diff options
Diffstat (limited to 'contrib')
204 files changed, 24257 insertions, 9396 deletions
diff --git a/contrib/bind9/CHANGES b/contrib/bind9/CHANGES index 05a4594..06b6052 100644 --- a/contrib/bind9/CHANGES +++ b/contrib/bind9/CHANGES @@ -1,5 +1,117 @@ - --- 9.4.1-P1 released --- + --- 9.4.2 released --- + --- 9.4.2rc2 released --- + +2259. [bug] Reverse incorrect LIBINTERFACE bump of libisc + in 9.4.2rc1. Applications built against 9.4.2rc1 + will need to be rebuilt. + +2258. [bug] Fallback from IXFR/TSIG to SOA/AXFR/TSIG broken. + [RT #17241] + +2257. [bug] win32: Use the full path to vcredist_x86.exe when + calling it. [RT #17222] + +2256. [bug] win32: Correctly register the installation location of + bindevt.dll. [RT #17159] + +2255. [bug] L.ROOT-SERVERS.NET is now 199.7.83.42. + +2254. [bug] timer.c:dispatch() failed to lock timer->lock + when reading timer->idle allowing it to see + intermediate values as timer->idle was reset by + isc_timer_touch(). [RT #17243] + + --- 9.4.2rc1 released --- + +2251. [doc] Update memstatistics-file documentation to reflect + reality. Note there is behaviour change for BIND 9.5. + [RT #17113] + +2249. [bug] Only set Authentic Data bit if client requested + DNSSEC, per RFC 3655 [RT #17175] + +2248. [cleanup] Fix several errors reported by Coverity. [RT #17160] + +2245. [bug] Validating lack of DS records at trust anchors wasn't + working. [RT #17151] + +2238. [bug] It was possible to trigger a REQUIRE when a + validation was cancelled. [RT #17106] + +2237. [bug] libbind: res_init() was not thread aware. [RT #17123] + +2236. [bug] dnssec-signzone failed to preserve the case of + of wildcard owner names. [RT #17085] + +2235. [bug] <isc/atomic.h> was not being installed. [RT #17135] + +2234. [port] Correct some compiler warnings on SCO OSr5 [RT #17134] + +2232. [bug] dns_adb_findaddrinfo() could fail and return + ISC_R_SUCCESS. [RT #17137] + +2231. [bug] Building dlzbdb (contrib/dlz/bin/dlzbdb) was broken. + [RT #17088] + +2230. [bug] We could INSIST reading a corrupted journal. + [RT #17132] + +2228. [contrib] contrib: Change 2188 was incomplete. + +2227. [cleanup] Tidied up the FAQ. [RT #17121] + +2225. [bug] More support for systems with no IPv4 addresses. + [RT #17111] + +2224. [bug] Defer journal compaction if a xfrin is in progress. + [RT #17119] + +2223. [bug] Make a new journal when compacting. [RT #17119] + +2221. [bug] Set the event result code to reflect the actual + record returned to caller when a cache update is + rejected due to a more credible answer existing. + [RT #17017] + +2220. [bug] win32: Address a race condition in final shutdown of + the Windows socket code. [RT #17028] + +2219. [bug] Apply zone consistancy checks to additions, not + removals, when updating. [RT #17049] + +2218. [bug] Remove unnecessary REQUIRE from dns_validator_create(). + [RT #16976] + +2216. [cleanup] Fix a number of errors reported by Coverity. + [RT #17094] + +2215. [bug] Bad REQUIRE check isc_hmacsha1_verify(). [RT #17094] + +2214. [bug] Deregister OpenSSL lock callback when cleaning + up. Reorder OpenSSL cleanup so that RAND_cleanup() + is called before the locks are destroyed. [RT #17098] + +2213. [bug] SIG0 diagnostic failure messages were looking at the + wrong status code. [RT #17101] + +2212. [func] 'host -m' now causes memory statistics and active + memory to be printed at exit. [RT 17028] + +2210. [bug] Deleting class specific records via UPDATE could + fail. [RT #17074] + +2209. [port] osx: linking against user supplied static OpenSSL + libraries failed as the system ones were still being + found. [RT #17078] + +2208. [port] win32: make sure both build methods produce the + same output. [RT #17058] + +2207. [port] Some implementations of getaddrinfo() fail to set + ai_canonname correctly. [RT #17061] + + --- 9.4.2b1 released --- 2206. [security] "allow-query-cache" and "allow-recursion" now cross inherit from each other. @@ -16,12 +128,32 @@ [RT #16987] +2205. [bug] libbind: change #2119 broke thread support. [RT #16982] + 2203. [security] Query id generation was cryptographically weak. [RT # 16915] 2202. [security] The default acls for allow-query-cache and allow-recursion were not being applied. [RT #16960] +2200. [bug] The search for cached NSEC records was stopping to + early leading to excessive DLV queries. [RT #16930] + +2199. [bug] win32: don't call WSAStartup() while loading dlls. + [RT #16911] + +2198. [bug] win32: RegCloseKey() could be called when + RegOpenKeyEx() failed. [RT #16911] + +2197. [bug] Add INSIST to catch negative responses which are + not setting the event result code appropriately. + [RT #16909] + +2196. [port] win32: yield processor while waiting for once to + to complete. [RT #16958] + +2194. [bug] Close journal before calling 'done' in xfrin.c. + 2193. [port] win32: BINDInstall.exe is now linked statically. [RT #16906] @@ -29,6 +161,145 @@ Studio's redistributable dlls if building with Visual Stdio 2005 or later. +2189. [bug] Handle socket() returning EINTR. [RT #15949] + +2188. [contrib] queryperf: autoconf changes to make the search for + libresolv or libbind more robust. [RT #16299] + +2187. [bug] query_addds(), query_addwildcardproof() and + query_addnxrrsetnsec() should take a version + arguement. [RT #16368] + +2186. [port] cygwin: libbind: check for struct sockaddr_storage + independently of IPv6. [RT #16482] + +2185. [port] sunos: libbind: check for ssize_t, memmove() and + memchr(). [RT #16463] + +2183. [bug] dnssec-signzone didn't handle offline private keys + well. [RT #16832] + +2182. [bug] dns_dispatch_createtcp() and dispatch_createudp() + could return ISC_R_SUCCESS when they ran out of + memory. [RT #16365] + +2181. [port] sunos: libbind: add paths.h from BIND 8. [RT #16462] + +2180. [cleanup] Remove bit test from 'compress_test' as they + are no longer needed. [RT #16497] + +2178. [bug] 'rndc reload' of a slave or stub zone resulted in + a reference leak. [RT #16867] + +2177. [bug] Array bounds overrun on read (rcodetext) at + debug level 10+. [RT #16798] + +2176. [contrib] dbus update to handle race condition during + initialisation (Bugzilla 235809). [RT #16842] + +2175. [bug] win32: windows broadcast condition variable support + was broken. [RT #16592] + +2174. [bug] I/O errors should always be fatal when reading + master files. [RT #16825] + +2173. [port] win32: When compiling with MSVS 2005 SP1 we also + need to ship Microsoft.VC80.MFCLOC. + +2171. [bug] Handle breaks in DNSSEC trust chains where the parent + servers are not DS aware (DS queries to the parent + return a referral to the child). + +2170. [func] Add acache processing to test suite. [RT #16711] + +2169. [bug] host, nslookup: when reporting NXDOMAIN report the + given name and not the last name searched for. + [RT #16763] + +2168. [bug] nsupdate: in non-interactive mode treat syntax errors + as fatal errors. [RT #16785] + +2167. [bug] When re-using a automatic zone named failed to + attach it to the new view. [RT #16786] + +2166. [bug] When running in batch mode, dig could misinterpret + a server address as a name to be looked up, causing + unexpected output. [RT #16743] + +2164. [bug] The code to determine how named-checkzone / + named-compilezone was called failed under windows. + [RT #16764] + +2162. [func] Allow "rrset-order fixed" to be disabled at compile + time. [RT #16665] + +2161. [bug] 'rndc flush' could report a false success. [RT #16698] + +2160. [bug] libisc wasn't handling NULL ifa_addr pointers returned + from getifaddrs(). [RT #16708] + +2159. [bug] Array bounds overrun in acache processing. [RT #16710] + +2158. [bug] ns_client_isself() failed to initialise key + leading to a REQUIRE failure. [RT #16688] + +2156. [bug] Fix node reference leaks in lookup.c:lookup_find(), + resolver.c:validated() and resolver.c:cache_name(). + Fix a memory leak in rbtdb.c:free_noqname(). + Make lookup.c:lookup_find() robust against + event leaks. [RT #16685] + +2155. [contrib] SQLite sdb module from jaboydjr@netwalk.com. + [RT #16694] + +2153. [bug] nsupdate could leak memory. [RT #16691] + +2152. [cleanup] Use sizeof(buf) instead of fixed number in + dighost.c:get_trusted_key(). [RT #16678] + +2151. [bug] Missing newline in usage message for journalprint. + [RT #16679] + +2150. [bug] 'rrset-order cyclic' uniformly distribute the + starting point for the first response for a given + RRset. [RT #16655] + +2149. [bug] isc_mem_checkdestroyed() failed to abort on + if there were still active memory contexts. + [RT #16672] + +2147. [bug] libbind: remove potential buffer overflow from + hmac_link.c. [RT #16437] + +2146. [cleanup] Silence Linux's spurious "obsolete setsockopt + SO_BSDCOMPAT" message. [RT #16641] + +2145. [bug] Check DS/DLV digest lengths for known digests. + [RT #16622] + +2144. [cleanup] Suppress logging of SERVFAIL from forwarders. + [RT #16619] + +2143. [bug] We failed to restart the IPv6 client when the + kernel failed to return the destination the + packet was sent to. [RT #16613] + +2142. [bug] Handle master files with a modification time that + matches the epoch. [RT# 16612] + +2141. [bug] dig/host should not be setting IDN_ASCCHECK (IDN + equivalent of LDH checks). [RT #16609] + +2140. [bug] libbind: missing unlock on pthread_key_create() + failures. [RT #16654] + +2139. [bug] dns_view_find() was being called with wrong type + in adb.c. [RT #16670] + +2119. [compat] libbind: allow res_init() to succeed enough to + return the default domain even if it was unable + to allocate memory. + --- 9.4.1 released --- 2172. [bug] query_addsoa() was being called with a non zone db. @@ -524,7 +795,7 @@ hex strings with comments. [RT #15814] 1974. [doc] List each of the zone types and associated zone - options seperately in the ARM. + options separately in the ARM. 1973. [func] TSIG HMACSHA1, HMACSHA224, HMACSHA256, HMACSHA384 and HMACSHA512 support. [RT #13606] @@ -551,7 +822,7 @@ 1965. [func] Suppress spurious "recusion requested but not available" warning with 'dig +qr'. [RT #15780]. -1964. [func] Seperate out MX and SRV to CNAME checks. [RT #15723] +1964. [func] Separate out MX and SRV to CNAME checks. [RT #15723] 1963. [port] Tru64 4.0E doesn't support send() and recv(). [RT #15586] @@ -771,7 +1042,7 @@ 1898. [bug] Extend ISC_SOCKADDR_FORMATSIZE and ISC_NETADDR_FORMATSIZE to allow for scope details. -1897. [func] x86 and x86_64 now have seperate atomic locking +1897. [func] x86 and x86_64 now have separate atomic locking implementations. 1896. [bug] Recursive clients soft quota support wasn't working @@ -825,7 +1096,7 @@ [RT #14892] 1878. [func] Detect duplicates of UDP queries we are recursing on - and drop them. New stats category "duplicates". + and drop them. New stats category "duplicate". [RT #2471] 1877. [bug] Fix unreasonably low quantum on call to @@ -1769,7 +2040,7 @@ [RT #6427] 1555. [func] 'rrset-order cyclic' no longer has a random starting - point. [RT #7572] + point per query. [RT #7572] 1554. [bug] dig, host, nslookup failed when no nameservers were specified in /etc/resolv.conf. [RT #8232] @@ -6250,7 +6521,7 @@ and has been removed. 170. [cleanup] Remove inter server consistancy checks from zone, - these should return as a seperate module in 9.1. + these should return as a separate module in 9.1. dns_zone_checkservers(), dns_zone_checkparents(), dns_zone_checkchildren(), dns_zone_checkglue(). diff --git a/contrib/bind9/COPYRIGHT b/contrib/bind9/COPYRIGHT index 8f1c2af..48141e7 100644 --- a/contrib/bind9/COPYRIGHT +++ b/contrib/bind9/COPYRIGHT @@ -1,7 +1,7 @@ Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") Copyright (C) 1996-2003 Internet Software Consortium. -Permission to use, copy, modify, and distribute this software for any +Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies. @@ -13,7 +13,7 @@ LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -$Id: COPYRIGHT,v 1.9.18.3 2007/01/08 02:41:59 marka Exp $ +$Id: COPYRIGHT,v 1.9.18.4 2007/08/28 07:19:54 tbox Exp $ Portions Copyright (C) 1996-2001 Nominum, Inc. diff --git a/contrib/bind9/FAQ b/contrib/bind9/FAQ index af6c89a..90b3ca0 100644 --- a/contrib/bind9/FAQ +++ b/contrib/bind9/FAQ @@ -4,97 +4,71 @@ Copyright © 2004-2007 Internet Systems Consortium, Inc. ("ISC") Copyright © 2000-2003 Internet Software Consortium. -------------------------------------------------------------------------------- +----------------------------------------------------------------------- -Q: Why doesn't -u work on Linux 2.2.x when I build with --enable-threads? +1. Compilation and Installation Questions -A: Linux threads do not fully implement the Posix threads (pthreads) standard. In - particular, setuid() operates only on the current thread, not the full process. - Because of this limitation, BIND 9 cannot use setuid() on Linux as it can on - all other supported platforms. setuid() cannot be called before creating - threads, since the server does not start listening on reserved ports until - after threads have started. +Q: I'm trying to compile BIND 9, and "make" is failing due to files not + being found. Why? - In the 2.2.18 or 2.3.99-pre3 and newer kernels, the ability to preserve - capabilities across a setuid() call is present. This allows BIND 9 to call - setuid() early, while retaining the ability to bind reserved ports. This is a - Linux-specific hack. +A: Using a parallel or distributed "make" to build BIND 9 is not + supported, and doesn't work. If you are using one of these, use normal + make or gmake instead. - On a 2.2 kernel, BIND 9 does drop many root privileges, so it should be less of - a security risk than a root process that has not dropped privileges. +Q: Isn't "make install" supposed to generate a default named.conf? - If Linux threads ever work correctly, this restriction will go away. +A: Short Answer: No. - Configuring BIND9 with the --disable-threads option (the default) causes a - non-threaded version to be built, which will allow -u to be used. + Long Answer: There really isn't a default configuration which fits any + site perfectly. There are lots of decisions that need to be made and + there is no consensus on what the defaults should be. For example + FreeBSD uses /etc/namedb as the location where the configuration files + for named are stored. Others use /var/named. -Q: Why do I get the following errors: + What addresses to listen on? For a laptop on the move a lot you may + only want to listen on the loop back interfaces. - general: errno2result.c:109: unexpected error: - general: unable to convert errno to isc_result: 14: Bad address - client: UDP client handler shutting down due to fatal receive error: unexpected error + Who do you offer recursive service to? Is there are firewall to + consider? If so is it stateless or stateful. Are you directly on the + Internet? Are you on a private network? Are you on a NAT'd network? The + answers to all these questions change how you configure even a caching + name server. -A: This is the result of a Linux kernel bug. +2. Configuration and Setup Questions - See: http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=2 - -Q: Why does named log the warning message "no TTL specified - using SOA MINTTL - instead"? +Q: Why does named log the warning message "no TTL specified - using SOA + MINTTL instead"? -A: Your zone file is illegal according to RFC1035. It must either have a line - like: +A: Your zone file is illegal according to RFC1035. It must either have a + line like: $TTL 86400 - at the beginning, or the first record in it must have a TTL field, like the - "84600" in this example: + at the beginning, or the first record in it must have a TTL field, like + the "84600" in this example: example.com. 86400 IN SOA ns hostmaster ( 1 3600 1800 1814400 3600 ) -Q: Why do I see 5 (or more) copies of named on Linux? - -A: Linux threads each show up as a process under ps. The approximate number of - threads running is n+4, where n is the number of CPUs. Note that the amount of - memory used is not cumulative; if each process is using 10M of memory, only a - total of 10M is used. - - Newer versions of Linux's ps command hide the individual threads and require -L - to display them. - -Q: Why does BIND 9 log "permission denied" errors accessing its configuration - files or zones on my Linux system even though it is running as root? +Q: Why do I get errors like "dns_zone_load: zone foo/IN: loading master + file bar: ran out of space"? -A: On Linux, BIND 9 drops most of its root privileges on startup. This including - the privilege to open files owned by other users. Therefore, if the server is - running as root, the configuration files and zone files should also be owned by - root. - -Q: Why do I get errors like "dns_zone_load: zone foo/IN: loading master file bar: - ran out of space"? - -A: This is often caused by TXT records with missing close quotes. Check that all - TXT records containing quoted strings have both open and close quotes. - -Q: How do I produce a usable core file from a multi-threaded named on Linux? - -A: If the Linux kernel is 2.4.7 or newer, multi-threaded core dumps are usable - (that is, the correct thread is dumped). Otherwise, if using a 2.2 kernel, - apply the kernel patch found in contrib/linux/coredump-patch and rebuild the - kernel. This patch will cause multi-threaded programs to dump the correct - thread. +A: This is often caused by TXT records with missing close quotes. Check + that all TXT records containing quoted strings have both open and close + quotes. Q: How do I restrict people from looking up the server version? -A: Put a "version" option containing something other than the real version in the - "options" section of named.conf. Note doing this will not prevent attacks and - may impede people trying to diagnose problems with your server. Also it is - possible to "fingerprint" nameservers to determine their version. +A: Put a "version" option containing something other than the real version + in the "options" section of named.conf. Note doing this will not + prevent attacks and may impede people trying to diagnose problems with + your server. Also it is possible to "fingerprint" nameservers to + determine their version. Q: How do I restrict only remote users from looking up the server version? -A: The following view statement will intercept lookups as the internal view that - holds the version information will be matched last. The caveats of the previous - answer still apply, of course. +A: The following view statement will intercept lookups as the internal + view that holds the version information will be matched last. The + caveats of the previous answer still apply, of course. view "chaos" chaos { match-clients { <those to be refused>; }; @@ -105,120 +79,46 @@ A: The following view statement will intercept lookups as the internal view that }; }; -Q: What do "no source of entropy found" or "could not open entropy source foo" - mean? - -A: The server requires a source of entropy to perform certain operations, mostly - DNSSEC related. These messages indicate that you have no source of entropy. On - systems with /dev/random or an equivalent, it is used by default. A source of - entropy can also be defined using the random-device option in named.conf. +Q: What do "no source of entropy found" or "could not open entropy source + foo" mean? -Q: I installed BIND 9 and restarted named, but it's still BIND 8. Why? +A: The server requires a source of entropy to perform certain operations, + mostly DNSSEC related. These messages indicate that you have no source + of entropy. On systems with /dev/random or an equivalent, it is used by + default. A source of entropy can also be defined using the + random-device option in named.conf. -A: BIND 9 is installed under /usr/local by default. BIND 8 is often installed - under /usr. Check that the correct named is running. +Q: I'm trying to use TSIG to authenticate dynamic updates or zone + transfers. I'm sure I have the keys set up correctly, but the server is + rejecting the TSIG. Why? -Q: I'm trying to use TSIG to authenticate dynamic updates or zone transfers. I'm - sure I have the keys set up correctly, but the server is rejecting the TSIG. - Why? - -A: This may be a clock skew problem. Check that the the clocks on the client and - server are properly synchronised (e.g., using ntp). - -Q: I'm trying to compile BIND 9, and "make" is failing due to files not being - found. Why? - -A: Using a parallel or distributed "make" to build BIND 9 is not supported, and - doesn't work. If you are using one of these, use normal make or gmake instead. - -Q: I have a BIND 9 master and a BIND 8.2.3 slave, and the master is logging error - messages like "notify to 10.0.0.1#53 failed: unexpected end of input". What's - wrong? - -A: This error message is caused by a known bug in BIND 8.2.3 and is fixed in BIND - 8.2.4. It can be safely ignored - the notify has been acted on by the slave - despite the error message. - -Q: I keep getting log messages like the following. Why? - - Dec 4 23:47:59 client 10.0.0.1#1355: updating zone 'example.com/IN': update - failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET) - -A: DNS updates allow the update request to test to see if certain conditions are - met prior to proceeding with the update. The message above is saying that - conditions were not met and the update is not proceeding. See doc/rfc/ - rfc2136.txt for more details on prerequisites. - -Q: I keep getting log messages like the following. Why? - - Jun 21 12:00:00.000 client 10.0.0.1#1234: update denied - -A: Someone is trying to update your DNS data using the RFC2136 Dynamic Update - protocol. Windows 2000 machines have a habit of sending dynamic update requests - to DNS servers without being specifically configured to do so. If the update - requests are coming from a Windows 2000 machine, see http:// - support.microsoft.com/support/kb/articles/q246/8/04.asp for information about - how to turn them off. +A: This may be a clock skew problem. Check that the the clocks on the + client and server are properly synchronised (e.g., using ntp). Q: I see a log message like the following. Why? couldn't open pid file '/var/run/named.pid': Permission denied -A: You are most likely running named as a non-root user, and that user does not - have permission to write in /var/run. The common ways of fixing this are to - create a /var/run/named directory owned by the named user and set pid-file to " - /var/run/named/named.pid", or set pid-file to "named.pid", which will put the - file in the directory specified by the directory option (which, in this case, - must be writable by the named user). - -Q: When I do a "dig . ns", many of the A records for the root servers are missing. - Why? - -A: This is normal and harmless. It is a somewhat confusing side effect of the way - BIND 9 does RFC2181 trust ranking and of the efforts BIND 9 makes to avoid - promoting glue into answers. - - When BIND 9 first starts up and primes its cache, it receives the root server - addresses as additional data in an authoritative response from a root server, - and these records are eligible for inclusion as additional data in responses. - Subsequently it receives a subset of the root server addresses as additional - data in a non-authoritative (referral) response from a root server. This causes - the addresses to now be considered non-authoritative (glue) data, which is not - eligible for inclusion in responses. +A: You are most likely running named as a non-root user, and that user + does not have permission to write in /var/run. The common ways of + fixing this are to create a /var/run/named directory owned by the named + user and set pid-file to "/var/run/named/named.pid", or set pid-file to + "named.pid", which will put the file in the directory specified by the + directory option (which, in this case, must be writable by the named + user). - The server does have a complete set of root server addresses cached at all - times, it just may not include all of them as additional data, depending on - whether they were last received as answers or as glue. You can always look up - the addresses with explicit queries like "dig a.root-servers.net A". +Q: I can query the nameserver from the nameserver but not from other + machines. Why? -Q: Zone transfers from my BIND 9 master to my Windows 2000 slave fail. Why? +A: This is usually the result of the firewall configuration stopping the + queries and / or the replies. -A: This may be caused by a bug in the Windows 2000 DNS server where DNS messages - larger than 16K are not handled properly. This can be worked around by setting - the option "transfer-format one-answer;". Also check whether your zone contains - domain names with embedded spaces or other special characters, like "John\ - 032Doe\213s\032Computer", since such names have been known to cause Windows - 2000 slaves to incorrectly reject the zone. +Q: How can I make a server a slave for both an internal and an external + view at the same time? When I tried, both views on the slave were + transferred from the same view on the master. -Q: Why don't my zones reload when I do an "rndc reload" or SIGHUP? - -A: A zone can be updated either by editing zone files and reloading the server or - by dynamic update, but not both. If you have enabled dynamic update for a zone - using the "allow-update" option, you are not supposed to edit the zone file by - hand, and the server will not attempt to reload it. - -Q: I can query the nameserver from the nameserver but not from other machines. - Why? - -A: This is usually the result of the firewall configuration stopping the queries - and / or the replies. - -Q: How can I make a server a slave for both an internal and an external view at - the same time? When I tried, both views on the slave were transferred from the - same view on the master. - -A: You will need to give the master and slave multiple IP addresses and use those - to make sure you reach the correct view on the other machine. +A: You will need to give the master and slave multiple IP addresses and + use those to make sure you reach the correct view on the other machine. Master: 10.0.1.1 (internal), 10.0.1.2 (external, IP alias) internal: @@ -246,8 +146,8 @@ A: You will need to give the master and slave multiple IP addresses and use thos transfer-source 10.0.1.4; query-source address 10.0.1.4; - You put the external address on the alias so that all the other dns clients on - these boxes see the internal view by default. + You put the external address on the alias so that all the other dns + clients on these boxes see the internal view by default. A: BIND 9.3 and later: Use TSIG to select the appropriate view. @@ -283,64 +183,38 @@ A: BIND 9.3 and later: Use TSIG to select the appropriate view. ... }; -Q: I have FreeBSD 4.x and "rndc-confgen -a" just sits there. - -A: /dev/random is not configured. Use rndcontrol(8) to tell the kernel to use - certain interrupts as a source of random events. You can make this permanent by - setting rand_irqs in /etc/rc.conf. - - /etc/rc.conf - rand_irqs="3 14 15" - - See also http://people.freebsd.org/~dougb/randomness.html - -Q: Why is named listening on UDP port other than 53? - -A: Named uses a system selected port to make queries of other nameservers. This - behaviour can be overridden by using query-source to lock down the port and/or - address. See also notify-source and transfer-source. +Q: I get error messages like "multiple RRs of singleton type" and "CNAME + and other data" when transferring a zone. What does this mean? -Q: I get error messages like "multiple RRs of singleton type" and "CNAME and other - data" when transferring a zone. What does this mean? - -A: These indicate a malformed master zone. You can identify the exact records - involved by transferring the zone using dig then running named-checkzone on it. +A: These indicate a malformed master zone. You can identify the exact + records involved by transferring the zone using dig then running + named-checkzone on it. dig axfr example.com @master-server > tmp named-checkzone example.com tmp - A CNAME record cannot exist with the same name as another record except for the - DNSSEC records which prove its existence (NSEC). - - RFC 1034, Section 3.6.2: "If a CNAME RR is present at a node, no other data - should be present; this ensures that the data for a canonical name and its - aliases cannot be different. This rule also insures that a cached CNAME can be - used without checking with an authoritative server for other RR types." - -Q: I get error messages like "named.conf:99: unexpected end of input" where 99 is - the last line of named.conf. + A CNAME record cannot exist with the same name as another record except + for the DNSSEC records which prove its existence (NSEC). -A: Some text editors (notepad and wordpad) fail to put a line title indication - (e.g. CR/LF) on the last line of a text file. This can be fixed by "adding" a - blank line to the end of the file. Named expects to see EOF immediately after - EOL and treats text files where this is not met as truncated. + RFC 1034, Section 3.6.2: "If a CNAME RR is present at a node, no other + data should be present; this ensures that the data for a canonical name + and its aliases cannot be different. This rule also insures that a + cached CNAME can be used without checking with an authoritative server + for other RR types." -Q: I get warning messages like "zone example.com/IN: refresh: failure trying - master 1.2.3.4#53: timed out". +Q: I get error messages like "named.conf:99: unexpected end of input" + where 99 is the last line of named.conf. -A: Check that you can make UDP queries from the slave to the master - - dig +norec example.com soa @1.2.3.4 - - You could be generating queries faster than the slave can cope with. Lower the - serial query rate. - - serial-query-rate 5; // default 20 +A: Some text editors (notepad and wordpad) fail to put a line title + indication (e.g. CR/LF) on the last line of a text file. This can be + fixed by "adding" a blank line to the end of the file. Named expects to + see EOF immediately after EOL and treats text files where this is not + met as truncated. Q: How do I share a dynamic zone between multiple views? -A: You choose one view to be master and the second a slave and transfer the zone - between views. +A: You choose one view to be master and the second a slave and transfer + the zone between views. Master 10.0.1.1: key "external" { @@ -354,7 +228,7 @@ A: You choose one view to be master and the second a slave and transfer the zone }; view "internal" { - match-clients { !external; 10.0.1/24; }; + match-clients { !key external; 10.0.1/24; }; server 10.0.1.1 { /* Deliver notify messages to external view. */ keys { external; }; @@ -368,7 +242,7 @@ A: You choose one view to be master and the second a slave and transfer the zone }; view "external" { - match-clients { external; any; }; + match-clients { key external; any; }; zone "example.com" { type slave; file "external/example.db"; @@ -379,18 +253,19 @@ A: You choose one view to be master and the second a slave and transfer the zone }; }; -Q: I get a error message like "zone wireless.ietf56.ietf.org/IN: loading master - file primaries/wireless.ietf56.ietf.org: no owner". +Q: I get a error message like "zone wireless.ietf56.ietf.org/IN: loading + master file primaries/wireless.ietf56.ietf.org: no owner". -A: This error is produced when a line in the master file contains leading white - space (tab/space) but the is no current record owner name to inherit the name - from. Usually this is the result of putting white space before a comment. - Forgetting the "@" for the SOA record or indenting the master file. +A: This error is produced when a line in the master file contains leading + white space (tab/space) but the is no current record owner name to + inherit the name from. Usually this is the result of putting white + space before a comment, forgetting the "@" for the SOA record, or + indenting the master file. Q: Why are my logs in GMT (UTC). -A: You are running chrooted (-t) and have not supplied local timezone information - in the chroot area. +A: You are running chrooted (-t) and have not supplied local timezone + information in the chroot area. FreeBSD: /etc/localtime Solaris: /etc/TIMEZONE and /usr/share/lib/zoneinfo @@ -398,71 +273,51 @@ A: You are running chrooted (-t) and have not supplied local timezone informatio See also tzset(3) and zic(8). -Q: I get the error message "named: capset failed: Operation not permitted" when - starting named. - -A: The capability module, part of "Linux Security Modules/LSM", has not been - loaded into the kernel. See insmod(8). - -Q: I get "rndc: connect failed: connection refused" when I try to run rndc. +Q: I get "rndc: connect failed: connection refused" when I try to run + rndc. A: This is usually a configuration error. - First ensure that named is running and no errors are being reported at startup - (/var/log/messages or equivalent). Running "named -g <usual arguments>" from a - title can help at this point. + First ensure that named is running and no errors are being reported at + startup (/var/log/messages or equivalent). Running "named -g <usual + arguments>" from a title can help at this point. - Secondly ensure that named is configured to use rndc either by "rndc-confgen - -a", rndc-confgen or manually. The Administrators Reference manual has details - on how to do this. + Secondly ensure that named is configured to use rndc either by + "rndc-confgen -a", rndc-confgen or manually. The Administrators + Reference manual has details on how to do this. - Old versions of rndc-confgen used localhost rather than 127.0.0.1 in /etc/ - rndc.conf for the default server. Update /etc/rndc.conf if necessary so that - the default server listed in /etc/rndc.conf matches the addresses used in - named.conf. "localhost" has two address (127.0.0.1 and ::1). + Old versions of rndc-confgen used localhost rather than 127.0.0.1 in / + etc/rndc.conf for the default server. Update /etc/rndc.conf if + necessary so that the default server listed in /etc/rndc.conf matches + the addresses used in named.conf. "localhost" has two address + (127.0.0.1 and ::1). - If you use "rndc-confgen -a" and named is running with -t or -u ensure that / - etc/rndc.conf has the correct ownership and that a copy is in the chroot area. - You can do this by re-running "rndc-confgen -a" with appropriate -t and -u - arguments. - -Q: I don't get RRSIG's returned when I use "dig +dnssec". - -A: You need to ensure DNSSEC is enabled (dnssec-enable yes;). - -Q: I get "Error 1067" when starting named under Windows. - -A: This is the service manager saying that named exited. You need to examine the - Application log in the EventViewer to find out why. - - Common causes are that you failed to create "named.conf" (usually "C:\windows\ - dns\etc\named.conf") or failed to specify the directory in named.conf. - - options { - Directory "C:\windows\dns\etc"; - }; + If you use "rndc-confgen -a" and named is running with -t or -u ensure + that /etc/rndc.conf has the correct ownership and that a copy is in the + chroot area. You can do this by re-running "rndc-confgen -a" with + appropriate -t and -u arguments. Q: I get "transfer of 'example.net/IN' from 192.168.4.12#53: failed while receiving responses: permission denied" error messages. -A: These indicate a filesystem permission error preventing named creating / - renaming the temporary file. These will usually also have other associated - error messages like +A: These indicate a filesystem permission error preventing named creating + / renaming the temporary file. These will usually also have other + associated error messages like "dumping master file: sl/tmp-XXXX5il3sQ: open: permission denied" - Named needs write permission on the directory containing the file. Named writes - the new cache file to a temporary file then renames it to the name specified in - named.conf to ensure that the contents are always complete. This is to prevent - named loading a partial zone in the event of power failure or similar - interrupting the write of the master file. + Named needs write permission on the directory containing the file. + Named writes the new cache file to a temporary file then renames it to + the name specified in named.conf to ensure that the contents are always + complete. This is to prevent named loading a partial zone in the event + of power failure or similar interrupting the write of the master file. - Note file names are relative to the directory specified in options and any - chroot directory ([<chroot dir>/][<options dir>]). + Note file names are relative to the directory specified in options and + any chroot directory ([<chroot dir>/][<options dir>]). - If named is invoked as "named -t /chroot/DNS" with the following named.conf - then "/chroot/DNS/var/named/sl" needs to be writable by the user named is - running as. + If named is invoked as "named -t /chroot/DNS" with the following + named.conf then "/chroot/DNS/var/named/sl" needs to be writable by the + user named is running as. options { directory "/var/named"; @@ -474,35 +329,153 @@ A: These indicate a filesystem permission error preventing named creating / masters { 192.168.4.12; }; }; -Q: How do I integrate BIND 9 and Solaris SMF +Q: I want to forward all DNS queries from my caching nameserver to another + server. But there are some domains which have to be served locally, via + rbldnsd. -A: Sun has a blog entry describing how to do this. + How do I achieve this ? - http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris +A: options { + forward only; + forwarders { <ip.of.primary.nameserver>; }; + }; + + zone "sbl-xbl.spamhaus.org" { + type forward; forward only; + forwarders { <ip.of.rbldns.server> port 530; }; + }; + + zone "list.dsbl.org" { + type forward; forward only; + forwarders { <ip.of.rbldns.server> port 530; }; + }; + + +Q: Can you help me understand how BIND 9 uses memory to store DNS zones? + + Some times it seems to take several times the amount of memory it needs + to store the zone. + +A: When reloading a zone named my have multiple copies of the zone in + memory at one time. The zone it is serving and the one it is loading. + If reloads are ultra fast it can have more still. + + e.g. Ones that are transferring out, the one that it is serving and the + one that is loading. + + BIND 8 destroyed the zone before loading and also killed off outgoing + transfers of the zone. + + The new strategy allows slaves to get copies of the new zone regardless + of how often the master is loaded compared to the transfer time. The + slave might skip some intermediate versions but the transfers will + complete and it will keep reasonably in sync with the master. + + The new strategy also allows the master to recover from syntax and + other errors in the master file as it still has an in-core copy of the + old contents. + +3. General Questions + +Q: I keep getting log messages like the following. Why? + + Dec 4 23:47:59 client 10.0.0.1#1355: updating zone 'example.com/IN': + update failed: 'RRset exists (value dependent)' prerequisite not + satisfied (NXRRSET) + +A: DNS updates allow the update request to test to see if certain + conditions are met prior to proceeding with the update. The message + above is saying that conditions were not met and the update is not + proceeding. See doc/rfc/rfc2136.txt for more details on prerequisites. + +Q: I keep getting log messages like the following. Why? + + Jun 21 12:00:00.000 client 10.0.0.1#1234: update denied + +A: Someone is trying to update your DNS data using the RFC2136 Dynamic + Update protocol. Windows 2000 machines have a habit of sending dynamic + update requests to DNS servers without being specifically configured to + do so. If the update requests are coming from a Windows 2000 machine, + see http://support.microsoft.com/support/kb/articles/q246/8/04.asp for + information about how to turn them off. + +Q: When I do a "dig . ns", many of the A records for the root servers are + missing. Why? + +A: This is normal and harmless. It is a somewhat confusing side effect of + the way BIND 9 does RFC2181 trust ranking and of the efforts BIND 9 + makes to avoid promoting glue into answers. + + When BIND 9 first starts up and primes its cache, it receives the root + server addresses as additional data in an authoritative response from a + root server, and these records are eligible for inclusion as additional + data in responses. Subsequently it receives a subset of the root server + addresses as additional data in a non-authoritative (referral) response + from a root server. This causes the addresses to now be considered + non-authoritative (glue) data, which is not eligible for inclusion in + responses. + + The server does have a complete set of root server addresses cached at + all times, it just may not include all of them as additional data, + depending on whether they were last received as answers or as glue. You + can always look up the addresses with explicit queries like "dig + a.root-servers.net A". + +Q: Why don't my zones reload when I do an "rndc reload" or SIGHUP? + +A: A zone can be updated either by editing zone files and reloading the + server or by dynamic update, but not both. If you have enabled dynamic + update for a zone using the "allow-update" option, you are not supposed + to edit the zone file by hand, and the server will not attempt to + reload it. + +Q: Why is named listening on UDP port other than 53? + +A: Named uses a system selected port to make queries of other nameservers. + This behaviour can be overridden by using query-source to lock down the + port and/or address. See also notify-source and transfer-source. + +Q: I get warning messages like "zone example.com/IN: refresh: failure + trying master 1.2.3.4#53: timed out". + +A: Check that you can make UDP queries from the slave to the master + + dig +norec example.com soa @1.2.3.4 + + You could be generating queries faster than the slave can cope with. + Lower the serial query rate. + + serial-query-rate 5; // default 20 + +Q: I don't get RRSIG's returned when I use "dig +dnssec". + +A: You need to ensure DNSSEC is enabled (dnssec-enable yes;). Q: Can a NS record refer to a CNAME. -A: No. The rules for glue (copies of the *address* records in the parent zones) - and additional section processing do not allow it to work. +A: No. The rules for glue (copies of the *address* records in the parent + zones) and additional section processing do not allow it to work. - You would have to add both the CNAME and address records (A/AAAA) as glue to - the parent zone and have CNAMEs be followed when doing additional section - processing to make it work. No nameserver implementation supports either of - these requirements. + You would have to add both the CNAME and address records (A/AAAA) as + glue to the parent zone and have CNAMEs be followed when doing + additional section processing to make it work. No nameserver + implementation supports either of these requirements. -Q: What does "RFC 1918 response from Internet for 0.0.0.10.IN-ADDR.ARPA" mean? +Q: What does "RFC 1918 response from Internet for 0.0.0.10.IN-ADDR.ARPA" + mean? -A: If the IN-ADDR.ARPA name covered refers to a internal address space you are - using then you have failed to follow RFC 1918 usage rules and are leaking - queries to the Internet. You should establish your own zones for these - addresses to prevent you querying the Internet's name servers for these - addresses. Please see http://as112.net/ for details of the problems you are - causing and the counter measures that have had to be deployed. +A: If the IN-ADDR.ARPA name covered refers to a internal address space you + are using then you have failed to follow RFC 1918 usage rules and are + leaking queries to the Internet. You should establish your own zones + for these addresses to prevent you querying the Internet's name servers + for these addresses. Please see http://as112.net/ for details of the + problems you are causing and the counter measures that have had to be + deployed. - If you are not using these private addresses then a client has queried for - them. You can just ignore the messages, get the offending client to stop - sending you these messages as they are most probably leaking them or setup your - own zones empty zones to serve answers to these queries. + If you are not using these private addresses then a client has queried + for them. You can just ignore the messages, get the offending client to + stop sending you these messages as they are most probably leaking them + or setup your own zones empty zones to serve answers to these queries. zone "10.IN-ADDR.ARPA" { type master; @@ -535,42 +508,133 @@ A: If the IN-ADDR.ARPA name covered refers to a internal address space you are Future versions of named are likely to do this automatically. +Q: Will named be affected by the 2007 changes to daylight savings rules in + the US. + +A: No, so long as the machines internal clock (as reported by "date -u") + remains at UTC. The only visible change if you fail to upgrade your OS, + if you are in a affected area, will be that log messages will be a hour + out during the period where the old rules do not match the new rules. + + For most OS's this change just means that you need to update the + conversion rules from UTC to local time. Normally this involves + updating a file in /etc (which sets the default timezone for the + machine) and possibly a directory which has all the conversion rules + for the world (e.g. /usr/share/zoneinfo). When updating the OS do not + forget to update any chroot areas as well. See your OS's documentation + for more details. + + The local timezone conversion rules can also be done on a individual + basis by setting the TZ environment variable appropriately. See your + OS's documentation for more details. + +Q: Is there a bugzilla (or other tool) database that mere mortals can have + (read-only) access to for bind? + +A: No. The BIND 9 bug database is kept closed for a number of reasons. + These include, but are not limited to, that the database contains + proprietory information from people reporting bugs. The database has in + the past and may in future contain unfixed bugs which are capable of + bringing down most of the Internet's DNS infrastructure. + + The release pages for each version contain up to date lists of bugs + that have been fixed post release. That is as close as we can get to + providing a bug database. + +4. Operating-System Specific Questions + +4.1. HPUX + +Q: I get the following error trying to configure BIND: + + checking if unistd.h or sys/types.h defines fd_set... no + configure: error: need either working unistd.h or sys/select.h + +A: You have attempted to configure BIND with the bundled C compiler. This + compiler does not meet the minimum compiler requirements to for + building BIND. You need to install a ANSI C compiler and / or teach + configure how to find the ANSI C compiler. The later can be done by + adjusting the PATH environment variable and / or specifying the + compiler via CC. + + ./configure CC=<compiler> ... + +4.2. Linux + +Q: Why do I get the following errors: + + general: errno2result.c:109: unexpected error: + general: unable to convert errno to isc_result: 14: Bad address + client: UDP client handler shutting down due to fatal receive error: unexpected error + +A: This is the result of a Linux kernel bug. + + See: http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=2 + +Q: Why do I see 5 (or more) copies of named on Linux? + +A: Linux threads each show up as a process under ps. The approximate + number of threads running is n+4, where n is the number of CPUs. Note + that the amount of memory used is not cumulative; if each process is + using 10M of memory, only a total of 10M is used. + + Newer versions of Linux's ps command hide the individual threads and + require -L to display them. + +Q: Why does BIND 9 log "permission denied" errors accessing its + configuration files or zones on my Linux system even though it is + running as root? + +A: On Linux, BIND 9 drops most of its root privileges on startup. This + including the privilege to open files owned by other users. Therefore, + if the server is running as root, the configuration files and zone + files should also be owned by root. + +Q: I get the error message "named: capset failed: Operation not permitted" + when starting named. + +A: The capability module, part of "Linux Security Modules/LSM", has not + been loaded into the kernel. See insmod(8). + Q: I'm running BIND on Red Hat Enterprise Linux or Fedora Core - Why can't named update slave zone database files? - Why can't named create DDNS journal files or update the master zones from - journals? + Why can't named create DDNS journal files or update the master zones + from journals? Why can't named create custom log files? A: Red Hat Security Enhanced Linux (SELinux) policy security protections : - Red Hat have adopted the National Security Agency's SELinux security policy ( - see http://www.nsa.gov/selinux ) and recommendations for BIND security , which - are more secure than running named in a chroot and make use of the bind-chroot - environment unnecessary . + Red Hat have adopted the National Security Agency's SELinux security + policy ( see http://www.nsa.gov/selinux ) and recommendations for BIND + security , which are more secure than running named in a chroot and + make use of the bind-chroot environment unnecessary . - By default, named is not allowed by the SELinux policy to write, create or - delete any files EXCEPT in these directories: + By default, named is not allowed by the SELinux policy to write, create + or delete any files EXCEPT in these directories: $ROOTDIR/var/named/slaves $ROOTDIR/var/named/data $ROOTDIR/var/tmp - where $ROOTDIR may be set in /etc/sysconfig/named if bind-chroot is installed. + where $ROOTDIR may be set in /etc/sysconfig/named if bind-chroot is + installed. - The SELinux policy particularly does NOT allow named to modify the $ROOTDIR/var - /named directory, the default location for master zone database files. + The SELinux policy particularly does NOT allow named to modify the + $ROOTDIR/var/named directory, the default location for master zone + database files. - SELinux policy overrules file access permissions - so even if all the files - under /var/named have ownership named:named and mode rw-rw-r--, named will - still not be able to write or create files except in the directories above, - with SELinux in Enforcing mode. + SELinux policy overrules file access permissions - so even if all the + files under /var/named have ownership named:named and mode rw-rw-r--, + named will still not be able to write or create files except in the + directories above, with SELinux in Enforcing mode. - So, to allow named to update slave or DDNS zone files, it is best to locate - them in $ROOTDIR/var/named/slaves, with named.conf zone statements such as: + So, to allow named to update slave or DDNS zone files, it is best to + locate them in $ROOTDIR/var/named/slaves, with named.conf zone + statements such as: zone "slave.zone." IN { type slave; @@ -584,8 +648,8 @@ A: Red Hat Security Enhanced Linux (SELinux) policy security protections : }; - To allow named to create its cache dump and statistics files, for example, you - could use named.conf options statements such as: + To allow named to create its cache dump and statistics files, for + example, you could use named.conf options statements such as: options { ... @@ -595,10 +659,11 @@ A: Red Hat Security Enhanced Linux (SELinux) policy security protections : }; - You can also tell SELinux to allow named to update any zone database files, by - setting the SELinux tunable boolean parameter 'named_write_master_zones=1', - using the system-config-securitylevel GUI, using the 'setsebool' command, or in - /etc/selinux/targeted/booleans. + You can also tell SELinux to allow named to update any zone database + files, by setting the SELinux tunable boolean parameter + 'named_write_master_zones=1', using the system-config-securitylevel + GUI, using the 'setsebool' command, or in /etc/selinux/targeted/ + booleans. You can disable SELinux protection for named entirely by setting the 'named_disable_trans=1' SELinux tunable boolean parameter. @@ -610,18 +675,18 @@ A: Red Hat Security Enhanced Linux (SELinux) policy security protections : named_cache_t: for files modifiable by named - $ROOTDIR/var/{tmp,named/{slaves,data}} - If you want to retain use of the SELinux policy for named, and put named files - in different locations, you can do so by changing the context of the custom - file locations . + If you want to retain use of the SELinux policy for named, and put + named files in different locations, you can do so by changing the + context of the custom file locations . - To create a custom configuration file location, e.g. '/root/named.conf', to use - with the 'named -c' option, do: + To create a custom configuration file location, e.g. '/root/ + named.conf', to use with the 'named -c' option, do: # chcon system_u:object_r:named_conf_t /root/named.conf - To create a custom modifiable named data location, e.g. '/var/log/named' for a - log file, do: + To create a custom modifiable named data location, e.g. '/var/log/ + named' for a log file, do: # chcon system_u:object_r:named_cache_t /var/log/named @@ -631,91 +696,86 @@ A: Red Hat Security Enhanced Linux (SELinux) policy security protections : # chcon system_u:object_r:named_zone_t /root/zones/{.,*} - See these man-pages for more information : selinux(8), named_selinux(8), chcon - (1), setsebool(8) + See these man-pages for more information : selinux(8), named_selinux + (8), chcon(1), setsebool(8) -Q: I want to forward all DNS queries from my caching nameserver to another server. - But there are some domains which have to be served locally, via rbldnsd. +4.3. Windows - How do I achieve this ? +Q: Zone transfers from my BIND 9 master to my Windows 2000 slave fail. + Why? -A: options { - forward only; - forwarders { <ip.of.primary.nameserver>; }; - }; +A: This may be caused by a bug in the Windows 2000 DNS server where DNS + messages larger than 16K are not handled properly. This can be worked + around by setting the option "transfer-format one-answer;". Also check + whether your zone contains domain names with embedded spaces or other + special characters, like "John\032Doe\213s\032Computer", since such + names have been known to cause Windows 2000 slaves to incorrectly + reject the zone. - zone "sbl-xbl.spamhaus.org" { - type forward; forward only; - forwarders { <ip.of.rbldns.server> port 530; }; - }; +Q: I get "Error 1067" when starting named under Windows. - zone "list.dsbl.org" { - type forward; forward only; - forwarders { <ip.of.rbldns.server> port 530; }; +A: This is the service manager saying that named exited. You need to + examine the Application log in the EventViewer to find out why. + + Common causes are that you failed to create "named.conf" (usually "C:\ + windows\dns\etc\named.conf") or failed to specify the directory in + named.conf. + + options { + Directory "C:\windows\dns\etc"; }; +4.4. FreeBSD -Q: Will named be affected by the 2007 changes to daylight savings rules in the US. +Q: I have FreeBSD 4.x and "rndc-confgen -a" just sits there. -A: No, so long as the machines internal clock (as reported by "date -u") remains - at UTC. The only visible change if you fail to upgrade your OS, if you are in a - affected area, will be that log messages will be a hour out during the period - where the old rules do not match the new rules. +A: /dev/random is not configured. Use rndcontrol(8) to tell the kernel to + use certain interrupts as a source of random events. You can make this + permanent by setting rand_irqs in /etc/rc.conf. - For most OS's this change just means that you need to update the conversion - rules from UTC to local time. Normally this involves updating a file in /etc - (which sets the default timezone for the machine) and possibly a directory - which has all the conversion rules for the world (e.g. /usr/share/zoneinfo). - When updating the OS do not forget to update any chroot areas as well. See your - OS's documentation for more details. + /etc/rc.conf + rand_irqs="3 14 15" - The local timezone conversion rules can also be done on a individual basis by - setting the TZ environment variable appropriately. See your OS's documentation - for more details. + See also http://people.freebsd.org/~dougb/randomness.html -Q: Why do we get the following warning at run time: +4.5. Solaris - kernel: process `named' is using obsolete setsockopt SO_BSDCOMPAT +Q: How do I integrate BIND 9 and Solaris SMF -A: The early Linux kernels broke sendto() by having it return that a ICMP - unreachable had be received for non connected UDP sockets. This made non - connected UDP sockets work like connected UDP socket which is fine when you are - only talking to one destination. Named however talks to multiple destinations - and it caused problems. +A: Sun has a blog entry describing how to do this. - Rather than fix sendto() to just have BSD behaviour they added SO_BSDCOMPAT to - turn BSD behaviour on/off on a per socket basis. + http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris - Later they decided to make BSD behaviour the default and to aggressively track - down applications that used SO_BSDCOMPAT by issuing a warning. This is the sort - of things vendors do in alpha/beta stages of a release so that their code is - clean. They then turn the warning *off* for release code. +4.6. Apple Mac OS X - We still have customers that have kernels that require SO_BSDCOMPAT to operate. - We therefore cannot remove the setsockopt(SO_BSDCOMPAT) call. +Q: How do I run BIND 9 on Apple Mac OS X? - Now most/all portable applications that use SO_BSDCOMPAT use it conditionally - manner so just removing SO_BSDCOMPAT from the header file would be safe as long - as the binary was not to be moved between systems. BIND's use is conditional. +A: If you run Tiger(Mac OS 10.4) or later then this is all you need to do: - In short, the Linux developers should either, remove the #define for - SO_BSDCOMPAT, and/or remove the warning. + % sudo rndc-confgen > /etc/rndc.conf -Q: Isn't "make install" supposed to generate a default named.conf? + Copy the key statement from /etc/rndc.conf into /etc/rndc.key, e.g.: -A: Short Answer: No. + key "rndc-key" { + algorithm hmac-md5; + secret "uvceheVuqf17ZwIcTydddw=="; + }; + + Then start the relevant service: + + % sudo service org.isc.named start + + This is persistent upon a reboot, so you will have to do it only once. + +A: Alternatively you can just generate /etc/rndc.key by running: + + % sudo rndc-confgen -a - Long Answer: There really isn't a default configuration which fits any site - perfectly. There are lots of decisions that need to be made and there is no - consensus on what the defaults should be. For example FreeBSD uses /etc/namedb - as the location where the configuration files for named are stored. Others use - /var/named. + Then start the relevant service: - What addresses to listen on? For a laptop on the move a lot you may only want - to listen on the loop back interfaces. + % sudo service org.isc.named start - Who do you offer recursive service to? Is there are firewall to consider? If so - is it stateless or stateful. Are you directly on the Internet? Are you on a - private network? Are you on a NAT'd network? The answers to all these questions - change how you configure even a caching name server. + Named will look for /etc/rndc.key when it starts if it doesn't have a + controls section or the existing controls are missing keys sub-clauses. + This is persistent upon a reboot, so you will have to do it only once. diff --git a/contrib/bind9/FAQ.xml b/contrib/bind9/FAQ.xml index 4e11b84..0f864ef 100644 --- a/contrib/bind9/FAQ.xml +++ b/contrib/bind9/FAQ.xml @@ -1,11 +1,10 @@ -<?xml-stylesheet href="common.css" type="text/css"?> <!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN" "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" []> <!-- - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000-2003 Internet Software Consortium. - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -18,7 +17,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: FAQ.xml,v 1.4.4.8 2007/02/05 05:23:39 marka Exp $ --> +<!-- $Id: FAQ.xml,v 1.4.4.16 2007/10/31 02:14:07 marka Exp $ --> <article class="faq"> <title>Frequently Asked Questions about BIND 9</title> @@ -39,69 +38,63 @@ </copyright> </articleinfo> <qandaset defaultlabel='qanda'> + + <qandadiv><title>Compilation and Installation Questions</title> + <qandaentry> <question> <para> - Why doesn't -u work on Linux 2.2.x when I build with - --enable-threads? + I'm trying to compile BIND 9, and "make" is failing due to + files not being found. Why? </para> </question> <answer> <para> - Linux threads do not fully implement the Posix threads - (pthreads) standard. In particular, setuid() operates only - on the current thread, not the full process. Because of - this limitation, BIND 9 cannot use setuid() on Linux as it - can on all other supported platforms. setuid() cannot be - called before creating threads, since the server does not - start listening on reserved ports until after threads have - started. - </para> - <para> - In the 2.2.18 or 2.3.99-pre3 and newer kernels, the ability - to preserve capabilities across a setuid() call is present. - This allows BIND 9 to call setuid() early, while retaining - the ability to bind reserved ports. This is a Linux-specific - hack. - </para> - <para> - On a 2.2 kernel, BIND 9 does drop many root privileges, so - it should be less of a security risk than a root process - that has not dropped privileges. - </para> - <para> - If Linux threads ever work correctly, this restriction will - go away. - </para> - <para> - Configuring BIND9 with the --disable-threads option (the - default) causes a non-threaded version to be built, which - will allow -u to be used. + Using a parallel or distributed "make" to build BIND 9 is + not supported, and doesn't work. If you are using one of + these, use normal make or gmake instead. </para> </answer> </qandaentry> - + <qandaentry> <question> <para> - Why do I get the following errors: -<programlisting>general: errno2result.c:109: unexpected error: -general: unable to convert errno to isc_result: 14: Bad address -client: UDP client handler shutting down due to fatal receive error: unexpected error</programlisting> + Isn't "make install" supposed to generate a default named.conf? </para> </question> <answer> <para> - This is the result of a Linux kernel bug. + Short Answer: No. </para> <para> - See: - <ulink url="http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=2">http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=2</ulink> + Long Answer: There really isn't a default configuration which fits + any site perfectly. There are lots of decisions that need to + be made and there is no consensus on what the defaults should be. + For example FreeBSD uses /etc/namedb as the location where the + configuration files for named are stored. Others use /var/named. + </para> + <para> + What addresses to listen on? For a laptop on the move a lot + you may only want to listen on the loop back interfaces. + </para> + <para> + Who do you offer recursive service to? Is there are firewall + to consider? If so is it stateless or stateful. Are you + directly on the Internet? Are you on a private network? Are + you on a NAT'd network? The answers + to all these questions change how you configure even a + caching name server. </para> </answer> </qandaentry> + + </qandadiv> <!-- Compilation and Installation Questions --> + + <qandadiv><title>Configuration and Setup Questions</title> <qandaentry> + <!-- configuration, log --> <question> <para> Why does named log the warning message <quote>no TTL specified - @@ -127,48 +120,9 @@ example.com. 86400 IN SOA ns hostmaster ( 1 3600 1800 1814400 3600 )</programlis </informalexample> </answer> </qandaentry> - - <qandaentry> - <question> - <para> - Why do I see 5 (or more) copies of named on Linux? - </para> - </question> - <answer> - <para> - Linux threads each show up as a process under ps. The - approximate number of threads running is n+4, where n is - the number of CPUs. Note that the amount of memory used - is not cumulative; if each process is using 10M of memory, - only a total of 10M is used. - </para> - <para> - Newer versions of Linux's ps command hide the individual threads - and require -L to display them. - </para> - </answer> - </qandaentry> - - <qandaentry> - <question> - <para> - Why does BIND 9 log <quote>permission denied</quote> errors accessing - its configuration files or zones on my Linux system even - though it is running as root? - </para> - </question> - <answer> - <para> - On Linux, BIND 9 drops most of its root privileges on - startup. This including the privilege to open files owned - by other users. Therefore, if the server is running as - root, the configuration files and zone files should also - be owned by root. - </para> - </answer> - </qandaentry> - + <qandaentry> + <!-- configuration --> <question> <para> Why do I get errors like <quote>dns_zone_load: zone foo/IN: loading @@ -185,25 +139,7 @@ example.com. 86400 IN SOA ns hostmaster ( 1 3600 1800 1814400 3600 )</programlis </qandaentry> <qandaentry> - <question> - <para> - How do I produce a usable core file from a multi-threaded - named on Linux? - </para> - </question> - <answer> - <para> - If the Linux kernel is 2.4.7 or newer, multi-threaded core - dumps are usable (that is, the correct thread is dumped). - Otherwise, if using a 2.2 kernel, apply the kernel patch - found in contrib/linux/coredump-patch and rebuild the kernel. - This patch will cause multi-threaded programs to dump the - correct thread. - </para> - </answer> - </qandaentry> - - <qandaentry> + <!-- security --> <question> <para> How do I restrict people from looking up the server version? @@ -222,6 +158,7 @@ example.com. 86400 IN SOA ns hostmaster ( 1 3600 1800 1814400 3600 )</programlis </qandaentry> <qandaentry> + <!-- security --> <question> <para> How do I restrict only remote users from looking up the @@ -250,6 +187,7 @@ view "chaos" chaos { </qandaentry> <qandaentry> + <!-- configuration --> <question> <para> What do <quote>no source of entropy found</quote> or <quote>could not @@ -269,21 +207,7 @@ view "chaos" chaos { </qandaentry> <qandaentry> - <question> - <para> - I installed BIND 9 and restarted named, but it's still BIND 8. Why? - </para> - </question> - <answer> - <para> - BIND 9 is installed under /usr/local by default. BIND 8 - is often installed under /usr. Check that the correct named - is running. - </para> - </answer> - </qandaentry> - - <qandaentry> + <!-- configuration --> <question> <para> I'm trying to use TSIG to authenticate dynamic updates or @@ -303,87 +227,6 @@ view "chaos" chaos { <qandaentry> <question> <para> - I'm trying to compile BIND 9, and "make" is failing due to - files not being found. Why? - </para> - </question> - <answer> - <para> - Using a parallel or distributed "make" to build BIND 9 is - not supported, and doesn't work. If you are using one of - these, use normal make or gmake instead. - </para> - </answer> - </qandaentry> - - <qandaentry> - <question> - <para> - I have a BIND 9 master and a BIND 8.2.3 slave, and the - master is logging error messages like <quote>notify to 10.0.0.1#53 - failed: unexpected end of input</quote>. What's wrong? - </para> - </question> - <answer> - <para> - This error message is caused by a known bug in BIND 8.2.3 - and is fixed in BIND 8.2.4. It can be safely ignored - the - notify has been acted on by the slave despite the error - message. - </para> - </answer> - </qandaentry> - - <qandaentry> - <question> - <para> - I keep getting log messages like the following. Why? - </para> - <para> - Dec 4 23:47:59 client 10.0.0.1#1355: updating zone - 'example.com/IN': update failed: 'RRset exists (value - dependent)' prerequisite not satisfied (NXRRSET) - </para> - </question> - <answer> - <para> - DNS updates allow the update request to test to see if - certain conditions are met prior to proceeding with the - update. The message above is saying that conditions were - not met and the update is not proceeding. See doc/rfc/rfc2136.txt - for more details on prerequisites. - </para> - </answer> - </qandaentry> - - <qandaentry> - <question> - <para> - I keep getting log messages like the following. Why? - </para> - <para> - Jun 21 12:00:00.000 client 10.0.0.1#1234: update denied - </para> - </question> - <answer> - <para> - Someone is trying to update your DNS data using the RFC2136 - Dynamic Update protocol. Windows 2000 machines have a habit - of sending dynamic update requests to DNS servers without - being specifically configured to do so. If the update - requests are coming from a Windows 2000 machine, see - <ulink - url="http://support.microsoft.com/support/kb/articles/q246/8/04.asp"> - http://support.microsoft.com/support/kb/articles/q246/8/04.asp - </ulink> - for information about how to turn them off. - </para> - </answer> - </qandaentry> - - <qandaentry> - <question> - <para> I see a log message like the following. Why? </para> <para> @@ -403,81 +246,7 @@ view "chaos" chaos { </para> </answer> </qandaentry> - - <qandaentry> - <question> - <para> - When I do a "dig . ns", many of the A records for the root - servers are missing. Why? - </para> - </question> - <answer> - <para> - This is normal and harmless. It is a somewhat confusing - side effect of the way BIND 9 does RFC2181 trust ranking - and of the efforts BIND 9 makes to avoid promoting glue - into answers. - </para> - <para> - When BIND 9 first starts up and primes its cache, it receives - the root server addresses as additional data in an authoritative - response from a root server, and these records are eligible - for inclusion as additional data in responses. Subsequently - it receives a subset of the root server addresses as - additional data in a non-authoritative (referral) response - from a root server. This causes the addresses to now be - considered non-authoritative (glue) data, which is not - eligible for inclusion in responses. - </para> - <para> - The server does have a complete set of root server addresses - cached at all times, it just may not include all of them - as additional data, depending on whether they were last - received as answers or as glue. You can always look up the - addresses with explicit queries like "dig a.root-servers.net A". - </para> - </answer> - </qandaentry> - - <qandaentry> - <question> - <para> - Zone transfers from my BIND 9 master to my Windows 2000 - slave fail. Why? - </para> - </question> - <answer> - <para> - This may be caused by a bug in the Windows 2000 DNS server - where DNS messages larger than 16K are not handled properly. - This can be worked around by setting the option "transfer-format - one-answer;". Also check whether your zone contains domain - names with embedded spaces or other special characters, - like "John\032Doe\213s\032Computer", since such names have - been known to cause Windows 2000 slaves to incorrectly - reject the zone. - </para> - </answer> - </qandaentry> - - <qandaentry> - <question> - <para> - Why don't my zones reload when I do an "rndc reload" or SIGHUP? - </para> - </question> - <answer> - <para> - A zone can be updated either by editing zone files and - reloading the server or by dynamic update, but not both. - If you have enabled dynamic update for a zone using the - "allow-update" option, you are not supposed to edit the - zone file by hand, and the server will not attempt to reload - it. - </para> - </answer> - </qandaentry> - + <qandaentry> <question> <para> @@ -492,7 +261,7 @@ view "chaos" chaos { </para> </answer> </qandaentry> - + <qandaentry> <question> <para> @@ -580,50 +349,7 @@ Slave 10.0.1.2: </informalexample> </answer> </qandaentry> - - <qandaentry> - <question> - <para> - I have FreeBSD 4.x and "rndc-confgen -a" just sits there. - </para> - </question> - <answer> - <para> - /dev/random is not configured. Use rndcontrol(8) to tell - the kernel to use certain interrupts as a source of random - events. You can make this permanent by setting rand_irqs - in /etc/rc.conf. - </para> - <informalexample> - <programlisting> -/etc/rc.conf -rand_irqs="3 14 15"</programlisting> - </informalexample> - <para> - See also - <ulink url="http://people.freebsd.org/~dougb/randomness.html"> - http://people.freebsd.org/~dougb/randomness.html - </ulink> - </para> - </answer> - </qandaentry> - - <qandaentry> - <question> - <para> - Why is named listening on UDP port other than 53? - </para> - </question> - <answer> - <para> - Named uses a system selected port to make queries of other - nameservers. This behaviour can be overridden by using - query-source to lock down the port and/or address. See - also notify-source and transfer-source. - </para> - </answer> - </qandaentry> - + <qandaentry> <question> <para> @@ -656,7 +382,7 @@ named-checkzone example.com tmp</programlisting> </para> </answer> </qandaentry> - + <qandaentry> <question> <para> @@ -675,33 +401,7 @@ named-checkzone example.com tmp</programlisting> </para> </answer> </qandaentry> - - <qandaentry> - <question> - <para> - I get warning messages like <quote>zone example.com/IN: refresh: - failure trying master 1.2.3.4#53: timed out</quote>. - </para> - </question> - <answer> - <para> - Check that you can make UDP queries from the slave to the master - </para> - <informalexample> - <programlisting> -dig +norec example.com soa @1.2.3.4</programlisting> - </informalexample> - <para> - You could be generating queries faster than the slave can - cope with. Lower the serial query rate. - </para> - <informalexample> - <programlisting> -serial-query-rate 5; // default 20</programlisting> - </informalexample> - </answer> - </qandaentry> - + <qandaentry> <question> <para> @@ -727,7 +427,7 @@ Master 10.0.1.1: }; view "internal" { - match-clients { !external; 10.0.1/24; }; + match-clients { !key external; 10.0.1/24; }; server 10.0.1.1 { /* Deliver notify messages to external view. */ keys { external; }; @@ -741,7 +441,7 @@ Master 10.0.1.1: }; view "external" { - match-clients { external; any; }; + match-clients { key external; any; }; zone "example.com" { type slave; file "external/example.db"; @@ -768,8 +468,8 @@ Master 10.0.1.1: This error is produced when a line in the master file contains leading white space (tab/space) but the is no current record owner name to inherit the name from. Usually - this is the result of putting white space before a comment. - Forgetting the "@" for the SOA record or indenting the master + this is the result of putting white space before a comment, + forgetting the "@" for the SOA record, or indenting the master file. </para> </answer> @@ -796,22 +496,7 @@ Master 10.0.1.1: </para> </answer> </qandaentry> - - <qandaentry> - <question> - <para> - I get the error message <quote>named: capset failed: Operation - not permitted</quote> when starting named. - </para> - </question> - <answer> - <para> - The capability module, part of "Linux Security Modules/LSM", - has not been loaded into the kernel. See insmod(8). - </para> - </answer> - </qandaentry> - + <qandaentry> <question> <para> @@ -851,46 +536,7 @@ Master 10.0.1.1: </para> </answer> </qandaentry> - - <qandaentry> - <question> - <para> - I don't get RRSIG's returned when I use "dig +dnssec". - </para> - </question> - <answer> - <para> - You need to ensure DNSSEC is enabled (dnssec-enable yes;). - </para> - </answer> - </qandaentry> - - <qandaentry> - <question> - <para> - I get <quote>Error 1067</quote> when starting named under Windows. - </para> - </question> - <answer> - <para> - This is the service manager saying that named exited. You - need to examine the Application log in the EventViewer to - find out why. - </para> - <para> - Common causes are that you failed to create "named.conf" - (usually "C:\windows\dns\etc\named.conf") or failed to - specify the directory in named.conf. - </para> - <informalexample> - <programlisting> -options { - Directory "C:\windows\dns\etc"; -};</programlisting> - </informalexample> - </answer> - </qandaentry> - + <qandaentry> <question> <para> @@ -942,26 +588,238 @@ zone "example.net" { </informalexample> </answer> </qandaentry> + + <qandaentry> + <question> + <para> + I want to forward all DNS queries from my caching nameserver to + another server. But there are some domains which have to be + served locally, via rbldnsd. + </para> + <para> + How do I achieve this ? + </para> + </question> + <answer> + <programlisting> +options { + forward only; + forwarders { <ip.of.primary.nameserver>; }; +}; + +zone "sbl-xbl.spamhaus.org" { + type forward; forward only; + forwarders { <ip.of.rbldns.server> port 530; }; +}; + +zone "list.dsbl.org" { + type forward; forward only; + forwarders { <ip.of.rbldns.server> port 530; }; +}; + </programlisting> + </answer> + </qandaentry> <qandaentry> <question> <para> - How do I integrate BIND 9 and Solaris SMF + Can you help me understand how BIND 9 uses memory to store + DNS zones? + </para> + <para> + Some times it seems to take several times the amount of + memory it needs to store the zone. </para> </question> <answer> <para> - Sun has a blog entry describing how to do this. + When reloading a zone named my have multiple copies of + the zone in memory at one time. The zone it is serving + and the one it is loading. If reloads are ultra fast it + can have more still. + </para> + <para> + e.g. Ones that are transferring out, the one that it is + serving and the one that is loading. + </para> + <para> + BIND 8 destroyed the zone before loading and also killed + off outgoing transfers of the zone. + </para> + <para> + The new strategy allows slaves to get copies of the new + zone regardless of how often the master is loaded compared + to the transfer time. The slave might skip some intermediate + versions but the transfers will complete and it will keep + reasonably in sync with the master. + </para> + <para> + The new strategy also allows the master to recover from + syntax and other errors in the master file as it still + has an in-core copy of the old contents. + </para> + </answer> + </qandaentry> + + </qandadiv> <!-- Configuration and Setup Questions --> + + <qandadiv><title>General Questions</title> + + <qandaentry> + <question> + <para> + I keep getting log messages like the following. Why? + </para> + <para> + Dec 4 23:47:59 client 10.0.0.1#1355: updating zone + 'example.com/IN': update failed: 'RRset exists (value + dependent)' prerequisite not satisfied (NXRRSET) + </para> + </question> + <answer> + <para> + DNS updates allow the update request to test to see if + certain conditions are met prior to proceeding with the + update. The message above is saying that conditions were + not met and the update is not proceeding. See doc/rfc/rfc2136.txt + for more details on prerequisites. </para> + </answer> + </qandaentry> + + <qandaentry> + <question> <para> + I keep getting log messages like the following. Why? + </para> + <para> + Jun 21 12:00:00.000 client 10.0.0.1#1234: update denied + </para> + </question> + <answer> + <para> + Someone is trying to update your DNS data using the RFC2136 + Dynamic Update protocol. Windows 2000 machines have a habit + of sending dynamic update requests to DNS servers without + being specifically configured to do so. If the update + requests are coming from a Windows 2000 machine, see <ulink - url="http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris"> - http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris + url="http://support.microsoft.com/support/kb/articles/q246/8/04.asp"> + http://support.microsoft.com/support/kb/articles/q246/8/04.asp </ulink> + for information about how to turn them off. </para> </answer> </qandaentry> + + <qandaentry> + <question> + <para> + When I do a "dig . ns", many of the A records for the root + servers are missing. Why? + </para> + </question> + <answer> + <para> + This is normal and harmless. It is a somewhat confusing + side effect of the way BIND 9 does RFC2181 trust ranking + and of the efforts BIND 9 makes to avoid promoting glue + into answers. + </para> + <para> + When BIND 9 first starts up and primes its cache, it receives + the root server addresses as additional data in an authoritative + response from a root server, and these records are eligible + for inclusion as additional data in responses. Subsequently + it receives a subset of the root server addresses as + additional data in a non-authoritative (referral) response + from a root server. This causes the addresses to now be + considered non-authoritative (glue) data, which is not + eligible for inclusion in responses. + </para> + <para> + The server does have a complete set of root server addresses + cached at all times, it just may not include all of them + as additional data, depending on whether they were last + received as answers or as glue. You can always look up the + addresses with explicit queries like "dig a.root-servers.net A". + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + Why don't my zones reload when I do an "rndc reload" or SIGHUP? + </para> + </question> + <answer> + <para> + A zone can be updated either by editing zone files and + reloading the server or by dynamic update, but not both. + If you have enabled dynamic update for a zone using the + "allow-update" option, you are not supposed to edit the + zone file by hand, and the server will not attempt to reload + it. + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + Why is named listening on UDP port other than 53? + </para> + </question> + <answer> + <para> + Named uses a system selected port to make queries of other + nameservers. This behaviour can be overridden by using + query-source to lock down the port and/or address. See + also notify-source and transfer-source. + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + I get warning messages like <quote>zone example.com/IN: refresh: + failure trying master 1.2.3.4#53: timed out</quote>. + </para> + </question> + <answer> + <para> + Check that you can make UDP queries from the slave to the master + </para> + <informalexample> + <programlisting> +dig +norec example.com soa @1.2.3.4</programlisting> + </informalexample> + <para> + You could be generating queries faster than the slave can + cope with. Lower the serial query rate. + </para> + <informalexample> + <programlisting> +serial-query-rate 5; // default 20</programlisting> + </informalexample> + </answer> + </qandaentry> + <qandaentry> + <question> + <para> + I don't get RRSIG's returned when I use "dig +dnssec". + </para> + </question> + <answer> + <para> + You need to ensure DNSSEC is enabled (dnssec-enable yes;). + </para> + </answer> + </qandaentry> + <qandaentry> <question> <para> @@ -1045,10 +903,175 @@ empty: </para> </answer> </qandaentry> + + <qandaentry> + <question> + <para> + Will named be affected by the 2007 changes to daylight savings + rules in the US. + </para> + </question> + <answer> + <para> + No, so long as the machines internal clock (as reported + by "date -u") remains at UTC. The only visible change + if you fail to upgrade your OS, if you are in a affected + area, will be that log messages will be a hour out during + the period where the old rules do not match the new rules. + </para> + <para> + For most OS's this change just means that you need to + update the conversion rules from UTC to local time. + Normally this involves updating a file in /etc (which + sets the default timezone for the machine) and possibly + a directory which has all the conversion rules for the + world (e.g. /usr/share/zoneinfo). When updating the OS + do not forget to update any chroot areas as well. + See your OS's documentation for more details. + </para> + <para> + The local timezone conversion rules can also be done on + a individual basis by setting the TZ environment variable + appropriately. See your OS's documentation for more + details. + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + Is there a bugzilla (or other tool) database that mere + mortals can have (read-only) access to for bind? + </para> + </question> + <answer> + <para> + No. The BIND 9 bug database is kept closed for a number + of reasons. These include, but are not limited to, that + the database contains proprietory information from people + reporting bugs. The database has in the past and may in + future contain unfixed bugs which are capable of bringing + down most of the Internet's DNS infrastructure. + </para> + <para> + The release pages for each version contain up to date + lists of bugs that have been fixed post release. That + is as close as we can get to providing a bug database. + </para> + </answer> + </qandaentry> + + </qandadiv> <!-- General Questions --> + + <qandadiv><title>Operating-System Specific Questions</title> + + <qandadiv><title>HPUX</title> + + <qandaentry> + <question> + <para>I get the following error trying to configure BIND: +<programlisting>checking if unistd.h or sys/types.h defines fd_set... no +configure: error: need either working unistd.h or sys/select.h</programlisting> + </para> + </question> + <answer> + <para> + You have attempted to configure BIND with the bundled C compiler. + This compiler does not meet the minimum compiler requirements to + for building BIND. You need to install a ANSI C compiler and / or + teach configure how to find the ANSI C compiler. The later can + be done by adjusting the PATH environment variable and / or + specifying the compiler via CC. + </para> + <informalexample> + <programlisting>./configure CC=<compiler> ...</programlisting> + </informalexample> + </answer> + </qandaentry> + + </qandadiv> <!-- HPUX --> + + <qandadiv><title>Linux</title> + + <qandaentry> + <question> + <para> + Why do I get the following errors: +<programlisting>general: errno2result.c:109: unexpected error: +general: unable to convert errno to isc_result: 14: Bad address +client: UDP client handler shutting down due to fatal receive error: unexpected error</programlisting> + </para> + </question> + <answer> + <para> + This is the result of a Linux kernel bug. + </para> + <para> + See: + <ulink url="http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=2">http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=2</ulink> + </para> + </answer> + </qandaentry> <qandaentry> <question> <para> + Why do I see 5 (or more) copies of named on Linux? + </para> + </question> + <answer> + <para> + Linux threads each show up as a process under ps. The + approximate number of threads running is n+4, where n is + the number of CPUs. Note that the amount of memory used + is not cumulative; if each process is using 10M of memory, + only a total of 10M is used. + </para> + <para> + Newer versions of Linux's ps command hide the individual threads + and require -L to display them. + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + Why does BIND 9 log <quote>permission denied</quote> errors accessing + its configuration files or zones on my Linux system even + though it is running as root? + </para> + </question> + <answer> + <para> + On Linux, BIND 9 drops most of its root privileges on + startup. This including the privilege to open files owned + by other users. Therefore, if the server is running as + root, the configuration files and zone files should also + be owned by root. + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + I get the error message <quote>named: capset failed: Operation + not permitted</quote> when starting named. + </para> + </question> + <answer> + <para> + The capability module, part of "Linux Security Modules/LSM", + has not been loaded into the kernel. See insmod(8). + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> I'm running BIND on Red Hat Enterprise Linux or Fedora Core - </para> <para> @@ -1210,148 +1233,115 @@ named_cache_t: for files modifiable by named - $ROOTDIR/var/{tmp,named/{slaves,d </para> </answer> </qandaentry> - + + </qandadiv> <!-- Linux --> + + <qandadiv><title>Windows</title> + <qandaentry> <question> <para> - I want to forward all DNS queries from my caching nameserver to - another server. But there are some domains which have to be - served locally, via rbldnsd. - </para> - <para> - How do I achieve this ? + Zone transfers from my BIND 9 master to my Windows 2000 + slave fail. Why? </para> </question> <answer> - <programlisting> -options { - forward only; - forwarders { <ip.of.primary.nameserver>; }; -}; - -zone "sbl-xbl.spamhaus.org" { - type forward; forward only; - forwarders { <ip.of.rbldns.server> port 530; }; -}; - -zone "list.dsbl.org" { - type forward; forward only; - forwarders { <ip.of.rbldns.server> port 530; }; -}; - </programlisting> + <para> + This may be caused by a bug in the Windows 2000 DNS server + where DNS messages larger than 16K are not handled properly. + This can be worked around by setting the option "transfer-format + one-answer;". Also check whether your zone contains domain + names with embedded spaces or other special characters, + like "John\032Doe\213s\032Computer", since such names have + been known to cause Windows 2000 slaves to incorrectly + reject the zone. + </para> </answer> </qandaentry> - + <qandaentry> <question> <para> - Will named be affected by the 2007 changes to daylight savings - rules in the US. + I get <quote>Error 1067</quote> when starting named under Windows. </para> </question> <answer> <para> - No, so long as the machines internal clock (as reported - by "date -u") remains at UTC. The only visible change - if you fail to upgrade your OS, if you are in a affected - area, will be that log messages will be a hour out during - the period where the old rules do not match the new rules. - </para> - <para> - For most OS's this change just means that you need to - update the conversion rules from UTC to local time. - Normally this involves updating a file in /etc (which - sets the default timezone for the machine) and possibly - a directory which has all the conversion rules for the - world (e.g. /usr/share/zoneinfo). When updating the OS - do not forget to update any chroot areas as well. - See your OS's documentation for more details. + This is the service manager saying that named exited. You + need to examine the Application log in the EventViewer to + find out why. </para> <para> - The local timezone conversion rules can also be done on - a individual basis by setting the TZ environment variable - appropriately. See your OS's documentation for more - details. + Common causes are that you failed to create "named.conf" + (usually "C:\windows\dns\etc\named.conf") or failed to + specify the directory in named.conf. </para> + <informalexample> + <programlisting> +options { + Directory "C:\windows\dns\etc"; +};</programlisting> + </informalexample> </answer> </qandaentry> - + + </qandadiv> <!-- Windows --> + + <qandadiv><title>FreeBSD</title> + <qandaentry> <question> <para> - Why do we get the following warning at run time: -<programlisting>kernel: process `named' is using obsolete setsockopt SO_BSDCOMPAT</programlisting> + I have FreeBSD 4.x and "rndc-confgen -a" just sits there. </para> </question> <answer> <para> - The early Linux kernels broke sendto() by having it return - that a ICMP unreachable had be received for non connected - UDP sockets. This made non connected UDP sockets work like - connected UDP socket which is fine when you are only talking - to one destination. Named however talks to multiple - destinations and it caused problems. - </para> - <para> - Rather than fix sendto() to just have BSD behaviour they added - SO_BSDCOMPAT to turn BSD behaviour on/off on a per socket basis. - </para> - <para> - Later they decided to make BSD behaviour the default and - to aggressively track down applications that used SO_BSDCOMPAT - by issuing a warning. This is the sort of things vendors - do in alpha/beta stages of a release so that their code is - clean. They then turn the warning *off* for release code. - </para> - <para> - We still have customers that have kernels that require - SO_BSDCOMPAT to operate. We therefore cannot remove the - setsockopt(SO_BSDCOMPAT) call. - </para> - <para> - Now most/all portable applications that use SO_BSDCOMPAT use it - conditionally manner so just removing SO_BSDCOMPAT from the - header file would be safe as long as the binary was not to - be moved between systems. BIND's use is conditional. + /dev/random is not configured. Use rndcontrol(8) to tell + the kernel to use certain interrupts as a source of random + events. You can make this permanent by setting rand_irqs + in /etc/rc.conf. </para> + <informalexample> + <programlisting> +/etc/rc.conf +rand_irqs="3 14 15"</programlisting> + </informalexample> <para> - In short, the Linux developers should either, remove the #define for - SO_BSDCOMPAT, and/or remove the warning. + See also + <ulink url="http://people.freebsd.org/~dougb/randomness.html"> + http://people.freebsd.org/~dougb/randomness.html + </ulink> </para> </answer> </qandaentry> - + + </qandadiv> <!-- FreeBSD --> + + <qandadiv><title>Solaris</title> + <qandaentry> <question> <para> - Isn't "make install" supposed to generate a default named.conf? + How do I integrate BIND 9 and Solaris SMF </para> </question> <answer> <para> - Short Answer: No. - </para> - <para> - Long Answer: There really isn't a default configuration which fits - any site perfectly. There are lots of decisions that need to - be made and there is no consensus on what the defaults should be. - For example FreeBSD uses /etc/namedb as the location where the - configuration files for named are stored. Others use /var/named. - </para> - <para> - What addresses to listen on? For a laptop on the move a lot - you may only want to listen on the loop back interfaces. + Sun has a blog entry describing how to do this. </para> <para> - Who do you offer recursive service to? Is there are firewall - to consider? If so is it stateless or stateful. Are you - directly on the Internet? Are you on a private network? Are - you on a NAT'd network? The answers - to all these questions change how you configure even a - caching name server. + <ulink + url="http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris"> + http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris + </ulink> </para> </answer> </qandaentry> + + </qandadiv> + + </qandadiv> <!-- Operating-System Specific Questions --> </qandaset> </article> diff --git a/contrib/bind9/FREEBSD-Upgrade b/contrib/bind9/FREEBSD-Upgrade index f590181..75efb09 100644 --- a/contrib/bind9/FREEBSD-Upgrade +++ b/contrib/bind9/FREEBSD-Upgrade @@ -1,17 +1,120 @@ -# $FreeBSD$ -# -# Bug trhodes@ and des@ to actually throw some text in here. -# -while read pattern ; do rm -rf $pattern ; done <FREEBSD-Xlist -sed -i.orig -e '/\/tests/d; /docutil/d;' configure.in Makefile.in */Makefile.in + FreeBSD maintainer's guide to updating BIND 9 + ============================================= -autoconf253 +1) Obtain the latest source distribution from the ISC's FTP server + (ftp://ftp.isc.org/isc/bind9/) -autoheader253 +2) Unpack the tarball in a suitable directory, and cd into the new + source directory. -./configure --prefix=/usr --infodir=/usr/share/info --mandir=/usr/share/man \ - --enable-threads --enable-libbind --disable-ipv6 \ - --enable-getifaddrs --disable-linux-caps \ - --with-openssl=/usr --with-randomdev=/dev/random +3) Remove unwanted files and directories: + + $ while read pattern ; do rm -rf $pattern ; done \ + </usr/src/contrib/bind9/FREEBSD-Xlist + + Make sure that took care of everything, and if it didn't, make sure + to update FREEBSD-Xlist so you won't miss it the next time. A good + way to do this is to run a test import and see if any new files + show up: + + $ cvs -q -n import src/contrib/bind9 ISC x | grep \^N + +4) Import the sources: + + $ cvs import -m "Vendor import of BIND 9.X.Y" \ + src/contrib/bind9 ISC BIND_9_X_Y + +5) Resolve conflicts. + + As of 2 June 2007, we have no local patches against BIND 9; thus + there are no conflicts to merge. This may change at a later date. + +5a) Remove any files that are no longer in the tarball from the vendor branch. + +6) Remove any references to the {bin,lib}/tests and docutil + directories from the configure and Makefile templates: + + $ sed -i.orig -e '/\/tests/d; /docutil/d; /\/xsl/d;' \ + configure.in Makefile.in */Makefile.in + + Please do not commit this change, as it would unnecessarily take + files off the vendor branch. You only need this to generate + config.h. + +7) Generate and run configure: + + $ aclocal + $ autoheader + $ autoconf + $ ./configure --prefix=/usr \ + --infodir=/usr/share/info --mandir=/usr/share/man \ + --enable-threads --enable-libbind --disable-ipv6 \ + --enable-getifaddrs --disable-linux-caps \ + --with-openssl=/usr --with-randomdev=/dev/random + + Note that we intentionally disable IPv6 support on the configure + command line; src/lib/bind/config.mk will re-enable it at compile + time if WITHOUT_INET6 is not defined. + +8) Copy the following generated files to src/lib/bind and commit them: + + Path in src/contrib/bind9 Path in src/lib/bind + ------------------------------------------------------------ + s=/usr/src/lib/bind + cp config.h ${s}/config.h + cp lib/bind/config.h ${s}/bind/config.h + cp lib/bind/port_after.h ${s}/bind/port_after.h + cp lib/bind/port_before.h ${s}/bind/port_before.h + cp lib/isc/include/isc/platform.h ${s}/isc/isc/platform.h + cp lib/lwres/include/lwres/netdb.h ${s}/lwres/lwres/netdb.h + cp lib/lwres/include/lwres/platform.h ${s}/lwres/lwres/platform.h + + Do not commit any other file that was modified or created in + steps 6) or 7). + +9) cd src/lib/bind/dns && make -DMAINTAINER_MODE generate && rm gen + Commit the new versions of the files generated. + + The following directories contain Makefiles for bits and pieces of + BIND 9: + + FreeBSD directory ISC directory + ======================================================== + src/lib/bind bind9/lib + src/lib/bind/bind bind9/lib/bind + src/lib/bind/bind9 bind9/lib/bind9 + src/lib/bind/dns bind9/lib/dns + src/lib/bind/isc bind9/lib/isc + src/lib/bind/isccc bind9/lib/isccc + src/lib/bind/isccfg bind9/lib/isccfg + src/lib/bind/lwres bind9/lib/lwres + src/share/doc/bind9 bind9/doc/{arm,misc} + src/usr.bin/dig bind9/bin/dig + src/usr.bin/host bind9/bin/dig + src/usr.bin/nslookup bind9/bin/dig + src/usr.bin/nsupdate bind9/bin/nsupdate + src/usr.sbin/dnssec-keygen bind9/bin/dnssec + src/usr.sbin/dnssec-signzone bind9/bin/dnssec + src/usr.sbin/named bind9/bin/named + src/usr.sbin/named-checkconf bind9/bin/check + src/usr.sbin/named-checkzone bind9/bin/check + src/usr.sbin/rndc bind9/bin/rndc + src/usr.sbin/rndc-confgen bind9/bin/rndc + + Make sure that the lists of sources, headers and man pages in each + FreeBSD Makefile accurately reflects those in the corresponding ISC + Makefile. Please strive to keep those lists in the same order and + with line breaks in the same places to ease future comparisons. + +A) Build and test. + +B) Lather, rinse, repeat. + +C) Commit when everything builds cleanly and works properly. + + -- des@FreeBSD.org + -- dougb@FreeBSD.org + +$FreeBSD$ diff --git a/contrib/bind9/FREEBSD-Xlist b/contrib/bind9/FREEBSD-Xlist index 652d2c0..f423955 100644 --- a/contrib/bind9/FREEBSD-Xlist +++ b/contrib/bind9/FREEBSD-Xlist @@ -3,12 +3,19 @@ # Misc. stuff .cvsignore aclocal.m4 -bin/tests config.h.in configure contrib docutil +# Tests +bin/tests +lib/tests + +# Doc stuff +doc/arm/latex-fixup.pl +doc/xsl + # Windows directories bin/check/win32 bin/dig/win32 @@ -29,8 +36,7 @@ lib/win32 win32utils # Various ports to other OSs -lib/bind/port/aix32 -lib/bind/port/aix4 +lib/bind/port/aix* lib/bind/port/aux3 lib/bind/port/bsdos lib/bind/port/bsdos2 diff --git a/contrib/bind9/Makefile.in b/contrib/bind9/Makefile.in index 0820ce7..9ff0f64 100644 --- a/contrib/bind9/Makefile.in +++ b/contrib/bind9/Makefile.in @@ -1,7 +1,7 @@ -# Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 1998-2002 Internet Software Consortium. # -# Permission to use, copy, modify, and distribute this software for any +# Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above # copyright notice and this permission notice appear in all copies. # @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: Makefile.in,v 1.43.18.4 2006/05/19 00:04:01 marka Exp $ +# $Id: Makefile.in,v 1.43.18.6 2007/09/03 23:46:21 tbox Exp $ srcdir = @srcdir@ VPATH = @srcdir@ @@ -61,7 +61,7 @@ test: FAQ: FAQ.xml ${XSLTPROC} doc/xsl/isc-docbook-text.xsl FAQ.xml | \ - ${W3M} -T text/html -dump >$@.tmp + LC_ALL=C ${W3M} -T text/html -dump -cols 72 >$@.tmp mv $@.tmp $@ clean:: diff --git a/contrib/bind9/README b/contrib/bind9/README index 4cdd146..20fd84a 100644 --- a/contrib/bind9/README +++ b/contrib/bind9/README @@ -43,16 +43,19 @@ BIND 9 Nominum, Inc. -BIND 9.4.1-P1 +BIND 9.4.2 - BIND 9.4.1-P1 is a security release, containing a fixes for a - security bugs in BIND 9.4.1. + BIND 9.4.2 is a maintenance release, containing fixes for + a number of bugs in 9.4.1. + + Warning: If you installed BIND 9.4.2rc1 then any applications + linked against this release candidate will need to be rebuilt. BIND 9.4.1 - BIND 9.4.1 is a security release, containing a fix for a - security bug in 9.4.0. - + BIND 9.4.1 is a security release, containing a fix for + a security bugs in 9.4.0. + BIND 9.4.0 BIND 9.4.0 has a number of new features over 9.3, @@ -74,7 +77,9 @@ BIND 9.4.0 used to specify the default zone access level rather than having to have every zone override the global value. allow-query-cache can be set at both the options and view - levels. If allow-query-cache is not set allow-query applies. + levels. If allow-query-cache is not set then allow-recursion + is used if set, otherwise allow-query is used if set, otherwise + the default (localhost; localnets;) is used. rndc: the source address can now be specified. @@ -418,7 +423,7 @@ Building We've had successful builds and tests on the following systems: COMPAQ Tru64 UNIX 5.1B - FreeBSD 4.10, 5.2.1 + FreeBSD 4.10, 5.2.1, 6.2 HP-UX 11.11 NetBSD 1.5 Slackware Linux 8.1 @@ -475,6 +480,8 @@ Building -DDIG_SIGCHASE_BU=1) Disable dropping queries from particular well known ports. -DNS_CLIENT_DROPPORT=0 + Disable support for "rrset-order fixed". + -DDNS_RDATASET_FIXED=0 LDFLAGS Linker flags. Defaults to empty string. @@ -587,9 +594,8 @@ Bug Reports and Mailing Lists http://www.isc.org/ops/lists/ If you're planning on making changes to the BIND 9 source - code, you might want to join the BIND Workers mailing list. - Send mail to - - bind-workers-request@isc.org - + code, you might want to join the BIND Forum as a Worker. + This gives you access to the bind-workers@isc.org mailing + list and pre-release access to the code. + http://www.isc.org/sw/guild/bf/ diff --git a/contrib/bind9/bin/check/check-tool.c b/contrib/bind9/bin/check/check-tool.c index c8ef4df..1f5f1cd 100644 --- a/contrib/bind9/bin/check/check-tool.c +++ b/contrib/bind9/bin/check/check-tool.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000-2002 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,14 +15,13 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: check-tool.c,v 1.10.18.14 2006/06/08 01:43:00 marka Exp $ */ +/* $Id: check-tool.c,v 1.10.18.18 2007/09/13 05:04:01 each Exp $ */ /*! \file */ #include <config.h> #include <stdio.h> -#include <string.h> #include "check-tool.h" #include <isc/util.h> @@ -33,6 +32,7 @@ #include <isc/netdb.h> #include <isc/region.h> #include <isc/stdio.h> +#include <isc/string.h> #include <isc/types.h> #include <dns/fixedname.h> @@ -130,7 +130,16 @@ checkns(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner, dns_name_format(name, namebuf, sizeof(namebuf) - 1); switch (result) { case 0: - if (strcasecmp(ai->ai_canonname, namebuf) != 0) { + /* + * Work around broken getaddrinfo() implementations that + * fail to set ai_canonname on first entry. + */ + cur = ai; + while (cur != NULL && cur->ai_canonname == NULL && + cur->ai_next != NULL) + cur = cur->ai_next; + if (cur != NULL && cur->ai_canonname != NULL && + strcasecmp(ai->ai_canonname, namebuf) != 0) { dns_zone_log(zone, ISC_LOG_ERROR, "%s/NS '%s' (out of zone) " "is a CNAME (illegal)", @@ -268,7 +277,7 @@ checkns(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner, static isc_boolean_t checkmx(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner) { #ifdef USE_GETADDRINFO - struct addrinfo hints, *ai; + struct addrinfo hints, *ai, *cur; char namebuf[DNS_NAME_FORMATSIZE + 1]; char ownerbuf[DNS_NAME_FORMATSIZE]; int result; @@ -293,7 +302,16 @@ checkmx(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner) { dns_name_format(name, namebuf, sizeof(namebuf) - 1); switch (result) { case 0: - if (strcasecmp(ai->ai_canonname, namebuf) != 0) { + /* + * Work around broken getaddrinfo() implementations that + * fail to set ai_canonname on first entry. + */ + cur = ai; + while (cur != NULL && cur->ai_canonname == NULL && + cur->ai_next != NULL) + cur = cur->ai_next; + if (cur != NULL && cur->ai_canonname != NULL && + strcasecmp(cur->ai_canonname, namebuf) != 0) { if ((zone_options & DNS_ZONEOPT_WARNMXCNAME) != 0) level = ISC_LOG_WARNING; if ((zone_options & DNS_ZONEOPT_IGNOREMXCNAME) == 0) { @@ -332,7 +350,7 @@ checkmx(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner) { static isc_boolean_t checksrv(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner) { #ifdef USE_GETADDRINFO - struct addrinfo hints, *ai; + struct addrinfo hints, *ai, *cur; char namebuf[DNS_NAME_FORMATSIZE + 1]; char ownerbuf[DNS_NAME_FORMATSIZE]; int result; @@ -357,7 +375,16 @@ checksrv(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner) { dns_name_format(name, namebuf, sizeof(namebuf) - 1); switch (result) { case 0: - if (strcasecmp(ai->ai_canonname, namebuf) != 0) { + /* + * Work around broken getaddrinfo() implementations that + * fail to set ai_canonname on first entry. + */ + cur = ai; + while (cur != NULL && cur->ai_canonname == NULL && + cur->ai_next != NULL) + cur = cur->ai_next; + if (cur != NULL && cur->ai_canonname != NULL && + strcasecmp(cur->ai_canonname, namebuf) != 0) { if ((zone_options & DNS_ZONEOPT_WARNSRVCNAME) != 0) level = ISC_LOG_WARNING; if ((zone_options & DNS_ZONEOPT_IGNORESRVCNAME) == 0) { diff --git a/contrib/bind9/bin/check/named-checkconf.8 b/contrib/bind9/bin/check/named-checkconf.8 index 9fb900e..364e6b9 100644 --- a/contrib/bind9/bin/check/named-checkconf.8 +++ b/contrib/bind9/bin/check/named-checkconf.8 @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: named-checkconf.8,v 1.16.18.11 2007/01/30 00:23:44 marka Exp $ +.\" $Id: named-checkconf.8,v 1.16.18.13 2007/06/20 02:26:58 marka Exp $ .\" .hy 0 .ad l @@ -42,7 +42,7 @@ checks the syntax, but not the semantics, of a named configuration file. .PP \-t \fIdirectory\fR .RS 4 -chroot to +Chroot to \fIdirectory\fR so that include directives in the configuration file are processed as if run by a similarly chrooted named. .RE @@ -56,7 +56,7 @@ program and exit. .PP \-z .RS 4 -Perform a check load the master zonefiles found in +Perform a test load of all master zones found in \fInamed.conf\fR. .RE .PP @@ -77,6 +77,7 @@ returns an exit status of 1 if errors were detected and 0 otherwise. .SH "SEE ALSO" .PP \fBnamed\fR(8), +\fBnamed\-checkzone\fR(8), BIND 9 Administrator Reference Manual. .SH "AUTHOR" .PP diff --git a/contrib/bind9/bin/check/named-checkconf.docbook b/contrib/bind9/bin/check/named-checkconf.docbook index afeb8d5..af7a73d 100644 --- a/contrib/bind9/bin/check/named-checkconf.docbook +++ b/contrib/bind9/bin/check/named-checkconf.docbook @@ -5,7 +5,7 @@ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000-2002 Internet Software Consortium. - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: named-checkconf.docbook,v 1.8.18.7 2007/01/29 23:57:20 marka Exp $ --> +<!-- $Id: named-checkconf.docbook,v 1.8.18.10 2007/08/28 07:19:55 tbox Exp $ --> <refentry id="man.named-checkconf"> <refentryinfo> <date>June 14, 2000</date> @@ -77,7 +77,7 @@ <term>-t <replaceable class="parameter">directory</replaceable></term> <listitem> <para> - chroot to <filename>directory</filename> so that + Chroot to <filename>directory</filename> so that include directives in the configuration file are processed as if run by a similarly chrooted named. @@ -99,8 +99,8 @@ <term>-z</term> <listitem> <para> - Perform a check load the master zonefiles found in - <filename>named.conf</filename>. + Perform a test load of all master zones found in + <filename>named.conf</filename>. </para> </listitem> </varlistentry> @@ -141,6 +141,9 @@ <para><citerefentry> <refentrytitle>named</refentrytitle><manvolnum>8</manvolnum> </citerefentry>, + <citerefentry> + <refentrytitle>named-checkzone</refentrytitle><manvolnum>8</manvolnum> + </citerefentry>, <citetitle>BIND 9 Administrator Reference Manual</citetitle>. </para> </refsect1> diff --git a/contrib/bind9/bin/check/named-checkconf.html b/contrib/bind9/bin/check/named-checkconf.html index f099645..910df0d 100644 --- a/contrib/bind9/bin/check/named-checkconf.html +++ b/contrib/bind9/bin/check/named-checkconf.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: named-checkconf.html,v 1.9.18.18 2007/01/30 00:23:44 marka Exp $ --> +<!-- $Id: named-checkconf.html,v 1.9.18.20 2007/06/20 02:26:58 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -43,7 +43,7 @@ <div class="variablelist"><dl> <dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt> <dd><p> - chroot to <code class="filename">directory</code> so that + Chroot to <code class="filename">directory</code> so that include directives in the configuration file are processed as if run by a similarly chrooted named. @@ -55,8 +55,8 @@ </p></dd> <dt><span class="term">-z</span></dt> <dd><p> - Perform a check load the master zonefiles found in - <code class="filename">named.conf</code>. + Perform a test load of all master zones found in + <code class="filename">named.conf</code>. </p></dd> <dt><span class="term">-j</span></dt> <dd><p> @@ -70,20 +70,21 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2543488"></a><h2>RETURN VALUES</h2> +<a name="id2543489"></a><h2>RETURN VALUES</h2> <p><span><strong class="command">named-checkconf</strong></span> returns an exit status of 1 if errors were detected and 0 otherwise. </p> </div> <div class="refsect1" lang="en"> -<a name="id2543499"></a><h2>SEE ALSO</h2> +<a name="id2543500"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, + <span class="citerefentry"><span class="refentrytitle">named-checkzone</span>(8)</span>, <em class="citetitle">BIND 9 Administrator Reference Manual</em>. </p> </div> <div class="refsect1" lang="en"> -<a name="id2543521"></a><h2>AUTHOR</h2> +<a name="id2543530"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/contrib/bind9/bin/check/named-checkzone.8 b/contrib/bind9/bin/check/named-checkzone.8 index ecd389c..bd538ac 100644 --- a/contrib/bind9/bin/check/named-checkzone.8 +++ b/contrib/bind9/bin/check/named-checkzone.8 @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: named-checkzone.8,v 1.18.18.20 2007/01/30 00:23:44 marka Exp $ +.\" $Id: named-checkzone.8,v 1.18.18.23 2007/06/20 02:26:58 marka Exp $ .\" .hy 0 .ad l @@ -48,7 +48,7 @@ useful for checking zone files before configuring them into a name server. \fBnamed\-compilezone\fR is similar to \fBnamed\-checkzone\fR, but it always dumps the zone contents to a specified file in a specified format. Additionally, it applies stricter check levels by default, since the dump output will be used as an actual zone file loaded by -\fBnamed\fR. When manaully specified otherwise, the check levels must at least be as strict as those specified in the +\fBnamed\fR. When manually specified otherwise, the check levels must at least be as strict as those specified in the \fBnamed\fR configuration file. .SH "OPTIONS" @@ -82,7 +82,7 @@ Specify the class of the zone. If not specified "IN" is assumed. .PP \-i \fImode\fR .RS 4 -Perform post load zone integrity checks. Possible modes are +Perform post\-load zone integrity checks. Possible modes are \fB"full"\fR (default), \fB"full\-sibling"\fR, @@ -105,7 +105,7 @@ only checks SRV records which refer to in\-zone hostnames. .sp Mode \fB"full"\fR -checks that delegation NS records refer to A or AAAA record (both in\-zone and out\-of\-zone hostnames). It also checks that glue addresses records in the zone match those advertised by the child. Mode +checks that delegation NS records refer to A or AAAA record (both in\-zone and out\-of\-zone hostnames). It also checks that glue address records in the zone match those advertised by the child. Mode \fB"local"\fR only checks NS records which refer to in\-zone hostnames or that some required glue exists, that is when the nameserver is in a child zone. .sp @@ -213,7 +213,7 @@ Check if a SRV record refers to a CNAME. Possible modes are .PP \-t \fIdirectory\fR .RS 4 -chroot to +Chroot to \fIdirectory\fR so that include directives in the configuration file are processed as if run by a similarly chrooted named. .RE @@ -256,6 +256,7 @@ returns an exit status of 1 if errors were detected and 0 otherwise. .SH "SEE ALSO" .PP \fBnamed\fR(8), +\fBnamed\-checkconf\fR(8), RFC 1035, BIND 9 Administrator Reference Manual. .SH "AUTHOR" diff --git a/contrib/bind9/bin/check/named-checkzone.c b/contrib/bind9/bin/check/named-checkzone.c index aa94b8c..08e958e 100644 --- a/contrib/bind9/bin/check/named-checkzone.c +++ b/contrib/bind9/bin/check/named-checkzone.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: named-checkzone.c,v 1.29.18.16 2006/10/05 05:24:35 marka Exp $ */ +/* $Id: named-checkzone.c,v 1.29.18.19 2007/08/28 07:19:55 tbox Exp $ */ /*! \file */ @@ -109,6 +109,8 @@ main(int argc, char **argv) { outputstyle = &dns_master_style_full; prog_name = strrchr(argv[0], '/'); + if (prog_name == NULL) + prog_name = strrchr(argv[0], '\\'); if (prog_name != NULL) prog_name++; else diff --git a/contrib/bind9/bin/check/named-checkzone.docbook b/contrib/bind9/bin/check/named-checkzone.docbook index 70e1878..11b85ef 100644 --- a/contrib/bind9/bin/check/named-checkzone.docbook +++ b/contrib/bind9/bin/check/named-checkzone.docbook @@ -5,7 +5,7 @@ - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000-2002 Internet Software Consortium. - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: named-checkzone.docbook,v 1.11.18.17 2007/01/29 23:57:20 marka Exp $ --> +<!-- $Id: named-checkzone.docbook,v 1.11.18.21 2007/08/28 07:19:55 tbox Exp $ --> <refentry id="man.named-checkzone"> <refentryinfo> <date>June 13, 2000</date> @@ -117,7 +117,7 @@ Additionally, it applies stricter check levels by default, since the dump output will be used as an actual zone file loaded by <command>named</command>. - When manaully specified otherwise, the check levels must at + When manually specified otherwise, the check levels must at least be as strict as those specified in the <command>named</command> configuration file. </para> @@ -177,7 +177,7 @@ <term>-i <replaceable class="parameter">mode</replaceable></term> <listitem> <para> - Perform post load zone integrity checks. Possible modes are + Perform post-load zone integrity checks. Possible modes are <command>"full"</command> (default), <command>"full-sibling"</command>, <command>"local"</command>, @@ -199,7 +199,7 @@ <para> Mode <command>"full"</command> checks that delegation NS records refer to A or AAAA record (both in-zone and out-of-zone - hostnames). It also checks that glue addresses records + hostnames). It also checks that glue address records in the zone match those advertised by the child. Mode <command>"local"</command> only checks NS records which refer to in-zone hostnames or that some required glue exists, @@ -342,7 +342,7 @@ <term>-t <replaceable class="parameter">directory</replaceable></term> <listitem> <para> - chroot to <filename>directory</filename> so that + Chroot to <filename>directory</filename> so that include directives in the configuration file are processed as if run by a similarly chrooted named. @@ -422,6 +422,9 @@ <para><citerefentry> <refentrytitle>named</refentrytitle><manvolnum>8</manvolnum> </citerefentry>, + <citerefentry> + <refentrytitle>named-checkconf</refentrytitle><manvolnum>8</manvolnum> + </citerefentry>, <citetitle>RFC 1035</citetitle>, <citetitle>BIND 9 Administrator Reference Manual</citetitle>. </para> diff --git a/contrib/bind9/bin/check/named-checkzone.html b/contrib/bind9/bin/check/named-checkzone.html index be2f589..0e1015d 100644 --- a/contrib/bind9/bin/check/named-checkzone.html +++ b/contrib/bind9/bin/check/named-checkzone.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: named-checkzone.html,v 1.11.18.27 2007/01/30 00:23:44 marka Exp $ --> +<!-- $Id: named-checkzone.html,v 1.11.18.30 2007/06/20 02:26:58 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -47,7 +47,7 @@ Additionally, it applies stricter check levels by default, since the dump output will be used as an actual zone file loaded by <span><strong class="command">named</strong></span>. - When manaully specified otherwise, the check levels must at + When manually specified otherwise, the check levels must at least be as strict as those specified in the <span><strong class="command">named</strong></span> configuration file. </p> @@ -79,7 +79,7 @@ <dt><span class="term">-i <em class="replaceable"><code>mode</code></em></span></dt> <dd> <p> - Perform post load zone integrity checks. Possible modes are + Perform post-load zone integrity checks. Possible modes are <span><strong class="command">"full"</strong></span> (default), <span><strong class="command">"full-sibling"</strong></span>, <span><strong class="command">"local"</strong></span>, @@ -101,7 +101,7 @@ <p> Mode <span><strong class="command">"full"</strong></span> checks that delegation NS records refer to A or AAAA record (both in-zone and out-of-zone - hostnames). It also checks that glue addresses records + hostnames). It also checks that glue address records in the zone match those advertised by the child. Mode <span><strong class="command">"local"</strong></span> only checks NS records which refer to in-zone hostnames or that some required glue exists, @@ -195,7 +195,7 @@ </p></dd> <dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt> <dd><p> - chroot to <code class="filename">directory</code> so that + Chroot to <code class="filename">directory</code> so that include directives in the configuration file are processed as if run by a similarly chrooted named. @@ -242,12 +242,13 @@ <div class="refsect1" lang="en"> <a name="id2544311"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, + <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>, <em class="citetitle">RFC 1035</em>, <em class="citetitle">BIND 9 Administrator Reference Manual</em>. </p> </div> <div class="refsect1" lang="en"> -<a name="id2544336"></a><h2>AUTHOR</h2> +<a name="id2544344"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/contrib/bind9/bin/dig/dig.1 b/contrib/bind9/bin/dig/dig.1 index 240b732..bf53280 100644 --- a/contrib/bind9/bin/dig/dig.1 +++ b/contrib/bind9/bin/dig/dig.1 @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dig.1,v 1.23.18.19 2007/01/30 00:23:44 marka Exp $ +.\" $Id: dig.1,v 1.23.18.22 2007/05/16 06:11:27 marka Exp $ .\" .hy 0 .ad l @@ -50,7 +50,7 @@ Although \fBdig\fR is normally used with command\-line arguments, it also has a batch mode of operation for reading lookup requests from a file. A brief summary of its command\-line arguments and options is printed when the \fB\-h\fR -option is given. Unlike earlier versions, the BIND9 implementation of +option is given. Unlike earlier versions, the BIND 9 implementation of \fBdig\fR allows multiple lookups to be issued from the command line. .PP @@ -128,14 +128,14 @@ The default query class (IN for internet) is overridden by the \fB\-c\fR option. \fIclass\fR -is any valid class, such as HS for Hesiod records or CH for CHAOSNET records. +is any valid class, such as HS for Hesiod records or CH for Chaosnet records. .PP The \fB\-f\fR option makes \fBdig \fR operate in batch mode by reading a list of lookup requests to process from the file -\fIfilename\fR. The file contains a number of queries, one per line. Each entry in the file should be organised in the same way they would be presented as queries to +\fIfilename\fR. The file contains a number of queries, one per line. Each entry in the file should be organized in the same way they would be presented as queries to \fBdig\fR using the command\-line interface. .PP @@ -160,7 +160,7 @@ to only use IPv6 query transport. The \fB\-t\fR option sets the query type to -\fItype\fR. It can be any valid query type which is supported in BIND9. The default query type "A", unless the +\fItype\fR. It can be any valid query type which is supported in BIND 9. The default query type is "A", unless the \fB\-x\fR option is supplied to indicate a reverse lookup. A zone transfer can be requested by specifying a type of AXFR. When an incremental zone transfer (IXFR) is required, \fItype\fR @@ -171,11 +171,11 @@ ixfr=N. The incremental zone transfer will contain the changes made to the zone The \fB\-q\fR option sets the query name to -\fIname\fR. This useful do distingish the +\fIname\fR. This useful do distinguish the \fIname\fR from other arguments. .PP -Reverse lookups \- mapping addresses to names \- are simplified by the +Reverse lookups \(em mapping addresses to names \(em are simplified by the \fB\-x\fR option. \fIaddr\fR @@ -228,7 +228,7 @@ to negate the meaning of that keyword. Other keywords assign values to options l .PP \fB+[no]tcp\fR .RS 4 -Use [do not use] TCP when querying name servers. The default behaviour is to use UDP unless an AXFR or IXFR query is requested, in which case a TCP connection is used. +Use [do not use] TCP when querying name servers. The default behavior is to use UDP unless an AXFR or IXFR query is requested, in which case a TCP connection is used. .RE .PP \fB+[no]vc\fR @@ -330,7 +330,7 @@ makes iterative queries to resolve the name being looked up. It will follow refe .PP \fB+[no]cmd\fR .RS 4 -toggles the printing of the initial comment in the output identifying the version of +Toggles the printing of the initial comment in the output identifying the version of \fBdig\fR and the query options that have been applied. This comment is printed by default. .RE @@ -354,7 +354,7 @@ Toggle the display of comment lines in the output. The default is to print comme .PP \fB+[no]stats\fR .RS 4 -This query option toggles the printing of statistics: when the query was made, the size of the reply and so on. The default behaviour is to print the query statistics. +This query option toggles the printing of statistics: when the query was made, the size of the reply and so on. The default behavior is to print the query statistics. .RE .PP \fB+[no]qr\fR @@ -391,7 +391,7 @@ Set or clear all display flags. .RS 4 Sets the timeout for a query to \fIT\fR -seconds. The default time out is 5 seconds. An attempt to set +seconds. The default timeout is 5 seconds. An attempt to set \fIT\fR to less than 1 will result in a query timeout of 1 second being applied. .RE @@ -451,7 +451,7 @@ output. .PP \fB+[no]fail\fR .RS 4 -Do not try the next server if you receive a SERVFAIL. The default is to not try the next server which is the reverse of normal stub resolver behaviour. +Do not try the next server if you receive a SERVFAIL. The default is to not try the next server which is the reverse of normal stub resolver behavior. .RE .PP \fB+[no]besteffort\fR @@ -487,7 +487,7 @@ Requires dig be compiled with \-DDIG_SIGCHASE. .PP \fB+[no]topdown\fR .RS 4 -When chasing DNSSEC signature chains perform a top down validation. Requires dig be compiled with \-DDIG_SIGCHASE. +When chasing DNSSEC signature chains perform a top\-down validation. Requires dig be compiled with \-DDIG_SIGCHASE. .RE .SH "MULTIPLE QUERIES" .PP diff --git a/contrib/bind9/bin/dig/dig.c b/contrib/bind9/bin/dig/dig.c index dd80199..ba5d87b 100644 --- a/contrib/bind9/bin/dig/dig.c +++ b/contrib/bind9/bin/dig/dig.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dig.c,v 1.186.18.26 2006/07/21 23:52:21 marka Exp $ */ +/* $Id: dig.c,v 1.186.18.29 2007/08/28 07:19:55 tbox Exp $ */ /*! \file */ @@ -650,42 +650,6 @@ printgreeting(int argc, char **argv, dig_lookup_t *lookup) { } } -/*% - * Reorder an argument list so that server names all come at the end. - * This is a bit of a hack, to allow batch-mode processing to properly - * handle the server options. - */ -static void -reorder_args(int argc, char *argv[]) { - int i, j; - char *ptr; - int end; - - debug("reorder_args()"); - end = argc - 1; - while (argv[end][0] == '@') { - end--; - if (end == 0) - return; - } - debug("arg[end]=%s", argv[end]); - for (i = 1; i < end - 1; i++) { - if (argv[i][0] == '@') { - debug("arg[%d]=%s", i, argv[i]); - ptr = argv[i]; - for (j = i + 1; j < end; j++) { - debug("Moving %s to %d", argv[j], j - 1); - argv[j - 1] = argv[j]; - } - debug("moving %s to end, %d", ptr, end - 1); - argv[end - 1] = ptr; - end--; - if (end < 1) - return; - } - } -} - static isc_uint32_t parse_uint(char *arg, const char *desc, isc_uint32_t max) { isc_result_t result; @@ -1104,7 +1068,9 @@ static const char *single_dash_opts = "46dhimnv"; static const char *dash_opts = "46bcdfhikmnptvyx"; static isc_boolean_t dash_option(char *option, char *next, dig_lookup_t **lookup, - isc_boolean_t *open_type_class, isc_boolean_t config_only) + isc_boolean_t *open_type_class, isc_boolean_t *need_clone, + isc_boolean_t config_only, int argc, char **argv, + isc_boolean_t *firstarg) { char opt, *value, *ptr, *ptr2, *ptr3; isc_result_t result; @@ -1241,14 +1207,20 @@ dash_option(char *option, char *next, dig_lookup_t **lookup, return (value_from_next); case 'q': if (!config_only) { - (*lookup) = clone_lookup(default_lookup, - ISC_TRUE); + if (*need_clone) + (*lookup) = clone_lookup(default_lookup, + ISC_TRUE); + *need_clone = ISC_TRUE; strncpy((*lookup)->textname, value, sizeof((*lookup)->textname)); (*lookup)->textname[sizeof((*lookup)->textname)-1]=0; (*lookup)->trace_root = ISC_TF((*lookup)->trace || (*lookup)->ns_search_only); (*lookup)->new_search = ISC_TRUE; + if (*firstarg) { + printgreeting(argc, argv, *lookup); + *firstarg = ISC_FALSE; + } ISC_LIST_APPEND(lookup_list, (*lookup), link); debug("looking up %s", (*lookup)->textname); } @@ -1376,7 +1348,9 @@ dash_option(char *option, char *next, dig_lookup_t **lookup, keysecret[sizeof(keysecret)-1]=0; return (value_from_next); case 'x': - *lookup = clone_lookup(default_lookup, ISC_TRUE); + if (*need_clone) + *lookup = clone_lookup(default_lookup, ISC_TRUE); + *need_clone = ISC_TRUE; if (get_reverse(textname, sizeof(textname), value, ip6_int, ISC_FALSE) == ISC_R_SUCCESS) { strncpy((*lookup)->textname, textname, @@ -1390,6 +1364,10 @@ dash_option(char *option, char *next, dig_lookup_t **lookup, if (!(*lookup)->rdclassset) (*lookup)->rdclass = dns_rdataclass_in; (*lookup)->new_search = ISC_TRUE; + if (*firstarg) { + printgreeting(argc, argv, *lookup); + *firstarg = ISC_FALSE; + } ISC_LIST_APPEND(lookup_list, *lookup, link); } else { fprintf(stderr, "Invalid IP address %s\n", value); @@ -1481,6 +1459,8 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, char rcfile[256]; #endif char *input; + int i; + isc_boolean_t need_clone = ISC_TRUE; /* * The semantics for parsing the args is a bit complex; if @@ -1528,7 +1508,9 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, bargv[0] = argv[0]; argv0 = argv[0]; - reorder_args(bargc, (char **)bargv); + for(i = 0; i < bargc; i++) + debug(".digrc argv %d: %s", + i, bargv[i]); parse_args(ISC_TRUE, ISC_TRUE, bargc, (char **)bargv); } @@ -1537,7 +1519,12 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, #endif } - lookup = default_lookup; + if (is_batchfile && !config_only) { + /* Processing '-f batchfile'. */ + lookup = clone_lookup(default_lookup, ISC_TRUE); + need_clone = ISC_FALSE; + } else + lookup = default_lookup; rc = argc; rv = argv; @@ -1554,14 +1541,16 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, if (rc <= 1) { if (dash_option(&rv[0][1], NULL, &lookup, &open_type_class, - config_only)) { + &need_clone, config_only, + argc, argv, &firstarg)) { rc--; rv++; } } else { if (dash_option(&rv[0][1], rv[1], &lookup, &open_type_class, - config_only)) { + &need_clone, config_only, + argc, argv, &firstarg)) { rc--; rv++; } @@ -1629,21 +1618,29 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, continue; } } + if (!config_only) { - lookup = clone_lookup(default_lookup, - ISC_TRUE); + if (need_clone) + lookup = clone_lookup(default_lookup, + ISC_TRUE); + need_clone = ISC_TRUE; strncpy(lookup->textname, rv[0], sizeof(lookup->textname)); lookup->textname[sizeof(lookup->textname)-1]=0; lookup->trace_root = ISC_TF(lookup->trace || lookup->ns_search_only); lookup->new_search = ISC_TRUE; + if (firstarg) { + printgreeting(argc, argv, lookup); + firstarg = ISC_FALSE; + } ISC_LIST_APPEND(lookup_list, lookup, link); debug("looking up %s", lookup->textname); } /* XXX Error message */ } } + /* * If we have a batchfile, seed the lookup list with the * first entry, then trust the callback in dighost_shutdown @@ -1678,15 +1675,20 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, bargv[0] = argv[0]; argv0 = argv[0]; - reorder_args(bargc, (char **)bargv); + for(i = 0; i < bargc; i++) + debug("batch argv %d: %s", i, bargv[i]); parse_args(ISC_TRUE, ISC_FALSE, bargc, (char **)bargv); + return; } + return; } /* * If no lookup specified, search for root */ if ((lookup_list.head == NULL) && !config_only) { - lookup = clone_lookup(default_lookup, ISC_TRUE); + if (need_clone) + lookup = clone_lookup(default_lookup, ISC_TRUE); + need_clone = ISC_TRUE; lookup->trace_root = ISC_TF(lookup->trace || lookup->ns_search_only); lookup->new_search = ISC_TRUE; @@ -1698,10 +1700,9 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, firstarg = ISC_FALSE; } ISC_LIST_APPEND(lookup_list, lookup, link); - } else if (!config_only && firstarg) { - printgreeting(argc, argv, lookup); - firstarg = ISC_FALSE; } + if (!need_clone) + destroy_lookup(lookup); } /* @@ -1715,7 +1716,7 @@ dighost_shutdown(void) { int bargc; char *bargv[16]; char *input; - + int i; if (batchname == NULL) { isc_app_shutdown(); @@ -1743,7 +1744,8 @@ dighost_shutdown(void) { bargv[0] = argv0; - reorder_args(bargc, (char **)bargv); + for(i = 0; i < bargc; i++) + debug("batch argv %d: %s", i, bargv[i]); parse_args(ISC_TRUE, ISC_FALSE, bargc, (char **)bargv); start_lookup(); } else { @@ -1759,7 +1761,6 @@ dighost_shutdown(void) { int main(int argc, char **argv) { isc_result_t result; - dig_server_t *s, *s2; ISC_LIST_INIT(lookup_list); ISC_LIST_INIT(server_list); @@ -1780,16 +1781,7 @@ main(int argc, char **argv) { result = isc_app_onrun(mctx, global_task, onrun_callback, NULL); check_result(result, "isc_app_onrun"); isc_app_run(); - s = ISC_LIST_HEAD(default_lookup->my_server_list); - while (s != NULL) { - debug("freeing server %p belonging to %p", - s, default_lookup); - s2 = s; - s = ISC_LIST_NEXT(s, link); - ISC_LIST_DEQUEUE(default_lookup->my_server_list, s2, link); - isc_mem_free(mctx, s2); - } - isc_mem_free(mctx, default_lookup); + destroy_lookup(default_lookup); if (batchname != NULL) { if (batchfp != stdin) fclose(batchfp); diff --git a/contrib/bind9/bin/dig/dig.docbook b/contrib/bind9/bin/dig/dig.docbook index be01a86..6a28b88 100644 --- a/contrib/bind9/bin/dig/dig.docbook +++ b/contrib/bind9/bin/dig/dig.docbook @@ -5,7 +5,7 @@ - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000-2003 Internet Software Consortium. - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: dig.docbook,v 1.17.18.17 2007/01/29 23:57:20 marka Exp $ --> +<!-- $Id: dig.docbook,v 1.17.18.21 2007/08/28 07:19:55 tbox Exp $ --> <refentry id="man.dig"> <refentryinfo> @@ -104,7 +104,7 @@ arguments, it also has a batch mode of operation for reading lookup requests from a file. A brief summary of its command-line arguments and options is printed when the <option>-h</option> option is given. - Unlike earlier versions, the BIND9 implementation of + Unlike earlier versions, the BIND 9 implementation of <command>dig</command> allows multiple lookups to be issued from the command line. @@ -216,7 +216,7 @@ The default query class (IN for internet) is overridden by the <option>-c</option> option. <parameter>class</parameter> is any valid - class, such as HS for Hesiod records or CH for CHAOSNET records. + class, such as HS for Hesiod records or CH for Chaosnet records. </para> <para> @@ -225,7 +225,7 @@ in batch mode by reading a list of lookup requests to process from the file <parameter>filename</parameter>. The file contains a number of - queries, one per line. Each entry in the file should be organised in + queries, one per line. Each entry in the file should be organized in the same way they would be presented as queries to <command>dig</command> using the command-line interface. </para> @@ -251,7 +251,7 @@ The <option>-t</option> option sets the query type to <parameter>type</parameter>. It can be any valid query type which is - supported in BIND9. The default query type "A", unless the + supported in BIND 9. The default query type is "A", unless the <option>-x</option> option is supplied to indicate a reverse lookup. A zone transfer can be requested by specifying a type of AXFR. When an incremental zone transfer (IXFR) is required, @@ -263,12 +263,12 @@ <para> The <option>-q</option> option sets the query name to - <parameter>name</parameter>. This useful do distingish the + <parameter>name</parameter>. This useful do distinguish the <parameter>name</parameter> from other arguments. </para> <para> - Reverse lookups - mapping addresses to names - are simplified by the + Reverse lookups — mapping addresses to names — are simplified by the <option>-x</option> option. <parameter>addr</parameter> is an IPv4 address in dotted-decimal notation, or a colon-delimited IPv6 address. @@ -343,7 +343,7 @@ <listitem> <para> Use [do not use] TCP when querying name servers. The default - behaviour is to use UDP unless an AXFR or IXFR query is + behavior is to use UDP unless an AXFR or IXFR query is requested, in which case a TCP connection is used. </para> @@ -536,7 +536,7 @@ <term><option>+[no]cmd</option></term> <listitem> <para> - toggles the printing of the initial comment in the output + Toggles the printing of the initial comment in the output identifying the version of <command>dig</command> and the query options that have @@ -588,7 +588,7 @@ This query option toggles the printing of statistics: when the query was made, the size of the reply and so on. The default - behaviour is + behavior is to print the query statistics. </para> </listitem> @@ -662,8 +662,8 @@ <para> Sets the timeout for a query to - <parameter>T</parameter> seconds. The default time - out is 5 seconds. + <parameter>T</parameter> seconds. The default + timeout is 5 seconds. An attempt to set <parameter>T</parameter> to less than 1 will result in a query timeout of 1 second being applied. @@ -763,7 +763,7 @@ default is to not try the next server which is the reverse of normal stub resolver - behaviour. + behavior. </para> </listitem> </varlistentry> @@ -822,7 +822,7 @@ <term><option>+[no]topdown</option></term> <listitem> <para> - When chasing DNSSEC signature chains perform a top down + When chasing DNSSEC signature chains perform a top-down validation. Requires dig be compiled with -DDIG_SIGCHASE. </para> diff --git a/contrib/bind9/bin/dig/dig.html b/contrib/bind9/bin/dig/dig.html index 945a896..afdaa4f 100644 --- a/contrib/bind9/bin/dig/dig.html +++ b/contrib/bind9/bin/dig/dig.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: dig.html,v 1.13.18.25 2007/01/30 00:23:44 marka Exp $ --> +<!-- $Id: dig.html,v 1.13.18.28 2007/05/16 06:11:27 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -50,7 +50,7 @@ arguments, it also has a batch mode of operation for reading lookup requests from a file. A brief summary of its command-line arguments and options is printed when the <code class="option">-h</code> option is given. - Unlike earlier versions, the BIND9 implementation of + Unlike earlier versions, the BIND 9 implementation of <span><strong class="command">dig</strong></span> allows multiple lookups to be issued from the command line. @@ -139,7 +139,7 @@ The default query class (IN for internet) is overridden by the <code class="option">-c</code> option. <em class="parameter"><code>class</code></em> is any valid - class, such as HS for Hesiod records or CH for CHAOSNET records. + class, such as HS for Hesiod records or CH for Chaosnet records. </p> <p> The <code class="option">-f</code> option makes <span><strong class="command">dig </strong></span> @@ -147,7 +147,7 @@ in batch mode by reading a list of lookup requests to process from the file <em class="parameter"><code>filename</code></em>. The file contains a number of - queries, one per line. Each entry in the file should be organised in + queries, one per line. Each entry in the file should be organized in the same way they would be presented as queries to <span><strong class="command">dig</strong></span> using the command-line interface. </p> @@ -170,7 +170,7 @@ The <code class="option">-t</code> option sets the query type to <em class="parameter"><code>type</code></em>. It can be any valid query type which is - supported in BIND9. The default query type "A", unless the + supported in BIND 9. The default query type is "A", unless the <code class="option">-x</code> option is supplied to indicate a reverse lookup. A zone transfer can be requested by specifying a type of AXFR. When an incremental zone transfer (IXFR) is required, @@ -181,11 +181,11 @@ </p> <p> The <code class="option">-q</code> option sets the query name to - <em class="parameter"><code>name</code></em>. This useful do distingish the + <em class="parameter"><code>name</code></em>. This useful do distinguish the <em class="parameter"><code>name</code></em> from other arguments. </p> <p> - Reverse lookups - mapping addresses to names - are simplified by the + Reverse lookups — mapping addresses to names — are simplified by the <code class="option">-x</code> option. <em class="parameter"><code>addr</code></em> is an IPv4 address in dotted-decimal notation, or a colon-delimited IPv6 address. @@ -249,7 +249,7 @@ <dt><span class="term"><code class="option">+[no]tcp</code></span></dt> <dd><p> Use [do not use] TCP when querying name servers. The default - behaviour is to use UDP unless an AXFR or IXFR query is + behavior is to use UDP unless an AXFR or IXFR query is requested, in which case a TCP connection is used. </p></dd> @@ -362,7 +362,7 @@ </p></dd> <dt><span class="term"><code class="option">+[no]cmd</code></span></dt> <dd><p> - toggles the printing of the initial comment in the output + Toggles the printing of the initial comment in the output identifying the version of <span><strong class="command">dig</strong></span> and the query options that have @@ -394,7 +394,7 @@ This query option toggles the printing of statistics: when the query was made, the size of the reply and so on. The default - behaviour is + behavior is to print the query statistics. </p></dd> <dt><span class="term"><code class="option">+[no]qr</code></span></dt> @@ -433,8 +433,8 @@ <dd><p> Sets the timeout for a query to - <em class="parameter"><code>T</code></em> seconds. The default time - out is 5 seconds. + <em class="parameter"><code>T</code></em> seconds. The default + timeout is 5 seconds. An attempt to set <em class="parameter"><code>T</code></em> to less than 1 will result in a query timeout of 1 second being applied. @@ -499,7 +499,7 @@ default is to not try the next server which is the reverse of normal stub resolver - behaviour. + behavior. </p></dd> <dt><span class="term"><code class="option">+[no]besteffort</code></span></dt> <dd><p> @@ -535,7 +535,7 @@ </dd> <dt><span class="term"><code class="option">+[no]topdown</code></span></dt> <dd><p> - When chasing DNSSEC signature chains perform a top down + When chasing DNSSEC signature chains perform a top-down validation. Requires dig be compiled with -DDIG_SIGCHASE. </p></dd> diff --git a/contrib/bind9/bin/dig/dighost.c b/contrib/bind9/bin/dig/dighost.c index 2e950a4..6e7c16b 100644 --- a/contrib/bind9/bin/dig/dighost.c +++ b/contrib/bind9/bin/dig/dighost.c @@ -2,7 +2,7 @@ * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dighost.c,v 1.259.18.39 2007/02/14 23:45:43 marka Exp $ */ +/* $Id: dighost.c,v 1.259.18.43 2007/08/28 07:19:55 tbox Exp $ */ /*! \file * \note @@ -144,6 +144,7 @@ static idn_result_t append_textname(char *name, const char *origin, static void idn_check_result(idn_result_t r, const char *msg); #define MAXDLEN 256 +int idnoptions = 0; #endif /*% @@ -1275,9 +1276,7 @@ clear_query(dig_query_t *query) { */ static isc_boolean_t try_clear_lookup(dig_lookup_t *lookup) { - dig_server_t *s; dig_query_t *q; - void *ptr; REQUIRE(lookup != NULL); @@ -1298,7 +1297,16 @@ try_clear_lookup(dig_lookup_t *lookup) { * At this point, we know there are no queries on the lookup, * so can make it go away also. */ - debug("cleared"); + destroy_lookup(lookup); + return (ISC_TRUE); +} + +void +destroy_lookup(dig_lookup_t *lookup) { + dig_server_t *s; + void *ptr; + + debug("destroy"); s = ISC_LIST_HEAD(lookup->my_server_list); while (s != NULL) { debug("freeing server %p belonging to %p", s, lookup); @@ -1323,7 +1331,6 @@ try_clear_lookup(dig_lookup_t *lookup) { dst_context_destroy(&lookup->tsigctx); isc_mem_free(mctx, lookup); - return (ISC_TRUE); } /*% @@ -1816,7 +1823,7 @@ setup_lookup(dig_lookup_t *lookup) { sizeof(utf8_textname)); idn_check_result(mr, "append origin to textname"); } - mr = idn_encodename(IDN_LOCALMAP | IDN_NAMEPREP | IDN_ASCCHECK | + mr = idn_encodename(idnoptions | IDN_LOCALMAP | IDN_NAMEPREP | IDN_IDNCONV | IDN_LENCHECK, utf8_textname, idn_textname, sizeof(idn_textname)); idn_check_result(mr, "convert UTF-8 textname to IDN encoding"); @@ -3891,7 +3898,7 @@ get_trusted_key(isc_mem_t *mctx) filename); return (ISC_R_FAILURE); } - while (fgets(buf, 1500, fp) != NULL) { + while (fgets(buf, sizeof(buf), fp) != NULL) { result = opentmpkey(mctx,"tmp_file", &filetemp, &fptemp); if (result != ISC_R_SUCCESS) { fclose(fp); diff --git a/contrib/bind9/bin/dig/host.1 b/contrib/bind9/bin/dig/host.1 index 3149fc6..ee537bd 100644 --- a/contrib/bind9/bin/dig/host.1 +++ b/contrib/bind9/bin/dig/host.1 @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: host.1,v 1.14.18.13 2007/01/30 00:23:44 marka Exp $ +.\" $Id: host.1,v 1.14.18.14 2007/05/09 03:33:12 marka Exp $ .\" .hy 0 .ad l @@ -130,7 +130,7 @@ makes. This should mean that the name server receiving the query will not attemp \fB\-r\fR option enables \fBhost\fR -to mimic the behaviour of a name server by making non\-recursive queries and expecting to receive answers to those queries that are usually referrals to other name servers. +to mimic the behavior of a name server by making non\-recursive queries and expecting to receive answers to those queries that are usually referrals to other name servers. .PP By default \fBhost\fR @@ -152,7 +152,7 @@ The \fB\-t\fR option is used to select the query type. \fItype\fR -can be any recognised query type: CNAME, NS, SOA, SIG, KEY, AXFR, etc. When no query type is specified, +can be any recognized query type: CNAME, NS, SOA, SIG, KEY, AXFR, etc. When no query type is specified, \fBhost\fR automatically selects an appropriate query type. By default it looks for A records, but if the \fB\-C\fR @@ -185,7 +185,7 @@ The option tells \fBhost\fR \fInot\fR -to send the query to the next nameserver if any server responds with a SERVFAIL response, which is the reverse of normal stub resolver behaviour. +to send the query to the next nameserver if any server responds with a SERVFAIL response, which is the reverse of normal stub resolver behavior. .PP The \fB\-m\fR diff --git a/contrib/bind9/bin/dig/host.c b/contrib/bind9/bin/dig/host.c index f73145c..33025d5 100644 --- a/contrib/bind9/bin/dig/host.c +++ b/contrib/bind9/bin/dig/host.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,13 +15,25 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: host.c,v 1.94.18.14 2006/05/23 04:40:42 marka Exp $ */ +/* $Id: host.c,v 1.94.18.19 2007/08/28 07:19:55 tbox Exp $ */ /*! \file */ #include <config.h> +#include <stdlib.h> #include <limits.h> +#ifdef HAVE_LOCALE_H +#include <locale.h> +#endif + +#ifdef WITH_IDN +#include <idn/result.h> +#include <idn/log.h> +#include <idn/resconf.h> +#include <idn/api.h> +#endif + #include <isc/app.h> #include <isc/commandline.h> #include <isc/netaddr.h> @@ -414,8 +426,10 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) { if (msg->rcode != 0) { char namestr[DNS_NAME_FORMATSIZE]; dns_name_format(query->lookup->name, namestr, sizeof(namestr)); - printf("Host %s not found: %d(%s)\n", namestr, - msg->rcode, rcodetext[msg->rcode]); + printf("Host %s not found: %d(%s)\n", + (msg->rcode != dns_rcode_nxdomain) ? namestr : + query->lookup->textname, msg->rcode, + rcodetext[msg->rcode]); return (ISC_R_SUCCESS); } @@ -569,6 +583,7 @@ pre_parse_args(int argc, char **argv) { while ((c = isc_commandline_parse(argc, argv, optstring)) != -1) { switch (c) { case 'm': + memdebugging = ISC_TRUE; if (strcasecmp("trace", isc_commandline_argument) == 0) isc_mem_debugging |= ISC_MEM_DEBUGTRACE; else if (!strcasecmp("record", @@ -664,6 +679,9 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { lookup->rdtype != dns_rdatatype_axfr) lookup->rdtype = rdtype; lookup->rdtypeset = ISC_TRUE; +#ifdef WITH_IDN + idnoptions = 0; +#endif if (rdtype == dns_rdatatype_axfr) { /* -l -t any -v */ list_type = dns_rdatatype_any; @@ -672,6 +690,13 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { } else if (rdtype == dns_rdatatype_ixfr) { lookup->ixfr_serial = serial; list_type = rdtype; +#ifdef WITH_IDN + } else if (rdtype == dns_rdatatype_a || + rdtype == dns_rdatatype_aaaa || + rdtype == dns_rdatatype_mx) { + idnoptions = IDN_ASCCHECK; + list_type = rdtype; +#endif } else list_type = rdtype; list_addresses = ISC_FALSE; @@ -814,6 +839,9 @@ main(int argc, char **argv) { ISC_LIST_INIT(search_list); fatalexit = 1; +#ifdef WITH_IDN + idnoptions = IDN_ASCCHECK; +#endif debug("main()"); progname = argv[0]; diff --git a/contrib/bind9/bin/dig/host.docbook b/contrib/bind9/bin/dig/host.docbook index 09a306c..8ab7679 100644 --- a/contrib/bind9/bin/dig/host.docbook +++ b/contrib/bind9/bin/dig/host.docbook @@ -5,7 +5,7 @@ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000-2002 Internet Software Consortium. - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: host.docbook,v 1.5.18.9 2007/01/29 23:57:20 marka Exp $ --> +<!-- $Id: host.docbook,v 1.5.18.11 2007/08/28 07:19:55 tbox Exp $ --> <refentry id="man.host"> <refentryinfo> @@ -173,7 +173,7 @@ attempt to resolve <parameter>name</parameter>. The <option>-r</option> option enables <command>host</command> to mimic - the behaviour of a name server by making non-recursive queries and + the behavior of a name server by making non-recursive queries and expecting to receive answers to those queries that are usually referrals to other name servers. </para> @@ -194,7 +194,7 @@ <para> The <option>-t</option> option is used to select the query type. - <parameter>type</parameter> can be any recognised query + <parameter>type</parameter> can be any recognized query type: CNAME, NS, SOA, SIG, KEY, AXFR, etc. When no query type is specified, <command>host</command> automatically selects an appropriate @@ -227,7 +227,7 @@ The <option>-s</option> option tells <command>host</command> <emphasis>not</emphasis> to send the query to the next nameserver if any server responds with a SERVFAIL response, which is the - reverse of normal stub resolver behaviour. + reverse of normal stub resolver behavior. </para> <para> diff --git a/contrib/bind9/bin/dig/host.html b/contrib/bind9/bin/dig/host.html index b370769..adc9883 100644 --- a/contrib/bind9/bin/dig/host.html +++ b/contrib/bind9/bin/dig/host.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: host.html,v 1.7.18.19 2007/01/30 00:23:44 marka Exp $ --> +<!-- $Id: host.html,v 1.7.18.20 2007/05/09 03:33:12 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -125,7 +125,7 @@ attempt to resolve <em class="parameter"><code>name</code></em>. The <code class="option">-r</code> option enables <span><strong class="command">host</strong></span> to mimic - the behaviour of a name server by making non-recursive queries and + the behavior of a name server by making non-recursive queries and expecting to receive answers to those queries that are usually referrals to other name servers. </p> @@ -143,7 +143,7 @@ </p> <p> The <code class="option">-t</code> option is used to select the query type. - <em class="parameter"><code>type</code></em> can be any recognised query + <em class="parameter"><code>type</code></em> can be any recognized query type: CNAME, NS, SOA, SIG, KEY, AXFR, etc. When no query type is specified, <span><strong class="command">host</strong></span> automatically selects an appropriate @@ -174,7 +174,7 @@ The <code class="option">-s</code> option tells <span><strong class="command">host</strong></span> <span class="emphasis"><em>not</em></span> to send the query to the next nameserver if any server responds with a SERVFAIL response, which is the - reverse of normal stub resolver behaviour. + reverse of normal stub resolver behavior. </p> <p> The <code class="option">-m</code> can be used to set the memory usage debugging diff --git a/contrib/bind9/bin/dig/include/dig/dig.h b/contrib/bind9/bin/dig/include/dig/dig.h index 675bb15..02ae4d2 100644 --- a/contrib/bind9/bin/dig/include/dig/dig.h +++ b/contrib/bind9/bin/dig/include/dig/dig.h @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dig.h,v 1.82.18.19 2006/12/07 06:08:02 marka Exp $ */ +/* $Id: dig.h,v 1.82.18.23 2007/08/28 07:19:55 tbox Exp $ */ #ifndef DIG_H #define DIG_H @@ -277,6 +277,9 @@ extern isc_boolean_t debugging, memdebugging; extern char *progname; extern int tries; extern int fatalexit; +#ifdef WITH_IDN +extern int idnoptions; +#endif /* * Routines in dighost.c. @@ -301,6 +304,9 @@ void setup_lookup(dig_lookup_t *lookup); void +destroy_lookup(dig_lookup_t *lookup); + +void do_lookup(dig_lookup_t *lookup); void diff --git a/contrib/bind9/bin/dig/nslookup.1 b/contrib/bind9/bin/dig/nslookup.1 index f941e9b..a453c2f 100644 --- a/contrib/bind9/bin/dig/nslookup.1 +++ b/contrib/bind9/bin/dig/nslookup.1 @@ -12,7 +12,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: nslookup.1,v 1.1.10.12 2007/01/30 00:23:44 marka Exp $ +.\" $Id: nslookup.1,v 1.1.10.14 2007/05/16 06:11:27 marka Exp $ .\" .hy 0 .ad l @@ -158,7 +158,7 @@ The class specifies the protocol group of the information. .PP \fB \fR\fB\fI[no]\fR\fR\fBdebug\fR .RS 4 -Turn debugging mode on. A lot more information is printed about the packet sent to the server and the resulting answer. +Turn on or off the display of the full response packet and any intermediate response packets when searching. .sp (Default = nodebug; abbreviation = [no]deb) @@ -166,7 +166,7 @@ Turn debugging mode on. A lot more information is printed about the packet sent .PP \fB \fR\fB\fI[no]\fR\fR\fBd2\fR .RS 4 -Turn debugging mode on. A lot more information is printed about the packet sent to the server and the resulting answer. +Turn debugging mode on or off. This displays more about what nslookup is doing. .sp (Default = nod2) .RE diff --git a/contrib/bind9/bin/dig/nslookup.c b/contrib/bind9/bin/dig/nslookup.c index e2310af..3327c6e 100644 --- a/contrib/bind9/bin/dig/nslookup.c +++ b/contrib/bind9/bin/dig/nslookup.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: nslookup.c,v 1.101.18.12 2006/12/07 06:08:02 marka Exp $ */ +/* $Id: nslookup.c,v 1.101.18.15 2007/08/28 07:19:55 tbox Exp $ */ #include <config.h> @@ -410,8 +410,9 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) { char nametext[DNS_NAME_FORMATSIZE]; dns_name_format(query->lookup->name, nametext, sizeof(nametext)); - printf("** server can't find %s: %s\n", nametext, - rcodetext[msg->rcode]); + printf("** server can't find %s: %s\n", + (msg->rcode != dns_rcode_nxdomain) ? nametext : + query->lookup->textname, rcodetext[msg->rcode]); debug("returning with rcode == 0"); return (ISC_R_SUCCESS); } diff --git a/contrib/bind9/bin/dig/nslookup.docbook b/contrib/bind9/bin/dig/nslookup.docbook index c989b73..dff5fa3 100644 --- a/contrib/bind9/bin/dig/nslookup.docbook +++ b/contrib/bind9/bin/dig/nslookup.docbook @@ -4,7 +4,7 @@ <!-- - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -17,7 +17,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: nslookup.docbook,v 1.4.2.10 2007/01/29 23:57:20 marka Exp $ --> +<!-- $Id: nslookup.docbook,v 1.4.2.13 2007/08/28 07:19:55 tbox Exp $ --> <!-- - Copyright (c) 1985, 1989 - The Regents of the University of California. All rights reserved. @@ -314,9 +314,8 @@ nslookup -query=hinfo -timeout=10 <replaceable><optional>no</optional></replaceable>debug</constant></term> <listitem> <para> - Turn debugging mode on. A lot more information is - printed about the packet sent to the server and the - resulting answer. + Turn on or off the display of the full response packet and + any intermediate response packets when searching. </para> <para> (Default = nodebug; abbreviation = <optional>no</optional>deb) @@ -329,9 +328,8 @@ nslookup -query=hinfo -timeout=10 <replaceable><optional>no</optional></replaceable>d2</constant></term> <listitem> <para> - Turn debugging mode on. A lot more information is - printed about the packet sent to the server and the - resulting answer. + Turn debugging mode on or off. This displays more about + what nslookup is doing. </para> <para> (Default = nod2) diff --git a/contrib/bind9/bin/dig/nslookup.html b/contrib/bind9/bin/dig/nslookup.html index 07f8c3e..46ae43c 100644 --- a/contrib/bind9/bin/dig/nslookup.html +++ b/contrib/bind9/bin/dig/nslookup.html @@ -13,7 +13,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: nslookup.html,v 1.1.10.19 2007/01/30 00:23:44 marka Exp $ --> +<!-- $Id: nslookup.html,v 1.1.10.21 2007/05/16 06:11:27 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -180,9 +180,8 @@ nslookup -query=hinfo -timeout=10 <em class="replaceable"><code>[<span class="optional">no</span>]</code></em>debug</code></span></dt> <dd> <p> - Turn debugging mode on. A lot more information is - printed about the packet sent to the server and the - resulting answer. + Turn on or off the display of the full response packet and + any intermediate response packets when searching. </p> <p> (Default = nodebug; abbreviation = [<span class="optional">no</span>]deb) @@ -192,9 +191,8 @@ nslookup -query=hinfo -timeout=10 <em class="replaceable"><code>[<span class="optional">no</span>]</code></em>d2</code></span></dt> <dd> <p> - Turn debugging mode on. A lot more information is - printed about the packet sent to the server and the - resulting answer. + Turn debugging mode on or off. This displays more about + what nslookup is doing. </p> <p> (Default = nod2) diff --git a/contrib/bind9/bin/dnssec/dnssec-keygen.8 b/contrib/bind9/bin/dnssec/dnssec-keygen.8 index 39762fd..542190b 100644 --- a/contrib/bind9/bin/dnssec/dnssec-keygen.8 +++ b/contrib/bind9/bin/dnssec/dnssec-keygen.8 @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dnssec-keygen.8,v 1.23.18.13 2007/01/30 00:23:44 marka Exp $ +.\" $Id: dnssec-keygen.8,v 1.23.18.14 2007/05/09 03:33:12 marka Exp $ .\" .hy 0 .ad l @@ -37,7 +37,7 @@ dnssec\-keygen \- DNSSEC key generation tool .SH "DESCRIPTION" .PP \fBdnssec\-keygen\fR -generates keys for DNSSEC (Secure DNS), as defined in RFC 2535 and RFC <TBA\\>. It can also generate keys for use with TSIG (Transaction Signatures), as defined in RFC 2845. +generates keys for DNSSEC (Secure DNS), as defined in RFC 2535 and RFC 4034. It can also generate keys for use with TSIG (Transaction Signatures), as defined in RFC 2845. .SH "OPTIONS" .PP \-a \fIalgorithm\fR @@ -147,7 +147,7 @@ is the numeric representation of the algorithm. is the key identifier (or footprint). .PP \fBdnssec\-keygen\fR -creates two file, with names based on the printed string. +creates two files, with names based on the printed string. \fIKnnnn.+aaa+iiiii.key\fR contains the public key, and \fIKnnnn.+aaa+iiiii.private\fR @@ -159,13 +159,13 @@ file contains a DNS KEY record that can be inserted into a zone file (directly o .PP The \fI.private\fR -file contains algorithm specific fields. For obvious security reasons, this file does not have general read permission. +file contains algorithm\-specific fields. For obvious security reasons, this file does not have general read permission. .PP Both \fI.key\fR and \fI.private\fR -files are generated for symmetric encryption algorithm such as HMAC\-MD5, even though the public and private key are equivalent. +files are generated for symmetric encryption algorithms such as HMAC\-MD5, even though the public and private key are equivalent. .SH "EXAMPLE" .PP To generate a 768\-bit DSA key for the domain @@ -182,7 +182,7 @@ In this example, creates the files \fIKexample.com.+003+26160.key\fR and -\fIKexample.com.+003+26160.private\fR +\fIKexample.com.+003+26160.private\fR. .SH "SEE ALSO" .PP \fBdnssec\-signzone\fR(8), diff --git a/contrib/bind9/bin/dnssec/dnssec-keygen.c b/contrib/bind9/bin/dnssec/dnssec-keygen.c index 19087ea..0b57f6d 100644 --- a/contrib/bind9/bin/dnssec/dnssec-keygen.c +++ b/contrib/bind9/bin/dnssec/dnssec-keygen.c @@ -3,7 +3,7 @@ * Portions Copyright (C) 1999-2003 Internet Software Consortium. * Portions Copyright (C) 1995-2000 by Network Associates, Inc. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -16,7 +16,7 @@ * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dnssec-keygen.c,v 1.66.18.9 2007/01/18 00:06:11 marka Exp $ */ +/* $Id: dnssec-keygen.c,v 1.66.18.10 2007/08/28 07:19:55 tbox Exp $ */ /*! \file */ diff --git a/contrib/bind9/bin/dnssec/dnssec-keygen.docbook b/contrib/bind9/bin/dnssec/dnssec-keygen.docbook index cc5f1e7..8e81cb4 100644 --- a/contrib/bind9/bin/dnssec/dnssec-keygen.docbook +++ b/contrib/bind9/bin/dnssec/dnssec-keygen.docbook @@ -5,7 +5,7 @@ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000-2003 Internet Software Consortium. - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: dnssec-keygen.docbook,v 1.7.18.9 2007/01/29 23:57:20 marka Exp $ --> +<!-- $Id: dnssec-keygen.docbook,v 1.7.18.11 2007/08/28 07:20:00 tbox Exp $ --> <refentry id="man.dnssec-keygen"> <refentryinfo> <date>June 30, 2000</date> @@ -76,7 +76,7 @@ <title>DESCRIPTION</title> <para><command>dnssec-keygen</command> generates keys for DNSSEC (Secure DNS), as defined in RFC 2535 - and RFC <TBA\>. It can also generate keys for use with + and RFC 4034. It can also generate keys for use with TSIG (Transaction Signatures), as defined in RFC 2845. </para> </refsect1> @@ -286,7 +286,7 @@ </listitem> </itemizedlist> <para><command>dnssec-keygen</command> - creates two file, with names based + creates two files, with names based on the printed string. <filename>Knnnn.+aaa+iiiii.key</filename> contains the public key, and <filename>Knnnn.+aaa+iiiii.private</filename> contains the @@ -300,14 +300,14 @@ statement). </para> <para> - The <filename>.private</filename> file contains algorithm - specific + The <filename>.private</filename> file contains + algorithm-specific fields. For obvious security reasons, this file does not have general read permission. </para> <para> Both <filename>.key</filename> and <filename>.private</filename> - files are generated for symmetric encryption algorithm such as + files are generated for symmetric encryption algorithms such as HMAC-MD5, even though the public and private key are equivalent. </para> </refsect1> @@ -330,7 +330,7 @@ In this example, <command>dnssec-keygen</command> creates the files <filename>Kexample.com.+003+26160.key</filename> and - <filename>Kexample.com.+003+26160.private</filename> + <filename>Kexample.com.+003+26160.private</filename>. </para> </refsect1> diff --git a/contrib/bind9/bin/dnssec/dnssec-keygen.html b/contrib/bind9/bin/dnssec/dnssec-keygen.html index 5229868..7ad747f 100644 --- a/contrib/bind9/bin/dnssec/dnssec-keygen.html +++ b/contrib/bind9/bin/dnssec/dnssec-keygen.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: dnssec-keygen.html,v 1.9.18.19 2007/01/30 00:23:44 marka Exp $ --> +<!-- $Id: dnssec-keygen.html,v 1.9.18.20 2007/05/09 03:33:12 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -35,7 +35,7 @@ <a name="id2543474"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">dnssec-keygen</strong></span> generates keys for DNSSEC (Secure DNS), as defined in RFC 2535 - and RFC <TBA\>. It can also generate keys for use with + and RFC 4034. It can also generate keys for use with TSIG (Transaction Signatures), as defined in RFC 2845. </p> </div> @@ -168,7 +168,7 @@ </p></li> </ul></div> <p><span><strong class="command">dnssec-keygen</strong></span> - creates two file, with names based + creates two files, with names based on the printed string. <code class="filename">Knnnn.+aaa+iiiii.key</code> contains the public key, and <code class="filename">Knnnn.+aaa+iiiii.private</code> contains the @@ -182,14 +182,14 @@ statement). </p> <p> - The <code class="filename">.private</code> file contains algorithm - specific + The <code class="filename">.private</code> file contains + algorithm-specific fields. For obvious security reasons, this file does not have general read permission. </p> <p> Both <code class="filename">.key</code> and <code class="filename">.private</code> - files are generated for symmetric encryption algorithm such as + files are generated for symmetric encryption algorithms such as HMAC-MD5, even though the public and private key are equivalent. </p> </div> @@ -211,7 +211,7 @@ In this example, <span><strong class="command">dnssec-keygen</strong></span> creates the files <code class="filename">Kexample.com.+003+26160.key</code> and - <code class="filename">Kexample.com.+003+26160.private</code> + <code class="filename">Kexample.com.+003+26160.private</code>. </p> </div> <div class="refsect1" lang="en"> diff --git a/contrib/bind9/bin/dnssec/dnssec-signzone.8 b/contrib/bind9/bin/dnssec/dnssec-signzone.8 index 86347b1..d150c3f 100644 --- a/contrib/bind9/bin/dnssec/dnssec-signzone.8 +++ b/contrib/bind9/bin/dnssec/dnssec-signzone.8 @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dnssec-signzone.8,v 1.28.18.16 2007/01/30 00:23:44 marka Exp $ +.\" $Id: dnssec-signzone.8,v 1.28.18.17 2007/05/09 03:33:12 marka Exp $ .\" .hy 0 .ad l @@ -95,7 +95,7 @@ is specified, 30 days from the start time is used as a default. .RS 4 The name of the output file containing the signed zone. The default is to append \fI.signed\fR -to the input file. +to the input filename. .RE .PP \-h @@ -106,7 +106,7 @@ Prints a short summary of the options and arguments to .PP \-i \fIinterval\fR .RS 4 -When a previously signed zone is passed as input, records may be resigned. The +When a previously\-signed zone is passed as input, records may be resigned. The \fBinterval\fR option specifies the cycle interval as an offset from the current time (in seconds). If a RRSIG record expires after the cycle interval, it is retained. Otherwise, it is considered to be expiring soon, and it will be replaced. .sp @@ -129,7 +129,7 @@ The format of the input zone file. Possible formats are .PP \-j \fIjitter\fR .RS 4 -When signing a zone with a fixed signature lifetime, all RRSIG records issued at the time of signing expires simultaneously. If the zone is incrementally signed, i.e. a previously signed zone is passed as input to the signer, all expired signatures has to be regenerated at about the same time. The +When signing a zone with a fixed signature lifetime, all RRSIG records issued at the time of signing expires simultaneously. If the zone is incrementally signed, i.e. a previously\-signed zone is passed as input to the signer, all expired signatures have to be regenerated at about the same time. The \fBjitter\fR option specifies a jitter window that will be used to randomize the signature expire time, thus spreading incremental signature regeneration over time. .sp @@ -219,29 +219,44 @@ The file containing the zone to be signed. .PP key .RS 4 -The keys used to sign the zone. If no keys are specified, the default all zone keys that have private key files in the current directory. +Specify which keys should be used to sign the zone. If no keys are specified, then the zone will be examined for DNSKEY records at the zone apex. If these are found and there are matching private keys, in the current directory, then these will be used for signing. .RE .SH "EXAMPLE" .PP The following command signs the \fBexample.com\fR -zone with the DSA key generated in the +zone with the DSA key generated by \fBdnssec\-keygen\fR -man page. The zone's keys must be in the zone. If there are +(Kexample.com.+003+17247). The zone's keys must be in the master file (\fIdb.example.com\fR). This invocation looks for \fIkeyset\fR -files associated with child zones, they must be in the current directory. -\fBexample.com\fR, the following command would be issued: -.PP -\fBdnssec\-signzone \-o example.com db.example.com Kexample.com.+003+26160\fR -.PP -The command would print a string of the form: +files, in the current directory, so that DS records can be generated from them (\fB\-g\fR). +.sp +.RS 4 +.nf +% dnssec\-signzone \-g \-o example.com db.example.com \\ +Kexample.com.+003+17247 +db.example.com.signed +% +.fi +.RE .PP -In this example, +In the above example, \fBdnssec\-signzone\fR creates the file \fIdb.example.com.signed\fR. This file should be referenced in a zone statement in a \fInamed.conf\fR file. +.PP +This example re\-signs a previously signed zone with default parameters. The private keys are assumed to be in the current directory. +.sp +.RS 4 +.nf +% cp db.example.com.signed db.example.com +% dnssec\-signzone \-o example.com db.example.com +db.example.com.signed +% +.fi +.RE .SH "SEE ALSO" .PP \fBdnssec\-keygen\fR(8), diff --git a/contrib/bind9/bin/dnssec/dnssec-signzone.c b/contrib/bind9/bin/dnssec/dnssec-signzone.c index 1f5b538..46cd4a7 100644 --- a/contrib/bind9/bin/dnssec/dnssec-signzone.c +++ b/contrib/bind9/bin/dnssec/dnssec-signzone.c @@ -1,9 +1,9 @@ /* - * Portions Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Portions Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Portions Copyright (C) 1999-2003 Internet Software Consortium. * Portions Copyright (C) 1995-2000 by Network Associates, Inc. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -16,7 +16,7 @@ * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dnssec-signzone.c,v 1.177.18.21 2006/08/30 23:01:54 marka Exp $ */ +/* $Id: dnssec-signzone.c,v 1.177.18.24 2007/08/28 07:20:00 tbox Exp $ */ /*! \file */ @@ -1481,7 +1481,7 @@ loadzonekeys(dns_db_t *db) { for (i = 0; i < nkeys; i++) { signer_key_t *key; - key = newkeystruct(keys[i], ISC_TRUE); + key = newkeystruct(keys[i], dst_key_isprivate(keys[i])); ISC_LIST_APPEND(keylist, key, link); } dns_db_detachnode(db, &node); diff --git a/contrib/bind9/bin/dnssec/dnssec-signzone.docbook b/contrib/bind9/bin/dnssec/dnssec-signzone.docbook index 371d72b..8d92831 100644 --- a/contrib/bind9/bin/dnssec/dnssec-signzone.docbook +++ b/contrib/bind9/bin/dnssec/dnssec-signzone.docbook @@ -5,7 +5,7 @@ - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000-2003 Internet Software Consortium. - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: dnssec-signzone.docbook,v 1.10.18.15 2007/01/29 23:57:20 marka Exp $ --> +<!-- $Id: dnssec-signzone.docbook,v 1.10.18.17 2007/08/28 07:20:00 tbox Exp $ --> <refentry id="man.dnssec-signzone"> <refentryinfo> <date>June 30, 2000</date> @@ -193,7 +193,7 @@ The name of the output file containing the signed zone. The default is to append <filename>.signed</filename> to the - input file. + input filename. </para> </listitem> </varlistentry> @@ -212,7 +212,7 @@ <term>-i <replaceable class="parameter">interval</replaceable></term> <listitem> <para> - When a previously signed zone is passed as input, records + When a previously-signed zone is passed as input, records may be resigned. The <option>interval</option> option specifies the cycle interval as an offset from the current time (in seconds). If a RRSIG record expires after the @@ -256,8 +256,8 @@ When signing a zone with a fixed signature lifetime, all RRSIG records issued at the time of signing expires simultaneously. If the zone is incrementally signed, i.e. - a previously signed zone is passed as input to the signer, - all expired signatures has to be regenerated at about the + a previously-signed zone is passed as input to the signer, + all expired signatures have to be regenerated at about the same time. The <option>jitter</option> option specifies a jitter window that will be used to randomize the signature expire time, thus spreading incremental signature @@ -411,9 +411,11 @@ <term>key</term> <listitem> <para> - The keys used to sign the zone. If no keys are specified, the - default all zone keys that have private key files in the - current directory. + Specify which keys should be used to sign the zone. If + no keys are specified, then the zone will be examined + for DNSKEY records at the zone apex. If these are found and + there are matching private keys, in the current directory, + then these will be used for signing. </para> </listitem> </varlistentry> @@ -425,27 +427,30 @@ <title>EXAMPLE</title> <para> The following command signs the <userinput>example.com</userinput> - zone with the DSA key generated in the <command>dnssec-keygen</command> - man page. The zone's keys must be in the zone. If there are - <filename>keyset</filename> files associated with child - zones, - they must be in the current directory. - <userinput>example.com</userinput>, the following command would be - issued: - </para> - <para><userinput>dnssec-signzone -o example.com db.example.com - Kexample.com.+003+26160</userinput> - </para> - <para> - The command would print a string of the form: + zone with the DSA key generated by <command>dnssec-keygen</command> + (Kexample.com.+003+17247). The zone's keys must be in the master + file (<filename>db.example.com</filename>). This invocation looks + for <filename>keyset</filename> files, in the current directory, + so that DS records can be generated from them (<command>-g</command>). </para> +<programlisting>% dnssec-signzone -g -o example.com db.example.com \ +Kexample.com.+003+17247 +db.example.com.signed +%</programlisting> <para> - In this example, <command>dnssec-signzone</command> creates + In the above example, <command>dnssec-signzone</command> creates the file <filename>db.example.com.signed</filename>. This - file - should be referenced in a zone statement in a + file should be referenced in a zone statement in a <filename>named.conf</filename> file. </para> + <para> + This example re-signs a previously signed zone with default parameters. + The private keys are assumed to be in the current directory. + </para> +<programlisting>% cp db.example.com.signed db.example.com +% dnssec-signzone -o example.com db.example.com +db.example.com.signed +%</programlisting> </refsect1> <refsect1> diff --git a/contrib/bind9/bin/dnssec/dnssec-signzone.html b/contrib/bind9/bin/dnssec/dnssec-signzone.html index da1e058..e794d4c 100644 --- a/contrib/bind9/bin/dnssec/dnssec-signzone.html +++ b/contrib/bind9/bin/dnssec/dnssec-signzone.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: dnssec-signzone.html,v 1.8.18.22 2007/01/30 00:23:44 marka Exp $ --> +<!-- $Id: dnssec-signzone.html,v 1.8.18.23 2007/05/09 03:33:12 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -99,7 +99,7 @@ The name of the output file containing the signed zone. The default is to append <code class="filename">.signed</code> to the - input file. + input filename. </p></dd> <dt><span class="term">-h</span></dt> <dd><p> @@ -109,7 +109,7 @@ <dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt> <dd> <p> - When a previously signed zone is passed as input, records + When a previously-signed zone is passed as input, records may be resigned. The <code class="option">interval</code> option specifies the cycle interval as an offset from the current time (in seconds). If a RRSIG record expires after the @@ -145,8 +145,8 @@ When signing a zone with a fixed signature lifetime, all RRSIG records issued at the time of signing expires simultaneously. If the zone is incrementally signed, i.e. - a previously signed zone is passed as input to the signer, - all expired signatures has to be regenerated at about the + a previously-signed zone is passed as input to the signer, + all expired signatures have to be regenerated at about the same time. The <code class="option">jitter</code> option specifies a jitter window that will be used to randomize the signature expire time, thus spreading incremental signature @@ -232,9 +232,11 @@ </p></dd> <dt><span class="term">key</span></dt> <dd><p> - The keys used to sign the zone. If no keys are specified, the - default all zone keys that have private key files in the - current directory. + Specify which keys should be used to sign the zone. If + no keys are specified, then the zone will be examined + for DNSKEY records at the zone apex. If these are found and + there are matching private keys, in the current directory, + then these will be used for signing. </p></dd> </dl></div> </div> @@ -242,37 +244,40 @@ <a name="id2544327"></a><h2>EXAMPLE</h2> <p> The following command signs the <strong class="userinput"><code>example.com</code></strong> - zone with the DSA key generated in the <span><strong class="command">dnssec-keygen</strong></span> - man page. The zone's keys must be in the zone. If there are - <code class="filename">keyset</code> files associated with child - zones, - they must be in the current directory. - <strong class="userinput"><code>example.com</code></strong>, the following command would be - issued: - </p> -<p><strong class="userinput"><code>dnssec-signzone -o example.com db.example.com - Kexample.com.+003+26160</code></strong> - </p> -<p> - The command would print a string of the form: + zone with the DSA key generated by <span><strong class="command">dnssec-keygen</strong></span> + (Kexample.com.+003+17247). The zone's keys must be in the master + file (<code class="filename">db.example.com</code>). This invocation looks + for <code class="filename">keyset</code> files, in the current directory, + so that DS records can be generated from them (<span><strong class="command">-g</strong></span>). </p> +<pre class="programlisting">% dnssec-signzone -g -o example.com db.example.com \ +Kexample.com.+003+17247 +db.example.com.signed +%</pre> <p> - In this example, <span><strong class="command">dnssec-signzone</strong></span> creates + In the above example, <span><strong class="command">dnssec-signzone</strong></span> creates the file <code class="filename">db.example.com.signed</code>. This - file - should be referenced in a zone statement in a + file should be referenced in a zone statement in a <code class="filename">named.conf</code> file. </p> +<p> + This example re-signs a previously signed zone with default parameters. + The private keys are assumed to be in the current directory. + </p> +<pre class="programlisting">% cp db.example.com.signed db.example.com +% dnssec-signzone -o example.com db.example.com +db.example.com.signed +%</pre> </div> <div class="refsect1" lang="en"> -<a name="id2544375"></a><h2>SEE ALSO</h2> +<a name="id2544378"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>, <em class="citetitle">BIND 9 Administrator Reference Manual</em>, <em class="citetitle">RFC 2535</em>. </p> </div> <div class="refsect1" lang="en"> -<a name="id2544400"></a><h2>AUTHOR</h2> +<a name="id2544403"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/contrib/bind9/bin/named/client.c b/contrib/bind9/bin/named/client.c index 4f1caa8..b0e9cdd 100644 --- a/contrib/bind9/bin/named/client.c +++ b/contrib/bind9/bin/named/client.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: client.c,v 1.219.18.20.14.1 2007/06/26 02:58:54 marka Exp $ */ +/* $Id: client.c,v 1.219.18.28 2007/08/28 07:20:00 tbox Exp $ */ #include <config.h> @@ -1180,7 +1180,7 @@ client_addopt(ns_client_t *client) { rdatalist->ttl = (client->extflags & DNS_MESSAGEEXTFLAG_REPLYPRESERVE); /* - * No ENDS options in the default case. + * No EDNS options in the default case. */ rdata->data = NULL; rdata->length = 0; @@ -1226,7 +1226,8 @@ ns_client_isself(dns_view_t *myview, dns_tsigkey_t *mykey, dns_rdataclass_t rdclass, void *arg) { dns_view_t *view; - dns_tsigkey_t *key; + dns_tsigkey_t *key = NULL; + dns_name_t *tsig = NULL; isc_netaddr_t netsrc; isc_netaddr_t netdst; @@ -1241,7 +1242,6 @@ ns_client_isself(dns_view_t *myview, dns_tsigkey_t *mykey, for (view = ISC_LIST_HEAD(ns_g_server->viewlist); view != NULL; view = ISC_LIST_NEXT(view, link)) { - dns_name_t *tsig = NULL; if (view->matchrecursiveonly) continue; @@ -1584,6 +1584,7 @@ client_request(isc_task_t *task, isc_event_t *event) { "failed to get request's " "destination: %s", isc_result_totext(result)); + ns_client_next(client, ISC_R_SUCCESS); goto cleanup; } } @@ -1672,21 +1673,29 @@ client_request(isc_task_t *task, isc_event_t *event) { char tsigrcode[64]; isc_buffer_t b; dns_name_t *name = NULL; + dns_rcode_t status; + isc_result_t tresult; - isc_buffer_init(&b, tsigrcode, sizeof(tsigrcode) - 1); - RUNTIME_CHECK(dns_tsigrcode_totext(client->message->tsigstatus, - &b) == ISC_R_SUCCESS); - tsigrcode[isc_buffer_usedlength(&b)] = '\0'; /* There is a signature, but it is bad. */ if (dns_message_gettsig(client->message, &name) != NULL) { char namebuf[DNS_NAME_FORMATSIZE]; dns_name_format(name, namebuf, sizeof(namebuf)); + status = client->message->tsigstatus; + isc_buffer_init(&b, tsigrcode, sizeof(tsigrcode) - 1); + tresult = dns_tsigrcode_totext(status, &b); + INSIST(tresult == ISC_R_SUCCESS); + tsigrcode[isc_buffer_usedlength(&b)] = '\0'; ns_client_log(client, DNS_LOGCATEGORY_SECURITY, NS_LOGMODULE_CLIENT, ISC_LOG_ERROR, "request has invalid signature: " "TSIG %s: %s (%s)", namebuf, isc_result_totext(result), tsigrcode); } else { + status = client->message->sig0status; + isc_buffer_init(&b, tsigrcode, sizeof(tsigrcode) - 1); + tresult = dns_tsigrcode_totext(status, &b); + INSIST(tresult == ISC_R_SUCCESS); + tsigrcode[isc_buffer_usedlength(&b)] = '\0'; ns_client_log(client, DNS_LOGCATEGORY_SECURITY, NS_LOGMODULE_CLIENT, ISC_LOG_ERROR, "request has invalid signature: %s (%s)", diff --git a/contrib/bind9/bin/named/config.c b/contrib/bind9/bin/named/config.c index 6a6d5e3..e2dc833 100644 --- a/contrib/bind9/bin/named/config.c +++ b/contrib/bind9/bin/named/config.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2001-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,14 +15,13 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: config.c,v 1.47.18.28 2006/05/03 01:46:40 marka Exp $ */ +/* $Id: config.c,v 1.47.18.32 2007/09/13 05:04:01 each Exp $ */ /*! \file */ #include <config.h> #include <stdlib.h> -#include <string.h> #include <isc/buffer.h> #include <isc/log.h> @@ -31,6 +30,7 @@ #include <isc/region.h> #include <isc/result.h> #include <isc/sockaddr.h> +#include <isc/string.h> #include <isc/util.h> #include <isccfg/namedconf.h> @@ -182,7 +182,7 @@ options {\n\ " "#\n\ -# Zones in the \"_bind\" view are NOT counted is the count of zones.\n\ +# Zones in the \"_bind\" view are NOT counted in the count of zones.\n\ #\n\ view \"_bind\" chaos {\n\ recursion no;\n\ diff --git a/contrib/bind9/bin/named/control.c b/contrib/bind9/bin/named/control.c index e3d54bd..3f2d52e 100644 --- a/contrib/bind9/bin/named/control.c +++ b/contrib/bind9/bin/named/control.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2001-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,17 +15,17 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: control.c,v 1.20.10.8 2006/03/10 00:23:20 marka Exp $ */ +/* $Id: control.c,v 1.20.10.10 2007/09/13 23:46:26 tbox Exp $ */ /*! \file */ #include <config.h> -#include <string.h> #include <isc/app.h> #include <isc/event.h> #include <isc/mem.h> +#include <isc/string.h> #include <isc/timer.h> #include <isc/util.h> diff --git a/contrib/bind9/bin/named/lwresd.8 b/contrib/bind9/bin/named/lwresd.8 index 7275d29..825645a 100644 --- a/contrib/bind9/bin/named/lwresd.8 +++ b/contrib/bind9/bin/named/lwresd.8 @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: lwresd.8,v 1.15.18.10 2007/01/30 00:23:44 marka Exp $ +.\" $Id: lwresd.8,v 1.15.18.12 2007/05/16 06:11:27 marka Exp $ .\" .hy 0 .ad l @@ -33,7 +33,7 @@ lwresd \- lightweight resolver daemon .SH "SYNOPSIS" .HP 7 -\fBlwresd\fR [\fB\-C\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-d\ \fR\fB\fIdebug\-level\fR\fR] [\fB\-f\fR] [\fB\-g\fR] [\fB\-i\ \fR\fB\fIpid\-file\fR\fR] [\fB\-n\ \fR\fB\fI#cpus\fR\fR] [\fB\-P\ \fR\fB\fIport\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR] [\fB\-v\fR] +\fBlwresd\fR [\fB\-c\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-C\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-d\ \fR\fB\fIdebug\-level\fR\fR] [\fB\-f\fR] [\fB\-g\fR] [\fB\-i\ \fR\fB\fIpid\-file\fR\fR] [\fB\-m\ \fR\fB\fIflag\fR\fR] [\fB\-n\ \fR\fB\fI#cpus\fR\fR] [\fB\-P\ \fR\fB\fIport\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR] [\fB\-v\fR] [\fB\-4\fR] [\fB\-6\fR] .SH "DESCRIPTION" .PP \fBlwresd\fR @@ -61,12 +61,44 @@ entries are present, or if forwarding fails, resolves the queries autonomously starting at the root name servers, using a built\-in list of root server hints. .SH "OPTIONS" .PP +\-4 +.RS 4 +Use IPv4 only even if the host machine is capable of IPv6. +\fB\-4\fR +and +\fB\-6\fR +are mutually exclusive. +.RE +.PP +\-6 +.RS 4 +Use IPv6 only even if the host machine is capable of IPv4. +\fB\-4\fR +and +\fB\-6\fR +are mutually exclusive. +.RE +.PP +\-c \fIconfig\-file\fR +.RS 4 +Use +\fIconfig\-file\fR +as the configuration file instead of the default, +\fI/etc/lwresd.conf\fR. +<term>\-c</term> +can not be used with +<term>\-C</term>. +.RE +.PP \-C \fIconfig\-file\fR .RS 4 Use \fIconfig\-file\fR as the configuration file instead of the default, \fI/etc/resolv.conf\fR. +<term>\-C</term> +can not be used with +<term>\-c</term>. .RE .PP \-d \fIdebug\-level\fR @@ -88,6 +120,25 @@ Run the server in the foreground and force all logging to \fIstderr\fR. .RE .PP +\-i \fIpid\-file\fR +.RS 4 +Use +\fIpid\-file\fR +as the PID file instead of the default, +\fI/var/run/lwresd.pid\fR. +.RE +.PP +\-m \fIflag\fR +.RS 4 +Turn on memory usage debugging flags. Possible flags are +\fIusage\fR, +\fItrace\fR, +\fIrecord\fR, +\fIsize\fR, and +\fImctx\fR. These correspond to the ISC_MEM_DEBUGXXXX flags described in +\fI<isc/mem.h>\fR. +.RE +.PP \-n \fI#cpus\fR .RS 4 Create @@ -122,8 +173,7 @@ This option is mainly of interest to BIND 9 developers and may be removed or cha .PP \-t \fIdirectory\fR .RS 4 -\fBchroot()\fR -to +Chroot to \fIdirectory\fR after processing the command line arguments, but before reading the configuration file. .RS @@ -131,15 +181,14 @@ after processing the command line arguments, but before reading the configuratio This option should be used in conjunction with the \fB\-u\fR option, as chrooting a process running as root doesn't enhance security on most systems; the way -\fBchroot()\fR +\fBchroot(2)\fR is defined allows a process with root privileges to escape a chroot jail. .RE .RE .PP \-u \fIuser\fR .RS 4 -\fBsetuid()\fR -to +Setuid to \fIuser\fR after completing privileged operations, such as creating sockets that listen on privileged ports. .RE diff --git a/contrib/bind9/bin/named/lwresd.docbook b/contrib/bind9/bin/named/lwresd.docbook index d1eabfa..5b3143e 100644 --- a/contrib/bind9/bin/named/lwresd.docbook +++ b/contrib/bind9/bin/named/lwresd.docbook @@ -5,7 +5,7 @@ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: lwresd.docbook,v 1.7.18.5 2007/01/29 23:57:20 marka Exp $ --> +<!-- $Id: lwresd.docbook,v 1.7.18.8 2007/08/28 07:20:01 tbox Exp $ --> <refentry> <refentryinfo> <date>June 30, 2000</date> @@ -52,11 +52,13 @@ <refsynopsisdiv> <cmdsynopsis> <command>lwresd</command> + <arg><option>-c <replaceable class="parameter">config-file</replaceable></option></arg> <arg><option>-C <replaceable class="parameter">config-file</replaceable></option></arg> <arg><option>-d <replaceable class="parameter">debug-level</replaceable></option></arg> <arg><option>-f</option></arg> <arg><option>-g</option></arg> <arg><option>-i <replaceable class="parameter">pid-file</replaceable></option></arg> + <arg><option>-m <replaceable class="parameter">flag</replaceable></option></arg> <arg><option>-n <replaceable class="parameter">#cpus</replaceable></option></arg> <arg><option>-P <replaceable class="parameter">port</replaceable></option></arg> <arg><option>-p <replaceable class="parameter">port</replaceable></option></arg> @@ -64,6 +66,8 @@ <arg><option>-t <replaceable class="parameter">directory</replaceable></option></arg> <arg><option>-u <replaceable class="parameter">user</replaceable></option></arg> <arg><option>-v</option></arg> + <arg><option>-4</option></arg> + <arg><option>-6</option></arg> </cmdsynopsis> </refsynopsisdiv> @@ -109,6 +113,43 @@ <title>OPTIONS</title> <variablelist> + + <varlistentry> + <term>-4</term> + <listitem> + <para> + Use IPv4 only even if the host machine is capable of IPv6. + <option>-4</option> and <option>-6</option> are mutually + exclusive. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term>-6</term> + <listitem> + <para> + Use IPv6 only even if the host machine is capable of IPv4. + <option>-4</option> and <option>-6</option> are mutually + exclusive. + </para> + </listitem> + </varlistentry> + + <!-- this is in source but not mentioned? does this matter? --> + <varlistentry> + <term>-c <replaceable class="parameter">config-file</replaceable></term> + <listitem> + <para> + Use <replaceable class="parameter">config-file</replaceable> as the + configuration file instead of the default, + <filename>/etc/lwresd.conf</filename>. + <!-- Should this be an absolute path name? --> + <term>-c</term> can not be used with <term>-C</term>. + </para> + </listitem> + </varlistentry> + <varlistentry> <term>-C <replaceable class="parameter">config-file</replaceable></term> <listitem> @@ -116,6 +157,7 @@ Use <replaceable class="parameter">config-file</replaceable> as the configuration file instead of the default, <filename>/etc/resolv.conf</filename>. + <term>-C</term> can not be used with <term>-c</term>. </para> </listitem> </varlistentry> @@ -151,6 +193,33 @@ </varlistentry> <varlistentry> + <term>-i <replaceable class="parameter">pid-file</replaceable></term> + <listitem> + <para> + Use <replaceable class="parameter">pid-file</replaceable> as the + PID file instead of the default, + <filename>/var/run/lwresd.pid</filename>. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term>-m <replaceable class="parameter">flag</replaceable></term> + <listitem> + <para> + Turn on memory usage debugging flags. Possible flags are + <replaceable class="parameter">usage</replaceable>, + <replaceable class="parameter">trace</replaceable>, + <replaceable class="parameter">record</replaceable>, + <replaceable class="parameter">size</replaceable>, and + <replaceable class="parameter">mctx</replaceable>. + These correspond to the ISC_MEM_DEBUGXXXX flags described in + <filename><isc/mem.h></filename>. + </para> + </listitem> + </varlistentry> + + <varlistentry> <term>-n <replaceable class="parameter">#cpus</replaceable></term> <listitem> <para> @@ -207,7 +276,7 @@ <varlistentry> <term>-t <replaceable class="parameter">directory</replaceable></term> <listitem> - <para><function>chroot()</function> + <para>Chroot to <replaceable class="parameter">directory</replaceable> after processing the command line arguments, but before reading the configuration file. @@ -217,7 +286,7 @@ This option should be used in conjunction with the <option>-u</option> option, as chrooting a process running as root doesn't enhance security on most - systems; the way <function>chroot()</function> is + systems; the way <function>chroot(2)</function> is defined allows a process with root privileges to escape a chroot jail. </para> @@ -228,7 +297,7 @@ <varlistentry> <term>-u <replaceable class="parameter">user</replaceable></term> <listitem> - <para><function>setuid()</function> + <para>Setuid to <replaceable class="parameter">user</replaceable> after completing privileged operations, such as creating sockets that listen on privileged ports. diff --git a/contrib/bind9/bin/named/lwresd.html b/contrib/bind9/bin/named/lwresd.html index e25dfcf..b59a7cc 100644 --- a/contrib/bind9/bin/named/lwresd.html +++ b/contrib/bind9/bin/named/lwresd.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: lwresd.html,v 1.5.18.16 2007/01/30 00:23:44 marka Exp $ --> +<!-- $Id: lwresd.html,v 1.5.18.18 2007/05/16 06:11:27 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -29,10 +29,10 @@ </div> <div class="refsynopsisdiv"> <h2>Synopsis</h2> -<div class="cmdsynopsis"><p><code class="command">lwresd</code> [<code class="option">-C <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-i <em class="replaceable"><code>pid-file</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-P <em class="replaceable"><code>port</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>]</p></div> +<div class="cmdsynopsis"><p><code class="command">lwresd</code> [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-C <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-i <em class="replaceable"><code>pid-file</code></em></code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-P <em class="replaceable"><code>port</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-4</code>] [<code class="option">-6</code>]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543435"></a><h2>DESCRIPTION</h2> +<a name="id2543461"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">lwresd</strong></span> is the daemon providing name lookup services to clients that use the BIND 9 lightweight resolver @@ -67,13 +67,34 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543482"></a><h2>OPTIONS</h2> +<a name="id2543508"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> +<dt><span class="term">-4</span></dt> +<dd><p> + Use IPv4 only even if the host machine is capable of IPv6. + <code class="option">-4</code> and <code class="option">-6</code> are mutually + exclusive. + </p></dd> +<dt><span class="term">-6</span></dt> +<dd><p> + Use IPv6 only even if the host machine is capable of IPv4. + <code class="option">-4</code> and <code class="option">-6</code> are mutually + exclusive. + </p></dd> +<dt><span class="term">-c <em class="replaceable"><code>config-file</code></em></span></dt> +<dd><p> + Use <em class="replaceable"><code>config-file</code></em> as the + configuration file instead of the default, + <code class="filename">/etc/lwresd.conf</code>. + + <font color="red"><term>-c</term></font> can not be used with <font color="red"><term>-C</term></font>. + </p></dd> <dt><span class="term">-C <em class="replaceable"><code>config-file</code></em></span></dt> <dd><p> Use <em class="replaceable"><code>config-file</code></em> as the configuration file instead of the default, <code class="filename">/etc/resolv.conf</code>. + <font color="red"><term>-C</term></font> can not be used with <font color="red"><term>-c</term></font>. </p></dd> <dt><span class="term">-d <em class="replaceable"><code>debug-level</code></em></span></dt> <dd><p> @@ -90,6 +111,23 @@ Run the server in the foreground and force all logging to <code class="filename">stderr</code>. </p></dd> +<dt><span class="term">-i <em class="replaceable"><code>pid-file</code></em></span></dt> +<dd><p> + Use <em class="replaceable"><code>pid-file</code></em> as the + PID file instead of the default, + <code class="filename">/var/run/lwresd.pid</code>. + </p></dd> +<dt><span class="term">-m <em class="replaceable"><code>flag</code></em></span></dt> +<dd><p> + Turn on memory usage debugging flags. Possible flags are + <em class="replaceable"><code>usage</code></em>, + <em class="replaceable"><code>trace</code></em>, + <em class="replaceable"><code>record</code></em>, + <em class="replaceable"><code>size</code></em>, and + <em class="replaceable"><code>mctx</code></em>. + These correspond to the ISC_MEM_DEBUGXXXX flags described in + <code class="filename"><isc/mem.h></code>. + </p></dd> <dt><span class="term">-n <em class="replaceable"><code>#cpus</code></em></span></dt> <dd><p> Create <em class="replaceable"><code>#cpus</code></em> worker threads @@ -129,7 +167,7 @@ </dd> <dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt> <dd> -<p><code class="function">chroot()</code> +<p>Chroot to <em class="replaceable"><code>directory</code></em> after processing the command line arguments, but before reading the configuration file. @@ -140,14 +178,14 @@ This option should be used in conjunction with the <code class="option">-u</code> option, as chrooting a process running as root doesn't enhance security on most - systems; the way <code class="function">chroot()</code> is + systems; the way <code class="function">chroot(2)</code> is defined allows a process with root privileges to escape a chroot jail. </p> </div> </dd> <dt><span class="term">-u <em class="replaceable"><code>user</code></em></span></dt> -<dd><p><code class="function">setuid()</code> +<dd><p>Setuid to <em class="replaceable"><code>user</code></em> after completing privileged operations, such as creating sockets that listen on privileged ports. @@ -159,7 +197,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2543746"></a><h2>FILES</h2> +<a name="id2543925"></a><h2>FILES</h2> <div class="variablelist"><dl> <dt><span class="term"><code class="filename">/etc/resolv.conf</code></span></dt> <dd><p> @@ -172,14 +210,14 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2543785"></a><h2>SEE ALSO</h2> +<a name="id2543964"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">lwres</span>(3)</span>, <span class="citerefentry"><span class="refentrytitle">resolver</span>(5)</span>. </p> </div> <div class="refsect1" lang="en"> -<a name="id2543819"></a><h2>AUTHOR</h2> +<a name="id2543998"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/contrib/bind9/bin/named/named.8 b/contrib/bind9/bin/named/named.8 index 5b39e2a..f5e8230 100644 --- a/contrib/bind9/bin/named/named.8 +++ b/contrib/bind9/bin/named/named.8 @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: named.8,v 1.20.18.12 2007/01/30 00:23:44 marka Exp $ +.\" $Id: named.8,v 1.20.18.15 2007/06/20 02:26:58 marka Exp $ .\" .hy 0 .ad l @@ -33,7 +33,7 @@ named \- Internet domain name server .SH "SYNOPSIS" .HP 6 -\fBnamed\fR [\fB\-4\fR] [\fB\-6\fR] [\fB\-c\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-d\ \fR\fB\fIdebug\-level\fR\fR] [\fB\-f\fR] [\fB\-g\fR] [\fB\-n\ \fR\fB\fI#cpus\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR] [\fB\-v\fR] [\fB\-x\ \fR\fB\fIcache\-file\fR\fR] +\fBnamed\fR [\fB\-4\fR] [\fB\-6\fR] [\fB\-c\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-d\ \fR\fB\fIdebug\-level\fR\fR] [\fB\-f\fR] [\fB\-g\fR] [\fB\-m\ \fR\fB\fIflag\fR\fR] [\fB\-n\ \fR\fB\fI#cpus\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR] [\fB\-v\fR] [\fB\-x\ \fR\fB\fIcache\-file\fR\fR] .SH "DESCRIPTION" .PP \fBnamed\fR @@ -94,6 +94,17 @@ Run the server in the foreground and force all logging to \fIstderr\fR. .RE .PP +\-m \fIflag\fR +.RS 4 +Turn on memory usage debugging flags. Possible flags are +\fIusage\fR, +\fItrace\fR, +\fIrecord\fR, +\fIsize\fR, and +\fImctx\fR. These correspond to the ISC_MEM_DEBUGXXXX flags described in +\fI<isc/mem.h>\fR. +.RE +.PP \-n \fI#cpus\fR .RS 4 Create @@ -122,8 +133,7 @@ This option is mainly of interest to BIND 9 developers and may be removed or cha .PP \-t \fIdirectory\fR .RS 4 -\fBchroot()\fR -to +Chroot to \fIdirectory\fR after processing the command line arguments, but before reading the configuration file. .RS @@ -131,15 +141,14 @@ after processing the command line arguments, but before reading the configuratio This option should be used in conjunction with the \fB\-u\fR option, as chrooting a process running as root doesn't enhance security on most systems; the way -\fBchroot()\fR +\fBchroot(2)\fR is defined allows a process with root privileges to escape a chroot jail. .RE .RE .PP \-u \fIuser\fR .RS 4 -\fBsetuid()\fR -to +Setuid to \fIuser\fR after completing privileged operations, such as creating sockets that listen on privileged ports. .RS @@ -147,13 +156,13 @@ after completing privileged operations, such as creating sockets that listen on On Linux, \fBnamed\fR uses the kernel's capability mechanism to drop all root privileges except the ability to -\fBbind()\fR +\fBbind(2)\fR to a privileged port and set process resource limits. Unfortunately, this means that the \fB\-u\fR option only works when \fBnamed\fR is run on kernel 2.2.18 or later, or kernel 2.3.99\-pre3 or later, since previous kernels did not allow privileges to be retained after -\fBsetuid()\fR. +\fBsetuid(2)\fR. .RE .RE .PP @@ -211,6 +220,8 @@ The default process\-id file. RFC 1033, RFC 1034, RFC 1035, +\fBnamed\-checkconf\fR(8), +\fBnamed\-checkzone\fR(8), \fBrndc\fR(8), \fBlwresd\fR(8), \fBnamed.conf\fR(5), diff --git a/contrib/bind9/bin/named/named.conf.5 b/contrib/bind9/bin/named/named.conf.5 index 75b1bb5..00c92a6 100644 --- a/contrib/bind9/bin/named/named.conf.5 +++ b/contrib/bind9/bin/named/named.conf.5 @@ -12,7 +12,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: named.conf.5,v 1.1.2.23 2007/01/30 00:23:44 marka Exp $ +.\" $Id: named.conf.5,v 1.1.2.26 2007/08/19 23:26:13 marka Exp $ .\" .hy 0 .ad l @@ -253,6 +253,7 @@ options { allow\-update { \fIaddress_match_element\fR; ... }; allow\-update\-forwarding { \fIaddress_match_element\fR; ... }; update\-check\-ksk \fIboolean\fR; + masterfile\-format ( text | raw ); notify \fInotifytype\fR; notify\-source ( \fIipv4_address\fR | * ) [ port ( \fIinteger\fR | * ) ]; notify\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * ) ]; @@ -386,6 +387,7 @@ view \fIstring\fR \fIoptional_class\fR { allow\-update { \fIaddress_match_element\fR; ... }; allow\-update\-forwarding { \fIaddress_match_element\fR; ... }; update\-check\-ksk \fIboolean\fR; + masterfile\-format ( text | raw ); notify \fInotifytype\fR; notify\-source ( \fIipv4_address\fR | * ) [ port ( \fIinteger\fR | * ) ]; notify\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * ) ]; @@ -462,6 +464,7 @@ zone \fIstring\fR \fIoptional_class\fR { \fIrrtypelist\fR; ... }; update\-check\-ksk \fIboolean\fR; + masterfile\-format ( text | raw ); notify \fInotifytype\fR; notify\-source ( \fIipv4_address\fR | * ) [ port ( \fIinteger\fR | * ) ]; notify\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * ) ]; @@ -509,8 +512,9 @@ zone \fIstring\fR \fIoptional_class\fR { .SH "SEE ALSO" .PP \fBnamed\fR(8), +\fBnamed\-checkconf\fR(8), \fBrndc\fR(8), -\fBBIND 9 Administrator Reference Manual\fR(). +BIND 9 Administrator Reference Manual. .SH "COPYRIGHT" Copyright \(co 2004\-2007 Internet Systems Consortium, Inc. ("ISC") .br diff --git a/contrib/bind9/bin/named/named.conf.docbook b/contrib/bind9/bin/named/named.conf.docbook index 5d5f52f..e4cfcc7 100644 --- a/contrib/bind9/bin/named/named.conf.docbook +++ b/contrib/bind9/bin/named/named.conf.docbook @@ -4,7 +4,7 @@ <!-- - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -17,7 +17,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: named.conf.docbook,v 1.1.2.25 2007/01/29 23:57:20 marka Exp $ --> +<!-- $Id: named.conf.docbook,v 1.1.2.29 2007/08/28 07:20:01 tbox Exp $ --> <refentry> <refentryinfo> <date>Aug 13, 2004</date> @@ -284,6 +284,7 @@ options { allow-update-forwarding { <replaceable>address_match_element</replaceable>; ... }; update-check-ksk <replaceable>boolean</replaceable>; + masterfile-format ( text | raw ); notify <replaceable>notifytype</replaceable>; notify-source ( <replaceable>ipv4_address</replaceable> | * ) <optional> port ( <replaceable>integer</replaceable> | * ) </optional>; notify-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) <optional> port ( <replaceable>integer</replaceable> | * ) </optional>; @@ -432,6 +433,7 @@ view <replaceable>string</replaceable> <replaceable>optional_class</replaceable> allow-update-forwarding { <replaceable>address_match_element</replaceable>; ... }; update-check-ksk <replaceable>boolean</replaceable>; + masterfile-format ( text | raw ); notify <replaceable>notifytype</replaceable>; notify-source ( <replaceable>ipv4_address</replaceable> | * ) <optional> port ( <replaceable>integer</replaceable> | * ) </optional>; notify-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) <optional> port ( <replaceable>integer</replaceable> | * ) </optional>; @@ -518,6 +520,7 @@ zone <replaceable>string</replaceable> <replaceable>optional_class</replaceable> }; update-check-ksk <replaceable>boolean</replaceable>; + masterfile-format ( text | raw ); notify <replaceable>notifytype</replaceable>; notify-source ( <replaceable>ipv4_address</replaceable> | * ) <optional> port ( <replaceable>integer</replaceable> | * ) </optional>; notify-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) <optional> port ( <replaceable>integer</replaceable> | * ) </optional>; @@ -578,11 +581,12 @@ zone <replaceable>string</replaceable> <replaceable>optional_class</replaceable> <refentrytitle>named</refentrytitle><manvolnum>8</manvolnum> </citerefentry>, <citerefentry> - <refentrytitle>rndc</refentrytitle><manvolnum>8</manvolnum> + <refentrytitle>named-checkconf</refentrytitle><manvolnum>8</manvolnum> </citerefentry>, <citerefentry> - <refentrytitle>BIND 9 Administrator Reference Manual</refentrytitle> - </citerefentry>. + <refentrytitle>rndc</refentrytitle><manvolnum>8</manvolnum> + </citerefentry>, + <citetitle>BIND 9 Administrator Reference Manual</citetitle>. </para> </refsect1> diff --git a/contrib/bind9/bin/named/named.conf.html b/contrib/bind9/bin/named/named.conf.html index 5cd449e..09e71a3 100644 --- a/contrib/bind9/bin/named/named.conf.html +++ b/contrib/bind9/bin/named/named.conf.html @@ -13,7 +13,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: named.conf.html,v 1.1.2.32 2007/01/30 00:23:44 marka Exp $ --> +<!-- $Id: named.conf.html,v 1.1.2.35 2007/08/19 23:26:13 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -255,6 +255,7 @@ options {<br> allow-update-forwarding { <em class="replaceable"><code>address_match_element</code></em>; ... };<br> update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br> <br> + masterfile-format ( text | raw );<br> notify <em class="replaceable"><code>notifytype</code></em>;<br> notify-source ( <em class="replaceable"><code>ipv4_address</code></em> | * ) [<span class="optional"> port ( <em class="replaceable"><code>integer</code></em> | * ) </span>];<br> notify-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [<span class="optional"> port ( <em class="replaceable"><code>integer</code></em> | * ) </span>];<br> @@ -312,7 +313,7 @@ options {<br> </p></div> </div> <div class="refsect1" lang="en"> -<a name="id2544400"></a><h2>VIEW</h2> +<a name="id2544401"></a><h2>VIEW</h2> <div class="literallayout"><p><br> view <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>optional_class</code></em> {<br> match-clients { <em class="replaceable"><code>address_match_element</code></em>; ... };<br> @@ -402,6 +403,7 @@ view <em class="replaceable"><code>string</code></em> <em class="replaceable"><c allow-update-forwarding { <em class="replaceable"><code>address_match_element</code></em>; ... };<br> update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br> <br> + masterfile-format ( text | raw );<br> notify <em class="replaceable"><code>notifytype</code></em>;<br> notify-source ( <em class="replaceable"><code>ipv4_address</code></em> | * ) [<span class="optional"> port ( <em class="replaceable"><code>integer</code></em> | * ) </span>];<br> notify-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [<span class="optional"> port ( <em class="replaceable"><code>integer</code></em> | * ) </span>];<br> @@ -451,7 +453,7 @@ view <em class="replaceable"><code>string</code></em> <em class="replaceable"><c </p></div> </div> <div class="refsect1" lang="en"> -<a name="id2544964"></a><h2>ZONE</h2> +<a name="id2544966"></a><h2>ZONE</h2> <div class="literallayout"><p><br> zone <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>optional_class</code></em> {<br> type ( master | slave | stub | hint |<br> @@ -487,6 +489,7 @@ zone <em class="replaceable"><code>string</code></em> <em class="replaceable"><c };<br> update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br> <br> + masterfile-format ( text | raw );<br> notify <em class="replaceable"><code>notifytype</code></em>;<br> notify-source ( <em class="replaceable"><code>ipv4_address</code></em> | * ) [<span class="optional"> port ( <em class="replaceable"><code>integer</code></em> | * ) </span>];<br> notify-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [<span class="optional"> port ( <em class="replaceable"><code>integer</code></em> | * ) </span>];<br> @@ -535,15 +538,16 @@ zone <em class="replaceable"><code>string</code></em> <em class="replaceable"><c </p></div> </div> <div class="refsect1" lang="en"> -<a name="id2545316"></a><h2>FILES</h2> +<a name="id2545319"></a><h2>FILES</h2> <p><code class="filename">/etc/named.conf</code> </p> </div> <div class="refsect1" lang="en"> -<a name="id2545328"></a><h2>SEE ALSO</h2> +<a name="id2545331"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, + <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>, - <span class="citerefentry"><span class="refentrytitle">BIND 9 Administrator Reference Manual</span></span>. + <em class="citetitle">BIND 9 Administrator Reference Manual</em>. </p> </div> </div></body> diff --git a/contrib/bind9/bin/named/named.docbook b/contrib/bind9/bin/named/named.docbook index f648b9d..74b41f5 100644 --- a/contrib/bind9/bin/named/named.docbook +++ b/contrib/bind9/bin/named/named.docbook @@ -5,7 +5,7 @@ - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001, 2003 Internet Software Consortium. - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: named.docbook,v 1.7.18.8 2007/01/29 23:57:20 marka Exp $ --> +<!-- $Id: named.docbook,v 1.7.18.12 2007/08/28 07:20:01 tbox Exp $ --> <refentry id="man.named"> <refentryinfo> <date>June 30, 2000</date> @@ -60,6 +60,7 @@ <arg><option>-d <replaceable class="parameter">debug-level</replaceable></option></arg> <arg><option>-f</option></arg> <arg><option>-g</option></arg> + <arg><option>-m <replaceable class="parameter">flag</replaceable></option></arg> <arg><option>-n <replaceable class="parameter">#cpus</replaceable></option></arg> <arg><option>-p <replaceable class="parameter">port</replaceable></option></arg> <arg><option>-s</option></arg> @@ -159,6 +160,22 @@ </varlistentry> <varlistentry> + <term>-m <replaceable class="parameter">flag</replaceable></term> + <listitem> + <para> + Turn on memory usage debugging flags. Possible flags are + <replaceable class="parameter">usage</replaceable>, + <replaceable class="parameter">trace</replaceable>, + <replaceable class="parameter">record</replaceable>, + <replaceable class="parameter">size</replaceable>, and + <replaceable class="parameter">mctx</replaceable>. + These correspond to the ISC_MEM_DEBUGXXXX flags described in + <filename><isc/mem.h></filename>. + </para> + </listitem> + </varlistentry> + + <varlistentry> <term>-n <replaceable class="parameter">#cpus</replaceable></term> <listitem> <para> @@ -200,7 +217,7 @@ <varlistentry> <term>-t <replaceable class="parameter">directory</replaceable></term> <listitem> - <para><function>chroot()</function> + <para>Chroot to <replaceable class="parameter">directory</replaceable> after processing the command line arguments, but before reading the configuration file. @@ -210,7 +227,7 @@ This option should be used in conjunction with the <option>-u</option> option, as chrooting a process running as root doesn't enhance security on most - systems; the way <function>chroot()</function> is + systems; the way <function>chroot(2)</function> is defined allows a process with root privileges to escape a chroot jail. </para> @@ -221,7 +238,7 @@ <varlistentry> <term>-u <replaceable class="parameter">user</replaceable></term> <listitem> - <para><function>setuid()</function> + <para>Setuid to <replaceable class="parameter">user</replaceable> after completing privileged operations, such as creating sockets that listen on privileged ports. @@ -230,7 +247,7 @@ <para> On Linux, <command>named</command> uses the kernel's capability mechanism to drop all root privileges - except the ability to <function>bind()</function> to + except the ability to <function>bind(2)</function> to a privileged port and set process resource limits. Unfortunately, this means that the <option>-u</option> @@ -238,7 +255,7 @@ run on kernel 2.2.18 or later, or kernel 2.3.99-pre3 or later, since previous kernels did not allow privileges - to be retained after <function>setuid()</function>. + to be retained after <function>setuid(2)</function>. </para> </note> </listitem> @@ -353,6 +370,14 @@ <citetitle>RFC 1034</citetitle>, <citetitle>RFC 1035</citetitle>, <citerefentry> + <refentrytitle>named-checkconf</refentrytitle> + <manvolnum>8</manvolnum> + </citerefentry>, + <citerefentry> + <refentrytitle>named-checkzone</refentrytitle> + <manvolnum>8</manvolnum> + </citerefentry>, + <citerefentry> <refentrytitle>rndc</refentrytitle> <manvolnum>8</manvolnum> </citerefentry>, diff --git a/contrib/bind9/bin/named/named.html b/contrib/bind9/bin/named/named.html index 1839e4a..294ecce 100644 --- a/contrib/bind9/bin/named/named.html +++ b/contrib/bind9/bin/named/named.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: named.html,v 1.6.18.18 2007/01/30 00:23:44 marka Exp $ --> +<!-- $Id: named.html,v 1.6.18.21 2007/06/20 02:26:58 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -29,10 +29,10 @@ </div> <div class="refsynopsisdiv"> <h2>Synopsis</h2> -<div class="cmdsynopsis"><p><code class="command">named</code> [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div> +<div class="cmdsynopsis"><p><code class="command">named</code> [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543444"></a><h2>DESCRIPTION</h2> +<a name="id2543452"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">named</strong></span> is a Domain Name System (DNS) server, part of the BIND 9 distribution from ISC. For more @@ -47,7 +47,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543468"></a><h2>OPTIONS</h2> +<a name="id2543477"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-4</span></dt> <dd><p> @@ -88,6 +88,17 @@ Run the server in the foreground and force all logging to <code class="filename">stderr</code>. </p></dd> +<dt><span class="term">-m <em class="replaceable"><code>flag</code></em></span></dt> +<dd><p> + Turn on memory usage debugging flags. Possible flags are + <em class="replaceable"><code>usage</code></em>, + <em class="replaceable"><code>trace</code></em>, + <em class="replaceable"><code>record</code></em>, + <em class="replaceable"><code>size</code></em>, and + <em class="replaceable"><code>mctx</code></em>. + These correspond to the ISC_MEM_DEBUGXXXX flags described in + <code class="filename"><isc/mem.h></code>. + </p></dd> <dt><span class="term">-n <em class="replaceable"><code>#cpus</code></em></span></dt> <dd><p> Create <em class="replaceable"><code>#cpus</code></em> worker threads @@ -117,7 +128,7 @@ </dd> <dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt> <dd> -<p><code class="function">chroot()</code> +<p>Chroot to <em class="replaceable"><code>directory</code></em> after processing the command line arguments, but before reading the configuration file. @@ -128,7 +139,7 @@ This option should be used in conjunction with the <code class="option">-u</code> option, as chrooting a process running as root doesn't enhance security on most - systems; the way <code class="function">chroot()</code> is + systems; the way <code class="function">chroot(2)</code> is defined allows a process with root privileges to escape a chroot jail. </p> @@ -136,7 +147,7 @@ </dd> <dt><span class="term">-u <em class="replaceable"><code>user</code></em></span></dt> <dd> -<p><code class="function">setuid()</code> +<p>Setuid to <em class="replaceable"><code>user</code></em> after completing privileged operations, such as creating sockets that listen on privileged ports. @@ -146,7 +157,7 @@ <p> On Linux, <span><strong class="command">named</strong></span> uses the kernel's capability mechanism to drop all root privileges - except the ability to <code class="function">bind()</code> to + except the ability to <code class="function">bind(2)</code> to a privileged port and set process resource limits. Unfortunately, this means that the <code class="option">-u</code> @@ -154,7 +165,7 @@ run on kernel 2.2.18 or later, or kernel 2.3.99-pre3 or later, since previous kernels did not allow privileges - to be retained after <code class="function">setuid()</code>. + to be retained after <code class="function">setuid(2)</code>. </p> </div> </dd> @@ -180,7 +191,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2543813"></a><h2>SIGNALS</h2> +<a name="id2543864"></a><h2>SIGNALS</h2> <p> In routine operation, signals should not be used to control the nameserver; <span><strong class="command">rndc</strong></span> should be used @@ -201,7 +212,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543861"></a><h2>CONFIGURATION</h2> +<a name="id2543912"></a><h2>CONFIGURATION</h2> <p> The <span><strong class="command">named</strong></span> configuration file is too complex to describe in detail here. A complete description is provided @@ -210,7 +221,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543878"></a><h2>FILES</h2> +<a name="id2543929"></a><h2>FILES</h2> <div class="variablelist"><dl> <dt><span class="term"><code class="filename">/etc/named.conf</code></span></dt> <dd><p> @@ -223,10 +234,12 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2543917"></a><h2>SEE ALSO</h2> +<a name="id2543969"></a><h2>SEE ALSO</h2> <p><em class="citetitle">RFC 1033</em>, <em class="citetitle">RFC 1034</em>, <em class="citetitle">RFC 1035</em>, + <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>, + <span class="citerefentry"><span class="refentrytitle">named-checkzone</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">lwresd</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>, @@ -234,7 +247,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543969"></a><h2>AUTHOR</h2> +<a name="id2544039"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/contrib/bind9/bin/named/query.c b/contrib/bind9/bin/named/query.c index f30c07c..38eb9a1 100644 --- a/contrib/bind9/bin/named/query.c +++ b/contrib/bind9/bin/named/query.c @@ -2,7 +2,7 @@ * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: query.c,v 1.257.18.36.12.1 2007/04/30 01:10:19 marka Exp $ */ +/* $Id: query.c,v 1.257.18.40 2007/09/26 03:08:14 each Exp $ */ /*! \file */ @@ -2592,7 +2592,9 @@ query_addbestns(ns_client_t *client) { } static void -query_addds(ns_client_t *client, dns_db_t *db, dns_dbnode_t *node) { +query_addds(ns_client_t *client, dns_db_t *db, dns_dbnode_t *node, + dns_dbversion_t *version) +{ dns_name_t *rname; dns_rdataset_t *rdataset, *sigrdataset; isc_result_t result; @@ -2613,12 +2615,12 @@ query_addds(ns_client_t *client, dns_db_t *db, dns_dbnode_t *node) { /* * Look for the DS record, which may or may not be present. */ - result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_ds, 0, + result = dns_db_findrdataset(db, node, version, dns_rdatatype_ds, 0, client->now, rdataset, sigrdataset); /* * If we didn't find it, look for an NSEC. */ if (result == ISC_R_NOTFOUND) - result = dns_db_findrdataset(db, node, NULL, + result = dns_db_findrdataset(db, node, version, dns_rdatatype_nsec, 0, client->now, rdataset, sigrdataset); if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) @@ -2657,7 +2659,8 @@ query_addds(ns_client_t *client, dns_db_t *db, dns_dbnode_t *node) { static void query_addwildcardproof(ns_client_t *client, dns_db_t *db, - dns_name_t *name, isc_boolean_t ispositive) + dns_dbversion_t *version, dns_name_t *name, + isc_boolean_t ispositive) { isc_buffer_t *dbuf, b; dns_name_t *fname; @@ -2738,7 +2741,7 @@ query_addwildcardproof(ns_client_t *client, dns_db_t *db, if (fname == NULL || rdataset == NULL || sigrdataset == NULL) goto cleanup; - result = dns_db_find(db, name, NULL, dns_rdatatype_nsec, options, + result = dns_db_find(db, name, version, dns_rdatatype_nsec, options, 0, &node, fname, rdataset, sigrdataset); if (node != NULL) dns_db_detachnode(db, &node); @@ -2790,8 +2793,9 @@ query_addwildcardproof(ns_client_t *client, dns_db_t *db, } static void -query_addnxrrsetnsec(ns_client_t *client, dns_db_t *db, dns_name_t **namep, - dns_rdataset_t **rdatasetp, dns_rdataset_t **sigrdatasetp) +query_addnxrrsetnsec(ns_client_t *client, dns_db_t *db, + dns_dbversion_t *version, dns_name_t **namep, + dns_rdataset_t **rdatasetp, dns_rdataset_t **sigrdatasetp) { dns_name_t *name; dns_rdataset_t *sigrdataset; @@ -2828,8 +2832,7 @@ query_addnxrrsetnsec(ns_client_t *client, dns_db_t *db, dns_name_t **namep, return; /* XXX */ - query_addwildcardproof(client, db, - client->query.qname, + query_addwildcardproof(client, db, version, client->query.qname, ISC_TRUE); /* @@ -3705,7 +3708,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) dbuf, DNS_SECTION_AUTHORITY); client->query.gluedb = NULL; if (WANTDNSSEC(client) && dns_db_issecure(db)) - query_addds(client, db, node); + query_addds(client, db, node, version); } else { /* * We might have a better answer or delegation @@ -3809,7 +3812,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) client->query.attributes &= ~NS_QUERYATTR_CACHEGLUEOK; if (WANTDNSSEC(client)) - query_addds(client, db, node); + query_addds(client, db, node, version); } } goto cleanup; @@ -3846,8 +3849,9 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) */ if (WANTDNSSEC(client)) { if (dns_rdataset_isassociated(rdataset)) - query_addnxrrsetnsec(client, db, &fname, - &rdataset, &sigrdataset); + query_addnxrrsetnsec(client, db, version, + &fname, &rdataset, + &sigrdataset); } goto cleanup; case DNS_R_EMPTYWILD: @@ -3896,7 +3900,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) query_addrrset(client, &fname, &rdataset, &sigrdataset, NULL, DNS_SECTION_AUTHORITY); - query_addwildcardproof(client, db, + query_addwildcardproof(client, db, version, client->query.qname, ISC_FALSE); } @@ -4305,7 +4309,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) * DNSSEC wildcard proofs. */ if (need_wildcardproof && dns_db_issecure(db)) - query_addwildcardproof(client, db, + query_addwildcardproof(client, db, version, dns_fixedname_name(&wildcardname), ISC_TRUE); cleanup: @@ -4590,7 +4594,7 @@ ns_query_start(ns_client_t *client) { * Set AD. We must clear it if we add non-validated data to a * response. */ - if (client->view->enablednssec) + if (WANTDNSSEC(client)) message->flags |= DNS_MESSAGEFLAG_AD; qclient = NULL; diff --git a/contrib/bind9/bin/named/server.c b/contrib/bind9/bin/named/server.c index 50f5df4..cd8bff1 100644 --- a/contrib/bind9/bin/named/server.c +++ b/contrib/bind9/bin/named/server.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: server.c,v 1.419.18.49.12.2 2007/07/09 02:23:16 marka Exp $ */ +/* $Id: server.c,v 1.419.18.57 2007/08/28 07:20:01 tbox Exp $ */ /*! \file */ @@ -1773,6 +1773,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config, empty_dbtype, mctx); if (zone != NULL) { dns_zone_setview(zone, view); + CHECK(dns_view_addzone(view, zone)); dns_zone_detach(&zone); continue; } @@ -3977,6 +3978,7 @@ ns_server_reloadcommand(ns_server_t *server, char *args, isc_buffer_t *text) { type = dns_zone_gettype(zone); if (type == dns_zone_slave || type == dns_zone_stub) { dns_zone_refresh(zone); + dns_zone_detach(&zone); msg = "zone refresh queued"; } else { result = dns_zone_load(zone); @@ -4593,7 +4595,8 @@ isc_result_t ns_server_flushcache(ns_server_t *server, char *args) { char *ptr, *viewname; dns_view_t *view; - isc_boolean_t flushed = ISC_FALSE; + isc_boolean_t flushed; + isc_boolean_t found; isc_result_t result; /* Skip the command name. */ @@ -4606,22 +4609,27 @@ ns_server_flushcache(ns_server_t *server, char *args) { result = isc_task_beginexclusive(server->task); RUNTIME_CHECK(result == ISC_R_SUCCESS); + flushed = ISC_TRUE; + found = ISC_FALSE; for (view = ISC_LIST_HEAD(server->viewlist); view != NULL; view = ISC_LIST_NEXT(view, link)) { if (viewname != NULL && strcasecmp(viewname, view->name) != 0) continue; + found = ISC_TRUE; result = dns_view_flushcache(view); if (result != ISC_R_SUCCESS) - goto out; - flushed = ISC_TRUE; + flushed = ISC_FALSE; } - if (flushed) + if (flushed && found) { result = ISC_R_SUCCESS; - else - result = ISC_R_FAILURE; - out: + } else { + if (!found) + result = ISC_R_NOTFOUND; + else + result = ISC_R_FAILURE; + } isc_task_endexclusive(server->task); return (result); } @@ -4630,7 +4638,8 @@ isc_result_t ns_server_flushname(ns_server_t *server, char *args) { char *ptr, *target, *viewname; dns_view_t *view; - isc_boolean_t flushed = ISC_FALSE; + isc_boolean_t flushed; + isc_boolean_t found; isc_result_t result; isc_buffer_t b; dns_fixedname_t fixed; @@ -4660,18 +4669,22 @@ ns_server_flushname(ns_server_t *server, char *args) { result = isc_task_beginexclusive(server->task); RUNTIME_CHECK(result == ISC_R_SUCCESS); flushed = ISC_TRUE; + found = ISC_FALSE; for (view = ISC_LIST_HEAD(server->viewlist); view != NULL; view = ISC_LIST_NEXT(view, link)) { if (viewname != NULL && strcasecmp(viewname, view->name) != 0) continue; + found = ISC_TRUE; result = dns_view_flushname(view, name); if (result != ISC_R_SUCCESS) flushed = ISC_FALSE; } - if (flushed) + if (flushed && found) result = ISC_R_SUCCESS; + else if (!found) + result = ISC_R_NOTFOUND; else result = ISC_R_FAILURE; isc_task_endexclusive(server->task); diff --git a/contrib/bind9/bin/named/update.c b/contrib/bind9/bin/named/update.c index 0547761..98054f8 100644 --- a/contrib/bind9/bin/named/update.c +++ b/contrib/bind9/bin/named/update.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: update.c,v 1.109.18.19 2006/03/06 01:38:00 marka Exp $ */ +/* $Id: update.c,v 1.109.18.23 2007/08/28 07:20:01 tbox Exp $ */ #include <config.h> @@ -1675,6 +1675,9 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, if (check_ksk && type != dns_rdatatype_dnskey && (dst_key_flags(keys[i]) & DNS_KEYFLAG_KSK) != 0) continue; + + if (!dst_key_isprivate(keys[i])) + continue; /* Calculate the signature, creating a RRSIG RDATA. */ CHECK(dns_dnssec_sign(name, &rdataset, keys[i], @@ -2186,7 +2189,7 @@ remove_orphaned_ds(dns_db_t *db, dns_dbversion_t *newver, dns_diff_t *diff) { for (t = ISC_LIST_HEAD(diff->tuples); t != NULL; t = ISC_LIST_NEXT(t, link)) { - if (t->op != DNS_DIFFOP_DEL || + if (t->op != DNS_DIFFOP_ADD || t->rdata.type != dns_rdatatype_ns) continue; CHECK(rrset_exists(db, newver, &t->name, dns_rdatatype_ns, 0, @@ -2237,7 +2240,7 @@ check_mx(ns_client_t *client, dns_zone_t *zone, for (t = ISC_LIST_HEAD(diff->tuples); t != NULL; t = ISC_LIST_NEXT(t, link)) { - if (t->op != DNS_DIFFOP_DEL || + if (t->op != DNS_DIFFOP_ADD || t->rdata.type != dns_rdatatype_mx) continue; diff --git a/contrib/bind9/bin/nsupdate/nsupdate.8 b/contrib/bind9/bin/nsupdate/nsupdate.8 index 5b9f247..8e3963a 100644 --- a/contrib/bind9/bin/nsupdate/nsupdate.8 +++ b/contrib/bind9/bin/nsupdate/nsupdate.8 @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: nsupdate.8,v 1.30.18.13 2007/01/30 00:23:44 marka Exp $ +.\" $Id: nsupdate.8,v 1.30.18.14 2007/05/09 03:33:13 marka Exp $ .\" .hy 0 .ad l @@ -55,7 +55,7 @@ operate in debug mode. This provides tracing information about the update reques .PP Transaction signatures can be used to authenticate the Dynamic DNS updates. These use the TSIG resource record type described in RFC2845 or the SIG(0) record described in RFC3535 and RFC2931. TSIG relies on a shared secret that should only be known to \fBnsupdate\fR -and the name server. Currently, the only supported encryption algorithm for TSIG is HMAC\-MD5, which is defined in RFC 2104. Once other algorithms are defined for TSIG, applications will need to ensure they select the appropriate algorithm as well as the key when authenticating each other. For instance suitable +and the name server. Currently, the only supported encryption algorithm for TSIG is HMAC\-MD5, which is defined in RFC 2104. Once other algorithms are defined for TSIG, applications will need to ensure they select the appropriate algorithm as well as the key when authenticating each other. For instance, suitable \fBkey\fR and \fBserver\fR @@ -106,15 +106,15 @@ use a TCP connection. This may be preferable when a batch of update requests is .PP The \fB\-t\fR -option sets the maximum time a update request can take before it is aborted. The default is 300 seconds. Zero can be used to disable the timeout. +option sets the maximum time an update request can take before it is aborted. The default is 300 seconds. Zero can be used to disable the timeout. .PP The \fB\-u\fR -option sets the UDP retry interval. The default is 3 seconds. If zero the interval will be computed from the timeout interval and number of UDP retries. +option sets the UDP retry interval. The default is 3 seconds. If zero, the interval will be computed from the timeout interval and number of UDP retries. .PP The \fB\-r\fR -option sets the number of UDP retries. The default is 3. If zero only one update request will be made. +option sets the number of UDP retries. The default is 3. If zero, only one update request will be made. .SH "INPUT FORMAT" .PP \fBnsupdate\fR @@ -164,13 +164,13 @@ will attempt determine the correct zone to update based on the rest of the input .RS 4 Specify the default class. If no \fIclass\fR -is specified the default class is +is specified, the default class is \fIIN\fR. .RE .PP \fBkey\fR {name} {secret} .RS 4 -Specifies that all updates are to be TSIG signed using the +Specifies that all updates are to be TSIG\-signed using the \fIkeyname\fR \fIkeysecret\fR pair. The @@ -293,9 +293,9 @@ zone. Notice that the input in each example contains a trailing blank line so th .PP Any A records for \fBoldhost.example.com\fR -are deleted. and an A record for +are deleted. And an A record for \fBnewhost.example.com\fR -it IP address 172.16.1.1 is added. The newly\-added record has a 1 day TTL (86400 seconds) +with IP address 172.16.1.1 is added. The newly\-added record has a 1 day TTL (86400 seconds). .sp .RS 4 .nf diff --git a/contrib/bind9/bin/nsupdate/nsupdate.c b/contrib/bind9/bin/nsupdate/nsupdate.c index 412505e..7f10174 100644 --- a/contrib/bind9/bin/nsupdate/nsupdate.c +++ b/contrib/bind9/bin/nsupdate/nsupdate.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: nsupdate.c,v 1.130.18.15 2006/12/07 05:39:45 marka Exp $ */ +/* $Id: nsupdate.c,v 1.130.18.19 2007/08/28 07:20:01 tbox Exp $ */ /*! \file */ @@ -1565,8 +1565,11 @@ user_interaction(void) { isc_uint16_t result = STATUS_MORE; ddebug("user_interaction()"); - while ((result == STATUS_MORE) || (result == STATUS_SYNTAX)) + while ((result == STATUS_MORE) || (result == STATUS_SYNTAX)) { result = get_next_command(); + if (!interactive && result == STATUS_SYNTAX) + fatal("syntax error"); + } if (result == STATUS_SEND) return (ISC_TRUE); return (ISC_FALSE); @@ -2063,6 +2066,10 @@ start_update(void) { result = dns_message_firstname(updatemsg, section); } if (result != ISC_R_SUCCESS) { + dns_message_puttempname(soaquery, &name); + dns_rdataset_disassociate(rdataset); + dns_message_puttemprdataset(soaquery, &rdataset); + dns_message_destroy(&soaquery); done_update(); return; } diff --git a/contrib/bind9/bin/nsupdate/nsupdate.docbook b/contrib/bind9/bin/nsupdate/nsupdate.docbook index 77eff65..0ea4906 100644 --- a/contrib/bind9/bin/nsupdate/nsupdate.docbook +++ b/contrib/bind9/bin/nsupdate/nsupdate.docbook @@ -5,7 +5,7 @@ - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000-2003 Internet Software Consortium. - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: nsupdate.docbook,v 1.18.18.8 2007/01/29 23:57:20 marka Exp $ --> +<!-- $Id: nsupdate.docbook,v 1.18.18.10 2007/08/28 07:20:01 tbox Exp $ --> <refentry> <refentryinfo> <date>Jun 30, 2000</date> @@ -112,7 +112,7 @@ Once other algorithms are defined for TSIG, applications will need to ensure they select the appropriate algorithm as well as the key when authenticating each other. - For instance suitable + For instance, suitable <type>key</type> and <type>server</type> @@ -170,7 +170,7 @@ This may be preferable when a batch of update requests is made. </para> <para> - The <option>-t</option> option sets the maximum time a update request + The <option>-t</option> option sets the maximum time an update request can take before it is aborted. The default is 300 seconds. Zero can be used @@ -179,14 +179,14 @@ <para> The <option>-u</option> option sets the UDP retry interval. The default is - 3 seconds. If zero the interval will be computed from the timeout + 3 seconds. If zero, the interval will be computed from the timeout interval and number of UDP retries. </para> <para> The <option>-r</option> option sets the number of UDP retries. The default is - 3. If zero only one update request will be made. + 3. If zero, only one update request will be made. </para> </refsect1> @@ -297,7 +297,7 @@ <listitem> <para> Specify the default class. - If no <parameter>class</parameter> is specified the + If no <parameter>class</parameter> is specified, the default class is <parameter>IN</parameter>. </para> @@ -312,7 +312,7 @@ </term> <listitem> <para> - Specifies that all updates are to be TSIG signed using the + Specifies that all updates are to be TSIG-signed using the <parameter>keyname</parameter> <parameter>keysecret</parameter> pair. The <command>key</command> command overrides any key specified on the command line via @@ -543,10 +543,10 @@ Any A records for <type>oldhost.example.com</type> are deleted. - and an A record for + And an A record for <type>newhost.example.com</type> - it IP address 172.16.1.1 is added. - The newly-added record has a 1 day TTL (86400 seconds) + with IP address 172.16.1.1 is added. + The newly-added record has a 1 day TTL (86400 seconds). <programlisting> # nsupdate > prereq nxdomain nickname.example.com diff --git a/contrib/bind9/bin/nsupdate/nsupdate.html b/contrib/bind9/bin/nsupdate/nsupdate.html index ecf52ab..d11b57e 100644 --- a/contrib/bind9/bin/nsupdate/nsupdate.html +++ b/contrib/bind9/bin/nsupdate/nsupdate.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: nsupdate.html,v 1.14.18.21 2007/01/30 00:23:44 marka Exp $ --> +<!-- $Id: nsupdate.html,v 1.14.18.22 2007/05/09 03:33:13 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -77,7 +77,7 @@ Once other algorithms are defined for TSIG, applications will need to ensure they select the appropriate algorithm as well as the key when authenticating each other. - For instance suitable + For instance, suitable <span class="type">key</span> and <span class="type">server</span> @@ -133,7 +133,7 @@ This may be preferable when a batch of update requests is made. </p> <p> - The <code class="option">-t</code> option sets the maximum time a update request + The <code class="option">-t</code> option sets the maximum time an update request can take before it is aborted. The default is 300 seconds. Zero can be used @@ -142,14 +142,14 @@ <p> The <code class="option">-u</code> option sets the UDP retry interval. The default is - 3 seconds. If zero the interval will be computed from the timeout + 3 seconds. If zero, the interval will be computed from the timeout interval and number of UDP retries. </p> <p> The <code class="option">-r</code> option sets the number of UDP retries. The default is - 3. If zero only one update request will be made. + 3. If zero, only one update request will be made. </p> </div> <div class="refsect1" lang="en"> @@ -242,7 +242,7 @@ </span></dt> <dd><p> Specify the default class. - If no <em class="parameter"><code>class</code></em> is specified the + If no <em class="parameter"><code>class</code></em> is specified, the default class is <em class="parameter"><code>IN</code></em>. </p></dd> @@ -252,7 +252,7 @@ {secret} </span></dt> <dd><p> - Specifies that all updates are to be TSIG signed using the + Specifies that all updates are to be TSIG-signed using the <em class="parameter"><code>keyname</code></em> <em class="parameter"><code>keysecret</code></em> pair. The <span><strong class="command">key</strong></span> command overrides any key specified on the command line via @@ -402,7 +402,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2544649"></a><h2>EXAMPLES</h2> +<a name="id2544648"></a><h2>EXAMPLES</h2> <p> The examples below show how <span><strong class="command">nsupdate</strong></span> @@ -428,10 +428,10 @@ Any A records for <span class="type">oldhost.example.com</span> are deleted. - and an A record for + And an A record for <span class="type">newhost.example.com</span> - it IP address 172.16.1.1 is added. - The newly-added record has a 1 day TTL (86400 seconds) + with IP address 172.16.1.1 is added. + The newly-added record has a 1 day TTL (86400 seconds). </p> <pre class="programlisting"> # nsupdate @@ -456,7 +456,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2544693"></a><h2>FILES</h2> +<a name="id2544692"></a><h2>FILES</h2> <div class="variablelist"><dl> <dt><span class="term"><code class="constant">/etc/resolv.conf</code></span></dt> <dd><p> @@ -475,7 +475,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2544830"></a><h2>SEE ALSO</h2> +<a name="id2544829"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">RFC2136</span></span>, <span class="citerefentry"><span class="refentrytitle">RFC3007</span></span>, <span class="citerefentry"><span class="refentrytitle">RFC2104</span></span>, @@ -488,7 +488,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2544901"></a><h2>BUGS</h2> +<a name="id2544900"></a><h2>BUGS</h2> <p> The TSIG key is redundantly stored in two separate files. This is a consequence of nsupdate using the DST library diff --git a/contrib/bind9/bin/rndc/Makefile.in b/contrib/bind9/bin/rndc/Makefile.in index eed3c0a..3bc72b1 100644 --- a/contrib/bind9/bin/rndc/Makefile.in +++ b/contrib/bind9/bin/rndc/Makefile.in @@ -1,7 +1,7 @@ # Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 2000-2002 Internet Software Consortium. # -# Permission to use, copy, modify, and distribute this software for any +# Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above # copyright notice and this permission notice appear in all copies. # @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: Makefile.in,v 1.40.18.3 2007/01/19 00:55:49 marka Exp $ +# $Id: Makefile.in,v 1.40.18.4 2007/08/28 07:20:01 tbox Exp $ srcdir = @srcdir@ VPATH = @srcdir@ diff --git a/contrib/bind9/bin/rndc/rndc-confgen.docbook b/contrib/bind9/bin/rndc/rndc-confgen.docbook index 7267f5c..c694f4b 100644 --- a/contrib/bind9/bin/rndc/rndc-confgen.docbook +++ b/contrib/bind9/bin/rndc/rndc-confgen.docbook @@ -5,7 +5,7 @@ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2001, 2003 Internet Software Consortium. - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: rndc-confgen.docbook,v 1.6.18.6 2007/01/29 23:57:20 marka Exp $ --> +<!-- $Id: rndc-confgen.docbook,v 1.6.18.7 2007/08/28 07:20:01 tbox Exp $ --> <refentry id="man.rndc-confgen"> <refentryinfo> <date>Aug 27, 2001</date> diff --git a/contrib/bind9/bin/rndc/rndc.8 b/contrib/bind9/bin/rndc/rndc.8 index 11e0c2d..14a51b3 100644 --- a/contrib/bind9/bin/rndc/rndc.8 +++ b/contrib/bind9/bin/rndc/rndc.8 @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: rndc.8,v 1.26.18.12 2007/01/30 00:23:44 marka Exp $ +.\" $Id: rndc.8,v 1.26.18.15 2007/06/20 02:26:58 marka Exp $ .\" .hy 0 .ad l @@ -47,8 +47,7 @@ is invoked with no command line options or arguments, it prints a short summary communicates with the name server over a TCP connection, sending commands authenticated with digital signatures. In the current versions of \fBrndc\fR and -\fBnamed\fR -named the only supported authentication algorithm is HMAC\-MD5, which uses a shared secret on each end of the connection. This provides TSIG\-style authentication for the command request and the name server's response. All commands sent over the channel must be signed by a key_id known to the server. +\fBnamed\fR, the only supported authentication algorithm is HMAC\-MD5, which uses a shared secret on each end of the connection. This provides TSIG\-style authentication for the command request and the name server's response. All commands sent over the channel must be signed by a key_id known to the server. .PP \fBrndc\fR reads a configuration file to determine how to contact the name server and decide what algorithm and key it should use. @@ -85,7 +84,9 @@ does not exist. .RS 4 \fIserver\fR is the name or address of the server which matches a server statement in the configuration file for -\fBrndc\fR. If no server is supplied on the command line, the host named by the default\-server clause in the option statement of the configuration file will be used. +\fBrndc\fR. If no server is supplied on the command line, the host named by the default\-server clause in the options statement of the +\fBrndc\fR +configuration file will be used. .RE .PP \-p \fIport\fR @@ -100,14 +101,14 @@ instead of BIND 9's default control channel port, 953. Enable verbose logging. .RE .PP -\-y \fIkeyid\fR +\-y \fIkey_id\fR .RS 4 Use the key -\fIkeyid\fR +\fIkey_id\fR from the configuration file. -\fIkeyid\fR +\fIkey_id\fR must be known by named with the same algorithm and secret string in order for control message validation to succeed. If no -\fIkeyid\fR +\fIkey_id\fR is specified, \fBrndc\fR will first look for a key clause in the server statement of the server being used, or if no server statement is present for that host, then the default\-key clause of the options statement. Note that the configuration file contains shared secrets which are used to send authenticated control commands to name servers. It should therefore not have general read or write access. @@ -133,7 +134,7 @@ Several error messages could be clearer. .PP \fBrndc.conf\fR(5), \fBnamed\fR(8), -\fBnamed.conf\fR(5) +\fBnamed.conf\fR(5), \fBndc\fR(8), BIND 9 Administrator Reference Manual. .SH "AUTHOR" diff --git a/contrib/bind9/bin/rndc/rndc.conf.5 b/contrib/bind9/bin/rndc/rndc.conf.5 index ce12151..dbeb707 100644 --- a/contrib/bind9/bin/rndc/rndc.conf.5 +++ b/contrib/bind9/bin/rndc/rndc.conf.5 @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: rndc.conf.5,v 1.23.18.13 2007/01/30 00:23:44 marka Exp $ +.\" $Id: rndc.conf.5,v 1.23.18.15 2007/05/09 13:35:47 marka Exp $ .\" .hy 0 .ad l @@ -88,7 +88,7 @@ keyword, the server statement includes a string which is the hostname or address and \fBaddresses\fR. The key name must match the name of a key statement in the file. The port number specifies the port to connect to. If an \fBaddresses\fR -clause is supplied these addresses will be used instead of the server name. Each address can take a optional port. If an +clause is supplied these addresses will be used instead of the server name. Each address can take an optional port. If an \fBsource\-address\fR or \fBsource\-address\-v6\fR @@ -156,7 +156,7 @@ does not ship with BIND 9 but is available on many systems. See the EXAMPLE sect key testkey { algorithm hmac\-md5; secret "R3HI8P6BKw9ZwXwN3VZKuQ=="; - } + }; .fi .RE .sp @@ -178,7 +178,7 @@ To generate a random secret with .PP A complete \fIrndc.conf\fR -file, including the randomly generated key, will be written to the standard output. Commented out +file, including the randomly generated key, will be written to the standard output. Commented\-out \fBkey\fR and \fBcontrols\fR diff --git a/contrib/bind9/bin/rndc/rndc.conf.docbook b/contrib/bind9/bin/rndc/rndc.conf.docbook index 624a235..ebea7af 100644 --- a/contrib/bind9/bin/rndc/rndc.conf.docbook +++ b/contrib/bind9/bin/rndc/rndc.conf.docbook @@ -5,7 +5,7 @@ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: rndc.conf.docbook,v 1.5.18.9 2007/01/29 23:57:20 marka Exp $ --> +<!-- $Id: rndc.conf.docbook,v 1.5.18.12 2007/08/28 07:20:01 tbox Exp $ --> <refentry id="man.rndc.conf"> <refentryinfo> <date>June 30, 2000</date> @@ -111,7 +111,7 @@ name of a key statement in the file. The port number specifies the port to connect to. If an <option>addresses</option> clause is supplied these addresses will be used instead of - the server name. Each address can take a optional port. + the server name. Each address can take an optional port. If an <option>source-address</option> or <option>source-address-v6</option> of supplied then these will be used to specify the IPv4 and IPv6 source addresses respectively. @@ -175,7 +175,7 @@ key testkey { algorithm hmac-md5; secret "R3HI8P6BKw9ZwXwN3VZKuQ=="; - } + }; </programlisting> </para> @@ -202,7 +202,7 @@ A complete <filename>rndc.conf</filename> file, including the randomly generated key, will be written to the standard - output. Commented out <option>key</option> and + output. Commented-out <option>key</option> and <option>controls</option> statements for <filename>named.conf</filename> are also printed. </para> diff --git a/contrib/bind9/bin/rndc/rndc.conf.html b/contrib/bind9/bin/rndc/rndc.conf.html index 8e510bd..d11f9df 100644 --- a/contrib/bind9/bin/rndc/rndc.conf.html +++ b/contrib/bind9/bin/rndc/rndc.conf.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: rndc.conf.html,v 1.6.18.21 2007/01/30 00:23:44 marka Exp $ --> +<!-- $Id: rndc.conf.html,v 1.6.18.23 2007/05/09 13:35:47 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -87,7 +87,7 @@ name of a key statement in the file. The port number specifies the port to connect to. If an <code class="option">addresses</code> clause is supplied these addresses will be used instead of - the server name. Each address can take a optional port. + the server name. Each address can take an optional port. If an <code class="option">source-address</code> or <code class="option">source-address-v6</code> of supplied then these will be used to specify the IPv4 and IPv6 source addresses respectively. @@ -153,7 +153,7 @@ key testkey { algorithm hmac-md5; secret "R3HI8P6BKw9ZwXwN3VZKuQ=="; - } + }; </pre> <p> </p> @@ -180,7 +180,7 @@ A complete <code class="filename">rndc.conf</code> file, including the randomly generated key, will be written to the standard - output. Commented out <code class="option">key</code> and + output. Commented-out <code class="option">key</code> and <code class="option">controls</code> statements for <code class="filename">named.conf</code> are also printed. </p> diff --git a/contrib/bind9/bin/rndc/rndc.docbook b/contrib/bind9/bin/rndc/rndc.docbook index 5dd2606..0719a74 100644 --- a/contrib/bind9/bin/rndc/rndc.docbook +++ b/contrib/bind9/bin/rndc/rndc.docbook @@ -5,7 +5,7 @@ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: rndc.docbook,v 1.8.18.8 2007/01/29 23:57:20 marka Exp $ --> +<!-- $Id: rndc.docbook,v 1.8.18.12 2007/08/28 07:20:01 tbox Exp $ --> <refentry id="man.rndc"> <refentryinfo> <date>June 30, 2000</date> @@ -78,7 +78,7 @@ communicates with the name server over a TCP connection, sending commands authenticated with digital signatures. In the current versions of - <command>rndc</command> and <command>named</command> named + <command>rndc</command> and <command>named</command>, the only supported authentication algorithm is HMAC-MD5, which uses a shared secret on each end of the connection. This provides TSIG-style authentication for the command @@ -139,13 +139,12 @@ <term>-s <replaceable class="parameter">server</replaceable></term> <listitem> <para><replaceable class="parameter">server</replaceable> is - the name or address of the server which matches a + the name or address of the server which matches a server statement in the configuration file for - <command>rndc</command>. If no server is supplied on - the + <command>rndc</command>. If no server is supplied on the command line, the host named by the default-server clause - in the option statement of the configuration file will be - used. + in the options statement of the <command>rndc</command> + configuration file will be used. </para> </listitem> </varlistentry> @@ -172,16 +171,16 @@ </varlistentry> <varlistentry> - <term>-y <replaceable class="parameter">keyid</replaceable></term> + <term>-y <replaceable class="parameter">key_id</replaceable></term> <listitem> <para> - Use the key <replaceable class="parameter">keyid</replaceable> + Use the key <replaceable class="parameter">key_id</replaceable> from the configuration file. - <replaceable class="parameter">keyid</replaceable> + <replaceable class="parameter">key_id</replaceable> must be known by named with the same algorithm and secret string in order for control message validation to succeed. - If no <replaceable class="parameter">keyid</replaceable> + If no <replaceable class="parameter">key_id</replaceable> is specified, <command>rndc</command> will first look for a key clause in the server statement of the server being used, or if no server statement is present for that @@ -230,7 +229,7 @@ </citerefentry>, <citerefentry> <refentrytitle>named.conf</refentrytitle><manvolnum>5</manvolnum> - </citerefentry> + </citerefentry>, <citerefentry> <refentrytitle>ndc</refentrytitle><manvolnum>8</manvolnum> </citerefentry>, diff --git a/contrib/bind9/bin/rndc/rndc.html b/contrib/bind9/bin/rndc/rndc.html index 35e949a..d4d0ebb 100644 --- a/contrib/bind9/bin/rndc/rndc.html +++ b/contrib/bind9/bin/rndc/rndc.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: rndc.html,v 1.8.18.19 2007/01/30 00:23:44 marka Exp $ --> +<!-- $Id: rndc.html,v 1.8.18.22 2007/06/20 02:26:58 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -46,7 +46,7 @@ communicates with the name server over a TCP connection, sending commands authenticated with digital signatures. In the current versions of - <span><strong class="command">rndc</strong></span> and <span><strong class="command">named</strong></span> named + <span><strong class="command">rndc</strong></span> and <span><strong class="command">named</strong></span>, the only supported authentication algorithm is HMAC-MD5, which uses a shared secret on each end of the connection. This provides TSIG-style authentication for the command @@ -88,13 +88,12 @@ </p></dd> <dt><span class="term">-s <em class="replaceable"><code>server</code></em></span></dt> <dd><p><em class="replaceable"><code>server</code></em> is - the name or address of the server which matches a + the name or address of the server which matches a server statement in the configuration file for - <span><strong class="command">rndc</strong></span>. If no server is supplied on - the + <span><strong class="command">rndc</strong></span>. If no server is supplied on the command line, the host named by the default-server clause - in the option statement of the configuration file will be - used. + in the options statement of the <span><strong class="command">rndc</strong></span> + configuration file will be used. </p></dd> <dt><span class="term">-p <em class="replaceable"><code>port</code></em></span></dt> <dd><p> @@ -107,15 +106,15 @@ <dd><p> Enable verbose logging. </p></dd> -<dt><span class="term">-y <em class="replaceable"><code>keyid</code></em></span></dt> +<dt><span class="term">-y <em class="replaceable"><code>key_id</code></em></span></dt> <dd><p> - Use the key <em class="replaceable"><code>keyid</code></em> + Use the key <em class="replaceable"><code>key_id</code></em> from the configuration file. - <em class="replaceable"><code>keyid</code></em> + <em class="replaceable"><code>key_id</code></em> must be known by named with the same algorithm and secret string in order for control message validation to succeed. - If no <em class="replaceable"><code>keyid</code></em> + If no <em class="replaceable"><code>key_id</code></em> is specified, <span><strong class="command">rndc</strong></span> will first look for a key clause in the server statement of the server being used, or if no server statement is present for that @@ -134,7 +133,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543652"></a><h2>LIMITATIONS</h2> +<a name="id2543656"></a><h2>LIMITATIONS</h2> <p><span><strong class="command">rndc</strong></span> does not yet support all the commands of the BIND 8 <span><strong class="command">ndc</strong></span> utility. @@ -148,16 +147,16 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543678"></a><h2>SEE ALSO</h2> +<a name="id2543683"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>, <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, - <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span> + <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>, <span class="citerefentry"><span class="refentrytitle">ndc</span>(8)</span>, <em class="citetitle">BIND 9 Administrator Reference Manual</em>. </p> </div> <div class="refsect1" lang="en"> -<a name="id2543725"></a><h2>AUTHOR</h2> +<a name="id2543730"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/contrib/bind9/configure.in b/contrib/bind9/configure.in index 3e3d743..b9280a3 100644 --- a/contrib/bind9/configure.in +++ b/contrib/bind9/configure.in @@ -1,7 +1,7 @@ # Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 1998-2003 Internet Software Consortium. # -# Permission to use, copy, modify, and distribute this software for any +# Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above # copyright notice and this permission notice appear in all copies. # @@ -18,7 +18,7 @@ AC_DIVERT_PUSH(1)dnl esyscmd([sed "s/^/# /" COPYRIGHT])dnl AC_DIVERT_POP()dnl -AC_REVISION($Revision: 1.355.18.67 $) +AC_REVISION($Revision: 1.355.18.71 $) AC_INIT(lib/dns/name.c) AC_PREREQ(2.59) @@ -429,6 +429,21 @@ case "$use_openssl" in *-hp-hpux*) DNS_OPENSSL_LIBS="-L$use_openssl/lib -Wl,+b: -lcrypto" ;; + *-apple-darwin*) + # + # Apple's ld seaches for serially for dynamic + # then static libraries. This means you can't + # use -L to override dynamic system libraries + # with static ones when linking. Instead + # we specify a absolute path. + # + if test -f "$use_openssl/lib/libcrypto.dylib" + then + DNS_OPENSSL_LIBS="-L$use_openssl/lib -lcrypto" + else + DNS_OPENSSL_LIBS="$use_openssl/lib/libcrypto.a" + fi + ;; *) DNS_OPENSSL_LIBS="-L$use_openssl/lib -lcrypto" ;; @@ -1865,6 +1880,13 @@ case "$hack_shutup_stdargcast" in ;; esac +AC_CHECK_HEADERS(strings.h, + ISC_PLATFORM_HAVESTRINGSH="#define ISC_PLATFORM_HAVESTRINGSH 1" +, + ISC_PLATFORM_HAVESTRINGSH="#undef ISC_PLATFORM_HAVESTRINGSH" +) +AC_SUBST(ISC_PLATFORM_HAVESTRINGSH) + # # Check for if_nametoindex() for IPv6 scoped addresses support # @@ -2424,6 +2446,9 @@ AC_CONFIG_FILES([ lib/isc/$thread_dir/Makefile lib/isc/$thread_dir/include/Makefile lib/isc/$thread_dir/include/isc/Makefile + lib/isc/$arch/Makefile + lib/isc/$arch/include/Makefile + lib/isc/$arch/include/isc/Makefile lib/isccc/Makefile lib/isccc/include/Makefile lib/isccc/include/isccc/Makefile diff --git a/contrib/bind9/doc/arm/Bv9ARM-book.xml b/contrib/bind9/doc/arm/Bv9ARM-book.xml index 3e7b530..e30ca3f 100644 --- a/contrib/bind9/doc/arm/Bv9ARM-book.xml +++ b/contrib/bind9/doc/arm/Bv9ARM-book.xml @@ -5,7 +5,7 @@ - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000-2003 Internet Software Consortium. - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- File: $Id: Bv9ARM-book.xml,v 1.241.18.66.10.1 2007/07/09 02:23:16 marka Exp $ --> +<!-- File: $Id: Bv9ARM-book.xml,v 1.241.18.82 2007/09/26 03:28:27 marka Exp $ --> <book xmlns:xi="http://www.w3.org/2001/XInclude"> <title>BIND 9 Administrator Reference Manual</title> @@ -91,8 +91,8 @@ security considerations, and <emphasis>Section 8</emphasis> contains troubleshooting help. The main body of the document is followed by several - <emphasis>Appendices</emphasis> which contain useful reference - information, such as a <emphasis>Bibliography</emphasis> and + <emphasis>appendices</emphasis> which contain useful reference + information, such as a <emphasis>bibliography</emphasis> and historic information related to <acronym>BIND</acronym> and the Domain Name System. @@ -229,8 +229,8 @@ <title>The Domain Name System (<acronym>DNS</acronym>)</title> <para> The purpose of this document is to explain the installation - and upkeep of the <acronym>BIND</acronym> software - package, and we + and upkeep of the <acronym>BIND</acronym> (Berkeley Internet + Name Domain) software package, and we begin by reviewing the fundamentals of the Domain Name System (<acronym>DNS</acronym>) as they relate to <acronym>BIND</acronym>. </para> @@ -464,7 +464,7 @@ <title>Caching Name Servers</title> <!-- - - Terminology here is inconsistant. Probably ought to + - Terminology here is inconsistent. Probably ought to - convert to using "recursive name server" everywhere - with just a note about "caching" terminology. --> @@ -600,7 +600,7 @@ traffic. Additionally, if additional section caching (<xref linkend="acache"/>) is enabled, - the <command>max-acache-size</command> can be used to + the <command>max-acache-size</command> option can be used to limit the amount of memory used by the mechanism. It is still good practice to have enough memory to load @@ -741,8 +741,8 @@ zone "eng.example.com" { <para> A primitive form of load balancing can be achieved in - the <acronym>DNS</acronym> by using multiple A records for - one name. + the <acronym>DNS</acronym> by using multiple records + (such as multiple A records) for one name. </para> <para> @@ -955,12 +955,15 @@ zone "eng.example.com" { </para> <cmdsynopsis label="Usage"> <command>host</command> - <arg>-aCdlrTwv</arg> + <arg>-aCdlnrsTwv</arg> <arg>-c <replaceable>class</replaceable></arg> <arg>-N <replaceable>ndots</replaceable></arg> <arg>-t <replaceable>type</replaceable></arg> <arg>-W <replaceable>timeout</replaceable></arg> <arg>-R <replaceable>retries</replaceable></arg> + <arg>-m <replaceable>flag</replaceable></arg> + <arg>-4</arg> + <arg>-6</arg> <arg choice="plain"><replaceable>hostname</replaceable></arg> <arg><replaceable>server</replaceable></arg> </cmdsynopsis> @@ -1085,6 +1088,12 @@ zone "eng.example.com" { (<command>rndc</command>) program allows the system administrator to control the operation of a name server. + Since <acronym>BIND</acronym> 9.2, <command>rndc</command> + supports all the commands of the BIND 8 <command>ndc</command> + utility except <command>ndc start</command> and + <command>ndc restart</command>, which were also + not supported in <command>ndc</command>'s + channel mode. If you run <command>rndc</command> without any options it will display a usage message as follows: @@ -1357,15 +1366,6 @@ zone "eng.example.com" { </variablelist> <para> - In <acronym>BIND</acronym> 9.2, <command>rndc</command> - supports all the commands of the BIND 8 <command>ndc</command> - utility except <command>ndc start</command> and - <command>ndc restart</command>, which were also - not supported in <command>ndc</command>'s - channel mode. - </para> - - <para> A configuration file is required, since all communication with the server is authenticated with digital signatures that rely on a shared secret, and @@ -1743,7 +1743,7 @@ controls { However, since listing addresses of internal servers that external clients cannot possibly reach can result in connection delays and other annoyances, an organization may - choose to use a Split DNS to present a consistant view of itself + choose to use a Split DNS to present a consistent view of itself to the outside world. </para> <para> @@ -1753,9 +1753,8 @@ controls { on the Internet. Split DNS can also be used to allow mail from outside back in to the internal network. </para> - <para> - Here is an example of a split DNS setup: - </para> + <sect2> + <title>Example split DNS setup</title> <para> Let's say a company named <emphasis>Example, Inc.</emphasis> (<literal>example.com</literal>) @@ -1990,6 +1989,7 @@ nameserver 172.16.72.3 nameserver 172.16.72.4 </programlisting> + </sect2> </sect1> <sect1 id="tsig"> <title>TSIG</title> @@ -2187,7 +2187,7 @@ allow-update { key host1-host2. ;}; outside of the allowed range, the response will be signed with the TSIG extended error code set to BADTIME, and the time values will be adjusted so that the response can be successfully - verified. In any of these cases, the message's rcode is set to + verified. In any of these cases, the message's rcode (response code) is set to NOTAUTH (not authenticated). </para> @@ -2266,7 +2266,7 @@ allow-update { key host1-host2. ;}; <para> Cryptographic authentication of DNS information is possible through the DNS Security (<emphasis>DNSSEC-bis</emphasis>) extensions, - defined in RFC 4033, RFC 4034 and RFC 4035. + defined in RFC 4033, RFC 4034, and RFC 4035. This section describes the creation and use of DNSSEC signed zones. </para> @@ -2334,7 +2334,7 @@ allow-update { key host1-host2. ;}; <filename>Kchild.example.+005+12345.key</filename> and <filename>Kchild.example.+005+12345.private</filename> (where - 12345 is an example of a key tag). The key file names contain + 12345 is an example of a key tag). The key filenames contain the key name (<filename>child.example.</filename>), algorithm (3 is DSA, 1 is RSAMD5, 5 is RSASHA1, etc.), and the key tag (12345 in @@ -2402,7 +2402,7 @@ allow-update { key host1-host2. ;}; <para><command>dnssec-signzone</command> will also produce a keyset and dsset files and optionally a dlvset file. These are used to provide the parent zone - administators with the <literal>DNSKEYs</literal> (or their + administrators with the <literal>DNSKEYs</literal> (or their corresponding <literal>DS</literal> records) that are the secure entry point to the zone. </para> @@ -2421,7 +2421,7 @@ allow-update { key host1-host2. ;}; <para> To enable <command>named</command> to validate answers from other servers both <command>dnssec-enable</command> and - <command>dnssec-validate</command> must be set and some + <command>dnssec-validation</command> must be set and some <command>trusted-keys</command> must be configured into <filename>named.conf</filename>. </para> @@ -2840,7 +2840,7 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa. <entry colname="2"> <para> An IP port <varname>number</varname>. - <varname>number</varname> is limited to 0 + The <varname>number</varname> is limited to 0 through 65535, with values below 1024 typically restricted to use by processes running as root. @@ -3109,7 +3109,7 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa. <para> The <acronym>BIND</acronym> 9 comment syntax allows for comments to appear - anywhere that white space may appear in a <acronym>BIND</acronym> configuration + anywhere that whitespace may appear in a <acronym>BIND</acronym> configuration file. To appeal to programmers of all kinds, they can be written in the C, C++, or shell/perl style. </para> @@ -3126,7 +3126,7 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa. <sect3> <title>Definition and Usage</title> <para> - Comments may appear anywhere that white space may appear in + Comments may appear anywhere that whitespace may appear in a <acronym>BIND</acronym> configuration file. </para> <para> @@ -3649,7 +3649,7 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa. <literal>hmac-sha256</literal>, <literal>hmac-sha384</literal> and <literal>hmac-sha512</literal> TSIG authentication. Truncated hashes are supported by appending the minimum - number of required bits preceeded by a dash, e.g. + number of required bits preceded by a dash, e.g. <literal>hmac-sha1-80</literal>. The <replaceable>secret_string</replaceable> is the secret to be used by the algorithm, and is treated as a base-64 @@ -4289,7 +4289,7 @@ category notify { null; }; The <command>lwres</command> statement configures the name server to also act as a lightweight resolver server. (See - <xref linkend="lwresd"/>.) There may be be multiple + <xref linkend="lwresd"/>.) There may be multiple <command>lwres</command> statements configuring lightweight resolver servers with different properties. </para> @@ -4376,6 +4376,7 @@ category notify { null; }; <optional> dump-file <replaceable>path_name</replaceable>; </optional> <optional> memstatistics-file <replaceable>path_name</replaceable>; </optional> <optional> pid-file <replaceable>path_name</replaceable>; </optional> + <optional> recursing-file <replaceable>path_name</replaceable>; </optional> <optional> statistics-file <replaceable>path_name</replaceable>; </optional> <optional> zone-statistics <replaceable>yes_or_no</replaceable>; </optional> <optional> auth-nxdomain <replaceable>yes_or_no</replaceable>; </optional> @@ -4453,6 +4454,7 @@ category notify { null; }; <optional> alt-transfer-source (<replaceable>ip4_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> ; </optional> <optional> alt-transfer-source-v6 (<replaceable>ip6_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> ; </optional> <optional> use-alt-transfer-source <replaceable>yes_or_no</replaceable>; </optional> + <optional> notify-delay <replaceable>seconds</replaceable> ; </optional> <optional> notify-source (<replaceable>ip4_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> ; </optional> <optional> notify-source-v6 (<replaceable>ip6_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> ; </optional> <optional> also-notify { <replaceable>ip_addr</replaceable> <optional>port <replaceable>ip_port</replaceable></optional> ; <optional> <replaceable>ip_addr</replaceable> <optional>port <replaceable>ip_port</replaceable></optional> ; ... </optional> }; </optional> @@ -4639,12 +4641,18 @@ digits</varname>" + "<varname>tkey-domain</varname>". In most cases, <listitem> <para> The pathname of the file the server writes memory - usage statistics to on exit. If not specified, - the default is - <filename>named.memstats</filename>. + usage statistics to on exit. If specified the + statistics will be written to the file on exit. </para> - </listitem> - </varlistentry> + <para> + In <acronym>BIND</acronym> 9.5 and later this will + default to <filename>named.memstats</filename>. + <acronym>BIND</acronym> 9.5 will also introduce + <command>memstatistics</command> to control the + writing. + </para> + </listitem> + </varlistentry> <varlistentry> <term><command>pid-file</command></term> @@ -4657,7 +4665,7 @@ digits</varname>" + "<varname>tkey-domain</varname>". In most cases, name server. Specifying <command>pid-file none</command> disables the use of a PID file — no file will be written and any existing one will be removed. Note that <command>none</command> - is a keyword, not a file name, and therefore is not enclosed + is a keyword, not a filename, and therefore is not enclosed in double quotes. </para> @@ -4665,6 +4673,18 @@ digits</varname>" + "<varname>tkey-domain</varname>". In most cases, </varlistentry> <varlistentry> + <term><command>recursing-file</command></term> + <listitem> + <para> + The pathname of the file the server dumps + the queries that are currently recursing when instructed + to do so with <command>rndc recursing</command>. + If not specified, the default is <filename>named.recursing</filename>. + </para> + </listitem> + </varlistentry> + + <varlistentry> <term><command>statistics-file</command></term> <listitem> <para> @@ -5286,7 +5306,7 @@ options { <para> <emphasis>This option is obsolete</emphasis>. If you need to disable IXFR to a particular server or - servers see + servers, see the information on the <command>provide-ixfr</command> option in <xref linkend="server_statement_definition_and_usage"/>. See also @@ -5520,6 +5540,7 @@ options { <para> Accept expired signatures when verifying DNSSEC signatures. The default is <userinput>no</userinput>. + Setting this option to "yes" leaves named vulnerable to replay attacks. </para> </listitem> </varlistentry> @@ -5563,7 +5584,7 @@ options { and MX records. It also applies to the RDATA of PTR records where the owner name indicated that it is a reverse lookup of a hostname - (the owner name ends in IN-ADDR.ARPA, IP6.ARPA or IP6.INT). + (the owner name ends in IN-ADDR.ARPA, IP6.ARPA, or IP6.INT). </para> </listitem> </varlistentry> @@ -5606,7 +5627,7 @@ options { MX and SRV records only in-zone hostnames are checked (for out-of-zone hostnames use named-checkzone). For NS records only names below top of zone are - checked (for out-of-zone names and glue consistancy + checked (for out-of-zone names and glue consistency checks use named-checkzone). The default is <command>yes</command>. </para> @@ -6680,7 +6701,7 @@ query-source-v6 address * port *; </para><note> <simpara> Not yet implemented in - <acronym>BIND</acronym>9. + <acronym>BIND</acronym> 9. </simpara> </note> </listitem> @@ -7067,7 +7088,7 @@ query-source-v6 address * port *; values are 512 to 4096 (values outside this range will be silently adjusted). The default value is 4096. The usual reason for setting edns-udp-size to - a non-default value it to get UDP answers to pass + a non-default value is to get UDP answers to pass through broken firewalls that block fragmented packets and/or block UDP packets that are greater than 512 bytes. @@ -7087,6 +7108,8 @@ query-source-v6 address * port *; answers to pass through broken firewalls that block fragmented packets and/or block UDP packets that are greater than 512 bytes. + This is independent of the advertised receive + buffer (<command>edns-udp-size</command>). </para> </listitem> </varlistentry> @@ -7155,6 +7178,16 @@ query-source-v6 address * port *; </para> </listitem> </varlistentry> + + <varlistentry> + <term><command>notify-delay</command></term> + <listitem> + <para> + The delay, in seconds, between sending sets of notify + messages for a zone. The default is zero. + </para> + </listitem> + </varlistentry> </variablelist> </sect3> @@ -7245,7 +7278,7 @@ query-source-v6 address * port *; Named has some built-in empty zones (SOA and NS records only). These are for zones that should normally be answered locally and which queries should not be sent to the Internet's root - servers. The offical servers which cover these namespaces + servers. The official servers which cover these namespaces return NXDOMAIN responses to these queries. In particular, these cover the reverse namespace for addresses from RFC 1918 and RFC 3330. They also include the reverse namespace for IPv6 local @@ -7304,10 +7337,10 @@ query-source-v6 address * port *; If you are using the address ranges covered here, you should already have reverse zones covering the addresses you use. In practice this appears to not be the case with many queries - being made to the infrustructure servers for names in these + being made to the infrastructure servers for names in these spaces. So many in fact that sacrificial servers were needed to be deployed to channel the query load away from the - infrustructure servers. + infrastructure servers. </para> <note> The real parent servers for these zones should disable all @@ -7472,6 +7505,32 @@ query-source-v6 address * port *; </para> </entry> </row> + <row rowsep="0"> + <entry colname="1"> + <para><command>duplicate</command></para> + </entry> + <entry colname="2"> + <para> + The number of queries which the server attempted to + recurse but discover a existing query with the same + IP address, port, query id, name, type and class + already being processed. + </para> + </entry> + </row> + <row rowsep="0"> + <entry colname="1"> + <para><command>dropped</command></para> + </entry> + <entry colname="2"> + <para> + The number of queries for which the server + discovered a excessive number of existing + recursive queries for the same name, type and + class and were subsequently dropped. + </para> + </entry> + </row> </tbody> </tgroup> </informaltable> @@ -8028,6 +8087,7 @@ view "external" { <optional> max-transfer-idle-out <replaceable>number</replaceable> ; </optional> <optional> max-transfer-time-out <replaceable>number</replaceable> ; </optional> <optional> notify <replaceable>yes_or_no</replaceable> | <replaceable>explicit</replaceable> | <replaceable>master-only</replaceable> ; </optional> + <optional> notify-delay <replaceable>seconds</replaceable> ; </optional> <optional> pubkey <replaceable>number</replaceable> <replaceable>number</replaceable> <replaceable>number</replaceable> <replaceable>string</replaceable> ; </optional> <optional> notify-source (<replaceable>ip4_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> ; </optional> <optional> notify-source-v6 (<replaceable>ip6_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> ; </optional> @@ -8194,7 +8254,7 @@ zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replacea numbers (in the tens or hundreds of thousands) of zones per server, it is best to - use a two-level naming scheme for zone file names. For + use a two-level naming scheme for zone filenames. For example, a slave server for the zone <literal>example.com</literal> might place the zone contents into a file called @@ -8364,7 +8424,7 @@ zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replacea a synonym for hesiod. </para> <para> - Another MIT development is CHAOSnet, a LAN protocol created + Another MIT development is Chaosnet, a LAN protocol created in the mid-1970s. Zone data for it can be specified with the <literal>CHAOS</literal> class. </para> </sect3> @@ -8640,8 +8700,8 @@ zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replacea <term><command>journal</command></term> <listitem> <para> - Allow the default journal's file name to be overridden. - The default is the zone's file with "<filename>.jnl</filename>" appended. + Allow the default journal's filename to be overridden. + The default is the zone's filename with "<filename>.jnl</filename>" appended. This is applicable to <command>master</command> and <command>slave</command> zones. </para> </listitem> @@ -8698,6 +8758,16 @@ zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replacea </varlistentry> <varlistentry> + <term><command>notify-delay</command></term> + <listitem> + <para> + See the description of + <command>notify-delay</command> in <xref linkend="tuning"/>. + </para> + </listitem> + </varlistentry> + + <varlistentry> <term><command>pubkey</command></term> <listitem> <para> @@ -8932,7 +9002,7 @@ zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replacea wildcard name, it is subject to DNS wildcard expansion, so the rule will apply to multiple identities. The <replaceable>identity</replaceable> field must - contain a fully qualified domain name. + contain a fully-qualified domain name. </para> <para> @@ -9046,7 +9116,7 @@ zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replacea <para> In all cases, the <replaceable>name</replaceable> field must - specify a fully qualified domain name. + specify a fully-qualified domain name. </para> <para> @@ -9659,7 +9729,7 @@ zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replacea </entry> <entry colname="2"> <para> - CHAOSnet, a LAN protocol created at MIT in the + Chaosnet, a LAN protocol created at MIT in the mid-1970s. Rarely used for its historical purpose, but reused for BIND's @@ -10239,7 +10309,7 @@ zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replacea <note> <para> The <command>$ORIGIN</command> lines in the examples - are for providing context to the examples only-they do not + are for providing context to the examples only — they do not necessarily appear in the actual usage. They are only used here to indicate that the example is relative to the listed origin. @@ -10403,14 +10473,14 @@ $GENERATE 1-127 $ CNAME $.0</programlisting> <para><command>lhs</command></para> </entry> <entry colname="2"> - <para><command>lhs</command> + <para>This describes the owner name of the resource records to be created. Any single <command>$</command> (dollar sign) symbols within the <command>lhs</command> side are replaced by the iterator value. - To get a $ in the output you need to escape the + To get a $ in the output, you need to escape the <command>$</command> using a backslash <command>\</command>, e.g. <command>\$</command>. The @@ -10419,7 +10489,7 @@ $GENERATE 1-127 $ CNAME $.0</programlisting> iterator, field width and base. Modifiers are introduced by a - <command>{</command> immediately following the + <command>{</command> (left brace) immediately following the <command>$</command> as <command>${offset[,width[,base]]}</command>. For example, <command>${-20,3,d}</command> @@ -10492,7 +10562,7 @@ $GENERATE 1-127 $ CNAME $.0</programlisting> </entry> <entry colname="2"> <para> - A domain name. It is processed + <command>rhs</command> is a domain name. It is processed similarly to lhs. </para> </entry> @@ -10619,7 +10689,7 @@ zone "example.com" { </para> </sect1> <sect1> - <title><command>chroot</command> and <command>setuid</command></title> + <title><command>Chroot</command> and <command>Setuid</command></title> <para> On UNIX servers, it is possible to run <acronym>BIND</acronym> in a <emphasis>chrooted</emphasis> environment (using the <command>chroot()</command> function) by specifying the "<option>-t</option>" @@ -10658,7 +10728,7 @@ zone "example.com" { for this. </para> <para> - Unlike with earlier versions of BIND, you will typically + Unlike with earlier versions of BIND, you typically will <emphasis>not</emphasis> need to compile <command>named</command> statically nor install shared libraries under the new root. However, depending on your operating system, you may need @@ -10758,18 +10828,18 @@ zone "example.com" { <sect1> <title>Incrementing and Changing the Serial Number</title> - <para> - Zone serial numbers are just numbers-they aren't date - related. A lot of people set them to a number that represents a - date, usually of the form YYYYMMDDRR. A number of people have been - testing these numbers for Y2K compliance and have set the number - to the year 2000 to see if it will work. They then try to restore - the old serial number. This will cause problems because serial - numbers are used to indicate that a zone has been updated. If the - serial number on the slave server is lower than the serial number - on the master, the slave server will attempt to update its copy of - the zone. - </para> + <para> + Zone serial numbers are just numbers — they aren't + date related. A lot of people set them to a number that + represents a date, usually of the form YYYYMMDDRR. + Occasionally they will make a mistake and set them to a + "date in the future" then try to correct them by setting + them to the "current date". This causes problems because + serial numbers are used to indicate that a zone has been + updated. If the serial number on the slave server is + lower than the serial number on the master, the slave + server will attempt to update its copy of the zone. + </para> <para> Setting the serial number to a lower number on the master @@ -10866,7 +10936,7 @@ zone "example.com" { during that time: Doug Kingston, Craig Partridge, Smoot Carl-Mitchell, Mike Muuss, Jim Bloom and Mike Schwartz. <acronym>BIND</acronym> maintenance was subsequently - handled by Mike Karels and O. Kure. + handled by Mike Karels and Øivind Kure. </para> <para> <acronym>BIND</acronym> versions 4.9 and 4.9.1 were @@ -10881,7 +10951,7 @@ zone "example.com" { Wolfhugel, and others. </para> <para> - <acronym>BIND</acronym> version 4.9.2 was sponsored by + In 1994, <acronym>BIND</acronym> version 4.9.2 was sponsored by Vixie Enterprises. Paul Vixie became <acronym>BIND</acronym>'s principal architect/programmer. @@ -10891,10 +10961,25 @@ zone "example.com" { have been developed and maintained by the Internet Systems Consortium and its predecessor, the Internet Software Consortium, with support being provided - by ISC's sponsors. As co-architects/programmers, Bob Halley and + by ISC's sponsors. + </para> + <para> + As co-architects/programmers, Bob Halley and Paul Vixie released the first production-ready version of <acronym>BIND</acronym> version 8 in May 1997. </para> + <para> + BIND version 9 was released in September 2000 and is a + major rewrite of nearly all aspects of the underlying + BIND architecture. + </para> + <para> + BIND version 4 is officially deprecated and BIND version + 8 development is considered maintenance-only in favor + of BIND version 9. No additional development is done + on BIND version 4 or BIND version 8 other than for + security-related patches. + </para> <para> <acronym>BIND</acronym> development work is made possible today by the sponsorship @@ -10915,7 +11000,8 @@ zone "example.com" { <emphasis>Anycast</emphasis>, an identifier for a set of interfaces; and <emphasis>Multicast</emphasis>, an identifier for a set of interfaces. Here we describe the global - Unicast address scheme. For more information, see RFC 3587. + Unicast address scheme. For more information, see RFC 3587, + "Global Unicast Address Format." </para> <para> IPv6 unicast addresses consist of a @@ -11966,15 +12052,6 @@ zone "example.com" { <title>DNS IPv6 Transport Operational Guidelines</title> <pubdate>September 2004</pubdate> </biblioentry> - <biblioentry> - <abbrev>RFC2352</abbrev> - <author> - <surname>Vaughan</surname> - <firstname>O.