA. </p></dd> <dt><span class="term"> - <span><strong class="command">update delete</strong></span> + <span><strong class="command">[<span class="optional">update</span>] del[<span class="optional">ete</span>]</strong></span> {domain-name} [ttl] [class] @@ -449,7 +449,7 @@ is ignored, and is only allowed for compatibility. </p></dd> <dt><span class="term"> - <span><strong class="command">update add</strong></span> + <span><strong class="command">[<span class="optional">update</span>] add</strong></span> {domain-name} {ttl} [class] @@ -498,7 +498,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2676987"></a><h2>EXAMPLES</h2> +<a name="id2681622"></a><h2>EXAMPLES</h2> <p> The examples below show how <span><strong class="command">nsupdate</strong></span> @@ -552,7 +552,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2677037"></a><h2>FILES</h2> +<a name="id2681672"></a><h2>FILES</h2> <div class="variablelist"><dl> <dt><span class="term"><code class="constant">/etc/resolv.conf</code></span></dt> <dd><p> @@ -575,7 +575,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2677121"></a><h2>SEE ALSO</h2> +<a name="id2681755"></a><h2>SEE ALSO</h2> <p> <em class="citetitle">RFC 2136</em>, <em class="citetitle">RFC 3007</em>, @@ -590,7 +590,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2677246"></a><h2>BUGS</h2> +<a name="id2681813"></a><h2>BUGS</h2> <p> The TSIG key is redundantly stored in two separate files. This is a consequence of nsupdate using the DST library diff --git a/doc/arm/man.rndc-confgen.html b/doc/arm/man.rndc-confgen.html index 977ec22..1ad009b 100644 --- a/doc/arm/man.rndc-confgen.html +++ b/doc/arm/man.rndc-confgen.html @@ -50,7 +50,7 @@ <div class="cmdsynopsis"><p><code class="command">rndc-confgen</code> [<code class="option">-a</code>] [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>] [<code class="option">-c <em class="replaceable"><code>keyfile</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>keyname</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomfile</code></em></code>] [<code class="option">-s <em class="replaceable"><code>address</code></em></code>] [<code class="option">-t <em class="replaceable"><code>chrootdir</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2643706"></a><h2>DESCRIPTION</h2> +<a name="id2657330"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">rndc-confgen</strong></span> generates configuration files for <span><strong class="command">rndc</strong></span>. It can be used as a @@ -66,7 +66,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2643772"></a><h2>OPTIONS</h2> +<a name="id2657396"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-a</span></dt> <dd> @@ -173,7 +173,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2644978"></a><h2>EXAMPLES</h2> +<a name="id2659147"></a><h2>EXAMPLES</h2> <p> To allow <span><strong class="command">rndc</strong></span> to be used with no manual configuration, run @@ -190,7 +190,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2645034"></a><h2>SEE ALSO</h2> +<a name="id2659204"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>, <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, @@ -198,7 +198,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2652650"></a><h2>AUTHOR</h2> +<a name="id2659242"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/doc/arm/man.rndc.conf.html b/doc/arm/man.rndc.conf.html index ebb4e40..6b9ea5f 100644 --- a/doc/arm/man.rndc.conf.html +++ b/doc/arm/man.rndc.conf.html @@ -50,7 +50,7 @@ <div class="cmdsynopsis"><p><code class="command">rndc.conf</code> </p></div> </div> <div class="refsect1" lang="en"> -<a name="id2642400"></a><h2>DESCRIPTION</h2> +<a name="id2649469"></a><h2>DESCRIPTION</h2> <p><code class="filename">rndc.conf</code> is the configuration file for <span><strong class="command">rndc</strong></span>, the BIND 9 name server control utility. This file has a similar structure and syntax to @@ -135,7 +135,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2642571"></a><h2>EXAMPLE</h2> +<a name="id2650392"></a><h2>EXAMPLE</h2> <pre class="programlisting"> options { default-server localhost; @@ -209,7 +209,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2643239"></a><h2>NAME SERVER CONFIGURATION</h2> +<a name="id2650514"></a><h2>NAME SERVER CONFIGURATION</h2> <p> The name server must be configured to accept rndc connections and to recognize the key specified in the <code class="filename">rndc.conf</code> @@ -219,7 +219,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2643265"></a><h2>SEE ALSO</h2> +<a name="id2654704"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">mmencode</span>(1)</span>, @@ -227,7 +227,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2643303"></a><h2>AUTHOR</h2> +<a name="id2654742"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/doc/arm/man.rndc.html b/doc/arm/man.rndc.html index d433baf..059f726 100644 --- a/doc/arm/man.rndc.html +++ b/doc/arm/man.rndc.html @@ -50,7 +50,7 @@ <div class="cmdsynopsis"><p><code class="command">rndc</code> [<code class="option">-b <em class="replaceable"><code>source-address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key-file</code></em></code>] [<code class="option">-s <em class="replaceable"><code>server</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-V</code>] [<code class="option">-y <em class="replaceable"><code>key_id</code></em></code>] {command}</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2641686"></a><h2>DESCRIPTION</h2> +<a name="id2644796"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">rndc</strong></span> controls the operation of a name server. It supersedes the <span><strong class="command">ndc</strong></span> utility @@ -79,7 +79,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2641736"></a><h2>OPTIONS</h2> +<a name="id2644846"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-b <em class="replaceable"><code>source-address</code></em></span></dt> <dd><p> @@ -151,7 +151,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2642029"></a><h2>LIMITATIONS</h2> +<a name="id2646710"></a><h2>LIMITATIONS</h2> <p><span><strong class="command">rndc</strong></span> does not yet support all the commands of the BIND 8 <span><strong class="command">ndc</strong></span> utility. @@ -165,7 +165,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2642060"></a><h2>SEE ALSO</h2> +<a name="id2646741"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>, <span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, @@ -175,7 +175,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2642116"></a><h2>AUTHOR</h2> +<a name="id2654647"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/doc/arm/pkcs11.xml b/doc/arm/pkcs11.xml index 2eb85cb..8a0062f 100644 --- a/doc/arm/pkcs11.xml +++ b/doc/arm/pkcs11.xml @@ -17,7 +17,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id$ --> +<!-- $Id: pkcs11.xml,v 1.7 2012/01/16 22:50:12 each Exp $ --> <sect1 id="pkcs11"> <title>PKCS #11 (Cryptoki) support</title> diff --git a/doc/misc/options b/doc/misc/options index 9cfc5a6..2c9cddd 100644 --- a/doc/misc/options +++ b/doc/misc/options @@ -67,8 +67,9 @@ options { allow-update { <address_match_element>; ... }; allow-update-forwarding { <address_match_element>; ... }; allow-v6-synthesis { <address_match_element>; ... }; // obsolete - also-notify [ port <integer> ] { ( <ipv4_address> | <ipv6_address> - ) [ port <integer> ]; ... }; + also-notify [ port <integer> ] { ( <masters> | <ipv4_address> [ + port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key + <string> ]; ... }; alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ]; alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ]; @@ -115,9 +116,11 @@ options { dnssec-accept-expired <boolean>; dnssec-dnskey-kskonly <boolean>; dnssec-enable <boolean>; + dnssec-loadkeys-interval <integer>; dnssec-lookaside ( <string> trust-anchor <string> | auto | no ); dnssec-must-be-secure <string> <boolean>; dnssec-secure-to-insecure <boolean>; + dnssec-update-mode ( maintain | no-resign ); dnssec-validation ( yes | no | auto ); dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port <integer> ] | <ipv4_address> [ port <integer> ] | @@ -141,6 +144,7 @@ options { host-statistics <boolean>; // not implemented host-statistics-max <integer>; // not implemented hostname ( <quoted_string> | none ); + inline-signing <boolean>; interface-interval <integer>; ixfr-from-differences <ixfrdiff>; key-directory <quoted_string>; @@ -160,6 +164,7 @@ options { max-ncache-ttl <integer>; max-refresh-time <integer>; max-retry-time <integer>; + max-rsa-exponent-size <integer>; max-transfer-idle-in <integer>; max-transfer-idle-out <integer>; max-transfer-time-in <integer>; @@ -194,6 +199,7 @@ options { recursion <boolean>; recursive-clients <integer>; request-ixfr <boolean>; + request-ixfr <boolean>; request-nsid <boolean>; reserved-sockets <integer>; resolver-query-timeout <integer>; @@ -209,6 +215,7 @@ options { secroots-file <quoted_string>; serial-queries <integer>; // obsolete serial-query-rate <integer>; + serial-update-method ( increment | unixtime ); server-id ( <quoted_string> | none | hostname ); session-keyalg <string>; session-keyfile ( <quoted_string> | none ); @@ -247,7 +254,7 @@ options { version ( <quoted_string> | none ); zero-no-soa-ttl <boolean>; zero-no-soa-ttl-cache <boolean>; - zone-statistics <boolean>; + zone-statistics <zonestat>; }; server <netprefix> { @@ -293,8 +300,9 @@ view <string> <optional_class> { allow-update { <address_match_element>; ... }; allow-update-forwarding { <address_match_element>; ... }; allow-v6-synthesis { <address_match_element>; ... }; // obsolete - also-notify [ port <integer> ] { ( <ipv4_address> | <ipv6_address> - ) [ port <integer> ]; ... }; + also-notify [ port <integer> ] { ( <masters> | <ipv4_address> [ + port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key + <string> ]; ... }; alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ]; alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ]; @@ -337,9 +345,11 @@ view <string> <optional_class> { dnssec-accept-expired <boolean>; dnssec-dnskey-kskonly <boolean>; dnssec-enable <boolean>; + dnssec-loadkeys-interval <integer>; dnssec-lookaside ( <string> trust-anchor <string> | auto | no ); dnssec-must-be-secure <string> <boolean>; dnssec-secure-to-insecure <boolean>; + dnssec-update-mode ( maintain | no-resign ); dnssec-validation ( yes | no | auto ); dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port <integer> ] | <ipv4_address> [ port <integer> ] | @@ -354,6 +364,7 @@ view <string> <optional_class> { forward ( first | only ); forwarders [ port <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... }; + inline-signing <boolean>; ixfr-from-differences <ixfrdiff>; key <string> { algorithm <string>; @@ -401,6 +412,7 @@ view <string> <optional_class> { queryport-pool-updateinterval <integer>; // obsolete recursion <boolean>; request-ixfr <boolean>; + request-ixfr <boolean>; request-nsid <boolean>; resolver-query-timeout <integer>; response-policy { zone <quoted_string> [ policy ( given | disabled @@ -412,6 +424,7 @@ view <string> <optional_class> { root-delegation-only [ exclude { <quoted_string>; ... } ]; rrset-order { [ class <string> ] [ type <string> ] [ name <quoted_string> ] <string> <string>; ... }; + serial-update-method ( increment | unixtime ); server <netprefix> { bogus <boolean>; edns <boolean>; @@ -459,8 +472,9 @@ view <string> <optional_class> { allow-transfer { <address_match_element>; ... }; allow-update { <address_match_element>; ... }; allow-update-forwarding { <address_match_element>; ... }; - also-notify [ port <integer> ] { ( <ipv4_address> | - <ipv6_address> ) [ port <integer> ]; ... }; + also-notify [ port <integer> ] { ( <masters> | + <ipv4_address> [ port <integer> ] | <ipv6_address> [ + port <integer> ] ) [ key <string> ]; ... }; alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ]; alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( @@ -479,11 +493,14 @@ view <string> <optional_class> { delegation-only <boolean>; dialup <dialuptype>; dnssec-dnskey-kskonly <boolean>; + dnssec-loadkeys-interval <integer>; dnssec-secure-to-insecure <boolean>; + dnssec-update-mode ( maintain | no-resign ); file <quoted_string>; forward ( first | only ); forwarders [ port <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... }; + inline-signing <boolean>; ixfr-base <quoted_string>; // obsolete ixfr-from-differences <boolean>; ixfr-tmp-file <quoted_string>; // obsolete @@ -515,6 +532,8 @@ view <string> <optional_class> { nsec3-test-zone <boolean>; // test only pubkey <integer> <integer> <integer> <quoted_string>; // obsolete + request-ixfr <boolean>; + serial-update-method ( increment | unixtime ); server-addresses { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... }; server-names { <quoted_string>; ... }; @@ -528,7 +547,7 @@ view <string> <optional_class> { <integer> | * ) ]; try-tcp-refresh <boolean>; type ( master | slave | stub | static-stub | hint | forward - | delegation-only ); + | delegation-only | redirect ); update-check-ksk <boolean>; update-policy ( local | { ( grant | deny ) <string> ( name | subdomain | wildcard | self | selfsub | selfwild | @@ -537,9 +556,9 @@ view <string> <optional_class> { ] <rrtypelist>; ... }; use-alt-transfer-source <boolean>; zero-no-soa-ttl <boolean>; - zone-statistics <boolean>; + zone-statistics <zonestat>; }; - zone-statistics <boolean>; + zone-statistics <zonestat>; }; zone <string> <optional_class> { @@ -549,8 +568,9 @@ zone <string> <optional_class> { allow-transfer { <address_match_element>; ... }; allow-update { <address_match_element>; ... }; allow-update-forwarding { <address_match_element>; ... }; - also-notify [ port <integer> ] { ( <ipv4_address> | <ipv6_address> - ) [ port <integer> ]; ... }; + also-notify [ port <integer> ] { ( <masters> | <ipv4_address> [ + port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key + <string> ]; ... }; alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ]; alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ]; @@ -568,11 +588,14 @@ zone <string> <optional_class> { delegation-only <boolean>; dialup <dialuptype>; dnssec-dnskey-kskonly <boolean>; + dnssec-loadkeys-interval <integer>; dnssec-secure-to-insecure <boolean>; + dnssec-update-mode ( maintain | no-resign ); file <quoted_string>; forward ( first | only ); forwarders [ port <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... }; + inline-signing <boolean>; ixfr-base <quoted_string>; // obsolete ixfr-from-differences <boolean>; ixfr-tmp-file <quoted_string>; // obsolete @@ -601,6 +624,8 @@ zone <string> <optional_class> { notify-to-soa <boolean>; nsec3-test-zone <boolean>; // test only pubkey <integer> <integer> <integer> <quoted_string>; // obsolete + request-ixfr <boolean>; + serial-update-method ( increment | unixtime ); server-addresses { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... }; server-names { <quoted_string>; ... }; @@ -612,7 +637,7 @@ zone <string> <optional_class> { transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ]; try-tcp-refresh <boolean>; type ( master | slave | stub | static-stub | hint | forward | - delegation-only ); + delegation-only | redirect ); update-check-ksk <boolean>; update-policy ( local | { ( grant | deny ) <string> ( name | subdomain | wildcard | self | selfsub | selfwild | krb5-self | @@ -620,6 +645,6 @@ zone <string> <optional_class> { | zonesub | external ) [ <string> ] <rrtypelist>; ... }; use-alt-transfer-source <boolean>; zero-no-soa-ttl <boolean>; - zone-statistics <boolean>; + zone-statistics <zonestat>; }; diff --git a/lib/bind9/api b/lib/bind9/api index 99f8d31..a27437f 100644 --- a/lib/bind9/api +++ b/lib/bind9/api @@ -4,6 +4,6 @@ # 9.8: 80-89, 120-129 # 9.9: 90-109 # 9.9-sub: 130-139 -LIBINTERFACE = 80 -LIBREVISION = 8 +LIBINTERFACE = 90 +LIBREVISION = 7 LIBAGE = 0 diff --git a/lib/bind9/check.c b/lib/bind9/check.c index 7c975c9..91f8bff 100644 --- a/lib/bind9/check.c +++ b/lib/bind9/check.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2013 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2001-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -733,6 +733,20 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx, } obj = NULL; + cfg_map_get(options, "max-rsa-exponent-size", &obj); + if (obj != NULL) { + isc_uint32_t val; + + val = cfg_obj_asuint32(obj); + if (val != 0 && (val < 35 || val > 4096)) { + cfg_obj_log(obj, logctx, ISC_LOG_ERROR, + "max-rsa-exponent-size '%u' is out of " + "range (35..4096)", val); + result = ISC_R_RANGE; + } + } + + obj = NULL; cfg_map_get(options, "sig-validity-interval", &obj); if (obj != NULL) { isc_uint32_t validity, resign = 0; @@ -1247,7 +1261,9 @@ check_update_policy(const cfg_obj_t *policy, isc_log_t *logctx) { #define FORWARDZONE 16 #define DELEGATIONZONE 32 #define STATICSTUBZONE 64 -#define CHECKACL 128 +#define REDIRECTZONE 128 +#define STREDIRECTZONE 0 /* Set to REDIRECTZONE to allow xfr-in. */ +#define CHECKACL 512 typedef struct { const char *name; @@ -1299,74 +1315,76 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions, const cfg_listelt_t *element; static optionstable options[] = { - { "allow-query", MASTERZONE | SLAVEZONE | STUBZONE | CHECKACL | - STATICSTUBZONE }, + { "allow-query", MASTERZONE | SLAVEZONE | STUBZONE | REDIRECTZONE | + CHECKACL | STATICSTUBZONE }, { "allow-notify", SLAVEZONE | CHECKACL }, { "allow-transfer", MASTERZONE | SLAVEZONE | CHECKACL }, { "notify", MASTERZONE | SLAVEZONE }, { "also-notify", MASTERZONE | SLAVEZONE }, - { "dialup", MASTERZONE | SLAVEZONE | STUBZONE }, + { "dialup", MASTERZONE | SLAVEZONE | STUBZONE | STREDIRECTZONE }, { "delegation-only", HINTZONE | STUBZONE | DELEGATIONZONE }, { "forward", MASTERZONE | SLAVEZONE | STUBZONE | STATICSTUBZONE | FORWARDZONE }, { "forwarders", MASTERZONE | SLAVEZONE | STUBZONE | STATICSTUBZONE | FORWARDZONE }, - { "maintain-ixfr-base", MASTERZONE | SLAVEZONE }, - { "max-ixfr-log-size", MASTERZONE | SLAVEZONE }, + { "maintain-ixfr-base", MASTERZONE | SLAVEZONE | STREDIRECTZONE }, + { "max-ixfr-log-size", MASTERZONE | SLAVEZONE | STREDIRECTZONE }, { "notify-source", MASTERZONE | SLAVEZONE }, { "notify-source-v6", MASTERZONE | SLAVEZONE }, - { "transfer-source", SLAVEZONE | STUBZONE }, - { "transfer-source-v6", SLAVEZONE | STUBZONE }, - { "max-transfer-time-in", SLAVEZONE | STUBZONE }, + { "transfer-source", SLAVEZONE | STUBZONE | STREDIRECTZONE }, + { "transfer-source-v6", SLAVEZONE | STUBZONE | STREDIRECTZONE }, + { "max-transfer-time-in", SLAVEZONE | STUBZONE | STREDIRECTZONE }, { "max-transfer-time-out", MASTERZONE | SLAVEZONE }, - { "max-transfer-idle-in", SLAVEZONE | STUBZONE }, + { "max-transfer-idle-in", SLAVEZONE | STUBZONE | STREDIRECTZONE }, { "max-transfer-idle-out", MASTERZONE | SLAVEZONE }, - { "max-retry-time", SLAVEZONE | STUBZONE }, - { "min-retry-time", SLAVEZONE | STUBZONE }, - { "max-refresh-time", SLAVEZONE | STUBZONE }, - { "min-refresh-time", SLAVEZONE | STUBZONE }, + { "max-retry-time", SLAVEZONE | STUBZONE | STREDIRECTZONE }, + { "min-retry-time", SLAVEZONE | STUBZONE | STREDIRECTZONE }, + { "max-refresh-time", SLAVEZONE | STUBZONE | STREDIRECTZONE }, + { "min-refresh-time", SLAVEZONE | STUBZONE | STREDIRECTZONE }, { "dnssec-secure-to-insecure", MASTERZONE }, - { "sig-validity-interval", MASTERZONE }, - { "sig-re-signing-interval", MASTERZONE }, - { "sig-signing-nodes", MASTERZONE }, - { "sig-signing-type", MASTERZONE }, - { "sig-signing-signatures", MASTERZONE }, + { "sig-re-signing-interval", MASTERZONE | SLAVEZONE }, + { "sig-signing-nodes", MASTERZONE | SLAVEZONE }, + { "sig-signing-signatures", MASTERZONE | SLAVEZONE }, + { "sig-signing-type", MASTERZONE | SLAVEZONE }, + { "sig-validity-interval", MASTERZONE | SLAVEZONE }, + { "signing", MASTERZONE | SLAVEZONE }, { "zone-statistics", MASTERZONE | SLAVEZONE | STUBZONE | - STATICSTUBZONE}, + STATICSTUBZONE | REDIRECTZONE }, { "allow-update", MASTERZONE | CHECKACL }, { "allow-update-forwarding", SLAVEZONE | CHECKACL }, - { "file", MASTERZONE | SLAVEZONE | STUBZONE | HINTZONE }, - { "journal", MASTERZONE | SLAVEZONE }, + { "file", MASTERZONE | SLAVEZONE | STUBZONE | HINTZONE | REDIRECTZONE }, + { "journal", MASTERZONE | SLAVEZONE | STREDIRECTZONE }, { "ixfr-base", MASTERZONE | SLAVEZONE }, { "ixfr-tmp-file", MASTERZONE | SLAVEZONE }, - { "masters", SLAVEZONE | STUBZONE }, + { "masters", SLAVEZONE | STUBZONE | REDIRECTZONE }, { "pubkey", MASTERZONE | SLAVEZONE | STUBZONE }, { "update-policy", MASTERZONE }, - { "database", MASTERZONE | SLAVEZONE | STUBZONE }, - { "key-directory", MASTERZONE }, + { "database", MASTERZONE | SLAVEZONE | STUBZONE | REDIRECTZONE }, + { "key-directory", MASTERZONE | SLAVEZONE }, { "check-wildcard", MASTERZONE }, { "check-mx", MASTERZONE }, { "check-dup-records", MASTERZONE }, { "integrity-check", MASTERZONE }, { "check-mx-cname", MASTERZONE }, { "check-srv-cname", MASTERZONE }, - { "masterfile-format", MASTERZONE | SLAVEZONE | STUBZONE | HINTZONE }, - { "update-check-ksk", MASTERZONE }, - { "dnssec-dnskey-kskonly", MASTERZONE }, - { "auto-dnssec", MASTERZONE }, - { "try-tcp-refresh", SLAVEZONE }, + { "masterfile-format", MASTERZONE | SLAVEZONE | STUBZONE | HINTZONE | + REDIRECTZONE }, + { "update-check-ksk", MASTERZONE | SLAVEZONE }, + { "dnssec-dnskey-kskonly", MASTERZONE | SLAVEZONE }, + { "dnssec-loadkeys-interval", MASTERZONE | SLAVEZONE }, + { "auto-dnssec", MASTERZONE | SLAVEZONE }, + { "try-tcp-refresh", SLAVEZONE | STREDIRECTZONE }, { "server-addresses", STATICSTUBZONE }, { "server-names", STATICSTUBZONE }, }; static optionstable dialups[] = { - { "notify", MASTERZONE | SLAVEZONE }, - { "notify-passive", SLAVEZONE }, - { "refresh", SLAVEZONE | STUBZONE }, - { "passive", SLAVEZONE | STUBZONE }, + { "notify", MASTERZONE | SLAVEZONE | STREDIRECTZONE }, + { "notify-passive", SLAVEZONE | STREDIRECTZONE }, + { "refresh", SLAVEZONE | STUBZONE | STREDIRECTZONE }, + { "passive", SLAVEZONE | STUBZONE | STREDIRECTZONE }, }; - znamestr = cfg_obj_asstring(cfg_tuple_get(zconfig, "name")); zoptions = cfg_tuple_get(zconfig, "options"); @@ -1397,6 +1415,8 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions, ztype = HINTZONE; else if (strcasecmp(typestr, "delegation-only") == 0) ztype = DELEGATIONZONE; + else if (strcasecmp(typestr, "redirect") == 0) + ztype = REDIRECTZONE; else { cfg_obj_log(obj, logctx, ISC_LOG_ERROR, "zone '%s': invalid type %s", @@ -1404,6 +1424,11 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions, return (ISC_R_FAILURE); } + if (ztype == REDIRECTZONE && strcmp(znamestr, ".") != 0) { + cfg_obj_log(zconfig, logctx, ISC_LOG_ERROR, + "redirect zones must be called \".\""); + return (ISC_R_FAILURE); + } obj = cfg_tuple_get(zconfig, "class"); if (cfg_obj_isstring(obj)) { isc_textregion_t r; @@ -1445,7 +1470,8 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions, zname = dns_fixedname_name(&fixedname); dns_name_format(zname, namebuf, sizeof(namebuf)); - tresult = nameexist(zconfig, namebuf, ztype == HINTZONE ? 1 : 2, + tresult = nameexist(zconfig, namebuf, ztype == HINTZONE ? 1 : + ztype == REDIRECTZONE ? 2 : 3, symtab, "zone '%s': already exists " "previous definition: %s:%u", logctx, mctx); if (tresult != ISC_R_SUCCESS) @@ -1498,6 +1524,21 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions, } /* + * Master & slave zones must have a "also-notify" field. + */ + if (ztype == MASTERZONE || ztype == SLAVEZONE ) { + obj = NULL; + tresult = cfg_map_get(zoptions, "also-notify", &obj); + if (tresult == ISC_R_SUCCESS) { + isc_uint32_t count; + tresult = validate_masters(obj, config, &count, + logctx, mctx); + if (tresult != ISC_R_SUCCESS && result == ISC_R_SUCCESS) + result = tresult; + } + } + + /* * Slave & stub zones must have a "masters" field. */ if (ztype == SLAVEZONE || ztype == STUBZONE) { @@ -1525,10 +1566,10 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions, /* * Master zones can't have both "allow-update" and "update-policy". */ - if (ztype == MASTERZONE) { + if (ztype == MASTERZONE || ztype == SLAVEZONE) { isc_result_t res1, res2, res3; const char *arg; - isc_boolean_t ddns; + isc_boolean_t ddns = ISC_FALSE, signing = ISC_FALSE; obj = NULL; res1 = cfg_map_get(zoptions, "allow-update", &obj); @@ -1546,15 +1587,22 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions, ddns = ISC_TF(res1 == ISC_R_SUCCESS || res2 == ISC_R_SUCCESS); obj = NULL; + res1 = cfg_map_get(zoptions, "inline-signing", &obj); + if (res1 == ISC_R_SUCCESS) + signing = cfg_obj_asboolean(obj); + + obj = NULL; arg = "off"; res3 = cfg_map_get(zoptions, "auto-dnssec", &obj); if (res3 == ISC_R_SUCCESS) arg = cfg_obj_asstring(obj); - if (strcasecmp(arg, "off") != 0 && !ddns) { + if (strcasecmp(arg, "off") != 0 && !ddns && !signing) { cfg_obj_log(obj, logctx, ISC_LOG_ERROR, - "'auto-dnssec %s;' requires " - "dynamic DNS to be configured in the zone", - arg); + "'auto-dnssec %s;' requires%s " + "inline-signing to be configured for " + "the zone", arg, + (ztype == MASTERZONE) ? + " dynamic DNS or" : ""); result = ISC_R_FAILURE; } if (strcasecmp(arg, "create") == 0) { @@ -1575,6 +1623,33 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions, 0xff00U, 0xffffU); result = ISC_R_FAILURE; } + + obj = NULL; + res1 = cfg_map_get(zoptions, "dnssec-dnskey-kskonly", &obj); + if (res1 == ISC_R_SUCCESS && ztype == SLAVEZONE && !signing) { + cfg_obj_log(obj, logctx, ISC_LOG_ERROR, + "dnssec-dnskey-kskonly: requires " + "inline-signing when used in slave zone"); + result = ISC_R_FAILURE; + } + + obj = NULL; + res1 = cfg_map_get(zoptions, "dnssec-loadkeys-interval", &obj); + if (res1 == ISC_R_SUCCESS && ztype == SLAVEZONE && !signing) { + cfg_obj_log(obj, logctx, ISC_LOG_ERROR, + "dnssec-loadkeys-interval: requires " + "inline-signing when used in slave zone"); + result = ISC_R_FAILURE; + } + + obj = NULL; + res1 = cfg_map_get(zoptions, "update-check-ksk", &obj); + if (res1 == ISC_R_SUCCESS && ztype == SLAVEZONE && !signing) { + cfg_obj_log(obj, logctx, ISC_LOG_ERROR, + "update-check-ksk: requires " + "inline-signing when used in slave zone"); + result = ISC_R_FAILURE; + } } /* @@ -1710,20 +1785,27 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions, /* * If the zone type is rbt/rbt64 then master/hint zones * require file clauses. + * If inline signing is used, then slave zones require a + * file clause as well */ obj = NULL; tresult = cfg_map_get(zoptions, "database", &obj); if (tresult == ISC_R_NOTFOUND || (tresult == ISC_R_SUCCESS && (strcmp("rbt", cfg_obj_asstring(obj)) == 0 || - strcmp("rbt64", cfg_obj_asstring(obj)) == 0))) { + strcmp("rbt64", cfg_obj_asstring(obj)) == 0))) + { + isc_result_t res1; obj = NULL; tresult = cfg_map_get(zoptions, "file", &obj); - if (tresult != ISC_R_SUCCESS && - (ztype == MASTERZONE || ztype == HINTZONE)) { + obj = NULL; + res1 = cfg_map_get(zoptions, "inline-signing", &obj); + if ((tresult != ISC_R_SUCCESS && + (ztype == MASTERZONE || ztype == HINTZONE)) || + (ztype == SLAVEZONE && res1 == ISC_R_SUCCESS)) { cfg_obj_log(zconfig, logctx, ISC_LOG_ERROR, - "zone '%s': missing 'file' entry", - znamestr); + "zone '%s': missing 'file' entry", + znamestr); result = tresult; } } diff --git a/lib/dns/Makefile.in b/lib/dns/Makefile.in index 51d6066..b712ab1 100644 --- a/lib/dns/Makefile.in +++ b/lib/dns/Makefile.in @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id$ +# $Id: Makefile.in,v 1.180 2011/10/11 00:09:03 each Exp $ srcdir = @srcdir@ VPATH = @srcdir@ @@ -57,7 +57,7 @@ DSTOBJS = @DST_EXTRA_OBJS@ @OPENSSLLINKOBJS@ \ # Alphabetically DNSOBJS = acache.@O@ acl.@O@ adb.@O@ byaddr.@O@ \ - cache.@O@ callbacks.@O@ compress.@O@ \ + cache.@O@ callbacks.@O@ clientinfo.@O@ compress.@O@ \ db.@O@ dbiterator.@O@ dbtable.@O@ diff.@O@ dispatch.@O@ \ dlz.@O@ dns64.@O@ dnssec.@O@ ds.@O@ forward.@O@ iptable.@O@ \ journal.@O@ keydata.@O@ keytable.@O@ \ @@ -71,7 +71,7 @@ DNSOBJS = acache.@O@ acl.@O@ adb.@O@ byaddr.@O@ \ rriterator.@O@ sdb.@O@ \ sdlz.@O@ soa.@O@ ssu.@O@ ssu_external.@O@ \ stats.@O@ tcpmsg.@O@ time.@O@ timer.@O@ tkey.@O@ \ - tsec.@O@ tsig.@O@ ttl.@O@ validator.@O@ \ + tsec.@O@ tsig.@O@ ttl.@O@ update.@O@ validator.@O@ \ version.@O@ view.@O@ xfrin.@O@ zone.@O@ zonekey.@O@ zt.@O@ OBJS= ${DNSOBJS} ${OTHEROBJS} ${DSTOBJS} @@ -87,7 +87,7 @@ DSTSRCS = @DST_EXTRA_SRCS@ @OPENSSLLINKSRCS@ \ hmac_link.c key.c DNSSRCS = acache.c acl.c adb.c byaddr.c \ - cache.c callbacks.c compress.c \ + cache.c callbacks.c clientinfo.c compress.c \ db.c dbiterator.c dbtable.c diff.c dispatch.c \ dlz.c dns64.c dnssec.c ds.c forward.c iptable.c journal.c \ keydata.c keytable.c lib.c log.c lookup.c \ @@ -98,7 +98,7 @@ DNSSRCS = acache.c acl.c adb.c byaddr.c \ resolver.c result.c rootns.c rpz.c rriterator.c \ sdb.c sdlz.c soa.c ssu.c ssu_external.c \ stats.c tcpmsg.c time.c timer.c tkey.c \ - tsec.c tsig.c ttl.c validator.c \ + tsec.c tsig.c ttl.c update.c validator.c \ version.c view.c xfrin.c zone.c zonekey.c zt.c ${OTHERSRCS} SRCS = ${DSTSRCS} ${DNSSRCS} diff --git a/lib/dns/acache.c b/lib/dns/acache.c index 863df35..6df9b98 100644 --- a/lib/dns/acache.c +++ b/lib/dns/acache.c @@ -1781,9 +1781,8 @@ dns_acache_setcleaninginterval(dns_acache_t *acache, unsigned int t) { * function for more details about the logic. */ void -dns_acache_setcachesize(dns_acache_t *acache, isc_uint32_t size) { - isc_uint32_t lowater; - isc_uint32_t hiwater; +dns_acache_setcachesize(dns_acache_t *acache, size_t size) { + size_t hiwater, lowater; REQUIRE(DNS_ACACHE_VALID(acache)); diff --git a/lib/dns/acl.c b/lib/dns/acl.c index ec29bc7..3221d30 100644 --- a/lib/dns/acl.c +++ b/lib/dns/acl.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2009, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2009, 2011, 2013 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: acl.c,v 1.55 2011/06/17 23:47:49 tbox Exp $ */ /*! \file */ @@ -48,7 +48,10 @@ dns_acl_create(isc_mem_t *mctx, int n, dns_acl_t **target) { acl = isc_mem_get(mctx, sizeof(*acl)); if (acl == NULL) return (ISC_R_NOMEMORY); - acl->mctx = mctx; + + acl->mctx = NULL; + isc_mem_attach(mctx, &acl->mctx); + acl->name = NULL; result = isc_refcount_init(&acl->refcount, 1); @@ -467,7 +470,7 @@ destroy(dns_acl_t *dacl) { dns_iptable_detach(&dacl->iptable); isc_refcount_destroy(&dacl->refcount); dacl->magic = 0; - isc_mem_put(dacl->mctx, dacl, sizeof(*dacl)); + isc_mem_putanddetach(&dacl->mctx, dacl, sizeof(*dacl)); } void diff --git a/lib/dns/adb.c b/lib/dns/adb.c index 6aa5e5a..ef7875d 100644 --- a/lib/dns/adb.c +++ b/lib/dns/adb.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: adb.c,v 1.264 2011/12/05 17:10:51 each Exp $ */ /*! \file * @@ -4130,9 +4130,8 @@ water(void *arg, int mark) { } void -dns_adb_setadbsize(dns_adb_t *adb, isc_uint32_t size) { - isc_uint32_t hiwater; - isc_uint32_t lowater; +dns_adb_setadbsize(dns_adb_t *adb, size_t size) { + size_t hiwater, lowater; INSIST(DNS_ADB_VALID(adb)); diff --git a/lib/dns/api b/lib/dns/api index 5241a88..a888110 100644 --- a/lib/dns/api +++ b/lib/dns/api @@ -4,6 +4,6 @@ # 9.8: 80-89, 120-129 # 9.9: 90-109 # 9.9-sub: 130-139 -LIBINTERFACE = 122 +LIBINTERFACE = 99 LIBREVISION = 1 LIBAGE = 0 diff --git a/lib/dns/byaddr.c b/lib/dns/byaddr.c index 6a3a603..eb05f9f 100644 --- a/lib/dns/byaddr.c +++ b/lib/dns/byaddr.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007, 2009 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2009, 2013 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -224,7 +224,8 @@ dns_byaddr_create(isc_mem_t *mctx, isc_netaddr_t *address, dns_view_t *view, byaddr = isc_mem_get(mctx, sizeof(*byaddr)); if (byaddr == NULL) return (ISC_R_NOMEMORY); - byaddr->mctx = mctx; + byaddr->mctx = NULL; + isc_mem_attach(mctx, &byaddr->mctx); byaddr->options = options; byaddr->event = isc_mem_get(mctx, sizeof(*byaddr->event)); @@ -277,7 +278,7 @@ dns_byaddr_create(isc_mem_t *mctx, isc_netaddr_t *address, dns_view_t *view, isc_task_detach(&byaddr->task); cleanup_byaddr: - isc_mem_put(mctx, byaddr, sizeof(*byaddr)); + isc_mem_putanddetach(&mctx, byaddr, sizeof(*byaddr)); return (result); } @@ -310,7 +311,7 @@ dns_byaddr_destroy(dns_byaddr_t **byaddrp) { DESTROYLOCK(&byaddr->lock); byaddr->magic = 0; - isc_mem_put(byaddr->mctx, byaddr, sizeof(*byaddr)); + isc_mem_putanddetach(&byaddr->mctx, byaddr, sizeof(*byaddr)); *byaddrp = NULL; } diff --git a/lib/dns/cache.c b/lib/dns/cache.c index bced80e..d0f05b9 100644 --- a/lib/dns/cache.c +++ b/lib/dns/cache.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2009, 2011-2013 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2009, 2011, 2013 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: cache.c,v 1.91 2011/08/26 05:12:56 marka Exp $ */ /*! \file */ @@ -136,7 +136,7 @@ struct dns_cache { char *db_type; int db_argc; char **db_argv; - isc_uint32_t size; + size_t size; /* Locked by 'filelock'. */ char *filename; @@ -1028,9 +1028,8 @@ water(void *arg, int mark) { } void -dns_cache_setcachesize(dns_cache_t *cache, isc_uint32_t size) { - isc_uint32_t lowater; - isc_uint32_t hiwater; +dns_cache_setcachesize(dns_cache_t *cache, size_t size) { + size_t hiwater, lowater; REQUIRE(VALID_CACHE(cache)); @@ -1068,9 +1067,9 @@ dns_cache_setcachesize(dns_cache_t *cache, isc_uint32_t size) { isc_mem_setwater(cache->mctx, water, cache, hiwater, lowater); } -isc_uint32_t +size_t dns_cache_getcachesize(dns_cache_t *cache) { - isc_uint32_t size; + size_t size; REQUIRE(VALID_CACHE(cache)); @@ -1153,31 +1152,14 @@ dns_cache_flush(dns_cache_t *cache) { return (ISC_R_SUCCESS); } -isc_result_t -dns_cache_flushname(dns_cache_t *cache, dns_name_t *name) { +static isc_result_t +clearnode(dns_db_t *db, dns_dbnode_t *node) { isc_result_t result; dns_rdatasetiter_t *iter = NULL; - dns_dbnode_t *node = NULL; - dns_db_t *db = NULL; - - LOCK(&cache->lock); - if (cache->db != NULL) - dns_db_attach(cache->db, &db); - UNLOCK(&cache->lock); - if (db == NULL) - return (ISC_R_SUCCESS); - result = dns_db_findnode(cache->db, name, ISC_FALSE, &node); - if (result == ISC_R_NOTFOUND) { - result = ISC_R_SUCCESS; - goto cleanup_db; - } - if (result != ISC_R_SUCCESS) - goto cleanup_db; - result = dns_db_allrdatasets(cache->db, node, NULL, - (isc_stdtime_t)0, &iter); + result = dns_db_allrdatasets(db, node, NULL, (isc_stdtime_t)0, &iter); if (result != ISC_R_SUCCESS) - goto cleanup_node; + return (result); for (result = dns_rdatasetiter_first(iter); result == ISC_R_SUCCESS; @@ -1187,19 +1169,110 @@ dns_cache_flushname(dns_cache_t *cache, dns_name_t *name) { dns_rdataset_init(&rdataset); dns_rdatasetiter_current(iter, &rdataset); - result = dns_db_deleterdataset(cache->db, node, NULL, + result = dns_db_deleterdataset(db, node, NULL, rdataset.type, rdataset.covers); dns_rdataset_disassociate(&rdataset); if (result != ISC_R_SUCCESS && result != DNS_R_UNCHANGED) break; } + if (result == ISC_R_NOMORE) result = ISC_R_SUCCESS; dns_rdatasetiter_destroy(&iter); + return (result); +} + +static isc_result_t +cleartree(dns_db_t *db, dns_name_t *name) { + isc_result_t result, answer = ISC_R_SUCCESS; + dns_dbiterator_t *iter = NULL; + dns_dbnode_t *node = NULL; + dns_fixedname_t fnodename; + dns_name_t *nodename; + + dns_fixedname_init(&fnodename); + nodename = dns_fixedname_name(&fnodename); + + result = dns_db_createiterator(db, 0, &iter); + if (result != ISC_R_SUCCESS) + goto cleanup; - cleanup_node: - dns_db_detachnode(cache->db, &node); + result = dns_dbiterator_seek(iter, name); + if (result != ISC_R_SUCCESS) + goto cleanup; + + while (result == ISC_R_SUCCESS) { + result = dns_dbiterator_current(iter, &node, nodename); + if (result == DNS_R_NEWORIGIN) + result = ISC_R_SUCCESS; + if (result != ISC_R_SUCCESS) + goto cleanup; + /* + * Are we done? + */ + if (! dns_name_issubdomain(nodename, name)) + goto cleanup; + + /* + * If clearnode fails record and move onto the next node. + */ + result = clearnode(db, node); + if (result != ISC_R_SUCCESS && answer == ISC_R_SUCCESS) + answer = result; + dns_db_detachnode(db, &node); + result = dns_dbiterator_next(iter); + } + + cleanup: + if (result == ISC_R_NOMORE || result == ISC_R_NOTFOUND) + result = ISC_R_SUCCESS; + if (result != ISC_R_SUCCESS && answer == ISC_R_SUCCESS) + answer = result; + if (node != NULL) + dns_db_detachnode(db, &node); + if (iter != NULL) + dns_dbiterator_destroy(&iter); + + return (answer); +} + +isc_result_t +dns_cache_flushname(dns_cache_t *cache, dns_name_t *name) { + return (dns_cache_flushnode(cache, name, ISC_FALSE)); +} + +isc_result_t +dns_cache_flushnode(dns_cache_t *cache, dns_name_t *name, + isc_boolean_t tree) +{ + isc_result_t result; + dns_dbnode_t *node = NULL; + dns_db_t *db = NULL; + + if (dns_name_equal(name, dns_rootname)) + return (dns_cache_flush(cache)); + + LOCK(&cache->lock); + if (cache->db != NULL) + dns_db_attach(cache->db, &db); + UNLOCK(&cache->lock); + if (db == NULL) + return (ISC_R_SUCCESS); + + if (tree) { + result = cleartree(cache->db, name); + } else { + result = dns_db_findnode(cache->db, name, ISC_FALSE, &node); + if (result == ISC_R_NOTFOUND) { + result = ISC_R_SUCCESS; + goto cleanup_db; + } + if (result != ISC_R_SUCCESS) + goto cleanup_db; + result = clearnode(cache->db, node); + dns_db_detachnode(cache->db, &node); + } cleanup_db: dns_db_detach(&db); diff --git a/lib/dns/callbacks.c b/lib/dns/callbacks.c index 705b6f1..0ef17ab 100644 --- a/lib/dns/callbacks.c +++ b/lib/dns/callbacks.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2011 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2001 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: callbacks.c,v 1.19 2011/12/09 23:47:05 tbox Exp $ */ /*! \file */ @@ -88,6 +88,8 @@ dns_rdatacallbacks_initcommon(dns_rdatacallbacks_t *callbacks) { REQUIRE(callbacks != NULL); callbacks->add = NULL; + callbacks->rawdata = NULL; + callbacks->zone = NULL; callbacks->add_private = NULL; callbacks->error_private = NULL; callbacks->warn_private = NULL; diff --git a/lib/dns/client.c b/lib/dns/client.c index c4780f7..fc551cf 100644 --- a/lib/dns/client.c +++ b/lib/dns/client.c @@ -14,7 +14,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: client.c,v 1.14 2011/03/12 04:59:47 tbox Exp $ */ #include <config.h> @@ -318,7 +318,7 @@ dns_client_createview(isc_mem_t *mctx, dns_rdataclass_t rdclass, return (result); } - result = dns_view_createresolver(view, taskmgr, ntasks, socketmgr, + result = dns_view_createresolver(view, taskmgr, ntasks, 1, socketmgr, timermgr, 0, dispatchmgr, dispatchv4, dispatchv6); if (result != ISC_R_SUCCESS) { diff --git a/lib/dns/clientinfo.c b/lib/dns/clientinfo.c new file mode 100644 index 0000000..fd5a5e2 --- /dev/null +++ b/lib/dns/clientinfo.c @@ -0,0 +1,38 @@ +/* + * Copyright (C) 2011 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +/* $Id: clientinfo.c,v 1.3 2011/10/11 00:25:12 marka Exp $ */ + +/*! \file */ + +#include "config.h" + +#include <dns/clientinfo.h> + +void +dns_clientinfomethods_init(dns_clientinfomethods_t *methods, + dns_clientinfo_sourceip_t sourceip) +{ + methods->version = DNS_CLIENTINFOMETHODS_VERSION; + methods->age = DNS_CLIENTINFOMETHODS_AGE; + methods->sourceip = sourceip; +} + +void +dns_clientinfo_init(dns_clientinfo_t *ci, void *data) { + ci->version = DNS_CLIENTINFO_VERSION; + ci->data = data; +} diff --git a/lib/dns/db.c b/lib/dns/db.c index 77f82f1..bf4a5b3 100644 --- a/lib/dns/db.c +++ b/lib/dns/db.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: db.c,v 1.99.4.1 2011/10/23 20:12:07 vjs Exp $ */ /*! \file */ @@ -33,6 +33,7 @@ #include <isc/util.h> #include <dns/callbacks.h> +#include <dns/clientinfo.h> #include <dns/db.h> #include <dns/dbiterator.h> #include <dns/log.h> @@ -478,7 +479,31 @@ dns_db_findnode(dns_db_t *db, dns_name_t *name, REQUIRE(DNS_DB_VALID(db)); REQUIRE(nodep != NULL && *nodep == NULL); - return ((db->methods->findnode)(db, name, create, nodep)); + if (db->methods->findnode != NULL) + return ((db->methods->findnode)(db, name, create, nodep)); + else + return ((db->methods->findnodeext)(db, name, create, + NULL, NULL, nodep)); +} + +isc_result_t +dns_db_findnodeext(dns_db_t *db, dns_name_t *name, + isc_boolean_t create, dns_clientinfomethods_t *methods, + dns_clientinfo_t *clientinfo, dns_dbnode_t **nodep) +{ + /* + * Find the node with name 'name', passing 'arg' to the database + * implementation. + */ + + REQUIRE(DNS_DB_VALID(db)); + REQUIRE(nodep != NULL && *nodep == NULL); + + if (db->methods->findnodeext != NULL) + return ((db->methods->findnodeext)(db, name, create, + methods, clientinfo, nodep)); + else + return ((db->methods->findnode)(db, name, create, nodep)); } isc_result_t @@ -502,7 +527,6 @@ dns_db_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, dns_dbnode_t **nodep, dns_name_t *foundname, dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) { - /* * Find the best match for 'name' and 'type' in version 'version' * of 'db'. @@ -519,8 +543,50 @@ dns_db_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, (DNS_RDATASET_VALID(sigrdataset) && ! dns_rdataset_isassociated(sigrdataset))); - return ((db->methods->find)(db, name, version, type, options, now, - nodep, foundname, rdataset, sigrdataset)); + if (db->methods->find != NULL) + return ((db->methods->find)(db, name, version, type, + options, now, nodep, foundname, + rdataset, sigrdataset)); + else + return ((db->methods->findext)(db, name, version, type, + options, now, nodep, foundname, + NULL, NULL, + rdataset, sigrdataset)); +} + +isc_result_t +dns_db_findext(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, + dns_rdatatype_t type, unsigned int options, isc_stdtime_t now, + dns_dbnode_t **nodep, dns_name_t *foundname, + dns_clientinfomethods_t *methods, dns_clientinfo_t *clientinfo, + dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) +{ + + /* + * Find the best match for 'name' and 'type' in version 'version' + * of 'db', passing in 'arg'. + */ + + REQUIRE(DNS_DB_VALID(db)); + REQUIRE(type != dns_rdatatype_rrsig); + REQUIRE(nodep == NULL || (nodep != NULL && *nodep == NULL)); + REQUIRE(dns_name_hasbuffer(foundname)); + REQUIRE(rdataset == NULL || + (DNS_RDATASET_VALID(rdataset) && + ! dns_rdataset_isassociated(rdataset))); + REQUIRE(sigrdataset == NULL || + (DNS_RDATASET_VALID(sigrdataset) && + ! dns_rdataset_isassociated(sigrdataset))); + + if (db->methods->findext != NULL) + return ((db->methods->findext)(db, name, version, type, + options, now, nodep, foundname, + methods, clientinfo, + rdataset, sigrdataset)); + else + return ((db->methods->find)(db, name, version, type, + options, now, nodep, foundname, + rdataset, sigrdataset)); } isc_result_t @@ -653,11 +719,6 @@ dns_db_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version, isc_stdtime_t now, dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) { - /* - * Search for an rdataset of type 'type' at 'node' that are in version - * 'version' of 'db'. If found, make 'rdataset' refer to it. - */ - REQUIRE(DNS_DB_VALID(db)); REQUIRE(node != NULL); REQUIRE(DNS_RDATASET_VALID(rdataset)); @@ -668,8 +729,9 @@ dns_db_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version, (DNS_RDATASET_VALID(sigrdataset) && ! dns_rdataset_isassociated(sigrdataset))); - return ((db->methods->findrdataset)(db, node, version, type, covers, - now, rdataset, sigrdataset)); + return ((db->methods->findrdataset)(db, node, version, type, + covers, now, rdataset, + sigrdataset)); } isc_result_t diff --git a/lib/dns/dbtable.c b/lib/dns/dbtable.c index 57bbfc1..2009220 100644 --- a/lib/dns/dbtable.c +++ b/lib/dns/dbtable.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2013 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2001 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -89,7 +89,8 @@ dns_dbtable_create(isc_mem_t *mctx, dns_rdataclass_t rdclass, goto clean3; dbtable->default_db = NULL; - dbtable->mctx = mctx; + dbtable->mctx = NULL; + isc_mem_attach(mctx, &dbtable->mctx); dbtable->rdclass = rdclass; dbtable->magic = DBTABLE_MAGIC; dbtable->references = 1; @@ -105,7 +106,7 @@ dns_dbtable_create(isc_mem_t *mctx, dns_rdataclass_t rdclass, dns_rbt_destroy(&dbtable->rbt); clean1: - isc_mem_put(mctx, dbtable, sizeof(*dbtable)); + isc_mem_putanddetach(&mctx, dbtable, sizeof(*dbtable)); return (result); } @@ -129,7 +130,7 @@ dbtable_free(dns_dbtable_t *dbtable) { dbtable->magic = 0; - isc_mem_put(dbtable->mctx, dbtable, sizeof(*dbtable)); + isc_mem_putanddetach(&dbtable->mctx, dbtable, sizeof(*dbtable)); } void diff --git a/lib/dns/diff.c b/lib/dns/diff.c index de00d0f..ff60d46 100644 --- a/lib/dns/diff.c +++ b/lib/dns/diff.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007-2009, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007-2009, 2011, 2013 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: diff.c,v 1.26 2011/03/25 23:53:02 each Exp $ */ /*! \file */ @@ -73,7 +73,8 @@ dns_difftuple_create(isc_mem_t *mctx, t = isc_mem_allocate(mctx, size); if (t == NULL) return (ISC_R_NOMEMORY); - t->mctx = mctx; + t->mctx = NULL; + isc_mem_attach(mctx, &t->mctx); t->op = op; datap = (unsigned char *)(t + 1); @@ -105,10 +106,15 @@ dns_difftuple_create(isc_mem_t *mctx, void dns_difftuple_free(dns_difftuple_t **tp) { dns_difftuple_t *t = *tp; + isc_mem_t *mctx; + REQUIRE(DNS_DIFFTUPLE_VALID(t)); + dns_name_invalidate(&t->name); t->magic = 0; - isc_mem_free(t->mctx, t); + mctx = t->mctx; + isc_mem_free(mctx, t); + isc_mem_detach(&mctx); *tp = NULL; } diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c index 9848ac2..5063914 100644 --- a/lib/dns/dispatch.c +++ b/lib/dns/dispatch.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: dispatch.c,v 1.175 2011/11/29 01:03:47 marka Exp $ */ /*! \file */ @@ -32,6 +32,7 @@ #include <isc/portset.h> #include <isc/print.h> #include <isc/random.h> +#include <isc/socket.h> #include <isc/stats.h> #include <isc/string.h> #include <isc/task.h> @@ -101,12 +102,16 @@ struct dns_dispatchmgr { unsigned int maxbuffers; /*%< max buffers */ /* Locked internally. */ - isc_mutex_t pool_lock; - isc_mempool_t *epool; /*%< memory pool for events */ - isc_mempool_t *rpool; /*%< memory pool for replies */ + isc_mutex_t depool_lock; + isc_mempool_t *depool; /*%< pool for dispatch events */ + isc_mutex_t rpool_lock; + isc_mempool_t *rpool; /*%< pool for replies */ + isc_mutex_t dpool_lock; isc_mempool_t *dpool; /*%< dispatch allocations */ - isc_mempool_t *bpool; /*%< memory pool for buffers */ - isc_mempool_t *spool; /*%< memory pool for dispsocs */ + isc_mutex_t bpool_lock; + isc_mempool_t *bpool; /*%< pool for buffers */ + isc_mutex_t spool_lock; + isc_mempool_t *spool; /*%< pool for dispsocks */ /*% * Locked by qid->lock if qid exists; otherwise, can be used without @@ -226,6 +231,9 @@ struct dns_dispatch { unsigned int maxrequests; /*%< max requests */ isc_event_t *ctlevent; + isc_mutex_t sepool_lock; + isc_mempool_t *sepool; /*%< pool for socket events */ + /*% Locked by mgr->lock. */ ISC_LINK(dns_dispatch_t) link; @@ -301,8 +309,8 @@ static isc_uint32_t dns_hash(dns_qid_t *, isc_sockaddr_t *, dns_messageid_t, in_port_t); static void free_buffer(dns_dispatch_t *disp, void *buf, unsigned int len); static void *allocate_udp_buffer(dns_dispatch_t *disp); -static inline void free_event(dns_dispatch_t *disp, dns_dispatchevent_t *ev); -static inline dns_dispatchevent_t *allocate_event(dns_dispatch_t *disp); +static inline void free_devent(dns_dispatch_t *disp, dns_dispatchevent_t *ev); +static inline dns_dispatchevent_t *allocate_devent(dns_dispatch_t *disp); static void do_cancel(dns_dispatch_t *disp); static dns_dispentry_t *linear_first(dns_qid_t *disp); static dns_dispentry_t *linear_next(dns_qid_t *disp, @@ -312,14 +320,16 @@ static isc_result_t get_udpsocket(dns_dispatchmgr_t *mgr, dns_dispatch_t *disp, isc_socketmgr_t *sockmgr, isc_sockaddr_t *localaddr, - isc_socket_t **sockp); + isc_socket_t **sockp, + isc_socket_t *dup_socket); static isc_result_t dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr, isc_taskmgr_t *taskmgr, isc_sockaddr_t *localaddr, unsigned int maxrequests, unsigned int attributes, - dns_dispatch_t **dispp); + dns_dispatch_t **dispp, + isc_socket_t *dup_socket); static isc_boolean_t destroy_mgr_ok(dns_dispatchmgr_t *mgr); static void destroy_mgr(dns_dispatchmgr_t **mgrp); static isc_result_t qid_allocate(dns_dispatchmgr_t *mgr, unsigned int buckets, @@ -327,7 +337,8 @@ static isc_result_t qid_allocate(dns_dispatchmgr_t *mgr, unsigned int buckets, isc_boolean_t needaddrtable); static void qid_destroy(isc_mem_t *mctx, dns_qid_t **qidp); static isc_result_t open_socket(isc_socketmgr_t *mgr, isc_sockaddr_t *local, - unsigned int options, isc_socket_t **sockp); + unsigned int options, isc_socket_t **sockp, + isc_socket_t *dup_socket); static isc_boolean_t portavailable(dns_dispatchmgr_t *mgr, isc_socket_t *sock, isc_sockaddr_t *sockaddrp); @@ -720,6 +731,11 @@ destroy_disp(isc_task_t *task, isc_event_t *event) { "shutting down; detaching from sock %p, task %p", disp->socket, disp->task[0]); /* XXXX */ + if (disp->sepool != NULL) { + isc_mempool_destroy(&disp->sepool); + (void)isc_mutex_destroy(&disp->sepool_lock); + } + if (disp->socket != NULL) isc_socket_detach(&disp->socket); while ((dispsocket = ISC_LIST_HEAD(disp->inactivesockets)) != NULL) { @@ -784,6 +800,7 @@ new_portentry(dns_dispatch_t *disp, in_port_t port) { static void deref_portentry(dns_dispatch_t *disp, dispportentry_t **portentryp) { dispportentry_t *portentry = *portentryp; + isc_boolean_t unlink = ISC_FALSE; dns_qid_t *qid; REQUIRE(disp->port_table != NULL); @@ -792,7 +809,10 @@ deref_portentry(dns_dispatch_t *disp, dispportentry_t **portentryp) { qid = DNS_QID(disp); LOCK(&qid->lock); portentry->refs--; - if (portentry->refs == 0) { + unlink = ISC_TF(portentry->refs == 0); + UNLOCK(&qid->lock); + + if (unlink) { ISC_LIST_UNLINK(disp->port_table[portentry->port % DNS_DISPATCH_PORTTABLESIZE], portentry, link); @@ -800,7 +820,6 @@ deref_portentry(dns_dispatch_t *disp, dispportentry_t **portentryp) { } *portentryp = NULL; - UNLOCK(&qid->lock); } /*% @@ -830,12 +849,12 @@ socket_search(dns_qid_t *qid, isc_sockaddr_t *dest, in_port_t port, /*% * Make a new socket for a single dispatch with a random port number. - * The caller must hold the disp->lock and qid->lock. + * The caller must hold the disp->lock */ static isc_result_t get_dispsocket(dns_dispatch_t *disp, isc_sockaddr_t *dest, - isc_socketmgr_t *sockmgr, dns_qid_t *qid, - dispsocket_t **dispsockp, in_port_t *portp) + isc_socketmgr_t *sockmgr, dispsocket_t **dispsockp, + in_port_t *portp) { int i; isc_uint32_t r; @@ -850,6 +869,7 @@ get_dispsocket(dns_dispatch_t *disp, isc_sockaddr_t *dest, in_port_t *ports; unsigned int bindoptions; dispportentry_t *portentry = NULL; + dns_qid_t *qid; if (isc_sockaddr_pf(&disp->local) == AF_INET) { nports = disp->mgr->nv4ports; @@ -890,19 +910,27 @@ get_dispsocket(dns_dispatch_t *disp, isc_sockaddr_t *dest, * very likely to fail in bind(2) or connect(2). */ localaddr = disp->local; + qid = DNS_QID(disp); + for (i = 0; i < 64; i++) { port = ports[dispatch_uniformrandom(DISP_ARC4CTX(disp), nports)]; isc_sockaddr_setport(&localaddr, port); + LOCK(&qid->lock); bucket = dns_hash(qid, dest, 0, port); - if (socket_search(qid, dest, port, bucket) != NULL) + if (socket_search(qid, dest, port, bucket) != NULL) { + UNLOCK(&qid->lock); continue; + } + UNLOCK(&qid->lock); bindoptions = 0; portentry = port_search(disp, port); + if (portentry != NULL) bindoptions |= ISC_SOCKET_REUSEADDRESS; - result = open_socket(sockmgr, &localaddr, bindoptions, &sock); + result = open_socket(sockmgr, &localaddr, bindoptions, &sock, + NULL); if (result == ISC_R_SUCCESS) { if (portentry == NULL) { portentry = new_portentry(disp, port); @@ -928,7 +956,9 @@ get_dispsocket(dns_dispatch_t *disp, isc_sockaddr_t *dest, dispsock->host = *dest; dispsock->portentry = portentry; dispsock->bucket = bucket; + LOCK(&qid->lock); ISC_LIST_APPEND(qid->sock_table[bucket], dispsock, blink); + UNLOCK(&qid->lock); *dispsockp = dispsock; *portp = port; } else { @@ -1063,6 +1093,7 @@ entry_search(dns_qid_t *qid, isc_sockaddr_t *dest, dns_messageid_t id, static void free_buffer(dns_dispatch_t *disp, void *buf, unsigned int len) { + isc_mempool_t *bpool; INSIST(buf != NULL && len != 0); @@ -1077,8 +1108,9 @@ free_buffer(dns_dispatch_t *disp, void *buf, unsigned int len) { INSIST(disp->mgr->buffers > 0); INSIST(len == disp->mgr->buffersize); disp->mgr->buffers--; - isc_mempool_put(disp->mgr->bpool, buf); + bpool = disp->mgr->bpool; UNLOCK(&disp->mgr->buffer_lock); + isc_mempool_put(bpool, buf); break; default: INSIST(0); @@ -1088,20 +1120,60 @@ free_buffer(dns_dispatch_t *disp, void *buf, unsigned int len) { static void * allocate_udp_buffer(dns_dispatch_t *disp) { + isc_mempool_t *bpool; void *temp; LOCK(&disp->mgr->buffer_lock); - temp = isc_mempool_get(disp->mgr->bpool); - - if (temp != NULL) - disp->mgr->buffers++; + bpool = disp->mgr->bpool; + disp->mgr->buffers++; UNLOCK(&disp->mgr->buffer_lock); + temp = isc_mempool_get(bpool); + + if (temp == NULL) { + LOCK(&disp->mgr->buffer_lock); + disp->mgr->buffers--; + UNLOCK(&disp->mgr->buffer_lock); + } + return (temp); } static inline void -free_event(dns_dispatch_t *disp, dns_dispatchevent_t *ev) { +free_sevent(isc_event_t *ev) { + isc_mempool_t *pool = ev->ev_destroy_arg; + isc_socketevent_t *sev = (isc_socketevent_t *) ev; + isc_mempool_put(pool, sev); +} + +static inline isc_socketevent_t * +allocate_sevent(dns_dispatch_t *disp, isc_socket_t *socket, + isc_eventtype_t type, isc_taskaction_t action, const void *arg) +{ + isc_socketevent_t *ev; + void *deconst_arg; + + ev = isc_mempool_get(disp->sepool); + if (ev == NULL) + return (NULL); + DE_CONST(arg, deconst_arg); + ISC_EVENT_INIT(ev, sizeof(*ev), 0, NULL, type, + action, deconst_arg, socket, + free_sevent, disp->sepool); + ev->result = ISC_R_UNSET; + ISC_LINK_INIT(ev, ev_link); + ISC_LIST_INIT(ev->bufferlist); + ev->region.base = NULL; + ev->n = 0; + ev->offset = 0; + ev->attributes = 0; + + return (ev); +} + + +static inline void +free_devent(dns_dispatch_t *disp, dns_dispatchevent_t *ev) { if (disp->failsafe_ev == ev) { INSIST(disp->shutdown_out == 1); disp->shutdown_out = 0; @@ -1109,14 +1181,14 @@ free_event(dns_dispatch_t *disp, dns_dispatchevent_t *ev) { return; } - isc_mempool_put(disp->mgr->epool, ev); + isc_mempool_put(disp->mgr->depool, ev); } static inline dns_dispatchevent_t * -allocate_event(dns_dispatch_t *disp) { +allocate_devent(dns_dispatch_t *disp) { dns_dispatchevent_t *ev; - ev = isc_mempool_get(disp->mgr->epool); + ev = isc_mempool_get(disp->mgr->depool); if (ev == NULL) return (NULL); ISC_EVENT_INIT(ev, sizeof(*ev), 0, NULL, 0, @@ -1381,7 +1453,7 @@ udp_recv(isc_event_t *ev_in, dns_dispatch_t *disp, dispsocket_t *dispsock) { sendresponse: queue_response = resp->item_out; - rev = allocate_event(resp->disp); + rev = allocate_devent(resp->disp); if (rev == NULL) { free_buffer(disp, ev->region.base, ev->region.length); goto unlock; @@ -1579,7 +1651,7 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) { if (resp == NULL) goto unlock; queue_response = resp->item_out; - rev = allocate_event(disp); + rev = allocate_devent(disp); if (rev == NULL) goto unlock; @@ -1660,16 +1732,33 @@ startrecv(dns_dispatch_t *disp, dispsocket_t *dispsock) { if (region.base == NULL) return (ISC_R_NOMEMORY); if (dispsock != NULL) { - res = isc_socket_recv(socket, ®ion, 1, - dispsock->task, udp_exrecv, - dispsock); + isc_task_t *dt = dispsock->task; + isc_socketevent_t *sev = + allocate_sevent(disp, socket, + ISC_SOCKEVENT_RECVDONE, + udp_exrecv, dispsock); + if (sev == NULL) { + free_buffer(disp, region.base, region.length); + return (ISC_R_NOMEMORY); + } + + res = isc_socket_recv2(socket, ®ion, 1, dt, sev, 0); if (res != ISC_R_SUCCESS) { free_buffer(disp, region.base, region.length); return (res); } } else { - res = isc_socket_recv(socket, ®ion, 1, - disp->task[0], udp_shrecv, disp); + isc_task_t *dt = disp->task[0]; + isc_socketevent_t *sev = + allocate_sevent(disp, socket, + ISC_SOCKEVENT_RECVDONE, + udp_shrecv, disp); + if (sev == NULL) { + free_buffer(disp, region.base, region.length); + return (ISC_R_NOMEMORY); + } + + res = isc_socket_recv2(socket, ®ion, 1, dt, sev, 0); if (res != ISC_R_SUCCESS) { free_buffer(disp, region.base, region.length); disp->shutdown_why = res; @@ -1709,16 +1798,16 @@ static isc_boolean_t destroy_mgr_ok(dns_dispatchmgr_t *mgr) { mgr_log(mgr, LVL(90), "destroy_mgr_ok: shuttingdown=%d, listnonempty=%d, " - "epool=%d, rpool=%d, dpool=%d", + "depool=%d, rpool=%d, dpool=%d", MGR_IS_SHUTTINGDOWN(mgr), !ISC_LIST_EMPTY(mgr->list), - isc_mempool_getallocated(mgr->epool), + isc_mempool_getallocated(mgr->depool), isc_mempool_getallocated(mgr->rpool), isc_mempool_getallocated(mgr->dpool)); if (!MGR_IS_SHUTTINGDOWN(mgr)) return (ISC_FALSE); if (!ISC_LIST_EMPTY(mgr->list)) return (ISC_FALSE); - if (isc_mempool_getallocated(mgr->epool) != 0) + if (isc_mempool_getallocated(mgr->depool) != 0) return (ISC_FALSE); if (isc_mempool_getallocated(mgr->rpool) != 0) return (ISC_FALSE); @@ -1748,7 +1837,7 @@ destroy_mgr(dns_dispatchmgr_t **mgrp) { DESTROYLOCK(&mgr->arc4_lock); - isc_mempool_destroy(&mgr->epool); + isc_mempool_destroy(&mgr->depool); isc_mempool_destroy(&mgr->rpool); isc_mempool_destroy(&mgr->dpool); if (mgr->bpool != NULL) @@ -1756,7 +1845,11 @@ destroy_mgr(dns_dispatchmgr_t **mgrp) { if (mgr->spool != NULL) isc_mempool_destroy(&mgr->spool); - DESTROYLOCK(&mgr->pool_lock); + DESTROYLOCK(&mgr->spool_lock); + DESTROYLOCK(&mgr->bpool_lock); + DESTROYLOCK(&mgr->dpool_lock); + DESTROYLOCK(&mgr->rpool_lock); + DESTROYLOCK(&mgr->depool_lock); #ifdef BIND9 if (mgr->entropy != NULL) @@ -1787,19 +1880,14 @@ destroy_mgr(dns_dispatchmgr_t **mgrp) { static isc_result_t open_socket(isc_socketmgr_t *mgr, isc_sockaddr_t *local, - unsigned int options, isc_socket_t **sockp) + unsigned int options, isc_socket_t **sockp, + isc_socket_t *dup_socket) { isc_socket_t *sock; isc_result_t result; sock = *sockp; - if (sock == NULL) { - result = isc_socket_create(mgr, isc_sockaddr_pf(local), - isc_sockettype_udp, &sock); - if (result != ISC_R_SUCCESS) - return (result); - isc_socket_setname(sock, "dispatcher", NULL); - } else { + if (sock != NULL) { #ifdef BIND9 result = isc_socket_open(sock); if (result != ISC_R_SUCCESS) @@ -1807,8 +1895,23 @@ open_socket(isc_socketmgr_t *mgr, isc_sockaddr_t *local, #else INSIST(0); #endif + } else if (dup_socket != NULL) { + result = isc_socket_dup(dup_socket, &sock); + if (result != ISC_R_SUCCESS) + return (result); + + isc_socket_setname(sock, "dispatcher", NULL); + *sockp = sock; + return (ISC_R_SUCCESS); + } else { + result = isc_socket_create(mgr, isc_sockaddr_pf(local), + isc_sockettype_udp, &sock); + if (result != ISC_R_SUCCESS) + return (result); } + isc_socket_setname(sock, "dispatcher", NULL); + #ifndef ISC_ALLOW_MAPPED isc_socket_ipv6only(sock, ISC_TRUE); #endif @@ -1886,22 +1989,38 @@ dns_dispatchmgr_create(isc_mem_t *mctx, isc_entropy_t *entropy, if (result != ISC_R_SUCCESS) goto kill_arc4_lock; - result = isc_mutex_init(&mgr->pool_lock); + result = isc_mutex_init(&mgr->depool_lock); if (result != ISC_R_SUCCESS) goto kill_buffer_lock; - mgr->epool = NULL; + result = isc_mutex_init(&mgr->rpool_lock); + if (result != ISC_R_SUCCESS) + goto kill_depool_lock; + + result = isc_mutex_init(&mgr->dpool_lock); + if (result != ISC_R_SUCCESS) + goto kill_rpool_lock; + + result = isc_mutex_init(&mgr->bpool_lock); + if (result != ISC_R_SUCCESS) + goto kill_dpool_lock; + + result = isc_mutex_init(&mgr->spool_lock); + if (result != ISC_R_SUCCESS) + goto kill_bpool_lock; + + mgr->depool = NULL; if (isc_mempool_create(mgr->mctx, sizeof(dns_dispatchevent_t), - &mgr->epool) != ISC_R_SUCCESS) { + &mgr->depool) != ISC_R_SUCCESS) { result = ISC_R_NOMEMORY; - goto kill_pool_lock; + goto kill_spool_lock; } mgr->rpool = NULL; if (isc_mempool_create(mgr->mctx, sizeof(dns_dispentry_t), &mgr->rpool) != ISC_R_SUCCESS) { result = ISC_R_NOMEMORY; - goto kill_epool; + goto kill_depool; } mgr->dpool = NULL; @@ -1911,17 +2030,23 @@ dns_dispatchmgr_create(isc_mem_t *mctx, isc_entropy_t *entropy, goto kill_rpool; } - isc_mempool_setname(mgr->epool, "dispmgr_epool"); - isc_mempool_setfreemax(mgr->epool, 1024); - isc_mempool_associatelock(mgr->epool, &mgr->pool_lock); + isc_mempool_setname(mgr->depool, "dispmgr_depool"); + isc_mempool_setmaxalloc(mgr->depool, 32768); + isc_mempool_setfreemax(mgr->depool, 32768); + isc_mempool_associatelock(mgr->depool, &mgr->depool_lock); + isc_mempool_setfillcount(mgr->depool, 256); isc_mempool_setname(mgr->rpool, "dispmgr_rpool"); - isc_mempool_setfreemax(mgr->rpool, 1024); - isc_mempool_associatelock(mgr->rpool, &mgr->pool_lock); + isc_mempool_setmaxalloc(mgr->rpool, 32768); + isc_mempool_setfreemax(mgr->rpool, 32768); + isc_mempool_associatelock(mgr->rpool, &mgr->rpool_lock); + isc_mempool_setfillcount(mgr->rpool, 256); isc_mempool_setname(mgr->dpool, "dispmgr_dpool"); - isc_mempool_setfreemax(mgr->dpool, 1024); - isc_mempool_associatelock(mgr->dpool, &mgr->pool_lock); + isc_mempool_setmaxalloc(mgr->dpool, 32768); + isc_mempool_setfreemax(mgr->dpool, 32768); + isc_mempool_associatelock(mgr->dpool, &mgr->dpool_lock); + isc_mempool_setfillcount(mgr->dpool, 256); mgr->buffers = 0; mgr->buffersize = 0; @@ -1970,10 +2095,18 @@ dns_dispatchmgr_create(isc_mem_t *mctx, isc_entropy_t *entropy, isc_mempool_destroy(&mgr->dpool); kill_rpool: isc_mempool_destroy(&mgr->rpool); - kill_epool: - isc_mempool_destroy(&mgr->epool); - kill_pool_lock: - DESTROYLOCK(&mgr->pool_lock); + kill_depool: + isc_mempool_destroy(&mgr->depool); + kill_spool_lock: + DESTROYLOCK(&mgr->spool_lock); + kill_bpool_lock: + DESTROYLOCK(&mgr->bpool_lock); + kill_dpool_lock: + DESTROYLOCK(&mgr->dpool_lock); + kill_rpool_lock: + DESTROYLOCK(&mgr->rpool_lock); + kill_depool_lock: + DESTROYLOCK(&mgr->depool_lock); kill_buffer_lock: DESTROYLOCK(&mgr->buffer_lock); kill_arc4_lock: @@ -2127,6 +2260,7 @@ dns_dispatchmgr_setudp(dns_dispatchmgr_t *mgr, */ if (maxbuffers > mgr->maxbuffers) { isc_mempool_setmaxalloc(mgr->bpool, maxbuffers); + isc_mempool_setfreemax(mgr->bpool, maxbuffers); mgr->maxbuffers = maxbuffers; } } else { @@ -2137,12 +2271,16 @@ dns_dispatchmgr_setudp(dns_dispatchmgr_t *mgr, } isc_mempool_setname(mgr->bpool, "dispmgr_bpool"); isc_mempool_setmaxalloc(mgr->bpool, maxbuffers); - isc_mempool_associatelock(mgr->bpool, &mgr->pool_lock); + isc_mempool_setfreemax(mgr->bpool, maxbuffers); + isc_mempool_associatelock(mgr->bpool, &mgr->bpool_lock); + isc_mempool_setfillcount(mgr->bpool, 256); } /* Create or adjust socket pool */ if (mgr->spool != NULL) { - isc_mempool_setmaxalloc(mgr->spool, DNS_DISPATCH_POOLSOCKS * 2); + if (maxrequests < DNS_DISPATCH_POOLSOCKS * 2) + isc_mempool_setmaxalloc(mgr->spool, DNS_DISPATCH_POOLSOCKS * 2); + isc_mempool_setfreemax(mgr->spool, DNS_DISPATCH_POOLSOCKS * 2); UNLOCK(&mgr->buffer_lock); return (ISC_R_SUCCESS); } @@ -2154,7 +2292,9 @@ dns_dispatchmgr_setudp(dns_dispatchmgr_t *mgr, } isc_mempool_setname(mgr->spool, "dispmgr_spool"); isc_mempool_setmaxalloc(mgr->spool, maxrequests); - isc_mempool_associatelock(mgr->spool, &mgr->pool_lock); + isc_mempool_setfreemax(mgr->spool, maxrequests); + isc_mempool_associatelock(mgr->spool, &mgr->spool_lock); + isc_mempool_setfillcount(mgr->spool, 256); result = qid_allocate(mgr, buckets, increment, &mgr->qid, ISC_TRUE); if (result != ISC_R_SUCCESS) @@ -2480,7 +2620,7 @@ dispatch_allocate(dns_dispatchmgr_t *mgr, unsigned int maxrequests, if (result != ISC_R_SUCCESS) goto deallocate; - disp->failsafe_ev = allocate_event(disp); + disp->failsafe_ev = allocate_devent(disp); if (disp->failsafe_ev == NULL) { result = ISC_R_NOMEMORY; goto kill_lock; @@ -2531,7 +2671,7 @@ dispatch_free(dns_dispatch_t **dispp) INSIST(ISC_LIST_EMPTY(disp->activesockets)); INSIST(ISC_LIST_EMPTY(disp->inactivesockets)); - isc_mempool_put(mgr->epool, disp->failsafe_ev); + isc_mempool_put(mgr->depool, disp->failsafe_ev); disp->failsafe_ev = NULL; if (disp->qid != NULL) @@ -2595,6 +2735,8 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, isc_socket_t *sock, disp->socket = NULL; isc_socket_attach(sock, &disp->socket); + disp->sepool = NULL; + disp->ntasks = 1; disp->task[0] = NULL; result = isc_task_create(taskmgr, 0, &disp->task[0]); @@ -2646,13 +2788,13 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, isc_socket_t *sock, } isc_result_t -dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr, +dns_dispatch_getudp_dup(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr, isc_taskmgr_t *taskmgr, isc_sockaddr_t *localaddr, unsigned int buffersize, unsigned int maxbuffers, unsigned int maxrequests, unsigned int buckets, unsigned int increment, unsigned int attributes, unsigned int mask, - dns_dispatch_t **dispp) + dns_dispatch_t **dispp, dns_dispatch_t *dup_dispatch) { isc_result_t result; dns_dispatch_t *disp = NULL; @@ -2683,28 +2825,31 @@ dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr, /* * See if we have a dispatcher that matches. */ - result = dispatch_find(mgr, localaddr, attributes, mask, &disp); - if (result == ISC_R_SUCCESS) { - disp->refcount++; - - if (disp->maxrequests < maxrequests) - disp->maxrequests = maxrequests; - - if ((disp->attributes & DNS_DISPATCHATTR_NOLISTEN) == 0 && - (attributes & DNS_DISPATCHATTR_NOLISTEN) != 0) - { - disp->attributes |= DNS_DISPATCHATTR_NOLISTEN; - if (disp->recv_pending != 0) - isc_socket_cancel(disp->socket, disp->task[0], - ISC_SOCKCANCEL_RECV); - } + if (dup_dispatch == NULL) { + result = dispatch_find(mgr, localaddr, attributes, mask, &disp); + if (result == ISC_R_SUCCESS) { + disp->refcount++; + + if (disp->maxrequests < maxrequests) + disp->maxrequests = maxrequests; + + if ((disp->attributes & DNS_DISPATCHATTR_NOLISTEN) == 0 + && (attributes & DNS_DISPATCHATTR_NOLISTEN) != 0) + { + disp->attributes |= DNS_DISPATCHATTR_NOLISTEN; + if (disp->recv_pending != 0) + isc_socket_cancel(disp->socket, + disp->task[0], + ISC_SOCKCANCEL_RECV); + } - UNLOCK(&disp->lock); - UNLOCK(&mgr->lock); + UNLOCK(&disp->lock); + UNLOCK(&mgr->lock); - *dispp = disp; + *dispp = disp; - return (ISC_R_SUCCESS); + return (ISC_R_SUCCESS); + } } createudp: @@ -2712,7 +2857,11 @@ dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr, * Nope, create one. */ result = dispatch_createudp(mgr, sockmgr, taskmgr, localaddr, - maxrequests, attributes, &disp); + maxrequests, attributes, &disp, + dup_dispatch == NULL + ? NULL + : dup_dispatch->socket); + if (result != ISC_R_SUCCESS) { UNLOCK(&mgr->lock); return (result); @@ -2720,9 +2869,25 @@ dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr, UNLOCK(&mgr->lock); *dispp = disp; + return (ISC_R_SUCCESS); } +isc_result_t +dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr, + isc_taskmgr_t *taskmgr, isc_sockaddr_t *localaddr, + unsigned int buffersize, + unsigned int maxbuffers, unsigned int maxrequests, + unsigned int buckets, unsigned int increment, + unsigned int attributes, unsigned int mask, + dns_dispatch_t **dispp) +{ + return (dns_dispatch_getudp_dup(mgr, sockmgr, taskmgr, localaddr, + buffersize, maxbuffers, maxrequests, + buckets, increment, attributes, + mask, dispp, NULL)); +} + /* * mgr should be locked. */ @@ -2734,7 +2899,7 @@ dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr, static isc_result_t get_udpsocket(dns_dispatchmgr_t *mgr, dns_dispatch_t *disp, isc_socketmgr_t *sockmgr, isc_sockaddr_t *localaddr, - isc_socket_t **sockp) + isc_socket_t **sockp, isc_socket_t *dup_socket) { unsigned int i, j; isc_socket_t *held[DNS_DISPATCH_HELD]; @@ -2774,7 +2939,7 @@ get_udpsocket(dns_dispatchmgr_t *mgr, dns_dispatch_t *disp, nports)]; isc_sockaddr_setport(&localaddr_bound, prt); result = open_socket(sockmgr, &localaddr_bound, - 0, &sock); + 0, &sock, NULL); /* * Continue if the port choosen is already in use * or the OS has reserved it. @@ -2794,7 +2959,8 @@ get_udpsocket(dns_dispatchmgr_t *mgr, dns_dispatch_t *disp, } else { /* Allow to reuse address for non-random ports. */ result = open_socket(sockmgr, localaddr, - ISC_SOCKET_REUSEADDRESS, &sock); + ISC_SOCKET_REUSEADDRESS, &sock, + dup_socket); if (result == ISC_R_SUCCESS) *sockp = sock; @@ -2806,7 +2972,7 @@ get_udpsocket(dns_dispatchmgr_t *mgr, dns_dispatch_t *disp, i = 0; for (j = 0; j < 0xffffU; j++) { - result = open_socket(sockmgr, localaddr, 0, &sock); + result = open_socket(sockmgr, localaddr, 0, &sock, NULL); if (result != ISC_R_SUCCESS) goto end; else if (portavailable(mgr, sock, NULL)) @@ -2843,7 +3009,8 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr, isc_sockaddr_t *localaddr, unsigned int maxrequests, unsigned int attributes, - dns_dispatch_t **dispp) + dns_dispatch_t **dispp, + isc_socket_t *dup_socket) { isc_result_t result; dns_dispatch_t *disp; @@ -2859,9 +3026,21 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr, return (result); if ((attributes & DNS_DISPATCHATTR_EXCLUSIVE) == 0) { - result = get_udpsocket(mgr, disp, sockmgr, localaddr, &sock); + result = get_udpsocket(mgr, disp, sockmgr, localaddr, &sock, + dup_socket); if (result != ISC_R_SUCCESS) goto deallocate_dispatch; + + if (isc_log_wouldlog(dns_lctx, 90)) { + char addrbuf[ISC_SOCKADDR_FORMATSIZE]; + + isc_sockaddr_format(localaddr, addrbuf, + ISC_SOCKADDR_FORMATSIZE); + mgr_log(mgr, LVL(90), "dns_dispatch_createudp: Created" + " UDP dispatch for %s with socket fd %d\n", + addrbuf, isc_socket_getfd(sock)); + } + } else { isc_sockaddr_t sa_any; @@ -2873,7 +3052,7 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr, */ isc_sockaddr_anyofpf(&sa_any, isc_sockaddr_pf(localaddr)); if (!isc_sockaddr_eqaddr(&sa_any, localaddr)) { - result = open_socket(sockmgr, localaddr, 0, &sock); + result = open_socket(sockmgr, localaddr, 0, &sock, NULL); if (sock != NULL) isc_socket_detach(&sock); if (result != ISC_R_SUCCESS) @@ -2925,6 +3104,24 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr, goto kill_task; } + disp->sepool = NULL; + if (isc_mempool_create(mgr->mctx, sizeof(isc_socketevent_t), + &disp->sepool) != ISC_R_SUCCESS) + { + result = ISC_R_NOMEMORY; + goto kill_ctlevent; + } + + result = isc_mutex_init(&disp->sepool_lock); + if (result != ISC_R_SUCCESS) + goto kill_sepool; + + isc_mempool_setname(disp->sepool, "disp_sepool"); + isc_mempool_setmaxalloc(disp->sepool, 32768); + isc_mempool_setfreemax(disp->sepool, 32768); + isc_mempool_associatelock(disp->sepool, &disp->sepool_lock); + isc_mempool_setfillcount(disp->sepool, 16); + attributes &= ~DNS_DISPATCHATTR_TCP; attributes |= DNS_DISPATCHATTR_UDP; disp->attributes = attributes; @@ -2940,11 +3137,16 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr, dispatch_log(disp, LVL(90), "created socket %p", disp->socket); *dispp = disp; + return (result); /* * Error returns. */ + kill_sepool: + isc_mempool_destroy(&disp->sepool); + kill_ctlevent: + isc_event_free(&disp->ctlevent); kill_task: for (i = 0; i < disp->ntasks; i++) isc_task_detach(&disp->task[i]); @@ -3061,7 +3263,7 @@ dns_dispatch_addresponse2(dns_dispatch_t *disp, isc_sockaddr_t *dest, oldestsocket = ISC_LIST_HEAD(disp->activesockets); oldestresp = oldestsocket->resp; if (oldestresp != NULL && !oldestresp->item_out) { - rev = allocate_event(oldestresp->disp); + rev = allocate_devent(oldestresp->disp); if (rev != NULL) { rev->buffer.base = NULL; rev->result = ISC_R_CANCELED; @@ -3088,16 +3290,14 @@ dns_dispatch_addresponse2(dns_dispatch_t *disp, isc_sockaddr_t *dest, } qid = DNS_QID(disp); - LOCK(&qid->lock); if ((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0) { /* * Get a separate UDP socket with a random port number. */ - result = get_dispsocket(disp, dest, sockmgr, qid, &dispsocket, + result = get_dispsocket(disp, dest, sockmgr, &dispsocket, &localport); if (result != ISC_R_SUCCESS) { - UNLOCK(&qid->lock); UNLOCK(&disp->lock); inc_stats(disp->mgr, dns_resstatscounter_dispsockfail); return (result); @@ -3109,6 +3309,7 @@ dns_dispatch_addresponse2(dns_dispatch_t *disp, isc_sockaddr_t *dest, /* * Try somewhat hard to find an unique ID. */ + LOCK(&qid->lock); id = (dns_messageid_t)dispatch_random(DISP_ARC4CTX(disp)); bucket = dns_hash(qid, dest, id, localport); ok = ISC_FALSE; @@ -3121,16 +3322,15 @@ dns_dispatch_addresponse2(dns_dispatch_t *disp, isc_sockaddr_t *dest, id &= 0x0000ffff; bucket = dns_hash(qid, dest, id, localport); } + UNLOCK(&qid->lock); if (!ok) { - UNLOCK(&qid->lock); UNLOCK(&disp->lock); return (ISC_R_NOMORE); } res = isc_mempool_get(disp->mgr->rpool); if (res == NULL) { - UNLOCK(&qid->lock); UNLOCK(&disp->lock); if (dispsocket != NULL) destroy_dispsocket(disp, &dispsocket); @@ -3155,6 +3355,8 @@ dns_dispatch_addresponse2(dns_dispatch_t *disp, isc_sockaddr_t *dest, ISC_LIST_INIT(res->items); ISC_LINK_INIT(res, link); res->magic = RESPONSE_MAGIC; + + LOCK(&qid->lock); ISC_LIST_APPEND(qid->qid_table[bucket], res, link); UNLOCK(&qid->lock); @@ -3302,7 +3504,7 @@ dns_dispatch_removeresponse(dns_dispentry_t **resp, res->item_out = ISC_FALSE; if (ev->buffer.base != NULL) free_buffer(disp, ev->buffer.base, ev->buffer.length); - free_event(disp, ev); + free_devent(disp, ev); } request_log(disp, res, LVL(90), "detaching from task %p", res->task); @@ -3322,7 +3524,7 @@ dns_dispatch_removeresponse(dns_dispentry_t **resp, ISC_LIST_UNLINK(res->items, ev, ev_link); if (ev->buffer.base != NULL) free_buffer(disp, ev->buffer.base, ev->buffer.length); - free_event(disp, ev); + free_devent(disp, ev); ev = ISC_LIST_HEAD(res->items); } res->magic = 0; @@ -3519,6 +3721,128 @@ dns_dispatch_importrecv(dns_dispatch_t *disp, isc_event_t *event) { isc_task_send(disp->task[0], ISC_EVENT_PTR(&newsevent)); } +dns_dispatch_t * +dns_dispatchset_get(dns_dispatchset_t *dset) { + dns_dispatch_t *disp; + + /* check that dispatch set is configured */ + if (dset == NULL || dset->ndisp == 0) + return (NULL); + + LOCK(&dset->lock); + disp = dset->dispatches[dset->cur]; + dset->cur++; + if (dset->cur == dset->ndisp) + dset->cur = 0; + UNLOCK(&dset->lock); + + return (disp); +} + +isc_result_t +dns_dispatchset_create(isc_mem_t *mctx, isc_socketmgr_t *sockmgr, + isc_taskmgr_t *taskmgr, dns_dispatch_t *source, + dns_dispatchset_t **dsetp, int n) +{ + isc_result_t result; + dns_dispatchset_t *dset; + dns_dispatchmgr_t *mgr; + int i, j; + + REQUIRE(VALID_DISPATCH(source)); + REQUIRE((source->attributes & DNS_DISPATCHATTR_UDP) != 0); + REQUIRE(dsetp != NULL && *dsetp == NULL); + + mgr = source->mgr; + + dset = isc_mem_get(mctx, sizeof(dns_dispatchset_t)); + if (dset == NULL) + return (ISC_R_NOMEMORY); + memset(dset, 0, sizeof(*dset)); + + result = isc_mutex_init(&dset->lock); + if (result != ISC_R_SUCCESS) + goto fail_alloc; + + dset->dispatches = isc_mem_get(mctx, sizeof(dns_dispatch_t *) * n); + if (dset == NULL) { + result = ISC_R_NOMEMORY; + goto fail_lock; + } + + isc_mem_attach(mctx, &dset->mctx); + dset->ndisp = n; + dset->cur = 0; + + dset->dispatches[0] = NULL; + dns_dispatch_attach(source, &dset->dispatches[0]); + + LOCK(&mgr->lock); + for (i = 1; i < n; i++) { + dset->dispatches[i] = NULL; + result = dispatch_createudp(mgr, sockmgr, taskmgr, + &source->local, + source->maxrequests, + source->attributes, + &dset->dispatches[i], + source->socket); + if (result != ISC_R_SUCCESS) + goto fail; + } + + UNLOCK(&mgr->lock); + *dsetp = dset; + + return (ISC_R_SUCCESS); + + fail: + UNLOCK(&mgr->lock); + + for (j = 0; j < i; j++) + dns_dispatch_detach(&(dset->dispatches[j])); + isc_mem_put(mctx, dset->dispatches, sizeof(dns_dispatch_t *) * n); + if (dset->mctx == mctx) + isc_mem_detach(&dset->mctx); + + fail_lock: + DESTROYLOCK(&dset->lock); + + fail_alloc: + isc_mem_put(mctx, dset, sizeof(dns_dispatchset_t)); + return (result); +} + +void +dns_dispatchset_cancelall(dns_dispatchset_t *dset, isc_task_t *task) { + int i; + + REQUIRE(dset != NULL); + + for (i = 0; i < dset->ndisp; i++) { + isc_socket_t *sock; + sock = dns_dispatch_getsocket(dset->dispatches[i]); + isc_socket_cancel(sock, task, ISC_SOCKCANCEL_ALL); + } +} + +void +dns_dispatchset_destroy(dns_dispatchset_t **dsetp) { + dns_dispatchset_t *dset; + int i; + + REQUIRE(dsetp != NULL && *dsetp != NULL); + + dset = *dsetp; + for (i = 0; i < dset->ndisp; i++) + dns_dispatch_detach(&(dset->dispatches[i])); + isc_mem_put(dset->mctx, dset->dispatches, + sizeof(dns_dispatch_t *) * dset->ndisp); + DESTROYLOCK(&dset->lock); + isc_mem_putanddetach(&dset->mctx, dset, sizeof(dns_dispatchset_t)); + + *dsetp = NULL; +} + #if 0 void dns_dispatchmgr_dump(dns_dispatchmgr_t *mgr) { diff --git a/lib/dns/dns64.c b/lib/dns/dns64.c index 0b3f1d4..78eff57 100644 --- a/lib/dns/dns64.c +++ b/lib/dns/dns64.