</firstname> - </author> - <title>A Convention For Using Legal Names as Domain Names</title> - <pubdate>May 1998</pubdate> - </biblioentry> </bibliodiv> <bibliodiv> <title>Obsolete and Unimplemented Experimental RFC</title> diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch01.html b/contrib/bind9/doc/arm/Bv9ARM.ch01.html index 1f942de..30e9e0d 100644 --- a/contrib/bind9/doc/arm/Bv9ARM.ch01.html +++ b/contrib/bind9/doc/arm/Bv9ARM.ch01.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: Bv9ARM.ch01.html,v 1.16.18.19.10.1 2007/07/09 02:25:50 marka Exp $ --> +<!-- $Id: Bv9ARM.ch01.html,v 1.16.18.21 2007/10/31 01:35:57 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -45,17 +45,17 @@ <div class="toc"> <p><b>Table of Contents</b></p> <dl> -<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2564115">Scope of Document</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2564138">Organization of This Document</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2563472">Conventions Used in This Document</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2564813">The Domain Name System (<acronym class="acronym">DNS</acronym>)</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2564117">Scope of Document</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2564140">Organization of This Document</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2563474">Conventions Used in This Document</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2564816">The Domain Name System (<acronym class="acronym">DNS</acronym>)</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2564835">DNS Fundamentals</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2564869">Domains and Domain Names</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2564953">Zones</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2567283">Authoritative Name Servers</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2567524">Caching Name Servers</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2567586">Name Servers in Multiple Roles</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2564837">DNS Fundamentals</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2564871">Domains and Domain Names</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2567208">Zones</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2567285">Authoritative Name Servers</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2567526">Caching Name Servers</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2567588">Name Servers in Multiple Roles</a></span></dt> </dl></dd> </dl> </div> @@ -71,7 +71,7 @@ </p> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2564115"></a>Scope of Document</h2></div></div></div> +<a name="id2564117"></a>Scope of Document</h2></div></div></div> <p> The Berkeley Internet Name Domain (<acronym class="acronym">BIND</acronym>) implements a @@ -87,7 +87,7 @@ </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2564138"></a>Organization of This Document</h2></div></div></div> +<a name="id2564140"></a>Organization of This Document</h2></div></div></div> <p> In this document, <span class="emphasis"><em>Section 1</em></span> introduces the basic <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym> concepts. <span class="emphasis"><em>Section 2</em></span> @@ -107,8 +107,8 @@ security considerations, and <span class="emphasis"><em>Section 8</em></span> contains troubleshooting help. The main body of the document is followed by several - <span class="emphasis"><em>Appendices</em></span> which contain useful reference - information, such as a <span class="emphasis"><em>Bibliography</em></span> and + <span class="emphasis"><em>appendices</em></span> which contain useful reference + information, such as a <span class="emphasis"><em>bibliography</em></span> and historic information related to <acronym class="acronym">BIND</acronym> and the Domain Name System. @@ -116,7 +116,7 @@ </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2563472"></a>Conventions Used in This Document</h2></div></div></div> +<a name="id2563474"></a>Conventions Used in This Document</h2></div></div></div> <p> In this document, we use the following general typographic conventions: @@ -243,17 +243,17 @@ </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2564813"></a>The Domain Name System (<acronym class="acronym">DNS</acronym>)</h2></div></div></div> +<a name="id2564816"></a>The Domain Name System (<acronym class="acronym">DNS</acronym>)</h2></div></div></div> <p> The purpose of this document is to explain the installation - and upkeep of the <acronym class="acronym">BIND</acronym> software - package, and we + and upkeep of the <acronym class="acronym">BIND</acronym> (Berkeley Internet + Name Domain) software package, and we begin by reviewing the fundamentals of the Domain Name System (<acronym class="acronym">DNS</acronym>) as they relate to <acronym class="acronym">BIND</acronym>. </p> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2564835"></a>DNS Fundamentals</h3></div></div></div> +<a name="id2564837"></a>DNS Fundamentals</h3></div></div></div> <p> The Domain Name System (DNS) is a hierarchical, distributed database. It stores information for mapping Internet host names to @@ -273,7 +273,7 @@ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2564869"></a>Domains and Domain Names</h3></div></div></div> +<a name="id2564871"></a>Domains and Domain Names</h3></div></div></div> <p> The data stored in the DNS is identified by <span class="emphasis"><em>domain names</em></span> that are organized as a tree according to organizational or administrative boundaries. Each node of the tree, @@ -319,7 +319,7 @@ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2564953"></a>Zones</h3></div></div></div> +<a name="id2567208"></a>Zones</h3></div></div></div> <p> To properly operate a name server, it is important to understand the difference between a <span class="emphasis"><em>zone</em></span> @@ -372,7 +372,7 @@ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2567283"></a>Authoritative Name Servers</h3></div></div></div> +<a name="id2567285"></a>Authoritative Name Servers</h3></div></div></div> <p> Each zone is served by at least one <span class="emphasis"><em>authoritative name server</em></span>, @@ -389,7 +389,7 @@ </p> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2567306"></a>The Primary Master</h4></div></div></div> +<a name="id2567308"></a>The Primary Master</h4></div></div></div> <p> The authoritative server where the master copy of the zone data is maintained is called the @@ -409,7 +409,7 @@ </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2567336"></a>Slave Servers</h4></div></div></div> +<a name="id2567338"></a>Slave Servers</h4></div></div></div> <p> The other authoritative servers, the <span class="emphasis"><em>slave</em></span> servers (also known as <span class="emphasis"><em>secondary</em></span> servers) @@ -425,7 +425,7 @@ </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2567357"></a>Stealth Servers</h4></div></div></div> +<a name="id2567360"></a>Stealth Servers</h4></div></div></div> <p> Usually all of the zone's authoritative servers are listed in NS records in the parent zone. These NS records constitute @@ -460,7 +460,7 @@ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2567524"></a>Caching Name Servers</h3></div></div></div> +<a name="id2567526"></a>Caching Name Servers</h3></div></div></div> <p> The resolver libraries provided by most operating systems are <span class="emphasis"><em>stub resolvers</em></span>, meaning that they are not @@ -487,7 +487,7 @@ </p> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2567559"></a>Forwarding</h4></div></div></div> +<a name="id2567561"></a>Forwarding</h4></div></div></div> <p> Even a caching name server does not necessarily perform the complete recursive lookup itself. Instead, it can @@ -514,7 +514,7 @@ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2567586"></a>Name Servers in Multiple Roles</h3></div></div></div> +<a name="id2567588"></a>Name Servers in Multiple Roles</h3></div></div></div> <p> The <acronym class="acronym">BIND</acronym> name server can simultaneously act as diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch02.html b/contrib/bind9/doc/arm/Bv9ARM.ch02.html index 9d859d6..cbf6c15 100644 --- a/contrib/bind9/doc/arm/Bv9ARM.ch02.html +++ b/contrib/bind9/doc/arm/Bv9ARM.ch02.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: Bv9ARM.ch02.html,v 1.13.18.18.10.1 2007/07/09 02:25:50 marka Exp $ --> +<!-- $Id: Bv9ARM.ch02.html,v 1.13.18.21 2007/10/31 01:35:57 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -45,16 +45,16 @@ <div class="toc"> <p><b>Table of Contents</b></p> <dl> -<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567620">Hardware requirements</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567646">CPU Requirements</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567659">Memory Requirements</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567686">Name Server Intensive Environment Issues</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567697">Supported Operating Systems</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567622">Hardware requirements</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567649">CPU Requirements</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567661">Memory Requirements</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567688">Name Server Intensive Environment Issues</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567699">Supported Operating Systems</a></span></dt> </dl> </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2567620"></a>Hardware requirements</h2></div></div></div> +<a name="id2567622"></a>Hardware requirements</h2></div></div></div> <p> <acronym class="acronym">DNS</acronym> hardware requirements have traditionally been quite modest. @@ -73,7 +73,7 @@ </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2567646"></a>CPU Requirements</h2></div></div></div> +<a name="id2567649"></a>CPU Requirements</h2></div></div></div> <p> CPU requirements for <acronym class="acronym">BIND</acronym> 9 range from i486-class machines @@ -84,7 +84,7 @@ </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2567659"></a>Memory Requirements</h2></div></div></div> +<a name="id2567661"></a>Memory Requirements</h2></div></div></div> <p> The memory of the server has to be large enough to fit the cache and zones loaded off disk. The <span><strong class="command">max-cache-size</strong></span> @@ -93,7 +93,7 @@ traffic. Additionally, if additional section caching (<a href="Bv9ARM.ch06.html#acache" title="Additional Section Caching">the section called “Additional Section Caching”</a>) is enabled, - the <span><strong class="command">max-acache-size</strong></span> can be used to + the <span><strong class="command">max-acache-size</strong></span> option can be used to limit the amount of memory used by the mechanism. It is still good practice to have enough memory to load @@ -107,7 +107,7 @@ </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2567686"></a>Name Server Intensive Environment Issues</h2></div></div></div> +<a name="id2567688"></a>Name Server Intensive Environment Issues</h2></div></div></div> <p> For name server intensive environments, there are two alternative configurations that may be used. The first is where clients and @@ -124,7 +124,7 @@ </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2567697"></a>Supported Operating Systems</h2></div></div></div> +<a name="id2567699"></a>Supported Operating Systems</h2></div></div></div> <p> ISC <acronym class="acronym">BIND</acronym> 9 compiles and runs on a large number diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch03.html b/contrib/bind9/doc/arm/Bv9ARM.ch03.html index 351927d..18f2711 100644 --- a/contrib/bind9/doc/arm/Bv9ARM.ch03.html +++ b/contrib/bind9/doc/arm/Bv9ARM.ch03.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: Bv9ARM.ch03.html,v 1.35.18.26.10.1 2007/07/09 02:25:50 marka Exp $ --> +<!-- $Id: Bv9ARM.ch03.html,v 1.35.18.31 2007/10/31 01:35:57 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -47,14 +47,14 @@ <dl> <dt><span class="sect1"><a href="Bv9ARM.ch03.html#sample_configuration">Sample Configurations</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568002">A Caching-only Name Server</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568018">An Authoritative-only Name Server</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568004">A Caching-only Name Server</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568020">An Authoritative-only Name Server</a></span></dt> </dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2568040">Load Balancing</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2568464">Name Server Operations</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2568042">Load Balancing</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2568465">Name Server Operations</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568469">Tools for Use With the Name Server Daemon</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2570039">Signals</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568470">Tools for Use With the Name Server Daemon</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2570184">Signals</a></span></dt> </dl></dd> </dl> </div> @@ -68,7 +68,7 @@ <a name="sample_configuration"></a>Sample Configurations</h2></div></div></div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2568002"></a>A Caching-only Name Server</h3></div></div></div> +<a name="id2568004"></a>A Caching-only Name Server</h3></div></div></div> <p> The following sample configuration is appropriate for a caching-only name server for use by clients internal to a corporation. All @@ -95,7 +95,7 @@ zone "0.0.127.in-addr.arpa" { </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2568018"></a>An Authoritative-only Name Server</h3></div></div></div> +<a name="id2568020"></a>An Authoritative-only Name Server</h3></div></div></div> <p> This sample configuration is for an authoritative-only server that is the master server for "<code class="filename">example.com</code>" @@ -137,11 +137,11 @@ zone "eng.example.com" { </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2568040"></a>Load Balancing</h2></div></div></div> +<a name="id2568042"></a>Load Balancing</h2></div></div></div> <p> A primitive form of load balancing can be achieved in - the <acronym class="acronym">DNS</acronym> by using multiple A records for - one name. + the <acronym class="acronym">DNS</acronym> by using multiple records + (such as multiple A records) for one name. </p> <p> For example, if you have three WWW servers with network addresses @@ -280,10 +280,10 @@ zone "eng.example.com" { </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2568464"></a>Name Server Operations</h2></div></div></div> +<a name="id2568465"></a>Name Server Operations</h2></div></div></div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2568469"></a>Tools for Use With the Name Server Daemon</h3></div></div></div> +<a name="id2568470"></a>Tools for Use With the Name Server Daemon</h3></div></div></div> <p> This section describes several indispensable diagnostic, administrative and monitoring tools available to the system @@ -336,7 +336,7 @@ zone "eng.example.com" { functionality can be extended with the use of options. </p> -<div class="cmdsynopsis"><p><code class="command">host</code> [-aCdlrTwv] [-c <em class="replaceable"><code>class</code></em>] [-N <em class="replaceable"><code>ndots</code></em>] [-t <em class="replaceable"><code>type</code></em>] [-W <em class="replaceable"><code>timeout</code></em>] [-R <em class="replaceable"><code>retries</code></em>] <em class="replaceable"><code>hostname</code></em> [<em class="replaceable"><code>server</code></em>]</p></div> +<div class="cmdsynopsis"><p><code class="command">host</code> [-aCdlnrsTwv] [-c <em class="replaceable"><code>class</code></em>] [-N <em class="replaceable"><code>ndots</code></em>] [-t <em class="replaceable"><code>type</code></em>] [-W <em class="replaceable"><code>timeout</code></em>] [-R <em class="replaceable"><code>retries</code></em>] [-m <em class="replaceable"><code>flag</code></em>] [-4] [-6] <em class="replaceable"><code>hostname</code></em> [<em class="replaceable"><code>server</code></em>]</p></div> <p> For more information and a list of available commands and options, see the <span><strong class="command">host</strong></span> man @@ -425,6 +425,12 @@ zone "eng.example.com" { (<span><strong class="command">rndc</strong></span>) program allows the system administrator to control the operation of a name server. + Since <acronym class="acronym">BIND</acronym> 9.2, <span><strong class="command">rndc</strong></span> + supports all the commands of the BIND 8 <span><strong class="command">ndc</strong></span> + utility except <span><strong class="command">ndc start</strong></span> and + <span><strong class="command">ndc restart</strong></span>, which were also + not supported in <span><strong class="command">ndc</strong></span>'s + channel mode. If you run <span><strong class="command">rndc</strong></span> without any options it will display a usage message as follows: @@ -585,14 +591,6 @@ zone "eng.example.com" { </p></dd> </dl></div> <p> - In <acronym class="acronym">BIND</acronym> 9.2, <span><strong class="command">rndc</strong></span> - supports all the commands of the BIND 8 <span><strong class="command">ndc</strong></span> - utility except <span><strong class="command">ndc start</strong></span> and - <span><strong class="command">ndc restart</strong></span>, which were also - not supported in <span><strong class="command">ndc</strong></span>'s - channel mode. - </p> -<p> A configuration file is required, since all communication with the server is authenticated with digital signatures that rely on a shared secret, and @@ -741,7 +739,7 @@ controls { </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2570039"></a>Signals</h3></div></div></div> +<a name="id2570184"></a>Signals</h3></div></div></div> <p> Certain UNIX signals cause the name server to take specific actions, as described in the following table. These signals can diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch04.html b/contrib/bind9/doc/arm/Bv9ARM.ch04.html index d7be205..09507fe 100644 --- a/contrib/bind9/doc/arm/Bv9ARM.ch04.html +++ b/contrib/bind9/doc/arm/Bv9ARM.ch04.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: Bv9ARM.ch04.html,v 1.40.18.34.10.1 2007/07/09 02:25:50 marka Exp $ --> +<!-- $Id: Bv9ARM.ch04.html,v 1.40.18.41 2007/10/31 01:35:57 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -49,28 +49,29 @@ <dt><span class="sect1"><a href="Bv9ARM.ch04.html#dynamic_update">Dynamic Update</a></span></dt> <dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch04.html#journal">The journal file</a></span></dt></dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch04.html#incremental_zone_transfers">Incremental Zone Transfers (IXFR)</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2570428">Split DNS</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2570642">Split DNS</a></span></dt> +<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2570660">Example split DNS setup</a></span></dt></dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch04.html#tsig">TSIG</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2570948">Generate Shared Keys for Each Pair of Hosts</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571021">Copying the Shared Secret to Both Machines</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571032">Informing the Servers of the Key's Existence</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571140">Instructing the Server to Use the Key</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571197">TSIG Key Based Access Control</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571242">Errors</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571095">Generate Shared Keys for Each Pair of Hosts</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571169">Copying the Shared Secret to Both Machines</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571179">Informing the Servers of the Key's Existence</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571219">Instructing the Server to Use the Key</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571413">TSIG Key Based Access Control</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571458">Errors</a></span></dt> </dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571256">TKEY</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571305">SIG(0)</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571472">TKEY</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571521">SIG(0)</a></span></dt> <dt><span class="sect1"><a href="Bv9ARM.ch04.html#DNSSEC">DNSSEC</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571578">Generating Keys</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571648">Signing the Zone</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571726">Configuring Servers</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571725">Generating Keys</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571795">Signing the Zone</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571874">Configuring Servers</a></span></dt> </dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571801">IPv6 Support in <acronym class="acronym">BIND</acronym> 9</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2572153">IPv6 Support in <acronym class="acronym">BIND</acronym> 9</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572000">Address Lookups Using AAAA Records</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572021">Address to Name Lookups Using Nibble Format</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572215">Address Lookups Using AAAA Records</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572236">Address to Name Lookups Using Nibble Format</a></span></dt> </dl></dd> </dl> </div> @@ -204,7 +205,7 @@ </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2570428"></a>Split DNS</h2></div></div></div> +<a name="id2570642"></a>Split DNS</h2></div></div></div> <p> Setting up different views, or visibility, of the DNS space to internal and external resolvers is usually referred to as a @@ -222,7 +223,7 @@ However, since listing addresses of internal servers that external clients cannot possibly reach can result in connection delays and other annoyances, an organization may - choose to use a Split DNS to present a consistant view of itself + choose to use a Split DNS to present a consistent view of itself to the outside world. </p> <p> @@ -232,9 +233,9 @@ on the Internet. Split DNS can also be used to allow mail from outside back in to the internal network. </p> -<p> - Here is an example of a split DNS setup: - </p> +<div class="sect2" lang="en"> +<div class="titlepage"><div><div><h3 class="title"> +<a name="id2570660"></a>Example split DNS setup</h3></div></div></div> <p> Let's say a company named <span class="emphasis"><em>Example, Inc.</em></span> (<code class="literal">example.com</code>) @@ -450,6 +451,7 @@ nameserver 172.16.72.3 nameserver 172.16.72.4 </pre> </div> +</div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> <a name="tsig"></a>TSIG</h2></div></div></div> @@ -479,7 +481,7 @@ nameserver 172.16.72.4 </p> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2570948"></a>Generate Shared Keys for Each Pair of Hosts</h3></div></div></div> +<a name="id2571095"></a>Generate Shared Keys for Each Pair of Hosts</h3></div></div></div> <p> A shared secret is generated to be shared between <span class="emphasis"><em>host1</em></span> and <span class="emphasis"><em>host2</em></span>. An arbitrary key name is chosen: "host1-host2.". The key name must @@ -487,7 +489,7 @@ nameserver 172.16.72.4 </p> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2570965"></a>Automatic Generation</h4></div></div></div> +<a name="id2571112"></a>Automatic Generation</h4></div></div></div> <p> The following command will generate a 128-bit (16 byte) HMAC-MD5 key as described above. Longer keys are better, but shorter keys @@ -512,7 +514,7 @@ nameserver 172.16.72.4 </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2571003"></a>Manual Generation</h4></div></div></div> +<a name="id2571150"></a>Manual Generation</h4></div></div></div> <p> The shared secret is simply a random sequence of bits, encoded in base-64. Most ASCII strings are valid base-64 strings (assuming @@ -527,7 +529,7 @@ nameserver 172.16.72.4 </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2571021"></a>Copying the Shared Secret to Both Machines</h3></div></div></div> +<a name="id2571169"></a>Copying the Shared Secret to Both Machines</h3></div></div></div> <p> This is beyond the scope of DNS. A secure transport mechanism should be used. This could be secure FTP, ssh, telephone, etc. @@ -535,7 +537,7 @@ nameserver 172.16.72.4 </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2571032"></a>Informing the Servers of the Key's Existence</h3></div></div></div> +<a name="id2571179"></a>Informing the Servers of the Key's Existence</h3></div></div></div> <p> Imagine <span class="emphasis"><em>host1</em></span> and <span class="emphasis"><em>host 2</em></span> are @@ -564,7 +566,7 @@ key host1-host2. { </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2571140"></a>Instructing the Server to Use the Key</h3></div></div></div> +<a name="id2571219"></a>Instructing the Server to Use the Key</h3></div></div></div> <p> Since keys are shared between two hosts only, the server must be told when keys are to be used. The following is added to the <code class="filename">named.conf</code> file @@ -596,7 +598,7 @@ server 10.1.2.3 { </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2571197"></a>TSIG Key Based Access Control</h3></div></div></div> +<a name="id2571413"></a>TSIG Key Based Access Control</h3></div></div></div> <p> <acronym class="acronym">BIND</acronym> allows IP addresses and ranges to be specified in ACL @@ -624,7 +626,7 @@ allow-update { key host1-host2. ;}; </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2571242"></a>Errors</h3></div></div></div> +<a name="id2571458"></a>Errors</h3></div></div></div> <p> The processing of TSIG signed messages can result in several errors. If a signed message is sent to a non-TSIG aware @@ -643,14 +645,14 @@ allow-update { key host1-host2. ;}; outside of the allowed range, the response will be signed with the TSIG extended error code set to BADTIME, and the time values will be adjusted so that the response can be successfully - verified. In any of these cases, the message's rcode is set to + verified. In any of these cases, the message's rcode (response code) is set to NOTAUTH (not authenticated). </p> </div> </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2571256"></a>TKEY</h2></div></div></div> +<a name="id2571472"></a>TKEY</h2></div></div></div> <p><span><strong class="command">TKEY</strong></span> is a mechanism for automatically generating a shared secret between two hosts. There are several "modes" of @@ -686,7 +688,7 @@ allow-update { key host1-host2. ;}; </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2571305"></a>SIG(0)</h2></div></div></div> +<a name="id2571521"></a>SIG(0)</h2></div></div></div> <p> <acronym class="acronym">BIND</acronym> 9 partially supports DNSSEC SIG(0) transaction signatures as specified in RFC 2535 and RFC2931. @@ -715,7 +717,7 @@ allow-update { key host1-host2. ;}; <p> Cryptographic authentication of DNS information is possible through the DNS Security (<span class="emphasis"><em>DNSSEC-bis</em></span>) extensions, - defined in RFC 4033, RFC 4034 and RFC 4035. + defined in RFC 4033, RFC 4034, and RFC 4035. This section describes the creation and use of DNSSEC signed zones. </p> <p> @@ -747,7 +749,7 @@ allow-update { key host1-host2. ;}; </p> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2571578"></a>Generating Keys</h3></div></div></div> +<a name="id2571725"></a>Generating Keys</h3></div></div></div> <p> The <span><strong class="command">dnssec-keygen</strong></span> program is used to generate keys. @@ -775,7 +777,7 @@ allow-update { key host1-host2. ;}; <code class="filename">Kchild.example.+005+12345.key</code> and <code class="filename">Kchild.example.+005+12345.private</code> (where - 12345 is an example of a key tag). The key file names contain + 12345 is an example of a key tag). The key filenames contain the key name (<code class="filename">child.example.</code>), algorithm (3 is DSA, 1 is RSAMD5, 5 is RSASHA1, etc.), and the key tag (12345 in @@ -798,7 +800,7 @@ allow-update { key host1-host2. ;}; </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2571648"></a>Signing the Zone</h3></div></div></div> +<a name="id2571795"></a>Signing the Zone</h3></div></div></div> <p> The <span><strong class="command">dnssec-signzone</strong></span> program is used to @@ -835,14 +837,14 @@ allow-update { key host1-host2. ;}; <p><span><strong class="command">dnssec-signzone</strong></span> will also produce a keyset and dsset files and optionally a dlvset file. These are used to provide the parent zone - administators with the <code class="literal">DNSKEYs</code> (or their + administrators with the <code class="literal">DNSKEYs</code> (or their corresponding <code class="literal">DS</code> records) that are the secure entry point to the zone. </p> </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2571726"></a>Configuring Servers</h3></div></div></div> +<a name="id2571874"></a>Configuring Servers</h3></div></div></div> <p> To enable <span><strong class="command">named</strong></span> to respond appropriately to DNS requests from DNSSEC aware clients, @@ -851,7 +853,7 @@ allow-update { key host1-host2. ;}; <p> To enable <span><strong class="command">named</strong></span> to validate answers from other servers both <span><strong class="command">dnssec-enable</strong></span> and - <span><strong class="command">dnssec-validate</strong></span> must be set and some + <span><strong class="command">dnssec-validation</strong></span> must be set and some <span><strong class="command">trusted-keys</strong></span> must be configured into <code class="filename">named.conf</code>. </p> @@ -930,7 +932,7 @@ options { </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2571801"></a>IPv6 Support in <acronym class="acronym">BIND</acronym> 9</h2></div></div></div> +<a name="id2572153"></a>IPv6 Support in <acronym class="acronym">BIND</acronym> 9</h2></div></div></div> <p> <acronym class="acronym">BIND</acronym> 9 fully supports all currently defined forms of IPv6 @@ -969,7 +971,7 @@ options { </p> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2572000"></a>Address Lookups Using AAAA Records</h3></div></div></div> +<a name="id2572215"></a>Address Lookups Using AAAA Records</h3></div></div></div> <p> The IPv6 AAAA record is a parallel to the IPv4 A record, and, unlike the deprecated A6 record, specifies the entire @@ -988,7 +990,7 @@ host 3600 IN AAAA 2001:db8::1 </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2572021"></a>Address to Name Lookups Using Nibble Format</h3></div></div></div> +<a name="id2572236"></a>Address to Name Lookups Using Nibble Format</h3></div></div></div> <p> When looking up an address in nibble format, the address components are simply reversed, just as in IPv4, and diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch05.html b/contrib/bind9/doc/arm/Bv9ARM.ch05.html index 458d933..80418b9 100644 --- a/contrib/bind9/doc/arm/Bv9ARM.ch05.html +++ b/contrib/bind9/doc/arm/Bv9ARM.ch05.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: Bv9ARM.ch05.html,v 1.33.18.28.10.1 2007/07/09 02:25:50 marka Exp $ --> +<!-- $Id: Bv9ARM.ch05.html,v 1.33.18.33 2007/10/31 01:35:58 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -45,13 +45,13 @@ <div class="toc"> <p><b>Table of Contents</b></p> <dl> -<dt><span class="sect1"><a href="Bv9ARM.ch05.html#id2572054">The Lightweight Resolver Library</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch05.html#id2572269">The Lightweight Resolver Library</a></span></dt> <dt><span class="sect1"><a href="Bv9ARM.ch05.html#lwresd">Running a Resolver Daemon</a></span></dt> </dl> </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2572054"></a>The Lightweight Resolver Library</h2></div></div></div> +<a name="id2572269"></a>The Lightweight Resolver Library</h2></div></div></div> <p> Traditionally applications have been linked with a stub resolver library that sends recursive DNS queries to a local caching name diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch06.html b/contrib/bind9/doc/arm/Bv9ARM.ch06.html index 69c4855..d829a17 100644 --- a/contrib/bind9/doc/arm/Bv9ARM.ch06.html +++ b/contrib/bind9/doc/arm/Bv9ARM.ch06.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: Bv9ARM.ch06.html,v 1.82.18.63.10.1 2007/07/09 02:25:50 marka Exp $ --> +<!-- $Id: Bv9ARM.ch06.html,v 1.82.18.73 2007/10/31 01:35:58 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -48,52 +48,52 @@ <dt><span class="sect1"><a href="Bv9ARM.ch06.html#configuration_file_elements">Configuration File Elements</a></span></dt> <dd><dl> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#address_match_lists">Address Match Lists</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573333">Comment Syntax</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573480">Comment Syntax</a></span></dt> </dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch06.html#Configuration_File_Grammar">Configuration File Grammar</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574013"><span><strong class="command">acl</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574092"><span><strong class="command">acl</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#acl"><span><strong class="command">acl</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574203"><span><strong class="command">controls</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574282"><span><strong class="command">controls</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage"><span><strong class="command">controls</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574632"><span><strong class="command">include</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574647"><span><strong class="command">include</strong></span> Statement Definition and +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574711"><span><strong class="command">include</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574726"><span><strong class="command">include</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574670"><span><strong class="command">key</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574692"><span><strong class="command">key</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574782"><span><strong class="command">logging</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574908"><span><strong class="command">logging</strong></span> Statement Definition and +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574749"><span><strong class="command">key</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574771"><span><strong class="command">key</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574930"><span><strong class="command">logging</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575056"><span><strong class="command">logging</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576395"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576469"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576533"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576577"><span><strong class="command">masters</strong></span> Statement Definition and +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576406"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576480"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576544"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576587"><span><strong class="command">masters</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576592"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576602"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#options"><span><strong class="command">options</strong></span> Statement Definition and Usage</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_grammar"><span><strong class="command">server</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_definition_and_usage"><span><strong class="command">server</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585031"><span><strong class="command">trusted-keys</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585080"><span><strong class="command">trusted-keys</strong></span> Statement Definition +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585361"><span><strong class="command">trusted-keys</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585410"><span><strong class="command">trusted-keys</strong></span> Statement Definition and Usage</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#view_statement_grammar"><span><strong class="command">view</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585228"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585490"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#zone_statement_grammar"><span><strong class="command">zone</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2586599"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2586798"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt> </dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2588791">Zone File</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2589080">Zone File</a></span></dt> <dd><dl> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#types_of_resource_records_and_when_to_use_them">Types of Resource Records and When to Use Them</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2590812">Discussion of MX Records</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591101">Discussion of MX Records</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#Setting_TTLs">Setting TTLs</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591432">Inverse Mapping in IPv4</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591559">Other Zone File Directives</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591816"><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591653">Inverse Mapping in IPv4</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591848">Other Zone File Directives</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2592173"><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#zonefile_format">Additional File Formats</a></span></dt> </dl></dd> </dl> @@ -266,7 +266,7 @@ <td> <p> An IP port <code class="varname">number</code>. - <code class="varname">number</code> is limited to 0 + The <code class="varname">number</code> is limited to 0 through 65535, with values below 1024 typically restricted to use by processes running as root. @@ -428,7 +428,7 @@ <a name="address_match_lists"></a>Address Match Lists</h3></div></div></div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2573198"></a>Syntax</h4></div></div></div> +<a name="id2573277"></a>Syntax</h4></div></div></div> <pre class="programlisting"><code class="varname">address_match_list</code> = address_match_list_element ; [<span class="optional"> address_match_list_element; ... </span>] <code class="varname">address_match_list_element</code> = [<span class="optional"> ! </span>] (ip_address [<span class="optional">/length</span>] | @@ -437,7 +437,7 @@ </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2573226"></a>Definition and Usage</h4></div></div></div> +<a name="id2573305"></a>Definition and Usage</h4></div></div></div> <p> Address match lists are primarily used to determine access control for various server operations. They are also used in @@ -515,17 +515,17 @@ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2573333"></a>Comment Syntax</h3></div></div></div> +<a name="id2573480"></a>Comment Syntax</h3></div></div></div> <p> The <acronym class="acronym">BIND</acronym> 9 comment syntax allows for comments to appear - anywhere that white space may appear in a <acronym class="acronym">BIND</acronym> configuration + anywhere that whitespace may appear in a <acronym class="acronym">BIND</acronym> configuration file. To appeal to programmers of all kinds, they can be written in the C, C++, or shell/perl style. </p> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2573348"></a>Syntax</h4></div></div></div> +<a name="id2573495"></a>Syntax</h4></div></div></div> <p> </p> <pre class="programlisting">/* This is a <acronym class="acronym">BIND</acronym> comment as in C */</pre> @@ -540,9 +540,9 @@ </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2573378"></a>Definition and Usage</h4></div></div></div> +<a name="id2573525"></a>Definition and Usage</h4></div></div></div> <p> - Comments may appear anywhere that white space may appear in + Comments may appear anywhere that whitespace may appear in a <acronym class="acronym">BIND</acronym> configuration file. </p> <p> @@ -774,7 +774,7 @@ </p> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2574013"></a><span><strong class="command">acl</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2574092"></a><span><strong class="command">acl</strong></span> Statement Grammar</h3></div></div></div> <pre class="programlisting"><span><strong class="command">acl</strong></span> acl-name { address_match_list }; @@ -857,7 +857,7 @@ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2574203"></a><span><strong class="command">controls</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2574282"></a><span><strong class="command">controls</strong></span> Statement Grammar</h3></div></div></div> <pre class="programlisting"><span><strong class="command">controls</strong></span> { [ inet ( ip_addr | * ) [ port ip_port ] allow { <em class="replaceable"><code> address_match_list </code></em> } keys { <em class="replaceable"><code>key_list</code></em> }; ] @@ -979,12 +979,12 @@ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2574632"></a><span><strong class="command">include</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2574711"></a><span><strong class="command">include</strong></span> Statement Grammar</h3></div></div></div> <pre class="programlisting">include <em class="replaceable"><code>filename</code></em>;</pre> </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2574647"></a><span><strong class="command">include</strong></span> Statement Definition and +<a name="id2574726"></a><span><strong class="command">include</strong></span> Statement Definition and Usage</h3></div></div></div> <p> The <span><strong class="command">include</strong></span> statement inserts the @@ -999,7 +999,7 @@ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2574670"></a><span><strong class="command">key</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2574749"></a><span><strong class="command">key</strong></span> Statement Grammar</h3></div></div></div> <pre class="programlisting">key <em class="replaceable"><code>key_id</code></em> { algorithm <em class="replaceable"><code>string</code></em>; secret <em class="replaceable"><code>string</code></em>; @@ -1008,7 +1008,7 @@ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2574692"></a><span><strong class="command">key</strong></span> Statement Definition and Usage</h3></div></div></div> +<a name="id2574771"></a><span><strong class="command">key</strong></span> Statement Definition and Usage</h3></div></div></div> <p> The <span><strong class="command">key</strong></span> statement defines a shared secret key for use with TSIG (see <a href="Bv9ARM.ch04.html#tsig" title="TSIG">the section called “TSIG”</a>) @@ -1046,7 +1046,7 @@ <code class="literal">hmac-sha256</code>, <code class="literal">hmac-sha384</code> and <code class="literal">hmac-sha512</code> TSIG authentication. Truncated hashes are supported by appending the minimum - number of required bits preceeded by a dash, e.g. + number of required bits preceded by a dash, e.g. <code class="literal">hmac-sha1-80</code>. The <em class="replaceable"><code>secret_string</code></em> is the secret to be used by the algorithm, and is treated as a base-64 @@ -1055,7 +1055,7 @@ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2574782"></a><span><strong class="command">logging</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2574930"></a><span><strong class="command">logging</strong></span> Statement Grammar</h3></div></div></div> <pre class="programlisting"><span><strong class="command">logging</strong></span> { [ <span><strong class="command">channel</strong></span> <em class="replaceable"><code>channel_name</code></em> { ( <span><strong class="command">file</strong></span> <em class="replaceable"><code>path name</code></em> @@ -1079,7 +1079,7 @@ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2574908"></a><span><strong class="command">logging</strong></span> Statement Definition and +<a name="id2575056"></a><span><strong class="command">logging</strong></span> Statement Definition and Usage</h3></div></div></div> <p> The <span><strong class="command">logging</strong></span> statement configures a @@ -1113,7 +1113,7 @@ </p> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2574961"></a>The <span><strong class="command">channel</strong></span> Phrase</h4></div></div></div> +<a name="id2575108"></a>The <span><strong class="command">channel</strong></span> Phrase</h4></div></div></div> <p> All log output goes to one or more <span class="emphasis"><em>channels</em></span>; you can make as many of them as you want. @@ -1632,7 +1632,7 @@ category notify { null; }; </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2576395"></a><span><strong class="command">lwres</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2576406"></a><span><strong class="command">lwres</strong></span> Statement Grammar</h3></div></div></div> <p> This is the grammar of the <span><strong class="command">lwres</strong></span> statement in the <code class="filename">named.conf</code> file: @@ -1647,12 +1647,12 @@ category notify { null; }; </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2576469"></a><span><strong class="command">lwres</strong></span> Statement Definition and Usage</h3></div></div></div> +<a name="id2576480"></a><span><strong class="command">lwres</strong></span> Statement Definition and Usage</h3></div></div></div> <p> The <span><strong class="command">lwres</strong></span> statement configures the name server to also act as a lightweight resolver server. (See - <a href="Bv9ARM.ch05.html#lwresd" title="Running a Resolver Daemon">the section called “Running a Resolver Daemon”</a>.) There may be be multiple + <a href="Bv9ARM.ch05.html#lwresd" title="Running a Resolver Daemon">the section called “Running a Resolver Daemon”</a>.) There may be multiple <span><strong class="command">lwres</strong></span> statements configuring lightweight resolver servers with different properties. </p> @@ -1698,14 +1698,14 @@ category notify { null; }; </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2576533"></a><span><strong class="command">masters</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2576544"></a><span><strong class="command">masters</strong></span> Statement Grammar</h3></div></div></div> <pre class="programlisting"> <span><strong class="command">masters</strong></span> <em class="replaceable"><code>name</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] }; </pre> </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2576577"></a><span><strong class="command">masters</strong></span> Statement Definition and +<a name="id2576587"></a><span><strong class="command">masters</strong></span> Statement Definition and Usage</h3></div></div></div> <p><span><strong class="command">masters</strong></span> lists allow for a common set of masters to be easily used by @@ -1714,7 +1714,7 @@ category notify { null; }; </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2576592"></a><span><strong class="command">options</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2576602"></a><span><strong class="command">options</strong></span> Statement Grammar</h3></div></div></div> <p> This is the grammar of the <span><strong class="command">options</strong></span> statement in the <code class="filename">named.conf</code> file: @@ -1732,6 +1732,7 @@ category notify { null; }; [<span class="optional"> dump-file <em class="replaceable"><code>path_name</code></em>; </span>] [<span class="optional"> memstatistics-file <em class="replaceable"><code>path_name</code></em>; </span>] [<span class="optional"> pid-file <em class="replaceable"><code>path_name</code></em>; </span>] + [<span class="optional"> recursing-file <em class="replaceable"><code>path_name</code></em>; </span>] [<span class="optional"> statistics-file <em class="replaceable"><code>path_name</code></em>; </span>] [<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em>; </span>] [<span class="optional"> auth-nxdomain <em class="replaceable"><code>yes_or_no</code></em>; </span>] @@ -1809,6 +1810,7 @@ category notify { null; }; [<span class="optional"> alt-transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>] [<span class="optional"> alt-transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>] [<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>] + [<span class="optional"> notify-delay <em class="replaceable"><code>seconds</code></em> ; </span>] [<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>] [<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>] [<span class="optional"> also-notify { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>] @@ -1951,12 +1953,20 @@ digits</code>" + "<code class="varname">tkey-domain</code>". In most cases, If not specified, the default is <code class="filename">named_dump.db</code>. </p></dd> <dt><span class="term"><span><strong class="command">memstatistics-file</strong></span></span></dt> -<dd><p> +<dd> +<p> The pathname of the file the server writes memory - usage statistics to on exit. If not specified, - the default is - <code class="filename">named.memstats</code>. - </p></dd> + usage statistics to on exit. If specified the + statistics will be written to the file on exit. + </p> +<p> + In <acronym class="acronym">BIND</acronym> 9.5 and later this will + default to <code class="filename">named.memstats</code>. + <acronym class="acronym">BIND</acronym> 9.5 will also introduce + <span><strong class="command">memstatistics</strong></span> to control the + writing. + </p> +</dd> <dt><span class="term"><span><strong class="command">pid-file</strong></span></span></dt> <dd><p> The pathname of the file the server writes its process ID @@ -1966,10 +1976,17 @@ digits</code>" + "<code class="varname">tkey-domain</code>". In most cases, name server. Specifying <span><strong class="command">pid-file none</strong></span> disables the use of a PID file — no file will be written and any existing one will be removed. Note that <span><strong class="command">none</strong></span> - is a keyword, not a file name, and therefore is not enclosed + is a keyword, not a filename, and therefore is not enclosed in double quotes. </p></dd> +<dt><span class="term"><span><strong class="command">recursing-file</strong></span></span></dt> +<dd><p> + The pathname of the file the server dumps + the queries that are currently recursing when instructed + to do so with <span><strong class="command">rndc recursing</strong></span>. + If not specified, the default is <code class="filename">named.recursing</code>. + </p></dd> <dt><span class="term"><span><strong class="command">statistics-file</strong></span></span></dt> <dd><p> The pathname of the file the server appends statistics @@ -2472,7 +2489,7 @@ options { <dd><p> <span class="emphasis"><em>This option is obsolete</em></span>. If you need to disable IXFR to a particular server or - servers see + servers, see the information on the <span><strong class="command">provide-ixfr</strong></span> option in <a href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and Usage">the section called “<span><strong class="command">server</strong></span> Statement Definition and @@ -2660,6 +2677,7 @@ options { <dd><p> Accept expired signatures when verifying DNSSEC signatures. The default is <strong class="userinput"><code>no</code></strong>. + Setting this option to "yes" leaves named vulnerable to replay attacks. </p></dd> <dt><span class="term"><span><strong class="command">querylog</strong></span></span></dt> <dd><p> @@ -2694,7 +2712,7 @@ options { and MX records. It also applies to the RDATA of PTR records where the owner name indicated that it is a reverse lookup of a hostname - (the owner name ends in IN-ADDR.ARPA, IP6.ARPA or IP6.INT). + (the owner name ends in IN-ADDR.ARPA, IP6.ARPA, or IP6.INT). </p> </dd> <dt><span class="term"><span><strong class="command">check-mx</strong></span></span></dt> @@ -2723,7 +2741,7 @@ options { MX and SRV records only in-zone hostnames are checked (for out-of-zone hostnames use named-checkzone). For NS records only names below top of zone are - checked (for out-of-zone names and glue consistancy + checked (for out-of-zone names and glue consistency checks use named-checkzone). The default is <span><strong class="command">yes</strong></span>. </p></dd> @@ -2771,7 +2789,7 @@ options { </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2580407"></a>Forwarding</h4></div></div></div> +<a name="id2580536"></a>Forwarding</h4></div></div></div> <p> The forwarding facility can be used to create a large site-wide cache on a few servers, reducing traffic over links to external @@ -2815,7 +2833,7 @@ options { </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2580466"></a>Dual-stack Servers</h4></div></div></div> +<a name="id2580595"></a>Dual-stack Servers</h4></div></div></div> <p> Dual-stack servers are used as servers of last resort to work around @@ -2970,7 +2988,7 @@ options { </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2580955"></a>Interfaces</h4></div></div></div> +<a name="id2581153"></a>Interfaces</h4></div></div></div> <p> The interfaces and ports that the server will answer queries from may be specified using the <span><strong class="command">listen-on</strong></span> option. <span><strong class="command">listen-on</strong></span> takes @@ -3050,7 +3068,7 @@ listen-on-v6 port 1234 { !2001:db8::/32; any; }; </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2581112"></a>Query Address</h4></div></div></div> +<a name="id2581241"></a>Query Address</h4></div></div></div> <p> If the server doesn't know the answer to a question, it will query other name servers. <span><strong class="command">query-source</strong></span> specifies @@ -3330,7 +3348,7 @@ query-source-v6 address * port *; </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2581859"></a>Bad UDP Port Lists</h4></div></div></div> +<a name="id2581988"></a>Bad UDP Port Lists</h4></div></div></div> <p><span><strong class="command">avoid-v4-udp-ports</strong></span> and <span><strong class="command">avoid-v6-udp-ports</strong></span> specify a list of IPv4 and IPv6 UDP ports that will not be used as system @@ -3344,7 +3362,7 @@ query-source-v6 address * port *; </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2581874"></a>Operating System Resource Limits</h4></div></div></div> +<a name="id2582003"></a>Operating System Resource Limits</h4></div></div></div> <p> The server's usage of many system resources can be limited. Scaled values are allowed when specifying resource limits. For @@ -3403,7 +3421,7 @@ query-source-v6 address * port *; </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2582057"></a>Server Resource Limits</h4></div></div></div> +<a name="id2582186"></a>Server Resource Limits</h4></div></div></div> <p> The following options set limits on the server's resource consumption that are enforced internally by the @@ -3481,7 +3499,7 @@ query-source-v6 address * port *; </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2582190"></a>Periodic Task Intervals</h4></div></div></div> +<a name="id2582320"></a>Periodic Task Intervals</h4></div></div></div> <div class="variablelist"><dl> <dt><span class="term"><span><strong class="command">cleaning-interval</strong></span></span></dt> <dd><p> @@ -3529,7 +3547,7 @@ query-source-v6 address * port *; <h3 class="title">Note</h3> <p> Not yet implemented in - <acronym class="acronym">BIND</acronym>9. + <acronym class="acronym">BIND</acronym> 9. </p> </div> </dd> @@ -3869,7 +3887,7 @@ query-source-v6 address * port *; values are 512 to 4096 (values outside this range will be silently adjusted). The default value is 4096. The usual reason for setting edns-udp-size to - a non-default value it to get UDP answers to pass + a non-default value is to get UDP answers to pass through broken firewalls that block fragmented packets and/or block UDP packets that are greater than 512 bytes. @@ -3884,6 +3902,8 @@ query-source-v6 address * port *; answers to pass through broken firewalls that block fragmented packets and/or block UDP packets that are greater than 512 bytes. + This is independent of the advertised receive + buffer (<span><strong class="command">edns-udp-size</strong></span>). </p></dd> <dt><span class="term"><span><strong class="command">masterfile-format</strong></span></span></dt> <dd><p>Specifies @@ -3943,6 +3963,11 @@ query-source-v6 address * port *; <span><strong class="command">recursive-clients</strong></span>. </p> </dd> +<dt><span class="term"><span><strong class="command">notify-delay</strong></span></span></dt> +<dd><p> + The delay, in seconds, between sending sets of notify + messages for a zone. The default is zero. + </p></dd> </dl></div> </div> <div class="sect3" lang="en"> @@ -4013,7 +4038,7 @@ query-source-v6 address * port *; Named has some built-in empty zones (SOA and NS records only). These are for zones that should normally be answered locally and which queries should not be sent to the Internet's root - servers. The offical servers which cover these namespaces + servers. The official servers which cover these namespaces return NXDOMAIN responses to these queries. In particular, these cover the reverse namespace for addresses from RFC 1918 and RFC 3330. They also include the reverse namespace for IPv6 local @@ -4076,10 +4101,10 @@ query-source-v6 address * port *; If you are using the address ranges covered here, you should already have reverse zones covering the addresses you use. In practice this appears to not be the case with many queries - being made to the infrustructure servers for names in these + being made to the infrastructure servers for names in these spaces. So many in fact that sacrificial servers were needed to be deployed to channel the query load away from the - infrustructure servers. + infrastructure servers. </p> <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"> <h3 class="title">Note</h3> @@ -4226,6 +4251,32 @@ query-source-v6 address * port *; </p> </td> </tr> +<tr> +<td> + <p><span><strong class="command">duplicate</strong></span></p> + </td> +<td> + <p> + The number of queries which the server attempted to + recurse but discover a existing query with the same + IP address, port, query id, name, type and class + already being processed. + </p> + </td> +</tr> +<tr> +<td> + <p><span><strong class="command">dropped</strong></span></p> + </td> +<td> + <p> + The number of queries for which the server + discovered a excessive number of existing + recursive queries for the same name, type and + class and were subsequently dropped. + </p> + </td> +</tr> </tbody> </table></div> <p> @@ -4528,7 +4579,7 @@ query-source-v6 address * port *; </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2585031"></a><span><strong class="command">trusted-keys</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2585361"></a><span><strong class="command">trusted-keys</strong></span> Statement Grammar</h3></div></div></div> <pre class="programlisting">trusted-keys { <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; [<span class="optional"> <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; [<span class="optional">...</span>]</span>] @@ -4537,7 +4588,7 @@ query-source-v6 address * port *; </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2585080"></a><span><strong class="command">trusted-keys</strong></span> Statement Definition +<a name="id2585410"></a><span><strong class="command">trusted-keys</strong></span> Statement Definition and Usage</h3></div></div></div> <p> The <span><strong class="command">trusted-keys</strong></span> statement defines @@ -4580,7 +4631,7 @@ query-source-v6 address * port *; </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2585228"></a><span><strong class="command">view</strong></span> Statement Definition and Usage</h3></div></div></div> +<a name="id2585490"></a><span><strong class="command">view</strong></span> Statement Definition and Usage</h3></div></div></div> <p> The <span><strong class="command">view</strong></span> statement is a powerful feature @@ -4724,6 +4775,7 @@ view "external" { [<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em> ; </span>] [<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em> ; </span>] [<span class="optional"> notify <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>explicit</code></em> | <em class="replaceable"><code>master-only</code></em> ; </span>] + [<span class="optional"> notify-delay <em class="replaceable"><code>seconds</code></em> ; </span>] [<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>] [<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>] [<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>] @@ -4831,10 +4883,10 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2586599"></a><span><strong class="command">zone</strong></span> Statement Definition and Usage</h3></div></div></div> +<a name="id2586798"></a><span><strong class="command">zone</strong></span> Statement Definition and Usage</h3></div></div></div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2586606"></a>Zone Types</h4></div></div></div> +<a name="id2586806"></a>Zone Types</h4></div></div></div> <div class="informaltable"><table border="1"> <colgroup> <col> @@ -4890,7 +4942,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" numbers (in the tens or hundreds of thousands) of zones per server, it is best to - use a two-level naming scheme for zone file names. For + use a two-level naming scheme for zone filenames. For example, a slave server for the zone <code class="literal">example.com</code> might place the zone contents into a file called @@ -5043,7 +5095,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2587026"></a>Class</h4></div></div></div> +<a name="id2587362"></a>Class</h4></div></div></div> <p> The zone's name may optionally be followed by a class. If a class is not specified, class <code class="literal">IN</code> (for <code class="varname">Internet</code>), @@ -5059,13 +5111,13 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" a synonym for hesiod. </p> <p> - Another MIT development is CHAOSnet, a LAN protocol created + Another MIT development is Chaosnet, a LAN protocol created in the mid-1970s. Zone data for it can be specified with the <code class="literal">CHAOS</code> class. </p> </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2587059"></a>Zone Options</h4></div></div></div> +<a name="id2587395"></a>Zone Options</h4></div></div></div> <div class="variablelist"><dl> <dt><span class="term"><span><strong class="command">allow-notify</strong></span></span></dt> <dd><p> @@ -5228,8 +5280,8 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" </p></dd> <dt><span class="term"><span><strong class="command">journal</strong></span></span></dt> <dd><p> - Allow the default journal's file name to be overridden. - The default is the zone's file with "<code class="filename">.jnl</code>" appended. + Allow the default journal's filename to be overridden. + The default is the zone's filename with "<code class="filename">.jnl</code>" appended. This is applicable to <span><strong class="command">master</strong></span> and <span><strong class="command">slave</strong></span> zones. </p></dd> <dt><span class="term"><span><strong class="command">max-transfer-time-in</strong></span></span></dt> @@ -5257,6 +5309,11 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" See the description of <span><strong class="command">notify</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>. </p></dd> +<dt><span class="term"><span><strong class="command">notify-delay</strong></span></span></dt> +<dd><p> + See the description of + <span><strong class="command">notify-delay</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>. + </p></dd> <dt><span class="term"><span><strong class="command">pubkey</strong></span></span></dt> <dd><p> In <acronym class="acronym">BIND</acronym> 8, this option was @@ -5414,7 +5471,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" wildcard name, it is subject to DNS wildcard expansion, so the rule will apply to multiple identities. The <em class="replaceable"><code>identity</code></em> field must - contain a fully qualified domain name. + contain a fully-qualified domain name. </p> <p> The <em class="replaceable"><code>nametype</code></em> field has 6 @@ -5531,7 +5588,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" <p> In all cases, the <em class="replaceable"><code>name</code></em> field must - specify a fully qualified domain name. + specify a fully-qualified domain name. </p> <p> If no types are explicitly specified, this rule matches all @@ -5548,7 +5605,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2588791"></a>Zone File</h2></div></div></div> +<a name="id2589080"></a>Zone File</h2></div></div></div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> <a name="types_of_resource_records_and_when_to_use_them"></a>Types of Resource Records and When to Use Them</h3></div></div></div> @@ -5561,7 +5618,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" </p> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2588809"></a>Resource Records</h4></div></div></div> +<a name="id2589098"></a>Resource Records</h4></div></div></div> <p> A domain name identifies a node. Each node has a set of resource information, which may be empty. The set of resource @@ -6144,7 +6201,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" </td> <td> <p> - CHAOSnet, a LAN protocol created at MIT in the + Chaosnet, a LAN protocol created at MIT in the mid-1970s. Rarely used for its historical purpose, but reused for BIND's @@ -6212,7 +6269,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2590224"></a>Textual expression of RRs</h4></div></div></div> +<a name="id2590513"></a>Textual expression of RRs</h4></div></div></div> <p> RRs are represented in binary form in the packets of the DNS protocol, and are usually represented in highly encoded form @@ -6415,7 +6472,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2590812"></a>Discussion of MX Records</h3></div></div></div> +<a name="id2591101"></a>Discussion of MX Records</h3></div></div></div> <p> As described above, domain servers store information as a series of resource records, each of which contains a particular @@ -6673,7 +6730,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2591432"></a>Inverse Mapping in IPv4</h3></div></div></div> +<a name="id2591653"></a>Inverse Mapping in IPv4</h3></div></div></div> <p> Reverse name resolution (that is, translation from IP address to name) is achieved by means of the <span class="emphasis"><em>in-addr.arpa</em></span> domain @@ -6725,7 +6782,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" <h3 class="title">Note</h3> <p> The <span><strong class="command">$ORIGIN</strong></span> lines in the examples - are for providing context to the examples only-they do not + are for providing context to the examples only — they do not necessarily appear in the actual usage. They are only used here to indicate that the example is relative to the listed origin. @@ -6734,7 +6791,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2591559"></a>Other Zone File Directives</h3></div></div></div> +<a name="id2591848"></a>Other Zone File Directives</h3></div></div></div> <p> The Master File Format was initially defined in RFC 1035 and has subsequently been extended. While the Master File Format @@ -6749,7 +6806,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" </p> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2591581"></a>The <span><strong class="command">$ORIGIN</strong></span> Directive</h4></div></div></div> +<a name="id2591870"></a>The <span><strong class="command">$ORIGIN</strong></span> Directive</h4></div></div></div> <p> Syntax: <span><strong class="command">$ORIGIN</strong></span> <em class="replaceable"><code>domain-name</code></em> @@ -6777,7 +6834,7 @@ WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM. </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2591642"></a>The <span><strong class="command">$INCLUDE</strong></span> Directive</h4></div></div></div> +<a name="id2592000"></a>The <span><strong class="command">$INCLUDE</strong></span> Directive</h4></div></div></div> <p> Syntax: <span><strong class="command">$INCLUDE</strong></span> <em class="replaceable"><code>filename</code></em> @@ -6813,7 +6870,7 @@ WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM. </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2591780"></a>The <span><strong class="command">$TTL</strong></span> Directive</h4></div></div></div> +<a name="id2592069"></a>The <span><strong class="command">$TTL</strong></span> Directive</h4></div></div></div> <p> Syntax: <span><strong class="command">$TTL</strong></span> <em class="replaceable"><code>default-ttl</code></em> @@ -6832,7 +6889,7 @@ WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM. </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2591816"></a><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</h3></div></div></div> +<a name="id2592173"></a><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</h3></div></div></div> <p> Syntax: <span><strong class="command">$GENERATE</strong></span> <em class="replaceable"><code>range</code></em> @@ -6888,14 +6945,14 @@ $GENERATE 1-127 $ CNAME $.0</pre> <p><span><strong class="command">lhs</strong></span></p> </td> <td> - <p><span><strong class="command">lhs</strong></span> + <p>This describes the owner name of the resource records to be created. Any single <span><strong class="command">$</strong></span> (dollar sign) symbols within the <span><strong class="command">lhs</strong></span> side are replaced by the iterator value. - To get a $ in the output you need to escape the + To get a $ in the output, you need to escape the <span><strong class="command">$</strong></span> using a backslash <span><strong class="command">\</strong></span>, e.g. <span><strong class="command">\$</strong></span>. The @@ -6904,7 +6961,7 @@ $GENERATE 1-127 $ CNAME $.0</pre> iterator, field width and base. Modifiers are introduced by a - <span><strong class="command">{</strong></span> immediately following the + <span><strong class="command">{</strong></span> (left brace) immediately following the <span><strong class="command">$</strong></span> as <span><strong class="command">${offset[,width[,base]]}</strong></span>. For example, <span><strong class="command">${-20,3,d}</strong></span> @@ -6977,7 +7034,7 @@ $GENERATE 1-127 $ CNAME $.0</pre> </td> <td> <p> - A domain name. It is processed + <span><strong class="command">rhs</strong></span> is a domain name. It is processed similarly to lhs. </p> </td> diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch07.html b/contrib/bind9/doc/arm/Bv9ARM.ch07.html index c12d56d..96acfe6 100644 --- a/contrib/bind9/doc/arm/Bv9ARM.ch07.html +++ b/contrib/bind9/doc/arm/Bv9ARM.ch07.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: Bv9ARM.ch07.html,v 1.75.18.54.10.1 2007/07/09 02:25:51 marka Exp $ --> +<!-- $Id: Bv9ARM.ch07.html,v 1.75.18.63 2007/10/31 01:35:59 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -46,10 +46,10 @@ <p><b>Table of Contents</b></p> <dl> <dt><span class="sect1"><a href="Bv9ARM.ch07.html#Access_Control_Lists">Access Control Lists</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch07.html#id2592492"><span><strong class="command">chroot</strong></span> and <span><strong class="command">setuid</strong></span></a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch07.html#id2592714"><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span></a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2592569">The <span><strong class="command">chroot</strong></span> Environment</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2592629">Using the <span><strong class="command">setuid</strong></span> Function</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2592791">The <span><strong class="command">chroot</strong></span> Environment</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2592851">Using the <span><strong class="command">setuid</strong></span> Function</a></span></dt> </dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch07.html#dynamic_update_security">Dynamic Update Security</a></span></dt> </dl> @@ -118,7 +118,7 @@ zone "example.com" { </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2592492"></a><span><strong class="command">chroot</strong></span> and <span><strong class="command">setuid</strong></span> +<a name="id2592714"></a><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span> </h2></div></div></div> <p> On UNIX servers, it is possible to run <acronym class="acronym">BIND</acronym> in a <span class="emphasis"><em>chrooted</em></span> environment @@ -142,7 +142,7 @@ zone "example.com" { </p> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2592569"></a>The <span><strong class="command">chroot</strong></span> Environment</h3></div></div></div> +<a name="id2592791"></a>The <span><strong class="command">chroot</strong></span> Environment</h3></div></div></div> <p> In order for a <span><strong class="command">chroot</strong></span> environment to @@ -157,7 +157,7 @@ zone "example.com" { for this. </p> <p> - Unlike with earlier versions of BIND, you will typically + Unlike with earlier versions of BIND, you typically will <span class="emphasis"><em>not</em></span> need to compile <span><strong class="command">named</strong></span> statically nor install shared libraries under the new root. However, depending on your operating system, you may need @@ -170,7 +170,7 @@ zone "example.com" { </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2592629"></a>Using the <span><strong class="command">setuid</strong></span> Function</h3></div></div></div> +<a name="id2592851"></a>Using the <span><strong class="command">setuid</strong></span> Function</h3></div></div></div> <p> Prior to running the <span><strong class="command">named</strong></span> daemon, use diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch08.html b/contrib/bind9/doc/arm/Bv9ARM.ch08.html index 61c5f31..a475378 100644 --- a/contrib/bind9/doc/arm/Bv9ARM.ch08.html +++ b/contrib/bind9/doc/arm/Bv9ARM.ch08.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: Bv9ARM.ch08.html,v 1.75.18.53.10.1 2007/07/09 02:25:52 marka Exp $ --> +<!-- $Id: Bv9ARM.ch08.html,v 1.75.18.64 2007/10/31 01:35:59 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -45,18 +45,18 @@ <div class="toc"> <p><b>Table of Contents</b></p> <dl> -<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2592709">Common Problems</a></span></dt> -<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch08.html#id2592714">It's not working; how can I figure out what's wrong?</a></span></dt></dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2592726">Incrementing and Changing the Serial Number</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2592743">Where Can I Get Help?</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2592999">Common Problems</a></span></dt> +<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch08.html#id2593004">It's not working; how can I figure out what's wrong?</a></span></dt></dl></dd> +<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2593016">Incrementing and Changing the Serial Number</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2593033">Where Can I Get Help?</a></span></dt> </dl> </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2592709"></a>Common Problems</h2></div></div></div> +<a name="id2592999"></a>Common Problems</h2></div></div></div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2592714"></a>It's not working; how can I figure out what's wrong?</h3></div></div></div> +<a name="id2593004"></a>It's not working; how can I figure out what's wrong?</h3></div></div></div> <p> The best solution to solving installation and configuration issues is to take preventative measures by setting @@ -68,18 +68,18 @@ </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2592726"></a>Incrementing and Changing the Serial Number</h2></div></div></div> +<a name="id2593016"></a>Incrementing and Changing the Serial Number</h2></div></div></div> <p> - Zone serial numbers are just numbers-they aren't date - related. A lot of people set them to a number that represents a - date, usually of the form YYYYMMDDRR. A number of people have been - testing these numbers for Y2K compliance and have set the number - to the year 2000 to see if it will work. They then try to restore - the old serial number. This will cause problems because serial - numbers are used to indicate that a zone has been updated. If the - serial number on the slave server is lower than the serial number - on the master, the slave server will attempt to update its copy of - the zone. + Zone serial numbers are just numbers — they aren't + date related. A lot of people set them to a number that + represents a date, usually of the form YYYYMMDDRR. + Occasionally they will make a mistake and set them to a + "date in the future" then try to correct them by setting + them to the "current date". This causes problems because + serial numbers are used to indicate that a zone has been + updated. If the serial number on the slave server is + lower than the serial number on the master, the slave + server will attempt to update its copy of the zone. </p> <p> Setting the serial number to a lower number on the master @@ -95,7 +95,7 @@ </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2592743"></a>Where Can I Get Help?</h2></div></div></div> +<a name="id2593033"></a>Where Can I Get Help?</h2></div></div></div> <p> The Internet Systems Consortium (<acronym class="acronym">ISC</acronym>) offers a wide range diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch09.html b/contrib/bind9/doc/arm/Bv9ARM.ch09.html index 3617b75..3c2e779 100644 --- a/contrib/bind9/doc/arm/Bv9ARM.ch09.html +++ b/contrib/bind9/doc/arm/Bv9ARM.ch09.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: Bv9ARM.ch09.html,v 1.75.18.56.10.1 2007/07/09 02:25:52 marka Exp $ --> +<!-- $Id: Bv9ARM.ch09.html,v 1.75.18.66 2007/10/31 01:35:59 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -45,21 +45,21 @@ <div class="toc"> <p><b>Table of Contents</b></p> <dl> -<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2593078">Acknowledgments</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2593300">Acknowledgments</a></span></dt> <dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch09.html#historical_dns_information">A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym></a></span></dt></dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2593172">General <acronym class="acronym">DNS</acronym> Reference Information</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2593472">General <acronym class="acronym">DNS</acronym> Reference Information</a></span></dt> <dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch09.html#ipv6addresses">IPv6 addresses (AAAA)</a></span></dt></dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch09.html#bibliography">Bibliography (and Suggested Reading)</a></span></dt> <dd><dl> <dt><span class="sect2"><a href="Bv9ARM.ch09.html#rfcs">Request for Comments (RFCs)</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch09.html#internet_drafts">Internet Drafts</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2596339">Other Documents About <acronym class="acronym">BIND</acronym></a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2596683">Other Documents About <acronym class="acronym">BIND</acronym></a></span></dt> </dl></dd> </dl> </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2593078"></a>Acknowledgments</h2></div></div></div> +<a name="id2593300"></a>Acknowledgments</h2></div></div></div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> <a name="historical_dns_information"></a>A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym> @@ -110,7 +110,7 @@ during that time: Doug Kingston, Craig Partridge, Smoot Carl-Mitchell, Mike Muuss, Jim Bloom and Mike Schwartz. <acronym class="acronym">BIND</acronym> maintenance was subsequently - handled by Mike Karels and O. Kure. + handled by Mike Karels and Øivind Kure. </p> <p> <acronym class="acronym">BIND</acronym> versions 4.9 and 4.9.1 were @@ -125,7 +125,7 @@ Wolfhugel, and others. </p> <p> - <acronym class="acronym">BIND</acronym> version 4.9.2 was sponsored by + In 1994, <acronym class="acronym">BIND</acronym> version 4.9.2 was sponsored by Vixie Enterprises. Paul Vixie became <acronym class="acronym">BIND</acronym>'s principal architect/programmer. @@ -135,11 +135,26 @@ have been developed and maintained by the Internet Systems Consortium and its predecessor, the Internet Software Consortium, with support being provided - by ISC's sponsors. As co-architects/programmers, Bob Halley and + by ISC's sponsors. + </p> +<p> + As co-architects/programmers, Bob Halley and Paul Vixie released the first production-ready version of <acronym class="acronym">BIND</acronym> version 8 in May 1997. </p> <p> + BIND version 9 was released in September 2000 and is a + major rewrite of nearly all aspects of the underlying + BIND architecture. + </p> +<p> + BIND version 4 is officially deprecated and BIND version + 8 development is considered maintenance-only in favor + of BIND version 9. No additional development is done + on BIND version 4 or BIND version 8 other than for + security-related patches. + </p> +<p> <acronym class="acronym">BIND</acronym> development work is made possible today by the sponsorship of several corporations, and by the tireless work efforts of @@ -149,7 +164,7 @@ </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2593172"></a>General <acronym class="acronym">DNS</acronym> Reference Information</h2></div></div></div> +<a name="id2593472"></a>General <acronym class="acronym">DNS</acronym> Reference Information</h2></div></div></div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> <a name="ipv6addresses"></a>IPv6 addresses (AAAA)</h3></div></div></div> @@ -161,7 +176,8 @@ <span class="emphasis"><em>Anycast</em></span>, an identifier for a set of interfaces; and <span class="emphasis"><em>Multicast</em></span>, an identifier for a set of interfaces. Here we describe the global - Unicast address scheme. For more information, see RFC 3587. + Unicast address scheme. For more information, see RFC 3587, + "Global Unicast Address Format." </p> <p> IPv6 unicast addresses consist of a @@ -236,17 +252,17 @@ </p> <div class="bibliography"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2593360"></a>Bibliography</h4></div></div></div> +<a name="id2593659"></a>Bibliography</h4></div></div></div> <div class="bibliodiv"> <h3 class="title">Standards</h3> <div class="biblioentry"> -<a name="id2593370"></a><p>[<abbr class="abbrev">RFC974</abbr>] <span class="author"><span class="firstname">C.</span> <span class="surname">Partridge</span>. </span><span class="title"><i>Mail Routing and the Domain System</i>. </span><span class="pubdate">January 1986. </span></p> +<a name="id2593670"></a><p>[<abbr class="abbrev">RFC974</abbr>] <span class="author"><span class="firstname">C.</span> <span class="surname">Partridge</span>. </span><span class="title"><i>Mail Routing and the Domain System</i>. </span><span class="pubdate">January 1986. </span></p> </div> <div class="biblioentry"> -<a name="id2593394"></a><p>[<abbr class="abbrev">RFC1034</abbr>] <span class="author"><span class="firstname">P.V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>Domain Names — Concepts and Facilities</i>. </span><span class="pubdate">November 1987. </span></p> +<a name="id2593693"></a><p>[<abbr class="abbrev">RFC1034</abbr>] <span class="author"><span class="firstname">P.V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>Domain Names — Concepts and Facilities</i>. </span><span class="pubdate">November 1987. </span></p> </div> <div class="biblioentry"> -<a name="id2593417"></a><p>[<abbr class="abbrev">RFC1035</abbr>] <span class="author"><span class="firstname">P. V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>Domain Names — Implementation and +<a name="id2593717"></a><p>[<abbr class="abbrev">RFC1035</abbr>] <span class="author"><span class="firstname">P. V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>Domain Names — Implementation and Specification</i>. </span><span class="pubdate">November 1987. </span></p> </div> </div> @@ -254,42 +270,42 @@ <h3 class="title"> <a name="proposed_standards"></a>Proposed Standards</h3> <div class="biblioentry"> -<a name="id2593453"></a><p>[<abbr class="abbrev">RFC2181</abbr>] <span class="author"><span class="firstname">R., R. Bush</span> <span class="surname">Elz</span>. </span><span class="title"><i>Clarifications to the <acronym class="acronym">DNS</acronym> +<a name="id2593753"></a><p>[<abbr class="abbrev">RFC2181</abbr>] <span class="author"><span class="firstname">R., R. Bush</span> <span class="surname">Elz</span>. </span><span class="title"><i>Clarifications to the <acronym class="acronym">DNS</acronym> Specification</i>. </span><span class="pubdate">July 1997. </span></p> </div> <div class="biblioentry"> -<a name="id2593480"></a><p>[<abbr class="abbrev">RFC2308</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Andrews</span>. </span><span class="title"><i>Negative Caching of <acronym class="acronym">DNS</acronym> +<a name="id2593780"></a><p>[<abbr class="abbrev">RFC2308</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Andrews</span>. </span><span class="title"><i>Negative Caching of <acronym class="acronym">DNS</acronym> Queries</i>. </span><span class="pubdate">March 1998. </span></p> </div> <div class="biblioentry"> -<a name="id2593506"></a><p>[<abbr class="abbrev">RFC1995</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Ohta</span>. </span><span class="title"><i>Incremental Zone Transfer in <acronym class="acronym">DNS</acronym></i>. </span><span class="pubdate">August 1996. </span></p> +<a name="id2593805"></a><p>[<abbr class="abbrev">RFC1995</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Ohta</span>. </span><span class="title"><i>Incremental Zone Transfer in <acronym class="acronym">DNS</acronym></i>. </span><span class="pubdate">August 1996. </span></p> </div> <div class="biblioentry"> -<a name="id2593530"></a><p>[<abbr class="abbrev">RFC1996</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>A Mechanism for Prompt Notification of Zone Changes</i>. </span><span class="pubdate">August 1996. </span></p> +<a name="id2593830"></a><p>[<abbr class="abbrev">RFC1996</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>A Mechanism for Prompt Notification of Zone Changes</i>. </span><span class="pubdate">August 1996. </span></p> </div> <div class="biblioentry"> -<a name="id2593554"></a><p>[<abbr class="abbrev">RFC2136</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">S.</span> <span class="surname">Thomson</span>, <span class="firstname">Y.</span> <span class="surname">Rekhter</span>, and <span class="firstname">J.</span> <span class="surname">Bound</span>. </span><span class="title"><i>Dynamic Updates in the Domain Name System</i>. </span><span class="pubdate">April 1997. </span></p> +<a name="id2593853"></a><p>[<abbr class="abbrev">RFC2136</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">S.</span> <span class="surname">Thomson</span>, <span class="firstname">Y.</span> <span class="surname">Rekhter</span>, and <span class="firstname">J.</span> <span class="surname">Bound</span>. </span><span class="title"><i>Dynamic Updates in the Domain Name System</i>. </span><span class="pubdate">April 1997. </span></p> </div> <div class="biblioentry"> -<a name="id2593609"></a><p>[<abbr class="abbrev">RFC2671</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Extension Mechanisms for DNS (EDNS0)</i>. </span><span class="pubdate">August 1997. </span></p> +<a name="id2593909"></a><p>[<abbr class="abbrev">RFC2671</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Extension Mechanisms for DNS (EDNS0)</i>. </span><span class="pubdate">August 1997. </span></p> </div> <div class="biblioentry"> -<a name="id2593636"></a><p>[<abbr class="abbrev">RFC2672</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Crawford</span>. </span><span class="title"><i>Non-Terminal DNS Name Redirection</i>. </span><span class="pubdate">August 1999. </span></p> +<a name="id2593936"></a><p>[<abbr class="abbrev">RFC2672</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Crawford</span>. </span><span class="title"><i>Non-Terminal DNS Name Redirection</i>. </span><span class="pubdate">August 1999. </span></p> </div> <div class="biblioentry"> -<a name="id2593662"></a><p>[<abbr class="abbrev">RFC2845</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">O.</span> <span class="surname">Gudmundsson</span>, <span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>, and <span class="firstname">B.</span> <span class="surname">Wellington</span>. </span><span class="title"><i>Secret Key Transaction Authentication for <acronym class="acronym">DNS</acronym> (TSIG)</i>. </span><span class="pubdate">May 2000. </span></p> +<a name="id2593962"></a><p>[<abbr class="abbrev">RFC2845</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">O.</span> <span class="surname">Gudmundsson</span>, <span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>, and <span class="firstname">B.</span> <span class="surname">Wellington</span>. </span><span class="title"><i>Secret Key Transaction Authentication for <acronym class="acronym">DNS</acronym> (TSIG)</i>. </span><span class="pubdate">May 2000. </span></p> </div> <div class="biblioentry"> -<a name="id2593724"></a><p>[<abbr class="abbrev">RFC2930</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Secret Key Establishment for DNS (TKEY RR)</i>. </span><span class="pubdate">September 2000. </span></p> +<a name="id2594024"></a><p>[<abbr class="abbrev">RFC2930</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Secret Key Establishment for DNS (TKEY RR)</i>. </span><span class="pubdate">September 2000. </span></p> </div> <div class="biblioentry"> -<a name="id2593754"></a><p>[<abbr class="abbrev">RFC2931</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>DNS Request and Transaction Signatures (SIG(0)s)</i>. </span><span class="pubdate">September 2000. </span></p> +<a name="id2594054"></a><p>[<abbr class="abbrev">RFC2931</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>DNS Request and Transaction Signatures (SIG(0)s)</i>. </span><span class="pubdate">September 2000. </span></p> </div> <div class="biblioentry"> -<a name="id2593784"></a><p>[<abbr class="abbrev">RFC3007</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Wellington</span>. </span><span class="title"><i>Secure Domain Name System (DNS) Dynamic Update</i>. </span><span class="pubdate">November 2000. </span></p> +<a name="id2594084"></a><p>[<abbr class="abbrev">RFC3007</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Wellington</span>. </span><span class="title"><i>Secure Domain Name System (DNS) Dynamic Update</i>. </span><span class="pubdate">November 2000. </span></p> </div> <div class="biblioentry"> -<a name="id2593811"></a><p>[<abbr class="abbrev">RFC3645</abbr>] <span class="authorgroup"><span class="firstname">S.</span> <span class="surname">Kwan</span>, <span class="firstname">P.</span> <span class="surname">Garg</span>, <span class="firstname">J.</span> <span class="surname">Gilroy</span>, <span class="firstname">L.</span> <span class="surname">Esibov</span>, <span class="firstname">J.</span> <span class="surname">Westhead</span>, and <span class="firstname">R.</span> <span class="surname">Hall</span>. </span><span class="title"><i>Generic Security Service Algorithm for Secret +<a name="id2594110"></a><p>[<abbr class="abbrev">RFC3645</abbr>] <span class="authorgroup"><span class="firstname">S.</span> <span class="surname">Kwan</span>, <span class="firstname">P.</span> <span class="surname">Garg</span>, <span class="firstname">J.</span> <span class="surname">Gilroy</span>, <span class="firstname">L.</span> <span class="surname">Esibov</span>, <span class="firstname">J.</span> <span class="surname">Westhead</span>, and <span class="firstname">R.</span> <span class="surname">Hall</span>. </span><span class="title"><i>Generic Security Service Algorithm for Secret Key Transaction Authentication for DNS (GSS-TSIG)</i>. </span><span class="pubdate">October 2003. </span></p> </div> @@ -298,19 +314,19 @@ <h3 class="title"> <acronym class="acronym">DNS</acronym> Security Proposed Standards</h3> <div class="biblioentry"> -<a name="id2593893"></a><p>[<abbr class="abbrev">RFC3225</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Conrad</span>. </span><span class="title"><i>Indicating Resolver Support of DNSSEC</i>. </span><span class="pubdate">December 2001. </span></p> +<a name="id2594193"></a><p>[<abbr class="abbrev">RFC3225</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Conrad</span>. </span><span class="title"><i>Indicating Resolver Support of DNSSEC</i>. </span><span class="pubdate">December 2001. </span></p> </div> <div class="biblioentry"> -<a name="id2593920"></a><p>[<abbr class="abbrev">RFC3833</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Atkins</span> and <span class="firstname">R.</span> <span class="surname">Austein</span>. </span><span class="title"><i>Threat Analysis of the Domain Name System (DNS)</i>. </span><span class="pubdate">August 2004. </span></p> +<a name="id2594288"></a><p>[<abbr class="abbrev">RFC3833</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Atkins</span> and <span class="firstname">R.</span> <span class="surname">Austein</span>. </span><span class="title"><i>Threat Analysis of the Domain Name System (DNS)</i>. </span><span class="pubdate">August 2004. </span></p> </div> <div class="biblioentry"> -<a name="id2593956"></a><p>[<abbr class="abbrev">RFC4033</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Arends</span>, <span class="firstname">R.</span> <span class="surname">Austein</span>, <span class="firstname">M.</span> <span class="surname">Larson</span>, <span class="firstname">D.</span> <span class="surname">Massey</span>, and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>DNS Security Introduction and Requirements</i>. </span><span class="pubdate">March 2005. </span></p> +<a name="id2594324"></a><p>[<abbr class="abbrev">RFC4033</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Arends</span>, <span class="firstname">R.</span> <span class="surname">Austein</span>, <span class="firstname">M.</span> <span class="surname">Larson</span>, <span class="firstname">D.</span> <span class="surname">Massey</span>, and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>DNS Security Introduction and Requirements</i>. </span><span class="pubdate">March 2005. </span></p> </div> <div class="biblioentry"> -<a name="id2594021"></a><p>[<abbr class="abbrev">RFC4044</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Arends</span>, <span class="firstname">R.</span> <span class="surname">Austein</span>, <span class="firstname">M.</span> <span class="surname">Larson</span>, <span class="firstname">D.</span> <span class="surname">Massey</span>, and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>Resource Records for the DNS Security Extensions</i>. </span><span class="pubdate">March 2005. </span></p> +<a name="id2594389"></a><p>[<abbr class="abbrev">RFC4044</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Arends</span>, <span class="firstname">R.</span> <span class="surname">Austein</span>, <span class="firstname">M.</span> <span class="surname">Larson</span>, <span class="firstname">D.</span> <span class="surname">Massey</span>, and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>Resource Records for the DNS Security Extensions</i>. </span><span class="pubdate">March 2005. </span></p> </div> <div class="biblioentry"> -<a name="id2594086"></a><p>[<abbr class="abbrev">RFC4035</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Arends</span>, <span class="firstname">R.</span> <span class="surname">Austein</span>, <span class="firstname">M.</span> <span class="surname">Larson</span>, <span class="firstname">D.</span> <span class="surname">Massey</span>, and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>Protocol Modifications for the DNS +<a name="id2594454"></a><p>[<abbr class="abbrev">RFC4035</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Arends</span>, <span class="firstname">R.</span> <span class="surname">Austein</span>, <span class="firstname">M.</span> <span class="surname">Larson</span>, <span class="firstname">D.</span> <span class="surname">Massey</span>, and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>Protocol Modifications for the DNS Security Extensions</i>. </span><span class="pubdate">March 2005. </span></p> </div> </div> @@ -318,146 +334,146 @@ <h3 class="title">Other Important RFCs About <acronym class="acronym">DNS</acronym> Implementation</h3> <div class="biblioentry"> -<a name="id2594160"></a><p>[<abbr class="abbrev">RFC1535</abbr>] <span class="author"><span class="firstname">E.</span> <span class="surname">Gavron</span>. </span><span class="title"><i>A Security Problem and Proposed Correction With Widely +<a name="id2594596"></a><p>[<abbr class="abbrev">RFC1535</abbr>] <span class="author"><span class="firstname">E.</span> <span class="surname">Gavron</span>. </span><span class="title"><i>A Security Problem and Proposed Correction With Widely Deployed <acronym class="acronym">DNS</acronym> Software.</i>. </span><span class="pubdate">October 1993. </span></p> </div> <div class="biblioentry"> -<a name="id2594185"></a><p>[<abbr class="abbrev">RFC1536</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Kumar</span>, <span class="firstname">J.</span> <span class="surname">Postel</span>, <span class="firstname">C.</span> <span class="surname">Neuman</span>, <span class="firstname">P.</span> <span class="surname">Danzig</span>, and <span class="firstname">S.</span> <span class="surname">Miller</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Implementation +<a name="id2594621"></a><p>[<abbr class="abbrev">RFC1536</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Kumar</span>, <span class="firstname">J.</span> <span class="surname">Postel</span>, <span class="firstname">C.</span> <span class="surname">Neuman</span>, <span class="firstname">P.</span> <span class="surname">Danzig</span>, and <span class="firstname">S.</span> <span class="surname">Miller</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Implementation Errors and Suggested Fixes</i>. </span><span class="pubdate">October 1993. </span></p> </div> <div class="biblioentry"> -<a name="id2594253"></a><p>[<abbr class="abbrev">RFC1982</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Elz</span> and <span class="firstname">R.</span> <span class="surname">Bush</span>. </span><span class="title"><i>Serial Number Arithmetic</i>. </span><span class="pubdate">August 1996. </span></p> +<a name="id2594690"></a><p>[<abbr class="abbrev">RFC1982</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Elz</span> and <span class="firstname">R.</span> <span class="surname">Bush</span>. </span><span class="title"><i>Serial Number Arithmetic</i>. </span><span class="pubdate">August 1996. </span></p> </div> <div class="biblioentry"> -<a name="id2594289"></a><p>[<abbr class="abbrev">RFC4074</abbr>] <span class="authorgroup"><span class="firstname">Y.</span> <span class="surname">Morishita</span> and <span class="firstname">T.</span> <span class="surname">Jinmei</span>. </span><span class="title"><i>Common Misbehaviour Against <acronym class="acronym">DNS</acronym> +<a name="id2594725"></a><p>[<abbr class="abbrev">RFC4074</abbr>] <span class="authorgroup"><span class="firstname">Y.</span> <span class="surname">Morishita</span> and <span class="firstname">T.</span> <span class="surname">Jinmei</span>. </span><span class="title"><i>Common Misbehaviour Against <acronym class="acronym">DNS</acronym> Queries for IPv6 Addresses</i>. </span><span class="pubdate">May 2005. </span></p> </div> </div> <div class="bibliodiv"> <h3 class="title">Resource Record Types</h3> <div class="biblioentry"> -<a name="id2594334"></a><p>[<abbr class="abbrev">RFC1183</abbr>] <span class="authorgroup"><span class="firstname">C.F.</span> <span class="surname">Everhart</span>, <span class="firstname">L. A.</span> <span class="surname">Mamakos</span>, <span class="firstname">R.</span> <span class="surname">Ullmann</span>, and <span class="firstname">P.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>New <acronym class="acronym">DNS</acronym> RR Definitions</i>. </span><span class="pubdate">October 1990. </span></p> +<a name="id2594771"></a><p>[<abbr class="abbrev">RFC1183</abbr>] <span class="authorgroup"><span class="firstname">C.F.</span> <span class="surname">Everhart</span>, <span class="firstname">L. A.</span> <span class="surname">Mamakos</span>, <span class="firstname">R.</span> <span class="surname">Ullmann</span>, and <span class="firstname">P.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>New <acronym class="acronym">DNS</acronym> RR Definitions</i>. </span><span class="pubdate">October 1990. </span></p> </div> <div class="biblioentry"> -<a name="id2594460"></a><p>[<abbr class="abbrev">RFC1706</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Manning</span> and <span class="firstname">R.</span> <span class="surname">Colella</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> NSAP Resource Records</i>. </span><span class="pubdate">October 1994. </span></p> +<a name="id2594828"></a><p>[<abbr class="abbrev">RFC1706</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Manning</span> and <span class="firstname">R.</span> <span class="surname">Colella</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> NSAP Resource Records</i>. </span><span class="pubdate">October 1994. </span></p> </div> <div class="biblioentry"> -<a name="id2594498"></a><p>[<abbr class="abbrev">RFC2168</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Daniel</span> and <span class="firstname">M.</span> <span class="surname">Mealling</span>. </span><span class="title"><i>Resolution of Uniform Resource Identifiers using +<a name="id2594866"></a><p>[<abbr class="abbrev">RFC2168</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Daniel</span> and <span class="firstname">M.</span> <span class="surname">Mealling</span>. </span><span class="title"><i>Resolution of Uniform Resource Identifiers using the Domain Name System</i>. </span><span class="pubdate">June 1997. </span></p> </div> <div class="biblioentry"> -<a name="id2594533"></a><p>[<abbr class="abbrev">RFC1876</abbr>] <span class="authorgroup"><span class="firstname">C.</span> <span class="surname">Davis</span>, <span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">T.</span>, and <span class="firstname">I.</span> <span class="surname">Dickinson</span>. </span><span class="title"><i>A Means for Expressing Location Information in the +<a name="id2594901"></a><p>[<abbr class="abbrev">RFC1876</abbr>] <span class="authorgroup"><span class="firstname">C.</span> <span class="surname">Davis</span>, <span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">T.</span>, and <span class="firstname">I.</span> <span class="surname">Dickinson</span>. </span><span class="title"><i>A Means for Expressing Location Information in the Domain Name System</i>. </span><span class="pubdate">January 1996. </span></p> </div> <div class="biblioentry"> -<a name="id2594587"></a><p>[<abbr class="abbrev">RFC2052</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Gulbrandsen</span> and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>A <acronym class="acronym">DNS</acronym> RR for Specifying the +<a name="id2594955"></a><p>[<abbr class="abbrev">RFC2052</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Gulbrandsen</span> and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>A <acronym class="acronym">DNS</acronym> RR for Specifying the Location of Services.</i>. </span><span class="pubdate">October 1996. </span></p> </div> <div class="biblioentry"> -<a name="id2594626"></a><p>[<abbr class="abbrev">RFC2163</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Allocchio</span>. </span><span class="title"><i>Using the Internet <acronym class="acronym">DNS</acronym> to +<a name="id2594994"></a><p>[<abbr class="abbrev">RFC2163</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Allocchio</span>. </span><span class="title"><i>Using the Internet <acronym class="acronym">DNS</acronym> to Distribute MIXER Conformant Global Address Mapping</i>. </span><span class="pubdate">January 1998. </span></p> </div> <div class="biblioentry"> -<a name="id2594651"></a><p>[<abbr class="abbrev">RFC2230</abbr>] <span class="author"><span class="firstname">R.</span> <span class="surname">Atkinson</span>. </span><span class="title"><i>Key Exchange Delegation Record for the <acronym class="acronym">DNS</acronym></i>. </span><span class="pubdate">October 1997. </span></p> +<a name="id2595019"></a><p>[<abbr class="abbrev">RFC2230</abbr>] <span class="author"><span class="firstname">R.</span> <span class="surname">Atkinson</span>. </span><span class="title"><i>Key Exchange Delegation Record for the <acronym class="acronym">DNS</acronym></i>. </span><span class="pubdate">October 1997. </span></p> </div> <div class="biblioentry"> -<a name="id2594677"></a><p>[<abbr class="abbrev">RFC2536</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>DSA KEYs and SIGs in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p> +<a name="id2595045"></a><p>[<abbr class="abbrev">RFC2536</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>DSA KEYs and SIGs in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p> </div> <div class="biblioentry"> -<a name="id2594704"></a><p>[<abbr class="abbrev">RFC2537</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>RSA/MD5 KEYs and SIGs in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p> +<a name="id2595072"></a><p>[<abbr class="abbrev">RFC2537</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>RSA/MD5 KEYs and SIGs in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p> </div> <div class="biblioentry"> -<a name="id2594730"></a><p>[<abbr class="abbrev">RFC2538</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span> and <span class="firstname">O.</span> <span class="surname">Gudmundsson</span>. </span><span class="title"><i>Storing Certificates in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p> +<a name="id2595098"></a><p>[<abbr class="abbrev">RFC2538</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span> and <span class="firstname">O.</span> <span class="surname">Gudmundsson</span>. </span><span class="title"><i>Storing Certificates in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p> </div> <div class="biblioentry"> -<a name="id2594770"></a><p>[<abbr class="abbrev">RFC2539</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Storage of Diffie-Hellman Keys in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p> +<a name="id2595138"></a><p>[<abbr class="abbrev">RFC2539</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Storage of Diffie-Hellman Keys in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p> </div> <div class="biblioentry"> -<a name="id2594800"></a><p>[<abbr class="abbrev">RFC2540</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Detached Domain Name System (DNS) Information</i>. </span><span class="pubdate">March 1999. </span></p> +<a name="id2595168"></a><p>[<abbr class="abbrev">RFC2540</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Detached Domain Name System (DNS) Information</i>. </span><span class="pubdate">March 1999. </span></p> </div> <div class="biblioentry"> -<a name="id2594829"></a><p>[<abbr class="abbrev">RFC2782</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Gulbrandsen</span>. </span><span class="author"><span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="author"><span class="firstname">L.</span> <span class="surname">Esibov</span>. </span><span class="title"><i>A DNS RR for specifying the location of services (DNS SRV)</i>. </span><span class="pubdate">February 2000. </span></p> +<a name="id2595197"></a><p>[<abbr class="abbrev">RFC2782</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Gulbrandsen</span>. </span><span class="author"><span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="author"><span class="firstname">L.</span> <span class="surname">Esibov</span>. </span><span class="title"><i>A DNS RR for specifying the location of services (DNS SRV)</i>. </span><span class="pubdate">February 2000. </span></p> </div> <div class="biblioentry"> -<a name="id2594872"></a><p>[<abbr class="abbrev">RFC2915</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Mealling</span>. </span><span class="author"><span class="firstname">R.</span> <span class="surname">Daniel</span>. </span><span class="title"><i>The Naming Authority Pointer (NAPTR) DNS Resource Record</i>. </span><span class="pubdate">September 2000. </span></p> +<a name="id2595240"></a><p>[<abbr class="abbrev">RFC2915</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Mealling</span>. </span><span class="author"><span class="firstname">R.</span> <span class="surname">Daniel</span>. </span><span class="title"><i>The Naming Authority Pointer (NAPTR) DNS Resource Record</i>. </span><span class="pubdate">September 2000. </span></p> </div> <div class="biblioentry"> -<a name="id2594905"></a><p>[<abbr class="abbrev">RFC3110</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS)</i>. </span><span class="pubdate">May 2001. </span></p> +<a name="id2595273"></a><p>[<abbr class="abbrev">RFC3110</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS)</i>. </span><span class="pubdate">May 2001. </span></p> </div> <div class="biblioentry"> -<a name="id2594932"></a><p>[<abbr class="abbrev">RFC3123</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Koch</span>. </span><span class="title"><i>A DNS RR Type for Lists of Address Prefixes (APL RR)</i>. </span><span class="pubdate">June 2001. </span></p> +<a name="id2595300"></a><p>[<abbr class="abbrev">RFC3123</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Koch</span>. </span><span class="title"><i>A DNS RR Type for Lists of Address Prefixes (APL RR)</i>. </span><span class="pubdate">June 2001. </span></p> </div> <div class="biblioentry"> -<a name="id2594955"></a><p>[<abbr class="abbrev">RFC3596</abbr>] <span class="authorgroup"><span class="firstname">S.</span> <span class="surname">Thomson</span>, <span class="firstname">C.</span> <span class="surname">Huitema</span>, <span class="firstname">V.</span> <span class="surname">Ksinant</span>, and <span class="firstname">M.</span> <span class="surname">Souissi</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Extensions to support IP +<a name="id2595323"></a><p>[<abbr class="abbrev">RFC3596</abbr>] <span class="authorgroup"><span class="firstname">S.</span> <span class="surname">Thomson</span>, <span class="firstname">C.</span> <span class="surname">Huitema</span>, <span class="firstname">V.</span> <span class="surname">Ksinant</span>, and <span class="firstname">M.</span> <span class="surname">Souissi</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Extensions to support IP version 6</i>. </span><span class="pubdate">October 2003. </span></p> </div> <div class="biblioentry"> -<a name="id2595013"></a><p>[<abbr class="abbrev">RFC3597</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Gustafsson</span>. </span><span class="title"><i>Handling of Unknown DNS Resource Record (RR) Types</i>. </span><span class="pubdate">September 2003. </span></p> +<a name="id2595381"></a><p>[<abbr class="abbrev">RFC3597</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Gustafsson</span>. </span><span class="title"><i>Handling of Unknown DNS Resource Record (RR) Types</i>. </span><span class="pubdate">September 2003. </span></p> </div> </div> <div class="bibliodiv"> <h3 class="title"> <acronym class="acronym">DNS</acronym> and the Internet</h3> <div class="biblioentry"> -<a name="id2595045"></a><p>[<abbr class="abbrev">RFC1101</abbr>] <span class="author"><span class="firstname">P. V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Encoding of Network Names +<a name="id2595413"></a><p>[<abbr class="abbrev">RFC1101</abbr>] <span class="author"><span class="firstname">P. V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Encoding of Network Names and Other Types</i>. </span><span class="pubdate">April 1989. </span></p> </div> <div class="biblioentry"> -<a name="id2595070"></a><p>[<abbr class="abbrev">RFC1123</abbr>] <span class="author"><span class="surname">Braden</span>. </span><span class="title"><i>Requirements for Internet Hosts - Application and +<a name="id2595438"></a><p>[<abbr class="abbrev">RFC1123</abbr>] <span class="author"><span class="surname">Braden</span>. </span><span class="title"><i>Requirements for Internet Hosts - Application and Support</i>. </span><span class="pubdate">October 1989. </span></p> </div> <div class="biblioentry"> -<a name="id2595093"></a><p>[<abbr class="abbrev">RFC1591</abbr>] <span class="author"><span class="firstname">J.</span> <span class="surname">Postel</span>. </span><span class="title"><i>Domain Name System Structure and Delegation</i>. </span><span class="pubdate">March 1994. </span></p> +<a name="id2595461"></a><p>[<abbr class="abbrev">RFC1591</abbr>] <span class="author"><span class="firstname">J.</span> <span class="surname">Postel</span>. </span><span class="title"><i>Domain Name System Structure and Delegation</i>. </span><span class="pubdate">March 1994. </span></p> </div> <div class="biblioentry"> -<a name="id2595116"></a><p>[<abbr class="abbrev">RFC2317</abbr>] <span class="authorgroup"><span class="firstname">H.</span> <span class="surname">Eidnes</span>, <span class="firstname">G.</span> <span class="surname">de Groot</span>, and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Classless IN-ADDR.ARPA Delegation</i>. </span><span class="pubdate">March 1998. </span></p> +<a name="id2595484"></a><p>[<abbr class="abbrev">RFC2317</abbr>] <span class="authorgroup"><span class="firstname">H.</span> <span class="surname">Eidnes</span>, <span class="firstname">G.</span> <span class="surname">de Groot</span>, and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Classless IN-ADDR.ARPA Delegation</i>. </span><span class="pubdate">March 1998. </span></p> </div> <div class="biblioentry"> -<a name="id2595162"></a><p>[<abbr class="abbrev">RFC2826</abbr>] <span class="authorgroup"><span class="surname">Internet Architecture Board</span>. </span><span class="title"><i>IAB Technical Comment on the Unique DNS Root</i>. </span><span class="pubdate">May 2000. </span></p> +<a name="id2595530"></a><p>[<abbr class="abbrev">RFC2826</abbr>] <span class="authorgroup"><span class="surname">Internet Architecture Board</span>. </span><span class="title"><i>IAB Technical Comment on the Unique DNS Root</i>. </span><span class="pubdate">May 2000. </span></p> </div> <div class="biblioentry"> -<a name="id2595186"></a><p>[<abbr class="abbrev">RFC2929</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>, <span class="firstname">E.</span> <span class="surname">Brunner-Williams</span>, and <span class="firstname">B.</span> <span class="surname">Manning</span>. </span><span class="title"><i>Domain Name System (DNS) IANA Considerations</i>. </span><span class="pubdate">September 2000. </span></p> +<a name="id2595554"></a><p>[<abbr class="abbrev">RFC2929</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>, <span class="firstname">E.</span> <span class="surname">Brunner-Williams</span>, and <span class="firstname">B.</span> <span class="surname">Manning</span>. </span><span class="title"><i>Domain Name System (DNS) IANA Considerations</i>. </span><span class="pubdate">September 2000. </span></p> </div> </div> <div class="bibliodiv"> <h3 class="title"> <acronym class="acronym">DNS</acronym> Operations</h3> <div class="biblioentry"> -<a name="id2595243"></a><p>[<abbr class="abbrev">RFC1033</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Lottor</span>. </span><span class="title"><i>Domain administrators operations guide.</i>. </span><span class="pubdate">November 1987. </span></p> +<a name="id2595611"></a><p>[<abbr class="abbrev">RFC1033</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Lottor</span>. </span><span class="title"><i>Domain administrators operations guide.</i>. </span><span class="pubdate">November 1987. </span></p> </div> <div class="biblioentry"> -<a name="id2595267"></a><p>[<abbr class="abbrev">RFC1537</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Beertema</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Data File +<a name="id2595635"></a><p>[<abbr class="abbrev">RFC1537</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Beertema</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Data File Configuration Errors</i>. </span><span class="pubdate">October 1993. </span></p> </div> <div class="biblioentry"> -<a name="id2595293"></a><p>[<abbr class="abbrev">RFC1912</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Barr</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Operational and +<a name="id2595661"></a><p>[<abbr class="abbrev">RFC1912</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Barr</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Operational and Configuration Errors</i>. </span><span class="pubdate">February 1996. </span></p> </div> <div class="biblioentry"> -<a name="id2595320"></a><p>[<abbr class="abbrev">RFC2010</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Manning</span> and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Operational Criteria for Root Name Servers.</i>. </span><span class="pubdate">October 1996. </span></p> +<a name="id2595688"></a><p>[<abbr class="abbrev">RFC2010</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Manning</span> and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Operational Criteria for Root Name Servers.</i>. </span><span class="pubdate">October 1996. </span></p> </div> <div class="biblioentry"> -<a name="id2595356"></a><p>[<abbr class="abbrev">RFC2219</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Hamilton</span> and <span class="firstname">R.</span> <span class="surname">Wright</span>. </span><span class="title"><i>Use of <acronym class="acronym">DNS</acronym> Aliases for +<a name="id2595724"></a><p>[<abbr class="abbrev">RFC2219</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Hamilton</span> and <span class="firstname">R.</span> <span class="surname">Wright</span>. </span><span class="title"><i>Use of <acronym class="acronym">DNS</acronym> Aliases for Network Services.</i>. </span><span class="pubdate">October 1997. </span></p> </div> </div> <div class="bibliodiv"> <h3 class="title">Internationalized Domain Names</h3> <div class="biblioentry"> -<a name="id2595402"></a><p>[<abbr class="abbrev">RFC2825</abbr>] <span class="authorgroup"><span class="surname">IAB</span> and <span class="firstname">R.</span> <span class="surname">Daigle</span>. </span><span class="title"><i>A Tangled Web: Issues of I18N, Domain Names, +<a name="id2595770"></a><p>[<abbr class="abbrev">RFC2825</abbr>] <span class="authorgroup"><span class="surname">IAB</span> and <span class="firstname">R.</span> <span class="surname">Daigle</span>. </span><span class="title"><i>A Tangled Web: Issues of I18N, Domain Names, and the Other Internet protocols</i>. </span><span class="pubdate">May 2000. </span></p> </div> <div class="biblioentry"> -<a name="id2595434"></a><p>[<abbr class="abbrev">RFC3490</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Faltstrom</span>, <span class="firstname">P.</span> <span class="surname">Hoffman</span>, and <span class="firstname">A.</span> <span class="surname">Costello</span>. </span><span class="title"><i>Internationalizing Domain Names in Applications (IDNA)</i>. </span><span class="pubdate">March 2003. </span></p> +<a name="id2595802"></a><p>[<abbr class="abbrev">RFC3490</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Faltstrom</span>, <span class="firstname">P.</span> <span class="surname">Hoffman</span>, and <span class="firstname">A.</span> <span class="surname">Costello</span>. </span><span class="title"><i>Internationalizing Domain Names in Applications (IDNA)</i>. </span><span class="pubdate">March 2003. </span></p> </div> <div class="biblioentry"> -<a name="id2595480"></a><p>[<abbr class="abbrev">RFC3491</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Hoffman</span> and <span class="firstname">M.</span> <span class="surname">Blanchet</span>. </span><span class="title"><i>Nameprep: A Stringprep Profile for Internationalized Domain Names</i>. </span><span class="pubdate">March 2003. </span></p> +<a name="id2595848"></a><p>[<abbr class="abbrev">RFC3491</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Hoffman</span> and <span class="firstname">M.</span> <span class="surname">Blanchet</span>. </span><span class="title"><i>Nameprep: A Stringprep Profile for Internationalized Domain Names</i>. </span><span class="pubdate">March 2003. </span></p> </div> <div class="biblioentry"> -<a name="id2595515"></a><p>[<abbr class="abbrev">RFC3492</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Costello</span>. </span><span class="title"><i>Punycode: A Bootstring encoding of Unicode +<a name="id2595883"></a><p>[<abbr class="abbrev">RFC3492</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Costello</span>. </span><span class="title"><i>Punycode: A Bootstring encoding of Unicode for Internationalized Domain Names in Applications (IDNA)</i>. </span><span class="pubdate">March 2003. </span></p> </div> @@ -473,50 +489,47 @@ </p> </div> <div class="biblioentry"> -<a name="id2595560"></a><p>[<abbr class="abbrev">RFC1464</abbr>] <span class="author"><span class="firstname">R.</span> <span class="surname">Rosenbaum</span>. </span><span class="title"><i>Using the Domain Name System To Store Arbitrary String +<a name="id2595928"></a><p>[<abbr class="abbrev">RFC1464</abbr>] <span class="author"><span class="firstname">R.</span> <span class="surname">Rosenbaum</span>. </span><span class="title"><i>Using the Domain Name System To Store Arbitrary String Attributes</i>. </span><span class="pubdate">May 1993. </span></p> </div> <div class="biblioentry"> -<a name="id2595582"></a><p>[<abbr class="abbrev">RFC1713</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Romao</span>. </span><span class="title"><i>Tools for <acronym class="acronym">DNS</acronym> Debugging</i>. </span><span class="pubdate">November 1994. </span></p> +<a name="id2595950"></a><p>[<abbr class="abbrev">RFC1713</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Romao</span>. </span><span class="title"><i>Tools for <acronym class="acronym">DNS</acronym> Debugging</i>. </span><span class="pubdate">November 1994. </span></p> </div> <div class="biblioentry"> -<a name="id2595608"></a><p>[<abbr class="abbrev">RFC1794</abbr>] <span class="author"><span class="firstname">T.</span> <span class="surname">Brisco</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Support for Load +<a name="id2595976"></a><p>[<abbr class="abbrev">RFC1794</abbr>] <span class="author"><span class="firstname">T.</span> <span class="surname">Brisco</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Support for Load Balancing</i>. </span><span class="pubdate">April 1995. </span></p> </div> <div class="biblioentry"> -<a name="id2595634"></a><p>[<abbr class="abbrev">RFC2240</abbr>] <span class="author"><span class="firstname">O.</span> <span class="surname">Vaughan</span>. </span><span class="title"><i>A Legal Basis for Domain Name Allocation</i>. </span><span class="pubdate">November 1997. </span></p> +<a name="id2596002"></a><p>[<abbr class="abbrev">RFC2240</abbr>] <span class="author"><span class="firstname">O.</span> <span class="surname">Vaughan</span>. </span><span class="title"><i>A Legal Basis for Domain Name Allocation</i>. </span><span class="pubdate">November 1997. </span></p> </div> <div class="biblioentry"> -<a name="id2595657"></a><p>[<abbr class="abbrev">RFC2345</abbr>] <span class="authorgroup"><span class="firstname">J.</span> <span class="surname">Klensin</span>, <span class="firstname">T.</span> <span class="surname">Wolf</span>, and <span class="firstname">G.</span> <span class="surname">Oglesby</span>. </span><span class="title"><i>Domain Names and Company Name Retrieval</i>. </span><span class="pubdate">May 1998. </span></p> +<a name="id2596025"></a><p>[<abbr class="abbrev">RFC2345</abbr>] <span class="authorgroup"><span class="firstname">J.</span> <span class="surname">Klensin</span>, <span class="firstname">T.</span> <span class="surname">Wolf</span>, and <span class="firstname">G.</span> <span class="surname">Oglesby</span>. </span><span class="title"><i>Domain Names and Company Name Retrieval</i>. </span><span class="pubdate">May 1998. </span></p> </div> <div class="biblioentry"> -<a name="id2595703"></a><p>[<abbr class="abbrev">RFC2352</abbr>] <span class="author"><span class="firstname">O.</span> <span class="surname">Vaughan</span>. </span><span class="title"><i>A Convention For Using Legal Names as Domain Names</i>. </span><span class="pubdate">May 1998. </span></p> +<a name="id2596071"></a><p>[<abbr class="abbrev">RFC2352</abbr>] <span class="author"><span class="firstname">O.</span> <span class="surname">Vaughan</span>. </span><span class="title"><i>A Convention For Using Legal Names as Domain Names</i>. </span><span class="pubdate">May 1998. </span></p> </div> <div class="biblioentry"> -<a name="id2595726"></a><p>[<abbr class="abbrev">RFC3071</abbr>] <span class="authorgroup"><span class="firstname">J.</span> <span class="surname">Klensin</span>. </span><span class="title"><i>Reflections on the DNS, RFC 1591, and Categories of Domains</i>. </span><span class="pubdate">February 2001. </span></p> +<a name="id2596094"></a><p>[<abbr class="abbrev">RFC3071</abbr>] <span class="authorgroup"><span class="firstname">J.</span> <span class="surname">Klensin</span>. </span><span class="title"><i>Reflections on the DNS, RFC 1591, and Categories of Domains</i>. </span><span class="pubdate">February 2001. </span></p> </div> <div class="biblioentry"> -<a name="id2595753"></a><p>[<abbr class="abbrev">RFC3258</abbr>] <span class="authorgroup"><span class="firstname">T.</span> <span class="surname">Hardie</span>. </span><span class="title"><i>Distributing Authoritative Name Servers via +<a name="id2596121"></a><p>[<abbr class="abbrev">RFC3258</abbr>] <span class="authorgroup"><span class="firstname">T.</span> <span class="surname">Hardie</span>. </span><span class="title"><i>Distributing Authoritative Name Servers via Shared Unicast Addresses</i>. </span><span class="pubdate">April 2002. </span></p> </div> <div class="biblioentry"> -<a name="id2595779"></a><p>[<abbr class="abbrev">RFC3901</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Durand</span> and <span class="firstname">J.</span> <span class="surname">Ihren</span>. </span><span class="title"><i>DNS IPv6 Transport Operational Guidelines</i>. </span><span class="pubdate">September 2004. </span></p> -</div> -<div class="biblioentry"> -<a name="id2595815"></a><p>[<abbr class="abbrev">RFC2352</abbr>] <span class="author"><span class="firstname">O.</span> <span class="surname">Vaughan</span>. </span><span class="title"><i>A Convention For Using Legal Names as Domain Names</i>. </span><span class="pubdate">May 1998. </span></p> +<a name="id2596147"></a><p>[<abbr class="abbrev">RFC3901</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Durand</span> and <span class="firstname">J.</span> <span class="surname">Ihren</span>. </span><span class="title"><i>DNS IPv6 Transport Operational Guidelines</i>. </span><span class="pubdate">September 2004. </span></p> </div> </div> <div class="bibliodiv"> <h3 class="title">Obsolete and Unimplemented Experimental RFC</h3> <div class="biblioentry"> -<a name="id2595846"></a><p>[<abbr class="abbrev">RFC1712</abbr>] <span class="authorgroup"><span class="firstname">C.</span> <span class="surname">Farrell</span>, <span class="firstname">M.</span> <span class="surname">Schulze</span>, <span class="firstname">S.</span> <span class="surname">Pleitner</span>, and <span class="firstname">D.</span> <span class="surname">Baldoni</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Encoding of Geographical +<a name="id2596190"></a><p>[<abbr class="abbrev">RFC1712</abbr>] <span class="authorgroup"><span class="firstname">C.</span> <span class="surname">Farrell</span>, <span class="firstname">M.</span> <span class="surname">Schulze</span>, <span class="firstname">S.</span> <span class="surname">Pleitner</span>, and <span class="firstname">D.</span> <span class="surname">Baldoni</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Encoding of Geographical Location</i>. </span><span class="pubdate">November 1994. </span></p> </div> <div class="biblioentry"> -<a name="id2595904"></a><p>[<abbr class="abbrev">RFC2673</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Crawford</span>. </span><span class="title"><i>Binary Labels in the Domain Name System</i>. </span><span class="pubdate">August 1999. </span></p> +<a name="id2596248"></a><p>[<abbr class="abbrev">RFC2673</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Crawford</span>. </span><span class="title"><i>Binary Labels in the Domain Name System</i>. </span><span class="pubdate">August 1999. </span></p> </div> <div class="biblioentry"> -<a name="id2595930"></a><p>[<abbr class="abbrev">RFC2874</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Crawford</span> and <span class="firstname">C.</span> <span class="surname">Huitema</span>. </span><span class="title"><i>DNS Extensions to Support IPv6 Address Aggregation +<a name="id2596275"></a><p>[<abbr class="abbrev">RFC2874</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Crawford</span> and <span class="firstname">C.</span> <span class="surname">Huitema</span>. </span><span class="title"><i>DNS Extensions to Support IPv6 Address Aggregation and Renumbering</i>. </span><span class="pubdate">July 2000. </span></p> </div> </div> @@ -530,39 +543,39 @@ </p> </div> <div class="biblioentry"> -<a name="id2595978"></a><p>[<abbr class="abbrev">RFC2065</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span> and <span class="firstname">C.</span> <span class="surname">Kaufman</span>. </span><span class="title"><i>Domain Name System Security Extensions</i>. </span><span class="pubdate">January 1997. </span></p> +<a name="id2596323"></a><p>[<abbr class="abbrev">RFC2065</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span> and <span class="firstname">C.</span> <span class="surname">Kaufman</span>. </span><span class="title"><i>Domain Name System Security Extensions</i>. </span><span class="pubdate">January 1997. </span></p> </div> <div class="biblioentry"> -<a name="id2596018"></a><p>[<abbr class="abbrev">RFC2137</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Secure Domain Name System Dynamic Update</i>. </span><span class="pubdate">April 1997. </span></p> +<a name="id2596362"></a><p>[<abbr class="abbrev">RFC2137</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Secure Domain Name System Dynamic Update</i>. </span><span class="pubdate">April 1997. </span></p> </div> <div class="biblioentry"> -<a name="id2596044"></a><p>[<abbr class="abbrev">RFC2535</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Domain Name System Security Extensions</i>. </span><span class="pubdate">March 1999. </span></p> +<a name="id2596389"></a><p>[<abbr class="abbrev">RFC2535</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Domain Name System Security Extensions</i>. </span><span class="pubdate">March 1999. </span></p> </div> <div class="biblioentry"> -<a name="id2596074"></a><p>[<abbr class="abbrev">RFC3008</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Wellington</span>. </span><span class="title"><i>Domain Name System Security (DNSSEC) +<a name="id2596419"></a><p>[<abbr class="abbrev">RFC3008</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Wellington</span>. </span><span class="title"><i>Domain Name System Security (DNSSEC) Signing Authority</i>. </span><span class="pubdate">November 2000. </span></p> </div> <div class="biblioentry"> -<a name="id2596100"></a><p>[<abbr class="abbrev">RFC3090</abbr>] <span class="authorgroup"><span class="firstname">E.</span> <span class="surname">Lewis</span>. </span><span class="title"><i>DNS Security Extension Clarification on Zone Status</i>. </span><span class="pubdate">March 2001. </span></p> +<a name="id2596444"></a><p>[<abbr class="abbrev">RFC3090</abbr>] <span class="authorgroup"><span class="firstname">E.</span> <span class="surname">Lewis</span>. </span><span class="title"><i>DNS Security Extension Clarification on Zone Status</i>. </span><span class="pubdate">March 2001. </span></p> </div> <div class="biblioentry"> -<a name="id2596126"></a><p>[<abbr class="abbrev">RFC3445</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Massey</span> and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>Limiting the Scope of the KEY Resource Record (RR)</i>. </span><span class="pubdate">December 2002. </span></p> +<a name="id2596471"></a><p>[<abbr class="abbrev">RFC3445</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Massey</span> and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>Limiting the Scope of the KEY Resource Record (RR)</i>. </span><span class="pubdate">December 2002. </span></p> </div> <div class="biblioentry"> -<a name="id2596163"></a><p>[<abbr class="abbrev">RFC3655</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Wellington</span> and <span class="firstname">O.</span> <span class="surname">Gudmundsson</span>. </span><span class="title"><i>Redefinition of DNS Authenticated Data (AD) bit</i>. </span><span class="pubdate">November 2003. </span></p> +<a name="id2596507"></a><p>[<abbr class="abbrev">RFC3655</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Wellington</span> and <span class="firstname">O.</span> <span class="surname">Gudmundsson</span>. </span><span class="title"><i>Redefinition of DNS Authenticated Data (AD) bit</i>. </span><span class="pubdate">November 2003. </span></p> </div> <div class="biblioentry"> -<a name="id2596199"></a><p>[<abbr class="abbrev">RFC3658</abbr>] <span class="authorgroup"><span class="firstname">O.</span> <span class="surname">Gudmundsson</span>. </span><span class="title"><i>Delegation Signer (DS) Resource Record (RR)</i>. </span><span class="pubdate">December 2003. </span></p> +<a name="id2596544"></a><p>[<abbr class="abbrev">RFC3658</abbr>] <span class="authorgroup"><span class="firstname">O.</span> <span class="surname">Gudmundsson</span>. </span><span class="title"><i>Delegation Signer (DS) Resource Record (RR)</i>. </span><span class="pubdate">December 2003. </span></p> </div> <div class="biblioentry"> -<a name="id2596226"></a><p>[<abbr class="abbrev">RFC3755</abbr>] <span class="authorgroup"><span class="firstname">S.</span> <span class="surname">Weiler</span>. </span><span class="title"><i>Legacy Resolver Compatibility for Delegation Signer (DS)</i>. </span><span class="pubdate">May 2004. </span></p> +<a name="id2596570"></a><p>[<abbr class="abbrev">RFC3755</abbr>] <span class="authorgroup"><span class="firstname">S.</span> <span class="surname">Weiler</span>. </span><span class="title"><i>Legacy Resolver Compatibility for Delegation Signer (DS)</i>. </span><span class="pubdate">May 2004. </span></p> </div> <div class="biblioentry"> -<a name="id2596252"></a><p>[<abbr class="abbrev">RFC3757</abbr>] <span class="authorgroup"><span class="firstname">O.</span> <span class="surname">Kolkman</span>, <span class="firstname">J.</span> <span class="surname">Schlyter</span>, and <span class="firstname">E.</span> <span class="surname">Lewis</span>. </span><span class="title"><i>Domain Name System KEY (DNSKEY) Resource Record +<a name="id2596597"></a><p>[<abbr class="abbrev">RFC3757</abbr>] <span class="authorgroup"><span class="firstname">O.</span> <span class="surname">Kolkman</span>, <span class="firstname">J.</span> <span class="surname">Schlyter</span>, and <span class="firstname">E.</span> <span class="surname">Lewis</span>. </span><span class="title"><i>Domain Name System KEY (DNSKEY) Resource Record (RR) Secure Entry Point (SEP) Flag</i>. </span><span class="pubdate">April 2004. </span></p> </div> <div class="biblioentry"> -<a name="id2596297"></a><p>[<abbr class="abbrev">RFC3845</abbr>] <span class="authorgroup"><span class="firstname">J.</span> <span class="surname">Schlyter</span>. </span><span class="title"><i>DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format</i>. </span><span class="pubdate">August 2004. </span></p> +<a name="id2596642"></a><p>[<abbr class="abbrev">RFC3845</abbr>] <span class="authorgroup"><span class="firstname">J.</span> <span class="surname">Schlyter</span>. </span><span class="title"><i>DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format</i>. </span><span class="pubdate">August 2004. </span></p> </div> </div> </div> @@ -583,14 +596,14 @@ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2596339"></a>Other Documents About <acronym class="acronym">BIND</acronym> +<a name="id2596683"></a>Other Documents About <acronym class="acronym">BIND</acronym> </h3></div></div></div> <p></p> <div class="bibliography"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2596348"></a>Bibliography</h4></div></div></div> +<a name="id2596693"></a>Bibliography</h4></div></div></div> <div class="biblioentry"> -<a name="id2596350"></a><p><span class="authorgroup"><span class="firstname">Paul</span> <span class="surname">Albitz</span> and <span class="firstname">Cricket</span> <span class="surname">Liu</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym></i>. </span><span class="copyright">Copyright © 1998 Sebastopol, CA: O'Reilly and Associates. </span></p> +<a name="id2596695"></a><p><span class="authorgroup"><span class="firstname">Paul</span> <span class="surname">Albitz</span> and <span class="firstname">Cricket</span> <span class="surname">Liu</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym></i>. </span><span class="copyright">Copyright © 1998 Sebastopol, CA: O'Reilly and Associates. </span></p> </div> </div> </div> diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch10.html b/contrib/bind9/doc/arm/Bv9ARM.ch10.html index 4889fac..03cce5a 100644 --- a/contrib/bind9/doc/arm/Bv9ARM.ch10.html +++ b/contrib/bind9/doc/arm/Bv9ARM.ch10.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: Bv9ARM.ch10.html,v 1.2.2.6.10.1 2007/07/09 02:25:52 marka Exp $ --> +<!-- $Id: Bv9ARM.ch10.html,v 1.2.2.6 2007/01/30 00:23:46 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> diff --git a/contrib/bind9/doc/arm/Bv9ARM.html b/contrib/bind9/doc/arm/Bv9ARM.html index 9e7d7ad..8a33041 100644 --- a/contrib/bind9/doc/arm/Bv9ARM.html +++ b/contrib/bind9/doc/arm/Bv9ARM.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: Bv9ARM.html,v 1.85.18.57.10.1 2007/07/09 02:25:52 marka Exp $ --> +<!-- $Id: Bv9ARM.html,v 1.85.18.68 2007/10/31 01:35:59 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -40,7 +40,7 @@ <div class="titlepage"> <div> <div><h1 class="title"> -<a name="id2563411"></a>BIND 9 Administrator Reference Manual</h1></div> +<a name="id2563155"></a>BIND 9 Administrator Reference Manual</h1></div> <div><p class="copyright">Copyright © 2004-2007 Internet Systems Consortium, Inc. ("ISC")</p></div> <div><p class="copyright">Copyright © 2000-2003 Internet Software Consortium.</p></div> </div> @@ -51,39 +51,39 @@ <dl> <dt><span class="chapter"><a href="Bv9ARM.ch01.html">1. Introduction</a></span></dt> <dd><dl> -<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2564115">Scope of Document</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2564138">Organization of This Document</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2563472">Conventions Used in This Document</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2564813">The Domain Name System (<acronym class="acronym">DNS</acronym>)</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2564117">Scope of Document</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2564140">Organization of This Document</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2563474">Conventions Used in This Document</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2564816">The Domain Name System (<acronym class="acronym">DNS</acronym>)</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2564835">DNS Fundamentals</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2564869">Domains and Domain Names</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2564953">Zones</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2567283">Authoritative Name Servers</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2567524">Caching Name Servers</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2567586">Name Servers in Multiple Roles</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2564837">DNS Fundamentals</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2564871">Domains and Domain Names</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2567208">Zones</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2567285">Authoritative Name Servers</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2567526">Caching Name Servers</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2567588">Name Servers in Multiple Roles</a></span></dt> </dl></dd> </dl></dd> <dt><span class="chapter"><a href="Bv9ARM.ch02.html">2. <acronym class="acronym">BIND</acronym> Resource Requirements</a></span></dt> <dd><dl> -<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567620">Hardware requirements</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567646">CPU Requirements</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567659">Memory Requirements</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567686">Name Server Intensive Environment Issues</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567697">Supported Operating Systems</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567622">Hardware requirements</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567649">CPU Requirements</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567661">Memory Requirements</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567688">Name Server Intensive Environment Issues</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567699">Supported Operating Systems</a></span></dt> </dl></dd> <dt><span class="chapter"><a href="Bv9ARM.ch03.html">3. Name Server Configuration</a></span></dt> <dd><dl> <dt><span class="sect1"><a href="Bv9ARM.ch03.html#sample_configuration">Sample Configurations</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568002">A Caching-only Name Server</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568018">An Authoritative-only Name Server</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568004">A Caching-only Name Server</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568020">An Authoritative-only Name Server</a></span></dt> </dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2568040">Load Balancing</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2568464">Name Server Operations</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2568042">Load Balancing</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2568465">Name Server Operations</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568469">Tools for Use With the Name Server Daemon</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2570039">Signals</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568470">Tools for Use With the Name Server Daemon</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2570184">Signals</a></span></dt> </dl></dd> </dl></dd> <dt><span class="chapter"><a href="Bv9ARM.ch04.html">4. Advanced DNS Features</a></span></dt> @@ -92,33 +92,34 @@ <dt><span class="sect1"><a href="Bv9ARM.ch04.html#dynamic_update">Dynamic Update</a></span></dt> <dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch04.html#journal">The journal file</a></span></dt></dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch04.html#incremental_zone_transfers">Incremental Zone Transfers (IXFR)</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2570428">Split DNS</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2570642">Split DNS</a></span></dt> +<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2570660">Example split DNS setup</a></span></dt></dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch04.html#tsig">TSIG</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2570948">Generate Shared Keys for Each Pair of Hosts</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571021">Copying the Shared Secret to Both Machines</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571032">Informing the Servers of the Key's Existence</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571140">Instructing the Server to Use the Key</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571197">TSIG Key Based Access Control</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571242">Errors</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571095">Generate Shared Keys for Each Pair of Hosts</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571169">Copying the Shared Secret to Both Machines</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571179">Informing the Servers of the Key's Existence</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571219">Instructing the Server to Use the Key</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571413">TSIG Key Based Access Control</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571458">Errors</a></span></dt> </dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571256">TKEY</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571305">SIG(0)</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571472">TKEY</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571521">SIG(0)</a></span></dt> <dt><span class="sect1"><a href="Bv9ARM.ch04.html#DNSSEC">DNSSEC</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571578">Generating Keys</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571648">Signing the Zone</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571726">Configuring Servers</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571725">Generating Keys</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571795">Signing the Zone</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571874">Configuring Servers</a></span></dt> </dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571801">IPv6 Support in <acronym class="acronym">BIND</acronym> 9</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2572153">IPv6 Support in <acronym class="acronym">BIND</acronym> 9</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572000">Address Lookups Using AAAA Records</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572021">Address to Name Lookups Using Nibble Format</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572215">Address Lookups Using AAAA Records</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572236">Address to Name Lookups Using Nibble Format</a></span></dt> </dl></dd> </dl></dd> <dt><span class="chapter"><a href="Bv9ARM.ch05.html">5. The <acronym class="acronym">BIND</acronym> 9 Lightweight Resolver</a></span></dt> <dd><dl> -<dt><span class="sect1"><a href="Bv9ARM.ch05.html#id2572054">The Lightweight Resolver Library</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch05.html#id2572269">The Lightweight Resolver Library</a></span></dt> <dt><span class="sect1"><a href="Bv9ARM.ch05.html#lwresd">Running a Resolver Daemon</a></span></dt> </dl></dd> <dt><span class="chapter"><a href="Bv9ARM.ch06.html">6. <acronym class="acronym">BIND</acronym> 9 Configuration Reference</a></span></dt> @@ -126,83 +127,83 @@ <dt><span class="sect1"><a href="Bv9ARM.ch06.html#configuration_file_elements">Configuration File Elements</a></span></dt> <dd><dl> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#address_match_lists">Address Match Lists</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573333">Comment Syntax</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573480">Comment Syntax</a></span></dt> </dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch06.html#Configuration_File_Grammar">Configuration File Grammar</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574013"><span><strong class="command">acl</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574092"><span><strong class="command">acl</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#acl"><span><strong class="command">acl</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574203"><span><strong class="command">controls</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574282"><span><strong class="command">controls</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage"><span><strong class="command">controls</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574632"><span><strong class="command">include</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574647"><span><strong class="command">include</strong></span> Statement Definition and +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574711"><span><strong class="command">include</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574726"><span><strong class="command">include</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574670"><span><strong class="command">key</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574692"><span><strong class="command">key</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574782"><span><strong class="command">logging</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574908"><span><strong class="command">logging</strong></span> Statement Definition and +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574749"><span><strong class="command">key</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574771"><span><strong class="command">key</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574930"><span><strong class="command">logging</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575056"><span><strong class="command">logging</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576395"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576469"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576533"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576577"><span><strong class="command">masters</strong></span> Statement Definition and +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576406"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576480"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576544"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576587"><span><strong class="command">masters</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576592"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576602"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#options"><span><strong class="command">options</strong></span> Statement Definition and Usage</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_grammar"><span><strong class="command">server</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_definition_and_usage"><span><strong class="command">server</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585031"><span><strong class="command">trusted-keys</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585080"><span><strong class="command">trusted-keys</strong></span> Statement Definition +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585361"><span><strong class="command">trusted-keys</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585410"><span><strong class="command">trusted-keys</strong></span> Statement Definition and Usage</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#view_statement_grammar"><span><strong class="command">view</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585228"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585490"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#zone_statement_grammar"><span><strong class="command">zone</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2586599"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2586798"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt> </dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2588791">Zone File</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2589080">Zone File</a></span></dt> <dd><dl> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#types_of_resource_records_and_when_to_use_them">Types of Resource Records and When to Use Them</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2590812">Discussion of MX Records</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591101">Discussion of MX Records</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#Setting_TTLs">Setting TTLs</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591432">Inverse Mapping in IPv4</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591559">Other Zone File Directives</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591816"><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591653">Inverse Mapping in IPv4</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591848">Other Zone File Directives</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2592173"><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#zonefile_format">Additional File Formats</a></span></dt> </dl></dd> </dl></dd> <dt><span class="chapter"><a href="Bv9ARM.ch07.html">7. <acronym class="acronym">BIND</acronym> 9 Security Considerations</a></span></dt> <dd><dl> <dt><span class="sect1"><a href="Bv9ARM.ch07.html#Access_Control_Lists">Access Control Lists</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch07.html#id2592492"><span><strong class="command">chroot</strong></span> and <span><strong class="command">setuid</strong></span></a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch07.html#id2592714"><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span></a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2592569">The <span><strong class="command">chroot</strong></span> Environment</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2592629">Using the <span><strong class="command">setuid</strong></span> Function</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2592791">The <span><strong class="command">chroot</strong></span> Environment</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2592851">Using the <span><strong class="command">setuid</strong></span> Function</a></span></dt> </dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch07.html#dynamic_update_security">Dynamic Update Security</a></span></dt> </dl></dd> <dt><span class="chapter"><a href="Bv9ARM.ch08.html">8. Troubleshooting</a></span></dt> <dd><dl> -<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2592709">Common Problems</a></span></dt> -<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch08.html#id2592714">It's not working; how can I figure out what's wrong?</a></span></dt></dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2592726">Incrementing and Changing the Serial Number</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2592743">Where Can I Get Help?</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2592999">Common Problems</a></span></dt> +<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch08.html#id2593004">It's not working; how can I figure out what's wrong?</a></span></dt></dl></dd> +<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2593016">Incrementing and Changing the Serial Number</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2593033">Where Can I Get Help?</a></span></dt> </dl></dd> <dt><span class="appendix"><a href="Bv9ARM.ch09.html">A. Appendices</a></span></dt> <dd><dl> -<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2593078">Acknowledgments</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2593300">Acknowledgments</a></span></dt> <dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch09.html#historical_dns_information">A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym></a></span></dt></dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2593172">General <acronym class="acronym">DNS</acronym> Reference Information</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2593472">General <acronym class="acronym">DNS</acronym> Reference Information</a></span></dt> <dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch09.html#ipv6addresses">IPv6 addresses (AAAA)</a></span></dt></dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch09.html#bibliography">Bibliography (and Suggested Reading)</a></span></dt> <dd><dl> <dt><span class="sect2"><a href="Bv9ARM.ch09.html#rfcs">Request for Comments (RFCs)</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch09.html#internet_drafts">Internet Drafts</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2596339">Other Documents About <acronym class="acronym">BIND</acronym></a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2596683">Other Documents About <acronym class="acronym">BIND</acronym></a></span></dt> </dl></dd> </dl></dd> <dt><span class="reference"><a href="Bv9ARM.ch10.html">I. Manual pages</a></span></dt> diff --git a/contrib/bind9/doc/arm/Bv9ARM.pdf b/contrib/bind9/doc/arm/Bv9ARM.pdf index d66c247..be27aa1 100755 --- a/contrib/bind9/doc/arm/Bv9ARM.pdf +++ b/contrib/bind9/doc/arm/Bv9ARM.pdf @@ -222,782 +222,788 @@ endobj (4.4 Split DNS) endobj 153 0 obj -<< /S /GoTo /D (section.4.5) >> +<< /S /GoTo /D (subsection.4.4.1) >> endobj 156 0 obj -(4.5 TSIG) +(4.4.1 Example split DNS setup) endobj 157 0 obj -<< /S /GoTo /D (subsection.4.5.1) >> +<< /S /GoTo /D (section.4.5) >> endobj 160 0 obj -(4.5.1 Generate Shared Keys for Each Pair of Hosts) +(4.5 TSIG) endobj 161 0 obj -<< /S /GoTo /D (subsubsection.4.5.1.1) >> +<< /S /GoTo /D (subsection.4.5.1) >> endobj 164 0 obj -(4.5.1.1 Automatic Generation) +(4.5.1 Generate Shared Keys for Each Pair of Hosts) endobj 165 0 obj -<< /S /GoTo /D (subsubsection.4.5.1.2) >> +<< /S /GoTo /D (subsubsection.4.5.1.1) >> endobj 168 0 obj -(4.5.1.2 Manual Generation) +(4.5.1.1 Automatic Generation) endobj 169 0 obj -<< /S /GoTo /D (subsection.4.5.2) >> +<< /S /GoTo /D (subsubsection.4.5.1.2) >> endobj 172 0 obj -(4.5.2 Copying the Shared Secret to Both Machines) +(4.5.1.2 Manual Generation) endobj 173 0 obj -<< /S /GoTo /D (subsection.4.5.3) >> +<< /S /GoTo /D (subsection.4.5.2) >> endobj 176 0 obj -(4.5.3 Informing the Servers of the Key's Existence) +(4.5.2 Copying the Shared Secret to Both Machines) endobj 177 0 obj -<< /S /GoTo /D (subsection.4.5.4) >> +<< /S /GoTo /D (subsection.4.5.3) >> endobj 180 0 obj -(4.5.4 Instructing the Server to Use the Key) +(4.5.3 Informing the Servers of the Key's Existence) endobj 181 0 obj -<< /S /GoTo /D (subsection.4.5.5) >> +<< /S /GoTo /D (subsection.4.5.4) >> endobj 184 0 obj -(4.5.5 TSIG Key Based Access Control) +(4.5.4 Instructing the Server to Use the Key) endobj 185 0 obj -<< /S /GoTo /D (subsection.4.5.6) >> +<< /S /GoTo /D (subsection.4.5.5) >> endobj 188 0 obj -(4.5.6 Errors) +(4.5.5 TSIG Key Based Access Control) endobj 189 0 obj -<< /S /GoTo /D (section.4.6) >> +<< /S /GoTo /D (subsection.4.5.6) >> endobj 192 0 obj -(4.6 TKEY) +(4.5.6 Errors) endobj 193 0 obj -<< /S /GoTo /D (section.4.7) >> +<< /S /GoTo /D (section.4.6) >> endobj 196 0 obj -(4.7 SIG\(0\)) +(4.6 TKEY) endobj 197 0 obj -<< /S /GoTo /D (section.4.8) >> +<< /S /GoTo /D (section.4.7) >> endobj 200 0 obj -(4.8 DNSSEC) +(4.7 SIG\(0\)) endobj 201 0 obj -<< /S /GoTo /D (subsection.4.8.1) >> +<< /S /GoTo /D (section.4.8) >> endobj 204 0 obj -(4.8.1 Generating Keys) +(4.8 DNSSEC) endobj 205 0 obj -<< /S /GoTo /D (subsection.4.8.2) >> +<< /S /GoTo /D (subsection.4.8.1) >> endobj 208 0 obj -(4.8.2 Signing the Zone) +(4.8.1 Generating Keys) endobj 209 0 obj -<< /S /GoTo /D (subsection.4.8.3) >> +<< /S /GoTo /D (subsection.4.8.2) >> endobj 212 0 obj -(4.8.3 Configuring Servers) +(4.8.2 Signing the Zone) endobj 213 0 obj -<< /S /GoTo /D (section.4.9) >> +<< /S /GoTo /D (subsection.4.8.3) >> endobj 216 0 obj -(4.9 IPv6 Support in BIND 9) +(4.8.3 Configuring Servers) endobj 217 0 obj -<< /S /GoTo /D (subsection.4.9.1) >> +<< /S /GoTo /D (section.4.9) >> endobj 220 0 obj -(4.9.1 Address Lookups Using AAAA Records) +(4.9 IPv6 Support in BIND 9) endobj 221 0 obj -<< /S /GoTo /D (subsection.4.9.2) >> +<< /S /GoTo /D (subsection.4.9.1) >> endobj 224 0 obj -(4.9.2 Address to Name Lookups Using Nibble Format) +(4.9.1 Address Lookups Using AAAA Records) endobj 225 0 obj -<< /S /GoTo /D (chapter.5) >> +<< /S /GoTo /D (subsection.4.9.2) >> endobj 228 0 obj -(5 The BIND 9 Lightweight Resolver) +(4.9.2 Address to Name Lookups Using Nibble Format) endobj 229 0 obj -<< /S /GoTo /D (section.5.1) >> +<< /S /GoTo /D (chapter.5) >> endobj 232 0 obj -(5.1 The Lightweight Resolver Library) +(5 The BIND 9 Lightweight Resolver) endobj 233 0 obj -<< /S /GoTo /D (section.5.2) >> +<< /S /GoTo /D (section.5.1) >> endobj 236 0 obj -(5.2 Running a Resolver Daemon) +(5.1 The Lightweight Resolver Library) endobj 237 0 obj -<< /S /GoTo /D (chapter.6) >> +<< /S /GoTo /D (section.5.2) >> endobj 240 0 obj -(6 BIND 9 Configuration Reference) +(5.2 Running a Resolver Daemon) endobj 241 0 obj -<< /S /GoTo /D (section.6.1) >> +<< /S /GoTo /D (chapter.6) >> endobj 244 0 obj -(6.1 Configuration File Elements) +(6 BIND 9 Configuration Reference) endobj 245 0 obj -<< /S /GoTo /D (subsection.6.1.1) >> +<< /S /GoTo /D (section.6.1) >> endobj 248 0 obj -(6.1.1 Address Match Lists) +(6.1 Configuration File Elements) endobj 249 0 obj -<< /S /GoTo /D (subsubsection.6.1.1.1) >> +<< /S /GoTo /D (subsection.6.1.1) >> endobj 252 0 obj -(6.1.1.1 Syntax) +(6.1.1 Address Match Lists) endobj 253 0 obj -<< /S /GoTo /D (subsubsection.6.1.1.2) >> +<< /S /GoTo /D (subsubsection.6.1.1.1) >> endobj 256 0 obj -(6.1.1.2 Definition and Usage) +(6.1.1.1 Syntax) endobj 257 0 obj -<< /S /GoTo /D (subsection.6.1.2) >> +<< /S /GoTo /D (subsubsection.6.1.1.2) >> endobj 260 0 obj -(6.1.2 Comment Syntax) +(6.1.1.2 Definition and Usage) endobj 261 0 obj -<< /S /GoTo /D (subsubsection.6.1.2.1) >> +<< /S /GoTo /D (subsection.6.1.2) >> endobj 264 0 obj -(6.1.2.1 Syntax) +(6.1.2 Comment Syntax) endobj 265 0 obj -<< /S /GoTo /D (subsubsection.6.1.2.2) >> +<< /S /GoTo /D (subsubsection.6.1.2.1) >> endobj 268 0 obj -(6.1.2.2 Definition and Usage) +(6.1.2.1 Syntax) endobj 269 0 obj -<< /S /GoTo /D (section.6.2) >> +<< /S /GoTo /D (subsubsection.6.1.2.2) >> endobj 272 0 obj -(6.2 Configuration File Grammar) +(6.1.2.2 Definition and Usage) endobj 273 0 obj -<< /S /GoTo /D (subsection.6.2.1) >> +<< /S /GoTo /D (section.6.2) >> endobj 276 0 obj -(6.2.1 acl Statement Grammar) +(6.2 Configuration File Grammar) endobj 277 0 obj -<< /S /GoTo /D (subsection.6.2.2) >> +<< /S /GoTo /D (subsection.6.2.1) >> endobj 280 0 obj -(6.2.2 acl Statement Definition and Usage) +(6.2.1 acl Statement Grammar) endobj 281 0 obj -<< /S /GoTo /D (subsection.6.2.3) >> +<< /S /GoTo /D (subsection.6.2.2) >> endobj 284 0 obj -(6.2.3 controls Statement Grammar) +(6.2.2 acl Statement Definition and Usage) endobj 285 0 obj -<< /S /GoTo /D (subsection.6.2.4) >> +<< /S /GoTo /D (subsection.6.2.3) >> endobj 288 0 obj -(6.2.4 controls Statement Definition and Usage) +(6.2.3 controls Statement Grammar) endobj 289 0 obj -<< /S /GoTo /D (subsection.6.2.5) >> +<< /S /GoTo /D (subsection.6.2.4) >> endobj 292 0 obj -(6.2.5 include Statement Grammar) +(6.2.4 controls Statement Definition and Usage) endobj 293 0 obj -<< /S /GoTo /D (subsection.6.2.6) >> +<< /S /GoTo /D (subsection.6.2.5) >> endobj 296 0 obj -(6.2.6 include Statement Definition and Usage) +(6.2.5 include Statement Grammar) endobj 297 0 obj -<< /S /GoTo /D (subsection.6.2.7) >> +<< /S /GoTo /D (subsection.6.2.6) >> endobj 300 0 obj -(6.2.7 key Statement Grammar) +(6.2.6 include Statement Definition and Usage) endobj 301 0 obj -<< /S /GoTo /D (subsection.6.2.8) >> +<< /S /GoTo /D (subsection.6.2.7) >> endobj 304 0 obj -(6.2.8 key Statement Definition and Usage) +(6.2.7 key Statement Grammar) endobj 305 0 obj -<< /S /GoTo /D (subsection.6.2.9) >> +<< /S /GoTo /D (subsection.6.2.8) >> endobj 308 0 obj -(6.2.9 logging Statement Grammar) +(6.2.8 key Statement Definition and Usage) endobj 309 0 obj -<< /S /GoTo /D (subsection.6.2.10) >> +<< /S /GoTo /D (subsection.6.2.9) >> endobj 312 0 obj -(6.2.10 logging Statement Definition and Usage) +(6.2.9 logging Statement Grammar) endobj 313 0 obj -<< /S /GoTo /D (subsubsection.6.2.10.1) >> +<< /S /GoTo /D (subsection.6.2.10) >> endobj 316 0 obj -(6.2.10.1 The channel Phrase) +(6.2.10 logging Statement Definition and Usage) endobj 317 0 obj -<< /S /GoTo /D (subsubsection.6.2.10.2) >> +<< /S /GoTo /D (subsubsection.6.2.10.1) >> endobj 320 0 obj -(6.2.10.2 The category Phrase) +(6.2.10.1 The channel Phrase) endobj 321 0 obj -<< /S /GoTo /D (subsection.6.2.11) >> +<< /S /GoTo /D (subsubsection.6.2.10.2) >> endobj 324 0 obj -(6.2.11 lwres Statement Grammar) +(6.2.10.2 The category Phrase) endobj 325 0 obj -<< /S /GoTo /D (subsection.6.2.12) >> +<< /S /GoTo /D (subsection.6.2.11) >> endobj 328 0 obj -(6.2.12 lwres Statement Definition and Usage) +(6.2.11 lwres Statement Grammar) endobj 329 0 obj -<< /S /GoTo /D (subsection.6.2.13) >> +<< /S /GoTo /D (subsection.6.2.12) >> endobj 332 0 obj -(6.2.13 masters Statement Grammar) +(6.2.12 lwres Statement Definition and Usage) endobj 333 0 obj -<< /S /GoTo /D (subsection.6.2.14) >> +<< /S /GoTo /D (subsection.6.2.13) >> endobj 336 0 obj -(6.2.14 masters Statement Definition and Usage) +(6.2.13 masters Statement Grammar) endobj 337 0 obj -<< /S /GoTo /D (subsection.6.2.15) >> +<< /S /GoTo /D (subsection.6.2.14) >> endobj 340 0 obj -(6.2.15 options Statement Grammar) +(6.2.14 masters Statement Definition and Usage) endobj 341 0 obj -<< /S /GoTo /D (subsection.6.2.16) >> +<< /S /GoTo /D (subsection.6.2.15) >> endobj 344 0 obj -(6.2.16 options Statement Definition and Usage) +(6.2.15 options Statement Grammar) endobj 345 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.1) >> +<< /S /GoTo /D (subsection.6.2.16) >> endobj 348 0 obj -(6.2.16.1 Boolean Options) +(6.2.16 options Statement Definition and Usage) endobj 349 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.2) >> +<< /S /GoTo /D (subsubsection.6.2.16.1) >> endobj 352 0 obj -(6.2.16.2 Forwarding) +(6.2.16.1 Boolean Options) endobj 353 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.3) >> +<< /S /GoTo /D (subsubsection.6.2.16.2) >> endobj 356 0 obj -(6.2.16.3 Dual-stack Servers) +(6.2.16.2 Forwarding) endobj 357 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.4) >> +<< /S /GoTo /D (subsubsection.6.2.16.3) >> endobj 360 0 obj -(6.2.16.4 Access Control) +(6.2.16.3 Dual-stack Servers) endobj 361 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.5) >> +<< /S /GoTo /D (subsubsection.6.2.16.4) >> endobj 364 0 obj -(6.2.16.5 Interfaces) +(6.2.16.4 Access Control) endobj 365 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.6) >> +<< /S /GoTo /D (subsubsection.6.2.16.5) >> endobj 368 0 obj -(6.2.16.6 Query Address) +(6.2.16.5 Interfaces) endobj 369 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.7) >> +<< /S /GoTo /D (subsubsection.6.2.16.6) >> endobj 372 0 obj -(6.2.16.7 Zone Transfers) +(6.2.16.6 Query Address) endobj 373 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.8) >> +<< /S /GoTo /D (subsubsection.6.2.16.7) >> endobj 376 0 obj -(6.2.16.8 Bad UDP Port Lists) +(6.2.16.7 Zone Transfers) endobj 377 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.9) >> +<< /S /GoTo /D (subsubsection.6.2.16.8) >> endobj 380 0 obj -(6.2.16.9 Operating System Resource Limits) +(6.2.16.8 Bad UDP Port Lists) endobj 381 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.10) >> +<< /S /GoTo /D (subsubsection.6.2.16.9) >> endobj 384 0 obj -(6.2.16.10 Server Resource Limits) +(6.2.16.9 Operating System Resource Limits) endobj 385 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.11) >> +<< /S /GoTo /D (subsubsection.6.2.16.10) >> endobj 388 0 obj -(6.2.16.11 Periodic Task Intervals) +(6.2.16.10 Server Resource Limits) endobj 389 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.12) >> +<< /S /GoTo /D (subsubsection.6.2.16.11) >> endobj 392 0 obj -(6.2.16.12 Topology) +(6.2.16.11 Periodic Task Intervals) endobj 393 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.13) >> +<< /S /GoTo /D (subsubsection.6.2.16.12) >> endobj 396 0 obj -(6.2.16.13 The sortlist Statement) +(6.2.16.12 Topology) endobj 397 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.14) >> +<< /S /GoTo /D (subsubsection.6.2.16.13) >> endobj 400 0 obj -(6.2.16.14 RRset Ordering) +(6.2.16.13 The sortlist Statement) endobj 401 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.15) >> +<< /S /GoTo /D (subsubsection.6.2.16.14) >> endobj 404 0 obj -(6.2.16.15 Tuning) +(6.2.16.14 RRset Ordering) endobj 405 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.16) >> +<< /S /GoTo /D (subsubsection.6.2.16.15) >> endobj 408 0 obj -(6.2.16.16 Built-in server information zones) +(6.2.16.15 Tuning) endobj 409 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.17) >> +<< /S /GoTo /D (subsubsection.6.2.16.16) >> endobj 412 0 obj -(6.2.16.17 Built-in Empty Zones) +(6.2.16.16 Built-in server information zones) endobj 413 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.18) >> +<< /S /GoTo /D (subsubsection.6.2.16.17) >> endobj 416 0 obj -(6.2.16.18 The Statistics File) +(6.2.16.17 Built-in Empty Zones) endobj 417 0 obj -<< /S /GoTo /D (subsubsection.6.2.16.19) >> +<< /S /GoTo /D (subsubsection.6.2.16.18) >> endobj 420 0 obj -(6.2.16.19 Additional Section Caching) +(6.2.16.18 The Statistics File) endobj 421 0 obj -<< /S /GoTo /D (subsection.6.2.17) >> +<< /S /GoTo /D (subsubsection.6.2.16.19) >> endobj 424 0 obj -(6.2.17 server Statement Grammar) +(6.2.16.19 Additional Section Caching) endobj 425 0 obj -<< /S /GoTo /D (subsection.6.2.18) >> +<< /S /GoTo /D (subsection.6.2.17) >> endobj 428 0 obj -(6.2.18 server Statement Definition and Usage) +(6.2.17 server Statement Grammar) endobj 429 0 obj -<< /S /GoTo /D (subsection.6.2.19) >> +<< /S /GoTo /D (subsection.6.2.18) >> endobj 432 0 obj -(6.2.19 trusted-keys Statement Grammar) +(6.2.18 server Statement Definition and Usage) endobj 433 0 obj -<< /S /GoTo /D (subsection.6.2.20) >> +<< /S /GoTo /D (subsection.6.2.19) >> endobj 436 0 obj -(6.2.20 trusted-keys Statement Definition and Usage) +(6.2.19 trusted-keys Statement Grammar) endobj 437 0 obj -<< /S /GoTo /D (subsection.6.2.21) >> +<< /S /GoTo /D (subsection.6.2.20) >> endobj 440 0 obj -(6.2.21 view Statement Grammar) +(6.2.20 trusted-keys Statement Definition and Usage) endobj 441 0 obj -<< /S /GoTo /D (subsection.6.2.22) >> +<< /S /GoTo /D (subsection.6.2.21) >> endobj 444 0 obj -(6.2.22 view Statement Definition and Usage) +(6.2.21 view Statement Grammar) endobj 445 0 obj -<< /S /GoTo /D (subsection.6.2.23) >> +<< /S /GoTo /D (subsection.6.2.22) >> endobj 448 0 obj -(6.2.23 zone Statement Grammar) +(6.2.22 view Statement Definition and Usage) endobj 449 0 obj -<< /S /GoTo /D (subsection.6.2.24) >> +<< /S /GoTo /D (subsection.6.2.23) >> endobj 452 0 obj -(6.2.24 zone Statement Definition and Usage) +(6.2.23 zone Statement Grammar) endobj 453 0 obj -<< /S /GoTo /D (subsubsection.6.2.24.1) >> +<< /S /GoTo /D (subsection.6.2.24) >> endobj 456 0 obj -(6.2.24.1 Zone Types) +(6.2.24 zone Statement Definition and Usage) endobj 457 0 obj -<< /S /GoTo /D (subsubsection.6.2.24.2) >> +<< /S /GoTo /D (subsubsection.6.2.24.1) >> endobj 460 0 obj -(6.2.24.2 Class) +(6.2.24.1 Zone Types) endobj 461 0 obj -<< /S /GoTo /D (subsubsection.6.2.24.3) >> +<< /S /GoTo /D (subsubsection.6.2.24.2) >> endobj 464 0 obj -(6.2.24.3 Zone Options) +(6.2.24.2 Class) endobj 465 0 obj -<< /S /GoTo /D (subsubsection.6.2.24.4) >> +<< /S /GoTo /D (subsubsection.6.2.24.3) >> endobj 468 0 obj -(6.2.24.4 Dynamic Update Policies) +(6.2.24.3 Zone Options) endobj 469 0 obj -<< /S /GoTo /D (section.6.3) >> +<< /S /GoTo /D (subsubsection.6.2.24.4) >> endobj 472 0 obj -(6.3 Zone File) +(6.2.24.4 Dynamic Update Policies) endobj 473 0 obj -<< /S /GoTo /D (subsection.6.3.1) >> +<< /S /GoTo /D (section.6.3) >> endobj 476 0 obj -(6.3.1 Types of Resource Records and When to Use Them) +(6.3 Zone File) endobj 477 0 obj -<< /S /GoTo /D (subsubsection.6.3.1.1) >> +<< /S /GoTo /D (subsection.6.3.1) >> endobj 480 0 obj -(6.3.1.1 Resource Records) +(6.3.1 Types of Resource Records and When to Use Them) endobj 481 0 obj -<< /S /GoTo /D (subsubsection.6.3.1.2) >> +<< /S /GoTo /D (subsubsection.6.3.1.1) >> endobj 484 0 obj -(6.3.1.2 Textual expression of RRs) +(6.3.1.1 Resource Records) endobj 485 0 obj -<< /S /GoTo /D (subsection.6.3.2) >> +<< /S /GoTo /D (subsubsection.6.3.1.2) >> endobj 488 0 obj -(6.3.2 Discussion of MX Records) +(6.3.1.2 Textual expression of RRs) endobj 489 0 obj -<< /S /GoTo /D (subsection.6.3.3) >> +<< /S /GoTo /D (subsection.6.3.2) >> endobj 492 0 obj -(6.3.3 Setting TTLs) +(6.3.2 Discussion of MX Records) endobj 493 0 obj -<< /S /GoTo /D (subsection.6.3.4) >> +<< /S /GoTo /D (subsection.6.3.3) >> endobj 496 0 obj -(6.3.4 Inverse Mapping in IPv4) +(6.3.3 Setting TTLs) endobj 497 0 obj -<< /S /GoTo /D (subsection.6.3.5) >> +<< /S /GoTo /D (subsection.6.3.4) >> endobj 500 0 obj -(6.3.5 Other Zone File Directives) +(6.3.4 Inverse Mapping in IPv4) endobj 501 0 obj -<< /S /GoTo /D (subsubsection.6.3.5.1) >> +<< /S /GoTo /D (subsection.6.3.5) >> endobj 504 0 obj -(6.3.5.1 The \044ORIGIN Directive) +(6.3.5 Other Zone File Directives) endobj 505 0 obj -<< /S /GoTo /D (subsubsection.6.3.5.2) >> +<< /S /GoTo /D (subsubsection.6.3.5.1) >> endobj 508 0 obj -(6.3.5.2 The \044INCLUDE Directive) +(6.3.5.1 The \044ORIGIN Directive) endobj 509 0 obj -<< /S /GoTo /D (subsubsection.6.3.5.3) >> +<< /S /GoTo /D (subsubsection.6.3.5.2) >> endobj 512 0 obj -(6.3.5.3 The \044TTL Directive) +(6.3.5.2 The \044INCLUDE Directive) endobj 513 0 obj -<< /S /GoTo /D (subsection.6.3.6) >> +<< /S /GoTo /D (subsubsection.6.3.5.3) >> endobj 516 0 obj -(6.3.6 BIND Master File Extension: the \044GENERATE Directive) +(6.3.5.3 The \044TTL Directive) endobj 517 0 obj -<< /S /GoTo /D (subsection.6.3.7) >> +<< /S /GoTo /D (subsection.6.3.6) >> endobj 520 0 obj -(6.3.7 Additional File Formats) +(6.3.6 BIND Master File Extension: the \044GENERATE Directive) endobj 521 0 obj -<< /S /GoTo /D (chapter.7) >> +<< /S /GoTo /D (subsection.6.3.7) >> endobj 524 0 obj -(7 BIND 9 Security Considerations) +(6.3.7 Additional File Formats) endobj 525 0 obj -<< /S /GoTo /D (section.7.1) >> +<< /S /GoTo /D (chapter.7) >> endobj 528 0 obj -(7.1 Access Control Lists) +(7 BIND 9 Security Considerations) endobj 529 0 obj -<< /S /GoTo /D (section.7.2) >> +<< /S /GoTo /D (section.7.1) >> endobj 532 0 obj -(7.2 chroot and setuid) +(7.1 Access Control Lists) endobj 533 0 obj -<< /S /GoTo /D (subsection.7.2.1) >> +<< /S /GoTo /D (section.7.2) >> endobj 536 0 obj -(7.2.1 The chroot Environment) +(7.2 Chroot and Setuid) endobj 537 0 obj -<< /S /GoTo /D (subsection.7.2.2) >> +<< /S /GoTo /D (subsection.7.2.1) >> endobj 540 0 obj -(7.2.2 Using the setuid Function) +(7.2.1 The chroot Environment) endobj 541 0 obj -<< /S /GoTo /D (section.7.3) >> +<< /S /GoTo /D (subsection.7.2.2) >> endobj 544 0 obj -(7.3 Dynamic Update Security) +(7.2.2 Using the setuid Function) endobj 545 0 obj -<< /S /GoTo /D (chapter.8) >> +<< /S /GoTo /D (section.7.3) >> endobj 548 0 obj -(8 Troubleshooting) +(7.3 Dynamic Update Security) endobj 549 0 obj -<< /S /GoTo /D (section.8.1) >> +<< /S /GoTo /D (chapter.8) >> endobj 552 0 obj -(8.1 Common Problems) +(8 Troubleshooting) endobj 553 0 obj -<< /S /GoTo /D (subsection.8.1.1) >> +<< /S /GoTo /D (section.8.1) >> endobj 556 0 obj -(8.1.1 It's not working; how can I figure out what's wrong?) +(8.1 Common Problems) endobj 557 0 obj -<< /S /GoTo /D (section.8.2) >> +<< /S /GoTo /D (subsection.8.1.1) >> endobj 560 0 obj -(8.2 Incrementing and Changing the Serial Number) +(8.1.1 It's not working; how can I figure out what's wrong?) endobj 561 0 obj -<< /S /GoTo /D (section.8.3) >> +<< /S /GoTo /D (section.8.2) >> endobj 564 0 obj -(8.3 Where Can I Get Help?) +(8.2 Incrementing and Changing the Serial Number) endobj 565 0 obj -<< /S /GoTo /D (appendix.A) >> +<< /S /GoTo /D (section.8.3) >> endobj 568 0 obj -(A Appendices) +(8.3 Where Can I Get Help?) endobj 569 0 obj -<< /S /GoTo /D (section.A.1) >> +<< /S /GoTo /D (appendix.A) >> endobj 572 0 obj -(A.1 Acknowledgments) +(A Appendices) endobj 573 0 obj -<< /S /GoTo /D (subsection.A.1.1) >> +<< /S /GoTo /D (section.A.1) >> endobj 576 0 obj -(A.1.1 A Brief History of the DNS and BIND) +(A.1 Acknowledgments) endobj 577 0 obj -<< /S /GoTo /D (section.A.2) >> +<< /S /GoTo /D (subsection.A.1.1) >> endobj 580 0 obj -(A.2 General DNS Reference Information) +(A.1.1 A Brief History of the DNS and BIND) endobj 581 0 obj -<< /S /GoTo /D (subsection.A.2.1) >> +<< /S /GoTo /D (section.A.2) >> endobj 584 0 obj -(A.2.1 IPv6 addresses \(AAAA\)) +(A.2 General DNS Reference Information) endobj 585 0 obj -<< /S /GoTo /D (section.A.3) >> +<< /S /GoTo /D (subsection.A.2.1) >> endobj 588 0 obj -(A.3 Bibliography \(and Suggested Reading\)) +(A.2.1 IPv6 addresses \(AAAA\)) endobj 589 0 obj -<< /S /GoTo /D (subsection.A.3.1) >> +<< /S /GoTo /D (section.A.3) >> endobj 592 0 obj -(A.3.1 Request for Comments \(RFCs\)) +(A.3 Bibliography \(and Suggested Reading\)) endobj 593 0 obj -<< /S /GoTo /D (subsection.A.3.2) >> +<< /S /GoTo /D (subsection.A.3.1) >> endobj 596 0 obj -(A.3.2 Internet Drafts) +(A.3.1 Request for Comments \(RFCs\)) endobj 597 0 obj -<< /S /GoTo /D (subsection.A.3.3) >> +<< /S /GoTo /D (subsection.A.3.2) >> endobj 600 0 obj -(A.3.3 Other Documents About BIND) +(A.3.2 Internet Drafts) endobj 601 0 obj -<< /S /GoTo /D (appendix.B) >> +<< /S /GoTo /D (subsection.A.3.3) >> endobj 604 0 obj -(B Manual pages) +(A.3.3 Other Documents About BIND) endobj 605 0 obj -<< /S /GoTo /D (section.B.1) >> +<< /S /GoTo /D (appendix.B) >> endobj 608 0 obj -(B.1 dig) +(B Manual pages) endobj 609 0 obj -<< /S /GoTo /D (section.B.2) >> +<< /S /GoTo /D (section.B.1) >> endobj 612 0 obj -(B.2 host) +(B.1 dig) endobj 613 0 obj -<< /S /GoTo /D (section.B.3) >> +<< /S /GoTo /D (section.B.2) >> endobj 616 0 obj -(B.3 dnssec-keygen) +(B.2 host) endobj 617 0 obj -<< /S /GoTo /D (section.B.4) >> +<< /S /GoTo /D (section.B.3) >> endobj 620 0 obj -(B.4 dnssec-signzone) +(B.3 dnssec-keygen) endobj 621 0 obj -<< /S /GoTo /D (section.B.5) >> +<< /S /GoTo /D (section.B.4) >> endobj 624 0 obj -(B.5 named-checkconf) +(B.4 dnssec-signzone) endobj 625 0 obj -<< /S /GoTo /D (section.B.6) >> +<< /S /GoTo /D (section.B.5) >> endobj 628 0 obj -(B.6 named-checkzone) +(B.5 named-checkconf) endobj 629 0 obj -<< /S /GoTo /D (section.B.7) >> +<< /S /GoTo /D (section.B.6) >> endobj 632 0 obj -(B.7 named) +(B.6 named-checkzone) endobj 633 0 obj -<< /S /GoTo /D (section.B.8) >> +<< /S /GoTo /D (section.B.7) >> endobj 636 0 obj -(B.8 rndc) +(B.7 named) endobj 637 0 obj -<< /S /GoTo /D (section.B.9) >> +<< /S /GoTo /D (section.B.8) >> endobj 640 0 obj -(B.9 rndc.conf) +(B.8 rndc) endobj 641 0 obj -<< /S /GoTo /D (section.B.10) >> +<< /S /GoTo /D (section.B.9) >> endobj 644 0 obj -(B.10 rndc-confgen) +(B.9 rndc.conf) endobj 645 0 obj -<< /S /GoTo /D [646 0 R /FitH ] >> +<< /S /GoTo /D (section.B.10) >> +endobj +648 0 obj +(B.10 rndc-confgen) endobj -649 0 obj << +649 0 obj +<< /S /GoTo /D [650 0 R /FitH ] >> +endobj +653 0 obj << /Length 236 /Filter /FlateDecode >> stream xÚÁJA †ïó9¶‡M'™d2s´T¥‚Beoâai·Rp·tïïÔÕ*êArÉÿ‘ü /A}ȖՓºs žŠvíèƒ
¨B)þP+!ÃlQ¡bJÕÂwìNì1úÈP©)&>áóÚÍ®˜€-A½bEM¦pæêÍÃd¾¼[L+V?ÉcºØt»~÷r šã~[÷í¶ Ú~ÝN ë a¤(±ø˘’å÷9·MÿÚ<Ÿ endobj -646 0 obj << +650 0 obj << /Type /Page -/Contents 649 0 R -/Resources 648 0 R +/Contents 653 0 R +/Resources 652 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 655 0 R +/Parent 659 0 R >> endobj -647 0 obj << +651 0 obj << /Type /XObject /Subtype /Form /FormType 1 /PTEX.FileName (./isc-logo.pdf) /PTEX.PageNumber 1 -/PTEX.InfoDict 656 0 R +/PTEX.InfoDict 660 0 R /Matrix [1.00000000 0.00000000 0.00000000 1.00000000 0.00000000 0.00000000] /BBox [0.00000000 0.00000000 255.00000000 149.00000000] /Resources << /ProcSet [ /PDF /Text ] /ColorSpace << -/R15 657 0 R -/R9 658 0 R -/R11 659 0 R -/R13 660 0 R +/R15 661 0 R +/R9 662 0 R +/R11 663 0 R +/R13 664 0 R >>/ExtGState << -/R17 661 0 R -/R8 662 0 R ->>/Font << /R19 663 0 R >> +/R17 665 0 R +/R8 666 0 R +>>/Font << /R19 667 0 R >> >> -/Length 664 0 R +/Length 668 0 R /Filter /FlateDecode >> stream @@ -1013,7 +1019,7 @@ xœu˜;“d9…ýû+®Ùe´R©— lG`XËkz#†10gwÙ~6ßÉ[53}+ˆ}tI%åóäÉT½ßs*{Ö?·¿××í'¿ûŸ? FÑÞIcaÇ0Ú) ¹A¿+ÇÀº
¸|-Tuùa>‚s:½¯•~K“ÒÞV׋„OÒAŠI…
ɪÁr2Q“°Ø¨Á>.z ÏÆ狼eÇNdæÌdï "gK2cëÉ—GoOá8Gë ÏϦ:B
Àht[ endobj -656 0 obj +660 0 obj << /Producer (AFPL Ghostscript 8.51) /CreationDate (D:20050606145621) @@ -1023,46 +1029,46 @@ endobj /Author (Douglas E. Appelt) >> endobj -657 0 obj -[/Separation/PANTONE#201805#20C/DeviceCMYK 665 0 R] +661 0 obj +[/Separation/PANTONE#201805#20C/DeviceCMYK 669 0 R] endobj -658 0 obj -[/Separation/PANTONE#207506#20C/DeviceCMYK 666 0 R] +662 0 obj +[/Separation/PANTONE#207506#20C/DeviceCMYK 670 0 R] endobj -659 0 obj -[/Separation/PANTONE#20301#20C/DeviceCMYK 667 0 R] +663 0 obj +[/Separation/PANTONE#20301#20C/DeviceCMYK 671 0 R] endobj -660 0 obj -[/Separation/PANTONE#20871#20C/DeviceCMYK 668 0 R] +664 0 obj +[/Separation/PANTONE#20871#20C/DeviceCMYK 672 0 R] endobj -661 0 obj +665 0 obj << /Type /ExtGState /SA true >> endobj -662 0 obj +666 0 obj << /Type /ExtGState /OPM 1 >> endobj -663 0 obj +667 0 obj << /BaseFont /NVXWCK#2BTrajanPro-Bold -/FontDescriptor 669 0 R +/FontDescriptor 673 0 R /Type /Font /FirstChar 67 /LastChar 136 /Widths [ 800 0 0 0 0 0 452 0 0 0 0 0 0 0 0 0 582 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 841 633 576 686 590 540 923 827 407 760] -/Encoding 670 0 R +/Encoding 674 0 R /Subtype /Type1 >> endobj -664 0 obj +668 0 obj 2362 endobj -665 0 obj +669 0 obj << /Filter /FlateDecode /FunctionType 4 @@ -1073,7 +1079,7 @@ endobj stream xœ«N)-P0PÈ-ÍQHHÎP endobj -666 0 obj +670 0 obj << /Filter /FlateDecode /FunctionType 4 @@ -1084,7 +1090,7 @@ endobj stream xœ«N)-P0PÈ-ÍQHHÎP endobj -667 0 obj +671 0 obj << /Filter /FlateDecode /FunctionType 4 @@ -1095,7 +1101,7 @@ endobj stream xœ«N)-P0TÈ-ÍQHHÎP endobj -668 0 obj +672 0 obj << /Filter /FlateDecode /FunctionType 4 @@ -1106,7 +1112,7 @@ endobj stream xœ«N)-P0Ð365³TÈ-ÍQHHÎP€Š™X ‹™›#Ä ô -,ŒÀüZ endobj -669 0 obj +673 0 obj << /Type /FontDescriptor /FontName /NVXWCK#2BTrajanPro-Bold @@ -1119,17 +1125,17 @@ endobj /StemV 138 /MissingWidth 500 /CharSet (/Msmall/C/Ysmall/Nsmall/Osmall/Esmall/Rsmall/S/Ssmall/I/Tsmall/Ismall/Usmall) -/FontFile3 671 0 R +/FontFile3 675 0 R >> endobj -670 0 obj +674 0 obj << /Type /Encoding /BaseEncoding /WinAnsiEncoding /Differences [ 127/Nsmall/Tsmall/Esmall/Rsmall/Ysmall/Ssmall/Msmall/Osmall/Ismall/Usmall] >> endobj -671 0 obj +675 0 obj << /Filter /FlateDecode /Subtype /Type1C @@ -1152,18 +1158,18 @@ x¸
\3§gA34 –ITž-‹R8õ-ǵÛö2ªWuÉ~Á!"(0Š*FÂ͢ùĨ¸SˆˆoÊQPˆ0 ¦šåiFäݸVN^_!Ô‚–b ȼLçÇ<;— * X³«¥×ÛG â_Y1ETïƒ4ˆÒ-U…_>´üØ¢æ}õï÷v¼
§ádù#¹rÛŸå¥@ÔÁ\5l …hð<8Ús· »O·Øèv61Bá5*È<6ÞÍ,‡bh‘˜¶ž\Î]Çé#¹#ØÔÍ1Oúñ°Ï¤5oÂ]цÆß4}h˜î0$å,6ü¼”A,¯?/å;Rôcy 6Ò½UJ¿§Y½X^é¶ÙÉŸ‡‹º–2¸K|o½Ø”/Ȩ/ƒ( Â2Ð#žNMKðrˆ
rœÛf9ËyZ¸Ú}$«Ö õ–©) h`iÎGàAç ÷´€H+Šˆ…Õ&*áX$žèìVŽhª”—›¾÷‡A1Ý£¤œÏ0‰÷—Hi éƒw~I(Áö2;à]¸L ™x4[¡OÜ,¾®ÆûÂQQ°”FdQ“ƒ¢¬„%\î¢Åâ:Ó;ÈÑ”ÌEb1ž’¡ˆÿ§=$¸¥?Iš¿CÐõ3¾C=VÐ'>·¯ôÌÒ+Ü~8 ç#;úÁ_£×á*qň+ô 8®‚ãÆpêŒ_YR”¾d%a ç¡H\eÄõãDf£Ñ ¨ŽR[kφG¸ù/WT®ò•A5”H¥ÛVoo8hnû)¼Þ ÃDn…ñëqÌz fåhý&þcQbµXÇß‚çLŽúõ;{²Ðñðué¿ÊÛÙ†-©[SÄ-Û¼Ô yubÜñhüm´œ 4^Ë™ ääšLÿQ‹¡endstream endobj -650 0 obj << -/D [646 0 R /XYZ 85.0394 794.5015 null] +654 0 obj << +/D [650 0 R /XYZ 85.0394 794.5015 null] >> endobj -651 0 obj << -/D [646 0 R /XYZ 85.0394 769.5949 null] +655 0 obj << +/D [650 0 R /XYZ 85.0394 769.5949 null] >> endobj -648 0 obj << -/Font << /F21 654 0 R >> -/XObject << /Im1 647 0 R >> +652 0 obj << +/Font << /F21 658 0 R >> +/XObject << /Im1 651 0 R >> /ProcSet [ /PDF /Text ] >> endobj -674 0 obj << +678 0 obj << /Length 994 /Filter /FlateDecode >> @@ -1173,1577 +1179,1619 @@ Qm]»ÀÒíÏ¡[ ?NùËk5ú~Õ Œ,Ìr À¦v|™ý*Ô˜"ËäV£ŠÂýí´›•"("6 Š±þ0SצњfkZÂòUv:d ±žËLÖ³yG„¡Üï‹m¾ëœ¬[aló²:åÏçJX½æršÊ›âwÅIýûCÇóéX”ÒýžW¯ÂR¸ú¤8K1w™ÄA‚ºëpßAÜ0hSÚk&ò=Ëø/§54d+I gñ'ßf[Åv])KF_?²V1eÍöPTù&ëÕßÖ{ìÉÚ ÙZ•Kÿúí©ƒpšTß„ëJ wž•ÍÀàbŽ˜Îêb-ĵH:÷ä˜EÓôiÄéЉ剟ˆuGßý‰7»úæ:‰BÔ;a;áD ºÂ˜€8þB‚ †Ì;aê{Òùä§saÅÞ̉'âJÂó•‘nIi~$ é\Q¼C>tƒÕÄg½äþbøª–{L¢©X^ìÎÁ1²ô¡óè~ú£-´fg"®Û–bGvS?
½$AŠƒXCÉ×ûîA<AxÞ2Rz=Jêï<ÒžF±Ê*Ó'KÏõàAi {nÃQ=mÛ#Ñ ½YàϼÐõº™¢&ró°Ðµ é¶\ d<b ’ëœ2²ûÉE‹h•v©D=Ú@-ô®(·WãrWA NkëË —^ ópÚz¦ŸÝš›7‰úôbª¿ˆî~x©|ýá5VÙƺ…˜mÓûo"jÃËbRÍ{õ†8Ì9e&½Ãü_®…dµendstream endobj -673 0 obj << +677 0 obj << /Type /Page -/Contents 674 0 R -/Resources 672 0 R +/Contents 678 0 R +/Resources 676 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 655 0 R +/Parent 659 0 R >> endobj -675 0 obj << -/D [673 0 R /XYZ 56.6929 794.5015 null] +679 0 obj << +/D [677 0 R /XYZ 56.6929 794.5015 null] >> endobj -672 0 obj << -/Font << /F23 678 0 R /F14 681 0 R >> +676 0 obj << +/Font << /F23 682 0 R /F14 685 0 R >> /ProcSet [ /PDF /Text ] >> endobj -684 0 obj << -/Length 2884 -/Filter /FlateDecode ->> -stream -xÚí]wÛ¸†ïó+tWûB(¾ ^:Ž“u·ÉæÄÎé×ö‚GflõX¤KQÞº¿¾ €# œÍ&»±tra9Òp&ó>ÀPa3jÿ°™Q„Š\β\E™š-V/èìÚ¾÷æsŸ‘J%…°¿DÞ+aˆ2<›ÍáE^^¾øãkÎf\’Ìdlvùiô¥8á\ä³Ë« ÖU[VíúøŸ—ê
r’k®»ÏÓÙ\s"0ý'ÙñœQJΫ¶©¯6‹vYWÕ‹³ËŒ‚hÊäL›œd’².”áÍæz6¼ø°»ûü øØÇPv¯ÛE”íºw©€WC¶ëT -ËLƒ uÎ8'&Ϭsž.¯Yd_µp›+þ@ÂëMuUtCDqÛFì]òDL|&“1†&P)“H&¨ó–¦¨˜pI?’¸É¤¨®âã‹}_hù,©˜ÄÁg,`ˆá -P £ -jŠ×uóKÑï°_õ¬Èïdó
&” Ï^2ÀccK „H ¨÷qøà”-ÇJC»á#¶Þ -9>¹Éä -€°'u^-Æ6N÷(eXRУ¦¨ÖŸBûi÷xþù__žÏ×yöœÁ™DÅg3`ˆ¡ÕâÓM¨±80TPï;Þ¨ÜøŠÈw©\ÜÝ.[X*}¨…¾æpäeHf bŒA™1Æ"q`Œ¡ÞcŒ›½Ü1æû_./Îß Ïí‡Åö7[÷)’9†gPj>}®‹ã õ j&–")ó5“ -5Ó›²ê^üþøë w‹á ˇǛígÅÂí¯¿/–Íö—`ýP¯ÛþY?ý}õØ…ì¤j
í·²h ‹Ñ ÷ öO™ÑDP¡FíÃŽúɦWEØPw0 _n¦÷äÆéI bâÃôcâGâÀÄG½âgv…DâûÍó·Eµñµ.T>3j¯Fþ¢d -ad7‚ DÂ4ç91±¯$ï†C×”8v±.&º^Í7*gîCÃÐÓdø+yoÿ)X¯öendstream +688 0 obj << +/Length 2891 +/Filter /FlateDecode +>> +stream +xÚíMsÛȆïþ¼E:p2ß +–˜•U~}Àô )ÚB¼k¯E–¢$6ºÝž™%fÜý³Ô0®2=K2Í f¶X½à³k÷»7/„6Š”û&òÛ¹Q)3©Lfs|‘——/þøZŠ™Ô,I1»ü4ø2’I©²ÙåÕ?ŽN«²)Êf}üÏË?uˬ´íûùln%Ó©J»wŠã¹àœ —M]]mͲ*[«g—!£³\è™M3–h.ÚPú_Ö׳þŇØýûçØ +W±ïëå*¯ úoÞæ®x]Δܫ!$j2È¢ +¤§àâ6¿<™îÏLñ9. u“¹@†X‚‹H¤ó c™5™B\(à¢)òÛææ–g‡"dm2ÈB«B ƒB‚t>ÔZ3cÅPC_Cœæ‹›ey=Z=¨Tì]±ùX™2+¹’øDBÀnŽ
#„ì\¿‰#‰ƒB„ô>ŒJ2måPS˜PS¼®êÿäÝûUÇŠþN0_aB ÚAö&³ )6¶Ô!؈ÄA±Az †É™²z¨4¬ >bë
´“þvsÛ,ïný[>T·íò7Sö™®=‚X®É0 C +†-9"qP0ìxLJÇp%ÊMhséO³_ž¿{åE.ÖÕ¦^€äÅ¿7˺XÁÙx4]ኟ9åi‘Sîëvi£i—#Ò³ë5v¸ ]ž¬Rý .Ã1÷~üôã¨OOÿºMQ÷¢OÓ<U‡Í òþ +9žzaCâþÚÒ'é= +5ž't9*?;^£·w÷O“>?Cßk¾ + ãGyiKnSñSî,Hîä; Rw"&Eé=l»¨Œ3-¸tBûщç¦ß¼WåíC|×åÝf{EDÈÙT"°!AÄ–&±8"hïIÊ”û.F'~Çm«'€Ãhõlú™ƒ8žÉâ#CJ|œ~JüH ”ø¤w˜H\éΤ𜨰1ðç*÷¥ØËü6/])–Jsè-úR˜ ß“aB†LXO¡ÇaŠÄAÁDz0Í„0P•(r™çkü®2ÑÏç‘œßh‚ÌNÆRØ`å(l"qPØÞ‡ HKÆE%‰ +%Éåq&ªêÖŸ +¥ ï±D™*ÆÓ¬ŸÚ´ßH<¹ºwkØl »*òfSã=ábOÝBÄÄâVb¼_ŽÈÌ®×X±.βLôC¼[ˆïªfùÉïݺGÏ“|ëeacê=ˆ
‰{pKlŠ°H i¤÷@šIÝ°®<h°Åðê¡ÌWPØ}¼»Ê7§‰9@ôCäó<™¡ÁŽB©H´å:”R[–d:‚†õ!,øþUmjWÀƒÔ\¶§ 雧qé 2¤ÈÁòQèDâ Ø!½‡ÁGif3ë €°'u^.†6 +2¤PÁjÉñ&ÔX *¤÷€ŠoL–BE]*w·Ë—Š©=ÔB¿åp2Lf RŒa™)Æ"qPŒ‘Þ‡¹LpæÒ—da.;û Þ¯ 3×þ¬h6wm‰¤öHßd8!–‡‚#é ‘¥Lsu4G]^œ¿9ž»7 Vb_mS$H1•3lHp¶%µ ?ôÅApF{ƒH-S\ +øƒÿÝÙ/ËuS”탙‰0ß™æ•Éš#CJsœuJóH ”æ¤÷AsiX +M…æ:h¾nêãô¨ýèá·oðÐkƒh—#öùlk…lMfR,`5("qP,Þ„b‰Ðø˜Ž~]í»=Ãמ,Åz ž%húg°º +ÁîGÓ äm2ƒ ÅR…Bb7ŠÊõ +RDaYåxÏN,Š)Ò;ì]¥3"ÃÂÖÕgk›uÔaëê«m‘‚S)CvdXg‚±Hb¤k ,I˜†–D·œ…Ó™ó7íÉ ïå4ψ}µ
™J²#HÃz¤E‚ þ åzø”¦¤ð ¥Ð¯òîââìÔ-töã)˜o•OþT¦3)$¬´Äßx ÁPáïþÌeÆÒØ'·ªïAœ+·üR#M.ŠgÎ×3ÿ¦þçñç/àJàí”s®Aendstream endobj -683 0 obj << +687 0 obj << /Type /Page -/Contents 684 0 R -/Resources 682 0 R +/Contents 688 0 R +/Resources 686 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 655 0 R -/Annots [ 687 0 R 688 0 R 689 0 R 690 0 R 691 0 R 692 0 R 693 0 R 694 0 R 695 0 R 696 0 R 697 0 R 698 0 R 699 0 R 700 0 R 701 0 R 702 0 R 703 0 R 704 0 R 705 0 R 706 0 R 707 0 R 708 0 R 709 0 R 710 0 R 711 0 R 712 0 R 713 0 R 714 0 R 715 0 R 716 0 R 717 0 R 718 0 R 719 0 R 720 0 R 721 0 R 722 0 R 723 0 R 724 0 R 725 0 R 726 0 R 727 0 R 728 0 R 729 0 R 730 0 R 731 0 R 732 0 R 733 0 R 734 0 R 735 0 R 736 0 R ] +/Parent 659 0 R +/Annots [ 691 0 R 692 0 R 693 0 R 694 0 R 695 0 R 696 0 R 697 0 R 698 0 R 699 0 R 700 0 R 701 0 R 702 0 R 703 0 R 704 0 R 705 0 R 706 0 R 707 0 R 708 0 R 709 0 R 710 0 R 711 0 R 712 0 R 713 0 R 714 0 R 715 0 R 716 0 R 717 0 R 718 0 R 719 0 R 720 0 R 721 0 R 722 0 R 723 0 R 724 0 R 725 0 R 726 0 R 727 0 R 728 0 R 729 0 R 730 0 R 731 0 R 732 0 R 733 0 R 734 0 R 735 0 R 736 0 R 737 0 R 738 0 R 739 0 R 740 0 R ] >> endobj -687 0 obj << +691 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 688.709 539.579 697.2967] /Subtype /Link /A << /S /GoTo /D (chapter.1) >> >> endobj -688 0 obj << +692 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 676.5858 539.579 685.4425] /Subtype /Link /A << /S /GoTo /D (section.1.1) >> >> endobj -689 0 obj << +693 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 664.4876 539.579 673.3442] /Subtype /Link /A << /S /GoTo /D (section.1.2) >> >> endobj -690 0 obj << +694 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 652.3894 539.579 661.246] /Subtype /Link /A << /S /GoTo /D (section.1.3) >> >> endobj -691 0 obj << +695 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 640.1914 539.579 649.1477] /Subtype /Link /A << /S /GoTo /D (section.1.4) >> >> endobj -692 0 obj << +696 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 628.0932 539.579 637.0495] /Subtype /Link /A << /S /GoTo /D (subsection.1.4.1) >> >> endobj -693 0 obj << +697 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 615.995 539.579 624.9512] /Subtype /Link /A << /S /GoTo /D (subsection.1.4.2) >> >> endobj -694 0 obj << +698 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 603.8967 539.579 612.853] /Subtype /Link /A << /S /GoTo /D (subsection.1.4.3) >> >> endobj -695 0 obj << +699 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 591.7985 539.579 600.7547] /Subtype /Link /A << /S /GoTo /D (subsection.1.4.4) >> >> endobj -696 0 obj << +700 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 579.7002 539.579 588.6565] /Subtype /Link /A << /S /GoTo /D (subsubsection.1.4.4.1) >> >> endobj -697 0 obj << +701 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 567.6019 539.579 576.5582] /Subtype /Link /A << /S /GoTo /D (subsubsection.1.4.4.2) >> >> endobj -698 0 obj << +702 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [532.6051 555.5037 539.579 564.46] /Subtype /Link /A << /S /GoTo /D (subsubsection.1.4.4.3) >> >> endobj -699 0 obj << +703 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 543.4055 539.579 552.5112] /Subtype /Link /A << /S /GoTo /D (subsection.1.4.5) >> >> endobj -700 0 obj << +704 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 531.3072 539.579 540.413] /Subtype /Link /A << /S /GoTo /D (subsubsection.1.4.5.1) >> >> endobj -701 0 obj << +705 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 519.209 539.579 528.3147] /Subtype /Link /A << /S /GoTo /D (subsection.1.4.6) >> >> endobj -702 0 obj << +706 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 496.7003 539.579 505.4125] /Subtype /Link /A << /S /GoTo /D (chapter.2) >> >> endobj -703 0 obj << +707 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 484.5772 539.579 493.5832] /Subtype /Link /A << /S /GoTo /D (section.2.1) >> >> endobj -704 0 obj << +708 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 472.4789 539.579 481.485] /Subtype /Link /A << /S /GoTo /D (section.2.2) >> >> endobj -705 0 obj << +709 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 460.3806 539.579 469.3867] /Subtype /Link /A << /S /GoTo /D (section.2.3) >> >> endobj -706 0 obj << +710 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 448.2824 539.579 457.2885] /Subtype /Link /A << /S /GoTo /D (section.2.4) >> >> endobj -707 0 obj << +711 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 436.1841 539.579 445.1902] /Subtype /Link /A << /S /GoTo /D (section.2.5) >> >> endobj -708 0 obj << +712 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 413.4314 539.579 422.288] /Subtype /Link /A << /S /GoTo /D (chapter.3) >> >> endobj -709 0 obj << +713 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 401.353 539.579 410.4588] /Subtype /Link /A << /S /GoTo /D (section.3.1) >> >> endobj -710 0 obj << +714 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 389.2548 539.579 398.3605] /Subtype /Link /A << /S /GoTo /D (subsection.3.1.1) >> >> endobj -711 0 obj << +715 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 377.1565 539.579 386.2623] /Subtype /Link /A << /S /GoTo /D (subsection.3.1.2) >> >> endobj -712 0 obj << +716 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 365.1579 539.579 374.164] /Subtype /Link /A << /S /GoTo /D (section.3.2) >> >> endobj -713 0 obj << +717 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 353.0597 539.579 362.0658] /Subtype /Link /A << /S /GoTo /D (section.3.3) >> >> endobj -714 0 obj << +718 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 340.9614 539.579 349.9675] /Subtype /Link /A << /S /GoTo /D (subsection.3.3.1) >> >> endobj -715 0 obj << +719 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 328.7635 539.579 337.8693] /Subtype /Link /A << /S /GoTo /D (subsubsection.3.3.1.1) >> >> endobj -716 0 obj << +720 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 316.6653 539.579 325.771] /Subtype /Link /A << /S /GoTo /D (subsubsection.3.3.1.2) >> >> endobj -717 0 obj << +721 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 304.567 539.579 313.6728] /Subtype /Link /A << /S /GoTo /D (subsection.3.3.2) >> >> endobj -718 0 obj << +722 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 281.9139 539.579 290.7706] /Subtype /Link /A << /S /GoTo /D (chapter.4) >> >> endobj -719 0 obj << +723 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 269.8356 539.579 278.9413] /Subtype /Link /A << /S /GoTo /D (section.4.1) >> >> endobj -720 0 obj << +724 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 257.7373 539.579 266.8431] /Subtype /Link /A << /S /GoTo /D (section.4.2) >> >> endobj -721 0 obj << +725 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 245.6391 539.579 254.7448] /Subtype /Link /A << /S /GoTo /D (subsection.4.2.1) >> >> endobj -722 0 obj << +726 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 233.5408 539.579 242.4971] /Subtype /Link /A << /S /GoTo /D (section.4.3) >> >> endobj -723 0 obj << +727 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 221.4426 539.579 230.3988] /Subtype /Link /A << /S /GoTo /D (section.4.4) >> >> endobj -724 0 obj << +728 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 209.3443 539.579 218.3006] /Subtype /Link -/A << /S /GoTo /D (section.4.5) >> +/A << /S /GoTo /D (subsection.4.4.1) >> >> endobj -725 0 obj << +729 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 197.2461 539.579 206.2023] /Subtype /Link -/A << /S /GoTo /D (subsection.4.5.1) >> +/A << /S /GoTo /D (section.4.5) >> >> endobj -726 0 obj << +730 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 185.1478 539.579 194.1041] /Subtype /Link -/A << /S /GoTo /D (subsubsection.4.5.1.1) >> +/A << /S /GoTo /D (subsection.4.5.1) >> >> endobj -727 0 obj << +731 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 173.1492 539.579 182.1553] +/Rect [527.6238 173.0496 539.579 182.0058] /Subtype /Link -/A << /S /GoTo /D (subsubsection.4.5.1.2) >> +/A << /S /GoTo /D (subsubsection.4.5.1.1) >> >> endobj -728 0 obj << +732 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 161.051 539.579 170.0571] /Subtype /Link -/A << /S /GoTo /D (subsection.4.5.2) >> +/A << /S /GoTo /D (subsubsection.4.5.1.2) >> >> endobj -729 0 obj << +733 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 148.9527 539.579 157.9588] /Subtype /Link -/A << /S /GoTo /D (subsection.4.5.3) >> +/A << /S /GoTo /D (subsection.4.5.2) >> >> endobj -730 0 obj << +734 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 136.8545 539.579 145.8606] /Subtype /Link -/A << /S /GoTo /D (subsection.4.5.4) >> +/A << /S /GoTo /D (subsection.4.5.3) >> >> endobj -731 0 obj << +735 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 124.7562 539.579 133.7623] /Subtype /Link -/A << /S /GoTo /D (subsection.4.5.5) >> +/A << /S /GoTo /D (subsection.4.5.4) >> >> endobj -732 0 obj << +736 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 112.5583 539.579 121.5146] +/Rect [527.6238 112.658 539.579 121.6641] /Subtype /Link -/A << /S /GoTo /D (subsection.4.5.6) >> +/A << /S /GoTo /D (subsection.4.5.5) >> >> endobj -733 0 obj << +737 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 100.4601 539.579 109.4163] /Subtype /Link -/A << /S /GoTo /D (section.4.6) >> +/A << /S /GoTo /D (subsection.4.5.6) >> >> endobj -734 0 obj << +738 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 88.3618 539.579 97.3181] /Subtype /Link -/A << /S /GoTo /D (section.4.7) >> +/A << /S /GoTo /D (section.4.6) >> >> endobj -735 0 obj << +739 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 76.2636 539.579 85.2199] /Subtype /Link -/A << /S /GoTo /D (section.4.8) >> +/A << /S /GoTo /D (section.4.7) >> >> endobj -736 0 obj << +740 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 64.1653 539.579 73.1216] /Subtype /Link -/A << /S /GoTo /D (subsection.4.8.1) >> +/A << /S /GoTo /D (section.4.8) >> >> endobj -685 0 obj << -/D [683 0 R /XYZ 85.0394 794.5015 null] +689 0 obj << +/D [687 0 R /XYZ 85.0394 794.5015 null] >> endobj -686 0 obj << -/D [683 0 R /XYZ 85.0394 711.9273 null] +690 0 obj << +/D [687 0 R /XYZ 85.0394 711.9273 null] >> endobj -682 0 obj << -/Font << /F21 654 0 R /F23 678 0 R >> +686 0 obj << +/Font << /F21 658 0 R /F23 682 0 R >> /ProcSet [ /PDF /Text ] >> endobj -739 0 obj << -/Length 3160 +743 0 obj << +/Length 3152 /Filter /FlateDecode >> stream -xÚí[wÛ¸Çßý)ôh?Åýò˜ëžìi“lâ¾t»ŒÌØ:‘DW’“z?}A‘ -0ÄHba¤$âÀHÙñžls%'V²SÝ·¹;MíPÁUëi³ä|®—õbRç3N~ïö`í- Z°|ÆÀé°LíxM~§%–ºN& ÛÛdj^OÃØâÕ¬ž×‹µ €(fµ^ÉòRZü͆Ø7 J†q’ˆãõÞZ5³Ä˜~"Ðã’/TþV'W¡S^µ¨hÃ5í TB:‹Q†*P.Áó¨$âÀPA½3®‰LŽ4ÕÄHX6¸ˆv>äv±®þ}6N §VïJHe1(ÀJ…’ˆõ AQ¾u1LZ -ïAyY·ýÐb:ôBÕâ"Ô½Õe;;ÿ3ŒôÄ,{ÌR)Ða`K„T ¸÷¾_Q–mÅЯð8Ë>oGý,jßj(kŽŠJHg1*ÀCÊ%D •D *¨÷¡¹0”håßDXŽýÊ JHe1(ÀJ…’ˆõ>€¢,ÑÌ -ý¢Ý`׶ͬí4Ž×=‰+ÆbX@a0,q`X Þ,´#V¹¾CuX¼YøösåÙ8kÊŽ—/¦ñ ,Æbx@T¾ IÅáz ðP†Xn¶ºÝáñÛMÝÞ¼hsC7xCaÌ‘Š˜·b*€!FÔEå¯SKÅQz ¨Š§¤ÂtTtw¡m¡8?sôtY-VŸ7ƒ -eØ‹˜¸b,€!†Ã"†ê}ÀBbôv bû¢´ -“ /ßwoÞÇ[Œö·\±\ ![Å, +xÚí[wÛÆÇßõ)ø(=p»÷Ë£¯9I[Û±Õ—¦y€)Xæ I¨$×ýô]ØݸjÛȵD&'‘la0£ùÿ¸³³X +
÷ÕÚ?«×{qõsq`¬ Þ+ÒM©Ž¬ðž•óëUeû¹î¾ù{³òߪOÄ Ä„¬ 1b j1™80bPÒÖEbDOÌ‹fõJùõí:ró¡^ÿ^¯Û1†‰cEe”‘ÇbF€!ÆÔ‰›qF2q`Œ Þ
óCŽöå‘ûª& ï!q êyøñÝïº'ãöæ¦Yo»?ÌWÝ×ç?¾yÙ}ç
gwù& +& ŒŸ{L¡ ¸ŒrrYÌ 0Ä8ZaœdâÀ8A½NŒl7`GLÔALæ«ÙâöªÎQ¢‰qìÐdÇ2~Tóäábx’ ÆÐOŒïˆÍ‘ƒ¹àh_“´NsýPä _¾õõü?x³FLe1"ÀcJ…A’‰£õ 0Q”:)s“ß꯹©¯/AΊƒ‹ö´ês^Ì0Äx‚šb<eâÀxB½ž„%‚¦QÇ>N‡G EŸ^'R[LM²Ã ÂaÌì!ƒ¹Äpωa w™Es}Ýî$Ë*ã‡<§ç(yT»
cŠ‹Ñ†;PB1~OG.Œ Ô{À‡I¸Ói)>?÷˜èüvYýa
wÈe1'Àãj…q’‰ãõ ¯2IÊ §ÆRÚ둶߶¼¦¾«–aÖ;û\VunÕÏrR)Ý ÷îóºÚx´àÇ5« é-†bð@ùÄø͹80xPï á<,´Sí +àñÉu³ÎÍt$%Úš;ðHjªBÅô–Â
xòI: +O. Ü{_¡„±„I *Ôá«U‹/ë:·ÐÇ}}Š°ŒMo¸ÒG|Ý3¦»%`ˆ¡å”ãÛzsq`(¡ÞJZ{z8(aüAP:<Ó‘Ì=¡Ñ'¤µ`ˆ!eÃÉÄ!ƒzÈ(I¨e<!søJÕ²ÚlÛûãóócéôÁþJ Wõ +9.æbü@
åøŽÏ\ ?¨÷Àä„J§?ò¡ø¹Oå ssYÌ 0Ä8ZaœdâÀ8A½ND;á…ÝÕáKUÍM+õ&ÁÁú³ ¼TÅŽkjr\Ì0ÄøbüdâÀøA½~˜!ÎjP§ôCñsŸ VòQ×£ËbN€!Æ ÔJŽoýËÅq‚zO8UÄ) *’ë8Ï›fQW½¨o{:¦J¸#¾ÚÓU 0Ä`€rÈñ+¹80Pïîqœ[C¿.óºY©º'¬ìn;—”Ÿn+²³WÊ4Dب£Æ—]rq làÞÖW [ Ý>¬eãåmµ˜n¶Õì·;Oßß-Kßbˆ©*b @)Ôxœ‹õž@ÐŽXåCv <›ÍâÐ/Ú
víxÑ,Ú¢qºï9%® `ˆa…Á°ÈÄazOX(C,7ƒÚ¡:,~\ùöSåÙ¸˜jÊN·/æñ ,Æbx@Ôx?’‹ÃõžðŠ§ÄCwxü|[·/Ú=Ð
>PAs¢"æ˜ +`ˆQuQã÷©åâÀ¨@½'*„ F»ÓQÑ=…¶…âòÂÑóuµÚ|ÚM*”a',b⊱ +‹ /ßuß¼‹í ¹b¹:.B¶ŠY +‡ëXx{3xÒù‡¯›m½LB»Ý•’Y|†Þr¾£CªÇµNP,/0Ää… VãK¹80yQïQ^æ ÑÚÉÁúõÅ?ö‘‡5L?ñÆ!樔 endobj -738 0 obj << +742 0 obj << /Type /Page -/Contents 739 0 R -/Resources 737 0 R +/Contents 743 0 R +/Resources 741 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 655 0 R -/Annots [ 744 0 R 745 0 R 746 0 R 747 0 R 748 0 R 749 0 R 750 0 R 751 0 R 752 0 R 753 0 R 754 0 R 755 0 R 756 0 R 757 0 R 758 0 R 759 0 R 760 0 R 761 0 R 762 0 R 763 0 R 764 0 R 765 0 R 766 0 R 767 0 R 768 0 R 769 0 R 770 0 R 771 0 R 772 0 R 773 0 R 774 0 R 775 0 R 776 0 R 777 0 R 778 0 R 779 0 R 780 0 R 781 0 R 782 0 R 783 0 R 784 0 R 785 0 R 786 0 R 787 0 R 788 0 R 789 0 R 790 0 R 791 0 R 792 0 R 793 0 R 794 0 R 795 0 R 796 0 R 797 0 R 798 0 R 799 0 R 800 0 R ] +/Parent 659 0 R +/Annots [ 748 0 R 749 0 R 750 0 R 751 0 R 752 0 R 753 0 R 754 0 R 755 0 R 756 0 R 757 0 R 758 0 R 759 0 R 760 0 R 761 0 R 762 0 R 763 0 R 764 0 R 765 0 R 766 0 R 767 0 R 768 0 R 769 0 R 770 0 R 771 0 R 772 0 R 773 0 R 774 0 R 775 0 R 776 0 R 777 0 R 778 0 R 779 0 R 780 0 R 781 0 R 782 0 R 783 0 R 784 0 R 785 0 R 786 0 R 787 0 R 788 0 R 789 0 R 790 0 R 791 0 R 792 0 R 793 0 R 794 0 R 795 0 R 796 0 R 797 0 R 798 0 R 799 0 R 800 0 R 801 0 R 802 0 R 803 0 R 804 0 R ] >> endobj -744 0 obj << +748 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 758.4766 511.2325 767.4329] /Subtype /Link +/A << /S /GoTo /D (subsection.4.8.1) >> +>> endobj +749 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.2773 746.445 511.2325 755.4012] +/Subtype /Link /A << /S /GoTo /D (subsection.4.8.2) >> >> endobj -745 0 obj << +750 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 746.5446 511.2325 755.4012] +/Rect [499.2773 734.5129 511.2325 743.3696] /Subtype /Link /A << /S /GoTo /D (subsection.4.8.3) >> >> endobj -746 0 obj << +751 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 734.4133 511.2325 743.3696] +/Rect [499.2773 722.3816 511.2325 731.3379] /Subtype /Link /A << /S /GoTo /D (section.4.9) >> >> endobj -747 0 obj << +752 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 722.3816 511.2325 731.3379] +/Rect [499.2773 710.3499 511.2325 719.3062] /Subtype /Link /A << /S /GoTo /D (subsection.4.9.1) >> >> endobj -748 0 obj << +753 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 710.3499 511.2325 719.3062] +/Rect [499.2773 698.3182 511.2325 707.2745] /Subtype /Link /A << /S /GoTo /D (subsection.4.9.2) >> >> endobj -749 0 obj << +754 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 688.0297 511.2325 696.7618] +/Rect [499.2773 675.998 511.2325 684.7301] /Subtype /Link /A << /S /GoTo /D (chapter.5) >> >> endobj -750 0 obj << +755 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 676.0179 511.2325 684.9742] +/Rect [499.2773 663.9862 511.2325 672.9425] /Subtype /Link /A << /S /GoTo /D (section.5.1) >> >> endobj -751 0 obj << +756 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 663.9862 511.2325 672.9425] +/Rect [499.2773 651.9545 511.2325 660.9108] /Subtype /Link /A << /S /GoTo /D (section.5.2) >> >> endobj -752 0 obj << +757 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 641.666 511.2325 650.5226] +/Rect [499.2773 629.6343 511.2325 638.4909] /Subtype /Link /A << /S /GoTo /D (chapter.6) >> >> endobj -753 0 obj << +758 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 629.6542 511.2325 638.7599] +/Rect [499.2773 617.6225 511.2325 626.7282] /Subtype /Link /A << /S /GoTo /D (section.6.1) >> >> endobj -754 0 obj << +759 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 617.6225 511.2325 626.5788] +/Rect [499.2773 605.5908 511.2325 614.5471] /Subtype /Link /A << /S /GoTo /D (subsection.6.1.1) >> >> endobj -755 0 obj << +760 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 605.5908 511.2325 614.5471] +/Rect [499.2773 593.5591 511.2325 602.5154] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.1.1.1) >> >> endobj -756 0 obj << +761 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 593.5591 511.2325 602.5154] +/Rect [499.2773 581.5275 511.2325 590.4837] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.1.1.2) >> >> endobj -757 0 obj << +762 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 581.5275 511.2325 590.4837] +/Rect [499.2773 569.4958 511.2325 578.4521] /Subtype /Link /A << /S /GoTo /D (subsection.6.1.2) >> >> endobj -758 0 obj << +763 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 569.4958 511.2325 578.4521] +/Rect [499.2773 557.4641 511.2325 566.4204] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.1.2.1) >> >> endobj -759 0 obj << +764 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 557.4641 511.2325 566.4204] +/Rect [499.2773 545.4324 511.2325 554.3887] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.1.2.2) >> >> endobj -760 0 obj << +765 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 545.4324 511.2325 554.5382] +/Rect [499.2773 533.4007 511.2325 542.5065] /Subtype /Link /A << /S /GoTo /D (section.6.2) >> >> endobj -761 0 obj << +766 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 533.4007 511.2325 542.357] +/Rect [499.2773 521.3691 511.2325 530.3254] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.1) >> >> endobj -762 0 obj << +767 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 521.3691 511.2325 530.3254] +/Rect [499.2773 509.3374 511.2325 518.2937] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.2) >> >> endobj -763 0 obj << +768 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 509.3374 511.2325 518.2937] +/Rect [499.2773 497.3057 511.2325 506.262] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.3) >> >> endobj -764 0 obj << +769 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 497.3057 511.2325 506.262] +/Rect [499.2773 485.274 511.2325 494.2303] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.4) >> >> endobj -765 0 obj << +770 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 485.274 511.2325 494.2303] +/Rect [499.2773 473.2424 511.2325 482.1986] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.5) >> >> endobj -766 0 obj << +771 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 473.2424 511.2325 482.1986] +/Rect [499.2773 461.2107 511.2325 470.167] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.6) >> >> endobj -767 0 obj << +772 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 461.2107 511.2325 470.167] +/Rect [499.2773 449.179 511.2325 458.1353] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.7) >> >> endobj -768 0 obj << +773 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 449.179 511.2325 458.1353] +/Rect [499.2773 437.1473 511.2325 446.1036] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.8) >> >> endobj -769 0 obj << +774 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 437.1473 511.2325 446.1036] +/Rect [499.2773 425.1157 511.2325 434.0719] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.9) >> >> endobj -770 0 obj << +775 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 425.1157 511.2325 434.0719] +/Rect [499.2773 413.084 511.2325 422.0403] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.10) >> >> endobj -771 0 obj << +776 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 413.084 511.2325 422.0403] +/Rect [499.2773 401.0523 511.2325 410.0086] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.10.1) >> >> endobj -772 0 obj << +777 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 401.0523 511.2325 410.158] +/Rect [499.2773 389.0206 511.2325 398.1264] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.10.2) >> >> endobj -773 0 obj << +778 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 389.1203 511.2325 398.1264] +/Rect [499.2773 377.0886 511.2325 386.0947] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.11) >> >> endobj -774 0 obj << +779 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 377.0886 511.2325 386.0947] +/Rect [499.2773 365.0569 511.2325 374.063] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.12) >> >> endobj -775 0 obj << +780 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 365.0569 511.2325 374.063] +/Rect [499.2773 353.0252 511.2325 362.0313] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.13) >> >> endobj -776 0 obj << +781 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 353.0252 511.2325 362.0313] +/Rect [499.2773 340.9936 511.2325 349.9997] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.14) >> >> endobj -777 0 obj << +782 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 340.9936 511.2325 349.9997] +/Rect [499.2773 328.9619 511.2325 337.968] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.15) >> >> endobj -778 0 obj << +783 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 328.9619 511.2325 337.968] +/Rect [499.2773 316.9302 511.2325 325.9363] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.16) >> >> endobj -779 0 obj << +784 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 316.8305 511.2325 325.9363] +/Rect [499.2773 304.7989 511.2325 313.9046] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.1) >> >> endobj -780 0 obj << +785 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 304.7989 511.2325 313.7552] +/Rect [499.2773 292.7672 511.2325 301.7235] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.2) >> >> endobj -781 0 obj << +786 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 292.7672 511.2325 301.873] +/Rect [499.2773 280.7355 511.2325 289.8413] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.3) >> >> endobj -782 0 obj << +787 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 280.7355 511.2325 289.8413] +/Rect [499.2773 268.7038 511.2325 277.8096] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.4) >> >> endobj -783 0 obj << +788 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 268.7038 511.2325 277.6601] +/Rect [499.2773 256.6722 511.2325 265.6285] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.5) >> >> endobj -784 0 obj << +789 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 256.6722 511.2325 265.6285] +/Rect [499.2773 244.6405 511.2325 253.5968] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.6) >> >> endobj -785 0 obj << +790 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 244.6405 511.2325 253.5968] +/Rect [499.2773 232.6088 511.2325 241.5651] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.7) >> >> endobj -786 0 obj << +791 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 232.6088 511.2325 241.5651] +/Rect [499.2773 220.5771 511.2325 229.5334] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.8) >> >> endobj -787 0 obj << +792 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 220.5771 511.2325 229.5334] +/Rect [499.2773 208.5455 511.2325 217.5017] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.9) >> >> endobj -788 0 obj << +793 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 208.5455 511.2325 217.5017] +/Rect [499.2773 196.5138 511.2325 205.4701] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.10) >> >> endobj -789 0 obj << +794 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 196.5138 511.2325 205.4701] +/Rect [499.2773 184.4821 511.2325 193.4384] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.11) >> >> endobj -790 0 obj << +795 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 184.4821 511.2325 193.4384] +/Rect [499.2773 172.4504 511.2325 181.4067] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.12) >> >> endobj -791 0 obj << +796 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 172.4504 511.2325 181.4067] +/Rect [499.2773 160.4187 511.2325 169.375] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.13) >> >> endobj -792 0 obj << +797 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 160.4187 511.2325 169.375] +/Rect [499.2773 148.3871 511.2325 157.3433] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.14) >> >> endobj -793 0 obj << +798 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 148.3871 511.2325 157.3433] +/Rect [499.2773 136.3554 511.2325 145.3117] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.15) >> >> endobj -794 0 obj << +799 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 136.3554 511.2325 145.4611] +/Rect [499.2773 124.3237 511.2325 133.4295] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.16) >> >> endobj -795 0 obj << +800 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 124.3237 511.2325 133.4295] +/Rect [499.2773 112.292 511.2325 121.3978] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.17) >> >> endobj -796 0 obj << +801 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 112.292 511.2325 121.2483] +/Rect [499.2773 100.2604 511.2325 109.2166] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.18) >> >> endobj -797 0 obj << +802 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 100.2604 511.2325 109.3661] +/Rect [499.2773 88.2287 511.2325 97.3344] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.16.19) >> >> endobj -798 0 obj << +803 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 88.2287 511.2325 97.3344] +/Rect [499.2773 76.197 511.2325 85.3027] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.17) >> >> endobj -799 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.2773 76.197 511.2325 85.1533] -/Subtype /Link -/A << /S /GoTo /D (subsection.6.2.18) >> ->> endobj -800 0 obj << +804 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [499.2773 64.1653 511.2325 73.1216] /Subtype /Link -/A << /S /GoTo /D (subsection.6.2.19) >> +/A << /S /GoTo /D (subsection.6.2.18) >> >> endobj -740 0 obj << -/D [738 0 R /XYZ 56.6929 794.5015 null] +744 0 obj << +/D [742 0 R /XYZ 56.6929 794.5015 null] >> endobj -737 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F21 654 0 R >> +741 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R >> /ProcSet [ /PDF /Text ] >> endobj -803 0 obj << -/Length 3296 -/Filter /FlateDecode ->> -stream -xÚíYs7€ßõ+øª• „Å}ì>lé²£”-{%¹²µI hrL±, >ö×/†3À4ELKHbÙ–èTJ”4=ÝìþÐè0ëQÿ ëYE¨p²gœ$Š2ÕLvhoä÷|‡5×쇋öáU‡—;&Lϧ¹î]¾÷²„ZËz—Ã_v^]žœ]^ìývùÓÎÉe¼)T̨¨îøûÎ/¿ÑÞÐëÿi‡á¬ê}ôßPÂœã½ÉŽT‚()DøÉõÎÅοã
ÁoW¢©7¢„%Êr“x'\€wÂ8'ÖorD ÿ»êh §Õñ—3p¹`ÄZ*½Žê²Ål9_Ãý÷Åçys1¼·²Äq«›‹/ýE1)ÊÅÞ>Wt÷¸ø•R^ŽãiYÿ¤_ëoæýQQ½»do_Qú…¿Hç²nÅWqK4§¬uáF@f£^ýâ †(ÈíCÁÍmÞ"½aGyÊ T{ ˆ4DÃZ@Ø€| `péßQi0žÏú“Iæ- (þÅM LÁÝÙ0A ¦µp"0%ìÀ`Bµ·0 E g®…‰˜îÎ2ÚéïNh‚[³¡‚4kaC IØAƒjo¡á‚m ¸šÿMË"
5ÎÜ•¬}Ì©ç.˜‚»³a‚Lká4Ý0%ìÀ`Bµ·01Ï cº…I~˜îÎ@F±G4m·fC1h`Ø í†&a
ª)IŒ1®§#Vi !lÏw
t÷¿«°^î9ºûù¦˜{_Éo¼„yø¬]˜ D -` L÷âWÊŒT{; Pß–2Å"¼™ŽÇóÁ2î—ÿI$ùUÃÿµ×Ú£³ ‚!0FÆv’°#Õ QÎ7 ʹHˆh¹(‹q9jfõË+䶾Ìæ'z8— (ˆð³A„Ÿ” ?¸ö– K‰ 2ö2Uûºâç´üPÌBUø²sa79çôõ1·bÛŠD/f31F`”Œëf$aƪ½eD["¤k[Õ0òjqUÌjn7¿«-•q]– ãU»"${ÂóPôb6#@cF c$aƪ=Ö«Jy0œlÛÛßR&vì´ïŠ˜ ›q?¼:?}~z–Ø´“†ObsÝR{ûN±ïšN\‚C³q‚.0`. ;0\Pí-.R) ¸ð \NÏŽ^¼9>I fS„jÑÅ /¯Wfƒ1P`¨0Pv` Ú[P'ÒJ@9 øÊ7u@+]$æë,˽â%¸8 ˆCh»wzSv` -ÇÚ~x~rvr~PÐ\¦²“„R!ÓàéêÓ;A®Êb ÀP` $ìÀ@@µ· P/`„‰ ˜„ƒápuê',§µ<›Î&ý…¯\µÑÛ&':0 ˆád»·rSv`xlhg‰'¤ÕD+ÕtáÕŽÞZŠpõ—‹b°œŸë>? ‹Y¿Þ÷ïò[¼µ7à^þ‚›oÞwå/Ñé/x;ÄO›ZS{ŸÒø‰™Ò¦]ÕøÕÞçÁ`PÌçÑ-‹U^›6êÅx¾XýNn÷<³G]tx‚Ȩ[ (FQÂŒ&T{¤Isb¤jzV’:[îÓ·c’53æàj6.«`„ &Öj§31W;"|&h®™‹åx˜º•/2Ã<ñ ü?nˆm6¸@²c»€¤ìÀÀEµÇjB*JŒ£2ÛnÏ'ËDÅ•VäQ|R~¨ ÄiYŸSZ<¼ØÉUð|6W@ã -Fã*aƪ½åÊ X¡Dä*ìø½™Çøt'âë»3»y3hìŸ-ËA}â]š§0çvBÜž
Ä ‚aÅ JØA…j³lµÜai³CÏ«užPl«\£ôß#ì&ø4 ˆc†“°fC{²¢²úYCkÓ ]î1ÆvgÓåÛëb~åç¯* uº'ÜáÞ=Àzž5˺cÀÛaîØК?ÂU«6Í#˜6ö<GÓÉ$œ¿x]ÏÓÞ5“j¹@Êm‹“=¤¢›s‡D†Ôz»ÙIÙ0„k»°¾T<0ëÅÓÅßš¾¹œ6¢}œÎÞûÁõÏú»«éÇúÅ 6Þë/Õój£ú\`“¸§Ëp‡«~¼íǦ„ ýËçsf¿¡I7¸$;Þ nèp$Ú›F`ÁÆTÇ|¡ ¡®y`Ò®*¸*_œ–ƒ:XU1 ‹¹x(÷èª_ŽÖj¼f2žÃÊäÙrò¶Z¨ö - A! Ý” ˆ°„€„ ¨öÈ€2„ÉæùGk®Ÿ«í€=º5¤ŸÍ -"`¬ÅÆuŸ
HÙ€k9‚[C$,rÄéëºôÃaxÆ&<y÷«/èü?ÿÕ_®…Ù ˆ~̦b”À8a”$ìÀ(AµÇôa‘Í샪¢¯²Çáøíõx:šõo®>·XÄ)âb9Õgï…¬Ò ú¯&FpþDrGã¸l(Z9Œ ‰M#0"0ÕmÚЂHÇ#!mœ¿/}Ôë˜ûI#œ‹˜4ejÀäüÙѼfÁ -þ4jÍè²l€ F †CÂŒT{ „bD £#¼™GÊE1+Cs<ë¿«0pŽo“û0¼šÍ ĘQsÝ{-);0fPí-3ÂU*2#jfÀÃ5ÇÓÁ¤Žƒ·q¡·nA{*Ù#ø*› ˆ‘ -Œ!LwDHbý¿†!U3Tö'ÅppU ަ廽ês˶ðüax‚³é‚>0†ŒvïP§ Á +807 0 obj << +/Length 3353 +/Filter /FlateDecode +>> +stream +xÚíKs7€ïú<¤j¥ƒ°x€ÝÖ^v”rd¯$W¶6É&ÇËâPáÃŽ÷×/†`š"¦%8~ÈJ‘’¦§›Ýß4ºÌõ¨ûõŒ"TXÙÓVE™ê
&;´7r{¾Ãü1ûá }xÔáåÎߟ ݳļè]¾ç2„Ãz—Ã_w^ž]žœ]^ìý~ùÓÎÉe<)T̨¨ÏøÇί¿ÓÞÐéÿi‡aê}p?P¬å½ÉŽT‚()DøÍõÎÅοã Á_W¢©¢„!Êpø$\€OÂ8'Æjg²¤îoõG)wŠëâgàpÁˆ1T: õa‹Ùr¾(‡ûïÊs0<·2ÄrSøƒ/ýE9)«ÅÞ>Wt÷ù¬?™ôg{ûFÒ]²·¯èx‘Ö~ŠÜ€+nHÁ)k}º¡Ù¨×¼9‡1 rûPp3f›ç_Ŭذ#0²#ÕÞ#5)´f‘N¿(1Çåo”òj¼O«æ7ýjؼy=ïÊúx˜œt\˜
Ä +[|ìtBÜš
Ä Y ›î†&a
ª½…†9 +ZhÄÐüoZ•ih¨¶ú® dÌcN=wÁÜ
Ä`Z §é†)aª=ÂTXKŒ*d “ü"0Ý´bgØŠnÍ… +"Ь…MÓNhRv ÐàÚ™’Dkm{…ÑÄR& +PíqPÖ•”ÊÚH÷ƒÀñx>X&Âýó B~Óðë¹öèÃ\B BÈZŒt÷ôhÊ„\{Kˆ¡DPi"!ÂrQ.ãjäGõË+䶾Ìç'x8› ˆñ#¨m7? ;0~Pí-?…!BÚØËÔí늟Óê}9 UáÏý››ÓØçœÓWïÝÁ܈m+½˜ÍÄQÂIØ1‚joQ +ÛVDyF^.®ÊYÃíæwµ¤2nÊ’Ábü¾nW„dOy +^ÌfbŒÀ(aŒ$ìÀAµÇzUII¤°¼e$¶/®¥L¬Ø® f2,ÆýðòüôùéYbÑNj" ‰þ¸5¤ööbu[th6.@ÃÌt¯¿¤ìÀpAµ·¸N¤‘ àÂsp9=;zñúø$µ™MZˆ.^¸x|y%¸2 ˆC…’°ÕÞ‚Â)q¦X +"x¬Èt/ñ§ì@ðØÔÎ÷”Hí J}^¯è¥Û¼\”ƒål¼øØüt4uùaXÎúͺ§ß©÷óØ´xó¼+‰nÓa~ÚКZû”'Z*߉®jüzíó`0(çóè–Å*¯Mýõb<_¬þ&·kžùW]pxöU±«£(aFª=Ò¤(Ñ–úž•¤ö–»ôm™d~Ä<ºšM§‹ÄÀ*$¡’‡Ãê•ÎÄXm‰pEØÿY.–ãaêT†8T?쉯à +±!¨ÙÄAŒXéÞû‘²#ÕÞ–NÀ%²íº|²>TÌqisƒN|ᚇºð¤zßT†ÓªÙ , +ñtb'WÁóÙ\AŒ+YŒ«„ W¨ö–«º'5”E®ÂRßëyœyO· ®1–…Ô7ïLkoãgËjÐlu—ú) ¶P·gC1¨`X1¨v`P¡ÚãðÊ$±\ú¥É¸Qskb[ÞjU<ñÅÁN`‚O³‚00f0 ;0`6´§º aëù çªñ]Ðå clw6]¾¹.çWnüªóQ—{âîÛì@¤ÙY·¬{ < âŽM©ëG7z+?E {£édö]¼j†iç™I=M 嶵ɾ¢‚—s/( ‡\Ok1D¸Ù4ÃS ‡tQXB¿ Óø
}«µõÅß|¯\Mýíg ¦³wîºúgóÓÕôCófЋíÍK}Ú¨Ù èsötÎpÕ§ýà«ÇÑ¿\*gæ·Ñ'ÙÑ‚X¸×|ŽÄ;apT{ÌJ׫ú^zUÁÕ ã´4«‹ùXÌÅݸGWýj´VãùÁx6S’gËÉ›z†Ú™ñ +ùè¦l€ ÆÀZv` Ú#Rfü&Ö\¿Ô;%Ú«öèÖuý¼ôWñåõ»h¥ÜŽ ÷B)x;% ˆ¡´M¥„ JÚ“Õ„~BüÀerÎwnnÊj8 ”ÝóÍQìÞ%ÀJ0hŽéÞ`O‡ù`CkòrbŒ&TãƒzÕÚyað®š~¸.‡£:¥Ö{à¹ÝV^ùWOpnöÕ±«#&aFª=–_ÜÖó½Ftjxl} 5™öp6.ý®é ÇóÅtöq}+u ˆÏ.nØͺPAÙãA!:+(ˆ ° …” +¸öD¸ÑDRÁ< ¼I"Ï˪œ… ++ù¼|ëGê*ÜmsZ½]-¯¦Ë +û´ÖŸ¢ï²Á + Ó=kVÙîûßáé0WlhM\Ì +¢•lâp¸V…Ý ŽG*i~?7¿Æxä^wP¹îÖâ@–²
× a3Œhk™‡7°]MëNé-m_6A +atûÒæåö¡`Š¶Ûç¯Îhw‘˜2Ã
U q+,1þþÌÃÕ`_§¶j>/õ“ÙGõ3y¤T[¦>LÞÝÙ,µrJ ˜Œv?w.a¦;r¤41îŸI®4 ªÕão JbËÐ_e(¸:" ˆQCÉhwÝ™2ãU A’ŠX! +’j@ªú“r¸?¸*ïÓêí^ýP¼-AŸLPðq6A@#ÆÑîê”!A¨úHÄjã;—úÖÊ[ùT¤¶9èÓ +>Î&bÁ2Úý endobj -802 0 obj << +806 0 obj << /Type /Page -/Contents 803 0 R -/Resources 801 0 R +/Contents 807 0 R +/Resources 805 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 655 0 R -/Annots [ 805 0 R 806 0 R 807 0 R 808 0 R 809 0 R 810 0 R 811 0 R 812 0 R 813 0 R 814 0 R 815 0 R 816 0 R 817 0 R 818 0 R 819 0 R 820 0 R 821 0 R 822 0 R 823 0 R 824 0 R 825 0 R 826 0 R 827 0 R 828 0 R 829 0 R 830 0 R 831 0 R 832 0 R 833 0 R 834 0 R 835 0 R 836 0 R 837 0 R 838 0 R 839 0 R 840 0 R 841 0 R 842 0 R 843 0 R 844 0 R 845 0 R 846 0 R 847 0 R 848 0 R 849 0 R 850 0 R 851 0 R 852 0 R 853 0 R 854 0 R 855 0 R 859 0 R 860 0 R ] +/Parent 659 0 R +/Annots [ 809 0 R 810 0 R 811 0 R 812 0 R 813 0 R 814 0 R 815 0 R 816 0 R 817 0 R 818 0 R 819 0 R 820 0 R 821 0 R 822 0 R 823 0 R 824 0 R 825 0 R 826 0 R 827 0 R 828 0 R 829 0 R 830 0 R 831 0 R 832 0 R 833 0 R 834 0 R 835 0 R 836 0 R 837 0 R 838 0 R 839 0 R 840 0 R 841 0 R 842 0 R 843 0 R 844 0 R 845 0 R 846 0 R 847 0 R 848 0 R 849 0 R 850 0 R 851 0 R 852 0 R 853 0 R 854 0 R 855 0 R 856 0 R 857 0 R 858 0 R 859 0 R 860 0 R 864 0 R 865 0 R ] >> endobj -805 0 obj << +809 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 758.4766 539.579 767.4329] /Subtype /Link -/A << /S /GoTo /D (subsection.6.2.20) >> +/A << /S /GoTo /D (subsection.6.2.19) >> >> endobj -806 0 obj << +810 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 746.5215 539.579 755.4777] /Subtype /Link -/A << /S /GoTo /D (subsection.6.2.21) >> +/A << /S /GoTo /D (subsection.6.2.20) >> >> endobj -807 0 obj << +811 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 734.5663 539.579 743.5226] /Subtype /Link -/A << /S /GoTo /D (subsection.6.2.22) >> +/A << /S /GoTo /D (subsection.6.2.21) >> >> endobj -808 0 obj << +812 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 722.6111 539.579 731.5674] /Subtype /Link -/A << /S /GoTo /D (subsection.6.2.23) >> +/A << /S /GoTo /D (subsection.6.2.22) >> >> endobj -809 0 obj << +813 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 710.656 539.579 719.6122] /Subtype /Link -/A << /S /GoTo /D (subsection.6.2.24) >> +/A << /S /GoTo /D (subsection.6.2.23) >> >> endobj -810 0 obj << +814 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [527.6238 698.7008 539.579 707.6571] /Subtype /Link +/A << /S /GoTo /D (subsection.6.2.24) >> +>> endobj +815 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [527.6238 686.7456 539.579 695.7019] +/Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.24.1) >> >> endobj -811 0 obj << +816 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 686.8453 539.579 695.8514] +/Rect [527.6238 674.8901 539.579 683.8962] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.24.2) >> >> endobj -812 0 obj << +817 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 674.8901 539.579 683.8962] +/Rect [527.6238 662.935 539.579 671.7916] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.24.3) >> >> endobj -813 0 obj << +818 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 662.935 539.579 671.941] +/Rect [527.6238 650.9798 539.579 659.9859] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.24.4) >> >> endobj -814 0 obj << +819 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 650.8801 539.579 659.8364] +/Rect [527.6238 638.925 539.579 647.8812] /Subtype /Link /A << /S /GoTo /D (section.6.3) >> >> endobj -815 0 obj << +820 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 638.925 539.579 647.8812] +/Rect [527.6238 626.9698 539.579 635.9261] /Subtype /Link /A << /S /GoTo /D (subsection.6.3.1) >> >> endobj -816 0 obj << +821 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 626.9698 539.579 635.9261] +/Rect [527.6238 615.0146 539.579 623.9709] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.3.1.1) >> >> endobj -817 0 obj << +822 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 615.1143 539.579 623.9709] +/Rect [527.6238 603.1591 539.579 612.0157] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.3.1.2) >> >> endobj -818 0 obj << +823 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 603.0594 539.579 612.0157] +/Rect [527.6238 591.1043 539.579 600.0606] /Subtype /Link /A << /S /GoTo /D (subsection.6.3.2) >> >> endobj -819 0 obj << +824 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 591.1043 539.579 600.0606] +/Rect [527.6238 579.1491 539.579 588.1054] /Subtype /Link /A << /S /GoTo /D (subsection.6.3.3) >> >> endobj -820 0 obj << +825 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 579.1491 539.579 588.1054] +/Rect [527.6238 567.1939 539.579 576.1502] /Subtype /Link /A << /S /GoTo /D (subsection.6.3.4) >> >> endobj -821 0 obj << +826 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 567.1939 539.579 576.1502] +/Rect [527.6238 555.2388 539.579 564.1951] /Subtype /Link /A << /S /GoTo /D (subsection.6.3.5) >> >> endobj -822 0 obj << +827 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 555.2388 539.579 564.1951] +/Rect [527.6238 543.2836 539.579 552.2399] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.3.5.1) >> >> endobj -823 0 obj << +828 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 543.2836 539.579 552.2399] +/Rect [527.6238 531.3284 539.579 540.2847] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.3.5.2) >> >> endobj -824 0 obj << +829 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 531.3284 539.579 540.2847] +/Rect [527.6238 519.3733 539.579 528.3296] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.3.5.3) >> >> endobj -825 0 obj << +830 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 519.3733 539.579 528.3296] +/Rect [527.6238 507.4181 539.579 516.3744] /Subtype /Link /A << /S /GoTo /D (subsection.6.3.6) >> >> endobj -826 0 obj << +831 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 507.4181 539.579 516.5239] +/Rect [527.6238 495.4629 539.579 504.5687] /Subtype /Link /A << /S /GoTo /D (subsection.6.3.7) >> >> endobj -827 0 obj << +832 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 485.4804 539.579 494.2126] +/Rect [527.6238 473.5253 539.579 482.2574] /Subtype /Link /A << /S /GoTo /D (chapter.7) >> >> endobj -828 0 obj << +833 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 473.5451 539.579 482.5014] +/Rect [527.6238 461.59 539.579 470.5462] /Subtype /Link /A << /S /GoTo /D (section.7.1) >> >> endobj -829 0 obj << +834 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 461.59 539.579 470.6957] +/Rect [527.6238 449.6348 539.579 458.7405] /Subtype /Link /A << /S /GoTo /D (section.7.2) >> >> endobj -830 0 obj << +835 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 449.6348 539.579 458.7405] +/Rect [527.6238 437.6796 539.579 446.7854] /Subtype /Link /A << /S /GoTo /D (subsection.7.2.1) >> >> endobj -831 0 obj << +836 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 437.6796 539.579 446.7854] +/Rect [527.6238 425.7245 539.579 434.8302] /Subtype /Link /A << /S /GoTo /D (subsection.7.2.2) >> >> endobj -832 0 obj << +837 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 425.7245 539.579 434.8302] +/Rect [527.6238 413.7693 539.579 422.875] /Subtype /Link /A << /S /GoTo /D (section.7.3) >> >> endobj -833 0 obj << +838 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 403.7868 539.579 412.5189] +/Rect [527.6238 391.8316 539.579 400.5637] /Subtype /Link /A << /S /GoTo /D (chapter.8) >> >> endobj -834 0 obj << +839 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 391.8515 539.579 400.8078] +/Rect [527.6238 379.8963 539.579 388.8526] /Subtype /Link /A << /S /GoTo /D (section.8.1) >> >> endobj -835 0 obj << +840 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 379.8963 539.579 388.8526] +/Rect [527.6238 367.9411 539.579 376.8974] /Subtype /Link /A << /S /GoTo /D (subsection.8.1.1) >> >> endobj -836 0 obj << +841 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 367.9411 539.579 376.8974] +/Rect [527.6238 355.986 539.579 364.9423] /Subtype /Link /A << /S /GoTo /D (section.8.2) >> >> endobj -837 0 obj << +842 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 355.986 539.579 364.9423] +/Rect [527.6238 344.0308 539.579 352.9871] /Subtype /Link /A << /S /GoTo /D (section.8.3) >> >> endobj -838 0 obj << +843 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 334.0483 539.579 342.7804] +/Rect [527.6238 322.0931 539.579 330.8253] /Subtype /Link /A << /S /GoTo /D (appendix.A) >> >> endobj -839 0 obj << +844 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 322.113 539.579 331.0693] +/Rect [527.6238 310.1578 539.579 319.1141] /Subtype /Link /A << /S /GoTo /D (section.A.1) >> >> endobj -840 0 obj << +845 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 310.1578 539.579 319.1141] +/Rect [527.6238 298.2027 539.579 307.1589] /Subtype /Link /A << /S /GoTo /D (subsection.A.1.1) >> >> endobj -841 0 obj << +846 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 298.2027 539.579 307.1589] +/Rect [527.6238 286.2475 539.579 295.2038] /Subtype /Link /A << /S /GoTo /D (section.A.2) >> >> endobj -842 0 obj << +847 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 286.2475 539.579 295.2038] +/Rect [527.6238 274.2923 539.579 283.2486] /Subtype /Link /A << /S /GoTo /D (subsection.A.2.1) >> >> endobj -843 0 obj << +848 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 274.2923 539.579 283.2486] +/Rect [527.6238 262.3372 539.579 271.2934] /Subtype /Link /A << /S /GoTo /D (section.A.3) >> >> endobj -844 0 obj << +849 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 262.3372 539.579 271.2934] +/Rect [527.6238 250.382 539.579 259.3383] /Subtype /Link /A << /S /GoTo /D (subsection.A.3.1) >> >> endobj -845 0 obj << +850 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 250.382 539.579 259.4877] +/Rect [527.6238 238.4268 539.579 247.5326] /Subtype /Link /A << /S /GoTo /D (subsection.A.3.2) >> >> endobj -846 0 obj << +851 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 238.4268 539.579 247.5326] +/Rect [527.6238 226.4717 539.579 235.5774] /Subtype /Link /A << /S /GoTo /D (subsection.A.3.3) >> >> endobj -847 0 obj << +852 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 216.4891 539.579 225.2213] +/Rect [527.6238 204.534 539.579 213.2661] /Subtype /Link /A << /S /GoTo /D (appendix.B) >> >> endobj -848 0 obj << +853 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [527.6238 204.5538 539.579 213.5101] +/Rect [527.6238 192.5987 539.579 201.555] /Subtype /Link /A << /S /GoTo /D (section.B.1) >> >> endobj -849 0 obj << +854 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [522.6425 192.5987 539.579 201.7044] +/Rect [522.6425 180.6435 539.579 189.7493] /Subtype /Link /A << /S /GoTo /D (section.B.2) >> >> endobj -850 0 obj << +855 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [522.6425 180.6435 539.579 189.7493] +/Rect [522.6425 168.6883 539.579 177.7941] /Subtype /Link /A << /S /GoTo /D (section.B.3) >> >> endobj -851 0 obj << +856 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [522.6425 168.6883 539.579 177.7941] +/Rect [522.6425 156.7332 539.579 165.8389] /Subtype /Link /A << /S /GoTo /D (section.B.4) >> >> endobj -852 0 obj << +857 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [522.6425 156.7332 539.579 165.8389] +/Rect [522.6425 144.778 539.579 153.8838] /Subtype /Link /A << /S /GoTo /D (section.B.5) >> >> endobj -853 0 obj << +858 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [522.6425 144.778 539.579 153.8838] +/Rect [522.6425 132.8228 539.579 141.9286] /Subtype /Link /A << /S /GoTo /D (section.B.6) >> >> endobj -854 0 obj << +859 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [522.6425 132.8228 539.579 141.9286] +/Rect [522.6425 120.8677 539.579 129.9734] /Subtype /Link /A << /S /GoTo /D (section.B.7) >> >> endobj -855 0 obj << +860 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [522.6425 120.8677 539.579 129.9734] +/Rect [522.6425 108.9125 539.579 118.0182] /Subtype /Link /A << /S /GoTo /D (section.B.8) >> >> endobj -859 0 obj << +864 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [522.6425 109.0122 539.579 118.0182] +/Rect [522.6425 97.057 539.579 106.0631] /Subtype /Link /A << /S /GoTo /D (section.B.9) >> >> endobj -860 0 obj << +865 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [522.6425 96.9573 539.579 106.0631] +/Rect [522.6425 85.0022 539.579 94.1079] /Subtype /Link /A << /S /GoTo /D (section.B.10) >> >> endobj -804 0 obj << -/D [802 0 R /XYZ 85.0394 794.5015 null] +808 0 obj << +/D [806 0 R /XYZ 85.0394 794.5015 null] >> endobj -801 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F21 654 0 R /F39 858 0 R >> +805 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -863 0 obj << +868 0 obj << /Length 69 /Filter /FlateDecode >> stream xÚ3T0 endobj -862 0 obj << +867 0 obj << /Type /Page -/Contents 863 0 R -/Resources 861 0 R +/Contents 868 0 R +/Resources 866 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 655 0 R +/Parent 659 0 R >> endobj -864 0 obj << -/D [862 0 R /XYZ 56.6929 794.5015 null] +869 0 obj << +/D [867 0 R /XYZ 56.6929 794.5015 null] >> endobj -861 0 obj << +866 0 obj << /ProcSet [ /PDF ] >> endobj -867 0 obj << -/Length 2199 +872 0 obj << +/Length 2197 /Filter /FlateDecode >> stream -xÚÝYÝã¶÷_áG-pVù-2o½»¦¸ ¸¢Ý
òäA+qmádIÑÇnœ¿¾Ci˶|wè-Ð X`M†äpæ7¿ÚtMவL 7b‘JBåºØ¯Èz ïþ¾¢AGHžJÁ9<,¼ÝH®S©Y¶ÞÌyû°úË÷Œ®I•brýðtÜKe:5\˜õCùsòn—w£íï6L’„ÞýúðNi¦3ê¦ØB¦™!ÚOøÐŒ}[NÅXµMPçk“ÅTÔÎ`.˜ë´ v–ÖÊM³}cG|zßîóªÁñÇ| tîÃh÷8þ…Hòþã=|P'È’¢m†j|Ý>áç× Í˜ÿ „mu¶¨žš
ìw±ŠmÆj¬Pš%Õ M ºIpFw*JS#%‹>‡áŒ$î œÑ$ÇÇ]eû¼¿£:)vU‘×(ÝçMnÎDò\£=îM§“©v›»E¦Á–(j{ ”¶¶Û|¬šmØgwm_`æ%í³
ºþpa‡¼ +…(8É;øìDÔŸ¨ÚwµÝƒ r ×
CÇ]î•É$/Æ)¯ëÊ÷y7à(ºT¼ÏA4‹³›X–Þvì‚š'UT-ó1Gµjˆ+W`AÕ8¸g· >nýZíÔ¡¢·›@ÒWÓè‘KñpR·ùc§"åB±€bAR¦8bž¦ -ôœA)*l7Fê8³“fD Ö±›Ö± R -+úF…ÓŸ°3± -šD
n:% -Z¹b¿úmõó¯d]®Èú‡I¹Ð¾ÀxÓ¶Þ¯‡!‘:JêÕýê_ÿå¬hǬ=¸iÎ#°VFPŸ/µ‰gÚP¡`KM_C]À™§” XF˜Tî9¾i -w”Xó®ÜÆ™LAO¯ç[|›ÕÇ%¿`6‡†QèÌœ›ýÓ #ÉM¸ 㡾>„t±’ò!\:”ŽM˜û¿ƒãPé¡Kÿú3Å7áÄ(ðŸá§o5ù"œ\ƒ)mrǯnàãÎ}âèVp¸ÑVÛ£€%?þû oPs×ãLxŽuíâ;ƒˆ£ôýÕ7\îû `ûýù«Ð±ÞFôì”ß渢/=÷¡%DÏ<÷}õ»ãXôûR•ãî6x_ÍÞ?xc _‘ ‰I…êKà¥<%œEˆ§²¬ÒÇš×MŸÁÏl£WcÄKã…^ÄÏÜø€~ò -B·€ójæþYpÃÜW\Uî -7&æ?ø]ýðÇ<¡nÀ|õ⯃ñG¿
—©û
q= 23"ÖAÉE!»r{üñ´RÜí?q7{endstream +xÚÝYÝã¶÷_áG-pfù)‘y¼»¦¸ ¸¢Ý
òæA+qmádÉÑÇnœ¿¾C)˶|wé-Ð X`M†äpæ7¿ÚlMáµ"T¹ÎŒ$Š2µ.ö+ºÞ»¿XБJ%…€‡…·%4QšgëÍ|‘·«¿|ÏÙšS’¦\ ž¦½ÒL#¤Y?”?'ïvùa°Ý݆+š°»_ ~Ài’d:cn…-É Õ~‡fèÚr,†ªm‚ºXbRžFí 悹Nûagaiºi¶kì€OïÛ}^58þ˜ïƒÎý± ì Çÿ¦Š¾ÿx Ì ²¤h›¾ê‡ _·Oø9Äõûc3ä¿ad[TOÇ Íö»XÅ6C5T(Í’êŽ%
Ý$8£;cÄ(Å£Âa§‰;ˆà,ÉñqWÙ.ïî˜NŠ]Uä5J÷yÓ€›3™¼Ðh{ÓÝéd¬Ýæn‘±·%ÊŸÚ¥í6 ªfö‡]ÛU˜yDIûlƒ®?\Ø!oÂJa+Nò>;ó'ªö‡ÚîÁ¹ë†ƒ¡Ã.wáÊT’Ø×õåûüÐã(ºT¼ÏA4‹³›X–Þ¶ïmOÀ-ˆ*ª–ù£ZÕÇ•+° jœ ܳ‡ˆ[ ·~v< ¢·›@ÒUãàQKñpR·ùcg’™ò€bI Obž +ôœA)*ìaˆÔqf§†d +D Öñ›Öñ R +}å7A,û+£c”ú…%%”Æ8yÿiU ¢¿^OI¢0SÔƒ©C>”‚e”<÷á!8|V5T•ËãWóø·áÕÓØøú*ÉsUž›vð>¯Jœ‹–D‚A G +OyùœCÖ•“¦Ï@´64* >2óNgÃŒ&ÌõÀçUlN¾.ÝR Ñ#ë›0Hõ§øn*·Ø†¤°ÝàK{hîôËŒB/-RvÍi¢n0‚b‰ÒHUéŒ +êj»^¬û h‚*"¸‘K4Ñ·õ3v£®tgihM2îc`ˆŠw.°Ëº >,)…¼â`7!] +> YÉàT&³ëdQ ¶®ÂŠ¾QaÁô'ìL, +¸×S^ÛIÀ“ ÿõ÷7¨¹kûa¦ ¼VÇêvñÍA
DŠÑ
úþ ®ø} °ÝþüUè[o#zvÊosÜ Ñ—žƒ[Ñ¢gžû¾úÍql +ôûR•Ãî6x_ÍÞ?xc _‘ ©!RªôKàe‚PÁ#ĆSYVébÍ;ŒŸÁÏl£WcÄK㡪/ágnü @?y +š[}¡[Ày5sÿ,¸áî‹®Œ¥î +ADÆåüg¿«Ÿÿ¸§` Ô
˜¯µ^ü0þô·Š¸_Ñ# §r ”\²+·Ç_O+ÅÝþ-Õ «endstream endobj -866 0 obj << +871 0 obj << /Type /Page -/Contents 867 0 R -/Resources 865 0 R +/Contents 872 0 R +/Resources 870 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 881 0 R +/Parent 886 0 R >> endobj -868 0 obj << -/D [866 0 R /XYZ 85.0394 794.5015 null] +873 0 obj << +/D [871 0 R /XYZ 85.0394 794.5015 null] >> endobj 6 0 obj << -/D [866 0 R /XYZ 85.0394 769.5949 null] +/D [871 0 R /XYZ 85.0394 769.5949 null] >> endobj -869 0 obj << -/D [866 0 R /XYZ 85.0394 582.8476 null] +874 0 obj << +/D [871 0 R /XYZ 85.0394 582.8476 null] >> endobj 10 0 obj << -/D [866 0 R /XYZ 85.0394 512.9824 null] +/D [871 0 R /XYZ 85.0394 512.9824 null] >> endobj -870 0 obj << -/D [866 0 R /XYZ 85.0394 474.7837 null] +875 0 obj << +/D [871 0 R /XYZ 85.0394 474.7837 null] >> endobj 14 0 obj << -/D [866 0 R /XYZ 85.0394 399.5462 null] +/D [871 0 R /XYZ 85.0394 399.5462 null] >> endobj -871 0 obj << -/D [866 0 R /XYZ 85.0394 363.8828 null] +876 0 obj << +/D [871 0 R /XYZ 85.0394 363.8828 null] >> endobj 18 0 obj << -/D [866 0 R /XYZ 85.0394 223.0066 null] +/D [871 0 R /XYZ 85.0394 223.0066 null] >> endobj -875 0 obj << -/D [866 0 R /XYZ 85.0394 190.9009 null] +880 0 obj << +/D [871 0 R /XYZ 85.0394 190.9009 null] >> endobj -876 0 obj << -/D [866 0 R /XYZ 85.0394 170.4169 null] +881 0 obj << +/D [871 0 R /XYZ 85.0394 170.4169 null] >> endobj -877 0 obj << -/D [866 0 R /XYZ 85.0394 158.4617 null] +882 0 obj << +/D [871 0 R /XYZ 85.0394 158.4617 null] >> endobj -865 0 obj << -/Font << /F21 654 0 R /F23 678 0 R /F47 874 0 R /F39 858 0 R /F48 880 0 R >> +870 0 obj << +/Font << /F21 658 0 R /F23 682 0 R /F47 879 0 R /F39 863 0 R /F48 885 0 R >> /ProcSet [ /PDF /Text ] >> endobj -884 0 obj << -/Length 3270 -/Filter /FlateDecode ->> -stream -xÚÍZK“Ûƾï¯à‘[%NægnkKŠå*l-S®ÄÖ$†$J -“&áì?¤Piªgû› 4" Œñ3åÍÃÍÏý†ƒU÷ꤦ”ÚDzBUÚL©*LEd` UµÜYoS—e}*ª-ý\×Õ£º¢®ZšÈ·*™3ñ±µ9ŠŠž¹mׇ¢¼PoèÙù¾{sÿ²ßü7)õöxÈð¯©Kû×K•F‰ˆ”®ƒ@ÀÿïÒ©NE,ã þgoy>ä œB¤aøè= {ñп1ÞjáeZÄF‹P½½‚¡kÇH“x›|IFd®[¥Ô¼ ê|:[¨D3ÿåVˉ.ôßvOú
ÒX¤*Åsz^þ;éPîâÿDaZŠ0„½'=ÜkLÃí ÂÀiì£}:ÕÎwóe‡ø‘^Ñ:¦¥£~]|FÏŽ¤œÿRäÝîym#éŸ\]FæWÕ¥4ì&) <f‡"[•öÕÕ€‹?¯®¢âc„_וÄXRšyçÂ]VúHØ ;¸‰‘‘áü×åmªçösÇk mµ.ë«ØÙ~:Ž¢ëê?Ú®ýð¬F‡¼þQ=g˜ÿGxÕ2I *_ “c†©î*åé8Ab åE`?Éúl55S0äÃA΋`W™‚æ €$ømŸý^ÖûÌ›ã>ÛóìÃSÛÙý5<pWcä @<™Æé «&zÞ Mí"q¢(#Âd·sþ -`{<gV‘¼z†ÕH‰( ¼ªº]ÖýÙ/ âv›UÅ|ÆŒ±D ‘3ûÙzÍ !N´šž4O ””©%
/§;'ë‘kbè¢Ã3Ë÷E…wV -ÍjÌ€èpá™Î_e.ÀRUçLDXÃx¬az~ÑÏSå¢KXxÈ„^NDŒUÝH±×Ú„˜˜$q8¸D°9¡&3ßÏ•?Ã=ÊleKfÝÄ)Å€R¢ 2ãkëm©•æû¯Ë¥<†R½ÈŠ±Úp B d[ùL -âNœªa©ënB· -`w ù -!A=]Ĺ%aØ€ <Éä »!ÉDA‚Šž§CÑu–`Ò¤QÆïgôÀícÀ@ž¥×ŽÁAýÎå Åv×ÑÐ)‰í†g(Ààþ¶ÉÀÁýÀ3¯;ôp(…æwcð@·Æ±@a©²¾€««’1ÅÊw]ª’*O -Ý€+ë}“USaNC²0&ò×ñÕèø7ÕZL¥óX$‘ñ¡q] ËœŽYÙ‰N‚I…†¼ÅÔõñ€| -–S -L.ß»Çeð¨ï³gLÉ©s"gÀÒ&ñÂØk -€ -¾ -ŠÆáîW}ÞžêL\ï6pT CÙ©R=ÔÐôí
WiåÖÅ¢¤J, ÷w\õEWpTP‚î‹mÅÕÜfºÚŒ¸Ë¡â‰¥áÄ m €`Ù2 q¸±‡aµ÷.và bÍÆß¼fR£¹õM…¶{ÞQT -U+”3-›Ä|ÃSzúÅð…k+]ï{å+wS¾¢!^F‘R#~®¿ xªopq½Ûó] ä8}ÝÅ0ÜÅøç3ywÜ£ÀAh3Ó‡ÚÆ °vÀ »®µÑ©+øM Œ õ xÅR‚ –€7Š=Æ‘¬âéŽÏ² RHG>g8]à /6ÈÁ†3kµæ“W¶;Y,Ïh*Í2Œ¯Í +889 0 obj << +/Length 3125 +/Filter /FlateDecode +>> +stream +xÚÍ]“Û¶ñý~… u3‹~öíÛ3“sb«“i<P"¤ã˜"’:ùò뻋]P¤„³Ý6fî+`ìö 'þä"Šƒ8SÙ"É 2Zl7b±‡¹¿ÝHÆY9¤Õë›õÍ_^ëd‘Y¬âÅz7Ù+
DšÊźø°”AÜÂb¹þîÕíJEbùòíwoî ¾¿ûGßÿãýúÕÿ""ñòþ=|äíJÊ8Ëo¿»ûqýê ÍKÞòÍýúÝÛ—ÿvýæíýí¯ëïo^Gª§œI¡‘äßn>ü*0øýt–F‹üÌ2µ8Ü„‘¢Pk7Rݼ¿ùiÜp2k—z%%E t¬<¢RÚ'ª( b
S(ªõƒ!övMU5§²ÞÓÏmS?šz(›º§¼»•é’‘½)*kú¦ßve;YÐìè;¸¾ysÿrÜü!ÔþØå¸ÀÉ_¨ÊüõR¤qÄR +h€½t+æ[ O«D« ’ᨯpjÚIdi²Ht ¶$bR×”rÙLe¾™dª´^þ|«ÄDEòï‡'|Ã, 2™á9#-ÿ w(G
wñ"0%‚(‚½½î$¦àö…Qh%öÑ<k»E¼ƒÿÈ&K”JèDa±_—ŸÐ²c!–?—Åðð¼´ˆìO.. +3o»Ë+ç Ûã +Ë~€Ìá8XWèE>䛼7ãêìa á~ ÐizÚ®¬wMwp¦ð“fy»ò ¿%µbÞìl ~ÉåCÓ4^c=VÔˆú#!åEÁÇ÷…l +€ÇrkëÑt}nS@FYѨ]Ø ‡ñü íYŸ÷j@û (ÚÀæ¸3ŽÈ{lØN&ü µm¶ùo0.ƒØŠÔ.û¶*AÿÖÚ¢eÕ4 :¶ôKÖЗӷÈ\[¹|"4ZqÊ ÊeÍrH…î=CÙ,ͦ™yìPk/Z2rUB êžlÆù‚Î;=Ði½© ææ·£éJ« @¡ëWµfº…À÷À¦ä¡µ¨,‹æ¶S[“×ö°µì! | +‘(¶ +ÕVx ›–ÎC™k'HX-hÊ€®V±ŠèÊá$yI„2>zæäpd¼<VW8õÌ +| „S»P +B×ó9õÅ|›4´£xx qFPB¬ßæ©kɆ O’Éi išÁ#[ %J;…ûS8„J#E9%óhº¦\8ä̾¤rvÞe(GA„š¾§® Ã?0j”óúœ>è£mdØ +¾•“Â` nç‰p€rÿ0h…‚ÈfÇ#äbpÓæ`àn ›À·h´p(©–w¾|È’@Ž©6®lꊓŠëÞÔ%DU‚O% ìÌÊ]]Ë7¿æüƒ Ï›y¼¶÷2ŸòC[ÙËD.G‹˜-R÷[ÃXœ®áÀ@dB0°mm^ûÜœ‚h¡uì®ã«Ùñoêmà‹çIÆÚ¹Æms¬ +:fc<
µ".ÆnŽ Ò0ŸPæ3P©ƒ( åxûÉ:#ˆ0fÚ:a^xNZæÝ̬T2Rê= @‘:Gƒ.³”D50˜WK#•yD«@ÐéÃ"6„Gi×5 Ò +Xÿ»üGAfn˜cSï]Z0—.zSá8ä]}IR™f\æD{Üœý0¸Í4 ’0Œæ^ +b5:”ÀyÈ,º¸+¤€$u9@yß7Û’C.üƸH«#™D³dŒf +Î +J}¹¯¹šÛù«Í˜Û 2ñLM/ :i
5 +÷&M¾d)#þjºàZK×û^ÙÊÏVøË8–rFÏõÛ‚Ãú×»=ßÆ@Š³8UWm ÍmŒ>v/›øª„JÓ£¯mM‡ÅŽ lÛÖZe¶â×cú Ŭ Õ+Ö4a“ XQ Бä5|ÔíC2:Íñ¢Ü!;õ–OÞ˜ád°>C$_œ E I¾Ò“”×qHHS9kí=³¡-¡:½Åø—êw½ypv»ï¸) +S™ýä-ç깇bë¤Âˆ;=Ÿµmê ®c?Ý *؇ñù »”åþèmÓ+ô‚¥ÿ±%:W€Ï$üE‰ endobj -883 0 obj << +888 0 obj << /Type /Page -/Contents 884 0 R -/Resources 882 0 R +/Contents 889 0 R +/Resources 887 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 881 0 R -/Annots [ 891 0 R 892 0 R ] +/Parent 886 0 R +/Annots [ 896 0 R 897 0 R ] >> endobj -891 0 obj << +896 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [272.8897 231.1055 329.1084 243.1651] +/Rect [272.8897 210.0781 329.1084 222.1378] /Subtype /Link /A << /S /GoTo /D (types_of_resource_records_and_when_to_use_them) >> >> endobj -892 0 obj << +897 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [190.6691 203.5826 249.6573 212.9922] +/Rect [190.6691 182.1322 249.6573 191.5418] /Subtype /Link /A << /S /GoTo /D (rfcs) >> >> endobj -885 0 obj << -/D [883 0 R /XYZ 56.6929 794.5015 null] +890 0 obj << +/D [888 0 R /XYZ 56.6929 794.5015 null] >> endobj -886 0 obj << -/D [883 0 R /XYZ 56.6929 756.8229 null] +891 0 obj << +/D [888 0 R /XYZ 56.6929 756.8229 null] >> endobj -887 0 obj << -/D [883 0 R /XYZ 56.6929 744.8677 null] +892 0 obj << +/D [888 0 R /XYZ 56.6929 744.8677 null] >> endobj 22 0 obj << -/D [883 0 R /XYZ 56.6929 651.295 null] +/D [888 0 R /XYZ 56.6929 649.0335 null] >> endobj -888 0 obj << -/D [883 0 R /XYZ 56.6929 612.4036 null] +893 0 obj << +/D [888 0 R /XYZ 56.6929 609.5205 null] >> endobj 26 0 obj << -/D [883 0 R /XYZ 56.6929 567.3837 null] +/D [888 0 R /XYZ 56.6929 551.1302 null] >> endobj -889 0 obj << -/D [883 0 R /XYZ 56.6929 542.6255 null] +894 0 obj << +/D [888 0 R /XYZ 56.6929 525.7505 null] >> endobj 30 0 obj << -/D [883 0 R /XYZ 56.6929 441.1968 null] +/D [888 0 R /XYZ 56.6929 422.4834 null] >> endobj -890 0 obj << -/D [883 0 R /XYZ 56.6929 415.1634 null] +895 0 obj << +/D [888 0 R /XYZ 56.6929 395.8284 null] >> endobj 34 0 obj << -/D [883 0 R /XYZ 56.6929 188.7253 null] +/D [888 0 R /XYZ 56.6929 166.2827 null] >> endobj -893 0 obj << -/D [883 0 R /XYZ 56.6929 161.3171 null] +898 0 obj << +/D [888 0 R /XYZ 56.6929 138.253 null] >> endobj -882 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F47 874 0 R /F39 858 0 R /F21 654 0 R >> +887 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F47 879 0 R /F39 863 0 R /F21 658 0 R >> /ProcSet [ /PDF /Text ] >> endobj -898 0 obj << -/Length 3430 -/Filter /FlateDecode ->> -stream -xÚ¥ZÝsÛ6÷_¡·È35 @>ºMrMg’ôwn:m (‰²8¦HHÅõýõ·‹]€” 'íÜøAà\,»¿ý åBÀŸ\&ºÌ®Ì3#¤Y¬÷Wbqsÿ¼’¼æ&,º™¯úþîê oµ[”Yi•]Ümg¼ŠL…\Üm~[þðãíÏwo>]ß(#–2»¾1V,ß}¸ûôñõ/?ܽûøáúFJëp.çÙ» ßÐò× ßß¾û@ã·ï™úù×ÏwoÞÓøwaÄëŸáG^ÿq÷ÓÕ›»(õüdRhù?W¿ý!8àOW"Óeað 2Y–j±¿ÊÎL®u ´WŸ¯þÎfý«)M]d¦P.¡*¥Sª2ef5L¡ªÞöG8•Ê—M7ŒU·®¿ƒG-–뾚Mí'ÍrÜÕxTÐ}9c(¥ÎÊ 6žUýgµ?´u¶î÷´ølwë²²’×nú}Õt´óã®YïhŸ¦[·§M=ÐDWíih–É–äËjHIba\JËÜwý0fUUeA$|eq£ÌJ•ƒMI£üâ´¸JdÊšVÝ&µk™)¡Ô|ÓÕj•}]Rɬ(\x«þR£t:îO÷xHý’¾Î¬2QÝè%/ýoßÕ´ÉLÁ°MßµODßÔm}_
Ü:MmÁ.HiBg© ¥½`&+Jk‚Òf²”™ËÕ7”\€™ ®oë÷œ'ž| -ýÄ
¿W¾ñx-‹e=\¼Âþ„ÃÙÞ+~‡oºfòÈõÀôHCt;
õñK} È}Ĺ¼¯(Ã/(a—Þ¥Ù¯ -Ææï"î„¢ly«1nù|/@We]Î<Æú¸oºªMl¦s¸YaÏ7wÕÈ›
LÚU|²®Olgm&TpÊá´¢³
‰ýr—¹°Ð›¯™+<¾Ê.ê :X)Ï/ÈëX;o¾ÚNˆ‹$ð4?¨™' §y n°®#Ñé*aà/°ïGZ¹{“Žû¸I6[ƒ¬wá}Ònßö÷¼#±° *ÞªéÆS36_êIÊ3Ã#zDã N÷÷dûàœtH~êOD"ƒ«6Dþôö‡F—µw¤ ‡9½FxÖ0Ëž(÷^-š€ -ÔXCõ@ÏMÛ’ia’ÐÑ£9<Wô”ºM"c÷Dñ˜‚ZÈ -¸{|*./ ðÎ4ÏçR!`à -ÖëÓè‚9„ó÷?ÄTvODp„'¦õDò³ ’úHx ôM½‚ÐO¸Þtp -ü È4vÕ'îëbq„Ç}½ÞU]<PfâÁ‹‡ )Äa†QR‡^˜¡ô£ð†Òü%13JP=°&¢ÔÄW0³©0ðÅEò‚¡–´6?o ù¦§g–¸h“ÉÜËê“i¦›1gp©¯rÍef¤6Ñ~øÊJ@^(€Î*¡wˆoÒ5C¾®J …ÙõõÌÖ•dã’f^‰ºòô'"Ra*)ÛöÝ…pHãEÑb€æÛ@%óöØ:gŠ}V_•ÎG™8²¾P#öÛ´vUîbÿù`³&õž -L8éí”_éü%›•VfBä¡ -¥BÒ= ó8°k„Óâ²sÍ€¨µ!Žö“ S= szJ†€\… îÐ|€Å>[@ú®ëw:AöC`ñ\5ª<0…9\<BV?l“ÁÉÀ½Ø\NÁÂØò2XèЊB^ dQŽÚ¤¥ û¯Àó\K¼1ôµ„é† ¹ÛëÎÒmR]çb„óŒŒ%EÎî
ë}ÎÌÁ ¹-† úahV [ ÷”1àmÐ[cJ†x‹8åm ʨw] -îcpËGªd6¡*©¸T™¼4TF04a‡ºåZêx g<æèí3cZñ¾M‡°óž ½Ìˆ¾è€/ -#qÙÜ#â¬kƒ\E‰YÒ&g‹œ¥=r–íHV‰¤L—Ekº|‡×õÛ±fH€³üRrj$9{¢ÏøøˆÚÚ5›MÌàXlV)8ÂÅ¡îM¾üHñ,GK¦iÛþâ˜x•ˆ4i¸—ªl(<4© ¨Qe³wVõ®ñwr|$átêG4•¯}Ô ÃMmûùퟺÉþ‚M¯ûýþ„í”B^äê˜ß6!ŒæÕŸFü¥˜ÿ¶›ì¥ÎÒ&Ãÿ¨J´9EüfôÿãÖôÿk¹Ã¬V¥û¥Z”øQ(TZù¬ þÁë¹äÿ2/I¾endstream +903 0 obj << +/Length 3414 +/Filter /FlateDecode +>> +stream +xÚ¥ZKsã6¾ûWè¹jÍàA +a²¢´á¦f²”™ËÕW„\€Ž™ ®¯Ë÷tÎ +Bƒc34ÏõÈå‰â‘=½ r‚
öÇÇGÒ}0N: +$¿vG"‘ÂUk"þð}O-ˆÂ´7¤ ›9½D¸×ð” Q ½X4 +Ú½¢¤bü²êÿr…û€º– Èuüç˜âÙKŠy{„°ëРÆáäÍ0Å#÷—Ì‚² _Xy‡«4Øòǧǚh>½§Ç*x¶uÕs¿K Á¶ÑOuÊ-~Çf ->øDÄ)Ày•ZNŽ/ £øLeð~È¿QtœOpÈëj¨¨EçÄ#é˜,¬`Î Ê9ntáæ‹ëRÍÑO8Xð„òu Ç ‰¢¤tm}¨|Bd®@
*4‚I îêá¥;<õ¡jÚ#GCè‰ c?ÐH¯4nã5ϯôÒQ£ã‰c†é©,é›RM•…#$΃B2Ü?Ô§ù"³Ü'ýsÝïï(áqór·[|+Î ðÊÔÏûRÁ]Cñüâ3ttý =FÜÞúÊ…ï_úxÉÏÏ
JÓŠqf–³ç–ºöÕê))ªz@¸4ºW@áüù÷1Ý á•i Q ùÜ
È@}!´úº^‚ã'T¯:Ø +n±=*‚«wzŒÐx¢KìÏñ¸‹¨i{ + ˜0¸†¥^!ž¥ð +ÍÈ)´c‘Â|Fææ¡f63 +O=°& wœWðdcZ*…— ™¤µùiÙȸýd‰ƒ6™Ì]Ь.dJÐæ &õÅYs™©MÔ >²W˜S·ùñMš fHÁWUOA +fD +_tÀ€ÌvØüM„ù¹…S &cÃQðføˆ‘€:úMϣΠ+4´â9§îåÌüváâ}Ï1[,ò\\ÔG S=Ÿ^ÌÉ:ÐmZc´“1àp¨/÷‚ã~¤Fñ_ [€ƒUÁÁÒß.¨rlõ ØpŸ…Ô8è m¨þ°·ì§_Så þpäœþå‘óß-¦ëE*ýCŸ« g¶ÌŒÖgeŽÑAè)èpÅ Ô%_* { Ðå7‚¤§ºÞûÀ(Þb1AÓ!ñG¢·Âñ¦+ܪ³_Ç¥÷uÍ7kÇ=uU+ +¢ü
XÇÃÕXT
p~ÅCê,x^®¤zç;š›ˆ|¦„§¹`õ\5mµ )"_œâ€´íÙ$X5ìÆ‹¬¦j¹Ž8Bé…D›^¿šr +¡‚—†HÙ[‚ ÿï”(L‰Xãÿ¿ÿV5þ»,w™. +•®piQâEpd +£¼( endobj -897 0 obj << +902 0 obj << /Type /Page -/Contents 898 0 R -/Resources 896 0 R +/Contents 903 0 R +/Resources 901 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 881 0 R -/Annots [ 901 0 R 902 0 R ] +/Parent 886 0 R +/Annots [ 906 0 R 907 0 R ] >> endobj -901 0 obj << +906 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [519.8432 497.8292 539.579 509.8889] +/Rect [519.8432 463.1122 539.579 475.1718] /Subtype /Link /A << /S /GoTo /D (diagnostic_tools) >> >> endobj -902 0 obj << +907 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.0431 486.5416 133.308 497.9337] +/Rect [84.0431 451.8246 133.308 463.2167] /Subtype /Link /A << /S /GoTo /D (diagnostic_tools) >> >> endobj -899 0 obj << -/D [897 0 R /XYZ 85.0394 794.5015 null] +904 0 obj << +/D [902 0 R /XYZ 85.0394 794.5015 null] >> endobj 38 0 obj << -/D [897 0 R /XYZ 85.0394 603.5324 null] +/D [902 0 R /XYZ 85.0394 570.5252 null] >> endobj -900 0 obj << -/D [897 0 R /XYZ 85.0394 575.1064 null] +905 0 obj << +/D [902 0 R /XYZ 85.0394 541.3751 null] >> endobj 42 0 obj << -/D [897 0 R /XYZ 85.0394 470.0596 null] +/D [902 0 R /XYZ 85.0394 434.1868 null] >> endobj -903 0 obj << -/D [897 0 R /XYZ 85.0394 443.1738 null] +908 0 obj << +/D [902 0 R /XYZ 85.0394 406.5769 null] >> endobj 46 0 obj << -/D [897 0 R /XYZ 85.0394 339.8943 null] +/D [902 0 R /XYZ 85.0394 301.1559 null] >> endobj -904 0 obj << -/D [897 0 R /XYZ 85.0394 316.1468 null] +909 0 obj << +/D [902 0 R /XYZ 85.0394 276.6843 null] >> endobj 50 0 obj << -/D [897 0 R /XYZ 85.0394 241.2623 null] +/D [902 0 R /XYZ 85.0394 200.1512 null] >> endobj -905 0 obj << -/D [897 0 R /XYZ 85.0394 217.5147 null] +910 0 obj << +/D [902 0 R /XYZ 85.0394 175.6796 null] >> endobj -896 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F39 858 0 R /F47 874 0 R /F21 654 0 R >> +901 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F47 879 0 R /F39 863 0 R /F21 658 0 R >> /ProcSet [ /PDF /Text ] >> endobj -909 0 obj << -/Length 2282 +914 0 obj << +/Length 2458 /Filter /FlateDecode >> stream -xÚ¥Ërã¸ñî¯Ð-tÕŠK -¾÷ \*TÐݎ؃¶~eX\/ˆÛ´E«µR*L£XÖ£úf©_õ¶FÜ^·§_xä¾;6Ä$u¤i± êšVà•´Ÿ0تkù>i²4}O -â’°Û1îˆóŸ™µ¥_~w¿ÀU@"H¥*ÙºËu×}^—¼?Çû›ÀÀã“5ðÉueZ ¶%â0ÎcÈ>" %sŠÿûB` •æAÕø7(¼àº-
¸d³kñVÏ©ÆÝ(! 1Ü ˜ -x¨mO'Gx`=ª£¿w¾`6OÓ$x®@Œéâ‚kÏâÊE*(dãh.·ó-8ÒíŽÎÊ1…"tL°©Z[5Ú’ã#f׶wÆH,؇áÀšeó*/ÊÔ;Öì©·ÆM“Ê™·.ʺà<E(áq.žñ.]°bE’_Îølð›noMKË¡÷1ÓŸÛ®=7ÝЃ6„A8šÀ¹S6+'" jӾ؀<(“OÉ[aq:T%ciúa%uîwG°FŸ‰ÂÖÌ‘¬®ZÃ(UK¿Ö Àžˆ·ˆÿÈaRl8ta5&
¤ÖÓM0¸%§rÉc!ã¸
ê!¾°ØÜ'IP5ãŽÂ ׿Œ1}Ëfó õ-ˆ¤©}vêû®¬Àíxªœ"aetÉ+Ÿ4·(Í êu²ùÅeõ‡:'ĬëJBÁ½ÄOÝñ¤;ÔÍí ÞÈERʹéL«°ñ 1¥â,Øu.,ñ¼³¼0Ðe¸ÀT#`ÃJâ]óZË»›,™r¡ue¡†ºJ!‹©¢-Øó³R >Ý.u%Øfñ”_Q7K¥ -s;Þ1~e1½¨”û1¤4"ÏIŒ¼¥ »ó·Ic¦ñk¢'(u~ê½öq²Ô|†€ü÷'Nf~ñeu6§c]…B*¢l¬«)WÕÛ¡œ†î°>C_\½ÖŒòµ«Íÿ<µgQðÃãÓGZùÑk6ýd«UŒtk¨ƒ1¢Ã ]¶Æ_úi4¤#&@è<ýA*Å 9Ž€pXë7suËÎÍv·¤ü©`ð´6û¬íÒEÍŸ§ù¤7Ž@ãh}?ûŸG£è²’|êNfª|±„9™G‚[~U -¿õûëÙ꽫bþ)åZu÷2æ÷ ¯½ê#´’ø!©µÈ¹td…ïô¤woºµú „ .‘d8¿å`v0
ºö’áz{àIãÞe\®- -—kóèÃEúRîlý§†ÙG'ç£éµ‚ç_ ÒIKF·Yîì" -©üw£ ŠkÇ{aØNÂ,/2ßå¹G°+³tÔ¹oÏÒ›éwU)›SÄ‚.R^MeÓ@NM¸"‰©ô¶ª+{& ¹:*2A0
hëÒ:ê]N d{MX9G€_*ñHêÊäâŠØ0?ÏW¬Éf¸º°Ù‚‹^·ïE<³[¡¨’Ów% -ejѪ€Ç*EF ½ÍRqÕâqÖª)Ê_¸2PyL|Jwåˆ?/ÕºôýwÕö ö‹4xÝ=¼óýÊ~´^øZ …îÿþ6>ý‹ ÎB•çrúì®>Ç9a¡\In$÷ ÑoEÿ7>“endstream +xڥ˒ã¶ñ>_¡[4U š +Yþýî×ßÂU üù. TžÅ«LÂ@ä¹\5wQ¬‚8RÊCê»ç»Œg«n뢤DH•ÈQIµ$ª8K(ªwp9®‹®ý†òe8j[u-O{s¼ÙÚÐÔîyp8V>žiÒèÞš÷æøêÇ•íM½ãqO_ÍhÖèÚîö0^·³†y væHƒ’Yé˜ Û <á¯RFûª,a3(¤z ò8–îªÌ6"z]_ô«âhý¹5´<ô<ØuÈ_ƒ ‡·[ H‹1Ê!$2 +ëÖòT „ +‚>a·£ßÑÉå£-}ùÞý©àÓA"U¾x¬Û\wÝ·á°dý)^Üï¤`êðIxåº2í6ð0 +¢,‚Ì&Ò W2%ÿ¿Ïåô£’l]5ÞÇ
rϸn &™òšAÜÕs¨q; +G ·{¦Â + jÛÓ +ú.Xêïè÷/Ž'·Ÿ+`cÚ¸˜‰F¿r ¤rrÙ(œóíl –(ÊG¡ã™¼ ¡cp€IÕZÈ/– ?r鼿3ÎA"Á6 wÕ«€½0UohN`K½UnP*yí"¯ Æ“2 çâoÒ-ÆAžÇÙ•ãÌó›¯0ÕõÞgúsÛµç¦z†€â U07'*fÒumÚªERRaò*Y+ Nûª`,M %Ü’`>…™#Y]µ†Qª–¾Ö3À–ˆ»èüñ„IP0a×…ÑT1¥\1e¨pKFå‚Ç‚ÍmÏW)}s Çëªgä^8þeôi¬‰7›_¨&&@(Mí£SßwEfW^×
F<òAspƒÂÌ¡^vS)q‘ý!Ï 1«è¡°àZâ§îxÒÇeó?놯d" ÅÜd&U˜ø€˜ÌBqº.;ç–¸ÞY ôV¨2¨HJf9&,Ô««Cm,Ïn¢d„ÆT"c¦ù”Ñt‡ñY)Ÿn—ªì|ÒhŠ¯(›¥T +iâ;.Pw…°s7¨ì@Va$ê÷´DF …Þ˜óY€GZF£éKõê‰÷•]ÌÝÎ\‰)ZˆÂÒì²ÖEC•(_=H y rZ~DŠáefkŠ(Å6Ýá’P£0-$æçÔ
—‰µWìDh¢‰‰vh¶d¹×"oèB#®bê <‰ &dg°¬[Ìx†ÙeÇêÞKÔØá¹}¾#Elr|¨¶uÏ«]|3–ϲ{Š ÃËÞ ¡ýQcLÖÇÂJÍý’<_±Z0F~tmŒ0Öºå’ñ+‹áE%\!¥yNb<[:·;_6I ÁÔ~Lô¥ÊO½U>Nšš÷ÿþÂÁÌ· ®CO8«Þ6åÔ p…õ êâêàŸ¾tµùÓ]{®x|zO#ßzͺŸ4dq#°jà Ý*à MïD7ÃESzHJgoO0¦J
tžþ ”b„ [@X¬õ«¹ÚÀiçfG»XGM ƒ»µÙ³–K9*œæÞØ] õõì ·FW5ìÇîd¦ÌI蓹õȹäW9œ6´6¬=M»Ã:·Þ¾ËÆ%Ò ŽÛªà 9=lá»~Ý[½µUÌŸR®åXw/c|ÏpÛA ¡”Ä‹I¥EÆ©#Í}¥ ]¾êÖê4‚¸@’bÿ–A€aØÞ44êÚË×ëWw/ãbmž»X›…ÎÓ—bgëŸfNÎF“kÏ_ ’IJF³Y®ìB©ü»ÑÅwöB³ i–§¾Ês—`3„£ØÍ’QVäº=MnºOX,« C6¦ˆU¤Ì.ãíÔSѦÈ/1•ÞVueÏ$SBCÅCL
ÚC a å.§DãZFÎàK) I]Ù/€œ_Ñ1|žóç«£Ig8ºÐÙ‚v¯Ë÷<šé-W”Iòé] @ì®wz]ª+chft¶ýð[ +ä4 Õ’Bá nUàhjU +e*Ѳ€Ç,EJ¡¼Mq 9jÕäå/œÆGi²5—Žøy©Ö…¯¿«vzOÖSo9¯ ÞøoÒþ!²ðOH8&ºÿû—éï§(
T–Éå¿TðA8Ê€3åRjxùÿƒæ–õÿ÷Å:êendstream endobj -908 0 obj << +913 0 obj << /Type /Page -/Contents 909 0 R -/Resources 907 0 R +/Contents 914 0 R +/Resources 912 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 881 0 R +/Parent 886 0 R >> endobj -910 0 obj << -/D [908 0 R /XYZ 56.6929 794.5015 null] +915 0 obj << +/D [913 0 R /XYZ 56.6929 794.5015 null] >> endobj 54 0 obj << -/D [908 0 R /XYZ 56.6929 769.5949 null] +/D [913 0 R /XYZ 56.6929 717.7272 null] >> endobj -911 0 obj << -/D [908 0 R /XYZ 56.6929 749.4437 null] +916 0 obj << +/D [913 0 R /XYZ 56.6929 690.4227 null] >> endobj 58 0 obj << -/D [908 0 R /XYZ 56.6929 609.0996 null] +/D [913 0 R /XYZ 56.6929 550.0786 null] >> endobj -912 0 obj << -/D [908 0 R /XYZ 56.6929 584.3177 null] +917 0 obj << +/D [913 0 R /XYZ 56.6929 525.2967 null] >> endobj 62 0 obj << -/D [908 0 R /XYZ 56.6929 452.0712 null] +/D [913 0 R /XYZ 56.6929 393.0502 null] >> endobj -913 0 obj << -/D [908 0 R /XYZ 56.6929 422.2123 null] +918 0 obj << +/D [913 0 R /XYZ 56.6929 363.1913 null] >> endobj -907 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F47 874 0 R >> +912 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F47 879 0 R >> /ProcSet [ /PDF /Text ] >> endobj -916 0 obj << +921 0 obj << /Length 2095 /Filter /FlateDecode >> stream -xÚ•XK“Û8¾çWø¨®jkõ~ g2™ÝlÕ¦¶&½§É Øm±ZHÙq~ý -´ -}ˆM“¸HÚl&Ñ(£ÆAtÝXÏRDÁnÃâú±‘Ú„û4+ƒ_ljôbàMjÐD¥ ‘—ZN9ñ‘¦B3â8¬ó<±f°*`>Ÿ ÔYäȆ†ãM8Òàhí{‰ƒQn3›Q‹Ì³œŽãÔ;I¢éÕ$ž;^'4ýÓUÁ‡^Ñ:L¢š¼öÔ‚Ì4Jqõçï‰>JafºaM PÖþS¨ UÓ_/nDœÉ‚ ‹3#ý?ó˜/ É÷ÿý j0x%nK;^%èùPf\u—f!£•}ƒúF®à3¾sù½x±U—‘³fÞx¤ÓBäHÇÝšŒ kW¥[Þ2ÒÿTP
¥Xt¡'7Ö7mdo¥äÁqœÜqþ,q>wê@–`ì%•OÁïÿ”ÞZ[ËŽsç¼ÜÏQ¦%•E#›Gö~×W5œ8®`Q³Q _Ÿ¿E{ï µ 9VfDÎŒh›Ä²n°Ô ]H*~12 -€—% -4 ±NãØó<aÿi ÷<0ÏÝ'p<ªEK¾â -ZYX¸"J8áfÌ¢ÊRú4 A0>Žß)0_’¤$ÏÍÔb3œK*QcÈ -w
ÑÜ9’®^6qѾ‹´&LÅ/,Ãßr¯ô˜WÛ†…+9 Ü›íŽû - Ñižü+ -×Ûö çé-Ä3‹B¼ ï9‘Z¦’ -Ûd ƒºkú_GF ™Þ)jÇqŽòß7"¨ÙÛwðöëXÎ`ççNI¡o¶‰eaóÈBýõB
÷vùWeRå ž‚ ¿ûh×ÔWY„Ãvâu_èÚ8@–YuÜ’1Nlz?îélsÁu)– O?r'ç à» |“zÓoÂpSWÕÖ¡¿fèG%¿ò-ÝÁŽ-æn _泶XR»V·æK§%›8ÁI¥i‚ÞðØš˜ÏŽ±vr#½×±h°|/ N$=Ñ‘r/€;þPC#¡k zßÑŒ8…\$O2hC |ÚtE• _MsWj3”.ª™m”ÁÄêe³øÕ¼c$×?à^ÔÏÖ‡¸ù»ÅÊ&ûòÍ# ÎãÕ¦:B»Ï 46îSŒO* €‚ïÎAöÃ4ijq•Žœ•Pðú⇠x ˆæ"#Nrý?p½XŒ¤8ù¾‡Eþß…ûìq‹Ç|Û«×ÇóÁCê
8h7È
ËÕ´* +xÚ•XÉ’Û6½û+täTîË1Þ§*®T<9Å9`DHD
… +wQàgY”î ŽÓYYžûYš»‡êoïM-ÎFwû(
¼èßh[âçE ⶠ+JòÚC
2ã ÆÕŸÞ½!ú(…Éš8 ¬ýR¨ UÒ§7"Îtƒ ‹3=} yÌFGòÍ ¡:ƒ&q[êþ*AÏ»<ñÀÔq˜{š…ôVöItê+¹‚Ïø†ñ[ñd
•yµ—‘£f^¤¯©!r¤ã®¯Œ {3$®J×¼¥§ïTP¥Xæ5¡'7Ö7mdk¥¤Þ± ÜqÓYâ|nÔn‚±S +fhWü(½¾Yhov çåvlŒ25©,*Yݳ÷›¦¿ªîÄqˆjØ|SüÍ‚Ø{©uÏ•cqÀ]#Xg±¬,ÕI’Êøߨ ´8͸dD\2lL|£ælV‹„J n Ë`«.hš±š#A&Fªä=¢;I^4¥ ŽTRdûC#4‹hÅ¡V|.ÓÊhMË4`šÑ_ûiÓ\Õ†+ït¿åab\rc8JK§ rgM¢ ÷Ô‘¸·~$Â&TE´´ð¬“a«ì¯nhQYdçJÉk„“âªÒZ¨xm¯v¿•|“UllÑY6HúQƒX½¾G9(©§²æ +dXõcsý.Û~¸ý¿ Šç•‰×:%<ä7IE”èÚ–Ø’ª 2 yÑT +hZvýxªY/ý ‘áÝN6“dy 8xp]Óc~{î0¨”~‚’$¡½„3×|Ó$ý$ÈR¸2Æ/{ë³ý4±òÕc¯ÕW¹aµ¤ôó,ÎXT¦JP¶Ø¶ÖVDÙ6 +^AÁ³"r +DŽ49œvDü¹„šný~¹ æÒû/å¢õ>ÉÃP©_¬MËZç¹—ù +ÜѸU‚>Gy%â*哦tð–RW8 +Ÿ¤IhsÜ]W‰y +Õmíš ™Q‘‚z +â~ó
¯ fÙ"‡èâ9Lt¨ž¹£j¡ mK(ÈÏbµ endobj -915 0 obj << +920 0 obj << /Type /Page -/Contents 916 0 R -/Resources 914 0 R +/Contents 921 0 R +/Resources 919 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 881 0 R -/Annots [ 922 0 R 923 0 R ] +/Parent 886 0 R +/Annots [ 927 0 R 928 0 R ] >> endobj -922 0 obj << +927 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [519.8432 268.1131 539.579 280.1727] /Subtype /Link /A << /S /GoTo /D (acache) >> >> endobj -923 0 obj << +928 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.0431 256.1579 143.605 268.2175] +/Rect [84.0431 256.1579 143.5361 268.2175] /Subtype /Link /A << /S /GoTo /D (acache) >> >> endobj -917 0 obj << -/D [915 0 R /XYZ 85.0394 794.5015 null] +922 0 obj << +/D [920 0 R /XYZ 85.0394 794.5015 null] >> endobj 66 0 obj << -/D [915 0 R /XYZ 85.0394 769.5949 null] +/D [920 0 R /XYZ 85.0394 769.5949 null] >> endobj -918 0 obj << -/D [915 0 R /XYZ 85.0394 574.3444 null] +923 0 obj << +/D [920 0 R /XYZ 85.0394 574.3444 null] >> endobj 70 0 obj << -/D [915 0 R /XYZ 85.0394 574.3444 null] +/D [920 0 R /XYZ 85.0394 574.3444 null] >> endobj -919 0 obj << -/D [915 0 R /XYZ 85.0394 540.5052 null] +924 0 obj << +/D [920 0 R /XYZ 85.0394 540.5052 null] >> endobj 74 0 obj << -/D [915 0 R /XYZ 85.0394 447.7637 null] +/D [920 0 R /XYZ 85.0394 447.7637 null] >> endobj -920 0 obj << -/D [915 0 R /XYZ 85.0394 410.3389 null] +925 0 obj << +/D [920 0 R /XYZ 85.0394 410.3389 null] >> endobj 78 0 obj << -/D [915 0 R /XYZ 85.0394 348.7624 null] +/D [920 0 R /XYZ 85.0394 348.7624 null] >> endobj -921 0 obj << -/D [915 0 R /XYZ 85.0394 311.223 null] +926 0 obj << +/D [920 0 R /XYZ 85.0394 311.223 null] >> endobj 82 0 obj << -/D [915 0 R /XYZ 85.0394 189.9853 null] +/D [920 0 R /XYZ 85.0394 189.9853 null] >> endobj -924 0 obj << -/D [915 0 R /XYZ 85.0394 156.0037 null] +929 0 obj << +/D [920 0 R /XYZ 85.0394 156.0037 null] >> endobj -914 0 obj << -/Font << /F21 654 0 R /F23 678 0 R >> +919 0 obj << +/Font << /F21 658 0 R /F23 682 0 R >> /ProcSet [ /PDF /Text ] >> endobj -928 0 obj << +933 0 obj << /Length 611 /Filter /FlateDecode >> @@ -2751,27 +2799,27 @@ stream xÚ¥TMs›0½ó+t3EÕtÌI;ŽÁÓvÒ £$šbp$Í¿¯@Â&Mzêx<ˆ÷vŸvßzM ˆ,}Q7c‚}vû ƒbÓJP*ݾ-W fü¦=»DÖ+ýÉ\Kií“ ù'çs·?0¦¥ÃUõW`[ïí¡”Ï²´ÇB
>Ém[7¯Ššæ WN¸ênÈÚÊQD·ºïZ3ô¯åc õóÁª˜¯›æ/æñß*ŒKzܹénÐ8AabD\Q½Í„¾«|Üà÷¥ÿ¦œ@šendstream endobj -927 0 obj << +932 0 obj << /Type /Page -/Contents 928 0 R -/Resources 926 0 R +/Contents 933 0 R +/Resources 931 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 881 0 R +/Parent 886 0 R >> endobj -929 0 obj << -/D [927 0 R /XYZ 56.6929 794.5015 null] +934 0 obj << +/D [932 0 R /XYZ 56.6929 794.5015 null] >> endobj 86 0 obj << -/D [927 0 R /XYZ 56.6929 769.5949 null] +/D [932 0 R /XYZ 56.6929 769.5949 null] >> endobj -930 0 obj << -/D [927 0 R /XYZ 56.6929 744.7247 null] +935 0 obj << +/D [932 0 R /XYZ 56.6929 744.7247 null] >> endobj -926 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R >> +931 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R >> /ProcSet [ /PDF /Text ] >> endobj -933 0 obj << +938 0 obj << /Length 1222 /Filter /FlateDecode >> @@ -2781,268 +2829,274 @@ xÚÍWIãD¾÷¯ˆúäH¸âZ¼©OÍ°‰Hs`8TìrbSeìrBƒæ¿ójs6sà ÿ¨2ûù@[ –¤('ðVt„(þ° F —7¯€Ñ K‚sTRRx;Ö›#<鹎{žëøIÜý7¸Pé´«Õqþ›ð™˜1t6Ihb–{â^Ž(áÏ!½Žm‰CÁe 5€B=—âÿëÄæ/n¸GÂä^xÞ`W>¾QAF?°9¯ª™Ù;ë ƒû9âãòíÊwÁ®|»0«ðœIª
Ÿ:½äÊ0
£ •0ö1¦ÿ˜SM™^ÿ^r0m%©ßÑ1¡¨Ä ûOèøéÛíü•¾]hŠÌ—ÐÒwP‰/2î#èñ4ÉPAÊ<2yazïmþ¤zt÷7¯Ì™øendstream endobj -932 0 obj << +937 0 obj << /Type /Page -/Contents 933 0 R -/Resources 931 0 R +/Contents 938 0 R +/Resources 936 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 939 0 R +/Parent 944 0 R >> endobj -934 0 obj << -/D [932 0 R /XYZ 85.0394 794.5015 null] +939 0 obj << +/D [937 0 R /XYZ 85.0394 794.5015 null] >> endobj 90 0 obj << -/D [932 0 R /XYZ 85.0394 769.5949 null] +/D [937 0 R /XYZ 85.0394 769.5949 null] >> endobj -935 0 obj << -/D [932 0 R /XYZ 85.0394 575.896 null] +940 0 obj << +/D [937 0 R /XYZ 85.0394 575.896 null] >> endobj 94 0 obj << -/D [932 0 R /XYZ 85.0394 529.2011 null] +/D [937 0 R /XYZ 85.0394 529.2011 null] >> endobj -936 0 obj << -/D [932 0 R /XYZ 85.0394 492.9468 null] +941 0 obj << +/D [937 0 R /XYZ 85.0394 492.9468 null] >> endobj 98 0 obj << -/D [932 0 R /XYZ 85.0394 492.9468 null] +/D [937 0 R /XYZ 85.0394 492.9468 null] >> endobj -937 0 obj << -/D [932 0 R /XYZ 85.0394 466.0581 null] +942 0 obj << +/D [937 0 R /XYZ 85.0394 466.0581 null] >> endobj 102 0 obj << -/D [932 0 R /XYZ 85.0394 237.1121 null] +/D [937 0 R /XYZ 85.0394 237.1121 null] >> endobj -938 0 obj << -/D [932 0 R /XYZ 85.0394 206.4074 null] +943 0 obj << +/D [937 0 R /XYZ 85.0394 206.4074 null] >> endobj -931 0 obj << -/Font << /F21 654 0 R /F23 678 0 R /F39 858 0 R >> +936 0 obj << +/Font << /F21 658 0 R /F23 682 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -942 0 obj << -/Length 1842 +947 0 obj << +/Length 1859 /Filter /FlateDecode >> stream -xÚÍXYoÛF~ׯ üDÑf/^Í“s8u8®¢Ô(Ò<ÐäÚ"ÂC!)«nÑÿÞÙ%EÉ”í¶Z÷˜ùvvŽe… s<Ÿøœ ’Ä£Ìs’bBk˜{;a–fÖ͆T/“ç'"p"ùÜwW^!¡aÈœEúÅD)p îÙñ‡7Ó÷¨ûéÍ|êyîÏð1ýçoæÇÓ@º‹ÓgŸ¦³€FÒ}õãñù¢£x˜Ç«g'§o?oùL¿.ÞMÞ,z-†š2*´ -ß'_¾R'…ßM(Qè9èP¢ˆ;ÅDz‚xRˆn$Ÿ|šüÔ3 Ìš¥£È1J¸ðùtÑt^D|Á…î÷ªTÓ™O©{D ˆÀ’•³8Mk׫øçþЊ:<"aÀ1F"Ïã†A{»² Š¸iUýÂÒ]¢«,ïvÉ«$ΗUÓ’ZÝ íQãq–U›]Ý"}Y!Éltó?Gw{þ ×^Ø=ãÚ6Ú厨ØnT}Óµ¯*ÛP¿ÅÅ*W$©Š1 ¨
(Ÿ ¬s’^Ž£Õi{znµ…³SM£ìVWVÍ<¾QCí|œçÕF¥ Ê~ë¸l®ÔC` ¼†ÃlwÉ=°ˆæ‡nˆ U¨#ðˆ' qø³ v¿eÄ@Ú7‹òš<€ÆÐ4v©ÿŽyAFUZÇ.rùíèÞû°g!»ö±¯Ú¡{2 ©šN=óœ2C΋
Îëù g“DHpgà²`#Î"ëæùtÆ(°z_Å)ºä—q —IV^Ûåbàð`5‰ Dèꎧ3!¥»ª³"k3}κ g[è–gÐ#¹a®[—=sÓMâÒŽ+\'ËLÝ(KÙYãet㵎3†þé×MÏ«Xçm¶Ê-¥ž²ÐUIe¾iÓ håÃA¿Œ Eú‰€D‚fâD/ä¡èîï3èEÜÍ®ô¨to«)s×Ø^³×´í…P8qqqã½ÏÐMÖ.q¾Tí¦ª¿á°¶+³½ž¯®pŠéàáÅÊ`»Ü®+S¤¶ÃâÙ¨›¨AZl˜ã¢c iªu²ÄVlF<{*Tã©ý t ~ ›í2¶¼“<Sek‡7YžÛáª,Ubi´¯Ô_w[Ú J»MÕ5Úe†¢¡ ØZž-Û¬P?ì§Dî€rGøŒ_²Gå 2‡0 w󊶪“càŠJ€ë(ð²ÍN»]V³N'0íˆHõ9ËΡҎ -y ÌêŠC—N! Å5 -r›ZWéPÓÃ9º§v±G7lNdY^V7&= -ƒmè׈nAu“VE~k{( 2Yä``\â~ÓN¸ee£yfŸ#^à·ïÛ/³ã˜5
'ì—ku?@‘#[ cu‚Öº±!4±òº[µ«Óp¬]×¥J÷ÄH³&‰‡´=Wk mŸ¥rHcd²T°…7RØKUg9¶+£ä[øLòÆwÌ2N>¤ÉÉR ~ò
)¬…™Âb{©8óÀ 1 „1öVCV9«êë›ýH‰ç‡ÂÒ6ëËF_…M¶0Ç|p«*Ê¥]]Ú „ ÙEø$´“¨ßÂ(¥³^uè‰E’ø&àL}í`c>öº¶¥>ìj,–c>7ù¶y@¢¿' ƒ'< „¹ãðzš{eØ礅 c¥á ŠKßg¡~ÿ"~ðî%Жˆ˜$šW<[É%VªŽ‡GÀú¨‚£ð€Yè÷ϊ̲[LcnUåöªŸ»Kt1‹…ÑÐøÇåx «Ìz¼f…žg_6ËÌT!X@¢åÆNªš¤Î.{§!Ìã8ǹ¬„›¸Re_šòR“gñu Þ K´—çºR+²2kZÅ%B_
,k«ÚVHà¾PkCs—Òð +]ª=՛ۦՑ¸‰íŽ r=„PVµcò ¯öŽ_Q—ëëë~¼ç^öÀ6`S,9tYàx¥£J“ªÇ¾Ún¯› ˆÃ¡½O:©Ìë—¼#{÷¾;"ü_Gƒž†endstream +xÚÍËrÛ6ð®¯àøDÍD0^$ÁæäÄvêL⸲RO'Í"!‹>’²êvúï]<HQ2e»gÚá `±Ø]ì“ÄÁðÇó‘ ÒÐ BŽ<L<'ÎGع…½w#bq&-Ò¤õf6:>g¢Ð§¾3[ôh „… Î,ùâ2ÄÐ(`÷òäãÙxB=ì^ŸMÇžçþ ƒžº:›žŒîÎ.>]^'¹ûöÇ“«Y‹ñ4·Ÿ.Ï/Þ}ÞÒ½ Í:)ú’Ì”ßG_¾b'ß0b¡ðœ
L0"aH|Ä=†<ÎX»’®G?u{»úè æF”ùtHuáê¼ùŒ2ºßËBŽ'>ÆîFÀ
PZL¢$©PT¢#³÷‡Ô¡!"€'"…žG5æ~e äQÝÈêµFÅ»H‹4koÉÊ8Ê–eÝ JÞ ía›ç,Ê&]Üü¢4(“ÁËÿ ¼íøØœ½±wF•šå«®eu׋Òò·(_eÅe>ÄaOk=Ì—WV8JæÃÚj¥½¸²ÒÂÛɺ–µ™– +fÝɾÄv?ʲr#« ÒŽUTÔ ù”2 ¿šÂd÷È#: !EÄ<„ +Ô"xÈcÏxüçYyÜ2¢JÚ7‹â=¡¾iìbÿ óÐŒ ŠÐ·Ž]úhþíèQس]ûØíŸ Ð7Xu+ž z¯L_›¥ïEzïu|N‰C8b „,¸È£ˆ’Іy:ž ¤>”QbBò›(‹Š8-níqÖ xpš +ä¡ u'ã ž»ªÒ<mRõÎj +o›HiB™&® yG\O㨰ëöl/Sy'-vjwu”QÀ©Ê3ÿތ뺣•¯³&]e³áʸÔcR›Å_±‡ëu¼´wÕƒªïÈ(eœ˜aÐ!fCÛ±´* ˆr‰: +
4ás*Xëü¯`R7]¨UîÞ—câ®
¼Ô>£p›¥¹Zš››³Þ 5Ù¤ÍÒì²Ù”Õ7³¬ŒR 6¡Kí— ³ETf‚Üdy°SjωÁ¶ËìÕ`Œ%bŒ4Ðo
ãCÅ+,£t€"½Ò>),,JìÌ+Â4—ô Ø,#K;ÎRY4vy“f™].‹BÆGZ5ʨ½*WÆTØkÊh–©aÍðѲø²IsùÃ~M@Ú0u˜Oó9yVQB ìBì%ÿìTËG/Ž äÀœÃ@Ë‚t»¤&LÆCÄqØ<;þ/ÂÜgƒ†ž¯ut ?žpÁˆ;›}PøîÛ'×ÊWy@ÝÙ/WPþqB}w*ërõ [™v¶bæÊG§Ó‡FM´ÿ +ß× +ÞƲƒZéÝ÷²ZyQ7$ºMñžÒ +dŠx¦VØaôî{)l;¬ÿ":RL 8b ¸À¸AÛê=hùh +€¬SËþ‘.oBff¾ï¾¹¸<5û6íµ˜e5²#’ÛÛUæîÝ¿*Û
î–Ÿû–²* ÚÝùAJ§A¨k35FfH Ž]Õ®(ä¢Q%”E挄ڦR->‚‹Bá^ØÚ ؚȒœ—wº<Á6õ«
£Ak””yvog†A©KÐÞÂ0ÇÝ¥-s•á• Ö9ô•ý—ñÚŒÝÜŽÄ®›ª©¿aGªd&Øý ºYÙÊ+@ëÚ¦Dà ΅˜Ví©]™úkͺ*d²ÇF’ÖqÔÇí¨Zãhº*•BÃÑ«RÁrs‘4³D6Qš¸Tzät«>]¼Ñ ³ƒŠS‰Ï¡Ä_ªÇ¿ kaº+Ù:% D!â3ÚÞ*¨*'e•˜æhß1ò|Á,n½ž×Êrcrp…~æƒW h_0åöt¹jR`và检ᖣî +-”ªzå¡ U$äÈ×™ÀìT·Ž¦C¿æ¶Ø‡CÅQ|L§ºÞÖßúÚßã…@Šc zÌ<x Σ<ìSRL ¡¾r©ï¡~ž!_´ýhûKS$ê_€ö7€b%«¨ÿ¤Ë*¦Ûd ~÷O’Xr³1!Ä-ˬÞëÃ>·Nt3fk£¾ñóqÉ Ìz¸á…™g‹Î–©îBB°€Xñm&‰¬ã*ëðŽìá(3{iž¸’E ÍuoªÐÓ趀hÆ*ÊSÕ©åi‘ÖÒÅE2± endobj -941 0 obj << +946 0 obj << /Type /Page -/Contents 942 0 R -/Resources 940 0 R +/Contents 947 0 R +/Resources 945 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 939 0 R -/Annots [ 947 0 R ] +/Parent 944 0 R +/Annots [ 952 0 R ] >> endobj -947 0 obj << +952 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [55.6967 190.8043 126.3509 202.8639] /Subtype /Link /A << /S /GoTo /D (rrset_ordering) >> >> endobj -943 0 obj << -/D [941 0 R /XYZ 56.6929 794.5015 null] +948 0 obj << +/D [946 0 R /XYZ 56.6929 794.5015 null] >> endobj 106 0 obj << -/D [941 0 R /XYZ 56.6929 480.2651 null] +/D [946 0 R /XYZ 56.6929 480.2651 null] >> endobj -944 0 obj << -/D [941 0 R /XYZ 56.6929 441.7923 null] +949 0 obj << +/D [946 0 R /XYZ 56.6929 441.7923 null] >> endobj -945 0 obj << -/D [941 0 R /XYZ 56.6929 373.7178 null] +950 0 obj << +/D [946 0 R /XYZ 56.6929 373.7178 null] >> endobj -946 0 obj << -/D [941 0 R /XYZ 56.6929 361.7627 null] +951 0 obj << +/D [946 0 R /XYZ 56.6929 361.7627 null] >> endobj 110 0 obj << -/D [941 0 R /XYZ 56.6929 167.4388 null] +/D [946 0 R /XYZ 56.6929 167.4388 null] >> endobj -948 0 obj << -/D [941 0 R /XYZ 56.6929 126.8733 null] +953 0 obj << +/D [946 0 R /XYZ 56.6929 126.8733 null] >> endobj 114 0 obj << -/D [941 0 R /XYZ 56.6929 126.8733 null] +/D [946 0 R /XYZ 56.6929 126.8733 null] >> endobj -949 0 obj << -/D [941 0 R /XYZ 56.6929 98.4089 null] +954 0 obj << +/D [946 0 R /XYZ 56.6929 98.4089 null] >> endobj -940 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F21 654 0 R /F23 678 0 R >> +945 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F21 658 0 R /F23 682 0 R >> /ProcSet [ /PDF /Text ] >> endobj -953 0 obj << -/Length 2679 -/Filter /FlateDecode ->> -stream -xÚÕZÝsÛ¸÷_¡—N¥éÅA°O—Ë%×ÜÌ%×Äi ÒÌ”– ‹w©);Îôï À$EJÎø©ãàò·ËÅ~f3 -l¦SBE.gY.IJY:[î®èìžýtÅ<Mˆ’.Õ×W}-²YNrÅÕìzÝÁÒ„jÍf׫Oó—ñëõ«÷‹„§t.È"I¿}ñË+\ù -›öakpˆÒÁ >¶ûc‹cjW´äĦ)ì 8šÒ9WÎƽ×%]ªiŒT £èòÌá-øyžh„gÏ.(˜—’iŸ©µÖ„Ól¾ªw…ÓÕ )ÔAYWøðw|ïT óÓ”Ž¹”¬M|ƒ•C̲AæmhgíÛ즃4n×€w
ÖÁÀö[Ózúz ¿ä
ÚÙA\㹚¿ñÀ›¢ñ¶”‚äT¨¾-µ÷õ"”(+Óüm‘HÆçMi™âzYµæP,ÛòÎ<âÈ™¶€XRà¼{¯9ûv!ÜS0‰_dŸÜír3„ºß”aÑ|1Ëckœ]8û ´/?º˜´),@× -üÙ–·z§=ë ´]lq‚Èž²2V}‚Ñù‹íéózoÍ¥ñè1 ØÉriš¦¼ N·FcÚá ·ÑÂs;õ@Hu\ƒ7HEƒt8â
"±P)ŒÇ\Åû -c© 9Ym~lŠ[3)“D¤Z=K¦fü|L¦@\,Q`eŸ¾GWK»®&R¢UšzWÃè‰d=d¡·õdŸG€‚Qy¿ÆPq -$ÑR O#@)ɳLyg=Iû°7#Xœ³,ÕQ(üÊ1Ù ®{˜ËmÑ4# *%Y*ä -²u•i:7»=Ô å‚Í¿š—œÕ—ËHâ+^ I×ù -›Ai:ÿÁ¯Ìº8n[»ùJ W—ufÝ6øÖiï©ðÑ‹"X¶e±¯^$ôLŠòkPÑÀÞØ"¥2Þ8‹Õ -ͺiL0º›Pú–·Îõ±ZZ³,ü§[ó
vtã-Ô|iMµ2«àÖífàÌ'1À›údbO)'TÁN>#‰v1¦{¤º˜ØeÊ….é92u1¦{¤Š¦‰á=)^®¶‡ëû»ï“åXáУñ<Fü‰ Èón ß^¬ ªUÝ~`{p"ïcâ¦èä_—ñÊ6î 9ÎC¾ LC™ÈD?o L{(MóÔüy&½Û}u
íHr$Ë5jõômåÜ ¥ÛŠ…©ÿÛ¼7 ¸umñi‰OòÌžÉó‰¯K5ø"Õð8¥—ü¸†V3ãç9Gª ¬ä<¦a 'yŸ åh‡£ Û -î7®hÍ)D \Ác¡Û£íE›î’‡ºø -‡ö„í&¾JƉ7f Žƒ=3ì*aäÊÓÜUŸ+wº8b¸h®QD‹V˘òšu_`¤CÌ÷Âtó°GˆEþOòg¢iiœ³uÁ¥ýê6’[ô:<8GÑU§ª 1™ñ' Ñ ÂLÎIr»Ž@'ñHð4 LÂÈ -l1 Ù*ÔŽÜG®<3»äNDá÷±!±³ž°ŽlÝC=[ªñ÷Æ?±.X[W²üÊѨLKÃQÍ0xÜrû´³-®YÓþ¬ž¡ºã˜ÅÍ ¼åŸîͲ´ÈfÈÎï*Œü>HT
—j°sÒ·Ž–Á˜?a ÝG«/†éÂþº>ÏPnhí ÏÈHb7i],ý›xB
ƒuÌ Ukïk4Ñ@ -t_oWn̦¸+k'‘=ãæz~ï‘V^†ªö´ˆGT+ÃÃïí6”#·Yšd2–ˆçJ (™TNÑü™öÇÆŒßi ý†ã(ZS¬ÈXÂDn»Ne“Q’ÉÎÕ#÷W/V»²U ŠP<õúDZ÷Û…·ÅC(ÄCßšÛxâ¿/mÿ¦ ¶óPOCõ~T&8Vk3™ªÕ…Z»K5]kGªà«d¹1ËßÁ×'%·J Ôdùy"Õˆýý¦"1ï‹0yÞÄTìHFÄ `kN2žóÓ‹VßJÙW›Á¾4U[|îÉi=à¬OÆ›a' ™Cq•Jã% åÛéû{«)Ï© ºÓU]¤ºXÕ1}Ž-•ž#Scºª‹Tc;ì‹»ß=aŠ0j ãÌÁ,Û/õ†§’(ž²o½Y—[3qî - =Ï‚PVx–%ÿEt*úÿ +958 0 obj << +/Length 2706 +/Filter /FlateDecode +>> +stream +xÚÕZÝsÛ¸÷_¡—NåéÅA°O—Ë%×ÜÌ%×Äi ÒÌ”– ‰w©);Îôï À$EJÎø©ãàò·ËÅ~f3 +l¦SBE.gY.IJY:[ì®èl
Ï~ºbž& DI—ꇛ«¿¾Ù,'¹âjv³ê`iBµf³›å§ùË¿¿øõæÕû넧t.Èu’*:ûâ—W¸ò ¥éüŸâå»·¯ßüôñý‹ëLÎoÞ¼{{d4—ðæåwßýúêñ½×Ÿo~¾zu¿¢û¥Œ +û \}úLgKøàŸ¯(¹Ng÷0¡„å9Ÿí®d*H*…+Û«Wÿˆ€§îÕ1Í¥B“TólDuœ©.͉\8ÕÙof„]'ŒR:ÿ±,ÖUÝ´å¿öæš16¯ëmc¿ðDήHγÜ!ÝlŒ'ê2e9¡)³²Zše¹ b’äRhOóÝŠ$Z$Ø€€c(9*ã%á’Í‹j9Çaw¸–ž´j¶uýûq?‚)SÐ>Ë<áþpÍô¼^ Š]ðBÏ ·bì$ŸÛ-®.êÝÎ2v“mY µNŽtU p
èŽðÞÎþ8šÃCYqV;ܘÃ94ÄJ8KÏ@ëvž1’§)êÀM[–++ÕÊ p^VøÛ´[ƒC”õ±Ý [ ƒP»¢%'6MaÁÑ”ÎÁ¸r6(éRM›`¤êE—g¯hÁÏó D#<{vAÁ¼”LûLµ&œfóe½+œ†¨M¡ÊºÂ‡kÜñ½S%ÌÿMS:fäR°6ñ
VH 1Ë™·A¢µo7²›Ò¸] +Ü5XÛoMëéëUhü’7h7vfqçjþÆoŠÆÛR +’S¡ú¶ÔÞ×׉ DYšæo׉d|Þ”–)®—UkÅ¢-ïÌ#!Žœi ˆ%ΰçðš³oRÀ=“øEöÉmÑ.6C¨ûMͳ8¶¦ÁYÑ…³ßAûò£{I›Ât ÀŸmÙx«wÚ³Þa@ÛÅ'ˆì)+cÕ'¿Øž>¯÷Ö\ ã,¦iÊÛàt+4¦ Îp»að-<·S„TÇ5xƒTD0H‡#ÞÀ •ÂxÌU¼@Šèbœú'£0–ê‘“ÕæǦX›I™„$"ÕêY2u00ãçc2ªàb‰+ûô=ºZÚu5‘ÒÔ»FO$ë! E8¸'û<ŒÊû5†ŠS Ɉ–" +Ü x"â Â×dU“ +¨€©¾PÕt©¦«šHÕR»LmÈ“T©ó\#Õ[1ŒÂ–Å=¾Óe8“ü|ÍÁiŒ‡G(<ÊÖU¦éÜìöP3”×lþÕ4¸ä¬¾\D_ñJHºÎ`ɬ€SØ JÓùžxiVÅqÛÚÍPµ¸º¨+0ë¶Á·nM{oL…6XÁ²-‹}õ"¡gR”‡Xƒ +ˆöÆ)•ñÆY,—hÖMc‚Ñ݆ҷl½u®ŽÕšeá?Ýšo°£[o¡æKkª¥Y·n7g>‰ÞÔ'{J9¡ +vòI´‹1Ø#ÕÅÄ.sP.tIÏ‘©‹1Ø#U4M ïIñr¹ÍÍý]ˆøÉb,ð{-Cv›Ê<‡&r˜B’·Ë‡jY·“x±)€íEÀ‰ÄßÏ\ï_—ñÊ>î IÎC¾ „¼‰Ê¹ì'îƒi¥ižŽ½»(îj[¬Ç> ‚^¦ùOÆ‘+Ðzˆµ ×4‚dyD¿X¡}[ÉØ/xšð¹ÿ¯Éu:;è4ÚûÓ²«ä™=j’ç³k—j:»Fªá™M/Ãr
ýlÆÏsŽTX3H¬LÃNò>=/Ò:çE¶ËNx&°Ÿ¶ƒÐO‹4ë÷Ðö!n ªºJ:OmêÔ>ué±Qvon·õ}àµñ‹…˜&UN˜à|Ðã;‘2["BVwÝ,Ìü™Œ¼ @s쩳ìÑfá™3[X+nk—JaxËÅ¡¬þ=kM~è?Pù’Õ¯"®Šíðí¸TàŠwXpNA{?&,„9ºðŒ\÷žÍßöÕŠ„^‰@ëÎa`ô¶Ä‘“ž‰`é·cãG>Û‹ 2˽OÌÑÅA³@ÌæƯœ‡c +Ø¿±C _ñXgîUú“U„È8äAö¬*¢‹1]EDª‹U„P”¤\=ëÈ¢‹1]EDªž‹úÜáÙ„ñ©†Z +"U·FNÚ:Y•á¹ßújÂhpôÿ"ŸÄ³C×ù<ž Œ¦*ï%‡¾gë<%ŒœQ¯±$Ϊ–¸p¿q•qN!Zà +ž=¶ámºK j
ðí1&Ú/L|)ŽoÌ:œ9{fغÂÈÕÀ¹+q—îsÄpÑ\£ˆ*VÆ–1å4ë¾ÀH‡.˜;ï…éæa)ŠüŸäÏþØÔÒ8gë‚7ú‡å%l$·èu$xpŽ¢«Në0b:Ä 3ãO@£A…™œ“äv Nâ‘ài8ý„‘Øþb<²#T¨ ¹\yfvÉ »Âïc×cg=a Ùª‡+·Tãïb](°¶®dù•£Q7˜–†
þ¢šað¸åöig[\G¨ý +<C ug*0‹›9xË?Ý›Ei‘ÍßUù}¨.Õ`ç¤ïO-ƒ13~Â>:º V_ Ó…ýuͤ ÜÐ?:Ÿ‘‘ÄnÒªXø7ñ «˜9ªÖ^ +!-h¢è¾Þ®ÜšMqWÖN"{ÎõüÞ#-½ UíiÏÁ–(†/‡ßÛíZG®Ì4Éd,Ï•@P2©,ôYþàüccƯá4Ð~Ù
)–d,a"·²IŒ(Édç~“ûûÍË]Y*E¨ + =Ï‚PVx–%ÿªt*úÿ endobj -952 0 obj << +957 0 obj << /Type /Page -/Contents 953 0 R -/Resources 951 0 R +/Contents 958 0 R +/Resources 956 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 939 0 R +/Parent 944 0 R >> endobj -954 0 obj << -/D [952 0 R /XYZ 85.0394 794.5015 null] +959 0 obj << +/D [957 0 R /XYZ 85.0394 794.5015 null] >> endobj 118 0 obj << -/D [952 0 R /XYZ 85.0394 769.5949 null] +/D [957 0 R /XYZ 85.0394 769.5949 null] >> endobj -906 0 obj << -/D [952 0 R /XYZ 85.0394 749.3395 null] +911 0 obj << +/D [957 0 R /XYZ 85.0394 749.3395 null] >> endobj 122 0 obj << -/D [952 0 R /XYZ 85.0394 221.8894 null] +/D [957 0 R /XYZ 85.0394 221.8894 null] >> endobj -958 0 obj << -/D [952 0 R /XYZ 85.0394 197.4323 null] +963 0 obj << +/D [957 0 R /XYZ 85.0394 197.4323 null] >> endobj -951 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R /F53 957 0 R >> +956 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F53 962 0 R >> /ProcSet [ /PDF /Text ] >> endobj -961 0 obj << -/Length 3210 -/Filter /FlateDecode ->> -stream -xÚåZY“Û6~Ÿ_¡·PU‚ƒà±ûäMì¬S;ñL6»åø#RÆ)‹ÔLäÊßn\ÅC®d«v+[z -?¶‰Rž.â4$’2¹Xïoèb Ͼ¹a†fe‰V>Õßîn¾|)âEJÒˆG‹»Ç+!4IØâ."È8Ðàõóï^,W\ÒàöÅÛ¥”Á?àOõß|ÿâíóe w¯Þ¼¾]®bš†ÁWþý¥¸Îã«7¯_¾úæÇŽÏòýÝ·7/îÜ*ü•2*p oÞ½§‹ üí
%"Mäâ :”°4å‹ýM(‘¡vdws{óƒcè=U¯Ži.””HÊÅJ„$ùǨXDRIh±ˆAn–phÈ”D‚‹Nù©§ü„™¦rá¨PùU¶/òÕú¡XøTWÅrQ¼[å¿||üú½íQS_¾”ÂãÆbØ7”¹¬wYÓh¢Þ”<%I§†Êñ«Gø «—–a}j§v„cŸÌql¯rÌËc±nëãy„© IÄ%»dú4Âv ÷”Å‹c$•’ÿ^î ®Šü3•´ÜVõ±Ð¤,ôHCF’PX®¿Œ0ã$ŽâÐ<eÇj„ $ESÿL.›¬ÜTlj«“ËEVÂEíù§QCá ‰iö
å?½ÜÏtäü¡4…:û×ؼa#IÇ‘Õ\¹+PF8…1I8}zÐËHÌX´ˆ©$”§É¸“1D+ŸJá gcNÆRy8Wï £]/ S˜ŒçEpT#2ô´ ‡ž¦1ë q[îË]vw$dÐìÉ 5eVáàü̼àO”D`N¯÷€™Šy©þà Û=eçFå§ý¡ÑÃíC¡Ç4æãк®Ú¢jlúuÝmźü™R^ä(ÂbÅiHxD™µmfl›ò]¡-Úy{>”ël·;롲Òÿ™þËËÍ’%Á¦8⟞†7õqŸµhÖdÊH¢ˆ‘Àúgħš6G… 8VùúrÒ8&,’éü¤–hdÒÞfqÂÂXô'½S{‘ð@ëa_·¦¯N´Xg0\éQÜ'EYïô -ÚèNiž>•»nåesØeçÞNM¶U+ Á¾hl 7F))%‰ -€S„¾{r¸"€.@=«Æ
™T ¸ƒkjò¨fÔd©újK”“w÷XöR›w#\”=äÂ=.ýC8ÉÆ ‹Ç²x“¥ê4àRÁÊçu騆Êì{@ÐOš&¬¯MëÝ!Ø–EÕmòä ‡)@?Ì<»Å Ñô["½Á›cÑ<Œíp/ñ˜ÛáAž3¹7ÿå-9l - -"ð†q˜^1jÆ,•6A«fc]pOû‘ çŠV -[ˆ(I9x¿Y…:ª¡FûÖ -J±dÑSéÛN¥³›mlB‡úû Ú}¹‚ Ö§lT&ž\± jÆ&,•ŠEñÉ–6ÿ”1‚ °aé¼R ÕP«}»€ 9•‚÷Õz{j:v!Âàtȳ¶ht3?¡Ëø—Ÿ!i+׺£aa%#®ò5 ªêî‘n•†‘*<¬L^$!W—É¢®J<#KZ›Ê’%æ«ØÐ<3¦lÝi´ðE²„,„ˆQÅyI襺¬¶:e†S‘—Ö™ î ýhŸå…ÿDNW^V…e
,…àZh
Zw¨H0Ðû3þ3TÚ’B7èk"”6bÁ«Vg»¦Öuvj”ú±ýU[Ýaªê‚ƒê$bã—út¬pQرAR¶†Õ½!lÎ -^ÿW`ËÆ¥3ºìb× eŽG®ž6_TÙ½2¼(éðŠG©¶BÌt·Ûk=ÜY <4ø%¢H×›àyUwôHi#~Yø zñݨôð+vø[üŠû²@ßáYìãÖOqm -ÍÀÂ-š%ðS¸‹mBÖšP33½Ol1,ö];¼—͇gcP Ž?$ІåJ‹†pÄ™ç € sÐÉ6 -@„Å
Óâ`ë!3 °„¿+ZµTÉeðܾƕ»?ãF€¶4¬ñ)%‹qd5vöíKêÙ†tx-µÍð¿«]M,to`ÂØI|à)%’ñp !|ªiŒpTJôº-7çÿ«ìvV— B ”9Ž=m¾-šÂ–+^¿¹{õò_&‚ÕÅÚf*õ™Íw¸L1ÆWöÞ£šÙ{K¥ó®„Ù+Á¶†œ^™ÙQ
§î—€DHB¼ÕÑ›ÛÕDd¿(E#µ t. Ú::€F÷rÆ -Ý Ej¿eEA^ªÚ ô -úůeÓ–Õ¶ãáÏjÊê‚‚™‡¼U…N`Ò4(ËÓ×qÖ#Ùc¡Çt<¥°UF[ñF?ßØØÆ -±LËû(hÝ‹‚6å;Ld¾Îeu™7–_…ˆ,~4µ!T—Ö¹òwk¯JØ–{;á ®ê c¶rú|Q «‰¯Ô|ª™óe©T9¿ÍÚfX_eàËc9?£ÎÛ?\,S -ö½ú_bj“z¿Ÿ¶z ËÅiâ*jØ®{@¹}|õÏ—x¡šù¦ƒícÓê'
Äι WVÈl=\¥m„® ¨øϧtuQ 5_ŽU<«lVýLY Nk-tfßSø…!0÷šÖEÓL]þ† ÅÛ#»MÝ
ˆ?|1¼»/w
’„O$¨1ÖŒ€‰ -ÕÏ¢áµ8 -§?â#¢ÿÐü#endstream +966 0 obj << +/Length 3396 +/Filter /FlateDecode +>> +stream +xÚå[Ý“Û¶¿¿BoáÍX>‚lŸœÄN™Ú‰ïÒ´ãø'RwŒ%R©;Ë“?¾»ø"!’’'éL;é܃Àår±X,~Ø]àØ‚Â [È„$Ï*‹‰¤L.VÛ+º¸‡wß^1˳tLË!×W·W_¾j‘‘,áÉâv=•š¦lq[¼‹ä$Ðèõ󿿸^rI£›o¯¥Œþ?úùÍ÷/Þ>¿VqtûêÍë›ë¥¢Y }ý·çßß:ŽË2¾~óúå«oìå\¿¿ýîêÅ Åp¤Œ + ¯WïÞÓEþ¥rñ”°,ã‹íU,‘±Ž²¹º¹úÁ ¼ÕŸNY.–”HËÅRÄ$…þ§¸XB2‘HhO‰P 7K94dFÁEoül`ü”™erá¹Ðøu¾-‹åê¡\}øÔÔåõ2¡4z·,~ùõñ›÷îi…–úò¥iLÁ¼¡F(eµÉÛÖ0]òŒ¤©Ê,——×LÈF/ÀæÐíÝ„ÄÍKì.J,ª}¹êšýqB¨ŒIÂ%;ú4!f 甩Œ1’IɯôUþ™JZÝ×;4¬, °ÆŒ¤±pR™Æ‰JTlžò}=!… ’¡«¦”u^m@+67Õéé ë?á ÇþüÓ¤£ð”(šÆ¡£ü§‡û™ŠN¬_«”áÐkÿ’˜wb$É”JœåªM‰€2!)V$åT
+ —ÅX²PT¥Ôô cy–&rœMm1–i +º¡»gqF“êlÿži¬@`XXï4S,Ðà¦ÚV›|‘Qgñ/Ð;–„RæL}ËÏìÃ~Ò|Á[ôÐR ¯ôo 囧üØZqØîZCî JC3h¤USweÝyÝÌçæ±Ý•«êgJyY +‹%§1á eΫ™õjÊ7¥ÙfÑûã®Zå›ÍѪÚüæ槨Ö×,Öå L×@^7ûmÞ¡C“9÷HAÒKî1`šwÇ„ÚïëbuÚ£R„%2;Û£ã÷Ì',V"èñVÏBÊ#cmÓÙg½z Å¢"rm¨8Cš³ÙÚx‡ŒŽÆ~Q»q(Ä)A}<ü2#sgz¸ßç[C€ùkžZ£MçnmW:†b[ÕUÛísØù I»Ï”Æ(@;«Qmµ!,6»¤T8`Aã¨Y›ßÜü«*¢¶Ü?‚Û@ +uÖ˜HËÌïW_´Füê!¯ërc„o›¢çàõ¯ÖÆg1æK™„ wl¸ö×it˜RI(ˆüRyÁß84…Sû©ê šƒEļ¶ +½Ñ +ÓxÞB®3&r\¡À ålöÖgTÈ M~7!E»òD]%®¿Y1nE<VåÓ”.á‚ %e ö/ +þ}Þ–žklÌpŸÃè"KYhÍáÔ{÷¿¯ ˺ŸäÙ9Ž3J +sÏ\Çð6ü½¾ +bXvÞ¨žklÕÐ/ j†¤‡f½9´»·w!âè°+ò®lÍÖ„)KáOq¬ómµ2–2ᘰiRÝô¯L«²‚tAkiK‚Äâ´aª]˜§f½M×`¤Iýyjd¶–æÓVxhòe• CĨã¼4 R$xm}Ȥ²¨:K6uÝ•æÕ6/ÊáSK}ÙZ5–˰Ćc¡ajjl‡†½;â/C£AÎmíφ µM Õí ³I¾±µÊ6?¶!A¾7LWóh‹ 4ú¥9ìë|c \¨†œugÛ# +€¿±\¶4DÃy°ë{ɹ‹ù¸«CñAŸøàÃChk{ç}v¶G=1ØóóýÌ{>k˜oó®+·;=7ÜçÙœžÈ\ƒ}¬ZOÕfr z8sÑ¿…µOe=‹_°0ˆL“ô<~
¹æñËsµò§yô +å²ÿ+àåbÔ³í#Ù‘I§#ÙÀ¦/êüN;a’öØÅ“Ìx$sóØÏ»!÷^/-–‰$ÑX†ïë¦e(•ŒXæ L¤$NéÉ©d5À2å±L9,S¡.ðì±M
±
kô86làíÙRø-+W°0ÄÆ0a6Ô 2;<SÃm >(ªöó)hÓP endobj -960 0 obj << +965 0 obj << /Type /Page -/Contents 961 0 R -/Resources 959 0 R +/Contents 966 0 R +/Resources 964 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 939 0 R +/Parent 944 0 R >> endobj -962 0 obj << -/D [960 0 R /XYZ 56.6929 794.5015 null] +967 0 obj << +/D [965 0 R /XYZ 56.6929 794.5015 null] >> endobj -959 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F53 957 0 R /F14 681 0 R /F21 654 0 R /F23 678 0 R /F48 880 0 R /F55 965 0 R >> +964 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F53 962 0 R /F14 685 0 R /F21 658 0 R /F23 682 0 R /F48 885 0 R /F55 970 0 R >> /ProcSet [ /PDF /Text ] >> endobj -968 0 obj << -/Length 3905 -/Filter /FlateDecode ->> -stream -xÚÙrã¸ñÝ_á·ÈU# qLžfÙLª2›Ì8GÕî>Ð$m1C‘Z‘¯óõéF<$Hr%)—‹ Ð@7}ƒâ· üñ[«Y"3u›fŠé„ëÛb{“Ü>ÁØ7ÜìÐzõÍýÍÛ÷2½ÍXf„¹½œeYb-¿½/Z}ûÇw¹ÿþÓÝZèd%ÙÝZ›dõñÝŸ¿§žÏ0¤õêïâÛ ?¾ÿðÃß>½»KÕêþà ïÖi’)˜y}îù~š÷ùî—û?Ý|?îb¾SžHܯ7?ý’Ü–°á?Ý$LfVß>ÃKÂx–‰ÛíÒ’i%eèin>ßüu\p6ê¦Æ8§¥eÚŠ4Â:!g¬ã’3k¤½MuÆŒ„1ä]]Þ¥±«º§çþŽÛU5 ömU7ŒÑ«ûMÌ›¦{í–žÕoCµoóß²ÕÎÍ÷`CGϲ°mÝVôú¼©üü6ßVž†M^Ò*E·Ý50¡DÃ.ל³Lká(î‡n·«Û'vÌ}ž(جJoSž2)²,Ê®j=sìRvήÚÊL‹!îMÞ À”$Yý´ÞýrB€‘,UJ^! @°</cY*ôŸa÷ ŠB®†M…
±ê«ý×jOõ¸YçCÕ¼ÜqÎWp„2á«OUQµ›¼}ªîøª§÷m^VaE:½ÃÓ†:Ê8º 4‡] ëÒ@çÑ}øçûOîŒàØ@¸¸] UNÒ4p½j»}þÕ84tpE{ÁŽmÞ¸lÿœ$¢©ú7ð&ùêáà§?×MC?‰¨nš°êc·&Ô%-ÿH[4 ûWwð’;aó8H<=ðBÉäŒ<ÏŒS ‘y2ª~È÷ƒÓ ¥ÒÕ‡G[ï–°ý®*jD‰4ã€Sƒßõô²Ð"¯ËªQKi)æwk¾jà€IYq *+>GeèÕ)Ø:< |ÎT_‰7Øòª‹M§ºØ˜T×÷7ÃE]5š3ÎSqEWç`çuu„Âý û¼¨NðÊŒY)³+xÔ)Þ¥Š*Å,þ-h :Ÿ-é ²rã™GrÓÆ> žž€=ôÚT_«†š/ôìÚêëDÂÒôãF l#˜ÓÞ¾×z*5¨7ô$Š(=¦+ÕÌdàý.Ñ`ŽéZ²Õ&ÌØÄÎ û\
}”—à¼ÕêwW9„9÷²[ý¶kê¢öçó5o8³„)!ì^ÏÁÎs{„ÂmQŒŠ)ÈSj3~s€:żä§6ÀÆD-Qÿ¿8š\à›IX’‚ »Â·Ø¾($þ±9ô›³Ê}ï¨Ü'xãʽ@ü W¯`\‘›K"%2ðîV]cÍ ìkÔÈ4Í5AÖf^Ђ@açÔ)K fšqaŽ(Œóð©þ:w,Ôš<÷ÿÈo•eLZ~ÍÏÌÁÎó{„¢x4 ý b“C,~q€:E|¤Á`3PÜæïê~×äè*Èpí£Ž$„ˆÉ"»jõ±üаɇÐò]íaûà‚X‚–«ƒ+ò«×mÑ Êð6ΪÛ)¶ -$½¨Â‰NAÉ:´u1. -쩇
µ(¨àG±3 É0Ü8Õ%Ô -J¿Tå3¨YoöÝ‚Ó ³ðl;~vÞ:ßá“Ú¯uégŠä tní@vK‘‰ƒB*"\ ž¡’à*/ -ÒòŠzƒŸróš®'(¬WPÃŽ$ˆcà³¯Ø Álb‚qŠÐ¥<]Ô®{Z”oV\M™Ôctø¶Š·ˆÁj”VB–fĨŽ¤ÒÂ@dh–|sµ¡²ÑGæ‹\ Ý3v¸H®¥î‡í-Š%0àÏZ#Çóœ$ؤuT…S* &©Û!~<3žPÑÆ/~䬙0:²ÚË` -ZH›G–öž~ðôµL%˄Ζ\#‰Y~‚ÃaW¤„8<±.5¦ÁýÓ-5>ÍCÀ -B -=<}](S&äxÈ#mX1‘«3ÙxKVUôZ4ù¡¯úßG
z - šÒà#ÀõYA4è’Ë
® wÆG ¦!랈FãÂ
~gÚvX¥Ø²Š¥VXÌ@x3†a5oY2ÁLz|Kx– X3ÌL^†ü‹K+ áÉé±é\½ -hàÎÃ{iä¡|† V¸íãc½ŽaëÁÃ] ò‚¼>¼ºÊR×E û:ìnÁ‹u&TÍ»_TåãN=OsJ! bXJ
ÔÛÔþb餤 Øvñ: óšXqt<Zœz¬ãj_С¼ ^¿8Ë‚ï~õàçÎɧDÙ#–6ÏÍLõ<xÄWi¥x ‘L¬BŒãŒSɘTé‰
ˆ1KOàÒ¾RoR¦… ¸§ŒÆï‚X
7º:z’EŽœ’Š·:×êQ µ#ÞMwh<§@X[Àèʼnjª½¨b eÁ¹ê#éôÄÍ -p³¢}äfYÓ(q‰“8· «/” FåP1píæ®››Ñ²/O %ÄÆ*Óñïæšd@r«"ÞÁÊQ -{zÍéAb
r”ÞPÀ<†Ë Êk„T¡í+Ž6ãAþüµ<"Ÿ -8Tµr¬àœÈPÊ1ªUX£lβQx]•> ~³ý X½ßB¢ŒTGyÆ¿hJ" “Xí?þÐçª –³¸t$X¼—“”LGâ°µ„f -™ñ{&!}T°è³LhñeÉÜ‚³†_¦€3eFõ -}ìðC)kk2I’lŸÇ:ö&dµše–›¥‰ ±˜°«íÁ¹:á‹"ГÓãkÞ¸C YvÛÜ)@ÑÚ¾â>èÉVîV@Ûªò“(¶ÂõŠá7®@7ò©!u,*6xr bÖ°9¸4@Ê@G?ìIØ`rS©bqÜÏB¨£n] Éúñ½®Ö^pfm’½æÃ:«Zÿ¬n=®¸ž/¹6Q” -È®G° ö!e™ ƒ=·×Em(§×p`ŠÉ—œâV)C#|Õ*%XQ>µJ€€bV´ÉÏ õ\ŠVa)£Fž7OÝ ¬Æ6VñO!{ͳ“ÔcŠ‡‰Ié†SL¦¹ñM *káû+,M“ý]ˆT¤2gV»|ß»pM™¤A+/ÜuµÛjŒb«4E*¤HÊ ‡ŒÊgQ8˜ƒJ Ò“{( -qJú +973 0 obj << +/Length 3750 +/Filter /FlateDecode +>> +stream +xÚksã¶ñ»…¿Už9ñð$ÁöÓå’K.3½¤wîc&Éth’¶Ø£HG¤Îqû绋@R‚$OÓñx‚‹ÝÅbß ¿fðǯN˜ÌÕu–«D3®¯Ëí»~€wß^q³ö@ë9ÔW·W¯ßÉì:OòT¤×·÷3\&aÆðëÛê§ÕÛïÞüxûÍÇ›µÐl%“›µNÙêÛ?C3Ÿà•Ö«¿yˆ·?|x÷þÛ¿~|s“©Õíû >ܬ3–+Xyyí?~3ûtóËí÷Wß܆]ÌwÊ™Ä-üzõÓ/캂
Å™}ý,áy.®·WJËD+)ýL{õéê/áì]“œ–&ÑFdÑ 9 —<1©4יΓTÂ;”]SݬejVÍ@¿»nVõ¸ßuuÒHS½ºÝø—EÛöO~ÜÑoýÛXﺢŧ|õh×÷e=8°±§ßª°mÓÕôø´©Ýú®ØÖŽ‡MQ–²ß>¶° BÃ.ל'¹ÖÂr<ŒýãcÓ=$‡ÒçLÁfUvñ,‘"Ï£â +Pë9˜—2sq1«tB†´7E;‚P[ý´~üåˆT&™Rò ê˜åy¥&É„>ààì TQÈÕ¸©q VC½ûRïh²Ù‚4›b¬ÛçÎù +ŽP2¾úX—u7H¹)º‡ú†¯zÞUí1Òéí 64Q=Ãé4%‘Ù?V€—^ôŽÜû¼ûhÏŽ
”‹›åQ¤MÀ׫® i0_ì‰ÃÐjW´œØÈ{ÁñÏŒ‰¶ ^Á“ä«»½[þÔ´-îÜ"âºm=Öû~÷D¤+BO[GÔûW¿wš;Qs4H= ðB Éå™ç©5 ‘;6êa,v£µ ¥²Õû{z·~\ÂuÙ Iä_X3øÃ@ +B𦊑 +VŠ”ÈJñeq³æ«˜Œ×¡±âo0Öˆ]-‰‚¯ÃÃÁß™éâ#ÉGÎtqhM“éºùv<k«©æ 癸`«s°Ó¶ p?ã®(ë#º2OŒ”ùº ê˜îÒD•J ù-¿ïJ:Ÿ-Ù Šrã„Gz3xÁÞí @<ôØÖ_ê–†wÏôÛwõÑ –dÙ%Á 3b#˜…Ð^¿Óz*5˜7Ì0 Eœ ò•é$Í!úãËà òµ«aIj˜™3ö© ‡¨,!x«Õ .JÔ+sát·þí±mÊÆÏ—¢ÝŸ‘´ÎY¢„0d=;-í +w»«Ëýn@ß~ª9O;2G´ã…Ì‚ø×ûíãÁQ¶ÍàäÔ;™ÿº¯w÷³tÓ ø'ùucû<xؘˢ*R40’å)°n ž”Ê¿Dß̤› ³ÃmQ€‰tM¶6žÆ¯ûÆ ”(ŠËP,k‚(lK Þ H!nÆ
¨(ïÏpÒ)öðºq©-l +\5‚sÒ9¼¥i+,˜G–p¶ Çaã*¶Ê¡ª]&;¾Â‰Ô™ŸE8 +Ï‘œ¡7½ÅíÙîb¥ +IPHEŒ«ãÃÒWt¶VP Õ4ëý…]×öeX °n¤+úü 0—€ït®b×UeÌŸˆÄ°ÔGØ_ÊñEãf ŽÌš\Pïkâu=–¯‘XÈî#„d9åüiº)èt)6[B •Wźl +`z&
P;š¾óAwQ³Â w 0 +[ìCL7YêX[ÇäÅU¢“¤DúxdœQíì øLÏ&¼
Ò„ñÒ'ÃÄ}¿ïªW‘³DáCEÃò¥!:T™¨Lx&]‚qßÐÓ¨íûÏ4jºˆ$2•è”§GGú¹~Ž({ð“úg¦*&"«©ÑS “€$•Kåµfx P]ªfÁŸ +pƒÚkÌS1òªFYvÖÙXZ¶#rS0øêý‡¯]»‡ñŠÞìPÁšu]bæ8ÐÁv8¶, c¸j
i§V&;;!'HŠ@¨Y“S稑øCÝÕ;òŸ8mËjøÝݘվë\ä;P
.t¢4Ëfô×(Ë›ÂêuáNXpå3 Ú<Št(wÍkd®e&“\è|)5Ò˜Eü ¤‚éÀÙºŽ^î ®iðq ‰=üz¾ ‰ðR!XNVB¢b¥½L_ð-î-Ô%.Ž°ÙüŒD”‚ð¹â>DÛWÖwËÔ:è-†
™RbŠs£y ÀÊ+P[A€Ü6m±sË{¤x„3ý}Ì•i°`Åù¬rªN9d£y™à×°×¾ô-P§€>£Þw‘i‹ûSp’§ùa÷ÔKØiv"VAÊ•3¾ðªC„U‰$¡ã +9dì,Ë^ŠÄ¥:^D×܃a¦±Í<Qyˆ®‰áÅÊ Á$3Œ, ä Pz +üôŸÕԲƗO”¤À¨†¾Ä¾:€M‘Ëeô @eÒeJc2Ü@ol>„¿šÍ‚0ë*Ž6M¹! +´6ÐÝôûÖI +”µƒŒ ¬ªfÚ©*Xª4\õv:æf}YïÔ'r³ª)h ³çàv…¯£z¨íé B7Oƒg_žKÈU$§;ßÓKšÅŠD#ƒôXЩ9 (P:G¿1le P_#Ü€¦ +m^p´9÷úçnG‘øÔ¿¡N”‘¡s¤CYÂD0 jtEÅœçAym•¯Þn³Ã3x½ß|¡‚Tuæ¿è*b ‹Xíîàõ©¦‡áI†Î öPå¤%Ó‘Xj ‘™Rfü¬DH—Õ }r‰ !_v.
+ú'8à‰JƒyùÞ÷ø½ŠÍµ5¹$I¾ÏQ{å«Z䆧Kçs1aVÛ½
uÂ5E`¦ Ÿ/EkïèaXõÛÂ@n×ðòßUä+Û Ð®®Ý"Ê_9î‹ÖöçfT6
”±VDåOîOÔË7{[HéùÆ ),n›Ïu,ûY´ÂË]?¼^S :0A‘ +ŠRÕu +zô¦è\Ë)î•rt½Æò±W”³¢O~êiæ\¶ +¨RâyÑ>ô;ðÛQ•Aõ +Í““Ô¡ÄäŽÅE‘&à8ÅäZPß4¾³æ?ƒÁÎ4ùß…JE:séê±Ø
6]S©OÒ`T”eý8ºq÷Lƒ ¶JSF¡|‰¤ÒÔQ¹* +ßxá ¨ìè: endobj -967 0 obj << +972 0 obj << /Type /Page -/Contents 968 0 R -/Resources 966 0 R +/Contents 973 0 R +/Resources 971 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 939 0 R -/Annots [ 970 0 R ] +/Parent 944 0 R +/Annots [ 975 0 R ] >> endobj -970 0 obj << +975 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [120.1376 335.453 176.3563 344.6684] +/Rect [120.1376 365.8002 176.3563 375.0156] /Subtype /Link /A << /S /GoTo /D (controls_statement_definition_and_usage) >> >> endobj -969 0 obj << -/D [967 0 R /XYZ 85.0394 794.5015 null] +974 0 obj << +/D [972 0 R /XYZ 85.0394 794.5015 null] >> endobj -966 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F48 880 0 R /F55 965 0 R /F21 654 0 R /F39 858 0 R >> +971 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F48 885 0 R /F55 970 0 R /F21 658 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -974 0 obj << +979 0 obj << /Length 1632 /Filter /FlateDecode >> stream -xÚÝX[oÛ6~÷¯Š=ØÀÄð"ÞÖ§4HSwhÚ%N¶¶+Ebl¡²”Yr³`èß‘Hʲ´A Åà‹ä¹ñœï\$`ø‘€ $4ÕÔâ˜ð YŽp0‡³“q4¡' -ûTÏf£ƒçLiAE0»îÉR+E‚Yú~ÌC€Ç§‡¯Ž'!åx|~|6á|| íúõ›ã³Ã‰ŒÆ³éëÓóI(±ŽÆG/ßÌ<Å×e ½>}>=¹ØÈ™|˜½ Ϻ[ôoJ0k®ðçèý ¤pá—#Œ˜V<¸…FDk,GgˆGŒù|t>ú¥Ø;mY=G0¢LÐ!×éžëA\k ÈH"!¥uÝGs7 ÆãU‘&t«¿››T#¥T‚4ç´eˆóy¹ÊêÅÒ>Y,ã$\¦üÉÓ–{j+¾2ÉÊÔŽ4agwW”Ó“Ëõ»,â£gË+6¿=V¿ý5š¿-.ñô„,Þ\Ìß-õÝôäxžRÝœýìćC&}ÞQmwË›:+‹êþûX Ss ¯ó:¬Ìê“YYjB%Âð#ƒ‚=Gë,õ|÷UžSÖ‹v´R·4³EVY ýŽ1ÍÍv‘]»ÿ¢ªã<7©]Æ••¸c‚1Ò‡[‰¦NëPR×(†„èXr§ð¶\ç^Iž—·ö±^û”Ëe\¤?
¨‰*ÁáI"ͨjåþ`I#ÕOd¤¥Nqc¢ƒ¡ÉË8 °4t N°lùêL’ L* -“Ôvá7»(ÚåM¹rš3û -eX‡ôŠtsƒÁÎvþÈý²O•FŒ(±Ñìëþ¾×|nÙ{ WÎ(G‚¹zg µlñl¥‘~Š+ð -‹z^ ›247Å€jÁ•ÊßXÜÎWñÒj¸Íò&4Z4°üdŠ B’ßÙ³ÄfÊRÄC!cˆ}cÐÄ%ï̶¥Ø*j¢ßj¸+×ö k‡¬Fi^•Ö_Œ Q²“$iVÝäqc1¡.ÿ ƒË¬¬ñÕMY¤?÷ÝHˆ -™ÏR[ú† Æ!èÒZ¾0 0QBïÃ]œ[4 o\ª¯o\…ðDS‡„Ö}0
'‡´&„íb©-<®¥S¸,Óìún@›‚¢ª)ˆÛETO×]GÓ:CO0AL‚ãBÆ!Xtã4„0KÀœÍ‹xmM…ŽHÔ2 ™U g¿Éøâtú›}ª ?,h×faßMÄ7ʆÔ7Ê渴 uüÑŸÞ˜$k ˜Øuœ´ãÝ–.®ìnjªd•]Ù šr±£m«C6â¯rƒ†úïla*©ÞzP¼ò§]oXW]ç ®‡Pu‰ü±©h%X!ÎpÔe{;k¡Ývµ?"Pb€˜+³ ÐMXûRÂwúÉ·qy;z^»×ˇA–{ô ;
Íß ªA‚¬çûÙ–5ERI0Á%‘
×ùôäÅÅ›]/ UHpô%þ;#;‘Vn‡Q ÒäÆ–™GMT;óô÷¸«B®£¥CU˜0(‘ü†ràKÎfxÝ1%!#âÊìá-‚ ‡ýˆŽdš!‰%8rójûÿAp¤aš°}ÁœBÁÜ#xv|öê~÷D>„÷Ì †pßÎC8ɯ•]+õ +xÚÝXmoÛ6þî_!û`Ãñmý”iêM»ÄÉÖvÅ HŠ-T–2Kn ýï;Š”,ÛLtÁ6 þ`R<Þ Ÿ{îŽ 0üHÀšê@êqLx,G8˜ÃÚɈ8™° +‡RÏf£ƒçLiAE0» èR+E‚Yú~ÌCЀǧ‡¯Ž'!åx|~|6á|| íüõ›ã³Ã‰ŒÆ³éëÓóI(±ŽÆG/ßÌ:‰¯ë8z}ú|zr±Ñ3ù0{9:žõ§ž”`fŽðûèý ¤pà—#Œ˜V<¸… FDk,GgˆGŒuOŠÑùè§^á`µÝêEŽ`D™ >èô +·£†1Ò¸„[Y“ ïPR•× CB¬¸3x[‹ÎHQT·vØ,2;Hªå2.Ó <æC¢€SJpI¤•Þï¬h¤†©‰´”Â6.ZèWYQÅ©ÇÓÐmpŠ-bM.I.•e–4vÒ=ì£h§7ÕÊ hÎì +8PvH¹§H›âà-öa¯1 ªÜ¯äTiĈËÆGsÀ}غ¬µç@®žQŽ'r;÷ÎzjÙÚj#à W€ +‹¨„¦Í³ÒcZ0D¥ê„o,qç«xi-Üæ… †—Ÿ²2‡wv-±é²±/Dà bèÌ}Eú²ä½Û¶[C&ú…»j
yÏ°vÌ2F‹º²x1&PD‰ÜÎè4¯oŠØxL¨+ +q†£>ÛÛËÚm'Pû#%†i‰"ÍÈCº kß3øN?ù¶] ƒk˽ Ø}t¹a‡óNCëÎ2ÅÕ·³-5ERIÅNC1Š,cϧ'/.Þì‚D$!ÁY0Pø÷\ì5îû¸ CˆIŒ-' ûëÛô†ô¸/A®¥¾LÔ‚H~C-èêÍæêºãJC:Äu¶G¶®7„èǃ‘i†$– endobj -973 0 obj << +978 0 obj << /Type /Page -/Contents 974 0 R -/Resources 972 0 R +/Contents 979 0 R +/Resources 977 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 939 0 R +/Parent 944 0 R >> endobj -975 0 obj << -/D [973 0 R /XYZ 56.6929 794.5015 null] +980 0 obj << +/D [978 0 R /XYZ 56.6929 794.5015 null] >> endobj 126 0 obj << -/D [973 0 R /XYZ 56.6929 442.7583 null] +/D [978 0 R /XYZ 56.6929 466.6686 null] >> endobj -976 0 obj << -/D [973 0 R /XYZ 56.6929 415.4538 null] +981 0 obj << +/D [978 0 R /XYZ 56.6929 439.3642 null] >> endobj -977 0 obj << -/D [973 0 R /XYZ 56.6929 385.9365 null] +982 0 obj << +/D [978 0 R /XYZ 56.6929 409.8468 null] >> endobj -978 0 obj << -/D [973 0 R /XYZ 56.6929 373.9813 null] +983 0 obj << +/D [978 0 R /XYZ 56.6929 397.8916 null] >> endobj -972 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F23 678 0 R /F48 880 0 R /F21 654 0 R >> +977 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F48 885 0 R /F21 658 0 R >> /ProcSet [ /PDF /Text ] >> endobj -982 0 obj << +987 0 obj << /Length 2297 /Filter /FlateDecode >> @@ -3062,29 +3116,29 @@ oQÈ"ú5QÚìû¶)—ª:kE¦òXÕ•-Å ä…£¹ ¼>Å‚3eSojÍkâ f2 €ïFt-˜¢~¶åônwâ-ú¬;]àc×BλÈs¤Hz ƒúÅå©9Eª;4UUw—iwÉIÎ’iÌœæ šÎ ž¿“²‡§þØVÓcïb¢uÕŒ1tì|w |ON~™
ˆI›ÏŠ“<> Ú<¶= ö endobj -981 0 obj << +986 0 obj << /Type /Page -/Contents 982 0 R -/Resources 980 0 R +/Contents 987 0 R +/Resources 985 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 996 0 R -/Annots [ 986 0 R 987 0 R ] +/Parent 1001 0 R +/Annots [ 991 0 R 992 0 R ] >> endobj -979 0 obj << +984 0 obj << /Type /XObject /Subtype /Form /FormType 1 /PTEX.FileName (/usr/local/share/db2latex/xsl/figures/note.pdf) /PTEX.PageNumber 1 -/PTEX.InfoDict 997 0 R +/PTEX.InfoDict 1002 0 R /Matrix [1.00000000 0.00000000 0.00000000 1.00000000 0.00000000 0.00000000] /BBox [0.00000000 0.00000000 27.00000000 27.00000000] /Resources << /ProcSet [ /PDF ] /ExtGState << -/R4 998 0 R +/R4 1003 0 R >>>> -/Length 999 0 R +/Length 1004 0 R /Filter /FlateDecode >> stream @@ -3097,12 +3151,12 @@ qª„Ñ«ò^ÿï>‹«>÷—
.13×…Óƒ!¶3¢SËAÕ”ih¥Å¨Š^…(€<Îm䦽ªšÛÆlLÊâ³ò7Ù n*Œ1½÷¨¾x¥Æˆpîâ‹&Xîܧ³±è\í D¤ß ä0}#XŒûž˜ ‹¸À>#^V °¡|2Îi‰9ÊÎr ) `˜¢Xh¡Ò& „hb—H°Œe"Ãê þrÓGçX 5¾û û8‡´ÕªOª«t–Ô ³$Ây°‰—BÒ›ÀÄ5©/¨vp÷o`kA“ôr ±ñœÓ4N.4Žæ endobj -997 0 obj +1002 0 obj << /Producer (AFPL Ghostscript 6.50) >> endobj -998 0 obj +1003 0 obj << /Type /ExtGState /Name /R4 @@ -3112,116 +3166,122 @@ endobj /SA true >> endobj -999 0 obj +1004 0 obj 1049 endobj -986 0 obj << +991 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [470.3398 482.8902 539.579 494.9499] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -987 0 obj << +992 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [316.7164 470.9351 385.3363 482.9947] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -983 0 obj << -/D [981 0 R /XYZ 85.0394 794.5015 null] +988 0 obj << +/D [986 0 R /XYZ 85.0394 794.5015 null] >> endobj 130 0 obj << -/D [981 0 R /XYZ 85.0394 769.5949 null] +/D [986 0 R /XYZ 85.0394 769.5949 null] >> endobj -984 0 obj << -/D [981 0 R /XYZ 85.0394 582.0558 null] +989 0 obj << +/D [986 0 R /XYZ 85.0394 582.0558 null] >> endobj 134 0 obj << -/D [981 0 R /XYZ 85.0394 582.0558 null] +/D [986 0 R /XYZ 85.0394 582.0558 null] >> endobj -985 0 obj << -/D [981 0 R /XYZ 85.0394 543.4475 null] +990 0 obj << +/D [986 0 R /XYZ 85.0394 543.4475 null] >> endobj 138 0 obj << -/D [981 0 R /XYZ 85.0394 324.8439 null] +/D [986 0 R /XYZ 85.0394 324.8439 null] >> endobj -994 0 obj << -/D [981 0 R /XYZ 85.0394 292.4184 null] +999 0 obj << +/D [986 0 R /XYZ 85.0394 292.4184 null] >> endobj 142 0 obj << -/D [981 0 R /XYZ 85.0394 174.5048 null] +/D [986 0 R /XYZ 85.0394 174.5048 null] >> endobj -995 0 obj << -/D [981 0 R /XYZ 85.0394 146.6189 null] +1000 0 obj << +/D [986 0 R /XYZ 85.0394 146.6189 null] >> endobj -980 0 obj << -/Font << /F21 654 0 R /F23 678 0 R /F62 990 0 R /F63 993 0 R /F39 858 0 R >> -/XObject << /Im2 979 0 R >> +985 0 obj << +/Font << /F21 658 0 R /F23 682 0 R /F62 995 0 R /F63 998 0 R /F39 863 0 R >> +/XObject << /Im2 984 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1004 0 obj << -/Length 3372 +1009 0 obj << +/Length 3382 /Filter /FlateDecode >> stream -xÚ¥ksÛ6ò»…¾•ž‰x$Ad¿¹‰su§uS[÷˜&ù@“ņ"U²¢üúÛÅ.øèëÍÜx<x-‹}c©pÀ_¸‰ŸdQ¶PYìË ”‹b{,žaíïW!Ã, Ðr õÃêêoï…Zd~–DÉbµ áJý MÃŪüèžð¯CàÝÝ¿}¸ýåö~ubïæçëe$ï÷_ïo©·z¸¹|ûðHÃO îþýþÚðz)T yo¼ù°º} õ˜±Þ¼ûçu†ÞÍýÛÛw´ôîžq¼¿½Á³Vÿx¸}¼þ¼úéêvÕ_j|ñ0x£?¯>~%Üÿ§«ÀY*G~˜eÑb{KáËX7S_=^ýÖ# Ú³Œ ?I4ÃÉHÌqRf~"` 9Yçûë0õž5\.ʼomýÊP{Ø•y§K¬-°þó ›®>YÇDywét^¾8{ÝÆbI½ò°ÝMñ•ºÎOßÓÉ Bm×RJj·Usè´±X…—×u{¬šgZË˲ꪶÉk”°b†~&edïEd™E‹mþESoWç…öû™ †Ib7þk£<@z96‰gôþEïiŠ.!=bƒéò=³&ñòuç rjÌæЕ푱µ{‚+ö¹ÙØ ^ÕÑÚ±ªkZ%Ä@݉V˜‘Òû£=ìñªvð)¢ZÓbÖí~×îáÖn‚–‹d†E,kàFÞœ¨3åÚ&ï ÿÚ/#¾ñ&¾°…ä¹:7¼e@Ž*0Ëé·›¼y¾<Œy{¨yL:×ni„×ܒЈÀ· –;“£»}Þ˜µÞó¤êŽüÚ°V0kk+I‹”!¨1Õ¶B+±ƒcî´~æB+bƒè)ˆXR†¦Û5M–§&ßVÅ -~'Ž3æùd÷ÑOƦº1>hÆ FjîÔxÐ ÞÒ Oâëõb$ÅñŽÊ8Sšúž’ sáVöשwh4pØáÈaG2öUf@1ºoJ>ÍtíŽáÇ>Ž|!‚”ÁIE‘~Ejªªwx—Ty§ö@Mþ‚ä¥)‘3[r–éXŽ0pË9A\€9æ‚ÝÜ ¬ú¢±¼Kö¬ÛÁ‘ìŽ ¼Ðå¡W˜f§ˆ½vÿå{3©ôÞU&ªgåØS"‚lpd"$Fã¤% -\†K§¾ -bÖ«¯ôzZ®÷ívY -ßµ8ýRé#:ôÕV¸vÎTOœÙ¿róEpÑÅvlá;fgk'‚‹6Ø‚Óô°ÎSaR¡¿vסׯ(WikÊŒìVn†|âL´ ]pêX7sº+<ò¿ÉzÇE× 2ŠX.Ž± -wƒ¡%’M2‘gùLÔ:ÿb¨k1Q»µeRì`ãúK•Ó@CJÂ'l๦Š>!s9"B|Í·»Zóç˜ “G䶤†=“¿¼œ^“¯¼ø˜Y@2ê!n¤Z•E']• -øbz -g‹Å¦ Ïse9éõ… ->…²G -UZJÆðz¦åY~ -‚Ê\Uó–hCek|þL’•Ä¾Œã¾^+ƒ™Ò¯ðE¨\jÏ7ö -÷ç褯¤¾HÞäîn.=ÃÁèÛ"™ŠŠë™3)ÚiÕ?ë4\…Cd'çŸ^¢ª7P «nC½©ÝàŒÓU %Þ‡i‘MQ(¾ûÀUH%!’G.Ç®YŽÃŠÂÔÓø|_}s‡ñ;^%í»_~§‡ûŒ µüe2ë6'bV‰\X¹T:¾ø›ó⺒Î+†±;À ÑiÊD»ÎôuÐ.§¯jWè'*vê€9µ}_d”;‹(¼U²QZÈŸí±}ÒJTW¦ -@ àò² ´ÆÇ!· ¡ûþ* +xÚ¥ZÝsã6Ï_‘·*3k$’¢toénöšN›î%¾Ùn ‰ŽÕ•%W’ãõþõ >líõfnüÀ/Aàrx À/¼V± §QzSé« T×ùî*¸~±¿]…L³rD«)Õ÷ë«¿¼ú:õÓ8Š¯×› ¯Ä’$¼^¿zÒþ
p¼û‡·w?ß=¬o´ônºYE*ð>þòpGµõãíÃÓû»Ç'j~ +Tpÿï÷P†7+¡eä½ýáöÃúî‘Æ%s½}÷Ï›0 ½Û‡·wïhèÝóxw‹kÿñx÷tóÛúÇ«»õ°©éÆÃ@àŽþ¸úõ·àº€ýÿxø"MÔõ ¦it½»’JøJ +ázª«§«¿ '£vê¢"ÃÀD -h2KšT© BMVY{&Þ‹ÍE©÷µ©¹VvT öEÖ›‚Klþ8˜º¯NVE 1DÞ}Ýõ&+Þ +VmeOÒ2e +*ºrW¢—ØÆ1sV¿°¡5©A D|R u7ê,Nu¶+󑶣þ<«ë¦§îºiw Ó‰Fž™±“'1#ò è-º “g‡ŽIáLxòdÛÈ·§Þ—CÚé
±hG 6’7 W«4æcNµ·kì1§Î^sÐ>µÇY> 0Œ|Š"MÝý¶±BBç(4šÚn(. 9YîH™²Îg³ÖyRv
è0uwà…f[¤X21sgÆ£
žu:¾Á.&§8QvΕæØScN(ÜH{“x‡EÀ'€ )éë8LAb´ ^ë›=ÓO^F¾AÂäd¢¨ +Æ„‚[£ÌÈg ?Töƈ—²šYo ‡4ŽðLŽ½[©àN»7- +›˜Ýt3Ä!Á†yZ¤Á¡½5ËP)dâë@º^~¡›ÓjÓ6»U| B™:7ÝB0HÑ”K6ËŽÝJƾŒ‚³ 3ÃÍ8Éd–·B–)ætZ\
½ +U, +JÎt…Gð‹œwúÞý@E ‹Ó+/ëUJ?ÑQ2 vØs>¿ £Ÿ]kl ƒÝÐk–dY³®©;¯¦r —¬.¿:WÞcs¨ +"<fu?ßtЋ"ÀgÏLY|TSè'€N3‡ì·îVþ__x~±¯…—7»HOå§1Š50Ð9+Ã^+¶I6é9‰NºvÔÉRhÁ)²æø mPc‚P°Ÿ`{Έ°NãÌWœA Œ ïh x„óÁò&¼„†{OU‚tÔhÀ,kª’}k|ôÅ)|vk5=q -yf×츧0Ï”EhpÍ( %$KýÖ¦'¸—öµ +©I3S® 8!À@bÉîGG‹»d¬ÎÒ)è¨Lö¹£ªÅb"¢rg_H±ÃDÖ_ËŒ2^a W
pUÄ„Ô¥ˆHñ%Ûí+Ã_ ƒ\ ™Û×4¬uÙëëé[ç±+Ë?g> •âƒ!N¤g*ËN¹¨ÌwH#'¢¯í³ öш6¬ßH`ðT…ö~hŽè.?N´Sr^£‚|•À¬¬(ºód¶aãF"&؇ÉOº×8èvöHÁmÃ=”¸¡ +9ÐìsÉ3Ûás LÜC¶;e/hÕÒç›™E=žÍ?¹ êÜKüä8UàŽs’"ºÃ² žP~(¥Ë ýsÃ;B^~:_ؤÍZ¾‘3J ŸFåO¦ÿÎ^À 3›ûkº}h´ù=˜' hÃÅ™î’g¹U(@^ºÇL @|Ú󄈥¯¤ žiU°ðâ+|j—Õs ñs +õç씯•P#¿DÞfno.5ÃÆä“"u%½©§Î—h¦µ»Ô¢ =~Â"*•ñùg8J=x&5Že¿¥ÚÜa°Ç)ì‡ù㚦0|ÿ_ µr ˆUp[¡rR4^žv˜ÂgmùÕ-ÆWx [¶ï~þHwö%h䂌٨9 ³åBÊåg#Þø›óÏž.ÿ ^s¾áû\¥Ì¬ë •Gë2ù¦u…~¬¥3̧íÝ"¥¼YDÉìž’NRBþZå³!R’z:2‡& O endobj -1003 0 obj << +1008 0 obj << /Type /Page -/Contents 1004 0 R -/Resources 1002 0 R +/Contents 1009 0 R +/Resources 1007 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 996 0 R -/Annots [ 1007 0 R 1008 0 R ] +/Parent 1001 0 R +/Annots [ 1012 0 R 1013 0 R ] >> endobj -1007 0 obj << +1012 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [464.1993 509.0768 511.2325 521.1365] +/Rect [464.1993 519.4233 511.2325 531.4829] /Subtype /Link /A << /S /GoTo /D (proposed_standards) >> >> endobj -1008 0 obj << +1013 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [55.6967 498.1379 105.4 509.1813] +/Rect [55.6967 508.4843 105.4 519.5278] /Subtype /Link /A << /S /GoTo /D (proposed_standards) >> >> endobj -1005 0 obj << -/D [1003 0 R /XYZ 56.6929 794.5015 null] +1010 0 obj << +/D [1008 0 R /XYZ 56.6929 794.5015 null] >> endobj 146 0 obj << -/D [1003 0 R /XYZ 56.6929 577.5408 null] +/D [1008 0 R /XYZ 56.6929 584.989 null] >> endobj -1006 0 obj << -/D [1003 0 R /XYZ 56.6929 542.4624 null] +1011 0 obj << +/D [1008 0 R /XYZ 56.6929 551.635 null] >> endobj 150 0 obj << -/D [1003 0 R /XYZ 56.6929 380.9794 null] +/D [1008 0 R /XYZ 56.6929 396.4263 null] >> endobj -1009 0 obj << -/D [1003 0 R /XYZ 56.6929 343.6916 null] +1014 0 obj << +/D [1008 0 R /XYZ 56.6929 360.8629 null] +>> endobj +154 0 obj << +/D [1008 0 R /XYZ 56.6929 173.1662 null] +>> endobj +1015 0 obj << +/D [1008 0 R /XYZ 56.6929 145.9427 null] >> endobj -1002 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F21 654 0 R /F55 965 0 R /F39 858 0 R /F48 880 0 R /F47 874 0 R >> +1007 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F55 970 0 R /F39 863 0 R /F48 885 0 R /F47 879 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1013 0 obj << +1019 0 obj << /Length 2880 /Filter /FlateDecode >> @@ -3237,29 +3297,29 @@ _©ƒ©A˜[ÌÛªÃ3šÍ?¾ü"— 3.=½ MQ ‡o(GèËuËámˆåL ˜¦MY.|^ÂÏÊyqç³ ªºìIú³ÏÎ$ÿ¥þ08Kpó< ŸÞà 3hóešf8™Nf8°i ìbÂ/xN¥|Šýï°|Gÿô?ájQÖóíê’þ,®º¬îK,ú˜¾š2¢*š¸ŠDŧïQúÍFÇoE×Ø%?¿4 ½_ŽÓp·Œµrl- >VwÑïø^£Œ¿º,‡ö¬…cN+7‘ P…ÿC z¹½žÐâ}bÚ-ü,ý`׶wñ¢ >` ¹RLìPc!âä}bv¼+ £`ˆ+ùiXA¸4Æ
Íy/_
ºö¾à÷Œµ`Î9* ‹ùšÆ|1
Ö´ýWfàœ–ÁÿùK©_…à éá¿_E›¢1 î£é´> f«Ûzv]Í–å¶ÜƒŽrFu‹à-Žt’Ùk¢cc¾sLÐ40YVô–W |G X Ã?1>øÿÇ×%&
·srÜŒ·ÌÉ<‹D!/rÇqÚ?ØÛ%ý?mwendstream endobj -1012 0 obj << +1018 0 obj << /Type /Page -/Contents 1013 0 R -/Resources 1011 0 R +/Contents 1019 0 R +/Resources 1017 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 996 0 R -/Annots [ 1015 0 R ] +/Parent 1001 0 R +/Annots [ 1021 0 R ] >> endobj -1015 0 obj << +1021 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [417.8476 228.9788 466.5943 241.0384] /Subtype /Link /A << /S /GoTo /D (sample_configuration) >> >> endobj -1014 0 obj << -/D [1012 0 R /XYZ 85.0394 794.5015 null] +1020 0 obj << +/D [1018 0 R /XYZ 85.0394 794.5015 null] >> endobj -1011 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F39 858 0 R /F47 874 0 R /F14 681 0 R >> +1017 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F47 879 0 R /F14 685 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1018 0 obj << +1024 0 obj << /Length 837 /Filter /FlateDecode >> @@ -3267,21 +3327,21 @@ stream xÚÅWKSÛ0¾ûWx8%+zÙ–Ë)…Жé0”¸½ gVé…³ Œ´QXK `Z yÊÈ endobj -1017 0 obj << +1023 0 obj << /Type /Page -/Contents 1018 0 R -/Resources 1016 0 R +/Contents 1024 0 R +/Resources 1022 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 996 0 R +/Parent 1001 0 R >> endobj -1019 0 obj << -/D [1017 0 R /XYZ 56.6929 794.5015 null] +1025 0 obj << +/D [1023 0 R /XYZ 56.6929 794.5015 null] >> endobj -1016 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F23 678 0 R >> +1022 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1022 0 obj << +1028 0 obj << /Length 2146 /Filter /FlateDecode >> @@ -3296,39 +3356,39 @@ xÚ¥ÛrÛ¶òÝ_¡É“4 a¼">¸‰“¸—4'Ö9/M'‘ÄT$^ì¨gοŸ],@‰2ݤSkÆ KÖûcâf ±$îf ˉ&Ägqdd<h< ;‡'ȨÜc>’ᮨl–÷L\Ø&¥¨ŽhÊŸzœ†»IEC#Â÷#Ë!$â)IcûIlqر!pRPGÊQŠ ðeÏ¢™˜…¢“Yéî^ëŠØOŸ– XøÎèØò nEȤ/ϽgL _|qzBHL÷IR9XÞžð*bS5«Š æ<\¢}Íû½±üÐ×ÕsêÉô¨>‡îy”>q<à Ã5&XHUKטpB7à¬ìÛÎ:§>kÚÉÕöUíê8ÞѲ ŸÅg@ÀÒ4G ¼ìªïêŠpFD¬ÓaëðU‡!b¬ø¨±¦< EXÜØ‹álsôgX)¸H=Ð8-°åä1ÍW‡N»ÖSÎßürõÂûåeD+Òiitm¤½Sê;SÉâdþs
íÞdAµM×â µ;i0"ª*¸cºmê_ÒÇNkÕ…:ŸÔ6 *GŽd8[w¹3]©p•'¥úR”}9ÜAxOmŒ™mÁˆ#.,ÃE‡/D!15ñÚ‘¬/©á=¦:× #x\^@/Ô¹„slÉx¸ µ±yŸÙ“Š†£a“cƒf½3LÇNEÝ 9U^µq<8þBo+OѸ-Uæ•yd¡+ûò©Xô7¿Þ.í“Ø›vçӛɥ I˜UKNÏéÂ&öÑñ°~É endobj -1021 0 obj << +1027 0 obj << /Type /Page -/Contents 1022 0 R -/Resources 1020 0 R +/Contents 1028 0 R +/Resources 1026 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 996 0 R ->> endobj -1023 0 obj << -/D [1021 0 R /XYZ 85.0394 794.5015 null] ->> endobj -154 0 obj << -/D [1021 0 R /XYZ 85.0394 479.27 null] +/Parent 1001 0 R >> endobj -1024 0 obj << -/D [1021 0 R /XYZ 85.0394 444.0186 null] +1029 0 obj << +/D [1027 0 R /XYZ 85.0394 794.5015 null] >> endobj 158 0 obj << -/D [1021 0 R /XYZ 85.0394 287.5734 null] +/D [1027 0 R /XYZ 85.0394 479.27 null] >> endobj -1025 0 obj << -/D [1021 0 R /XYZ 85.0394 259.9325 null] +1030 0 obj << +/D [1027 0 R /XYZ 85.0394 444.0186 null] >> endobj 162 0 obj << -/D [1021 0 R /XYZ 85.0394 214.4637 null] +/D [1027 0 R /XYZ 85.0394 287.5734 null] >> endobj -1026 0 obj << -/D [1021 0 R /XYZ 85.0394 191.8161 null] +1031 0 obj << +/D [1027 0 R /XYZ 85.0394 259.9325 null] >> endobj -1020 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F23 678 0 R /F21 654 0 R /F47 874 0 R /F48 880 0 R >> +166 0 obj << +/D [1027 0 R /XYZ 85.0394 214.4637 null] +>> endobj +1032 0 obj << +/D [1027 0 R /XYZ 85.0394 191.8161 null] +>> endobj +1026 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F21 658 0 R /F47 879 0 R /F48 885 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1029 0 obj << +1035 0 obj << /Length 2336 /Filter /FlateDecode >> @@ -3340,189 +3400,195 @@ r¥mÓd-Äô—…½!ª>.Ù14 sÚ˜zRunýŽ|[¢”"ç'CÖ-—¶ëx>œÉò %Øõæ1$¡#ÂR»^Û¶(Nçc¬òMæBBt&ƒû!¹—õ]*tM;^ÝcT?æÈþö_šƒ.CEÙ‚µ?‡öþsmîçå§S°2<¶|Ö8JÏL]\™æÖ˜'Ím…›0h·‹¤¨n°>åwfeÇû¶nþŠV›ª nwžü,5•g¿¾²‚zÊFä |yvnvfÄÉ…P„êÿÍľF8ŽÕ:‚©H$OÕ:‚é(öXTãåwk±ë÷ÝÅÈŠÏUÛý“cˆGJö«,ùd•åE½9´×LÖ*,Ô:æf¯[øí”Â{Oí‘ (P^üùw«†·çÖ5JèH•¦'hé@R5Šmuß6¸D-ŒP°ÝêþXÓº |ÉXUú¸ ˜wsàe•¡ eÕ \“ºG€¦% w.Ü#‚í ª1 Èßðž†Ù3/)Ó¥ËùC™òN_Œ
Þõ˜u%,P±zº„Wô%7È5s—Æ,c5Ðe™¨KY=·ÀrŠSdöckj’”óæÁŽžG8)g5
θ͋G+Zîr›[um@äS0€êƒYS"¡„®XsýhJrq2üªf‡Ø´íÄg`€T‹6ÑÕ9˜Âêa€;§jîo~ÃÛE “.Þ5.ß¹ÑàrÐa€N÷VÐ3‘uÛݳ„4PCeÚàs¹eÖ}wC@^Žµx«aðd DÐg]^Zåm[ztÀ.h»±æîö# 8X]äöçöìÑ>n!p<A„ÚSñt˜DwŒÓ¥“÷¶$HÅ´ÖáÐ.‡ž3f#ŽÍp¬¾êÚ£ÅpyÚ ûE¦"ˆ^´©œÁ· ´öV¹pE Ž/!8 «âé’ÇöoV8zD( œ>$fN ;ëÅ Á‚ðÍÈ=ù d endobj -1028 0 obj << +1034 0 obj << /Type /Page -/Contents 1029 0 R -/Resources 1027 0 R +/Contents 1035 0 R +/Resources 1033 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 996 0 R ->> endobj -1030 0 obj << -/D [1028 0 R /XYZ 56.6929 794.5015 null] +/Parent 1001 0 R >> endobj -166 0 obj << -/D [1028 0 R /XYZ 56.6929 769.5949 null] ->> endobj -1031 0 obj << -/D [1028 0 R /XYZ 56.6929 752.2692 null] +1036 0 obj << +/D [1034 0 R /XYZ 56.6929 794.5015 null] >> endobj 170 0 obj << -/D [1028 0 R /XYZ 56.6929 663.7495 null] +/D [1034 0 R /XYZ 56.6929 769.5949 null] >> endobj -1032 0 obj << -/D [1028 0 R /XYZ 56.6929 633.2462 null] +1037 0 obj << +/D [1034 0 R /XYZ 56.6929 752.2692 null] >> endobj 174 0 obj << -/D [1028 0 R /XYZ 56.6929 587.2939 null] +/D [1034 0 R /XYZ 56.6929 663.7495 null] >> endobj -1033 0 obj << -/D [1028 0 R /XYZ 56.6929 559.4406 null] +1038 0 obj << +/D [1034 0 R /XYZ 56.6929 633.2462 null] >> endobj 178 0 obj << -/D [1028 0 R /XYZ 56.6929 362.928 null] +/D [1034 0 R /XYZ 56.6929 587.2939 null] >> endobj -1034 0 obj << -/D [1028 0 R /XYZ 56.6929 335.0747 null] +1039 0 obj << +/D [1034 0 R /XYZ 56.6929 559.4406 null] >> endobj 182 0 obj << -/D [1028 0 R /XYZ 56.6929 132.2109 null] +/D [1034 0 R /XYZ 56.6929 362.928 null] >> endobj -1035 0 obj << -/D [1028 0 R /XYZ 56.6929 104.3577 null] +1040 0 obj << +/D [1034 0 R /XYZ 56.6929 335.0747 null] >> endobj -1027 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F47 874 0 R /F39 858 0 R /F14 681 0 R >> +186 0 obj << +/D [1034 0 R /XYZ 56.6929 132.2109 null] +>> endobj +1041 0 obj << +/D [1034 0 R /XYZ 56.6929 104.3577 null] +>> endobj +1033 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F47 879 0 R /F39 863 0 R /F14 685 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1038 0 obj << -/Length 2907 +1044 0 obj << +/Length 2916 /Filter /FlateDecode >> stream -xÚ¥YYoÜÈ~ׯ˜·Œ -PÈŽ‡•U]mÈ-@Ð^c((Ë„ëì1ëíº6o€1 ÿ/ÒF@÷óÕO—WWÜù¤Œº›CÖr¿ç |&=eÉÙ™Oi»D‘½A·;e÷˜mRÕrTWíó¼£Úëä“(Í®ºj¸ -i~3^áŽð'„n¯AhÏ4¨¯öG„Î @¶$ Jžµ]†Š@PtTâõ¾¦F…¤‡¬,03¡žIsHŸé–ˆžaìF(½ž‰*ŒÑ²‰ˆ
¤‘fU<Ñ, ŠfULš]0sÒshPÏ°£Ç Rq‘’Bã΂ÖXÅáà˜Øž©xX=¨:"Ihx*2xÀ{×¹å_–§#ð"!aQ“Uw¤Ö(ýz˜rJ´q!OG 9€Ò»¸vŒá(‡ íÄFÒ b¤TŒ]V1N#ãE…MJÝ~øéòsdÕ.°i'<’ÀV:ÊpsFDËöÿ‚ HÜ$ÁÚâY‰SD -o™€ÂÉfߪµ -Òl~ÆóxŽÇðû¦ìÅÍ$LÉÛ#™ddRç©ÐâÌ ‹ *—¡5ëLJlÐ…¢©¹ÞqX à„kÁy ò¥YÂ(ü¦x‘Ÿ¸ûß
õ%[»Ê‘h¬Có.µìó2wÕ§‰"Å;E¸’k+ò{ïJbÈEÝYWâé•”Nü@{Q¦3y ,Û4ÌŒ‰¾QceÂ%“Ö†&ýVE[pÀÄ.½ "F¿ÐÝ•y ¶)–ÂoéÜt¢U{ÊO£µƒ‡ÌÙÁ]”ú.þ] çs—7rú¼ËNN"öD“x&ŠÒ :ŠøǦ Ê y–ßÌZÞîšßîøC<¥Áz3ƳT:Þnãûì£j÷° -Â" +Ì:¤¢ Ž¢yÐ/¨lÇ%AÚ€–LÀ区j3Œ|ÌÞ"‡çÝÀ‡¶¨ó$J«DÐ'à9ÆqH™ë
G![q©$Z_ܶž)p@Ë%±\ ¹á$ Y°¦8f”bq*'( Ë+I'@-*®o`ÑË¡b}šn%ÉíÁC›CáRt &þŠýÞ__ákK3ó/ÙNÐÆ4ðÓîG°lëp +xÚ¥YYsÛÈ~ׯà[¨*žÁ`pÄO²%¯½©õndnR[ë}€HHB–h (YI忧¯ÁEÈvUŠUœ»§»§oz¡à§©
”É¢E’EUÚ.6û3µ¸ƒ± δÌYùI«á¬×ë³—oM²È‚,ãÅúv@+
TšêÅzûûòÍ»‹_ÖW×ç«Ðªeœ¯l¬–—ÿ8×Z//>¼¹ºä¡Ë ¹òöêâ<‰–ë_¯¯°Ge0/ +bY¹þÛÕoç¬<»Zwü
eÐÊ sŸÏ~ÿC-¶ Êg*0YjÐPβp±?‹¬ ldŒïÙ}<û{Gp0JKçtbMØ4Lf”š9¥Ø,ˆ
¡R.*–µø’ﻂõ-—¹ æ»]ý¸: ¶y+3¶es®Óe±iËéz¬»-WoŠ¿¢fàP²Áþj±2a†)ï<&+µüO\¹¯]«Wø Üó꿯˜ðH° áõ}é|K}ûTåûrÃ
ÞUFÚšKwÜlŠBD¨«Ý×JQF{/‚²äŸ…kEò\(¹ò®òndyÎ …àÂOù†‘ˆ£â˜LÊÂA)g¤…Sá- ¹
e2’¤Y‹UÙÀÆQ¼ +u6béÄk»Yßbä„2tzFåZ8˜ºŠ” +²4´xøAñT° >_iþsÕ4uãæ](Ì‚0V‰¸ «N–:ãzS8WVwÜGÑAÇËõÇ÷?pOg÷PßÃÔüŽ| Z +!0™mÅ w-”•,- Š&ßq£hx»Æ¿‡Yº|Ëù³û5Ç»8¶è!;îWVuµ"· +aë˜*h^Åå±ú³ª +^…‰ +hÜD)«ûå¬uå„$[ ,<!ÙfÆ2 Ëö f-$¡"âD-hžøƒþά¹¹©·OsE+$j.__\"*B~î!
B™ó +¿… iš¡>Ñ Q¼Z4^€|N>”<oÝ *AÑQJ–Ûš(C 9v=ä»3ê9”4‡ý=ÃÑ3ŒÝHO§gêÆhC!"bC×@³*iE³*!ÍΘ9é9²¨g pƒT Ť¤Èú½ 6TqÔ;&Ö'*îW÷*††HY ʽ påÖ7n¹dyq:/5yuGj³¯‡©NÉZy%kÅJÖ=¸âQbLûsÒe©l¨bè ªš¢bíWsˆÀ”º~ÿÓÕ nQd í ÂC
låHzóŒÎˆD/½nÿAb´ †£ØŠ)bÇÍ8žè +Ÿ@”ÂYA±ÝBÆ”%yõÄŠá´cÑÓu…Þ¨~{9ø¿¸7¤¬3ļ7aײj%ñ!T󘸘 Ë?¯1Þ^üº~'0¨q^Ã8}Žª¶Ü€+n‘Ú +$,‚ªD\†ß¬3 (‰EŠÇæ6¸ëYŸ”±¶&pr*_‘%Š£oŠëÔŸÿ¦ƒrµ]’G ç¿O-ÛbWøª‘"(yEøg Ö¦*)ïýs‡òCY ê•<¯èÐq ¦3º0ÌÛ4Ì¿Qe£9“6–&•UÙ– 0±Iw‡˜247»’¼ëK¡ìpŸŸN}Õ–òÓ`mï!Söp¥¾‹ÿÌóùX4²úÜwGÙº°'Ú4°qœí*?ˆø‡¦¤×A +ò à #÷{Ã÷{,ˆ§,\®†˜—žúûÝÊjÍ9¡z‡e ,œÁL`"zøÃѲ•T¶ágC"À`L&{¼šà¶Í1ò1{³`dvžw
uQçI”V)#Ô. Œõ°gª7 …lÅÏ)ñòⶥ(¦ð Ij>‰½à'”Nb°ð7 endobj -1037 0 obj << +1043 0 obj << /Type /Page -/Contents 1038 0 R -/Resources 1036 0 R +/Contents 1044 0 R +/Resources 1042 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1044 0 R -/Annots [ 1040 0 R ] +/Parent 1050 0 R +/Annots [ 1046 0 R ] >> endobj -1040 0 obj << +1046 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [418.3461 669.297 487.0181 681.3566] /Subtype /Link /A << /S /GoTo /D (dynamic_update_policies) >> >> endobj -1039 0 obj << -/D [1037 0 R /XYZ 85.0394 794.5015 null] ->> endobj -186 0 obj << -/D [1037 0 R /XYZ 85.0394 648.2128 null] ->> endobj -1041 0 obj << -/D [1037 0 R /XYZ 85.0394 619.5539 null] +1045 0 obj << +/D [1043 0 R /XYZ 85.0394 794.5015 null] >> endobj 190 0 obj << -/D [1037 0 R /XYZ 85.0394 445.0359 null] +/D [1043 0 R /XYZ 85.0394 648.2128 null] >> endobj -1042 0 obj << -/D [1037 0 R /XYZ 85.0394 407.9434 null] +1047 0 obj << +/D [1043 0 R /XYZ 85.0394 619.5539 null] >> endobj 194 0 obj << -/D [1037 0 R /XYZ 85.0394 220.8457 null] +/D [1043 0 R /XYZ 85.0394 444.3683 null] >> endobj -1043 0 obj << -/D [1037 0 R /XYZ 85.0394 183.187 null] +1048 0 obj << +/D [1043 0 R /XYZ 85.0394 407.9434 null] >> endobj -1036 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F39 858 0 R /F21 654 0 R >> +198 0 obj << +/D [1043 0 R /XYZ 85.0394 220.8457 null] +>> endobj +1049 0 obj << +/D [1043 0 R /XYZ 85.0394 183.187 null] +>> endobj +1042 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F21 658 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1048 0 obj << -/Length 3089 +1054 0 obj << +/Length 3094 /Filter /FlateDecode >> stream -xÚËrã6òî¯Ða«F®Œ€ -F;·béù »Õ¾^:WG’мø\õpƒCçˆÔƒçãs×@;ïê':ÀŸÚÆuIœQ$Ú¦d
ïäÔí÷¬Ü _ͼo ݹž‡ !Jz
èÒsLc¸ÈJ¥4 )/q¥Îík×1ŒëÝŽQ ÀH×„Ý ºžK^ï±ÝlÚ®Ië<ŸýîöšŠ±p(‚të:®Z÷ëÀü{·/7ø’éÛ
Sôë’71
ò¯ˆ¶naÍSvdõ+×u|üÈ|>^Å}Ümʺ¡¥²¸Ô¶ U®/kfléàœ—E:÷'µ¬5Xu³™2ƒUÙ9oÙY•wU ÜEë¬(ewY¬'< -)´b’vÇÖ˜8hÝô Á%= À‰‡65j)Í4E$/÷åÖõnß¡G3¿m{GC$e‚M‘¤I2¿ ê "Ü!NúÍ={KE yã:rc«•‹ÇwjÉŒRV%¼ûåñ¡ÝÿV7O„xËUßîŸi¼ÝŸL8£gß¹U¼x-Íòù8é\!©5Ó 4RMiÄ$©´éH#hi:§ -&@íç¿òéTQ8åÔ¨!–ýGøÌ€õ'LÝTxL æýLhηjÌ>ïC#þ€*é=º Vå®ä|®ØñºvóÞñ 8âÄ¡úý%¦'Vcíã -–‹ (Ó·cŸ¡ -Ä ±¥ç±|,Ð…µI&ó± bÀÊdX³á; 2)†ï*†^â¸×)ÒµÓó9¸ArñR™%èCí+†” -U‚Ê€ -¦ -9a¼Áçïî¯î¿½’/ÕEDDÍP \(ÑX¬±³‹’ yf¡îG›„éÇa,?O±Jx« -µ©/÷±DyM˜—õ—%¡·@ Åý¿ P-”…*r3>ñ8.2ˆ4‹’ž‘w\ÒNǦö6ï¡ŸÉtœ û² -z
+r²?Dnc²³Py &åv(¥¼Tê9Ûb¹ÃÎùâQ\× +xÚËrã6òî¯Ða«F®Œ<Ìžœ±'™d×Ùµ=äq DØbE"‘šÏ×o7º‘Ij·|P£Ñ +J$š-RÂUÆÎR‚ŒòóîcïšnÒ½t6¯Ü/B¨ÆU8TpWú½{û=O…ÖLÊ8…¸”qeSøIƨXÚÚK +véÜŠÅ•ëVûzé:’Œ€hå…çÊ#eÜýÐ1
(o'Æ· +ŽVÞÕOt€?µë’¸¢HR«ÈÞ5È"(ÛŸY¹=ͼo ݹž‡ !J†ƒˆ4é9¦9< ¤¢•À+
gÊã îÔ¹}ðL<2®w;F} +Äœæùüëw·×DPŒ…Cñ£[×q׺_æß»}¹ÁA·n7LѯK>lÄ4È¿"Úº „5/ّͯ\×ñõ#óùx÷q·)놶ÊâVÛvHT¹¾¬™±¥ƒ{^jîojYk°ëf3e«²sÞ®³Â[•w] œ%M•B¬"gY¬'ü ÂŽ)RÍ$íŽ13pѺé;‚Kúy< +¡°ì<Ãw¬¿)`ê¦Âkú0ègBs¶Õcöù šyô· + g³y¦ñªm0T=q ¯hÎ’ÈÏè¼WÝ”|ŠÊü
ùj*ŠlŠ&(®a¡ŒéÊeû>ÚH°›8[7'Ä¿§›¸„u
etàÕ—Ã)…Ejcc!¹„þÆ5Pô>úã>߃¯NÔ*Çh,CpŠç lªHd–lSUÓk/àâO®™Ø2CI‹P¿r1Eúvì3Tø+¶ôûD, Ëtam’É|l‚p 2Öl8fÄAFaøn ihç½N‘®^ÏÁ
’‹—ÊÄ,A j_1(*T **˜€cWô‹å<pÕOx=e•%®Pñ9¿7@Ck`î¤ ÜINHÜ<0˜Ì‚ó{]ð xmUóŸ&öc©´.ß»:(j"4Éå멲¸Õa)@ýóŽ!jN¬2³I!bKõÓ·7ƨŠD«"„Ã×´ å~@K>éÐqÆ°!µ ý¨©ÄŒ' tå•ÞžŽúÝn]S9>€ëB€X9 +‚Œ—f/ Á-ÉAjl…ÇÓ¡ñ{¶3Á0 )™ __ćAïvãw@aÞ¬µOù4vâ‘þ
+a+ÓtlÈ +ð˜~CYˆ|q`õ 2¿œ‹ñäL +üã qÚÑÑ\5áy-ý!Œ(p†÷O'Š›jºg¸Îa¹lB%¾3“õv'ã _Œ™)7þ<[eI*äÔå&KÂ¥G÷!tþ="dc‰Ü$ÆdgA2,ÊíPJy1¨Ñs¶ Äro󓢸¢G¾Û÷þ™gQ4ËäËþtƒ’Uýˆ« Ý { žÈ±À—%áihçJÞŽ¹°±w +ScvøÛ»Û7ÿøñzª2„"rU.NÞÓ±£ô•Q÷g;.Å ×=˜j¬Zb#÷—Dÿ·¾ =âÓô¦yÕÈ_ﻸo9–Q¸=û~·0À¸÷jž§ò²JZˆoC®Ÿ`RÛÄš¢8Ó©€àÛrÙíÚ¦ªÁ±¼ ÉÏøòä‰ X?,}dzÁ˜³ƒg— ÷L²GÀ›±àO {ÂrÑ#bdõ¯
ç×]`©“ª“s;ýÝJa]“™?¬k@ÂY¡C¸»»÷Í”øT’ËTN¾ïøº?=ö-\ §áqEA<,™ˆûH€ÊnŠ
܈øŒûÒSS)–IøÔð˜
LJwEf€® 'ŽÃ”Ç^-ªW/ +1ôr5ï7xŸFK97uBf ·õúð–BòR½FšŽ¯Ã^Gçg‡ºæWœ»;p†n¢¡ †=¹ÇY‡ÏÑîÔq—¡û©ª0yààŸÃð›ñË}–.²aŸ…ÃØgá endobj -1047 0 obj << +1053 0 obj << /Type /Page -/Contents 1048 0 R -/Resources 1046 0 R +/Contents 1054 0 R +/Resources 1052 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1044 0 R ->> endobj -1049 0 obj << -/D [1047 0 R /XYZ 56.6929 794.5015 null] ->> endobj -198 0 obj << -/D [1047 0 R /XYZ 56.6929 769.5949 null] +/Parent 1050 0 R >> endobj -1050 0 obj << -/D [1047 0 R /XYZ 56.6929 747.8139 null] +1055 0 obj << +/D [1053 0 R /XYZ 56.6929 794.5015 null] >> endobj 202 0 obj << -/D [1047 0 R /XYZ 56.6929 540.916 null] +/D [1053 0 R /XYZ 56.6929 769.5949 null] >> endobj -1051 0 obj << -/D [1047 0 R /XYZ 56.6929 511.3349 null] +1056 0 obj << +/D [1053 0 R /XYZ 56.6929 747.8139 null] >> endobj 206 0 obj << -/D [1047 0 R /XYZ 56.6929 239.6059 null] +/D [1053 0 R /XYZ 56.6929 540.916 null] >> endobj -1052 0 obj << -/D [1047 0 R /XYZ 56.6929 207.3747 null] +1057 0 obj << +/D [1053 0 R /XYZ 56.6929 511.3349 null] >> endobj -1046 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F47 874 0 R /F39 858 0 R /F48 880 0 R >> +210 0 obj << +/D [1053 0 R /XYZ 56.6929 239.6059 null] +>> endobj +1058 0 obj << +/D [1053 0 R /XYZ 56.6929 207.3747 null] +>> endobj +1052 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F47 879 0 R /F39 863 0 R /F48 885 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1055 0 obj << -/Length 2920 +1061 0 obj << +/Length 2903 /Filter /FlateDecode >> stream -xÚµYI“«8¾×¯¨x—qMua$±FÇ ¼=ï;xëYlÀëÄü÷Ñ.\™× > R©T._¦R¼òø^‘ã‘*¼ÊªÀ‰<_Mÿ…uð\ó¤< ÓGž«ª½”¿#ùUåT J¯Ú&'KáxE¯šõ[©ÖªŒ´ÆäíŠ|IàÞ>D‰/Uê³7 -PEáuJº³Mµ·?´ÎKC{h˜·ðˆ¨w|ùíþÕÂÆt^x©ŠøzÁ/<T¾ú/‚ˆ8Q@(£x/Ó—ñC`n–.-òŠˆNT \àŠÜ"ªœ„ ¢n±‚8¶ÍØu‚{ØÄ ¼ å–É2'ŠªŒ÷"ü×ó°¹dxqÈF‡è
(¥Ð:™v:Å {ûÛIJ -,2PJVü ýÎóгã'¹ 7 Ï»= ³¼ó—…8%mkÇÙ¾T›mtŠm‹˜ƒÝ’Zð -ÃXÌÀ˜V‚'Ëó6á(« ’ô eÿ§\?Âý%¢7;¦q$2§ª¸B=9\”þ‹ÃNäŸû[$”÷7–y6<×Â~eoF_lš¨¢œ÷ ž -1æ"6ŒS´Ð—5ž(P à2 ýIÇIÎy ¥Ü¤Î‰Ä ¤~‘øп (CNJ&“Æ€f¢€ -jæð|j=ŒÅãÔ"Ÿõ?9x³ðåë]–·Ö—- -c <Ê$;Tgz.ùó2+VEçÿ*²s©ú´‰eÇfä®?Ó“=ýð™)1ÜÔ~[=3'[7u“š' <Ü‚tß']õÀs÷D°ŒJÕö€ô߸ßV~!OõAA%•MX!m1!F•ÚÝÜ‘t°F’Ö˜”1 ŸV*–ö¬x*íäðd[L£9KÆ)Ù†‘‹›;÷œr¥iLf‘ˆÙ©–ˬÀþŠ‡Gù=ئKù«“ ù,•i‚1ëv NÐʆŠ-B*³]z<J/T¢ŠýAa'‘cÜHRCñˆŠ9ñ%Ii´ŒK0©ô쌆içé„ñGí% -½„™îÅ©ŠÙÍJâŸÚý/A$‹
XïJžvŸžè´È!¦= %’`Ч/ÌÐO›cßíŒ1ȤÙLXÛlFN¤ÌÄ!9fÄî!nr{LXótãK/!1WШË~$éÇÂû!á«È?©xAæÈã»'DœŠob”¹L§DN•eR9Y@lâït"ƒMnb’šGÄvmv|‰ô"‚ -–§rst¶ßÀ· ªè˜ß¸oL2î‹Ù -‘J>½ý¥Ä€âx€äg/ØWÃ?àƒ×$Wa†ˆi†T.JŸŽúæ^ùÖz<æöª*…úâ=âÇ}Iì®·Ú.šƒ•Q™ø£mcµbê|ayIy)ZªîÆiœŽòyU¾7WºÕhæ·÷Îê~ŠyO?$g×¼lõ)E¥µ:]}½.ÇP3ûÊá²ðv|Ã] °þ}æïZCAœÞ¾:dè]}Sökrë¼¹,[åª
a3¨!Ã‹Ü Û9€¡#Ü.÷¡:w¼þ^Þ7s„ ½{v#A±Ù“§ÚX¿W×¢ _ Û$Ås‚›¦·b Î¥¶·Ý•T;~¿ú•Ùjy×ÑÜ«”AÏŒœE¹Ûo4r¡‰îéü]8vj7ëäÚÓþ´D-aѯ˜“÷«k@fbÐÖGg¿ Þæ¥:/oçÖ}xŠLœÖ´×Ú «»ôìú:)‡`¨yµÂÿ#ÃûgÐþo€ÈÁONß Ü¬Âáæ@ï÷¾ìËø¢eñÙLÈ‘Îk>*õúdTá
íg8 ƒ©p
Êmg¨ ª£Z‡Îýb^‡ÖÀ¸ò2èe|\ãñ¸ÂÔUé§é|Àf³èÝím›Z0h P+œ{zûÞ:³º;Î
Í/MÚ¯BÉä‹žÄ÷åqœÍïŒkJíÞ
wýò H®Ôo–m#õiSG±k )_æÛ°-UQ|y_®¬»·ìíNs#ôëvÛÛ»µºáz9Žv·q‘B¯Ê{5Ùqÿ¶ì¶ZK{rf;®»öxá[GgØi ßϸ‰kòRá5WgÙÙªQ½ |Ð$Hw®½QžZ½< z‹÷:ÒÞ+2Bnu–沪‹=QwÓQ¼ê´ìzM¿Í—Ñy´²ãU½=9oëõ¢ýE8íž×[ÛÖ:º/5¶ûû- àt JãÉ^ٕݶ⮠°/Œæ¿~Í$³d`ÿ+°¯øÅP~5ÇqÿéO„¡ŽPÑ_ ü#™þç?X>ÿSÂê!EŸÿ<}`ä%¬¼*gJÑ ’¿jþø'æGÕÿ
¼!Xendstream +xÚµYI“«F¾÷¯èx«§Ýˆ¢XÃ1mOûÚl @b‘ +WýÀ«,0,TøWIá«῰¯6¢µ_@Æó‘3}<rÕÕ—êw(½*Œ"r⫺{%3¬,ƒWÕüµÒèÔ&jkööÁ l…gÞ>‘Ôš‹7 +lr݈nf„Õ->†évɆ€™òýæ%[çGÎB%"ÑøiÆhko¬'I¨H dåÊOØQÚøð +ºˆâ,\ÈüJtâX Â?‰œˆl–Ø<¹py+ɈBW™ÄLTKý!A• +”¢4’°È8³^øÔ<óúTàì_l”©â×ÈÆ›˜VlDîö3;éÓŸ™ÝÍì÷…Ñ3sâ¸Lfhœ}Ôl˜"ɾOºjç °` VêÝ>i£“µü3~*Å ¬(”`†äPˆ&‚0¡S¨8»»”N⳪žd%&c Êç…º™‰%§SD¢Ç6LÌ|‹æHÎâ~Nœ0rTn/W–Ƙj†t +«‘w²‡Ì +¬¯ñPߣe¸8‘¿‚\DÈg¥¤•žLæçÚ’®YÛQ pâCß+¶EÏ"B"AÈ ‹ +|ŽÍoÌ7*™$:€OoõÑš¿FË!»Þ{ce²Ñb•®ýp›Hq«µëCÛmÛºz÷nQûpë-ÃÍYìJ“{ïL·F×m‰%-àê–bßxîíZÇ[õÍ_w3G¯÷ƒ‹Ñà4Åß8S;š`‡ÕNÍÜ,yà½à¾†eλ§Ü*åÞr\kª“ûü¢Xº¿—@žtÚûú@_$ëË¡ê¦vܯmg÷.îZ^ä¦~/KÜá”7‚Zc&©ù¯×uI›U·V³“ w©®–sW\ùao°m+sãdHžÄö›'ﲚÁa™ŽUOÓ³íÁ²AwÒ›»¦ß‡›´áy¿š÷·{«Ê óþÙèØÁUöÖn˜œDÑî‡ætÿ^*Ñq ¶Ó–tV”å] tNÞéÜÖÓ)Ç~Ÿ*Òü}Ð×ÔãÔ8qÒLª©°ºœÙô67ºeVNWãÎïקM“ÛMMû¶5šjÃÓØƬnº®•†£ûª
¿ýR|M¡îý{AŽC›„ ©pxžóAôY¯~Š .tÅ5éKþ¥ê•ƒ +þÎÿJbp"dX +Fd¯ªýa«mVKMtÏ—ïü©×Hͳku·óvøÕ°fÌÞo®ÎQƒ®6¹øÕ0]Îäú²ê,Íûø”™8o¨Ž×ÙÁ›»ö¬æ6©†`¬NY¥Æþ3÷O§ýß>½ wß<¸é +¹›áþRÙ—Ð]‹“„g39]æ˜îè£ÖlÎ&5fÔRÿ(Χã`Îß‚j× kÇú¤·¡}¿·±9Òo¬@žž6Át:QuÀpä;ô£Ã‹èÝ 8m5µ°.§{ïG½ÅÞm;…ËëH›P4Ø2‡'ñ}}Ú&ÃñíiCnÜûá~X]Ñ‡íª¥g˜¶5»úØœ³enNÇ]±nOâëûzcÞ½õPïöÚ;~È›iØï:ws“N¹ízíÓi™ü Îz
I ñ0]÷;µ5»Ð'·}wºòÍ“=îµOïtŽk³biÃZ¾ƒ›½î9JÔèî ´q¤Û·Á¤Í]Vj³: «÷&T¡6(3BêôÖžSÛ4… ,.ûù$Þô:V³¡¥Ëut™l¬xÓìÎ.N³Y¶¿ÀÍû—cYjOóÅ–s¸§ÉhÄÍGŠ8 ä}ÕíÊî¶ûRoþû—\2Mú'ýd_~z\Í0ÌûÇ¢P‡°ìÿ
¶H¦¿ýoÊç HH=(ËÜç %OŸñ—stÎÏ•"$}Õ¼øÛåGÕÿôt úendstream endobj -1054 0 obj << +1060 0 obj << /Type /Page -/Contents 1055 0 R -/Resources 1053 0 R +/Contents 1061 0 R +/Resources 1059 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1044 0 R +/Parent 1050 0 R >> endobj -1056 0 obj << -/D [1054 0 R /XYZ 85.0394 794.5015 null] +1062 0 obj << +/D [1060 0 R /XYZ 85.0394 794.5015 null] >> endobj -210 0 obj << -/D [1054 0 R /XYZ 85.0394 717.5894 null] +214 0 obj << +/D [1060 0 R /XYZ 85.0394 717.5894 null] >> endobj -1057 0 obj << -/D [1054 0 R /XYZ 85.0394 690.1986 null] +1063 0 obj << +/D [1060 0 R /XYZ 85.0394 690.1986 null] >> endobj -1053 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R >> +1059 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1060 0 obj << +1066 0 obj << /Length 2379 /Filter /FlateDecode >> @@ -3539,48 +3605,48 @@ tÒ“'--$¤ƒÞ:Û…k"wŸÜTx½ñ¨¡ãà:wá¹™ŠZŠ œí†Ð Eôz82CT¼~1ŒCÜB—×Ñ¡h±óþ½×=ÎxKo ?Qù=‘ ê#ÏgÙ¥XíÀÕXu¾ŸõùŠ¶€$y&zT¼çNª ÿµwQŵ³»Wdî¡!æÁûî¥ë5”ÓÂ}…×ÝlÆ`DB"zÆ^gÈŒ}Ò]„£Ã™ý÷eç-ª] ™¢c$È6 £” òåjÎ$PšÀƒ endobj -1059 0 obj << +1065 0 obj << /Type /Page -/Contents 1060 0 R -/Resources 1058 0 R +/Contents 1066 0 R +/Resources 1064 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1044 0 R -/Annots [ 1063 0 R ] +/Parent 1050 0 R +/Annots [ 1069 0 R ] >> endobj -1063 0 obj << +1069 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [349.4919 384.4828 408.4801 395.2672] /Subtype /Link /A << /S /GoTo /D (ipv6addresses) >> >> endobj -1061 0 obj << -/D [1059 0 R /XYZ 56.6929 794.5015 null] ->> endobj -214 0 obj << -/D [1059 0 R /XYZ 56.6929 594.1106 null] ->> endobj -1062 0 obj << -/D [1059 0 R /XYZ 56.6929 562.6395 null] +1067 0 obj << +/D [1065 0 R /XYZ 56.6929 794.5015 null] >> endobj 218 0 obj << -/D [1059 0 R /XYZ 56.6929 370.2937 null] +/D [1065 0 R /XYZ 56.6929 594.1106 null] >> endobj -1064 0 obj << -/D [1059 0 R /XYZ 56.6929 341.714 null] +1068 0 obj << +/D [1065 0 R /XYZ 56.6929 562.6395 null] >> endobj 222 0 obj << -/D [1059 0 R /XYZ 56.6929 214.6004 null] +/D [1065 0 R /XYZ 56.6929 370.2937 null] >> endobj -1065 0 obj << -/D [1059 0 R /XYZ 56.6929 186.0207 null] +1070 0 obj << +/D [1065 0 R /XYZ 56.6929 341.714 null] >> endobj -1058 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F23 678 0 R /F62 990 0 R /F21 654 0 R /F47 874 0 R >> -/XObject << /Im2 979 0 R >> +226 0 obj << +/D [1065 0 R /XYZ 56.6929 214.6004 null] +>> endobj +1071 0 obj << +/D [1065 0 R /XYZ 56.6929 186.0207 null] +>> endobj +1064 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F62 995 0 R /F21 658 0 R /F47 879 0 R >> +/XObject << /Im2 984 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1069 0 obj << +1075 0 obj << /Length 1913 /Filter /FlateDecode >> @@ -3590,59 +3656,59 @@ xÚX_Û8ï§È£h\KòßÇöfoÑÅ]±èÎ>]ïA±•‰P[ÊFöäæÛ )JNœqºE€˜¦(Š"© )³M?¶©‹4M¾©š<-2Vl ve ÒÖNÏ ¬—ê¼g¸rÞÊ.ÎèŒÈ¢h¡Á¾¨îý<æBh%ÒËÞ:z³á˜èáhÓ»>HÅôÑhÇ L8[Ú,²j¼œ—D>Õ/…T¿—T„
¬ñØ€0š&îm´Ù4DÈÞY¢Bž¼è.ÈÜ&ò0§5¤RP ¦†³à÷öÆ'çSʯ†í°ÓF^b ®Æû+ìY‰Óò¸ó†_Ž;oDHàJz+ÞI©!úê`Dñ:™Œ¡£ Q’â™ÞR-ÅãT!pº M&PÄqíèÙi7jÓŽ4¾§YyŸ"A¦Í ì‚d,"û©ì±‰kkÒ;¥)ÏR^Š:”& JÓ×9*—“²,Jן©IW؃È!6Š‚O endobj -1068 0 obj << +1074 0 obj << /Type /Page -/Contents 1069 0 R -/Resources 1067 0 R +/Contents 1075 0 R +/Resources 1073 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1044 0 R ->> endobj -1070 0 obj << -/D [1068 0 R /XYZ 85.0394 794.5015 null] +/Parent 1050 0 R >> endobj -226 0 obj << -/D [1068 0 R /XYZ 85.0394 769.5949 null] ->> endobj -1071 0 obj << -/D [1068 0 R /XYZ 85.0394 576.7004 null] +1076 0 obj << +/D [1074 0 R /XYZ 85.0394 794.5015 null] >> endobj 230 0 obj << -/D [1068 0 R /XYZ 85.0394 576.7004 null] +/D [1074 0 R /XYZ 85.0394 769.5949 null] >> endobj -1072 0 obj << -/D [1068 0 R /XYZ 85.0394 544.8207 null] +1077 0 obj << +/D [1074 0 R /XYZ 85.0394 576.7004 null] >> endobj 234 0 obj << -/D [1068 0 R /XYZ 85.0394 403.9445 null] +/D [1074 0 R /XYZ 85.0394 576.7004 null] >> endobj -1073 0 obj << -/D [1068 0 R /XYZ 85.0394 368.2811 null] +1078 0 obj << +/D [1074 0 R /XYZ 85.0394 544.8207 null] >> endobj -1067 0 obj << -/Font << /F21 654 0 R /F23 678 0 R /F39 858 0 R >> +238 0 obj << +/D [1074 0 R /XYZ 85.0394 403.9445 null] +>> endobj +1079 0 obj << +/D [1074 0 R /XYZ 85.0394 368.2811 null] +>> endobj +1073 0 obj << +/Font << /F21 658 0 R /F23 682 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1076 0 obj << +1082 0 obj << /Length 69 /Filter /FlateDecode >> stream xÚ3T0 endobj -1075 0 obj << +1081 0 obj << /Type /Page -/Contents 1076 0 R -/Resources 1074 0 R +/Contents 1082 0 R +/Resources 1080 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1044 0 R +/Parent 1050 0 R >> endobj -1077 0 obj << -/D [1075 0 R /XYZ 56.6929 794.5015 null] +1083 0 obj << +/D [1081 0 R /XYZ 56.6929 794.5015 null] >> endobj -1074 0 obj << +1080 0 obj << /ProcSet [ /PDF ] >> endobj -1080 0 obj << +1086 0 obj << /Length 3113 /Filter /FlateDecode >> @@ -3662,152 +3728,150 @@ Hy‰¨Uc‹\`e*Y;
Þ7hfå*óUÌ8ëÏ;xÃ
”èÚÞŠçßEž
w¨µzÌsÖµƒëðL;s”=—Í⫬ƒWŽi}n‹¥÷ ³ÆGZP[ññk(ü[wÔ6-µ]_6 zü´ ‘5h Ésª\0Á03 “ã…õ"GÌX€2Á K!§óÝ–(Š¯x¼‡]Ç^ 2Èíc™¨ /Öìªn>EXX'»ÃîÅOÃ;"¢Ùmðx¥Z 5 =J·[S 2³¾ÍAèAøñ¡êŸ«ªÉ²œÈK’dB©
›Êó>”_>u|¶ô&2¶‡œÚy¹Š(FiÁ©Ï“Ã[ã’Ï{¬ —=+K£z©Â©«Â&±ÂPÙ÷å|qh endobj -1079 0 obj << +1085 0 obj << /Type /Page -/Contents 1080 0 R -/Resources 1078 0 R +/Contents 1086 0 R +/Resources 1084 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1087 0 R -/Annots [ 1086 0 R ] +/Parent 1093 0 R +/Annots [ 1092 0 R ] >> endobj -1086 0 obj << +1092 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [356.2946 363.7923 412.5133 376.6291] /Subtype /Link /A << /S /GoTo /D (address_match_lists) >> >> endobj -1081 0 obj << -/D [1079 0 R /XYZ 85.0394 794.5015 null] ->> endobj -238 0 obj << -/D [1079 0 R /XYZ 85.0394 769.5949 null] ->> endobj -1082 0 obj << -/D [1079 0 R /XYZ 85.0394 576.7004 null] +1087 0 obj << +/D [1085 0 R /XYZ 85.0394 794.5015 null] >> endobj 242 0 obj << -/D [1079 0 R /XYZ 85.0394 479.565 null] ->> endobj -1083 0 obj << -/D [1079 0 R /XYZ 85.0394 441.8891 null] ->> endobj -1084 0 obj << -/D [1079 0 R /XYZ 85.0394 424.9629 null] ->> endobj -1085 0 obj << -/D [1079 0 R /XYZ 85.0394 413.0077 null] ->> endobj -1078 0 obj << -/Font << /F21 654 0 R /F23 678 0 R /F39 858 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -1091 0 obj << -/Length 3627 -/Filter /FlateDecode ->> -stream -xÚÍ[[sã¶~÷¯PŸ"gV0î—dú°I¼©Ód“nœéC’ÙÐms–"µ"µ^§íïÁ")HVje¦³“Áƒƒƒs¾sL&þ‘‰Hj&Êp$0“ùò OîàÝ×g$Œ™ÅA³þ¨/®Ï.^151ÈH*'×·=ZaÉäzñóT"‚Ξ~ùýëWW_ÿôæå¹âÓë«ï_ŸÏ¨ÀÓWWß^úÖå·—ß]¾¾þ~af¦_þíå×—oü;ˆ|qõú+ßcücÕ7—¯.ß\¾þòòü×ëoÎ.¯»ÅôL0³+yöó¯x²€us†3ZL àFÄ:YžqÁàŒÅžòìdzt{oݧ)rN¤‚MfZ"ª¤Ø?ŸÃ´¡) RJèѬ3©‘$Øî ÖˆÒÞ–˜Þ–(ŽŒVD$£ÌíH±ËD+$˜1ÛaG…aÓ"™E‚³>Å]î F‚ŽÙ[ÕëÖ2xñ -:¶c …¶bv -;êeu>c°ãW?øçö«Á ‚"…… U›åM¾Ngi)D†„ ¢‹'éÔMV4ž³²Xm¾ð?ÚÚ>Ù‡Ÿ÷ës¢§õæîÞw -ƒWž±yÞ40‡åùXŸÃWUUTwÀ9–Ó¬ñOÿ]}N¦-˜,WzzUù7M½ÌmKLç}mŠ§Y¿oóuѼó#~Áÿöé'ð þõü>[gÀ÷:ü„ÏLy°¹±e—³ð-Ç– -’ -!PP$î0â0íHÚ*oB<@TtŒ"ŠÂ4%"NÁ U?f|΢Œ8ìUC#Ú# *"ŒçMí‹éOŃ‹G€võÄÓýÇS3H/”îTI§Ø÷7§òŠ ·ø ‘n¯W¤ö0{Eú¢±t+~—?Ž×l M JlÇ=""ÁYŸbÂ-‚Z£ ðW,’.ä`º0øeÊ·aÄš
áQVT;`›Ï™R§[iGñ‰¥RìQ)†k²ež'È9¢±ø°nbä¼j]`Kw±
GZܹ"Û“ùG±iˆ -Ýo»ù„ë2©2>Æ†î› -6D(2D= ±Rça×¾ÑB -rÑ“I¦£ø„h˜õ€ýCÙ¤ñ&è¿_…K… -±ç‹,=ø(!øW®ûQAÒtþuSE|ÛS0¤Œî•z,å.=b*HÊ(S1˜^ä·Ù¦LCœ Í»¢ÚÖ|<Pø—ÉÒˆFt…íŠf\ÐäŽ3 -† -Y0!Ã\äýL¼ñKÔVë]z!0sÛd;»² -aÖã+5”ç2ûX,7K‹Áï~ÈŠÒ{L÷sYo*[®Wàš“i 7clFûkƒø¤Øíy—fDLÖ°µL=[ì ÅYŸä®Ø9çHS€§nØ!±+¤
ï $žt€²ƒ U.;;p{m# ‡¬†·ÞZæÑx\us`OM¾þ¯GŸ7m¶nCä0vÉu¤â˜“)aÔ°yâ°zeÓKFdûã˼¾Æk{Ã[Õ+œg¥÷…v$d¨õú³&PÂ-þD$û{‚+Èìâ’Žtµ^'Ȇ(qïÔ Ò¸1—F3ͧ¾ylíÓ.Q Dy÷Íw{ˆÊ¨øG0¶<š±%DÖ±'f[K ƒ8:Rÿú Þ Íá]ÑU!‚˜bT…ܲÏë‚""‚ä¾éTžöTÒ
¤®ùi÷›ù€8æÓîéCGWžk¶)IÙ«„ŒG^ßçþ¤0fÐ\n\ΕWóxXÙ¯ú„,¢wž™ù/$‰tmª¦¸«œq`Ù¥A‰„Â&E6ÓÁÔŸ3Z͹Tœc€&lJâ’ "v’ 7ý© ‡ãJV6`’Çøv‰4Ár[aö; -ù#jT{ï é&o:\‹‰P -|+2JyÙ>zï’*_uãNV¾êSÜ_¾ðç‘£Ï ,Â-˜ådüuŸ`Š0@Ø€ÁªNEËàæ¹`ÑÉ\.Éß…@†Ÿ‰öb @¼,ºc›}HŠŠÆ”æhPÕ²‡jš8Å1t“rF -Ÿû!ßø5”¡†Äö±9ä#°æüK$è îˆiõ6‹âu/ʼºkïÃûel ,à ’º1Ðx[,âx¿¶yùÖŸî÷:ÿµoݾÿ? S$±§³Ž.m:#{[KÃÖ~•Û+…U±=à÷& Ÿšì.… -£M·šæÁ ñW –AÛ Y:mƒ&í¡ô¯ÖÅ2[.CƒŸáÞ½ç®),ò6_/‹* Ïç y{æïÌ•¾ÃßU€Æ YoÂ|]] ^Ô«|Ùî@D`l$ü˜JØ{LÒÚÖæœL‹Ô—ÖTWê É\k -|>‘ªRrww¥ —ûR_QÝ}¶ïO%¬ÇdþlcÿŸ†ô9Ì$¼ BfÅä–’/Ž5žQ5qþ¡ã˜‡^ž€ŸÿÙŸ1ÊÄÞñu2Xx„¹úá ž@ŒfžˆÑ'¤³ ³_8aÌS²90]'šÑtIÉô¦ &Ä,<}ÜJ&¶»ø$dtuëLûp˜Í¥XŠ[ܹ›gÿ ÎVÎ\!¦5M¯¼óð)»tFw8'è2I¬ÿ‹²l½endstream -endobj -1090 0 obj << -/Type /Page -/Contents 1091 0 R -/Resources 1089 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 1087 0 R ->> endobj -1092 0 obj << -/D [1090 0 R /XYZ 56.6929 794.5015 null] ->> endobj -246 0 obj << -/D [1090 0 R /XYZ 56.6929 304.8746 null] +/D [1085 0 R /XYZ 85.0394 769.5949 null] >> endobj 1088 0 obj << -/D [1090 0 R /XYZ 56.6929 277.1668 null] +/D [1085 0 R /XYZ 85.0394 576.7004 null] >> endobj -250 0 obj << -/D [1090 0 R /XYZ 56.6929 277.1668 null] +246 0 obj << +/D [1085 0 R /XYZ 85.0394 479.565 null] >> endobj -1093 0 obj << -/D [1090 0 R /XYZ 56.6929 249.2319 null] +1089 0 obj << +/D [1085 0 R /XYZ 85.0394 441.8891 null] >> endobj -254 0 obj << -/D [1090 0 R /XYZ 56.6929 169.6708 null] +1090 0 obj << +/D [1085 0 R /XYZ 85.0394 424.9629 null] >> endobj -1094 0 obj << -/D [1090 0 R /XYZ 56.6929 141.5207 null] +1091 0 obj << +/D [1085 0 R /XYZ 85.0394 413.0077 null] >> endobj -1089 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F23 678 0 R /F21 654 0 R /F48 880 0 R /F14 681 0 R >> +1084 0 obj << +/Font << /F21 658 0 R /F23 682 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj 1097 0 obj << -/Length 2803 +/Length 3638 /Filter /FlateDecode >> stream -xÚ]sÛ6òÝ¿B™{¨œX4@ðóúÔ¸NÏÖí%ÎÜÍ49Š‚lŽ)R%©8þ÷·‹]€DÛ¹kG -²h</æ8*'fybÎaš)¸]…bþ$dzxU)"Ø¥3ŸÞÑ©nÕñ±0 •æQ²lA¾×4¹úþŒ&EOãJ"lôŠ>—¼n¸ÓÈ- !ý#d D‘DÖ8R¥E{|ä€ûóš~(½ÑÍð¤ž#$ðy‰{«ž‘¸]õ²ÄŸ;Õ“øá±Ó÷EÉ6ņgíšeÞð¸Zu§2›ëž•°)†òŽ¦uÕ“šy¨†»çt†`¹i³Ü‹²žÒM „2̾Z7¡ ’X¼t¼UÏèÆ®zY7ÏêéæðØiÝøDz74º ¬X¿Nº)붷{*Öã²+JÝã=f ~.’Ì‚<™9ï²6âEÊJÍK£˜,Ñ.T|ÜÄ -ùÆÓa uÊF
ãŽÜPCKÏE]@Z-Ê’|-%›ow}ÊoÉ>H4 © Ä@À¶ Zã HÚúò©œ÷=Ø’ÊäüŒäXágS:wª t·¡™ñ†â´‰½µˆªfãعP1Ü*íî–/êÓª-w¨+cÚ“vô¯;«J@…ùü¶úl!W¿hSD lÁÎ…®õ…0È*bÊv³e?\mˆÙãöˆ‚¯8¼>˜‹ŠrºŠ…ÑŠ¹ºâ³îŒ ¸qÌ¡zÁè&Œl×€ A6yB¹2÷Í9Oˆ š¢„ ÀUºãÛ6FÂ^cî9™»ÝM˜•ÞêfÕÜ.¸CCéHJ(ÇK<†×/Á¼4ù|±®aQjÊÀœÁƒÆË¶È ê³½,Ï.J‚ÔÍ mÛ
=/56ï¥ Îf=,a•P‘a w ßæ¼ð -G¨I°> »‹«ýÍ´§’톕Mß«–ƒ^; ¥v'ñÂájú·Ú^SæÄVh· -¸ E -+Æ/õÚUçøí6.)è+s*ìáSñfùayWSJ„U†aØ>¦+øÐÕ87iÆ£)§)ˆÇáü]kW)6ÛZO¶)tÛ£wŒ —Ò¶Á2u Fßb.Éç¯N18R};á‰ÐúªÔ…o*‚Bå¶àW8 - QTy9§ƒ73‹À’jöW,¡Ù´ã¨:¡Or7\a“ ®i ÉÏó4 -!æíf¬×>`«÷eBn° òHÉÊo?S÷Ž›Ð;nŠöçu‡DÎ lÙ…p2’q5ƒ‘àÒíV w’ÍãÃXA!–õ8¹ûmQòtSpË;’IŸˆIÞw‰ùiÐ&nwÕL’+©5v{‰œßœæá¼%„9 ¦†wÙvn»nÖõ4!7Ô¼ú¾‚æ -ª×~(ºôªìó'‚†‡– å]Ñå`< ç¯ Žo¨}]ôØ꩘Èáƒ*¢Ö_aiâŸñúœ †ìâ·4C "üK,Î\å8]}aA RïyT¤ûÕ|¯t
U:u½ðÉ\óZÑÛ=îŠg\H@òväéqTP Ñ{zA!’åº>ÚÆž]Ѐô+(pn"®ÕPžï?\ 3VöfWÕ¶v5wƒ;Ïi>ÜÓ|¨Ìs/ò€ Ö{*•P\&Ô•‰ðeßV¼n1õñK{H妲M - -*â=ß8f œp¬ÛæËJ?—˜.øˆ›P¨ „6äë3êÔ_|*ðڄ“ðŸþ ~ü¯0J•eáôvÉ‚,ÌSË2®Ô!ç1Êq¦¬ÿÕ -€ endstream +xÚÍ[Ýsã¶÷_¡>EÎœ`|$Ó‡KâK/M.iâL ’Ì…–h›s”¨ˆÔùœ¶ÿ{w")Jvje¦s“ÁÅb±ûÛÀlBá ›(M´ãnbœ$Š25™/ÏèäÞ}yÆâ˜Y;hÖ õÙÕÙÅ+a&Ž8Íõäê¦CËj-›\-~šjÂÈ9P ÓÏ¿}óêõ—?~ÿòÜÈéÕëoߜϸ¢ÓW¯¿¾ ˯/¿¹|sõü¢ÂM?ÿÛËï®.¿ït$òÙë7_„ ¨~ùêòûË7Ÿ_žÿrõÕÙåUZLwÁŒ +\Éog?ýB' X÷Wg”gÕä ~PÂœã“å™T‚()DÛSžýpöD°óÖ:&@)Ñ\‰ÉÌjÂV‡§
SP˜66•#Æ(;˜u¦-ÑŒâžPK8ïl‰ël‰‘ÄY31@D .üŽë¡L¬!J8·ö¡p lí¸Hf-ÁY—â>wŽÅ‡ì«Mƒ ^¼‚ŽÝXÆ¡mN£^®PKìôõwø4¯z3HCŒ°:~´Ú.¯óÍq¡ˆÕJÅa jÜééÕ]>B‘ƒÚXù(ACœ€ï°¢Ì–ŲhòEษB'?ï6çÌN«íí]è~„z´'3&1œCƒ§÷T23}Ÿ•Û¼í뼬î±i§Œr:›‡u1ÏÊò!üô3åu³)æ Ùîí9›Öyh_ÇñëÀÚ<¯k˜9¢}V6çðájU¬nÏg‚êiVãS…‰ªª‰J›µ +¯ëj™‡ó (¾€6§ÓlÕ~Ü䛢~FüLýõãàÁÂëù]¶É€ïMü Ÿõ8 +°s(3ÝÖ¸@lyž?×e6Ïïªrá © +üx›6búªÚ„îüC¶\—ù‹Hˆ
Œ¼“”7vl>M”¡¬ã‘n<,¬Qjb©8¸Öòög/ ’¦I ÅcŽšÂ¶Ž8ºL•d„¶æ + u>ßnŠ&?bS m}ž mJœÒ¦(…äØ Ï`5Ó„* µ©vÜélªCñˆMuù+‹ºyŠUA¸$Ã`ßBeBM«U ;6Ṭ‚V˜!n5- F
^J¹ÓI&Q|D4ý#`_6ãxõ?¬Â'„J–¯!ÕkB|)c|‰ÝËb^•ÕªýÑó‚ F¸šž9å«E0`0›ËZ;Š¤ŽØPG;OeCm¹áé$Û/ÙðÄhqÔ„”ãà§!{:Z¹ÀRƒbÒu”Ãj5[å·YS¼GÝÔt*ø âïð¶X5ùÏ£á†õÉ n¢5!…ÞÅï8â⺠#||AC_»‰ƒÈ d&6Ü)$'5L5/·5piÖ…›¾Æ4@p˜k>Ï×Mv]"\‡ºHxµ„´½ ½7Û
ù&ôG( Tv…ò þ¡1¯`½ šð£ˆ|WÌ£rí«:<Ñ+Xg랧 &F+p£V»?ª`Jà 2¦ÛYs·Ò
;qølŽg]Šûü1ʉ´ÐÕãð@4À˜%”ÙŽþk;ým[ ‚6ÖÍ|¡K›v×±û¾(ËÐòµ'xÆÚ´|• +±ç‹,݇(!úWi»Q#Ú%ÿº]µø¶?§Ä8Û)õ å‡>a*Hʸ0m0½Èo²m9 IF¬LE7²«(ø¸§ð/GKk • + +»Í¤â£;.8d®Å}uÐ=?j)κ$G⠈…´|7ó‘=ç3ÖÏE~Û‚‰×aiƒ•ÄœûôBQá· ;SY… ôøÆôå¹Ì>ËíÆRð»ï³¢ Óÿ\VÛ–ë
¸æÑ´O:B)uƒýÅ ~TìxòeSE-l0Ï{¢8ë’Ü»”’X𔆠»!ÖÉd í1(;HñAå2Ùß‹Ö6²ØºÏê~hp¬eÞ¯nöì©Î7ïóÍàóºÉ6MŒ †N`tk@ yÊ. MaI*iØ<‹qXµÆô2œáïp€âB™7Ôx±7¾õQ ¸ÂyV_ˆ#!C6ŸŒ`gñ§E²¿p™½"Ró®V›rLNU»‚w#Ô ±4˜O£…•ÓwEY]?4xà´OTQ™¾ùæ +|+qÆÙ>ï2V¾JãNV¾êR<\¾êñ£Ë ,Â-˜ådü%Š0È' ¬Çઋ–ÁÍK%Z'sYø$ E?Ó"\Ü‹a8 +w "p ?Œ%ì &yŒ?±.&/Â_Z3©Ô9¹µ +ÍGXÿ/Õ/oendstream endobj 1096 0 obj << /Type /Page /Contents 1097 0 R /Resources 1095 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1087 0 R +/Parent 1093 0 R >> endobj 1098 0 obj << -/D [1096 0 R /XYZ 85.0394 794.5015 null] +/D [1096 0 R /XYZ 56.6929 794.5015 null] >> endobj -258 0 obj << -/D [1096 0 R /XYZ 85.0394 438.8479 null] +250 0 obj << +/D [1096 0 R /XYZ 56.6929 304.8746 null] +>> endobj +1094 0 obj << +/D [1096 0 R /XYZ 56.6929 277.1668 null] +>> endobj +254 0 obj << +/D [1096 0 R /XYZ 56.6929 277.1668 null] >> endobj 1099 0 obj << -/D [1096 0 R /XYZ 85.0394 409.9891 null] +/D [1096 0 R /XYZ 56.6929 249.2319 null] >> endobj -262 0 obj << -/D [1096 0 R /XYZ 85.0394 349.7918 null] +258 0 obj << +/D [1096 0 R /XYZ 56.6929 169.6708 null] >> endobj 1100 0 obj << -/D [1096 0 R /XYZ 85.0394 323.4555 null] +/D [1096 0 R /XYZ 56.6929 141.5207 null] +>> endobj +1095 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F21 658 0 R /F48 885 0 R /F14 685 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1103 0 obj << +/Length 2809 +/Filter /FlateDecode +>> +stream +xÚ]sÛ6òÝ¿B™{¨œX4@ðóúÔ¸NÏÖí%ÎÜÍ49Š‚$Ž)R%©8þ÷·‹]€¤DÛ¹kG +ùÆÓa uÌF
ãÜ–ºš Ÿ³²X´šå9ùZL6_ :ú •oÈ>ŽHd4 ©Ñˆ€m=ÔÆ´õås9o[°%•Èù-1ȱ„C/¦tîTÛéfG3ã
/Ä2h
ZkEÉÆqp¡¢Û*õaà ӪΨ+cÚ“vô¯F‹U% üt¾)>[ÈͯqŠ (\`çB×úB+È*®äõnÏ~¸¢´!f…¾>®áõÁ\TÒU,Œ æ¢k²Ïº1‚0àÊ1‡ê£›0²C2Ù¤åÊthÎiDLhÔlDìd +c
¸2d²I\à€hªV‹°8.ƒk5¼ò¢ª»b=UP‡ÝqÌÈô"/Œý`Díƒn&‰…ž +üÿƒÖ‚ê ¨ø¼$QÉØÆó,wEéð4¬IÓ(|済Äjt DŽª]S„8¢AO˜$ÑKôÆì ö&ûLPƒŽPªÿ‘;¢¶ +RQ™útàè™&šBÍõ¡ØeÖ”çRJò6 +ÊQX‚’¬¶5,=PÚ3•Õ0é`c«›ÏS%es,ÖêŽÈ Gí;¢‘¦ å +G¨I°>¢»‹+*ýÍ´§÷’І…Mß«šƒ^ݤv'ñÂGájú·Ú^S¦Ä–o· +>tÑÏMÚ…±ÂhÊi +â±?W[ì/Ùn_êÉ6…n{òŽá¥RÚ6Xz¾§.ýà[Ì%éüÕù"ç1POªo'<Z_»ðME¯Üüò{¡ãU^FŽÀi§ÁÍ XRÉþŠ%4›®8ªÎDè“Ü
1lÒCœê‘ü<=ðŽqp.ëúþ°GKP¦FI0àÁÆ3¥U¦TN&FÉ—Üí€2“ùǶ|£`&!Wù
|¯»¥±qGûT°qì%Òå S¹[GÙ ®kë%pDKæÑ +¶Ùgª£ä@ÔCÖò(hF¶±„öô~ê嫯‰\'¸´Õ{f‹üº¯®è°×ôM +µC ôž“›ãeV«/¢g +|EõÏR1¿ªw}½ö[½/rƒíGHVƒöê-~Ç…F)åvÍ‘ƒ–ÈQ‡ÅeÂ׶»bìvØŒA·ßëŒ1Àð ú +Ê`‘žbôè¢Óí>˹3ÜeÇ‚'¢¶(¶ìà ŠJ´†Í¡±:‰c ¥Æ>/’ó»óԟ״`(i§áF¶šM“Áš–€&øà†’±ï h 0bÅ&×<Ò25¹°lš\ À!;ÍÀ‚Ù!ËÀÕoÞRþ|º3h¡--/÷ºqo +xS·BëˆÀ:â}x’-dh*}Ú(.
PÑÄ1–^ ("÷Ú,XñîÌC$¨qÄ1£ô‚3gOfÕbW4^aŒ–"”g23ø%û«H=_BU4êD./‰îŸæëÍ›©Fço
u\¬yþñöæß43º¶ô°•Á‰Qý3êê¶á{nûÐä:¾m¶Ñ/G‡«Þ«MñÃÏy¥!9rkÀ²ÎUR½[?Eà¨GíÿO:ud|paGžPÊÕÂx> øƒx¤ bm»¬éh O•}òDP÷P$ßfM–wÆçqáò5ÁñÝ´-³Û;9|D%,j7ñå•&Ã3^_ÄP€]ü~fˆ A¤‚ƒ…‰«§+.,D<xñ¸B€ï•.¡2§N>™ a^(Z»Ç]ñ‚‹HØŽ<=ˆ +Š^8r /(8ò¡\«ÀG]Ù³3ð‚ _…LZ›ˆh%”äãÇŠŽ‹m0VöîPvžtuv…:ÏiÞ iÞW扗ŠwXé Ó[*
•P\Ô•†ðeßS¼®1ÝñëºO%¦² +endobj +1102 0 obj << +/Type /Page +/Contents 1103 0 R +/Resources 1101 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 1093 0 R +>> endobj +1104 0 obj << +/D [1102 0 R /XYZ 85.0394 794.5015 null] +>> endobj +262 0 obj << +/D [1102 0 R /XYZ 85.0394 438.8479 null] +>> endobj +1105 0 obj << +/D [1102 0 R /XYZ 85.0394 409.9891 null] >> endobj 266 0 obj << -/D [1096 0 R /XYZ 85.0394 249.9022 null] +/D [1102 0 R /XYZ 85.0394 349.7918 null] >> endobj -1101 0 obj << -/D [1096 0 R /XYZ 85.0394 222.3206 null] +1106 0 obj << +/D [1102 0 R /XYZ 85.0394 323.4555 null] >> endobj -1095 0 obj << -/Font << /F37 743 0 R /F14 681 0 R /F23 678 0 R /F21 654 0 R /F39 858 0 R >> +270 0 obj << +/D [1102 0 R /XYZ 85.0394 249.9022 null] +>> endobj +1107 0 obj << +/D [1102 0 R /XYZ 85.0394 222.3206 null] +>> endobj +1101 0 obj << +/Font << /F37 747 0 R /F14 685 0 R /F23 682 0 R /F21 658 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1105 0 obj << +1111 0 obj << /Length 2453 /Filter /FlateDecode >> @@ -3826,14 +3890,14 @@ kJÞãGñŒLG£DKaA" ™$ØØ‚Ütí|Óv·Žeé85…~Þ ñéOUÿï73è§HöCÈP-/ÖÛ Té*㶓ÉÈ=Uk©žåð {þõÿã](‚¸„è’‚ñð§;?Ñ äPÇ QÁäþ_hD1ŠUÿ,9ö‚@ =z|²b.ªòðQgÆQ^Lô ùéŒÍ"cÒÇÿgÑUòèã{á[iÚùÜZ¦ÙïÇ2Å“&„© ÐX Óqõvt‡ÒŠ`|çäþ9»Gÿ ²Ë÷endstream endobj -1104 0 obj << +1110 0 obj << /Type /Page -/Contents 1105 0 R -/Resources 1103 0 R +/Contents 1111 0 R +/Resources 1109 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1087 0 R +/Parent 1093 0 R >> endobj -1102 0 obj << +1108 0 obj << /Type /XObject /Subtype /Form /FormType 1 @@ -3853,27 +3917,27 @@ xÚm”In 1 EOPw¨u€$ÅIg0²Êľÿ6¤¤êV5 oʯÅésÀóή¯ƒÖ×O²Î Ž¢‘ÿ¨#h8Çùø:„5? ù 6\>RgÈbÏWÖ¹j[†› WŒÏ¢®{6;»²þFÃÇñ÷ø]š¨)Õ/Ô¬Mu;pk; Ì©Ëdh<åE–ñ¬AÏw³ð¬±±Nê¦ó¡Ä½t•‹ùD„™Â²]°Ä(‡;„ ·åŽ°Šr²ÂÙÄLûˆ
T¥Í¡èª‹ŠŽt’¹w_ =Î]ˆ‹=¦uSä÷—ä"ï ±yl±‡µÃ-ËkHsŠöreOÚ³êvg›<7ºt,‡Ýe—;ãÒèÐ/I…B÷&ê(ýê³ö󻉨YÙ¹Ç,çkRÔšÚ' ^
m" ^˜h±ÎW9AVªy ©/fýÆ"•œãûFy-Sng \Çdª¼˜©Æ¥†Í}B©• µŒÎ$âw1.¶&Øíþ²C¶O–ÃVç X×9g¹E{îÇ< •ãóP)!ÍZÜÅŸLÞª~ÑÔ'¯UâXLµüc“ÅXsЖõÚ ¯½˜Ó’~òBL–§èªÆ¹O¦ºNZ_[Èü.øšŠû*]3QôçÇñ !Ö-žendstream endobj -1106 0 obj << -/D [1104 0 R /XYZ 56.6929 794.5015 null] +1112 0 obj << +/D [1110 0 R /XYZ 56.6929 794.5015 null] >> endobj -270 0 obj << -/D [1104 0 R /XYZ 56.6929 426.5656 null] +274 0 obj << +/D [1110 0 R /XYZ 56.6929 426.5656 null] >> endobj -1107 0 obj << -/D [1104 0 R /XYZ 56.6929 394.7216 null] +1113 0 obj << +/D [1110 0 R /XYZ 56.6929 394.7216 null] >> endobj -1108 0 obj << -/D [1104 0 R /XYZ 56.6929 335.9523 null] +1114 0 obj << +/D [1110 0 R /XYZ 56.6929 335.9523 null] >> endobj -1109 0 obj << -/D [1104 0 R /XYZ 56.6929 323.9972 null] +1115 0 obj << +/D [1110 0 R /XYZ 56.6929 323.9972 null] >> endobj -1103 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F39 858 0 R /F62 990 0 R /F21 654 0 R >> -/XObject << /Im3 1102 0 R >> +1109 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F62 995 0 R /F21 658 0 R >> +/XObject << /Im3 1108 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1112 0 obj << +1118 0 obj << /Length 2937 /Filter /FlateDecode >> @@ -3892,51 +3956,51 @@ clk ¿©ÊßãNs¨4¨ŒZÕfuYDuÖwUjÉ×ëzs»OþS;Ú‰’{¢ín%;Ñè`ñŽhTt^«Ÿâµ_Y¿Üy¼~—pªM–J² 5®èÄÂ¥ÂpU›é(dà³SsY§§Ç^bá‡ýÑh2`J^ì÷:‚Ë˼À«k.Â#pÞ²ƒÞ*,„J™™‰Pž Úg{kÇq6d9r£`=„¨ºay+6šG¼5ƒS‡¼|9–¥¢"Sí7ÓüìŠÔw_o°ò÷ÉGÓ†[ñkÃÎ<}•ÉGA‚6Î ¢82$7‡ÕbŒ4¬X;£†Ü·3²¾½Ì矣µ è4‹ÝA½¡øÙWÞÍdI&À~bDz8Èu_”êõ¸â5ºSü›„Èù ŒB@R6C ƒ ðR±HWúët}ð{¹Ú¬†™oÖˆ³„ÆÌœgšk›ÐLXäüjû‚•ª³á¢ƒúbwŒ7j{0"GF ‹ºo)ÄÅoCRêõ@Æ‚¢ #…Qs0Œæ³ÌN£ÇÀ2Ý8á7Œ¢—¨WÔˆw &\÷
hHäõ.xø€«Ÿ endobj -1111 0 obj << +1117 0 obj << /Type /Page -/Contents 1112 0 R -/Resources 1110 0 R +/Contents 1118 0 R +/Resources 1116 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1087 0 R ->> endobj -1113 0 obj << -/D [1111 0 R /XYZ 85.0394 794.5015 null] ->> endobj -274 0 obj << -/D [1111 0 R /XYZ 85.0394 769.5949 null] +/Parent 1093 0 R >> endobj -1114 0 obj << -/D [1111 0 R /XYZ 85.0394 752.4085 null] +1119 0 obj << +/D [1117 0 R /XYZ 85.0394 794.5015 null] >> endobj 278 0 obj << -/D [1111 0 R /XYZ 85.0394 683.64 null] +/D [1117 0 R /XYZ 85.0394 769.5949 null] >> endobj -1115 0 obj << -/D [1111 0 R /XYZ 85.0394 653.5261 null] +1120 0 obj << +/D [1117 0 R /XYZ 85.0394 752.4085 null] >> endobj -1116 0 obj << -/D [1111 0 R /XYZ 85.0394 576.1881 null] +282 0 obj << +/D [1117 0 R /XYZ 85.0394 683.64 null] >> endobj -1117 0 obj << -/D [1111 0 R /XYZ 85.0394 564.2329 null] +1121 0 obj << +/D [1117 0 R /XYZ 85.0394 653.5261 null] >> endobj -282 0 obj << -/D [1111 0 R /XYZ 85.0394 417.9499 null] +1122 0 obj << +/D [1117 0 R /XYZ 85.0394 576.1881 null] >> endobj -1118 0 obj << -/D [1111 0 R /XYZ 85.0394 388.7174 null] +1123 0 obj << +/D [1117 0 R /XYZ 85.0394 564.2329 null] >> endobj 286 0 obj << -/D [1111 0 R /XYZ 85.0394 267.384 null] +/D [1117 0 R /XYZ 85.0394 417.9499 null] >> endobj -971 0 obj << -/D [1111 0 R /XYZ 85.0394 235.1866 null] +1124 0 obj << +/D [1117 0 R /XYZ 85.0394 388.7174 null] >> endobj -1110 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F39 858 0 R /F23 678 0 R >> +290 0 obj << +/D [1117 0 R /XYZ 85.0394 267.384 null] +>> endobj +976 0 obj << +/D [1117 0 R /XYZ 85.0394 235.1866 null] +>> endobj +1116 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F39 863 0 R /F23 682 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1121 0 obj << +1127 0 obj << /Length 3451 /Filter /FlateDecode >> @@ -3955,131 +4019,127 @@ BȤ†µ‡%ãâCÉåS ^Fçc6Š8’ªðÀÙÒ¤Ö ÀÇkàxR`8òh&¡¥:“TÏÙnþ²FyFË€Ÿf Ë3nh2Ž K¹Îº{}9œ#L™÷ó ¹»Þñ^úïrÐöXQËñ ´
u`‚¨jQ® >ßIÄ£$¦“${…$?hûU¬šü&#øÅ‘Sít"ša!x|ƒËà9J0b V$jä”OjDzÅÎg £;4†U»ì]¥Ã`Þ Qoë2²{Ä ¡ÎÙË08gÒì+%BU8ëßzN%Þ¶[a‡qá¬"µ|8]ÏŒˆcM²Èg˜ ¯üw Âqjˆ>û"»‘zG*À‹ ëäP»’x L$ð«Ã½=öl¡^ôÕ”Óü]ž1É{D‚Ø[|É¡âÁÓ¨å"׃CGŽ¦¦8Ò9 öowågŸqðáHš(K ¾7Ü#õ(A€OE ÃIuý endobj -1120 0 obj << +1126 0 obj << /Type /Page -/Contents 1121 0 R -/Resources 1119 0 R +/Contents 1127 0 R +/Resources 1125 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1087 0 R -/Annots [ 1123 0 R 1124 0 R 1129 0 R 1130 0 R ] +/Parent 1093 0 R +/Annots [ 1129 0 R 1130 0 R 1135 0 R 1136 0 R ] >> endobj -1123 0 obj << +1129 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [55.6967 676.8938 256.3816 688.9534] /Subtype /Link /A << /S /GoTo /D (rndc) >> >> endobj -1124 0 obj << +1130 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [268.5158 676.8938 332.4306 688.9534] /Subtype /Link /A << /S /GoTo /D (admin_tools) >> >> endobj -1129 0 obj << +1135 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [378.2799 73.4705 428.5017 85.5301] /Subtype /Link /A << /S /GoTo /D (tsig) >> >> endobj -1130 0 obj << +1136 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [112.234 62.1828 168.4527 73.5749] /Subtype /Link /A << /S /GoTo /D (controls_statement_definition_and_usage) >> >> endobj -1122 0 obj << -/D [1120 0 R /XYZ 56.6929 794.5015 null] ->> endobj -290 0 obj << -/D [1120 0 R /XYZ 56.6929 403.8784 null] ->> endobj -1125 0 obj << -/D [1120 0 R /XYZ 56.6929 377.7405 null] +1128 0 obj << +/D [1126 0 R /XYZ 56.6929 794.5015 null] >> endobj 294 0 obj << -/D [1120 0 R /XYZ 56.6929 339.6466 null] +/D [1126 0 R /XYZ 56.6929 403.8784 null] >> endobj -1126 0 obj << -/D [1120 0 R /XYZ 56.6929 308.8302 null] +1131 0 obj << +/D [1126 0 R /XYZ 56.6929 377.7405 null] >> endobj 298 0 obj << -/D [1120 0 R /XYZ 56.6929 236.1221 null] +/D [1126 0 R /XYZ 56.6929 339.6466 null] >> endobj -1127 0 obj << -/D [1120 0 R /XYZ 56.6929 207.0192 null] +1132 0 obj << +/D [1126 0 R /XYZ 56.6929 308.8302 null] >> endobj 302 0 obj << -/D [1120 0 R /XYZ 56.6929 125.1654 null] +/D [1126 0 R /XYZ 56.6929 236.1221 null] >> endobj -1128 0 obj << -/D [1120 0 R /XYZ 56.6929 93.2531 null] +1133 0 obj << +/D [1126 0 R /XYZ 56.6929 207.0192 null] >> endobj -1119 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F21 654 0 R /F39 858 0 R /F48 880 0 R /F14 681 0 R >> -/ProcSet [ /PDF /Text ] +306 0 obj << +/D [1126 0 R /XYZ 56.6929 125.1654 null] >> endobj 1134 0 obj << -/Length 2601 -/Filter /FlateDecode ->> -stream -xÚ]“Û6î}… µ3‘ÊQ”.OiºÉm¯Mî6Û¹‡4“ÑÚ\[S[r-9¾½Þý÷RÖ7»ÜøÁ$‚ -R *’LÂ*ðvcP@åTž'š³ è#ÎoæÁáÈ1N–répÚ®ìÌÎÔ è‡¥Ñ²¬iÐ,—Ç
K·ÖÁ‘0PQ×ì ²5_ÌÖá߀RSÿʘX eW5Ž*B¶¡q䫺VVd’L%Jh/Ô—ÊœR ¸8ÍÔT*° Q¨èoæ¡¥V&ÆÝ‹Xf:aŠùržJ »¬Í -p%rFÿ oL¢Î¹Ó:‘)Üá/R6ÓxKÔIå0¸3ôlÇ ¨¨Ün €Â· “IœL3õŠ6©èÞ*–èŒåiWh•H®SÇ ÜZwh¶m@ -°Ö\)>³«Í”³$UJMµ©XkÌÔÛ8K“Œ+½ÐR%Zðížë
nŽÒãÇÃ
sG™ÓE&>˜¥3@jD’ÎøQ Z -èCò3wí±žâbFÍ©‚ »cÛÑÈ^8ü¯ÌÙì`Zºer% Xƒ5„4®e’3 -,a ,ÔÔþÀÜÇ6:R€²l¡¹e9}N -ï~æðÅ B^ -ÖÀE ¸Û8FbYö¡ápÉóÈ€Œ-…#”§èݦtw*A›aÔ‚}Õºœ§ªÛø½• R^EVýyäƒT âV+â¥uø»²[n\pÑ3Qx]Q±ˆå\+y op;FL誗͎® p&Ãú¦übhíΘš`½00vÂÀzI -=8øq×V -ž9IP)ã¨nük»ƒÕ1ŽéVSp±vo–Õ%·¶i æ7H]ªîá»ò - »tˆ%êÕ®ª3½ƒ»Z¹}Çý¾9tîí“Å€Á4Æ ßÚfW.ãÝJ$Ju’ ¦û`5' áNõyƒ¥ÔnJ ™$¤Îò)Rù„”i€X†¸2ý³| •=JLýYb2r¯fÖ§¥ÎO&ä8 uª&ôÒó‘ðöÃõ[ˆÍ Œäû”^P)óqXZ FsÁ¢ÛË‚AÜÈá5 -B}ÜnÏr¼ü - ^ƒ Ú+j SˆÛ‘’àÔf¬¶Sy¨{kð§7°ÓxžíÎ$¾oFÛVæîè9®\Ï‚t9B}€ë¯–C‡ çHîÁoºßðX'îƒqâe«›—Á»çsJcÅ=›R€§®ò>ñ•éM±ÿ>ƒç±Ü~öˆ;NèÏ}÷åè² ]O’ä¹G -´Õ=Ûƒ - ‘öa³gÄÁ ¨À¯Î}ˆ>lÿÒ–kxW&2ÜîÃAjÿ’z‚¼|óÖM,¥ 4ê¨þB¨upñd[s8úR *ƒ6‰ÌM«Ú÷ ÅEœØ.ì{†¸t‡re¤N1OPëå6ÔøƒºA2îÓG ôçâA*§¥!G Ýá~s(©ÎÅG°m–ÈÝRß 9vûcGk;ÓmšUû‚êN`|Wº•^"Ûj°W&‡q
g6ž8”V$TúÚò×]3A²¾Žæ¾åg[<nDe4?w&níªP× -(«H˜òÙsï’ŠÆÜ«´×m2¹,ÀlÍÒÙí¦9Ñ -ƒãMéαͯÀ;¹/5aÅ4IÆ•—ŒgQŽ’a;µ£•“¥ cn@ *jËÇ +/D [1126 0 R /XYZ 56.6929 93.2531 null] +>> endobj +1125 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F39 863 0 R /F48 885 0 R /F14 685 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1140 0 obj << +/Length 2602 +/Filter /FlateDecode +>> +stream +xÚ]sÛ6òÝ¿BôLˆâƒàÇå)Mœ{WçÎqç ÒL†– ‰S‰TEÊ:_¯ÿýv± +Olxwý÷+½¿}óÓOon/?ßýxqu×Ë2”Wp…‚üvñé3Ÿ-@ì /8SE®gG˜p&ŠBζ‰VL'JyÈæâãÅ?{‚ƒU»5¤?r¦s™(UHº`©‚%TàÝÚ €*¨"g™à9ÐGœ_Í£ÃQcœ4Êá´]Ù™©;ÐO¢yYÓ ™Ï{–nƒ#a £®Ùdc ÌÆá/GH@©©á\®û²«G!‡Ð8òUÝV +2)®™–™ê¡2Ç€T..ãz*Ø…,tô7óØÒ ãîY¬ÒŒqÍÁ|…`…ÖÒnDk³ +´{Zܯf4¸ 8J 7œ;Ê9]d⣙;´¡F²äŒ
¢%€>$æ®=Ös\œQsªÄÂöÐv4²ÿ s2;˜–n™\ Öß``‘Æ3År.Aá’3ÎÁòGQAOíÌ}l£#H ñ'Mg™°,'/ €’yž‡Ã_ÜSŒ‡$²Æ¬IÍ’B'§“‘Åjò"gX$Å+4ižÑ60’YôkÝ k–-ý“q
D†AÕåÖØ2ª RI+‹f[Vn?bÑèPW¿ Ìæ‘f¦ê®Z>VõŠ6BDÖ5etݘ\÷ž º¶½>
v(„ ûË× .Qi^x÷3û³y)XƒànãEˆyÙ‡†ý¥È#2¶Ž4Pž¢wëÒAÜ©m†Q öU«>p «ní÷V.HyYõç‘R}ˆ[,ˆ—ÖáoËn¾vÁDOeáuEĦ"–óŒXÉóxƒÛq0bFU=o¶te€3Ö×僡µ{cj‚õÂÀØ ë%Èš``Yì);Qó¬·²¬k³jö@`ëç5Ý? _|kæÄXÇüòón
i¦¼[÷'9w +. +†“Bù +›°MK0¿Á@éRuß•pPðع«@,Q¯&pÕ,UÑ
ÜÕÂí;ìv;s¹Oc(иàb|këm9· (ÉX.yÖ«s’ît_7XJíºRPIB鬞#•OHI™ˆ¥ˆ«’?Ë—Ôé“ÄôŸ%¦ò g5Ó¾,u~2!'`˜%zBO ù$= ï>^¿‡Ø,ÀH±/Y ƒ*•ÃÊÐb0šK Ý] âFÙ +§ `ÿf+¶beP %§ç< íL°LùÚô–@n~"j¥ÇÒ>CAà3Ý4d)‘² +æT*DEñÍ!ËŒ‡ÏC–Ó…ÈOSµ(Xg:׃°…š¥›-Ä ¨»…ÆÝ„[wuþànÜV>LÖV%T{ÊÆÜáí¢“ØºÐ …"ç”S%„ÿ®à,[§ M äÅ…G$Y_wôÇ,ѤɸÌèP¬ áy. 9E›fµrÍ£ƒb_Úûr»-÷ÃÂä–#ç¤ÞžH +·ò +XVø0 Jû‰0æë²®ñÕ9˜|¡Šm@Àí¹6¾FiYm ú®ÄäŽ#K÷âÕc t8T-†–f'‚Þoqü_ú;Ô›j[Ù›p¸‚FŸCŽêè·ÕÌÙ2Ýpg ÎÚ>¶ Ïáø˲œWH‡¡cý®naöû¯ Ô‡Íæ$Çë! ḃÄ`1‡öŠšÃâêf¤$8µ«íXîëÞüé
ì4 „g»p3)ž—ÍhÛÂÜ !Ç•ëW.G¨pýÕ|(âPã¡ã É øMc^ +ðÔUÞ'ž£2µ("öÇ x ËígϹ£ËMg¾ûztYO®3ƾ‘{¤@[Cæ×O„AIA&}üqðzÜW§ D ¶nË• ä•I€ ·úð} 2Ÿ|<Á$%UqÞ¶‰•ÊM:z{!Ô¾spñhÛr8z(÷•A›Ä Ö%ˆÕ m»Žâ"Nl +6Ÿ!.Ý!‚Ü2K°Jо•ÛPÓÞ P›øÒÑýsñ ŒË˜ÎòI¼Þ÷%½q1 ¶Í¼¹[ê4‡nwèhmkºu³h_ћߖn¥—ȶ앩a\Ù'刯zöR‘¥¸o$(Þ¿¡…o÷Ù:Áè -N݉[»¨k ”U0®}åÜ»dàQÆÜ«´×v• VfcæÎn×Í‘xùÍÁó
hÓ¸ U¨¨Ä-Ùקb˜<Ã,|˪`Y2~Ù~¨ms%I¢¦‰•G‘ô<ÅÊ3¨’<Ð÷ +9‰ s.:ØÞì0-tù ×îíèÙtïÏå$¬üÒwŸÆý›T²ôÔËŠW϶ù-!bj7ˆIþ]k»€¶H9&ôMWÁm*ú¤Ãûþù{ïécx–›ç2ümHñ”å²È<S(¢Ê¦œ÷ †ÏYÿ ~þØendstream endobj -1133 0 obj << +1139 0 obj << /Type /Page -/Contents 1134 0 R -/Resources 1132 0 R +/Contents 1140 0 R +/Resources 1138 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1139 0 R -/Annots [ 1136 0 R ] +/Parent 1145 0 R +/Annots [ 1142 0 R ] >> endobj -1136 0 obj << +1142 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [103.6195 731.9163 159.8382 743.9759] /Subtype /Link /A << /S /GoTo /D (controls_statement_definition_and_usage) >> >> endobj -1135 0 obj << -/D [1133 0 R /XYZ 85.0394 794.5015 null] +1141 0 obj << +/D [1139 0 R /XYZ 85.0394 794.5015 null] >> endobj -306 0 obj << -/D [1133 0 R /XYZ 85.0394 589.1911 null] +310 0 obj << +/D [1139 0 R /XYZ 85.0394 589.1911 null] >> endobj -1137 0 obj << -/D [1133 0 R /XYZ 85.0394 558.8491 null] +1143 0 obj << +/D [1139 0 R /XYZ 85.0394 558.8491 null] >> endobj -310 0 obj << -/D [1133 0 R /XYZ 85.0394 294.8462 null] +314 0 obj << +/D [1139 0 R /XYZ 85.0394 294.8462 null] >> endobj -1138 0 obj << -/D [1133 0 R /XYZ 85.0394 261.6947 null] +1144 0 obj << +/D [1139 0 R /XYZ 85.0394 261.6947 null] >> endobj -1132 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F21 654 0 R /F53 957 0 R /F39 858 0 R >> +1138 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F53 962 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1142 0 obj << +1148 0 obj << /Length 4109 /Filter /FlateDecode >> @@ -4095,27 +4155,27 @@ xÚ]sã¶ñÝ¿ÂÓ—È3' ?zO—Ô—\Ú\Ò«ûÐI2J¢$ö(R)ëœNÿ{w± ”!Ûio< ‚ X,ö{!y-àO^›$Jr•_§ [@Ŧ?Òõ |ß *NR4p¼:/å,½Cy¼ãfkkòÒU'ãIuÒø^TæÔTØÇEÿxdñW0tt Á¡Ë<ZÈHŠL=-Ńϧ] ˆ…L.†ˆ~q¼Æá¯<,Ž=aG&±†›³ÑÏcp¦„™*“M˜« ÐH³<Ÿl$:‡f>) Á†TìóFU8… ¥ã—1S<ŽÏ\FRÓ lª‘lb‡-ôÌšLõ›„,NŸ¾j¡y¦=Ë_ôJñŽ«p*¦Z–á Rà²éQQ
]0ú+bØýÞ›P¥Q®³lÊÙ6y,Üý!
.ƒÀëiÈ) W¶BϦ\½¢ò„M³ö` -y¾!´wÀ}W €á0Äy!Ç0ŽR;F½ÌI˜ÎV>/CÉ`ãT.p¶ÝU~©Àþ8ùÓlYh[¨¢$ÏÌÅ©=Öll’õ¶SäSsà2¾œM+«{oVèlwaÛÌû^ö”Œ¯Ëvý /X†#©X¥ÁäŸÉGžS~–üK<vùøÎ;& z»ò`«_p_ð—g×?aÐøú'~㯢“ 3Ø$¹“ùÌ?›ÞV
9H§M¨3ÕN6:StÓGjçjkær“™òèaÛÎaeë¤ênË[¥#áántp
ðh¯EÁg{z_ÂY¿¢°ÎcPúäü «›7Ã:ô endobj -1141 0 obj << +1147 0 obj << /Type /Page -/Contents 1142 0 R -/Resources 1140 0 R +/Contents 1148 0 R +/Resources 1146 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1139 0 R +/Parent 1145 0 R >> endobj -1143 0 obj << -/D [1141 0 R /XYZ 56.6929 794.5015 null] +1149 0 obj << +/D [1147 0 R /XYZ 56.6929 794.5015 null] >> endobj -314 0 obj << -/D [1141 0 R /XYZ 56.6929 769.5949 null] +318 0 obj << +/D [1147 0 R /XYZ 56.6929 769.5949 null] >> endobj -1144 0 obj << -/D [1141 0 R /XYZ 56.6929 752.0323 null] +1150 0 obj << +/D [1147 0 R /XYZ 56.6929 752.0323 null] >> endobj -1140 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F47 874 0 R /F39 858 0 R >> +1146 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F47 879 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1147 0 obj << +1153 0 obj << /Length 2579 /Filter /FlateDecode >> @@ -4134,29 +4194,29 @@ pHÅïPâyxå‘ UÆÝÌi¹ó0é4D(æ"s%4~[jêࣦ™XÛtBP£:øÅ ih£VÎC‡ùßÅØ=#óTdÎeGN^+¬D¨D’Ð vV|\ …º¯³#ï;·‰¦ÿ¨1ß4³±ÆÚ¶ÈI*í@%Gè ;6Ã
©Î±ÌÞ¡ÝÑ¢ÑÚ¾c¤ ¿Eþ8ìÆÖ0•6iàÉËŒiØñŠí® ¦ôÙëh ÿWk7©öοM,ñ{$5¡2–ë¯u¨˜ ='fΘõîc¤°‘e e$³SÊÇŽž“þ7½6Òóendstream endobj -1146 0 obj << +1152 0 obj << /Type /Page -/Contents 1147 0 R -/Resources 1145 0 R +/Contents 1153 0 R +/Resources 1151 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1139 0 R -/Annots [ 1149 0 R ] +/Parent 1145 0 R +/Annots [ 1155 0 R ] >> endobj -1149 0 obj << +1155 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [173.6261 500.8708 242.2981 510.2804] /Subtype /Link /A << /S /GoTo /D (the_category_phrase) >> >> endobj -1148 0 obj << -/D [1146 0 R /XYZ 85.0394 794.5015 null] +1154 0 obj << +/D [1152 0 R /XYZ 85.0394 794.5015 null] >> endobj -1145 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R >> +1151 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1153 0 obj << +1159 0 obj << /Length 2502 /Filter /FlateDecode >> @@ -4173,705 +4233,710 @@ GMtlï‘`‡ú øæqÊОî>SCW‚ÝE[&èW¥9ç´†<ºu‹8~³îæþÜ ÕæêÕ*1ßå„}µ—èžàæ–à ì§Á;S¼`‡ fºÌ´ýž"Í…¡8t)„0{‡ҿy!Å~XšiꀒÐkS³"ÉèK`'Ÿª)UÞR{7ÛÒÀî«.bfzø›^ã°M[7 x—ËcñÜ‹Þ#ž¿s©—yé×£žÏ žŠ£^„?D 8Z¨ê¡Ü|9é÷7–"(T»¦C9+;{ù–S÷ Qãá Èx.Ù`¹NÁ/N·[ˆ‰Ù¼¹DÂ9Çàêìã[†ËuYè†'.¸ë3t¿ Z“¯uµ`•ñœ$NG^‹’¤&> Æ%]]ìÿÇ ,5Ÿúßݯ¢|ÉDyÿéñdZ endobj -1152 0 obj << +1158 0 obj << /Type /Page -/Contents 1153 0 R -/Resources 1151 0 R +/Contents 1159 0 R +/Resources 1157 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1139 0 R +/Parent 1145 0 R >> endobj -1154 0 obj << -/D [1152 0 R /XYZ 56.6929 794.5015 null] +1160 0 obj << +/D [1158 0 R /XYZ 56.6929 794.5015 null] >> endobj -318 0 obj << -/D [1152 0 R /XYZ 56.6929 729.6823 null] +322 0 obj << +/D [1158 0 R /XYZ 56.6929 729.6823 null] >> endobj -1150 0 obj << -/D [1152 0 R /XYZ 56.6929 704.9004 null] +1156 0 obj << +/D [1158 0 R /XYZ 56.6929 704.9004 null] >> endobj -1155 0 obj << -/D [1152 0 R /XYZ 56.6929 387.929 null] +1161 0 obj << +/D [1158 0 R /XYZ 56.6929 387.929 null] >> endobj -1156 0 obj << -/D [1152 0 R /XYZ 56.6929 375.9738 null] +1162 0 obj << +/D [1158 0 R /XYZ 56.6929 375.9738 null] >> endobj -1151 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F21 654 0 R /F39 858 0 R >> +1157 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1159 0 obj << -/Length 2765 -/Filter /FlateDecode ->> -stream -xÚ¥koÛFò»…€ûp4zb¸O’é'7Vr.§g»ÀiPÐÒJ"J‘ªHÙõ î¿ßÌÎ.EJ”Ç1}ÏìÎ{†b£þØ(Qa$R9ŠSªˆ©Ñtu°öጹ=c¿iÜÝõÓÝÙ›÷" ¥aª¹ ÝÍ;°’0J6º›} Þýóâ—»ÉÍù˜«(ÐáùXé(øéêú’fRjÞ}¾~õá×›‹óXwWŸ¯iúfò~r3¹~79 ³D18Ï „#Þ_}œPïÃÍŧO7ç_ï~>›Üµoé¾—E òçÙ—¯ÑhÏþù, -Eš¨Ñ# ¢¥) Τ¡’Bø™âìöì_-ÀΪ=:D?±q%Fð -¦,NŽã% àu]¦T(Y¼wÌD JW4ã¡J€ž+œu¸Â¤!Ô(Vi¨–-nÍ&75’ö‹Î~ L¬d HpßíÚLóùÑôqi6ç,
= ;¨—Õ¶˜QÿÞm(ªÅ¸¹¦ -€ 3 RÜ¿hÎÇ@½ n²M³]ÿF -Θq·ï1/ -‚ue¯8æ…àªUSf÷¾,Nú9 6O4ÂwÚ»â`[¦®‡.ÈãKžt.ø'n ‹%sûªu“W%Á^fHí8 -›’îÊâ(L‘ø»’ÖYþEÜÌÉ~·4ÈÞ‚ºxÛ1eãçˆÝëjÓ8Ä?8-rØ÷w7}õ ]0›ÍèHí²r6„ !ž…Žƒr»º©-Þ‹TÛvގ»£Ð:(³•qû¦E†HpÃîÈÓڀКWM /ÑÅòxÌ™Ú{L€p7(ßv@τΙn751 -ʪiwÀ9ævM.¯o{Èà„»Ú¶64h&x†æ«M ²{švd ¸'FÎ¥×_„z‹PCX‘vvÊ$À‡( -Pê#øcÓ`õ[°ä<"ÛñôvûãchþÊVë„ÓjEP®®©½€Ôûáv2tº‹úí[B?‡” -Ms é˜v ŠkÍG]+üJÓ.d -ð `‰¸‹H¾ - TsjóxéfY°Î¦«x°ÔT®µ‚ Úl ¬"BUͶ™ñAé{#8îÜTÖ›®ú>im«)X(g¹Ù¥Òë(¿c¦¸ˆ{îqfÆ:ŒYÂO0S%€$’ 1³„§OO³òúövòÎQ´tVàîöêCŽM5ŠÊ£Ÿ!mçί£ÃŽ´B…‰Vê ý‰ã¤•Q˜(~*ªRî SmiV€{“øž>Âfp[*u_£ç1úæÚ-´’ŒƒU^O«úb»É0(°î/² - ÊD:Ûj -³°ì WeñtZ/ÛýÀI›ì!ÆX -=ÈŽ -©ÃB0þ®ò¦±¨v ’¿¹ÂÛŠu·¦A/õ•:o®ÛÊ›ƒD—¶ ]8{¬ÁÆü–dÈzÒ “xÿ¡Ø&Á}^Îjê)°· Ùø -ÚŒš}
Ĺ¾âŒg¼\õ -ÕmªçÂÞ*+KªQzÅI[°)«Í*sÐé10éëøöè® -€Ií¿ýAŸJD8GYÎØÂŒ¤°DÆ{|¦(4´êb~éM4öÚ`@ö+R¸æÏe‰ù‹²˜²ö“f‹ªúc»¦é{ãŠaGª«$ª^p×Yãz¦ðáæQýJ¢xIß öcñ¨Mð^ý †ÝÏ;$†®Ý = ã 7îRøjÉ ‘„*áñÀÕÿÚÁ”úendstream +1165 0 obj << +/Length 2770 +/Filter /FlateDecode +>> +stream +xÚ¥]oÛFòÝ¿BÀ= žî'ÉôÉ•œ‹ÄéÙ.p@´´’ˆR¤*Rv}‡ûï7³³K‘eÅqt—»³3»ó=#³QÿØ(Qa$R9ŠSªˆ©Ñtu°÷áŒ9˜±w¡~º;{ó^Ä£4L5×£»yWFIÂFw³/Á»^ür7¹9 s:< + ?]]_ÒJJûÏ×ï¯>üzsq Ëàîêó5-ßLÞOn&×ï&çc–(ç¹ÃpäÀû«š}¸¹øôéâæüëÝÏg“»ö-Ý÷²HàCþ<ûò5ÍàÙ?ŸE¡H5z„(diÊG«3©D¨¤~¥8»=ûW‹°³kñOF,d\‰¼‚…)‹“ãt‰FtÝ”)JïÓ 3‡RÅ Íx¨…— +g ©0)ÂD5ŠUjÁ…ËŸ[³ÉMìxÑÆÄJÆ@án×fšÏŸˆ§K³9gI`èÓã° õ²Ú3šß;€¢Z,Œ[kª‰Ú1 (Å-þ‹æ| Ü ê&Û4Ûõ?à+dD5/´Û,
M¦YcÕæÉÝ»÷N-C®™p?þ@Ú3îà ó¢ ÜYQWöŠc ñP®úW5ev_àËⱟ³`óD_øN{WüØ–…©ë¡ ò8ä’' >ÁÉ‚ÄbÉ \µnòª$ÜË ¹ 'ÀaSÒ]Y …i"W²:ËÀߢˆ›Ù Ûï–†Ù[Ðïb'¦lü‰{]mG¸ñ§EpwËW¿Ð³ÙŒŽÔn#+gCôãùXè8(·«{Ð*°b½Hµ=aw,)œ¸; +ƒ2[7-2$‚ +Pë#øÇþ¦Áê·àÉyD¾ãéí õÇÇÐü•Ö… §ÕŠ°\]ÓxÿÑì‡ÛÉÐé.é·o‰hü Qv@´4Í1¢c"Ú
("J¬5 u½ð+]»I( ‚‚'."ùœtB *IB q"ZèÜ)sì™åõ:k¦Ë“áâÒ’7<¨æ4æ%ÈÒ²`Mÿ0Öð`«©Üh&µÙ<XC„ùªšm rãŠÒFpÜ…©¬·\õcÒÚnVSðPÎ7J³Ë¥×q~'L¯p/P÷ÜãÂŒu³„Ÿ¦J€H$f OŸžåõííäãhé¼ÀÝíÕ‡ ›jZœA?ÃÚÎ_LJ k… +Ô PúÇY+£0QüTV¥4ÜA¦Úò¬€ð4&õ=Z}`[*u +_cä1ÆæÚm´šŒ «¼žV%õÅv“aR`Ã_d# + ÊD:ßj +³°â WeñtÚ.[x$¤Möc, + xk =ÌŽ ˆ©#"0”ð®ò¦±¤v%‘¿¹í»Û u·‹A/õ½9ï Û^›ÃD—¶?³pö]-é&ñþz ›IDpŸ—³š¦Ä +œí¿lFcF(Ä9 v:k} Ä/x‹¸ê! Ot<eGŠz¦0ÁÀP{)!eczÏ:³)¶—¹HÛ'¶ +ªÍ…oœ +ß:®×P€Áí ú¸w`àdêfsžÛ)IÊ…Çê€j«p¶ÊÊ’º^TPq² Êj³Ê vz ,úν=ºk¹9 È+,‡Rn#VÄœ®ÊVWe_WEà—wÚ)„Ëq{fæ™-ð†¸3 +ÂÚNêÚó¸×’lÝ—Ù£ìbí ù¬$³!Gºi©ØU³É ßãØÓÿäyýg2m3uJ~Hb!¸_ËeBõ„´†œ?dE»nÕV¦Ç* À©õ.ïù>Òå@ÂyBÞ˜fúfc-ëX ‘*ÜÌÇOP¥ø›Š½» bù̸Wf4P ÁY5'3Å<Ý+”mžì½Û2Ç,û s›×¦œí~?ìzÇŠìgº_E¹ÎÇËDÎÛß)õ ,àÒ$eCœt¤ê Öéâ꧱ԯ¢|DÞ‰jñ~—Ä!µWè·f9þöZ»7Q‘ ž'¿çº8؃åö~ŠÌWÛ “ÚÿÔsêá9¸bû0’rïÉ™@Qih×¥øÒûgœµ™€ì7 pÏŸË ó%ÿ°d'UõÇvMË÷Æõ¾Ž4SIU½â®³ÆÍLáÍ£ + û£HÚ%ýä°ŸzGm=÷ê?XØý5‡Ä~D÷·ƒž‡ñ}w)|µdõHB•ðxàêÿ 5‘Cendstream endobj -1158 0 obj << +1164 0 obj << /Type /Page -/Contents 1159 0 R -/Resources 1157 0 R +/Contents 1165 0 R +/Resources 1163 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1139 0 R -/Annots [ 1163 0 R 1164 0 R ] +/Parent 1145 0 R +/Annots [ 1169 0 R 1170 0 R ] >> endobj -1163 0 obj << +1169 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [519.8432 252.798 539.579 264.8576] /Subtype /Link /A << /S /GoTo /D (lwresd) >> >> endobj -1164 0 obj << +1170 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.0431 240.8428 119.7369 252.9024] +/Rect [84.0431 240.8428 117.8035 252.9024] /Subtype /Link /A << /S /GoTo /D (lwresd) >> >> endobj -1160 0 obj << -/D [1158 0 R /XYZ 85.0394 794.5015 null] +1166 0 obj << +/D [1164 0 R /XYZ 85.0394 794.5015 null] >> endobj -322 0 obj << -/D [1158 0 R /XYZ 85.0394 451.0558 null] +326 0 obj << +/D [1164 0 R /XYZ 85.0394 451.0558 null] >> endobj -1161 0 obj << -/D [1158 0 R /XYZ 85.0394 423.9067 null] +1167 0 obj << +/D [1164 0 R /XYZ 85.0394 423.9067 null] >> endobj -326 0 obj << -/D [1158 0 R /XYZ 85.0394 301.4703 null] +330 0 obj << +/D [1164 0 R /XYZ 85.0394 301.4703 null] >> endobj -1162 0 obj << -/D [1158 0 R /XYZ 85.0394 271.3564 null] +1168 0 obj << +/D [1164 0 R /XYZ 85.0394 271.3564 null] >> endobj -1157 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R >> +1163 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1167 0 obj << -/Length 1235 +1173 0 obj << +/Length 1216 /Filter /FlateDecode >> stream -xÚ¥X[s›8~÷¯àÑyVÜaû”¦N7mºëºOnÆ#ƒš -Bhžãš“ªVV~易œ\óWá<Ç•4Yx&ìyÀö…š(Ü#v ž@,pNTm]²Š«*-7²q§Zÿ¨â+r‘ªi€MFk-ð£“Ãq\½‚·~ Ϫ&*w ¸©joô$¡ û÷²iH–0Ê k[á&gMïÈW„¬‚rÊ -Õƒ‹XU¾Ôøžtk
ø³\è®?àOM´{˶zB@Γôh p–±'UMX¥ûT±<o5©‰V’%ª ™*·D•×4{Võ¦&ÚˆîÉ›ŒÓ2ÓskÞl¬3ü¨G¿³‚ÔðË 5 Ø t}?8íj²Y)© ±'Tuœz{ÄUJ5B[òT+w¯1ÄÈÑ—Ž2Í -6BÜð»¾ûω¼"| -à žœ5e¿¾QqcÄú ~ €~kH{hÎQ>!<JÁ}Öó•N²¦NÁþÖ‘–×iÃcö4Á €,QFEøžàAèÎÝæ/ +xÚ¥XKsÛ6¾ëWðh €‚o²99Žœ:Ó8¢œ"A c’`ЖÛô¿@Š”Õš’G£Ás?ì~X,°´-$¶å0ˆØ +cúÈö¤˜ k-Ç>Nl3´“@Öûùä—7´bN`ͳ VQÙÖ<]\З]\¹»¹ýømvuzóÛ/w—ÀñÑÅÍíïS]û8»úüùjv ìÈ·/®»úc>é¡À`¼¿½û {b]üèlz3Mﮧ—÷óO“é¼³¥o¯\eÈÉâ Y©4ûÓA7Ž|ëI6´ãرŠ‰ç»Ð÷\·íÉ'_'v€½ÑèQþl 7pŽèØ–mÃØ÷ƒ~ ×q;mW²‚º(0¤æÚʯ RRþj\¸V&ˉ{;ƒ,à†RMï;@"–¸ º¶¨X-t•VKո׿uñ ùH× À2§ÜüìäpšÖ¯à- ȳ®ÉÊ}nëÚ;3 BhÆþy§m’%ò"è»N¼§ÉAÓò !§¤‚²R÷à2Õ•o ¯I·Ö€?LJ~ä‡þôD·7Q²ìzq Ô<EÑç9{ÒՌզO +ŠVNŒ’,ÓåÀÁt¹"º$˜ÓüY×NŒ+ÓS4¹ UnærѬ¬å9~4£±’pxŒeÐšÜ +VfGV èA«r»œüz81‚~ J–¥nh{õÍ!”r–ãÂXÅ-Ðm‘œ·Ð3 ¥£ì|º×XrQÓrmÎÔýµÒv_zøØÇ‚¶õ¿òƒÕ9©åš€¦ýæ’¦ãRZ“D°ÚĆ +‹ÍRé0ByGÀi⃕w›¶©O—»µY©a^×G*®¥7ý€¸Üï‚j <†»'2š“Ó-H›¢/:P¿ …:;2ÎÑ„Ÿ¹|EÓ3%å~7ÒËËõ™Ú¿Yu6Á Ew>¾dõ²d# +srÆI/9' %^ågœ#þˆsšb1–Ác9còÙ™’þeg‘®ŒËdÃêþèxó +°’!Umô‘ÎÐ' ©„Œ•| ¤gDV?á:=Ì€”Ç<9£u› ©TfLüÓÈ]"f²¬Å)™”YF¦JízmÂ4âÖ—!CÆäè·5 Ü?@½!äž½[ËIåÏ \ËË€ q¶÷3F°´j 5NŽ}p}¨òø# <ê¢7.ØKñd^EÎþK@?qpB™ÇDÄ(¥,ñœš·ß^ªþ/#„¹rendstream endobj -1166 0 obj << +1172 0 obj << /Type /Page -/Contents 1167 0 R -/Resources 1165 0 R +/Contents 1173 0 R +/Resources 1171 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1139 0 R +/Parent 1145 0 R >> endobj -1168 0 obj << -/D [1166 0 R /XYZ 56.6929 794.5015 null] ->> endobj -330 0 obj << -/D [1166 0 R /XYZ 56.6929 769.5949 null] ->> endobj -1169 0 obj << -/D [1166 0 R /XYZ 56.6929 752.2028 null] +1174 0 obj << +/D [1172 0 R /XYZ 56.6929 794.5015 null] >> endobj 334 0 obj << -/D [1166 0 R /XYZ 56.6929 693.9224 null] +/D [1172 0 R /XYZ 56.6929 769.5949 null] >> endobj -1170 0 obj << -/D [1166 0 R /XYZ 56.6929 663.1642 null] +1175 0 obj << +/D [1172 0 R /XYZ 56.6929 752.2028 null] >> endobj 338 0 obj << -/D [1166 0 R /XYZ 56.6929 628.9495 null] +/D [1172 0 R /XYZ 56.6929 693.9224 null] >> endobj -1171 0 obj << -/D [1166 0 R /XYZ 56.6929 601.0964 null] +1176 0 obj << +/D [1172 0 R /XYZ 56.6929 663.1642 null] >> endobj -1165 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F39 858 0 R /F23 678 0 R >> +342 0 obj << +/D [1172 0 R /XYZ 56.6929 628.9495 null] +>> endobj +1177 0 obj << +/D [1172 0 R /XYZ 56.6929 601.0964 null] +>> endobj +1171 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F39 863 0 R /F23 682 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1174 0 obj << -/Length 1161 +1180 0 obj << +/Length 1186 /Filter /FlateDecode >> stream -xÚÍYMsÛ6½ëWðhu(>Ibrr\9u¦qZU=©
MB2kŠTJ¶Óä¿¿-Ê"e9ÓñAÀ}ûöa…]ÀØ@ú6‡ˆ -fX‚AŽ07Üå -O,Äzå9É©5È@Á<Šuªze> -%ØlÔ&êl2L@F…Ùº>?FjàÝ‹ÔȾÔ)ó¶={Ì]Í„‰‰HïìÑ,ÕßN˜=lŸoÖ+{p§ì1÷eë¿t‡—èœ=Kç±l/@â/¥nk³™p½¼•q‡½k"Z'‡1öÓð½ h4BIÜp_†E ëì=ï¥6òH{%cß ò 2.Û§ÎÌkö¾ìë<
;¯}`-ûšªëæL¿ç™ …è dÜ8O,ð) W½N…;µÍLŽ¡ªŽÈÑÊv¥c
UßÜ*Tz^å{Vu…e™í;Át§Q¹iÝ^Ú½Ÿñl””J}ªQH¨%öœ ÐKÖÚó’SçÊŽå* Áœï9#ìp=(-!b ™o$-± f6i?)ý£Ý'oŸC|v|ï–ôUKÚº:üU«ƒ- -)¢uu,§|õûy‹_§Àl¯ëZS^EmW"°byÈÑôa£ÛøÞ±$ûóÑ(ÿ«<¢³øG/I¨+[ež>ÍÔJº]n½"ÝÿíZ¶ÈÞnï9‰ÓÓ¾ÁÜŠjÜß¹JôÙÿ5ìÝ@:¡ .¶W•ñÆ zê'8¹•NÒ A`k6w\y í’œr˜Þl·\i£²!~õzõߦw Û&åÝ8¡µ»qŠLha¤Ò }μ¼iߥþ ÝilÏendstream +xÚÕYËrÛ6Ýë+¸´:O’˜¬ WNiœVUWªGC“Ìš"‚’í4ù÷Bâ[¢lRÌt¼òž{îÁpcé?lØ "*˜a 9ÂÜpç=dÌô»=œ}ò@õ«÷£ÞÏ×Ô2&1Ñ´‚eCdÛØyã‹«_/
†}@8º0a p]¼¿¹ý%íéÏÕçÛë›
/û»Ý|¾M»‡ƒëÁpp{5èls¬íI†°Çàúæ·AÚú0¼üôérØ¿}ì
FE,Õx1¢ë@¾ôÆwÈðtØ {RasãI? ˆ… ƼÇ8…œQš÷½?{€•·Ó&ý8µ!·‰Õ$ ¨ˆ‘
–aqMJèFÁq ˜]¸Ò}¡3—*íøq”¶æŽJdœ¶¿¥?*pV²ÖKµˆB% c¼ÖÆ Šµ +¦Q¬SÕ+òébdÈi²>ªÇCueõ&RùêdÁߎûøòtc¿Š|¬Xz °ˆâ¤NvÝÓu€RDótˆë¯eòÌ —@ÙZ´˜”w'“¦p«ƒ9»çZÀéÚ¡¢eìî,ÍeË_°ÉÚK¾.¯ñ°% %×°Ðb”oPJ_e~*/Š `Ó‚Ô"¬‘NbÕy%òÌ7ÖõŽÅpæ›íóÍJßUݾeL‡œÚœ©¨” d6c ”¨V'˜ Ȩ0O(H +e!¶i½kOš:EÞ6g¹«™° 1é0‚)#];SýÔ8f?F¬=ÙCZeù?Èž®Ó©möÔÆjî<åHü¹Ôemú&\ÎïeÜbíÚ…ˆ–É1¾´£_‡èN#qÀ
|æ[Xkˬ–ZÉöö5öJƾd5d\”OýWì}©;Ûû4ÀRvä^¨®‹3½ùmgzJ ?xÚ:•Îð%ëWN¹;µÉL:EZضJÜl»Ð±†EÎUÚÞå;îê +Ë2›£ñN¡r׸"lÞ¯ñ¬m)¯l!´aÕªRe‡Q%ˆBB-±ç“€N²VÐÎ +AÌùž3Â×7¥%Cl!óLt‰1³I#Ý¥Ò“vŸ¼oœjc” ß'ç%_ªÜ(ôT¥æ‰“!´š6eQÛ(?nÚXR&ÄÛ,ßž4å <äÁC²¹clœ4*jºTÑ€%Ë· °Öê•ï-ëÿyƒ šå•Ôÿè! õÞXš¯[µn›{³HW»–³×sçû© äûy+ãzU‘8îã1ÞÝ@:¡ Î6—ñÊ öéßt¯N9\_†7Ü‚£¢ =úνü‡Ós߶IqNhå:"ÚDX9©uŒŒn3/.çw©ÿÏ@wJendstream endobj -1173 0 obj << +1179 0 obj << /Type /Page -/Contents 1174 0 R -/Resources 1172 0 R +/Contents 1180 0 R +/Resources 1178 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1176 0 R +/Parent 1182 0 R >> endobj -1175 0 obj << -/D [1173 0 R /XYZ 85.0394 794.5015 null] +1181 0 obj << +/D [1179 0 R /XYZ 85.0394 794.5015 null] >> endobj -1172 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F23 678 0 R >> +1178 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1179 0 obj << -/Length 1707 +1185 0 obj << +/Length 1615 /Filter /FlateDecode >> stream -xÚ¥ËrÛ6ð®¯ÐôL€|srrS;u§uZG™ ‘Ä E²Giûï]pI‰”hW’í‹Å¾ €ø”Á?Ÿz>õ#;š‘K=ƽi¼ž°éöÞNxKC:"Ò§úa6ùþÚ ¦|ÛŸÎ=^!eaȧ³ä£åS›^ -ÊyW{Z~ÕÿTâÑÕÑü亄Á¯ÀÃ'u%< ¹±>îüˆøoE.Õéi3šø;Žˆ7Ðiö›¬ -’Dbw¡:]¡=6ÇŽb;4âÌ òÄ;ç÷×6ŸnÑ #Ø
¨ÁöqÄ}xð0s§-MÏRø€y×}¹†ôÃåòcvÞL8ÄÀ„BàƒKÙÊrz e{”!>#f+¹UhGÄCEQ - ÉŠ8¤EBƒÛÆñ‘jÕ&-óièEÑÐ7‰\ˆ:k“î1Í2„špyÍÍ?¡OjNÎý)w Êm;|â ŒD¤OÕ¼€nëžç[ªF©´’±. ÿîIŽê»aø¼äŽhDr?œÙ+Ì Š6UC Û³ ‹ê3Ì6\€BM @å–Ñ«Á üêîLÛ£×2¿^@Ö_æ-iw1WEVë–Ö\/MÏ3!¶]ÌÑ>¯Ã,$fiON™Ãüa81‚Ž‹ç¸P€â³Ì%~Ñ– ø~éˆ -ÜÑMhg±1—sÞ˜ñÖA†¢Ë à -í¶ÆpÚÚ–¦½µÓ í¦1F7`–skI52j¶C†Ñ4[Ûlå f|ÓøS!¢é›@ûçˆ# ß¡0º&NÇ @£ ð[‚ï^aƸ0·œÀ÷†)ƒçò}µ ׶
¦X#Áã*mZ€í!»KyÜÇ㦩UÚ4â…^—1#xße-¿UQg nÎÛsMO„½mLtSNO6*ߣtgÛÔŽæé&ÕÒyŸå†<Ù¦8¨¸ÏÉíHäZ”mSÏóœ¾à?VM9sxàÁ%î—ؤXd%(‰4ÆͺLDÓj +xÚ¥]sÓ8ð=¿"oçÎ`!ùÛÃS–+s”»žJ§§ØJâÁ±Œ¤ôëà¿ßÊ’;1% ɃV«Õîj?%“1†?‡ŠR/ Çi€BLÂq¶ áñ ÖÞˆ¥q["·Kõz2zyîÇ㥑'³¯á$!ãI~íDÈC'À;o>^ž_¼û|uzÎäâãå‰ë…Ø9¿øëÌ@ï®N?|8½:qIçÍŸ§OήÌRdy¼¾¸|k0©~ÂôêìüìêìòÍÙÉÍäýèl²>K÷¼ûú ßF×7xœÃ±ß0òÓ$ ßÃ#’¦Þx9 +B …ï·˜rôiôÏšagµÙ:h?‚‘çGÞÓŽŒ" ¬â0E‘ïù¯OÜcgÁ¨PSF•[TŠ‰;Z|µZN™xe&7ú¸ Ó%¥aèu4Ûf4cÇ2ŠªBª"“p ]Š×¼äóG3ûÏ 4Ï“òvIU¶¸-A‚Áÿ¸yõœ2\¨
ío±B2år‘3ÑãÖ`neÍ23·¼~v!ÔÚ¡;üxõŒYJºd®R‡úcI Ü*£ÙâØÍìíé+‹¹ Î/òB=†BÏ"ÏjQT®à\ɵ_Iˆâ‡™ôÈä-·NnïµàwE>Ècé‚}[1©ŽÜ„NâL¸Tº²†|<öñØ "~áªbÉŽó +mˆH‚Ò4XÓ´ì2ó“Nv”ó}.ðÒ@«ÚŒó’Ouþkxs,˜(®ÇÀ™2»A²Ü@ÓG3ê7&2àdQØm[—Ôë®H…•ÓÔzeÌx& µÚ^ß3º¨úQäP=Ĥ‚¶í|%¨±®^Ó˜’éÇD˜:3ƒT È8’8ÌlÔÊi4Å€a£%iJ~mÙ@œl[öðNC𲑵6¢8-yöÕ€÷…¾1i +Ájp†ÖÀ೬
¯…’6hq„’0Mû¶ÉÙŒ®Jt÷EY¨qWØÜüs´ó¨'(&$‚0÷ +Á2Å¡þnINcIò¼ä–h@r×{+Øë‹ÖYãú^èÜsñz›™€BM @%ŽÖ«Áò™U»ÇÖè8pô÷ˆúÓÊ’Vp7¡SÉË•²´úz©kžv±˜íòÚR@š(µþ$û8ê»ÓxÐLÂù$ ýÊ*ƒ¢ÒŒæ,%ð½k‰¸YQMjhsb}\BHs¤”XiŠ6r4ÐVMX‚¶g€%—Ê@iÀxv¯T½²KæP²„˜¡92‰Óû\³Uõñr$VÕ@Ž…>ŠÓij9fºniÊKÜžSCƒçô¯©š€Ñõ˜U\@ßZ +}–C6{ 6ÞÔKëhä¦mÓØSDS7ößCø‘ µE
endobj -1178 0 obj << +1184 0 obj << /Type /Page -/Contents 1179 0 R -/Resources 1177 0 R +/Contents 1185 0 R +/Resources 1183 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1176 0 R +/Parent 1182 0 R >> endobj -1180 0 obj << -/D [1178 0 R /XYZ 56.6929 794.5015 null] +1186 0 obj << +/D [1184 0 R /XYZ 56.6929 794.5015 null] >> endobj -342 0 obj << -/D [1178 0 R /XYZ 56.6929 242.1112 null] +346 0 obj << +/D [1184 0 R /XYZ 56.6929 215.7523 null] >> endobj -1181 0 obj << -/D [1178 0 R /XYZ 56.6929 211.8603 null] +1187 0 obj << +/D [1184 0 R /XYZ 56.6929 183.9675 null] >> endobj -1177 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F21 654 0 R /F23 678 0 R >> +1183 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F21 658 0 R /F23 682 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1184 0 obj << -/Length 3757 -/Filter /FlateDecode ->> -stream -xÚ¥]sÛ6òÝ¿Bo'O+† -¤H¹×K&!´X`—‹ýÅ,„¿bftª4š%ièPèÙj{Î `î§ Á8 ‡´ð±~\^¼z«’Y¤±ŒgË{o/„ƈÙ2ÿmþæç× –× /R‡ó8¸\è8œÿxs{E” oÞß¾½ùéóÇ×—I4_Þ¼¿%ðÇë·× ¯oß\_.„ÑÖKÞabÁÛ›_¯iôÓÇ×ïÞ½þxùÇò—‹ëe÷.þûŠPá‹|½øíp–Ãkÿr*5zö?Â@¤©œm/" )å ›‹Oÿè6ôfíÒ1ùiemd2"@©<ŠÆQ<KtÄ -¦P€»}ù˜µÅåBÉtþ¥x¦Áïa(7Eƒ?̼YׇMNwŒy_ ªü{Gé¼¼'¼ ÂÌï‹=>Šª%ÔvUnÄ«W‡} ç©Þ)«·M®Úzÿ|)„˜ã©DÉ|éÖ÷1à @ !‚Tkiߪ٫_¢È鼶‡¦¥¾>‘)û¼kêÍ¡eè.k×ÁÉ©†A¨Aá‘RÃj1#-|,:1¦Å Ù²m‘/¾¡ä¤…J‚0VéyÚ Ö)ñÈ7!É Œ@F=êËu‰'̼޵e‡¥’yCùma¥2Ш4
$è 0ûÜ´´â)kh‹CƒâGPYÑ“,ç ÚšžöÀîŸhÏð4P6}\œ&^|ÁÊHR©˜™é‹tÀ÷B%q )Ö¶ÔªúaŸm$Ío¬’˜Î£˜y -J/c1¯júÝ»ltÊ‘ˆ’@)-þ G 7Õ)£zŒ< |VE‘ùÈ‚œ—-CïÕ -.Û”í³¿ -< -{vá©B¤ê¦Â¾ õKÆ÷Lc–¥¢0ŽÏ©w Ë8UÌè>«à•Hxëâ
òò]èˆ Á-Ƥ}9±ïˆ‹)šÒ°0úËr\€=bÄ!y¢2 Ô¶vYÌ*kŠæ{Çü›Pî ˆ+õfd ãØÅ)—îùÉ’= /$, &ü!ó”8F“±B›(ˆS©Ï k:ZtXGQ¯ÑâFÓ§è<i‡4BZ&OªOÛ .抲_›t.~.6›Í0SCž -VÑ3Ò Î -Ñ܆¤ªÂ´{ÌîXsÌ$½æH%œ¢6op’*ƒ[IR×Ä齬Á«F 3`!ÔnQ^6˜7´„Ý‹*p³7Jæ=> ~àÀ'•fâHÒ*–Êk Ý9hb[T¼q•³l#fèg²Ê:³=”˿ྚ ¸ÝSÞ=åfÓ¶~¥A!&óÛºå9{¦#‚Äžó1¼ŽË
û ‰rHV“`ÇŒ tC”;LSŽüGŒ£H¨³Çh\\Ø{ âüžöaŽÉŠ ;Áô$ “¾‰téEQ6uã.&\‘×*v`üõ -¨TYä¥ØHˆB=–—BÙ2Ÿ -šQtFvkŠì¸„\9®í»òTºÎcä¹òXMq4ø3Ó‹âSÜ@¤’ÄuÎl<îZ jX‰â\ÿ:9«‹ñµ–ÝÍC ¢ÂØÓ6c3©ï¹Ê18 +¾¼hVûòÎ3¦ÆJ
Û‡ ZJ(0 ˆØ Š4¹˜Ñࣧ» þÂ_pª»§û"ÿŸŠ] Ñm´ ÈÝœ¤ÿ;@’ôx:±¢ëNNw;›yIñbþyçácM;ˆ´šzÒ=É£6ñyª ÖY5h7¹h.û 3ÿ|õáÕòÍúa¹Ä¹ÃöŽ\‚K¶Bãù ƒñ³!Tº7 -‡ÏݾÜfûrÃ`º–¦±Õ8 À}º~ÃUƒ Dd׎õÛÛ ÌØUBΛÃjÆêÑÐÓ¶”íÌ©j2ë^/ é ›¨ØÆ ‡]NŸ³„|µ„·gøŒü È4Gº sÇ+wÙ¶û¬ÄÆ_Ä. - ¿VÐM‚.Aˆ ß]ïÙþzZ—öe•""¯ƒýmüå ¤û†K~"_2#î™9ì÷|¹Ö‰Ø'ñõPîÉ…
茼2Ûp›•<¢¤I&® ŸxÁÆk<=œ½Ã[s‡Z|[g‡¦µ™¾J¸w‘8ל´Ýívžo¼Çls`J£ÉTïA„í3®[á|^ñýßH²c‚(r¹Ÿ i,öié¾Ê¢è€>ÈŒÎUF©“ŒúÇ¡’!J©P±£Ú]‰¢ ÂÔÅ„á×,cŒ{÷—žß¼Fº»iï"Pk³/¶`„aÁ_gZú H ,Z——¥XôÇq_ ʪlKçxWu…§ôp Í" ßË goû7vÜfûö°co^n»O°ò~:vZ /¹4÷¼pƒÃ]ƒ %T¼9!!Ñé2I(¼…¤÷l𱦃@‡Eß÷Å~_ä‹ÔÄ“(bfhÎÓï°FèG £DŸêûɡɤݘšoÊÆÖ1ˆÖ>ïø® 5ü5!ØÄ +1190 0 obj << +/Length 3744 +/Filter /FlateDecode +>> +stream +xÚ½]sã¶ñÝ¿Âo¥'ø"ÉSrçKœ6—ôΙN'É-Rç$R'Rçs}w± +¥[ -S®Õ¨ Ão×lt ¦îKOò‹NÑŠo«Í!ç“Fk ºð1ÁŠ6ä~*fíܽƒÝ¹³_ÃŽð. ;…*‚VXüêãêÿç¶<½„ÒþŸàçOô
JÏi"èÝçOןßáh\G]—Gø
ñˆ~À?ßÿý©òñ;nüîÑ9Q¯†q`°ƒÇL¡”#=ä¼û¦ù”õÿ<xmendstream +îæw%Ï2'‚¿?Áñ 3g\A¦eü,Kø«ËtEʵôª31¿ ‰\¥…2¢ºƒc>1g¤Y?ƒxöOM».À¯8ÿμ …K„D˜ÊÆ‚Ô5ß3,s|ž[YæF8F÷ +u[ÞºþBƒªyDG:#GpŽ9Óf,G öqqŽ&øÉÿZŽ P@Œ;.eƒLÃÔ¶ó¹Ì²ìmšÈPOM4÷Æ„_1b¥>à Oyžûh哾8e²›È’“¿ôòžÇHàlÄPêx*r1bÄXç#FÀ:Šz7›DÉˤ=Ò iqšB‰1m08¸˜7”ÛÔsñC½Ùlmži4yD¡¬A2ø·½\qÒk€ùð@ÐØ,8¹´žF6nX r½§fójn¢°¡.3`#:ùf oR× t&ͱîSê?™ô10á‡IjðÝ°n¤F™:@Ú¤|ظ‘• Ìlº²rÿ _ñØÚÊ}qƒP'*(½Ú:÷/Tš>©‹B„ +í;@¨W¬êÏÕ+Xyݹ×ά +Ϥ:¶Gš¡=„rOˆS–+òQ™årx~Úñ® +¸Š~òRUåh»wô|¢TFMÛû –”ùFH•{ö ‘:“/ Zjƒ ;NÛömµtf \UgÊy”$£®&úµ¦[Õ«ò°‚Ú&Ö§0SÄ¥ßtƒ¡”MEVä×R©*„ú38žõ|n¾¸ˆ?IMʘ;!YÊQrÍëb:+0@×R° °sV‚>^©—¬$º`% Ë&<õ¶ Ê¡s^öçÌ%—àŹÌEÀšacd0`'¹f|ֱ̌ÁhC£}¡ÍÑ`b`0 +MèzÃBÀÈEk“l Tï 6W ãÊÄV`àfÆê4OµÙ®µºÔ)Ï\†¯lrì$7s : +·ËÎs°™&'°m÷ÎÚ©€ÌUä/eà1Öy;
X¶dnªsÖ ºÀ ]¤ °fˆ+\¨UY>&~?ß4¤hV ×1šé¹hV û–ƒkeºŽÜ²î àîïlbÉVØn‚ †…(&DäÙ‘\Pe×h=Ue™™ÌÝûÜW¾¼ÝQfÒ°û\î_íí+ÒwØ„—‹Y z<s ¸ñÎÙß”KI_« +Ÿ"ò¿øaŒÃ +ˆÞzêçËcH&Ñ»´áÒ` |Ï@¶g’I×ãÛvŸAi@ˆKÞuƒ›³{:Ócϲ´(„wEgÇUZpæ‘ì9|²¤;P<!ikÌŒÇN&¸×AS€À™ÁŸvºã©—tù ÏSiðˆqÔÎö ]Ý.7]ïà /éªîðà£Ø§ ?ë7y‘C
›¿Ð뎱ÎûÍ€esV<ýÃ:ýœ÷”*…Àž_æ `Í°0=¼b‚ó*òžøËj5<‡–xŒ£ŸPÞ€Õ±‚‡±+FóŸØ;ß7u˜ §¡’Òo%þˆ7Ïrµ5 ˆ@¶ŠðGš -aRYĹKåž}çSžÙÊ‚eôA©äÛ†¡¤5ß˃TZþ ª +=Êo.ñ¤Áïå¢x)qçB`‚ñ’bGXÛc³š³šÍÓ,ƒ»ÈBÀšáaܛˡ<ÊÕ˜ J ÀOD‰zF{ôî[÷ +7BªÜÓV¸€zèç×{’2Sc'}„Ä'9—ØJ™†Àš˜cGyE¯·ÅwÇé‰áþCFéI.Îh"HšáˆXÏqµ”€¨áãAKD 51mjáÜø~ +üúæ—W÷¯¡ –A¦rØ>3ð¥C¦#õ»- 2ø §·uóÙåd!ŸÑ6;Ð7ï>Ы.à ºe·q´öeèÍ/1WÓ2(>;ÌÙØAD‘¤W”°wxè˜áºÇñ +‡‘‹ªþÜ,Oã"ìc"¿L>`ÍÐ g|f¥3`µÌ†èîÙÒýFG‰ÏÚ7vÏ@ùâóÁ!Ruh! #|3.а_r;ý* >wûf[î›Ó
[ÃlЇÛ×.åÓ›M+Ãn‡gd ÌöÒ ãIX®Ñx@=zzÚs);sjûÒ:V{Hf¼EfÑE½,º¨—ù‹z™-ck‡l/é¡9*ãïP!æÎ}XøûÅœBÛÈ‹X,ÜðÃÀk•ÆX©Ì:æS€0ú °ì¯§uc˨°Fy <$Ã_ñFúët™K ,ùÆ1⟥gÉ~íN胈cŸÍž\Ø„ÎhÉ<¶á6¶l܈Ò%^ø“¼" +Ë0^ãîáì– µþ².ý`ëVQÐB›\Cq’e¾Ü£o¼Ïåæà(ͦ9BPQjå»0°?¯Ü%‚™4G§Rú¬Ëí i,S©‘r’Å¡è€>ÈŒö•K㥣ñí„P›¶ê¶£Îß«HéúçýüÅ8Ž¡Žç£K‘ß™,£ÈR®ë„Ô†ò£Þ`X»‹žË~WR‹22ƒ-¬|RŽ7m34Þñ.»wéñ@šE@w¸‹ž} {º®õ~8ìœ7o¶á6g5NäÀN»ãIyÔ¢î=ÞljÝÇ ‰ÎTþ¡Ë™âõæ ÿnOÿç[ÔÇ+æxoPë3EŽÈòTsSx¦P¨RM9WB§Jób†õŸ¶›‰endstream endobj -1183 0 obj << +1189 0 obj << /Type /Page -/Contents 1184 0 R -/Resources 1182 0 R +/Contents 1190 0 R +/Resources 1188 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1176 0 R -/Annots [ 1186 0 R ] +/Parent 1182 0 R +/Annots [ 1192 0 R ] >> endobj -1186 0 obj << +1192 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [250.9056 311.8959 324.559 321.3055] +/Rect [250.9056 208.6872 324.559 218.0968] /Subtype /Link /A << /S /GoTo /D (statsfile) >> >> endobj -1185 0 obj << -/D [1183 0 R /XYZ 85.0394 794.5015 null] +1191 0 obj << +/D [1189 0 R /XYZ 85.0394 794.5015 null] >> endobj -1182 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F21 654 0 R /F47 874 0 R /F39 858 0 R >> +1188 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F47 879 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1190 0 obj << -/Length 3440 -/Filter /FlateDecode ->> -stream -xÚÍZÝsÛ¸÷_¡¹'z&dÁ¹§\â\Ó^œ6q?nîîa‹
EêDÉŽÛéÿÞ]ì‚")JNz}èøKp,ûñÛ•åBÀŸ\¤:Òyœ/²\E©éb¹¾‹{øöý…džÐ3…C®ïn.~÷&Éy”ëX/nîk™H#7åOŽâèVÁ«÷×oÞ~ÿ—//3ܼ}}Æ©Þ¼ýከï?¼|÷îå‡ËPšT¯~ÿòO7W è“æ5¾{{ýšFrzœXôÃÕ›«Wׯ®.¹ùÃÅÕM–áy¥Hð ¿^üô‹X”pì?\ˆ(ÉMºx„É<ë •&Qª’ÄÔ /þÜ/8øê¦ÎêOŠ(Nt<§À| @#£4ÏÓE¦²Hg)°Ý쪶é.C-Dð/<Ï>›Xd‹PÊ(OÓØñmÛv–¶¶÷NÛ¦~¢Iöó²Þ—Ö¯à ß”ö›o™¬ zrßõäzßÙýÚ¿þû[·s8ÙšD¤#5Ë(“R/4 )ÁJæÕBLáËi%–3fÕsá–eÕ·µ
‹ú¾ÝV»Õº›Š U )-Òó2ô\3B$!$ \)iÆR¼&)Àæ´ -v+G$A·±Ëêg!b[Ò—×× ?^½¢Ý·bÇϦ$†[[·ÏØk .‘€Ÿ¼Û×»*¤ÛÑidÈ=2Œ
_'Z•:’ -¬YœQçDÆDqjü”nWììÚ6»Ž\®Ø^JX~©á¶D¥Þ;SÄq:ë¶ÛÕŸmIïU]uëÛlê -;edJ@¼ú#p12Ïå´Òt]†uÛ~*ºª´G&–¨(¹9/AÏ5#ÂÈÄ’ dr,ÃßV¶Á;7Agw/f.RébP‘3"O¯QDÚæ߸[k €µ£mØèLðPÔUYìÚ-½>‚YU°@Dê ¾”ÁÎn0 ̓µÝÚ’×jû¥ØB!´C(ŒÍØDq ˜žˆ }åW?"²¨eëžeG è0øtr:¢Ý{{Ç ôøgÛ (#X‰ƒoÃ]ªÉÂx` gG Ì*ÛuQñBC—Ä“‰qH¼EƒWÞ…U”Ön,Øüñj ´Ð/¾À Ò«Ô9Oxë§ ?†;6ív]Ô4H«Í÷ -9‚øVEG j{·£!^CŸ,Ÿcß춗&Øw;[òŽÈDwªT$bÈ}£;õüaÑ,W¤ÓŒ›´ËªÝl,ŠN79ºZMÛãÆ;æ÷̱¼þá2ƒ¿ÒØØ`Nm‰ºµüu¿nÁɘ©bcªØ*–`õ£{¦S²2íŒàRÊÀÙŸ ÞÞÑpo³ÏHûu»f›?‹TtÕºª‹mýÄË·×x,ø‹Ÿÿñ´žÊÖv°¦œ³æ>l{ Æú -‰´4ŠÐ“ 2‹rŒó‡ EöAGæ©sè’HrP¤²"U,—v³cºé í¶£tK|ÂJžÕ Wæzp|ð¼8—óâÇ€ÙMžûÚ´sò³“Ÿ’Ÿƒ+Ò>¸"=®N¥qøRè $#Dƒ¾+ÂJUsoIpçB% WÍð. £Wò9_‡Á[ÿÑiÌA®LÉàÆ…€| ‘±Ob@“…!›_fß”–(fr•˜ÆxçÐ!†»c¦Xëô*„sÍ Pª¯/© -PrA–*ˆ¾Î=ñ{iï -(àðÅðµKˆÊ™Iõ—«o½¶]Z†Mü³ ÇrU4÷–¶¼#ü¿¦/Ü^Ê8AµC.øþÔîy>»À˾sq 5=±~r¨w”˜@ü¶.{Á…_{·{äå^Ðí‚åaÁcc§xâ -3‹T–«ó2ô\3BŒ›®ÙaÆRܬ<|£V—á®*H%ܱ¿Š? šp†Xк["mÃ
øº\Ùå'2xs‰ÍÝ]·Û'b‡XûÉoΫ£\ß@ÒFÔØ'd<6)nºiÙ'M†áyø¸Ö ¤7v b§óœàÝi{PàCš<c®3ö๨ SÔPL¶5€¤ÈÎoë™f¶ Z@.#О o{ -â!õ¼ûdˆ$E‘rV§}uƒtS…ë ×(¢Xû±Ž†0ã»ÇzÃàÃeëlËOfÞ- ¤;†‹Œ)¾u~iFE£Ë•vváL,
‚MŒo$LÒ4¨«æf {Ž£X:Â!¨ªLÚq¿ÚÑ? [øï…{^82Ä}Õ@‚p(xaÙÍp Š«2SXYÂ5°óâ'WÆãbeå–%8e5»¹ŠÎ2Ï/"‘?r9HBÀƒ˜ð$íº‘§
ST†K8Û,a-ת’ãyˆcv€•ºÖóº® P?A ±r^ÓVؘ«Á;È°.Än³ þ‚^[·!RÖç§# -(ÁˆÎQ„RÑl«:´2yߪöAr²OGFå¾4ècnM`8 ëà9î¬Ã€Kr ½fDI
dÐÄoòPÙÇIâ4’¤™=”Iz|â.hf! -ˆÔ -zî_œ’ ШLóñ¿8ýw³¼ƒÐ{Rš'`-&ýEŒ— -ý‘Â\E:†R`¾¹‘–ÄJI¦é¨€§ÿ9) \Séy 'B&dB!ÚÐ .™%Ù×!˜
oDeøÚZ ¤ÿmú@Í+™
@üÿNÅ&Žtvê±¼Š!\ÄZ$gŠ>Ié~‚±³ ˜›J¡Pù -!C¼ÔœêRýÿªRK&Mz^uÄÁ©e¾¯†ýó„ë•sÐO›ÓÓ@„ßv(%áŠ
þ€”@–3éì6ŠÅ³JüÒÿ£<ü“©Ê A›xÞÇã -p•#H…k¡†”>îÔò?\2×@ôÿ +1196 0 obj << +/Length 3362 +/Filter /FlateDecode +>> +stream +xÚ¥]sÛÈíÝ¿ÂsOòLÄrÉår9yrbçêëÅnm§íÍÝ=PâJâ„"u"e'×é/°À®H™’“i2c‚K‹Å7@‰óþ‹óD*‹²ó4“AŠä|¾> Ï—ðìÇ3Á8S‡4íc½{<ûˇ8=Ï‚LEêüqÑ£¥ƒPkqþXü:QA\ +Bë¾n A¿…IxIÍ––.á , Z}.«ŠÖgLȬËÎSš™¼'ô„ 6° Ó±²°‹eÍÛ:^ò¢(§('ÔNÅ) +@€r:NW6u^‘1µfŽ·tÓ,èšÓåÙ~%˜h7MÝ0×X„“G» <+Ì"ßU Ý”-]놺†®"±°üã 5“fi„Òº½»½Fñ/Œ›-He*FŸ6³>Öq3óX(•mÓtÓÂTf™£D¦M]}}alID±ˆOsá±FØ[’‘ˆÔÇ‹,œì¶ ’XƒJìU€ˆIÍÆ07kSw´Ž*C¼CÆíbÉD ¾j EÜ5Z®Ì“©øõf—uK†‰ y]ÐvG
ÙSJÄÞž( þÙÔ†Õþ\v+§_¶©MßÜÌ—yµ+Xßè3VÏ 6ˆ‹W3"xÛtŒÒ6k†è –²÷ˆ¾íÀûZ)8³2Á’Íö·(’W×ø÷
?ðç‹,šüó`ñÓþu§)ö>~z¸þô!o©-²žfá<q„R’Ñ €}†“ÿØË4ÐQ˜ sÔíK^nDÁ^~(Ìo¬ž<¸k=¸Þµf·v·ÿ}Ë1a¸5‰œ Ž9\’bHÒÓ×Ç:îp ·,Ê6ŸUfšWËf v³n_¸›Œ©Âä4 k„‰»ÁÁ¥zÈÅqÚU’C¨Šû‘žž\Ý><\¿§‡=†í³¼ã«5@˜™ªy~b¯m(…rà#„O±Uh | cS²²T… +„„¤ žç ´¢D»WÚ.ïl,󬼂C˜‚ÝæλSçâþºiÙ÷üÙæ. +Tìï3Gl³©J$vÌÈbL·ê•â¡uÂÈ –•JÝBŠ›VMó9oËâeùË
3}š5ÂÂÀÄâ xbÈÿVƒ’Òm»7#Š”*€RË+r„åC5†Òšñ)³6O€ÚÒ6ltzò”We‘w¶ö€[ŽÎ +œŒ‘J6¦’bV?Ð3’…iFBL¬ý ÛಷÙW¸Vžn{ÄlS[™´åº¬ò-Ù|sàÏ9?qï? —SÑ*áF¬Ù‡mÇ€m%ï!"
w0òµ)†µ»‹â{û9È!ÁiôZ ïc ä «çTk4Ç™™¼Û¾Œæ Ò@æ4 k„A4W2HÒ42ò€Qc>¥“Ui¶”5ç +MöIÎ$¨‚íaØ£¹D 9+YÖV+»ÎÀ +_†žO54áéAhÓµHê~ +B^K@_ÍX± Rh #Ý RdÿtD–X‡.$EˆJV„òùÜl:†ëöÙl[ºA·Ä+Pr¨î¸"S½ãÔc² %q ³ÌEкãŸepŒ®»àŠp/¸Z‘FÔ—¡:(ɨ¢AßÎ$ÕJe½Ä»x²°¡–¡£êéÒ":A žõuXœ¹‡Vb¶äJ¥ ñ¥#"ú$0Y¢92»º0Ì@>’«ãÂÖ:ôÃÝK&8ó"„sT¡"Ð*‘ßU¼$!x½À Ò¯ç]ùd‚‘¦"GÔz—Qf~ ‡µ0¨/„>ç]ÓTƵŸwÜz Wqœa¿ÒÜô±Ž‡+eÍcצõÖÔ‹™|”‰'·÷X#û‹NöÉ!£^“i,³ïsú8ì4q¨]ÅpXÀBE(SÁ/]^ŽÑÕA¢„C™¹œì+· + Ã6'áf
j·ÿ¾ºûxysÛÏ|4‹j™AóäªC—ô9bͽ}2[¿—;"ˆR}Ð~S$ÖZà\ú+ß*±£‚*9'ËœJˆ¾4ÿ‚çûù—Ö¼ÃØDåT'êÛƒÕ['m›–awÍé2_åõÒЖ ªÿ×ô„§È + +É0=½CÙ¶o™@zb¸í±¡×Ý'í•H"ô%RÆâ C Dí"i*·S£ÐŠè›ãZKKñÞÕzýàâØÙÚ–{™q·P%-¸\Ä`Lñu¤i.W˜5Ú…5±$N441ÖÈ4N’IUÖŸ1cèÈ鸊}¡l•@—I;î–«Ž ¸÷q$€W`q(<óÂw C,Ë„g –íÖCbQ¦;KP;/>²m<+JK ?– °ên¬£3Œ3GEÄÂÖÜ°dKL¸’tíŠýÜbÑm.àüM=‡=¶Ü« + @ ßÃ:¦ƒÐ +ÝC"op`‰&«fc;Êüp[ì¶ ûÜ×5Ës8§rb™÷¼j9ˆ¶»
ñ‚zØU ™†ª#=h$öŸ8Üç7 Äüø`ö›X{š ¶¼g¯}i¥T ¤©þöâ„[Í(M œŒ#÷í†3Ñè¤:ƒj]g~RíbäÁ6qh™¹ÎÀ‡þLs1Ñ€$ K¶]€ëp° 6Çqða%Ñ@c·ÉSižG8‰’@„:éÙÇè¡tìË«ŸBPè0}1pCjr¼º‘°?Ï[>™Ž2 íR àùk
”TX* ¾ ñø·o?˪™yóﳞ…T¦ß Xé¡>Xù"D] (ßÎÈtÂá + ÿðÀ}Ýñ…·Þ¬_¬ƒôiÜ%³=Þ>åºbq_|5uÝÿ]+N]g?ŒP¾pñTÞö[ƒÃÜçüœÂûµöû¸eÅ
f{Þ¨€iªÊUųѴ…Vœ†‘‹ ŠaÄIÂ@(õj¨ˆ“ÔÍH0†MÒ“Y%Þ7]¬Í`©õð;¹íì”ËM +} Š ífû·0Ûª„ p@Ó9 ÂüaO
óÛÁ ´¼ÜU9¿…_Ê÷œa-eñºâ“?´+úÅ ˜Žé}Á{®Ø’Uj¥B£Wåf£ endobj -1189 0 obj << +1195 0 obj << /Type /Page -/Contents 1190 0 R -/Resources 1188 0 R +/Contents 1196 0 R +/Resources 1194 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1176 0 R +/Parent 1182 0 R >> endobj -1191 0 obj << -/D [1189 0 R /XYZ 56.6929 794.5015 null] ->> endobj -346 0 obj << -/D [1189 0 R /XYZ 56.6929 496.716 null] ->> endobj -1000 0 obj << -/D [1189 0 R /XYZ 56.6929 471.8543 null] +1197 0 obj << +/D [1195 0 R /XYZ 56.6929 794.5015 null] >> endobj -1192 0 obj << -/D [1189 0 R /XYZ 56.6929 118.9377 null] +350 0 obj << +/D [1195 0 R /XYZ 56.6929 387.6589 null] >> endobj -1193 0 obj << -/D [1189 0 R /XYZ 56.6929 106.9825 null] +1005 0 obj << +/D [1195 0 R /XYZ 56.6929 362.5676 null] >> endobj -1188 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F21 654 0 R /F23 678 0 R /F48 880 0 R >> +1194 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F48 885 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1196 0 obj << -/Length 3558 +1200 0 obj << +/Length 3390 /Filter /FlateDecode >> stream -xÚÍ]sÛ6òÝ¿Bo•gB >I`î)Mœ;皸sÓkû@K”ʼnLª"eÅ÷ëo @¤DIM¯ GK`,ö{—ä|btʤU“ܪT3®'³§+6y„¹wWÜã$)éc}{õ··2ŸØÔf"›Ü/z{™”Ã'÷óŸ§oþñú_÷7 ¯¡Ù4K¯±é··wßш¥Ÿ7 îÞÞ¾ûñãëë\Mïo?ÜÑðÇ›·7 oîÞÜ\'Ühë…ßáÄ‚··ÿ¼!èÝÇ×ïß¿þxýëý÷W7÷ñ.ýûr&ñ"¿]ýü+›ÌáÚß_±TZ£';x`)·VLž®”–©VR†‘ÕÕ§« ↽Y·tŒŠgi–Ûl’H“*ÍécéÇzóÔj}xjÂŒ3 P®³”)G™Þ“ &9ì“k›fRH'”ºéªÅ òÐe ¸’k•ÃˆöR¶×‰aZÀ -‚ZpS$ -œØYR"Ö-ïÏ $Ä!1ÿvr—R’ˆ¥„,´x*ƒªâDù¥êZššoKóVVÏNEpîÓí;(ÞÞ¿"IšjüNóÆŸ€®åTÝ}¹CÅ(ê 0Ëz #%²Ž ݦêÊí›3Ð"?:/ÅvÕE:Ž™<ÏSÁ¥òözV&‡îƒÿ±Šïó«co®p!ÔbÚhú‚Žõ°ÎèXÀ—Üb5Of«ª¬»£t"dj18K@Ä¡`pY(欶|H™´Ì³è™Þ~°ºæÓ\”פnõâÇŸÖ«ò ˆF[w~%4B½ËÉÖ JØó±n¢ŸÀ8äåp¹mÉŒ™Þ_[PMÒ=(àÇ„¼ z‹Ù²*ÑArËÈ<¨€´zŽ'àSS4zÇ7¢lÇ+´á ¨XfÀésÕ«GT,OaOLh˜˜¶ër†åúän×ЖëbSt~˜ä2j QÃþÛn™Ô_æÍSQYWÕé鎓
õ…ÑîP„#Ç[ˆ¥yˆ¥›ÅLHfL§ø³dÿê¬5*`?Ö¥‚øVó“F©P„ÌÎe ë´QF,'÷¦í’¶ƒ<íªÙ±Q*0#“©óD¬ -†F ¢È 2à2 Í{ÑÑ¥Â0âSa€(ýõòsY®½ÛåÕá·w‡´h6~é3%¿ -–v¡ÑÐÇ:myËY^UWOÅ*ÙøŠãØÓæ@!åó$D¬†8K
æƒ"n#̳sšìw„uÓ ë:GÇéŒA‡:
GбMhLèlPcµ„âýîyYØ¡ZhES¯^h ª:Ž+GÀ#EìmWlŸ²cSÚê¡AvË’rÜR}ªÇ$ ŽXJPá(y( [÷”.Z„Mˆ,&ø·mµ¯å¦Y™>:CO³* ]?Ä©¾Ô`Vøìª]À ð -–ò EéSñC
5îžc§¯ õÉf½¾z,uq€á…àýÌÅre 8ìA2þ„šCXJË/˜] ë´ÙE,gvp… -"q2säq¤ã€ ÅÁY"ÖƒËfY*si†$x‰Ù^?`Š6 ± -†*?å]=@†Pœ®Ãc±Z¹‚ôã³_‡åó
ø¡“¢#óÍÝë÷7d,P%)ÕT_ÇŽ
NH¢NˆésÕPW†FÁ0i PÓF !«ç…ßÃÙ@Lñ`¼Žß ÞƒƒŠÕ®xià ›ŠÊ0œ)ëEã{JíÁ©û+ Ä0×4Š™ãCÓ-‡éØS‰·oÁ@Á-"jlÚÌ_€³ÕÌG«5ø¬íO)²b·.ôgzHgÔØ#
ßw”—‹4çZž=4" Ÿ:´Ó<Íl–
Ž
œ¥àýíÙx! äæÚÄ>†fÔÈÉ¢[Aÿ†]““ÂHmã«D[m‹G”ÎD_‹S-¤‘[v4@YBt ÌĦQFm<‡½¥p@ΗºÜ6ÕB dq.e“LNgË¢b`Žë8c62Í8DYUµe¹K†iró8!àc_*?é/ËѾHקÐÕDÚTÊztdh Õîo~Ü£ Xh8ÞͧÞ*3.ŒžÀX/8┣¤§»eœBé´ô°‚òÍ5I -*¸ÏÐá9|`E,`˶k ËWâÁ«·kÂ÷ï^žŠ‡%¾ŠÇ“âdË}9"Ü›67IX|¿É®Ù|öA ?—¯GÕ5£x* (êvç(`>6#@W ß5X1ÜÄàZ´Ó[˜Ú«3Sži!Á‘xS¬åée-“þ»\°¢‹ù Í|¦·Å}ª<©Pm£SårJÑé°Æ÷|á µ·8x.úà ð Å +xÚÍ]sã¶ñÝ¿Bo•gŽ>Iàñrñ]éùŸ34ÍO¢,62鈔}î¯ï. H‘’®i:½ñx´\,€Åb¿I1ãð'fÖ0®œžeN3Ã…™- .øì ÆÞ]ˆ@“D¢¤OõíÝÅ7oU6sÌ¥2ÝzkYƳ»åÏó7~ý×»«ÛËD>OÙebR>ÿöúæ;Â8úyóáæíõ» o__fz~wýá†Ð·Wo¯n¯nÞ\]&ÂóeXáÈ„·×¹"èÝíë÷ï_ß^þr÷ýÅÕ]w–þyWxß.~þ…Ï–pìï/8SΚÙ3<p&œ“³‡ m3Z©ˆÙ\|¼ø¡[°7ê§NÉÏ(ËŒ•Ù„ +ã†îæ÷ÍŠŒð½6 å€æqX+€qÆp©¤;T’º”¥Ú sfÒ2™Á:çdœ(õe™ov$½‡z‰¦eµ9-iÅ…"EJP“ŽP‰Le#ª½Këß x`¦$7³þ þ;© üµÈôÿFÐV³Ô)µ´˜tj=à‚;° +
+«çK§á¶¼äa¬~l˺¢Ñ¢ÂraIMù°Ûä-]<ûÊ©êOM½)ü½ú»›Ð!=EûòF¯øñêöRÙŸ.…p~ÌÜ…Y1´ÄA‘XAå¿
uL k˜Þzþ92YWGïVƒ1hËõé»íS ¿ÛŽÊßmÑ.ÖÉýfWŒ¯–ÃÔÔžÞ»£šØ|pµÊ€áõO‚»ßÑ
¦vƒi6ïpáŽ@à*U¤€‚ÈNö0 öÔVÅ Fï€IÊù‘ *|e°cäç,ò]ã5ö ®(•ý]"²¦ß¼m‹‡Ç–"ÒïH*hf•êñ"
SSï<°`µÿÅ. +ñOË'ó7®” +Í0YhþPD%ÅâsÙ64´Ü„ ºU”O^9pìãõ»»«Û÷¯ˆ œ†ê°Ò²;`€ëSy%‡‚ Rm9låÕK˜Eµì"%Ê çmÙ
Z¶à ?jßN—Æ1Ó÷GT·üü… :a¡0ÖbŸ_MTãA«Ï„ZÈe˜æ©;^}ªãúÕQùÞ\§Ø,“Ŧ,ªv”îApdS“ tT kR8CȘU–v>áç< ËK1¯À9Mj}·ñ›â˜önD„™dÊaÜÖ< ½]$‰kÞWuç!ñ 6y9œî@[Rkçw—T“tOgŒ LÈûî(tÜ÷-Q`³³Z¡ÁZt)=ƒË›P6HߵË9P±Š=%t¯´žP±Œ9%㚘Êp9o ‹VëC–Ûç:¶ƒ ómÞ4Ýˤuh컊¨¿ù®]'Õçeý—Sa-'‡â›f[Bå';»ëº¾Ãí DÑ,FÑíj!· &RbJX²}Ò5ˆßÄ.r ‘È—ÇRÂNžñù}ªF©ü½×M›4-dhM[.ÆF©ÁŒlªO3ÐQMp04JtòY6dÁç>Fôâ¢O‚ˆI0@”ø†ÐøkQ<·+(žÃoï žhUoÃÔ'J{ÄË¡ð¾ÅGa1a©˜
ì_#ä ²°IɸÙÁÛ’²]oˤËðˆjýÞ6ä'øêàLFܧ:~Û rŠ¶ÒÂR~¦Vvò)oÆÙ1˜ºKõi6"ј
<‚‚ÜØ ð“*½Ï&œÚ×/¹¬e&㮋aP?‹ùuKó½ G d¸¸dX:J +,ÚÃ'´ð¸„}¶%…nÉ&(Ä– rúi·yÕ€ +€ßîXÝÔ÷¤ÂHäH h„çD PUŸADúÀuµ x€Úá“U@þ’Í1ð9î¸62íÏq% +V‹!׫ á9È9múaÝöºÉÐqzc0±Bè tl[& TW
‘kz^V(7šA¯øõ ãšèH{Ëå»ð.ßiûî WÑ®kHÊqeHõ©SbX2b)A%£±dl ¨|´ˆ‹[„&ø·]¹¯ßxìÞÛzšMqï;!^õ•³Âg_çõ@Vø†ŒMÙä¾ }È_ºPC»§®ÓWÄúd»Â^_µˆ–º: —üÌÙre 8ìAq£ÿ€šC€_ÙÓfק:nv •7;8B ‘8Yø +r éSNšÓ tT ›¦LeÊY7æz<€)B¸4Æ*@•a(¸z€,‘x]‡Ç|³ñé'd¿ž*ä/€ô±‡b:1å››×ï¯ÈX JÒø.i`,cƒ“Š¸“rþTÖÔÏ#´×(@“F‚Ú€„¬Zæa
o]Š£àuÂÕs>Ø(ß<ç/M\c[R†#EµªC7©9Øu$~x;ßu™ã§º]Ó±‡ ïÐ|‚[v¤]»fù’-!Z=‚ÀÚþ˜"+É2ÇÏô©ûT'9R
ßxôW +ÈN”Vÿž†·÷3nû÷é“þ„‰{‹|}Œ]MäM31jÓ)Žß)Ù7ã>]¤:ÃÃxµ€ëÔRÐ@6zÆ{!‡Â…qJ½q¸]wCx;
=l ˆó (Ãé:J¼Ú?…Õ½Âp5òV”–—N«Çæòç…ÏÉ¡‰íEÝy„÷mFÝÛª-Ñ/x–ƒ© ?¼&à½wA ô6˨ޘTa¾?<üú â~»† ºÃ ì4NÒ‚|ÓÔÉѯ" —Èt¨) ± endobj -1195 0 obj << +1199 0 obj << /Type /Page -/Contents 1196 0 R -/Resources 1194 0 R +/Contents 1200 0 R +/Resources 1198 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1176 0 R -/Annots [ 1198 0 R ] +/Parent 1182 0 R +/Annots [ 1204 0 R ] >> endobj -1198 0 obj << +1204 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [182.6146 225.1021 231.8861 237.1618] +/Rect [182.6146 117.0296 231.8861 129.0892] /Subtype /Link /A << /S /GoTo /D (notify) >> >> endobj -1197 0 obj << -/D [1195 0 R /XYZ 85.0394 794.5015 null] +1201 0 obj << +/D [1199 0 R /XYZ 85.0394 794.5015 null] >> endobj -1194 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F48 880 0 R /F47 874 0 R >> +1202 0 obj << +/D [1199 0 R /XYZ 85.0394 720.9574 null] +>> endobj +1203 0 obj << +/D [1199 0 R /XYZ 85.0394 709.0022 null] +>> endobj +1198 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F48 885 0 R /F21 658 0 R /F47 879 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1201 0 obj << -/Length 3695 -/Filter /FlateDecode ->> -stream -xÚ]sã¶ñÝ¿Bo¥gN >H|tî|Ww_ës¦é$y )Èæ E*"eÅýõÝÅ)Òòµ‰5c€‹°Xì' -’‚nÚµÞ¸‘ª„[n°8•Au?_.îῈ&f\ƒ -nÖ36Â&Ð̳î |e.…ß™wä%(´ÉÓà°N®KäIT¶uMa¢øUÛh -ÜÛp†©ÍñXo2 m6Bó64É4¸·Òƒ!Öë†6`ø;Xþ“‰sŽj¤ÏO쑦|_® î’|<1¹> –Ë»>¬Øë®/˜#äGQÊÖÚö{i÷Ti Ê2ÖlÜåªêŠvü¸ùéãݸ¹ b[ì@’÷u±£ïA Q#Xç?ÜNW0$À8(IÇv¡j ØGAó弎é4fYîW¹ÝµÏÕê¸S§Úú¨åG¡Dsº±ØŒVe&É%žÑ+¾ âOÅy2ê¼^M” -Œ_¬ ‘3‘³€õÓÑÑÑ$³ Ñ¡Àm$ì›Ùðߢh2î„1I,'Á9ä%è,WÖ4LG;ojd - ¶”o˜šÖSã±æ„x|¡†€öììkfúqÚ Ò¨ Í ?&Ù]¹«êÒ®gT1Ïb&ýÿ¨âŒúO˜ŽzNÿ<þKžŽû˜ð˜gýšÕ@õÓÑÎËєɢvD:#iɆQ²›®Ÿ4p·šKqvê€4{,f•ZÅLþçHÙéN¥ ì >pFÊÐÓâÑã€þsBæÑϯw2ê·Š˜Ìb
qÞYž¤ó4LÆ:+_2KÀ`$oœ ±^—°€…3ö;SôË’2¢¢[vÛ¢4Ó,5‡À'ççÉX3tŒ¤M&q*X:&Ä $üèö¡~( pOHÂ(¤ˆ;$€š¦Â&PnŠ¯ÆA¬äBŸ"N:‹ž>Ëb·«ŠG׃Ú0½¤oLF"!ÑåÉÈGƒÃç0ÍŒ*$`9¸Ï²çÄ_Æ:Ký8fnŽ®§bW”KŠÄ$dh âÍQ ÖÛÐMd>
Ê Û*6†@{…Ë@h*è“ö×Ví1.´ôÅhJ¯ˆ0%Ó’˜ -m뢬ê -Lú®ÛbE÷%0‚½a eÔX£üÉMm7I¡âÇÛ›Ÿ ¹/©mÆ ”?ôO´?°ÊÖ
}=šoLHÜ9€ WÞÞSi—å‡Ï_¨²±×;Æ^öèèÆ¡{RQþŽÊ‡Oȱ樄ÚkûÏ3:xüÆýofö vUgb°ÿ~9+¿žïÜÒ×ÈÈÒ’®ü”ÂñJ†Rø'Êm‚‡¿ééÁBcuÕøó»"lïé9_Yš-ìô;½°:qGs'ÕcC7fõº-…´F«<Ö°ÎØRe/ÆV« -I*êåz×n–žz.ëFM%ÈãÄÌŠÜR&õy -Ö ‰ãLÆ2ŸiôçA!]uÙ_Ù6d[¼…Ê¥»!‚–óT<W>el]~Z¸<×ØîÐ0àE¥ZÄ,MOÒFo‚Á¢Ã“i°ÆÝ¥‘5$Ø€‡¹JaÙÓ ¬ÆuŒ¤<S|‡G]Ò*ýptÛºnaô÷·W?\ûyWsfçaàŽ1¬š.X#$ZÊ¿ì’ g.°fùeïøËù€¿ -`³râ ìD :/<ntû0!¶W
ïyU ®éÝIËP lŒJ3Ú>å(RµÀ`<hÆ=P¸?ndxì9#ÖŸÕtäœS’kwjAþl[/ -åÁÔ5ò"?}mÚCã`æÙZ\ŽgðíþÍ·öôÅ
¬0|4ö
TªÐǵ ¥ÊÐ"Æäü#&ºøs 91?6‚J #ˆ%C¬2Šƒ3K ‚•ù§;I ù¬ -å./:šÀ™:ýe"ÜÙfisù€kÌRØXn¡Cã*Ü+%h™ -hpFTIwÜdŸ²(!O³kojŽáJÕ^:ßÌš mK9ˆáã
JiŸ6VTðËÒ•}Ú± ‡Ú— ,KZ<69?‰^4%/ŠPê(ÇGè%£çÊ î`ñW=äåÛ —(R2êBQØjtKM3×ã,‰3)ÏK&üøø
Þn¯5h³—ð0 TÕ³)÷»Ž>dvRÈœ2Øø±â²{q‡SÒ¶‹Á‡ŽÙeàƒ¿AGæe'áðQ}†ùkÝ>ŽÞ¥ Š]C±|lÀþfV˜¾œãF¢cÍ•ÏæÓMˆtÅkÏ벘«` ‹¢Izl=*›x5„ -±,.¶ ´Œfë Rã‡#ÅLœb‚ “n¾òüX¦q‚W®3™0 oçþðÛäãÃí$ƒ¦åëçÆ ÞxªY‰ž 4¸WÌ3Äÿ%õU¡endstream +1207 0 obj << +/Length 3814 +/Filter /FlateDecode +>> +stream +xÚ]sÛ6òÝ¿BoGÏD,@$0÷ä&N΋sç¸s½iû@K”Í Eª"Õ÷ëo» H‘’Òiã™ +òÛÕÏ¿ŠÙ–ýÕ•5z¶‡ "”ÖF³õU¬U¨c¥üHyõùêß ÂÞ¬ûtrÿ¤#•D©Þjkõ,Õ6LLá>¾ä¸ +
²jOˆ*ÁÌ{@$¨rJÓinóÅnÛà*ŽÈZ*¥gÉz˜1ÙþñH‡‘‰dïVtŽ±éÚPá•ã6l|Ô2
Š Àý «pŸ-t°‘Á»ûÏôû·]îκ[<À š¶!(áÕ3&ΊàQL]§É· Àôɾ(K¦Ô‚”mZvòƒKn3‚’$ûzû…Ž]£9JÍðà=sup5"&´BÁòš½ã +S)† ´i0Û¡ìV +ýeíä¦Aëøƒ’PgËWšùRÕû#®˜U0ê°¡‘T¨
¸lá×KÞ…÷12Ì-+üÎúÃ+0 Ù +îë–©´/™#‘ÂFµmQ=O˜1pBo‹¶½c +&$Hi ÊH«#ÛQ +¿êM¾ÍZ2+‘²A³÷8¡Ž"Ä=÷Ÿ ïÞÿ—úÙrɲΓe]ÙmÜ‚¤>ç9Ãa +öb^,盺.G†Q@Ø R=ë£ F5¦ §5„Å…È?RšúÝ¥9¤ë4öÔÔeÞN¹Ø¶X'¦Gɉ@Vî³×Æ÷Ëzyÿôa;tïÞñX/€À¨Á9é²â8 ¼t, 3§Â@>Ožc’Y@±hFæß$2=K½“ ú+ P³>ùyS:ùGó¦Ä§'º—ãè.ljƒE]–ü ˆ_²‹q`€c;‹¡ µœöh·G
áøEh±«J +f/R +ækº¾™‚>y¡ØƒíJ °…‹‰E÷Ûð*9ÄØÖmZF<ŽôQiÁU:td ¬t¸ÝÖ X˜i ˜C€öiLµ\Ð×HtJºbƶs]ôjã‹Bø ËP\îÖƒ}Zs¯¦9G@ù(s,a‘ÄnJ¾CŸ*!E ¶·´AsÆ7‘|¿KtßR©.ÂNº{*$‰…EßàüÍmŸÙ»>|˜ˆúð§+ˆ ¦‹ƒÙÅz¬„°ÍŒ ŽVà©Á±õ)Œ-Ž‡ºÀÈÛd`æͧJÁÁ$ZŸ·±}¨ÓF¶ƒê\ßï`ó‹RÕÈœ'ìÆ„^Ï&XÚ”CÂäôTz¨ía¿;íôl*Ùwz‰M]MF¼Ö;BPå®8›RÛeÑdO(ìøãî§÷Ã錚M¶IÞ•Ù–‚çðCw#;Þ`uVJøÅhY_0 +0œq{ÿH[´ï>}¦ÎÚ]ñÐ¥ îÜ‹PØ7Ô>ÕX&Ç s ½Sç/S*@~ãùWS JN£Þùûå,ýz¾ã%èSl€©´Kh¿U +‡+éKá_´'¶1õq™¡Ê÷eQù:^Ö ïq½o±È7pÒoü ÃòÈ)MU ‹çªæûñÓ¶œc¢ÕSz +vj»8×ÈÃû²¥–˜€MÝ4…++âpþû&¯žrG5b#ê¬ôÄ1xÍåw)ué ì)”à ?¯DDÁÚMÞ© ÝÕ‘`bÙÕ +¿ˆ£·L80zÊ‚ƒèEnøZŸnà y;üÅ:u¼õ‘ÀÌþRm°€SÈ•ñÕ÷D endobj -1200 0 obj << +1206 0 obj << /Type /Page -/Contents 1201 0 R -/Resources 1199 0 R +/Contents 1207 0 R +/Resources 1205 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1176 0 R -/Annots [ 1203 0 R 1204 0 R 1205 0 R 1206 0 R 1207 0 R ] +/Parent 1182 0 R +/Annots [ 1209 0 R 1210 0 R 1211 0 R 1212 0 R 1213 0 R ] >> endobj -1203 0 obj << +1209 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [80.6033 508.2814 154.2566 517.4968] +/Rect [80.6033 407.9328 154.2566 417.1482] /Subtype /Link /A << /S /GoTo /D (statsfile) >> >> endobj -1204 0 obj << +1210 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [265.4578 462.9269 326.6578 474.9865] +/Rect [265.4578 363.0047 326.6578 375.0643] /Subtype /Link /A << /S /GoTo /D (server_statement_definition_and_usage) >> >> endobj -1205 0 obj << +1211 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [367.5441 462.9269 416.2908 474.9865] +/Rect [367.5441 363.0047 416.2908 375.0643] /Subtype /Link /A << /S /GoTo /D (incremental_zone_transfers) >> >> endobj -1206 0 obj << +1212 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [280.9692 432.1776 342.1692 444.2372] +/Rect [280.9692 332.6817 342.1692 344.7414] /Subtype /Link /A << /S /GoTo /D (server_statement_definition_and_usage) >> >> endobj -1207 0 obj << +1213 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [277.6219 401.4283 338.8219 413.4879] +/Rect [277.6219 302.3588 338.8219 314.4184] /Subtype /Link /A << /S /GoTo /D (server_statement_definition_and_usage) >> >> endobj -1202 0 obj << -/D [1200 0 R /XYZ 56.6929 794.5015 null] +1208 0 obj << +/D [1206 0 R /XYZ 56.6929 794.5015 null] >> endobj -1199 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F21 654 0 R /F48 880 0 R /F62 990 0 R /F47 874 0 R /F14 681 0 R /F39 858 0 R >> -/XObject << /Im2 979 0 R >> +1205 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F48 885 0 R /F62 995 0 R /F47 879 0 R /F14 685 0 R /F39 863 0 R >> +/XObject << /Im2 984 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1211 0 obj << -/Length 3636 -/Filter /FlateDecode ->> -stream -xÚMw¤6òî_áÛâ÷Òôè8q<Yç%“YçåÉíf‡† ö8¿~«T%0ng6y}h©T’J¥úáy -'æH†ÂO ´Rà</û²©Ój³m›ýÆîãéSk¶çÏno—Z…LàVÝÀŒt‡"+?(r …U{×u×ilQhEg'p ¢;4uNCx~»ÔíBZع™ýŽÀ¥|üpõ½Op²|vâ®*^Œô€Y:t«"HªÖ„ù
÷°g;Ó‘@asÆ{,xoÍÒÔàñÆñáhnJ¶djò˜M5àÍÌHÊÀPúÏÜ ˜;
ž9’<ŒÖÝ=#m¦XäÂw?b!cöiŸí6ûôp(ò
HL TÀ%,ÈAàG‰2§é±V™ -š´ E‘œSr½%™TÉÌÃúB:~"–N8ö_M8¨˜‰B†[ך%бwýþAñ9i - -Ž$¹®”ˆ`Ί RtbxCgƒPþYP.D6ŠM q‰Ó`ᮬ)49N<®ÈˆpÄŠqÒšÌ^3²p´pœø˜ãnÇj‘Y9]_]¸„‰ˆ…ÿbhÚ´-]Ñ U,³V{N¦SvLnàôÁ–¡è^¹ÄôŒ×® Õû+ÙôBÙ_
¾Ù$>dÚÊùf[ô&æ°²[ÙPk_ í’ Ö‹ç KéKE§ÿ|©‚'ŒCNr%|ˆ|H‡em²á襽nÃÞAd`:êTÅCQqûqWZëMØŸ¶HúzóÛÿjÆÆ~ &ÚÝ>ÛÕB R¶‘ôu˜W™,|#"·KÓ®ñ8ô“H«×x¬ýXJÆY³=« 0y±¥È0 ½£a)?ÒÚœŽ†§X/GÃ#–åÀPõåæȇYð«$äóIrz÷keûYð«?Šƒp¾?tÀvŒH•C˜µ—Ð R9¶žšpv6òC=ár={–Ž¨QºÙßhª\ÑB¦YÆú£6ÝÊÄ… -—IÍܼ å ت4Û¹ÅpL³^å -Gêa©ŒIE³<´ŽGNiw©ePP¼jÍu±MábÇG•âP"ý%x²ZÔtÄÊËúÀ•B¾õŠ~M°Nè—òRQƒ4e\5y®`òÀDÞ~ÄZÙvTðÁ+žpUs,$Þ÷ï>|¸ºÄ6^àb{°= -ö -ÖÍÿ 6N?HÔ?`âЉqãi <"@Fš\ EµHË–^6çU4ðøaDzNļ†fü(€Ñ)oìöXÁ=KÃøè-ñç¾Nû};!ñÓ;ŒBvRnŸ¨j.'â íùD”Wíj¥0:Þ vVïn©@ë<Nø;wÆ14”>}‰S¬—oqÄ í[+Æ Ë›ƒ ! -“0å\CÉ…+Š¼p«V ²
‡‹ JE c¨ߌ/„õâÐ^“ÓO>È!³m÷.•lÑs¶ --ת äzj –íÓÜŠ;о2á1ªÒÃH p&Ž^/C9ÆGÿåi[¯má¸_ã'”Ó£/½DÂA„eÐáOÝã\xìW“‚ëÄt±ðPçS ƒµ>Vˆš–ÅtÍžÛ¯Ù‚ÕÂÅn«‘Ú¼²¤}}´:4íêM_JO
$D<:óHWr”lL -ª;´‰7TT”®¦!