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2010-2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2010, 2011 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -14,7 +14,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: dns64.c,v 1.8 2011/03/12 04:59:47 tbox Exp $ */ #include <config.h> diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c index 587bd1c..d00c99b 100644 --- a/lib/dns/dnssec.c +++ b/lib/dns/dnssec.c @@ -373,6 +373,15 @@ dns_dnssec_verify2(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key, isc_boolean_t ignoretime, isc_mem_t *mctx, dns_rdata_t *sigrdata, dns_name_t *wild) { + return (dns_dnssec_verify3(name, set, key, ignoretime, 0, mctx, + sigrdata, wild)); +} + +isc_result_t +dns_dnssec_verify3(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key, + isc_boolean_t ignoretime, unsigned int maxbits, + isc_mem_t *mctx, dns_rdata_t *sigrdata, dns_name_t *wild) +{ dns_rdata_rrsig_t sig; dns_fixedname_t fnewname; isc_region_t r; @@ -546,7 +555,7 @@ dns_dnssec_verify2(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key, r.base = sig.signature; r.length = sig.siglen; - ret = dst_context_verify(ctx, &r); + ret = dst_context_verify2(ctx, maxbits, &r); if (ret == ISC_R_SUCCESS && downcase) { char namebuf[DNS_NAME_FORMATSIZE]; dns_name_format(&sig.signer, namebuf, sizeof(namebuf)); @@ -683,6 +692,8 @@ dns_dnssec_findzonekeys2(dns_db_t *db, dns_dbversion_t *ver, pubkey = NULL; dns_rdataset_current(&rdataset, &rdata); RETERR(dns_dnssec_keyfromrdata(name, &rdata, mctx, &pubkey)); + dst_key_setttl(pubkey, rdataset.ttl); + if (!is_zone_key(pubkey) || (dst_key_flags(pubkey) & DNS_KEYTYPE_NOAUTH) != 0) goto next; @@ -760,6 +771,12 @@ dns_dnssec_findzonekeys2(dns_db_t *db, dns_dbversion_t *ver, goto next; } + /* + * Whatever the key's default TTL may have + * been, the rdataset TTL takes priority. + */ + dst_key_setttl(keys[count], rdataset.ttl); + if ((dst_key_flags(keys[count]) & DNS_KEYTYPE_NOAUTH) != 0) { /* We should never get here. */ dst_key_free(&keys[count]); @@ -1509,6 +1526,7 @@ dns_dnssec_keylistfromrdataset(dns_name_t *origin, dns_rdata_reset(&rdata); dns_rdataset_current(&keys, &rdata); RETERR(dns_dnssec_keyfromrdata(origin, &rdata, mctx, &pubkey)); + dst_key_setttl(pubkey, keys.ttl); if (!is_zone_key(pubkey) || (dst_key_flags(pubkey) & DNS_KEYTYPE_NOAUTH) != 0) @@ -1581,6 +1599,12 @@ dns_dnssec_keylistfromrdataset(dns_name_t *origin, if ((dst_key_flags(privkey) & DNS_KEYTYPE_NOAUTH) != 0) goto skip; + /* + * Whatever the key's default TTL may have + * been, the rdataset TTL takes priority. + */ + dst_key_setttl(privkey, dst_key_getttl(pubkey)); + RETERR(addkey(keylist, &privkey, savekeys, mctx)); skip: if (pubkey != NULL) @@ -1706,16 +1730,22 @@ remove_key(dns_diff_t *diff, dns_dnsseckey_t *key, dns_name_t *origin, isc_result_t dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys, dns_dnsseckeylist_t *removed, dns_name_t *origin, - dns_ttl_t ttl, dns_diff_t *diff, isc_boolean_t allzsk, - isc_mem_t *mctx, void (*report)(const char *, ...)) + dns_ttl_t hint_ttl, dns_diff_t *diff, + isc_boolean_t allzsk, isc_mem_t *mctx, + void (*report)(const char *, ...)) { isc_result_t result; dns_dnsseckey_t *key, *key1, *key2, *next; + isc_boolean_t found_ttl = ISC_FALSE; + dns_ttl_t ttl = hint_ttl; /* * First, look through the existing key list to find keys * supplied from the command line which are not in the zone. * Update the zone to include them. + * + * Also, if there are keys published in the zone already, + * use their TTL for all subsequent published keys. */ for (key = ISC_LIST_HEAD(*keys); key != NULL; @@ -1725,6 +1755,30 @@ dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys, RETERR(publish_key(diff, key, origin, ttl, mctx, allzsk, report)); } + if (key->source == dns_keysource_zoneapex) { + ttl = dst_key_getttl(key->key); + found_ttl = ISC_TRUE; + } + } + + /* + * If there were no existing keys, use the smallest nonzero + * TTL of the keys found in the repository. + */ + if (!found_ttl && !ISC_LIST_EMPTY(*newkeys)) { + dns_ttl_t shortest = 0; + + for (key = ISC_LIST_HEAD(*newkeys); + key != NULL; + key = ISC_LIST_NEXT(key, link)) { + dns_ttl_t thisttl = dst_key_getttl(key->key); + if (thisttl != 0 && + (shortest == 0 || thisttl < shortest)) + shortest = thisttl; + } + + if (shortest != 0) + ttl = shortest; } /* diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c index 53978bc..9860724 100644 --- a/lib/dns/dst_api.c +++ b/lib/dns/dst_api.c @@ -31,7 +31,7 @@ /* * Principal Author: Brian Wellington - * $Id$ + * $Id: dst_api.c,v 1.65 2011/10/20 21:20:02 marka Exp $ */ /*! \file */ @@ -58,6 +58,8 @@ #include <isc/util.h> #include <isc/file.h> +#define DST_KEY_INTERNAL + #include <dns/fixedname.h> #include <dns/keyvalues.h> #include <dns/name.h> @@ -92,6 +94,7 @@ static dst_key_t * get_key_struct(dns_name_t *name, unsigned int protocol, unsigned int bits, dns_rdataclass_t rdclass, + dns_ttl_t ttl, isc_mem_t *mctx); static isc_result_t write_public_key(const dst_key_t *key, int type, const char *directory); @@ -371,6 +374,25 @@ dst_context_verify(dst_context_t *dctx, isc_region_t *sig) { } isc_result_t +dst_context_verify2(dst_context_t *dctx, unsigned int maxbits, + isc_region_t *sig) +{ + REQUIRE(VALID_CTX(dctx)); + REQUIRE(sig != NULL); + + CHECKALG(dctx->key->key_alg); + if (dctx->key->keydata.generic == NULL) + return (DST_R_NULLKEY); + if (dctx->key->func->verify == NULL && + dctx->key->func->verify2 == NULL) + return (DST_R_NOTPUBLICKEY); + + return (dctx->key->func->verify2 != NULL ? + dctx->key->func->verify2(dctx, maxbits, sig) : + dctx->key->func->verify(dctx, sig)); +} + +isc_result_t dst_key_computesecret(const dst_key_t *pub, const dst_key_t *priv, isc_buffer_t *secret) { @@ -525,7 +547,7 @@ dst_key_fromnamedfile(const char *filename, const char *dirname, key = get_key_struct(pubkey->key_name, pubkey->key_alg, pubkey->key_flags, pubkey->key_proto, 0, - pubkey->key_class, mctx); + pubkey->key_class, pubkey->key_ttl, mctx); if (key == NULL) { dst_key_free(&pubkey); return (ISC_R_NOMEMORY); @@ -726,7 +748,7 @@ dst_key_fromgssapi(dns_name_t *name, gss_ctx_id_t gssctx, isc_mem_t *mctx, REQUIRE(keyp != NULL && *keyp == NULL); key = get_key_struct(name, DST_ALG_GSSAPI, 0, DNS_KEYPROTO_DNSSEC, - 0, dns_rdataclass_in, mctx); + 0, dns_rdataclass_in, 0, mctx); if (key == NULL) return (ISC_R_NOMEMORY); @@ -748,6 +770,40 @@ out: } isc_result_t +dst_key_buildinternal(dns_name_t *name, unsigned int alg, + unsigned int bits, unsigned int flags, + unsigned int protocol, dns_rdataclass_t rdclass, + void *data, isc_mem_t *mctx, dst_key_t **keyp) +{ + dst_key_t *key; + isc_result_t result; + + REQUIRE(dst_initialized == ISC_TRUE); + REQUIRE(dns_name_isabsolute(name)); + REQUIRE(mctx != NULL); + REQUIRE(keyp != NULL && *keyp == NULL); + REQUIRE(data != NULL); + + CHECKALG(alg); + + key = get_key_struct(name, alg, flags, protocol, bits, rdclass, + 0, mctx); + if (key == NULL) + return (ISC_R_NOMEMORY); + + key->keydata.generic = data; + + result = computeid(key); + if (result != ISC_R_SUCCESS) { + dst_key_free(&key); + return (result); + } + + *keyp = key; + return (ISC_R_SUCCESS); +} + +isc_result_t dst_key_fromlabel(dns_name_t *name, int alg, unsigned int flags, unsigned int protocol, dns_rdataclass_t rdclass, const char *engine, const char *label, const char *pin, @@ -764,7 +820,7 @@ dst_key_fromlabel(dns_name_t *name, int alg, unsigned int flags, CHECKALG(alg); - key = get_key_struct(name, alg, flags, protocol, 0, rdclass, mctx); + key = get_key_struct(name, alg, flags, protocol, 0, rdclass, 0, mctx); if (key == NULL) return (ISC_R_NOMEMORY); @@ -818,7 +874,8 @@ dst_key_generate2(dns_name_t *name, unsigned int alg, CHECKALG(alg); - key = get_key_struct(name, alg, flags, protocol, bits, rdclass, mctx); + key = get_key_struct(name, alg, flags, protocol, bits, + rdclass, 0, mctx); if (key == NULL) return (ISC_R_NOMEMORY); @@ -1078,7 +1135,7 @@ dst_key_free(dst_key_t **keyp) { isc_buffer_free(&key->key_tkeytoken); } memset(key, 0, sizeof(dst_key_t)); - isc_mem_put(mctx, key, sizeof(dst_key_t)); + isc_mem_putanddetach(&mctx, key, sizeof(dst_key_t)); *keyp = NULL; } @@ -1220,7 +1277,7 @@ dst_key_restore(dns_name_t *name, unsigned int alg, unsigned int flags, if (dst_t_func[alg]->restore == NULL) return (ISC_R_NOTIMPLEMENTED); - key = get_key_struct(name, alg, flags, protocol, 0, rdclass, mctx); + key = get_key_struct(name, alg, flags, protocol, 0, rdclass, 0, mctx); if (key == NULL) return (ISC_R_NOMEMORY); @@ -1244,7 +1301,7 @@ static dst_key_t * get_key_struct(dns_name_t *name, unsigned int alg, unsigned int flags, unsigned int protocol, unsigned int bits, dns_rdataclass_t rdclass, - isc_mem_t *mctx) + dns_ttl_t ttl, isc_mem_t *mctx) { dst_key_t *key; isc_result_t result; @@ -1277,13 +1334,14 @@ get_key_struct(dns_name_t *name, unsigned int alg, isc_mem_put(mctx, key, sizeof(dst_key_t)); return (NULL); } + isc_mem_attach(mctx, &key->mctx); key->key_alg = alg; key->key_flags = flags; key->key_proto = protocol; - key->mctx = mctx; key->keydata.generic = NULL; key->key_size = bits; key->key_class = rdclass; + key->key_ttl = ttl; key->func = dst_t_func[alg]; key->fmt_major = 0; key->fmt_minor = 0; @@ -1312,7 +1370,7 @@ dst_key_read_public(const char *filename, int type, unsigned int opt = ISC_LEXOPT_DNSMULTILINE; dns_rdataclass_t rdclass = dns_rdataclass_in; isc_lexspecials_t specials; - isc_uint32_t ttl; + isc_uint32_t ttl = 0; isc_result_t result; dns_rdatatype_t keytype; @@ -1413,6 +1471,8 @@ dst_key_read_public(const char *filename, int type, if (ret != ISC_R_SUCCESS) goto cleanup; + dst_key_setttl(*keyp, ttl); + cleanup: if (lex != NULL) isc_lex_destroy(&lex); @@ -1581,9 +1641,11 @@ write_public_key(const dst_key_t *key, int type, const char *directory) { /* Now print the actual key */ ret = dns_name_print(key->key_name, fp); - fprintf(fp, " "); + if (key->key_ttl != 0) + fprintf(fp, "%d ", key->key_ttl); + isc_buffer_usedregion(&classb, &r); if ((unsigned) fwrite(r.base, 1, r.length, fp) != r.length) ret = DST_R_WRITEERROR; @@ -1675,7 +1737,7 @@ frombuffer(dns_name_t *name, unsigned int alg, unsigned int flags, REQUIRE(mctx != NULL); REQUIRE(keyp != NULL && *keyp == NULL); - key = get_key_struct(name, alg, flags, protocol, 0, rdclass, mctx); + key = get_key_struct(name, alg, flags, protocol, 0, rdclass, 0, mctx); if (key == NULL) return (ISC_R_NOMEMORY); diff --git a/lib/dns/dst_internal.h b/lib/dns/dst_internal.h index ee824f4..c3e8e29 100644 --- a/lib/dns/dst_internal.h +++ b/lib/dns/dst_internal.h @@ -29,7 +29,7 @@ * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: dst_internal.h,v 1.31 2011/10/20 21:20:02 marka Exp $ */ #ifndef DST_DST_INTERNAL_H #define DST_DST_INTERNAL_H 1 @@ -98,6 +98,7 @@ struct dst_key { revoked */ isc_uint16_t key_bits; /*%< hmac digest bits */ dns_rdataclass_t key_class; /*%< class of the key record */ + dns_ttl_t key_ttl; /*%< default/initial dnskey ttl */ isc_mem_t *mctx; /*%< memory context */ char *engine; /*%< engine name (HSM) */ char *label; /*%< engine label (HSM) */ @@ -170,6 +171,8 @@ struct dst_func { */ isc_result_t (*sign)(dst_context_t *dctx, isc_buffer_t *sig); isc_result_t (*verify)(dst_context_t *dctx, const isc_region_t *sig); + isc_result_t (*verify2)(dst_context_t *dctx, int maxbits, + const isc_region_t *sig); isc_result_t (*computesecret)(const dst_key_t *pub, const dst_key_t *priv, isc_buffer_t *secret); diff --git a/lib/dns/dst_openssl.h b/lib/dns/dst_openssl.h index e4d636e..99a43ef 100644 --- a/lib/dns/dst_openssl.h +++ b/lib/dns/dst_openssl.h @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: dst_openssl.h,v 1.11 2011/03/12 04:59:48 tbox Exp $ */ #ifndef DST_OPENSSL_H #define DST_OPENSSL_H 1 diff --git a/lib/dns/dst_parse.c b/lib/dns/dst_parse.c index 95896c4..ca43cb3 100644 --- a/lib/dns/dst_parse.c +++ b/lib/dns/dst_parse.c @@ -31,7 +31,7 @@ /*% * Principal Author: Brian Wellington - * $Id$ + * $Id: dst_parse.c,v 1.29 2011/08/18 23:46:35 tbox Exp $ */ #include <config.h> diff --git a/lib/dns/ecdb.c b/lib/dns/ecdb.c index 20da5b0..8b3f774 100644 --- a/lib/dns/ecdb.c +++ b/lib/dns/ecdb.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2009-2013 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2009-2011, 2013 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -14,7 +14,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: ecdb.c,v 1.10 2011/12/20 00:06:53 marka Exp $ */ #include "config.h" @@ -583,7 +583,9 @@ static dns_dbmethods_t ecdb_methods = { NULL, /* isdnssec */ NULL, /* getrrsetstats */ NULL, /* rpz_enabled */ - NULL /* rpz_findips */ + NULL, /* rpz_findips */ + NULL, /* findnodeext */ + NULL /* findext */ }; static isc_result_t diff --git a/lib/dns/gssapi_link.c b/lib/dns/gssapi_link.c index a992a89..5ad81cd 100644 --- a/lib/dns/gssapi_link.c +++ b/lib/dns/gssapi_link.c @@ -16,7 +16,7 @@ */ /* - * $Id$ + * $Id: gssapi_link.c,v 1.17 2011/03/28 05:32:16 marka Exp $ */ #include <config.h> @@ -362,6 +362,7 @@ static dst_func_t gssapi_functions = { gssapi_adddata, gssapi_sign, gssapi_verify, + NULL, /*%< verify2 */ NULL, /*%< computesecret */ gssapi_compare, NULL, /*%< paramcompare */ diff --git a/lib/dns/gssapictx.c b/lib/dns/gssapictx.c index e4047d2..a8c5900 100644 --- a/lib/dns/gssapictx.c +++ b/lib/dns/gssapictx.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: gssapictx.c,v 1.29 2011/08/29 06:33:25 marka Exp $ */ #include <config.h> diff --git a/lib/dns/hmac_link.c b/lib/dns/hmac_link.c index bc0e9a0..256abb6 100644 --- a/lib/dns/hmac_link.c +++ b/lib/dns/hmac_link.c @@ -1,5 +1,5 @@ /* - * Portions Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC") + * Portions Copyright (C) 2004-2012 Internet Systems Consortium, Inc. ("ISC") * Portions Copyright (C) 1999-2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -313,6 +313,7 @@ static dst_func_t hmacmd5_functions = { hmacmd5_adddata, hmacmd5_sign, hmacmd5_verify, + NULL, /*%< verify2 */ NULL, /*%< computesecret */ hmacmd5_compare, NULL, /*%< paramcompare */ @@ -589,6 +590,7 @@ static dst_func_t hmacsha1_functions = { hmacsha1_adddata, hmacsha1_sign, hmacsha1_verify, + NULL, /* verify2 */ NULL, /* computesecret */ hmacsha1_compare, NULL, /* paramcompare */ @@ -867,6 +869,7 @@ static dst_func_t hmacsha224_functions = { hmacsha224_adddata, hmacsha224_sign, hmacsha224_verify, + NULL, /* verify2 */ NULL, /* computesecret */ hmacsha224_compare, NULL, /* paramcompare */ @@ -1145,6 +1148,7 @@ static dst_func_t hmacsha256_functions = { hmacsha256_adddata, hmacsha256_sign, hmacsha256_verify, + NULL, /* verify2 */ NULL, /* computesecret */ hmacsha256_compare, NULL, /* paramcompare */ @@ -1423,6 +1427,7 @@ static dst_func_t hmacsha384_functions = { hmacsha384_adddata, hmacsha384_sign, hmacsha384_verify, + NULL, /* verify2 */ NULL, /* computesecret */ hmacsha384_compare, NULL, /* paramcompare */ @@ -1701,6 +1706,7 @@ static dst_func_t hmacsha512_functions = { hmacsha512_adddata, hmacsha512_sign, hmacsha512_verify, + NULL, /* verify2 */ NULL, /* computesecret */ hmacsha512_compare, NULL, /* paramcompare */ diff --git a/lib/dns/include/dns/Makefile.in b/lib/dns/include/dns/Makefile.in index ad8bc38..1a69f2c 100644 --- a/lib/dns/include/dns/Makefile.in +++ b/lib/dns/include/dns/Makefile.in @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id$ +# $Id: Makefile.in,v 1.60 2011/11/14 18:32:34 each Exp $ srcdir = @srcdir@ VPATH = @srcdir@ @@ -22,8 +22,8 @@ top_srcdir = @top_srcdir@ @BIND9_VERSION@ HEADERS = acl.h adb.h byaddr.h cache.h callbacks.h cert.h compress.h \ - db.h dbiterator.h dbtable.h diff.h dispatch.h dlz.h \ - dnssec.h ds.h events.h fixedname.h iptable.h journal.h \ + clientinfo.h db.h dbiterator.h dbtable.h diff.h dispatch.h \ + dlz.h dnssec.h ds.h events.h fixedname.h iptable.h journal.h \ keyflags.h keytable.h keyvalues.h lib.h log.h \ master.h masterdump.h message.h name.h ncache.h nsec.h \ peer.h portlist.h private.h rbt.h rcode.h \ diff --git a/lib/dns/include/dns/acache.h b/lib/dns/include/dns/acache.h index c372ed9..304cba7 100644 --- a/lib/dns/include/dns/acache.h +++ b/lib/dns/include/dns/acache.h @@ -238,7 +238,7 @@ dns_acache_setcleaninginterval(dns_acache_t *acache, unsigned int t); */ void -dns_acache_setcachesize(dns_acache_t *acache, isc_uint32_t size); +dns_acache_setcachesize(dns_acache_t *acache, size_t size); /* * Set the maximum additional cache size. 0 means unlimited. */ diff --git a/lib/dns/include/dns/acl.h b/lib/dns/include/dns/acl.h index 41b9522..f4fc4a3 100644 --- a/lib/dns/include/dns/acl.h +++ b/lib/dns/include/dns/acl.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2007, 2009, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007, 2009, 2011 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: acl.h,v 1.35 2011/06/17 23:47:49 tbox Exp $ */ #ifndef DNS_ACL_H #define DNS_ACL_H 1 diff --git a/lib/dns/include/dns/adb.h b/lib/dns/include/dns/adb.h index b8c41dc..a5a3124 100644 --- a/lib/dns/include/dns/adb.h +++ b/lib/dns/include/dns/adb.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2008, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2008, 2011, 2013 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: adb.h,v 1.88 2011/12/05 17:10:51 each Exp $ */ #ifndef DNS_ADB_H #define DNS_ADB_H 1 @@ -607,7 +607,7 @@ dns_adb_flush(dns_adb_t *adb); */ void -dns_adb_setadbsize(dns_adb_t *adb, isc_uint32_t size); +dns_adb_setadbsize(dns_adb_t *adb, size_t size); /*%< * Set a target memory size. If memory usage exceeds the target * size entries will be removed before they would have expired on diff --git a/lib/dns/include/dns/cache.h b/lib/dns/include/dns/cache.h index f0825be..f7140aa 100644 --- a/lib/dns/include/dns/cache.h +++ b/lib/dns/include/dns/cache.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2007, 2009, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007, 2009, 2011, 2013 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2001 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: cache.h,v 1.32 2011/08/02 23:47:52 tbox Exp $ */ #ifndef DNS_CACHE_H #define DNS_CACHE_H 1 @@ -245,12 +245,6 @@ dns_cache_getcleaninginterval(dns_cache_t *cache); * Get the periodic cache cleaning interval to 'interval' seconds. */ -isc_uint32_t -dns_cache_getcachesize(dns_cache_t *cache); -/*%< - * Get the maximum cache size. - */ - const char * dns_cache_getname(dns_cache_t *cache); /*%< @@ -258,12 +252,12 @@ dns_cache_getname(dns_cache_t *cache); */ void -dns_cache_setcachesize(dns_cache_t *cache, isc_uint32_t size); +dns_cache_setcachesize(dns_cache_t *cache, size_t size); /*%< * Set the maximum cache size. 0 means unlimited. */ -isc_uint32_t +size_t dns_cache_getcachesize(dns_cache_t *cache); /*%< * Get the maximum cache size. @@ -280,9 +274,27 @@ dns_cache_flush(dns_cache_t *cache); */ isc_result_t +dns_cache_flushnode(dns_cache_t *cache, dns_name_t *name, + isc_boolean_t tree); +/* + * Flush a given name from the cache. If 'tree' is true, then + * also flush all names under 'name'. + * + * Requires: + *\li 'cache' to be valid. + *\li 'name' to be valid. + * + * Returns: + *\li #ISC_R_SUCCESS + *\li #ISC_R_NOMEMORY + *\li other error returns. + */ + +isc_result_t dns_cache_flushname(dns_cache_t *cache, dns_name_t *name); /* - * Flushes a given name from the cache. + * Flush a given name from the cache. Equivalent to + * dns_cache_flushpartial(cache, name, ISC_FALSE). * * Requires: *\li 'cache' to be valid. diff --git a/lib/dns/include/dns/callbacks.h b/lib/dns/include/dns/callbacks.h index b686647..5e9cb71 100644 --- a/lib/dns/include/dns/callbacks.h +++ b/lib/dns/include/dns/callbacks.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2007, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007, 2011 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: callbacks.h,v 1.26 2011/12/09 23:47:05 tbox Exp $ */ #ifndef DNS_CALLBACKS_H #define DNS_CALLBACKS_H 1 @@ -41,6 +41,14 @@ struct dns_rdatacallbacks { * dns_load_master calls this when it has rdatasets to commit. */ dns_addrdatasetfunc_t add; + + /*% + * dns_master_load*() call this when loading a raw zonefile, + * to pass back information obtained from the file header + */ + dns_rawdatafunc_t rawdata; + dns_zone_t *zone; + /*% * dns_load_master / dns_rdata_fromtext call this to issue a error. */ diff --git a/lib/dns/include/dns/clientinfo.h b/lib/dns/include/dns/clientinfo.h new file mode 100644 index 0000000..4f2b89c --- /dev/null +++ b/lib/dns/include/dns/clientinfo.h @@ -0,0 +1,85 @@ +/* + * Copyright (C) 2011 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +/* $Id: clientinfo.h,v 1.3 2011/10/11 23:46:45 tbox Exp $ */ + +#ifndef DNS_CLIENTINFO_H +#define DNS_CLIENTINFO_H 1 + +/***** + ***** Module Info + *****/ + +/*! \file dns/clientinfo.h + * \brief + * The DNS clientinfo interface allows libdns to retrieve information + * about the client from the caller. + * + * The clientinfo interface is used by the DNS DB and DLZ interfaces; + * it allows databases to modify their answers on the basis of information + * about the client, such as source IP address. + * + * dns_clientinfo_t contains a pointer to an opaque structure containing + * client information in some form. dns_clientinfomethods_t contains a + * list of methods which operate on that opaque structure to return + * potentially useful data. Both structures also contain versioning + * information. + */ + +/***** + ***** Imports + *****/ + +#include <isc/sockaddr.h> +#include <isc/types.h> + +ISC_LANG_BEGINDECLS + +/***** + ***** Types + *****/ + +#define DNS_CLIENTINFO_VERSION 1 +typedef struct dns_clientinfo { + isc_uint16_t version; + void *data; +} dns_clientinfo_t; + +typedef isc_result_t (*dns_clientinfo_sourceip_t)(dns_clientinfo_t *client, + isc_sockaddr_t **addrp); + +#define DNS_CLIENTINFOMETHODS_VERSION 1 +#define DNS_CLIENTINFOMETHODS_AGE 0 + +typedef struct dns_clientinfomethods { + isc_uint16_t version; + isc_uint16_t age; + dns_clientinfo_sourceip_t sourceip; +} dns_clientinfomethods_t; + +/***** + ***** Methods + *****/ +void +dns_clientinfomethods_init(dns_clientinfomethods_t *methods, + dns_clientinfo_sourceip_t sourceip); + +void +dns_clientinfo_init(dns_clientinfo_t *ci, void *data); + +ISC_LANG_ENDDECLS + +#endif /* DNS_CLIENTINFO_H */ diff --git a/lib/dns/include/dns/db.h b/lib/dns/include/dns/db.h index ef090a2..66bc3e3 100644 --- a/lib/dns/include/dns/db.h +++ b/lib/dns/include/dns/db.h @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: db.h,v 1.107.4.1 2011/10/23 20:12:08 vjs Exp $ */ #ifndef DNS_DB_H #define DNS_DB_H 1 @@ -59,6 +59,7 @@ #include <isc/ondestroy.h> #include <isc/stdtime.h> +#include <dns/clientinfo.h> #include <dns/fixedname.h> #include <dns/name.h> #include <dns/rdata.h> @@ -179,6 +180,20 @@ typedef struct dns_dbmethods { dns_rdataset_t *ardataset, dns_rpz_st_t *st, dns_name_t *query_qname); + isc_result_t (*findnodeext)(dns_db_t *db, dns_name_t *name, + isc_boolean_t create, + dns_clientinfomethods_t *methods, + dns_clientinfo_t *clientinfo, + dns_dbnode_t **nodep); + isc_result_t (*findext)(dns_db_t *db, dns_name_t *name, + dns_dbversion_t *version, + dns_rdatatype_t type, unsigned int options, + isc_stdtime_t now, + dns_dbnode_t **nodep, dns_name_t *foundname, + dns_clientinfomethods_t *methods, + dns_clientinfo_t *clientinfo, + dns_rdataset_t *rdataset, + dns_rdataset_t *sigrdataset); } dns_dbmethods_t; typedef isc_result_t @@ -660,9 +675,19 @@ dns_db_closeversion(dns_db_t *db, dns_dbversion_t **versionp, isc_result_t dns_db_findnode(dns_db_t *db, dns_name_t *name, isc_boolean_t create, dns_dbnode_t **nodep); + +isc_result_t +dns_db_findnodeext(dns_db_t *db, dns_name_t *name, isc_boolean_t create, + dns_clientinfomethods_t *methods, + dns_clientinfo_t *clientinfo, dns_dbnode_t **nodep); /*%< * Find the node with name 'name'. * + * dns_db_findnodeext() (findnode extended) also accepts parameters + * 'methods' and 'clientinfo', which, when provided, enable the database to + * retreive information about the client from the caller, and modify its + * response on the basis of that information. + * * Notes: * \li If 'create' is ISC_TRUE and no node with name 'name' exists, then * such a node will be created. @@ -699,9 +724,21 @@ dns_db_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, dns_rdatatype_t type, unsigned int options, isc_stdtime_t now, dns_dbnode_t **nodep, dns_name_t *foundname, dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset); + +isc_result_t +dns_db_findext(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, + dns_rdatatype_t type, unsigned int options, isc_stdtime_t now, + dns_dbnode_t **nodep, dns_name_t *foundname, + dns_clientinfomethods_t *methods, dns_clientinfo_t *clientinfo, + dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset); /*%< * Find the best match for 'name' and 'type' in version 'version' of 'db'. * + * dns_db_findext() (find extended) also accepts parameters 'methods' + * and 'clientinfo', which when provided enable the database to retreive + * information about the client from the caller, and modify its response + * on the basis of this information. + * * Notes: * * \li If type == dns_rdataset_any, then rdataset will not be bound. @@ -733,6 +770,10 @@ dns_db_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, * that it is correct. This only affects answers returned from the * cache. * + * \li In the #DNS_DBFIND_FORCENSEC3 option is set, then we are looking + * in the NSEC3 tree and not the main tree. Without this option being + * set NSEC3 records will not be found. + * * \li To respond to a query for SIG records, the caller should create a * rdataset iterator and extract the signatures from each rdataset. * @@ -1048,6 +1089,7 @@ dns_db_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version, dns_rdatatype_t type, dns_rdatatype_t covers, isc_stdtime_t now, dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset); + /*%< * Search for an rdataset of type 'type' at 'node' that are in version * 'version' of 'db'. If found, make 'rdataset' refer to it. diff --git a/lib/dns/include/dns/dispatch.h b/lib/dns/include/dns/dispatch.h index 3f881df..1235f7c 100644 --- a/lib/dns/include/dns/dispatch.h +++ b/lib/dns/include/dns/dispatch.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2009, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2009, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: dispatch.h,v 1.64 2011/07/28 23:47:58 tbox Exp $ */ #ifndef DNS_DISPATCH_H #define DNS_DISPATCH_H 1 @@ -54,6 +54,7 @@ #include <isc/buffer.h> #include <isc/lang.h> +#include <isc/mutex.h> #include <isc/socket.h> #include <isc/types.h> @@ -88,6 +89,18 @@ struct dns_dispatchevent { isc_uint32_t attributes; /*%< mirrored from socket.h */ }; +/*% + * This is a set of one or more dispatches which can be retrieved + * round-robin fashion. + */ +struct dns_dispatchset { + isc_mem_t *mctx; + dns_dispatch_t **dispatches; + int ndisp; + int cur; + isc_mutex_t lock; +}; + /*@{*/ /*% * Attributes for added dispatchers. @@ -245,6 +258,15 @@ dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr, unsigned int buckets, unsigned int increment, unsigned int attributes, unsigned int mask, dns_dispatch_t **dispp); + +isc_result_t +dns_dispatch_getudp_dup(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr, + isc_taskmgr_t *taskmgr, isc_sockaddr_t *localaddr, + unsigned int buffersize, + unsigned int maxbuffers, unsigned int maxrequests, + unsigned int buckets, unsigned int increment, + unsigned int attributes, unsigned int mask, + dns_dispatch_t **dispp, dns_dispatch_t *dup); /*%< * Attach to existing dns_dispatch_t if one is found with dns_dispatchmgr_find, * otherwise create a new UDP dispatch. @@ -496,6 +518,46 @@ dns_dispatch_importrecv(dns_dispatch_t *disp, isc_event_t *event); * event != NULL */ +dns_dispatch_t * +dns_dispatchset_get(dns_dispatchset_t *dset); +/*%< + * Retrieve the next dispatch from dispatch set 'dset', and increment + * the round-robin counter. + * + * Requires: + *\li dset != NULL + */ + +isc_result_t +dns_dispatchset_create(isc_mem_t *mctx, isc_socketmgr_t *sockmgr, + isc_taskmgr_t *taskmgr, dns_dispatch_t *source, + dns_dispatchset_t **dsetp, int n); +/*%< + * Given a valid dispatch 'source', create a dispatch set containing + * 'n' UDP dispatches, with the remainder filled out by clones of the + * source. + * + * Requires: + *\li source is a valid UDP dispatcher + *\li dsetp != NULL, *dsetp == NULL + */ + +void +dns_dispatchset_cancelall(dns_dispatchset_t *dset, isc_task_t *task); +/*%< + * Cancel socket operations for the dispatches in 'dset'. + */ + +void +dns_dispatchset_destroy(dns_dispatchset_t **dsetp); +/*%< + * Dereference all the dispatches in '*dsetp', free the dispatchset + * memory, and set *dsetp to NULL. + * + * Requires: + *\li dset is valid + */ + ISC_LANG_ENDDECLS #endif /* DNS_DISPATCH_H */ diff --git a/lib/dns/include/dns/dlz_dlopen.h b/lib/dns/include/dns/dlz_dlopen.h index 6ad7e7a..f87722c 100644 --- a/lib/dns/include/dns/dlz_dlopen.h +++ b/lib/dns/include/dns/dlz_dlopen.h @@ -30,7 +30,7 @@ ISC_LANG_BEGINDECLS * for the entry points of an external DLZ module for bind9. */ -#define DLZ_DLOPEN_VERSION 1 +#define DLZ_DLOPEN_VERSION 2 /* * dlz_dlopen_version() is required for all DLZ external drivers. It @@ -65,7 +65,9 @@ typedef isc_result_t dlz_dlopen_findzonedb_t (void *dbdata, typedef isc_result_t dlz_dlopen_lookup_t (const char *zone, const char *name, void *dbdata, - dns_sdlzlookup_t *lookup); + dns_sdlzlookup_t *lookup, + dns_clientinfomethods_t *methods, + dns_clientinfo_t *clientinfo); /* * dlz_dlopen_authority is optional() if dlz_dlopen_lookup() @@ -116,6 +118,15 @@ typedef isc_result_t dlz_dlopen_configure_t (dns_view_t *view, void *dbdata); /* + * dlz_dlopen_setclientcallback() is optional, but must be supplied if you + * want to retrieve information about the client (e.g., source address) + * before sending a replay. + */ +typedef isc_result_t dlz_dlopen_setclientcallback_t (dns_view_t *view, + void *dbdata); + + +/* * dlz_dlopen_ssumatch() is optional, but must be supplied if you want * to support dynamic updates */ diff --git a/lib/dns/include/dns/dnssec.h b/lib/dns/include/dns/dnssec.h index e986d40..e443f91 100644 --- a/lib/dns/include/dns/dnssec.h +++ b/lib/dns/include/dns/dnssec.h @@ -132,12 +132,19 @@ isc_result_t dns_dnssec_verify2(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key, isc_boolean_t ignoretime, isc_mem_t *mctx, dns_rdata_t *sigrdata, dns_name_t *wild); + +isc_result_t +dns_dnssec_verify3(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key, + isc_boolean_t ignoretime, unsigned int maxbits, + isc_mem_t *mctx, dns_rdata_t *sigrdata, dns_name_t *wild); /*%< * Verifies the RRSIG record covering this rdataset signed by a specific * key. This does not determine if the key's owner is authorized to sign * this record, as this requires a resolver or database. * If 'ignoretime' is ISC_TRUE, temporal validity will not be checked. * + * 'maxbits' specifies the maximum number of rsa exponent bits accepted. + * * Requires: *\li 'name' (the owner name of the record) is a valid name *\li 'set' is a valid rdataset @@ -309,7 +316,7 @@ dns_dnssec_keylistfromrdataset(dns_name_t *origin, isc_result_t dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys, dns_dnsseckeylist_t *removed, dns_name_t *origin, - dns_ttl_t ttl, dns_diff_t *diff, isc_boolean_t allzsk, + dns_ttl_t hint_ttl, dns_diff_t *diff, isc_boolean_t allzsk, isc_mem_t *mctx, void (*report)(const char *, ...)); /*%< * Update the list of keys in 'keys' with new key information in 'newkeys'. @@ -328,9 +335,11 @@ dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys, * If 'allzsk' is true, we are allowing KSK-flagged keys to be used as * ZSKs. * - * 'ttl' is the TTL of the DNSKEY RRset; if it is longer than the - * time until a new key will be activated, then we have to delay the - * key's activation. + * 'hint_ttl' is the TTL to use for the DNSKEY RRset if there is no + * existing RRset, and if none of the keys to be added has a default TTL + * (in which case we would use the shortest one). If the TTL is longer + * than the time until a new key will be activated, then we have to delay + * the key's activation. * * 'report' points to a function for reporting status. * diff --git a/lib/dns/include/dns/events.h b/lib/dns/include/dns/events.h index 3a28ab2..fd2144f 100644 --- a/lib/dns/include/dns/events.h +++ b/lib/dns/include/dns/events.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2007, 2009, 2010, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007, 2009-2011 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: events.h,v 1.61 2011/10/28 06:20:06 each Exp $ */ #ifndef DNS_EVENTS_H #define DNS_EVENTS_H 1 @@ -74,6 +74,11 @@ #define DNS_EVENT_CLIENTREQDONE (ISC_EVENTCLASS_DNS + 44) #define DNS_EVENT_ADBGROWENTRIES (ISC_EVENTCLASS_DNS + 45) #define DNS_EVENT_ADBGROWNAMES (ISC_EVENTCLASS_DNS + 46) +#define DNS_EVENT_ZONESECURESERIAL (ISC_EVENTCLASS_DNS + 47) +#define DNS_EVENT_ZONESECUREDB (ISC_EVENTCLASS_DNS + 48) +#define DNS_EVENT_ZONELOAD (ISC_EVENTCLASS_DNS + 49) +#define DNS_EVENT_KEYDONE (ISC_EVENTCLASS_DNS + 50) +#define DNS_EVENT_SETNSEC3PARAM (ISC_EVENTCLASS_DNS + 51) #define DNS_EVENT_FIRSTEVENT (ISC_EVENTCLASS_DNS + 0) #define DNS_EVENT_LASTEVENT (ISC_EVENTCLASS_DNS + 65535) diff --git a/lib/dns/include/dns/journal.h b/lib/dns/include/dns/journal.h index d750fbe..68ba8b3 100644 --- a/lib/dns/include/dns/journal.h +++ b/lib/dns/include/dns/journal.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2009, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2009, 2011 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2001 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: journal.h,v 1.43 2011/12/22 07:32:41 each Exp $ */ #ifndef DNS_JOURNAL_H #define DNS_JOURNAL_H 1 @@ -46,6 +46,10 @@ ***/ #define DNS_JOURNALOPT_RESIGN 0x00000001 +#define DNS_JOURNAL_READ 0x00000000 /* ISC_FALSE */ +#define DNS_JOURNAL_CREATE 0x00000001 /* ISC_TRUE */ +#define DNS_JOURNAL_WRITE 0x00000002 + /*** *** Types ***/ @@ -72,7 +76,7 @@ ISC_LANG_BEGINDECLS isc_result_t dns_db_createsoatuple(dns_db_t *db, dns_dbversion_t *ver, isc_mem_t *mctx, - dns_diffop_t op, dns_difftuple_t **tp); + dns_diffop_t op, dns_difftuple_t **tp); /*!< brief * Create a diff tuple for the current database SOA. * XXX this probably belongs somewhere else. @@ -95,16 +99,15 @@ dns_db_createsoatuple(dns_db_t *db, dns_dbversion_t *ver, isc_mem_t *mctx, */ isc_result_t -dns_journal_open(isc_mem_t *mctx, const char *filename, isc_boolean_t write, +dns_journal_open(isc_mem_t *mctx, const char *filename, unsigned int mode, dns_journal_t **journalp); /*%< * Open the journal file 'filename' and create a dns_journal_t object for it. * - * If 'write' is ISC_TRUE, the journal is open for writing. If it does - * not exist, it is created. - * - * If 'write' is ISC_FALSE, the journal is open for reading. If it does - * not exist, ISC_R_NOTFOUND is returned. + * DNS_JOURNAL_CREATE open the journal for reading and writing and create + * the journal if it does not exist. + * DNS_JOURNAL_WRITE open the journal for reading and writing. + * DNS_JOURNAL_READ open the journal for reading only. */ void @@ -267,12 +270,18 @@ dns_db_diff(isc_mem_t *mctx, dns_db_t *dba, dns_dbversion_t *dbvera, dns_db_t *dbb, dns_dbversion_t *dbverb, const char *journal_filename); + +isc_result_t +dns_db_diffx(dns_diff_t *diff, dns_db_t *dba, dns_dbversion_t *dbvera, + dns_db_t *dbb, dns_dbversion_t *dbverb, + const char *journal_filename); /*%< - * Compare the databases 'dba' and 'dbb' and generate a journal + * Compare the databases 'dba' and 'dbb' and generate a diff/journal * entry containing the changes to make 'dba' from 'dbb' (note * the order). This journal entry will consist of a single, * possibly very large transaction. Append the journal - * entry to the journal file specified by 'journal_filename'. + * entry to the journal file specified by 'journal_filename' if + * non-NULL. */ isc_result_t @@ -284,6 +293,17 @@ dns_journal_compact(isc_mem_t *mctx, char *filename, isc_uint32_t serial, * exists and is non-empty 'serial' must exist in the journal. */ +isc_boolean_t +dns_journal_get_sourceserial(dns_journal_t *j, isc_uint32_t *sourceserial); +void +dns_journal_set_sourceserial(dns_journal_t *j, isc_uint32_t sourceserial); +/*%< + * Get and set source serial. + * + * Returns: + * ISC_TRUE if sourceserial has previously been set. + */ + ISC_LANG_ENDDECLS #endif /* DNS_JOURNAL_H */ diff --git a/lib/dns/include/dns/log.h b/lib/dns/include/dns/log.h index 689b148..3c4df8a 100644 --- a/lib/dns/include/dns/log.h +++ b/lib/dns/include/dns/log.h @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: log.h,v 1.47 2011/10/13 22:48:24 tbox Exp $ */ /*! \file dns/log.h * \author Principal Authors: DCL */ diff --git a/lib/dns/include/dns/master.h b/lib/dns/include/dns/master.h index a852ae4..896c6e9 100644 --- a/lib/dns/include/dns/master.h +++ b/lib/dns/include/dns/master.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2009, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2009, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -66,18 +66,29 @@ ISC_LANG_BEGINDECLS * encoding, we directly read/write each field so that the encoded data * is always "packed", regardless of the hardware architecture. */ -#define DNS_RAWFORMAT_VERSION 0 +#define DNS_RAWFORMAT_VERSION 1 + +/* + * Flags to indicate the status of the data in the raw file header + */ +#define DNS_MASTERRAW_COMPAT 0x01 +#define DNS_MASTERRAW_SOURCESERIALSET 0x02 +#define DNS_MASTERRAW_LASTXFRINSET 0x04 /* Common header */ -typedef struct { +struct dns_masterrawheader { isc_uint32_t format; /* must be * dns_masterformat_raw */ isc_uint32_t version; /* compatibility for future * extensions */ isc_uint32_t dumptime; /* timestamp on creation - * (currently unused) - */ -} dns_masterrawheader_t; + * (currently unused) */ + isc_uint32_t flags; /* Flags */ + isc_uint32_t sourceserial; /* Source serial number (used + * by inline-signing zones) */ + isc_uint32_t lastxfrin; /* timestamp of last transfer + * (used by slave zones) */ +}; /* The structure for each RRset */ typedef struct { @@ -302,6 +313,12 @@ dns_loadctx_cancel(dns_loadctx_t *ctx); *\li 'ctx' to be valid */ +void +dns_master_initrawheader(dns_masterrawheader_t *header); +/*%< + * Initializes the header for a raw master file, setting all + * values to zero. + */ ISC_LANG_ENDDECLS #endif /* DNS_MASTER_H */ diff --git a/lib/dns/include/dns/masterdump.h b/lib/dns/include/dns/masterdump.h index f7e30f1..8631248 100644 --- a/lib/dns/include/dns/masterdump.h +++ b/lib/dns/include/dns/masterdump.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2008, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2008, 2011 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: masterdump.h,v 1.47 2011/12/08 23:46:49 tbox Exp $ */ #ifndef DNS_MASTERDUMP_H #define DNS_MASTERDUMP_H 1 @@ -220,13 +220,25 @@ dns_master_dumptostream2(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version, const dns_master_style_t *style, dns_masterformat_t format, FILE *f); + +isc_result_t +dns_master_dumptostream3(isc_mem_t *mctx, dns_db_t *db, + dns_dbversion_t *version, + const dns_master_style_t *style, + dns_masterformat_t format, + dns_masterrawheader_t *header, FILE *f); /*%< * Dump the database 'db' to the steam 'f' in the specified format by * 'format'. If the format is dns_masterformat_text (the RFC1035 format), * 'style' specifies the file style (e.g., &dns_master_style_default). * - * dns_master_dumptostream() is an old form of dns_master_dumptostream2(), + * dns_master_dumptostream() is an old form of dns_master_dumptostream3(), * which always specifies the dns_masterformat_text format. + * dns_master_dumptostream2() is an old form which always specifies + * a NULL header. + * + * If 'format' is dns_masterformat_raw, then 'header' can contain + * information to be written to the file header. * * Temporary dynamic memory may be allocated from 'mctx'. * @@ -257,6 +269,13 @@ dns_master_dumpinc2(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version, isc_task_t *task, dns_dumpdonefunc_t done, void *done_arg, dns_dumpctx_t **dctxp, dns_masterformat_t format); isc_result_t +dns_master_dumpinc3(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version, + const dns_master_style_t *style, const char *filename, + isc_task_t *task, dns_dumpdonefunc_t done, void + *done_arg, dns_dumpctx_t **dctxp, + dns_masterformat_t format, dns_masterrawheader_t *header); + +isc_result_t dns_master_dump(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version, const dns_master_style_t *style, const char *filename); @@ -267,14 +286,24 @@ dns_master_dump2(isc_mem_t *mctx, dns_db_t *db, const dns_master_style_t *style, const char *filename, dns_masterformat_t format); +isc_result_t +dns_master_dump3(isc_mem_t *mctx, dns_db_t *db, + dns_dbversion_t *version, + const dns_master_style_t *style, const char *filename, + dns_masterformat_t format, dns_masterrawheader_t *header); + /*%< * Dump the database 'db' to the file 'filename' in the specified format by * 'format'. If the format is dns_masterformat_text (the RFC1035 format), * 'style' specifies the file style (e.g., &dns_master_style_default). * - * dns_master_dumpinc() and dns_master_dump() are old forms of _dumpinc2() - * and _dump2(), respectively, which always specify the dns_masterformat_text - * format. + * dns_master_dumpinc() and dns_master_dump() are old forms of _dumpinc3() + * and _dump3(), respectively, which always specify the dns_masterformat_text + * format. dns_master_dumpinc2() and dns_master_dump2() are old forms which + * always specify a NULL header. + * + * If 'format' is dns_masterformat_raw, then 'header' can contain + * information to be written to the file header. * * Temporary dynamic memory may be allocated from 'mctx'. * @@ -329,6 +358,12 @@ dns_master_stylecreate(dns_master_style_t **style, unsigned int flags, unsigned int line_length, unsigned int tab_width, isc_mem_t *mctx); +isc_result_t +dns_master_stylecreate2(dns_master_style_t **style, unsigned int flags, + unsigned int ttl_column, unsigned int class_column, + unsigned int type_column, unsigned int rdata_column, + unsigned int line_length, unsigned int tab_width, + unsigned int split_width, isc_mem_t *mctx); void dns_master_styledestroy(dns_master_style_t **style, isc_mem_t *mctx); diff --git a/lib/dns/include/dns/nsec.h b/lib/dns/include/dns/nsec.h index 510d96b..440ee4e 100644 --- a/lib/dns/include/dns/nsec.h +++ b/lib/dns/include/dns/nsec.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2008, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2008, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2001, 2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: nsec.h,v 1.14 2011/06/10 23:47:32 tbox Exp $ */ #ifndef DNS_NSEC_H #define DNS_NSEC_H 1 @@ -69,12 +69,35 @@ dns_nsec_nseconly(dns_db_t *db, dns_dbversion_t *version, isc_boolean_t *answer); /* * Report whether the DNSKEY RRset has a NSEC only algorithm. Unknown - * algorithms are assumed to support NSEC3. + * algorithms are assumed to support NSEC3. If DNSKEY is not found, + * *answer is set to ISC_FALSE, and ISC_R_NOTFOUND is returned. * * Requires: * 'answer' to be non NULL. */ +unsigned int +dns_nsec_compressbitmap(unsigned char *map, const unsigned char *raw, + unsigned int max_type); +/*%< + * Convert a raw bitmap into a compressed windowed bit map. 'map' and 'raw' + * may overlap. + * + * Returns the length of the compressed windowed bit map. + */ + +void +dns_nsec_setbit(unsigned char *array, unsigned int type, unsigned int bit); +/*%< + * Set type bit in raw 'array' to 'bit'. + */ + +isc_boolean_t +dns_nsec_isset(const unsigned char *array, unsigned int type); +/*%< + * Test if the corresponding 'type' bit is set in 'array'. + */ + isc_result_t dns_nsec_noexistnodata(dns_rdatatype_t type, dns_name_t *name, dns_name_t *nsecname, dns_rdataset_t *nsecset, diff --git a/lib/dns/include/dns/nsec3.h b/lib/dns/include/dns/nsec3.h index 588dd05..e4a2286 100644 --- a/lib/dns/include/dns/nsec3.h +++ b/lib/dns/include/dns/nsec3.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2008-2010, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2008-2012 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -14,7 +14,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: nsec3.h,v 1.14 2011/10/28 12:20:31 tbox Exp $ */ #ifndef DNS_NSEC3_H #define DNS_NSEC3_H 1 @@ -241,7 +241,8 @@ dns_nsec3param_toprivate(dns_rdata_t *src, dns_rdata_t *target, isc_result_t dns_nsec3param_deletechains(dns_db_t *db, dns_dbversion_t *ver, - dns_zone_t *zone, dns_diff_t *diff); + dns_zone_t *zone, isc_boolean_t nonsec, + dns_diff_t *diff); /*%< * Mark NSEC3PARAM for deletion. diff --git a/lib/dns/include/dns/private.h b/lib/dns/include/dns/private.h index 7bc59b2..c4a2ae6 100644 --- a/lib/dns/include/dns/private.h +++ b/lib/dns/include/dns/private.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2009, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2009, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -14,7 +14,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: private.h,v 1.5 2011/10/28 12:20:31 tbox Exp $ */ #include <isc/lang.h> #include <isc/types.h> @@ -50,6 +50,23 @@ dns_private_chains(dns_db_t *db, dns_dbversion_t *ver, * \li other on error */ +isc_result_t +dns_private_totext(dns_rdata_t *privaterdata, isc_buffer_t *buffer); +/*%< + * Convert a private-type RR 'privaterdata' to human-readable form, + * and place the result in 'buffer'. The text should indicate + * which action the private-type record specifies and whether the + * action has been completed. + * + * Requires: + * \li 'privaterdata' is a valid rdata containing at least five bytes + * \li 'buffer' is a valid buffer + * + * Returns: + * \li ISC_R_SUCCESS + * \li other on error + */ + ISC_LANG_ENDDECLS #endif diff --git a/lib/dns/include/dns/rdata.h b/lib/dns/include/dns/rdata.h index 2a67dc9..89ecaf8 100644 --- a/lib/dns/include/dns/rdata.h +++ b/lib/dns/include/dns/rdata.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2009, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2009, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1998-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: rdata.h,v 1.80 2011/03/20 02:31:53 marka Exp $ */ #ifndef DNS_RDATA_H #define DNS_RDATA_H 1 @@ -169,6 +169,7 @@ struct dns_rdata { /*% Output explanatory comments. */ #define DNS_STYLEFLAG_COMMENT 0x00000002U +#define DNS_STYLEFLAG_RRCOMMENT 0x00000004U #define DNS_RDATA_DOWNCASE DNS_NAME_DOWNCASE #define DNS_RDATA_CHECKNAMES DNS_NAME_CHECKNAMES @@ -435,8 +436,8 @@ dns_rdata_totext(dns_rdata_t *rdata, dns_name_t *origin, isc_buffer_t *target); isc_result_t dns_rdata_tofmttext(dns_rdata_t *rdata, dns_name_t *origin, unsigned int flags, - unsigned int width, const char *linebreak, - isc_buffer_t *target); + unsigned int width, unsigned int split_width, + const char *linebreak, isc_buffer_t *target); /*%< * Like dns_rdata_totext, but do formatted output suitable for * database dumps. This is intended for use by dns_db_dump(); @@ -458,6 +459,11 @@ dns_rdata_tofmttext(dns_rdata_t *rdata, dns_name_t *origin, unsigned int flags, * comments next to things like the SOA timer fields. Some * comments (e.g., the SOA ones) are only printed when multiline * output is selected. + * + * base64 rdata text (e.g., DNSKEY records) will be split into chunks + * of 'split_width' characters. If split_width == 0, the text will + * not be split at all. If split_width == UINT_MAX (0xffffffff), then + * it is undefined and falls back to the default value of 'width' */ isc_result_t diff --git a/lib/dns/include/dns/rdataset.h b/lib/dns/include/dns/rdataset.h index b2b8370..31bcd15 100644 --- a/lib/dns/include/dns/rdataset.h +++ b/lib/dns/include/dns/rdataset.h @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: rdataset.h,v 1.72 2011/06/08 22:13:51 each Exp $ */ #ifndef DNS_RDATASET_H #define DNS_RDATASET_H 1 diff --git a/lib/dns/include/dns/resolver.h b/lib/dns/include/dns/resolver.h index 7f7d093..095269e 100644 --- a/lib/dns/include/dns/resolver.h +++ b/lib/dns/include/dns/resolver.h @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: resolver.h,v 1.72 2011/12/05 17:10:51 each Exp $ */ #ifndef DNS_RESOLVER_H #define DNS_RESOLVER_H 1 @@ -126,7 +126,8 @@ typedef struct dns_fetchevent { isc_result_t dns_resolver_create(dns_view_t *view, - isc_taskmgr_t *taskmgr, unsigned int ntasks, + isc_taskmgr_t *taskmgr, + unsigned int ntasks, unsigned int ndisp, isc_socketmgr_t *socketmgr, isc_timermgr_t *timermgr, unsigned int options, @@ -155,9 +156,11 @@ dns_resolver_create(dns_view_t *view, * *\li 'timermgr' is a valid timer manager. * - *\li 'dispatchv4' is a valid dispatcher with an IPv4 UDP socket, or is NULL. + *\li 'dispatchv4' is a dispatch with an IPv4 UDP socket, or is NULL. + * If not NULL, 'ndisp' clones of it will be created by the resolver. * - *\li 'dispatchv6' is a valid dispatcher with an IPv6 UDP socket, or is NULL. + *\li 'dispatchv6' is a dispatch with an IPv6 UDP socket, or is NULL. + * If not NULL, 'ndisp' clones of it will be created by the resolver. * *\li resp != NULL && *resp == NULL. * diff --git a/lib/dns/include/dns/result.h b/lib/dns/include/dns/result.h index 9a7d2c2..12aacf9 100644 --- a/lib/dns/include/dns/result.h +++ b/lib/dns/include/dns/result.h @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: result.h,v 1.123 2011/03/21 07:22:14 each Exp $ */ #ifndef DNS_RESULT_H #define DNS_RESULT_H 1 diff --git a/lib/dns/include/dns/rpz.h b/lib/dns/include/dns/rpz.h index ceea26d..e1d50a5 100644 --- a/lib/dns/include/dns/rpz.h +++ b/lib/dns/include/dns/rpz.h @@ -16,6 +16,7 @@ /* $Id$ */ + #ifndef DNS_RPZ_H #define DNS_RPZ_H 1 diff --git a/lib/dns/include/dns/rriterator.h b/lib/dns/include/dns/rriterator.h index a3e8e47..c979f22 100644 --- a/lib/dns/include/dns/rriterator.h +++ b/lib/dns/include/dns/rriterator.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2009, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2009, 2011 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -14,7 +14,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: rriterator.h,v 1.4 2011/11/01 23:47:00 tbox Exp $ */ #ifndef DNS_RRITERATOR_H #define DNS_RRITERATOR_H 1 diff --git a/lib/dns/include/dns/sdb.h b/lib/dns/include/dns/sdb.h index c57c4a1..2751903 100644 --- a/lib/dns/include/dns/sdb.h +++ b/lib/dns/include/dns/sdb.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2007, 2009, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007, 2009, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: sdb.h,v 1.25 2011/10/11 23:46:45 tbox Exp $ */ #ifndef DNS_SDB_H #define DNS_SDB_H 1 @@ -35,6 +35,7 @@ #include <isc/lang.h> +#include <dns/clientinfo.h> #include <dns/types.h> /*** @@ -58,10 +59,14 @@ typedef struct dns_sdballnodes dns_sdballnodes_t; typedef isc_result_t (*dns_sdblookupfunc_t)(const char *zone, const char *name, void *dbdata, - dns_sdblookup_t *); + dns_sdblookup_t *lookup, + dns_clientinfomethods_t *methods, + dns_clientinfo_t *clientinfo); typedef isc_result_t (*dns_sdblookup2func_t)(const dns_name_t *zone, const dns_name_t *name, - void *dbdata, dns_sdblookup_t *lookup); + void *dbdata, dns_sdblookup_t *lookup, + dns_clientinfomethods_t *methods, + dns_clientinfo_t *clientinfo); typedef isc_result_t (*dns_sdbauthorityfunc_t)(const char *zone, void *dbdata, dns_sdblookup_t *); diff --git a/lib/dns/include/dns/sdlz.h b/lib/dns/include/dns/sdlz.h index 375a99a..fbc6b95 100644 --- a/lib/dns/include/dns/sdlz.h +++ b/lib/dns/include/dns/sdlz.h @@ -57,6 +57,7 @@ #ifndef SDLZ_H #define SDLZ_H 1 +#include <dns/clientinfo.h> #include <dns/dlz.h> ISC_LANG_BEGINDECLS @@ -182,18 +183,23 @@ typedef isc_result_t typedef isc_result_t (*dns_sdlzlookupfunc_t)(const char *zone, const char *name, void *driverarg, - void *dbdata, dns_sdlzlookup_t *lookup); + void *dbdata, dns_sdlzlookup_t *lookup, + dns_clientinfomethods_t *methods, + dns_clientinfo_t *clientinfo); /*%< * Method prototype. Drivers implementing the SDLZ interface MUST - * supply a lookup method. This method is called when the DNS server - * is performing a query, after the find zone and before any other - * methods have been called. This function returns record DNS record + * supply a lookup method. This method is called when the + * DNS server is performing a query, after the find zone and before any + * other methods have been called. This function returns DNS record * information using the dns_sdlz_putrr and dns_sdlz_putsoa functions. * If this function supplies authority information for the DNS record * the authority method is not required. If it does not, the - * authority function is required. A SDLZ driver must implement a - * lookup method. + * authority function is required. + * + * The 'methods' and 'clientinfo' args allow an SDLZ driver to retrieve + * information about the querying client (such as source IP address) + * from the caller. */ typedef isc_result_t (*dns_sdlznewversion_t)(const char *zone, diff --git a/lib/dns/include/dns/time.h b/lib/dns/include/dns/time.h index b646ba8..6a59c8a 100644 --- a/lib/dns/include/dns/time.h +++ b/lib/dns/include/dns/time.h @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: time.h,v 1.19 2012/01/27 23:46:58 tbox Exp $ */ #ifndef DNS_TIME_H #define DNS_TIME_H 1 diff --git a/lib/dns/include/dns/types.h b/lib/dns/include/dns/types.h index a031825..76167c2 100644 --- a/lib/dns/include/dns/types.h +++ b/lib/dns/include/dns/types.