¿·)<ÀvM׳~ ûùSNð½}úEY^âø Ž€-'fÏ>B¼›·—6ZðLW6á!é%"äMyñ}“—›µÚ59¼¹³¢e â§/}ý)A ¤\³×Á:ýí/CŸÍªØ—IòBš-ƒÈOÐ -0Qx2e–”Ÿ>'ý‹í, -endstream +1217 0 obj << +/Length 3673 +/Filter /FlateDecode +>> +stream +xÚËrã6òî¯ðmåª!ðuœL<Y§’ÉìØS9$9ÐdqM‘ + Ö8_¿ÝèHJ”&³»¥Fh4ú
…×üÂë4Êôu’iat½Ú]×O0öÃUÈ8K‡´ c}÷põí;•\g"‹e|ý°•Š MÃë‡õo‹·ÿ|óááöãÍRFÁ"7Ë(ßݽÿž }ÞþòþÝÝŸ>¾¹Iôâáî—÷þxûîöãíû··7Ë0B˜/y…3ÞÝýtK >¾ùùç7 oþxøñêöÁŸe|Þ0Px?¯~û#¸^ñ¼ +„ÊÒèú +%Ò$Ô^‡Pàyõ¼l݆{³*6¯,¯3»@3á%³ê›XL‹Ìn¥"‹Ÿ*. ¯rËlÜ’® `^ÊF (žªÚ« ñ)Eæ%É”‹ƒúX¡YS£¬ŸBŸCÞTxBÛÙ™¶ÍŸÌ¬0Ý_â†NEÆ mù妩wËU¾²çÒòÌm„‰ã0tÓW]Ÿ—V³`ÆHeµSChË QoŽF&»uŒT¹åH15+&2é¦åcG"KŽ4‘VÅȺú¹ß£EÙâå¡$/Ø:lÑ~â bZ¦"¸ßÐhgXFïV1Vè)Ú! *xõ¾e ÐO\›¶ X3ÞlÙÉ•[N©æÔïÜKZdOà, +#´ª‚¯º +D„€–ñ,d<‹›¹ˆŽDèúm?/a¿nÿÉÉõTùŽ}Š' Eë<PµdªPõ^Œ= üÙ›¦p¾î 9Ïâ5ѱåÎ…µ¼Ÿói¦¬Þý1M{ó™Zöà¸bõ:¢n=Çt´ÞhUjÍ·’lÒìønåȘcíÓ÷w)u¿?Á^3 zcš&/¡¡µ8JÒâÐêš·eM +1cÜéè†Vlë™;TÝ¡˜€¨I + ¨¹g¯RuÔ·«8lj
¼–Wjâ% ìëdq_T+s„éTN²HKâ|§¼ +yèÑÈñHÈú–†˜œ”ïRaDS®ú2ï œ ¶´}bG¶Ä˜bje¬~&ëö< +¯9Tw2rœ3g+ë§'kÎ4Wð´«àéȲñ -ÿ
ŠMÅ+è¸;Á6›b 9ã>¬ «m^=^b•ó¼¾½œ]ÑuŽk«á»†l¢íˆþ|Çû H´41Ÿ5?>³<‰iýl,Óü3²Ë|‡!%Šb É ™rè.êåLŽä¬ånMßG ¼¦)4Õ
µQ~ׯ+BÃõ¬#A±¢UŠM4¶[fÌ~aZÎÝé¡XÛü1€Ô´£/‡ ja>ïMex@ ,ýÙrK&‚Þ~øÄ+T Ù™]mó6hƒwnûó §ûhg_¨¶¡ã 2  +}¯’a‚Uè™ûäèZ’ÞaÃë v¨î ©€%ýK®4Ø p_šŽê‘4® +WsB[Y#HUG’°ñ”-“8}°U(ºW®0ðÚÕ³:1“L Õš¾5 ¹æ,h»‚1׈³„£ÊvfÃ(‘Œ\®Ãzqº°RBeq<òù3µfˆ dâ^|ÈGÎD±²&9ãàXn§GºÖ,Uˆ¡SšSrû°-¬q‡&Çë§D-RBBozû_ÍØD¤‰d¢ÝíC¬] DNÂvDD¬DÙ™,E&c·KÝÌñ8i é/ñ8?-X³=)ì1w±•È0 gƒa™H§’är0<Æ: {,˾ìŠåÀ‡I쫤óizyw5³ýô]-q„Óý¹ž¶Ã×sbIVaÖ^Bƒ*åØz{ÂÙÚÀAö ûÒõìYÚÉ«e›±Oþ¼©Þ鎒4ùò£ÖÜ*|—ÑáQÙÿȼ å)ت|µs‹Ñ˜Ê²ù"Ø +„êoT9Ò¡Ê!ÓÄ–E×´—ÚRW“JÝËM’9•Úúm‘» ýîÑ Ú”êg¢‹ÿ±m¯ +¦’¾]߀±ÕÀòÌŠô°RƤ¢YîÇ#§´ÛÜ2( (\µæÚlr¸Xÿ&0SJ•HPò.½Ûñ
ÊyýBö&`V.ë×ë‚~9,+HÓŠ‹&§ +– ¦úòö kfÿÉQ#:H¦ÜV ¤éâû÷÷÷·o±u×=¸ØŽl@@{I‡Éhñ©rל² ¦™?fª†Qø•â ~Å‹oJSVí`—œ·µÿ9€~Ád®k‡2Î/™àSTMÅn8 ÈZPçkÄKk¡Ó8þŠs•¯0áˆÃì²|±ÎË—ÇÉ×K^ë܆ÙÇ2GBÆIv™5CÃô¸:SS"œŒáK‡“1l¨²ý‚¿NÌ¢T-Þ×™ñ®¶” gŽ±'jtDWœˆ(ž“é…w‚в¥fWŸbØ·ðÀéå/áREMMü™" Ö~”>ŠH YÎ {ëæÿ '!MõÿÁÄ…Ó„Äù²Ž°.ˆ ÃÝ
¶KÈ‹†Þ6§u4ü÷C¤.“á±fè˜ÖÑ20:!ä¥ +vÀ 1´§Qj#W0…QƒØ™½Áe´±G9Ïß¹I+,î PG¹ÏõG!/¾í‚ŒÒ¯ýï†a£:uÀ/}YŸ#óéŒû2wYW×å«çóRp R…_¨ÐŽÎ ”CÂsÛg_Œ]ŽEò• ˆôÅm=Òé¾Ó¿ó"Kãd²1ÿa…ªH TÒÆ¿~ðK4±F×¥&³úZ•Z´]Þø:G^Z{öã,Ä°ñNú€ðè!ø†NÆ 9:ˆÆlP; UpÿÆ¢ñ¡ö&\¬– ·‚(j Y5~ÈýÆ¿TVGo–îôôg '/ŒN×b7;WSlñu² + ×Ù1åþ¢§¤ÿðDÂendstream endobj -1210 0 obj << +1216 0 obj << /Type /Page -/Contents 1211 0 R -/Resources 1209 0 R +/Contents 1217 0 R +/Resources 1215 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1213 0 R +/Parent 1219 0 R >> endobj -1212 0 obj << -/D [1210 0 R /XYZ 85.0394 794.5015 null] +1218 0 obj << +/D [1216 0 R /XYZ 85.0394 794.5015 null] >> endobj -1209 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F21 654 0 R /F48 880 0 R >> +1215 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F21 658 0 R /F48 885 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1216 0 obj << -/Length 3228 -/Filter /FlateDecode ->> -stream -xÚÅZYsã6~÷¯ÐÛÊU#,‚$ •Ï¬“ŒÇ+;{T’ŽDY¬‘IG¤Æq~}ºÑ
%ïÔnÕ–«L°Ñ@7Ð?4¤&þÔÄÆ"vÚM +•, /ääú>\(晦YŸë»û‹¿¾7ÉÄ ëxr¿îÍ• -™¦jr¿úy -.a9}ûéæýõ‡ŸóË$šÞ_º¹œi+§ï¯¼¢Ö‡ÅüãÇùâr¦R«¦oÿ6¿½¿ZPWÌs|w}óŽ(Ž '&]\½¿Z\ݼ½ºüõþû‹«ûv-ýõ*ip!¿]üü«œ¬`Ùß_Ha\j'Ïð"…rNO /"k„Œ ”íÅÝÅßÛ {½~èèþ))´‰õÈjÕÛÀT ëœ$Ö‰Øhã7p¹É—_feö˜×¸bzCb)“¤ y³§§m|3ä´©à)Ý´ÙäD¨žË|G4šŽ¨k"ÍßÐû|>§FV®¨ç㿈°»Té4_Vþ¹ªÁ$ÚÅÓë†Ù·5 <¯ÅªzÌŠ—2™‘öÉd¦”pÖj¿ÖÍÈd -|ðŒi0ïÈÐøoN}¨?vÝܽ!Âݧ9Qü‚ @Âñ¢Äùxv¿ -ÌYÃ
QŠšÞ3z¥™¿æ»š§ßVÕ—ýKX-£×MU7A’œþ"<¯K^ .ˆ" …±w}3›¿{·óÅí¥ÓäWH¾[Qª]×s}s’•8ŠW%¥â °Išœˆ/bšõ¹ŽÃ+Ä~ËÕ…×ã©•éyÁiDp?H•ŒDj@—ä·(wÀ /4¿ÓðB»
wð :ÑÀEólWóˆªÏ¸n'brFë[~]ˆ±Æ0ÊMïƒÄU¾ÎöÛ†^ŠnvÊ;ý½4V -'!RâyÎvåHvÒFèH'ÌÄÒ>ù¥úø7.&¢ad<Uu]|Þæä _³íÞ'hg 1Çú¤VDQ±¤uVlGÔQ‰p©L˜ Ž'RN›æ) Êj— Ø@ûve§Ü6r"2Ö¾â¶=®3n¸:·}.¶«e¶[ ŠW:‘TçŦñƒM3 -l¤üûwM«§¦¨JjÚ¾ö™Ê°eÉÎ͵{h”U9kòÝcQf[¢ðzÚôldÄÎI“²Äõ¹ñ3r-P6Iu:ô¬vn`×ìáð̶± Aû9{¹TÓš_ =8p(FàÝ«º#ïwû6«k^><÷å -rqCŸT b ýå1k–›¢|ª=T»¢Ù<’ -4½¯`ß¡kà+dsmµˆ•uÃïmºÅod½ç¤’ÑÓlõÉðµ©ßWî|øö¹N‡oËÕ…oQ6ùX÷å8~0Òž— ˜FäãÀg›¡·ùöÖ{•Ä„ëýYLÈVDCO V§¥gñª×Ôåã žÁ…°?¸Z³pt£T@/@õ_8 &tÝ-.þƒC8q „ð!²š£ú >c4A6 ÷¾tD@çSÓ;<îÎÉqäèì„#MP [[ô$ q$ctŠü÷¢æ¡äÒ0r•oóéF¢¹
DØ÷>a¦„cuÊÀ a»<õH0rTåö…º‹rÆ6rÀ|5OØ!јLEH3ñ;¶ò«}3«Öí4Ioš<HùæEŽÕÌO‹C9Ia ÓÊ - “["à
5¸^ìVË -.•˜àR@ô.ÏKÁ°îåO ²_µÝäW(±"ò‘_Yuˆœÿß~G7™Æñ+~Õã:ãW«çWpÜDÈ}èU*Jj}^|Ë5"àW°V™;TàŸdõ(ž>$#è %Üñg¹~C}\lƒV ->(ç‹Hë\
ßú®Flh-ìavïpHG‡{!šw7lxóc§w7OáÑ=[k§ÈÖH¶ö ˜DBEJ
?1£àà@ßš¶¬Æ¬¯´ÌkÖ‡ï8L¥Ï¿ÇtÚöÉŸqžVp‚#X?ûR9Æ%€%bw^|Ët,èæ -…ÅçvvÏæ«+Ølñ† ôBÒY -¢²X„w»¬NÅ„Mö5 «
-ÆȧÏ.—T@Ó|áªS¾pÂu‰KÍÜI€¨Ÿ÷
1<õ¦?$ñ·œÔ»NäñÛTø’PÃÕ2J,_|¡ €îU¤Ù{Î\Õr 2NZ•c您 Åž£YÉ÷ XmÞËÍ|¢ ž¦(ö{Ø* Ä~ýiUå‡ì~³ÐYY?·Ó3*+ è}øäSE‘0Ú½rãÚç:ýÉl¹üå EúÑ…+œµµç妹ý|áRH\q:”Ë7"N·WV -‚IX)\Ý!]‘#w¬úŸÈYendstream +1222 0 obj << +/Length 3453 +/Filter /FlateDecode +>> +stream +xÚÅZYs#7~÷¯ðÛÊUã/>*3žY'Wvö¨$m©euÔí¨[vœ_ € +˜âЊÈhÓXY«1+{.´òb-¾L‹t›UÃ+ +@ßî°Â®é¦#]i˜§6ñ÷뼺€ÉÙIùTçeeXOÛWÙ’(uI”Ý…J&YUïòEÍ-댚ët—.êlGô*«‰žK*T¯EþFåŠ;e»:ÍYì²ÜRÈ"¤M–%HD¬ƒ +û*}„Át,')i“‚ëÉ +4%™ì] êÈLVÎœ@Þdé†h벪9À±Åe¤oÑÁ ‰RÁQÁ-ÙŽ
•Žµoþá ‘a¸gÁŒÜd&‰V,”ß–Ë|ÚKÅf•Ú¯êÃ+ïNn((¾3bVÙ·É »ŒI›Øûyúô´qÉC+Ê·ZZ^Q ”/¦9¤yË)J£Hš]R}6›Q&-ŸþMöTÎHøº¶ÑäºföMÅOkÁÚy×¾—Ë|Ú–ñÄeré(æïi¯Ç?3jsÛ +™<]Àš¶ºÝ I•èP•˜U‰&·÷óQc.ò²Î×L|ø%ªY, ¡Aˆ˜Ë|‘ÖÎ¥ sZsCMÜu±žR•F~† ÄÃoÊòËþ‰%¬ˆ–RÕ1¿œÖ%+†¢åÃ5C÷¾¾™ÎÞ¿Ÿ‹ÙüöÂjr/$ßFC’‹nnº¾¹Ç\$ ã£HZØÁMrDu¹Žƒ¨†«
³íoCÁÖŠ$”ÉiÁžiDpo—“€ +gbCñ¿}o"ÄZ–î*îQvWÍ@LNéçú–«Ë%cŒ£,§_hêä~C>Eà &+ +P9@µ‰Eûtð:ŠYT l`l zÂ^Qg,k_¢ól¬54õ|ŃK-"Úþ¢“Ñ ˜öœTRúÁ´¦> ¾R‰DñáÛá:¾ž«
ß¼¨³GXÝ×Ãø…ƒ¹ OË÷L#òûñ+…N"ÓWà6ÛmWIL¸ÎŸà„tI4ô*µZ:§zEM.îá×»¶{ÂUã, m/åá Pݧ=䄦»ùENþÉ!œˆ(‰!<„Vp8VÝÏM˜
ÈŽè¼3*Òù^!ì‘+bÏÑÑ O¯8– 7ûŒz È "û-¯¸+¹´ÁÓ kÔDsˆ` :U&„gu +¦Háˆqø±‰#8U¬ {@>‰hcò»›Ù§«;¾IQ&‚ÃGbú®zÔ™è’g ÊÇFÄ‘6_‡ä8•IPùÞír wª†«]°j÷|Ò«NË÷L#òG|Êô8âS&H¾Æ¥`U×¥¢„]*²Þ¥€ä]*6Þ¥€HwaIߥ [»DcùˆìWM3ùJ,‰|àW¡"çÿ·_è¦;íV-Ó ¯b¦ŽSÁYñöÁJ"”Ôú¤ì†éPxÿÅ™˜°'ý_´ÞA4y"0F ?ˆ{ˆ+à
¹º¤6¾nƒ’‡ÉA“9€è'ãȼGÙáBe ص]K` ßp"8F©äkpýñ5”ÐEFol8]®«è¹ VÊvå´(§U™Nëzs¦µƒÐœV áÑ ¿”1l$QÜW×RyøWïá`Ç.·@M÷õÏqi?ó}hàkjøº„$Àèî5‘ðë>Û5÷«”6Í_°Þßÿ@‚AþN8!êPX «Ñ‡N* oÚixŠ¿ßk +üœõTp¢¤‹ +À…ý7B +þ@’Ò]r +äÝ—ŠŠtµeÐÛ»»P¤Òë –X*~iâŸ8Jfüc-– ¸^P¨É²3ºcs—+Xl@‡ëôJÒY +w¢[± +GF|‰”Ç=¾¡-†©lçÐV´Ž©Ä_Ò(Úø¢æ endobj -1215 0 obj << +1221 0 obj << /Type /Page -/Contents 1216 0 R -/Resources 1214 0 R +/Contents 1222 0 R +/Resources 1220 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1213 0 R +/Parent 1219 0 R >> endobj -1217 0 obj << -/D [1215 0 R /XYZ 56.6929 794.5015 null] +1223 0 obj << +/D [1221 0 R /XYZ 56.6929 794.5015 null] >> endobj -350 0 obj << -/D [1215 0 R /XYZ 56.6929 254.6581 null] +354 0 obj << +/D [1221 0 R /XYZ 56.6929 183.6365 null] >> endobj -1218 0 obj << -/D [1215 0 R /XYZ 56.6929 227.9662 null] +1224 0 obj << +/D [1221 0 R /XYZ 56.6929 158.6249 null] >> endobj -1214 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R >> +1220 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1221 0 obj << -/Length 3193 -/Filter /FlateDecode ->> -stream -xÚ¥]oã6ò=¿Âou€•ÊoRèÓv7ÛKqM÷vs‡¶Š$ÂÚRjÙä÷ßo†CÊÔ‡^‹ -vÀ…tÚš–·Íæå[¼Ï]WFäFJ² R ¦ÂÀ$Þ„õ;z6íž /(Ã\yXÓUÕØj¤q¨äba¥Îàê/Mî 4ø”(|Ÿ¥ ¦ -?Ýùø\P}¢Ë¹c‚”ð2³‚&v×c½BÆt7$#Ÿ¹ªL*‘[Î%ŒŠ\¸ÂxT$’›\‚›bŒ-ß ÊMÖíËÕâásµ-ïf.”Î6šÓ>éB)
\,¼äKXëßéæ*zµ]㬺KÐ W{cAà¦ÕñZܵ»=Í þ#ü¹Ý}I÷oÍšÞŸðlºÛTÛp -Z(>i»rõXÞÕ›m7[ yè,fìbÓKÅ[3êÛáéÉÓô“U
„ñõǯj¨Ï -¼ š
Þ¿¿P°øœ;TÕA â
´
&¼&òA«-Ú]U51tvxSëv¾j·[¯Yø²!ÁÁèW¦Y•?Ì9op×¹±àæ‰A¼Ú°<S3âP<·Nò€
ûòùˆ ÁñßsA…ˆð6Ä»¶ÙïÚ͹h`ý ý"%Hz*¨8¢Šã˜ò ˜½ “AŸ÷»zµ÷< ò;r’¥ÇÍ®?ÒDâhÂûè#fˆÕïØœ²=$å¥ÛW[LÈ@?O³åT®d!Z@,wÚ½’=ôøYº`&lOö f@(eÎÇôôéxºý™¤ý<1h --îwO ¬Ì<ûÜbÄ6bÈ~rIoFp]Ý—‡MˆŸõ(Ê>QÚ~Œ:½òcb Ð’´7Ô˜!ù¦EÛA Fš¿ébF*Š¶rÚ
,ŠB¾â†¬3n(b Õ "ÏnÆ Î;®Î ÞcÍœ>ôB:8þÁñC/tÔaˆø½B3ë½À^ÈQ®éÝ´±iRî^hêýÍgš¢ø -Š;›Æ§™>µÉeÄŒv¹àF¤Þ@Do@VçÀ·0Îgº3pÍ -¥ÆÞ -ˆÐ…ñg/~_pohí +{fBð€o¯·bñ¾–)Wqç,ÝÚ³e J‰ÂA½.™Ì
ãGwÉ¡ÀöJ‰…Ãò%[•«KDíKN¬ æñìµJ׆6¡ê‰Pêâó˜jba +ŒtÔbd^Áöšè–* J‘ÀRz{M!¤ƒ- 9ÿ±þ×Ôî ÇI°‘Üj}. !T - þl<ê±F~7#QMz<˜ÄêdÙ|'`ÍÐ0ìñÈ\[HOD {<²Ïq¢“¾!?F%¨VB/ ª}˜mºçÐCä‰ÇÁ7ÊYaàÙÅ b´D¯7õ»’AM¬Œž†¨,æÆ€lí(ÙéÅ8Ž6‡ çREW<øYÅC·_…¦È”ÞÚh; fW».äê£ã@ÒÖ±btÜ¡/Ÿë{:ÎE¿®ä²Å^åsÝÍÆ ¦ðâø ×6·ªoÁüßGƒ`”PºwÖfã¶Jf†€¡ 4lÚU¹iª}÷](Bñ U뻹’Ë 32i™ # 2r2s |8·î|æ˜b±ÔˆuâÆv -¥Ä+çG¤™óVj Òe -0€|ry~hÈ| ëF±ó¨,¦º* -x_WÍ AŽG8)(l,(L - ÒË›v_tÿè*¶ƒ¯ -žs-ä
xU³£QHãa3zÍúÞÆ_þîìøQž²æ¿°„ƉÂF¢ }ú±)éÿS–êRendstream +1227 0 obj << +/Length 3161 +/Filter /FlateDecode +>> +stream +xÚ¥]sÛ6òÝ¿Bo•g*ß +ò÷Å ñÙ +ŽýÛg*ófö /œ‰,“³Í…6ŠT‚TŸ.þÕmØ›
K§äg”gÆK7!@©z ÆÚΜɘU0…l 8‘7ó¦Ø})v8Öó粪 +Ó[Uuý™f×õ®›¤A¾mž‹K1ð²mŠj
¢ÔBϯ×($¸Ë¬ÇŠ†9é28 +j@P8[®ñ k’N±m oh("kçA&0ù˜)†ç£x“{>Þ’¼Kßè´cÎðä]¢µÑrô?á}îšvÂ/yɬWÍ£H™ƒPñc\¿£ç¶niÐ; ò8W ×4E1¶se=:9³ ”ÔM˜&w3ÜöL¾Ã_ô Ûüñ¾Áæ‹%ªO +¥’I5fHË 37`èÈótX¯°q¼²Á&®j¡ÀC;!ÀšåI™‘Ia™‚ðÍ9Ÿ¿ÛçÕ¢ióåg:ç
š‰ ¥ØÂ3Ú¦¿N)KQãDCïtq½SS +Œºé¡® ¶‚À*G…è%ë]K3¨þ®wŸûû×ûíŠÞŸB$EÐ}Ul"4P|Òvùò1¿/«M7[í#{)¦Ì¾ê„ŒÕmÿôxŠêIƒ¢„
âøúã=Tg€Ød ô$׃Ǻ‰{m€·r[œŒ—Æ8¸÷J¼ìcŽ— žqÕ]ã¢9Üü nZq>3çyè°&˜DNZk¹ r1ˆœJ›(¥í|›o%ŠÏQE¬ A0å<ÃÅÐ|¾\6Aƒ.쾦Y/-l Ô &Ã…8ff„öCÕhw½¡* o·™Å„m¡œGWª\øGÎ ˆQ¡h?b‚4Î¥ì ç7ûpj€ÞÉA™ ¸H²ŒêKšxŒ¸‰ ÒÅóz£LG'ô¼; fxQz>æx8Í]8 BbÊ(“˜#~COT% ©yЧ˜hò.–‰þH/AÿY†Þ‰ŸÑÈq01Lðl´$ĵ@!d5ð,b$[Ƴì·Þ¸P°x&<ªê F
ZÇ8_{òA«Í#Ú}QlSälð¦V'ì|Yo6A³ð¥"ÁÁÓ°‚=Lùné¡Úpàåé€xµqùBOˆC æ¼»KÒŽ‚¿o!zO ›ž ÞÖÛvWW¯ƒn–$<RP +m^VÍPƒ ëç¡E„2rý’"[4“Á]oÚÓµŸ†šÉjãÏDz>ÖéXÖaÆJ`é#r8Žb`"Ú»W¨wXäQLƒ½X?¢?¬ÿ¤˜??–ËG Ê"´ËŒ x¦Ê'Ö‚ðŒGíc×E;Š ³tT RWàþ"(Xàþ·ÞFól CT?I¼±2¨ 9DËŒ”zèC¼ñ)¼À€¶ÄÑÒ´TÜî%ó,ëãû tU e"ò&¡Ý©LÄÑ}¤×ë] ¤u‘·c „’ŒkmãÆï‰6‰aÚtHoÀ1@Ƀá”(ÄÄá¼R”xK—
¢hB·LEbÈA൅@<É&$BÎféø]Šk^ YXëƬc&â ™‰|”q³þ!jù\áz_á{l0zôŠDCZÚoM ,ËÂñ…Ãxmåðø£S?ü :ðRŽbì%퇘Ó)?¦Å +¯ ¸“ILYší»‘\F‡1žIaeßÈä
Èê<ø.ÄDk®yà#\ <§}„—°—Î^qÃd6á"¤ç $^AÔ[zÖ`ýpš +ç°˜ y\q^n c!ı/ˆ2S¨Ç#S½^-ßj»3"{e2Ô‘y†–r,wÓ‚Ô`Gm×}Mû u{ï§Ûÿ Û·–>½ã°W ¦Ã‰;› +R;øJÐ .Pf¥v¹K$}Ó»0cµ +Ì(™nú8Y1¿ƒÿr~u$ØTIÈ.¤r,èKÆìø–eŠ°zãpÚƒà§ëœ½«áL³þ±Ò΋þÖá\vàbÀ³d ÊuÐMæœÌ:K¾P_ĺaþ²XæËK$õSî™[F³Þ7 ¨\·´ ½Ä¾w¬tñyÈ5±®NF”Ôah^Âö:R.A~¦àHýëû>P ¶Ì8äü‡¯Kߧ¯Ôu÷¡¥n!²ž‰Hpsý!äèó©Ã9Þ‰ê¨ÅDfz˦[<k‚‡a‹G1ã ?01lñ¨.9Æa K8ìµ
Å!,)Åc PÌ Š6Îâ÷³]\wp9øFI+ Âqñó¤QÝ7µÀ‡’X[s £)9dÐü¡ íÄ8Ž ó}E×":Z-b¯_ÇžÈ17ܵ5nÀÌ®XîwMLÖGä@ÒÎólDnß•ÏåšÈ]tìZÍklU>—Ídâ/N|]¼·¡»ÌÿM+¡†2Ù¸±6x°S2Á°›†t$òPÕ˼Úmós¬Bñ Uëç©’gž[Õë˜ C ädê(´b^ÈW*Ø>ÖKMX'n|`§D&_¡Ÿ&è¬ÔB©Ë1ˆõZ©=@0LVj{Écxé¬ÔÆ6¥Åñsœ&Ôp¢/Ô% aÅcìä?<&@§/Ö"ÖL›ðb”6vôÑò+ŒGƒOÖn”’b5lÕ‰“¶ªÄú ¿qÊ7xˤÉĈ^Š{’,Ɖd1νb¬Ò%þÕÉ5×æ,é.Çöœ‹a+ 2„XÇЙ,ñ„± +¨šúÛU~›µBò!•P絇tÚVÒAàû§dÜÇe dW’¥s¤;¤cÚà +¥å€ø°Æㇻ®Æãý÷Ì‘B +Àf¿ µ +Œß½lóM¹$ªð +%ì¸ð8¨‰Í¢ÆbÞWÅö… ’ +ðAN›™Åt\¼Òmî°ôc…ïyô•Ú±£OÔÒræ¥w=>ŽôµÃ9O R%ÀVzÔÇ=fvê`Ê0üÕÖuÞÕZßýã°Ã/ç´# þÜþÕËÌ%¦ð ætƒþ˜õÿØúÎÆendstream endobj -1220 0 obj << +1226 0 obj << /Type /Page -/Contents 1221 0 R -/Resources 1219 0 R +/Contents 1227 0 R +/Resources 1225 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1213 0 R -/Annots [ 1223 0 R 1226 0 R 1227 0 R ] +/Parent 1219 0 R +/Annots [ 1229 0 R 1232 0 R 1233 0 R ] >> endobj -1223 0 obj << +1229 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [367.5469 732.0757 428.747 743.9759] +/Rect [367.5469 658.7781 428.747 670.6783] /Subtype /Link /A << /S /GoTo /D (zone_statement_grammar) >> >> endobj -1226 0 obj << +1232 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [483.4431 518.4802 539.579 530.5398] +/Rect [483.4431 456.4665 539.579 468.5262] /Subtype /Link /A << /S /GoTo /D (address_match_lists) >> >> endobj -1227 0 obj << +1233 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [213.0783 118.4338 261.825 129.2182] +/Rect [213.0783 62.7905 261.825 73.5749] /Subtype /Link /A << /S /GoTo /D (dynamic_update_security) >> >> endobj -1222 0 obj << -/D [1220 0 R /XYZ 85.0394 794.5015 null] +1228 0 obj << +/D [1226 0 R /XYZ 85.0394 794.5015 null] >> endobj -354 0 obj << -/D [1220 0 R /XYZ 85.0394 713.5601 null] +358 0 obj << +/D [1226 0 R /XYZ 85.0394 642.7523 null] >> endobj -1224 0 obj << -/D [1220 0 R /XYZ 85.0394 688.3792 null] +1230 0 obj << +/D [1226 0 R /XYZ 85.0394 619.131 null] >> endobj -358 0 obj << -/D [1220 0 R /XYZ 85.0394 566.9058 null] +362 0 obj << +/D [1226 0 R /XYZ 85.0394 502.2708 null] >> endobj -1225 0 obj << -/D [1220 0 R /XYZ 85.0394 541.8843 null] +1231 0 obj << +/D [1226 0 R /XYZ 85.0394 478.809 null] >> endobj -1219 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F21 654 0 R /F63 993 0 R /F62 990 0 R /F48 880 0 R >> -/XObject << /Im2 979 0 R >> +1225 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F21 658 0 R /F63 998 0 R /F62 995 0 R >> +/XObject << /Im2 984 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1232 0 obj << -/Length 2980 +1238 0 obj << +/Length 3053 /Filter /FlateDecode >> stream -xÚ]sã6î=¿Â÷fϬ¹üÐg÷)ÝKÚtn·Û47÷ÐöA¶™X³¶äZrÒÜÍý÷–dÙ»7ífvD € -õöæ;º7Ô\¸5¨-PáÏ;», _Ëêi67FNŸ‹ÍÁ64®ÛµÝÓ°]‘ìq£L.dª3¦É|Tue=#c|¤xôš×Ôû1ºZ$I”öÉvÄ£ª„R2á%%‹phÅfóJ/ËúPµv¿ÛÏT6W‡å éLæFfL”LæJ‰<Žµ#Ñ–Ïö
,”fÚ”ÕÒ‚ÕäázêˆØfWWM¹(7eûJ C8ìVEË«ŠåÒ6
—u5SÓ–˜Ø¬Yׇ͊ÆL¸%*/e» ì¼-šÖîy¡Ý?à ›YêöˆŽÒɾTͦx¶S™ÈÒ˜¬ècìš(ÃÓnid«b±!ãˆRbÁ^6 ƒÀ/…czň -ì7i&tœy‘5^ÔŽúà:UÉÀ9/ª/—i4Àûå£÷GvÐŽßð½WÏcqØ 9\ßÈ#ƒŽ4À 3Ô³Þ'²CÞ~Ù{»Xç½7`¡è‹
äëzs’X( u -{@£«²…KiÈd¬±Ø0!“žâ—˜„œ@FpØ=&] -ö›¦YßoËjYoCEÿ{7_l Øø80î>='£¶ô/laœÆ™ÖW5½kœze:H…d6-x"äA½Ó -ß(¿œ)¨\2ȉNR¡©’øSwp 8ïP<½‚Uš‹ü>ì{6MÐø EAqüWq^æP„–*ïqx.Gˆ¡4O|ZHµ{.ý .Àc±ÿe§ƒ,8í9 †•° ]x -$)Üݱr -ÎpŽÖ»ž†RÜ3Qž sçNÜ1è·òx 7•gܳ« -öÏ~úqR2¼é62žØŠ6¡–¨9+zY[úT<è½5e¯MN†ÑI½Ø@Î/dxQÝp6l¦* [˜øÙ¯¨ÆŠ˜¯/ òT˜Èœ+ Ÿn¶?üz¶n /•ZJõÍj‘}óÍ[£ß}ÕïF«x Õƒ‘œû#ª¨3K€kÁt!Îò -u€ŠžNM8Ãߕпþ ©ÞÉè(,. ¾ìæH*ÞÇ)¡ä¾8r©ýbhGµŒùÑÃ,×ÓÚ·>Û H(”Æêwª>í=G°g{æÇ6&ø ™‘.6üçCûÓ?Ä9þJ)×Äß Œ¶Ãuš‰("Ìê)Ö§ÍþÅÎ)ëÿ£Â`˜endstream +xÚ]sã6î=¿Â÷fÏÄ\‘ú Õ}J·I››ëv›ÍÍ=´}m%ÖÔ–\KN껹ÿ~ +>™§±F¡DR¤q¬,ÿ®JûIÌŸÄjºÈé‡|,3°E(€ºfœmV7ù
,2”zúèvVùSvØ4ôRÔÈ»»Èt¦T"©XNþ3›'A0-¡÷´ü/}ÔÓ2˜ø“ûæšÈ;"CyVÖÌì:ããKf›4D» Š6'Ý( +#Uì”CÎêÄGÛ™«HO_‹ÍW†”]¾JÛ|…òéôq–ªiE8y™-6Œç†uG±@ùšk4”§ã˜žR)d¬Ë|Á¸AÂ
û—̪ÍÊ£Óìû7U‹ÂÎgbËj ƒéK¶9 Áàº3ØÓt]Ž°.à \™?vÅÃ¥®i„®Ié>ÙŽxcTA12Hø“‚E8ÔÐç‘^–Õ¡kÞÙ«©V‡%G(A3!Æ«®R›â%¿ÆK'+Ê%Þmê<l€ ºÞUe],ŠMÑ íÎ"x‹ +hc·>VÈn¶Jž:'ã +D'iŸ²}8[uõ½Ê›¬ØÑõŠ.iD¨ Š\¬ºXçëÕ†Ò—d^ K°ÝšÒT¯DˆÀ„¥/óà±F˜è•Q"Œ‰úL<®1) O« ߬_3 LÀ< ¬ñÁ&éäó°¨·Ue÷ G*™>Ñ÷[Ú½ÿ¯bHBϬ\
>°Ñ/‰…2QÔ÷¦Ÿ•ŠÊbAé
>Ùd‹|S#”Þ‰¶ž.Š2Û »8˜'M:ý*œ62)ÓQÀ\°, ó–8ÞÆÒú5÷…ǯó’ðW9…ó| iu=º +ÔÕ’ [œžH) #Õ
Øô6/[ŽJ‚+a¹Ìj[À‚i7©@QûbeˆóÜh#TlœÆÈÇj'jG}`Ðk%ýzä²úÒ@GCœ_>9dí(ñšÓôÚ' ß«´Žì“8òÈ Ö€´°†zÞ{Bî¼ì½ ¬ Þë°PôŪŒuµ9)/d E IçòÑ käìžã‰ +Ù9„¯,7Eý [ÉDÄ3°h°î±OzÊ 9Ò+tö;{ªol_‚!ÅdûÊé°±«övKîÙSåÚé
׬Fûqýê Þð¥s+¶:xÁÍQ?”ÂÆ¡¦ük ‹_tÃé í:/çU9"ùÜãö̈BÞh6=±ùÒQ(ãb]“ýJ=¸=ГÎÈ6ÔÉ¢F±á‹%i™1-Ù0í5èøôÍ6Z.¶5Ã6êÕØHCe}Bc½·æ„J¤Æ˜ñ)áÜSœwIÒ µË_¨ 6ihÛ=¥Ê’ÒÉXaËþ…L:Šo1 5AÁ÷˜´ðmœƒ•à%ùè:cÇ_tIWŒI‡ò¦RB%íèŠl®çl.‹¹ø²8àI§K¶K<|S3z •
‹ß³É¶EŽÃaLt¡¢õjtôð=ľb·uÏ@À*ýRÂh_nùzÁ)¨Û‘²¶Xì;׶æ¿g[àâzÄ‘æ&1º2óìعª ‚Z˜Þ,nØ” ¾$íá +Š»¨Gíobs("&oïdriÎ ûA4‡2Â9é ÞõóJí¦I +´žÑÀ|ƒE¡ŸoHIó
€€ñ7Åò°ÉöôNzEŒáä6—¶qƒMû «`„ô3}¨´-Tp‡‡qô½lHÉ“Ù™œ0wöÆ-ƒî(‡×qÓàŒ{vUÁþÙ/BN‡ëî8ã™hã;ŠŠk£×uN?&puÑ–“at +06³- ÞàÆôÿÙ=œ
›Zzäv‰?fåX+óåíCªE…¦oj=~º5ÿð—ü³ÝƒÿðR¡‚@~µZ˜¯¾zª÷ã'ŒýÑP üKŸ‘™"üÏÜüé?(jÿÚ*Âq”93œTÚˆÈ +µ«ÓQ,äé0Q#¬ÿ?- endstream endobj -1231 0 obj << +1237 0 obj << /Type /Page -/Contents 1232 0 R -/Resources 1230 0 R +/Contents 1238 0 R +/Resources 1236 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1213 0 R -/Annots [ 1234 0 R ] +/Parent 1219 0 R +/Annots [ 1240 0 R ] >> endobj -1234 0 obj << +1240 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [369.8158 701.0858 418.5625 713.1454] +/Rect [369.8158 645.68 418.5625 657.7397] /Subtype /Link /A << /S /GoTo /D (dynamic_update_security) >> >> endobj -1233 0 obj << -/D [1231 0 R /XYZ 56.6929 794.5015 null] +1239 0 obj << +/D [1237 0 R /XYZ 56.6929 794.5015 null] >> endobj -362 0 obj << -/D [1231 0 R /XYZ 56.6929 532.4192 null] +366 0 obj << +/D [1237 0 R /XYZ 56.6929 475.2364 null] >> endobj -1235 0 obj << -/D [1231 0 R /XYZ 56.6929 508.7234 null] +1241 0 obj << +/D [1237 0 R /XYZ 56.6929 451.0522 null] >> endobj -1230 0 obj << -/Font << /F37 743 0 R /F48 880 0 R /F23 678 0 R /F21 654 0 R /F39 858 0 R >> +1236 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F48 885 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1238 0 obj << -/Length 2534 -/Filter /FlateDecode ->> -stream -xÚÍYÝsÛ6÷_¡·Ê7%‚O‚¸<¹±s§uRGN¯í#Ñ6'©ˆ”=îÍýïÝÅ)QN:ÉÍÜxÆ°XìþöbÂáOL2ørzbf† 3™¯NøäÆ^Ÿˆ@“D¢¤OõÝìäÅ¥²Ç\*ÓÉ춷VÆx–‰ÉlñÛôÕ¿ÎÞÎ.nNiø4e§‰Iùô»«ësêqôóêÍõåÕëŸoÎNžÎ®Þ\S÷ÍÅåÅÍÅõ«‹ÓDdFÀ|V82áòê‡ j½¾9ûñdz›Ó?fߟ\̺³ôÏ+¸Âƒ|<ùí>YÀ±¿?áL¹ÌL áƒ3᜜¬N´QÌh¥bÏòäÝÉOÝ‚½Q?uL~FeÌdÒŽ Ð Ð8–*©¼ -äùQ5S–éLDû+›‘• ³Ú˜@ñ1Ö×&rö;7<SÚ”Íh ÐóTMQ¶øëí4ÕÓzU¶-Ù(‰ AéóÜËsAdWoidpÕØ»Œ O)M<ÎÕõÙùùî -$š$Úp&%ˆ{`%Á^•ž¾GUTÊk¾÷Xb\?¬/Äãµz‹eBhiŸÓÁ™Ö -°¹SeŒ·èÜ€%×+"ÜVëMùP.‹;oÉ0¬Æâ©U8µîŸzv?fwìÈq1)¨ËEò “íb€Uæ˜ÒÚ
7 ³ ÀhÁ…ˆËˆ,H5Ü2õ[ [ÖL õ>³Óy^QŒ¿pØB`Çß5Yʃ.™¥ «Í CÑâWS,‹y[VwaíbÓæeXß3’Ô²“$œš -pß}V ã<"Ž!ÜH¦XªÕ3kÑ<k…fœ±‚]¨pÀ,·;THH³€Ý ºÄ)º¹î™€p Àb”ŒPþn -£È)éæ©äÓL
8J-“ - -®±g _f[hÅÆAæ“ìr½/¶|p]*¥ýkYÈn¬LÿÆIãŒc(¢ - -ü@£±¢¦ž£ÅÀE¬ô˜…ôoùËçÿßDKSÈ´þÆIÃŒc&"!Ç˸M?a"ŠƒŒUöU=-¤é÷êÿ§í¯üŒ‰@Úȸq¤r09_6õˆÅlK©˜£´^4·ò…w Ï{RÈÔ.¿éü¡“†Œ!‹YX[yû)÷ ºÂUL¾Ž›Gÿ†¿Li¾¾y õPs'Æ“ÞH†¹9伃Š˜
±×U¨ÒÍN…SCÅæ3êbTÏÅbË} Š/«b~ŸWe³ -ß`ùªÐ2÷ †5$,‚¥åóòT -ÈWõ¶ -„õm˜Pç Ú¥½ÏÛ1ðìí‰Ò,÷k’»zæSÓ+ €@“g±÷¶^.ëGÊépV—<bjAV¨;úÀ -~ÿìßí| K -lÏÈñ:} IzDÇU!y‹“MÈfö7ÆØW:ýüÎ ÑáÖÃ8Ú1Èý‡{ŸˆWÞOÊÌW ¤Þ-ë÷ù’º°*L-‡0Š%)O¼+IÅù‘$G¡'G©Ûß9Ííj†2`–'µFè»~3»ºü•Ú+Ø!¿+šƒÔH·—?ÞUÊ“œŠ"äúEsO½ózýD-ÒFU•w*ÏCýRxE¥¢L–ûñ‘@Iy~‘ õVÙ5
ÕôQÄùƒý¾ ;]¿3b}^S-Ð×!Ö!|ùÐñé}±\‡¦×dø-ªfÅ*ÒÆ89eŽÎîgÝ2ä%Œ…G‡5ïrþÁ›ŠŸ^=P‘÷®‹T4Ž˜/1]ÂήîY¥’Û~•7¯ÆªC -GWAšÃþ$`©T½×,‡ÊPVÓ»òÁ¿a`WøÍÇjXeè|š¿þ‘Ê–ÔO£j!W ¾dK¸cl„õñM¹(è« ¾ ¥Ï´;(m!£Ïž<˘͸Ûç†ÅšBü‘C-úåÞ Ã©Q! +1244 0 obj << +/Length 2446 +/Filter /FlateDecode +>> +stream +xÚÍ]sÛFîÝ¿Bo¥nÂÍ~“›<¹±sçꤎúÐkû@Kk‹c‰TEɾôæþû‹%EI´“Žs37š—X,ÀX +O,¸¸üÇ9Þ_Ÿþøãéõø÷É'ç“N–¾¼‚+ä“_磈ýà gÊåfô/œ çähy¢bF+ÕB'ŸN~êöfÃÒ!ý•3“Ël@R
)Ð8fL¡ ËÅbœ*n_7 cl枀U±Œ Ư üš uE°U½ÞÄ(‚ÜÖ¥¨>Óàòュ¹b6[Ežø¦ñ
MþÆ
,7óˆ@À¦¬îZF€½Ù´Ëfq¶žÞû
,¯ +\ÅZ è\Þ¶lG\ÑÕ’å`ðüxÇcºÆ²LX‘ëÕ¦l…ÆãZZùi‰Gìg¯žQ yÔ Uɤ÷fVp +ÐŒk—N1h ËÐŽ9èì§_G§@H
ëP¦ 7U+Žê‰£ (ÎjßTßmh⾪ p‹ªy$\ +°¹3eLð +Q -øå~ìšùÛb»ØĘü׿ùrz±w „d¢¦Fn?#‚5`?ÊìÌkÔnÞ›híw$ C?=^Çže¦¿æm +<Aiwpí äcþ´bÚʸ“>bOŽzûìen`UàÏö½}ªrÑ$™–_Uº@Èq!"E.8‘\1«á˜ž¤Eë8ЊÃvÅAìJDå t)ª¬Ú +§Sm0íL@i¨‚{CåAÖ«ž«EŒ,FÉ6–€# +æ!õÆAÖàõåRŽÎjhÔª%œö)¡àè{ .áÄÑpŸ:!H(ôp ÝÙ
¼¨~ŠJ³èrøÜ´Ëö#€DÒ‚Þ{I¦‘ çXò¤Í¦ö8²ƒRJ ¤Êa»ÈE„ÜŽ_nj¬~pôóÙGÂŒQ
R.X¥î¾«LÞá-ë–7Hƒ {‚Ç+Š?7Èä6£XŽ!ò*lù(Á‹Õj’.œ««Åçˆ^$ð‚€Ã=0‚|`˜¢¼xDÄ…ü 7ˆåÏa†yH–'Á0gW¾ãD4»{ÁìÐ !ï€cì»Â˼ ýØ8¨}Ò]—áž!6Wö›Ð‚˜d3iÿ‚¤íŠ§âˆ„‹ØeÆ~!Ž(Xdß4Ž(Hèd®þq¤Où™8¢¤`R;XþT/Šh€˜5å<[`‚†TôÀÀG p£5A°,¤Q¨rqÐlW=Ç ¿¡@e.ÖV·rØ¡^øÒÅ +|A¯èv4õ]þ ÿ°aÜô)éŸòË çÿßE³j¿ i\ñ”‹€I1¶ò¼ŒeVÉoé"XjYéÄ·w‘>åg\D +…GC –OÞSP.M=p‹jª¶JÙ@ÑÜb”÷á}þ*…ŠAí*œ.Åß¿¥¡fÈÛ: ¼¼ýÒý ¶ÂU[~=í ý~™Ñ|{÷èÛ!Rv¸ìmÑöïxÌncO,‹=±ÖUìÓMÆBˆ$œ_EgŒ¾$`»e^ÄöËÒOçEU6ËøŽVè -ŠÔ°‹„m0 Q1-Ç‚æ&ôyôg`% u\ì÷— fÒ`QBùgëj¯?èËz[EDìf‡u1£]Bëz xööDmD–û]É]Gós³ñKÌ€À’'-ô¶^,êGªêpUW>bqYVì<nb«ùÏNñÝÎGÖ˜sÆ
ÄÕR 5ü…(â¤=¤§M¡E + .›’Ï nŒÉ¯túù;¤ã÷i˜ÍÌþÞgá{@îI™‡þƒÌ’»E}S,„}a…3„YlJäƒo%=”Ø Hl˜>W„µ]×PƘb·`W &—¿Ðx ;w¾‰I8„éôAÿgî+ ”œÚ"Vû¾™tZ¯>Óˆ¬Q´¦Ê;“籃)‚¡R[&Ï£ÿ„L ¤BßÈ…zTv²ÚØOŸF»~o¿ïâNWŸ†Rqb}ZS70t"v"BÑñdî«8 – O_5ÛVp}Dmã HNå€#ÙêyDC^â\ü,à°ë]N„åÕµyï|$RÑZ±X`½„À® X¥¦ÛPù® ̻ËûÅ %w±Ygp5årØ)ܵ¹tY˪ި£Žiûõò˜õÿÔ–F{endstream endobj -1237 0 obj << +1243 0 obj << /Type /Page -/Contents 1238 0 R -/Resources 1236 0 R +/Contents 1244 0 R +/Resources 1242 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1213 0 R +/Parent 1219 0 R >> endobj -1239 0 obj << -/D [1237 0 R /XYZ 85.0394 794.5015 null] +1245 0 obj << +/D [1243 0 R /XYZ 85.0394 794.5015 null] >> endobj -366 0 obj << -/D [1237 0 R /XYZ 85.0394 708.1399 null] +370 0 obj << +/D [1243 0 R /XYZ 85.0394 650.4851 null] >> endobj -1240 0 obj << -/D [1237 0 R /XYZ 85.0394 681.7727 null] +1246 0 obj << +/D [1243 0 R /XYZ 85.0394 625.2941 null] >> endobj -370 0 obj << -/D [1237 0 R /XYZ 85.0394 221.7119 null] +374 0 obj << +/D [1243 0 R /XYZ 85.0394 171.1138 null] >> endobj -1001 0 obj << -/D [1237 0 R /XYZ 85.0394 198.8068 null] +1006 0 obj << +/D [1243 0 R /XYZ 85.0394 149.3849 null] >> endobj -1236 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F23 678 0 R /F21 654 0 R /F62 990 0 R /F63 993 0 R >> -/XObject << /Im2 979 0 R >> +1242 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F21 658 0 R /F62 995 0 R /F63 998 0 R >> +/XObject << /Im2 984 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1243 0 obj << -/Length 3560 -/Filter /FlateDecode ->> -stream -xÚÝZÝoã6Ï_‘·:ÀšÇOI|Ün³½×íÞ6Å×öA¶•DX[r-9ÙÜ_3œ¡,ɲ“½;à€Â¢È9 þæ“V—~êÒ%"ñÚ_¦Þ -'•»\n.äå=Œ}¡˜f ‰æ}ªoo/þòÞ¤—^øD'—·w½¹2!³L]Þ®~%B‹+˜AÎÞýôáýÍ÷¿|z{•ÚÙíÍO ®æÚÉÙû›¿]SëûOoüñí§«¹Êœš½ûë۷ןh(á9¾½ùð õxzœ˜ôÓõûëO× Þ]_ý~ûÃÅõm·—þ~•4¸‘?.~ý]^®`Û?\Ha|æ.ŸàE -å½¾Ü\Xg„³ÆÄžõÅÏï&ì†O§äg]&œ¶ÉåÜX‘ÁúÓRV"U -ˆRçEb´é¤¬Õ””#Jy“™·»¼jîŠÝ•Êfó¶Üó²o_9)\vÙ_ሦ™`ÃôØPÎ —(3äã¦ZÔûju57™ý«® -jEÖ|5³ÝU6ÛWUYÝÓðº®îo"}È«Ø*jmò꙾ܔվ-¸û©\¯©µˆë»M9ÇMûxU)ìG ïœüUy[¬ -[‹¸T P «ôPêÏeÀ?zR=ª3ŠT§Õ$¤Œ0Ö¿ÀJG5ÁËÐ\eÂ9bæ -"9qE‘ÙÃÞ¥ -Û¥îm¤kŠe]‚ lA -M.©[ Ï ûò±¨h X¬L¤Ž¥‰ãž «šÖ&ë–ÈÙ „e x½¸k ‡]OémŸ#ÒzÀ‘m† ûªæPâ`kŽOVep´Þ™¯8Z%¡Ù?Z6?7ø™œì h~;6w6š;wdî,š;°uáµõY¥#Ímc0qØ.¼ L!¼°mÀî&F1Á·áAãë¾!Bó„4ÒL8É×ÙÀÔ¦ÙH '̉µ m+_(þô©N›“Ž*H§ -ÍýŸ ácˆç‘ôᾨ–Ü?dÓ M<Š`˜2¸… Š–:ïðŽe$@6k¡®È:U ¶[ T+4Öu¾ªkohr(L ž! ÚœT e¤Ҟ×>Õiå騆‚Ÿ*XäSyôÙå;ª‰õ‡8ñ"M]:d hU½< _¢Y-áa_Ý•¶ñT[=BrR! *„SöUIO¨iN&Tš¨¡3¤ô"œa´çᦀ4i›z_–¡” Îÿn|þ\܃&—R{Æžæ¼Ã úlm|XÎ>Ö`ã $Ø]Lõ*>…BHµ¼T/\¡ô©Î 0R
Q}Xu\’Ò™°Ö¨ó\tTl ÓG#, ùàfÿ -)y0çøÂ%j5¸f ¯1±kÁ”GØ|¿c£ÄšéqXrGQòçÉýÃkBؤi7u(rÀ;ÆLÔbg:”Ã=oÙ÷Aå ò'@¥-è|¢¢ùÖS6[ø4Mz^ÁÈWy–?ò -CXŒ£& N.ËQn5xVfü;ɸ¢|†âJ°QzÂg(ªã`ΫƒÏÐ)û ¬+·DGÞ{ÈO)=ò½%{$ª«7ýCÄ:ÄÀJïe8*ݽVˆàb]/0vÑü¯3=±¿ægNÃãÐ3|J¡ghò_g8ôÄ®¡§…„Æ$f € †-Ö•}¤Ü>ìH¸ÈÛ 6½ä¹ü[7ÄÂÿ,ÈUI*\’¼PaëS¶‘ ÕQùøòø P[È9Ò˜è¨^àBixc0ÐÒ,F]1'\ûÉ®šcQ³|µ:Ü<2¾]d›‰O6¹@MW‡`Q>>ZjݾûH
ÐâªXb9Š¯ñ¢B0FÚßU§bÑé®h©Ê”‘†óè°$Õ§Îü;ωU¯º50²Æ@4Ì…ª9fC™ ¾íWZà7ËôôfêÚ*ï.áZ _ÅÂ;ÏÎ~ùî#õ`.þfX¤ •µ}C^õ:{åïä°&| ëq¾Õ3X¬rIãûí -43v£aSwD‚··
MA…®ðé.³oè- ˜Æ ;S¿%ç¸^F /:3hFèa“à}³gai2xan q©5ß ¡y¹R¡Ìm¼fÜÝåKþæ7ír]7ó©s‚ ¥ -4–h³sæÛm‘ï¨7üuC›8÷È£À +1249 0 obj << +/Length 3623 +/Filter /FlateDecode +>> +stream +xÚÝ[Ýsã6Ï_á·sfÖ<~ˆù¸Ýf{é\w÷¶étîÚ>(¶œhjK®eošûë @}YvÒ¹›¹™N L‘ ?€ +ã=ÁƒÊ{=Û^%Ö›{6Wß_ý£°7^”Ÿ’B›TOP›ž +=D»)›È(Õó²Á_5(¿wño>±d¦D–¤)Oóïº*&ÖÒ UŸZ&jù¡ØÕá
NkçåV|*7Z¨þRì÷åª §Ãc1¹WpJ<OZïe]5ÌèÅ;'2'ý˜¤³…q0¯u ¥„·Vª ƒ0¼™‚É„²Æ÷…hÏ ßÌÒd̽4 +¥¼ºÈGKtÊÈ + U%C€Á$oeE…è +q +Ó\b‘h|oÊf4g€ÍÎË==–`ÛKž%TÉ ¹zhB i”c{j2±‰vå¹ÜZ§ÂúXF˜Dý®àùt›ßS*Ž»Vj ŽD‰5„C'%h‚G‚͇VIç dÄQDf»½Ks@0 »–uµ”»ÞÑÎ`ÛÒg ¢rÒAHpΩ$༷Ée§Ò§:ïTZª‘xqoc¢œH_Xi& xmDš€G¬~‹êÑ>‚S»¹Cõs©…´ ,\žá}´hš$É +G g‡–}äõâ®q v=e·}ŽÈêY +ŒfI:dã_!XPÞö^|\â€{ ']a‹•^zª©±‚èvÂjIicÍ›©³ËdÂù$ž^ÀÇx‚ & +’ (Ù¶õr°˜)»NzÍ4só|“Faá¨i‚+Êì`t[LÃ΃¿l:£Ë1î”°©;ñ±Öñ±–… „zâÛëBB ‹ÁR ¨éwU„Ä´br2Î@ÍüÐBü º\5bª@®P)®§tu;”ÍY}AP¬ñz†¦¡Ñ„m¡¦¾þð=õp-˜zC€€½ì!9ÁƲè÷.ÉI®è•(z[MíIƒýÿÉ+‘áE¢ÚÚ÷._þʼç
²9ª}§ÙdTJ:å]«lÄ{C9ÿîê¦)ï7L +XÍãôÃ2“8ÔÂ9õZÔ;!U{ýQòêÛº‹N³yì8”ÇK¾úÑf~ ’ dŽ_ª«·@«9îvõ R> R ²jt¦?S‚I+mò Ç›c ÿDƒœ„&e=x¢Î;°?(AÆ0{| irsâw&¦ú£ì% Kuõ”³60Ñ$cÚÔ÷à+×1ëŸFü”QL‰ßx!] Ö.%ßåIºÃ–éI5 üð—aÔ†Ôß•K*B4õš»~¼¶0´ªŸšªÊ@$Ï^È h»àš˜˜Ø=¨3K}òòîÕK»Ï„ÌdÖw¹ãsRØÌÿaŸšx¥Zîø(Þ?ñýäªà[žxÛ“ÓÏŽ§ï *¼š71˸~e¢ÁßÛÝTÒt"B¥§×«gƒÈš…Éä ¹LŸê|ðÑRõ…ÛLÝH8ÛÌWo©&– ^m&xwn‡ë +~ªl
˜Ï<dÓ—o©&Ö âÄ‹,ƒp}À@° Dõ²q|ˆ”h”†}u[àÆ'2!lõLÉÉ„p ˜6oBHzÆ„ø« ¡²ttúS’t½zx¢) YkMßçÿ¾ õ ÿõXÿ\âƒ&T{.Ÿæ\c(}±B>,jŸZ°±Òì6²z• ŸA¡òpJe©½ŒÂ>Õy¶TCÆ“¬:-Li'’ĨË\´Tl˜ÑÇ< d>C>¸ŒÙ¿6€‡®2È¥!%;wŽ\¨VƒË–ðH_‚HÆ"vÝ3å öïïÙi±:=ÍÖ+!ž‚ + -r* a1Ž8äœÄN¸Õp:°1ãç$ãºN83׃Òg†¢Z0¶A½êÎ ñ™ÕåÑÑé€=tN)=: zK*> ¨®FÜô•ˆ¤ÄÀJO‰§2 ð^+D8bm/< »hþªÅ Pì¯ù7§áq +,óv£aSk"‰__ʱ1R¹†ë|ºÍïz + +ÓÁùàÅÎÔå èpÜl#Ð3hFèa“àcsdairxaGn q©5ß¡{¹V¡Ø¤M¸lܯó%¿ó³ÖÉrS7‹áîxER<üÊé°ÍËaçÀëÃ@îÆ;ÖàNµ²„DÛcœ3ßíŠ|O½ámâÜ£`î¿LÖJT*¬J}ûí¦~ê>t™(Çe"‘z\ÆSg¾|7Vàçê J¶ñèýU|÷/I& F8óñƒÎ jtxAALá6lrêâùóùSÖÿ!Å^ßendstream endobj -1242 0 obj << +1248 0 obj << /Type /Page -/Contents 1243 0 R -/Resources 1241 0 R +/Contents 1249 0 R +/Resources 1247 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1213 0 R +/Parent 1219 0 R >> endobj -1244 0 obj << -/D [1242 0 R /XYZ 56.6929 794.5015 null] +1250 0 obj << +/D [1248 0 R /XYZ 56.6929 794.5015 null] >> endobj -1241 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R >> +1247 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1247 0 obj << -/Length 2459 +1253 0 obj << +/Length 2665 /Filter /FlateDecode >> stream -xÚåZKoÛH¾ûWð¶0ìéw7™ÄÉz0ãd=Êa13Z¢l"©ˆ”µÞ_¿Uý H‰’3HìbÀ,v«««ëñU+,¡ð%V*2™˜LE™Jæë+š<ÀÜ»+xÒÈ”ö¹~š]ýøV˜$#™æ:™-{²,¡Ö²d¶ø}òúï¯>Ì®ï¦)Wt¢É4UšN~º¹}ãG2ÿxýþöíÍ»w¯¦FNf7ïoýðÝõÛë»ëÛ××Ó”YÅà{ $œùàíÍ/מzw÷ê×__ÝMÿœý|u=ëöÒß/£7òùê÷?i²€mÿ|E‰È¬JöðB Ë2ž¬¯¤DI!âÈêê·«t{³îÓ1ûIn‰Ú$©€ hù%« -ëŒhÇW¥pšh†?+ËGAV ãCQ)£p„R'©¶Œ(-³ît¹H#™R —1E4—&1ŒH
wç{‹v¬~Ì '%Jp â‘ãý4Õl2ƒ¿|r}| (TpeC)±F0\<ùœ0Be– ÏÕ£ÝnVp?Þ¬yò¦†=%ýmEÉi_´Û—æ=¯e -¶h)hÀ8±ÂfNéßêU¾¯S“²™Â±eNažÌ«…'ŠÀ³*‹ YÔEà¯êÖÍn³©aZÒI )Ú¶¬ üKûX„Ñz·:_,¶E$-§‚N@˜¾;Psöú¸»±ðñ|Êéäþ)Úf -J‘c[ËÌ Š¤Ð_ç;Â‚È â(=¸ÿ×yvÊ3‚“)Ä UÙx>¢0,bQ#ËFÒQÇ…k·yÕ,á´˜¤Þâé“>ñJ‰Ñ ¿Â‰ ׈"¢ïa†#Å‘&3<wÌTM¾TÞ„`êoCiÂxÆB0èß Àø6`CˆTÿÍ^zñ¯y±i=ýïº -kFMPÁIs›b»¬·ëbá_wsZ$o><éÿòÇFc¡†^:;´YëÂáE.ÜH¾jÓ3ž l ü㢠‘iDáÙaR€ä3PäU‘i *Tl«¼Å¨5úp8n•C-]LÃ{¹ôO ðÀîÎ -0*Ê-ƒ›A<qŸX‡*nå·©’V-Å_Étñ‹sURâ’’ª—ª¤R–H%¿i‘TLñ JäAð…©„ -bÓŠËå(2]¨Fcpð–ÎtÒ[â´ žS=åÈ"3b V#nh¿áë¡á[¿qÃ\5r\Ý# b5Bz¼QKøåùjlp¤¼•D2ɇÉ)>^‘ AjzÉG„„Ll9 ¨AD\ÀÇj@Ò£.W¾T‘"V‘ z¼ŒñË€¦ÏuÁƒ"×iö¹ jðä5žü%e:®m~”·I«‡ê|lÐlL6¸Ž \Êf=—jüt & ¥ÌcÊ• œy*‹}DvÆ›M1/1 9‡³Ø
•AØ¢Xæ»U¾‚Ôuê!)ÄŒ¡@<¡ªG êcÑ—jØßjS€¹e -dÑx°\ÓB¦ZU^ñ"ÄQh¦‘`– +xÚÝ]oÛ8ò=¿Âo§ +{vO@" +Uï~³ÎÛ²«8³(Ò}Sí¬©TI0¼gت̼ëÉÆm•šÔX¡Ó¢} hv˜=RÓÈÝ$˜Zclߤ»·Bj²²ã8h>¼$Êèª'Em'ëOµQÔ Î§†'7ð¿H.DD¥ÐÙÄÀ;3« >ù2MRÎIÂêÁþ¶;)ø‰Ÿ.—bò¶†;Mú׊”§}Òþ^`‡=½ÐpŌ૘bÖ3ý{½ÈÁ¤À:¼ñ—ˆT§œÀ¼šPœEY¬if^¿ª[šÍj…æ©@{ÂLѶd}0ðågɬè„ù|]4ÒݹdA§ñáûæsóæ#hžÍ`óì\°ä3þ‡¾˜:PCå,8c#'ý‡þ1Ý‘t}¦» ñcš=.ÅEp¡© qí0Œ³”ù—e2UÚî^v`ñ1BvXG<ÙôÑ ¨¥1 ! Ö?á€k„‘A4Çh•Üãä&º’&_(oF —6)Ž—'6„¦J{^õâ_³bÕLñÁ{´@° ,Pð¥DˆkËbNÃMC¡ÀËæ@ÁèYøD[È$Œs'Þs‰ ÖñÇë°ð"ù¢ Àðõàú 'ùˆH#| ß"·ï3`ä5Æck‘¡b]AœÃ¡Ù=Ž_DæKoÔ0ÆD¿dñ€N1feÓ¢=V5¢‚ƒ›}o862n¹ËËE˜÷5g!r*:íMSLQÚ!vC²—9©‡ÎçÙi’´]Ü-ƒš <&µ„-˜{‰0™ÉÔ@ÌýWw “J/Ì2ñ0©áÍ8ãöEäutÆÚÿ@˜ì“>&Dg ]ëUš±ä ãN½¡Á¼Æ/&¶eó@©> +‡OÕ ø¶á~î6Ù ¡ý× +H#¬ S†)™•C^00 Ëú ‡»À„£~`–S…mcq +ÅŒ€÷yù"¶OúD+0p\üÿ÷zûý?ÝëåÒ–©ÓÙL‡uà¶ÆÊ1°QÁÀoõi &4k„…Aªg@§2ž
yøµü\Œ6ôRÛÅoºW|ØÍõaÅwlW+ÐÉ]¦ê¿!xz8&±¸©Ú!.ör©]ÆùȈ§æ†§Bc'PŠTe d Íæ&…<–3™m Æ>}Bà#¤Oý +eÕ\°ƒ2‚þc]Χjº™¯¦˜n¥!;ƒ]” ¯9¤†GÙ²æd»ø……ˆžã>ä:*„i¢¾£š +(è"”¡)º8 +aöTPÕÇý}›@€Tâ‘ôÖª|Ù¹ókõ’fu ~"è±ZîÞ»Ÿ#Bù8÷µò¬Ij´’Óg7¤HT ŠÜô… Ÿ¢ŸñÍ-ƒ-¤g)ýäíkÑ yls…Û` "©7À†›Íìa°qȸeˆóîr (š·E¨ endobj -1246 0 obj << +1252 0 obj << /Type /Page -/Contents 1247 0 R -/Resources 1245 0 R +/Contents 1253 0 R +/Resources 1251 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1250 0 R +/Parent 1256 0 R >> endobj -1248 0 obj << -/D [1246 0 R /XYZ 85.0394 794.5015 null] +1254 0 obj << +/D [1252 0 R /XYZ 85.0394 794.5015 null] >> endobj -374 0 obj << -/D [1246 0 R /XYZ 85.0394 151.4942 null] +378 0 obj << +/D [1252 0 R /XYZ 85.0394 141.2512 null] >> endobj -1249 0 obj << -/D [1246 0 R /XYZ 85.0394 123.0886 null] +1255 0 obj << +/D [1252 0 R /XYZ 85.0394 118.94 null] >> endobj -1245 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F62 990 0 R /F21 654 0 R /F63 993 0 R >> -/XObject << /Im2 979 0 R >> +1251 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F62 995 0 R /F63 998 0 R >> +/XObject << /Im2 984 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1253 0 obj << +1259 0 obj << /Length 3339 /Filter /FlateDecode >> @@ -4888,49 +4953,49 @@ G˜óÖ5óoso&¨Ï õ±únÑÞ'¦ùR €9[Ù =iyÍ¡%ÈÅ&o<ÐÖaLÂMhëœ qaþк|9út¼ "EÞže"?†xª²€ QÁk¬Á]áñBû%ÃG‡×øB©$Rd@¹/© .+±Ãßó÷Ô4]üsÅÄžT*ÎW#Ò)™ª$ÊŸ·P§±É_C ‚|姲¢uÍ©D†“â¥ÎCV™qCi‚µƒë’àõƒÅ=ëí˜XKuÙÙLç}=0ùmZíÎ:9Ä÷4lö’äŽéTôøÈìbëR3’½eÖAiÞö 4Õ„í±‡CKgÆ@/ÞýÂuU]4Ϻ`_ÒMG%ݾZL‡¾Š”)Þ©ŒÍù‚¶•x<6½Oý¾"38M¾…P±Ðâ•p=亰ëkºB8Úy X§!q¾(¿ãšP`4W™Å©tv¬ óµ¦ß}Í;¼×#C¨JC¿÷Eí¨ ŠgéáЯO~ñƒM~¦ˆ/©òÛ<æ endobj -1252 0 obj << +1258 0 obj << /Type /Page -/Contents 1253 0 R -/Resources 1251 0 R +/Contents 1259 0 R +/Resources 1257 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1250 0 R -/Annots [ 1256 0 R 1258 0 R ] +/Parent 1256 0 R +/Annots [ 1262 0 R 1264 0 R ] >> endobj -1256 0 obj << +1262 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [361.118 694.3759 409.8647 706.4356] /Subtype /Link /A << /S /GoTo /D (configuration_file_elements) >> >> endobj -1258 0 obj << +1264 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [347.1258 314.3269 404.2417 326.3865] /Subtype /Link /A << /S /GoTo /D (journal) >> >> endobj -1254 0 obj << -/D [1252 0 R /XYZ 56.6929 794.5015 null] +1260 0 obj << +/D [1258 0 R /XYZ 56.6929 794.5015 null] >> endobj -378 0 obj << -/D [1252 0 R /XYZ 56.6929 769.5949 null] +382 0 obj << +/D [1258 0 R /XYZ 56.6929 769.5949 null] >> endobj -1255 0 obj << -/D [1252 0 R /XYZ 56.6929 749.7681 null] +1261 0 obj << +/D [1258 0 R /XYZ 56.6929 749.7681 null] >> endobj -382 0 obj << -/D [1252 0 R /XYZ 56.6929 443.842 null] +386 0 obj << +/D [1258 0 R /XYZ 56.6929 443.842 null] >> endobj -1257 0 obj << -/D [1252 0 R /XYZ 56.6929 420.887 null] +1263 0 obj << +/D [1258 0 R /XYZ 56.6929 420.887 null] >> endobj -1251 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R >> +1257 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1261 0 obj << -/Length 2859 +1267 0 obj << +/Length 2860 /Filter /FlateDecode >> stream @@ -4939,39 +5004,41 @@ xÚ]sÛ¸ñÝ¿B}£g"ß'O¾œ“ú¦—¤®Û—ë=ÐeqB‘ŠHÛñÝô¿w P D)餓ñp±X,vý„Âg þñ™Õ)“¹še¹J5 ^,¯ wV½´ÄÜžÀy-|ë¶XbÑ7WÂ&W+WŽ8¡\ ´d,ÂÓÁÍÙîˇÊïäû¢)uYQB â\¨·w•‹dR%(+"©† )Ÿk.«nÑâƾ*BÜ`O ñj¶Tþ<UK¢R(¹ç±”8¨ëö9pº÷¾9LÖ¦BÙPÊxÛf2WÚ‘âW‚Öâk׃ÃS×·[‚h§¡–pw©ÙHoŠw…¯PÖÅ“|5q‡gþXŸŒv ¡åÜœw1Õéx7P¡Ú]êv}µèÎF<&Í7„¨&¤8ŒzŒgb|(° “QåáàA8 Í ÌÜ{êº}xpð©Çs¨ôsÖ c tÇÇ¥±²Ò—l_ PÄ“*Õ";¬¾½†’³à£!aûæ ¿.aëP##'lÍ6ðþîr8>رeß{)è`ì‘38"e sPÐFA½õ ¯EèoÌZ;ýZñJQÃŒ>Í‹Ö1àåÁ°bÌj ¤›K¯JBÅ&8Ü X&\’„kÚzŒÌ@Å %dG |È >B©Ç¡už‘\
džò" ߶`óÙ—’ÊsITì´ÝŸ‚C¼¾ÙˆÙÏ-è4‹Õ -œç1k§—±¡ƒ!ä–JAë·ãÔj]õf“—KÁ’ҪͶ.7%8ÀÒ#úâCd~tï*ÏR#¡[ŽOöÇ. ª×Ôä :öý;á™ÒøþÁSóóP€9ó(<—ÿ\B$í¶Ox™`·øM§|åÚ\ -[ .°áh :Bû'$D—_ ‹ Riîk".‰rh½ -E‘ Ûˇ¶™7åCá‚/èØ#_ˆÑ¤]Ð8°$ä}Ñ…e®®ò¯v„Ú¶]E-N¸CÜ;© r=Zº¶d(¶ $œ<sw€$ãq`ÕMõ@Î…¥õ+€=ˆ¼ë ‡‘Q~ÎRÑ¯Û ýÚs‰T—þFbõ×?—î÷ ©ü.Þ*¢m||t¯pÑ:¹"üþè:hx_^J앦"btßbØ&~ì#a´Á£cÁ”ÿ‡(öw’{}©lñ“õUü[ ‹åÒ¿^yj¯LyCÊÉ6#CšPîy]á9ÄèêqGÉÌw0Mè‡^B5™qh†ò}ØAÛ:Å0fæYøÒö]x9*¿Xº¼¢()~”’¹k.ô87Ì
äó?ÒB¦9þÈ9R³×öÍÔ™üªÃT¾êÍ”ÉÿIŒæ57oh ‘“ƒþCkæ“;ÒäqE‹ :w å\ûÌLop®ãäþœÑ×? ˆdÓ:Ãw€UÚj¤À¶¿k 8ËNÚL`#³úù–Sü -lG&ÇÙ€R[%‰B)
Êökš&‘(¿â¯jô:”D UôSGå•ŽÅ ¦5tø¸»·}XSyÞû3ï:Õe ¾õT8é@ÝæÐö
O`ÔŸõ~wâ·y©SüA}¢ïfC_óÿÛïÿSƒÊR¨´Oür ™Iȳ j§³CÉ5dumE6!úO³Vòendstream +œç1k§—±¡ƒ!ä–JAë·ãÔj]õf“—KÁ’ҪͶ.7%8ÀÒ#úú‡H€ò£ÛWy– =s|¾?vePæ&gзï_ Ì ÆV +HSØøpmGóÐÚ?$!ºüòXÔà–Js_!qI”CÈźm»Ò³(èÓ¸€‰³{Jz‘B æìBE
aµðu¡tEÇo¢ î –9O*l…Àø)…—+˜A„ô/0ãra +O\:Æjyý…¦5*Ö‡yOßwe½Â¶J
åaºg`5:Ͻ_ö§/<É(ò;›÷ûA‘W|.½tE3±˜†2Ypÿbé Z>Fèìàñt¹Ã§¾‰€©0+iÓ\èïz_àÆgÍÛqœÇ,í›s°~ 7¹LVô‹õ‘Š¥Æ2ñ2pü– +:%“ó±Î<ï’gi&Exü¢§q™Qå-Ò=s#®sø5h÷8ì¶å¢r}? öE×\g<¹.à`ܘӼ†j¢¦µä,8QÖÁ|µßªèºê¡)½0~#¨…{l‚ýãUfR(ìØ^>´Í¼) +‚A¯À ùB¤~ÀPè‚Æ%!ï‹.,s5¹põµ#Ô¶í*j,p ‚àÞIèÑÒ5'CÉ-X áä™»$«nªr.,_ìAä]O8Œ4ˆòsv°ˆ~Ýîè7‡˜K¤ºôï0kÀþ¹t¿ª +Ï!®CW;Jf¾iBWôjÊÈŒCKD7èÃ>*ØÖ)†13ϸïÂûQùµÀæE Hñ£”Ì]‹¡Ç¹an Ÿÿé”2Íñ§Î‘ꜽ¶o¦Îä/P#¦òµPo¦LþOb 4¯¹yC‰œ ô Z3ŸÜ‘&+ŠXüпó(çÒØgfz‰s}' ÷A0àŒ¾þa@$›Öy ¾¬ÚÐ\#6×ø]ÁYŽpÐlÒ endobj -1260 0 obj << +1266 0 obj << /Type /Page -/Contents 1261 0 R -/Resources 1259 0 R +/Contents 1267 0 R +/Resources 1265 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1250 0 R +/Parent 1256 0 R >> endobj -1262 0 obj << -/D [1260 0 R /XYZ 85.0394 794.5015 null] +1268 0 obj << +/D [1266 0 R /XYZ 85.0394 794.5015 null] >> endobj -386 0 obj << -/D [1260 0 R /XYZ 85.0394 690.2056 null] +390 0 obj << +/D [1266 0 R /XYZ 85.0394 690.2056 null] >> endobj -1263 0 obj << -/D [1260 0 R /XYZ 85.0394 665.1198 null] +1269 0 obj << +/D [1266 0 R /XYZ 85.0394 665.1198 null] >> endobj -390 0 obj << -/D [1260 0 R /XYZ 85.0394 302.1184 null] +394 0 obj << +/D [1266 0 R /XYZ 85.0394 302.1184 null] >> endobj -1264 0 obj << -/D [1260 0 R /XYZ 85.0394 278.2032 null] +1270 0 obj << +/D [1266 0 R /XYZ 85.0394 278.2032 null] >> endobj -1259 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F62 990 0 R /F39 858 0 R >> -/XObject << /Im2 979 0 R >> +1265 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F62 995 0 R /F39 863 0 R >> +/XObject << /Im2 984 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1267 0 obj << +1273 0 obj << /Length 2998 /Filter /FlateDecode >> @@ -4986,43 +5053,43 @@ r Ž†à†-ïœdûÉ5… غ(ÿì oëî( Ô5#„}¯
?ÖË9Å™Ml䛺Üü´‘ȱʴ±x)5-1GèªEÊv
ˆÅMO-Vë{ž€[VÜwL쾟êIJ&ÉíÁ`E
+|}8ëŸíN‚êÔ|ç»»æ¡&ðèQÞ¡$rÔ1 J„ò6FE¿ † øÃìÀ0á« -LQ ×QwÆFÒœ»‰¿®2™·I€‚‹¹oîæ"85yC:Ä%NSL6&ëR
ã#¢™êÃu±ÕLB¥‰—ÏŒ9í¥eò©´Ìèïk –fÖ5Í0cùpºæÓ}4ƒb¦ Ò²¡õ9á¾2caæ,ÌeLß2:ÄzpˆUKàº5±±c¼`솛üÆ?é§îQ¤_÷‘) •
þmˆµ™ þ¥ûqòåKZ9‡8‘°ë p t"ßÓÖÇió ›´¯¾?» è¦j=³7(¢”žáŸ %|HßxúŽç fà<21§ f44ßWã)µŸúûp¤&þ˜”d_¥ì¹Ì圄ý…W›#9‚o&ûç„-¾vRjgå½ëX™±xÁÒnyBN¾Õ£ÆóÏËM>SnòÉr“O•›œÊMüßrÿ˜ÜÔ3妞,7õT¹©Çä&Ÿ#7ù<¹MЇ˜ñYx]ì7¸+èÉ• ßù¾¥`A^è¯4=¿³’8þ‡XÊÄøgc3údø‹§gÿuÚþ¯`°Ïn<ÒñÏ@†ˆ0Sȹ±œû?c;dý¿?¿Évendstream endobj -1266 0 obj << +1272 0 obj << /Type /Page -/Contents 1267 0 R -/Resources 1265 0 R +/Contents 1273 0 R +/Resources 1271 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1250 0 R -/Annots [ 1270 0 R 1271 0 R ] +/Parent 1256 0 R +/Annots [ 1276 0 R 1277 0 R ] >> endobj -1270 0 obj << +1276 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [213.6732 554.0172 286.8984 566.0768] /Subtype /Link /A << /S /GoTo /D (rrset_ordering) >> >> endobj -1271 0 obj << +1277 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [209.702 475.7236 283.4678 487.7833] /Subtype /Link /A << /S /GoTo /D (topology) >> >> endobj -1268 0 obj << -/D [1266 0 R /XYZ 56.6929 794.5015 null] +1274 0 obj << +/D [1272 0 R /XYZ 56.6929 794.5015 null] >> endobj -394 0 obj << -/D [1266 0 R /XYZ 56.6929 622.2509 null] +398 0 obj << +/D [1272 0 R /XYZ 56.6929 622.2509 null] >> endobj -1269 0 obj << -/D [1266 0 R /XYZ 56.6929 600.0717 null] +1275 0 obj << +/D [1272 0 R /XYZ 56.6929 600.0717 null] >> endobj -1265 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F23 678 0 R /F62 990 0 R /F63 993 0 R /F21 654 0 R >> -/XObject << /Im2 979 0 R >> +1271 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F62 995 0 R /F63 998 0 R /F21 658 0 R >> +/XObject << /Im2 984 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1274 0 obj << +1280 0 obj << /Length 2668 /Filter /FlateDecode >> @@ -5040,49 +5107,49 @@ $>…<k©Ó‹ÕÁKP îºÂX’+% ®âŠ âˆGüª
…§P¶}~¼¢yÙA )*Å@8pY!ArP—ØúLÛ÷ΰÁ\Àõž¹º ”y >2r'˜ï¥Æ QÔeq“º*;rì݉sín¦Ory’Ad¶J Mûr¸½jý5i_\±çû>þÒËSÏÖ›3è4%93pcgî‚Lü29 *¢'ñ¼ËfðŸgçû’œ’¹XΘ[æ·ž|œ@t”Ö Júž× üÀK>ù¹Ž& Sñ4Å왂`––ŠrWø endobj -1273 0 obj << +1279 0 obj << /Type /Page -/Contents 1274 0 R -/Resources 1272 0 R +/Contents 1280 0 R +/Resources 1278 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1250 0 R -/Annots [ 1276 0 R ] +/Parent 1256 0 R +/Annots [ 1282 0 R ] >> endobj -1276 0 obj << +1282 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [353.6787 560.2827 427.332 572.3423] /Subtype /Link /A << /S /GoTo /D (the_sortlist_statement) >> >> endobj -1275 0 obj << -/D [1273 0 R /XYZ 85.0394 794.5015 null] +1281 0 obj << +/D [1279 0 R /XYZ 85.0394 794.5015 null] >> endobj -398 0 obj << -/D [1273 0 R /XYZ 85.0394 630.8728 null] +402 0 obj << +/D [1279 0 R /XYZ 85.0394 630.8728 null] >> endobj -950 0 obj << -/D [1273 0 R /XYZ 85.0394 603.2815 null] +955 0 obj << +/D [1279 0 R /XYZ 85.0394 603.2815 null] >> endobj -1277 0 obj << -/D [1273 0 R /XYZ 85.0394 477.5928 null] +1283 0 obj << +/D [1279 0 R /XYZ 85.0394 477.5928 null] >> endobj -1278 0 obj << -/D [1273 0 R /XYZ 85.0394 465.6376 null] +1284 0 obj << +/D [1279 0 R /XYZ 85.0394 465.6376 null] >> endobj -402 0 obj << -/D [1273 0 R /XYZ 85.0394 128.2785 null] +406 0 obj << +/D [1279 0 R /XYZ 85.0394 128.2785 null] >> endobj -1279 0 obj << -/D [1273 0 R /XYZ 85.0394 104.5761 null] +1285 0 obj << +/D [1279 0 R /XYZ 85.0394 104.5761 null] >> endobj -1272 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F39 858 0 R /F21 654 0 R /F53 957 0 R /F62 990 0 R /F63 993 0 R >> -/XObject << /Im2 979 0 R >> +1278 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F21 658 0 R /F53 962 0 R /F62 995 0 R /F63 998 0 R >> +/XObject << /Im2 984 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1282 0 obj << -/Length 3614 +1288 0 obj << +/Length 3669 /Filter /FlateDecode >> stream @@ -5094,1260 +5161,1250 @@ c…bì1 j W¦« 3¹ ZM’ špmøJiE”Ph5 ÂP¹d(/hçñLÿñz3ˆjÖ9ÏfQ¤h‚FF$eÞ`W¿¯¡ÒZLƒ Õ÷Õ¡JqhNq”&Äø›}³ a^÷¥|r÷닱äpñЯÂá€ë8Œ\)¶+ïÛ²ÛÝö¾Á¹ø~‰ì¹ûöyΉ3ÊÉi._ÞBâZØÃȃòœ(1âh·x…f„ë-¦Ã ˜GñÙ ^µ®ã~-³¿u!:3’X3
ÏîÊ]ñXyÕ €ã¿h÷ñvUý€ô? • ‰Ç2ˆ ÛçÀ%ƒ¥ -Ò£'NåSV°:·O)\êÍuZ;=;W–2‘ +Ä#OVh’gûæÎ[%y›3Q nÀ$W9ë *>àÂ"Ú¢b ¯ÏÂ]ºC’[T¦Íà&ûâp\ÚV‚l4m(̤åQ¸Þ[ûöùŒëÝØÓˆ]ŠÓ¶ƒŒKw©D×’Û—zÀt§#“×Û¶îÖ§íqÝU”óô/nšÙçNLóÉÅ$x0pMÍ “-úœl)¶à:}ÕÅœÙ
„šØòóÛŸtwòyà{t1ù¥{]q Ï}é±KÐìßÎÞ‚™ -‚«9*8":ª+ŸvÅ!¸zrmá_þ&}Ð*§Ìçá“͸Ê_½7ÿIT`šËô+.C®Ë¨¸\œì$·/×þÕ´ŸƒP„k-_^DâZXÅ $…Ôèñ2Æ™+n "<ùîC9¬Ï—1dÂâÌÙÅŠ¢]9¿9B(2У½¼ Jü¯ìj>î$d²œ¢gë1A !^–mâzm³Ñb.Èý‚ɘñ1ÃŒI9f.$(à9¢}ùµ_Èþ -ÿP„âxôqº36.oÕ=ð+ž æÚâii«”¡—vz»«Bt~Lv"úCYÔ!èò™Y }B‰³>TøK—Iá^œKûÚ"¥¢j´J ôpÂd BI1‚
¨>UýÂ[d]q%/h,îËÇrŒE gæ*н…¨IÄŒ–'.@”ƒLeó×ýL2•,¡©Ý´§¶ÿu’Q¸)MT…Ä ½¼ U¼¦]\3ì3áÄ…h²:vJó¹„<“ç'Ù%LbºìR ßë] @Íä(p)öÚn=Î - RÂøø “j¡ ·øÜšo¹+:/hô§ªz³?mC²×
º ¥áÆ–óÿM v@£º†*ÚÛ^¶±¬„5 +Ò£'NåSV°:·O)\êÍuZ;=;W–2‘ +Ä#OVh’gûæÎ[%y›3Q nÀ$W9ë *>àÂ"Ú¢b ¯ÏÂ]ºC’[T¦Íà&ûâp\ÚV‚l4m(̤åQ¸Þ[ûöùŒëÝØÓˆ]ŠÓ¶ƒŒKw©D×’Û—zÀt§#“×Û¶îÖ§íqÝU”óô/nšÙçNLóÉÅ$x0pMÍ “-úœl)¶à:}ÕÅœÙ
„šØòóÛŸtwòyà{t1ù¥{]q Ï}é±KÐìßÎÞ‚™ +ŽˆŽêJÁ§]qˆ®ž\[ø—?ÄI ´Ê)óyød3®2ÂÀW/ÅÍST Û˜¾Oßz[ ÁÂËé…/ÅãÃ3†#› 4Ý££“¦DÉ;¸6$,&xgAÂôõK¦m`~ñ)iN,Ó¯¼
¹.[âB`s¡¾Sþ¾\û‡ß~†oB®µ|y‰ka#|“‚ +4úSHU½ÙŸ¶!_í]ÐÒpéÌùÿ& +; Q]Cím¯ +ÛXV€šP©'ùý '—„êdAŒS2ð&]Þ‹dqœœ§“o©¨êécÓÌþ|ÜöwáO®Ëå·išþ!ñ—ÿ endobj -1281 0 obj << +1287 0 obj << /Type /Page -/Contents 1282 0 R -/Resources 1280 0 R +/Contents 1288 0 R +/Resources 1286 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1250 0 R -/Annots [ 1284 0 R 1285 0 R ] +/Parent 1256 0 R +/Annots [ 1290 0 R 1291 0 R ] >> endobj -1284 0 obj << +1290 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [297.8955 476.5924 347.2449 488.6521] /Subtype /Link /A << /S /GoTo /D (dynamic_update) >> >> endobj -1285 0 obj << +1291 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [324.9335 169.1118 381.8296 181.1714] /Subtype /Link /A << /S /GoTo /D (zonefile_format) >> >> endobj -1283 0 obj << -/D [1281 0 R /XYZ 56.6929 794.5015 null] +1289 0 obj << +/D [1287 0 R /XYZ 56.6929 794.5015 null] >> endobj -1280 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R /F48 880 0 R /F62 990 0 R >> -/XObject << /Im2 979 0 R >> +1286 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F48 885 0 R /F62 995 0 R >> +/XObject << /Im2 984 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1289 0 obj << -/Length 3521 -/Filter /FlateDecode ->> -stream -xÚksã¶ñ»…¾Už9!xñÕt:ãÜùRg_ês;™&ù@“”Å9ŠÔ‰”}ʯï.€@‰²/ÓÎ=,€ÝÅbŸ€ÄŒÃ 1K#ÆU¦gI¦YÄE4+Ö|öcß_;gá&-ÂYßÝ_|ó^%³Œe±Œg÷Ë -®p#Ÿ/~ýÏJØöœ©,fÏÐáLd™œ/t¤X¤•ræâãÅ?=Â`Ô,’ŸŽRI ÏJ³4 “RæŒG µEe,VRy)K1%e7 ¥\4uÕýbSm/E:_|ÞUÛý’Ä:ÿ²˜ ?–Œ–*ÍBNØô³&øTŸ2‘,*3z¿ªú -øâñ¼¯lDóae!u[uÞô)ovþø×»54çmI£°? ¡N»[?À ag³…ˆƒ8É %XEÒpÐ-Q,ÑÜ¢*vÛ¾~ºóŠ = j†¼»]íDKÃËnK¼ÝÓðcýTµ#¡(rŒL|ó^„g'UÂ2 ,‘•¿Ñ”‘Ø–è4±>·ùºzóyØoàÿ¢Éû~i3GÊ.ùûk8#”{>»t¸ýjûTm ø\7
R©Œ¥<KÇ‚Ì‹¢Ú ‚XÎ *” -”ú¥ét›MÝ>$/K8Ü®5Ç 'V0g¥áØ`Ÿ%M4diÉ0Tk¢ æCGÀ¾j–Ôv¥6¬êžZNipuk«¼}¬Œä@v äœ,-0’‡Š¾M÷øX•È•à¨¬-«ejA C£§vî7
Á-ÐP6 -¶ÀêKQ€{Ä -Õqk3ŠÊmz* k§Ò6Ùò +‹R ½,Rmfbö+bø Ù0ÓønW7ÃÂxp8«CèFSçfZwv=Õ+pž2b2†ã²Ù˜_z@¦R1ß´ŸêÒ+ŽšXƒUÕl–»†&–uþØvà - q€aE¨v+Z‘Ü)8‚PÁöà7‡=âßL€ƒ³ ÞIÔA¦ÀûmújWv‹¡Û,šê©je‡þƒ¶ i pJ²8Jœ/x¨ÛrBH2a2î¼ K@Éžœç¢|‚Åχ5˜Hê32“Øa]Êlóc$àö¬ÒCša¶—ojYá0u‘Aï©®ži“ѾªÎ•B‘€¢N¥¦(¡±íãŒwSE`8ÿ4í?ÁŠ;üi é¢ÈŒKqÌÐ -Rc.Gìœ ~Ö+\œb R_àÁ¸Qø9õè!áUI¿rŒ˜ ©í¬çU]¬-¥w˜ –‰–2 %iÿšÆlÆ•É%tèÔ<‹°ê ‹’§LƒòZê7·S F¢æ~ë “:¹” c•ŒmI ›î!w©?”®‰ÉØÔ¼¯É0:àÑöÔéwFä'ýdh,•©³·¼$ál4 -³ºÎ©a?.U„¦ñ4!NS žFK¼Ñ‰ ´8]"~Ø™¨™àU!wi °Ê~38uÄ”Ê\à¼ÿå~ÊAS9ŒTÜ@‚‘>2Ƴ>Sc¸—¯¹õ„ÅÒGg,Ñ2iS#hxwº§ïàFIìyC=dØñY´eîæ[ö ¨ê>nª¢^îÑ0'â ƒHŽŽÂÒÁªôtWè™ QñØ0—³–fs½¢ê{[ s[rpWðCízÆ -ÞkP0œuÞ -ý,äuÉ¥ÓÍ‘BÖ¥„z™°›4Ax¤c -jL Q&#Œã ¦78°·Â8¸È×>²B#+Œ©®co…Ð4bqž³ÂT0Ä™=zÇÐ934uëØ‘È´B‚
Ö”B™;Ò‘¯²FXϧ á•\ýiÔtYŒ9Ëë ŽaÚ|©f ÁTGøá"J±ªÛ`.…¼pŠ[ õOd3Ð\È· IfIu¤Ô‰ ¨R;/ªÍ%Žc 3p›|ÂŒå®5é°¹üɬnÁ‚Ͷ^çF °³Ûb J+Œn -w -2l¼-©ËS5{EÍK´ý¤SâcÇ¡b…t-¤nÝ]2¿y:§dÊá%Ë ^räð’S‡—¼îð ßÎtìœÇÍ;öñúîß×wS%CÌ ß×_ëî ç‚Ç&ç0 ŸÍ}¡â„œ<M¿.÷=qwÒå27 -7Í=ëÔ{©ð¡3 ÒkhÛË ò ]i‘÷s?. -üp)Å©°î7yQÙ$†a·m©ûË»?]Ý܆£ôèg˜]qŽÓª‹ /‰ëb·˜:—&7u¦¹ö“ •Ðžiá Ÿ„û™îÑNò{ qûʬñ…Ó2Ü»7éðÂSÏïÞ¿%°ÈDjטà Ós>‡Ñ• žFó¦ïh¸n‹fWZÒÃjòõy̱ s ]â7??ÅÔ2HÍ`ˆŒ] 4g@˜xl«-ÇÈ0 1Õí§—pš;B\Bü!Ýæ!/>Mæè#¶Â øDÕ"‚Ö®ýÔvÏÖ+ûÉG<ëz)ûÃo/0|t,+0¡µ)¢°[/í\ú'E Œ } Ç9½)÷¨¾Ô½y¿„¶9\fû8Ð;´Qü¤—Îc ©ý²‰_ÛgòXå}Ú”Vs|®_VÉmÍÕ!tyÁ žCÉÍ„Âîf°²ÏéS ü¾Ýzd…aÊ]nB2Uùaˆ]Sì¶D¡µKšº ÆÊ-«uÿ×sï<©b:yå~‡9¦R€„)ˆ§ÐL•ÇC* -ÎnnWïÞݱ«»ŸñýêÜvãˆ)ˆä/n÷0çüvíœW·û½ÃvNn7 (dòÕûUß!NЇÖþç_; D§…Ιç7Åc–JHv-S&c:yò‹TÊ @M&Xÿ/Vãšendstream +1295 0 obj << +/Length 3537 +/Filter /FlateDecode +>> +stream +xÚZmoã6þž_áoç +‹x–‰ÙæJÅ2Š•”žR_}ºúçÀ0hµC§ô§â4Š…Jf ©¢4 “Zf‹Ak gQ"… ´,ø”–}/ÔrQW¦é»ÅÖì®y:_|Ù›Ýá
ib“]L¶ŸêF$:J¥ˆg¡ +ÜœÜ\à$†¾u»Z™¥â •¨¥Yæ`T±stT·EC…3G´3[‹†iÓ(µrN`ååÉ /»u»¯K*×_“¦è‰´nŸ©°!ÓƒÚ[e%áñ¼h7ŽQÕЗl +9}¼¥rR÷¸3Y +hp[ T«²7Göe`¶+xÉÞ®ÁNF’HZ
P<›Òä5'4>WýšÈù”™4m³pKÞ¶
àr—Éü÷ÖZ ÔnËäÄ +¹"ÑnÒL†÷¸y:NÉBzÈÃ
l¨Ç£k«Ûg:lp‡°M
£: ú¾Ç½Fbµtœtë¼sÂY›¼j€ÏÄrö
ùw9éi X‚Ã0³H0‘:8¼x2ž`(œÎÊz+¢3 í³%ÂïĦ}ã!–köG¬ƒÆ««MåXµÍÈQÔ¤£§’šo}ëpIBv âiÅ †¡eþÆ&Ðp°¬?£^΢ Tå4õbôq¢cÎT èX‰”t¬„¶:FB c¥…7=htŒUÏ iiü~k…¤ÇvúÁbkG¹ñyC]«Í¶íŒëñx˜X%¨1Ž¸Æ8(4Ç‹(Œ_ôÔq¬¢$… –…¨.Œèûôb¬tº *úN„e}µ<,JSçg W¸u™|qê¡ÓùÜ£½Tq”AD6šœT
àh§çœÏÑQRIçÆ °h›²³TvØ?345%! 0è!¡d=šiaDÛ˜®ËWÖ®µ?œÓa7ÍBü •ªsq,AcØ ºŒ·¾hÊ(„Š2–` © +§˜´ðþBà +‡Ö¶3û²]ôívQ›'S/ÊaŸ–yD`[R€IiáUSN(IèHhîÝÌŠ³àtç'àLC\9ëÇO ÑòÓ!¶ñ8¦£€A.Á üšezŒíòò]O%«+l¦j 2¨=U晚1‡èŒ¹”Áª,@« ÝÚv«î§r÷°ÿ¹»žqÅ~‚è“l‘gÖŒ?‡
#q&0ÃõzEŠsnAÆ2X_‡o +¶ò©Óä•mÄl† åz=¯«bMl)*ÏÀ`³l# p]’õo¨ÍÊY€P¡]D„Q—D,¯›ýönê ÀÐÊ[î·ÃÄdN>ÓBŒ‰ËD¡Ãªn sŸ±Åi¤%×cW°&ÃC ·¶£J··*È +ˆCÑ1'Î'eªO¶Â̓— ç«Bd‚£PžD¡åœ§¹X¯€°×Ýi0—)2ŸF²ã•Ã%/T*JµÌ^ñÂ × ^è{¡¬k.½mŽÜ¢.ÉåËûNlLB꘩“™É “ä(‚õž<xaÜ¿´¼ÚÈ ºŽI’Á ¡hÕ ò¼ä…)”N2·õ^ Knh¯ÆNˆ“L;!ØàMi,Çîô‡¼ÆÆ—ã)†9œüÓŽ,éŽóž× iû¥œ%Ü$S 14Çp¢ëª úÒ‘vñ£“ ÿ‰]$– ñVªÆÞ³¤ô_(mT¡<Š*{÷æEÂÜŸÐc¹ol8lïì|궻j“[sÀÊ~‡74ÂÚ]x¥Òà¾Ei +7Ýk`#ÄËaêãRâ3‘8¡-‚ +—œm©jç„/„…EÞõT!½àtŒ®El¢ßÃ}ðý»gÍ¢T!æÚQéxS)²×à
lK¤">±qâƒøöíÔ§'" ã…±™Œ˜b'ÇÄÿífŠé—Ñ.ìuí†^A÷\Uyyq$âT¼<ýÐkbþ1è1H[!f à@OÏo߇¥§`O°—œÀž>=}{úu؃¨;S‰‡Û÷ѧ›ûßÜO%IQ¿ú£ ‘ç,ù3‘‡•øb y'DæéÉ+× =á£
‘ñ +–I ðª¸*SOÑû:·Ù¦} + Bk¯7íã‚kt„a
£—‘Ÿ§À$-‚kO¨ÝxGCxÆS7Æîö±-žKÀœˆ"qØ…ƒëVw-
š¢Þ—æâ#€âDbÀ²Pbh'‰~ûÓSB$k‚D –AmèXGµ¨ÙU«Æ”è:oèùÜsâóºj>¿ÄÓÞâ<‘½Ä¡ ív1µºÇ¼øì®ÄF†¿WÇJûæsÓ>7g#»É·X‡BBøgy, BƒIKÄÒ€7mlR…ÕjéúÒÇâ
°$÷;ìS»›’ò@óµêìK ”ik…Â&ôS (ãF…zðÀ©Ç™íI¶{&ð*oSö ôbÿÒ@L·³VÇClPìñU›',n5½Ó}N s<ÜÒc§ »Qþ²Â*]zž‘q„¿ +œï៳ÿùLJÁ뎎 tÓy‚dI” +_œPö<{ʉeAÒ¡'Dÿ/ä×}endstream endobj -1288 0 obj << +1294 0 obj << /Type /Page -/Contents 1289 0 R -/Resources 1287 0 R +/Contents 1295 0 R +/Resources 1293 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1297 0 R -/Annots [ 1295 0 R ] +/Parent 1303 0 R +/Annots [ 1301 0 R ] >> endobj -1295 0 obj << +1301 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.0431 510.7325 144.9365 522.7922] +/Rect [84.0431 462.4692 144.9365 474.5288] /Subtype /Link /A << /S /GoTo /D (view_statement_grammar) >> >> endobj -1290 0 obj << -/D [1288 0 R /XYZ 85.0394 794.5015 null] ->> endobj -406 0 obj << -/D [1288 0 R /XYZ 85.0394 581.6899 null] ->> endobj -1294 0 obj << -/D [1288 0 R /XYZ 85.0394 556.4234 null] ->> endobj -410 0 obj << -/D [1288 0 R /XYZ 85.0394 250.947 null] ->> endobj 1296 0 obj << -/D [1288 0 R /XYZ 85.0394 225.1724 null] +/D [1294 0 R /XYZ 85.0394 794.5015 null] >> endobj -1287 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F11 1293 0 R /F39 858 0 R /F14 681 0 R >> -/ProcSet [ /PDF /Text ] +410 0 obj << +/D [1294 0 R /XYZ 85.0394 535.1829 null] >> endobj -1301 0 obj << -/Length 1676 -/Filter /FlateDecode ->> -stream -xÚ½šËnÛ8†÷~ -£+¨Y^D]fVnãt\LÓŒëYµ](¶Òp$×R’É<ý") +4Y¡À (ÌËOþç;"i*
™bñC¦<BQJÓiœ†ˆc§Ûû ž~}ï'DkæF4‡ª·›É›KOS”F4šnnÁ\ ÂIB¦›Ý— BÍÄ 8x÷éêrõþïõb‡Áfõéj6§ —«?—ªô~½øøq±žÍIÂIðîÅõf¹V]‘žãíêêBµ¤êã̤ëåår½¼z·œ}Û|˜,7 ä%˜I “/ßðt'°?L0bi§O¢‚IS:½Ÿ„œ! 2fZö“Ï“¿º Ao;Ô–¿N3g!J„¿'Ë<E£¬Ë2 A–c":#A`T2Ë_1‰‡¨±˜$t -§{ajD/ME±7MâiÊOM)9ŒR´ºš/..Öh±¾ž¥4XœÍ9KPš$¾5Tz£òÒ»L{ú¡© š’‘˜þ<<I ÃØTx£ò»L{ø¡© š’x|”Æ(Æ8uÃCÕyøNåƒwšvð/Lð'¦"£àãa <P9àÊ ï2íᇦvxhJÒqð¢Æ<ð@å€7*/¼Ë´‡ šÚá¡)ÅãàGq”z<¨rÀ•ÞeÚÃMíðД’qð„#B¹çÀƒ*¼Qyá]¦=üÐÔM) ÏÅõ"LˆçÀƒªóðÊï4íà_˜ZáOL) 3”°ÄsàA•Þ¨¼ð.Ó ~hj‡‡¦4 /îz$
C<P9àÊ ï2íᇦvxhJù8xFç8òÀ•Þ¨¼ð.Ó ~hj‡‡¦tÜ
‚R % x rÀ•ÞeÚÃMíðДŽ»á…)A4ò|ÍÑyt#ò‘» ;𡣕:Òqw»0ÆÂÉ÷BUp£ò’»L{ô¡© šÒqw»0óÅÜsÔA•Þ¨¼ð.Ó ~hj‡‡¦lÜÝ.ÉbŒxŽ:¨rÀ•ÞeÚÃMíðД»Û…8AQ{Ž:¨rÀ•ÞeÚÃMíðДDbÓ§?OÏ’aß7<g7" ºË±# :ZÁ¡#Ex w£cÏaUr£ò¢»L{ö¡© šbôk?«ëÈŸ±0B1|K¨ 3*oÆ\¦}Ɔ¦öŒASòdL^ºõ «PåȘQy3æ2í364µg š^ KIûs䘣0J<¯ŒPå 7*/¹Ë´' šÚÉ¡i‚–#Øi¢„rÏ#TgïT>v§iÇþÂÔÊ~bšŽcÄ fB<Wg¨r°•—ÝeÚ³MíìÐt1Ž=dˆ³Øó 2¨r°•—ÝeÚ³MíìÐôíYv9|µŠDAÜ·C¦. ËûCó<›Sƒ«2¯e1 ²ãŒ$A®Úë¼i²›½®e’4wºá±ÈŸTiŸ?æ{=A¹SmU¹×Óg‡ƒ*Š±U?´Öº[ÕµÝgµnZ]!U¸(jé¿SŠÜ1ï"–¤x:—¯‘œ«oY ãAQÞåÇ¢igbQpÛŽ©îUguhŠª¬UWq«e— -ÑÜçEô••jÜõá‰Vžè0á‰Öúo‹¯â{ßx·iTªA§‘é4 -tq˜ùü´Oõ˜ ÅnÀ¨ö»š†c@!*û¢ntóú±ŠZàkU~® Ta›•'ZUé TΪ¦ŸA•²f Ô@2 ¤mn«£*äÿd÷‡}þ›¤ysÉÒÓí3"¿íä -oùt,ó6»såa ¼B¯~W3œì¹eŠ•LAiÐ>LQy˜‘ .Ê益 ¤f·SªvQŠ†cV~Ïuy+ŸHÛ»S
f±¼–/îê»êa¯5Ù^i²\%)î²Gm¦:Äœµn0 ÈxÄgY Z9ŽñPÅ u.ÖTDY°*UËá˜m›b›«ZsWè!b£æÙQWäV•Ÿ¥|â²pÓêõ•
Û¬Ö¥§¢¹S¥û¬|V¥ "lÌMÞ(Å.‡ü%“Ú½E)¶i"ÂoÚmóÐ=¶Hd6?Ê|É -×kK´–Ù}›7Q,JÕ'f¯Í˜C¶Ík¹Áx |®T¿Š¸ !N‘ 3¶]Ürh¶=¶Ûx[d{KO9 ®Ìó]»4DYPZànô^Ùå‡}õl¶e{<Êx—•e{¢Â}%3ú¬7V•é!ÙS¦ÛÀ¡G9Ò(z5:{1×*ûÿe‰šç—ÿŒþ² -‰—Ä3oR4NP˜0j‚jÿƒ¾ˆœ`$Mj ý?„ {“endstream -endobj 1300 0 obj << -/Type /Page -/Contents 1301 0 R -/Resources 1299 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 1297 0 R +/D [1294 0 R /XYZ 85.0394 508.8634 null] +>> endobj +414 0 obj << +/D [1294 0 R /XYZ 85.0394 198.9245 null] >> endobj 1302 0 obj << -/D [1300 0 R /XYZ 56.6929 794.5015 null] +/D [1294 0 R /XYZ 85.0394 172.1168 null] >> endobj -1299 0 obj << -/Font << /F37 743 0 R /F14 681 0 R /F23 678 0 R /F39 858 0 R >> +1293 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F11 1299 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1305 0 obj << -/Length 2717 +1307 0 obj << +/Length 1767 /Filter /FlateDecode >> stream -xÚÍ]oÛFòÝ¿‚oG!á–ûÍí=9±sÐØwŽ Ðô)›8‰TDÊŽûë;ûIJ¢d]œM -qÁ°FÄ)â” -‘E%/‚ ™ÝÄ -¸*Jú$óºô‘0¤2¬EÊåÁÝ´Ÿ¢”C¼'ëˆbÊú¼€GÒ~ÀÒ2æLÀC Aƒ[ÂŒ¡ 3
éîì °F¶§Ãf -IÅÕæþŸ—å´šCQªâ§‡¼³cÈÀu¾(ݼq"
åËe™»ymrý4&× -1ù¢S °8…ÇêbÚÔ]>ív½B!B^Ú>`ì¿áœ!’n3¼‚dÌyÉxì92ÃNm0ìÔcÞ-4l÷©‘m¹…ž2nÑOõn¡'g#2 nÁ0 nîOxó+Üâ ! é?ßå\B"#’ vƒ!Ö~7X½™µçåŽ/HTÊØa Ö¾A q¹ÉŹÝÙèÁ˜žæDöƒ¹×–7”‹/m( -çÅ;7V”³|mŽ3«|7œ[ã;f³ºfIª^¹!Ö]{,-¥“(éu¾«kŽKÅa Ö›ºN!>±Úäâ¬×+… -a `¡‘!·cPoUFN€›Y¿¢µXæàjGVøUÓf]wFwz«çeéø±• <æóµÛÈS
s~±qçálJ€äþìIŸz\Žà KX`t «òÉ"èE!û8BNP
j¿mlT±°ŠöôûÝçà’6ˆ6r ‹ïçÍ ¤Ì
‰l’Ù ÛV -`èé¡ q0Äé€ØžX…¬êp;Üyf6ÖhmÐÌlf4Ñ3⚥ni¦üYc~L–„ªQ¾”&{œïÍ“–¹YÆÎÎíHQµ€Ô¡ÓGYü¼SÔP‰´ÒQ N_EŽi™)ËLåÖEß÷ÜÓA!”‘Tþ × -‡Ô.›Ú\çQ û¿³Ï9œ¾´éLÏÕíÓ¸¸77»FP¸K!H4´êë<Eû$M³lã~çH’~Å~ç Æ3ò’óÑ )øgµ]ÎÊÕÊ _/{ Ã$xŸ†µ÷1L{oÓƒÖ²tf‚T¯=Aè‚«Ÿq{v$=GÛHþ:mþ¥,U/CØ)› êo«U[vGf‡lp6l²ƒ‹;›
²ÌÛGƒ›ö¡îÖW¯ðÑ6)ÃØÛ©þk×y—ï·×P?Ö^ì‡Ú zkYò{a…–®£®¿>ÿŽ3á<LÃÚ`ú ¦_œÁ4¸i0Â…/?4xõß³ëO§—W/í€aÿ ªE¹÷n«7ŒˆˆÌfºY^Í׫òÈ@ÒíØ”kbIßXÌì³% r ߊ%ns µ=‰~µ ø” ‘ñ\-Ý=”¡€ÎÃÅrãçó»æ±<`Ò®þαFàÄÄ"{ɤ -Q æNhŠrx3ºsCJS]l+%J ¦°¿
?@€œ!Ý7ôóÜD·È|åJEø¤TB]ØÉ»gûtW ƒ¯YÂÕñ'‹ +xÚ½š]sÚ8†ïùL¯ÌLQõaÉÖîmH—Î6íRöªí…¦x†Ø“d³¿~e$áƒ#¤x:³“É K¯õžçÈ’e bõG†\ !© &2F >\Þ
ðð‡j{? F3¶¢1T½] Þ\³d(‘T kÐWŠpš’ábõ5ˆ¢‘êGï>Ý\ÏÞÿ=ŸŒ’8ZÌ>݌ƔãèzöçT—ÞÏ' ?Næ£1I9‰Þý1ù¼˜Îu“0}¼Ý\é©?.t:Ÿ^OçÓ›wÓÑ÷ŇÁtqb¼³äçàëw<\)쌘LùðQ `D¤¤Ã»AÌâ1c¶f;ø2øëÔ!h=žêÌ Áˆ2A ¤Ì•@.‘`ª©Iàb“k¦åý~?"i”—]±-jSªÖú3¿Û žtñߪÌk],êß.¦)w'aªcÔ$Q'D+@_MÔß0Iº¦‰ê¤ÔojEÏMÏR•Ä¥äç¦*ͳ›ñäêjŽ&óÏ#I£ÉEpÚ IBà@å·ª ¸Ï´ïšºÁ¡)¡ÉËÉ1FœÉÐL*¹UÉ}¦-y×ÔMM)WóXÈÓ‹£4&ÒOU—éOª½×ôDÿÌÔIfJ" }9¼ ˆÄq €*¼Uá}¦-|×Ô
MIÒ>&(ŽE€*¼Uá}¦-|×Ô
MIÚž”Äêæå‡*¼Uá}¦-|×Ô
M‰ì)Âœˆ +”J XV¡êrÆNªPƼ¦§Œ=3ufìÌô +]7´/#I3wS¨ò[UÜgÚ’wMÝäÐ4EÓ>ìq‚bÉOPåa·ª »Ï´e١©ìÇ®öÛ‰LPåa·ª »Ï´eïšºÙ¡é¤ ;N–2ðì +²ûL[ö®©› š¾½ÈÞ\FHb!†c"U¢7 SóÊðÓ+CG™~Ó¨ëëüpÈn·æ(;hÉac* ŠüQ—¶ùC¾5 ”+]W•[Ó}¶Ûé¢:·jOn›–Û¬6U³¤ WEÝø¯´"wDÌO7¤X!$9×+ ñ¨(7ù¾8 {b"Z Ï©îtcµ;UYë¦b+å)ªºÍ‹j++]¹jÃSµ6<Õ`ÃSµõ._ß0¦Öû˜Fm +L™I£Bg˜G‹füŒOõï÷ŪèçûÁ¾%n)œoˆA¬ö%ñk]~ªîÍ{æ¬<ÓꃓÎYuh{Ð¥ìÐ &ŒÈج«½yWýOv·ÛæÇWÓo®™<ŸN SA=Nõß3>¦w¬mÆÑ+ôêwÝÅÙäŸ÷¡o³& RT ‡S ÜHTå}¤1Íj¥UÇËRUì³òGnÊËfLŽ+]a/—×Íð%S½©î·F“mµ&[5׉äÑ&{0fºAõY› +{ Y¯³ø ×:ˆ¶9ñXÇÐîë\]U‚²hVêšÝ>[ Še®›Âœ¢¦jžíÍA3Y›Ï²ó¦p{Ô›K·©Xfµ)=‡.Ýeå“.ý¼WaÛ`nó#V¬rèÀ/1åzŸÕ‡ý(î—‡ûÓ˜%j¼ò}“,} /-U(³»ÜÔ¥þT]×öœèl™×ÍKXô¥Òõ:bxÒZeÇžž™R-÷lj¼,²#ˆÇ ÆWæùêxi4}T®‰{kfË*ßm«';1 d37YY ×T8³šŒšŸyl«Ìœ’=f¦,kð¬KiTM† endobj -1304 0 obj << +1306 0 obj << /Type /Page -/Contents 1305 0 R -/Resources 1303 0 R +/Contents 1307 0 R +/Resources 1305 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1297 0 R ->> endobj -1306 0 obj << -/D [1304 0 R /XYZ 85.0394 794.5015 null] ->> endobj -414 0 obj << -/D [1304 0 R /XYZ 85.0394 517.7894 null] ->> endobj -1187 0 obj << -/D [1304 0 R /XYZ 85.0394 495.4781 null] ->> endobj -1307 0 obj << -/D [1304 0 R /XYZ 85.0394 307.5429 null] +/Parent 1303 0 R >> endobj 1308 0 obj << -/D [1304 0 R /XYZ 85.0394 295.5877 null] +/D [1306 0 R /XYZ 56.6929 794.5015 null] >> endobj -1303 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F62 990 0 R /F21 654 0 R >> -/XObject << /Im2 979 0 R >> +1305 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F14 685 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj 1311 0 obj << -/Length 3077 -/Filter /FlateDecode ->> -stream -xÚZ[sÛ6~÷¯ÐÛÊ;Š A³Oi›´î´É®ãN ÒL‡– ™SŠTy±£îîßsp -Ô†ÅJª^"†A/œóåËÍ&oóªÌ -:ê;»Æ®WG¶¾ËË žx«o¾XɈ™HDŽëͽ\©H/³;EË&°ÃÁ5°³/ §Ë¬h*š²ÎŠÂnü cùE -J•i›á ™[>#‹4,M’ÔOóüóÆ TÒ.yÙÚÚ‹å%¡¶"R¾?Ô—"]V÷þ(m˜áȶ9TeㇶÞVŽ¼By@"bœ£I„`FkéDÙgåVÈÄ,«-|ÓÞã€bÀÁÄË_îlIc¨»K±ì¤^}¸bíáFð|H´ev ê{ÔdÌž>yáYù##1ó ¸½îªº]»Ö ‰‡£PÜ¡–¤LH)ØZÊt$) ®+à\¶ÔAM¹† hrV6ÖS¯¯5ÞT
›díŒ?ÈD3ðeýœ?(ððHpŠB½l£Cƒ$ƒNaho×wY™7{2ªâ 3\¨©Q%õ$w¼ oVn¨á¶„oYµÔ *²ÖúNøuê„Æ·oÞQcH£ùë{§'ho»Òi˜õæé”LPã(V`Ù!ìÆ~£ÀÊ›Ê6DvÒ¹q8ôÎR›œ 'NüÀ;]±ÿ+×Ü~\ÛC{²ôúº±ß„¢dckÀG.oÉv§Ž6ñ+Õ'T±B/³D¾µEõ -T®[KtÄ\Ô»=Òèùt"ÎÒÈL…Xp›‘%ŽYÄ#õd,Š¹~2‹À…Q€ºÂ•¤=x$Ž”CÕ49Êãzžà™vožè 6”@Ãtzê@Ýá J‘ïó“ ïýVŸØÝÅtåf£è½õ³»f^«R ¦•ŠƒÑ²+¯Ù&ÿsN¯‰b\é¤×n1:6jZ½^΃ªöBƒ¯A*«¢ê ý}^R|F£úOCÄ©G$šÑ¦€É¡ ¿o_¦Ié<8ùåRCÊoïVs…»êÚYeI¢ÒϽg=fø\Ä¡þë"_ÏñI™†søic„À
å -> Ã^ ôœ lQL)´^ðþ â]ŠÂ†GYÇž§¿ä¥‚¥F˜©F nBÕKµü¾z°ˆÆ -ßßÝ[λ‘·^[ë.ÀaÙ¸ì4~c¢í2Ú£°Mã7ÝNä‰út FŸEyu
KVUžøØg£î”=(Ãç#p
zõñ$À•HèŽ#°0;w -`Ÿ®ØõÖ¯¢ A΢”ZÞMÜ)Þ º¾â"oIl: - hŽz? /ˆ>ª¾tïp¼³Æú™èÊŸ²1´°aû3¸Ë9Ìx2îu‚OC+`˜ÉÅ=`×T2 'oËmUÀ´çž2k»ý> 50ÔÅê.^gž f - ìÍ…J>/]³GO—’µˆê _9æŸiÒj<ëüKc?kçŒw’3¨½âéíûY3ûOÀŽÔ ²C4àj.ê
± áŸNø°©Fï‰ÏÞR&6ÁìþeŽQ©édc·YWxÿºÏú›tÞÌÙ:†š#"ó9HïŒU*Ñm¢§í<žuÞÎý¬‘×…Ð\îVî{dò8a€¿äÓ’ô³fD™œ:‘L©TOe!-K3¼‹Èþ
T†‹Ìžž„pV›9È«†{£Ä'Õ¶Î]Å‘ƒo!ulh€ž7ýû)|¼þ™ædÅÁÃÝž.)+Ã@«Ð€iþ8kn–òhúÀ9¯ØG> Y*EX •¥k-Âi|™’P׃zà܈1§þtÍÕ–F 6`ù¨ˆÀQ-2BWt} -Ô=„Y~p¹z÷¹}péæøŠñ–ÙáPä¤dxÈj€ -ÏØÿOº<zzÓ/ÓMŸÚõw{l‚¹OÓÒÅhÄàýùÆØï£ÿýl=šª«×v8i~ˆ\ -$øèÈ’HQþÝ
if’$^ŒèÃÙß ªºí£ -; fäÃÁ „xÚ"$çê> ‹?Õ$LÆ.@Q¤èŒ¨Ñ—‰*¹bR%fVT(Zùöøi -E È蜔ú/I)ÅTd̬á'R>¯ÎÁ6ÿwËÏý/Ò ÿgññ¾,üåÿóþ *3¤éè(“”E)0ñB¹Ò=†Ëþ ‚ ‹þ?]˜Ãýendstream +/Length 2674 +/Filter /FlateDecode +>> +stream +xÚÍÙnÛHòÝ_¡·¥ˆÓ'Ù=ûä$vÖÁÄžu<À“y EÊ&–"‘ò1_¿U}‘”écã 0.VWWW×ÕU-Ót¦dL¸³T‹X*gËõ™]ÁÜÇêhžh1¤zwqðÓ1Og:Ö Kf«/¥èì"ÿ=zÿ¯Ã_/ŽÎç &I”Äó…LHôîäôƒÅh;¼?;=>ùøÛùá<ÑÅÉÙ©EŸ ¾?š/¨’Ö3Çá‘Ç'¿ Yèãùáçχçó?.> ]„³ ÏK ǃ|;øý2ËáØŸH̵’³[ø 1ÕšÍÖBòX +Î=¦:ørðïÀp0k–Né/Ð,„Š /Ù–²Xk)¦·%``šŠ'xÙux9Я³êÍ›$,N Λ—ñ¥±–’¡}5‰S +³)ç1A˜÷lu,A‘Ž’Xr‚Š³ù"¡ÑüÏ¢£}s +vмO t"ë*´1ç<ä4¸§!*D¬¨HfC¾vTÛóa §Zêñþ_6Ų\Cq®£Û묳ÈÀu¶.ܼq"„²Í¦ÈÜ<š GcrÀKÀÍÀ‡ê"·˜/g‡Ã©ecF7¹j #çÚþ‰n7xÐÉʸö‚ëXA†‡qmÃî1ãé0¶x¢¯„°"k1 X ÿ¸ö|¹ èÒavm‘?ð\oopµXÊ„=íCªÇ"PõN±lê.[v½BÇŒ=·} šØäRÄŒì ¼‚)ἂ)y‰ Ú©
ÐNm€ón°MXÒ§F±ç8eÜ¢ŸêÝ'Wc2žn!¨nîÏ.^ã_1þ÷}n +úBˆ+-Ï—.ëʶ+—.ŒK{ê$–/ä…AeŠQ¿· ö"^u±Í:/ÿ¥óÇ-WÈ åº¬@ÐG¹ r¹sÞ\7(s(*ËeVù ÓxwϺîªúJ.5géÓ'ÊwëOVWeÝúÖ]»ð²CUÖÅ[þ·øyÂ2aGev|óæÍ´ >„ ÉW"‰N9ô³Zhø Ó&zp Ul½[_šR`SJÀ¸q^[›¡u“nÌì +2ËÔ=à¹(ªÖ:0}ùÏŠžÆZéK^òô%-3 +ötïïûV
žéD +…Iÿg +×Þû +n_Út†su{;}Üóó‡FP¸§ t¨C«¾ÎSÐ'9Qjô¾óB–~ÅãÎGH RÒçœê^¢¤M'ÛbUl·öúzÞûeÁûFï”÷Þ†HkY:3AªGO@ \ýŒÛÛð°˜Åä=jìÜ>a ÁÉ_§Í¿Ô@Ø'œ«g D5ô&©´Ù¡¾ÛnÛ¢{avPƒ» `“ \ÜÙl ”·‚cûp÷ê‹+|´= Î&ûÕíú<ë²Çí5Tĵ—ø¡ö’,N.›ÓDÅ,ñµÐ]Þàý÷2ƒ1)ƒÁFƒá † Î`Ž
ÆdâËOÿóáìóáÉéTzí à Nüw$¦bõèÛVo!b.…6XeeµÛ/ $l7À. \Køb±²c K2ä:ÄïÅ’´¹ŽÛž? endobj 1310 0 obj << /Type /Page /Contents 1311 0 R /Resources 1309 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1297 0 R +/Parent 1303 0 R >> endobj 1312 0 obj << -/D [1310 0 R /XYZ 56.6929 794.5015 null] +/D [1310 0 R /XYZ 85.0394 794.5015 null] >> endobj 418 0 obj << -/D [1310 0 R /XYZ 56.6929 769.5949 null] ->> endobj -925 0 obj << -/D [1310 0 R /XYZ 56.6929 749.9737 null] +/D [1310 0 R /XYZ 85.0394 494.8753 null] >> endobj -422 0 obj << -/D [1310 0 R /XYZ 56.6929 262.7954 null] +1193 0 obj << +/D [1310 0 R /XYZ 85.0394 472.5641 null] >> endobj 1313 0 obj << -/D [1310 0 R /XYZ 56.6929 238.4558 null] +/D [1310 0 R /XYZ 85.0394 284.6288 null] +>> endobj +1314 0 obj << +/D [1310 0 R /XYZ 85.0394 272.6736 null] >> endobj 1309 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R >> +/Font << /F37 747 0 R /F23 682 0 R /F62 995 0 R /F21 658 0 R >> +/XObject << /Im2 984 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1316 0 obj << -/Length 3978 -/Filter /FlateDecode ->> -stream -xÚZY“ÛÈ‘~ï_Ñl‡£.TUÌ“<#ÍʱÖx¥ž];Æ4²±"š -s½9\¥×;hûñJpŸuì´ ÷úÃíÕïß*{íŸÉìúv;šË%©sâú¶øeõý¿½þóí›7kiÒU–ܬM–®þðîýDñô÷ýOïß¾ûñç¯o¬^ݾûé=‘?¼yûæÛ÷ß¿¹Y gŒ—<Ã…oßýû*ýøáõŸþôúÃͯ·¼zsÛŸe|^‘*<È?®~ù5½.àؼJå¹~„JšïåõáJ•T¤ì¯>^ýG?á¨5 ]âŸQ.1NÚ%úE꯽½¶Æ'™’*pð—›u–¦«œËÓÓºmΧMInÈ‹âT¶-Uþ–š”JÕñïØB•ÿA>\K)aÓìz-«• Óÿ.4 ‘xcäõ¨¦4ú×ÉzÇæÔ-,6i1¡l¢Öß¼ØwqQìºVN&&38
ºÀ“õCö[Ù¢<ÊÂåŠÿ¶˜o^lÊ-u¢S7cËÿ~‡¿+EÏc«º[]IP‰„Jaº¶<=”'R™]Þ•‡²î¨úCù·4•uÕUMM”¼.¨ðs›ïJ^JV‚}yŸù°Òí}Ùïg$å.É\j 3öá
<ŸK‚ -XP7î6Ú[*Víl©º¹ÏOù¦+OUÛU&v
ýß•ôŸ·m³©`š‚êUwÏ-ôwºnU š. «:?ðPÞ$@
Àôjõn;y¤¡¸§Ï4v_ÞˆU½ƒèº\¢ (öä¶*ܨ‚Ùå¦Â±eñ -)fÕÝ—Èr%ÃÐå”×»’ŠÍ–G…=µÔ-NµipŸ¸—vªR½ú©Þ?QLJ…CÓv³•74M/
8Õ>?·<"? ÷UÉkÐü»<üû c86†gMã! ÿiU™†úGa«jºó -ž9_8–&`pxÃUù¸¤\:qÆ=;ÊŒõ$Ýæ@ö‰Kž^óåul -”çÜ3ÏÜåp ¬¹US—D'Â$fñîtš8k¾æò¤Ï–oQÍŒ‡%ƒnÀZÝ}Óòò(ë‘Ú‰eØÑ)©A¡ƒÂwjŽkºaEo'üT㛀X*)á³ vu3h¶i¸Ð:<T€&¸4V¶aºYâµ -^¢tVgatG84îÓ³!)¢îÞ-{WÖ$FôþÙK* -æʨ¨ÏÍ‘] ˜½ª‡Uhd‚ û ð¿Û7w¨
†¶T¹µýÄÓ0)XâŒR€d~@å ªùAíËE¯R;܉Ôåâ±Mâ™è n' ™–¤,a#óBDXBÚD¥ ` û…S9 -&°/+µt> -“cõ¦Q‹ZתSo¦\# ’6›Ê±YmIÛÜHÒl"!m*ØfvÞ3ô5Óe¬™KkÙ½óÚ¢´Bk³ ö°€L €ZöFëåks™y&0{Åð
>'øD^]…¢™²¯›2Œ´^†¡e
<“È; -Rú5ÒJ1л¿¼Å œÒ35 ´–QD©Ù?Âæ‚›‰ÓØï|¤¬¶³(-?wÍâN ->õjKP¥»< h´îk˜"¡âí=‡¯[vˆC@ Ôæ!&¿ qþݪ.ƒ€B+ ;VŸã^ÀšWÿ¢µ¯6÷T ÞOèûzvú¡}4Ž\z,qù¦ûJ:Â74õ׫ÜÈ+ÃÑK®˜Æt¡÷拆rÝ÷š¨b{ßœ÷¸KpBóýcþÔRù±9}BÍÉ2öv<ŸŽödž$ó—àÜÉD+e¾Îµ•ÑID®-¥Ñ½½¬qÖû Nò¹*þ7 ïOá@.xÝá”lÑû~ä=@˜ :33Œ"äÔÕÅÛƒBÊdòz™‡RI@æû[Øë® y% 1h…2ÉúRO8IuàÅní%*Ù_±Ú6<Kù9? ë÷XñŽ€ê·È×8W•AÊG€rwÞížf¾Í)oïcˆQjÓœN7nu>vÜ€•øøPbæÌ -jÎFKËÍ€#$QIŠü - ¨Œ(wO ‰©ã)šsG‰>lìî+&s"‰,«8MÜbµW
Í\ØDñßgÀŸß’%0¸¥Yu:܈ò«HYßž÷Dc•³)ÀÓª½§Æp,Ñ='rÌز§ôø@€bäža-ÎÁííq¤æ¼9ݧ3â–’$ývÆ ðF@8þŠhÛlV÷å«9–
nÇÐó0=KÍäÝ`S÷’jW±Ä ÖˆÑÙ#¯ j{’¢Ýd¢‡ÿ¶xÄ‚¦³æ òÏ_TS€+ÕÇ#½PÕT¨ˆ hÜ>W‡ó+²ÇCÅ:‹íe^‰h<)0”¢Z -Õƒ-F/uÈ|ú™V©¨U¤¥:Q*©i¯jRJR5)ùí¤jHaUCâXÕ°©W5l$ Dr|s"»¶’ “€2¨R§ª¶V©`å -ÓÇ - '0ÙMr¾¶Ñø!9 «§hÁ Ù¼a—EÙË5Lø¸˜‰621Vš!£EÈ -”Ñ[C|‰yyìLƒd|å -*RMÄ°{Í)3¨ŸëöÑ5MÁô'¢ó—*@ñ<ÿ@qÉg¦‘Û Ýy·¹)&>ÂD6Ðû¦è Ó‹èã?͉%ðËrŸy½ú+Ba°·Ðž±Þl·OTá@4䜃ÎP9˜SýU(K‡…œ'‰º‰spöÙ]JŽ -¼_üè/…§ý¨éXÀB„z’« Á/æÄÒo[ÌÊ$uý+cð ROù -tž§ïëJê u ½õaåÑB´…à‹ŠôÂzVfk=1·‹o.6Q¾çÿè—¦‰âi¢2ë¦jvW΂°Ù&f!ÙÀ{¾
¸©¤ë¤íÓQ–.PöÕ!ß6ºAP¨Ï‡;JXó ÃÉzs>
n!Òªú®9m‚JÌ+Ši^qb‹Æ‹Løæq½«òç3t” «–ŸRºdÿ™À ì÷Äͳ¹#ƒ;ûÐcì&Fž{—LÈ7’{c ý–KBt6äKú=¯,΋Rfu"u:Ñ’øú*’Ô‡××£wXZùõ©|º½›4“óè]CôQ€(Z¢,}„àT¢‡½Â"óÏü$~¶¡µ„ë‰R~͇~2ñιåÏüÖýŒëñ”á¾Ù[hµRbX9(K±„ËÄ
×?i*èØ:ô¥| ˜§ÌŒs&§ˆMnüÄÖaÆó›;”ÈVàÒ(8øŽ¢ - FŸMöÝ×£þÄñéËÚlVÜÃÇ2îÛY0ªæÙV2·£Æ;yöÙfìóÂò³™†Ïöpé˜zÈV]¾çOð9«ármí4Ûà²)rYˆæÿ‹'²Á„÷#ø½Fñ
»/®‚/Þ¼<¸P”WjçÉ\ÓøÙš3»:ïÎ}ºÃô)4âÿ»².OôÝ VÏ-±ÁÄp ¡Ó„ -„!ÎÁZp´Báx„˜1vB‘l&SúÁ!]gÊ®^/%@¦O^!ÑYíª:ïzœ=/åë&ðMÏ%fx7¯ØËŸ"ø]ŸØÕ±íî)®'Cþ`âb1úzžßyNœNy“XØòºPA›[—ŒœOlf²PÛ$©xö\‰³BÙ<¶Tð…ÃyßUÇ=wÁ91ÔRø¥f°Ÿ ÂlF™u¥Ú+jeþb¹âl€ÈtbŸ}a5r(öÌEŽ=ÙýYú\|ÜX€´ÿŽö_þP|øŠ^ƒ?çœ\†•f‰“ÞÆM…/vŸÁWÿEùóÿ ™¹lùendstream +1317 0 obj << +/Length 3317 +/Filter /FlateDecode +>> +stream +xÚ¥ZYoä6~÷¯è·m#†‡(‰Ø§ÉÄ“8H&» y˜ ²Zm «££ÃvgÿüV±H mÙžl`À"‹W©Î¯¨b£#i6± ™æBo²êŒonaìû3áæ~R0ŸõíõÙ7ïU¼1ÌD2Ú\ïg{%Œ'‰Ø\ï>m#&Ù9ìÀ·ï~ùðþòû_¯ÞžÇáöúò—çÔ|ûþò§ j}õöçŸß^"Ñbûÿº¾¸¢¡Èíñíå‡ïˆbèñ̦Wï/®.>¼»8ÿ|ýãÙÅõø.ó÷\á‹üqöé3ßìàµ<ãL™Do Ù0Fnª³P+¦C¥<¥<ûxöïqÃÙ¨]º&¿ &¤V À))^8–Žàp¬k†1K$ON
7LÀ?ØRÂÌ„ËQ'RÌt"„faobmX¤¤²:ÙµÍáïP60]ͦƒTb Æpλ¾ËAœa¼‡ê&o± m›=Ñþò¶È;êì›–wEvG{¿ºËÛûÜïŠ.k°'’-q +¯ÀóÝ¢’ÇB£JŽ²Û}ÑÔiY:ŠS76Ñ0V4+CïÔRÌižy{Á¹SÖ ÀJë¶~™_¶&!Å%ø8N +–ˆZ
6Wb««E…) +úG!W¾|Æ=§Ü=ËÙνÜ(‹@DPBħʹ¾:DO +ŒÐ‘®ÒOr -½3ÓŠöi%BÐÜ÷T ¹Ôˆ£ž$BBé†êàŒ2¢¼i'
TñÙËÛû +@ŒoVÊ*ú´«_¡¬Hûâk‚XWºŒ™Ë‚o ¡ æ¢ –…Ò¦Ü版9KB³d" à¶ÂKÕÕ‹QD°0âúÅ("´ü.Œ Ô&®˜ð±‚‡#åÐt]üØž…'øN‡<+öGGt R a:95 ápðP¥,ªâÄÉG»Õ'z·>ݸ…éÌ{oÜì¡[—ªÔPv*y¥¥“lWü¹&W¨°¹Òñ(z¨ÎtdÔópjB(ÛO
Fœ•Ï¬Š²/ô«¢&ÿ gùŸ†h§‘hBLD[&‹2ܹ#~YB$í¹sàä·s
!¿¿ Öw3ô«ÊâX%µÔzºàsùü— ³²ÈÖöI˜†÷pÓæŠð<ÁLH²f‚
+LÐX$|>‡½8èvzÈËrI¡õ‚uˆ ´! +e Ç=]—–aNÂâ&½TÛ š‡ Ñ@[D'¹mnHznH0‚HóÑFí
¦œXƒ £Õñ´²íúiÏÜU‡Ú!G˜ã
HÎÙf‡ “«Ö2rnæ8 l¼ßt¢jv!z³ }jB +¡ðü°eÛ^ƒfYžïü -’æi§sí6¥3ÊÜ_®Ú83ñŽáؾŠòìíVдh‰+w3 Ô”#(ÃO `tñ!¢…ƒ+S#01[s +`Ÿ¡ÜõÆ¢AÆ¢”ÚÞ-Ì) Þ *_q‘Ó$6-€±7祵arœu<8;öï²°cÌ«öª’ûµoa!@½£^J®JÉ£¦Û~»jOOàX :¯Š‰YxRÝa÷N»ÜÍDSþšƒA¡eîOqÕß|sú¤°bÉxÖ b<u-a…»Ç0¶
¨dN^û-÷M U鸟¿H ® ª*õ9ÐçÅæà ¯g® V œÍ…ŠÿZ¸~òí +>+Vá·ô@ØŸä;ÈC{³‰ä” ŸÒ_œµ7+6¶@ï¾È l89îÅüÈôp(é÷vÃCÚ wîS˜NR•Ø>¹ov Z´=ùÜHº¸–><êY$€ŽÏ<Ê," +g2”¾JjËïê/AÀTb“¨Y¾TXðS °'8ùCËÅVꤣ¡slï–©ž_ôIo¸f ÔÚÁEKí§iî’+d< °Pó,XaÖ.G kU>}G Wí! à~GÕL©§O©±ûŽ:ÿNó±åÑ
µý¥R›"ì[‘ðÉWT¿Gû‡/€7ÚOß Ú|_<–yý™þkßN*fðþuñnŸhÆMs‹šØtó¥i¿`¤Æî?éñyÍbÜâCÛÜ»<( ÷í«{¬ýV +$„?pZ‰–|éßþ Õô#³âi’Èõ°ë~¢<SVkáÓTv®"¹Âúÿ endobj -1315 0 obj << +1316 0 obj << /Type /Page -/Contents 1316 0 R -/Resources 1314 0 R +/Contents 1317 0 R +/Resources 1315 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1297 0 R -/Annots [ 1318 0 R ] +/Parent 1303 0 R >> endobj 1318 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [116.0003 115.3513 166.1092 127.411] -/Subtype /Link -/A << /S /GoTo /D (tsig) >> +/D [1316 0 R /XYZ 56.6929 794.5015 null] >> endobj -1317 0 obj << -/D [1315 0 R /XYZ 85.0394 794.5015 null] +422 0 obj << +/D [1316 0 R /XYZ 56.6929 644.4755 null] +>> endobj +930 0 obj << +/D [1316 0 R /XYZ 56.6929 619.6136 null] >> endobj 426 0 obj << -/D [1315 0 R /XYZ 85.0394 708.4928 null] +/D [1316 0 R /XYZ 56.6929 131.4228 null] >> endobj -1208 0 obj << -/D [1315 0 R /XYZ 85.0394 678.3234 null] +1319 0 obj << +/D [1316 0 R /XYZ 56.6929 107.0033 null] >> endobj -1314 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F21 654 0 R /F23 678 0 R >> +1315 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1321 0 obj << -/Length 2790 +1322 0 obj << +/Length 3405 /Filter /FlateDecode >> stream -xÚÅZÝsÛ¸÷_¡·“g, Ä'ONb§¹ö’«í{èä2J¢-N$R'RvÝÎýïÝÅ)Q±}—NGÀÅb±Øýí.(1âð#m˜Ie:²iÂ4z4[ðÑ ¼{w"Í$MºT¯oNþr©ì(e©‘ftsÛáåwNŒnæŸÆ†Iv - øøÍÇ—ïßýru~j“ñÍû N'Róñåû¿_PëÝÕùO?_N„Óbüæ¯ç?ß\\Ñ+x¼~ÿá-¤ô8ÂôêâòâêâÛ‹ÓÏ7?ž\Ü´{éîWp…ùíäÓg>šÃ¶<áL¥N ÙHS9Z$Z1(G–'×'ÿhvÞú©ƒúœIe䀥R N™Qð -x³Èq@*:¤"eBJ ü‘¦Ùde}›oN…Oêj»™Å9]öD”© s²r>ÌW aóܛִilœ6[fÛ:¯á(=®×ù¬¸}ÄŽ7°?úþçû„†PŽ8dÂX —œåd>÷ý¼<›Š^L7XÍof4©d© ´Kµ–^ Ûjs:Q<ÿ»*sléÝÖüøCÑ,Âø"§!ZqU5aBoî Ìì à] ¶×÷ùòñT1;M¬_Ò‚vGÜh¿8Òç› òJàux2Êif´3/:òI;«§Š%eP <ý!ýʹÌç Å’ãëbU,³M؈&• ="=Í·ñÌ`¤»-ϱ»-œ{d[R' —Ô/¶8ÅR•ñŒý\’èv¼ªHT²¥ K%ømÐÖ<o²bYŸ˜ÔyN
²^hÌóz¶)ÖMQ•4PÝù’Ä@y©“Z<é¤Úª?à¤R¨Èº(÷±QYP²rd¥bÖ‡(E/7w#j\u`¥Ÿt' ÂÚ!_\ÿý&꣄0Ìî‹”Àñ@–žHøÚR=!È!7„Kp ¥T,Á1a…| -}E<€²j -6
S½±xø$„Üù1C5…"ÊË
© -‚çÃ" ” ˧¨¨¦S»ý>©Þ«³]ÅÓNzåßÈà
W(4‚B¡ÕjÚÃÚ±Žqéž ç\Lè}RÊÛªÎ÷—Þé:±R5m
í¿W {PùÛÅ?c¶` ]0{éæÕU7ûÖ¿SéÑÞƒ{rj>Ѿ F;© Ê·g¤O\ürÓçkM3¨4$¡Ê!D!RÓèj»lŠõ2§^')n Œ I6[´sk8èà"i0¹4'ÏÁëhÉyi¸ÌVùé¯
¬Ü»ÌTÙ]¼ ÈÔT³jyãCÙbu¶—eµ—t¯3ˆ½&ébÔ:x5ì&ë]ÞõgÒ®±#)"åáj—"Š"Þùß˿‰ƒ ¼¾ ®¼ª`Igô^mø ªÕºþÜÍÓ÷{•5³Åd¶,@’6Ÿ÷,L-¾xŠ/K(8þû«¡€N| ãƒãöêûc̺Bm³kÈF&äÒHÿ˜×_ªÍ—²zºFðê©ü=lHù1ã ’=L@dûÒúÁþœÉ ‚Ÿ_$ȧ,àX H ~î—?äù§ -/Ó.Û÷€.e -§ï'`dø„€©dVò¤'¡=Öl˜µ"š|u»;ß@Ëý¡ ðÐ5í§Š[±¤— r17d\Cé˜RŒ+£{·ÌôÍ—j0h„‘«
³4€VæI{—É¢ceØ9be ¨ÓíÊGLCBnìÈh¦ä÷0²Ào²c8dcPmâªß°1‡ÿßM¼ÈïÛ⥂%iW¸cæe·m &LrýÜqó2 ²2æ5ô¯ÈOð¯&wV¼ÍMþô?Zv÷”$‡/¿ €±Ä“ ”Ï‚Ìäñ¯/‡¢ÿ¤¼O endstream +xÚµk“Û¶ñûýŠû¨ëX ñ"É''>§Î4Nê\:í8 O¤N¬%R©;_Úü÷îb| ïOG ,€ÅîbŸ +9cäG‘WÍ—¬] óý²)/T w—Åá! bˆa—}~6‚ í!«šuqh¾hõr] vYKÀ_cS«®Š%L¸ ÿˆ®nÞtKÄxÓ‡˜þTÜòºÿÐ_Ó Êêj„àýý#Qzßþãùœ6õñ°*zN˽þ˜åyÇ!¢©‹”L
`ŠRŒGô?d"—¦Éé +¥!ö 2R1|Ã@{l¤ìÐ q¥„#Çðmv] HƼÆߨ44êUN§)»+DÓòžs^IÙbvÙ·Åœ~3qZ…9¼ó”qr à`S)' ¶K»L%% +âÕ¦XS˜F: «‚‚fÍÓÛùì*5‘]~ö˜‰B¸2*Øs½ç°—U¿ Q@!Ørž +/ €Ð˜ŽUÇ@ Dó’ê_ŒöåjCÍóvÈ¡ë8tœôÃø` ¥ôØÊÃöuû5´tpß0Ô ¯²ƒ¬ WÏ¥bß>œ3Êe7k$‹fS ·H%$¡Ùö&ÛtlßÔ‡Oh9IÂù!ÀöÇÞʞđ$î>wne¤•2Ovç:•!ID©Í:J£;#zÜâRçF~’ù*ùߟ´O¼?y†¬Ïº=— Ñ»y”=@™ 6“Ž³(2šjÃéA£óÊò:‡VAŽÌ*ηpÖeíï• +ýŒ4;T`¨L<¹OªÀ’îZlüÐyw; É%ÖM"&Ôµñœ,_O"ˆe _^ýDcôü‰ .Û-iŽe9ˆª-éÊ +È´l64èÙÒq
Á3çà£@kàt½9x1JÏ°p0£]<ÐŒ‰#%ÑÝuF iÆÕuä 3,€rüÁÖÁ±y·º-^L}YŸvŒ û<¼ž¥áÊnp¨}Ì´ËÐâ kèˆ1Ù£¬ z[Ò¢«"ÿ<gš‚¥³å>'˜1SpWª«G:¥*˜©PÁƒbpû\îŽ;ìÈÎ *¶Y /ÿJDëÉ€¡ÌR¨ÎÙbõRù›O7±*¬Š¬TGJÅ3íLMJI¦&%¿ý +‡Ïrf¬Õ³"»—@¯±PPuOBГP$bÇ?_–`Œè½5Ô—x/“i‘ ¯< +}¼…ÿÔˆ
ÿf»¾¥¢þÎÙÛ µ}8MC¾ +
é°‘1’`›ˆƒoŸí}—#àw–á,:KÙ‡ïÂîùbP,ç¾ï‹»ï¾økÂþSKFÊZÙ}(8y¸H"+]ˆò_B˜)åÝg‡wIÿ Ýíúendstream endobj -1320 0 obj << +1321 0 obj << /Type /Page -/Contents 1321 0 R -/Resources 1319 0 R +/Contents 1322 0 R +/Resources 1320 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1297 0 R -/Annots [ 1323 0 R 1326 0 R ] +/Parent 1303 0 R >> endobj 1323 0 obj << +/D [1321 0 R /XYZ 85.0394 794.5015 null] +>> endobj +430 0 obj << +/D [1321 0 R /XYZ 85.0394 575.952 null] +>> endobj +1214 0 obj << +/D [1321 0 R /XYZ 85.0394 545.1349 null] +>> endobj +1320 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F21 658 0 R /F23 682 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1326 0 obj << +/Length 3013 +/Filter /FlateDecode +>> +stream +xÚÅZKsÛ8¾ûWè¶r•…Ń +FÇMfAo* +î¢ ±P,–6xÅó(Ńyë,C¶w¦ÒCGÄ ÚºnmÖ ùŽt±(Â˼Xùye;ÿpÏRr'ÉpϳwçQ/‹#&#žô¼‘yÏÒ‚ñ$}W¹_pEË`¯oÙãØZqÃÈ©T”Ló%¸Ù¨¢žt,R‹Ú½Â"C`” Î5X0€Þ±Uæ%Ð(Yb ÆY#qÖI¨××?1Æ´+»`YŽXAHfÛcZf¨uá #òпã'l,³J 042Gl:€
„ÀX9rëxÃSc ÀÎ/Ž“.Ш£Ê ^óSÇGr pAp 8í äüÆ5¿¹¾üp6<k™ûvo˜Å Ò»ÝjB«ÎE†Ïºã¸‡ë,ìÛÆSð¶áV„2,6F÷örpÕ5£žÙ¡4oAx¸ËÜVÌ´N×ß\c·;üEÀa᦬3ÝïXòé?½ ¢3ãû>«jêp·Ÿ›ZÔO¯çèŠ; ÑÉZ8Øœ·¸¦NkBG•¯Š´ÞS?vYº–ÜKç`ð»ÊŠl>¸¤Ç}EfЉßLB?&½‹:î²V8@Bá»Óí6+–aPõD&ÓMVUé*óOÏr¼ï®=uTË]¾ÊA¡m;×M³»§E€íŒØqGBÚÁß÷95–} ·4Z2¼C õ‚0´bÊ5:p|¾®ïÊýê¨÷›ÄÆj—n6éŽ ðæ
oÇ®º¼X›g°[3.Œ`7JM×ëò¡¢¶llöë:ß®ý” +ÊŠ¤ï¨ Z±öV¬öÛm¹«= oü. ²á•=FX•ûÝ"»Fáf‘I`è©£r•ñq¹³{3"ÚÉ7qܳ<zF¤)`nQÕÈx…ÞË_î#êr㻌ŸRRÀ.2?d¹$›U^¦óMx1÷ÒÜ
AFOàªTb + +ÞQtƒ(0Õk{Th +©S,å EW’Ùÿu‡ r!é¹fUï\2ŠÃB%õ©vwüc9ïçÃq¯—ë~>3ƾ|ñå þÞÉ}~ÿaÌÖ°ŸÈ2kxû]Eò—ù •Êò–ÚÐm _ñîñŒÆúÑÓŒ#Â:?<¡C‰:aR6Ÿ :UyiySÌ«èñÝÇëë‹·Ô¦"ZýHOTY(ëŠQ"Ü ™WAá¹ãØ] 8ÅldÕD!Æ#ÃyšS6ãgÝ cTn(·Ï)a3³»tM8$]á‡t2ŒznÒˆNº*Ày0é¬0ÉÓwöÆÞ {Ó“³0üvj¯Rq_®ÃDì ±ÝÏ×ù‚Ú®2ÑfjÊ•/ð§(‹Yº¯ïJX/Eø§nÿCñf½oEùP¸”MOç{¿À«"llî§:gqèI +Oeý\j´&Ã'ŸÜC« çålÓöÃN^Xi_Pµ‹Ô§ÂÝëÚø#BmOïÒŠz晫…j÷! Ïoµojkn¢ —Òc½;µSÑô Ši® îíà w8«&YiÝni@˜p—.Ã~NÅ”¶$¦÷é:_v&~Ж¬yŸcZ·ÇíoÚ›~±*×M…1p¶µGÈ7 í×nóæ +8Lu¹(×g0Vx•ÝmÎ,«©Ñ½Iáî5Q£¶>ªA›´W»ëÏ$=±#ÑÑð(i)¢ðñ>Ï þ(ÿ&HŒ—õmåL¥4°R=°ÔgHV«êK—§.âMZ/îf‹u;iø¼ûÁ¼Ðâ«ñuí +ØÈŒBÇ?fÕ×r÷µ(GsÑÍœyèß<åGÆÿDRÈöµ‰ƒÁœ±ÿ^“ã¿ °DÞøßþϦöß¾¢˜)kå8Ý” +endobj +1325 0 obj << +/Type /Page +/Contents 1326 0 R +/Resources 1324 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 1303 0 R +/Annots [ 1328 0 R 1329 0 R 1332 0 R ] +>> endobj +1328 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [370.941 719.9611 439.613 732.0207] +/Rect [87.6538 683.0228 137.7628 695.0824] +/Subtype /Link +/A << /S /GoTo /D (tsig) >> +>> endobj +1329 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [370.941 574.3534 439.613 586.4131] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1326 0 obj << +1332 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [432.8521 465.5772 481.8988 477.6369] +/Rect [432.8521 316.5051 481.8988 328.5648] /Subtype /Link /A << /S /GoTo /D (DNSSEC) >> >> endobj -1322 0 obj << -/D [1320 0 R /XYZ 56.6929 794.5015 null] ->> endobj -430 0 obj << -/D [1320 0 R /XYZ 56.6929 621.0496 null] ->> endobj -1324 0 obj << -/D [1320 0 R /XYZ 56.6929 593.3949 null] +1327 0 obj << +/D [1325 0 R /XYZ 56.6929 794.5015 null] >> endobj 434 0 obj << -/D [1320 0 R /XYZ 56.6929 514.8384 null] +/D [1325 0 R /XYZ 56.6929 474.1474 null] >> endobj -1325 0 obj << -/D [1320 0 R /XYZ 56.6929 484.3742 null] +1330 0 obj << +/D [1325 0 R /XYZ 56.6929 446.055 null] >> endobj 438 0 obj << -/D [1320 0 R /XYZ 56.6929 330.8003 null] +/D [1325 0 R /XYZ 56.6929 366.5019 null] >> endobj -1298 0 obj << -/D [1320 0 R /XYZ 56.6929 306.1104 null] +1331 0 obj << +/D [1325 0 R /XYZ 56.6929 335.6 null] >> endobj 442 0 obj << -/D [1320 0 R /XYZ 56.6929 176.7683 null] +/D [1325 0 R /XYZ 56.6929 180.4336 null] >> endobj -1327 0 obj << -/D [1320 0 R /XYZ 56.6929 146.3041 null] +1304 0 obj << +/D [1325 0 R /XYZ 56.6929 155.306 null] >> endobj -1319 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F21 654 0 R /F39 858 0 R >> +1324 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1330 0 obj << -/Length 2380 -/Filter /FlateDecode ->> -stream -xÚksÛ¸ñ»…&Ÿ¨™ˆÁƒ/ÔŸœœ“óÍÅ—:n;Ó\¦C“PÄ EêDJŽÛ¹ÿÞ]`Á‡ÄTrïF °X -ß9ðöæçk ½»»zÿþênþùþ§‹ëûN–¡¼œIä·‹OŸÙ,±º`¾TI8{„ ó¹Rb¶¾B釔S^|¼økGp°jŽNé/”‰ &"žP àS - • I!sÝ´E•¶E]5(
œ‘ƒ3°•«$€‹psV¦»F£ŽBåÝ,ç )¥W՚Ί_: ˜0ð êvED‡ŒpÉý-h©®Ó6[-²²ÐU;ÅCºŒTL»Ó*Ÿ )@{`ÂÅ¢)< Éõ2Ý•$I[ÛÑÐ)ª/xz¶QèBŠÙ‚s_…¡°ü”%º„òÒ<ßÎyâé¦Ñ"ï¦êÖ -äÃÎ<ŽÙJg_‘¼™Ý|˜ 3%ªü8ç:S{Ò$ÿS{\ùA†ÏÑ^‚G„;’¥Nв!áÚô«ž¸j!Uì3t呿ꧩ[@Ô( œû=®ŠlŠocTTï‹\#BzÈ -„BÀ*)Áœt¡ vÉ£iÓV¯‰s [ÐØ_*c00jkQ¿ -#Ƴç8”e¤€ ôpKS—{tsYÕ cguÕêom'ªÑÒ—Œ ć=…™Ü6í„6$¨rÎImD"v*#× -¦ÆF%õÙ ‰q4¡¼ƒ‚-¸?ŒÖú°Ô¤kZª:ȸ¬¡|›’°ÈeƒyÊX^,Ñ—Úú¤qbØâîQ^ž¶©ÅÙDÀ-}A(S¶`œ$§œz_‰Ù8©™4Œþ¥¿¥kàñ%93Ô²b`[¥%‹5ª[†ø8XîSúmEgìÐlJçÉ?Ü~$œnw¿ãjàÉïÓ -óa(¢Cé [øÌÄé -'Ñ+Å\V-Üñ}Ïôzg:äš’t:((ÉBÞ¡ ‹.I©¼)zûØ@Æ0ÀÍËÝV¤’ÕëMQê|áLØ»/]ÖLfo£¾Pà%Ʊú÷ª=vx%Œ‘ƒ@Mõ@ײê - @khÚ/v† 9aµ&†R zEˆ®A µ^tÈV&Þwx«[ܵ5ì.2°*5I‚/¸ƒ´œYU -ôb£ødè™q_¡ÐÌIBÅ2ù^â±€ ¤Îª L©d¢z -N` qƒŒõ£ j pj©F11º õµíÓ£ýD“Kt‘ -ò¢©Þ5ô ëð]ïgèþ?9ÿb÷J5ú¶‰€%ÁØ6ÙEày/\³ÿÂÎÿc”%Cxe†ÞW¯ì–{|5«zWæ¦7‚5GÛÎ*Ý>ÖÛ¯ƒÒqô¥{HXVÌÀ™o~¯’K‹øýÒ -'ÛþƒŠáWo÷EFŒÑc&G `Ùœä–èbÊÃ}Oº9Ÿ§”.ªÑ)ZBöA73ìh‰œÐÏð³"\À 2ånƒ²_îrÓ×›ûò|k?\Žèņ®=4ŒèÃۺʀ“ÓÞñ¡g4pÕåä#´(ˆ/ _~þðâ’"wŠþïg,væ‡^ïÞ°ç{ýûÞ¿Mçvä,æ£{ šÂâáéÀœ›Þõ®éíþÌx€qV Üéå®yF 8•ŒD;Çû«úÙÎÙn‹¬uZú3ÝŸºåÎÿmïkT¿{€¢êfÃoR8„ò“$VN8K B`’þ!`êK‡^â弄#ú« ÿ^Ú3ækÊÓÇá×æ½Û¦ë5´ -ÇåM úLÄñ¢ú—ý †ÓO¦½ý<ÒæiMý›"ã_pÿ½±NÜ?üO_ÿ7(èL&‰èÿĵ‡ ^¨ú1bÊ(6>ä¼ûKð˜õÿxÅÃ…endstream +1335 0 obj << +/Length 2914 +/Filter /FlateDecode +>> +stream +xÚZKsÛ8¾ûW¨rYºÊb@€`sr'㩉'ëxv«vf4Y¬P¤F¤ìx·æ¿o7àC†#e6¥6¯_ ¢ƒ_4“IÈ„Šg™ŠÃ„EɬXŸ°Ù Œ½?‰ìœ¹›4 Ïz}sòòÈf*T)Og7Ë/2)£ÙÍâ×àÍç o.®Oç<aAžÎ“”¯/¯ÞR¢Ç›Ÿ¯Þ]¾ÿåúü4‹ƒ›ËŸ¯¨ûúâÝÅõÅÕ›‹Óy$“Þç–Ã3/¼»ü邨÷×ç >œ_Ÿþ~óãÉÅM¿—ñ~#&p#œüú;›-`Û?ž°P(™Ì ÁÂH)>[ŸÄ‰“X×S|:ùGÏp4j^õé/2L$Ï| +T>&*LF¾Â=¼|Ç£Y…*I8Ne³y,C%$7“P1œƒ–cÁ}© H Ÿº¼Ók]wÔ|«cŒ×eW65õäõ‚ˆ_ÚüNÛ…ÄH$X‡'a–ÂAã:7+ÝK3LŠ,®p»8Ç,ÿ”ÃTJi'µcÉÒ lé™ÓcÓ<èírWa+ –:ïN£`·=d ©¯YÒL‡¤””Ý*·<+ÝM¹ÖùÚ¾Ýêí½ÞÚÁº}èiz¼½úDÄ ;½}$rQ.qù¥6RÌqƒp"TQ¦fóþd`k°© +_Êd°Ð]/ÊúŽšFëð|X5D˜mÃ3o?Ã$€¶P"¸ì¦ƒ›|ەŮʷŽí®Õ¤ —ÍÖN_o*£Ñ~¹vS•–íût·ÛXÆe·jvÙ +s{ «]å÷Ä Ñ5ôÜžÂÊ7ë]Õ•° µHmØs’a¬xb8]äÅÊ@ƒPÉÄ$!#bDÄAµËºÅf„'‡½}¤ 8ÐbM‡Qö ÚM^Ø~ ReUÑ”[;Öj]uû8Y§ÝÝ‚&§+U Òæ±J‚s‹´ät!4t'³`wÅ +w
ÄŸ”° €»±ah”K+;;©mÈpؾüh_^,ÈBÚ–Þœ°îœåN<Cq[ # |}Ïi + ¶ËD:K “ŒÇǸM *cî>§9ï9ÎÇ,ŸzD!³0Q0ÚOC1ÍÆö…¤„,ƒ¨óÝ„ì9 2æQÈR8ä‰UÙv>P§a–EùÍr8 C €ÿÖz BB–2g FÎ q &‰’>Œµ „€(“: Š*w‚–
0XCb¡[ð'9 ì@°™©c°aG6l<6T&ýÊÏ‚M„"|–‚úÓ(ãßl–ã|ÌÒ¶4éhá¯`-
eœeßOÆžãcˆµOo"äsXË +é^ª2= +_‰”}e¡—9FÚ †M|>Láè˜#ÇÆšW&ÕQc³ÒI„HƒËº ë37e£² +ÀèŠÏ6V+Šû||[…ø›IÈÔžcÁøWµÀŒã$ùíI|…÷ž(wZ»¹.ÿìË7!Md£M´øY?¶Ï$žIìà÷°*Ážá â`cTÔÜ— 4ˆT( +þ +¦nÃ>µTCWÝSV06ªë8%-úcÓú—@ SÜ:*Xä]N}äȸµCwà l— [ðô²SN½g¾š”*]8ý%ÇZ÷Ì‚bY 6°ó +齋
ìûØ \âÖ]†ØjÖ–ÍxaBŒÊfo}û!¯Í
°W™tl(ð™†Óe=Lô +q’ÿê™ÕÍ0aÞÚÂvæÕNYZææðÎF +ûóê)`ëQ*€qª /8ŒØs¸*¶bÅî$•É
èI›ˆâ¾c œÎ(FZs…)8•MCXå÷z‚f«vî$/1ÒØwýÛ'êžá$:>²ô»~e/¢ ¨Øöôà ÓŠlÚ䎆ÚØLE/t]ؾÆÞÿ!×ÆquŽÀ¿ð½PÕÅü(ÃdÑ“tÁÆC!#Ì8â©ùçiÁ Ü-H +( 0ˆžÎ-íÓ—Gñxøòj:
vk½°|¯šÎ®n͉¥¶J1‹Õs÷úý ôzg2”’’ÜoÖÉ‚ß±>!i]y[çC.À †!.¯œï¦= —ÜE³Þ”•^ÌÝðµ‹ùo'ú¼ÔÃír4R?Œj=%²€3fGxÆ8V¾¼ø’¨Î¡@h
öŽZHÚ ÇIk|¼+Þ_ó÷Ù9ô
W~øE¦hÈ:qU7¸ë˜]pª6Á+¸=·\*@t0÷H‘Ø‘ŠÜ1`×åUHÄyýèMÙâ"€S–ñA eA©ž~ °KL¼.ßÔ4`´gˆfC#•¾×õaH MŠzï¶öN GIÓD÷'og·åÂ"cáRë,Ì>ug&«‘ŒB,<ñÊž(ºàCÅË12³!BÑ-KùœŠ2 H ;˜R¾o-ÀÛ–@¹+Y¿{éÄ<pQ{ K#ÃAµe ¿@ÚT”·FePè+•yÊ·£c€5ô‘eöŽ½uÙ3.Ê£7ˆ¹P‚ˆ +k¿®úr«¿¶Ï¿{.‰a×"d2ÞÛ69»÷Â%û/¨ý_£,‘@•™ì¼/_Ò”c|Hµ«fW-ˆ¶5’øEÅŽ7µjÝ=4ÛÏ£Ðñ䎥/$HóˆXh~/å+ê O¸æ[*~0dñDº[{…íp¡bäÕÛû²°
´Ñ§BN$À°é•ÖòE—‡ó u{¼L¹]¨APt¶s8„™oe‡,ï}°ÃܾPn5ûÕŽ>“šõèÀn§ü§Û†¬Û?>˜7Ae$Éa´€}h‡Œ–zå-BËjùÜÉ.n_¼²–ëãÿçƒýqˆ}Ô»öxÔðm2·'`1—î½%hkø¥srœ›¾/›];œû7ÚĈ£ áZ/ͧ¨cíÀ©d²µcÐ_7ß ~ +)‡oKÓ¬AáÂ!L[¡Ì K²}Éû?³<ý="c¢endstream endobj -1329 0 obj << +1334 0 obj << /Type /Page -/Contents 1330 0 R -/Resources 1328 0 R +/Contents 1335 0 R +/Resources 1333 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1332 0 R +/Parent 1338 0 R >> endobj -1331 0 obj << -/D [1329 0 R /XYZ 85.0394 794.5015 null] +1336 0 obj << +/D [1334 0 R /XYZ 85.0394 794.5015 null] >> endobj 446 0 obj << -/D [1329 0 R /XYZ 85.0394 122.2879 null] +/D [1334 0 R /XYZ 85.0394 731.1791 null] >> endobj -1228 0 obj << -/D [1329 0 R /XYZ 85.0394 95.0525 null] +1337 0 obj << +/D [1334 0 R /XYZ 85.0394 700.243 null] >> endobj -1328 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R >> +1333 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F21 658 0 R /F23 682 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1335 0 obj << -/Length 1016 +1341 0 obj << +/Length 1132 /Filter /FlateDecode >> stream -xÚíX]sÚ8}çWøvFªåoOŸÒ,ɦ³MwYúDF±ÑÆ_•D€”þ÷•-ì@ -†ffw¶Ã0¶¯¬££«{¥ã‹4]þf;Ðñ
_s} Ú:²µ îèÚL¶]wPù¨^õ·Þ
;o®LWó¡ïŽ6œÖ°<¨{ Ò†á¨ë@ö$‚Þ½üx{usýipÑsîðæãm¶Þ½ºù½¯î® >\ z +xÚÍXÝsâ6ç¯ðä :#Åò·§O¹”¤¹éåZŽ>Ñ £Ø‚¨ñ×I"@Êýï•-ÛØ’™X+ë§ß®v×»Bš.H³ èø†¯¹¾m ÙZ÷tm.ç®{¨|T/æ[ŸÆ½ó+ÓÕ|è;†£g
,ꞇ´q8é;Ѐ‰ ÷/¿Þ^Ý\ÿ9º¸V|óõv +d©ôé¶ÔÌTÍLÙ¢r° „ðîcð$© ³6<ͦ9ï3K™¨åù Ü¡Ü`ò†5’fÅ®³‰ƒ<‚Üã¸ü¥Ûú³d3Ã4ÚÐy’2"e¨µÓ©¯ãÕ»Â-i˜…J¶&|š²i’vV&‚Ìë +˜ŸŠ)ú®ëh
ù6fE™bkBÓ>Ì<9MšÎ.Mφ¦Üýƒhúžáî=«¼Æ\–j²l käq:O8¢¡üªßöT%Õ#=]V ø˜dÔ8™E™Ér衈·7Çÿé ÁÖGA ] ÇB´XÈ0!e$iUàfX<Eu‡åÏ„åÅ›tc „ˆ;Ø[ÿ¨+p5m½wÏ#üD—ù{ÊÐÓëü“{ô1½ƒñZï endobj -1334 0 obj << +1340 0 obj << /Type /Page -/Contents 1335 0 R -/Resources 1333 0 R +/Contents 1341 0 R +/Resources 1339 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1332 0 R +/Parent 1338 0 R >> endobj -1336 0 obj << -/D [1334 0 R /XYZ 56.6929 794.5015 null] +1342 0 obj << +/D [1340 0 R /XYZ 56.6929 794.5015 null] >> endobj -1333 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F23 678 0 R >> -/ProcSet [ /PDF /Text ] +450 0 obj << +/D [1340 0 R /XYZ 56.6929 672.4064 null] +>> endobj +1234 0 obj << +/D [1340 0 R /XYZ 56.6929 645.0635 null] >> endobj 1339 0 obj << -/Length 1041 +/Font << /F37 747 0 R /F39 863 0 R /F21 658 0 R /F23 682 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1345 0 obj << +/Length 1074 /Filter /FlateDecode >> stream -xÚíX[oâ8~çWäV²ëKœÄêS§K»Œv˜]†ybJÁ´ÑäÂÄf[f˜ÿ¾Ps-h´ÚBqœøËw> Ÿãcl!ýÃ–Ç ¢Ü¶\nC†0³†Q
YúÙ}
/ß«—@ùwÝÚÕ u-¹C «;.ayy ¶º£^ýö·›?ºÍN†êl -™Méª'¬}ªýY -¿æq,D•Å4TÈSΩòM¤ ˆí>P*Ü… /Ânɨ ׫oäóµ’9ÍÚ}±¿2´7 })—^ø=9&X5›,G<±º6Ù1B£7íðAŠGíÈI\ÊÓ)W™Àá“~™Mr½jŸý4žý œq’Šõ"\"^]å×v²\‘hŠHÄJŒà.‰QgúVɆÎRM v‰ç‡aò ¾NE:[¡æý:T )‘¯†OƒPG‰¼ÿÇÅ”Üf?œNÊíA2Éfüp„ó8É6ï< Le«:ÆIªU]+£Ä‹š§þóQŠhèh’Y5 ©Tûp°G¤²2ý½"½¬sÖ¾´aáð»\Å ‹Üóïk3+ÃJ~9?†p¯ØŸëF¿ +xÚåX]“Ú6}çWø:#%Y¶5yÚlÙ-™†´„<Q†ñ‚`Õ›H¢ òß+ +vjÀµíê@átRl÷â‰q”u½Ë.ÝÄ`óU€d”â"ÂP„<k)-E4:zà8PšËd8Ær è¬û/›ÚšÏôBϦöá¡"ÞßñTFAxCà9ƒ5ƒ8 +ç‹¡J âP†Ã¥Êî¿g—ü©˜ô‚Á@æ}“XêUrÓÝø „pù½ôòã Äl(Ác ÎsH:Z'à—ŠH›?Ø"2çªË^ íÌ,8Ô©¾¯ ¶1¬ +•Xœ"}ç+Ÿg-Óè®À7ýß1žÙï“-Mf™ a<J¼ä’DÓñ#—'(;Z‘r ÄÀÌ „öÅS}9%-ƧP: +–"Ë]ígÒJeVµ>_ǹ˜8…H^¤Èc`$è9ÄI~I QÈ<ϵ +ýëx>´eü’=3¨Tñ-žà ·HÕ}M•y»f‹Ì¨Ò TéyT±M & +•458IÖÚ›pe#JåzPZŒDží¾M`ìAäø¸4 +¦Šƒò®&âaŸMàã‚Þõ ñ°³Ë;ô"ï @â0v˜åá_ÏŸ·˜ Aœf%~y‰#”´ÙE_°oØ;tpvV16é€äCÉÕSº¸Ÿ½kRÂDËù)S!6M™†Z€lË9×!/\Æ ŠM@ëð0 À2”.»4“¾äßX>Nz“ Y‡O/ +–†vúa Ô*õJל2X=Ÿä#žL:ø®L‹]æžä! IeRاOW®ÿÄû_Ab“ZÏZ“²G‹a Â…E±ä¯R¾››ìÚŒóÙOB>æ‘æ¸OgTª³s©ÎhKg¥§ûÄ Â0~ߦ\Î7çd©âJõLñÕ*$Í?ÞLÉ}3ãòZôJArJýƒ®\ÒþŒeéÏUÌ[†]xBÿ‘:äÊ óv ‚¯X‡\;YÞªCÐÿ¸¹*ݲCWBarRZrDjþ¹I È®O« Svø>^µbR8k%¶ }̼%©ÄD—m3_ܾ¦þ/
$þÇendstream endobj -1338 0 obj << +1344 0 obj << /Type /Page -/Contents 1339 0 R -/Resources 1337 0 R +/Contents 1345 0 R +/Resources 1343 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1332 0 R +/Parent 1338 0 R >> endobj -1340 0 obj << -/D [1338 0 R /XYZ 85.0394 794.5015 null] +1346 0 obj << +/D [1344 0 R /XYZ 85.0394 794.5015 null] >> endobj -1337 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F23 678 0 R >> +1343 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1343 0 obj << -/Length 2934 +1349 0 obj << +/Length 1975 /Filter /FlateDecode >> stream -xÚ¥]sÛ6òÝ¿BôLÄ -&¡äp¬ßƒªMÕ<ü¾úE©¤q[ƸvÉÀϽ{¬Â>'Y£Ò¸LµíkÙéïa§ûËä¼ú§–TèØÚ ,ª41{ñ?™’c)³sKú¿ùS¨“l_ÜŸ×)`% Wý9«¹¿xÈ)×é´•jrëÌŠ,δaen\?T;´‘çiœë²€-ì~r‘öÕî мv= - T”`߸/Õ” è87Z,à-ª%Z½®Š¨îãøC⯶M½p<Ï&æƒHi’=wøD•qžæ© ƒ×ö§5yœ'þ´MÝràmµ¨çÎÒ<Nmñ$ža ªÈòHâ yLjMÇ·áÑÍO<ë–KF÷}X¹’þr@ÆÎ"ÃÚ
’M¼0·€À;e݃[ ž™·ö[ð YVó¤õþbý.AÄƨèƒHDF@± ƒ²gåZF»¦ïÎÏÄÁ üpn@´˜ozqSú®;‹ )Âã^= 4}wdܲZ¹}3¼bí;pÉUXà¼Ø
ÌrÒõWìè8n®£m·ÃûäI”ÆPV/‹ -P8.†
*¾ÆxŽªÕý”úÄ2Qã:ã,iT"gk:ðÁœœGr€Â -{õ¤æ~Q™ªQà>"™ 8VmÏ(r^À¬÷xÙÒϬ„vÝí{8[œôxJ“ÕôLµ%
†`‡
†X¥HÊ8ñÔ°‰ê”Œf†ï Ž -²Çpèæ
˜lÃXÿÝîëj#Ô,£} -^VQøP&ºö¤Õ×Iå¹Í¶©^ŠLÚ¡ - -•¡¬Ã"'µÑG‘ãS—\€i1TÑ „ÿ¶“,ëx ™´]2…dÑ£ -ZI*T>šâûÛoêȸ÷ÀtU¹a?Ƈ:k1Yeu>±Jþ<½ÖÖ°-¡Ò2žÒI -)5§úÿZøïéñ\Ÿd ¹'µç@&mLþ´Âd$+€¶:0 -Ë1‚ R|ÁÚ)°yÛÔ p'a š`8ëÊŽ -†ˆH¾S¦Â2õìN” U²£*$; /. -öºgÂQ–lwõ)-`I}Îî7 ìûù”ž˜¿µÑÝõ;]ê‚£´+X y’Tfí3;`¬>êkƒ XNÏÓ÷Áh×í »ÝÖMäðÒĵ} í›YR˜±¥ïjIAFòƒô½Õ®u
S‰HíèœZ➧Coí7;7¡ç?ëŒ^ÜG?뜞mØÆ^þ‘gÔÎ|c‡”&E¬sìŠ3 g×ùÔOÌ*ü‚úÍ?hŸ~íO¡ç/Š$´dç-|^ÄiLL#/”c®žýÜîùªÑÑÿ…wQÒendstream +xÚX_sÛ8÷§ð£<S±¤Dý›<¥Ý¤›mv/õ¾\6Ó¡m:Ö,yE¹®ïn¿û)Ë©ÒK¯7~ ‚ ü +É.’ér;áÓGX{7N&ôBáPêÍ|òú:Φ+Ò(Î×]9ãy.¦óÕ}²ˆÍ@Þþr{}óî·»ËY&ƒùÍ/·³0Jxp}óóQïî.ß¿¿¼›…"ODðöÇË_çWw´”: onn NAÃ3Jï®®¯î®nß^Í æ?M®æý]†÷<Æ‹ü9¹àÓ\û§ gq‘'ÓL8EM·™Ä,‘qì9ÕäÃäo½ÂÁªÝ:ê?ÁY§Ñ˜‹sÎRª²¤`i ÅÖ÷³0å<Ø ªª »VÕfÛÐ4ûv©iñ¨ÍǦýX74ÀkÃÙ¡¬H’h¨èŸMCÓ©®4]¹4OÐôjVªS eœ¦kËúñk›Åpó¶¬ÃV¯[m6aWn’z¿]èöÅlÕçÿƒkI× ¿I…øÒŽoUqnžêÊp«Lç7}- a³Bpy®ê¯ +r*Ê‹@ÑÜ ¤—ÍîHT³&¡Î«ÀrOä&ýšƒ +ê´H +Þ ‰·ÒkÍÊ+Š¾oFÝåÝ [À¬FSM‰¾s3Ðë eQÄı¯ +Œä + \@.päÆøteعp‚˪ õŠ&T €P¶Ø)°À] Çgq·>ÚV6–± Ëĉ ß×!w¡×=ÎpÍŒ #dY!hõ
!>ŒS•IV9m§í¾°¯ä‰ û¶® +ì¡@õ†àf8@Ó5†‡PUEª4£.#dbÄEB¯dÌ#g[Õ@¦8Î)9pæl endobj -1342 0 obj << +1348 0 obj << /Type /Page -/Contents 1343 0 R -/Resources 1341 0 R +/Contents 1349 0 R +/Resources 1347 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1332 0 R +/Parent 1338 0 R >> endobj -1344 0 obj << -/D [1342 0 R /XYZ 56.6929 794.5015 null] +1350 0 obj << +/D [1348 0 R /XYZ 56.6929 794.5015 null] >> endobj -450 0 obj << -/D [1342 0 R /XYZ 56.6929 660.7607 null] +454 0 obj << +/D [1348 0 R /XYZ 56.6929 493.3884 null] >> endobj -1345 0 obj << -/D [1342 0 R /XYZ 56.6929 630.6469 null] +1351 0 obj << +/D [1348 0 R /XYZ 56.6929 463.2745 null] >> endobj -454 0 obj << -/D [1342 0 R /XYZ 56.6929 630.6469 null] +458 0 obj << +/D [1348 0 R /XYZ 56.6929 463.2745 null] >> endobj -1346 0 obj << -/D [1342 0 R /XYZ 56.6929 606.2355 null] +1352 0 obj << +/D [1348 0 R /XYZ 56.6929 438.8631 null] >> endobj -1347 0 obj << -/D [1342 0 R /XYZ 56.6929 606.2355 null] +1353 0 obj << +/D [1348 0 R /XYZ 56.6929 438.8631 null] >> endobj -1348 0 obj << -/D [1342 0 R /XYZ 56.6929 594.2803 null] +1354 0 obj << +/D [1348 0 R /XYZ 56.6929 426.9079 null] >> endobj -1341 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F21 654 0 R /F23 678 0 R >> +1347 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F21 658 0 R /F23 682 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1351 0 obj << -/Length 3085 +1357 0 obj << +/Length 3410 /Filter /FlateDecode >> stream -xÚµZYsã6~÷¯Ð[誂›ä£3ñLœÊx² §v+Ç-Q³©ˆ” í¯ßn4Hñ5ÙÉÖÔ@ ôñ¡ÈbÆ៘E†qëYkf¸0³ÅöŠÏžaîý•ð4óšhÞ¦úæñêëw*œÅ,¶ÒÎ W½"Æ£HÌ —¿o¿»ùññöáz.
,»žËƒoîî¿¥‘˜š· ïßݽÿéáæ:ÔÁãÝÇ{~¸}wûp{ÿööz."#`½ô;œYðîî‡[꽸ùðáæáú·Çï¯n YÚò -®P?®~ùÏ– ö÷Wœ©82³WøàLıœm¯´QÌh¥ê‘ÍÕ§«4¶fÝÒ1ýi1ccè ªá¡9.Áá\ßJ€ÎmÔ;w.g\(;›[e™™£Ä-£
{ÏB3«¤r&Yû×d¿DÕ|ýÆNÄaÈB Y8 -[TÇ]:¶È")¿ö¼~UÄlIO·H<û žÊËbAôáþ`=y² ìÒÊ\†’…± »Ú9À´ÌFQä7Jòå×°×ð<eX(uÔ•'Ý—#;ü¥‰j{s=W!^×Ùb
]mƒ×l³¡^²ÛmŽØ5 8ôÇ!ÝgiI a@MRÖ‘#yͪµÓƒjb': -;ü%™¡(ühî,M„ÞÒn ß:à \ј8p(/ÃA<:þÜWQ±13ÿ“Ð-bocèЩ¾_%ûª¤þa‡—&È*?P¦eom[’Ø騦(¨EÆó%õ“±5Nú‘ËÒpe-¦Ôyvš§H Àȶ(+궔iÁ7E7ì9µÃ¢ÖÁ0êÕn› †þÖ„Ìq¾ ¶6|_“Þ_JŠ½Øv-%)¬º™Å&)=ÑÝý긬–ú^Å’L‹+‹í.ۤ˹‹40°LWÉa3ÊùK8Ãö$0~ü”=ÎT ±÷¹KK¿øÚS|iN½»{¿*yIiµƒíÓ!ÛTÈ܈ =«>âøǽFëB~Ñ?ùŒHAîbå_ر^qÖkèH0 ‚£wÂ2Åvf tb½6és‚1jŽ‘căY–ˆBZu XRâ² ÒÜ'î.ä˜J0Ó?Í
bBqð›Q¼†ÍóÕ>)«ý5¤ ‹ª®¦Î ×ráÂk -Ñ=»´WCéüá
MÝß>bùì¾xðñá=F#Fs7.‚á$/_ ιƒVE£™ß½¾¾Ù á$†ALÕ‹C5ž–QÒ–þ¹Ûd tQ - -Æ:̶íÑ“ZülÞI£ 9À9ûÌ%Æ0^BN艣&ù 1ù ÑPEœCÒL‹Xº-bÜÿëÛ nîî
“e±·,RO’ãÝtk¨’Á.Zç s8@Ž†¨Ò?îí6æ@_›%Ý8·;vž|4ÇS²tÙÍò6iÒÊ -àfO³P±‘ ‡]M¾Ûg-¿3¥Ò°¦,¨-rQ+ákùwz|-|É{1|÷iì@…~ë5Èá‘šò˜ùqÛƒ aùÇ ¿Þ#Š ›orŸšJå ‡ ¾ý%Ý;ÿÀªÈBؾýîæã'¸Ox¡Uä‡Ñ nîi ½“U±(64µhÇq·SN¤t``›-£»J›àgª -ÿæ&ìœþ©É¤»õþò ß=üÀ:Í_à÷OŽkÿC |{ö…/Â}ëY΄‚ØÛâs -O5ù´\ƒ]GÑ©ù -qKÜ Ä5Ô“‚÷÷ülï¥ALÈ×õ”îšiz;ƒÍƒD¹?‚;
þûêú‹ÿïôWŠ:„¬>:àë·SÏ2 ŠÁ3³ŠàÉp„õÿ˜Þç×endstream +xÚ¥ÙnãFòÝ_¡·Ð€Åé“öÉ™x&v<Y»@’Z¢,&©ˆ”=Ê×o]MQIv`]¬¾ë®j鉂?=É|¬lî&iîb¯´ŸÌÖjò}ï/´Œ™†AÓá¨o .Þ¼³é$óÄ$“‡Å`,VY¦'óŸ¢·ß_ÿøps95^EI|9õ‰Š¾½½ûŽ197o?Þ½»}ÿïûëËÔE· ï}óîæþæîíÍåTg^Ã|#+¼2áÝí?ozýáÃõýå/?\Ü<ôwÞW+‹ùýâ§_Ôd×þáBÅ6Ïüä>T¬óÜLÖÎÛØ;kfuñéâ_ý‚ƒ^š:F?g²Ø'9@&Ëc¯{}_ÞCÁ¾šÄÆJ¡÷jŸL¦^¹8ÏR}àJ>àŠvyl’®ìó8±Æ[Ún÷ˆ´yó‡ÁI§Îàþ8èHiS PýÑÔ%ãªVúªuµ*¶ÜÝ5Œ,¤oU<—‡‰WæQùyVn: Ñ- ªŽn/u•›U5+ºRöhêÕ Ï +§‚[ǹ÷†Ž×-aukòèLž5ÔÎ[îlÜYðçºh»rË(¾b«°ÅüxF¿~Yw¯}˜‡rè’è“Ðñôl8¯tT„©F©¨n:ÁòwÛõœG̹cSl;îÃs †Îˆïî>ý£Gí7X½_tQÝnˆo7å¬úY)3;>+«(±
T†÷ñCõ¬Ö›U¹†û]ÕÔñØM‰@îlfE͸ǒ»¶œ3wCL¹Ñ©Ë‚^ +P—<ÒG‹f˨§ÕN–aN»N «Âh’E«¤*M©;F 롧 +.Hú{¬ìIg&KEq±y<kêň®ƒ9HÁ&ÈPgkmô°¬dý][<ÉI +=êU¨Î[™>kv«9ƒO%v M¨—ª[†qõtì " ¤U&MøVzºjËXæ/Bx0ìdÚ"Xtštð$yÈHd°c„8Ì8p¿Ÿ Ù.iYĬ«Ï¨‚v
ÜxIûÁf2âçE,qÏ:ÂW üYêèÞW(º ¼¬FÅ} ÀV¡¶ÊR –ö±&ªPØça#ö œ›žd†Í ÿ0áˆP½£DhY´ 0›FŽ(ò©Üá^~ ó´î Ï©mT¬VÜ/.Îõ1ƒ +¼lÏÌ Ž<:#tÈ¡§XµÍWÙ³§·ä͆¾¯û«zAD$ßÉ«þN^Ýéϼ£Êzï {G +ƒ†ç2Œ!fŽjÛ;öó xÞã
t·ˆ +N0LîÃͧP¾yW<¢ p&çOjŒ y¬ŒÊ{ºõÊÅ.ÍOïD1¡q2/¯Ä+;Hø0·3λ ìE/²m;ö<8¹kh¸A¥õÆ&b↠²8ÐÏÕ¬äY*Wc’ô¸ë¸®Â|CˆÌ–N$ÂÑI¨Ú$·Ô1hÔÛ€”žVHm8“òš1$ Håi°
‡Q/H%µÅþŒÄËù äÿµpgD|edrwR
.õïDP2áõPGÁ +,M¼Û ”ÏÕlDpµn8wx“œhF4ÜâÁ©H¨s>íé ºýˆºô§ÂÄ…V +bê†ÛÇ]µê¦\½=e¡ U|ŽìøŠÝhäW)ùÁjd—ÄüÃŒWí†ÑY¬ûÚÓ”Nb›åÉÄ`j™©Tˆ°*Ÿ¨4<
/?'&DÃÝ÷&„´‰BËE„Ø5›¨¬C¹„ u%è9ÝSìd1vÙ°x½Øm·½„¨aÖ?¯üùÓzX|KˆŸ(òuÑÛ ®¸ëîæŸ.¯¸î÷ñþ=:¤˜û®ëð¸S·/\^Ô!Æ"¡¬ ô·z†-Jy>Âh½Ùuã‘Çmåg|_£Ê9äŒ! ħžö@é¢Á¬Ïû÷Œo!,”ÁY ¦Ž=ÜñÉ ªËëÜ—Ö¹îþûÝÇ×·w1£™³Í›R†ÐkÍádAä2öÑáJ±8ªüL´×¼Ú˜XrUŽŸç +dü°þŒ“Žó×°ãiúú¥ˆe¨Ó_g'¦çðxþÅ×x˜ãsüÿM +Ç€Äänå IåÊSxÃ?{Ë· +_ØrÌú3 ç:=üâ(x?4Ð.ÓTs¿ +½ã:X{@ЛÐL ä6¾>Ü>|#KþÈ ¿²QÄ5æ‚þ2šè¶;>Àù/ +`c¿G‚¡ðWÿúéðÓ0Ð8›eæ` ¤3M9Þ1ÕgþÅf±ÏL:rôÿ^܉endstream endobj -1350 0 obj << +1356 0 obj << /Type /Page -/Contents 1351 0 R -/Resources 1349 0 R +/Contents 1357 0 R +/Resources 1355 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1332 0 R -/Annots [ 1355 0 R 1356 0 R 1357 0 R 1358 0 R 1359 0 R 1360 0 R ] +/Parent 1338 0 R +>> endobj +1358 0 obj << +/D [1356 0 R /XYZ 85.0394 794.5015 null] +>> endobj +462 0 obj << +/D [1356 0 R /XYZ 85.0394 167.2075 null] +>> endobj +1359 0 obj << +/D [1356 0 R /XYZ 85.0394 139.8789 null] >> endobj 1355 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F21 658 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1362 0 obj << +/Length 3030 +/Filter /FlateDecode +>> +stream +xÚµ[Ksã6¾ûW¨ö²rU„àI‚GgâÉ:•ØYsØMr $x̲D*$5Žóë·Á)‚¤@§â)—@à#ú
Áa +ÿØBE$Jx²ˆIej±Ù_ÐÅghûî‚9̪ú¨o .¾þ(âEB’ˆG‹‡Ç^_šPÙâaûË2"œ\BtùáîöãÍw?ß_]Ærùpsw{¹âŠ.?Þüp¥ïî¯~üñêþrÅ´bËÿºúéáú ›"×Ç77·ßbM‚?g:½¿þx}}ûáúò·‡ï/® :[úö2*¬!¿_üò]lÁìï/(‰V‹x „% _ì/¤DI!ÚšÝŧ‹w öZ›W'ýÇ(á"âäbÊ*!‘€&ëÀ«¼¨ŸL viµüñæÁärk¾˜]qØ›¼Æ–¬ÂßOiQå¦þ + ±L±ö‡«[|ïP^2½,êbSì°iÓÔ˜´6[×SŽPŠûl»bIL+Éäò¿EîZ¶i"ø±pfNŸMš[߃VŒ‘D)ÞX³68@ÕÁl²_)åT¨xÉê',Y¹ð&+éù&7Sm]j»rÜ}B”çAÁ‰ˆaµÙ¥(0ÖƒWDë(Z¬DL„ U¹$H)mÍîuVäÕˆKŒÄŒE‹(fDqynì´ê£pèÙÄÐw(«PºÛ/+ÿìñu(œ1A˜¤qXz‡šß÷cš0Î}ñŸŒ9HSØšjSf7°¢xœðnÊ¥vƒ04bÈyM¡¥gùÐNàá±`žØX~^`á¾gq‡Ÿ±xÜ/š¼9gùÀ""‡* e Íg¾CÍ(2îÍ*BÎ’MB ‰ &[ [‹:ÓïGSNp*dÞ¡&¤û\~°Høâß“lC®ÅD ¸&XìÙäšÃÏX<î÷í\“ ‰%ãa×w¨Eƽ…¹FXòt<õ *Àµu¦ºLóê–¶!Ý8…à ‹dP~‡šPÀ£›
õÑPƒ÷¤[ߎð¬q–q‚R+™x¦×ágŒ ÷ûvÆE1‘BŠ°÷;Ôœ"£Þ‚ŒS1l …ša\ užq ê4RÇìXÌ8¼Á ÒH†¥w¨ ñ>ß žë8öåÿ=¾% ßNV ÙƉ¦’o°‰¢TúnÅ·?cò¸ß¿°–ÂVWƒÎAßw¨Eƽ…Ù&#¢c®gØÖCØÖ¢¬D ¡Õ¡Øe›‰Õ‚0lñÃâ;Ô„|Ÿnfz,|>uÛë +ýŸâϯœËOÙþ°s$„1:âþ Ÿn·(|v0ÆÀ‹+ÁhCäá +p•†=\_ÓPkñ3¦û¤8`L+8‚Jˆ¼a w¨9EF½…iʼni2G« *@«5œþ+8q½¤å6Ë?IMápT¤CMhâ,Ž`úfýâÙÀ ‰M£JôùØ&) +s‰%c6æ *À§uØÎn7px§rá\DYX| šïqK0"4Tyòßç :¶b <昽<›È… ÃQó4”iñ3Fû};Ób
g!ÂÎïPsŠŒz òk
JɾõQçùÖ¡N#•åµù\fõøj'Uaù-hB¾O8J¸Ž„¯À{Î3cÈ8F
\VÁ˜D”iÏÔàÕÃÏX=î÷/0Z4aïw¨9EF½…§l~žñÆõPƵ¨ÓPUÙz7•k³ç”ó°ø5!ßß' BµP¾ï¹€öÌ^ ¢“$ \ (ó,
^ 8üŒÍã~ßηˆ «™±ïP3ŠŒ{ óÍÞ+Âz4÷ *À·Õl<MiOª«ªHWu½G8N”T"¬@‡šÐÀg\L”=ã{*¼ã& rNÃñQ°@Œ“0 ¸òl
Æ8‡Ÿ±zÜï_ˆq”ÄKÂîïPsŠŒz rŽ%’D±šÉôQç9סzV#ž«çéœk¢dFƒ5¡‚G:ɉTt Ãû,¬S– Äk8~EqàR^’ +ÄMúÏÖ5 [¨ŽëÊü~ÄÏf“ž–×]†ÃÃ!š1n<Àç£ýð¶U£«ãš×f*ÿ6ò:ǤcÿÒþ%} |4»q²Ì“ä.£× +M§qì¯!Y/Ÿm> Öoï“Áh{ +ùG¹®ÿ1}¦uwf?=–¢ýVzNþyÉ––óÔ]ªY‰ùjoöEùŠè…íj½K!v×øØjê,k.Üb—:æÞ$m`…iå5Ò(iNî‘ïö:}vNòtà-¼b½sB.¿¤»#¦Xʼn*¶áPTvgm°){ÄÚt»ÍlxOwXß(r¹-3wMO6%ÙT¯É±6êϘ––'Öº€%Ý]šýî½I ³å§b?àƆ*=}ðÑ =ÙnZÒmvÇíôçØøjfcÕúxZ° Ü^”äf¢ËÖ€>§×¯^*•œû@_("§o àÏäßþxÿô?¤ý üÜ.Û܇¶¹TÊ:5æãÓ}å?Vý…endstream +endobj +1361 0 obj << +/Type /Page +/Contents 1362 0 R +/Resources 1360 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 1338 0 R +/Annots [ 1365 0 R 1366 0 R 1367 0 R 1368 0 R 1369 0 R 1370 0 R 1371 0 R 1372 0 R 1373 0 R 1374 0 R 1375 0 R 1376 0 R ] +>> endobj +1365 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [312.6233 217.8123 381.2953 229.872] +/Rect [284.2769 667.7189 352.9489 679.7785] /Subtype /Link /A << /S /GoTo /D (access_control) >> >> endobj -1356 0 obj << +1366 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [310.4119 186.5529 379.0839 198.6126] +/Rect [282.0654 636.5559 350.7374 648.6156] /Subtype /Link /A << /S /GoTo /D (access_control) >> >> endobj -1357 0 obj << +1367 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [328.1051 155.2935 396.7771 167.3532] +/Rect [299.7586 605.393 368.4306 617.4526] /Subtype /Link /A << /S /GoTo /D (access_control) >> >> endobj -1358 0 obj << +1368 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [320.3548 124.0341 389.0268 136.0937] +/Rect [292.0084 574.23 360.6804 586.2897] /Subtype /Link /A << /S /GoTo /D (access_control) >> >> endobj -1359 0 obj << +1369 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [359.1386 92.7747 427.8106 104.8343] +/Rect [330.7921 543.0671 399.4641 555.1267] /Subtype /Link /A << /S /GoTo /D (dynamic_update_policies) >> >> endobj -1360 0 obj << +1370 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [429.9426 61.5153 498.6146 73.5749] +/Rect [401.5962 511.9042 470.2682 523.9638] /Subtype /Link /A << /S /GoTo /D (access_control) >> >> endobj -1352 0 obj << -/D [1350 0 R /XYZ 85.0394 794.5015 null] ->> endobj -458 0 obj << -/D [1350 0 R /XYZ 85.0394 430.9244 null] ->> endobj -1353 0 obj << -/D [1350 0 R /XYZ 85.0394 403.7891 null] ->> endobj -462 0 obj << -/D [1350 0 R /XYZ 85.0394 277.0241 null] ->> endobj -1354 0 obj << -/D [1350 0 R /XYZ 85.0394 250.3071 null] ->> endobj -1349 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F23 678 0 R /F21 654 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -1363 0 obj << -/Length 3306 -/Filter /FlateDecode ->> -stream -xÚZmsÛ6þî_áé—“g*”x#Áijçܹ&=Ç»›¶ h‰²YS¤JRqÝ_»X€ï¢Òi&“1<Äîvøe -C.âÕ>MŠ¬xÜ súíP—‘öI£@,~Ü©<’$ ¨£ØÁ²šzL6Mö)¥ò®¬¨Ð<ùæ?Ë"šÈ@®îŸ ¬N*”;§e²yÊŠ´ö '®ý%ËÞÕ7«t“¶¢RPÆ}CÍTd„Óð»÷ 3
C -†”ƒZØÖ÷ îooþ7c¦40ì0ãÔÉ>ëä1E œ}X ûd`¬}TG5hÌÖÕ ôÍDl‚ÖÐç‘gu“n©\${W[§Õ§´r~ tPÂä¤ur¨²}R½’^{g+ñaŸ€˜ -zâð…Î(P Jz3 ê k*%Å+ntÛ-ÍC]§5}W ÒMöKk`^²æi†b"LèиQ Ñ ¨°*rXt2&Z½qê•UC¥}âÔ{HGº\ñ¨CÃà 9øÆÁÜ[%íè¦À¼uUÈd$ôgi«“"ôÚöƈ$4¥ŸÔbëjhâŒ_iÄâÙà#`Œ›a2*Z&˜)Ìj›î’cî¡;jï6cáÂAˆŽs00g,_¨´ê; -ܵ%NKÚP}b™ …úµh’?¨ÕÒ?J«&ÉœØm¹§²"U;mŠÖùDB©9ç@®puæö+øb¿)]új[pê Ê¢ö¸žïßRÍÎV•{úEöA¡H›—²z¶»CüÂênUÀOI•µ -l6¥íi ´u}•Ö’`¸,È;ZZ¾ RÇßøvº®Âœ{oàlŸ 2‚vè#•]#ÞWÅLØŽ˜ÿæúØ%Y>#¸§bÞó¥§U “‘>ðÕy±vf Y$qgõÅ4IªbNdB‰NóSë>™ #qfÝ÷P ëÞ£ºu¿ÿc,8Ž™ÑYìA3‚³(f$è2ü1M'CZoªÌA«s:¬qÄ¡|Œíë?°š…Êø™¦ÕÛ7Qh R
l¤Æêñ’ -w=k[üs§ý’¹›Î0<™ðñ±Jx!ùÌ°·¨3ŠL{[䘎43Lç"Çú¨Ó kQÝ Á6w»Iªí$¼ˆ©€/‹÷ ñ¦IΤªü¿Ç´xÀ´¾#áÌil¢“|Ã]ZG¥ |kñgŒžöûù|‹ œ%¤\ üuN‘IoË|Sà"¤Ë|ë¡øæQÝLeE“>VY3=—â²€ƒð¢|š‘?$\À„ åP/I¸cÆqƱÀ¸ faÀÍÀÔ%Æyü«§ýþÆA‹áryô[Ô9E&½-3ŽK@sp hoÔÍS=ä¸Ášlž
ΑX”Ý‚¦Â‡[gÉ#õ@ú— £=F¢CÇñéXkp~!J=|ÙàI¯ŸO38\˜H/Oy ZÖbÒ×"Ç”Ì(,’¬:Ͳe7¡i…§Öu]&ë¦É§^M0´\V EÍh0¤ZÄ4ž÷*|®Í2f›£¤ä ~MÁBz`ë¢_sø3VOûý ~-`QÈãåáoQç™ô¶Ì9(£Ïœú¨ÎyJ< ¶I“®É;<×ÏÒI8ã„ñ
ZÔŒ -Ò)Á”F:|™`:gÉH¼£XÉÓ¬“’Å’l]"ƒŸ1zÒëgSN 1£¿8ø-êŒ ÓÞ–)'@™3±´Z œG¡D˜¦ä!©ÓÉ4dZ¡jQ°Í H1_ª¢¡ä˜Yµ™JåÓI2¶¹ª¢\QÐiHí%Õ>8”ËU)—DHÝ”å^ÚŽUà“ÑÐŽ ÚüoàÓ9øM÷É®ÌóòeÐÃLª“C™ëQª³?šã —°ç¼S~N__\š¤ˆˆroøöŸÕ²S”Åf•¸Æ„þ`Ê’JvŒ -6Д„E„â½Üüð¹-ˆß½-˜ä?y|U=4_ÍߥÓÞ¥}ýI -=Çÿ¸â«šÊEâ.ØPb±Þ§û²z¥Ÿ4 -ÛõCž€ïnè§×ÔYf/ß"—FƒEjaeêå”
Ñ(¶§õpH£&yvƒ4˜ÐÑhöƒ»¤jõ)É”n• U°áPÖ¸§N©)ÛQm²ÝfèÞ“œêûE¶UæîÅ é Ó“¶ú!M ªƒ-ú3åˆò¤¤Zç°”»WÃ;i›"æ«å>Ë÷ÖÉþ{†x¡í©'Ý&?n=éNiH® }Õñ XPö—&E:Ó¥7 Ïé‡×AZõdÜ0o<“3èNG ²n2ƒ<Œeˆ&|I¦ÇLeöB ñF >ùe6ÓæÓÜ» >}b -k¯ Ëcîä'xšp:QMQV{ÜŒ`• k[Iu~]‰H Ôx]eéö$ïyûõ(–ËÄï£N3¿Eõ¨ã;yxA9 -™ûÐú#nܨ¼G²ˆ‚ ýt^²•I‡Ÿ2I ³¨»¡ïy“IÖ"lý3ÄÄq5ÚBeû.Æ[Fdï9Öm»/l_Ï´› î-˜~[;r¸7²û¤¹ kûTâ§y ëCˆ(:ÃË j— e·ZÐÃõ‰,†Ô2^–îA3ÒÇY pZb(þ?W±°‘C¤d•eÖÐé K†¾ø³öÙüaG [é¹ V!“zMP¨Àg%ng‡Ø¼|¤|Ì÷[y¬à€C¯ñ¨ ÅÒÎ:Vn_A@¶qÊÚ Q Z‘ÔÑèÝ–%œhnÿ{sǨèN“!½Ê…Šì±(Ýóª ö„Aû²+Û®6À!ؘÕqÓŒ? ã±Ê.£®‰¯œy„ó¦aƒ=Ç €Ã!- óáç/B¨™·œJêXôŸàºrµƒ˜ó[‘ŸÝ8Y1ó9 -endobj -1362 0 obj << -/Type /Page -/Contents 1363 0 R -/Resources 1361 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 1332 0 R -/Annots [ 1365 0 R 1366 0 R 1367 0 R 1368 0 R 1369 0 R 1370 0 R 1371 0 R ] ->> endobj -1365 0 obj << +1371 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [257.6971 603.0615 326.3691 615.1212] +/Rect [257.6971 346.6843 326.3691 358.744] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1366 0 obj << +1372 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [310.7975 572.0651 379.4695 584.1248] +/Rect [310.7975 315.5214 379.4695 327.581] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1367 0 obj << +1373 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [308.6055 541.0687 377.2775 553.1283] +/Rect [308.6055 284.3584 377.2775 296.4181] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1368 0 obj << +1374 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [294.1999 510.0723 362.8719 522.1319] +/Rect [294.1999 253.1955 362.8719 265.2551] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1369 0 obj << +1375 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [303.0862 479.0759 371.7582 491.1355] +/Rect [303.0862 222.0326 371.7582 234.0922] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1370 0 obj << +1376 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [332.9347 448.0795 401.6067 460.1391] +/Rect [332.9347 190.8696 401.6067 202.9292] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1371 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [231.137 288.2283 299.809 300.288] -/Subtype /Link -/A << /S /GoTo /D (boolean_options) >> +1363 0 obj << +/D [1361 0 R /XYZ 56.6929 794.5015 null] +>> endobj +466 0 obj << +/D [1361 0 R /XYZ 56.6929 726.6924 null] >> endobj 1364 0 obj << -/D [1362 0 R /XYZ 56.6929 794.5015 null] +/D [1361 0 R /XYZ 56.6929 700.1172 null] >> endobj -1361 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R /F48 880 0 R >> +1360 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F21 658 0 R /F48 885 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1374 0 obj << -/Length 2658 -/Filter /FlateDecode ->> -stream -xÚµ[MsÜ6½ëWÌm¥*‹ï£ãÈ^¥6ή¬=esk(‹ñhF;3’¢üúm† Ȇ\‘Ëå|ì~
<Ý Åþ±…U„ -'ÆI¢(S‹ë»ºø×>œ° SP5Dýpuò÷÷Â, qšëÅÕÍÀ–%ÔZ¶¸Zýzúî oÿuu~yVqEO59«”¦§?\|ü±;㺟w¿||ñá?—oÏŒ<½ºøåcwúòüýùåùÇwçg³ŠÁý¼·0sÃû‹žw—oþùíåÙoW?œ_ÅX†ñ2*| ÿ;ùõ7ºXAØ?P"œU‹'8 „9Çw'R ¢¤áÌúäÓÉ¿£ÁÁÕöÖ©þ“ÊÅ¥^T -¼ -é¦{™ª ×*#Á–Ö:ö2gS½ P¾—ß>ì6Ëõ8ZÆ,á MfŽ#j³xf\ΕK]¿]¯·Og•àêôp[wU}ÆNo–ëCwÜÓûÛ¾;ü/¥|ÝC7Ë»¾uØú_yú¹?Þ>Ö»]³ZÕ?æ†ùh~`»Ù'ÎåéŸÛM=åé©9Üög9—¾«@¿nŸ¤Ž#LÛÀˆ‡ÀàqN´rm?§T'ëß7ëÎBÚC†8Ámo uÓŠqy_oVõ -ŒB ž´¿~°n®—Ÿ=W }ÑY Ž<“†h-Eoþn¹?Ô» ‚Çuc¹YMÙ‚P•‘=f¿^>Ö–¸"FˆàÐwìždOT/[í < ÔàÚ ¢æµ Q]œT‡Ýr³¿h™=Í]]5›LìÆú¸%Î$¢&¨$Ci‹6åò©tÛ7Võþz×Ü ší¦;±½™èn°A¹´qäæ#Ñp$iLc ´°–Hgytwq÷eÑ5.áG|!üÜnþõ1P?3M̘’TŠ0Ï ‡ˆ*ÉÅgsR…ZÁ®0ÃQˆ -jrÌšÕzZ…š0¥ Î$¢&¨¤*d°`øarùk*ts* D4V¡ šZŽ¨¦ åx4ªÂ _?·ûrJG´° ‡ˆ*Éá*’ k®Â -Qa@ÍÏ Û‡C&C+‰ÔJãT"j‚K*CG Ap)™ï$ÃaHc –`¦Ý¼#Êh•„ 1à Û}¹5\)
D -j~æ˜T!#Ú镈šà’ªPm̈ÌwZ’‡!gCG “ˆ%tšQIÔ¨{|!þÜî7ˆÃ >T ‘ÙBE¨ '‚‹pˆšaDy›í¡¹yÎ+ ä”ÀýFÔ„ãDqЃ2uêùuwä? f¨3}q5'/˜ -“ŒP«mAa¢°€ò ï >'·Q¨ôQ¿5á8©%±ÖÙÔó…ïo#Ã> ´ìøµ $×–Œpfäí§e²Ù ÚBÓ ©Ó›í®;½¿¯¯AlÍæKw¼ì~ @¨:»¶/|Ìí©x;⯤¯—G— ð½o¾l–UW*3Iœ6TʼåðÐN¨µgÈ=Ãî÷ÇŸ>¿ëÚÞF˹¯Þ{èÓm݃áA{îZËÎXw°Þ.Wá¾›öÂö®;Z5û¯¾Ø¦,ô!œtýµmp -U ’[ÃIµuº° 3D! - (dȦ&Án»§@T&¶EÊ廊pzìöEiOP$Q—÷E©r»ß¸'¨
>U ’[CuÈÛS…M›!j^‡å=>ìëꥳ¡¿OCß¡d"j‚M"EŠ…².¥ó:ïH -AeoI`iÚ³bô)“3Î%#bŒøBäv_.FH`µæ¤ªD$³†‹Q)(¯UáuÝ…ˆ1 Ž{¼sò“°vi¨“P÷5á?@ ñ›o ×ܪžœ†L€ÅÍœ‰É3¨N¨H"Å&¿€/ÄœÛ}±Þü÷
T:‹w~D•ˆdÖp½qHša° -z ½T6PSK¯òûxTá "j‚B"9Ÿ‚[fSßArÓK®G[1DuQ©E,¦º€/„Û}ù,Ç1\Y¼ÿ#ª@$·†ªŽ9È™P¸ê†¨yÕETûî´ÙT»úfWïoÛ—÷oºNð¯T§N·èÃî9dž“ùà - ·x5Ã8erBò4ˆV¶Ìõ²õD¶þÄÄB -.•ß zÄÒ€/PÌí&ódf7ó$bÊ@e‚vVD˜äÖpiFŒã…Ýä! -ÑX@µ÷ Ý žêf·½«VÍ?€L¨Þ\×ùK
ð$9ÔD(ˆšà“Ö0§Sžòy¼®Õ¸Ê€ÔÚ ŸaA -*ý;Äa@h‘Ñã =Û}ñ›aÿé3ÓšãCQ"¹5\¢oaoyˆBÔPÞã×úFk °Ý=OåuŽS‰»¨ ÿã¼ÎQX毳ÈfaŒó:éC>>åÜë‚'‘¢y]/ÄœÛÑ[¾Pø]að®¨Ìª6ç?©f…åh^kÔ.®ëCS ¿õN•&ˆ¶Ö¢®#(÷èLZ¨”(Kœ¿Ò~£Æ*c„IÊæUÆ ¹öw écëÑx´c›/ÿÒÅJb(”cX—GPÄØþ5 L}‚–>æ;‚oùzÐñº÷ÎU÷~<ß4Ý»zŒAåÒ’TFO8¼Ö|“‘Œ÷‹™ÿÆ ›ò»Wb+&¶ =¶ù
/f9äªÐõ„³ÈlM«-ìíBÎ#&Ëøßèð—ÿvêø‡eÒag_õPM,w&òÄÈò^a‰²ÜLPÿ?¡xd endstream +1379 0 obj << +/Length 2951 +/Filter /FlateDecode +>> +stream +xÚµ[ÙrÜ6}×WôÛ´ªÒìË£ãÈ¥&vFVj¦*ÎÕÍ–SdO/R”¯Ÿ bi® <qÊåj8Ä]pp\Pdá Yh03|¡ G±X?^àÅ=´}A<f@«6êÛÛ‹¿¿cja‘T.n·¾4ÂZ“Åíæ—åÛ¼ùéöêærE^Jt¹/¿½~ÿ«1îçí‡÷﮿ÿùæÍ¥âËÛëï]õÍÕ»«›«÷o¯.WD ïSßÃÄ ï®ÿyåJßß¼ùñÇ77—¿ÞþpqumiÛK0³†ü÷â—_ñbfÿp3Z,žá#b ]<^pÁàŒ…šòâãÅ¿b‡ÖæÕ1ÿq¡‘ \.V ++½Lɘ—ÊzySdåi×7–Ž QtÑîq 7¢F³–`B ÒÖÄŽäyî ~|ð…M~Xï‹Ý±¨+WQob=3ŒB˜r*tõï e1 2 ¬¨ú&R‰WFuLtûû…+Ü´Œøc‡ý:c×g³,‰D¤¯£ +af¼ Q3Š {³Š ¯=y†A¢s;ƒüò fxò2¿Ï¬é«º*_<m’Âf(¼Ã1IQ¸+ý¶a–‘ËO³ìޖŲѣ©Ív»²ÈîáX»ß‡¢::`Vm\Õáxºs¥?ê*?@ á\-¯·¾5÷xè¡¡!×m:0ƒ'ÒóðÄ
¹J2 tv˜o.W +;-*¯Z0Êw²ž‹²ôF”¯ù]n»‚€°ÑÚNPd„ M¯Çý%ÑË<;æÇÂìà~‹ÿ=ú__ï;¶¥0=»cé&ïËÎÏ^«Ü$»¤„A4Œ¤éÕFMó+¢¬YÛzÿœí7bQ‚„"&-8¢F$wƇJ$„êŽèËÇ<«Šê~{*í3o\j뛳7p¶éÁºÝVeîÇéo‡f“ïS‡c³Zñ†ÁÃî†-•'L˜YýHÄ&ŠxÐÄI¯Í:; r/+ªXÖõg¤NïÚ5n³¢tœ¢† Âér*Û ó=Œ¾ ì_À¶L<_¡²oœmt³ +ïóã1¾RÕ®2«ÏÐ%,ÍßØ +¹|~(Êq$µfÞ:˜àt8Žy¡Y^ƒžëSéågeY?{\MUï ³ÒUw4¶Õ®.L0ª(lS$Î ~‚ùfzŠ¨Û6$ø%èïA-ö[çö' +{W™ßØYlYß»–OXàßêÓ¾ÊJ(’P‰ié{mÆÝVn^@@±öÊî6°>;vÁžY1¡ºär”dyýŸw7ÈÁžK²üÎ=÷SÜC,k(qpŽB2ÐÆUÆÞÖ@$Ø èåi}ì¿àì·UÍd:7‘¥·Ðá‚u¶áîÅ ØíòÊÓ ?QÊÝäb¦5ŠœR$… !…Ùåk;+ÎoU9»jĸ‰S÷&7Æ -¦æ³dzâÀ©G¨Ù‰ÓB%&N@u&Îñq·òîìO n’tF‰ˆÑ¢ã6.Q¬§Fœ>.ùPRmêõé1¯âö±nÓ +ÿ{>k '#xy ‰¸™‚šIOsÍ4š§=ÝFM{:¢yâN½Q§í¤àˆ‘Ü
N Q*LWô¿ëÐa i +kß6;•GWëuûÛÁ=: xÞ¶¡´nö"ͯ_v7ye%Xø3´tzmV ûzhµtŸ’ñ\ |”1Ý985á”FÂ~ OTp‰!pHëOT(ìjÕ°æö!¬”ñ0bjëì®ÌãÌ .ç„+$%Ý?f»= M
˜óªo£àH_° Ì9”ÙS>f€ ÍÊŸ§Ø ³RK&fØÜB%Ø PÎÎßWÍR´Í}ü( óÕ0ãA”¶vó´&5¢J‡ÞÀjƒ•îêòç’::ŽÜ´E=5ŒDL)5™æaZ#n4íHóDüŒùÃ~§Ò<ª¯6ì‚ÎÉqˆ¨E†½%Ó< ëš©¶P Ô蘛rœ…°k†ýZZ“ˆQ¥ËB{.µÃÐÖåë¤SõY kš`!„ ›‹k[“d¡ÇϘ?ì÷õ,ä°wfZ¦Ç!¢fö–d!SÙu IÂhšƒ4 6êÓqÀAÍ—B&õˆ ¡"]»ÓÑä/"`Ûž¾Vh"Í4=žm›S ð´õƒ^_Ï? -3C0i ú=¥™Ça÷FùL"¦Jp/ ¦£Å(ùlåŒ*5¢K—~I¥zÊüEËpÛ¤~´inÅôãà4%:V'ùçñ3öûýb¤ˆJC +ê ܾœ•ÉÎJ[Ãp7 ¦ƒß»-éæ¾Û‘Â
×4‰1¬áffQnö Z Ž0l‡c± ÞÓÁÁ‰Ú£cJz
Åwˆ,줅ֶüëíÈW pX³aæÿù&!|ô°j®~¡|þásžïÂ'ÞàÌ7ÕÖÞ®zòB…cvóuCq8ÞÐÒöÚwýàj×Y¿oh~7§Ç]¾qtWiŒ{Wpí´ÿÈͱB\ËÜÏ#ÓJ¹÷—8á‰øÆ&·ÀªŸÐŽ,‹®9_ÒMRŽð²Ä3q³š&]D5f÷«§¬,6Åñee#Òþi$ßRh•T#¢FôèžD€tX×Qäë¬×“æ ó0”‘ÌÃP +ûô¶)3y˜?cû°ß×/Üö;@p¯HBDÍh2ì-¹p˜
XÏebÚ¨Ê}
Ñ:7 êÓ~=¼Ì6Ïg”ˆ¨-ºÁìÅ¢§Æס߄1=
FpM l¥ {Sä øˇý¾þŒ™½L@ +ýžÆ™rrÙûG¤Á.ûÓ?pþã +®³´qßa‰45*(eW¬¯¹`Ž¾T¨þ?탄kendstream endobj -1373 0 obj << +1378 0 obj << /Type /Page -/Contents 1374 0 R -/Resources 1372 0 R +/Contents 1379 0 R +/Resources 1377 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1394 0 R -/Annots [ 1376 0 R 1377 0 R 1378 0 R 1379 0 R 1380 0 R 1381 0 R 1382 0 R 1383 0 R 1384 0 R 1385 0 R 1386 0 R 1387 0 R 1388 0 R 1389 0 R 1390 0 R 1391 0 R 1392 0 R 1393 0 R ] +/Parent 1392 0 R +/Annots [ 1381 0 R 1382 0 R 1383 0 R 1384 0 R 1385 0 R 1386 0 R 1387 0 R 1388 0 R 1389 0 R 1390 0 R 1391 0 R ] >> endobj -1376 0 obj << +1381 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [259.4835 736.902 328.1555 748.9617] +/Subtype /Link +/A << /S /GoTo /D (boolean_options) >> +>> endobj +1382 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [387.5019 693.385 456.1739 705.4447] +/Rect [387.5019 437.0578 456.1739 449.1174] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1377 0 obj << +1383 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [381.9629 662.1643 450.6349 674.2239] +/Rect [381.9629 406.178 450.6349 418.2377] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1378 0 obj << +1384 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [398.5803 630.9435 467.2523 643.0031] +/Rect [398.5803 375.2983 467.2523 387.358] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1379 0 obj << +1385 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [393.0412 599.7227 461.7132 611.7823] +/Rect [393.0412 344.4186 461.7132 356.4782] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1380 0 obj << +1386 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [255.0796 568.5019 323.7516 580.5616] +/Rect [255.0796 313.5389 323.7516 325.5985] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1381 0 obj << +1387 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [381.2254 438.9741 454.8788 451.0337] +/Rect [311.5276 282.6591 385.1809 294.7188] /Subtype /Link /A << /S /GoTo /D (tuning) >> >> endobj -1382 0 obj << +1388 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [335.4973 407.7533 404.1693 419.8129] +/Rect [381.2254 154.1545 454.8788 166.2141] +/Subtype /Link +/A << /S /GoTo /D (tuning) >> +>> endobj +1389 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [335.4973 123.2747 404.1693 135.3344] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1383 0 obj << +1390 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [363.1733 376.5325 431.8453 388.5921] +/Rect [363.1733 92.395 431.8453 104.4547] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1384 0 obj << +1391 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [365.365 345.3117 434.037 357.3714] +/Rect [365.365 61.5153 434.037 73.5749] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1385 0 obj << +1380 0 obj << +/D [1378 0 R /XYZ 85.0394 794.5015 null] +>> endobj +1377 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F48 885 0 R /F39 863 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1395 0 obj << +/Length 3132 +/Filter /FlateDecode +>> +stream +xÚµZÝsÛ¸÷_¡Gy&b ö)—8©¯=çêø¦ÓÉå‘(‹DêDÊŽnúÇw ‚¤H‘î\:™˜ °\ìÇo?@‘Ïüã3‘ Í,62PŒ«ÙrwÅf°öþŠ;šEM´hSýðpõ§w"ž™ÀDa4{X·xé€iÍg«Oó(ƒkàÀæo>ܽ»}ÿËýëëXÎ n?Ü]/BÅæïnÿ~C£÷÷¯úéõýõ‚kÅçoþúú燛{ZŠ nïÞÒŒ¡Ë¦÷7ïnîoîÞÜ\~øñêæÁëÒÖ—3Šüvõé3›@í ¯X ŒV³g¸a7&œí®¤’BÔ3Û«Wÿð [«öÑ!ûI¥Ê,š…ÃFæAÌ9ÐÄ’ƒŒ¦1rȇŒ\S¡‘“mµ¨I^®ÓÃ5×óEY ËtñëÏA\!á±ö.=Y<Õ€0¢% Å„`º+ÍÇ4%/T7X¥åòí«¬Èi¢X£`gª™8`¡4 ´Ng‚p‡îÑ,?W[D +äk +úÐâáqFƒû–<ý„ú|É +wÌ‹*[Ÿ.aƒƒ§v¯‰vïø;„U‹îöß' ö”8Û;‚zÂaÇKP +h%Ǩ‰è +ã ÆUÏÝÐ…Ø3Œû»¦š¤ÏmcÊ +ô}:ºIµÎÏq GœÄºŠ / ý„ ú|/¥<Þ ‘Ð@k +‚N Ò¢Ü#fŸÒíéšsN¸oBíÔ²´7F„ô +äaXCÄB½P?ÛŒG¼Ü&Ǽ'X<._KZâ Lvõjr¢Aâh ÐáÍ÷¤ÄSV ÝÊSz(AGw‡Â+"2 ámEW +GöÈiXƒËšAC˜°Htá³Àk—•¥x‹#¸ [A“䧶µ—…½®|ìåVc eùY +E Ö+zÌ+_ †/G‰d¡9óK(Ä<+隧Ïna ã0cè‚h¥bÀ=¶#} 3Œž<]€å³<uÔT•¥)¶Ä¸ +äqeM(4øP‡Ý×R m Çê€ÒÐ úŠû´˜Ø ȇ5 b1O¿%ˆó’æ):`ÚG¯i.¡[— þÒÎ&øDA½Ô2%²dµrz•D¹=ò¢rx +6vñDmÓ§Í1X$3—:êë¦xîäV&ÇP¶¥*kšùmQ|-ÿL&æ¬õ5Ö1½¿ÂŒs½ˆ ¶€†ÿ¡ ä–(%á¨I8x‡é¼:íÓæŽFŸè‚K%
?_èÂ[¢ÜP•‚Ðlt‹¢¦2aˆ»8ö•)–*{ʶé#³ÒóùÒ=šÐ¥Éìðè&qÏ•Çå IPÚ +•“:J
é²¢1%6ä]×ǃ« ðD«@Ú¦šáØBÈ0²-Ì6v„J º¥%L>câ³#W1M }Ü›!û¤=„Äõ9F·KLÛ°µ¬y"×(ʸÍįÇ~]× hÚ–˜L–uLȹ°ö 5u€ Á±Åɉâ'ç>ò¥Ò=gª%l—R‡e[U;p¨ùm˜9!.vÂ=š¶tk/g²„ˆƒY ÁLB·ÏÙvµL|×îl¡ÁÙü_KlÝÑé=WQªA1º^él²>[ríKkÿNû2€ž¯©=ü”dE#¬ (BÎÍÐYÊøV
ÇV
ñ
¶õÚ®%tyøÛÍ¿h”~[n’üÑ=j£ ·€âMqN7gÀuI{ø- Ûr“ø³³4u„P/IÈv–Ä;{¨“¬Yî°•m¶îñÒ= +Â2’á´I „ŽDϤ°Ýîh= žgJ`”\`ÎÖÄÅoÇdÛJs`™b—Ø÷Zî 4…ZAÿÛ;á
ž'†µáKßÁù>¬ çÊ0WÒñ
&]ž’-䊡æGó@o:›Þú;adžßÅÑ«620š×˜`YÃäCB èOu8ŪÞË¡p5 q C¿”S™n×U“ÿ PoH h)¸gä^ 8†lî?D–¨æ¤Š½_#8¨ÀŸY h‹„yÉwËBê Æw̓ß-ã§È¿ˆQ ðÞ×Úðß…û þLºù† 4Z_ú)N R‹p&T +endobj +1394 0 obj << +/Type /Page +/Contents 1395 0 R +/Resources 1393 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 1392 0 R +/Annots [ 1397 0 R 1398 0 R 1399 0 R 1400 0 R 1401 0 R 1402 0 R 1403 0 R 1404 0 R 1405 0 R ] +>> endobj +1397 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [393.041 314.0909 461.713 326.1506] +/Rect [364.6945 737.8938 433.3665 749.9535] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1386 0 obj << +1398 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [402.9837 282.8702 471.6557 294.9298] +/Rect [374.6372 708.0059 443.3092 720.0656] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1387 0 obj << +1399 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [320.374 251.6494 389.046 263.709] +/Rect [292.0276 678.118 360.6996 690.1776] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1388 0 obj << +1400 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [348.05 220.4286 416.722 232.4882] +/Rect [319.7036 648.2301 388.3756 660.2897] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1389 0 obj << +1401 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [488.512 189.2078 561.5676 201.2675] +/Rect [460.1655 618.3422 533.2211 630.4018] /Subtype /Link /A << /S /GoTo /D (tuning) >> >> endobj -1390 0 obj << +1402 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [390.4905 157.987 459.1625 170.0467] +/Rect [362.144 588.4542 430.816 600.5139] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1391 0 obj << +1403 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [321.49 126.7663 382.69 138.8259] +/Rect [293.1435 558.5663 354.3435 570.626] /Subtype /Link /A << /S /GoTo /D (options) >> >> endobj -1392 0 obj << +1404 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [317.0267 95.5455 385.6987 107.6051] +/Rect [288.6803 528.6784 357.3523 540.738] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1393 0 obj << +1405 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [356.8967 64.3247 430.5501 76.3843] +/Rect [328.5503 498.7905 402.2036 510.8501] /Subtype /Link /A << /S /GoTo /D (tuning) >> >> endobj -1375 0 obj << -/D [1373 0 R /XYZ 85.0394 794.5015 null] ->> endobj -1372 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R /F48 880 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -1397 0 obj << -/Length 3410 -/Filter /FlateDecode ->> -stream -xÚÅZÝsÛ¸÷_áGºc¡ø"¶O¾œ“ºí9WÇ7›»{ %Úf#‘ŠHÅñMÿøîb”(Û¹x¦“‰.€°øí qÌáŸ8N
3¹Ì³\³”‹ôx¾:âÇwÐöîHø>³Ði6ìõÝõџߪì8g¹‘æøúvÀË2n8¾^ü’&Ù pàÉ›÷—o/Þýtuv’éäúâýåÉL¦<y{ñÏsª½»:ûᇳ«“™°©HÞüíìÇëó+j2žÇw—ß%§â -D+U~ØŠö뙡öÔå $_Õ¥ï
JÕ¹>Í’7p‚Ôôp_tTëÕù{–tB`¸8ãr+(xàR%g(À4iKd–j/u
'b“íÒq…f·Q ¢>T¸ÐráôÄÀ2Àö”q з,æ÷# ž\Áim¨! ËM¸¡öEYW¥§õØñ„ÛÐ Îy<,ÊpÂ:!`M }V'7%}“ÌžøHDbŽ•
5 ¨,±«:X%ȬyrqK݆У·¢q -êAl>m˶£FXX[ÜùÖÊ/²îèä¡þ+Oy‡G<Ú9õªõFªê‚>Ì—ÛI$
ÊCÅõ‡‹w^«|p -Ä”"ýtG˼ -úì}{Ñ‘Ab¹!Ë´¡OÚ¶=t2RsÆÅ‹ ¡0fzí¤ÈâʉPY8C+Ç -2ØÊ<ËøÔ2ÉÅWD YžåëÊdÀC¦’òK8o‰NÚä¨ Øù–h}zcðס5Á
ÅR󒺋…ßWK *?GÝt ORcËåO4hY~.P “N²ò¦#”÷ÍÃÈ~ ,9ª²sUU}û²i>¶!‘©|'ôÍ™µ¤ähpNfÂhç -y“ ¤9íeAu²kP©*o·ï8`ÄÀÿcßÞæàAhi\Ô^ŽðAöÃv Ä´{®æ f ”bÂÇÑH—ƒd!±Cdç–.¶ØÉlj:2‰íYl·‘gb1>° Ã…¶p©\ŽN~)>7Ù=£è)ý8¨õ+ zReçTGp*öí™ùE „÷D˜%`sy‘Ô©˜ÃP -ú|¨–‹yƒv/{T
Á“KH.‹¥ÏœNi\G–—1>•Ñ$·;M>zÌ?Š^&$ý±t)Qž@¨¾ :\BÎS(•Êc¤†õA¤†ø ;wíÚ -*®ÿqþ3ÕÊ/óû¢¾óC¶ãà› &®écgPÎiŽ8¥gÛÞ1uv -}Gp·À¤ôÐJâ—Ëé4ï›Glõ Þú°æ8†rK¨í»gf#Áë¸mM‰Ÿcµ…^0vN Žr0A¾ £“pR¨>ÆH‡6>ŒÛ4$Ðq¥ûÎ@CUg!:êu - -›„wÈÐÔnoþSÎ=ÑE,P~ùZwYaÈ°.êÖ…œäÇ5ìDɸ°EF&„H\—D®Kªë5yéÕZm—]µ½G¹ŒÒi $ -‹c¹Œ7$Oˆ4åLK+öDêfvY,ÓÙ‚"xINO&Ñ'ÊäÓ– d‘,¡2ûe²hV8®_Œf*v?Ù{ú -`´3‘CŒƒ¹hÌ'7¦DŒûa”Tx#m¨ø\,ÁnLÅAV0¥âÕ•3uû3að†—¢Ôét‚f¹D -ü9VFB0þ‚[k¥-Ëx¶skýÇF……`ë!rp4Ž/_
#ƬfqS3$A™í òQB2m³c…ˆÒyú~3Ž¶"€îüK1ïf.¾Á ,k¹Â«ê9Z c¹Ï:°%Ú1üˆ~PȨ2Ÿ!)L¾ëoÊÊ]Ç+ÆÅ8¥!Û5/–ãëÈF¡mòç;—SfQ0Ù_3 ÒgÃ4ß±ˆ{èÒiÆ´ÈAƒsø¶³E)9×,¨ÝkÂEh&óL?̵T.Ÿ5TcÌ„DtèÚàc$‹E@Í ˆÃ¢‚@$mA…[Ñl -E«"Ä×ÍíéøÆl@§ß€ a-ãZ¦¯Š ÁѼ‚TʬIÓ¯`F DÌ,ž?ƒ ž2üÅÁþi@“ê -ËÕâ9mÍX -n×Ï+C¹ -–1¬SxÙÑ…uX‡uH„u3•g1-œÇÉ!ú»”A”0°‡zh¡ÅÛC-Cì,=ø±§?#ø‡=¤õÕô[ D/•·™qánz‡[=ŒÇáAxz<ZÅŒ5ò+X†ñ(r
®-͞ƣ q£ÔSQΔ1Aôç)rÓŸ'¶ÐybÍÉÛé´äωñ<‘>âàÍËîaö¶HIzÔÁrÚ™œC{IŒY‰ÎÕ®=š¥J Ð< -)Ì~¦C—>`Õ’`4VMÛRo÷14‚îܽÀ>ÑV¸W¤ùÜ]âóÛ¡ç4è€WÔhûlxy<Å×0‡åpK¨Â56Vˆ-ô¦û‘a“? «¼‡&®¼¯W&æ¶P½ñ¤íhNS½€ Èý„dÜÆŸ <Õ¢öYaÊMˆ<T _Ð)ªýóÎ
³ÜàA‚QFÿiòÈÓœñTã«:'µ 7çáEͽ*UíÇþ宿 Áî¼hËÆyhñ¾ÍŠî†š¯š™°§V¥Ï„šÂ¦²L>“8Nšfô²á¯
Þ®ªe±!"€}â<ñ}-&؇²^ßrìGùe^®;š £Ç{à ƒc?us;1d(þ?f.âSl±l›ñ£¬w+O ep¯›”¼.R´ÓMÅ3Hü]cŸ»˜‚ŠâðŒûP -Êü˜† -Dúi¼•< • öºÇÓAkôÄè& €ÆµLf&ðWgYªvnc5¦{¯÷Ïep¯”þ'}ÿÛa‘Ê@Fò2eøè·…{¿1t±®Uîå5Å×ë ‹c‡âcþ@‚uwÒ¾ˆú¹ìw{úTúh,¨¥_Ÿ=úW'º‘
ÏK·£ÇÞp# ÕO[H -†¯O>‘¿Çò¿ˆsƒ»·,×äÞܯcÀAºçE•ÅG- õω@‡d:Ù¹9Çe â«‘DÒر¿€ †aš¬·¸@¾ºúpñî”è— N‰øáý™'ùßgh;Èv}’óÄq›|Ÿ| WþNa÷¡î汿8õ×îw:ñŠâW)õÙåÏXx¸y ì=
Š€
Ñ?
Š~{З}.H*ú–z k(éwc´Þ?Ê…äK+%¦~C ÿýÞ¿ù»ýÏ™!9PÖÊiEñ -¥âªPè™Þ[{ømïÄâÿ’:e endstream -endobj 1396 0 obj << -/Type /Page -/Contents 1397 0 R -/Resources 1395 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 1394 0 R ->> endobj -1398 0 obj << -/D [1396 0 R /XYZ 56.6929 794.5015 null] +/D [1394 0 R /XYZ 56.6929 794.5015 null] >> endobj -466 0 obj << -/D [1396 0 R /XYZ 56.6929 769.5949 null] +470 0 obj << +/D [1394 0 R /XYZ 56.6929 484.6014 null] >> endobj -1045 0 obj << -/D [1396 0 R /XYZ 56.6929 749.9737 null] +1051 0 obj << +/D [1394 0 R /XYZ 56.6929 459.8194 null] >> endobj -1399 0 obj << -/D [1396 0 R /XYZ 56.6929 374.4718 null] +1406 0 obj << +/D [1394 0 R /XYZ 56.6929 84.3175 null] >> endobj -1400 0 obj << -/D [1396 0 R /XYZ 56.6929 362.5166 null] +1407 0 obj << +/D [1394 0 R /XYZ 56.6929 72.3624 null] >> endobj -1395 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R /F53 957 0 R >> +1393 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F53 962 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1403 0 obj << -/Length 2993 -/Filter /FlateDecode ->> -stream -xÚÍksÛFî»…>Ò3»O>î›ËMz9''«ss×öE-N)R'RvÒ_Àb—"e=Ò‹3M<‚Xì.¯@ñƒ?>JtÈdªFqªB͸ å« 6z€± /¸£{¢qŸêõìâ‡Ò0D4šÝ÷ÖJB–$|4[ü¼y{õq6™^Ž…fA^ŽuÄ‚×ïn¯ “Òã͇ۛw?þ<½ºŒU0{÷á–ÐÓÉÍd:¹}3¹ s©´€¤[â? n'Dtóîýäò·ÙO“YÇrÿXœIä÷¿¿üÆF 8ÝO,”i¢GOðÂBž¦b´ºPZ†ZIé1åÅÝÅ?»{£vê!1i™„:ñ9 yHN:
# C(§íz‘µfñ+Ó N(YÜÖª4h—Y‹P<-MEPVÑXÖ¶fµvÃECÏU¶0µ5‘-LiZ‡ËÊ’€Í%O“×ö¹hÜ‚MSçòâ¶,Ú¥›G*[™Wž1ãWJ‚miü´0*$3æ<Lµö˜ùÒä¿Û¥As÷°³L–/ ô©hÚ¢z ·!ƒ„k?¯MˆKƒTùˆ«PªH Xa'ÅBÉÄî¦VØJ]g*EivS=[vªdaónjÈÝäÙeÊز¡ê{g™¦©·›Üø7àqáH²Êqú/Rò\ÓóçÆM˜-ÍÊ1Ò· àC¨0U\Y>fKT¨ÔIИ¼-ê -Ä.“((IÀ¦üŒÃi0¯7S?¡hqÂ=½¯h|zó†Ðà Ê-²0M¾)æÆí`U‰´y]å
-±x\DfôJ§Æ•sG=íi)À~ÙtŠVì&‚0˜ù´.³¢Â½¹pV-¹t†€¸Âm³ -ö€0͇œ¸Kg°Ôp¿3ý¥¢èèÏ1ðlÝ£¢Pû<i‡®›Ó¢è¨Îpò|5ä„‚âXN¤ÞŒy ¦pî‚#²h#TQ~/ËÉúÉŽ“ÝÅÒKÊÜ5ö·ý#r‡JÇj¤’$LáíK2q©’0fñ^&þÿÍòŒô|ó(4ÁZôqi¸Ô¸;ÔXÅP$G4±”Ï xðü©ò>MS$ÛtªðWpo 'Œ–»D¡Ë)¦®°*ŸQo+JÆG A–Üç÷ëd€Ò†ë JHP,SbIš!OˆŠ-¦qN¬Ô[)ÅZÈÐ/Ç‘Štp…ÂK£ÀT9d"hŸ©x4ž-
<fåÖè¢1Ø íS ò4vi¤±^Ñ "•Œ‹%’¬kp™í»Í°ž9¡§ž -Ÿ5¥ Fº€4›½Eé”9“AžÅÊŒá¶äÁ¸, Ò -;öÂŽ5˜zHªŠeõU.푽Já4¨²òëtHW Ò]ÙÛª°!PRŽŠO¨¼êja/~åk;@Žl½)VÙ¦ÀB _·6ÍChî0ƒ$ˆP¶Ü9úÀQqRă ²iC %†pã:yÊŠ^ ‡¯Ëú ”µM„"›£Ò"~ÝŠ€ùáâ ·]ø|ã¾î‡œÂ¥-Ͳޖ‹aN²(š<sùé)«î™Ë×™à7>2áSÄç¢L£0qá'/¡L -û ‘rÅb"Õ†€]dm¾ÙÞŽ’ªE‚mM–pלp²U<é2A%¾9r05õÊ`dt7»51ê«tE…âNh¯'–—ÒÞ®ýùWdq<JCТ+ŠCû°Ï2gÉÀCE -åŒ`à;§û±ÅŸÆ|˜ß×eY?u-É^oó‡5h#Ë pÞe$‡/ a-¸vTÞ+!& ŸÒ5ÇÓhAG*þ¦Ñß â -tLAÅÁ ÿPC@†§}Ç*ŠUd;WBÂÝ×´e‹…s_ÛQið®¢òK -µmWðB®â$ú9Çè
;gå—$Ñ ùõ{©Zô• ~ù’~Æqù í¿PŸPꤔm\Ä"¶\xÜgÉxsdU?]ãƒÎvÃ÷ "{?¹»f{CxÛ|ÚÝ@®óÍñKÔ MÕ¢pEk©jacöIŸ „o jѯs¥æ; -Ç[KoôU¢·À€{D ÷íáFªkdöO¢$!`…OWIÛfåäÓÚ@žZV:Tß6UD¶ O²M -þLâ€ÚIü„µíG©Õq-ôÎ÷ GXž¤!Üç",œ² å"ìG(µ–<¸:6Ø?aÊ¢k"ïË}…¡:?ˆ%'ÄÜçÿ¥ñ7èåñ8ðœ˜!ÍK" -Äo&ÓK¨çg¶|`ÁÛºì¾ûÂø¡h}ˆÍͦu ^ZsæŠi{á -üYÁqáö¸þŽ;z\KLÜÏÉ6²MbjN¿¹½úǤ)Èà†Õ1”l][w]¹2à]Ë4vÝ:ÀØÀŽ}¡²ÈlxIÔ@ì@R84è£ÙÜélwÀ—mØÅ/Ù°ãLCÆÏe\AEÄ$Eôk§
r›šu™åÔ¡ˆƒ¬”Z¡ñ®m
°Ó@»®ê‚îÇ$ -ÝaÍ#ô@K<uîÁS¿6Y„ÏŒ(¼ehÇz -D"R`7Kw -Dx4*
”ú5šë åëä¬ c¡êð«o ú®ÌFgSÕ/ýmäî÷¡àô29öÝ®kÇÁ=Šk¡ðbý죸ÿ¥£ê±þ?+–ý`endstream +1410 0 obj << +/Length 3082 +/Filter /FlateDecode +>> +stream +xÚÍZKsãÈ
¾ûWèH§¬^ö‹Üfg<»³µåIdm¥²%µ-f)R+Rãq~}€š¢dÉòij•”l¢Ñ/à +©¬ µYs¼`Ym2‘Æé‰eãÑXi‘ËØœž‹ÆÅ07i„>˜ +$˜ +cST£¶"U2ß©1 ¨Q-2í(µR¨TŒz¬‹•C)ó^és‹\i\ ™®?ón¼*ºùòr¬S µnUÔ]9oAkIGÓeÙRÏæ2‹¶•£?ÂqÏÃÒÕØ2Q·äþ°8ÊCJ‘[«üz3WÖ÷„‚ízQtnA/¸ˆ. ®^TôÚ5üÄy±1oê8˜»¹Ûuû“ÚáI•Di˜ŒzB * +ä2 +Óôð; ƒ‘ß&CàŠ›ºz„dŽÑ(óU!4ÐÍׂ 2K¬ý‚)È“JR+r“ÈsŠµ0Fû£?”Õb^l/ +—›ÎÔóŒñ[žâ>Ïݺ£ºeÑÑì}tÌK7wGV“2Cù©¿ “™÷È©ZN{fn/Uz* ü §%`0Âè\Ÿƒ +WÎÕ”!2/„ŠŽ‡YÌÁ<{¨àËq¨@¨o9 • Îz +¶šºzäE ñ=Ç@3–ʈ<µzß?ƒÕ>×è!ór 4ðµ€²+°üw¥“×\$ÄE:lHé|XéyRñÛFd*‡ ÞJ 'æPŽ2y*ÒÌJ>ôZíüw{õ\ v™i©¾<¤IWÛ¶£–¿¿î yô€ð¡z ÿ±…” ¿Ù€ÌY¼o㊂b1p…`- +PyV 鎮ÇÚ_ѧBÀÒ©aÒ!רÊyÙ!²®S<¿Îæq42îŠÐC‚à ,“îÜ-'“Ûß]ýæöŠˆ· ß0 33Oº¹½~+ˆ6½ÌãÈÏv$ +Y¡àÀ…½( +Ö<²? 4ûã3nû*”GJ¬¸a“öà>¹M¿ß#‘ [7F>pÊ£›¦Ã“™<ÜT& •hù‰¡¯è:·Zs·×<WÅÂQËÙ€má*×1Ž
ÁœâúE˶m3/¹nƒK–Ý’ÇÑ#ˆÓoÌ…™<,ÂŒ®cIÑÒÍ +º u WÀ0ï-Û®/#îomä/ØÐÀC¸Á÷¥ÅXóÅ)¡?Ò³8Ž£Ÿ}xí‹ÓeåvCöüP ‹$•ýP!yðƒ{‰øĵÍv3wá
ö¸`B24þÁe²]©ó§–@P¼:â,°À ÷…‘fxía„â Úw\ÈÈ’¨"ß; ǬÙxJóà‹6‹îè}Eý“÷o‰ îÞð$ ×Î7åÌ—6 ‡rà…Ì•ï> úĈ½ÒÁqæ9sO +B´¡É„Bc?k.H@¯Ã·§ì“$© H+¹’)L&À]G·`ÀŽ¨´[°ÞÎÀ}/–`ß1<éÈÐGVìë‡H¯ÝM1™ðRËâO?saC”›°c9âˆz}—«uåVÀܾ냪ͻ›[Ñ `aç‹÷âCrU|ß{ÀîáDD%ÇQ ¯=bCó,ØÞ ×Éú ÛœÆéP-õÌÒ, êòÇkR ©Eù掽u Mèu´) –5¸†Uð®Tð©Øé ?6fÌþïñRJ‰c@›.9¹¦Å¡á7òØâ& .ÎiûÀ#â;yDßCu±éÊù–BP#ûr_¨ `]zµnÚ0AX¿u0²è˜@ˆ… äôxA‰Ìmè~ æ ^hÚÈRe ds˜œƒZ˜Ð–÷µW&\OLò öLÎ-ØIÎy´fy¹Í'Ï#éŠõ¼ŒôTлi¯¨j$\
hMØ·<,rœQœèKcr>*Mœ Ò÷àéðNMM„·‘L£¶ÙðÕ1¹ÚV]¹®x¸—•b™ aí6«²#‹…Wº‘psë’Š3 +<çvƒ*ly±žÓ}.Ði,øý½ +’ endobj -1402 0 obj << +1409 0 obj << /Type /Page -/Contents 1403 0 R -/Resources 1401 0 R +/Contents 1410 0 R +/Resources 1408 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1394 0 R -/Annots [ 1407 0 R 1408 0 R ] +/Parent 1392 0 R +/Annots [ 1414 0 R 1415 0 R ] >> endobj -1407 0 obj << +1414 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [341.1654 518.2039 414.8187 530.2635] +/Rect [341.1654 214.5127 414.8187 226.5723] /Subtype /Link /A << /S /GoTo /D (the_sortlist_statement) >> >> endobj -1408 0 obj << +1415 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [434.6742 518.2039 508.3275 530.2635] +/Rect [434.6742 214.5127 508.3275 226.5723] /Subtype /Link /A << /S /GoTo /D (rrset_ordering) >> >> endobj -1404 0 obj << -/D [1402 0 R /XYZ 85.0394 794.5015 null] ->> endobj -470 0 obj << -/D [1402 0 R /XYZ 85.0394 728.5142 null] ->> endobj -1405 0 obj << -/D [1402 0 R /XYZ 85.0394 696.4086 null] +1411 0 obj << +/D [1409 0 R /XYZ 85.0394 794.5015 null] >> endobj 474 0 obj << -/D [1402 0 R /XYZ 85.0394 696.4086 null] +/D [1409 0 R /XYZ 85.0394 424.823 null] >> endobj -894 0 obj << -/D [1402 0 R /XYZ 85.0394 666.5529 null] +1412 0 obj << +/D [1409 0 R /XYZ 85.0394 392.7174 null] >> endobj 478 0 obj << -/D [1402 0 R /XYZ 85.0394 609.895 null] ->> endobj -1406 0 obj << -/D [1402 0 R /XYZ 85.0394 587.5837 null] ->> endobj -1409 0 obj << -/D [1402 0 R /XYZ 85.0394 501.2674 null] ->> endobj -1410 0 obj << -/D [1402 0 R /XYZ 85.0394 489.3122 null] +/D [1409 0 R /XYZ 85.0394 392.7174 null] >> endobj -1411 0 obj << -/D [1402 0 R /XYZ 85.0394 309.1877 null] ->> endobj -1412 0 obj << -/D [1402 0 R /XYZ 85.0394 297.2325 null] +899 0 obj << +/D [1409 0 R /XYZ 85.0394 362.8617 null] >> endobj -1401 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F21 654 0 R /F47 874 0 R >> -/ProcSet [ /PDF /Text ] +482 0 obj << +/D [1409 0 R /XYZ 85.0394 306.2038 null] >> endobj -1415 0 obj << -/Length 2737 -/Filter /FlateDecode ->> -stream -xÚíZKs¹¾ëWð8ª²°x?’“W–¼Ú‡¤ÜÄÉî FäHšZšär†–_Ÿn4† Ò"G^щ)U
-X*¼Ì.ÆÅ´^óT¸ÄS N¯&"Ÿ"ß„ÏPØ°¬"'Šœ„/9UïgU
l—!doŠj´(ošŽå”:öÏO‘ã° bÕIÃ3\lÔìHk§ÏãÞ¶@ôAÂ=“ÒtȦqÖú¸í‹Áð†—õ‹ùâØTT – µ>H™Ín±TMWhÉÇãÔ³**à¹Ògg çÅ¢|c'MÛ›âd7Ç×2sˆ2B2Š„^í‘Çz£‡ˆß[ó%S6#vŠÃ:É” ò°!0o¬ŽLùáìŸÀc#ÁwÔ³Ädð%Ê šc1_ÞLÊÑ¿ŸÒ·ªšÊ¼Fnbý¡¬ï7F½¹ 1Íß1D˜ìçªéÌDJd°³EyWN££yg§¥ --o>ÉGQŠÐM’ºÅHš¼5ô¦¬^aÝg7Ë:þ*ßÒŠºœ$gšL (ÚRƒ‹·¿rÃ9üÉɶ}S“’§†€bˆ"o‚MA‰ÝÚÕ–Ûót᫺_ “k
=÷«—…yôêõîøÄ -%¶}/˜?ºQãI§(>Žîóé]± êí,õ}Y• -‡&¥RJo -ÃïÐ,’ôÊÔ¥T|0Z»<”7Ë8 º°Ê2 :B¡Õ p ·qÿ€ -:Í4ˬ&¢øXVõö|d - šÁ
SÊÐ)U´DãChY¢“|Ò‘Þ2CljÌiB‘H!S ààŠÜ Åd©Äöµ‘„,ñKòرŒØ¼5RJÄ[£Ø!ÝaŸxOôˆ¤+‹ÿÒ¥QK‡½3:( ‚m± } ’60
@:sõ“;ð[GéN¬#gUGlð-•9u¡„hãÃêPbD<u›FŽ¼;–ϸ³ooõÇS¼üâà:$i¡d{Ð?6&û;&Voâ eYÞÌ¢XŸ=ÑD€ú}Šî9’+‹•t€ZQ
¤eÕî|á ? ’1¡at‚Tçå 9µð‚/ø¤ðŒ[Õ‘â>eVB>Ãx,c ÙzMüH±î÷ÇOÍ“;´½µ¼üdHàs2#;©%ô·âoÒ5|v8}C×4®#ùp_Žî‘´Ií±1©=’+µÇ Ú¿Ú“/GéÉAž"Âà§áõ±!{Õ< -yª%s ¿~.ö浨@P:á6÷ËtcÙðù›sÝ~òjAéƒ×ðs8d4ÉQÄÔoãd`RD¨_„+OZÍ67[þ5ih±2Z.Ò=|=Iw³ òI¹¥$« r@¡ÙÖ‘•E am°ÿ+‰ò¯rY s¢+뜎þâKÂKH8ñPz%ö <Î;Þm^ yÞº5çÌI Öe%“^èÇžó^',xêcæõƒní˜ò»Ð[2 …P æ"F9ûÙ[k^FY¹êÖZü -endobj -1414 0 obj << -/Type /Page -/Contents 1415 0 R -/Resources 1413 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 1394 0 R +1413 0 obj << +/D [1409 0 R /XYZ 85.0394 283.8925 null] >> endobj 1416 0 obj << -/D [1414 0 R /XYZ 56.6929 794.5015 null] +/D [1409 0 R /XYZ 85.0394 197.5762 null] >> endobj 1417 0 obj << -/D [1414 0 R /XYZ 56.6929 122.0233 null] ->> endobj -1418 0 obj << -/D [1414 0 R /XYZ 56.6929 110.0681 null] +/D [1409 0 R /XYZ 85.0394 185.621 null] >> endobj -1413 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F47 874 0 R >> +1408 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F53 962 0 R /F21 658 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1421 0 obj << -/Length 3228 -/Filter /FlateDecode ->> -stream -xÚÍZÝsÛ6÷_¡·“g" ð ½'7±[wR§ç¨wkû -ƾº<gæ'͆³¾œ_üýF¥ èD&“ùÀW„Y&&óüÇé믯¾›_ß_Îd N“àr'áôËÛ»7DÑôyýîîæö«ïï¯.Óh:¿}wGäûë›ëûë»××—3¡¢XÅ,þóîîš&Ýܾ½¾üyþÍÅõ¼yx,*”÷׋ '9œî›‹0P:‹'{è„ÐZN6Q¬‚8RÊSÊ‹÷ÿìFÝÒ15E¡„Œè) -” Ù–¶a[nFiÉ0=ÙNQœ¢ê%ÌÌBÙ«^ªêE¤‚L©x’Æ:HŒ‘îAW:Sh„wï+Û¾‚¾H¦ær%rúöêjºÝ]ŠlZ·õ².‰²tkZ›Á´´æÛÛ9ŠŠ¾íÚRcSä34ïã…ØN¡Ó°Ó)àqoˆ{ùLÒi×à.Øz¨wÔ(Ú†ë¢ië]±4%õ·Ýn[7"S9]t-‘‰á1#”%<–ýîoÀY¹µEÙÎð*UÓÆî íŽFŠ -–oL[Ô~¯+ÛÀ–Q¨¦6X¯78¿ X -ž Û h¼bi©“ÛG[Ö[ç Ð]<Ñ -ÍïÈݱËö¼Ã^cW“̦·àfJ‚g ïHÅ ‹”¶&J³f§æ‰G.ãfQwÌäÑ슺cNÍS3;öTòÖnJo¹iÍÂ4αßtË5µ Ï - á}å 4+³a"9 >´¶bÒf[Ës´RÙtgÀy]»6< ½ª¨VÔñD4ðj‡{[³k=s¿œw½¿¨qS3gû›m-ï¹1ÕÓ˜3’Ü‚”&Ñ™²Øí»«Léò8 ¢pÔj),ÍsI ¨kÓ¬‰ÒÀ„lÚ-ÛŽ&6=^¿æ¥ƒ·féÒ¾VìÅ@\®
&pœyÏLàÔÀò:U[,;‘ˆœEFjI°FN±2À ¿Ò©²!R ÝØ!ñ ñSÊß\¦Ùkkr´
Äaû´uGPNKÓ4ÜžÏߨ yûuá¢9¢Ü‚¤e]5PôlÕRŸ”@Ñ^<Ï‹âÑL-fQŽž“üc …»CP ÿ»bybçiý¤P¶§ZjTÖæLCç:cKÖdÒ%S–´Š‰Ì6Ë]±°yЋ—ZÉt/ ÍƲ„Jcrá” =¢ |¶Ì©ã F
Ï.6<½,6EKD*æà…õžÇjÚ… - RÐîØ_ž»`6 ì–¹ÕÑNK³\[ð¯@Ö|íÅ ]Gl×ÖMà˜Ž!ñv‹ñƒ4WKÔµkÀ<-”GKCX¨E„„Iþž€Öò37eìP9¡þ8#5áèÂoLÚõ6|`S®Ù bº15yÙÏ€+â¢#'è$¿œ{ÙM³©0†›¦XUN8 :IttàarÈs]®Òœ péÑFÔÚc®äò{`£¼Þ€ -] -TøüNâÖý6Ô` ¾.€ŸñáÄ(ØR¦,ÚÂòL‘ð½uiÙŽ:àÖî 0©– Tšnµ²
#Š~jÙ†g 5<y]w%ŸÀ‘¾ÈHÌöQØŽ»ôÍÍs!;—@¦$„uÝ´v%Ó[^kèÙ¾Zæ6 -X©Y*Ôw »Åû Ö¶(ó›iöDh<[D:Í»%;؉dÕŒólX˜Á x -A á‹¥ -êL7ôaÌš†ý£Rkþz˜Tâĉ{I!iÓŽ%í‘yC=VÂc‘ŸnzóšVŠPE¯ÆΆÙ3„äÝ>•–›¥J³£ŽK^aŸüC_ÚæÀ|7²ÏGàåäÂÎÞp°õÓéºa-è·XGö~S R%B^ææŠ|Á¼'‰Ó-(š± ¦ë6¦MO75V4 [“ =ðøàþ5]\² Ž@)-‘Ê¢ryX)‘u«5
¬EÕù”ËpjCÍÁF`¶BoQò¶]CxZå -m󱌫ÀrÝ¡I¹Oy7QnglÉé -Àbs2ÊwÏÑ•î2ˆ[ 1ÄÇsTP11Ë}Ñ®Ó`°4ÕT‡«Ó™ fˆ¯C4:öÚQûÛÂIl(–©õpCyváh¤×Êr5¾Di©émušÙù*Î5¶ìrŸÔéÖßpLnà®'—kG-ws(¯ÛääÐ ¥@Ðc ÓÉtÏô²pl8PÊ+&Ñ5综‡4wŸdž'+é’ׇIýBdF®±' 7•ÝÔU±lFo.ã¾êkô¢~tÁ‘ølœx›„}Y7\{ݹÚø¡îõ>D$¶øn‡çˆ¥F¬û‡dâ¦×D6uᥤ°êÐ4Gø‚a.ŠÛŒø CE^¹Ø<¨Äuþ¼h~ÁlUæ¯ -§³øèî®ÒÃ&tjlЩ›a/& "·rï3¶A0„Æ*Œ89À¼Û»¡ÔcéßcH2‚/„@
7ض -: -MßÓ’ ƒ¤Ö~qîϲT àßRüU8y1-êŸl þl-J•egþtª -O—>˸±Ê‚8“éˆèÿnÿ¸Nendstream -endobj 1420 0 obj << +/Length 2921 +/Filter /FlateDecode +>> +stream +xÚÍ[[SÛH~çWøQT…ž¾_vŸ 3`Tewf „-‚*ÆòZ’ýõ{NŸ–-;Ø +ƒ©!©JŸnµÚÝß¹ŸVÄ€Ã_10–Ù ÃÀÍ f0¼ÝáƒÏðìýŽHsöÚI{ÝYo/w~:RnX°Ò.¯;kyƽƒËÑï™eŠí +<ûÏéÉáîž4<;:þ +Ÿuu‰a åM,pÜ,f^W³Û¼!ººÆVdÍMç¢ÊšÚæÛ4=ûƒžOFÈš‡ó#áD‚Ü`]ÝMy[ÔÄÌá8¯kxIP·žÃòÎårWø8o•ç!´g +„v°·`pŸÄà;Ž»‰ùkoµ60倃{Ò1î–%í;‰“ÎßàêH¼Pkä£U ši=÷þÈaDúº«‡rò™º9É‚þÓ‘î*¸Ç-{Øy| 9]Ó¬¥ „6ÍB‘ÁUïóq9JZ{^ÿc•¥sI· *F8÷w1€ªQDô6Õ×¢bâonT_ë :ᕵN[lA£³›ªnˆÊG£¤½5šK²ã =!µâø„Ú¨Ro€Ö¨³QEa”ZåÔUrïªLk Ÿ=ò¨ÀN?¢ÀïŠz8+¯ŠÄ×r’ø{t@@bÖ+o“m)/íî)–·=ÏzÖiǬ‘²‡uF0©<iÖ>üƒ«…@ïmR«%¶)ÁûáóÞn€¯³¯çu °Ë[ósÚ¾± >øQçëO&½² f%ˆþzðX¯²õyî*Ú3rÝi>kÊ|üÝ4)z§äiî®ñúš¯ ÿƒ®‹–›¬×€r2*iÝaSV¨†Ò4Uj£:1ÉoõpS$ë +]±˜‘öÖP/ºÙîK»ÇÜ=>Åñ…Øã–¦4³{€’@"‚íuu7!–<d‡_§Å ñ¤ÉÇi¨+›0»Lo“l!=à±^6;Lž -dó¬²ñŽygû¬2WpªÎî ]¼{ º-=Ï>TÃœ¸A_rtgÐ +lsšÑò‡"ã³qñpþ–™óiäáZ~-ñõYÌë ²Ýpt«’V’kDó”e Ž!zv +ìÓ ò¢‹¹W¨W,×çquÕKÓª.1sH¸^ÜM ð7³ºµØ^%]üpz°ÑÎV_q|¤¹gFÃ⛕±–K±çÏÇ'G§ +ÄÁÙG"(YµAFàÀ] ‘*" Orêb
ýFXÎqáIg˜øŒ@©{ÒíÚ§2¢Df•ï‰”4‡õ<§s _¼;”‹‡R²P˜GQl$U- Öiª\*[ +ÁÌJÇÖ8 ñcs +Ü=é¶òE²X’î«+g™´!DP¢g¨–=»RѾcÓz¤£WˆÏ:^ûä:oEoŽÆ~ñ2Îd ëvz¹¡VÍ œDGë\ ü“:´½]h$ê$M‹‘´xçÕ«ëÖRùìê®y,2¬›rœ¬iÒu R¤ÔÅñ{¬‘q¬€õz¯zž‹š¥Ú HÖKׂm¯¸Êü¨ìIýäxšk + ýшPbÕö‚öÇÜß·Á"ðõë²€Ï1%€îu•ˆ&Õg}ŠkeJ©å ¦l¬E/ßÀ‹Î)_q±K Éw=¦W ËtÐ$é€"‚+ÌŽ"¸`/kÐyº¯“¢ -'×U,ߪ%|aJ”ué–0 ¼³iê²=^ og߯ø¶A:aYO)QqÍŒòdHQ‡ê;QG÷…Ê ! ÕÊ:õHÔÛk7|až<Ã`2ERµËK×lH'z½!MJ÷“˜w{÷§w‰DÃ6® ¢Êy ¯ópøªhšb–JþЧkÝ(øôµ´Yx.q(åù@ ÄÔÎCØ„P-?˜§ß<én°ÃÇmYÖH¤5Œ{ÛØJHZSdYOöÏ.Ï!°åŠg'„;ú›»æ4ºùÖ¦åX‰ n<¡’x/‘m +Ä +:ºÌ´JÕQ|-ëfu½Gœ–¥°ro)XG¢s6è=ÐÙ€:?§–>XÒÍ¿qŠãt–¢ÔÒÒÔÆMí=V/Ÿ5Õ·Ï.“uEc[i O1O1üíë%X +f¥îñ}Â)ÆU2ÒŸ.c «’üjO©öüÒ +/¶ËÂK³[Çy‘ÁHEáE‚„©|ƒ)ù;…W¾>á
º^eâ
Ò•—êfö0ºÈ졳’ÙÃH 3¡%k•–yD}çëusó
:ÓÆç ø‹fâÁAÈ¢uÊÅ ¸!Å`ÑXâg€ZÏCÃØ!3¯÷qF>kˆŠW}:]! Ñæ'H§o’tºÜÃZOPϹ¹Ùì—;GÅ…Q°VžëžÒ¿LiCÙãJðcŸ³¨ +Õ}9ŠÙ£w,M§ `©ÉÙCQL¨C˜á¥$‚ +N@|BÛŸÆ–«§ù+L)ì† +içÈÏCËÅr ,/3åèó÷Õ/–ù 7aøÑ/òÿ+ÜŸò~MÒŸ>‘V˜ âZˆ˜³ßýÁ™TV¶³:[ÿ? +endobj +1419 0 obj << /Type /Page -/Contents 1421 0 R -/Resources 1419 0 R +/Contents 1420 0 R +/Resources 1418 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1394 0 R +/Parent 1392 0 R >> endobj -1422 0 obj << -/D [1420 0 R /XYZ 85.0394 794.5015 null] +1421 0 obj << +/D [1419 0 R /XYZ 56.6929 794.5015 null] >> endobj -482 0 obj << -/D [1420 0 R /XYZ 85.0394 465.493 null] +1422 0 obj << +/D [1419 0 R /XYZ 56.6929 695.8713 null] >> endobj 1423 0 obj << -/D [1420 0 R /XYZ 85.0394 440.7907 null] +/D [1419 0 R /XYZ 56.6929 683.9162 null] >> endobj -1424 0 obj << -/D [1420 0 R /XYZ 85.0394 255.2465 null] ->> endobj -1425 0 obj << -/D [1420 0 R /XYZ 85.0394 243.2913 null] ->> endobj -1426 0 obj << -/D [1420 0 R /XYZ 85.0394 76.199 null] ->> endobj -1419 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F39 858 0 R /F21 654 0 R >> +1418 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F47 879 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1429 0 obj << -/Length 2977 +1426 0 obj << +/Length 3296 /Filter /FlateDecode >> stream -xÚÍ]sÛ6òÝ¿B÷@ÏT8|“¼77qZw§ç¸3™kû@S´Å)EêH*Žï×ß. )™rœ‹3WûÀØö »K‰‡±0–ÙT¦‹8ÕÌpaùæ„/î`î‡á×,âåtÕ÷×'£âEÊR+íâúv‚+a<IÄâzõ[d™b§€Gÿzwy~º”†Go.~†žPÚÈèÕg¿\Ÿ_Ñ„õK¿¿¸|M”šWï.ß\üðëÕÙi¬£ë‹w—¾:s~u~ùêüôëŸNί‡#O¯%¸Âóþûä·?øb·ûé„3•&fqÎDšÊÅæDÅŒV*@ª“÷'ÿ NfÝÖ96i!˜åÈ'¥YôŸCVÙ”Y+Í>ÙÿmW8 _,á(©1Oœ€öqÀå»aÇ>ª%ÈÒ*¸÷2Ö1³q,FÙ§Ù nç©^ÄF0iA/Pø >°Ÿ_½go/®Ùùë_A¸2MtÒ³œGgÐ!#Áþk}(Emc–¤±ZLiÝuqÒêo eX,E:Ï )5S(Ç*eŠ
dЫ §¬ÑÈ)„J-ùqžLȽOFÝþhˆS–èÌGÆŒÇûFöÈØdœ0( |ç “Z|—jÆ)ÙN$¤tl¿^— yâS¶ÙV
ºusïáý}ClµjOE]Wø¹Û¦E© Z@,™P@‰Ï¨>ß;X¢˜M¬ôË¿óÇÉò5õš[OŸšUy‹§¸-è0uOà¼ÊºŽyìb0 ‡iÑ¢|
‚ǃ;–à{9¨×ë²Ëw]W6õ>É· ¼w-ò¦]u3gêœj¡ Ò3`Œ²2Z]Þ–7Å -‡*Ênš\L¥pþf“•5Á»¢ýX´~O×7t%š+kàî&ëÝ¡p>óë²aoYxža^>ÍÎuò‚f šöUçÎ!<ƒ§»ï×%€àŽ£Û¤—+oê ÎŒBWÂÉšmÖöe¾«²ÖË b×±Ú½+¸7Íå¥xÀrW~,üd` öëlãqýÎ
§ƒJˆ]·ËªêáT€«@Q&º!Ô°¹ñ¬ºÏ à¾{W"½G& -›® -ÜŒNc°†‚à]‰¶Ðõ8’`!pß _—õŸrÌ2 ¼º¢!žÇYhýÆ‡Ó €l³²% ¡PÑ*ë3ŽLÂòAW`–X‚=àhŽÑø¾ì×ÊÌUIüUñ1s¶¢5ÚmkÚDY½"à ~~LXÝLã„=p%J3«p¬Üuhf_Ô -^ù¸(x«é¥Ø°!f)pÏm@ÓU ÊOÀl04§JN$ÐsâÝD}w+šŠ&VEzÚ>ÐÈÉ Ú„Saœf”× \ -B¤^·yù;ç2PpÂDJaùþñü¢pJj¶mÙ´eï‰;yÑì ›…ѱSÿ|Òé -Jü@ ì¦kª]_ÐhSd5Ü™Öü.eL`8iX>0 - ø5˜nêÊ/ L,ò¾ DÝÅqàk©ëÞ÷ÕÄIà$7ž¾+¬óæ5§¯ÞؤôÆfôhŒÐ÷Þz^'°ë,Åho¥›¯OtІÚ`sû í™ lìݲdäËý™.zŠ]ô4KUr ‡Àk³ëú™ÂHg¬_D2D2ñtr\c“•îº&/³Þ½&ûÁãÔŽaøÖŸù¬¥ö þðö H'0
¾<{{¾ÿ$žaðºs"º¼, ½þ½q,™ª Mº$7´¼ ò[:¥ñÊCGڛƽ’6xÂÁlòøŠH :Ô:|´Ø'=ºjzòÑ8.Zòé-V "åÈÎh÷•¢ò`[ÞÕͨ:tþ¢†g;sN ^ï5Òàˆ`Ëc${H ò:©ß€Áõb;y&Ý)j¿+Ps÷Og´`Û¦¬û ™{Þ<ø\f]LÔç ½ó¡ ¦²Ü8‰v% -ôþ9™2‹øË’Äù]ߢ´î´Ô R¥DØùÌ=6`é:Yhž2mâçË›
:1 –5”ä$6è$‘à§zÇÅö¶ fõ)°Õ@2?=Ê×Ýù(bLóôr S©b©´æH©˜5¸Ú˜¡ ù“î(Ç ù<öL ¿,{^RŸT b¡>ÇžÄ0câôä”? C™Ý–5íÝÜ™Ðý s'æŒ +ž¶6+,¦’{zl? Œ&—`ýL%N§\)Q gÑ„ø_˜E¢ ËÓÏ°È -ful ¼OðH ç‘£þ¢,z~eñ[<hq ×æK+‹3“è§ ‹JH†elÊ¿)>r’ J)B´ -ÚlÔ—›bÙ7ËŠR:€â×Y_&².ö/ª
(A †J.oÊÞOAäxG ·>¸Üú<¥ðA¥[EvuÙwSÊÂØ õΉ$D÷I‹ ô&kK—–",5 ‹O'õÛÊW\Q–ÒÒ`èåYN‰Ö;|tâÙ à*uBÚcZ7÷Ô©' -ﮀsINÊùþ ¼—ÜHšŽªÌUˆ "›šò|ÖÁ m•¾Ò€>`¨‹»Ì—f é™W§¿Œ…Sê R‰s¨Í¨kÖíÙ“×pc†btÇB fpmf0&èÖÍ\ìz9|‰ -6Ù§r³ó«ÑÏß×üË0²‹OÙ5–?5`m7–SÔš>o F81ˆ\¤ è‰6|‚¡*+ž$à¼!3yò§P† Gu‚šD¥öiÕ†AÜOIÖßœ›ÐX¢¤z ¼ÂƒD <’/$OÝ—žZ*±Áš¾ÙÄ•ûe¨Z€üöÈÐ4r{ê#÷!ò KM]øÎ3£ÃÞk·Ù®êœÞ Åøô‡o#X`§ïk£¯J+ù¢®èŸÐŠ ¿¿N„‡Z¡_R+8ðMÒKŽk…LÇû ‘\ÜÑm¬¢súÌ,
MJã Aè„rµq¼„†x‡ãŽZòfÒø(€ú£G„AY ¬¼ºr!áð%a!$6{ žŽ:7zÇáÁËñÑËñ©—ãþ.Þc5°ò)˜°ö¥à ~Sñ
ÞR‘Bä ƒ†,5d|<ŸÎ|@kân³DKH’¹_9ñÅgÓÝçþ¦jü]8W•$GTzÈÇ ºF\¨
qòè_ÖJe‡U“£ÿ ùM%endstream +xÚÍ]sÛÆñ]¿‚of$‡;|\óäÈRÌÔ‘]‰i2Mò +„/ÂHŽÎ£ÀWB ¾•nàVCék¤sûRxéÄWQ‚œWÊt°á|(œJú©”Ñ(‰´ K˜CÖß¼?=CàÚ¸¹kW‹¬«ÚX–„ž{.‹•iCƒÕ©H½Â,QMë‚°éu%còv‘U
HA&‰wùŽÀ}ç(Q¢| EH¸@ ´dT‹¢é²wˆÀ{]˜Ùªš9 ¯jXÒW‘‚ˆwÄ©@žI ‡£!>µR¥¾- »/)V¦AxLZ^+š¤us;þáô\E±ô.ZàX…‚Q©ð^_ßÞ^^L+; =SÍ›¬[“¸•g]üA
ŒSÈ`|"ƒ÷ˆˆŒTR=ÃôÁÛ¼ÓáÍÓ8úoäèv dzœ*_ +• c:¼x*DLL?•‰7A3IAÛuWœw¥ål»ž— ‘2ò¦U“WÍ 1Û +Gh)5‡™ÿËßoÙ¢Ð:Ž%Aa’†ÏˆjÀƒ—•£õÓt;Š*JS?N¤<"ªH‡~iJ‚&¿NPLà¼&§:ôŠ 1„cbkŸ¹ùÔ\òY Ò÷yïüE5>ŠÐ{”‹)ܨÔ)p³ö-eÂÈ);‚e5+ŒYïÉz`¯÷¸ÂéýÙa7k<ÎFŽ ·?MÞŸŠP{g4æD WЃj ‚Íz¹lW“í›Êtàöf˜¼ ”à†5_±ËŠ <¤ cŒ ¸ÕJY^þF˜{D‰wS,9µÃLŽ½V*mxÀç¯>.Ehã§`°›&ÞÉ' ŸU¡
ßö¥„²©¹ñ¸' ’"þÛå±öeBƒëÉvñÿ¤ ƒØOC€Ü…„}ѹ»…Ò¤B!»?› +œU˜€Ëÿ?I4ø"ñNÅ ¯áÑúS%p”šŒ¯¡ö”Q¼‘ü¸éŠ˜òa ÞóRqë ”\J† +SoŒµJ5 Ö ¡ÓIÄt-aLÙ{n»p«àyWðÀÜ}¶ªÚ5Ÿd ÍNˆ¬ + °·1ÍL¯bOS> fåfçÜH[:ÄrU¡w3;½ÓÒ´ð ‚
%÷R +öÕ¤° ê¹OL+ dõ¶øŸM+ðn-ùŒ
.¼äöè:l²#I‘`ò®+F-–u5«:ÛHJ½U +Èû ‡çE¨U¶/Š‡DÏWèq´´m:Ümç[on|®Z>¹ø˜Áµß¹ÈšÇ}ÊHt£ ’#DeJ#{ïªÉjë©a‰#¨#[(hõ¶€-3SÆÀ‚Ô[Ï\Ïôðþ’·n^B±:%k1 g%•2)öæøxk8òŽM›ÛT\ e%²ÇÓXQÃY 8 Ÿ¡e¥!Ô&/S®§ +™€/—h?ˆ³±QÜ}„ðq_Ђˆ +Û.÷Y½~ÒêØöátùaÿ Æ›BTÞ¹pˆ B(I6åé1Ç \gcuL ³lµª¨Œä´6¦~%ε‹).Ÿ"úS»zäk:d¬ÛØðI}«va&aü} ïÛ +M¸ Œ]N¨ù{™vÚ¢1»š}(:¾ÁÒ¥ÃÍ,¼> 6 Ж—öh±M×Ú¬9=L¤%c”Õ¼´[cí¹BÖ˜Ó€é‡Øø@&8ì9« qÅøŒ œ³&ƒ¶`[~º4©Æ°Ÿ>ˆÚ¶¤]fnhÄL¸¯òÝK©EœØ/êlŸsDïà÷ÏGü‘ÁKÕÙŠÖy½ó\hCœM6à¹ÈÀ‹ñzL¼,]8xÈ(€Øöqwß0ôW Œ#îR& \%¦¼|š
ðÄä=Ž-hCeö ÊmÛø‰¼Eklç'e
z )ðÀû]’ ΀±?ÃT]5ÔI‚l¤†ŒŒ~œHkÕ¬K‚m¸Ô8¸ÄÖ÷».@®
y\œÈ\cyÎãÊþËu,Ù÷¹_†€7#zsHÍÎ,מ{wÚb1ÏdtŽ;QB\œÛ ` üPuå`LÖYóÙÇ.: ¸¹â# ã[/v ÁÝŽÖU ;NÐ-
\ë¦ByR°µßSw…¼ üý ©%ÐÉj׳s)Î1¶^çΩ÷?ÓปgÓªÞü6àÀ¯ eä+úιÛWFGáŸú ÉͯDUâË4=ð[›¾‘ÁD!Ë“d—òH¦~”†É Òÿ³Ÿk#endstream endobj -1428 0 obj << +1425 0 obj << /Type /Page -/Contents 1429 0 R -/Resources 1427 0 R +/Contents 1426 0 R +/Resources 1424 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1394 0 R +/Parent 1392 0 R >> endobj -1430 0 obj << -/D [1428 0 R /XYZ 56.6929 794.5015 null] +1427 0 obj << +/D [1425 0 R /XYZ 85.0394 794.5015 null] >> endobj -1431 0 obj << -/D [1428 0 R /XYZ 56.6929 769.5949 null] +1428 0 obj << +/D [1425 0 R /XYZ 85.0394 492.6335 null] +>> endobj +1429 0 obj << +/D [1425 0 R /XYZ 85.0394 480.6783 null] >> endobj 486 0 obj << -/D [1428 0 R /XYZ 56.6929 672.3174 null] +/D [1425 0 R /XYZ 85.0394 173.0867 null] >> endobj -1432 0 obj << -/D [1428 0 R /XYZ 56.6929 647.9778 null] +1430 0 obj << +/D [1425 0 R /XYZ 85.0394 147.5597 null] +>> endobj +1424 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F47 879 0 R /F39 863 0 R /F21 658 0 R >> +/ProcSet [ /PDF /Text ] >> endobj 1433 0 obj << -/D [1428 0 R /XYZ 56.6929 430.1905 null] +/Length 2902 +/Filter /FlateDecode +>> +stream +xÚÍZÝsÛ6÷_¡Gz&Æ ${s§U§urŠ{“¹¦”D[¼J¤N¤ìø¿¿]ì‚¢$Êq÷.ñLˆÅb÷‡Åb± Åð'GI*R§Ü(sF$±LF³ÕY<ºƒ¾ïÏ$Ó\¢‹>Õw7g{«³‘.Uéèæ¶ÇËŠØZ9º™ÿ¥B‹sàGÿzw}u~¡’8z;þ JR›DE¯¸|s5¡Ž”I¿_¿¡GŸ×ï®ßŽ¿ÿeryž™èfüîšš'Wo¯&Wׯ¯Î»ùñìꦹ¯–Œ5ÊûŸ³_‹GsÐîdzXhg“ÑTb!S£Õ™I´HŒÖ¡eyöáì Ã^¯ :“Œ…Ò©ÀIé!œ'R
]ˆÓÛz¹¬ ÊêîüB§YÔ. +*ÔU±A_Aݥѷ/˦= ½¹ùé7=® ¦Ï«9µÍ–yÓ0ÏÛƒ‘“‰ Âë Q7™QiÛWU±ª«rÖà +R +—$Ê«4/>űª +à£`Qói}R©Ts•J”™zˆ©*ê(«¶¸Í}ã´¸7çÒFuúù±ƒdÃNU,稇‘ј¹Ð¨yàÓÖÔœß×ej5-ï¶eûÈbðÀu¾i`1X\?Í€†¤†6\,î ñÕ¼“*ó²ùw
š![mQù!*V½ñTÙnÒ ¤uo2¬%„!r[>ä\ÁZ%†}Cã“h|Ý—zO/ÙÓ 6-îóå¶h¨¼*õm[T\\•m[ðÈ[OT¯¨V|ÎWëe`Pò +°¨ì4,½ ¿]ÓH,Xx¢¾`‰SAÛtß2ÂöÐ'1èq!vׂÿÇQ;]hãà†¦2gû÷“£{ +8a¬G9•"ɾpMkHR»h î,Þcke(dÀ†E~Ï]Âû®ý@ »º@ +‹r¶ ÒY]5¥ý°ÃßOuÊôbZ¶ÔTmWSŒæ±|ë¯L¥ Õô±7HGóz•—,H•¯ +1çÞ„À'ŸÏ9 k"!çéE?M Á1E‚ ߟàQÛ*ç`Ëß<0°ª!Ì;¨´"ýºH¸*Ú#–Oľ ßöâ¾]ŒÇÒ4åçNµ–í‚Å{¨ô‚ùl± ‘· ’)D¢ 4–èf0,ýP®Jˆä—§ÃÑ¢8 +%…íÍÈX°þä¹ûËý©ýåþG¡dÐé¤Vd±Ö§<nÚ%#“)¡¬£ÓïãGñÓëâçñ
”ÊetŸÃ 6YšHàŸ1Ç0Ç™ ½¹¿Öº>w +ÄϤzúX0 ¼ÖÖ°#*›§ÝOçaz>Ø9J\•Ã +Ã>̲ÿ%‚’‡ÏÀ'K²ÑЮWËÄîÍoÁË0ãàÃýÜ-éÓy7·C~è5¢“Øv>|]Ws~ÇpŠÕ°&"Б®á€jÓR5¿££ÐâÎ]2ÍmN%¸då³ßy\ÍßÀ²*>3% rç vuB³þFÆÑû΄pSCäózH;rÇàÔ袩”#~¤¦|ÚÔËm[PmUäeäæ“R5ƒ¤¼ +üt×Õ’ ˆxk
“zÅ‘ +øm¨èÏ÷ŽUÏI`'åîýü~YŽ·×½òfSŠ7[bv›11Á{'ÝûýNIø• +8“½Oô5}ÞÛ'ô{/ ‹¥i˜–v#ùr–iÜRìbúϾÚÃ-…¯Õ¶i" oà:“2' `šœp +ŽíÜ;ñ8¼8Y ‘‹˜ìY 5‘×q<ÞÅ;׋åuï˜ôRT<*ÌæõwVmk|˜íÍ3à‚¦ïe~•žõ w”Ú€ xšY;’Ú +›jù¬Ÿ(ÀÅ,ÉdöÇ.‰Ã£þŠÔFÐéBªT¸8sÃ7÷,nPõXgã$fõÊ¿“A ‡i
bǹÆØúס,fÇ%ö† Þê ÜêA¾$_§ Â(3^ ¯ 9Âå/9ùdCÙ&ØX‘h~2;DÇt´GG= éFý™¿a|b%œ;õ„¶Ã'NEbù í ÕÇG`(³]‹zs÷:½y_ ù‚è8 ç¯2Oo68¤SEIÄãÍ7Ý~³>Yo½Aù<¢<‰Ooæo×x2'b{ê-ÀcPóóÚÀöÓï €ÔI€zs¿@ÏÏ)þÇ…_ ›€7Z¨$I‡~ ¾häÏýÝÝî·‡&ÚÚIIN^ª‘Nð"Ù£Ÿ†_貞ðÿd`®endstream +endobj +1432 0 obj << +/Type /Page +/Contents 1433 0 R +/Resources 1431 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 1392 0 R >> endobj 1434 0 obj << -/D [1428 0 R /XYZ 56.6929 418.2353 null] ->> endobj -490 0 obj << -/D [1428 0 R /XYZ 56.6929 282.7013 null] +/D [1432 0 R /XYZ 56.6929 794.5015 null] >> endobj 1435 0 obj << -/D [1428 0 R /XYZ 56.6929 255.3968 null] +/D [1432 0 R /XYZ 56.6929 673.1367 null] >> endobj 1436 0 obj << -/D [1428 0 R /XYZ 56.6929 213.9243 null] +/D [1432 0 R /XYZ 56.6929 661.1815 null] >> endobj 1437 0 obj << -/D [1428 0 R /XYZ 56.6929 201.9691 null] +/D [1432 0 R /XYZ 56.6929 493.0122 null] >> endobj -1427 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F23 678 0 R /F21 654 0 R /F47 874 0 R >> -/ProcSet [ /PDF /Text ] +1438 0 obj << +/D [1432 0 R /XYZ 56.6929 481.057 null] +>> endobj +490 0 obj << +/D [1432 0 R /XYZ 56.6929 393.3436 null] +>> endobj +1439 0 obj << +/D [1432 0 R /XYZ 56.6929 369.004 null] >> endobj 1440 0 obj << -/Length 2405 -/Filter /FlateDecode ->> -stream -xÚÅ]oÛ8ò=¿B÷ — ¢D.dS§çE›äRïu±Ý>(¶ %×’“æ~ý
9¤,ÙJÓîÞáP b†Ãá|Ð, ðJ*t ¤:&’2,6g4¸‡½7gÌáD )êcý<?ûáR¤&:áI0_õh)B•bÁ|ù1¼øÇùÍ|z;‰¸¤aB&‘Lhøóìê5B4~.®¯.go~½=Ÿ¤q8Ÿ]_!øvz9½^]L'±ä@@8¿__Méröv:ù4ÿål:ïXî‹Å¨0ü~>ûø‰Kî—3J„V2x„?(aZó`sKAd,„‡”gïÏþÙìíÚ£cj’B©x:¢'.Æô$5Il=—å$š…õÊ|yØ®ó&GÐ|þ¶Aà2Ÿ°p•íËÖ!Õˆ±¯ŠÖ¡ày6ù¢®–Í«Ió¨Õûûõ2 Y…§îÜUù—mY,Š¶|Bx³ÍÅ ”ò|i)%áªÞáVþ%ÛlËü•Ñ=x‚îIHƒˆ1¢¥äV6¶tƒhEpM”J5 ,â0XÐ]‘lj„$ŒÑÄ¢7ˆÁ'(¥á¬zÈwFSÆÞeÛmQÝã E…ßÙÍC<r;0Éc¢c[š·¹£#4
«lcVJ‡» SaÞÔå¾-ê -wÿ ’¶ë¬EŒu,Ãv—UM™9<ØYÙÃõOÍnš-—ŽhƒÖˆ°a.Ò ¡EãÐëX["ôî ¡› îBœ‡A)ãôySUdï‡0#Ùn›è<i@G«,ëMVXyÒ0« * oæ·¸@Aµý.ˆÍ”ÓpZµ»"oð N,{pÄ‚Ý Üƒdqc“-ó!¥2Ïš6jëhS7À„ òìdÅÔÓ÷•õ]ðr°W Èhno³qpy¼,["F™¯,®°f1]q¿nA²˜¦á|mÌb ø(–%½ÝÖMÑæ>\d7=-‡-ÂÇì !Æ+Ì·ç¹#Ý©Áìï›}V–Oîô®h#+ù‘yÛ¼2œrœî_ -ˆÌ —1žTrà,E»F°É -ö2(!þ¾uæ07uçl ½xð˜F ãZ" /Màý -`ƒð óȵKÍ 6YÔ›O˜ÿñ¸x3iY¦qPJRÁ¾¥z -HJÓ£êýçNy>z’<Ëž£@Ë-ý‰!©¨“)’J‘4•êÐCõ+'ãŒ!d 5„Z±6ýíúvöfM‘d‚†ÃxèÒx_…’*“„ýÛþšFWÚºÿRÒ„(Õý¥(J
»Ä0‰T -ê0zOÁP0‹U]“ž³‘畃·¦ÿMå úÃÿ‡Ë2͈J¡œG<%JÇi¿Q=iX9è5ÕÐ G‚)cõM}2ãDk?3J•(ö Jõ'Ž”Ú ÐwƒÃÇI¿îõˆ²SÆ® šØ…ÌU¯³‘I̬ Q"ìcgs
Þ½5üÏÓhÆ X‹MNUl®>ŒÐXkH½µ•õ øa¶áÁë$ -zByÂQŸ² - ²ïò)¡ L§Š@Óƒ.?÷-^2h£É¼X>W ^Ÿf %!Ư„¢ã:È¢:tv‘O ®0‚ J¶s[+³…# -$$Ö f% Ôz8âš îxz;®n >|°O[4¼¸:g~ P°~w>»ŠÞOoÿ5½ Ïmæ¾ä``Êlñ•d`ƒÑ×ìÃI¸šL;wóvJ.®ßdر‘ ¹"žÚƒš) +/D [1432 0 R /XYZ 56.6929 151.2167 null] +>> endobj +1441 0 obj << +/D [1432 0 R /XYZ 56.6929 139.2615 null] +>> endobj +1431 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F21 658 0 R /F47 879 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1444 0 obj << +/Length 2798 +/Filter /FlateDecode +>> +stream +xÚÍZÝsÛ¸÷_¡‡>P3 ö-Û©o;UtÓÎåò@K°Å)E*"'ý뻋HJ¦ì\“Îu2B‹ÅXìÇo‹ ‡bb4ã*‹'i3Í…ž,7g|r}¯Ï„癦ÙëçÅÙO—*d,Kd2YÜ
dÆ“ÅêCôêo/ß-.æÓ™Ô<JØt¦ ý|u}N”Œ>¯n®/¯^ÿ:9MãhqusMäùÅåÅüâúÕÅt&T¬%P^Äo7×ÄtyõæbúqñËÙÅ¢[òp[‚+\麟 ùd»ûåŒ3•=y€ œ‰,““ÍY¬Ó±RRž½?û{'pÐ놎©I*ÁR&33“€ˆÓ#fÅfd–‚RuÆ%U§ThŽ(5,É2í”ú6/Jؼ”ÑÊ–Åg»ûŠ¿DôP”ž~ké›·Ýl[»¢Ÿmš‚sËS-@II CáÎì—|³--[Öq°¨,eFóÄÈ«Õ˜ÔŒqØÚ@¨|F* ¨ÄH?äw®yQùmT~‡õn* ìz½âÒL˜ tš +P¼ +Á2¥“SÜ‘T¶h×vG?jOl×uc©Ùì—KkW/è×@±È6ª·$cZ‰áÙm¾ü×~ËêÝý˜Ú$:zö‡Òoý +ºÃb~°˜t¹ûJÀL‚¦™€sbÐ%øç<zoÛ¶¨îIÚbñ¦YA1Ëb»á‹µ›<‰Úbcgm=Ãm…t”‚Ž<a>§ïïœK[®èGÑWN?•œÝïªZ{OO"wpvKŸÆVd“Ž‹ì«¢m†3'Qc—uµjÜ‘Ð9¦L¢í®Ø仢üê4– À-ö'ʯ ©K8׆Hk[Q 6éÙ–ùÒmšóyáFÅÆ« H Uj¬l³Ü·ÖKZ×Ô(kw +h Y¾F Ššu›ši#d@9 Î…L)¥'‰” ”¤Ü¾¿y9AŠáäâ¨ÌçEjèmÊ+;>©h(RÈ)Tè‰!ÞÝçwf26oΈ1-Öa xZë¹.êC“FƒK4YÛSy3×:ªCTÕà¯;ï[à!¾éΣ YÕ3ˆ³ëÙª†pY
ýõ?ÏoÞ¾¼ºÆ°NTïÛºjl3føw´Ú
Û×zÏÆœ¿s…Mþ¥Øì=7»à!» zuñ¡º¸W-}À%wM0q8Â5.ú‘™kn˜L9Ä÷š³d…PƒeOâšG"ÈÓv«
3&Íž±[àe±Ì(÷üÅ…‹XEzV‰¦d +‘‰ÎpIjÅμ¥oKÜ[ê-Q0 +~QØ Ì=†} +Fç%Àa±ôD ¤y +Å%Ož®ƒb ;I; —xœ*=2‰*G8$2=$®ìTDÞÍ SM p"‰Æ‹àŒ],ª÷÷ë#fAg£nýTö˶,–…ÃFHï«&b°AP°ËW@/Fʉ£Ä%ÖŠUI2£ AEĉJÁó<*b_(\UhºÞ<ßæÛmŸë¼ _½û ?_=Ì—£2È 9&Ue² iïÛ¢®¨#w»v +Ò1øë.¯š2÷|ÐÓ§u uõŽ¨ùjå…6Ôá:pR ô3ÊÔŽ ²7,mET, +#•<º€€T¸ŒƒhpâS›# -Áu ÌÓ¥DèØä+{(©´ + }.(É# «QÞÐíIá½aÅÊåaÞ¨+W‚@ÛR¦ÔB +ua-عlVQ{ßä÷·ƒi.¦›ç~6R +åÅ‘ÌnlY4ô + +…u[8ÐF·wÃÓØòîð¶xYæMŠê•ÝâœU¸7 Oèã•ñé7û¦=|>ìß4Ëf n¹ÝZúûq@7J†§ä1áçëÛnUËr¿²Ý…à î*°ô4cÁôÀF0˜J¡=ß‹Q endobj -1439 0 obj << +1443 0 obj << /Type /Page -/Contents 1440 0 R -/Resources 1438 0 R +/Contents 1444 0 R +/Resources 1442 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1448 0 R +/Parent 1453 0 R >> endobj -1441 0 obj << -/D [1439 0 R /XYZ 85.0394 794.5015 null] +1445 0 obj << +/D [1443 0 R /XYZ 85.0394 794.5015 null] >> endobj 494 0 obj << -/D [1439 0 R /XYZ 85.0394 732.3673 null] +/D [1443 0 R /XYZ 85.0394 711.7496 null] >> endobj -1442 0 obj << -/D [1439 0 R /XYZ 85.0394 702.3779 null] +1446 0 obj << +/D [1443 0 R /XYZ 85.0394 684.4451 null] >> endobj -1443 0 obj << -/D [1439 0 R /XYZ 85.0394 613.0847 null] +1447 0 obj << +/D [1443 0 R /XYZ 85.0394 642.9726 null] >> endobj -1444 0 obj << -/D [1439 0 R /XYZ 85.0394 601.1295 null] +1448 0 obj << +/D [1443 0 R /XYZ 85.0394 631.0174 null] >> endobj 498 0 obj << -/D [1439 0 R /XYZ 85.0394 411.9014 null] +/D [1443 0 R /XYZ 85.0394 462.3028 null] >> endobj -1445 0 obj << -/D [1439 0 R /XYZ 85.0394 388.7145 null] +1449 0 obj << +/D [1443 0 R /XYZ 85.0394 432.3134 null] >> endobj -502 0 obj << -/D [1439 0 R /XYZ 85.0394 323.2073 null] +1450 0 obj << +/D [1443 0 R /XYZ 85.0394 343.0202 null] >> endobj -1446 0 obj << -/D [1439 0 R /XYZ 85.0394 298.2648 null] +1451 0 obj << +/D [1443 0 R /XYZ 85.0394 331.065 null] >> endobj -506 0 obj << -/D [1439 0 R /XYZ 85.0394 108.8668 null] +502 0 obj << +/D [1443 0 R /XYZ 85.0394 138.4884 null] >> endobj -1447 0 obj << -/D [1439 0 R /XYZ 85.0394 82.3901 null] +1452 0 obj << +/D [1443 0 R /XYZ 85.0394 114.5262 null] >> endobj -1438 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F39 858 0 R /F21 654 0 R /F47 874 0 R /F62 990 0 R /F63 993 0 R /F53 957 0 R /F11 1293 0 R >> -/XObject << /Im2 979 0 R >> +1442 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F21 658 0 R /F47 879 0 R /F62 995 0 R /F63 998 0 R >> +/XObject << /Im2 984 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1451 0 obj << -/Length 2130 +1456 0 obj << +/Length 2275 /Filter /FlateDecode >> stream -xÚµMsÛ¶òî_ÁƒÒLˆàDo®ä©ãÈyŠÚyÓ4Z¢,ÎH¤"Rqýï»Àe1®û2 ÍËÅb±»Ø/€%~,QšhËmb¬$Š2•Ì74y€¹÷,Ф‘(íRý<»xûN˜Ä«¹Nf˯ŒÐ,cÉlñy ‰ Cà@¿ßMFÔ+:x7¾ˆ ©øàú?W g£)Nè@úóxrƒ‹ÃõÝäÝøý¯Ó«¡‘ƒÙøn‚èéèÝh:š\†_f¿\Œf‘»j1*œ¼_/>¡É´ûå‚a3•<Â%ÌZžl.¤DI!"f}ñé⿆Y¿´×LŒ.4ï±}vR–hSÎNÓ"_€R"ä•Ì`»²lPÏ‹¦Á™vU ð¥|]8¥ál‡5c Ä”rL—庨òM <ÔÌ2 ó°C¹ÄË¿ /Cض¬æëý¢â•U[÷Ëå§ó6N–ù¶†%p‚êÁxdb ™8à8\¡ê]ùPV=² J¨Y ‹ì›m1/ ¬IRI%É”5I -V±JqOŽÂ‚ó „Øó€±cr¯& ËvÕ#«³4œ!.ï¦ã÷ãI°ÒÁtMÑ"[o;7®ò€ù–¯÷Å„kr÷X6E$ -À|¿Ã©Ú>™ œ¾‘ÿT¦¨ü t&h:a ¸2ÍÀt†XÁ3O8óbÈ,žŒ‡Ñ]eôiO„ô3‹z“GrïŽ BšoÅ.Py‹ ùdhyò ±«<ì·Ý•õî|é¹Y„fÄ2ž\ßþz3ê‹ ~užºš'lÁ£˜&d‡èQ˜âºŽ´Êƒ1ï‹¢BõÌÑ´}IJg²…V¯ÊRŒk•ìÏR4I œkû}^¸Ž¯ -¤qÑà#ÁaÃ25ÀèqˆfUï× ¤¼/·+š¶Þ›/[HÂ~"ÉPŸ$CÁ‰VÇ OÒÃqâ$ýu|ÿDe!!%°ÈÒ”jp?äœìRûšà.]¸±qÅ%àê -i W…Ë\ˆD -ò;ûu›p¸ÅkFmÂ9'Lð×4ÌšoCͳ7ÇÿoUç
+xÚ½YÝo7÷_¡?¬€Šáç~Ū-ç\Ør*«ÍáÒ<¬%Ê^@Ú•µ«8¾¿þ† rŵ6‰{¹Â9;œÎüfH³…l bg<$™$Š25XlNèà ÖÞž0Ç3òL£ëçùÉ› ‘ 2’Å< ÌW¬”Ð4eƒùòCA† Fÿ¾™N†#®htqyRñèìŸãwóÉ bÇúóåô g2 În¦—o›‡‰Œæ—7SœžM.&³Éôl2ü8ÿåd2oUÍbT} O>|¤ƒ%X÷Ë %"KÕà ~P²Œ6'R ¢¤~f}r{òk+0XµŸöº‰QÂEÌ{üÄYŸŸTFbÁEë'E¸…RÍ 4Zxz3»|{éÌ=/vzÑŸ´1„Š@( +>0|^¾åS¡@™Á8w|Ëj“å¨Ì7}›Ç)áR2Çû¡Gš +
EOÊ0Œ»«ÖíèhTöØ„ +(g‰$ÚÚ𯺮qó“xkÝ. bUI™¾Êe,má#w;Øü‚m~Á率Õr±Þ#jžÒâF^v9oübá„o+øÄG—«žÀ +2õ'ci Wé£@f %íJÛ£ +À”*ºr€£»ŒmM0“.ÌXØ»º*‘çéAÛÞÝN¢ €8¸ +_⃳Y?Ô}ý')å¯MŽþ c ÉOÿì•m×}Á].EY÷¯{'•ÛÇžæyë Üõ(á¼!ÿÿ–—EA3hIJq}|`]|â endobj -1450 0 obj << +1455 0 obj << /Type /Page -/Contents 1451 0 R -/Resources 1449 0 R +/Contents 1456 0 R +/Resources 1454 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1448 0 R +/Parent 1453 0 R >> endobj -1452 0 obj << -/D [1450 0 R /XYZ 56.6929 794.5015 null] +1457 0 obj << +/D [1455 0 R /XYZ 56.6929 794.5015 null] +>> endobj +506 0 obj << +/D [1455 0 R /XYZ 56.6929 769.5949 null] +>> endobj +1458 0 obj << +/D [1455 0 R /XYZ 56.6929 751.4464 null] >> endobj 510 0 obj << -/D [1450 0 R /XYZ 56.6929 572.7144 null] +/D [1455 0 R /XYZ 56.6929 563.3947 null] >> endobj -1453 0 obj << -/D [1450 0 R /XYZ 56.6929 550.4382 null] +1459 0 obj << +/D [1455 0 R /XYZ 56.6929 537.1873 null] >> endobj 514 0 obj << -/D [1450 0 R /XYZ 56.6929 469.4994 null] +/D [1455 0 R /XYZ 56.6929 314.9763 null] >> endobj -1454 0 obj << -/D [1450 0 R /XYZ 56.6929 442.3384 null] +1460 0 obj << +/D [1455 0 R /XYZ 56.6929 292.5697 null] >> endobj -1455 0 obj << -/D [1450 0 R /XYZ 56.6929 234.4857 null] +518 0 obj << +/D [1455 0 R /XYZ 56.6929 211.1564 null] >> endobj -1456 0 obj << -/D [1450 0 R /XYZ 56.6929 222.5305 null] +1461 0 obj << +/D [1455 0 R /XYZ 56.6929 183.865 null] >> endobj -1449 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F39 858 0 R /F21 654 0 R /F62 990 0 R /F63 993 0 R /F53 957 0 R >> -/XObject << /Im2 979 0 R >> +1454 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F53 962 0 R /F11 1299 0 R /F39 863 0 R /F62 995 0 R /F63 998 0 R >> +/XObject << /Im2 984 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1459 0 obj << -/Length 3279 +1464 0 obj << +/Length 3617 /Filter /FlateDecode >> stream -xÚåËrÛÈñ®¯àÁUªDd^ -™LÕ,IU1 Í–›36{€µwgÜî™»MóᮟîÏþz-“Y¦±ˆg÷«, 2ùì>ÿ¼ýÛåo÷Wwçs± ÏçQÌ‚Ÿnn¦™”š· n¯oÞýãîò<QÁý͇[š¾»º¾º»º}{u>çRE -wçE»Ü•‹¾‘‘ºuAæ©.vÔ³›\a›ô»vç\EÛìMgy4»lL›;È
µ »iI»²®ÈCÄ® -:‘¼0÷iy ÊÑÉæÿVÜ u$^«zDÎC&¿È¥—>Nl¤ýÞÌI ®
Å æ'Äœ'àlÉzË`³o;Ú¹É:̪pÒÁ·¦.¦„Ý# -OwƒEo hYP42¥mi/ƒc‚š%àÏ ÆÑm¥g!N§öc¢O;‚™ùLlp¢}±‡˜Ô
Ú|¿Ù ï#~bø9Š™ÉŸPE? -r²Ø%L1N‰dÔK¸L‡ÎXÈTì¼ù.{šŠ 8JK_} -ß&Û}JعrcÍýãó ¦j²¼Ÿ-]¶Ïœžê>Ë`…2j¶»rc#RH²ŠÝcáëðÌo²F!½Q€¾qN©èë)Ç‘Hõxò²p@ˆ&}Xé¤Ã -æëpäI¨X‹>‹©ç¸sÿ8bØ6Z«ðeÞ:d0¬ö^d—¡ã“2|I ¥£÷2` xfW¹ÏVK`z Ûí²º]
Ó¼]M¯:x¥]u[ö[°3¶Ñ«8y>ªs’P0åNcªW^èåí79óˆ}¯†ÐÇWÜ–º ª¤CØ·å`¬±55J—$eö˜]k6¯Å#ÌÉX^¬ Av -J7pE©¡®E§WX‹q˜Ê.NÈ - -Ìîª|¨mÝZ« ©F¯ìô¨DÐ6ÔvëÌΔ®µOæÑÆ›½èaühßâ`äÖ·MÛ– 2¥F`\ Pš C‘˵þVY«¬¿…vߺ•²¶?KQ®ì(µæw?}ÿÛ›q¸Ù À¶o@³â8¦À:ÖG¤ŽíF`1)Îe4eCZ˜p
gM §'lKqþªÄÄL=“ +xÚÝZKsÛ8¾ûW誥«, ^|íM“(YOeœ¬íÝšÚL”HÙ¬P¤V¤ì(¿~»Ñ +'1‹LnW=ZãQ$&·é'ïõßf oç×çSés/`çS?àÞÏ—Wo¨'¦ÇëWo/ßýãzv jïöòÃu_ÏßίçW¯ççS¡´/€²$þõájNƒÞ^¾ŸŸ¾ýål~Ûn¹,Áî÷ßgŸ>óI +§ûåŒ3Gþä~p&âXNÖgÚWÌ×J¹žâìæìï-ÁÞ[3uŒM¾Š˜ ÉpŒOñŸü˜J*Ã'Îð_Ä’]^MgoÞ\³ÙõÇÙù4àÜ»º¡çÍüúŸókÁæ¿Í~ýø~ÎðÔ°ôTû¾|‚#$Ÿ$$ž"ôújö뜚4nlä€(iƒ|!Qù2¢´SÆÆ Ã— ÁŽ<±^_±„аB¨'AèƒB„ÁKTKÅŠ…<<Pÿn–Û Vù, +|ÿôh Z¶éf IMÛCM*IÑ*.4;ÅR0¥”? ‚‰06lÞ&å]†l‚Áª78Ô$vnFÝÞç5˜kyˤ¤Æ"£gUšFèU+êh +j¬ªíºþëùTéÀ«›dÛLë¦ÚØY[zvý?ÕM¶áª@y—ŽÔ½]äwÎå¶nÆôWAqì™-ÂsWgé àvc\(Û ‡ÕYC¦¢§€Õµ x³¢ s" ‰›´í€bR¦îµ#½ÞÕ–æ"³ŸMUçMþ é¥Ï#&ƒ@Núü1@ýSàÇa nJý 4Û)'UM‡ÈÇásª¦ ! Ç/îëjšÜK³z¹ÍYÝŠ’ú«Ç2ÛR_™¬]çê`Ôö\D^VW;ÓXfôšz—•y¦v!”?>vÐ’F%M–Žz¦Y¹ÇЂÏË»ÂOÿø>°6Šb{¤Wc‡f~໿sŸ§UQ$[G÷®„>ºÏ½z¿^TEM¯ óæ>/éžõxm¡ ZÚã<Óš4¦ÎÓŒÈ'tt¢OíM‘,³”^/ö† S) +ÀÌD8y*Ó` áÒ“ Ÿªg9ØKX º—»-©vÙÐãÀÁ†¤Þf ª^ Ì°±vWØ ‰ Ðë4[æë¤ >¼ºwß2ÚÄt.%iJ¡‡wÆ‹? 0ƒ§5bé K â3Œ0I^$‹"³£M +W¨› C¤ïÒˆ»2ÿF0Ç7NŸy™æ.úBâq †çYÂLôE D ë}^ÑÃ8Ê>ƒÈN ûÙ¦y]îø')´•_òL樅qÌjKS<›9ÞlÀÏÇ€j¨m.hù:›6Õ´€Ô›zL +r‘9 ßgÛ¼qÎfC£€påôyП—”K;j{ y»"«Ùó9Ï’—17"5ã~ìà¦Eć¢@â‡ÎÕŒ‹b€ÖÊ$*õŽ î†<½;´Óò 9ÛZE'–g»?¡ï==ú£J%†ºsÎü0z®P¢%¤ÔàퟔÒS +ï;@æ+;ßôTê½ë«9ô¨¹]½†Û’Œ\'Íòž:-1é}Ãê߈Ïn7 +ê>!…Þñ~ŒeºkÁÿÅeâÄ(~CrÈt$dÿ~òèžRñ€EpÞTAŒP” ÕÈ=%¨?–÷B[^ÏÆ=$@Á¶^ýn~5¿6‰ôí|,ÉUŒså +ι7KÓ¼¿ÈÛÜ ì9ؘq9ˆƒ +!¼‹Ö èÅbïüµN¶_€¶/_[ÿpœÖU’v½y?ñ7vu‰¿Œ©V›ÚãÚ0FÆweÛ‡¬îóvu +ÐjBl«Žq¯Ú=TŽPúk£Û åààk[¤é´Ã¯é™}ô#¼%ak\¢çÂág¯þ +²ûompô0¶¬ ™Œ„:¸®@ƀƌ—’°˜¬Û²5étŠõð.à F|
XG:/c×à.ñš$#µÙ4–F @_²w?lL»²ÏÕÁ”t›È—ô·€º¥lš`m ß5€.š|i®™¬ +DG†¬Î évttðƒ”yëÛƒþmŒhÅl1íÝwÃÆ k†\~''ñû”'FßAVÃÜZÄ"_…Cõ
œüKÐJœ.dQ¬ÄsÀ|Ÿ:D @sW›„W¹/[ QfÍcµýB?ûÆvwÕó“n€°ñPå©¥AhoyŸ7Yê§ifªõ¥]‘@]äw¥-eGš ˜xwOW„Zzuån“Û“»§)Æ*º„ßëQh!~´—tZ¶ï7U]ç R2È8 ¡)äÚx«m¼Õ6ÞÂsW»7yi¿qÑ®[ªÍ×Cfûí‡<‡‚z¾}÷QA@Àš>^kY Äö”7cRìK¨ËBZèp
{é—ø„€oa¾ÏjLÀõ‘Æ endobj -1458 0 obj << +1463 0 obj << /Type /Page -/Contents 1459 0 R -/Resources 1457 0 R +/Contents 1464 0 R +/Resources 1462 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1448 0 R +/Parent 1453 0 R >> endobj -1460 0 obj << -/D [1458 0 R /XYZ 85.0394 794.5015 null] +1465 0 obj << +/D [1463 0 R /XYZ 85.0394 794.5015 null] >> endobj -518 0 obj << -/D [1458 0 R /XYZ 85.0394 420.8405 null] +1466 0 obj << +/D [1463 0 R /XYZ 85.0394 687.9013 null] >> endobj -1286 0 obj << -/D [1458 0 R /XYZ 85.0394 396.5009 null] +1467 0 obj << +/D [1463 0 R /XYZ 85.0394 675.9461 null] >> endobj -1457 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F14 681 0 R /F39 858 0 R >> +522 0 obj << +/D [1463 0 R /XYZ 85.0394 283.5376 null] +>> endobj +1292 0 obj << +/D [1463 0 R /XYZ 85.0394 259.198 null] +>> endobj +1462 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F21 658 0 R /F23 682 0 R /F14 685 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1463 0 obj << +1470 0 obj << /Length 69 /Filter /FlateDecode >> stream xÚ3T0 endobj -1462 0 obj << +1469 0 obj << /Type /Page -/Contents 1463 0 R -/Resources 1461 0 R +/Contents 1470 0 R +/Resources 1468 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1448 0 R +/Parent 1453 0 R >> endobj -1464 0 obj << -/D [1462 0 R /XYZ 56.6929 794.5015 null] +1471 0 obj << +/D [1469 0 R /XYZ 56.6929 794.5015 null] >> endobj -1461 0 obj << +1468 0 obj << /ProcSet [ /PDF ] >> endobj -1467 0 obj << +1474 0 obj << /Length 1368 /Filter /FlateDecode >> @@ -6357,1237 +6414,1226 @@ xÚ•]oÛ6ð=¿ÂÈ“ Ä )ês}jÓvëP Cã>{ eÚ*‰šD%͆þ÷ñx¤,Ǫ·À0t< ïŽ÷M¶ æÇYL(Ï£EšG$¦,^õ ôU”N|æ$LŒ/ÐW{¥¶îÌVŠ¹Pa$ËS Æà ¶Y ýM# endobj -1466 0 obj << +1473 0 obj << /Type /Page -/Contents 1467 0 R -/Resources 1465 0 R +/Contents 1474 0 R +/Resources 1472 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1448 0 R +/Parent 1453 0 R >> endobj -1468 0 obj << -/D [1466 0 R /XYZ 85.0394 794.5015 null] +1475 0 obj << +/D [1473 0 R /XYZ 85.0394 794.5015 null] >> endobj -522 0 obj << -/D [1466 0 R /XYZ 85.0394 769.5949 null] +526 0 obj << +/D [1473 0 R /XYZ 85.0394 769.5949 null] >> endobj -1469 0 obj << -/D [1466 0 R /XYZ 85.0394 574.5824 null] +1476 0 obj << +/D [1473 0 R /XYZ 85.0394 574.5824 null] >> endobj -526 0 obj << -/D [1466 0 R /XYZ 85.0394 574.5824 null] +530 0 obj << +/D [1473 0 R /XYZ 85.0394 574.5824 null] >> endobj -1470 0 obj << -/D [1466 0 R /XYZ 85.0394 544.7049 null] +1477 0 obj << +/D [1473 0 R /XYZ 85.0394 544.7049 null] >> endobj -1465 0 obj << -/Font << /F21 654 0 R /F23 678 0 R /F47 874 0 R /F39 858 0 R >> +1472 0 obj << +/Font << /F21 658 0 R /F23 682 0 R /F47 879 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1473 0 obj << +1480 0 obj << /Length 3343 /Filter /FlateDecode >> stream -xÚ¥ZmÛFþ¾¿ÂßN ¬eÍ‹ÞŠÃÛfÓnïô/ dKkë"KŽ$¯ëþú#‡œ±dk› -Î1äHÿ/ÝôÓ$I¦o`î$~aƒpK¾/Ž7o®5 … ¤W'|q©ŽëzÕÑ¥^KÃeÿA ÅLh_i°
`+0Ø|‚{òµ Bë ·s·Þ¶MÓ“guNƒ®èeÎòÔ`å -‘xÁ,FŽÝìQ1 ‡aâ-·xY¸Ð:«i~[T{•»=ÝKA„îÔõÅŽø»b}hËþD3+~î«lÍ›|»FËÎΛêÀüVÍï8¼£“I¤ æìÁPn9nËõ–ÌôXVªrW²›ƒÂAží² 75Êg¶ukéh¯<ÕÑsÝØmîÊ®ÈM&Cˇd’Ä9Ð}ÝÀBø¡¼CW< P-¼ç"ëæë‚& Ãév áÊÂëàðé½y&v •´Ý²UY™36Ô†žÎ†ËäY±³‚3“ñû¡Þ·åKYò³»ñÁ†øLо'¬MB -k J¤æŽñiÜ
žÅïÙn_ñ$Øâ΄e|©ÊšÉxó†Òd<Ç®bK–“MíKAÂHµúŠ}¥ajï—=ónB $•@VÞâ%ku¶›ŒÃp¹2‰-ë :~ä¹½Ù ±-_¯H&Lû¹[òš” -PÑ’îhhœç±!N9íK›Õi -ÞkP?Vÿz2âà‰]:á‹FÁ ŠÅ•Õ+·Ê0¹Ì$×M¥¾w}Ö³¾f•ºi-¼ƒ)Ø¥{ˆ– -h—!&„£ô—„©¡°ªÙLù&¦À >[+OàbMpeýšÐA_î¦Ü4Qè¦vÃþ -ñ7-?†bBÊs@;@ 8‘œá¢¢ÀÑCïJ%a`‚ÝÒz›Õ›ÂÒM5tˆE×qÅdZ!@Ü5y‰Lë¬wuÞfg«~8A ¦¦ôe¦hÿ´ÀHàRµCUÍqêv”ôS©«ýp]fãºóIwûg4km -3X |È<J©±g«[ I
}*&@O¨óò1Šrà;ÒK[t=+µî æÜ›<££wÓ„B [nüU½•¡Gh !XlDb™Ï¨QW9Jn@@ ë_³ô4 ƒœ|økÞ9t)A͹ԨUmùd -@µuqÖÑpw
±Ø‰ñ]àŠ¶$Áý"póQÅÎrg´8~zƒ§b eý‰ðAâÔ*²®4… ŒŸ©´1‹ ùûªkøěީšYÏ#åcºÅ±Ò/cΗڰ ™Â«7£RåKé ánfîØ'jsXÆ4’LÇ„^HYŒOÆÊq‚ ]•½0«ûa -hDÙ† Ó|ßTåú4ÝÂc÷×+î´Œ#ð`u®øò×KÐÇ?'™ø“ƒÀÕ4ù¯VÎ8OhK9¬œ†5zâë„°R¸³D_inÿ¼åZõÿŸJendstream +xÚ¥Z[oÛV~÷¯ÐÛÒ€Eñ\x+ ¸Óº»Hº‰ŒÝ¢íE KÜP¤BRVÕ_¿3gæP”D7Š æáp8ç2·o†³ +¬$ ƒU‚3 åGax‘~_3b™úI§£ˆ…† Kï؀•N8)á¨6h 8²Æ
W0Jì1¡ê˜| î¯Ì¾µÉxTÖyµ/LÇÌ7Žý†²*ܳëƒ8œ±;Ÿ’üÉGÛÓÞ[Nk´s·—³ôŠÂþ†A5M®•v-`|65é¥4ŒÍSG 8&NRñ5± ‚Ì Æ.n–< aœ +ð9« +ìË
]³âû®¿˜ï%«ö¦f³§#" +îÏì‚°RçPÇ'3];O Û”‘;°^¶ÜëApŽ“'FÅ +€M)_ÄQr
\ ÿtŽf¹®±ðÇŽßréùg +ñÍ7-?†bBÊS@ÛC 8‘œAQQà‚è¾ J%aa‚ÛR¾ÉêµqtA- â£é:®˜l+ˆÛ¦(‘)Ïú¡NCmv®ê‡”`jJ_fŠöO Œ”ªTÕ ¦´£¤ŸÊH]í‡ë2ן ´B³Î`? ·¢5çÁeÁ= 7µo3,‹m\ý4TÞ8–¹„rê£ümÙS!4Õ.U +QØ´£³À›ÐÉ^Å‚³É +€è =B Áb+Ë|nDu•£àÔ±±þ5ûGO:8ÀéãÃ_óαK ‚lƒKµª Ÿ ÀJ9Ï)ÎroŽ`JeN¡åiWd½qÍjî;~±]}Ï^ Åý×WÒ+œ|¤îY>ŽŸ³œ/Þu›f_4^ñ« qPvÅ ¶‰Úšƒ«Úš©`ÆN€ !`Æ+æѪàY] §pØÁ¶Tq]£½¢áû
US`ï¶7¤UÖQ¤(¾§Ú•RÊ{ü‰YQFíø%*º”ãÔÞ¦¡²I&5Ÿ¡bbX9f£“»cÿâEVåÀª©U÷ÊÔ;¥¬…^ÖSç@†P™Þ +\Tü·”Ã'ºm¶†É« üØ×qêðÀöæ0gUOÖ¨I2ı?¸ƒœœÚåJ…Ü.GòÖô›¦àe0
Š4N×
+@µÜœÖh¹»†X܃s]àŒ®$Áý"pó³Šå$ƒÑâøé
žnˆ-”üáƒdX–ɺÒ20~¦fÐÚ,väï«®áoúa©™ñ|¶ø˜´x¾hÃÓØó¥6lB¦ðªfTª|)høÍÌö‰Ú ¦±$Û1¡Z, ÎOÖÊñ]º*{aÖáà +ìÍ´phÛŽ0<PyÇEØHêRð†vc¿Œ)qZÒ6ƒz¬2üœzÚfdN‹m.Aœõ=ê¶ ‡+¦vC5:7ÕÈ44Ã3ç²@°»¾£ñ€ñÔðuE÷Hè[Ë„(Þ
¿o›!~¼ðl2\½`Ï `› +. júl?Qëœ&=aÏl7úReQnï¾›îù†b:óÄ'ž·ÍÉÖ|:‹b}Y±C ¦}CL˜õmÿnmóÀÀ‹
|c›ÜVA¨ÁèfÅÒóö¸ë›u›í6®×€³=¬ ÆöCoXЊçØš¬ž>[4A endobj -1472 0 obj << +1479 0 obj << /Type /Page -/Contents 1473 0 R -/Resources 1471 0 R +/Contents 1480 0 R +/Resources 1478 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1448 0 R -/Annots [ 1478 0 R ] +/Parent 1453 0 R +/Annots [ 1485 0 R ] >> endobj -1478 0 obj << +1485 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [63.4454 757.0719 452.088 767.2337] /Subtype/Link/A<</Type/Action/S/URI/URI(ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos)>> >> endobj -1474 0 obj << -/D [1472 0 R /XYZ 56.6929 794.5015 null] ->> endobj -530 0 obj << -/D [1472 0 R /XYZ 56.6929 739.5018 null] ->> endobj -1479 0 obj << -/D [1472 0 R /XYZ 56.6929 704.7645 null] +1481 0 obj << +/D [1479 0 R /XYZ 56.6929 794.5015 null] >> endobj 534 0 obj << -/D [1472 0 R /XYZ 56.6929 563.5308 null] +/D [1479 0 R /XYZ 56.6929 739.5018 null] >> endobj -1480 0 obj << -/D [1472 0 R /XYZ 56.6929 535.7626 null] +1486 0 obj << +/D [1479 0 R /XYZ 56.6929 704.7645 null] >> endobj 538 0 obj << -/D [1472 0 R /XYZ 56.6929 418.2412 null] +/D [1479 0 R /XYZ 56.6929 563.5308 null] >> endobj -1481 0 obj << -/D [1472 0 R /XYZ 56.6929 389.5504 null] +1487 0 obj << +/D [1479 0 R /XYZ 56.6929 535.7626 null] >> endobj 542 0 obj << -/D [1472 0 R /XYZ 56.6929 228.1296 null] +/D [1479 0 R /XYZ 56.6929 418.2412 null] >> endobj -1229 0 obj << -/D [1472 0 R /XYZ 56.6929 194.8993 null] +1488 0 obj << +/D [1479 0 R /XYZ 56.6929 389.5504 null] >> endobj -1471 0 obj << -/Font << /F37 743 0 R /F67 1477 0 R /F11 1293 0 R /F39 858 0 R /F21 654 0 R /F23 678 0 R /F47 874 0 R /F53 957 0 R /F48 880 0 R /F62 990 0 R /F63 993 0 R >> -/XObject << /Im2 979 0 R >> +546 0 obj << +/D [1479 0 R /XYZ 56.6929 228.1296 null] +>> endobj +1235 0 obj << +/D [1479 0 R /XYZ 56.6929 194.8993 null] +>> endobj +1478 0 obj << +/Font << /F37 747 0 R /F67 1484 0 R /F11 1299 0 R /F39 863 0 R /F21 658 0 R /F23 682 0 R /F47 879 0 R /F53 962 0 R /F48 885 0 R /F62 995 0 R /F63 998 0 R >> +/XObject << /Im2 984 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1484 0 obj << +1491 0 obj << /Length 533 /Filter /FlateDecode >> stream xÚ¥TM›0½ó+|©¸6Æ` ³IÚ²RÓ4a«Õ xT‚Ó@6Úýõµ3·¶ôTEóÆoÞ|x€"b~ Ž “1JeŒ9¡ •[ µ9ûêQÇ Ï¤ð–u—{Ÿ¿°I,“(AùË–ÀDŠòêÉ Íóé"#Nü!Oˆ—Í&à‘ðXNÇ‹,4þ1[f“éb¤±Ÿga,ˆ0ñÌ)L g£ïÙøó P§ Ôžó{oš_¹m–f»øí==T™žï=‚™
˜J¡s†yÌØÙÓxKïçEðæô:4<Îæ"J¦±¡éq‰fŽìô–z«lO‰ßÕ½êÀ,7ZwÎÝkûäþ/¥và)šŒê-¶uið[xØUE¯*8˜ØyžE_€U· ã`wXUz[€×H¶.²RZ!—{Sô7üÐŽÛô RŠ%çÑ©'ÂTÊä)…Ú{2è]·ÊÜ,#‰Ÿoê˜Çâ- ”úŸ Œ‰I§Àßë]بWÕ\cÁ*uÛ›|u»vx_÷v endobj -1483 0 obj << +1490 0 obj << /Type /Page -/Contents 1484 0 R -/Resources 1482 0 R +/Contents 1491 0 R +/Resources 1489 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1486 0 R +/Parent 1493 0 R >> endobj -1485 0 obj << -/D [1483 0 R /XYZ 85.0394 794.5015 null] +1492 0 obj << +/D [1490 0 R /XYZ 85.0394 794.5015 null] >> endobj -1482 0 obj << -/Font << /F37 743 0 R /F23 678 0 R >> +1489 0 obj << +/Font << /F37 747 0 R /F23 682 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1489 0 obj << +1496 0 obj << /Length 69 /Filter /FlateDecode >> stream xÚ3T0 endobj -1488 0 obj << +1495 0 obj << /Type /Page -/Contents 1489 0 R -/Resources 1487 0 R +/Contents 1496 0 R +/Resources 1494 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1486 0 R +/Parent 1493 0 R >> endobj -1490 0 obj << -/D [1488 0 R /XYZ 56.6929 794.5015 null] +1497 0 obj << +/D [1495 0 R /XYZ 56.6929 794.5015 null] >> endobj -1487 0 obj << +1494 0 obj << /ProcSet [ /PDF ] >> endobj -1493 0 obj << -/Length 1978 +1500 0 obj << +/Length 1964 /Filter /FlateDecode >> stream -xÚ¥ÛŽë¶ñý|…ßâb(êšM“=M²
9 iO h™k«+‰ŽDÙu¾¾3œ¡$Û:Mî>x4wÎ#‰Uÿb•'A(‹x•q„"Y•Í»pµÚ·ïóĉ ’XJxX n™I e«Í\É×/ï ¿‰Ä* -ƒ4’ÕËëh+Íò q±zÙýcýtPG«»‡M”„ëüáŸ/%±8ÈòL X&’ +ÂÜ ¼<!Ö¶µîÆتÝb"dœF,–Ê KC²“âa#Â0\?™¦1-ü©3 ¦é'"(’Ä+à|&r¯`Tñl?{H’uOJZc 8›î
¼ù= Ì™€R±µgúù†Ñ~è4=™ÁK Ô•ÚsgÚý—ì™\A‘F);á)bS@ IÆb½Õ½%¨7õ`+<$>Y3bO,÷PµÀ,Öª®ÕÄ©Ú ¥iÙ˵êûA÷ ¾ÖmÕ{qì D¾Ö'ÝZ=1¶Ñª ˆÂ’Û
3Æ Ók뺉²l= ñ7]×f¿ ‘èWJ²Õ¯†´ À÷ - -U[”Ár
Ö:i¸¸?\ ßÜÒ“i{ÓÙjhèëéùÃW ¸áЯ4ÐAZúLÛ)@ lWšhtc• ” (z@ÅŽJ–R{ -¦ÛÙغªóëç ß/E˜Öÿ0]¿ÿîé'„ =Ž}Xi¿ÁÙqÔ°à×=Án[^ÞjwX$Œ~âô¸áÃIUµÚâšà1Þ¶VåafƒTWmY;Ý/èÅS-\âÔ;q´†h# ý»ïTÓcåÅÐÕ¾pO.©J}Wõ¥(fðèFÈ$¼JO¡¸`;(B˜â¬“ñÒeÈtìÒ€¥ßôÎk«à䦫ì…dV±aO·¼/·</SLÕvó:´;§5ƒULã FàþÞÛ,&Q¦9T+‰ÃÌ«pF¢ßÐø'À_U$ò‘¦Þ‚aJ"۟ʹæG¨£*ßÔž 9 *ÈëÂqf©‰/b~êü›>¼R -zr‘B€_sTm ©+}Í#Ê訉JÓ¸w +xÚ¥X[ë¶~?¿ÂoѱV”D]Ò¢i³§I¶EÒ g¢íé-imõH¢#Rv7¿¾3œ¡,ÛJS »&çÎá7äˆbÁ¿Ø2Œ’2ÝäeÊHÈMÕ¿‹6{à}óN°L*“P¦I“îV&E(‹8ßl—F¾zy÷øu,6qfY,7/¯³¯,/Â2IËÍKýàé Ž¶ ¶±Œ‚âáŸ/"µ4Ì‹\ Z.d˜—Qá^ „Á¨§]טƒÖ¶ ö³šHÃ$ÍbVË’0Ï"òS„âa+¢( +žtßë þ0j0Ó›‹–Rz Ÿ‹Â˜M<ÛÏ ¤ ´¥ÁYŸ šßÐì Ï4¨{{¦ŸQ隣¡™ž¼öA]™=zØÉ‘%›2,³8ãÀ =e*RJÈ,%©v±42º›l‹‹Ä™Õ3õ„Ér“v +i ·¥Ý3éÀ–yíˆùðŠ&Â8K<æcø¡› ‚hï Cû™<»úÐŒêhüýÔï Æס\@•‰ó÷w= vV +ŠØmT¹,(¾ÊÞñ‰}q´€¨\Â&|&d¾vKÈTÝVŒÐhÆKI›S?s@Õ+6¸k0mHšŽµÇrRϯÄ'¨ +ýf3GÕ51b‘æi‘diNŒ‘Œâ±ˆ±0·"ð0àâÄßZÕ7’\sÂw"ó‡&0ÍåþF—?$cRÍZº”í(õåŠ:éH^04g¢°û(½À ÙWáÓ7˜¿S,[>°úŒ¹…;î3`ô¦'bÕÀ¤Ö^ ïöEy˜]¹œÞv‹íçÞa¯Úák@n@þzh|ÇütÓOÓ0J¿mºã—¿ÞeÚâ š(°ÁiÇEðá
êÍâÀz҃ѣm§žæˆ§çOŒ$ +è×ØÚ:‰óÎÐÃBYn?z·XdÌqâd¾©Üä¤ÚNí:ørðï»QÕaáƒL·CÕMucVìâªV.Wª4 Û8Hü» Uoy)”@» Zìo+B)ˆ×©ôD9ƒ©;B.ÊõTyå vÂ)Î6™îZds§¡ÁÓÏMíµ°r=¶öä&vÓž®é^/yr€¡ ¶¯ÓP;«y Â1{9B€FãŸà{ËוÂM>p\×-ž‘7>å èWˆÌ¨W +¥Ìrcø-Š¼ûãËü +“¤%œ¡i±I æ² —â~ÚøÑŸ/¯6³Âv¡á m’rá÷Î.zïá°ú‹EØûÛxà8KQ”×ñܼ ÍBw1\ýÎÆð»•s^ÀÍQŠ’säjMkç/ Ú,ÜÚmR¡ÈEzís³ã¾‡ê endobj -1492 0 obj << +1499 0 obj << /Type /Page -/Contents 1493 0 R -/Resources 1491 0 R +/Contents 1500 0 R +/Resources 1498 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1486 0 R -/Annots [ 1500 0 R 1501 0 R ] +/Parent 1493 0 R +/Annots [ 1507 0 R 1508 0 R ] >> endobj -1500 0 obj << +1507 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [348.3486 128.9523 463.9152 141.0119] /Subtype/Link/A<</Type/Action/S/URI/URI(mailto:info@isc.org)>> >> endobj -1501 0 obj << +1508 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [147.3629 116.9971 364.5484 129.0567] /Subtype/Link/A<</Type/Action/S/URI/URI(http://www.isc.org/services/support/)>> >> endobj -1494 0 obj << -/D [1492 0 R /XYZ 85.0394 794.5015 null] ->> endobj -546 0 obj << -/D [1492 0 R /XYZ 85.0394 769.5949 null] ->> endobj -1495 0 obj << -/D [1492 0 R /XYZ 85.0394 576.7004 null] +1501 0 obj << +/D [1499 0 R /XYZ 85.0394 794.5015 null] >> endobj 550 0 obj << -/D [1492 0 R /XYZ 85.0394 576.7004 null] +/D [1499 0 R /XYZ 85.0394 769.5949 null] >> endobj -1496 0 obj << -/D [1492 0 R /XYZ 85.0394 548.3785 null] +1502 0 obj << +/D [1499 0 R /XYZ 85.0394 576.7004 null] >> endobj 554 0 obj << -/D [1492 0 R /XYZ 85.0394 548.3785 null] +/D [1499 0 R /XYZ 85.0394 576.7004 null] >> endobj -1497 0 obj << -/D [1492 0 R /XYZ 85.0394 518.5228 null] +1503 0 obj << +/D [1499 0 R /XYZ 85.0394 548.3785 null] >> endobj 558 0 obj << -/D [1492 0 R /XYZ 85.0394 460.6968 null] +/D [1499 0 R /XYZ 85.0394 548.3785 null] >> endobj -1498 0 obj << -/D [1492 0 R /XYZ 85.0394 425.0333 null] +1504 0 obj << +/D [1499 0 R /XYZ 85.0394 518.5228 null] >> endobj 562 0 obj << -/D [1492 0 R /XYZ 85.0394 260.2468 null] +/D [1499 0 R /XYZ 85.0394 460.6968 null] >> endobj -1499 0 obj << -/D [1492 0 R /XYZ 85.0394 224.698 null] +1505 0 obj << +/D [1499 0 R /XYZ 85.0394 425.0333 null] >> endobj -1491 0 obj << -/Font << /F21 654 0 R /F23 678 0 R /F11 1293 0 R /F39 858 0 R >> +566 0 obj << +/D [1499 0 R /XYZ 85.0394 260.2468 null] +>> endobj +1506 0 obj << +/D [1499 0 R /XYZ 85.0394 224.698 null] +>> endobj +1498 0 obj << +/Font << /F21 658 0 R /F23 682 0 R /F11 1299 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1504 0 obj << +1511 0 obj << /Length 69 /Filter /FlateDecode >> stream xÚ3T0 endobj -1503 0 obj << +1510 0 obj << /Type /Page -/Contents 1504 0 R -/Resources 1502 0 R +/Contents 1511 0 R +/Resources 1509 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1486 0 R +/Parent 1493 0 R >> endobj -1505 0 obj << -/D [1503 0 R /XYZ 56.6929 794.5015 null] +1512 0 obj << +/D [1510 0 R /XYZ 56.6929 794.5015 null] >> endobj -1502 0 obj << +1509 0 obj << /ProcSet [ /PDF ] >> endobj -1508 0 obj << -/Length 2638 +1515 0 obj << +/Length 2543 /Filter /FlateDecode >> stream -xÚ}YÝsÛ8ï_‘·*3kW%Kº·ÄéGÚM6§·3w{´Äؼ諢×û× @€²âÕít:&‚ññ¨>ü .Òxé‹,ºH²hûA|‘Wïü‹ ð>¿ xM‹e “î"é2NÃäb1Ýäúé݇OapúËÕ*Œ/žžÇ³VIº ã hÅ¿½«¶Uu¡^.ÂØ÷®.ÿóô•ä¢e’&ÊùpÆjÁ6S‰\™qq-E„l»x-#±´x\.߇ó—º9”ªØUªî'²Á2‹c'+P7r¢'aRïºÓꙆ_´é›îH“†‰ý^Ñàæ~CY,z{ÃgŠ‹l™Â ÆËL¶FÙï›a·‘ñv0ø# #8#H½?|?̵,‘B¼íeà©®k]ïˆbµ™Šß4•Ô5ïeÅÔÍÑôªb‘< ºP¨¯H=·>ÈR>è ûs½Úa[ê\öº©Ç£áŽx«Ñ¬p«ÇOk4Bäe¡ÿ ØR‘—7t,Îrd ¯V¢§-Ò±P&ïôÖê t«3AgA#¢Ô€EÒ4${)by¹¡ï}²ª4Õ¸KÄÚ4$”Äê [gnzõøp™…ÞUzˆœ,ž½ NZº*˜ÚÀ- ·¦ßB ßœÄÞmÝ«¶ -õªÊ¦µb· Åbkå7· ìmjYÁÚ²(Hqc(Æß3ù^Ù@‚±52üJúéd«‹òHP
bh· -F`4†dƒ\#å¯hòЄ6DÖ5DuÛÀEŸV‘ë›W5.O¼4pÄÌ
l6e.Ï`€"ÓÃÔS%˜&ŠÎ, ¾ˆÀÄlƒÐ0f|Foë¦ÎUk™Ÿd®KÝkePŒw¹ÓícË §ÛÏ„ v[µ¥šD¡ùH lZ•[ûp’!ct*ÌÒ©ÃÞˆ»TÀ±5L|iÅ C¤¡u' ö:ßó.e9gð®õÅ
cø ¡|o;èÓm’.W~J›<f%£;ÓÓääºã…Ý㚀FFu¯põ$ò,¸d^j¦%ÖÜ_$®s.` -¬õæñ3ç, -;(“¶ðÕuóçÑž<N°Û+Yáøö™a!±½C94Wz쇸^Ш©ÝbW'šçþ0)F‰ËWÂű(MÞ‚ÿ£,Û=
ײj·ª,Y©oêõ¼sI êR¶VÉÀ&
¾jôN÷¤¨ï}ü1èK%-YsÇ3†µ‚RÚ #.Q( ’ùÔT§7F ŸgÐ[¦nKt X\DRHó#$ âLŒM²ZI(1Žb:ž( 6SQU ‰Ù`"~«šÖ†eiX*oj¨ŸÛª[Æ ,aÂÍ6[XÅÐq76›¨tëÿ€ói äç\ñ
Äà±Y#,§ -X`àYfšñSòló˜NBšÈ ±¦CT‡.’P¸èÿëÒ1¦ÓIL ¤ë\·²¤©kZæŸ =í\À¡=¬*ù3Ý_Ø'à‚³SµÁÞ_а©¹r4ßËWÔ×ÇO;6qÆCñÂ`L{5œ[{ù®õ÷ãi³³±Wà <ûs¹ .èõ€zìb|øëÞ…¿T -^Pè-ŠF®Ü{#xóÂð¡¡šö&È_[?ã!V2æï‡È2C ØÆ’[e«"ÒÝG]Ø«>¿+à°Íú½™MK -'Œ%ô -A>Äú¼~5gŽÅÚ -x&4ÐflIæ ¾º4¦ Wp`4 9œžÕg œÞÿ0ás‹!G(_˜Ð™¹Ì˜<ÓoÊ®ŽùoÙ)°àéäòdYòwõPˆ³ÎDD®ç–6ôË}0ðÚ~k; ÛÏ”4´è.ܧZ 8WìuK ú
8¯³Å&ù©®‘\W~¶å\‚jgtà k–¡Û$œ…¨2oÍW•â׉q&+4„Ø +xÚuYYsÛ8~ϯð[誑ÂûØ7[ÎádìrYÎNÕnö"! k’`ÒŠæ×O7ºyØéTJ@£hôñuƒö.\øç]¤ÑÚ
²ð"ÉÂuäzÑE^½s/°öùÇ<a¬£0`²°ºŠ‚t ¥~r±šorýôîÃ'ß»ðÝu ûÑÅÓ~<+N’µ ¥OÅ«¦‘u¡~]®üÈu®.ÿ÷ô•ÄÂu’& Š¹pD²ã$žKäÒŒÌ^¸ÂØgæ8Z‡A’óÚ»\y® [çϵ>•²8T²îf²Þ:‹¢A6Ö^yƒì$Mú]·JîiøE™N·gšh&vGIƒ›û-
D]°èíý
\dë,öc>Ӈ˹!ë[vGÝ Ž d¼ ~ø~gx©óÃuý\‰)´¶»ô yPuêQ¬6sñ] UÓø^TLÝžM'+Éó¾mñ +\Ó±8 ØãràÔòD3h Ä“0D,¤É[µ³:Ýê dÐ9 QÔ€EÒÔ'{)Áúrø®óɪ¢«q—µÑ$”Äê Y_ÝÔ'ÿ=>\f¾sUË"' Á_‘k/ƒ“†® +¦6pkKÂé·ç÷'‘s[w²…-@Ø£åÌßp,XBšÎÞ 'h7ü•¿Ù*Œpv +÷Ãa…|‘¥nl Ø-H±ÈZyá6µ¨€÷ƒ( +RÜŠ1ÏuL~”6`l ¿‚~ZѨ¢<ÓCƒÚ̓ +’
r”OœBç=Á 1j"«¢ºÑpQɧUäzý"GöÄÙ G,ØÝfS6ä ÐBdz˜€z²Ó„Q™DÏ
B0q +ã”U#7Cã@Q²€.ÿ¾ô +ÝD‘øñðñ^=:\è±æí +®o¬ƒñ+ñ'E\2}8Ç’;i %Ò‡ï&ª°Wõ\~jÀaÛÍ{³˜¢GË!zeoA_^†N mÞxš^Xð”Ð;’ù‚Ïr{z8Ø'"Hóȃ…×UØNÑô endobj -1507 0 obj << +1514 0 obj << /Type /Page -/Contents 1508 0 R -/Resources 1506 0 R +/Contents 1515 0 R +/Resources 1513 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1486 0 R +/Parent 1493 0 R >> endobj -1509 0 obj << -/D [1507 0 R /XYZ 85.0394 794.5015 null] ->> endobj -566 0 obj << -/D [1507 0 R /XYZ 85.0394 769.5949 null] ->> endobj -1510 0 obj << -/D [1507 0 R /XYZ 85.0394 575.5478 null] +1516 0 obj << +/D [1514 0 R /XYZ 85.0394 794.5015 null] >> endobj 570 0 obj << -/D [1507 0 R /XYZ 85.0394 575.5478 null] +/D [1514 0 R /XYZ 85.0394 769.5949 null] >> endobj -1511 0 obj << -/D [1507 0 R /XYZ 85.0394 542.4777 null] +1517 0 obj << +/D [1514 0 R /XYZ 85.0394 573.5449 null] >> endobj 574 0 obj << -/D [1507 0 R /XYZ 85.0394 542.4777 null] +/D [1514 0 R /XYZ 85.0394 573.5449 null] >> endobj -1512 0 obj << -/D [1507 0 R /XYZ 85.0394 515.1876 null] +1518 0 obj << +/D [1514 0 R /XYZ 85.0394 539.0037 null] >> endobj -1506 0 obj << -/Font << /F21 654 0 R /F23 678 0 R >> +578 0 obj << +/D [1514 0 R /XYZ 85.0394 539.0037 null] +>> endobj +1519 0 obj << +/D [1514 0 R /XYZ 85.0394 510.2426 null] +>> endobj +1513 0 obj << +/Font << /F21 658 0 R /F23 682 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1515 0 obj << -/Length 2940 -/Filter /FlateDecode ->> -stream -xÚksÛ¸ñ»…¾Už‰` ÒétÆçØ©sãÚêcšËL) -’8–HHÙñýú.° -à? ‰ˆD KF2 ‰¨e›³`´„½gÔÂL ÐćúizvqËå(!IÄ¢ÑtááŠIÇt4 _FÎC0þxsóxõ—ó ÁøÃý ono oî¯opzwûåñóÕ¹ ÇÓ»/÷ç“X&b|õðpsÿáîŸs¥[½¾y:ÿ6ýtv3m8öoE®Ùýõìë·`4‡Ë}: Ob1z…I@h’°Ñæ,œˆs·²>{:ûkƒÐÛ5G¥DÂxÄÄÄ舆„‡°éËI$„Å’99Oh -µK×}9©…Ú©"SVNÅ¢ÜmÒ:/ }y$AI"„!Œ&< Z%P‹þîá%B é|¾SU¥*œþˆà -þÁ—ZœÜÓ. d‚ÐXHƒÒ¢‰¥AsNã±CÇãpŸ²x2ËkÜÉ窨ós -Ô¦v î‚°yQ«Ý"ÍDÅ 7*UW8*STŽ_Wy¶²CÕÒ7€fZÎ÷™š;:¸W¯”¾ª¾\#=¸ J]&ãºÄ/ÐÉ×yÖ -çU–®ÓÙÚÎî4+…ªq†Äöu^,ÁPy"ÇÓUË -9%’7pï´"1’AÍ Zì¥A+Z8.c8HŒÐ¦R¸[HÇ\SˇA«’÷\ÆŒð˜3Küªx;Æ$¸Ðc’GÜ0©©u™Ô+Æt4qÇVƒ hñu˜ªÞ¹ð|€=0lÂ9“–îçýº>*Æ„„’ò߃Co!©ìÚ`Ë·¶"ŒÿÜxë«ýÎU•íò™i{6ƒåºœ¹â ¢qzkM¸Pe+µQ–ÆqDXÝ”>±¼6ïì)e· o¯qÀE,IãL’„ú‘@öGq(+‹*wûÆü5ܲ Gœ…Vþe=ïÃ…-RÑù> L0Ë€ùÊ<J“È°ÚÏÐáµt|• Rˆ”Ó ØÌ`È£%‰ ƒÚ#%üWä$'Lpw52 YH˜I§³75Æ“V~<îÉ6;ò3+y… ¸S¾ -ƒ¯J7>:sh‡+Æä -¨MºRiQ!&“XŒÒ2+4“™€e–yÁ, ¢21+`îšqdžõÁÞM¥½©t¬Ç}ñÙÄï1—ó Ìhòè(š9Ñ’ñl ù‹²+öBï]¤³õwGÕLK_ŒDÐGt Jë•Ú¹°œ]èMšòBÇöˆ‰R²«˜gé6éBDû™ˆlŒ”Mˆµb-è‘É#]vqõ=ÇÒEȆ33ªqäa
/AŒ0bOÍ”[Øír4‚}=ä{FPØc1¨å¾˜§p®2µˆ•>lXîa„æ ¹³dXzMßpVø½^§UµF;©©Æ>”›Ôa{lÂLt4¹¾ûð¨ÃÈ;‹ÇDš–Xèê¿pü0} 2.”¨Œ˜rjã€-£a,,òHYp 3¨^Æž©Th!In½D¦^ F¶&ü[Y¸*r°-`ð¸ýp¡(Ð ¸…vk -œrý†‹KÓÎÔjŽ{é¾.u%‘µ5¬•‘$θa”o¶k¨U¬¸uáEé8]×+,Hm¿~Vôd[V•5ýÄf -ø– ã $»êÈÎÕ"…"'†4î~ Î^¥»·s -|@Ä E<¾²¨êóÌU(ݬS‹mòåÊë²|¶£üY]6MžWDœÄœ»Š•½œÏâKßä2
-4úÅåBÅô’Í8Hi“ÏPÕ–ô1´3ÕVeÆŠ2£‡ -ÁÊEmBj¢3¨Èx_¢må¡ -•ë®q¹.7:BxoСT?zÓˆ ö§®a -hìæe¶w£Ð‚uÔmúÝ?,Ûú¶.ÁNp¥ÚƒéjåDÎ\Qß‘K8 -ýdŒf{Ñç/ÔüDZìñ×{Þm yêã›æéOC™— ˜˜kúÚÔÆôÚ¼ *ŽCƒOýÞ"&¯z¯CÅ~3s½‰{gi6Á\œ ãÌžNý¡t]ÙN&}Is÷êmƒï Ú*Õ¬cÁ=™M@‘~¬öŸ'ì( -IR9b1të!?4#w`âŸ8´¢¼¦R¨[+Rõ‚”»åÅn‘ $IÞçªg<
Ô!+ A b;f<’È0–þ+O?AO¨ˆ!Ü$¢›¨› ªcùV(ŠPOÒçÕ±_Xh Pñéß|(üA„ünÔ@iÊ_ÁðhÀÃo}Ê”1"B!O“n i÷^õ$Lvi7Í#ì=ô®˜`Lº"ä·uEFSÚÜâ¯y#ÚN¼•‘Lºï€øäEþŽ \û\fÏéVA]XY¨{èQZ¥‰}i THÄ×ɧâAPˆƒò"N(äiO!}Úà -ñiÿP!wΰ§–~Y7-) Ô
N~G
…!a’ýHC Ô
9(§¡Džò˜S”=õI+È'ýr€ÍþÛ{£‚&øš|zƒ6`3ä*Ö©è*ãÚŠþj_èÖ—Ê®J‹½nÁÜ#2Ö&Œ…$‰CjÃrý°+¡s¥×c]ÌIÈNk9®2i< -òÿq… §Øj«KrPU-É»"Ã,n|Ūì_¥«8§æ%c—Õ™²S–~ÐTH â°««ÏVW_Vuj—®ö˽ëÕàÎÑQïˆá »“RnaŽ‹ÙÂxrŽŽËùÑVÐ=ªƒ’ö¨^YY@ã”yµéõ©ØAl¶µ u·õôJ³VA×+ýÂPzaÀg$ÙÉ&Ä8ÿž«ÿU%à1úO ¤4>öÿ…E«ÝP ÇG¼ˆÉ˜„1 ±LéË&ÁçîO1Yÿ—ÌÉBendstream +1522 0 obj << +/Length 2893 +/Filter /FlateDecode +>> +stream +xÚksã¸í{~…¿Õ™‰IÔ3ÛéL.›ls×Ë¥‰;íÌíÍ”–h[]Yò‰r²¹__€ +'é<%Ø«Ô4hνd®J%µÊ‰¢¨ó¬öÚTCSßu]"UN ‚yH‚ïäêfÈõµ)ZE¸zMˆJɦ|ãeeÉ õ^e-3³”í–— ª\~ 4 +hfáyN†¾9fùVT²"ŸFÒÐg[Ø>k$ŒÓ%ya4P’~¯$œø#Ìùp +"‡Ï®ëgýFÐ\í‰s&[Ô ÂŒjp`‹1ãÄ.}Qe½ß©ª%€Ý)«+]ðq‰§ +~H¿°OQ4Áæ:“¥$o…Ù=ŠR©–fì-DM¸û"çËm/Èá¤ÝÒÌNßöæ@1t$ ê÷Š, s¸b,Â)PøTE&u;aBá9±èèðV$ÑÜ\{؆,CfáCƒUP9 '°ÐßHI"ð掉zÛ›äÄ”‰ïˆDø¼ùuõöžè‚"FHÜm,$BŒëàæV 4P}#¡ô +±AiÏK:·úCÛÅÂñCa×R¾_~à‰ -³¤üœö +É‘9R P)0¦†Œi‚4`(M§6ó'óÃ^S(Wr7dg51™hïŸ Ï=¨m/̹?5YŽ¥ÚlË7“ìÌ(Ø… ¾È5o]÷"L¸6xc0¡q ²m +©—´¦5õÃD œ$ŒlH„r«å&Âçݳ5º?¾·hdµÁk+ §/-UçI0> +è¾ÏÝG$”uf,ÕDC¡Æüx¾;˜t +(–"—ÜYi4¹B™º¦qfèY'ÉíŽÑ–\z
¬nÌ\³&ÊKŸ ‰•v(Äð1“‘㣓Æ|ÒØŠž «Ëˆp}µ6eè£[SWöj›ŸMñ¢Âú`K@®Ö j]¼©VP%Û +·KÊÿóWÞþCw;"Iüé¸~œ8Ô¥V(<AêžHn?ŸŠþ_`Ý2ƒendstream endobj -1514 0 obj << +1521 0 obj << /Type /Page -/Contents 1515 0 R -/Resources 1513 0 R +/Contents 1522 0 R +/Resources 1520 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1486 0 R -/Annots [ 1519 0 R 1520 0 R ] +/Parent 1493 0 R +/Annots [ 1526 0 R 1527 0 R ] >> endobj -1519 0 obj << +1526 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [253.7995 314.5359 417.685 326.5956] +/Rect [253.7995 146.8976 417.685 158.9572] /Subtype/Link/A<</Type/Action/S/URI/URI(ftp://www.isi.edu/in-notes/)>> >> endobj -1520 0 obj << +1527 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [63.4454 279.5831 208.8999 289.7449] +/Rect [63.4454 108.9117 208.8999 119.0735] /Subtype/Link/A<</Type/Action/S/URI/URI(http://www.ietf.org/rfc/)>> >> endobj -1516 0 obj << -/D [1514 0 R /XYZ 56.6929 794.5015 null] ->> endobj -578 0 obj << -/D [1514 0 R /XYZ 56.6929 769.5949 null] ->> endobj -1517 0 obj << -/D [1514 0 R /XYZ 56.6929 748.2046 null] +1523 0 obj << +/D [1521 0 R /XYZ 56.6929 794.5015 null] >> endobj 582 0 obj << -/D [1514 0 R /XYZ 56.6929 748.2046 null] +/D [1521 0 R /XYZ 56.6929 652.1213 null] >> endobj -1066 0 obj << -/D [1514 0 R /XYZ 56.6929 720.0412 null] +1524 0 obj << +/D [1521 0 R /XYZ 56.6929 614.8935 null] >> endobj 586 0 obj << -/D [1514 0 R /XYZ 56.6929 449.6752 null] +/D [1521 0 R /XYZ 56.6929 614.8935 null] >> endobj -1518 0 obj << -/D [1514 0 R /XYZ 56.6929 413.7675 null] +1072 0 obj << +/D [1521 0 R /XYZ 56.6929 584.5024 null] >> endobj 590 0 obj << -/D [1514 0 R /XYZ 56.6929 413.7675 null] ->> endobj -895 0 obj << -/D [1514 0 R /XYZ 56.6929 387.3208 null] ->> endobj -1521 0 obj << -/D [1514 0 R /XYZ 56.6929 230.2407 null] ->> endobj -1522 0 obj << -/D [1514 0 R /XYZ 56.6929 230.2407 null] ->> endobj -1523 0 obj << -/D [1514 0 R /XYZ 56.6929 198.3547 null] ->> endobj -1524 0 obj << -/D [1514 0 R /XYZ 56.6929 198.3547 null] +/D [1521 0 R /XYZ 56.6929 289.5256 null] >> endobj 1525 0 obj << -/D [1514 0 R /XYZ 56.6929 198.3547 null] +/D [1521 0 R /XYZ 56.6929 251.3901 null] >> endobj -1526 0 obj << -/D [1514 0 R /XYZ 56.6929 192.4259 null] +594 0 obj << +/D [1521 0 R /XYZ 56.6929 251.3901 null] >> endobj -1527 0 obj << -/D [1514 0 R /XYZ 56.6929 177.6614 null] +900 0 obj << +/D [1521 0 R /XYZ 56.6929 222.7156 null] >> endobj 1528 0 obj << -/D [1514 0 R /XYZ 56.6929 174.3269 null] +/D [1521 0 R /XYZ 56.6929 53.7852 null] >> endobj 1529 0 obj << -/D [1514 0 R /XYZ 56.6929 159.5623 null] ->> endobj -1530 0 obj << -/D [1514 0 R /XYZ 56.6929 156.2278 null] +/D [1521 0 R /XYZ 56.6929 53.7852 null] >> endobj -1531 0 obj << -/D [1514 0 R /XYZ 56.6929 98.4347 null] ->> endobj -1010 0 obj << -/D [1514 0 R /XYZ 56.6929 98.4347 null] +1520 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F47 879 0 R /F53 962 0 R /F11 1299 0 R /F39 863 0 R >> +/ProcSet [ /PDF /Text ] >> endobj 1532 0 obj << -/D [1514 0 R /XYZ 56.6929 98.4347 null] +/Length 2825 +/Filter /FlateDecode +>> +stream +xÚµZ]{£6¾Ï¯ð¥ý<-’ KÇö¤É4™4v·Ûα›g0¸g&ýõ{„>äζûä" ôâóžO <òà"†<ÊýQÈ}Ä<ÌFëý•7ÚÂÜíV2×ZèÚ–ºY]ýó
G ñ€£ÕgkyQ„G«ÍÇñôéiñ8¿û÷äš0o<E“kæyzt¶XN®Ã€‹ *¦o|swóã݇Ûçéӿʇ~ó˜7}œË›åÏ··‹åj¡nŸÓùÝã-ˆàɧÕýÕbe^ÛþiØ£â¿úøÉmàÞ_yˆòˆ¾Â‡0çd´¿òȨTdWË«ŸÌ‚ÖlýhŸª‹HØ£+‚G#Îi)‹qPBke-«8ßÄÇM9ø[¨(c—h²¤$4í£IK äÏïf $ÿS3E ÞÝ m¤Î±}ÛD0c( +)kƒÏ‹}œæ’ÐÇxŸ”ŠwBBy5+òur¨Ô8èH^¼‹×i–ViRë«ó3qè!„¼ Àø‡|äi‚ £Érì¡X‰IuLK%õX¼&û—ä(ï0B4ÈÀVüKŒXRF´”Ås0₶éb0bƒ_dänÈ’}’Wq•y‡—å!Y§¿y YËÙsr&@¿ö’#oþ>Š(½@‘-5L‘‘ÒñÐá3N䆡3è~†ZØqš©Xœª4ßv8¨v‰¼°©\¾•U²ïs1Òç¼ÍÇLiÿ)>‚æ7ÛDßÇù)>¾ÕH-ÙŠpׄøˆG Z*~€O꥟ŽÅ¡(m)—^@Eäw–”ƒ;-eÜ‹s‡{9¡-òºØäÙàwùú8ÁÑXzâñ?E®([M0Æãcœ—ŸµkçË>ú|Œp +ªèf1ˆ{²¶À,@^C-·{FæBþ¿9•;yµÈþЉ픽ý&A$¢ä–”ƒ -e˜ ^ä`Âm1ÑÅ `ÂL¶ ÒW ÕâõÎT:è~:%Dz›r„I@úSÑ4ßÈÄ÷U×qq=°Þ½GÃz‡¦CP½ wKÊ¡w-eô „.pA[zïbèÝ_|«’¼4 Æ$§²“ŒòE?¼€;Ow½gF¡€ùŸóŽÃô1 |‰KÊA–²( +\Ð]ì +lðÇ"¿–EWrܧ¹®ÈŒÆe‚©£G²I¥¯ÃC$d´ßfÇø«`VØôëžêÞ^"ˆ|nÝÛRú7RF÷‘洞ÐîÏ°ûuß_&ª* lü>y“M ¯UýEÐ䄼JMM’ÒEàBÂEVË»Û!„"/bØâ j<nÀCüq:Ácå$”?¨©ÛÓfé»”E¡Ñx®fqY]˼o Zy?‹¿h—£-#0}Û2”_&œŒ“,ƒ\Iœ:XªôD<(›í$QQ~ÁN,)‡h)c'œz;qA[vÒÅ °¼e' i'"}—Uü’¥åN4S®˜¹z¿P;ŠÏÏC¡3âÈçAgÓh®8ô2¸L•µ#áfÈçˆr‰!KÊÁ–²r$2'´ÅP{€!Ü(û9ùý”èf,»ÇŸ…ÚÒm W'ImÙ%׫s\9äÆ Ô”ðÿ7[#àKlYR¶´”f‹z^è`Ëm±ÕÅ `ËRZ?ß'jòj¨ -ÀqM†|D·kâF¶k½Á#ƃ6IÎ0×ÞÛssƒ)è7–”ƒ-e¸ œ9ÑmqÓÅ àÆ¿Mr¨¯…bÃP•V"Ú…Ü _Óu"§¦Ù¶€©Ý^ÎÉ°' ib%ÜËX =>(–éæT{-éÕp!è¿].e~ót^“§<®\ËÏüN9´Tô¿ÿç}õéì +¶º/ÓÃi&·hÞêß¡fÔ_¦/Å«=sß²²~e|–pu?øCœejîú*ló£ýû›<€æ©»¿Ù4ª
mõÖÒwm{RßC Kqšµ-5lÖFʘ5!³vB7f}†ÝoÖ-ð»|SÛ˜n+Ÿ“²È^µ¢—§Ã¡8Vg çr1ëËÔƒØ ±þØ?+ò£¡zž¬Ûᆠ+±ŠSzIï–”CïZÊè=¢Ô¡w´¥÷.ö€ÞmðÕNFƒ” /]xœ½•i)Źµfk
®ÕÖ\éL ®íLÐ ð©p’f¯M¬Šxõ%Í´Ü-ƒ‹g= P’Šàã@wFªžV‹¶êi Ó $“pŒ" ^Ø#µ¥†É4RšLßs‘é„nÈ<Ãî'³^Ìí¼€y¾UÉ|\lN*²‹ÑZÁBX”disæлsùбØÅ”ÕĈç§òYèzº†11ú FŒª;òdw$^æ!.ËDGn¹9ª [œ6LjH p•IÿnÐφé0 +=|a¿Ô–rЯ¥,ú 1Ô mÑßÅ ßWgU±.Ä.øÌC±él FD¥oíÕbD&&áÈMb‚;¹û}nýlŸ3C¯îs;s,“&,Ú6 3a;²}PâÚ,”G«•[ìëÞ2–Îñò_´ ¨‚™èÌÝvaI9ìBK5vá;΃Ж]t±ì¹TÖó¢8„È#ëB”õMm”F*ÊSU׉‹Æ ÄÙì5,>}ñ}ʸ Þ´#š‰È21ú ÄMŒƒsu\bZFñ÷ÃY‚©À² ¸ ¡£ùÈ +’Xï* +endobj +1531 0 obj << +/Type /Page +/Contents 1532 0 R +/Resources 1530 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 1589 0 R >> endobj 1533 0 obj << -/D [1514 0 R /XYZ 56.6929 95.3752 null] +/D [1531 0 R /XYZ 85.0394 794.5015 null] >> endobj 1534 0 obj << -/D [1514 0 R /XYZ 56.6929 80.6106 null] +/D [1531 0 R /XYZ 85.0394 752.3015 null] >> endobj 1535 0 obj << -/D [1514 0 R /XYZ 56.6929 77.2761 null] +/D [1531 0 R /XYZ 85.0394 752.3015 null] >> endobj -1513 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F47 874 0 R /F53 957 0 R /F11 1293 0 R /F39 858 0 R >> -/ProcSet [ /PDF /Text ] +1536 0 obj << +/D [1531 0 R /XYZ 85.0394 752.3015 null] >> endobj -1538 0 obj << -/Length 2936 -/Filter /FlateDecode ->> -stream -xÚµZ[sÛ6~÷¯Ð£4Sc‚àåQ‘ÕN츒²ÝNÚZb,N(Ò);î¯ßâB" tº;~0 â£Îwn8 aø#£ˆ!LcÆ>b˜°Ñöp…GO0·¼"RæZ ]›Rï6WÿzOÃQŒâÀ F›¯ÆZÂQDF›Ý—ñôáaq?¿ùÏäÚcx<E“k†±-Ö“ë0ˆùåS ¿»y÷ñæÓr5}øù7ñÐï˜áéý\ܬ?/—‹õf!oW‹éüæ~ "dòÇæöj±Ñ¯mþ4‚)ç?¯¾üG;ø…·WÑ8b£W¸ÁˆÄ±7:\ùŒ"æSªFò«õÕ/zAc¶ytHUZæšú( -`
·BYŒêQP¸ P¨’â -ý²z?ó
þèÿ^Â0ŠbŒÌEÏ µÔ9¶o’ICQHY|þV$‡l;¹¦A8þü¼Kê´â7Ñ8+Ä`½OÅż<$jð>9¤BlýVÕé¿zï·0š -Ÿ%Û}V<‰›òk…_Né1ß Ð>ñ¯«ý;©ôi±;NH4N_+5“4Û½Ö{dÕ;Ä;K‡n½›Rv½k)÷ tx€ºÕûö°Þ;à‹ïuZTÜ–…BÒí>)²ê ]ákyì)Ÿ'¬Üa•–ú„… ¦CŽuüÆŒu
/§§SUÿ€é!EaL.˜¾)å @Ix -\Ð}l &ø}Y\ošÀž Y‘ä=‹ÓDt— ÞZÃC^Èè°ÌŽÉ+gVØ
ë>¶ë V¦O.èÞrè^IiÝG>sèÞmè¾mѽ ¾N·B¡\”?¤oâBrLŠ*º†Ñ -‰Í\ -G
üù©xv:ý Í ½“£ “£Üa±#â/s—TUª¢µhˆJÈ:«Ä°‚`9Ü!Ê™rÂcÔ¿@º!å ]IÄ»â¦ Ú ¾m!ßI¯.·%ïL€ŸÜ•»^Ó4òdÊVžÌGD2âÎÛ&#¸ 'ØÛ6Ï9pˆ"?6svLD¢„E»f¡'Lçå£wR\™…ôb¹r‡}µ;ÆÒÍÒÿÐ. Qð®ä…``JÙíBKµváûv»pB·vq†=l pž?E
Ï BJ¹ËoK^V47=PÉÈNe-Ç/Z{àwº9h „ŸGùF¯„²XlÚ‹íDd ½“â:FðÁ¹<"Ñ £øßÃYÑ‚Â)Ç2‹¶O !Y Ü x’¨NÐ+7¥ÓÇòT÷º - œ7±UŸE ü>Æ[ânã3¤ Ƨ¤”ñæ -JNhÃøúØã3Á§“kæù†%ñ;© s^)ð†3cFÁ|dV ÍNj3öëÄÃcØИw»4—«ÏÓç¼|SÏ7,4¯P~_ÿ)°` -¥bH#˱‚ ´>=Û±¾eò"^¸Ú8¦ÖXãEá8¾ÐÜ1¥ìtk)ƒnÇѬº¥û {˜îø¬< D¿•¨6ë™ý7“ Ájy¬„ŒðZ˜XŸžž`Öì`ü}ö}ð -Ò:õ¨u;<wvó¤ø+{²E›»,ÏõYïß4 ?FAèÅLÂr˜„’Ò&GŽS'´a}l‹I˜àëô˜©£’ûS»Ãš6-‰´Î¶C'f柟Îê£XËöœ × ˜vµS‚<L.Tƒ¦”CíJªÍú¡#ë;¡
µ÷±-j7Áµ'Bå—Ué>yÉx -¬äÄç<‡°\Èu¥¡P#ó‡Ëí·ä9Á¦Ô¾Q½U'~÷c°½S µ "á¥6L)ËJJ³ bGZvB,÷±-,›àíõzúÐvÕÚ]Aë
ƒT{ $Å0 nÎßKºYw‘gežæybI†ö¶ Áˆ±wa/fJ9ˆPRšˆ(tá‚6ˆèc[ˆ0Á§ÜšÃñ]š4ÛqOuÐ=¾½zVÁUh&?–ºÙ7 ô@Ð|îÆ'ÄNÞk?wã“òtFŸ»QLTŠn"ê"¾$ŒJŽµ^çu>µ±Z¦Ûìo"z¿LºQET¶å
>]8ß&Å)9¾ý@ºCä…Á…ž·!äø¨J -é#QÌ %’ ×ø¤ªlù¢Ê@“ D~”@‰ßÄ_> öåpÑ|Ëöõ1 -~/öé ÙZ n´\\ ýTÈ~jö\\ Šù“ËSþx¦ª´ -¡“®„R†ø·ªzÅ:¡ÿãÏfͶ<¢Qd Ý(òâP½ùøì£^F#Ä"/ xõÿp=7endstream -endobj 1537 0 obj << -/Type /Page -/Contents 1538 0 R -/Resources 1536 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 1592 0 R +/D [1531 0 R /XYZ 85.0394 746.3107 null] +>> endobj +1538 0 obj << +/D [1531 0 R /XYZ 85.0394 731.5461 null] >> endobj 1539 0 obj << -/D [1537 0 R /XYZ 85.0394 794.5015 null] +/D [1531 0 R /XYZ 85.0394 728.1497 null] >> endobj 1540 0 obj << -/D [1537 0 R /XYZ 85.0394 769.5949 null] +/D [1531 0 R /XYZ 85.0394 713.3851 null] >> endobj 1541 0 obj << -/D [1537 0 R /XYZ 85.0394 771.5874 null] +/D [1531 0 R /XYZ 85.0394 709.9887 null] >> endobj 1542 0 obj << -/D [1537 0 R /XYZ 85.0394 744.8677 null] +/D [1531 0 R /XYZ 85.0394 651.9592 null] +>> endobj +1016 0 obj << +/D [1531 0 R /XYZ 85.0394 651.9592 null] >> endobj 1543 0 obj << -/D [1537 0 R /XYZ 85.0394 741.1608 null] +/D [1531 0 R /XYZ 85.0394 651.9592 null] >> endobj 1544 0 obj << -/D [1537 0 R /XYZ 85.0394 726.3962 null] +/D [1531 0 R /XYZ 85.0394 648.8377 null] >> endobj 1545 0 obj << -/D [1537 0 R /XYZ 85.0394 722.6893 null] +/D [1531 0 R /XYZ 85.0394 634.0731 null] >> endobj 1546 0 obj << -/D [1537 0 R /XYZ 85.0394 707.9846 null] +/D [1531 0 R /XYZ 85.0394 630.6767 null] >> endobj 1547 0 obj << -/D [1537 0 R /XYZ 85.0394 704.2179 null] +/D [1531 0 R /XYZ 85.0394 615.9121 null] >> endobj 1548 0 obj << -/D [1537 0 R /XYZ 85.0394 689.4533 null] +/D [1531 0 R /XYZ 85.0394 612.5156 null] >> endobj 1549 0 obj << -/D [1537 0 R /XYZ 85.0394 685.7464 null] +/D [1531 0 R /XYZ 85.0394 585.7959 null] >> endobj 1550 0 obj << -/D [1537 0 R /XYZ 85.0394 670.9818 null] +/D [1531 0 R /XYZ 85.0394 582.3994 null] >> endobj 1551 0 obj << -/D [1537 0 R /XYZ 85.0394 667.2749 null] +/D [1531 0 R /XYZ 85.0394 567.6349 null] >> endobj 1552 0 obj << -/D [1537 0 R /XYZ 85.0394 640.5552 null] +/D [1531 0 R /XYZ 85.0394 564.2384 null] >> endobj 1553 0 obj << -/D [1537 0 R /XYZ 85.0394 636.8483 null] +/D [1531 0 R /XYZ 85.0394 549.5337 null] >> endobj 1554 0 obj << -/D [1537 0 R /XYZ 85.0394 622.0837 null] +/D [1531 0 R /XYZ 85.0394 546.0774 null] >> endobj 1555 0 obj << -/D [1537 0 R /XYZ 85.0394 618.3768 null] +/D [1531 0 R /XYZ 85.0394 531.3128 null] >> endobj 1556 0 obj << -/D [1537 0 R /XYZ 85.0394 603.6122 null] +/D [1531 0 R /XYZ 85.0394 527.9163 null] >> endobj 1557 0 obj << -/D [1537 0 R /XYZ 85.0394 599.9053 null] +/D [1531 0 R /XYZ 85.0394 513.1518 null] >> endobj 1558 0 obj << -/D [1537 0 R /XYZ 85.0394 585.1408 null] +/D [1531 0 R /XYZ 85.0394 509.7553 null] >> endobj 1559 0 obj << -/D [1537 0 R /XYZ 85.0394 581.4339 null] +/D [1531 0 R /XYZ 85.0394 483.0356 null] >> endobj 1560 0 obj << -/D [1537 0 R /XYZ 85.0394 510.1696 null] +/D [1531 0 R /XYZ 85.0394 479.6391 null] >> endobj 1561 0 obj << -/D [1537 0 R /XYZ 85.0394 510.1696 null] +/D [1531 0 R /XYZ 85.0394 464.8745 null] >> endobj 1562 0 obj << -/D [1537 0 R /XYZ 85.0394 510.1696 null] +/D [1531 0 R /XYZ 85.0394 461.4781 null] >> endobj 1563 0 obj << -/D [1537 0 R /XYZ 85.0394 506.8333 null] +/D [1531 0 R /XYZ 85.0394 446.7135 null] >> endobj 1564 0 obj << -/D [1537 0 R /XYZ 85.0394 492.1286 null] +/D [1531 0 R /XYZ 85.0394 443.3171 null] >> endobj 1565 0 obj << -/D [1537 0 R /XYZ 85.0394 488.3618 null] +/D [1531 0 R /XYZ 85.0394 428.5525 null] >> endobj 1566 0 obj << -/D [1537 0 R /XYZ 85.0394 464.2921 null] +/D [1531 0 R /XYZ 85.0394 425.156 null] >> endobj 1567 0 obj << -/D [1537 0 R /XYZ 85.0394 457.9352 null] +/D [1531 0 R /XYZ 85.0394 355.0758 null] >> endobj 1568 0 obj << -/D [1537 0 R /XYZ 85.0394 432.4907 null] +/D [1531 0 R /XYZ 85.0394 355.0758 null] >> endobj 1569 0 obj << -/D [1537 0 R /XYZ 85.0394 427.5086 null] +/D [1531 0 R /XYZ 85.0394 355.0758 null] >> endobj 1570 0 obj << -/D [1537 0 R /XYZ 85.0394 400.7888 null] +/D [1531 0 R /XYZ 85.0394 352.0499 null] >> endobj 1571 0 obj << -/D [1537 0 R /XYZ 85.0394 397.0819 null] +/D [1531 0 R /XYZ 85.0394 337.3452 null] >> endobj 1572 0 obj << -/D [1537 0 R /XYZ 85.0394 325.9133 null] +/D [1531 0 R /XYZ 85.0394 333.8889 null] >> endobj 1573 0 obj << -/D [1537 0 R /XYZ 85.0394 325.9133 null] +/D [1531 0 R /XYZ 85.0394 309.8192 null] >> endobj 1574 0 obj << -/D [1537 0 R /XYZ 85.0394 325.9133 null] +/D [1531 0 R /XYZ 85.0394 303.7727 null] >> endobj 1575 0 obj << -/D [1537 0 R /XYZ 85.0394 322.4814 null] +/D [1531 0 R /XYZ 85.0394 278.3282 null] >> endobj 1576 0 obj << -/D [1537 0 R /XYZ 85.0394 297.0369 null] +/D [1531 0 R /XYZ 85.0394 273.6565 null] >> endobj 1577 0 obj << -/D [1537 0 R /XYZ 85.0394 292.0547 null] +/D [1531 0 R /XYZ 85.0394 246.9367 null] >> endobj 1578 0 obj << -/D [1537 0 R /XYZ 85.0394 265.335 null] +/D [1531 0 R /XYZ 85.0394 243.5403 null] >> endobj 1579 0 obj << -/D [1537 0 R /XYZ 85.0394 261.6281 null] +/D [1531 0 R /XYZ 85.0394 173.5556 null] >> endobj 1580 0 obj << -/D [1537 0 R /XYZ 85.0394 246.8635 null] +/D [1531 0 R /XYZ 85.0394 173.5556 null] >> endobj 1581 0 obj << -/D [1537 0 R /XYZ 85.0394 243.1566 null] +/D [1531 0 R /XYZ 85.0394 173.5556 null] >> endobj 1582 0 obj << -/D [1537 0 R /XYZ 85.0394 171.8924 null] +/D [1531 0 R /XYZ 85.0394 170.4341 null] >> endobj 1583 0 obj << -/D [1537 0 R /XYZ 85.0394 171.8924 null] +/D [1531 0 R /XYZ 85.0394 144.9896 null] >> endobj 1584 0 obj << -/D [1537 0 R /XYZ 85.0394 171.8924 null] +/D [1531 0 R /XYZ 85.0394 140.3179 null] >> endobj 1585 0 obj << -/D [1537 0 R /XYZ 85.0394 168.5561 null] +/D [1531 0 R /XYZ 85.0394 113.5982 null] >> endobj 1586 0 obj << -/D [1537 0 R /XYZ 85.0394 144.4863 null] +/D [1531 0 R /XYZ 85.0394 110.2017 null] >> endobj 1587 0 obj << -/D [1537 0 R /XYZ 85.0394 138.1294 null] +/D [1531 0 R /XYZ 85.0394 95.4372 null] >> endobj 1588 0 obj << -/D [1537 0 R /XYZ 85.0394 123.3648 null] ->> endobj -1589 0 obj << -/D [1537 0 R /XYZ 85.0394 119.6579 null] ->> endobj -1590 0 obj << -/D [1537 0 R /XYZ 85.0394 92.9382 null] +/D [1531 0 R /XYZ 85.0394 92.0407 null] >> endobj -1591 0 obj << -/D [1537 0 R /XYZ 85.0394 89.2313 null] ->> endobj -1536 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F47 874 0 R /F21 654 0 R >> +1530 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F47 879 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1595 0 obj << -/Length 2839 +1592 0 obj << +/Length 2889 /Filter /FlateDecode >> stream -xÚµšÝs›¸ÀßóWøÑž©µHâóщ]ÇmãæÚIwwº} ¶’0µ!Ü6ÿýJH‚¢½wîä! :X?OÀ#‡ÿá‘ç#?"Ñ(ˆ\ä9ØíŽÎè‰_[^`%3ÕBS(uywñÇ[Œ"ùÄ Ý=‚¹Bä„! Ýí?gˆ¢ ŸÁ_®.?¬>.7³Ûë¿'Sâ9ã Ï™çòd{¿\.¶w uºYÌæ«õ’‹àÉ4ð#g<»½]¬ç«¿äõ™˜Õ©G¯ÛÉ—»w‹»ú±áOÃÏüíâóg´ç¿ðÝ…ƒhz£ üÄA8ŠÈèxázy.¥zäp±½øO=!¸ZÝjZªZfJ]rý êEȧ„Ö Ê
ª¥Ä‚~Þ¼½"ا_º¿ÂU{ÁNz¦º–:×íB˜˜È#A[÷}‘¤O“)%d\>3y°JK–§¬”góõV]ÏÔ@R”yòp*•øÍê¯ÅF ^eéc– ãTÝ»<dñA Ïöû|‚Ã1+ -u_üò"”ó ÝY%êFÈÅ.ÇR=ã.ïÊýQMt˜Š{%6ÅEžG*éC¶Û='Ù¹©ÞÅé)Î_å ß!êÝT|y"Š£¼@Ê‚WK¼¡¯M5ÀÛÕmÆ uoX‘ Ne’¥|¨?Î Åÿ`|Ÿ&” B§ŠÍŽÉ‘Õž¥eòã–rè$7Š¸¹Ú(blž ãDͼŽL^Þ¾%;š°:¡°7HM§ ;È)ât/oBom¡¾añáÀ K³>¥¬ ô‚ö# Š];h(Õº–ªAêôƒ¶ªn@Ÿé6‚né~ÏÔ _üÜ=Çé“Zˆ9;°§Xñ>˜í²|/ù’§^o
Øpèq=š˜)§]~MÒ"KÕðÇ]™=°üW(>rCÀ›B) -USð¨o¡`S
(tu›)@ÝóíLþô÷‹¿ y$·²ˆ†«¥JÒîºk;âÇÊŽÄ
ÒŽê¸ÊéT±óœá‘) -ü6¡¹"´ˆ‹òej˜V†¾Wg7±´ûçšXÔOŒ ®3à ¡”…˜–Ä 1›j@¬«ÛL êÞlgÜÌ= YMXRC’š8€Ä&¹Œ¦&%µêEM Pó#ñ !ˆrÄ&fØ\bg
¶Ê;Ö3µ¼£ &ñã:Ù!”²ÀÔR -Ü0¯±²ÝóY¿ÆŽÿlÇ
êN(eÁ¦¥jl^déXUl]ÝflP·ìª†<GüY²´àÁQ”™‘#»¬üqzyÉòR -nåàw–U ƒ¾©W`äø.ñÆ[$ï¸{ÎŽ²‚£Wjôú”p»Õè'
K\z_$iœ–ê’,Šù°îÊÕÚÚN6;%E‘˜:Bœ3íåL#g÷Á@I -¥ú9×R€³¥¿`UÝp>ÓmäÜÒ}Íí 2¢ÆäîÓ¯iö#íšn»Ûi× T†×2ðÂ؈ﴎ Δ .OE?M-y %%>+_$öQ´a ¢˜{ž)O q@Ýf/·z]ug«~•ÐÇœøÈ †*S(ea®¥4s c±…¹M5`ÞÕmfu×ë±HwÙþ þš•?²ükSÕt;… ùòå¿ -žVv,õ2‹;=µ_é¥ðº…. ?PÊÂKK5íbi_[U^]Ýf^PwíéÜP{:7žn íÊÙ¹Q§»É%W³õL ]ñŠ!Ù³¼²¿¢§Õé“Ö[A>cUdóÛa‘͇A‘-.*¡Ëªá•¦¬º:ý³²¹Ã!‰…î²h% - 6ÙKzÄiÚ¼§ïëÂœ¥›ƒBêâžlóã üõ¦ƒ¹pcðÍPªãÔRuˆt¨%o±ªn6ΙnãÆié†!2Þ “T|Ž—Y®ËúfYªó§ß&Èä¡}O¼¹îä7 -Ù‡¬äsŠ6¬º°Î¾h<5é·/ž›úþ€ƒ…R–u×RMjb{SlU
Ö½«Û¼îP·ð¡Y·d›Çe¬ÚÃÉig›ŠÖÉÓ)Ùá"—a-/Œ_XÈõ]×’É_2–«*ÝôEU€[èÐ[{(ea¡¥j¶¼Š°ª,ººÍ, n#‹Ú è¨W»¡ß'B0OØß]Æ9´Œ³7 ˆß „³o mBý8´P Ê [SÙ¦·ÑUldŸúUÎã~žÄzªÊ'ºy=ËEGËèœ^Üâ°óMK'žüN‚ص˜~@~ˆ0u†>k„, F(¡æã0lÉ5lzÁg Åæ¯"€âû‚µûµÁÌx$/X·ðmµ'¶ê 9~„( ]¯¥ãÇu|LåYq¬¿ûSØOž<=—¿ýååa‹?…uêìáþ2¾áATx#i"^®„|õPb!"röäØA„úÄðèÿå3fƒendstream +xÚµšÝw›:ÀßóWøÑ>§ÑEŸ$v·‰›µ“·ÄVN0¤·Í¿#ôÀ zwÏž<¤AƒõÓŒfFà‰xâùÈH4 "yö&Ûý™3ù}WgXÊœ+¡sSêâþì÷4˜D(ò‰?¹2Æ +‘†xr¿û2E3Á™^,/n–Ÿ®ÖñÝõ_³sâ9Ó¿ ωWsq³y¸ºZlîòv½ˆçËÕˆàÙyàGÎ4¾»[¬æË?EÌGutëåb3ûzÿálq¯_ÛüiØ¡ü¿Ÿ}ùêLvð ?œ9ˆF¡7ù 7ÂQD&û3×£Ès)U-ÙÙæì_z@£·~´wª°ƒõIÏ\<ÁEžGZ“åEȧ„Ö“µfeq<l™œ¶-;q}?ƒx{eå௤ €°4¤ÄKÑ>€JŠ¿Ó—õûKŒCúµ«ÓávÕZêT·k. Lä‘ {Å~ÂÏÇt:_mÄÅz-ØߎCò´J‹¼ž“ÎOÁŽ ÓJ}x >Ð;xŠ8ÓKô~‘)c,~°Ã ‡ÓçäPÕxz#»âú?™Þ&ûä¥(eïZö>dÙ>És9h’ïDóÝ “H
~[l_’WV RxÞfB½Ò¹XÂ>>m«âÞ£¦ ‹ÎAC„ý(B¡ïŽ6¥† k)M8püaÂVÕ
áݽ„[ºXøé«M|§–=7¦m½˜Aw‘ä/ø Òü›¸˜øh²÷²ÈX–%ò™.w˜C +jt¼G¯~c¬úqe×õ‚ÐZ ÂNû{ÞH`dJY¨*)Mû–}ÕªÚ ÚÕÝOÕÔý ,fBò‚‹e^±CÎ*q'€óþB6¤%ìeÇJŠß.ÿ\¬Ååe!ì?—Ï^eÅc’‰ëx·SÎC>—¼¾rå=FïFÈÅ.5ð»"ΫÊÎ¥Q+±Ã¬ØnŸÓbÀhÃA¼^è"â® ¯)5ŒWKxÃa¼VÕ
Þݽx[ºùš ¥;¦~m|„Ó‡<å Dcg›…–åŽåUÊã*v(EÓQº|ª|9´i_Nµ/§V_NQzÔôå‘Ø„ù`Iž²L !|14Þ"å¿å£-Ô°Ge¼–b}Ì™ ƒö¢ADG@RÐJJƒ&Ô±€¶©6@wu÷ƒ6udr/~mŸ“ü›œˆ9ËØ7µ w ±Ã…àÉ¥W›¾È*ô ‘¡íÀJ…NqÕÚ#»±“…%Èuý1 +†”…‚’Ò`¯·P°©6(tu÷S0uÏ7±øé •°b³¼’MiÞweG<úvÄ v¤óc SçÀ=Û%uQømBsIh‘”U–¼0ÙLkCß½Sq±°ûgM,&†af0 s†”…˜’2ˆb6Õ±®î~b¦îõ&þãvîÁÎ(j4À2¢5~Åñÿb›E7 +jõ’¿ ¡æG(pÐØån`s ¿k°‰`FÔÊ'0ÝÐA>Lº ¦)5 SK0-»UuóDw/Ì–îMU ê] +GtzÉb ƒà“•¼Íò¾š!oP y£`ȯC.1ÂP„!ílòç9Cþ¬izŽ§ +™z…ñ‹ORøê¸Û !¨•Á ¹Å´ñ´ÿÄr]ˆã؆”¶’2`GØ6Õì®î~ئn;û\(â/‚Øô©ŽZίY]™½°9–¢?•-Òõ††ë´ë
×-€ÀEÄÒ†ë
¥ëZüý–ëõñ‰
Ëþ C ºÑUCÊBUI5T]K cUmPíêî§jêž³*Ù>³Ý³1Šìݨ@ôà‚Ù¥ÔõþÏ[%…42ÂþSj–Òh‚ÐR +5 ‰¥ngÓkì(îGi(Ž›t]$ãk}4HøÑ`'¿¿IËJ¦žÂ÷:íb o¸·<xúÅJãPöîFé = ààö–j¸^È«ŠíóIÆ + <¢8²3„†)!
Ì‹,¥›ÞXWq/0S±¨¡†þªX^Ö'•°;¢¦ +ÿËãëkq¨„ÐòN4þ`‡R”Í¡Ñï«Ì9~dl„.ñ¦$ž¸.ö"_à—²õú˜‚&²õ³.˜C×Ç2Í“¼’]"†fUƒÓÚÚδ8¦e™öÕ€0 &Ì‹·ÔClHY+)²¥š`UmPîêîÇl꾆IËô9£2¶‡ü%/~æ]£ 8ÜllOš\Ë´ËÞòFnu,0–Æwu,«ä©l2ÇÓíª3˜Öw à—¬`Jx Bãö9®lé:–>8`ù,ä8Έ 6¥†™k©æË3·ªn˜ŸèîeÞÒçc‘o‹Ý ü«~‡—&‡éÖ?Áô ~²"âø¡ÅÍ~6oZ_ ˆñzH3•¼„ÃÉ ö"â±j)e¡¤¤J¶ýÒªÚ ÔÕÝOÉÔ½fß©Øãö,WÛ¡Þ"›#/~w]è
ó\ÍÝk–nBzSÖ•ž»Ï,HžÜNáüâìØ@¹Ü… ݑz)e¢¤4/²™ŽMµ¥«» Š©{<½ßT‡ã¶n’ufÞ8ÛèÙ#ùuÛ“ÿAÇ +¶}ÎÁ=eês¦=÷qr ê 6=äé÷#ë#@ wÓ!(ôü
¶í,c‰ÂÊŽ¥^I§‚ö;•“~f8ö•…!4LK 5eb©TÛô6¬ºŠ{Q™ŠµsCåã܈û¸¤Õµ›s£N$—ñ*W—+¤;vH†¾oä%MŸ´Nÿ`Ä:¥†ÇÍ”š”šwJ¡‹º°•çâ#Èó×Ö–ei²W_,j%Ø_kç3»Á@ÓRgñÿž¶gò “þÏŸíUñ endobj -1594 0 obj << +1591 0 obj << /Type /Page -/Contents 1595 0 R -/Resources 1593 0 R +/Contents 1592 0 R +/Resources 1590 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1592 0 R +/Parent 1589 0 R +>> endobj +1593 0 obj << +/D [1591 0 R /XYZ 56.6929 794.5015 null] +>> endobj +1594 0 obj << +/D [1591 0 R /XYZ 56.6929 748.5056 null] +>> endobj +1595 0 obj << +/D [1591 0 R /XYZ 56.6929 748.5056 null] >> endobj 1596 0 obj << -/D [1594 0 R /XYZ 56.6929 794.5015 null] +/D [1591 0 R /XYZ 56.6929 748.5056 null] >> endobj 1597 0 obj << -/D [1594 0 R /XYZ 56.6929 769.5949 null] +/D [1591 0 R /XYZ 56.6929 743.7078 null] >> endobj 1598 0 obj << -/D [1594 0 R /XYZ 56.6929 771.5874 null] +/D [1591 0 R /XYZ 56.6929 719.6381 null] >> endobj 1599 0 obj << -/D [1594 0 R /XYZ 56.6929 744.8677 null] +/D [1591 0 R /XYZ 56.6929 711.8197 null] >> endobj 1600 0 obj << -/D [1594 0 R /XYZ 56.6929 739.887 null] +/D [1591 0 R /XYZ 56.6929 697.0552 null] >> endobj 1601 0 obj << -/D [1594 0 R /XYZ 56.6929 713.1673 null] +/D [1591 0 R /XYZ 56.6929 691.8868 null] >> endobj 1602 0 obj << -/D [1594 0 R /XYZ 56.6929 708.1866 null] +/D [1591 0 R /XYZ 56.6929 665.1671 null] >> endobj 1603 0 obj << -/D [1594 0 R /XYZ 56.6929 693.4819 null] +/D [1591 0 R /XYZ 56.6929 659.9987 null] >> endobj 1604 0 obj << -/D [1594 0 R /XYZ 56.6929 688.4414 null] +/D [1591 0 R /XYZ 56.6929 635.929 null] >> endobj 1605 0 obj << -/D [1594 0 R /XYZ 56.6929 673.7366 null] +/D [1591 0 R /XYZ 56.6929 628.1106 null] >> endobj 1606 0 obj << -/D [1594 0 R /XYZ 56.6929 668.6961 null] +/D [1591 0 R /XYZ 56.6929 601.3909 null] >> endobj 1607 0 obj << -/D [1594 0 R /XYZ 56.6929 644.6264 null] +/D [1591 0 R /XYZ 56.6929 596.2225 null] >> endobj 1608 0 obj << -/D [1594 0 R /XYZ 56.6929 636.9957 null] +/D [1591 0 R /XYZ 56.6929 569.5028 null] >> endobj 1609 0 obj << -/D [1594 0 R /XYZ 56.6929 611.5512 null] +/D [1591 0 R /XYZ 56.6929 564.3344 null] >> endobj 1610 0 obj << -/D [1594 0 R /XYZ 56.6929 605.2953 null] +/D [1591 0 R /XYZ 56.6929 549.6297 null] >> endobj 1611 0 obj << -/D [1594 0 R /XYZ 56.6929 581.2255 null] +/D [1591 0 R /XYZ 56.6929 544.4015 null] >> endobj 1612 0 obj << -/D [1594 0 R /XYZ 56.6929 573.5948 null] +/D [1591 0 R /XYZ 56.6929 529.6968 null] >> endobj 1613 0 obj << -/D [1594 0 R /XYZ 56.6929 558.8901 null] +/D [1591 0 R /XYZ 56.6929 524.4686 null] >> endobj 1614 0 obj << -/D [1594 0 R /XYZ 56.6929 553.8496 null] +/D [1591 0 R /XYZ 56.6929 500.3989 null] >> endobj 1615 0 obj << -/D [1594 0 R /XYZ 56.6929 527.1298 null] +/D [1591 0 R /XYZ 56.6929 492.5805 null] >> endobj 1616 0 obj << -/D [1594 0 R /XYZ 56.6929 522.1492 null] +/D [1591 0 R /XYZ 56.6929 467.136 null] >> endobj 1617 0 obj << -/D [1594 0 R /XYZ 56.6929 495.4294 null] +/D [1591 0 R /XYZ 56.6929 460.6924 null] >> endobj 1618 0 obj << -/D [1594 0 R /XYZ 56.6929 490.4487 null] +/D [1591 0 R /XYZ 56.6929 436.6227 null] >> endobj 1619 0 obj << -/D [1594 0 R /XYZ 56.6929 466.379 null] +/D [1591 0 R /XYZ 56.6929 428.8043 null] >> endobj 1620 0 obj << -/D [1594 0 R /XYZ 56.6929 458.7483 null] +/D [1591 0 R /XYZ 56.6929 414.0996 null] >> endobj 1621 0 obj << -/D [1594 0 R /XYZ 56.6929 444.0436 null] +/D [1591 0 R /XYZ 56.6929 408.8714 null] >> endobj 1622 0 obj << -/D [1594 0 R /XYZ 56.6929 439.0031 null] +/D [1591 0 R /XYZ 56.6929 382.1516 null] >> endobj 1623 0 obj << -/D [1594 0 R /XYZ 56.6929 413.5586 null] +/D [1591 0 R /XYZ 56.6929 376.9833 null] >> endobj 1624 0 obj << -/D [1594 0 R /XYZ 56.6929 407.3026 null] +/D [1591 0 R /XYZ 56.6929 350.2636 null] >> endobj 1625 0 obj << -/D [1594 0 R /XYZ 56.6929 346.1003 null] +/D [1591 0 R /XYZ 56.6929 345.0952 null] >> endobj 1626 0 obj << -/D [1594 0 R /XYZ 56.6929 346.1003 null] +/D [1591 0 R /XYZ 56.6929 321.0255 null] >> endobj 1627 0 obj << -/D [1594 0 R /XYZ 56.6929 346.1003 null] +/D [1591 0 R /XYZ 56.6929 313.2071 null] >> endobj 1628 0 obj << -/D [1594 0 R /XYZ 56.6929 338.5253 null] +/D [1591 0 R /XYZ 56.6929 298.5024 null] >> endobj 1629 0 obj << -/D [1594 0 R /XYZ 56.6929 323.7607 null] +/D [1591 0 R /XYZ 56.6929 293.2742 null] >> endobj 1630 0 obj << -/D [1594 0 R /XYZ 56.6929 318.7801 null] +/D [1591 0 R /XYZ 56.6929 267.8297 null] >> endobj 1631 0 obj << -/D [1594 0 R /XYZ 56.6929 304.0753 null] +/D [1591 0 R /XYZ 56.6929 261.3861 null] >> endobj 1632 0 obj << -/D [1594 0 R /XYZ 56.6929 299.0348 null] +/D [1591 0 R /XYZ 56.6929 199.468 null] >> endobj 1633 0 obj << -/D [1594 0 R /XYZ 56.6929 284.3301 null] +/D [1591 0 R /XYZ 56.6929 199.468 null] >> endobj 1634 0 obj << -/D [1594 0 R /XYZ 56.6929 279.2896 null] +/D [1591 0 R /XYZ 56.6929 199.468 null] >> endobj 1635 0 obj << -/D [1594 0 R /XYZ 56.6929 264.5848 null] +/D [1591 0 R /XYZ 56.6929 191.7053 null] >> endobj 1636 0 obj << -/D [1594 0 R /XYZ 56.6929 259.5443 null] +/D [1591 0 R /XYZ 56.6929 176.9408 null] >> endobj 1637 0 obj << -/D [1594 0 R /XYZ 56.6929 244.7797 null] +/D [1591 0 R /XYZ 56.6929 171.7724 null] >> endobj 1638 0 obj << -/D [1594 0 R /XYZ 56.6929 239.7991 null] +/D [1591 0 R /XYZ 56.6929 157.0677 null] >> endobj 1639 0 obj << -/D [1594 0 R /XYZ 56.6929 163.7723 null] +/D [1591 0 R /XYZ 56.6929 151.8395 null] >> endobj 1640 0 obj << -/D [1594 0 R /XYZ 56.6929 163.7723 null] +/D [1591 0 R /XYZ 56.6929 137.1348 null] >> endobj 1641 0 obj << -/D [1594 0 R /XYZ 56.6929 163.7723 null] +/D [1591 0 R /XYZ 56.6929 131.9066 null] >> endobj 1642 0 obj << -/D [1594 0 R /XYZ 56.6929 159.0666 null] +/D [1591 0 R /XYZ 56.6929 117.2018 null] >> endobj 1643 0 obj << -/D [1594 0 R /XYZ 56.6929 144.3618 null] +/D [1591 0 R /XYZ 56.6929 111.9736 null] >> endobj 1644 0 obj << -/D [1594 0 R /XYZ 56.6929 139.3213 null] +/D [1591 0 R /XYZ 56.6929 97.2091 null] >> endobj 1645 0 obj << -/D [1594 0 R /XYZ 56.6929 124.6166 null] +/D [1591 0 R /XYZ 56.6929 92.0407 null] >> endobj -1646 0 obj << -/D [1594 0 R /XYZ 56.6929 119.576 null] ->> endobj -1647 0 obj << -/D [1594 0 R /XYZ 56.6929 104.8115 null] +1590 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F47 879 0 R >> +/ProcSet [ /PDF /Text ] >> endobj 1648 0 obj << -/D [1594 0 R /XYZ 56.6929 99.8308 null] +/Length 2544 +/Filter /FlateDecode +>> +stream +xÚ¥ZKs㸾ûWè(U€ øÈM¶l&3¶#y²IÍî–`™ŠTHʳ³¿>
âA" ɦ|0 4ñýu7º›ÂxS‘$˜DIàQ„éd{¸B“=ÌÝ_a)3WBsSêúùê/w$š$^úáäùÕX+öP ãÉóîÛtñôtû°\ýs6÷)š.¼Ùœ"¤Fon7³y&|‚ð©M¯WןW÷ëÅÓlj‡~E- –âfóõþþvó|+o×·‹åêá Dðì·çOW·ÏúµÍaDø;ÿçêÛoh²ƒ ~ºB Ib:ù7ÈÃIâOW%
Q#ùÕæêïzAc¶}tLU”Ä ýhDW>ž`ì%”ú=eÑÄ ‰OZe- 6b[GV¥MVµuWÃ[\ Kˈ cd Žþm}wŠ"¿
11E^œÀû;@µÌ50MSêÅ¡&ì²<¤Y!öîY‘Õ
l¾¬j1Vvºhï÷§lÇ<þŽƒ-ázA ÆðB|ÝBü‹'þ.Xsjâ¡|g‡V‰;œÄ‘gU6çKr¨Ûr(\Ii•S9Tî‚6”>Ķ¨Ý¿)‡R*^[Þ2mRqu—åL\ݔůùû“àA ÞVÕ ÇSNÓ Ì HŸŠ§ö“©äãš±ªa‡TÎ=n›Ò #!V2ÂúªL);ZJ“‘`ßN†º#ã {œŒ ø(: ¤¹ôb÷g)ñ1õÂ8öû”,ieúÆ {©fñô”V?4#¡‘vNQ|CÊÁˆ’RŒø##.hƒ‘!¶…üLù7UÖ°*“îñZJc]—e##Jz ³aÕ;«êÑ(Åà‚qØçáZòð%-Š¬ØØî9Î?f”N³ß3fñ O 0Âhê„ ,I!M’I\ƒ£°…"ùk-Õ]¾ g‘giÍêS¬ù^Vÿî(ʶlœ£0ö"?ÆO’é!Ëåtš¤µœþ…ûQ•íß A‘‚ì%sŸ$ ¥WÌ߃V¸*Àæ +i‡Ù L‚™‡&7;kž@£Ä‹¾)˜RvÖµ”¦=ö©v'tÇûö8ñ=ðì< §Ï3Œ10°Ï[½„(ßGSöò×ÙœþtU×§Ö +`¦µxf…ã‡âR+¦[%òñHQ +ͳpUÉç[BX#îŽ"â6å¶ÌÇ¢.ñ¡Ä<`µ¸ëj¤uk“¹–Ÿ Ó†¾L3Ø¢2ÃTÆd !dõuD^Fhï„ ¬K!E: G@vᜀ-”È?1’ÐŽCHGh‡Å.ŽÇ<ÛêôFx5±Z>,TÉ0<& `&„ÁC] +/ ¦”O-ÕñI É£ºãó {œÏ øB÷FßYѵEï”Kɬ`à|*û㽜ÚÑ]9+áU}ŒÖÛtÙî&6Fãà/ƒ)¤Sz9j8®AÊ +§ý©n4‰•%ˆtÓ`ÙYPBÝ'©ÈQG»p;†Àã˜ÈÂÉb §áY…Hvà¾)ù³¸†A•áÊ8åÀ~/öê»~¬¼VY³âÄ-}¼'`(ŠÌ¦Gœºâ>]ݲòÜ”öÜêF}î<eÆï4>òŸùüÄÓ +2jëHøÿûYF2òHlë¹B¦žDê¥øæ2|sýËóWÿ/§÷Áendstream +endobj +1647 0 obj << +/Type /Page +/Contents 1648 0 R +/Resources 1646 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 1589 0 R >> endobj 1649 0 obj << -/D [1594 0 R /XYZ 56.6929 85.0662 null] +/D [1647 0 R /XYZ 85.0394 794.5015 null] >> endobj 1650 0 obj << -/D [1594 0 R /XYZ 56.6929 80.0855 null] +/D [1647 0 R /XYZ 85.0394 748.4854 null] >> endobj -1593 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F47 874 0 R /F21 654 0 R >> -/ProcSet [ /PDF /Text ] +1651 0 obj << +/D [1647 0 R /XYZ 85.0394 748.4854 null] >> endobj -1653 0 obj << -/Length 2728 -/Filter /FlateDecode ->> -stream -xÚÝZ[w£8~ϯð#>§Í" q™7'N§Ó—$k§wv¶§ ˆM ÎbðNoæ×O ]‰ÞÝ·=~0H%}P_U©TÍ<ø¡YD]Äþ,Œ}—zˆÎ¶‡ o¶‡¾› $dRh¡K]>^üå= g±8˜=>ksE®Ehö¸ûæ, ®ïV·Ÿ/0õœ¥;_PÏ“W×›ù" bÖAXWà9—·—ŸoïoÖˇ¿ñA¿{Ô[ÞøÍæëÍÍõæñZÜ®¯—«Û»Aóï /® Õc믆<žù_ß¾{³ ¼áÇ Ï%qDg?àÆsQ ãÙá§ĥ>!²%¿Ø\üUM¨õ¶CÇTEIäÒ‡#ºÂh†SŠ{Ê¢±LZeÝMZI“•E’g¤;þ’«òd¿¾Kim|Uâ»~ngQ“âOFÆX”RìÁ¾ß_áÓïCdD=7ŠáÕ¬ÐJê Û×-QêF!¡}ð%¼y8s„“û¼ÕK:¿Î±ç¤O¿ÌÄÇÎm]Ÿ@5mOùÌÇÜ¢èî ¿TJ„îV‰¬=ô` h^RÞ{W•ß’6üîXÍQä”M¹-ó–ƒêŽ]Ï‹Á@Úç -|ëvÿT—yÚ¤4°´Ã1O°ÈòÄõ¿á3Ö"_‘…“- KýTªKYlAJiû\ËÒh…Ölaˆm° œÛœë®²wmô„ÿ›´ÜWÉñœ4ç-Ÿ-ù€ÝˆÒX¯`#çÊåß'§9ÏEÏ—¶‡:›íË)ÿ#!ÿ§YS€€w‹.Î%ô„ ì we‘½‰¨Äï9ø°ÃÆhÆŸJKu)3ÅJJe?Ah)eX¡;ŠÏ°Ç)î_f…Z¶>'O©,idg+íè–OÔ© Û½Øû ÿE«äÇ3/díd08íOu£xˆÍ<¾‹Ã©,T—²ð ¥ºÄÐRé°Bk< ±
<èàÜÕ"a§a¹Oyà¾)Ù¿^F›áJ[EÃ~Ïö‰Hf#é0Ë:-NÌÞÇ+%Äó\/ õÊTsÒ¢>iÝ´bõûçF‚í§ Œ$‘9Ô) žžÅîTI|4¨%‹Ð½ÔÚ6éöyÆÛtUÅÈ¥áT5R—2›Ž’R¦ã–Jº33ìqÓéKÏô±ôLH£U™µvb=š…¯Ôaj5? mHm‡B6–'ÿœ#§M¡`ïO¤=0œÖÌØÅ•ÿ”œÄq#›åcR´92ÇhX0zP -€gÙTZ¡5&†Ø&tpU"Yâ„+u6Æ®$ -ÛsOX6×WíÉ'—Èö?ƒ¹'}ÛñƒS’X#ÊÇعtùÀ¶ -É)ÌÔ”m<äK ùá˜ßûPÆúIL ¯:õiD'c&LÈttÙ>†±€vd
PÇ©Ò`
k±ò ‘õåI•±Ï ¶IWg“ÿÿ( éiMÒœFk2(„,vt=_ºveqîGVOÍõ˜0„,,˜Hë5!ËgIB¨û\Ávv`ÃÕ>J -¿á3Eân„ãP>{ø˜ Ÿ\}ŽyþèpnØMendstream -endobj 1652 0 obj << -/Type /Page -/Contents 1653 0 R -/Resources 1651 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 1592 0 R +/D [1647 0 R /XYZ 85.0394 748.4854 null] +>> endobj +1653 0 obj << +/D [1647 0 R /XYZ 85.0394 743.3452 null] >> endobj 1654 0 obj << -/D [1652 0 R /XYZ 85.0394 794.5015 null] +/D [1647 0 R /XYZ 85.0394 728.6405 null] >> endobj 1655 0 obj << -/D [1652 0 R /XYZ 85.0394 752.341 null] +/D [1647 0 R /XYZ 85.0394 723.1655 null] >> endobj 1656 0 obj << -/D [1652 0 R /XYZ 85.0394 752.341 null] +/D [1647 0 R /XYZ 85.0394 708.4607 null] >> endobj 1657 0 obj << -/D [1652 0 R /XYZ 85.0394 752.341 null] +/D [1647 0 R /XYZ 85.0394 702.9857 null] >> endobj 1658 0 obj << -/D [1652 0 R /XYZ 85.0394 746.4344 null] +/D [1647 0 R /XYZ 85.0394 688.2211 null] >> endobj 1659 0 obj << -/D [1652 0 R /XYZ 85.0394 719.7147 null] +/D [1647 0 R /XYZ 85.0394 682.8059 null] >> endobj 1660 0 obj << -/D [1652 0 R /XYZ 85.0394 716.4024 null] +/D [1647 0 R /XYZ 85.0394 668.0414 null] >> endobj 1661 0 obj << -/D [1652 0 R /XYZ 85.0394 690.9579 null] +/D [1647 0 R /XYZ 85.0394 662.6262 null] >> endobj 1662 0 obj << -/D [1652 0 R /XYZ 85.0394 686.3704 null] +/D [1647 0 R /XYZ 85.0394 599.7666 null] >> endobj 1663 0 obj << -/D [1652 0 R /XYZ 85.0394 660.9259 null] +/D [1647 0 R /XYZ 85.0394 599.7666 null] >> endobj 1664 0 obj << -/D [1652 0 R /XYZ 85.0394 656.3385 null] +/D [1647 0 R /XYZ 85.0394 599.7666 null] >> endobj 1665 0 obj << -/D [1652 0 R /XYZ 85.0394 589.5443 null] +/D [1647 0 R /XYZ 85.0394 591.7571 null] >> endobj 1666 0 obj << -/D [1652 0 R /XYZ 85.0394 589.5443 null] +/D [1647 0 R /XYZ 85.0394 565.0374 null] >> endobj 1667 0 obj << -/D [1652 0 R /XYZ 85.0394 589.5443 null] +/D [1647 0 R /XYZ 85.0394 559.6222 null] >> endobj 1668 0 obj << -/D [1652 0 R /XYZ 85.0394 583.6377 null] +/D [1647 0 R /XYZ 85.0394 534.1777 null] >> endobj 1669 0 obj << -/D [1652 0 R /XYZ 85.0394 559.568 null] +/D [1647 0 R /XYZ 85.0394 527.4872 null] >> endobj 1670 0 obj << -/D [1652 0 R /XYZ 85.0394 553.6057 null] +/D [1647 0 R /XYZ 85.0394 502.0427 null] >> endobj 1671 0 obj << -/D [1652 0 R /XYZ 85.0394 538.901 null] +/D [1647 0 R /XYZ 85.0394 495.3523 null] >> endobj 1672 0 obj << -/D [1652 0 R /XYZ 85.0394 535.5289 null] +/D [1647 0 R /XYZ 85.0394 420.5376 null] >> endobj 1673 0 obj << -/D [1652 0 R /XYZ 85.0394 520.7643 null] +/D [1647 0 R /XYZ 85.0394 420.5376 null] >> endobj 1674 0 obj << -/D [1652 0 R /XYZ 85.0394 517.4521 null] +/D [1647 0 R /XYZ 85.0394 420.5376 null] >> endobj 1675 0 obj << -/D [1652 0 R /XYZ 85.0394 502.6875 null] +/D [1647 0 R /XYZ 85.0394 412.5281 null] >> endobj 1676 0 obj << -/D [1652 0 R /XYZ 85.0394 499.3753 null] +/D [1647 0 R /XYZ 85.0394 388.4584 null] >> endobj 1677 0 obj << -/D [1652 0 R /XYZ 85.0394 475.3056 null] +/D [1647 0 R /XYZ 85.0394 380.3932 null] >> endobj 1678 0 obj << -/D [1652 0 R /XYZ 85.0394 469.3433 null] +/D [1647 0 R /XYZ 85.0394 365.6884 null] >> endobj 1679 0 obj << -/D [1652 0 R /XYZ 85.0394 454.5787 null] +/D [1647 0 R /XYZ 85.0394 360.2134 null] >> endobj 1680 0 obj << -/D [1652 0 R /XYZ 85.0394 436.5019 null] +/D [1647 0 R /XYZ 85.0394 345.4488 null] >> endobj 1681 0 obj << -/D [1652 0 R /XYZ 85.0394 433.1897 null] +/D [1647 0 R /XYZ 85.0394 340.0336 null] >> endobj 1682 0 obj << -/D [1652 0 R /XYZ 85.0394 418.4251 null] +/D [1647 0 R /XYZ 85.0394 325.269 null] >> endobj 1683 0 obj << -/D [1652 0 R /XYZ 85.0394 415.1128 null] +/D [1647 0 R /XYZ 85.0394 319.8539 null] >> endobj 1684 0 obj << -/D [1652 0 R /XYZ 85.0394 391.0431 null] +/D [1647 0 R /XYZ 85.0394 295.7842 null] >> endobj 1685 0 obj << -/D [1652 0 R /XYZ 85.0394 385.0808 null] +/D [1647 0 R /XYZ 85.0394 287.7189 null] >> endobj 1686 0 obj << -/D [1652 0 R /XYZ 85.0394 327.3726 null] +/D [1647 0 R /XYZ 85.0394 272.9543 null] >> endobj 1687 0 obj << -/D [1652 0 R /XYZ 85.0394 327.3726 null] +/D [1647 0 R /XYZ 85.0394 267.5392 null] >> endobj 1688 0 obj << -/D [1652 0 R /XYZ 85.0394 327.3726 null] +/D [1647 0 R /XYZ 85.0394 252.7746 null] >> endobj 1689 0 obj << -/D [1652 0 R /XYZ 85.0394 324.3353 null] +/D [1647 0 R /XYZ 85.0394 247.3594 null] >> endobj 1690 0 obj << -/D [1652 0 R /XYZ 85.0394 300.2656 null] +/D [1647 0 R /XYZ 85.0394 223.2897 null] >> endobj 1691 0 obj << -/D [1652 0 R /XYZ 85.0394 294.3033 null] +/D [1647 0 R /XYZ 85.0394 215.2245 null] >> endobj 1692 0 obj << -/D [1652 0 R /XYZ 85.0394 279.5387 null] +/D [1647 0 R /XYZ 85.0394 149.4956 null] >> endobj 1693 0 obj << -/D [1652 0 R /XYZ 85.0394 276.2265 null] +/D [1647 0 R /XYZ 85.0394 149.4956 null] >> endobj 1694 0 obj << -/D [1652 0 R /XYZ 85.0394 206.4674 null] +/D [1647 0 R /XYZ 85.0394 149.4956 null] >> endobj 1695 0 obj << -/D [1652 0 R /XYZ 85.0394 206.4674 null] +/D [1647 0 R /XYZ 85.0394 144.3554 null] >> endobj 1696 0 obj << -/D [1652 0 R /XYZ 85.0394 206.4674 null] +/D [1647 0 R /XYZ 85.0394 120.2857 null] >> endobj 1697 0 obj << -/D [1652 0 R /XYZ 85.0394 203.5257 null] +/D [1647 0 R /XYZ 85.0394 112.2205 null] >> endobj 1698 0 obj << -/D [1652 0 R /XYZ 85.0394 179.456 null] +/D [1647 0 R /XYZ 85.0394 97.4559 null] >> endobj 1699 0 obj << -/D [1652 0 R /XYZ 85.0394 173.4937 null] ->> endobj -1700 0 obj << -/D [1652 0 R /XYZ 85.0394 158.7292 null] +/D [1647 0 R /XYZ 85.0394 92.0407 null] >> endobj -1701 0 obj << -/D [1652 0 R /XYZ 85.0394 155.4169 null] +1646 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F47 879 0 R >> +/ProcSet [ /PDF /Text ] >> endobj 1702 0 obj << -/D [1652 0 R /XYZ 85.0394 140.7122 null] +/Length 2122 +/Filter /FlateDecode +>> +stream +xÚ¥YKs㸾ûWèª*Bðà37ÙÒ8žñÚŽåd33š‚%–)R+RžÑþú4Ð J$µ•”n ?ôQø±‘ç?âÑ(ˆ\âQæ’Í `ìöŠžIÍ4±¹®_®þöI£ˆD>÷G/o–¬Ð0d£—åWgJƒê\ß]ßß=Þ>OŸþñÛxÂ=ê|£ >Ì°³øõöv¾x™›îó|:»{¸6ž~DéÓÓüav÷o Ÿ*©´¡ÞÌãï/Ÿ¯æ/Ͳí1*Ôš¿úúŽ–°ÃÏW”ˆ(ôF? C ‹">Ú\¹ž ž+DMÉ®WÿlZ£zj§©%\ø¼ÃVœ#‘çñ–±¼ˆø‚ m¬ÇײÈd%—¸ÇÙÃÂØF&û]Z Œi>Ý”½›.4htG‹ ×&ºp¬¹ÔÒ¾‚VN}ïû©fÆ9XÅ †U7\çº]û 1 mݳb§ùxârê<Ä©ZÌY ÊJnz4™ÿ¬d^¦E®Ít²;R„ëR²ÿ +S|á̈™—U¿Ë1Ã×»1 %ê‰sÓ¸1ü_âýÛ&ΔÏq¾w¥¶\+š4°ƒ>8WéEº$Ä£: +‰"ïÀà—Xw“uƒCÔƒ ’Hò’Í5€CÍUã (
pRmápª»[wƒCƒƒjÕ8èvƒƒ'!,æ7˜5GºÊÓ|…é¾Zšÿ 'î3HW‘î8w® Nü×8âŽÌ2T:Šqá< ró*wÆêù(Æ)¥ý˜‰ˆP7º„™Å5€YÍuÄ,¢˜
©¶0;ÕÝ™»'7.‚Ý›,Þ¥ß(åI\5ÄúûŸ"¯]®Š«}—Sqð°íUsãU÷òGZv; +p¹™Ll«ežúï…ÔƒÈyx¡Î³¹ú!m¸H}o +ÌWP%ºQ…A=-Í@Rà:Mb;4ظýØp¸` ØX\ØÔ\6—¥AÕ6§º»±±u7õ¹[×…ªÕÔçÐÖL5LI}ãE@;ñ"M1^df/B±öå úó¼Ú °ùT¤yuœµ˜? §}ÊâUÎ.» |±ZÇĆڊ‰µs~)²w¼;«ÞgC]$ëìPµŽ„Ž¾}…u£<1PÈ/¼t“°¹úOLÃÕœ˜p¨T}<1gº;OLKwOUzzaÐ>ù³BëB®ø Z\ϳéØóœå™S$}*v›¸3ú°ò»mç Àqº_íËê«Ó‡±‰€á2 ª!áA¹Gýæ ‘' . Î]rsi$Ívñ[ÕULSHÊ.D æj ֬ЫgA ¾»Yi¬ +ë˜èÊÿ€\åºØg†ªµªÆ«ÄïïûßUQg5 %©!¹Ú>Zcn„½©SŸ!Ñƺû<3þ$)6“.|¶qžjéŒ:¯ü≀Æ2-“,N7:‡ê¸jX óñBçç®:s%võrá‹(+d-K¢øpuüa„ÄøÉÒ7YÂò°§O+|Ëô'66E^Í\8ïõ¬S¸lvlԬسW ¥´^²“©¶~Ö3¯f*IM=ëÇŒ²38Ðó LPxuµbá¥ÂÎk±7±âúîav”ëB±ê7r)‰X}y“;åF½Ïì<„RïÂõËæ:O&° lâ(LgÖŸGµ óÈ™ÚÎ<ÒÒŠy„zƨo[Ê^´5Vć9Oñ>ÃIÓ .\œHºSá¤É»ŽÐ¿O÷j"s¡âÜ véj“ˈ!lÀ
Õß+Ô¼ '¸ˆàÇ%L8 üöiñ}£Ìëº pØbXWŸ,ŠB\ÛB¾ÆeUl M ÈÞLÿŽ#y†‚43OøÜSºN®tM52…kE’ÂY.{‹8¬ê£¼hs¬ÿïÿ¥¬ê% "컊p°¯‚³(µ—È=[yýÖùÒÿ š`£endstream +endobj +1701 0 obj << +/Type /Page +/Contents 1702 0 R +/Resources 1700 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 1589 0 R >> endobj 1703 0 obj << -/D [1652 0 R /XYZ 85.0394 137.3401 null] +/D [1701 0 R /XYZ 56.6929 794.5015 null] >> endobj 1704 0 obj << -/D [1652 0 R /XYZ 85.0394 113.2704 null] +/D [1701 0 R /XYZ 56.6929 749.4437 null] >> endobj 1705 0 obj << -/D [1652 0 R /XYZ 85.0394 107.3081 null] +/D [1701 0 R /XYZ 56.6929 749.4437 null] >> endobj 1706 0 obj << -/D [1652 0 R /XYZ 85.0394 92.6034 null] +/D [1701 0 R /XYZ 56.6929 749.4437 null] >> endobj 1707 0 obj << -/D [1652 0 R /XYZ 85.0394 89.2313 null] +/D [1701 0 R /XYZ 56.6929 746.6461 null] >> endobj -1651 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F47 874 0 R >> -/ProcSet [ /PDF /Text ] +1708 0 obj << +/D [1701 0 R /XYZ 56.6929 722.5763 null] >> endobj -1710 0 obj << -/Length 1567 -/Filter /FlateDecode ->> -stream -xÚ¥XKsâ8¾ó+|[S5h%[~í’e&K²ÀÖîÔdÆPÅÛÉ°¿~[ÆIÕ·¤~©¿n©10üˆá¸È
¬ÀðŠ L #JzØØÀÚ}hžAÅ4hrÝ,z¿ÞÙž Àµ\c±nèòö}b,VßÌ!²Q 4`ófró0y¼Ÿ
Ÿ~ÿÚ X6Ÿ±ƒ‡Ó‘Ìÿº¿ Ïc=œ‡£Éô XHà¹6‡OOãéhòZ -¸ž½ Ïûߟ{ãEívskÛÂç ½oß±±‚ ~îad¾c¼Á -»ÍH5vá@õíƉ2Oa+¡a Ï®Ï4ÝBV˜<z‘ç Œ x) …ŽswØóÍV^.ñ|Ø -endobj 1709 0 obj << -/Type /Page -/Contents 1710 0 R -/Resources 1708 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 1592 0 R +/D [1701 0 R /XYZ 56.6929 716.7581 null] +>> endobj +1710 0 obj << +/D [1701 0 R /XYZ 56.6929 701.9936 null] >> endobj 1711 0 obj << -/D [1709 0 R /XYZ 56.6929 794.5015 null] +/D [1701 0 R /XYZ 56.6929 698.8254 null] >> endobj 1712 0 obj << -/D [1709 0 R /XYZ 56.6929 769.5949 null] +/D [1701 0 R /XYZ 56.6929 684.1207 null] >> endobj 1713 0 obj << -/D [1709 0 R /XYZ 56.6929 771.5874 null] +/D [1701 0 R /XYZ 56.6929 680.8926 null] >> endobj 1714 0 obj << -/D [1709 0 R /XYZ 56.6929 747.5177 null] +/D [1701 0 R /XYZ 56.6929 656.8229 null] >> endobj 1715 0 obj << -/D [1709 0 R /XYZ 56.6929 741.6995 null] +/D [1701 0 R /XYZ 56.6929 651.0047 null] >> endobj 1716 0 obj << -/D [1709 0 R /XYZ 56.6929 726.9948 null] +/D [1701 0 R /XYZ 56.6929 636.3 null] >> endobj 1717 0 obj << -/D [1709 0 R /XYZ 56.6929 723.7668 null] +/D [1701 0 R /XYZ 56.6929 633.072 null] >> endobj 1718 0 obj << -/D [1709 0 R /XYZ 56.6929 709.0022 null] +/D [1701 0 R /XYZ 56.6929 609.0023 null] >> endobj 1719 0 obj << -/D [1709 0 R /XYZ 56.6929 705.834 null] +/D [1701 0 R /XYZ 56.6929 603.184 null] >> endobj 1720 0 obj << -/D [1709 0 R /XYZ 56.6929 679.1143 null] +/D [1701 0 R /XYZ 56.6929 579.1143 null] >> endobj 1721 0 obj << -/D [1709 0 R /XYZ 56.6929 675.9461 null] ->> endobj -594 0 obj << -/D [1709 0 R /XYZ 56.6929 645.9962 null] +/D [1701 0 R /XYZ 56.6929 573.2961 null] >> endobj 1722 0 obj << -/D [1709 0 R /XYZ 56.6929 621.6566 null] ->> endobj -598 0 obj << -/D [1709 0 R /XYZ 56.6929 538.1235 null] +/D [1701 0 R /XYZ 56.6929 558.5914 null] >> endobj 1723 0 obj << -/D [1709 0 R /XYZ 56.6929 513.7839 null] +/D [1701 0 R /XYZ 56.6929 555.3634 null] >> endobj 1724 0 obj << -/D [1709 0 R /XYZ 56.6929 479.0839 null] +/D [1701 0 R /XYZ 56.6929 540.5988 null] >> endobj 1725 0 obj << -/D [1709 0 R /XYZ 56.6929 479.0839 null] +/D [1701 0 R /XYZ 56.6929 537.4306 null] >> endobj 1726 0 obj << -/D [1709 0 R /XYZ 56.6929 479.0839 null] +/D [1701 0 R /XYZ 56.6929 510.7109 null] >> endobj 1727 0 obj << -/D [1709 0 R /XYZ 56.6929 479.0839 null] ->> endobj -1708 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F47 874 0 R /F21 654 0 R /F14 681 0 R >> -/ProcSet [ /PDF /Text ] +/D [1701 0 R /XYZ 56.6929 507.5427 null] >> endobj -1730 0 obj << -/Length 1914 -/Filter /FlateDecode ->> -stream -xÚµXKÛ6¾çWh^ bøE©§æÕf dS4[ôìAkÓ¶YR%y7FÑÿÞ)[^9FQ ¬ÉáðãpÞ”˜qø³T3®²xf²˜i.ôl±}ÆgkXûù™ð<±VLÇJÁdb5Ò*e:•f ƒ¼º}öâ')f’³$‘zv»ÎJŒa<›Ý.?Í_6–Å׫Hj>uuwû 튙IÀ] N0,Q:q;ÞçÕ./‰¿É׶öˆ˜©8‘~O¢YÂuêö¼bâ*œóù²X#?2(ÃT’7ùÖz 5ËX–ÈÄÃ(ÁT -2#nvç~–ÒÐèÍÍG”uýe×Ðx×eÑï‚ –i ‹“© Ë|ÜWuÓîÏÞÞ:M8 -4‹„ ©)½ SêøŒQRÎàö;@8›¨ìè†Á$×pÏ´õéÇ涽óÓèžî¤•$¸a:K4œ‹›óå²µ·Êè,¸x+áùÌŦÒ,Mt€\”ù$ ÌXššìpupU”¶L>Ò°TrsŠùåÀl&0#…¾®Ót
^{šºí¿;§ôøϋžT*– ®Nñú‹xý¾ùx_/â¡MáÅL&O콿÷i³Í?Üáøb÷ÈgqÆ“Sèx%w.oD -3ÅåØ>Ÿ:ð¢2Âعn˜ü¹³í¾nzÆØݹˆWF²ØˆÿñÇç#~àG|´9/š–,É”ù/¢ A|C´À5m]Ö÷y´ 9h6¨õBÎ}óöãëß®½½þp3pR¾Ä‡”ÿ´.( ŠGüÌ5_ÖÛ¼¨ ýÇ|^T«ºÝæ}Q#Aeóu{%ÒyÝØX…gêh-§égΕýZÜ—–È}]—´X¶·-!¼Z'U Xw1íH”´;v)næ×=Qáx”«#nÜæ :ÜeäÏTÍ€U ±ZÂ@bñìš2ß{r¿±DÎ«îŽ Ô¼÷Ûœ¬ž‡Æý®ì’–Wt•í ÝIt TnGjÃå< ða†PØ%\YÃì}Ýõ¡Ì _ËéJ%ò˶¨Š+1ïú6ïk'<wp I6Ô™3.=JBŽïkìé’;°k·©k=á1Z†ÕmGK÷v‘£n¹^ÑoÑûÕà%Ô^€\óç°‚òÓ= „;ë‘¡g¤ jk‹`®qÁÍîw×7» ýGðù°Mû´ÉAíüТ‡‘~7ùƒõ[°p£Õ®Z`Läåp X³šP¸Âl¢µù¶Âc–Å*Ô>²sÌÒ,ÓpÇŒc(â_–ý¦Þ7GÅúL¥.™VB¦ô<¸JÉy…1^–{œ9u/‰þXô¢-êí´ •EeiBb½ÛÚªïÐtZ‚q‰;/»š¸6yçI4¿Ïû…‡ÜÖKå쌿֔jœ’R(Çn?¤Š˜|IÉ#>2(äZ„@êzŸ#!Š³C¦’¥u¹%™¿$Ú=ÄÞŠ†Ý.ÝîiR{¢s`<c¬‡z¬OrÞ„Û¼X7$̉ˆnZL‹Èo %l,fÜ”»tò´È›Œi{;F›i§2*“ž…Î'l—¯y]<Ø -oŸ¥óß«²øb‰nó¶,\œ -Få–¨eÑ‘?â-« 'Z3!EhM_Ø~ñ LuùrX -ï$!ObxQW« ¹©ÃŽÇY0Gêÿƒ‚,TÕgÌF£ÓˆÄzàóÿ! >¿É…Ås{íáûœZÏï/æ`a z zXÇ ÿù)ÿÁËÈ÷ê ›IsN’’S% M]ç;* :Çjg=[C
D©»¥¥¥]å £PÍ€I î æ;ëM ÏBmz(ò)?€· 0ßÿõîÃû·¿`€×.&SÅ’4‘ƒ¡´«ùí&\•’òñõÓ!ÙÈyµ'ÊÁ˜¸É×™Å,RÏ…ë©É󦌷 ÙÕuX<Ÿ&œlÒš·®#„s}C¿Ô†Âàõ;ú¥Ï®ÇÅ\е†X,ó†&¾Ã¨¿××
•öÁ–D£¶Þ#»C@õ±Iço êŠN–?câõxÐÛ…×ôȼÑÀ4Ò»ïÝN='c"‘Á»¢Åt “zHyK+Ÿß¡•pétµ÷DÊe‚ òŽDFÃ6†ÔŒ4¦Ê7—aßÄ3ÃCN¯ïð=bB >?–J ¨Ãë -ˆ!íOHƒ‰ãú&äl Bï+Ý‹’§ã*ˆŒ¯ß å›Ç!GbI¤. ¿ç5ƒSwÁ¿ë&ô·ÎYpè…¾ŸÏZ† Q' Èž%:ðÐ÷ÓÑ7
ž°Tf& -endobj -1729 0 obj << -/Type /Page -/Contents 1730 0 R -/Resources 1728 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 1592 0 R +598 0 obj << +/D [1701 0 R /XYZ 56.6929 477.5928 null] >> endobj -1731 0 obj << -/D [1729 0 R /XYZ 85.0394 794.5015 null] +1728 0 obj << +/D [1701 0 R /XYZ 56.6929 453.2532 null] >> endobj 602 0 obj << -/D [1729 0 R /XYZ 85.0394 769.5949 null] ->> endobj -1732 0 obj << -/D [1729 0 R /XYZ 85.0394 573.0107 null] +/D [1701 0 R /XYZ 56.6929 369.7201 null] >> endobj -606 0 obj << -/D [1729 0 R /XYZ 85.0394 573.0107 null] +1729 0 obj << +/D [1701 0 R /XYZ 56.6929 345.3805 null] >> endobj -1733 0 obj << -/D [1729 0 R /XYZ 85.0394 538.4209 null] +1730 0 obj << +/D [1701 0 R /XYZ 56.6929 310.6805 null] >> endobj -1734 0 obj << -/D [1729 0 R /XYZ 85.0394 504.6118 null] +1731 0 obj << +/D [1701 0 R /XYZ 56.6929 310.6805 null] >> endobj -1735 0 obj << -/D [1729 0 R /XYZ 85.0394 432.7569 null] +1732 0 obj << +/D [1701 0 R /XYZ 56.6929 310.6805 null] >> endobj -1736 0 obj << -/D [1729 0 R /XYZ 85.0394 303.3232 null] +1733 0 obj << +/D [1701 0 R /XYZ 56.6929 310.6805 null] >> endobj -1728 0 obj << -/Font << /F21 654 0 R /F23 678 0 R /F39 858 0 R /F53 957 0 R >> +1700 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F47 879 0 R /F14 685 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1739 0 obj << -/Length 3967 +1736 0 obj << +/Length 1917 /Filter /FlateDecode >> stream -xÚÍZësÛ6ÿî¿Â3ýPe&b$ÀÞcÎy4q§qr±;×N{ h‰¶8‘HE¤ìúþúÛÅ. R‚¢tîËÅ3!´x/öñÛä¹€?yžåI^¤Å¹)t’ ™ÏVgâü êÞœIn3õ¦ÃV/nξûA™ó")ò4?¿¹Œea<¿™ÿ6y‘ÈäŒ &¯.ß<›¦y&ÒÉŇ¯¯^]þ¿3M “wW?_üD´Ï -höæõõ³ßüxöú&,f¸`)®äóÙoÿçsX÷g"Q…ÍÎ á‡HdQ¤ç«3©$ÓJyÊòìúìŸaÀAëe€Iªò4ÂTžK™Y–ŽXI®RåXp}ùîÃO¯i_?_æpOÐS
x'Ρ:Qyn\— jÝ?ëY¹¤ uóÐÎʾnúÝÞñ8r0°$†nœy} ™LšD+q›eÛ~êhÈeý©úž:¨bÐa*¥Nt¼›J›¤ð/Œ>ÍáäþÑU›‡jC?šrUQ –_E¦ŸfIaL> ëqý¥Ðü£—‰‘2?Þ$¹VöÈ Q£é°•; m#"ZáÔ¼ø½i‹4É2«¿<ot8íhÇ…I2U˜ñ´52Ý—À®ÔÌ8$µú^~ šr>'ætÜÎþX_Hí[¢}ÞV›§gRÊ ¨š*ŠÉÍÂÏ>+j{ËýÝo7÷ƒ>2{ÍMæmßWó)rNU ”¯(!Õ¬^9¶jÒ´½_øE{T<ŸÂùr¦ŒçS<ŸšÌÚeÛLçÕ²^Õ0ñxTØ™Åä_‹Š[o Ðm×ëe
í(fÃQÆ$¶0’Ua' {¨l’[]p³Ò-÷ežd6웬ÞývU5=ë-+WIŸEÛõxZÏ£Ú bldqZ{•_2sª]>T<O¿(yf -(ÁáÊÉ]K‰äd¢nîwbní¤F‚HÜq“6ÂÊLž@m>ÍJ•Ržfe:f¥¶ÄJø®]¯ö¡žWó ™ØL§'Ù(óœÛÌÚ¦Û.û.bü`Ám?5ü®êgßm ÃètÜ ØK@e3§E#ÃëŠw@©ƒâ‰8Æõ˺# §¶tp ±)Õy"S)Ç|ºYð±QÛõò‰~Þ¯Vþœ«#Ǽ',W붙wc9ž×ÝzY>Uó䘥Î,x?™/[êa«ã–:´Â=ºEïMjE’ pß_œÔ7:œttr6ùÓùxÒº;ʺön¯ÊkãÖf#êŒÔo¾Ïé0~t•œ1øåŠ[o×Ç™
z§Á8`ö Õ˜í[á¾½÷Ž2ûK“?iœÙÃIëfˆ§wjRH@ŽKPr«q%Çtø’SsÅš›£?ok*̉ú{š, ¼úÕyÁçTqÁßw¿páúò
—@Ë“˜‘+@õ¤ðÆàÀIóÄJ¡½iq Ƽå
”
/û¡\Öóáfœz+è^ˆ, «7Nõ5fXö–…:¹@-äÈÇ<–wœQk«ü8ó±^2’]WðE«‘[Diß®ÙdµlŽJ†º1=Jª -·¼žn
°õw£Ð‚¸Š'ª(×ë - Tã„ Eg¸-œñâ´ i -–üü5r&1ÚúnY‡ƒ@¨RíáßOâ¸B˜JƒŒC-B -<yuWèÁ¨¼’ôÙ²tG -ÅßE&.¯¨Lj MݱÀAA¥¤ªš›·€$6õ|î08üFÆa>ªVÐ")dêw5Åõ*×éX¯b–Y餰ÂÃJÚA|B¼f2o™ýªÉ Ã2½p{ 30ØÁÙ‚ms¦ÀþK3>ù’íåÛë=ûõ¶êêv 3^ÜÃ7|ùv¯ç˷ﯯ^ßDû&AüöN5j¹ -£½;˜Æà*Ì4 ¸Ý[.ˆ0@1>U]Äöç -PEqÂöÃÒt8L>xu¶æáoË øJ3µs®$Uó®¼tÊæ%~„ÆD 3"ƒçØõQîúŽ(ˆªðË!ÃÌ+$\LÑ+ø*isµçtISôÁ²Š‰] -bç¥ó®^V ¢î›[ˆ3SaæÖj¯ˆax'lTôe
áZÓ¡¤O³]¹(nC?g€/ì‰X °Z錯«YS@ËšŠg|]"ǑΞÔ=£ðH¼Ûl° =éív9'ú-›u - !g(=¢Íå:.=ÂD°î{Ë
×ìb`½~X§nðÝT8NÔÔ°MÕÉx:Ú Í¶£˜x¸ìY»ZA7EFú±câL p»0›WIJü!PS ðZ3íz¨ô -–ÁMÐþQôAåGÖ)Æ øÝ’Ö(:r÷#ÆƉ75v:_Ç/¼sº*FÓ`aPÃï·»(i~ºÌC³çŽv¼B§ÕŒû¡X;ŒO|Ázâ‹K#ý¿eŠpŽS ÷[¤پKå]³¸óÌa‚É>ê¼D.½v8 „aÛs*X‚â%I±ÄðIÉtÒoʦÃýcJÒ%[£;4)º„ -¼aíô¸š\íË( YóÐ!ÿNËi¹–3=ô«¤Y$Lƒ2À 0Þƒi +xÚµX[Ûº~ϯ0Ð>hˆáE¤¤óÔÜÚì²)š-úìƒÖ¦m!²¤#É»1Šþ÷ÎpHÙòÊÇ(ŠÖäpøq8wJ,8ü‰E¦Wy²Hó„i.ôb¹{ÅXûÛ+áy˜N”‚ÉÌj¬UÆt&ÓE| +òîþÕ›¿J±œ#õâ~=žeÒ”ñ|q¿ú½m[[¯ÊŸ7±Ô<zwópÿ+íJXš¥wq8!eFiãv|.ê}Q[ll?î S‰‘~ÑÌp¹=‰ç<Z•äG•2e ‰qWì¬ÇQ‹œåF£SÈŒ\¸Ùû]Ê”F î¾Ò jš û–Æû¡¬ÊápL°\ë X"˜Ì]æë¡nÚ¾twxõñ~Ô©áL(Ðh" :Wsz §ÔÉ£dœÁí w„p6QùÉ
ƒIF®ñž´õí/½ížl÷à§ñ#ÝIŸ*Ið”éÜh87«Ug{o•ÉYpñ,QÂó˜ËL¥Yft€\VÅ, ÌY–¥ù9àú*ຬl=š|*dÊ2ÉÓsÌ ÿÌv3Vèë:Ëñè5°§mºáO—4ÿvUØ ‚JÅrÁÕ9Þpo8´ÿÞÏ«xèDsx “æ…½Wá¾mwÅò—¼õ/?ìa9ç,ɹ9‡NÆ‘ypy#V€œ+.§öù†Ð•ÆÎuÃä·½íM;0Æ .E¼J%KRñG"þârÄ\Óˆ·—EÓ’™\¥D´ˆß-pMEÛTÍcQÅ-ÆBŽš
j½’s?|üúþ ·¿¿ýr7rOR¾ÄÇ”ÿ².( ŠGüÎ5_5»¢¬!ý'<*ëuÓ튡l òhÓ݈,jZÛ«ðL=4ýι²?ËÇÊyhšŠV +ë.¦ ‰’vÏnbÅÓèv * rõÄÛœC‡»Lü™ª°*"Ö+H,ž}[O ¶–ÈEÝ?ÃqZ ~›“ÕóÐxØwµ]Ñòš®²;£[ ‰nÊíIm¸|„‡#>ÌÐJ»‚+k˜}nú!”ùÓk9])# ¿ìʺ¼Q?tÅÐ8á¼ïíŒK€0ùXg.¸ô@Ê„ ?48Ð%÷`×~Û4(ºáG1ZZ†Õ]OKvY n¹YÓo9øÕà%Ô^€\ÑkXÈ@ Åù ÂõÈЊ3
RP‰µµC0׸àf÷» Úý€þ#xôlÓ½lrÐC{?´è!D¤ßmñdýìÜh½¯—E5žÖ¬g®0›hþ¾Â–'*Ô>²s²<×pÇœ¥iJÿ¶¶Í~³9*ÑÐg*uÍ´2¥çÁÀUJF5ÆxU pæÔ½"ús9l‰¶lv;Ð~\•µ¥5 +‰Í~gë¡GÓi Æ%î¢êâÚ½'Ñü±– r׬<”³3þBXSªq +0 ¤PžLÝ~L!1ÅŠ’GrbPÈ´Ô>G CgÇL%+ër‹‰ÞíboMÃ~—î4i<Ñ90ž1U‰C=U‰'9oÂí-^¬ æLD· ¦Eä7Iô¼µ50¼,òi΄0‰7d¼÷*™Ð +;‘ +¢ô]–è„Kš‡²§|Á¸IÈŠ/(yÎàõ!¯)PÂ[Æó<—Uå BØCQú +o§¾÷Pcµ·ž¥>"† ÞÑÒÊ® ŒžÖQ¨™ž 5P~DrÍ› ÏC‰z*‹9?€ww¼àÏÿþôåóÇÿ¼a€×-g3ÅLfähg¨ð*ºß†«Rn>½~6æ|â C¹¨D97ù2"ó„%BžÕ®ç&/ÚòÞ*d T×qñrn˜q²YkÞ»ÆJÍí ýR7 +ƒ÷Ÿè—¾¸VsAOÔb±*Zšøš £á*ÜдVÙ'[º{ìÕ'i},©9B:u\þŒ™ endobj -1738 0 obj << +1735 0 obj << /Type /Page -/Contents 1739 0 R -/Resources 1737 0 R +/Contents 1736 0 R +/Resources 1734 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1592 0 R +/Parent 1589 0 R +>> endobj +1737 0 obj << +/D [1735 0 R /XYZ 85.0394 794.5015 null] +>> endobj +606 0 obj << +/D [1735 0 R /XYZ 85.0394 769.5949 null] +>> endobj +1738 0 obj << +/D [1735 0 R /XYZ 85.0394 573.0107 null] +>> endobj +610 0 obj << +/D [1735 0 R /XYZ 85.0394 573.0107 null] +>> endobj +1739 0 obj << +/D [1735 0 R /XYZ 85.0394 538.4209 null] >> endobj 1740 0 obj << -/D [1738 0 R /XYZ 56.6929 794.5015 null] +/D [1735 0 R /XYZ 85.0394 504.6118 null] >> endobj 1741 0 obj << -/D [1738 0 R /XYZ 56.6929 752.2728 null] +/D [1735 0 R /XYZ 85.0394 432.7569 null] >> endobj 1742 0 obj << -/D [1738 0 R /XYZ 56.6929 504.0748 null] +/D [1735 0 R /XYZ 85.0394 303.3232 null] >> endobj -1737 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R /F48 880 0 R /F53 957 0 R /F11 1293 0 R >> +1734 0 obj << +/Font << /F21 658 0 R /F23 682 0 R /F39 863 0 R /F53 962 0 R >> /ProcSet [ /PDF /Text ] >> endobj 1745 0 obj << -/Length 2766 +/Length 3971 /Filter /FlateDecode >> stream -xÚZQoÛ8~ϯð£‚ݨ¤HJâû6Ù"‹nšÝ¤À Ú<(–ì±¥¬%'çCIQ²$ îjz8ä ?~œÒ¡ ÿè"!a’/ÉCA¨X,·gd±†¾ÏgÔè\X¥ _ëãÃÙ‡_Y²¡Œ£xñ°òæJC’¦tñ.ïî®o¯nþ:¿ˆ >†ç‚à÷ËÛo—_Pvw.£àòóõ=|‰@‰*µ˜W7ŸÏ ~;»~pÎøS”'Ÿ}$‹ üþ팄L¦bñ_HH¥ŒÛ3.X(8cV²9»?ûÃMèõê¡c -€¢ P”P¦RÂdjµ"TòѤ2$2eFG-vd"2‘X õñT ¶>Žc«Ö‚WÛ¢jô·¬p“Þ<”„›!U¶Ø–uµ™ v;-7ª¡sÓÁ´Z\Dø•¤pˆ8
cB¼?¾]ÿy.DðOtäëÝÃÍ×Ûû‘uèQ&’r=./×c€%!hbüè6¦Pë¤@õ‘Õ~û¤ ¢z…2Eý¶e]™!ïÏå9
–Ïf‚•šrU,[üŽ”Ñ{f—•<—vЦ®_ö¯Ö픵Íòˆ5“ijg”ê5û
l’bÝ…]œ! 584¯›ì€Œ&qp_oÕx–âÂX¢&lŒ¨)ZÓ·Ã>cʲ5¶ŸJMPÒ+bÖ3ÖA}Ϭ`wžð@ N‚ÆÙÏ‹¶ØmËÊ|µxÀ à3 -jD@¤FÁ -IJ²Ô‚ª ‹ Â[dÛÎ60wU¬UÀÖÓ;à[‘UÛAªùª½Ð9$ Df]_Q‡ŸÆ%")8Gé€ç
î' ¼e›½ -YŒ2혒¹ ¤„›ò¥@±öQ7,¯U¿: ;˜Üá2Q0 °ã9{\Õ»íyh &) †<¸ŽüíÛœ) ã4Ž\ -°†Ñ.ž½|™'‚÷ãXsÕ±ÄÿÇQéCB" ¬1 -¬ñZÍ(]øZºRáéH¥â´ô*¿Wõc»| ¦ ¨ “–Ö±éó8t`û[£±âÁ÷¼ÆFU·Ø€ŠåQµàÀ|ºCÑûsQaKC«Ù©Çd[3
–®7™Ý qq•ANÁ/O¢¬÷;üZ6øÙÖÎ.šývug¸ žK18ÒûjS4vë*ü¼üë×?MP6ÁûÆIlÐT…GãÇ_èhº°^š©læ€æ2kLÏðCã¡{êªÂ´ÒŸ‹½) E,$‘ˆOðÈÓšá‘Õr<z[ Ñ(‚ýN#1oØi [ ЈÝXÚ74‚LŒ4‚ÒˆK#n`S
C#N}©1H#•Ð;¥0PWÇJžm ÄT:VjµCÕfÿÂvkÂè <
Yê*Pÿ¤
s
#"©Q,MÔä
e¢ 6¼Ïdò•åÛS¶|yϺ̥I²}ÍÚò©Ü”íáœRªâ£O‡ÒøEüm©þ·… -ÝBSsUT xž6Æ^g¨·3&D.!Ecx‡Þ>VÔÞ½BeÂeÀúû“²ó » nA±(Y<Vê›$^øçj
8U“gŠAlI ÌŸ)_kúL9-&»UŒ†ÉYã]˜<²> &{æujV!I§fbjVLͪe. ²·£ªwTõä…¢u…Db.ˆ£#Íjª0ø4ŒÆyú´UÝ£´…œm! eÍ%otç'è …
'´»mÅ?¬æòÙËÆ=„ƒÀ+ï@S發° -܃¦¾PB ,ñrì*vý<5
1QOÔòÄžÖ ÄVËA <š02!|ÞºÓ:6ßÇ7¦a"hÒ·UØ׉¬»¯´(RlÓøPÕÕaÛ“#W]£HúEò8‹,zQ…PÃœ€Øך†Øi9ÛYVW›Ãd¬œ5ÞÅÊ#ëã±²g jfðr§Jë,ëjs÷ZéÝ2Þ1±ÄŸ‚ÂìtžÖ tV˃nµÉÖÓÐÍ÷ ZŸ€Î7ù Ó-–°H÷Â?ØñL &ü'þQPIÆ‘8ª§5ªÕê¼ËçA3î:´>ªo ka!̵ZØ×4Eûˆ"¬wAty…•ã²=ˆ«¶\bWžµ™Êu¨ðTšItq*„‚÷|Gܼà@N.ìX÷Î †žªÝ °ïYWxÐÈf®:úr›Ù×gH ÝC§ú¢‰ &ÓΤwgSÕ¨ˆ
L8%ü=»“àioºqaÐÈÌõ¥5ZÐÇ=5\7¯ë1ÏGÚ±¦ÿ“ÁÉGõ°)Ú¢‚jx’ÃTDaš&'ît¾Ö4‡–ãðržÃ³Æ; Y çpϼæ0°ÀTÐÀŠ ¥†Ãª…Ÿ®ðSqxù\,_° -›ÉÂYÃÝ á‘åñžé+üÉpª84¿(>ê§/—÷÷öA¶¨¼ßá\‘ètMmä~™ +xÚÍZÝsÛ6÷_á™>T™‰X€ +ç\ 9æ=5`½Z7õ¼ êñ¼j×Ëâ©œ'Ç<uf!úéÌ|ÞS÷G ÷ÔqîÑ3½·¨I. |vÑ0èpÑÁÉÙ ôOçÃE«ö¨èš»½®`[ߘ
¨32¿ù¾¤ãüM´U +Æ—K ½] 6ØçtBؽQŸv…ûÑ{TØŸ[t'ìýEÇ…Ý_´ªç€x:o&N*ðR‚–çÆ·¼ÐáIAÍ7+ N‚þ´¨1'êoij°€òê ŸSÇ?ßýÌëË7Ü+OÆœœÓ“"8ƒ# +“mà +[Á6ÄÚ Ã©=¨ ôœ>QܼjÃOð`ì™xSÈó×’øEˆL·eÉPÜ š÷ýv—"õrO_v¨÷bÑNV±êl?TkðI.ØOrñ5¤/ ZÆÅsœêñ %Lší«°T¡Ê5\ +)¶;) ~cSÔ-î 둾Ò:ºC“b<ˆÈ'ÿÿÝbÎN¾rv¨‡1 ýÉA+#¯Óîþ;Ì«Œy•‘!p‰ †õ#Æó$@ À‰S‰<8v¼dÚEm˜ù²£¸rÎòz D)û¨zÇÑ㢢0,#ÅTdWòkOýâòê» ~ ßGžÎód’H{Þ¨Ýâi\<å•O.ð?ríd[/)‘3é‘Ð"]ùüNiÿ8r\¹=<®Ýº±O+5ÜËu S‘\E™w‚z¼ç ûç.Û”:·ç*½^Þù0ƒÑ M~ð15MûˆÑg{ØõD]>
¼£9Ò "“(‘à(P.~þîCB$º~@bX¨ªg´ÖW|ò žiß=dϧ[0eVþõv˜kÊ^ÕWèz>V RIžŠì„†ƒVíÊcã¶ì"z )ˆ`$^RTÜmþq52¬Dd=ã o1 Ø Y,*í‹èʱE蘈.L6[õ}Ù†¬%ä„ý£:ƒ5z³§!´ª¢ÀU¹WÒ…ÈZ…+Øå3¾ëÄi¾æ(yýãÅñÒïcÑ ¹?d8 ŘDùÞ4””>1;‘þEw °=ø¼é§qûU:Û‡†Éw«ÃŽõÎݪÝ5Æ1w ˜Q@ŽG’¤Cw+L +œk,]IvfR qé`%ýK»q—Ž8$ÏNW`r +0+–þ*J÷,ø‚¤ / €D)ïãúµI$‚éAðe_'œÿ^fĪ0ÊĪ&¼)ÓDªŽ©ª§¨XI±Y£Î7K2mÌàæ–a×+ƒë»j-4ÚI±{!p}ïo>!òe]¹»é-g]õP.Ãw"0 +”Ø¢ /Û†H½m„ËH Ž0]um¹¼#"‰*ß+—R‰ÊõÔ¸9.Ã;ÈGtzX† «¡à ±Jôtäj£ ;þ۱ˣ,DŽÅª˜C¹—)‰‚ˆ˜:¾—èuÝÐgØŒé9|ûîâåôÝ«l,§ÌÒw"¨#KñÐx¢@u”'jáÑñwÞFÔÐ
ñ`ìA<Å>s"Q2ïC=Lbò +œÀ4d‹V ½K²Üì]½„Á…s¯I°Måz°“âcÉÝ‹ÐbKöýãjmÁL8¥×BªÃ>]ÁãsZVM!äm˜¿§ürK?ŠvÇ€oxóEÉSy¤·‡‡ª|0Æ Ø8È9÷]Wá +êyŽvQ.—_3¤¼Ý5TÉ +weþ>Kô@yðÐd·cá„` endobj 1744 0 obj << /Type /Page /Contents 1745 0 R /Resources 1743 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1748 0 R +/Parent 1589 0 R >> endobj 1746 0 obj << -/D [1744 0 R /XYZ 85.0394 794.5015 null] +/D [1744 0 R /XYZ 56.6929 794.5015 null] >> endobj 1747 0 obj << -/D [1744 0 R /XYZ 85.0394 695.9587 null] +/D [1744 0 R /XYZ 56.6929 752.2728 null] +>> endobj +1748 0 obj << +/D [1744 0 R /XYZ 56.6929 504.0748 null] >> endobj 1743 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F21 654 0 R /F39 858 0 R /F48 880 0 R /F53 957 0 R >> +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F48 885 0 R /F53 962 0 R /F11 1299 0 R >> /ProcSet [ /PDF /Text ] >> endobj 1751 0 obj << -/Length 2849 +/Length 2762 /Filter /FlateDecode >> stream -xÚ¥Z[oܺ~÷¯ØGITR¤(©@ $=ÈA{êž8hÄòŠ¶…h¥ÍJÃùõ rHŠÔmO[ìƒ(rÄÎ|s!¹tGàGw©ˆE‘»¬àqJhºÛ ®ÈîÆ~¹¢†æ%zãS½»½úÓ_Y¶+âB$bwûàÍ•Ç$Ïéî¶ú½‹i|
3èýÇ_®ß$"%IôöææÃoï?þÞS$@@Hô÷·¿}~û7컹.€ì—Ÿ®ïn½úpë„ñ¦„)I¾_}¹#» -äþõŠÄ¬ÈÓÝ3¼˜E²;\ñ”Å)gÌö4WŸ®þé&ôFõ§K -ài § »7ŒÇ9ð_V3J(K‹X°„95ñ|IM–J©éÕ—¶»;ÉýùÔËé’i’Ç<aÞKÜ Õœ=4Gö”±˜“4 ùß*}w¼~Ãr
Oº‘D½ †kÕí#¾w~ϯ$%§kšGzu×"}%û»+ H{_Ø¨Û »ïgyz¹¦”F -¢ž‚ -tú!Ofš -m[ ¨†3ŠHŒ ¡ÓI«ßz¹ _´c«ZÅQjCÓœ¼Â<¥¡uõ#´µ=„ÝçS‹õ?/´ï×,ÿuÕê ¯Á³ _,ÂÊ Â¯C‚¨OÆ/@£ڀ„¥r«µð¢#¼(Ø6sG5ç>‰ðYÌaW²ïgÕ¹Ÿš¤{·±´jór9¹æ -ãgß Ý×ë†I2ÖèBØô©Ö
ã¨F؃Þù¦‚iVÐmþŽj.@hðQ&%mÃm¸µ
lÃÝ11‰F‘õëh V y8š‡/™‡dÆ<Ü77æáÆ<<8ZÞ6lYó"¿J}ª
óXªÑ<UU«Õ•ÍÜ>B]´dÛ8ª¹¡}@Rµï$ðÌ#¬y„5Ìch ÛY¿öáÂØG }Ä’} -k áÛGûcŸÌÙGSQÄË'…цÑh›?Â/œÊûTëFsT£Ñšfõˆn“óxD7c½|Dðþ$M¤±ûF–¦©DšG¯„°òq½b£‚ÇD\8Íðˆ6”dˆðê°>È¿Ü®”k[<mµ6e¹\¬ù<A7æŠqZ‘’¢Sçª/uÔM,¾›T¯?è–.CÁO²"±Ç· ¹j1C -ïý_’3Sàæ¹:F[ +xÚZßoÛ8~Ï_áG»QI‘”Äö!m²EÝ6»I=´yP,9jKYKNÎÿý
9Cê‡%åpw(PKÃ!gøñãÌ +_0ølj +˜Ðrk(ÆÕbµ;c‹'hûxÆIçÂ)]tµÞߟ½ûUÄ è(Œ÷ëÎXIÀ’„/î³oËËÛÛëÏW7_„Š-ß犱åï—Ÿ¿^~BÙí¹—— ¯ïà5R,%nÔ"¶¼ºùxþpÿÛÙõ½w¦ë0gÂxò÷Ù·¶ÈÀïßÎX t¢¯ð®u¸ØI%%…p’íÙÝÙ ~ÀN«í:€I ’0 A c( Dš u¾É÷f®zÙlÒÆ<%Ë¢FÉ߇|_ä¾”yžÕØÞT(úQV¯®oŽM?ò#JÒ’ú¥Û§j_4› õ%+Ú[yÌ‹ò už¼BDË›[ßß|¾úÙ)꾃YUæ4ÈÑ, rÁy • +íôž÷ç<YV/EF&Ø2}&áó¾H›Üô x(ÎX a03†™*uÑä:`:¤c&;2„ŠA}:”€¥¢È©5àÕ./›ý-Jì"t§K j&©K™î +ûþµ²Æiù‘³ù*Ï&z<o4x]<‘¹ïL±‘
|’(Ih;ü4¶q Ç.*À0&ï„Z;ñ¤ëaÖ.œXÄû,2Ž–ÈWÁà ‘‘ì¯'Âdͨå=q“IØ +fžLA¤FÁ +ê<æ@ˆÂìcóf¢–Q±”C³øðõê–¨ Žk5Øчr›×nåJü½üë×?)&Sì¾ñ3Éb~¡¡n£zAC¹Ä«´¦(žâ…öTe‰Y¥?0ÖzS4 +EÀB½A£ŽÖ œ–§ÑËê„E!,wªyÃ^ëÔò€E Ø&’¾id‘ô,bÄ"éY$=‹˜c‘ä=1Ç"Ùe‘J ã9 °…SÚPiÕŽe“þ ŸŠ¶ªWÊ$‰/@»m˜’x2ÍI± )C (.T?jt*<JäkÇ·Çtõã5m—%Éî9mŠÇb[4Çsι S‚3Ü Fã{Ê—•ùßÕP!Ôƒ‘R±oé–Æ-¬™Õ¡hLÛ$ßd¬ƒP†jžo]i¾y-&djŸŸpN1(š¡n™5îµN÷9§ú’÷ÍßË®ª…³m³?‡SV¹Jq?‘73ÃHbT3<CÌ·Å93 vša;fÙNaFù8 Ç<Ô14æ¡6«hÞ QL΄îBDg$(êˆR*HÂd˜†ýDL™™ïMvœ !R¨@*-ÞXÒŽÖÌ’:-»¤YµK‹òSOÛÝ8\W<JX<ï×:u¡¿®àCÉ»çÂ)èDäJx¨s„ÇÄc™2¤v*þB nR³Øý~°x[zÆyDˆC1ª¥;Dv'>ðVB +™+î`…†€TãøÅ}«Ÿó•¯¼my•Ž ./„Ђ’§O†®¯ýÓtÈH»`–Tª6…®">~ VB pGõwy³z·Ïëjû2u¬Ö°*¦Nh'šÐIÑLàyÜ’½þÊðÎÊPˆ\AŠÆð}¬¸;z
„ë$€³€ó÷'cÆ?uÜ‚ZQ‹h¬Ò§$žw÷ÕàTNî)±%†0¿§ºZÓ{Êkù0ÙÎb4LÎoÃä‰õñ0Ù3oS³ I65ƒS³‘`j6Otæн5
¸¢¦%Ë
K< 2: Žö¤>œª0ø%Fã8}ÚšæQÚBN‡g¥ˆDY:ã®ü¡°‘Œ·‡Mfø‡Uã‘Ξ½l܃@y:å Hu åý£;ÿÛ,0Í2uZÄñ,ëhÍ°Ìiµ,ÛT¯L‹e3ñ†^ëÔƒÁ…—† +-Ø»ãžÎ®3®o¡ë#ëXÝÿbð楀¹ØæM^B5<Éa®Â Iâ7Ît]i{-ÏáÕ<‡g· >±>ÎážyËa`Uð€A‰Ãæ #(<|¸Â_ÃáÕ&_ýÀb +LCÖ ç©ÐÑš¡‚Ój©°¼!œ5ÜÞžX ¿!왾Â/†SÅ!}P|$ÔŸ.ïîÜ…l^v>Ãù"ÑëRmä?‰L€ÇAGo`ÛQš†Ö)µ7‹
¬ú ¸R ìˆYÃ^éÄr Z ;8õLÿwÈÞßú?áêJe˜¿æ™ ó äÿç?iÿ$FÆ endobj 1750 0 obj << /Type /Page /Contents 1751 0 R /Resources 1749 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1748 0 R +/Parent 1754 0 R >> endobj 1752 0 obj << -/D [1750 0 R /XYZ 56.6929 794.5015 null] +/D [1750 0 R /XYZ 85.0394 794.5015 null] +>> endobj +1753 0 obj << +/D [1750 0 R /XYZ 85.0394 695.9587 null] >> endobj 1749 0 obj << -/Font << /F37 743 0 R /F48 880 0 R /F23 678 0 R /F21 654 0 R /F53 957 0 R >> +/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F39 863 0 R /F48 885 0 R /F53 962 0 R >> /ProcSet [ /PDF /Text ] >> endobj +1757 0 obj << +/Length 2840 +/Filter /FlateDecode +>> +stream +xÚ¥Z[oܺ~÷¯ØGITR¤(©@ $=ÈA{êž8hÄòŠ¶…h¥ÍJÃùõ rHŠÔmO[ìƒ(qÄÎ|s£–îüè.±(’b—<N MwûÃÙ=ÂÜ/WÔм±Do|ªw·Wú+ËvE\ˆDìn ¼µò˜ä9ÝÝV_¢w1¯a½ÿøËõ›D¤$‰ÞÞÜ|øíýÇÃ}J€‰þþö·Ïoÿ†Ïn® ûåçë»Û_¯>Ü:a|)aJ’ïW_îÈ®¹½"1+òt÷ 7$¦E‘ìW<eqʳOš«OWÿt z³úÕ%ð4Ó„‹ÝÆã ø/«‰Æ¥@”¥E,XÂœšx¾¤&K¥ÔôêKÛÝäþ|êåtË4Écž0ï%îŽjÎ †#{ÊXÌIš„üo•¾»ÇÇF^¿a9†'=H¢^Ã5êöﻇ€€F¿¿ÇëW’’Ó5Í#½‰ºk‘¾’}+ H{_8¨Û »ïgyz¹¦”F +oν¬â™ßçL€h°ö¶zT h©œú* \üž«À·ÉÞQÍùO\°ˆ·y(À¿´õÍÀzâ0B%áØ>Ø¿^€-%EL“,ÝÆmAÓ£ y8fÙ¡ÃëWB’¶²‚H +1‰`ÑñT·†kx¬€7Í¡â«…²Áû}w8Èv°““źóp<ÛÉ +èꇷ¶£RðÐÅp\p,!bFT‘¿]Ô¥µ4*©h×á +28B¡Í{®R78†Óª\€V×`“¥l³ÏÕ®¶×¡ruZ6©xzm· +ƒCYÉת
¥#]_ÿ”ŽÁzOã€N|l^&^Üswí&:î%T/µmpÿHÊôê¡që«b˜ŸB$ÝDOµŽ Gåôý4å[äqÊ.°54s®“ª˜Aõœ±íͨ‘/•Ñ’ŽÉN]wëú²G=qÍ œÐXé]Xý½^_̾ rß8WcûhF/Œ>Õ†),Õh +•Ä”×Möcpñ_® +¤YA·ù;ª¹ +ïýEpÌÔ#x®NÍ\ Zö<½È×~ «Íç/¯}ûŸþàk#¥ü~.›°<û)ñøjÚv- „¥ú}\Ý@µm[q\êܺ“0ý1ÛãF×ÿ‘ÅI&.T ÑÆ ‘ôI:6 +endobj +1756 0 obj << +/Type /Page +/Contents 1757 0 R +/Resources 1755 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 1754 0 R +>> endobj +1758 0 obj << +/D [1756 0 R /XYZ 56.6929 794.5015 null] +>> endobj 1755 0 obj << +/Font << /F37 747 0 R /F48 885 0 R /F23 682 0 R /F21 658 0 R /F53 962 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1761 0 obj << /Length 3318 /Filter /FlateDecode >> stream xÚZÝsÛ6÷_¡™¾ÐÓ -!¾HâfòàÔNÎmš¸µÓ»›¶”HÛœR¤*’NÜ¿þv± -–D!_ לp¬… °æ2f‰â¼oóö|)e ´95ªn³ÊwØŽ‚úžÆP>O–º é“›ÑÖôL·ÛüœéŽºE…zõV¥¡aQ¢ÈŽì«t“ÕHV3EÜÁúÓ…¸`¡’Žârf
äÊÜ×^¨v(s¬Ü ÖuÕì›'Až¹ý¬šºìÚœáê‹¥H"&Ç#çÌh-ìÊwöÜ4œQ~ŸveK§´ìÜxÑÐÓœ¥ü5 EeÙ@·k -8µêÁ“¹y•;th6mÚ曼róýÁJ3<²D1Ør~•·ëW» 6ðÄ`o÷s¤Y¤¸?Âo`íDöœ€w¬ -ªšÎ@Æ@[ UmE…Ý8iq¤po¶0 Lj‘^ƒž+¥‚ -…·ã–Ú|·¥‘ÒR¸…h¸LÛâ)§7ÕžKZ9êÏEYÒÐÊ‚NÂm‹ÌW“Çõ£] Ì•…6à -ìÓÞ6²z“UC²hZ?eH9½5 ',᱇)r\?ÎÜ•L\ƒ×bf)f@û•Hž£+yÕÊ -:ªµ;)xº¸ŒG2ú«àbKîÌeKPÓ(9mS‡TÇmjOemꪻoŠ?ó×o&VU)8r@îIÞ=Õ”ùت*Ãbé1wkU…×fl|º¼¡À°I Ü(‰Ço±ŽŠc+ -Òì)ßµEC0²F-6¯.?܆nù9Ë(¢]°Ë›™Û&cO°znó†¡Éãdͬ˜é—bÓm¨ƒCêÏ5S±6cõß•£ÝBCMô øl 72Ú/ô÷
Hk©Ý¸UQh„ô ²fK8-ŸÏ9çŠlâàg !ÐÜz®]‹–|Ä: ƒ] -çÇ-/èÛvÝUYžÍ™nKŠáu?«?;‡Gs·»,ô@. ŽåÂ逅·©[áOò85õœA‚Ö:í§)=ðÖ©õG—ïžÝBnâÊÑ’Y=¦k<aBJó‚®
¨N蚧²º–gUóú«‰¢‰ˆ õiÆ=Õ”óAø‚öM&cÖ· -D ŠðA'8¤:ÄžÊîë—ªþmAXQU>Ác”°lëiþ=ÕT€1 ÁÞÇadÆÜì -Œ{”HÜ9kûÌ,‹ßsjÙóÄÆíÇ lÄó0|ÀgJ8ÚUݸ™v§K»UÛ‡èd“:îJaë±Û¤Õ’PÌQhÆöø¦Yº*q¡C0¼Áø
B ir -8Þ‡¸ØAê cC bë¶Cyº~¤Áñžh Õ©Rê¢c#Æ"À½@ ª¤é—½O×p› -7õ×P‡— áN}tÜDûÙ oîæd¡;Wš%"ác×7IãÓ,+Zˆ]zåÆŒ£®¦.e‰QÌÒ„ ’ò“0ØÓ £é!ÐëÇ´™ r‹a…|=É!ßñõC #‡Œ¿µ —‚ -QB`ÒúP¥m׫£ÀŠ CPÁc#f\™¡¡×èomÃÆ«o›mQZåêcl-/gªÀ*L©{|© -,À§%É|
xÙ¯wò@ÜPŠáÜ^¿ûöŸ·WÇo ânðK/Ýÿ€ê<•Å@»ë°Æ´ü=~ýü™à ‰X¤yZ„žj*Ã
†³Hšh,„M¾°”™[u·© ->p¨Ì©F °àT tgwž •Ç°ò»Éhñ¹r3»ÆÓX<ÌT<¥bÚôµ³¯‡*q ¿†¸¢š¾µ°ì•R‘ ùû«ÿø -'\Kb"†Ã8ÖºØÆ8ýò†¢h}Îï+ز>f5Àº3¼F›b\,#Àš5ý¡fsq«Á´|)nõ‰ž¯pÆAY׿ƒûÙê¡Ž! ï?[à@ŒÁ¿9NB0 Æ~ØÅÙÊ4ÅÂËüòªF°ˆ÷¹ª5ÑÆWÒ@þ5Y—ÑHPÞ\Â\JSõŽÜ9롹>¼Š;e'>Œ/x`§tèí´f픈ф*³ -0-1—ñžóÿdD.?2/-CªãÖª§ê=V[omålµDg„ê4÷žjÊþÀmqk ùÿ Å cr)¢ NÌL˜qNŒH·ùÃ?z‘Ò6D/]A†ž°~”¶¶ø¾O bJ†^g1 cI¨ã±ùk@ãXÝÁëÖ˜Ä)ý÷æW\—œê¶zÏy4kÀú-ÞcFƒÑ6îaàJèŠ~øô s¤»ë›÷W´Õ ?]ýt}u;c BDKtlö_à$}o®?\bˆŠÍ¶´_¢RÄ)[”žšUÌ’u$ø‹õ -'õL-׉,±^ÜË¿6è–¶ÞìjŠYN¯ðíÒŽÈ`´Û–nœ¬° A@pE×éÚxÛ¶©§„/؃ A2GE„í.gËÓî,•r>@{ †>@»dÖJ‚ - èïÞûëTj +!¾HâfòàÔNÎmš¸µÓ»›¶”HÛœJ¤*RNÜ¿þvDŠ”|Ó^2 p] +×R& “ʦŽÉSá1}]M×¾¾<Ü.—‚eIÌgý5GœÕ˜µ=Ö\¦,Sü€÷mÙÏ¥L£î±tz·^”[l'QsïÆP>O–Ó„Çü‰ft{æ›MyΣ|ëºUzõV÷¥±aI¦ÈŽìë|]:ª¬"e"I8Áúã…¸`±’Dq9±†aR +E÷ªëËœD Úò©Ûª€}ó,* ÚÏ¢mV»®d¸úl.²„ ÁñÈ93Z »ò=7
gTÞç»Uç:OùjGãUëžtr–ò×8µeÝ][Á©ÕžŒæÕtèÐl»¼+×eMóýÁJÓ?²L1Ø¢
¿*»å«m xb°·û©Ò,QÜ á7°v¦"{NÀƒ+€N¢ºqg S ‚΀DF[Qa7$-ŽTôfÃp¼i„iá5è¹R*ú +ìÓÞ6ŠfWuë:«ªíü”>åøÖxš±Œ§ ¦Èqù8qW2cp
^k@Š‰¥8˜íWrò ]É«VQ¹£ZÒI9Ç‹kÁx"“¿ +.6²äd.“T‚š&Ùi›Ú§:nS•µ©‹Ý}[ýY¾~3²ªJÁ‘rOòTcæC«ª KM¢‡ÜU^›±ñéòÆ5 +:Ó¸ $h-ó]Kú˜»Þºký±+·Ï´M\3«ÇtgLHi^е Õ ]óTV×Ê¢n_5R4‘0€¡>Í8P9 „/hßd6d} ¨îíid^Ù²pVYJÔVMMï÷ ˜Yc¡¯ü}UÍ W—õÐx¸˜Ðš +H= +DŠ2ðA'ا:Ä@e÷õKÝü¶† ¬ZUu9Âc’±lëiþj,À`ïÓ81C n¶Æ=JdtNËÆ>‹Ö
®ªßKײç‰ÛØH§'`ø€ÏÜ=àhMK3íNçv«¶ÑÉ:'î.”ÂÖãn×s‡ºdNb3´oŽo^ä‹.s†×¿¡SH휎‡;hXdlˆAìohë0TæËG78Ü“CuDªÜuѱ9Æ"½@ ª¤ ËÞçK¸M € ÉÖ¦ËÝj§> +±™”¢ÜmB,Ÿ<©Ë…,°¯TâEµ>÷±B°ÚÈwÚÔ¡9+‡ ªQÓÈT·ÝnÑ'ǨØ/¾(!K® +,˜|A€@5–à@[lb¯‡"\t¸n0Nœ¥ ˜‘ªÝ¬òg´‡
H$:4:ŽÆž4ŒR¸Üºž¿¬„÷|2Rå+4~eañC _ü`§jÉ +BÈ.3=Ä„w¥T6Ì RB'0 Ÿ\·Ÿ¶Ç¯P—diú•ö¨N\©§ +W +®»-—£ëÔ1d"";Í<P¹¯Âš4U|Èþ§‚ïˆCÖ ÿöê[× 9/îÒjûlm1ÀŽ<ûŠ•°c!p¸àÇïiFESu|ùþ箞‘›d?ûãÍÝ”,îΕf™ÈøÐó²ø¼(ªB— Û˜p4õØ£ô1ò ‚41ƒœü$ ö4ÇA@4mõ°|ÌÛ‰G°V8Áד ò ^?ä©0²Ïø[Ëp. ¦ð%æ¬uÞí‚: +,˜`-u 6b†ª {îÖ6lØ*°ø¶ÞT+«\!tÁÖür¢¬2Á”‘ª·Ç—ŠÀ\Z–M—€ça½“¢à&€RôäöúÝ·ÿ¼¸½:~ûvƒ[zéþ{T'à©,ºíKLóßËç×_ÁŸ²„%:“§ETc†h0œ%Ò$C!lî…•ÌÒª»ÍTðC«ÒµÑ¨HÕAw¶çY´sÕ1ìƒü4í/>4s×z‹‡‰‚§TL›P:ûº¯òk{!¨ Ũ¹€e¯lŠ +.a*£©ƒ#÷5Φo®¯âÀNىà îÙ) {;I;%R4¡ÊÌ@jÜœüÛ–*¬8ï/9VW¦%å2ÝsþŸ¬•HÀå'æ… ¥OuÜZªà±ºfc g£¨%8#V§¹ª1û·ÅYªy:äÿ/æ\ØJ~N"7{'/÷N̵7åÃ?×ÉÝtØÐœJÜ–‹ª"ïlÙ®Ç Â &ºb&ƲX§Có×0Ʊ®ƒ71}Súïc̯8ï/91Tk%ôžócÖv…-Þc.š‚½6äaàEÜíüðé=¦Gw×7ï¯ÜVütõÓõÕí„mˆ +‡Â™àø2'éå^úUe¿Â¨Ã?Ž[§jWü\¥ýtíx¸â ‹…9Hì@V™?´ßK¶¢¶>+F%U"˜öÖx)Rú¯ +ÐZBÀ+ËĽÆ_cR
˜÷ Î Ÿ‰r‚‰8óíRÛ‡ }C6ÎŽÐ×Î6 ç$OUÕSUìlÚ"EØŽ}åE.Ib‡9*âHû jòŵ‹²]n«}™ó<WŸ¼óEóTâ¯4À¨ÑM‹Ø}A·¹!öì½sü’óÜ”=a£í@ŒÜGTHî_Û»ÁÆþþö?S€aûË·bã¦/¨±NI“wšga&üõæ«©=ýÂúó¦<ÀÈr•·‡¸±»›PøÒCQHûØìVÅ0žÈ=Ôûµüý”ƒüòw«fá.>u*!è‡ø HH¼\&TRp’—Œ~Ͻdô[ ;h£IZ4˜–Z:âû¶q3ü2^™m*hË26ƒ +’z¢ŠK"K¬@`á×ÆÛÒVš©šX”A»´ud0ºÛ¬hÜY!aAƒ€àÊ]'µñ¶mS÷N _ô°=ÉX ¶;Ÿ,LÓY*E>@{ ú>@Sž endobj -1754 0 obj << +1760 0 obj << /Type /Page -/Contents 1755 0 R -/Resources 1753 0 R +/Contents 1761 0 R +/Resources 1759 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1748 0 R +/Parent 1754 0 R >> endobj -1756 0 obj << -/D [1754 0 R /XYZ 85.0394 794.5015 null] +1762 0 obj << +/D [1760 0 R /XYZ 85.0394 794.5015 null] >> endobj -1757 0 obj << -/D [1754 0 R /XYZ 85.0394 204.5196 null] +1763 0 obj << +/D [1760 0 R /XYZ 85.0394 204.5196 null] >> endobj -1753 0 obj << -/Font << /F37 743 0 R /F48 880 0 R /F23 678 0 R /F53 957 0 R /F39 858 0 R /F21 654 0 R >> +1759 0 obj << +/Font << /F37 747 0 R /F48 885 0 R /F23 682 0 R /F53 962 0 R /F39 863 0 R /F21 658 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1760 0 obj << +1766 0 obj << /Length 2180 /Filter /FlateDecode >> @@ -7602,809 +7648,823 @@ C¦#Xs ºfÓ
˜Gñ¨É?Ø $âÎ…~u])ÀE/31K6›²È3T¹”^Û¶['݈3G’ùQœWœâ“ŽÆÞâ™PÔEW˜“ÃÀ ¬Íõ1¿?Îò{NŠîU~ªçG-Z zŽË£/³jd—CVeò8¶‹f:ŒN´ {(°U2G¥Á·Ñ *Lâ0h\ß,Þ}šß/çw·#ya$,Ž·JGà Ò/–4øk‹jƒéHÄQ'Í„©%Øä[€+S¬áØ\gì;$MC®ìëø×°&)KË CÂzÿ¶<¤M9z8?¿·rfÅ@ˆä-tí,IÕ1”OOEj 1|~HL
¦¼?¨Klmk@ ;,Z[ymíŸçΰ ½Çâ)¯ßŒ˜BB”àÚw>óš)$„Jß]nÓå¹]lí¸6e†wU•˜Pû6¶„, ½{<"…„ø¾xÜ1Û'¥>‹¼ QF]'IÂ?Ší”Õɽêñ endobj -1759 0 obj << +1765 0 obj << /Type /Page -/Contents 1760 0 R -/Resources 1758 0 R +/Contents 1766 0 R +/Resources 1764 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1748 0 R +/Parent 1754 0 R >> endobj -1761 0 obj << -/D [1759 0 R /XYZ 56.6929 794.5015 null] +1767 0 obj << +/D [1765 0 R /XYZ 56.6929 794.5015 null] >> endobj -1762 0 obj << -/D [1759 0 R /XYZ 56.6929 626.4701 null] +1768 0 obj << +/D [1765 0 R /XYZ 56.6929 626.4701 null] >> endobj -1763 0 obj << -/D [1759 0 R /XYZ 56.6929 517.4334 null] +1769 0 obj << +/D [1765 0 R /XYZ 56.6929 517.4334 null] >> endobj -1764 0 obj << -/D [1759 0 R /XYZ 56.6929 438.0429 null] +1770 0 obj << +/D [1765 0 R /XYZ 56.6929 438.0429 null] >> endobj -1765 0 obj << -/D [1759 0 R /XYZ 56.6929 376.8269 null] +1771 0 obj << +/D [1765 0 R /XYZ 56.6929 376.8269 null] >> endobj -610 0 obj << -/D [1759 0 R /XYZ 56.6929 339.1376 null] +614 0 obj << +/D [1765 0 R /XYZ 56.6929 339.1376 null] >> endobj -1766 0 obj << -/D [1759 0 R /XYZ 56.6929 306.6767 null] +1772 0 obj << +/D [1765 0 R /XYZ 56.6929 306.6767 null] >> endobj -1767 0 obj << -/D [1759 0 R /XYZ 56.6929 271.6646 null] +1773 0 obj << +/D [1765 0 R /XYZ 56.6929 271.6646 null] >> endobj -1768 0 obj << -/D [1759 0 R /XYZ 56.6929 207.5268 null] +1774 0 obj << +/D [1765 0 R /XYZ 56.6929 207.5268 null] >> endobj -1769 0 obj << -/D [1759 0 R /XYZ 56.6929 137.3205 null] +1775 0 obj << +/D [1765 0 R /XYZ 56.6929 137.3205 null] >> endobj -1758 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F23 678 0 R /F21 654 0 R /F53 957 0 R /F47 874 0 R >> +1764 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F21 658 0 R /F53 962 0 R /F47 879 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1772 0 obj << -/Length 4060 -/Filter /FlateDecode ->> -stream -xÚÍ[ÝsÛ8’÷_á·“«"† -6Τ U!¢LkIBÚ6}µ!ø܇/Ô,ë¶+r¦#{øtìaÃ3å^ Æ´–~T%|¾ñC7*q#U•ù=x[të·‡¢mª—hÝÔO3üÃ"ÓD(þ  ×K¥d¤l¬¯—Æî?Ÿ§S -ØõÔx)-ó™9D%‰¶Üå×XÇyUÁCðRfðªx¥Åç¾|É+§ NFGוõó ¸†RPÖ8,iùr‘£1yÍòÍÛßp¢S½°2Jȯ«…‘ÕÆOà¹ßå¿ñVç'ª´áËžûÜÞÿÏ"l -Œ™&™nÊ߶˜Pg¤‘¤°“Ò3²|7' Ðs#’#aàÎáÙ·ÅæÍŒ(@Ò±Tâ‚(d”ØÄwz-«ŠÍ»®Øí;f¾Á§\lÊv_å_†¹ÆÃ/·Ô û^7î¹aîž @ã_MÍ"ÐSD*n˜3lXK@¯'7C³cV=Ï,c°úÆ„µ{«§Íðö©d²ÈûnÛ Ê.ïÊ—‚H ~ô`ÕH&þ¡á€Èµp%è4”rVçh88}M¸6Œ—LÇ#øÔ‹Mñk ËÚ3´úâgáî ¨ß±PqñΈ3§¸Ô›~<5½7—'XÍh
<Ø7áHf¼–,×óz*“ìXM•p¨z¸±‹~ÝáÒÁ¾!ƒCJN„ Ý¢¡–w#_è—“(<×UÞ¶s*$âÈàvÓä£nS Ê"kâj Ë-™«uÎ ¯ -z¢]M®šæ·~O´?mÙl˜Áé4:²"–Óíy·Í›¶.x‹ˆ;×dØô®±.ÆÔ°áêvLŠ†¯7ÅSÞW§ƒyl¾»§'ù]ݘÑüh³ guV VMëF‡8 ïö}GmÑ,ž‹º8äìÚ jê)Ö/´6â"îfÒ°qàˆCžG¥à.¼Òmæ=…©WºÃœâ”J§Ü
"NÜÍ Ô„ˆ¶š÷x~mXdîî92@3r“ì$$à}œ¢“ë ‰^&1‹mŽ`$ :èd´=aÝK¹q -á â8f»šg[Št -¹ õÈåØ -û§âã`]dvÑî‹u‰A/ä §à+!@ž‚äY[úþ ûß}|I‰2Ú™‚;ù ;ö~·Ëظû˜Fw÷ôcÓìò²¦®9>„_ ¾CÊ
AèD»JÎ:>}x',Ó×<±w¿>™è= '·Ÿ¨îð ’—qgÁ,—÷ó—2ú$äJæaÔ$>œRÝïV.¥¢‹§€¶i†n.¶¹ GCŸ@Íâ³Ú£ -›-d •EÜp³i¾6Qb¤þ¿¦ùo ºÂ”‚ åMY7óL-Y‘µŠDcSMfŽ¥eGe} кàæS‹{Ø9~ép˵žŠW‚{ËÚ‚!ÈÁ1ÆäÑØñ‘•áK"Wœe!¥ f!ÜuÓ9x“– -žmAspÄ€Œ4? Mᓽ£\ˆl}¾"s\ÏñsLk: -\»dÀåœì€
Ø86ÿnesáDžâX€D¾Áìä@?ÉŠåâ/?b…-ñ¾¡;”EK¶3éÒ+xThÑœÁÀOJx AfÎk›×Ïdo’u -à‰éG€O?áWˆº‰2Z¤Ï©$$-"IO b[*cÁcÈ8^¬Ð
#É¡^ì÷)A}¡I - e*‚(î(MÁrŸÉP?È8 ]Ï2qGɊᇋ#”Åï{ôÔþ[UÂsP€ ÛN{u[W8Cc;*®"¹o{Hʾ̅ Ô
2×C^ e
™9 $Á ‡H³ÉÁ(“Ø<ÝÍ$‹â4½\äWÂcvïr( •B‡Øp)[Aøðšå€Îês¢‰£DÆ!Qy<s„!ìÉFì+n2— ÀÓ%Nø.§ßï˜G¤jÜ^úÖϤM:… 4M¦Fí¬žÖ" °ÆeyôL²p+ÌüTY8‰É1 -سhGB¥—O¡â4LOhƒI”µ4>›ÒÝÇ—„HÞ7ÑÉdß \&cä¹%ºó°P[¦ÿטúØFⵃtF±CiÔ¯ü{¶ZÛ$x•n^ 6•'°˜…rDIg#˜vœ’9 eÎ!þ•îät.ö& ƒ“;`^ -®0œÝ¸¸
]ñ< ܇x¨y®ËÀáÿ‰.7Y¼»¿ýóû7DÆš ! d"i6TÉæ ~¹ÅŽV. î~âÖŸÞãñ¯\ðO4BnBî‡xk>ýEšKÚí +ýI²åšP†zÙìq.¨øm«/ûm“x%?‚-7‹Û§–¦Î™¿|ÏÇ ûC ) #SQ’Êl^û²”·t™$Æù)™éqŽ’:HG"÷Z"Q[zuTÏ|CP¿êýO<Ó||”,O&_=>O¢,ŽOw`ÌWW¤ - -9‘TÙeUFO. P_¥‘V&™Ê1 ¼¯ -÷ÆΔ‚a»R<¼Íé1MÎXR!!³¥–3BƒÕ kî¿åîm— øLŠäµC&‹ŸæüÝÊ64¿8ŠÉ¢ÀøŠzŽ»ò:\²É+|_UÍ«¯d¾ W²ö(œ,ý‡ãDc…"zæ*ö’Ói”À ©;sN<ªAA'W<áVCÏ×Ü™¹â›ØÈéÁ5<ð“Ä£¨šìMÝêTt§0Õ%Jÿ¼åiÎdF22i€¹åßÎœ Øáeöà¯Ge& ļž&à‡Ó4À÷yÿªM¤Ó`ßÀZ -⤱Sû#
ër5ètJ…aÚ‚_Óõ
7†ƒì3÷|GK©³…N ©DÙ¯) ø@Q•SË;kSöòæüm-‰4½œ•KNŒÙ?ÁàÅZÍÕ©ÉÓo™6õÁkAÕëÝ°¥, ~¦ÊW‘±ÑC'6zË…“¡]#§7ì ö`%üçÒáÛÔmŒÃü,Ž”5G×e|®üÕj!+ ýpü 6nù~ß“(þ£õ—ý~/wýŽo -‡â—+#œ^±ú¦k¹»‹VÖ^ ýY>'`ÓË·G«Û»ÆgŠ}›?‡sëÉõPTþ<{¯²!-& 0Ôš»õ£4¤‹Z‡ãËÓ‘ ·á¨ˆX™¥ô98ìi¶˜EJ›P–Ä›AçnúÙñÙÚÜ¥~…çÖjî -~|í5íß¾ð?ü=$+ Ä2Ü埮=N"¥2á™BÆE,ŽYpÊûÿª–³ßendstream +1778 0 obj << +/Length 4061 +/Filter /FlateDecode +>> +stream +xÚÍ[[wã¶~÷¯ð[åsV\\ì9}pö’ºMœíÚIÛ“ô’h‹'©);ίï f +ìVµWS²IQãÓNšMW5u±bêöJºÉãn]Ö Qž—Õ|I]çeÕ-a&Oƒëb͆_Ý|à1 ?jÙò÷ÍÃÉoyüºèx9r° X½q9¯gÙ´ÝÈ¢§©†³HUÊ$7F‘–Ínµ ø´+·/Ô¬ê¶+ ¦#{øôìa#0å_n÷i-ýXUðù" EÜè|¥³Äê<ìÁë²›¿Þ–m³zJæMý0Â?,2K¥æìq9ÕZ%Ú s9Uа–tÿ ø<žR®g6HiZŒÌ!Ó$Mã.¿#ŠÕ + ’—ê5ƒWÅ+-?íª§båµÃ˨ â躪~ì7ÂPÊ*â’¦Og9Úg ¨Y¾Eû+Nt¬N%RKõyµP2qƆ ÷ëâWÞêâH5¢6¼l¸Ïõí¿¯¤”qS`Ì,ÍÝpSþ¹,ÑÀ¤>!4ƒT‘é›1a€ž[™ ‡ô†Ï][.^ˆ$-”–gD¡’Ô¥¡ÓsµZÑ EוëMÇÌ7øT“EÕnVÅK¿"߸ûášdßóÆ?Ì݃wÐø½©YfÈ€L@Å-sàÀ›Ö½×ƒŸ¡Y3«g–1X½€1aíÁêi3‚}j•NŠ]·l¶UWtÕSI¤à~LoÕH&þ¡á ‘oáJ0hhíÎÓppúšüZ?^: ܧ™,Ê_„Pu`höfánï¨ß¡PqbèΈ3¯¸Ô›~<4»`.ÁaEoFkàÁ¾Èä6hÉt>®§*ÍÕTKïU·Wn²›w¸tMîßÁ!¥ Â[¿hh å]ÉÉ ýò…ç|U´í˜ +I‘XÜnš|¯ÛP‡òĹè q‚åVÌÕ¼`†g%=Ñ®† ¯šæ×݆h-ÛªY0ƒ[Ò;eMâ¤PÃíy³,š¶.y‹ˆ;ßäxØì|c^îSã†'¨Û‚
_/ʇb·: ,øæ›[z¢#¿©»r 3£7?ØlÏÙOÞƒ•ÛYÓúÑìºÍ®£6h'e]n m5õØ×H€ÆXyÖïæÊEgã#yÂ9ê$ƒp”n1 )ŒÌ‚ÒmǦÔ&;n`ynz &$´Õ¼ÀósÃ"ó pÏ=´{a’ƒ„/2 ûúCb”IídY 3R© ô²Ú†|ÝSµð +Xí©7 +rrý‘ê_!y%‘G³œÞŽ#.mÍäJ5æajÒ +€„àí$uó0"ü©é[yà1No‚Ã=•{ud´Šº|,z ¦ô;-¥yu`z‘ù½ÊÚy °pm°2Ø ó3°™Û¦ž²åî »yâøõiw…é.ˆ-YpקŠævϳÄZ+wÛÚ Ýs“»P'¥ *f§á`œ+pOLï‚øø–¿ +œñj*Gµþ¾ÃEÞë½ÿØ ×…yʶk¿®¾¯mLЦéxE"3ò¨¶g gúö¨·‰ÔÙùS(‘Åé½µX¬H¢¬•
Ù4n><¥D +± ˆ^&›fë3«N-ÑŸ‡ÅrØ4û?^c°ÂkÙˆbÇÒhXù×lµI]ðìÓn\ NeG°ŽÓGçølD9òŸH!s 6E^ç"«H{Ù”cØ_Ú,6VAýëˆð +_Š‡·=öF`“³TaÆç
˜-µ¼Z¬ ¬¹ÿ’»·]±å3ü*‚BÅvÌdñÓ‚¿›…Ïzƒæx‘, +Œ¯¬ñ¸«¨ã%›bŽïW«æ9T²f/‡•¬ž=‚“Uøp?ÑF¬P&\Åžr:ø‹T:5™u#çÄ{5(èä‹'Üjèù\x3×|S=¸&â ü$ñhª&{BSwäuVt§1Õ%ÊîqÉÓŒ[¾Q‰Íb3ýç‰×Ÿ Œ âõ¨Üƃ˜çSÃdÿá5
üûx|561Y´‚/`-:%Xî©£¼LBü‹ùën»ÑiƒÓ:¬¾9eo‘Ø{´€¯Tt7-X]í-Θ|¼¬d4 xÆõE£ÒM =Y‘còê@—24à¤}§ G@ê×åkÐOÞÑi ‡iK~M×7üá
²ÏÜó -O:M¢Sí>§$ebðêÀ²{ä”q”·§ok¹Df™=_~T+q|‚ÁË´šªSS¤·Á2]ÀkIÕ°£#^øÝ›*_HeÎFØè¡ ½Ã¡}£ 7 6`%üMàÒ2ZËüÆxŸŸ‹ ØÁu™+¶ZÈ +H?| endobj -1771 0 obj << +1777 0 obj << /Type /Page -/Contents 1772 0 R -/Resources 1770 0 R +/Contents 1778 0 R +/Resources 1776 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1748 0 R +/Parent 1754 0 R >> endobj -1773 0 obj << -/D [1771 0 R /XYZ 85.0394 794.5015 null] +1779 0 obj << +/D [1777 0 R /XYZ 85.0394 794.5015 null] >> endobj -1770 0 obj << -/Font << /F37 743 0 R /F53 957 0 R /F23 678 0 R /F21 654 0 R /F39 858 0 R /F47 874 0 R >> +1776 0 obj << +/Font << /F37 747 0 R /F53 962 0 R /F23 682 0 R /F21 658 0 R /F39 863 0 R /F47 879 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1776 0 obj << -/Length 2189 +1782 0 obj << +/Length 2136 /Filter /FlateDecode >> stream -xÚ¥X_oÛHϧðÛ)@5¿’fq8ÀMÒ6»mš½À ²}Pä±#T–¼–œ^îÓ/g8R$g’8øAÔˆÃ!9ä¤ÙŒÂÍTBÍõ,Õ’(ÊԬ؞ÐÙ¾}8až'î™â1×»åÉÛ÷"i¢žÌ–둬ŒÐ,c³åê&zG9 4:¿Z,.Îâß.þóáâê4f:S:š___\_þû4æŠ3°R}ž_ý1ÿ„kקšGó‹ÓoË_O.–ƒZcÕV§¿Nn¾ÑÙ -,øõ„'Ì~À %Lk>ÛžH%ˆ’Bô+ÕÉâä÷Aàè«Ût£„‹„|ÁÙŒ1¢•âg(MÁ…sÆåùµøãúúË×S¥¢¥5 6‹‘#é,æ ÉÓ¸kíy؈'#™¤°ZŽ»¦ír8#JÖ3å- ÎÒèÖ˜ÚRYt{(«”Ý .¢’°ô'U´¬;³¯ó®lê¼*ÿgVøiÕlóÒ ©óV†_ÚÃn×ì»7ðÆeTzéEî™ó¢0;¿˜×½´²ÝUùƒ×Ô±µe ¸‡T@Ø
n+拳ËKàLÙ£@[%Zð£”h)^ó'4ISÏ”ïvûSP¥Ùí˼3ÕžQ4õ½Ùw»Ë÷yÞÁWSͪ¬7øÖ¬Ã*"ukÖ;À¿·¦v[ÕŒ BÄ•7Ó(ÎDG¸ë¯ƒi;\èûÌlráBkö÷N' ÿôþEX´Á¥‰¼³^×höÖ˾3(ÜËLeù)’ÔF¤ûðÐ þ±BæªünÆ*Á󰯑
¼bשÚÇ™UCÆ™O§·mý .j¬óç^å¼mjˆ1!À:ˆ>ÊkÓ"§•ï."g\šråoØž}'œJµҳD' €Ô?(œè,ËÂpã±HÄͱnœ¦„g2}<Ùªx~¹˜¿ûtV©•’{SL}_âµÕ[Swè„û "÷¶2O!
—wÞyÎçΟÞçî¥lñ+ĉݴò«k\õ…‹Ñ - ,™ÞPâš•dŸéøqX@/ -˜Ÿ€cã QbR@ÄjÖ‡a^mš=ÔÊm ®”S¶OÌø6$-%Z ‡·PT¢dJ2N“^Týª(OÝÃ.$ ÚhÉzµnâ" ŠŽfTzž¢ÊÛ6 @4ˆŒü†^»‰Í@¢ER%zÑë*ß„$KÈßAÇo8’e„)–Mç&Þ¼j€T¨ w@»¨’'FÜ
Ô÷Ú² (™ðÛwû¦kŠ>
W˜ Ÿ³ÈŠd‰ê‹Ó £f»2÷aåªø±ÐöU¡m·7õz¼ŸV´ È„¼ó³„M»“gïD ¾UÙÊÜ›êgã¯~D»ã¢ -¨7)`i Z‰z S™ÂÍXRúYˆbÿ°ëšÍ>ßÝ•.
Jº -Pµl`JA{$Ü¥Ñ[|<¦ j P –€r°äžÝü›^ãH`ôÁ©Ì<#¸ÃŸw-ðÑCKð¸À¿5ˆ‰zt8¼À˜o‰¬ïMt$©N<# n}ƒ k}×”
`«Ã‚Ñ* ¼à,b”ËGÁ“–À§ù/”{$·‡ª+`Báà R.‘$”Çý†×Ryß«±ïá… å=jzÇ?óŸ6´Ãöè@®Ð¡¥ø¿ÿï~ü_ & +xÚ¥X_sÛ8ϧðÛ)3Ë?¢$î›Û¸÷Ú4Wygî&ÛE¦ MeÉkÉîæ>ý¥H“tæÆ) àÀlFáÇf2&±âj–¨ˆHÊä¬Ø]ÐÙÞ}¼`Ž'ì™Â1×»ÕÅÛ"™)¢b ÏV›‘¬”Ð4e³Õú6xG¹ 4¸ºÎ²ÅûðŸ‹ÿ|\\_†L¥Ró››ÅõÕòß—!—˜•ÒàËüúùgÜ»¹T<˜\d—ßW¿_,VƒZcÕF§¿.n¿ÓÙ,øý‚7Ì~‚¦Ÿí.")ˆŒ„èwª‹ìâ_ƒÀÑ[{Ôë +F 1÷ø‚³cDIÉ'ΊĂ ëŒåÕ5•ýqsóõÛ¥”Áʘ‡ÅÈ‘tò˜¤Œ)<µq<lÄ“’4¢)°Žû¦í<r8#RÖ3å-\Î’àNëÚPipw,«7–Ý=n¢’°õ'•´¬;}¨ó®lê¼*ÿ«×øjÝìòÒ ©óV†oÚã~ß º7°âQP:éEî˜ó¢Ð{·™×½´²ÝWùƒ×Ô¡±e +ø‰€°Ü +V̳÷Ë%p&ìQ -ñø‰QJT$^ó'4NÇ”ï÷‡KP¥Ù ʼÓÕÞQ4õI ºÖîóC^€wp©ë¢Y—õWÍƯ"RwzÓØ ÜºÕµ=jf\Ê ®œÙ˜F9pÆ*ÀS uÛáFטgj’ 7Z}8Y€nÜÓùaÁ·&òöÖBXnÐì“}¯Q¸“™D䧈‘öÅCsüÇ™«ò‡ «Ïã¡F6ðˆÝL¤*gFe k>~mã§PppQcœ'8w*çmSCŒ ÖAôQ^ë9|û!rFaÀ¡ —î ›»Ïà„Óˆp%Õ,V1(©_NTš¦~8 ‰áX$âæX7NÂÓ(y¼Ù¨xµÌæï>/<ÁIB£ˆ;St}*ñ³Õ;]wè„S‘{Wiƒ§†«{ç<ësëOçs»([| qbÝîwCáÃ( PO¿Pâš‘džîøyXãA/ +€ž ÄÄ®ÙûoË›Õò뵧0÷9ÔžAj¬ +¸âÁ±uïÜð +3ñº±¹—¨€ýfæ.3;å î`ˆbÔJio ¾±½x‚£ <À€µ©ˆÈj§4õÛWËÜ(+±ŸÑÍ=Ù|$ ME³ §ƒê×zm‡ÑàC \²÷ž›Î
JBG ¼äƒ¿¡ø©(¿©Ù8v0…we‘WÕÃÙx‚áDø£G-*ò-y3 dP¨^ÁŒ× ˜ÑsMšÅ fÀ +'8
åÑ£àÉKCàSÿ
å ÉݱêJ endobj -1775 0 obj << +1781 0 obj << /Type /Page -/Contents 1776 0 R -/Resources 1774 0 R +/Contents 1782 0 R +/Resources 1780 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1748 0 R +/Parent 1754 0 R >> endobj -1777 0 obj << -/D [1775 0 R /XYZ 56.6929 794.5015 null] +1783 0 obj << +/D [1781 0 R /XYZ 56.6929 794.5015 null] >> endobj -1778 0 obj << -/D [1775 0 R /XYZ 56.6929 751.8114 null] +1784 0 obj << +/D [1781 0 R /XYZ 56.6929 751.8114 null] >> endobj -1779 0 obj << -/D [1775 0 R /XYZ 56.6929 637.809 null] +1785 0 obj << +/D [1781 0 R /XYZ 56.6929 637.809 null] >> endobj -1780 0 obj << -/D [1775 0 R /XYZ 56.6929 571.6272 null] +1786 0 obj << +/D [1781 0 R /XYZ 56.6929 571.6272 null] >> endobj -614 0 obj << -/D [1775 0 R /XYZ 56.6929 530.4875 null] +618 0 obj << +/D [1781 0 R /XYZ 56.6929 530.4875 null] >> endobj -1781 0 obj << -/D [1775 0 R /XYZ 56.6929 492.9536 null] +1787 0 obj << +/D [1781 0 R /XYZ 56.6929 492.9536 null] >> endobj -1782 0 obj << -/D [1775 0 R /XYZ 56.6929 459.984 null] +1788 0 obj << +/D [1781 0 R /XYZ 56.6929 459.984 null] >> endobj -1783 0 obj << -/D [1775 0 R /XYZ 56.6929 390.8804 null] +1789 0 obj << +/D [1781 0 R /XYZ 56.6929 390.8804 null] >> endobj -1784 0 obj << -/D [1775 0 R /XYZ 56.6929 303.7532 null] +1790 0 obj << +/D [1781 0 R /XYZ 56.6929 303.7532 null] >> endobj -1785 0 obj << -/D [1775 0 R /XYZ 56.6929 225.6163 null] +1791 0 obj << +/D [1781 0 R /XYZ 56.6929 225.6163 null] >> endobj -1774 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R /F53 957 0 R /F11 1293 0 R /F14 681 0 R /F55 965 0 R >> +1780 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F53 962 0 R /F55 970 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1788 0 obj << -/Length 2917 +1794 0 obj << +/Length 2915 /Filter /FlateDecode >> stream -xÚ¥Z[sÛ6~÷¯Ð£<\y™}rçÒ´v6Rf·Ûö–(›ŠTEÊÞô×ï98 - …°ˆOßÞÍç·ofŸn}{wýÇ⧫ÛEGVHºà -iúóê·?ød'øéŠ3«M^à3‘¦r²¹ÒF1£•ò#åÕüêŸÝ‚Á¬}uˆÚ$ÌH Mf -{.;„ ¾4ð$ðÿ+B}¸Ÿ/f·‚öönñqñ+Í h€‰ìhݬiêe‘µùŠž_à8Éh੶'=pØOÃý)È.¿Îo¿àaexrÚÚ5:Ú5êv„Gî›|w´ Møï Âla4ÐäÔµ:иw×dFËÌCŠªÉ«Yÿ@$–¦h‹çœx gŠQ¬Q›Õy{
QãöÚ¡¬½.‡ì•3©ÀO’.K`㉱JÄI’ó”u¨ÒzƪÀ¥i.ú´}¬VÅ„‡<Õ -Œ0k}/§ˆ;rJì^Ö¶]Ñä²®Ú¬¨Šêñè-Rè4Oõ¾tè§ì9ïáä´éœ…_9¦Ï“éÇ5Uµ#Ê¢I¶3‰ Z‹¾ˆi¥W6ˆ©¶ûñŽÚÂ=ƒN®ÆAI&“ä’"¨3ŠàQVNüqª˜R‰<¿¥
l -bª©éoiY~ÌÁõf- -ž³ŠÚ/ó›_Þš×ÐÌ?ÜóøUÇ+÷5%Þ£Íÿ»Wµãìä‚Å ¡ ì PgØéQ–ë»JY”(oVë2{<±*‘°HA ?KW‡ ¬gUR±H@äëQ6ÏQacáô :}=Ñ“s•¡0btYGèä •.Ý[6X†ÈC ¡¥úFŠv+BñõªüN={¬Š¿IjÈÊ /J¢¾•}š"Ù[·n- æÅcÕéŒ:Gol’†RP ÑcR¦t|AKBÔ¸–t(«%ÃÙ -Ê‘* +xÚ¥Z[sÛ6~÷¯Ð£<\y™}rçÒ´v6Rf·Ûö–(›ŠTEÊÞô×ï98 +Y\!O^ýöŸ¬`?]q¦`µÉ <p&ÒTN6WÚ(f´R~¤¼š_ý³[0˜µ¯‰B›„©£É ÀšGé°À8ã0‹µ`<¸˜Có(ج¾~gL€‚%©Î,¤Ê6yû}› KDhÍbc‚‡˜ëPÜ©¦NY¬¢¸ÏÞ|›/‹ß9—yÇ%Óö)§NýRå;ì¦SË
®Pßòï×Bˆ)œ°ŠÌtAãéô9+÷‡w¬Tp#EÌDlÄ€Žø6œéTiÜì›––Í `bGýGõ?÷w·4ò;7|]»é —Ì™6 '3jŒ´+’RÔö¯ºÂ•Ra÷e‡p!PØ× +Rúb‚>Ý;IWf fB¥ðR2•èähSGœÈˆ nú +5⛿R-Ú£HÓ”lì[·P’%ÉX +Š±—šê_*û{#oÜ÷{ ñ4yȨ°ƒÑºr¯ÛT æ,ç~– ÛPb&#Åb.Gü4CQ
•¿J±ÔV!¡7vÅ鱸·û‡Ò«òÑGL—ÜŸ$‹ c¡ƒÁÆž15:eKhÌt7Õcì¸÷{üŒ‹2 Y4 ¸¼Kþï 0 ÌNÇ&'r8sZ)’qLá&WǬ¨”Lb8åý6A&Æendstream endobj -1787 0 obj << +1793 0 obj << /Type /Page -/Contents 1788 0 R -/Resources 1786 0 R +/Contents 1794 0 R +/Resources 1792 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1791 0 R +/Parent 1797 0 R >> endobj -1789 0 obj << -/D [1787 0 R /XYZ 85.0394 794.5015 null] +1795 0 obj << +/D [1793 0 R /XYZ 85.0394 794.5015 null] >> endobj -1790 0 obj << -/D [1787 0 R /XYZ 85.0394 181.7045 null] +1796 0 obj << +/D [1793 0 R /XYZ 85.0394 181.7045 null] >> endobj -1786 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F55 965 0 R /F23 678 0 R /F39 858 0 R /F14 681 0 R >> +1792 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F55 970 0 R /F23 682 0 R /F39 863 0 R /F14 685 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1794 0 obj << -/Length 1916 +1800 0 obj << +/Length 1931 /Filter /FlateDecode >> stream -xÚ¥XKwÛ¶ÞëWhqòiˆâE¸;ÅVRµ±ìk)ç´7ñ‚!‰- ŠH9U}H‰2 ¥§G ƒá`æÃ` C ?2 Šªa¤8 -1 ‡Ë|€‡kX{? Ž'h™‚S®·‹ÁïX4TH *†‹Õ‰,‰°”d¸H>Þ"Ž®@ ÝÌæóÉu0Ÿ¾Ÿýÿn6¹ -ˆŒH4ßßOf7Ó_¯b`fŒG·ãÙÇñK»¿Rt4~?™_=.~ Lb§ÊÌŒV_Ÿ ñ0~ `Ä” ‡_a‚QŠó -9c-%Ìÿ랬6ŸzÁ Q&¨
Ê|h„ - KÅF# -CÚyýáãÍÄú@UǵÎuQÃ5ß``h#N¾-Å !Zh·»ôyà©”`r/ǧðÂ,ÎÖåìÈÍ”Œª^¦†{i—ÍPgIeÜXâÑ»Ætà+Ÿž¯È(-÷•ûN/÷ æ`¿²€ÅUYTo€" LZ %¶ª$¥vÔ¢¬-pè ‰3à6ñ³¶¸u¡wqf'n›Äζz—§U•–…Ï·% –PŠ"ÎÄE_Å’Pljßé1‹¾ãd8 ‰z'(P°%¶Ù‰5µñX3]èÍ :ä¹®wéÒL£‘.–»Ã¶³Œã6ÜûåÆ-¸M~º _·7á 8!’!€ÔC\?ëÂÂZoÊýzÓŽÝ1l÷OY£ -÷™2ÒÂÞ©-!¶‘ÁSZ› ÄîùØRš@±ðÅÚÈŒsæpMìæ\öî A8"Ü þ3η™FË2÷h*B…¬å}cDóv»fYù5-ÖvK‘[8aík¹ÏKrìàÞ{ü×£S@…@’çôIQÁÍ Àʵ9O™(ˆíACx²ÿ -29ÏbÃÙæýH÷û<Ÿ¸ì7þ0¿»|« ºUº.Lv6¹XštéÎ…ŸÖjR"©Â¶äx;ÝØ”Û0ÉÓ"7‹ëæžéA¯´=bé<í6.ö[|HJDiק - ØîÏ)eÌ$˜¿P½}}©ûß ¦¨endstream +xÚ¥XKsã6¾ëWè°¹2D +©=h„Ô‡—HPXÒh,6J €“G¬D¢(Œb¯yÐ ê`˜zòBC,-ÓWŒÃ\]‹Ñ²*›$+k3Kô_¤Ñ6ó_&¿™ÁîŠÄ#µ¬ÚÿÔКMÒX!IiOÊ +i¥ì÷eÕÀ"Ð7¤Ø&yV¯µ*Õ.ÉÍÄn“šÙV튬®³ªôâø¾#y€dˆðõ·}4B‚I‡vR¦~‹ÌÅwY„s)zÑ(D|”˜é‰°G5ž +k«wÔ‡¢PÍ.[š©*—»Ã¶c›Ï:CZ™õ~¹±Ò-å§ÛñµuOÇ' VíÛþÎ@ªžUiFͦگ7nl±Ý?åZ
=Ö ¢=x;Ñpšew²VìŸ{àÉÁë‘Ň ;VÚp #I9kÕ™ü:¾½ÿ4ñ Œ`&¥a\èx +·9¤ÄwEÚ=˜¿HÄÁSÖè DîùØPš@iAÖsF ¤U—Äl×èØÞD_Afí¨þ—Û\¡eUx4 Eœ:^.en»æyõ-+×fKQ8aí[µÏSC²ìàä{•þÛ£S +âh=×OËîg +ÈCAbþ[Z“ù€,Áršœ¦Go ѶZc¿œ&î4ÆOÊÆ:‡‹…;ƒŒ«Õ‰¯e +ß‘O¶ýåHIôÆô‡P/ë;mÓw +3wÜw‹¾|1Ä0
9ûðzŒCº ¿´Q«i/}»£2ºPð:¶@PÄDº uæŒgb lË7ƒ !q—„»
L ò8ã'1ùdóóñŽPxXte€ïÊ SïêÏ'6MŽ?Íï. +…! O%Î.J¬«$€N5KòóÚ¨A‰_Ýê¢thÖÇjw^„9E˜ž6kΕÏB ¡Ç¯<mÛvž½ú7`ULU¤êùÌýÆüàõeÀ›dל»á J ¨+:©M7z>«´“ŸC7•”ûëÑV_±„l&e d kÛ`a¸áN#„ ½™Z<‰¡é%“›Éüúaz¿˜ÞÍ<õíÛu•''‚MiÈܽԌ:; Ö–öÐþëÏT¹œŒ¦!¹öÖ2ÎL–„Ó, +!@¿‹zª"Ü]¢üüúòÐ ù‹ÆqèYL£h•ÒÇ$˜½RÝ=Ô¾Öýÿ~·endstream endobj -1793 0 obj << +1799 0 obj << /Type /Page -/Contents 1794 0 R -/Resources 1792 0 R +/Contents 1800 0 R +/Resources 1798 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1791 0 R +/Parent 1797 0 R >> endobj -1795 0 obj << -/D [1793 0 R /XYZ 56.6929 794.5015 null] +1801 0 obj << +/D [1799 0 R /XYZ 56.6929 794.5015 null] >> endobj -1796 0 obj << -/D [1793 0 R /XYZ 56.6929 635.5323 null] +1802 0 obj << +/D [1799 0 R /XYZ 56.6929 635.5323 null] >> endobj -1797 0 obj << -/D [1793 0 R /XYZ 56.6929 476.3563 null] +1803 0 obj << +/D [1799 0 R /XYZ 56.6929 476.3563 null] >> endobj -1798 0 obj << -/D [1793 0 R /XYZ 56.6929 407.9215 null] +1804 0 obj << +/D [1799 0 R /XYZ 56.6929 407.9215 null] >> endobj -618 0 obj << -/D [1793 0 R /XYZ 56.6929 365.2162 null] +622 0 obj << +/D [1799 0 R /XYZ 56.6929 365.2162 null] >> endobj -1799 0 obj << -/D [1793 0 R /XYZ 56.6929 326.9947 null] +1805 0 obj << +/D [1799 0 R /XYZ 56.6929 326.9947 null] >> endobj -1800 0 obj << -/D [1793 0 R /XYZ 56.6929 293.3376 null] +1806 0 obj << +/D [1799 0 R /XYZ 56.6929 293.3376 null] >> endobj -1801 0 obj << -/D [1793 0 R /XYZ 56.6929 221.9809 null] +1807 0 obj << +/D [1799 0 R /XYZ 56.6929 221.9809 null] >> endobj -1802 0 obj << -/D [1793 0 R /XYZ 56.6929 108.6903 null] +1808 0 obj << +/D [1799 0 R /XYZ 56.6929 108.6903 null] >> endobj -1792 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F39 858 0 R /F21 654 0 R /F48 880 0 R /F47 874 0 R /F53 957 0 R >> +1798 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F21 658 0 R /F48 885 0 R /F47 879 0 R /F53 962 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1805 0 obj << -/Length 3193 +1811 0 obj << +/Length 3191 /Filter /FlateDecode >> stream -xÚ¥Z[wÛ6~÷¯ð#}±¸’D÷)mÜ4mâdk·»Ý¶´DÛl$Ò©8Þ_¿3˜o¢¤œ³öƒÀÁ -iÏ—›3q~}¯Ï$ó,ÓbÈõíÍÙ×ßëôÜÅ.QÉùÍÝ`®,Y&ÏoV¿G/?|¸¼zõæß eEôm|±°BDï^^ýòò-Ñ>\8½|}y}±Y*S`2È–ˆèÕÕõõåw‹ë7¯¯þóþêòâÏ› Ï.o:Á†ÂK¡Qª¿Ï~ÿSœ¯`?ž‰X»Ìž?Áƒˆ¥sê|sf¬ŽÑ:PÖg×gÿì& ôú¡sÊ°:‹m¦Òm(y.eì¬U#uX'Zi¯Ž÷ nÞ¼¿ºÞÛ‰ˆ…¥JÄN¥jÞ Ì´r……g̸pÝE>]ÒéXëL _20Í,©K‚Áµtv¼ä¯RʨؖwÏdè|½¦Æ}QÛ¼-VôØ”÷UÞî¶2‹Š&>¤›$sq& qT7C®Ãºé¸¼n–¸ä×ß[;à”"Vl+<Ër7ÍT0©l,m– —¬ãšm¨C©Á%cÙ® ‹eù‡ªhHYíCA
ˆ
jl¾YßM˜þ[WÅa…Ú,†ÅN)tÀuD¡Ë+ôãœBeœ9«Y¡ ‹ç=uJgIjËÕqÍ6R§-4ÎP²› '"r´¼½Xh%£¦ÓðŠ(šoä
ÿŽèÊûkYÝO¸Xo;r^=Oúa ß7ˆlJG7%Ï^?¶e]Q{“ó·Å¾p .ÈØ •¡g`S›Ýº- ×lò¶Ü "iãDwÂæ®#6\Þæë›»¼?e“¯êM^V{V·Z$Ç%ë¸fDȦ Ëöšñ”4§Jlôê-ž;¿)Z¢‚€Ä´Z•d¤¶5Q)® áŠ=+ ºü
Z’ÇV+^⺛ í®-Ú½ >Ö†ïGW@ZþøXT«`jÀ
‘X7¶µ—dáU¾)?ùù²ö¿«Ã>aS§žHûÄë°Ot\Þ'V'q`Un‹e[o÷ÑÀŠ8…“ø¨piF¸‘WX§Òè±toëú#)êTäÕn0Ê -™WhÆPì+7ÜùôPT#~=J$þóÏP)PsßH@¼Â†‡~Ê×%f¡œåÃ9–yX „`D¦d -ШâÂ¹ä ŠëÎc„ß”ëPß
N@VÚvדÉÆa &˜ÁN_q5Ü6’w‡ UýôÕULm7ì7
•7gS¯‘1 Ev -å9@KÒX¨ H‹1£”R1TÒrl}–àPI§xŽ½Š»¬üfûrá°ÿk“¸lr ñŸÀåýça¯úÿ6æÄ’ifÉQõåÀìdÉÛ²jùÀÏ9x¨·¬ˆf·ÙäÛçtÅW\å>Àïw›¢›¸e°i@¢ºk¤ªˆ] õÐofì—š8qnäsÖQióº™Éë°u:.oòÔU¨²ØB²Ÿ˜€fÀvT¶ŽkF¸qb’@;•céþÕe9ý<Òéñ©¬wÍš–ØöZö’³‰Ç¼iBoÎ4 x8 -5Ÿ›ø»MlÜà †Vât£&¨!Á2Îe3Ê›ìx¡Á V‰É¥Y¸b gÕÍ4Õ^®Cm–ðO9sæ<ø7H~G—“ÒÁExXÓ”n¾z fÝe5*D0³ö¥…êJ‹œæ …-PƺKbú$åÎ -¹öwÒ î ]"W|+± ?Ö\HýÉšÀó!ÄÙì¥(Jྸª
œ‡ý¢ÀÓºv©>o1òËÑ>µêò¦P05¼ÖèÕb¸ÄÏ[®§%TnJMêé^XÒ56.ˆ†¹*0WE§5"T@̉'ÄP` þp*TòDÀY|Ô'証¶ô«a“(y˜¯„ÊþnÈ t:sóÄ°§?ZíŠîðõ¿=~t×Øþw]4Ý tÎ4ÚÞF³.èØçDà©Þ…Û׃Á:w2K¼ú–öDÞ4ä:|2w\þd~s*ïöÇØ”¿!''Þ ¤ÊGåë¸f ΩŒ
$Ýc oBNÍ"@ÛpÂmû„›SPì£Ó‰!…<ÚD ê¦)o×1Ñd
'Ͻ/ìeZIœ&"d¾@åÖŸ[ü <Šs¶óaã+Ýù¥B’>Žp‹L›Á*ÛüéÐ"ÏËLMóù²üd’Ïó-®³ýyïlhÛ2Ô O† ô¯ÚüÕÔ y)<S ‰- -zh¬ž«|S.é!¤GØï\ótˆ0ÜâW»Í#H¢ +xÚ¥Z[wÛ6~÷¯ð#}Z±¸’D÷)mÜ4mâdk·»Ý¦´DÛl$Ò©8Þ_¿3˜o¢¤œ³öƒÀÁ +iÏ—›3q~}¯Î$ó,ÓbÈõÝÍÙ7?èôÜÅ.QÉùÍÝ`®,Y&ÏoVD/Þ¿¿¼zùúß eEô]|±°BDo_\ýúâ
ÑÞ_8½xuy}±Y*S`2È–ˆèåÕõõå÷‹ëׯ®þóîêòâÏ›ŸÎ.o:Á†ÂK¡Qª¿ÏþøSœ¯`?‰X»Ìž?Áƒˆ¥sê|sf¬ŽÑ:PÖg×gÿì& ôú¡sÊ°:‹m¦Òm(y.eì¬U#uX'Zi¯Žwïo^¿»ºÞÛ‰ˆ…¥JÄN¥jÞ Ì´r……g̸pÝE>]ÒéXëL _20Í,©K‚Áµtv¼äoRʨؖwÏdè|½¦Æ}QÛ¼-VôØ”÷UÞî¶2‹Š&>¤›$sq& qT7C®Ãºé¸¼n–¸ä7?X;à”"Vl+<Ër7ÍT0©l,m– —¬ãšm¨C©Á%cÙ® ‹eùAU4¤¬ö¡ Ä5H6߬ï&Lÿ«â°BmÃb§:à:¢ÐÀåúqN¡2ΜլÐÅóž:¥‰³$µÇåê¸f©S‚
g(ÙÍ…9ZÞ^,´’QÓixEÍ7ò†Gtåýµ¬î'Ü@¬· 9¯ž'ý°„ÎïD6¥£›‡’g¯ Û²®¨½Éy‰Ûb_8Pdì„ÊP
Œ3°©ÍnÝ–k6y[nŽ‘´q";aó×›.oóõŒÍ] ÞŸ²ÉWõ&/«=«ƒÛ -’ã’u\3¢ƒdÓe{Åx +J šS%6zùÏ߈Ö-QA@bZJ² RÛš¨WÐðVŞ +ˆÄŸ/‡–ä±ÕŠ—¸îfG»k‹v/¨µáûÑ–?>Õ*˜pC$Ömí%Fx•oŠÁO~¾¬ýïê°OØTÁ©'Òã>1ä:ì —÷‰ÕI X•ÛbÙÖÛ}4°"Ná$>*\`šnäÖÆ©4z,Ý›ºþHŠºyAµŒ2€Ç©ëñ +}Äsæ†l@ÛD2†ê:@59ûdV-ã<tnû“™m«, äSü‡¡dß9íu¦526J&'L;à:bÚÀåM{?“Od.9±d`šYr’Odi:YrÅxü]Ï:yoP: Êõª? +C·g®7ôĦõm¶ «Ñåç²i=¤Ÿ\ñ© ÉÍí(ú6õ§bu8ò ËÐBÙæp 1OàòæiN¦4M›oÛžû¡Sš$=.^Ç5#ß(ø؇n¶Ëk|b(¬BcEæš1ûÊ
w>=Õˆ_I ÿò T +ÔÜ7o°á¡Ÿòu †Y(gù0FŽe^Va +îÝKÈèEEÌá†ìÒóRË˧ðxZ•Ä¤=åö™×§Ÿj·¹
¢•<ÿïð÷öíË…ß‘Ÿ'/üñíÛëkô÷4ªê6ÇCï xVÉH ø³ ©1P³! ¨² +<²‰èw<bÍ9©†-&&ù'µ.NS›1+{¤Ñ +S|=R‰ +’U c3®è±G
PÅ…s ÈA×Æ¿)ס¾œ €¬´/ì®'“Ã>L0ƒ¾â4j¸;m$ï;ªúé««˜ÚnØ; n*n&Φ^#c8Šì +Yw9ÔαK[é§>qA2ä:Œ] —Ç®»Ùb9ÉtÐT½k wíâ®\ï£$T&Môqñ:®ùÆé™MÓ±€¾LÕ2‰ª ÿ!£
4˜†…&þ’M IX"ú ºç…Xh¡Î¥{`mÃÄx‰âDº¥‚\+ífÛƒ·/®XÓ3Ês€–¤±4P9cF)¥b¨¤åØú,Á¡’Nñ {wYùÍöå–à‡}H¸X›ìÄ…Ëëˆ.ïC{ø¸1'– L3KŽ*0Î`'K¾ß–Uˇ~ÎÁC½ee4»Í&ß> ¸Œ k®0¸â¢,÷A~¿ÛÝÄ-ÎHÊ8ÀÕ]%U
Àì-ˆ¾3cÃÔĉs#?˜³ŽJ3˜×ÈN†\‡Óqy딧®Ã@•Åªýä|4¶£²u\3““Ú© K÷¯.ÓÈéç‘NOe½kÖÏ‹œØåì[%'yÓ„Þœi>(ðlj>5ñW›Ø¸-† ÄÙ +ÿLLƒí2fFo“Í.t»5 óQ ‡ÖqRÝL3ýçå:”a ÿ”3gÎS€kƒäwtg0© \„g5Méæ‹jaÒ]V£:k_Y¨®²ÈižP×e¬Û¹ ¦ÏQî àû®õar!h„Íf²Û,/ƒ½·LæÑ4b¸7“ºç V¿OeS »iÊUA#W¼rM¿·¼ª—’®Và©©ëÊOæ<4Ìå.íñ{–Çu¾ä*Ä…PK´ëÏ2 ‰Rw¤H§‚Þ›Û?5ÄÀn¯£¿wq ñq
{ÛnÒ’Ü·[-™~[´OEÙ€{ôª‹H*T]vˆÍþ2ªk%
âÞÑ rÅ—ûñc- …Ô_« <B†?{'Š¸/.jCÈæa¿(ð´¬ ©O[Œür Ocº´)ÔK
¯5z³îðó–Ëi …›R“rºV§tK„Í„ëa aªŠLUÑisâ ñ”˜@‡? +…<p õ :*¯-ýjØäJ æ_+á°¢¿šr endobj -1804 0 obj << +1810 0 obj << /Type /Page -/Contents 1805 0 R -/Resources 1803 0 R +/Contents 1811 0 R +/Resources 1809 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1791 0 R +/Parent 1797 0 R >> endobj -1806 0 obj << -/D [1804 0 R /XYZ 85.0394 794.5015 null] +1812 0 obj << +/D [1810 0 R /XYZ 85.0394 794.5015 null] >> endobj -1807 0 obj << -/D [1804 0 R /XYZ 85.0394 751.8312 null] +1813 0 obj << +/D [1810 0 R /XYZ 85.0394 751.8312 null] >> endobj -1803 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F55 965 0 R /F39 858 0 R >> +1809 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F55 970 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1810 0 obj << -/Length 2888 -/Filter /FlateDecode ->> -stream -xÚ¥Z[sÛ¶~÷¯Ð[åi„â pÞœÄͤi“œÚ霶´HÙ<•HU¤ì8¿¾»X€)’>3~ | -<(ÎPaXœ€*¹Åü·lÛâ@°ÞŠJ³4ÆÁê}[ÖhÈðe³/ÖåïœË¢m–õ»¥lû©¬òú‰ÚíCÖð©Ün©ï® ç±)rkkê9d0sW~-üä‚Æ›ò¾ÊÚãáRè¥+¾ìK÷äei¦Dœ,VB0ÇÒJÞ–»â™¶}86Ôjö4/ËËꞺÊjM}»¢j³Ã
6….jßUqÈœN ·~´'ÇM`?fåá H -úTd›ÁZ‘YnËMxúÕé/ÒËlÛÔÔÛºgS{\ñ¥©}r )Ú†~?fÛ2ÏÚúиuªÜM/ ¢CÝ=»Î «>º•×ÙšÜÇž#P¨Õº=ºU«Z– ¼R°P¹¡žmf×½·*“Ë긻£½a¬ÞPçÏ?ûéúòºú¦¥îÀ¦vȺ<É -@=ÄH,õ ÔĪ¢ ÇaìL›X¹ P÷ðB
¤‚p ¥°æ¤ò˜s©ÂA–Eq÷ĺ ƒŠbÒ–Š"çeÔ‰NFƒÞÁ¡!p -¾mÄüî jdûž -ÍÍû¿u1»ª»—›aŒ¶þiƒµóO;…ü3fÔ–H&…‰^P[€šQ›GMúKOw -^8m’y:Ôˆ =Ý·F)7}!Þ‡dê h̶MGÊ~þþ
5„ÑÒeÌCÙ>ì€6›iå*É¡æ• f”ëQS¯M_·HºŽæ%èP#"ôtK6Hû2ÜÿX£ž~t3ÂÁzã'ÕÉ=ArØb_¯ &UÌA4-_` !j:Qu(›¨êqþ¡¢4òEÉ¡¼/«3 -\Жƕ€ÚdMK¬BD¤ÄòÎ: ¨E iwƒà0TŽâK›ˆw% U¸N!‡œÕ‹/SiÅǸ•¦N(™ªÓ… -j -¨{’A½Ö 8y^Ü ïï»*× -62hˆˆëT fTæQVe_Ïœ(bÆ=¿¥lÙs"h¦Jô·|_ÕáÇ”7 ºúFeN þ¦ ÞEj8š`!lç
yçóRi]JÁ¤”ê]¨]z É C“,IR3¿µl êü0‰Àz[w3¬Ã -š¦{iµ{{È-ŸÍþ -X„؂߆µëú¡D¦$}Ði^u ñSžì
ãöÐð´‡–þÐÐXcùx>öMz~Ïç¤4P%êó¹|NùO9¯Â/–°aàû(vçû8öDTÓ ‚>"x¤Ñýb lšc‘ÿkDÒÁÿ 8?Ä—Š¼?á oYí3<†íÈïØY߇ ‡} û[ …&ŸúG øß-#±›w‘äÿþ'šÓ¿ E)SZOP3™ÆÀZ í„B…€c';÷ï6ç²ÿ
3íðDendstream +1816 0 obj << +/Length 2975 +/Filter /FlateDecode +>> +stream +xÚ¥ZÝsÛ6÷_¡·ÊÓÁI +3wÅ·<Löº¸/Óæx¸f鎵X™˜›„`6†RšÝ äD‹üxå›ÇšZõž iV”÷ÔU”kêÛåe“n=®·©ë¢ö}^懔x‚½Õ#ž<ìÇ } 3L&I컬Ùå¶Ø䈧_22Ët[WÔÛøo]\þµ©}t (šš~?¦Û"K›êPûuÊÌOÏ@¢GÝ=ûÎ «:ú•×éšÔÇcÈ`wtÇVµ,*œ‚…Š
õlS·î½c™\–ÇÝ í
cÕ†:?†kêû²ªü®¡î¾øÔ2mèëô +ε= Ð(´d‘0vžÈ5BeOÌZ³äÙ' Ø*âzyóñ +É’H¢Î jl#ïÅÉt?QòømÂhÈQN¸Æ7+ˆ]ðûU]wÛ¼]V¨éGzò4Ž®,ø Γ¾ ÿ2ú+Ï÷ø s§àÈ-œ¸û¹W5hŠW#»DÜ4¼] =”óN[Ć)Ó +-ÿùªÂ2kÕYõX_ѼL-Ê™…HËO8ÓT
Ú%Œ\ÀÙ€ÜÈŽ*A +駎fØ–p¦¹’/°ƒša[@MêKw +.œ±É< -j„† ï@[#ÍmŸˆwÝê p̵uš}þñjk¤÷›‡¢yØA𴮧™«8/’˜ÛAÍ07 ¦®MŸ·¢vÍSТFHèñ–d û4Üäÿ˜£!igt«M˜ OÂdP!Í÷ÕúaÒQA>Å$0jÞQuQÓŽªE9GU‡ *Òmjr(î‹òL7X ›yÒZÔmý(Ä0¹dŸ¸ÛÀÈo.Ppltĸp˜/ßm¶ã”9e¯†²hc½ ‰æ|uœºõíÂË(ëãng†0¶]#Ð5!?¸»Œ+#çå×EM˯E9ù}|)Ѐ„cl¦‚ŒÈà ‰ç lQ#ö¤¹7Ü$Ó'ÑIQiîÝ?¶…ŽÚ3D&µƒ·¥I‹²€èÍvµsBÐm t$0~ +:N»Ö4u&èÐwsu t4N8oiDã1‡×žÑ(!¶LÛÓDXü>Mí¡™@C: ´8“ˆè
ë f4, œ†í‡[& ãV¿°e +U×ëì$Mé±°!Љ=¾úUSÿ_ùó]Eúžù‘|;¬r©¤SÁq@ä3 +½\÷øýb,ö…+ Q`É3ruZø¬ ÒCº¦R-àˆ y oëáî= YµæǼµã¾¤ß;¿»/ìBOQ‚R¤YŸ”fX[¤«ëùîã§6¾r‡LOU¶ãX][ˆ˜Å"žÈK!Ïid… X”Y±N›¼në{>ZëË‘jÄ.p$=TÇmÖ¶ðÌÓV‡k–Dò…«‹š±:å¬ÎYÔ”(¦¤¶ó[ÐÈ–]^%†)nUËO‡"$tu÷¿Æ<¬_Ð\W»ý6G¿1ɉ5 ÉãyŽtQÓ iQŽ#/&
Ûü1ßžÕ-5–\ä<a4BX?cY@æØ£ ²¶z™gùÝñþ¾Íu aÓ,‹ ڲ慂`5ò€r,ûv¦D³V˜ù-hdËžAS+ÑßòÝ}Yu VÞß¼o³ •zv„ª;ÜEjø0Á1LØÎ& +ÊÒ A¦y) J¿p!»¨^ ƒo@‡ +&Y’h;¿u +e nYÝ_Ö“ë T=]èObžÁƒ] +×Ä‘«8½RHiñ±üýõ¿©“HXÓ}tÕ +¿öˆÖšÑX9ø*øåfCbDk7•ùGÅuS ž/…ËSæ4¹öÓ=[®ZÄ?G€NÖæÏ-Ï7hÁú'¨'LJM_ÿvõë§_®G"8„ìÃ%kœà“Òv[=7 þ§º#&Âî_S³ ý‘”;$oŸP
À%³õh´Œ~Þ$4 ²Ø¢y Í›@ÔÛ›+jQ††
§ãóòÈËú +cß!+kÈ_W°L
wáŽÆ&¼–aã}ç$ì{pß
ž‹˜OCN% C7å; Œj!K}ö?vǺ!ȇ¢áHæî(wí6 endobj -1809 0 obj << +1815 0 obj << /Type /Page -/Contents 1810 0 R -/Resources 1808 0 R +/Contents 1816 0 R +/Resources 1814 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1791 0 R +/Parent 1797 0 R >> endobj -1811 0 obj << -/D [1809 0 R /XYZ 56.6929 794.5015 null] +1817 0 obj << +/D [1815 0 R /XYZ 56.6929 794.5015 null] >> endobj -1812 0 obj << -/D [1809 0 R /XYZ 56.6929 136.9875 null] +1818 0 obj << +/D [1815 0 R /XYZ 56.6929 119.3275 null] >> endobj -1808 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F39 858 0 R /F21 654 0 R /F55 965 0 R /F48 880 0 R >> +1814 0 obj << +/Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F21 658 0 R /F55 970 0 R /F48 885 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1815 0 obj << -/Length 1618 +1821 0 obj << +/Length 1544 /Filter /FlateDecode >> stream -xÚ¥XÛrÛ6}×WèQš‰ÜIôͱ•Äi#»–Üv&ñMA6‰tIÊŽóõ] -2̧˼ªt:©²»ü{‘k‡ï -Š%ÌÁÓrLâ‘Nj]y•ÚjüŒ1]»ï™ê|/¢Œq¯ï9Ûx½zÐJ¨@‚*¯(ÂH Íœ^§®YW÷Þ¥ltëö¬+Ýü4N›0Ž‘Œ¥ç¤„ h§ÚÅ#Ë{Áh âÂ'Þh ¬ îåq ã(¢Ìž'½„£æ«À!%ETJá öH¨
YkäÊD["«£XÊæƒùtjí8ùm~,¡ …E7Ô_õóÎ?ccø8Šð^nÄÎή7ç³3«G9uËM–g@Õ¤.J»uå]m¼i·>&ù6Y‡B+csléć àpØ–sWoODˆ¯ÈãQ.HË”ÿ¨(V&ô ÿ\/Þ_\ sœtéUë2×.øóç -¸PÙ‡Ó"¯Š²Î¶›ZŽ—ÔÉá a¢lu„RUCElX1IïuúÕSÀ™D K ž$lƒzEc±£WGPcÔgJ#»j^û”‚Ým!jYá¼Ë"àøs^'ß Øl Q]ëW±ó¦P–ŽÏyñPA‚în Õ—A 唀Oc *´PͦH[†Z-fÒa[’ -áôÿš<ÞøÕ—vUÛCŠ Y#ÞŽ|Ž.³R§Àúç@æ Ž$my褮²µ6&x ßoÂüd @N—ŸgÓùéÕùåâüb¨ã{Ù Ô~‚ÂO•/ü
²Úë0–¯ìÃíÖ1>/ê}œ†~Vgiõªßª’Ÿ¡]8S½•]G\4>˜¿˜ -h£ˆazœ;]”mà$Àeô¶Œ ¤BЛ¢ º¶ ÁЎעÖõX((RœË¾yé}Sr‹&<0JÕE€•P ¹daúöt iêÛtU8‘÷I#\@ÏK×Û¥¶Û §)öi=6“@ðŸh»ñ2ôð¶8°N¬‹~°gI54©¥{_Ù¾M o %d¿ogŽså8 m ±nŸûÓT¶ÉÖI¹~öUÍû˳Óv烼bE’ó ðªƒ:Â+jxõ¸¯R1Óž~ Òƒ*»„<Ž¢=•—»Q³ÍâG]VmNv§Í—ÅnÄ9–Ý©æ'Š î]™l\€ü4¬¿eõá +xÚ¥XmsÚ8þίàËÍÀ´VõbÉöGJH›¶!¹@çn¦Í ¸5rÎ6´ô×ßÚ’ŒmÍÍMf‚-¯wWÏ>û"“>†?Ò÷9Â,pû^à"Ž ï/¶=Ü_ów=¢e #ä4¥ÞÎ{o®™×P ¨èÏW
]>¾Oúóå—Áèþ~2½ºù{èPŽoÑÐánGÓÏ£Ojí~ÐÁèÝd6tˆ'˜ B¼x0 ÝN®œñûÉøãønz=|œèMæµcMç f¥Wÿô¾<âþö𡇠|Þÿ7‘ ýmÏå q—1³’ôf½?k…§Õ«608ó÷©gC#°¡Á$e Û_Ê<N ¯å¯TFjÑYëßTýF?Ãís¡EºÕo=¡“µ¯„¹%,à›C +8§•¡
Iô +cöŠxÔõl¢mµ¨t*Z¶‰v ß\ÃVŽ»,E|$|W"7RÅ´ØDå„Oé~HúNÛy‘†¢ @„ø.(¬|ê + Wo6™(´FŸfwöúAÂPF›yá[Gò+,ûðèzᶚ
A.6åâíÍôJ™ ´µå6–q^d!G-=4óK-݆r&¶,~™B«·ÙwQàS ®ÇJ#åŒ[ô¹Q—“ºhXpshÀ‘ xmøFŸçïï ~Û„”‘fæìCuÐiœÊ<ÍŠx·=šus… —K‘çCå€D º0žTuÂYl¢ÅwS,ªØrä îUÂS9ãZPª<Ö›† U%)õÔUõX'X*ËŠ³ÞAÐâTZêéAáO-\*ŒåZ'iš&/!ãA¦Ï9T¬Î !``Ð +†ÖÎ +ÁœâÙÑô¸ ¼-ý¢sµ”Å»9E늶{ãMUsÓ2> e›=å¥ 3•/<;ƒ[F¸@ÐIdžj¥›P«å"Ù-#uslÐñ¾œ +F¥yKË \4…§¼®gˆòF0é"‚N¥Ú"@Ä‘+:3]¨™kâeC°Óìz:´È˜ÇÛ8 ³ä`j›ÁÌPT
mg¹I&°`¿áVCê·ŒTÅ}×dÀ G‰ß˜4B“ÍXÂ)Ñ÷¼ŽÉû,–ÝTÞôW'¦ÉãòéiÅS r],šÃî¨8:¶k˜1u€¤Ž@ô3.Î endobj -1814 0 obj << +1820 0 obj << /Type /Page -/Contents 1815 0 R -/Resources 1813 0 R +/Contents 1821 0 R +/Resources 1819 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1791 0 R +/Parent 1797 0 R >> endobj -1816 0 obj << -/D [1814 0 R /XYZ 85.0394 794.5015 null] ->> endobj -1817 0 obj << -/D [1814 0 R /XYZ 85.0394 682.0055 null] +1822 0 obj << +/D [1820 0 R /XYZ 85.0394 794.5015 null] >> endobj -1818 0 obj << -/D [1814 0 R /XYZ 85.0394 616.549 null] +1823 0 obj << +/D [1820 0 R /XYZ 85.0394 562.7154 null] >> endobj -622 0 obj << -/D [1814 0 R /XYZ 85.0394 575.9131 null] +1824 0 obj << +/D [1820 0 R /XYZ 85.0394 499.03 null] >> endobj -1819 0 obj << -/D [1814 0 R /XYZ 85.0394 542.1583 null] +626 0 obj << +/D [1820 0 R /XYZ 85.0394 459.6249 null] >> endobj -1820 0 obj << -/D [1814 0 R /XYZ 85.0394 505.8522 null] +1825 0 obj << +/D [1820 0 R /XYZ 85.0394 426.4105 null] >> endobj -1821 0 obj << -/D [1814 0 R /XYZ 85.0394 437.4739 null] +1826 0 obj << +/D [1820 0 R /XYZ 85.0394 390.6449 null] >> endobj -1822 0 obj << -/D [1814 0 R /XYZ 85.0394 374.9822 null] +1827 0 obj << +/D [1820 0 R /XYZ 85.0394 324.0377 null] >> endobj -1823 0 obj << -/D [1814 0 R /XYZ 85.0394 309.5257 null] +1828 0 obj << +/D [1820 0 R /XYZ 85.0394 263.3171 null] >> endobj -1824 0 obj << -/D [1814 0 R /XYZ 85.0394 84.1613 null] +1829 0 obj << +/D [1820 0 R /XYZ 85.0394 199.6317 null] >> endobj -1813 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F21 654 0 R /F39 858 0 R /F47 874 0 R /F53 957 0 R /F55 965 0 R >> +1819 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F21 658 0 R /F47 879 0 R /F53 962 0 R /F55 970 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1827 0 obj << -/Length 1899 +1832 0 obj << +/Length 1880 /Filter /FlateDecode >> stream -xÚíYÝsÛ6×_¡Gi¦Äრ- ðäæâÍì*¸üivùÏ?oofÓ€D‚’ÉÅÝÝìæêúi@9r Æxòæâæ·‹_ìÜÝTÑÉųùôÃýÏ£Ù}+XWx‚™–êóèÝ<N@‡ŸG1%ùø 0"JÑñjr†xȘŸÉGóѯ-ÃΪyu ‚e‚ Aɘ¤8§=8¸B‚Qfà˜ÏfV©‹_æ·Z x‹u0Äã€Â{‚WÄ«4y9–ð|géÃ.æa„0c!¼gÀ¾¾¹²ì•Û%YeEV7UÜ”•z›.ÓjJä$-©z›8 †‰¨Â±GŽ¤§f@ Gl 0…0ur_üvÿÓíÛêae讋&Š´±bÌ·u“®jûpYuY5ÙfµÛ4D,Ôñ Áæ`ïdàNüÆ ,žÒŧ¿Ë"Õïjb&‹„%¾’aј1»ÚA¿cô•ÊÍ–«u–§f3ýžÒÈŽ:sÓÜŸã<K²fkŸ Ó¬x´OÞ.‹²xNAa?ß”e>„7îC=ßåºÎêýØ`ER°q¨0! ôeÚSÞ~ÄÑQDˆ -i$Â\ò/IËrßF—¯ ¨ÿ™,“é«¥ûoÉ¢ÿíYþ5+ŒK¤™öNà/ÍÎÿÏ›ûyÓ<õM³×Q0ÊQȔ𕮯«ÙüòíõÝýõíMûÖÑÎb Ø«÷eˆBy¯2”¦õ`“æÉ”íá¤ÞMü—Œ‹ÄNfг<V®˜g“réÖíª¯ÿ™«ÿ¡eÐä^7vrV:M ldpÑS;9ÂI\èɘD„R®Ñs@» ¤r”ÚËQI™jæ2œ¼<¥… åeœØ®CZ5¤UD‡ªbrÿ”ÕvmJ‡D"ׇ’ìŠtúˆ* #›:]nr»ïÒtC0èôH°³Cæ-ªN‡‡TÓëVÖ½Tzý1°g3…!Ù+7Õ®ÅzJWvF-í(Þ5zvT§ôeÓ(ì´¿=·#®/>bµW Q"|ÜYpa›l•å±Ñž@ï7°Ä«¤¡úr”AiL}&Ð
¬”“‡Mc÷Ë»Uœ¿Ä['C²YÝк&¬{èMƒÚ¤Eã J÷¾.<ìPå((<ú°gÚ2àªÐdó¶7fX -~&0Œ”b»[œ€c:ùÝ$ -„ò±ŠÝQï -9k™£PúÂXñÎÑqø=‘Aÿãú 1©“ûyšÃýz•¹D -}`™ŒëlæÀ¬›ú(œà?p¬žqçÑq8=‘Ó_Hðž¿ ¨@î#ºRD’@ }J*Os(Uï á‹zbÍõñ´ÜîÁg%9pøÖºS xríÖŠ²9rؽ‡êÿúFÿw&¨ýAYo 6б¯dL7UlHYÜ dßüm÷:l&% ÆBË +xÚíY[sÛ¶~ׯÐ#5S!¸’à£b«{;µ•¶Ó$´Ù<¡HE¤âª¿¾‹ER”LÜNÏÌϘ °Ü;>`WdŒáŒEˆÂ˜Æã(æH`"ÆËõï`í‡q4SO4mS½\Œ^|Ï¢qŒâ†ãŪÅK",%/ÒwÁK¢ pÀÁåìõü|zöãüì?¿_]Î'S…”³7oæ—ç¿M¦T` bŒƒ×³Ë·³WvîÍ$¦Áì‡ùÍäÃâ§Ñ|Ñ(ÖVž`¦µú4z÷S°á§F,–bü +ŒxÉ \Ù™úÞM,ËB«x·Û&uVvÕ*m êÒÎÝúîÕò£J!² ‹àbeg‹²¶dÕF-3ý½J¿ƒŽƒ¬¶$©Z%»¼®œ¥öä\Ü2ƒqˆ µõZÿª^¾Ðºƒ4 OY¨ƒ‚b!¨!V–YÇ'”¡˜`îx!GAÆͧ+¿D’DÀX Œ
åõ|ñöúÒ&ë/Bã`öêM×^Àñˆ™ýÐh:5þ9¡’¤(¢§V¥í„È@Õ»mQYiIaŸêã3UuRïܪ <‰}dîUm
ŸrëÈ ”åkßRU«eR/À
°c i°}È*5ì ¯nÇ=7ó¹ýxöêæjÀÆ!§¼ÇKøG¾³Ÿ¶<õgY¨Ö²áÇÛ8D '#>Ž//.Ï-“Ø©‘®³"«jÈßrk§®ÕÊ9¡X:?¼NŠ]’¨KB‰h†¦ ƒË®#fo?^]?í‹¢VÛB¹ˆÞì«Z]¬ÎÊ¢*·u¶[ ÄrÄxH ŽÁˆðØ (‹ñ‘ûÌÞ +Nò,Íê½}3L³âÎ%š‹ ì‹Ï + öóuYæC ÇÞÕv‡ßì‹rSeU B +8 ‡ö6 {ÆÐÞP
xo2
!6ï¦é?úo3úÔŒ>7£¥5\t1+ÖgŸOöežTÕ +=×gP[¨Ë&oÀ´ƒ +ÔZµ'(Ý÷NýZz·Ã-'欇—®ñe[c¾6f8×۹ľ¶šdvÞ «:£(˜¥PFge‘äù~BÑf1k “Í&ÏtzVõ6[Ö;³d\erõY啾ÝÛ§kÁi~TGôGô‚ñ„þJ{Ç÷Ú–•»z£½Êìª,ÏíH÷õ²;µ£¤rÏÂ=—µî»˜±õ² 5®!vgú¯o÷)A )Ä`À0ŠcvèãL¦Á¯ +cØ¡Qø”—â’7ÂQó·ééœh„aª2ˆ»°+s^ 7ôÝ5^cA ß<zÕoî¬{"-tšöåA¤p =.ÏÓ Ëk{)‚ë~$»òæEr›7]ÕÛÝÝ @,:e3\!àH|ÜäÍi‹ 1øÓ)ƒ ÖØÛ6dnKØÏ»Ìw,ÍýÇŒ¦ýöô²Y* ‡UèÔÏ:L_wØ’¸I±oþÉçðãÜ}Í¥jÐ` +‡9| z¥´ÅËã`bDYHtÿ Ñ®vendstream endobj -1826 0 obj << +1831 0 obj << /Type /Page -/Contents 1827 0 R -/Resources 1825 0 R +/Contents 1832 0 R +/Resources 1830 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1791 0 R +/Parent 1797 0 R >> endobj -1828 0 obj << -/D [1826 0 R /XYZ 56.6929 794.5015 null] +1833 0 obj << +/D [1831 0 R /XYZ 56.6929 794.5015 null] >> endobj -1829 0 obj << -/D [1826 0 R /XYZ 56.6929 751.8596 null] +1834 0 obj << +/D [1831 0 R /XYZ 56.6929 687.0104 null] >> endobj -1830 0 obj << -/D [1826 0 R /XYZ 56.6929 686.1725 null] +1835 0 obj << +/D [1831 0 R /XYZ 56.6929 626.5588 null] >> endobj -626 0 obj << -/D [1826 0 R /XYZ 56.6929 645.3764 null] +1836 0 obj << +/D [1831 0 R /XYZ 56.6929 566.1072 null] >> endobj -1831 0 obj << -/D [1826 0 R /XYZ 56.6929 611.5513 null] +630 0 obj << +/D [1831 0 R /XYZ 56.6929 528.949 null] >> endobj -1832 0 obj << -/D [1826 0 R /XYZ 56.6929 575.1748 null] +1837 0 obj << +/D [1831 0 R /XYZ 56.6929 496.7215 null] >> endobj -1833 0 obj << -/D [1826 0 R /XYZ 56.6929 506.5659 null] +1838 0 obj << +/D [1831 0 R /XYZ 56.6929 461.9427 null] >> endobj -1834 0 obj << -/D [1826 0 R /XYZ 56.6929 364.9645 null] +1839 0 obj << +/D [1831 0 R /XYZ 56.6929 398.5692 null] >> endobj -1835 0 obj << -/D [1826 0 R /XYZ 56.6929 220.3983 null] +1840 0 obj << +/D [1831 0 R /XYZ 56.6929 263.2909 null] >> endobj -1825 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F47 874 0 R /F39 858 0 R /F53 957 0 R /F55 965 0 R >> +1841 0 obj << +/D [1831 0 R /XYZ 56.6929 125.0477 null] +>> endobj +1830 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F47 879 0 R /F53 962 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1838 0 obj << -/Length 3112 +1844 0 obj << +/Length 2946 /Filter /FlateDecode >> stream -xÚÝ[Ý“Û¶¿¿B}àÍX¾>^ìsš4vÜúÒfšä'Q'Ž%ñ"R¾8}Ÿ")ÒÕn§ÓóƒÀåX,~»Ø]Àd†á ™i0ËùLå LÄl±½Â³x÷Íñ<óÀ4ïr}}wõÕk¦f9Ê%•³»U§/°Ödv·ü9»y÷îöí«oºžS³¯Ñõ\`œ½¹yûãÍ÷Žöî:§ÙÍ7·ï¯çDIJ€I6‰³·7on_Í_þùöå_þùÃÛÛë_ï¾»º½‹‚u…'˜©~»úùW<[ ¾»ÂˆåZÌžà#’çt¶½â‚!Á ”ÍÕû«¿Æ;oí§)ep¡‘ \Îæ‚"-`êI•a„¨`®8A’ë<ªŒ’”Ê—QÙ¼2ýêµ Î *tn8¶õ² *ƒÐº¾RrE®„`¬3 ¡ & U_²wå~Uï·×sÆiöX7i±lSKGû£Þ•ŽVíÚòa_µŸÜ‹Åº\|h̲j•½«›¦ºßxN3™Æqûk¢³ÒM¿§(ªÂDj¯€_(å«Ãfc~=wWz -ME"3xY®ŠÃ¦…&y‘èžsÐJ®½Ï”ÕîadI ©ˆÿ(ÕíœS‰—Vñ(‚Æþ7õ¢Ÿ@!XÙxÇ åšðŽ¸¶»sò戳ÜTì–‰~IŽ˜PÝŽw°¢cbR$ÌÈpÀ<…ÝpÀ˜AHÆíË7 °ÃUT E/_Ôœu;@؈¬]‰<{ó“£8 -jû»lºÄU¹w¼míÈ7î±ÞûGøKu⸠–îëví8ªÝ< ^Xºží¼^¹7V'ÂL“°>Ö`>»b[6“`Œà15iîˆêár- `™Ñ Ôz·ùäülИi¿ñþøDO†ø´®ëî{«2óhTf~ã¼ÍCœH@ -TO@…Ì–å¦|(ÚªÞ¹7oß»ßÄDEvÒÏÎzóS{²CÅi'ŽvD…yê(F:TØž -1…E 0–÷”e߶î]±i¼ˆÇÉó8y‘=l¥£Ë¥¶iÊfBÕ.ôᇂðl[´‹uPoÝø÷Åòc¹o«¦´Û,…Ÿ‰‹úî=Þ|wxÕfyá)®È³N&îÖü ƒÛ=Ö×ë gM½-îs¤—½Åuƒüv¨\cé¾ -+…³ò÷ªi›Ãn«(n¹èÔŠSî?¹kå‹Žê]ÓLÅõºÈ*1ÇÏ
‹8¢šósqÑœ<?€¡2Á˪)lIËü‡æ¥9¢¨÷‡ÖC”i©`±åþ©jüN¹¦CP®ã(šTdG ÂWŠç§‘Ý´ã/¡Ÿ‚]î轩?–‹¶úX‚IBB`¦)â ó‹½1¹4 -ájÒ_”æÄü]ø?Là|–$˜àd*ÕåO¥"—M¥VÉTJj¢k“Ï€
“)†‘КOK¹¢õ’)Б^ôd{ËT†ŽÒËãœÌjðòèŽ~Á˜nJïPùÔ±¿ä< ÷Œ»-o'‘›§3*?TÎûª\tCü}ñ46ˆB3nB‘D -J}&ñîrM %pY´¼N Ì›qÅÎÀ…"*À 'E‹\ ÙúpQ\è á´ߦ™f.†hàbhþ¥MD #:À8ºq•!”fKVà#:yì´qÌãb„"ÆH~‚ÀV˜&£²C%4‡@ a<ÌŸ.P²vòví„!Pã¥g5›êrnýUÞ]kS ³so¢a÷]ÖÁûíjoÇ‹âДÁH¼Á—+£ÖxjÏ}ØÛ ;¸ÿpyØ>6£>`QïÚr׎»U.%¢fš4”.׸¡D.k( Ò†¢sÁ¦JT#ÍÅ´\)!W¿@% ¡’ÁB*Q1éÚÝÓìÏ]ˆ‘‚-“œ 4Éž*›ýiltmÊVEµ9„HÃŒFŒ¹aÞ37 `zº -å\|àâKEù3<»Èÿÿ£"P :c–‘eÜ& ‹5Èú|f i”sb”œ#ŠŸ)² …ê$75O:RýãZñl_µ'™]HÜ}5ÚŠÎò.´˜9z Ñ£r^ -HÄäù¿oã«-A#NžYð×Äš.»ìMjÙ1¢,ž®7í§Mª¤*“’E®„hýzF„cÒ—íèŠuî³û {q,ÍVÿºïL5Àz[ z¬èüX ä4w|ºó¡¡¿ÆqN%—ð$ÔÅÇo<†§ñ¥)é*$lD*ï ûrS˜JõÈ@Ƭ“ý þJEßßßÙ4œé̈í[¡2msó»uWV Õ ªÖ x^×x´*ª°)ÙÓC+m
=U‹bc™ éÞÿ¾³ò±Øï¬Yì«ÇÖ\uQ"ûaçˆmО7¤ŽÌÖ ´À#H`SNGŽrœñ³ãcRÔõŒyî(Å2Ìû£éÎgíúÐ8Js -N)¹¡4 Í#Ï80=…å«á`¹t‘ûÄ`åd° Î0¤ +xÚÝZY“·~ß_ÁGn•ˆà> ײìȉÖr´‰U±ý0KÎ.Ç&9kÎP²òëÓ8ç r#U*m•ˆÁô +ûÔŒŒ±²p¨pPˆ)," | 8 lpÖ¯kÿ.ÛU¥o%;€v°h=îNa”l³ñÌVhhÐY âî3ºlØØgµÅ€[ViXH=ê¢ÊÝ&ŠèÀú~¦m‹Ýæ ¾R\‘gá›ÌâÛkü C;Äš‘6À
ÊrŸGÔ¤¤ ‘øI~?¾¢N¯§&äÑ ¶HìÆÜ#ÉÔ±“ ?D¾#i³–èÛqÔ×EÎs¬žqD5çç¢ ¢9y~øBeŠ~7E•¹’2¶ Ú…ÊXƒè½?Õ¾3Ƙ®ì5?~,ªð® „ë)²j,®#ÚC†n†qÝ¼Û ¡Ÿ€]î惡CjS r0 –|±¦6ûç—ê’Kc@Èé¸&]¥Tó÷ÁÿDÅaŒÏ¤P-¢é *¹êa4’šÅÀÚf1`hý +ÒOÈRù,[‰hÈW7•HH£:Œg²™éT¶]Z®´É£šbÞ:IA®ÃqǬëüz³f<“j*AÃi æ… ¬ Ú ³S“(DHÑ4N0ƒ=‚œ©æµ©f© T¾«{ĸbg°B`€³¬%ªÞºhQœè2—àÂ4´f .¶ÓÂÅö…—.y:Õ¾3Ö¢l«êRà Z™x´òÄÓ‚ +µ¹Ì\Z\p~®ÄË>Ït. ÒÈó +ѨôÌÑi›jš‘ÊAóðYÁÑ,_):ò5 uk²MÆœç½&Kç|í³+‘16R"c49_Kp ª!ÉùºjIóP5qçØŒç;(¶ô/â²è|;_Ž_`ÚÕ2úµ—t+d¸øÁÅ— +ŠÌ3<»0ÿÿQÑ +I†ÏÜiSM[f¢r–YžOîA£VJëä QpñóÌ%ªî:öÉmÙS«.{?^+¾<õ Ë‹I|¨I»50ӳǯbd
½‰¹¿nþ„œø.%®ñwêÎêòøiZö1ÿ¹MLë_HÄ$;ã™ÛT3úTNÿÕÙK-Uýi—O^j™å¬¹Ô2dmôRK‡·Æ9k2}ƒ;®ÏUÛïleÀù_è XѦ© +rnW€—÷^5ŽWyʹt“øKO— Áñ, #N;Ó¨ó°™»2íä˜ï2[¯ž˜È—b²{É \«èî endobj -1837 0 obj << +1843 0 obj << /Type /Page -/Contents 1838 0 R -/Resources 1836 0 R +/Contents 1844 0 R +/Resources 1842 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1840 0 R +/Parent 1846 0 R >> endobj -1839 0 obj << -/D [1837 0 R /XYZ 85.0394 794.5015 null] +1845 0 obj << +/D [1843 0 R /XYZ 85.0394 794.5015 null] >> endobj -1836 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F55 965 0 R /F23 678 0 R /F39 858 0 R >> +1842 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F55 970 0 R /F39 863 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1843 0 obj << -/Length 1768 +1849 0 obj << +/Length 2037 /Filter /FlateDecode >> stream -xÚÝXKoÛF¾ëWèE¬Í.÷}tb§u‘(®%7Ò ‘’‰R¤Ë‡ ÷×w–»K“ÒJ.PôRèÀ!9œ™Ç73"S ?2å é©Ô qLøt½›àéÞý8!Žgî™æC®·«É›÷TN5Ò"ÓÕf K!¬™®’/³·H¢3€g‹‹W—góˆ1*f77W‹Ëëßàžc`Œg /w ì³›3 Í.~¼Zž}]ý<¹Zõæ M&˜[þœ|ùŠ§ Xþó#ªŸ>Á
FDëhº›0Ng”ú'ùd9ù¥8xÛ}rã -ñˆ pE"’a?$ É0R’½ø)"!?y.ã§ùgsÎ7ï9 pŽ¤Ä -¤–]™¤ûÎÐQÉÈt¨ñÀ.Ï°‹µa‚(çllØò!]g›ç³9ÕbötŸ6÷ieošÒ^×÷éúCÊÙ¦t˜7iµËŠ8wŸfy²Ž«3¢fI
ñ–Lͧ¹ì#{—Zq¾+ëÆxa:'IÎiΣÎÜ8ŠŸk“fÑ Lµ„•P·ycï˽Æö²‰³¼õZºK{m‹$ê&.’=C3í“]ܬï³bëç۲ʚû½ý s|ûþ½œeð€€(V³›²®³oyY—; é#^Ûrð^è’d”NL"E0sIò{±§¸*ÌÕ1cL9äžð¼`V’nbð‹1È)‚à *áàkÍÉ@I¶-Ê*=¦F#Šá‰eG%ì -E("N¢ÓÕ4ä:^M=—ÑøWY¤E¼;(ð="J±Óš{®€êqÁ(D„–cÝ«.IÀ“I¹‹³ÂÒ1 Õå \ÏflµÔ·Ô&]M¥ÉqÏqŽ8UôÏ
¸NxÎsÙœÀQ ôæБV홪ǞÃ@ 9ÖÝ{î yËZŠúdíQ`pÍP$)@…âP FüíÕêîva?þõŒDzvñáÎö—=Ï@FN]ÆœdÞ…¤S˜ïŠAë ¾<l©6mUøâuY~ÏK¨4m=>£+ÀÌݦU'§¬ ÛSÚC”I®´I×Mš¼mG`'Ò ôSV q7wäžåÕ•ýøâÃòSàŒ!§Q;ÎíLŽ SêAÀâŸ9&¦< ž± a‚ò µˆÇ¹·×‹K+O;«h#YÝTqcšyt›nœÏŠµsÛǸh¡× ª'B¡H1„¬¿E‚À ØØqw«Ÿ>ݾî±ëz]‘º X>×Mºs±}WuY5Y»{Ñ 1b"rrE€§ÜTg€QØÖIâ@»Jw, W¿ƒ4Rš BèŠ)Š¤¥ÆV†1¬N«GðlÀEØ»ÆjX>åCÕûXB¡” ÓHc$¸V!,ö®#nÒç$Æ
EØ™T0®çœ[€¿ÌÙWO‰žZ»Yl” `ôeéd]›l;ßd¹sôH€ÁSŸ«½Ü$ · L}–5I¿µÛyž>¦ù?»é©mOU -XG`.ï„v]±Ø&àç ÑÜ#hSuߧèyO²ó½NkÚê‡vq—]>ߧ
<–X„U°24÷eÛØ7všß¶»´hêó@ —ŠË·££Q„ÍUbŸ¤°•äV¾õMìT»óê™öí
˜¡¶mÕ»H¹¡*®DbÄh_½oÒfý¦³ -$ D AÕ°Ÿ›5š Ì#9^s†Ö?»A¨Èš,Î]#Š›x?9¤MêbºñMÿÏ6²´F'»“O]
-ÍØ°6C -èÓígÀt|ÂöLÝ¢Ïöõ l4Q'õyžC}#øRR2ÒwW»Ì¾¾yd¾rçbè3ÅxêìkãÞìÙ µ‹Ífë g®:ÖñCl¶ÖÑ * -A)7kôØ<ŒÄ”p‡ý:NBX+¹ôå\ ã+" ŽÌ»¶Ù¯?ú÷uÞÖÙczbÇBÂùʆåyNíW Ï‹É¡àŸPÖÇ~_Y(ôeÃÈ‹ÿ>òìy1@vó` ¸‡“ý·ãËߪÌ`½:ò'C$Áƒhg”9 !ø0i1Š(ì ‡¶ÿ
J{9 endstream +xÚ¥YKsÛ8¾ûW¨j÷ UYž$pt,eÖS‰âµäJr )Jb…
öx~ý6"%HJÕ–l‚îF÷×Àd„ጄ‡<EÕÈW LÄ(Loðh ß~»!–gÚ2Mû\ W7 >1¤ò¨7Zmz²$ÂR’Ñjýmüùhðxq÷e>›L)çÌß=>γ‡ÿ»ÀÀ,¿Ü-žï>›µÇ‰¢ã»ßæËÉÕï7óUgNßd‚™¶åÏ›o?ðh
–ÿ~ƒSRŒÞà#¢ ¥7\0$8cíJr³¼ùw'°÷µù©Ë\H$(÷À 1ß;ã(‚|B€Éçzð%.?Y&í¦i¥·ùá“=F¥?û Zs¬ã" +«¼x?ö! +yÄ;ÈsYÖ1šÆz … +ã
$SÞømAîæEg“~†»(ü©I¿ G³ÁB’§q¦#Üü4NÖ¡éëís9^\æ2K‡Î +‚$ÍËÊVÈ.Ùe‹™‡:¤pjÓ #¡¬“ʼçó ÌcÄIÝji~˜›g£¢¬‚l}$°o¦Yô†»8ÛZÁÉ6/âj—š×ïXà§O÷æf* Dƒ Ëñc^–1 +BÙµl>A\ÀÔw1›ú\糩ãÒu’ë¬?i¹˜!"%¿¬¹ãr¨ &ŒD0óùCÝ«®¹äiЖ»Æ˜†Ê7G=èP'_" f¾œº0ÏhÜ0i“+žëq]ð\Ëe0Ñví“R#Lïü²ê–É¡zè9øêyþPwç¹_ò–±u`ígÇ Ž ~Ai`>ÂŒšYèi¾z~Z˜ ÿgóÒøîó³9ÿ yÒJ /ë÷ ’3ÝCr8Ú°6=LªVu‘µÉkQýWv,©‚ª.‡{$Ãa8*̈[X¶·¨+Q\QSKÛM…[‘ºJ¿Åå÷´æܳœÏÍï>/¿:öèrŠ® R׎ÛÞn<¥G¢ÞçF ÷C2´"•uš©Ú
˜ ‡z়«@. GÚšóña13ò”ÝÕÚL\Vp€Éí8øm¬O³ÐºõKÕЋNÕŠ¨× ÀÜ~…î µ˜¨¡cïžWÿúútÉ£†ï!ƒ^˜E!Ëw˜’Sûû<+ó¢Šëô bÈ=jåp +KˆöJ`5 Ûp´J¿ÀX5, ›ßƒàAY/Ä6Ù(õ
5´Ò]ãʨx +—‹ðæÞ³|_ÆåqaPÁ¤ÇFDR$ˆûÚÚ¿¢BÇûb
ì‹0w*ÊQ;®Þ¾=ðà·)ÿÑR^G…vV +Š·ÇIûóMl]Ç Ž¸/ɱŽÌ!oÊÀ«„é[‘þTóp_—.É +Ié«cÉû«NÙCj¸ä1¤ƒQ'¯ì¨Ê!yè£ñ: Á |âˆúª¹p¼,ÜŽ¥ÞÉî_;꯫ֆTÞsžE¸Û&ÅÈ#À?HÒÙ|yÿôð¸zøºøÅ^éš6¼»Ñç:¨^z +hhÝIf‹¥Sõ‚-1>‡V endobj -1842 0 obj << +1848 0 obj << /Type /Page -/Contents 1843 0 R -/Resources 1841 0 R +/Contents 1849 0 R +/Resources 1847 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1840 0 R ->> endobj -1844 0 obj << -/D [1842 0 R /XYZ 56.6929 794.5015 null] +/Parent 1846 0 R >> endobj -1845 0 obj << -/D [1842 0 R /XYZ 56.6929 610.0572 null] +1850 0 obj << +/D [1848 0 R /XYZ 56.6929 794.5015 null] >> endobj -1846 0 obj << -/D [1842 0 R /XYZ 56.6929 546.0335 null] +1851 0 obj << +/D [1848 0 R /XYZ 56.6929 496.4666 null] >> endobj -1847 0 obj << -/D [1842 0 R /XYZ 56.6929 482.0098 null] +1852 0 obj << +/D [1848 0 R /XYZ 56.6929 433.6488 null] >> endobj -630 0 obj << -/D [1842 0 R /XYZ 56.6929 442.3696 null] +1853 0 obj << +/D [1848 0 R /XYZ 56.6929 370.8311 null] >> endobj -1848 0 obj << -/D [1842 0 R /XYZ 56.6929 409.052 null] +634 0 obj << +/D [1848 0 R /XYZ 56.6929 332.0288 null] >> endobj -1849 0 obj << -/D [1842 0 R /XYZ 56.6929 373.1831 null] +1854 0 obj << +/D [1848 0 R /XYZ 56.6929 299.0792 null] >> endobj -1850 0 obj << -/D [1842 0 R /XYZ 56.6929 306.2376 null] +1855 0 obj << +/D [1848 0 R /XYZ 56.6929 263.5784 null] >> endobj -1851 0 obj << -/D [1842 0 R /XYZ 56.6929 233.2236 null] +1856 0 obj << +/D [1848 0 R /XYZ 56.6929 197.8388 null] >> endobj -1852 0 obj << -/D [1842 0 R /XYZ 56.6929 126.5318 null] +1857 0 obj << +/D [1848 0 R /XYZ 56.6929 126.0307 null] >> endobj -1841 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F55 965 0 R /F23 678 0 R /F47 874 0 R /F39 858 0 R /F53 957 0 R >> +1847 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F55 970 0 R /F23 682 0 R /F39 863 0 R /F47 879 0 R /F53 962 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1855 0 obj << -/Length 2451 +1860 0 obj << +/Length 2811 /Filter /FlateDecode >> stream -xÚÅYÝÛ6ß¿ÂÀ=Ô"†ß’pO›&
¶h÷Òfƒ; íƒÖ¢m5²äXR¶¹¿¾3ü%Yöö‡–#rH‡3¿™¡Ù‚ [$ŠP‘ÊEœJ¢(S‹õþ†.¶0öö†yž(0EC®W7/¿ñ"%©æzñ°¬•š$lñÿ²¼}÷îÍýë»ÿ¬"®èòYEŠÒå·÷ np}ïV)_Þ¾}ó >¥˜bdÓtyûã›×«ß ¾¿yóЋ3™Q²|ºùå7ºÈAòïo(i¢OðA KS¾ØßH%ˆ’B„žòæýÍOý‚ƒQ;uNR%Dq©‘¦„ )æE Upð(’p ó^QœÍ)*p¡¢¢5 ôåwJ
8nú¦–e]W›bmŠÒL•Â4#”ƒXÃÏäë¹fÃmµ&”ªx,á‡Æx‡¼œ 'ñ¼ˆ“uuJt¢¸çÍšU$Rµlw ‰“¥”o»cÖuåF±§4Ž.ª¦5Yî¸ëÍdzn6YW¶/ÜÆ" -É4‘*
R¾4íúe•íMNy ÍI’€ DŒ‘T)Þ fæ\
Ϧšh¹|@+®W‘jiª¦;®X²4î»Ýe-RrézË:Ë‹j=×Ùé±3œ 'C[TiüD¿ÛS}üè²MkŽ“Usü :w q{ÜpZç©ë]Vm
*W¤Ë¢m «[Yñ#/ÜÖm}üâ»:ãgØf®9ÔMS<k_Š $¥T{EÂâ~ás•«˜°X?¨Þ<PPß:+ -~O?ÖM0¶ÆµNs@]éu…dQÝYcšË&ˆVAÁ ®›à€ëŠ .k‚›é–)‡èº¹ºe`šÙr¨Õ4&œ =Þò箚h&À¡ÓÇdpãU¼uwÜUÞ©¥Š¼6 ”[»Þªn½¶ÿ5ÀÇ.êUÅ’ÈD¥×õ:京מËêu{¦W~ŸÙ20Íl9ÒkB’8žlù7é5 „gX{.½Å–uðBurõq SÝG†¦ÍÍñ8çtŠ$'¶Ë—$ ÐhH|®_Ò€ëÊ%.{IÕ³øûõ¡kΗk’p`¿*YÏ5#Ú:ÇD´o=(´sÙ Lˆ™Œ§"žCe4 - Û4û²áÚWw÷¯ÝœÔuäf% RXq…O4ü6>íŠamdøâ&9\Ž—G0åS~^>¤,.ÅÉéÅ -†!¥Ãæ!}§Å5œ ¬|¦9} : +xÚÝZÝoÛF÷_!à Jáf¿—D8±/pÑ8¾ÆA ´} ©•ÄV"‘t’þõ7ûE‘%ùôå Z.ggggg~óA“†d–„YÊg*åH`"fùæÏ–ðîÍñ4q ŠûT¯ .^þ›©YŠRIåìaÑã• œ$dö0ÿ5ºº¿¿¹»¾ýå2¦G¯Ðe,0ŽÞ^Ý}¸úÑÍÝ_¦4ºzsó 9gˆ”!“8º»z{s}ùûÃ78}‘ fF–¿þŽgsü‡ ŒXšˆÙ'xÀˆ¤)m.¸`HpÆÂÌúâýÅ:†½·vé” +KH¨šÐ%3BP* (A¤H2ʬÞÝ?ܾ»{pŒ° +d¢—ôŒô©Ž[AGµ|Ê +NnÙYÁá–SV0زoòï·þd 5KÙ9+èQ°‚@eÏàBôLj2À2'x^•‹b/ +PñH<" ”³ÓòuTô%%ÂX¨¡„Æhœˆ}ZŠ‘T‰šqÄWæ&€Ãþ ÀjX*œu>Ìâß0¦Ëv—5EUº·ffݸ(ëFgsGmìk°|®Y»n^LÙ‘ˆ‹4HùR7ùË2Ûè¹½çYÌ$EI!&v¡‚t‡™8e(5Íñ‚P˜H =˜(Y]Æœ‰H—ulÌ<7«¬1# ¹Ùu•Í‹r^zªƒÓ›Épz³š¢luíúÝ>U»? A¶hônĵֻ§0¹Ûã†Ä]`4§]eåRå²4*šÚ
w+«y˜î +Ñ
tsrË@4±å ÍQˆ&‡[þÔ–#Í8tú½\x/Ý ·¥wêß°À¯åVn¶¬|*äì´øK 9®W¸V&å9½ö¨Nè5PY½.'ÒÇ$•g¶ D[ŽÒÇD©Ñ–ßH¯Yx‚<ØóÚ[ìº +^(ö®>J"!£‘]d¨›¹Þí¦œN dOvô’¸JMÕ™KêS ¿¤ŽÊ^Òf +9à H°Xg7I RKÂåiÁ:ª ɸH¡HNE:
2 µ;)9‹lÄä<Ú€MÛsm-µÎ÷Èh¨ ®²lY›v +=1‘}ëÄŸË>¡R†ì›³¾|*l̤n êÛAe¾`žPUn\¯ÇL¯ü l76äswCkäw3[)ºlÜ„ ö0È÷a×T{ÎA‰žEà\‘£½]¸™Â3-ünméûNœû<Ô08`ÿ}`ëNÑëX™S¼ð©ˆOo â…¾V¸wǦ'²yW„Ô%‚ûÓÎ:"³á¢ÅIOìS wÅŽÊúâö¬/n«]sèŠ%\œ–+MÈ5Ì9 TR9ìÇ¢nB“Ñ$vð±Õ»Bס éKf/ß8òÈÒ½/î©Î‡¾ÛÅ( 8Ö¸²-¥a—ÓnfG‚ ¿S åçî´GuâN•½Óz¢ŒR ¨âä–hbËQ¥$‘Ã-¾T<Ú¡‹RC3ö©¡Uc“5pE^ŸÈ×Mi.9ݧëU;uq,ÄF† +>Ø‚þ\4 +'– €• :NŸæYb¿€ ô€ Êt(Àhòrë0ðòC·‚s† ]Ld-)}µ÷>K¨þ%…Ä0F‚aa~×Sœø–°`4÷w—±$ÂÇ’F7ª¦ŒŠª$ ’K»ùìã OSæ¨zc{Ú½ìÄËÛ
]Wp¦YÿXsÜgmÏ%iÿº¡<KœØ,ŸS¸ [q¬œ+©®“gÆnNF›¬ðŸ"”GdxWzk÷íAùìTE¯nï®ÝšÔMÌõ%ÃÑÓ%¦É +ñÃoã M¼
Á·ÈA´‚,S]á×ͧ¢‡…(•ì{¤æÁֹ𛹟EÛ´;íÆ;½6]ÃõÀ`¹ À L¥o_ge,ùÔ4t÷ŸH¿Îb_(ÅÔÈHø 0r‰Ï¡XGeQ¬™ˆL)‚h¡¦ÚÁ«hJ%c³þ¶‡á)PMH7$r~oâ½vq½²!‚Êé6£IÉ{N÷tÈ»ªÓwé
[—$U¹®k×æ0[Ù؃¼ÚlœáÂÃÚe.` ®’^¶È¬l–ÂHôØz9 õbß&„ç$Ü”8Ì»‹wÍs_¬Ðµ> +¼DrD¡¾ ð¦ ñ„§ÿƒK„Ç€Wa¤0 ÐÜ%èêãÝìBí§h¨¿®,àþdÿg!ø¶ÓèÍQ †Œ’¦„{ ÆžpîÀ·?>Äì÷YŸ endobj -1854 0 obj << +1859 0 obj << /Type /Page -/Contents 1855 0 R -/Resources 1853 0 R +/Contents 1860 0 R +/Resources 1858 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1840 0 R +/Parent 1846 0 R >> endobj -1856 0 obj << -/D [1854 0 R /XYZ 85.0394 794.5015 null] +1861 0 obj << +/D [1859 0 R /XYZ 85.0394 794.5015 null] >> endobj -1853 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F55 965 0 R /F23 678 0 R /F53 957 0 R /F39 858 0 R /F62 990 0 R >> -/XObject << /Im2 979 0 R /Im3 1102 0 R >> +1862 0 obj << +/D [1859 0 R /XYZ 85.0394 751.3856 null] +>> endobj +1858 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F55 970 0 R /F53 962 0 R /F62 995 0 R >> +/XObject << /Im2 984 0 R /Im3 1108 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1859 0 obj << -/Length 2185 +1865 0 obj << +/Length 2226 /Filter /FlateDecode >> stream -xÚµÛnÛFöÝ_Á·¥ -v¶´8²‰J¤*Q¶ó÷=s!MŠ”ÒEºbÏœ9÷ÛP$Áð$B"i¨I”áH`"’Åú 'O°wsF"δAšv±>ÌÏ.®™J 2’Êd¾ìÐÒkM’yþKú)4 -8]~ºú8™RΙL/¿|¹š}¼ý/¼ H€‚qúéröõò.À¾L M/o® &¿Í>»š·âtE&˜9Yþ8ûå7œä ùÏg1£Eò -/ch²>ã‚!Ák «³‡³·;»þè˜ 8ÕH2©
1,È_aË´7„ g‹“)!1}ŠX8ˆX\¶GúĦš aŒH¦RP¤ a(ƒCÈA“´BTiš(!Àq28iælì1
’‡H0Œr î0>O¦’¤søKÓ«Ch‰ x#‘F"n„r¬“?‚07†¤ÎÚ+ûn¸¸]Óäc%]¥"ái—²WJÒNàÊÀ9œ%ŠîLÉ r9™2.Ó»¢œœîß΃–’uŽr ¤ŽZ–ÙÚæ«Ë€ $„Rk¿³»@º~¶añû„âÔn]䦥]ýc qÙ&{,VEý-¼¯íâ9+‹ÝÚ½ª´®8ßV›°ÊV«°ØVUí„;P.\ÀDG‚`GDZ¼+ûä$âD§vÂpú¶°›:¼{ 91i+ƒ‡VAIfºVd)ÊMÔò±(ó_±À🌘„c„iŽp }Ñò Á¦(Çi”,+ó°ØÙº9UMƒ¾D(ÜÒSxawNK¨ [»«öÛ…S©tU¬‹z7†PF4púZ.~û2«íêNϤ˜¥Ø…Ãk›•‘jýœÕÍÊŽˆJH ¬eÔyº 1‹ËNLID©6uQ•fU‚^;ª èVv!_]VÁp¿»Ø¡&}}¶åHÐBƒòï-Ó´ í"’ ö.7¨N«2@â7lRDÑÁ æ`+0åÖE÷¹‹QÚÂG À1ÓÍÖ² ¹!HcJûnõ$0é“Æ*Ý¥ó0˜"ÃÇõKQíwù€_„æE ”9 ÉT¹Èx
¯ƒœq@Ÿ‚pèц÷³¢´y¤°tb
£÷µ€(Þ'F!MqSCÐa
åÒ ªNºõû{ƒb/
´Èé{gû±ž5¥iŒoƒœR6>/¤@&(Û -¸ÁïódÆp^h±|V½ ZFBñåF&]b–
ÒËnæ(×ÔðË{ ¥©S‡¯—nñb·;Ÿ»î¥Ü¯ C°áP·Ü¾õÀê€@ËÓöéb ·O‹åíóbKˆnÕÁHihþ!¶ÙâÙN—â‡Ò -Ý_hvZ¼kD>ÖkP!˜‘}ïª,(Ïê,¬–Û Ô÷j E?ðˆT\ŽŠ~ÀO;)-‹ÒåmÏgþtXV˃½Ü.³ý*zù¥°¯n¼ ¸¯™¢ðRF˜¿eÊSùÌüù ›ð¸æPw¤ù΄ù -ÁäMÇã Ú7‚Ã²Ê ñ:ÌwŒ(ƒ6”ýO® Aendstream +xÚµY_oÛ8ϧÐÛÉ@Íð¿DìSzMr^´n/q±ìîƒbщP[òZR’~û›!)G²e÷½C +4Ël›=ë¢ùîç»|ÊÊ¢Þà4ÁHsËù®ÚúQ¶^ûÁ®ªšàµ ÜAªÎkYðÚÉ”©8¸.JÓ Aã×¥Ý6~î5Ô&~ÓWCx Ó·¢ +ìRÔ~óÆfeàêS‡ Ù q
A!½ÒA" ú"'å,T[ÌhžgU‚ +ît<Á$ :8Ý ziå
÷
¯“›øåÉ–#^ ¸"™‘?öZ‘òη‹ÀÒ h18xŠyÑ 8°É ',õ¨®3ÌèÊœe¿>ÂÀ +DS…žñâ§ÇA‹ÎyaÓƒõóm²¢tn‹ † { ^_íàó\Ä@õS‡ñGøy‹ð𵟿${m vš¾•<?‡Y€¦$M@P @¤â|}ÖraÎ×G{*Vχ–Ñ I õ™ ‰ìˆFDöC'AP£"ï,B¾—1qðlwµ ^œ”íæÁ{õ‰ öµhŽ®±;ºâŒ@Rc?°OêŒ}:*gŸ×±ú‘’ +Èà[Ëlùd§+ðñCí‡$¯àÖΪ·§ÑO R„0z¨àÇ* ʳ&ó£•+ݪÍHY 7¢©GU?§AœÖÝ)‹wpgn· V«ƒw¹]eí:Üòsa_°ï8YåIˆ©ù?©ò’ªŒÔüív˜“%ž„ûÖ,U?(ñ +tú õS>ú€œÛCõÐË•=§ï’¥À#)ãûšûÙíüêãýH.¡X‡µ‹#œ¡ý8T–.OµÐ§Z¿°ïK¡*á‚AUòXfXoàËú©j×x<8.>„èT~äò<—UÙxk¿Ç''xƒ5 4Ô€9¿]û8 @Ó„§]Á·+óåXë
53¤Ç@ô¦Ú±FèÃÐgùIô`i°vz ½úT§ÑkO.ä _¿ }ÜH5ŒÛˆ €å„&зäÞTÎðË +Ò†0 (òÔÌÌ«—ò¼yàŽ$ Âï+24 )ÙöÍ]ïQ¸3wmËÜÐqåÕ÷ðÄ„’ë-èPz5®…¨-sû¥¼´Þɳ„¿„RPùo_ÿ<¿™Ý~½»Bƒ/fŸç?N‹®E \% [3ò=aÀJHB™î:mÈ +¨écëó v "Æ•µëG¤‡"XkªÊü·´Wÿ¶ ‹¹—»â¡ÛSv«Ðˬý͉@°¦÷H>ÌÙ>—í›"^¸ÄÎ Whб—aíùs‘w_Њž£¸ãËÁ÷cE¤f]#ä©\团,êÌQ…[½³« {ÙEð§¬l³õˆq™N±JÔý>ëðö!Â8¶1Þ |åz3û8ò:Ä°«•šŸó ‘‹/(JŽã¼#B‘—¶Y^:?!à«ãð†ÆNéä¬ô=Ñ‘øƒð†"]¤ñ‹ÑêøÈ#qÑ{äÉ4Vgà'çÍÓ#:mžŽÈ™ç9Û]îÚ2˜h[äGÒ+yV=Ñ‘®¥CˆÑWaÜD! ð“Ô´ÈÏ[¨ÃAp{1Ú/Ó½oþôÿ8Þþ‡#!Y¥é _€$M`³î”ƒ2Æ/ +.¾r¬û¿IË! endstream endobj -1858 0 obj << +1864 0 obj << /Type /Page -/Contents 1859 0 R -/Resources 1857 0 R +/Contents 1865 0 R +/Resources 1863 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1840 0 R ->> endobj -1860 0 obj << -/D [1858 0 R /XYZ 56.6929 794.5015 null] +/Parent 1846 0 R >> endobj -1861 0 obj << -/D [1858 0 R /XYZ 56.6929 436.0529 null] +1866 0 obj << +/D [1864 0 R /XYZ 56.6929 794.5015 null] >> endobj -1862 0 obj << -/D [1858 0 R /XYZ 56.6929 286.4775 null] +1867 0 obj << +/D [1864 0 R /XYZ 56.6929 361.2723 null] >> endobj -1863 0 obj << -/D [1858 0 R /XYZ 56.6929 207.1916 null] +1868 0 obj << +/D [1864 0 R /XYZ 56.6929 210.791 null] >> endobj -1864 0 obj << -/D [1858 0 R /XYZ 56.6929 96.5058 null] +1869 0 obj << +/D [1864 0 R /XYZ 56.6929 130.947 null] >> endobj -1857 0 obj << -/Font << /F37 743 0 R /F23 678 0 R /F62 990 0 R /F63 993 0 R /F39 858 0 R /F21 654 0 R /F55 965 0 R /F53 957 0 R /F47 874 0 R /F48 880 0 R >> -/XObject << /Im2 979 0 R /Im3 1102 0 R >> +1863 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F55 970 0 R /F23 682 0 R /F53 962 0 R /F62 995 0 R /F63 998 0 R /F39 863 0 R /F47 879 0 R /F48 885 0 R >> +/XObject << /Im2 984 0 R /Im3 1108 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1867 0 obj << -/Length 2451 +1872 0 obj << +/Length 2455 /Filter /FlateDecode >> stream -xÚ¥YIsÛ¸¾ûWè6rU„`%€£³LÆSÇ/v¦^U&F¢,V$R#Rñó¿ÝXHP¢¤©šÒXFãë
b -?61ŠPaåD[Iej2ß\ÑÉÌ}¸bf‰f)՛ǫ׿ -=±Äf<›<.^†PcØäqñuzsÿþîÝí¯g\Ñér=S”N?ÞÜ}¹ùÃÝ_[>½ùðþ»° ˆ ’etúùîÝÛëo¿_½ì¤I%fT (_}ýF' ü÷+J„5jò J˜µ|²¹’J%…ˆ#뫇«ÿt “Y·tLJ¢ ×#*àl±Jñ”%™àÂëàËãoŸ>ãA€\$£“ψ²F;ºÛª-vUÑz½<¼4m±i|çm]5õ®-÷›Àv•DÈŒ>RÂÆ:s|@×3FAÏ»j1ÇH!2"˜äŽâ.ßãòЂÈ< ·ÚmÿçÚ·*\éZM±ûYì|{^Wíîš™i½öû¶\—íK/l¯"ÜÄc¤r›<¼Tõ¶)›Ã{Îà²h\©Œ8æȵ0œ+ íQÔRB•ÁËë9xÐÚÐF¢þÜèïëì»?‚JÕ€ŒsØ©›z¿›³|±ØMãɇ[’!kOþ-ržp -„P*‚V—åÓlY®‹¶™"Z yÈöÇE¶?Š—S<¥&†S}ȳ¹È3€á˜# ŽsÉ9nG8B¡£¹šÌ:¸Àš-à~„1Ä¢ý 0þ³k½Œl1Ô(âuœÂ$°U`P–föŸøN¬1fÜ»Ì:Ž³”¥â@4Îaܲ~g±\Œ q"”ȆGŸ×›M^-Æ,nƤ!]\°<é¾{ÿðöóíýãí§»nÕIß=ÉÇàœ(àÞ6ºô[TMÛUáõ¶ØåmYW¡»ôßÜ‚WV -Jã‚^¢V€H?ë N>ˆ¥Ïe»òÃUíG"6Üຬ -?\oñB‹z翹“öi¿)ª¶yu
Ø·~ÁvWÂ` óŸf…æéf›=ì²{ ì–^#Z.h6TˆGÆýÍÛI®: ‡˜ç%†FGžÿÌËuþ} º½üÔeKƒ³qC¡µ@.LçQÈ}UÎó¡È, -g ')y@ãP “8Z‡GíáÀãÛ{ßË©Š9 çb -ôZT‹²zòd½^ÜÚ=lSµN‚E"G`u ïEùT¶9†f™M›ò©ÊÛ½%âQP ©‡Ÿôª†Æ|¿óÞ®ÔS½ Ú†éz ¿ r#£½ -
õ¿*ç+?³oŠ@“ûO³ò0Ä]¿˜û~ëûèñ[ä‘EQ9Ré¼$¸ó`£‡ Ü[&íôq%JüTS¾· fMû²v¬Ì¡ÜØ€ÈtÜÐôž;^ì¿÷EÓ q¦£÷¸G÷àÉiÒõÍPT üp›õz°Ñ¨è!Z|—qv>a¾ÊA'!íÜì›@ù=z@{t/ß_‚[ðŸ±ðo4d›€‹… ÁÌ¿ÿ‘ã,eé+‡U@ä°TÚ~çþ½¨Uý\…ƒ× -H#æ±%a€ò‰š÷tì’i“5]¹wÇÞá+ç©þ¢”?í»ps8â½2Šé¢€jfãƒ
¯êg?îç £6Ÿ·apÈb}!’ú‚GçŽLç -÷íÊ•:KFŒUâd9’JÈ€[Æ!ܱ£‘q˜I)’Q·B~iŠ‘Ô›StÖêLÑ4`
f#ŒŠ1“1¡Yð3š»õÏyá'‘÷.Ò»2Íã–øÎÀ«> 80$T¸ó¡7ú¸_·å6æ eÕ´y5/š4ãs[ÄÛe7ÑróõÚÛÚnÛº(ïœÛ2¸©Úåo©ßÞÿ”i eI¢ GÒë¢ðYÏ(F…& ýÁyŒ&Tg0© Fçc¥²…í -0H8P, 0<Q{øfhµLЙd#>£Ä6¢<«ïà½3+úå‹b™È^U½nF³(å뢿FgNPÞ13¼=œÍ z]€BGsžÆÁàÇEW•>D 0 -=MRü¡§9iŽ6#Ò¾óÖ˜6ÆHälq{1ìÅí%r|ûSg…Š4ÇB
¬C½Ç³¡TE5úÄSR÷åRÖî±}hÚÜ¡»'çžjˆØŒH l ó’Ët/¥®e "Ìœø iPÝ㶯ÂrW§.ŒTð ÷ÚÓœ¾Ö@ãnõÏÃÍ@»Œ‚¯;³Y$9Úl Y -™¬±éfï«þ‰Ìè{ Íg]?=Aµ@Ný%*ÁGþYhWËþë¿Kûƒ%–h†ŸKP ðƒ"<…cL ŠÞý±z,ûÿ³@‡¬endstream +xÚYYoÛH~÷¯ÐÛÊÀ°Ó÷ñè8Nƃ±ãÅI Š²S¤F¤ìõþú¾(’¢ä +Á 1¶î3] tX•Q}v,_ý¨230žGÁq%âZ²aêIËÇz &\ƒhÉœ·Ùçï7—ÉÍaW4dþ²*²•ŸÙ5yàIý£Yy ÚµÝ{žù÷Ö¿ÛxhŸyEä•cå.DZ‚Ç "Fê +NLr3XEzAª‰õ^ ÷ן’¦}-(=6£-m`RÅõ>lدö_»¼iƒŒ8ÓñÐKÕ Âø?šþ÷Íð“[ýa‡e9XhRõÆÃϺ{Wnv![¥`“Ps®wMàüà à<Æ–Ÿ¯!&øÇTî‡Ò ™1j¬¢?÷G‰I_¤ï6þ +zº+ésÅû‡Ã¶¤ã²ëv͈èÇIEš`G›‘¾†V—›Ó*v\:ë(ÛQR:Tòk“OÞC*ʼn–i ü†iûÔe=³+uß[xf¹Ÿ°‚|x œ>–gø„ô‚gUFždÍ +£D¹rá
Œö¹Žc´ãrͦ0Š¡$GÚÚ@%A˜rvZ¿ŽkBÁá•DŒNÔ60¤ó È• +xï¡“˜€$b&b¤%ÆiÇ5Yý‹=wbØþóE¾Ld¿Mõ¼NF‘¨å»¼ÍÞÙ`î.ɦÜhpóp øm§ÁÐã:†ÈåÀðôfÀê_F À9´ê‚ŸV®ãšÐnpºÐ*(L†ê E‚QœN^– „B»†¹2=PËgÊB¦J— )Û ½p.Ocú‰£'B#M>8úPÈŒtS +"²Þ_VBiL ^ ëÕ¬:K è0’ý•|D„ê)‰Ã"ù„`u£IÔù¥°õ %Ê×gð„|»ð# áÙol,Eö{B¢b5ØûÂìkN;.–ûɉd¤CäW}Ý Cע΃"UÝF£Ä¥5^ùŠ¦=êpÚØxÈNû[鸻E&çmÍ›¡wM7ð5F–ã¤^ ÓbCïa¢Ô@³þíà°ƒPóÎ×üm†‰-œ‰å Œüí„fz7± }ÓÁ +® K¦Qu3¸Åé C¯(:rÙÇ #ãì
B; ™Ú;û¸Á½þÇ Õk"mBÇ~¼dÙ{Õ ‡Á]ñ·ØÜÿnËm]¬”; sÄ E¥ì~ acÕ»Ÿ@uÿ ‚D|Õendstream endobj -1866 0 obj << +1871 0 obj << /Type /Page -/Contents 1867 0 R -/Resources 1865 0 R +/Contents 1872 0 R +/Resources 1870 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1840 0 R +/Parent 1846 0 R >> endobj -1868 0 obj << -/D [1866 0 R /XYZ 85.0394 794.5015 null] +1873 0 obj << +/D [1871 0 R /XYZ 85.0394 794.5015 null] >> endobj -1869 0 obj << -/D [1866 0 R /XYZ 85.0394 751.8794 null] +1874 0 obj << +/D [1871 0 R /XYZ 85.0394 752.1052 null] >> endobj -634 0 obj << -/D [1866 0 R /XYZ 85.0394 711.2251 null] +1875 0 obj << +/D [1871 0 R /XYZ 85.0394 676.9839 null] >> endobj -1870 0 obj << -/D [1866 0 R /XYZ 85.0394 677.4622 null] +638 0 obj << +/D [1871 0 R /XYZ 85.0394 637.9396 null] >> endobj -1871 0 obj << -/D [1866 0 R /XYZ 85.0394 641.148 null] +1876 0 obj << +/D [1871 0 R /XYZ 85.0394 604.8838 null] >> endobj -1872 0 obj << -/D [1866 0 R /XYZ 85.0394 572.743 null] +1877 0 obj << +/D [1871 0 R /XYZ 85.0394 569.2766 null] >> endobj -1873 0 obj << -/D [1866 0 R /XYZ 85.0394 498.2696 null] +1878 0 obj << +/D [1871 0 R /XYZ 85.0394 503.1887 null] >> endobj -1874 0 obj << -/D [1866 0 R /XYZ 85.0394 310.9784 null] +1879 0 obj << +/D [1871 0 R /XYZ 85.0394 431.0324 null] >> endobj -1865 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R /F53 957 0 R /F55 965 0 R >> +1880 0 obj << +/D [1871 0 R /XYZ 85.0394 247.0209 null] +>> endobj +1870 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F47 879 0 R /F23 682 0 R /F39 863 0 R /F53 962 0 R /F55 970 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1877 0 obj << -/Length 2033 +1883 0 obj << +/Length 2194 /Filter /FlateDecode >> stream -xÚ¥]oÛ8òÝ¿ÂÀ½Ø»1ÃOIì[š¦{^´i¯v¶û Xr,¬,å,9YÿûrH}Ø즋ƒ‹ç{†3bS -?6U‰4×ÓXK¢(SÓÍ~B§°÷Ë„9œ…GZ ±Þ®'×ïE<ÕDG<š®·Z ¡I¦ëì÷Ù[¢Éüõ¯×ï•àrF"žh o¾Ü¿»%·Ÿîß#æˆ*O8UÜ¡Þ|þ|wÿnùÛ|Áêó…¢töñæþëÍ„}žk>»ùåneˆMîÖ C]F‰ÿN~ÿƒN3Pù× %B'jú/”0ùt?‘J%…ðr²šü§#8صGC¶“*!ŠË¬È,–a 33H±¤D'’uæ,dae,²89ûª&cDH`†Fû3?Ù¹9tL4w:dy!˜G -6t'£œhªÕX²¯M>_®gíÎ.#H @-.´8öŒ‡„E\9¬íaÎ’Y½?c°©«o”òÇã!m‹ºÂ])óP2 Æâ c 9¬ý±i‘ðƒW«ª_ ¯‡>«tŸg¸ûR´»^L >]ðˆkãpp”V݆pg †ãh––õŽíÝk•á¢É7Vï¼uïí¡¨ q]TæÏj‹‘åok· -3[ù0hL>1:[¶º«eæÎìro[wbµÃÝ¥Ïô˜Wù!uŒ7uD¬§áùUÄa§ÈMC\‚4¢‘IÁ„D2Aϼ·§dì| MÍØ?•¹¥ -¤/gŠPªØ+ùK‰ìŠò•gžŸ ÷vyÿA7Ù¾¨ -¨‰ië5ù’o5«;ö1Ž`44ƒPÀ Z•Ëœ³&…è¨ZJ(‹ù+JÀ•‰¨+B-øعãïñhRá,RPMX~g——O¸r›tuBCUUÀ.¡ ”×z4àk¸~X~\®m?dþÖËO÷«€:Ó\Á}⿪/ªY7gyÊ}4c 8]˲‹ëPŠØXn;·Â* ˆ #Ñ>€Â¢2mP @Ƕ(‹ö4gŒÍ|øCÕ c>þ1™×>ó€=ÜÖ¶ŽÂss<¸jË‚l†çKê -7}’C<H±³$÷_Ô装íÕ½ÅS|àÜ?Ä#ßû¨j)!B×í*ûÿýÁµÿ-cðBÂÃ_#ylïƒÈ e´fL^ˆÎ¨iHy@öÿ‰Sѯendstream +xÚÛrÛ6öÝ_¡·¥ÚÆDß\Ç麓8n¤tv¦é-R§é%){õ÷{p£H +²§ÓLf"ðàààÜ/0™aøGfB"©¨šÅŠ#‰˜wxö{¿\‡³ðH‹!ÖÏ«‹Ë,ž)¤$•³Õf@+A8IÈl•ýýŒšÿ¹úõòƒ`\J¤‰úéËÝûktýùîƒÅ Q¥ ²‚:Ô«ûû›»÷·ÿ™/¨À@}¾GŸ®î¾^}´°û¹¢ÑÕ/7KMìâfÕË1”•`¦…øïÅ âY"ÿzS‰˜½ÀFD):Û]pÁàŒyHy±¼ø'8Ø5GCºã"A‚r Zdˆb‡5LPL Åœ ªDÒk˜’†=–ÖÈâÉéW 0 A‰[¥=ÕM7Õ†¢ˆ«DΆ7žðå‘|
©bÄc5ák™W™µÈºÞíÒ*kíWWÛßÕõ½]xî&.B¨B,fr"Ãäj*ÇÄáUÛå©»µÞ8 ¹½{oWê_Ž…,ߤû²óÜU]3'IT—°M«*/̽sÇÁ‚'>å ÿ!Œ9}ú¬W¬ë±ŒuŸ^)cKÂ^¿Ò#® j/¦(æTŽ¯¼©Ò‡2·2?çÍCݺ²~|,ªÇ³J †{U C¬óJ豌ag<æÎôå‡)[‰D"Æñˆ·ž"•$I8Üžà©#Æ…„Pr,B‘MÙ#˜ AxüºÚz¬€ÞFÑ‚!”$ã[¿ÓIu[·pzšÄšà K,Îë’ÄŒò;êÒ èr$dÚ )sª¨MJú’²±!½›ˆÁþ
cú¸oÒ®¨+ Ô2GÁ ןW c1J ˜|7Åx‚o(Ì…bE’¿˜Ý¾í¬ØÞ%ªúÅiâá eT¥»<³ —¢Û •Ôg 3'J[‘ %„M-œÑyBDiùX7plç>m Q›¯UòÎ}w
¤».4‚GµÁÈòÆ‚7µ[L²´ˆvyÛ¦îÆç´,2oQø¶5nد×yžA—À¨ˆn7ZÕS3%‘”ž75 ª@µR&(zþ©{Š‹!ÉScC
F4!äxóYc/8 š@æŒcÛ°* ƒF©}Ê×…ö÷<{çN“q PÚ—¬š*[‡J.C\2 /EYZÚšl£K”uý—^0áœD]§vS+×,Öeº×)J¯µè_«¹Í›ç¼q|wi—ïòÊQ×µ}€‹G¸¹ñ*Mˆ[9¡&ÐMH6öYã]ŠG…ö e<Ã|{r6¸Ú ¶üd]¹í7¬«* '©mëV7 KÍie6ÁÂu! £
}ÐkCoÖOÌž´{·žF0<–H3Š4’ŒîêNŸÅÊs„G@§‰vm"캴0ÂN»M¼™Ý=†²CxÙëÝs˜®-à˜¨ )ÛjĽÖJW¬A˜l,ŒõÚÓÖ,ØIV.óx7hu¼ ݺ¯ÝÖûÒu…p£eoS÷ljµÃݦÏô˜Wy“º‹-nßZ6ö÷²œÃN!Ñ´-r ÂëâFÀé˜F˜æ
¸ÔÒ<•¹¡ +ÈÙiç%ù’oœ6«µ;ö)ö 4«&঄Œê•×ÌÁ;ª€ #Lbú†Xe? è"Uï ÿ=îu(L<ÅŠ ‹ÂïlóòÉ®\AA=G}XAV:ãÊ3´YÒ +òñöÓíÊ ›ú¿Õíç»e@pi*`œ¿-ŽÏ©Y·¿<äÞ™ 8Q˲wëP„ø¨ß>CIÈ@:h¾½ÿ„Y%JO÷Þö]QÝaN‰¼÷CªUºZ9÷·‚¯|àÁõTÙ4 +¿ë}ã<¨+d’0ü¾¤Ð9€M¹õs‘">›ÁÎ(=Q5î4àÛæfX¤î…A
¥ +ÅXÈך<®õƒ”xÂøwhò,ÁÅ¢}Qr¦{AEâäxñkM
„ˆ¼om“¥éõušý8hƒgºÊ€£c56â2>æÄÜZÎdz‹ŸÖûaŸr ¼k–¹³R3y 4<Š°åÍ=zõqù9 t ¶ˆ¶ù†ð yw,™&S`=[͵|ô$³V,˜ÏPƒÇí$Shš)tÌ”SSB“M¸7f8!±R=Q>#¡ÌëØ×Õ¿?y[S·U—7•O)ËC Ž3Ü54_Šýîx¯ž¥·'HÞ¿î9ý$C,ðnóaiô "¸ð¸ (”++Ǯ觑ª¥PˆÆ Zˆ0¿#Ф`üFi쪎NjþÝgû(X Å‘ƒ ªú©…\6M$h6!öQ"xðÑò¨¢æ‰îÕç’!‰Ó áŸKz¬3 +?aïo–×_nïuñ:£ïP|…ô Ã$ƒ½¾Í¸!ˆëÏCÊÖ»¾ÝÔ:CŸ$ƒöùï54Ðç o¶Ñ©¯S`»E
臆é+ Þ ¶…$Pâ·V.<àœ@Ç耩˜˜"¬ød +îSÁ?þëÇñÏB<F,IÎ<1S(TpXz¦´Ä„ðÓ7d¬àýÿ&t}Ûendstream endobj -1876 0 obj << +1882 0 obj << /Type /Page -/Contents 1877 0 R -/Resources 1875 0 R +/Contents 1883 0 R +/Resources 1881 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1840 0 R +/Parent 1846 0 R >> endobj -1878 0 obj << -/D [1876 0 R /XYZ 56.6929 794.5015 null] +1884 0 obj << +/D [1882 0 R /XYZ 56.6929 794.5015 null] >> endobj -1879 0 obj << -/D [1876 0 R /XYZ 56.6929 605.5421 null] +1885 0 obj << +/D [1882 0 R /XYZ 56.6929 546.7712 null] >> endobj -1880 0 obj << -/D [1876 0 R /XYZ 56.6929 504.7499 null] +1886 0 obj << +/D [1882 0 R /XYZ 56.6929 448.103 null] >> endobj -1881 0 obj << -/D [1876 0 R /XYZ 56.6929 441.2539 null] +1887 0 obj << +/D [1882 0 R /XYZ 56.6929 386.1077 null] >> endobj -638 0 obj << -/D [1876 0 R /XYZ 56.6929 401.9804 null] +642 0 obj << +/D [1882 0 R /XYZ 56.6929 347.8768 null] >> endobj -1882 0 obj << -/D [1876 0 R /XYZ 56.6929 368.8239 null] +1888 0 obj << +/D [1882 0 R /XYZ 56.6929 315.1782 null] >> endobj -1883 0 obj << -/D [1876 0 R /XYZ 56.6929 333.1161 null] +1889 0 obj << +/D [1882 0 R /XYZ 56.6929 279.9283 null] >> endobj -1884 0 obj << -/D [1876 0 R /XYZ 56.6929 266.6983 null] +1890 0 obj << +/D [1882 0 R /XYZ 56.6929 215.0111 null] >> endobj -1885 0 obj << -/D [1876 0 R /XYZ 56.6929 206.1673 null] +1891 0 obj << +/D [1882 0 R /XYZ 56.6929 155.9807 null] >> endobj -1875 0 obj << -/Font << /F37 743 0 R /F53 957 0 R /F21 654 0 R /F55 965 0 R /F23 678 0 R /F39 858 0 R /F47 874 0 R /F48 880 0 R >> +1881 0 obj << +/Font << /F37 747 0 R /F53 962 0 R /F21 658 0 R /F55 970 0 R /F23 682 0 R /F39 863 0 R /F47 879 0 R /F48 885 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1888 0 obj << -/Length 2595 +1894 0 obj << +/Length 2682 /Filter /FlateDecode >> stream -xÚ¥ÛrÛ6öÝ_¡éKåÙÅàfú‹“:m ·ñîdÚí-Q7銔5N§ÿ¾çà -ÁRH½6°OŠi¶XlN…›æMC€zèãñø ¦žÜDOÑú¤f‹plU7-vEYÒè:œÚam•W/ « ^áñûqD|SÜÅ3Y -Gö´9¢K™0—Hw ÊÏùýV›2.=Ô£t¿´¯G€z=”ô€(œ4(Æ‘bÜïóðݪ˜¯†8‹H¤@=Ä›ñ“ -&‰ gD -&¹Nû¾1#ûÒÜËÈ4J™¢ê¤hž#áX©G.7–AœPû»‹ÅÈí -â†I£÷x6m:½õú¯ï -°¥…ç€uE_’ \ëõíAóz½ÎªË¢ÊŸÁ0‰Váì(…R$,á&yJ<–ku¨gÀIÄ:Ðó6^STÊhºÎÚù*tÄœnh²Eu3S 9ÈN#Ç"‰‚ðhœ8 jÀº -¤äés"Ú1Mȸ Îì‚3»Î™a ’mAÖ`os@M’=l‰
ãÛpOPB˜‘èa'¡ “0ë’ƒˆÕÜBÔ¦0›$G\Ó -ÌúÀ5oëM;"™D³$yè›Ü†k1Ö†kbŒµS×ÚÍ`y¢Êç^Óo”8§£&°»®Û€*¸9Œ‚È|ŒõÂÊ2ÍÝн¼Oñ#>%!×hÔî%8 äÎAR$œ1ÃtîE¾+qG—e‚ohï[|ï[RN;ØJPÑ…Ý¿Eê^Q®— ·ñž"Иъw®qÿÁŒˆ÷‘K>éIê‘1O‚B,xRÂ{ž„1Šl$é\ FÞ•à\) ®_2 0& ;p$§ª+àºj¢Þnæù S:¦ó‡ e ,Ñ?P7#bÑ`póÁ@,ã—ÌîìØ=F2aÍ0 ‚t$XuHW2QÓ9&r„¡@@A -!MÞÀ*§Áùå¦5oZdÃv v 6÷ª›¼ îiøSØu ž õFy*„ˆåƒc:•†Êðe‹Mjrƒ‡òÓ‚%¼žŠËŽ)åô>«ìjOÄâ"ù o‰1Ô÷5)N‹j^n^²Ú[< lÚ
Ú»Eakr•H´ `ÅFaOÕá†A=ˆ€e½!Á9(é¥1C«ÈÈËc•¢á JDë-˜Vzõ4 YQ5' º0§émÝ4ÅuÓùç˜`–H»’d</CîNUW«=+@4Xæ‰ -ý§.\ Ëš|f5AAšõ"Ô ymo'Üo›a\'Í÷u~Ó3+%b¶øþJô¿XØÀ¸ˆÊºsî" [Ô[_Aàø-4YÍ1 $q„Ža?I¼áv
õ=Ét—Ý7¡ª r“Wù†úÞ~_ÔÑÐH7Ž—þÝmÿPçz:ñˆ2T°òòüâ5mN ²›M¶ 1Õðãz¦:|¡9ˆ å%?Þèpð ˜6}ÖJð:è6SMRÀï^ -^÷Ü@×4Žú}FS*6“}=ô¹Ô1É»¦p½ö¶–ù¾dÒñXC÷ÄîÉÊ&Pø¹ªwU ¯»“ƒ]( Q‹G.UL¨îÒgAÄF0nðÕºï¶!a‡‚¡ëøBÕPÚ ¬ga{gö¶WÏÃú’X\ÓJdÊ?)Ýn[6ÂdIfºèqYê´{$_ÔTÉá›XKw7«â–@”XpD&Š«i |ÛÆWgÇx*åÁCVpÛì.+ʬóÑÖY2rsõÔº ñàcž $ê³O/Þ_þt6cº8¼‡yh¶¾t¯8Á׉æ`s¥Ø^| ÉþñÚáÔÑÿ ñÚ‘„}„ÅîH%,Œ1ø«af9ŸþéQ÷Ö¡Nö—õ<+±I{>AûÏÎ xäæÏC£;¼‰,ò¯$dχ½&Õ“Ù]ûÕ¢+O -xúj9zµ{p5Äé¶?DbÔÅèp¨»ù@HûÞ àã: eÔsþõõBô$Ù¾4žä¢W‚hTùjÍgë…y>Ö a¢È‰R>ýƾy¿ü¯V š/º¼¿–úÃy.‹·g_Òr)Êò݇”_¾ùzmtD©~
ö8rÀ€WÛ7¿¨ ÎÝ¥}ùã.ýu÷iw¡þýëÛŸ¿ÿž¨ û\ ÿ; ùÓwÄýßQîÿ¢Õ SÎÉñ !@딊Hò'„9$½û3ó!íÿTQÖ_endstream +xÚYÝsÛ6÷_¡é=”ž‹P| ˜<9‰Ós¦ù¸‹;Ó™^ h‰²x¡HU¤ìsnú¿ß.€(šŠÓ¹=\€‹Å~þ3?1³šq•§³,O™æBÏ›3>»…¹ Ï„_3‹æÃU/¯Ï~x£²YÎr#Íìz5àe·VÌ®—¿& ?^¾}õËù\jž¼dçsÍyòîâýÏ?íãy.“‹ /?Á«Ì3‹rvþÛõÛ Þh5`¯òœe©F©ñ?Þ¿~Å^}xÿ—ž]^Gq‡G\¡¬¿ŸýúŸ-ádoÏ8S¹Õ³{xáL乜mÎR˜N• +”úìÓÙß#ÃÁ¬ûtJEZY¦Ì&t$Õ”ŽtÎŒ‚)<ÊÏMõoÒE×?Ôåóó¹<ù ‘ú–že³¤A»¢g]5%©Iåƒ øl.,Ë…&Þ»f¹`‹¶YÑÒ#a´a2S^ŸUlS›lö‹5Žò¤«6ۺܹ_ÍÄn¹fÊF M±)—'wóeÚú¥àŠçÉõº¤Íþɹ¬KÚkß• Qûõî\ؤô]_ôå¦lúî9}2¹uí¶¯Ú¦zF“ +3›K!Xª ¹ÖÒÉÑ•»;wF§}ÿ!½Aã=>—£uÎMÇÇ#=V”€Ó+ä}¬¥4e9—ÁÉ)ž% Ù¾¨ðœø†*»+ýL] Ö@«©§D0)ãÚhÏ{Y®Š}ÝϽ ‹b
Æ›ôËiÚò¬ÚºnïË%½Ý<г_ûeè¤{%4KS>Ò} zWR$ÅrIfî:" ‹» z8>nˆÄ‰›¥èBZ*8lå?[·]O£ûª®itã¿Ù—~n]6žo‹O~ÄŸ¼Çëmu>(<©ïNìÛ½·P ZI‘b’ƒccHN¨[r–ÆH³¥ú„!eÆl&íÈŽèž¹šœq©Í؈ÒúóåC#ÕQæÞˆ@ÊɽU,YÅR8 ý~]aÊò¬– ‘ + tÌ·˜:O.˜ÈLrú R0ÉÓ|sr®TBli™-Sá¡øœc’+ÜX´÷ãÍ! BÊW‡½«åÄî +J€Îõ W*“'[gÿö®¯\º“±mèI„m½ iÑn6.« ó7d(()‰§åÓJ‘±Œëì)õžª±' kÁÎû°MÕ© ×MÑ/Ö^™`#f°Ç.[5·S 꼌9•FT:m e48z*hÉÉgEðcz!ç²<D²õ‘lc$[*H)ö kð·°& +é –„€†tñ½ßÇÁ¿‘êa%e ¯1c³q©ØBʦ ›e'BÓ,ëé(4·í®ŸÐL–bE|›Üø«¬ñ V‡kÇ×zðÀ–†P$šrè-}âœßéSí»i{Ïʇ9Œ¼Ê\‚uÊÊ°”Ûãðr1ÅOÄ”„B“ª Nœ^Bà :ªˆÄ3”—^[0VÄãc H‡Øâ‡Ø’2‰´’*"¦Ýoõ`(;¨„û°Oåe,hÆ×tü`Å +ƒ«w)Í@$’ñËA8tÚ…_<€6eçÃ)ÈvO~Õ"ðFýp.„H&ñåŪ?€ò)㤂e˜¼žÊË–)eÓCU¹oËg{Ô ò[ÓkÕ,êý²ôÀ»ð}C¿Cw¤ ìÔÆ#òE¸FiÇAx¿ÃDªݑâ,tgRëc¯((ÊJQGé ð¡¡ÃÍ À4|²&4'‡M¾nÛ®«njÿ‘wçSA€U"dº.CíÎUÄjϦ +6Ê—TY|.iDõª”ð¢&êÝm# Vðk§”i +ݪËðúÁWüdX]pÉÈG4ÿuäDeçÐK¥ò뽆dœçöñ EÊÑ5oÝ
Žï«~0Ÿ;7A +5†«W @Å!L(9H¥ä#42ˆS(ižYKy ‰á²;úû6´‰,3éȡõÉcE ز*¸eQ߶;8Íf*È!9 ïÑ/ÖåS‘R2)›Åî!à\˜80u¯«àÌG—"Èdcÿtêò +ÀÌË«÷¯iqNß‘ÝîŠÍ„«ú‹;pÕã+šQnÄ‹bºÓáA¡nÒ5¯¥d +¶õÉ4%-àó g{"î …¶û>£WB›ÙA Ç\n™ä±+Ülœ¯•S±/™´<€èzü>EÝy ?7í}ãÅë¦öä–¥*
¬6ÕW6UL¨¸é3¯b-×øÄ0lIuÆ#†Øò!…àP>T]Fwݸ<º½ +ãÐS¶åðR¬§½»uµ% ‘‹âlî%ß÷áÎÙ2žK9ºÉòa[ÜU]Ä
i`S4á’ÿ +õå/ï>þtéc¹
<\„9j Ð8^O„¿nºÑâ°ØA}Qdw{ŒZžQÊûNT,è$ öG®³Ëó£æ†óä?N3÷twí‘¢°¾nEmÚ‹)l<¼x†ìÀÃáý…ou§vú#2ƒŠl¡‰:ú Æ ·ýŠÔ"â€ÿ¿!Q÷Ã÷§ö–©ÿ(î<ª3‡îÀó›:!õ(8ÒJ«4üãÏœÄ D2Cm<i÷IÑäëM±˜o–zò0X)J’”'ß™7ïVÿJÕ‡îKZ?ÜÈôÃU)« /¿äõJÔõÛ¿|7}18ÃÔ_·àÉøëÄ <žâþ[÷ð·vš1eœþÇ-F“B¡äBè±èñàDzÿ1 '¹endstream endobj -1887 0 obj << +1893 0 obj << /Type /Page -/Contents 1888 0 R -/Resources 1886 0 R +/Contents 1894 0 R +/Resources 1892 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1891 0 R +/Parent 1897 0 R >> endobj -1889 0 obj << -/D [1887 0 R /XYZ 85.0394 794.5015 null] +1895 0 obj << +/D [1893 0 R /XYZ 85.0394 794.5015 null] >> endobj -1890 0 obj << -/D [1887 0 R /XYZ 85.0394 420.6717 null] +1896 0 obj << +/D [1893 0 R /XYZ 85.0394 368.0049 null] >> endobj -1886 0 obj << -/Font << /F37 743 0 R /F53 957 0 R /F23 678 0 R /F39 858 0 R /F21 654 0 R >> +1892 0 obj << +/Font << /F37 747 0 R /F53 962 0 R /F23 682 0 R /F39 863 0 R /F21 658 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1894 0 obj << -/Length 2221 +1900 0 obj << +/Length 1897 /Filter /FlateDecode >> stream -xÚ¥YOsÛ¶¿ûShz)=¡øKï¦ÚNêNíäÙJçÍ$9Ð"lqB‘ªHÙM§ýîo)R¢-g::\.‹Åîow!6¡ðc“Øp3IŒ$Š25Y¬Nèä¾½;agÚ2Mû\?ÏO~z+’‰!&æñd~ß“¥ ÕšMæÙ§ègÂ(94º¹>?›ž½¿~ûîâútÊŒLd4ûðáâúüò§S®(0'¥ÑÕìúãì7¤}85<š½»¸=ý2ÿõäbÞ©ÕWQátúãäÓ:É`¿žP"ŒV“'x¡„Ã'«©QRˆ–RœÜžü·Øû꧎švÃEÌÇlaz¶0œ(¥å$Q†Ä‚ o‹Ü~z o;Æ©PDÇJÁ€så9/Kؼ¤Q³´0&JïªG‹4ûgºZöMÆú«j’0&AU'dSf‹‘9'Z˜žò¢@¹wßp©ÌÞ§Û¢Aⶠ- &@©íæÑn‚V«¨i±¬êÉŸ)†'„ÂÁ C®´Ìöd}µaM˜^Ø,,®¦NíÉ”qFTBÁñ#F)î5†½»yŒ±ÜE€»œU«¯a>çQS…§_…³v@ï6 -,dŽ„ÆíEˆŒÙo·ï;¿ó× h×¼ 9º— ÷¿µAê -¤#RôÛN–¸Œc´í¿³ÄáX¬ æÆ;ŒXe*$tqPL3û8ÿåýÍKf‘¡Ûkì¦lÁõö[
G 2Æ8ÔOùvµ[WB)·§!9TJu½64Ö”Òƒú œ …nÊcšCŸqÅ Q\ŒT)^ŸÏà™»sÃn»D‚mŠóΪ*^ãDßÊj]çõ~ƒ/ ft,à€L…Jy¤!‡Äl¸r‰y¼[wý°K!=‡Íz{“Ðq îÝ¥ŒOÓôK;ºÃ}©§€ÂŠvf© ¸ ¢d®xoK°NæbDf{;Љ¼Ï‹ï¹ìF_G„CQ¨®òáe篾>ª¯/ýåq€Ož¼Íˆ<èPø£äC8ÄÂþ[ ñ»_ U7Ͳë×[ 9*r±ÜTU“åcu tcLuîÒ Ý -}Þ˜<.¨vâFqŠq¢
âïüâöìæòC¯~a/CøK
î”·.ÕV–Ì´¹ËÐ&äûÀÑÈ{u¥ 5üHß -u|W¢»¬Í“è² +§a5/£MÛ*Ã(
K§Ž¶Ì1Ó:rá°ô} 3}竱§ ÷TÜ•ØZÆC Å×ÄÏ”‚À_6¾¦>J$׃ú%ã…‰Q¡0®òÛ`b«×Ué[¹s‚¥¸2æx1" ‘qÂö[£¡4Wʳ—[,à«°±®ÈÄãõZ g4eS”ðNü5&H]‚º¡’.e¹w8Ûl±»Ú“ ¿l’Ái¤B§ÂæTGÛ@ ×n@íŽwh¥!1˶š¦cf¡PªVñj ‚Bb™îd×xñ¥¢í 鈩M e¬ïIãÇ Ü¹ïÚ(>ܼüÇ*Ï‚Ë°íÒÚ@Âñ5À„J’ Áþ +xÚ¥X_sÛ6 ÷§ðåeò]ÅŠ¤(ŠÛíÁMÒ6[㶉»Ûíƒ"1±®²äYòÜìÏw HP²l+Kz;?˜A +'"ä¼¥£ëÑûN`oÕn tXÃxĆ|¡z¾PŒ‡cJI‰¾ø¢ï'~ö5ºnºÉ_Æ°1¥D rÛÙwÕ:oKä\,“Ô_fâ»#hyQxÓµnÀg!pž\ñ×ñ»èÅÏ[õÛö×íŒÿòÛÏ›÷?þx‚{ýÁãþ±‹Ï_2Þ³Äç‚Ä‘0 +£{Ú½3 +”º=Æ^;žã<´g ^8ÔlãöºcïõåôÔ¿<8KŠ õº´«# òÆmÝ)‹ó´Hð¢Ì¸*›$/-§Ü r“ÔÚBœè2²¼¼ÃYuûBúï
@ ¢Šª¶ 3{‘ðŸU›{0þ}S“H+ŒAøóHb>ßdkL \?Y!¨ç‹8³(æâ8‰eL⻽y;7¨ ·ñUœ(B"Cþ8>H)𤃿K6î€ +‰;4 žN¾ŸoÀºªÖ
..x«)^ +oó
h hߘሑ ÜÔŽ=¯ÎMíªÐùwºÔ"î*ü[CDUK ާ͛cÑ<¬ç# ,¿½ë Ú÷Uµ ŒpÌß#G÷ñŠÐœîTŸ"÷ |¦©P²2ùÖhÜ°W… Q¸‡üÄH -$`ª Ž‘0-gçâLsœ½ ;7B².‹{$´ÎαF †ŒY0(hþ·ä
Šb«¾x +„Tm†8Œ:Œô€„¬Kƒ>ráB¶<sÖUQùBôvŒ „Öm·Õz@xè„ÚT3`=tm#,ŠZVôVìXu`´ZçÆ%.i8‹ åÐ }[Òì +Á)oÕã˜}F}“–ÒëTÌ4/ÕÌñS’L((}¢Õ &TÊ»Öú@ºçanË^»<„C”H ÊÇÄA$ƒÉ~ ÒkÆz–M󨻘áHáß4[æe^7Ø& éJßj¼÷2uÛ.“r“;pÂnFCGU` ó`jp«Öõ¹ËŒé›ë·¿‰ó,ˆÍsà™«Î½x¸Ö&©}J ‘¢ÿ"¦ÒÔ2Ö‚âÿóı 4Š
æF]8 xÅç!¼ß ÞŽé‡ùë·W»å°k]¶àz}_ÃU»Šq +S¾YîÎ
¡ ŠºÛ„4ê>À›?‚£Î°r }ŸDÖ™AŸAÅà*åqwbµùožÝá¶]Á牉ͪ*ž€®×÷eµªóúð˃Ñ#Ž¸éq¹dCß (+&L þˆ`^ÁF;Ç_ºÏÈslµ) ýäs;ºA‹Ä^„€ª"è RP=Fšv½ºNf: ³ý Љ¼Í‹o¹èF_„C-E×ñ€ð²‹†§_=ª¯möå1@ ðCyëyð&åD°ðàã ¶òøq;>_?ªn’ek]×O÷@ó¨Èt±®ª&ˇú=xQÑ…K'tó¨PxÙ
Éc! endobj -1893 0 obj << +1899 0 obj << /Type /Page -/Contents 1894 0 R -/Resources 1892 0 R +/Contents 1900 0 R +/Resources 1898 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1891 0 R +/Parent 1897 0 R >> endobj -1895 0 obj << -/D [1893 0 R /XYZ 56.6929 794.5015 null] ->> endobj -1896 0 obj << -/D [1893 0 R /XYZ 56.6929 513.8248 null] +1901 0 obj << +/D [1899 0 R /XYZ 56.6929 794.5015 null] >> endobj -1897 0 obj << -/D [1893 0 R /XYZ 56.6929 427.0967 null] +1902 0 obj << +/D [1899 0 R /XYZ 56.6929 449.4646 null] >> endobj -1898 0 obj << -/D [1893 0 R /XYZ 56.6929 364.279 null] +1903 0 obj << +/D [1899 0 R /XYZ 56.6929 355.3738 null] >> endobj -642 0 obj << -/D [1893 0 R /XYZ 56.6929 325.4767 null] +1904 0 obj << +/D [1899 0 R /XYZ 56.6929 285.1933 null] >> endobj -1899 0 obj << -/D [1893 0 R /XYZ 56.6929 288.9693 null] +646 0 obj << +/D [1899 0 R /XYZ 56.6929 241.275 null] >> endobj -1900 0 obj << -/D [1893 0 R /XYZ 56.6929 257.0263 null] +1905 0 obj << +/D [1899 0 R /XYZ 56.6929 202.5209 null] >> endobj -1901 0 obj << -/D [1893 0 R /XYZ 56.6929 191.2867 null] +1906 0 obj << +/D [1899 0 R /XYZ 56.6929 168.3311 null] >> endobj -1902 0 obj << -/D [1893 0 R /XYZ 56.6929 119.4786 null] +1907 0 obj << +/D [1899 0 R /XYZ 56.6929 95.2288 null] >> endobj -1892 0 obj << -/Font << /F37 743 0 R /F39 858 0 R /F23 678 0 R /F21 654 0 R /F48 880 0 R /F47 874 0 R /F53 957 0 R >> +1898 0 obj << +/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F21 658 0 R /F48 885 0 R /F47 879 0 R /F53 962 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1905 0 obj << -/Length 3038 +1910 0 obj << +/Length 3181 /Filter /FlateDecode >> stream -xÚ¥Z[Û¶~ß_áG/pÌð.ç)iÒ E»ÙÓlm ´– ±%×’³ÝþúÎð"KZÊNqàQÒˆ Î|s¥Ù‚Â-Œ"TX¹È¬$Š2µXïoèâ3¼{ÃÍ*†To n^}/²…%Vs½xØ æ2„ÃÅoË×÷÷ïîÞ~øõvÅ]¾!·+Eéò§×w¿¼þÑ?»¿µ|ùúý»O·+fe&ˆQ¤ÓtùóÝÛïVß}¼ûþý»»Û? ~¸y÷г5dQ<ýyóÛ tQÀ~¸¡DX£OpC ³–/ö7R ¢¤ñÉîæÓÍÿú oݧ)Q(aˆ2<KÈ‚³cÄ*ÅGÂP–hÁ…ÆÇû‡ ï>½Ø %T¼2Îà#˜<©„@´RÅ…JˆT¸î*Ÿ.iÂðËKF¢Ä’b°$¨[0«ÆK¾m@»F/óS×ìó®Z#^5'&“Ã/Žu‰†³s`‚sˆÖMý;¥üóés65ÀD2³|ØV_n}¼…û2ïÊð ÷ühWúé… LϤ"2Ó|ÀùR>'Q”茪@XÕ©É -¤ °Ï¤™H9
†ÃžÉ€Å§rY”xW;´RåÐêžnòÓ®ó7ëf¿Ç½;‚õ6¯ërçßôOÁÈnÙÔvæìÂ?Ff<án×<Uõç„üSÄH«®jBQÕÕ5gÎN5.Y™(p<SQ&><Ui pŸ”×4'ˆ4R 4‡1£Û–~°kÖùηMÛù‘[ÐêÆ_7§#|rô7/|ˆã]i¹ÇÊ¢–{Ö>ÕuZn|êÝŠm…&ù¹t fÁåN6“ ’‰,‚Éi¥õäÞâ¸ÒKë ¤Ñn€IÔUI˜ÿ@Y0ácéç?µh÷n‰°váL·9¬ªÀ»7åÃ._—{ÀTë?Ü875à5[/:Î%|=1…{µD¨,ê3½¦‰²Yhþ3§T´…ÏÎrÍå_UÛ¡î|âx¦žç©ß΀«¬—«Ã"Au&˜ƒ þ@l9@ˆg2>†Ð‡
®kiCF³o¼týÃr—?6G´ w;A¦®ö<êü, -™OÔç³Û!Õ|vÛS9‘?zFÁ~G"7¶W8D¶ú»œ²Æ ›Ï2@ûEÞzªs#-K° eÙ˜»O}º…p—Ü{( 8ŽÜ¨ÙL^A@ Es|æ¢9ªðà±êZ¬“ sü鄱Ï=,ãµ{*Ë@ɬl0PŒã@¸)þ CÓ#0&ˆab±sFꮂÚ7óÚ¡„vYÛª ÚŽTNÛ딶Á¼!“9k{SíÚÎcò2k‘(ÁÚX× \<àkÄÛ/!¶£UÚch §w³i§AÁ÷‰YtÃXç2ùͳ¿ÉÃË|וÇ:„Ÿ ¿D‡°ƒ…Þõ -Hf ÓèÆæUO5¡œê+ª P]P}¤rbÚ¾(c%òÊ’‘(±ä¨ŒµDr5YòþX…ˆºŽRß6Ç`í RócP@³™d ^eñã: #w®òó©Ï¬œ>Óá›sž}cÈ¢x ~M52“Äf⊠RÍ«¦§rªùò->Cˬ¾ÈÛÙ¿d.éƒGÜ|0æ²AG:”H0p¬¹‘×ã€Æg,8šºå8æ%ćíЊ€û“¯GtŸzçþò5ßU… Í>¯ê3ä‚ ~ˆ¸šúâDÑ -åš‘Ã2auÉ¢õUØà#£ö -lT`© lWas@k›b†S‚û»ÈW$Jð5B WXáOGmЀƒ¾ vPŽãÇ©=aé²ü„]SHá¸×ê^€¯èë¤ Ô2e XqY·g_'ƒìl|%·OÕ]‚Fûr{®t¤Dö‹¢3ib_äH!æqŒW3Pß,˜ ÙÀnˆº ¦!Õ<˜z*¦cL–h#zK -ÅwHApŠ {ÝZ¢„œxœöP·÷¥^Ñ8ß©”ßtðhûZ¥'[¢†ëWEùõUØW"ˆ©î;¬®¶„Y±ì— ~ׯSTëÒU aÓŽ¿ †@2”(¾t. ®~åºl[¿kf4F‹I¿*:pp™×Á]WõáÔ‘Ä.