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2010, 2012, 2013 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2013 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1998-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -65,6 +65,7 @@ typedef struct dns_decompress dns_decompress_t; typedef struct dns_dispatch dns_dispatch_t; typedef struct dns_dispatchevent dns_dispatchevent_t; typedef struct dns_dispatchlist dns_dispatchlist_t; +typedef struct dns_dispatchset dns_dispatchset_t; typedef struct dns_dispatchmgr dns_dispatchmgr_t; typedef struct dns_dispentry dns_dispentry_t; typedef struct dns_dns64 dns_dns64_t; @@ -86,6 +87,7 @@ typedef struct dns_keytable dns_keytable_t; typedef isc_uint16_t dns_keytag_t; typedef struct dns_loadctx dns_loadctx_t; typedef struct dns_loadmgr dns_loadmgr_t; +typedef struct dns_masterrawheader dns_masterrawheader_t; typedef struct dns_message dns_message_t; typedef isc_uint16_t dns_messageid_t; typedef isc_region_t dns_label_t; @@ -333,6 +335,20 @@ typedef enum { dns_severity_fail } dns_severity_t; +/*% + * DNS Serial Number Update Method. + * + * \li _increment: Add one to the current serial, skipping 0. + * \li _unixtime: Set to the seconds since 00:00 Jan 1, 1970, + * if possible. + * \li _yyyymmvv: Set to Year, Month, Version, if possible. + * (Not yet implemented) + */ +typedef enum { + dns_updatemethod_increment = 0, + dns_updatemethod_unixtime +} dns_updatemethod_t; + /* * Functions. */ @@ -342,6 +358,9 @@ typedef void typedef void (*dns_loaddonefunc_t)(void *, isc_result_t); +typedef void +(*dns_rawdatafunc_t)(dns_zone_t *, dns_masterrawheader_t *); + typedef isc_result_t (*dns_addrdatasetfunc_t)(void *, dns_name_t *, dns_rdataset_t *); diff --git a/lib/dns/include/dns/update.h b/lib/dns/include/dns/update.h new file mode 100644 index 0000000..2d2c491 --- /dev/null +++ b/lib/dns/include/dns/update.h @@ -0,0 +1,64 @@ +/* + * Copyright (C) 2011 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +/* $Id: update.h,v 1.5 2011/08/30 23:46:53 tbox Exp $ */ + +#ifndef DNS_UPDATE_H +#define DNS_UPDATE_H 1 + +/*! \file dns/update.h */ + +/*** + *** Imports + ***/ + +#include <isc/lang.h> + +#include <dns/types.h> +#include <dns/diff.h> + +typedef struct { + void (*func)(void *arg, dns_zone_t *zone, int level, + const char *message); + void *arg; +} dns_update_log_t; + +ISC_LANG_BEGINDECLS + +/*** + *** Functions + ***/ + +isc_uint32_t +dns_update_soaserial(isc_uint32_t serial, dns_updatemethod_t method); +/*%< + * Return the next serial number after 'serial', depending on the + * update method 'method': + * + *\li * dns_updatemethod_increment increments the serial number by one + *\li * dns_updatemethod_unixtime sets the serial number to the current + * time (seconds since UNIX epoch) if possible, or increments by one + * if not. + */ + +isc_result_t +dns_update_signatures(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db, + dns_dbversion_t *oldver, dns_dbversion_t *newver, + dns_diff_t *diff, isc_uint32_t sigvalidityinterval); + +ISC_LANG_ENDDECLS + +#endif /* DNS_UPDATE_H */ diff --git a/lib/dns/include/dns/view.h b/lib/dns/include/dns/view.h index d999fa1..d0c1931 100644 --- a/lib/dns/include/dns/view.h +++ b/lib/dns/include/dns/view.h @@ -76,6 +76,7 @@ #include <dns/rdatastruct.h> #include <dns/rpz.h> #include <dns/types.h> +#include <dns/zt.h> ISC_LANG_BEGINDECLS @@ -141,7 +142,6 @@ struct dns_view { dns_rbt_t * answeracl_exclude; dns_rbt_t * denyanswernames; dns_rbt_t * answernames_exclude; - isc_boolean_t requestixfr; isc_boolean_t provideixfr; isc_boolean_t requestnsid; dns_ttl_t maxcachettl; @@ -157,6 +157,7 @@ struct dns_view { dns_name_t * dlv; dns_fixedname_t dlv_fixed; isc_uint16_t maxudp; + unsigned int maxbits; dns_v4_aaaa_t v4_aaaa; dns_acl_t * v4_aaaa_acl; dns_dns64list_t dns64; @@ -185,6 +186,7 @@ struct dns_view { dns_viewlist_t * viewlist; dns_zone_t * managed_keys; + dns_zone_t * redirect; #ifdef BIND9 /* File in which to store configuration for newly added zones */ @@ -312,7 +314,8 @@ dns_view_weakdetach(dns_view_t **targetp); isc_result_t dns_view_createresolver(dns_view_t *view, - isc_taskmgr_t *taskmgr, unsigned int ntasks, + isc_taskmgr_t *taskmgr, + unsigned int ntasks, unsigned int ndisp, isc_socketmgr_t *socketmgr, isc_timermgr_t *timermgr, unsigned int options, @@ -730,14 +733,21 @@ dns_view_load(dns_view_t *view, isc_boolean_t stop); isc_result_t dns_view_loadnew(dns_view_t *view, isc_boolean_t stop); + +isc_result_t +dns_view_asyncload(dns_view_t *view, dns_zt_allloaded_t callback, void *arg); /*%< * Load zones attached to this view. dns_view_load() loads * all zones whose master file has changed since the last * load; dns_view_loadnew() loads only zones that have never * been loaded. * + * dns_view_asyncload() loads zones asynchronously. When all zones + * in the view have finished loading, 'callback' is called with argument + * 'arg' to inform the caller. + * * If 'stop' is ISC_TRUE, stop on the first error and return it. - * If 'stop' is ISC_FALSE, ignore errors. + * If 'stop' is ISC_FALSE (or we are loading asynchronously), ignore errors. * * Requires: * @@ -841,9 +851,31 @@ dns_view_flushcache2(dns_view_t *view, isc_boolean_t fixuponly); */ isc_result_t -dns_view_flushname(dns_view_t *view, dns_name_t *); +dns_view_flushnode(dns_view_t *view, dns_name_t *name, isc_boolean_t tree); /*%< - * Flush the given name from the view's cache (and ADB). + * Flush the given name from the view's cache (and optionally ADB/badcache). + * + * If 'tree' is true, flush 'name' and all names below it + * from the cache, but do not flush ADB. + * + * If 'tree' is false, flush 'name' frmo both the cache and ADB, + * but do not touch any other nodes. + * + * Requires: + *\li 'view' is valid. + *\li 'name' is valid. + * + * Returns: + *\li #ISC_R_SUCCESS + * other returns are failures. + */ + +isc_result_t +dns_view_flushname(dns_view_t *view, dns_name_t *name); +/*%< + * Flush the given name from the view's cache, ADB and badcache. + * Equivalent to dns_view_flushnode(view, name, ISC_FALSE). + * * * Requires: *\li 'view' is valid. @@ -859,7 +891,6 @@ dns_view_adddelegationonly(dns_view_t *view, dns_name_t *name); /*%< * Add the given name to the delegation only table. * - * * Requires: *\li 'view' is valid. *\li 'name' is valid. diff --git a/lib/dns/include/dns/zone.h b/lib/dns/include/dns/zone.h index 6b9911d..f91801f 100644 --- a/lib/dns/include/dns/zone.h +++ b/lib/dns/include/dns/zone.h @@ -32,10 +32,12 @@ #include <isc/lang.h> #include <isc/rwlock.h> +#include <dns/master.h> #include <dns/masterdump.h> #include <dns/rdatastruct.h> #include <dns/rpz.h> #include <dns/types.h> +#include <dns/zt.h> typedef enum { dns_zone_none, @@ -44,9 +46,16 @@ typedef enum { dns_zone_stub, dns_zone_staticstub, dns_zone_key, - dns_zone_dlz + dns_zone_dlz, + dns_zone_redirect } dns_zonetype_t; +typedef enum { + dns_zonestat_none = 0, + dns_zonestat_terse, + dns_zonestat_full +} dns_zonestat_level_t; + #define DNS_ZONEOPT_SERVERS 0x00000001U /*%< perform server checks */ #define DNS_ZONEOPT_PARENTS 0x00000002U /*%< perform parent checks */ #define DNS_ZONEOPT_CHILDREN 0x00000004U /*%< perform child checks */ @@ -94,6 +103,7 @@ typedef enum { #define DNS_ZONEKEY_MAINTAIN 0x00000002U /*%< publish/sign on schedule */ #define DNS_ZONEKEY_CREATE 0x00000004U /*%< make keys when needed */ #define DNS_ZONEKEY_FULLSIGN 0x00000008U /*%< roll to new keys immediately */ +#define DNS_ZONEKEY_NORESIGN 0x00000010U /*%< no automatic resigning */ #ifndef DNS_ZONE_MINREFRESH #define DNS_ZONE_MINREFRESH 300 /*%< 5 minutes */ @@ -287,6 +297,7 @@ dns_zone_loadnew(dns_zone_t *zone); isc_result_t dns_zone_loadandthaw(dns_zone_t *zone); + /*%< * Cause the database to be loaded from its backing store. * Confirm that the minimum requirements for the zone type are @@ -311,6 +322,25 @@ dns_zone_loadandthaw(dns_zone_t *zone); *\li Any result value from dns_db_load(). */ +isc_result_t +dns_zone_asyncload(dns_zone_t *zone, dns_zt_zoneloaded_t done, void *arg); +/*%< + * Cause the database to be loaded from its backing store asynchronously. + * Other zone maintenance functions are suspended until this is complete. + * When finished, 'done' is called to inform the caller, with 'arg' as + * its first argument and 'zone' as its second. (Normally, 'arg' is + * expected to point to the zone table but is left undefined for testing + * purposes.) + */ + +isc_boolean_t +dns__zone_loadpending(dns_zone_t *zone); +/*%< + * Indicates whether the zone is waiting to be loaded asynchronously. + * (Not currently intended for use outside of this module and associated + * tests.) + */ + void dns_zone_attach(dns_zone_t *source, dns_zone_t **target); /*%< @@ -489,6 +519,10 @@ dns_zone_dumptostream(dns_zone_t *zone, FILE *fd); isc_result_t dns_zone_dumptostream2(dns_zone_t *zone, FILE *fd, dns_masterformat_t format, const dns_master_style_t *style); +isc_result_t +dns_zone_dumptostream3(dns_zone_t *zone, FILE *fd, dns_masterformat_t format, + const dns_master_style_t *style, + const isc_uint32_t rawversion); /*%< * Write the zone to stream 'fd' in the specified 'format'. * If the 'format' is dns_masterformat_text (RFC1035), 'style' also @@ -498,7 +532,11 @@ dns_zone_dumptostream2(dns_zone_t *zone, FILE *fd, dns_masterformat_t format, * dns_zone_dumptostream2(), which always uses the dns_masterformat_text * format and the dns_master_style_default style. * - * Note that dns_zone_dumptostream2() is the most flexible form. It + * dns_zone_dumptostream2() is a backward-compatible form of + * dns_zone_dumptostream3(), which always uses the current + * default raw file format version. + * + * Note that dns_zone_dumptostream3() is the most flexible form. It * can also provide the functionality of dns_zone_fulldumptostream(). * * Require: @@ -558,10 +596,16 @@ dns_zone_setmasterswithkeys(dns_zone_t *zone, isc_result_t dns_zone_setalsonotify(dns_zone_t *zone, const isc_sockaddr_t *notify, isc_uint32_t count); +isc_result_t +dns_zone_setalsonotifywithkeys(dns_zone_t *zone, const isc_sockaddr_t *notify, + dns_name_t **keynames, isc_uint32_t count); /*%< * Set the list of additional servers to be notified when * a zone changes. To clear the list use 'count = 0'. * + * dns_zone_alsonotifywithkeys() allows each notify address to + * be associated with a TSIG key. + * * Require: *\li 'zone' to be a valid zone. *\li 'notify' to be non-NULL if count != 0. @@ -1405,6 +1449,18 @@ dns_zonemgr_setsize(dns_zonemgr_t *zmgr, int num_zones); */ isc_result_t +dns_zonemgr_createzone(dns_zonemgr_t *zmgr, dns_zone_t **zonep); +/*%< + * Allocate a new zone using a memory context from the + * zone manager's memory context pool. + * + * Require: + *\li 'zmgr' to be a valid zone manager. + *\li 'zonep' != NULL and '*zonep' == NULL. + */ + + +isc_result_t dns_zonemgr_managezone(dns_zonemgr_t *zmgr, dns_zone_t *zone); /*%< * Bring the zone under control of a zone manager. @@ -1422,6 +1478,14 @@ dns_zonemgr_forcemaint(dns_zonemgr_t *zmgr); */ void +dns__zonemgr_run(isc_task_t *task, isc_event_t *event); +/*%< + * Event handler to call dns_zonemgr_forcemaint(); used to start + * zone operations from a unit test. Not intended for use outside + * libdns or related tests. + */ + +void dns_zonemgr_resumexfrs(dns_zonemgr_t *zmgr); /*%< * Attempt to start any stalled zone transfers. @@ -1647,9 +1711,13 @@ dns_zone_setstats(dns_zone_t *zone, isc_stats_t *stats); void dns_zone_setrequeststats(dns_zone_t *zone, isc_stats_t *stats); + +void +dns_zone_setrcvquerystats(dns_zone_t *zone, dns_stats_t *stats); /*%< - * Set an additional statistics set to zone. It is attached in the zone - * but is not counted in the zone module; only the caller updates the counters. + * Set additional statistics sets to zone. These are attached to the zone + * but are not counted in the zone module; only the caller updates the + * counters. * * Requires: * \li 'zone' to be a valid zone. @@ -1657,8 +1725,19 @@ dns_zone_setrequeststats(dns_zone_t *zone, isc_stats_t *stats); *\li stats is a valid statistics. */ +#ifdef NEWSTATS +void +dns_zone_setrcvquerystats(dns_zone_t *zone, dns_stats_t *stats); +#endif + isc_stats_t * dns_zone_getrequeststats(dns_zone_t *zone); + +#ifdef NEWSTATS +dns_stats_t * +dns_zone_getrcvquerystats(dns_zone_t *zone); +#endif + /*%< * Get the additional statistics for zone, if one is installed. * @@ -1893,6 +1972,107 @@ dns_zone_dlzpostload(dns_zone_t *zone, dns_db_t *db); * Load the origin names for a writeable DLZ database. */ +isc_boolean_t +dns_zone_isdynamic(dns_zone_t *zone, isc_boolean_t ignore_freeze); +/*% + * Return true iff the zone is "dynamic", in the sense that the zone's + * master file (if any) is written by the server, rather than being + * updated manually and read by the server. + * + * This is true for slave zones, stub zones, key zones, and zones that + * allow dynamic updates either by having an update policy ("ssutable") + * or an "allow-update" ACL with a value other than exactly "{ none; }". + * + * If 'ignore_freeze' is true, then the zone which has had updates disabled + * will still report itself to be dynamic. + * + * Requires: + * \li 'zone' to be valid. + */ + +isc_result_t +dns_zone_setrefreshkeyinterval(dns_zone_t *zone, isc_uint32_t interval); +/*% + * Sets the frequency, in minutes, with which the key repository will be + * checked to see if the keys for this zone have been updated. Any value + * higher than 1440 minutes (24 hours) will be silently reduced. A + * value of zero will return an out-of-range error. + * + * Requires: + * \li 'zone' to be valid. + */ + +isc_boolean_t +dns_zone_getrequestixfr(dns_zone_t *zone); +/*% + * Returns the true/false value of the request-ixfr option in the zone. + * + * Requires: + * \li 'zone' to be valid. + */ + +void +dns_zone_setrequestixfr(dns_zone_t *zone, isc_boolean_t flag); +/*% + * Sets the request-ixfr option for the zone. Either true or false. The + * default value is determined by the setting of this option in the view. + * + * Requires: + * \li 'zone' to be valid. + */ + +void +dns_zone_setserialupdatemethod(dns_zone_t *zone, dns_updatemethod_t method); +/*% + * Sets the update method to use when incrementing the zone serial number + * due to a DDNS update. Valid options are dns_updatemethod_increment + * and dns_updatemethod_unixtime. + * + * Requires: + * \li 'zone' to be valid. + */ + +dns_updatemethod_t +dns_zone_getserialupdatemethod(dns_zone_t *zone); +/*% + * Returns the update method to be used when incrementing the zone serial + * number due to a DDNS update. + * + * Requires: + * \li 'zone' to be valid. + */ + +isc_result_t +dns_zone_link(dns_zone_t *zone, dns_zone_t *raw); + +void +dns_zone_getraw(dns_zone_t *zone, dns_zone_t **raw); + +isc_result_t +dns_zone_keydone(dns_zone_t *zone, const char *data); + +isc_result_t +dns_zone_setnsec3param(dns_zone_t *zone, isc_uint8_t hash, isc_uint8_t flags, + isc_uint16_t iter, isc_uint8_t saltlen, + unsigned char *salt, isc_boolean_t replace); +/*% + * Set the NSEC3 parameters for the zone. + * + * If 'replace' is ISC_TRUE, then the existing NSEC3 chain, if any, will + * be replaced with the new one. If 'hash' is zero, then the replacement + * chain will be NSEC rather than NSEC3. + * + * Requires: + * \li 'zone' to be valid. + */ + +void +dns_zone_setrawdata(dns_zone_t *zone, dns_masterrawheader_t *header); +/*% + * Set the data to be included in the header when the zone is dumped in + * binary format. + */ + isc_result_t dns_zone_synckeyzone(dns_zone_t *zone); /*% @@ -1909,6 +2089,16 @@ dns_zone_rpz_enable(dns_zone_t *zone); isc_boolean_t dns_zone_get_rpz(dns_zone_t *zone); +void +dns_zone_setstatlevel(dns_zone_t *zone, dns_zonestat_level_t level); + +dns_zonestat_level_t +dns_zone_getstatlevel(dns_zone_t *zone); +/*% + * Set and get the statistics reporting level for the zone; + * full, terse, or none. + */ + ISC_LANG_ENDDECLS #endif /* DNS_ZONE_H */ diff --git a/lib/dns/include/dns/zt.h b/lib/dns/include/dns/zt.h index 7d1e8bf..f91d7e8 100644 --- a/lib/dns/include/dns/zt.h +++ b/lib/dns/include/dns/zt.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2007, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007, 2011 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: zt.h,v 1.40 2011/09/02 23:46:32 tbox Exp $ */ #ifndef DNS_ZT_H #define DNS_ZT_H 1 @@ -30,6 +30,21 @@ ISC_LANG_BEGINDECLS +typedef isc_result_t +(*dns_zt_allloaded_t)(void *arg); +/*%< + * Method prototype: when all pending zone loads are complete, + * the zone table can inform the caller via a callback function with + * this signature. + */ + +typedef isc_result_t +(*dns_zt_zoneloaded_t)(dns_zt_t *zt, dns_zone_t *zone, isc_task_t *task); +/*%< + * Method prototype: when a zone finishes loading, the zt object + * can be informed via a callback function with this signature. + */ + isc_result_t dns_zt_create(isc_mem_t *mctx, dns_rdataclass_t rdclass, dns_zt_t **zt); /*%< @@ -134,6 +149,9 @@ dns_zt_load(dns_zt_t *zt, isc_boolean_t stop); isc_result_t dns_zt_loadnew(dns_zt_t *zt, isc_boolean_t stop); + +isc_result_t +dns_zt_asyncload(dns_zt_t *zt, dns_zt_allloaded_t alldone, void *arg); /*%< * Load all zones in the table. If 'stop' is ISC_TRUE, * stop on the first error and return it. If 'stop' @@ -142,6 +160,10 @@ dns_zt_loadnew(dns_zt_t *zt, isc_boolean_t stop); * dns_zt_loadnew() only loads zones that are not yet loaded. * dns_zt_load() also loads zones that are already loaded and * and whose master file has changed since the last load. + * dns_zt_asyncload() loads zones asynchronously; when all + * zones in the zone table have finished loaded (or failed due + * to errors), the caller is informed by calling 'alldone' + * with an argument of 'arg'. * * Requires: * \li 'zt' to be valid @@ -178,6 +200,16 @@ dns_zt_apply2(dns_zt_t *zt, isc_boolean_t stop, isc_result_t *sub, * any error code from 'action'. */ +isc_boolean_t +dns_zt_loadspending(dns_zt_t *zt); +/*%< + * Returns ISC_TRUE if and only if there are zones still waiting to + * be loaded in zone table 'zt'. + * + * Requires: + * \li 'zt' to be valid. + */ + ISC_LANG_ENDDECLS #endif /* DNS_ZT_H */ diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h index 87d844b..4724fc6 100644 --- a/lib/dns/include/dst/dst.h +++ b/lib/dns/include/dst/dst.h @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: dst.h,v 1.34 2011/10/20 21:20:02 marka Exp $ */ #ifndef DST_DST_H #define DST_DST_H 1 @@ -239,9 +239,16 @@ dst_context_sign(dst_context_t *dctx, isc_buffer_t *sig); isc_result_t dst_context_verify(dst_context_t *dctx, isc_region_t *sig); + +isc_result_t +dst_context_verify2(dst_context_t *dctx, unsigned int maxbits, + isc_region_t *sig); /*%< * Verifies the signature using the data and key stored in the context. * + * 'maxbits' specifies the maximum number of bits permitted in the RSA + * exponent. + * * Requires: * \li "dctx" is a valid context. * \li "sig" is a valid region. @@ -498,6 +505,14 @@ dst_key_fromgssapi(dns_name_t *name, gss_ctx_id_t gssctx, isc_mem_t *mctx, * the context id. */ +#ifdef DST_KEY_INTERNAL +isc_result_t +dst_key_buildinternal(dns_name_t *name, unsigned int alg, + unsigned int bits, unsigned int flags, + unsigned int protocol, dns_rdataclass_t rdclass, + void *data, isc_mem_t *mctx, dst_key_t **keyp); +#endif + isc_result_t dst_key_fromlabel(dns_name_t *name, int alg, unsigned int flags, unsigned int protocol, dns_rdataclass_t rdclass, @@ -518,6 +533,7 @@ dst_key_generate2(dns_name_t *name, unsigned int alg, dns_rdataclass_t rdclass, isc_mem_t *mctx, dst_key_t **keyp, void (*callback)(int)); + /*%< * Generate a DST key (or keypair) with the supplied parameters. The * interpretation of the "param" field depends on the algorithm: @@ -748,6 +764,26 @@ dst_key_setbits(dst_key_t *key, isc_uint16_t bits); * "key" is a valid key. */ +void +dst_key_setttl(dst_key_t *key, dns_ttl_t ttl); +/*%< + * Set the default TTL to use when converting the key + * to a KEY or DNSKEY RR. + * + * Requires: + * "key" is a valid key. + */ + +dns_ttl_t +dst_key_getttl(const dst_key_t *key); +/*%< + * Get the default TTL to use when converting the key + * to a KEY or DNSKEY RR. + * + * Requires: + * "key" is a valid key. + */ + isc_result_t dst_key_setflags(dst_key_t *key, isc_uint32_t flags); /* diff --git a/lib/dns/iptable.c b/lib/dns/iptable.c index e960d5c..7019505 100644 --- a/lib/dns/iptable.c +++ b/lib/dns/iptable.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2007-2009 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2007-2009, 2013 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -36,7 +36,8 @@ dns_iptable_create(isc_mem_t *mctx, dns_iptable_t **target) { tab = isc_mem_get(mctx, sizeof(*tab)); if (tab == NULL) return (ISC_R_NOMEMORY); - tab->mctx = mctx; + tab->mctx = NULL; + isc_mem_attach(mctx, &tab->mctx); isc_refcount_init(&tab->refcount, 1); tab->radix = NULL; tab->magic = DNS_IPTABLE_MAGIC; @@ -184,5 +185,5 @@ destroy_iptable(dns_iptable_t *dtab) { isc_refcount_destroy(&dtab->refcount); dtab->magic = 0; - isc_mem_put(dtab->mctx, dtab, sizeof(*dtab)); + isc_mem_putanddetach(&dtab->mctx, dtab, sizeof(*dtab)); } diff --git a/lib/dns/journal.c b/lib/dns/journal.c index 1564a81..022a3e2 100644 --- a/lib/dns/journal.c +++ b/lib/dns/journal.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007-2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007-2011, 2013 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: journal.c,v 1.120 2011/12/22 07:32:41 each Exp $ */ #include <config.h> @@ -111,6 +111,8 @@ static isc_boolean_t bind8_compat = ISC_TRUE; /* XXX config */ if (result != ISC_R_SUCCESS) goto failure; \ } while (0) +#define JOURNAL_SERIALSET 0x01U + static isc_result_t index_to_disk(dns_journal_t *); static inline isc_uint32_t @@ -213,6 +215,9 @@ typedef union { journal_rawpos_t end; /*% Number of index entries following the header. */ unsigned char index_size[4]; + /*% Source serial number. */ + unsigned char sourceserial[4]; + unsigned char flags; } h; /* Pad the header to a fixed size. */ unsigned char pad[JOURNAL_HEADER_SIZE]; @@ -252,6 +257,8 @@ typedef struct { journal_pos_t begin; journal_pos_t end; isc_uint32_t index_size; + isc_uint32_t sourceserial; + isc_boolean_t serialset; } journal_header_t; /*% @@ -284,7 +291,7 @@ typedef struct { */ static journal_header_t -initial_journal_header = { ";BIND LOG V9\n", { 0, 0 }, { 0, 0 }, 0 }; +initial_journal_header = { ";BIND LOG V9\n", { 0, 0 }, { 0, 0 }, 0, 0, 0 }; #define JOURNAL_EMPTY(h) ((h)->begin.offset == (h)->end.offset) @@ -292,7 +299,8 @@ typedef enum { JOURNAL_STATE_INVALID, JOURNAL_STATE_READ, JOURNAL_STATE_WRITE, - JOURNAL_STATE_TRANSACTION + JOURNAL_STATE_TRANSACTION, + JOURNAL_STATE_INLINE } journal_state_t; struct dns_journal { @@ -353,16 +361,24 @@ journal_header_decode(journal_rawheader_t *raw, journal_header_t *cooked) { journal_pos_decode(&raw->h.begin, &cooked->begin); journal_pos_decode(&raw->h.end, &cooked->end); cooked->index_size = decode_uint32(raw->h.index_size); + cooked->sourceserial = decode_uint32(raw->h.sourceserial); + cooked->serialset = ISC_TF(raw->h.flags & JOURNAL_SERIALSET); } static void journal_header_encode(journal_header_t *cooked, journal_rawheader_t *raw) { + unsigned char flags = 0; + INSIST(sizeof(cooked->format) == sizeof(raw->h.format)); memset(raw->pad, 0, sizeof(raw->pad)); memcpy(raw->h.format, cooked->format, sizeof(raw->h.format)); journal_pos_encode(&raw->h.begin, &cooked->begin); journal_pos_encode(&raw->h.end, &cooked->end); encode_uint32(cooked->index_size, raw->h.index_size); + encode_uint32(cooked->sourceserial, raw->h.sourceserial); + if (cooked->serialset) + flags |= JOURNAL_SERIALSET; + raw->h.flags = flags; } /* @@ -540,7 +556,8 @@ journal_file_create(isc_mem_t *mctx, const char *filename) { static isc_result_t journal_open(isc_mem_t *mctx, const char *filename, isc_boolean_t write, - isc_boolean_t create, dns_journal_t **journalp) { + isc_boolean_t create, dns_journal_t **journalp) +{ FILE *fp = NULL; isc_result_t result; journal_rawheader_t rawheader; @@ -551,7 +568,8 @@ journal_open(isc_mem_t *mctx, const char *filename, isc_boolean_t write, if (j == NULL) return (ISC_R_NOMEMORY); - j->mctx = mctx; + j->mctx = NULL; + isc_mem_attach(mctx, &j->mctx); j->state = JOURNAL_STATE_INVALID; j->fp = NULL; j->filename = filename; @@ -662,18 +680,23 @@ journal_open(isc_mem_t *mctx, const char *filename, isc_boolean_t write, } if (j->fp != NULL) (void)isc_stdio_close(j->fp); - isc_mem_put(j->mctx, j, sizeof(*j)); + isc_mem_putanddetach(&j->mctx, j, sizeof(*j)); return (result); } isc_result_t -dns_journal_open(isc_mem_t *mctx, const char *filename, isc_boolean_t write, - dns_journal_t **journalp) { +dns_journal_open(isc_mem_t *mctx, const char *filename, unsigned int mode, + dns_journal_t **journalp) +{ isc_result_t result; int namelen; char backup[1024]; + isc_boolean_t write, create; + + create = ISC_TF(mode & DNS_JOURNAL_CREATE); + write = ISC_TF(mode & (DNS_JOURNAL_WRITE|DNS_JOURNAL_CREATE)); - result = journal_open(mctx, filename, write, write, journalp); + result = journal_open(mctx, filename, write, create, journalp); if (result == ISC_R_NOTFOUND) { namelen = strlen(filename); if (namelen > 4 && strcmp(filename + namelen - 4, ".jnl") == 0) @@ -944,7 +967,8 @@ dns_journal_begin_transaction(dns_journal_t *j) { journal_rawxhdr_t hdr; REQUIRE(DNS_JOURNAL_VALID(j)); - REQUIRE(j->state == JOURNAL_STATE_WRITE); + REQUIRE(j->state == JOURNAL_STATE_WRITE || + j->state == JOURNAL_STATE_INLINE); /* * Find the file offset where the new transaction should @@ -1067,7 +1091,21 @@ dns_journal_commit(dns_journal_t *j) { journal_rawheader_t rawheader; REQUIRE(DNS_JOURNAL_VALID(j)); - REQUIRE(j->state == JOURNAL_STATE_TRANSACTION); + REQUIRE(j->state == JOURNAL_STATE_TRANSACTION || + j->state == JOURNAL_STATE_INLINE); + + /* + * Just write out a updated header. + */ + if (j->state == JOURNAL_STATE_INLINE) { + CHECK(journal_fsync(j)); + journal_header_encode(&j->header, &rawheader); + CHECK(journal_seek(j, 0)); + CHECK(journal_write(j, &rawheader, sizeof(rawheader))); + CHECK(journal_fsync(j)); + j->state = JOURNAL_STATE_WRITE; + return (ISC_R_SUCCESS); + } /* * Perform some basic consistency checks. @@ -1124,20 +1162,23 @@ dns_journal_commit(dns_journal_t *j) { */ CHECK(journal_fsync(j)); - /* - * Update the transaction header. - */ - CHECK(journal_seek(j, j->x.pos[0].offset)); - CHECK(journal_write_xhdr(j, (j->x.pos[1].offset - j->x.pos[0].offset) - - sizeof(journal_rawxhdr_t), - j->x.pos[0].serial, j->x.pos[1].serial)); + if (j->state == JOURNAL_STATE_TRANSACTION) { + isc_offset_t offset; + offset = (j->x.pos[1].offset - j->x.pos[0].offset) - + sizeof(journal_rawxhdr_t); + /* + * Update the transaction header. + */ + CHECK(journal_seek(j, j->x.pos[0].offset)); + CHECK(journal_write_xhdr(j, offset, j->x.pos[0].serial, + j->x.pos[1].serial)); + } /* * Update the journal header. */ - if (JOURNAL_EMPTY(&j->header)) { + if (JOURNAL_EMPTY(&j->header)) j->header.begin = j->x.pos[0]; - } j->header.end = j->x.pos[1]; journal_header_encode(&j->header, &rawheader); CHECK(journal_seek(j, 0)); @@ -1204,7 +1245,7 @@ dns_journal_destroy(dns_journal_t **journalp) { if (j->fp != NULL) (void)isc_stdio_close(j->fp); j->magic = 0; - isc_mem_put(j->mctx, j, sizeof(*j)); + isc_mem_putanddetach(&j->mctx, j, sizeof(*j)); *journalp = NULL; } @@ -1369,7 +1410,7 @@ dns_journal_rollforward2(isc_mem_t *mctx, dns_db_t *db, unsigned int options, REQUIRE(filename != NULL); j = NULL; - result = dns_journal_open(mctx, filename, ISC_FALSE, &j); + result = dns_journal_open(mctx, filename, DNS_JOURNAL_READ, &j); if (result == ISC_R_NOTFOUND) { isc_log_write(JOURNAL_DEBUG_LOGARGS(3), "no journal file, but that's OK"); @@ -1402,7 +1443,7 @@ dns_journal_print(isc_mem_t *mctx, const char *filename, FILE *file) { REQUIRE(filename != NULL); j = NULL; - result = dns_journal_open(mctx, filename, ISC_FALSE, &j); + result = dns_journal_open(mctx, filename, DNS_JOURNAL_READ, &j); if (result == ISC_R_NOTFOUND) { isc_log_write(JOURNAL_DEBUG_LOGARGS(3), "no journal file"); return (DNS_R_NOJOURNAL); @@ -1415,6 +1456,8 @@ dns_journal_print(isc_mem_t *mctx, const char *filename, FILE *file) { return (result); } + if (j->header.serialset) + fprintf(file, "Source serial = %u\n", j->header.sourceserial); dns_diff_init(j->mctx, &diff); /* @@ -1497,14 +1540,39 @@ dns_journal_print(isc_mem_t *mctx, const char *filename, FILE *file) { /* * Miscellaneous accessors. */ -isc_uint32_t dns_journal_first_serial(dns_journal_t *j) { +isc_uint32_t +dns_journal_first_serial(dns_journal_t *j) { return (j->header.begin.serial); } -isc_uint32_t dns_journal_last_serial(dns_journal_t *j) { +isc_uint32_t +dns_journal_last_serial(dns_journal_t *j) { return (j->header.end.serial); } +void +dns_journal_set_sourceserial(dns_journal_t *j, isc_uint32_t sourceserial) { + + REQUIRE(j->state == JOURNAL_STATE_WRITE || + j->state == JOURNAL_STATE_INLINE || + j->state == JOURNAL_STATE_TRANSACTION); + + j->header.sourceserial = sourceserial; + j->header.serialset = ISC_TRUE; + if (j->state == JOURNAL_STATE_WRITE) + j->state = JOURNAL_STATE_INLINE; +} + +isc_boolean_t +dns_journal_get_sourceserial(dns_journal_t *j, isc_uint32_t *sourceserial) { + REQUIRE(sourceserial != NULL); + + if (!j->header.serialset) + return (ISC_FALSE); + *sourceserial = j->header.sourceserial; + return (ISC_TRUE); +} + /**************************************************************************/ /* * Iteration support. @@ -1860,8 +1928,7 @@ dns_diff_subtract(dns_diff_t diff[2], dns_diff_t *r) { } static isc_result_t -diff_namespace(isc_mem_t *mctx, - dns_db_t *dba, dns_dbversion_t *dbvera, +diff_namespace(dns_db_t *dba, dns_dbversion_t *dbvera, dns_db_t *dbb, dns_dbversion_t *dbverb, unsigned int options, dns_diff_t *resultdiff) { @@ -1877,8 +1944,8 @@ diff_namespace(isc_mem_t *mctx, db[0] = dba, db[1] = dbb; ver[0] = dbvera, ver[1] = dbverb; - dns_diff_init(mctx, &diff[0]); - dns_diff_init(mctx, &diff[1]); + dns_diff_init(resultdiff->mctx, &diff[0]); + dns_diff_init(resultdiff->mctx, &diff[1]); dns_fixedname_init(&fixname[0]); dns_fixedname_init(&fixname[1]); @@ -1956,8 +2023,11 @@ diff_namespace(isc_mem_t *mctx, failure: dns_dbiterator_destroy(&dbit[1]); + cleanup_iterator: dns_dbiterator_destroy(&dbit[0]); + dns_diff_clear(&diff[0]); + dns_diff_clear(&diff[1]); return (result); } @@ -1968,33 +2038,48 @@ diff_namespace(isc_mem_t *mctx, * possibly very large transaction. */ isc_result_t -dns_db_diff(isc_mem_t *mctx, - dns_db_t *dba, dns_dbversion_t *dbvera, - dns_db_t *dbb, dns_dbversion_t *dbverb, - const char *journal_filename) +dns_db_diff(isc_mem_t *mctx, dns_db_t *dba, dns_dbversion_t *dbvera, + dns_db_t *dbb, dns_dbversion_t *dbverb, const char *filename) +{ + isc_result_t result; + dns_diff_t diff; + + dns_diff_init(mctx, &diff); + + result = dns_db_diffx(&diff, dba, dbvera, dbb, dbverb, filename); + + dns_diff_clear(&diff); + + return (result); +} + +isc_result_t +dns_db_diffx(dns_diff_t *diff, dns_db_t *dba, dns_dbversion_t *dbvera, + dns_db_t *dbb, dns_dbversion_t *dbverb, const char *filename) { isc_result_t result; dns_journal_t *journal = NULL; - dns_diff_t resultdiff; - result = dns_journal_open(mctx, journal_filename, ISC_TRUE, &journal); - if (result != ISC_R_SUCCESS) - return (result); + if (filename != NULL) { + result = dns_journal_open(diff->mctx, filename, + DNS_JOURNAL_CREATE, &journal); + if (result != ISC_R_SUCCESS) + return (result); + } - dns_diff_init(mctx, &resultdiff); + CHECK(diff_namespace(dba, dbvera, dbb, dbverb, DNS_DB_NONSEC3, diff)); + CHECK(diff_namespace(dba, dbvera, dbb, dbverb, DNS_DB_NSEC3ONLY, diff)); - CHECK(diff_namespace(mctx, dba, dbvera, dbb, dbverb, - DNS_DB_NONSEC3, &resultdiff)); - CHECK(diff_namespace(mctx, dba, dbvera, dbb, dbverb, - DNS_DB_NSEC3ONLY, &resultdiff)); - if (ISC_LIST_EMPTY(resultdiff.tuples)) { - isc_log_write(JOURNAL_DEBUG_LOGARGS(3), "no changes"); - } else { - CHECK(dns_journal_write_transaction(journal, &resultdiff)); + if (journal != NULL) { + if (ISC_LIST_EMPTY(diff->tuples)) + isc_log_write(JOURNAL_DEBUG_LOGARGS(3), "no changes"); + else + CHECK(dns_journal_write_transaction(journal, diff)); } + failure: - dns_diff_clear(&resultdiff); - dns_journal_destroy(&journal); + if (journal != NULL) + dns_journal_destroy(&journal); return (result); } @@ -2145,6 +2230,8 @@ dns_journal_compact(isc_mem_t *mctx, char *filename, isc_uint32_t serial, new->header.begin.offset = indexend; new->header.end.serial = j->header.end.serial; new->header.end.offset = indexend + copy_length; + new->header.sourceserial = j->header.sourceserial; + new->header.serialset = j->header.serialset; /* * Update the journal header. diff --git a/lib/dns/key.c b/lib/dns/key.c index bf9b16c..ccac157 100644 --- a/lib/dns/key.c +++ b/lib/dns/key.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2007, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007, 2011 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2001 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: key.c,v 1.11 2011/10/20 21:20:02 marka Exp $ */ #include <config.h> @@ -177,4 +177,16 @@ dst_key_getbits(const dst_key_t *key) { return (key->key_bits); } +void +dst_key_setttl(dst_key_t *key, dns_ttl_t ttl) { + REQUIRE(VALID_KEY(key)); + key->key_ttl = ttl; +} + +dns_ttl_t +dst_key_getttl(const dst_key_t *key) { + REQUIRE(VALID_KEY(key)); + return (key->key_ttl); +} + /*! \file */ diff --git a/lib/dns/keytable.c b/lib/dns/keytable.c index 309e9dd..c49847f 100644 --- a/lib/dns/keytable.c +++ b/lib/dns/keytable.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007, 2009, 2010 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2009, 2010, 2013 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -67,7 +67,8 @@ dns_keytable_create(isc_mem_t *mctx, dns_keytable_t **keytablep) { if (result != ISC_R_SUCCESS) goto cleanup_lock; - keytable->mctx = mctx; + keytable->mctx = NULL; + isc_mem_attach(mctx, &keytable->mctx); keytable->active_nodes = 0; keytable->references = 1; keytable->magic = KEYTABLE_MAGIC; @@ -82,7 +83,7 @@ dns_keytable_create(isc_mem_t *mctx, dns_keytable_t **keytablep) { dns_rbt_destroy(&keytable->table); cleanup_keytable: - isc_mem_put(mctx, keytable, sizeof(*keytable)); + isc_mem_putanddetach(&mctx, keytable, sizeof(*keytable)); return (result); } @@ -137,7 +138,8 @@ dns_keytable_detach(dns_keytable_t **keytablep) { isc_rwlock_destroy(&keytable->rwlock); DESTROYLOCK(&keytable->lock); keytable->magic = 0; - isc_mem_put(keytable->mctx, keytable, sizeof(*keytable)); + isc_mem_putanddetach(&keytable->mctx, + keytable, sizeof(*keytable)); } *keytablep = NULL; diff --git a/lib/dns/log.c b/lib/dns/log.c index d286d10..c4d644e 100644 --- a/lib/dns/log.c +++ b/lib/dns/log.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: log.c,v 1.49 2011/10/13 22:48:24 tbox Exp $ */ /*! \file */ diff --git a/lib/dns/lookup.c b/lib/dns/lookup.c index d5fc7aa..9387a95 100644 --- a/lib/dns/lookup.c +++ b/lib/dns/lookup.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2013 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001, 2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -356,7 +356,7 @@ static void levent_destroy(isc_event_t *event) { dns_lookupevent_t *levent; isc_mem_t *mctx; - + REQUIRE(event->ev_type == DNS_EVENT_LOOKUPDONE); mctx = event->ev_destroy_arg; levent = (dns_lookupevent_t *)event; @@ -393,7 +393,8 @@ dns_lookup_create(isc_mem_t *mctx, dns_name_t *name, dns_rdatatype_t type, lookup = isc_mem_get(mctx, sizeof(*lookup)); if (lookup == NULL) return (ISC_R_NOMEMORY); - lookup->mctx = mctx; + lookup->mctx = NULL; + isc_mem_attach(mctx, &lookup->mctx); lookup->options = options; ievent = isc_event_allocate(mctx, lookup, DNS_EVENT_LOOKUPDONE, @@ -452,7 +453,7 @@ dns_lookup_create(isc_mem_t *mctx, dns_name_t *name, dns_rdatatype_t type, isc_task_detach(&lookup->task); cleanup_lookup: - isc_mem_put(mctx, lookup, sizeof(*lookup)); + isc_mem_putanddetach(&mctx, lookup, sizeof(*lookup)); return (result); } @@ -491,7 +492,7 @@ dns_lookup_destroy(dns_lookup_t **lookupp) { DESTROYLOCK(&lookup->lock); lookup->magic = 0; - isc_mem_put(lookup->mctx, lookup, sizeof(*lookup)); + isc_mem_putanddetach(&lookup->mctx, lookup, sizeof(*lookup)); *lookupp = NULL; } diff --git a/lib/dns/master.c b/lib/dns/master.c index 1b7460c..d0c1758 100644 --- a/lib/dns/master.c +++ b/lib/dns/master.c @@ -133,6 +133,7 @@ struct dns_loadctx { /* Members specific to the raw format: */ FILE *f; isc_boolean_t first; + dns_masterrawheader_t header; /* Which fixed buffers we are using? */ unsigned int loop_cnt; /*% records per quantum, @@ -597,6 +598,7 @@ loadctx_create(dns_masterformat_t format, isc_mem_t *mctx, lctx->f = NULL; lctx->first = ISC_TRUE; + dns_master_initrawheader(&lctx->header); lctx->loop_cnt = (done != NULL) ? 100 : 0; lctx->callbacks = callbacks; @@ -2105,50 +2107,74 @@ load_raw(dns_loadctx_t *lctx) { int target_size = TSIZ; isc_buffer_t target, buf; unsigned char *target_mem = NULL; + dns_masterrawheader_t header; dns_decompress_t dctx; REQUIRE(DNS_LCTX_VALID(lctx)); callbacks = lctx->callbacks; dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_NONE); + dns_master_initrawheader(&header); + if (lctx->first) { - dns_masterrawheader_t header; - isc_uint32_t format, version, dumptime; - size_t hdrlen = sizeof(format) + sizeof(version) + - sizeof(dumptime); + unsigned char data[sizeof(header)]; + size_t commonlen = + sizeof(header.format) + sizeof(header.version); + size_t remainder; - INSIST(hdrlen <= sizeof(header)); - isc_buffer_init(&target, &header, sizeof(header)); + INSIST(commonlen <= sizeof(header)); + isc_buffer_init(&target, data, sizeof(data)); - result = isc_stdio_read(&header, 1, hdrlen, lctx->f, NULL); + result = isc_stdio_read(data, 1, commonlen, lctx->f, NULL); if (result != ISC_R_SUCCESS) { UNEXPECTED_ERROR(__FILE__, __LINE__, "isc_stdio_read failed: %s", isc_result_totext(result)); return (result); } - isc_buffer_add(&target, hdrlen); - format = isc_buffer_getuint32(&target); - if (format != dns_masterformat_raw) { + isc_buffer_add(&target, commonlen); + header.format = isc_buffer_getuint32(&target); + if (header.format != dns_masterformat_raw) { (*callbacks->error)(callbacks, "dns_master_load: " "file format mismatch"); return (ISC_R_NOTIMPLEMENTED); } - version = isc_buffer_getuint32(&target); - if (version > DNS_RAWFORMAT_VERSION) { + header.version = isc_buffer_getuint32(&target); + switch (header.version) { + case 0: + remainder = sizeof(header.dumptime); + break; + case DNS_RAWFORMAT_VERSION: + remainder = sizeof(header) - commonlen; + break; + default: (*callbacks->error)(callbacks, "dns_master_load: " "unsupported file format version"); return (ISC_R_NOTIMPLEMENTED); } - /* Empty read: currently, we do not use dumptime */ - dumptime = isc_buffer_getuint32(&target); - POST(dumptime); + result = isc_stdio_read(data + commonlen, 1, remainder, + lctx->f, NULL); + if (result != ISC_R_SUCCESS) { + UNEXPECTED_ERROR(__FILE__, __LINE__, + "isc_stdio_read failed: %s", + isc_result_totext(result)); + return (result); + } + + isc_buffer_add(&target, remainder); + header.dumptime = isc_buffer_getuint32(&target); + if (header.version == DNS_RAWFORMAT_VERSION) { + header.flags = isc_buffer_getuint32(&target); + header.sourceserial = isc_buffer_getuint32(&target); + header.lastxfrin = isc_buffer_getuint32(&target); + } lctx->first = ISC_FALSE; + lctx->header = header; } ISC_LIST_INIT(head); @@ -2383,6 +2409,9 @@ load_raw(dns_loadctx_t *lctx) { } else if (result == ISC_R_SUCCESS && lctx->result != ISC_R_SUCCESS) result = lctx->result; + if (result == ISC_R_SUCCESS && callbacks->rawdata != NULL) + (*callbacks->rawdata)(callbacks->zone, &header); + cleanup: if (rdata != NULL) isc_mem_put(mctx, rdata, rdata_size * sizeof(*rdata)); @@ -2969,3 +2998,8 @@ dns_loadctx_cancel(dns_loadctx_t *lctx) { lctx->canceled = ISC_TRUE; UNLOCK(&lctx->lock); } + +void +dns_master_initrawheader(dns_masterrawheader_t *header) { + memset(header, 0, sizeof(dns_masterrawheader_t)); +} diff --git a/lib/dns/masterdump.c b/lib/dns/masterdump.c index a10e6f2..2717658 100644 --- a/lib/dns/masterdump.c +++ b/lib/dns/masterdump.c @@ -74,6 +74,7 @@ struct dns_master_style { unsigned int rdata_column; unsigned int line_length; unsigned int tab_width; + unsigned int split_width; }; /*% @@ -108,15 +109,16 @@ dns_master_style_default = { DNS_STYLEFLAG_OMIT_TTL | DNS_STYLEFLAG_TTL | DNS_STYLEFLAG_COMMENT | + DNS_STYLEFLAG_RRCOMMENT | DNS_STYLEFLAG_MULTILINE, - 24, 24, 24, 32, 80, 8 + 24, 24, 24, 32, 80, 8, UINT_MAX }; LIBDNS_EXTERNAL_DATA const dns_master_style_t dns_master_style_full = { DNS_STYLEFLAG_COMMENT | DNS_STYLEFLAG_RESIGN, - 46, 46, 46, 64, 120, 8 + 46, 46, 46, 64, 120, 8, UINT_MAX }; LIBDNS_EXTERNAL_DATA const dns_master_style_t @@ -126,8 +128,9 @@ dns_master_style_explicitttl = { DNS_STYLEFLAG_REL_OWNER | DNS_STYLEFLAG_REL_DATA | DNS_STYLEFLAG_COMMENT | + DNS_STYLEFLAG_RRCOMMENT | DNS_STYLEFLAG_MULTILINE, - 24, 32, 32, 40, 80, 8 + 24, 32, 32, 40, 80, 8, UINT_MAX }; LIBDNS_EXTERNAL_DATA const dns_master_style_t @@ -137,13 +140,13 @@ dns_master_style_cache = { DNS_STYLEFLAG_MULTILINE | DNS_STYLEFLAG_TRUST | DNS_STYLEFLAG_NCACHE, - 24, 32, 32, 40, 80, 8 + 24, 32, 32, 40, 80, 8, UINT_MAX }; LIBDNS_EXTERNAL_DATA const dns_master_style_t dns_master_style_simple = { 0, - 24, 32, 32, 40, 80, 8 + 24, 32, 32, 40, 80, 8, UINT_MAX }; /*% @@ -152,7 +155,7 @@ dns_master_style_simple = { LIBDNS_EXTERNAL_DATA const dns_master_style_t dns_master_style_debug = { DNS_STYLEFLAG_REL_OWNER, - 24, 32, 40, 48, 80, 8 + 24, 32, 40, 48, 80, 8, UINT_MAX }; @@ -185,6 +188,7 @@ struct dns_dumpctx { char *file; char *tmpfile; dns_masterformat_t format; + dns_masterrawheader_t header; isc_result_t (*dumpsets)(isc_mem_t *mctx, dns_name_t *name, dns_rdatasetiter_t *rdsiter, dns_totext_ctx_t *ctx, @@ -373,7 +377,7 @@ ncache_summary(dns_rdataset_t *rdataset, isc_boolean_t omit_final_dot, dns_rdataset_current(&rds, &rdata); CHECK(str_totext(" ", target)); CHECK(dns_rdata_tofmttext(&rdata, dns_rootname, - 0, 0, " ", target)); + 0, 0, 0, " ", target)); CHECK(str_totext("\n", target)); } } @@ -533,6 +537,7 @@ rdataset_totext(dns_rdataset_t *rdataset, ctx->style.flags, ctx->style.line_length - ctx->style.rdata_column, + ctx->style.split_width, ctx->linebreak, target)); @@ -1147,20 +1152,52 @@ dns_dumpctx_cancel(dns_dumpctx_t *dctx) { } static isc_result_t -closeandrename(FILE *f, isc_result_t result, const char *temp, const char *file) -{ - isc_result_t tresult; +flushandsync(FILE *f, isc_result_t result, const char *temp) { isc_boolean_t logit = ISC_TF(result == ISC_R_SUCCESS); if (result == ISC_R_SUCCESS) - result = isc_stdio_sync(f); + result = isc_stdio_flush(f); if (result != ISC_R_SUCCESS && logit) { - isc_log_write(dns_lctx, ISC_LOGCATEGORY_GENERAL, - DNS_LOGMODULE_MASTERDUMP, ISC_LOG_ERROR, - "dumping master file: %s: fsync: %s", - temp, isc_result_totext(result)); + if (temp != NULL) + isc_log_write(dns_lctx, ISC_LOGCATEGORY_GENERAL, + DNS_LOGMODULE_MASTERDUMP, ISC_LOG_ERROR, + "dumping to master file: %s: flush: %s", + temp, isc_result_totext(result)); + else + isc_log_write(dns_lctx, ISC_LOGCATEGORY_GENERAL, + DNS_LOGMODULE_MASTERDUMP, ISC_LOG_ERROR, + "dumping to stream: flush: %s", + isc_result_totext(result)); logit = ISC_FALSE; } + + if (result == ISC_R_SUCCESS) + result = isc_stdio_sync(f); + if (result != ISC_R_SUCCESS && logit) { + if (temp != NULL) + isc_log_write(dns_lctx, ISC_LOGCATEGORY_GENERAL, + DNS_LOGMODULE_MASTERDUMP, ISC_LOG_ERROR, + "dumping to master file: %s: fsync: %s", + temp, isc_result_totext(result)); + else + isc_log_write(dns_lctx, ISC_LOGCATEGORY_GENERAL, + DNS_LOGMODULE_MASTERDUMP, ISC_LOG_ERROR, + "dumping to stream: fsync: %s", + isc_result_totext(result)); + } + return (result); +} + +static isc_result_t +closeandrename(FILE *f, isc_result_t result, const char *temp, const char *file) +{ + isc_result_t tresult; + isc_boolean_t logit = ISC_TF(result == ISC_R_SUCCESS); + + result = flushandsync(f, result, temp); + if (result != ISC_R_SUCCESS) + logit = ISC_FALSE; + tresult = isc_stdio_close(f); if (result == ISC_R_SUCCESS) result = tresult; @@ -1208,7 +1245,8 @@ dump_quantum(isc_task_t *task, isc_event_t *event) { dctx->tmpfile, dctx->file); if (tresult != ISC_R_SUCCESS && result == ISC_R_SUCCESS) result = tresult; - } + } else + result = flushandsync(dctx->f, result, NULL); (dctx->done)(dctx->done_arg, result); isc_event_free(&event); dns_dumpctx_detach(&dctx); @@ -1229,7 +1267,7 @@ task_send(dns_dumpctx_t *dctx) { static isc_result_t dumpctx_create(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version, const dns_master_style_t *style, FILE *f, dns_dumpctx_t **dctxp, - dns_masterformat_t format) + dns_masterformat_t format, dns_masterrawheader_t *header) { dns_dumpctx_t *dctx; isc_result_t result; @@ -1253,6 +1291,10 @@ dumpctx_create(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version, dctx->file = NULL; dctx->tmpfile = NULL; dctx->format = format; + if (header == NULL) + dns_master_initrawheader(&dctx->header); + else + dctx->header = *header; switch (format) { case dns_masterformat_text: @@ -1320,7 +1362,7 @@ dumptostreaminc(dns_dumpctx_t *dctx) { dns_fixedname_t fixname; unsigned int nodes; dns_masterrawheader_t rawheader; - isc_uint32_t now32; + isc_uint32_t rawversion, now32; isc_time_t start; bufmem = isc_mem_get(dctx->mctx, initial_buffer_length); @@ -1355,8 +1397,6 @@ dumptostreaminc(dns_dumpctx_t *dctx) { r.base = (unsigned char *)&rawheader; r.length = sizeof(rawheader); isc_buffer_region(&buffer, &r); - isc_buffer_putuint32(&buffer, dns_masterformat_raw); - isc_buffer_putuint32(&buffer, DNS_RAWFORMAT_VERSION); #if !defined(STDTIME_ON_32BITS) || (STDTIME_ON_32BITS + 0) != 1 /* * We assume isc_stdtime_t is a 32-bit integer, @@ -1375,7 +1415,22 @@ dumptostreaminc(dns_dumpctx_t *dctx) { #else now32 = dctx->now; #endif + rawversion = 1; + if ((dctx->header.flags & DNS_MASTERRAW_COMPAT) != 0) + rawversion = 0; + isc_buffer_putuint32(&buffer, dns_masterformat_raw); + isc_buffer_putuint32(&buffer, rawversion); isc_buffer_putuint32(&buffer, now32); + + if (rawversion == 1) { + isc_buffer_putuint32(&buffer, + dctx->header.flags); + isc_buffer_putuint32(&buffer, + dctx->header.sourceserial); + isc_buffer_putuint32(&buffer, + dctx->header.lastxfrin); + } + INSIST(isc_buffer_usedlength(&buffer) <= sizeof(rawheader)); result = isc_stdio_write(buffer.base, 1, @@ -1494,7 +1549,7 @@ dns_master_dumptostreaminc(isc_mem_t *mctx, dns_db_t *db, REQUIRE(done != NULL); result = dumpctx_create(mctx, db, version, style, f, &dctx, - dns_masterformat_text); + dns_masterformat_text, NULL); if (result != ISC_R_SUCCESS) return (result); isc_task_attach(task, &dctx->task); @@ -1521,8 +1576,8 @@ dns_master_dumptostream(isc_mem_t *mctx, dns_db_t *db, const dns_master_style_t *style, FILE *f) { - return (dns_master_dumptostream2(mctx, db, version, style, - dns_masterformat_text, f)); + return (dns_master_dumptostream3(mctx, db, version, style, + dns_masterformat_text, NULL, f)); } isc_result_t @@ -1531,16 +1586,30 @@ dns_master_dumptostream2(isc_mem_t *mctx, dns_db_t *db, const dns_master_style_t *style, dns_masterformat_t format, FILE *f) { + return (dns_master_dumptostream3(mctx, db, version, style, + format, NULL, f)); +} + +isc_result_t +dns_master_dumptostream3(isc_mem_t *mctx, dns_db_t *db, + dns_dbversion_t *version, + const dns_master_style_t *style, + dns_masterformat_t format, + dns_masterrawheader_t *header, FILE *f) +{ dns_dumpctx_t *dctx = NULL; isc_result_t result; - result = dumpctx_create(mctx, db, version, style, f, &dctx, format); + result = dumpctx_create(mctx, db, version, style, f, &dctx, + format, header); if (result != ISC_R_SUCCESS) return (result); result = dumptostreaminc(dctx); INSIST(result != DNS_R_CONTINUE); dns_dumpctx_detach(&dctx); + + result = flushandsync(f, result, NULL); return (result); } @@ -1587,9 +1656,9 @@ dns_master_dumpinc(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version, isc_task_t *task, dns_dumpdonefunc_t done, void *done_arg, dns_dumpctx_t **dctxp) { - return (dns_master_dumpinc2(mctx, db, version, style, filename, task, + return (dns_master_dumpinc3(mctx, db, version, style, filename, task, done, done_arg, dctxp, - dns_masterformat_text)); + dns_masterformat_text, NULL)); } isc_result_t @@ -1598,6 +1667,17 @@ dns_master_dumpinc2(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version, isc_task_t *task, dns_dumpdonefunc_t done, void *done_arg, dns_dumpctx_t **dctxp, dns_masterformat_t format) { + return (dns_master_dumpinc3(mctx, db, version, style, filename, task, + done, done_arg, dctxp, format, NULL)); +} + +isc_result_t +dns_master_dumpinc3(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version, + const dns_master_style_t *style, const char *filename, + isc_task_t *task, dns_dumpdonefunc_t done, void *done_arg, + dns_dumpctx_t **dctxp, dns_masterformat_t format, + dns_masterrawheader_t *header) +{ FILE *f = NULL; isc_result_t result; char *tempname = NULL; @@ -1612,7 +1692,8 @@ dns_master_dumpinc2(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version, if (result != ISC_R_SUCCESS) goto cleanup; - result = dumpctx_create(mctx, db, version, style, f, &dctx, format); + result = dumpctx_create(mctx, db, version, style, f, &dctx, + format, header); if (result != ISC_R_SUCCESS) { (void)isc_stdio_close(f); (void)isc_file_remove(tempname); @@ -1648,8 +1729,8 @@ isc_result_t dns_master_dump(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version, const dns_master_style_t *style, const char *filename) { - return (dns_master_dump2(mctx, db, version, style, filename, - dns_masterformat_text)); + return (dns_master_dump3(mctx, db, version, style, filename, + dns_masterformat_text, NULL)); } isc_result_t @@ -1657,6 +1738,15 @@ dns_master_dump2(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version, const dns_master_style_t *style, const char *filename, dns_masterformat_t format) { + return (dns_master_dump3(mctx, db, version, style, filename, + format, NULL)); +} + +isc_result_t +dns_master_dump3(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version, + const dns_master_style_t *style, const char *filename, + dns_masterformat_t format, dns_masterrawheader_t *header) +{ FILE *f = NULL; isc_result_t result; char *tempname; @@ -1666,7 +1756,8 @@ dns_master_dump2(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version, if (result != ISC_R_SUCCESS) return (result); - result = dumpctx_create(mctx, db, version, style, f, &dctx, format); + result = dumpctx_create(mctx, db, version, style, f, &dctx, + format, header); if (result != ISC_R_SUCCESS) goto cleanup; @@ -1777,6 +1868,19 @@ dns_master_stylecreate(dns_master_style_t **stylep, unsigned int flags, unsigned int line_length, unsigned int tab_width, isc_mem_t *mctx) { + return (dns_master_stylecreate2(stylep, flags, ttl_column, + class_column, type_column, + rdata_column, line_length, + tab_width, 0xffffffff, mctx)); +} + +isc_result_t +dns_master_stylecreate2(dns_master_style_t **stylep, unsigned int flags, + unsigned int ttl_column, unsigned int class_column, + unsigned int type_column, unsigned int rdata_column, + unsigned int line_length, unsigned int tab_width, + unsigned int split_width, isc_mem_t *mctx) +{ dns_master_style_t *style; REQUIRE(stylep != NULL && *stylep == NULL); @@ -1791,6 +1895,7 @@ dns_master_stylecreate(dns_master_style_t **stylep, unsigned int flags, style->rdata_column = rdata_column; style->line_length = line_length; style->tab_width = tab_width; + style->split_width = split_width; *stylep = style; return (ISC_R_SUCCESS); diff --git a/lib/dns/message.c b/lib/dns/message.c index d36edba..53efc5a 100644 --- a/lib/dns/message.c +++ b/lib/dns/message.c @@ -732,7 +732,9 @@ dns_message_create(isc_mem_t *mctx, unsigned int intent, dns_message_t **msgp) for (i = 0; i < DNS_SECTION_MAX; i++) ISC_LIST_INIT(m->sections[i]); - m->mctx = mctx; + + m->mctx = NULL; + isc_mem_attach(mctx, &m->mctx); ISC_LIST_INIT(m->scratchpad); ISC_LIST_INIT(m->cleanup); @@ -786,7 +788,7 @@ dns_message_create(isc_mem_t *mctx, unsigned int intent, dns_message_t **msgp) if (m->rdspool != NULL) isc_mempool_destroy(&m->rdspool); m->magic = 0; - isc_mem_put(mctx, m, sizeof(dns_message_t)); + isc_mem_putanddetach(&mctx, m, sizeof(dns_message_t)); return (ISC_R_NOMEMORY); } @@ -815,7 +817,7 @@ dns_message_destroy(dns_message_t **msgp) { isc_mempool_destroy(&msg->namepool); isc_mempool_destroy(&msg->rdspool); msg->magic = 0; - isc_mem_put(msg->mctx, msg, sizeof(dns_message_t)); + isc_mem_putanddetach(&msg->mctx, msg, sizeof(dns_message_t)); } static isc_result_t diff --git a/lib/dns/nsec.c b/lib/dns/nsec.c index 41b5dc3..e446806b 100644 --- a/lib/dns/nsec.c +++ b/lib/dns/nsec.c @@ -42,28 +42,61 @@ goto failure; \ } while (0) -static void -set_bit(unsigned char *array, unsigned int index, unsigned int bit) { +void +dns_nsec_setbit(unsigned char *array, unsigned int type, unsigned int bit) { unsigned int shift, mask; - shift = 7 - (index % 8); + shift = 7 - (type % 8); mask = 1 << shift; if (bit != 0) - array[index / 8] |= mask; + array[type / 8] |= mask; else - array[index / 8] &= (~mask & 0xFF); + array[type / 8] &= (~mask & 0xFF); } -static unsigned int -bit_isset(unsigned char *array, unsigned int index) { +isc_boolean_t +dns_nsec_isset(const unsigned char *array, unsigned int type) { unsigned int byte, shift, mask; - byte = array[index / 8]; - shift = 7 - (index % 8); + byte = array[type / 8]; + shift = 7 - (type % 8); mask = 1 << shift; - return ((byte & mask) != 0); + return (ISC_TF(byte & mask)); +} + +unsigned int +dns_nsec_compressbitmap(unsigned char *map, const unsigned char *raw, + unsigned int max_type) +{ + unsigned char *start = map; + unsigned int window; + int octet; + + if (raw == NULL) + return (0); + + for (window = 0; window < 256; window++) { + if (window * 256 > max_type) + break; + for (octet = 31; octet >= 0; octet--) + if (*(raw + octet) != 0) + break; + if (octet < 0) { + raw += 32; + continue; + } + *map++ = window; + *map++ = octet + 1; + /* + * Note: potential overlapping move. + */ + memmove(map, raw, octet + 1); + map += octet + 1; + raw += 32; + } + return (map - start); } isc_result_t @@ -74,8 +107,7 @@ dns_nsec_buildrdata(dns_db_t *db, dns_dbversion_t *version, isc_result_t result; dns_rdataset_t rdataset; isc_region_t r; - unsigned int i, window; - int octet; + unsigned int i; unsigned char *nsec_bits, *bm; unsigned int max_type; @@ -91,8 +123,8 @@ dns_nsec_buildrdata(dns_db_t *db, dns_dbversion_t *version, */ bm = r.base + r.length + 512; nsec_bits = r.base + r.length; - set_bit(bm, dns_rdatatype_rrsig, 1); - set_bit(bm, dns_rdatatype_nsec, 1); + dns_nsec_setbit(bm, dns_rdatatype_rrsig, 1); + dns_nsec_setbit(bm, dns_rdatatype_nsec, 1); max_type = dns_rdatatype_nsec; dns_rdataset_init(&rdataset); rdsiter = NULL; @@ -109,7 +141,7 @@ dns_nsec_buildrdata(dns_db_t *db, dns_dbversion_t *version, rdataset.type != dns_rdatatype_rrsig) { if (rdataset.type > max_type) max_type = rdataset.type; - set_bit(bm, rdataset.type, 1); + dns_nsec_setbit(bm, rdataset.type, 1); } dns_rdataset_disassociate(&rdataset); } @@ -117,12 +149,12 @@ dns_nsec_buildrdata(dns_db_t *db, dns_dbversion_t *version, /* * At zone cuts, deny the existence of glue in the parent zone. */ - if (bit_isset(bm, dns_rdatatype_ns) && - ! bit_isset(bm, dns_rdatatype_soa)) { + if (dns_nsec_isset(bm, dns_rdatatype_ns) && + ! dns_nsec_isset(bm, dns_rdatatype_soa)) { for (i = 0; i <= max_type; i++) { - if (bit_isset(bm, i) && + if (dns_nsec_isset(bm, i) && ! dns_rdatatype_iszonecutauth((dns_rdatatype_t)i)) - set_bit(bm, i, 0); + dns_nsec_setbit(bm, i, 0); } } @@ -130,22 +162,8 @@ dns_nsec_buildrdata(dns_db_t *db, dns_dbversion_t *version, if (result != ISC_R_NOMORE) return (result); - for (window = 0; window < 256; window++) { - if (window * 256 > max_type) - break; - for (octet = 31; octet >= 0; octet--) - if (bm[window * 32 + octet] != 0) - break; - if (octet < 0) - continue; - nsec_bits[0] = window; - nsec_bits[1] = octet + 1; - /* - * Note: potential overlapping move. - */ - memmove(&nsec_bits[2], &bm[window * 32], octet + 1); - nsec_bits += 3 + octet; - } + nsec_bits += dns_nsec_compressbitmap(nsec_bits, bm, max_type); + r.length = nsec_bits - r.base; INSIST(r.length <= DNS_NSEC_BUFFERSIZE); dns_rdata_fromregion(rdata, @@ -156,7 +174,6 @@ dns_nsec_buildrdata(dns_db_t *db, dns_dbversion_t *version, return (ISC_R_SUCCESS); } - isc_result_t dns_nsec_build(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node, dns_name_t *target, dns_ttl_t ttl) @@ -217,8 +234,8 @@ dns_nsec_typepresent(dns_rdata_t *nsec, dns_rdatatype_t type) { if ((window + 1) * 256 <= type) continue; if (type < (window * 256) + len * 8) - present = ISC_TF(bit_isset(&nsecstruct.typebits[i], - type % 256)); + present = ISC_TF(dns_nsec_isset(&nsecstruct.typebits[i], + type % 256)); break; } dns_rdata_freestruct(&nsecstruct); @@ -246,10 +263,8 @@ dns_nsec_nseconly(dns_db_t *db, dns_dbversion_t *version, 0, 0, &rdataset, NULL); dns_db_detachnode(db, &node); - if (result == ISC_R_NOTFOUND) { + if (result == ISC_R_NOTFOUND) *answer = ISC_FALSE; - return (ISC_R_SUCCESS); - } if (result != ISC_R_SUCCESS) return (result); for (result = dns_rdataset_first(&rdataset); diff --git a/lib/dns/nsec3.c b/lib/dns/nsec3.c index 7ec6b4c..935f515 100644 --- a/lib/dns/nsec3.c +++ b/lib/dns/nsec3.c @@ -34,6 +34,7 @@ #include <dns/dbiterator.h> #include <dns/diff.h> #include <dns/fixedname.h> +#include <dns/nsec.h> #include <dns/nsec3.h> #include <dns/rdata.h> #include <dns/rdatalist.h> @@ -50,32 +51,9 @@ #define OPTOUT(x) (((x) & DNS_NSEC3FLAG_OPTOUT) != 0) #define CREATE(x) (((x) & DNS_NSEC3FLAG_CREATE) != 0) +#define INITIAL(x) (((x) & DNS_NSEC3FLAG_INITIAL) != 0) #define REMOVE(x) (((x) & DNS_NSEC3FLAG_REMOVE) != 0) -static void -set_bit(unsigned char *array, unsigned int index, unsigned int bit) { - unsigned int shift, mask; - - shift = 7 - (index % 8); - mask = 1 << shift; - - if (bit != 0) - array[index / 8] |= mask; - else - array[index / 8] &= (~mask & 0xFF); -} - -static unsigned int -bit_isset(unsigned char *array, unsigned int index) { - unsigned int byte, shift, mask; - - byte = array[index / 8]; - shift = 7 - (index % 8); - mask = 1 << shift; - - return ((byte & mask) != 0); -} - isc_result_t dns_nsec3_buildrdata(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node, unsigned int hashalg, @@ -87,8 +65,7 @@ dns_nsec3_buildrdata(dns_db_t *db, dns_dbversion_t *version, isc_result_t result; dns_rdataset_t rdataset; isc_region_t r; - unsigned int i, window; - int octet; + unsigned int i; isc_boolean_t found; isc_boolean_t found_ns; isc_boolean_t need_rrsig; @@ -156,7 +133,7 @@ dns_nsec3_buildrdata(dns_db_t *db, dns_dbversion_t *version, rdataset.type != dns_rdatatype_rrsig) { if (rdataset.type > max_type) max_type = rdataset.type; - set_bit(bm, rdataset.type, 1); + dns_nsec_setbit(bm, rdataset.type, 1); /* * Work out if we need to set the RRSIG bit for * this node. We set the RRSIG bit if either of @@ -179,18 +156,18 @@ dns_nsec3_buildrdata(dns_db_t *db, dns_dbversion_t *version, if ((found && !found_ns) || need_rrsig) { if (dns_rdatatype_rrsig > max_type) max_type = dns_rdatatype_rrsig; - set_bit(bm, dns_rdatatype_rrsig, 1); + dns_nsec_setbit(bm, dns_rdatatype_rrsig, 1); } /* * At zone cuts, deny the existence of glue in the parent zone. */ - if (bit_isset(bm, dns_rdatatype_ns) && - ! bit_isset(bm, dns_rdatatype_soa)) { + if (dns_nsec_isset(bm, dns_rdatatype_ns) && + ! dns_nsec_isset(bm, dns_rdatatype_soa)) { for (i = 0; i <= max_type; i++) { - if (bit_isset(bm, i) && + if (dns_nsec_isset(bm, i) && ! dns_rdatatype_iszonecutauth((dns_rdatatype_t)i)) - set_bit(bm, i, 0); + dns_nsec_setbit(bm, i, 0); } } @@ -199,22 +176,7 @@ dns_nsec3_buildrdata(dns_db_t *db, dns_dbversion_t *version, return (result); collapse_bitmap: - for (window = 0; window < 256; window++) { - if (window * 256 > max_type) - break; - for (octet = 31; octet >= 0; octet--) - if (bm[window * 32 + octet] != 0) - break; - if (octet < 0) - continue; - nsec_bits[0] = window; - nsec_bits[1] = octet + 1; - /* - * Note: potentially overlapping move. - */ - memmove(&nsec_bits[2], &bm[window * 32], octet + 1); - nsec_bits += 3 + octet; - } + nsec_bits += dns_nsec_compressbitmap(nsec_bits, bm, max_type); r.length = nsec_bits - r.base; INSIST(r.length <= DNS_NSEC3_BUFFERSIZE); dns_rdata_fromregion(rdata, dns_db_class(db), dns_rdatatype_nsec3, &r); @@ -249,8 +211,8 @@ dns_nsec3_typepresent(dns_rdata_t *rdata, dns_rdatatype_t type) { if ((window + 1) * 256 <= type) continue; if (type < (window * 256) + len * 8) - present = ISC_TF(bit_isset(&nsec3.typebits[i], - type % 256)); + present = ISC_TF(dns_nsec_isset(&nsec3.typebits[i], + type % 256)); break; } dns_rdata_freestruct(&nsec3); @@ -1054,7 +1016,8 @@ rr_exists(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, #ifdef BIND9 isc_result_t dns_nsec3param_deletechains(dns_db_t *db, dns_dbversion_t *ver, - dns_zone_t *zone, dns_diff_t *diff) + dns_zone_t *zone, isc_boolean_t nonsec, + dns_diff_t *diff) { dns_dbnode_t *node = NULL; dns_difftuple_t *tuple = NULL; @@ -1098,7 +1061,9 @@ dns_nsec3param_deletechains(dns_db_t *db, dns_dbversion_t *ver, dns_nsec3param_toprivate(&rdata, &private, privatetype, buf, sizeof(buf)); - buf[2] = DNS_NSEC3FLAG_REMOVE | DNS_NSEC3FLAG_NONSEC; + buf[2] = DNS_NSEC3FLAG_REMOVE; + if (nonsec) + buf[2] |= DNS_NSEC3FLAG_NONSEC; CHECK(rr_exists(db, ver, origin, &private, &flag)); @@ -1129,6 +1094,7 @@ dns_nsec3param_deletechains(dns_db_t *db, dns_dbversion_t *ver, for (result = dns_rdataset_first(&rdataset); result == ISC_R_SUCCESS; result = dns_rdataset_next(&rdataset)) { + dns_rdata_reset(&rdata); dns_rdataset_current(&rdataset, &rdata); INSIST(rdata.length <= sizeof(buf)); memcpy(buf, rdata.data, rdata.length); @@ -1138,10 +1104,9 @@ dns_nsec3param_deletechains(dns_db_t *db, dns_dbversion_t *ver, * <0(1), hash(1), flags(1), iterations(2), saltlen(1)> */ if (rdata.length < 6 || buf[0] != 0 || - buf[2] == (DNS_NSEC3FLAG_REMOVE | DNS_NSEC3FLAG_NONSEC)) { - dns_rdata_reset(&rdata); + (buf[2] & DNS_NSEC3FLAG_REMOVE) != 0 || + (nonsec && (buf[2] & DNS_NSEC3FLAG_NONSEC) != 0)) continue; - } CHECK(dns_difftuple_create(diff->mctx, DNS_DIFFOP_DEL, origin, 0, &rdata, &tuple)); @@ -1149,7 +1114,9 @@ dns_nsec3param_deletechains(dns_db_t *db, dns_dbversion_t *ver, INSIST(tuple == NULL); rdata.data = buf; - buf[2] = DNS_NSEC3FLAG_REMOVE | DNS_NSEC3FLAG_NONSEC; + buf[2] = DNS_NSEC3FLAG_REMOVE; + if (nonsec) + buf[2] |= DNS_NSEC3FLAG_NONSEC; CHECK(rr_exists(db, ver, origin, &rdata, &flag)); @@ -1159,7 +1126,6 @@ dns_nsec3param_deletechains(dns_db_t *db, dns_dbversion_t *ver, CHECK(do_one_tuple(&tuple, db, ver, diff)); INSIST(tuple == NULL); } - dns_rdata_reset(&rdata); } if (result != ISC_R_NOMORE) goto failure; diff --git a/lib/dns/openssldh_link.c b/lib/dns/openssldh_link.c index 9fe9bb5..36b8a41 100644 --- a/lib/dns/openssldh_link.c +++ b/lib/dns/openssldh_link.c @@ -634,6 +634,7 @@ static dst_func_t openssldh_functions = { NULL, /*%< adddata */ NULL, /*%< openssldh_sign */ NULL, /*%< openssldh_verify */ + NULL, /*%< openssldh_verify2 */ openssldh_computesecret, openssldh_compare, openssldh_paramcompare, diff --git a/lib/dns/openssldsa_link.c b/lib/dns/openssldsa_link.c index 66d47bb..8bea1c0 100644 --- a/lib/dns/openssldsa_link.c +++ b/lib/dns/openssldsa_link.c @@ -624,6 +624,7 @@ static dst_func_t openssldsa_functions = { openssldsa_adddata, openssldsa_sign, openssldsa_verify, + NULL, /*%< verify2 */ NULL, /*%< computesecret */ openssldsa_compare, NULL, /*%< paramcompare */ diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c index 1cf30f8..c3f5061 100644 --- a/lib/dns/opensslecdsa_link.c +++ b/lib/dns/opensslecdsa_link.c @@ -572,6 +572,7 @@ static dst_func_t opensslecdsa_functions = { opensslecdsa_adddata, opensslecdsa_sign, opensslecdsa_verify, + NULL, /*%< verify2 */ NULL, /*%< computesecret */ opensslecdsa_compare, NULL, /*%< paramcompare */ diff --git a/lib/dns/opensslgost_link.c b/lib/dns/opensslgost_link.c index 098e312..1ce4405 100644 --- a/lib/dns/opensslgost_link.c +++ b/lib/dns/opensslgost_link.c @@ -373,6 +373,7 @@ static dst_func_t opensslgost_functions = { opensslgost_adddata, opensslgost_sign, opensslgost_verify, + NULL, /*%< verify2 */ NULL, /*%< computesecret */ opensslgost_compare, NULL, /*%< paramcompare */ diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c index 2430f24..fa7412c 100644 --- a/lib/dns/opensslrsa_link.c +++ b/lib/dns/opensslrsa_link.c @@ -56,6 +56,13 @@ #endif /* + * Limit the size of public exponents. + */ +#ifndef RSA_MAX_PUBEXP_BITS +#define RSA_MAX_PUBEXP_BITS 35 +#endif + +/* * We don't use configure for windows so enforce the OpenSSL version * here. Unlike with configure we don't support overriding this test. */ @@ -503,12 +510,14 @@ opensslrsa_sign(dst_context_t *dctx, isc_buffer_t *sig) { } static isc_result_t -opensslrsa_verify(dst_context_t *dctx, const isc_region_t *sig) { +opensslrsa_verify2(dst_context_t *dctx, int maxbits, const isc_region_t *sig) { dst_key_t *key = dctx->key; int status = 0; #if USE_EVP EVP_MD_CTX *evp_md_ctx = dctx->ctxdata.evp_md_ctx; EVP_PKEY *pkey = key->keydata.pkey; + RSA *rsa; + int bits; #else /* note: ISC_SHA512_DIGESTLENGTH >= ISC_*_DIGESTLENGTH */ unsigned char digest[ISC_SHA512_DIGESTLENGTH]; @@ -528,6 +537,14 @@ opensslrsa_verify(dst_context_t *dctx, const isc_region_t *sig) { dctx->key->key_alg == DST_ALG_RSASHA512); #if USE_EVP + rsa = EVP_PKEY_get1_RSA(pkey); + if (rsa == NULL) + return (dst__openssl_toresult(DST_R_OPENSSLFAILURE)); + bits = BN_num_bits(rsa->e); + RSA_free(rsa); + if (bits > maxbits && maxbits != 0) + return (DST_R_VERIFYFAILURE); + status = EVP_VerifyFinal(evp_md_ctx, sig->base, sig->length, pkey); switch (status) { case 1: @@ -540,6 +557,9 @@ opensslrsa_verify(dst_context_t *dctx, const isc_region_t *sig) { DST_R_VERIFYFAILURE)); } #else + if (BN_num_bits(rsa->e) > maxbits && maxbits != 0) + return (DST_R_VERIFYFAILURE); + switch (dctx->key->key_alg) { case DST_ALG_RSAMD5: { @@ -652,6 +672,11 @@ opensslrsa_verify(dst_context_t *dctx, const isc_region_t *sig) { #endif } +static isc_result_t +opensslrsa_verify(dst_context_t *dctx, const isc_region_t *sig) { + return (opensslrsa_verify2(dctx, 0, sig)); +} + static isc_boolean_t opensslrsa_compare(const dst_key_t *key1, const dst_key_t *key2) { int status; @@ -764,7 +789,7 @@ opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) { BN_set_bit(e, 0); BN_set_bit(e, 16); } else { - /* F5 0x100000001 */ + /* (phased-out) F5 0x100000001 */ BN_set_bit(e, 0); BN_set_bit(e, 32); } @@ -1219,6 +1244,8 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); if (rsa_check(rsa, pubrsa) != ISC_R_SUCCESS) DST_RET(DST_R_INVALIDPRIVATEKEY); + if (BN_num_bits(rsa->e) > RSA_MAX_PUBEXP_BITS) + DST_RET(ISC_R_RANGE); if (pubrsa != NULL) RSA_free(pubrsa); key->key_size = EVP_PKEY_bits(pkey); @@ -1301,6 +1328,8 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { if (rsa_check(rsa, pubrsa) != ISC_R_SUCCESS) DST_RET(DST_R_INVALIDPRIVATEKEY); + if (BN_num_bits(rsa->e) > RSA_MAX_PUBEXP_BITS) + DST_RET(ISC_R_RANGE); key->key_size = BN_num_bits(rsa->n); if (pubrsa != NULL) RSA_free(pubrsa); @@ -1319,7 +1348,7 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { RSA_free(rsa); if (pubrsa != NULL) RSA_free(pubrsa); - opensslrsa_destroy(key); + key->keydata.generic = NULL; dst__privstruct_free(&priv, mctx); memset(&priv, 0, sizeof(priv)); return (ret); @@ -1374,6 +1403,8 @@ opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label, DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); if (rsa_check(rsa, pubrsa) != ISC_R_SUCCESS) DST_RET(DST_R_INVALIDPRIVATEKEY); + if (BN_num_bits(rsa->e) > RSA_MAX_PUBEXP_BITS) + DST_RET(ISC_R_RANGE); if (pubrsa != NULL) RSA_free(pubrsa); key->key_size = EVP_PKEY_bits(pkey); @@ -1409,6 +1440,7 @@ static dst_func_t opensslrsa_functions = { opensslrsa_adddata, opensslrsa_sign, opensslrsa_verify, + opensslrsa_verify2, NULL, /*%< computesecret */ opensslrsa_compare, NULL, /*%< paramcompare */ diff --git a/lib/dns/private.c b/lib/dns/private.c index b0cb96f..6521279 100644 --- a/lib/dns/private.c +++ b/lib/dns/private.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2009, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2009, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -44,6 +44,7 @@ #define REMOVE(x) (((x) & DNS_NSEC3FLAG_REMOVE) != 0) #define CREATE(x) (((x) & DNS_NSEC3FLAG_CREATE) != 0) +#define INITIAL(x) (((x) & DNS_NSEC3FLAG_INITIAL) != 0) #define NONSEC(x) (((x) & DNS_NSEC3FLAG_NONSEC) != 0) #define CHECK(x) do { \ @@ -149,7 +150,7 @@ dns_private_chains(dns_db_t *db, dns_dbversion_t *ver, } /* - * Look to see if we also need to be creating a NSEC3 chains. + * Look to see if we also need to be creating a NSEC3 chain. */ if (dns_rdataset_isassociated(&nsecset)) { if (build_nsec != NULL) @@ -293,3 +294,78 @@ dns_private_chains(dns_db_t *db, dns_dbversion_t *ver, dns_db_detachnode(db, &node); return (result); } + +isc_result_t +dns_private_totext(dns_rdata_t *private, isc_buffer_t *buf) { + isc_result_t result; + + if (private->length < 5) + return (ISC_R_NOTFOUND); + + if (private->data[0] == 0) { + unsigned char nsec3buf[DNS_NSEC3PARAM_BUFFERSIZE]; + unsigned char newbuf[DNS_NSEC3PARAM_BUFFERSIZE]; + dns_rdata_t rdata = DNS_RDATA_INIT; + dns_rdata_nsec3param_t nsec3param; + isc_boolean_t remove, init, nonsec; + isc_buffer_t b; + + if (!dns_nsec3param_fromprivate(private, &rdata, nsec3buf, + sizeof(nsec3buf))) + CHECK(ISC_R_FAILURE); + + CHECK(dns_rdata_tostruct(&rdata, &nsec3param, NULL)); + + remove = ISC_TF((nsec3param.flags & DNS_NSEC3FLAG_REMOVE) != 0); + init = ISC_TF((nsec3param.flags & DNS_NSEC3FLAG_INITIAL) != 0); + nonsec = ISC_TF((nsec3param.flags & DNS_NSEC3FLAG_NONSEC) != 0); + + nsec3param.flags &= ~(DNS_NSEC3FLAG_CREATE| + DNS_NSEC3FLAG_REMOVE| + DNS_NSEC3FLAG_INITIAL| + DNS_NSEC3FLAG_NONSEC); + + if (init) + isc_buffer_putstr(buf, "Pending NSEC3 chain "); + else if (remove) + isc_buffer_putstr(buf, "Removing NSEC3 chain "); + else + isc_buffer_putstr(buf, "Creating NSEC3 chain "); + + dns_rdata_reset(&rdata); + isc_buffer_init(&b, newbuf, sizeof(newbuf)); + CHECK(dns_rdata_fromstruct(&rdata, dns_rdataclass_in, + dns_rdatatype_nsec3param, + &nsec3param, &b)); + + CHECK(dns_rdata_totext(&rdata, NULL, buf)); + + if (remove && !nonsec) + isc_buffer_putstr(buf, " / creating NSEC chain"); + } else if (private->length == 5) { + unsigned char alg = private->data[0]; + dns_keytag_t keyid = (private->data[2] | private->data[1] << 8); + char keybuf[BUFSIZ], algbuf[DNS_SECALG_FORMATSIZE]; + isc_boolean_t remove = ISC_TF(private->data[3] != 0); + isc_boolean_t complete = ISC_TF(private->data[4] != 0); + + if (remove && complete) + isc_buffer_putstr(buf, "Done removing signatures for "); + else if (remove) + isc_buffer_putstr(buf, "Removing signatures for "); + else if (complete) + isc_buffer_putstr(buf, "Done signing with "); + else + isc_buffer_putstr(buf, "Signing with "); + + dns_secalg_format(alg, algbuf, sizeof(algbuf)); + sprintf(keybuf, "key %d/%s", keyid, algbuf); + isc_buffer_putstr(buf, keybuf); + } else + return (ISC_R_NOTFOUND); + + isc_buffer_putuint8(buf, 0); + result = ISC_R_SUCCESS; + failure: + return (result); +} diff --git a/lib/dns/rbt.c b/lib/dns/rbt.c index eb95d14..7381b4a 100644 --- a/lib/dns/rbt.c +++ b/lib/dns/rbt.