ž œÛ™nà3] ™õÜÙÀô2 …è.ç˜C¡å*o¤(þÚ7•ó „˜ÐÑ˳ð1¨Zð´sv@C!º,SS ½à>4ŽàIU.òÂ?ö²iÓÓñ¥†Z:$«®W4 ÏSªÛÊ¥úr˜È£Št7^2Ý÷)êµ!DÏ’‰áÓaè×XÕ´Ô‡†ú±Çrqïó¡k½–ï©.8´Hå Z{µÔÉ‹âàœ*u.²Ö—:/YK–:#ÞÆ)úçlùáÞ?@Ö\lÅ¥¨È ÞQɲëÝ`fŒžFEœÝ÷¢`ýs¿œÓA¿œÓq¼tßÌÇKÈŠ·âßÅKïJ¹&LêoLÞ¦íìæ𘯿„Ra$AWpC± ?6‹E®ÂÂà"‡TóXì© »dp…ì)êl½=6MΤF`„,ÓjHÅ/2×S%¸ÇVN¬ùŽØ •·µ±ò¶v®ò†tOu¥]Ç3-§•7NÙøë¹ò¶¾³kÍ Ö Ã›‹ˆ‡ 2É®#ÞfŒ÷½ÈÝÎO Zn ’w8n\ûm%ÁÍ¿¯òbJ -&PZf êŠ -÷æ½² -®:ב†{/¬ ä%_…BȈ³ ô1Ã˶'òn_,«p…%aþɪ›æäÜ>z>GB€òä£7Ë¡€Síß 3¯ú.J¬Wk-Î8¸kÑdHuÁ‚#•ƒúéjaî8Wk]䫯µ^ò•¬µFŒÛuêr¶«å|×,Ë»Ò5³œÙ©íöP’¾Ó ÁíÍSíÒ) n&ë“YÁ!_¤öÛПžø -ýÑ
&H€›ÄF3Eíëòè{Çí*xåÃs˜<ßµq—ƒSþp6‹)>¤{M½{žÄ söH—Õô¼õl ÃnVZcÛx PÅÖVm\W~»ƒË¬8”»Tk,¬ˆÅ̽ûõõO÷?¾û”Ø=Å0A4ž »ðŠÿ!jbt×<¥Nl!n -{ý/„²ÑÙé8
œ;„œã¢'çxásx:%ÍðXGCZC¹ Žì4¥iÀÓñWQ‚j(Ð*,šp˜ûKÛ ÓM]:#BŒp=ždä×nסXq CÖrh -Ožž3ê:\âü¯žîØìÚ”×Ôf\^þ ™
é¿`èóWÛ†,ò܉=†Íxe¢ià]UÇ Ê¦v“Üœfqoâ…òZÒo:`+gÇgßóÈaWfíèÌümN("ÓÍVÚ[æÿý—ºó_!»Æðt\T"üXd -÷ÀX6e½ÿóÝKÞÿn9ôÝendstream +xÚ¥ZKã6¾÷¯ðÑ
Ä >%{šd&A›™ÙLX ›ƒÚ’»…Ø’cÉÝéüúTñeI¦ì>ˆ¦Jd©ê«'Å~l¡¡ÂÈEn$Q”©ÅzwCpï‡æiVh5¤úöþæÝ÷"_b2ž-î7ƒµ4¡Z³Å}ùëòý—/ ?}¸ûïíŠ+ºü–Ü®¥ËŸÞúåý¿ÝÜ—[×ïøøõvÅŒÌ%1Št]þüéÃw«ï>úþ‡Ÿn»ÿñæã}dkÈ:£yúãæ×ß袄7øñ†a´Z¼À J˜1|±»‘J%…3Û›¯7ÿ‰ îÚGS¢PB¥yžg ƈQŠ„¡ ÉV >~ýîç»/÷wŸíÛØgNò£‹7„K–YâCS®Wë¶Ù<V§êLN¹„§hªCÑW ÈT›%<ö?Jùãæê¶q“8³
›ö`IAr +’¡‘…ÄÖœ™ Oš’<_Þõ~çÂïöP¹ë±«J7*üÖEäñ¹jêªñOÛ¾:4Àï³²oÝõåP÷+däÃs"´Ì«(j`¡n ÒdËþ©rì +3`Wb¬Zã;kâÅTFrɵ§tòr+
¾„Qv ;³n‡[¦—U·o›YHˆ$Å•1~Aص?´Û.±³0Df¹§ÃÍ‹¢ ªù½zM,4 ”@Óõ€ˆ ¸s,×MB:#Úhæ iŠ]UΉ'ã$ç4@îáÕúì§ É$˜Ž4cõ¼?)vûzË[~OJà5/¥ÇŒT30q¸ÕË£Ÿ{©û'7µ;‹Ò„id·*Rb¡$* Ý{›€Õ-Æ`í®êÝÄqï&Š„¨rM el¤´ª=çS ÁòG¸þs[—ž‡'ÿÚMUù)´ÎY6WDåùˆ/.H¦” ògv)mòŒHʦ<‚Cv<â !npÄý&DS&Î èWÞöíc/~¸‡Oâ>ºbT)`±•” wî¼âgë=¿žJ¨gøW: Ç<ÑjH|÷y ‹T'\
·4‚¡ùå-QbË¡° b +fÔxËÖÿï9öíÌgP˜¤ÎÁ ^ö×Àç/4Œ
è¿ÁÝ?ÕÛníÜZ&™ó×Y€HRA<Èø›ì"Ë©ò„IwP2bû]Õ¯ÓÐͳvµöL¾<ßÏÕ!±2b-TB÷Ú¡]”õ!±þJdšhPÆØ‘½`5-»}µ®Q h¯8n¼<A¬¶£oï>}ðsáæñÞöÀ,s{`Õ¦<ËÚxÁû5Ñ¿Úk ð\ó\)gWTωdÑóÍxWªÍ0¤ì™s_ë_ìúÐ ÷C¥ð²äYvî® Ë‚x«õØ]ÍF6“E&£»¢rYVø¯±h¥Ê¢ÕÎnŠã¶wÖín缬!`5ÕÖ݉³`d·l ê; 9L#3Žp»m_ÒQ^0E´4êª&5A]6îxÎŽ
nYy™@8<WäÕi @@–R^Óœ RK1Ð º`u`°m×ÅÖ
ŸÚÎ;h uaÔ´îº9 ¬¿¶Î|ˆå Ò'Î5äÆöh´OÜïçcÓ¤å&¸ãè–Fé.l’§Cy ªÈ˜¬V:Gî,Ž«liÜD현yÕcRAõPY° MO`}ŸÒâ~ïÒšn»_ÕžwgÊûm±Ž <èÂú€×|©Cb+¡fÊ&g6*æßé`Q&IÑ7sJE[x´–ƒˆh'Ȩþ¬»Þ%×X»yž©ãyê·sà*r½–G‚?P#[öâyŽŒ!t·Á}]á +yeË@”ØrTƬ^'[~9Ô>¢6‚£ÔŸÚƒ7„î©ùÁ+ ÝL2§²nÚ—°®òñ3+«Ïtøæœço YïØ°˜Wbࢴ¼¢šÕÕ*«šßßâƒ1´Ìúà‹¼|ð9sI <ânäƒ1—õ:Ê|‰Ëš 9=h\Æ‚£©[+`^B\Øö¸±;ºz$‹©wá.ÏÅÖvÏ`X¶»¢nN ¤ vQþ>àjê‹E+”kZË„Õ%‹Î®Â†fÄè+}©ÑÐx"‹™ýUÌìÑÔ¦€Áì^îSæœ)1éEBq?æj ¯}_Þb!.Ì Ç;–M;zÁ*Óæ÷ ‹¦¼ñL\«x%1"VH[¨bªÆ³bómÇ +l¾öîÙÙ¸n—ª¸%ŒÆBûÇ"¹Ô¡#±B´ãLŽ™Ì @w³0â˜=²\]ÆÑj H‘Ê"é@’!™Ñ@qí.™(¨ü‹ÜEª{#H)ˆ"š²1cL)ìŒÃE-»öhõ¶®Ü´Íáê¸u4eÑnÖi ¾ú³Å-’8„â²àŸÚCýWèf\Øúïy"a)<ìtkˆrâkºW@ÝÎyek½fÆ ðîÝÔÞ¡í¹.+7‘ìô3MD<>zWVÏïü{%Âf±·j«JX Np–®ñûÃõº²µg8x@þ" d(Q¼i9\ÝÎMÕuî™Î0N¨IÚEŸþк@í uÝì=I¼¥Æc×S#Ón|¦+1!óØÂ
Iç‘ÈÇ
p9‡J,[s+/
Oyp×ÓIˆõ=ßÉ–'ác85àf'æl†B´ùeF]Ü‚ÿ¾e3u¸(J7íd « « ⊠¯2Ÿ¦Ú. Ѐ>©>+—*Ëa +(Ó}xɲءhJÛ€ô=µH&:„{V‡¾Sc4ÔÑZLPï[ èÇ |°ÅwŸuhL3ìt\Ét‡Tó-RY‡Ö]-rŠ²<x8§Šœ‹¬Å"眵d‘3âmœLñ Ζw_ܲæN—=Å¥¨È ÞQ¨¢®÷™ÖÙ4*âê® ûŸ:åœ:圎ã¥}f>^B>D¸ÿ,^úÌŒ°éùþlÚ6md·û‡bý»/F´¥vN +O—%»Žx“ÇO&^êíÖ- ¿/€1HÞ⸵·•7ÿÞß*JÿÙ‰`¬xzPUÖønÎ+ °ýë0`Š™¯Q4¸M¿í°TŠh®žyXÖ…a?‹¹wm{Ñðß k> AÚÀˆµ ô1ÃÍ.9·/Üg¸A½…õ'»nÚ£u8õzŠ„ GFÍr(àTã7ÇcÌ«¾‹cÄÕ* ¯Z]ÉŽDóöˆ,ÎW«,ˆq‡¹*ëS±Ê:c*Ye
¹òVke6“ó²<WìJ§Ìpf¦VA¾ñ°¶ƒö¥±‰7“ýÇi¬à)Ró6Ì觧¼°C<®ÁÔPu·I¼h®ˆ¢±^wÜ¢"€T><›Å‹mÞrp²ïÏc1¹§flúm³}DŸá4õôŒõdÃVåÛaOá í¬ ÚxD—H b‰àÇm pÑø9ÍÿýiäéPi{µ<SA%¶Ž,S(*Æò)ëñ#ÊsÞÿFðl“endstream endobj -1904 0 obj << +1909 0 obj << /Type /Page -/Contents 1905 0 R -/Resources 1903 0 R +/Contents 1910 0 R +/Resources 1908 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1891 0 R +/Parent 1897 0 R >> endobj -1906 0 obj << -/D [1904 0 R /XYZ 85.0394 794.5015 null] +1911 0 obj << +/D [1909 0 R /XYZ 85.0394 794.5015 null] >> endobj -1907 0 obj << -/D [1904 0 R /XYZ 85.0394 751.8648 null] +1912 0 obj << +/D [1909 0 R /XYZ 85.0394 751.0357 null] >> endobj -1908 0 obj << -/D [1904 0 R /XYZ 85.0394 153.4294 null] +1913 0 obj << +/D [1909 0 R /XYZ 85.0394 641.026 null] >> endobj -1903 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F39 858 0 R /F55 965 0 R /F48 880 0 R >> +1908 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F55 970 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1911 0 obj << -/Length 438 +1916 0 obj << +/Length 733 /Filter /FlateDecode >> stream -xÚ¥SMo›@½ó+öR™îì»GbÇQ‚]C¤Ji–Á‘¥°V1QÕßlg£8Ê¡BBìÌ›Ù÷Þ H¨{HÊ0C#@R”dÓ”<»Ü,À#&>b uU߯yB Å)·^/
Tk$eõ^Rˆ\ ®òé$ž,òëY–G1‘ˆ0].³|:ÿÅLRvHJÃû4HïÆØ22,LgY=•·AVžiùÔ‘òžÓïàñ‰’Ê)¸
(p£%ùãÐFš@HRp~Š¼EðãÜÐË¥pjWì‚ ")Ù;3¤Å Ì(²l•Þ‹^«âžƒ”ÄL€(xk«Í/*©v/ü6Vö1Øìí¶OH/a×M]yè¡»ð烂j©Ý5Ãdæùt,5GRU³³»C×®»};†Võ¶n#Ôam7õº_Û×õËò¨40¥Ô±= !ï\‰¹óOH&Ü—DªlúPÞ,V_2·]ÝÚº™]Ý ÆÃdoû¶Û½6Ÿí‰»° î…©Ò3ÅÿÞ¡·E$Àµfoëáëb‰W¬N¤zqˆúõÓ¶}äþjnÕÃendstream +xÚ¥UßO£@~ç¯à’co³ûˆZ=/Z{¶&&êì‘+‹4Æÿþ†( .MÚaùæ›™of§Ì§ða¾ÒD[nýØJ¢(Sþºô¨¿wg ë1Ñ +¤ÛmõÒ»°‘‹„*„íRë<j—'x9Ú„ ¶§|Ìñw×äZ/Eû-×cÊÔíÒ-ÚëÊÝSÊ7»:m‹Ê}ÃÓ:4ÁÎaPiFA#- %Üø‹‰` FÀô´É]iès”N+^ñ‚êà¹.\‹fŠ?MZ>osdvÄbpð®
é"O„ƒFH ]‘@‡\†Æºªë™ ož+—n3Ñ @b˜=ÄjëjÛLÄ–¨NØ™`“iÕcþä¯<€Ñ* 6mÚæeîÚsn{Å ûb°™ÛW|*\Ô1ú‘àŒ0©5H>ŒnG–×í0 x5!¯´DÒ!¸KË<ûT_Kb¸=ôËÉaÔ[{8£3è5ºm03BÆ(—³ÆI.–W__¶Žýž*jà‹
#Ó½P£ûbGh¬a¼™ä„5ÌÔÑùü]mŸTV®hZ¸KUG×ùSŽ3æÖýÕ¼Äë7Ñxm×Ð3¤'SzDö”T\ºè=6¹Yý¸ºþZs×æµË[ÌdùÚÀl5øp\¹¦ªÛbW~¶!`·D'¶'}Kñ¿wõû’Œ‰0†¿¯áƒí+ÎzHª+Ž1ó!õa«Ìý ˳Øendstream endobj -1910 0 obj << +1915 0 obj << /Type /Page -/Contents 1911 0 R -/Resources 1909 0 R +/Contents 1916 0 R +/Resources 1914 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1891 0 R +/Parent 1897 0 R >> endobj -1912 0 obj << -/D [1910 0 R /XYZ 56.6929 794.5015 null] +1917 0 obj << +/D [1915 0 R /XYZ 56.6929 794.5015 null] >> endobj -1913 0 obj << -/D [1910 0 R /XYZ 56.6929 752.4085 null] +1918 0 obj << +/D [1915 0 R /XYZ 56.6929 752.4085 null] >> endobj -1914 0 obj << -/D [1910 0 R /XYZ 56.6929 692.3565 null] +1919 0 obj << +/D [1915 0 R /XYZ 56.6929 626.6031 null] >> endobj -1909 0 obj << -/Font << /F37 743 0 R /F21 654 0 R /F23 678 0 R /F47 874 0 R >> +1920 0 obj << +/D [1915 0 R /XYZ 56.6929 566.5511 null] +>> endobj +1914 0 obj << +/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F48 885 0 R /F39 863 0 R /F47 879 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1131 0 obj -[646 0 R /Fit] +1137 0 obj +[650 0 R /Fit] endobj -1915 0 obj << +1921 0 obj << /Type /Encoding /Differences [ 0 /.notdef 1/dotaccent/fi/fl/fraction/hungarumlaut/Lslash/lslash/ogonek/ring 10/.notdef 11/breve/minus 13/.notdef 14/Zcaron/zcaron/caron/dotlessi/dotlessj/ff/ffi/ffl/notequal/infinity/lessequal/greaterequal/partialdiff/summation/product/pi/grave/quotesingle/space/exclam/quotedbl/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/backslash/bracketright/asciicircum/underscore/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright/asciitilde 127/.notdef 128/Euro/integral/quotesinglbase/florin/quotedblbase/ellipsis/dagger/daggerdbl/circumflex/perthousand/Scaron/guilsinglleft/OE/Omega/radical/approxequal 144/.notdef 147/quotedblleft/quotedblright/bullet/endash/emdash/tilde/trademark/scaron/guilsinglright/oe/Delta/lozenge/Ydieresis 160/.notdef 161/exclamdown/cent/sterling/currency/yen/brokenbar/section/dieresis/copyright/ordfeminine/guillemotleft/logicalnot/hyphen/registered/macron/degree/plusminus/twosuperior/threesuperior/acute/mu/paragraph/periodcentered/cedilla/onesuperior/ordmasculine/guillemotright/onequarter/onehalf/threequarters/questiondown/Agrave/Aacute/Acircumflex/Atilde/Adieresis/Aring/AE/Ccedilla/Egrave/Eacute/Ecircumflex/Edieresis/Igrave/Iacute/Icircumflex/Idieresis/Eth/Ntilde/Ograve/Oacute/Ocircumflex/Otilde/Odieresis/multiply/Oslash/Ugrave/Uacute/Ucircumflex/Udieresis/Yacute/Thorn/germandbls/agrave/aacute/acircumflex/atilde/adieresis/aring/ae/ccedilla/egrave/eacute/ecircumflex/edieresis/igrave/iacute/icircumflex/idieresis/eth/ntilde/ograve/oacute/ocircumflex/otilde/odieresis/divide/oslash/ugrave/uacute/ucircumflex/udieresis/yacute/thorn/ydieresis] >> endobj -1476 0 obj << +1483 0 obj << /Length1 1628 /Length2 8040 /Length3 532 @@ -8414,7 +8474,7 @@ endobj stream xÚíte\Ôí¶6Ò ˆtÃÐÝÝÝÝ¡Ä0 00Ì ÝÝÝÝ ’‚R" ‚´t ÒÈ‹>ïÞûüž³?³?½¿w¾Ìÿ^×Z׺î7¶ ‡Œ5Ü ¬‡¹rðpr‹ t´P(ÐWç…CfL9g0ЇÉ]Á¢ -Äü{fX E +Äü{fX E 0Üú÷äè¹aÖÃöOÃoäæìüØã?ûÿxýœÿŒ=ì a.ÌÁAb¡ö™9Y®
Ä£ò/z{xÂœ*Þè—ÖÁ»2#×Dj,ïêÃ8›ÇEµyÍî;Ýoª²n
öA™ºÓÁß‹(üèX>ã.3v±ms™W`g Åú Ϩ¯"› rnêèš—ß¡RŽwð9£ _²Ò¹Ð_8=óe4%v>oFÀk(Ù?`LÙ½¼`ê ú4ð±ûåÃ&9[~ƒ˜;26cLà«|r)Sƒj…×Íl(ßÛ b¬Å7ÎßÊçÏVð™h9Žù,¢I‚°RÊ• e®äß·RÆ%=²ìÙ
êt›œ(†Ì%³LÇî)®Ž>1Ù¥‘„µ…^Ñ2¼éˆO£Ý %õ‰>•pjÕr{2–ÂwÍ<–g¬™-j—!3cäáakIè,AŒ$ÁLˆÇÆ‹J¯³nöùU» Ïm›Þ‰D3 @@ -8437,370 +8497,356 @@ $OíœàÅ€DÈ t‡Í=žÝbóÆÃwî6ß"£“˵?”JËOP2RÐ oQo+†â1) ©w†¦ÜèådîI½È Z¿VÍ(e÷åû È"[vQÔüFØs(úF$'‘qL ®/¶!õÔ
¤HvkÖ‰Œh¼È‰¬ê؉á¶o?Ùa:Šÿ±qêcŒ° gã!_QÇ~ÏWê¡1üaœ¯UÝGmã§Yñmn%ìRãr9÷¬ß0qˆ5†/‚E…(êÚ“†,W‚˜$Ù½ï¶åçLxËÎÔ|ú 奕£w†Z|ÂV€ãž÷,éOd ÞyŠGÝ
ŽÎ¨Ý3lÍ4©¿Î\×T2Zª½Ag—.7Ù#ÏPæï™v¼eŦQLÞ»±Oþ¼Ô\’ ¬ÿĵJÅñ¾(š3Ç].Å*,MÎ>ÛBx(ÃSÃó|D³uû‚Þ¡ï†{:Ò‘Á¨2G9¡Cê{É•<|?ÒK áéá@F)Ø,êw÷ó?È ¸ ¢Ëa„Çh%Ù±o ^Œñ{‹6™Ý @¥-«ä%Å~jÉwXjz1îi´·î¬%uÕ3^¿±g¸`d+ÎK[ŽDe—„]âò†YèÖýÇ?Ï>£³HjË,èkѸÍhÔ8Š” ™v_Å
[ªJÖ®²9m=·âú?\‹k>¼à¬‡¤*³Ñ³ž,Y
ê<‹ý¹uÓ Z/ZV$S·é#ƒmNOš¨5M@¿§rãÝ0Hõ7¬&7[àçŽAØñêOõƧÈêÚ5±pE6~d»Ž^.x¨T1¬µ¤$£Í7¿ÿ4òÆêüj§‹G1¬èípoóÌ3³QýÐZ:œNÍÆéç,0½‹ Š‡Zg‹ðâ£à)‹Q©¯³‹X""œÛÆ0ÏÁ¾äBvFA‚)Y9(ÎYÖý…ì¬S…|¸Ôü¾“qbæÇN.LÔX§…_ï‚¿œ%%½¥åŒìé|°D>W²7}C –Í#—ZR¸$º`bÛGο…a¿9gÝS%\”Á/œ îñhC|?s§ Ø…šg¯ÎÙÈ)ª¬m}ÐvÖËk†Ÿ.bÉ&O üõí+uqfº`Îa‡„°£â,I§ã¯½/‘˜÷ÇÝ›Á¤'P6ߢH‚Ú?÷›½šÙ¹˜Žà9¦ŠmHr7:pMRYŸ#£ 'æW¥¿ðKCß|-¡mWÝ躖nᲶË0–«ÞÐ3äÛÙ=j’¸Ë-,n–³e±€¢üb½iÙ;‘˜Hâ°l<)žL.ßÐYÖÿ°Ú·)wL=(‚Œ£± L|)=å'ÀÆ-Å@²öò¾µ<ÃNrä³6îµEôʃ3±d¶kÓ»¬ÿ‹%ôµøü·(kD~ô(¬_yñ‡Í; ¯åä²fùOî{&*‰äyÒ¯9ÛB±T¨d>è.<Sâ¢éX3p7«Á~ ª"럽Ÿ“lË´ÍÔDQÿfŒ°Ì -*s"}Y
;Ò‰¢ú{YÌÝÇí]p¶Òݯ€ Ž¶Xo³êÙ} +*s"}Y
;Ò‰¢ú{YÌÝÇí]p¶Òݯ€ Ž¶Xo³êÙ} endobj -1477 0 obj << +1484 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1915 0 R +/Encoding 1921 0 R /FirstChar 67 /LastChar 85 -/Widths 1916 0 R -/BaseFont /WDIAMI+URWPalladioL-Bold-Slant_167 -/FontDescriptor 1475 0 R +/Widths 1922 0 R +/BaseFont /NTJURL+URWPalladioL-Bold-Slant_167 +/FontDescriptor 1482 0 R >> endobj -1475 0 obj << +1482 0 obj << /Ascent 708 /CapHeight 672 /Descent -266 -/FontName /WDIAMI+URWPalladioL-Bold-Slant_167 +/FontName /NTJURL+URWPalladioL-Bold-Slant_167 /ItalicAngle -9 /StemV 123 /XHeight 471 /FontBBox [-152 -301 1000 935] /Flags 4 /CharSet (/C/D/E/H/I/O/R/S/T/U) -/FontFile 1476 0 R +/FontFile 1483 0 R >> endobj -1916 0 obj +1922 0 obj [722 833 611 0 0 833 389 0 0 0 0 0 833 0 0 722 611 667 778 ] endobj -1292 0 obj << +1298 0 obj << /Length1 771 /Length2 1151 /Length3 532 -/Length 1712 +/Length 1711 /Filter /FlateDecode >> stream -xÚíRkPSבª¡Ly©¤jÝ F‰Ü<5„„1
‡ÄœrJr=œ@Ò -·€/Ò*ÂÆk‘ªUðÕÖé”þlݹ{ÿÙë[ß^ëÛß^4HCaàP % &G‚¥R ‡
È3›M¡Ñ‚qXA ¢ `!à>`¥N¸Ë -¤ -B
kÉJ…È0%&i4`íÄt°N‡ñ bR8 -M:<‰Ã(4U éߤ–,"8B íýû×N&#JDÒ`Àþƒ=sþˆI“pDâÙL6›CÉýö”8¥™Ub‚¦ - É* §Lü«°4pzúúàVÊÄì‘îM`}ZP¦72–qƒË#[±—û>ý'¢R‡ã0JLŽiÐÛX…žÂ° VR¬70¥ß–÷žÚV#®ì8jOOŸo>¼¥íÜÖ“f?æPŸË5¼á‡(øƒ_·:Œ s* ŽøŠ©x½ÔS¢,‹QÆÚÚílqt£—ï“Íx JHšv©´µå=ííw Ò¼ üèùôNÆ9ûÚU÷8ü -êpÁôê›7^>ÎIÝØÞkuøò ,¦$–ž^µ–ÿ÷Ná•ñûaX%fº47aßS×WVjËí®Ô[Žf©TjwÝìÿb›®WõµS8ûSZcK+e™ó}®ÉËÌÀæ}sl@Sc„ô—™ýtA¿‡ùÝ.I^vqxŒ$zdÞÑreõ<XÕ®kY׬
@/äÔÉsIëàúqÒöÐÖ&½¤ýºhÇô'‰ÏŸ÷<{m¢6?P=lÜO‹ñöÝ ˜áå=DocSí¯~fñˆS¨¿¸KˆÃ{ V˜ZµÿìËj•‚XÁõ\·G>ó´r)÷„cÚ½eÿ’®óþºÑ²;A¬·Ä]D?ì«xøóÅfÓ~nRhp|Oò™¨›Þ—jêÏW†¸ÖäOO´4††V.jœ‰u÷Íõpï7ÛI”0Ô;ºô…÷Õg³\xãc Ž }t½ðü¡8ÚÒ0|ØgAŽýàæy©;™÷£–}±;Q“lèð9aù~Î’½PTcÍÞÔcÕÕÛ´†G‚Y{Ž -ê rìʲÎ>5~§*Å AWÄƧKé´õ—k N…‘Ï+’™x\à™æGŽ3¸g>ZÏóKHyÕpxíÁ*ã® Ý\¾`ûzŠÐ¡¯»_@MZœózËHw˜ÎÁYÜØoEï 5ßþ¾ôo>{ÐYçé ûÕâ€fjíùÿŒ®XÃà:«¢ŒlMœwmß8
jªÐÖ¸Ñ ·KAŠ/«»Eêúä‰;jiJ3m %h‡^ž¨,–³rºWœôñ VVQÙbÉ)ÍR›i·§>.v xŠo:p5œ__¶ -¼U ¹n¤|ÜÿNç¸.×õòpAûO§—IUÒ×ñ²=ÉsU™}ÇœÌÆÎ’yNeú`†×–Ó ?ç~qÊÔ°Éf¾Z }c«nÛvÍõJ¸ÜQËÙ #ÐsŸ ‰mϳ{7»`%•ú jZ\;ªßW^2Ð{dÇÅÌè÷ó-w¼äî%ââW¶qòÚÁ6ÛÒ„C\¡Kƒ²¡Î´ûBE‘ã‡rM0^•§l½•´yå´¶þø.‡íœƒê¬¢ÎÙùM3æïØô£Û£%²ò/לãçeÈφòzg}ë¹°PM@IÙ' ÅURóž~÷ ôŽ}ÈÈ¢Ç1gÌùÏÔ=§}ËŠ$C—;D7[vÓj:5U%ù»¥³«]Ö¿æt¨í²ðª“ÿ®¶¢6Þ'cÔ%Ä‹Wñ'—º}mH.ä„t™ †5¯Ê„ÐÃÍXˆãêž—Ö@fn®¨$¨óúÎauR}ûµÒÜŸÐhY=u¼µrß,Nt.+ u¾P`7ãÞWâ>ý&¹Šß?z^Üœxµûó‘5;ø/¬‰,zb!CA¬èâͱnx’y(¯’ZÓÇþ›‹òÿÿ”X˜V§R~¸Œ§endstream +xÚíRiTSבª¡¬2©¤j=,Œyn4„„1d %æÞ[’{éå’2ˆ8PIU–EltÉ(*J…UE (µÄ*¼N¤U„,ŸEªVEÀ©¬««ôgûëwΟ³¿ý½¿óÍp
g‰a|ˆc$ bC"à/“I!. Î\.Áð'9‰âX€œDD +=ÀjðV +ÑP5r5Ç(BêÙ@¬Vƒu“7ÒÁ:$ !2˜Mƒ +l@RPŒÆ™Ô$Å”8¼amÚÛTB¤S¢€Û”L& DÂ8¦ÖQÒ8kqªBiù'dM/ ¨U«×Ê5“姜úK^®AÕú߸&MK"á0B`Ó©ÑÈq2FµšéY))W£ +1–¢F +W‡‹f/ô¸Unï{»c|š›Bd¿Ì èb +\ŒïvKósJ‚£¥‘£ ŽV8(j¨½ƒªé–H}k\‹Æ»P0X –ïZßÉó.†Ò÷0Ö%¿düºdÇÌ'‰ÏŸ÷>{m ·<Pd¹X8 Ÿíî¹ß7ÃÍ}˜ÙÎ¥[_ýÌä+W}q—û÷Ú¬2´iþíÛŸÝ<&1ÂëyN7Ž|æjæÑî‰Æ5{Ëÿ%‹sÿºÉ´;A¢³Æ^Ä>ì¯|øóÅÃ~^R |oò™ˆ›î—jÎW8ÖÌL45V-iš÷ øÍwñq\è5×Nœ0T;ͺuE÷Ug³ øã‹Ž‰<t¿ðú¡$ÒÔ8rØcQ®õÐæ©;Ù÷#–gyþbu.¤6YßéY{Âôý¼e{áˆlVØÞÔc5!5Û4úGÂ9{Ž +ë BVåÙgŸˆ›¾S–E Î-dãÓåÌ6Æú˵H»¢Ðç•Él"Ö÷LK+F`ƒÇdz2xg>ZÏ÷JHyÕísxÝÁê¬] <º¹rÑöõ4‘MÏ€ž&ù´$÷õ–Ñž ½¤©=ÞŒÝ=j¼ý} * Ø|ö ½ÖÕ;æ«¥>-ôºóÿ[ÆâÙ+#²¸êX÷BËþ Ü\©©ubÀNƒ—üä)nfg“Ìñ[égÌÔœfØH2½<QUÅÉ ìYuÒÃ…\3V)—JO©—[̸=sìq‰óàSbÓ«Á‚†ò°ïŠÐ¸ÑŠ ï;]Ú<ÇË#… ?^!SÊ^LJïIž¯ÌÔë:çe6u•.°+×ù³Ü¶œþ(ësÞ§ ›,æk¥¡ð7–ªöm× ¯GÙj ÍÑB ïÙ‘˜Ž|«ws +WÓéŸ`†¥ucº}uÁ¥ƒ}Gv\ÌŒ|¿ÀtÇ-ʹTRòÊ26ªn¨Ý²,áOäШh¬7ì¾PYlûa”ÚŸ(ÈW´ÝJÚ¼zXV×p|—Ívè *»¸knAó¬…;6ýèôhYFxÅ—q>çùQgù}¾s¾u]\¤"ᤜCE’ê)w%=ÁÙÏ|¿{~Ç:`tÉãè3Æ‚烪ÞÓžåÅÒáËâ›»µ]ê¦ê҂ݲ¹5ëß ²;Ô~YtÕÎ{W{q;ÿ“¶qú2òÅ«ø“˾Ö'A݆‡A-k2aìp `»¶·Ñ¡Í——'.õ뺾sD•ÔÐq,ï',2¼>ÑVµo™Çñi›E,Zͺ÷Á•ØO¿I® Œ—´$^íù|4l‡à…9‘ÃL,bÉÉUÝüyæ
O2CåWÑkû¹sÑþ_ࢀBÈ ×ȉTÚoU팯endstream endobj -1293 0 obj << +1299 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1917 0 R +/Encoding 1923 0 R /FirstChar 60 /LastChar 62 -/Widths 1918 0 R -/BaseFont /SKCKVU+CMMI10 -/FontDescriptor 1291 0 R +/Widths 1924 0 R +/BaseFont /AUHQZV+CMMI10 +/FontDescriptor 1297 0 R >> endobj -1291 0 obj << +1297 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 -/FontName /SKCKVU+CMMI10 +/FontName /AUHQZV+CMMI10 /ItalicAngle -14.04 /StemV 72 /XHeight 431 /FontBBox [-32 -250 1048 750] /Flags 4 /CharSet (/less/greater) -/FontFile 1292 0 R +/FontFile 1298 0 R >> endobj -1918 0 obj +1924 0 obj [778 0 778 ] endobj -1917 0 obj << +1923 0 obj << /Type /Encoding /Differences [ 0 /.notdef 60/less 61/.notdef 62/greater 63/.notdef] >> endobj -992 0 obj << +997 0 obj << /Length1 1608 /Length2 7939 /Length3 532 -/Length 8789 -/Filter /FlateDecode ->> -stream -xÚívgPTݶ-HPPÉ™&çÐÉ™–œƒº–††î&K(HÎQÉH ’sÎ 9#$ˆ€øÐïžsn}ïüº÷üzõvÕ®ÚkÎ¹Æ sŽ¹VmVF-]^Yª„p@óùž4`ö–Î(]°ƒ¯ ÜEXYå‘P0†pP -G8ÚC зÿãºP( -²B р۬Z -JñDÛ‚Ñ¿s£`·n -÷ßoÓ?QZ·ª£õÜ o‰ýW êÈ?¿1ään -uƒZ|™BX‰¼LLIB—Qdt
(<okbu:æ}Ò{ŸíûÑ쓼,Vôâº4¯rèéMûäŽãÏõg\=-äpöæxèA3gkö£¶Qî
~ó<¤]ÃpÏà µ%l“Ç+Ú:æ¹×w醄x‡ß9}™]²}IYÎ ‰¼*"É Vb—åìì²Å|ý~ÎÞÑÛÝÕÙ|ŒÓºNà ‰Ï*î‚MÈæë”N#m¢_äa™ ŒéøÛÔªÏ!´0sL^µ$0ÙÂÿTh5ë¹[Fúù{ª\™ÏíßÉúÐâ¦Ùé%üföC ~–fí*!Î:‰EvýÔzð´÷Û6гßÕ•Ü ê³º£Âgü«e‰;}ƒv©b]ùßÖÒï6”‡ùÚ}sø.Gj¢T«$Kñ£•I
âQ–®‹Â~ÒìEÛ1w.ì*Çbr|¬½}$oÖ‡·Gs]> Ã?V1ñŸx£+w¿³^õ9’e‡Ð†ŠÚ¥ÍäÊu””7œœ¸äNÑ ÷ˆ¨/ùŠõ.‹ú…'Ð)á0äPùÝÚ…k e -¸ éÛR§ö -]8sô&sß±|*åŸî#>cÕ¯‡‹úœ‚ œEëÑymeê÷AÆ€>8m„ 1œ4¬jõõr¦XÜâd8„²³¤¿V>M ¼çÀ7ÁÜ&N\€*ÄJÒÜOµøï8•^Ýçôáö¼J%qõ‡ ‘®.µ&у;ìXBÒ0ÊÚcVKŸ0-S۷ߌG?óí·Eƒòñ(€(§¸Ëš’=´øô•ú+y\J6.æê” ‹‚œÞ»ó^eúÞ‚·V„(õb*$Ã=AÁžéÌmEéïa9ž oñ€Rý3™ÙÑS×!÷8ÎãÒ9‹ÅÕçÜrƒÅ£‘C™Äù\‹-ÕÕ²k±ò¡øáÃÍ8 -ušÅ?Ó<–“G¬ -hEá$=k -jK‹ê\ô#Œ²Ô_j$ø>Û}~';Äë 08~Ⱥ:{¤j7l˜ŒEÖÉ/‘ÕØô 5³î*Tô#ÛýêŒm¥(Ÿ¡\B½MÈ b\Zk³u -ÂKJ^'W²Ù3FÁå¤éÉ.ðÊüÊÕúìðã‹’c=,®¬3jÉ/Ì ¬}橃”.‡Ó6Š& êÝîU¸¨Ûkh•kgݺKÙ!ì`M«a'x0¡ƒÌ ùts«,t-¥§†ìC+µýÝû¡ÝÒ^aâBý" ðf°Üpû š±›õvV¥³ƒÃ÷Ì
×pJs®a¯—ÀœÉAgÔ6tå„è/ZÅkQ^î›íF“’Ô¯[t#¾]°rÛÅ‹60^Ùý” ðzFYËP’OI*ÄmÉ×d«òñ¦¾âWfÖòûé!ou¾qÊÜCZhµ ÐÞ“iQ'÷|(D¦¶xÙ*ª÷d_R½˜Ñ%8Z?Èb+ - à‹)קw&¬š>òÕäø° DxùAt€næ£`öVkøqvëð1']/¸t ¡yô8,TÎ.a Os%/i5 -ÉzY`yÖP@-ª¤9¯ŸÇæžÓçý¤>Vo€Ì¢éªd>Í/ˆöõÏ}êY -³¸~h—•¸8˸ƒŒFF¹õ•Šû?ih -vžj ×`Ú[›öÇ|-…>°ë=].žàŽJ,}”›ûÈi±ð!æÛ‹õÛ‰ÌJ«—–r• øœEk ±9,ð”ˆO’ܽ…n®Ðq !páxÓ“1¶¥©~à]ÙDXÞÑTtÿ Xwd‰–¸rϽ”T…³k«eÛ?ƒ6òg¶òõPªj~«YÏZš{JÃÁp´hü@AÓœlú)ÿ€úBè×@aS‡ž”Y2(õ¡r‹¼û^*84å¹uÞVi¢¾¡HÑÂé…ØÊÏ–)ŸÃ;c4¢ž/{Ž¬Ûe/HìEˆ…jŽÚ¼9CÖ •Š ‚ŒüsB—W¨Èòè!&÷E*l.\ÙÈL4´ÚËÚ÷h„¢Æ·GñZÍŽ<çYÎz9†CÅŸäᦠTKñÅ3c/ÕQYV;Ò+Q%_Vªdá¸ô¿ð‘8ܳ
v4e$2iä*õ Œ9csõ3k~YžØaí¼zf ¡ äö•Á’±¥;Éb1ª"(GO_XLô>ÅGçë%:}¨= Â[#™µ¿Nôp½vCžªÂíu>N1
¬Ê¼íQù„8¬ì¨`æWn-aö§m+´Y¬~5A”XĽh§"hV לÞ_9æJqB—¡Ìh'·ïžrs)¤<ÃÑ!]‚ŒšÙZ~\ÍHÒzU´NÏh“[€Hái3 -RgT$vÊ®éï9‡á׺ù§ßWŸa|…psØ´"ÀÅÑÁñgð~¸¿Õxy¿oA‹z¾Â¼âÕëPúí -GZ÷± Z6ÂlƒÝI§(²‡ +/Length 8790 +/Filter /FlateDecode +>> +stream +xÚívgPTݶ-HPPÉIhrM‘œirNlèZº›,Q@¢ 9G%#A2HÎ9ƒäŒd âC¿{ιõ½óëÞóëÕÛU»j¯9çsÌ9æZµY´tyd K¨"ÂÍäåЀÙ[:£tÁj<²8pk&`a‘CBÁhÂA Œ†>B! + ³‚: +uû
€¡ + sDn³jÉ+þÅm Fÿ΂ݺëÛHÂÊùwI|·0·^4æ€ ¡nèß¹,¡ +a%ð21% ]F‘Ñ5 ÿ¼ˆÕè˜÷Iï}¶ïGD³Obð²hÑ‹ëÒ@ÞÊ¡g7uî“;Ž?×U87zZÈálÍñЃ,Z/&ŽÖìG ¬
"\þ|æy„I»†áž‡jKØ&Oø
6V´uÌs¯ï> jDâ ~çðerÉö%e>w$ò¶J¨ˆ$k|X‰A\–³³Ëóõû9[GowWgó1Në:
Wz$>‹˜ 6!k˜¯S:”‰~‘g„e.0¦ãclKP«>»àÂÌ1yÕ’ Àd ÿS¡Õ¬çn9´éçï©|e>·'ëC‹›f§—ЛÙq€úYšµ«„8ë$fÚõSëÁ·RÞoÛ@*¾« ʹAÔguG…*|«eB‰;}ƒv©¢]ùßÖÒï6”‡yÛ}sx/Gj¢T«$Jñ£•H
âQ–®‹B~RlEÛ1w.ì*Çbr|¬½}$nÖ‡·Gs]> Ã?V1òx£+w¿³\õ9’e‡Ð†ŠØ¥ÍäÊv””7œœ¸äNÑ ÷«/ùŠö.‹ú…&Ð)âá0äPùÝÚ…k ¥ èé¹ éÛR§ö +^8³÷&sݱ|&éŸî#6cÕ¯‡‹úœ‚ œEë=öÚÊÔïƒ.Œ}(pÚéc8hXÔêëeM±¸ÄÈpefI|š +8xÏŽo‚¹
Lœ¸ +R!ß1Âr<;Þâ$ûg2³£§Ä¯Cǥs‹©Ï¹å‹E#‡„2‰ó9[ª«eÖb äBñÇ›;qäë4‹¦y,'XÈ. ó¹^Ûû¾çm}l3S@+'éY“W[ZTç¤ay þR#ÁWeôù ì¯w<Ààø!ËêHô‘ªÝ°a2Y'ŸxVc[ЃÖ̺«P‘|m÷ L¨3X´•¢|FSp õ6!wˆ¥qiÍÖ)/)y4ž^ÉdÏ—“¦'»À+Oð+Wë³Ã/HŽõ°8³:̨%¾0€°nô™¦Rº NSX)šÄ©wo¸Vá"n®¡U®uë.ýe‡°ƒ5†âÁ„v0äÓ=̲е”ž²ÔÂtwï‡tKy…‰ ö €À›Á²Ãí/hÆnfÔÛYÏß35|\Ã)͹b€½^s$QÛ<.'DÑ +(^‹òp߬h7š” ~Ý¢ñí‚…Ë.^,°‰ðzÈî§D€×û3ÊZú’|JRA.KÞ&[å/0õî¼2³–ÛOy«óCú ÒB«e€öžt‹:¹ïäCA2µÅËV‘ÀP½'Ûz”êÅŒ~,ÁÑ’ØAkQè + Çö7=s`[šzþáÞ•Må ME÷¿€uG–h‰+÷ÜKI•9º¶Z¶ý3h#`+]¥J¢æ·šõ¬¥¸¦4 G‹Æä5ÍɦŸñ
¨/„~
2…°ëIš%ƒR *µÈ¹ï¥‚CSž[çm•&ê,œ^ˆ®ül™ò‰0¼3F£!âù2°gáȺÝYzñ‚Ä^˜X@°æ¨Í›#díQ¿¸ ˜ßÈ?'ty…Š,ÿˆbx_¸Âæ••ÌDC«½¬}F0j|{¯Õ\þ˜ßsžù¬—}8$QŒái núAµ$o<½öR •eµ#"Uòe¥rÞ‰Kÿ ñÃ=Û`GS"“H®bʘ#6W?³æ—å‰ ÖÎ+ëíø ·¯ô– -ÝI{ˆQeY:BøÂb¢÷‘>:_/!€ÐéË@íáÞÑȬýu¢‡3èµ+òLn¯óqŠq`Uúmò'ÄaeG- +óŠW¯C鶰€®ô +„©ÊìiÝÇ.h™³
6'¢È 6 +VÍŠ2Û71sz 8o+VPÚ^M£õ‚¨‰J®ÆÕe/ýéœGÎ>Î +òÎ qE„¹¯øç*+nû…Æ—²;O eŸöY:«*š“ïgœò'\Ý7"µkûl‡ÉqèËÑÌ'ð9‘Tgeix ¿qVV^ÐÅnOiêlÄ&Àh1ÿ¥ n† Šo-R’È!î±~x“ýè‘·ÞøyoÏõÏ4íÙ{¦Å\4X ²‰¤÷ •Ï´±ÝÈ/åµ½¸N%{’;4u)Ç!‹=íè¡ç"Â3¬¶Ðœš® `¬õ<xö¡Øà + 1±#-@ëÓóÄ<ì¾âæ©)[‰Ø“9QuC —̨é-ûFæÉ€?›ëþYû|96£àj’òÖåUNºnî…XÓ°‰Ä·ÏGÑÅk'uÁêFd×É>0¼ f»åæ6ç -#vƒl|¯göÕšŽùí:qÄÔyN¿3-y„¨Å–UÇâ${Læ6¬ÆÚRøÉ™¼ó¥?"áZ¾þþË\øQ>È” §{õîû7l] +™mÜtW ?e‡ÌŠØÇRXÝŸ¶«
qÐNøb%2t)( æß- Ö§9¢A¸‰Éš2žŠŸ±;Njf:¯ƒ9NÃïÊœT)š…ùïš=l“'v!V‚»ú7?êÑš\“Äk=ò†º¦ù^š -2~ ë‰Uïs‘.»o¨ËªüaMfsÍ%W2b+¯ø¾ +( Ì°?ø6|Kú‘œ™µÁ86<6zlDÌ)®VésF¢¹¦GfôZ¸èøJü
P!HlÆ<¼H›8ºîeg©õ/¶D-¾ú‰¤÷ ã›UêYœqáÕ±Ç øË +*Ïp›Â¤A wÓ'v•ù7Vš4¶¨ž+jÙÚN9dB<o¬L©oÝÌ#%p áÔn³òäAH41ס
tö. Zm½0ë¼r˜$‰®XrJJ&¼è
¢—Ë™¯`¾eM¹»3µ¤¯û_ê÷ðö}d½)(A=À_D ‰ÔôÛòbN¿Ø}® ÆÿÄ5,¢Óc9A7!ô{•K*J^ŸÀ~™j '÷%UY Ü{ñ•Ý‡å]ä"Lžïxiå2¬Ž/ï b…U¸ƒjå×)4§"ò§ªÓ ?Uôü¬Ë÷ -žä¶5Äõv!.[7$›\ÙÌù ö %Ü-DÇ9øÓ\¯ÔÍŸÄ7 & Oâ×ÏžÅÚÅ8“£òÅff\Æ
--â×6™…ÈXÓØø¬ï¾ÆÇ„)h}YÆ ð–êA±>–?qhY êJÁoȯü¸"Š˜‰œñµŠýVw$ˆÇÑ5-C¶Ãö&šg ŸI}2Ñ»5ãùáö¶DăuéBÿ;¤»¥ªïÕ\rþhüæx€Í?‚^z:“Å„ê!Ïå¨Ú -DЃqB[äßTœB<ug(°Ø˦×ý9J~¿|º#ß*ý2üÌ‘ÔLÉ{¾OO±ÏïùƒiÌ‚øœÎ'=Ú‰d ž•TŸT¿ÇÍ8ÕíÌ¿Þó£œÁ8©È«ÚÁZ±€,m³2ÓDŽñC£{p›®
Î>*«ic:5uª ÍÐåS;ùEÑÎÙÀHoÑÏWçx ×ØÄИ0uÎlPÎ5 —¢ú½»<>ÕW:‹ƒoY2’˜HJyf€ÇòTcª§Y½ªÄæ'Jçx{êI_Í[¾ÆuE^n¥ñÙ±pmËISDx°ñ¸U -JŠ+Y–¾^#Y%ÿ GpXŽÒ0Nãˆ&^-`iªiðŸ;ÐNU‡UîS ’7K±Åüð[Žç&“vñ;ÁsZ §â§u‰ö´{§¸àôò‡ëòÔˆBW
×B‹CóáiòT£ÊÚÿ“±'ŒÒÞÚ¾
ZwÕ¢‰?U Û.[
h‡)qŒÐÇ -¯5Áƒ ¨“¹Ýa%µxkÐÏ_WÃp)ÉâüdÃS<C&fåc—Åo FÏT±Õ„ú° -)è@#{ë>Y]K ¢þäWOk‹à0É -m›Hi‘œô
d„†q. „WôâPløFûÐÀî ±Ü"“[¹É`¬?sòŠô£NÙêqüiv Ž&#‘ÑPb6G¨4Ùpòã¹>¼¾_$”ì¹J‘N x?~«=!ädœGû¥ªw³ -‡¯0&;ì8u¶IýÚ¼ü?"¦ûø}¶lÞK©#«ÞÓBüFçõ'Ã÷bc-~Žò8îêÜÕ, |¦,kÏ%äq†Ö‰~^÷ŽÓ×™E°~r¥¡˜[©¹Ùéù _T¾lÌâÍî -ù¡M½Þöxhá,ÿ -áHQ þY»Bå <GJÞ,6]JOU?ÀÕ«Uh´\ï MNñÂçzŽùy¬˜+߸+¤ „#äoàùØÈ)ÏøÅ PØ -Û9ÔB1®¥Ò[Yù=cÁöâS§¹óp—ü›ÏUÞYKf†mˆ¡ãž\%¬,Ü1õ È<o« »—ÆØ1D*@„ã¯O‡¿q¡ùî)uô¼ÍÌâýükjgWØ!›ÖöÎÏb¶wéÜ/žbmS`¼•9yì>ÕjªâD^ûÐ."߷ƽú5Zï°Æ溱@²¬®fµ4ðÎ^‚›M²¸©ým|ÿ ¯©‰É«ê4 -$L¦nW`6»SN™’h܉¥::`í ?ä·¾:*Q “ן”„y ·±,ˆÅ’·õç ?‘²}ùT{·BV°£3ëÉZmmsÇBkÙ-’Ãøá+@™d× Ä¾€ËM¥Üšô³lŒ~‹ûÛ«/xôñTpïÅM~âÓ¶•˜IÓA éoc_3¥KNI/6V à&âûßÕ{´adÂ{Þ@:C&] [°A=Ûe¾¶5YØøJ>ªí®(íPãHš(b"»,ŸÚšíÑ)„Ï\˺_ºw‘©¿cð>b»¨Oœ»ÛybôÃ$ N`ðöL~kñ^óÛSïž]Þ ÙXƒ‚AW°}´e•!]¨µØìà×fÏH Í·Œš’ ƒGïa:Õsg«1ì8ñÍÑ –äiöÉñhCìò´g¯Ë8ßêô-Ì–~‘9V|T±&Nn·äML† ‘§ÚDü” ¹Ú>I^Ž”[û•ÞJ¶½ÕÉò<
ë•Zv·yÁ<ü0ˆ¤5ºŒ„hO!ƒÈ÷sÿððd‡åÁúÌ´Jb+"ä(2mfƒ77Ê¿”Í -8*v4ºÏÄ^±ûà+h5zê2¶;šÞþ,-õQü! C$yw9†CšJO ™Åˆq\`±"H,Þ)T<icº ¿ª}ZþK§{«Þ®ûªè&4CSQ~åâ7 ê -QH;ǘ¢&šùŸe“ô¿žUÙ|µ°Sc0R2YE]¨ -‡á{__ bçâ.°ßþ -LóÃI8GU–¿Bã¡\‚–Ÿˆ{éõ´Sû›7M‹Š–…;ûÛ䃵h¹0GQœ&÷
<‹"œ_ý¼ÈAze‰ÀN2ÿPÜJ"u ]©¶ÕLòs.}æQùü‰iõHö5¨ñ‹‚‘öqLðëƒýUj[’ =Á®…1Ñè²YÆHOŠåoq ’„!¿‡RÒ¯¸ð%ê«~u¯ ³¿0Š×·6î;>nE=m½aÔ\{\ÄcïQq”&T/bµ^þü‹}m“¹ò
A’ü陈×O/ÍI>c×b%ÒÌ&ìýºªú· ¶mJ;û7žb{ª6eC‰Æô_è<@ÀbW’+Q'‘šäçÚU›‚ݧ/ˆ+ƒË°a -<¤þdÑ
_IÒõ.˜ê¢Ï\9¾§é-xÚÖ-9?›ìÐv_ wóý}¾éH` …Ñ'>Êß4¬>äŽT‹¬ÌÛúGäµGÔà…$Í ï‚7LI›u`žUJ2ì„΃79ç¯~f´láÊΚìïW 5?|¸':U—.ûrJo ÇÓlÔË5áAÜçxE ³º×Ø §‰3Ç•ÚTñ#åKþtâ•.iKW@ö/É›ÔÑ÷ ûj&Q ¦ Œ²È˜¥t°Èð§Äh-ؤ1íý b?e¾™F Š– ÉXrÙ/&Šjz©¨rAÁM°re.2Òe%ÉÍ£™6"5[¹(H4 :\mdb“™[i: ýP½2“¿Ýä÷ö0JÑ»pÕh¯Qš Q¨ý±Qó_»Ã7;mþã«÷Aú^ÁÐ; Ó èvñ¡Õñ¥ã«*’Hóß¹,QëtT½}…ÁbWý€g”ùxÔ$Ó¬GÞ×™®'}¡uÞói õ´’D§ùõ; ¼x ðÞÔ¡Æ°~.
°öâ%ÅÅ4O”˜»ª¡ Þ»Bï\ÿÆÈæ -†ìvm…$t§³ÎLd?莑ˆ+í–«I&VñZ"-¿35MGöÊìä§7À Ñ4‰>ÅauA×W¯½r‚…`Hã×W{Ûw1Û®¹E¥^["W¬%BŽ… >«íÜMÑ#nNCuy‹¼Hû %Tž,TÜþ0]4.ïdîžk0œPañœ„5ðY ÓëF–?ªU'?Õ‹«žäfü¸Š·Ö¤qC r®až1j, †º¿÷2Ó“=²õáÿ¶D4ÏØeÊÀ¿I
Üóv¼ vþ´b„dîÿ¼ø)xý)\+"oÜ´¦ÜD1å[|)h$úØûe GUeŸ?õ¾†Ó<åízznKB†Éd–¬ö…Àÿò!øÿ -endobj -993 0 obj << +žä²5Äõv!.[7$›\ÉÌù ö)%Ü-DÇ9øÓ\¯äͯø7 F Oâ×ÏžÅÚÅ8i“£òÅf&\†
+-â×6™…ÈXÓØø,ï¾ÆÇ„Ék}YÆ ð”êA±<‘‹?qâoY êLÁoȯü¸"‚˜‰œñµŠýVw$€ÇÞ5-M¶Ãú&š{ ŸQ}2Ñ»5ãùáö¶xĽuéBÿ;¤»¥ªïÕ\rþhüæx¿Í?‚^iºÇ&‹ ÕCžËQµb\¸THüe%¤¼®QÕE²üO¥}¿:y´ÀJ ÛAHù åP¤-´á€[kNÔ/ˆ<Í©ÁEÁ‹zHÃ('¿8/ÖÈ><ï·NZN,±$íŽÝ\ë|.ʳ4 +Úu&IFlµ PÈ‹˜<>ê¼çO}ö•>ݧ·ðgžF±;YuQTˆ §ÿæ‡ ¬ßôtD¤ûfP˜{s“cÞ·+J .>xi¾’²È¦{¹3Åš®Þ~—ÛãŒd@ãa‚äÄ·Ž„kï887Kp¥ôRXŠCãóÑ°áTîEQæü^w~@³ßG±¸½Kë 3rÎN¡ÀK’jùÚ +}~Ï LcÄçt>í ÔN$c÷¬¤úœ ú=nÆ©ngþõž å ÆIE^ÕÖŠ +!dÌF æö/¨˜õpŽI^ø©Ý©²‰µ([|«Fv/f»H/>_!üËê¹ocG¥%ÅÉ s5“•ŽnÇ5¾Z‚ÏÝŸ¤±ðJ©ýšžÇÝ\UËúö¡
î[Ÿ2Êíß2û²Qx„úûs‘½¯Ø« PU XäxŠnO +IÇäœ÷îÍóÍè v ó4ý ð
CihTðÞ²° ÇÒf%’2Ž +Oyâ|g܇;Òðh¬Ù#1|éôë6Ög²›œ·UëáÇ rk_‹öw€º«¹j!:/œ*¼È_Ô¦ ¶S+³(#>ûpKÕs%ìÛø“hj£ê·ßN +\O–ˆuõ–.½½h8¤Ëµ[%-n&í—o{Ø,OJ‹ä k ƒ$4Œsz!¼¢‡bÃ7Ú‡vçˆemÝÊ5Hcý™’W¤ uÊTãO³‰³7 †³Ê;B¥È†“ŸÌõáõý"¡dËUŒtúÀóñ[í¹0!Ã<Ú—(U½›È>ä9íÁ;˜Ö€7¤ÊÞ:À¤Õ²y £7ÀÔÁT}I”C¶–‘Qîì¹È\·ÞWõ3›Ã½ZÆ™&ÝhÄlÊÞK\o`~~çt!•†ó(à '¤§tq Y†¶bëÑ4r3ÛDZëòa[ö_ó> (ÁÔE7 bO;8<0¹8Ô4;Õª>*ËVëu?+« h–H½~šq»x/·}$ãºÊá+¡V8|ýƒ!Ù‘`Ç©³Mò×ÎàåÇøQÝ'ï³eò^J Yõžâ7:¯? ¾kñs”ÛqWç®fa Š’Œý 4>§ ÇZ'úy]Ü;_GdRÁú È•†bn¥æf§çƒ\Qù²1³7› +3ú·<Ȉ› h¥=¯`·C-ãZ*¾•‘Û3ØJ`+>…p˜;w cÁ¿ù\åµdf؆:îÉVÂÊ £QÏ +Ló¶Ú±{i C¤üD8þúñ7.4ß=£Nƒ~ØA·™Y¼ŸíQíì +;dÕÚÞùYÌú.ëÅ3¬m +Œ·Ò'OܧZM•Èk ÚEä»óÔAøV¿F+á ÖØ\7H”ÕÁ¬–ÞÙ‹s± +A7µ¢¿ï?å151"yUF„I×íòÏfwÊ*Q;1WG¬ ä‡üÖWG9 +dòú“¢Ï¡ã6–±hò¶þ|áç RÖ/?‚jïVÈttf=]«mîXCh-»E²`?|(“躃Øçw¹©”]“RÉÆè·¸¿½ú‚[ O÷^Üä'^m[ñ™4]aÄ‘þÖ9ö5QºÄ”ÔbcÅ‘n"¾ÿ]½GF&<ç
¤3dRµ°%‘ ”Ê.ÓµÉÂÆWòQmw)‡GÒDa™e¹ÔÖlNA|¦Z–ýÒ½‹Lý ƒ÷ÛE}b\ÝîL» &épƒ·gr[‹÷šßžz÷ìòdÈÄ º‚íüë£-« ‡Z‹ÎîpnöŒ´Ð|˨) 2xqô ¦S=w¶Ã†ß
jIž6a› 6Ä.OSy]ÆñþS§oa¶Ô«ˆÌ±â£Š51r»%ob2üpȈ EÐ&â§ÜÈÕöIòÊp¤ì‚è¯ôV²íNæçiX¯Ô²»Í æá‡A$Ñe$D{òD¾Ÿû‡‡';,Ög¦•k\Ü Gái3¼q¸Qþ¥L +Xæ"¢Úbò3¸ý]ub7¾‚夨õù-ÅsÅK>ˆ<– !!’ =j‰Á
bê÷](åÏi·t9 ù +KÆ.H a½+-Ε[åòÿÑÒñx Ciif|-is \‹¦ÿ €|6±m¦ÍñŠ =“1ä`K^!y9ÊÌßIjX÷žXHO~ûLýì«œÈF7v—")òï@µW™[zb™®ÕÚ4“*ý÷L´ªŽœ0–¯z$¹Š/‚„à{>UiO³ýE©²5êæ÷”t¦=Ä;î +€¯À4?œt€sTeù›!4 J%h¹‰¸—ŽQÏ:µ¿yÓ´(kY¸³½M>X‹–
sôqÀir ÐÀ³8!ÂùÕÏS€ ¤Sì$óÅ$R÷Ñ• amPÍ$?çÔg•ËŸ˜Vd[ƒ1Ëi ÇO°<Ø_¥¶%yÐœáZ.›eˆô¤Xþ*Iò{()õŠ_¼¾êW÷ºÛ £x}kã¾ããVÔ³Ö–I͵'EÜö Gi‚õÂV;áåÏ¿Ø×6™+Ý$Éž {ýTö"1Ðœä5v-V$ÍlÂÞ¯«ª›bݦ´³ã)º§ÊoS6”hLGñ…îÇ,v%¹u©I~®]%¾)Ñ}ú‚¸2¸ âoJ°]^¯ÿRÓ HmØ;Âúž +8>Ô +²© +3ã½+ôÞÊ•÷aˆlª Ïn×–OBw:ëÌDöƒ^ቃ€¸Rn¹šd¢¯ÅÓò;SÓtd®Ì A~z M“èR Vt}õÚ+'˜ †4~}µ÷°}³íÚš[T:áµ%|Å’Q"èXê³ÚÎÝ9"áòç0Tw³È‹d·¿Pô@åÉ@ÅìÓEâòxOæî¹Ã åÏIXUb_4²üQ
¨:ù©^\õ47ãÇU ¸µ& ²ðc
óŒA«`á0Ôýµ˜—™žÌ‘¥ˆß·%¢y†.Sz¾M²hàž·ãý°óg
#$SÿçÅOÁëÏàBø[yã¦5åž Šq(OÜâƒL#‘'Þ/ãØ«*ûü©¯ð5X1œæ)ol×Ós[2L&³d´/øÿ—ÁÿøÀ +#Ñ{0ÒŽàÿ +endobj +998 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1915 0 R +/Encoding 1921 0 R /FirstChar 36 /LastChar 121 -/Widths 1919 0 R -/BaseFont /MVOATH+NimbusSanL-Bold -/FontDescriptor 991 0 R +/Widths 1925 0 R +/BaseFont /MTTJYO+NimbusSanL-Bold +/FontDescriptor 996 0 R >> endobj -991 0 obj << +996 0 obj << /Ascent 722 /CapHeight 722 /Descent -217 -/FontName /MVOATH+NimbusSanL-Bold +/FontName /MTTJYO+NimbusSanL-Bold /ItalicAngle 0 /StemV 141 /XHeight 532 /FontBBox [-173 -307 1003 949] /Flags 4 /CharSet (/dollar/hyphen/semicolon/C/D/E/F/G/I/L/N/O/R/T/U/Y/a/c/d/e/f/g/h/i/l/m/n/o/p/q/r/s/t/u/w/y) -/FontFile 992 0 R +/FontFile 997 0 R >> endobj -1919 0 obj +1925 0 obj [556 0 0 0 0 0 0 0 0 333 0 0 0 0 0 0 0 0 0 0 0 0 0 333 0 0 0 0 0 0 0 722 722 667 611 778 0 278 0 0 611 0 722 778 0 0 722 0 611 722 0 0 0 667 0 0 0 0 0 0 0 556 0 556 611 556 333 611 611 278 0 0 278 889 611 611 611 611 389 556 333 611 0 778 0 556 ] endobj -989 0 obj << +994 0 obj << /Length1 1166 -/Length2 8219 +/Length2 8264 /Length3 544 -/Length 9029 -/Filter /FlateDecode ->> -stream -xÚízU\\kö%Ü ’P¸CáNp‡àîP@áRxð@ $¸»»»»
nÁ‚»; ÷öÿvOßîyš·ùÍ9çûÖÚgí½×·O=™’*“ˆ™½ HÒÞÂÄÊ ä(‚mM\œUíä™T@.€WÓ™ŠJ
±ýýJˆ9Œ!`{;qcÈ+¯féP0v°¬@> 'ëëÈþW ½ @É lkï PA@N6`»WJÜÞÔÅdQuqp°ƒÌT@Îö.N¦ g>€ùkeÿ™ fïàᶰ„ -²±wø#Ó«„ÈäôZ´Ù ±JæÆf`È íh-!>scÐ+ÆìlÎl‚°Ð½*ag&foû‡€3ò ž‰ƒ@¦¯My°üÝ7k;{7;¯ÿ€ÍÁvf¶dæâÀ¢nvtɈÿOð+„ü/ÌpÙ€¼@6 -rr~M -ø’€"ÛQ?yG#«ƒRxƒSÖ†m43Û+ŠÆé; ,… ©>5!Ñ.âæk í`»·,n1¿¯ rÈá”e×wXbìË„ÕÏYîÔ}[he°öÁzÓWøÝÅ)r ›(~³a°\€×Éï¶c¾ ED]Åãô·<¹fEÙÌŒÒõû YW\ö˜µõÎ0³ÚpCÒI;ü& eâu5Ž†õ¶sM‘¨Íže•0p]³÷R›€»û=¸lG +»ó”Ea×>Ÿm’:ÚªTCÊ«¤"é*U± –æú¡üw³ÓT uËcÝ-µn÷³Í)=Ž]¡)v ê°-$Öº ó"š¦2G¸—êtK}ŒX[ñ®ôõ.€rþ´´%€Ä8êªÎ'“‡„ -÷)ì%¤}Õ6“]<n¤òÐ,YÏç„ÉA$±zªÊ¦SD$ÚÊ[=”x¢èØ%#k,“Îíæ¤ö*KQ%Àò¡j1²T1#] ÝhDÂqIñ-0QX^H¸‘BÿÄæjV¹Qä—‹¥J]Ê>yg\“Ý$ZjHôUû·pÐÛ¦ôÐÁ/&Oé¾!WŠº]šóĆàD@ I?Íœ‹.‘ JY -)²·- Á~ê#ØyeoðzéOëß· ÊY±Écý-¸¼qÂ?Ê—àûSØà«a³îû"–¡;·¬·”Ùæó
\ååñרXŽDbë¹H,Ìd(Óœ–ÅËæÛž®yY*R‡:± -O<]…xsW½°}E¹.d>ü;ñÎF·qÊ :Rg¾ÆÉ5¨ú~«î†@Ý€È,Ï~'žn;{›q¢Tõó¤µzþž›vô<Ñ£YäægX -ˆ’~¦ÃJÿRžÚ¯ ¯‡%>p»G
5Ñ\DSÒ˜ÇCõ~c\òyÀWÌSEÉ ^B‰!IÍ'ª[?ø´/rî!]y-5¨¯õpRo!s™Ý°·.t)ºš¸ÍP––ºÕôìá˜T Sœû—½¿Æ)m [f Kœó| 3yŸÎæh‚À94Ðõ–Ì|$µÿHU'\fc!ßKK´T -—…œ \‹à}9Žôä“op…~{ìƒ °CÏÕÑÈú²’~
ÜV njBL ¹Å°oÈ¡ì+PÉq“2 À=jßÝ"[¸Ï~pü\îà€²'ê¼Ì# „1ó„À)ý ÅEðV3J °™µäœt‚L&p#ºÁH«*|›¢çË} ü^¿¯F¤Ñ·õ*òÔ}”w]ˆÈ¨ %ÎœU‡îJŒe!}‚ÞŽa[]s@áƒyhžuÜýIK±,6®ðÝzÚ€$Ví®ª
[‹{˜¶ùœ'v Ø>À‰Ö” Æ6ìÆ7€á,5PÍ¿ŽÑòsF曬e»p¶fkÁ–Ä2g>JjÌdÑÒ*”Æd(ëBçˆÓSMºŒvkuEúCǘž¬ `g“Èñ[*¿O‚ZŒri¹z…ÿ3 oâ9N¯!úÐéL JgH2Û<ª"
Æ)cømR"N|ÃI–ú@àÂHó èg÷Ø!ÎÚVBú,Õ ¬kie¨£žÅˆ(¨iGÞtä“ܪ›æÝÀK¿± q§‘Ï ½H±2i®b®š)ó»Ê&Zvð1öi? ¾RÀÓtãÓD÷Ê ¯2~/bÕÉØ>ÍXÑî-tÁ‡ÌF…&ʤ§ ÕE¤O¬Hª¥Š"uó*æ9…nïæS<¹ -ûÈ“Öó²‰ÁÕ¢_eÓTî^ú1 -ô 2ो¡¦ -zö. ™&žÂ"?RB·ª;•¼Æ¤ÇÃÞ‹ÂGH[Ç©é°ôX]wA$&·OÅ/Î"B<ÚOw›“u»Vš‡ú°âFÛI~[D"Çñ - \§+?ù¦ÞÈ»UráÃì ãÁÛº€”<ÎeÂÛ;/ù)JÈħDÊ7Æúx6ƒå©%áæÜ€5¸¶rlb,®E{D‡‚nÞºI¬Xß—F¸N[0D*.hIõ{bM@ŽlLZ8Vô1sgçã&ýÜsß~)Ì8Òr^œæÆcXÐúAØ0ÿ=<“o&ʨ,®BÏ‚cþl¢¹{˜Àבä*¯ü£V‚][ m¦¶¬ÍñM§}_ðYI{2_3¶z}¼JâÔï×â/‘#Òìf¼'ŠÕ5ë„—ú‰‹ÿ@΀( vÅ'•éZ u¿týLô%-d8=ïò^Eú JKÓó.›Ï ð®‘Mõö´‡\wõÛF?~ÊàzT… -3DvdíÓäÁBª0$ýxª›‚ô3×ÃÏc³3¬{຿ø¥¦S §4@²AWÅ6×™»ž]}ÇçŠfTw.Á)ÙÃÔwbÁúá¢Nv5)îðE3ÍEyñÑñÛär†).ùÄ»rcO:tÖÉV½õ_/[ÝÞíŒ OÂô±G>y eÅdæ&ûy©‡wÝ©Xpì(WÔ
¡J->/å -nñëç‚8 ™˜+¨±‹?vòK=¸eI—ªÄÁÿ°’qËÿèšPGõºõ‘3=Au±P -¶v«¢¹Ò¼ ¸ªÁWNÌÍeìáá2—eÝÐ12]&„‚òwnª³Á= ‚R‡/‘µàv5-!¶ü“ê®ïJ
>êRïÉ|ÔG˜P†[P»ký»Ç•«‘ÕžÕò5£mŸ©Ê¼« -bÝ -~kКY ãYç–€'bK\ûÿúe Üñƒ›£žr Y€Ø„— @WfU:º½ç(ëÃïø ;lÞ@ÞÀ·k=†ŒêAotZA xÖ«Ž6;ÆÉ×ý¶Šêý¬†.ŠI'µüá¢ôˆ'D[»zëäî”îv¸!ËPÒÑ^š¡¾T¥-ÄMn&’nÆÑÝ7ÇJã¢Çjh5®A»•®B¬;k 1Z®>UkNÈ»*rÃBá«1ND\ôÀ4Œ§Ú[[54AÑ~¥d‘õ^ÓPŒÖÐø>„ ;{ê³ïÆ:/DJ*(äJ Ž©™úˆu4!Á?n
•ÍôöR·âøµ0›?Å—_‘»3]ëô«{¨å +¶pã•”×?¡Ç¥±„]dénnd[a5n Øàš«ûSÝuŽ&341 Aˆ ÷Û ’¨5§dý¦kµ?!ùþŒ—Q“L/²|ö ÇŠ¾‰ºi¼5pebÙEJ€Þ[,BÜ% F9V-€ƒ.âà†Ñ13îƒä)vÍ£Ælµúè:ŸU‚SðÕbQš -ÓŠŠ±êé²àLß4ä0Ó§Ô©¬*Aê«kw/XnzQ/¬gE=Ù¬¡=iÀ[«ÚJ
' ~ã1ÄF*†1BñÎJ3²)¢(
ƒQ›áå¹c•&L†ü`s€<XŒ{Ï -+Óèrì v F[׋¤¨™Ê~œüd—yô,i¹&ãƒÝ6g}Ä/ßTß!êMÂÑÚßÒ‘¼ýkô ,°bÞÑPn%ao—Dt(»Æ圾ң¦× ¶b‰bsëÐ(¢Cveʯ"<sþJ9áv9HÓÞz³å)S@ ìå´®”Ù-Û5˜ÆÒø®àÂÉLÖKð}9];µTøjÝ'¼ -"©ì³¢âµ ÌÃû›1©2Q–BCAîpº)îy‹;¿ì@;ÿØÔtüÝEKtñd½Á<8œPbßD¯'}󔉙Õ]¹L9(kV[*Ž†tùå¶nö ©Ë0Ìg»ƒ -:CÿÑ`Péî5)Šuy6±}ðáSÙ2c'¡ÉiKÎ…æ}ÌwáLq ¯Ô:vÆ'J(1Ì+ñ8MÂhôGë/‘»?ƒºÃ Ù$2m“Æ£¯ŽeØßÙ)ßWÓ9f.b¸‹¦¦œ|Y ì8¸+D´à×ç¸%ãÊ¥§&ºsü1ÃŒŽyö:’ÓF E\3ºµÇ*?–Óÿ"ö[ÙRTõ"ɈñY ̹¬ë‰ Q8”_¾„éÍ*Í€-ºšˆo^,›ã#,ÜR ³ñâ¡•NQ¯¥-¯4¸A¥Ãú-ípë·É:Ó˜É{Œ…~… íÃüÅËFb,§ØHKû8ÓFÒ´*Ì>|Ðgq¨gKL?,%sˆã{ÂÔ¶ œv•Í¤ÂÜ *O:š…ÄüŒ¤(é4è ·6ž?x[(ûb×b¾\›ãÜ£,dî×/§þ#'#XÐÚk_]PîWÈN h²Ä)ß®.‚¹fÛaÆ¿5*«eØT[ÅÇ9puºôøwòf¸jdO’ Oìp•Ó~•ñÓ;7 "£û.F:zD¬ñ ÕÎhö¾Íá‚Ÿ ñ˜(8Pj˧•"Hlp pÁYãAløkßê1rvjY m`žÑ@ÎåQ#~|JÐÄŽ¡]ï–€+ÌN1³œ>Cóóš/cÑátù`ô¨¨S·ˆ§ü‹ -wò{Í ëtv+’#Øm=ûÛF?Xug¥‡ÃF¾Tkªàpãt‰õÈ,€±ÔVA¾1é]q!7ÁwIkŽ}\„Ã$ºÃ‘eì2·g‘ Ú ë‘vn]¢´ÞÅf><À5`æýî‡ð
¦a”uz¡›åè4².ø¹ nW}Œ"4?Ìf•Ê@‡ÆŠ £Ôp9Õ4UwàßJReM0`>éUamÛ“íž[Ï’2
c>œ|yü¢ˆzl1nÐý§³¤[’É\E[4BWÀÛê O©ëäÚ ÈÞ=å9çÍx¢ÔÜ'¨rpiÌÇ€
êJVØ M”:Çds—Ø)FTÒÈÚ¦±j¾“Ú`öÌ{¤ÜæRÛ ÒkßûÌjÛŽäA~ãå 0%È —~L€ÒÌtá× rÛ5ݱ4Ä`y"òa+\ÞÜPÊ0)Ú%U1°q™‘5²o5¯¡ˆãªKxz/&«IIÆ öDà9S,!ZwHjYþ -£Ž “8bòUÐùêd ÿ±{|ç°0vŽ‹éLtO½ØÍõ€¸º™Ð€:„ -ök}$†´„a†æÇï;`CŒƒùóƒšqº7S€×1M£Â:ùÉÀŽƒþ’)¬øð—4(|"½¸œÓêÚŠÁ\‘@!½@ Šp£Ÿsªöíg›+k?Í}ì·ô;"CÛd«o/ý²dPP~Hû [,†~Fó!%!H£–á•«ª#O&«—/6“` 3±[• YNYRŒÕ £Ró(þƵ.¾3Õãòƒzл—#Òù&hå\Êlêá©{f} ¨SÿþømE@ƒo‘4êàZ‹³:çËF¡Á²µ‘RzRß=†cÛ òÕ9H°2§®Rœa)ømó[-ùSŠK냧ö>ß^¢Ô¥AâëOõ¼$»_-§`¢´èÁ}Ž+Wß䢒þ*"ß·¹wÛw§+ãX!º¦3.¬¿MäuIÎ»Þ µ u²ÇµaÐÆšBÕ¢_Š´1בê} Ç¿)N'nR÷È5w²æR€ Ú$ƒÀ¹LfYrÝSJ´?‡×FA1…ÏaÊRX{« -ÔxB¡ÝÛÎ^( +KÑï® 4‚©VÆX²Â¦X¼&]_‹÷ÃEú”ÜÕÞw|(ˆ,úAÊU É„÷0[Û-É ^†œ -±">£tÆKÉ¢ ·Þ+ÿ¥ØËZ2 ósÝ,R2,y1™úK]Æäñæ ×4þ«(ák†ÉÉ
É^¬M²áFÌÔ[Xåt9‚…ƒ\[$«… -Æñݧ‚}~¾+Kv&)çuXFû\éO¿æ€âý¦ TÔW›EêÃùl -5öØÊcnðç3©J6æËÇøÁÖ–o§– |lsº§0®¡k ³.¤ÒéëÍ”°Ý¼/ë¶h›†þ!° =ð {0õn[iZ! ‘·,ïÃôË0`_ÖÍÆÚhøŠÛYp" §®Ä†2ä³R¼±sŸÍkÛ›âê£XüQIXv¯Œùi™ò‰¾Í©ÿî–r>YÞVd |û;Îb ‰+ …ôs™\ Â{ÒþoÒ\ñEŽ6Á±‚¼YÊï##AoöZ{ó/¦mh4@y‰®²{›hMÏö •³™ðƒùHµy´T^Pí)o·lº7]»Är¹]˜Fc þ³½e§– -(¯\xÕ®U'/ævHñn?PÚïK¾cƒê=åÍWWå}=õö{I‡´HCvÞ¢ŸqÌŸŽÞ¥L—‚u;òi²aë2®zú!±BÙ£àæÅÂjùvwVêãVMæÎüÅ·±C1ßFª7¼½ yÌ·iˆ¡¤ñ‚nŽJ`±—æÉÓFEÏ“Hú_FܬWÒŽDyÎ|=çtà¾U×ÅhG³úŠ~+‡ã4p¼ÍH]ªÃ¯ùÁ”jâñ)åÍ‚ÄbÅ7…!„²‘˜‹OõBÍJµ6wÂ3¥·'Í{YVOÂþ Dh‡¦£ï¶8Ët¿’XÅ/D*±îÜd -½~Oµ—EŸóè.¶ÅÀ[›ÿl8¨¬–‚JEj`³í#'= Ù|LeÏ/}' ôäÇ.“XÖÅÛðþgäK"Ò•¢šØ,Sâô“C?L#/m‚3Ú6î7c2ZÌ–÷¬ÜŠ³y0&*65I›Éè$ œ:mŠ?,6kÚ˜i!©žr¶_îÖìê cÒ=ø;•[ VÄC°Uææ׊(<tš0=£ñ —q.æÄëP[«†-«ÎVwùrßh€Ê°&êÏ“všº4]?ï¼ì7êq - -AÎÔõ{ë»›*Áqzí6ä”Y
¥«pÆ'¼#xjª~„Ä'X# 5V¤PD5Ã.[xÎÍÐ â&fs <‰=Ÿ˜ŒôcuÅt¥Úö ‘GE–¨{Q·”Y@e•ÛÃpñÕB‰ÞöÓ7ò‹ -=”äÄT&LC!<*Z äøkÚû#J 7›•‹ÒŸº«áÍc”wšò¦[bb+Äú -[Ñ=wy2WR‘úž v -¢³‰¶•Åó¨Ù0R"úkVÙ÷¤ y[#×¹UE8‰ìõÑ{<ô%4eWáÛÇ '¾.ÝOUc~QaFÜ<M#œNäZHœýjœ—Øn”\ëЇ”é¾tþN ŽI¡ßË/„b ֑×òͼ`ÛØP9 £ ¶HB{úö~H‘lÿxÛmõ#Wæ¬k_Þý Ÿ§Çºô¼…vû7zÄ‚‘ѵè•ÈùÝêD]ûVkæ>µ*ac¨¨ÒUGyuY5ßX1Yè^òË‚LŸ UéP?óÓaµ_ %&˜C‰.LgË’@/Ù·¼ Sç¶){'m]îA ØTß-ª
wåEz²WbŨWÎ:â,q²€>&§!»¹Ç†Òpíøü_šu‹êuÏ’hž>·Å|’©ok‹7’9´X£¥Ë‡»BñV§a„Ë û*F¬- žŒ½°L×?É2òç{Lvá¬5»¢'Søoj™°Òq)âàÒ:S§ñòT†œuÝcz_ÕE’Ðœ°ŒcDúwÅáa:·FwÆÒdE™üWû‚šæ±f3ë#` ?Øó;Äÿg„&!ì'Rz&x¯ EW’"o±f }ß®â(Š9šèÍôc&}ò’¾ð0.1¡MT›XŽ "q"®·€Ïµü0_1Ïé9~jå@›™³WNò×í¢Ãêþ40ê ŠÚ:ucI¦†
6««TÛ†ÙÅà£C>ZÑçÒÁ¶€ÎŸ¦2 Œ:Ô -àÿ//äÿ/ðÿ„€©
ÈØ bokìdìår†Ø;ýñg&äÿ0µøeendstream +/Length 9079 +/Filter /FlateDecode +>> +stream +xÚízUX\[Ö- 4Á½p'hpw×*(¤€*Ü!‚»înÁ]ƒ»kÜÝ/çôºoŸîûtßîw« öZcÌ=æœcÍýíz(*r%U&3[ÐG[¨+3 +në3Áù +|ØGè´£ÇÀNâ¨Ð× éÛb®=R‡äEÚTBbCøª¶DÞ¤W:›[öŠ¨$dEY%Š[Ót¼/oü¥¬½”ùP'û[Ä–~ X2µc×42:Xµ{—%ÍøFSÓ]¢8œÞ“’˜•G&$ÚÜ|-Cl7…à›ò~»,Nv}»Æî,@HíŒÅfMè\ƒ• jLw~˜,rÿMüF]_© +ýÍ8¶öOáÏoëÓ‚úïLîÓ¼¿œ+è¶kÎ6ÙAÝ$=43Žºoô°Jü¨rOwVsr ¶Ê¬ðšz¾Ž~ÿ²ºþëÁ‹êËõ-!蔄Wd=R9‹ò”l:VŽhÔïÀ³¼LôÃaìtþ8QIVæyU&Á¡û «ü\ žj_E‘{<óéYàôDËæúlø a½ê£D–Îîç„xô?¹é$Ì|’"Xûü"rø—Xu[ÊÚ6·èNâ÷AŒ»®qmƒ½Éý¢¹Hx7žMxÃ_Õ[±½z + ¼*K«™Zú¹úÕ°×Wý¢Øø¹.ÔR¯æES úLkéDÐ?«áäv%. +šI-b´zŸŒU íÑ—þDÅyMß\…‹ÙCó«ïÓÖSätR R˜…$ ùÛˆFy/Á ê}äYeOÈZñ¸ÕÏ«¥¬øïc}͹ü< ÂåŠ^úRX¿T[ÅgÝñF/yo\ky“Wb“Ë·Ú{že”Ã_¥b1‰¯ç(17•®LsT/“ks¸àýÄR–Ê8à׆h0ƒÄcsâð]€¡í"Z°p¬Ì¥`ÓTÚÕ¼V£ˆ™×Þš¥ ”¾Îé;»WžÄi%(¶ØÄ5œ™,—»ì>N*Yƒ?åïyÚóíʈfüλ» ² ɽø7ãáFWqÊ ZS>M…ùdT„ Ǫ;£Qס3˱_‹§ÙL_¥Ÿ€(U}Üh- ²Cö F;5 œ} ó.T²¶/0žyÖ]±!3f\CÕ1WR|#¯ o‚Ǧ?}Fq?¯ÓfÏ ‰²¾RŒ2Á œðäÞ"# +hŠÚ?åðP‘||èuæsSQ2¨•PbHRóŠêÐ8ꎜ¹MS^MýÜÝ´ Ó›û¶ÈnØU´]IÜl(óš–ªÉô˜ÔpXò,Î%0Œ1µky„Òæ®qú§°Ä ßÉ`hˆ Y›½ goû[rð`jϾªN¸t Ç\®»–ü»bIBj¬÷¯Âµ^‘•HÝ{”é·ÄÞê +Ô
+¸'º]÷ñ@f̼ÀÜGgìdô—éËùêÛðFÔ!k£«Ã*.$|™ /mßFàŽùyAO&—2Ö…Õ ªõ¾1Ù «<Žø+v ˆý–Dce”µEx`Iµ5úÐçK:™¢¦ïÝOÜtó‡ž.erƧbÛ,H/«äíuåí™RrŠò–WW“OF3³gÃ)‡¬Då"\ßžâjèßÓ”võVسïuÔt2C
«Æh]W*é„g̯%ä"‡È@Šr¤Bqf„•4†Fóó<ÐP+]°¹Ng…8à„q/•ãȼ¹b–Òdù&Ê´ºdVN šùÞÕç6bÎNé?ï…çPÒZWïn›vÊ +bší‘v\aۺΤ:×}¸½øÚ"¤#" tl~–ŠÂó5‚ws¬@ö|KéêyÏ’4%Óù|ô}É=ƒ-RK¨Ö{Öˆ“¤‹xwwa@â©Ûæí‰ûÂŽKˆ0oýwËŠµºÕ6©M8³q¡ºïˆoâ³·àßYF¤i{#ØHj î˜/„†HP,9;]D»¢ôc¢bÓ* ÃzøüÆísüe¹ÔÊâ°?»ÔÎTùw}ãΗÊâÜšTÆýjy¡<w¹ï…ʼO Ž âé MÉwï¿ÆUQ8øx¬È¬¿àñÆ3…}ð^ëaÑÄà|Ý’¯¼~¢Zw(í +kA,Èž¼ÃR*(^?X5ðÙä,|í0&æ)q¡35QýQ”>1(`ãóŸ©3;çó~•…jffl¯©È{>ë²SÕ†¬[ZÆ€ñí^m5 +îlúôü4
} +¸iÛ¬[ +AEÂiæ·Ü¾^Ápš¡¶²S‹q”)ä—®}ÀÈ™’X¦‘Ñê ½ž¹I|&åYöd§œçI»Á~hÜ%i}ºZùñfǤXÂx,¯ðçÝÀŠÆTÀ;=ÝJi×î^‡É¦Ö èz,€h?R9Ìó; @Öÿj—þY) Ƀp9:•I߸ùG« +gwoÔЇ¼V}ŽCs g@ˆÑÕ†šÒm
^©‰iÙ;4 +ú‹®fºÐ61^Ô˜±õƒøåiBž•1•ƒ—ÛÉŽ¸ïõ+üèªicöe 3+ âòÖÛ'˜–ÍN¥ê“7ðÉi˜ì§ ï´½~2¤bêó²ãò½õþ•`×Êê¯áÞØC ?¹ÕÔÌ=u¤ÛˆU¸…Í"â#øŽ\f£N2ú +wŸè’¡ µ¸§¶”¬Õ¾Ï®HÁ=ˆÒT“³šÌ6X’> 3¡6º1 •üVŽ mjƒ3/7¯=Íôþ
&!nIy<<QDð"'É[nt”;D[sZæZÿÄŽ ¥¾v™•8`±ÝÆfF—ÚsÔ|¯ï7G 9Î+
?Iæ†]Kk Ûdì Ó½çÓô+(–¶ÿ5ß(ä þCT°‚\ÚŸ§l±npOhÃíÜ@tþ¹3´6PäUi·QñGŸð*íwõÌx¿© 1)mvj"§f6¦F0±ÎýèªêµÌY™i õÞK÷òUQNÉg_;;C4‹± o%bT èŠÍ†d^âF G
ÐÛk—W·>` e%aŠ{ƒ#0SÌ=²\:×Ñòz¤ØGàU%˜YMçËá.žÜÃ_bÔõ~¬›ÖwŸXöçÏ×{7¨‡¬MÅ6ê£BÊæz‘×´‡ïÝpä÷¹QØì‡G2n2ªDö.×hE#£“ Z½¼Y‘ñ&ÐëE\(ÃES¥cùlgK„ŽT@â9 1D±èc™×Àj …¤ÐiÞÚDÅëÁ»ÂЯ0Tµµ£bÅ$㪌íéyÑdö¸Ì„ýn&¢›\ ‹Hè^¶ÙôX\JÆÇH?!Ê +F‘PÖçhé!ÍFµù„è¤ ‡ì‚4ãE¢Q¢ªÈŒ êË¿$Æ£}IÅD0I>àÅlPól&ÕFXÞáÅâ‹×Ž^ì÷êÑ!W‹ é·qV`ç¥Óz"!׌_j¯Ñò«E’µeä —QúŸŠGÌå«P•['ïkÈôZðÛ5%K…š†Â¸ª ¾àÛ㼿°è/©äG ZÖ¸µ²¤Ë›w f§þĺ#7^•Ÿ?<Žàa¶Úñ9" ç*‹æz]à•Öˆ·Ñôv–ý £-ÉTqÿ.åó%‚ 8Þkeÿ3¿[M£6 ò¢@Gò‰ƒXúÞ¥çˆS&2ØŸjF[fzØ.½„ø'eCL`KI +g.£ Êù5õ\Ïc¯ªO]ffå,§m¾¼@+¬—q[¹ ,<¸¡ÎIPŸ©if8§”MI e({—Jœ~À$:`š‘ -éé;±‘¬y~`²ŸâÑjr+Ö-±˜…>IEƒfçl±¢ZV®ô
ÛûU M½5
ßOÇRòˆœN@Èd£èF_ó³òÌu³Gö–l0êYiQ¶ˆrœÔÑeY$î9Ùq+SÊbÁ9+²ÀYƒŒá— )mdA( Å”µˆm;ÞUÓ
ŠÊˆm-Œ/=ŠÉ?ˆ )CH ÙrS¶Ô-“×ìª0Kƒk}öWjõ‰9‡ý@F#iÍKû½D;¦$*µ±¯ˆ:vÍuš + ¢6G4Ú Wó÷mq£Mo’¾íü0zt™ žà[ΛÙóïÄ3ÕÝZsÆÈP:dVÔ/fyŨV³Œ§²· ÞŽ%Ÿ ð G5¤ÆA«ÀÞ«§hÏ}Kœ¤=ª4¢a3¨˜– x MPn”ªÇ#qp´ų́çxk lƒ<¶ä¥ùÁãÊ¿aLÆòË+&ç0qwl$^dnÜðy(ÙBÓ¶ûo‘#@¹×M±®@S#8±CjQðç} ékŠ»*lí ,¡µ =êïΘexí¬„¢h‹®•ëö¥°gЇ™N¬/U
tùM-w*Û¼¿<ý\ɽ~,($ۥDzÁÏ5dèrÐ ®Ê º=¸’+•"‹~tó%Ê"â…,iãä, +û +àÑè.šoÏxg6åëÚ†ÇËVDU±N …;ZÆÒ5oùOhú—Ð>IîÌ:h^$¼Ôlz×ÚÁÓT @ÿ}&YƒHõEŒ (=‹qåö6õÙ¨ôW=wš’xsDs‰¼:ŒëöÊ-¶¿{´1öFi”"}±FêÃLf_ÜÅÅ;FO5æøþ|y~U¦Î ‡ëÄCš¢Õ „’+ê´Èø–u{Ó&d¹¿*¯’E牊ô‡Mâ‰t/&%Ï©H6ÛÒ¥Š‡¬GJ×:Ìøö•¿ÒÒ•ß:–”eˆº —ýq«É(LdOÅ"^$·u1§&j¶À Z¬ +Ú=;ˆðá:ØÓÏäÁÏ/én¼¡,*¢`\ÜäK}["ÊH TÆÞˆo`ÝÙýz„N¢ &j¸'µ2ó‹|K×c6Qén)' üÖœëv?.ßüê´–®PÌ£§åZ]GOŸIªvIbŒµ³ ÉЄH\Ô‡óÉ}vÆé¾°å1ù{'¾ógâ݇ûmœ‡½*œ‰VákÑJÃÙ9ÿ¾<§µÈi¥ßgCL‚¶áX±rX¯=Gó‹Ûìö.BÒÓ oû~o‡´~8:_ª˜WzåHTº{‚, ×d?u-ôR,ýá²ÍþcQk®‰î•üâŒ'ÄݹQ쪡³¾§Æç‰g\&ÚQ„#J©Yð#Õ²á[ƒËEßE(@˵¸x†üœ³/ ö®:g]!$…US ](%v¨ åÑÜ팼`‰jî&^ Ûœ?-ó@öùàjÙ÷<³ïlY?XRr$Š™£-ÑTù†~ŠÇ/0‰ÌB¯7Ù×ìYSB{@&A^UE s $DH@ +Ù¦ÏÓ%"Òð9Ó +-ý¸Bçhµ0ÊnnL¿ñE~„éMÇv¡“LYd< gñÕ¾ìQ±íÅ EþoÉ|Ľ„\cvê´ +Y
É4j"¼ÒÜçÞ»6ð¯ø»(~7qBËb“½ L*&=¤ö4P'©ð·@Xáѧ†÷§€R§ ÙiîÌ#k]3§&M<~èêÆŽ¬y×–=¶÷.Ö}ìh"rr²Ë«À±æ <³$wt•°CnEÕ@¸*ùw N.߆Z r™LŽ:øõŒªOâTãPêŽ ".!ÉMù?dð<Ÿ½h·Õð¯=B›B] oº×dûJèoÛ°Æ°TFØQêP¢úC@qSÁÅùÖ÷¥ 7_±¸Ôˆ ²»ÞÌ3å³_Ž¾«š’ñ #¼Ì‚
¸~sOsÔ |ùƱ-J?§>8_@1.æX Ig5ßRic¹Rc endobj -990 0 obj << +995 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1915 0 R +/Encoding 1921 0 R /FirstChar 2 -/LastChar 148 -/Widths 1920 0 R -/BaseFont /VUOWRJ+NimbusSanL-Regu -/FontDescriptor 988 0 R +/LastChar 151 +/Widths 1926 0 R +/BaseFont /DHCAHC+NimbusSanL-Regu +/FontDescriptor 993 0 R >> endobj -988 0 obj << +993 0 obj << /Ascent 712 /CapHeight 712 /Descent -213 -/FontName /VUOWRJ+NimbusSanL-Regu +/FontName /DHCAHC+NimbusSanL-Regu /ItalicAngle 0 /StemV 85 /XHeight 523 /FontBBox [-174 -285 1001 953] /Flags 4 -/CharSet (/fi/quoteright/parenleft/parenright/comma/hyphen/period/zero/one/two/three/five/eight/nine/semicolon/A/B/C/D/F/I/L/N/O/P/R/S/T/U/Y/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/quotedblright) -/FontFile 989 0 R +/CharSet (/fi/quoteright/parenleft/parenright/comma/hyphen/period/zero/one/two/three/five/eight/nine/semicolon/A/B/C/D/F/I/L/N/O/P/R/S/T/U/Y/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/quotedblright/emdash) +/FontFile 994 0 R >> endobj -1920 0 obj -[500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 222 333 333 0 0 278 333 278 0 556 556 556 556 0 556 0 0 556 556 0 278 0 0 0 0 0 667 667 722 722 0 611 0 0 278 0 0 556 0 722 778 667 0 722 667 611 722 0 0 0 667 0 0 0 0 0 0 222 556 556 500 556 556 278 556 556 222 222 500 222 833 556 556 556 556 333 500 278 556 500 722 500 500 500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 333 ] +1926 0 obj +[500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 222 333 333 0 0 278 333 278 0 556 556 556 556 0 556 0 0 556 556 0 278 0 0 0 0 0 667 667 722 722 0 611 0 0 278 0 0 556 0 722 778 667 0 722 667 611 722 0 0 0 667 0 0 0 0 0 0 222 556 556 500 556 556 278 556 556 222 222 500 222 833 556 556 556 556 333 500 278 556 500 722 500 500 500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 333 0 0 1000 ] endobj -964 0 obj << +969 0 obj << /Length1 1624 /Length2 8351 /Length3 532 -/Length 9215 -/Filter /FlateDecode ->> -stream -xÚíwePœk¶.4¸;w‡àÜ]h ‘n¤!xð à ÜÝ!$,¸»»kìì;3§ö_ç̯[·«ºë{׳ֳô]õ5†6»”5Ô$…Àع9¸D -v†ž¼jÈÊÿ'ÌûíÛ
ü 6OšÖP+÷ß)ýÁžhžP qÀ@ž°ß¾,A -h
…8z¬A6èœjPØ“K -—ZÜU†rÔ
‹<4{Mí;ßo¾bÙêë"r|Ñ™ :Î¥ð£cþœ‡»ÄØ*ȺÄiVˆ™v ÿÎçdRe噑 -%ÚL E÷ÛL©Øž÷úå8C‘eP¡1rŠQÏG€¿{…=òu€[׎A]z1Å’1Oõ¢™/ÇXá‘;8zQÆ@g$[7©Þ>Vƒ' F=ú&¸ÝÓ¯f¹Ú:Ѓ¨Å‡4Ŷì]ŒFŒ"âÕØ §WÜÍCý6B›ËH3•úbŽ³9Wgœ‘ÅM׋ÏÚpX)fîø£„ÒáUÆzäÇû_v[“Ú)@Émf=rXvK=$WËýÉ/Cáõg) ¦zÆBç#t%8SR£•_ - €f(ïüëZ%›ý#ñ;…Ôuu¥c…pMö¶©¹™„ ëá„òç …]/q -õµà‘vÁwø&ôvjç ¬hÛa5=qIIR±ºò\¤éVúµr >gvÊv•QZPÓ
§Æ JŸ1ºrh_—B«©(Gˆ¯ú*ÊùnI®]áqdw7È äõ}`mÚ— uçêÓ;ÿïvþæ|-N£Fbg Š´µÆ :ªßXºœZé'˜æ 4qu“GΆÀØç.8j|ÉÙ¯ÔH?BÉ|(™+w[~ʘµìp
·þJŸ:Ì 0^ -¬Q\TCBi[1à ˆ†6$‰X ¤FÌÿÈ?-•wË´3/o¨µ¯È
ÞÉmrè¹JØn-%^³«§ø=EÎïæº8 á!§MiF¼‚ -DûÈŠ$™“Ï?*ê©Ú|Ts8ó™V¦¼öÀ;d¯0{í‹| >¶¢1µi¹<ƒ_•l¤Ø<ôž( B¼Âž vvŠÇî$2-q³T/ÇÛi/±ûAé}F9«ÏMF,{Àœ…‡Iw¶H ׫ø”ðÞª^UÓ‹±·LN -à "û…/@u•à$Ò|‰E$ylV\Auw:Ù%=Õošì¼Êlãwñ¤ÉÀÂY딃&:Û„£¬ –j,e¨q}!±ÄÛ;>¯°ª¶Càz˜WnÒ’ôŸÅeÖíZ ÔRW'– -Iv’L¢ –ÿŠ*ßõ€iŸ: \¶§ÌVЇ5CÏâ9_¿÷’&ÒôÊóšèm+pTÓòÕÏ”ã <ùÔŸ–ΨCý’ëC¯ÆC¥èÒ'[0A6 ù»œ¾¼õÉ -F!£NÇ>ø³}gþG¾”ÓN‹¯£ÎŠmŠ^
Á5!¤L¾ý=½ CægÏÑ#œ_î
¤œÎC÷Hv0Ü #kеæ[nMBS¶>LÀ7‹[#¤ê-.oŸÊ÷3HˆÊŠ›[Vƶ&߶ðÔ8¹·£iD<.—»-_é±&+úH®M2ûÓÆš¡9*äAU¯R4Ò÷öN‹¼t2 -2/‘JXÌQLõg‘Q Y-÷3`Xð +tÍÁµ^_sÎ_Œíø¡œAâtfE‰_ÚŸ0ÀŠ¼2ª9œ±s -i`1o¬WVóÜT |Xßuà©ÂÕU=÷ÂI•)þ™3ÎÃ%&Òµ}é;ý)è×—2ð][nîK Ô -ûÈ ºÏâN$nÂ>3'ÕÔ†UÒ…˜ Ï3ô|·´€úѽð'=´±dyKJñÈW&óïÛÞú,Ûî6¬ÊÚ+öæ(æ]çúÊTÓå|JxGð]ûÛHc¬eKx¿®óë[¹t¨äµÆU²9Ù•Zowq°ã•Ë5³KéœÕ\ÁÃþwvVàvñ¶Vh¼Q/ü84§ÅŽÔt÷y>Ò )çÜç*²«ïÚá9ìA&™]sî# ¶ƒñ'¸¥7“ l¾qËF¹®Ùߺ5bi¨€i‡dì3FiLŸ+ù˜§±Ký¬—¬ëxV$¥¿û¶A{4[êLÛR;ÐhEâp—ÐÌMÜMÓ—°¡ &ÃÝurÂGçhê|yéñL¦ñÉ‘~‹'s½·^©}’Öò~Š<¿¢×sŽõø_ªª²JËî®/' ²Ü®± É úZ¦óΆ¨¤Zˆ¥ y»öÂóL«5ÖËH¬¡%ªF×?¢ òË!ÈÛ´Ò›èä¿&©þ˜¢ùc¬hÆ•\‚˜ ºõìX¢Uoÿ9ñ‹küRÕÞdƒ ñû"”œ -l{ïòuñèb¤7\3{*G,†“ËóÇÒ÷Ç5³µìêçºñòÑÊ…òÑCN±M×xßï J¯•Q86'BlE‚èŠÓ-kÙ¹š6·ª¿ÁÆ´Q ÎÒ>Æ÷df||=]óÁ£PQCÈr‚OYÕ ]Ò²DFºU1þúîííÎ5ó¦ Wл€ï8ñuBuI\ù†]Ç-虨û3$zî’fÅVbÚY©Ä¥Wµ[1K”•‘Õ~cÏEJb²®§ªHí„x± -•ñ~NÛBße=wmŠÐ:ö÷œL"tÒ;4ÍGH=:³STS¼AæÑm_OŽ’¤ÑD…Qf›ªë![?yEkoaõb¤c/±ì~
,q†nAÊž!äÌoƆ
Ì75¨üzÉøcžÙÎàx´Òð©>º<ÏäËèJ:™†Âcæ·t'¿ñÊn6¸ÈI -„–«,7n”(B¡ú‰¨ó¹¶:]Á¸k€3’¤Ò—×–3ե̓¥`}~?*òôwjt+ ý:•&hÏT[ \Š×|Pº5—R&ßÿtߎÝh¢Ç˜ƒº–A ¾ õ£RŸjch¹Õ€)ÙB+~0/Å)!'AU:øšf‰•ÇÐâÑWzª}‚ª¦wÌ+©±èYei³?1¡à9¾1ªá›NSÛßçÇ÷ag5À -¬Õm›
ƒ‰n]3Ñ’” ßrDí¹Ë*¦®jW‰h´¾É!§—3ÍŒ"ïEùF©6Ö ŸZ×¢`'ršóv|×óð âFÁø}õþqN¶
T]–ÜWQH}C´Èb mÚX}¼E -†ÎeÔ-2~§Ð•0ÝBˆÇôÜñ ×Fþ>÷Î+ÓÒc8eméáÇ£ã {¢›”Övû -‡)ŸÌü¤o|Ä?S+4“cò©wÌT
ÉtÈõô.³óHØÔ‹ºüãj´ îóUê -·½w‡I ¯YqÙ rœ9œ;[‹z}f¯0~DØIfrÊÈÈ*à§Ë™fÒ“¯¬³j<ÊŸë—µ×ri5/FTJ³zºd
Úè}º†Ý‹Í£9Ï·èå-ÞÔh^Ä“ÔL3킃¼ô¤ë µÜË4 ú¾µõš$wõ\ô¢‡}¬†œ"ÞˆÔßå´rñêåxübøÕɤõÊIþoQ¹I—AgOIî1«!˜äÚ󶡅û3ïaþŽÈ¥sIÆ#Jäàì’ ŒÆ$Ë]&«ë.xVe–9²æW—ؼ=6Æ,…W1dó .äÎôÛÞ‰@¶XEÞ’}W‹É , ];‚ÕÜ„, Ç5ªšì1eLûˆ¡ø‹Ï`e¼RÑ8.Äa \·¹ÓÓcãó '! -äbEq–kÂ\ÇMA|¥Ä_«ÆdˆvÝ÷Gã;Œ 2¦±"í‘ T=£ëÓ9”BªÆÅ`¸ ßÍ>SqãßY·PQoFpÞ9Ä<‚$s£ûÝç Ù9Àw´Iöp‹Ñ>¿ŸÉÇÌlâ•0åÂÚ÷ý‡!É0ïÒYzô]q\Y§_ácéÅO¡Ïa°á7o‰é ¿Œª{Xê!=Rú0Z8=Óø*£ þé’¨\@!Ìv¦ò³wd©üV_ ªMíDÕÓ?³íÙÑÎ*¦ ï{ìO φv¨ÁnϸŸ½ {‹µû ç¬æz–󃂹žGŒ9-CTl-²| n¼|‹U±éSuž÷ù}R~QÑ<¬ÒâîÈŒqì…Z¢µs÷P¥™e}‹@çõ¶OŽ«ª'^S[Ä£ 'ÆûÆ y<\Çsâe!þ «†¹Ùòç•#šxVµ…©ôùn± Ù KºSÓŒCØ›S2œ‘ ¢²o‚ÜÑç“êÙdaòËUŠ²l:¤YÉs'ȇmæ8|è"6ž\Ç!’µjg‚E ™D„½ÞŠ!È¢+¤C-ˆƒ´d_«žG͸T†¤ÈžÆqÑÒÀŒÑ6iáVÐÂ¥‹Øк
ñyg;1Áð:3³Ôb"‚xÕEË‘d›i¯qNsˆî‘v1»rgé -K¸AAr\VÁQNyKã34¬ ;$°©Ó!Co+‹3û°]¼»$ƒoQQã†y°Ow«‘Km3ÝŒœƒƒnùÒ/œ2Òn1ò’ -ös¤ÇdÐq(S•¢‹Øì:™Cxßpã¾Æq“ fš× â5pß‹"´ŠK% Uø#|‰De™uHSò’ïóìcô…œ—2b4\½È²Áªü*¢£Ät4]
˜ÁóÃvñWMQRp î §åæù´¼ á™=rVogž¬Ê7Qµ£²Yš¹»—±ŠœžB. ÒEÓL|¦9¨¤bÌ&Uê&ÖJ0úlóÕÄ=q^ï’H0sii·«èzÛè’®ƒJ4ƒøÂbó(ã`¼m439âtã”°·¤†{ùøӥ벾#ù‡ ->iæ§2¢½ ±ŸuNºˆ[ƒRÙ:’Ø%³7ƒ¢ýÑë´Ó5.MyH6[ŸÑÁÛŒkJV2SRˆsÊWo”(•/& Äbø4hësYÆý}NP ;àÅ@'šÐø4×üÒî”ßrBãï_˜“ -†“5äëbVÒ8ÜpÚ51¨£9 ŸÉT¿ˆzunêm€€¸ ðòµŠ%ü"‡dBiE½ÎûqfZì(¥¡€Cl˜>µ(7½^ ´7íDÕ TÞ7L¤ !:¾ŽeÜ Žs)šj“Ú識 Ñ/Á›XìõU‚è0âk"®÷bœºµdô# -B©aeE?ax -›V$ÍE ®Ã!Vj(ÍCXn×ü~ב¤ˆc€¯Q=¾«+GÝ9v·O „Ãõãæ"#»ôŒ"]ÝŽãʹ\šëBûb!®òܲfmMÿ.4¥¾yš £€óòظå]¥ýAªNÅ*2…™kÕB.æd+ñ0avmž ÇÑ8ŠDïXOŠ$uëÍk‘. üxoFgß<› iÝ$ƒ4ëíÞÉâÍÈÙö)ä¤D°W«ˆQÈS!šöŒFq<`峂~§‘ƒ`†‰Z_¾kl
¢½Ý‡ÈŽ_/C;}œÈU…#ÄËž¹j`¹îeOf>¿ ->æSbª‰\N@€BÇ£ e9ˆ§Q|@‡éu ï·BhþN»³Ñ[¯ØU¥!j3c€÷Y„i,súcRgi ®Ù+ÐŒ×*^ét5éÙ¤ÍÏÞ²ì#ë«®›_׮㗠0è©7›Ôá|Þqk ;Eèà)¡Ab -ŠhQü˜TyegF(f«Åõì³>œV$>¢#ôÏ, Ë ¾&µRÙÐ)MV©ôy<ê'w"%0-<Å‘Ö¹‹ÍjÇè‘Ì8,”3³ñÏÛ sïQvïÂ:Ú|“L8)µ[P7·ë±‰ ù#ž}†5÷=¥žÀ³8Ö¨(I†Î»IWá±ÓÒˆ,4,æ5óÚØ -Ñ4H™ÿÈ ¥ë§o†ìrG¼¹)&mŸøá ìRe~‹Gã’ºÔCì!Ñn+æ'|lj²æ—ƒm#<Ã{¿O[Ñâv õÛb6=9¥uP‹Ñ½p°¯j²ÝÔ¶T%sç|Žãļl½ˆuåÂ:"Z<=Ãö³ñ ÍpµWÌ& V³íªZñÍ¡Û0;aâ“Ó&éÍö1öž¤+àfk.»lÈ©üêÑ8iÜÞÅ1ŠDFãÛ÷£2 Sm¨mʼnv‹zù -…|¹ - ß-¿ÐZ|Ïâ–oÃ$ô=Y[Ò ?6ùJ‹-^æì‹ÖR Úþó1&*1^dTÏh‹h×ö³'2³" ýëêµ#z–é¸NEXeM¡ õ ¿™/®]Ñêr>Õ¢èÃl¿à‰UuͶ±9*÷p0 vÚ”Ó+•©`¯|,ŸÏê TLSwD"®R„àK¸ûÜíÚóÜC;EðgdkŽ íË ¨Ï´Iç5¬¦D5É¥žÝ\6ˆ²Ð#åVãMT}=Ü,YÕ’®3åÜ×ÑCi637“ùI%¢Ïj— H¯xà“¾‘ ²O¶’¡W§Ïzhaß -ú.·:È{k
KÃhµkú¤}9ÜŸ}ÃÚMÃÝ"öåŠ{ëƒKÇýW~†Pno1²ÆÏý°›ŽÓìG=oÑp½Ù›LR„)xYø®o -ÛÆ÷¿^§Pc$eX»fé*dõ oUX32âšH6w'BÞAᨨÂâ—,¥>E5Ï…Žé4' ª›° <ž/†Üÿ{Š™½aŽt jôJ¤t„ã”uN4§˜· :r¥Íé±QÀ»ƒ×}<„¼Ž1»¶_fö ¥—»Ìvn¼Ý¤XVÑG}7œl£¡OƒX\w.û¹íÆEÆÝ7x¡7ÛácEA~$]æ¶#âì°oÏ9¹×²Â˜Ï£•Qˆ Ýø&±»Èf}y‘¶à -¹ ÝxEʤÜ
;ÌiˆØ’˜=¶Ú½«‚ž$<o -'W«zn!̦œ§ ŒGU±•÷Íxß8¨\…$ÙúX¢wÎŒ0©8Vpª¾á?OǺóI`ß_CÜÀ.îíÇ3‘†€»(iÌ8Ó‡Žæyà‰]j™rìûãíRì~ÑÓ5í«r«SÌî@UOjx¿O¤öᜬÒcü63ªAï´ç=8¸ê<Q‡E†] [£…=ªá[ŒD{¶*êàEéØê1ìqaº„Œ9Å›8ð¹¶ýTÉ¥Œµ] ’Ð/T…]O˜µª´H a«dcZJ*gy¾Ýr¾¦w°ÈÄþ¸â ŒÑº<æÌkì×[î¾'ÒÿTÊ|dò˜í‚ègªáxÈÆññ¿Æ„Ψ½5Íf!?Fib b}´ËϧnFÜaè™ò^öÃÄ7.:Õ¥BÛ}FðÓ_b`aµÿ«t…ogî…_eS¡ÌÐM NÎÑ…Fö´U=iFWO2šË; -1Öp‡ãª!jNRE‚ --<ÿEåÁ6ZõøÞÆ[äά[SÆŽã˜\Z× ¦°ÃOíØ«¥ -ƒ:] Ðÿ ï4Ðcendstream +/Length 9216 +/Filter /FlateDecode +>> +stream +xÚíweT›ë¶.R´¸;A‹»Cq-î‡ H!P¼x‘Bq)-îîPZ(VÜÝݵ-íº{ï3ÖÝ¿ÎÙ¿î¸#ß;Ÿ9Ÿ©ï _˜è´t9el Ö E(ÎÉËÅ#Ð +‚l +°… +qòØ€l1¹5 ðG— +úhÄÃó7LÏ t„ü.¿à_bó÷Ø õ'rn
cE…*ìÿn·þÑÔzœ¸ž— ðܪCmþyøÍ#+ õøp +ñ8ù„E +â6/ÄN;0|ës2©¶òÄXˆÇ`kmH[Ǽà*õp+? ýä†5€Á#/€ˆñÚÇ ˜RóŽ¸
¯ *ÿ€9a÷æúÙ—þ¯½=g(Ÿ6)Ù³Þa0‰{<ÁfŽ +pÍ¢”2Ö/õ‰`”Tè Äjš 3L¿àƒí á!ŠH» s…?VLãT‘ ¹Jˆ&‰g: ÉÒѧLy‰À¸Šge 0å+÷&|ÂýÀê~sóTšù‡²©ttÔRmñIëëd°9:6+¶@›ÿ䧗%«ŠA~ªÎA ý¨£±bíè0TóYòs¢ 1…Ðg{Ü™ü_8X—Áx!Öy4´Ê3æmü,qÕ¡Fôž¸Uœ1”=Ê™gÊ™gÆȲüwâEÉw#A¯ òøJàú•BþS›•¤ònë®”{w‘?ßW#·TæJZ…å˜>}‡Ñ•ÁJJù‹”ºŠÑäÊj¿¸°[f"u¬x^Ø( HHŠ }Q¡‚ßaŽRz8Œ¶¦µ“;jÇÐ:šÈƒÏó%^%QÓ±¬v˜iŒ¼Æ¤|hÉÊUq”J÷¹ù »Ìã:aẖ²Åà2]½Rô¶°÷\xT;
µ7L4T3FÁ°.ÌkÛ4ä»Ïuä‰qÑÅÓÅŠ ›c´ã¨ˆ“Ÿ¾Ú:‰Á˃NG!òç»EŽfµ4ƒvZi•M –Þc’þÆXÓ"Ã-íêÆáP‡³ÕÌ$’_?Nˆyéå…ÓÕ½mÞ+à„_½‘sãÙ ’I%pazÏl›€ÿ¶uçU«
·\Û×Ðbjêìb>U¸)}{ QŸNßà—¨ªw%=Ák±äfZ%Åêos[1øÉ]·êñZ¬w¹fsƒ\û¾c x‰¾¾‰ŽµMÌ(}–"Ú\ñ|1wNkõTƒh,.Wèçh7)m|°Íü'gˆ5’S¯ŠJ2ÇM<'sÖ+ ±UÇR·¬§ëÁµ&I"AkËðÖíƒÜc»Êþª'ºø®¾bÒ^XÛÒV¶ãž‹c&jžü õ«{Aî.5ûÛd +Ž{âA‚ݧL3bü
J?ÙnÁ›C#ŒGÖ:ÂûSÅŸ†¸XJ½·5^9%4•Õó’‚Ò¨î_Zúäu¼AÁÜ݇€,23sËÛZÉzÎgIÞf35TìQ›Ã_
?Ôn¹ )-ödÙ¤!á-æÔ‡$J›½Àzö‚õ˜»‹Š)Nü‹:¸¶’{ý[}ð|ͯÍ*Úe™à€\‡v,: j±ªÖÙH’R<[ݧ¹}I¡ ÊíÐRò´hs t4ý¯3¥{Þë— à e¶A¥ÆÈ)f !ÁîÎÈWn];FuéÅTK&|Õ‹æ¾\c…GîàèE9#½‘lý¤z‡X,¾t8íèëàvO¿šåj›@’ ò»²·1Z1–ÈÈWc7Ü^q7÷õÛHm®#Í4š‹9.<qÆ–7]Ï>é"घ»Ž;ʆW=™PN ïÞmMj§%·™Gô(àØ/õ]-÷'?E4œ¥ºŸê ЗBáNIV}f…×–Ÿý•‰ÓBýó®aˈ +ÝìËI–Ø+¥®kª +…k{p¶MÍÍ$]Lj&”?M(ìzŽh¾ÏöÄÝá6è g*⪈}Æôš.lÄÕÉ^wïkæXÏ7eKxvù»‡ù5QÁ°Ç•Ê.ܥ˯ŒZKòQóÂs Åhã˜\«l >[êß Ý“ Ñ"bÇ +idguÊ ÛáÜ‚Ñ 9¤ëË‘'jM.~×ÿfêKÃÔ Ÿ’ SêkÉ'ë,Fèø.JìíÜÎ XѶ%Ænvâš’¤ ¼ò\¤ëVù¹r >guΆɩ,hè‡ÓbѤÏ_9¶¯Ë`ÔT •#ÅW}gƒ|³f<×ð8²ÿ5È âõm`cÚ—}çêã[ÿoöþ-ΣÆgLÊôµF& Žzê_Ùºœ['Xæ tqu“G.¢/bŸºâi$g¿Ð ÿ +#ÄÎÝSDº“l
¹ügTù®„B'æ|pÙž2SXÁÖ =‹ç~õÎK–DÛ+Ïk¢·ÀICÇCÜ0SApðäcZ:³ ísž÷½Z÷•âK íÀDÙl”osúòÖ'+˜EŒ;úØÏb ] RN;-¿Œº(·]({5ׄX’³øö÷ô~™Ÿ=ÇŒpy¾7rB>Ý#ÛÁr{Yƒ©3ßrƒlšê¼õ~±Y¬Ø)Õ`qyûT±ŸIJ\^Òº2¶5ù¶…ŒÂ¨ÆÙ½ C+âa¹ÜmyüÊ€=YÙGzm’ÕŸ>Ö ÃI)ª~•¢•¾·wZ䥗QyyŒRÂfff8û“‚ +¸ÜÏ„e) ªÔ5‡Ðz}Í=1¶ à‡v‰ÓG <˜'}îpÂ/òʨ^ärÁÍ)¤ƒÇ¼V²YYÍsSsôaÛA ŽPWôÔ /U®øGÎ8 G”„X×ö¥ïôgd” ŸŸËÀ¿ÚrsŸc¡W8DN0|’t&sõ™9©~ }Y%ÛZˆÝñ4Ã@hÁwKÇÊ0º7ñ¤‡>–"OhIåà" 5àÊtþ]ÛŸe»ÝÁ†UyåÞ å¼ë\_¹j†œO" o‰¾é~ iŒµb âÔwyu«•¾Ö: + ÓEWº?Kûß“IœñáÕtÍ{Be-ë Uu£tië9ÙVåøë_onw®YH°íy‚Þ|˯©KâÉ'zÙuLÔ‚™I…¾?Cfà.mQn%¥Ÿ•I\zQ[°³D]Yí7öT¬$&+ázªŠÜ^„ §P•àÇ´ ômÖSXS„α¿çd±³Á¡Y>RêÑ™½²†ò… *Ÿ~ûzr”46:bŒ*Ç´H]ÅúÉ êXË—P/f Îëîw¸ÑV%.Ð-HÙ¤œùÍØÁ°ù¦µŸÏ™¿Ï³Ú /€V>ÖG—ç™~ ]I§ÐRúå”ù5ÝÙo<…zÅ•—Ã!rÀÜC)4ÜKÿªdÞÌ 5YG¨Ò!ŠUa dV¦Ä`ȆՃ¶å|þFĹšÆ#\XZ•c…–exÍØ⻫‹ +ðŠâÅI´ÁAM8îe¹åÌ 4+Ÿ`,NÍ| +‘† “u +jTC©i–Tu # s¥§Ú'¨jzÇ¢’‡‘]ž>û Ó›ãé4ý}AB1ö‰pvs!œÀZý¶Ù0¸øÖ5 =YÙ‘Õ®¨=×`«²Š©«åU:¯ +$¨éå,3£¨{Q¾Qê5¨§6µh¸‰Üü ß <ü‡ŸP1[½;džFoU—%÷UÒÞ,²Éš5V o1 +=JƒË¬À<2Í¢îÿ¸ £»|µºÂmïÝa²‡kv¼@ˆw÷ÎÖý¢AŸyÆ«ïÌ vÒDYœ32² +©òc¦Y +«Æ€§Qùsýò:ŽrM£ÅÈ*iÀ· Kö î0ÐÇkøÄ<æçó|;€^QÞâÝ@öE<YÍ4Ë.8XÉË@¶ÞIǽL» ïk[¯irWÏE/f؇jÈ)RàXý¯œvb ~ƒ ŸCL?;Yt^8+¾ç/*7í2êì)É=fIï#!½öôžcháîÌÃ{ØV°#ré\šùˆ58»ƒ¬«1Éz—xÝ…È®ÊÖ¡@Ñüâ—¿GÈvÄð*†b> +ăڙ~»À?(Ç«Ì_aè3µœÌÀq•Ò·'ZÍMÈòqZ£¹§Ë SÅv8à‚¼Ô[=Ä2MV*ÇE¸ì¬Ömpx†“‘ò°Œ¢Ç¸
+4a¯ã§À!¾Â2J ’¯Ôc2Ä»îú£ GЙÓØQö(„ªž0ôé Ê ÕZÅÅ`¹‰ÞÍ>QqÜY·TÓlFrÙ9Ä>‚$s™| +cúÝå 99¯ vµI÷ðJÐ?½›ÉÇÎlâ—2ãÁ¯Ú÷ýŒ€%Í4ïÚ]zôMy\U¯_éCùÅ‘Oaðáׯ™I m>jzX <Pû0[:?Ñú"§¤ùñ’¤\H)Ìn®ö£ d©üN_ ºmíDÕã?³íÙÑÎ*–=ï;ÜR O†vhÁnOxŸŒ={ƒ³{oà¢;ËùNÅZϧ&ˆœ–#)¶[>P’·ž¿Á©Øô©:Ïûô.)¿¨h ^iyˆpdÎ<öL#ÑÆ¥{¨Òܺ¾E¨ózÛ'¦îIÐÔñ`Ïõ®±G‘ +F¸lqF÷wã!ïlgVc8Agbf–FLD¿¦x9Š|s ý5þi.ñ½5ò.–so–¾¨ìû4§e5<eÑ”7t>CÚ±CŠH›z rŒøòx³÷ÛÅ»+Vˆ-j¼pÎén
J™m–›Ñs°pÐ@úEƒsFÚ-V^@6êI]§gIëEJ‚J[eƒÏ%K\ñ¸\%kÕבÊ}½Ï±ª·—´Æs‡2ßwýÕk“Òhý€×U%'ˆW(“ûh?œGØâˆÏlíä7+#ÐÖO'›Þÿ²ºéúÅç78' K*ûTâàÃF\Úÿq$qƒqê¦tMŠ+éM4Îâ§7·!…
û9B²cr˜xÔ©*ÑE ö¬!ü¯¹Š G_á¹É³Ìkñ¹ïEãA GþHŸ#ÑÙf ÓT¼äû<û˜}!gÆÁ¥¬…X
Wϲlq*¿ˆé©° MWfüp]ýÕST” i;Çéyù>.¯GxfœÕÛ[$« LTmç¨m–fîîe¬¢¦§P*†tÑ5[=Ñ TQ3<“)u k¥ }²ùbâŽ4¯w +E,˜µ´´&¾Þ6º„¢ï¨Í$¹°ÁÜ<ÊÅ|˜oÏLŽ8ßx'%ì-ià_~±úáÚuY߉•ü]<ócÉÞ„Ä:g}äA™l=iÜ’Ù›Añþèuúéצ<ÛO˜àmæ5 ÜT… ò ‘êÕkjÕ‹IG ¦X%-úú\¶qŸt§D Љ64>–_ÚÒâ[Nlòí3«KRÁp²–Âb]ÌJ—^»6m4×Ë'rÕÏ"d^D›y!!o<¥fN¸È%PZQ¯÷nœ• 7Je( æ%.ÜÆÐFœ—Q Ú›v¢î*ï&Q _Ç1éÇ»OµMí÷S]Ðê—âO +,öŠú"Erq‰3×{1NÛZ2ú
©ôeeE?qx +‡N$ÝE ¾ã!Nz(Ý}Xn×ü½aב´˜S€¯q=! ÆUwŽÛ-ÁWá‚}Ø\dæ”Qf¨ÛÁsZY THƒ-´/â«Î-k×ÖôïÒÉRZ¤™2ûx°.[ÿªt8HÕ«XE¥2‡U-äbO¶’g×Vs £I5üŒõ¤JÒ´Ù¼ëâ#LAôfvñͳýn™ÖM6H·Þî,ÙŒšípŸBIN"±Š …:2 íÀl ÇV=+èw 9fš ÷˜±ÁÕ"ÙÛ½ìøù<´ÓÇ™R]Y4B²,LˆéIL ׶—=™ùôÜ3BÍ]²'ÿÔ¨ ’]döŽ +ÝݦDJ) ÙŒáÉ¡fl°«Sa¬c€²cý×Øh}ë
–7‘:©„ÑÅeƒ+"Ï ^Œæ?õl^}âï.<œEÖöþÒë’QzM‚iDÓÂÂLTª¬õºÒk=mùP©ú '·UŒ´/€›0òû +ä–“Tf0kˆ¯¨éÞ6¡"¸FÂéq$ îDY7Êôµíª‡ æ¢_Ä+ùXDLI¨#%ò8ß[”: ¨ËA|’z,¯ +ø¿BówÚ]ŒßxÅ®ª ÙÒš› +rÒÛdê9ñb÷Cæ½óG„á·| 9]°Q ˆí3ˆ¥8ö•'|2
jK¢´”6¾Y¦·ü–ū؆Mì{"¶¶¤~lú… W²ÌÅ£¥ZI¼ýÇCLTb¼Ø¨ñÉ®-üGOdfEæ—ôk'Ì,³q½Š°ÊšBa›=As_|û¢Õå|šEñ ¦Ù á`uͶ‰:ïp0nÚ”Û+•¥`¯|,_ +Q^ ±ëkB˶ÉÝÏW)´XI6°,}¥¬>Ñ +ff|óéæîDÈ[(-’°1MXü’µÌǨæ¹Ð1½æÄCÍ`SN¡‡ÒÅ»ïaÏB±³7,PÄ_ˆ•Žp²Ï‰çó×CG®t¹=6Jøwº‡P×±f×öËÌŸ õò–ÙÍ·¿)—UôÑþN¶Õ2¤C.®;—ÿÔvcƒ‹&çî¼Ð›íø¡¢ ?’!sÛ yvØ·ïœÒÎkYiÌçh bÏ0¾IDê.¶Y_^¤+<@<«Nk¿± eopô³…+¥º êhC‹0Hó³ cŒÆÜHf
Õ»uÎTÉ "[1ò™8ÍQ áMBšHi ô*ó]ƽ ¨Y©ipá8iÞñó°žÇª<FßèÍNa¼°ã¹Q[£ðbd
Yfwp“—µ©Â·{äBŽT.‡)çN¨5# Ü\8£
¦oåc—j9^ ÐbYHËoùIà3Ò"¾œ½OÒU›7œëí
Ú£xÖ°´ =|MÆË•’ëé÷\Êã®›½›ÊLs (iï*{–2w}À ‚Sq¤”œz¬4XBc°ˆ/ùšNߧ}‹ÆO"¼¸ò^µ¯Å•m¹•÷h„‰rd,ŒÛà½ûJtF ˆÛÑW¤\ʯ¡q—9-1;Š ’‡Vû·U¢“Äç
+ a¤)•Y°žeD ÿö‡Ú—«~‰ÕofØB8ûzIÅ‹‹—ç"ç6ZŠõæ ï?|ÙÊËûêÞVÓjˆóý ª¾$ù…è¾™A_%ãè +½=7c…ÙG¬èÎ35µmªâÊÉmqZ†\B‘[›¸46ÊÎõÉ é1‹äp#T‹ÀY̼†Ü¼²µ8c1@Ìõb$ýZÃ>ËA‡ýÿ Z*9/‹[ qM%ÛZîÔ3Ÿ"Å÷OÙýklT¢HFkmºYüéA3—¾OpkÄ·\;±©ô‰ã ìµêOX.š²ÃÙZ|©9K>ø +[L-‘×_ÎlrÉÁ~Õ?·åSç & ‰Å¬}+ž¾†¸WfÊ5na¸À®ª|êkS=öê[¢8ˆžºÐ(ú°Oæ*ÔØ…ª\LêÊ°_P Äê:‚܆Ÿ0 +o¶d© W<DÐ?§ |)"¶úšzœ8…û>r‘ÓÕ$EŠÚÜÍyÆokjÄÀ”*€Ò¤'ñË']Çåú®8šŸ ªBžß%[Ž1FôõU~zË7†Ÿ¿Ñ&¤”D·=.Eå°¹úiˆH×
|v`—þ /õ«”WÕw°õ‚I ¾ª@+a®ó(©±ãA5¡=y=£ñxç>USåD»<çÆÍMUÔ›€Ùl E— û†wRŽ{ÞÉíkGo-îçDq±¯R®¾ … ù ¤í€‹p¼ ìoB:04B»Ëß
*pº¤¯O*=¾oFäÉ°ïCÀIüŠkú$ÛÆò
wLv' +OêX¡gŠÛm9#Êó2Ôq +ÓRLvÏÍŒÆ/Ï7Xy!r8Ë!MÔ4ócK v&½›Ä4á”UO-EyÂTóTâÑÕì}3Þ5ªV¡H·>”œ³"M*œjnøÏ3°ï|Ú÷×’4²{óÝéL¬!àW”¬Pfœ«ÙýFGó¼Õ‰}j™j컓íRÜAñÓ5Ý«rà)vw º'-¢ßGrËpnvÙ1AÛõ ·ºó \<užèÃbð‡ÖhQjÄcñžŠ:DqŽz,|¸>1sNñ& b®]?Mr)smWÅ€ÑûäÌ uQØÉ +aàùÚîjäßÜš¨SÞ‚{ÈTvø…ùî)x“›”Vˆc†šçùÁüÿÿO +æˆù_Â:ÐEendstream endobj -965 0 obj << +970 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1915 0 R +/Encoding 1921 0 R /FirstChar 35 /LastChar 122 -/Widths 1921 0 R -/BaseFont /YXUFDT+NimbusMonL-BoldObli -/FontDescriptor 963 0 R +/Widths 1927 0 R +/BaseFont /NZFEJI+NimbusMonL-BoldObli +/FontDescriptor 968 0 R >> endobj -963 0 obj << +968 0 obj << /Ascent 624 /CapHeight 552 /Descent -126 -/FontName /YXUFDT+NimbusMonL-BoldObli +/FontName /NZFEJI+NimbusMonL-BoldObli /ItalicAngle -12 /StemV 103 /XHeight 439 /FontBBox [-61 -278 840 871] /Flags 4 /CharSet (/numbersign/hyphen/period/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/r/s/t/u/v/w/y/z) -/FontFile 964 0 R +/FontFile 969 0 R >> endobj -1921 0 obj +1927 0 obj [600 0 0 0 0 0 0 0 0 0 600 600 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 0 600 600 600 600 600 600 0 600 600 ] endobj -956 0 obj << +961 0 obj << /Length1 1630 /Length2 10420 /Length3 532 -/Length 11283 -/Filter /FlateDecode ->> -stream -xÚíteTœí’-îîNÜ%¸{pw·iÜÝÝÝ݃kp× -äh- -×u” ø¦ñWÉê!r6Y—fü…øÙGRŸ¾yKR‰vUå)0o+Xä - ø`8ï&-Ô§|_wñ˜7¦æ
奿i®™ÀÂÆC6K’kФZqÿ©Üõ-„8ª±Ïë½=Iæ¾xV@f³6Å-ýwËÄÎûñÌq#Eûu$u±ë5Äel&Qül‰x„ù»ƒ#MeȦ’9ázÚð¤Æ¯ ëÃÈ E¸½ëâíŸ+óˆ°×CˆØ³Üg¨´ä·[¾Ñ÷pÒ!ìSðŸò“Ø›9"ÐbòMÀ8Õëq]yZsY£4îV ¯—… d<¥siáøÞ ù% Þ«¯ÔˆÝ¤qg'ä·„ãKä´¾ÀGq!»:½mQ!!&ßa?F±1Ž»ÁÞ¥Y†eP.hNø1!/öã÷œ½ð&
‚¸a©7hèÛûŒýóÇÙ‡\š¯+D®ÉÑÐ Zƒœ0üÓvÄùØEýÉO¼ö~&ÙRm³ŽÊø=q¶qÊ¥¥»5ôÌ”ëb_
¸mÓa…©!RÇ<Ê)¯ $KåT¾C’"ú3Lº wìóÏ
#uCm…›®££¥b·B_iÊîð¼ ]7‰Œõ•
ðeQ ,®€”]®ì|va!Ø;ýF‰E=ÅÑ8³¬5)Å¢u,
ûÕðì^È ›Âê‡V+ƉC~~UY›¿> %<{ïè—ÒQs…ñpbÈNÖi¿ KÚëC/`_IL»/\x7´×´mÂdšØÒeÖίð¸‡^ìë!>ûÙ;æ ê¹MQU,¯ÕêÓÉKQBäg~—šö–S£,QØú¹¸_ìMjŽCçqTlÉJ6È£¾šø (Ü×}Yô*NY&X ìs'«Q·’R ïÍnƒa°1³'ù¶¢;\ ´ý6§eã3Qº7¢RÜ -ã>õû~ -[`Ï—Ì/ù®—o
MyYU‹â¢/ÿ¼Ý›Âœ¢ÝˆÓ[³¶ MlÆ -Ë šÕ˜ ±{[½¤-üyª!Ø¥ò6¯Ë,ÝÏ–r‡{ŠÒþŽ•ðRö¢i³ 4:»ŒNt8¬¼Gr Ø¿š&¦².ÌP˜ã®—ae‘©Ö’ГÖNTX/ïbmåV¡îé1âûœ9åì¾ú;‘ùÑ[BvÞÄÏdär{,‹&z¨½tEÒ2]A fS0ò}úö4kwçXN!ZÔ¿£I5·›_m—Ákˆìˆ±—|šÓC„8Ìx^]·=´–(LHž I3(ed7iwã—â ‹ª%ú£%wÚS?{drS[nA½G›;õ>Òi´ý'mLG:dŒhfL{¤ÞzÚGÛH,UAw™ Ö
PÖê=µàŒ dn¶h˜¥‚Jï
¡ßÜè{ruIîÏž çS?èôQÚØŒjT3§Ïñ¤ ŽYΡ¯jã"»t¡EM>í'ÎÄ—·pýèþÉR
?©0 o‹Oï|Ï‚ ®š!\Õsø” ¶ìOߨùu -/À/„¡œ‹œãWÃ5t/‡…û’ÀÈÍL´ÀhDÔËá磑À÷7 -Ö«LA‘G´D©(aÿ à;ÔAG´Õ JU;_^\‡uç.-©¤î,+»¼Z‘=•¿RæŸÐò…FIجóÔ~ÅÇ›º 1“|÷dÈ…¾^¢ § =Ô**sç «n-Ø[”Ú¶Q¶ñ¦D•œ1ÃØu® KÁ¦¿µÜ†y€´Pä†c(âÏnh0(iX²w¬N¸×õ¡ÍI˜û„ùÒ¥Èæbd¶ùq0« s°ö؆¿-ÆN™¦}ümšŒü‡+ÈŽšœ=zàë…qãWÈÅ+¯|jeÅ5ÎtÿwˆŠoµé¼’{„Ùdã
å”=\bHv8† Nt{„¿_å<˜m«3²”K,Í"ëT)(ãú`ÙP¸&«Âo˜«·õ£C·’=ø V–ŽŽ‚ä±à Ë1>F,.6¬z&·!^ ý‚÷ž·9š/–_ Ý‹ROnOs!ºð± -
ÍœçI ËýMãèY=±Dˆ* -Xÿ ÷Ô&?=b¬;”½î‚™ ¬«zGn£P6í±ÿû±Ù‘,œPýg µƒ6å Åù„
˜:vn‹ -®õg JŒGâÖÜ3ûRÄë,’ Órw¨¾}óã”sᓱx&á= ¥Ì \_ Îƈ߾lz'¦vC>_ €1Ä8ïÁ'nX«ÄÿÔ_>E듸è3cióú‚"“š¿X.,\Œ:ÚÎä½s¿
‹Šs©h‰74’ žÅïM$úÚ”t¹A¬Å‰V%è¼Úï¯à Fð¥ìÌšjIp0!{»¢”§îYý2™‡5¥C)›¬ÜgªïvPc,ØÖ1#H¼l€àT3%H°øófØúï{l;¸¼ûüÓ
¿@vt
MrO;¨| ¡–Ï즪ègY§Óùî îÆô[q£¿èÄ"
…W²Èj7 ð!¸ÇŸ nV ¼ð’"ꘕ¤i$| ðæjlF -ÃÚ¶lóE7÷³3™N/,*+¿PC.m.>ÊÖSyüŠô¥–ƒ®v«~@ P2ÝÒfNMTP-OÏ<a-€…>oIBeqì†bHpæÔt‡“ŽÄqj
µ ¥u!Œ»MB“†#z«Vk™…ó³;¨b„èC5ãAÆyÝYïØ ü£D@ìpøÃò¾×{àOÅvcwQŠrøŽ €e·52åeú/ ZLé¹ÉË` ~>\‚hX "'N¡Ã$wõ¶!•õ[5ièÑsh7â”›Ž›ã¥ä»l—Ý~ú,;>Â|¡bŒ»-挟 B—ík.D¿ÛµËïÅÓ€”ÖWQ”‘]H‰Õ÷gÆPіتïS+ØT
‹§ y3ÕúÑ›:u–ù§™Ã ×&_¡TT}4ÞÝÛ˜¤¢ÓM2²%Òì½#øE= -;½N -¸»v ½Ê…éÔÔqKoœ â\¶Ý€×Ÿ0 hïóÚR -¨T5=š€áÅ -•½*V^¾º1ê rðŒ* -®é/Š)T,¯}«2lÍ,ʽÆÎ[ ÙŸMÕ° Ú~(¤ÞQò«Žã¶ÚœuÁ3° QÑ •×46™›œö¬}Ù6tF-„zôôÏ -x0Æà K¾'¯g~y÷ ý|Ž°ž¡CCëLFRçÔûCx“U2x’ì¤Ú€òzô8i½‚“ÀÀºP &&åËk剺âi-`JÜ&â,¿Ý¦¯˜Á ¦¯z‚+Ý°G…˜Ö¬l†0ÏüÜÖ9oHƒT>vüŠ"nC1Ç=ˆ§XØ„?ýËzñŽ7 ½Ò!·51 ضMcÿekxn ºÒº1Èv&ÿ%V¯Œ Q¶Ù¾¡cÑ4~€Úgo¡ =;?§‹c6vÖÂ5NCÞ0è+wµ ý¶NùLCª•û‰r,Ïbj¿ÞÀ×Otm‹yã«÷Q±âm·/SVæK |“D|VïáEV<Q¡)…xú—7'Õ^'å´U6æAÂÉ¡ehSÃQúÙì6p5 =‚ÔKÅ´t,ý‰>
¯-¢A–×pE¸6¥]“ ¼á£Ê h3–©pD’&ä£ Ä
É
+k«ût‹2üWŽÜª|nÈ<~'> m8MUš™Ö²Z†>?nÆšfcBeµvG5?ÛbêÀ: ' ñ” "en<Ma f'2$ ûÌ]R_I¬‹ÃXż #—ˆd}lu>ërv×Mq(‘¦aíÅýv&…æä üá —<šµWˆ¼üe®vz{óü·ÄÜÓ òŽ¦G§IDÃ"b_Ö Í%ËŒ‚²¢êx‡Ê^‘$Û„ù…üÆy
uÁéQ_p $@ÖU/Èãˆ(w¡id-êl¡å¾kT -K§4xÈÔP¶—ÛÛ‰Õ[û‹ÕÇo›_¶¤uÃwü`@À r4ýÃ¥ Šùâu.Çc^ʈ~¢{ªŽËûb²OÁw}ñx×— `c™ãø?$?q;a—C¸G KÁCÐJ&Ÿò"t¸§'¥=€gh¥Þ¹ê ýs§H½Q”þ¯ÙN0ViT®I‚ÀRÜ#Š,šõ@¯»Ï„S; —nÑ´„(ÁPþ±Óí'ó±÷t—¢ç ©¤ç‹ûø?0õK* `ÁÎöÄË’&8¡ßçöìd„ÌV }¼ ·Õ0£¢²Ü}çŽ 3ѬÅ@‘Òµ13LëÃAÏNÓó.WN8™œ `c¥ý -üm££O<+„ºlMË´p ~Mý™[ñ©ø·hÊW·N–&9_ 9øÂåÖ ÒgÙ0ª¸Lt»Èé X+sÿõ„&ûI*ofÊ ¸èÊ
/ŒÀÐÀƒÔ[ü"¤}.¸ûæ¥c‘çäß>3D|åOVη}ðî -(ª4rQ¹!Yzˆ‘Yù_‡u¼‡Ó´Q½Þˆ®¸ËÛÌ« -|ø2C¸Yƒ~Y¤¬BþLŽË¬ðLÕûvè ÷Í ³˜U@âçÖ¾”5Ù¹~ÜCåýŽœ—® ‘ë†<…¡ÚÉ¡È„¿ ;÷Un¹ù¼‡ ã
à™9 ZTêS½D,f¥ ‘j@xqÒ–iEÐ+ž²J>`ýáìÃÕ´Eñϼœ#ÄñN%€õÐ7 -l^¹C8I‘èe«3ÅA¤Ã¯ðÿØòk¾ Z¬nk¢ªh±¡FÃ]ðÙ›·²îtxrJ¼‰Ù¿bo
-d©‘¯l};¥ZòM«yŽÏ‚ÐÛe ´Æ;Î÷kßíªêÂ×¢èCsú?êÂr؇VÚýV.K“.ÅÍ"ûUg§ ™áön~ vµ2Äv gè"àÃ\ôAm»)Zÿ h”RøÉR¼.|y÷¹'"ˆ*&–ç>™#xr§cm¦Æö0žœn³‘=ǤslF&~k2E«jlþ¬ Ƈf„ÃLbJ&ÆRXc6¦KnÄÎäÖ¹˜O"êûðΕ¦#{ä Ú ª|^3ŨÊ;è44Âr1f5)·g¼_
ì(1%Õ -rÒŽ½wÂø’>;Slêô‰‘5 s¼uÖ²Å#&ëA¬!ø5çÈÔúÉÂbªªF%.ïîÐ{ãRU©Éàë NyÐÒ6½/ÚÓNEg“É·Û¯êÏò¼hžNº–Ž¡]Șùj©<}crÑ¥d!]ìÜÎò>þ
ÞÄ ÷{€m6"ûªùø@P¡S†¸s}'V%ó.£zùˆí]¡I^(ÛùÌ6…–¯ƒÑ|4âsæþ>êYÈ-Ï:´¢Ù2åÁÅs(×±@¢
=}Åæ—U·n6 ÈBC¯>Ç!Âû@u=å<²—1i=íÉú=ƒ-¨òZ—ÅM Â4÷–@tõJæv‘q½ãû´yç¾vr«Ï„¾VnEø„}j*7Si‹{=‹Áï£!æXàý1±J ='»Ê`W¸îÌÒìì;ïD}Âv-wŒ$ØM0½(ðö¨ÍéM$ÀzCç§ 3ß3XôåB£ -°œâ‘1é#V~Ö¤›½hBñ
åùjtw“b sYŸ´5 ¬˜º ÿ“,W²ýÖ»X,+'z7ÂàOe~a.!dÊ«+¼˜å¡ñÊVóÎçõîú…*>3 þ»m'¯¼ŽpFTYDº9HÁ†“lPËÁsà–Žý„Ä&ä’ÍåìƒÔ„¶“MÊBW{a -œây[ƒËu¦YÚr!ƒô$l³Ø a£.†þÌGƒaW] èPj©"!w¦k?…Bm$¯œ:#ϯ˜R ¡~+Oø0¹`5ÌP (ÅÍé=vÛ
„ú"þÀ‘—Ñî1+…¸Ý¸&ߘ óÚ*-‰Š ”8ÕÐYNÒcŸ˜¾üJìsMQj[F¸‹kzéú¸ä(ŽÀK¹öëÎá½ gnä@@m35N-Í˨d²äí«hV]¨Áà^ƒì÷¾Þ uŸ÷ÚÖ¦k‰-¾·UÉ[~¡‰è%?Ôé·SrJvı}Ñ™¾Ä=3¯rêÅÀØ›uYoaQ•L}F¡©›§ü¡à:Ežir¢,sÊÜ[<z˜¦öÚwR–o'«èC=Rp3s* £_Ë•Fª!Ñ ŒLïЋ˜¦)§í>¸©¿ÄG€ÇàðÿÀï>Â6SGÄT¤®I;@|&ÞHJstÊk=Lig¤5è‰,þm!7ÿîág=ò"Œ -<uHîPe£C³PÍ2EíäÁ|ËM ó«QX³g9(bçŠvà‹÷µ/’TÂèó¹ÂûàEÔ’÷¼¡¿J£ºV]CG ;f¥/ÁàL÷ mˆª©’’ùê#°ð¯¸1¹C‚U=è3TnÌó´sS_vçahîÖ5ImŒ=_²ž‘•9–ãÆ›Öo!|>i÷.T+=a9?wô²ÅùÄ˺éN¡¼‡Q²¡\Ýq.¿³lߣ¯ÚÌMú‘á£óäPêç@lʼnT -¨JUŠÆ•ý¿Ñu3·àp G„‡ùbÃéÏÝDŒ%çwì´¯ïª9áÌ ó5SsÕþ†ˆKë †Üœ¼e}Vô™¡)‹$?·,V§ ¨$Uã½cNùÕTD ½³#éˆF»œ±´Å(EB‰w%È
{|(¬3-I™ ¢m8W‘r…XÍe«àÞVLL¥Q.*Gõt¹IÚ¯±™^_Ø “’ÚÖÈûR˜Sö «îÒžÿk./·9Ï•ÅyÊo •ÓwÉ×°ïJwYâ‘ϱî¸6eÉÑœEɈeósS}¯E±X8‚ÕË#¤y ã ¼ŸKuEüì£!o´öUöä”óÏéŽÃZX©¨,M|eÍóÉÝ)ƒ^»D¥?OÜ]De×a$p*£<Ôu¸-‡•²·HÈÁÉ'.
JØ QíH2³&šÞ–é{IênÊf›êòËŽêõ0]\³Ç¸,Y|egσÜÍ–Ø,’ä¥à¦¥\ÂO° ÌA %hP
ŽmÀÙ3Y'Ä]ÄhÌýð±ÕÞì²›ODPxþõnº”å“]ç7CåÎm gªô÷ËÜ Æu“ óm‚ 5 :ª4kíusDó°ˆ ªKÀs¢'·»^Rå”XÄ
) >M“£<Áp©E^ˆž+vxE$¶ÆöÕ¸œ eMÁ$ ÷Š¡|¨•ùìü–îøÈp¹[ä ¢§ªT«-ĺ ô{~Êfª~ý
WÑ8æôQT“yi¬W%>ùàw—3+¶ë‡IÕæŒ}'Î
'>š! ^ËÉ´¯ƒT%¼àn=0Z€ÞOi°nŠŒƒÔ'ó'~ -\´)(ä t‹hß÷ç uÌîÈ ÕyêáTÅD_.àÞM`¦_}\_i¥ê#k?×ziÓÍà‰Á¼zñ)90¥7€•ØIgx¶ }/b -(Ñ-ì@¹ÀËq²<Þl™xüú0·¨gOyP} Å¥\’`ÀxªÃÆ°6‹9)ü<»^íéîä>ƒ@1è¥ôk5 ê¥5a*ìH¹4}YÕ #|ÿ§¦}ý68w…Ëj*6Ã㸟QmŽECÁ¬œ“§Äƒ Ooül“³æoC’rR>s”Ù°ký“Xâ²Tþ--i»ê‘7`ù`/N…›'¶1 h <þS°=xÇ4î×ÚT¡ëÛÇÍs=@· 1~_¶ý)î;ÎnoŸ*CHÖÏÄÒú `^¨VY©êKŒ·€’ÃN±ÍÉÿ£†-$Û:5š›B§>™ÌwÍ? -qÒ¸#q¹àÞMn¢¾ƒÂ†ÇUÛòA ö5 îQ¤±£-•²x^€’ÙtÉ¥óçw¸_Ü ý‡ýZ;Ô4ò#qó)ùtƒ/UåÐnp©á„Ͷ5 ž‚B²W ÎQÝNk›‹v<§sïU'¦J*"Ñx«xóoŽú ¡…ÁÇ••×ÕqƧÇãç‘œ^¬³“Rö éEhæå)ôd6ºØ¦Nr ?â¿®¼Ä½`„ˆÇÐS#£‹c†MéáßÞÀ>RÝNf¹h}ù)æ_Èt€½ +/Length 11286 +/Filter /FlateDecode +>> +stream +xÚíteTœí’-î \›à.ÁÝÜ]h ‘Æww—à.!$@ð Á=¸[p· Á!—|ßœ9³Î_3ç×]·×z{½Oíª]UÏ®·è¨Õ4Ù$- ÍArŽ(;§@ì`îæªìQbÓ +rrq|ñpxÁ^ÈÔ ]¡®.`'(à%«šŒÜßuBm€Ð?¹]Á/0ÀÑêÅÓÒÑÂíOKa/4/(†¸ OèŸ\æ €%ØÕÉ èõ’û…ÌÉüWn®`ˆõ?+`¸€¬.–ö Wךî?·óÏ>ÿ¥{ ““½×_ÑŽyýg
`¨+ÈÞŠ ‹û%§ô%·5‚ÆñgXä!VŽ +:€í½þ›ÀuÔý]ìðý+,¾\Š$ÄúE6.nvοÍ`W9°'ÈR
µ°Xí_îì/»6Ääb†€^´ýëZ_‚89ÿÓ²[ØAþˆÀû7‚Xþkù/rýU<‡¦–š†”Ë·aÿòT{™¨–—ð it• -ÿóð‡GJÊÑàÃÆÇ`ã~Ãàççpqùý7ÿ¢áúçYu{ 9Ù99¹ +Ì;ƒ„ö é ÓBr?¦®"ÜUúV~–`“rÌÌ#ÝXŸ³¥5>Nïê&eHco\PÎn˜iÜ‹ñi¯°ü-Þ×&´áÔÃàÕ Ñ§ìß\3ô
ô÷uœ#vm“±ä% Ò »#`ÒÇ:瑉hWúD±lÁ}Ù¡ŠïJÎçâYÊÝ¥…ŽeÌ|,PwÐÖºàóoËóÍQä‡/Kk×ØC)3ù•kKКM,y]íÝ»IWàCn‹ÿ³ÑžŸEbg¬BY¶â EœÞïýoÕÍ%¢_¹
p¿ž²Ÿ¬?BûZ·bŒ“ˆ·d*R ˆÈÕÝÆø÷@÷¯¾òðgŸoÒÙÌ2ô!í¤ Øô‡~‰±ùÁpÕ}ØK³ ç¸ûC׫F%=ʾü+Þxè7§Á½€Ö +µå7„ùŸ{D/kÅ:NŠº3©1fæÁª®ÖÌ>›ˆ0œÊ-~ýdžR¨X<™6Ú4’ÑzVÆ„öO”ðµaÕ= åƒd!?Õ–¦.OB)»OÞ8:eõ4 ± ÎÌYÉzM—I[ Øù\ó‰i·Ó¯‡‚¶j×ÍX‰õæáBJ÷[ØE¾ RS×ß½c&È1Om +bi¬ NÈŸ +"¿ ¹V6Õ ›dJ VOÆýräªÕpê9£åLV± Bï÷Õ&JÀà»<ëÈdRs΄5Ãc6âš<ZˆÚ½–‘õxc~ Œð +7kXp-ºZc¤ë·8* ŸÑ¶•â–Ÿ÷µÓ÷“hØ4WžL^ñ¶AÞež
"<ÍyÅg WõxÅÇõo)l)ºÍ¨øß*—–£ÉÌ™ üÑõÊ”ÒtM +Y4<z€¶TÙ±šm·àÇ™y„>þ=ó×½Ó#|õ‰2Ì u÷Ñà 7$tD;³Ì/>ä…¦+²Ø˜±% œýD@X;…1OžK(„ØfAH̦Ê"m…
`²èF5óRX¯.èÝÀ1_|qãŸ2 +òâ¸ÚqÍ\ó°aTúËî3ì lŸBØ0UmËç:<¢Lµp. «ŒHa>7÷ ¡$é$aLŽW*æ—ôZÇÝඔ‚ªÖß.«UŸHeYê¦äñ 4’5¡ö|Ž¥ò ïm´ÑËçŠß“Trו?äÖÏä‹wJf–h÷3»7P¸bF»`œ/[ŸLÏ>¿¦td#ø5‡ÍPÝ®gÊ |Ô«ÕCY…#4WÚ*€¿0Z^oÖ,F±ãƒiôŽ¬ ÷“Ön4
‘EMI;h!ŸQ5r²©äÂÏ †uVrŒyq ò…f~IØA¼þ8«+ö}¤&ØõÃu"a žyº-¡ Íß* Ã
ɹü#Líj)¸|›t¿Wu‹ü4°s!MRmYŒ5 0ÉWýŽƒýÝG iÅGÝD¥å²VŽ>5ºöæw&‚ß3F\Ü~'²Ý»µIËO™ù™õ¯âÑG÷4•ÌËX¥+© ¬ŠD¾I_ åhkˆÀ/ÀŠr2ûHïíæ÷¹Õè9D¾ÏÔK1Íœõ.ÂÖf:¥©_ˆ ú™4LT™M 7(¥o3iså—ò»ºö½_ÚC'¿{drmcN~µG§;ÝÚq´ Ó CLs:l
‚DFLS¤ÁrÚ'»H<uw0¥ÞHÞúµÈ˜lN–D˜•’Æ·+¿Éþ7Tš2|ß=›OG~vu1b4ršTªgŒÌœÊ ²ŸŠÀ_|Ž‹lÕ‡—0ûº“8_VÏ»×ö“ý#ò°R—¢ “Ë-{z—ú{±Šöý‡9¦/Ú‹]¨mȨõÖ?2T8¯f
5°Ï9[X©Ûß>íÚGtH”ÁòaÀÉ©ZʼÎ÷h96åË—¤õÆ3ψ%6Ëpx¢OÚe.OSåÐœ©<³Œ)˾ F‹´®7}Ë”#)_Z¥¢Ê +7ÂÃD
R ‚¿è±¡~HYÑ+RÝ,=Ä-*Òÿ‚´-°?MVC˜$™œiĵ5˜Ãù–…Z¶a8W‘OYE«Pj5úï NhŸüˆ×KÈÜœƒ[—ÝËŒ ÇÓ]ûʲj +eÕÔ×Ì:8}L¸Õ÷aÈN˜üŠûÔªÌéjb¾ú©;¯ ·»ñÐA¨1ÆE“¦{øc”’³l +¶§£âŠîZ<3ýrãrö, ˜ú¡ü´sÛ£¦üÇçt™-’,ÊÁš2šv^I4{|ãfg£!Æ-’ßÏ + l ,v ßgª[™GV©SÓÄu rbðW„_±}\7Œ]Kö ÜÏŸŸ=8RÄC&)Ãù13S³à™ÜˆzÖó &Ü{ Òâ®;›{ºw/L=®¹>Îi%Â+06wIœ¢¸/óÆ1qx≓–^½Û ‚ŸVæø
aF©kH£ ¸p”6œB¨EAb¶¼4ƒ"Ògå#ß–ß]ßÙ¬’ÛžâÀÓÇQ´ÝKçãëA”œ˜jô¾ð‚p ?Ѓú'[yõ |#—Qb9rȾÃFNw®Å^™Ý~¹6”Ô ™ÓEŠïábä߬í#Áæ#ÚWŒ¯*È•:ëè$4×hÔË×öÂnD¹ïÜšÇS×¢FD¸}¸ÐXëÏI¢U1Øθ3o8ú8J)u£e<Ô…Þóh|¬"=–gfíÎ1 `[u˜ÅQAØÇyïóÎp%oZ’øqa’…aÜýËC5¿‘ˆó^ÐŒ +ûôÐÓ]2Žá×ðÂŽk•|½Ç7X>럾·Ù(´Í¾o÷ŸÔÌJmˆ•oXGUç²7w&¿# +)FkcøÖ¥Ó‰]Í¥D¢Ø MÐò÷*Óç”t…f¼™¡øÜÏÛÏFf ðz•¬ŒÊ2Î`®&qTYOý“ê9JÇÎNy…ï´Ûöpì¯lbúÐ8Á©æf*°©Ç 6Äê••í-Î
¡€Ñ„š_`-{F”šZ…ü‡
LAîP«Ç. :öIæñhž;³»)ÓZ\ÿ/FÉH£}QôùLÊÏ+w5]D0|ƒÆ&ÄW Ž^„IU5lª rôÒ>0„“•¶} +ê(O“ùRtS63ZÞ0CFv߲ͳZ +|C·r®ÿµ?Øô¼©F¨$ @¯ÍrjB/áH
$=@"¿ƒ£ +€ñLœ #Ž|DøÓú$LP÷f(.€ RC¿7é@ +ÿ³±Ž“ ˆ¸*„e³VtØø®Ï`Áz)£`j|S’»§²×¨?È4·¼-ó5W¾”8˜ ‰¨WÑ÷Òh òµÈ~à&JYÈ)0ê¶D©:Ç4Á¬Ãšž“<Á$ ŽFô!uæýÔK~Smò¡z2
;zëJŠfÕiu°„j–ó¼ÍÏ}ÃGL0tW’e³Þ‚å»0\èœCå™xà¶}½©âV<=Xeys¯”òLV²º3#†–¡ØNs‡Nɶ¢»H*åÀ›õ³?ò +/RBùðMÍÚËW?Fóm6¡Iyþ%ÓYµšÕ¥oÅ{;sË2¯Ó†{®G ‹ LãžRê
ú AƒíI+23—(-ãAqpå—Z âãö¥‰u#̸{OÿÌ€;S núäë)ªj¶§×o°O'Iª™›ßá蜼“Ñ;ö~Yå ¦<úhDsÙ˜´\ÎCldS \“2ñœIsd„|ü0"eq’×dÛÑ +ÉÈصM"-!J$Th ¸þ`1/ù†ñ\âîôÜTQ‡ÐŒÈ[ÖNåÝW…ˆãíñò Φ·9íïCÆ?öaô|ºé ´Ó2gz µÚ|펋0T§ÃLÒº2ÖËàÃÍÄEßþ:–@A,™Š`kû úm«§”G6Š+Š9gÃÀº‚r~I÷Oùè·DÊ¢[ {‚¯´rÁ\CPÉ#†|m\¶}äh;¢µ…ÿ´fBÃ0=7ÍRô‡/œÀÐÀÝÔk¢1fR´ ^¤ÛºÙCñ®Çäß>0c(¤‚e(Ö.× ÈîJêùô +Q9!™¨‘™y0‹½zÞ½iº˜^Ì /D—Ó|eæèù>JB»!| A¿,S`&ǽï.÷L5ü±ï÷÷ˆCX æçÞŽ¬
å©aÜó‡Û
/}WRèŠ"µ±gÚѾøÿ;.¾‹œ2Q‹)3–+À#'[¼„ì×jéXÜö¤êáEIkÀò YBUµ<ÀòÝÉÛ‹QË¢Ÿ¹Ù¨ƒ-* +HŠ‰³ÝÒ¶X´2l ‰ÀëRC/ýÕwÆY@}!ù~ƒvÖ³K®×YËE.®\ØÍ,Å»ÕBj>š…¢«îlô~â†õàØü-³er@ÜYŒÖäžîj«ýT"ŠÒãÛ¨×KÜð%ì_í[~«¶¬ƒxRå øž&'q.kýØ®ƒ”ÞÑ‘ccšÀs1\ÖEÔõŠbº<&zò¹d£}‘l—¾¢@ ¢¯uR$î-±ÌM +ñ,(ZÃ
…G!½½,‹8yKæ;~ã)_Çzá8´‹öÑÊXÐ/â&_5º(Ƀ|s5š)ˆÒá+>úÏ°c²±lj×ú²ˆ%¯ñQ
eÃü²†‚w¾ÙÁÜUú7|Þ–ýö‹ç4Ï‘³·¾hB²’Œh'à¨] NåD¡·T±TÎ$n ñõ½Cm¼:1
S’•ÄéEÔ¨“¯Q/nHbç A( ¯öÌ'rÀ/V±¼.p:F‹ Ö“»aûÏÕwïl0yß]Žˆ”.z2“ÖŸ~ÝÊü”— ³z^¢ä&Ÿ›ÚÕ_BXÌ].ùÞ,y4DñÓY=õN[“ou1~KM“ éýeülÝQЃ$¾®QJÖ\â3¢¼ÛÚ7²_ÞU2æ°(²89j¢è‘X(ÍàRêôâ +ïÝ åJÂYsD,~ ‹j %ûÏ.Ÿ(g ªbç7ú[([7™>"Ä«1íKIkJ°rÚ(t~¨,{|†xáïÒ…CWá
§›ƒpK¾}AµþÖoX4šÝØœÙ5)köa³ŠGöfeÌƦ¦»#%ÝÅM'zŠX³¸·®ËÂV‹ïÞ,]0.Ùìëî9¡ß‡'¼Ó+}ÅNw§s»çoXçð:¥r•Çu’Ÿ¨óUºÊ‡˜BsûîsŽ1ðô]¸ÑÊágE>èé6±: ËÖªbCÀÙ‘Pý\rËÿñfóªÙL[1Ë@í×õˆL +Æý¾> X¿ ãŒ0ÛÙêpµ~è~ñnrÆÀf·*zW–Wµ8ÁˆåX“7`i
vXìq|¹*ÚÓÝ;É} …ºÛKå×B@ÅSCÂHØjIúœº3NøÎOm‡êuHÎ&¯õHì{ÃNIv-%ó2 þb*BÁÁ ˆµ.Ú¿ÉË(-0ÆÃ.™
bÉJßÒú×קínjiF^Aƒ½x”® 8¤á- …Ž!
`ܯ¥ LÑËëû.íS@&Ÿ$ 1~G„¡é!nó[‡:sHæÏÄzŠê÷ ÜPÒõöoaÇ"Û£]¡{ ;XÎ Fb
úzÛçŽw¯ëö +v{ Â~[ Y퉷kë[ÊF.Ëë®R2:|µ&˶ ù&~t±³íšá–kAYÆ-Ò’Qíç^Ü—³AÆPR˜R†ŸAÅ %®’+Âã9ÔR´¹«{ Ó ’!ŒUW2i÷ø¹ó›
oO7BÁ. _«¬ëyŠ
D(aá]k ~®u– ®Ý‘»ÌF%ïýÐ×ÙÐdf»qÅ£ˆ =#ã j)Š¸)…ào}Ú|(¤ »ó$5÷)ê:×eÝ–\KÒ|ý`S';ZU©Ü +Ÿü._¯ 7#° ôcö›ÐB¥×¢ fÜÈ =°ŽÏÚÜÙê?½zêý0íCÊ‘!´æûtÍç«1žu?K+.®o–/þRi†-zSÇ6ÊüdrhŽtFš(eL³‚/umDðN”Vï}º3,RÖŽXí;m?´oZ92íã“Á‚?†}æ]*ý|ðÊI¡¯W•’Ké6¤,È5ßsx˜ ™ßV$$öøu"ÛºîŒw£¸Ô endobj -957 0 obj << +962 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1915 0 R +/Encoding 1921 0 R /FirstChar 34 /LastChar 122 -/Widths 1922 0 R -/BaseFont /HYQQKL+NimbusMonL-ReguObli -/FontDescriptor 955 0 R +/Widths 1928 0 R +/BaseFont /STPRBR+NimbusMonL-ReguObli +/FontDescriptor 960 0 R >> endobj -955 0 obj << +960 0 obj << /Ascent 625 /CapHeight 557 /Descent -147 -/FontName /HYQQKL+NimbusMonL-ReguObli +/FontName /STPRBR+NimbusMonL-ReguObli /ItalicAngle -12 /StemV 43 /XHeight 426 /FontBBox [-61 -237 774 811] /Flags 4 /CharSet (/quotedbl/numbersign/parenleft/parenright/plus/hyphen/period/colon/B/C/D/F/N/O/R/T/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z) -/FontFile 956 0 R +/FontFile 961 0 R >> endobj -1922 0 obj +1928 0 obj [600 600 0 0 0 0 600 600 0 600 0 600 600 0 0 0 0 0 0 0 0 0 0 0 600 0 0 0 0 0 0 0 600 600 600 0 600 0 0 0 0 0 0 0 600 600 0 0 600 0 600 0 0 0 0 0 0 600 0 600 0 0 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 ] endobj -879 0 obj << +884 0 obj << /Length1 1606 /Length2 16237 /Length3 532 @@ -8810,7 +8856,7 @@ endobj stream xÚ¬¶ct§_Ó%œ¤cÛøŶmÛ¶mÛ¶Ží¤£N:¶mÛvòöÿ¾gæ™u¿óiæùpuª:»vÕ®sÖ!%TP¦4±72³·s¡e¤càÈYÚ¹:ËÚÛÉÐ ÙÛ˜ -"bÿæébaèòOngË¿n€½ÙßH{c×Jú—ï/Ì_¯‹¡¥3ÀÅÔÃåŸ\F¦ +"bÿæébaèòOngË¿n€½ÙßH{c×Jú—ï/Ì_¯‹¡¥3ÀÅÔÃåŸ\F¦ IŒ‡1† í:Œ}V T§:jâV6ðë>z1ZVª=àšì™ÓvÓFÑÐ54½ú!§¶å9A6P0ð®+MG¼bê¢Y‘ßçGaƒæ¶Ë Vc3çY?â!_¸Ù
þZk @@ -8861,247 +8907,271 @@ Rs2$Ñ%º‹ë!nß%BÛ»C)uv÷'\ó&6Éu¨ë=Ôä:Æ k‡z½ÌèœýU9S/ƒœþÀϨŠïw1~µ0D6 Y+e»øݼF‚z— y#K×2ª®q1g¬›“‘-öæÙú݃ÓIÝFÍ×½Mx°<?ÑgýÆ kµB-ÝNlr¥A¤M/šÅƒ¾Iµä;5÷£,Ø¿W‰`ˆiÈäLJ©x’ ʪѾÓF/G c à"Ç»_¹,Ó ¯+¢¸&lwsä`“ïS&®ÖyGpˆ$9>O cׇK2ºëAÆö¹Ì,b
šO)Ù˜•äªŽÛ–Üå×ïLlˆ¨¯Ø: :^fËër¡ó5‘ª‹ê(foC;a'¥'Ô'pq84 «Åq†‚iµ‡„ ¤¬™·yæN¡ÒÍ=Ñxhwí‡Ð¦-LêÅoR„µ ”3'ÅžŽ7vF£¼êb•r 1uºÄ…›Ùaml³§W·áFIöõ»_ìß±#EÂp¯Î\R8úrî ,¸©n²o‰¨¡2V;ëÃrÁÿßþî [gƶé¾ï—OžBË&í)Ü\ù#ûÌÿ7õ|®æov·E|’ïÙ}…I%\ÜrŸø¥
7K¢ì´v,_Zµ¢e¥ÐŠÒyÛÕíŽ%_ÿœ÷ãyìÍ2#í O¯Ö8_^{ñšÃÿ9ÊçC'±2]ØÓÔyÕáùÍ)Ó ç©X÷\â~¡æô}Ù’—§Ëøby³Äó{K9ì™ül“íÙtß9³äí2Ë~ŸÏMÖYYzࢄ°TƒÎŸ8ë6‰B9ûdIF†Æ{úáª:OãÊ.,|©–u‰•Énãk“9u³3z X&jîû7WD‹ý î9“fGÝÏòTNo½ ª÷À’Ñž3(È'Pôè§b/©ˆóy§?nIËy¶ÚH©îš©ÖšÖæ-×¾$êMS|á*¹áö±k¬«¼+§Yå–óŸ}˜á·ÓÂ;œ¬ëö nüÍ¢°iòüêÕþ™6íŸLÂ6/èžµý±æc‰][K8–¾‰KQùiš¾ZnrKb]Ÿ:ß˃ü—ü¬²´o\glV“Üèãë]šwó¹KÿM“?
ÌÉ{EÝf3Ë…¼×Q©‘éÏÙ¼‚ýCÒR¥Èk_g-äM·´ÊQüµõöf -רÀäœÔÄ¢’üÜÄ¢l. +רÀäœÔÄ¢’üÜÄ¢l. endobj -880 0 obj << +885 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1915 0 R +/Encoding 1921 0 R /FirstChar 34 /LastChar 125 -/Widths 1923 0 R -/BaseFont /XRHXVB+NimbusMonL-Bold -/FontDescriptor 878 0 R +/Widths 1929 0 R +/BaseFont /NQLZDD+NimbusMonL-Bold +/FontDescriptor 883 0 R >> endobj -878 0 obj << +883 0 obj << /Ascent 624 /CapHeight 552 /Descent -126 -/FontName /XRHXVB+NimbusMonL-Bold +/FontName /NQLZDD+NimbusMonL-Bold /ItalicAngle 0 /StemV 101 /XHeight 439 /FontBBox [-43 -278 681 871] /Flags 4 /CharSet (/quotedbl/numbersign/plus/hyphen/period/slash/zero/one/two/three/five/six/seven/eight/semicolon/equal/A/B/D/E/F/G/H/K/M/N/O/R/S/T/W/Z/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright) -/FontFile 879 0 R +/FontFile 884 0 R >> endobj -1923 0 obj +1929 0 obj [600 600 0 0 0 0 0 0 0 600 0 600 600 600 600 600 600 600 0 600 600 600 600 0 0 600 0 600 0 0 0 600 600 0 600 600 600 600 600 0 0 600 0 600 600 600 0 0 600 600 600 0 0 600 0 0 600 600 0 600 0 0 0 600 600 600 600 600 600 600 600 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 ] endobj -873 0 obj << +878 0 obj << /Length1 1620 /Length2 20127 /Length3 532 -/Length 21035 -/Filter /FlateDecode ->> -stream -xÚ¬ºct¤]·. Ûv*I§cul' [ £b§bÛ¶mÛ¶Ží¤cwý¼ï·÷>cŸóëœý£jÜk^s^×Zë 5FQ’)ª0›Ø%ìlA ,ŒÌ< -šþô¯œtGLz¥ÈéQž7K²;P?8˜Õö¦””õJ>`ˆg:Y ánžiü(\ -ü°¾<Ù£ø§6Äbw¡5aÔž_|M<}~¢ î½…î?$¤Ë‰…§äuBþéçC(øCB¼ªùÕi{Ju ¡glŸÏÏìC(»ƒ¢ÈbÓËZÁçjð§fÌÁpC@¶ -¦éÂú”/é„ÐaF)¹ìÉT_Äü AÇDF@’_²–
z¿IÂ>^"ò “£œŸpÖ j×Ñm¡HNZ¬¹Šù—;Ão{ô«OŠ—© š }¾ŽÈïqM gÀÁõ@‰Î -vÌó_Ÿ äsýðKÞ`zŒ—6$Aïܪ“³ÖUª Ô¼qTÉŒ!ÝNë”›Å/˜4ú#pöpò>ÙMBˆÁrêM<õlb®‚‡é‹à\jÑhŽ!··qèš–í:—… u>5±“ª——‡³›G¿:×MÎ{òεÁéKœJC·Ò@µ¾/) qpgŸ”µí‚ ¨•Šgý´» Û]^ÕÞƒÛ1Ü ½û߬Dþµß™á…°ä]xŠ©9 -b¤H#øÕV h@û€€Æjý)ûƒe{’Ó -3 á"Å8a¶ÌýhC©Š‚¡|«ßÎ[ÖGÏ3“G DBI‘Z8«µ¯öºÛK -’wi¡ ´NºóoI^0Õ–ÎÈ!C 6פ AÅjc›a˜ LÁý äü>wiúÁЧ('Q_´d¶lAS¬Ôæ‡äaíøîyNM×iÙòD³."KÂ.38°n -ݱÍAïOÇ4å|cå žä½Ë™à˺ _…¤Bcbœp%ÉU™xíŒ`#Ë}Cºûð¥H" ¹ºå)çØÑYi#,ج¿ßÁ;QÝqç·Äjí(^& +
MÌøkRÐ,7÷u¾!+o¹-}iC¼ HBbÛ*1'O. Íþ~6'jïý˜ñ+gt5û¢PVÔÿ¤˜¿T?ÚãÔR¨s(S¡šq¹"yV‡ôî@v¨„3ëÔHG¹çòšu´ÉÅQ›8 Ô%âÛV†w>ðÛeã‘[‹}H}öA÷4OöÖgí -„7N•{œP¾©3¹¥Œ/Ä[Ö]ªpCƒ’½f±eB8|* ÿá´%Q0d’hyŽÏË9€œH7þ 5'i}=½ó{LXwÜëaä6Aº„ï5Ëo7F—Aµbñ#¹‰…O[?ˆny= ¯7…³¾ÏÆ_žMSÑÓ<Ÿj²¹O-ÄËOrlºÈ|! •¡ÀºüV„, y©+¥, ß ê¹2š_Sûà£#üåž ·${ qÛF2<üm=àmûS}ü{/°¥ÖÌ:i‚ƒ‹\’³¦ææŒ"×îS©ÄÙM>?gЀ ñ¤kMí!,£sê-Ð@‘œm -ï™°H¯Ñq<)XÍe.vU ÀŒ‹Ææ6¼j÷(OóÈŠ¨ð"AÏ@ ä_ÞžX$#–alxUeh[f dþ.Þ_lÔæ8-®(˜ÙÉë¾—©)Zó ÕŸ -Ôû´Þܼõz2‹÷¤#‚JÇ_N‚aºäYCÏ>\z…„–gĈÏs³Ìjd¨¦!X¸ˆÓ wÜ2mö8Ùp!os´C?yTÿ@[Qc×Üÿq…ÒŽ¥Á=5(æΡm³× ÔIìÑ/Ôa1VGKj]Ø w´Ú}oä¿8A#çÁ°\SêœM,ZkyÀºHí(¨ ·³ÔŠSñçöš]MC~ÌTŸÜ¤Pg}÷p€‡€
J¥'Þ fØ‘Vý"‡øíbÇd sªÝë~£vz -t±~ŸU²ôn5\±ìÕµIýS«Uÿ >¢KóHšÃmµ[»nKYݼ øËÈ|(ÚÍs@ w³™ >sϽ°V…–šü ®ÙÞÇ +×Xª‰‘†€9õUW«K8†?é
`(zšŒÜ›×Io_eîÁ‘Í>&p×$ÏoLòŠJß ´/õý…›R-“ÃOÃÄ,Á‰ þØFáÒÓýâùu.ÍŽ©X€²£ÝF:ûL@¥å߸‰+¸CVçD§›î$2ܘ± ¤‚Tô¦:‡4Oò ü?ŒÙì7ØC *™VBÆò6VjóšÛ¾§
÷fÝÆ1÷ídž
¿ô | ÒÞÞ@OBG À§˜«T ˜Ã1=Úuø1&\ÛTĉº(Ð64Ï›§¼ì¥—¿ž6ÇnÚ4~ÆcÅÛ[zFbÆ’RJ»žƒ.¶¡ÖkŽ ãÃÞDþÈÉ+GâzƒîÔ¹ m_C|øþ0/–Xµ³-`_1+Rå¬Ë¸ƒðžM*&`*ó|ÜTF-ò\<óãT¢ - - -à+N‰Ø5ÚNjÔÐY›€¨áàݵiï+Zf;ˆ?Çåe³ÙvWà·kŸÒÅüµ—¢I¹ë´“F4{½*-5 …)<m‰‘·iîúó…sA€fÌTljò‰¹^›]¿w› H.’îŠI†m¸_|óÚ»b \ÝÛè#Úžƒð ž1Êê
×åã–μmœh³fË]Ú¸¤„ž¯\ÇišÒ}EK¶
õ»›õx}3sŵÈûÔM¿=i‹ƒ)»o)=26¢QžÉªË C†;ß5T]hQ€Ð^šŸmúà|‰Z›!ç˜8ºs±S°È¾J¬ f?Ý ëÞìoåCˆ€ßlOŒ‰¯¸1 ]§Uxœ<Šzæ᥀•áç=ˆÎmò ò‰¿½PÓ1ú”¢>2x¤iÎ#§·5ž.‰©sV ñº^ñ¼ëÓýªÀ›`õVÙÅ¢UR¸¼ûpœ“åæ41$ûFÐ8ªŸ8 lV{v”ƒîÞw©³î~ ¯ìýý«&À꾃~èôÓEKå½ây
Dj”¹÷-vá'†H=~€Œøä“þܦð!UMÌÆ‚qzÝKs"œÏòçžNIZÇ&s™/í}‡•‚ðQE´¶åï¼1àE˜»×AÖö ¹›€Ú8!ZŒ%©u4¶7 ×)-¹¢þxÏ ÌŠi#Ò},V{ 3ê™Lk0Ûd±À1èÙýåÇN@ˆ<E¾=\Ðwö\#·Sä‡ó Ìµì¬ j‰um‚Þ>ñ€ÖXzdöi¢ð»†¢”YµÇÙ¹þÕ‚ÅmË.»ÎÅ)6>NSã"jú¦HËèË LnE™ƒ¦üÂKh°ï_ŽÆˆ\RÙßC* 5¦
T(´eLjÔ9úÞÓ…eñrWtA…¤ÙlõtŽcKª¿ÔL©ÓšïÃÍCm á‚cÆó7ªÓû:³HAÁÏÑ ×$k!å8Õ#[;mñW¨$¥„ÊQã]T”PpÎÊ©j0)¤p)8H‹Ûä—4ÞÌd9ãYVä]mze;ûµª.ò+ÜôÖƼ9+C…ŒµÍ7ÈÀaÀõñú%B{PçÑó²ŒG>¦ï\8ÞÓ>\ùë -¾07ÙtîRÝçP{myZí2÷<ijœçâzxÒô £'2ºñÉþD–£,9tÞ±¾vR§ðSp CŠ%è²³O»¢‘Ï ‡æhÇeUfL†öH)”éßѦ"¥2¦TVÞ¤Vx/ >’^Ž³Š$pEÚŸ ºþ<˜÷|š ‡+œüäî˜j -º.F5|EKÖ_kßU†Ä&“ó"÷•€äûdÎ…#æ›5åØK"20¬.Fí¢Jà(2\࢚z~"‚*X¸×”•›¹-=‰Œ!‹2 ZK
… ‹3 …~`ÊòJ&qðmvpˆ;¢¬¬Õ¼}ÜtЈD½N¸Q/pÏÐ@Øy)diDÿD¡ -ÛIX¨_QW:ÿµ
]úÐÀï9Lœ`]fd „ú1ØñœÖʨó™¢r -EþØÜlgøÕ_:jûìe ‚¡¡¬ -M
q‚8IoÜ•ªÅö›ÍL-Ô…`€ToÞ½*Pvz:N“x ›ÝžÜ™3*IŸeÀ4µô -;S9Á%]9Ao¢ÁN©‡’p6/€ôJš6:7õ"élÈ2îqœÞ܃A«ñ )Û«Â! F—?+ÍõÙV ³d$7ÁÌ&áýWW( Þg0 ÎÜ#Úž8¤;ßJì¯ý‰Ù¡L¹ŒÙOÝ5 oYÖᘠ-AÒà} …a™5‚>ÂÃNFØX4²–€žÞri¸™½ ‹…:'é‹NÎXªËQ±lC#Ë4’w‰ùŸÈ>ßOºÒLZx¯dTH‘™‡Ø*:ÑP=<Ylc<¢„%Vù3nË
½H¼!›Å.raìþ “¼ù÷Y:›Î xf‘…H^#ü¡ æh -ø> @[›CQƒi«m®þ²´! -ÚÕìΨWtŠã ?oAZdæ vò6I›¼)’þ‰èRUÛÌ(Á@Ú”µ²âa»¦Ð£ñ Ûå²ÛšÖ/ì¬ý&Å%é¾ACF ÷êÏa¶šƒ;öùZj ûâÛQBÙ„ãljÎYIN«ä…{Ïy|—hX®t²RML ‡WK&q¨aEPjÍ–_ê›Í2ÒÙmYL¡£Ý§ÎŒrêgsÓ¯NãÚ‹+A׃²„7g¨ëÞÊN óké…%¦~aÝ–o¥~F¼».û# 3{9D«Áä1;â´ æ ÍôQôÃZÏú8w&_a†¶j¡ã÷q ´r©>Ý}~9ÃQ‡“¹ýñQËöš‚¸¸ÅÒRß -nº_Ø;úáW„ZÏ(œd ÆÅÕ>¤õ„‹ÁêÍ¢*qöŒ‚#röwQ;£œjÚÆ^kNÿyŠÕzÁ<S€\ìæ¬# -) ¬¹YQkfb -<Æê> tjY×rCD[")Q’£#˜Øn]Ìcõ(ð(»CÈ=g}¶F`³k940 ŒÜ§k¤ÿe:ä#_tRáY L©£½N‡íAKZ' KLH§£tvH¶ÐSÑe6óSò<ø]©k>¿2 GÇNê#u0UóQŽÅÕò K»/ó<'\` ÛyæÒ5êLZ íèÄn™çš z‹ˆÆL²˜)ÏvŒX¡[M5þÉž„¤´‚o®HõÌLg‡œQ ä zä<¸±5î6Ýc²±ï.U¨vÉM{bUWåL¼Ù¾Î,mxÙ*û+‚ikX‚â{uõ<„NZ'8ƒ,T¥~ Xè%{2Ñ/f>[µª¦Dîïö|Ý ¡ ±šöœ©.q´Ÿ›l¢”„AMãSæKæí3r,ÁãZ<Ë›¬ïám)œ+h¯zìÏa~¥^Ø‹Yºxà½M67 -}¾Q@<gäÍd}ßÜ-âãf††Çª§è·à^.@uz¥@”M|Ý°Ìì4ÒÊ -à™<=²!>°ë_Â! ¡nÒ
q£^c7Nh?–Dbk]z‘Zøù·Íà[ÛX=mÅ›P
:žž‰ÍW½G°tC#<áß×V Â'¦ŠÒyÞÄ1ò\ðÎòˆ¿ƒˆ§9&åŒÂT«âÞ°;¯oQ -Äd²’Ø[EÜ°¿ÈÇ`n—ÅædþǦiBŠFtù£¿
mŽ<{ töJD|Ï;±Æ&G‚iþco§Àå² -çaA3©±W(æ‚2MYÕô(mò¤ œFã³{gþz&V__é a6ÎÇp›¯ØalĺÃuwðnæ c"8¡n‡:Ñ!1w‡Í‘˜Ý¿g•Ã
ˆ%ù[Ûà ÞI‘nÓåÙ–~ gdº/~û¬ugÉp¡`ÁPþôTiHŸì2\)ÜЙÍàÿ®ºþ0æ‡zx)œE½ Úéq;7,¦ýs¸ƒ,ª‡izÕéü*ið ¾\~]•mî§Æ Æ
K•!ì†ß !ou4›¿›û‹†«ðw<«^UG‰/)cy¯$Ë‹> täCÔž•6rеð‚jåº)×ä; æC'17'IÙŬõ1:Ï–¼pV%¤»Ã -2°ÅѦyWýö¾¥jÖÎŒUËü«üÂ@¹,íðÊ&©¾JèS"§oóZ²,¢t -’ú C¡ãa4Ÿ—7C‘ªÜ݃~Z¨‹ˆÃ©µ»*‡‚s· @ qp![~_£Œ¿:[8&‹”ŽËNp€0ËtÃ"¤ü4q%¬i¨•F³høð¡<uÖñ¾î7iÞßÐäS)–óã IÌ)¶ é¿Õ+[ò5L\Ö*ãÍZóÊgDسö@WÎìÖ1üÊ,o>HÁ81äј=Þü2¶ã³âL˜lƒK¯:ÏÂiåsB¢/]ûP6 -Q+ª''a¯¥¯óm@6úâçòg}»°4ï N–³š¬0ìHñëà´Po|®RÎhkÏ–T…£¿» ”àá€#V‰Y R³ŠÅ·Rßx°îV&£Ìy«úEê¥Äyêî‰;|0üŸ¸Opˆ`Ôæ:5 × -dž°Åû€{ò$#ïˆÚrþ÷øúø -Ažˆ+‰o徑ù ^ÄWòó -þ¤a;åR6¨¹;áD ] ëVsGm½˜¤îý‚(Œ3î}
ìfˆ¦»ÖÔÊËÅ!’ uÒPPÝö F5ñ;êO"•— ni2õˆbg+€ã–¦ÜÛ%çŸoÚˣǦÅ|É) –C¹,Å‹ñìSÑ.” Qƒ—#l )tæúnÙ‡')ó×LM šýLsi|¼n°Q!g ZŠ ƒp2Äòf;|d·sJ5[èOú»·r• -¹0>“Q8 0ƒÁ˜jU¥9Ãüró5½C£öñ²·Ëä—A<Õ¦¡1RÁgó[¼X- ?¼§µebÑ×k^6*Ù J ¬(І¦7Ü1)ºPïNଛ/r§t ªX¥õø&™ ¥ƒÆôÏážµÓfÇHöõŒ’°.ÛJó9øP>µe't§l†ƒì1M¾#,Çä1¾#ÜÕÄš#[ÀN).·E¶/°6 ~ª§ˆÄ•T1˜ôY¶#ß: a³áI]ï¡‘g=㟗ì26®HZÄ+ØÃîk -z|~ÝX!ö×½’F`à[m”Ý»”}«SqÁM÷]»&ÃÍÝùԛꚥ‘ ü…@ÏHÈúû Ónê -c—™XúAÒœü.;
®¯˜›'·Œ©½C›ˆ^zºnõâ塳ýæzI‡• -RÐ%åØWÔ糖Î;ÇOÏØŒI“ëöL %Ç’,úÛ¼F¬>žÜÁ|á™ôaײÍ4˜m?3’V=·_L=Rx;`‚i<’kav`Ä óè·¶²ú0 -pºs*Å"øVŸûå¦ä!¥`˜nƒ³ß+ó+ŽµÐ -çøx£ƒ®Ñãz#ú€½ãJÿy‘ÃEäºF•“Róª»ÿø†D¯11tü@Ct´Y$Á¼šGj™¯%?¼äX+å•?L¤ÔÛ˜‡Í”_´Ò#(?Êô \˜ã@¨nw"àYl™À<”w„ÙY)ª5avQÿÊ%éömŒ—êÆ5=–AâŒ*$$–-Ò{OcŒËüŒÖ3n¡÷j¦&•3ì£Ç€ÄY+÷U&‡Zg\'ãMnÿ@÷W¢4’: zvlAÚ”‘…‡’> é„Üo¦˜Vü_Ù¹šÇ};*ˆux’ÆC,(¨ƒ| ýÜñ¹Ú÷zw¹ -£fÍ6•9í]ØTÉ°bµ÷áú1K/š&‘9€‡e×¢hœj4Šß.Î[)Z -dCŽREm46¬8Ó¥N¸ «Ô6<É,ÆÐÍ ÉÎæi:ýx(¥Ët8ÐËn ÿ`’®! -¼ë0å ®ÏØ¿îZïܪc~[Q7µê4è©Hšñq‡Ôø°7ò=³ž‰’ §™òÆú˜“duˆ?ÎÕ+r^9kæÖq槜a^NžbÁ:ÐÞ“ªC=>JÅЕd›dg‡¼]ÕúˆËz@øeaªCšs5z Q/FÐéDú÷8È«âX²D›íŽO@Ñ%
U÷Méd>kZ|èdü%ÎÐ?,cYÎMw5ÊÃÃP|øTëZBŒåæxM~`Ô•ä×P -Ïoé†-Ë»ç² ¹
Y¶ñα‹èÞÛ°ëÙC¼aŸèß7嶸מ -뜻%CAÌ‚¬UV´‰Maü€¤Ï¹uñçó„áÜêÀ:œð؃CÛ(|#ºÉ& ÇëéòɼÏÈ8GÙx被 Š³p< BÌýÀ«›[¤Êñ+ÇÕ˳ž8b׈×[ÍT|¥#NùæQߧCW;Gˆ|SmÿFÞÖil±^õãþ™ef C¹ ‡¸·á¢y JòëL;˜L]¸îÙÙeÂAÚbˆPAIÛdðIÔPîÅ -×·³÷ ŒAÿÞ]ÿ¹:# ¥µIä -ÑÅÛ±åprkBÙûCzÆaÑÓ3ëÌ"!²2ö]3¾v{ÌÆY»G «Œs» Oå ×náR¤C2¾&`ñNƒ§Eƒ“\ÙÍ9È&Bê.üŒ¶Ù· nRV'“BV’äýáú%h:¾.l¶CÑy% 4KÉ ÂTÙfÝ4 „T·:ùÔÖ4_'áULšj€žXËÜý¤öiû ÃÆûê ç”´c§=`²¨øqªe˜ßC´Ü¥îóÚlmé òù -H¦Ö¼9Gž¸M‡ôº„þP¼¡ïÒ4Š›µ.¾êJøiˆG•Ä$ …hÎX÷lÕ-DÞßÍ›á/c;§Ü?‚Ë¥9‡l®Ñ{ÄÆ»òni†n½$›B×:õÒ© ~’Xv - w/¼ÞU·O§”~EÁÏAç8 Q•|ðŒGÇ=gý9,?YÁ2Ë<må,*]ß»¹5HN”¤mf`!”uåIì¦uþÕÕ>2L"ô ÄEñK‡æPüÚ÷AÍí"I1„'{†§ ³
úº¿¯c¼NøŒß_lbéøûö—
m„nÄœ É«í÷Zäo£‚³|t0ó>ú>S‹Â™ÔRú—°zaI¿ î%ÕA˜">©
•N~ú‚×-† ®2-QVçh-‰úó
ýÞpܹâÛ/–¹"5vÎf—GWnT66þ8éô ^úÞu¾4+k‹O - Òo)³S™2áØ ¢c—¶FäKa·\®ó*‡©‘@èž›XsIÅXðûh‰ðeýÖ8%W6¤¹¤‹»Ü²yÕŠ½¢uoUêJP'mͧésŠêø?¹ÄÆŽÞמ+Ü¿eB*£HH:`rÀL]¿ºH.âØð~}Êη¡>¼üHÇ8š½D ýâ.ºQÞùÎ_]Ì—%×Ïت3©W$@2?d…°Õã¾Â`¾²ß³Þ׆>xÊ:ªÔý°™9•YæÒÊßÞñ˜¥ãë^:?Ü'°‡eIº¼¨-„~ä˦MÕ7W¥_ÓÞàÁ¥MxqÅß)w¾€Ì}®+È Á‘Äâ Gu™.Y6¸D£‰ý}KCîý§WçRPn"8U+Sœ÷ÂøÌûyvÝôL½3ìüî3QÁš\É–ä>¨UHC{ϊѼ•€Q¹!÷Å“÷. ¼?;L9§ZšÒE¾é«v¥Ž}03|˜6þ–ˆ¶9£,wh œ-ÇËŸ×;?zøpÙÍ„y8àŽ9Ë¥H»Ñ<TÒ>HîÍÄû-q˜˜\—1άÄ.5HLUcß|{¨8óŒòZßÔç`äô³ÁPß½Q5åŽèz”=û ŒW0zúU÷Þ r còRˆžÿžDCh-&¦)¬u#Å>"1™k–ôÿ »žÍÌÃá±N”vD#¹¢Açª ›`_ÝxXÒÈwgÞ„ÏÙå 솋ÛÈK+´CܦA"Ê -âc§x~XÃJo (¦cé;‚÷ÿ¨š#1âŽøé}SUx °f=”4+ÿ䎧õZ›…H -—€_úØî*Ý– ·£ý7<³Y6ªãvl¤ÎݱæŒú‹ Ù¸™‡ÈÈc?m·Ò†h¡ˆÕ©Åç•¥RäÍ×”»L|âÊLwõø
Ρò°¤¼AçY Kr¼Ï¹ÙÖJÑkW ½b%òyQ·ŠTæ9æ‹Ló"$N¬½ôž‡9ȯòL¡ åùö;û¿ZÆMú›¦Ýj{wAÆIL TI¨£%èÔ&ëö…ôâÞ %§½(1ã: «/h•¶µôÕ9óUÖô”‘Í¡i¬rÝxUæ¸ÂÝPÂ#á61”#,*@Š
–üb±·Tx8ÙÄç{ëG79yçÐê°ÀCþ“væ$Põ`Ò匀V–ƒÿþu6®%…Ùqc†¬Ó:†wtÎì•NôwØ ÒPÄv©*û&<û'ývýЊâ¹!ÔA"OýMBð¼"ðÛQܸ…ÍK) z²>Ç'áØóô-oâŠÌ#°±ÛÓÀD/&Ësg k7/;ô^D÷‡ÞKÉÁ¤ ŸCH-²oS<ÛõCoõšÂÛw˜´øŒª"ØK–_Š"H‘¬ûVpÆsáõpa¡£_ Ì×SÈÚua¯õ°Ü±l|ÚV±{+ wókÎ:¤6= s÷(HfUôRê¸zP¢[E ïcYÄEùºŽsûr~3§Ÿ°3ŸMÆ?å¦T‚°ÍZ5ÕèR˜±˜rL‰buO[ˆ`×w\ÁU·?‚‹œWà&ó+Дzu(“ Ø!ÌìÅûR% 2ú§8xdßÿó <ÌЃ|Šˆîç }®rw‚RÕ:Mp’òÛ BÿÉ] ˜RòöÖ„½®íX((gÿ¶Ä?É ¸‹e»¿è ÚXÄ -Ü ¯*ù V}ÒD¦ÿôð¥ÎÈ -}ˆÒçq=G/¦8õ6ÙüÍ/]Z?ó {P>yêU•œµú}éË2&@žÊå:Þä®þ;TÆ -݂Ư9ÎÖïSftt7,-–‘hV© ©<
®ÙÒ]+,àŒA‡Ø •;…ÔzEå]þ<Ïßý‹Ìɤ C™Ñ6ïðÖR®{ÒºsŽyZÍÒ+±êÈÜôÄk´Ñ¤FÈZ‰!FÝmP€×:%•éd - Ü)„lk2'¨ á"€”Öó±âµ|syùÍ ±Õe€\ûÊJ;YýMªI‘_£ƒ~Æ1bfÓõÝd=–ÙþÅ|SÅ=UkΫ -S‚DÍ0 -G7ôæøÆnuÒ{«ýef‚‰@ÆÚJt'D©Ñeèb
ÕÓþÿkŸ,Ûš -ÅGÕkX:gׂ še£¤xu®ôØ\CùqKå1¦g ¡lø 7[Ù²Ì4Òÿ¹ [PÞÿøç¥ÏFÔ´²ÿšûI#pŒ"ªºóöWwxN¥&ÿÊYGúéÆ„¾åoK?\aùt@½=¥¢D#UŠ&ÐmÂ΃:Kó#˜´ÏÙf`ÃN¯Ú¬5}=ÿúfy$V·‹Id”-é%#©¾¯{z²5…رF’oö¾!²’»÷ØIáMØïä†H}ØÝÖR ´x`î/Æ]è›Òª^3±Í7é¶ûñâ¬Â^µñŠ -·(FLH³~å¶ÞÖ@Õ6 Jäó¾xÌ0V?K£ÈÕJÑ}gy,‹¨ †/ã©$þ¸Ì~“Æp\!#…þö/»-ñæ
–Ú3Uv+l•EM ´Dýý_O ‰uò!÷¶:)
G‚·Ñ é91¬ÄdÐ~í@§q&±ÑŸ<¹¥ËŠ)üÁžjÄÆpîp ãO`6ÿÓa Ì€“Ê ‰bœ›³ƒø*Ln<rüME‰J¬#Å<ÝþŽð »Z–êÞ§é - Ö/y³¤¥6f,¹yK@ðcõÏ’bÖ3Jca~Äï¬]+)T!¿hê (ò‹gÙ׺Ñ9QÀî/LÆ. |ºy‹ÔOI ûè{£dç*ÇU6j—áÅ+”S •ÙÏ= ¡ …–› öHL -ú¼ÌìÝÂYÛ…(tf¦ƒ>•OA‚+«ä¿dWÍXäøkÚ— ÞÎÓÒU± ?*›¢jžêß_ -+µ¸¹Cíu†Æ…¥v‹øò¬WU˜}öÔ“LÂØÏÚ(kœ¾¨RoiÍ^$Hé~ÒøÈz’ T ñ׿·xû0®Åψ_ShúÜ2\oEŠã¦=U´ž$¸_N Ó–jz͉Q -Žò2Oa}=AÀmãUv”'·ýÆû9û¨,Yó‹Äg“ˆÐ‰$¥°®ÇªÍ3|Zí-Ä -ïùnS;ÝŠM‚fˆðÓ%¸<%kDpu47û95%–T +G“¢æ×*T‹J<È ü«˜t‡'On¬ÄÂ. -ðž¯ÔÏ´ZÕ׈‚œâ^ž>ñ·!eÖ²ØäÛ¶(¥/J‹@Ëz ¼–F]¢wò¿ÝÓÏõwÁ/…= £ÆhŒcsËtö„t˹¢Æ1|Pú1—ŠR,·²ÖÑï„$8É -,f¬S¼‚Ô·Nï¡Ó¡›¾¼xœñÏ‚È¥éJ# ìKÛ1íü±SŸä{årsê,<+ö‰ÙöÙœ¼U1*µþôD'î¿ð|ÂBÕF5Ç .‰Õ+‹f¬æ-åuÝÓ±oFã” ’zeíðÓ„A Ç«á±™—KØ+·,V cšðôŽ/EþrË<g{³™$ÇÜ-+Ó xYt3É°¯‹çq¬¸”‚û@k{#lŠŠBäƒûO€Ä¦ù%ÛèúC Ýt@AÎ]7DXÒþƒÅuOî¾[©ÞÌ
m_'y… ,Ò ÈŽA ìÊxi -K› ÀöYt^¬evQ&57Ñ„t9Æ©‘;ØQLV2²ûËI2U^¹¨%Ô~ŸŒ×ˆzW -—wyÑ7a﨑Ýâ‚\Ð8Ó}`\%êp‡có'Æü-ú稛ù2ü@/øç0´ âs]1Ñ “ì³ h«Ñˆs.:5üókÔLžQdBöǺs+úof´Ôë§hÖ"³ÍÞ„ôî¥J¬ °aÿì·µid´¯<îûöÞŸpÖ=×&¸ùï|A½WKÏÓ}‡õ2yÐ2f:oü0Á¹=}”% 4€%³ì~46¬“âNÑq›äøáõéí”Ú,VÞyš0ÐYjš¿c\êàøªà躮´Cg6Çh¥8=’Š%hU åí™Sî·’|Ì¡)‡{—zBÅŠº¿ð"qج5å§\ -p -íSß»bò7+Ö˜ß áænÍwˆ'£#µE°n x‹¢PšL~|ö4KQ¦–!¯jn£ÕªîØãVBGE”}œœ ŽýÐ{ƒéV³”Vã0¾ô.¶Tv‚Ì|` °SU[¸U! &ýø7 >hI£YÉì0 …òÇ*껪¦úݳj€í¨ž¨ß`Ù?8sGx9g3ÎîèñÙt÷:n:—S úluHx‹œ›ÍÉPo·«ÃJAüÕh€ß¾ÅW'ˆÃô´B ¶q…¡Jˆ`“ý kaæ®´bg>–MO”¶æB8uk—ÄþÙ7)Çê®Ü¿5GVQ(ë¿Pm-FG*åTA¸¡WK2z)· Ž×?3Ì›QOl -s¹ -¹ƒ%ÔÕÝÙêjý#Øáêendstream +/Length 21036 +/Filter /FlateDecode +>> +stream +xÚ¬ºct¤]·. Ûv*I§cul' [ £b§bÛ¶mÛ¶Ží¤cwý¼ï·÷>cŸóëœý£jÜk^s^×Zë 5FQ’)ª0›Ø%ìlA ,ŒÌ< +o(:¨Ñ_‚ä¤ñOFuØI)Q’¬¥®‰Í:T\+kÀ2ñ´Ò(ÏË2+Ô»Ð]é¾çAM¾×Q?A"tto¯$ÏÊAœÇÛwÎB¼ã¢ü1lþUxq¨eÝÒäöt ¼d"$ÀÇŒ‡™M ,tEÃ2g§ö“0ACª•ƒÇ“IyàbLżê|c + )/úh½0HéZ =`|K›@?ôî3Ob¨cËL<Bß1d÷h•ß$™§ ”±ù¡î]C¶Y™GOýú!‰ëŠ.=÷«Ý ¹½.oÇ°,½ƒ št¯”3s ƒÆÖ®·qbé§0ŠÅ°ÈDY~–iÃøu(Ò˾‰ªæ³?ž
cŠÔbdS7sYð§>ádÍíìÉQûcz‹þú7¾cèü¹$ Æ>2Í%—¹ß°%F +>@í£dJî'¾T¨WÝ–
’ÆÑë«úþ®@Zl—,P* ï™7o6x©bäÀ×ZëíùOרc ‰^à°HY¹ê¶]¼„qGÝx-
$v·úyüJŠÑ‹lüwÝ„ze|5lÇ¢‰Û&^^Y†¯d¤å¸=眫Ø'ZðþžQ.,°#p¯ü°Éøù¨~j‡|i¯ÖÍ_)¢é<-ëqHb_Ò»S3‚4~«Ò/²Jú +ó»kœAUyÑ®
D‰<aº/Q߆W}á{N·râ‹0¢ž¦¸ 2üuŠþK!Ìe§óç-õœ_…Éæé&·öŽtºö›)×öÜÑiÞÜ=39^TùyÖVÑ úA`›Ë¯“Š×1³[´³Cr!F\YÔT¯É$0¹âv¬]1¹â2õ¦2˜÷¨ÏQï<^™2ÄH‘,Fð«Ð€öÕúSöËö$§f@ÂÝ}7EŠqÂl™ûÑ0†R +CùV¿·¬žg&>ˆ„’"µpVk_í+t·—$ïÒBhtçß’¼`ª-‘C†<l®I4@‚ŠÕÆ6Ã0;˜‚û;>Èù}îÒôƒ¡OQN¢¾hÉlÙ‚¦X©ÍÉÃÚ-ðÝ󜚮Ӳå‰f]D–„]fp`Ý + ‘ו‡ošDƒŒ ¾”¹yÙÚ<1Þö÷Š3 +9à Ù÷:Å„Ÿ\ÉFlý¹ŽNÁçµ±½F¥1¢{1I# ù#gÐM !Å&Ð!ùf¸¸<:â‘[Ç‚êÞ—dx²UÃü9‰Åm³{¦¨F®Aº/b›ƒÞŸ&ŽiÊù0ÆÊ<É{ –3Á—)t;¾ +I…ÆÄ8á J’«2ðÚÁF–û†t÷+àK‘D:r tËSα£³ÒFX°Y¿ƒw0¢ºãÎo‰Õ"Ú-P¼L>Vš˜ñפ2 Ynîë|CVÞZsZú Ó†x9„ĶU&bNž\@š'üýlNÔÞû1ãWÎèjöE¡¬¨ÿI1©~´Ç)¨¥P#çP&¦B5ãrEò¬é&ÜìPÿgÖ©‘ŽrÏ3ä5ë(h“‹£66q¨ JÄ· ï|à·Ë Ç#·û:[‘úìƒîi0žìÎÚoœ*3ö8¡|Sgr J _ˆ·¬»TáZ‡%{ÍbË„pøTþÃiK¢`È$Ñò -ž—
r +g}%ž¿<ÿš¦¢§y>ÕdsŸZˆ—ŸäØt‘ùB<*Cuù
Xò4RWJY¾?Ôse4¿¦öÁGGøË=1nI6ö>â¶dxøÛzÀÛö§úø÷^`K™u ÒZ¹$gMÍÍE®Ý§R‰³› |~Î ;âIךÚCXFçÔ[ "9Û +%Všy¯Žç½wd`õ\ ¥ +?>Lîw\_¼__º‚+úˆ—Ï*×5²,Üâ~‡ +ËGBÐ×4$<]q…x\6_ÌI_Ï ±È¸tÓ<< ±ã[ôV(“K—ê£hAÑLÿžƒ«±î«k”“Á ™-H¼~„ÈëRtàÆ;ê¬Ô§ÐžSŸ«,Ä>x›ºQ mMÎ à¸ÀöH|’MÇD-2:s»ÁK¾jÍ)yu$–©Ó:ž•([mq!+GŒ™SÞz‚PùÒ†ÞjLñpö«Ys%²Ý¶p¬z.M[›t]Þ§ÀŽKx ÀKPų½×ÕêL•ªçLý=à'd{ì-¥?Ö#†‚¢E^+#6#–
ñ/–“õñ¼ÍTñÖ<ínÀZ‰/”Ú8Y2ÓØ/gÓAÓ›øæ±,dx +v]šÑØ}a(ôÉ:eÝX!±«A Ï[–Ž×ÊÜ’ÀæƹƣÞ3a‘^£ãxR°šË\ì2ª<2€ÿŒÍmxÕîQžæ‘ QáE‚žÈ¿¼=±HF,ÃØðªÊжÌ>Èü]¼¾Ø¨ÍqZ\Q0³“×-|/SS´æ; ª? [ B«˜jÜë&BØ’ÆIRòu“$€„ƒƒj°i&ÝY³$——½å£ +ç¨÷i
¼%0¸)xëõdïIG•& Ž¿œÃtɳ6†ž7|¸.&õ + -ΈŸçf™Õ ÈPMC° 3p§î¸eÚìq²áBÞæh‡~ ò¨,þ¶¢Æ®¹ÿã +¥ ;Kƒ{jPÌCÛf¯¨“Ø£_:©Ãb*¬Ž–Ôº°AïhµûÞÈq‚F΃a¹¦Ô9›X´Öò€)t‘ÚQPAng©§âÏíÿ4»š†ü˜©>¹I¡Îúîá +-5ù\;³½2>V®±*T#
+ +@0‡cz´ëðcL"¸¶©ˆ1tQ mhž7OyÙK/=mŽ1Ü´iüŒÇŠ··ôŒÄŒ%¥”v=
\l B× 9Æ †½‰ü‘“WŽÄõÝ©s;Ú¾†øðýa _ 7,Z±jg[À6¾bV¤ÊY—qá=›TLÀTæù4¸©ŒZä¹xæÇ©D S7Aof„ûoŽ¦¹¶†d¬Å(?# Í”¡4÷Ú7©¯;˜Ác%$P„P|¹Ú“k½T˜dpR(áæÓþ; @UÂŽåo.P +·?å? «ì:º;rº ¶;( œ åÒHBÐUQ%Wy ¯ÇûcEàÝÚóÌãÁÏbמgo@¦ðq´ÔDÖèÈ'
)øóÁ«ÄhåHø*²ï›#™·ZÏYHá( %Òïg!›µ ß¿ûW{|êõhñGÆq¡ÄL»»o–DTèd ·ºãú±‚e6D²]}~Ç¢jé‰ +S(xÚ#oÓÜõç ç‚ +¦cô)E}dðHÓœGNo j<]Sç¬<âu½âyקûU7Á겋E«¤py÷á8'ËÍibHö qT?q::جöì(ݽïRgÝý>^ ØûûWM€Õ}ýÐ駋–Ê{ÅóZˆÔ(sï[6ìÂO ‘zü +I³Ùêé Ç–T©-˜R§5߇›‡þÚ@ÂÇŒçoT§÷uf‘‚‚Ÿ£;?®IÖB,$ÊqªG¶vÚâ¯PIJ •£Æ»¨(¡àœ•SÕ`RHáRp·É/i¼™É6rƳ¬È»ÚôÊvökU;]äW¸éysV†$Z k›oÀëãõK„ö Σ
æe*|L Þ¹*p¼§ }¸ò× }an²éÜ¥ºÏ¡öÚò´Ú7dîyˆg9ÏÅõð¤éFOdtã’ý‰,5FYrè¼c}í¤Ná§à:†K Ðe
fŸvE#Ÿ?Íю˪̘ í‘0 S(Ó¿£ME J+dL©¬¼Ið^>|$½ g'IàŠ´?"týy0ïù4=:9W8ùÉÝ1Õ +6AdQ›¹Í,>N)¥Ò©ðOã’ÛÍ·o}ŠÓ3U¢ªõ3“ÏŠC…}àp)Æó¿a™FK›ó+ •W1{‘¨íœiNŒZ?¿~Ô<îZÛ×Áˆô~ô}“IU?û +^ºö*ÕÊ;â˜<\éæjB† :æ‹ãk‡o™ùžËýtaA=« ÓÔ'ŸÔÐH•ÄN!z^“«ÿw¢ëKËÌ´«vߪý'ZÎØS³_-Ÿ!¡ÑÐ9†˜yƒ±<`–ìÜkÚìƒ8˹‚® UF¡èýÒ¿äâôëO‹¦3xª©‡ì†°b$pãÀfN2rI[ ÷Ð`-IêѸ\\AIëÇz£AÅ
;²;»¬·Ó@sûÑ’Ðë"ø ,méG(;vø™Ùd× "|‘"¦ŠÄ`྅Óé‘«¬óõlýÖ!|t]Œjø0Š–¬¿Ö¾ª0Z
)ˆM&çEî+É÷Éœ GÌ7kʱ— Ed`X]ŒÚE•ÀQd¸À'D5õüDU° p¯)+7sZz Ce´– +Ý)k=g< +ýÀ”å•LâàÛìàwD#XY«yû¸é ‰zp£^àž¡°óRÈÒˆþ‰B˜D²¼¾Ý_v|˜÷ÕìÆ”¡v’S|*B‰ã˜D#ÑŒ¹N7uˆ'ôx’ ÎvïNEy-‡U I 9̽Ç|iýB[}¥ Ó¨ÜE>T ”;pf4_·Ñ%ÙøN} T…—Äï÷ uĘ¿”õ‰¦ûñ,Ri.ï +„y„ÑŠ<¦ª òÐYtÍþz`Õ4ŠMÇ>f·ÅH3¯ð(±…¼]¨!9‡çߤ– šà›cà +è°ƒXC#Ä1ž7róѧƒ†1÷‹þØ*:½Ý +¾¬üš"¨ùᶓ°P
¾¢®tþkºô¡ßs˜8ÁºÌÈ8õc°ã9•Qæ3EåŠü±¹ÙΆq«¿tÔöÙËCCY^"fDzJ +ÛnÂ÷Ù'Î{ü®ÒÿŒŒ®AiD–Xg‰¸N +Ã2k}„‡Œ°±hd7,=½åÒp3{9 uN4Òœ °T—£b ؆F–i$ïó‹'p‘}¾Ÿt¥™´ð^ɨ"3±Ut¢¡zx²ØÆx4D K¬ZógÜ–z‘xC6‹]äÂØý9&yóï³t6?ðÌ"% +‘¼FøCAÌÑð}>€¶6‡¢ÓVÛþ\ý di B´«ÙQ¯è.Ç~Þ‚´ÈÌ=ìäm’6yS$ý-Ñ¥ª¶™)P‚´)ke ÅÃvM¡Gã¶Ëe·5%¬_ØYûMŠKÒ}ƒ†Œ8 îÕŸÃl5wìóµ Ô<öÅ·£„²3dz’œVÉ ÷ + žóø.Ñ°\éd¥(š˜>¯–LãPÊ Ôš3,¿Ô16še¤³Û²˜BG»OåÔÏæ¦_ƵW‚®e oÎP×½'”@ç×Ò KLýº-/ÞJ[ýŒxw]öG8förˆVƒÉcvÄþh;Ìšé£è‡µŸõ!qîL¾Â mÕBÇïã@håR}ºûür†¢'rû⣖í5qq!Š¥¥¾ Üt¿°wô¯µžQ8É@Œ‹«}Hë% ‚Õ›E1TâìGäìï¢vF9Õ´½Öœþó«õ‚y¦ +°YN0Ûæxô Þù¾•·Z1#‘pÐG)œïò±ž{+¿ÝªjwÒ±E©áš=P´Þ7±ÙÑ[7û¦“¸NYYÇU¸yd +¢ˆÉd)$± ¶Š¸[a# :‘ÁÜ.‹ÍÉü7LÓ„(èòGÚ yö é안øžwbMŽÓüÇÞNËe?ZÎÂfRc¯PÌeš²ªéQÚ"äI8 +4Æg÷Îü ôL¬¾¾Ò?Âlœá6_± Â؈u‡ëî$àÝÌ; ÇDpBÝu¢Cbî›#13º;Ï +*‡Kò·¶‡;¼-’"+ܦ˳-ý<ÎÈt_üöYëÎ’áBÁ‚¡$üé©Ò.&>Ùe¸R¸¡3›Áÿ]u7üaÌõ ñ.R8‹zAµÓãvnXLûçpYTÓôª['ÒøUÒà=|¹üº*ÚÜOAŒ/–*CØ
¿?CÞêh67÷
Wáïx,V½ªŽ_RÆò^/H–}èÈ;‡¨=+mä káÕÊuS®ÉẇNbnN’²‹Y)êctž-yá¬JHw‡d`‹£Mó®úí}KÕ4¬«–!øWù…sYÚá•MS
|•Ð§D Nß"æµdYDé +Á4õ5’KÄó}†#‘.§¤‹R‹« +õS—¸oïV‚•¦x{ì—?]Ž{øjA}øé{¶$õ†BÇÃh>/o†"U¹»ý´P‡SkwUçn0þ €8âàB¶ü ¾F;u¶pL) #–à +}c6!„L¹âP’{ƒá;D¾dçq í¨ˆz`Ë2«f§µ])ÊFDŠÜ›/˜[öÃð"§Ê^wHZÁ‘³"¯oD{¼_7z üä5àb«;ýS@$ú¡W ° ²ZðDò¢òuÙÙ‡W{fMÞ2ó ¥I*,~…Ä©¹#xÖÖŠìz‰KkVßL™E›)¹‚¢ÞIXbÄSóùÈ»´[N[lº 3íLX ¬˜üçw^@dqór +G%vA)ÁÃG¬³¤f‹o¥¿ñ`ÝLF™óVõ‹ÔK‰óÔÝwø`ø?qŸàÁ¨Í tj@®È<a‹÷÷äIFÞµåüïñõñÚ1*Oîc=÷Sï×Rf•«xh¡«> Îê3cçÈ +ž(—NÑÄåi¾%¦Še¿€Ù?ó‡ Ÿ›o†`ƒbîª0Ø– õÚ MR¾ +Xá…<§õ0ØC"ôñŸjè (–ŸÚŠeÂÑ_{Ú#‹p7ƒLìÙ5`:ì¥~Áì4«¼„?ãL®Ý8Qó\‡,OÇ™ÒÀ;ŒmhT ΧµVÄ! ¿h¥¦ž;t*ê¿ôŸçq
!·Ë, ·*¤Z…ΟÐWŸ¼T‘*”„6C‰:(ç›ø9ÖɵQçQÈÔGæǦߑ_<Â9ç×YÛÐÚºMîƒ3u"JL üüÒ¦Q#ÆV_©©…vYTóVKYðçæÄÞU™gÔ»ð¼ òù‘Ïz‘Z(ßC?¢1Ý=ž âD®jŠR8€‘%öøg×Èži2v»n›„¸MM¢t
QdÂ*l%–¿‡RS7ÌÖgj¿¤‚<ÿWßÊ}#ó9¼ˆ¯†eç^™êg ÞÀ
Ïõ#²z:Ý¢ +Ha\»¤ÿ EH
Ü„Ôçì¾f• %bA¯üIÃvÊ¥lPsw‰8º8ÖæŽÚz1IÝûQgÜûØÍMw©•—#ŠC$=ꤡ ºí=ŒjâwÔŸD*/ÜÒdêÅÎV +ž‘õ÷¦ÝÔÆ.3±õƒ¤9ù]v\_17OnS{‡71¼ôtÝêÅËCgû!Ìõ’+Ì\\j·Äž¸,1Èßß62–e€Æ§¥ì¶£þ&kL¿ÜêWÎc½aàJÚQà&AY¸Úãt¼Å+« 8•õ àZõг…V|Òœ½ÅÆú¡/½99t<g¸`^B?h¸Ç0Àûµ©¢ûOÛ âD¥¿ ¸ÆŽAôÅö ŸÐˆ"&üÒÙGZ‘úáMŠ÷1Ó.Ø›ÉÕ +}É6¡©†þÇÈE…<ÊP&öÌ>sDõb Û_Ç ÜÛWp vµe>‡ÿö²fßé(!‡°~i0bkzì¾ÕIäÖÙ²¥© @ œæ‰R&ï…Ãi$|i ׶Î
³ùòR¥ñ-f —ºŸ æžæœby,Iê ¾ŸpXðØ©»›¦Æ )bF°¡K·b ¬H‰ÌçubØ<A¨õ¨Y*ÓIÄw7y èÃokSI‡&úÆΤ Kʱ¯¨/ÞQwŽŸž±“&×í1 ™>JŽ%Yô ¶yX}<¹ƒùÂ3éîe ›i0Û~4f$z6n/¾˜z¤ðvÀÓx$×ÂìÀˆæÑnmeõaàtçTŠEð*>÷ËMÉCJÁ0Ýg¿WæW k¡0[(ÃL(”ÂÁÒ/;í:1J ÛÙÞ¯£ùþŽŠ's +†‚˜!Y5ª¬h›Âø +’9„ ©²Íºi=ÿ¨ nuþò©'h¾N«˜4Õ 7<±–¹ûIíÓö†÷Õ=Î)iÇN{À$dQñãTË0¿‡h¹KÝçµÙÚÒ9äóÌèÍï@¢ËG¢ $éðfKvHÀÑ:ÓÝ&îûAoà `žŽ“DGO?Ìd¨ö3ìŒ Â̪i¢ì'Y"-°ö-¸™¸O-õÂ5¾4 ¡Ãš6rMŸ4Éì’‰üË¢¸U9F4Ò±SÑU-ÚÆ +¡à£"Ð,‘gÏKîD~^ººÓÜÉ/Zn\Æ$ÿMŒù–1ÄŒ)Á×BoÅ£E[âcQóh¨X*úêÊÒO>0”ëw+ÇœðaÚ¨F~¶zñyþþ{ ‡ gS(êá9‡&IdÑX2)Fžb¡8ÚËp¤‹PX,Gæ(xõš2œS`º faje‰ªh.,w¤á«7 +cLÇý2 Ža® +LysŽ<q›é;u %ý¡xCߤi67k]|Õ•ðÓ*‰I +Ñœ±îÙª
Zˆ¼¿›7Ã_ ÆvN¹—Ks6Ù\£÷ˆ[wåÝ4 +Ò ÝzI6…®uê+¤S9ü$±ì +³î ^x½«nŸN)ýŠ‚Ÿƒ.Îq:¢:+ù áŽ{ÎúsX~²‚e–yÚÊYTº¾ws!kœ(IÛÌÀB(ëÊ#’ØMëü««}d˜D2è9 ‰‹â—'Ì¡ø´ïƒšÛE’,6bOö O;fôu-~_Çxð¿7¾ØÄ(Òñ÷í/Ú݈9?’WÛïµÈßFgùè`æ}ô}4*¦ +…3© ¤ô1.aõÂ’ AÜÿJ&ªƒ0E|R*ü(ô¯[ \eZ¢¬ ÏÑZõçú½á¸sÅ%¶_,sEjìœÌ.®Ü¨llüqÒé;¼ô½ë|i*VÖŸ +¸KþÓp’¹«³>ú±ägWüD³É÷?æKåÖôm#|žZ¡£ ¢Ieí "b0G`½t¢ n¢J¯q¨ÜÜPé¢G08mÜ8Ùªç µÝ¯Ý ã¤ßRf§2e±;$D/Æ&.mÈ—(Ân¹\çU"S#Ð!=7±æ +’Š±à÷+ÐáËúqJ®lHsIw¹eòª zDëÞªÔ• NÚšO%ÒçÕñr‰ ½¯=W¸Ë„TF%:uÀ䀙2º,~u‘\ıáýú”oC}xù‘Žq"4{‰ +@ûÅ#\t£¼ó¿º ™/K®Ÿ±UgR¯H€d~È +a«Ç|…Á|e¿g½¯
}ð”uT©ûa3s+³Ì¥•¿½ã1KÇ×1¼tþ~¸O`Ë’tyQ[ýÈ—M!›ªo®J¿¦½Á'‚K›ð⊿Sî|ÿ˜û\WAƒ#‰Å9Žê2]2Z³lp‰Fûû–†ÜûO¯†O
&¤ ÜDpªV¦8ï…ñ™÷óìº
è™zgØùÝg¢‚5¹’-É}P«†öž/£y+ ¢rC*î‹#&ï]:x"v˜rNµ4¥‹|ÓWíJ û`føZ1mü-msFYîÐ:8[Ž –?[¯+v~ôðá²› ó&pÀ s–K‘v£y¨¤}Üšÿˆ÷[â01%¸.cœY‰]j˜ª:Ç ¿ùö:Qqæ!åµ¾©ÏÁÈégƒ¡¾{£6jÊ Ñõ({ö;¯`ôô«î½A$äÆä¥=ÿ7<‰†ÐZLLSXëFŠ}Db62×, èÿv;=›#˜‡Ãc(íˆFrEƒÎUA7Á¾ºñ°¤‘ïμ Ÿ³ËØ
0 + ·‘—Vh/†¸MƒD:•ÄÇNñü°†•:#Þþ>PLÇÒwïÿQ5GbÄ ñ
Òû¦ªð@` Ìz(iVþÉ Oëµ6 ‘ +³ãÆ Y§u ïèœÙ+èï°9¤- ˆíRUöMxöOþú íú¡ÅsC¨3‚Džú›„àyEà·£¸q ›—Rôd}ŽO± æé[ÞÄ™G`c·§;[‰^L–çÎ(Ön^v轈’ ‚IA?‡Zdߦx¶ë‡0Þê5/„·ï0iñU E°—,¿"7ZE"Y÷à ŒçÂëáÂBG¾8˜¯§µ#êÂ^ êa¹bÙø´b÷VîæלuHmzæî +P̪è¥Ôqõ D·Š@ÞDzˆ‹òu çöÿäüfN?ag>-šŒÊM©a7šµjª)Ð¥0c1å˜Åêž&¶Á0®ï¸‚«n9¯ÀMæW )õêP&°C˜Ù‹÷¥J@eôOqðȾÿçx˜¡ù3ÜÏú\åušà$å·=„þ ’»:0¥äí
¬ {]Û7°PPÎþm1ˆ’=pËvÑ18Zµ±ˆÀºrG»%±6.«ßÌ¢8Î8П«woZKÉ9'çêí#úG—ïj ²X+§ÃšP8†»ŒÝ¸¼0J…®D“-ý f¸=_U0 óAú¤‰Lÿé-àK‘ú¥Ïã&zŽ^Lqêm²ù›_º´~æ9ö$ |òÔ«*9k+ôûÒ—eL€<•Ëu¼É]ý v¨Œº_ rœ!¬ß§Ìèèn"X [,#ѬR;Ry\³¥»VXÀƒ±AA+w +©õŠÊ»üyž+¾û™%’I†2£mÞá¥\÷¤uç ó:µš¥WbÕ‘¹é ˆ×h'¢IµCŒºÛ +JÎtŒa½µ~öB¿çn
8b¦”W»VŽn$èÍñ)4Üê¤÷VûËÌŒ;µ•èN ‰R£ËÐŪ§ýÿ×>Y¶5( QD‰!%ÝHîfà¨Ñ9º‘n i’"]Ò-Ý1ºKÝݵ÷þ‡÷Û}îùçÃyžã•”4|œ"ïñ`Ûý]_€ßÿ¼Ý²í\£$«:ê¯{¶F†Æ»lìÏ3¢?ÑL$G@Öóå×vmôãŠ#Ž ª×°tή4ËFIñê\é±¹†òã–ÊcLÏBÙðn¶²e™i¤ÿs;<¶ ¼ÿñÏ7JŸ¨ie/þ5÷“FàEZUuç!í¯îðœJMþ•³ŽôÓ }Ëß–~¸ +Âòé€z{JE‰FªM Û„u–æG0i ž³ÍÀ†^µYkúzþ'ôÍòH¬n“È([ÒKFR}ÿ^÷ôdk +±5b$ßì}Cd%#vﱓ*š°ßÉ
‘ú°»¥8hñÀÜ_Œ»Ð7¥U½2f +b›oÒm÷ãÅY…½jãnQŒ˜fýÊm½ªm&*þ8”Èç1|ñ˜a¬~– F‘«•¢ûÎòXQ;( _ÆSI0ü+p˜ý&á¸$BF +ý1ì_v#ZâÍ,µgªìVØ +*‹š@i‰úû¿ž8ëäCî3luRŽ n£ÒsbX‰É ýÚNã0Lb£?yrK—Søƒ=ÕˆáÜá@Æ žÀlþ
¦Ã<˜'•AÅ87gñU˜ +Üxäø›Š•XGŠyº'ü á9vµ,Õ½OÓà¬KÏýØIC` ” ¿¸9Âò§é¸ˆ ßcZ”Âh.RÕŒI8¬_$òfIKmÌXró–€àÇê Ÿ%Ŭg”ÆÂüˆßY'ºVR, ¨B~
ÐÔAQäϲ¯u£s¢€Ý_˜Œ\@øt-ò©Ÿ’>ö‡Q÷FÉÎUŽ«l$Ô.ËW(¦8*³Ÿ{>B7@ -7쑘ôy™Ù7º!„³ ¶ QèÌL}*Ÿ$‚WVÉÉ®š±Èñ×´//2ZA$¼§¥ªb;>~T6EÕ<Õ¿¿Vj3ps[‡Ú[ë #.JìñåY¯ª0ûì©'™„±ŸµQÖ8}Q¥ÞÒš½.HÒý¤ñ‘õ$=¨â¯oñöaZ]‹#6ž/¿¦Ðô¹e¸ÞZ‹ÇM{ªh= Hp¿œ¦-Õôš£ åežÂúz‚€ÛÆ«ì(Onû÷söQY²æ‰Ï&¡I(Ja]U›-fø´ Û[ˆÿÞóݦ6vº%š.[Íá§KpyJÖˆàêh2nösjJ,©VŽ&EͯU¨•x9øW+0éOžÜX‰3„\ +‚¾¡ÉzŒ:s[+ž:[´‚r 7À«_ó熈ÑFÂ2Õ:¨Ù˜-Aè +œÆâOŒ,Eß÷;XM« â U†æüìeçÎ &¾¸cë2“.D£T«h8&Ëe7nV"ÎCøpÁ¨Ö# }&_ot-ç2ÃæXL¦ºŠðï"’‚Áf&Ñ탔w¤éʼŽE9Ãê¶Y|t\dà=_©Ÿiµª¯ 9ÅÝU5½<}âoCʬe±É·mQJ_”–õx-º Dïä»3¦Ÿëï"‚_ +{8þFÑÇæ–éì é–sEcø ôc /
¥Xne£ß Ip’XÌ,X§x©oÞC§C7}yñ8㟑KÓ•F<Ø—¶cÚùc§>É÷"ÊåæÔYxVì#³í³9y«bTjýé‰NÜáù„…ªjŽ\«WÍX!Ì[Ê뺧b'ÞŒÆ)<$1ôÊÚ[,ৠƒ@ŽWÃc3/—°WnY"¬Æ4áé [_Šüå–#xÎöf3I¹[V¦;ñ²è2f’a_ÏãX ;q)ö& Öö4FØ …È ÷Ÿ +=X¤9 ƒ:Ø•ñÒ +†*Nñ(ßc“À“ +ÎQÓp/6è~ +ê™ã2ú»‚îY$óµÉ•ßª2^IÑPYm3ïÜÚ×Juý¼=ÕùÌ~9Äÿ 2©”pmP kDÉ Ç¥)DcX¨Ù콘ûk*+ ÇMC Æ{Ù´~͵)²è5¿¯ÅL|yÿ1ª5u‡Êëñ÷Òc9„ÍrU ¶óBDøò3TyÈ嘙 SzH1ß+`Îð¶+ §`½°W5Ó㎎²ÁÑÃiÁ™,÷ò}cýö3!§ïÒƒŒ‘Pu aÛ›”Ë tòÍ|T\ÅL,pÈBHðì9çÑô)8H-úäjj*ê=êOŽ +Œ†<\a/r¼ˆ v ÈxµfíÉCvP€ÕóuóföÈy§Åm4ÍÛÆajùlW¤JÕ4pñûZ¢ Aÿ6Ñ®–B][¢µš×´B©®¦Ö +åUÔwUMõ»gÕ"& +C•Á&ûA×"4ÂÌ]iÅ Î|,›ž(mÍ…pêÖ.‰ý³oRŽÕ] ¸kŽ¬¢PÖ¡ZÛZŒŽT2Ê©‚pC¯–dô.Rn ®f™ 7£žØærð k®–-!OõŽž1t¿9~‚ó–‰æ·q¼mx Yæó”9gK’}ÃÜÕè×å HéÏAf™\pCÊˬM‚._óBâÚ jq
À¶]qL÷‡ Âa¯¡n—ˆ›´¢('â¥&Cvpñf–¿‡OFÙ2ö +# ð:øF(‰¥YäsäLèÆùxÂJßÓ%ÌgæÂîˆñe :‡¯#0®ÿëÊ»3¯‡óíLM¤\“wŒgßRkHäŽÅ_KØwÓªÂìni–ŠØ±
¨wŠlNþj sßÑ8v<o¸ÞâÖ²ãU8^ë|Wš +ÆúÁÿ%ž†ëÿ öÿÿsK¨«»³#ÔÕ ûÿ endobj -874 0 obj << +879 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1915 0 R +/Encoding 1921 0 R /FirstChar 2 /LastChar 151 -/Widths 1924 0 R -/BaseFont /EENKPJ+URWPalladioL-Ital -/FontDescriptor 872 0 R +/Widths 1930 0 R +/BaseFont /HVVXSU+URWPalladioL-Ital +/FontDescriptor 877 0 R >> endobj -872 0 obj << +877 0 obj << /Ascent 722 /CapHeight 693 /Descent -261 -/FontName /EENKPJ+URWPalladioL-Ital +/FontName /HVVXSU+URWPalladioL-Ital /ItalicAngle -9.5 /StemV 78 /XHeight 482 /FontBBox [-170 -305 1010 941] /Flags 4 /CharSet (/fi/fl/parenleft/parenright/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/a/b/c/d/e/f/g/h/i/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/emdash) -/FontFile 873 0 R +/FontFile 878 0 R >> endobj -1924 0 obj +1930 0 obj [528 545 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 333 333 0 0 250 333 250 296 500 500 500 500 500 500 500 500 500 500 250 0 0 0 0 0 0 722 611 667 778 611 556 722 778 333 0 667 556 944 778 778 611 778 667 556 611 778 722 944 722 667 667 0 0 0 0 0 0 444 463 407 500 389 278 500 500 278 0 444 278 778 556 444 500 463 389 389 333 556 500 722 500 500 444 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1000 ] endobj -857 0 obj << +862 0 obj << /Length1 1612 -/Length2 18467 +/Length2 18760 /Length3 532 -/Length 19384 -/Filter /FlateDecode ->> -stream -xÚ¬´cx¦ÝÖ%Û¬ø +¶mÛöÛFŶTl;Û¶UÛÉ©wïîþúڧϟ>ßûºî51æ˜s̵ȉUè„Líâöv.tLôŒÜ -Î#óãJB'‹'EÂ2^È Óùú3p’é±m‡–^ù;Ðëw¨ë ÜìB0à’»¢€ÌFÈVóçC'EÅ]Ë“&Km,wy*qLm±ãÛÈøÒtv8o _ V´~hç+2œn£ Ýáxþó‰¿Ó¤õ›Î¸õË0¸’¨9\ oW&ÎçxL#¼#‘Rd´«%1î‚øå|q‘?iÔl7Ú28ó±óðIpãYÑí aFR»_$ç³¢d’_J þ껊¤ª›zÊ+Ñ#j»i - >„*ÝÓçuÈö0Îft𤆠1%z†SdÑwÒ½9êçkV’™Ú
ÇÈ)¢£Ý™¬‡¸yœû¯O.óÝj«Ä˜¾”À/Zín)£1T§Iü.Kx‘mŒÐÕÔå^
Í©L$xÜ…æ¬++túÍX†Ô339L(æ¢ñ*hZWâÈÁ·T+~›_æQŸãt©WtôÚ¶Çѵ< Ñ »fùÜd!Ä[ÉW™¹m0ìÊz}̰ʥ᫽ªÑdÕ°–˜<’¶8æ{ñP×"¦Þ&žNOØ*ÐcŽ;54µ]óyÈ;ëÍi^Z‹ž+jhî z'æM|h¯Ñ23òÔןû><é>.à «Êðàq²ô½}•¶McœØd"#’}!.” öýì?Dåõ÷œÙ9VÐܳ#§•¶ö>VÕ_÷GpÁE j‚±pP(Ê{t3óç~_FqUÕEv¶3/ ç ¤xû˜žf5gKï ”ð]Ü+]õSLð â )ý¸GV‚ûÜW´NÇ—%_{Ó…™ž}§¿¬öÞE±m™Iƒ²z)eÜŸ@‚”]cHj-«ˆÚxýÑ GhønàÏÿJÐÓ´®ã}bB=<ÿPᥫÔèÉñ²²c}Ξ@ïý›¸ºyì·¬@Òw -ÆK´¾9¬m–Ʀì;MÏÙoÎȳ†¼E„DåFt ÙnÞqW]+ÔÀ;žÚ¹Ä0fÙWÐ"NLJï¡qžÃøÜæ)jªeRC·¾ž«{ÌÎO?I—å°’Z_žBHqƒW剈çz.ó^äÓÏJó„¿ËnÌü24-çý
ά gìyÓèìeÌ|èÁ/ñ‹q{³.~È:_K‡(4qïtb _¾÷ D†;ßN(™ÂÒÞ_•p¬×´úTÔbÈm}(M¤ Â&@ ÁÁÌ¿ýê¤99Ùnwü“LôyØv7Àß™Ÿ½õ"»7\ œ= p¥ldöŠ’v@¸Y¿€.iŒ§vaP_ëèÕYè&lÀ^Ä_„¹~¡£0Z‡wÅôí’)'¥“ºã -üºŸŸÏ›‚Wõ<d=àraéÞU½J†î é<W*|CJc‹ÒvèaùÏԂݱ¤3ñ 6¯`}îÁÛJ˜Ôü9{%·Ño“Ø¡7g -•:D?IéðBÉì/$/hm5…ÜëüŸßÁÞ¿,‹{¡Àˆ’ - -Íõø ; ›WV>{€º^O -
œ
ɲ +ÕÚ åÏY÷V¿*r†úíÆÐ-w-XF¢¬p&wŸX„ -_Ó#>R+r¥*³DilDÐqo]• †œÁ‰y¦S ʈÑni³ ë—ð{s®Ü4ÑÍôÁ¹¼ôLG¿¯á÷¯ÄiÔBØ¨Ô -ò¡krNÚ -åa‹êÛÉýÓŸ´ý-ç_vJ/ .:óQ9D¦š¢~ cܸÁU•&ŒÅsm -½%}‘>@:ÐaZýði”ó¨ÖUɬµñ ŠæRLje¡ònAÝhI
ÆB -¥ö¦Üà‚ÿEÆ ÌQŒU\€|e‚roàÈböôa‹@J©$,a óK+£,¿Ð -_<YpD[¦bè)Ý÷A±¢YNb .Þ¬±µ”29pŸ·Ñù0¦œUŒbeA Ú@k¡âÈñL:·YÂ5µåÖUñ£=ER÷”oiæUìÚ“Æ™ ÌU [î¥ ê'5TxJFŽû[èO¨“CWU0'‰¼Ä k8æÐî2ècŽõ
¦ž2}¨q*Ôc.p ÊϾ7Št S~Mac^í¿ èeéJá?v ]›± wtY`~õ¦„ˆr,
¨<P«¬ ¶ò.Xaœç`Ž# Xæ¯ ÆlPWMcÎEÈr6p,¨ ³“gg
µl‚N0êT8ï–{Ëô˜ÍmwÆ‚ÜòbɇF%¿»mÝ.n .Óg+O£Þ‡º¹¥võ½^K¶Á§ñþj1-–±óM J‚³¯yd¢Jƒ÷ÝÈ8¨Õ Éw#¬ï`w%º¤ \©ïÆŽ8?y܃¤Ÿ'Tì E¶g6»-QƒÚ7@yŸpc¨¶@ÏÙáÊ'ò°™Ô» :iWýÞô^^ ©ÌP:Ùʉ4GÂCe*Z£:?ß*íÑŠS,`ï¹&~=QáAn£¾l3`0]‘iþ9ö[ÿD&¹R–ˆ%êa9G m€¡ÆcÅdr¾ô*𑘮Ċ[ℳ“ra± -ð?% ÷’BÏÛ›Ù‡¦_ ¡,Ðqv]Y4Ôýay½’¬”¸=ŠÖM’œïa¬ZÇb~ÆA¬/$OXݯ€°I,Ø!kÀ~Y2Ó &!sÐö~#5*³3€»ßÉ AôÀà2ÀF•íß-2äà÷ Æg‹¬¿J7£rèÄ’ìæÚSÓ& 6ý`âûJà‹1ÈbBZ u2zýÈp¤ì8ÌÁ
ºQ1Éþ0ˆáÛ½WlÄþ‰¯L7Ä‹âOT触ôœWï#¦q 'oô²`Jó]+R€Q¢ ˆ|t“¼fáçYŠQQ>Ì®*?ìRîÆ~"~öaÚè¥óÆ”HãÌ&ÝÖÊGºd,ìPz®Hx=»¼G9ɹo{`Ó[?‰ôXãZMÙÔñÞ¨ûdÓvÛÌ •ß/О±.%ûäמ~—Å43Ñ_êWhÄ[)Å/îš[!·yÓ¢Ù^i£û%óEåêË—‰ïpÛK„þ~rŽ<3°õE˜ }eâ4“ôm§>›hEaŽÎˆYÈBË'²Ë7;ÐpHÁŠÖ;o$lN„ùæ茔–Ô~ -Æ㜾µ¯õŒÇdgñâ— èõ¾ÄšFŠ¡X½aN¿Ð1•f`q¡¢ 9ßcEF슚Â7õ ¼é¨Í€j†C“›ƒH» ãÄumŒJkÞƒhþðK´Se^ðÝ+¡–Ž¶÷'aïqog&„ÕÄ»py ÿ"Ž—w‰¶ƒpP—ÛlMÆØNÝû÷(ål [‘fmîñR~àû®!!%¡ÂMêL²9³Ð/—‘ôÙ«% -m¢üß«†™¢EÖM@ùXž,µ¾v…Ë;•,ÿFm|ûÅÑ+°ÜT´æUû~Ñ_±îç4ýY§v‘u1e2q¢bè•ÒY¹ç ½9 ®OÁ‹„-›Éšª®YÑ\éI#mFIÑ™-gE¬‡ôn>~6ß6ft7#IhÉWVî#á’ç[øó9RÅÊR¡Bò¢Â§©ûRü¡ü|uâ`îú‰nqÜ¥hÂÅ -[#ÚÊféÜÿVùA•àPÜÅ»íD{SÏƤÊÆ w‘눃¡¥91óEøI=ðU9_.‡H¿,êÿ!ñ+×êëB,츼©^$ƒ¸´ŸqØB$pAIÜvżj«‘ç|©ˆJ]ÂËs™êáP Á/Þ P?}¶'uhW¡k1šK U÷€ºyIeÃ׸,gÖ“ü ¶Ÿ¢ Ö”B¨ SˆgŦß*öuÑïwTõw)•Ì_‚úªÓÔÉ3øè•0PY^·»ô’²ÒŸ€Ôsù1ï/ó²=] ßëÀOá‡DûÁ⼑ [¨åáºêÐãYGOä¤Ï‡Š¨ ? =EôÅ6K›('36V:̆M”ܲ|%äÁ¶åæõ
½ÙtaÏ$w›Ø±‚ŒÕ¹Ö?tB‘ÖB—Õ˜‚ÍI&«O¤ -!)KáÊ…jþɶ‘ܸ$`Z=ÛV(µ: k}BŒ ¬Éßè.ùÎE‚F˜x›éˆ,7JÚ`*µß¹–Ýçðd¡’^…œtÒ†©H›$c‚ÃõPìàÎÚʆ¢wÉÔqe·؃ž®ÂØ,ô£/ÝñŒ>p§¨o!tûœ’Ñ…P.Ióf;§W䛧 -éÊÆF@´ùbôìL¯Æ8üB„$³)ßUȦëŠ×1ÒቹeeÕí6FÊ”#ñ ]vê$âãÝ;%ÖKu¡‡Ÿû?`„ivÈp–ŸJÙTá‡ð~Váêä·Æd.Vç~Ì9( ì8 -ÁÎ n¦¸øãßÎ×Ê)¶xõ2÷%3gÜÿ´\U.²Ð^xWG)×¼ÅÛÝ—b%HŽ íU×ýÊr^ÉÈ¿>ziˆú¢‹'e¯ÿzTÈS>±âv»¾fn2†ß~A]ß -/¾ëÃw6¥%±ì¤³H¬c¨O4# ›Ïõ¬ÝA“ÂáùÝ|c–¼›¬öÝÿ{ö~,É8k4&QœÐQ0V,ë¯ ÿ#Ú`nDôþ粧ÎáZ0Yu¿»Á]ŸÕº´«7OLaÿŒ®í½PÊ3*+¨¢ÁjeÛƾê&gzaS?Š±ºàVm”äšÔîc¦WkÜÀÍÀŠ(ÈÙŽ»È^ÉyCi‡Å]²D*t<‹'6MñïÍu, *ð§™åèoÜžÃH?,j·-o`1=R¿ àˆ š<qQu¶ÅžÊŸ¦RË è¾saOÑêåœ_ÚçæM¢XOÚ+ðAŽ>îC=_ûõ& ”ByÝçË><óµUùät›‘„¨) ûéÖ…þÂIÒ٣ꈒÌí[§ -®,£“ç—i ø"Õš€xv^P«+M›ê~I eùÔ–S˜1‹w¼/ù¬á <é?ç̃âyû! Å¥žZ‘8žï3ŒìôP½»Û‘†ßĸA™ùSUÊz0 6µR -#¡ÂF¸õ ³1=ÈJçfTnh!@?¹ å#ü×KÅ4XÆ©˜’%`o+Àz› -—¦é[ž8ö»gºE©s1Ѽ îC ´†nË$yCØy¼Þª¼¢ò㛉ÖröWmØ ©wÑ”œLm
¯'¸ß4Èìjø¤œŽ©~íì Dã,Q›’Îci=ø³"£lÙÛ'˸9Êê -Çf¡— Rªeß:ãƒG†ñí -=0‡Ç/ÿŒ‘´‘ ùµÕn´?ye8`kõõm‹4Q í¹ÖièÜ&ZèjÖ– -•äJBžO+ÚƒÄ òÎ"«g®ÄõS?39’°Tvd(Ôõ·Ug(ÂÜ5¬$Éî°÷^ö/€Õ™DГüì³—µ²‚1î ˜à äa.ð•Ïá\à?˜¶þغ¾~
î±ËA[ù{ÍL*-0§‚(Êr¤àñá’ô’Ù[—óÈe÷€¤u£ré]•N¥›ÍW±F‚KÇè4Ì–Ùç?$“v³;-kÞkâXc Ù=H“añÌ‹†s’6i5ß©ÿM
ïü&º—X -ES…|Î •\À³«0Iª´ªY;o‡ò¸]»t«½a¢?esûºŠ7týgZTE¨REýóc -CíOónrªË€„…ƒ}ô¹6¾@ ??‘¶”xMõTµÇþ ¥õê6“$Ì[(ûfé^õQÍ¢£¿—êsyOúmù…MÆX7ô¶eø½Ž -aƒâOӘܡïÐPG¶¨¸Š{õâÏ-ú÷T6ì`#lì}X …šu'Ä·]ŒÐWПºR„[,6yªj¤wð„Ü·S»â¢H¾Vë<zrìmæÙ¾@Ä4Îœ®ñ[í¿=±÷xärö|á·¸t¨ !7O× i
Z¹‡7‚ÚWr9>D.Æ,˧‹X™öÍpŒ‹âäýˆÓ‰É‚þ>LÈÌ)v…ÁÂ2dÖQ‚6ø®ý´¡‰K>Ðñ’«=5Ìw‚H^[ô7Qáá[ò-@^ŸF°/¤ß ¶?27,Ïm]L5ì3j¦{Þ&Jì. ÕÁ ínfÓî S¸&Q=“ -¦*âA3Ÿû<Ü@Ðe “Gp± ¢/æÍŸ -?§‡èBya̘¿ÅOä(h.`è×åÖg¤ Íü¹¡°‚Ú9#!ê -D$ÏÑ#=…Ꭼ›}Qb'Ž5 |,wÞ¸iS( ñR&ñn°úpšQÙq- ШFvf(¶Øj—R·é@ –¸sëì)”8‡Ã³&ŸÑ;ù¶vŽb¶'Ï[3=oýkX=*ÍÁ·#ªï)ts fÚ¶n“N•ySȪI—gÞ¿A®¢÷Âúj¢¹:„¶ûÇHè&s–·Ð8ßÛþAX~:U{K¢Ý˜ù½ 4óNÁUé0ÉÙÓtA-‰]ñ<:19¡§ýàñ¥æö3^ Ö/_‹HA…®‡ØþaÇŸÙ6Ôš4$ªzÉó0ãô%×þž÷XlI2mex‰SÑaiÞp>ªxmkí–àvÖ”Õð<…bLï NÕ -Ã:nBXM ëž?QQÌàóGën 1Võp¾*Ë»sÉè¶qÏpeÎÃH_ ¿yu8\ä.~ƒ2ÁÉÛã#áæOå Ïoß¼·ÓnJ‚ít ”ƒát–%ô}H:S¼ÙÀ?£U:¼î˜+qÛyÀ5ͼ·h!vm RáKŸò2Þo
ÈïqÙÁ‡Ápe-ÄUÂõÜ<œ)J^T¹lŒi…xöpéù…(V"7 -I+RPÞµ1pï’›jÕZdw|^z Ïi)—›Õ‘Á…§t— Ë:RÖñ{w}HÙòп -Œ´ OÑ!Àq´ïÑ ¼²‘j JпAAºçôgÃìd‰Æ0è^J#¸©÷YAª×°îTó¢ˆ +Ý Í̶EÕK]K#ûEÅu¦‰CB4Ž?žb -i"9u2’V"múN ‰aõCr*\O…¼€Ÿc
B&ïEö°}Ê¢4]û$“Íœ¬ìùë$&/é’¹¯Ô 2 ؤ œ„Ñ»ÿcQ÷s'õƒÞÀ;dwܳíØ0“9Ól°/›ìÞ‚’ñ‘eë#ÙÊ⬼þ œLÁ*ºµ}|ƒ¯]wDq5UJNÑP§ËŸÖgˆÜõTx¿&ÓákAcFκD§õ삃G
ŠxrnºWM‘üè€(Cù^Q]a{IPžËA‰>ÒNöÏç$á¢]uÅ@ï0ï;Oÿ U-m -OÁª>+7JN,¶³-¼1ÃݘÅâ׋qrÃ2Ñ7…ÓïXòaa ×ÃB·>ã\wC‰eÇóNw;™¤×d
H[Sy2N³‚vßzÙ7ë“Ý%\›;[ÕM >ѦâÎßÍá¡c'…,jx³Šõž|¯ J,š˜ ~œtç¿Úá:ƒ“;0çÃ¥ìŠ+;O@— íZ€]ÝÇYQÏ šCúw —´ÍMñ2 -!èDU]IN‰ž<ÚhDž˜t‡±‰h¢ -â
¾ùÿIý½ª¼v.aÌ7@Ýñë[$¾™Häž"p—Å…RÂv`Êc§Û`¦¾lITöcíûËn0[ÌJõôž†½;øKâÆýîMëcö~ˆþKü§;m£ÏÕÊ–Wb1¯—NxÚ«îtzc±-ŸyN7k©uQœ±Ó&†ëMÍ"ãEu±Ûù¨ÂpÛQÁJ’õ‹ _ãµj&ô%A†
RhƱ?ò)û#9ZžõÝ‹®Áµ‹mb ¨hº=¯´<ZpŽÝGÒ[?ž"ëò‚er‰as¦)Õ0w´w»WÖ.EÄJÊ9Š#6 °9üxÁ¡‚ ó<B-AIuÍê¦uʮхçŠØ™zvtJkÉÑÓîãDQøúçnéêÜ|²Øü’ÂK X× Ö°žPv žŽaªu`ÅÔtpñ7œÄàeKJ×¹ýöqŒ¬g #lÎO…ß-–VÀ½î§Œ\ƒ¤»$^©}–!¾'5–Þ4$K¹Ãû.Êq¸E ã`Ô -q2=¨YÓ$£2 -¨¿)Þ-ò ×8ú¾ÂZ0yëýš3óBÉzó‡zèíТìkÌldµµxi1bIDÔƒ
VþŒ7CŒ?LÎkp‰Ã ãS¾NŒ0Ì´fiäz³ÄäJ‹—ƒ×ƒø¨m Û¾°^Òë7Ô !¡% Dºâs“k2F$ -tAؤ Æ1Í«åY`Êö¡9Q¶$çÐŒ%@ùÿÐ>”Nê’àl -1¡»¦Ç%®÷Þu–T{’zð…D#8®9Ç£Ú¿vR"éº<•|îlƒ¤MÉwV`Gªªõ[‰v½I’¯l -I5Ø‘ý¾s]# ¦¹ e¡¸ßÐNtÖ02àvÍîPá÷—¤û@°÷¨qn]”ê·_úÝôéœ_J`rŠµï0§›Š²áÃkBÌh V|·ÐexRiÆ4ñ®Ò»ûiAdÿ-¦ž”Ë®'ÀEñ¾Ì 'í%8l -ªå´$ ´¥ØSê¾:Ž ™ âí"óY’xñ!#º°¨!7OyØ2ù@"iPEP,ÃJèéªòÅÎW•¹‹Û—ظx±©È˜ÄsUÇU¨œ´Bω¬â¦H🔙 †SÕ‡·<”]ÅX~‚ ”/Ãiõ¶¦‰RÖçéßÒ!®E.ä/dï;K¶‹ÃR¬ -J¨–/–]&áÄdã-˜]µµü ìªò¬_A®Bùyæ¹ÞÛ#sÊɤ”CÑzHóý˜Ÿ*¤KBMØ4Rî
èáç
s -Õ-ÃMÅ[!‹°cr7 ŠsÑoU¸ù¦òíóâíý¦V|ªâzË‚ ‰úzÓs Ogy¤V) -A†Ê™ÏvVgå7Y”Ž
$¨×Ý\t+o.G^_Ëçï© hÔµ°ÇŒÅ¼Ó/°’³ÔjüÇl6Œxƒ’9Æ<Œ^F8uΆ×?†xu$FôÐ3¥‚ö7`Ì‚÷tèz¿Ò¼! *7zç@àzsùPW`"½¹æ"Q» ´œNtXêAý,ï}NÐ|^“«Û³‚x5‹ôM“TyâqBj{{ÃÝBO2)Q#ÏŸÏí ¥–¡gÛÕŒo‘ Ìž6“µ–œs@D'h]¿Ó¼±.Jkë,G3ÖÄ憙*XîRáHÚ»Øì|Ó™©¥ÉÏ茇èXGÐ*„æ -÷D¼§~‡¹(‘ŽctD›?Æ´"ß$r˜Þ[ñÈšûų5ÉýûÁ/Ôžb»as."Ñ>Aé´X~4`Z[B |¤{eô-|óéòþã.bP…›5½áê >nŠ‘œÉ§â† ¢™21‘*S½¶¬'.:F‚Æ2ïôk>®u‹"4cÁYû¤cnT¥4þÑ°Ô=﹌€ºÉ
ÓípòÁ,ÉãÖ:ƒ/¿þ‚[ ©Àßr‡âg/¡óÁLC9í}ú®¼žÿ¯9¹dHú¼:ÍFÜüÝ f…-Ù[ýR û_oÝÕ ÎMŠ"RƃHí!Ý^`|£} þP;¼š&þt1c,oäÑâj>—÷·{_56Éï.CœÝ¸ôÉ«yIœŠØÓðö™;¯$Ù¬1øGh÷¿ß - ¥æ†×²?¡*!%`†¾sÝ+h>Á»Â;Ü·˜yl.¼j4ä*²”cQÃët‘>üàë°CÕ,jȻХ²ù1Î\¿³àh À¦OA·âè6!în#{T´¹Úûç‚àêáA~c{9Û3Cdœƒ ñ-£VM¹šÀc#t:ŽîÀü›Ó•_˜çod¬ÁØ/OÉõm J>á–Ðϑ狧$Y¾¤†0èD„
þI Õ{c‰öò˜À¸‹ïV&2}‰*T1À‚G!$¤ª’Þ5 %Ø+<É ÞÁ~ 1°•Ój8ž¬‚UK£{¦»ØÅNd-5½=r¢W$A Np…$5i™ºgöàŒûi¿PÁZA¤ÜÆÌhó† ìéà s Æ«âÖ~–^Zhh\.…K¼ ¡¢²Ð ŸpÌ» Ž¼ŽÙ5 MYóÞU-atÙ«Œ–xªñôu‚ ~o`¹lWŸ Éïµ@Í\Öbž»]™¥/RÛãàëW0Ÿ@ü¦izgžxñÀ.⧧.%T^¬”9Nÿ ;Æã—½ö 5awÔ)üÝöõïÕ£-I&ß ¥±'y…—žÀXß"žÚ7oô*ŒD:`Ø\:m·K±jþ0›`æ¶ÐÏ4¬”*xýÔWÁŠ`ßbÂ6aÊzÓ:Uç?fû"Ôôý‘GÙÐrÔ öŒ²ž£²èô £ðAŽPW‡6\Èœ7
•±øä´äÝž:ìãÄ -õ¹‚t#PcßÕÑ/&Ø™ -k0͆‰àEP«t¯'øß!q‚Ù½Zó ÷ó¬AP¿a0qt.z„×,S¨æ| «–ÐhóTŠµhÏs°ÓÐÉ–»n€hvÅл:N^”4Ôù &ºÊËXE š´Ù6ý?íÖ÷?ŽãÀqgeœ-+3. IV2“âDÊJÆÙ{&¡³ÎÈΈKVæ™Ý g :;ªwgwgœ£8ã}öù|ÿ‡ïoŸÇçõ<~=n¼ Ú¡`(?®ÉLÕ³Ÿ¡þôR‚Ív#®ÚŽ¶m~Aö´§ ¬ð2ĬÏ`“\nCØÔò óæKÙZ ~:§pñæç•Ñj2~Ò¢–tUˆs°‡²Ô’Ô*/.éÃéXÓyb¶©¢d‚éý¦*´ Š9íJÿ$«F`™GÇ—ÒžX°©ÊCÛßß -ç.pÒ%o~Í-¤6L-LŒ}
Bv£ "Í°íÓ]`Õim"¿Y…éÉQÚB>Öž÷cÔ£z> (]<E6ÿd 껾 Ct™–ÈŒ¸_
R‘hdC§ ¹0´ÔCþï‹™\Rr,ò?u'Äc$„R$ò‚Œc+•ê¬¯*tòLiod »Žº -^•ÉÓÌˬ6`¸½G¯;¸ÖâJ ðN¢yÂûOÔˆôïþÛ¨:”²É±Ýͽì4áÈd¾}sNKÑ&}ù&‹° ’š¯ˆ·Y:PÏ•Õ45™Í²]ˆï×ÕøÝñ¼ -ÐÁ]Ý @?H[ª~T|ü[\._¯Äû†‡Ûm«~â¿Î&]“=æÉ?”b‘Y}…ö†®²žb&_˜Uá¹#Q\´3|°/›øè3—3:@÷×D„} ‰n7U)4žu¾_Ù×)Ó¡;ÃÊg”‹îÝ{ÁåôÑáÛ‹`ñ’\+ÕHïì] -ËdQ WþðãéH… —îc‚·¶Þ‚©Û’ £RÄ’bݬ†G’+lIáCªw¼,Í*¬¹EÈþ YÑ•¬Ñ‘Àº%ÁH‡½@[˜ -–Á -ŠßÛf_ÿÞÛ -7{–4 pÎušóÌ(Ãq"»Ý:56©"KÑ^_Á” Ùw#çãHJ~1g <ujÆ׺ݨ‹¯ñYùÖn;“[ØŽîXo¼?A¸5IÍ-╯#¤”µü -pÆU¢ûß· à2b¯½V¹•‹ôk -KÒ§yçÙW9ô/˜µGB„Ý À¶ºSsâ'⃥—GWýè¤Ø@ níVM£YQ|¸óØ` ”~x·¦äe·=éšJàľ¿ çò£‹²6“a~5¡FËŸo=q9¨tÿÉ-äš —ErÆÅŒ½ ](©DM<6FZHf]Á«·ÑÈ?ÕG[>gùhH¬t͈Àd…>cÍ}una=ôp]Ë‘|Ý-ÿšÅQERv›0výšGñs€Ýi ,¬v®dR¾—“UÊ(af ¦Û´¼9&M¬@mšäK 4G:Š¨'ÿ(Ž|ªŸÓ34TDŸ`umÊ¡;>ÀªáÓ ï¶ì¿Á×jÃzþ´õîÜî‰kæ%] «Èó×rL¡°þ¦Võ®ÅÜý®Åºßý>7Gm*þLÈ•UüàÙkö†öM#Kfró–²ÊÔRŽ,˜
OÝöþ izD}uÜ>©êûâarê(v¯ €ÏSi¹á®NEƒÏ#k–ûnÆw—’Ûí¿wè®]öÝÎÒ -ØfòC9’¨þ1â°'Å:Ü$–oK òs×ðlÀ[ŸÔy>ÖÚĪÏBÜŽ À,ÿkOù]d´I $"kõ4ïþûþ¶ÕÞ¢„´~¸|`ãÂC_iMTã[rLölÒ½ «_X] ʦy=Ò˜úÖv–6þôO‡ÛžXÌÐú°D´e¢=YêMÅHºEr'ó MˆÎ‹vYÊ$ÿdƒîvQ€¿!4X¢¤Ó2(uJíÆj)Â7îY m¦ÎÔ.µ«ZÄ ×Ĺ'd*oøö²™êLi+îÜú™9àS ¯ -Muà™C} -Ó 6+Ø[É> Þ]¨W:£{C˜µ « x<Ä5w=¿ÕZLL‘1Ž,6ÑI½Þ šMxã…Û”«fÆ~¸ÚUÍÓcˆÚP]S\ÜènëGñö_j Ýpu+,Ûî’±ÊÞdŠ ûüÕQŒà¨±—:àGyäç÷Bº9èÉÜ‘Oµ hªày߉zwL”ªÈ +/Length 19672 +/Filter /FlateDecode +>> +stream +xÚ¬·ctåßÖ&›£’ Û¶mWœT²cÛ¶m§bÛ¶]±*¶[ÿsºûíqnß/}ß{Œßšxæ3ç3×c“)ªÐ ÛþŠÛÚ8Ñ1Ñ3räÍ:;ÊÙÚÈÒ)Mlpdd"@C's[QC' 7@h ˜™L\\\pd +ŠšRò +üªm{|ÓÂv¸* Þk‚駹?ÛÜ—Ní>ö¥©F{1(zR€—ùøÞ$T}¨›ä 4 z%ˆégQžW‹²ÛZìŒê»“JÊzÅïPߧ;X `®ž¨üH\ +üÐI í|ŒRëc1:QA¾Õžž‘' ?=R Ž õÜ@öíãÑäÄÂ’ñ¸@ ’GúÙçà h©Ux†SA¥7!àÝ´_}jt{êå‘‘â’FX˾*šæ¯Ù´Ë¾'A¦· ð&Ê9H¶îWþÀ¼žŸŽäJœæšËýZw&sÄâmŸ +쿵$
œÉ„®'~ +j8+¼="HOló‰à|V”LôIŽÅ_y·1A‘T5dSoEy%|Dm3N†Á‡P¥{ú¼ÞÆÙˆ +šÔ0ã#¢DËFwˆ(¤ ÙÓ§~¾f%ž©Y·˜"<Ø™Él¶‹Ç¹ÿúä2Ý©²HˆîKöÿ¢Õê’2|Cu˜Äï4‡Ùb +dÇ$[ß4˜h3iï*#§†]Y·6_¡$l¥—\5Š´ +Ö ƒGÒgÏt7êz \ÄØSÂèÑÝá Kz¬Å~»šF£¦s>y{)ÕCóaÑýû²Ú7× Ý#ÓF¾o¯Q2v3äòÔן¼xÒ¾#x9s¬(ÃÇÊÒ÷öUX7Žqb‘ŠŒHö;QºÙö³ˆÊëí:²5p,sÍŠ˜VÚÜýXQý3j .jW ô…¼¬[Ç2#oîä2’«²6¢£yé0O ÙÓËø8³)Kz¡l„ïzä^骟|‚gOH)à Y îó¸¢e¾,Ùê›Ì,ðŒ‚þ²Êsźy&Ê⥄ñϤì*“@bKiyäúk@W Á»¾/ÿë÷îÆ5
Ï##êáù@¹‡ŽRƒ;ÇË6ÈV|¶å9{<)¼ç QU+ó؉¬@"9ãå·¾9Ì-–†Æ¬» î³ØŽÈ³¼… „e†t Y.ž±áWËÔÀ;žš¹„PfÙWÐBNûŠX÷a|nÓd5ÕR©¡Ûo÷¿]fǧ_$¿å0[^ž‚IpƒVzrEÄsÜó^Á¤ÑÏJó„½Ë®Ïô—qŠž€3«Çþt¿ipôøɼïÆ/ÑøµÑ7d™§©M’°{<1†/ß{€"Ãg'”Dnnë«J0 VkÜ„},j6ä²6”ª ’ nå'Ž`gâ[ö +õ Ò””d³3þˆA*ú<ì;»ãçëȈÏÞr‘U¦Îžƒ ¸R64yEIÝ#ب[@“4ÂS»Ð¯«±÷è(pÖg/ä/ÄX»ÐÖ@Å»b¾äcŠÅIî n¿¿„îçç3Ã"çU=^ó»\XºwV¯”¡ûB:Ï‘ +[—ÒØ$ ´ zEø}:µ`s(éHô‚Å+X—³÷¶ *5Â^ÁmøÆÊ$¶ïÉéGH +>êò:Û†ç-àñwN‰ +3“7º]Ç }"}xt¿-i7Ÿè¹½‚• +üƉ¾ÏÑüІž@S&_#‰= ]Œ% e šPŠ†¼RŽ”oQÈJt{¸œñàº0ê8&ò½ A"zXXª‰„^i$º@ õÁh0škm}…“u@îK/²OÊ\®zOóu#«"ùÈR.¯AÇ„ŠòÙôÐJ ©4I°muþ`*?섨0V2 +p‡÷/ó¢nD(0ÂD +[Õ%:P+t¦*5Gi l@ÐvmY‘ ‚œÁ‰~¦S JÖjn5£ë—ðys¬Ø0ÒÉð¹¼tOC»¯‰æ÷™ÄiÐDX¯Ð +Ù¿®;ªôŠD™r]9@èšÌˆ“ÖS|æ[Û,
('|f¤~}Ã!Ónëw¦©®n”Š\8ÖgK½Uz:'=*"Ô›%F WHO´Ú³ÒèÒõÖDÐ_|ÌÎ\ê\Û +qá‚ú a¾ýGŸºî“ •e +™âîÑ~)Ü“U‚™$¹ß“ñA=‡C“ü‘:³œW•Pv Æû§hbÖ¼ð»AàlmoÎUÁùË7…¹í \~3È +ÂÏå±äÑs‰TNŸ +Ã<ˆ•9O¶¥fÈ ËDˆF§‹ÑÉöYï ªƒl›¸·°6¿33ïáð\1 ôb° a÷ Á{ó|³m«é*Ê›}½"é?Yš,µÔ¹‹ e§úPh‹ŽŸXEô¸º\©çÜ[ëgøV3C^à ±çSø¥$š ƒÛáÃ:“É»®’´ ð¾ˆïÅ^ƒÑÁ´‹¶ù´ë¬†)à!jáìKøGR~ŽCkCœùŒBΔí!$ÐdÕˆV`¨\ ©n¿»Gó§æHðnê Úïvœ&ëÌŠ":—íÞÕ^"Æ;bÊz³N¾0UÅÕ–ûÖ1ÃÁ,Ծ㢫|7ßoV};º:Mý³éØc£ôÂà¤= ™MhüCÔgaì‘7¨²Âˆ±b®5_¡·¸/ H:L«
>r>Õ²"™y£6 o„Aù±RQ ¼“_;N\¾L©µá%7¸àÀ‘¾g$µc [ž Ü 80›=~Øü.¥T ¿†ñ¥™^šW`/ž$8¢%S>ô”æý XÞ$'ñ.ά¡¥„2Éÿoƒã;At«!Äò‚´žÖ&\Åžã™dn£˜kjÓ¥³< -YRç˜oiæUìÚÆ‘ ÌY Kî%?ê5TXrz¶ë[È/¨£=gU0‰Ü„€U ShW´1ûºzcw™>ÔXê1§†S\»²3Š‘ÎBaʉ@,ŒëÂ?/ßu3u¤ð ;…®MXÛ;Í0¾z“ƒE9–T ¨ÕÖ[x,ÐÏsô1Æ÷Ìó–Q£×©VNcÌ…ËrÖs,¨ ³“eeµ‚l€N0j—;î +??zÜ…¤Ÿ'PìE¶e6¹-Vƒú£ò>áÂPe†–½Í•Gèf5©{AuÔ¦JÑø^V¡ÌP +:Ù‰4GÌCe*Z:?ß"íÖŠS$`ë¾*~=QîFf†£¾d5 ?Užaú9v¢÷"“T!KÈ
õð;[ùÛ +ðþ¿$ vCÎÛš,Ù‡¦_ ¡ÌÐpvœY4Ô}ay =,”¸Ý +׌’ü ïa,ZÆ¢O>c!Ö’&,î—AØ$l‹ˆ4`¿Ì™é„G ‘9h{±I Kàôáî·3ÂF£Ýйô±Peûw +
8ø=ÇC¦ñÙ"ê®ÒL¨ì:0%»¸vÕ´HƒŒ?˜ø¾âù¢õ3™VF _?Òí)Û÷³qoTŒ²>ô£‚ùvî[±~á+Ó
ñ¢øøhÂ…ª>çV©Ã{‰iÜÁɾ,ÓPhF°1J4‘÷Ò.’×l"ü<KÑ*ÊûY•eûÊ]XODÏ^,@+Ý4 ‘‚èbiœüÙÄÛù§ô¥‘mJ÷e g§÷H9×-7,z3’ '‘nKÜ‹)«ZÞu¯,Ú.«9¡²ûÚ3Ö¥$¯Ü šc +9P “½¥Þ8€Fl‘…RÜ⎩r«'¶&ÍÖr+ v¤Ì•³7_¾‡ßm/!ÚûÑ9òÌÀæAVÔ•I°ÃL"ö„O]á²Â !³™¦WD§w<·¿
`Ÿœõ[ï ¼¡°)!䛽'2Rj:PCøÄfűbü]–¬L¡ÅpÝ·mñª}pÜf†Ë ÑSYá‚ë^0Ñx‘Ê·€ýÍEÛÝöEô7N‚)Õm ÑŒªæÀ á7Š•U÷ↇK›—ß²9¯É,‡…ŒŸX¨<™¡ÌÅ…cÆ"ûgÚùÏ=j³é b«*"ìëLZaì{oFðÂ{¹†âMAÆ ßQƒ(°Á0ÖkøcÇǦŽtDþ<`N%ìy0ÉB´¨þ•PPˆ?Ĭ‰…šåxùVày»—.Jª“ÈÌë/vg`ž0zðõà~¬ |ôiÄlT ªœXöA¥j–çW¸ӷôµœñø€l/^ôŠ^ÿ‘XÕH6«3d"Èî:¤úá_T`‚¨KÆ÷Xž ³¬¦€ À›†ÚÐt¨bØ×82ºÙ‹°Y +g–w¸Ò _ÍÑf4…,lÕF¯tçÜ äÊåšv…è0 ‚Z„•åIÝX®E˜w²b!ZhÙ”áÉTëkS¸¼SÉômз}P¼½ËiGýÖ´b
Â/ÚãzNÓŸylQ]*+ ºÞ"†V!™s¾Ð›Íáüô¸Hм‘ôCÕ93Š+-q¤Õ01=*ã±ù¬uŸ rÀeÂËÇ +{ÃbFg#‚˜–lyù>.i¾™?#E¬4*872lºGÝ›ü”òóÕƒ¹óšA úa§¢+lµh ›¹cÿ[ÅU‚·_Q'ï–íM Ç7&U6æØ‹ { tÍ 3_ŸÔ_óerˆ$q¿E½â>$zr,¾.ÄBËëDÒ‰ú@û‡ÍDü”ÄwPL+w1xàKDTjã_žKU÷‡Š¿÷ðN€úè±=©C; ]‹‰ØÑ\z©r¸úÕ~ÈK*¼Æf:² }䥳ý]°¤Bu›B<+2¦ø¥Ø×Iÿ§½²¿S©ôûü¨·zM<ƒïˆn1•ùu›Ó÷^Vú#:. æ?¿yÙž®ïµá§ðƒ£|`q^ Iš©åâ:kÓãZFMd§Í‡ˆ¨ > <…÷Å4I)'16TØ͆Nß°`‹ð` [€r óz‡ÅÜl8±§ ’¹Ll[@Æh_ëí; Hk¢ÉjLÁf'‘Ö%З&så@µTýb[Ojöß 0®šm-Z‡µ<"ÂVçwSp#H¸Í°ÿ,3L\g*±Ý¾–Ýçpg¡’^ uІªH%a€ÃuQlàÎZK‡B£vHÕqe·lAW`¬úÑ–îxüF ÁŽ¸“Õ7º¼Î IhB($y{³ ÓËòMSô~¥ã # Z|Ѻ6Æ×c >ÁB’Y”ï‚*¤ÓµEkèið„ûܲ²ê6ë#¥ÊxNÛµqqŠ® k%:ЂÃÏý 0{Â4Û¤8¿ŸJØTá‡ð~UâjçµDg,Vå|ÌÙ)îmÛ ÁÎ n$;ùâßÎWûË)6{ô2÷Å1§ßÿ2_Q.4ÓZxWG)ûqŠ·óGŠõ{RÜh¯ºÎW¦ãrzÞõÈÐKËDä]Üw¹Qöº¯G…\å# n—ë{aæÆŸð»Â¯U"¨k;`aEw}øŽ¦¢´Äæ tf µŒu &ßéæsÜk¶Qk¥pxNšnL’v’Ô(|)²FðcˆÇY£0c…‚Ø0cX{Ò}hƒ¸eÐúƒ KŸ:†ohÁhdYÔ}îw¼Vj ¾]½¹cû¦wní†PžQY@V)[7ôU5:Ò³û Ñ
+¢ðBîBZYø ¡QÚ÷¥Ä:_}ÒbeÚ*r³9ò”¯Ô¿åÏ{ݘéËáªÝ]1÷WšeÂ…5âo#”‰Nb… ¨ô>¶ïÓA Îì·¼žíÉzàá]M¸Q»„)ˆ'°&má"²‡8øg+Gž‹-¯ðJÁÙ¶(!‚d%šò÷F¨é’‹Íü0ÓK^žŒð §.Úf9Õºi"‚Bœ‘תÂh<MÆOOìu h9ž&ZO{èìxö6"÷rWN Õ6Ù$Çøâ0™…´žUîÇ>‚0æ£Þ·/Dž¿V™¹6j©Û̇‡o— +_0ß9ø™Ü®Á³@3&i ¯)BB D‚Òr8ª¯sÿ’¶þø¶6ù5EåÇÁ‡›3§ŸÒûišI©R«‹ª]S¯Ðeÿzý!KþãÑÑÛ7çÙ96@:áO´ˆE(Q`¡W¡ÐêgÉCIචœ7·@ªÁ×N~ðOÎÏL ÔšîÑ„6 t>æ€ñtFt &QòŒõk©ú¡Ì: ZBw˜0.•Ö +X˜DöBà矉uƒ Rá±êëŒãù³"‹‡»½øS, VëUgÈÓÑ×Hë‡
Ö•Ø®ôh3ßõ½@gYa°«¯ÃK}\)ÚÖ„èoô}7dÔ{Â+ ä’רþ‘ǟúiæpC 8[bk%u‘I0: ]¯úíŽI*]¬NꌕԲî<'âÌ€Dq¥1öYßþù4ˆù;4Ù´Ô˜¥^ðžöE›:ãZ”¢‡ÖãßhSÁÒ"”‘æeGq ¿¸ú‚Ò®ˆ÷ñ"‰v=}ç¾ÌÅ%ű;>RÕw´ºÊuú)DãPèñåVÂ-{
i¢87£rC ~zIu( a=/åÓ`éÇ +`JVæ€ÝM?Ë-*\šFì\q¬w÷4³Ç"Ây'LÜi
æI²úвTxÝCxEåÇ7#Í=䬯šÐ]ÏÂ)9™šj^wpŸiuØ•°I/9 c½šÙ;ˆ†YÂV%íÇ’:ðgEFÙÒ·O(–qS ”•=ŽM.A¥ó¾5Æ·ôŸ·¸PF×/ * ÝXåï·Dê,o ö°`ÐO„&ÄÓú1¢ç)ã”au§4‚x¦"ô£šVKnþ?af¿½ðÒâº-©Þ(äM×4jý€‘âª[ Âx06Ä–3± ÊbV®gG¬$¨ˆX”£þÙ]0ML]B@! !k“ö'9iH„%7ØdÇýý³ê«VÂiH€ð‹Lêõº «§ÜTÉMÓ´1=1TäöÅ¢ÕæûH&LÏ5« "ŒúÞ¶jªÏa1¾5e‘× ¯Š9³dfƒC|—fS}½Á¢ ^3²Ry€!©ìcÊ^Ù±•CyÞ>æäŸGY› µöLˆ²Í+ðüw…¯‰‡› ]E™†ÏIœº#½Á” “W¿ig/€¶0@hçnlÊäª5Áç®ýF6PI¥pKˆÈKUëqßoÁÎJôƒED=§É*óS½PlBø±a` +^ñ2Ý9á4GÌMdHä:a,h&y að;!Ù$õÖa Ö8|Z2ÃdÞ‹J‰Óc—…6‘Ñ}Äu"åÈÄ7)õ)ÚÞ”L#mõ0n—Ü^žÇl¡~c[øïz¡AèÖЕ–êÍ™qùÐEm)PF½÷¢x ŠÔ–ŒisØ€ç³D6
&œ<ÝÍYï’Úl¥ç¬œ s·ÚCò£ypKWFsš£jƒ“ÃÉs ÈÚË~ +¸š4?æ·q|CÇÂ[9ËÞnÑŽ¯U…”kCWvܾOøHB ÔfGpÊñ¦Ú™uw"£Û¬‘M+<ÂREÍœËâ`Ôщ) SßêÓk3—ÌŒÊy‰m:ãs‚êf“Bܲþà ĨÙþ†¨4ÃJ´§ ¹=µ¬l%Ž»Wa*ÂÎK6#º=\{œ˜{áÒBz[òaey}1i%œ1ˆpÊeDNi±`à6^¥ +“V-Á …ê©>Zw>î^’:ðëÖ£,AÎó=a¼PP?N}“8s3zxC4-áÙ'Ð@¢¯Äa0½ÌåŠ&vù& Ê«¹jÐ-OB;ó¹bîAl/äÝÈ»÷
#o«²#yÁ?.¶Üè© ®Ï² +sf"7íȘ'z½½Aܬù;˜-Ø„º5½ŸPoö’RnÃã—§cÄd>Õ‚ëmO évXš}Ý…["äC»Îµš Ú·ñfº ?jÊ…Šs$!ϧmAb÷yg‘Õ3–ã¾ú©Ÿ™ì‰YÊIÚÓjû[«Òaî ë—e·Ù{/ûÀjÂé‰õÙÊZXÀüì ˜à äa.ð–Ïæ\àß›¶üؼ¾~
ê¶Éþ¶ü5öZ š‘X’oJQ˜iOÎãÅ[=Z)é!³»&ç–ÃîIëBå\Ý;»"B7›§ c)Œ—†Þa%ó‡ŸTÚÅLn_´´i·‘c•udg/U†Å=7 +BÎA>ȨÅt»î„ÞñMt7¡Š:»ùœ=2>ï((Ÿ!{GÅo’8DiåGÍlœ
ÊãVÍÒUŒÖº‘jÜ”Õíë +ÞÐõ)δ¨ŠP=¥ŠúçÇ ºÚiÓNRŠÓ€„™m:ô¹¾@1??¡– ”x!MÕT•ÛŸAsË•-&I˜·ö@ãݪƒêE!F_Õç5²î´ÛT² «ô±.è-ó°{m”´YÐßžëÈ C&ÐöºoÕ¬ìêW5iø·Š ¹Ž–ðûï~dÏFœöN{uÍUg¿a`BFtCÙ¾VØ-¯Vâe *ï@ì @uòQµ
ä8L°4§2Ir©¶Ð“†¤o §¿Ù §¥ë ÁIÆtPÕ'ÆiÎâsëŽÉÇTЃF `Þ™0Úu5hJ»½
Ù‡,KíÜкÔP¡f|éO7§Hf|dÑr^kç
Žß¼¥'@>¢íð@‘…„—Ä”ÄÄJÄÞ¿Ý>3„Œµ¬èZˆ›Ù¡R^XÚ9ÈÍjÕy0”Nš¯s„gA‚îWˆ™[Uú £™2õÞzבl‡KØ6`ñ +î†Å×°æËùß'™+¹O?àªH‡q@… +…eȤ½øÛ ]Ûq};—¼¿ý%W[J¨÷¡¼–Þè aÁþ[Ò-@^ŸFðGH¿ ìÏÈÜ°<·eÕ@wô¨‰Îy«(‘«xd;{”«‰U¸otÁªDÕL +˜ªˆÍ|Îóp—aÜ^§9Lî÷‹¥¨`=1OþL +^ú”ãh@RÄfíÁ•6—U +×qóp&+yPå°1¦àÙÂ¥å Xˆ|¿ð$6Uç»’ÄŽ¸%¼ûm'v»!†æ^™íç Åä.°¥6q2Œ\õº«CÛ7E.ÄÔ—¨lwBÂæ8=÷_so09Fµtéf²ÅoÊRaáÜJýèb;†xŸ)ｫG œþW¤ÈùQw¤ØØV„K˜7µºy$•o5 MåÐà,=²æ_³4¥ñ3ž•÷°Ÿ +áB«¦¨Û$EZk°`ë¥Y
5qÁ[œù¥ëÂF… :ÁƒN„´®jîܨ€›JV[‘ + ü™±8Ébº¢¾9àѲœ&Â&9 h°¼§!`Z„ù“½M$¨'Ì é·Ç ˆ‰b| ö]·[EÍ\çtHL”.=MSeî{F"ä(ËfI Ü +ˆ4ƬÆx»ák&ªˆü• “KѡڪƎ5soõUKæU6Û‹m™³Ó<{WûFgsü2‘“+tëÑɇ¡ˆ§Ç—–Fë¹mù¨ö9¥ûŒí¬ ( Q«¿˜?©Fߧ$‹OÌr?ãZJŠM¿{m9ùœÄ1+É°‡!¨Ú‚§ ¨næòY:ŸAÈ‹Wv¿ ˜iq“~ˆRŠ +íqÃoØ8\"ÉÄø‰m~'8
£Éùª¤\"~Ķº…puX‚8R±·ù;¤‡,qÞ\;1´L AÈ›œ>lϴʘƒš¶ü¸\UÆækèK¬ôó(29÷ðJ3ôûõrï˜O²âåMçÑñBu” 蓼!þ*²‰ ñØx“–ãfðÔƒªáFb6ä([N£+þe÷#Ìó ,+CðÇUÓ3Mcf‘ÐAñn0Ja¸Þ.H”#ÓJ>U³ ÂåbFµîV?4™;> +Û Ì_÷cvDMÄȺ„‘)˜3,fÅ·„@sž?X³¡˜ò\ªå$@Š$ÈW; ö=W!za(NGv È(èᇓÃY†CõdQ1”On?S9Ç>Oµ +dõ›#. +óÕu«ðaxÍ'¢T´Æ49¿} +„¹ƒ°yeà êÙÔSYãæœjî×]…)Å ’ÀY¡vSWòÀ¢ÒGÕîUê£ ã þh4 ×
¯DTÚè¢Ë ¾ŠŒ}dœœ'.ßñ»c)sùÂ4E©”€cr'L’q!2XdêF Ò±!NMi€âñ¢Âd Ö |H—^ÉuÞõ“ù¦?aÈísNfB èÈ(û;Ÿ>§[ Q-„- ï$àKor§ËûI’;G¸],˜úJâAžXÚ€àvÞ9g•0žh}[ü £Å‹—T€ %/WHþî×Dªÿ~Å!¬„ŒµWJQ;dZUüÁˆo 7êU
‰iT†dGà!y×"?αLÛuº·Ô~¡šŒ{U#[Ö÷g_SÚ®s·ßñs=„Ñý}Ž´þ^W@ƒ¨IÙ9¼£ýè@‡}Ó$0_>)’¤Èz®Ep,—ðóõè¦ +ÈïQš4Zl’€AÍMNÒ1B.Nè L·YÏ¥ £ÌÊ©“0d›±)š„¢«ëOØF'Í<I('Ó.DÁ=Œ”³‡pEdùØøõmQÜÛÓ +~z#ë6 å˜Mmné©^«ŠÒŽ†y§×ù{?¤¾ó
ÃN[„!H -Èâ–‘Ôyú ê³Ból«ns ªYòU4Mö¤
©0lÕÜ´~µÇê½æ` +chô„, 3 ‹
ï‘“#•ÃùG ÖÑŠ9$5à »l|ëQλM}ž¥’>‚ ÈÔ!¦}™n¿°B=…_½' qŠ=ò¼²D½JQ:| 4ù "V&71¢‡»Ê´XGŽÌ˜Û6¸XÉLjðD^«Pìˆ,0ª°>«ÇŒzK „Uê• Á;ð#
zJí™ÛG ÃLtåk
' , 2ýòô™ÏªÍÑk|Õ[~>'}A–žh¦M$™O¤{É™ ™a ý|Fo¾á¦›\basmç‚‹ÝjM߃½€—RÚ·Ž¤`W<Tº;ˆˆ³õì&> 5YC¶]Þœ}ËA… Iñ FÝi„—¤>4Å1 <ÏÜïQ»ÔäJ!¼@ïµ/g”Æ +¹?¯²YÉLµOÿº“oc€ùÃ^vu?ÂYáQbâÔò%hñ£›Þ|ù:µ˜Âôʼn "¶®œ%v ¾õ +U¨!š»N}œ Ñ“;æJ›ªÙCĵ?ûœôý+¼<¹è¾ŒÐp—³[»õþAN +ç´hô@ª{âN'H_È9S(rÚ·kEü&ßÏ•tÛª.Ü,çx> A(wYœÐ% + ±(ø'E5 Í0Á{'WÈÐÐlûù
4·Oÿæþk¨ÕÏÙ€œ“æ¬)Tlý¼SM¢ÌºtÙö :ʇOI[|¹ ,™á +¸} ³i¼<nU·ƒÊ'D†7Òz;%s}S°l<•’y°46Ê–TZ¹eÛ]DÕ\Y¹ñ}˜en|( xèn )<¸ËŒ¢G/ Çê‚«þf$'„ƒ":èuë ìðx/’<€Â?‰CòSÁ064qcZŒ z¸ÙÝü\! ;‰^ ¼·'PZÖ‰EvdŒ¢bòjGYþ=Ñh/«¹È´®ŸË $8éÈ'kê¼²à +%gsðùB§*÷Ä•TÝþô¶VÔ½~Þgÿ°s-Ãê¾ù¤‡I3ôÀâʨbŠÅ4ZŨǾdzçÏ—à Áç‰÷ø׳ŠX] "ïe ‰¥?ÂÛjš…<®ÛsÒfÔAgV+¢ÔŸ8ýdÚ¥_ÜÌl:ɶ™q +L!