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007-2009, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007-2009, 2011-2013 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -248,7 +248,8 @@ dns_rbt_create(isc_mem_t *mctx, void (*deleter)(void *, void *), if (rbt == NULL) return (ISC_R_NOMEMORY); - rbt->mctx = mctx; + rbt->mctx = NULL; + isc_mem_attach(mctx, &rbt->mctx); rbt->data_deleter = deleter; rbt->deleter_arg = deleter_arg; rbt->root = NULL; @@ -259,7 +260,7 @@ dns_rbt_create(isc_mem_t *mctx, void (*deleter)(void *, void *), #ifdef DNS_RBT_USEHASH result = inithash(rbt); if (result != ISC_R_SUCCESS) { - isc_mem_put(mctx, rbt, sizeof(*rbt)); + isc_mem_putanddetach(&rbt->mctx, rbt, sizeof(*rbt)); return (result); } #endif @@ -299,7 +300,7 @@ dns_rbt_destroy2(dns_rbt_t **rbtp, unsigned int quantum) { rbt->magic = 0; - isc_mem_put(rbt->mctx, rbt, sizeof(*rbt)); + isc_mem_putanddetach(&rbt->mctx, rbt, sizeof(*rbt)); *rbtp = NULL; return (ISC_R_SUCCESS); } diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c index f6f96ab..bff52b8 100644 --- a/lib/dns/rbtdb.c +++ b/lib/dns/rbtdb.c @@ -4553,7 +4553,8 @@ find_coveringnsec(rbtdb_search_t *search, dns_dbnode_t **nodep, */ #ifdef BIND9 static isc_result_t -rpz_enabled(dns_db_t *db, dns_rpz_st_t *st) { +rpz_enabled(dns_db_t *db, dns_rpz_st_t *st) +{ dns_rbtdb_t *rbtdb; isc_result_t result; @@ -7464,8 +7465,10 @@ static dns_dbmethods_t zone_methods = { rpz_findips, #else NULL, - NULL + NULL, #endif + NULL, + NULL }; static dns_dbmethods_t cache_methods = { @@ -7506,6 +7509,8 @@ static dns_dbmethods_t cache_methods = { isdnssec, getrrsetstats, NULL, + NULL, + NULL, NULL }; diff --git a/lib/dns/rdata.c b/lib/dns/rdata.c index 3865f42..a83dab4 100644 --- a/lib/dns/rdata.c +++ b/lib/dns/rdata.c @@ -15,6 +15,8 @@ * PERFORMANCE OF THIS SOFTWARE. */ +/* $Id$ */ + /*! \file */ #include <config.h> @@ -878,7 +880,8 @@ dns_rdata_totext(dns_rdata_t *rdata, dns_name_t *origin, isc_buffer_t *target) isc_result_t dns_rdata_tofmttext(dns_rdata_t *rdata, dns_name_t *origin, unsigned int flags, unsigned int width, - const char *linebreak, isc_buffer_t *target) + unsigned int split_width, const char *linebreak, + isc_buffer_t *target) { dns_rdata_textctx_t tctx; @@ -889,11 +892,16 @@ dns_rdata_tofmttext(dns_rdata_t *rdata, dns_name_t *origin, */ tctx.origin = origin; tctx.flags = flags; - if ((flags & DNS_STYLEFLAG_MULTILINE) != 0) { + if (split_width == 0xffffffff) tctx.width = width; + else + tctx.width = split_width; + + if ((flags & DNS_STYLEFLAG_MULTILINE) != 0) tctx.linebreak = linebreak; - } else { - tctx.width = 60; /* Used for hex word length only. */ + else { + if (split_width == 0xffffffff) + tctx.width = 60; /* Used for hex word length only. */ tctx.linebreak = " "; } return (rdata_totext(rdata, &tctx, target)); @@ -1409,7 +1417,8 @@ multitxt_fromwire(isc_buffer_t *source, isc_buffer_t *target) { if (n > tregion.length) return (ISC_R_NOSPACE); - memcpy(tregion.base, sregion.base, n); + if (tregion.base != sregion.base) + memcpy(tregion.base, sregion.base, n); isc_buffer_forward(source, n); isc_buffer_add(target, n); isc_buffer_activeregion(source, &sregion); diff --git a/lib/dns/rdata/any_255/tsig_250.c b/lib/dns/rdata/any_255/tsig_250.c index 0046ed0..3f91f91 100644 --- a/lib/dns/rdata/any_255/tsig_250.c +++ b/lib/dns/rdata/any_255/tsig_250.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007, 2009, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2009, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -202,8 +202,11 @@ totext_any_tsig(ARGS_TOTEXT) { if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) RETERR(str_totext(" (", target)); RETERR(str_totext(tctx->linebreak, target)); - RETERR(isc_base64_totext(&sigr, tctx->width - 2, - tctx->linebreak, target)); + if (tctx->width == 0) /* No splitting */ + RETERR(isc_base64_totext(&sigr, 60, "", target)); + else + RETERR(isc_base64_totext(&sigr, tctx->width - 2, + tctx->linebreak, target)); if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) RETERR(str_totext(" ) ", target)); else @@ -236,7 +239,10 @@ totext_any_tsig(ARGS_TOTEXT) { /* * Other. */ - return (isc_base64_totext(&sr, 60, " ", target)); + if (tctx->width == 0) /* No splitting */ + return (isc_base64_totext(&sr, 60, "", target)); + else + return (isc_base64_totext(&sr, 60, " ", target)); } static inline isc_result_t diff --git a/lib/dns/rdata/generic/cert_37.c b/lib/dns/rdata/generic/cert_37.c index 2a447a6..a03290a 100644 --- a/lib/dns/rdata/generic/cert_37.c +++ b/lib/dns/rdata/generic/cert_37.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007, 2009, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2009, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -109,8 +109,11 @@ totext_cert(ARGS_TOTEXT) { if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) RETERR(str_totext(" (", target)); RETERR(str_totext(tctx->linebreak, target)); - RETERR(isc_base64_totext(&sr, tctx->width - 2, - tctx->linebreak, target)); + if (tctx->width == 0) /* No splitting */ + RETERR(isc_base64_totext(&sr, 60, "", target)); + else + RETERR(isc_base64_totext(&sr, tctx->width - 2, + tctx->linebreak, target)); if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) RETERR(str_totext(" )", target)); return (ISC_R_SUCCESS); diff --git a/lib/dns/rdata/generic/dlv_32769.c b/lib/dns/rdata/generic/dlv_32769.c index 97f37f7..5751ad8 100644 --- a/lib/dns/rdata/generic/dlv_32769.c +++ b/lib/dns/rdata/generic/dlv_32769.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2006, 2007, 2009, 2010, 2012, 2013 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2006, 2007, 2009-2013 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -137,7 +137,11 @@ totext_dlv(ARGS_TOTEXT) { if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) RETERR(str_totext(" (", target)); RETERR(str_totext(tctx->linebreak, target)); - RETERR(isc_hex_totext(&sr, tctx->width - 2, tctx->linebreak, target)); + if (tctx->width == 0) /* No splitting */ + RETERR(isc_hex_totext(&sr, 0, "", target)); + else + RETERR(isc_hex_totext(&sr, tctx->width - 2, + tctx->linebreak, target)); if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) RETERR(str_totext(" )", target)); return (ISC_R_SUCCESS); diff --git a/lib/dns/rdata/generic/dnskey_48.c b/lib/dns/rdata/generic/dnskey_48.c index b7eeb34..688e7ac 100644 --- a/lib/dns/rdata/generic/dnskey_48.c +++ b/lib/dns/rdata/generic/dnskey_48.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007, 2009, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2009, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -76,7 +76,8 @@ totext_dnskey(ARGS_TOTEXT) { char buf[sizeof("64000")]; unsigned int flags; unsigned char algorithm; - char namebuf[DNS_NAME_FORMATSIZE]; + char algbuf[DNS_NAME_FORMATSIZE]; + const char *keyinfo; REQUIRE(rdata->type == 48); REQUIRE(rdata->length != 0); @@ -89,6 +90,13 @@ totext_dnskey(ARGS_TOTEXT) { sprintf(buf, "%u", flags); RETERR(str_totext(buf, target)); RETERR(str_totext(" ", target)); + if ((flags & DNS_KEYFLAG_KSK) != 0) { + if (flags & DNS_KEYFLAG_REVOKE) + keyinfo = "revoked KSK"; + else + keyinfo = "KSK"; + } else + keyinfo = "ZSK"; /* protocol */ sprintf(buf, "%u", sr.base[0]); @@ -106,23 +114,28 @@ totext_dnskey(ARGS_TOTEXT) { if ((flags & 0xc000) == 0xc000) return (ISC_R_SUCCESS); - if ((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0 && + if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0 && algorithm == DNS_KEYALG_PRIVATEDNS) { dns_name_t name; dns_name_init(&name, NULL); dns_name_fromregion(&name, &sr); - dns_name_format(&name, namebuf, sizeof(namebuf)); - } else - namebuf[0] = 0; + dns_name_format(&name, algbuf, sizeof(algbuf)); + } else { + dns_secalg_format((dns_secalg_t) algorithm, algbuf, + sizeof(algbuf)); + } /* key */ if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) RETERR(str_totext(" (", target)); RETERR(str_totext(tctx->linebreak, target)); - RETERR(isc_base64_totext(&sr, tctx->width - 2, - tctx->linebreak, target)); + if (tctx->width == 0) /* No splitting */ + RETERR(isc_base64_totext(&sr, 0, "", target)); + else + RETERR(isc_base64_totext(&sr, tctx->width - 2, + tctx->linebreak, target)); - if ((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0) + if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0) RETERR(str_totext(tctx->linebreak, target)); else if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) RETERR(str_totext(" ", target)); @@ -130,18 +143,17 @@ totext_dnskey(ARGS_TOTEXT) { if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) RETERR(str_totext(")", target)); - if ((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0) { + if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0) { isc_region_t tmpr; - RETERR(str_totext(" ; key id = ", target)); + RETERR(str_totext(" ; ", target)); + RETERR(str_totext(keyinfo, target)); + RETERR(str_totext("; alg = ", target)); + RETERR(str_totext(algbuf, target)); + RETERR(str_totext("; key id = ", target)); dns_rdata_toregion(rdata, &tmpr); sprintf(buf, "%u", dst_region_computeid(&tmpr, algorithm)); RETERR(str_totext(buf, target)); - if (algorithm == DNS_KEYALG_PRIVATEDNS) { - RETERR(str_totext(tctx->linebreak, target)); - RETERR(str_totext("; alg = ", target)); - RETERR(str_totext(namebuf, target)); - } } return (ISC_R_SUCCESS); } diff --git a/lib/dns/rdata/generic/ds_43.c b/lib/dns/rdata/generic/ds_43.c index 20bac85..dd47c8d 100644 --- a/lib/dns/rdata/generic/ds_43.c +++ b/lib/dns/rdata/generic/ds_43.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007, 2009, 2010, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2009-2012 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -137,7 +137,11 @@ totext_ds(ARGS_TOTEXT) { if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) RETERR(str_totext(" (", target)); RETERR(str_totext(tctx->linebreak, target)); - RETERR(isc_hex_totext(&sr, tctx->width - 2, tctx->linebreak, target)); + if (tctx->width == 0) /* No splitting */ + RETERR(isc_hex_totext(&sr, 0, "", target)); + else + RETERR(isc_hex_totext(&sr, tctx->width - 2, + tctx->linebreak, target)); if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) RETERR(str_totext(" )", target)); return (ISC_R_SUCCESS); diff --git a/lib/dns/rdata/generic/ipseckey_45.c b/lib/dns/rdata/generic/ipseckey_45.c index 7e65e65..1d2508c 100644 --- a/lib/dns/rdata/generic/ipseckey_45.c +++ b/lib/dns/rdata/generic/ipseckey_45.c @@ -190,8 +190,11 @@ totext_ipseckey(ARGS_TOTEXT) { */ if (region.length > 0U) { RETERR(str_totext(tctx->linebreak, target)); - RETERR(isc_base64_totext(®ion, tctx->width - 2, - tctx->linebreak, target)); + if (tctx->width == 0) /* No splitting */ + RETERR(isc_base64_totext(®ion, 60, "", target)); + else + RETERR(isc_base64_totext(®ion, tctx->width - 2, + tctx->linebreak, target)); } if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) diff --git a/lib/dns/rdata/generic/key_25.c b/lib/dns/rdata/generic/key_25.c index 26ca9a9..1d0ba83 100644 --- a/lib/dns/rdata/generic/key_25.c +++ b/lib/dns/rdata/generic/key_25.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007, 2009, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2009, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -106,7 +106,7 @@ totext_key(ARGS_TOTEXT) { if ((flags & 0xc000) == 0xc000) return (ISC_R_SUCCESS); - if ((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0 && + if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0 && algorithm == DNS_KEYALG_PRIVATEDNS) { dns_name_t name; dns_name_init(&name, NULL); @@ -119,10 +119,13 @@ totext_key(ARGS_TOTEXT) { if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) RETERR(str_totext(" (", target)); RETERR(str_totext(tctx->linebreak, target)); - RETERR(isc_base64_totext(&sr, tctx->width - 2, - tctx->linebreak, target)); + if (tctx->width == 0) /* No splitting */ + RETERR(isc_base64_totext(&sr, 60, "", target)); + else + RETERR(isc_base64_totext(&sr, tctx->width - 2, + tctx->linebreak, target)); - if ((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0) + if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0) RETERR(str_totext(tctx->linebreak, target)); else if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) RETERR(str_totext(" ", target)); @@ -130,7 +133,7 @@ totext_key(ARGS_TOTEXT) { if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) RETERR(str_totext(")", target)); - if ((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0) { + if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0) { isc_region_t tmpr; RETERR(str_totext(" ; key id = ", target)); diff --git a/lib/dns/rdata/generic/keydata_65533.c b/lib/dns/rdata/generic/keydata_65533.c index 317e1a8..a2d83f4 100644 --- a/lib/dns/rdata/generic/keydata_65533.c +++ b/lib/dns/rdata/generic/keydata_65533.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2009, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2009, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -89,6 +89,8 @@ totext_keydata(ARGS_TOTEXT) { unsigned int flags; unsigned char algorithm; unsigned long when; + char algbuf[DNS_NAME_FORMATSIZE]; + const char *keyinfo; REQUIRE(rdata->type == 65533); REQUIRE(rdata->length != 0); @@ -119,6 +121,13 @@ totext_keydata(ARGS_TOTEXT) { sprintf(buf, "%u", flags); RETERR(str_totext(buf, target)); RETERR(str_totext(" ", target)); + if ((flags & DNS_KEYFLAG_KSK) != 0) { + if (flags & DNS_KEYFLAG_REVOKE) + keyinfo = "revoked KSK"; + else + keyinfo = "KSK"; + } else + keyinfo = "ZSK"; /* protocol */ sprintf(buf, "%u", sr.base[0]); @@ -140,10 +149,13 @@ totext_keydata(ARGS_TOTEXT) { if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) RETERR(str_totext(" (", target)); RETERR(str_totext(tctx->linebreak, target)); - RETERR(isc_base64_totext(&sr, tctx->width - 2, - tctx->linebreak, target)); + if (tctx->width == 0) /* No splitting */ + RETERR(isc_base64_totext(&sr, 60, "", target)); + else + RETERR(isc_base64_totext(&sr, tctx->width - 2, + tctx->linebreak, target)); - if ((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0) + if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0) RETERR(str_totext(tctx->linebreak, target)); else if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) RETERR(str_totext(" ", target)); @@ -151,10 +163,16 @@ totext_keydata(ARGS_TOTEXT) { if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) RETERR(str_totext(")", target)); - if ((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0) { + if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0) { isc_region_t tmpr; - RETERR(str_totext(" ; key id = ", target)); + RETERR(str_totext(" ; ", target)); + RETERR(str_totext(keyinfo, target)); + dns_secalg_format((dns_secalg_t) algorithm, algbuf, + sizeof(algbuf)); + RETERR(str_totext("; alg = ", target)); + RETERR(str_totext(algbuf, target)); + RETERR(str_totext("; key id = ", target)); dns_rdata_toregion(rdata, &tmpr); /* Skip over refresh, addhd, and removehd */ isc_region_consume(&tmpr, 12); diff --git a/lib/dns/rdata/in_1/naptr_35.c b/lib/dns/rdata/generic/naptr_35.c index e5df80b..83439a5 100644 --- a/lib/dns/rdata/in_1/naptr_35.c +++ b/lib/dns/rdata/generic/naptr_35.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007-2009, 2012, 2013 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007-2009, 2011-2013 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2001, 2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -21,8 +21,8 @@ /* RFC2915 */ -#ifndef RDATA_IN_1_NAPTR_35_C -#define RDATA_IN_1_NAPTR_35_C +#ifndef RDATA_GENERIC_NAPTR_35_C +#define RDATA_GENERIC_NAPTR_35_C #define RRTYPE_NAPTR_ATTRIBUTES (0) @@ -121,14 +121,13 @@ txt_valid_regex(const unsigned char *txt) { } static inline isc_result_t -fromtext_in_naptr(ARGS_FROMTEXT) { +fromtext_naptr(ARGS_FROMTEXT) { isc_token_t token; dns_name_t name; isc_buffer_t buffer; unsigned char *regex; REQUIRE(type == 35); - REQUIRE(rdclass == 1); UNUSED(type); UNUSED(rdclass); @@ -188,7 +187,7 @@ fromtext_in_naptr(ARGS_FROMTEXT) { } static inline isc_result_t -totext_in_naptr(ARGS_TOTEXT) { +totext_naptr(ARGS_TOTEXT) { isc_region_t region; dns_name_t name; dns_name_t prefix; @@ -197,7 +196,6 @@ totext_in_naptr(ARGS_TOTEXT) { unsigned short num; REQUIRE(rdata->type == 35); - REQUIRE(rdata->rdclass == 1); REQUIRE(rdata->length != 0); dns_name_init(&name, NULL); @@ -250,13 +248,12 @@ totext_in_naptr(ARGS_TOTEXT) { } static inline isc_result_t -fromwire_in_naptr(ARGS_FROMWIRE) { +fromwire_naptr(ARGS_FROMWIRE) { dns_name_t name; isc_region_t sr; unsigned char *regex; REQUIRE(type == 35); - REQUIRE(rdclass == 1); UNUSED(type); UNUSED(rdclass); @@ -298,13 +295,12 @@ fromwire_in_naptr(ARGS_FROMWIRE) { } static inline isc_result_t -towire_in_naptr(ARGS_TOWIRE) { +towire_naptr(ARGS_TOWIRE) { dns_name_t name; dns_offsets_t offsets; isc_region_t sr; REQUIRE(rdata->type == 35); - REQUIRE(rdata->rdclass == 1); REQUIRE(rdata->length != 0); dns_compress_setmethods(cctx, DNS_COMPRESS_NONE); @@ -342,7 +338,7 @@ towire_in_naptr(ARGS_TOWIRE) { } static inline int -compare_in_naptr(ARGS_COMPARE) { +compare_naptr(ARGS_COMPARE) { dns_name_t name1; dns_name_t name2; isc_region_t region1; @@ -352,7 +348,6 @@ compare_in_naptr(ARGS_COMPARE) { REQUIRE(rdata1->type == rdata2->type); REQUIRE(rdata1->rdclass == rdata2->rdclass); REQUIRE(rdata1->type == 35); - REQUIRE(rdata1->rdclass == 1); REQUIRE(rdata1->length != 0); REQUIRE(rdata2->length != 0); @@ -411,12 +406,11 @@ compare_in_naptr(ARGS_COMPARE) { } static inline isc_result_t -fromstruct_in_naptr(ARGS_FROMSTRUCT) { - dns_rdata_in_naptr_t *naptr = source; +fromstruct_naptr(ARGS_FROMSTRUCT) { + dns_rdata_naptr_t *naptr = source; isc_region_t region; REQUIRE(type == 35); - REQUIRE(rdclass == 1); REQUIRE(source != NULL); REQUIRE(naptr->common.rdtype == type); REQUIRE(naptr->common.rdclass == rdclass); @@ -440,14 +434,13 @@ fromstruct_in_naptr(ARGS_FROMSTRUCT) { } static inline isc_result_t -tostruct_in_naptr(ARGS_TOSTRUCT) { - dns_rdata_in_naptr_t *naptr = target; +tostruct_naptr(ARGS_TOSTRUCT) { + dns_rdata_naptr_t *naptr = target; isc_region_t r; isc_result_t result; dns_name_t name; REQUIRE(rdata->type == 35); - REQUIRE(rdata->rdclass == 1); REQUIRE(target != NULL); REQUIRE(rdata->length != 0); @@ -511,11 +504,10 @@ tostruct_in_naptr(ARGS_TOSTRUCT) { } static inline void -freestruct_in_naptr(ARGS_FREESTRUCT) { - dns_rdata_in_naptr_t *naptr = source; +freestruct_naptr(ARGS_FREESTRUCT) { + dns_rdata_naptr_t *naptr = source; REQUIRE(source != NULL); - REQUIRE(naptr->common.rdclass == 1); REQUIRE(naptr->common.rdtype == 35); if (naptr->mctx == NULL) @@ -532,7 +524,7 @@ freestruct_in_naptr(ARGS_FREESTRUCT) { } static inline isc_result_t -additionaldata_in_naptr(ARGS_ADDLDATA) { +additionaldata_naptr(ARGS_ADDLDATA) { dns_name_t name; dns_offsets_t offsets; isc_region_t sr; @@ -541,7 +533,6 @@ additionaldata_in_naptr(ARGS_ADDLDATA) { char *cp; REQUIRE(rdata->type == 35); - REQUIRE(rdata->rdclass == 1); /* * Order, preference. @@ -590,14 +581,13 @@ additionaldata_in_naptr(ARGS_ADDLDATA) { } static inline isc_result_t -digest_in_naptr(ARGS_DIGEST) { +digest_naptr(ARGS_DIGEST) { isc_region_t r1, r2; unsigned int length, n; isc_result_t result; dns_name_t name; REQUIRE(rdata->type == 35); - REQUIRE(rdata->rdclass == 1); dns_rdata_toregion(rdata, &r1); r2 = r1; @@ -649,10 +639,9 @@ digest_in_naptr(ARGS_DIGEST) { } static inline isc_boolean_t -checkowner_in_naptr(ARGS_CHECKOWNER) { +checkowner_naptr(ARGS_CHECKOWNER) { REQUIRE(type == 35); - REQUIRE(rdclass == 1); UNUSED(name); UNUSED(type); @@ -663,10 +652,9 @@ checkowner_in_naptr(ARGS_CHECKOWNER) { } static inline isc_boolean_t -checknames_in_naptr(ARGS_CHECKNAMES) { +checknames_naptr(ARGS_CHECKNAMES) { REQUIRE(rdata->type == 35); - REQUIRE(rdata->rdclass == 1); UNUSED(rdata); UNUSED(owner); @@ -676,8 +664,8 @@ checknames_in_naptr(ARGS_CHECKNAMES) { } static inline int -casecompare_in_naptr(ARGS_COMPARE) { - return (compare_in_naptr(rdata1, rdata2)); +casecompare_naptr(ARGS_COMPARE) { + return (compare_naptr(rdata1, rdata2)); } -#endif /* RDATA_IN_1_NAPTR_35_C */ +#endif /* RDATA_GENERIC_NAPTR_35_C */ diff --git a/lib/dns/rdata/in_1/naptr_35.h b/lib/dns/rdata/generic/naptr_35.h index 04e8d69..f88c523 100644 --- a/lib/dns/rdata/in_1/naptr_35.h +++ b/lib/dns/rdata/generic/naptr_35.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2001 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,15 +15,15 @@ * PERFORMANCE OF THIS SOFTWARE. */ -#ifndef IN_1_NAPTR_35_H -#define IN_1_NAPTR_35_H 1 +#ifndef GENERIC_NAPTR_35_H +#define GENERIC_NAPTR_35_H 1 /* $Id$ */ /*! * \brief Per RFC2915 */ -typedef struct dns_rdata_in_naptr { +typedef struct dns_rdata_naptr { dns_rdatacommon_t common; isc_mem_t *mctx; isc_uint16_t order; @@ -35,6 +35,6 @@ typedef struct dns_rdata_in_naptr { char *regexp; isc_uint8_t regexp_len; dns_name_t replacement; -} dns_rdata_in_naptr_t; +} dns_rdata_naptr_t; -#endif /* IN_1_NAPTR_35_H */ +#endif /* GENERIC_NAPTR_35_H */ diff --git a/lib/dns/rdata/generic/nsec3_50.c b/lib/dns/rdata/generic/nsec3_50.c index 96b2dc8..19b94ef 100644 --- a/lib/dns/rdata/generic/nsec3_50.c +++ b/lib/dns/rdata/generic/nsec3_50.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2008, 2009, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2008, 2009, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -142,32 +142,32 @@ totext_nsec3(ARGS_TOTEXT) { unsigned char flags; char buf[sizeof("65535 ")]; isc_uint32_t iterations; + isc_boolean_t first; REQUIRE(rdata->type == 50); REQUIRE(rdata->length != 0); - UNUSED(tctx); - dns_rdata_toregion(rdata, &sr); + /* Hash */ hash = uint8_fromregion(&sr); isc_region_consume(&sr, 1); - - flags = uint8_fromregion(&sr); - isc_region_consume(&sr, 1); - - iterations = uint16_fromregion(&sr); - isc_region_consume(&sr, 2); - sprintf(buf, "%u ", hash); RETERR(str_totext(buf, target)); + /* Flags */ + flags = uint8_fromregion(&sr); + isc_region_consume(&sr, 1); sprintf(buf, "%u ", flags); RETERR(str_totext(buf, target)); + /* Iterations */ + iterations = uint16_fromregion(&sr); + isc_region_consume(&sr, 2); sprintf(buf, "%u ", iterations); RETERR(str_totext(buf, target)); + /* Salt */ j = uint8_fromregion(&sr); isc_region_consume(&sr, 1); INSIST(j <= sr.length); @@ -177,10 +177,14 @@ totext_nsec3(ARGS_TOTEXT) { sr.length = j; RETERR(isc_hex_totext(&sr, 1, "", target)); sr.length = i - j; - RETERR(str_totext(" ", target)); } else - RETERR(str_totext("- ", target)); + RETERR(str_totext("-", target)); + if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) + RETERR(str_totext(" (", target)); + RETERR(str_totext(tctx->linebreak, target)); + + /* Next hash */ j = uint8_fromregion(&sr); isc_region_consume(&sr, 1); INSIST(j <= sr.length); @@ -190,7 +194,16 @@ totext_nsec3(ARGS_TOTEXT) { RETERR(isc_base32hex_totext(&sr, 1, "", target)); sr.length = i - j; + if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) == 0) + RETERR(str_totext(" ", target)); + + /* Types covered */ + first = ISC_TRUE; for (i = 0; i < sr.length; i += len) { + if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) { + RETERR(str_totext(tctx->linebreak, target)); + first = ISC_TRUE; + } INSIST(i + 2 <= sr.length); window = sr.base[i]; len = sr.base[i + 1]; @@ -205,7 +218,9 @@ totext_nsec3(ARGS_TOTEXT) { if ((sr.base[i + j] & (0x80 >> k)) == 0) continue; t = window * 256 + j * 8 + k; - RETERR(str_totext(" ", target)); + if (!first) + RETERR(str_totext(" ", target)); + first = ISC_FALSE; if (dns_rdatatype_isknown(t)) { RETERR(dns_rdatatype_totext(t, target)); } else { @@ -216,6 +231,10 @@ totext_nsec3(ARGS_TOTEXT) { } } } + + if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) + RETERR(str_totext(" )", target)); + return (ISC_R_SUCCESS); } diff --git a/lib/dns/rdata/generic/nsec3_50.h b/lib/dns/rdata/generic/nsec3_50.h index 69a1141..5f2afb8 100644 --- a/lib/dns/rdata/generic/nsec3_50.h +++ b/lib/dns/rdata/generic/nsec3_50.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2008, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2008, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -46,7 +46,16 @@ typedef struct dns_rdata_nsec3 { #define DNS_NSEC3FLAG_OPTOUT 0x01U /*% - * Non-standard, NSEC3PARAM only. + * The following flags are used in the private-type record (implemented in + * lib/dns/private.c) which is used to store NSEC3PARAM data during the + * time when it is not legal to have an actual NSEC3PARAM record in the + * zone. They are defined here because the private-type record uses the + * same flags field for the OPTOUT flag above and for the private flags + * below. XXX: This should be considered for refactoring. + */ + +/*% + * Non-standard, private type only. * * Create a corresponding NSEC3 chain. * Once the NSEC3 chain is complete this flag will be removed to signal @@ -55,13 +64,14 @@ typedef struct dns_rdata_nsec3 { * This flag is automatically set when a NSEC3PARAM record is added to * the zone via UPDATE. * - * NSEC3PARAM records with this flag set are supposed to be ignored by - * RFC 5155 compliant nameservers. + * NSEC3PARAM records containing this flag should never be published, + * but if they are, they should be ignored by RFC 5155 compliant + * nameservers. */ #define DNS_NSEC3FLAG_CREATE 0x80U /*% - * Non-standard, NSEC3PARAM only. + * Non-standard, private type only. * * The corresponding NSEC3 set is to be removed once the NSEC chain * has been generated. @@ -69,24 +79,39 @@ typedef struct dns_rdata_nsec3 { * This flag is automatically set when the last active NSEC3PARAM record * is removed from the zone via UPDATE. * - * NSEC3PARAM records with this flag set are supposed to be ignored by - * RFC 5155 compliant nameservers. + * NSEC3PARAM records containing this flag should never be published, + * but if they are, they should be ignored by RFC 5155 compliant + * nameservers. */ #define DNS_NSEC3FLAG_REMOVE 0x40U /*% - * Non-standard, NSEC3PARAM only. + * Non-standard, private type only. * - * Used to identify NSEC3PARAM records added in this UPDATE request. + * When set with the CREATE flag, a corresponding NSEC3 chain will be + * created when the zone becomes capable of supporting one (i.e., when it + * has a DNSKEY RRset containing at least one NSEC3-capable algorithm). + * Without this flag, NSEC3 chain creation would be attempted immediately, + * fail, and the private type record would be removed. With it, the NSEC3 + * parameters are stored until they can be used. When the zone has the + * necessary prerequisites for NSEC3, then the INITIAL flag can be cleared, + * and the record will be cleaned up normally. + * + * NSEC3PARAM records containing this flag should never be published, but + * if they are, they should be ignored by RFC 5155 compliant nameservers. */ -#define DNS_NSEC3FLAG_UPDATE 0x20U +#define DNS_NSEC3FLAG_INITIAL 0x20U /*% - * Non-standard, NSEC3PARAM only. + * Non-standard, private type only. * * Prevent the creation of a NSEC chain before the last NSEC3 chain * is removed. This will normally only be set when the zone is * transitioning from secure with NSEC3 chains to insecure. + * + * NSEC3PARAM records containing this flag should never be published, + * but if they are, they should be ignored by RFC 5155 compliant + * nameservers. */ #define DNS_NSEC3FLAG_NONSEC 0x10U diff --git a/lib/dns/rdata/generic/opt_41.c b/lib/dns/rdata/generic/opt_41.c index fa349f1..4b51804 100644 --- a/lib/dns/rdata/generic/opt_41.c +++ b/lib/dns/rdata/generic/opt_41.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007, 2009, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2009, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1998-2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -76,8 +76,12 @@ totext_opt(ARGS_TOTEXT) { RETERR(str_totext(tctx->linebreak, target)); or = r; or.length = length; - RETERR(isc_base64_totext(&or, tctx->width - 2, - tctx->linebreak, target)); + if (tctx->width == 0) /* No splitting */ + RETERR(isc_base64_totext(&or, 60, "", target)); + else + RETERR(isc_base64_totext(&or, tctx->width - 2, + tctx->linebreak, + target)); isc_region_consume(&r, length); if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) RETERR(str_totext(" )", target)); diff --git a/lib/dns/rdata/generic/rrsig_46.c b/lib/dns/rdata/generic/rrsig_46.c index 82dfce6..58a327c 100644 --- a/lib/dns/rdata/generic/rrsig_46.c +++ b/lib/dns/rdata/generic/rrsig_46.c @@ -181,7 +181,10 @@ totext_rrsig(ARGS_TOTEXT) { isc_region_consume(&sr, 4); sprintf(buf, "%lu", ttl); RETERR(str_totext(buf, target)); - RETERR(str_totext(" ", target)); + + if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) + RETERR(str_totext(" (", target)); + RETERR(str_totext(tctx->linebreak, target)); /* * Sig exp. @@ -189,10 +192,7 @@ totext_rrsig(ARGS_TOTEXT) { exp = uint32_fromregion(&sr); isc_region_consume(&sr, 4); RETERR(dns_time32_totext(exp, target)); - - if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) - RETERR(str_totext(" (", target)); - RETERR(str_totext(tctx->linebreak, target)); + RETERR(str_totext(" ", target)); /* * Time signed. @@ -223,8 +223,11 @@ totext_rrsig(ARGS_TOTEXT) { * Sig. */ RETERR(str_totext(tctx->linebreak, target)); - RETERR(isc_base64_totext(&sr, tctx->width - 2, - tctx->linebreak, target)); + if (tctx->width == 0) /* No splitting */ + RETERR(isc_base64_totext(&sr, 60, "", target)); + else + RETERR(isc_base64_totext(&sr, tctx->width - 2, + tctx->linebreak, target)); if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) RETERR(str_totext(" )", target)); diff --git a/lib/dns/rdata/generic/sig_24.c b/lib/dns/rdata/generic/sig_24.c index 3cdd17a..803a864 100644 --- a/lib/dns/rdata/generic/sig_24.c +++ b/lib/dns/rdata/generic/sig_24.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007, 2009, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2009, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -227,8 +227,11 @@ totext_sig(ARGS_TOTEXT) { * Sig. */ RETERR(str_totext(tctx->linebreak, target)); - RETERR(isc_base64_totext(&sr, tctx->width - 2, - tctx->linebreak, target)); + if (tctx->width == 0) /* No splitting */ + RETERR(isc_base64_totext(&sr, 60, "", target)); + else + RETERR(isc_base64_totext(&sr, tctx->width - 2, + tctx->linebreak, target)); if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) RETERR(str_totext(" )", target)); diff --git a/lib/dns/rdata/generic/soa_6.c b/lib/dns/rdata/generic/soa_6.c index a867610..ac0a38f 100644 --- a/lib/dns/rdata/generic/soa_6.c +++ b/lib/dns/rdata/generic/soa_6.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2007, 2009, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007, 2009, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1998-2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -102,7 +102,7 @@ totext_soa(ARGS_TOTEXT) { multiline = ISC_TF((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0); if (multiline) - comment = ISC_TF((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0); + comment = ISC_TF((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0); else comment = ISC_FALSE; diff --git a/lib/dns/rdata/generic/sshfp_44.c b/lib/dns/rdata/generic/sshfp_44.c index 03d5127..d553cd4 100644 --- a/lib/dns/rdata/generic/sshfp_44.c +++ b/lib/dns/rdata/generic/sshfp_44.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2006, 2007, 2009, 2012, 2013 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2006, 2007, 2009, 2011-2013 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -95,7 +95,11 @@ totext_sshfp(ARGS_TOTEXT) { if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) RETERR(str_totext(" (", target)); RETERR(str_totext(tctx->linebreak, target)); - RETERR(isc_hex_totext(&sr, tctx->width - 2, tctx->linebreak, target)); + if (tctx->width == 0) /* No splitting */ + RETERR(isc_hex_totext(&sr, 0, "", target)); + else + RETERR(isc_hex_totext(&sr, tctx->width - 2, + tctx->linebreak, target)); if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) RETERR(str_totext(" )", target)); return (ISC_R_SUCCESS); diff --git a/lib/dns/rdata/generic/tkey_249.c b/lib/dns/rdata/generic/tkey_249.c index 3afee13..6f1ec02 100644 --- a/lib/dns/rdata/generic/tkey_249.c +++ b/lib/dns/rdata/generic/tkey_249.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2007, 2009, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007, 2009, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -201,8 +201,11 @@ totext_tkey(ARGS_TOTEXT) { if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) RETERR(str_totext(" (", target)); RETERR(str_totext(tctx->linebreak, target)); - RETERR(isc_base64_totext(&dr, tctx->width - 2, - tctx->linebreak, target)); + if (tctx->width == 0) /* No splitting */ + RETERR(isc_base64_totext(&dr, 60, "", target)); + else + RETERR(isc_base64_totext(&dr, tctx->width - 2, + tctx->linebreak, target)); if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) RETERR(str_totext(" ) ", target)); else @@ -227,8 +230,11 @@ totext_tkey(ARGS_TOTEXT) { if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) RETERR(str_totext(" (", target)); RETERR(str_totext(tctx->linebreak, target)); - RETERR(isc_base64_totext(&dr, tctx->width - 2, - tctx->linebreak, target)); + if (tctx->width == 0) /* No splitting */ + RETERR(isc_base64_totext(&dr, 60, "", target)); + else + RETERR(isc_base64_totext(&dr, tctx->width - 2, + tctx->linebreak, target)); if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) RETERR(str_totext(" )", target)); } diff --git a/lib/dns/rdata/generic/uri_256.c b/lib/dns/rdata/generic/uri_256.c index aa5b194..799eb69 100644 --- a/lib/dns/rdata/generic/uri_256.c +++ b/lib/dns/rdata/generic/uri_256.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2011-2013 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2011, 2012 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -14,7 +14,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: uri_256.c,v 1.2 2011/03/03 14:10:27 fdupont Exp $ */ +/* $Id$ */ #ifndef GENERIC_URI_256_C #define GENERIC_URI_256_C 1 diff --git a/lib/dns/rdata/generic/uri_256.h b/lib/dns/rdata/generic/uri_256.h index 5061c03..13c8fd2 100644 --- a/lib/dns/rdata/generic/uri_256.h +++ b/lib/dns/rdata/generic/uri_256.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2011-2013 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2011, 2012 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -17,7 +17,7 @@ #ifndef GENERIC_URI_256_H #define GENERIC_URI_256_H 1 -/* $Id: uri_256.h,v 1.2 2011/03/03 14:10:27 fdupont Exp $ */ +/* $Id$ */ typedef struct dns_rdata_uri { dns_rdatacommon_t common; diff --git a/lib/dns/rdata/in_1/dhcid_49.c b/lib/dns/rdata/in_1/dhcid_49.c index 1ec75ec..7575da0 100644 --- a/lib/dns/rdata/in_1/dhcid_49.c +++ b/lib/dns/rdata/in_1/dhcid_49.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2006, 2007, 2009, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2006, 2007, 2009, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -52,8 +52,11 @@ totext_in_dhcid(ARGS_TOTEXT) { if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) RETERR(str_totext("( " /*)*/, target)); - RETERR(isc_base64_totext(&sr, tctx->width - 2, tctx->linebreak, - target)); + if (tctx->width == 0) /* No splitting */ + RETERR(isc_base64_totext(&sr, 60, "", target)); + else + RETERR(isc_base64_totext(&sr, tctx->width - 2, + tctx->linebreak, target)); if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) { RETERR(str_totext(/* ( */ " )", target)); if (rdata->length > 2) { diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c index e21d97e..27d15b9 100644 --- a/lib/dns/resolver.c +++ b/lib/dns/resolver.c @@ -26,8 +26,9 @@ #include <isc/print.h> #include <isc/string.h> #include <isc/random.h> -#include <isc/task.h> +#include <isc/socket.h> #include <isc/stats.h> +#include <isc/task.h> #include <isc/timer.h> #include <isc/util.h> @@ -160,6 +161,7 @@ typedef struct query { isc_buffer_t buffer; isc_buffer_t *tsig; dns_tsigkey_t *tsigkey; + isc_socketevent_t sendevent; unsigned int options; unsigned int attributes; unsigned int sends; @@ -393,11 +395,10 @@ struct dns_resolver { isc_boolean_t frozen; unsigned int options; dns_dispatchmgr_t * dispatchmgr; - dns_dispatch_t * dispatchv4; + dns_dispatchset_t * dispatches4; isc_boolean_t exclusivev4; - dns_dispatch_t * dispatchv6; + dns_dispatchset_t * dispatches6; isc_boolean_t exclusivev6; - unsigned int ndisps; unsigned int nbuckets; fctxbucket_t * buckets; isc_uint32_t lame_ttl; @@ -424,7 +425,6 @@ struct dns_resolver { unsigned int activebuckets; isc_boolean_t priming; unsigned int spillat; /* clients-per-query */ - unsigned int nextdisp; /* Bad cache. */ dns_badcache_t ** badcache; @@ -1218,7 +1218,8 @@ process_sendevent(resquery_t *query, isc_event_t *event) { } } - isc_event_free(&event); + if (event->ev_type == ISC_SOCKEVENT_CONNECT) + isc_event_free(&event); if (retry) { /* @@ -1413,14 +1414,14 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, if (!have_addr) { switch (pf) { case PF_INET: - result = - dns_dispatch_getlocaladdress(res->dispatchv4, - &addr); + result = dns_dispatch_getlocaladdress( + res->dispatches4->dispatches[0], + &addr); break; case PF_INET6: - result = - dns_dispatch_getlocaladdress(res->dispatchv6, - &addr); + result = dns_dispatch_getlocaladdress( + res->dispatches6->dispatches[0], + &addr); break; default: result = ISC_R_NOTIMPLEMENTED; @@ -1476,13 +1477,15 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, } else { switch (isc_sockaddr_pf(&addrinfo->sockaddr)) { case PF_INET: - dns_dispatch_attach(res->dispatchv4, - &query->dispatch); + dns_dispatch_attach( + dns_resolver_dispatchv4(res), + &query->dispatch); query->exclusivesocket = res->exclusivev4; break; case PF_INET6: - dns_dispatch_attach(res->dispatchv6, - &query->dispatch); + dns_dispatch_attach( + dns_resolver_dispatchv6(res), + &query->dispatch); query->exclusivesocket = res->exclusivev6; break; default: @@ -1975,8 +1978,11 @@ resquery_send(resquery_t *query) { * XXXRTH Make sure we don't send to ourselves! We should probably * prune out these addresses when we get them from the ADB. */ - result = isc_socket_sendto(socket, &r, task, resquery_senddone, - query, address, NULL); + ISC_EVENT_INIT(&query->sendevent, sizeof(query->sendevent), 0, NULL, + ISC_SOCKEVENT_SENDDONE, resquery_senddone, query, + NULL, NULL, NULL); + result = isc_socket_sendto2(socket, &r, task, address, NULL, + &query->sendevent, 0); if (result != ISC_R_SUCCESS) { if (connecting) { /* @@ -2510,9 +2516,9 @@ findname(fetchctx_t *fctx, dns_name_t *name, in_port_t port, */ if (need_alternate != NULL && !*need_alternate && unshared && - ((res->dispatchv4 == NULL && + ((res->dispatches4 == NULL && find->result_v6 != DNS_R_NXDOMAIN) || - (res->dispatchv6 == NULL && + (res->dispatches6 == NULL && find->result_v4 != DNS_R_NXDOMAIN))) *need_alternate = ISC_TRUE; } else { @@ -2527,9 +2533,9 @@ findname(fetchctx_t *fctx, dns_name_t *name, in_port_t port, * an alternative server. */ if (need_alternate != NULL && !*need_alternate && - ((res->dispatchv4 == NULL && + ((res->dispatches4 == NULL && find->result_v6 == DNS_R_NXRRSET) || - (res->dispatchv6 == NULL && + (res->dispatches6 == NULL && find->result_v4 == DNS_R_NXRRSET))) *need_alternate = ISC_TRUE; dns_adb_destroyfind(&find); @@ -2627,9 +2633,9 @@ fctx_getaddresses(fetchctx_t *fctx, isc_boolean_t badcache) { while (sa != NULL) { if ((isc_sockaddr_pf(sa) == AF_INET && - fctx->res->dispatchv4 == NULL) || + fctx->res->dispatches4 == NULL) || (isc_sockaddr_pf(sa) == AF_INET6 && - fctx->res->dispatchv6 == NULL)) { + fctx->res->dispatches6 == NULL)) { sa = ISC_LIST_NEXT(sa, link); continue; } @@ -2677,9 +2683,9 @@ fctx_getaddresses(fetchctx_t *fctx, isc_boolean_t badcache) { */ stdoptions |= DNS_ADBFIND_AVOIDFETCHES; } - if (res->dispatchv4 != NULL) + if (res->dispatches4 != NULL) stdoptions |= DNS_ADBFIND_INET; - if (res->dispatchv6 != NULL) + if (res->dispatches6 != NULL) stdoptions |= DNS_ADBFIND_INET6; isc_stdtime_get(&now); @@ -2712,7 +2718,7 @@ fctx_getaddresses(fetchctx_t *fctx, isc_boolean_t badcache) { if (need_alternate) { int family; alternate_t *a; - family = (res->dispatchv6 != NULL) ? AF_INET6 : AF_INET; + family = (res->dispatches6 != NULL) ? AF_INET6 : AF_INET; for (a = ISC_LIST_HEAD(fctx->res->alternates); a != NULL; a = ISC_LIST_NEXT(a, link)) { @@ -7567,10 +7573,10 @@ destroy(dns_resolver_t *res) { } isc_mem_put(res->mctx, res->buckets, res->nbuckets * sizeof(fctxbucket_t)); - if (res->dispatchv4 != NULL) - dns_dispatch_detach(&res->dispatchv4); - if (res->dispatchv6 != NULL) - dns_dispatch_detach(&res->dispatchv6); + if (res->dispatches4 != NULL) + dns_dispatchset_destroy(&res->dispatches4); + if (res->dispatches6 != NULL) + dns_dispatchset_destroy(&res->dispatches6); while ((a = ISC_LIST_HEAD(res->alternates)) != NULL) { ISC_LIST_UNLINK(res->alternates, a, link); if (!a->isaddress) @@ -7660,7 +7666,8 @@ spillattimer_countdown(isc_task_t *task, isc_event_t *event) { isc_result_t dns_resolver_create(dns_view_t *view, - isc_taskmgr_t *taskmgr, unsigned int ntasks, + isc_taskmgr_t *taskmgr, + unsigned int ntasks, unsigned int ndisp, isc_socketmgr_t *socketmgr, isc_timermgr_t *timermgr, unsigned int options, @@ -7682,6 +7689,7 @@ dns_resolver_create(dns_view_t *view, REQUIRE(DNS_VIEW_VALID(view)); REQUIRE(ntasks > 0); + REQUIRE(ndisp > 0); REQUIRE(resp != NULL && *resp == NULL); REQUIRE(dispatchmgr != NULL); REQUIRE(dispatchv4 != NULL || dispatchv6 != NULL); @@ -7712,8 +7720,6 @@ dns_resolver_create(dns_view_t *view, res->spillattimer = NULL; res->zero_no_soa_ttl = ISC_FALSE; res->query_timeout = DEFAULT_QUERY_TIMEOUT; - res->ndisps = 0; - res->nextdisp = 0; /* meaningless at this point, but init it */ res->nbuckets = ntasks; res->activebuckets = ntasks; res->buckets = isc_mem_get(view->mctx, @@ -7756,17 +7762,19 @@ dns_resolver_create(dns_view_t *view, buckets_created++; } - res->dispatchv4 = NULL; + res->dispatches4 = NULL; if (dispatchv4 != NULL) { - dns_dispatch_attach(dispatchv4, &res->dispatchv4); + dns_dispatchset_create(view->mctx, socketmgr, taskmgr, + dispatchv4, &res->dispatches4, ndisp); dispattr = dns_dispatch_getattributes(dispatchv4); res->exclusivev4 = ISC_TF((dispattr & DNS_DISPATCHATTR_EXCLUSIVE) != 0); } - res->dispatchv6 = NULL; + res->dispatches6 = NULL; if (dispatchv6 != NULL) { - dns_dispatch_attach(dispatchv6, &res->dispatchv6); + dns_dispatchset_create(view->mctx, socketmgr, taskmgr, + dispatchv6, &res->dispatches6, ndisp); dispattr = dns_dispatch_getattributes(dispatchv6); res->exclusivev6 = ISC_TF((dispattr & DNS_DISPATCHATTR_EXCLUSIVE) != 0); @@ -7842,10 +7850,10 @@ dns_resolver_create(dns_view_t *view, DESTROYLOCK(&res->lock); cleanup_dispatches: - if (res->dispatchv6 != NULL) - dns_dispatch_detach(&res->dispatchv6); - if (res->dispatchv4 != NULL) - dns_dispatch_detach(&res->dispatchv4); + if (res->dispatches6 != NULL) + dns_dispatchset_destroy(&res->dispatches6); + if (res->dispatches4 != NULL) + dns_dispatchset_destroy(&res->dispatches4); cleanup_buckets: for (i = 0; i < buckets_created; i++) { @@ -8034,7 +8042,6 @@ void dns_resolver_shutdown(dns_resolver_t *res) { unsigned int i; fetchctx_t *fctx; - isc_socket_t *sock; isc_result_t result; REQUIRE(VALID_RESOLVER(res)); @@ -8053,15 +8060,13 @@ dns_resolver_shutdown(dns_resolver_t *res) { fctx != NULL; fctx = ISC_LIST_NEXT(fctx, link)) fctx_shutdown(fctx); - if (res->dispatchv4 != NULL && !res->exclusivev4) { - sock = dns_dispatch_getsocket(res->dispatchv4); - isc_socket_cancel(sock, res->buckets[i].task, - ISC_SOCKCANCEL_ALL); + if (res->dispatches4 != NULL && !res->exclusivev4) { + dns_dispatchset_cancelall(res->dispatches4, + res->buckets[i].task); } - if (res->dispatchv6 != NULL && !res->exclusivev6) { - sock = dns_dispatch_getsocket(res->dispatchv6); - isc_socket_cancel(sock, res->buckets[i].task, - ISC_SOCKCANCEL_ALL); + if (res->dispatches6 != NULL && !res->exclusivev6) { + dns_dispatchset_cancelall(res->dispatches6, + res->buckets[i].task); } res->buckets[i].exiting = ISC_TRUE; if (ISC_LIST_EMPTY(res->buckets[i].fctxs)) { @@ -8444,13 +8449,13 @@ dns_resolver_dispatchmgr(dns_resolver_t *resolver) { dns_dispatch_t * dns_resolver_dispatchv4(dns_resolver_t *resolver) { REQUIRE(VALID_RESOLVER(resolver)); - return (resolver->dispatchv4); + return (dns_dispatchset_get(resolver->dispatches4)); } dns_dispatch_t * dns_resolver_dispatchv6(dns_resolver_t *resolver) { REQUIRE(VALID_RESOLVER(resolver)); - return (resolver->dispatchv6); + return (dns_dispatchset_get(resolver->dispatches6)); } isc_socketmgr_t * diff --git a/lib/dns/sdb.c b/lib/dns/sdb.c index 526ce87..191fda2 100644 --- a/lib/dns/sdb.c +++ b/lib/dns/sdb.c @@ -728,8 +728,9 @@ destroynode(dns_sdbnode_t *node) { } static isc_result_t -findnode(dns_db_t *db, dns_name_t *name, isc_boolean_t create, - dns_dbnode_t **nodep) +findnodeext(dns_db_t *db, dns_name_t *name, isc_boolean_t create, + dns_clientinfomethods_t *methods, dns_clientinfo_t *clientinfo, + dns_dbnode_t **nodep) { dns_sdb_t *sdb = (dns_sdb_t *)db; dns_sdbnode_t *node = NULL; @@ -786,10 +787,11 @@ findnode(dns_db_t *db, dns_name_t *name, isc_boolean_t create, MAYBE_LOCK(sdb); if (imp->methods->lookup2 != NULL) result = imp->methods->lookup2(&sdb->common.origin, name, - sdb->dbdata, node); + sdb->dbdata, node, methods, + clientinfo); else result = imp->methods->lookup(sdb->zone, namestr, sdb->dbdata, - node); + node, methods, clientinfo); MAYBE_UNLOCK(sdb); if (result != ISC_R_SUCCESS && !(result == ISC_R_NOTFOUND && @@ -814,10 +816,11 @@ findnode(dns_db_t *db, dns_name_t *name, isc_boolean_t create, } static isc_result_t -find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, - dns_rdatatype_t type, unsigned int options, isc_stdtime_t now, - dns_dbnode_t **nodep, dns_name_t *foundname, - dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) +findext(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, + dns_rdatatype_t type, unsigned int options, isc_stdtime_t now, + dns_dbnode_t **nodep, dns_name_t *foundname, + dns_clientinfomethods_t *methods, dns_clientinfo_t *clientinfo, + dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) { dns_sdb_t *sdb = (dns_sdb_t *)db; dns_dbnode_t *node = NULL; @@ -857,7 +860,8 @@ find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, * Look up the next label. */ dns_name_getlabelsequence(name, nlabels - i, i, xname); - result = findnode(db, xname, ISC_FALSE, &node); + result = findnodeext(db, xname, ISC_FALSE, methods, + clientinfo, &node); if (result == ISC_R_NOTFOUND) { /* * No data at zone apex? @@ -1264,8 +1268,8 @@ static dns_dbmethods_t sdb_methods = { newversion, attachversion, closeversion, - findnode, - find, + NULL, + NULL, findzonecut, attachnode, detachnode, @@ -1282,17 +1286,19 @@ static dns_dbmethods_t sdb_methods = { ispersistent, overmem, settask, - NULL, - NULL, - NULL, - NULL, - NULL, - NULL, - NULL, - NULL, - NULL, - NULL, - NULL + NULL, /* getoriginnode */ + NULL, /* transfernode */ + NULL, /* getnsec3parameters */ + NULL, /* findnsec3node */ + NULL, /* setsigningtime */ + NULL, /* getsigningtime */ + NULL, /* resigned */ + NULL, /* isdnssec */ + NULL, /* getrrsetstats */ + NULL, /* rpz_enabled */ + NULL, /* rpz_findips */ + findnodeext, + findext }; static isc_result_t diff --git a/lib/dns/sdlz.c b/lib/dns/sdlz.c index 6e518d1..9d4e615 100644 --- a/lib/dns/sdlz.c +++ b/lib/dns/sdlz.c @@ -538,8 +538,9 @@ destroynode(dns_sdlznode_t *node) { } static isc_result_t -findnode(dns_db_t *db, dns_name_t *name, isc_boolean_t create, - dns_dbnode_t **nodep) +findnodeext(dns_db_t *db, dns_name_t *name, isc_boolean_t create, + dns_clientinfomethods_t *methods, dns_clientinfo_t *clientinfo, + dns_dbnode_t **nodep) { dns_sdlz_db_t *sdlz = (dns_sdlz_db_t *)db; dns_sdlznode_t *node = NULL; @@ -598,17 +599,18 @@ findnode(dns_db_t *db, dns_name_t *name, isc_boolean_t create, /* try to lookup the host (namestr) */ result = sdlz->dlzimp->methods->lookup(zonestr, namestr, sdlz->dlzimp->driverarg, - sdlz->dbdata, node); + sdlz->dbdata, node, + methods, clientinfo); /* * if the host (namestr) was not found, try to lookup a * "wildcard" host. */ - if (result != ISC_R_SUCCESS && !create) { + if (result != ISC_R_SUCCESS && !create) result = sdlz->dlzimp->methods->lookup(zonestr, "*", sdlz->dlzimp->driverarg, - sdlz->dbdata, node); - } + sdlz->dbdata, node, + methods, clientinfo); MAYBE_UNLOCK(sdlz->dlzimp); @@ -652,6 +654,13 @@ findnode(dns_db_t *db, dns_name_t *name, isc_boolean_t create, } static isc_result_t +findnode(dns_db_t *db, dns_name_t *name, isc_boolean_t create, + dns_dbnode_t **nodep) +{ + return (findnodeext(db, name, create, NULL, NULL, nodep)); +} + +static isc_result_t findzonecut(dns_db_t *db, dns_name_t *name, unsigned int options, isc_stdtime_t now, dns_dbnode_t **nodep, dns_name_t *foundname, dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) @@ -825,10 +834,11 @@ findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version, } static isc_result_t -find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, - dns_rdatatype_t type, unsigned int options, isc_stdtime_t now, - dns_dbnode_t **nodep, dns_name_t *foundname, - dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) +findext(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, + dns_rdatatype_t type, unsigned int options, isc_stdtime_t now, + dns_dbnode_t **nodep, dns_name_t *foundname, + dns_clientinfomethods_t *methods, dns_clientinfo_t *clientinfo, + dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) { dns_sdlz_db_t *sdlz = (dns_sdlz_db_t *)db; dns_dbnode_t *node = NULL; @@ -867,7 +877,8 @@ find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, * Look up the next label. */ dns_name_getlabelsequence(name, nlabels - i, i, xname); - result = findnode(db, xname, ISC_FALSE, &node); + result = findnodeext(db, xname, ISC_FALSE, + methods, clientinfo, &node); if (result != ISC_R_SUCCESS) { result = DNS_R_NXDOMAIN; continue; @@ -879,8 +890,8 @@ find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, */ if (i < nlabels) { result = findrdataset(db, node, version, - dns_rdatatype_dname, - 0, now, rdataset, sigrdataset); + dns_rdatatype_dname, 0, now, + rdataset, sigrdataset); if (result == ISC_R_SUCCESS) { result = DNS_R_DNAME; break; @@ -893,8 +904,8 @@ find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, */ if (i != olabels && (options & DNS_DBFIND_GLUEOK) == 0) { result = findrdataset(db, node, version, - dns_rdatatype_ns, - 0, now, rdataset, sigrdataset); + dns_rdatatype_ns, 0, now, + rdataset, sigrdataset); if (result == ISC_R_SUCCESS) { if (i == nlabels && type == dns_rdatatype_any) { @@ -933,8 +944,8 @@ find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, /* * Look for the qtype. */ - result = findrdataset(db, node, version, type, - 0, now, rdataset, sigrdataset); + result = findrdataset(db, node, version, type, 0, now, + rdataset, sigrdataset); if (result == ISC_R_SUCCESS) break; @@ -943,8 +954,8 @@ find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, */ if (type != dns_rdatatype_cname) { result = findrdataset(db, node, version, - dns_rdatatype_cname, - 0, now, rdataset, sigrdataset); + dns_rdatatype_cname, 0, now, + rdataset, sigrdataset); if (result == ISC_R_SUCCESS) { result = DNS_R_CNAME; break; @@ -980,6 +991,16 @@ find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, } static isc_result_t +find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, + dns_rdatatype_t type, unsigned int options, isc_stdtime_t now, + dns_dbnode_t **nodep, dns_name_t *foundname, + dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) +{ + return (findext(db, name, version, type, options, now, nodep, + foundname, NULL, NULL, rdataset, sigrdataset)); +} + +static isc_result_t allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version, isc_stdtime_t now, dns_rdatasetiter_t **iteratorp) { @@ -1194,7 +1215,8 @@ getoriginnode(dns_db_t *db, dns_dbnode_t **nodep) { if (sdlz->dlzimp->methods->newversion == NULL) return (ISC_R_NOTIMPLEMENTED); - result = findnode(db, &sdlz->common.origin, ISC_FALSE, nodep); + result = findnodeext(db, &sdlz->common.origin, ISC_FALSE, + NULL, NULL, nodep); if (result != ISC_R_SUCCESS) sdlz_log(ISC_LOG_ERROR, "sdlz getoriginnode failed : %s", isc_result_totext(result)); @@ -1230,16 +1252,18 @@ static dns_dbmethods_t sdlzdb_methods = { overmem, settask, getoriginnode, - NULL, - NULL, - NULL, - NULL, - NULL, - NULL, - NULL, - NULL, - NULL, - NULL + NULL, /* transfernode */ + NULL, /* getnsec3parameters */ + NULL, /* findnsec3node */ + NULL, /* setsigningtime */ + NULL, /* getsigningtime */ + NULL, /* resigned */ + NULL, /* isdnssec */ + NULL, /* getrrsetstats */ + NULL, /* rpz_enabled */ + NULL, /* rpz_findips */ + findnodeext, + findext }; /* diff --git a/lib/dns/update.c b/lib/dns/update.c new file mode 100644 index 0000000..14ffcc2 --- /dev/null +++ b/lib/dns/update.c @@ -0,0 +1,1865 @@ +/* + * Copyright (C) 2011, 2012 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +/* $Id$ */ + +#include <config.h> + +#include <isc/log.h> +#include <isc/netaddr.h> +#include <isc/print.h> +#include <isc/serial.h> +#include <isc/stats.h> +#include <isc/stdtime.h> +#include <isc/string.h> +#include <isc/taskpool.h> +#include <isc/util.h> + +#include <dns/db.h> +#include <dns/dbiterator.h> +#include <dns/diff.h> +#include <dns/dnssec.h> +#include <dns/events.h> +#include <dns/fixedname.h> +#include <dns/journal.h> +#include <dns/keyvalues.h> +#include <dns/log.h> +#include <dns/message.h> +#include <dns/nsec.h> +#include <dns/nsec3.h> +#include <dns/private.h> +#include <dns/rdataclass.h> +#include <dns/rdataset.h> +#include <dns/rdatasetiter.h> +#include <dns/rdatastruct.h> +#include <dns/rdatatype.h> +#include <dns/result.h> +#include <dns/soa.h> +#include <dns/ssu.h> +#include <dns/tsig.h> +#include <dns/update.h> +#include <dns/view.h> +#include <dns/zone.h> +#include <dns/zt.h> + + +/**************************************************************************/ + +/*% + * Log level for tracing dynamic update protocol requests. + */ +#define LOGLEVEL_PROTOCOL ISC_LOG_INFO + +/*% + * Log level for low-level debug tracing. + */ +#define LOGLEVEL_DEBUG ISC_LOG_DEBUG(8) + +/*% + * Check an operation for failure. These macros all assume that + * the function using them has a 'result' variable and a 'failure' + * label. + */ +#define CHECK(op) \ + do { result = (op); \ + if (result != ISC_R_SUCCESS) goto failure; \ + } while (0) + +/*% + * Fail unconditionally with result 'code', which must not + * be ISC_R_SUCCESS. The reason for failure presumably has + * been logged already. + * + * The test against ISC_R_SUCCESS is there to keep the Solaris compiler + * from complaining about "end-of-loop code not reached". + */ + +#define FAIL(code) \ + do { \ + result = (code); \ + if (result != ISC_R_SUCCESS) goto failure; \ + } while (0) + +/*% + * Fail unconditionally and log as a client error. + * The test against ISC_R_SUCCESS is there to keep the Solaris compiler + * from complaining about "end-of-loop code not reached". + */ +#define FAILC(code, msg) \ + do { \ + const char *_what = "failed"; \ + result = (code); \ + switch (result) { \ + case DNS_R_NXDOMAIN: \ + case DNS_R_YXDOMAIN: \ + case DNS_R_YXRRSET: \ + case DNS_R_NXRRSET: \ + _what = "unsuccessful"; \ + } \ + update_log(log, zone, LOGLEVEL_PROTOCOL, \ + "update %s: %s (%s)", _what, \ + msg, isc_result_totext(result)); \ + if (result != ISC_R_SUCCESS) goto failure; \ + } while (0) + +#define FAILN(code, name, msg) \ + do { \ + const char *_what = "failed"; \ + result = (code); \ + switch (result) { \ + case DNS_R_NXDOMAIN: \ + case DNS_R_YXDOMAIN: \ + case DNS_R_YXRRSET: \ + case DNS_R_NXRRSET: \ + _what = "unsuccessful"; \ + } \ + if (isc_log_wouldlog(dns_lctx, LOGLEVEL_PROTOCOL)) { \ + char _nbuf[DNS_NAME_FORMATSIZE]; \ + dns_name_format(name, _nbuf, sizeof(_nbuf)); \ + update_log(log, zone, LOGLEVEL_PROTOCOL, \ + "update %s: %s: %s (%s)", _what, _nbuf, \ + msg, isc_result_totext(result)); \ + } \ + if (result != ISC_R_SUCCESS) goto failure; \ + } while (0) + +#define FAILNT(code, name, type, msg) \ + do { \ + const char *_what = "failed"; \ + result = (code); \ + switch (result) { \ + case DNS_R_NXDOMAIN: \ + case DNS_R_YXDOMAIN: \ + case DNS_R_YXRRSET: \ + case DNS_R_NXRRSET: \ + _what = "unsuccessful"; \ + } \ + if (isc_log_wouldlog(dns_lctx, LOGLEVEL_PROTOCOL)) { \ + char _nbuf[DNS_NAME_FORMATSIZE]; \ + char _tbuf[DNS_RDATATYPE_FORMATSIZE]; \ + dns_name_format(name, _nbuf, sizeof(_nbuf)); \ + dns_rdatatype_format(type, _tbuf, sizeof(_tbuf)); \ + update_log(log, zone, LOGLEVEL_PROTOCOL, \ + "update %s: %s/%s: %s (%s)", \ + _what, _nbuf, _tbuf, msg, \ + isc_result_totext(result)); \ + } \ + if (result != ISC_R_SUCCESS) goto failure; \ + } while (0) + +/*% + * Fail unconditionally and log as a server error. + * The test against ISC_R_SUCCESS is there to keep the Solaris compiler + * from complaining about "end-of-loop code not reached". + */ +#define FAILS(code, msg) \ + do { \ + result = (code); \ + update_log(log, zone, LOGLEVEL_PROTOCOL, \ + "error: %s: %s", \ + msg, isc_result_totext(result)); \ + if (result != ISC_R_SUCCESS) goto failure; \ + } while (0) + +/**************************************************************************/ + +typedef struct rr rr_t; + +struct rr { + /* dns_name_t name; */ + isc_uint32_t ttl; + dns_rdata_t rdata; +}; + +typedef struct update_event update_event_t; + +/**************************************************************************/ + +static void +update_log(dns_update_log_t *callback, dns_zone_t *zone, + int level, const char *fmt, ...) ISC_FORMAT_PRINTF(4, 5); + +static void +update_log(dns_update_log_t *callback, dns_zone_t *zone, + int level, const char *fmt, ...) +{ + va_list ap; + char message[4096]; + + if (callback == NULL) + return; + + if (isc_log_wouldlog(dns_lctx, level) == ISC_FALSE) + return; + + + va_start(ap, fmt); + vsnprintf(message, sizeof(message), fmt, ap); + va_end(ap); + + (callback->func)(callback->arg, zone, level, message); +} + +/*% + * Update a single RR in version 'ver' of 'db' and log the + * update in 'diff'. + * + * Ensures: + * \li '*tuple' == NULL. Either the tuple is freed, or its + * ownership has been transferred to the diff. + */ +static isc_result_t +do_one_tuple(dns_difftuple_t **tuple, dns_db_t *db, dns_dbversion_t *ver, + dns_diff_t *diff) +{ + dns_diff_t temp_diff; + isc_result_t result; + + /* + * Create a singleton diff. + */ + dns_diff_init(diff->mctx, &temp_diff); + temp_diff.resign = diff->resign; + ISC_LIST_APPEND(temp_diff.tuples, *tuple, link); + + /* + * Apply it to the database. + */ + result = dns_diff_apply(&temp_diff, db, ver); + ISC_LIST_UNLINK(temp_diff.tuples, *tuple, link); + if (result != ISC_R_SUCCESS) { + dns_difftuple_free(tuple); + return (result); + } + + /* + * Merge it into the current pending journal entry. + */ + dns_diff_appendminimal(diff, tuple); + + /* + * Do not clear temp_diff. + */ + return (ISC_R_SUCCESS); +} + +static isc_result_t +update_one_rr(dns_db_t *db, dns_dbversion_t *ver, dns_diff_t *diff, + dns_diffop_t op, dns_name_t *name, dns_ttl_t ttl, + dns_rdata_t *rdata) +{ + dns_difftuple_t *tuple = NULL; + isc_result_t result; + result = dns_difftuple_create(diff->mctx, op, + name, ttl, rdata, &tuple); + if (result != ISC_R_SUCCESS) + return (result); + return (do_one_tuple(&tuple, db, ver, diff)); +} + +/**************************************************************************/ +/* + * Callback-style iteration over rdatasets and rdatas. + * + * foreach_rrset() can be used to iterate over the RRsets + * of a name and call a callback function with each + * one. Similarly, foreach_rr() can be used to iterate + * over the individual RRs at name, optionally restricted + * to RRs of a given type. + * + * The callback functions are called "actions" and take + * two arguments: a void pointer for passing arbitrary + * context information, and a pointer to the current RRset + * or RR. By convention, their names end in "_action". + */ + +/* + * XXXRTH We might want to make this public somewhere in libdns. + */ + +/*% + * Function type for foreach_rrset() iterator actions. + */ +typedef isc_result_t rrset_func(void *data, dns_rdataset_t *rrset); + +/*% + * Function type for foreach_rr() iterator actions. + */ +typedef isc_result_t rr_func(void *data, rr_t *rr); + +/*% + * Internal context struct for foreach_node_rr(). + */ +typedef struct { + rr_func * rr_action; + void * rr_action_data; +} foreach_node_rr_ctx_t; + +/*% + * Internal helper function for foreach_node_rr(). + */ +static isc_result_t +foreach_node_rr_action(void *data, dns_rdataset_t *rdataset) { + isc_result_t result; + foreach_node_rr_ctx_t *ctx = data; + for (result = dns_rdataset_first(rdataset); + result == ISC_R_SUCCESS; + result = dns_rdataset_next(rdataset)) + { + rr_t rr = { 0, DNS_RDATA_INIT }; + + dns_rdataset_current(rdataset, &rr.rdata); + rr.ttl = rdataset->ttl; + result = (*ctx->rr_action)(ctx->rr_action_data, &rr); + if (result != ISC_R_SUCCESS) + return (result); + } + if (result != ISC_R_NOMORE) + return (result); + return (ISC_R_SUCCESS); +} + +/*% + * For each rdataset of 'name' in 'ver' of 'db', call 'action' + * with the rdataset and 'action_data' as arguments. If the name + * does not exist, do nothing. + * + * If 'action' returns an error, abort iteration and return the error. + */ +static isc_result_t +foreach_rrset(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, + rrset_func *action, void *action_data) +{ + isc_result_t result; + dns_dbnode_t *node; + dns_rdatasetiter_t *iter; + + node = NULL; + result = dns_db_findnode(db, name, ISC_FALSE, &node); + if (result == ISC_R_NOTFOUND) + return (ISC_R_SUCCESS); + if (result != ISC_R_SUCCESS) + return (result); + + iter = NULL; + result = dns_db_allrdatasets(db, node, ver, + (isc_stdtime_t) 0, &iter); + if (result != ISC_R_SUCCESS) + goto cleanup_node; + + for (result = dns_rdatasetiter_first(iter); + result == ISC_R_SUCCESS; + result = dns_rdatasetiter_next(iter)) + { + dns_rdataset_t rdataset; + + dns_rdataset_init(&rdataset); + dns_rdatasetiter_current(iter, &rdataset); + + result = (*action)(action_data, &rdataset); + + dns_rdataset_disassociate(&rdataset); + if (result != ISC_R_SUCCESS) + goto cleanup_iterator; + } + if (result == ISC_R_NOMORE) + result = ISC_R_SUCCESS; + + cleanup_iterator: + dns_rdatasetiter_destroy(&iter); + + cleanup_node: + dns_db_detachnode(db, &node); + + return (result); +} + +/*% + * For each RR of 'name' in 'ver' of 'db', call 'action' + * with the RR and 'action_data' as arguments. If the name + * does not exist, do nothing. + * + * If 'action' returns an error, abort iteration + * and return the error. + */ +static isc_result_t +foreach_node_rr(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, + rr_func *rr_action, void *rr_action_data) +{ + foreach_node_rr_ctx_t ctx; + ctx.rr_action = rr_action; + ctx.rr_action_data = rr_action_data; + return (foreach_rrset(db, ver, name, + foreach_node_rr_action, &ctx)); +} + + +/*% + * For each of the RRs specified by 'db', 'ver', 'name', 'type', + * (which can be dns_rdatatype_any to match any type), and 'covers', call + * 'action' with the RR and 'action_data' as arguments. If the name + * does not exist, or if no RRset of the given type exists at the name, + * do nothing. + * + * If 'action' returns an error, abort iteration and return the error. + */ +static isc_result_t +foreach_rr(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, + dns_rdatatype_t type, dns_rdatatype_t covers, rr_func *rr_action, + void *rr_action_data) +{ + + isc_result_t result; + dns_dbnode_t *node; + dns_rdataset_t rdataset; + + if (type == dns_rdatatype_any) + return (foreach_node_rr(db, ver, name, + rr_action, rr_action_data)); + + node = NULL; + if (type == dns_rdatatype_nsec3 || + (type == dns_rdatatype_rrsig && covers == dns_rdatatype_nsec3)) + result = dns_db_findnsec3node(db, name, ISC_FALSE, &node); + else + result = dns_db_findnode(db, name, ISC_FALSE, &node); + if (result == ISC_R_NOTFOUND) + return (ISC_R_SUCCESS); + if (result != ISC_R_SUCCESS) + return (result); + + dns_rdataset_init(&rdataset); + result = dns_db_findrdataset(db, node, ver, type, covers, + (isc_stdtime_t) 0, &rdataset, NULL); + if (result == ISC_R_NOTFOUND) { + result = ISC_R_SUCCESS; + goto cleanup_node; + } + if (result != ISC_R_SUCCESS) + goto cleanup_node; + + for (result = dns_rdataset_first(&rdataset); + result == ISC_R_SUCCESS; + result = dns_rdataset_next(&rdataset)) + { + rr_t rr = { 0, DNS_RDATA_INIT }; + dns_rdataset_current(&rdataset, &rr.rdata); + rr.ttl = rdataset.ttl; + result = (*rr_action)(rr_action_data, &rr); + if (result != ISC_R_SUCCESS) + goto cleanup_rdataset; + } + if (result != ISC_R_NOMORE) + goto cleanup_rdataset; + result = ISC_R_SUCCESS; + + cleanup_rdataset: + dns_rdataset_disassociate(&rdataset); + cleanup_node: + dns_db_detachnode(db, &node); + + return (result); +} + +/**************************************************************************/ +/* + * Various tests on the database contents (for prerequisites, etc). + */ + +/*% + * Function type for predicate functions that compare a database RR 'db_rr' + * against an update RR 'update_rr'. + */ +typedef isc_boolean_t rr_predicate(dns_rdata_t *update_rr, dns_rdata_t *db_rr); + +/*% + * Helper function for rrset_exists(). + */ +static isc_result_t +rrset_exists_action(void *data, rr_t *rr) { + UNUSED(data); + UNUSED(rr); + return (ISC_R_EXISTS); +} + +/*% + * Utility macro for RR existence checking functions. + * + * If the variable 'result' has the value ISC_R_EXISTS or + * ISC_R_SUCCESS, set *exists to ISC_TRUE or ISC_FALSE, + * respectively, and return success. + * + * If 'result' has any other value, there was a failure. + * Return the failure result code and do not set *exists. + * + * This would be more readable as "do { if ... } while(0)", + * but that form generates tons of warnings on Solaris 2.6. + */ +#define RETURN_EXISTENCE_FLAG \ + return ((result == ISC_R_EXISTS) ? \ + (*exists = ISC_TRUE, ISC_R_SUCCESS) : \ + ((result == ISC_R_SUCCESS) ? \ + (*exists = ISC_FALSE, ISC_R_SUCCESS) : \ + result)) + +/*% + * Set '*exists' to true iff an rrset of the given type exists, + * to false otherwise. + */ +static isc_result_t +rrset_exists(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, + dns_rdatatype_t type, dns_rdatatype_t covers, + isc_boolean_t *exists) +{ + isc_result_t result; + result = foreach_rr(db, ver, name, type, covers, + rrset_exists_action, NULL); + RETURN_EXISTENCE_FLAG; +} + +/*% + * Set '*visible' to true if the RRset exists and is part of the + * visible zone. Otherwise '*visible' is set to false unless a + * error occurs. + */ +static isc_result_t +rrset_visible(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, + dns_rdatatype_t type, isc_boolean_t *visible) +{ + isc_result_t result; + dns_fixedname_t fixed; + + dns_fixedname_init(&fixed); + result = dns_db_find(db, name, ver, type, DNS_DBFIND_NOWILD, + (isc_stdtime_t) 0, NULL, + dns_fixedname_name(&fixed), NULL, NULL); + switch (result) { + case ISC_R_SUCCESS: + *visible = ISC_TRUE; + break; + /* + * Glue, obscured, deleted or replaced records. + */ + case DNS_R_DELEGATION: + case DNS_R_DNAME: + case DNS_R_CNAME: + case DNS_R_NXDOMAIN: + case DNS_R_NXRRSET: + case DNS_R_EMPTYNAME: + case DNS_R_COVERINGNSEC: + *visible = ISC_FALSE; + result = ISC_R_SUCCESS; + break; + default: + break; + } + return (result); +} + +/*% + * Context struct and helper function for name_exists(). + */ + +static isc_result_t +name_exists_action(void *data, dns_rdataset_t *rrset) { + UNUSED(data); + UNUSED(rrset); + return (ISC_R_EXISTS); +} + +/*% + * Set '*exists' to true iff the given name exists, to false otherwise. + */ +static isc_result_t +name_exists(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, + isc_boolean_t *exists) +{ + isc_result_t result; + result = foreach_rrset(db, ver, name, + name_exists_action, NULL); + RETURN_EXISTENCE_FLAG; +} + +/**************************************************************************/ +/* + * Checking of "RRset exists (value dependent)" prerequisites. + * + * In the RFC2136 section 3.2.5, this is the pseudocode involving + * a variable called "temp", a mapping of <name, type> tuples to rrsets. + * + * Here, we represent the "temp" data structure as (non-minimal) "dns_diff_t" + * where each tuple has op==DNS_DIFFOP_EXISTS. + */ + +/*% + * A comparison function defining the sorting order for the entries + * in the "temp" data structure. The major sort key is the owner name, + * followed by the type and rdata. + */ +static int +temp_order(const void *av, const void *bv) { + dns_difftuple_t const * const *ap = av; + dns_difftuple_t const * const *bp = bv; + dns_difftuple_t const *a = *ap; + dns_difftuple_t const *b = *bp; + int r; + r = dns_name_compare(&a->name, &b->name); + if (r != 0) + return (r); + r = (b->rdata.type - a->rdata.type); + if (r != 0) + return (r); + r = dns_rdata_casecompare(&a->rdata, &b->rdata); + return (r); +} + +/**************************************************************************/ +/* + * Conditional deletion of RRs. + */ + +/*% + * Context structure for delete_if(). + */ + +typedef struct { + rr_predicate *predicate; + dns_db_t *db; + dns_dbversion_t *ver; + dns_diff_t *diff; + dns_name_t *name; + dns_rdata_t *update_rr; +} conditional_delete_ctx_t; + +/*% + * Predicate functions for delete_if(). + */ + +/*% + * Return true always. + */ +static isc_boolean_t +true_p(dns_rdata_t *update_rr, dns_rdata_t *db_rr) { + UNUSED(update_rr); + UNUSED(db_rr); + return (ISC_TRUE); +} + +/*% + * Return true if the record is a RRSIG. + */ +static isc_boolean_t +rrsig_p(dns_rdata_t *update_rr, dns_rdata_t *db_rr) { + UNUSED(update_rr); + return ((db_rr->type == dns_rdatatype_rrsig) ? + ISC_TRUE : ISC_FALSE); +} + +/*% + * Internal helper function for delete_if(). + */ +static isc_result_t +delete_if_action(void *data, rr_t *rr) { + conditional_delete_ctx_t *ctx = data; + if ((*ctx->predicate)(ctx->update_rr, &rr->rdata)) { + isc_result_t result; + result = update_one_rr(ctx->db, ctx->ver, ctx->diff, + DNS_DIFFOP_DEL, ctx->name, + rr->ttl, &rr->rdata); + return (result); + } else { + return (ISC_R_SUCCESS); + } +} + +/*% + * Conditionally delete RRs. Apply 'predicate' to the RRs + * specified by 'db', 'ver', 'name', and 'type' (which can + * be dns_rdatatype_any to match any type). Delete those + * RRs for which the predicate returns true, and log the + * deletions in 'diff'. + */ +static isc_result_t +delete_if(rr_predicate *predicate, dns_db_t *db, dns_dbversion_t *ver, + dns_name_t *name, dns_rdatatype_t type, dns_rdatatype_t covers, + dns_rdata_t *update_rr, dns_diff_t *diff) +{ + conditional_delete_ctx_t ctx; + ctx.predicate = predicate; + ctx.db = db; + ctx.ver = ver; + ctx.diff = diff; + ctx.name = name; + ctx.update_rr = update_rr; + return (foreach_rr(db, ver, name, type, covers, + delete_if_action, &ctx)); +} + +/**************************************************************************/ +/* + * Incremental updating of NSECs and RRSIGs. + */ + +/*% + * We abuse the dns_diff_t type to represent a set of domain names + * affected by the update. + */ +static isc_result_t +namelist_append_name(dns_diff_t *list, dns_name_t *name) { + isc_result_t result; + dns_difftuple_t *tuple = NULL; + static dns_rdata_t dummy_rdata = DNS_RDATA_INIT; + + CHECK(dns_difftuple_create(list->mctx, DNS_DIFFOP_EXISTS, name, 0, + &dummy_rdata, &tuple)); + dns_diff_append(list, &tuple); + failure: + return (result); +} + +static isc_result_t +namelist_append_subdomain(dns_db_t *db, dns_name_t *name, dns_diff_t *affected) +{ + isc_result_t result; + dns_fixedname_t fixedname; + dns_name_t *child; + dns_dbiterator_t *dbit = NULL; + + dns_fixedname_init(&fixedname); + child = dns_fixedname_name(&fixedname); + + CHECK(dns_db_createiterator(db, DNS_DB_NONSEC3, &dbit)); + + for (result = dns_dbiterator_seek(dbit, name); + result == ISC_R_SUCCESS; + result = dns_dbiterator_next(dbit)) + { + dns_dbnode_t *node = NULL; + CHECK(dns_dbiterator_current(dbit, &node, child)); + dns_db_detachnode(db, &node); + if (! dns_name_issubdomain(child, name)) + break; + CHECK(namelist_append_name(affected, child)); + } + if (result == ISC_R_NOMORE) + result = ISC_R_SUCCESS; + failure: + if (dbit != NULL) + dns_dbiterator_destroy(&dbit); + return (result); +} + + + +/*% + * Helper function for non_nsec_rrset_exists(). + */ +static isc_result_t +is_non_nsec_action(void *data, dns_rdataset_t *rrset) { + UNUSED(data); + if (!