… a¥,C-CŒ}M¾~šÞƒÔCzâë—ò '|;¦DÜ‹ Ž‹¼”ýû·NsŠŠô
c‹Ð9T#qY%%ËGð 0Ù¥*÷f’ +. ³ã׋ÏLH]DÒ.½Å ¦œÈçûNcxï*ÿÍRŒõjHGmwr$Æ›~üzXÉõ½c7G9±fRpÂÔ›õñ`ç¾/ŽFöøÍ¡Sësöe‘Ä ¡ûÅ ¯jrv±K ±‚º‹—li¬@b Á̧òÓµ¬FÁ§”L ¡s¾´_úm\9G›8 +¥£XmK‰ ^γ³æ&„m©œtðÞì]ª_l„Š@O3º] q—ÃX;Ü3œåá› +kƒãåxÄüÁ‡¹C ¥"QPf¦CY_vŠÓÑô|‚ŸŽîdœîÃ:
eФÛw‘éûe« VÑê–†P-o‰ ã¶*‚½—€:GçMøŸ¥ÀOr¿/CîlMk[6qÉŠP·eÙ0ÿ¸•Ëzý?TRÈõó·—Ï(ªå8“j$27BjߺÌèÖ–õ¦òãȹÿäâÌ-:N
^TüÚO`bŒvï ×o(<>yýeþðHó‚Tƒƒ2¸¹Áí åÞ(å2Çæ¬9½³g¦F³Ù å’Ë?q…ÃNßJšPZØcš¹ÔiΑ88›ï…wäD&oô\<朕çÞ‡.'cve‰kÎþšØuôI¡]Èš‡þý+‡¨§Ä ~¸db D:{‹ÛÖq •¢j+˜ZÖ+·?ÜT±æºŸÀÜÀ! +û:%é5¾¯åV¾çu™J°5Jòb´â"2j þä³àí=j¹ òüÅÍ·½OÖ±¼×Ñi¥Réqødo e ל}½j(áIaRFT¼‡{°˜Të‰n°‹W÷'½y@,} H5»A¬8ÑLØÑ]ƒ5ævYÛÐD"ßïŽÊDʺ°z¡Ž »z}ð…ˆÇÄ_@ïO>s0<#gr¹ñ´»f!bºÛè Ê5ƒ¢Ã–x¦ÐJÚ./°A>x» ! jm–²sÞ7v ÁßC}AœíÁ÷}Žn4XìÅVÄés¡%›†¹¢{Pû< ´éÔ Ì7¹d±·ÝÖ.´?²s1‹t¯}¼;¯±Ý½’×Gû»{UÔ.!ó !T-ºž¸9Çݯ~_’*gûkèŽvª»¦$û¦ÝU‰ô¥5Sü¼ +¨ ïÃÌ'l¿:¦ðè;{3¦Íäeµ—Ä;»¯McÕÒÚ-ÿXON´Â½²ùr0‘õC€ƒºÆ…L9ꉱSWËñÛÖ þN2¼‹ÆvÃñ’ýÐ È*ö{ä•k^‡jogÊ"oØÊglÂóIüPÚ}tq(½Ÿ +QCm6õ +Ê’¸È˜”m€¿™»_–pÛD‹KÅ|iVWeeÀÀ«‰
„lÐÁôÿê4èT0Éëë]Ïd‹;PL¹£¥e!D*%)fоì {ÄùíÐîòsÃÕ|0ŠLï-ûÈØÀªY‚èZ`ä<Üu´N!ìÆÂçaæ¨ÞôIJE OÕFÚØÙ‚™O¥ì鲟‹„œ*+aB5*êëˆYš0MŽŒ£>ÂãðSΚb¤³(= nìj‘·æÑ4 WÁÂ-ÕÏ·_ѱîíô‡Çº™·` î%âg›«ïW‘iІJmøª º¢Ô††ß‘$1½ÑØ“](snr…„L¹Rœ±¹ UbµVfn3]ú‘ÛÀáˆÿ3È9ÆTÄk›“ ¯Bšž«µW¯ôoäˆ9u“lܲ ‡vxvèô3Õ ÖÞlQ;,
ÿ®w½ß,Öf9z ï ï‹?Ž J¬äl* +pË(ÑMÁ™ž eF× gº ‡@‰ <·5ð˜MêÍ jmòÏ °ñksŒ]VY:zÅPÆ]•a£¿u_d„‰ê`”]&6ú‚–2#³ëb…S–ä|_'UB É9ÇØÔ*+‹©´ËY[–µ²zŽ’w +Áë±(`°1BøÍéÑ÷kL»;B„/ˆ,àG70“›(Y:¥ö +ùµi¸ŸÔ§îwX\Ÿy=rû„7"¬ˆiÝe6ÕÈý`Cõì¥oØ?g`Í F朌‹ÀH‹†ò×ÓÕÏ‘`ñ»
‚ƒT~65Î.96,`³xõµôlë Ä\θ;&¦!kÇ×å ÆæÁJôV>ÓÛnQ3‹c…8¤„½aGãÐ$ îÉ(»çf†A*"CÛï}„:¾¹ Ìl{‹7nN^ÐÊ`„påƒå˘ÌV—Ûyþ2>÷{Ή =½"ž;ôl`¦GS=)ÅhhR:ê bÞ°ã }µ;íYÏHey~aN'¡¦o¦NQ»ð%`\ô?G°2™9×Á>ìS Š¬7…¾»Ù6ò_qÛ§ÍȒΊŽ¤¦vغä.Ù#*Íõ¹²G-–à°Ã~3º½øÕNôdàÐ H¬|ò€Ò>I6]ñs˜öüåÛ {ñ7cÌ a8d?‡ÉNV¦æWíûê^ÙŸ\W’é†;ˆwÒ`–v0zA…füA©‰õ§$=›Ò¥˜ÖÒGVöašMŒs*(±Ó8üì¹äô¶^d•àŒ1÷·»s®ÛCºDdq +I¢BŸîÙ¿¿²ÊXãÞLb ÁcÔÅã‡Î0¸±hÿŸvæû +‡ +ïÔ2AÆìö â©eîÛ›Ó¦;»ŠÞ¹‘°!¸„è`Ò]åU-YñÌëŸò¬ùM5ÁF³·&RGßw´+ùûè8šŒÁÈfïyFW
OU£wÀº$¾¿@i¼ù9ºùr¹>ÒHÝÂö§õÆe¢Íw{˜¡Ù +,ùÌçÖ6ºþ‘ß‘—§ìä*ƒšA>SxÏå’ò§Oœ•Ãøjäwcâ]o¸‡´×ç?e•é%Iôm ßÞl)·œ?Þ4‹™æI¿´—.¦Äì Ê×AÖŒqh}Ä_J¬Qêõu‘¦ZX´y7³xÄ,i’¸«^飯\µ1) Ík„ÝÅ TÅ>¹Þðô3¥Ÿ¦õ 1!} KGf³[ZdɦÚ^ Ýs>¶ì¨¹…ç›ý˜“]û·çÁ ~V\Yƒ°ÕæÆÐ¥–tQrÿ=<e¢w†|hó$¿åÜ£ ëØ ÁS ä<þxØI'è÷¤ïëÚ_tšd¯„§wòÒs_×àdI#ØÙÒ¿˜ +ogÓƒ1GC6E®Í]cdv®l}©µžÆÍE*û‚Xí
øVr,À8è–>7%×5/ÔQz 6@^î$ Æ +Ìkª¸â§hDlU¼v7X}ñÂúZ%fòb+†Î5ƒ;TÅHÿ$IÀÒR.X/+ùeÌö2¸Õ4•õ…6È(z¡ØîõÉìg,Í¢ÛäZ}~û JmÕg(±èe{u›"&Œ›Å? c +á ò¼\¶¿ûë¦n +Ý)¥ÀÓ,Ú €ž–ñ;Þ© x%ŽÇ*:GïÌ‘bàÞšÈÚ±ÓÀ'“('
ø·&ᦗ„Bfs^0 ©^T +i¿5xÑ@>,Ïu> w?ti Ó¶0ûôIÏä#%(ù‰ö +©«ˆ|LO†D¨Å÷¦gîÑå¼Þ8vÉC÷I~®O–ÙÍ>mŒáõÞ¢‰‘}‚ +^hâŒð·¹ œ£“hZ™Í/øÅ_à7œÀ+P¸¸&&êåî$+Nȶp®Ô
~ I(–»c¹ÚŸYªÓÅg¶%ø¥p%ö>’ H¾iL¿\ÚõÐß(¦µâ_«8Cƒ—R{‹ +Žµrð¦ëØíû‹0Ê{‡˜ÊQê¸2‰«Zœa‰ƒ†*7Äc¹äJî„I›ÏüìÒ]©æÁ 1=Š¡å©òñS€MX¡¥GMøªéþP¢‹:*½ÙOT9†ÜD¨*ÀzÞÃ*Úž“¬ÿ°Ë_hg +‚œ«ê9ŸjˆŠ"J7Þ®(ðhT(ìâ ª¦ ¼ÜðÊ™§Ä‹V¬áÝq +oò]ç }£¯9B‘7õ· öœH{È’ëæi`T&éVÇãs"¹‡‡ªÃßÛçVMo¼iá÷׈â{C„^×;¿_g¿`,·÷þ2
Ún“
R ɫǶ]ÅjÍuib°ƒãÏV!QÏÆ>²¦aO<ö”ñOÁxƒªH²$áófe °§Åû›ê¥úКxÇÑiêÅà>ò$–Ìy"-Ú-ŵ ôý‰¤Ëq ¸ŠÖˆÕ"™[Ø m¥cA¸ ¶¹"t8Q+PK¥ìó÷Ñ”¶ëÛãh_“ ®$+ƒº‡¼S¾ÎúÜþµ$áØ™éezv~7EhÅZÞ‚¥ÓªãHÝåûm®Ý‘(ãŸÄ"Þïòwnúê›»ÉÕ”^«¦ endobj -858 0 obj << +863 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1915 0 R +/Encoding 1921 0 R /FirstChar 33 /LastChar 125 -/Widths 1925 0 R -/BaseFont /EAXEUU+NimbusMonL-Regu -/FontDescriptor 856 0 R +/Widths 1931 0 R +/BaseFont /REOTBO+NimbusMonL-Regu +/FontDescriptor 861 0 R >> endobj -856 0 obj << +861 0 obj << /Ascent 625 /CapHeight 557 /Descent -147 -/FontName /EAXEUU+NimbusMonL-Regu +/FontName /REOTBO+NimbusMonL-Regu /ItalicAngle 0 /StemV 41 /XHeight 426 /FontBBox [-12 -237 650 811] /Flags 4 -/CharSet (/exclam/quotedbl/numbersign/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/bracketright/underscore/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright) -/FontFile 857 0 R +/CharSet (/exclam/quotedbl/numbersign/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/backslash/bracketright/underscore/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright) +/FontFile 862 0 R >> endobj -1925 0 obj -[600 600 600 600 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 0 600 0 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 0 600 0 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 ] +1931 0 obj +[600 600 600 600 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 0 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 ] endobj -742 0 obj << +746 0 obj << /Length1 1630 /Length2 15892 /Length3 532 @@ -9112,7 +9182,7 @@ stream xÚ¬¹cx¥]³- Ûv¯ØfǶm¯$+6:ìض“Žm;éØè°culãëç}ÏÞû\ûœ_çÛ¿Ö=kTªY£æ¼îûZ”¤ÊjŒ"æ¦@I{WFV&^€†ª–²‰‰9ÈAžQÕÁÎð×̉@I)æ 4q9Ø‹›¸yZ@s€8Ð ÀÆ`ýúõ+%@ÌÁÑËdiå ùËAKOÏð_–\ ø›UY\òßuºZ™¸þ“Ûô8Xüõ4w0sûgKÿÂþÒüE]M@ö. -`abû·Wÿ²kØ›mAöÀ¿šþ« +`abû·Wÿ²kØ›mAöÀ¿šþ« ™**À)—PHW£B¢ªU³m·WÛÔOrí]VÉ• $«ùqyĤ"õÂzŒ f<0ëûë £Îðf}/Ÿí¤>bêFè,VØUd‹ÕƒæÔJlNÍo’©+¬OXÏ1Ï-¼§c-NÂ1ipÝ›í\AÖ úê ì`u vdé,RHžê$žkK‚>&Y ¤ºÛ”OØ&â„o™kâÆœm§Ù WëÙÉ ¨œ/û«Ð[BÒó´`Ûtä¯äÍN¿Gf áĈHªýmVéDÇÏ“Ÿ”Ä÷¦Y_kÉóÍ+èü1 pÇÒ¨åÁ³ñÂj D•jÊ @@ -9174,35 +9244,35 @@ MIª\ÂuTØjGI-gýÂÓ–GâydføæÅxÃÃ,oÛ.رÌ*_ùSÕúƒóØCkëÚ™¨·>]ÙrÿÅ:K¥ÓS%œx ¿n$rÝ XðD˜t
ÎõÓ…”2§—n „sÞmOÆ„ ˆ;²ÃßshuåU9ñÖ&;y-sõP~K*ªÅz4rnp´}ª÷œõ)RB—+«å—>¢cI£Ž¹w× éhz€Ì\mm £MúHþ×<×|Ìï&‰ Ÿw³s£Üë+\?VË´<=yò‹ØH»M'²ñÑ67Cøoí+A5x5 ½·x¯'_Ë c!vÜ~óÓ4¶bIpµP]ãH^ŒúÀnkLßYßÙ„æÀ,•‰)tCœrÀ‘ Çi†Ï±m$hýÈn.ÿ¶»öO¿ª WÂ[–{OFC hÓ'žWùÆ*6L‡1±’g^H]u Ââa3ð¸g@—TÕL_1@ d7¾ùÁ“†µ‹Œ:…‘XF.ÿ§Òfb1\ÄñSÙ£Ö®TÁIS ÒŽã{9 .´ v´ôPš_$ ƒºÃ™.T€Áj”¤RÚ.zàÂiXÎ^;-”ûkwå0HMKyÃûSc-‘tkâôk'a.*bí Û¶4ŠdÇ&ž*qÉŸX‡ÒÝÓä"c°4 *+9‚3£ cáE¢Lg%ãŸïÁó§KíÚï©=ëg‡~Q)œu‘Še7@ô`¥¡c˜„s2¬ìe/ï´Ã÷5ØI*·[ÔrHîD4;"«hntRÉ´c¬¥ŸýÝ„u å{ÿÁØ }hë … -¯41¶{ºQµÚâl·Pãg;‹($@QQ~:ú4¥ /麞e„¼æª't“Ê>~œÍÆTÂ={š÷ÈcW
äë6Å͆ÇIjË‚¶{ Al ¸¸
²œís è¹”Lª £ÈàýÞùqœöÇ=*Y€þK +¯41¶{ºQµÚâl·Pãg;‹($@QQ~:ú4¥ /麞e„¼æª't“Ê>~œÍÆTÂ={š÷ÈcW
äë6Å͆ÇIjË‚¶{ Al ¸¸
²œís è¹”Lª £ÈàýÞùqœöÇ=*Y€þK endobj -743 0 obj << +747 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1915 0 R +/Encoding 1921 0 R /FirstChar 40 /LastChar 90 -/Widths 1926 0 R -/BaseFont /XWWUFG+URWPalladioL-Roma-Slant_167 -/FontDescriptor 741 0 R +/Widths 1932 0 R +/BaseFont /SJDLCB+URWPalladioL-Roma-Slant_167 +/FontDescriptor 745 0 R >> endobj -741 0 obj << +745 0 obj << /Ascent 715 /CapHeight 680 /Descent -282 -/FontName /XWWUFG+URWPalladioL-Roma-Slant_167 +/FontName /SJDLCB+URWPalladioL-Roma-Slant_167 /ItalicAngle -9 /StemV 84 /XHeight 469 /FontBBox [-166 -283 1021 943] /Flags 4 /CharSet (/parenleft/parenright/hyphen/period/zero/one/two/three/four/five/six/seven/eight/nine/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/Q/R/S/T/U/V/X/Y/Z) -/FontFile 742 0 R +/FontFile 746 0 R >> endobj -1926 0 obj +1932 0 obj [333 333 0 0 0 333 250 0 500 500 500 500 500 500 500 500 500 500 0 0 0 0 0 0 0 778 611 709 774 611 556 763 832 337 0 726 611 946 831 786 604 786 668 525 613 778 722 0 667 667 667 ] endobj -680 0 obj << +684 0 obj << /Length1 862 /Length2 1251 /Length3 532 @@ -9210,167 +9280,175 @@ endobj /Filter /FlateDecode >> stream -xÚíU}8Tù ßgYC¯VC¨Cײ4/gÖ(eX™]/ƒŠ’Í1sÆ 3s83£Á†‹ÅŠŠÍKØìfíö‚‹õÒhSôl“XòVS4C´yuêi¯ýóÞ¿îsÏùç|?ŸÏïûûœÏ÷÷<?3¦/Á‰Ã®ˆPL -™FµÃ™ÎHxÊ áŠ çOEv€“ -à‹`4fq °y,1 ‡ð„8Ò¢#†ƒ -°ÀL~`Ùˆ °aŽä‰`{Á˜“ÿ†©•Í]%|¾'$Xl¿”Ò_xHÀãG½Q ‚p‰F„
£Â•R?xÙœÌæI+Y†âóXNÂ> @"ÙšºLðD®<)ÌfòÄ,.Àø"x ‡…ì•V°ø–ŒÜ\Üý™VoæºD2!žP¼7* ÈïÔK5ø®ÆRByR €L$“ALˆ½o¿Wlö™…°y€Bµ …¢pØ Â**<!–°sL" -1¶À¢9 -p·8VÐ ±x(‹³§&^d— *@ -Æ2‡ÿ‘)†B,˜sþ [¿—‡þ·Åp}`` -ýÏY'uÑËžé_N—è^¸’VTîŸOm"öøâ£Ódk^Y™2äûO|4¤5¡Ï|³m{ïô¶¸6³lýà¹Æ¹Ání–>',M7Ûõž× x>jàqçÖÉÚ¸¼ë;Y·î¹3˜x‘kš¹‚㨠<
Í>Âr" -+淪»*å}öüz¯ô¦ -jr]žDG|W¿sn >ã(ñ‹êSž–Ö˵»ëõ@Ý]w{3_jyvh¤Q<$WfeµÜãc$üð¸MG÷í=¥ãïé|û•w`
.à r}¥‘Ñ2<xìZ8EËTÖegdþåþ—ŒÕåkE%›D%ãÇiýGÀª]à}ÕxÆ¡œXÆ$#M/7äjŒ#ÇÛWY6o”ÕéõÔœ‘ÉûtŒ5û•YÑz -Y¥8ˆÇ9=›™žÁ ôôöÿB#îPs^R Wà3µºïyÅÓ2äÌŽ±- c~êdÆñÖƒVS¢q_mÚÅ®RÿCó(øbƒ£ÍL¦Sù™õ*†Éi¿A÷¿°·‹[˜œÍžJ=û›é‹¸Á?&¿ÛXJø1ÆrhB¹é–=7âap¢ŒûLéUçP]flBìµ ·Kê Ä9¢²¤våš'øÖAÝîSŒ#â²GŒ™05t½Êe— ´j®ûÊBfwØDXÎ?+ÓÂV#êÇÌ pMïÖ .“ j_*ð9¹ãG5ÅRÒúmÍ^vÐýéê}›^gîÖA×Ïý(ì º³þê—yó‡‡ÕÇT^²>ù%ÜûùÒïüm¨t2b}þÕ›ò«r¢+¡u¢µÿf‘-UqäÁ¤òZåõ1IÃ
sIy‹²/át; 4ÏïÂj¯(Öe•Å£ª¦Æžºù” AÑB8tWQõ1m å<u ¯p˜¬,
}êëök UÌ9áôü—“¤×‰ÝÏ5êZ¥Fe~ôª”©éÖ×[™YíC^ƒz²9+K:¥zÄ™ -§Ý“VŒë -ÓÎÿ깫P™’< ¹%èZcÅ®ýyŒfß–vÇ6Ì6½L´P}“YÅ4]m\Ü·PR з
« > ‰·—
xDèFi¬‰O‹:"˜s]’œ†Ü„ OùåhræãR¤Ø¿ÕF§ _ÜsIÔ½Ž6j«i¼ý÷TÇ#]ëfîÜ…Së ecîªU1š}ºw:]ËFu[jÙ»[n:†9]Õ’óÛ4Z l - ýòÒ5gl6$"&9éãÝÛõ
×eí!qøøð¦yücêƒÙÞƒ¶ãSÙ4§ü¦C âqHÌ9“ ¾Ž>¬ X1ús_‹¾ª®îð©Î®d¿XwÓ¹viÊiåÔÆí݄㻲½ 1Nô}Nw?Ñ?'×ZT Ëî·AãHzŽfûhôʸkƒzs+8ïéÿÃ÷ÿÿ
°«Bň +xÚíUkTgnõJÀ+Å€€¸ +æ2%X4© É„’ L P +A@0¨P¹TZ)`åb°¢àY#BAn¬\uÝôØ¥?wíÙ™?ó>Ïó½ß3ÏûóY˜yúœ9H슈$ÒwŸƒ +C>"ÚI`: +—³L $à³EÁ €vD²-u‰à‹]ù2˜ãÉ—°y +Ú$6 e `öÂÔ$ ìAHAXæð 2ÃPˆ
`î aÛ·ðÒÐßãö¡ï, `‡Š˜·ÿ98‘E( +‹$‹g‹ÿ]Íåc#ƒaÌÆõt!lÇÄܪ¤ò˜/Îßùá#’ÎËÖ +Mv“_ML ŸṡzÎË,XR2R¤ºzBUîe;žÒG¯¥{¤}5U¬ñjja™_f µ‘ØíƒLH•¯zmc9ÂT„ 8ÿʘވ>:ûí–=S[b[õÎqÔŒCçfºt×[{Ÿ´6ßHë¹ Ýÿá|dÿ“ŽÍ5±¹7¶³ÇoßwczâÅ®©–J®“nÐ4óÀP*m¼†›ï©UG
9skYiþ²§¦)æÉÏ[|ÊdÓ©1ÆÑ¿Ý +ÓÆßMM/šþš¥ƒk4e\ï¿£H¼¡"eÄín0u3i}dË{µ±ÕÆCþI0yÀvť᣶Çû©“ߨµ7–Ƽ(ƒBó«sLw= +ÿ¾nûì~|ú1â—U§>+©SèvÕ€ú;îõ¸d¼,Ðñh×J¥¸K¯ÎÈkx'FIø¡1»ö®;»K Å ?Ð3úîk¯€j\: r}•Þ<4püzEÇ\ÞI3±üêÀ+æʲÕâb«
ââKq£ ô¾£`åÍŽNðz,ýpv s‚™j|- Æ‘ã *›ÖËk
º«Ïʽz¦Ú}ªÌ(¥™¼BÈçžÑÉHK÷ ððòûR+öpSnb +TÉIs›ò¯7”ï8Ëlòi~H;¾n¦ñU‚•úÛŒJOó•¦E½óÅ endobj -681 0 obj << +685 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1927 0 R +/Encoding 1933 0 R /FirstChar 13 /LastChar 110 -/Widths 1928 0 R -/BaseFont /HDLCXP+CMSY10 -/FontDescriptor 679 0 R +/Widths 1934 0 R +/BaseFont /JTOBJF+CMSY10 +/FontDescriptor 683 0 R >> endobj -679 0 obj << +683 0 obj << /Ascent 750 /CapHeight 683 /Descent -194 -/FontName /HDLCXP+CMSY10 +/FontName /JTOBJF+CMSY10 /ItalicAngle -14.035 /StemV 85 /XHeight 431 /FontBBox [-29 -960 1116 775] /Flags 4 /CharSet (/circlecopyrt/bullet/braceleft/braceright/bar/backslash) -/FontFile 680 0 R +/FontFile 684 0 R >> endobj -1928 0 obj +1934 0 obj [1000 0 500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 500 500 0 0 278 0 0 0 500 ] endobj -1927 0 obj << +1933 0 obj << /Type /Encoding /Differences [ 0 /.notdef 13/circlecopyrt 14/.notdef 15/bullet 16/.notdef 102/braceleft/braceright 104/.notdef 106/bar 107/.notdef 110/backslash 111/.notdef] >> endobj -677 0 obj << +681 0 obj << /Length1 1616 -/Length2 25061 +/Length2 25291 /Length3 532 -/Length 25968 -/Filter /FlateDecode ->> -stream -xÚ¬¸ct%\°& ÛvNlÛ¶mçĶmvœŽmÛIwlw’Ž:¶í¯ß÷Î;ëÎüšo~œµÎ®ªýÔSõÔ®µÎ¡ QVc1w4J::¸1°02ó4Tµ”MììLÌ åT íM -°t1qpûÛ7G€µƒ™»ù?þÚ- ÿ%ääâø7Âþ¯ï/˜²£«›«™‹µ“àoVeqÉÿàéfeâöOnWë¿n€£ÅßHsG3÷Jú×÷æ¯×ÍÄÚÁàôrû'—)`níêdgâý7÷_0'ëi¸»Z;Xþz€ ÐÒÄÅÜèêúæ/ö?Ýù¯:ÿKõ&NNvÞÿÞvü7êr°vsÚY0±°þÍiæö7·¥µ Ó?£"ã`á`aþ»¹»Óú<€.ÿ6ˆúŸ™¡ùKÂÄÜÑÁÎ`´€cRttû›@ý§2ãÿ;‘ÿ HüÿDàÿ'òþÿ÷¿kô¿<âÿ¿ïù¿CKºÛÙ)šØÿ½øÏ ü³d þ·h{k;ïÿSüÔþÉÿ#ŒŒ›ÉßVˆ8Xþ•ƒ™‘ù?ŒÖ®’Ö^@sek73+€…‰Ýß>ýk×p0ºØY; -ŽæÿóðŠ¨¨£À—…“ÀÀÊÍö÷ɱ² -"—x
r[Hzä-ÙÙc«óæXÓ¬ŒQm í-½èÄEꋳ’øÞ Ë[=Yym ú¯®jµ|XV^hƒØrMYáX z2(—²ß6êX´oϯÛåzðïæñeç,ø¦¸µ©Æ‘W“‰¹dÖÌ!àPjBü„RËEW&ù?GƒzÖÔáB ¥9ó?ªsUe˜ÐàÇþŒ¹zþ¶#¹ÙÍÁ¬JÉôŒt 36² o=Í`ſͽâL®W3¼:Í0J5WuÁ ¡.þ kì9sÐêà -YN¤µ(¦6;.2P' -¥>®6Sô¹p¯{¡ŽMº7q '÷BSì\!#Ò
ì²Ý,k:èJ Z®{ ?ó™¸ z$©Ÿ{F”§‘€ -–u°U×Ðü$~ßÀÝîÖÐ¿Ä ÒÜeuãónÃöÍZ¶ú««ìbE¢°ÙAeÞbdË(j~nZ¢1«…ÐÈ^Óˆ+¹ýÖ oK²±µ>”/81Ó¹Ì%=ô'åU-Ól,õ]ð5Uó/”Á¤ˆ"1ˆÝeÛ?Ó˜ð¬*à0ŽmzŒÀŒ Ï&=t°ó v%!—°‹&H=—pO¤'³z}ïI¶×4>±Íi7H`,e ½Óí½6 + -AZºM}eP„H‡§žÕ"Ù t‚aÜLæÝ@g¥˜£ !É ñ¯y€ -leh¯4³Àe ê¢$SbdxßW#Mÿ(\?'aS4©/K>ƒÝnèÔ„˜6¬÷Æ`š6Šg×!«˜ [“wf×bRIñOð“-Gè…=lº¥
HYä°¾TÎ…k›í áx±µ,¶v.©ºø¢gáe1eX¹¢èÉUNÐÆlB ¹øªÓ>îmcxé+Y»èY»m )6d`÷*ÉfïQÔ]%1E¯ÈU¿o:ŽŽ×¥ IÓ QÞ†Ào?Ô#„¿NdævB!†‘$)ó–×KŽxv…@MkG/f,p}·S¤µÅ6Ó¥!2:D•V³âšç à6{RWx®í‚7ÈViµ<epŸ–h -@uº@ä® ÀŠTœå’WÙ-ƒ -ü;RAeý ö žœi7Žsþ5ÒñIÓŸ¥%ªÍäyÈ°—©áú’P–*Fñ
ý+QàKš©} %÷Þ lwQ,CÆ)=ž»Ê" 3£–LRw<;a!ªÌ(ÈfÊRb—G¢Ö1…›òM E[ÕhtÂŒ¡ÈI"+¤½?e–ø1CÒÝ·Yôä<ÐÐ`üɲ ¨Î°e…(-ƒpÕp$ߺBË_}êçÓªÓËYkûùþZMÌî¬l¸ÌÑx‰ë<ÚÓO¾C艋BX\唽4Jhõüá7Ð2
qû&ŒÑúwÿÌ A*Öz½C¾Â1ÃÑŽa.g€ÀMnÓ“û 4¸=¿jy 9Ù`è…']X¦zý–(©È0NIíëk9K±Fb êËRJ)!ØÙ룰»®¡q‡¦ìE¡÷Gη¨-˜}U æ½ä)Þ…ÀÐIÞ3(bÝÔ¾PEPÈKr]å]U™ ¯P¶LEqòÂÔø,0-ɹêÒÇ*Ö6h=éŠKS;¬n±HüEp2=96éU-9¸ÈQÕŸED€éD˜ŸÑj+Ä´k#™ù‰@G&¿8Üü8ÆØ¥n°å¤ƒ+ŠK–±«Ô4Q6nCNTM´gu„ í¢—ýy|d ®¸ZÏƼ‰›‡zü •…(¶]î1í~ÑÎÇ œª÷ÇΑV1]F Ç\EØ%H2ÊuÝÖ”Œu}¯¬Þ d bÂÂy;²ø¥XO††Ìƒ(Hþé%_èTrzè©ùËE)`~ 6çÛí²|Œ5ŸVà P”ð yj.k"äçeÁS ’݆-ÞÖš¯g[‚r›Qyv,ºgb £T ?ߺUÖb›Ç÷ŸD ~øàÉ`“ÈÇ›8b89<†9ìðf ÎðN>’)»êÉøñ;™Òa[#CÏW²p?¶ªQ¯ ý®†[>x”©ÐCk`+E#UÍ‹ô¨Îi÷ÜGNà%Âñ§»}ðš´f•¦$ÊùäyþÄ5Ò¦ ”·@8¨âeô¾.%³cË]ÉÑXSЄmÍO„X_(‹Cz>sñb}„óº~ë'_<m4ú-œÝ3 ¿Èîω—ßœQuŸé9îTHØ6cŽ÷©¯gdÛq'òV„mz giüíEÀÆý¼\Þ›{èLŒç!Ãã—œ}žrT-¹rfålžðµ"zX€|29 ö‰ç’ -j_ë0ÚCQf#dèÃ…Z®vòëÞ`©XRe‚Þ¶“ÆbCç_† Í3§¿/¼&¬ +¥ž²ó܉ÈFÔïòÎÜ¢Pî)EïIÌv/Ò¨O³¥‘—ÐSìvm¹=–¶cê×cý3ê« ¥_Ba>éUDžèß´84—5†¸ô´%Ìd¤`Dœ™´ãI|vU@^Ù96 ¿L>ô•‰÷äv ØŒr© w^>w(dphµ5³]‰´MäA:bÙïVp‰ WØŠÊ‹8Š„NdMjËñȚͪ~ ÏÃMiŸ?oëµû/ªk·åµÙª“IÆ_4ËøÆ¿É·+€:’1fîúmv€1Xût~?ÀÎ(Ö4»c`
Ð⪗|•õચ¾ëU½OVp¥×Î[Ãq©«6 ‹Q½Ì ®îúÀw£c:£w†ôøo¦¬ŒììCz @ÆЫ®e÷ îYi׸p2w•º)Î,«èsÞzÇjKÀ¬ç -õÁÈ28žäp¦£›ô–Yÿ -}jÀЖ¦EöT'¨4kâùÁ:¯ k N)4m{ª'¨8 -o"®ßÜ–},2þv~D7e¤ÞZ rùˆg Éžà±3pm?ÿ,T -ëîgÄ?)•Šl®/×ð£ Ñ]ÛºŽƒ†šÞŽi—é -W7ª°å:)ª²‰¢Ò8¾M²
cOšg<ºÝö§Ü½‘çÅåÍ×3K‡à^i¨g7ÎÅN`‡©™ÔÎKO™É·Ì~rf 䉶MÉ™\Sþü0[:Im²z?¸,ÛY¼[YØÝ T_ôöNÀ[ŠôAf¿/èçÃ4ÑÓ¤L3³ñ±•4Á„D›Z8âD¿ú>‡àotgç{°ÑÔؾє AåiÌÿpÁóI›úžöâ4 »èÊv‹M~C{ôš*¾T8 Ù(Y² ©`Wkf¼!6cZEËàxpâuÆ9ÃÐ }Óá7uCÓïT÷E j²DÎ"0R/mx„â/! öFkÆ™ÔøˆiD¹—¯ÒLðVÿ fô²< *ÉÄŽtûS3û nú>sF£Sc×Êå -:ïزAøÀêPØ5Á2#U[øð/•ª€Ç»¦î” n[WˆLØoHé„W¹„ 3Ts€´<±_Z_÷ÈÜõž/Y8VÖŒ6•ñíZ(D{Ô~‹Šc?W-QQƒ¿QØÌt°•ÑNóPtz'æ_! ÆμMÓ²·ý *cëè;Ç…X9Ï!øù©Ò -‘"Õôç|ÈÈtú<®{ }à -]’4ªLîl£+òöÁðt¤q©Èñ·*¾kÏø˜þ’3YwÂ~.u=è|›ËáAN@®¦§‹»‚=ÀôÕ~LUP|Ñy+cwFæéB´ ö QxÞjÊd]æ}ƬsŸ«ØÃ>S,ÔÙQ‰Î¿Úi SFÁêÎω ¿k_rÿÅ&h&o”€¶ÚŒ%UʼãŽN7ùäøcÓc*eQTæþìvÍ`éX b4o0 1j}OÎW†lÙÿGµ“æÙ‚ßE×x#KG7Ø¢ò“–LÂBµôE9rÙv¶J?F0‰×…Ä–šˆÞïXx» ¼ûê|¶m—{·Ñc¾ -úÊ•REË
»Ñr:ýYîËñ˜ ùII·ÍWæÎаD0p,yà›Á ÄŸþ!Ïê S/‘çt •™•œÌiÊü1 ->ú#ÍÌ׬-cRÏx_QkÞ±{Q*‡Õ™-ÝQ^+b<y6Ö8‘ê fkw6IŠ;R¶×T
?~¡˜5‰PdíܵzwZó²Û´ÄúóÓ¾ÈàÞË&Óéè’ ¸ _É×_]m= ‰ÀGÛ6=Ý?%¹!¯ƒ5i‚h1ÎZ]b îxÜítsà ) ís¯
¦¸Ø’ù( ùX¤ƒ·`bÅßéµú€÷ð@l{(ƒ.•ôF|ÊÏñtK“MîvîØóŒ¬É¾»–Y1«Y£C=V<É3-Vêàõ0œ=ƒlðaqʡݘ’
Æ_p¸¥BøoU ¯)ÆáQá#ªÝ{eN†û9 Î(ÔAïé~ýÙ0EŸ"œã|K¶êÅñ¯¸1pn»‚dNƆmU8'¬ÿ=ó¢ `íuwÞ]½dfŸT&YŠ¢žnª ƒ“¤à„0‚Ø^ÚTø蓺›M×ü˦Çdx9& qÖ‰–Æßp±p3;™*–œ¢Ãêc Ö½³ª18«°óiÉpÆU£@Kèçø÷'ZkÓÃøè÷ ©ìzF\ek9-‚rrGnr÷ÈÖÎf[Ó¼¨¢ž5ÇbÕJÁ%!’õ‘o²—r ÛJ(hô|ÉÝI¸<ŠÈ¦€G(Åa—›Å³¹“勪âs‹(ÛpÌ2ÛýXµ@û-5=ÒtN žyJc¹fza -Ê_ñŸÃ§ÑÔèõðnÏ c›Nê—ÃIlŸÃSÃÖ$ÓR AkP$'ÙÆò³¢lÁ‰“•¨=ÏÖtF%ç̾O¢-
8b(!O¥®4öT”Ä/-_0!Ô=èæöx)”ƒØåÒ‹ÛBŒ Ƹ@£"‚8I#ÇE”b8¤‡O“‘w©O»Ž$Žç i'À]K-xzfÞ]üï Ë t͈á*(/ÅÎú0aOcº¾FÔ»å5úÅ+6öÎjxÉònÜX‹{˜SÄ…œ¶F‚máWÌ{ߣ$qum»Üø
çqw00_PC^vÉ'Ì Q©‘ÙNòáyÃŒÁ_A¾*ãuΛíöùD«dºë4Q^)ðO½öa»þhÔ–õ³¥jÂJÕ¾‡!-² ÕÒOí±âT"´xâ±Z´5ó-ÁÀ̲ElJ›VŒöù^[úkJà•ñ¢^Hrï“Ί€‡ØïO§ŽoDEizÑâ¥/ÝëÝò@,²ŽÞK;ñzàÂ//+s›I‘"_«ó¿«h˜+É„éq
é¨Wn4 ÓGˆ²¯%±_0‰Û ݸMÉŠÙÆÏmp ³æu£ª1R×õ!^dÞX€ -¼/ú¡e“–NfoŸ=\îÒ.³p¤Œÿg Æ"‚í¶K‘2›ÕýÞ ; ¯ÀƒÓZU1Vµõ+Ê[ò0…=¶%Pêi~. ½ÚdìÝ´j¹]ÔSŸzl]GU -¹±Œ2e8¿ûž÷‹£Ï;ãÛéå¸D(-’PÑÎ šïXíj» <àèékÃrt1fà‘ìðÆ"e—_¶Ë/ZÂÉ™ K -äÕAüÞ#(€ñ³ê[&H8¬ëé” //ð'tÔd N´ÖÙ–r‰»M¡Ù -wp‘éõó åÑûkB“꽞ü³süyí)ˆ¨X²59~þ ¿¯ï%v£‡"w‚é„0Í>au#§PùRà!ƒ’QNT>d⥄n0ßÊjš‘â¾BÌ¡„J»ªø›Ö)²‘¨V+ô1«éƒÃ å¹;ýÐb1±’4Î5¿[Pö²ù¶£sw ~ó#l -%p<ƵulºM*sLÛVXë$„'+kË’Tó6qI[ëRÛäHJì TÍR70O!½}Ó´<çJΚ - . úBU*R‘VI*‰~†:¨ª˜M]ªßö £ˆµ-‹•$ƒ@¹À\F ?ÂŃ´æª]Ä$ÙxãÑ´ÕëìZx7‚\g¸cÆÃf¥B¸à¥9èkItÃGåÞd^j Õ·«¤ãæ€þIwÿŽ®„g'éÛµËÿM5‰l ü
hd¥}–uyR w÷º41]›u·ÎQ,f¢äá¶ÀßBû¡ýE;&)AD) Õh³rJ–¨À£=Ç.¨Þ‰@¹#VÊ–GG¢Ýþ…e§ì+Sõø*ë<*zÛ±ÙõÑ”ª†¢éÃ} ü
Ü£?ŠquPibîB!B7›²L@UÔîuÆiHà q–^ã8ÌŸ>o!"="¾å[½†¢"SÖºþnŸÑ#Ëå¹¼PGËPÈ1Ù,E"ÇyG:í´æÎ÷0ý¹z$J¬ xÀo„…:f±ð™µm‚ éø¼MI"H v¤ö®òÞO5.ÅpÔ]Iœ p±úJžœ‡]H—ýØ$çO¼ãóØ`vNܒЉ¼â†ƒá•Gñ™®Zú«²øá·(«†ù·ÿš"à -RÈrdKÚ*Ÿ¤\*9f+2æúpŒËlóž°I¼/]Ù¥QÔA‰Ó€kŽ Ÿ˜¾›lq Ç¢ð/Tg^:RvGà˜H…ØøH{Œ“HÉ îd×_³,ˆÉ‰ÍNñŒÜ< xK
t¸»8‹ðÿæ¥
¡Ë…ìdíº…£— Qá@ùš—` ãSYN§2GM(t–¨Ñ£äÌ/¨ñ"Z«rúGÊO‰Ï‰^²ã¦/%›Ý‚Ƶ S gëiËOC( :å÷~Ê4Ÿ.óÊnädy«‚c˜ÞÁýRSæ’"© Ò Ã³ -‘²4‹g…ÌÃv`u*“ä¹àð³_˜Ì) ¬}©øæraÙ*×;î;»› ¼=nâ)MÔ‘LpFäµ\yå”àúËôá8Jy8¼ºE g³!DÃÛ#ë S$)ú3Åîå¥Èoé ú'DæƒkP¢¾c hL³`Æ /íËŒ J¥Y¢ß»Æ>‚Xä¥R”/ …ÓZíÇô†ãLÜu:ï±÷"Ôz¯!ÖŸÈpì“;qª MŠ•…©• RÈ.jêEäÆ7Yã)Ì×ôVK„vvJñn¨ éÀ/˜” _èÒ×E6 9 zfŸì ˆjxSp‡M˜8
< }ÔL †PüxT JÜÆÛo½Á9Á ÛiWÓ¢|NsÍC®ŒŸ< /ÎKû˜™¨»††¤+â‚ï—¿°0Az{¾N©8Açi ³¬¤wkR3Ü´pÝ! ¨2®É9Zdâ~WÞ¦ ]F=¢(XÌ ™á\¨‘_?¿<yáå¨ aŒ -¢°cmí”(¥ƒ¾sÕD¶ пû°-
ÐSJC_7æšø^Œf鄺©sŸ·:%/Ò‹%‘omoC>…üÉxÝô÷éOBÚ÷FÒ0® h@ Ë‚ká pØ[ÈÛý Nm‹•=sÙló¶ÿ1 Fä0·Š2ªâØg
gyGª]¾úzÿÍUaÀ ¾W¨Ï…—"³?þ¦«D·°ÁVVnŽ}ï-ôz`ȼÃÛú*WÄÂm/Ž3*܈^ª>Ìš… ùfÀu*´Ó.£È“3O×Çï s/C6þÕRí¶p¿J Küh€GeŸÆMNb¼ˆPr’•‰5Cøˆ¨‚bͨÍ~Ò´ü!Ù÷£@e=\ûö@¢ -!§âe0ÒwyëÅÄ›°$µ«‹q.wà6;}Ø^Ù¸í(R -/÷¾Î*ߧ›UC·H®Ðû%
3†×÷<Ü÷û/š%=QÐÛLæ¬MÍÜ+‡¥B¤Ki¿ö¯ÎÊÌNlK¾Õl™!ø&KJp® ·[éµ_Y&•í%óU ¹«¿ÆÜ[SÁ>æÏ·7[8xgŒ ÝU抯 #Dýƒ¸Ž:ŠÈnåU¼‰âz"דø ;“„FCϳF+õaX/b»á„3ÅÖìÀ=#>J…dÚJRýßS3çÊ”!‹)~¿@ÓÞAõ2?d3òÊZׯecŠWMi,ý0]y8yñq±§‚q€ËÉ ûƒÎAfüÆ_þS‹1yM±Ù-~òns%þwèO®úÒõîg¥h±êû4DÚŠw-fy^×Ü€‘â^|,Mo±>…2eýšÈ ?ª”¤™4DF’ -;å¬&¸P±öÊ‘>çÂ’‰#¢!jϧœuA`9‰ GBÇæ§Of• -wJÔúB/.qfQäXò‹›b¼¨)¸"Á,ÈítcG`Å«ßn Ã7&uù;eßÊ
§N¬º[ü\™\7’M¿mLªræ‰1Þϵèl H 3Ý!r¥Z”°ÎT ³¥/EÐ aß¹;™¢l¯:¶þUîÛû¯Ré6‹@eQ¨z0Úõ'¾ù YÓ(UY¨o®&lv4\ÄåÒ_ɪFC†ãñœj*?Ë‹Ëg~"¶!¡’Œ 3ùþ:¸äë‚"¯=Ag ƒ¿| 1Ñî7öC$¾ù÷}†?¼ª¶ ~ǒ稽²ÄôšˆfÎ ¸<—a¯¸#"tÑcŒe!èË¿ŽŒv.ÛõÕzµN«Xí“Ý™ N—LbF8ÏÕÕ4PW¾>³»’#GÊdÔëè3*æ“YŽhd ¨ ú®šµ±¤Õ$ÍÁrR -ã:I‘ì×òõð,°ˆ²ám©l×曼½€#« [*A¢¢U‹5Uí³õþ·¬üçápM#Ó2O(ñPWSxœ~þ‰!_¿ Ú»È.s5%Ú£30ÆÞ=ôÏI¯ÛI"[€/nAq‡{4}¼ã‘Ôþ‚š-Ò)p+ÐÞ„efTZ@¿¤˜]ò×=ždŸ…±@_ –{سÆS2{*Jyk/Z<ü–ù~õwo/¢l{„͘Ï]¦ý.ß®ªFÝ©e³§tH‡§/
Ñ™Äü¥u[Ü׋©$ŽáÄÄëã,UFÖ ÞåŸ W6Ëj›¾½7æF7ñ
£Þçréq¹'Î0¿æÛVÝRR™$ÙÞƒhÿ7GÒvÕñ¤®ðàäeïËÜÛ -FñÁe¿agöÓè7è—‹Þ|‘Ô7ßo×M…•ºW€‰¶•ÜËKïØ‘ƒÅ2Œöý¼iFØ6ùÄ›¦«oR²LAJ7Ò'·#0ÍÒk²ó§Ð(¤ñý'™_Ŷ‚ú°ÜdÛßdÓÙ+³Üœò´õæyxáK/ìj!T>‡ (FÉ>òþ‰VŽ-®yô yñðÙbþ]s¨C2òù¸2úÐþUû¶‰
²DjÍÛ#) ÀT+PØûº(T!Mð%tÜÎð9Cñ <Üí -xýövB¶è2bJ ®ÌLÓY>=Vàr?,(f»«iÂúŽü›NÚ8ŒÖÝô¹Ëº„ 0Tvº@ý*‰’(ÿªÝfEBZˆqàÖ©À6º Wì¸Ö÷d¹C6n¢ BÔ*Ä"ßk° I6”V³6èô8ÖÅ.,O‡lÌÀ>“#\µM²õ!HèRåƒmcü¯º¹ -`ìgcxþôaÈ9P|ŠRm¶£Ç"`¡²'“ŠÏÖFMŽšNyÚT
·oe ¬5<Ã-Ö±Ó—µ» WC¼³l„†üÈӶ߱‚$â[È š¨Vp~#B¼-Èä˜åô0RF~Ü~g™xò‹…že††f@)‘ 9! -90š Š\ñ ‚³„tŒ¶òj´ÅåC–ZÝ4}iÔÑ™ÒV{ qÁ4^Ág×£Ö*,Úæ« Så=ö «j> n€'*S%:ÄWª˜w¾F¶I¤áýaXä3B¥z>Yø\I±DQ ’Ëx嚌ý:l¤*ÊwAÍÔÂéjÍJÕ¸\ÖbÉ åÏ,ø06”6†Ã -O†½Ð¼ÿìát»¾£â†¡þ½äÓå`K:JDm’êP4o變o݉4-gÑäê¹ð -"ü„£ÐD‚oà^b±IÁ÷- ‚áp,mÕ8®V¥‡ dØÆÆ‘ü%kû¹ùð· „· ²³Ü¨7úüYCµ%Ý éï±³ëP7 \ây<ìc¤ LšeMu ©Úœ6²†>–\sý]C:8yB69æd‹)‘SbŽ)Ì:øL€ãŒ_`ùI˜-BN|ÇaD˜r>g0k&rIöXkæ ”V2øÅ/1™‡œëÓrÞ0ÊÒû#䳜Æg®BAÓK°™“„JR -4£C!µ*•Ò&Ê(aYƒ?c4[¾›÷>˜SC_¢?5›¿+Bí÷Ð.« ÒëRÒ;_öç]bŒ"fT·Ó¼À»š¥‘(• <mÖ;ápú²49¡“<oË¨Ô -ŪpÉíÿtùátI -†Û*üh»(b xW˺~CÅ ó¢”$”XxèEš‹ÖùxãÌ1I"Ñ3ÑÞÏAÏ JbÚ)—½Ï¶£«S0¾ëºóXD¯fÅ(Š|d×egªZO*v oÛãÐX:_Õ'Ôi¿{q:?·Œ®í%Æ(͘¹ÄdnR‡Qo@N©>äš8<å¾ýŒ‹Í³Oˆ¾Ð_ô1ÀÀ‰)ó ›sÜWȳg VšÍ -qmÏÌàcEB°†0æª/’/N?yœÞßþñ“—³qTј :8 yA«ïïºáή“hÊÌ-€PͪˆÜÅeån²ñ éf%$›Ú±“YnyÅ™ÝbI Q~_™¶oà&r8›[Bž
Ài'”<b.DöD–;†Ã4~LOìj“¶“#x0Vªžúݶת^ -³à8Š/ÝËOþB¬ºc½NÅöT!´ìX£ *Båµû9á+é!<«
V™´u4ŽÌ×ýmçNËncéDŽ¨= ÑúV4HbÚ˜°2‘Ï_êÉL§Þ–67…uÒ¥SÈxÒé: çÏñWÎÏ’Æ"¾®…ßߌÍÅíb^¡BŽóá!³ ¢;ˆãñ 2¡Ey.˜6”•>‰æ9ÎÍôQÃâ -Y6Z*óø+9#«8wØ|¼4N|k%;îˆ"äAçbJ]¸ø«Æ÷‚ÇT6„XLäÝñº4g]D9D•F¡7a‰çÚž‹”b|ÍeJµ+j¯»x*]vÍʧե º1`7`e‚>¹ë;¨ª ì|cÄÏ}›åÎ/ÞoÈ l‡ÀºñÂ3ßçH0èöÚ -(Ç…¶jÁU<4õÅ‘¬°Ë¯ —ršWߪ
¥È‹F6j¢×ÛÀÌWñ áÿ‰M(LóMEÑÍ<¨í—J+„9 ÙQÎ([ÂpRQ‹0CgäŽqd?§WE;wÆ–…¤†${N†³v1<«”¾Sp N¸!6=ç,ÝK ¯Ê:ÞV+*ʻ࣢P†]ž‘5ÃÆFS çÚåÍzòøÛOª¨GîËiÁÌ!ÿ b|TØÚø€ÈÄ1e²{'U}f<`· AÁk¥¥Ç˜Íj~¨ÎVÈt®Æ „°¬íª´Öé k^HøÀ?5h‚LùF'öÆÖƒ&-¢]\<üòt"e¥1/U½Sõ ‰c±Ç¸Ùæ¡®jè1ù£ÞÛyE9“Ÿ'7šÍ4l#>´ç`xÈ - l ®Ö/ÏŒ…°ý<ãÓöxyõå\¤.çé;ãËÃÚöø¢·¯=‡T†QQ–2a ŸF9¾( ²™N™(Ô‘üNa}R·pf¶°Öz(Fý‡ù†=èÕu¬¡RòX14)Î\DJjg<¿óÑbÖIÙ|
0RµR—¤k¨EÙï º Æ Œ¤ -í ³|Ïõ™œHa™€4ú@»ä/ú£sß· -™#+.‘]q&½‹«
hJ©T¦:Ó’Q!0
`9
RaÏˉ'·w¢HÐ\z”Œ>Fˆ} -sf³±jÍ2‰ -.\R^æ•o;gV;§¿¢¶Çù‘fbîI$c4ŠÕŽ"7%€NWãJÌö,YøQRJò Í6 ®Kä‚úärSÌÇB :¹õm°S·Î’!Ðu¤ žöºÚÏc!–ÙÆã|€TÔa’±dsXA’¾ç ß)ÂèÜ#r î_£Ð¦ß¤¤P£¸$<™äE3*ÛóŸ Û¥§ÈAì˜
Ft‘ 0í‚+'+yÑÔð¨èYÒº%?5Øe=¼\}ù“ƒ%˜Â)%9EJªÛªùq2ò¤F×@Dn©6봼礜O}Â0*“¡²^ŒJ¶i€X°¯ÀIOS9 ×çúÙ}{¡Ñ+Ò¹)Ã%¥f2öB +è!ŠùIXllëòè&Êg"ë~Á:Ýö”:Ys§>j¤¥w- ¡/r*ÁÑ£¸ÏSø°‘³VÃIvõ€Eë#¬Ç†Áâ–1F$~„}â 1;yV®"vÆŒ;gR~ S ±ÂƒŒlÀ hràE¨;:ÉÏ3ÔÜ>r˜÷ÇÙ 4upcñT·’~õU) -‹@Mcpƒä½‡×µ¶¡ŒËžÉò`™TîPm/dÉ–°ƒ,¦‡ú\‚јýÎIä›îsß ¯=l -¦ÜÞ°éˆÝÜb_ZFÍ’L”
ç“sÂgúœÓ›”pzŒÄ¦ðñÖ÷µfi ×V"¬O¬:·Qîã ~®ÃZ4ÀD/BEƒm»á®®²3ÖŽçÛwfÍÌÓVîÞ ”fîmY’ìAŠÚ[UGÌ7¦6 V·hûBÔ@ÛC¥Ž¶ ;µ'úÓØý ‡7ø×âÕ„OÚ‹¼r.±|¥Tý±ŠLs”ä ¿Ìf¯Ÿ;ËUŠmK¢°õ©5Œg
½C¨îÐÇåª#¡L›q’Ý3R²¢?ð/™&ô=Áôc Z4<˜Ïm÷êØz«ÈÇ[Ý B¢òMÿhäÖl§¹Ê§œ²íÛ„LÖ±x¸•A û™[bv¤uËE0?_|O
Ô×ëæfB¿{§$íÅ©rŽ;÷6þÕµž:Ã" ¡&§;*\U„jŒ§Êž…lÙ5̳HU;ËYÂD™0œÚ7Øl;½¼é1Q‚D½±—¢IíOùʈ¸ ƒ -b´Îì(« £IÛ{jú»±Ú3í½ÏéÒªXÿ|\hÝ™#XòèŠ_^—7ÿlÅx$×ëËrÃKÂ'”?õ[õÉ¿—°QÓž¸}ƒ[ê!&1‚4Ah LêåSÅÜ”qâ>XâîeTfO®\pCÚ ž¿òE?àã˜fB܇Žrm3eμW_Ÿ±ômšY7Fv Ÿt¨çÔDƈP.=Õ"tHKÆ‹.‡4›žaÑ!ƒêâÖ_Ÿ“WJ%`Fµ€:¬ä:§ÜI?ôw?ÂÚ¤¦ÍÛŽJŠíPúþeCiq¢E ™w¢n;³‹2HÐÍ'a*àæíÅyîøn°˜š¢Ïa2¯~T -‡}ºšíPøÌ^Ì ã~9|t=Ž%ÿ©øóÕšÐûäâÿ×âÒöµl/îh¨¯šs±º×Ø¥T9½ÉEUTJ–@”ŒAQÎ'4XÏýv;—uS]Ss½Ÿ–ÈÿàÆF`‡ãŠé+f¤þ[¥ebǨ‹åxŽ‘Rñ°<1?FQkáÆ c¨üè#?Žþ&.-AöÔÐ[(CàÀ¥o]ô¯½þ œc pàÈn÷Ž”óÄÁp˜,\’@|†‚”Ö$.DS`X¦a¡™ðÌà,(8‚Ùvãñix,?"xŸXéT–rÖ8¸–+ÅÖÚå{fÅÄ-(6¤/ÐKwäÙùd-ptÈÊq2?àÑ‘xfß|ÈÅŸ¤F† ñ2òjÑà9tñmÞ1B4‰³¯¥üúUŽäµš[wŸy<‚&üš 4ñ@Òà%GòV·žº·Ð.NRé´KóÙš$ŒÀùSN¬m[oðÝlˆÓÏ#92+úÇ?e‰×WÙ4Øê¨5 \ÕïÒ<?§yžvcÑþÞ)%Ÿ`ViWbù€ÂÔ™
:=[ŽÐ×¾¼f£eìá µ0ôÁRÀ×QEK0‚-IÃË®ëLÄætv±™«éÛ–Å:Ú–¸9c ‡_>6w¡íð( §¬íìàò‘ £}1tUüÖÀ_€>*'ø’ö ‰ ¬ü¤éÉ¿8*îÓ—¿i>À ÈÛÙa8mù‘º½lØÖ ZÝð{Xþ¨Î¡»c’P1¾  ©e«Fm¦6Ê¢øð„§£0*£šß—L[NË|äm - .ó)¹)ÛÍߢßÏǨ8Ë—ËîÁÎ ïÀCuR 5‡ˆb¼¿(ã S]Z Ý+ïa›ÒìÛ þk ª_YGëVâ ïbaˆèþmmt/:ÅáúG ÒDÄnB{²Ø?§¯1i¶Wéž¹5»/è zú¾éWƒb#½cC ù Ž¶*_6Kªsálssy\½mQõ·]»p¾Ö´ßcÇ"çxÓ ÍËmõv€qËdíy T¬ †eœó÷Éc†Uï»ó˶—«C® Sè»XlÔ -Óu Å l– Ä=§‡ÎóliŽµÏ®ß2@A7÷Ï4.¢” K{[s߉Ë&MÔ3V¤eå‚Ÿ‡´Ré8œÛçýwñäìÌR5BÜVxÚï 6þzÌ(î ½º È%Â3Í@½ºðéŠúVªI%°ð&ÄEf©¢Wÿ¹Föô"ê/-or@zZSö<Kl¾ Ck:úw9FŽãqUk‰
oµ€Çï´ÓÔ¢’:(d›ØI)FQïŠ&
Y‘5²ÀD¬ˆá '³ºS¸ªn0%FDCÛcŒsÏn[Ð Ic; -›u*öctIñ¬'2͹Ù>Ëk»¿ -–J3ðMÖ
£«ñH¬a@¯œÎÉ÷k®?s½la `²ÉÕÀ ¦7"+GQ ‚ž%ŸÉ79µµøèµùÁþ‰˜¤–ß9æ²ñÓ.éeØý‹Ýߺ™¤/ÇN¿HˆÓ$:°øgL¯Œ=ßÂôäuå¥xÅ…¥Ÿæ‘ÙjKÍiŸ@·©.å8Þ"ih«Œ›èµ8!
õÔ1e± 1'‡+0É]Êò»l)Ú±©S…â ¡¾q}lY ™ø 1¿§M
Ç“«¿¬Žíì²:RÆ0ÁØ°§ÇáˋÛA³†9´9\v~Ë–©aòîo=ù"‚êÆêë%á{3 Ý’Õ® -~J]áÿÎaËŒ¶Bؤ™¾oÍH Ϭ„鲉®‹¹.ê—ë|ù ç¾0ðòœ³xcÚq ry×ïІݸë,«ÖÃïï¯&3sDÄžíÉþ¾,0ÂY†û44ßH¢3ÎÚ~%Ï¡]óŽî6 -à[†#NÁ3ŠfêvߧqëX¨ÍÝ{ûeaÖQ@ßÍ}kYzéB>_¥UÍ5îºÄ7‚ úÊU¿Ø‘Ø'+u7»ñ[–¶ûŠ†uVÉ„½x]oøŹpQÏò+á]ͪº9Äß—cÖu - ù=€«ªû%ýš²B»¹Øœp«îfq»sGTÌ•WÒ?–9´°$E8¯—Xð‰jU·«pž[…þ0&¢aoìÏì+²K /¹+9ù²g+ ,6@^›¥Î~R=Ïi</BÿºWÂÄV/Ü›åÓ<6e7—ûý„emP°{Ñ4{æÖ-
Ò‹ïJÿåAŠ2õø D[˜éWºç~÷ûk]àÉTðÃW¶ jr¶n=]ƒ þfŽuõ8Ö:¬¸áÈ[¢‡7ù«L ·#Íö×4Y|€¾S jènß“kÒünIçØ7¿£o(’‚&²:ÊÚ1á¸
yµì{5þh î¹gz²r”ÑVÎÅPyÒŽz ôÑ|N RgÀOn.øüFEÞƒq”ÓWf?l§:nÒú69ý… /Y:²}§Ç祲î¸6ìÜë7az¾3&4ìžþ° -¬kr ÓÄÇr} u
+Ü”¶Ü[§ûÕ–0>Q„…¾Ïr¶kµ3ç̼ê7âéL×»:2ýõ<—‡ÌŸb®_>-z˜Ú‹8„Uåg'²¤UuŽ€mvf»ö!úΓëJ›ë²pZ¾Õ9äådLÉ–í”° ªú ªä7¡Ð>÷ìjFWÄÑNƒ\¨GŽÕïí¶ëÉ„+âëÐ&Ø¥ŸÊª?á°0²|Ÿ³n`³¡ñʆ¦„Ëz
Çî'¾Ekåh%(m±®TQþM˜¼îÛè¬nBAá÷¨–Ðh½71ñ] 6þ¹£Åa°–¨ ‘£0~˜ôD©iþÑÆDÉD‚ê²ÞÞ“Ô«%N×…b'Ýsãc›pC<}oC°éŽyÇQ{²œhöItßÇ`[i“ä«kì}Æ5bþS ›å“?k{뇴ºý˜üyý÷Rfê·/ßËÝvÖ9ÔÍ!dôQûó!á@^Ĺü4ÆÃÝ9&^Ð^µ
GÑKŒ±,&÷îd+z.ø!IÛÞYS¼A¦ùWmM,I Ðj€æ+|“¹o&ºæ‚´ÇóÁvÎý4×V×KÏb¢ƒêÏq{Ó¸R!i0a7ŒQšbc©ä¤eÂy°X£vœsÄ/uÌ@çÀ1a}#¾:ÒÝIrÝ_ÿšÌ4@¸#ùO}*ÏRÈZ˜»âŒ§wŒbüíô¾0#VŠÈ´J †õ„ïcÈÎ2r<ã;Ä¥4<R,IWòå°^¶˜/½o+JUøê¬Â"AG†¼1(Q|ÝIØZʾÌKƒÖ›þÖƒðÆÓ9Þa„˜Ì ZÀ%EÄPsÐ ’ñð}ùsÔr¬æ_¼"šØ¡ƒßa » /ËQ¸xV]ÇŒËÐ> -)œÊÓTU×ÀŽx(S•ü+Õ˜ºÉhn6÷^ê->97ø_Á$k©½œð––RYö«GÞ.²(²Ó"ž,‹ŽNWa¾üê‰ê˜*×X2 /¥›ád:"!1¶Ò<7_ËÖÌÌ.j'kí”6!À -Œ8¼TŠRWæâ9í.ž©ÖYÈ‘€ÁÁØ2ñNæäüY4Lᯪ|˜oc%|äx±(··èŸWò(‹xiD,¨Þ Æ›hq‚³Ë ŽÝª±]Bž#¤@ZO¾Æäô«‡‚½}p¾Qv%Ár_`£Ë§ôQéÝ/èaÅ)ýS;.Ì)Û²ˆÜþÙx£›1kÞ[ª;µÚd¡oÞ°8[¡tÄ6Cí;lv€°D41¯å
RÃ(´Öãí¹ æ»kr8ûŽ˜ë¡lêo
að°åf& -.$ƃÊQÎO/UŸöÑ$2yÿ¢Ì$¿ÓÚ£Ž?߆\M$]´áõ˜™! áÄ3¸žjIœè½ÛÐÞy ÞêœQxu«,Ã1Rè GÅ}²¹é.*e¬´“gS_Þây\˜< ~Å`K ôsWJ{\|= eü¤yÉŸ ŇÐúšö©>|U=D6ÒB3iƒJ›ð"-©Yå?%ß+æïê¾Tp.ˆd)¿Z8âÇsDFO,L%• !<ôKæá%L)ßHõÓŸ¹ ?¦#ë˜<ŒüKð<ñ%§./½<T¹$‰3KD rÛmþèa‹±gy «ž
|êÚY"en èiA/ G.hŒ2i´ÏËJá©uˆ¯ØM. ”A˜l;E™¬÷¨Þü“:ÑäjÇu+^éX¼ðîQJ÷Í•ó~ @)ñ3…àVþˆÙî'‚¡2ËQþKéÎYšØ…¯Á”¥*W]LÔ\(}I¡-”’ηmIï]Ó'šATàãZÊÞ=\r¯…ªmW3T‡¬:ÆГýpR%TvŸû…¼—Ó¹ú½”Ï/ïè¦v/{½Èñúéï%7=A}i^…·q âºwƒiÈÆgÑþõ/¬ìÌwD¥îT“]CœxÖ@ý«kÙ‡] »}VLºÇüe6Ë -ªÁ ¡1”ÕZÁ‚àˆ=ØrB =-…ü> -!?Ðè‘ñ—Ådf¸÷•Ï±ÈÎcÓñÔw—
Oq_/0òkxLu\ÎRýZ«ïüd_¥Á¾™*˜Ð‹ l^s>PWêѦæé—¸y5×yÉÞYš¼jli\aÄâ ’šÎí^8‡/cyÜ}g‡Œôô_Þ‘òïªðk_öѨr.
ã -末vß,ybÓœrJHÅ#n}{iÔúìæzfï¦ÏAoéú2ºÞ¶HG.‰ùq6ÐóÝSdù Lè²Ä*öåpÑ,7ĉˆÈ, 0šqDµqœ¸3O§÷—'H<q»’›êNœ ^$q^ åTÄ€3–‹(¶^„?¹Šy Xøì²Á¾vô¤Ù>†Ó¢WÒSÏGuu]„††TôöÊgäêÔ” 3Þ{§tRÌâdh´š[½*ŠOÍòÎùBVù¬šq21N{›}×~LܯÆù -<>ݯ¥h<òÀ @"«
ºØïÀ9ÉÔZɈ”òœWÄ«ÕI½†…*GIÛ‚þ!T¶þ k„à •[“|<²…‹Ñ°â£%Q®¥/ ºÉJÙÅIM.²«b¡ÜÞ†1F)—½¸J ¦–oMùÎØ‹^> +'ø‘ï<¸ëÒñ-¨ÀÿPÐSýE\üïá—Ù
Qš:>° ð"0èV乊žW,¥ì_ãÅhý$Ù9¦ ”/À|£ZÉ<ö–Ê‘(ÅñWµÀ]›Q8 ªN“Ã(~ö¾}:-]ÖjwÏ)áÅ@;ÂŽßQ®«ÊBí”èÚsã,]hÇb:Û—K)4çŠI„©ò>Qõvªaì0±0Ÿ!• -@¦ðÛÒGì+œé;D“±}¡Ð—ž~µ -¡?ôèMô©ê==зÔf®2 ¶‹Mªf4ø/ÓäõGáK› ”ÜZÕ†§ÓSþsT:ÆF)¸ÛÉ=#|2õÊ’ªö\:`¤Ú¼îÂKÉÀÁw{m
1ÎSk¼¶`ÿ¼6KÑôüc×ýhºÙ3IÜax>ójÅíõtããl'‰î0‚à‡êõ˜BGßÅΦòF›þí´º T\Eq©S1r551LñYADôìå…_ˆ²¢ÄZZ -¶?¨žC$‰ë»y„kˆâŽL<±4–þõ /nKgÓÒõý-ÏUÔQr?S²QÑð²Ž5úÁýГ&Hë{R×î°â'=ä÷
hþp·~õŒBtŠJ©Ip ãQ¼R~¯ƒº ý ¬ûäŠÂáWv}¹YʽóëtÇÈwàe"Gx þj$”mÂëeÎŽ¾ê¸µ¯4c~:ŒÌ7\ T-n×ÃO-ôÖ›2f‹§+¿ ªýtÀÎtnCóí/é
8¸(8–f‘¾á• ¾/¿ÑüØ»e±Ëî'ݱ՚Ûïccp¹é`”;˜A®•!XŠ$zȪ‘¬ok¡u㉉„ìJ3<ÛÝä%Ö©=< ÏÏl§Y©Æh—!H‚z6÷xˆ9¹Â0ò‹±ó§$ s«…rü Ýv†AÓÁ´ÜtÚµŠ1ÐæêòÃæ¢ì`§a´ß‘^dC>¹¦D"Šô€zÒìæ/AOÁ}`Û%þ«\ Ø[ÉÖ…ÙuÜíƒi“ÈG,djCÕÁñU¥ý´ê[¥!ë/OÇÞ^>ù¦ýó¾þ¿XWm&›ËŒ¥ù¸˜1gèS¸Àys¯ƒB÷ц7”q ýCIvcØV«Kçâ´ŸS”JÚ*¢Çõ˜,}¸ VV
”iײ÷8ÌÅ÷Ç¢D3Œ‰¸¾Út_/g¬"0ÔF(YŠ[fnMœñqb/'%€o¶úú>"Ñ2.~ Vú*¡qèÅ·@ò:ýø¯ô -YEÄáõj64ÍÔŒfÄÒø„á -³=Ö²%öËÿBy otµË{w>ÓŽei -"öpfÂjZä—‹ìêéóäëêg¯Ìû=aÕi6ux‹²cVþ7èïå–5“ýÂòÐØÞd
¯$}„bV¼Ú[ë/ƒ˜¢1Rçµdwƒ/˜L#©dR£W¯¨™$m¦|¤$:{ý®EÞw†MÀOüáMtáäù ¸ñ6a´ºB–Ÿ¬V¦çæy:yц”! –¥m<î2w¡X9-]Ü V®ÌºêëyG;ç©ißÝ; ³‹ö”gþBØJ w„h4û¿Á÷rŒx™ÈÁ»«<?…ÿ“÷Œö°3Þ#9fÉ$'>¨£Äm*Èövh¹—‰Œ8êÇ@Ú^o·tEër_— -îj1q<„I²žI^L7bfD$À¢¡ë ¢1õ%Ó8Ó
"¥›<øp#sû½åÄÎœ
÷KןFŽÿePþ ð`á`eæêîôÓÌÕ å?ÓØa‹endstream +/Length 26183 +/Filter /FlateDecode +>> +stream +xÚ¬ºc”¤]°%\]èª.uÙȲmÛ¶]YV—mÛ¶mtÙ¶ºlÛÖ×ï{çÎug~Í7?rçDÄÙ±#ö9±Ö“™$òJ4ƶ†@Q[GZzN€Š¢š¼••±¹4¢µà¯™š„DÈ hàhnk#làä¨Â@# +Ó¿rÐÓÒÿ‡ÑÜAÔÜh,oîhd01°úÛ§í*6Æ@{+sà_=ÿm%€†žþ¿ù”ÍÌ,mþi<˸€6Æÿû_‰þeN'!§ ¯.Fõ¿ÏÔãäÿjï¨ìf÷—Úÿ(EÆÖø.þA´uxÐ0°²hÙ™þ^9F +4‚^ùckÄh‘š‘æX‹ž34!¬Õ×à +¥$T³ØÄ^×âs:‰¿„³Ót»©È i+3«0€Ö~Z¦Ò‹Áº*ã¹®.òzbdÄhn“<£c¿§¯ +ë³ü>Ëä1os´˜™(ÏÂß_Ø⟣ +Üiv^ëå‚áßcHdð8âzî‡ù&v'ö@¹ v +Ý}ÈâJK3î„ÕžÖ õlµüÁçÓDÓRfd‚ICÖFJ$GKó¾¯D˜ü‘·vŽ+À$kPS öc«¶U|R·Æ
‹‡hX'œQýSÁàØœ¸5£ +•LŒ{Œ›h1X+ðaÃ1©GÌ$“ñ¥l&HÝoÿÃ5Ÿ©qΧ©uAÑÇÁÛ9 +.ÅÌAK¯lrD‡2||ÀÞW™òqo ÅU{´@ÎÜ^ËÜqøHΧ6U½SN0} ì Šz,sE¬˜¶a;<Zt$N}Dzë³õPô:–šÕú . Nž³¤FtÈ¥Í œhR=l>eŽE/Í:P–ÒÝH“OïQ\ÉŒm–Õ›ÝèIY湪
F'}P¡Éô”ÆiR¤ÞÑî •¼Æ-D1dšMZa·ø»ooÄPe0™ù{à3X|ªÕ(Æ5rcˆí“ªCch³Áó€n']íõ%®$Á÷pÙC$äg´ž/qº–Q„¬{kÐÝy¡ »ä(örïZÔ”*"ILÎÑŒè¹ÐbG. /“!C¡U†RmÊfB, @²¼NïÊ;ÉE–•@’O} 64jÂ(æcŠ +M
J9‚®»˜=¾EMì¥Ç§SëøüªæÊgg æ ·g˜èô\ %#B9%´®©b]c A=Ô +‹“Û,o2ˆC½³Ò=ÙÖk•/ØØK‘ÕœƒjŸQªÊ„·¨Ãy +@†Ä¿ØÜô H ¢ì’×Z²øPAçGÆKX•©Èë7ÿŒQŒ±f´ý1ÜF-Ùw|¤ $»\ÃD¿‰x¼ È€Ñ"õ†t?oånŒFÖÙ»s¤‡V@•RÈ2Sx p]½ùö]¼¦ÊCRë
" .zî¼å§ð©PGŠŠ Ôƒ H>öé%WÀD|rÀ©ñËE`…zôGfìí¢t•„9—šÏ¶3Í7„ ir6s¼ŸÏ‹¼Á†(»µ›œM•_Ï^–8%ÃÒÌh<TÏø<G‰& ž ÕsŠŒï}x4ž"Ø`ñ ã?70„029t3™aŒh ~Áع‹&ì*ÇcGí\¤Šn
<_‰HB÷nV ^?z^
6~ pÈ“!Tþ( Q4Î×"‹>§Üs: žlwÇjèQ›–óž…-á’æØŽ¬£öI:(i>·QÄJé|]ˆgZC—º’¢0'¡Üœ ó7Á¿†pyfã ÎCûâtˆí&ž?¨Ó[åÏ蘚ç>÷bE‰ÌiòK)¿Oµ…µËÃmžÒÃúÔˆÒÒ³ü}'ð– ixiª ûÂcá‰|^"íÆÅ>p&ÄñâüGÚ:[>´ŠX>µlºZ‹ÿZ9Ð[:ž}€Àe‡Fk;èpO ©¿=–õySɱ¤T‰‚í)Üs<ZvkHJÉ=žEFék
Ê[} ´ÇHeˆ"y0OÍÁJzÍ
4M¬˜×Ír|L_hàüKå[ÃÔéê…ë˜Ùc™ØSF¶ Ñò]ö™c(Î=©à=ñÁîEù©y†øÏ$¸«]K¶ç…𚵯Ô>m%¾äËï¨OZ¥8!'Ú76
Åuþö ÍqCS) (Ág-˜¾"Ÿmå:ºWV¶õÇ/ã |Å Y¿,F}ØÛu/ŸË¤°¨570]ç 4eCØ¢Yøí–² ó—Z +Jë Ø +{Œ¥«KqHM+~ ÏBO¨Ÿ?oiµxÍ+«7g7[*‰F]4HxD½I·È-÷€ðÚѦîº-v€á*hûT°ž½ g$+ªíá?t"+<äµ +zÒ´ÊßÇKÙ’«fÍ¡Ù”ø…È^fx—wÝ¡×Ú‘Q!·úwxm$,
ãûùyïìC8 @„S+®dtóWÚ³æѶ9ÊN-*h³ÞºE¨‹@åðòuAIÒØždé°&#t›ÿ xªÅæQ§„
ó +9µÝ.Ý0{Z[Cdiî×É!âOø^)kUIÑhäëºCiµá{¾ç&KÚéçýoû›Æ îZ—‰ÜËlÓîÔù—6lÂKR:¶;y>ñuj u¶ M¯²á3Ú©*cð!¼ cpäï ½¿§$+7æ,ÌŸ; o&ÁÈbÓZlÑ~ËwÔ»¤¶”Y¶ˆ~ÂÞÉ)X‡[uçÌSX‰&©ìÈ-D rÄ-‘7Œ¿ îV5Û —nþÙÓžÍÔÞš£÷âËì›tŽƒ‚õGQbEˆD>¤*꯴Â[@ÁÖ5Ƥö*>›9%§úýD HÔy µff3@h?L;¬îFÂð¡Íϸ/;*s ˆ¯cOåU®BÚ½/âAñ.kþÚ sHFC®Ü¨¬J½¯1þFn^×áöƒ¿¢WW)ËNV¹ŸQO‘Âömœi}Ü8åÑñ¶;áî=Ÿ8;2{¶†^Ü óJE9£n(tòx~˜Jþká)5þ–ÞBʨnŽ8Ʋ>>•m‹jS#®YR«—Í´…Á‰Ù\ñGkï¬1_d:mN;ªž‚˜"a’žq€‹©° Ê?ÌÐÄ#ìÕãÙ {½=#Ç™‰¢Òò¢äè{¶Êl¯=¨çPÒDZÒ‹Ýlļ÷Ù-:ñeD8å=ü*$YTÔO½xÑÜúÜ]µ©ÑÚˆ”I5ãþ±×©_)ºNÈ3¨6«äµõ«‰Nó"äD1¬ù „®ê0ö°7®<4ö(Ìuæ´SˆQÁ“pR/Á®E©`SŒ^ôÈÅÙ@D‚± ñ–§æxÌä}ú”:»º¶¥uÒ pp—§QÿÐšÓ +ÒÎ&rs¿:Ÿ° ôåÌÄÜÏVèy.<Ó!f•ÛËiQØg:0ÖáéãÍs_E©3dΑ¹Ÿ:A=Ë×8‹´dÍAƒÊ½ ïêÛRØ- À×SÄÂ'ãBØ\eá~›"›ÙRrD|©}Ýÿd¯qyIÇð1ó6§µ(‹‚hQCÀÛ#÷œ— é[6ED€ó‹%±˜úÍ<ZL9ÉAÒê“sõ“7\wêm’’¹Ù·—¬˜9ðwב0Êpø¢Ày&NߧBm4D”SD"«4*Èwît£ &ˆÞWÄŠWÈžèHÌËKv3†;a4 ¥QoÚ®ÓA.óÎ`L›&<v×2•M\ü;C‰ï!Uê›^e_Å Ú*Ù³ä_ª¤Ø¶•ð +¢á`7z´|„yð•Ý™ íýîkn:ð ˜|—
ý +ã;[Ȳœ]P ¿“ؤ¸›äNßñÕ§Ü
ÿH¬Ù|.´=hÄÎdr †E#†UPQE^}ÿv€ê¡þ˜(#û¢2ôVÌìôü“£
βÄÏcH®çy³>•q‘óýÁµÚi¦týL6OcG!,çj§eD =G83˜ø®eÁ鯑´^4ÒršXýŽ2Nä@È“mï†óD¼ <ÔýÙíŠÎ±6øpv\èÚž”%¦3+è¢W,K…êÙœçEÛh Ãï`vÐyù'5‰$ع$rñ‹’ŸÅ[ +Ý(~®$"·jJZ«ö0V;XÁÖ9àL[ö÷ŽÃ=ú\µ$ÔeKE²¦ë•*VÃ% TÚÓì—£ácÒ㢎¯ô1 6`hÒÀ7>œm¸>/ÿge–‰—sªè²àÔ2 Vú¤ yîpwí¡úÜkÆƱg¬¯Ð·ˆ½P…ÊÔÆöÐGWð%!Žl sŒÒe £•;‹8Ù 1Ëk²àÚ>Ø?Fõ$é;wͺnæœÌ^Ü”/˜÷RºñTš„ŽzÇWÒU~WW›G0a–
@8§OQvˆk?UJ_xJ”³&ûˆ#p;'+ÍUv˜á#9¾}¶Qý•þÇ%ë<"w9>O“d°FT´pü;í&w°n ð-gùo …ÁŸÒ3 íâDã»;Ö C+Ò¸ïÅf@Ô +Æ° +á[xœŒ †÷\KQ}Þ£{ânUà {¨ƒÁÅð(¸ixJ +/ÀÅÜÍôx¢Pt|‚£»ŽPûβJÿ´ÌΧ•Í[…† %®§íßW´¦ú‡Ñá´L±ŒZLys)5œb[vb§¦ÖKÃB¬ÐüŽÛ |Å2Þ>‚µ¡XÉK©o[rHÔ\ñíq˜ ²?
ßyæ ùíoædÏfN/Ê ÎMB-£ÁP ˆ,÷#”|¬7a•´“YE8n¤
Hõ¥ ¨ùIHÿD}ž†‘#×Àä:>ƒŒlØ)_Æ1}N šLŠýö]ùNp’›±=’“ j † /Gîr¶Ò£1,Â;c|6Ž 4Õ‘a 'ýq*v¥Ú³§ '|iú‚â®ìL5³ÇI"wè{À,•|XÐì¯/û(3Âö-4Ø—•0dT@N&‚†E|ð4þç.ùiÛÑœÈ1àü[Ò pJÓT
†šžs;ícñU\ÂKÁ/m¨@‘§M=ò]“’Jí‚% ë_JXñÒ¹Žìhuó{¨øy¬–z¼ÍAWô{iaz¢˜š–mŽÜ󺳘;¨2¨/ˆþ/»ÄcÆѶˆäó?™Nû¸°Ü F`® ^å±Z§ôv»ÜÃR4êI¯d¸'|ß|ºÐ zëÔ%†=-ÉjÅÐÕï¡ó-‡Õ´;ÌXåpMž8Ìæ-< +QPÓ-áê“&eÃÜÓªŠ^" q\SVÁkøD÷>©Ìp8ð=·[5<‚K‹ “óç/=¨^ï{"~jhõ^Z × +TSõ÷Ò‘òÍ?¡n¢‡ Ì>bO³3ÙØÈ#wÈVßÊ[½6´Éû‰V˜5xy`ï’ÙFC±èëŠY &³»ïÙXºÜR>Ñí.Ž ù’BpeŒ ¹Ž•®¶ºÁ¼ž¾ÖM‡çÃ{ ‰ (Lv¹%Û<ÃDì¼Ù ÑÄ@^m„ï}(}屩 A? N'´89}¡ãÕ°àahg›ò…NyF=Ø,¨E$ª=ˆ +‡?wÔ]™{†]°á³Í4jÕâŠ”P)ssW;RëË„‘#•m“>®~Fí& û[¾ +Êçx™>]ù‘³±”íìÕÄõ3OSF}óÞn+QýíPR»Š¦½Ý5¨VÅÅ ç„þªeh—‡ÇŠûFe]mÿ‚e¤e¤RÕƒÓI¤MQÈ›.·—~#v‰XÇJ€Ë¦ïu»wgß´»Ù² +^>íª$¡‚ªN³°jQtˆâ ¡'§"»BKº-¯”¬ØfOUÎ51½D:e;…"YE"^gŽLÖIÜ)Éæ#S|^o´¨/‘feý •á€•‰¶ 4ê|¶%ýý
.–î´0¶ &Û$LèÐÛýÏk¨MLèOöc«¨ðæ[›L3xÒZsýZ”Óîd42)wàÐ!É5³ %aû+|ã=Ê.ÜÓ¹3ÜÙ8Þ- pˆh’•™ž^¿W¯ïEvÃhdBdwü¨øPy>h†L r%@÷CøÆ#œ(|HD‰ñÝ ¾W6ÀG~ùç+¢m+ç®_#É€'[.ÕF ö Ô9”f÷iõD +ÇEE‹S9WM3×!ídòÔmAfoçõÄmî¦Ð[Òd‘F$ØíRUJt·äýÀ ÷ +0ê +‚‚DqÓÚ»uJ‡$m¨Ëâ\5%w Ëxƒë á¤ÝŠc×Ãäçò‘ ¾¶Ï· +:âP ÉÜgú–ÁÏÛç-R^üÀ#¥w…÷n²Q1šû£ö2ü8 +ßU‰òãTç[Fèšx],Z·Éðšsðð½Š+šž ÈS&×9hÁô œp4mYKØ…Ðl]ë³.)µ~gRšŽ_•Ÿ(ºë÷˜te“c»¼x„Ÿ×ŽÆ¡â]ôî2xÂÂ4–ÙO®°¤ë梨áq.svÞ}µØüDváð - 7—s‹fYn‘iÌŽR0Ö˜Áp§¡G~)!×R%e¼k/“‡£%A0Ê|&á8¬
ºàµoŒ/t!„ÈÏ$»g¤—«â½Ú'xÆý+ß=Fœ‘è¦y@õST~£Ì½´,Ò~”B”Ê¥ ¦µ|ø2H‹%È_Øò'5Yh
ÂE8i´ÞÅ ï…Ø)uô_ƒ¯ òÉ`XÇ˶b”ë Èó“Ëã$]TÖHõŒn0F ’¯h-òðíìaÝÛR]ÐÉËæ½PÉ$¯ Ðêm<²ètL?Y=àGWr&`Ðñ°êà8Cº+Ú š!xr(<:Ž¶Üº±‚=6ûP.'…ºŸf zh?9>^.~-죦ª îêê>. ó¾_þAC鈮ëø:%cý6{L™n&¾[™˜â¨†énC–rMÌÒ( ¿Zv›ptúˆ c2{d„q¡D|ýü¢ó䊇•©|„¦3Ì‹ÀŒ¶¹S(·’ ÖÿÎV‰Ò‡CýîδÐCM*y]?œeàq1œ®=à¨Ì>xÞd?O-G¼®·²µñ¤ç¿òºáåÞ ¿ï¯ý _ŠS߃Ø#”ÍÝÈÞc³7—½û9˜X'!yf¿ÑìfÝ;ˆg3³Œ0¬`ÛemrG¨^²üz ë ÓãÓÉ×eI’Ú uÓV¨™Wk))5ü÷pÝ3`ÜŠŽâf~€)`â¸ÒÉê ¦GñF¬&ÐœíçMÃD@«UJ¾ k¶¦» Öê^ŠdÔ«©ÒmÞ~9OºðQ†4Â>…£”ÈX>®è8# c +ÿ^÷É + ŽM ·«*T$à&N_Òò,j5% +œì_ØË\ŸŽdµíY|ï—ô(®iÙ˜ï÷_ <{‚ßnSéÓ7T³®l pá/Å=[ü][Ë6S[ÑM¹–3$`êMIuÀØR {,ÅWþ¤”µÎ–g-ÿqjòIý˜=ßôY÷idᜒÑtR˜)¸z éôªóe;úOt+%«Àã†Ù²ÇÙWË7 pž>\¦
ÅxÑÍŸ*L³bæüQÄ'QÛ\˜èõžx˜:S,Q@²úIyîÛIÿAË)i^í·’ê#\>¡²ˆ×k¸ôpÀ/ðânoMe™3²ÌB¤ÿÆ]Ò§F¿"Ûà5~·±µÐÇVS´Öþ,&Tqx`•GYú®F/Í âå=TЉ¦ê&Ô%³S¬À#¯]âëI–7•„ +öšûDG¹_×
óæÕõôðªØtx˜†&ÍRueŠÖï:FŸ‚sy.!À\Ùs‡‡k¯EÁ€Ó•s ö«x×CíÕ<©t¹KrgÆ/Y4Ž ö<KSUGYþúÌôJŠ>•V«‹§K¯€Kb1¸Ž†¤”,M1}}AÖW2Œ…á¤ÊùÛ8x¼3tã×Ã3Ï<º›©¼U³GüÖ †¤|D‘‚ZÚD…ûú÷÷>Ìâ’¾ÃÁÊ:ºŸ ømõA‘ÚõØ'º\ÝöH+Ì»tô¤H¿€áÖNÛstàmœŽ'1LÞ d˜Í8¿Ê!©£lÄö'`•,áO›>Ö SÃâ<Ú…Ì¢î±D»Lôyº*mpÐœŸUžâ™Jš:‘¢`6Í؈÷+ÒÜ\ñ2¬aÃUÃ?wéöÛ<ÚÊë4'ž’!lž¾T§brÖœ-1_/&âXcb®ÓiÇD8ûæþŽ u†åfmk7Ôõv üZÏÅ¢ã|$b ŒAnÕ·Íê…¸bQ&¢½ÁRîX[ ÅѸ¶ ¿øE·Ë¬[oÙ¶žÚ[£Ê«ïÌw>w¦{3ÿD)¯Iÿ#Ó)°Ó'×J‡£ÀŒÏF™¡ã×ö£M÷ß4ÙËáZuT»Ø²n“€9DDt”¾ô b5Û1g8 õ!2õ¬j <è+Íy"
$¬ï¡1!‰ùœ«l_.‰‰´—k3q,7’•ˆ³F÷F¹¡ï_z=F¨ïœ:Gß¿q€*F yDÓ³ –R3¡ÞPaZ¥~CRœúsF]ñµ«†, +áŠD(A~«ÌiðÔ–Eó—1+¥^¨„iyÖ¡dõgVs¥Ý_Çë t\û¥[Vƒ‹¢ 㟞4Ž«EUwS¦€˜”ÍƵßT÷Ün¯
°"@æs÷‚Ù¡h B^#ÓÞ€Ý~aG>aLÉ uò§p€ºf¦Î +ë`H“@$ÕflÕ=nUúÕ5îÙù-2?—+{žj•ð¡Òj›W b>H°ÿØ…9Š Ìïh‹æv =f÷{fÕüVì:Ç1["rù”SêƒoÑõ¾Ç’€šlOÕ‘äÌ]ªãuƒ0êôXPðkµ»9Ð…Ø:ÿÖ‹\þ±Öãà–{áÍÜÒ#ú}B*Q½‘W¢¢´ž…tZ…xœêÆ/*ÖV’^oá?Z‘F
‰Ô7” :ã
øcj¿?‰zz1ÿÍ^yãývÍð¿\û0Æò±ŒÄ†]dqá =¤¿@‚Öº›3Io ÝûÂ"Ãp™çMLò"–Îw»h=y|+Õ(¹2#g‰D ÛkœþUhÉ«ýƒh+V2™¹,ÈÎ*MYcœ´ð¬äOæ~‚ gï.ícfÛèMM“ “!TêÕ6ƒ8 .ƒ)¡
éU¾ïmS‹"Œ§Ô°5”
L4ûöã¾:‘Oìc³5hFWG8 sË›æs-¡ëûç";÷\¬ã2•„ys8‹×ªlºP²XÎL|¹©‰ü4ÍÞ̯v9êNvsr‰…Â+xCü>c¯Xç§Ë'}ֲ߱ß1TÝçu#ß2çÓ ++¦É¿ìÚÖŠ^Ú®/\—sjÇOŒ¤+G4Õ–¬¨9 +,Ù°U× g·ù;ŸÐôl"•R’uEc°VÁ2^ºBRA4MæÀQ‰ç‰¶·#ÂÊ€ó#Šh5¾ ;•b‡§XæD ””gX]åF¥"yM…Y@ÅZéxaxÕ49ìÍ|ÑÞŒ>‹ŠçââD’ü2¼C%4öÿ/ô»ènÙt§ÄŠeýú2nš±t
=_~ ¼}RÉ~>Ë »a0¬n.¿Î¥µ#M
HöíTiCÕNjŽØÃsûÖ‘ýaç_ ÒÈ£ÑxF‰“Ô
EG^Èn Ý=†¨Œr&ª‡C0ŒwCÀ“`>ÒUÜFæœØXîØ}6ø[·ìfÇ·fí Œz¼–ç‡ñVÉSçä‘¿Ôìi€Ðg oLúº¨6UtY–S
ýS´,ãþXppjIíWÀž8›‘ÊsÇÞwZ„EyB¦È˜Ê}°w9zÌ^Ù®(ÿ÷ôÈЩÛ< KäVÕø>Q/ÚÜ#ï×Ø·¢yû!«oø~Aòô%“#¹ö÷ƒ¼BzÁ˜»ªŒï?_"’ ë‘Úë?w0ºŠüvˆ_…¡"=%_U[Œˆ|ð <"á6ìZƒ UcèzA²¿¯5`¢\î~ê×Sù©å¡ïÕšPÄëŠó+™ë +1·ð€š2åªvÙz¥›Ž³AfWæ› îs÷óK—i&ê¯Ózy¿ðƒþ#t°ZÚ)þƒÝ6Ö +kÈä+>x‡ÅôŸåÞ„PÁ
E Eo-B1ЦL¥Š ñãÝÖ ›²Ö›ï{ƒÎûZq"Cöá±â ši¨èbyÇû[&Èïd_† / +ÁÑ™i-j´ã/¾fXØü€ßÙ(‡.V’+®¿
² +½JTàÇÊcŒ†úJ$1³Ù«B«“HûS•°
î{ƒ)E˜ï@Ä|èÈö,›G|8fäUÜêg¾dÊÊSð õÀPÒ”¬^Ÿ¢õ±ûJ#„ÉòvÖœ¶2W¡ýâVø~-…3RüzÌýÝ÷ +3Üdc
×›+°É'©z8údÆ ÕùÛüÌ[Tòw@ÿŽ¦žÍ…gM/Ù›ƒéFŽ]á,ˆø½Åžlx+d±‹
9²ðä~OêÌKC†«hMŒú%ÎvkøæþÒ(„¼MW{B %8T ØdaèÒ…`[Ô¥Ýy¬CCtt?èhîÑâðïä÷`ãß1>ëÕÙu•î$= ›gSg¸W‚Åw‚¾H. Þ¬¬_ÕLz£x÷þç…«ˆ9ú¼Q³:²sðÖ9v®A%ý˲ùïß¡ãë’!CÒ¶è‰)YXP›Äîé•1 *A‹EöRSîŸùÆš¦ÿ8L? #ºOYI(¬c,F‡n¿ô¤@É«ïE6ÊPdw9^Ö äv]
ô%cND·y§ ;£ÙP™äµQFaØ®›qF?Æh¿µÚëè-Å×›ÞË#ôý<ë)%™<åàiÙFÏ +{@[s0Ÿ"¥²ŽÌdbÔǘ–´EVðMh^±i5q×B 2¯^JO
^ Ìê£oÜ'‹âØL¥ÆdýT<“øê²fjí7Dµ• 1X}2†7›€¤c½Bbá/?ãÒI xPp%‡Œ©SíCÖ…“La2ì‹i½I[«E8Ššå½¸çÌ Þ@Âî\ǸŸ29SQTw*ÑB1ï¼Ðå+Uïh®¼Ä¡Ê/þ‘Cå y[üAôŒŸ#2‰oLú *ÇÇUqQ½ +ó|,šZŠK§ -J˜UÀ·~SsÜ1Á¥Ã3ûtâ’”§ ¿ømƒQDf"x~ˆîd÷ôM”prB!4¥”N½Ëïb«@äÒë³q
§àάAÃêÕµhÛ„Œ°Ç³8vˆti¤E¥ÌU$ÕƒF#ãlˆè‹2Ž55JÁÆû +W—‰ÊGo#Jܤ±ÐLê yNב]IïðÔfñ+ZM v‡ï7{ä¶Ãê‚øíXºžXä ó½Ý‹`*‹Ò‚jp j÷´?+› +|B@†-›&±í
ä5‰tkfÏ? B~½b:%Yñóà6uΣþ˜”£LA®ªˆðÁëX ‹ÀÌWÿªïÏ,Ñoðö»¶ ƒ1´†Ö®ûM")ûŠ’8H_Q@)ÃûÌßj”Yã* Fô&ù2ÙüB‘çÇ.Œ%nåÁ\Û†_ØO˜Aê;)çÓjÙ7 ÊíåÛsoÒ쪰1¯ 3Yjè@á³fæåE#ÚQÔYï”zpÒáš×,£»e‹\nÆnCþÙPÛöXCƒ +Û .]¿1èf‹Þ$‰V™ÇŒ[óN<š?ÜY ætLçN¢“v} «˜&…yncú(Å:ÉZ£Ÿœî,Õ„wJo ØŸq”é»»2ÛÔŒR⩽(Òue†·¦³‰Â€D…%ô¿Á„Ä a÷uZG“9ì4éÓ¤uy Ù¡]&PžàfÌeAÔ>X õ®pøN·¶±R`ÿläC‰ÚHlÐ$ðô²NæPh7»˜ è›LfŒ¨“a h¿Ïy8
¨ã q˜ác )ÿ_~1iSÕˆC¢a H
” Ó‰k0zÉæ .@ÉÕ—Rû“µ l‚‘¿R
§´ù½Lý¥tû(Iðd˜î |ëm´ ØÿSáB ÷ÈVG:ý†®§DÚƒ?s¼Úö˜ ÎTëýô?ÿ?ˆ ¹×”-.ûdÜ7”ˆì¾.îÐ +q· +<Š´yçö {e¯(×6鈔I»îbyö„•ZA „I³ªÙÆç`¼ÏÎ S¼^™AáRup:ÓäGW@-!Äø«ƒèÕßèËs=aË‹Ü'vÉRýl+}¦Á_¾u0 +Öÿ“^)~ƒpàÕ²ô*²ÿ‰sY:ûyé×6Å€$ŒÝº½Å{‡êÑi×rL#¯(T‹PÆvœ·Qr†¤óVJô kH0¥rÔIV€«´*$ã®/ +ëÙO³!õxÉRdíhÜ!] úãUK+<7Öœjã«/ªM;Ë>ú‘ÕÃ}„ý甂 ÜZV +bù‰æ1²y†#Ö6yéRØÙ`sßUJ öà‚Hø.ß°›GßôýMŒek½„¾Û º¦¥CŽšËž…l^§¿\<…‡6ÂK̹çø$‡’vçÏ
%hf¥Ëm°¥sô |G'Æ[fûý/Š a¥¬3µrž®gS¬Ê~9^é ÈŠSìꦘÏéNÐó á¢M>À]àpÀ +䀚Œ5åèÓíöRŠÙRÒ +Ì‚StRóùa¼âæøïŸm+ŽÞ¾µ¬¼/†m@”«†fDä)”y âXDl_`p ˜3‰Õé"p£ ùÓ½r§à‡ ¬i3N€ ‚_ø+iÝ ‚WQ ô¥ˆlò÷ÅK¯Ë.XÐ :îîÐ0 ûvפ¹, aÑ;‰<e8“z Uö¯ùšÒø\j^íÂÖ"œ‰7 s.G쯸‘U,™Ç‘–ÚUõ
ê…¶,?àE jÏ2 +K¼BPÒÇMÆÍÖßx)<¨„Ó«à?j¨¨[âs£ +#!ÕŸÝS‰ ¾¡Ú±á$j',göbõÓËÍÅ!: Ñi¼|ÓÜîÊûJpÙ‘ýéÞÇœ*ðáˆR7¢O&½¶$nÄP$sn¢ä+ouu*„Û“A–’
ã†ò/% £¸¾älÛñËÔk|*“š
HîÀ²äk|ßm: ÕU¥Õ6ØŸo£;§h™:Á„tè÷!©N|çÊ?÷`~Y`¶VG?Ãça }4¨äIßž= 6Î,ºJ¥ÀV9uÖ”!þÈjYA‹¯ÏdJõæÕ…2–ÎÊ/«âÖV0ÙFìŒù.}3}ä–Ü&q—ó?xúœ¾˜þsóp¿]×U‡|y
#çjr¶24°E_ôaà´¢u¨‰C¡^¡Óå’&BŒ‹‚•M}ŽÀÙz) Ü…tMJXŧòŽ©:õCbX(—Ârj´¶45õèÚ{ ,3¶jòWó0_±Žª +þ®£¥?]ÄýÅ ½<ꯞ'°á1ÛÃC ÃæKtð(Õ‚Ã'%ÔŸ8“ÓM¼æcû Õz&CA3þ×E®rÒÝ,”BªyK¤åNÉ×%‘/);ÐÖS˧‡v!ï]Àÿ_›ÓdðŒ¶6ýCŠŸTÝçÌôûî*®¥e轜Ódv*LáOhfòÕúÓ€oMºÜ¸‡_õxB5(Ceõº%-n„ôVDÆ„ ç™6j®Ž\åoÕ”ƒº B¬çýû[ÝÌ ›_œÿr¸HÔ;6é×ÑðÀ¼!Çrª¬
±£ +éNÀÐq
„Ê•GÄ`“Ïx]SJãõ_ê»G1ÁmÃðé²]„5½R)%hÃ+Ñ] +we:‰¢}‡”ëâ.ð UöÉ›±-ÏÒõwKP–ŒxÊÙl×Ê´ Õ®Hi¸®Àð”á6Ãìؼyn¼ +#"±91cÓ…†5BZÌ¡U Q}‚Û’á“ÓiþçáœBpØ÷=:¸Œ=ĪÈÃýïVƒ®Ì¾‡¡¤ã<Å‘J*=
ó2",^†B;TË}Ç\å€S ´rV„-ã •£‘c?5ä圣9zL’ž1dpAP³¡Ÿ63—ó[%Ò
MD´j&z\%djÕ2žS)Ü‚í:cExòCU}SÄ\ºáz&¶ð,GÂ{k ˳Ô:•³D"¸
²„?.¤V5’0_‚Ü ö»Hñ ´é¦Èݼ+ÙŽÚñ#ü™ëÊ°øm;•HP^vø+ˆoo|ú² ®Ë7¨õ$0‚b…çþç<nhœBmWf¡Áy°+‘›¸Uë«Ð-‘±ôw hÒýi‰›õž+æ/Ã={W¬Î Zð|,'‘¿ó#hQlÍüyïírT¶Ô‰ ƒ"~1]¹²?::·ç3ÝÛ¨wÎC +Òðš¦}dÔF\•È]Œ9@òµñ…¿[¡Ô´]z›»•K½Ÿ³™µŸ Pù +‚Ï€oD‚¯õ!ä]OZg*µ@D©(ú¢é¯NVÓX.ò_šï¾Ü@Üú$4Ü "_=‚1«qÓTnÌhž¹ÈuÑRý +lj
»•ª nÀC›žFåÔã€ë(RX¦ðròÚ…ïØÈzš¹]3èm8Y)HRï˜* w;6ü-$9Ô7ÈbVu |sÀùñ¯ªã°}¨$\ ˆ%¼®ËDq–îÑAÃ÷Ð&8Ýß« ñ¨Âµ”(Æo™;Z{ŠrA y¤÷>[€ Äß‘yO(³ÿ®™3hwr粂ˆ ¢†;D¾J#Hù]øÝ/˜[>@çÆŒt.<‘I×S=RÌZ`Ï3Uó%ÖÑõ,Á>!ßÀÄt$9·žÒ›Q6óâ‚:ÕEðµ$î£?u&ÌIßIUŒûÍÛÜ¡½Àý—#û&y- +tkR¦ ÍûÀVùŒ ++Eª0»¹§“Í 3M‡rN?ZeÜÔhSž K½c#B¯š`”Ž+ÞÁ?í@žâM¹ÓØ%qndzF¯ðIÏE8ú£ÖÚ¥dó½ëH’›Tz]¾7]37Ô—ãß?2œœÕ˜`‹Óý5ŒVY7Ž âv‡ ébŸ +2ã$5nµD錥öI …5;£·‘³â¥œš½ œ¹ÎœI—¼ŠP¶–z ¬ {çÙÏš ÐQÅhÆ- [/µ/þ%Á4¾Ù^—a‚ªßvè¨1 ¡x™6LÚëI –œ©n¾4âz EÍçõ3ù¬ßÇÖ%r—±(×Ù[!yŒk»¬Fy›˜µ›e5kWâìŒ(¯(j¶Y9›oæÔjCBçO›ƒ±æä9?}0‹ÀÃÒéstQ Óútƒy QÆä*¥[ ~R¨[ E†¼Íx#è{¬=6OKâ#s‚{oq“7ë[›¹<nÃœ!é“q’§€
%ã¼ ×$21Ó‚åûˆY£®ƒ;YÕj įb§E »iœs'hœüÓò +xá¢,FÅ×V¢u=;”ZØn†•îµ"ÊÖÔêvС՛¶õÝäa®r¿=Ia‰›qììY˜f ‚¤ H¸¸ÃซqõÛ#ø¢tÞDײØ)b»„ +•±ÒAëågѪ‡Öö-Ñ©3 … +iâwˆ]SwC''/ˆ Ž‰~ðs + +ñ 8þ~|²oßÅ3ôv<*gÅײî_ÈŠZœëÁ +jf«Õ Iˆ7ÛÑt":¤Ê˜f÷ºá|¥Ýn«8ËiòÙºi=7"*ÆZ÷T…½ƒ Jœ[É©L~¯ä÷úxô| ×ôjƒsm #ƒYmèu#Œì .¨lÝPXUòÑ,‹÷âÐysËÓJàläy¨› Èß¾gVmè|Yɺ™IÎoÆÙ¥Ã}x ªhx R§ªœØD"áíñmóC/·Û]Ë#ìß’œ|rÝB>ý†›Ýe‚gظ%ÛâÂ¥FK#¼Ü +VKëÏ°@öMêhµÕ{íÓ«k +ýñWÖ͸uòó Ƀɋ,In“„È ÷úÏh¬Záßrž×wç3÷¡nã)8FÕ°=ÀËÈS¬ ‡5÷*ÎoÕ`!Ú\:âÀÉGàb¸ØÖ:*™°Wɬ)÷Ðõáñµ.Åzxï¶Q+u +ßoÕ üŠèg|)¢Ý”+媀B}lzr}/LŸè×Z + ¸Ä¦~Vyg²åŒ¡°uÆJ °Ê×´fM-€8 ¥K¬Ÿ«äCËš, J ½| šj_6R#/&]ääæ|e@¸(óã#š' ò{Ì¿’˜qå »|ð¹L¹¹j + +0ís ¬¦¬×&0/¾Ét‹ÕŸóëå;”Û9t;ÎÑÛ¶ niaóÀvñ~¶"‘_ŒNëÁÚGM] Ñ#·8-z;aaZJpÙ ½kš +²°×³^Kè„…žåÖ#Ö »*0N” u ^8~=“²BÑóCŒüÛr/CÎà-À;0|ûÇ£‡gÊÒMNÄéa`œËßwª@É#—0ñŸ}Åà¦Åÿ“[Ž5^3H¸>x«0Ò"†„TÛp» +ÓhÙ$ål$zQœ€ì=´ö‚1d–®ÓÃû"sx(Ú*1¨ø¶z,ˆÒ'݇v!²§ðI1Õ΃ñ¦©»g [ÞC¡ç1Q1SÑÄl»Iz_TŸÊé–Éü¢Í«¹>Ð¥GâÈ…¬oa¦Ý—ÞëZ¼êɬÿDW•¸¼‹Uô‰ ù;VtWí½ªŒä´p€4oUû¤I67Â]¯KÃ%µôN”ph»ÈØ O{Viï‡ •ÂÔF ìË¿ú°È‹!”éH8-“ ¨š +:B‡ŒlŽgú‚2ºaÒ"¦¹?| ÿ¢
t+ë+ˆùR–~ h
,“Ø‚_s +h<…È™¸gß W ¯@Wç™áÜ;_y"ÙC ü :mM`¢= ã;òtçÊXÈê
~Ô“'–6Ç3mœÄAÛ÷1Á¦±ÙMæŽW‰¡Þ®jj ÚÔ2ä,Êb¡¦³ÿÊ<)yh+oÕ QÑv‘j—3¦‘„å&‰ +ÃGÖÏ:¾åîø§¡û2M.ˆºD7–c ùWkx6Š„N+§Ls£ÙȶVaŽkŸ ÓÜ øœy#‡-ôØ¢xofiRTÚ´ µlQNí¸ ÙÕULÓ‚Mæ&ò“2ç‚‹D‡u£®#}J¡4×pÚ4emØ +ÖVxæ]"ÊÕ=¤¿Ëós÷ç~ÿ—41‚ó¸%ÊO:F§£43†Y\ ô¹³*lT¶Š‚Tò3®³¡Ž¨Å°¸n«¼ AoœsíêrO¼±¶5åd1
¢~ìËQ¢¸¾»Æ)56(ù×ÖÂ<ìÖåZ‰G¬LQ„pyC¯gŠ÷).è1 οy™ëßáÖO–‚\7ŒTQ|§uÎC†wv#†ææ¤M ÊØrÌ\÷˜›d†À¡f¤Æ1`ˆ×J8>ùÔ~ ÐõÔ&Ø`Y£Í˜¡cç?›2¡e‰ð D/Ô(–+ÉP×½L-Ía ž +Z¦Ûæûa„Ék6kUqèL£%hp—´rÛ° ÍèE–r:-ÃdÆÊHP:ì‡2;P®…ÓêF{ Ư<Q,JšãÁ~ +¡h[ÅRN]~¾…L„ÁßïüÉíä-—Ù¥ìŸ +»áY€»}€cù‡Câˤêðq£þ¤Â eSê]èûgÚò6\LÀ ž/*X«–Ü> ДÏ@ÏœüO©ªtºG©÷Ž’4Å%ü’Y×ÞöPðüid‘˃8LÖU/p„h[×ÿ1õ˜åô×îE¥JP(òCˆ¤‚§t¢8ꜧÝÎQ‹‚j%U×¼±†ÙŸJXµ¿LF-.=5†Oí~Ñ +\jË9gWØÅ."FˆmßÝÔÇ‘ÓßAÌõ|ˆWj
p7MÐ"Kc20ȧåOh]9J°F®×Ò‡õíTNì)mC\Rà‰æ8èÄЗ|- µÂ¸ÅæßËl ÏB@\ë®4Ʋó˜•k™_̦CÍö˜T!Ô½\!ƒÂD×$×&m iÀ槻ÁLÝ¢»?a|ÿ¤þë™ ú*$÷¼66ÛëðÞºR¨p `N‹8¹Îs©2õóŸÉ×®aLç%¢)K–9CJN +iÿót:ùÃûxxñÍš6ïÛ÷ÄKZ·ÏlŽ¸ŠŒbd|Oá±–kË¥þÎÏB™E‹¤» +èlLäšOnRZ~‡î&I°=w¦}æ‰l§b””Î÷g ÅTÍ‘ûûÁ{Ë1LxméÌ?b†‘Ü€±%Öé]¶çÛ'$5ˆç
}~Ü‹{Á47
ŒCS endobj -678 0 obj << +682 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1915 0 R +/Encoding 1921 0 R /FirstChar 2 -/LastChar 151 -/Widths 1929 0 R -/BaseFont /CAAECV+URWPalladioL-Roma -/FontDescriptor 676 0 R +/LastChar 216 +/Widths 1935 0 R +/BaseFont /IOQPXG+URWPalladioL-Roma +/FontDescriptor 680 0 R >> endobj -676 0 obj << +680 0 obj << /Ascent 715 /CapHeight 680 /Descent -282 -/FontName /CAAECV+URWPalladioL-Roma +/FontName /IOQPXG+URWPalladioL-Roma /ItalicAngle 0 /StemV 84 /XHeight 469 /FontBBox [-166 -283 1021 943] /Flags 4 -/CharSet (/fi/fl/exclam/numbersign/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/bracketright/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/circumflex/quotedblright/emdash) -/FontFile 677 0 R +/CharSet (/fi/fl/exclam/numbersign/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/bracketright/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/circumflex/quotedblright/emdash/Oslash) +/FontFile 681 0 R >> endobj -1929 0 obj -[605 608 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 278 0 500 500 840 0 278 333 333 389 606 250 333 250 606 500 500 500 500 500 500 500 500 500 500 250 250 0 606 0 444 747 778 611 709 774 611 556 763 832 337 333 726 611 946 831 786 604 786 668 525 613 778 722 1000 667 667 667 333 0 333 0 0 278 500 553 444 611 479 333 556 582 291 234 556 291 883 582 546 601 560 395 424 326 603 565 834 516 556 500 0 0 0 0 0 0 0 0 0 0 0 0 0 333 0 0 0 0 0 0 0 0 0 0 0 500 0 0 1000 ] +1935 0 obj +[605 608 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 278 0 500 500 840 0 278 333 333 389 606 250 333 250 606 500 500 500 500 500 500 500 500 500 500 250 250 0 606 0 444 747 778 611 709 774 611 556 763 832 337 333 726 611 946 831 786 604 786 668 525 613 778 722 1000 667 667 667 333 0 333 0 0 278 500 553 444 611 479 333 556 582 291 234 556 291 883 582 546 601 560 395 424 326 603 565 834 516 556 500 0 0 0 0 0 0 0 0 0 0 0 0 0 333 0 0 0 0 0 0 0 0 0 0 0 500 0 0 1000 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 833 ] endobj -653 0 obj << +657 0 obj << /Length1 1614 /Length2 24766 /Length3 532 @@ -9378,7 +9456,7 @@ endobj /Filter /FlateDecode >> stream -xÚ¬zSm]³eÙ¶]uʶmÛ¶mÛö)Û¶mÛæ)ó”«ëû¯:n÷S÷}Xkfæ 92GÎ{G,RBy%c;CQ;[gZzNE5ykkc ;iA;kc‚ 3 )©£‰³…°³ 'š‰1°‰##)½‡£…™¹3ùõYþ !0ôøÏÏN' 3[²ŸWk;{[ç ˆÿçJ&&Îæ&¦Ö&Brò²bäb²*b&¶&ŽÖò.†ÖFÒF&¶N&¦vŽÖÿ¶ 0²³5¶ø§4'Ú ,''{#‹Ÿm&îF&öÿ¸¨ ìM m,œœ~Þ ,œÌ
lzàlG`akdíbü »©Ý¿Ù;ÚýDØüø~Àä휜Œ -ì ~²Ê ‹þOgsçr;Yü¸ ìL"íŒ\þ)é_¾ ˜ ¯³…³‰»ó?¹ MŒ-œì
<~rÿ€Ù;Zü‹†‹“…Ù1 &p413p4¶6qrúùÁþ§;ÿU'ÁÿV½½½µÇ¿vÛý+ê?9X8;™X›ÒB10þä4rþÉmfa E÷ϨHØšÚ0Ðÿ›ÝØÅþ?|®&Žÿjù?3CñCÂÀØÎÖÚƒÀØÄŠNÖÎù'%ùÿ›Ê´ÿs"ÿHü?"ðÿˆ¼ÿâþwþ·Cüÿ{žÿ;´¨‹µµ¬É¿6üÇ C MðÏ%óØXX{üßÂÿ{¤šÉ¿qü¿¡H8ü4BÀÖìG zZú3Z8‰Z¸›Ë[8™˜Xÿté_v[cGk [“ 5ÿÕHzúÿæS6·0²²ý§í,ÿæ2±5þïÔúq:
e
ªÿóFýWœüòÎÊ ö?Ôþ½;ãÿ\üƒ"(hçNàEÃÀÂH@ÃDÏðsà~øp0±øü_2þ ˆá¿Ö2ÎŽîZ?eÿìü§øþk¥óß`DlìŒÿ™%g[ãŸñúOÃ?n#GÇ UÿuâŠþõ¿ÝÄÄÝÄj}ÅΈ+Ø2ýw†s zîÈ”°Ö@ ðHˆ}i£rQ]¯_zø G¥þGmmÓ çW»Çò ûÏ#IÊã±>4ë_½©&×ù8>ÄýˆÛdlTÇtº¥°jÑ^7KÒ» š¬ôªÇûS +xÚ¬zSm]³eÙ¶]uʶmÛ¶mÛö)Û¶mÛæ)ó”«ëû¯:n÷S÷}Xkfæ 92GÎ{G,RBy%c;CQ;[gZzNE5ykkc ;iA;kc‚ 3 )©£‰³…°³ 'š‰1°‰##)½‡£…™¹3ùõYþ !0ôøÏÏN' 3[²ŸWk;{[ç ˆÿçJ&&Îæ&¦Ö&Brò²bäb²*b&¶&ŽÖò.†ÖFÒF&¶N&¦vŽÖÿ¶ 0²³5¶ø§4'Ú ,''{#‹Ÿm&îF&öÿ¸¨ ìM m,œœ~Þ ,œÌ
lzàlG`akdíbü »©Ý¿Ù;ÚýDØüø~Àä휜Œ -ì ~²Ê ‹þOgsçr;Yü¸ ìL"íŒ\þ)é_¾ ˜ ¯³…³‰»ó?¹ MŒ-œì
<~rÿ€Ù;Zü‹†‹“…Ù1 &p413p4¶6qrúùÁþ§;ÿU'ÁÿV½½½µÇ¿vÛý+ê?9X8;™X›ÒB10þä4rþÉmfa E÷ϨHØšÚ0Ðÿ›ÝØÅþ?|®&Žÿjù?3CñCÂÀØÎÖÚƒÀØÄŠNÖÎù'%ùÿ›Ê´ÿs"ÿHü?"ðÿˆ¼ÿâþwþ·Cüÿ{žÿ;´¨‹µµ¬É¿6üÇ C MðÏ%óØXX{üßÂÿ{¤šÉ¿qü¿¡H8ü4BÀÖìG zZú3Z8‰Z¸›Ë[8™˜Xÿté_v[cGk [“ 5ÿÕHzúÿæS6·0²²ý§í,ÿæ2±5þïÔúq:qU
ªÿóFýWœüòÎÊ ö?Ôþ½;ãÿ\üƒ"(hçNàEÃÀÂH@ÃDÏðsà~øp0±øü_2þ ˆá¿Ö2ÎŽîZ?eÿìü§øþk¥óß`DlìŒÿ™%g[ãŸñúOÃ?n#GÇ UÿuâŠþõ¿ÝÄÄÝÄj}ÅΈ+Ø2ýw†s zîÈ”°Ö@ ðHˆ}i£rQ]¯_zø G¥þGmmÓ çW»Çò ûÏ#IÊã±>4ë_½©&×ù8>ÄýˆÛdlTÇtº¥°jÑ^7KÒ» š¬ôªÇûS Šº% `¸3LŽ7)ü‰] üQHžíá|ÒâP»š ÿ\%ý}þ54>:2Ü{Ú„M•IÊå KåïƒÍ§©R!RÕDzÝžeÌ}øØ"œ³\ʤ!g?5íµ Îk“T $f}QìŒ}}œ7Ãë–aIzQ£Ø`{1®ËÊ›¡9sõ‰ór5úË<#¤=ø…ˆ´±36…è4Ó+òŽÇ¾a‘Ïp:‰é"“|:[5P6“Ó<M`IÍÍÍL Õ‘ ˜‡ ‰ŠŒDa_gÁ¡Ãœá½]é–§ 9 ç8sêÓšÆô e¬bô:miØ*N±«z|+hytHOÛV77Ùa‰ @@ -9477,1079 +9555,1087 @@ Iö×~pºóE¦f}^! ˜tQ°Ù’‹ƒEäì>‰ n|'ÆV ²5D9_äå‹7â̬FJvõ˜2ÈÛŒ’ý;Û£K¿>Z&ú‰Àš¤þØɉ, y‘üP'cà Ü^M#R°·ñÃ4
{LJ B «œ »×ën¾HïŸMc–9|þ*S 5ïV®ñKãÁ“üvÚJ¦‰‡’à°áR‹ÁPKw©ä;ÉͳðåH-ºOÖ²ÉâØÉ*Wü—¼éýšö•p…+èó®a7AÔºº;˜âR·~4ÿÕ|S®‘mƒ®W•~ ©Ãâ ‡} D L×WF5J‰åéØ|¨i÷>#\2®˜ šÒ30D”€`Ÿ†§¾ç4}&1xÒ¤Ö¥ ÎdP•Ý‹$ȾCO‡Ù’jÛvëö?`C&W'aÔCJ•I'sŠFðìM˼k©¡¨»°+X Š cAÐ À«á¥£ùr!<s %!ÈbˆÀNÑ* d3³Ê6†Ø0´+3ïÍNYÀ8îj•ÛP ³7Þ¨VäÎ c=$0€Ž9€òõ
«£…WCÒ¸1å
Ô²9L±ž±~óŸ –äWÚyüI nÐäöÀ'¼I3
ú]`+ò7vÃÝ!’ÔËö—k«Zœ–(&4¨j„¸`é+àpôxÿÅë«SüW â$åM7ƒ[IZÒýš®ê~‚VƒÍ:Ø\é«…Œ€Øy_à£öý .Èë Ã6‹û¯™ÅSßcŽ¾Q&É5 fd -ön’“,6"”@K;\ÿŸÁüø¯ +ön’“,6"”@K;\ÿŸÁüø¯ endobj -654 0 obj << +658 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1915 0 R +/Encoding 1921 0 R /FirstChar 2 /LastChar 151 -/Widths 1930 0 R -/BaseFont /YTQUEY+URWPalladioL-Bold -/FontDescriptor 652 0 R +/Widths 1936 0 R +/BaseFont /HVUUYY+URWPalladioL-Bold +/FontDescriptor 656 0 R >> endobj -652 0 obj << +656 0 obj << /Ascent 708 /CapHeight 672 /Descent -266 -/FontName /YTQUEY+URWPalladioL-Bold +/FontName /HVUUYY+URWPalladioL-Bold /ItalicAngle 0 /StemV 123 /XHeight 471 /FontBBox [-152 -301 1000 935] /Flags 4 /CharSet (/fi/fl/exclam/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/question/at/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/quotedblright/emdash) -/FontFile 653 0 R +/FontFile 657 0 R >> endobj -1930 0 obj +1936 0 obj [611 611 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 278 0 0 500 889 0 278 333 333 444 606 250 333 250 296 500 500 500 500 500 500 500 500 500 500 250 250 0 0 0 444 747 778 667 722 833 611 556 833 833 389 0 778 611 1000 833 833 611 833 722 611 667 778 778 1000 667 667 667 333 0 333 0 0 0 500 611 444 611 500 389 556 611 333 333 611 333 889 611 556 611 611 389 444 333 611 556 833 500 556 500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 500 0 0 1000 ] endobj -655 0 obj << +659 0 obj << /Type /Pages /Count 6 -/Parent 1931 0 R -/Kids [646 0 R 673 0 R 683 0 R 738 0 R 802 0 R 862 0 R] +/Parent 1937 0 R +/Kids [650 0 R 677 0 R 687 0 R 742 0 R 806 0 R 867 0 R] >> endobj -881 0 obj << +886 0 obj << /Type /Pages /Count 6 -/Parent 1931 0 R -/Kids [866 0 R 883 0 R 897 0 R 908 0 R 915 0 R 927 0 R] +/Parent 1937 0 R +/Kids [871 0 R 888 0 R 902 0 R 913 0 R 920 0 R 932 0 R] >> endobj -939 0 obj << +944 0 obj << /Type /Pages /Count 6 -/Parent 1931 0 R -/Kids [932 0 R 941 0 R 952 0 R 960 0 R 967 0 R 973 0 R] +/Parent 1937 0 R +/Kids [937 0 R 946 0 R 957 0 R 965 0 R 972 0 R 978 0 R] >> endobj -996 0 obj << +1001 0 obj << /Type /Pages /Count 6 -/Parent 1931 0 R -/Kids [981 0 R 1003 0 R 1012 0 R 1017 0 R 1021 0 R 1028 0 R] +/Parent 1937 0 R +/Kids [986 0 R 1008 0 R 1018 0 R 1023 0 R 1027 0 R 1034 0 R] >> endobj -1044 0 obj << +1050 0 obj << /Type /Pages /Count 6 -/Parent 1931 0 R -/Kids [1037 0 R 1047 0 R 1054 0 R 1059 0 R 1068 0 R 1075 0 R] +/Parent 1937 0 R +/Kids [1043 0 R 1053 0 R 1060 0 R 1065 0 R 1074 0 R 1081 0 R] >> endobj -1087 0 obj << +1093 0 obj << /Type /Pages /Count 6 -/Parent 1931 0 R -/Kids [1079 0 R 1090 0 R 1096 0 R 1104 0 R 1111 0 R 1120 0 R] +/Parent 1937 0 R +/Kids [1085 0 R 1096 0 R 1102 0 R 1110 0 R 1117 0 R 1126 0 R] >> endobj -1139 0 obj << +1145 0 obj << /Type /Pages /Count 6 -/Parent 1932 0 R -/Kids [1133 0 R 1141 0 R 1146 0 R 1152 0 R 1158 0 R 1166 0 R] +/Parent 1938 0 R +/Kids [1139 0 R 1147 0 R 1152 0 R 1158 0 R 1164 0 R 1172 0 R] >> endobj -1176 0 obj << +1182 0 obj << /Type /Pages /Count 6 -/Parent 1932 0 R -/Kids [1173 0 R 1178 0 R 1183 0 R 1189 0 R 1195 0 R 1200 0 R] +/Parent 1938 0 R +/Kids [1179 0 R 1184 0 R 1189 0 R 1195 0 R 1199 0 R 1206 0 R] >> endobj -1213 0 obj << +1219 0 obj << /Type /Pages /Count 6 -/Parent 1932 0 R -/Kids [1210 0 R 1215 0 R 1220 0 R 1231 0 R 1237 0 R 1242 0 R] +/Parent 1938 0 R +/Kids [1216 0 R 1221 0 R 1226 0 R 1237 0 R 1243 0 R 1248 0 R] >> endobj -1250 0 obj << +1256 0 obj << /Type /Pages /Count 6 -/Parent 1932 0 R -/Kids [1246 0 R 1252 0 R 1260 0 R 1266 0 R 1273 0 R 1281 0 R] +/Parent 1938 0 R +/Kids [1252 0 R 1258 0 R 1266 0 R 1272 0 R 1279 0 R 1287 0 R] >> endobj -1297 0 obj << +1303 0 obj << /Type /Pages /Count 6 -/Parent 1932 0 R -/Kids [1288 0 R 1300 0 R 1304 0 R 1310 0 R 1315 0 R 1320 0 R] +/Parent 1938 0 R +/Kids [1294 0 R 1306 0 R 1310 0 R 1316 0 R 1321 0 R 1325 0 R] >> endobj -1332 0 obj << +1338 0 obj << /Type /Pages /Count 6 -/Parent 1932 0 R -/Kids [1329 0 R 1334 0 R 1338 0 R 1342 0 R 1350 0 R 1362 0 R] +/Parent 1938 0 R +/Kids [1334 0 R 1340 0 R 1344 0 R 1348 0 R 1356 0 R 1361 0 R] >> endobj -1394 0 obj << +1392 0 obj << /Type /Pages /Count 6 -/Parent 1933 0 R -/Kids [1373 0 R 1396 0 R 1402 0 R 1414 0 R 1420 0 R 1428 0 R] +/Parent 1939 0 R +/Kids [1378 0 R 1394 0 R 1409 0 R 1419 0 R 1425 0 R 1432 0 R] >> endobj -1448 0 obj << +1453 0 obj << /Type /Pages /Count 6 -/Parent 1933 0 R -/Kids [1439 0 R 1450 0 R 1458 0 R 1462 0 R 1466 0 R 1472 0 R] +/Parent 1939 0 R +/Kids [1443 0 R 1455 0 R 1463 0 R 1469 0 R 1473 0 R 1479 0 R] >> endobj -1486 0 obj << +1493 0 obj << /Type /Pages /Count 6 -/Parent 1933 0 R -/Kids [1483 0 R 1488 0 R 1492 0 R 1503 0 R 1507 0 R 1514 0 R] +/Parent 1939 0 R +/Kids [1490 0 R 1495 0 R 1499 0 R 1510 0 R 1514 0 R 1521 0 R] >> endobj -1592 0 obj << +1589 0 obj << /Type /Pages /Count 6 -/Parent 1933 0 R -/Kids [1537 0 R 1594 0 R 1652 0 R 1709 0 R 1729 0 R 1738 0 R] +/Parent 1939 0 R +/Kids [1531 0 R 1591 0 R 1647 0 R 1701 0 R 1735 0 R 1744 0 R] >> endobj -1748 0 obj << +1754 0 obj << /Type /Pages /Count 6 -/Parent 1933 0 R -/Kids [1744 0 R 1750 0 R 1754 0 R 1759 0 R 1771 0 R 1775 0 R] +/Parent 1939 0 R +/Kids [1750 0 R 1756 0 R 1760 0 R 1765 0 R 1777 0 R 1781 0 R] >> endobj -1791 0 obj << +1797 0 obj << /Type /Pages /Count 6 -/Parent 1933 0 R -/Kids [1787 0 R 1793 0 R 1804 0 R 1809 0 R 1814 0 R 1826 0 R] +/Parent 1939 0 R +/Kids [1793 0 R 1799 0 R 1810 0 R 1815 0 R 1820 0 R 1831 0 R] >> endobj -1840 0 obj << +1846 0 obj << /Type /Pages /Count 6 -/Parent 1934 0 R -/Kids [1837 0 R 1842 0 R 1854 0 R 1858 0 R 1866 0 R 1876 0 R] +/Parent 1940 0 R +/Kids [1843 0 R 1848 0 R 1859 0 R 1864 0 R 1871 0 R 1882 0 R] >> endobj -1891 0 obj << +1897 0 obj << /Type /Pages /Count 4 -/Parent 1934 0 R -/Kids [1887 0 R 1893 0 R 1904 0 R 1910 0 R] +/Parent 1940 0 R +/Kids [1893 0 R 1899 0 R 1909 0 R 1915 0 R] >> endobj -1931 0 obj << +1937 0 obj << /Type /Pages /Count 36 -/Parent 1935 0 R -/Kids [655 0 R 881 0 R 939 0 R 996 0 R 1044 0 R 1087 0 R] +/Parent 1941 0 R +/Kids [659 0 R 886 0 R 944 0 R 1001 0 R 1050 0 R 1093 0 R] >> endobj -1932 0 obj << +1938 0 obj << /Type /Pages /Count 36 -/Parent 1935 0 R -/Kids [1139 0 R 1176 0 R 1213 0 R 1250 0 R 1297 0 R 1332 0 R] +/Parent 1941 0 R +/Kids [1145 0 R 1182 0 R 1219 0 R 1256 0 R 1303 0 R 1338 0 R] >> endobj -1933 0 obj << +1939 0 obj << /Type /Pages /Count 36 -/Parent 1935 0 R -/Kids [1394 0 R 1448 0 R 1486 0 R 1592 0 R 1748 0 R 1791 0 R] +/Parent 1941 0 R +/Kids [1392 0 R 1453 0 R 1493 0 R 1589 0 R 1754 0 R 1797 0 R] >> endobj -1934 0 obj << +1940 0 obj << /Type /Pages /Count 10 -/Parent 1935 0 R -/Kids [1840 0 R 1891 0 R] +/Parent 1941 0 R +/Kids [1846 0 R 1897 0 R] >> endobj -1935 0 obj << +1941 0 obj << /Type /Pages /Count 118 -/Kids [1931 0 R 1932 0 R 1933 0 R 1934 0 R] +/Kids [1937 0 R 1938 0 R 1939 0 R 1940 0 R] >> endobj -1936 0 obj << +1942 0 obj << /Type /Outlines /First 7 0 R -/Last 603 0 R +/Last 607 0 R /Count 10 >> endobj +647 0 obj << +/Title 648 0 R +/A 645 0 R +/Parent 607 0 R +/Prev 643 0 R +>> endobj 643 0 obj << /Title 644 0 R /A 641 0 R -/Parent 603 0 R +/Parent 607 0 R /Prev 639 0 R +/Next 647 0 R >> endobj 639 0 obj << /Title 640 0 R /A 637 0 R -/Parent 603 0 R +/Parent 607 0 R /Prev 635 0 R /Next 643 0 R >> endobj 635 0 obj << /Title 636 0 R /A 633 0 R -/Parent 603 0 R +/Parent 607 0 R /Prev 631 0 R /Next 639 0 R >> endobj 631 0 obj << /Title 632 0 R /A 629 0 R -/Parent 603 0 R +/Parent 607 0 R /Prev 627 0 R /Next 635 0 R >> endobj 627 0 obj << /Title 628 0 R /A 625 0 R -/Parent 603 0 R +/Parent 607 0 R /Prev 623 0 R /Next 631 0 R >> endobj 623 0 obj << /Title 624 0 R /A 621 0 R -/Parent 603 0 R +/Parent 607 0 R /Prev 619 0 R /Next 627 0 R >> endobj 619 0 obj << /Title 620 0 R /A 617 0 R -/Parent 603 0 R +/Parent 607 0 R /Prev 615 0 R /Next 623 0 R >> endobj 615 0 obj << /Title 616 0 R /A 613 0 R -/Parent 603 0 R +/Parent 607 0 R /Prev 611 0 R /Next 619 0 R >> endobj 611 0 obj << /Title 612 0 R /A 609 0 R -/Parent 603 0 R -/Prev 607 0 R +/Parent 607 0 R /Next 615 0 R >> endobj 607 0 obj << /Title 608 0 R /A 605 0 R -/Parent 603 0 R -/Next 611 0 R +/Parent 1942 0 R +/Prev 571 0 R +/First 611 0 R +/Last 647 0 R +/Count -10 >> endobj 603 0 obj << /Title 604 0 R /A 601 0 R -/Parent 1936 0 R -/Prev 567 0 R -/First 607 0 R -/Last 643 0 R -/Count -10 +/Parent 591 0 R +/Prev 599 0 R >> endobj 599 0 obj << /Title 600 0 R /A 597 0 R -/Parent 587 0 R +/Parent 591 0 R /Prev 595 0 R +/Next 603 0 R >> endobj 595 0 obj << /Title 596 0 R /A 593 0 R -/Parent 587 0 R -/Prev 591 0 R +/Parent 591 0 R /Next 599 0 R >> endobj 591 0 obj << /Title 592 0 R /A 589 0 R -/Parent 587 0 R -/Next 595 0 R +/Parent 571 0 R +/Prev 583 0 R +/First 595 0 R +/Last 603 0 R +/Count -3 >> endobj 587 0 obj << /Title 588 0 R /A 585 0 R -/Parent 567 0 R -/Prev 579 0 R -/First 591 0 R -/Last 599 0 R -/Count -3 +/Parent 583 0 R >> endobj 583 0 obj << /Title 584 0 R /A 581 0 R -/Parent 579 0 R +/Parent 571 0 R +/Prev 575 0 R +/Next 591 0 R +/First 587 0 R +/Last 587 0 R +/Count -1 >> endobj 579 0 obj << /Title 580 0 R /A 577 0 R -/Parent 567 0 R -/Prev 571 0 R -/Next 587 0 R -/First 583 0 R -/Last 583 0 R -/Count -1 +/Parent 575 0 R >> endobj 575 0 obj << /Title 576 0 R /A 573 0 R /Parent 571 0 R +/Next 583 0 R +/First 579 0 R +/Last 579 0 R +/Count -1 >> endobj 571 0 obj << /Title 572 0 R /A 569 0 R -/Parent 567 0 R -/Next 579 0 R +/Parent 1942 0 R +/Prev 551 0 R +/Next 607 0 R /First 575 0 R -/Last 575 0 R -/Count -1 +/Last 591 0 R +/Count -3 >> endobj 567 0 obj << /Title 568 0 R /A 565 0 R -/Parent 1936 0 R -/Prev 547 0 R -/Next 603 0 R -/First 571 0 R -/Last 587 0 R -/Count -3 +/Parent 551 0 R +/Prev 563 0 R >> endobj 563 0 obj << /Title 564 0 R /A 561 0 R -/Parent 547 0 R -/Prev 559 0 R +/Parent 551 0 R +/Prev 555 0 R +/Next 567 0 R >> endobj 559 0 obj << /Title 560 0 R /A 557 0 R -/Parent 547 0 R -/Prev 551 0 R -/Next 563 0 R +/Parent 555 0 R >> endobj 555 0 obj << /Title 556 0 R /A 553 0 R /Parent 551 0 R +/Next 563 0 R +/First 559 0 R +/Last 559 0 R +/Count -1 >> endobj 551 0 obj << /Title 552 0 R /A 549 0 R -/Parent 547 0 R -/Next 559 0 R +/Parent 1942 0 R +/Prev 527 0 R +/Next 571 0 R /First 555 0 R -/Last 555 0 R -/Count -1 +/Last 567 0 R +/Count -3 >> endobj 547 0 obj << /Title 548 0 R /A 545 0 R -/Parent 1936 0 R -/Prev 523 0 R -/Next 567 0 R -/First 551 0 R -/Last 563 0 R -/Count -3 +/Parent 527 0 R +/Prev 535 0 R >> endobj 543 0 obj << /Title 544 0 R /A 541 0 R -/Parent 523 0 R -/Prev 531 0 R +/Parent 535 0 R +/Prev 539 0 R >> endobj 539 0 obj << /Title 540 0 R /A 537 0 R -/Parent 531 0 R -/Prev 535 0 R +/Parent 535 0 R +/Next 543 0 R >> endobj 535 0 obj << /Title 536 0 R /A 533 0 R -/Parent 531 0 R -/Next 539 0 R +/Parent 527 0 R +/Prev 531 0 R +/Next 547 0 R +/First 539 0 R +/Last 543 0 R +/Count -2 >> endobj 531 0 obj << /Title 532 0 R /A 529 0 R -/Parent 523 0 R -/Prev 527 0 R -/Next 543 0 R -/First 535 0 R -/Last 539 0 R -/Count -2 +/Parent 527 0 R +/Next 535 0 R >> endobj 527 0 obj << /Title 528 0 R /A 525 0 R -/Parent 523 0 R -/Next 531 0 R +/Parent 1942 0 R +/Prev 243 0 R +/Next 551 0 R +/First 531 0 R +/Last 547 0 R +/Count -3 >> endobj 523 0 obj << /Title 524 0 R /A 521 0 R -/Parent 1936 0 R -/Prev 239 0 R -/Next 547 0 R -/First 527 0 R -/Last 543 0 R -/Count -3 +/Parent 475 0 R +/Prev 519 0 R >> endobj 519 0 obj << /Title 520 0 R /A 517 0 R -/Parent 471 0 R -/Prev 515 0 R +/Parent 475 0 R +/Prev 503 0 R +/Next 523 0 R >> endobj 515 0 obj << /Title 516 0 R /A 513 0 R -/Parent 471 0 R -/Prev 499 0 R -/Next 519 0 R +/Parent 503 0 R +/Prev 511 0 R >> endobj 511 0 obj << /Title 512 0 R /A 509 0 R -/Parent 499 0 R +/Parent 503 0 R /Prev 507 0 R +/Next 515 0 R >> endobj 507 0 obj << /Title 508 0 R /A 505 0 R -/Parent 499 0 R -/Prev 503 0 R +/Parent 503 0 R /Next 511 0 R >> endobj 503 0 obj << /Title 504 0 R /A 501 0 R -/Parent 499 0 R -/Next 507 0 R +/Parent 475 0 R +/Prev 499 0 R +/Next 519 0 R +/First 507 0 R +/Last 515 0 R +/Count -3 >> endobj 499 0 obj << /Title 500 0 R /A 497 0 R -/Parent 471 0 R +/Parent 475 0 R /Prev 495 0 R -/Next 515 0 R -/First 503 0 R -/Last 511 0 R -/Count -3 +/Next 503 0 R >> endobj 495 0 obj << /Title 496 0 R /A 493 0 R -/Parent 471 0 R +/Parent 475 0 R /Prev 491 0 R /Next 499 0 R >> endobj 491 0 obj << /Title 492 0 R /A 489 0 R -/Parent 471 0 R -/Prev 487 0 R +/Parent 475 0 R +/Prev 479 0 R /Next 495 0 R >> endobj 487 0 obj << /Title 488 0 R /A 485 0 R -/Parent 471 0 R -/Prev 475 0 R -/Next 491 0 R +/Parent 479 0 R +/Prev 483 0 R >> endobj 483 0 obj << /Title 484 0 R /A 481 0 R -/Parent 475 0 R -/Prev 479 0 R +/Parent 479 0 R +/Next 487 0 R >> endobj 479 0 obj << /Title 480 0 R /A 477 0 R /Parent 475 0 R -/Next 483 0 R +/Next 491 0 R +/First 483 0 R +/Last 487 0 R +/Count -2 >> endobj 475 0 obj << /Title 476 0 R /A 473 0 R -/Parent 471 0 R -/Next 487 0 R +/Parent 243 0 R +/Prev 275 0 R /First 479 0 R -/Last 483 0 R -/Count -2 +/Last 523 0 R +/Count -7 >> endobj 471 0 obj << /Title 472 0 R /A 469 0 R -/Parent 239 0 R -/Prev 271 0 R -/First 475 0 R -/Last 519 0 R -/Count -7 +/Parent 455 0 R +/Prev 467 0 R >> endobj 467 0 obj << /Title 468 0 R /A 465 0 R -/Parent 451 0 R +/Parent 455 0 R /Prev 463 0 R +/Next 471 0 R >> endobj 463 0 obj << /Title 464 0 R /A 461 0 R -/Parent 451 0 R +/Parent 455 0 R /Prev 459 0 R /Next 467 0 R >> endobj 459 0 obj << /Title 460 0 R /A 457 0 R -/Parent 451 0 R -/Prev 455 0 R +/Parent 455 0 R /Next 463 0 R >> endobj 455 0 obj << /Title 456 0 R /A 453 0 R -/Parent 451 0 R -/Next 459 0 R +/Parent 275 0 R +/Prev 451 0 R +/First 459 0 R +/Last 471 0 R +/Count -4 >> endobj 451 0 obj << /Title 452 0 R /A 449 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 447 0 R -/First 455 0 R -/Last 467 0 R -/Count -4 +/Next 455 0 R >> endobj 447 0 obj << /Title 448 0 R /A 445 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 443 0 R /Next 451 0 R >> endobj 443 0 obj << /Title 444 0 R /A 441 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 439 0 R /Next 447 0 R >> endobj 439 0 obj << /Title 440 0 R /A 437 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 435 0 R /Next 443 0 R >> endobj 435 0 obj << /Title 436 0 R /A 433 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 431 0 R /Next 439 0 R >> endobj 431 0 obj << /Title 432 0 R /A 429 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 427 0 R /Next 435 0 R >> endobj 427 0 obj << /Title 428 0 R /A 425 0 R -/Parent 271 0 R -/Prev 423 0 R +/Parent 275 0 R +/Prev 347 0 R /Next 431 0 R >> endobj 423 0 obj << /Title 424 0 R /A 421 0 R -/Parent 271 0 R -/Prev 343 0 R -/Next 427 0 R +/Parent 347 0 R +/Prev 419 0 R >> endobj 419 0 obj << /Title 420 0 R /A 417 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 415 0 R +/Next 423 0 R >> endobj 415 0 obj << /Title 416 0 R /A 413 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 411 0 R /Next 419 0 R >> endobj 411 0 obj << /Title 412 0 R /A 409 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 407 0 R /Next 415 0 R >> endobj 407 0 obj << /Title 408 0 R /A 405 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 403 0 R /Next 411 0 R >> endobj 403 0 obj << /Title 404 0 R /A 401 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 399 0 R /Next 407 0 R >> endobj 399 0 obj << /Title 400 0 R /A 397 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 395 0 R /Next 403 0 R >> endobj 395 0 obj << /Title 396 0 R /A 393 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 391 0 R /Next 399 0 R >> endobj 391 0 obj << /Title 392 0 R /A 389 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 387 0 R /Next 395 0 R >> endobj 387 0 obj << /Title 388 0 R /A 385 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 383 0 R /Next 391 0 R >> endobj 383 0 obj << /Title 384 0 R /A 381 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 379 0 R /Next 387 0 R >> endobj 379 0 obj << /Title 380 0 R /A 377 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 375 0 R /Next 383 0 R >> endobj 375 0 obj << /Title 376 0 R /A 373 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 371 0 R /Next 379 0 R >> endobj 371 0 obj << /Title 372 0 R /A 369 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 367 0 R /Next 375 0 R >> endobj 367 0 obj << /Title 368 0 R /A 365 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 363 0 R /Next 371 0 R >> endobj 363 0 obj << /Title 364 0 R /A 361 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 359 0 R /Next 367 0 R >> endobj 359 0 obj << /Title 360 0 R /A 357 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 355 0 R /Next 363 0 R >> endobj 355 0 obj << /Title 356 0 R /A 353 0 R -/Parent 343 0 R +/Parent 347 0 R /Prev 351 0 R /Next 359 0 R >> endobj 351 0 obj << /Title 352 0 R /A 349 0 R -/Parent 343 0 R -/Prev 347 0 R +/Parent 347 0 R /Next 355 0 R >> endobj 347 0 obj << /Title 348 0 R /A 345 0 R -/Parent 343 0 R -/Next 351 0 R +/Parent 275 0 R +/Prev 343 0 R +/Next 427 0 R +/First 351 0 R +/Last 423 0 R +/Count -19 >> endobj 343 0 obj << /Title 344 0 R /A 341 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 339 0 R -/Next 423 0 R -/First 347 0 R -/Last 419 0 R -/Count -19 +/Next 347 0 R >> endobj 339 0 obj << /Title 340 0 R /A 337 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 335 0 R /Next 343 0 R >> endobj 335 0 obj << /Title 336 0 R /A 333 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 331 0 R /Next 339 0 R >> endobj 331 0 obj << /Title 332 0 R /A 329 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 327 0 R /Next 335 0 R >> endobj 327 0 obj << /Title 328 0 R /A 325 0 R -/Parent 271 0 R -/Prev 323 0 R +/Parent 275 0 R +/Prev 315 0 R /Next 331 0 R >> endobj 323 0 obj << /Title 324 0 R /A 321 0 R -/Parent 271 0 R -/Prev 311 0 R -/Next 327 0 R +/Parent 315 0 R +/Prev 319 0 R >> endobj 319 0 obj << /Title 320 0 R /A 317 0 R -/Parent 311 0 R -/Prev 315 0 R +/Parent 315 0 R +/Next 323 0 R >> endobj 315 0 obj << /Title 316 0 R /A 313 0 R -/Parent 311 0 R -/Next 319 0 R +/Parent 275 0 R +/Prev 311 0 R +/Next 327 0 R +/First 319 0 R +/Last 323 0 R +/Count -2 >> endobj 311 0 obj << /Title 312 0 R /A 309 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 307 0 R -/Next 323 0 R -/First 315 0 R -/Last 319 0 R -/Count -2 +/Next 315 0 R >> endobj 307 0 obj << /Title 308 0 R /A 305 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 303 0 R /Next 311 0 R >> endobj 303 0 obj << /Title 304 0 R /A 301 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 299 0 R /Next 307 0 R >> endobj 299 0 obj << /Title 300 0 R /A 297 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 295 0 R /Next 303 0 R >> endobj 295 0 obj << /Title 296 0 R /A 293 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 291 0 R /Next 299 0 R >> endobj 291 0 obj << /Title 292 0 R /A 289 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 287 0 R /Next 295 0 R >> endobj 287 0 obj << /Title 288 0 R /A 285 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 283 0 R /Next 291 0 R >> endobj 283 0 obj << /Title 284 0 R /A 281 0 R -/Parent 271 0 R +/Parent 275 0 R /Prev 279 0 R /Next 287 0 R >> endobj 279 0 obj << /Title 280 0 R /A 277 0 R -/Parent 271 0 R -/Prev 275 0 R +/Parent 275 0 R /Next 283 0 R >> endobj 275 0 obj << /Title 276 0 R /A 273 0 R -/Parent 271 0 R -/Next 279 0 R +/Parent 243 0 R +/Prev 247 0 R +/Next 475 0 R +/First 279 0 R +/Last 455 0 R +/Count -24 >> endobj 271 0 obj << /Title 272 0 R /A 269 0 R -/Parent 239 0 R -/Prev 243 0 R -/Next 471 0 R -/First 275 0 R -/Last 451 0 R -/Count -24 +/Parent 263 0 R +/Prev 267 0 R >> endobj 267 0 obj << /Title 268 0 R /A 265 0 R -/Parent 259 0 R -/Prev 263 0 R +/Parent 263 0 R +/Next 271 0 R >> endobj 263 0 obj << /Title 264 0 R /A 261 0 R -/Parent 259 0 R -/Next 267 0 R +/Parent 247 0 R +/Prev 251 0 R +/First 267 0 R +/Last 271 0 R +/Count -2 >> endobj 259 0 obj << /Title 260 0 R /A 257 0 R -/Parent 243 0 R -/Prev 247 0 R -/First 263 0 R -/Last 267 0 R -/Count -2 +/Parent 251 0 R +/Prev 255 0 R >> endobj 255 0 obj << /Title 256 0 R /A 253 0 R -/Parent 247 0 R -/Prev 251 0 R +/Parent 251 0 R +/Next 259 0 R >> endobj 251 0 obj << /Title 252 0 R /A 249 0 R /Parent 247 0 R -/Next 255 0 R +/Next 263 0 R +/First 255 0 R +/Last 259 0 R +/Count -2 >> endobj 247 0 obj << /Title 248 0 R /A 245 0 R /Parent 243 0 R -/Next 259 0 R +/Next 275 0 R /First 251 0 R -/Last 255 0 R +/Last 263 0 R /Count -2 >> endobj 243 0 obj << /Title 244 0 R /A 241 0 R -/Parent 239 0 R -/Next 271 0 R +/Parent 1942 0 R +/Prev 231 0 R +/Next 527 0 R /First 247 0 R -/Last 259 0 R -/Count -2 +/Last 475 0 R +/Count -3 >> endobj 239 0 obj << /Title 240 0 R /A 237 0 R -/Parent 1936 0 R -/Prev 227 0 R -/Next 523 0 R -/First 243 0 R -/Last 471 0 R -/Count -3 +/Parent 231 0 R +/Prev 235 0 R >> endobj 235 0 obj << /Title 236 0 R /A 233 0 R -/Parent 227 0 R -/Prev 231 0 R +/Parent 231 0 R +/Next 239 0 R >> endobj 231 0 obj << /Title 232 0 R /A 229 0 R -/Parent 227 0 R -/Next 235 0 R +/Parent 1942 0 R +/Prev 131 0 R +/Next 243 0 R +/First 235 0 R +/Last 239 0 R +/Count -2 >> endobj 227 0 obj << /Title 228 0 R /A 225 0 R -/Parent 1936 0 R -/Prev 131 0 R -/Next 239 0 R -/First 231 0 R -/Last 235 0 R -/Count -2 +/Parent 219 0 R +/Prev 223 0 R >> endobj 223 0 obj << /Title 224 0 R /A 221 0 R -/Parent 215 0 R -/Prev 219 0 R +/Parent 219 0 R +/Next 227 0 R >> endobj 219 0 obj << /Title 220 0 R /A 217 0 R -/Parent 215 0 R -/Next 223 0 R +/Parent 131 0 R +/Prev 203 0 R +/First 223 0 R +/Last 227 0 R +/Count -2 >> endobj 215 0 obj << /Title 216 0 R /A 213 0 R -/Parent 131 0 R -/Prev 199 0 R -/First 219 0 R -/Last 223 0 R -/Count -2 +/Parent 203 0 R +/Prev 211 0 R >> endobj 211 0 obj << /Title 212 0 R /A 209 0 R -/Parent 199 0 R +/Parent 203 0 R /Prev 207 0 R +/Next 215 0 R >> endobj 207 0 obj << /Title 208 0 R /A 205 0 R -/Parent 199 0 R -/Prev 203 0 R +/Parent 203 0 R /Next 211 0 R >> endobj 203 0 obj << /Title 204 0 R /A 201 0 R -/Parent 199 0 R -/Next 207 0 R +/Parent 131 0 R +/Prev 199 0 R +/Next 219 0 R +/First 207 0 R +/Last 215 0 R +/Count -3 >> endobj 199 0 obj << /Title 200 0 R /A 197 0 R /Parent 131 0 R /Prev 195 0 R -/Next 215 0 R -/First 203 0 R -/Last 211 0 R -/Count -3 +/Next 203 0 R >> endobj 195 0 obj << /Title 196 0 R /A 193 0 R /Parent 131 0 R -/Prev 191 0 R +/Prev 159 0 R /Next 199 0 R >> endobj 191 0 obj << /Title 192 0 R /A 189 0 R -/Parent 131 0 R -/Prev 155 0 R -/Next 195 0 R +/Parent 159 0 R +/Prev 187 0 R >> endobj 187 0 obj << /Title 188 0 R /A 185 0 R -/Parent 155 0 R +/Parent 159 0 R /Prev 183 0 R +/Next 191 0 R >> endobj 183 0 obj << /Title 184 0 R /A 181 0 R -/Parent 155 0 R +/Parent 159 0 R /Prev 179 0 R /Next 187 0 R >> endobj 179 0 obj << /Title 180 0 R /A 177 0 R -/Parent 155 0 R +/Parent 159 0 R /Prev 175 0 R /Next 183 0 R >> endobj 175 0 obj << /Title 176 0 R /A 173 0 R -/Parent 155 0 R -/Prev 171 0 R +/Parent 159 0 R +/Prev 163 0 R /Next 179 0 R >> endobj 171 0 obj << /Title 172 0 R /A 169 0 R -/Parent 155 0 R -/Prev 159 0 R -/Next 175 0 R +/Parent 163 0 R +/Prev 167 0 R >> endobj 167 0 obj << /Title 168 0 R /A 165 0 R -/Parent 159 0 R -/Prev 163 0 R +/Parent 163 0 R +/Next 171 0 R >> endobj 163 0 obj << /Title 164 0 R /A 161 0 R /Parent 159 0 R -/Next 167 0 R +/Next 175 0 R +/First 167 0 R +/Last 171 0 R +/Count -2 >> endobj 159 0 obj << /Title 160 0 R /A 157 0 R -/Parent 155 0 R -/Next 171 0 R +/Parent 131 0 R +/Prev 151 0 R +/Next 195 0 R /First 163 0 R -/Last 167 0 R -/Count -2 +/Last 191 0 R +/Count -6 >> endobj 155 0 obj << /Title 156 0 R /A 153 0 R -/Parent 131 0 R -/Prev 151 0 R -/Next 191 0 R -/First 159 0 R -/Last 187 0 R -/Count -6 +/Parent 151 0 R >> endobj 151 0 obj << /Title 152 0 R /A 149 0 R /Parent 131 0 R /Prev 147 0 R -/Next 155 0 R +/Next 159 0 R +/First 155 0 R +/Last 155 0 R +/Count -1 >> endobj 147 0 obj << /Title 148 0 R @@ -10582,11 +10668,11 @@ endobj 131 0 obj << /Title 132 0 R /A 129 0 R -/Parent 1936 0 R +/Parent 1942 0 R /Prev 91 0 R -/Next 227 0 R +/Next 231 0 R /First 135 0 R -/Last 215 0 R +/Last 219 0 R /Count -9 >> endobj 127 0 obj << @@ -10656,7 +10742,7 @@ endobj 91 0 obj << /Title 92 0 R /A 89 0 R -/Parent 1936 0 R +/Parent 1942 0 R /Prev 67 0 R /Next 131 0 R /First 95 0 R @@ -10699,7 +10785,7 @@ endobj 67 0 obj << /Title 68 0 R /A 65 0 R -/Parent 1936 0 R +/Parent 1942 0 R /Prev 7 0 R /Next 91 0 R /First 71 0 R @@ -10808,1588 +10894,1570 @@ endobj 7 0 obj << /Title 8 0 R /A 5 0 R -/Parent 1936 0 R +/Parent 1942 0 R /Next 67 0 R /First 11 0 R /Last 23 0 R /Count -4 >> endobj -1937 0 obj << -/Names [(Access_Control_Lists) 1470 0 R (Bv9ARM.ch01) 869 0 R (Bv9ARM.ch02) 918 0 R (Bv9ARM.ch03) 935 0 R (Bv9ARM.ch04) 984 0 R (Bv9ARM.ch05) 1071 0 R (Bv9ARM.ch06) 1082 0 R (Bv9ARM.ch07) 1469 0 R (Bv9ARM.ch08) 1495 0 R (Bv9ARM.ch09) 1510 0 R (Bv9ARM.ch10) 1732 0 R (Configuration_File_Grammar) 1107 0 R (DNSSEC) 1050 0 R (Doc-Start) 651 0 R (Setting_TTLs) 1435 0 R (acache) 925 0 R (access_control) 1225 0 R (acl) 1115 0 R (address_match_lists) 1088 0 R (admin_tools) 958 0 R (appendix.A) 566 0 R (appendix.B) 602 0 R (bibliography) 1518 0 R (boolean_options) 1000 0 R (builtin) 1294 0 R (chapter*.1) 686 0 R (chapter.1) 6 0 R (chapter.2) 66 0 R (chapter.3) 90 0 R (chapter.4) 130 0 R (chapter.5) 226 0 R (chapter.6) 238 0 R (chapter.7) 522 0 R (chapter.8) 546 0 R (cite.RFC1033) 1642 0 R (cite.RFC1034) 1526 0 R (cite.RFC1035) 1528 0 R (cite.RFC1101) 1628 0 R (cite.RFC1123) 1630 0 R (cite.RFC1183) 1585 0 R (cite.RFC1464) 1668 0 R (cite.RFC1535) 1575 0 R (cite.RFC1536) 1577 0 R (cite.RFC1537) 1644 0 R (cite.RFC1591) 1632 0 R (cite.RFC1706) 1587 0 R (cite.RFC1712) 1689 0 R (cite.RFC1713) 1670 0 R (cite.RFC1794) 1672 0 R (cite.RFC1876) 1589 0 R (cite.RFC1912) 1646 0 R (cite.RFC1982) 1579 0 R (cite.RFC1995) 1533 0 R (cite.RFC1996) 1535 0 R (cite.RFC2010) 1648 0 R (cite.RFC2052) 1591 0 R (cite.RFC2065) 1697 0 R (cite.RFC2136) 1541 0 R (cite.RFC2137) 1699 0 R (cite.RFC2163) 1598 0 R (cite.RFC2168) 1600 0 R (cite.RFC2181) 1543 0 R (cite.RFC2219) 1650 0 R (cite.RFC2230) 1602 0 R (cite.RFC2240) 1674 0 R (cite.RFC2308) 1545 0 R (cite.RFC2317) 1634 0 R (cite.RFC2345) 1676 0 R (cite.RFC2352) 1678 0 R (cite.RFC2535) 1701 0 R (cite.RFC2536) 1604 0 R (cite.RFC2537) 1606 0 R (cite.RFC2538) 1608 0 R (cite.RFC2539) 1610 0 R (cite.RFC2540) 1612 0 R (cite.RFC2671) 1547 0 R (cite.RFC2672) 1549 0 R (cite.RFC2673) 1691 0 R (cite.RFC2782) 1614 0 R (cite.RFC2825) 1658 0 R (cite.RFC2826) 1636 0 R (cite.RFC2845) 1551 0 R (cite.RFC2874) 1693 0 R (cite.RFC2915) 1616 0 R (cite.RFC2929) 1638 0 R (cite.RFC2930) 1553 0 R (cite.RFC2931) 1555 0 R (cite.RFC3007) 1557 0 R (cite.RFC3008) 1703 0 R (cite.RFC3071) 1681 0 R (cite.RFC3090) 1705 0 R (cite.RFC3110) 1618 0 R (cite.RFC3123) 1620 0 R (cite.RFC3225) 1563 0 R (cite.RFC3258) 1683 0 R (cite.RFC3445) 1707 0 R (cite.RFC3490) 1660 0 R (cite.RFC3491) 1662 0 R (cite.RFC3492) 1664 0 R (cite.RFC3596) 1622 0 R (cite.RFC3597) 1624 0 R (cite.RFC3645) 1559 0 R (cite.RFC3655) 1713 0 R (cite.RFC3658) 1715 0 R (cite.RFC3755) 1717 0 R (cite.RFC3757) 1719 0 R (cite.RFC3833) 1565 0 R (cite.RFC3845) 1721 0 R (cite.RFC3901) 1685 0 R (cite.RFC4033) 1567 0 R (cite.RFC4035) 1569 0 R (cite.RFC4044) 1571 0 R (cite.RFC4074) 1581 0 R (cite.RFC974) 1530 0 R (cite.id2499288) 1726 0 R (configuration_file_elements) 1083 0 R (controls_statement_definition_and_usage) 971 0 R (diagnostic_tools) 906 0 R (dynamic_update) 994 0 R (dynamic_update_policies) 1045 0 R (dynamic_update_security) 1229 0 R (empty) 1296 0 R (historical_dns_information) 1512 0 R (id2465025) 870 0 R (id2467300) 871 0 R (id2467571) 875 0 R (id2467580) 876 0 R (id2467712) 886 0 R (id2467889) 888 0 R (id2467910) 889 0 R (id2467944) 890 0 R (id2468028) 893 0 R (id2470290) 900 0 R (id2470313) 903 0 R (id2470343) 904 0 R (id2470364) 905 0 R (id2470462) 911 0 R (id2470498) 912 0 R (id2470593) 913 0 R (id2470627) 919 0 R (id2470653) 920 0 R (id2470666) 921 0 R (id2470692) 924 0 R (id2470702) 930 0 R (id2470871) 937 0 R (id2470887) 938 0 R (id2470909) 944 0 R (id2470996) 945 0 R (id2471333) 948 0 R (id2471338) 949 0 R (id2472977) 976 0 R (id2472988) 977 0 R (id2473298) 1009 0 R (id2473817) 1025 0 R (id2473834) 1026 0 R (id2473873) 1031 0 R (id2473891) 1032 0 R (id2473901) 1033 0 R (id2474009) 1034 0 R (id2474067) 1035 0 R (id2474112) 1041 0 R (id2474194) 1042 0 R (id2474243) 1043 0 R (id2474448) 1051 0 R (id2474517) 1052 0 R (id2474596) 1057 0 R (id2474807) 1062 0 R (id2474869) 1064 0 R (id2475027) 1065 0 R (id2475060) 1072 0 R (id2475207) 1084 0 R (id2476000) 1093 0 R (id2476027) 1094 0 R (id2476202) 1099 0 R (id2476217) 1100 0 R (id2476247) 1101 0 R (id2476330) 1108 0 R (id2476746) 1114 0 R (id2476857) 1116 0 R (id2477004) 1118 0 R (id2477365) 1125 0 R (id2477380) 1126 0 R (id2477403) 1127 0 R (id2477425) 1128 0 R (id2477652) 1137 0 R (id2477778) 1138 0 R (id2477830) 1144 0 R (id2478455) 1155 0 R (id2479265) 1161 0 R (id2479338) 1162 0 R (id2479402) 1169 0 R (id2479446) 1170 0 R (id2479461) 1171 0 R (id2481443) 1192 0 R (id2483481) 1218 0 R (id2483540) 1224 0 R (id2483825) 1235 0 R (id2484050) 1240 0 R (id2484796) 1249 0 R (id2484811) 1255 0 R (id2484995) 1257 0 R (id2485128) 1263 0 R (id2485627) 1277 0 R (id2486913) 1307 0 R (id2487900) 1324 0 R (id2487949) 1325 0 R (id2488098) 1327 0 R (id2489468) 1345 0 R (id2489476) 1346 0 R (id2489481) 1347 0 R (id2489963) 1353 0 R (id2489996) 1354 0 R (id2491403) 1399 0 R (id2491660) 1405 0 R (id2491678) 1406 0 R (id2491699) 1409 0 R (id2491936) 1411 0 R (id2493033) 1417 0 R (id2493161) 1423 0 R (id2493182) 1424 0 R (id2493613) 1426 0 R (id2493750) 1432 0 R (id2493772) 1433 0 R (id2494245) 1436 0 R (id2494370) 1442 0 R (id2494385) 1443 0 R (id2494497) 1445 0 R (id2494519) 1446 0 R (id2494580) 1447 0 R (id2494649) 1453 0 R (id2494754) 1454 0 R (id2494816) 1455 0 R (id2495430) 1479 0 R (id2495575) 1480 0 R (id2495635) 1481 0 R (id2495715) 1496 0 R (id2495720) 1497 0 R (id2495732) 1498 0 R (id2495749) 1499 0 R (id2495811) 1511 0 R (id2496041) 1517 0 R (id2496161) 1522 0 R (id2496163) 1524 0 R (id2496171) 1529 0 R (id2496195) 1525 0 R (id2496218) 1527 0 R (id2496254) 1542 0 R (id2496281) 1544 0 R (id2496307) 1532 0 R (id2496331) 1534 0 R (id2496355) 1540 0 R (id2496410) 1546 0 R (id2496437) 1548 0 R (id2496464) 1550 0 R (id2496525) 1552 0 R (id2496555) 1554 0 R (id2496585) 1556 0 R (id2496612) 1558 0 R (id2496686) 1561 0 R (id2496694) 1562 0 R (id2496789) 1564 0 R (id2496825) 1566 0 R (id2496890) 1570 0 R (id2496955) 1568 0 R (id2497020) 1573 0 R (id2497029) 1574 0 R (id2497054) 1576 0 R (id2497123) 1578 0 R (id2497158) 1580 0 R (id2497267) 1583 0 R (id2497272) 1584 0 R (id2497330) 1586 0 R (id2497367) 1599 0 R (id2497402) 1588 0 R (id2497457) 1590 0 R (id2497495) 1597 0 R (id2497521) 1601 0 R (id2497546) 1603 0 R (id2497573) 1605 0 R (id2497600) 1607 0 R (id2497639) 1609 0 R (id2497669) 1611 0 R (id2497699) 1613 0 R (id2497741) 1615 0 R (id2497774) 1617 0 R (id2497801) 1619 0 R (id2497825) 1621 0 R (id2497882) 1623 0 R (id2497907) 1626 0 R (id2497914) 1627 0 R (id2497940) 1629 0 R (id2497962) 1631 0 R (id2497986) 1633 0 R (id2498032) 1635 0 R (id2498055) 1637 0 R (id2498105) 1640 0 R (id2498113) 1641 0 R (id2498136) 1643 0 R (id2498163) 1645 0 R (id2498189) 1647 0 R (id2498226) 1649 0 R (id2498266) 1656 0 R (id2498272) 1657 0 R (id2498304) 1659 0 R (id2498349) 1661 0 R (id2498453) 1663 0 R (id2498480) 1666 0 R (id2498498) 1667 0 R (id2498520) 1669 0 R (id2498546) 1671 0 R (id2498571) 1673 0 R (id2498595) 1675 0 R (id2498641) 1677 0 R (id2498664) 1680 0 R (id2498691) 1682 0 R (id2498716) 1684 0 R (id2498753) 1679 0 R (id2498777) 1687 0 R (id2498784) 1688 0 R (id2498841) 1690 0 R (id2498868) 1692 0 R (id2498904) 1695 0 R (id2498916) 1696 0 R (id2498955) 1698 0 R (id2498982) 1700 0 R (id2499012) 1702 0 R (id2499037) 1704 0 R (id2499064) 1706 0 R (id2499100) 1712 0 R (id2499137) 1714 0 R (id2499163) 1716 0 R (id2499190) 1718 0 R (id2499235) 1720 0 R (id2499276) 1723 0 R (id2499286) 1725 0 R (id2499288) 1727 0 R (incremental_zone_transfers) 1006 0 R (internet_drafts) 1722 0 R (ipv6addresses) 1066 0 R (journal) 995 0 R (lwresd) 1073 0 R (man.dig) 1733 0 R (man.dnssec-keygen) 1781 0 R (man.dnssec-signzone) 1799 0 R (man.host) 1766 0 R (man.named) 1848 0 R (man.named-checkconf) 1819 0 R (man.named-checkzone) 1831 0 R (man.rndc) 1870 0 R (man.rndc-confgen) 1899 0 R (man.rndc.conf) 1882 0 R (notify) 985 0 R (options) 1181 0 R (page.1) 650 0 R (page.10) 910 0 R (page.100) 1761 0 R (page.101) 1773 0 R (page.102) 1777 0 R (page.103) 1789 0 R (page.104) 1795 0 R (page.105) 1806 0 R (page.106) 1811 0 R (page.107) 1816 0 R (page.108) 1828 0 R (page.109) 1839 0 R (page.11) 917 0 R (page.110) 1844 0 R (page.111) 1856 0 R (page.112) 1860 0 R (page.113) 1868 0 R (page.114) 1878 0 R (page.115) 1889 0 R (page.116) 1895 0 R (page.117) 1906 0 R (page.118) 1912 0 R (page.12) 929 0 R (page.13) 934 0 R (page.14) 943 0 R (page.15) 954 0 R (page.16) 962 0 R (page.17) 969 0 R (page.18) 975 0 R (page.19) 983 0 R (page.2) 675 0 R (page.20) 1005 0 R (page.21) 1014 0 R (page.22) 1019 0 R (page.23) 1023 0 R (page.24) 1030 0 R (page.25) 1039 0 R (page.26) 1049 0 R (page.27) 1056 0 R (page.28) 1061 0 R (page.29) 1070 0 R (page.3) 685 0 R (page.30) 1077 0 R (page.31) 1081 0 R (page.32) 1092 0 R (page.33) 1098 0 R (page.34) 1106 0 R (page.35) 1113 0 R (page.36) 1122 0 R (page.37) 1135 0 R (page.38) 1143 0 R (page.39) 1148 0 R (page.4) 740 0 R (page.40) 1154 0 R (page.41) 1160 0 R (page.42) 1168 0 R (page.43) 1175 0 R (page.44) 1180 0 R (page.45) 1185 0 R (page.46) 1191 0 R (page.47) 1197 0 R (page.48) 1202 0 R (page.49) 1212 0 R (page.5) 804 0 R (page.50) 1217 0 R (page.51) 1222 0 R (page.52) 1233 0 R (page.53) 1239 0 R (page.54) 1244 0 R (page.55) 1248 0 R (page.56) 1254 0 R (page.57) 1262 0 R (page.58) 1268 0 R (page.59) 1275 0 R (page.6) 864 0 R (page.60) 1283 0 R (page.61) 1290 0 R (page.62) 1302 0 R (page.63) 1306 0 R (page.64) 1312 0 R (page.65) 1317 0 R (page.66) 1322 0 R (page.67) 1331 0 R (page.68) 1336 0 R (page.69) 1340 0 R (page.7) 868 0 R (page.70) 1344 0 R (page.71) 1352 0 R (page.72) 1364 0 R (page.73) 1375 0 R (page.74) 1398 0 R (page.75) 1404 0 R (page.76) 1416 0 R (page.77) 1422 0 R (page.78) 1430 0 R (page.79) 1441 0 R (page.8) 885 0 R (page.80) 1452 0 R (page.81) 1460 0 R (page.82) 1464 0 R (page.83) 1468 0 R (page.84) 1474 0 R (page.85) 1485 0 R (page.86) 1490 0 R (page.87) 1494 0 R (page.88) 1505 0 R (page.89) 1509 0 R (page.9) 899 0 R (page.90) 1516 0 R (page.91) 1539 0 R (page.92) 1596 0 R (page.93) 1654 0 R (page.94) 1711 0 R (page.95) 1731 0 R (page.96) 1740 0 R (page.97) 1746 0 R (page.98) 1752 0 R (page.99) 1756 0 R (proposed_standards) 1010 0 R (rfcs) 895 0 R (rndc) 1131 0 R (rrset_ordering) 950 0 R (sample_configuration) 936 0 R (section*.10) 1655 0 R (section*.11) 1665 0 R (section*.12) 1686 0 R (section*.13) 1694 0 R (section*.14) 1724 0 R (section*.15) 1734 0 R (section*.16) 1735 0 R (section*.17) 1736 0 R (section*.18) 1741 0 R (section*.19) 1742 0 R (section*.2) 1521 0 R (section*.20) 1747 0 R (section*.21) 1757 0 R (section*.22) 1762 0 R (section*.23) 1763 0 R (section*.24) 1764 0 R (section*.25) 1765 0 R (section*.26) 1767 0 R (section*.27) 1768 0 R (section*.28) 1769 0 R (section*.29) 1778 0 R (section*.3) 1523 0 R (section*.30) 1779 0 R (section*.31) 1780 0 R (section*.32) 1782 0 R (section*.33) 1783 0 R (section*.34) 1784 0 R (section*.35) 1785 0 R (section*.36) 1790 0 R (section*.37) 1796 0 R (section*.38) 1797 0 R (section*.39) 1798 0 R (section*.4) 1531 0 R (section*.40) 1800 0 R (section*.41) 1801 0 R (section*.42) 1802 0 R (section*.43) 1807 0 R (section*.44) 1812 0 R (section*.45) 1817 0 R (section*.46) 1818 0 R (section*.47) 1820 0 R (section*.48) 1821 0 R (section*.49) 1822 0 R (section*.5) 1560 0 R (section*.50) 1823 0 R (section*.51) 1824 0 R (section*.52) 1829 0 R (section*.53) 1830 0 R (section*.54) 1832 0 R (section*.55) 1833 0 R (section*.56) 1834 0 R (section*.57) 1835 0 R (section*.58) 1845 0 R (section*.59) 1846 0 R (section*.6) 1572 0 R (section*.60) 1847 0 R (section*.61) 1849 0 R (section*.62) 1850 0 R (section*.63) 1851 0 R (section*.64) 1852 0 R (section*.65) 1861 0 R (section*.66) 1862 0 R (section*.67) 1863 0 R (section*.68) 1864 0 R (section*.69) 1869 0 R (section*.7) 1582 0 R (section*.70) 1871 0 R (section*.71) 1872 0 R (section*.72) 1873 0 R (section*.73) 1874 0 R (section*.74) 1879 0 R (section*.75) 1880 0 R (section*.76) 1881 0 R (section*.77) 1883 0 R (section*.78) 1884 0 R (section*.79) 1885 0 R (section*.8) 1625 0 R (section*.80) 1890 0 R (section*.81) 1896 0 R (section*.82) 1897 0 R (section*.83) 1898 0 R (section*.84) 1900 0 R (section*.85) 1901 0 R (section*.86) 1902 0 R (section*.87) 1907 0 R (section*.88) 1908 0 R (section*.89) 1913 0 R (section*.9) 1639 0 R (section*.90) 1914 0 R (section.1.1) 10 0 R (section.1.2) 14 0 R (section.1.3) 18 0 R (section.1.4) 22 0 R (section.2.1) 70 0 R (section.2.2) 74 0 R (section.2.3) 78 0 R (section.2.4) 82 0 R (section.2.5) 86 0 R (section.3.1) 94 0 R (section.3.2) 106 0 R (section.3.3) 110 0 R (section.4.1) 134 0 R (section.4.2) 138 0 R (section.4.3) 146 0 R (section.4.4) 150 0 R (section.4.5) 154 0 R (section.4.6) 190 0 R (section.4.7) 194 0 R (section.4.8) 198 0 R (section.4.9) 214 0 R (section.5.1) 230 0 R (section.5.2) 234 0 R (section.6.1) 242 0 R (section.6.2) 270 0 R (section.6.3) 470 0 R (section.7.1) 526 0 R (section.7.2) 530 0 R (section.7.3) 542 0 R (section.8.1) 550 0 R (section.8.2) 558 0 R (section.8.3) 562 0 R (section.A.1) 570 0 R (section.A.2) 578 0 R (section.A.3) 586 0 R (section.B.1) 606 0 R (section.B.10) 642 0 R (section.B.2) 610 0 R (section.B.3) 614 0 R (section.B.4) 618 0 R (section.B.5) 622 0 R (section.B.6) 626 0 R (section.B.7) 630 0 R (section.B.8) 634 0 R (section.B.9) 638 0 R (server_statement_definition_and_usage) 1208 0 R (server_statement_grammar) 1313 0 R (statsfile) 1187 0 R (subsection.1.4.1) 26 0 R (subsection.1.4.2) 30 0 R (subsection.1.4.3) 34 0 R (subsection.1.4.4) 38 0 R (subsection.1.4.5) 54 0 R (subsection.1.4.6) 62 0 R (subsection.3.1.1) 98 0 R (subsection.3.1.2) 102 0 R (subsection.3.3.1) 114 0 R (subsection.3.3.2) 126 0 R (subsection.4.2.1) 142 0 R (subsection.4.5.1) 158 0 R (subsection.4.5.2) 170 0 R (subsection.4.5.3) 174 0 R (subsection.4.5.4) 178 0 R (subsection.4.5.5) 182 0 R (subsection.4.5.6) 186 0 R (subsection.4.8.1) 202 0 R (subsection.4.8.2) 206 0 R (subsection.4.8.3) 210 0 R (subsection.4.9.1) 218 0 R (subsection.4.9.2) 222 0 R (subsection.6.1.1) 246 0 R (subsection.6.1.2) 258 0 R (subsection.6.2.1) 274 0 R (subsection.6.2.10) 310 0 R (subsection.6.2.11) 322 0 R (subsection.6.2.12) 326 0 R (subsection.6.2.13) 330 0 R (subsection.6.2.14) 334 0 R (subsection.6.2.15) 338 0 R (subsection.6.2.16) 342 0 R (subsection.6.2.17) 422 0 R (subsection.6.2.18) 426 0 R (subsection.6.2.19) 430 0 R (subsection.6.2.2) 278 0 R (subsection.6.2.20) 434 0 R (subsection.6.2.21) 438 0 R (subsection.6.2.22) 442 0 R (subsection.6.2.23) 446 0 R (subsection.6.2.24) 450 0 R (subsection.6.2.3) 282 0 R (subsection.6.2.4) 286 0 R (subsection.6.2.5) 290 0 R (subsection.6.2.6) 294 0 R (subsection.6.2.7) 298 0 R (subsection.6.2.8) 302 0 R (subsection.6.2.9) 306 0 R (subsection.6.3.1) 474 0 R (subsection.6.3.2) 486 0 R (subsection.6.3.3) 490 0 R (subsection.6.3.4) 494 0 R (subsection.6.3.5) 498 0 R (subsection.6.3.6) 514 0 R (subsection.6.3.7) 518 0 R (subsection.7.2.1) 534 0 R (subsection.7.2.2) 538 0 R (subsection.8.1.1) 554 0 R (subsection.A.1.1) 574 0 R (subsection.A.2.1) 582 0 R (subsection.A.3.1) 590 0 R (subsection.A.3.2) 594 0 R (subsection.A.3.3) 598 0 R (subsubsection.1.4.4.1) 42 0 R (subsubsection.1.4.4.2) 46 0 R (subsubsection.1.4.4.3) 50 0 R (subsubsection.1.4.5.1) 58 0 R (subsubsection.3.3.1.1) 118 0 R (subsubsection.3.3.1.2) 122 0 R (subsubsection.4.5.1.1) 162 0 R (subsubsection.4.5.1.2) 166 0 R (subsubsection.6.1.1.1) 250 0 R (subsubsection.6.1.1.2) 254 0 R (subsubsection.6.1.2.1) 262 0 R (subsubsection.6.1.2.2) 266 0 R (subsubsection.6.2.10.1) 314 0 R (subsubsection.6.2.10.2) 318 0 R (subsubsection.6.2.16.1) 346 0 R (subsubsection.6.2.16.10) 382 0 R (subsubsection.6.2.16.11) 386 0 R (subsubsection.6.2.16.12) 390 0 R (subsubsection.6.2.16.13) 394 0 R (subsubsection.6.2.16.14) 398 0 R (subsubsection.6.2.16.15) 402 0 R (subsubsection.6.2.16.16) 406 0 R (subsubsection.6.2.16.17) 410 0 R (subsubsection.6.2.16.18) 414 0 R (subsubsection.6.2.16.19) 418 0 R (subsubsection.6.2.16.2) 350 0 R (subsubsection.6.2.16.3) 354 0 R (subsubsection.6.2.16.4) 358 0 R (subsubsection.6.2.16.5) 362 0 R (subsubsection.6.2.16.6) 366 0 R (subsubsection.6.2.16.7) 370 0 R (subsubsection.6.2.16.8) 374 0 R (subsubsection.6.2.16.9) 378 0 R (subsubsection.6.2.24.1) 454 0 R (subsubsection.6.2.24.2) 458 0 R (subsubsection.6.2.24.3) 462 0 R (subsubsection.6.2.24.4) 466 0 R (subsubsection.6.3.1.1) 478 0 R (subsubsection.6.3.1.2) 482 0 R (subsubsection.6.3.5.1) 502 0 R (subsubsection.6.3.5.2) 506 0 R (subsubsection.6.3.5.3) 510 0 R (table.1.1) 877 0 R (table.1.2) 887 0 R (table.3.1) 946 0 R (table.3.2) 978 0 R (table.6.1) 1085 0 R (table.6.10) 1410 0 R (table.6.11) 1412 0 R (table.6.12) 1418 0 R (table.6.13) 1425 0 R (table.6.14) 1431 0 R (table.6.15) 1434 0 R (table.6.16) 1437 0 R (table.6.17) 1444 0 R (table.6.18) 1456 0 R (table.6.2) 1109 0 R (table.6.3) 1117 0 R (table.6.4) 1156 0 R (table.6.5) 1193 0 R (table.6.6) 1278 0 R (table.6.7) 1308 0 R (table.6.8) 1348 0 R (table.6.9) 1400 0 R (the_category_phrase) 1150 0 R (the_sortlist_statement) 1269 0 R (topology) 1264 0 R (tsig) 1024 0 R (tuning) 1279 0 R (types_of_resource_records_and_when_to_use_them) 894 0 R (view_statement_grammar) 1298 0 R (zone_statement_grammar) 1228 0 R (zone_transfers) 1001 0 R (zonefile_format) 1286 0 R] +1943 0 obj << +/Names [(Access_Control_Lists) 1477 0 R (Bv9ARM.ch01) 874 0 R (Bv9ARM.ch02) 923 0 R (Bv9ARM.ch03) 940 0 R (Bv9ARM.ch04) 989 0 R (Bv9ARM.ch05) 1077 0 R (Bv9ARM.ch06) 1088 0 R (Bv9ARM.ch07) 1476 0 R (Bv9ARM.ch08) 1502 0 R (Bv9ARM.ch09) 1517 0 R (Bv9ARM.ch10) 1738 0 R (Configuration_File_Grammar) 1113 0 R (DNSSEC) 1056 0 R (Doc-Start) 655 0 R (Setting_TTLs) 1446 0 R (acache) 930 0 R (access_control) 1231 0 R (acl) 1121 0 R (address_match_lists) 1094 0 R (admin_tools) 963 0 R (appendix.A) 570 0 R (appendix.B) 606 0 R (bibliography) 1525 0 R (boolean_options) 1005 0 R (builtin) 1300 0 R (chapter*.1) 690 0 R (chapter.1) 6 0 R (chapter.2) 66 0 R (chapter.3) 90 0 R (chapter.4) 130 0 R (chapter.5) 230 0 R (chapter.6) 242 0 R (chapter.7) 526 0 R (chapter.8) 550 0 R (cite.RFC1033) 1653 0 R (cite.RFC1034) 1537 0 R (cite.RFC1035) 1539 0 R (cite.RFC1101) 1635 0 R (cite.RFC1123) 1637 0 R (cite.RFC1183) 1597 0 R (cite.RFC1464) 1675 0 R (cite.RFC1535) 1582 0 R (cite.RFC1536) 1584 0 R (cite.RFC1537) 1655 0 R (cite.RFC1591) 1639 0 R (cite.RFC1706) 1599 0 R (cite.RFC1712) 1695 0 R (cite.RFC1713) 1677 0 R (cite.RFC1794) 1679 0 R (cite.RFC1876) 1601 0 R (cite.RFC1912) 1657 0 R (cite.RFC1982) 1586 0 R (cite.RFC1995) 1544 0 R (cite.RFC1996) 1546 0 R (cite.RFC2010) 1659 0 R (cite.RFC2052) 1603 0 R (cite.RFC2065) 1707 0 R (cite.RFC2136) 1548 0 R (cite.RFC2137) 1709 0 R (cite.RFC2163) 1605 0 R (cite.RFC2168) 1607 0 R (cite.RFC2181) 1550 0 R (cite.RFC2219) 1661 0 R (cite.RFC2230) 1609 0 R (cite.RFC2240) 1681 0 R (cite.RFC2308) 1552 0 R (cite.RFC2317) 1641 0 R (cite.RFC2345) 1683 0 R (cite.RFC2352) 1685 0 R (cite.RFC2535) 1711 0 R (cite.RFC2536) 1611 0 R (cite.RFC2537) 1613 0 R (cite.RFC2538) 1615 0 R (cite.RFC2539) 1617 0 R (cite.RFC2540) 1619 0 R (cite.RFC2671) 1554 0 R (cite.RFC2672) 1556 0 R (cite.RFC2673) 1697 0 R (cite.RFC2782) 1621 0 R (cite.RFC2825) 1665 0 R (cite.RFC2826) 1643 0 R (cite.RFC2845) 1558 0 R (cite.RFC2874) 1699 0 R (cite.RFC2915) 1623 0 R (cite.RFC2929) 1645 0 R (cite.RFC2930) 1560 0 R (cite.RFC2931) 1562 0 R (cite.RFC3007) 1564 0 R (cite.RFC3008) 1713 0 R (cite.RFC3071) 1687 0 R (cite.RFC3090) 1715 0 R (cite.RFC3110) 1625 0 R (cite.RFC3123) 1627 0 R (cite.RFC3225) 1570 0 R (cite.RFC3258) 1689 0 R (cite.RFC3445) 1717 0 R (cite.RFC3490) 1667 0 R (cite.RFC3491) 1669 0 R (cite.RFC3492) 1671 0 R (cite.RFC3596) 1629 0 R (cite.RFC3597) 1631 0 R (cite.RFC3645) 1566 0 R (cite.RFC3655) 1719 0 R (cite.RFC3658) 1721 0 R (cite.RFC3755) 1723 0 R (cite.RFC3757) 1725 0 R (cite.RFC3833) 1572 0 R (cite.RFC3845) 1727 0 R (cite.RFC3901) 1691 0 R (cite.RFC4033) 1574 0 R (cite.RFC4035) 1576 0 R (cite.RFC4044) 1578 0 R (cite.RFC4074) 1588 0 R (cite.RFC974) 1541 0 R (cite.id2499701) 1732 0 R (configuration_file_elements) 1089 0 R (controls_statement_definition_and_usage) 976 0 R (diagnostic_tools) 911 0 R (dynamic_update) 999 0 R (dynamic_update_policies) 1051 0 R (dynamic_update_security) 1235 0 R (empty) 1302 0 R (historical_dns_information) 1519 0 R (id2465026) 875 0 R (id2466484) 876 0 R (id2467305) 880 0 R (id2467506) 881 0 R (id2467714) 891 0 R (id2467891) 893 0 R (id2467912) 894 0 R (id2467946) 895 0 R (id2468030) 898 0 R (id2470292) 905 0 R (id2470315) 908 0 R (id2470345) 909 0 R (id2470435) 910 0 R (id2470465) 916 0 R (id2470500) 917 0 R (id2470595) 918 0 R (id2470629) 924 0 R (id2470656) 925 0 R (id2470668) 926 0 R (id2470694) 929 0 R (id2470705) 935 0 R (id2470805) 942 0 R (id2470821) 943 0 R (id2470843) 949 0 R (id2470860) 950 0 R (id2471334) 953 0 R (id2471339) 954 0 R (id2473122) 981 0 R (id2473133) 982 0 R (id2473511) 1014 0 R (id2473529) 1015 0 R (id2473964) 1031 0 R (id2473981) 1032 0 R (id2474020) 1037 0 R (id2474038) 1038 0 R (id2474049) 1039 0 R (id2474156) 1040 0 R (id2474282) 1041 0 R (id2474327) 1047 0 R (id2474341) 1048 0 R (id2474390) 1049 0 R (id2474595) 1057 0 R (id2474732) 1058 0 R (id2474811) 1063 0 R (id2474954) 1068 0 R (id2475084) 1070 0 R (id2475106) 1071 0 R (id2475139) 1078 0 R (id2475354) 1090 0 R (id2476147) 1099 0 R (id2476174) 1100 0 R (id2476281) 1105 0 R (id2476296) 1106 0 R (id2476394) 1107 0 R (id2476477) 1114 0 R (id2476893) 1120 0 R (id2476936) 1122 0 R (id2477152) 1124 0 R (id2477512) 1131 0 R (id2477527) 1132 0 R (id2477550) 1133 0 R (id2477572) 1134 0 R (id2477662) 1143 0 R (id2477857) 1144 0 R (id2477909) 1150 0 R (id2478602) 1161 0 R (id2479412) 1167 0 R (id2479485) 1168 0 R (id2479549) 1175 0 R (id2479593) 1176 0 R (id2479608) 1177 0 R (id2481708) 1202 0 R (id2483474) 1224 0 R (id2483532) 1230 0 R (id2483954) 1241 0 R (id2484042) 1246 0 R (id2484857) 1255 0 R (id2484872) 1261 0 R (id2485056) 1263 0 R (id2485257) 1269 0 R (id2485688) 1283 0 R (id2486990) 1313 0 R (id2488093) 1330 0 R (id2488142) 1331 0 R (id2488222) 1337 0 R (id2489668) 1351 0 R (id2489675) 1352 0 R (id2489681) 1353 0 R (id2490299) 1359 0 R (id2490332) 1364 0 R (id2491624) 1406 0 R (id2491881) 1412 0 R (id2491899) 1413 0 R (id2491920) 1416 0 R (id2492156) 1422 0 R (id2493254) 1428 0 R (id2493382) 1430 0 R (id2493403) 1435 0 R (id2493834) 1437 0 R (id2493971) 1439 0 R (id2494061) 1440 0 R (id2494466) 1447 0 R (id2494590) 1449 0 R (id2494605) 1450 0 R (id2494717) 1452 0 R (id2494876) 1458 0 R (id2494937) 1459 0 R (id2495006) 1460 0 R (id2495043) 1461 0 R (id2495105) 1466 0 R (id2495584) 1486 0 R (id2495729) 1487 0 R (id2495788) 1488 0 R (id2495868) 1503 0 R (id2495874) 1504 0 R (id2495885) 1505 0 R (id2496039) 1506 0 R (id2496101) 1518 0 R (id2496273) 1524 0 R (id2496529) 1529 0 R (id2496531) 1535 0 R (id2496539) 1540 0 R (id2496563) 1536 0 R (id2496586) 1538 0 R (id2496622) 1549 0 R (id2496649) 1551 0 R (id2496675) 1543 0 R (id2496699) 1545 0 R (id2496791) 1547 0 R (id2496846) 1553 0 R (id2496873) 1555 0 R (id2496900) 1557 0 R (id2496962) 1559 0 R (id2496992) 1561 0 R (id2497021) 1563 0 R (id2497048) 1565 0 R (id2497123) 1568 0 R (id2497198) 1569 0 R (id2497225) 1571 0 R (id2497261) 1573 0 R (id2497326) 1577 0 R (id2497392) 1575 0 R (id2497457) 1580 0 R (id2497465) 1581 0 R (id2497559) 1583 0 R (id2497627) 1585 0 R (id2497662) 1587 0 R (id2497703) 1595 0 R (id2497708) 1596 0 R (id2497766) 1598 0 R (id2497803) 1606 0 R (id2497838) 1600 0 R (id2497893) 1602 0 R (id2497931) 1604 0 R (id2497957) 1608 0 R (id2497982) 1610 0 R (id2498009) 1612 0 R (id2498036) 1614 0 R (id2498075) 1616 0 R (id2498105) 1618 0 R (id2498135) 1620 0 R (id2498178) 1622 0 R (id2498211) 1624 0 R (id2498237) 1626 0 R (id2498261) 1628 0 R (id2498318) 1630 0 R (id2498343) 1633 0 R (id2498350) 1634 0 R (id2498376) 1636 0 R (id2498398) 1638 0 R (id2498422) 1640 0 R (id2498468) 1642 0 R (id2498491) 1644 0 R (id2498541) 1651 0 R (id2498549) 1652 0 R (id2498572) 1654 0 R (id2498599) 1656 0 R (id2498626) 1658 0 R (id2498662) 1660 0 R (id2498702) 1663 0 R (id2498708) 1664 0 R (id2498740) 1666 0 R (id2498854) 1668 0 R (id2498889) 1670 0 R (id2498916) 1673 0 R (id2498934) 1674 0 R (id2498956) 1676 0 R (id2498982) 1678 0 R (id2499008) 1680 0 R (id2499031) 1682 0 R (id2499077) 1684 0 R (id2499100) 1686 0 R (id2499127) 1688 0 R (id2499153) 1690 0 R (id2499190) 1693 0 R (id2499196) 1694 0 R (id2499254) 1696 0 R (id2499281) 1698 0 R (id2499317) 1705 0 R (id2499329) 1706 0 R (id2499368) 1708 0 R (id2499395) 1710 0 R (id2499425) 1712 0 R (id2499450) 1714 0 R (id2499477) 1716 0 R (id2499513) 1718 0 R (id2499549) 1720 0 R (id2499576) 1722 0 R (id2499603) 1724 0 R (id2499648) 1726 0 R (id2499689) 1729 0 R (id2499699) 1731 0 R (id2499701) 1733 0 R (incremental_zone_transfers) 1011 0 R (internet_drafts) 1728 0 R (ipv6addresses) 1072 0 R (journal) 1000 0 R (lwresd) 1079 0 R (man.dig) 1739 0 R (man.dnssec-keygen) 1787 0 R (man.dnssec-signzone) 1805 0 R (man.host) 1772 0 R (man.named) 1854 0 R (man.named-checkconf) 1825 0 R (man.named-checkzone) 1837 0 R (man.rndc) 1876 0 R (man.rndc-confgen) 1905 0 R (man.rndc.conf) 1888 0 R (notify) 990 0 R (options) 1187 0 R (page.1) 654 0 R (page.10) 915 0 R (page.100) 1767 0 R (page.101) 1779 0 R (page.102) 1783 0 R (page.103) 1795 0 R (page.104) 1801 0 R (page.105) 1812 0 R (page.106) 1817 0 R (page.107) 1822 0 R (page.108) 1833 0 R (page.109) 1845 0 R (page.11) 922 0 R (page.110) 1850 0 R (page.111) 1861 0 R (page.112) 1866 0 R (page.113) 1873 0 R (page.114) 1884 0 R (page.115) 1895 0 R (page.116) 1901 0 R (page.117) 1911 0 R (page.118) 1917 0 R (page.12) 934 0 R (page.13) 939 0 R (page.14) 948 0 R (page.15) 959 0 R (page.16) 967 0 R (page.17) 974 0 R (page.18) 980 0 R (page.19) 988 0 R (page.2) 679 0 R (page.20) 1010 0 R (page.21) 1020 0 R (page.22) 1025 0 R (page.23) 1029 0 R (page.24) 1036 0 R (page.25) 1045 0 R (page.26) 1055 0 R (page.27) 1062 0 R (page.28) 1067 0 R (page.29) 1076 0 R (page.3) 689 0 R (page.30) 1083 0 R (page.31) 1087 0 R (page.32) 1098 0 R (page.33) 1104 0 R (page.34) 1112 0 R (page.35) 1119 0 R (page.36) 1128 0 R (page.37) 1141 0 R (page.38) 1149 0 R (page.39) 1154 0 R (page.4) 744 0 R (page.40) 1160 0 R (page.41) 1166 0 R (page.42) 1174 0 R (page.43) 1181 0 R (page.44) 1186 0 R (page.45) 1191 0 R (page.46) 1197 0 R (page.47) 1201 0 R (page.48) 1208 0 R (page.49) 1218 0 R (page.5) 808 0 R (page.50) 1223 0 R (page.51) 1228 0 R (page.52) 1239 0 R (page.53) 1245 0 R (page.54) 1250 0 R (page.55) 1254 0 R (page.56) 1260 0 R (page.57) 1268 0 R (page.58) 1274 0 R (page.59) 1281 0 R (page.6) 869 0 R (page.60) 1289 0 R (page.61) 1296 0 R (page.62) 1308 0 R (page.63) 1312 0 R (page.64) 1318 0 R (page.65) 1323 0 R (page.66) 1327 0 R (page.67) 1336 0 R (page.68) 1342 0 R (page.69) 1346 0 R (page.7) 873 0 R (page.70) 1350 0 R (page.71) 1358 0 R (page.72) 1363 0 R (page.73) 1380 0 R (page.74) 1396 0 R (page.75) 1411 0 R (page.76) 1421 0 R (page.77) 1427 0 R (page.78) 1434 0 R (page.79) 1445 0 R (page.8) 890 0 R (page.80) 1457 0 R (page.81) 1465 0 R (page.82) 1471 0 R (page.83) 1475 0 R (page.84) 1481 0 R (page.85) 1492 0 R (page.86) 1497 0 R (page.87) 1501 0 R (page.88) 1512 0 R (page.89) 1516 0 R (page.9) 904 0 R (page.90) 1523 0 R (page.91) 1533 0 R (page.92) 1593 0 R (page.93) 1649 0 R (page.94) 1703 0 R (page.95) 1737 0 R (page.96) 1746 0 R (page.97) 1752 0 R (page.98) 1758 0 R (page.99) 1762 0 R (proposed_standards) 1016 0 R (rfcs) 900 0 R (rndc) 1137 0 R (rrset_ordering) 955 0 R (sample_configuration) 941 0 R (section*.10) 1662 0 R (section*.11) 1672 0 R (section*.12) 1692 0 R (section*.13) 1704 0 R (section*.14) 1730 0 R (section*.15) 1740 0 R (section*.16) 1741 0 R (section*.17) 1742 0 R (section*.18) 1747 0 R (section*.19) 1748 0 R (section*.2) 1528 0 R (section*.20) 1753 0 R (section*.21) 1763 0 R (section*.22) 1768 0 R (section*.23) 1769 0 R (section*.24) 1770 0 R (section*.25) 1771 0 R (section*.26) 1773 0 R (section*.27) 1774 0 R (section*.28) 1775 0 R (section*.29) 1784 0 R (section*.3) 1534 0 R (section*.30) 1785 0 R (section*.31) 1786 0 R (section*.32) 1788 0 R (section*.33) 1789 0 R (section*.34) 1790 0 R (section*.35) 1791 0 R (section*.36) 1796 0 R (section*.37) 1802 0 R (section*.38) 1803 0 R (section*.39) 1804 0 R (section*.4) 1542 0 R (section*.40) 1806 0 R (section*.41) 1807 0 R (section*.42) 1808 0 R (section*.43) 1813 0 R (section*.44) 1818 0 R (section*.45) 1823 0 R (section*.46) 1824 0 R (section*.47) 1826 0 R (section*.48) 1827 0 R (section*.49) 1828 0 R (section*.5) 1567 0 R (section*.50) 1829 0 R (section*.51) 1834 0 R (section*.52) 1835 0 R (section*.53) 1836 0 R (section*.54) 1838 0 R (section*.55) 1839 0 R (section*.56) 1840 0 R (section*.57) 1841 0 R (section*.58) 1851 0 R (section*.59) 1852 0 R (section*.6) 1579 0 R (section*.60) 1853 0 R (section*.61) 1855 0 R (section*.62) 1856 0 R (section*.63) 1857 0 R (section*.64) 1862 0 R (section*.65) 1867 0 R (section*.66) 1868 0 R (section*.67) 1869 0 R (section*.68) 1874 0 R (section*.69) 1875 0 R (section*.7) 1594 0 R (section*.70) 1877 0 R (section*.71) 1878 0 R (section*.72) 1879 0 R (section*.73) 1880 0 R (section*.74) 1885 0 R (section*.75) 1886 0 R (section*.76) 1887 0 R (section*.77) 1889 0 R (section*.78) 1890 0 R (section*.79) 1891 0 R (section*.8) 1632 0 R (section*.80) 1896 0 R (section*.81) 1902 0 R (section*.82) 1903 0 R (section*.83) 1904 0 R (section*.84) 1906 0 R (section*.85) 1907 0 R (section*.86) 1912 0 R (section*.87) 1913 0 R (section*.88) 1918 0 R (section*.89) 1919 0 R (section*.9) 1650 0 R (section*.90) 1920 0 R (section.1.1) 10 0 R (section.1.2) 14 0 R (section.1.3) 18 0 R (section.1.4) 22 0 R (section.2.1) 70 0 R (section.2.2) 74 0 R (section.2.3) 78 0 R (section.2.4) 82 0 R (section.2.5) 86 0 R (section.3.1) 94 0 R (section.3.2) 106 0 R (section.3.3) 110 0 R (section.4.1) 134 0 R (section.4.2) 138 0 R (section.4.3) 146 0 R (section.4.4) 150 0 R (section.4.5) 158 0 R (section.4.6) 194 0 R (section.4.7) 198 0 R (section.4.8) 202 0 R (section.4.9) 218 0 R (section.5.1) 234 0 R (section.5.2) 238 0 R (section.6.1) 246 0 R (section.6.2) 274 0 R (section.6.3) 474 0 R (section.7.1) 530 0 R (section.7.2) 534 0 R (section.7.3) 546 0 R (section.8.1) 554 0 R (section.8.2) 562 0 R (section.8.3) 566 0 R (section.A.1) 574 0 R (section.A.2) 582 0 R (section.A.3) 590 0 R (section.B.1) 610 0 R (section.B.10) 646 0 R (section.B.2) 614 0 R (section.B.3) 618 0 R (section.B.4) 622 0 R (section.B.5) 626 0 R (section.B.6) 630 0 R (section.B.7) 634 0 R (section.B.8) 638 0 R (section.B.9) 642 0 R (server_statement_definition_and_usage) 1214 0 R (server_statement_grammar) 1319 0 R (statsfile) 1193 0 R (subsection.1.4.1) 26 0 R (subsection.1.4.2) 30 0 R (subsection.1.4.3) 34 0 R (subsection.1.4.4) 38 0 R (subsection.1.4.5) 54 0 R (subsection.1.4.6) 62 0 R (subsection.3.1.1) 98 0 R (subsection.3.1.2) 102 0 R (subsection.3.3.1) 114 0 R (subsection.3.3.2) 126 0 R (subsection.4.2.1) 142 0 R (subsection.4.4.1) 154 0 R (subsection.4.5.1) 162 0 R (subsection.4.5.2) 174 0 R (subsection.4.5.3) 178 0 R (subsection.4.5.4) 182 0 R (subsection.4.5.5) 186 0 R (subsection.4.5.6) 190 0 R (subsection.4.8.1) 206 0 R (subsection.4.8.2) 210 0 R (subsection.4.8.3) 214 0 R (subsection.4.9.1) 222 0 R (subsection.4.9.2) 226 0 R (subsection.6.1.1) 250 0 R (subsection.6.1.2) 262 0 R (subsection.6.2.1) 278 0 R (subsection.6.2.10) 314 0 R (subsection.6.2.11) 326 0 R (subsection.6.2.12) 330 0 R (subsection.6.2.13) 334 0 R (subsection.6.2.14) 338 0 R (subsection.6.2.15) 342 0 R (subsection.6.2.16) 346 0 R (subsection.6.2.17) 426 0 R (subsection.6.2.18) 430 0 R (subsection.6.2.19) 434 0 R (subsection.6.2.2) 282 0 R (subsection.6.2.20) 438 0 R (subsection.6.2.21) 442 0 R (subsection.6.2.22) 446 0 R (subsection.6.2.23) 450 0 R (subsection.6.2.24) 454 0 R (subsection.6.2.3) 286 0 R (subsection.6.2.4) 290 0 R (subsection.6.2.5) 294 0 R (subsection.6.2.6) 298 0 R (subsection.6.2.7) 302 0 R (subsection.6.2.8) 306 0 R (subsection.6.2.9) 310 0 R (subsection.6.3.1) 478 0 R (subsection.6.3.2) 490 0 R (subsection.6.3.3) 494 0 R (subsection.6.3.4) 498 0 R (subsection.6.3.5) 502 0 R (subsection.6.3.6) 518 0 R (subsection.6.3.7) 522 0 R (subsection.7.2.1) 538 0 R (subsection.7.2.2) 542 0 R (subsection.8.1.1) 558 0 R (subsection.A.1.1) 578 0 R (subsection.A.2.1) 586 0 R (subsection.A.3.1) 594 0 R (subsection.A.3.2) 598 0 R (subsection.A.3.3) 602 0 R (subsubsection.1.4.4.1) 42 0 R (subsubsection.1.4.4.2) 46 0 R (subsubsection.1.4.4.3) 50 0 R (subsubsection.1.4.5.1) 58 0 R (subsubsection.3.3.1.1) 118 0 R (subsubsection.3.3.1.2) 122 0 R (subsubsection.4.5.1.1) 166 0 R (subsubsection.4.5.1.2) 170 0 R (subsubsection.6.1.1.1) 254 0 R (subsubsection.6.1.1.2) 258 0 R (subsubsection.6.1.2.1) 266 0 R (subsubsection.6.1.2.2) 270 0 R (subsubsection.6.2.10.1) 318 0 R (subsubsection.6.2.10.2) 322 0 R (subsubsection.6.2.16.1) 350 0 R (subsubsection.6.2.16.10) 386 0 R (subsubsection.6.2.16.11) 390 0 R (subsubsection.6.2.16.12) 394 0 R (subsubsection.6.2.16.13) 398 0 R (subsubsection.6.2.16.14) 402 0 R (subsubsection.6.2.16.15) 406 0 R (subsubsection.6.2.16.16) 410 0 R (subsubsection.6.2.16.17) 414 0 R (subsubsection.6.2.16.18) 418 0 R (subsubsection.6.2.16.19) 422 0 R (subsubsection.6.2.16.2) 354 0 R (subsubsection.6.2.16.3) 358 0 R (subsubsection.6.2.16.4) 362 0 R (subsubsection.6.2.16.5) 366 0 R (subsubsection.6.2.16.6) 370 0 R (subsubsection.6.2.16.7) 374 0 R (subsubsection.6.2.16.8) 378 0 R (subsubsection.6.2.16.9) 382 0 R (subsubsection.6.2.24.1) 458 0 R (subsubsection.6.2.24.2) 462 0 R (subsubsection.6.2.24.3) 466 0 R (subsubsection.6.2.24.4) 470 0 R (subsubsection.6.3.1.1) 482 0 R (subsubsection.6.3.1.2) 486 0 R (subsubsection.6.3.5.1) 506 0 R (subsubsection.6.3.5.2) 510 0 R (subsubsection.6.3.5.3) 514 0 R (table.1.1) 882 0 R (table.1.2) 892 0 R (table.3.1) 951 0 R (table.3.2) 983 0 R (table.6.1) 1091 0 R (table.6.10) 1417 0 R (table.6.11) 1423 0 R (table.6.12) 1429 0 R (table.6.13) 1436 0 R (table.6.14) 1438 0 R (table.6.15) 1441 0 R (table.6.16) 1448 0 R (table.6.17) 1451 0 R (table.6.18) 1467 0 R (table.6.2) 1115 0 R (table.6.3) 1123 0 R (table.6.4) 1162 0 R (table.6.5) 1203 0 R (table.6.6) 1284 0 R (table.6.7) 1314 0 R (table.6.8) 1354 0 R (table.6.9) 1407 0 R (the_category_phrase) 1156 0 R (the_sortlist_statement) 1275 0 R (topology) 1270 0 R (tsig) 1030 0 R (tuning) 1285 0 R (types_of_resource_records_and_when_to_use_them) 899 0 R (view_statement_grammar) 1304 0 R (zone_statement_grammar) 1234 0 R (zone_transfers) 1006 0 R (zonefile_format) 1292 0 R] /Limits [(Access_Control_Lists) (zonefile_format)] >> endobj -1938 0 obj << -/Kids [1937 0 R] +1944 0 obj << +/Kids [1943 0 R] >> endobj -1939 0 obj << -/Dests 1938 0 R +1945 0 obj << +/Dests 1944 0 R >> endobj -1940 0 obj << +1946 0 obj << /Type /Catalog -/Pages 1935 0 R -/Outlines 1936 0 R -/Names 1939 0 R +/Pages 1941 0 R +/Outlines 1942 0 R +/Names 1945 0 R /PageMode /UseOutlines -/OpenAction 645 0 R +/OpenAction 649 0 R >> endobj -1941 0 obj << +1947 0 obj << /Author()/Title()/Subject()/Creator(LaTeX with hyperref package)/Producer(pdfeTeX-1.21a)/Keywords() -/CreationDate (D:20070709122448+10'00') +/CreationDate (D:20071031135044+11'00') /PTEX.Fullbanner (This is pdfeTeX, Version 3.141592-1.21a-2.2 (Web2C 7.5.4) kpathsea version 3.5.4) >> endobj xref -0 1942 +0 1948 0000000001 65535 f 0000000002 00000 f 0000000003 00000 f 0000000004 00000 f 0000000000 00000 f 0000000009 00000 n -0000066574 00000 n -0000661084 00000 n +0000066898 00000 n +0000664779 00000 n 0000000054 00000 n 0000000086 00000 n -0000066698 00000 n -0000661012 00000 n +0000067022 00000 n +0000664707 00000 n 0000000133 00000 n 0000000173 00000 n -0000066823 00000 n -0000660926 00000 n +0000067147 00000 n +0000664621 00000 n 0000000221 00000 n 0000000273 00000 n -0000066948 00000 n -0000660840 00000 n +0000067272 00000 n +0000664535 00000 n 0000000321 00000 n 0000000377 00000 n -0000071356 00000 n -0000660730 00000 n +0000071535 00000 n +0000664425 00000 n 0000000425 00000 n 0000000478 00000 n -0000071480 00000 n -0000660656 00000 n +0000071660 00000 n +0000664351 00000 n 0000000531 00000 n 0000000572 00000 n -0000071605 00000 n -0000660569 00000 n +0000071785 00000 n +0000664264 00000 n 0000000625 00000 n 0000000674 00000 n -0000071730 00000 n -0000660482 00000 n +0000071910 00000 n +0000664177 00000 n 0000000727 00000 n 0000000757 00000 n -0000076025 00000 n -0000660358 00000 n +0000076188 00000 n +0000664053 00000 n 0000000810 00000 n 0000000861 00000 n -0000076150 00000 n -0000660284 00000 n +0000076313 00000 n +0000663979 00000 n 0000000919 00000 n 0000000964 00000 n -0000076275 00000 n -0000660197 00000 n +0000076438 00000 n +0000663892 00000 n 0000001022 00000 n 0000001062 00000 n -0000076400 00000 n -0000660123 00000 n +0000076563 00000 n +0000663818 00000 n 0000001120 00000 n 0000001162 00000 n -0000079196 00000 n -0000659999 00000 n +0000079535 00000 n +0000663694 00000 n 0000001215 00000 n 0000001260 00000 n -0000079321 00000 n -0000659938 00000 n +0000079660 00000 n +0000663633 00000 n 0000001318 00000 n 0000001355 00000 n -0000079446 00000 n -0000659864 00000 n +0000079785 00000 n +0000663559 00000 n 0000001408 00000 n 0000001463 00000 n -0000082373 00000 n -0000659739 00000 n +0000082713 00000 n +0000663434 00000 n 0000001509 00000 n 0000001556 00000 n -0000082498 00000 n -0000659665 00000 n +0000082838 00000 n +0000663360 00000 n 0000001604 00000 n 0000001648 00000 n -0000082623 00000 n -0000659578 00000 n +0000082963 00000 n +0000663273 00000 n 0000001696 00000 n 0000001735 00000 n -0000082748 00000 n -0000659491 00000 n +0000083088 00000 n +0000663186 00000 n 0000001783 00000 n 0000001825 00000 n -0000082872 00000 n -0000659404 00000 n +0000083212 00000 n +0000663099 00000 n 0000001873 00000 n 0000001936 00000 n -0000083958 00000 n -0000659330 00000 n +0000084298 00000 n +0000663025 00000 n 0000001984 00000 n 0000002034 00000 n -0000085668 00000 n -0000659202 00000 n +0000086008 00000 n +0000662897 00000 n 0000002080 00000 n 0000002126 00000 n -0000085792 00000 n -0000659089 00000 n +0000086132 00000 n +0000662784 00000 n 0000002174 00000 n 0000002218 00000 n -0000085917 00000 n -0000659013 00000 n +0000086257 00000 n +0000662708 00000 n 0000002271 00000 n 0000002323 00000 n -0000086042 00000 n -0000658936 00000 n +0000086382 00000 n +0000662631 00000 n 0000002377 00000 n 0000002436 00000 n -0000088553 00000 n -0000658845 00000 n +0000088910 00000 n +0000662540 00000 n 0000002485 00000 n 0000002523 00000 n -0000088805 00000 n -0000658728 00000 n +0000089162 00000 n +0000662423 00000 n 0000002572 00000 n 0000002618 00000 n -0000088931 00000 n -0000658610 00000 n +0000089288 00000 n +0000662305 00000 n 0000002672 00000 n 0000002739 00000 n -0000092111 00000 n -0000658531 00000 n +0000092495 00000 n +0000662226 00000 n 0000002798 00000 n 0000002842 00000 n -0000092237 00000 n -0000658452 00000 n +0000092621 00000 n +0000662147 00000 n 0000002901 00000 n 0000002949 00000 n -0000102534 00000 n -0000658373 00000 n +0000102950 00000 n +0000662068 00000 n 0000003003 00000 n 0000003036 00000 n -0000107458 00000 n -0000658241 00000 n +0000107881 00000 n +0000661936 00000 n 0000003083 00000 n 0000003126 00000 n -0000107584 00000 n -0000658162 00000 n +0000108007 00000 n +0000661857 00000 n 0000003175 00000 n 0000003205 00000 n -0000107710 00000 n -0000658030 00000 n +0000108133 00000 n +0000661725 00000 n 0000003254 00000 n 0000003292 00000 n -0000107836 00000 n -0000657965 00000 n +0000108259 00000 n +0000661660 00000 n 0000003346 00000 n 0000003388 00000 n -0000112115 00000 n -0000657872 00000 n +0000112550 00000 n +0000661567 00000 n 0000003437 00000 n 0000003496 00000 n -0000112244 00000 n -0000657779 00000 n +0000112677 00000 n +0000661435 00000 n 0000003545 00000 n 0000003578 00000 n -0000119613 00000 n -0000657647 00000 n -0000003627 00000 n -0000003655 00000 n -0000119740 00000 n -0000657529 00000 n -0000003709 00000 n -0000003778 00000 n -0000119869 00000 n -0000657450 00000 n -0000003837 00000 n -0000003885 00000 n -0000122743 00000 n -0000657371 00000 n -0000003944 00000 n -0000003989 00000 n -0000122872 00000 n -0000657278 00000 n -0000004043 00000 n -0000004111 00000 n -0000123001 00000 n -0000657185 00000 n -0000004165 00000 n -0000004235 00000 n -0000123130 00000 n -0000657092 00000 n -0000004289 00000 n -0000004352 00000 n -0000123258 00000 n -0000656999 00000 n -0000004406 00000 n -0000004461 00000 n -0000126895 00000 n -0000656920 00000 n -0000004515 00000 n -0000004547 00000 n -0000127024 00000 n -0000656827 00000 n -0000004596 00000 n -0000004624 00000 n -0000127153 00000 n -0000656734 00000 n -0000004673 00000 n -0000004705 00000 n -0000130754 00000 n -0000656602 00000 n -0000004754 00000 n -0000004784 00000 n -0000130883 00000 n -0000656523 00000 n -0000004838 00000 n -0000004879 00000 n -0000131011 00000 n -0000656430 00000 n -0000004933 00000 n -0000004975 00000 n -0000134470 00000 n -0000656351 00000 n -0000005029 00000 n -0000005074 00000 n -0000137544 00000 n -0000656233 00000 n -0000005123 00000 n -0000005169 00000 n -0000137673 00000 n -0000656154 00000 n -0000005223 00000 n -0000005283 00000 n -0000137801 00000 n -0000656075 00000 n -0000005337 00000 n -0000005406 00000 n -0000140281 00000 n -0000655942 00000 n -0000005453 00000 n -0000005506 00000 n -0000140410 00000 n -0000655863 00000 n -0000005555 00000 n -0000005611 00000 n -0000140539 00000 n -0000655784 00000 n -0000005660 00000 n -0000005709 00000 n -0000144723 00000 n -0000655651 00000 n -0000005756 00000 n -0000005808 00000 n -0000144852 00000 n -0000655533 00000 n -0000005857 00000 n -0000005908 00000 n -0000149108 00000 n -0000655415 00000 n -0000005962 00000 n -0000006007 00000 n -0000149237 00000 n -0000655336 00000 n -0000006066 00000 n -0000006100 00000 n -0000149366 00000 n -0000655257 00000 n -0000006159 00000 n -0000006207 00000 n -0000152708 00000 n -0000655139 00000 n -0000006261 00000 n -0000006301 00000 n -0000152837 00000 n -0000655060 00000 n -0000006360 00000 n -0000006394 00000 n -0000152966 00000 n -0000654981 00000 n -0000006453 00000 n -0000006501 00000 n -0000156871 00000 n -0000654848 00000 n -0000006550 00000 n -0000006600 00000 n -0000160493 00000 n -0000654769 00000 n -0000006654 00000 n -0000006701 00000 n -0000160622 00000 n -0000654676 00000 n -0000006755 00000 n -0000006815 00000 n -0000160879 00000 n -0000654583 00000 n -0000006869 00000 n -0000006921 00000 n -0000161008 00000 n -0000654490 00000 n -0000006975 00000 n -0000007040 00000 n -0000165662 00000 n -0000654397 00000 n -0000007094 00000 n -0000007145 00000 n -0000165791 00000 n -0000654304 00000 n -0000007199 00000 n -0000007263 00000 n -0000165920 00000 n -0000654211 00000 n -0000007317 00000 n -0000007364 00000 n -0000166049 00000 n -0000654118 00000 n -0000007418 00000 n -0000007478 00000 n -0000169396 00000 n -0000654025 00000 n -0000007532 00000 n -0000007583 00000 n -0000169525 00000 n -0000653893 00000 n -0000007638 00000 n -0000007703 00000 n -0000174160 00000 n -0000653814 00000 n -0000007763 00000 n -0000007810 00000 n -0000180339 00000 n -0000653735 00000 n -0000007870 00000 n -0000007918 00000 n -0000184081 00000 n -0000653642 00000 n +0000112806 00000 n +0000661370 00000 n +0000003632 00000 n +0000003681 00000 n +0000120178 00000 n +0000661238 00000 n +0000003730 00000 n +0000003758 00000 n +0000120305 00000 n +0000661120 00000 n +0000003812 00000 n +0000003881 00000 n +0000120434 00000 n +0000661041 00000 n +0000003940 00000 n +0000003988 00000 n +0000123309 00000 n +0000660962 00000 n +0000004047 00000 n +0000004092 00000 n +0000123438 00000 n +0000660869 00000 n +0000004146 00000 n +0000004214 00000 n +0000123567 00000 n +0000660776 00000 n +0000004268 00000 n +0000004338 00000 n +0000123696 00000 n +0000660683 00000 n +0000004392 00000 n +0000004455 00000 n +0000123824 00000 n +0000660590 00000 n +0000004509 00000 n +0000004564 00000 n +0000127470 00000 n +0000660511 00000 n +0000004618 00000 n +0000004650 00000 n +0000127599 00000 n +0000660418 00000 n +0000004699 00000 n +0000004727 00000 n +0000127728 00000 n +0000660325 00000 n +0000004776 00000 n +0000004808 00000 n +0000131334 00000 n +0000660193 00000 n +0000004857 00000 n +0000004887 00000 n +0000131463 00000 n +0000660114 00000 n +0000004941 00000 n +0000004982 00000 n +0000131591 00000 n +0000660021 00000 n +0000005036 00000 n +0000005078 00000 n +0000135033 00000 n +0000659942 00000 n +0000005132 00000 n +0000005177 00000 n +0000138107 00000 n +0000659824 00000 n +0000005226 00000 n +0000005272 00000 n +0000138236 00000 n +0000659745 00000 n +0000005326 00000 n +0000005386 00000 n +0000138364 00000 n +0000659666 00000 n +0000005440 00000 n +0000005509 00000 n +0000140844 00000 n +0000659533 00000 n +0000005556 00000 n +0000005609 00000 n +0000140973 00000 n +0000659454 00000 n +0000005658 00000 n +0000005714 00000 n +0000141102 00000 n +0000659375 00000 n +0000005763 00000 n +0000005812 00000 n +0000145286 00000 n +0000659242 00000 n +0000005859 00000 n +0000005911 00000 n +0000145415 00000 n +0000659124 00000 n +0000005960 00000 n +0000006011 00000 n +0000149682 00000 n +0000659006 00000 n +0000006065 00000 n +0000006110 00000 n +0000149811 00000 n +0000658927 00000 n +0000006169 00000 n +0000006203 00000 n +0000149940 00000 n +0000658848 00000 n +0000006262 00000 n +0000006310 00000 n +0000153288 00000 n +0000658730 00000 n +0000006364 00000 n +0000006404 00000 n +0000153417 00000 n +0000658651 00000 n +0000006463 00000 n +0000006497 00000 n +0000153546 00000 n +0000658572 00000 n +0000006556 00000 n +0000006604 00000 n +0000157451 00000 n +0000658439 00000 n +0000006653 00000 n +0000006703 00000 n +0000161073 00000 n +0000658360 00000 n +0000006757 00000 n +0000006804 00000 n +0000161202 00000 n +0000658267 00000 n +0000006858 00000 n +0000006918 00000 n +0000161459 00000 n +0000658174 00000 n +0000006972 00000 n +0000007024 00000 n +0000161588 00000 n +0000658081 00000 n +0000007078 00000 n +0000007143 00000 n +0000166242 00000 n +0000657988 00000 n +0000007197 00000 n +0000007248 00000 n +0000166371 00000 n +0000657895 00000 n +0000007302 00000 n +0000007366 00000 n +0000166500 00000 n +0000657802 00000 n +0000007420 00000 n +0000007467 00000 n +0000166629 00000 n +0000657709 00000 n +0000007521 00000 n +0000007581 00000 n +0000169977 00000 n +0000657616 00000 n +0000007635 00000 n +0000007686 00000 n +0000170106 00000 n +0000657484 00000 n +0000007741 00000 n +0000007806 00000 n +0000174741 00000 n +0000657405 00000 n +0000007866 00000 n +0000007913 00000 n +0000180920 00000 n +0000657326 00000 n 0000007973 00000 n -0000008023 00000 n -0000184210 00000 n -0000653549 00000 n -0000008078 00000 n -0000008141 00000 n -0000185958 00000 n -0000653456 00000 n -0000008196 00000 n -0000008248 00000 n -0000186087 00000 n -0000653363 00000 n -0000008303 00000 n -0000008368 00000 n -0000186216 00000 n -0000653270 00000 n -0000008423 00000 n -0000008475 00000 n -0000189968 00000 n -0000653137 00000 n -0000008530 00000 n -0000008595 00000 n -0000198252 00000 n -0000653058 00000 n -0000008655 00000 n -0000008699 00000 n -0000215386 00000 n -0000652965 00000 n -0000008759 00000 n -0000008798 00000 n -0000219636 00000 n -0000652872 00000 n -0000008858 00000 n -0000008905 00000 n -0000219765 00000 n -0000652779 00000 n -0000008965 00000 n +0000008021 00000 n +0000184667 00000 n +0000657233 00000 n +0000008076 00000 n +0000008126 00000 n +0000184796 00000 n +0000657140 00000 n +0000008181 00000 n +0000008244 00000 n +0000186525 00000 n +0000657047 00000 n +0000008299 00000 n +0000008351 00000 n +0000186654 00000 n +0000656954 00000 n +0000008406 00000 n +0000008471 00000 n +0000186783 00000 n +0000656861 00000 n +0000008526 00000 n +0000008578 00000 n +0000190468 00000 n +0000656728 00000 n +0000008633 00000 n +0000008698 00000 n +0000198661 00000 n +0000656649 00000 n +0000008758 00000 n +0000008802 00000 n +0000216022 00000 n +0000656556 00000 n +0000008862 00000 n +0000008901 00000 n +0000220238 00000 n +0000656463 00000 n +0000008961 00000 n 0000009008 00000 n -0000223504 00000 n -0000652686 00000 n +0000220366 00000 n +0000656370 00000 n 0000009068 00000 n -0000009107 00000 n -0000226564 00000 n -0000652593 00000 n -0000009167 00000 n -0000009209 00000 n -0000226693 00000 n -0000652500 00000 n -0000009269 00000 n +0000009111 00000 n +0000224175 00000 n +0000656277 00000 n +0000009171 00000 n +0000009210 00000 n +0000227147 00000 n +0000656184 00000 n +0000009270 00000 n 0000009312 00000 n -0000233663 00000 n -0000652407 00000 n +0000227276 00000 n +0000656091 00000 n 0000009372 00000 n -0000009419 00000 n -0000237915 00000 n -0000652314 00000 n -0000009479 00000 n -0000009540 00000 n -0000238044 00000 n -0000652221 00000 n -0000009601 00000 n -0000009653 00000 n -0000241414 00000 n -0000652128 00000 n -0000009714 00000 n -0000009767 00000 n -0000241543 00000 n -0000652035 00000 n -0000009828 00000 n -0000009866 00000 n -0000245442 00000 n -0000651942 00000 n -0000009927 00000 n -0000009979 00000 n -0000248867 00000 n -0000651849 00000 n -0000010040 00000 n -0000010084 00000 n -0000249125 00000 n -0000651756 00000 n -0000010145 00000 n -0000010181 00000 n -0000257823 00000 n -0000651663 00000 n -0000010242 00000 n -0000010305 00000 n -0000257952 00000 n -0000651570 00000 n -0000010366 00000 n -0000010416 00000 n -0000263268 00000 n -0000651477 00000 n -0000010477 00000 n -0000010526 00000 n -0000267016 00000 n -0000651398 00000 n -0000010587 00000 n -0000010643 00000 n -0000267144 00000 n -0000651305 00000 n -0000010698 00000 n -0000010749 00000 n -0000271807 00000 n -0000651212 00000 n -0000010804 00000 n -0000010868 00000 n -0000275454 00000 n -0000651119 00000 n -0000010923 00000 n -0000010980 00000 n -0000275583 00000 n -0000651026 00000 n -0000011035 00000 n -0000011105 00000 n -0000275712 00000 n -0000650933 00000 n -0000011160 00000 n -0000011209 00000 n -0000275841 00000 n -0000650840 00000 n -0000011264 00000 n -0000011326 00000 n -0000278734 00000 n -0000650747 00000 n -0000011381 00000 n -0000011430 00000 n -0000284979 00000 n -0000650629 00000 n -0000011485 00000 n -0000011547 00000 n -0000285108 00000 n -0000650550 00000 n -0000011607 00000 n -0000011646 00000 n -0000289879 00000 n -0000650457 00000 n -0000011706 00000 n -0000011740 00000 n -0000290008 00000 n -0000650364 00000 n -0000011800 00000 n -0000011841 00000 n -0000304944 00000 n -0000650285 00000 n -0000011901 00000 n -0000011953 00000 n -0000308955 00000 n -0000650167 00000 n -0000012002 00000 n -0000012035 00000 n -0000309084 00000 n -0000650049 00000 n -0000012089 00000 n -0000012161 00000 n -0000309212 00000 n -0000649970 00000 n -0000012220 00000 n +0000009415 00000 n +0000234515 00000 n +0000655998 00000 n +0000009475 00000 n +0000009522 00000 n +0000238765 00000 n +0000655905 00000 n +0000009582 00000 n +0000009643 00000 n +0000238894 00000 n +0000655812 00000 n +0000009704 00000 n +0000009756 00000 n +0000242265 00000 n +0000655719 00000 n +0000009817 00000 n +0000009870 00000 n +0000242394 00000 n +0000655626 00000 n +0000009931 00000 n +0000009969 00000 n +0000246293 00000 n +0000655533 00000 n +0000010030 00000 n +0000010082 00000 n +0000249718 00000 n +0000655440 00000 n +0000010143 00000 n +0000010187 00000 n +0000249976 00000 n +0000655347 00000 n +0000010248 00000 n +0000010284 00000 n +0000258745 00000 n +0000655254 00000 n +0000010345 00000 n +0000010408 00000 n +0000258874 00000 n +0000655161 00000 n +0000010469 00000 n +0000010519 00000 n +0000264226 00000 n +0000655068 00000 n +0000010580 00000 n +0000010629 00000 n +0000268214 00000 n +0000654989 00000 n +0000010690 00000 n +0000010746 00000 n +0000268342 00000 n +0000654896 00000 n +0000010801 00000 n +0000010852 00000 n +0000272260 00000 n +0000654803 00000 n +0000010907 00000 n +0000010971 00000 n +0000276289 00000 n +0000654710 00000 n +0000011026 00000 n +0000011083 00000 n +0000276417 00000 n +0000654617 00000 n +0000011138 00000 n +0000011208 00000 n +0000276543 00000 n +0000654524 00000 n +0000011263 00000 n +0000011312 00000 n +0000279969 00000 n +0000654431 00000 n +0000011367 00000 n +0000011429 00000 n +0000281613 00000 n +0000654338 00000 n +0000011484 00000 n +0000011533 00000 n +0000285546 00000 n +0000654220 00000 n +0000011588 00000 n +0000011650 00000 n +0000285675 00000 n +0000654141 00000 n +0000011710 00000 n +0000011749 00000 n +0000289728 00000 n +0000654048 00000 n +0000011809 00000 n +0000011843 00000 n +0000295345 00000 n +0000653955 00000 n +0000011903 00000 n +0000011944 00000 n +0000305746 00000 n +0000653876 00000 n +0000012004 00000 n +0000012056 00000 n +0000309844 00000 n +0000653758 00000 n +0000012105 00000 n +0000012138 00000 n +0000309972 00000 n +0000653640 00000 n +0000012192 00000 n 0000012264 00000 n -0000316450 00000 n -0000649891 00000 n +0000310100 00000 n +0000653561 00000 n 0000012323 00000 n -0000012376 00000 n -0000320197 00000 n -0000649798 00000 n -0000012430 00000 n -0000012480 00000 n -0000320456 00000 n -0000649705 00000 n -0000012534 00000 n -0000012572 00000 n -0000323517 00000 n -0000649612 00000 n -0000012626 00000 n +0000012367 00000 n +0000317603 00000 n +0000653482 00000 n +0000012426 00000 n +0000012479 00000 n +0000321290 00000 n +0000653389 00000 n +0000012533 00000 n +0000012583 00000 n +0000324743 00000 n +0000653296 00000 n +0000012637 00000 n 0000012675 00000 n -0000323776 00000 n -0000649480 00000 n +0000325002 00000 n +0000653203 00000 n 0000012729 00000 n -0000012781 00000 n -0000323905 00000 n -0000649401 00000 n -0000012840 00000 n -0000012892 00000 n -0000324034 00000 n -0000649308 00000 n -0000012951 00000 n -0000013004 00000 n -0000326770 00000 n -0000649229 00000 n -0000013063 00000 n -0000013112 00000 n -0000326899 00000 n -0000649136 00000 n +0000012778 00000 n +0000325260 00000 n +0000653071 00000 n +0000012832 00000 n +0000012884 00000 n +0000328115 00000 n +0000652992 00000 n +0000012943 00000 n +0000012995 00000 n +0000328244 00000 n +0000652899 00000 n +0000013054 00000 n +0000013107 00000 n +0000328373 00000 n +0000652820 00000 n 0000013166 00000 n -0000013246 00000 n -0000330888 00000 n -0000649057 00000 n -0000013300 00000 n +0000013215 00000 n +0000328502 00000 n +0000652727 00000 n +0000013269 00000 n 0000013349 00000 n -0000333165 00000 n -0000648924 00000 n -0000013396 00000 n -0000013448 00000 n -0000333294 00000 n -0000648845 00000 n -0000013497 00000 n -0000013541 00000 n -0000337387 00000 n -0000648713 00000 n -0000013590 00000 n -0000013631 00000 n -0000337516 00000 n -0000648634 00000 n -0000013685 00000 n -0000013733 00000 n -0000337645 00000 n -0000648555 00000 n -0000013787 00000 n -0000013838 00000 n -0000337774 00000 n -0000648476 00000 n -0000013887 00000 n -0000013934 00000 n -0000342051 00000 n -0000648343 00000 n -0000013981 00000 n -0000014018 00000 n -0000342180 00000 n -0000648225 00000 n -0000014067 00000 n -0000014106 00000 n -0000342309 00000 n -0000648160 00000 n -0000014160 00000 n -0000014238 00000 n -0000342438 00000 n -0000648067 00000 n -0000014287 00000 n -0000014354 00000 n -0000342567 00000 n -0000647988 00000 n -0000014403 00000 n -0000014448 00000 n -0000346101 00000 n -0000647855 00000 n -0000014496 00000 n -0000014528 00000 n -0000346230 00000 n -0000647737 00000 n -0000014577 00000 n -0000014616 00000 n -0000346359 00000 n -0000647672 00000 n -0000014670 00000 n -0000014731 00000 n -0000350171 00000 n -0000647540 00000 n -0000014780 00000 n -0000014837 00000 n -0000350300 00000 n -0000647475 00000 n -0000014891 00000 n +0000332842 00000 n +0000652648 00000 n +0000013403 00000 n +0000013452 00000 n +0000335118 00000 n +0000652515 00000 n +0000013499 00000 n +0000013551 00000 n +0000335247 00000 n +0000652436 00000 n +0000013600 00000 n +0000013644 00000 n +0000339340 00000 n +0000652304 00000 n +0000013693 00000 n +0000013734 00000 n +0000339469 00000 n +0000652225 00000 n +0000013788 00000 n +0000013836 00000 n +0000339598 00000 n +0000652146 00000 n +0000013890 00000 n +0000013941 00000 n +0000339727 00000 n +0000652067 00000 n +0000013990 00000 n +0000014037 00000 n +0000343990 00000 n +0000651934 00000 n +0000014084 00000 n +0000014121 00000 n +0000344119 00000 n +0000651816 00000 n +0000014170 00000 n +0000014209 00000 n +0000344248 00000 n +0000651751 00000 n +0000014263 00000 n +0000014341 00000 n +0000344377 00000 n +0000651658 00000 n +0000014390 00000 n +0000014457 00000 n +0000344506 00000 n +0000651579 00000 n +0000014506 00000 n +0000014551 00000 n +0000347945 00000 n +0000651446 00000 n +0000014599 00000 n +0000014631 00000 n +0000348074 00000 n +0000651328 00000 n +0000014680 00000 n +0000014719 00000 n +0000348203 00000 n +0000651263 00000 n +0000014773 00000 n +0000014834 00000 n +0000351968 00000 n +0000651131 00000 n +0000014883 00000 n 0000014940 00000 n -0000350429 00000 n -0000647357 00000 n -0000014989 00000 n -0000015051 00000 n -0000350558 00000 n -0000647278 00000 n -0000015105 00000 n -0000015160 00000 n -0000374333 00000 n -0000647185 00000 n -0000015214 00000 n -0000015255 00000 n -0000374462 00000 n -0000647106 00000 n -0000015309 00000 n -0000015361 00000 n -0000377162 00000 n -0000646986 00000 n -0000015409 00000 n -0000015443 00000 n -0000377291 00000 n -0000646907 00000 n -0000015492 00000 n -0000015519 00000 n -0000395240 00000 n -0000646814 00000 n -0000015568 00000 n -0000015596 00000 n -0000402827 00000 n -0000646721 00000 n -0000015645 00000 n -0000015682 00000 n -0000409155 00000 n -0000646628 00000 n -0000015731 00000 n -0000015770 00000 n -0000418667 00000 n -0000646535 00000 n -0000015819 00000 n -0000015858 00000 n -0000421572 00000 n -0000646442 00000 n -0000015907 00000 n -0000015946 00000 n -0000427856 00000 n -0000646349 00000 n -0000015995 00000 n -0000016024 00000 n -0000437047 00000 n -0000646256 00000 n -0000016073 00000 n -0000016101 00000 n -0000440072 00000 n -0000646163 00000 n -0000016150 00000 n -0000016183 00000 n -0000446304 00000 n -0000646084 00000 n -0000016233 00000 n -0000016270 00000 n -0000016639 00000 n -0000016761 00000 n -0000024590 00000 n -0000016323 00000 n -0000024464 00000 n -0000024527 00000 n -0000641967 00000 n -0000616024 00000 n -0000641793 00000 n -0000642992 00000 n -0000019624 00000 n -0000019841 00000 n -0000019910 00000 n -0000019979 00000 n -0000020047 00000 n -0000020115 00000 n -0000020164 00000 n -0000020211 00000 n -0000020544 00000 n -0000020566 00000 n -0000020734 00000 n -0000020899 00000 n -0000021068 00000 n -0000021247 00000 n -0000021556 00000 n -0000021716 00000 n -0000025949 00000 n -0000025764 00000 n -0000024690 00000 n -0000025886 00000 n -0000614951 00000 n -0000588687 00000 n -0000614777 00000 n -0000588002 00000 n -0000585857 00000 n -0000587838 00000 n -0000037649 00000 n -0000028998 00000 n -0000026034 00000 n -0000037523 00000 n -0000037586 00000 n -0000029532 00000 n -0000029686 00000 n -0000029843 00000 n -0000030000 00000 n -0000030156 00000 n -0000030313 00000 n -0000030475 00000 n -0000030636 00000 n -0000030797 00000 n -0000030959 00000 n -0000031126 00000 n -0000031293 00000 n -0000031458 00000 n -0000031620 00000 n -0000031786 00000 n -0000031947 00000 n -0000032102 00000 n -0000032259 00000 n -0000032415 00000 n -0000032572 00000 n -0000032729 00000 n -0000032886 00000 n -0000033040 00000 n -0000033196 00000 n -0000033358 00000 n -0000033520 00000 n -0000033676 00000 n -0000033833 00000 n -0000033995 00000 n -0000034162 00000 n -0000034328 00000 n -0000034489 00000 n -0000034644 00000 n -0000034801 00000 n -0000034958 00000 n -0000035120 00000 n -0000035277 00000 n -0000035434 00000 n -0000035591 00000 n -0000035753 00000 n -0000035920 00000 n -0000036087 00000 n -0000036248 00000 n -0000036410 00000 n -0000036572 00000 n -0000036734 00000 n -0000036896 00000 n -0000037053 00000 n -0000037208 00000 n -0000037363 00000 n -0000051025 00000 n -0000040974 00000 n -0000037734 00000 n -0000050962 00000 n -0000585306 00000 n -0000568225 00000 n -0000585122 00000 n -0000041564 00000 n -0000041727 00000 n -0000041890 00000 n -0000042048 00000 n -0000042211 00000 n -0000042374 00000 n -0000042530 00000 n -0000042688 00000 n -0000042846 00000 n -0000043001 00000 n -0000043159 00000 n -0000043322 00000 n -0000043490 00000 n -0000043658 00000 n -0000043821 00000 n -0000043989 00000 n -0000044157 00000 n -0000044315 00000 n -0000044477 00000 n -0000044640 00000 n -0000044803 00000 n -0000044965 00000 n -0000045127 00000 n -0000045290 00000 n -0000045452 00000 n -0000045614 00000 n -0000045777 00000 n -0000045941 00000 n -0000046109 00000 n -0000046277 00000 n -0000046441 00000 n -0000046605 00000 n -0000046768 00000 n -0000046932 00000 n -0000047096 00000 n -0000047259 00000 n -0000047428 00000 n -0000047597 00000 n -0000047765 00000 n -0000047934 00000 n -0000048103 00000 n -0000048272 00000 n -0000048441 00000 n -0000048610 00000 n -0000048779 00000 n -0000048949 00000 n -0000049119 00000 n -0000049289 00000 n -0000049459 00000 n -0000049628 00000 n -0000049798 00000 n -0000049968 00000 n -0000050138 00000 n -0000050307 00000 n -0000050477 00000 n -0000050639 00000 n -0000050800 00000 n -0000063624 00000 n -0000054499 00000 n -0000051123 00000 n -0000063561 00000 n -0000055057 00000 n -0000055220 00000 n -0000055383 00000 n -0000055546 00000 n -0000055709 00000 n -0000055871 00000 n -0000056039 00000 n -0000056207 00000 n -0000056375 00000 n -0000056541 00000 n -0000056698 00000 n -0000056859 00000 n -0000057026 00000 n -0000057193 00000 n -0000057355 00000 n -0000057517 00000 n -0000057679 00000 n -0000057841 00000 n -0000058008 00000 n -0000058175 00000 n -0000058342 00000 n -0000058504 00000 n -0000058666 00000 n -0000058821 00000 n -0000058978 00000 n -0000059133 00000 n -0000059295 00000 n -0000059457 00000 n -0000059614 00000 n -0000059769 00000 n -0000059926 00000 n -0000060088 00000 n -0000060245 00000 n -0000060401 00000 n -0000060557 00000 n -0000060713 00000 n -0000060875 00000 n -0000061032 00000 n -0000061194 00000 n -0000061351 00000 n -0000061513 00000 n -0000061674 00000 n -0000061836 00000 n -0000061992 00000 n -0000062149 00000 n -0000062306 00000 n -0000062463 00000 n -0000062620 00000 n -0000062777 00000 n -0000062933 00000 n -0000063090 00000 n -0000567288 00000 n -0000547609 00000 n -0000567115 00000 n -0000063247 00000 n -0000063404 00000 n -0000064069 00000 n -0000063884 00000 n -0000063735 00000 n -0000064006 00000 n -0000067199 00000 n -0000066389 00000 n -0000064110 00000 n -0000066511 00000 n -0000066635 00000 n -0000066760 00000 n -0000066885 00000 n -0000546720 00000 n -0000525389 00000 n -0000546546 00000 n -0000067010 00000 n -0000067073 00000 n -0000067136 00000 n -0000524622 00000 n -0000507214 00000 n -0000524449 00000 n -0000643110 00000 n -0000071855 00000 n -0000070673 00000 n -0000067323 00000 n -0000071167 00000 n -0000071230 00000 n -0000071293 00000 n -0000071417 00000 n -0000071542 00000 n -0000071667 00000 n -0000070823 00000 n -0000071016 00000 n -0000071792 00000 n -0000309148 00000 n -0000350622 00000 n -0000076525 00000 n -0000075489 00000 n -0000071979 00000 n -0000075962 00000 n -0000076087 00000 n -0000075639 00000 n -0000075801 00000 n -0000076212 00000 n -0000076337 00000 n -0000076462 00000 n -0000092174 00000 n -0000079571 00000 n -0000079011 00000 n -0000076649 00000 n -0000079133 00000 n -0000079258 00000 n -0000079383 00000 n -0000079508 00000 n -0000082997 00000 n -0000081857 00000 n -0000079682 00000 n -0000082310 00000 n -0000082435 00000 n -0000082560 00000 n -0000082685 00000 n -0000082810 00000 n -0000082007 00000 n -0000082159 00000 n -0000082934 00000 n -0000267080 00000 n -0000084083 00000 n -0000083773 00000 n -0000083082 00000 n -0000083895 00000 n -0000084020 00000 n -0000086168 00000 n -0000085483 00000 n -0000084181 00000 n -0000085605 00000 n -0000085730 00000 n -0000085854 00000 n -0000085979 00000 n -0000086105 00000 n -0000643228 00000 n -0000089056 00000 n -0000088188 00000 n -0000086266 00000 n -0000088490 00000 n -0000088616 00000 n -0000088679 00000 n -0000088742 00000 n -0000088330 00000 n -0000088868 00000 n -0000088994 00000 n -0000248931 00000 n -0000092363 00000 n -0000091926 00000 n -0000089167 00000 n -0000092048 00000 n -0000506558 00000 n -0000494976 00000 n -0000506381 00000 n -0000092300 00000 n -0000095962 00000 n -0000095777 00000 n -0000092487 00000 n -0000095899 00000 n -0000494441 00000 n -0000484928 00000 n -0000494264 00000 n -0000100500 00000 n -0000100110 00000 n -0000096125 00000 n -0000100437 00000 n -0000100252 00000 n -0000161071 00000 n -0000102786 00000 n -0000102349 00000 n -0000100637 00000 n -0000102471 00000 n -0000102597 00000 n -0000102660 00000 n -0000102723 00000 n -0000105437 00000 n -0000107962 00000 n -0000105287 00000 n -0000102910 00000 n -0000107395 00000 n -0000107521 00000 n -0000107647 00000 n -0000107073 00000 n -0000107234 00000 n -0000484085 00000 n -0000474763 00000 n -0000483913 00000 n -0000474201 00000 n -0000465118 00000 n -0000474028 00000 n -0000107773 00000 n -0000107899 00000 n -0000643346 00000 n -0000106905 00000 n -0000106962 00000 n -0000107051 00000 n -0000198315 00000 n -0000226757 00000 n -0000112373 00000 n -0000111567 00000 n -0000108114 00000 n -0000112050 00000 n -0000112179 00000 n -0000111722 00000 n -0000111888 00000 n -0000112308 00000 n -0000351400 00000 n -0000115864 00000 n -0000115485 00000 n -0000112524 00000 n -0000115799 00000 n -0000115631 00000 n -0000117097 00000 n -0000116907 00000 n -0000115989 00000 n -0000117032 00000 n -0000119998 00000 n -0000119423 00000 n -0000117196 00000 n -0000119548 00000 n -0000119675 00000 n -0000119804 00000 n -0000119933 00000 n -0000123387 00000 n -0000122553 00000 n -0000120136 00000 n -0000122678 00000 n -0000122807 00000 n -0000122936 00000 n -0000123065 00000 n -0000123193 00000 n -0000123322 00000 n -0000127281 00000 n -0000126513 00000 n -0000123525 00000 n -0000126830 00000 n -0000126660 00000 n -0000126959 00000 n +0000352097 00000 n +0000651066 00000 n +0000014994 00000 n +0000015043 00000 n +0000352226 00000 n +0000650948 00000 n +0000015092 00000 n +0000015154 00000 n +0000352355 00000 n +0000650869 00000 n +0000015208 00000 n +0000015263 00000 n +0000376379 00000 n +0000650776 00000 n +0000015317 00000 n +0000015358 00000 n +0000376508 00000 n +0000650697 00000 n +0000015412 00000 n +0000015464 00000 n +0000379211 00000 n +0000650577 00000 n +0000015512 00000 n +0000015546 00000 n +0000379340 00000 n +0000650498 00000 n +0000015595 00000 n +0000015622 00000 n +0000397280 00000 n +0000650405 00000 n +0000015671 00000 n +0000015699 00000 n +0000404815 00000 n +0000650312 00000 n +0000015748 00000 n +0000015785 00000 n +0000411129 00000 n +0000650219 00000 n +0000015834 00000 n +0000015873 00000 n +0000420651 00000 n +0000650126 00000 n +0000015922 00000 n +0000015961 00000 n +0000423538 00000 n +0000650033 00000 n +0000016010 00000 n +0000016049 00000 n +0000429911 00000 n +0000649940 00000 n +0000016098 00000 n +0000016127 00000 n +0000439507 00000 n +0000649847 00000 n +0000016176 00000 n +0000016204 00000 n +0000442707 00000 n +0000649754 00000 n +0000016253 00000 n +0000016286 00000 n +0000448703 00000 n +0000649675 00000 n +0000016336 00000 n +0000016373 00000 n +0000016742 00000 n +0000016864 00000 n +0000024693 00000 n +0000016426 00000 n +0000024567 00000 n +0000024630 00000 n +0000645556 00000 n +0000619613 00000 n +0000645382 00000 n +0000646581 00000 n +0000019727 00000 n +0000019944 00000 n +0000020013 00000 n +0000020082 00000 n +0000020150 00000 n +0000020218 00000 n +0000020267 00000 n +0000020314 00000 n +0000020647 00000 n +0000020669 00000 n +0000020837 00000 n +0000021002 00000 n +0000021171 00000 n +0000021350 00000 n +0000021659 00000 n +0000021819 00000 n +0000026052 00000 n +0000025867 00000 n +0000024793 00000 n +0000025989 00000 n +0000618401 00000 n +0000591922 00000 n +0000618227 00000 n +0000591237 00000 n +0000589092 00000 n +0000591073 00000 n +0000037758 00000 n +0000029108 00000 n +0000026137 00000 n +0000037632 00000 n +0000037695 00000 n +0000029642 00000 n +0000029796 00000 n +0000029953 00000 n +0000030110 00000 n +0000030266 00000 n +0000030423 00000 n +0000030585 00000 n +0000030746 00000 n +0000030907 00000 n +0000031069 00000 n +0000031236 00000 n +0000031403 00000 n +0000031568 00000 n +0000031730 00000 n +0000031896 00000 n +0000032057 00000 n +0000032212 00000 n +0000032369 00000 n +0000032525 00000 n +0000032682 00000 n +0000032839 00000 n +0000032996 00000 n +0000033150 00000 n +0000033306 00000 n +0000033468 00000 n +0000033630 00000 n +0000033786 00000 n +0000033943 00000 n +0000034105 00000 n +0000034272 00000 n +0000034438 00000 n +0000034599 00000 n +0000034754 00000 n +0000034911 00000 n +0000035068 00000 n +0000035230 00000 n +0000035387 00000 n +0000035544 00000 n +0000035706 00000 n +0000035863 00000 n +0000036025 00000 n +0000036192 00000 n +0000036358 00000 n +0000036520 00000 n +0000036682 00000 n +0000036844 00000 n +0000037005 00000 n +0000037167 00000 n +0000037322 00000 n +0000037477 00000 n +0000051127 00000 n +0000041075 00000 n +0000037843 00000 n +0000051064 00000 n +0000588541 00000 n +0000571460 00000 n +0000588357 00000 n +0000041665 00000 n +0000041828 00000 n +0000041990 00000 n +0000042153 00000 n +0000042311 00000 n +0000042474 00000 n +0000042637 00000 n +0000042792 00000 n +0000042950 00000 n +0000043108 00000 n +0000043264 00000 n +0000043422 00000 n +0000043585 00000 n +0000043753 00000 n +0000043921 00000 n +0000044084 00000 n +0000044252 00000 n +0000044420 00000 n +0000044578 00000 n +0000044741 00000 n +0000044904 00000 n +0000045066 00000 n +0000045228 00000 n +0000045391 00000 n +0000045553 00000 n +0000045715 00000 n +0000045878 00000 n +0000046041 00000 n +0000046204 00000 n +0000046373 00000 n +0000046542 00000 n +0000046706 00000 n +0000046869 00000 n +0000047033 00000 n +0000047197 00000 n +0000047360 00000 n +0000047524 00000 n +0000047693 00000 n +0000047862 00000 n +0000048031 00000 n +0000048200 00000 n +0000048369 00000 n +0000048538 00000 n +0000048707 00000 n +0000048876 00000 n +0000049045 00000 n +0000049215 00000 n +0000049385 00000 n +0000049555 00000 n +0000049724 00000 n +0000049894 00000 n +0000050064 00000 n +0000050234 00000 n +0000050403 00000 n +0000050573 00000 n +0000050741 00000 n +0000050902 00000 n +0000063950 00000 n +0000054658 00000 n +0000051225 00000 n +0000063887 00000 n +0000055224 00000 n +0000055387 00000 n +0000055550 00000 n +0000055713 00000 n +0000055876 00000 n +0000056038 00000 n +0000056201 00000 n +0000056369 00000 n +0000056537 00000 n +0000056704 00000 n +0000056872 00000 n +0000057028 00000 n +0000057190 00000 n +0000057357 00000 n +0000057524 00000 n +0000057686 00000 n +0000057848 00000 n +0000058010 00000 n +0000058172 00000 n +0000058339 00000 n +0000058506 00000 n +0000058673 00000 n +0000058835 00000 n +0000058997 00000 n +0000059152 00000 n +0000059307 00000 n +0000059464 00000 n +0000059626 00000 n +0000059788 00000 n +0000059944 00000 n +0000060099 00000 n +0000060256 00000 n +0000060418 00000 n +0000060574 00000 n +0000060731 00000 n +0000060887 00000 n +0000061044 00000 n +0000061206 00000 n +0000061363 00000 n +0000061525 00000 n +0000061682 00000 n +0000061843 00000 n +0000062005 00000 n +0000062167 00000 n +0000062322 00000 n +0000062478 00000 n +0000062635 00000 n +0000062792 00000 n +0000062949 00000 n +0000063105 00000 n +0000063262 00000 n +0000063419 00000 n +0000570494 00000 n +0000550527 00000 n +0000570321 00000 n +0000063576 00000 n +0000063731 00000 n +0000064395 00000 n +0000064210 00000 n +0000064061 00000 n +0000064332 00000 n +0000067523 00000 n +0000066713 00000 n +0000064436 00000 n +0000066835 00000 n +0000066959 00000 n +0000067084 00000 n +0000067209 00000 n +0000549638 00000 n +0000528306 00000 n +0000549464 00000 n +0000067334 00000 n +0000067397 00000 n +0000067460 00000 n +0000527539 00000 n +0000510131 00000 n +0000527366 00000 n +0000646699 00000 n +0000072034 00000 n +0000070852 00000 n +0000067647 00000 n +0000071346 00000 n +0000071409 00000 n +0000071472 00000 n +0000071597 00000 n +0000071722 00000 n +0000071847 00000 n +0000071002 00000 n +0000071195 00000 n +0000071972 00000 n +0000310036 00000 n +0000352419 00000 n +0000076688 00000 n +0000075652 00000 n +0000072158 00000 n +0000076125 00000 n +0000076250 00000 n +0000075802 00000 n +0000075964 00000 n +0000076375 00000 n +0000076500 00000 n +0000076625 00000 n +0000092558 00000 n +0000079910 00000 n +0000079350 00000 n +0000076812 00000 n +0000079472 00000 n +0000079597 00000 n +0000079722 00000 n +0000079847 00000 n +0000083337 00000 n +0000082196 00000 n +0000080021 00000 n +0000082650 00000 n +0000082775 00000 n +0000082900 00000 n +0000083025 00000 n +0000083150 00000 n +0000082346 00000 n +0000082498 00000 n +0000083274 00000 n +0000268278 00000 n +0000084423 00000 n +0000084113 00000 n +0000083422 00000 n +0000084235 00000 n +0000084360 00000 n +0000086508 00000 n +0000085823 00000 n +0000084521 00000 n +0000085945 00000 n +0000086070 00000 n +0000086194 00000 n +0000086319 00000 n +0000086445 00000 n +0000646817 00000 n +0000089413 00000 n +0000088545 00000 n +0000086606 00000 n +0000088847 00000 n +0000088973 00000 n +0000089036 00000 n +0000089099 00000 n +0000088687 00000 n +0000089225 00000 n +0000089351 00000 n +0000249782 00000 n +0000092747 00000 n +0000092310 00000 n +0000089524 00000 n +0000092432 00000 n +0000509475 00000 n +0000497890 00000 n +0000509298 00000 n +0000092684 00000 n +0000096532 00000 n +0000096347 00000 n +0000092871 00000 n +0000096469 00000 n +0000497355 00000 n +0000487841 00000 n +0000497178 00000 n +0000100916 00000 n +0000100525 00000 n +0000096695 00000 n +0000100853 00000 n +0000100667 00000 n +0000161651 00000 n +0000103202 00000 n +0000102765 00000 n +0000101053 00000 n +0000102887 00000 n +0000103013 00000 n +0000103076 00000 n +0000103139 00000 n +0000105854 00000 n +0000108386 00000 n +0000105703 00000 n +0000103326 00000 n +0000107818 00000 n +0000107944 00000 n +0000108070 00000 n +0000107496 00000 n +0000107657 00000 n +0000486982 00000 n +0000477610 00000 n +0000486810 00000 n +0000477048 00000 n +0000467964 00000 n +0000476875 00000 n +0000108196 00000 n +0000108322 00000 n +0000646935 00000 n +0000107325 00000 n +0000107383 00000 n +0000107473 00000 n +0000198725 00000 n +0000227340 00000 n +0000112935 00000 n +0000112001 00000 n +0000108538 00000 n +0000112485 00000 n +0000112613 00000 n +0000112157 00000 n +0000112323 00000 n +0000112741 00000 n +0000112870 00000 n +0000356445 00000 n +0000116427 00000 n +0000116047 00000 n +0000113086 00000 n +0000116362 00000 n +0000116194 00000 n +0000117661 00000 n +0000117470 00000 n +0000116552 00000 n +0000117596 00000 n +0000120563 00000 n +0000119987 00000 n +0000117760 00000 n +0000120113 00000 n +0000120240 00000 n +0000120369 00000 n +0000120498 00000 n +0000123953 00000 n +0000123118 00000 n +0000120701 00000 n +0000123244 00000 n +0000123373 00000 n +0000123502 00000 n +0000123631 00000 n +0000123759 00000 n +0000123888 00000 n +0000127856 00000 n 0000127088 00000 n -0000127217 00000 n -0000643469 00000 n -0000305008 00000 n -0000131140 00000 n -0000130563 00000 n -0000127393 00000 n -0000130689 00000 n -0000130818 00000 n -0000130946 00000 n -0000131075 00000 n -0000134599 00000 n -0000134279 00000 n -0000131278 00000 n -0000134405 00000 n -0000134534 00000 n -0000137930 00000 n -0000137171 00000 n -0000134711 00000 n -0000137479 00000 n -0000137608 00000 n -0000137318 00000 n -0000137737 00000 n -0000137865 00000 n -0000350364 00000 n -0000140668 00000 n -0000140090 00000 n -0000138096 00000 n -0000140216 00000 n -0000140345 00000 n -0000140474 00000 n -0000140603 00000 n -0000141108 00000 n -0000140917 00000 n -0000140767 00000 n -0000141043 00000 n -0000145110 00000 n -0000144344 00000 n -0000141150 00000 n -0000144658 00000 n -0000144787 00000 n -0000144915 00000 n -0000144980 00000 n -0000145045 00000 n -0000144491 00000 n -0000643594 00000 n -0000149172 00000 n -0000149495 00000 n -0000148917 00000 n -0000145209 00000 n -0000149043 00000 n -0000149301 00000 n -0000149430 00000 n -0000153095 00000 n -0000152517 00000 n -0000149633 00000 n -0000152643 00000 n -0000152772 00000 n -0000152901 00000 n -0000153030 00000 n -0000155880 00000 n -0000157130 00000 n -0000155754 00000 n -0000153220 00000 n -0000156806 00000 n -0000156935 00000 n -0000157000 00000 n -0000157065 00000 n -0000161135 00000 n -0000160302 00000 n -0000157284 00000 n -0000160428 00000 n -0000160557 00000 n -0000160684 00000 n -0000160749 00000 n -0000160814 00000 n -0000160943 00000 n +0000124091 00000 n +0000127405 00000 n +0000127235 00000 n +0000127534 00000 n +0000127663 00000 n +0000127792 00000 n +0000647059 00000 n +0000305810 00000 n +0000131720 00000 n +0000131143 00000 n +0000127968 00000 n +0000131269 00000 n +0000131398 00000 n +0000131526 00000 n +0000131655 00000 n +0000135162 00000 n +0000134842 00000 n +0000131858 00000 n +0000134968 00000 n +0000135097 00000 n +0000138493 00000 n +0000137734 00000 n +0000135274 00000 n +0000138042 00000 n +0000138171 00000 n +0000137881 00000 n +0000138300 00000 n +0000138428 00000 n +0000352161 00000 n +0000141231 00000 n +0000140653 00000 n +0000138659 00000 n +0000140779 00000 n +0000140908 00000 n +0000141037 00000 n +0000141166 00000 n +0000141671 00000 n +0000141480 00000 n +0000141330 00000 n +0000141606 00000 n +0000145673 00000 n +0000144907 00000 n +0000141713 00000 n +0000145221 00000 n +0000145350 00000 n +0000145478 00000 n +0000145543 00000 n +0000145608 00000 n +0000145054 00000 n +0000647184 00000 n +0000149746 00000 n +0000150069 00000 n +0000149491 00000 n +0000145772 00000 n +0000149617 00000 n +0000149875 00000 n +0000150004 00000 n +0000153675 00000 n +0000153097 00000 n +0000150207 00000 n +0000153223 00000 n +0000153352 00000 n +0000153481 00000 n +0000153610 00000 n +0000156460 00000 n +0000157710 00000 n +0000156334 00000 n +0000153800 00000 n +0000157386 00000 n +0000157515 00000 n +0000157580 00000 n +0000157645 00000 n +0000161715 00000 n +0000160882 00000 n +0000157864 00000 n +0000161008 00000 n +0000161137 00000 n +0000161264 00000 n +0000161329 00000 n +0000161394 00000 n +0000161523 00000 n +0000166757 00000 n +0000165359 00000 n +0000161827 00000 n 0000166177 00000 n -0000164779 00000 n -0000161247 00000 n -0000165597 00000 n -0000164953 00000 n -0000165104 00000 n -0000165726 00000 n -0000165855 00000 n -0000165984 00000 n -0000166113 00000 n -0000165263 00000 n -0000165413 00000 n -0000451309 00000 n -0000169654 00000 n -0000168997 00000 n -0000166315 00000 n -0000169331 00000 n -0000169144 00000 n -0000169460 00000 n -0000169589 00000 n -0000643719 00000 n -0000174289 00000 n -0000173969 00000 n -0000169779 00000 n -0000174095 00000 n -0000174224 00000 n -0000177453 00000 n -0000177074 00000 n -0000174414 00000 n -0000177388 00000 n -0000177221 00000 n -0000180403 00000 n -0000180597 00000 n -0000180148 00000 n -0000177565 00000 n -0000180274 00000 n -0000180468 00000 n -0000180532 00000 n -0000184339 00000 n -0000183555 00000 n -0000180709 00000 n -0000184016 00000 n -0000184145 00000 n -0000184274 00000 n -0000183711 00000 n -0000183863 00000 n -0000186345 00000 n -0000185767 00000 n -0000184451 00000 n -0000185893 00000 n -0000186022 00000 n -0000186151 00000 n -0000186280 00000 n -0000187890 00000 n -0000187699 00000 n -0000186457 00000 n -0000187825 00000 n -0000643844 00000 n -0000190097 00000 n -0000189777 00000 n -0000187989 00000 n -0000189903 00000 n -0000190032 00000 n -0000194415 00000 n -0000194047 00000 n -0000190209 00000 n -0000194350 00000 n -0000194194 00000 n -0000263332 00000 n -0000198510 00000 n -0000198061 00000 n -0000194540 00000 n -0000198187 00000 n -0000198380 00000 n -0000198445 00000 n -0000202640 00000 n -0000202274 00000 n -0000198635 00000 n -0000202575 00000 n -0000202421 00000 n -0000207674 00000 n -0000206541 00000 n -0000202765 00000 n -0000207609 00000 n -0000206724 00000 n -0000206880 00000 n -0000207065 00000 n -0000207239 00000 n -0000207424 00000 n -0000271871 00000 n -0000211774 00000 n -0000211583 00000 n -0000207866 00000 n -0000211709 00000 n -0000643969 00000 n -0000215515 00000 n -0000215195 00000 n -0000211886 00000 n -0000215321 00000 n -0000215450 00000 n -0000219894 00000 n -0000218901 00000 n -0000215627 00000 n -0000219571 00000 n -0000219066 00000 n -0000219700 00000 n -0000219829 00000 n -0000219235 00000 n -0000219401 00000 n -0000278798 00000 n -0000337838 00000 n -0000223633 00000 n -0000223121 00000 n -0000220060 00000 n -0000223439 00000 n -0000223268 00000 n -0000223568 00000 n -0000226822 00000 n -0000226373 00000 n -0000223758 00000 n -0000226499 00000 n -0000226628 00000 n -0000230820 00000 n -0000230629 00000 n -0000226988 00000 n -0000230755 00000 n -0000233792 00000 n -0000233472 00000 n -0000230932 00000 n -0000233598 00000 n -0000233727 00000 n -0000644094 00000 n -0000238171 00000 n -0000237365 00000 n -0000233945 00000 n -0000237850 00000 n -0000237979 00000 n -0000237521 00000 n -0000238107 00000 n -0000237695 00000 n -0000241672 00000 n -0000241223 00000 n -0000238283 00000 n -0000241349 00000 n -0000241478 00000 n -0000241607 00000 n -0000245571 00000 n -0000244904 00000 n -0000241825 00000 n -0000245377 00000 n -0000245506 00000 n -0000245060 00000 n -0000245222 00000 n -0000249254 00000 n -0000248486 00000 n -0000245737 00000 n -0000248802 00000 n -0000248633 00000 n -0000248995 00000 n -0000249060 00000 n -0000249189 00000 n -0000253674 00000 n -0000253128 00000 n -0000249433 00000 n -0000253609 00000 n -0000253284 00000 n -0000253446 00000 n -0000330952 00000 n -0000258080 00000 n -0000257442 00000 n -0000253840 00000 n -0000257758 00000 n -0000464763 00000 n -0000462765 00000 n -0000464598 00000 n -0000257887 00000 n -0000257589 00000 n -0000258015 00000 n -0000644219 00000 n -0000275776 00000 n -0000260167 00000 n -0000259976 00000 n -0000258219 00000 n -0000260102 00000 n -0000263527 00000 n -0000263077 00000 n -0000260279 00000 n -0000263203 00000 n -0000263397 00000 n -0000263462 00000 n -0000267273 00000 n -0000266825 00000 n -0000263667 00000 n -0000266951 00000 n -0000267208 00000 n -0000271936 00000 n -0000271444 00000 n -0000267385 00000 n -0000271742 00000 n -0000271591 00000 n -0000275970 00000 n -0000274919 00000 n -0000272048 00000 n -0000275389 00000 n -0000275075 00000 n -0000275518 00000 n -0000275647 00000 n -0000275235 00000 n -0000275905 00000 n -0000278862 00000 n -0000278543 00000 n -0000276082 00000 n -0000278669 00000 n -0000644344 00000 n -0000280262 00000 n -0000280071 00000 n -0000278974 00000 n -0000280197 00000 n -0000281674 00000 n -0000281483 00000 n -0000280361 00000 n -0000281609 00000 n -0000285367 00000 n -0000284788 00000 n -0000281773 00000 n -0000284914 00000 n -0000285043 00000 n -0000285172 00000 n -0000285237 00000 n -0000285302 00000 n -0000290137 00000 n -0000288645 00000 n -0000285479 00000 n -0000289814 00000 n -0000289943 00000 n -0000290072 00000 n -0000288837 00000 n -0000288998 00000 n -0000289160 00000 n -0000289322 00000 n -0000289484 00000 n -0000289654 00000 n -0000295040 00000 n -0000293636 00000 n -0000290249 00000 n -0000294975 00000 n -0000293837 00000 n -0000294000 00000 n -0000294163 00000 n -0000294326 00000 n -0000294489 00000 n -0000294652 00000 n -0000294815 00000 n -0000301137 00000 n -0000297904 00000 n -0000295165 00000 n -0000301072 00000 n -0000298204 00000 n -0000298365 00000 n -0000298527 00000 n -0000298689 00000 n -0000298851 00000 n -0000299014 00000 n -0000299168 00000 n -0000299330 00000 n -0000299492 00000 n -0000299652 00000 n -0000299812 00000 n -0000299974 00000 n -0000300133 00000 n -0000300292 00000 n -0000300445 00000 n -0000300607 00000 n -0000300758 00000 n -0000300920 00000 n -0000644469 00000 n -0000305203 00000 n -0000304753 00000 n -0000301262 00000 n -0000304879 00000 n -0000305073 00000 n -0000305138 00000 n -0000309600 00000 n -0000308402 00000 n -0000305328 00000 n -0000308890 00000 n -0000309019 00000 n -0000309275 00000 n -0000308558 00000 n -0000308728 00000 n -0000309340 00000 n -0000309405 00000 n -0000309470 00000 n -0000309535 00000 n -0000312851 00000 n -0000312530 00000 n -0000309712 00000 n -0000312656 00000 n -0000312721 00000 n -0000312786 00000 n -0000316771 00000 n -0000316259 00000 n -0000312950 00000 n -0000316385 00000 n -0000316513 00000 n -0000316578 00000 n -0000316643 00000 n -0000316708 00000 n -0000320715 00000 n -0000319941 00000 n -0000316883 00000 n -0000320067 00000 n -0000320132 00000 n -0000320261 00000 n -0000320326 00000 n -0000320391 00000 n -0000320520 00000 n -0000320585 00000 n -0000320650 00000 n -0000324162 00000 n -0000323326 00000 n +0000165533 00000 n +0000165684 00000 n +0000166306 00000 n +0000166435 00000 n +0000166564 00000 n +0000166693 00000 n +0000165843 00000 n +0000165993 00000 n +0000454156 00000 n +0000170235 00000 n +0000169578 00000 n +0000166895 00000 n +0000169912 00000 n +0000169725 00000 n +0000170041 00000 n +0000170170 00000 n +0000647309 00000 n +0000174870 00000 n +0000174550 00000 n +0000170360 00000 n +0000174676 00000 n +0000174805 00000 n +0000178034 00000 n +0000177655 00000 n +0000174995 00000 n +0000177969 00000 n +0000177802 00000 n +0000180984 00000 n +0000181178 00000 n +0000180729 00000 n +0000178146 00000 n +0000180855 00000 n +0000181049 00000 n +0000181113 00000 n +0000184925 00000 n +0000184141 00000 n +0000181290 00000 n +0000184602 00000 n +0000184731 00000 n +0000184860 00000 n +0000184297 00000 n +0000184449 00000 n +0000186912 00000 n +0000186334 00000 n +0000185037 00000 n +0000186460 00000 n +0000186589 00000 n +0000186718 00000 n +0000186847 00000 n +0000188482 00000 n +0000188291 00000 n +0000187024 00000 n +0000188417 00000 n +0000647434 00000 n +0000190597 00000 n +0000190277 00000 n +0000188581 00000 n +0000190403 00000 n +0000190532 00000 n +0000194902 00000 n +0000194534 00000 n +0000190709 00000 n +0000194837 00000 n +0000194681 00000 n +0000264290 00000 n +0000198790 00000 n +0000198470 00000 n +0000195027 00000 n +0000198596 00000 n +0000202882 00000 n +0000202386 00000 n +0000198915 00000 n +0000202687 00000 n +0000202752 00000 n +0000202817 00000 n +0000202533 00000 n +0000208035 00000 n +0000206902 00000 n +0000203007 00000 n +0000207970 00000 n +0000207085 00000 n +0000207241 00000 n +0000207426 00000 n +0000207600 00000 n +0000207785 00000 n +0000272323 00000 n +0000212172 00000 n +0000211981 00000 n +0000208227 00000 n +0000212107 00000 n +0000647559 00000 n +0000216151 00000 n +0000215831 00000 n +0000212297 00000 n +0000215957 00000 n +0000216086 00000 n +0000220494 00000 n +0000219505 00000 n +0000216263 00000 n +0000220173 00000 n +0000219670 00000 n +0000220302 00000 n +0000220430 00000 n +0000219839 00000 n +0000220005 00000 n +0000281677 00000 n +0000339791 00000 n +0000224304 00000 n +0000223794 00000 n +0000220660 00000 n +0000224110 00000 n +0000223941 00000 n +0000224239 00000 n +0000227405 00000 n +0000226956 00000 n +0000224429 00000 n +0000227082 00000 n +0000227211 00000 n +0000231466 00000 n +0000231275 00000 n +0000227571 00000 n +0000231401 00000 n +0000234642 00000 n +0000234324 00000 n +0000231578 00000 n +0000234450 00000 n +0000234579 00000 n +0000647684 00000 n +0000239021 00000 n +0000238215 00000 n +0000234795 00000 n +0000238700 00000 n +0000238829 00000 n +0000238371 00000 n +0000238957 00000 n +0000238545 00000 n +0000242523 00000 n +0000242074 00000 n +0000239133 00000 n +0000242200 00000 n +0000242329 00000 n +0000242458 00000 n +0000246422 00000 n +0000245755 00000 n +0000242676 00000 n +0000246228 00000 n +0000246357 00000 n +0000245911 00000 n +0000246073 00000 n +0000250105 00000 n +0000249337 00000 n +0000246588 00000 n +0000249653 00000 n +0000249484 00000 n +0000249846 00000 n +0000249911 00000 n +0000250040 00000 n +0000254580 00000 n +0000254034 00000 n +0000250284 00000 n +0000254515 00000 n +0000254190 00000 n +0000254352 00000 n +0000332906 00000 n +0000259003 00000 n +0000258364 00000 n +0000254746 00000 n +0000258680 00000 n +0000467609 00000 n +0000465612 00000 n +0000467444 00000 n +0000258809 00000 n +0000258511 00000 n +0000258938 00000 n +0000647809 00000 n +0000276607 00000 n +0000261168 00000 n +0000260977 00000 n +0000259129 00000 n +0000261103 00000 n +0000264485 00000 n +0000264035 00000 n +0000261280 00000 n +0000264161 00000 n +0000264355 00000 n +0000264420 00000 n +0000268471 00000 n +0000268023 00000 n +0000264625 00000 n +0000268149 00000 n +0000268406 00000 n +0000272388 00000 n +0000272069 00000 n +0000268583 00000 n +0000272195 00000 n +0000276671 00000 n +0000275594 00000 n +0000272500 00000 n +0000276224 00000 n +0000275759 00000 n +0000275910 00000 n +0000276353 00000 n +0000276481 00000 n +0000276070 00000 n +0000280097 00000 n +0000279778 00000 n +0000276783 00000 n +0000279904 00000 n +0000280033 00000 n +0000647934 00000 n +0000281742 00000 n +0000281422 00000 n +0000280209 00000 n +0000281548 00000 n +0000283200 00000 n +0000283009 00000 n +0000281854 00000 n +0000283135 00000 n +0000285934 00000 n +0000285355 00000 n +0000283299 00000 n +0000285481 00000 n +0000285610 00000 n +0000285739 00000 n +0000285804 00000 n +0000285869 00000 n +0000289857 00000 n +0000289537 00000 n +0000286046 00000 n +0000289663 00000 n +0000289792 00000 n +0000295474 00000 n +0000293080 00000 n +0000289969 00000 n +0000295280 00000 n +0000295409 00000 n +0000293326 00000 n +0000293488 00000 n +0000293650 00000 n +0000293811 00000 n +0000293971 00000 n +0000294142 00000 n +0000294304 00000 n +0000294466 00000 n +0000294628 00000 n +0000294791 00000 n +0000294954 00000 n +0000295117 00000 n +0000300692 00000 n +0000298631 00000 n +0000295599 00000 n +0000300627 00000 n +0000298868 00000 n +0000299030 00000 n +0000299192 00000 n +0000299353 00000 n +0000299514 00000 n +0000299676 00000 n +0000299839 00000 n +0000299993 00000 n +0000300147 00000 n +0000300309 00000 n +0000300469 00000 n +0000648059 00000 n +0000306003 00000 n +0000304030 00000 n +0000300817 00000 n +0000305681 00000 n +0000304249 00000 n +0000304411 00000 n +0000304573 00000 n +0000304734 00000 n +0000304896 00000 n +0000305050 00000 n +0000305211 00000 n +0000305365 00000 n +0000305527 00000 n +0000305875 00000 n +0000305939 00000 n +0000310358 00000 n +0000309291 00000 n +0000306128 00000 n +0000309779 00000 n +0000309907 00000 n +0000310164 00000 n +0000309447 00000 n +0000309617 00000 n +0000310229 00000 n +0000310294 00000 n +0000313806 00000 n +0000313485 00000 n +0000310483 00000 n +0000313611 00000 n +0000313676 00000 n +0000313741 00000 n +0000317732 00000 n +0000317282 00000 n +0000313905 00000 n +0000317408 00000 n +0000317473 00000 n +0000317538 00000 n +0000317667 00000 n +0000321548 00000 n 0000320840 00000 n -0000323452 00000 n -0000323581 00000 n -0000323646 00000 n -0000323711 00000 n -0000323840 00000 n -0000323969 00000 n -0000324098 00000 n -0000644594 00000 n -0000327158 00000 n -0000326579 00000 n -0000324368 00000 n -0000326705 00000 n -0000326834 00000 n -0000326963 00000 n -0000327028 00000 n -0000327093 00000 n -0000331017 00000 n -0000330697 00000 n -0000327337 00000 n -0000330823 00000 n -0000331483 00000 n -0000331292 00000 n -0000331142 00000 n -0000331418 00000 n -0000333423 00000 n -0000332974 00000 n -0000331525 00000 n -0000333100 00000 n -0000333229 00000 n -0000333358 00000 n -0000337903 00000 n -0000336959 00000 n -0000333535 00000 n -0000337322 00000 n -0000462444 00000 n -0000453231 00000 n -0000462258 00000 n -0000337106 00000 n -0000337451 00000 n -0000337580 00000 n -0000337709 00000 n -0000338941 00000 n -0000338750 00000 n -0000338136 00000 n -0000338876 00000 n -0000644719 00000 n -0000339368 00000 n -0000339177 00000 n -0000339027 00000 n -0000339303 00000 n -0000342695 00000 n -0000341469 00000 n -0000339410 00000 n -0000341986 00000 n -0000342115 00000 n -0000342244 00000 n -0000342373 00000 n -0000342502 00000 n -0000342631 00000 n -0000341625 00000 n -0000341797 00000 n -0000343149 00000 n -0000342958 00000 n -0000342808 00000 n -0000343084 00000 n -0000346488 00000 n -0000345910 00000 n -0000343191 00000 n -0000346036 00000 n -0000346165 00000 n -0000346294 00000 n -0000346423 00000 n -0000351720 00000 n -0000349595 00000 n -0000346574 00000 n -0000350106 00000 n -0000350235 00000 n -0000350493 00000 n -0000349751 00000 n -0000349930 00000 n -0000350686 00000 n -0000350751 00000 n -0000350816 00000 n -0000350881 00000 n -0000350946 00000 n -0000351011 00000 n -0000351076 00000 n -0000351141 00000 n -0000351206 00000 n -0000351271 00000 n -0000351336 00000 n -0000351464 00000 n -0000351528 00000 n -0000351592 00000 n -0000351656 00000 n -0000358457 00000 n -0000354889 00000 n -0000351872 00000 n -0000355015 00000 n -0000355080 00000 n -0000355145 00000 n -0000355210 00000 n -0000355275 00000 n -0000355340 00000 n -0000355405 00000 n -0000355470 00000 n -0000355535 00000 n -0000355600 00000 n -0000355665 00000 n -0000355730 00000 n +0000317857 00000 n +0000320966 00000 n +0000321031 00000 n +0000321096 00000 n +0000321161 00000 n +0000321226 00000 n +0000321354 00000 n +0000321418 00000 n +0000321483 00000 n +0000325389 00000 n +0000324552 00000 n +0000321673 00000 n +0000324678 00000 n +0000324807 00000 n +0000324872 00000 n +0000324937 00000 n +0000325066 00000 n +0000325131 00000 n +0000325196 00000 n +0000325324 00000 n +0000648184 00000 n +0000328630 00000 n +0000327924 00000 n +0000325568 00000 n +0000328050 00000 n +0000328179 00000 n +0000328308 00000 n +0000328437 00000 n +0000328566 00000 n +0000332970 00000 n +0000332521 00000 n +0000328823 00000 n +0000332647 00000 n +0000332712 00000 n +0000332777 00000 n +0000333436 00000 n +0000333245 00000 n +0000333095 00000 n +0000333371 00000 n +0000335376 00000 n +0000334927 00000 n +0000333478 00000 n +0000335053 00000 n +0000335182 00000 n +0000335311 00000 n +0000339856 00000 n +0000338912 00000 n +0000335488 00000 n +0000339275 00000 n +0000465291 00000 n +0000456078 00000 n +0000465105 00000 n +0000339059 00000 n +0000339404 00000 n +0000339533 00000 n +0000339662 00000 n +0000340894 00000 n +0000340703 00000 n +0000340089 00000 n +0000340829 00000 n +0000648309 00000 n +0000341321 00000 n +0000341130 00000 n +0000340980 00000 n +0000341256 00000 n +0000344634 00000 n +0000343408 00000 n +0000341363 00000 n +0000343925 00000 n +0000344054 00000 n +0000344183 00000 n +0000344312 00000 n +0000344441 00000 n +0000344570 00000 n +0000343564 00000 n +0000343736 00000 n +0000345088 00000 n +0000344897 00000 n +0000344747 00000 n +0000345023 00000 n +0000348332 00000 n +0000347754 00000 n +0000345130 00000 n +0000347880 00000 n +0000348009 00000 n +0000348138 00000 n +0000348267 00000 n +0000352611 00000 n +0000351392 00000 n +0000348418 00000 n +0000351903 00000 n +0000352032 00000 n +0000352290 00000 n +0000351548 00000 n +0000351727 00000 n +0000352483 00000 n +0000352547 00000 n +0000359497 00000 n +0000355669 00000 n +0000352763 00000 n 0000355795 00000 n 0000355860 00000 n 0000355925 00000 n @@ -12400,7 +12468,6 @@ xref 0000356250 00000 n 0000356315 00000 n 0000356380 00000 n -0000356445 00000 n 0000356510 00000 n 0000356575 00000 n 0000356640 00000 n @@ -12418,99 +12485,101 @@ xref 0000357420 00000 n 0000357485 00000 n 0000357550 00000 n -0000357614 00000 n -0000357679 00000 n -0000357744 00000 n -0000357809 00000 n -0000357874 00000 n -0000357939 00000 n -0000358004 00000 n +0000357615 00000 n +0000357680 00000 n +0000357745 00000 n +0000357810 00000 n +0000357875 00000 n +0000357940 00000 n +0000358005 00000 n 0000358069 00000 n 0000358134 00000 n 0000358199 00000 n 0000358264 00000 n 0000358329 00000 n -0000358393 00000 n -0000644844 00000 n -0000365184 00000 n -0000361489 00000 n -0000358569 00000 n -0000361615 00000 n -0000361680 00000 n -0000361745 00000 n -0000361810 00000 n -0000361875 00000 n -0000361939 00000 n -0000362004 00000 n -0000362069 00000 n -0000362134 00000 n -0000362199 00000 n -0000362264 00000 n -0000362329 00000 n -0000362394 00000 n -0000362459 00000 n -0000362524 00000 n -0000362589 00000 n -0000362654 00000 n -0000362719 00000 n -0000362784 00000 n -0000362849 00000 n -0000362914 00000 n -0000362979 00000 n -0000363044 00000 n -0000363109 00000 n -0000363173 00000 n -0000363238 00000 n -0000363303 00000 n -0000363368 00000 n -0000363433 00000 n -0000363498 00000 n -0000363563 00000 n -0000363628 00000 n -0000363693 00000 n -0000363758 00000 n -0000363823 00000 n -0000363888 00000 n -0000363953 00000 n -0000364018 00000 n -0000364083 00000 n -0000364148 00000 n -0000364213 00000 n -0000364278 00000 n -0000364343 00000 n -0000364408 00000 n -0000364473 00000 n -0000364538 00000 n -0000364603 00000 n -0000364668 00000 n -0000364733 00000 n -0000364798 00000 n -0000364863 00000 n -0000364927 00000 n -0000364992 00000 n -0000365056 00000 n -0000365120 00000 n -0000371733 00000 n -0000368105 00000 n -0000365296 00000 n -0000368231 00000 n -0000368296 00000 n -0000368360 00000 n -0000368424 00000 n -0000368488 00000 n -0000368553 00000 n -0000368618 00000 n -0000368683 00000 n -0000368748 00000 n -0000368813 00000 n -0000368878 00000 n -0000368943 00000 n -0000369008 00000 n -0000369073 00000 n -0000369138 00000 n -0000369203 00000 n -0000369267 00000 n -0000369332 00000 n +0000358394 00000 n +0000358459 00000 n +0000358524 00000 n +0000358589 00000 n +0000358654 00000 n +0000358719 00000 n +0000358784 00000 n +0000358849 00000 n +0000358914 00000 n +0000358979 00000 n +0000359044 00000 n +0000359109 00000 n +0000359174 00000 n +0000359239 00000 n +0000359304 00000 n +0000359369 00000 n +0000359433 00000 n +0000648434 00000 n +0000366143 00000 n +0000362579 00000 n +0000359609 00000 n +0000362705 00000 n +0000362770 00000 n +0000362835 00000 n +0000362900 00000 n +0000362965 00000 n +0000363030 00000 n +0000363095 00000 n +0000363160 00000 n +0000363225 00000 n +0000363290 00000 n +0000363355 00000 n +0000363420 00000 n +0000363484 00000 n +0000363549 00000 n +0000363614 00000 n +0000363679 00000 n +0000363744 00000 n +0000363809 00000 n +0000363874 00000 n +0000363939 00000 n +0000364004 00000 n +0000364069 00000 n +0000364134 00000 n +0000364199 00000 n +0000364263 00000 n +0000364328 00000 n +0000364393 00000 n +0000364458 00000 n +0000364523 00000 n +0000364588 00000 n +0000364653 00000 n +0000364718 00000 n +0000364783 00000 n +0000364848 00000 n +0000364913 00000 n +0000364978 00000 n +0000365043 00000 n +0000365108 00000 n +0000365173 00000 n +0000365238 00000 n +0000365302 00000 n +0000365366 00000 n +0000365430 00000 n +0000365495 00000 n +0000365560 00000 n +0000365625 00000 n +0000365690 00000 n +0000365755 00000 n +0000365820 00000 n +0000365885 00000 n +0000365950 00000 n +0000366015 00000 n +0000366079 00000 n +0000372318 00000 n +0000368880 00000 n +0000366255 00000 n +0000369006 00000 n +0000369071 00000 n +0000369136 00000 n +0000369201 00000 n +0000369266 00000 n +0000369331 00000 n 0000369396 00000 n 0000369461 00000 n 0000369526 00000 n @@ -12538,7 +12607,7 @@ xref 0000370956 00000 n 0000371021 00000 n 0000371086 00000 n -0000371150 00000 n +0000371151 00000 n 0000371215 00000 n 0000371280 00000 n 0000371345 00000 n @@ -12546,248 +12615,271 @@ xref 0000371475 00000 n 0000371540 00000 n 0000371605 00000 n -0000371669 00000 n -0000374851 00000 n -0000373493 00000 n -0000371845 00000 n -0000373619 00000 n -0000373684 00000 n -0000373749 00000 n -0000373814 00000 n -0000373879 00000 n -0000373944 00000 n -0000374009 00000 n -0000374074 00000 n -0000374139 00000 n -0000374203 00000 n -0000374268 00000 n -0000374397 00000 n -0000374526 00000 n -0000374591 00000 n -0000374656 00000 n -0000374721 00000 n -0000374786 00000 n -0000377615 00000 n -0000376971 00000 n -0000374976 00000 n -0000377097 00000 n -0000377226 00000 n -0000377355 00000 n -0000377420 00000 n -0000377485 00000 n -0000377550 00000 n -0000382096 00000 n -0000381775 00000 n -0000377727 00000 n -0000381901 00000 n -0000381966 00000 n -0000382031 00000 n -0000385351 00000 n -0000385095 00000 n -0000382248 00000 n -0000385221 00000 n -0000385286 00000 n -0000644969 00000 n -0000388610 00000 n -0000388419 00000 n -0000385489 00000 n -0000388545 00000 n -0000392390 00000 n -0000392134 00000 n -0000388735 00000 n -0000392260 00000 n -0000392325 00000 n -0000395564 00000 n -0000394789 00000 n -0000392528 00000 n -0000394915 00000 n -0000394980 00000 n -0000395045 00000 n -0000395110 00000 n -0000395175 00000 n -0000395304 00000 n -0000395369 00000 n -0000395434 00000 n -0000395499 00000 n -0000400034 00000 n -0000399843 00000 n -0000395702 00000 n -0000399969 00000 n -0000403215 00000 n -0000402442 00000 n -0000400172 00000 n -0000402568 00000 n -0000402633 00000 n -0000402698 00000 n -0000402762 00000 n -0000402891 00000 n -0000402956 00000 n -0000403020 00000 n -0000403085 00000 n -0000403150 00000 n -0000406634 00000 n -0000406378 00000 n -0000403380 00000 n -0000406504 00000 n -0000406569 00000 n -0000645094 00000 n -0000409479 00000 n -0000408769 00000 n -0000406772 00000 n -0000408895 00000 n -0000408960 00000 n -0000409025 00000 n -0000409090 00000 n -0000409219 00000 n -0000409284 00000 n -0000409349 00000 n -0000409414 00000 n -0000413160 00000 n -0000412904 00000 n -0000409630 00000 n -0000413030 00000 n -0000413095 00000 n -0000416510 00000 n -0000416254 00000 n -0000413285 00000 n -0000416380 00000 n -0000416445 00000 n -0000419120 00000 n -0000418347 00000 n -0000416648 00000 n -0000418473 00000 n -0000418538 00000 n -0000418603 00000 n -0000418731 00000 n -0000418796 00000 n -0000418861 00000 n -0000418926 00000 n -0000418991 00000 n -0000419056 00000 n -0000421961 00000 n -0000421251 00000 n -0000419271 00000 n -0000421377 00000 n -0000421442 00000 n -0000421507 00000 n -0000421636 00000 n -0000421701 00000 n -0000421766 00000 n -0000421831 00000 n -0000421896 00000 n -0000425496 00000 n -0000425305 00000 n -0000422112 00000 n -0000425431 00000 n -0000645219 00000 n -0000428244 00000 n -0000427470 00000 n -0000425621 00000 n -0000427596 00000 n -0000427661 00000 n -0000427726 00000 n -0000427791 00000 n -0000427920 00000 n -0000427984 00000 n -0000428049 00000 n -0000428114 00000 n -0000428179 00000 n -0000431118 00000 n -0000430927 00000 n -0000428395 00000 n -0000431053 00000 n -0000434027 00000 n -0000433577 00000 n -0000431311 00000 n -0000433703 00000 n -0000433768 00000 n -0000433833 00000 n -0000433898 00000 n -0000433963 00000 n -0000437434 00000 n -0000436791 00000 n -0000434259 00000 n -0000436917 00000 n -0000436982 00000 n -0000437111 00000 n -0000437176 00000 n -0000437240 00000 n -0000437304 00000 n -0000437369 00000 n -0000440396 00000 n -0000439686 00000 n -0000437572 00000 n -0000439812 00000 n -0000439877 00000 n -0000439942 00000 n -0000440007 00000 n -0000440136 00000 n -0000440201 00000 n -0000440266 00000 n -0000440331 00000 n -0000443492 00000 n -0000443236 00000 n -0000440560 00000 n -0000443362 00000 n -0000443427 00000 n -0000645344 00000 n -0000446628 00000 n -0000445919 00000 n -0000443617 00000 n -0000446045 00000 n -0000446110 00000 n -0000446175 00000 n -0000446240 00000 n -0000446368 00000 n -0000446433 00000 n -0000446498 00000 n -0000446563 00000 n -0000450219 00000 n -0000449898 00000 n -0000446779 00000 n -0000450024 00000 n -0000450089 00000 n -0000450154 00000 n -0000451197 00000 n -0000450876 00000 n -0000450357 00000 n -0000451002 00000 n -0000451067 00000 n -0000451132 00000 n -0000451342 00000 n -0000462686 00000 n -0000465010 00000 n -0000464979 00000 n -0000474498 00000 n -0000484497 00000 n -0000494725 00000 n -0000506927 00000 n -0000525060 00000 n -0000547147 00000 n -0000567846 00000 n -0000585658 00000 n -0000588489 00000 n -0000588259 00000 n -0000615525 00000 n -0000642502 00000 n -0000645451 00000 n -0000645573 00000 n -0000645699 00000 n -0000645825 00000 n -0000645915 00000 n -0000646007 00000 n -0000661194 00000 n -0000678432 00000 n -0000678473 00000 n -0000678513 00000 n -0000678647 00000 n +0000371670 00000 n +0000371735 00000 n +0000371800 00000 n +0000371865 00000 n +0000371930 00000 n +0000371995 00000 n +0000372060 00000 n +0000372125 00000 n +0000372190 00000 n +0000372254 00000 n +0000376897 00000 n +0000374633 00000 n +0000372430 00000 n +0000374759 00000 n +0000374824 00000 n +0000374889 00000 n +0000374954 00000 n +0000375019 00000 n +0000375084 00000 n +0000375149 00000 n +0000375214 00000 n +0000375279 00000 n +0000375344 00000 n +0000375409 00000 n +0000375474 00000 n +0000375539 00000 n +0000375604 00000 n +0000375666 00000 n +0000375730 00000 n +0000375795 00000 n +0000375859 00000 n +0000375924 00000 n +0000375989 00000 n +0000376054 00000 n +0000376119 00000 n +0000376184 00000 n +0000376249 00000 n +0000376314 00000 n +0000376443 00000 n +0000376572 00000 n +0000376637 00000 n +0000376702 00000 n +0000376767 00000 n +0000376832 00000 n +0000379664 00000 n +0000379020 00000 n +0000377022 00000 n +0000379146 00000 n +0000379275 00000 n +0000379404 00000 n +0000379469 00000 n +0000379534 00000 n +0000379599 00000 n +0000384149 00000 n +0000383828 00000 n +0000379776 00000 n +0000383954 00000 n +0000384019 00000 n +0000384084 00000 n +0000387400 00000 n +0000387144 00000 n +0000384301 00000 n +0000387270 00000 n +0000387335 00000 n +0000648559 00000 n +0000390650 00000 n +0000390459 00000 n +0000387538 00000 n +0000390585 00000 n +0000394430 00000 n +0000394174 00000 n +0000390775 00000 n +0000394300 00000 n +0000394365 00000 n +0000397604 00000 n +0000396829 00000 n +0000394568 00000 n +0000396955 00000 n +0000397020 00000 n +0000397085 00000 n +0000397150 00000 n +0000397215 00000 n +0000397344 00000 n +0000397409 00000 n +0000397474 00000 n +0000397539 00000 n +0000402075 00000 n +0000401884 00000 n +0000397742 00000 n +0000402010 00000 n +0000405203 00000 n +0000404430 00000 n +0000402213 00000 n +0000404556 00000 n +0000404621 00000 n +0000404686 00000 n +0000404750 00000 n +0000404879 00000 n +0000404944 00000 n +0000405008 00000 n +0000405073 00000 n +0000405138 00000 n +0000408593 00000 n +0000408337 00000 n +0000405341 00000 n +0000408463 00000 n +0000408528 00000 n +0000648684 00000 n +0000411453 00000 n +0000410743 00000 n +0000408731 00000 n +0000410869 00000 n +0000410934 00000 n +0000410999 00000 n +0000411064 00000 n +0000411193 00000 n +0000411258 00000 n +0000411323 00000 n +0000411388 00000 n +0000415132 00000 n +0000414876 00000 n +0000411604 00000 n +0000415002 00000 n +0000415067 00000 n +0000418569 00000 n +0000418313 00000 n +0000415257 00000 n +0000418439 00000 n +0000418504 00000 n +0000421040 00000 n +0000420332 00000 n +0000418707 00000 n +0000420458 00000 n +0000420523 00000 n +0000420588 00000 n +0000420715 00000 n +0000420780 00000 n +0000420845 00000 n +0000420910 00000 n +0000420975 00000 n +0000423926 00000 n +0000423152 00000 n +0000421191 00000 n +0000423278 00000 n +0000423343 00000 n +0000423408 00000 n +0000423473 00000 n +0000423601 00000 n +0000423666 00000 n +0000423731 00000 n +0000423796 00000 n +0000423861 00000 n +0000427282 00000 n +0000427091 00000 n +0000424064 00000 n +0000427217 00000 n +0000648809 00000 n +0000430235 00000 n +0000429525 00000 n +0000427407 00000 n +0000429651 00000 n +0000429716 00000 n +0000429781 00000 n +0000429846 00000 n +0000429975 00000 n +0000430040 00000 n +0000430105 00000 n +0000430170 00000 n +0000433534 00000 n +0000433278 00000 n +0000430386 00000 n +0000433404 00000 n +0000433469 00000 n +0000436418 00000 n +0000436034 00000 n +0000433727 00000 n +0000436160 00000 n +0000436225 00000 n +0000436290 00000 n +0000436354 00000 n +0000439896 00000 n +0000439186 00000 n +0000436650 00000 n +0000439312 00000 n +0000439377 00000 n +0000439442 00000 n +0000439571 00000 n +0000439636 00000 n +0000439701 00000 n +0000439766 00000 n +0000439831 00000 n +0000443031 00000 n +0000442322 00000 n +0000440047 00000 n +0000442448 00000 n +0000442513 00000 n +0000442578 00000 n +0000442642 00000 n +0000442771 00000 n +0000442836 00000 n +0000442901 00000 n +0000442966 00000 n +0000446214 00000 n +0000445958 00000 n +0000443195 00000 n +0000446084 00000 n +0000446149 00000 n +0000648934 00000 n +0000448960 00000 n +0000448317 00000 n +0000446339 00000 n +0000448443 00000 n +0000448508 00000 n +0000448573 00000 n +0000448638 00000 n +0000448766 00000 n +0000448831 00000 n +0000448896 00000 n +0000452693 00000 n +0000452373 00000 n +0000449111 00000 n +0000452499 00000 n +0000452564 00000 n +0000452629 00000 n +0000454018 00000 n +0000453632 00000 n +0000452818 00000 n +0000453758 00000 n +0000453823 00000 n +0000453888 00000 n +0000453953 00000 n +0000454189 00000 n +0000465533 00000 n +0000467856 00000 n +0000467825 00000 n +0000477345 00000 n +0000487401 00000 n +0000497639 00000 n +0000509844 00000 n +0000527977 00000 n +0000550065 00000 n +0000571075 00000 n +0000588893 00000 n +0000591724 00000 n +0000591494 00000 n +0000618982 00000 n +0000646091 00000 n +0000649041 00000 n +0000649164 00000 n +0000649290 00000 n +0000649416 00000 n +0000649506 00000 n +0000649598 00000 n +0000664889 00000 n +0000682155 00000 n +0000682196 00000 n +0000682236 00000 n +0000682370 00000 n trailer << -/Size 1942 -/Root 1940 0 R -/Info 1941 0 R -/ID [<5A797B736A6352D32D8187FB72286FDE> <5A797B736A6352D32D8187FB72286FDE>] +/Size 1948 +/Root 1946 0 R +/Info 1947 0 R +/ID [<FC34A9E475CA4461718A60185182A60D> <FC34A9E475CA4461718A60185182A60D>] >> startxref -678911 +682634 %%EOF diff --git a/contrib/bind9/doc/arm/Makefile.in b/contrib/bind9/doc/arm/Makefile.in index 4d48169..85f318d 100644 --- a/contrib/bind9/doc/arm/Makefile.in +++ b/contrib/bind9/doc/arm/Makefile.in @@ -1,7 +1,7 @@ # Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 2001, 2002 Internet Software Consortium. # -# Permission to use, copy, modify, and distribute this software for any +# Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above # copyright notice and this permission notice appear in all copies. # @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: Makefile.in,v 1.12.18.7 2007/02/07 23:57:58 marka Exp $ +# $Id: Makefile.in,v 1.12.18.8 2007/08/28 07:20:03 tbox Exp $ srcdir = @srcdir@ VPATH = @srcdir@ diff --git a/contrib/bind9/doc/arm/man.dig.html b/contrib/bind9/doc/arm/man.dig.html index 4379f94..7d0e437 100644 --- a/contrib/bind9/doc/arm/man.dig.html +++ b/contrib/bind9/doc/arm/man.dig.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: man.dig.html,v 1.2.2.37.10.1 2007/07/09 02:25:53 marka Exp $ --> +<!-- $Id: man.dig.html,v 1.2.2.48 2007/10/31 01:35:59 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -52,7 +52,7 @@ <div class="cmdsynopsis"><p><code class="command">dig</code> [global-queryopt...] [query...]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2564026"></a><h2>DESCRIPTION</h2> +<a name="id2564025"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">dig</strong></span> (domain information groper) is a flexible tool for interrogating DNS name servers. It performs DNS lookups and @@ -68,7 +68,7 @@ arguments, it also has a batch mode of operation for reading lookup requests from a file. A brief summary of its command-line arguments and options is printed when the <code class="option">-h</code> option is given. - Unlike earlier versions, the BIND9 implementation of + Unlike earlier versions, the BIND 9 implementation of <span><strong class="command">dig</strong></span> allows multiple lookups to be issued from the command line. @@ -98,7 +98,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2575037"></a><h2>SIMPLE USAGE</h2> +<a name="id2569712"></a><h2>SIMPLE USAGE</h2> <p> A typical invocation of <span><strong class="command">dig</strong></span> looks like: </p> @@ -144,7 +144,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2575148"></a><h2>OPTIONS</h2> +<a name="id2623002"></a><h2>OPTIONS</h2> <p> The <code class="option">-b</code> option sets the source IP address of the query to <em class="parameter"><code>address</code></em>. This must be a valid @@ -157,7 +157,7 @@ The default query class (IN for internet) is overridden by the <code class="option">-c</code> option. <em class="parameter"><code>class</code></em> is any valid - class, such as HS for Hesiod records or CH for CHAOSNET records. + class, such as HS for Hesiod records or CH for Chaosnet records. </p> <p> The <code class="option">-f</code> option makes <span><strong class="command">dig </strong></span> @@ -165,7 +165,7 @@ in batch mode by reading a list of lookup requests to process from the file <em class="parameter"><code>filename</code></em>. The file contains a number of - queries, one per line. Each entry in the file should be organised in + queries, one per line. Each entry in the file should be organized in the same way they would be presented as queries to <span><strong class="command">dig</strong></span> using the command-line interface. </p> @@ -188,7 +188,7 @@ The <code class="option">-t</code> option sets the query type to <em class="parameter"><code>type</code></em>. It can be any valid query type which is - supported in BIND9. The default query type "A", unless the + supported in BIND 9. The default query type is "A", unless the <code class="option">-x</code> option is supplied to indicate a reverse lookup. A zone transfer can be requested by specifying a type of AXFR. When an incremental zone transfer (IXFR) is required, @@ -199,11 +199,11 @@ </p> <p> The <code class="option">-q</code> option sets the query name to - <em class="parameter"><code>name</code></em>. This useful do distingish the + <em class="parameter"><code>name</code></em>. This useful do distinguish the <em class="parameter"><code>name</code></em> from other arguments. </p> <p> - Reverse lookups - mapping addresses to names - are simplified by the + Reverse lookups — mapping addresses to names — are simplified by the <code class="option">-x</code> option. <em class="parameter"><code>addr</code></em> is an IPv4 address in dotted-decimal notation, or a colon-delimited IPv6 address. @@ -244,7 +244,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2649141"></a><h2>QUERY OPTIONS</h2> +<a name="id2649413"></a><h2>QUERY OPTIONS</h2> <p><span><strong class="command">dig</strong></span> provides a number of query options which affect the way in which lookups are made and the results displayed. Some of @@ -267,7 +267,7 @@ <dt><span class="term"><code class="option">+[no]tcp</code></span></dt> <dd><p> Use [do not use] TCP when querying name servers. The default - behaviour is to use UDP unless an AXFR or IXFR query is + behavior is to use UDP unless an AXFR or IXFR query is requested, in which case a TCP connection is used. </p></dd> @@ -380,7 +380,7 @@ </p></dd> <dt><span class="term"><code class="option">+[no]cmd</code></span></dt> <dd><p> - toggles the printing of the initial comment in the output + Toggles the printing of the initial comment in the output identifying the version of <span><strong class="command">dig</strong></span> and the query options that have @@ -412,7 +412,7 @@ This query option toggles the printing of statistics: when the query was made, the size of the reply and so on. The default - behaviour is + behavior is to print the query statistics. </p></dd> <dt><span class="term"><code class="option">+[no]qr</code></span></dt> @@ -451,8 +451,8 @@ <dd><p> Sets the timeout for a query to - <em class="parameter"><code>T</code></em> seconds. The default time - out is 5 seconds. + <em class="parameter"><code>T</code></em> seconds. The default + timeout is 5 seconds. An attempt to set <em class="parameter"><code>T</code></em> to less than 1 will result in a query timeout of 1 second being applied. @@ -517,7 +517,7 @@ default is to not try the next server which is the reverse of normal stub resolver - behaviour. + behavior. </p></dd> <dt><span class="term"><code class="option">+[no]besteffort</code></span></dt> <dd><p> @@ -553,7 +553,7 @@ </dd> <dt><span class="term"><code class="option">+[no]topdown</code></span></dt> <dd><p> - When chasing DNSSEC signature chains perform a top down + When chasing DNSSEC signature chains perform a top-down validation. Requires dig be compiled with -DDIG_SIGCHASE. </p></dd> @@ -563,7 +563,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2650059"></a><h2>MULTIPLE QUERIES</h2> +<a name="id2650468"></a><h2>MULTIPLE QUERIES</h2> <p> The BIND 9 implementation of <span><strong class="command">dig </strong></span> supports @@ -609,7 +609,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr </p> </div> <div class="refsect1" lang="en"> -<a name="id2650213"></a><h2>IDN SUPPORT</h2> +<a name="id2650553"></a><h2>IDN SUPPORT</h2> <p> If <span><strong class="command">dig</strong></span> has been built with IDN (internationalized domain name) support, it can accept and display non-ASCII domain names. @@ -623,14 +623,14 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr </p> </div> <div class="refsect1" lang="en"> -<a name="id2650242"></a><h2>FILES</h2> +<a name="id2650582"></a><h2>FILES</h2> <p><code class="filename">/etc/resolv.conf</code> </p> <p><code class="filename">${HOME}/.digrc</code> </p> </div> <div class="refsect1" lang="en"> -<a name="id2650263"></a><h2>SEE ALSO</h2> +<a name="id2650603"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">host</span>(1)</span>, <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>, @@ -638,7 +638,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr </p> </div> <div class="refsect1" lang="en"> -<a name="id2650300"></a><h2>BUGS</h2> +<a name="id2650641"></a><h2>BUGS</h2> <p> There are probably too many query options. </p> diff --git a/contrib/bind9/doc/arm/man.dnssec-keygen.html b/contrib/bind9/doc/arm/man.dnssec-keygen.html index 54780dc..3b8d2d8 100644 --- a/contrib/bind9/doc/arm/man.dnssec-keygen.html +++ b/contrib/bind9/doc/arm/man.dnssec-keygen.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: man.dnssec-keygen.html,v 1.2.2.37.10.1 2007/07/09 02:25:53 marka Exp $ --> +<!-- $Id: man.dnssec-keygen.html,v 1.2.2.47 2007/10/31 01:35:59 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -50,15 +50,15 @@ <div class="cmdsynopsis"><p><code class="command">dnssec-keygen</code> {-a <em class="replaceable"><code>algorithm</code></em>} {-b <em class="replaceable"><code>keysize</code></em>} {-n <em class="replaceable"><code>nametype</code></em>} [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-e</code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-g <em class="replaceable"><code>generator</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k</code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {name}</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2597558"></a><h2>DESCRIPTION</h2> +<a name="id2597830"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">dnssec-keygen</strong></span> generates keys for DNSSEC (Secure DNS), as defined in RFC 2535 - and RFC <TBA\>. It can also generate keys for use with + and RFC 4034. It can also generate keys for use with TSIG (Transaction Signatures), as defined in RFC 2845. </p> </div> <div class="refsect1" lang="en"> -<a name="id2597572"></a><h2>OPTIONS</h2> +<a name="id2597844"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt> <dd> @@ -166,7 +166,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2598052"></a><h2>GENERATED KEYS</h2> +<a name="id2598187"></a><h2>GENERATED KEYS</h2> <p> When <span><strong class="command">dnssec-keygen</strong></span> completes successfully, @@ -186,7 +186,7 @@ </p></li> </ul></div> <p><span><strong class="command">dnssec-keygen</strong></span> - creates two file, with names based + creates two files, with names based on the printed string. <code class="filename">Knnnn.+aaa+iiiii.key</code> contains the public key, and <code class="filename">Knnnn.+aaa+iiiii.private</code> contains the @@ -200,19 +200,19 @@ statement). </p> <p> - The <code class="filename">.private</code> file contains algorithm - specific + The <code class="filename">.private</code> file contains + algorithm-specific fields. For obvious security reasons, this file does not have general read permission. </p> <p> Both <code class="filename">.key</code> and <code class="filename">.private</code> - files are generated for symmetric encryption algorithm such as + files are generated for symmetric encryption algorithms such as HMAC-MD5, even though the public and private key are equivalent. </p> </div> <div class="refsect1" lang="en"> -<a name="id2598160"></a><h2>EXAMPLE</h2> +<a name="id2598295"></a><h2>EXAMPLE</h2> <p> To generate a 768-bit DSA key for the domain <strong class="userinput"><code>example.com</code></strong>, the following command would be @@ -229,11 +229,11 @@ In this example, <span><strong class="command">dnssec-keygen</strong></span> creates the files <code class="filename">Kexample.com.+003+26160.key</code> and - <code class="filename">Kexample.com.+003+26160.private</code> + <code class="filename">Kexample.com.+003+26160.private</code>. </p> </div> <div class="refsect1" lang="en"> -<a name="id2600196"></a><h2>SEE ALSO</h2> +<a name="id2600195"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>, <em class="citetitle">BIND 9 Administrator Reference Manual</em>, <em class="citetitle">RFC 2535</em>, @@ -242,7 +242,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2600227"></a><h2>AUTHOR</h2> +<a name="id2600226"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/contrib/bind9/doc/arm/man.dnssec-signzone.html b/contrib/bind9/doc/arm/man.dnssec-signzone.html index 6301421..2d0ce06 100644 --- a/contrib/bind9/doc/arm/man.dnssec-signzone.html +++ b/contrib/bind9/doc/arm/man.dnssec-signzone.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: man.dnssec-signzone.html,v 1.2.2.35.10.1 2007/07/09 02:25:53 marka Exp $ --> +<!-- $Id: man.dnssec-signzone.html,v 1.2.2.46 2007/10/31 01:35:59 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -50,7 +50,7 @@ <div class="cmdsynopsis"><p><code class="command">dnssec-signzone</code> [<code class="option">-a</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>] [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>] [<code class="option">-g</code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>key</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-j <em class="replaceable"><code>jitter</code></em></code>] [<code class="option">-N <em class="replaceable"><code>soa-serial-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>] [<code class="option">-p</code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-t</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-z</code>] {zonefile} [key...]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2598407"></a><h2>DESCRIPTION</h2> +<a name="id2598823"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">dnssec-signzone</strong></span> signs a zone. It generates NSEC and RRSIG records and produces a signed version of the @@ -61,7 +61,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2598426"></a><h2>OPTIONS</h2> +<a name="id2598842"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-a</span></dt> <dd><p> @@ -117,7 +117,7 @@ The name of the output file containing the signed zone. The default is to append <code class="filename">.signed</code> to the - input file. + input filename. </p></dd> <dt><span class="term">-h</span></dt> <dd><p> @@ -127,7 +127,7 @@ <dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt> <dd> <p> - When a previously signed zone is passed as input, records + When a previously-signed zone is passed as input, records may be resigned. The <code class="option">interval</code> option specifies the cycle interval as an offset from the current time (in seconds). If a RRSIG record expires after the @@ -163,8 +163,8 @@ When signing a zone with a fixed signature lifetime, all RRSIG records issued at the time of signing expires simultaneously. If the zone is incrementally signed, i.e. - a previously signed zone is passed as input to the signer, - all expired signatures has to be regenerated at about the + a previously-signed zone is passed as input to the signer, + all expired signatures have to be regenerated at about the same time. The <code class="option">jitter</code> option specifies a jitter window that will be used to randomize the signature expire time, thus spreading incremental signature @@ -250,47 +250,52 @@ </p></dd> <dt><span class="term">key</span></dt> <dd><p> - The keys used to sign the zone. If no keys are specified, the - default all zone keys that have private key files in the - current directory. + Specify which keys should be used to sign the zone. If + no keys are specified, then the zone will be examined + for DNSKEY records at the zone apex. If these are found and + there are matching private keys, in the current directory, + then these will be used for signing. </p></dd> </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2622323"></a><h2>EXAMPLE</h2> +<a name="id2641307"></a><h2>EXAMPLE</h2> <p> The following command signs the <strong class="userinput"><code>example.com</code></strong> - zone with the DSA key generated in the <span><strong class="command">dnssec-keygen</strong></span> - man page. The zone's keys must be in the zone. If there are - <code class="filename">keyset</code> files associated with child - zones, - they must be in the current directory. - <strong class="userinput"><code>example.com</code></strong>, the following command would be - issued: - </p> -<p><strong class="userinput"><code>dnssec-signzone -o example.com db.example.com - Kexample.com.+003+26160</code></strong> - </p> -<p> - The command would print a string of the form: + zone with the DSA key generated by <span><strong class="command">dnssec-keygen</strong></span> + (Kexample.com.+003+17247). The zone's keys must be in the master + file (<code class="filename">db.example.com</code>). This invocation looks + for <code class="filename">keyset</code> files, in the current directory, + so that DS records can be generated from them (<span><strong class="command">-g</strong></span>). </p> +<pre class="programlisting">% dnssec-signzone -g -o example.com db.example.com \ +Kexample.com.+003+17247 +db.example.com.signed +%</pre> <p> - In this example, <span><strong class="command">dnssec-signzone</strong></span> creates + In the above example, <span><strong class="command">dnssec-signzone</strong></span> creates the file <code class="filename">db.example.com.signed</code>. This - file - should be referenced in a zone statement in a + file should be referenced in a zone statement in a <code class="filename">named.conf</code> file. </p> +<p> + This example re-signs a previously signed zone with default parameters. + The private keys are assumed to be in the current directory. + </p> +<pre class="programlisting">% cp db.example.com.signed db.example.com +% dnssec-signzone -o example.com db.example.com +db.example.com.signed +%</pre> </div> <div class="refsect1" lang="en"> -<a name="id2641229"></a><h2>SEE ALSO</h2> +<a name="id2641380"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>, <em class="citetitle">BIND 9 Administrator Reference Manual</em>, <em class="citetitle">RFC 2535</em>. </p> </div> <div class="refsect1" lang="en"> -<a name="id2652723"></a><h2>AUTHOR</h2> +<a name="id2641404"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/contrib/bind9/doc/arm/man.host.html b/contrib/bind9/doc/arm/man.host.html index a06a150..6bc2188 100644 --- a/contrib/bind9/doc/arm/man.host.html +++ b/contrib/bind9/doc/arm/man.host.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: man.host.html,v 1.2.2.36.10.1 2007/07/09 02:25:53 marka Exp $ --> +<!-- $Id: man.host.html,v 1.2.2.46 2007/10/31 01:35:59 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -50,7 +50,7 @@ <div class="cmdsynopsis"><p><code class="command">host</code> [<code class="option">-aCdlnrsTwv</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-N <em class="replaceable"><code>ndots</code></em></code>] [<code class="option">-R <em class="replaceable"><code>number</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-W <em class="replaceable"><code>wait</code></em></code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-4</code>] [<code class="option">-6</code>] {name} [server]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2596661"></a><h2>DESCRIPTION</h2> +<a name="id2597000"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">host</strong></span> is a simple utility for performing DNS lookups. It is normally used to convert names to IP addresses and vice versa. @@ -143,7 +143,7 @@ attempt to resolve <em class="parameter"><code>name</code></em>. The <code class="option">-r</code> option enables <span><strong class="command">host</strong></span> to mimic - the behaviour of a name server by making non-recursive queries and + the behavior of a name server by making non-recursive queries and expecting to receive answers to those queries that are usually referrals to other name servers. </p> @@ -161,7 +161,7 @@ </p> <p> The <code class="option">-t</code> option is used to select the query type. - <em class="parameter"><code>type</code></em> can be any recognised query + <em class="parameter"><code>type</code></em> can be any recognized query type: CNAME, NS, SOA, SIG, KEY, AXFR, etc. When no query type is specified, <span><strong class="command">host</strong></span> automatically selects an appropriate @@ -192,7 +192,7 @@ The <code class="option">-s</code> option tells <span><strong class="command">host</strong></span> <span class="emphasis"><em>not</em></span> to send the query to the next nameserver if any server responds with a SERVFAIL response, which is the - reverse of normal stub resolver behaviour. + reverse of normal stub resolver behavior. </p> <p> The <code class="option">-m</code> can be used to set the memory usage debugging @@ -202,7 +202,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2597312"></a><h2>IDN SUPPORT</h2> +<a name="id2597514"></a><h2>IDN SUPPORT</h2> <p> If <span><strong class="command">host</strong></span> has been built with IDN (internationalized domain name) support, it can accept and display non-ASCII domain names. @@ -216,12 +216,12 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2597340"></a><h2>FILES</h2> +<a name="id2597543"></a><h2>FILES</h2> <p><code class="filename">/etc/resolv.conf</code> </p> </div> <div class="refsect1" lang="en"> -<a name="id2599061"></a><h2>SEE ALSO</h2> +<a name="id2597557"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>, <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>. </p> diff --git a/contrib/bind9/doc/arm/man.named-checkconf.html b/contrib/bind9/doc/arm/man.named-checkconf.html index d298922..7db5021 100644 --- a/contrib/bind9/doc/arm/man.named-checkconf.html +++ b/contrib/bind9/doc/arm/man.named-checkconf.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: man.named-checkconf.html,v 1.2.2.38.10.1 2007/07/09 02:25:53 marka Exp $ --> +<!-- $Id: man.named-checkconf.html,v 1.2.2.49 2007/10/31 01:35:59 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -50,18 +50,18 @@ <div class="cmdsynopsis"><p><code class="command">named-checkconf</code> [<code class="option">-v</code>] [<code class="option">-j</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] {filename} [<code class="option">-z</code>]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2599724"></a><h2>DESCRIPTION</h2> +<a name="id2599604"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">named-checkconf</strong></span> checks the syntax, but not the semantics, of a named configuration file. </p> </div> <div class="refsect1" lang="en"> -<a name="id2599738"></a><h2>OPTIONS</h2> +<a name="id2599618"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt> <dd><p> - chroot to <code class="filename">directory</code> so that + Chroot to <code class="filename">directory</code> so that include directives in the configuration file are processed as if run by a similarly chrooted named. @@ -73,8 +73,8 @@ </p></dd> <dt><span class="term">-z</span></dt> <dd><p> - Perform a check load the master zonefiles found in - <code class="filename">named.conf</code>. + Perform a test load of all master zones found in + <code class="filename">named.conf</code>. </p></dd> <dt><span class="term">-j</span></dt> <dd><p> @@ -88,20 +88,21 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2599840"></a><h2>RETURN VALUES</h2> +<a name="id2599720"></a><h2>RETURN VALUES</h2> <p><span><strong class="command">named-checkconf</strong></span> returns an exit status of 1 if errors were detected and 0 otherwise. </p> </div> <div class="refsect1" lang="en"> -<a name="id2599853"></a><h2>SEE ALSO</h2> +<a name="id2599734"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, + <span class="citerefentry"><span class="refentrytitle">named-checkzone</span>(8)</span>, <em class="citetitle">BIND 9 Administrator Reference Manual</em>. </p> </div> <div class="refsect1" lang="en"> -<a name="id2599875"></a><h2>AUTHOR</h2> +<a name="id2599764"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/contrib/bind9/doc/arm/man.named-checkzone.html b/contrib/bind9/doc/arm/man.named-checkzone.html index 5496941..93e17ec 100644 --- a/contrib/bind9/doc/arm/man.named-checkzone.html +++ b/contrib/bind9/doc/arm/man.named-checkzone.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: man.named-checkzone.html,v 1.2.2.40.10.1 2007/07/09 02:25:53 marka Exp $ --> +<!-- $Id: man.named-checkzone.html,v 1.2.2.52 2007/10/31 01:35:59 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -51,7 +51,7 @@ <div class="cmdsynopsis"><p><code class="command">named-compilezone</code> [<code class="option">-d</code>] [<code class="option">-j</code>] [<code class="option">-q</code>] [<code class="option">-v</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-C <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-f <em class="replaceable"><code>format</code></em></code>] [<code class="option">-F <em class="replaceable"><code>format</code></em></code>] [<code class="option">-i <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-k <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-m <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-n <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-o <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-s <em class="replaceable"><code>style</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-w <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-W <em class="replaceable"><code>mode</code></em></code>] {zonename} {filename}</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2601347"></a><h2>DESCRIPTION</h2> +<a name="id2600689"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">named-checkzone</strong></span> checks the syntax and integrity of a zone file. It performs the same checks as <span><strong class="command">named</strong></span> does when loading a @@ -65,13 +65,13 @@ Additionally, it applies stricter check levels by default, since the dump output will be used as an actual zone file loaded by <span><strong class="command">named</strong></span>. - When manaully specified otherwise, the check levels must at + When manually specified otherwise, the check levels must at least be as strict as those specified in the <span><strong class="command">named</strong></span> configuration file. </p> </div> <div class="refsect1" lang="en"> -<a name="id2601397"></a><h2>OPTIONS</h2> +<a name="id2600739"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-d</span></dt> <dd><p> @@ -97,7 +97,7 @@ <dt><span class="term">-i <em class="replaceable"><code>mode</code></em></span></dt> <dd> <p> - Perform post load zone integrity checks. Possible modes are + Perform post-load zone integrity checks. Possible modes are <span><strong class="command">"full"</strong></span> (default), <span><strong class="command">"full-sibling"</strong></span>, <span><strong class="command">"local"</strong></span>, @@ -119,7 +119,7 @@ <p> Mode <span><strong class="command">"full"</strong></span> checks that delegation NS records refer to A or AAAA record (both in-zone and out-of-zone - hostnames). It also checks that glue addresses records + hostnames). It also checks that glue address records in the zone match those advertised by the child. Mode <span><strong class="command">"local"</strong></span> only checks NS records which refer to in-zone hostnames or that some required glue exists, @@ -213,7 +213,7 @@ </p></dd> <dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt> <dd><p> - chroot to <code class="filename">directory</code> so that + Chroot to <code class="filename">directory</code> so that include directives in the configuration file are processed as if run by a similarly chrooted named. @@ -251,21 +251,22 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2654948"></a><h2>RETURN VALUES</h2> +<a name="id2655177"></a><h2>RETURN VALUES</h2> <p><span><strong class="command">named-checkzone</strong></span> returns an exit status of 1 if errors were detected and 0 otherwise. </p> </div> <div class="refsect1" lang="en"> -<a name="id2654962"></a><h2>SEE ALSO</h2> +<a name="id2655191"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, + <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>, <em class="citetitle">RFC 1035</em>, <em class="citetitle">BIND 9 Administrator Reference Manual</em>. </p> </div> <div class="refsect1" lang="en"> -<a name="id2654986"></a><h2>AUTHOR</h2> +<a name="id2655224"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/contrib/bind9/doc/arm/man.named.html b/contrib/bind9/doc/arm/man.named.html index 42937c6..70539b4 100644 --- a/contrib/bind9/doc/arm/man.named.html +++ b/contrib/bind9/doc/arm/man.named.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: man.named.html,v 1.2.2.43.10.1 2007/07/09 02:25:53 marka Exp $ --> +<!-- $Id: man.named.html,v 1.2.2.53 2007/10/31 01:35:59 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -47,10 +47,10 @@ </div> <div class="refsynopsisdiv"> <h2>Synopsis</h2> -<div class="cmdsynopsis"><p><code class="command">named</code> [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div> +<div class="cmdsynopsis"><p><code class="command">named</code> [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2601554"></a><h2>DESCRIPTION</h2> +<a name="id2601798"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">named</strong></span> is a Domain Name System (DNS) server, part of the BIND 9 distribution from ISC. For more @@ -65,7 +65,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2601585"></a><h2>OPTIONS</h2> +<a name="id2601829"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-4</span></dt> <dd><p> @@ -106,6 +106,17 @@ Run the server in the foreground and force all logging to <code class="filename">stderr</code>. </p></dd> +<dt><span class="term">-m <em class="replaceable"><code>flag</code></em></span></dt> +<dd><p> + Turn on memory usage debugging flags. Possible flags are + <em class="replaceable"><code>usage</code></em>, + <em class="replaceable"><code>trace</code></em>, + <em class="replaceable"><code>record</code></em>, + <em class="replaceable"><code>size</code></em>, and + <em class="replaceable"><code>mctx</code></em>. + These correspond to the ISC_MEM_DEBUGXXXX flags described in + <code class="filename"><isc/mem.h></code>. + </p></dd> <dt><span class="term">-n <em class="replaceable"><code>#cpus</code></em></span></dt> <dd><p> Create <em class="replaceable"><code>#cpus</code></em> worker threads @@ -135,7 +146,7 @@ </dd> <dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt> <dd> -<p><code class="function">chroot()</code> +<p>Chroot to <em class="replaceable"><code>directory</code></em> after processing the command line arguments, but before reading the configuration file. @@ -146,7 +157,7 @@ This option should be used in conjunction with the <code class="option">-u</code> option, as chrooting a process running as root doesn't enhance security on most - systems; the way <code class="function">chroot()</code> is + systems; the way <code class="function">chroot(2)</code> is defined allows a process with root privileges to escape a chroot jail. </p> @@ -154,7 +165,7 @@ </dd> <dt><span class="term">-u <em class="replaceable"><code>user</code></em></span></dt> <dd> -<p><code class="function">setuid()</code> +<p>Setuid to <em class="replaceable"><code>user</code></em> after completing privileged operations, such as creating sockets that listen on privileged ports. @@ -164,7 +175,7 @@ <p> On Linux, <span><strong class="command">named</strong></span> uses the kernel's capability mechanism to drop all root privileges - except the ability to <code class="function">bind()</code> to + except the ability to <code class="function">bind(2)</code> to a privileged port and set process resource limits. Unfortunately, this means that the <code class="option">-u</code> @@ -172,7 +183,7 @@ run on kernel 2.2.18 or later, or kernel 2.3.99-pre3 or later, since previous kernels did not allow privileges - to be retained after <code class="function">setuid()</code>. + to be retained after <code class="function">setuid(2)</code>. </p> </div> </dd> @@ -198,7 +209,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2602364"></a><h2>SIGNALS</h2> +<a name="id2604492"></a><h2>SIGNALS</h2> <p> In routine operation, signals should not be used to control the nameserver; <span><strong class="command">rndc</strong></span> should be used @@ -219,7 +230,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2602414"></a><h2>CONFIGURATION</h2> +<a name="id2604542"></a><h2>CONFIGURATION</h2> <p> The <span><strong class="command">named</strong></span> configuration file is too complex to describe in detail here. A complete description is provided @@ -228,7 +239,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2602434"></a><h2>FILES</h2> +<a name="id2604562"></a><h2>FILES</h2> <div class="variablelist"><dl> <dt><span class="term"><code class="filename">/etc/named.conf</code></span></dt> <dd><p> @@ -241,10 +252,12 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2603911"></a><h2>SEE ALSO</h2> +<a name="id2604605"></a><h2>SEE ALSO</h2> <p><em class="citetitle">RFC 1033</em>, <em class="citetitle">RFC 1034</em>, <em class="citetitle">RFC 1035</em>, + <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>, + <span class="citerefentry"><span class="refentrytitle">named-checkzone</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">lwresd</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>, @@ -252,7 +265,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2603962"></a><h2>AUTHOR</h2> +<a name="id2604881"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/contrib/bind9/doc/arm/man.rndc-confgen.html b/contrib/bind9/doc/arm/man.rndc-confgen.html index 7e730a7..056bcbd 100644 --- a/contrib/bind9/doc/arm/man.rndc-confgen.html +++ b/contrib/bind9/doc/arm/man.rndc-confgen.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: man.rndc-confgen.html,v 1.2.2.44.10.1 2007/07/09 02:25:53 marka Exp $ --> +<!-- $Id: man.rndc-confgen.html,v 1.2.2.55 2007/10/31 01:35:59 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -48,7 +48,7 @@ <div class="cmdsynopsis"><p><code class="command">rndc-confgen</code> [<code class="option">-a</code>] [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>] [<code class="option">-c <em class="replaceable"><code>keyfile</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>keyname</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomfile</code></em></code>] [<code class="option">-s <em class="replaceable"><code>address</code></em></code>] [<code class="option">-t <em class="replaceable"><code>chrootdir</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2603716"></a><h2>DESCRIPTION</h2> +<a name="id2605524"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">rndc-confgen</strong></span> generates configuration files for <span><strong class="command">rndc</strong></span>. It can be used as a @@ -64,7 +64,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2604055"></a><h2>OPTIONS</h2> +<a name="id2605590"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-a</span></dt> <dd> @@ -171,7 +171,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2606557"></a><h2>EXAMPLES</h2> +<a name="id2606454"></a><h2>EXAMPLES</h2> <p> To allow <span><strong class="command">rndc</strong></span> to be used with no manual configuration, run @@ -188,7 +188,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2606614"></a><h2>SEE ALSO</h2> +<a name="id2609036"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>, <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, @@ -196,7 +196,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2606652"></a><h2>AUTHOR</h2> +<a name="id2609075"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/contrib/bind9/doc/arm/man.rndc.conf.html b/contrib/bind9/doc/arm/man.rndc.conf.html index 8e0d82d..4e8154c 100644 --- a/contrib/bind9/doc/arm/man.rndc.conf.html +++ b/contrib/bind9/doc/arm/man.rndc.conf.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: man.rndc.conf.html,v 1.2.2.43.10.1 2007/07/09 02:25:53 marka Exp $ --> +<!-- $Id: man.rndc.conf.html,v 1.2.2.55 2007/10/31 01:35:59 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -50,7 +50,7 @@ <div class="cmdsynopsis"><p><code class="command">rndc.conf</code> </p></div> </div> <div class="refsect1" lang="en"> -<a name="id2599206"></a><h2>DESCRIPTION</h2> +<a name="id2603676"></a><h2>DESCRIPTION</h2> <p><code class="filename">rndc.conf</code> is the configuration file for <span><strong class="command">rndc</strong></span>, the BIND 9 name server control utility. This file has a similar structure and syntax to @@ -105,7 +105,7 @@ name of a key statement in the file. The port number specifies the port to connect to. If an <code class="option">addresses</code> clause is supplied these addresses will be used instead of - the server name. Each address can take a optional port. + the server name. Each address can take an optional port. If an <code class="option">source-address</code> or <code class="option">source-address-v6</code> of supplied then these will be used to specify the IPv4 and IPv6 source addresses respectively. @@ -135,7 +135,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2603201"></a><h2>EXAMPLE</h2> +<a name="id2604121"></a><h2>EXAMPLE</h2> <pre class="programlisting"> options { default-server localhost; @@ -171,7 +171,7 @@ key testkey { algorithm hmac-md5; secret "R3HI8P6BKw9ZwXwN3VZKuQ=="; - } + }; </pre> <p> </p> @@ -198,7 +198,7 @@ A complete <code class="filename">rndc.conf</code> file, including the randomly generated key, will be written to the standard - output. Commented out <code class="option">key</code> and + output. Commented-out <code class="option">key</code> and <code class="option">controls</code> statements for <code class="filename">named.conf</code> are also printed. </p> @@ -209,7 +209,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2603459"></a><h2>NAME SERVER CONFIGURATION</h2> +<a name="id2604994"></a><h2>NAME SERVER CONFIGURATION</h2> <p> The name server must be configured to accept rndc connections and to recognize the key specified in the <code class="filename">rndc.conf</code> @@ -219,7 +219,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2603484"></a><h2>SEE ALSO</h2> +<a name="id2605019"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">mmencode</span>(1)</span>, @@ -227,7 +227,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2603523"></a><h2>AUTHOR</h2> +<a name="id2605058"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/contrib/bind9/doc/arm/man.rndc.html b/contrib/bind9/doc/arm/man.rndc.html index 41fb7d7..96ed547 100644 --- a/contrib/bind9/doc/arm/man.rndc.html +++ b/contrib/bind9/doc/arm/man.rndc.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: man.rndc.html,v 1.2.2.42.10.1 2007/07/09 02:25:53 marka Exp $ --> +<!-- $Id: man.rndc.html,v 1.2.2.54 2007/10/31 01:35:59 marka Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -50,7 +50,7 @@ <div class="cmdsynopsis"><p><code class="command">rndc</code> [<code class="option">-b <em class="replaceable"><code>source-address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key-file</code></em></code>] [<code class="option">-s <em class="replaceable"><code>server</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-V</code>] [<code class="option">-y <em class="replaceable"><code>key_id</code></em></code>] {command}</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2602522"></a><h2>DESCRIPTION</h2> +<a name="id2603169"></a><h2>DESCRIPTION</h2> <p><span><strong class="command">rndc</strong></span> controls the operation of a name server. It supersedes the <span><strong class="command">ndc</strong></span> utility @@ -64,7 +64,7 @@ communicates with the name server over a TCP connection, sending commands authenticated with digital signatures. In the current versions of - <span><strong class="command">rndc</strong></span> and <span><strong class="command">named</strong></span> named + <span><strong class="command">rndc</strong></span> and <span><strong class="command">named</strong></span>, the only supported authentication algorithm is HMAC-MD5, which uses a shared secret on each end of the connection. This provides TSIG-style authentication for the command @@ -79,7 +79,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2602572"></a><h2>OPTIONS</h2> +<a name="id2603219"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-b <em class="replaceable"><code>source-address</code></em></span></dt> <dd><p> @@ -106,13 +106,12 @@ </p></dd> <dt><span class="term">-s <em class="replaceable"><code>server</code></em></span></dt> <dd><p><em class="replaceable"><code>server</code></em> is - the name or address of the server which matches a + the name or address of the server which matches a server statement in the configuration file for - <span><strong class="command">rndc</strong></span>. If no server is supplied on - the + <span><strong class="command">rndc</strong></span>. If no server is supplied on the command line, the host named by the default-server clause - in the option statement of the configuration file will be - used. + in the options statement of the <span><strong class="command">rndc</strong></span> + configuration file will be used. </p></dd> <dt><span class="term">-p <em class="replaceable"><code>port</code></em></span></dt> <dd><p> @@ -125,15 +124,15 @@ <dd><p> Enable verbose logging. </p></dd> -<dt><span class="term">-y <em class="replaceable"><code>keyid</code></em></span></dt> +<dt><span class="term">-y <em class="replaceable"><code>key_id</code></em></span></dt> <dd><p> - Use the key <em class="replaceable"><code>keyid</code></em> + Use the key <em class="replaceable"><code>key_id</code></em> from the configuration file. - <em class="replaceable"><code>keyid</code></em> + <em class="replaceable"><code>key_id</code></em> must be known by named with the same algorithm and secret string in order for control message validation to succeed. - If no <em class="replaceable"><code>keyid</code></em> + If no <em class="replaceable"><code>key_id</code></em> is specified, <span><strong class="command">rndc</strong></span> will first look for a key clause in the server statement of the server being used, or if no server statement is present for that @@ -152,7 +151,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2602928"></a><h2>LIMITATIONS</h2> +<a name="id2603512"></a><h2>LIMITATIONS</h2> <p><span><strong class="command">rndc</strong></span> does not yet support all the commands of the BIND 8 <span><strong class="command">ndc</strong></span> utility. @@ -166,16 +165,16 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2602958"></a><h2>SEE ALSO</h2> +<a name="id2603543"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>, <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, - <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span> + <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>, <span class="citerefentry"><span class="refentrytitle">ndc</span>(8)</span>, <em class="citetitle">BIND 9 Administrator Reference Manual</em>. </p> </div> <div class="refsect1" lang="en"> -<a name="id2603005"></a><h2>AUTHOR</h2> +<a name="id2603590"></a><h2>AUTHOR</h2> <p><span class="corpauthor">Internet Systems Consortium</span> </p> </div> diff --git a/contrib/bind9/doc/misc/Makefile.in b/contrib/bind9/doc/misc/Makefile.in index 4251994..40a62fe 100644 --- a/contrib/bind9/doc/misc/Makefile.in +++ b/contrib/bind9/doc/misc/Makefile.in @@ -1,7 +1,7 @@ # Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 2001 Internet Software Consortium. # -# Permission to use, copy, modify, and distribute this software for any +# Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above # copyright notice and this permission notice appear in all copies. # @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: Makefile.in,v 1.3.18.2 2007/01/30 23:52:53 marka Exp $ +# $Id: Makefile.in,v 1.3.18.3 2007/08/28 07:20:03 tbox Exp $ srcdir = @srcdir@ VPATH = @srcdir@ diff --git a/contrib/bind9/doc/misc/migration b/contrib/bind9/doc/misc/migration index 6660e8f..b48371b 100644 --- a/contrib/bind9/doc/misc/migration +++ b/contrib/bind9/doc/misc/migration @@ -1,4 +1,4 @@ -Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") +Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") Copyright (C) 2000, 2001, 2003 Internet Software Consortium. See COPYRIGHT in the source root or http://isc.org/copyright.html for terms. @@ -134,9 +134,8 @@ characters. 3.1. EDNS0 BIND 9 uses EDNS0 (RFC2671) to advertise its receive buffer size. It -also sets an EDNS flag bit in queries to indicate that it wishes to -receive DNSSEC responses; this flag bit usage is not yet standardised, -but we hope it will be. +also sets DO EDNS flag bit in queries to indicate that it wishes to +receive DNSSEC responses. Most older servers that do not support EDNS0, including prior versions of BIND, will send a FORMERR or NOTIMP response to these queries. @@ -173,6 +172,8 @@ http://support.microsoft.com/default.aspx?scid=kb;en-us;297936 4. Unrestricted Character Set + BIND 9.2 only + BIND 9 does not restrict the character set of domain names - it is fully 8-bit clean in accordance with RFC2181 section 11. @@ -192,6 +193,7 @@ no-check-names" in resolv.conf. BIND 9 provides no such protection; if applications with these flaws are still being used, they should be upgraded. + BIND 9.3 onwards implements check-names. 