(rrset->type == dns_rdatatype_nsec || + rrset->type == dns_rdatatype_nsec3 || + (rrset->type == dns_rdatatype_rrsig && + (rrset->covers == dns_rdatatype_nsec || + rrset->covers == dns_rdatatype_nsec3)))) + return (ISC_R_EXISTS); + return (ISC_R_SUCCESS); +} + +/*% + * Check whether there is an rrset other than a NSEC or RRSIG NSEC, + * i.e., anything that justifies the continued existence of a name + * after a secure update. + * + * If such an rrset exists, set '*exists' to ISC_TRUE. + * Otherwise, set it to ISC_FALSE. + */ +static isc_result_t +non_nsec_rrset_exists(dns_db_t *db, dns_dbversion_t *ver, + dns_name_t *name, isc_boolean_t *exists) +{ + isc_result_t result; + result = foreach_rrset(db, ver, name, is_non_nsec_action, NULL); + RETURN_EXISTENCE_FLAG; +} + +/*% + * A comparison function for sorting dns_diff_t:s by name. + */ +static int +name_order(const void *av, const void *bv) { + dns_difftuple_t const * const *ap = av; + dns_difftuple_t const * const *bp = bv; + dns_difftuple_t const *a = *ap; + dns_difftuple_t const *b = *bp; + return (dns_name_compare(&a->name, &b->name)); +} + +static isc_result_t +uniqify_name_list(dns_diff_t *list) { + isc_result_t result; + dns_difftuple_t *p, *q; + + CHECK(dns_diff_sort(list, name_order)); + + p = ISC_LIST_HEAD(list->tuples); + while (p != NULL) { + do { + q = ISC_LIST_NEXT(p, link); + if (q == NULL || ! dns_name_equal(&p->name, &q->name)) + break; + ISC_LIST_UNLINK(list->tuples, q, link); + dns_difftuple_free(&q); + } while (1); + p = ISC_LIST_NEXT(p, link); + } + failure: + return (result); +} + +static isc_result_t +is_active(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, + isc_boolean_t *flag, isc_boolean_t *cut, isc_boolean_t *unsecure) +{ + isc_result_t result; + dns_fixedname_t foundname; + dns_fixedname_init(&foundname); + result = dns_db_find(db, name, ver, dns_rdatatype_any, + DNS_DBFIND_GLUEOK | DNS_DBFIND_NOWILD, + (isc_stdtime_t) 0, NULL, + dns_fixedname_name(&foundname), + NULL, NULL); + if (result == ISC_R_SUCCESS || result == DNS_R_EMPTYNAME) { + *flag = ISC_TRUE; + *cut = ISC_FALSE; + if (unsecure != NULL) + *unsecure = ISC_FALSE; + return (ISC_R_SUCCESS); + } else if (result == DNS_R_ZONECUT) { + *flag = ISC_TRUE; + *cut = ISC_TRUE; + if (unsecure != NULL) { + /* + * We are at the zonecut. Check to see if there + * is a DS RRset. + */ + if (dns_db_find(db, name, ver, dns_rdatatype_ds, 0, + (isc_stdtime_t) 0, NULL, + dns_fixedname_name(&foundname), + NULL, NULL) == DNS_R_NXRRSET) + *unsecure = ISC_TRUE; + else + *unsecure = ISC_FALSE; + } + return (ISC_R_SUCCESS); + } else if (result == DNS_R_GLUE || result == DNS_R_DNAME || + result == DNS_R_DELEGATION || result == DNS_R_NXDOMAIN) { + *flag = ISC_FALSE; + *cut = ISC_FALSE; + if (unsecure != NULL) + *unsecure = ISC_FALSE; + return (ISC_R_SUCCESS); + } else { + /* + * Silence compiler. + */ + *flag = ISC_FALSE; + *cut = ISC_FALSE; + if (unsecure != NULL) + *unsecure = ISC_FALSE; + return (result); + } +} + +/*% + * Find the next/previous name that has a NSEC record. + * In other words, skip empty database nodes and names that + * have had their NSECs removed because they are obscured by + * a zone cut. + */ +static isc_result_t +next_active(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db, + dns_dbversion_t *ver, dns_name_t *oldname, dns_name_t *newname, + isc_boolean_t forward) +{ + isc_result_t result; + dns_dbiterator_t *dbit = NULL; + isc_boolean_t has_nsec = ISC_FALSE; + unsigned int wraps = 0; + isc_boolean_t secure = dns_db_issecure(db); + + CHECK(dns_db_createiterator(db, 0, &dbit)); + + CHECK(dns_dbiterator_seek(dbit, oldname)); + do { + dns_dbnode_t *node = NULL; + + if (forward) + result = dns_dbiterator_next(dbit); + else + result = dns_dbiterator_prev(dbit); + if (result == ISC_R_NOMORE) { + /* + * Wrap around. + */ + if (forward) + CHECK(dns_dbiterator_first(dbit)); + else + CHECK(dns_dbiterator_last(dbit)); + wraps++; + if (wraps == 2) { + update_log(log, zone, ISC_LOG_ERROR, + "secure zone with no NSECs"); + result = DNS_R_BADZONE; + goto failure; + } + } + CHECK(dns_dbiterator_current(dbit, &node, newname)); + dns_db_detachnode(db, &node); + + /* + * The iterator may hold the tree lock, and + * rrset_exists() calls dns_db_findnode() which + * may try to reacquire it. To avoid deadlock + * we must pause the iterator first. + */ + CHECK(dns_dbiterator_pause(dbit)); + if (secure) { + CHECK(rrset_exists(db, ver, newname, + dns_rdatatype_nsec, 0, &has_nsec)); + } else { + dns_fixedname_t ffound; + dns_name_t *found; + dns_fixedname_init(&ffound); + found = dns_fixedname_name(&ffound); + result = dns_db_find(db, newname, ver, + dns_rdatatype_soa, + DNS_DBFIND_NOWILD, 0, NULL, found, + NULL, NULL); + if (result == ISC_R_SUCCESS || + result == DNS_R_EMPTYNAME || + result == DNS_R_NXRRSET || + result == DNS_R_CNAME || + (result == DNS_R_DELEGATION && + dns_name_equal(newname, found))) { + has_nsec = ISC_TRUE; + result = ISC_R_SUCCESS; + } else if (result != DNS_R_NXDOMAIN) + break; + } + } while (! has_nsec); + failure: + if (dbit != NULL) + dns_dbiterator_destroy(&dbit); + + return (result); +} + +/*% + * Add a NSEC record for "name", recording the change in "diff". + * The existing NSEC is removed. + */ +static isc_result_t +add_nsec(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db, + dns_dbversion_t *ver, dns_name_t *name, dns_ttl_t nsecttl, + dns_diff_t *diff) +{ + isc_result_t result; + dns_dbnode_t *node = NULL; + unsigned char buffer[DNS_NSEC_BUFFERSIZE]; + dns_rdata_t rdata = DNS_RDATA_INIT; + dns_difftuple_t *tuple = NULL; + dns_fixedname_t fixedname; + dns_name_t *target; + + dns_fixedname_init(&fixedname); + target = dns_fixedname_name(&fixedname); + + /* + * Find the successor name, aka NSEC target. + */ + CHECK(next_active(log, zone, db, ver, name, target, ISC_TRUE)); + + /* + * Create the NSEC RDATA. + */ + CHECK(dns_db_findnode(db, name, ISC_FALSE, &node)); + dns_rdata_init(&rdata); + CHECK(dns_nsec_buildrdata(db, ver, node, target, buffer, &rdata)); + dns_db_detachnode(db, &node); + + /* + * Delete the old NSEC and record the change. + */ + CHECK(delete_if(true_p, db, ver, name, dns_rdatatype_nsec, 0, + NULL, diff)); + /* + * Add the new NSEC and record the change. + */ + CHECK(dns_difftuple_create(diff->mctx, DNS_DIFFOP_ADD, name, + nsecttl, &rdata, &tuple)); + CHECK(do_one_tuple(&tuple, db, ver, diff)); + INSIST(tuple == NULL); + + failure: + if (node != NULL) + dns_db_detachnode(db, &node); + return (result); +} + +/*% + * Add a placeholder NSEC record for "name", recording the change in "diff". + */ +static isc_result_t +add_placeholder_nsec(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, + dns_diff_t *diff) +{ + isc_result_t result; + dns_difftuple_t *tuple = NULL; + isc_region_t r; + unsigned char data[1] = { 0 }; /* The root domain, no bits. */ + dns_rdata_t rdata = DNS_RDATA_INIT; + + r.base = data; + r.length = sizeof(data); + dns_rdata_fromregion(&rdata, dns_db_class(db), dns_rdatatype_nsec, &r); + CHECK(dns_difftuple_create(diff->mctx, DNS_DIFFOP_ADD, name, 0, + &rdata, &tuple)); + CHECK(do_one_tuple(&tuple, db, ver, diff)); + failure: + return (result); +} + +static isc_result_t +find_zone_keys(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, + isc_mem_t *mctx, unsigned int maxkeys, + dst_key_t **keys, unsigned int *nkeys) +{ + isc_result_t result; + dns_dbnode_t *node = NULL; + const char *directory = dns_zone_getkeydirectory(zone); + CHECK(dns_db_findnode(db, dns_db_origin(db), ISC_FALSE, &node)); + CHECK(dns_dnssec_findzonekeys2(db, ver, node, dns_db_origin(db), + directory, mctx, maxkeys, keys, nkeys)); + failure: + if (node != NULL) + dns_db_detachnode(db, &node); + return (result); +} + +/*% + * Add RRSIG records for an RRset, recording the change in "diff". + */ +static isc_result_t +add_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db, + dns_dbversion_t *ver, dns_name_t *name, dns_rdatatype_t type, + dns_diff_t *diff, dst_key_t **keys, unsigned int nkeys, + isc_stdtime_t inception, isc_stdtime_t expire, + isc_boolean_t check_ksk, isc_boolean_t keyset_kskonly) +{ + isc_result_t result; + dns_dbnode_t *node = NULL; + dns_rdataset_t rdataset; + dns_rdata_t sig_rdata = DNS_RDATA_INIT; + isc_buffer_t buffer; + unsigned char data[1024]; /* XXX */ + unsigned int i, j; + isc_boolean_t added_sig = ISC_FALSE; + isc_mem_t *mctx = diff->mctx; + + dns_rdataset_init(&rdataset); + isc_buffer_init(&buffer, data, sizeof(data)); + + /* Get the rdataset to sign. */ + if (type == dns_rdatatype_nsec3) + CHECK(dns_db_findnsec3node(db, name, ISC_FALSE, &node)); + else + CHECK(dns_db_findnode(db, name, ISC_FALSE, &node)); + CHECK(dns_db_findrdataset(db, node, ver, type, 0, + (isc_stdtime_t) 0, &rdataset, NULL)); + dns_db_detachnode(db, &node); + +#define REVOKE(x) ((dst_key_flags(x) & DNS_KEYFLAG_REVOKE) != 0) +#define KSK(x) ((dst_key_flags(x) & DNS_KEYFLAG_KSK) != 0) +#define ALG(x) dst_key_alg(x) + + /* + * If we are honoring KSK flags then we need to check that we + * have both KSK and non-KSK keys that are not revoked per + * algorithm. + */ + for (i = 0; i < nkeys; i++) { + isc_boolean_t both = ISC_FALSE; + + if (!dst_key_isprivate(keys[i])) + continue; + + if (check_ksk && !REVOKE(keys[i])) { + isc_boolean_t have_ksk, have_nonksk; + if (KSK(keys[i])) { + have_ksk = ISC_TRUE; + have_nonksk = ISC_FALSE; + } else { + have_ksk = ISC_FALSE; + have_nonksk = ISC_TRUE; + } + for (j = 0; j < nkeys; j++) { + if (j == i || ALG(keys[i]) != ALG(keys[j])) + continue; + if (REVOKE(keys[j])) + continue; + if (KSK(keys[j])) + have_ksk = ISC_TRUE; + else + have_nonksk = ISC_TRUE; + both = have_ksk && have_nonksk; + if (both) + break; + } + } + + if (both) { + if (type == dns_rdatatype_dnskey) { + if (!KSK(keys[i]) && keyset_kskonly) + continue; + } else if (KSK(keys[i])) + continue; + } else if (REVOKE(keys[i]) && type != dns_rdatatype_dnskey) + continue; + + /* Calculate the signature, creating a RRSIG RDATA. */ + CHECK(dns_dnssec_sign(name, &rdataset, keys[i], + &inception, &expire, + mctx, &buffer, &sig_rdata)); + + /* Update the database and journal with the RRSIG. */ + /* XXX inefficient - will cause dataset merging */ + CHECK(update_one_rr(db, ver, diff, DNS_DIFFOP_ADDRESIGN, name, + rdataset.ttl, &sig_rdata)); + dns_rdata_reset(&sig_rdata); + isc_buffer_init(&buffer, data, sizeof(data)); + added_sig = ISC_TRUE; + } + if (!added_sig) { + update_log(log, zone, ISC_LOG_ERROR, + "found no active private keys, " + "unable to generate any signatures"); + result = ISC_R_NOTFOUND; + } + + failure: + if (dns_rdataset_isassociated(&rdataset)) + dns_rdataset_disassociate(&rdataset); + if (node != NULL) + dns_db_detachnode(db, &node); + return (result); +} + +/* + * Delete expired RRsigs and any RRsigs we are about to re-sign. + * See also zone.c:del_sigs(). + */ +static isc_result_t +del_keysigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, + dns_diff_t *diff, dst_key_t **keys, unsigned int nkeys) +{ + isc_result_t result; + dns_dbnode_t *node = NULL; + dns_rdataset_t rdataset; + dns_rdata_t rdata = DNS_RDATA_INIT; + unsigned int i; + dns_rdata_rrsig_t rrsig; + isc_boolean_t found; + + dns_rdataset_init(&rdataset); + + result = dns_db_findnode(db, name, ISC_FALSE, &node); + if (result == ISC_R_NOTFOUND) + return (ISC_R_SUCCESS); + if (result != ISC_R_SUCCESS) + goto failure; + result = dns_db_findrdataset(db, node, ver, dns_rdatatype_rrsig, + dns_rdatatype_dnskey, (isc_stdtime_t) 0, + &rdataset, NULL); + dns_db_detachnode(db, &node); + + if (result == ISC_R_NOTFOUND) + return (ISC_R_SUCCESS); + if (result != ISC_R_SUCCESS) + goto failure; + + for (result = dns_rdataset_first(&rdataset); + result == ISC_R_SUCCESS; + result = dns_rdataset_next(&rdataset)) { + dns_rdataset_current(&rdataset, &rdata); + result = dns_rdata_tostruct(&rdata, &rrsig, NULL); + RUNTIME_CHECK(result == ISC_R_SUCCESS); + found = ISC_FALSE; + for (i = 0; i < nkeys; i++) { + if (rrsig.keyid == dst_key_id(keys[i])) { + found = ISC_TRUE; + if (!dst_key_isprivate(keys[i])) { + /* + * The re-signing code in zone.c + * will mark this as offline. + * Just skip the record for now. + */ + break; + } + result = update_one_rr(db, ver, diff, + DNS_DIFFOP_DEL, name, + rdataset.ttl, &rdata); + break; + } + } + /* + * If there is not a matching DNSKEY then delete the RRSIG. + */ + if (!found) + result = update_one_rr(db, ver, diff, DNS_DIFFOP_DEL, + name, rdataset.ttl, &rdata); + dns_rdata_reset(&rdata); + if (result != ISC_R_SUCCESS) + break; + } + dns_rdataset_disassociate(&rdataset); + if (result == ISC_R_NOMORE) + result = ISC_R_SUCCESS; +failure: + if (node != NULL) + dns_db_detachnode(db, &node); + return (result); +} + +static isc_result_t +add_exposed_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db, + dns_dbversion_t *ver, dns_name_t *name, isc_boolean_t cut, + dns_diff_t *diff, dst_key_t **keys, unsigned int nkeys, + isc_stdtime_t inception, isc_stdtime_t expire, + isc_boolean_t check_ksk, isc_boolean_t keyset_kskonly) +{ + isc_result_t result; + dns_dbnode_t *node; + dns_rdatasetiter_t *iter; + + node = NULL; + result = dns_db_findnode(db, name, ISC_FALSE, &node); + if (result == ISC_R_NOTFOUND) + return (ISC_R_SUCCESS); + if (result != ISC_R_SUCCESS) + return (result); + + iter = NULL; + result = dns_db_allrdatasets(db, node, ver, + (isc_stdtime_t) 0, &iter); + if (result != ISC_R_SUCCESS) + goto cleanup_node; + + for (result = dns_rdatasetiter_first(iter); + result == ISC_R_SUCCESS; + result = dns_rdatasetiter_next(iter)) + { + dns_rdataset_t rdataset; + dns_rdatatype_t type; + isc_boolean_t flag; + + dns_rdataset_init(&rdataset); + dns_rdatasetiter_current(iter, &rdataset); + type = rdataset.type; + dns_rdataset_disassociate(&rdataset); + + /* + * We don't need to sign unsigned NSEC records at the cut + * as they are handled elsewhere. + */ + if ((type == dns_rdatatype_rrsig) || + (cut && type != dns_rdatatype_ds)) + continue; + result = rrset_exists(db, ver, name, dns_rdatatype_rrsig, + type, &flag); + if (result != ISC_R_SUCCESS) + goto cleanup_iterator; + if (flag) + continue;; + result = add_sigs(log, zone, db, ver, name, type, diff, + keys, nkeys, inception, expire, + check_ksk, keyset_kskonly); + if (result != ISC_R_SUCCESS) + goto cleanup_iterator; + } + if (result == ISC_R_NOMORE) + result = ISC_R_SUCCESS; + + cleanup_iterator: + dns_rdatasetiter_destroy(&iter); + + cleanup_node: + dns_db_detachnode(db, &node); + + return (result); +} + +/*% + * Update RRSIG, NSEC and NSEC3 records affected by an update. The original + * update, including the SOA serial update but excluding the RRSIG & NSEC + * changes, is in "diff" and has already been applied to "newver" of "db". + * The database version prior to the update is "oldver". + * + * The necessary RRSIG, NSEC and NSEC3 changes will be applied to "newver" + * and added (as a minimal diff) to "diff". + * + * The RRSIGs generated will be valid for 'sigvalidityinterval' seconds. + */ +isc_result_t +dns_update_signatures(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db, + dns_dbversion_t *oldver, dns_dbversion_t *newver, + dns_diff_t *diff, isc_uint32_t sigvalidityinterval) +{ + isc_result_t result; + dns_difftuple_t *t; + dns_diff_t diffnames; + dns_diff_t affected; + dns_diff_t sig_diff; + dns_diff_t nsec_diff; + dns_diff_t nsec_mindiff; + isc_boolean_t flag, build_nsec, build_nsec3; + dst_key_t *zone_keys[DNS_MAXZONEKEYS]; + unsigned int nkeys = 0; + unsigned int i; + isc_stdtime_t now, inception, expire; + dns_ttl_t nsecttl; + dns_rdata_soa_t soa; + dns_rdata_t rdata = DNS_RDATA_INIT; + dns_rdataset_t rdataset; + dns_dbnode_t *node = NULL; + isc_boolean_t check_ksk, keyset_kskonly; + isc_boolean_t unsecure; + isc_boolean_t cut; + dns_rdatatype_t privatetype = dns_zone_getprivatetype(zone); + + dns_diff_init(diff->mctx, &diffnames); + dns_diff_init(diff->mctx, &affected); + + dns_diff_init(diff->mctx, &sig_diff); + sig_diff.resign = dns_zone_getsigresigninginterval(zone); + dns_diff_init(diff->mctx, &nsec_diff); + dns_diff_init(diff->mctx, &nsec_mindiff); + + result = find_zone_keys(zone, db, newver, diff->mctx, + DNS_MAXZONEKEYS, zone_keys, &nkeys); + if (result != ISC_R_SUCCESS) { + update_log(log, zone, ISC_LOG_ERROR, + "could not get zone keys for secure dynamic update"); + goto failure; + } + + isc_stdtime_get(&now); + inception = now - 3600; /* Allow for some clock skew. */ + expire = now + sigvalidityinterval; + + /* + * Do we look at the KSK flag on the DNSKEY to determining which + * keys sign which RRsets? First check the zone option then + * check the keys flags to make sure at least one has a ksk set + * and one doesn't. + */ + check_ksk = ISC_TF((dns_zone_getoptions(zone) & + DNS_ZONEOPT_UPDATECHECKKSK) != 0); + keyset_kskonly = ISC_TF((dns_zone_getoptions(zone) & + DNS_ZONEOPT_DNSKEYKSKONLY) != 0); + + /* + * Get the NSEC/NSEC3 TTL from the SOA MINIMUM field. + */ + CHECK(dns_db_findnode(db, dns_db_origin(db), ISC_FALSE, &node)); + dns_rdataset_init(&rdataset); + CHECK(dns_db_findrdataset(db, node, newver, dns_rdatatype_soa, 0, + (isc_stdtime_t) 0, &rdataset, NULL)); + CHECK(dns_rdataset_first(&rdataset)); + dns_rdataset_current(&rdataset, &rdata); + CHECK(dns_rdata_tostruct(&rdata, &soa, NULL)); + nsecttl = soa.minimum; + dns_rdataset_disassociate(&rdataset); + dns_db_detachnode(db, &node); + + /* + * Find all RRsets directly affected by the update, and + * update their RRSIGs. Also build a list of names affected + * by the update in "diffnames". + */ + CHECK(dns_diff_sort(diff, temp_order)); + + t = ISC_LIST_HEAD(diff->tuples); + while (t != NULL) { + dns_name_t *name = &t->name; + /* Now "name" is a new, unique name affected by the update. */ + + CHECK(namelist_append_name(&diffnames, name)); + + while (t != NULL && dns_name_equal(&t->name, name)) { + dns_rdatatype_t type; + type = t->rdata.type; + + /* + * Now "name" and "type" denote a new unique RRset + * affected by the update. + */ + + /* Don't sign RRSIGs. */ + if (type == dns_rdatatype_rrsig) + goto skip; + + /* + * Delete all old RRSIGs covering this type, since they + * are all invalid when the signed RRset has changed. + * We may not be able to recreate all of them - tough. + * Special case changes to the zone's DNSKEY records + * to support offline KSKs. + */ + if (type == dns_rdatatype_dnskey) + del_keysigs(db, newver, name, &sig_diff, + zone_keys, nkeys); + else + CHECK(delete_if(true_p, db, newver, name, + dns_rdatatype_rrsig, type, + NULL, &sig_diff)); + + /* + * If this RRset is still visible after the update, + * add a new signature for it. + */ + CHECK(rrset_visible(db, newver, name, type, &flag)); + if (flag) { + CHECK(add_sigs(log, zone, db, newver, name, + type, &sig_diff, zone_keys, + nkeys, inception, expire, + check_ksk, keyset_kskonly)); + } + skip: + /* Skip any other updates to the same RRset. */ + while (t != NULL && + dns_name_equal(&t->name, name) && + t->rdata.type == type) + { + t = ISC_LIST_NEXT(t, link); + } + } + } + update_log(log, zone, ISC_LOG_DEBUG(3), "updated data signatures"); + + /* Remove orphaned NSECs and RRSIG NSECs. */ + for (t = ISC_LIST_HEAD(diffnames.tuples); + t != NULL; + t = ISC_LIST_NEXT(t, link)) + { + CHECK(non_nsec_rrset_exists(db, newver, &t->name, &flag)); + if (! flag) { + CHECK(delete_if(true_p, db, newver, &t->name, + dns_rdatatype_any, 0, + NULL, &sig_diff)); + } + } + update_log(log, zone, ISC_LOG_DEBUG(3), + "removed any orphaned NSEC records"); + + /* + * See if we need to build NSEC or NSEC3 chains. + */ + CHECK(dns_private_chains(db, newver, privatetype, &build_nsec, + &build_nsec3)); + if (!build_nsec) + goto update_nsec3; + + update_log(log, zone, ISC_LOG_DEBUG(3), "rebuilding NSEC chain"); + + /* + * When a name is created or deleted, its predecessor needs to + * have its NSEC updated. + */ + for (t = ISC_LIST_HEAD(diffnames.tuples); + t != NULL; + t = ISC_LIST_NEXT(t, link)) + { + isc_boolean_t existed, exists; + dns_fixedname_t fixedname; + dns_name_t *prevname; + + dns_fixedname_init(&fixedname); + prevname = dns_fixedname_name(&fixedname); + + if (oldver != NULL) + CHECK(name_exists(db, oldver, &t->name, &existed)); + else + existed = ISC_FALSE; + CHECK(name_exists(db, newver, &t->name, &exists)); + if (exists == existed) + continue; + + /* + * Find the predecessor. + * When names become obscured or unobscured in this update + * transaction, we may find the wrong predecessor because + * the NSECs have not yet been updated to reflect the delegation + * change. This should not matter because in this case, + * the correct predecessor is either the delegation node or + * a newly unobscured node, and those nodes are on the + * "affected" list in any case. + */ + CHECK(next_active(log, zone, db, newver, + &t->name, prevname, ISC_FALSE)); + CHECK(namelist_append_name(&affected, prevname)); + } + + /* + * Find names potentially affected by delegation changes + * (obscured by adding an NS or DNAME, or unobscured by + * removing one). + */ + for (t = ISC_LIST_HEAD(diffnames.tuples); + t != NULL; + t = ISC_LIST_NEXT(t, link)) + { + isc_boolean_t ns_existed, dname_existed; + isc_boolean_t ns_exists, dname_exists; + + if (oldver != NULL) + CHECK(rrset_exists(db, oldver, &t->name, + dns_rdatatype_ns, 0, &ns_existed)); + else + ns_existed = ISC_FALSE; + if (oldver != NULL) + CHECK(rrset_exists(db, oldver, &t->name, + dns_rdatatype_dname, 0, + &dname_existed)); + else + dname_existed = ISC_FALSE; + CHECK(rrset_exists(db, newver, &t->name, dns_rdatatype_ns, 0, + &ns_exists)); + CHECK(rrset_exists(db, newver, &t->name, dns_rdatatype_dname, 0, + &dname_exists)); + if ((ns_exists || dname_exists) == (ns_existed || dname_existed)) + continue; + /* + * There was a delegation change. Mark all subdomains + * of t->name as potentially needing a NSEC update. + */ + CHECK(namelist_append_subdomain(db, &t->name, &affected)); + } + + ISC_LIST_APPENDLIST(affected.tuples, diffnames.tuples, link); + INSIST(ISC_LIST_EMPTY(diffnames.tuples)); + + CHECK(uniqify_name_list(&affected)); + + /* + * Determine which names should have NSECs, and delete/create + * NSECs to make it so. We don't know the final NSEC targets yet, + * so we just create placeholder NSECs with arbitrary contents + * to indicate that their respective owner names should be part of + * the NSEC chain. + */ + for (t = ISC_LIST_HEAD(affected.tuples); + t != NULL; + t = ISC_LIST_NEXT(t, link)) + { + isc_boolean_t exists; + dns_name_t *name = &t->name; + + CHECK(name_exists(db, newver, name, &exists)); + if (! exists) + continue; + CHECK(is_active(db, newver, name, &flag, &cut, NULL)); + if (!flag) { + /* + * This name is obscured. Delete any + * existing NSEC record. + */ + CHECK(delete_if(true_p, db, newver, name, + dns_rdatatype_nsec, 0, + NULL, &nsec_diff)); + CHECK(delete_if(rrsig_p, db, newver, name, + dns_rdatatype_any, 0, NULL, diff)); + } else { + /* + * This name is not obscured. It needs to have a + * NSEC unless it is the at the origin, in which + * case it should already exist if there is a complete + * NSEC chain and if there isn't a complete NSEC chain + * we don't want to add one as that would signal that + * there is a complete NSEC chain. + */ + if (!dns_name_equal(name, dns_db_origin(db))) { + CHECK(rrset_exists(db, newver, name, + dns_rdatatype_nsec, 0, + &flag)); + if (!flag) + CHECK(add_placeholder_nsec(db, newver, + name, diff)); + } + CHECK(add_exposed_sigs(log, zone, db, newver, name, + cut, &sig_diff, zone_keys, nkeys, + inception, expire, check_ksk, + keyset_kskonly)); + } + } + + /* + * Now we know which names are part of the NSEC chain. + * Make them all point at their correct targets. + */ + for (t = ISC_LIST_HEAD(affected.tuples); + t != NULL; + t = ISC_LIST_NEXT(t, link)) + { + CHECK(rrset_exists(db, newver, &t->name, + dns_rdatatype_nsec, 0, &flag)); + if (flag) { + /* + * There is a NSEC, but we don't know if it is correct. + * Delete it and create a correct one to be sure. + * If the update was unnecessary, the diff minimization + * will take care of eliminating it from the journal, + * IXFRs, etc. + * + * The RRSIG bit should always be set in the NSECs + * we generate, because they will all get RRSIG NSECs. + * (XXX what if the zone keys are missing?). + * Because the RRSIG NSECs have not necessarily been + * created yet, the correctness of the bit mask relies + * on the assumption that NSECs are only created if + * there is other data, and if there is other data, + * there are other RRSIGs. + */ + CHECK(add_nsec(log, zone, db, newver, &t->name, + nsecttl, &nsec_diff)); + } + } + + /* + * Minimize the set of NSEC updates so that we don't + * have to regenerate the RRSIG NSECs for NSECs that were + * replaced with identical ones. + */ + while ((t = ISC_LIST_HEAD(nsec_diff.tuples)) != NULL) { + ISC_LIST_UNLINK(nsec_diff.tuples, t, link); + dns_diff_appendminimal(&nsec_mindiff, &t); + } + + update_log(log, zone, ISC_LOG_DEBUG(3), "signing rebuilt NSEC chain"); + + /* Update RRSIG NSECs. */ + for (t = ISC_LIST_HEAD(nsec_mindiff.tuples); + t != NULL; + t = ISC_LIST_NEXT(t, link)) + { + if (t->op == DNS_DIFFOP_DEL) { + CHECK(delete_if(true_p, db, newver, &t->name, + dns_rdatatype_rrsig, dns_rdatatype_nsec, + NULL, &sig_diff)); + } else if (t->op == DNS_DIFFOP_ADD) { + CHECK(add_sigs(log, zone, db, newver, &t->name, + dns_rdatatype_nsec, &sig_diff, + zone_keys, nkeys, inception, expire, + check_ksk, keyset_kskonly)); + } else { + INSIST(0); + } + } + + update_nsec3: + + /* Record our changes for the journal. */ + while ((t = ISC_LIST_HEAD(sig_diff.tuples)) != NULL) { + ISC_LIST_UNLINK(sig_diff.tuples, t, link); + dns_diff_appendminimal(diff, &t); + } + while ((t = ISC_LIST_HEAD(nsec_mindiff.tuples)) != NULL) { + ISC_LIST_UNLINK(nsec_mindiff.tuples, t, link); + dns_diff_appendminimal(diff, &t); + } + + INSIST(ISC_LIST_EMPTY(sig_diff.tuples)); + INSIST(ISC_LIST_EMPTY(nsec_diff.tuples)); + INSIST(ISC_LIST_EMPTY(nsec_mindiff.tuples)); + + if (!build_nsec3) { + update_log(log, zone, ISC_LOG_DEBUG(3), + "no NSEC3 chains to rebuild"); + goto failure; + } + + update_log(log, zone, ISC_LOG_DEBUG(3), "rebuilding NSEC3 chains"); + + dns_diff_clear(&diffnames); + dns_diff_clear(&affected); + + CHECK(dns_diff_sort(diff, temp_order)); + + /* + * Find names potentially affected by delegation changes + * (obscured by adding an NS or DNAME, or unobscured by + * removing one). + */ + t = ISC_LIST_HEAD(diff->tuples); + while (t != NULL) { + dns_name_t *name = &t->name; + + isc_boolean_t ns_existed, dname_existed; + isc_boolean_t ns_exists, dname_exists; + isc_boolean_t exists, existed; + + if (t->rdata.type == dns_rdatatype_nsec || + t->rdata.type == dns_rdatatype_rrsig) { + t = ISC_LIST_NEXT(t, link); + continue; + } + + CHECK(namelist_append_name(&affected, name)); + + if (oldver != NULL) + CHECK(rrset_exists(db, oldver, name, dns_rdatatype_ns, + 0, &ns_existed)); + else + ns_existed = ISC_FALSE; + if (oldver != NULL) + CHECK(rrset_exists(db, oldver, name, + dns_rdatatype_dname, 0, + &dname_existed)); + else + dname_existed = ISC_FALSE; + CHECK(rrset_exists(db, newver, name, dns_rdatatype_ns, 0, + &ns_exists)); + CHECK(rrset_exists(db, newver, name, dns_rdatatype_dname, 0, + &dname_exists)); + + exists = ns_exists || dname_exists; + existed = ns_existed || dname_existed; + if (exists == existed) + goto nextname; + /* + * There was a delegation change. Mark all subdomains + * of t->name as potentially needing a NSEC3 update. + */ + CHECK(namelist_append_subdomain(db, name, &affected)); + + nextname: + while (t != NULL && dns_name_equal(&t->name, name)) + t = ISC_LIST_NEXT(t, link); + } + + for (t = ISC_LIST_HEAD(affected.tuples); + t != NULL; + t = ISC_LIST_NEXT(t, link)) { + dns_name_t *name = &t->name; + + unsecure = ISC_FALSE; /* Silence compiler warning. */ + CHECK(is_active(db, newver, name, &flag, &cut, &unsecure)); + + if (!flag) { + CHECK(delete_if(rrsig_p, db, newver, name, + dns_rdatatype_any, 0, NULL, diff)); + CHECK(dns_nsec3_delnsec3sx(db, newver, name, + privatetype, &nsec_diff)); + } else { + CHECK(add_exposed_sigs(log, zone, db, newver, name, + cut, &sig_diff, zone_keys, nkeys, + inception, expire, check_ksk, + keyset_kskonly)); + CHECK(dns_nsec3_addnsec3sx(db, newver, name, nsecttl, + unsecure, privatetype, + &nsec_diff)); + } + } + + /* + * Minimize the set of NSEC3 updates so that we don't + * have to regenerate the RRSIG NSEC3s for NSEC3s that were + * replaced with identical ones. + */ + while ((t = ISC_LIST_HEAD(nsec_diff.tuples)) != NULL) { + ISC_LIST_UNLINK(nsec_diff.tuples, t, link); + dns_diff_appendminimal(&nsec_mindiff, &t); + } + + update_log(log, zone, ISC_LOG_DEBUG(3), + "signing rebuilt NSEC3 chain"); + + /* Update RRSIG NSEC3s. */ + for (t = ISC_LIST_HEAD(nsec_mindiff.tuples); + t != NULL; + t = ISC_LIST_NEXT(t, link)) + { + if (t->op == DNS_DIFFOP_DEL) { + CHECK(delete_if(true_p, db, newver, &t->name, + dns_rdatatype_rrsig, + dns_rdatatype_nsec3, + NULL, &sig_diff)); + } else if (t->op == DNS_DIFFOP_ADD) { + CHECK(add_sigs(log, zone, db, newver, &t->name, + dns_rdatatype_nsec3, + &sig_diff, zone_keys, nkeys, + inception, expire, check_ksk, + keyset_kskonly)); + } else { + INSIST(0); + } + } + + /* Record our changes for the journal. */ + while ((t = ISC_LIST_HEAD(sig_diff.tuples)) != NULL) { + ISC_LIST_UNLINK(sig_diff.tuples, t, link); + dns_diff_appendminimal(diff, &t); + } + while ((t = ISC_LIST_HEAD(nsec_mindiff.tuples)) != NULL) { + ISC_LIST_UNLINK(nsec_mindiff.tuples, t, link); + dns_diff_appendminimal(diff, &t); + } + + INSIST(ISC_LIST_EMPTY(sig_diff.tuples)); + INSIST(ISC_LIST_EMPTY(nsec_diff.tuples)); + INSIST(ISC_LIST_EMPTY(nsec_mindiff.tuples)); + + failure: + dns_diff_clear(&sig_diff); + dns_diff_clear(&nsec_diff); + dns_diff_clear(&nsec_mindiff); + + dns_diff_clear(&affected); + dns_diff_clear(&diffnames); + + for (i = 0; i < nkeys; i++) + dst_key_free(&zone_keys[i]); + + return (result); +} + +isc_uint32_t +dns_update_soaserial(isc_uint32_t serial, dns_updatemethod_t method) { + isc_stdtime_t now; + + if (method == dns_updatemethod_unixtime) { + isc_stdtime_get(&now); + if (now != 0 && isc_serial_gt(now, serial)) + return (now); + } + + /* RFC1982 */ + serial = (serial + 1) & 0xFFFFFFFF; + if (serial == 0) + serial = 1; + + return (serial); +} diff --git a/lib/dns/validator.c b/lib/dns/validator.c index 3d7518a..8cf7f66 100644 --- a/lib/dns/validator.c +++ b/lib/dns/validator.c @@ -1459,8 +1459,10 @@ isselfsigned(dns_validator_t *val) { if (result != ISC_R_SUCCESS) continue; - result = dns_dnssec_verify2(name, rdataset, dstkey, - ISC_TRUE, mctx, &sigrdata, + result = dns_dnssec_verify3(name, rdataset, dstkey, + ISC_TRUE, + val->view->maxbits, + mctx, &sigrdata, dns_fixedname_name(&fixed)); dst_key_free(&dstkey); if (result != ISC_R_SUCCESS) @@ -1497,8 +1499,9 @@ verify(dns_validator_t *val, dst_key_t *key, dns_rdata_t *rdata, dns_fixedname_init(&fixed); wild = dns_fixedname_name(&fixed); again: - result = dns_dnssec_verify2(val->event->name, val->event->rdataset, - key, ignore, val->view->mctx, rdata, wild); + result = dns_dnssec_verify3(val->event->name, val->event->rdataset, + key, ignore, val->view->maxbits, + val->view->mctx, rdata, wild); if ((result == DNS_R_SIGEXPIRED || result == DNS_R_SIGFUTURE) && val->view->acceptexpired) { diff --git a/lib/dns/view.c b/lib/dns/view.c index 5b6ad65..9c1a201 100644 --- a/lib/dns/view.c +++ b/lib/dns/view.c @@ -35,6 +35,7 @@ #include <dns/adb.h> #include <dns/cache.h> #include <dns/db.h> +#include <dns/dispatch.h> #include <dns/dlz.h> #ifdef BIND9 #include <dns/dns64.h> @@ -183,7 +184,6 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass, view->answeracl_exclude = NULL; view->denyanswernames = NULL; view->answernames_exclude = NULL; - view->requestixfr = ISC_TRUE; view->provideixfr = ISC_TRUE; view->maxcachettl = 7 * 24 * 3600; view->maxncachettl = 3 * 3600; @@ -192,6 +192,7 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass, view->flush = ISC_FALSE; view->dlv = NULL; view->maxudp = 0; + view->maxbits = 0; view->v4_aaaa = dns_v4_aaaa_ok; view->v4_aaaa_acl = NULL; ISC_LIST_INIT(view->rpz_zones); @@ -199,6 +200,7 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass, view->rpz_break_dnssec = ISC_FALSE; dns_fixedname_init(&view->dlv_fixed); view->managed_keys = NULL; + view->redirect = NULL; #ifdef BIND9 view->new_zone_file = NULL; view->new_zone_config = NULL; @@ -435,6 +437,8 @@ destroy(dns_view_t *view) { } if (view->managed_keys != NULL) dns_zone_detach(&view->managed_keys); + if (view->redirect != NULL) + dns_zone_detach(&view->redirect); dns_view_setnewzones(view, ISC_FALSE, NULL, NULL); #endif dns_fwdtable_destroy(&view->fwdtable); @@ -486,7 +490,7 @@ view_flushanddetach(dns_view_t **viewp, isc_boolean_t flush) { isc_refcount_decrement(&view->references, &refs); if (refs == 0) { #ifdef BIND9 - dns_zone_t *mkzone = NULL; + dns_zone_t *mkzone = NULL, *rdzone = NULL; #endif LOCK(&view->lock); @@ -509,6 +513,12 @@ view_flushanddetach(dns_view_t **viewp, isc_boolean_t flush) { if (view->flush) dns_zone_flush(mkzone); } + if (view->redirect != NULL) { + rdzone = view->redirect; + view->redirect = NULL; + if (view->flush) + dns_zone_flush(rdzone); + } #endif done = all_done(view); UNLOCK(&view->lock); @@ -517,6 +527,9 @@ view_flushanddetach(dns_view_t **viewp, isc_boolean_t flush) { /* Need to detach zones outside view lock */ if (mkzone != NULL) dns_zone_detach(&mkzone); + + if (rdzone != NULL) + dns_zone_detach(&rdzone); #endif } @@ -661,7 +674,8 @@ req_shutdown(isc_task_t *task, isc_event_t *event) { isc_result_t dns_view_createresolver(dns_view_t *view, - isc_taskmgr_t *taskmgr, unsigned int ntasks, + isc_taskmgr_t *taskmgr, + unsigned int ntasks, unsigned int ndisp, isc_socketmgr_t *socketmgr, isc_timermgr_t *timermgr, unsigned int options, @@ -682,7 +696,7 @@ dns_view_createresolver(dns_view_t *view, return (result); isc_task_setname(view->task, "view", view); - result = dns_resolver_create(view, taskmgr, ntasks, socketmgr, + result = dns_resolver_create(view, taskmgr, ntasks, ndisp, socketmgr, timermgr, options, dispatchmgr, dispatchv4, dispatchv6, &view->resolver); @@ -714,8 +728,7 @@ dns_view_createresolver(dns_view_t *view, result = dns_requestmgr_create(view->mctx, timermgr, socketmgr, dns_resolver_taskmgr(view->resolver), dns_resolver_dispatchmgr(view->resolver), - dns_resolver_dispatchv4(view->resolver), - dns_resolver_dispatchv6(view->resolver), + dispatchv4, dispatchv6, &view->requestmgr); if (result != ISC_R_SUCCESS) { dns_adb_shutdown(view->adb); @@ -1434,6 +1447,7 @@ isc_result_t dns_view_load(dns_view_t *view, isc_boolean_t stop) { REQUIRE(DNS_VIEW_VALID(view)); + REQUIRE(view->zonetable != NULL); return (dns_zt_load(view->zonetable, stop)); } @@ -1442,9 +1456,20 @@ isc_result_t dns_view_loadnew(dns_view_t *view, isc_boolean_t stop) { REQUIRE(DNS_VIEW_VALID(view)); + REQUIRE(view->zonetable != NULL); return (dns_zt_loadnew(view->zonetable, stop)); } + +isc_result_t +dns_view_asyncload(dns_view_t *view, dns_zt_allloaded_t callback, void *arg) { + REQUIRE(DNS_VIEW_VALID(view)); + REQUIRE(view->zonetable != NULL); + + return (dns_zt_asyncload(view->zonetable, callback, arg)); +} + + #endif /* BIND9 */ isc_result_t @@ -1545,16 +1570,23 @@ dns_view_flushcache2(dns_view_t *view, isc_boolean_t fixuponly) { isc_result_t dns_view_flushname(dns_view_t *view, dns_name_t *name) { + return (dns_view_flushnode(view, name, ISC_FALSE)); +} + +isc_result_t +dns_view_flushnode(dns_view_t *view, dns_name_t *name, isc_boolean_t tree) { REQUIRE(DNS_VIEW_VALID(view)); - if (view->adb != NULL) - dns_adb_flushname(view->adb, name); - if (view->cache == NULL) - return (ISC_R_SUCCESS); - if (view->resolver != NULL) - dns_resolver_flushbadcache(view->resolver, name); - return (dns_cache_flushname(view->cache, name)); + if (!tree) { + if (view->adb != NULL) + dns_adb_flushname(view->adb, name); + if (view->cache == NULL) + return (ISC_R_SUCCESS); + if (view->resolver != NULL) + dns_resolver_flushbadcache(view->resolver, name); + } + return (dns_cache_flushnode(view->cache, name, tree)); } isc_result_t diff --git a/lib/dns/xfrin.c b/lib/dns/xfrin.c index 3026af9..813f616 100644 --- a/lib/dns/xfrin.c +++ b/lib/dns/xfrin.c @@ -360,7 +360,7 @@ ixfr_init(dns_xfrin_ctx_t *xfr) { journalfile = dns_zone_getjournal(xfr->zone); if (journalfile != NULL) CHECK(dns_journal_open(xfr->mctx, journalfile, - ISC_TRUE, &xfr->ixfr.journal)); + DNS_JOURNAL_CREATE, &xfr->ixfr.journal)); result = ISC_R_SUCCESS; failure: @@ -631,7 +631,8 @@ dns_xfrin_create2(dns_zone_t *zone, dns_rdatatype_t xfrtype, isc_sockaddr_t *masteraddr, isc_sockaddr_t *sourceaddr, dns_tsigkey_t *tsigkey, isc_mem_t *mctx, isc_timermgr_t *timermgr, isc_socketmgr_t *socketmgr, - isc_task_t *task, dns_xfrindone_t done, dns_xfrin_ctx_t **xfrp) + isc_task_t *task, dns_xfrindone_t done, + dns_xfrin_ctx_t **xfrp) { dns_name_t *zonename = dns_zone_getorigin(zone); dns_xfrin_ctx_t *xfr = NULL; diff --git a/lib/dns/zone.c b/lib/dns/zone.c index c212bf6..10ba807 100644 --- a/lib/dns/zone.c +++ b/lib/dns/zone.c @@ -23,16 +23,18 @@ #include <errno.h> #include <isc/file.h> +#include <isc/hex.h> #include <isc/mutex.h> +#include <isc/pool.h> #include <isc/print.h> #include <isc/random.h> #include <isc/ratelimiter.h> #include <isc/refcount.h> #include <isc/rwlock.h> #include <isc/serial.h> -#include <isc/strerror.h> #include <isc/stats.h> #include <isc/stdtime.h> +#include <isc/strerror.h> #include <isc/string.h> #include <isc/taskpool.h> #include <isc/timer.h> @@ -61,6 +63,7 @@ #include <dns/private.h> #include <dns/rbt.h> #include <dns/rcode.h> +#include <dns/rdata.h> #include <dns/rdataclass.h> #include <dns/rdatalist.h> #include <dns/rdataset.h> @@ -76,8 +79,10 @@ #include <dns/stats.h> #include <dns/time.h> #include <dns/tsig.h> +#include <dns/update.h> #include <dns/xfrin.h> #include <dns/zone.h> +#include <dns/zt.h> #include <dst/dst.h> @@ -145,6 +150,7 @@ typedef ISC_LIST(dns_signing_t) dns_signinglist_t; typedef struct dns_nsec3chain dns_nsec3chain_t; typedef ISC_LIST(dns_nsec3chain_t) dns_nsec3chainlist_t; typedef struct dns_keyfetch dns_keyfetch_t; +typedef struct dns_asyncload dns_asyncload_t; #define DNS_ZONE_CHECKLOCK #ifdef DNS_ZONE_CHECKLOCK @@ -217,6 +223,7 @@ struct dns_zone { isc_time_t signingtime; isc_time_t nsec3chaintime; isc_time_t refreshkeytime; + isc_uint32_t refreshkeyinterval; isc_uint32_t refreshkeycount; isc_uint32_t refresh; isc_uint32_t retry; @@ -239,9 +246,11 @@ struct dns_zone { isc_sockaddr_t masteraddr; dns_notifytype_t notifytype; isc_sockaddr_t *notify; + dns_name_t **notifykeynames; unsigned int notifycnt; isc_sockaddr_t notifyfrom; isc_task_t *task; + isc_task_t *loadtask; isc_sockaddr_t notifysrc4; isc_sockaddr_t notifysrc6; isc_sockaddr_t xfrsource4; @@ -297,8 +306,10 @@ struct dns_zone { * Optional per-zone statistics counters. Counted outside of this * module. */ + dns_zonestat_level_t statlevel; isc_boolean_t requeststats_on; isc_stats_t *requeststats; + dns_stats_t *rcvquerystats; isc_uint32_t notifydelay; dns_isselffunc_t isself; void *isselfarg; @@ -340,9 +351,25 @@ struct dns_zone { isc_boolean_t is_rpz; /*% + * Serial number update method. + */ + dns_updatemethod_t updatemethod; + + /*% + * whether ixfr is requested + */ + isc_boolean_t requestixfr; + + /*% * Outstanding forwarded UPDATE requests. */ dns_forwardlist_t forwards; + + dns_zone_t *raw; + dns_zone_t *secure; + + isc_boolean_t sourceserialset; + isc_uint32_t sourceserial; }; typedef struct { @@ -403,8 +430,9 @@ typedef struct { #define DNS_ZONEFLG_NEEDCOMPACT 0x02000000U #define DNS_ZONEFLG_REFRESHING 0x04000000U /*%< Refreshing keydata */ #define DNS_ZONEFLG_THAW 0x08000000U -/* #define DNS_ZONEFLG_XXXXX 0x10000000U XXXMPA unused. */ +#define DNS_ZONEFLG_LOADPENDING 0x10000000U /*%< Loading scheduled */ #define DNS_ZONEFLG_NODELAY 0x20000000U +#define DNS_ZONEFLG_SENDSECURE 0x40000000U #define DNS_ZONE_OPTION(z,o) (((z)->options & (o)) != 0) #define DNS_ZONEKEY_OPTION(z,o) (((z)->keyopts & (o)) != 0) @@ -437,7 +465,9 @@ struct dns_zonemgr { isc_timermgr_t * timermgr; isc_socketmgr_t * socketmgr; isc_taskpool_t * zonetasks; + isc_taskpool_t * loadtasks; isc_task_t * task; + isc_pool_t * mctxpool; isc_ratelimiter_t * rl; isc_rwlock_t rwlock; isc_mutex_t iolock; @@ -476,6 +506,7 @@ struct dns_notify { dns_request_t *request; dns_name_t ns; isc_sockaddr_t dst; + dns_tsigkey_t *key; ISC_LINK(dns_notify_t) link; }; @@ -594,6 +625,15 @@ struct dns_keyfetch { dns_fetch_t *fetch; }; +/*% + * Hold state for an asynchronous load + */ +struct dns_asyncload { + dns_zone_t *zone; + dns_zt_zoneloaded_t loaded; + void *loaded_arg; +}; + #define HOUR 3600 #define DAY (24*HOUR) #define MONTH (30*DAY) @@ -632,6 +672,9 @@ static void zone_namerd_tostr(dns_zone_t *zone, char *buf, size_t length); static void zone_name_tostr(dns_zone_t *zone, char *buf, size_t length); static void zone_rdclass_tostr(dns_zone_t *zone, char *buf, size_t length); static void zone_viewname_tostr(dns_zone_t *zone, char *buf, size_t length); +static isc_result_t zone_send_secureserial(dns_zone_t *zone, + isc_boolean_t secure_locked, + isc_uint32_t serial); #if 0 /* ondestroy example */ @@ -688,6 +731,8 @@ static isc_result_t delete_nsec(dns_db_t *db, dns_dbversion_t *ver, static void zone_rekey(dns_zone_t *zone); static isc_boolean_t delsig_ok(dns_rdata_rrsig_t *rrsig_ptr, dst_key_t **keys, unsigned int nkeys); +static isc_result_t zone_send_securedb(dns_zone_t *zone, isc_boolean_t locked, + dns_db_t *db); #define ENTER zone_debuglog(zone, me, 1, "enter") @@ -798,6 +843,7 @@ dns_zone_create(dns_zone_t **zonep, isc_mem_t *mctx) { isc_time_settoepoch(&zone->signingtime); isc_time_settoepoch(&zone->nsec3chaintime); isc_time_settoepoch(&zone->refreshkeytime); + zone->refreshkeyinterval = 0; zone->refreshkeycount = 0; zone->refresh = DNS_ZONE_DEFAULTREFRESH; zone->retry = DNS_ZONE_DEFAULTRETRY; @@ -813,9 +859,11 @@ dns_zone_create(dns_zone_t **zonep, isc_mem_t *mctx) { zone->masterscnt = 0; zone->curmaster = 0; zone->notify = NULL; + zone->notifykeynames = NULL; zone->notifytype = dns_notifytype_yes; zone->notifycnt = 0; zone->task = NULL; + zone->loadtask = NULL; zone->update_acl = NULL; zone->forward_acl = NULL; zone->notify_acl = NULL; @@ -857,7 +905,9 @@ dns_zone_create(dns_zone_t **zonep, isc_mem_t *mctx) { zone->statelist = NULL; zone->stats = NULL; zone->requeststats_on = ISC_FALSE; + zone->statlevel = dns_zonestat_none; zone->requeststats = NULL; + zone->rcvquerystats = NULL; zone->notifydelay = 5; zone->isself = NULL; zone->isselfarg = NULL; @@ -869,6 +919,10 @@ dns_zone_create(dns_zone_t **zonep, isc_mem_t *mctx) { zone->added = ISC_FALSE; zone->is_rpz = ISC_FALSE; ISC_LIST_INIT(zone->forwards); + zone->raw = NULL; + zone->secure = NULL; + zone->sourceserial = 0; + zone->sourceserialset = ISC_FALSE; zone->magic = ZONE_MAGIC; @@ -925,6 +979,8 @@ zone_free(dns_zone_t *zone) { if (zone->task != NULL) isc_task_detach(&zone->task); + if (zone->loadtask != NULL) + isc_task_detach(&zone->loadtask); if (zone->zmgr != NULL) dns_zonemgr_releasezone(zone->zmgr, zone); @@ -959,6 +1015,8 @@ zone_free(dns_zone_t *zone) { isc_stats_detach(&zone->stats); if (zone->requeststats != NULL) isc_stats_detach(&zone->requeststats); + if(zone->rcvquerystats != NULL ) + dns_stats_detach(&zone->rcvquerystats); if (zone->db != NULL) zone_detachdb(zone); if (zone->acache != NULL) @@ -1005,6 +1063,30 @@ zone_free(dns_zone_t *zone) { } /* + * Returns ISC_TRUE iff this the signed side of an inline-signing zone. + * Caller should hold zone lock. + */ +static inline isc_boolean_t +inline_secure(dns_zone_t *zone) { + REQUIRE(DNS_ZONE_VALID(zone)); + if (zone->raw != NULL) + return (ISC_TRUE); + return (ISC_FALSE); +} + +/* + * Returns ISC_TRUE iff this the unsigned side of an inline-signing zone + * Caller should hold zone lock. + */ +static inline isc_boolean_t +inline_raw(dns_zone_t *zone) { + REQUIRE(DNS_ZONE_VALID(zone)); + if (zone->secure != NULL) + return (ISC_TRUE); + return (ISC_FALSE); +} + +/* * Single shot. */ void @@ -1032,6 +1114,8 @@ dns_zone_setclass(dns_zone_t *zone, dns_rdataclass_t rdclass) { zone_rdclass_tostr(zone, namebuf, sizeof namebuf); zone->strrdclass = isc_mem_strdup(zone->mctx, namebuf); + if (inline_secure(zone)) + dns_zone_setclass(zone->raw, rdclass); UNLOCK_ZONE(zone); } @@ -1092,6 +1176,7 @@ dns_zone_getserial(dns_zone_t *zone) { */ void dns_zone_settype(dns_zone_t *zone, dns_zonetype_t type) { + char namebuf[1024]; REQUIRE(DNS_ZONE_VALID(zone)); REQUIRE(type != dns_zone_none); @@ -1102,6 +1187,12 @@ dns_zone_settype(dns_zone_t *zone, dns_zonetype_t type) { LOCK_ZONE(zone); REQUIRE(zone->type == dns_zone_none || zone->type == type); zone->type = type; + + if (zone->strnamerd != NULL) + isc_mem_free(zone->mctx, zone->strnamerd); + + zone_namerd_tostr(zone, namebuf, sizeof namebuf); + zone->strnamerd = isc_mem_strdup(zone->mctx, namebuf); UNLOCK_ZONE(zone); } @@ -1220,10 +1311,12 @@ dns_zone_setview(dns_zone_t *zone, dns_view_t *view) { zone_viewname_tostr(zone, namebuf, sizeof namebuf); zone->strviewname = isc_mem_strdup(zone->mctx, namebuf); + if (inline_secure(zone)) + dns_zone_setview(zone->raw, view); + UNLOCK_ZONE(zone); } - dns_view_t * dns_zone_getview(dns_zone_t *zone) { REQUIRE(DNS_ZONE_VALID(zone)); @@ -1257,6 +1350,8 @@ dns_zone_setorigin(dns_zone_t *zone, const dns_name_t *origin) { zone_name_tostr(zone, namebuf, sizeof namebuf); zone->strname = isc_mem_strdup(zone->mctx, namebuf); + if (result == ISC_R_SUCCESS && inline_secure(zone)) + result = dns_zone_setorigin(zone->raw, origin); UNLOCK_ZONE(zone); return (result); } @@ -1394,16 +1489,24 @@ dns_zone_getjournal(dns_zone_t *zone) { * allow dynamic updates either by having an update policy ("ssutable") * or an "allow-update" ACL with a value other than exactly "{ none; }". */ -static isc_boolean_t -zone_isdynamic(dns_zone_t *zone) { +isc_boolean_t +dns_zone_isdynamic(dns_zone_t *zone, isc_boolean_t ignore_freeze) { REQUIRE(DNS_ZONE_VALID(zone)); - return (ISC_TF(zone->type == dns_zone_slave || - zone->type == dns_zone_stub || - zone->type == dns_zone_key || - (!zone->update_disabled && zone->ssutable != NULL) || - (!zone->update_disabled && zone->update_acl != NULL && - !dns_acl_isnone(zone->update_acl)))); + if (zone->type == dns_zone_slave || zone->type == dns_zone_stub || + zone->type == dns_zone_key || + (zone->type == dns_zone_redirect && zone->masters != NULL)) + return (ISC_TRUE); + + /* If !ignore_freeze, we need check whether updates are disabled. */ + if (zone->type == dns_zone_master && + (!zone->update_disabled || ignore_freeze) && + ((zone->ssutable != NULL) || + (zone->update_acl != NULL && !dns_acl_isnone(zone->update_acl)))) + return (ISC_TRUE); + + return (ISC_FALSE); + } /* @@ -1437,11 +1540,21 @@ zone_load(dns_zone_t *zone, unsigned int flags) { isc_time_t now; isc_time_t loadtime, filetime; dns_db_t *db = NULL; - isc_boolean_t rbt; + isc_boolean_t rbt, hasraw; REQUIRE(DNS_ZONE_VALID(zone)); LOCK_ZONE(zone); + hasraw = inline_secure(zone); + if (hasraw) { + result = zone_load(zone->raw, flags); + if (result != ISC_R_SUCCESS) { + UNLOCK_ZONE(zone); + return(result); + } + LOCK_ZONE(zone->raw); + } + TIME_NOW(&now); INSIST(zone->type != dns_zone_none); @@ -1453,7 +1566,6 @@ zone_load(dns_zone_t *zone, unsigned int flags) { goto cleanup; } - INSIST(zone->db_argc >= 1); rbt = strcmp(zone->db_argv[0], "rbt") == 0 || @@ -1467,7 +1579,7 @@ zone_load(dns_zone_t *zone, unsigned int flags) { goto cleanup; } - if (zone->db != NULL && zone_isdynamic(zone)) { + if (zone->db != NULL && dns_zone_isdynamic(zone, ISC_FALSE)) { /* * This is a slave, stub, or dynamically updated * zone being reloaded. Do nothing - the database @@ -1531,7 +1643,8 @@ zone_load(dns_zone_t *zone, unsigned int flags) { goto cleanup; } - if ((zone->type == dns_zone_slave || zone->type == dns_zone_stub) && + if ((zone->type == dns_zone_slave || zone->type == dns_zone_stub || + (zone->type == dns_zone_redirect && zone->masters != NULL)) && rbt) { if (zone->masterfile == NULL || !isc_file_exists(zone->masterfile)) { @@ -1569,7 +1682,9 @@ zone_load(dns_zone_t *zone, unsigned int flags) { result = zone_startload(db, zone, loadtime); } else { result = DNS_R_NOMASTERFILE; - if (zone->type == dns_zone_master) { + if (zone->type == dns_zone_master || + (zone->type == dns_zone_redirect && + zone->masters == NULL)) { dns_zone_log(zone, ISC_LOG_ERROR, "loading zone: " "no master file configured"); @@ -1590,6 +1705,8 @@ zone_load(dns_zone_t *zone, unsigned int flags) { result = zone_postload(zone, db, loadtime, result); cleanup: + if (hasraw) + UNLOCK_ZONE(zone->raw); UNLOCK_ZONE(zone); if (db != NULL) dns_db_detach(&db); @@ -1606,17 +1723,100 @@ dns_zone_loadnew(dns_zone_t *zone) { return (zone_load(zone, DNS_ZONELOADFLAG_NOSTAT)); } +static void +zone_asyncload(isc_task_t *task, isc_event_t *event) { + dns_asyncload_t *asl = event->ev_arg; + dns_zone_t *zone = asl->zone; + isc_result_t result = ISC_R_SUCCESS; + + UNUSED(task); + + REQUIRE(DNS_ZONE_VALID(zone)); + + if ((event->ev_attributes & ISC_EVENTATTR_CANCELED) != 0) + result = ISC_R_CANCELED; + isc_event_free(&event); + if (result == ISC_R_CANCELED || + !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADPENDING)) + goto cleanup; + + zone_load(zone, 0); + + LOCK_ZONE(zone); + DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_LOADPENDING); + UNLOCK_ZONE(zone); + + /* Inform the zone table we've finished loading */ + if (asl->loaded != NULL) + (asl->loaded)(asl->loaded_arg, zone, task); + + cleanup: + isc_mem_put(zone->mctx, asl, sizeof (*asl)); + dns_zone_idetach(&zone); +} + +isc_result_t +dns_zone_asyncload(dns_zone_t *zone, dns_zt_zoneloaded_t done, void *arg) { + isc_event_t *e; + dns_asyncload_t *asl = NULL; + isc_result_t result = ISC_R_SUCCESS; + + REQUIRE(DNS_ZONE_VALID(zone)); + + if (zone->zmgr == NULL) + return (ISC_R_FAILURE); + + asl = isc_mem_get(zone->mctx, sizeof (*asl)); + if (asl == NULL) + CHECK(ISC_R_NOMEMORY); + + asl->zone = NULL; + asl->loaded = done; + asl->loaded_arg = arg; + + e = isc_event_allocate(zone->zmgr->mctx, zone->zmgr, + DNS_EVENT_ZONELOAD, + zone_asyncload, asl, + sizeof(isc_event_t)); + if (e == NULL) + CHECK(ISC_R_NOMEMORY); + + LOCK_ZONE(zone); + zone_iattach(zone, &asl->zone); + DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_LOADPENDING); + isc_task_send(zone->loadtask, &e); + UNLOCK_ZONE(zone); + + return (ISC_R_SUCCESS); + + failure: + if (asl != NULL) + isc_mem_put(zone->mctx, asl, sizeof (*asl)); + return (result); +} + +isc_boolean_t +dns__zone_loadpending(dns_zone_t *zone) { + REQUIRE(DNS_ZONE_VALID(zone)); + + return (ISC_TF(DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADPENDING))); +} + isc_result_t dns_zone_loadandthaw(dns_zone_t *zone) { isc_result_t result; - result = zone_load(zone, DNS_ZONELOADFLAG_THAW); + if (inline_raw(zone)) + result = zone_load(zone->secure, DNS_ZONELOADFLAG_THAW); + else + result = zone_load(zone, DNS_ZONELOADFLAG_THAW); + switch (result) { case DNS_R_CONTINUE: /* Deferred thaw. */ break; - case ISC_R_SUCCESS: case DNS_R_UPTODATE: + case ISC_R_SUCCESS: case DNS_R_SEENINCLUDE: zone->update_disabled = ISC_FALSE; break; @@ -1635,7 +1835,8 @@ get_master_options(dns_zone_t *zone) { unsigned int options; options = DNS_MASTER_ZONE; - if (zone->type == dns_zone_slave) + if (zone->type == dns_zone_slave || + (zone->type == dns_zone_redirect && zone->masters == NULL)) options |= DNS_MASTER_SLAVE; if (zone->type == dns_zone_key) options |= DNS_MASTER_KEY; @@ -1653,9 +1854,9 @@ get_master_options(dns_zone_t *zone) { options |= DNS_MASTER_CHECKMXFAIL; if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_CHECKWILDCARD)) options |= DNS_MASTER_CHECKWILDCARD; - if (zone->type == dns_zone_master && + if (inline_secure(zone) || (zone->type == dns_zone_master && ((zone->update_acl != NULL && !dns_acl_isnone(zone->update_acl)) || - zone->ssutable != NULL)) + zone->ssutable != NULL))) options |= DNS_MASTER_RESIGN; return (options); } @@ -1679,8 +1880,7 @@ zone_gotreadhandle(isc_task_t *task, isc_event_t *event) { result = dns_master_loadfileinc3(load->zone->masterfile, dns_db_origin(load->db), dns_db_origin(load->db), - load->zone->rdclass, - options, + load->zone->rdclass, options, load->zone->sigresigninginterval, &load->callbacks, task, zone_loaddone, load, @@ -1696,11 +1896,29 @@ zone_gotreadhandle(isc_task_t *task, isc_event_t *event) { } static void +get_raw_serial(dns_zone_t *raw, dns_masterrawheader_t *rawdata) { + isc_result_t result; + unsigned int soacount; + + LOCK(&raw->lock); + if (raw->db != NULL) { + result = zone_get_from_db(raw, raw->db, NULL, &soacount, + &rawdata->sourceserial, + NULL, NULL, NULL, NULL, + NULL); + if (result == ISC_R_SUCCESS && soacount > 0U) + rawdata->flags |= DNS_MASTERRAW_SOURCESERIALSET; + } + UNLOCK(&raw->lock); +} + +static void zone_gotwritehandle(isc_task_t *task, isc_event_t *event) { const char me[] = "zone_gotwritehandle"; dns_zone_t *zone = event->ev_arg; isc_result_t result = ISC_R_SUCCESS; dns_dbversion_t *version = NULL; + dns_masterrawheader_t rawdata; REQUIRE(DNS_ZONE_VALID(zone)); INSIST(task == zone->task); @@ -1716,11 +1934,14 @@ zone_gotwritehandle(isc_task_t *task, isc_event_t *event) { ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read); if (zone->db != NULL) { dns_db_currentversion(zone->db, &version); - result = dns_master_dumpinc2(zone->mctx, zone->db, version, + dns_master_initrawheader(&rawdata); + if (inline_secure(zone)) + get_raw_serial(zone->raw, &rawdata); + result = dns_master_dumpinc3(zone->mctx, zone->db, version, &dns_master_style_default, zone->masterfile, zone->task, dump_done, zone, &zone->dctx, - zone->masterformat); + zone->masterformat, &rawdata); dns_db_closeversion(zone->db, &version, ISC_FALSE); } else result = ISC_R_CANCELED; @@ -1734,6 +1955,31 @@ zone_gotwritehandle(isc_task_t *task, isc_event_t *event) { dump_done(zone, result); } +/* + * Save the raw serial number for inline-signing zones. + * (XXX: Other information from the header will be used + * for other purposes in the future, but for now this is + * all we're interested in.) + */ +static void +zone_setrawdata(dns_zone_t *zone, dns_masterrawheader_t *header) { + if ((header->flags & DNS_MASTERRAW_SOURCESERIALSET) == 0) + return; + + zone->sourceserial = header->sourceserial; + zone->sourceserialset = ISC_TRUE; +} + +void +dns_zone_setrawdata(dns_zone_t *zone, dns_masterrawheader_t *header) { + if (zone == NULL) + return; + + LOCK_ZONE(zone); + zone_setrawdata(zone, header); + UNLOCK_ZONE(zone); +} + static isc_result_t zone_startload(dns_db_t *db, dns_zone_t *zone, isc_time_t loadtime) { dns_load_t *load; @@ -1753,7 +1999,7 @@ zone_startload(dns_db_t *db, dns_zone_t *zone, isc_time_t loadtime) { if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_MANYERRORS)) options |= DNS_MASTER_MANYERRORS; - if (zone->zmgr != NULL && zone->db != NULL && zone->task != NULL) { + if (zone->zmgr != NULL && zone->db != NULL && zone->loadtask != NULL) { load = isc_mem_get(zone->mctx, sizeof(*load)); if (load == NULL) return (ISC_R_NOMEMORY); @@ -1768,11 +2014,13 @@ zone_startload(dns_db_t *db, dns_zone_t *zone, isc_time_t loadtime) { zone_iattach(zone, &load->zone); dns_db_attach(db, &load->db); dns_rdatacallbacks_init(&load->callbacks); + load->callbacks.rawdata = zone_setrawdata; + zone_iattach(zone, &load->callbacks.zone); result = dns_db_beginload(db, &load->callbacks.add, &load->callbacks.add_private); if (result != ISC_R_SUCCESS) goto cleanup; - result = zonemgr_getio(zone->zmgr, ISC_TRUE, zone->task, + result = zonemgr_getio(zone->zmgr, ISC_TRUE, zone->loadtask, zone_gotreadhandle, load, &zone->readio); if (result != ISC_R_SUCCESS) { @@ -1789,18 +2037,24 @@ zone_startload(dns_db_t *db, dns_zone_t *zone, isc_time_t loadtime) { dns_rdatacallbacks_t callbacks; dns_rdatacallbacks_init(&callbacks); + callbacks.rawdata = zone_setrawdata; + zone_iattach(zone, &callbacks.zone); result = dns_db_beginload(db, &callbacks.add, &callbacks.add_private); - if (result != ISC_R_SUCCESS) + if (result != ISC_R_SUCCESS) { + zone_idetach(&callbacks.zone); return (result); - result = dns_master_loadfile3(zone->masterfile, &zone->origin, - &zone->origin, zone->rdclass, - options, zone->sigresigninginterval, + } + result = dns_master_loadfile3(zone->masterfile, + &zone->origin, &zone->origin, + zone->rdclass, options, + zone->sigresigninginterval, &callbacks, zone->mctx, zone->masterformat); tresult = dns_db_endload(db, &callbacks.add_private); if (result == ISC_R_SUCCESS) result = tresult; + zone_idetach(&callbacks.zone); } return (result); @@ -1809,6 +2063,7 @@ zone_startload(dns_db_t *db, dns_zone_t *zone, isc_time_t loadtime) { load->magic = 0; dns_db_detach(&load->db); zone_idetach(&load->zone); + zone_idetach(&load->callbacks.zone); isc_mem_detach(&load->mctx); isc_mem_put(zone->mctx, load, sizeof(*load)); return (result); @@ -2531,13 +2786,22 @@ resume_signingwithkey(dns_zone_t *zone) { static isc_result_t zone_addnsec3chain(dns_zone_t *zone, dns_rdata_nsec3param_t *nsec3param) { dns_nsec3chain_t *nsec3chain, *current; + dns_dbversion_t *version = NULL; + isc_boolean_t nseconly = ISC_FALSE, nsec3ok = ISC_FALSE; isc_result_t result; isc_time_t now; unsigned int options = 0; char saltbuf[255*2+1]; - char flags[sizeof("REMOVE|CREATE|NONSEC|OPTOUT")]; + char flags[sizeof("INITIAL|REMOVE|CREATE|NONSEC|OPTOUT")]; int i; + dns_db_currentversion(zone->db, &version); + result = dns_nsec_nseconly(zone->db, version, &nseconly); + nsec3ok = (result == ISC_R_SUCCESS && !nseconly); + dns_db_closeversion(zone->db, &version, ISC_FALSE); + if (!nsec3ok && (nsec3param->flags & DNS_NSEC3FLAG_REMOVE) == 0) + return (ISC_R_SUCCESS); + nsec3chain = isc_mem_get(zone->mctx, sizeof *nsec3chain); if (nsec3chain == NULL) return (ISC_R_NOMEMORY); @@ -2564,6 +2828,12 @@ zone_addnsec3chain(dns_zone_t *zone, dns_rdata_nsec3param_t *nsec3param) { flags[0] = '\0'; if (nsec3param->flags & DNS_NSEC3FLAG_REMOVE) strlcat(flags, "REMOVE", sizeof(flags)); + if (nsec3param->flags & DNS_NSEC3FLAG_INITIAL) { + if (flags[0] == '\0') + strlcpy(flags, "INITIAL", sizeof(flags)); + else + strlcat(flags, "|INITIAL", sizeof(flags)); + } if (nsec3param->flags & DNS_NSEC3FLAG_CREATE) { if (flags[0] == '\0') strlcpy(flags, "CREATE", sizeof(flags)); @@ -2592,6 +2862,7 @@ zone_addnsec3chain(dns_zone_t *zone, dns_rdata_nsec3param_t *nsec3param) { "zone_addnsec3chain(%u,%s,%u,%s)", nsec3param->hash, flags, nsec3param->iterations, saltbuf); + for (current = ISC_LIST_HEAD(zone->nsec3chain); current != NULL; current = ISC_LIST_NEXT(current, link)) { @@ -2644,6 +2915,7 @@ resume_addnsec3chain(dns_zone_t *zone) { dns_rdataset_t rdataset; isc_result_t result; dns_rdata_nsec3param_t nsec3param; + isc_boolean_t nseconly = ISC_FALSE, nsec3ok = ISC_FALSE; if (zone->privatetype == 0) return; @@ -2653,6 +2925,10 @@ resume_addnsec3chain(dns_zone_t *zone) { goto cleanup; dns_db_currentversion(zone->db, &version); + + result = dns_nsec_nseconly(zone->db, version, &nseconly); + nsec3ok = (result == ISC_R_SUCCESS && !nseconly); + dns_rdataset_init(&rdataset); result = dns_db_findrdataset(zone->db, node, version, zone->privatetype, dns_rdatatype_none, @@ -2676,8 +2952,9 @@ resume_addnsec3chain(dns_zone_t *zone) { continue; result = dns_rdata_tostruct(&rdata, &nsec3param, NULL); RUNTIME_CHECK(result == ISC_R_SUCCESS); - if ((nsec3param.flags & DNS_NSEC3FLAG_CREATE) != 0 || - (nsec3param.flags & DNS_NSEC3FLAG_REMOVE) != 0) { + if (((nsec3param.flags & DNS_NSEC3FLAG_REMOVE) != 0) || + ((nsec3param.flags & DNS_NSEC3FLAG_CREATE) != 0 && nsec3ok)) + { result = zone_addnsec3chain(zone, &nsec3param); if (result != ISC_R_SUCCESS) { dns_zone_log(zone, ISC_LOG_ERROR, @@ -2727,7 +3004,7 @@ check_nsec3param(dns_zone_t *zone, dns_db_t *db) { isc_result_t result; dns_rdata_t rdata = DNS_RDATA_INIT; isc_boolean_t dynamic = (zone->type == dns_zone_master) ? - zone_isdynamic(zone) : ISC_FALSE; + dns_zone_isdynamic(zone, ISC_FALSE) : ISC_FALSE; dns_rdataset_init(&rdataset); result = dns_db_findnode(db, &zone->origin, ISC_FALSE, &node); @@ -3149,8 +3426,8 @@ update_one_rr(dns_db_t *db, dns_dbversion_t *ver, dns_diff_t *diff, } static isc_result_t -increment_soa_serial(dns_db_t *db, dns_dbversion_t *ver, - dns_diff_t *diff, isc_mem_t *mctx) { +update_soa_serial(dns_db_t *db, dns_dbversion_t *ver, dns_diff_t *diff, + isc_mem_t *mctx, dns_updatemethod_t method) { dns_difftuple_t *deltuple = NULL; dns_difftuple_t *addtuple = NULL; isc_uint32_t serial; @@ -3161,12 +3438,7 @@ increment_soa_serial(dns_db_t *db, dns_dbversion_t *ver, addtuple->op = DNS_DIFFOP_ADD; serial = dns_soa_getserial(&addtuple->rdata); - - /* RFC1982 */ - serial = (serial + 1) & 0xFFFFFFFF; - if (serial == 0) - serial = 1; - + serial = dns_update_soaserial(serial, method); dns_soa_setserial(serial, &addtuple->rdata); CHECK(do_one_tuple(&deltuple, db, ver, diff)); CHECK(do_one_tuple(&addtuple, db, ver, diff)); @@ -3184,17 +3456,20 @@ increment_soa_serial(dns_db_t *db, dns_dbversion_t *ver, * Write all transactions in 'diff' to the zone journal file. */ static isc_result_t -zone_journal(dns_zone_t *zone, dns_diff_t *diff, const char *caller) { +zone_journal(dns_zone_t *zone, dns_diff_t *diff, isc_uint32_t *sourceserial, + const char *caller) +{ const char me[] = "zone_journal"; const char *journalfile; isc_result_t result = ISC_R_SUCCESS; dns_journal_t *journal = NULL; + unsigned int mode = DNS_JOURNAL_CREATE|DNS_JOURNAL_WRITE; ENTER; journalfile = dns_zone_getjournal(zone); if (journalfile != NULL) { - result = dns_journal_open(zone->mctx, journalfile, - ISC_TRUE, &journal); + result = dns_journal_open(zone->mctx, journalfile, mode, + &journal); if (result != ISC_R_SUCCESS) { dns_zone_log(zone, ISC_LOG_ERROR, "%s:dns_journal_open -> %s", @@ -3202,15 +3477,18 @@ zone_journal(dns_zone_t *zone, dns_diff_t *diff, const char *caller) { return (result); } + if (sourceserial != NULL) + dns_journal_set_sourceserial(journal, *sourceserial); + result = dns_journal_write_transaction(journal, diff); - dns_journal_destroy(&journal); if (result != ISC_R_SUCCESS) { dns_zone_log(zone, ISC_LOG_ERROR, "%s:dns_journal_write_transaction -> %s", caller, dns_result_totext(result)); - return (result); } + dns_journal_destroy(&journal); } + return (result); } @@ -3391,8 +3669,9 @@ sync_keyzone(dns_zone_t *zone, dns_db_t *db) { if (changed) { /* Write changes to journal file. */ - CHECK(increment_soa_serial(db, ver, &diff, zone->mctx)); - CHECK(zone_journal(zone, &diff, "sync_keyzone")); + CHECK(update_soa_serial(db, ver, &diff, zone->mctx, + zone->updatemethod)); + CHECK(zone_journal(zone, &diff, NULL, "sync_keyzone")); DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_LOADED); zone_needdump(zone, 30); @@ -3418,6 +3697,73 @@ sync_keyzone(dns_zone_t *zone, dns_db_t *db) { return (result); } +isc_result_t +dns_zone_synckeyzone(dns_zone_t *zone) { + isc_result_t result; + dns_db_t *db = NULL; + + if (zone->type != dns_zone_key) + return (DNS_R_BADZONE); + + CHECK(dns_zone_getdb(zone, &db)); + + LOCK_ZONE(zone); + result = sync_keyzone(zone, db); + UNLOCK_ZONE(zone); + + failure: + if (db != NULL) + dns_db_detach(&db); + return (result); +} + +static void +maybe_send_secure(dns_zone_t *zone) { + isc_result_t result; + + /* + * We've finished loading, or else failed to load, an inline-signing + * 'secure' zone. We now need information about the status of the + * 'raw' zone. If we failed to load, then we need it to send a + * copy of its database; if we succeeded, we need it to send its + * serial number so that we can sync with it. If it has not yet + * loaded, we set a flag so that it will send the necessary + * information when it has finished loading. + */ + if (zone->raw->db != NULL) { + if (zone->db != NULL) { + isc_uint32_t serial; + unsigned int soacount; + + result = zone_get_from_db(zone->raw, zone->raw->db, + NULL, &soacount, &serial, NULL, + NULL, NULL, NULL, NULL); + if (result == ISC_R_SUCCESS && soacount > 0U) + zone_send_secureserial(zone->raw, ISC_TRUE, serial); + } else + zone_send_securedb(zone->raw, ISC_TRUE, zone->raw->db); + + } else + DNS_ZONE_SETFLAG(zone->raw, DNS_ZONEFLG_SENDSECURE); +} + +static isc_boolean_t +zone_unchanged(dns_db_t *db1, dns_db_t *db2, isc_mem_t *mctx) { + isc_result_t result; + isc_boolean_t answer = ISC_FALSE; + dns_diff_t diff; + + dns_diff_init(mctx, &diff); + result = dns_db_diffx(&diff, db1, NULL, db2, NULL, NULL); + if (result == ISC_R_SUCCESS && ISC_LIST_EMPTY(diff.tuples)) + answer = ISC_TRUE; + dns_diff_clear(&diff); + return (answer); +} + +/* + * The zone is presumed to be locked. + */ static isc_result_t zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime, isc_result_t result) @@ -3441,7 +3787,9 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime, */ if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE) { if (zone->type == dns_zone_slave || - zone->type == dns_zone_stub) { + zone->type == dns_zone_stub || + (zone->type == dns_zone_redirect && + zone->masters == NULL)) { if (result == ISC_R_FILENOTFOUND) dns_zone_log(zone, ISC_LOG_DEBUG(1), "no master file"); @@ -3451,6 +3799,12 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime, "failed: %s", zone->masterfile, dns_result_totext(result)); + } else if (zone->type == dns_zone_master && + inline_secure(zone) && result == ISC_R_FILENOTFOUND) + { + dns_zone_log(zone, ISC_LOG_DEBUG(1), + "no master file, requesting db"); + maybe_send_secure(zone); } else { int level = ISC_LOG_ERROR; if (zone->type == dns_zone_key && @@ -3510,6 +3864,8 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime, "journal rollforward failed: %s", dns_result_totext(result)); goto cleanup; + + } if (result == ISC_R_NOTFOUND || result == ISC_R_RANGE) { dns_zone_log(zone, ISC_LOG_ERROR, @@ -3525,7 +3881,6 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime, needdump = ISC_TRUE; } - dns_zone_log(zone, ISC_LOG_DEBUG(1), "loaded; checking validity"); /* * Obtain ns, soa and cname counts for top of zone. */ @@ -3539,6 +3894,46 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime, } /* + * Check to make sure the journal is up to date, and remove the + * journal file if it isn't, as we wouldn't be able to apply + * updates otherwise. + */ + if (zone->journal != NULL && dns_zone_isdynamic(zone, ISC_TRUE) && + ! DNS_ZONE_OPTION(zone, DNS_ZONEOPT_IXFRFROMDIFFS)) { + isc_uint32_t jserial; + dns_journal_t *journal = NULL; + + result = dns_journal_open(zone->mctx, zone->journal, + DNS_JOURNAL_READ, &journal); + if (result == ISC_R_SUCCESS) { + jserial = dns_journal_last_serial(journal); + dns_journal_destroy(&journal); + } else { + jserial = serial; + result = ISC_R_SUCCESS; + } + + if (jserial != serial) { + dns_zone_log(zone, ISC_LOG_INFO, + "journal file is out of date: " + "removing journal file"); + if (remove(zone->journal) < 0 && errno != ENOENT) { + char strbuf[ISC_STRERRORSIZE]; + isc__strerror(errno, strbuf, sizeof(strbuf)); + isc_log_write(dns_lctx, + DNS_LOGCATEGORY_GENERAL, + DNS_LOGMODULE_ZONE, + ISC_LOG_WARNING, + "unable to remove journal " + "'%s': '%s'", + zone->journal, strbuf); + } + } + } + + dns_zone_log(zone, ISC_LOG_DEBUG(1), "loaded; checking validity"); + + /* * Master / Slave / Stub zones require both NS and SOA records at * the top of the zone. */ @@ -3548,6 +3943,7 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime, case dns_zone_master: case dns_zone_slave: case dns_zone_stub: + case dns_zone_redirect: if (soacount != 1) { dns_zone_log(zone, ISC_LOG_ERROR, "has %d SOA records", soacount); @@ -3564,7 +3960,8 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime, result = DNS_R_BADZONE; goto cleanup; } - if (zone->type != dns_zone_stub) { + if (zone->type != dns_zone_stub && + zone->type != dns_zone_redirect) { result = check_nsec3param(zone, db); if (result != ISC_R_SUCCESS) goto cleanup; @@ -3575,7 +3972,6 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime, result = DNS_R_BADZONE; goto cleanup; } - if (zone->type == dns_zone_master && DNS_ZONE_OPTION(zone, DNS_ZONEOPT_CHECKDUPRR) && !zone_check_dup(zone, db)) { @@ -3602,6 +3998,14 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime, INSIST(zone->type == dns_zone_master); + if (serial == oldserial && + zone_unchanged(zone->db, db, zone->mctx)) { + dns_zone_log(zone, ISC_LOG_INFO, + "ixfr-from-differences: " + "unchanged"); + return(ISC_R_SUCCESS); + } + serialmin = (oldserial + 1) & 0xffffffffU; serialmax = (oldserial + 0x7fffffffU) & 0xffffffffU; @@ -3644,7 +4048,9 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime, DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_HAVETIMERS); if (zone->type == dns_zone_slave || - zone->type == dns_zone_stub) { + zone->type == dns_zone_stub || + (zone->type == dns_zone_redirect && + zone->masters != NULL)) { isc_time_t t; isc_uint32_t delay; @@ -3666,6 +4072,7 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime, &zone->expiretime) >= 0) zone->refreshtime = now; } + break; case dns_zone_key: @@ -3717,8 +4124,24 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime, ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_write); DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_LOADED|DNS_ZONEFLG_NEEDNOTIFY); + if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_SENDSECURE) && + inline_raw(zone)) + { + if (zone->secure->db == NULL) + zone_send_securedb(zone, ISC_FALSE, db); + else + zone_send_secureserial(zone, ISC_FALSE, serial); + } } + /* + * Finished loading inline-signing zone; need to get status + * from the raw side now. + */ + if (zone->type == dns_zone_master && inline_secure(zone)) + maybe_send_secure(zone); + + result = ISC_R_SUCCESS; if (needdump) { @@ -3736,7 +4159,8 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime, } if (zone->type == dns_zone_master && - zone_isdynamic(zone) && + !DNS_ZONEKEY_OPTION(zone, DNS_ZONEKEY_NORESIGN) && + dns_zone_isdynamic(zone, ISC_FALSE) && dns_db_issecure(db)) { dns_name_t *name; dns_fixedname_t fixed; @@ -3775,12 +4199,14 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime, dns_db_issecure(db) ? " (DNSSEC signed)" : ""); zone->loadtime = loadtime; + DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_LOADPENDING); return (result); cleanup: if (zone->type == dns_zone_slave || zone->type == dns_zone_stub || - zone->type == dns_zone_key) { + zone->type == dns_zone_key || + (zone->type == dns_zone_redirect && zone->masters != NULL)) { if (zone->journal != NULL) zone_saveunique(zone, zone->journal, "jn-XXXXXXXX"); if (zone->masterfile != NULL) @@ -3791,8 +4217,15 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime, if (zone->task != NULL) zone_settimer(zone, &now); result = ISC_R_SUCCESS; - } else if (zone->type == dns_zone_master) - dns_zone_log(zone, ISC_LOG_ERROR, "not loaded due to errors."); + } else if (zone->type == dns_zone_master || + zone->type == dns_zone_redirect) { + if (!(inline_secure(zone) && result == ISC_R_FILENOTFOUND)) + dns_zone_log(zone, ISC_LOG_ERROR, + "not loaded due to errors."); + else if (zone->type == dns_zone_master) + result = ISC_R_SUCCESS; + } + return (result); } @@ -4087,6 +4520,8 @@ dns_zone_attach(dns_zone_t *source, dns_zone_t **target) { void dns_zone_detach(dns_zone_t **zonep) { dns_zone_t *zone; + dns_zone_t *raw = NULL; + dns_zone_t *secure = NULL; unsigned int refs; isc_boolean_t free_now = ISC_FALSE; @@ -4124,12 +4559,21 @@ dns_zone_detach(dns_zone_t **zonep) { */ INSIST(zone->view == NULL); free_now = ISC_TRUE; + raw = zone->raw; + zone->raw = NULL; + secure = zone->secure; + zone->secure = NULL; } UNLOCK_ZONE(zone); } *zonep = NULL; - if (free_now) + if (free_now) { + if (raw != NULL) + dns_zone_detach(&raw); + if (secure != NULL) + dns_zone_idetach(&secure); zone_free(zone); + } } void @@ -4141,26 +4585,6 @@ dns_zone_iattach(dns_zone_t *source, dns_zone_t **target) { UNLOCK_ZONE(source); } -isc_result_t -dns_zone_synckeyzone(dns_zone_t *zone) { - isc_result_t result; - dns_db_t *db = NULL; - - if (zone->type != dns_zone_key) - return (DNS_R_BADZONE); - - CHECK(dns_zone_getdb(zone, &db)); - - LOCK_ZONE(zone); - result = sync_keyzone(zone, db); - UNLOCK_ZONE(zone); - - failure: - if (db != NULL) - dns_db_detach(&db); - return (result); -} - static void zone_iattach(dns_zone_t *source, dns_zone_t **target) { @@ -4385,48 +4809,8 @@ dns_zone_getnotifysrc6(dns_zone_t *zone) { return (&zone->notifysrc6); } -isc_result_t -dns_zone_setalsonotify(dns_zone_t *zone, const isc_sockaddr_t *notify, - isc_uint32_t count) -{ - isc_sockaddr_t *new; - - REQUIRE(DNS_ZONE_VALID(zone)); - REQUIRE(count == 0 || notify != NULL); - - LOCK_ZONE(zone); - if (zone->notify != NULL) { - isc_mem_put(zone->mctx, zone->notify, - zone->notifycnt * sizeof(*new)); - zone->notify = NULL; - zone->notifycnt = 0; - } - if (count != 0) { - new = isc_mem_get(zone->mctx, count * sizeof(*new)); - if (new == NULL) { - UNLOCK_ZONE(zone); - return (ISC_R_NOMEMORY); - } - memcpy(new, notify, count * sizeof(*new)); - zone->notify = new; - zone->notifycnt = count; - } - UNLOCK_ZONE(zone); - return (ISC_R_SUCCESS); -} - -isc_result_t -dns_zone_setmasters(dns_zone_t *zone, const isc_sockaddr_t *masters, - isc_uint32_t count) -{ - isc_result_t result; - - result = dns_zone_setmasterswithkeys(zone, masters, NULL, count); - return (result); -} - static isc_boolean_t -same_masters(const isc_sockaddr_t *old, const isc_sockaddr_t *new, +same_addrs(const isc_sockaddr_t *old, const isc_sockaddr_t *new, isc_uint32_t count) { unsigned int i; @@ -4456,15 +4840,170 @@ same_keynames(dns_name_t **old, dns_name_t **new, isc_uint32_t count) { return (ISC_TRUE); } +static void +clear_addresskeylist(isc_sockaddr_t **addrsp, dns_name_t ***keynamesp, + unsigned int *countp, isc_mem_t *mctx) +{ + unsigned int count; + isc_sockaddr_t *addrs; + dns_name_t **keynames; + + REQUIRE(countp != NULL && addrsp != NULL && keynamesp != NULL); + + count = *countp; + *countp = 0; + addrs = *addrsp; + *addrsp = NULL; + keynames = *keynamesp; + *keynamesp = NULL; + + if (addrs != NULL) + isc_mem_put(mctx, addrs, count * sizeof(isc_sockaddr_t)); + + if (keynames != NULL) { + unsigned int i; + for (i = 0; i < count; i++) { + if (keynames[i] != NULL) { + dns_name_free(keynames[i], mctx); + isc_mem_put(mctx, keynames[i], + sizeof(dns_name_t)); + keynames[i] = NULL; + } + } + isc_mem_put(mctx, keynames, count * sizeof(dns_name_t *)); + } +} + +static isc_result_t +set_addrkeylist(unsigned int count, + const isc_sockaddr_t *addrs, isc_sockaddr_t **newaddrsp, + dns_name_t **names, dns_name_t ***newnamesp, + isc_mem_t *mctx) +{ + isc_result_t result; + isc_sockaddr_t *newaddrs = NULL; + dns_name_t **newnames = NULL; + unsigned int i; + + REQUIRE(newaddrsp != NULL && *newaddrsp == NULL); + REQUIRE(newnamesp != NULL && *newnamesp == NULL); + + newaddrs = isc_mem_get(mctx, count * sizeof(*newaddrs)); + if (newaddrs == NULL) + return (ISC_R_NOMEMORY); + memcpy(newaddrs, addrs, count * sizeof(*newaddrs)); + + newnames = NULL; + if (names != NULL) { + newnames = isc_mem_get(mctx, count * sizeof(*newnames)); + if (newnames == NULL) { + isc_mem_put(mctx, newaddrs, count * sizeof(*newaddrs)); + return (ISC_R_NOMEMORY); + } + for (i = 0; i < count; i++) + newnames[i] = NULL; + for (i = 0; i < count; i++) { + if (names[i] != NULL) { + newnames[i] = isc_mem_get(mctx, + sizeof(dns_name_t)); + if (newnames[i] == NULL) + goto allocfail; + dns_name_init(newnames[i], NULL); + result = dns_name_dup(names[i], mctx, + newnames[i]); + if (result != ISC_R_SUCCESS) { + allocfail: + for (i = 0; i < count; i++) + if (newnames[i] != NULL) + dns_name_free( + newnames[i], + mctx); + isc_mem_put(mctx, newaddrs, + count * sizeof(*newaddrs)); + isc_mem_put(mctx, newnames, + count * sizeof(*newnames)); + return (ISC_R_NOMEMORY); + } + } + } + } + + *newaddrsp = newaddrs; + *newnamesp = newnames; + return (ISC_R_SUCCESS); +} + +isc_result_t +dns_zone_setalsonotify(dns_zone_t *zone, const isc_sockaddr_t *notify, + isc_uint32_t count) +{ + return (dns_zone_setalsonotifywithkeys(zone, notify, NULL, count)); +} + +isc_result_t +dns_zone_setalsonotifywithkeys(dns_zone_t *zone, const isc_sockaddr_t *notify, + dns_name_t **keynames, isc_uint32_t count) +{ + isc_result_t result; + isc_sockaddr_t *newaddrs = NULL; + dns_name_t **newnames = NULL; + + REQUIRE(DNS_ZONE_VALID(zone)); + REQUIRE(count == 0 || notify != NULL); + if (keynames != NULL) + REQUIRE(count != 0); + + LOCK_ZONE(zone); + + if (count == zone->notifycnt && + same_addrs(zone->notify, notify, count) && + same_keynames(zone->notifykeynames, keynames, count)) + goto unlock; + + clear_addresskeylist(&zone->notify, &zone->notifykeynames, + &zone->notifycnt, zone->mctx); + + if (count == 0) + goto unlock; + + /* + * Set up the notify and notifykey lists + */ + result = set_addrkeylist(count, notify, &newaddrs, + keynames, &newnames, zone->mctx); + if (result != ISC_R_SUCCESS) + goto unlock; + + /* + * Everything is ok so attach to the zone. + */ + zone->notify = newaddrs; + zone->notifykeynames = newnames; + zone->notifycnt = count; + unlock: + UNLOCK_ZONE(zone); + return (ISC_R_SUCCESS); +} + +isc_result_t +dns_zone_setmasters(dns_zone_t *zone, const isc_sockaddr_t *masters, + isc_uint32_t count) +{ + isc_result_t result; + + result = dns_zone_setmasterswithkeys(zone, masters, NULL, count); + return (result); +} + isc_result_t dns_zone_setmasterswithkeys(dns_zone_t *zone, const isc_sockaddr_t *masters, dns_name_t **keynames, isc_uint32_t count) { - isc_sockaddr_t *new; isc_result_t result = ISC_R_SUCCESS; - dns_name_t **newname; + isc_sockaddr_t *newaddrs = NULL; + dns_name_t **newnames = NULL; isc_boolean_t *newok; unsigned int i; @@ -4482,38 +5021,24 @@ dns_zone_setmasterswithkeys(dns_zone_t *zone, * unlock and exit. */ if (count != zone->masterscnt || - !same_masters(zone->masters, masters, count) || + !same_addrs(zone->masters, masters, count) || !same_keynames(zone->masterkeynames, keynames, count)) { if (zone->request != NULL) dns_request_cancel(zone->request); } else goto unlock; - if (zone->masters != NULL) { - isc_mem_put(zone->mctx, zone->masters, - zone->masterscnt * sizeof(*new)); - zone->masters = NULL; - } - if (zone->masterkeynames != NULL) { - for (i = 0; i < zone->masterscnt; i++) { - if (zone->masterkeynames[i] != NULL) { - dns_name_free(zone->masterkeynames[i], - zone->mctx); - isc_mem_put(zone->mctx, - zone->masterkeynames[i], - sizeof(dns_name_t)); - zone->masterkeynames[i] = NULL; - } - } - isc_mem_put(zone->mctx, zone->masterkeynames, - zone->masterscnt * sizeof(dns_name_t *)); - zone->masterkeynames = NULL; - } + + /* + * This needs to happen before clear_addresskeylist() sets + * zone->masterscnt to 0: + */ if (zone->mastersok != NULL) { isc_mem_put(zone->mctx, zone->mastersok, zone->masterscnt * sizeof(isc_boolean_t)); zone->mastersok = NULL; } - zone->masterscnt = 0; + clear_addresskeylist(&zone->masters, &zone->masterkeynames, + &zone->masterscnt, zone->mctx); /* * If count == 0, don't allocate any space for masters, mastersok or * keynames so internally, those pointers are NULL if count == 0 @@ -4522,76 +5047,34 @@ dns_zone_setmasterswithkeys(dns_zone_t *zone, goto unlock; /* - * masters must contain count elements! - */ - new = isc_mem_get(zone->mctx, count * sizeof(*new)); - if (new == NULL) { - result = ISC_R_NOMEMORY; - goto unlock; - } - memcpy(new, masters, count * sizeof(*new)); - - /* - * Similarly for mastersok. + * mastersok must contain count elements */ newok = isc_mem_get(zone->mctx, count * sizeof(*newok)); if (newok == NULL) { result = ISC_R_NOMEMORY; - isc_mem_put(zone->mctx, new, count * sizeof(*new)); + isc_mem_put(zone->mctx, newaddrs, count * sizeof(*newaddrs)); goto unlock; }; for (i = 0; i < count; i++) newok[i] = ISC_FALSE; /* - * if keynames is non-NULL, it must contain count elements! + * Now set up the masters and masterkey lists */ - newname = NULL; - if (keynames != NULL) { - newname = isc_mem_get(zone->mctx, count * sizeof(*newname)); - if (newname == NULL) { - result = ISC_R_NOMEMORY; - isc_mem_put(zone->mctx, new, count * sizeof(*new)); - isc_mem_put(zone->mctx, newok, count * sizeof(*newok)); - goto unlock; - } - for (i = 0; i < count; i++) - newname[i] = NULL; - for (i = 0; i < count; i++) { - if (keynames[i] != NULL) { - newname[i] = isc_mem_get(zone->mctx, - sizeof(dns_name_t)); - if (newname[i] == NULL) - goto allocfail; - dns_name_init(newname[i], NULL); - result = dns_name_dup(keynames[i], zone->mctx, - newname[i]); - if (result != ISC_R_SUCCESS) { - allocfail: - for (i = 0; i < count; i++) - if (newname[i] != NULL) - dns_name_free( - newname[i], - zone->mctx); - isc_mem_put(zone->mctx, new, - count * sizeof(*new)); - isc_mem_put(zone->mctx, newok, - count * sizeof(*newok)); - isc_mem_put(zone->mctx, newname, - count * sizeof(*newname)); - goto unlock; - } - } - } + result = set_addrkeylist(count, masters, &newaddrs, + keynames, &newnames, zone->mctx); + if (result != ISC_R_SUCCESS) { + isc_mem_put(zone->mctx, newok, count * sizeof(*newok)); + goto unlock; } /* * Everything is ok so attach to the zone. */ zone->curmaster = 0; - zone->masters = new; zone->mastersok = newok; - zone->masterkeynames = newname; + zone->masters = newaddrs; + zone->masterkeynames = newnames; zone->masterscnt = count; DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_NOMASTERS); @@ -5072,9 +5555,12 @@ zone_resigninc(dns_zone_t *zone) { zonediff_init(&zonediff, &_sig_diff); /* - * Updates are disabled. Pause for 5 minutes. + * Zone is frozen or automatic resigning is disabled. + * Pause for 5 minutes. */ - if (zone->update_disabled) { + if (zone->update_disabled || + DNS_ZONEKEY_OPTION(zone, DNS_ZONEKEY_NORESIGN)) + { result = ISC_R_FAILURE; goto failure; } @@ -5186,18 +5672,18 @@ zone_resigninc(dns_zone_t *zone) { */ if (ISC_LIST_EMPTY(zonediff.diff->tuples)) { /* - * Commit the changes if any key has been marked as offline. - */ + * Commit the changes if any key has been marked as offline. */ if (zonediff.offline) dns_db_closeversion(db, &version, ISC_TRUE); goto failure; } /* Increment SOA serial if we have made changes */ - result = increment_soa_serial(db, version, zonediff.diff, zone->mctx); + result = update_soa_serial(db, version, zonediff.diff, zone->mctx, + zone->updatemethod); if (result != ISC_R_SUCCESS) { dns_zone_log(zone, ISC_LOG_ERROR, - "zone_resigninc:increment_soa_serial -> %s", + "zone_resigninc:update_soa_serial -> %s", dns_result_totext(result)); goto failure; } @@ -5217,7 +5703,7 @@ zone_resigninc(dns_zone_t *zone) { } /* Write changes to journal file. */ - CHECK(zone_journal(zone, zonediff.diff, "zone_resigninc")); + CHECK(zone_journal(zone, zonediff.diff, NULL, "zone_resigninc")); /* Everything has succeeded. Commit the changes. */ dns_db_closeversion(db, &version, ISC_TRUE); @@ -5625,6 +6111,7 @@ fixup_nsec3param(dns_db_t *db, dns_dbversion_t *ver, dns_nsec3chain_t *chain, isc_buffer_t buffer; unsigned char parambuf[DNS_NSEC3PARAM_BUFFERSIZE]; dns_ttl_t ttl = 0; + isc_boolean_t nseconly = ISC_FALSE, nsec3ok = ISC_FALSE; dns_rdataset_init(&rdataset); @@ -5675,6 +6162,10 @@ fixup_nsec3param(dns_db_t *db, dns_dbversion_t *ver, dns_nsec3chain_t *chain, if (active) goto add; + + result = dns_nsec_nseconly(db, ver, &nseconly); + nsec3ok = (result == ISC_R_SUCCESS && !nseconly); + /* * Delete all private records which match that in nsec3chain. */ @@ -5697,7 +6188,9 @@ fixup_nsec3param(dns_db_t *db, dns_dbversion_t *ver, dns_nsec3chain_t *chain, continue; CHECK(dns_rdata_tostruct(&rdata, &nsec3param, NULL)); - if (nsec3param.hash != chain->nsec3param.hash || + if ((!nsec3ok && + (nsec3param.flags & DNS_NSEC3FLAG_INITIAL) != 0) || + nsec3param.hash != chain->nsec3param.hash || nsec3param.iterations != chain->nsec3param.iterations || nsec3param.salt_length != chain->nsec3param.salt_length || memcmp(nsec3param.salt, chain->nsec3param.salt, @@ -6271,7 +6764,8 @@ zone_nsec3chain(dns_zone_t *zone) { * of removing this NSEC3 chain. */ if (first && !updatensec && - (nsec3chain->nsec3param.flags & DNS_NSEC3FLAG_NONSEC) == 0) { + (nsec3chain->nsec3param.flags & DNS_NSEC3FLAG_NONSEC) == 0) + { result = need_nsec_chain(db, version, &nsec3chain->nsec3param, &buildnsecchain); @@ -6585,10 +7079,11 @@ zone_nsec3chain(dns_zone_t *zone) { goto failure; } - result = increment_soa_serial(db, version, zonediff.diff, zone->mctx); + result = update_soa_serial(db, version, zonediff.diff, zone->mctx, + zone->updatemethod); if (result != ISC_R_SUCCESS) { dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain:" - "increment_soa_serial -> %s", + "update_soa_serial -> %s", dns_result_totext(result)); goto failure; } @@ -6603,7 +7098,7 @@ zone_nsec3chain(dns_zone_t *zone) { } /* Write changes to journal file. */ - CHECK(zone_journal(zone, zonediff.diff, "zone_nsec3chain")); + CHECK(zone_journal(zone, zonediff.diff, NULL, "zone_nsec3chain")); LOCK_ZONE(zone); zone_needdump(zone, DNS_DUMP_DELAY); @@ -7154,10 +7649,11 @@ zone_sign(dns_zone_t *zone) { goto failure; } - result = increment_soa_serial(db, version, zonediff.diff, zone->mctx); + result = update_soa_serial(db, version, zonediff.diff, zone->mctx, + zone->updatemethod); if (result != ISC_R_SUCCESS) { dns_zone_log(zone, ISC_LOG_ERROR, - "zone_sign:increment_soa_serial -> %s", + "zone_sign:update_soa_serial -> %s", dns_result_totext(result)); goto failure; } @@ -7179,7 +7675,7 @@ zone_sign(dns_zone_t *zone) { /* * Write changes to journal file. */ - CHECK(zone_journal(zone, zonediff.diff, "zone_sign")); + CHECK(zone_journal(zone, zonediff.diff, NULL, "zone_sign")); pauseall: /* @@ -7941,8 +8437,9 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) { if (!ISC_LIST_EMPTY(diff.tuples)) { /* Write changes to journal file. */ - CHECK(increment_soa_serial(kfetch->db, ver, &diff, mctx)); - CHECK(zone_journal(zone, &diff, "keyfetch_done")); + CHECK(update_soa_serial(kfetch->db, ver, &diff, mctx, + zone->updatemethod)); + CHECK(zone_journal(zone, &diff, NULL, "keyfetch_done")); commit = ISC_TRUE; DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_LOADED); @@ -8115,8 +8612,9 @@ zone_refreshkeys(dns_zone_t *zone) { } } if (!ISC_LIST_EMPTY(diff.tuples)) { - CHECK(increment_soa_serial(db, ver, &diff, zone->mctx)); - CHECK(zone_journal(zone, &diff, "zone_refreshkeys")); + CHECK(update_soa_serial(db, ver, &diff, zone->mctx, + zone->updatemethod)); + CHECK(zone_journal(zone, &diff, NULL, "zone_refreshkeys")); commit = ISC_TRUE; DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_LOADED); zone_needdump(zone, 30); @@ -8164,11 +8662,17 @@ zone_maintenance(dns_zone_t *zone) { ENTER; /* + * Are we pending load/reload? + */ + if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADPENDING)) + return; + + /* * Configuring the view of this zone may have * failed, for example because the config file * had a syntax error. In that case, the view - * db or resolver will be NULL, and we had better not try - * to do maintenance on it. + * adb or resolver will be NULL, and we had better not try + * to do further maintenance on it. */ if (zone->view == NULL || zone->view->adb == NULL) return; @@ -8179,6 +8683,9 @@ zone_maintenance(dns_zone_t *zone) { * Expire check. */ switch (zone->type) { + case dns_zone_redirect: + if (zone->masters == NULL) + break; case dns_zone_slave: case dns_zone_stub: LOCK_ZONE(zone); @@ -8197,6 +8704,9 @@ zone_maintenance(dns_zone_t *zone) { * Up to date check. */ switch (zone->type) { + case dns_zone_redirect: + if (zone->masters == NULL) + break; case dns_zone_slave: case dns_zone_stub: if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_DIALREFRESH) && @@ -8222,6 +8732,7 @@ zone_maintenance(dns_zone_t *zone) { case dns_zone_master: case dns_zone_slave: case dns_zone_key: + case dns_zone_redirect: case dns_zone_stub: LOCK_ZONE(zone); if (zone->masterfile != NULL && @@ -8249,6 +8760,7 @@ zone_maintenance(dns_zone_t *zone) { */ switch (zone->type) { case dns_zone_master: + case dns_zone_redirect: if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDNOTIFY) && isc_time_compare(&now, &zone->notifytime) >= 0) zone_notify(zone, &now); @@ -8278,6 +8790,7 @@ zone_maintenance(dns_zone_t *zone) { switch (zone->type) { case dns_zone_master: + case dns_zone_redirect: case dns_zone_slave: /* * Do we need to sign/resign some RRsets? @@ -8299,6 +8812,7 @@ zone_maintenance(dns_zone_t *zone) { set_key_expiry_warning(zone, zone->key_expiry, isc_time_seconds(&now)); break; + default: break; } @@ -8307,10 +8821,31 @@ zone_maintenance(dns_zone_t *zone) { void dns_zone_markdirty(dns_zone_t *zone) { + isc_uint32_t serial; + isc_result_t result = ISC_R_SUCCESS; LOCK_ZONE(zone); - if (zone->type == dns_zone_master) - set_resigntime(zone); /* XXXMPA make separate call back */ + if (zone->type == dns_zone_master) { + if (inline_raw(zone)) { + unsigned int soacount; + + ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read); + if (zone->db != NULL) { + result = zone_get_from_db(zone, zone->db, NULL, + &soacount, &serial, + NULL, NULL, NULL, + NULL, NULL); + } else + result = DNS_R_NOTLOADED; + ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read); + if (result == ISC_R_SUCCESS && soacount > 0U) + zone_send_secureserial(zone, ISC_FALSE, serial); + } + + /* XXXMPA make separate call back */ + if (result == ISC_R_SUCCESS) + set_resigntime(zone); + } zone_needdump(zone, DNS_DUMP_DELAY); UNLOCK_ZONE(zone); } @@ -8498,6 +9033,22 @@ dump_done(void *arg, isc_result_t result) { tresult = dns_db_getsoaserial(db, version, &serial); /* + * If there is a secure version of this zone + * use its serial if it is less than ours. + */ + if (tresult == ISC_R_SUCCESS && inline_raw(zone) && + zone->secure->db != NULL) + { + isc_uint32_t sserial; + isc_result_t mresult; + + mresult = dns_db_getsoaserial(zone->secure->db, + NULL, &sserial); + if (mresult == ISC_R_SUCCESS && + isc_serial_lt(sserial, serial)) + serial = sserial; + } + /* * Note: we are task locked here so we can test * zone->xfr safely. */ @@ -8605,10 +9156,15 @@ zone_dump(dns_zone_t *zone, isc_boolean_t compact) { result = DNS_R_CONTINUE; UNLOCK_ZONE(zone); } else { + dns_masterrawheader_t rawdata; dns_db_currentversion(db, &version); - result = dns_master_dump2(zone->mctx, db, version, + dns_master_initrawheader(&rawdata); + if (inline_secure(zone)) + get_raw_serial(zone->raw, &rawdata); + result = dns_master_dump3(zone->mctx, db, version, &dns_master_style_default, - masterfile, masterformat); + masterfile, masterformat, + &rawdata); dns_db_closeversion(db, &version, ISC_FALSE); } fail: @@ -8647,11 +9203,12 @@ zone_dump(dns_zone_t *zone, isc_boolean_t compact) { static isc_result_t dumptostream(dns_zone_t *zone, FILE *fd, const dns_master_style_t *style, - dns_masterformat_t format) + dns_masterformat_t format, const isc_uint32_t rawversion) { isc_result_t result; dns_dbversion_t *version = NULL; dns_db_t *db = NULL; + dns_masterrawheader_t rawdata; REQUIRE(DNS_ZONE_VALID(zone)); @@ -8663,29 +9220,46 @@ dumptostream(dns_zone_t *zone, FILE *fd, const dns_master_style_t *style, return (DNS_R_NOTLOADED); dns_db_currentversion(db, &version); - result = dns_master_dumptostream2(zone->mctx, db, version, style, - format, fd); + dns_master_initrawheader(&rawdata); + if (rawversion == 0) + rawdata.flags |= DNS_MASTERRAW_COMPAT; + else if (inline_secure(zone)) + get_raw_serial(zone->raw, &rawdata); + else if (zone->sourceserialset) { + rawdata.flags = DNS_MASTERRAW_SOURCESERIALSET; + rawdata.sourceserial = zone->sourceserial; + } + result = dns_master_dumptostream3(zone->mctx, db, version, style, + format, &rawdata, fd); dns_db_closeversion(db, &version, ISC_FALSE); dns_db_detach(&db); return (result); } isc_result_t +dns_zone_dumptostream3(dns_zone_t *zone, FILE *fd, dns_masterformat_t format, + const dns_master_style_t *style, + const isc_uint32_t rawversion) +{ + return (dumptostream(zone, fd, style, format, rawversion)); +} + +isc_result_t dns_zone_dumptostream2(dns_zone_t *zone, FILE *fd, dns_masterformat_t format, const dns_master_style_t *style) { - return dumptostream(zone, fd, style, format); + return (dumptostream(zone, fd, style, format, DNS_RAWFORMAT_VERSION)); } isc_result_t dns_zone_dumptostream(dns_zone_t *zone, FILE *fd) { - return dumptostream(zone, fd, &dns_master_style_default, - dns_masterformat_text); + return (dumptostream(zone, fd, &dns_master_style_default, + dns_masterformat_text, 0)); } isc_result_t dns_zone_fulldumptostream(dns_zone_t *zone, FILE *fd) { - return dumptostream(zone, fd, &dns_master_style_full, - dns_masterformat_text); + return (dumptostream(zone, fd, &dns_master_style_full, + dns_masterformat_text, 0)); } void @@ -8880,6 +9454,8 @@ notify_destroy(dns_notify_t *notify, isc_boolean_t locked) { dns_request_destroy(¬ify->request); if (dns_name_dynamic(¬ify->ns)) dns_name_free(¬ify->ns, notify->mctx); + if (notify->key != NULL) + dns_tsigkey_detach(¬ify->key); mctx = notify->mctx; isc_mem_put(notify->mctx, notify, sizeof(*notify)); isc_mem_detach(&mctx); @@ -8901,6 +9477,7 @@ notify_create(isc_mem_t *mctx, unsigned int flags, dns_notify_t **notifyp) { notify->zone = NULL; notify->find = NULL; notify->request = NULL; + notify->key = NULL; isc_sockaddr_any(¬ify->dst); dns_name_init(¬ify->ns, NULL); ISC_LINK_INIT(notify, link); @@ -9045,15 +9622,23 @@ notify_send_toaddr(isc_task_t *task, isc_event_t *event) { if (result != ISC_R_SUCCESS) goto cleanup; - isc_netaddr_fromsockaddr(&dstip, ¬ify->dst); - isc_sockaddr_format(¬ify->dst, addrbuf, sizeof(addrbuf)); - result = dns_view_getpeertsig(notify->zone->view, &dstip, &key); - if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) { - notify_log(notify->zone, ISC_LOG_ERROR, "NOTIFY to %s not " - "sent. Peer TSIG key lookup failure.", addrbuf); - goto cleanup_message; + if (notify->key != NULL) { + /* Transfer ownership of key */ + key = notify->key; + notify->key = NULL; + } else { + isc_netaddr_fromsockaddr(&dstip, ¬ify->dst); + isc_sockaddr_format(¬ify->dst, addrbuf, sizeof(addrbuf)); + result = dns_view_getpeertsig(notify->zone->view, &dstip, &key); + if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) { + notify_log(notify->zone, ISC_LOG_ERROR, + "NOTIFY to %s not sent. " + "Peer TSIG key lookup failure.", addrbuf); + goto cleanup_message; + } } + /* XXX: should we log the tsig key too? */ notify_log(notify->zone, ISC_LOG_DEBUG(3), "sending notify to %s", addrbuf); if (notify->zone->view->peers != NULL) { @@ -9255,14 +9840,30 @@ zone_notify(dns_zone_t *zone, isc_time_t *now) { */ LOCK_ZONE(zone); for (i = 0; i < zone->notifycnt; i++) { + dns_tsigkey_t *key = NULL; + dst = zone->notify[i]; if (notify_isqueued(zone, NULL, &dst)) continue; + result = notify_create(zone->mctx, flags, ¬ify); if (result != ISC_R_SUCCESS) continue; + zone_iattach(zone, ¬ify->zone); notify->dst = dst; + + if ((zone->notifykeynames != NULL) && + (zone->notifykeynames[i] != NULL)) { + dns_view_t *view = dns_zone_getview(zone); + dns_name_t *keyname = zone->notifykeynames[i]; + result = dns_view_gettsig(view, keyname, &key); + if (result == ISC_R_SUCCESS) { + notify->key = key; + key = NULL; + } + } + ISC_LIST_APPEND(zone->notifies, notify, link); result = notify_send_queue(notify); if (result != ISC_R_SUCCESS) @@ -9753,7 +10354,8 @@ refresh_callback(isc_task_t *task, isc_event_t *event) { "master %s exceeded (source %s)", master, source); /* Try with slave with TCP. */ - if (zone->type == dns_zone_slave && + if ((zone->type == dns_zone_slave || + zone->type == dns_zone_redirect) && DNS_ZONE_OPTION(zone, DNS_ZONEOPT_TRYTCPREFRESH)) { if (!dns_zonemgr_unreachable(zone->zmgr, &zone->masteraddr, @@ -9819,7 +10421,8 @@ refresh_callback(isc_task_t *task, isc_event_t *event) { * Perhaps AXFR/IXFR is allowed even if SOA queries aren't. */ if (msg->rcode == dns_rcode_refused && - zone->type == dns_zone_slave) + (zone->type == dns_zone_slave || + zone->type == dns_zone_redirect)) goto tcp_transfer; goto next_master; } @@ -9828,7 +10431,8 @@ refresh_callback(isc_task_t *task, isc_event_t *event) { * If truncated punt to zone transfer which will query again. */ if ((msg->flags & DNS_MESSAGEFLAG_TC) != 0) { - if (zone->type == dns_zone_slave) { + if (zone->type == dns_zone_slave || + zone->type == dns_zone_redirect) { dns_zone_log(zone, ISC_LOG_INFO, "refresh: truncated UDP answer, " "initiating TCP zone xfer " @@ -9955,7 +10559,8 @@ refresh_callback(isc_task_t *task, isc_event_t *event) { dns_zone_log(zone, ISC_LOG_INFO, "refresh: skipping %s as master %s " "(source %s) is unreachable (cached)", - zone->type == dns_zone_slave ? + (zone->type == dns_zone_slave || + zone->type == dns_zone_redirect) ? "zone transfer" : "NS query", master, source); goto next_master; @@ -9963,7 +10568,8 @@ refresh_callback(isc_task_t *task, isc_event_t *event) { tcp_transfer: isc_event_free(&event); dns_request_destroy(&zone->request); - if (zone->type == dns_zone_slave) { + if (zone->type == dns_zone_slave || + zone->type == dns_zone_redirect) { do_queue_xfrin = ISC_TRUE; } else { INSIST(zone->type == dns_zone_stub); @@ -10643,6 +11249,7 @@ static void zone_shutdown(isc_task_t *task, isc_event_t *event) { dns_zone_t *zone = (dns_zone_t *) event->ev_arg; isc_boolean_t free_needed, linked = ISC_FALSE; + dns_zone_t *raw = NULL, *secure = NULL; UNUSED(task); REQUIRE(DNS_ZONE_VALID(zone)); @@ -10725,7 +11332,19 @@ zone_shutdown(isc_task_t *task, isc_event_t *event) { */ DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_SHUTDOWN); free_needed = exit_check(zone); + if (inline_secure(zone)) { + raw = zone->raw; + zone->raw = NULL; + } + if (inline_raw(zone)) { + secure = zone->secure; + zone->secure = NULL; + } UNLOCK_ZONE(zone); + if (raw != NULL) + dns_zone_detach(&raw); + if (secure != NULL) + dns_zone_idetach(&secure); if (free_needed) zone_free(zone); } @@ -10759,6 +11378,11 @@ zone_settimer(dns_zone_t *zone, isc_time_t *now) { isc_time_settoepoch(&next); switch (zone->type) { + case dns_zone_redirect: + if (zone->masters != NULL) + goto treat_as_slave; + /* FALLTHROUGH */ + case dns_zone_master: if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDNOTIFY)) next = zone->notifytime; @@ -10769,6 +11393,8 @@ zone_settimer(dns_zone_t *zone, isc_time_t *now) { isc_time_compare(&zone->dumptime, &next) < 0) next = zone->dumptime; } + if (zone->type == dns_zone_redirect) + break; if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_REFRESHING) && !isc_time_isepoch(&zone->refreshkeytime)) { if (isc_time_isepoch(&next) || @@ -10798,9 +11424,10 @@ zone_settimer(dns_zone_t *zone, isc_time_t *now) { break; case dns_zone_slave: + treat_as_slave: if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDNOTIFY)) next = zone->notifytime; - /*FALLTHROUGH*/ + /* FALLTHROUGH */ case dns_zone_stub: if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_REFRESH) && @@ -11078,9 +11705,17 @@ dns_zone_notifyreceive(dns_zone_t *zone, isc_sockaddr_t *from, isc_sockaddr_format(from, fromtext, sizeof(fromtext)); /* - * We only handle NOTIFY (SOA) at the present. + * Notify messages are processed by the raw zone. */ LOCK_ZONE(zone); + if (inline_secure(zone)) { + result = dns_zone_notifyreceive(zone->raw, from, msg); + UNLOCK_ZONE(zone); + return (result); + } + /* + * We only handle NOTIFY (SOA) at the present. + */ if (isc_sockaddr_pf(from) == PF_INET) inc_stats(zone, dns_zonestatscounter_notifyinv4); else @@ -11468,15 +12103,17 @@ zone_namerd_tostr(dns_zone_t *zone, char *buf, size_t length) { * Leave space for terminating '\0'. */ isc_buffer_init(&buffer, buf, length - 1); - if (dns_name_dynamic(&zone->origin)) - result = dns_name_totext(&zone->origin, ISC_TRUE, &buffer); - if (result != ISC_R_SUCCESS && - isc_buffer_availablelength(&buffer) >= (sizeof("<UNKNOWN>") - 1)) - isc_buffer_putstr(&buffer, "<UNKNOWN>"); + if (zone->type != dns_zone_redirect && zone->type != dns_zone_key) { + if (dns_name_dynamic(&zone->origin)) + result = dns_name_totext(&zone->origin, ISC_TRUE, &buffer); + if (result != ISC_R_SUCCESS && + isc_buffer_availablelength(&buffer) >= (sizeof("<UNKNOWN>") - 1)) + isc_buffer_putstr(&buffer, "<UNKNOWN>"); - if (isc_buffer_availablelength(&buffer) > 0) - isc_buffer_putstr(&buffer, "/"); - (void)dns_rdataclass_totext(zone->rdclass, &buffer); + if (isc_buffer_availablelength(&buffer) > 0) + isc_buffer_putstr(&buffer, "/"); + (void)dns_rdataclass_totext(zone->rdclass, &buffer); + } if (zone->view != NULL && strcmp(zone->view->name, "_bind") != 0 && strcmp(zone->view->name, "_default") != 0 && @@ -11484,6 +12121,10 @@ zone_namerd_tostr(dns_zone_t *zone, char *buf, size_t length) { isc_buffer_putstr(&buffer, "/"); isc_buffer_putstr(&buffer, zone->view->name); } + if (inline_secure(zone) && 9U < isc_buffer_availablelength(&buffer)) + isc_buffer_putstr(&buffer, " (signed)"); + if (inline_raw(zone) && 11U < isc_buffer_availablelength(&buffer)) + isc_buffer_putstr(&buffer, " (unsigned)"); buf[isc_buffer_usedlength(&buffer)] = '\0'; } @@ -11585,8 +12226,9 @@ dns_zone_logc(dns_zone_t *zone, isc_logcategory_t *category, vsnprintf(message, sizeof(message), fmt, ap); va_end(ap); isc_log_write(dns_lctx, category, DNS_LOGMODULE_ZONE, - level, "%s %s: %s", (zone->type == dns_zone_key) ? - "managed-keys-zone" : "zone", zone->strnamerd, message); + level, "%s%s: %s", (zone->type == dns_zone_key) ? + "managed-keys-zone" : (zone->type == dns_zone_redirect) ? + "redirect-zone" : "zone ", zone->strnamerd, message); } void @@ -11601,8 +12243,9 @@ dns_zone_log(dns_zone_t *zone, int level, const char *fmt, ...) { vsnprintf(message, sizeof(message), fmt, ap); va_end(ap); isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_ZONE, - level, "%s %s: %s", (zone->type == dns_zone_key) ? - "managed-keys-zone" : "zone", zone->strnamerd, message); + level, "%s%s: %s", (zone->type == dns_zone_key) ? + "managed-keys-zone" : (zone->type == dns_zone_redirect) ? + "redirect-zone" : "zone ", zone->strnamerd, message); } static void @@ -11612,6 +12255,7 @@ zone_debuglog(dns_zone_t *zone, const char *me, int debuglevel, va_list ap; char message[4096]; int level = ISC_LOG_DEBUG(debuglevel); + const char *zstr; if (isc_log_wouldlog(dns_lctx, level) == ISC_FALSE) return; @@ -11619,9 +12263,21 @@ zone_debuglog(dns_zone_t *zone, const char *me, int debuglevel, va_start(ap, fmt); vsnprintf(message, sizeof(message), fmt, ap); va_end(ap); + + switch (zone->type) { + case dns_zone_key: + zstr = "managed-keys-zone"; + break; + case dns_zone_redirect: + zstr = "redirect-zone"; + break; + default: + zstr = "zone"; + } + isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_ZONE, - level, "%s: %s %s: %s", me, zone->type != dns_zone_key ? - "zone" : "managed-keys-zone", zone->strnamerd, message); + level, "%s: %s %s: %s", me, zstr, zone->strnamerd, + message); } static int @@ -11799,6 +12455,572 @@ notify_done(isc_task_t *task, isc_event_t *event) { dns_message_destroy(&message); } +struct secure_event { + isc_event_t e; + dns_db_t *db; + isc_uint32_t serial; +}; + +static void +update_log_cb(void *arg, dns_zone_t *zone, int level, const char *message) { + UNUSED(arg); + dns_zone_log(zone, level, "%s", message); +} + +static isc_result_t +sync_secure_journal(dns_zone_t *zone, dns_journal_t *journal, + isc_uint32_t start, isc_uint32_t end, + dns_difftuple_t **soatuplep, dns_diff_t *diff) +{ + isc_result_t result; + dns_difftuple_t *tuple = NULL; + dns_diffop_t op = DNS_DIFFOP_ADD; + int n_soa = 0; + + REQUIRE(soatuplep != NULL); + + if (start == end) + return (DNS_R_UNCHANGED); + + CHECK(dns_journal_iter_init(journal, start, end)); + for (result = dns_journal_first_rr(journal); + result == ISC_R_SUCCESS; + result = dns_journal_next_rr(journal)) + { + dns_name_t *name = NULL; + isc_uint32_t ttl; + dns_rdata_t *rdata = NULL; + dns_journal_current_rr(journal, &name, &ttl, &rdata); + + if (rdata->type == dns_rdatatype_soa) { + n_soa++; + if (n_soa == 2) { + /* + * Save the latest raw SOA record. + */ + if (*soatuplep != NULL) + dns_difftuple_free(soatuplep); + CHECK(dns_difftuple_create(diff->mctx, + DNS_DIFFOP_ADD, + name, ttl, rdata, + soatuplep)); + } + if (n_soa == 3) + n_soa = 1; + continue; + } + + /* Sanity. */ + if (n_soa == 0) { + dns_zone_log(zone->raw, ISC_LOG_ERROR, + "corrupt journal file: '%s'\n", + zone->raw->journal); + return (ISC_R_FAILURE); + } + + if (zone->privatetype != 0 && + rdata->type == zone->privatetype) + continue; + + if (rdata->type == dns_rdatatype_nsec || + rdata->type == dns_rdatatype_rrsig || + rdata->type == dns_rdatatype_nsec3 || + rdata->type == dns_rdatatype_dnskey || + rdata->type == dns_rdatatype_nsec3param) + continue; + + op = (n_soa == 1) ? DNS_DIFFOP_DEL : DNS_DIFFOP_ADD; + + CHECK(dns_difftuple_create(diff->mctx, op, name, ttl, rdata, + &tuple)); + dns_diff_appendminimal(diff, &tuple); + } + if (result == ISC_R_NOMORE) + result = ISC_R_SUCCESS; + + failure: + return(result); +} + +static isc_result_t +sync_secure_db(dns_zone_t *seczone, dns_db_t *secdb, + dns_dbversion_t *secver, dns_difftuple_t **soatuple, + dns_diff_t *diff) +{ + isc_result_t result; + dns_db_t *rawdb = NULL; + dns_dbversion_t *rawver = NULL; + dns_difftuple_t *tuple = NULL, *next; + dns_difftuple_t *oldtuple = NULL, *newtuple = NULL; + dns_rdata_soa_t oldsoa, newsoa; + + REQUIRE(DNS_ZONE_VALID(seczone)); + REQUIRE(inline_secure(seczone)); + REQUIRE(soatuple != NULL && *soatuple == NULL); + + if (!seczone->sourceserialset) + return (DNS_R_UNCHANGED); + + dns_db_attach(seczone->raw->db, &rawdb); + dns_db_currentversion(rawdb, &rawver); + result = dns_db_diffx(diff, rawdb, rawver, secdb, secver, NULL); + dns_db_closeversion(rawdb, &rawver, ISC_FALSE); + dns_db_detach(&rawdb); + + if (result != ISC_R_SUCCESS) + return (result); + + for (tuple = ISC_LIST_HEAD(diff->tuples); + tuple != NULL; + tuple = next) + { + next = ISC_LIST_NEXT(tuple, link); + if (tuple->rdata.type == dns_rdatatype_nsec || + tuple->rdata.type == dns_rdatatype_rrsig || + tuple->rdata.type == dns_rdatatype_dnskey || + tuple->rdata.type == dns_rdatatype_nsec3 || + tuple->rdata.type == dns_rdatatype_nsec3param) + { + ISC_LIST_UNLINK(diff->tuples, tuple, link); + dns_difftuple_free(&tuple); + continue; + } + if (tuple->rdata.type == dns_rdatatype_soa) { + if (tuple->op == DNS_DIFFOP_DEL) { + INSIST(oldtuple == NULL); + oldtuple = tuple; + } + if (tuple->op == DNS_DIFFOP_ADD) { + INSIST(newtuple == NULL); + newtuple = tuple; + } + } + } + + if (oldtuple != NULL && newtuple != NULL) { + + result = dns_rdata_tostruct(&oldtuple->rdata, &oldsoa, NULL); + RUNTIME_CHECK(result == ISC_R_SUCCESS); + + result = dns_rdata_tostruct(&newtuple->rdata, &newsoa, NULL); + RUNTIME_CHECK(result == ISC_R_SUCCESS); + + /* + * If the SOA records are the same except for the serial + * remove them from the diff. + */ + if (oldsoa.refresh == newsoa.refresh && + oldsoa.retry == newsoa.retry && + oldsoa.minimum == newsoa.minimum && + oldsoa.expire == newsoa.expire && + dns_name_equal(&oldsoa.origin, &newsoa.origin) && + dns_name_equal(&oldsoa.contact, &newsoa.contact)) { + ISC_LIST_UNLINK(diff->tuples, oldtuple, link); + dns_difftuple_free(&oldtuple); + ISC_LIST_UNLINK(diff->tuples, newtuple, link); + dns_difftuple_free(&newtuple); + } + } + + if (ISC_LIST_EMPTY(diff->tuples)) + return (DNS_R_UNCHANGED); + + /* + * If there are still SOA records in the diff they can now be removed + * saving the new SOA record. + */ + if (oldtuple != NULL) { + ISC_LIST_UNLINK(diff->tuples, oldtuple, link); + dns_difftuple_free(&oldtuple); + } + + if (newtuple != NULL) { + ISC_LIST_UNLINK(diff->tuples, newtuple, link); + *soatuple = newtuple; + } + + return (ISC_R_SUCCESS); +} + +static void +receive_secure_serial(isc_task_t *task, isc_event_t *event) { + isc_result_t result; + dns_journal_t *rjournal = NULL; + isc_uint32_t start, end; + dns_zone_t *zone; + dns_db_t *db = NULL; + dns_dbversion_t *newver = NULL, *oldver = NULL; + dns_diff_t diff; + dns_difftuple_t *tuple = NULL, *soatuple = NULL; + dns_update_log_t log = { update_log_cb, NULL }; + isc_time_t timenow; + + zone = event->ev_arg; + end = ((struct secure_event *)event)->serial; + isc_event_free(&event); + + LOCK_ZONE(zone); + + dns_diff_init(zone->mctx, &diff); + + UNUSED(task); + + /* + * zone->db may be NULL if the load from disk failed. + */ + if (zone->db == NULL || !inline_secure(zone)) { + result = ISC_R_FAILURE; + goto failure; + } + + /* + * We first attempt to sync the raw zone to the secure zone + * by using the raw zone's journal, applying all the deltas + * from the latest source-serial of the secure zone up to + * the current serial number of the raw zone. + * + * If that fails, then we'll fall back to a direct comparison + * between raw and secure zones. + */ + result = dns_journal_open(zone->raw->mctx, zone->raw->journal, + DNS_JOURNAL_WRITE, &rjournal); + if (result != ISC_R_SUCCESS) + goto failure; + else { + dns_journal_t *sjournal = NULL; + + result = dns_journal_open(zone->mctx, zone->journal, + DNS_JOURNAL_READ, &sjournal); + if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) + goto failure; + + if (!dns_journal_get_sourceserial(rjournal, &start)) { + start = dns_journal_first_serial(rjournal); + dns_journal_set_sourceserial(rjournal, start); + } + if (sjournal != NULL) { + isc_uint32_t serial; + /* + * We read the secure journal first, if that exists + * use its value provided it is greater that from the + * raw journal. + */ + if (dns_journal_get_sourceserial(sjournal, &serial)) { + if (isc_serial_gt(serial, start)) + start = serial; + } + dns_journal_destroy(&sjournal); + } + } + + dns_db_attach(zone->db, &db); + dns_db_currentversion(db, &oldver); + CHECK(dns_db_newversion(db, &newver)); + + /* + * Try to apply diffs from the raw zone's journal to the secure + * zone. If that fails, we recover by syncing up the databases + * directly. + */ + result = sync_secure_journal(zone, rjournal, start, end, + &soatuple, &diff); + if (result == DNS_R_UNCHANGED) + goto failure; + else if (result != ISC_R_SUCCESS) + CHECK(sync_secure_db(zone, db, oldver, &soatuple, &diff)); + + CHECK(dns_diff_apply(&diff, db, newver)); + + if (soatuple != NULL) { + isc_uint32_t oldserial, newserial, desired; + + CHECK(dns_db_createsoatuple(db, oldver, diff.mctx, + DNS_DIFFOP_DEL, &tuple)); + oldserial = dns_soa_getserial(&tuple->rdata); + newserial = desired = dns_soa_getserial(&soatuple->rdata); + if (!isc_serial_gt(newserial, oldserial)) { + newserial = oldserial + 1; + if (newserial == 0) + newserial++; + dns_soa_setserial(newserial, &soatuple->rdata); + } + CHECK(do_one_tuple(&tuple, db, newver, &diff)); + CHECK(do_one_tuple(&soatuple, db, newver, &diff)); + dns_zone_log(zone, ISC_LOG_INFO, "serial %u (unsigned %u)", + newserial, desired); + } else + CHECK(update_soa_serial(db, newver, &diff, zone->mctx, + zone->updatemethod)); + + CHECK(dns_update_signatures(&log, zone, db, oldver, newver, + &diff, zone->sigvalidityinterval)); + + CHECK(zone_journal(zone, &diff, &end, "receive_secure_serial")); + + dns_journal_set_sourceserial(rjournal, end); + dns_journal_commit(rjournal); + + DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_NEEDNOTIFY); + + zone->sourceserial = end; + zone->sourceserialset = ISC_TRUE; + zone_needdump(zone, DNS_DUMP_DELAY); + + TIME_NOW(&timenow); + zone_settimer(zone, &timenow); + + dns_db_closeversion(db, &oldver, ISC_FALSE); + dns_db_closeversion(db, &newver, ISC_TRUE); + + failure: + UNLOCK_ZONE(zone); + if (result != ISC_R_SUCCESS) + dns_zone_log(zone, ISC_LOG_ERROR, "receive_secure_serial: %s", + dns_result_totext(result)); + if (tuple != NULL) + dns_difftuple_free(&tuple); + if (soatuple != NULL) + dns_difftuple_free(&soatuple); + if (db != NULL) { + if (oldver != NULL) + dns_db_closeversion(db, &oldver, ISC_FALSE); + if (newver != NULL) + dns_db_closeversion(db, &newver, ISC_FALSE); + dns_db_detach(&db); + } + if (rjournal != NULL) + dns_journal_destroy(&rjournal); + dns_diff_clear(&diff); + dns_zone_idetach(&zone); +} + +static isc_result_t +zone_send_secureserial(dns_zone_t *zone, isc_boolean_t locked, + isc_uint32_t serial) +{ + isc_event_t *e; + dns_zone_t *dummy = NULL; + + e = isc_event_allocate(zone->secure->mctx, zone, + DNS_EVENT_ZONESECURESERIAL, + receive_secure_serial, zone->secure, + sizeof(struct secure_event)); + if (e == NULL) + return (ISC_R_NOMEMORY); + ((struct secure_event *)e)->serial = serial; + if (locked) + zone_iattach(zone->secure, &dummy); + else + dns_zone_iattach(zone->secure, &dummy); + isc_task_send(zone->secure->task, &e); + + DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_SENDSECURE); + return (ISC_R_SUCCESS); +} + +static isc_result_t +checkandaddsoa(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version, + dns_rdataset_t *rdataset, isc_uint32_t oldserial) +{ + dns_rdata_soa_t soa; + dns_rdata_t rdata = DNS_RDATA_INIT; + dns_rdatalist_t temprdatalist; + dns_rdataset_t temprdataset; + isc_buffer_t b; + isc_result_t result; + unsigned char buf[DNS_SOA_BUFFERSIZE]; + + result = dns_rdataset_first(rdataset); + RUNTIME_CHECK(result == ISC_R_SUCCESS); + dns_rdataset_current(rdataset, &rdata); + result = dns_rdata_tostruct(&rdata, &soa, NULL); + RUNTIME_CHECK(result == ISC_R_SUCCESS); + + if (isc_serial_gt(soa.serial, oldserial)) + return (dns_db_addrdataset(db, node, version, 0, rdataset, 0, + NULL)); + /* + * Always bump the serial. + */ + oldserial++; + if (oldserial == 0) + oldserial++; + soa.serial = oldserial; + + /* + * Construct a replacement rdataset. + */ + dns_rdata_reset(&rdata); + isc_buffer_init(&b, buf, sizeof(buf)); + result = dns_rdata_fromstruct(&rdata, rdataset->rdclass, + dns_rdatatype_soa, &soa, &b); + RUNTIME_CHECK(result == ISC_R_SUCCESS); + temprdatalist.rdclass = rdata.rdclass; + temprdatalist.type = rdata.type; + temprdatalist.covers = 0; + temprdatalist.ttl = rdataset->ttl; + ISC_LIST_INIT(temprdatalist.rdata); + ISC_LIST_APPEND(temprdatalist.rdata, &rdata, link); + + dns_rdataset_init(&temprdataset); + result = dns_rdatalist_tordataset(&temprdatalist, &temprdataset); + RUNTIME_CHECK(result == ISC_R_SUCCESS); + return (dns_db_addrdataset(db, node, version, 0, &temprdataset, + 0, NULL)); +} + +static void +receive_secure_db(isc_task_t *task, isc_event_t *event) { + isc_result_t result; + dns_zone_t *zone; + dns_db_t *rawdb, *db = NULL; + dns_dbnode_t *rawnode = NULL, *node = NULL; + dns_fixedname_t fname; + dns_name_t *name; + dns_dbiterator_t *dbiterator = NULL; + dns_rdatasetiter_t *rdsit = NULL; + dns_rdataset_t rdataset; + dns_dbversion_t *version = NULL; + isc_time_t loadtime; + unsigned int oldserial = 0; + isc_boolean_t have_oldserial = ISC_FALSE; + + UNUSED(task); + + zone = event->ev_arg; + rawdb = ((struct secure_event *)event)->db; + isc_event_free(&event); + + REQUIRE(inline_secure(zone)); + + dns_fixedname_init(&fname); + name = dns_fixedname_name(&fname); + dns_rdataset_init(&rdataset); + + TIME_NOW(&loadtime); + if (zone->db != NULL) { + result = dns_db_getsoaserial(zone->db, NULL, &oldserial); + if (result == ISC_R_SUCCESS) + have_oldserial = ISC_TRUE; + } + + result = dns_db_create(zone->mctx, zone->db_argv[0], + &zone->origin, dns_dbtype_zone, zone->rdclass, + zone->db_argc - 1, zone->db_argv + 1, &db); + if (result != ISC_R_SUCCESS) + goto failure; + + result = dns_db_newversion(db, &version); + if (result != ISC_R_SUCCESS) + goto failure; + + result = dns_db_createiterator(rawdb, 0, &dbiterator); + if (result != ISC_R_SUCCESS) + goto failure; + + for (result = dns_dbiterator_first(dbiterator); + result == ISC_R_SUCCESS; + result = dns_dbiterator_next(dbiterator)) { + result = dns_dbiterator_current(dbiterator, &rawnode, name); + if (result != ISC_R_SUCCESS) + continue; + + result = dns_db_findnode(db, name, ISC_TRUE, &node); + if (result != ISC_R_SUCCESS) + goto failure; + + result = dns_db_allrdatasets(rawdb, rawnode, NULL, 0, &rdsit); + if (result != ISC_R_SUCCESS) + goto failure; + + for (result = dns_rdatasetiter_first(rdsit); + result == ISC_R_SUCCESS; + result = dns_rdatasetiter_next(rdsit)) { + dns_rdatasetiter_current(rdsit, &rdataset); + if (rdataset.type == dns_rdatatype_nsec || + rdataset.type == dns_rdatatype_rrsig || + rdataset.type == dns_rdatatype_nsec3 || + rdataset.type == dns_rdatatype_dnskey || + rdataset.type == dns_rdatatype_nsec3param) { + dns_rdataset_disassociate(&rdataset); + continue; + } + if (rdataset.type == dns_rdatatype_soa && + have_oldserial) { + result = checkandaddsoa(db, node, version, + &rdataset, oldserial); + } else + result = dns_db_addrdataset(db, node, version, + 0, &rdataset, 0, + NULL); + if (result != ISC_R_SUCCESS) + goto failure; + + dns_rdataset_disassociate(&rdataset); + } + dns_rdatasetiter_destroy(&rdsit); + dns_db_detachnode(rawdb, &rawnode); + dns_db_detachnode(db, &node); + } + + dns_db_closeversion(db, &version, ISC_TRUE); + /* + * Lock hierarchy: zmgr, zone, raw. + */ + LOCK_ZONE(zone); + if (inline_secure(zone)) + LOCK_ZONE(zone->raw); + DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_NEEDNOTIFY); + result = zone_postload(zone, db, loadtime, ISC_R_SUCCESS); + zone_needdump(zone, 0); /* XXXMPA */ + if (inline_secure(zone)) + UNLOCK_ZONE(zone->raw); + UNLOCK_ZONE(zone); + + failure: + if (result != ISC_R_SUCCESS) + dns_zone_log(zone, ISC_LOG_ERROR, "receive_secure_db: %s", + dns_result_totext(result)); + + if (dns_rdataset_isassociated(&rdataset)) + dns_rdataset_disassociate(&rdataset); + if (db != NULL) { + if (node != NULL) + dns_db_detachnode(db, &node); + dns_db_detach(&db); + } + if (rawnode != NULL) + dns_db_detachnode(rawdb, &rawnode); + dns_db_detach(&rawdb); + if (dbiterator != NULL) + dns_dbiterator_destroy(&dbiterator); + dns_zone_idetach(&zone); +} + +static isc_result_t +zone_send_securedb(dns_zone_t *zone, isc_boolean_t locked, dns_db_t *db) { + isc_event_t *e; + dns_db_t *dummy = NULL; + dns_zone_t *secure = NULL; + + e = isc_event_allocate(zone->secure->mctx, zone, + DNS_EVENT_ZONESECUREDB, + receive_secure_db, zone->secure, + sizeof(struct secure_event)); + if (e == NULL) + return (ISC_R_NOMEMORY); + dns_db_attach(db, &dummy); + ((struct secure_event *)e)->db = dummy; + if (locked) + zone_iattach(zone->secure, &secure); + else + dns_zone_iattach(zone->secure, &secure); + + isc_task_send(zone->secure->task, &e); + DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_SENDSECURE); + return (ISC_R_SUCCESS); +} + isc_result_t dns_zone_replacedb(dns_zone_t *zone, dns_db_t *db, isc_boolean_t dump) { isc_result_t result; @@ -11860,7 +13082,8 @@ zone_replacedb(dns_zone_t *zone, dns_db_t *db, isc_boolean_t dump) { */ if (zone->db != NULL && zone->journal != NULL && DNS_ZONE_OPTION(zone, DNS_ZONEOPT_IXFRFROMDIFFS) && - !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_FORCEXFER)) { + !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_FORCEXFER)) + { isc_uint32_t serial, oldserial; unsigned int soacount; @@ -11882,8 +13105,10 @@ zone_replacedb(dns_zone_t *zone, dns_db_t *db, isc_boolean_t dump) { NULL); RUNTIME_CHECK(result == ISC_R_SUCCESS); RUNTIME_CHECK(soacount > 0U); - if (zone->type == dns_zone_slave && - !isc_serial_gt(serial, oldserial)) { + if ((zone->type == dns_zone_slave || + (zone->type == dns_zone_redirect && + zone->masters != NULL)) + && !isc_serial_gt(serial, oldserial)) { isc_uint32_t serialmin, serialmax; serialmin = (oldserial + 1) & 0xffffffffU; serialmax = (oldserial + 0x7fffffffU) & 0xffffffffU; @@ -11919,6 +13144,8 @@ zone_replacedb(dns_zone_t *zone, dns_db_t *db, isc_boolean_t dump) { break; } } + if (zone->type == dns_zone_master && inline_raw(zone)) + zone_send_secureserial(zone, ISC_FALSE, serial); } else { if (dump && zone->masterfile != NULL) { /* @@ -11969,13 +13196,14 @@ zone_replacedb(dns_zone_t *zone, dns_db_t *db, isc_boolean_t dump) { zone->journal, strbuf); } } + + if (inline_raw(zone)) + zone_send_securedb(zone, ISC_FALSE, db); } dns_db_closeversion(db, &ver, ISC_FALSE); - isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL, - DNS_LOGMODULE_ZONE, ISC_LOG_DEBUG(3), - "replacing zone database"); + dns_zone_log(zone, ISC_LOG_DEBUG(3), "replacing zone database"); if (zone->db != NULL) zone_detachdb(zone); @@ -12120,6 +13348,8 @@ zone_xfrdone(dns_zone_t *zone, isc_result_t result) { dns_zone_log(zone, ISC_LOG_INFO, "transferred serial %u%s", serial, buf); + if (inline_raw(zone)) + zone_send_secureserial(zone, ISC_FALSE, serial); } /* @@ -12274,18 +13504,26 @@ zone_loaddone(void *arg, isc_result_t result) { (result == ISC_R_SUCCESS || result == DNS_R_SEENINCLUDE)) result = tresult; - LOCK_ZONE(load->zone); - (void)zone_postload(load->zone, load->db, load->loadtime, result); - zonemgr_putio(&load->zone->readio); - DNS_ZONE_CLRFLAG(load->zone, DNS_ZONEFLG_LOADING); + /* + * Lock hierarchy: zmgr, zone, raw. + */ + LOCK_ZONE(zone); + if (inline_secure(zone)) + LOCK_ZONE(zone->raw); + (void)zone_postload(zone, load->db, load->loadtime, result); + zonemgr_putio(&zone->readio); + DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_LOADING); + zone_idetach(&load->callbacks.zone); /* * Leave the zone frozen if the reload fails. */ if ((result == ISC_R_SUCCESS || result == DNS_R_SEENINCLUDE) && - DNS_ZONE_FLAG(load->zone, DNS_ZONEFLG_THAW)) + DNS_ZONE_FLAG(zone, DNS_ZONEFLG_THAW)) zone->update_disabled = ISC_FALSE; - DNS_ZONE_CLRFLAG(load->zone, DNS_ZONEFLG_THAW); - UNLOCK_ZONE(load->zone); + DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_THAW); + if (inline_secure(zone)) + UNLOCK_ZONE(zone->raw); + UNLOCK_ZONE(zone); load->magic = 0; dns_db_detach(&load->db); @@ -12383,7 +13621,7 @@ queue_xfrin(dns_zone_t *zone) { */ static void got_transfer_quota(isc_task_t *task, isc_event_t *event) { - isc_result_t result; + isc_result_t result = ISC_R_SUCCESS; dns_peer_t *peer = NULL; char master[ISC_SOCKADDR_FORMATSIZE]; char source[ISC_SOCKADDR_FORMATSIZE]; @@ -12432,14 +13670,6 @@ got_transfer_quota(isc_task_t *task, isc_event_t *event) { "no database exists yet, requesting AXFR of " "initial version from %s", master); xfrtype = dns_rdatatype_axfr; - } else if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_IXFRFROMDIFFS)) { - dns_zone_log(zone, ISC_LOG_DEBUG(1), "ixfr-from-differences " - "set, requesting %sAXFR from %s", soa_before, - master); - if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_SOABEFOREAXFR)) - xfrtype = dns_rdatatype_soa; - else - xfrtype = dns_rdatatype_axfr; } else if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_FORCEXFER)) { dns_zone_log(zone, ISC_LOG_DEBUG(1), "forced reload, requesting AXFR of " @@ -12455,13 +13685,10 @@ got_transfer_quota(isc_task_t *task, isc_event_t *event) { UNLOCK_ZONE(zone); } else { isc_boolean_t use_ixfr = ISC_TRUE; - if (peer != NULL && - dns_peer_getrequestixfr(peer, &use_ixfr) == - ISC_R_SUCCESS) { - ; /* Using peer setting */ - } else { - use_ixfr = zone->view->requestixfr; - } + if (peer != NULL) + result = dns_peer_getrequestixfr(peer, &use_ixfr); + if (peer == NULL || result != ISC_R_SUCCESS) + use_ixfr = zone->requestixfr; if (use_ixfr == ISC_FALSE) { dns_zone_log(zone, ISC_LOG_DEBUG(1), "IXFR disabled, requesting %sAXFR from %s", @@ -12806,6 +14033,8 @@ dns_zonemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr, zmgr->timermgr = timermgr; zmgr->socketmgr = socketmgr; zmgr->zonetasks = NULL; + zmgr->loadtasks = NULL; + zmgr->mctxpool = NULL; zmgr->task = NULL; zmgr->rl = NULL; ISC_LIST_INIT(zmgr->zones); @@ -12874,6 +14103,33 @@ dns_zonemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr, } isc_result_t +dns_zonemgr_createzone(dns_zonemgr_t *zmgr, dns_zone_t **zonep) { + isc_result_t result; + isc_mem_t *mctx = NULL; + dns_zone_t *zone = NULL; + void *item; + + REQUIRE(DNS_ZONEMGR_VALID(zmgr)); + REQUIRE(zonep != NULL && *zonep == NULL); + + if (zmgr->mctxpool == NULL) + return (ISC_R_FAILURE); + + item = isc_pool_get(zmgr->mctxpool); + if (item == NULL) + return (ISC_R_FAILURE); + + isc_mem_attach((isc_mem_t *) item, &mctx); + result = dns_zone_create(&zone, mctx); + isc_mem_detach(&mctx); + + if (result == ISC_R_SUCCESS) + *zonep = zone; + + return (result); +} + +isc_result_t dns_zonemgr_managezone(dns_zonemgr_t *zmgr, dns_zone_t *zone) { isc_result_t result; @@ -12890,6 +14146,7 @@ dns_zonemgr_managezone(dns_zonemgr_t *zmgr, dns_zone_t *zone) { REQUIRE(zone->zmgr == NULL); isc_taskpool_gettask(zmgr->zonetasks, &zone->task); + isc_taskpool_gettask(zmgr->loadtasks, &zone->loadtask); /* * Set the task name. The tag will arbitrarily point to one @@ -12897,6 +14154,7 @@ dns_zonemgr_managezone(dns_zonemgr_t *zmgr, dns_zone_t *zone) { * to be managed last). */ isc_task_setname(zone->task, "zone", zone); + isc_task_setname(zone->loadtask, "loadzone", zone); result = isc_timer_create(zmgr->timermgr, isc_timertype_inactive, NULL, NULL, @@ -12904,7 +14162,7 @@ dns_zonemgr_managezone(dns_zonemgr_t *zmgr, dns_zone_t *zone) { &zone->timer); if (result != ISC_R_SUCCESS) - goto cleanup_task; + goto cleanup_tasks; /* * The timer "holds" a iref. @@ -12918,7 +14176,8 @@ dns_zonemgr_managezone(dns_zonemgr_t *zmgr, dns_zone_t *zone) { goto unlock; - cleanup_task: + cleanup_tasks: + isc_task_detach(&zone->loadtask); isc_task_detach(&zone->task); unlock: @@ -13034,6 +14293,10 @@ dns_zonemgr_shutdown(dns_zonemgr_t *zmgr) { isc_task_destroy(&zmgr->task); if (zmgr->zonetasks != NULL) isc_taskpool_destroy(&zmgr->zonetasks); + if (zmgr->loadtasks != NULL) + isc_taskpool_destroy(&zmgr->loadtasks); + if (zmgr->mctxpool != NULL) + isc_pool_destroy(&zmgr->mctxpool); RWLOCK(&zmgr->rwlock, isc_rwlocktype_read); for (zone = ISC_LIST_HEAD(zmgr->zones); @@ -13047,23 +14310,56 @@ dns_zonemgr_shutdown(dns_zonemgr_t *zmgr) { RWUNLOCK(&zmgr->rwlock, isc_rwlocktype_read); } +static isc_result_t +mctxinit(void **target, void *arg) { + isc_result_t result; + isc_mem_t *mctx = NULL; + + UNUSED(arg); + + REQUIRE(target != NULL && *target == NULL); + + result = isc_mem_create(0, 0, &mctx); + if (result != ISC_R_SUCCESS) + return (result); + isc_mem_setname(mctx, "zonemgr-pool", NULL); + + *target = mctx; + return (ISC_R_SUCCESS); +} + +static void +mctxfree(void **target) { + isc_mem_t *mctx = *(isc_mem_t **) target; + isc_mem_detach(&mctx); + *target = NULL; +} + +#define ZONES_PER_TASK 100 +#define ZONES_PER_MCTX 1000 + isc_result_t dns_zonemgr_setsize(dns_zonemgr_t *zmgr, int num_zones) { isc_result_t result; - int ntasks = num_zones / 100; + int ntasks = num_zones / ZONES_PER_TASK; + int nmctx = num_zones / ZONES_PER_MCTX; isc_taskpool_t *pool = NULL; + isc_pool_t *mctxpool = NULL; REQUIRE(DNS_ZONEMGR_VALID(zmgr)); /* * For anything fewer than 1000 zones we use 10 tasks in - * the task pool. More than that, and we'll scale at one - * task per 100 zones. + * the task pools. More than that, and we'll scale at one + * task per 100 zones. Similarly, for anything smaller than + * 2000 zones we use 2 memory contexts, then scale at 1:1000. */ if (ntasks < 10) ntasks = 10; + if (nmctx < 2) + nmctx = 2; - /* Create or resize the zone task pool. */ + /* Create or resize the zone task pools. */ if (zmgr->zonetasks == NULL) result = isc_taskpool_create(zmgr->taskmgr, zmgr->mctx, ntasks, 2, &pool); @@ -13073,6 +14369,43 @@ dns_zonemgr_setsize(dns_zonemgr_t *zmgr, int num_zones) { if (result == ISC_R_SUCCESS) zmgr->zonetasks = pool; + pool = NULL; + if (zmgr->loadtasks == NULL) + result = isc_taskpool_create(zmgr->taskmgr, zmgr->mctx, + ntasks, 2, &pool); + else + result = isc_taskpool_expand(&zmgr->loadtasks, ntasks, &pool); + + if (result == ISC_R_SUCCESS) + zmgr->loadtasks = pool; + +#ifdef BIND9 + /* + * We always set all tasks in the zone-load task pool to + * privileged. This prevents other tasks in the system from + * running while the server task manager is in privileged + * mode. + * + * NOTE: If we start using task privileges for any other + * part of the system than zone tasks, then this will need to be + * revisted. In that case we'd want to turn on privileges for + * zone tasks only when we were loading, and turn them off the + * rest of the time. For now, however, it's okay to just + * set it and forget it. + */ + isc_taskpool_setprivilege(zmgr->loadtasks, ISC_TRUE); +#endif + + /* Create or resize the zone memory context pool. */ + if (zmgr->mctxpool == NULL) + result = isc_pool_create(zmgr->mctx, nmctx, mctxfree, + mctxinit, NULL, &mctxpool); + else + result = isc_pool_expand(&zmgr->mctxpool, nmctx, &mctxpool); + + if (result == ISC_R_SUCCESS) + zmgr->mctxpool = mctxpool; + return (result); } @@ -13309,12 +14642,14 @@ zonemgr_getio(dns_zonemgr_t *zmgr, isc_boolean_t high, io = isc_mem_get(zmgr->mctx, sizeof(*io)); if (io == NULL) return (ISC_R_NOMEMORY); + io->event = isc_event_allocate(zmgr->mctx, task, DNS_EVENT_IOREADY, action, arg, sizeof(*io->event)); if (io->event == NULL) { isc_mem_put(zmgr->mctx, io, sizeof(*io)); return (ISC_R_NOMEMORY); } + io->zmgr = zmgr; io->high = high; io->task = NULL; @@ -13334,9 +14669,8 @@ zonemgr_getio(dns_zonemgr_t *zmgr, isc_boolean_t high, UNLOCK(&zmgr->iolock); *iop = io; - if (!queue) { + if (!queue) isc_task_send(io->task, &io->event); - } return (ISC_R_SUCCESS); } @@ -13613,7 +14947,8 @@ void dns_zone_forcereload(dns_zone_t *zone) { REQUIRE(DNS_ZONE_VALID(zone)); - if (zone->type == dns_zone_master) + if (zone->type == dns_zone_master || + (zone->type == dns_zone_redirect && zone->masters == NULL)) return; LOCK_ZONE(zone); @@ -13661,6 +14996,7 @@ dns_zone_setstats(dns_zone_t *zone, isc_stats_t *stats) { void dns_zone_setrequeststats(dns_zone_t *zone, isc_stats_t *stats) { + REQUIRE(DNS_ZONE_VALID(zone)); LOCK_ZONE(zone); @@ -13673,9 +15009,24 @@ dns_zone_setrequeststats(dns_zone_t *zone, isc_stats_t *stats) { } } UNLOCK_ZONE(zone); +} - return; +#ifdef NEWSTATS +void +dns_zone_setrcvquerystats(dns_zone_t *zone, dns_stats_t *stats) { + + REQUIRE(DNS_ZONE_VALID(zone)); + + LOCK_ZONE(zone); + if (zone->requeststats_on && stats != NULL) { + if (zone->rcvquerystats == NULL) { + dns_stats_attach(stats, &zone->rcvquerystats); + zone->requeststats_on = ISC_TRUE; + } + } + UNLOCK_ZONE(zone); } +#endif isc_stats_t * dns_zone_getrequeststats(dns_zone_t *zone) { @@ -13693,6 +15044,20 @@ dns_zone_getrequeststats(dns_zone_t *zone) { return (NULL); } +#ifdef NEWSTATS +/* + * Return the received query stats bucket + * see note from dns_zone_getrequeststats() + */ +dns_stats_t * +dns_zone_getrcvquerystats(dns_zone_t *zone) { + if (zone->requeststats_on) + return (zone->rcvquerystats); + else + return (NULL); +} +#endif + void dns_zone_dialup(dns_zone_t *zone) { @@ -13705,7 +15070,7 @@ dns_zone_dialup(dns_zone_t *zone) { if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_DIALNOTIFY)) dns_zone_notify(zone); - if (zone->type != dns_zone_master && + if (zone->type != dns_zone_master && zone->masters != NULL && DNS_ZONE_FLAG(zone, DNS_ZONEFLG_DIALREFRESH)) dns_zone_refresh(zone); } @@ -14321,8 +15686,12 @@ dnskey_sane(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, } /* Check existing DB for NSEC-only DNSKEY */ - if (!nseconly) - CHECK(dns_nsec_nseconly(db, ver, &nseconly)); + if (!nseconly) { + result = dns_nsec_nseconly(db, ver, &nseconly); + if (result == ISC_R_NOTFOUND) + result = ISC_R_SUCCESS; + CHECK(result); + } /* Check existing DB for NSEC3 */ if (!nsec3) @@ -14360,7 +15729,7 @@ clean_nsec3param(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, if (result != ISC_R_NOTFOUND) goto failure; - result = dns_nsec3param_deletechains(db, ver, zone, diff); + result = dns_nsec3param_deletechains(db, ver, zone, ISC_TRUE, diff); failure: if (node != NULL) @@ -14476,14 +15845,11 @@ zone_rekey(dns_zone_t *zone) { dns_rdatatype_none, 0, &keyset, &keysigs); if (result == ISC_R_SUCCESS) { ttl = keyset.ttl; - result = dns_dnssec_keylistfromrdataset(&zone->origin, dir, - mctx, &keyset, - &keysigs, &soasigs, - ISC_FALSE, ISC_FALSE, - &dnskeys); - /* Can't get keys for some reason; try again later. */ - if (result != ISC_R_SUCCESS) - goto trylater; + CHECK(dns_dnssec_keylistfromrdataset(&zone->origin, dir, + mctx, &keyset, + &keysigs, &soasigs, + ISC_FALSE, ISC_FALSE, + &dnskeys)); } else if (result != ISC_R_NOTFOUND) goto failure; @@ -14509,7 +15875,7 @@ zone_rekey(dns_zone_t *zone) { dns_zone_log(zone, ISC_LOG_ERROR, "zone_rekey:" "couldn't update zone keys: %s", isc_result_totext(result)); - goto trylater; + goto failure; } /* @@ -14552,15 +15918,17 @@ zone_rekey(dns_zone_t *zone) { CHECK(add_signing_records(db, zone->privatetype, ver, &diff, ISC_TF(newalg || fullsign))); - CHECK(increment_soa_serial(db, ver, &diff, mctx)); + CHECK(update_soa_serial(db, ver, &diff, mctx, + zone->updatemethod)); CHECK(add_chains(zone, db, ver, &diff)); CHECK(sign_apex(zone, db, ver, &diff, &zonediff)); - CHECK(zone_journal(zone, zonediff.diff, "zone_rekey")); + CHECK(zone_journal(zone, zonediff.diff, NULL, + "zone_rekey")); commit = ISC_TRUE; } } - dns_db_closeversion(db, &ver, commit); + dns_db_closeversion(db, &ver, ISC_TRUE); if (commit) { dns_difftuple_t *tuple; @@ -14673,6 +16041,13 @@ zone_rekey(dns_zone_t *zone) { } /* + * Activate any NSEC3 chain updates that may have + * been scheduled before this rekey. + */ + if (fullsign || newalg) + resume_addnsec3chain(zone); + + /* * Schedule the next resigning event */ set_resigntime(zone); @@ -14683,15 +16058,16 @@ zone_rekey(dns_zone_t *zone) { /* * If we're doing key maintenance, set the key refresh timer to - * the next scheduled key event or to one hour in the future, - * whichever is sooner. + * the next scheduled key event or to 'dnssec-loadkeys-interval' + * seconds in the future, whichever is sooner. */ if (DNS_ZONEKEY_OPTION(zone, DNS_ZONEKEY_MAINTAIN)) { isc_time_t timethen; isc_stdtime_t then; LOCK_ZONE(zone); - DNS_ZONE_TIME_ADD(&timenow, HOUR, &timethen); + DNS_ZONE_TIME_ADD(&timenow, zone->refreshkeyinterval, + &timethen); zone->refreshkeytime = timethen; UNLOCK_ZONE(zone); @@ -14718,7 +16094,7 @@ zone_rekey(dns_zone_t *zone) { dns_zone_log(zone, ISC_LOG_INFO, "next key event: %s", timebuf); } - failure: + done: dns_diff_clear(&diff); dns_diff_clear(&_sig_diff); @@ -14740,10 +16116,14 @@ zone_rekey(dns_zone_t *zone) { dns_db_detach(&db); return; - trylater: - isc_interval_set(&ival, HOUR, 0); + failure: + /* + * Something went wrong; try again in ten minutes or + * after a key refresh interval, whichever is shorter. + */ + isc_interval_set(&ival, ISC_MIN(zone->refreshkeyinterval, 600), 0); isc_time_nowplusinterval(&zone->refreshkeytime, &ival); - goto failure; + goto done; } void @@ -14802,10 +16182,572 @@ dns_zone_dlzpostload(dns_zone_t *zone, dns_db_t *db) { isc_time_t loadtime; isc_result_t result; + TIME_NOW(&loadtime); + /* + * Lock hierarchy: zmgr, zone, raw. + */ LOCK_ZONE(zone); + if (inline_secure(zone)) + LOCK_ZONE(zone->raw); result = zone_postload(zone, db, loadtime, ISC_R_SUCCESS); + if (inline_secure(zone)) + UNLOCK_ZONE(zone->raw); UNLOCK_ZONE(zone); return result; } + +isc_result_t +dns_zone_setrefreshkeyinterval(dns_zone_t *zone, isc_uint32_t interval) { + REQUIRE(DNS_ZONE_VALID(zone)); + if (interval == 0) + return (ISC_R_RANGE); + /* Maximum value: 24 hours (3600 minutes) */ + if (interval > (24 * 60)) + interval = (24 * 60); + /* Multiply by 60 for seconds */ + zone->refreshkeyinterval = interval * 60; + return (ISC_R_SUCCESS); +} + +void +dns_zone_setrequestixfr(dns_zone_t *zone, isc_boolean_t flag) { + REQUIRE(DNS_ZONE_VALID(zone)); + zone->requestixfr = flag; +} + +isc_boolean_t +dns_zone_getrequestixfr(dns_zone_t *zone) { + REQUIRE(DNS_ZONE_VALID(zone)); + return (zone->requestixfr); +} + +void +dns_zone_setserialupdatemethod(dns_zone_t *zone, dns_updatemethod_t method) { + REQUIRE(DNS_ZONE_VALID(zone)); + zone->updatemethod = method; +} + +dns_updatemethod_t +dns_zone_getserialupdatemethod(dns_zone_t *zone) { + REQUIRE(DNS_ZONE_VALID(zone)); + return(zone->updatemethod); +} + +/* + * Lock hierarchy: zmgr, zone, raw. + */ +isc_result_t +dns_zone_link(dns_zone_t *zone, dns_zone_t *raw) { + isc_result_t result; + dns_zonemgr_t *zmgr; + + REQUIRE(DNS_ZONE_VALID(zone)); + REQUIRE(zone->zmgr != NULL); + REQUIRE(zone->task != NULL); + REQUIRE(zone->loadtask != NULL); + REQUIRE(zone->raw == NULL); + + REQUIRE(DNS_ZONE_VALID(raw)); + REQUIRE(raw->zmgr == NULL); + REQUIRE(raw->task == NULL); + REQUIRE(raw->loadtask == NULL); + REQUIRE(raw->secure == NULL); + + /* + * Lock hierarchy: zmgr, zone, raw. + */ + zmgr = zone->zmgr; + RWLOCK(&zmgr->rwlock, isc_rwlocktype_write); + LOCK_ZONE(zone); + LOCK_ZONE(raw); + + result = isc_timer_create(zmgr->timermgr, isc_timertype_inactive, + NULL, NULL, zone->task, zone_timer, raw, + &raw->timer); + if (result != ISC_R_SUCCESS) + goto unlock; + + /* + * The timer "holds" a iref. + */ + raw->irefs++; + INSIST(raw->irefs != 0); + + + /* dns_zone_attach(raw, &zone->raw); */ + isc_refcount_increment(&raw->erefs, NULL); + zone->raw = raw; + + /* dns_zone_iattach(zone, &raw->secure); */ + zone_iattach(zone, &raw->secure); + + isc_task_attach(zone->task, &raw->task); + isc_task_attach(zone->loadtask, &raw->loadtask); + + ISC_LIST_APPEND(zmgr->zones, raw, link); + raw->zmgr = zmgr; + zmgr->refs++; + + unlock: + UNLOCK_ZONE(raw); + UNLOCK_ZONE(zone); + RWUNLOCK(&zmgr->rwlock, isc_rwlocktype_write); + return (result); +} + +void +dns_zone_getraw(dns_zone_t *zone, dns_zone_t **raw) { + REQUIRE(DNS_ZONE_VALID(zone)); + REQUIRE(raw != NULL && *raw == NULL); + + LOCK(&zone->lock); + if (zone->raw != NULL) + dns_zone_attach(zone->raw, raw); + UNLOCK(&zone->lock); +} + +struct keydone { + isc_event_t event; + isc_boolean_t all; + unsigned char data[5]; +}; + +#define PENDINGFLAGS (DNS_NSEC3FLAG_CREATE|DNS_NSEC3FLAG_INITIAL) + +static void +keydone(isc_task_t *task, isc_event_t *event) { + const char *me = "keydone"; + isc_boolean_t commit = ISC_FALSE; + isc_result_t result; + dns_rdata_t rdata = DNS_RDATA_INIT; + dns_dbversion_t *oldver = NULL, *newver = NULL; + dns_zone_t *zone; + dns_db_t *db = NULL; + dns_dbnode_t *node = NULL; + dns_rdataset_t rdataset; + dns_diff_t diff; + struct keydone *keydone = (struct keydone *)event; + dns_update_log_t log = { update_log_cb, NULL }; + isc_boolean_t clear_pending = ISC_FALSE; + + UNUSED(task); + + zone = event->ev_arg; + INSIST(DNS_ZONE_VALID(zone)); + + ENTER; + + dns_rdataset_init(&rdataset); + dns_diff_init(zone->mctx, &diff); + + ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read); + if (zone->db != NULL) { + dns_db_attach(zone->db, &db); + dns_db_currentversion(db, &oldver); + result = dns_db_newversion(db, &newver); + if (result != ISC_R_SUCCESS) { + dns_zone_log(zone, ISC_LOG_ERROR, + "keydone:dns_db_newversion -> %s", + dns_result_totext(result)); + goto failure; + } + } + ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read); + if (db == NULL) + goto failure; + + result = dns_db_getoriginnode(db, &node); + if (result != ISC_R_SUCCESS) + goto failure; + + result = dns_db_findrdataset(db, node, newver, zone->privatetype, + dns_rdatatype_none, 0, &rdataset, NULL); + if (result == ISC_R_NOTFOUND) { + INSIST(!dns_rdataset_isassociated(&rdataset)); + goto failure; + } + if (result != ISC_R_SUCCESS) { + INSIST(!dns_rdataset_isassociated(&rdataset)); + goto failure; + } + + for (result = dns_rdataset_first(&rdataset); + result == ISC_R_SUCCESS; + result = dns_rdataset_next(&rdataset)) { + isc_boolean_t found = ISC_FALSE; + + dns_rdataset_current(&rdataset, &rdata); + + if (keydone->all) { + if (rdata.length == 5 && rdata.data[0] != 0 && + rdata.data[3] == 0 && rdata.data[4] == 1) + found = ISC_TRUE; + else if (rdata.data[0] == 0 && + (rdata.data[2] & PENDINGFLAGS) != 0) { + found = ISC_TRUE; + clear_pending = ISC_TRUE; + } + } else if (rdata.length == 5 && + memcmp(rdata.data, keydone->data, 5) == 0) + found = ISC_TRUE; + + if (found) + CHECK(update_one_rr(db, newver, &diff, DNS_DIFFOP_DEL, + &zone->origin, rdataset.ttl, + &rdata)); + dns_rdata_reset(&rdata); + } + + if (!ISC_LIST_EMPTY(diff.tuples)) { + /* Write changes to journal file. */ + CHECK(update_soa_serial(db, newver, &diff, zone->mctx, + zone->updatemethod)); + + result = dns_update_signatures(&log, zone, db, + oldver, newver, &diff, + zone->sigvalidityinterval); + if (!clear_pending) + CHECK(result); + + CHECK(zone_journal(zone, &diff, NULL, "keydone")); + commit = ISC_TRUE; + + LOCK_ZONE(zone); + DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_LOADED); + zone_needdump(zone, 30); + UNLOCK_ZONE(zone); + } + + failure: + if (dns_rdataset_isassociated(&rdataset)) + dns_rdataset_disassociate(&rdataset); + if (db != NULL) { + if (node != NULL) + dns_db_detachnode(db, &node); + if (oldver != NULL) + dns_db_closeversion(db, &oldver, ISC_FALSE); + if (newver != NULL) + dns_db_closeversion(db, &newver, commit); + dns_db_detach(&db); + } + dns_diff_clear(&diff); + isc_event_free(&event); + dns_zone_idetach(&zone); +} + +isc_result_t +dns_zone_keydone(dns_zone_t *zone, const char *keystr) { + isc_result_t result = ISC_R_SUCCESS; + isc_event_t *e; + isc_buffer_t b; + dns_zone_t *dummy = NULL; + struct keydone *kd; + + REQUIRE(DNS_ZONE_VALID(zone)); + + LOCK_ZONE(zone); + + e = isc_event_allocate(zone->mctx, zone, DNS_EVENT_KEYDONE, keydone, + zone, sizeof(struct keydone)); + if (e == NULL) { + result = ISC_R_NOMEMORY; + goto failure; + } + + kd = (struct keydone *) e; + if (strcasecmp(keystr, "all") == 0) + kd->all = ISC_TRUE; + else { + isc_textregion_t r; + char *algstr; + dns_keytag_t keyid; + dns_secalg_t alg; + size_t n; + + kd->all = ISC_FALSE; + + n = sscanf(keystr, "%hd/", &keyid); + if (n == 0U) + CHECK(ISC_R_FAILURE); + + algstr = strchr(keystr, '/'); + if (algstr != NULL) + algstr++; + else + CHECK(ISC_R_FAILURE); + + n = sscanf(algstr, "%hhd", &alg); + if (n == 0U) { + DE_CONST(algstr, r.base); + r.length = strlen(algstr); + CHECK(dns_secalg_fromtext(&alg, &r)); + } + + /* construct a private-type rdata */ + isc_buffer_init(&b, kd->data, sizeof(kd->data)); + isc_buffer_putuint8(&b, alg); + isc_buffer_putuint8(&b, (keyid & 0xff00) >> 8); + isc_buffer_putuint8(&b, (keyid & 0xff)); + isc_buffer_putuint8(&b, 0); + isc_buffer_putuint8(&b, 1); + } + + zone_iattach(zone, &dummy); + isc_task_send(zone->task, &e); + + failure: + if (e != NULL) + isc_event_free(&e); + UNLOCK_ZONE(zone); + return (result); +} + +struct nsec3param { + isc_event_t event; + unsigned char data[DNS_NSEC3PARAM_BUFFERSIZE + 1]; + unsigned int length; + isc_boolean_t nsec; + isc_boolean_t replace; +}; + +static void +setnsec3param(isc_task_t *task, isc_event_t *event) { + const char *me = "setnsec3param"; + isc_boolean_t commit = ISC_FALSE; + isc_result_t result; + dns_dbversion_t *oldver = NULL, *newver = NULL; + dns_zone_t *zone; + dns_db_t *db = NULL; + dns_dbnode_t *node = NULL; + dns_rdataset_t prdataset, nrdataset; + dns_diff_t diff; + struct nsec3param *np = (struct nsec3param *)event; + dns_update_log_t log = { update_log_cb, NULL }; + dns_rdata_t rdata; + isc_boolean_t nseconly; + isc_boolean_t exists = ISC_FALSE; + + UNUSED(task); + + zone = event->ev_arg; + INSIST(DNS_ZONE_VALID(zone)); + + ENTER; + + dns_rdataset_init(&prdataset); + dns_rdataset_init(&nrdataset); + dns_diff_init(zone->mctx, &diff); + + ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read); + if (zone->db != NULL) { + dns_db_attach(zone->db, &db); + dns_db_currentversion(db, &oldver); + result = dns_db_newversion(db, &newver); + if (result != ISC_R_SUCCESS) { + dns_zone_log(zone, ISC_LOG_ERROR, + "setnsec3param:dns_db_newversion -> %s", + dns_result_totext(result)); + goto failure; + } + } + ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read); + if (db == NULL) + goto failure; + + CHECK(dns_db_getoriginnode(db, &node)); + + /* + * Does a private-type record already exist for this chain? + */ + result = dns_db_findrdataset(db, node, newver, zone->privatetype, + dns_rdatatype_none, 0, &prdataset, NULL); + if (result == ISC_R_SUCCESS) { + for (result = dns_rdataset_first(&prdataset); + result == ISC_R_SUCCESS; + result = dns_rdataset_next(&prdataset)) { + dns_rdata_init(&rdata); + dns_rdataset_current(&prdataset, &rdata); + + if (np->length == rdata.length && + memcmp(rdata.data, np->data, np->length) == 0) { + exists = ISC_TRUE; + break; + } + } + } else if (result != ISC_R_NOTFOUND) { + INSIST(!dns_rdataset_isassociated(&prdataset)); + goto failure; + } + + /* + * Does the chain already exist? + */ + result = dns_db_findrdataset(db, node, newver, + dns_rdatatype_nsec3param, + dns_rdatatype_none, 0, &nrdataset, NULL); + if (result == ISC_R_SUCCESS) { + for (result = dns_rdataset_first(&nrdataset); + result == ISC_R_SUCCESS; + result = dns_rdataset_next(&nrdataset)) { + dns_rdata_init(&rdata); + dns_rdataset_current(&nrdataset, &rdata); + + if (np->length == (rdata.length + 1) && + memcmp(rdata.data, np->data + 1, + np->length - 1) == 0) + { + exists = ISC_TRUE; + break; + } + } + } else if (result != ISC_R_NOTFOUND) { + INSIST(!dns_rdataset_isassociated(&nrdataset)); + goto failure; + } + + + /* + * We need to remove any existing NSEC3 chains. + */ + if (!exists && np->replace && (np->length != 0 || np->nsec)) + CHECK(dns_nsec3param_deletechains(db, newver, zone, + !np->nsec, &diff)); + + if (!exists && np->length != 0) { + /* + * We're creating an NSEC3 chain. + * + * If the zone is not currently capable of supporting + * an NSEC3 chain, add the INITIAL flag, so these + * parameters can be used later when NSEC3 becomes + * available. + */ + dns_rdata_init(&rdata); + + np->data[2] |= DNS_NSEC3FLAG_CREATE; + result = dns_nsec_nseconly(db, newver, &nseconly); + if (result == ISC_R_NOTFOUND || nseconly) + np->data[2] |= DNS_NSEC3FLAG_INITIAL; + + rdata.length = np->length; + rdata.data = np->data; + rdata.type = zone->privatetype; + rdata.rdclass = zone->rdclass; + CHECK(update_one_rr(db, newver, &diff, DNS_DIFFOP_ADD, + &zone->origin, 0, &rdata)); + } + + if (!ISC_LIST_EMPTY(diff.tuples)) { + /* Write changes to journal file. */ + CHECK(update_soa_serial(db, newver, &diff, zone->mctx, + zone->updatemethod)); + result = dns_update_signatures(&log, zone, db, + oldver, newver, &diff, + zone->sigvalidityinterval); + if (result != ISC_R_NOTFOUND) + CHECK(result); + CHECK(zone_journal(zone, &diff, NULL, "setnsec3param")); + commit = ISC_TRUE; + + LOCK_ZONE(zone); + DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_LOADED); + zone_needdump(zone, 30); + UNLOCK_ZONE(zone); + } + + failure: + if (dns_rdataset_isassociated(&prdataset)) + dns_rdataset_disassociate(&prdataset); + if (dns_rdataset_isassociated(&nrdataset)) + dns_rdataset_disassociate(&nrdataset); + if (node != NULL) + dns_db_detachnode(db, &node); + if (oldver != NULL) + dns_db_closeversion(db, &oldver, ISC_FALSE); + if (newver != NULL) + dns_db_closeversion(db, &newver, commit); + if (db != NULL) + dns_db_detach(&db); + if (commit) + resume_addnsec3chain(zone); + dns_diff_clear(&diff); + isc_event_free(&event); + dns_zone_idetach(&zone); +} + +isc_result_t +dns_zone_setnsec3param(dns_zone_t *zone, isc_uint8_t hash, isc_uint8_t flags, + isc_uint16_t iter, isc_uint8_t saltlen, + unsigned char *salt, isc_boolean_t replace) +{ + isc_result_t result = ISC_R_SUCCESS; + dns_rdata_nsec3param_t param; + dns_rdata_t nrdata = DNS_RDATA_INIT; + dns_rdata_t prdata = DNS_RDATA_INIT; + unsigned char nbuf[DNS_NSEC3PARAM_BUFFERSIZE]; + struct nsec3param *np; + dns_zone_t *dummy = NULL; + isc_buffer_t b; + isc_event_t *e; + + REQUIRE(DNS_ZONE_VALID(zone)); + REQUIRE(salt != NULL); + + LOCK_ZONE(zone); + + e = isc_event_allocate(zone->mctx, zone, DNS_EVENT_SETNSEC3PARAM, + setnsec3param, zone, sizeof(struct nsec3param)); + if (e == NULL) { + result = ISC_R_NOMEMORY; + goto failure; + } + + np = (struct nsec3param *) e; + np->replace = replace; + if (hash == 0) { + np->length = 0; + np->nsec = ISC_TRUE; + } else { + param.common.rdclass = zone->rdclass; + param.common.rdtype = dns_rdatatype_nsec3param; + ISC_LINK_INIT(¶m.common, link); + param.mctx = NULL; + param.hash = hash; + param.flags = flags; + param.iterations = iter; + param.salt_length = saltlen; + param.salt = salt; + isc_buffer_init(&b, nbuf, sizeof(nbuf)); + CHECK(dns_rdata_fromstruct(&nrdata, zone->rdclass, + dns_rdatatype_nsec3param, + ¶m, &b)); + dns_nsec3param_toprivate(&nrdata, &prdata, zone->privatetype, + np->data, sizeof(np->data)); + np->length = prdata.length; + } + + zone_iattach(zone, &dummy); + isc_task_send(zone->task, &e); + + failure: + if (e != NULL) + isc_event_free(&e); + UNLOCK_ZONE(zone); + return (result); +} + +void +dns_zone_setstatlevel(dns_zone_t *zone, dns_zonestat_level_t level) { + REQUIRE(DNS_ZONE_VALID(zone)); + + zone->statlevel = level; +} + +dns_zonestat_level_t +dns_zone_getstatlevel(dns_zone_t *zone) { + REQUIRE(DNS_ZONE_VALID(zone)); + + return (zone->statlevel); +} diff --git a/lib/dns/zt.c b/lib/dns/zt.c index 650d46b..eb1e424 100644 --- a/lib/dns/zt.c +++ b/lib/dns/zt.c @@ -25,6 +25,7 @@ #include <isc/magic.h> #include <isc/mem.h> #include <isc/string.h> +#include <isc/task.h> #include <isc/util.h> #include <dns/log.h> @@ -42,8 +43,12 @@ struct dns_zt { isc_mem_t *mctx; dns_rdataclass_t rdclass; isc_rwlock_t rwlock; + dns_zt_allloaded_t loaddone; + void * loaddone_arg; /* Locked by lock. */ + isc_boolean_t flush; isc_uint32_t references; + unsigned int loads_pending; dns_rbt_t *table; }; @@ -57,11 +62,17 @@ static isc_result_t load(dns_zone_t *zone, void *uap); static isc_result_t +asyncload(dns_zone_t *zone, void *callback); + +static isc_result_t loadnew(dns_zone_t *zone, void *uap); static isc_result_t freezezones(dns_zone_t *zone, void *uap); +static isc_result_t +doneloading(dns_zt_t *zt, dns_zone_t *zone, isc_task_t *task); + isc_result_t dns_zt_create(isc_mem_t *mctx, dns_rdataclass_t rdclass, dns_zt_t **ztp) { @@ -83,10 +94,15 @@ dns_zt_create(isc_mem_t *mctx, dns_rdataclass_t rdclass, dns_zt_t **ztp) if (result != ISC_R_SUCCESS) goto cleanup_rbt; - zt->mctx = mctx; + zt->mctx = NULL; + isc_mem_attach(mctx, &zt->mctx); zt->references = 1; + zt->flush = ISC_FALSE; zt->rdclass = rdclass; zt->magic = ZTMAGIC; + zt->loaddone = NULL; + zt->loaddone_arg = NULL; + zt->loads_pending = 0; *ztp = zt; return (ISC_R_SUCCESS); @@ -188,6 +204,16 @@ flush(dns_zone_t *zone, void *uap) { } static void +zt_destroy(dns_zt_t *zt) { + if (zt->flush) + (void)dns_zt_apply(zt, ISC_FALSE, flush, NULL); + dns_rbt_destroy(&zt->table); + isc_rwlock_destroy(&zt->rwlock); + zt->magic = 0; + isc_mem_putanddetach(&zt->mctx, zt, sizeof(*zt)); +} + +static void zt_flushanddetach(dns_zt_t **ztp, isc_boolean_t need_flush) { isc_boolean_t destroy = ISC_FALSE; dns_zt_t *zt; @@ -202,17 +228,13 @@ zt_flushanddetach(dns_zt_t **ztp, isc_boolean_t need_flush) { zt->references--; if (zt->references == 0) destroy = ISC_TRUE; + if (need_flush) + zt->flush = ISC_TRUE; RWUNLOCK(&zt->rwlock, isc_rwlocktype_write); - if (destroy) { - if (need_flush) - (void)dns_zt_apply(zt, ISC_FALSE, flush, NULL); - dns_rbt_destroy(&zt->table); - isc_rwlock_destroy(&zt->rwlock); - zt->magic = 0; - isc_mem_put(zt->mctx, zt, sizeof(*zt)); - } + if (destroy) + zt_destroy(zt); *ztp = NULL; } @@ -243,13 +265,67 @@ static isc_result_t load(dns_zone_t *zone, void *uap) { isc_result_t result; UNUSED(uap); + result = dns_zone_load(zone); if (result == DNS_R_CONTINUE || result == DNS_R_UPTODATE) result = ISC_R_SUCCESS; + return (result); } isc_result_t +dns_zt_asyncload(dns_zt_t *zt, dns_zt_allloaded_t alldone, void *arg) { + isc_result_t result; + static dns_zt_zoneloaded_t dl = doneloading; + int pending; + + REQUIRE(VALID_ZT(zt)); + + RWLOCK(&zt->rwlock, isc_rwlocktype_write); + + INSIST(zt->loads_pending == 0); + result = dns_zt_apply2(zt, ISC_FALSE, NULL, asyncload, &dl); + + pending = zt->loads_pending; + if (pending != 0) { + zt->loaddone = alldone; + zt->loaddone_arg = arg; + } + + RWUNLOCK(&zt->rwlock, isc_rwlocktype_write); + + if (pending == 0) + alldone(arg); + + return (result); +} + +/* + * Initiates asynchronous loading of zone 'zone'. 'callback' is a + * pointer to a function which will be used to inform the caller when + * the zone loading is complete. + */ +static isc_result_t +asyncload(dns_zone_t *zone, void *callback) { + isc_result_t result; + dns_zt_zoneloaded_t *loaded = callback; + dns_zt_t *zt; + + REQUIRE(zone != NULL); + zt = dns_zone_getview(zone)->zonetable; + INSIST(VALID_ZT(zt)); + + result = dns_zone_asyncload(zone, *loaded, zt); + if (result == ISC_R_SUCCESS) { + INSIST(zt->references > 0); + zt->references++; + INSIST(zt->references != 0); + zt->loads_pending++; + } + return (ISC_R_SUCCESS); +} + +isc_result_t dns_zt_loadnew(dns_zt_t *zt, isc_boolean_t stop) { isc_result_t result; @@ -265,6 +341,7 @@ static isc_result_t loadnew(dns_zone_t *zone, void *uap) { isc_result_t result; UNUSED(uap); + result = dns_zone_loadnew(zone); if (result == DNS_R_CONTINUE || result == DNS_R_UPTODATE || result == DNS_R_DYNAMIC) @@ -281,6 +358,8 @@ dns_zt_freezezones(dns_zt_t *zt, isc_boolean_t freeze) { RWLOCK(&zt->rwlock, isc_rwlocktype_read); result = dns_zt_apply2(zt, ISC_FALSE, &tresult, freezezones, &freeze); RWUNLOCK(&zt->rwlock, isc_rwlocktype_read); + if (tresult == ISC_R_NOTFOUND) + tresult = ISC_R_SUCCESS; return ((result == ISC_R_SUCCESS) ? tresult : result); } @@ -291,14 +370,25 @@ freezezones(dns_zone_t *zone, void *uap) { isc_result_t result = ISC_R_SUCCESS; char classstr[DNS_RDATACLASS_FORMATSIZE]; char zonename[DNS_NAME_FORMATSIZE]; + dns_zone_t *raw = NULL; dns_view_t *view; - char *journal; const char *vname; const char *sep; int level; - if (dns_zone_gettype(zone) != dns_zone_master) + dns_zone_getraw(zone, &raw); + if (raw != NULL) + zone = raw; + if (dns_zone_gettype(zone) != dns_zone_master) { + if (raw != NULL) + dns_zone_detach(&raw); + return (ISC_R_SUCCESS); + } + if (!dns_zone_isdynamic(zone, ISC_TRUE)) { + if (raw != NULL) + dns_zone_detach(&raw); return (ISC_R_SUCCESS); + } frozen = dns_zone_getupdatedisabled(zone); if (freeze) { @@ -306,11 +396,6 @@ freezezones(dns_zone_t *zone, void *uap) { result = DNS_R_FROZEN; if (result == ISC_R_SUCCESS) result = dns_zone_flush(zone); - if (result == ISC_R_SUCCESS) { - journal = dns_zone_getjournal(zone); - if (journal != NULL) - (void)isc_file_remove(journal); - } } else { if (frozen) { result = dns_zone_load(zone); @@ -340,6 +425,8 @@ freezezones(dns_zone_t *zone, void *uap) { freeze ? "freezing" : "thawing", zonename, classstr, sep, vname, isc_result_totext(result)); + if (raw != NULL) + dns_zone_detach(&raw); return (result); } @@ -368,6 +455,7 @@ dns_zt_apply2(dns_zt_t *zt, isc_boolean_t stop, isc_result_t *sub, /* * The tree is empty. */ + tresult = result; result = ISC_R_NOMORE; } while (result == DNS_R_NEWORIGIN || result == ISC_R_SUCCESS) { @@ -397,6 +485,46 @@ dns_zt_apply2(dns_zt_t *zt, isc_boolean_t stop, isc_result_t *sub, return (result); } +/* + * Decrement the loads_pending counter; when counter reaches + * zero, call the loaddone callback that was initially set by + * dns_zt_asyncload(). + */ +static isc_result_t +doneloading(dns_zt_t *zt, dns_zone_t *zone, isc_task_t *task) { + isc_boolean_t destroy = ISC_FALSE; + dns_zt_allloaded_t alldone = NULL; + void *arg = NULL; + + UNUSED(zone); + UNUSED(task); + + REQUIRE(VALID_ZT(zt)); + + RWLOCK(&zt->rwlock, isc_rwlocktype_write); + INSIST(zt->loads_pending != 0); + INSIST(zt->references != 0); + zt->references--; + if (zt->references == 0) + destroy = ISC_TRUE; + zt->loads_pending--; + if (zt->loads_pending == 0) { + alldone = zt->loaddone; + arg = zt->loaddone_arg; + zt->loaddone = NULL; + zt->loaddone_arg = NULL; + } + RWUNLOCK(&zt->rwlock, isc_rwlocktype_write); + + if (alldone != NULL) + alldone(arg); + + if (destroy) + zt_destroy(zt); + + return (ISC_R_SUCCESS); +} + /*** *** Private ***/ diff --git a/lib/irs/api b/lib/irs/api index 5c8dd5e..298e96a 100644 --- a/lib/irs/api +++ b/lib/irs/api @@ -4,6 +4,6 @@ # 9.8: 80-89, 120-129 # 9.9: 90-109 # 9.9-sub: 130-139 -LIBINTERFACE = 80 -LIBREVISION = 4 +LIBINTERFACE = 90 +LIBREVISION = 1 LIBAGE = 0 diff --git a/lib/isc/Makefile.in b/lib/isc/Makefile.in index 2fa5633..e68290c 100644 --- a/lib/isc/Makefile.in +++ b/lib/isc/Makefile.in @@ -58,7 +58,7 @@ OBJS = @ISC_EXTRA_OBJS@ \ httpd.@O@ inet_aton.@O@ iterated_hash.@O@ \ lex.@O@ lfsr.@O@ lib.@O@ log.@O@ \ md5.@O@ mem.@O@ mutexblock.@O@ \ - netaddr.@O@ netscope.@O@ ondestroy.@O@ \ + netaddr.@O@ netscope.@O@ pool.@O@ ondestroy.@O@ \ parseint.@O@ portset.@O@ quota.@O@ radix.@O@ random.@O@ \ ratelimiter.@O@ refcount.@O@ region.@O@ regex.@O@ result.@O@ \ rwlock.@O@ \ @@ -75,7 +75,7 @@ SRCS = @ISC_EXTRA_SRCS@ \ httpd.c inet_aton.c iterated_hash.c \ lex.c lfsr.c lib.c log.c \ md5.c mem.c mutexblock.c \ - netaddr.c netscope.c ondestroy.c \ + netaddr.c netscope.c pool.c ondestroy.c \ parseint.c portset.c quota.c radix.c random.c \ ratelimiter.c refcount.c region.c regex.c result.c rwlock.c \ serial.c sha1.c sha2.c sockaddr.c stats.c string.c strtoul.c \ diff --git a/lib/isc/api b/lib/isc/api index c7d2813..48bc766 100644 --- a/lib/isc/api +++ b/lib/isc/api @@ -4,6 +4,6 @@ # 9.8: 80-89, 120-129 # 9.9: 90-109 # 9.9-sub: 130-139 -LIBINTERFACE = 87 +LIBINTERFACE = 95 LIBREVISION = 1 -LIBAGE = 3 +LIBAGE = 0 diff --git a/lib/isc/include/isc/heap.h b/lib/isc/include/isc/heap.h index 77bf07c..0b3a53b 100644 --- a/lib/isc/include/isc/heap.h +++ b/lib/isc/include/isc/heap.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2007, 2009 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007, 2009, 2012 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1997-2001 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -60,6 +60,8 @@ isc_heap_create(isc_mem_t *mctx, isc_heapcompare_t compare, * storage method. When the heap elements are deleted space is not freed * but will be reused when new elements are inserted. * + * Heap elements are indexed from 1. + * * Requires: *\li "mctx" is valid. *\li "compare" is a function which takes two void * arguments and diff --git a/lib/isc/include/isc/list.h b/lib/isc/include/isc/list.h index 2b174ec..401bbdad 100644 --- a/lib/isc/include/isc/list.h +++ b/lib/isc/include/isc/list.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2006, 2007, 2012, 2013 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2006, 2007, 2011-2013 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1997-2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -171,6 +171,19 @@ (list2).tail = NULL; \ } while (0) +#define ISC_LIST_PREPENDLIST(list1, list2, link) \ + do { \ + if (ISC_LIST_EMPTY(list1)) \ + (list1) = (list2); \ + else if (!ISC_LIST_EMPTY(list2)) { \ + (list2).tail->link.next = (list1).head; \ + (list1).head->link.prev = (list2).tail; \ + (list1).head = (list2).head; \ + } \ + (list2).head = NULL; \ + (list2).tail = NULL; \ + } while (0) + #define ISC_LIST_ENQUEUE(list, elt, link) ISC_LIST_APPEND(list, elt, link) #define __ISC_LIST_ENQUEUEUNSAFE(list, elt, link) \ __ISC_LIST_APPENDUNSAFE(list, elt, link) diff --git a/lib/isc/include/isc/mem.h b/lib/isc/include/isc/mem.h index 317417f..320d0d8 100644 --- a/lib/isc/include/isc/mem.h +++ b/lib/isc/include/isc/mem.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2010, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2012 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1997-2001 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -317,7 +317,7 @@ isc_mem_createx2(size_t max_size, size_t target_size, * ISC_MEMFLAG_INTERNAL is not set, 'target_size' is ignored. * * 'max_size' is also used to size the statistics arrays and the array - * used to record active memory when ISC_MEM_DEBUGRECORD is set. Settin + * used to record active memory when ISC_MEM_DEBUGRECORD is set. Setting * 'max_size' too low can have detrimental effects on performance. * * A memory context created using isc_mem_createx() will obtain diff --git a/lib/isc/include/isc/namespace.h b/lib/isc/include/isc/namespace.h index 45b769c..f8744d8 100644 --- a/lib/isc/include/isc/namespace.h +++ b/lib/isc/include/isc/namespace.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2009, 2010, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2009-2012 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -31,6 +31,7 @@ #define isc_app_run isc__app_run #define isc_app_ctxrun isc__app_ctxrun #define isc_app_shutdown isc__app_shutdown +#define isc_app_ctxfinish isc__app_ctxfinish #define isc_app_ctxshutdown isc__app_ctxshutdown #define isc_app_ctxsuspend isc__app_ctxsuspend #define isc_app_reload isc__app_reload @@ -89,6 +90,7 @@ #define isc_mempool_getfillcount isc__mempool_getfillcount #define isc_socket_create isc__socket_create +#define isc_socket_dup isc__socket_dup #define isc_socket_attach isc__socket_attach #define isc_socket_detach isc__socket_detach #define isc_socketmgr_create isc__socketmgr_create @@ -111,6 +113,7 @@ #define isc_socket_listen isc__socket_listen #define isc_socket_accept isc__socket_accept #define isc_socket_connect isc__socket_connect +#define isc_socket_getfd isc__socket_getfd #define isc_socket_getname isc__socket_getname #define isc_socket_gettag isc__socket_gettag #define isc_socket_getpeername isc__socket_getpeername @@ -146,11 +149,15 @@ #define isc_task_gettag isc__task_gettag #define isc_task_getcurrenttime isc__task_getcurrenttime #define isc_taskmgr_create isc__taskmgr_create +#define isc_taskmgr_setmode isc__taskmgr_setmode +#define isc_taskmgr_mode isc__taskmgr_mode #define isc_taskmgr_destroy isc__taskmgr_destroy #define isc_taskmgr_setexcltask isc__taskmgr_setexcltask #define isc_taskmgr_excltask isc__taskmgr_excltask #define isc_task_beginexclusive isc__task_beginexclusive #define isc_task_endexclusive isc__task_endexclusive +#define isc_task_setprivilege isc__task_setprivilege +#define isc_task_privilege isc__task_privilege #define isc_timer_create isc__timer_create #define isc_timer_reset isc__timer_reset diff --git a/lib/isc/include/isc/pool.h b/lib/isc/include/isc/pool.h new file mode 100644 index 0000000..7b33c37 --- /dev/null +++ b/lib/isc/include/isc/pool.h @@ -0,0 +1,149 @@ +/* + * Copyright (C) 2013 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef ISC_OBJPOOL_H +#define ISC_OBJPOOL_H 1 + +/***** + ***** Module Info + *****/ + +/*! \file isc/pool.h + * \brief An object pool is a mechanism for sharing a small pool of + * fungible objects among a large number of objects that depend on them. + * + * This is useful, for example, when it causes performance problems for + * large number of zones to share a single memory context or task object, + * but it would create a different set of problems for them each to have an + * independent task or memory context. + */ + + +/*** + *** Imports. + ***/ + +#include <isc/lang.h> +#include <isc/mem.h> +#include <isc/types.h> + +ISC_LANG_BEGINDECLS + +/***** + ***** Types. + *****/ + +typedef void +(*isc_pooldeallocator_t)(void **object); + +typedef isc_result_t +(*isc_poolinitializer_t)(void **target, void *arg); + +typedef struct isc_pool isc_pool_t; + +/***** + ***** Functions. + *****/ + +isc_result_t +isc_pool_create(isc_mem_t *mctx, unsigned int count, + isc_pooldeallocator_t free, + isc_poolinitializer_t init, void *initarg, + isc_pool_t **poolp); +/*%< + * Create a pool of "count" object pointers. If 'free' is not NULL, + * it points to a function that will detach the objects. 'init' + * points to a function that will initialize the arguments, and + * 'arg' to an argument to be passed into that function (for example, + * a relevant manager or context object). + * + * Requires: + * + *\li 'mctx' is a valid memory context. + * + *\li init != NULL + * + *\li poolp != NULL && *poolp == NULL + * + * Ensures: + * + *\li On success, '*poolp' points to the new object pool. + * + * Returns: + * + *\li #ISC_R_SUCCESS + *\li #ISC_R_NOMEMORY + *\li #ISC_R_UNEXPECTED + */ + +void * +isc_pool_get(isc_pool_t *pool); +/*%< + * Returns a pointer to an object from the pool. Currently the object + * is chosen from the pool at random. (This may be changed in the future + * to something that guaratees balance.) + */ + +int +isc_pool_count(isc_pool_t *pool); +/*%< + * Returns the number of objcts in the pool 'pool'. + */ + +isc_result_t +isc_pool_expand(isc_pool_t **sourcep, unsigned int count, isc_pool_t **targetp); + +/*%< + * If 'size' is larger than the number of objects in the pool pointed to by + * 'sourcep', then a new pool of size 'count' is allocated, the existing + * objects are copied into it, additional ones created to bring the + * total number up to 'count', and the resulting pool is attached to + * 'targetp'. + * + * If 'count' is less than or equal to the number of objects in 'source', then + * 'sourcep' is attached to 'targetp' without any other action being taken. + * + * In either case, 'sourcep' is detached. + * + * Requires: + * + * \li 'sourcep' is not NULL and '*source' is not NULL + * \li 'targetp' is not NULL and '*source' is NULL + * + * Ensures: + * + * \li On success, '*targetp' points to a valid task pool. + * \li On success, '*sourcep' points to NULL. + * + * Returns: + * + * \li #ISC_R_SUCCESS + * \li #ISC_R_NOMEMORY + */ + +void +isc_pool_destroy(isc_pool_t **poolp); +/*%< + * Destroy a task pool. The tasks in the pool are detached but not + * shut down. + * + * Requires: + * \li '*poolp' is a valid task pool. + */ + +ISC_LANG_ENDDECLS + +#endif /* ISC_OBJPOOL_H */ diff --git a/lib/isc/include/isc/queue.h b/lib/isc/include/isc/queue.h new file mode 100644 index 0000000..1cc6c12 --- /dev/null +++ b/lib/isc/include/isc/queue.h @@ -0,0 +1,165 @@ +/* + * Copyright (C) 2011-2013 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +/* $Id$ */ + +/* + * This is a generic implementation of a two-lock concurrent queue. + * There are built-in mutex locks for the head and tail of the queue, + * allowing elements to be safely added and removed at the same time. + * + * NULL is "end of list" + * -1 is "not linked" + */ + +#ifndef ISC_QUEUE_H +#define ISC_QUEUE_H 1 +#include <isc/assertions.h> +#include <isc/boolean.h> +#include <isc/mutex.h> + +#ifdef ISC_QUEUE_CHECKINIT +#define ISC_QLINK_INSIST(x) ISC_INSIST(x) +#else +#define ISC_QLINK_INSIST(x) (void)0 +#endif + +#define ISC_QLINK(type) struct { type *prev, *next; } + +#define ISC_QLINK_INIT(elt, link) \ + do { \ + (elt)->link.next = (elt)->link.prev = (void *)(-1); \ + } while(0) + +#define ISC_QLINK_LINKED(elt, link) ((void*)(elt)->link.next != (void*)(-1)) + +#define ISC_QUEUE(type) struct { \ + type *head, *tail; \ + isc_mutex_t headlock, taillock; \ +} + +#define ISC_QUEUE_INIT(queue, link) \ + do { \ + (void) isc_mutex_init(&(queue).taillock); \ + (void) isc_mutex_init(&(queue).headlock); \ + (queue).tail = (queue).head = NULL; \ + } while (0) + +#define ISC_QUEUE_EMPTY(queue) ISC_TF((queue).head == NULL) + +#define ISC_QUEUE_DESTROY(queue) \ + do { \ + ISC_QLINK_INSIST(ISC_QUEUE_EMPTY(queue)); \ + (void) isc_mutex_destroy(&(queue).taillock); \ + (void) isc_mutex_destroy(&(queue).headlock); \ + } while (0) + +/* + * queues are meant to separate the locks at either end. For best effect, that + * means keeping the ends separate - i.e. non-empty queues work best. + * + * a push to an empty queue has to take the pop lock to update + * the pop side of the queue. + * Popping the last entry has to take the push lock to update + * the push side of the queue. + * + * The order is (pop, push), because a pop is presumably in the + * latency path and a push is when we're done. + * + * We do an MT hot test in push to see if we need both locks, so we can + * acquire them in order. Hopefully that makes the case where we get + * the push lock and find we need the pop lock (and have to release it) rare. + * + * > 1 entry - no collision, push works on one end, pop on the other + * 0 entry - headlock race + * pop wins - return(NULL), push adds new as both head/tail + * push wins - updates head/tail, becomes 1 entry case. + * 1 entry - taillock race + * pop wins - return(pop) sets head/tail NULL, becomes 0 entry case + * push wins - updates {head,tail}->link.next, pop updates head + * with new ->link.next and doesn't update tail + * + */ +#define ISC_QUEUE_PUSH(queue, elt, link) \ + do { \ + isc_boolean_t headlocked = ISC_FALSE; \ + ISC_QLINK_INSIST(!ISC_QLINK_LINKED(elt, link)); \ + if ((queue).head == NULL) { \ + LOCK(&(queue).headlock); \ + headlocked = ISC_TRUE; \ + } \ + LOCK(&(queue).taillock); \ + if ((queue).tail == NULL && !headlocked) { \ + UNLOCK(&(queue).taillock); \ + LOCK(&(queue).headlock); \ + LOCK(&(queue).taillock); \ + headlocked = ISC_TRUE; \ + } \ + (elt)->link.prev = (queue).tail; \ + (elt)->link.next = NULL; \ + if ((queue).tail != NULL) \ + (queue).tail->link.next = (elt); \ + (queue).tail = (elt); \ + UNLOCK(&(queue).taillock); \ + if (headlocked) { \ + if ((queue).head == NULL) \ + (queue).head = (elt); \ + UNLOCK(&(queue).headlock); \ + } \ + } while (0) + +#define ISC_QUEUE_POP(queue, link, ret) \ + do { \ + LOCK(&(queue).headlock); \ + ret = (queue).head; \ + while (ret != NULL) { \ + if (ret->link.next == NULL) { \ + LOCK(&(queue).taillock); \ + if (ret->link.next == NULL) { \ + (queue).head = (queue).tail = NULL; \ + UNLOCK(&(queue).taillock); \ + break; \ + }\ + UNLOCK(&(queue).taillock); \ + } \ + (queue).head = ret->link.next; \ + (queue).head->link.prev = NULL; \ + break; \ + } \ + UNLOCK(&(queue).headlock); \ + if (ret != NULL) \ + (ret)->link.next = (ret)->link.prev = (void *)(-1); \ + } while(0) + +#define ISC_QUEUE_UNLINK(queue, elt, link) \ + do { \ + ISC_QLINK_INSIST(ISC_QLINK_LINKED(elt, link)); \ + LOCK(&(queue).headlock); \ + LOCK(&(queue).taillock); \ + if ((elt)->link.prev == NULL) \ + (queue).head = (elt)->link.next; \ + else \ + (elt)->link.prev->link.next = (elt)->link.next; \ + if ((elt)->link.next == NULL) \ + (queue).tail = (elt)->link.prev; \ + else \ + (elt)->link.next->link.prev = (elt)->link.prev; \ + UNLOCK(&(queue).taillock); \ + UNLOCK(&(queue).headlock); \ + (elt)->link.next = (elt)->link.prev = (void *)(-1); \ + } while(0) + +#endif /* ISC_QUEUE_H */ diff --git a/lib/isc/include/isc/radix.h b/lib/isc/include/isc/radix.h index 6b413a2..47512c7 100644 --- a/lib/isc/include/isc/radix.h +++ b/lib/isc/include/isc/radix.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2007, 2008 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2007, 2008, 2013 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -54,13 +54,14 @@ } while(0) typedef struct isc_prefix { - unsigned int family; /* AF_INET | AF_INET6, or AF_UNSPEC for "any" */ - unsigned int bitlen; /* 0 for "any" */ - isc_refcount_t refcount; - union { + isc_mem_t *mctx; + unsigned int family; /* AF_INET | AF_INET6, or AF_UNSPEC for "any" */ + unsigned int bitlen; /* 0 for "any" */ + isc_refcount_t refcount; + union { struct in_addr sin; struct in6_addr sin6; - } add; + } add; } isc_prefix_t; typedef void (*isc_radix_destroyfunc_t)(void *); @@ -90,12 +91,13 @@ typedef void (*isc_radix_processfunc_t)(isc_prefix_t *, void **); #define ISC_IS6(family) ((family) == AF_INET6 ? 1 : 0) typedef struct isc_radix_node { - isc_uint32_t bit; /* bit length of the prefix */ - isc_prefix_t *prefix; /* who we are in radix tree */ - struct isc_radix_node *l, *r; /* left and right children */ - struct isc_radix_node *parent; /* may be used */ - void *data[2]; /* pointers to IPv4 and IPV6 data */ - int node_num[2]; /* which node this was in the tree, + isc_mem_t *mctx; + isc_uint32_t bit; /* bit length of the prefix */ + isc_prefix_t *prefix; /* who we are in radix tree */ + struct isc_radix_node *l, *r; /* left and right children */ + struct isc_radix_node *parent; /* may be used */ + void *data[2]; /* pointers to IPv4 and IPV6 data */ + int node_num[2]; /* which node this was in the tree, or -1 for glue nodes */ } isc_radix_node_t; @@ -103,12 +105,12 @@ typedef struct isc_radix_node { #define RADIX_TREE_VALID(a) ISC_MAGIC_VALID(a, RADIX_TREE_MAGIC); typedef struct isc_radix_tree { - unsigned int magic; - isc_mem_t *mctx; - isc_radix_node_t *head; - isc_uint32_t maxbits; /* for IP, 32 bit addresses */ - int num_active_node; /* for debugging purposes */ - int num_added_node; /* total number of nodes */ + unsigned int magic; + isc_mem_t *mctx; + isc_radix_node_t *head; + isc_uint32_t maxbits; /* for IP, 32 bit addresses */ + int num_active_node; /* for debugging purposes */ + int num_added_node; /* total number of nodes */ } isc_radix_tree_t; isc_result_t diff --git a/lib/isc/include/isc/socket.h b/lib/isc/include/isc/socket.h index 4111ec2..9d086b4 100644 --- a/lib/isc/include/isc/socket.h +++ b/lib/isc/include/isc/socket.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2009, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2009, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1998-2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -283,12 +283,20 @@ typedef struct isc_socketmethods { isc_task_t *task, isc_taskaction_t action, const void *arg, isc_sockaddr_t *address, struct in6_pktinfo *pktinfo); + isc_result_t (*sendto2)(isc_socket_t *sock, isc_region_t *region, + isc_task_t *task, isc_sockaddr_t *address, + struct in6_pktinfo *pktinfo, + isc_socketevent_t *event, + unsigned int flags); isc_result_t (*connect)(isc_socket_t *sock, isc_sockaddr_t *addr, isc_task_t *task, isc_taskaction_t action, const void *arg); isc_result_t (*recv)(isc_socket_t *sock, isc_region_t *region, unsigned int minimum, isc_task_t *task, isc_taskaction_t action, const void *arg); + isc_result_t (*recv2)(isc_socket_t *sock, isc_region_t *region, + unsigned int minimum, isc_task_t *task, + isc_socketevent_t *event, unsigned int flags); void (*cancel)(isc_socket_t *sock, isc_task_t *task, unsigned int how); isc_result_t (*getsockname)(isc_socket_t *sock, @@ -296,6 +304,9 @@ typedef struct isc_socketmethods { isc_sockettype_t (*gettype)(isc_socket_t *sock); void (*ipv6only)(isc_socket_t *sock, isc_boolean_t yes); isc_result_t (*fdwatchpoke)(isc_socket_t *sock, int flags); + isc_result_t (*dup)(isc_socket_t *socket, + isc_socket_t **socketp); + int (*getfd)(isc_socket_t *socket); } isc_socketmethods_t; /*% @@ -449,6 +460,12 @@ isc_socket_create(isc_socketmgr_t *manager, *\li #ISC_R_UNEXPECTED */ +isc_result_t +isc_socket_dup(isc_socket_t *sock0, isc_socket_t **socketp); +/*%< + * Duplicate an existing socket, reusing its file descriptor. + */ + void isc_socket_cancel(isc_socket_t *sock, isc_task_t *task, unsigned int how); @@ -1102,6 +1119,11 @@ void *isc_socket_gettag(isc_socket_t *socket); * Get the tag associated with a socket, if any. */ +int isc_socket_getfd(isc_socket_t *socket); +/*%< + * Get the file descriptor associated with a socket + */ + void isc__socketmgr_setreserved(isc_socketmgr_t *mgr, isc_uint32_t); /*%< diff --git a/lib/isc/include/isc/task.h b/lib/isc/include/isc/task.h index ced7059..7abf2ef 100644 --- a/lib/isc/include/isc/task.h +++ b/lib/isc/include/isc/task.h @@ -88,6 +88,7 @@ #define ISC_TASKEVENT_FIRSTEVENT (ISC_EVENTCLASS_TASK + 0) #define ISC_TASKEVENT_SHUTDOWN (ISC_EVENTCLASS_TASK + 1) +#define ISC_TASKEVENT_TEST (ISC_EVENTCLASS_TASK + 1) #define ISC_TASKEVENT_LASTEVENT (ISC_EVENTCLASS_TASK + 65535) /***** @@ -100,9 +101,17 @@ ISC_LANG_BEGINDECLS *** Types ***/ +typedef enum { + isc_taskmgrmode_normal = 0, + isc_taskmgrmode_privileged +} isc_taskmgrmode_t; + /*% Task and task manager methods */ typedef struct isc_taskmgrmethods { void (*destroy)(isc_taskmgr_t **managerp); + void (*setmode)(isc_taskmgr_t *manager, + isc_taskmgrmode_t mode); + isc_taskmgrmode_t (*mode)(isc_taskmgr_t *manager); isc_result_t (*taskcreate)(isc_taskmgr_t *manager, unsigned int quantum, isc_task_t **taskp); @@ -129,6 +138,8 @@ typedef struct isc_taskmethods { void *tag); isc_result_t (*beginexclusive)(isc_task_t *task); void (*endexclusive)(isc_task_t *task); + void (*setprivilege)(isc_task_t *task, isc_boolean_t priv); + isc_boolean_t (*privilege)(isc_task_t *task); } isc_taskmethods_t; /*% @@ -613,6 +624,32 @@ isc_task_exiting(isc_task_t *t); *\li 'task' is a valid task. */ +void +isc_task_setprivilege(isc_task_t *task, isc_boolean_t priv); +/*%< + * Set or unset the task's "privileged" flag depending on the value of + * 'priv'. + * + * Under normal circumstances this flag has no effect on the task behavior, + * but when the task manager has been set to privileged exeuction mode via + * isc_taskmgr_setmode(), only tasks with the flag set will be executed, + * and all other tasks will wait until they're done. Once all privileged + * tasks have finished executing, the task manager will automatically + * return to normal execution mode and nonprivileged task can resume. + * + * Requires: + *\li 'task' is a valid task. + */ + +isc_boolean_t +isc_task_privilege(isc_task_t *task); +/*%< + * Returns the current value of the task's privilege flag. + * + * Requires: + *\li 'task' is a valid task. + */ + /***** ***** Task Manager. *****/ @@ -666,6 +703,31 @@ isc_taskmgr_create(isc_mem_t *mctx, unsigned int workers, */ void +isc_taskmgr_setmode(isc_taskmgr_t *manager, isc_taskmgrmode_t mode); + +isc_taskmgrmode_t +isc_taskmgr_mode(isc_taskmgr_t *manager); +/*%< + * Set/get the current operating mode of the task manager. Valid modes are: + * + *\li isc_taskmgrmode_normal + *\li isc_taskmgrmode_privileged + * + * In privileged execution mode, only tasks that have had the "privilege" + * flag set via isc_task_setprivilege() can be executed. When all such + * tasks are complete, the manager automatically returns to normal mode + * and proceeds with running non-privileged ready tasks. This means it is + * necessary to have at least one privileged task waiting on the ready + * queue *before* setting the manager into privileged execution mode, + * which in turn means the task which calls this function should be in + * task-exclusive mode when it does so. + * + * Requires: + * + *\li 'manager' is a valid task manager. + */ + +void isc_taskmgr_destroy(isc_taskmgr_t **managerp); /*%< * Destroy '*managerp'. diff --git a/lib/isc/include/isc/taskpool.h b/lib/isc/include/isc/taskpool.h index 64c739a..46f395e 100644 --- a/lib/isc/include/isc/taskpool.h +++ b/lib/isc/include/isc/taskpool.h @@ -139,6 +139,19 @@ isc_taskpool_destroy(isc_taskpool_t **poolp); * \li '*poolp' is a valid task pool. */ +void +isc_taskpool_setprivilege(isc_taskpool_t *pool, isc_boolean_t priv); +/*%< + * Set the privilege flag on all tasks in 'pool' to 'priv'. If 'priv' is + * true, then when the task manager is set into privileged mode, only + * tasks wihin this pool will be able to execute. (Note: It is important + * to turn the pool tasks' privilege back off before the last task finishes + * executing.) + * + * Requires: + * \li 'pool' is a valid task pool. + */ + ISC_LANG_ENDDECLS #endif /* ISC_TASKPOOL_H */ diff --git a/lib/isc/log.c b/lib/isc/log.c index f1c925c..024d97c 100644 --- a/lib/isc/log.c +++ b/lib/isc/log.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2007, 2009, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007, 2009, 2011-2013 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -275,7 +275,8 @@ isc_log_create(isc_mem_t *mctx, isc_log_t **lctxp, isc_logconfig_t **lcfgp) { lctx = isc_mem_get(mctx, sizeof(*lctx)); if (lctx != NULL) { - lctx->mctx = mctx; + lctx->mctx = NULL; + isc_mem_attach(mctx, &lctx->mctx); lctx->categories = NULL; lctx->category_count = 0; lctx->modules = NULL; @@ -286,7 +287,7 @@ isc_log_create(isc_mem_t *mctx, isc_log_t **lctxp, isc_logconfig_t **lcfgp) { result = isc_mutex_init(&lctx->lock); if (result != ISC_R_SUCCESS) { - isc_mem_put(mctx, lctx, sizeof(*lctx)); + isc_mem_putanddetach(&mctx, lctx, sizeof(*lctx)); return (result); } @@ -493,7 +494,7 @@ isc_log_destroy(isc_log_t **lctxp) { lctx->mctx = NULL; lctx->magic = 0; - isc_mem_put(mctx, lctx, sizeof(*lctx)); + isc_mem_putanddetach(&mctx, lctx, sizeof(*lctx)); *lctxp = NULL; } diff --git a/lib/isc/pool.c b/lib/isc/pool.c new file mode 100644 index 0000000..509abcb --- /dev/null +++ b/lib/isc/pool.c @@ -0,0 +1,177 @@ +/* + * Copyright (C) 2013 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +/* $Id$ */ + +/*! \file */ + +#include <config.h> + +#include <string.h> + +#include <isc/mem.h> +#include <isc/random.h> +#include <isc/pool.h> +#include <isc/util.h> + +/*** + *** Types. + ***/ + +struct isc_pool { + isc_mem_t * mctx; + unsigned int count; + isc_pooldeallocator_t free; + isc_poolinitializer_t init; + void * initarg; + void ** pool; +}; + +/*** + *** Functions. + ***/ + +static isc_result_t +alloc_pool(isc_mem_t *mctx, unsigned int count, isc_pool_t **poolp) { + isc_pool_t *pool; + + pool = isc_mem_get(mctx, sizeof(*pool)); + if (pool == NULL) + return (ISC_R_NOMEMORY); + pool->count = count; + pool->free = NULL; + pool->init = NULL; + pool->initarg = NULL; + pool->mctx = NULL; + isc_mem_attach(mctx, &pool->mctx); + pool->pool = isc_mem_get(mctx, count * sizeof(void *)); + if (pool->pool == NULL) { + isc_mem_put(mctx, pool, sizeof(*pool)); + return (ISC_R_NOMEMORY); + } + memset(pool->pool, 0, count * sizeof(void *)); + + *poolp = pool; + return (ISC_R_SUCCESS); +} + +isc_result_t +isc_pool_create(isc_mem_t *mctx, unsigned int count, + isc_pooldeallocator_t free, + isc_poolinitializer_t init, void *initarg, + isc_pool_t **poolp) +{ + isc_pool_t *pool = NULL; + isc_result_t result; + unsigned int i; + + INSIST(count > 0); + + /* Allocate the pool structure */ + result = alloc_pool(mctx, count, &pool); + if (result != ISC_R_SUCCESS) + return (result); + + pool->free = free; + pool->init = init; + pool->initarg = initarg; + + /* Populate the pool */ + for (i = 0; i < count; i++) { + result = init(&pool->pool[i], initarg); + if (result != ISC_R_SUCCESS) { + isc_pool_destroy(&pool); + return (result); + } + } + + *poolp = pool; + return (ISC_R_SUCCESS); +} + +void * +isc_pool_get(isc_pool_t *pool) { + isc_uint32_t i; + isc_random_get(&i); + return (pool->pool[i % pool->count]); +} + +int +isc_pool_count(isc_pool_t *pool) { + REQUIRE(pool != NULL); + return (pool->count); +} + +isc_result_t +isc_pool_expand(isc_pool_t **sourcep, unsigned int count, + isc_pool_t **targetp) +{ + isc_result_t result; + isc_pool_t *pool; + + REQUIRE(sourcep != NULL && *sourcep != NULL); + REQUIRE(targetp != NULL && *targetp == NULL); + + pool = *sourcep; + if (count > pool->count) { + isc_pool_t *newpool = NULL; + unsigned int i; + + /* Allocate a new pool structure */ + result = alloc_pool(pool->mctx, count, &newpool); + if (result != ISC_R_SUCCESS) + return (result); + + newpool->free = pool->free; + newpool->init = pool->init; + newpool->initarg = pool->initarg; + + /* Copy over the objects from the old pool */ + for (i = 0; i < pool->count; i++) { + newpool->pool[i] = pool->pool[i]; + pool->pool[i] = NULL; + } + + /* Populate the new entries */ + for (i = pool->count; i < count; i++) { + result = pool->init(&newpool->pool[i], pool->initarg); + if (result != ISC_R_SUCCESS) { + isc_pool_destroy(&pool); + return (result); + } + } + + isc_pool_destroy(&pool); + pool = newpool; + } + + *sourcep = NULL; + *targetp = pool; + return (ISC_R_SUCCESS); +} + +void +isc_pool_destroy(isc_pool_t **poolp) { + unsigned int i; + isc_pool_t *pool = *poolp; + for (i = 0; i < pool->count; i++) { + if (pool->free != NULL && pool->pool[i] != NULL) + pool->free(&pool->pool[i]); + } + isc_mem_put(pool->mctx, pool->pool, pool->count * sizeof(void *)); + isc_mem_putanddetach(&pool->mctx, pool, sizeof(*pool)); + *poolp = NULL; +} diff --git a/lib/isc/radix.c b/lib/isc/radix.c index ac211ef..3508878 100644 --- a/lib/isc/radix.c +++ b/lib/isc/radix.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2007-2009, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2007-2009, 2011-2013 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -34,7 +34,7 @@ _new_prefix(isc_mem_t *mctx, isc_prefix_t **target, int family, void *dest, int bitlen); static void -_deref_prefix(isc_mem_t *mctx, isc_prefix_t *prefix); +_deref_prefix(isc_prefix_t *prefix); static isc_result_t _ref_prefix(isc_mem_t *mctx, isc_prefix_t **target, isc_prefix_t *prefix); @@ -70,6 +70,8 @@ _new_prefix(isc_mem_t *mctx, isc_prefix_t **target, int family, void *dest, } prefix->family = family; + prefix->mctx = NULL; + isc_mem_attach(mctx, &prefix->mctx); isc_refcount_init(&prefix->refcount, 1); @@ -78,7 +80,7 @@ _new_prefix(isc_mem_t *mctx, isc_prefix_t **target, int family, void *dest, } static void -_deref_prefix(isc_mem_t *mctx, isc_prefix_t *prefix) { +_deref_prefix(isc_prefix_t *prefix) { int refs; if (prefix == NULL) @@ -88,7 +90,8 @@ _deref_prefix(isc_mem_t *mctx, isc_prefix_t *prefix) { if (refs <= 0) { isc_refcount_destroy(&prefix->refcount); - isc_mem_put(mctx, prefix, sizeof(isc_prefix_t)); + isc_mem_putanddetach(&prefix->mctx, prefix, + sizeof(isc_prefix_t)); } } @@ -109,7 +112,7 @@ _ref_prefix(isc_mem_t *mctx, isc_prefix_t **target, isc_prefix_t *prefix) { isc_result_t ret; ret = _new_prefix(mctx, target, prefix->family, &prefix->add, prefix->bitlen); - return ret; + return (ret); } isc_refcount_increment(&prefix->refcount, NULL); @@ -146,7 +149,8 @@ isc_radix_create(isc_mem_t *mctx, isc_radix_tree_t **target, int maxbits) { if (radix == NULL) return (ISC_R_NOMEMORY); - radix->mctx = mctx; + radix->mctx = NULL; + isc_mem_attach(mctx, &radix->mctx); radix->maxbits = maxbits; radix->head = NULL; radix->num_active_node = 0; @@ -168,7 +172,6 @@ _clear_radix(isc_radix_tree_t *radix, isc_radix_destroyfunc_t func) { REQUIRE(radix != NULL); if (radix->head != NULL) { - isc_radix_node_t *Xstack[RADIX_MAXBITS+1]; isc_radix_node_t **Xsp = Xstack; isc_radix_node_t *Xrn = radix->head; @@ -178,7 +181,7 @@ _clear_radix(isc_radix_tree_t *radix, isc_radix_destroyfunc_t func) { isc_radix_node_t *r = Xrn->r; if (Xrn->prefix != NULL) { - _deref_prefix(radix->mctx, Xrn->prefix); + _deref_prefix(Xrn->prefix); if (func != NULL && (Xrn->data[0] != NULL || Xrn->data[1] != NULL)) func(Xrn->data); @@ -209,11 +212,10 @@ _clear_radix(isc_radix_tree_t *radix, isc_radix_destroyfunc_t func) { void -isc_radix_destroy(isc_radix_tree_t *radix, isc_radix_destroyfunc_t func) -{ +isc_radix_destroy(isc_radix_tree_t *radix, isc_radix_destroyfunc_t func) { REQUIRE(radix != NULL); _clear_radix(radix, func); - isc_mem_put(radix->mctx, radix, sizeof(*radix)); + isc_mem_putanddetach(&radix->mctx, radix, sizeof(*radix)); } @@ -221,8 +223,7 @@ isc_radix_destroy(isc_radix_tree_t *radix, isc_radix_destroyfunc_t func) * func will be called as func(node->prefix, node->data) */ void -isc_radix_process(isc_radix_tree_t *radix, isc_radix_processfunc_t func) -{ +isc_radix_process(isc_radix_tree_t *radix, isc_radix_processfunc_t func) { isc_radix_node_t *node; REQUIRE(func != NULL); @@ -461,8 +462,8 @@ isc_radix_insert(isc_radix_tree_t *radix, isc_radix_node_t **target, *target = node; return (ISC_R_SUCCESS); } else { - result = - _ref_prefix(radix->mctx, &node->prefix, prefix); + result = _ref_prefix(radix->mctx, + &node->prefix, prefix); if (result != ISC_R_SUCCESS) return (result); } @@ -623,7 +624,7 @@ isc_radix_remove(isc_radix_tree_t *radix, isc_radix_node_t *node) { * make sure there is a prefix associated with it! */ if (node->prefix != NULL) - _deref_prefix(radix->mctx, node->prefix); + _deref_prefix(node->prefix); node->prefix = NULL; node->data[0] = node->data[1] = NULL; @@ -632,7 +633,7 @@ isc_radix_remove(isc_radix_tree_t *radix, isc_radix_node_t *node) { if (node->r == NULL && node->l == NULL) { parent = node->parent; - _deref_prefix(radix->mctx, node->prefix); + _deref_prefix(node->prefix); isc_mem_put(radix->mctx, node, sizeof(*node)); radix->num_active_node--; @@ -680,7 +681,7 @@ isc_radix_remove(isc_radix_tree_t *radix, isc_radix_node_t *node) { parent = node->parent; child->parent = parent; - _deref_prefix(radix->mctx, node->prefix); + _deref_prefix(node->prefix); isc_mem_put(radix->mctx, node, sizeof(*node)); radix->num_active_node--; diff --git a/lib/isc/socket_api.c b/lib/isc/socket_api.c index e97a931..1fba3e0 100644 --- a/lib/isc/socket_api.c +++ b/lib/isc/socket_api.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2009, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2009, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -141,6 +141,18 @@ isc_socket_sendto(isc_socket_t *sock, isc_region_t *region, isc_task_t *task, } isc_result_t +isc_socket_sendto2(isc_socket_t *sock, isc_region_t *region, + isc_task_t *task, isc_sockaddr_t *address, + struct in6_pktinfo *pktinfo, isc_socketevent_t *event, + unsigned int flags) +{ + REQUIRE(ISCAPI_SOCKET_VALID(sock)); + + return (sock->methods->sendto2(sock, region, task, address, + pktinfo, event, flags)); +} + +isc_result_t isc_socket_connect(isc_socket_t *sock, isc_sockaddr_t *addr, isc_task_t *task, isc_taskaction_t action, const void *arg) { @@ -158,6 +170,17 @@ isc_socket_recv(isc_socket_t *sock, isc_region_t *region, unsigned int minimum, return (sock->methods->recv(sock, region, minimum, task, action, arg)); } +isc_result_t +isc_socket_recv2(isc_socket_t *sock, isc_region_t *region, + unsigned int minimum, isc_task_t *task, + isc_socketevent_t *event, unsigned int flags) +{ + REQUIRE(ISCAPI_SOCKET_VALID(sock)); + + return (sock->methods->recv2(sock, region, minimum, task, + event, flags)); +} + void isc_socket_cancel(isc_socket_t *sock, isc_task_t *task, unsigned int how) { REQUIRE(ISCAPI_SOCKET_VALID(sock)); @@ -214,3 +237,18 @@ isc_socket_fdwatchpoke(isc_socket_t *sock, int flags) return(sock->methods->fdwatchpoke(sock, flags)); } + +isc_result_t +isc_socket_dup(isc_socket_t *sock, isc_socket_t **socketp) { + REQUIRE(ISCAPI_SOCKET_VALID(sock)); + REQUIRE(socketp != NULL && *socketp == NULL); + + return(sock->methods->dup(sock, socketp)); +} + +int +isc_socket_getfd(isc_socket_t *sock) { + REQUIRE(ISCAPI_SOCKET_VALID(sock)); + + return(sock->methods->getfd(sock)); +} diff --git a/lib/isc/task.c b/lib/isc/task.c index 94f1c6d..b743271 100644 --- a/lib/isc/task.c +++ b/lib/isc/task.c @@ -64,9 +64,7 @@ #endif /* ISC_PLATFORM_USETHREADS */ #endif /* BIND9 */ -#ifndef USE_WORKER_THREADS #include "task_p.h" -#endif /* USE_WORKER_THREADS */ #ifdef ISC_TASK_TRACE #define XTRACE(m) fprintf(stderr, "task %p thread %lu: %s\n", \ @@ -120,9 +118,11 @@ struct isc__task { /* Locked by task manager lock. */ LINK(isc__task_t) link; LINK(isc__task_t) ready_link; + LINK(isc__task_t) ready_priority_link; }; #define TASK_F_SHUTTINGDOWN 0x01 +#define TASK_F_PRIVILEGED 0x02 #define TASK_SHUTTINGDOWN(t) (((t)->flags & TASK_F_SHUTTINGDOWN) \ != 0) @@ -145,11 +145,15 @@ struct isc__taskmgr { unsigned int default_quantum; LIST(isc__task_t) tasks; isc__tasklist_t ready_tasks; + isc__tasklist_t ready_priority_tasks; + isc_taskmgrmode_t mode; #ifdef ISC_PLATFORM_USETHREADS isc_condition_t work_available; isc_condition_t exclusive_granted; + isc_condition_t paused; #endif /* ISC_PLATFORM_USETHREADS */ unsigned int tasks_running; + isc_boolean_t pause_requested; isc_boolean_t exclusive_requested; isc_boolean_t exiting; isc__task_t *excl; @@ -230,6 +234,23 @@ ISC_TASKFUNC_SCOPE isc_result_t isc__task_beginexclusive(isc_task_t *task); ISC_TASKFUNC_SCOPE void isc__task_endexclusive(isc_task_t *task0); +ISC_TASKFUNC_SCOPE void +isc__task_setprivilege(isc_task_t *task0, isc_boolean_t priv); +ISC_TASKFUNC_SCOPE isc_boolean_t +isc__task_privilege(isc_task_t *task0); +ISC_TASKFUNC_SCOPE void +isc__taskmgr_setmode(isc_taskmgr_t *manager0, isc_taskmgrmode_t mode); +ISC_TASKFUNC_SCOPE isc_taskmgrmode_t +isc__taskmgr_mode(isc_taskmgr_t *manager0); + +static inline isc_boolean_t +empty_readyq(isc__taskmgr_t *manager); + +static inline isc__task_t * +pop_readyq(isc__taskmgr_t *manager); + +static inline void +push_readyq(isc__taskmgr_t *manager, isc__task_t *task); static struct isc__taskmethods { isc_taskmethods_t methods; @@ -254,7 +275,9 @@ static struct isc__taskmethods { isc__task_purge, isc__task_purgerange, isc__task_beginexclusive, - isc__task_endexclusive + isc__task_endexclusive, + isc__task_setprivilege, + isc__task_privilege } #ifndef BIND9 , @@ -266,6 +289,8 @@ static struct isc__taskmethods { static isc_taskmgrmethods_t taskmgrmethods = { isc__taskmgr_destroy, + isc__taskmgr_setmode, + isc__taskmgr_mode, isc__task_create, isc__taskmgr_setexcltask, isc__taskmgr_excltask @@ -340,6 +365,7 @@ isc__task_create(isc_taskmgr_t *manager0, unsigned int quantum, task->tag = NULL; INIT_LINK(task, link); INIT_LINK(task, ready_link); + INIT_LINK(task, ready_priority_link); exiting = ISC_FALSE; LOCK(&manager->lock); @@ -407,6 +433,7 @@ task_shutdown(isc__task_t *task) { } INSIST(task->state == task_state_ready || task->state == task_state_running); + /* * Note that we post shutdown events LIFO. */ @@ -422,9 +449,17 @@ task_shutdown(isc__task_t *task) { return (was_idle); } +/* + * Moves a task onto the appropriate run queue. + * + * Caller must NOT hold manager lock. + */ static inline void task_ready(isc__task_t *task) { isc__taskmgr_t *manager = task->manager; +#ifdef USE_WORKER_THREADS + isc_boolean_t has_privilege = isc__task_privilege((isc_task_t *) task); +#endif /* USE_WORKER_THREADS */ REQUIRE(VALID_MANAGER(manager)); REQUIRE(task->state == task_state_ready); @@ -432,12 +467,11 @@ task_ready(isc__task_t *task) { XTRACE("task_ready"); LOCK(&manager->lock); - - ENQUEUE(manager->ready_tasks, task, ready_link); + push_readyq(manager, task); #ifdef USE_WORKER_THREADS - SIGNAL(&manager->work_available); + if (manager->mode == isc_taskmgrmode_normal || has_privilege) + SIGNAL(&manager->work_available); #endif /* USE_WORKER_THREADS */ - UNLOCK(&manager->lock); } @@ -875,21 +909,81 @@ isc__task_getcurrenttime(isc_task_t *task0, isc_stdtime_t *t) { REQUIRE(t != NULL); LOCK(&task->lock); - *t = task->now; - UNLOCK(&task->lock); } /*** *** Task Manager. ***/ + +/* + * Return ISC_TRUE if the current ready list for the manager, which is + * either ready_tasks or the ready_priority_tasks, depending on whether + * the manager is currently in normal or privileged execution mode. + * + * Caller must hold the task manager lock. + */ +static inline isc_boolean_t +empty_readyq(isc__taskmgr_t *manager) { + isc__tasklist_t queue; + + if (manager->mode == isc_taskmgrmode_normal) + queue = manager->ready_tasks; + else + queue = manager->ready_priority_tasks; + + return (ISC_TF(EMPTY(queue))); +} + +/* + * Dequeue and return a pointer to the first task on the current ready + * list for the manager. + * If the task is privileged, dequeue it from the other ready list + * as well. + * + * Caller must hold the task manager lock. + */ +static inline isc__task_t * +pop_readyq(isc__taskmgr_t *manager) { + isc__task_t *task; + + if (manager->mode == isc_taskmgrmode_normal) + task = HEAD(manager->ready_tasks); + else + task = HEAD(manager->ready_priority_tasks); + + if (task != NULL) { + DEQUEUE(manager->ready_tasks, task, ready_link); + if (ISC_LINK_LINKED(task, ready_priority_link)) + DEQUEUE(manager->ready_priority_tasks, task, + ready_priority_link); + } + + return (task); +} + +/* + * Push 'task' onto the ready_tasks queue. If 'task' has the privilege + * flag set, then also push it onto the ready_priority_tasks queue. + * + * Caller must hold the task manager lock. + */ +static inline void +push_readyq(isc__taskmgr_t *manager, isc__task_t *task) { + ENQUEUE(manager->ready_tasks, task, ready_link); + if ((task->flags & TASK_F_PRIVILEGED) != 0) + ENQUEUE(manager->ready_priority_tasks, task, + ready_priority_link); +} + static void dispatch(isc__taskmgr_t *manager) { isc__task_t *task; #ifndef USE_WORKER_THREADS unsigned int total_dispatch_count = 0; - isc__tasklist_t ready_tasks; + isc__tasklist_t new_ready_tasks; + isc__tasklist_t new_priority_tasks; #endif /* USE_WORKER_THREADS */ REQUIRE(VALID_MANAGER(manager)); @@ -945,9 +1039,11 @@ dispatch(isc__taskmgr_t *manager) { */ #ifndef USE_WORKER_THREADS - ISC_LIST_INIT(ready_tasks); + ISC_LIST_INIT(new_ready_tasks); + ISC_LIST_INIT(new_priority_tasks); #endif LOCK(&manager->lock); + while (!FINISHED(manager)) { #ifdef USE_WORKER_THREADS /* @@ -956,10 +1052,12 @@ dispatch(isc__taskmgr_t *manager) { * the task while only holding the manager lock, and then * change the task to running state while only holding the * task lock. + * + * If a pause has been requested, don't do any work + * until it's been released. */ - while ((EMPTY(manager->ready_tasks) || - manager->exclusive_requested) && - !FINISHED(manager)) + while ((empty_readyq(manager) || manager->pause_requested || + manager->exclusive_requested) && !FINISHED(manager)) { XTHREADTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL, @@ -971,13 +1069,13 @@ dispatch(isc__taskmgr_t *manager) { } #else /* USE_WORKER_THREADS */ if (total_dispatch_count >= DEFAULT_TASKMGR_QUANTUM || - EMPTY(manager->ready_tasks)) + empty_readyq(manager)) break; #endif /* USE_WORKER_THREADS */ XTHREADTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_TASK, ISC_MSG_WORKING, "working")); - task = HEAD(manager->ready_tasks); + task = pop_readyq(manager); if (task != NULL) { unsigned int dispatch_count = 0; isc_boolean_t done = ISC_FALSE; @@ -992,7 +1090,6 @@ dispatch(isc__taskmgr_t *manager) { * have a task to do. We must reacquire the manager * lock before exiting the 'if (task != NULL)' block. */ - DEQUEUE(manager->ready_tasks, task, ready_link); manager->tasks_running++; UNLOCK(&manager->lock); @@ -1113,6 +1210,9 @@ dispatch(isc__taskmgr_t *manager) { if (manager->exclusive_requested && manager->tasks_running == 1) { SIGNAL(&manager->exclusive_granted); + } else if (manager->pause_requested && + manager->tasks_running == 0) { + SIGNAL(&manager->paused); } #endif /* USE_WORKER_THREADS */ if (requeue) { @@ -1136,17 +1236,39 @@ dispatch(isc__taskmgr_t *manager) { * might even hurt rather than help. */ #ifdef USE_WORKER_THREADS - ENQUEUE(manager->ready_tasks, task, - ready_link); + push_readyq(manager, task); #else - ENQUEUE(ready_tasks, task, ready_link); + ENQUEUE(new_ready_tasks, task, ready_link); + if ((task->flags & TASK_F_PRIVILEGED) != 0) + ENQUEUE(new_priority_tasks, task, + ready_priority_link); #endif } } + +#ifdef USE_WORKER_THREADS + /* + * If we are in privileged execution mode and there are no + * tasks remaining on the current ready queue, then + * we're stuck. Automatically drop privileges at that + * point and continue with the regular ready queue. + */ + if (manager->tasks_running == 0 && empty_readyq(manager)) { + manager->mode = isc_taskmgrmode_normal; + if (!empty_readyq(manager)) + BROADCAST(&manager->work_available); + } +#endif } + #ifndef USE_WORKER_THREADS - ISC_LIST_APPENDLIST(manager->ready_tasks, ready_tasks, ready_link); + ISC_LIST_APPENDLIST(manager->ready_tasks, new_ready_tasks, ready_link); + ISC_LIST_APPENDLIST(manager->ready_priority_tasks, new_priority_tasks, + ready_priority_link); + if (empty_readyq(manager)) + manager->mode = isc_taskmgrmode_normal; #endif + UNLOCK(&manager->lock); } @@ -1181,6 +1303,7 @@ manager_free(isc__taskmgr_t *manager) { #ifdef USE_WORKER_THREADS (void)isc_condition_destroy(&manager->exclusive_granted); (void)isc_condition_destroy(&manager->work_available); + (void)isc_condition_destroy(&manager->paused); isc_mem_free(manager->mctx, manager->threads); #endif /* USE_WORKER_THREADS */ DESTROYLOCK(&manager->lock); @@ -1231,6 +1354,7 @@ isc__taskmgr_create(isc_mem_t *mctx, unsigned int workers, manager->common.methods = &taskmgrmethods; manager->common.impmagic = TASK_MANAGER_MAGIC; manager->common.magic = ISCAPI_TASKMGR_MAGIC; + manager->mode = isc_taskmgrmode_normal; manager->mctx = NULL; result = isc_mutex_init(&manager->lock); if (result != ISC_R_SUCCESS) @@ -1260,14 +1384,24 @@ isc__taskmgr_create(isc_mem_t *mctx, unsigned int workers, result = ISC_R_UNEXPECTED; goto cleanup_workavailable; } + if (isc_condition_init(&manager->paused) != ISC_R_SUCCESS) { + UNEXPECTED_ERROR(__FILE__, __LINE__, + "isc_condition_init() %s", + isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL, + ISC_MSG_FAILED, "failed")); + result = ISC_R_UNEXPECTED; + goto cleanup_exclusivegranted; + } #endif /* USE_WORKER_THREADS */ if (default_quantum == 0) default_quantum = DEFAULT_DEFAULT_QUANTUM; manager->default_quantum = default_quantum; INIT_LIST(manager->tasks); INIT_LIST(manager->ready_tasks); + INIT_LIST(manager->ready_priority_tasks); manager->tasks_running = 0; manager->exclusive_requested = ISC_FALSE; + manager->pause_requested = ISC_FALSE; manager->exiting = ISC_FALSE; manager->excl = NULL; @@ -1304,6 +1438,8 @@ isc__taskmgr_create(isc_mem_t *mctx, unsigned int workers, return (ISC_R_SUCCESS); #ifdef USE_WORKER_THREADS + cleanup_exclusivegranted: + (void)isc_condition_destroy(&manager->exclusive_granted); cleanup_workavailable: (void)isc_condition_destroy(&manager->work_available); cleanup_threads: @@ -1375,6 +1511,11 @@ isc__taskmgr_destroy(isc_taskmgr_t **managerp) { manager->exiting = ISC_TRUE; /* + * If privileged mode was on, turn it off. + */ + manager->mode = isc_taskmgrmode_normal; + + /* * Post shutdown event(s) to every task (if they haven't already been * posted). */ @@ -1383,7 +1524,7 @@ isc__taskmgr_destroy(isc_taskmgr_t **managerp) { task = NEXT(task, link)) { LOCK(&task->lock); if (task_shutdown(task)) - ENQUEUE(manager->ready_tasks, task, ready_link); + push_readyq(manager, task); UNLOCK(&task->lock); } #ifdef USE_WORKER_THREADS @@ -1422,10 +1563,30 @@ isc__taskmgr_destroy(isc_taskmgr_t **managerp) { *managerp = NULL; } +ISC_TASKFUNC_SCOPE void +isc__taskmgr_setmode(isc_taskmgr_t *manager0, isc_taskmgrmode_t mode) { + isc__taskmgr_t *manager = (isc__taskmgr_t *)manager0; + + LOCK(&manager->lock); + manager->mode = mode; + UNLOCK(&manager->lock); +} + +ISC_TASKFUNC_SCOPE isc_taskmgrmode_t +isc__taskmgr_mode(isc_taskmgr_t *manager0) { + isc__taskmgr_t *manager = (isc__taskmgr_t *)manager0; + isc_taskmgrmode_t mode; + LOCK(&manager->lock); + mode = manager->mode; + UNLOCK(&manager->lock); + return (mode); +} + #ifndef USE_WORKER_THREADS isc_boolean_t isc__taskmgr_ready(isc_taskmgr_t *manager0) { isc__taskmgr_t *manager = (isc__taskmgr_t *)manager0; + isc_boolean_t is_ready; #ifdef USE_SHARED_MANAGER if (manager == NULL) @@ -1433,7 +1594,12 @@ isc__taskmgr_ready(isc_taskmgr_t *manager0) { #endif if (manager == NULL) return (ISC_FALSE); - return (ISC_TF(!ISC_LIST_EMPTY(manager->ready_tasks))); + + LOCK(&manager->lock); + is_ready = !empty_readyq(manager); + UNLOCK(&manager->lock); + + return (is_ready); } isc_result_t @@ -1452,6 +1618,29 @@ isc__taskmgr_dispatch(isc_taskmgr_t *manager0) { return (ISC_R_SUCCESS); } +#else +ISC_TASKFUNC_SCOPE void +isc__taskmgr_pause(isc_taskmgr_t *manager0) { + isc__taskmgr_t *manager = (isc__taskmgr_t *)manager0; + LOCK(&manager->lock); + while (manager->tasks_running > 0) { + WAIT(&manager->paused, &manager->lock); + } + manager->pause_requested = ISC_TRUE; + UNLOCK(&manager->lock); +} + +ISC_TASKFUNC_SCOPE void +isc__taskmgr_resume(isc_taskmgr_t *manager0) { + isc__taskmgr_t *manager = (isc__taskmgr_t *)manager0; + + LOCK(&manager->lock); + if (manager->pause_requested) { + manager->pause_requested = ISC_FALSE; + BROADCAST(&manager->work_available); + } + UNLOCK(&manager->lock); +} #endif /* USE_WORKER_THREADS */ ISC_TASKFUNC_SCOPE void @@ -1522,6 +1711,44 @@ isc__task_endexclusive(isc_task_t *task0) { #endif } +ISC_TASKFUNC_SCOPE void +isc__task_setprivilege(isc_task_t *task0, isc_boolean_t priv) { + isc__task_t *task = (isc__task_t *)task0; + isc__taskmgr_t *manager = task->manager; + isc_boolean_t oldpriv; + + LOCK(&task->lock); + oldpriv = ISC_TF((task->flags & TASK_F_PRIVILEGED) != 0); + if (priv) + task->flags |= TASK_F_PRIVILEGED; + else + task->flags &= ~TASK_F_PRIVILEGED; + UNLOCK(&task->lock); + + if (priv == oldpriv) + return; + + LOCK(&manager->lock); + if (priv && ISC_LINK_LINKED(task, ready_link)) + ENQUEUE(manager->ready_priority_tasks, task, + ready_priority_link); + else if (!priv && ISC_LINK_LINKED(task, ready_priority_link)) + DEQUEUE(manager->ready_priority_tasks, task, + ready_priority_link); + UNLOCK(&manager->lock); +} + +ISC_TASKFUNC_SCOPE isc_boolean_t +isc__task_privilege(isc_task_t *task0) { + isc__task_t *task = (isc__task_t *)task0; + isc_boolean_t priv; + + LOCK(&task->lock); + priv = ISC_TF((task->flags & TASK_F_PRIVILEGED) != 0); + UNLOCK(&task->lock); + return (priv); +} + #ifdef USE_SOCKETIMPREGISTER isc_result_t isc__task_register() { diff --git a/lib/isc/task_api.c b/lib/isc/task_api.c index 06a8d24..f49ab32 100644 --- a/lib/isc/task_api.c +++ b/lib/isc/task_api.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2009, 2010, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2009-2012 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -99,6 +99,20 @@ isc_taskmgr_destroy(isc_taskmgr_t **managerp) { ENSURE(*managerp == NULL); } +void +isc_taskmgr_setmode(isc_taskmgr_t *manager, isc_taskmgrmode_t mode) { + REQUIRE(ISCAPI_TASKMGR_VALID(manager)); + + manager->methods->setmode(manager, mode); +} + +isc_taskmgrmode_t +isc_taskmgr_mode(isc_taskmgr_t *manager) { + REQUIRE(ISCAPI_TASKMGR_VALID(manager)); + + return (manager->methods->mode(manager)); +} + isc_result_t isc_task_create(isc_taskmgr_t *manager, unsigned int quantum, isc_task_t **taskp) @@ -212,6 +226,20 @@ isc_task_endexclusive(isc_task_t *task) { task->methods->endexclusive(task); } +void +isc_task_setprivilege(isc_task_t *task, isc_boolean_t priv) { + REQUIRE(ISCAPI_TASK_VALID(task)); + + task->methods->setprivilege(task, priv); +} + +isc_boolean_t +isc_task_privilege(isc_task_t *task) { + REQUIRE(ISCAPI_TASK_VALID(task)); + + return (task->methods->privilege(task)); +} + /*% * This is necessary for libisc's internal timer implementation. Other diff --git a/lib/isc/task_p.h b/lib/isc/task_p.h index 85deeae..8c1e4c5 100644 --- a/lib/isc/task_p.h +++ b/lib/isc/task_p.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007, 2009, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2009, 2011, 2012 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -22,10 +22,18 @@ /*! \file */ +#if defined(BIND9) && defined(ISC_PLATFORM_USETHREADS) +void +isc__taskmgr_pause(isc_taskmgr_t *taskmgr); + +void +isc__taskmgr_resume(isc_taskmgr_t *taskmgr); +#else isc_boolean_t isc__taskmgr_ready(isc_taskmgr_t *taskmgr); isc_result_t isc__taskmgr_dispatch(isc_taskmgr_t *taskmgr); +#endif /* !BIND9 || !ISC_PLATFORM_USETHREADS */ #endif /* ISC_TASK_P_H */ diff --git a/lib/isc/taskpool.c b/lib/isc/taskpool.c index 7324cfa..a5ce0e8 100644 --- a/lib/isc/taskpool.c +++ b/lib/isc/taskpool.c @@ -165,9 +165,8 @@ isc_taskpool_destroy(isc_taskpool_t **poolp) { unsigned int i; isc_taskpool_t *pool = *poolp; for (i = 0; i < pool->ntasks; i++) { - if (pool->tasks[i] != NULL) { + if (pool->tasks[i] != NULL) isc_task_detach(&pool->tasks[i]); - } } isc_mem_put(pool->mctx, pool->tasks, pool->ntasks * sizeof(isc_task_t *)); @@ -175,4 +174,14 @@ isc_taskpool_destroy(isc_taskpool_t **poolp) { *poolp = NULL; } +void +isc_taskpool_setprivilege(isc_taskpool_t *pool, isc_boolean_t priv) { + unsigned int i; + + REQUIRE(pool != NULL); + for (i = 0; i < pool->ntasks; i++) { + if (pool->tasks[i] != NULL) + isc_task_setprivilege(pool->tasks[i], priv); + } +} diff --git a/lib/isc/unix/socket.c b/lib/isc/unix/socket.c index d007598..7bd12aa 100644 --- a/lib/isc/unix/socket.c +++ b/lib/isc/unix/socket.c @@ -334,7 +334,8 @@ struct isc__socket { listener : 1, /* listener socket */ connected : 1, connecting : 1, /* connect pending */ - bound : 1; /* bound to local addr */ + bound : 1, /* bound to local addr */ + dupped : 1; #ifdef ISC_NET_RECVOVERFLOW unsigned char overflow; /* used for MSG_TRUNC fake */ @@ -428,6 +429,10 @@ static isc__socketmgr_t *socketmgr = NULL; # define MAXSCATTERGATHER_RECV (ISC_SOCKET_MAXSCATTERGATHER) #endif +static isc_result_t socket_create(isc_socketmgr_t *manager0, int pf, + isc_sockettype_t type, + isc_socket_t **socketp, + isc_socket_t *dup_socket); static void send_recvdone_event(isc__socket_t *, isc_socketevent_t **); static void send_senddone_event(isc__socket_t *, isc_socketevent_t **); static void free_socket(isc__socket_t **); @@ -546,6 +551,10 @@ isc__socket_fdwatchcreate(isc_socketmgr_t *manager, int fd, int flags, isc_task_t *task, isc_socket_t **socketp); ISC_SOCKETFUNC_SCOPE isc_result_t isc__socket_fdwatchpoke(isc_socket_t *sock, int flags); +ISC_SOCKETFUNC_SCOPE isc_result_t +isc__socket_dup(isc_socket_t *sock, isc_socket_t **socketp); +ISC_SOCKETFUNC_SCOPE int +isc__socket_getfd(isc_socket_t *sock); static struct { isc_socketmethods_t methods; @@ -563,13 +572,17 @@ static struct { isc__socket_detach, isc__socket_bind, isc__socket_sendto, + isc__socket_sendto2, isc__socket_connect, isc__socket_recv, + isc__socket_recv2, isc__socket_cancel, isc__socket_getsockname, isc__socket_gettype, isc__socket_ipv6only, - isc__socket_fdwatchpoke + isc__socket_fdwatchpoke, + isc__socket_dup, + isc__socket_getfd } #ifndef BIND9 , @@ -2046,6 +2059,7 @@ allocate_socket(isc__socketmgr_t *manager, isc_sockettype_t type, sock->manager = manager; sock->type = type; sock->fd = -1; + sock->dupped = 0; sock->statsindex = NULL; ISC_LINK_INIT(sock, link); @@ -2251,7 +2265,9 @@ use_min_mtu(isc__socket_t *sock) { } static isc_result_t -opensocket(isc__socketmgr_t *manager, isc__socket_t *sock) { +opensocket(isc__socketmgr_t *manager, isc__socket_t *sock, + isc__socket_t *dup_socket) +{ isc_result_t result; char strbuf[ISC_STRERRORSIZE]; const char *err = "socket"; @@ -2265,22 +2281,29 @@ opensocket(isc__socketmgr_t *manager, isc__socket_t *sock) { #endif again: - switch (sock->type) { - case isc_sockettype_udp: - sock->fd = socket(sock->pf, SOCK_DGRAM, IPPROTO_UDP); - break; - case isc_sockettype_tcp: - sock->fd = socket(sock->pf, SOCK_STREAM, IPPROTO_TCP); - break; - case isc_sockettype_unix: - sock->fd = socket(sock->pf, SOCK_STREAM, 0); - break; - case isc_sockettype_fdwatch: - /* - * We should not be called for isc_sockettype_fdwatch sockets. - */ - INSIST(0); - break; + if (dup_socket == NULL) { + switch (sock->type) { + case isc_sockettype_udp: + sock->fd = socket(sock->pf, SOCK_DGRAM, IPPROTO_UDP); + break; + case isc_sockettype_tcp: + sock->fd = socket(sock->pf, SOCK_STREAM, IPPROTO_TCP); + break; + case isc_sockettype_unix: + sock->fd = socket(sock->pf, SOCK_STREAM, 0); + break; + case isc_sockettype_fdwatch: + /* + * We should not be called for isc_sockettype_fdwatch + * sockets. + */ + INSIST(0); + break; + } + } else { + sock->fd = dup(dup_socket->fd); + sock->dupped = 1; + sock->bound = dup_socket->bound; } if (sock->fd == -1 && errno == EINTR && tries++ < 42) goto again; @@ -2357,6 +2380,9 @@ opensocket(isc__socketmgr_t *manager, isc__socket_t *sock) { } } + if (dup_socket != NULL) + goto setup_done; + result = make_nonblock(sock->fd); if (result != ISC_R_SUCCESS) { (void)close(sock->fd); @@ -2521,20 +2547,21 @@ opensocket(isc__socketmgr_t *manager, isc__socket_t *sock) { } #endif /* defined(USE_CMSG) || defined(SO_RCVBUF) */ +setup_done: inc_stats(manager->stats, sock->statsindex[STATID_OPEN]); return (ISC_R_SUCCESS); } -/*% - * Create a new 'type' socket managed by 'manager'. Events - * will be posted to 'task' and when dispatched 'action' will be - * called with 'arg' as the arg value. The new socket is returned - * in 'socketp'. +/* + * Create a 'type' socket or duplicate an existing socket, managed + * by 'manager'. Events will be posted to 'task' and when dispatched + * 'action' will be called with 'arg' as the arg value. The new + * socket is returned in 'socketp'. */ -ISC_SOCKETFUNC_SCOPE isc_result_t -isc__socket_create(isc_socketmgr_t *manager0, int pf, isc_sockettype_t type, - isc_socket_t **socketp) +static isc_result_t +socket_create(isc_socketmgr_t *manager0, int pf, isc_sockettype_t type, + isc_socket_t **socketp, isc_socket_t *dup_socket) { isc__socket_t *sock = NULL; isc__socketmgr_t *manager = (isc__socketmgr_t *)manager0; @@ -2566,7 +2593,8 @@ isc__socket_create(isc_socketmgr_t *manager0, int pf, isc_sockettype_t type, } sock->pf = pf; - result = opensocket(manager, sock); + + result = opensocket(manager, sock, (isc__socket_t *)dup_socket); if (result != ISC_R_SUCCESS) { inc_stats(manager->stats, sock->statsindex[STATID_OPENFAIL]); free_socket(&sock); @@ -2601,11 +2629,40 @@ isc__socket_create(isc_socketmgr_t *manager0, int pf, isc_sockettype_t type, UNLOCK(&manager->lock); socket_log(sock, NULL, CREATION, isc_msgcat, ISC_MSGSET_SOCKET, - ISC_MSG_CREATED, "created"); + ISC_MSG_CREATED, dup_socket != NULL ? "dupped" : "created"); return (ISC_R_SUCCESS); } +/*% + * Create a new 'type' socket managed by 'manager'. Events + * will be posted to 'task' and when dispatched 'action' will be + * called with 'arg' as the arg value. The new socket is returned + * in 'socketp'. + */ +ISC_SOCKETFUNC_SCOPE isc_result_t +isc__socket_create(isc_socketmgr_t *manager0, int pf, isc_sockettype_t type, + isc_socket_t **socketp) +{ + return (socket_create(manager0, pf, type, socketp, NULL)); +} + +/*% + * Duplicate an existing socket. The new socket is returned + * in 'socketp'. + */ +ISC_SOCKETFUNC_SCOPE isc_result_t +isc__socket_dup(isc_socket_t *sock0, isc_socket_t **socketp) { + isc__socket_t *sock = (isc__socket_t *)sock0; + + REQUIRE(VALID_SOCKET(sock)); + REQUIRE(socketp != NULL && *socketp == NULL); + + return (socket_create((isc_socketmgr_t *) sock->manager, + sock->pf, sock->type, socketp, + sock0)); +} + #ifdef BIND9 ISC_SOCKETFUNC_SCOPE isc_result_t isc__socket_open(isc_socket_t *sock0) { @@ -2624,7 +2681,7 @@ isc__socket_open(isc_socket_t *sock0) { */ REQUIRE(sock->fd == -1); - result = opensocket(sock->manager, sock); + result = opensocket(sock->manager, sock, NULL); if (result != ISC_R_SUCCESS) sock->fd = -1; @@ -2804,6 +2861,7 @@ isc__socket_close(isc_socket_t *sock0) { int fd; isc__socketmgr_t *manager; + fflush(stdout); REQUIRE(VALID_SOCKET(sock)); LOCK(&sock->lock); @@ -2824,6 +2882,7 @@ isc__socket_close(isc_socket_t *sock0) { manager = sock->manager; fd = sock->fd; sock->fd = -1; + sock->dupped = 0; memset(sock->name, 0, sizeof(sock->name)); sock->tag = NULL; sock->listener = 0; @@ -4991,11 +5050,13 @@ isc__socket_bind(isc_socket_t *sock0, isc_sockaddr_t *sockaddr, LOCK(&sock->lock); INSIST(!sock->bound); + INSIST(!sock->dupped); if (sock->pf != sockaddr->type.sa.sa_family) { UNLOCK(&sock->lock); return (ISC_R_FAMILYMISMATCH); } + /* * Only set SO_REUSEADDR when we want a specific port. */ @@ -5680,6 +5741,7 @@ isc__socket_ipv6only(isc_socket_t *sock0, isc_boolean_t yes) { #endif REQUIRE(VALID_SOCKET(sock)); + INSIST(!sock->dupped); #ifdef IPV6_V6ONLY if (sock->pf == AF_INET6) { @@ -5846,6 +5908,13 @@ isc__socket_register() { } #endif +ISC_SOCKETFUNC_SCOPE int +isc__socket_getfd(isc_socket_t *socket0) { + isc__socket_t *socket = (isc__socket_t *)socket0; + + return ((short) socket->fd); +} + #if defined(HAVE_LIBXML2) && defined(BIND9) static const char * diff --git a/lib/isccc/api b/lib/isccc/api index 461b9ac..47724c5 100644 --- a/lib/isccc/api +++ b/lib/isccc/api @@ -4,6 +4,6 @@ # 9.8: 80-89, 120-129 # 9.9: 90-109 # 9.9-sub: 130-139 -LIBINTERFACE = 80 +LIBINTERFACE = 90 LIBREVISION = 3 LIBAGE = 0 diff --git a/lib/isccfg/api b/lib/isccfg/api index 39585b0..864bdc9 100644 --- a/lib/isccfg/api +++ b/lib/isccfg/api @@ -4,6 +4,6 @@ # 9.8: 80-89, 120-129 # 9.9: 90-109 # 9.9-sub: 130-139 -LIBINTERFACE = 82 -LIBREVISION = 7 +LIBINTERFACE = 90 +LIBREVISION = 6 LIBAGE = 0 diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c index 287ce14..431af74 100644 --- a/lib/isccfg/namedconf.c +++ b/lib/isccfg/namedconf.c @@ -54,6 +54,9 @@ static isc_result_t parse_enum_or_other(cfg_parser_t *pctx, const cfg_type_t *enumtype, const cfg_type_t *othertype, cfg_obj_t **ret); +static void +doc_enum_or_other(cfg_printer_t *pctx, const cfg_type_t *type); + static isc_result_t parse_keyvalue(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret); @@ -228,9 +231,8 @@ static cfg_type_t cfg_type_namesockaddrkeylist = { }; /*% - * A list of socket addresses with an optional default port, - * as used in the also-notify option. E.g., - * "port 1234 { 10.0.0.1; 1::2 port 69; }" + * A list of socket addresses with an optional default port, as used + * in the lwresd 'listen-on' option. E.g., "{ 10.0.0.1; 1::2 port 69; }" */ static cfg_tuplefielddef_t portiplist_fields[] = { { "port", &cfg_type_optional_port, 0 }, @@ -238,8 +240,8 @@ static cfg_tuplefielddef_t portiplist_fields[] = { { NULL, NULL, 0 } }; static cfg_type_t cfg_type_portiplist = { - "portiplist", cfg_parse_tuple, cfg_print_tuple, cfg_doc_tuple, &cfg_rep_tuple, - portiplist_fields + "portiplist", cfg_parse_tuple, cfg_print_tuple, cfg_doc_tuple, + &cfg_rep_tuple, portiplist_fields }; /*% @@ -554,6 +556,35 @@ static cfg_type_t cfg_type_autodnssec = { &cfg_rep_string, &autodnssec_enums }; +static const char *dnssecupdatemode_enums[] = { "maintain", "no-resign", NULL }; +static cfg_type_t cfg_type_dnssecupdatemode = { + "dnssecupdatemode", cfg_parse_enum, cfg_print_ustring, cfg_doc_enum, + &cfg_rep_string, &dnssecupdatemode_enums +}; + +static const char *updatemethods_enums[] = { "increment", "unixtime", NULL }; +static cfg_type_t cfg_type_updatemethod = { + "updatemethod", cfg_parse_enum, cfg_print_ustring, cfg_doc_enum, + &cfg_rep_string, &updatemethods_enums +}; + +/* + * zone-statistics: full, terse, or none. + * + * for backward compatibility, we also support boolean values. + * yes represents "full", no represents "terse". in the future we + * may change no to mean "none". + */ +static const char *zonestat_enums[] = { "full", "terse", "none", NULL }; +static isc_result_t +parse_zonestat(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) { + return (parse_enum_or_other(pctx, type, &cfg_type_boolean, ret)); +} +static cfg_type_t cfg_type_zonestat = { + "zonestat", parse_zonestat, cfg_print_ustring, doc_enum_or_other, + &cfg_rep_string, zonestat_enums +}; + static cfg_type_t cfg_type_rrsetorder = { "rrsetorder", cfg_parse_bracketed_list, cfg_print_bracketed_list, cfg_doc_bracketed_list, &cfg_rep_list, &cfg_type_rrsetorderingelement @@ -599,7 +630,7 @@ static cfg_type_t cfg_type_forwardtype = { static const char *zonetype_enums[] = { "master", "slave", "stub", "static-stub", "hint", "forward", - "delegation-only", NULL }; + "delegation-only", "redirect", NULL }; static cfg_type_t cfg_type_zonetype = { "zonetype", cfg_parse_enum, cfg_print_ustring, cfg_doc_enum, &cfg_rep_string, &zonetype_enums @@ -912,6 +943,7 @@ options_clauses[] = { { "listen-on-v6", &cfg_type_listenon, CFG_CLAUSEFLAG_MULTI }, { "managed-keys-directory", &cfg_type_qstring, 0 }, { "match-mapped-addresses", &cfg_type_boolean, 0 }, + { "max-rsa-exponent-size", &cfg_type_uint32, 0 }, { "memstatistics-file", &cfg_type_qstring, 0 }, { "memstatistics", &cfg_type_boolean, 0 }, { "multiple-cnames", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE }, @@ -1458,7 +1490,7 @@ zone_clauses[] = { { "allow-transfer", &cfg_type_bracketed_aml, 0 }, { "allow-update", &cfg_type_bracketed_aml, 0 }, { "allow-update-forwarding", &cfg_type_bracketed_aml, 0 }, - { "also-notify", &cfg_type_portiplist, 0 }, + { "also-notify", &cfg_type_namesockaddrkeylist, 0 }, { "alt-transfer-source", &cfg_type_sockaddr4wild, 0 }, { "alt-transfer-source-v6", &cfg_type_sockaddr6wild, 0 }, { "auto-dnssec", &cfg_type_autodnssec, 0 }, @@ -1472,7 +1504,9 @@ zone_clauses[] = { { "check-wildcard", &cfg_type_boolean, 0 }, { "dialup", &cfg_type_dialuptype, 0 }, { "dnssec-dnskey-kskonly", &cfg_type_boolean, 0 }, + { "dnssec-loadkeys-interval", &cfg_type_uint32, 0 }, { "dnssec-secure-to-insecure", &cfg_type_boolean, 0 }, + { "dnssec-update-mode", &cfg_type_dnssecupdatemode, 0 }, { "forward", &cfg_type_forwardtype, 0 }, { "forwarders", &cfg_type_portiplist, 0 }, { "key-directory", &cfg_type_qstring, 0 }, @@ -1495,17 +1529,20 @@ zone_clauses[] = { { "notify-source-v6", &cfg_type_sockaddr6wild, 0 }, { "notify-to-soa", &cfg_type_boolean, 0 }, { "nsec3-test-zone", &cfg_type_boolean, CFG_CLAUSEFLAG_TESTONLY }, + { "serial-update-method", &cfg_type_updatemethod, 0 }, + { "request-ixfr", &cfg_type_boolean, 0 }, { "sig-signing-nodes", &cfg_type_uint32, 0 }, { "sig-signing-signatures", &cfg_type_uint32, 0 }, { "sig-signing-type", &cfg_type_uint32, 0 }, { "sig-validity-interval", &cfg_type_validityinterval, 0 }, + { "inline-signing", &cfg_type_boolean, 0 }, { "transfer-source", &cfg_type_sockaddr4wild, 0 }, { "transfer-source-v6", &cfg_type_sockaddr6wild, 0 }, { "try-tcp-refresh", &cfg_type_boolean, 0 }, { "update-check-ksk", &cfg_type_boolean, 0 }, { "use-alt-transfer-source", &cfg_type_boolean, 0 }, { "zero-no-soa-ttl", &cfg_type_boolean, 0 }, - { "zone-statistics", &cfg_type_boolean, 0 }, + { "zone-statistics", &cfg_type_zonestat, 0 }, { NULL, NULL, 0 } }; diff --git a/lib/lwres/api b/lib/lwres/api index 2a5c388..95bd204 100644 --- a/lib/lwres/api +++ b/lib/lwres/api @@ -4,6 +4,6 @@ # 9.8: 80-89, 120-129 # 9.9: 90-109 # 9.9-sub: 130-139 -LIBINTERFACE = 80 -LIBREVISION = 6 +LIBINTERFACE = 90 +LIBREVISION = 4 LIBAGE = 0 diff --git a/lib/lwres/man/lwres_config.3 b/lib/lwres/man/lwres_config.3 index a0919d9..42f0e69 100644 --- a/lib/lwres/man/lwres_config.3 +++ b/lib/lwres/man/lwres_config.3 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -100,7 +100,7 @@ unless an error occurred when converting the network addresses to a numeric host .PP \fI/etc/resolv.conf\fR .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001 Internet Software Consortium. .br diff --git a/lib/lwres/man/lwres_config.docbook b/lib/lwres/man/lwres_config.docbook index 7147570..5736ef3 100644 --- a/lib/lwres/man/lwres_config.docbook +++ b/lib/lwres/man/lwres_config.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [<!ENTITY mdash "—">]> <!-- - - Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id$ --> +<!-- $Id: lwres_config.docbook,v 1.9 2007/06/18 23:47:51 tbox Exp $ --> <refentry> <refentryinfo> @@ -36,7 +36,6 @@ <year>2004</year> <year>2005</year> <year>2007</year> - <year>2012</year> <holder>Internet Systems Consortium, Inc. ("ISC")</holder> </copyright> <copyright> diff --git a/lib/lwres/man/lwres_config.html b/lib/lwres/man/lwres_config.html index ccc9db1..ed10069 100644 --- a/lib/lwres/man/lwres_config.html +++ b/lib/lwres/man/lwres_config.html @@ -1,5 +1,5 @@ <!-- - - Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -90,7 +90,7 @@ lwres_conf_t * </div> </div> <div class="refsect1" lang="en"> -<a name="id2543445"></a><h2>DESCRIPTION</h2> +<a name="id2543442"></a><h2>DESCRIPTION</h2> <p><code class="function">lwres_conf_init()</code> creates an empty <span class="type">lwres_conf_t</span> @@ -123,7 +123,7 @@ lwres_conf_t * </p> </div> <div class="refsect1" lang="en"> -<a name="id2543512"></a><h2>RETURN VALUES</h2> +<a name="id2543509"></a><h2>RETURN VALUES</h2> <p><code class="function">lwres_conf_parse()</code> returns <span class="errorcode">LWRES_R_SUCCESS</span> if it successfully read and parsed @@ -142,13 +142,13 @@ lwres_conf_t * </p> </div> <div class="refsect1" lang="en"> -<a name="id2543549"></a><h2>SEE ALSO</h2> +<a name="id2543546"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">stdio</span>(3)</span>, <span class="citerefentry"><span class="refentrytitle">resolver</span>(5)</span>. </p> </div> <div class="refsect1" lang="en"> -<a name="id2543575"></a><h2>FILES</h2> +<a name="id2543572"></a><h2>FILES</h2> <p><code class="filename">/etc/resolv.conf</code> </p> </div> diff --git a/lib/lwres/man/lwres_context.3 b/lib/lwres/man/lwres_context.3 index c888c70..5764809 100644 --- a/lib/lwres/man/lwres_context.3 +++ b/lib/lwres/man/lwres_context.3 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001, 2003 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -164,7 +164,7 @@ times out waiting for a response. \fBmalloc\fR(3), \fBfree\fR(3). .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001, 2003 Internet Software Consortium. .br diff --git a/lib/lwres/man/lwres_context.docbook b/lib/lwres/man/lwres_context.docbook index d5092ac..ad0392e 100644 --- a/lib/lwres/man/lwres_context.docbook +++ b/lib/lwres/man/lwres_context.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [<!ENTITY mdash "—">]> <!-- - - Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001, 2003 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id$ --> +<!-- $Id: lwres_context.docbook,v 1.11 2007/06/18 23:47:51 tbox Exp $ --> <refentry> <refentryinfo> @@ -36,7 +36,6 @@ <year>2004</year> <year>2005</year> <year>2007</year> - <year>2012</year> <holder>Internet Systems Consortium, Inc. ("ISC")</holder> </copyright> <copyright> diff --git a/lib/lwres/man/lwres_context.html b/lib/lwres/man/lwres_context.html index 70efa24..e13539d 100644 --- a/lib/lwres/man/lwres_context.html +++ b/lib/lwres/man/lwres_context.html @@ -1,5 +1,5 @@ <!-- - - Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001, 2003 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -172,7 +172,7 @@ void * </div> </div> <div class="refsect1" lang="en"> -<a name="id2543536"></a><h2>DESCRIPTION</h2> +<a name="id2543532"></a><h2>DESCRIPTION</h2> <p><code class="function">lwres_context_create()</code> creates a <span class="type">lwres_context_t</span> structure for use in lightweight resolver operations. It holds a socket and other @@ -258,7 +258,7 @@ void * </p> </div> <div class="refsect1" lang="en"> -<a name="id2543723"></a><h2>RETURN VALUES</h2> +<a name="id2543720"></a><h2>RETURN VALUES</h2> <p><code class="function">lwres_context_create()</code> returns <span class="errorcode">LWRES_R_NOMEMORY</span> if memory for the <span class="type">struct lwres_context</span> could not be allocated, @@ -283,7 +283,7 @@ void * </p> </div> <div class="refsect1" lang="en"> -<a name="id2543773"></a><h2>SEE ALSO</h2> +<a name="id2543770"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">lwres_conf_init</span>(3)</span>, <span class="citerefentry"><span class="refentrytitle">malloc</span>(3)</span>, diff --git a/lib/lwres/man/lwres_gabn.3 b/lib/lwres/man/lwres_gabn.3 index 0cb5ac5..ea74690 100644 --- a/lib/lwres/man/lwres_gabn.3 +++ b/lib/lwres/man/lwres_gabn.3 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -189,7 +189,7 @@ indicate that the packet is not a response to an earlier query. .PP \fBlwres_packet\fR(3) .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001 Internet Software Consortium. .br diff --git a/lib/lwres/man/lwres_gabn.docbook b/lib/lwres/man/lwres_gabn.docbook index 6063c15..d0b5c19 100644 --- a/lib/lwres/man/lwres_gabn.docbook +++ b/lib/lwres/man/lwres_gabn.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [<!ENTITY mdash "—">]> <!-- - - Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id$ --> +<!-- $Id: lwres_gabn.docbook,v 1.10 2007/06/18 23:47:51 tbox Exp $ --> <refentry> <refentryinfo> @@ -36,7 +36,6 @@ <year>2004</year> <year>2005</year> <year>2007</year> - <year>2012</year> <holder>Internet Systems Consortium, Inc. ("ISC")</holder> </copyright> <copyright> diff --git a/lib/lwres/man/lwres_gabn.html b/lib/lwres/man/lwres_gabn.html index 30c9dda..270620d 100644 --- a/lib/lwres/man/lwres_gabn.html +++ b/lib/lwres/man/lwres_gabn.html @@ -1,5 +1,5 @@ <!-- - - Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -22,7 +22,7 @@ <meta name="generator" content="DocBook XSL Stylesheets V1.71.1"> </head> <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en"> -<a name="id2476275"></a><div class="titlepage"></div> +<a name="id2476274"></a><div class="titlepage"></div> <div class="refnamediv"> <h2>Name</h2> <p>lwres_gabnrequest_render, lwres_gabnresponse_render, lwres_gabnrequest_parse, lwres_gabnresponse_parse, lwres_gabnresponse_free, lwres_gabnrequest_free — lightweight resolver getaddrbyname message handling</p> @@ -178,7 +178,7 @@ void </div> </div> <div class="refsect1" lang="en"> -<a name="id2543526"></a><h2>DESCRIPTION</h2> +<a name="id2543524"></a><h2>DESCRIPTION</h2> <p> These are low-level routines for creating and parsing lightweight resolver name-to-address lookup request and @@ -278,7 +278,7 @@ typedef struct { </p> </div> <div class="refsect1" lang="en"> -<a name="id2543671"></a><h2>RETURN VALUES</h2> +<a name="id2543669"></a><h2>RETURN VALUES</h2> <p> The getaddrbyname opcode functions <code class="function">lwres_gabnrequest_render()</code>, @@ -316,7 +316,7 @@ typedef struct { </p> </div> <div class="refsect1" lang="en"> -<a name="id2543737"></a><h2>SEE ALSO</h2> +<a name="id2543735"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">lwres_packet</span>(3)</span> </p> </div> diff --git a/lib/lwres/man/lwres_gai_strerror.3 b/lib/lwres/man/lwres_gai_strerror.3 index 99d3cd2..fa3f494 100644 --- a/lib/lwres/man/lwres_gai_strerror.3 +++ b/lib/lwres/man/lwres_gai_strerror.3 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -123,7 +123,7 @@ used by \fBgetaddrinfo\fR(3), \fBRFC2133\fR(). .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001 Internet Software Consortium. .br diff --git a/lib/lwres/man/lwres_gai_strerror.docbook b/lib/lwres/man/lwres_gai_strerror.docbook index de6c041..c33fee5 100644 --- a/lib/lwres/man/lwres_gai_strerror.docbook +++ b/lib/lwres/man/lwres_gai_strerror.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [<!ENTITY mdash "—">]> <!-- - - Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id$ --> +<!-- $Id: lwres_gai_strerror.docbook,v 1.10 2007/06/18 23:47:51 tbox Exp $ --> <refentry> <refentryinfo> @@ -36,7 +36,6 @@ <year>2004</year> <year>2005</year> <year>2007</year> - <year>2012</year> <holder>Internet Systems Consortium, Inc. ("ISC")</holder> </copyright> <copyright> diff --git a/lib/lwres/man/lwres_gai_strerror.html b/lib/lwres/man/lwres_gai_strerror.html index e8d4935..f2faace 100644 --- a/lib/lwres/man/lwres_gai_strerror.html +++ b/lib/lwres/man/lwres_gai_strerror.html @@ -1,5 +1,5 @@ <!-- - - Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -42,7 +42,7 @@ char * </div> </div> <div class="refsect1" lang="en"> -<a name="id2543365"></a><h2>DESCRIPTION</h2> +<a name="id2543362"></a><h2>DESCRIPTION</h2> <p><code class="function">lwres_gai_strerror()</code> returns an error message corresponding to an error code returned by <code class="function">getaddrinfo()</code>. @@ -110,7 +110,7 @@ char * </p> </div> <div class="refsect1" lang="en"> -<a name="id2543580"></a><h2>SEE ALSO</h2> +<a name="id2543577"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">strerror</span>(3)</span>, <span class="citerefentry"><span class="refentrytitle">lwres_getaddrinfo</span>(3)</span>, diff --git a/lib/lwres/man/lwres_getaddrinfo.3 b/lib/lwres/man/lwres_getaddrinfo.3 index 96acaae..a80904b 100644 --- a/lib/lwres/man/lwres_getaddrinfo.3 +++ b/lib/lwres/man/lwres_getaddrinfo.3 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001, 2003 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -240,7 +240,7 @@ returns \fBsendmsg\fR(2), \fBsocket\fR(2). .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001, 2003 Internet Software Consortium. .br diff --git a/lib/lwres/man/lwres_getaddrinfo.docbook b/lib/lwres/man/lwres_getaddrinfo.docbook index cedb6ea..a328764 100644 --- a/lib/lwres/man/lwres_getaddrinfo.docbook +++ b/lib/lwres/man/lwres_getaddrinfo.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [<!ENTITY mdash "—">]> <!-- - - Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001, 2003 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id$ --> +<!-- $Id: lwres_getaddrinfo.docbook,v 1.13 2007/06/18 23:47:51 tbox Exp $ --> <refentry> <refentryinfo> @@ -36,7 +36,6 @@ <year>2004</year> <year>2005</year> <year>2007</year> - <year>2012</year> <holder>Internet Systems Consortium, Inc. ("ISC")</holder> </copyright> <copyright> diff --git a/lib/lwres/man/lwres_getaddrinfo.html b/lib/lwres/man/lwres_getaddrinfo.html index 57025c0..2702367 100644 --- a/lib/lwres/man/lwres_getaddrinfo.html +++ b/lib/lwres/man/lwres_getaddrinfo.html @@ -1,5 +1,5 @@ <!-- - - Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001, 2003 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -89,7 +89,7 @@ struct addrinfo { </p> </div> <div class="refsect1" lang="en"> -<a name="id2543416"></a><h2>DESCRIPTION</h2> +<a name="id2543413"></a><h2>DESCRIPTION</h2> <p><code class="function">lwres_getaddrinfo()</code> is used to get a list of IP addresses and port numbers for host <em class="parameter"><code>hostname</code></em> and service @@ -283,7 +283,7 @@ struct addrinfo { </p> </div> <div class="refsect1" lang="en"> -<a name="id2543794"></a><h2>RETURN VALUES</h2> +<a name="id2543790"></a><h2>RETURN VALUES</h2> <p><code class="function">lwres_getaddrinfo()</code> returns zero on success or one of the error codes listed in <span class="citerefentry"><span class="refentrytitle">gai_strerror</span>(3)</span> @@ -294,7 +294,7 @@ struct addrinfo { </p> </div> <div class="refsect1" lang="en"> -<a name="id2543831"></a><h2>SEE ALSO</h2> +<a name="id2543828"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">lwres</span>(3)</span>, <span class="citerefentry"><span class="refentrytitle">lwres_getaddrinfo</span>(3)</span>, diff --git a/lib/lwres/man/lwres_gethostent.3 b/lib/lwres/man/lwres_gethostent.3 index d6d32e0..3706727 100644 --- a/lib/lwres/man/lwres_gethostent.3 +++ b/lib/lwres/man/lwres_gethostent.3 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2001 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -309,7 +309,7 @@ The resolver daemon does not currently support any non\-DNS name services such a or \fBNIS\fR, consequently the above functions don't, either. .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2001 Internet Software Consortium. .br diff --git a/lib/lwres/man/lwres_gethostent.docbook b/lib/lwres/man/lwres_gethostent.docbook index b538915..a3f084b 100644 --- a/lib/lwres/man/lwres_gethostent.docbook +++ b/lib/lwres/man/lwres_gethostent.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [<!ENTITY mdash "—">]> <!-- - - Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2001 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id$ --> +<!-- $Id: lwres_gethostent.docbook,v 1.11 2007/06/18 23:47:51 tbox Exp $ --> <refentry> <refentryinfo> @@ -36,7 +36,6 @@ <year>2004</year> <year>2005</year> <year>2007</year> - <year>2012</year> <holder>Internet Systems Consortium, Inc. ("ISC")</holder> </copyright> <copyright> diff --git a/lib/lwres/man/lwres_gethostent.html b/lib/lwres/man/lwres_gethostent.html index e5f660c..2c99085 100644 --- a/lib/lwres/man/lwres_gethostent.html +++ b/lib/lwres/man/lwres_gethostent.html @@ -1,5 +1,5 @@ <!-- - - Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2001 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -228,7 +228,7 @@ void </div> </div> <div class="refsect1" lang="en"> -<a name="id2543612"></a><h2>DESCRIPTION</h2> +<a name="id2543609"></a><h2>DESCRIPTION</h2> <p> These functions provide hostname-to-address and address-to-hostname lookups by means of the lightweight resolver. @@ -366,7 +366,7 @@ struct hostent { </p> </div> <div class="refsect1" lang="en"> -<a name="id2543963"></a><h2>RETURN VALUES</h2> +<a name="id2543960"></a><h2>RETURN VALUES</h2> <p> The functions <code class="function">lwres_gethostbyname()</code>, @@ -430,7 +430,7 @@ struct hostent { </p> </div> <div class="refsect1" lang="en"> -<a name="id2544197"></a><h2>SEE ALSO</h2> +<a name="id2544194"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">gethostent</span>(3)</span>, <span class="citerefentry"><span class="refentrytitle">lwres_getipnode</span>(3)</span>, @@ -439,7 +439,7 @@ struct hostent { </p> </div> <div class="refsect1" lang="en"> -<a name="id2544231"></a><h2>BUGS</h2> +<a name="id2544228"></a><h2>BUGS</h2> <p><code class="function">lwres_gethostbyname()</code>, <code class="function">lwres_gethostbyname2()</code>, <code class="function">lwres_gethostbyaddr()</code> diff --git a/lib/lwres/man/lwres_getipnode.3 b/lib/lwres/man/lwres_getipnode.3 index c234ddf..3632e64 100644 --- a/lib/lwres/man/lwres_getipnode.3 +++ b/lib/lwres/man/lwres_getipnode.3 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001, 2003 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -200,7 +200,7 @@ translates these error codes to suitable error messages. \fBlwres_getnameinfo\fR(3), \fBlwres_hstrerror\fR(3). .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001, 2003 Internet Software Consortium. .br diff --git a/lib/lwres/man/lwres_getipnode.docbook b/lib/lwres/man/lwres_getipnode.docbook index 8fd9914..825f462 100644 --- a/lib/lwres/man/lwres_getipnode.docbook +++ b/lib/lwres/man/lwres_getipnode.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [<!ENTITY mdash "—">]> <!-- - - Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001, 2003 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id$ --> +<!-- $Id: lwres_getipnode.docbook,v 1.12 2007/06/18 23:47:51 tbox Exp $ --> <refentry> <refentryinfo> @@ -36,7 +36,6 @@ <year>2004</year> <year>2005</year> <year>2007</year> - <year>2012</year> <holder>Internet Systems Consortium, Inc. ("ISC")</holder> </copyright> <copyright> diff --git a/lib/lwres/man/lwres_getipnode.html b/lib/lwres/man/lwres_getipnode.html index 410fec9..0fc483d 100644 --- a/lib/lwres/man/lwres_getipnode.html +++ b/lib/lwres/man/lwres_getipnode.html @@ -1,5 +1,5 @@ <!-- - - Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001, 2003 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -98,7 +98,7 @@ void </div> </div> <div class="refsect1" lang="en"> -<a name="id2543435"></a><h2>DESCRIPTION</h2> +<a name="id2543432"></a><h2>DESCRIPTION</h2> <p> These functions perform thread safe, protocol independent nodename-to-address and address-to-nodename @@ -217,7 +217,7 @@ struct hostent { </p> </div> <div class="refsect1" lang="en"> -<a name="id2543693"></a><h2>RETURN VALUES</h2> +<a name="id2543690"></a><h2>RETURN VALUES</h2> <p> If an error occurs, <code class="function">lwres_getipnodebyname()</code> @@ -261,7 +261,7 @@ struct hostent { </p> </div> <div class="refsect1" lang="en"> -<a name="id2543790"></a><h2>SEE ALSO</h2> +<a name="id2543787"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">RFC2553</span></span>, <span class="citerefentry"><span class="refentrytitle">lwres</span>(3)</span>, diff --git a/lib/lwres/man/lwres_getnameinfo.3 b/lib/lwres/man/lwres_getnameinfo.3 index 4a9eb02..8ceb47c 100644 --- a/lib/lwres/man/lwres_getnameinfo.3 +++ b/lib/lwres/man/lwres_getnameinfo.3 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -111,7 +111,7 @@ RFC2133 fails to define what the nonzero return values of \fBgetnameinfo\fR(3) are. .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001 Internet Software Consortium. .br diff --git a/lib/lwres/man/lwres_getnameinfo.docbook b/lib/lwres/man/lwres_getnameinfo.docbook index 4b35f02..504dfb7 100644 --- a/lib/lwres/man/lwres_getnameinfo.docbook +++ b/lib/lwres/man/lwres_getnameinfo.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [<!ENTITY mdash "—">]> <!-- - - Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id$ --> +<!-- $Id: lwres_getnameinfo.docbook,v 1.10 2007/06/18 23:47:51 tbox Exp $ --> <refentry> <refentryinfo> @@ -36,7 +36,6 @@ <year>2004</year> <year>2005</year> <year>2007</year> - <year>2012</year> <holder>Internet Systems Consortium, Inc. ("ISC")</holder> </copyright> <copyright> diff --git a/lib/lwres/man/lwres_getnameinfo.html b/lib/lwres/man/lwres_getnameinfo.html index f4808e7..9cc7d5a 100644 --- a/lib/lwres/man/lwres_getnameinfo.html +++ b/lib/lwres/man/lwres_getnameinfo.html @@ -1,5 +1,5 @@ <!-- - - Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -82,7 +82,7 @@ int </div> </div> <div class="refsect1" lang="en"> -<a name="id2543397"></a><h2>DESCRIPTION</h2> +<a name="id2543394"></a><h2>DESCRIPTION</h2> <p> This function is equivalent to the <span class="citerefentry"><span class="refentrytitle">getnameinfo</span>(3)</span> function defined in RFC2133. @@ -149,13 +149,13 @@ int </p> </div> <div class="refsect1" lang="en"> -<a name="id2543539"></a><h2>RETURN VALUES</h2> +<a name="id2543536"></a><h2>RETURN VALUES</h2> <p><code class="function">lwres_getnameinfo()</code> returns 0 on success or a non-zero error code if an error occurs. </p> </div> <div class="refsect1" lang="en"> -<a name="id2543550"></a><h2>SEE ALSO</h2> +<a name="id2543547"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">RFC2133</span></span>, <span class="citerefentry"><span class="refentrytitle">getservbyport</span>(3)</span>, <span class="citerefentry"><span class="refentrytitle">lwres</span>(3)</span>, @@ -165,7 +165,7 @@ int </p> </div> <div class="refsect1" lang="en"> -<a name="id2543608"></a><h2>BUGS</h2> +<a name="id2543605"></a><h2>BUGS</h2> <p> RFC2133 fails to define what the nonzero return values of <span class="citerefentry"><span class="refentrytitle">getnameinfo</span>(3)</span> diff --git a/lib/lwres/man/lwres_getrrsetbyname.3 b/lib/lwres/man/lwres_getrrsetbyname.3 index be8abab..f2e3341 100644 --- a/lib/lwres/man/lwres_getrrsetbyname.3 +++ b/lib/lwres/man/lwres_getrrsetbyname.3 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -158,7 +158,7 @@ other failure .PP \fBlwres\fR(3). .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001 Internet Software Consortium. .br diff --git a/lib/lwres/man/lwres_getrrsetbyname.docbook b/lib/lwres/man/lwres_getrrsetbyname.docbook index 51a7701..5f2a68d 100644 --- a/lib/lwres/man/lwres_getrrsetbyname.docbook +++ b/lib/lwres/man/lwres_getrrsetbyname.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [<!ENTITY mdash "—">]> <!-- - - Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id$ --> +<!-- $Id: lwres_getrrsetbyname.docbook,v 1.10 2007/06/18 23:47:51 tbox Exp $ --> <refentry> <refentryinfo> @@ -36,7 +36,6 @@ <year>2004</year> <year>2005</year> <year>2007</year> - <year>2012</year> <holder>Internet Systems Consortium, Inc. ("ISC")</holder> </copyright> <copyright> diff --git a/lib/lwres/man/lwres_getrrsetbyname.html b/lib/lwres/man/lwres_getrrsetbyname.html index 7f3b56d..e7d68bb 100644 --- a/lib/lwres/man/lwres_getrrsetbyname.html +++ b/lib/lwres/man/lwres_getrrsetbyname.html @@ -1,5 +1,5 @@ <!-- - - Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -102,7 +102,7 @@ struct rrsetinfo { </p> </div> <div class="refsect1" lang="en"> -<a name="id2543418"></a><h2>DESCRIPTION</h2> +<a name="id2543415"></a><h2>DESCRIPTION</h2> <p><code class="function">lwres_getrrsetbyname()</code> gets a set of resource records associated with a <em class="parameter"><code>hostname</code></em>, <em class="parameter"><code>class</code></em>, @@ -150,7 +150,7 @@ struct rrsetinfo { <p></p> </div> <div class="refsect1" lang="en"> -<a name="id2543530"></a><h2>RETURN VALUES</h2> +<a name="id2543527"></a><h2>RETURN VALUES</h2> <p><code class="function">lwres_getrrsetbyname()</code> returns zero on success, and one of the following error codes if an error occurred: @@ -184,7 +184,7 @@ struct rrsetinfo { </p> </div> <div class="refsect1" lang="en"> -<a name="id2543630"></a><h2>SEE ALSO</h2> +<a name="id2543627"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">lwres</span>(3)</span>. </p> </div> diff --git a/lib/lwres/man/lwres_gnba.3 b/lib/lwres/man/lwres_gnba.3 index 5c2b264..4135190 100644 --- a/lib/lwres/man/lwres_gnba.3 +++ b/lib/lwres/man/lwres_gnba.3 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -177,7 +177,7 @@ indicate that the packet is not a response to an earlier query. .PP \fBlwres_packet\fR(3). .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001 Internet Software Consortium. .br diff --git a/lib/lwres/man/lwres_gnba.docbook b/lib/lwres/man/lwres_gnba.docbook index 4aa7fcb..452cdfc 100644 --- a/lib/lwres/man/lwres_gnba.docbook +++ b/lib/lwres/man/lwres_gnba.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [<!ENTITY mdash "—">]> <!-- - - Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id$ --> +<!-- $Id: lwres_gnba.docbook,v 1.11 2007/06/18 23:47:51 tbox Exp $ --> <refentry> <refentryinfo> @@ -36,7 +36,6 @@ <year>2004</year> <year>2005</year> <year>2007</year> - <year>2012</year> <holder>Internet Systems Consortium, Inc. ("ISC")</holder> </copyright> <copyright> diff --git a/lib/lwres/man/lwres_gnba.html b/lib/lwres/man/lwres_gnba.html index 774a166..6d61b87 100644 --- a/lib/lwres/man/lwres_gnba.html +++ b/lib/lwres/man/lwres_gnba.html @@ -1,5 +1,5 @@ <!-- - - Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -22,7 +22,7 @@ <meta name="generator" content="DocBook XSL Stylesheets V1.71.1"> </head> <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en"> -<a name="id2476275"></a><div class="titlepage"></div> +<a name="id2476274"></a><div class="titlepage"></div> <div class="refnamediv"> <h2>Name</h2> <p>lwres_gnbarequest_render, lwres_gnbaresponse_render, lwres_gnbarequest_parse, lwres_gnbaresponse_parse, lwres_gnbaresponse_free, lwres_gnbarequest_free — lightweight resolver getnamebyaddress message handling</p> @@ -183,7 +183,7 @@ void </div> </div> <div class="refsect1" lang="en"> -<a name="id2543529"></a><h2>DESCRIPTION</h2> +<a name="id2543527"></a><h2>DESCRIPTION</h2> <p> These are low-level routines for creating and parsing lightweight resolver address-to-name lookup request and @@ -270,7 +270,7 @@ typedef struct { </p> </div> <div class="refsect1" lang="en"> -<a name="id2543669"></a><h2>RETURN VALUES</h2> +<a name="id2543667"></a><h2>RETURN VALUES</h2> <p> The getnamebyaddr opcode functions <code class="function">lwres_gnbarequest_render()</code>, @@ -308,7 +308,7 @@ typedef struct { </p> </div> <div class="refsect1" lang="en"> -<a name="id2543735"></a><h2>SEE ALSO</h2> +<a name="id2543733"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">lwres_packet</span>(3)</span>. </p> </div> diff --git a/lib/lwres/man/lwres_hstrerror.3 b/lib/lwres/man/lwres_hstrerror.3 index 5beff3c..6d24cf6 100644 --- a/lib/lwres/man/lwres_hstrerror.3 +++ b/lib/lwres/man/lwres_hstrerror.3 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -93,7 +93,7 @@ is not a valid error code. \fBherror\fR(3), \fBlwres_hstrerror\fR(3). .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001 Internet Software Consortium. .br diff --git a/lib/lwres/man/lwres_hstrerror.docbook b/lib/lwres/man/lwres_hstrerror.docbook index d937b6c..ca4589e 100644 --- a/lib/lwres/man/lwres_hstrerror.docbook +++ b/lib/lwres/man/lwres_hstrerror.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [<!ENTITY mdash "—">]> <!-- - - Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id$ --> +<!-- $Id: lwres_hstrerror.docbook,v 1.11 2007/06/18 23:47:51 tbox Exp $ --> <refentry> <refentryinfo> @@ -36,7 +36,6 @@ <year>2004</year> <year>2005</year> <year>2007</year> - <year>2012</year> <holder>Internet Systems Consortium, Inc. ("ISC")</holder> </copyright> <copyright> diff --git a/lib/lwres/man/lwres_hstrerror.html b/lib/lwres/man/lwres_hstrerror.html index c698d55..8d4e9d6 100644 --- a/lib/lwres/man/lwres_hstrerror.html +++ b/lib/lwres/man/lwres_hstrerror.html @@ -1,5 +1,5 @@ <!-- - - Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -50,7 +50,7 @@ const char * </div> </div> <div class="refsect1" lang="en"> -<a name="id2543383"></a><h2>DESCRIPTION</h2> +<a name="id2543380"></a><h2>DESCRIPTION</h2> <p><code class="function">lwres_herror()</code> prints the string <em class="parameter"><code>s</code></em> on <span class="type">stderr</span> followed by the string generated by @@ -84,7 +84,7 @@ const char * </p> </div> <div class="refsect1" lang="en"> -<a name="id2543501"></a><h2>RETURN VALUES</h2> +<a name="id2543498"></a><h2>RETURN VALUES</h2> <p> The string <span class="errorname">Unknown resolver error</span> is returned by <code class="function">lwres_hstrerror()</code> @@ -94,7 +94,7 @@ const char * </p> </div> <div class="refsect1" lang="en"> -<a name="id2543522"></a><h2>SEE ALSO</h2> +<a name="id2543518"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">herror</span>(3)</span>, <span class="citerefentry"><span class="refentrytitle">lwres_hstrerror</span>(3)</span>. diff --git a/lib/lwres/man/lwres_inetntop.3 b/lib/lwres/man/lwres_inetntop.3 index 48a0319..0dfe5e6 100644 --- a/lib/lwres/man/lwres_inetntop.3 +++ b/lib/lwres/man/lwres_inetntop.3 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -71,7 +71,7 @@ is not supported. \fBinet_ntop\fR(3), \fBerrno\fR(3). .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001 Internet Software Consortium. .br diff --git a/lib/lwres/man/lwres_inetntop.docbook b/lib/lwres/man/lwres_inetntop.docbook index 93a9a4f..26f1779 100644 --- a/lib/lwres/man/lwres_inetntop.docbook +++ b/lib/lwres/man/lwres_inetntop.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [<!ENTITY mdash "—">]> <!-- - - Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id$ --> +<!-- $Id: lwres_inetntop.docbook,v 1.10 2007/06/18 23:47:51 tbox Exp $ --> <refentry> <refentryinfo> @@ -36,7 +36,6 @@ <year>2004</year> <year>2005</year> <year>2007</year> - <year>2012</year> <holder>Internet Systems Consortium, Inc. ("ISC")</holder> </copyright> <copyright> diff --git a/lib/lwres/man/lwres_inetntop.html b/lib/lwres/man/lwres_inetntop.html index 64be8a9..6f1a37f 100644 --- a/lib/lwres/man/lwres_inetntop.html +++ b/lib/lwres/man/lwres_inetntop.html @@ -1,5 +1,5 @@ <!-- - - Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -62,7 +62,7 @@ const char * </div> </div> <div class="refsect1" lang="en"> -<a name="id2543383"></a><h2>DESCRIPTION</h2> +<a name="id2543380"></a><h2>DESCRIPTION</h2> <p><code class="function">lwres_net_ntop()</code> converts an IP address of protocol family <em class="parameter"><code>af</code></em> — IPv4 or IPv6 — at @@ -80,7 +80,7 @@ const char * </p> </div> <div class="refsect1" lang="en"> -<a name="id2543415"></a><h2>RETURN VALUES</h2> +<a name="id2543412"></a><h2>RETURN VALUES</h2> <p> If successful, the function returns <em class="parameter"><code>dst</code></em>: a pointer to a string containing the presentation format of the @@ -93,7 +93,7 @@ const char * </p> </div> <div class="refsect1" lang="en"> -<a name="id2543448"></a><h2>SEE ALSO</h2> +<a name="id2543445"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">RFC1884</span></span>, <span class="citerefentry"><span class="refentrytitle">inet_ntop</span>(3)</span>, <span class="citerefentry"><span class="refentrytitle">errno</span>(3)</span>. diff --git a/lib/lwres/man/lwres_noop.3 b/lib/lwres/man/lwres_noop.3 index aa13875..c0fc47e 100644 --- a/lib/lwres/man/lwres_noop.3 +++ b/lib/lwres/man/lwres_noop.3 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -177,7 +177,7 @@ indicate that the packet is not a response to an earlier query. .PP \fBlwres_packet\fR(3) .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001 Internet Software Consortium. .br diff --git a/lib/lwres/man/lwres_noop.docbook b/lib/lwres/man/lwres_noop.docbook index be03c8f..eb823b7 100644 --- a/lib/lwres/man/lwres_noop.docbook +++ b/lib/lwres/man/lwres_noop.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [<!ENTITY mdash "—">]> <!-- - - Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id$ --> +<!-- $Id: lwres_noop.docbook,v 1.11 2007/06/18 23:47:51 tbox Exp $ --> <refentry> <refentryinfo> @@ -36,7 +36,6 @@ <year>2004</year> <year>2005</year> <year>2007</year> - <year>2012</year> <holder>Internet Systems Consortium, Inc. ("ISC")</holder> </copyright> <copyright> diff --git a/lib/lwres/man/lwres_noop.html b/lib/lwres/man/lwres_noop.html index 9db4d06..69d0d38 100644 --- a/lib/lwres/man/lwres_noop.html +++ b/lib/lwres/man/lwres_noop.html @@ -1,5 +1,5 @@ <!-- - - Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -22,7 +22,7 @@ <meta name="generator" content="DocBook XSL Stylesheets V1.71.1"> </head> <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en"> -<a name="id2476275"></a><div class="titlepage"></div> +<a name="id2476274"></a><div class="titlepage"></div> <div class="refnamediv"> <h2>Name</h2> <p>lwres_nooprequest_render, lwres_noopresponse_render, lwres_nooprequest_parse, lwres_noopresponse_parse, lwres_noopresponse_free, lwres_nooprequest_free — lightweight resolver no-op message handling</p> @@ -179,7 +179,7 @@ void </div> </div> <div class="refsect1" lang="en"> -<a name="id2543526"></a><h2>DESCRIPTION</h2> +<a name="id2543524"></a><h2>DESCRIPTION</h2> <p> These are low-level routines for creating and parsing lightweight resolver no-op request and response messages. @@ -270,7 +270,7 @@ typedef struct { </p> </div> <div class="refsect1" lang="en"> -<a name="id2543676"></a><h2>RETURN VALUES</h2> +<a name="id2543674"></a><h2>RETURN VALUES</h2> <p> The no-op opcode functions <code class="function">lwres_nooprequest_render()</code>, @@ -309,7 +309,7 @@ typedef struct { </p> </div> <div class="refsect1" lang="en"> -<a name="id2543742"></a><h2>SEE ALSO</h2> +<a name="id2543740"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">lwres_packet</span>(3)</span> </p> </div> diff --git a/lib/lwres/man/lwres_packet.3 b/lib/lwres/man/lwres_packet.3 index 21bc90d..49ebff7 100644 --- a/lib/lwres/man/lwres_packet.3 +++ b/lib/lwres/man/lwres_packet.3 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -164,7 +164,7 @@ and lightweight resolver packet both functions return \fBLWRES_R_UNEXPECTEDEND\fR. .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001 Internet Software Consortium. .br diff --git a/lib/lwres/man/lwres_packet.docbook b/lib/lwres/man/lwres_packet.docbook index b191b35..87841db 100644 --- a/lib/lwres/man/lwres_packet.docbook +++ b/lib/lwres/man/lwres_packet.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [<!ENTITY mdash "—">]> <!-- - - Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id$ --> +<!-- $Id: lwres_packet.docbook,v 1.13 2007/06/18 23:47:51 tbox Exp $ --> <refentry> <refentryinfo> @@ -36,7 +36,6 @@ <year>2004</year> <year>2005</year> <year>2007</year> - <year>2012</year> <holder>Internet Systems Consortium, Inc. ("ISC")</holder> </copyright> <copyright> diff --git a/lib/lwres/man/lwres_packet.html b/lib/lwres/man/lwres_packet.html index 3627465..fad9076 100644 --- a/lib/lwres/man/lwres_packet.html +++ b/lib/lwres/man/lwres_packet.html @@ -1,5 +1,5 @@ <!-- - - Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -66,7 +66,7 @@ lwres_result_t </div> </div> <div class="refsect1" lang="en"> -<a name="id2543394"></a><h2>DESCRIPTION</h2> +<a name="id2543390"></a><h2>DESCRIPTION</h2> <p> These functions rely on a <span class="type">struct lwres_lwpacket</span> @@ -219,7 +219,7 @@ struct lwres_lwpacket { </p> </div> <div class="refsect1" lang="en"> -<a name="id2543710"></a><h2>RETURN VALUES</h2> +<a name="id2543707"></a><h2>RETURN VALUES</h2> <p> Successful calls to <code class="function">lwres_lwpacket_renderheader()</code> and diff --git a/lib/lwres/man/lwres_resutil.3 b/lib/lwres/man/lwres_resutil.3 index 75dd751..0e9cf6f 100644 --- a/lib/lwres/man/lwres_resutil.3 +++ b/lib/lwres/man/lwres_resutil.3 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -164,7 +164,7 @@ if the buffers used for sending queries and receiving replies are too small. \fBlwres_buffer\fR(3), \fBlwres_gabn\fR(3). .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001 Internet Software Consortium. .br diff --git a/lib/lwres/man/lwres_resutil.docbook b/lib/lwres/man/lwres_resutil.docbook index d071bca..e6184d9 100644 --- a/lib/lwres/man/lwres_resutil.docbook +++ b/lib/lwres/man/lwres_resutil.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [<!ENTITY mdash "—">]> <!-- - - Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id$ --> +<!-- $Id: lwres_resutil.docbook,v 1.12 2007/06/18 23:47:51 tbox Exp $ --> <refentry> <refentryinfo> @@ -36,7 +36,6 @@ <year>2004</year> <year>2005</year> <year>2007</year> - <year>2012</year> <holder>Internet Systems Consortium, Inc. ("ISC")</holder> </copyright> <copyright> diff --git a/lib/lwres/man/lwres_resutil.html b/lib/lwres/man/lwres_resutil.html index cbe724b..4db7610 100644 --- a/lib/lwres/man/lwres_resutil.html +++ b/lib/lwres/man/lwres_resutil.html @@ -1,5 +1,5 @@ <!-- - - Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -134,7 +134,7 @@ lwres_result_t </div> </div> <div class="refsect1" lang="en"> -<a name="id2543470"></a><h2>DESCRIPTION</h2> +<a name="id2543467"></a><h2>DESCRIPTION</h2> <p><code class="function">lwres_string_parse()</code> retrieves a DNS-encoded string starting the current pointer of lightweight resolver buffer <em class="parameter"><code>b</code></em>: i.e. @@ -210,7 +210,7 @@ typedef struct { </p> </div> <div class="refsect1" lang="en"> -<a name="id2543609"></a><h2>RETURN VALUES</h2> +<a name="id2543606"></a><h2>RETURN VALUES</h2> <p> Successful calls to <code class="function">lwres_string_parse()</code> @@ -248,7 +248,7 @@ typedef struct { </p> </div> <div class="refsect1" lang="en"> -<a name="id2543681"></a><h2>SEE ALSO</h2> +<a name="id2543677"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">lwres_buffer</span>(3)</span>, <span class="citerefentry"><span class="refentrytitle">lwres_gabn</span>(3)</span>. diff --git a/lib/lwres/print_p.h b/lib/lwres/print_p.h index 60f91aa..c8b8896 100644 --- a/lib/lwres/print_p.h +++ b/lib/lwres/print_p.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2007, 2010, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007, 2010 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2001, 2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: print_p.h,v 1.6 2010/08/16 23:46:52 tbox Exp $ */ #ifndef LWRES_PRINT_P_H #define LWRES_PRINT_P_H 1 diff --git a/lib/lwres/strtoul.c b/lib/lwres/strtoul.c index c9413a4..f16896c 100644 --- a/lib/lwres/strtoul.c +++ b/lib/lwres/strtoul.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -53,7 +53,7 @@ static char sccsid[] = "@(#)strtoul.c 8.1 (Berkeley) 6/4/93"; #endif /* LIBC_SCCS and not lint */ -/* $Id$ */ +/* $Id: strtoul.c,v 1.4 2007/06/19 23:47:22 tbox Exp $ */ #include <config.h> diff --git a/lib/lwres/unix/Makefile.in b/lib/lwres/unix/Makefile.in index 15f052d..26ca4fb 100644 --- a/lib/lwres/unix/Makefile.in +++ b/lib/lwres/unix/Makefile.in @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id$ +# $Id: Makefile.in,v 1.4 2007/06/19 23:47:23 tbox Exp $ srcdir = @srcdir@ VPATH = @srcdir@ diff --git a/lib/lwres/unix/include/Makefile.in b/lib/lwres/unix/include/Makefile.in index 9c70db2..5372543 100644 --- a/lib/lwres/unix/include/Makefile.in +++ b/lib/lwres/unix/include/Makefile.in @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id$ +# $Id: Makefile.in,v 1.4 2007/06/19 23:47:23 tbox Exp $ srcdir = @srcdir@ VPATH = @srcdir@ diff --git a/lib/lwres/unix/include/lwres/Makefile.in b/lib/lwres/unix/include/lwres/Makefile.in index 21b63dd..4f60ce8 100644 --- a/lib/lwres/unix/include/lwres/Makefile.in +++ b/lib/lwres/unix/include/lwres/Makefile.in @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id$ +# $Id: Makefile.in,v 1.4 2007/06/19 23:47:23 tbox Exp $ srcdir = @srcdir@ VPATH = @srcdir@ diff --git a/lib/lwres/unix/include/lwres/net.h b/lib/lwres/unix/include/lwres/net.h index 390853f..0b16178 100644 --- a/lib/lwres/unix/include/lwres/net.h +++ b/lib/lwres/unix/include/lwres/net.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000-2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: net.h,v 1.9 2007/06/19 23:47:23 tbox Exp $ */ #ifndef LWRES_NET_H #define LWRES_NET_H 1 @@ -65,7 +65,7 @@ #ifdef LWRES_PLATFORM_NEEDNETINET6IN6H #include <netinet6/in6.h> /* Required on BSD/OS for in6_pktinfo. */ #endif -#include <net/if.h> +#include <net/if.h> #include <lwres/lang.h> @@ -80,7 +80,7 @@ /*! * Required for some pre RFC2133 implementations. * IN6ADDR_ANY_INIT and IN6ADDR_LOOPBACK_INIT were added in - * draft-ietf-ipngwg-bsd-api-04.txt or draft-ietf-ipngwg-bsd-api-05.txt. + * draft-ietf-ipngwg-bsd-api-04.txt or draft-ietf-ipngwg-bsd-api-05.txt. * If 's6_addr' is defined then assume that there is a union and three * levels otherwise assume two levels required. */ diff --git a/lib/lwres/version.c b/lib/lwres/version.c index a7e5a7e..cc52c51 100644 --- a/lib/lwres/version.c +++ b/lib/lwres/version.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ +/* $Id: version.c,v 1.12 2007/06/19 23:47:22 tbox Exp $ */ /*! \file */ diff --git a/make/Makefile.in b/make/Makefile.in index 29f2199..86c93e7 100644 --- a/make/Makefile.in +++ b/make/Makefile.in @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id$ +# $Id: Makefile.in,v 1.16 2007/06/19 23:47:24 tbox Exp $ srcdir = @srcdir@ VPATH = @srcdir@ diff --git a/make/includes.in b/make/includes.in index 5a5392c..f2f1b3f 100644 --- a/make/includes.in +++ b/make/includes.in @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id$ +# $Id: includes.in,v 1.21 2007/06/19 23:47:24 tbox Exp $ # Search for machine-generated header files in the build tree, # and for normal headers in the source tree (${top_srcdir}). diff --git a/make/rules.in b/make/rules.in index ae02766..37bc50d 100644 --- a/make/rules.in +++ b/make/rules.in @@ -358,3 +358,12 @@ ALWAYS_MAKE_SYMTABLE = @ALWAYS_MAKE_SYMTABLE@ .docbook.8: ${XSLTPROC} -o $@ ${top_srcdir}/doc/xsl/isc-manpage.xsl $< + +### +### Python executable +### +.SUFFIXES: .py +.py: + cp -f $< $@ + chmod +x $@ + diff --git a/mkinstalldirs b/mkinstalldirs index d0fd194..4992567 100755 --- a/mkinstalldirs +++ b/mkinstalldirs @@ -4,7 +4,7 @@ # Created: 1993-05-16 # Public domain -# $Id$ +# $Id: mkinstalldirs,v 1.1 2000/09/20 19:05:51 gson Exp $ errstatus=0 @@ -4,9 +4,9 @@ # configure. # PRODUCT=BIND -DESCRIPTION= +DESCRIPTION="(Extended Support Version)" MAJORVER=9 -MINORVER=8 -PATCHVER=5 +MINORVER=9 +PATCHVER=3 RELEASETYPE=-P RELEASEVER=2 |