5. Server Administration Tools @@ -252,4 +254,4 @@ necessary, the umask should be set explicitly in the script used to start the named process. -$Id: migration,v 1.45.18.1 2004/11/22 22:32:19 marka Exp $ +$Id: migration,v 1.45.18.2 2007/09/07 06:34:21 marka Exp $ diff --git a/contrib/bind9/doc/rfc/index b/contrib/bind9/doc/rfc/index index 947827e..990d4a9 100644 --- a/contrib/bind9/doc/rfc/index +++ b/contrib/bind9/doc/rfc/index @@ -105,4 +105,10 @@ 4255: Using DNS to Securely Publish Secure Shell (SSH) Key Fingerprints 4343: Domain Name System (DNS) Case Insensitivity Clarification 4367: What's in a Name: False Assumptions about DNS Names +4398: Storing Certificates in the Domain Name System (DNS) 4431: The DNSSEC Lookaside Validation (DLV) DNS Resource Record +4408: Sender Policy Framework (SPF) for Authorizing Use of Domains + in E-Mail, Version 1 +4470: Minimally Covering NSEC Records and DNSSEC On-line Signing +4634: US Secure Hash Algorithms (SHA and HMAC-SHA) +4641: DNSSEC Operational Practices diff --git a/contrib/bind9/doc/rfc/rfc4398.txt b/contrib/bind9/doc/rfc/rfc4398.txt new file mode 100644 index 0000000..6437436 --- /dev/null +++ b/contrib/bind9/doc/rfc/rfc4398.txt @@ -0,0 +1,955 @@ + + + + + + +Network Working Group S. Josefsson +Request for Comments: 4398 March 2006 +Obsoletes: 2538 +Category: Standards Track + + + Storing Certificates in the Domain Name System (DNS) + +Status of This Memo + + This document specifies an Internet standards track protocol for the + Internet community, and requests discussion and suggestions for + improvements. Please refer to the current edition of the "Internet + Official Protocol Standards" (STD 1) for the standardization state + and status of this protocol. Distribution of this memo is unlimited. + +Copyright Notice + + Copyright (C) The Internet Society (2006). + +Abstract + + Cryptographic public keys are frequently published, and their + authenticity is demonstrated by certificates. A CERT resource record + (RR) is defined so that such certificates and related certificate + revocation lists can be stored in the Domain Name System (DNS). + + This document obsoletes RFC 2538. + + + + + + + + + + + + + + + + + + + + + + + +Josefsson Standards Track [Page 1] + +RFC 4398 Storing Certificates in the DNS February 2006 + + +Table of Contents + + 1. Introduction ....................................................3 + 2. The CERT Resource Record ........................................3 + 2.1. Certificate Type Values ....................................4 + 2.2. Text Representation of CERT RRs ............................6 + 2.3. X.509 OIDs .................................................6 + 3. Appropriate Owner Names for CERT RRs ............................7 + 3.1. Content-Based X.509 CERT RR Names ..........................8 + 3.2. Purpose-Based X.509 CERT RR Names ..........................9 + 3.3. Content-Based OpenPGP CERT RR Names ........................9 + 3.4. Purpose-Based OpenPGP CERT RR Names .......................10 + 3.5. Owner Names for IPKIX, ISPKI, IPGP, and IACPKIX ...........10 + 4. Performance Considerations .....................................11 + 5. Contributors ...................................................11 + 6. Acknowledgements ...............................................11 + 7. Security Considerations ........................................12 + 8. IANA Considerations ............................................12 + 9. Changes since RFC 2538 .........................................13 + 10. References ....................................................14 + 10.1. Normative References .....................................14 + 10.2. Informative References ...................................15 + Appendix A. Copying Conditions ...................................16 + + + + + + + + + + + + + + + + + + + + + + + + + + + + +Josefsson Standards Track [Page 2] + +RFC 4398 Storing Certificates in the DNS February 2006 + + +1. Introduction + + Public keys are frequently published in the form of a certificate, + and their authenticity is commonly demonstrated by certificates and + related certificate revocation lists (CRLs). A certificate is a + binding, through a cryptographic digital signature, of a public key, + a validity interval and/or conditions, and identity, authorization, + or other information. A certificate revocation list is a list of + certificates that are revoked, and of incidental information, all + signed by the signer (issuer) of the revoked certificates. Examples + are X.509 certificates/CRLs in the X.500 directory system or OpenPGP + certificates/revocations used by OpenPGP software. + + Section 2 specifies a CERT resource record (RR) for the storage of + certificates in the Domain Name System [1] [2]. + + Section 3 discusses appropriate owner names for CERT RRs. + + Sections 4, 7, and 8 cover performance, security, and IANA + considerations, respectively. + + Section 9 explains the changes in this document compared to RFC 2538. + + The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", + "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this + document are to be interpreted as described in [3]. + +2. The CERT Resource Record + + The CERT resource record (RR) has the structure given below. Its RR + type code is 37. + + 1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3 + 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + | type | key tag | + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + | algorithm | / + +---------------+ certificate or CRL / + / / + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-| + + The type field is the certificate type as defined in Section 2.1 + below. + + The key tag field is the 16-bit value computed for the key embedded + in the certificate, using the RRSIG Key Tag algorithm described in + Appendix B of [12]. This field is used as an efficiency measure to + + + +Josefsson Standards Track [Page 3] + +RFC 4398 Storing Certificates in the DNS February 2006 + + + pick which CERT RRs may be applicable to a particular key. The key + tag can be calculated for the key in question, and then only CERT RRs + with the same key tag need to be examined. Note that two different + keys can have the same key tag. However, the key MUST be transformed + to the format it would have as the public key portion of a DNSKEY RR + before the key tag is computed. This is only possible if the key is + applicable to an algorithm and complies to limits (such as key size) + defined for DNS security. If it is not, the algorithm field MUST be + zero and the tag field is meaningless and SHOULD be zero. + + The algorithm field has the same meaning as the algorithm field in + DNSKEY and RRSIG RRs [12], except that a zero algorithm field + indicates that the algorithm is unknown to a secure DNS, which may + simply be the result of the algorithm not having been standardized + for DNSSEC [11]. + +2.1. Certificate Type Values + + The following values are defined or reserved: + + Value Mnemonic Certificate Type + ----- -------- ---------------- + 0 Reserved + 1 PKIX X.509 as per PKIX + 2 SPKI SPKI certificate + 3 PGP OpenPGP packet + 4 IPKIX The URL of an X.509 data object + 5 ISPKI The URL of an SPKI certificate + 6 IPGP The fingerprint and URL of an OpenPGP packet + 7 ACPKIX Attribute Certificate + 8 IACPKIX The URL of an Attribute Certificate + 9-252 Available for IANA assignment + 253 URI URI private + 254 OID OID private + 255 Reserved + 256-65279 Available for IANA assignment + 65280-65534 Experimental + 65535 Reserved + + These values represent the initial content of the IANA registry; see + Section 8. + + The PKIX type is reserved to indicate an X.509 certificate conforming + to the profile defined by the IETF PKIX working group [8]. The + certificate section will start with a one-octet unsigned OID length + and then an X.500 OID indicating the nature of the remainder of the + + + + + +Josefsson Standards Track [Page 4] + +RFC 4398 Storing Certificates in the DNS February 2006 + + + certificate section (see Section 2.3, below). (NOTE: X.509 + certificates do not include their X.500 directory-type-designating + OID as a prefix.) + + The SPKI and ISPKI types are reserved to indicate the SPKI + certificate format [15], for use when the SPKI documents are moved + from experimental status. The format for these two CERT RR types + will need to be specified later. + + The PGP type indicates an OpenPGP packet as described in [5] and its + extensions and successors. This is used to transfer public key + material and revocation signatures. The data is binary and MUST NOT + be encoded into an ASCII armor. An implementation SHOULD process + transferable public keys as described in Section 10.1 of [5], but it + MAY handle additional OpenPGP packets. + + The ACPKIX type indicates an Attribute Certificate format [9]. + + The IPKIX and IACPKIX types indicate a URL that will serve the + content that would have been in the "certificate, CRL, or URL" field + of the corresponding type (PKIX or ACPKIX, respectively). + + The IPGP type contains both an OpenPGP fingerprint for the key in + question, as well as a URL. The certificate portion of the IPGP CERT + RR is defined as a one-octet fingerprint length, followed by the + OpenPGP fingerprint, followed by the URL. The OpenPGP fingerprint is + calculated as defined in RFC 2440 [5]. A zero-length fingerprint or + a zero-length URL are legal, and indicate URL-only IPGP data or + fingerprint-only IPGP data, respectively. A zero-length fingerprint + and a zero-length URL are meaningless and invalid. + + The IPKIX, ISPKI, IPGP, and IACPKIX types are known as "indirect". + These types MUST be used when the content is too large to fit in the + CERT RR and MAY be used at the implementer's discretion. They SHOULD + NOT be used where the DNS message is 512 octets or smaller and could + thus be expected to fit a UDP packet. + + The URI private type indicates a certificate format defined by an + absolute URI. The certificate portion of the CERT RR MUST begin with + a null-terminated URI [10], and the data after the null is the + private format certificate itself. The URI SHOULD be such that a + retrieval from it will lead to documentation on the format of the + certificate. Recognition of private certificate types need not be + based on URI equality but can use various forms of pattern matching + so that, for example, subtype or version information can also be + encoded into the URI. + + + + + +Josefsson Standards Track [Page 5] + +RFC 4398 Storing Certificates in the DNS February 2006 + + + The OID private type indicates a private format certificate specified + by an ISO OID prefix. The certificate section will start with a + one-octet unsigned OID length and then a BER-encoded OID indicating + the nature of the remainder of the certificate section. This can be + an X.509 certificate format or some other format. X.509 certificates + that conform to the IETF PKIX profile SHOULD be indicated by the PKIX + type, not the OID private type. Recognition of private certificate + types need not be based on OID equality but can use various forms of + pattern matching such as OID prefix. + +2.2. Text Representation of CERT RRs + + The RDATA portion of a CERT RR has the type field as an unsigned + decimal integer or as a mnemonic symbol as listed in Section 2.1, + above. + + The key tag field is represented as an unsigned decimal integer. + + The algorithm field is represented as an unsigned decimal integer or + a mnemonic symbol as listed in [12]. + + The certificate/CRL portion is represented in base 64 [16] and may be + divided into any number of white-space-separated substrings, down to + single base-64 digits, which are concatenated to obtain the full + signature. These substrings can span lines using the standard + parenthesis. + + Note that the certificate/CRL portion may have internal sub-fields, + but these do not appear in the master file representation. For + example, with type 254, there will be an OID size, an OID, and then + the certificate/CRL proper. However, only a single logical base-64 + string will appear in the text representation. + +2.3. X.509 OIDs + + OIDs have been defined in connection with the X.500 directory for + user certificates, certification authority certificates, revocations + of certification authority, and revocations of user certificates. + The following table lists the OIDs, their BER encoding, and their + length-prefixed hex format for use in CERT RRs: + + + + + + + + + + + +Josefsson Standards Track [Page 6] + +RFC 4398 Storing Certificates in the DNS February 2006 + + + id-at-userCertificate + = { joint-iso-ccitt(2) ds(5) at(4) 36 } + == 0x 03 55 04 24 + id-at-cACertificate + = { joint-iso-ccitt(2) ds(5) at(4) 37 } + == 0x 03 55 04 25 + id-at-authorityRevocationList + = { joint-iso-ccitt(2) ds(5) at(4) 38 } + == 0x 03 55 04 26 + id-at-certificateRevocationList + = { joint-iso-ccitt(2) ds(5) at(4) 39 } + == 0x 03 55 04 27 + +3. Appropriate Owner Names for CERT RRs + + It is recommended that certificate CERT RRs be stored under a domain + name related to their subject, i.e., the name of the entity intended + to control the private key corresponding to the public key being + certified. It is recommended that certificate revocation list CERT + RRs be stored under a domain name related to their issuer. + + Following some of the guidelines below may result in DNS names with + characters that require DNS quoting as per Section 5.1 of RFC 1035 + [2]. + + The choice of name under which CERT RRs are stored is important to + clients that perform CERT queries. In some situations, the clients + may not know all information about the CERT RR object it wishes to + retrieve. For example, a client may not know the subject name of an + X.509 certificate, or the email address of the owner of an OpenPGP + key. Further, the client might only know the hostname of a service + that uses X.509 certificates or the Key ID of an OpenPGP key. + + Therefore, two owner name guidelines are defined: content-based owner + names and purpose-based owner names. A content-based owner name is + derived from the content of the CERT RR data; for example, the + Subject field in an X.509 certificate or the User ID field in OpenPGP + keys. A purpose-based owner name is a name that a client retrieving + CERT RRs ought to know already; for example, the host name of an + X.509 protected service or the Key ID of an OpenPGP key. The + content-based and purpose-based owner name may be the same; for + example, when a client looks up a key based on the From: address of + an incoming email. + + Implementations SHOULD use the purpose-based owner name guidelines + described in this document and MAY use CNAME RRs at content-based + owner names (or other names), pointing to the purpose-based owner + name. + + + +Josefsson Standards Track [Page 7] + +RFC 4398 Storing Certificates in the DNS February 2006 + + + Note that this section describes an application-based mapping from + the name space used in a certificate to the name space used by DNS. + The DNS does not infer any relationship amongst CERT resource records + based on similarities or differences of the DNS owner name(s) of CERT + resource records. For example, if multiple labels are used when + mapping from a CERT identifier to a domain name, then care must be + taken in understanding wildcard record synthesis. + +3.1. Content-Based X.509 CERT RR Names + + Some X.509 versions, such as the PKIX profile of X.509 [8], permit + multiple names to be associated with subjects and issuers under + "Subject Alternative Name" and "Issuer Alternative Name". For + example, the PKIX profile has such Alternate Names with an ASN.1 + specification as follows: + + GeneralName ::= CHOICE { + otherName [0] OtherName, + rfc822Name [1] IA5String, + dNSName [2] IA5String, + x400Address [3] ORAddress, + directoryName [4] Name, + ediPartyName [5] EDIPartyName, + uniformResourceIdentifier [6] IA5String, + iPAddress [7] OCTET STRING, + registeredID [8] OBJECT IDENTIFIER } + + The recommended locations of CERT storage are as follows, in priority + order: + + 1. If a domain name is included in the identification in the + certificate or CRL, that ought to be used. + 2. If a domain name is not included but an IP address is included, + then the translation of that IP address into the appropriate + inverse domain name ought to be used. + 3. If neither of the above is used, but a URI containing a domain + name is present, that domain name ought to be used. + 4. If none of the above is included but a character string name is + included, then it ought to be treated as described below for + OpenPGP names. + 5. If none of the above apply, then the distinguished name (DN) + ought to be mapped into a domain name as specified in [4]. + + Example 1: An X.509v3 certificate is issued to /CN=John Doe /DC=Doe/ + DC=com/DC=xy/O=Doe Inc/C=XY/ with Subject Alternative Names of (a) + string "John (the Man) Doe", (b) domain name john-doe.com, and (c) + URI <https://www.secure.john-doe.com:8080/>. The storage locations + recommended, in priority order, would be + + + +Josefsson Standards Track [Page 8] + +RFC 4398 Storing Certificates in the DNS February 2006 + + + 1. john-doe.com, + 2. www.secure.john-doe.com, and + 3. Doe.com.xy. + + Example 2: An X.509v3 certificate is issued to /CN=James Hacker/ + L=Basingstoke/O=Widget Inc/C=GB/ with Subject Alternate names of (a) + domain name widget.foo.example, (b) IPv4 address 10.251.13.201, and + (c) string "James Hacker <hacker@mail.widget.foo.example>". The + storage locations recommended, in priority order, would be + + 1. widget.foo.example, + 2. 201.13.251.10.in-addr.arpa, and + 3. hacker.mail.widget.foo.example. + +3.2. Purpose-Based X.509 CERT RR Names + + Due to the difficulty for clients that do not already possess a + certificate to reconstruct the content-based owner name, + purpose-based owner names are recommended in this section. + Recommendations for purpose-based owner names vary per scenario. The + following table summarizes the purpose-based X.509 CERT RR owner name + guidelines for use with S/MIME [17], SSL/TLS [13], and IPsec [14]: + + Scenario Owner name + ------------------ ---------------------------------------------- + S/MIME Certificate Standard translation of an RFC 2822 email + address. Example: An S/MIME certificate for + "postmaster@example.org" will use a standard + hostname translation of the owner name, + "postmaster.example.org". + + TLS Certificate Hostname of the TLS server. + + IPsec Certificate Hostname of the IPsec machine and/or, for IPv4 + or IPv6 addresses, the fully qualified domain + name in the appropriate reverse domain. + + An alternate approach for IPsec is to store raw public keys [18]. + +3.3. Content-Based OpenPGP CERT RR Names + + OpenPGP signed keys (certificates) use a general character string + User ID [5]. However, it is recommended by OpenPGP that such names + include the RFC 2822 [7] email address of the party, as in "Leslie + Example <Leslie@host.example>". If such a format is used, the CERT + ought to be under the standard translation of the email address into + + + + + +Josefsson Standards Track [Page 9] + +RFC 4398 Storing Certificates in the DNS February 2006 + + + a domain name, which would be leslie.host.example in this case. If + no RFC 2822 name can be extracted from the string name, no specific + domain name is recommended. + + If a user has more than one email address, the CNAME type can be used + to reduce the amount of data stored in the DNS. For example: + + $ORIGIN example.org. + smith IN CERT PGP 0 0 <OpenPGP binary> + john.smith IN CNAME smith + js IN CNAME smith + +3.4. Purpose-Based OpenPGP CERT RR Names + + Applications that receive an OpenPGP packet containing encrypted or + signed data but do not know the email address of the sender will have + difficulties constructing the correct owner name and cannot use the + content-based owner name guidelines. However, these clients commonly + know the key fingerprint or the Key ID. The key ID is found in + OpenPGP packets, and the key fingerprint is commonly found in + auxiliary data that may be available. In this case, use of an owner + name identical to the key fingerprint and the key ID expressed in + hexadecimal [16] is recommended. For example: + + $ORIGIN example.org. + 0424D4EE81A0E3D119C6F835EDA21E94B565716F IN CERT PGP ... + F835EDA21E94B565716F IN CERT PGP ... + B565716F IN CERT PGP ... + + If the same key material is stored for several owner names, the use + of CNAME may help avoid data duplication. Note that CNAME is not + always applicable, because it maps one owner name to the other for + all purposes, which may be sub-optimal when two keys with the same + Key ID are stored. + +3.5. Owner Names for IPKIX, ISPKI, IPGP, and IACPKIX + + These types are stored under the same owner names, both purpose- and + content-based, as the PKIX, SPKI, PGP, and ACPKIX types. + + + + + + + + + + + + +Josefsson Standards Track [Page 10] + +RFC 4398 Storing Certificates in the DNS February 2006 + + +4. Performance Considerations + + The Domain Name System (DNS) protocol was designed for small + transfers, typically below 512 octets. While larger transfers will + perform correctly and work is underway to make larger transfers more + efficient, it is still advisable at this time that every reasonable + effort be made to minimize the size of certificates stored within the + DNS. Steps that can be taken may include using the fewest possible + optional or extension fields and using short field values for + necessary variable-length fields. + + The RDATA field in the DNS protocol may only hold data of size 65535 + octets (64kb) or less. This means that each CERT RR MUST NOT contain + more than 64kb of payload, even if the corresponding certificate or + certificate revocation list is larger. This document addresses this + by defining "indirect" data types for each normal type. + + Deploying CERT RRs to support digitally signed email changes the + access patterns of DNS lookups from per-domain to per-user. If + digitally signed email and a key/certificate lookup based on CERT RRs + are deployed on a wide scale, this may lead to an increased DNS load, + with potential performance and cache effectiveness consequences. + Whether or not this load increase will be noticeable is not known. + +5. Contributors + + The majority of this document is copied verbatim from RFC 2538, by + Donald Eastlake 3rd and Olafur Gudmundsson. + +6. Acknowledgements + + Thanks to David Shaw and Michael Graff for their contributions to + earlier works that motivated, and served as inspiration for, this + document. + + This document was improved by suggestions and comments from Olivier + Dubuisson, Scott Hollenbeck, Russ Housley, Peter Koch, Olaf M. + Kolkman, Ben Laurie, Edward Lewis, John Loughney, Allison Mankin, + Douglas Otis, Marcos Sanz, Pekka Savola, Jason Sloderbeck, Samuel + Weiler, and Florian Weimer. No doubt the list is incomplete. We + apologize to anyone we left out. + + + + + + + + + + +Josefsson Standards Track [Page 11] + +RFC 4398 Storing Certificates in the DNS February 2006 + + +7. Security Considerations + + By definition, certificates contain their own authenticating + signatures. Thus, it is reasonable to store certificates in + non-secure DNS zones or to retrieve certificates from DNS with DNS + security checking not implemented or deferred for efficiency. The + results may be trusted if the certificate chain is verified back to a + known trusted key and this conforms with the user's security policy. + + Alternatively, if certificates are retrieved from a secure DNS zone + with DNS security checking enabled and are verified by DNS security, + the key within the retrieved certificate may be trusted without + verifying the certificate chain if this conforms with the user's + security policy. + + If an organization chooses to issue certificates for its employees, + placing CERT RRs in the DNS by owner name, and if DNSSEC (with NSEC) + is in use, it is possible for someone to enumerate all employees of + the organization. This is usually not considered desirable, for the + same reason that enterprise phone listings are not often publicly + published and are even marked confidential. + + Using the URI type introduces another level of indirection that may + open a new vulnerability. One method of securing that indirection is + to include a hash of the certificate in the URI itself. + + If DNSSEC is used, then the non-existence of a CERT RR and, + consequently, certificates or revocation lists can be securely + asserted. Without DNSSEC, this is not possible. + +8. IANA Considerations + + The IANA has created a new registry for CERT RR: certificate types. + The initial contents of this registry is: + + Decimal Type Meaning Reference + ------- ---- ------- --------- + 0 Reserved RFC 4398 + 1 PKIX X.509 as per PKIX RFC 4398 + 2 SPKI SPKI certificate RFC 4398 + 3 PGP OpenPGP packet RFC 4398 + 4 IPKIX The URL of an X.509 data object RFC 4398 + 5 ISPKI The URL of an SPKI certificate RFC 4398 + 6 IPGP The fingerprint and URL RFC 4398 + of an OpenPGP packet + 7 ACPKIX Attribute Certificate RFC 4398 + 8 IACPKIX The URL of an Attribute RFC 4398 + Certificate + + + +Josefsson Standards Track [Page 12] + +RFC 4398 Storing Certificates in the DNS February 2006 + + + 9-252 Available for IANA assignment + by IETF Standards action + 253 URI URI private RFC 4398 + 254 OID OID private RFC 4398 + 255 Reserved RFC 4398 + 256-65279 Available for IANA assignment + by IETF Consensus + 65280-65534 Experimental RFC 4398 + 65535 Reserved RFC 4398 + + Certificate types 0x0000 through 0x00FF and 0xFF00 through 0xFFFF can + only be assigned by an IETF standards action [6]. This document + assigns 0x0001 through 0x0008 and 0x00FD and 0x00FE. Certificate + types 0x0100 through 0xFEFF are assigned through IETF Consensus [6] + based on RFC documentation of the certificate type. The availability + of private types under 0x00FD and 0x00FE ought to satisfy most + requirements for proprietary or private types. + + The CERT RR reuses the DNS Security Algorithm Numbers registry. In + particular, the CERT RR requires that algorithm number 0 remain + reserved, as described in Section 2. The IANA will reference the + CERT RR as a user of this registry and value 0, in particular. + +9. Changes since RFC 2538 + + 1. Editorial changes to conform with new document requirements, + including splitting reference section into two parts and + updating the references to point at latest versions, and to add + some additional references. + 2. Improve terminology. For example replace "PGP" with "OpenPGP", + to align with RFC 2440. + 3. In Section 2.1, clarify that OpenPGP public key data are binary, + not the ASCII armored format, and reference 10.1 in RFC 2440 on + how to deal with OpenPGP keys, and acknowledge that + implementations may handle additional packet types. + 4. Clarify that integers in the representation format are decimal. + 5. Replace KEY/SIG with DNSKEY/RRSIG etc, to align with DNSSECbis + terminology. Improve reference for Key Tag Algorithm + calculations. + 6. Add examples that suggest use of CNAME to reduce bandwidth. + 7. In Section 3, appended the last paragraphs that discuss + "content-based" vs "purpose-based" owner names. Add Section 3.2 + for purpose-based X.509 CERT owner names, and Section 3.4 for + purpose-based OpenPGP CERT owner names. + 8. Added size considerations. + 9. The SPKI types has been reserved, until RFC 2692/2693 is moved + from the experimental status. + 10. Added indirect types IPKIX, ISPKI, IPGP, and IACPKIX. + + + +Josefsson Standards Track [Page 13] + +RFC 4398 Storing Certificates in the DNS February 2006 + + + 11. An IANA registry of CERT type values was created. + +10. References + +10.1. Normative References + + [1] Mockapetris, P., "Domain names - concepts and facilities", + STD 13, RFC 1034, November 1987. + + [2] Mockapetris, P., "Domain names - implementation and + specification", STD 13, RFC 1035, November 1987. + + [3] Bradner, S., "Key words for use in RFCs to Indicate Requirement + Levels", BCP 14, RFC 2119, March 1997. + + [4] Kille, S., Wahl, M., Grimstad, A., Huber, R., and S. Sataluri, + "Using Domains in LDAP/X.500 Distinguished Names", RFC 2247, + January 1998. + + [5] Callas, J., Donnerhacke, L., Finney, H., and R. Thayer, + "OpenPGP Message Format", RFC 2440, November 1998. + + [6] Narten, T. and H. Alvestrand, "Guidelines for Writing an IANA + Considerations Section in RFCs", BCP 26, RFC 2434, + October 1998. + + [7] Resnick, P., "Internet Message Format", RFC 2822, April 2001. + + [8] Housley, R., Polk, W., Ford, W., and D. Solo, "Internet X.509 + Public Key Infrastructure Certificate and Certificate + Revocation List (CRL) Profile", RFC 3280, April 2002. + + [9] Farrell, S. and R. Housley, "An Internet Attribute Certificate + Profile for Authorization", RFC 3281, April 2002. + + [10] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform + Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986, + January 2005. + + [11] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, + "DNS Security Introduction and Requirements", RFC 4033, + March 2005. + + [12] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, + "Resource Records for the DNS Security Extensions", RFC 4034, + March 2005. + + + + + +Josefsson Standards Track [Page 14] + +RFC 4398 Storing Certificates in the DNS February 2006 + + +10.2. Informative References + + [13] Dierks, T. and C. Allen, "The TLS Protocol Version 1.0", + RFC 2246, January 1999. + + [14] Kent, S. and K. Seo, "Security Architecture for the Internet + Protocol", RFC 4301, December 2005. + + [15] Ellison, C., Frantz, B., Lampson, B., Rivest, R., Thomas, B., + and T. Ylonen, "SPKI Certificate Theory", RFC 2693, + September 1999. + + [16] Josefsson, S., "The Base16, Base32, and Base64 Data Encodings", + RFC 3548, July 2003. + + [17] Ramsdell, B., "Secure/Multipurpose Internet Mail Extensions + (S/MIME) Version 3.1 Message Specification", RFC 3851, + July 2004. + + [18] Richardson, M., "A Method for Storing IPsec Keying Material in + DNS", RFC 4025, March 2005. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +Josefsson Standards Track [Page 15] + +RFC 4398 Storing Certificates in the DNS February 2006 + + +Appendix A. Copying Conditions + + Regarding the portion of this document that was written by Simon + Josefsson ("the author", for the remainder of this section), the + author makes no guarantees and is not responsible for any damage + resulting from its use. The author grants irrevocable permission to + anyone to use, modify, and distribute it in any way that does not + diminish the rights of anyone else to use, modify, and distribute it, + provided that redistributed derivative works do not contain + misleading author or version information. Derivative works need not + be licensed under similar terms. + +Author's Address + + Simon Josefsson + + EMail: simon@josefsson.org + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +Josefsson Standards Track [Page 16] + +RFC 4398 Storing Certificates in the DNS February 2006 + + +Full Copyright Statement + + Copyright (C) The Internet Society (2006). + + This document is subject to the rights, licenses and restrictions + contained in BCP 78, and except as set forth therein, the authors + retain all their rights. + + This document and the information contained herein are provided on an + "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS + OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET + ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, + INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE + INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED + WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. + +Intellectual Property + + The IETF takes no position regarding the validity or scope of any + Intellectual Property Rights or other rights that might be claimed to + pertain to the implementation or use of the technology described in + this document or the extent to which any license under such rights + might or might not be available; nor does it represent that it has + made any independent effort to identify any such rights. Information + on the procedures with respect to rights in RFC documents can be + found in BCP 78 and BCP 79. + + Copies of IPR disclosures made to the IETF Secretariat and any + assurances of licenses to be made available, or the result of an + attempt made to obtain a general license or permission for the use of + such proprietary rights by implementers or users of this + specification can be obtained from the IETF on-line IPR repository at + http://www.ietf.org/ipr. + + The IETF invites any interested party to bring to its attention any + copyrights, patents or patent applications, or other proprietary + rights that may cover technology that may be required to implement + this standard. Please address the information to the IETF at + ietf-ipr@ietf.org. + +Acknowledgement + + Funding for the RFC Editor function is provided by the IETF + Administrative Support Activity (IASA). + + + + + + + +Josefsson Standards Track [Page 17] + diff --git a/contrib/bind9/doc/rfc/rfc4408.txt b/contrib/bind9/doc/rfc/rfc4408.txt new file mode 100644 index 0000000..bc1b3f5 --- /dev/null +++ b/contrib/bind9/doc/rfc/rfc4408.txt @@ -0,0 +1,2691 @@ + + + + + + +Network Working Group M. Wong +Request for Comments: 4408 W. Schlitt +Category: Experimental April 2006 + + + Sender Policy Framework (SPF) for + Authorizing Use of Domains in E-Mail, Version 1 + +Status of This Memo + + This memo defines an Experimental Protocol for the Internet + community. It does not specify an Internet standard of any kind. + Discussion and suggestions for improvement are requested. + Distribution of this memo is unlimited. + +Copyright Notice + + Copyright (C) The Internet Society (2006). + +IESG Note + + The following documents (RFC 4405, RFC 4406, RFC 4407, and RFC 4408) + are published simultaneously as Experimental RFCs, although there is + no general technical consensus and efforts to reconcile the two + approaches have failed. As such, these documents have not received + full IETF review and are published "AS-IS" to document the different + approaches as they were considered in the MARID working group. + + The IESG takes no position about which approach is to be preferred + and cautions the reader that there are serious open issues for each + approach and concerns about using them in tandem. The IESG believes + that documenting the different approaches does less harm than not + documenting them. + + Note that the Sender ID experiment may use DNS records that may have + been created for the current SPF experiment or earlier versions in + this set of experiments. Depending on the content of the record, + this may mean that Sender-ID heuristics would be applied incorrectly + to a message. Depending on the actions associated by the recipient + with those heuristics, the message may not be delivered or may be + discarded on receipt. + + Participants relying on Sender ID experiment DNS records are warned + that they may lose valid messages in this set of circumstances. + aParticipants publishing SPF experiment DNS records should consider + the advice given in section 3.4 of RFC 4406 and may wish to publish + both v=spf1 and spf2.0 records to avoid the conflict. + + + + +Wong & Schlitt Experimental [Page 1] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + Participants in the Sender-ID experiment need to be aware that the + way Resent-* header fields are used will result in failure to receive + legitimate email when interacting with standards-compliant systems + (specifically automatic forwarders which comply with the standards by + not adding Resent-* headers, and systems which comply with RFC 822 + but have not yet implemented RFC 2822 Resent-* semantics). It would + be inappropriate to advance Sender-ID on the standards track without + resolving this interoperability problem. + + The community is invited to observe the success or failure of the two + approaches during the two years following publication, in order that + a community consensus can be reached in the future. + +Abstract + + E-mail on the Internet can be forged in a number of ways. In + particular, existing protocols place no restriction on what a sending + host can use as the reverse-path of a message or the domain given on + the SMTP HELO/EHLO commands. This document describes version 1 of + the Sender Policy Framework (SPF) protocol, whereby a domain may + explicitly authorize the hosts that are allowed to use its domain + name, and a receiving host may check such authorization. + +Table of Contents + + 1. Introduction ....................................................4 + 1.1. Protocol Status ............................................4 + 1.2. Terminology ................................................5 + 2. Operation .......................................................5 + 2.1. The HELO Identity ..........................................5 + 2.2. The MAIL FROM Identity .....................................5 + 2.3. Publishing Authorization ...................................6 + 2.4. Checking Authorization .....................................6 + 2.5. Interpreting the Result ....................................7 + 2.5.1. None ................................................8 + 2.5.2. Neutral .............................................8 + 2.5.3. Pass ................................................8 + 2.5.4. Fail ................................................8 + 2.5.5. SoftFail ............................................9 + 2.5.6. TempError ...........................................9 + 2.5.7. PermError ...........................................9 + 3. SPF Records .....................................................9 + 3.1. Publishing ................................................10 + 3.1.1. DNS Resource Record Types ..........................10 + 3.1.2. Multiple DNS Records ...............................11 + 3.1.3. Multiple Strings in a Single DNS record ............11 + 3.1.4. Record Size ........................................11 + 3.1.5. Wildcard Records ...................................11 + + + +Wong & Schlitt Experimental [Page 2] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + 4. The check_host() Function ......................................12 + 4.1. Arguments .................................................12 + 4.2. Results ...................................................13 + 4.3. Initial Processing ........................................13 + 4.4. Record Lookup .............................................13 + 4.5. Selecting Records .........................................13 + 4.6. Record Evaluation .........................................14 + 4.6.1. Term Evaluation ....................................14 + 4.6.2. Mechanisms .........................................15 + 4.6.3. Modifiers ..........................................15 + 4.7. Default Result ............................................16 + 4.8. Domain Specification ......................................16 + 5. Mechanism Definitions ..........................................16 + 5.1. "all" .....................................................17 + 5.2. "include" .................................................18 + 5.3. "a" .......................................................19 + 5.4. "mx" ......................................................20 + 5.5. "ptr" .....................................................20 + 5.6. "ip4" and "ip6" ...........................................21 + 5.7. "exists" ..................................................22 + 6. Modifier Definitions ...........................................22 + 6.1. redirect: Redirected Query ................................23 + 6.2. exp: Explanation ..........................................23 + 7. The Received-SPF Header Field ..................................25 + 8. Macros .........................................................27 + 8.1. Macro Definitions .........................................27 + 8.2. Expansion Examples ........................................30 + 9. Implications ...................................................31 + 9.1. Sending Domains ...........................................31 + 9.2. Mailing Lists .............................................32 + 9.3. Forwarding Services and Aliases ...........................32 + 9.4. Mail Services .............................................34 + 9.5. MTA Relays ................................................34 + 10. Security Considerations .......................................35 + 10.1. Processing Limits ........................................35 + 10.2. SPF-Authorized E-Mail May Contain Other False + Identities ...............................................37 + 10.3. Spoofed DNS and IP Data ..................................37 + 10.4. Cross-User Forgery .......................................37 + 10.5. Untrusted Information Sources ............................38 + 10.6. Privacy Exposure .........................................38 + 11. Contributors and Acknowledgements .............................38 + 12. IANA Considerations ...........................................39 + 12.1. The SPF DNS Record Type ..................................39 + 12.2. The Received-SPF Mail Header Field .......................39 + 13. References ....................................................39 + 13.1. Normative References .....................................39 + 13.2. Informative References ...................................40 + + + +Wong & Schlitt Experimental [Page 3] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + Appendix A. Collected ABNF .......................................42 + Appendix B. Extended Examples ....................................44 + B.1. Simple Examples ..........................................44 + B.2. Multiple Domain Example ..................................45 + B.3. DNSBL Style Example ......................................46 + B.4. Multiple Requirements Example ............................46 + +1. Introduction + + The current E-Mail infrastructure has the property that any host + injecting mail into the mail system can identify itself as any domain + name it wants. Hosts can do this at a variety of levels: in + particular, the session, the envelope, and the mail headers. + Although this feature is desirable in some circumstances, it is a + major obstacle to reducing Unsolicited Bulk E-Mail (UBE, aka spam). + Furthermore, many domain name holders are understandably concerned + about the ease with which other entities may make use of their domain + names, often with malicious intent. + + This document defines a protocol by which domain owners may authorize + hosts to use their domain name in the "MAIL FROM" or "HELO" identity. + Compliant domain holders publish Sender Policy Framework (SPF) + records specifying which hosts are permitted to use their names, and + compliant mail receivers use the published SPF records to test the + authorization of sending Mail Transfer Agents (MTAs) using a given + "HELO" or "MAIL FROM" identity during a mail transaction. + + An additional benefit to mail receivers is that after the use of an + identity is verified, local policy decisions about the mail can be + made based on the sender's domain, rather than the host's IP address. + This is advantageous because reputation of domain names is likely to + be more accurate than reputation of host IP addresses. Furthermore, + if a claimed identity fails verification, local policy can take + stronger action against such E-Mail, such as rejecting it. + +1.1. Protocol Status + + SPF has been in development since the summer of 2003 and has seen + deployment beyond the developers beginning in December 2003. The + design of SPF slowly evolved until the spring of 2004 and has since + stabilized. There have been quite a number of forms of SPF, some + written up as documents, some submitted as Internet Drafts, and many + discussed and debated in development forums. + + The goal of this document is to clearly document the protocol defined + by earlier draft specifications of SPF as used in existing + implementations. This conception of SPF is sometimes called "SPF + Classic". It is understood that particular implementations and + + + +Wong & Schlitt Experimental [Page 4] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + deployments may differ from, and build upon, this work. It is hoped + that we have nonetheless captured the common understanding of SPF + version 1. + +1.2. Terminology + + The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", + "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this + document are to be interpreted as described in [RFC2119]. + + This document is concerned with the portion of a mail message + commonly called "envelope sender", "return path", "reverse path", + "bounce address", "2821 FROM", or "MAIL FROM". Since these terms are + either not well defined or often used casually, this document defines + the "MAIL FROM" identity in Section 2.2. Note that other terms that + may superficially look like the common terms, such as "reverse-path", + are used only with the defined meanings from normative documents. + +2. Operation + +2.1. The HELO Identity + + The "HELO" identity derives from either the SMTP HELO or EHLO command + (see [RFC2821]). These commands supply the SMTP client (sending + host) for the SMTP session. Note that requirements for the domain + presented in the EHLO or HELO command are not always clear to the + sending party, and SPF clients must be prepared for the "HELO" + identity to be malformed or an IP address literal. At the time of + this writing, many legitimate E-Mails are delivered with invalid HELO + domains. + + It is RECOMMENDED that SPF clients not only check the "MAIL FROM" + identity, but also separately check the "HELO" identity by applying + the check_host() function (Section 4) to the "HELO" identity as the + <sender>. + +2.2. The MAIL FROM Identity + + The "MAIL FROM" identity derives from the SMTP MAIL command (see + [RFC2821]). This command supplies the "reverse-path" for a message, + which generally consists of the sender mailbox, and is the mailbox to + which notification messages are to be sent if there are problems + delivering the message. + + [RFC2821] allows the reverse-path to be null (see Section 4.5.5 in + RFC 2821). In this case, there is no explicit sender mailbox, and + such a message can be assumed to be a notification message from the + mail system itself. When the reverse-path is null, this document + + + +Wong & Schlitt Experimental [Page 5] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + defines the "MAIL FROM" identity to be the mailbox composed of the + localpart "postmaster" and the "HELO" identity (which may or may not + have been checked separately before). + + SPF clients MUST check the "MAIL FROM" identity. SPF clients check + the "MAIL FROM" identity by applying the check_host() function to the + "MAIL FROM" identity as the <sender>. + +2.3. Publishing Authorization + + An SPF-compliant domain MUST publish a valid SPF record as described + in Section 3. This record authorizes the use of the domain name in + the "HELO" and "MAIL FROM" identities by the MTAs it specifies. + + If domain owners choose to publish SPF records, it is RECOMMENDED + that they end in "-all", or redirect to other records that do, so + that a definitive determination of authorization can be made. + + Domain holders may publish SPF records that explicitly authorize no + hosts if mail should never originate using that domain. + + When changing SPF records, care must be taken to ensure that there is + a transition period so that the old policy remains valid until all + legitimate E-Mail has been checked. + +2.4. Checking Authorization + + A mail receiver can perform a set of SPF checks for each mail message + it receives. An SPF check tests the authorization of a client host + to emit mail with a given identity. Typically, such checks are done + by a receiving MTA, but can be performed elsewhere in the mail + processing chain so long as the required information is available and + reliable. At least the "MAIL FROM" identity MUST be checked, but it + is RECOMMENDED that the "HELO" identity also be checked beforehand. + + Without explicit approval of the domain owner, checking other + identities against SPF version 1 records is NOT RECOMMENDED because + there are cases that are known to give incorrect results. For + example, almost all mailing lists rewrite the "MAIL FROM" identity + (see Section 9.2), but some do not change any other identities in the + message. The scenario described in Section 9.3, sub-section 1.2, is + another example. Documents that define other identities should + define the method for explicit approval. + + It is possible that mail receivers will use the SPF check as part of + a larger set of tests on incoming mail. The results of other tests + may influence whether or not a particular SPF check is performed. + For example, finding the sending host's IP address on a local white + + + +Wong & Schlitt Experimental [Page 6] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + list may cause all other tests to be skipped and all mail from that + host to be accepted. + + When a mail receiver decides to perform an SPF check, it MUST use a + correctly-implemented check_host() function (Section 4) evaluated + with the correct parameters. Although the test as a whole is + optional, once it has been decided to perform a test it must be + performed as specified so that the correct semantics are preserved + between publisher and receiver. + + To make the test, the mail receiver MUST evaluate the check_host() + function with the arguments set as follows: + + <ip> - the IP address of the SMTP client that is emitting the + mail, either IPv4 or IPv6. + + <domain> - the domain portion of the "MAIL FROM" or "HELO" identity. + + <sender> - the "MAIL FROM" or "HELO" identity. + + Note that the <domain> argument may not be a well-formed domain name. + For example, if the reverse-path was null, then the EHLO/HELO domain + is used, with its associated problems (see Section 2.1). In these + cases, check_host() is defined in Section 4.3 to return a "None" + result. + + Although invalid, malformed, or non-existent domains cause SPF checks + to return "None" because no SPF record can be found, it has long been + the policy of many MTAs to reject E-Mail from such domains, + especially in the case of invalid "MAIL FROM". In order to prevent + the circumvention of SPF records, rejecting E-Mail from invalid + domains should be considered. + + Implementations must take care to correctly extract the <domain> from + the data given with the SMTP MAIL FROM command as many MTAs will + still accept such things as source routes (see [RFC2821], Appendix + C), the %-hack (see [RFC1123]), and bang paths (see [RFC1983]). + These archaic features have been maliciously used to bypass security + systems. + +2.5. Interpreting the Result + + This section describes how software that performs the authorization + should interpret the results of the check_host() function. The + authorization check SHOULD be performed during the processing of the + SMTP transaction that sends the mail. This allows errors to be + returned directly to the sending MTA by way of SMTP replies. + + + + +Wong & Schlitt Experimental [Page 7] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + Performing the authorization after the SMTP transaction has finished + may cause problems, such as the following: (1) It may be difficult to + accurately extract the required information from potentially + deceptive headers; (2) legitimate E-Mail may fail because the + sender's policy may have since changed. + + Generating non-delivery notifications to forged identities that have + failed the authorization check is generally abusive and against the + explicit wishes of the identity owner. + +2.5.1. None + + A result of "None" means that no records were published by the domain + or that no checkable sender domain could be determined from the given + identity. The checking software cannot ascertain whether or not the + client host is authorized. + +2.5.2. Neutral + + The domain owner has explicitly stated that he cannot or does not + want to assert whether or not the IP address is authorized. A + "Neutral" result MUST be treated exactly like the "None" result; the + distinction exists only for informational purposes. Treating + "Neutral" more harshly than "None" would discourage domain owners + from testing the use of SPF records (see Section 9.1). + +2.5.3. Pass + + A "Pass" result means that the client is authorized to inject mail + with the given identity. The domain can now, in the sense of + reputation, be considered responsible for sending the message. + Further policy checks can now proceed with confidence in the + legitimate use of the identity. + +2.5.4. Fail + + A "Fail" result is an explicit statement that the client is not + authorized to use the domain in the given identity. The checking + software can choose to mark the mail based on this or to reject the + mail outright. + + If the checking software chooses to reject the mail during the SMTP + transaction, then it SHOULD use an SMTP reply code of 550 (see + [RFC2821]) and, if supported, the 5.7.1 Delivery Status Notification + (DSN) code (see [RFC3464]), in addition to an appropriate reply text. + The check_host() function may return either a default explanation + string or one from the domain that published the SPF records (see + Section 6.2). If the information does not originate with the + + + +Wong & Schlitt Experimental [Page 8] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + checking software, it should be made clear that the text is provided + by the sender's domain. For example: + + 550-5.7.1 SPF MAIL FROM check failed: + 550-5.7.1 The domain example.com explains: + 550 5.7.1 Please see http://www.example.com/mailpolicy.html + +2.5.5. SoftFail + + A "SoftFail" result should be treated as somewhere between a "Fail" + and a "Neutral". The domain believes the host is not authorized but + is not willing to make that strong of a statement. Receiving + software SHOULD NOT reject the message based solely on this result, + but MAY subject the message to closer scrutiny than normal. + + The domain owner wants to discourage the use of this host and thus + desires limited feedback when a "SoftFail" result occurs. For + example, the recipient's Mail User Agent (MUA) could highlight the + "SoftFail" status, or the receiving MTA could give the sender a + message using a technique called "greylisting" whereby the MTA can + issue an SMTP reply code of 451 (4.3.0 DSN code) with a note the + first time the message is received, but accept it the second time. + +2.5.6. TempError + + A "TempError" result means that the SPF client encountered a + transient error while performing the check. Checking software can + choose to accept or temporarily reject the message. If the message + is rejected during the SMTP transaction for this reason, the software + SHOULD use an SMTP reply code of 451 and, if supported, the 4.4.3 DSN + code. + +2.5.7. PermError + + A "PermError" result means that the domain's published records could + not be correctly interpreted. This signals an error condition that + requires manual intervention to be resolved, as opposed to the + TempError result. Be aware that if the domain owner uses macros + (Section 8), it is possible that this result is due to the checked + identities having an unexpected format. + +3. SPF Records + + An SPF record is a DNS Resource Record (RR) that declares which hosts + are, and are not, authorized to use a domain name for the "HELO" and + "MAIL FROM" identities. Loosely, the record partitions all hosts + into permitted and not-permitted sets (though some hosts might fall + into neither category). + + + +Wong & Schlitt Experimental [Page 9] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + The SPF record is a single string of text. An example record is the + following: + + v=spf1 +mx a:colo.example.com/28 -all + + This record has a version of "spf1" and three directives: "+mx", + "a:colo.example.com/28" (the + is implied), and "-all". + +3.1. Publishing + + Domain owners wishing to be SPF compliant must publish SPF records + for the hosts that are used in the "MAIL FROM" and "HELO" identities. + The SPF records are placed in the DNS tree at the host name it + pertains to, not a subdomain under it, such as is done with SRV + records. This is the same whether the TXT or SPF RR type (see + Section 3.1.1) is used. + + The example above in Section 3 might be published via these lines in + a domain zone file: + + example.com. TXT "v=spf1 +mx a:colo.example.com/28 -all" + smtp-out.example.com. TXT "v=spf1 a -all" + + When publishing via TXT records, beware of other TXT records + published there for other purposes. They may cause problems with + size limits (see Section 3.1.4). + +3.1.1. DNS Resource Record Types + + This document defines a new DNS RR of type SPF, code 99. The format + of this type is identical to the TXT RR [RFC1035]. For either type, + the character content of the record is encoded as [US-ASCII]. + + It is recognized that the current practice (using a TXT record) is + not optimal, but it is necessary because there are a number of DNS + server and resolver implementations in common use that cannot handle + the new RR type. The two-record-type scheme provides a forward path + to the better solution of using an RR type reserved for this purpose. + + An SPF-compliant domain name SHOULD have SPF records of both RR + types. A compliant domain name MUST have a record of at least one + type. If a domain has records of both types, they MUST have + identical content. For example, instead of publishing just one + record as in Section 3.1 above, it is better to publish: + + example.com. IN TXT "v=spf1 +mx a:colo.example.com/28 -all" + example.com. IN SPF "v=spf1 +mx a:colo.example.com/28 -all" + + + + +Wong & Schlitt Experimental [Page 10] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + Example RRs in this document are shown with the TXT record type; + however, they could be published with the SPF type or with both + types. + +3.1.2. Multiple DNS Records + + A domain name MUST NOT have multiple records that would cause an + authorization check to select more than one record. See Section 4.5 + for the selection rules. + +3.1.3. Multiple Strings in a Single DNS record + + As defined in [RFC1035] sections 3.3.14 and 3.3, a single text DNS + record (either TXT or SPF RR types) can be composed of more than one + string. If a published record contains multiple strings, then the + record MUST be treated as if those strings are concatenated together + without adding spaces. For example: + + IN TXT "v=spf1 .... first" "second string..." + + MUST be treated as equivalent to + + IN TXT "v=spf1 .... firstsecond string..." + + SPF or TXT records containing multiple strings are useful in + constructing records that would exceed the 255-byte maximum length of + a string within a single TXT or SPF RR record. + +3.1.4. Record Size + + The published SPF record for a given domain name SHOULD remain small + enough that the results of a query for it will fit within 512 octets. + This will keep even older DNS implementations from falling over to + TCP. Since the answer size is dependent on many things outside the + scope of this document, it is only possible to give this guideline: + If the combined length of the DNS name and the text of all the + records of a given type (TXT or SPF) is under 450 characters, then + DNS answers should fit in UDP packets. Note that when computing the + sizes for queries of the TXT format, one must take into account any + other TXT records published at the domain name. Records that are too + long to fit in a single UDP packet MAY be silently ignored by SPF + clients. + +3.1.5. Wildcard Records + + Use of wildcard records for publishing is not recommended. Care must + be taken if wildcard records are used. If a domain publishes + wildcard MX records, it may want to publish wildcard declarations, + + + +Wong & Schlitt Experimental [Page 11] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + subject to the same requirements and problems. In particular, the + declaration must be repeated for any host that has any RR records at + all, and for subdomains thereof. For example, the example given in + [RFC1034], Section 4.3.3, could be extended with the following: + + X.COM. MX 10 A.X.COM + X.COM. TXT "v=spf1 a:A.X.COM -all" + + *.X.COM. MX 10 A.X.COM + *.X.COM. TXT "v=spf1 a:A.X.COM -all" + + A.X.COM. A 1.2.3.4 + A.X.COM. MX 10 A.X.COM + A.X.COM. TXT "v=spf1 a:A.X.COM -all" + + *.A.X.COM. MX 10 A.X.COM + *.A.X.COM. TXT "v=spf1 a:A.X.COM -all" + + Notice that SPF records must be repeated twice for every name within + the domain: once for the name, and once with a wildcard to cover the + tree under the name. + + Use of wildcards is discouraged in general as they cause every name + under the domain to exist and queries against arbitrary names will + never return RCODE 3 (Name Error). + +4. The check_host() Function + + The check_host() function fetches SPF records, parses them, and + interprets them to determine whether a particular host is or is not + permitted to send mail with a given identity. Mail receivers that + perform this check MUST correctly evaluate the check_host() function + as described here. + + Implementations MAY use a different algorithm than the canonical + algorithm defined here, so long as the results are the same in all + cases. + +4.1. Arguments + + The check_host() function takes these arguments: + + <ip> - the IP address of the SMTP client that is emitting the + mail, either IPv4 or IPv6. + + <domain> - the domain that provides the sought-after authorization + information; initially, the domain portion of the "MAIL + FROM" or "HELO" identity. + + + +Wong & Schlitt Experimental [Page 12] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + <sender> - the "MAIL FROM" or "HELO" identity. + + The domain portion of <sender> will usually be the same as the + <domain> argument when check_host() is initially evaluated. However, + this will generally not be true for recursive evaluations (see + Section 5.2 below). + + Actual implementations of the check_host() function may need + additional arguments. + +4.2. Results + + The function check_host() can return one of several results described + in Section 2.5. Based on the result, the action to be taken is + determined by the local policies of the receiver. + +4.3. Initial Processing + + If the <domain> is malformed (label longer than 63 characters, zero- + length label not at the end, etc.) or is not a fully qualified domain + name, or if the DNS lookup returns "domain does not exist" (RCODE 3), + check_host() immediately returns the result "None". + + If the <sender> has no localpart, substitute the string "postmaster" + for the localpart. + +4.4. Record Lookup + + In accordance with how the records are published (see Section 3.1 + above), a DNS query needs to be made for the <domain> name, querying + for either RR type TXT, SPF, or both. If both SPF and TXT RRs are + looked up, the queries MAY be done in parallel. + + If all DNS lookups that are made return a server failure (RCODE 2), + or other error (RCODE other than 0 or 3), or time out, then + check_host() exits immediately with the result "TempError". + +4.5. Selecting Records + + Records begin with a version section: + + record = version terms *SP + version = "v=spf1" + + Starting with the set of records that were returned by the lookup, + record selection proceeds in two steps: + + + + + +Wong & Schlitt Experimental [Page 13] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + 1. Records that do not begin with a version section of exactly + "v=spf1" are discarded. Note that the version section is + terminated either by an SP character or the end of the record. A + record with a version section of "v=spf10" does not match and must + be discarded. + + 2. If any records of type SPF are in the set, then all records of + type TXT are discarded. + + After the above steps, there should be exactly one record remaining + and evaluation can proceed. If there are two or more records + remaining, then check_host() exits immediately with the result of + "PermError". + + If no matching records are returned, an SPF client MUST assume that + the domain makes no SPF declarations. SPF processing MUST stop and + return "None". + +4.6. Record Evaluation + + After one SPF record has been selected, the check_host() function + parses and interprets it to find a result for the current test. If + there are any syntax errors, check_host() returns immediately with + the result "PermError". + + Implementations MAY choose to parse the entire record first and + return "PermError" if the record is not syntactically well formed. + However, in all cases, any syntax errors anywhere in the record MUST + be detected. + +4.6.1. Term Evaluation + + There are two types of terms: mechanisms and modifiers. A record + contains an ordered list of these as specified in the following + Augmented Backus-Naur Form (ABNF). + + terms = *( 1*SP ( directive / modifier ) ) + + directive = [ qualifier ] mechanism + qualifier = "+" / "-" / "?" / "~" + mechanism = ( all / include + / A / MX / PTR / IP4 / IP6 / exists ) + modifier = redirect / explanation / unknown-modifier + unknown-modifier = name "=" macro-string + + name = ALPHA *( ALPHA / DIGIT / "-" / "_" / "." ) + + Most mechanisms allow a ":" or "/" character after the name. + + + +Wong & Schlitt Experimental [Page 14] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + Modifiers always contain an equals ('=') character immediately after + the name, and before any ":" or "/" characters that may be part of + the macro-string. + + Terms that do not contain any of "=", ":", or "/" are mechanisms, as + defined in Section 5. + + As per the definition of the ABNF notation in [RFC4234], mechanism + and modifier names are case-insensitive. + +4.6.2. Mechanisms + + Each mechanism is considered in turn from left to right. If there + are no more mechanisms, the result is specified in Section 4.7. + + When a mechanism is evaluated, one of three things can happen: it can + match, not match, or throw an exception. + + If it matches, processing ends and the qualifier value is returned as + the result of that record. If it does not match, processing + continues with the next mechanism. If it throws an exception, + mechanism processing ends and the exception value is returned. + + The possible qualifiers, and the results they return are as follows: + + "+" Pass + "-" Fail + "~" SoftFail + "?" Neutral + + The qualifier is optional and defaults to "+". + + When a mechanism matches and the qualifier is "-", then a "Fail" + result is returned and the explanation string is computed as + described in Section 6.2. + + The specific mechanisms are described in Section 5. + +4.6.3. Modifiers + + Modifiers are not mechanisms: they do not return match or not-match. + Instead they provide additional information. Although modifiers do + not directly affect the evaluation of the record, the "redirect" + modifier has an effect after all the mechanisms have been evaluated. + + + + + + + +Wong & Schlitt Experimental [Page 15] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + +4.7. Default Result + + If none of the mechanisms match and there is no "redirect" modifier, + then the check_host() returns a result of "Neutral", just as if + "?all" were specified as the last directive. If there is a + "redirect" modifier, check_host() proceeds as defined in Section 6.1. + + Note that records SHOULD always use either a "redirect" modifier or + an "all" mechanism to explicitly terminate processing. + + For example: + + v=spf1 +mx -all + or + v=spf1 +mx redirect=_spf.example.com + +4.8. Domain Specification + + Several of these mechanisms and modifiers have a <domain-spec> + section. The <domain-spec> string is macro expanded (see Section 8). + The resulting string is the common presentation form of a fully- + qualified DNS name: a series of labels separated by periods. This + domain is called the <target-name> in the rest of this document. + + Note: The result of the macro expansion is not subject to any further + escaping. Hence, this facility cannot produce all characters that + are legal in a DNS label (e.g., the control characters). However, + this facility is powerful enough to express legal host names and + common utility labels (such as "_spf") that are used in DNS. + + For several mechanisms, the <domain-spec> is optional. If it is not + provided, the <domain> is used as the <target-name>. + +5. Mechanism Definitions + + This section defines two types of mechanisms. + + Basic mechanisms contribute to the language framework. They do not + specify a particular type of authorization scheme. + + all + include + + Designated sender mechanisms are used to designate a set of <ip> + addresses as being permitted or not permitted to use the <domain> for + sending mail. + + + + + +Wong & Schlitt Experimental [Page 16] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + a + mx + ptr + ip4 + ip6 + exists + + The following conventions apply to all mechanisms that perform a + comparison between <ip> and an IP address at any point: + + If no CIDR-length is given in the directive, then <ip> and the IP + address are compared for equality. (Here, CIDR is Classless Inter- + Domain Routing.) + + If a CIDR-length is specified, then only the specified number of + high-order bits of <ip> and the IP address are compared for equality. + + When any mechanism fetches host addresses to compare with <ip>, when + <ip> is an IPv4 address, A records are fetched, when <ip> is an IPv6 + address, AAAA records are fetched. Even if the SMTP connection is + via IPv6, an IPv4-mapped IPv6 IP address (see [RFC3513], Section + 2.5.5) MUST still be considered an IPv4 address. + + Several mechanisms rely on information fetched from DNS. For these + DNS queries, except where noted, if the DNS server returns an error + (RCODE other than 0 or 3) or the query times out, the mechanism + throws the exception "TempError". If the server returns "domain does + not exist" (RCODE 3), then evaluation of the mechanism continues as + if the server returned no error (RCODE 0) and zero answer records. + +5.1. "all" + + all = "all" + + The "all" mechanism is a test that always matches. It is used as the + rightmost mechanism in a record to provide an explicit default. + + For example: + + v=spf1 a mx -all + + Mechanisms after "all" will never be tested. Any "redirect" modifier + (Section 6.1) has no effect when there is an "all" mechanism. + + + + + + + + +Wong & Schlitt Experimental [Page 17] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + +5.2. "include" + + include = "include" ":" domain-spec + + The "include" mechanism triggers a recursive evaluation of + check_host(). The domain-spec is expanded as per Section 8. Then + check_host() is evaluated with the resulting string as the <domain>. + The <ip> and <sender> arguments remain the same as in the current + evaluation of check_host(). + + In hindsight, the name "include" was poorly chosen. Only the + evaluated result of the referenced SPF record is used, rather than + acting as if the referenced SPF record was literally included in the + first. For example, evaluating a "-all" directive in the referenced + record does not terminate the overall processing and does not + necessarily result in an overall "Fail". (Better names for this + mechanism would have been "if-pass", "on-pass", etc.) + + The "include" mechanism makes it possible for one domain to designate + multiple administratively-independent domains. For example, a vanity + domain "example.net" might send mail using the servers of + administratively-independent domains example.com and example.org. + + Example.net could say + + IN TXT "v=spf1 include:example.com include:example.org -all" + + This would direct check_host() to, in effect, check the records of + example.com and example.org for a "Pass" result. Only if the host + were not permitted for either of those domains would the result be + "Fail". + + + + + + + + + + + + + + + + + + + + +Wong & Schlitt Experimental [Page 18] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + Whether this mechanism matches, does not match, or throws an + exception depends on the result of the recursive evaluation of + check_host(): + + +---------------------------------+---------------------------------+ + | A recursive check_host() result | Causes the "include" mechanism | + | of: | to: | + +---------------------------------+---------------------------------+ + | Pass | match | + | | | + | Fail | not match | + | | | + | SoftFail | not match | + | | | + | Neutral | not match | + | | | + | TempError | throw TempError | + | | | + | PermError | throw PermError | + | | | + | None | throw PermError | + +---------------------------------+---------------------------------+ + + The "include" mechanism is intended for crossing administrative + boundaries. Although it is possible to use includes to consolidate + multiple domains that share the same set of designated hosts, domains + are encouraged to use redirects where possible, and to minimize the + number of includes within a single administrative domain. For + example, if example.com and example.org were managed by the same + entity, and if the permitted set of hosts for both domains was + "mx:example.com", it would be possible for example.org to specify + "include:example.com", but it would be preferable to specify + "redirect=example.com" or even "mx:example.com". + +5.3. "a" + + This mechanism matches if <ip> is one of the <target-name>'s IP + addresses. + + A = "a" [ ":" domain-spec ] [ dual-cidr-length ] + + An address lookup is done on the <target-name>. The <ip> is compared + to the returned address(es). If any address matches, the mechanism + matches. + + + + + + + +Wong & Schlitt Experimental [Page 19] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + +5.4. "mx" + + This mechanism matches if <ip> is one of the MX hosts for a domain + name. + + MX = "mx" [ ":" domain-spec ] [ dual-cidr-length ] + + check_host() first performs an MX lookup on the <target-name>. Then + it performs an address lookup on each MX name returned. The <ip> is + compared to each returned IP address. To prevent Denial of Service + (DoS) attacks, more than 10 MX names MUST NOT be looked up during the + evaluation of an "mx" mechanism (see Section 10). If any address + matches, the mechanism matches. + + Note regarding implicit MXs: If the <target-name> has no MX records, + check_host() MUST NOT pretend the target is its single MX, and MUST + NOT default to an A lookup on the <target-name> directly. This + behavior breaks with the legacy "implicit MX" rule. See [RFC2821], + Section 5. If such behavior is desired, the publisher should specify + an "a" directive. + +5.5. "ptr" + + This mechanism tests whether the DNS reverse-mapping for <ip> exists + and correctly points to a domain name within a particular domain. + + PTR = "ptr" [ ":" domain-spec ] + + First, the <ip>'s name is looked up using this procedure: perform a + DNS reverse-mapping for <ip>, looking up the corresponding PTR record + in "in-addr.arpa." if the address is an IPv4 one and in "ip6.arpa." + if it is an IPv6 address. For each record returned, validate the + domain name by looking up its IP address. To prevent DoS attacks, + more than 10 PTR names MUST NOT be looked up during the evaluation of + a "ptr" mechanism (see Section 10). If <ip> is among the returned IP + addresses, then that domain name is validated. In pseudocode: + + sending-domain_names := ptr_lookup(sending-host_IP); if more than 10 + sending-domain_names are found, use at most 10. for each name in + (sending-domain_names) { + IP_addresses := a_lookup(name); + if the sending-domain_IP is one of the IP_addresses { + validated-sending-domain_names += name; + } } + + Check all validated domain names to see if they end in the + <target-name> domain. If any do, this mechanism matches. If no + validated domain name can be found, or if none of the validated + + + +Wong & Schlitt Experimental [Page 20] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + domain names end in the <target-name>, this mechanism fails to match. + If a DNS error occurs while doing the PTR RR lookup, then this + mechanism fails to match. If a DNS error occurs while doing an A RR + lookup, then that domain name is skipped and the search continues. + + Pseudocode: + + for each name in (validated-sending-domain_names) { + if name ends in <domain-spec>, return match. + if name is <domain-spec>, return match. + } + return no-match. + + This mechanism matches if the <target-name> is either an ancestor of + a validated domain name or if the <target-name> and a validated + domain name are the same. For example: "mail.example.com" is within + the domain "example.com", but "mail.bad-example.com" is not. + + Note: Use of this mechanism is discouraged because it is slow, it is + not as reliable as other mechanisms in cases of DNS errors, and it + places a large burden on the arpa name servers. If used, proper PTR + records must be in place for the domain's hosts and the "ptr" + mechanism should be one of the last mechanisms checked. + +5.6. "ip4" and "ip6" + + These mechanisms test whether <ip> is contained within a given IP + network. + + IP4 = "ip4" ":" ip4-network [ ip4-cidr-length ] + IP6 = "ip6" ":" ip6-network [ ip6-cidr-length ] + + ip4-cidr-length = "/" 1*DIGIT + ip6-cidr-length = "/" 1*DIGIT + dual-cidr-length = [ ip4-cidr-length ] [ "/" ip6-cidr-length ] + + ip4-network = qnum "." qnum "." qnum "." qnum + qnum = DIGIT ; 0-9 + / %x31-39 DIGIT ; 10-99 + / "1" 2DIGIT ; 100-199 + / "2" %x30-34 DIGIT ; 200-249 + / "25" %x30-35 ; 250-255 + ; as per conventional dotted quad notation. e.g., 192.0.2.0 + ip6-network = <as per [RFC 3513], section 2.2> + ; e.g., 2001:DB8::CD30 + + The <ip> is compared to the given network. If CIDR-length high-order + bits match, the mechanism matches. + + + +Wong & Schlitt Experimental [Page 21] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + If ip4-cidr-length is omitted, it is taken to be "/32". If + ip6-cidr-length is omitted, it is taken to be "/128". It is not + permitted to omit parts of the IP address instead of using CIDR + notations. That is, use 192.0.2.0/24 instead of 192.0.2. + +5.7. "exists" + + This mechanism is used to construct an arbitrary domain name that is + used for a DNS A record query. It allows for complicated schemes + involving arbitrary parts of the mail envelope to determine what is + permitted. + + exists = "exists" ":" domain-spec + + The domain-spec is expanded as per Section 8. The resulting domain + name is used for a DNS A RR lookup. If any A record is returned, + this mechanism matches. The lookup type is A even when the + connection type is IPv6. + + Domains can use this mechanism to specify arbitrarily complex + queries. For example, suppose example.com publishes the record: + + v=spf1 exists:%{ir}.%{l1r+-}._spf.%{d} -all + + The <target-name> might expand to + "1.2.0.192.someuser._spf.example.com". This makes fine-grained + decisions possible at the level of the user and client IP address. + + This mechanism enables queries that mimic the style of tests that + existing anti-spam DNS blacklists (DNSBL) use. + +6. Modifier Definitions + + Modifiers are name/value pairs that provide additional information. + Modifiers always have an "=" separating the name and the value. + + The modifiers defined in this document ("redirect" and "exp") MAY + appear anywhere in the record, but SHOULD appear at the end, after + all mechanisms. Ordering of these two modifiers does not matter. + These two modifiers MUST NOT appear in a record more than once each. + If they do, then check_host() exits with a result of "PermError". + + Unrecognized modifiers MUST be ignored no matter where in a record, + or how often. This allows implementations of this document to + gracefully handle records with modifiers that are defined in other + specifications. + + + + + +Wong & Schlitt Experimental [Page 22] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + +6.1. redirect: Redirected Query + + If all mechanisms fail to match, and a "redirect" modifier is + present, then processing proceeds as follows: + + redirect = "redirect" "=" domain-spec + + The domain-spec portion of the redirect section is expanded as per + the macro rules in Section 8. Then check_host() is evaluated with + the resulting string as the <domain>. The <ip> and <sender> + arguments remain the same as current evaluation of check_host(). + + The result of this new evaluation of check_host() is then considered + the result of the current evaluation with the exception that if no + SPF record is found, or if the target-name is malformed, the result + is a "PermError" rather than "None". + + Note that the newly-queried domain may itself specify redirect + processing. + + This facility is intended for use by organizations that wish to apply + the same record to multiple domains. For example: + + la.example.com. TXT "v=spf1 redirect=_spf.example.com" + ny.example.com. TXT "v=spf1 redirect=_spf.example.com" + sf.example.com. TXT "v=spf1 redirect=_spf.example.com" + _spf.example.com. TXT "v=spf1 mx:example.com -all" + + In this example, mail from any of the three domains is described by + the same record. This can be an administrative advantage. + + Note: In general, the domain "A" cannot reliably use a redirect to + another domain "B" not under the same administrative control. Since + the <sender> stays the same, there is no guarantee that the record at + domain "B" will correctly work for mailboxes in domain "A", + especially if domain "B" uses mechanisms involving localparts. An + "include" directive may be more appropriate. + + For clarity, it is RECOMMENDED that any "redirect" modifier appear as + the very last term in a record. + +6.2. exp: Explanation + + explanation = "exp" "=" domain-spec + + If check_host() results in a "Fail" due to a mechanism match (such as + "-all"), and the "exp" modifier is present, then the explanation + string returned is computed as described below. If no "exp" modifier + + + +Wong & Schlitt Experimental [Page 23] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + is present, then either a default explanation string or an empty + explanation string may be returned. + + The <domain-spec> is macro expanded (see Section 8) and becomes the + <target-name>. The DNS TXT record for the <target-name> is fetched. + + If <domain-spec> is empty, or there are any DNS processing errors + (any RCODE other than 0), or if no records are returned, or if more + than one record is returned, or if there are syntax errors in the + explanation string, then proceed as if no exp modifier was given. + + The fetched TXT record's strings are concatenated with no spaces, and + then treated as an <explain-string>, which is macro-expanded. This + final result is the explanation string. Implementations MAY limit + the length of the resulting explanation string to allow for other + protocol constraints and/or reasonable processing limits. Since the + explanation string is intended for an SMTP response and [RFC2821] + Section 2.4 says that responses are in [US-ASCII], the explanation + string is also limited to US-ASCII. + + Software evaluating check_host() can use this string to communicate + information from the publishing domain in the form of a short message + or URL. Software SHOULD make it clear that the explanation string + comes from a third party. For example, it can prepend the macro + string "%{o} explains: " to the explanation, such as shown in Section + 2.5.4. + + Suppose example.com has this record: + + v=spf1 mx -all exp=explain._spf.%{d} + + Here are some examples of possible explanation TXT records at + explain._spf.example.com: + + "Mail from example.com should only be sent by its own servers." + -- a simple, constant message + + "%{i} is not one of %{d}'s designated mail servers." + -- a message with a little more information, including the IP + address that failed the check + + "See http://%{d}/why.html?s=%{S}&i=%{I}" + -- a complicated example that constructs a URL with the + arguments to check_host() so that a web page can be + generated with detailed, custom instructions + + Note: During recursion into an "include" mechanism, an exp= modifier + from the <target-name> MUST NOT be used. In contrast, when executing + + + +Wong & Schlitt Experimental [Page 24] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + a "redirect" modifier, an exp= modifier from the original domain MUST + NOT be used. + +7. The Received-SPF Header Field + + It is RECOMMENDED that SMTP receivers record the result of SPF + processing in the message header. If an SMTP receiver chooses to do + so, it SHOULD use the "Received-SPF" header field defined here for + each identity that was checked. This information is intended for the + recipient. (Information intended for the sender is described in + Section 6.2, Explanation.) + + The Received-SPF header field is a trace field (see [RFC2822] Section + 3.6.7) and SHOULD be prepended to the existing header, above the + Received: field that is generated by the SMTP receiver. It MUST + appear above all other Received-SPF fields in the message. The + header field has the following format: + + header-field = "Received-SPF:" [CFWS] result FWS [comment FWS] + [ key-value-list ] CRLF + + result = "Pass" / "Fail" / "SoftFail" / "Neutral" / + "None" / "TempError" / "PermError" + + key-value-list = key-value-pair *( ";" [CFWS] key-value-pair ) + [";"] + + key-value-pair = key [CFWS] "=" ( dot-atom / quoted-string ) + + key = "client-ip" / "envelope-from" / "helo" / + "problem" / "receiver" / "identity" / + mechanism / "x-" name / name + + identity = "mailfrom" ; for the "MAIL FROM" identity + / "helo" ; for the "HELO" identity + / name ; other identities + + dot-atom = <unquoted word as per [RFC2822]> + quoted-string = <quoted string as per [RFC2822]> + comment = <comment string as per [RFC2822]> + CFWS = <comment or folding white space as per [RFC2822]> + FWS = <folding white space as per [RFC2822]> + CRLF = <standard end-of-line token as per [RFC2822]> + + The header field SHOULD include a "(...)" style <comment> after the + result, conveying supporting information for the result, such as + <ip>, <sender>, and <domain>. + + + + +Wong & Schlitt Experimental [Page 25] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + The following key-value pairs are designed for later machine parsing. + SPF clients SHOULD give enough information so that the SPF results + can be verified. That is, at least "client-ip", "helo", and, if the + "MAIL FROM" identity was checked, "envelope-from". + + client-ip the IP address of the SMTP client + + envelope-from the envelope sender mailbox + + helo the host name given in the HELO or EHLO command + + mechanism the mechanism that matched (if no mechanisms matched, + substitute the word "default") + + problem if an error was returned, details about the error + + receiver the host name of the SPF client + + identity the identity that was checked; see the <identity> ABNF + rule + + Other keys may be defined by SPF clients. Until a new key name + becomes widely accepted, new key names should start with "x-". + + SPF clients MUST make sure that the Received-SPF header field does + not contain invalid characters, is not excessively long, and does not + contain malicious data that has been provided by the sender. + + Examples of various header styles that could be generated are the + following: + + Received-SPF: Pass (mybox.example.org: domain of + myname@example.com designates 192.0.2.1 as permitted sender) + receiver=mybox.example.org; client-ip=192.0.2.1; + envelope-from=<myname@example.com>; helo=foo.example.com; + + Received-SPF: Fail (mybox.example.org: domain of + myname@example.com does not designate + 192.0.2.1 as permitted sender) + identity=mailfrom; client-ip=192.0.2.1; + envelope-from=<myname@example.com>; + + + + + + + + + + +Wong & Schlitt Experimental [Page 26] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + +8. Macros + +8.1. Macro Definitions + + Many mechanisms and modifiers perform macro expansion on part of the + term. + + domain-spec = macro-string domain-end + domain-end = ( "." toplabel [ "." ] ) / macro-expand + + toplabel = ( *alphanum ALPHA *alphanum ) / + ( 1*alphanum "-" *( alphanum / "-" ) alphanum ) + ; LDH rule plus additional TLD restrictions + ; (see [RFC3696], Section 2) + alphanum = ALPHA / DIGIT + + explain-string = *( macro-string / SP ) + + macro-string = *( macro-expand / macro-literal ) + macro-expand = ( "%{" macro-letter transformers *delimiter "}" ) + / "%%" / "%_" / "%-" + macro-literal = %x21-24 / %x26-7E + ; visible characters except "%" + macro-letter = "s" / "l" / "o" / "d" / "i" / "p" / "h" / + "c" / "r" / "t" + transformers = *DIGIT [ "r" ] + delimiter = "." / "-" / "+" / "," / "/" / "_" / "=" + + A literal "%" is expressed by "%%". + + "%_" expands to a single " " space. + "%-" expands to a URL-encoded space, viz., "%20". + + The following macro letters are expanded in term arguments: + + s = <sender> + l = local-part of <sender> + o = domain of <sender> + d = <domain> + i = <ip> + p = the validated domain name of <ip> + v = the string "in-addr" if <ip> is ipv4, or "ip6" if <ip> is ipv6 + h = HELO/EHLO domain + + + + + + + + +Wong & Schlitt Experimental [Page 27] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + The following macro letters are allowed only in "exp" text: + + c = SMTP client IP (easily readable format) + r = domain name of host performing the check + t = current timestamp + + A '%' character not followed by a '{', '%', '-', or '_' character is + a syntax error. So + + -exists:%(ir).sbl.spamhaus.example.org + + is incorrect and will cause check_host() to return a "PermError". + Instead, say + + -exists:%{ir}.sbl.spamhaus.example.org + + Optional transformers are the following: + + *DIGIT = zero or more digits + 'r' = reverse value, splitting on dots by default + + If transformers or delimiters are provided, the replacement value for + a macro letter is split into parts. After performing any reversal + operation and/or removal of left-hand parts, the parts are rejoined + using "." and not the original splitting characters. + + By default, strings are split on "." (dots). Note that no special + treatment is given to leading, trailing, or consecutive delimiters, + and so the list of parts may contain empty strings. Older + implementations of SPF prohibit trailing dots in domain names, so + trailing dots should not be published by domain owners, although they + must be accepted by implementations conforming to this document. + Macros may specify delimiter characters that are used instead of ".". + + The 'r' transformer indicates a reversal operation: if the client IP + address were 192.0.2.1, the macro %{i} would expand to "192.0.2.1" + and the macro %{ir} would expand to "1.2.0.192". + + The DIGIT transformer indicates the number of right-hand parts to + use, after optional reversal. If a DIGIT is specified, the value + MUST be nonzero. If no DIGITs are specified, or if the value + specifies more parts than are available, all the available parts are + used. If the DIGIT was 5, and only 3 parts were available, the macro + interpreter would pretend the DIGIT was 3. Implementations MUST + support at least a value of 128, as that is the maximum number of + labels in a domain name. + + + + + +Wong & Schlitt Experimental [Page 28] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + The "s" macro expands to the <sender> argument. It is an E-Mail + address with a localpart, an "@" character, and a domain. The "l" + macro expands to just the localpart. The "o" macro expands to just + the domain part. Note that these values remain the same during + recursive and chained evaluations due to "include" and/or "redirect". + Note also that if the original <sender> had no localpart, the + localpart was set to "postmaster" in initial processing (see Section + 4.3). + + For IPv4 addresses, both the "i" and "c" macros expand to the + standard dotted-quad format. + + For IPv6 addresses, the "i" macro expands to a dot-format address; it + is intended for use in %{ir}. The "c" macro may expand to any of the + hexadecimal colon-format addresses specified in [RFC3513], Section + 2.2. It is intended for humans to read. + + The "p" macro expands to the validated domain name of <ip>. The + procedure for finding the validated domain name is defined in Section + 5.5. If the <domain> is present in the list of validated domains, it + SHOULD be used. Otherwise, if a subdomain of the <domain> is + present, it SHOULD be used. Otherwise, any name from the list may be + used. If there are no validated domain names or if a DNS error + occurs, the string "unknown" is used. + + The "r" macro expands to the name of the receiving MTA. This SHOULD + be a fully qualified domain name, but if one does not exist (as when + the checking is done by a MUA) or if policy restrictions dictate + otherwise, the word "unknown" SHOULD be substituted. The domain name + may be different from the name found in the MX record that the client + MTA used to locate the receiving MTA. + + The "t" macro expands to the decimal representation of the + approximate number of seconds since the Epoch (Midnight, January 1, + 1970, UTC). This is the same value as is returned by the POSIX + time() function in most standards-compliant libraries. + + When the result of macro expansion is used in a domain name query, if + the expanded domain name exceeds 253 characters (the maximum length + of a domain name), the left side is truncated to fit, by removing + successive domain labels until the total length does not exceed 253 + characters. + + Uppercased macros expand exactly as their lowercased equivalents, and + are then URL escaped. URL escaping must be performed for characters + not in the "uric" set, which is defined in [RFC3986]. + + + + + +Wong & Schlitt Experimental [Page 29] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + Note: Care must be taken so that macro expansion for legitimate + E-Mail does not exceed the 63-character limit on DNS labels. The + localpart of E-Mail addresses, in particular, can have more than 63 + characters between dots. + + Note: Domains should avoid using the "s", "l", "o", or "h" macros in + conjunction with any mechanism directive. Although these macros are + powerful and allow per-user records to be published, they severely + limit the ability of implementations to cache results of check_host() + and they reduce the effectiveness of DNS caches. + + Implementations should be aware that if no directive processed during + the evaluation of check_host() contains an "s", "l", "o", or "h" + macro, then the results of the evaluation can be cached on the basis + of <domain> and <ip> alone for as long as the shortest Time To Live + (TTL) of all the DNS records involved. + +8.2. Expansion Examples + + The <sender> is strong-bad@email.example.com. + The IPv4 SMTP client IP is 192.0.2.3. + The IPv6 SMTP client IP is 2001:DB8::CB01. + The PTR domain name of the client IP is mx.example.org. + + macro expansion + ------- ---------------------------- + %{s} strong-bad@email.example.com + %{o} email.example.com + %{d} email.example.com + %{d4} email.example.com + %{d3} email.example.com + %{d2} example.com + %{d1} com + %{dr} com.example.email + %{d2r} example.email + %{l} strong-bad + %{l-} strong.bad + %{lr} strong-bad + %{lr-} bad.strong + %{l1r-} strong + + + + + + + + + + + +Wong & Schlitt Experimental [Page 30] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + macro-string expansion + -------------------------------------------------------------------- + %{ir}.%{v}._spf.%{d2} 3.2.0.192.in-addr._spf.example.com + %{lr-}.lp._spf.%{d2} bad.strong.lp._spf.example.com + + %{lr-}.lp.%{ir}.%{v}._spf.%{d2} + bad.strong.lp.3.2.0.192.in-addr._spf.example.com + + %{ir}.%{v}.%{l1r-}.lp._spf.%{d2} + 3.2.0.192.in-addr.strong.lp._spf.example.com + + %{d2}.trusted-domains.example.net + example.com.trusted-domains.example.net + + IPv6: + %{ir}.%{v}._spf.%{d2} 1.0.B.C.0.0.0.0. + 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.B.D.0.1.0.0.2.ip6._spf.example.com + +9. Implications + + This section outlines the major implications that adoption of this + document will have on various entities involved in Internet E-Mail. + It is intended to make clear to the reader where this document + knowingly affects the operation of such entities. This section is + not a "how-to" manual, or a "best practices" document, and it is not + a comprehensive list of what such entities should do in light of this + document. + + This section is non-normative. + +9.1. Sending Domains + + Domains that wish to be compliant with this specification will need + to determine the list of hosts that they allow to use their domain + name in the "HELO" and "MAIL FROM" identities. It is recognized that + forming such a list is not just a simple technical exercise, but + involves policy decisions with both technical and administrative + considerations. + + It can be helpful to publish records that include a "tracking + exists:" mechanism. By looking at the name server logs, a rough list + may then be generated. For example: + + v=spf1 exists:_h.%{h}._l.%{l}._o.%{o}._i.%{i}._spf.%{d} ?all + + + + + + + +Wong & Schlitt Experimental [Page 31] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + +9.2. Mailing Lists + + Mailing lists must be aware of how they re-inject mail that is sent + to the list. Mailing lists MUST comply with the requirements in + [RFC2821], Section 3.10, and [RFC1123], Section 5.3.6, that say that + the reverse-path MUST be changed to be the mailbox of a person or + other entity who administers the list. Whereas the reasons for + changing the reverse-path are many and long-standing, SPF adds + enforcement to this requirement. + + In practice, almost all mailing list software in use already complies + with this requirement. Mailing lists that do not comply may or may + not encounter problems depending on how access to the list is + restricted. Such lists that are entirely internal to a domain (only + people in the domain can send to or receive from the list) are not + affected. + +9.3. Forwarding Services and Aliases + + Forwarding services take mail that is received at a mailbox and + direct it to some external mailbox. At the time of this writing, the + near-universal practice of such services is to use the original "MAIL + FROM" of a message when re-injecting it for delivery to the external + mailbox. [RFC1123] and [RFC2821] describe this action as an "alias" + rather than a "mail list". This means that the external mailbox's + MTA sees all such mail in a connection from a host of the forwarding + service, and so the "MAIL FROM" identity will not, in general, pass + authorization. + + There are three places that techniques can be used to ameliorate this + problem. + + 1. The beginning, when E-Mail is first sent. + + 1. "Neutral" results could be given for IP addresses that may be + forwarders, instead of "Fail" results. For example: + + "v=spf1 mx -exists:%{ir}.sbl.spamhaus.example.org ?all" + + This would cause a lookup on an anti-spam DNS blacklist + (DNSBL) and cause a result of "Fail" only for E-Mail coming + from listed sources. All other E-Mail, including E-Mail sent + through forwarders, would receive a "Neutral" result. By + checking the DNSBL after the known good sources, problems with + incorrect listing on the DNSBL are greatly reduced. + + + + + + +Wong & Schlitt Experimental [Page 32] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + 2. The "MAIL FROM" identity could have additional information in + the localpart that cryptographically identifies the mail as + coming from an authorized source. In this case, such an SPF + record could be used: + + "v=spf1 mx exists:%{l}._spf_verify.%{d} -all" + + Then, a specialized DNS server can be set up to serve the + _spf_verify subdomain that validates the localpart. Although + this requires an extra DNS lookup, this happens only when the + E-Mail would otherwise be rejected as not coming from a known + good source. + + Note that due to the 63-character limit for domain labels, + this approach only works reliably if the localpart signature + scheme is guaranteed either to only produce localparts with a + maximum of 63 characters or to gracefully handle truncated + localparts. + + 3. Similarly, a specialized DNS server could be set up that will + rate-limit the E-Mail coming from unexpected IP addresses. + + "v=spf1 mx exists:%{ir}._spf_rate.%{d} -all" + + 4. SPF allows the creation of per-user policies for special + cases. For example, the following SPF record and appropriate + wildcard DNS records can be used: + + "v=spf1 mx redirect=%{l1r+}._at_.%{o}._spf.%{d}" + + 2. The middle, when E-Mail is forwarded. + + 1. Forwarding services can solve the problem by rewriting the + "MAIL FROM" to be in their own domain. This means that mail + bounced from the external mailbox will have to be re-bounced + by the forwarding service. Various schemes to do this exist + though they vary widely in complexity and resource + requirements on the part of the forwarding service. + + 2. Several popular MTAs can be forced from "alias" semantics to + "mailing list" semantics by configuring an additional alias + with "owner-" prepended to the original alias name (e.g., an + alias of "friends: george@example.com, fred@example.org" would + need another alias of the form "owner-friends: localowner"). + + + + + + + +Wong & Schlitt Experimental [Page 33] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + 3. The end, when E-Mail is received. + + 1. If the owner of the external mailbox wishes to trust the + forwarding service, he can direct the external mailbox's MTA + to skip SPF tests when the client host belongs to the + forwarding service. + + 2. Tests against other identities, such as the "HELO" identity, + may be used to override a failed test against the "MAIL FROM" + identity. + + 3. For larger domains, it may not be possible to have a complete + or accurate list of forwarding services used by the owners of + the domain's mailboxes. In such cases, whitelists of + generally-recognized forwarding services could be employed. + +9.4. Mail Services + + Service providers that offer mail services to third-party domains, + such as sending of bulk mail, may want to adjust their setup in light + of the authorization check described in this document. If the "MAIL + FROM" identity used for such E-Mail uses the domain of the service + provider, then the provider needs only to ensure that its sending + host is authorized by its own SPF record, if any. + + If the "MAIL FROM" identity does not use the mail service provider's + domain, then extra care must be taken. The SPF record format has + several options for the third-party domain to authorize the service + provider's MTAs to send mail on its behalf. For mail service + providers, such as ISPs, that have a wide variety of customers using + the same MTA, steps should be taken to prevent cross-customer forgery + (see Section 10.4). + +9.5. MTA Relays + + The authorization check generally precludes the use of arbitrary MTA + relays between sender and receiver of an E-Mail message. + + Within an organization, MTA relays can be effectively deployed. + However, for purposes of this document, such relays are effectively + transparent. The SPF authorization check is a check between border + MTAs of different domains. + + For mail senders, this means that published SPF records must + authorize any MTAs that actually send across the Internet. Usually, + these are just the border MTAs as internal MTAs simply forward mail + to these MTAs for delivery. + + + + +Wong & Schlitt Experimental [Page 34] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + Mail receivers will generally want to perform the authorization check + at the border MTAs, specifically including all secondary MXs. This + allows mail that fails to be rejected during the SMTP session rather + than bounced. Internal MTAs then do not perform the authorization + test. To perform the authorization test other than at the border, + the host that first transferred the message to the organization must + be determined, which can be difficult to extract from the message + header. Testing other than at the border is not recommended. + +10. Security Considerations + +10.1. Processing Limits + + As with most aspects of E-Mail, there are a number of ways that + malicious parties could use the protocol as an avenue for a + Denial-of-Service (DoS) attack. The processing limits outlined here + are designed to prevent attacks such as the following: + + o A malicious party could create an SPF record with many references + to a victim's domain and send many E-Mails to different SPF + clients; those SPF clients would then create a DoS attack. In + effect, the SPF clients are being used to amplify the attacker's + bandwidth by using fewer bytes in the SMTP session than are used + by the DNS queries. Using SPF clients also allows the attacker to + hide the true source of the attack. + + o Whereas implementations of check_host() are supposed to limit the + number of DNS lookups, malicious domains could publish records + that exceed these limits in an attempt to waste computation effort + at their targets when they send them mail. Malicious domains + could also design SPF records that cause particular + implementations to use excessive memory or CPU usage, or to + trigger bugs. + + o Malicious parties could send a large volume of mail purporting to + come from the intended target to a wide variety of legitimate mail + hosts. These legitimate machines would then present a DNS load on + the target as they fetched the relevant records. + + Of these, the case of a third party referenced in the SPF record is + the easiest for a DoS attack to effectively exploit. As a result, + limits that may seem reasonable for an individual mail server can + still allow an unreasonable amount of bandwidth amplification. + Therefore, the processing limits need to be quite low. + + SPF implementations MUST limit the number of mechanisms and modifiers + that do DNS lookups to at most 10 per SPF check, including any + lookups caused by the use of the "include" mechanism or the + + + +Wong & Schlitt Experimental [Page 35] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + "redirect" modifier. If this number is exceeded during a check, a + PermError MUST be returned. The "include", "a", "mx", "ptr", and + "exists" mechanisms as well as the "redirect" modifier do count + against this limit. The "all", "ip4", and "ip6" mechanisms do not + require DNS lookups and therefore do not count against this limit. + The "exp" modifier does not count against this limit because the DNS + lookup to fetch the explanation string occurs after the SPF record + has been evaluated. + + When evaluating the "mx" and "ptr" mechanisms, or the %{p} macro, + there MUST be a limit of no more than 10 MX or PTR RRs looked up and + checked. + + SPF implementations SHOULD limit the total amount of data obtained + from the DNS queries. For example, when DNS over TCP or EDNS0 are + available, there may need to be an explicit limit to how much data + will be accepted to prevent excessive bandwidth usage or memory usage + and DoS attacks. + + MTAs or other processors MAY also impose a limit on the maximum + amount of elapsed time to evaluate check_host(). Such a limit SHOULD + allow at least 20 seconds. If such a limit is exceeded, the result + of authorization SHOULD be "TempError". + + Domains publishing records SHOULD try to keep the number of "include" + mechanisms and chained "redirect" modifiers to a minimum. Domains + SHOULD also try to minimize the amount of other DNS information + needed to evaluate a record. This can be done by choosing directives + that require less DNS information and placing lower-cost mechanisms + earlier in the SPF record. + + For example, consider a domain set up as follows: + + example.com. IN MX 10 mx.example.com. + mx.example.com. IN A 192.0.2.1 + a.example.com. IN TXT "v=spf1 mx:example.com -all" + b.example.com. IN TXT "v=spf1 a:mx.example.com -all" + c.example.com. IN TXT "v=spf1 ip4:192.0.2.1 -all" + + Evaluating check_host() for the domain "a.example.com" requires the + MX records for "example.com", and then the A records for the listed + hosts. Evaluating for "b.example.com" requires only the A records. + Evaluating for "c.example.com" requires none. + + However, there may be administrative considerations: using "a" over + "ip4" allows hosts to be renumbered easily. Using "mx" over "a" + allows the set of mail hosts to be changed easily. + + + + +Wong & Schlitt Experimental [Page 36] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + +10.2. SPF-Authorized E-Mail May Contain Other False Identities + + The "MAIL FROM" and "HELO" identity authorizations must not be + construed to provide more assurance than they do. It is entirely + possible for a malicious sender to inject a message using his own + domain in the identities used by SPF, to have that domain's SPF + record authorize the sending host, and yet the message can easily + list other identities in its header. Unless the user or the MUA + takes care to note that the authorized identity does not match the + other more commonly-presented identities (such as the From: header + field), the user may be lulled into a false sense of security. + +10.3. Spoofed DNS and IP Data + + There are two aspects of this protocol that malicious parties could + exploit to undermine the validity of the check_host() function: + + o The evaluation of check_host() relies heavily on DNS. A malicious + attacker could attack the DNS infrastructure and cause + check_host() to see spoofed DNS data, and then return incorrect + results. This could include returning "Pass" for an <ip> value + where the actual domain's record would evaluate to "Fail". See + [RFC3833] for a description of DNS weaknesses. + + o The client IP address, <ip>, is assumed to be correct. A + malicious attacker could spoof TCP sequence numbers to make mail + appear to come from a permitted host for a domain that the + attacker is impersonating. + +10.4. Cross-User Forgery + + By definition, SPF policies just map domain names to sets of + authorized MTAs, not whole E-Mail addresses to sets of authorized + users. Although the "l" macro (Section 8) provides a limited way to + define individual sets of authorized MTAs for specific E-Mail + addresses, it is generally impossible to verify, through SPF, the use + of specific E-Mail addresses by individual users of the same MTA. + + It is up to mail services and their MTAs to directly prevent + cross-user forgery: based on SMTP AUTH ([RFC2554]), users should be + restricted to using only those E-Mail addresses that are actually + under their control (see [RFC4409], Section 6.1). Another means to + verify the identity of individual users is message cryptography such + as PGP ([RFC2440]) or S/MIME ([RFC3851]). + + + + + + + +Wong & Schlitt Experimental [Page 37] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + +10.5. Untrusted Information Sources + + SPF uses information supplied by third parties, such as the "HELO" + domain name, the "MAIL FROM" address, and SPF records. This + information is then passed to the receiver in the Received-SPF: trace + fields and possibly returned to the client MTA in the form of an SMTP + rejection message. This information must be checked for invalid + characters and excessively long lines. + + When the authorization check fails, an explanation string may be + included in the reject response. Both the sender and the rejecting + receiver need to be aware that the explanation was determined by the + publisher of the SPF record checked and, in general, not the + receiver. The explanation may contain malicious URLs, or it may be + offensive or misleading. + + This is probably less of a concern than it may initially seem since + such messages are returned to the sender, and the explanation strings + come from the sender policy published by the domain in the identity + claimed by that very sender. As long as the DSN is not redirected to + someone other than the actual sender, the only people who see + malicious explanation strings are people whose messages claim to be + from domains that publish such strings in their SPF records. In + practice, DSNs can be misdirected, such as when an MTA accepts an + E-Mail and then later generates a DSN to a forged address, or when an + E-Mail forwarder does not direct the DSN back to the original sender. + +10.6. Privacy Exposure + + Checking SPF records causes DNS queries to be sent to the domain + owner. These DNS queries, especially if they are caused by the + "exists" mechanism, can contain information about who is sending + E-Mail and likely to which MTA the E-Mail is being sent. This can + introduce some privacy concerns, which may be more or less of an + issue depending on local laws and the relationship between the domain + owner and the person sending the E-Mail. + +11. Contributors and Acknowledgements + + This document is largely based on the work of Meng Weng Wong and Mark + Lentczner. Although, as this section acknowledges, many people have + contributed to this document, a very large portion of the writing and + editing are due to Meng and Mark. + + This design owes a debt of parentage to [RMX] by Hadmut Danisch and + to [DMP] by Gordon Fecyk. The idea of using a DNS record to check + the legitimacy of an E-Mail address traces its ancestry further back + through messages on the namedroppers mailing list by Paul Vixie + + + +Wong & Schlitt Experimental [Page 38] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + [Vixie] (based on suggestion by Jim Miller) and by David Green + [Green]. + + Philip Gladstone contributed the concept of macros to the + specification, multiplying the expressiveness of the language and + making per-user and per-IP lookups possible. + + The authors would also like to thank the literally hundreds of + individuals who have participated in the development of this design. + They are far too numerous to name, but they include the following: + + The folks on the spf-discuss mailing list. + The folks on the SPAM-L mailing list. + The folks on the IRTF ASRG mailing list. + The folks on the IETF MARID mailing list. + The folks on #perl. + +12. IANA Considerations + +12.1. The SPF DNS Record Type + + The IANA has assigned a new Resource Record Type and Qtype from the + DNS Parameters Registry for the SPF RR type with code 99. + +12.2. The Received-SPF Mail Header Field + + Per [RFC3864], the "Received-SPF:" header field is added to the IANA + Permanent Message Header Field Registry. The following is the + registration template: + + Header field name: Received-SPF + Applicable protocol: mail ([RFC2822]) + Status: Experimental + Author/Change controller: IETF + Specification document(s): RFC 4408 + Related information: + Requesting SPF Council review of any proposed changes and + additions to this field are recommended. For information about + the SPF Council see http://www.openspf.org/Council + +13. References + +13.1. Normative References + + [RFC1035] Mockapetris, P., "Domain names - implementation and + specification", STD 13, RFC 1035, November 1987. + + + + + +Wong & Schlitt Experimental [Page 39] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + [RFC1123] Braden, R., "Requirements for Internet Hosts - Application + and Support", STD 3, RFC 1123, October 1989. + + [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate + Requirement Levels", BCP 14, RFC 2119, March 1997. + + [RFC2821] Klensin, J., "Simple Mail Transfer Protocol", RFC 2821, + April 2001. + + [RFC2822] Resnick, P., "Internet Message Format", RFC 2822, April + 2001. + + [RFC3464] Moore, K. and G. Vaudreuil, "An Extensible Message Format + for Delivery Status Notifications", RFC 3464, January + 2003. + + [RFC3513] Hinden, R. and S. Deering, "Internet Protocol Version 6 + (IPv6) Addressing Architecture", RFC 3513, April 2003. + + [RFC3864] Klyne, G., Nottingham, M., and J. Mogul, "Registration + Procedures for Message Header Fields", BCP 90, RFC 3864, + September 2004. + + [RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform + Resource Identifier (URI): Generic Syntax", STD 66, RFC + 3986, January 2005. + + [RFC4234] Crocker, D. and P. Overell, "Augmented BNF for Syntax + Specifications: ABNF", RFC 4234, October 2005. + + [US-ASCII] American National Standards Institute (formerly United + States of America Standards Institute), "USA Code for + Information Interchange, X3.4", 1968. + + ANSI X3.4-1968 has been replaced by newer versions with slight + modifications, but the 1968 version remains definitive for + the Internet. + +13.2 Informative References + + [RFC1034] Mockapetris, P., "Domain names - concepts and facilities", + STD 13, RFC 1034, November 1987. + + [RFC1983] Malkin, G., "Internet Users' Glossary", RFC 1983, August + 1996. + + [RFC2440] Callas, J., Donnerhacke, L., Finney, H., and R. Thayer, + "OpenPGP Message Format", RFC 2440, November 1998. + + + +Wong & Schlitt Experimental [Page 40] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + [RFC2554] Myers, J., "SMTP Service Extension for Authentication", + RFC 2554, March 1999. + + [RFC3696] Klensin, J., "Application Techniques for Checking and + Transformation of Names", RFC 3696, February 2004. + + [RFC3833] Atkins, D. and R. Austein, "Threat Analysis of the Domain + Name System (DNS)", RFC 3833, August 2004. + + [RFC3851] Ramsdell, B., "Secure/Multipurpose Internet Mail + Extensions (S/MIME) Version 3.1 Message Specification", + RFC 3851, July 2004. + + [RFC4409] Gellens, R. and J. Klensin, "Message Submission for Mail", + RFC 4409, April 2006. + + [RMX] Danish, H., "The RMX DNS RR Type for light weight sender + authentication", Work In Progress + + [DMP] Fecyk, G., "Designated Mailers Protocol", Work In Progress + + [Vixie] Vixie, P., "Repudiating MAIL FROM", 2002. + + [Green] Green, D., "Domain-Authorized SMTP Mail", 2002. + + + + + + + + + + + + + + + + + + + + + + + + + + + +Wong & Schlitt Experimental [Page 41] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + +Appendix A. Collected ABNF + + This section is normative and any discrepancies with the ABNF + fragments in the preceding text are to be resolved in favor of this + grammar. + + See [RFC4234] for ABNF notation. Please note that as per this ABNF + definition, literal text strings (those in quotes) are case- + insensitive. Hence, "mx" matches "mx", "MX", "mX", and "Mx". + + record = version terms *SP + version = "v=spf1" + + terms = *( 1*SP ( directive / modifier ) ) + + directive = [ qualifier ] mechanism + qualifier = "+" / "-" / "?" / "~" + mechanism = ( all / include + / A / MX / PTR / IP4 / IP6 / exists ) + + all = "all" + include = "include" ":" domain-spec + A = "a" [ ":" domain-spec ] [ dual-cidr-length ] + MX = "mx" [ ":" domain-spec ] [ dual-cidr-length ] + PTR = "ptr" [ ":" domain-spec ] + IP4 = "ip4" ":" ip4-network [ ip4-cidr-length ] + IP6 = "ip6" ":" ip6-network [ ip6-cidr-length ] + exists = "exists" ":" domain-spec + + modifier = redirect / explanation / unknown-modifier + redirect = "redirect" "=" domain-spec + explanation = "exp" "=" domain-spec + unknown-modifier = name "=" macro-string + + ip4-cidr-length = "/" 1*DIGIT + ip6-cidr-length = "/" 1*DIGIT + dual-cidr-length = [ ip4-cidr-length ] [ "/" ip6-cidr-length ] + + ip4-network = qnum "." qnum "." qnum "." qnum + qnum = DIGIT ; 0-9 + / %x31-39 DIGIT ; 10-99 + / "1" 2DIGIT ; 100-199 + / "2" %x30-34 DIGIT ; 200-249 + / "25" %x30-35 ; 250-255 + ; conventional dotted quad notation. e.g., 192.0.2.0 + ip6-network = <as per [RFC 3513], section 2.2> + ; e.g., 2001:DB8::CD30 + + + + +Wong & Schlitt Experimental [Page 42] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + domain-spec = macro-string domain-end + domain-end = ( "." toplabel [ "." ] ) / macro-expand + toplabel = ( *alphanum ALPHA *alphanum ) / + ( 1*alphanum "-" *( alphanum / "-" ) alphanum ) + ; LDH rule plus additional TLD restrictions + ; (see [RFC3696], Section 2) + + alphanum = ALPHA / DIGIT + + explain-string = *( macro-string / SP ) + + macro-string = *( macro-expand / macro-literal ) + macro-expand = ( "%{" macro-letter transformers *delimiter "}" ) + / "%%" / "%_" / "%-" + macro-literal = %x21-24 / %x26-7E + ; visible characters except "%" + macro-letter = "s" / "l" / "o" / "d" / "i" / "p" / "h" / + "c" / "r" / "t" + transformers = *DIGIT [ "r" ] + delimiter = "." / "-" / "+" / "," / "/" / "_" / "=" + + name = ALPHA *( ALPHA / DIGIT / "-" / "_" / "." ) + + header-field = "Received-SPF:" [CFWS] result FWS [comment FWS] + [ key-value-list ] CRLF + + result = "Pass" / "Fail" / "SoftFail" / "Neutral" / + "None" / "TempError" / "PermError" + + key-value-list = key-value-pair *( ";" [CFWS] key-value-pair ) + [";"] + + key-value-pair = key [CFWS] "=" ( dot-atom / quoted-string ) + + key = "client-ip" / "envelope-from" / "helo" / + "problem" / "receiver" / "identity" / + mechanism / "x-" name / name + + identity = "mailfrom" ; for the "MAIL FROM" identity + / "helo" ; for the "HELO" identity + / name ; other identities + + dot-atom = <unquoted word as per [RFC2822]> + quoted-string = <quoted string as per [RFC2822]> + comment = <comment string as per [RFC2822]> + CFWS = <comment or folding white space as per [RFC2822]> + FWS = <folding white space as per [RFC2822]> + CRLF = <standard end-of-line token as per [RFC2822]> + + + +Wong & Schlitt Experimental [Page 43] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + +Appendix B. Extended Examples + + These examples are based on the following DNS setup: + + ; A domain with two mail servers, two hosts + ; and two servers at the domain name + $ORIGIN example.com. + @ MX 10 mail-a + MX 20 mail-b + A 192.0.2.10 + A 192.0.2.11 + amy A 192.0.2.65 + bob A 192.0.2.66 + mail-a A 192.0.2.129 + mail-b A 192.0.2.130 + www CNAME example.com. + + ; A related domain + $ORIGIN example.org. + @ MX 10 mail-c + mail-c A 192.0.2.140 + + ; The reverse IP for those addresses + $ORIGIN 2.0.192.in-addr.arpa. + 10 PTR example.com. + 11 PTR example.com. + 65 PTR amy.example.com. + 66 PTR bob.example.com. + 129 PTR mail-a.example.com. + 130 PTR mail-b.example.com. + 140 PTR mail-c.example.org. + + ; A rogue reverse IP domain that claims to be + ; something it's not + $ORIGIN 0.0.10.in-addr.arpa. + 4 PTR bob.example.com. + +B.1. Simple Examples + + These examples show various possible published records for + example.com and which values if <ip> would cause check_host() to + return "Pass". Note that <domain> is "example.com". + + v=spf1 +all + -- any <ip> passes + + v=spf1 a -all + -- hosts 192.0.2.10 and 192.0.2.11 pass + + + +Wong & Schlitt Experimental [Page 44] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + + v=spf1 a:example.org -all + -- no sending hosts pass since example.org has no A records + + v=spf1 mx -all + -- sending hosts 192.0.2.129 and 192.0.2.130 pass + + v=spf1 mx:example.org -all + -- sending host 192.0.2.140 passes + + v=spf1 mx mx:example.org -all + -- sending hosts 192.0.2.129, 192.0.2.130, and 192.0.2.140 pass + + v=spf1 mx/30 mx:example.org/30 -all + -- any sending host in 192.0.2.128/30 or 192.0.2.140/30 passes + + v=spf1 ptr -all + -- sending host 192.0.2.65 passes (reverse DNS is valid and is in + example.com) + -- sending host 192.0.2.140 fails (reverse DNS is valid, but not + in example.com) + -- sending host 10.0.0.4 fails (reverse IP is not valid) + + v=spf1 ip4:192.0.2.128/28 -all + -- sending host 192.0.2.65 fails + -- sending host 192.0.2.129 passes + +B.2. Multiple Domain Example + + These examples show the effect of related records: + + example.org: "v=spf1 include:example.com include:example.net -all" + + This record would be used if mail from example.org actually came + through servers at example.com and example.net. Example.org's + designated servers are the union of example.com's and example.net's + designated servers. + + la.example.org: "v=spf1 redirect=example.org" + ny.example.org: "v=spf1 redirect=example.org" + sf.example.org: "v=spf1 redirect=example.org" + + These records allow a set of domains that all use the same mail + system to make use of that mail system's record. In this way, only + the mail system's record needs to be updated when the mail setup + changes. These domains' records never have to change. + + + + + + +Wong & Schlitt Experimental [Page 45] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + +B.3. DNSBL Style Example + + Imagine that, in addition to the domain records listed above, there + are these: + + $ORIGIN _spf.example.com. mary.mobile-users A + 127.0.0.2 fred.mobile-users A 127.0.0.2 + 15.15.168.192.joel.remote-users A 127.0.0.2 + 16.15.168.192.joel.remote-users A 127.0.0.2 + + The following records describe users at example.com who mail from + arbitrary servers, or who mail from personal servers. + + example.com: + + v=spf1 mx + include:mobile-users._spf.%{d} + include:remote-users._spf.%{d} + -all + + mobile-users._spf.example.com: + + v=spf1 exists:%{l1r+}.%{d} + + remote-users._spf.example.com: + + v=spf1 exists:%{ir}.%{l1r+}.%{d} + +B.4. Multiple Requirements Example + + Say that your sender policy requires both that the IP address is + within a certain range and that the reverse DNS for the IP matches. + This can be done several ways, including the following: + + example.com. SPF ( "v=spf1 " + "-include:ip4._spf.%{d} " + "-include:ptr._spf.%{d} " + "+all" ) + ip4._spf.example.com. SPF "v=spf1 -ip4:192.0.2.0/24 +all" + ptr._spf.example.com. SPF "v=spf1 -ptr +all" + + This example shows how the "-include" mechanism can be useful, how an + SPF record that ends in "+all" can be very restrictive, and the use + of De Morgan's Law. + + + + + + + +Wong & Schlitt Experimental [Page 46] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + +Authors' Addresses + + Meng Weng Wong + Singapore + + EMail: mengwong+spf@pobox.com + + + Wayne Schlitt + 4615 Meredeth #9 + Lincoln Nebraska, NE 68506 + United States of America + + EMail: wayne@schlitt.net + URI: http://www.schlitt.net/spf/ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +Wong & Schlitt Experimental [Page 47] + +RFC 4408 Sender Policy Framework (SPF) April 2006 + + +Full Copyright Statement + + Copyright (C) The Internet Society (2006). + + This document is subject to the rights, licenses and restrictions + contained in BCP 78, and except as set forth therein, the authors + retain all their rights. + + This document and the information contained herein are provided on an + "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS + OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET + ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, + INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE + INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED + WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. + +Intellectual Property + + The IETF takes no position regarding the validity or scope of any + Intellectual Property Rights or other rights that might be claimed to + pertain to the implementation or use of the technology described in + this document or the extent to which any license under such rights + might or might not be available; nor does it represent that it has + made any independent effort to identify any such rights. Information + on the procedures with respect to rights in RFC documents can be + found in BCP 78 and BCP 79. + + Copies of IPR disclosures made to the IETF Secretariat and any + assurances of licenses to be made available, or the result of an + attempt made to obtain a general license or permission for the use of + such proprietary rights by implementers or users of this + specification can be obtained from the IETF on-line IPR repository at + http://www.ietf.org/ipr. + + The IETF invites any interested party to bring to its attention any + copyrights, patents or patent applications, or other proprietary + rights that may cover technology that may be required to implement + this standard. Please address the information to the IETF at + ietf-ipr@ietf.org. + +Acknowledgement + + Funding for the RFC Editor function is provided by the IETF + Administrative Support Activity (IASA). + + + + + + + +Wong & Schlitt Experimental [Page 48] + diff --git a/contrib/bind9/doc/rfc/rfc4470.txt b/contrib/bind9/doc/rfc/rfc4470.txt new file mode 100644 index 0000000..ac12d65 --- /dev/null +++ b/contrib/bind9/doc/rfc/rfc4470.txt @@ -0,0 +1,451 @@ + + + + + + +Network Working Group S. Weiler +Request for Comments: 4470 SPARTA, Inc. +Updates: 4035, 4034 J. Ihren +Category: Standards Track Autonomica AB + April 2006 + + + Minimally Covering NSEC Records and DNSSEC On-line Signing + + +Status of This Memo + + This document specifies an Internet standards track protocol for the + Internet community, and requests discussion and suggestions for + improvements. Please refer to the current edition of the "Internet + Official Protocol Standards" (STD 1) for the standardization state + and status of this protocol. Distribution of this memo is unlimited. + +Copyright Notice + + Copyright (C) The Internet Society (2006). + +Abstract + + This document describes how to construct DNSSEC NSEC resource records + that cover a smaller range of names than called for by RFC 4034. By + generating and signing these records on demand, authoritative name + servers can effectively stop the disclosure of zone contents + otherwise made possible by walking the chain of NSEC records in a + signed zone. + +Table of Contents + + 1. Introduction ....................................................1 + 2. Applicability of This Technique .................................2 + 3. Minimally Covering NSEC Records .................................2 + 4. Better Epsilon Functions ........................................4 + 5. Security Considerations .........................................5 + 6. Acknowledgements ................................................6 + 7. Normative References ............................................6 + +1. Introduction + + With DNSSEC [1], an NSEC record lists the next instantiated name in + its zone, proving that no names exist in the "span" between the + NSEC's owner name and the name in the "next name" field. In this + document, an NSEC record is said to "cover" the names between its + owner name and next name. + + + +Weiler & Ihren Standards Track [Page 1] + +RFC 4470 NSEC Epsilon April 2006 + + + Through repeated queries that return NSEC records, it is possible to + retrieve all of the names in the zone, a process commonly called + "walking" the zone. Some zone owners have policies forbidding zone + transfers by arbitrary clients; this side effect of the NSEC + architecture subverts those policies. + + This document presents a way to prevent zone walking by constructing + NSEC records that cover fewer names. These records can make zone + walking take approximately as many queries as simply asking for all + possible names in a zone, making zone walking impractical. Some of + these records must be created and signed on demand, which requires + on-line private keys. Anyone contemplating use of this technique is + strongly encouraged to review the discussion of the risks of on-line + signing in Section 5. + +1.2. Keywords + + The keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", + "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this + document are to be interpreted as described in RFC 2119 [4]. + +2. Applicability of This Technique + + The technique presented here may be useful to a zone owner that wants + to use DNSSEC, is concerned about exposure of its zone contents via + zone walking, and is willing to bear the costs of on-line signing. + + As discussed in Section 5, on-line signing has several security + risks, including an increased likelihood of private keys being + disclosed and an increased risk of denial of service attack. Anyone + contemplating use of this technique is strongly encouraged to review + the discussion of the risks of on-line signing in Section 5. + + Furthermore, at the time this document was published, the DNSEXT + working group was actively working on a mechanism to prevent zone + walking that does not require on-line signing (tentatively called + NSEC3). The new mechanism is likely to expose slightly more + information about the zone than this technique (e.g., the number of + instantiated names), but it may be preferable to this technique. + +3. Minimally Covering NSEC Records + + This mechanism involves changes to NSEC records for instantiated + names, which can still be generated and signed in advance, as well as + the on-demand generation and signing of new NSEC records whenever a + name must be proven not to exist. + + + + + +Weiler & Ihren Standards Track [Page 2] + +RFC 4470 NSEC Epsilon April 2006 + + + In the "next name" field of instantiated names' NSEC records, rather + than list the next instantiated name in the zone, list any name that + falls lexically after the NSEC's owner name and before the next + instantiated name in the zone, according to the ordering function in + RFC 4034 [2] Section 6.1. This relaxes the requirement in Section + 4.1.1 of RFC 4034 that the "next name" field contains the next owner + name in the zone. This change is expected to be fully compatible + with all existing DNSSEC validators. These NSEC records are returned + whenever proving something specifically about the owner name (e.g., + that no resource records of a given type appear at that name). + + Whenever an NSEC record is needed to prove the non-existence of a + name, a new NSEC record is dynamically produced and signed. The new + NSEC record has an owner name lexically before the QNAME but + lexically following any existing name and a "next name" lexically + following the QNAME but before any existing name. + + The generated NSEC record's type bitmap MUST have the RRSIG and NSEC + bits set and SHOULD NOT have any other bits set. This relaxes the + requirement in Section 2.3 of RFC4035 that NSEC RRs not appear at + names that did not exist before the zone was signed. + + The functions to generate the lexically following and proceeding + names need not be perfect or consistent, but the generated NSEC + records must not cover any existing names. Furthermore, this + technique works best when the generated NSEC records cover as few + names as possible. In this document, the functions that generate the + nearby names are called "epsilon" functions, a reference to the + mathematical convention of using the greek letter epsilon to + represent small deviations. + + An NSEC record denying the existence of a wildcard may be generated + in the same way. Since the NSEC record covering a non-existent + wildcard is likely to be used in response to many queries, + authoritative name servers using the techniques described here may + want to pregenerate or cache that record and its corresponding RRSIG. + + For example, a query for an A record at the non-instantiated name + example.com might produce the following two NSEC records, the first + denying the existence of the name example.com and the second denying + the existence of a wildcard: + + exampld.com 3600 IN NSEC example-.com ( RRSIG NSEC ) + + \).com 3600 IN NSEC +.com ( RRSIG NSEC ) + + + + + + +Weiler & Ihren Standards Track [Page 3] + +RFC 4470 NSEC Epsilon April 2006 + + + Before answering a query with these records, an authoritative server + must test for the existence of names between these endpoints. If the + generated NSEC would cover existing names (e.g., exampldd.com or + *bizarre.example.com), a better epsilon function may be used or the + covered name closest to the QNAME could be used as the NSEC owner + name or next name, as appropriate. If an existing name is used as + the NSEC owner name, that name's real NSEC record MUST be returned. + Using the same example, assuming an exampldd.com delegation exists, + this record might be returned from the parent: + + exampldd.com 3600 IN NSEC example-.com ( NS DS RRSIG NSEC ) + + Like every authoritative record in the zone, each generated NSEC + record MUST have corresponding RRSIGs generated using each algorithm + (but not necessarily each DNSKEY) in the zone's DNSKEY RRset, as + described in RFC 4035 [3] Section 2.2. To minimize the number of + signatures that must be generated, a zone may wish to limit the + number of algorithms in its DNSKEY RRset. + +4. Better Epsilon Functions + + Section 6.1 of RFC 4034 defines a strict ordering of DNS names. + Working backward from that definition, it should be possible to + define epsilon functions that generate the immediately following and + preceding names, respectively. This document does not define such + functions. Instead, this section presents functions that come + reasonably close to the perfect ones. As described above, an + authoritative server should still ensure than no generated NSEC + covers any existing name. + + To increment a name, add a leading label with a single null (zero- + value) octet. + + To decrement a name, decrement the last character of the leftmost + label, then fill that label to a length of 63 octets with octets of + value 255. To decrement a null (zero-value) octet, remove the octet + -- if an empty label is left, remove the label. Defining this + function numerically: fill the leftmost label to its maximum length + with zeros (numeric, not ASCII zeros) and subtract one. + + In response to a query for the non-existent name foo.example.com, + these functions produce NSEC records of the following: + + + + + + + + + +Weiler & Ihren Standards Track [Page 4] + +RFC 4470 NSEC Epsilon April 2006 + + + fon\255\255\255\255\255\255\255\255\255\255\255\255\255\255 + \255\255\255\255\255\255\255\255\255\255\255\255\255\255\255 + \255\255\255\255\255\255\255\255\255\255\255\255\255\255\255 + \255\255\255\255\255\255\255\255\255\255\255\255\255\255\255 + \255.example.com 3600 IN NSEC \000.foo.example.com ( NSEC RRSIG ) + + \)\255\255\255\255\255\255\255\255\255\255\255\255\255\255\255 + \255\255\255\255\255\255\255\255\255\255\255\255\255\255\255 + \255\255\255\255\255\255\255\255\255\255\255\255\255\255\255 + \255\255\255\255\255\255\255\255\255\255\255\255\255\255\255 + \255\255.example.com 3600 IN NSEC \000.*.example.com ( NSEC RRSIG ) + + The first of these NSEC RRs proves that no exact match for + foo.example.com exists, and the second proves that there is no + wildcard in example.com. + + Both of these functions are imperfect: they do not take into account + constraints on number of labels in a name nor total length of a name. + As noted in the previous section, though, this technique does not + depend on the use of perfect epsilon functions: it is sufficient to + test whether any instantiated names fall into the span covered by the + generated NSEC and, if so, substitute those instantiated owner names + for the NSEC owner name or next name, as appropriate. + +5. Security Considerations + + This approach requires on-demand generation of RRSIG records. This + creates several new vulnerabilities. + + First, on-demand signing requires that a zone's authoritative servers + have access to its private keys. Storing private keys on well-known + Internet-accessible servers may make them more vulnerable to + unintended disclosure. + + Second, since generation of digital signatures tends to be + computationally demanding, the requirement for on-demand signing + makes authoritative servers vulnerable to a denial of service attack. + + Last, if the epsilon functions are predictable, on-demand signing may + enable a chosen-plaintext attack on a zone's private keys. Zones + using this approach should attempt to use cryptographic algorithms + that are resistant to chosen-plaintext attacks. It is worth noting + that although DNSSEC has a "mandatory to implement" algorithm, that + is a requirement on resolvers and validators -- there is no + requirement that a zone be signed with any given algorithm. + + The success of using minimally covering NSEC records to prevent zone + walking depends greatly on the quality of the epsilon functions + + + +Weiler & Ihren Standards Track [Page 5] + +RFC 4470 NSEC Epsilon April 2006 + + + chosen. An increment function that chooses a name obviously derived + from the next instantiated name may be easily reverse engineered, + destroying the value of this technique. An increment function that + always returns a name close to the next instantiated name is likewise + a poor choice. Good choices of epsilon functions are the ones that + produce the immediately following and preceding names, respectively, + though zone administrators may wish to use less perfect functions + that return more human-friendly names than the functions described in + Section 4 above. + + Another obvious but misguided concern is the danger from synthesized + NSEC records being replayed. It is possible for an attacker to + replay an old but still validly signed NSEC record after a new name + has been added in the span covered by that NSEC, incorrectly proving + that there is no record at that name. This danger exists with DNSSEC + as defined in [3]. The techniques described here actually decrease + the danger, since the span covered by any NSEC record is smaller than + before. Choosing better epsilon functions will further reduce this + danger. + +6. Acknowledgements + + Many individuals contributed to this design. They include, in + addition to the authors of this document, Olaf Kolkman, Ed Lewis, + Peter Koch, Matt Larson, David Blacka, Suzanne Woolf, Jaap Akkerhuis, + Jakob Schlyter, Bill Manning, and Joao Damas. + + In addition, the editors would like to thank Ed Lewis, Scott Rose, + and David Blacka for their careful review of the document. + +7. Normative References + + [1] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, + "DNS Security Introduction and Requirements", RFC 4033, March + 2005. + + [2] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, + "Resource Records for the DNS Security Extensions", RFC 4034, + March 2005. + + [3] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, + "Protocol Modifications for the DNS Security Extensions", RFC + 4035, March 2005. + + [4] Bradner, S., "Key words for use in RFCs to Indicate Requirement + Levels", BCP 14, RFC 2119, March 1997. + + + + + +Weiler & Ihren Standards Track [Page 6] + +RFC 4470 NSEC Epsilon April 2006 + + +Authors' Addresses + + Samuel Weiler + SPARTA, Inc. + 7075 Samuel Morse Drive + Columbia, Maryland 21046 + US + + EMail: weiler@tislabs.com + + + Johan Ihren + Autonomica AB + Bellmansgatan 30 + Stockholm SE-118 47 + Sweden + + EMail: johani@autonomica.se + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +Weiler & Ihren Standards Track [Page 7] + +RFC 4470 NSEC Epsilon April 2006 + + +Full Copyright Statement + + Copyright (C) The Internet Society (2006). + + This document is subject to the rights, licenses and restrictions + contained in BCP 78, and except as set forth therein, the authors + retain all their rights. + + This document and the information contained herein are provided on an + "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS + OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET + ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, + INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE + INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED + WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. + +Intellectual Property + + The IETF takes no position regarding the validity or scope of any + Intellectual Property Rights or other rights that might be claimed to + pertain to the implementation or use of the technology described in + this document or the extent to which any license under such rights + might or might not be available; nor does it represent that it has + made any independent effort to identify any such rights. Information + on the procedures with respect to rights in RFC documents can be + found in BCP 78 and BCP 79. + + Copies of IPR disclosures made to the IETF Secretariat and any + assurances of licenses to be made available, or the result of an + attempt made to obtain a general license or permission for the use of + such proprietary rights by implementers or users of this + specification can be obtained from the IETF on-line IPR repository at + http://www.ietf.org/ipr. + + The IETF invites any interested party to bring to its attention any + copyrights, patents or patent applications, or other proprietary + rights that may cover technology that may be required to implement + this standard. Please address the information to the IETF at + ietf-ipr@ietf.org. + +Acknowledgement + + Funding for the RFC Editor function is provided by the IETF + Administrative Support Activity (IASA). + + + + + + + +Weiler & Ihren Standards Track [Page 8] + diff --git a/contrib/bind9/doc/rfc/rfc4634.txt b/contrib/bind9/doc/rfc/rfc4634.txt new file mode 100644 index 0000000..b672df8 --- /dev/null +++ b/contrib/bind9/doc/rfc/rfc4634.txt @@ -0,0 +1,6051 @@ + + + + + + +Network Working Group D. Eastlake 3rd +Request for Comments: 4634 Motorola Labs +Updates: 3174 T. Hansen +Category: Informational AT&T Labs + July 2006 + + + US Secure Hash Algorithms (SHA and HMAC-SHA) + +Status of This Memo + + This memo provides information for the Internet community. It does + not specify an Internet standard of any kind. Distribution of this + memo is unlimited. + +Copyright Notice + + Copyright (C) The Internet Society (2006). + +Abstract + + The United States of America has adopted a suite of Secure Hash + Algorithms (SHAs), including four beyond SHA-1, as part of a Federal + Information Processing Standard (FIPS), specifically SHA-224 (RFC + 3874), SHA-256, SHA-384, and SHA-512. The purpose of this document + is to make source code performing these hash functions conveniently + available to the Internet community. The sample code supports input + strings of arbitrary bit length. SHA-1's sample code from RFC 3174 + has also been updated to handle input strings of arbitrary bit + length. Most of the text herein was adapted by the authors from FIPS + 180-2. + + Code to perform SHA-based HMACs, with arbitrary bit length text, is + also included. + + + + + + + + + + + + + + + + + +Eastlake 3rd & Hansen Informational [Page 1] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +Table of Contents + + 1. Overview of Contents ............................................3 + 1.1. License ....................................................4 + 2. Notation for Bit Strings and Integers ...........................4 + 3. Operations on Words .............................................5 + 4. Message Padding and Parsing .....................................6 + 4.1. SHA-224 and SHA-256 ........................................7 + 4.2. SHA-384 and SHA-512 ........................................8 + 5. Functions and Constants Used ....................................9 + 5.1. SHA-224 and SHA-256 ........................................9 + 5.2. SHA-384 and SHA-512 .......................................10 + 6. Computing the Message Digest ...................................11 + 6.1. SHA-224 and SHA-256 Initialization ........................11 + 6.2. SHA-224 and SHA-256 Processing ............................11 + 6.3. SHA-384 and SHA-512 Initialization ........................13 + 6.4. SHA-384 and SHA-512 Processing ............................14 + 7. SHA-Based HMACs ................................................15 + 8. C Code for SHAs ................................................15 + 8.1. The .h File ...............................................18 + 8.2. The SHA Code ..............................................24 + 8.2.1. sha1.c .............................................24 + 8.2.2. sha224-256.c .......................................33 + 8.2.3. sha384-512.c .......................................45 + 8.2.4. usha.c .............................................67 + 8.2.5. sha-private.h ......................................72 + 8.3. The HMAC Code .............................................73 + 8.4. The Test Driver ...........................................78 + 9. Security Considerations .......................................106 + 10. Normative References .........................................106 + 11. Informative References .......................................106 + + + + + + + + + + + + + + + + + + + + +Eastlake 3rd & Hansen Informational [Page 2] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +1. Overview of Contents + + NOTE: Much of the text below is taken from [FIPS180-2] and assertions + therein of the security of the algorithms described are made by the + US Government, the author of [FIPS180-2], and not by the authors of + this document. + + The text below specifies Secure Hash Algorithms, SHA-224 [RFC3874], + SHA-256, SHA-384, and SHA-512, for computing a condensed + representation of a message or a data file. (SHA-1 is specified in + [RFC3174].) When a message of any length < 2^64 bits (for SHA-224 + and SHA-256) or < 2^128 bits (for SHA-384 and SHA-512) is input to + one of these algorithms, the result is an output called a message + digest. The message digests range in length from 224 to 512 bits, + depending on the algorithm. Secure hash algorithms are typically + used with other cryptographic algorithms, such as digital signature + algorithms and keyed hash authentication codes, or in the generation + of random numbers [RFC4086]. + + The four algorithms specified in this document are called secure + because it is computationally infeasible to (1) find a message that + corresponds to a given message digest, or (2) find two different + messages that produce the same message digest. Any change to a + message in transit will, with very high probability, result in a + different message digest. This will result in a verification failure + when the secure hash algorithm is used with a digital signature + algorithm or a keyed-hash message authentication algorithm. + + The code provided herein supports input strings of arbitrary bit + length. SHA-1's sample code from [RFC3174] has also been updated to + handle input strings of arbitrary bit length. See Section 1.1 for + license information for this code. + + Section 2 below defines the terminology and functions used as + building blocks to form these algorithms. Section 3 describes the + fundamental operations on words from which these algorithms are + built. Section 4 describes how messages are padded up to an integral + multiple of the required block size and then parsed into blocks. + Section 5 defines the constants and the composite functions used to + specify these algorithms. Section 6 gives the actual specification + for the SHA-224, SHA-256, SHA-384, and SHA-512 functions. Section 7 + provides pointers to the specification of HMAC keyed message + authentication codes based on the SHA algorithms. Section 8 gives + sample code for the SHA algorithms and Section 9 code for SHA-based + HMACs. The SHA-based HMACs will accept arbitrary bit length text. + + + + + + +Eastlake 3rd & Hansen Informational [Page 3] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +1.1. License + + Permission is granted for all uses, commercial and non-commercial, of + the sample code found in Section 8. Royalty free license to use, + copy, modify and distribute the software found in Section 8 is + granted, provided that this document is identified in all material + mentioning or referencing this software, and provided that + redistributed derivative works do not contain misleading author or + version information. + + The authors make no representations concerning either the + merchantability of this software or the suitability of this software + for any particular purpose. It is provided "as is" without express + or implied warranty of any kind. + +2. Notation for Bit Strings and Integers + + The following terminology related to bit strings and integers will be + used: + + a. A hex digit is an element of the set {0, 1, ... , 9, A, ... , + F}. A hex digit is the representation of a 4-bit string. + Examples: 7 = 0111, A = 1010. + + b. A word equals a 32-bit or 64-bit string, which may be + represented as a sequence of 8 or 16 hex digits, respectively. + To convert a word to hex digits, each 4-bit string is converted + to its hex equivalent as described in (a) above. Example: + + 1010 0001 0000 0011 1111 1110 0010 0011 = A103FE23. + + Throughout this document, the "big-endian" convention is used + when expressing both 32-bit and 64-bit words, so that within + each word the most significant bit is shown in the left-most bit + position. + + c. An integer may be represented as a word or pair of words. + + An integer between 0 and 2^32 - 1 inclusive may be represented + as a 32-bit word. The least significant four bits of the + integer are represented by the right-most hex digit of the word + representation. Example: the integer 291 = 2^8+2^5+2^1+2^0 = + 256+32+2+1 is represented by the hex word 00000123. + + The same holds true for an integer between 0 and 2^64-1 + inclusive, which may be represented as a 64-bit word. + + + + + +Eastlake 3rd & Hansen Informational [Page 4] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + If Z is an integer, 0 <= z < 2^64, then z = (2^32)x + y where 0 + <= x < 2^32 and 0 <= y < 2^32. Since x and y can be represented + as words X and Y, respectively, z can be represented as the pair + of words (X,Y). + + d. block = 512-bit or 1024-bit string. A block (e.g., B) may be + represented as a sequence of 32-bit or 64-bit words. + +3. Operations on Words + + The following logical operators will be applied to words in all four + hash operations specified herein. SHA-224 and SHA-256 operate on + 32-bit words, while SHA-384 and SHA-512 operate on 64-bit words. + + In the operations below, x<<n is obtained as follows: discard the + left-most n bits of x and then pad the result with n zeroed bits on + the right (the result will still be the same number of bits). + + a. Bitwise logical word operations + + X AND Y = bitwise logical "and" of X and Y. + + X OR Y = bitwise logical "inclusive-or" of X and Y. + + X XOR Y = bitwise logical "exclusive-or" of X and Y. + + NOT X = bitwise logical "complement" of X. + + Example: + 01101100101110011101001001111011 + XOR 01100101110000010110100110110111 + -------------------------------- + = 00001001011110001011101111001100 + + b. The operation X + Y is defined as follows: words X and Y + represent w-bit integers x and y, where 0 <= x < 2^w and + 0 <= y < 2^w. For positive integers n and m, let + + n mod m + + be the remainder upon dividing n by m. Compute + + z = (x + y) mod 2^w. + + Then 0 <= z < 2^w. Convert z to a word, Z, and define Z = X + + Y. + + + + + +Eastlake 3rd & Hansen Informational [Page 5] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + c. The right shift operation SHR^n(x), where x is a w-bit word and + n is an integer with 0 <= n < w, is defined by + + SHR^n(x) = x>>n + + d. The rotate right (circular right shift) operation ROTR^n(x), + where x is a w-bit word and n is an integer with 0 <= n < w, is + defined by + + ROTR^n(x) = (x>>n) OR (x<<(w-n)) + + e. The rotate left (circular left shift) operation ROTL^n(x), where + x is a w-bit word and n is an integer with 0 <= n < w, is + defined by + + ROTL^n(X) = (x<<n) OR (x>>w-n) + + Note the following equivalence relationships, where w is fixed + in each relationship: + + ROTL^n(x) = ROTR^(w-x)(x) + + ROTR^n(x) = ROTL^(w-n)(x) + +4. Message Padding and Parsing + + The hash functions specified herein are used to compute a message + digest for a message or data file that is provided as input. The + message or data file should be considered to be a bit string. The + length of the message is the number of bits in the message (the empty + message has length 0). If the number of bits in a message is a + multiple of 8, for compactness we can represent the message in hex. + The purpose of message padding is to make the total length of a + padded message a multiple of 512 for SHA-224 and SHA-256 or a + multiple of 1024 for SHA-384 and SHA-512. + + The following specifies how this padding shall be performed. As a + summary, a "1" followed by a number of "0"s followed by a 64-bit or + 128-bit integer are appended to the end of the message to produce a + padded message of length 512*n or 1024*n. The minimum number of "0"s + necessary to meet this criterion is used. The appended integer is + the length of the original message. The padded message is then + processed by the hash function as n 512-bit or 1024-bit blocks. + + + + + + + + +Eastlake 3rd & Hansen Informational [Page 6] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +4.1. SHA-224 and SHA-256 + + Suppose a message has length L < 2^64. Before it is input to the + hash function, the message is padded on the right as follows: + + a. "1" is appended. Example: if the original message is + "01010000", this is padded to "010100001". + + b. K "0"s are appended where K is the smallest, non-negative + solution to the equation + + L + 1 + K = 448 (mod 512) + + c. Then append the 64-bit block that is L in binary representation. + After appending this block, the length of the message will be a + multiple of 512 bits. + + Example: Suppose the original message is the bit string + + 01100001 01100010 01100011 01100100 01100101 + + After step (a), this gives + + 01100001 01100010 01100011 01100100 01100101 1 + + Since L = 40, the number of bits in the above is 41 and K = 407 + "0"s are appended, making the total now 448. This gives the + following in hex: + + 61626364 65800000 00000000 00000000 + 00000000 00000000 00000000 00000000 + 00000000 00000000 00000000 00000000 + 00000000 00000000 + + The 64-bit representation of L = 40 is hex 00000000 00000028. + Hence the final padded message is the following hex: + + 61626364 65800000 00000000 00000000 + 00000000 00000000 00000000 00000000 + 00000000 00000000 00000000 00000000 + 00000000 00000000 00000000 00000028 + + + + + + + + + + +Eastlake 3rd & Hansen Informational [Page 7] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +4.2. SHA-384 and SHA-512 + + Suppose a message has length L < 2^128. Before it is input to the + hash function, the message is padded on the right as follows: + + a. "1" is appended. Example: if the original message is + "01010000", this is padded to "010100001". + + b. K "0"s are appended where K is the smallest, non-negative + solution to the equation + + L + 1 + K = 896 (mod 1024) + + c. Then append the 128-bit block that is L in binary + representation. After appending this block, the length of the + message will be a multiple of 1024 bits. + + Example: Suppose the original message is the bit string + + 01100001 01100010 01100011 01100100 01100101 + + After step (a) this gives + + 01100001 01100010 01100011 01100100 01100101 1 + + Since L = 40, the number of bits in the above is 41 and K = 855 + "0"s are appended, making the total now 896. This gives the + following in hex: + + 61626364 65800000 00000000 00000000 + 00000000 00000000 00000000 00000000 + 00000000 00000000 00000000 00000000 + 00000000 00000000 00000000 00000000 + 00000000 00000000 00000000 00000000 + 00000000 00000000 00000000 00000000 + 00000000 00000000 00000000 00000000 + + The 128-bit representation of L = 40 is hex 00000000 00000000 + 00000000 00000028. Hence the final padded message is the + following hex: + + 61626364 65800000 00000000 00000000 + 00000000 00000000 00000000 00000000 + 00000000 00000000 00000000 00000000 + 00000000 00000000 00000000 00000000 + 00000000 00000000 00000000 00000000 + + + + + +Eastlake 3rd & Hansen Informational [Page 8] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + 00000000 00000000 00000000 00000000 + 00000000 00000000 00000000 00000000 + 00000000 00000000 00000000 00000028 + +5. Functions and Constants Used + + The following subsections give the six logical functions and the + table of constants used in each of the hash functions. + +5.1. SHA-224 and SHA-256 + + SHA-224 and SHA-256 use six logical functions, where each function + operates on 32-bit words, which are represented as x, y, and z. The + result of each function is a new 32-bit word. + + CH( x, y, z) = (x AND y) XOR ( (NOT x) AND z) + + MAJ( x, y, z) = (x AND y) XOR (x AND z) XOR (y AND z) + + BSIG0(x) = ROTR^2(x) XOR ROTR^13(x) XOR ROTR^22(x) + + BSIG1(x) = ROTR^6(x) XOR ROTR^11(x) XOR ROTR^25(x) + + SSIG0(x) = ROTR^7(x) XOR ROTR^18(x) XOR SHR^3(x) + + SSIG1(x) = ROTR^17(x) XOR ROTR^19(x) XOR SHR^10(x) + + SHA-224 and SHA-256 use the same sequence of sixty-four constant + 32-bit words, K0, K1, ..., K63. These words represent the first + thirty-two bits of the fractional parts of the cube roots of the + first sixty-four prime numbers. In hex, these constant words are as + follows (from left to right): + + 428a2f98 71374491 b5c0fbcf e9b5dba5 + 3956c25b 59f111f1 923f82a4 ab1c5ed5 + d807aa98 12835b01 243185be 550c7dc3 + 72be5d74 80deb1fe 9bdc06a7 c19bf174 + e49b69c1 efbe4786 0fc19dc6 240ca1cc + 2de92c6f 4a7484aa 5cb0a9dc 76f988da + 983e5152 a831c66d b00327c8 bf597fc7 + c6e00bf3 d5a79147 06ca6351 14292967 + 27b70a85 2e1b2138 4d2c6dfc 53380d13 + 650a7354 766a0abb 81c2c92e 92722c85 + a2bfe8a1 a81a664b c24b8b70 c76c51a3 + d192e819 d6990624 f40e3585 106aa070 + 19a4c116 1e376c08 2748774c 34b0bcb5 + + + + + +Eastlake 3rd & Hansen Informational [Page 9] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + 391c0cb3 4ed8aa4a 5b9cca4f 682e6ff3 + 748f82ee 78a5636f 84c87814 8cc70208 + 90befffa a4506ceb bef9a3f7 c67178f2 + +5.2. SHA-384 and SHA-512 + + SHA-384 and SHA-512 each use six logical functions, where each + function operates on 64-bit words, which are represented as x, y, and + z. The result of each function is a new 64-bit word. + + CH( x, y, z) = (x AND y) XOR ( (NOT x) AND z) + + MAJ( x, y, z) = (x AND y) XOR (x AND z) XOR (y AND z) + + BSIG0(x) = ROTR^28(x) XOR ROTR^34(x) XOR ROTR^39(x) + + BSIG1(x) = ROTR^14(x) XOR ROTR^18(x) XOR ROTR^41(x) + + SSIG0(x) = ROTR^1(x) XOR ROTR^8(x) XOR SHR^7(x) + + SSIG1(x) = ROTR^19(x) XOR ROTR^61(x) XOR SHR^6(x) + + SHA-384 and SHA-512 use the same sequence of eighty constant 64-bit + words, K0, K1, ... K79. These words represent the first sixty-four + bits of the fractional parts of the cube roots of the first eighty + prime numbers. In hex, these constant words are as follows (from + left to right): + + 428a2f98d728ae22 7137449123ef65cd b5c0fbcfec4d3b2f e9b5dba58189dbbc + 3956c25bf348b538 59f111f1b605d019 923f82a4af194f9b ab1c5ed5da6d8118 + d807aa98a3030242 12835b0145706fbe 243185be4ee4b28c 550c7dc3d5ffb4e2 + 72be5d74f27b896f 80deb1fe3b1696b1 9bdc06a725c71235 c19bf174cf692694 + e49b69c19ef14ad2 efbe4786384f25e3 0fc19dc68b8cd5b5 240ca1cc77ac9c65 + 2de92c6f592b0275 4a7484aa6ea6e483 5cb0a9dcbd41fbd4 76f988da831153b5 + 983e5152ee66dfab a831c66d2db43210 b00327c898fb213f bf597fc7beef0ee4 + c6e00bf33da88fc2 d5a79147930aa725 06ca6351e003826f 142929670a0e6e70 + 27b70a8546d22ffc 2e1b21385c26c926 4d2c6dfc5ac42aed 53380d139d95b3df + 650a73548baf63de 766a0abb3c77b2a8 81c2c92e47edaee6 92722c851482353b + a2bfe8a14cf10364 a81a664bbc423001 c24b8b70d0f89791 c76c51a30654be30 + d192e819d6ef5218 d69906245565a910 f40e35855771202a 106aa07032bbd1b8 + 19a4c116b8d2d0c8 1e376c085141ab53 2748774cdf8eeb99 34b0bcb5e19b48a8 + 391c0cb3c5c95a63 4ed8aa4ae3418acb 5b9cca4f7763e373 682e6ff3d6b2b8a3 + 748f82ee5defb2fc 78a5636f43172f60 84c87814a1f0ab72 8cc702081a6439ec + 90befffa23631e28 a4506cebde82bde9 bef9a3f7b2c67915 c67178f2e372532b + ca273eceea26619c d186b8c721c0c207 eada7dd6cde0eb1e f57d4f7fee6ed178 + 06f067aa72176fba 0a637dc5a2c898a6 113f9804bef90dae 1b710b35131c471b + 28db77f523047d84 32caab7b40c72493 3c9ebe0a15c9bebc 431d67c49c100d4c + 4cc5d4becb3e42b6 597f299cfc657e2a 5fcb6fab3ad6faec 6c44198c4a475817 + + + +Eastlake 3rd & Hansen Informational [Page 10] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +6. Computing the Message Digest + + The output of each of the secure hash functions, after being applied + to a message of N blocks, is the hash quantity H(N). For SHA-224 and + SHA-256, H(i) can be considered to be eight 32-bit words, H(i)0, + H(i)1, ... H(i)7. For SHA-384 and SHA-512, it can be considered to + be eight 64-bit words, H(i)0, H(i)1, ..., H(i)7. + + As described below, the hash words are initialized, modified as each + message block is processed, and finally concatenated after processing + the last block to yield the output. For SHA-256 and SHA-512, all of + the H(N) variables are concatenated while the SHA-224 and SHA-384 + hashes are produced by omitting some from the final concatenation. + +6.1. SHA-224 and SHA-256 Initialization + + For SHA-224, the initial hash value, H(0), consists of the following + 32-bit words in hex: + + H(0)0 = c1059ed8 + H(0)1 = 367cd507 + H(0)2 = 3070dd17 + H(0)3 = f70e5939 + H(0)4 = ffc00b31 + H(0)5 = 68581511 + H(0)6 = 64f98fa7 + H(0)7 = befa4fa4 + + For SHA-256, the initial hash value, H(0), consists of the following + eight 32-bit words, in hex. These words were obtained by taking the + first thirty-two bits of the fractional parts of the square roots of + the first eight prime numbers. + + H(0)0 = 6a09e667 + H(0)1 = bb67ae85 + H(0)2 = 3c6ef372 + H(0)3 = a54ff53a + H(0)4 = 510e527f + H(0)5 = 9b05688c + H(0)6 = 1f83d9ab + H(0)7 = 5be0cd19 + +6.2. SHA-224 and SHA-256 Processing + + SHA-224 and SHA-256 perform identical processing on messages blocks + and differ only in how H(0) is initialized and how they produce their + final output. They may be used to hash a message, M, having a length + of L bits, where 0 <= L < 2^64. The algorithm uses (1) a message + + + +Eastlake 3rd & Hansen Informational [Page 11] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + schedule of sixty-four 32-bit words, (2) eight working variables of + 32 bits each, and (3) a hash value of eight 32-bit words. + + The words of the message schedule are labeled W0, W1, ..., W63. The + eight working variables are labeled a, b, c, d, e, f, g, and h. The + words of the hash value are labeled H(i)0, H(i)1, ..., H(i)7, which + will hold the initial hash value, H(0), replaced by each successive + intermediate hash value (after each message block is processed), + H(i), and ending with the final hash value, H(N), after all N blocks + are processed. They also use two temporary words, T1 and T2. + + The input message is padded as described in Section 4.1 above then + parsed into 512-bit blocks, which are considered to be composed of 16 + 32-bit words M(i)0, M(i)1, ..., M(i)15. The following computations + are then performed for each of the N message blocks. All addition is + performed modulo 2^32. + + For i = 1 to N + + 1. Prepare the message schedule W: + For t = 0 to 15 + Wt = M(i)t + For t = 16 to 63 + Wt = SSIG1(W(t-2)) + W(t-7) + SSIG0(t-15) + W(t-16) + + 2. Initialize the working variables: + a = H(i-1)0 + b = H(i-1)1 + c = H(i-1)2 + d = H(i-1)3 + e = H(i-1)4 + f = H(i-1)5 + g = H(i-1)6 + h = H(i-1)7 + + 3. Perform the main hash computation: + For t = 0 to 63 + T1 = h + BSIG1(e) + CH(e,f,g) + Kt + Wt + T2 = BSIG0(a) + MAJ(a,b,c) + h = g + g = f + f = e + e = d + T1 + d = c + c = b + b = a + a = T1 + T2 + + + + +Eastlake 3rd & Hansen Informational [Page 12] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + 4. Compute the intermediate hash value H(i): + H(i)0 = a + H(i-1)0 + H(i)1 = b + H(i-1)1 + H(i)2 = c + H(i-1)2 + H(i)3 = d + H(i-1)3 + H(i)4 = e + H(i-1)4 + H(i)5 = f + H(i-1)5 + H(i)6 = g + H(i-1)6 + H(i)7 = h + H(i-1)7 + + After the above computations have been sequentially performed for all + of the blocks in the message, the final output is calculated. For + SHA-256, this is the concatenation of all of H(N)0, H(N)1, through + H(N)7. For SHA-224, this is the concatenation of H(N)0, H(N)1, + through H(N)6. + +6.3. SHA-384 and SHA-512 Initialization + + For SHA-384, the initial hash value, H(0), consists of the following + eight 64-bit words, in hex. These words were obtained by taking the + first sixty-four bits of the fractional parts of the square roots of + the ninth through sixteenth prime numbers. + + H(0)0 = cbbb9d5dc1059ed8 + H(0)1 = 629a292a367cd507 + H(0)2 = 9159015a3070dd17 + H(0)3 = 152fecd8f70e5939 + H(0)4 = 67332667ffc00b31 + H(0)5 = 8eb44a8768581511 + H(0)6 = db0c2e0d64f98fa7 + H(0)7 = 47b5481dbefa4fa4 + + For SHA-512, the initial hash value, H(0), consists of the following + eight 64-bit words, in hex. These words were obtained by taking the + first sixty-four bits of the fractional parts of the square roots of + the first eight prime numbers. + + H(0)0 = 6a09e667f3bcc908 + H(0)1 = bb67ae8584caa73b + H(0)2 = 3c6ef372fe94f82b + H(0)3 = a54ff53a5f1d36f1 + H(0)4 = 510e527fade682d1 + H(0)5 = 9b05688c2b3e6c1f + H(0)6 = 1f83d9abfb41bd6b + H(0)7 = 5be0cd19137e2179 + + + + + + +Eastlake 3rd & Hansen Informational [Page 13] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +6.4. SHA-384 and SHA-512 Processing + + SHA-384 and SHA-512 perform identical processing on message blocks + and differ only in how H(0) is initialized and how they produce their + final output. They may be used to hash a message, M, having a length + of L bits, where 0 <= L < 2^128. The algorithm uses (1) a message + schedule of eighty 64-bit words, (2) eight working variables of 64 + bits each, and (3) a hash value of eight 64-bit words. + + The words of the message schedule are labeled W0, W1, ..., W79. The + eight working variables are labeled a, b, c, d, e, f, g, and h. The + words of the hash value are labeled H(i)0, H(i)1, ..., H(i)7, which + will hold the initial hash value, H(0), replaced by each successive + intermediate hash value (after each message block is processed), + H(i), and ending with the final hash value, H(N) after all N blocks + are processed. + + The input message is padded as described in Section 4.2 above, then + parsed into 1024-bit blocks, which are considered to be composed of + 16 64-bit words M(i)0, M(i)1, ..., M(i)15. The following + computations are then performed for each of the N message blocks. + All addition is performed modulo 2^64. + + For i = 1 to N + + 1. Prepare the message schedule W: + For t = 0 to 15 + Wt = M(i)t + For t = 16 to 79 + Wt = SSIG1(W(t-2)) + W(t-7) + SSIG0(t-15) + W(t-16) + + 2. Initialize the working variables: + a = H(i-1)0 + b = H(i-1)1 + c = H(i-1)2 + d = H(i-1)3 + e = H(i-1)4 + f = H(i-1)5 + g = H(i-1)6 + h = H(i-1)7 + + 3. Perform the main hash computation: + For t = 0 to 79 + T1 = h + BSIG1(e) + CH(e,f,g) + Kt + Wt + T2 = BSIG0(a) + MAJ(a,b,c) + h = g + g = f + f = e + + + +Eastlake 3rd & Hansen Informational [Page 14] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + e = d + T1 + d = c + c = b + b = a + a = T1 + T2 + + 4. Compute the intermediate hash value H(i): + H(i)0 = a + H(i-1)0 + H(i)1 = b + H(i-1)1 + H(i)2 = c + H(i-1)2 + H(i)3 = d + H(i-1)3 + H(i)4 = e + H(i-1)4 + H(i)5 = f + H(i-1)5 + H(i)6 = g + H(i-1)6 + H(i)7 = h + H(i-1)7 + + After the above computations have been sequentially performed for all + of the blocks in the message, the final output is calculated. For + SHA-512, this is the concatenation of all of H(N)0, H(N)1, through + H(N)7. For SHA-384, this is the concatenation of H(N)0, H(N)1, + through H(N)5. + +7. SHA-Based HMACs + + HMAC is a method for computing a keyed MAC (message authentication + code) using a hash function as described in [RFC2104]. It uses a key + to mix in with the input text to produce the final hash. + + Sample code is also provided, in Section 8.3 below, to perform HMAC + based on any of the SHA algorithms described herein. The sample code + found in [RFC2104] was written in terms of a specified text size. + Since SHA is defined in terms of an arbitrary number of bits, the + sample HMAC code has been written to allow the text input to HMAC to + have an arbitrary number of octets and bits. A fixed-length + interface is also provided. + +8. C Code for SHAs + + Below is a demonstration implementation of these secure hash + functions in C. Section 8.1 contains the header file sha.h, which + declares all constants, structures, and functions used by the sha and + hmac functions. Section 8.2 contains the C code for sha1.c, + sha224-256.c, sha384-512.c, and usha.c along with sha-private.h, + which provides some declarations common to all the sha functions. + Section 8.3 contains the C code for the hmac functions. Section 8.4 + contains a test driver to exercise the code. + + + + + +Eastlake 3rd & Hansen Informational [Page 15] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + For each of the digest length $$$, there is the following set of + constants, a structure, and functions: + + Constants: + SHA$$$HashSize number of octets in the hash + SHA$$$HashSizeBits number of bits in the hash + SHA$$$_Message_Block_Size + number of octets used in the intermediate + message blocks + shaSuccess = 0 constant returned by each function on success + shaNull = 1 constant returned by each function when + presented with a null pointer parameter + shaInputTooLong = 2 constant returned by each function when the + input data is too long + shaStateError constant returned by each function when + SHA$$$Input is called after SHA$$$FinalBits or + SHA$$$Result. + + Structure: + typedef SHA$$$Context + an opaque structure holding the complete state + for producing the hash + + Functions: + int SHA$$$Reset(SHA$$$Context *); + Reset the hash context state + int SHA$$$Input(SHA$$$Context *, const uint8_t *octets, + unsigned int bytecount); + Incorporate bytecount octets into the hash. + int SHA$$$FinalBits(SHA$$$Context *, const uint8_t octet, + unsigned int bitcount); + Incorporate bitcount bits into the hash. The bits are in + the upper portion of the octet. SHA$$$Input() cannot be + called after this. + int SHA$$$Result(SHA$$$Context *, + uint8_t Message_Digest[SHA$$$HashSize]); + Do the final calculations on the hash and copy the value + into Message_Digest. + + In addition, functions with the prefix USHA are provided that take a + SHAversion value (SHA$$$) to select the SHA function suite. They add + the following constants, structure, and functions: + + Constants: + shaBadParam constant returned by USHA functions when + presented with a bad SHAversion (SHA$$$) + parameter + + + + +Eastlake 3rd & Hansen Informational [Page 16] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + SHA$$$ SHAversion enumeration values, used by usha + and hmac functions to select the SHA function + suite + + Structure: + typedef USHAContext + an opaque structure holding the complete state + for producing the hash + + Functions: + int USHAReset(USHAContext *, SHAversion whichSha); + Reset the hash context state. + int USHAInput(USHAContext *, + const uint8_t *bytes, unsigned int bytecount); + Incorporate bytecount octets into the hash. + int USHAFinalBits(USHAContext *, + const uint8_t bits, unsigned int bitcount); + Incorporate bitcount bits into the hash. + int USHAResult(USHAContext *, + uint8_t Message_Digest[USHAMaxHashSize]); + Do the final calculations on the hash and copy the value + into Message_Digest. Octets in Message_Digest beyond + USHAHashSize(whichSha) are left untouched. + int USHAHashSize(enum SHAversion whichSha); + The number of octets in the given hash. + int USHAHashSizeBits(enum SHAversion whichSha); + The number of bits in the given hash. + int USHABlockSize(enum SHAversion whichSha); + The internal block size for the given hash. + + The hmac functions follow the same pattern to allow any length of + text input to be used. + + Structure: + typedef HMACContext an opaque structure holding the complete state + for producing the hash + + Functions: + int hmacReset(HMACContext *ctx, enum SHAversion whichSha, + const unsigned char *key, int key_len); + Reset the hash context state. + int hmacInput(HMACContext *ctx, const unsigned char *text, + int text_len); + Incorporate text_len octets into the hash. + int hmacFinalBits(HMACContext *ctx, const uint8_t bits, + unsigned int bitcount); + Incorporate bitcount bits into the hash. + + + + +Eastlake 3rd & Hansen Informational [Page 17] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + int hmacResult(HMACContext *ctx, + uint8_t Message_Digest[USHAMaxHashSize]); + Do the final calculations on the hash and copy the value + into Message_Digest. Octets in Message_Digest beyond + USHAHashSize(whichSha) are left untouched. + + In addition, a combined interface is provided, similar to that shown + in RFC 2104, that allows a fixed-length text input to be used. + + int hmac(SHAversion whichSha, + const unsigned char *text, int text_len, + const unsigned char *key, int key_len, + uint8_t Message_Digest[USHAMaxHashSize]); + Calculate the given digest for the given text and key, and + return the resulting hash. Octets in Message_Digest beyond + USHAHashSize(whichSha) are left untouched. + +8.1. The .h File + +/**************************** sha.h ****************************/ +/******************* See RFC 4634 for details ******************/ +#ifndef _SHA_H_ +#define _SHA_H_ + +/* + * Description: + * This file implements the Secure Hash Signature Standard + * algorithms as defined in the National Institute of Standards + * and Technology Federal Information Processing Standards + * Publication (FIPS PUB) 180-1 published on April 17, 1995, 180-2 + * published on August 1, 2002, and the FIPS PUB 180-2 Change + * Notice published on February 28, 2004. + * + * A combined document showing all algorithms is available at + * http://csrc.nist.gov/publications/fips/ + * fips180-2/fips180-2withchangenotice.pdf + * + * The five hashes are defined in these sizes: + * SHA-1 20 byte / 160 bit + * SHA-224 28 byte / 224 bit + * SHA-256 32 byte / 256 bit + * SHA-384 48 byte / 384 bit + * SHA-512 64 byte / 512 bit + */ + +#include <stdint.h> +/* + * If you do not have the ISO standard stdint.h header file, then you + + + +Eastlake 3rd & Hansen Informational [Page 18] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * must typedef the following: + * name meaning + * uint64_t unsigned 64 bit integer + * uint32_t unsigned 32 bit integer + * uint8_t unsigned 8 bit integer (i.e., unsigned char) + * int_least16_t integer of >= 16 bits + * + */ + +#ifndef _SHA_enum_ +#define _SHA_enum_ +/* + * All SHA functions return one of these values. + */ +enum { + shaSuccess = 0, + shaNull, /* Null pointer parameter */ + shaInputTooLong, /* input data too long */ + shaStateError, /* called Input after FinalBits or Result */ + shaBadParam /* passed a bad parameter */ +}; +#endif /* _SHA_enum_ */ + +/* + * These constants hold size information for each of the SHA + * hashing operations + */ +enum { + SHA1_Message_Block_Size = 64, SHA224_Message_Block_Size = 64, + SHA256_Message_Block_Size = 64, SHA384_Message_Block_Size = 128, + SHA512_Message_Block_Size = 128, + USHA_Max_Message_Block_Size = SHA512_Message_Block_Size, + + SHA1HashSize = 20, SHA224HashSize = 28, SHA256HashSize = 32, + SHA384HashSize = 48, SHA512HashSize = 64, + USHAMaxHashSize = SHA512HashSize, + + SHA1HashSizeBits = 160, SHA224HashSizeBits = 224, + SHA256HashSizeBits = 256, SHA384HashSizeBits = 384, + SHA512HashSizeBits = 512, USHAMaxHashSizeBits = SHA512HashSizeBits +}; + +/* + * These constants are used in the USHA (unified sha) functions. + */ +typedef enum SHAversion { + SHA1, SHA224, SHA256, SHA384, SHA512 +} SHAversion; + + + +Eastlake 3rd & Hansen Informational [Page 19] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +/* + * This structure will hold context information for the SHA-1 + * hashing operation. + */ +typedef struct SHA1Context { + uint32_t Intermediate_Hash[SHA1HashSize/4]; /* Message Digest */ + + uint32_t Length_Low; /* Message length in bits */ + uint32_t Length_High; /* Message length in bits */ + + int_least16_t Message_Block_Index; /* Message_Block array index */ + /* 512-bit message blocks */ + uint8_t Message_Block[SHA1_Message_Block_Size]; + + int Computed; /* Is the digest computed? */ + int Corrupted; /* Is the digest corrupted? */ +} SHA1Context; + +/* + * This structure will hold context information for the SHA-256 + * hashing operation. + */ +typedef struct SHA256Context { + uint32_t Intermediate_Hash[SHA256HashSize/4]; /* Message Digest */ + + uint32_t Length_Low; /* Message length in bits */ + uint32_t Length_High; /* Message length in bits */ + + int_least16_t Message_Block_Index; /* Message_Block array index */ + /* 512-bit message blocks */ + uint8_t Message_Block[SHA256_Message_Block_Size]; + + int Computed; /* Is the digest computed? */ + int Corrupted; /* Is the digest corrupted? */ +} SHA256Context; + +/* + * This structure will hold context information for the SHA-512 + * hashing operation. + */ +typedef struct SHA512Context { +#ifdef USE_32BIT_ONLY + uint32_t Intermediate_Hash[SHA512HashSize/4]; /* Message Digest */ + uint32_t Length[4]; /* Message length in bits */ +#else /* !USE_32BIT_ONLY */ + uint64_t Intermediate_Hash[SHA512HashSize/8]; /* Message Digest */ + uint64_t Length_Low, Length_High; /* Message length in bits */ +#endif /* USE_32BIT_ONLY */ + + + +Eastlake 3rd & Hansen Informational [Page 20] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + int_least16_t Message_Block_Index; /* Message_Block array index */ + /* 1024-bit message blocks */ + uint8_t Message_Block[SHA512_Message_Block_Size]; + + int Computed; /* Is the digest computed?*/ + int Corrupted; /* Is the digest corrupted? */ +} SHA512Context; + +/* + * This structure will hold context information for the SHA-224 + * hashing operation. It uses the SHA-256 structure for computation. + */ +typedef struct SHA256Context SHA224Context; + +/* + * This structure will hold context information for the SHA-384 + * hashing operation. It uses the SHA-512 structure for computation. + */ +typedef struct SHA512Context SHA384Context; + +/* + * This structure holds context information for all SHA + * hashing operations. + */ +typedef struct USHAContext { + int whichSha; /* which SHA is being used */ + union { + SHA1Context sha1Context; + SHA224Context sha224Context; SHA256Context sha256Context; + SHA384Context sha384Context; SHA512Context sha512Context; + } ctx; +} USHAContext; + +/* + * This structure will hold context information for the HMAC + * keyed hashing operation. + */ +typedef struct HMACContext { + int whichSha; /* which SHA is being used */ + int hashSize; /* hash size of SHA being used */ + int blockSize; /* block size of SHA being used */ + USHAContext shaContext; /* SHA context */ + unsigned char k_opad[USHA_Max_Message_Block_Size]; + /* outer padding - key XORd with opad */ +} HMACContext; + + + + + + +Eastlake 3rd & Hansen Informational [Page 21] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +/* + * Function Prototypes + */ + +/* SHA-1 */ +extern int SHA1Reset(SHA1Context *); +extern int SHA1Input(SHA1Context *, const uint8_t *bytes, + unsigned int bytecount); +extern int SHA1FinalBits(SHA1Context *, const uint8_t bits, + unsigned int bitcount); +extern int SHA1Result(SHA1Context *, + uint8_t Message_Digest[SHA1HashSize]); + +/* SHA-224 */ +extern int SHA224Reset(SHA224Context *); +extern int SHA224Input(SHA224Context *, const uint8_t *bytes, + unsigned int bytecount); +extern int SHA224FinalBits(SHA224Context *, const uint8_t bits, + unsigned int bitcount); +extern int SHA224Result(SHA224Context *, + uint8_t Message_Digest[SHA224HashSize]); + +/* SHA-256 */ +extern int SHA256Reset(SHA256Context *); +extern int SHA256Input(SHA256Context *, const uint8_t *bytes, + unsigned int bytecount); +extern int SHA256FinalBits(SHA256Context *, const uint8_t bits, + unsigned int bitcount); +extern int SHA256Result(SHA256Context *, + uint8_t Message_Digest[SHA256HashSize]); + +/* SHA-384 */ +extern int SHA384Reset(SHA384Context *); +extern int SHA384Input(SHA384Context *, const uint8_t *bytes, + unsigned int bytecount); +extern int SHA384FinalBits(SHA384Context *, const uint8_t bits, + unsigned int bitcount); +extern int SHA384Result(SHA384Context *, + uint8_t Message_Digest[SHA384HashSize]); + +/* SHA-512 */ +extern int SHA512Reset(SHA512Context *); +extern int SHA512Input(SHA512Context *, const uint8_t *bytes, + unsigned int bytecount); +extern int SHA512FinalBits(SHA512Context *, const uint8_t bits, + unsigned int bitcount); +extern int SHA512Result(SHA512Context *, + uint8_t Message_Digest[SHA512HashSize]); + + + +Eastlake 3rd & Hansen Informational [Page 22] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +/* Unified SHA functions, chosen by whichSha */ +extern int USHAReset(USHAContext *, SHAversion whichSha); +extern int USHAInput(USHAContext *, + const uint8_t *bytes, unsigned int bytecount); +extern int USHAFinalBits(USHAContext *, + const uint8_t bits, unsigned int bitcount); +extern int USHAResult(USHAContext *, + uint8_t Message_Digest[USHAMaxHashSize]); +extern int USHABlockSize(enum SHAversion whichSha); +extern int USHAHashSize(enum SHAversion whichSha); +extern int USHAHashSizeBits(enum SHAversion whichSha); + +/* + * HMAC Keyed-Hashing for Message Authentication, RFC2104, + * for all SHAs. + * This interface allows a fixed-length text input to be used. + */ +extern int hmac(SHAversion whichSha, /* which SHA algorithm to use */ + const unsigned char *text, /* pointer to data stream */ + int text_len, /* length of data stream */ + const unsigned char *key, /* pointer to authentication key */ + int key_len, /* length of authentication key */ + uint8_t digest[USHAMaxHashSize]); /* caller digest to fill in */ + +/* + * HMAC Keyed-Hashing for Message Authentication, RFC2104, + * for all SHAs. + * This interface allows any length of text input to be used. + */ +extern int hmacReset(HMACContext *ctx, enum SHAversion whichSha, + const unsigned char *key, int key_len); +extern int hmacInput(HMACContext *ctx, const unsigned char *text, + int text_len); + +extern int hmacFinalBits(HMACContext *ctx, const uint8_t bits, + unsigned int bitcount); +extern int hmacResult(HMACContext *ctx, + uint8_t digest[USHAMaxHashSize]); + +#endif /* _SHA_H_ */ + + + + + + + + + + + +Eastlake 3rd & Hansen Informational [Page 23] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +8.2. The SHA Code + + This code is primarily intended as expository and could be optimized + further. For example, the assignment rotations through the variables + a, b, ..., h could be treated as a cycle and the loop unrolled, + rather than doing the explicit copying. + + Note that there are alternative representations of the Ch() and Maj() + functions controlled by an ifdef. + +8.2.1. sha1.c + +/**************************** sha1.c ****************************/ +/******************** See RFC 4634 for details ******************/ +/* + * Description: + * This file implements the Secure Hash Signature Standard + * algorithms as defined in the National Institute of Standards + * and Technology Federal Information Processing Standards + * Publication (FIPS PUB) 180-1 published on April 17, 1995, 180-2 + * published on August 1, 2002, and the FIPS PUB 180-2 Change + * Notice published on February 28, 2004. + * + * A combined document showing all algorithms is available at + * http://csrc.nist.gov/publications/fips/ + * fips180-2/fips180-2withchangenotice.pdf + * + * The SHA-1 algorithm produces a 160-bit message digest for a + * given data stream. It should take about 2**n steps to find a + * message with the same digest as a given message and + * 2**(n/2) to find any two messages with the same digest, + * when n is the digest size in bits. Therefore, this + * algorithm can serve as a means of providing a + * "fingerprint" for a message. + * + * Portability Issues: + * SHA-1 is defined in terms of 32-bit "words". This code + * uses <stdint.h> (included via "sha.h") to define 32 and 8 + * bit unsigned integer types. If your C compiler does not + * support 32 bit unsigned integers, this code is not + * appropriate. + * + * Caveats: + * SHA-1 is designed to work with messages less than 2^64 bits + * long. This implementation uses SHA1Input() to hash the bits + * that are a multiple of the size of an 8-bit character, and then + * uses SHA1FinalBits() to hash the final few bits of the input. + */ + + + +Eastlake 3rd & Hansen Informational [Page 24] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +#include "sha.h" +#include "sha-private.h" + +/* + * Define the SHA1 circular left shift macro + */ +#define SHA1_ROTL(bits,word) \ + (((word) << (bits)) | ((word) >> (32-(bits)))) + +/* + * add "length" to the length + */ +static uint32_t addTemp; +#define SHA1AddLength(context, length) \ + (addTemp = (context)->Length_Low, \ + (context)->Corrupted = \ + (((context)->Length_Low += (length)) < addTemp) && \ + (++(context)->Length_High == 0) ? 1 : 0) + +/* Local Function Prototypes */ +static void SHA1Finalize(SHA1Context *context, uint8_t Pad_Byte); +static void SHA1PadMessage(SHA1Context *, uint8_t Pad_Byte); +static void SHA1ProcessMessageBlock(SHA1Context *); + +/* + * SHA1Reset + * + * Description: + * This function will initialize the SHA1Context in preparation + * for computing a new SHA1 message digest. + * + * Parameters: + * context: [in/out] + * The context to reset. + * + * Returns: + * sha Error Code. + * + */ +int SHA1Reset(SHA1Context *context) +{ + if (!context) + return shaNull; + + context->Length_Low = 0; + context->Length_High = 0; + context->Message_Block_Index = 0; + + + + +Eastlake 3rd & Hansen Informational [Page 25] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + /* Initial Hash Values: FIPS-180-2 section 5.3.1 */ + context->Intermediate_Hash[0] = 0x67452301; + context->Intermediate_Hash[1] = 0xEFCDAB89; + context->Intermediate_Hash[2] = 0x98BADCFE; + context->Intermediate_Hash[3] = 0x10325476; + context->Intermediate_Hash[4] = 0xC3D2E1F0; + + context->Computed = 0; + context->Corrupted = 0; + + return shaSuccess; +} + +/* + * SHA1Input + * + * Description: + * This function accepts an array of octets as the next portion + * of the message. + * + * Parameters: + * context: [in/out] + * The SHA context to update + * message_array: [in] + * An array of characters representing the next portion of + * the message. + * length: [in] + * The length of the message in message_array + * + * Returns: + * sha Error Code. + * + */ +int SHA1Input(SHA1Context *context, + const uint8_t *message_array, unsigned length) +{ + if (!length) + return shaSuccess; + + if (!context || !message_array) + return shaNull; + + if (context->Computed) { + context->Corrupted = shaStateError; + return shaStateError; + } + + if (context->Corrupted) + + + +Eastlake 3rd & Hansen Informational [Page 26] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + return context->Corrupted; + + while (length-- && !context->Corrupted) { + context->Message_Block[context->Message_Block_Index++] = + (*message_array & 0xFF); + + if (!SHA1AddLength(context, 8) && + (context->Message_Block_Index == SHA1_Message_Block_Size)) + SHA1ProcessMessageBlock(context); + + message_array++; + } + + return shaSuccess; +} + +/* + * SHA1FinalBits + * + * Description: + * This function will add in any final bits of the message. + * + * Parameters: + * context: [in/out] + * The SHA context to update + * message_bits: [in] + * The final bits of the message, in the upper portion of the + * byte. (Use 0b###00000 instead of 0b00000### to input the + * three bits ###.) + * length: [in] + * The number of bits in message_bits, between 1 and 7. + * + * Returns: + * sha Error Code. + */ +int SHA1FinalBits(SHA1Context *context, const uint8_t message_bits, + unsigned int length) +{ + uint8_t masks[8] = { + /* 0 0b00000000 */ 0x00, /* 1 0b10000000 */ 0x80, + /* 2 0b11000000 */ 0xC0, /* 3 0b11100000 */ 0xE0, + /* 4 0b11110000 */ 0xF0, /* 5 0b11111000 */ 0xF8, + /* 6 0b11111100 */ 0xFC, /* 7 0b11111110 */ 0xFE + }; + uint8_t markbit[8] = { + /* 0 0b10000000 */ 0x80, /* 1 0b01000000 */ 0x40, + /* 2 0b00100000 */ 0x20, /* 3 0b00010000 */ 0x10, + /* 4 0b00001000 */ 0x08, /* 5 0b00000100 */ 0x04, + + + +Eastlake 3rd & Hansen Informational [Page 27] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + /* 6 0b00000010 */ 0x02, /* 7 0b00000001 */ 0x01 + }; + + if (!length) + return shaSuccess; + + if (!context) + return shaNull; + + if (context->Computed || (length >= 8) || (length == 0)) { + context->Corrupted = shaStateError; + return shaStateError; + } + + if (context->Corrupted) + return context->Corrupted; + + SHA1AddLength(context, length); + SHA1Finalize(context, + (uint8_t) ((message_bits & masks[length]) | markbit[length])); + + return shaSuccess; +} + +/* + * SHA1Result + * + * Description: + * This function will return the 160-bit message digest into the + * Message_Digest array provided by the caller. + * NOTE: The first octet of hash is stored in the 0th element, + * the last octet of hash in the 19th element. + * + * Parameters: + * context: [in/out] + * The context to use to calculate the SHA-1 hash. + * Message_Digest: [out] + * Where the digest is returned. + * + * Returns: + * sha Error Code. + * + */ +int SHA1Result(SHA1Context *context, + uint8_t Message_Digest[SHA1HashSize]) +{ + int i; + + + + +Eastlake 3rd & Hansen Informational [Page 28] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + if (!context || !Message_Digest) + return shaNull; + + if (context->Corrupted) + return context->Corrupted; + + if (!context->Computed) + SHA1Finalize(context, 0x80); + + for (i = 0; i < SHA1HashSize; ++i) + Message_Digest[i] = (uint8_t) (context->Intermediate_Hash[i>>2] + >> 8 * ( 3 - ( i & 0x03 ) )); + + return shaSuccess; +} + +/* + * SHA1Finalize + * + * Description: + * This helper function finishes off the digest calculations. + * + * Parameters: + * context: [in/out] + * The SHA context to update + * Pad_Byte: [in] + * The last byte to add to the digest before the 0-padding + * and length. This will contain the last bits of the message + * followed by another single bit. If the message was an + * exact multiple of 8-bits long, Pad_Byte will be 0x80. + * + * Returns: + * sha Error Code. + * + */ +static void SHA1Finalize(SHA1Context *context, uint8_t Pad_Byte) +{ + int i; + SHA1PadMessage(context, Pad_Byte); + /* message may be sensitive, clear it out */ + for (i = 0; i < SHA1_Message_Block_Size; ++i) + context->Message_Block[i] = 0; + context->Length_Low = 0; /* and clear length */ + context->Length_High = 0; + context->Computed = 1; +} + +/* + + + +Eastlake 3rd & Hansen Informational [Page 29] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * SHA1PadMessage + * + * Description: + * According to the standard, the message must be padded to an + * even 512 bits. The first padding bit must be a '1'. The last + * 64 bits represent the length of the original message. All bits + * in between should be 0. This helper function will pad the + * message according to those rules by filling the Message_Block + * array accordingly. When it returns, it can be assumed that the + * message digest has been computed. + * + * Parameters: + * context: [in/out] + * The context to pad + * Pad_Byte: [in] + * The last byte to add to the digest before the 0-padding + * and length. This will contain the last bits of the message + * followed by another single bit. If the message was an + * exact multiple of 8-bits long, Pad_Byte will be 0x80. + * + * Returns: + * Nothing. + */ +static void SHA1PadMessage(SHA1Context *context, uint8_t Pad_Byte) +{ + /* + * Check to see if the current message block is too small to hold + * the initial padding bits and length. If so, we will pad the + * block, process it, and then continue padding into a second + * block. + */ + if (context->Message_Block_Index >= (SHA1_Message_Block_Size - 8)) { + context->Message_Block[context->Message_Block_Index++] = Pad_Byte; + while (context->Message_Block_Index < SHA1_Message_Block_Size) + context->Message_Block[context->Message_Block_Index++] = 0; + + SHA1ProcessMessageBlock(context); + } else + context->Message_Block[context->Message_Block_Index++] = Pad_Byte; + + while (context->Message_Block_Index < (SHA1_Message_Block_Size - 8)) + context->Message_Block[context->Message_Block_Index++] = 0; + + /* + * Store the message length as the last 8 octets + */ + context->Message_Block[56] = (uint8_t) (context->Length_High >> 24); + context->Message_Block[57] = (uint8_t) (context->Length_High >> 16); + + + +Eastlake 3rd & Hansen Informational [Page 30] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + context->Message_Block[58] = (uint8_t) (context->Length_High >> 8); + context->Message_Block[59] = (uint8_t) (context->Length_High); + context->Message_Block[60] = (uint8_t) (context->Length_Low >> 24); + context->Message_Block[61] = (uint8_t) (context->Length_Low >> 16); + context->Message_Block[62] = (uint8_t) (context->Length_Low >> 8); + context->Message_Block[63] = (uint8_t) (context->Length_Low); + + SHA1ProcessMessageBlock(context); +} + +/* + * SHA1ProcessMessageBlock + * + * Description: + * This helper function will process the next 512 bits of the + * message stored in the Message_Block array. + * + * Parameters: + * None. + * + * Returns: + * Nothing. + * + * Comments: + * Many of the variable names in this code, especially the + * single character names, were used because those were the + * names used in the publication. + */ +static void SHA1ProcessMessageBlock(SHA1Context *context) +{ + /* Constants defined in FIPS-180-2, section 4.2.1 */ + const uint32_t K[4] = { + 0x5A827999, 0x6ED9EBA1, 0x8F1BBCDC, 0xCA62C1D6 + }; + int t; /* Loop counter */ + uint32_t temp; /* Temporary word value */ + uint32_t W[80]; /* Word sequence */ + uint32_t A, B, C, D, E; /* Word buffers */ + + /* + * Initialize the first 16 words in the array W + */ + for (t = 0; t < 16; t++) { + W[t] = ((uint32_t)context->Message_Block[t * 4]) << 24; + W[t] |= ((uint32_t)context->Message_Block[t * 4 + 1]) << 16; + W[t] |= ((uint32_t)context->Message_Block[t * 4 + 2]) << 8; + W[t] |= ((uint32_t)context->Message_Block[t * 4 + 3]); + } + + + +Eastlake 3rd & Hansen Informational [Page 31] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + for (t = 16; t < 80; t++) + W[t] = SHA1_ROTL(1, W[t-3] ^ W[t-8] ^ W[t-14] ^ W[t-16]); + + A = context->Intermediate_Hash[0]; + B = context->Intermediate_Hash[1]; + C = context->Intermediate_Hash[2]; + D = context->Intermediate_Hash[3]; + E = context->Intermediate_Hash[4]; + + for (t = 0; t < 20; t++) { + temp = SHA1_ROTL(5,A) + SHA_Ch(B, C, D) + E + W[t] + K[0]; + E = D; + D = C; + C = SHA1_ROTL(30,B); + B = A; + A = temp; + } + + for (t = 20; t < 40; t++) { + temp = SHA1_ROTL(5,A) + SHA_Parity(B, C, D) + E + W[t] + K[1]; + E = D; + D = C; + C = SHA1_ROTL(30,B); + B = A; + A = temp; + } + + for (t = 40; t < 60; t++) { + temp = SHA1_ROTL(5,A) + SHA_Maj(B, C, D) + E + W[t] + K[2]; + E = D; + D = C; + C = SHA1_ROTL(30,B); + B = A; + A = temp; + } + + for (t = 60; t < 80; t++) { + temp = SHA1_ROTL(5,A) + SHA_Parity(B, C, D) + E + W[t] + K[3]; + E = D; + D = C; + C = SHA1_ROTL(30,B); + B = A; + A = temp; + } + + context->Intermediate_Hash[0] += A; + context->Intermediate_Hash[1] += B; + context->Intermediate_Hash[2] += C; + + + +Eastlake 3rd & Hansen Informational [Page 32] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + context->Intermediate_Hash[3] += D; + context->Intermediate_Hash[4] += E; + + context->Message_Block_Index = 0; +} + +8.2.2. sha224-256.c + +/*************************** sha224-256.c ***************************/ +/********************* See RFC 4634 for details *********************/ +/* + * Description: + * This file implements the Secure Hash Signature Standard + * algorithms as defined in the National Institute of Standards + * and Technology Federal Information Processing Standards + * Publication (FIPS PUB) 180-1 published on April 17, 1995, 180-2 + * published on August 1, 2002, and the FIPS PUB 180-2 Change + * Notice published on February 28, 2004. + * + * A combined document showing all algorithms is available at + * http://csrc.nist.gov/publications/fips/ + * fips180-2/fips180-2withchangenotice.pdf + * + * The SHA-224 and SHA-256 algorithms produce 224-bit and 256-bit + * message digests for a given data stream. It should take about + * 2**n steps to find a message with the same digest as a given + * message and 2**(n/2) to find any two messages with the same + * digest, when n is the digest size in bits. Therefore, this + * algorithm can serve as a means of providing a + * "fingerprint" for a message. + * + * Portability Issues: + * SHA-224 and SHA-256 are defined in terms of 32-bit "words". + * This code uses <stdint.h> (included via "sha.h") to define 32 + * and 8 bit unsigned integer types. If your C compiler does not + * support 32 bit unsigned integers, this code is not + * appropriate. + * + * Caveats: + * SHA-224 and SHA-256 are designed to work with messages less + * than 2^64 bits long. This implementation uses SHA224/256Input() + * to hash the bits that are a multiple of the size of an 8-bit + * character, and then uses SHA224/256FinalBits() to hash the + * final few bits of the input. + */ + +#include "sha.h" +#include "sha-private.h" + + + +Eastlake 3rd & Hansen Informational [Page 33] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +/* Define the SHA shift, rotate left and rotate right macro */ +#define SHA256_SHR(bits,word) ((word) >> (bits)) +#define SHA256_ROTL(bits,word) \ + (((word) << (bits)) | ((word) >> (32-(bits)))) +#define SHA256_ROTR(bits,word) \ + (((word) >> (bits)) | ((word) << (32-(bits)))) + +/* Define the SHA SIGMA and sigma macros */ +#define SHA256_SIGMA0(word) \ + (SHA256_ROTR( 2,word) ^ SHA256_ROTR(13,word) ^ SHA256_ROTR(22,word)) +#define SHA256_SIGMA1(word) \ + (SHA256_ROTR( 6,word) ^ SHA256_ROTR(11,word) ^ SHA256_ROTR(25,word)) +#define SHA256_sigma0(word) \ + (SHA256_ROTR( 7,word) ^ SHA256_ROTR(18,word) ^ SHA256_SHR( 3,word)) +#define SHA256_sigma1(word) \ + (SHA256_ROTR(17,word) ^ SHA256_ROTR(19,word) ^ SHA256_SHR(10,word)) + +/* + * add "length" to the length + */ +static uint32_t addTemp; +#define SHA224_256AddLength(context, length) \ + (addTemp = (context)->Length_Low, (context)->Corrupted = \ + (((context)->Length_Low += (length)) < addTemp) && \ + (++(context)->Length_High == 0) ? 1 : 0) + +/* Local Function Prototypes */ +static void SHA224_256Finalize(SHA256Context *context, + uint8_t Pad_Byte); +static void SHA224_256PadMessage(SHA256Context *context, + uint8_t Pad_Byte); +static void SHA224_256ProcessMessageBlock(SHA256Context *context); +static int SHA224_256Reset(SHA256Context *context, uint32_t *H0); +static int SHA224_256ResultN(SHA256Context *context, + uint8_t Message_Digest[], int HashSize); + +/* Initial Hash Values: FIPS-180-2 Change Notice 1 */ +static uint32_t SHA224_H0[SHA256HashSize/4] = { + 0xC1059ED8, 0x367CD507, 0x3070DD17, 0xF70E5939, + 0xFFC00B31, 0x68581511, 0x64F98FA7, 0xBEFA4FA4 +}; + +/* Initial Hash Values: FIPS-180-2 section 5.3.2 */ +static uint32_t SHA256_H0[SHA256HashSize/4] = { + 0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A, + 0x510E527F, 0x9B05688C, 0x1F83D9AB, 0x5BE0CD19 +}; + + + + +Eastlake 3rd & Hansen Informational [Page 34] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +/* + * SHA224Reset + * + * Description: + * This function will initialize the SHA384Context in preparation + * for computing a new SHA224 message digest. + * + * Parameters: + * context: [in/out] + * The context to reset. + * + * Returns: + * sha Error Code. + */ +int SHA224Reset(SHA224Context *context) +{ + return SHA224_256Reset(context, SHA224_H0); +} + +/* + * SHA224Input + * + * Description: + * This function accepts an array of octets as the next portion + * of the message. + * + * Parameters: + * context: [in/out] + * The SHA context to update + * message_array: [in] + * An array of characters representing the next portion of + * the message. + * length: [in] + * The length of the message in message_array + * + * Returns: + * sha Error Code. + * + */ +int SHA224Input(SHA224Context *context, const uint8_t *message_array, + unsigned int length) +{ + return SHA256Input(context, message_array, length); +} + +/* + * SHA224FinalBits + * + + + +Eastlake 3rd & Hansen Informational [Page 35] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * Description: + * This function will add in any final bits of the message. + * + * Parameters: + * context: [in/out] + * The SHA context to update + * message_bits: [in] + * The final bits of the message, in the upper portion of the + * byte. (Use 0b###00000 instead of 0b00000### to input the + * three bits ###.) + * length: [in] + * The number of bits in message_bits, between 1 and 7. + * + * Returns: + * sha Error Code. + */ +int SHA224FinalBits( SHA224Context *context, + const uint8_t message_bits, unsigned int length) +{ + return SHA256FinalBits(context, message_bits, length); +} + +/* + * SHA224Result + * + * Description: + * This function will return the 224-bit message + * digest into the Message_Digest array provided by the caller. + * NOTE: The first octet of hash is stored in the 0th element, + * the last octet of hash in the 28th element. + * + * Parameters: + * context: [in/out] + * The context to use to calculate the SHA hash. + * Message_Digest: [out] + * Where the digest is returned. + * + * Returns: + * sha Error Code. + */ +int SHA224Result(SHA224Context *context, + uint8_t Message_Digest[SHA224HashSize]) +{ + return SHA224_256ResultN(context, Message_Digest, SHA224HashSize); +} + +/* + * SHA256Reset + + + +Eastlake 3rd & Hansen Informational [Page 36] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * + * Description: + * This function will initialize the SHA256Context in preparation + * for computing a new SHA256 message digest. + * + * Parameters: + * context: [in/out] + * The context to reset. + * + * Returns: + * sha Error Code. + */ +int SHA256Reset(SHA256Context *context) +{ + return SHA224_256Reset(context, SHA256_H0); +} + +/* + * SHA256Input + * + * Description: + * This function accepts an array of octets as the next portion + * of the message. + * + * Parameters: + * context: [in/out] + * The SHA context to update + * message_array: [in] + * An array of characters representing the next portion of + * the message. + * length: [in] + * The length of the message in message_array + * + * Returns: + * sha Error Code. + */ +int SHA256Input(SHA256Context *context, const uint8_t *message_array, + unsigned int length) +{ + if (!length) + return shaSuccess; + + if (!context || !message_array) + return shaNull; + + if (context->Computed) { + context->Corrupted = shaStateError; + return shaStateError; + + + +Eastlake 3rd & Hansen Informational [Page 37] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + } + + if (context->Corrupted) + return context->Corrupted; + + while (length-- && !context->Corrupted) { + context->Message_Block[context->Message_Block_Index++] = + (*message_array & 0xFF); + + if (!SHA224_256AddLength(context, 8) && + (context->Message_Block_Index == SHA256_Message_Block_Size)) + SHA224_256ProcessMessageBlock(context); + + message_array++; + } + + return shaSuccess; + +} + +/* + * SHA256FinalBits + * + * Description: + * This function will add in any final bits of the message. + * + * Parameters: + * context: [in/out] + * The SHA context to update + * message_bits: [in] + * The final bits of the message, in the upper portion of the + * byte. (Use 0b###00000 instead of 0b00000### to input the + * three bits ###.) + * length: [in] + * The number of bits in message_bits, between 1 and 7. + * + * Returns: + * sha Error Code. + */ +int SHA256FinalBits(SHA256Context *context, + const uint8_t message_bits, unsigned int length) +{ + uint8_t masks[8] = { + /* 0 0b00000000 */ 0x00, /* 1 0b10000000 */ 0x80, + /* 2 0b11000000 */ 0xC0, /* 3 0b11100000 */ 0xE0, + /* 4 0b11110000 */ 0xF0, /* 5 0b11111000 */ 0xF8, + /* 6 0b11111100 */ 0xFC, /* 7 0b11111110 */ 0xFE + }; + + + +Eastlake 3rd & Hansen Informational [Page 38] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + uint8_t markbit[8] = { + /* 0 0b10000000 */ 0x80, /* 1 0b01000000 */ 0x40, + /* 2 0b00100000 */ 0x20, /* 3 0b00010000 */ 0x10, + /* 4 0b00001000 */ 0x08, /* 5 0b00000100 */ 0x04, + /* 6 0b00000010 */ 0x02, /* 7 0b00000001 */ 0x01 + }; + + if (!length) + return shaSuccess; + + if (!context) + return shaNull; + + if ((context->Computed) || (length >= 8) || (length == 0)) { + context->Corrupted = shaStateError; + return shaStateError; + } + + if (context->Corrupted) + return context->Corrupted; + + SHA224_256AddLength(context, length); + SHA224_256Finalize(context, (uint8_t) + ((message_bits & masks[length]) | markbit[length])); + + return shaSuccess; +} + +/* + * SHA256Result + * + * Description: + * This function will return the 256-bit message + * digest into the Message_Digest array provided by the caller. + * NOTE: The first octet of hash is stored in the 0th element, + * the last octet of hash in the 32nd element. + * + * Parameters: + * context: [in/out] + * The context to use to calculate the SHA hash. + * Message_Digest: [out] + * Where the digest is returned. + * + * Returns: + * sha Error Code. + */ +int SHA256Result(SHA256Context *context, uint8_t Message_Digest[]) +{ + + + +Eastlake 3rd & Hansen Informational [Page 39] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + return SHA224_256ResultN(context, Message_Digest, SHA256HashSize); +} + +/* + * SHA224_256Finalize + * + * Description: + * This helper function finishes off the digest calculations. + * + * Parameters: + * context: [in/out] + * The SHA context to update + * Pad_Byte: [in] + * The last byte to add to the digest before the 0-padding + * and length. This will contain the last bits of the message + * followed by another single bit. If the message was an + * exact multiple of 8-bits long, Pad_Byte will be 0x80. + * + * Returns: + * sha Error Code. + */ +static void SHA224_256Finalize(SHA256Context *context, + uint8_t Pad_Byte) +{ + int i; + SHA224_256PadMessage(context, Pad_Byte); + /* message may be sensitive, so clear it out */ + for (i = 0; i < SHA256_Message_Block_Size; ++i) + context->Message_Block[i] = 0; + context->Length_Low = 0; /* and clear length */ + context->Length_High = 0; + context->Computed = 1; +} + +/* + * SHA224_256PadMessage + * + * Description: + * According to the standard, the message must be padded to an + * even 512 bits. The first padding bit must be a '1'. The + * last 64 bits represent the length of the original message. + * All bits in between should be 0. This helper function will pad + * the message according to those rules by filling the + * Message_Block array accordingly. When it returns, it can be + * assumed that the message digest has been computed. + * + * Parameters: + * context: [in/out] + + + +Eastlake 3rd & Hansen Informational [Page 40] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * The context to pad + * Pad_Byte: [in] + * The last byte to add to the digest before the 0-padding + * and length. This will contain the last bits of the message + * followed by another single bit. If the message was an + * exact multiple of 8-bits long, Pad_Byte will be 0x80. + * + * Returns: + * Nothing. + */ +static void SHA224_256PadMessage(SHA256Context *context, + uint8_t Pad_Byte) +{ + /* + * Check to see if the current message block is too small to hold + * the initial padding bits and length. If so, we will pad the + * block, process it, and then continue padding into a second + * block. + */ + if (context->Message_Block_Index >= (SHA256_Message_Block_Size-8)) { + context->Message_Block[context->Message_Block_Index++] = Pad_Byte; + while (context->Message_Block_Index < SHA256_Message_Block_Size) + context->Message_Block[context->Message_Block_Index++] = 0; + SHA224_256ProcessMessageBlock(context); + } else + context->Message_Block[context->Message_Block_Index++] = Pad_Byte; + + while (context->Message_Block_Index < (SHA256_Message_Block_Size-8)) + context->Message_Block[context->Message_Block_Index++] = 0; + + /* + * Store the message length as the last 8 octets + */ + context->Message_Block[56] = (uint8_t)(context->Length_High >> 24); + context->Message_Block[57] = (uint8_t)(context->Length_High >> 16); + context->Message_Block[58] = (uint8_t)(context->Length_High >> 8); + context->Message_Block[59] = (uint8_t)(context->Length_High); + context->Message_Block[60] = (uint8_t)(context->Length_Low >> 24); + context->Message_Block[61] = (uint8_t)(context->Length_Low >> 16); + context->Message_Block[62] = (uint8_t)(context->Length_Low >> 8); + context->Message_Block[63] = (uint8_t)(context->Length_Low); + + SHA224_256ProcessMessageBlock(context); +} + +/* + * SHA224_256ProcessMessageBlock + * + + + +Eastlake 3rd & Hansen Informational [Page 41] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * Description: + * This function will process the next 512 bits of the message + * stored in the Message_Block array. + * + * Parameters: + * context: [in/out] + * The SHA context to update + * + * Returns: + * Nothing. + * + * Comments: + * Many of the variable names in this code, especially the + * single character names, were used because those were the + * names used in the publication. + */ +static void SHA224_256ProcessMessageBlock(SHA256Context *context) +{ + /* Constants defined in FIPS-180-2, section 4.2.2 */ + static const uint32_t K[64] = { + 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, + 0x59f111f1, 0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, + 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, + 0xc19bf174, 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, + 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da, 0x983e5152, + 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, + 0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, + 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, + 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, + 0xd6990624, 0xf40e3585, 0x106aa070, 0x19a4c116, 0x1e376c08, + 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, + 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, + 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2 + }; + int t, t4; /* Loop counter */ + uint32_t temp1, temp2; /* Temporary word value */ + uint32_t W[64]; /* Word sequence */ + uint32_t A, B, C, D, E, F, G, H; /* Word buffers */ + + /* + * Initialize the first 16 words in the array W + */ + for (t = t4 = 0; t < 16; t++, t4 += 4) + W[t] = (((uint32_t)context->Message_Block[t4]) << 24) | + (((uint32_t)context->Message_Block[t4 + 1]) << 16) | + (((uint32_t)context->Message_Block[t4 + 2]) << 8) | + (((uint32_t)context->Message_Block[t4 + 3])); + + + + +Eastlake 3rd & Hansen Informational [Page 42] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + for (t = 16; t < 64; t++) + W[t] = SHA256_sigma1(W[t-2]) + W[t-7] + + SHA256_sigma0(W[t-15]) + W[t-16]; + + A = context->Intermediate_Hash[0]; + B = context->Intermediate_Hash[1]; + C = context->Intermediate_Hash[2]; + D = context->Intermediate_Hash[3]; + E = context->Intermediate_Hash[4]; + F = context->Intermediate_Hash[5]; + G = context->Intermediate_Hash[6]; + H = context->Intermediate_Hash[7]; + + for (t = 0; t < 64; t++) { + temp1 = H + SHA256_SIGMA1(E) + SHA_Ch(E,F,G) + K[t] + W[t]; + temp2 = SHA256_SIGMA0(A) + SHA_Maj(A,B,C); + H = G; + G = F; + F = E; + E = D + temp1; + D = C; + C = B; + B = A; + A = temp1 + temp2; + } + + context->Intermediate_Hash[0] += A; + context->Intermediate_Hash[1] += B; + context->Intermediate_Hash[2] += C; + context->Intermediate_Hash[3] += D; + context->Intermediate_Hash[4] += E; + context->Intermediate_Hash[5] += F; + context->Intermediate_Hash[6] += G; + context->Intermediate_Hash[7] += H; + + context->Message_Block_Index = 0; +} + +/* + * SHA224_256Reset + * + * Description: + * This helper function will initialize the SHA256Context in + * preparation for computing a new SHA256 message digest. + * + * Parameters: + * context: [in/out] + * The context to reset. + + + +Eastlake 3rd & Hansen Informational [Page 43] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * H0 + * The initial hash value to use. + * + * Returns: + * sha Error Code. + */ +static int SHA224_256Reset(SHA256Context *context, uint32_t *H0) +{ + if (!context) + return shaNull; + + context->Length_Low = 0; + context->Length_High = 0; + context->Message_Block_Index = 0; + + context->Intermediate_Hash[0] = H0[0]; + context->Intermediate_Hash[1] = H0[1]; + context->Intermediate_Hash[2] = H0[2]; + context->Intermediate_Hash[3] = H0[3]; + context->Intermediate_Hash[4] = H0[4]; + context->Intermediate_Hash[5] = H0[5]; + context->Intermediate_Hash[6] = H0[6]; + context->Intermediate_Hash[7] = H0[7]; + + context->Computed = 0; + context->Corrupted = 0; + + return shaSuccess; +} + +/* + * SHA224_256ResultN + * + * Description: + * This helper function will return the 224-bit or 256-bit message + * digest into the Message_Digest array provided by the caller. + * NOTE: The first octet of hash is stored in the 0th element, + * the last octet of hash in the 28th/32nd element. + * + * Parameters: + * context: [in/out] + * The context to use to calculate the SHA hash. + * Message_Digest: [out] + * Where the digest is returned. + * HashSize: [in] + * The size of the hash, either 28 or 32. + * + * Returns: + + + +Eastlake 3rd & Hansen Informational [Page 44] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * sha Error Code. + */ +static int SHA224_256ResultN(SHA256Context *context, + uint8_t Message_Digest[], int HashSize) +{ + int i; + + if (!context || !Message_Digest) + return shaNull; + + if (context->Corrupted) + return context->Corrupted; + + if (!context->Computed) + SHA224_256Finalize(context, 0x80); + + for (i = 0; i < HashSize; ++i) + Message_Digest[i] = (uint8_t) + (context->Intermediate_Hash[i>>2] >> 8 * ( 3 - ( i & 0x03 ) )); + + return shaSuccess; +} + +8.2.3. sha384-512.c + +/*************************** sha384-512.c ***************************/ +/********************* See RFC 4634 for details *********************/ +/* + * Description: + * This file implements the Secure Hash Signature Standard + * algorithms as defined in the National Institute of Standards + * and Technology Federal Information Processing Standards + * Publication (FIPS PUB) 180-1 published on April 17, 1995, 180-2 + * published on August 1, 2002, and the FIPS PUB 180-2 Change + * Notice published on February 28, 2004. + * + * A combined document showing all algorithms is available at + * http://csrc.nist.gov/publications/fips/ + * fips180-2/fips180-2withchangenotice.pdf + * + * The SHA-384 and SHA-512 algorithms produce 384-bit and 512-bit + * message digests for a given data stream. It should take about + * 2**n steps to find a message with the same digest as a given + * message and 2**(n/2) to find any two messages with the same + * digest, when n is the digest size in bits. Therefore, this + * algorithm can serve as a means of providing a + * "fingerprint" for a message. + * + + + +Eastlake 3rd & Hansen Informational [Page 45] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * Portability Issues: + * SHA-384 and SHA-512 are defined in terms of 64-bit "words", + * but if USE_32BIT_ONLY is #defined, this code is implemented in + * terms of 32-bit "words". This code uses <stdint.h> (included + * via "sha.h") to define the 64, 32 and 8 bit unsigned integer + * types. If your C compiler does not support 64 bit unsigned + * integers, and you do not #define USE_32BIT_ONLY, this code is + * not appropriate. + * + * Caveats: + * SHA-384 and SHA-512 are designed to work with messages less + * than 2^128 bits long. This implementation uses + * SHA384/512Input() to hash the bits that are a multiple of the + * size of an 8-bit character, and then uses SHA384/256FinalBits() + * to hash the final few bits of the input. + * + */ + +#include "sha.h" +#include "sha-private.h" + +#ifdef USE_32BIT_ONLY +/* + * Define 64-bit arithmetic in terms of 32-bit arithmetic. + * Each 64-bit number is represented in a 2-word array. + * All macros are defined such that the result is the last parameter. + */ + +/* + * Define shift, rotate left and rotate right functions + */ +#define SHA512_SHR(bits, word, ret) ( \ + /* (((uint64_t)((word))) >> (bits)) */ \ + (ret)[0] = (((bits) < 32) && ((bits) >= 0)) ? \ + ((word)[0] >> (bits)) : 0, \ + (ret)[1] = ((bits) > 32) ? ((word)[0] >> ((bits) - 32)) : \ + ((bits) == 32) ? (word)[0] : \ + ((bits) >= 0) ? \ + (((word)[0] << (32 - (bits))) | \ + ((word)[1] >> (bits))) : 0 ) + +#define SHA512_SHL(bits, word, ret) ( \ + /* (((uint64_t)(word)) << (bits)) */ \ + (ret)[0] = ((bits) > 32) ? ((word)[1] << ((bits) - 32)) : \ + ((bits) == 32) ? (word)[1] : \ + ((bits) >= 0) ? \ + (((word)[0] << (bits)) | \ + ((word)[1] >> (32 - (bits)))) : \ + + + +Eastlake 3rd & Hansen Informational [Page 46] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + 0, \ + (ret)[1] = (((bits) < 32) && ((bits) >= 0)) ? \ + ((word)[1] << (bits)) : 0 ) + +/* + * Define 64-bit OR + */ +#define SHA512_OR(word1, word2, ret) ( \ + (ret)[0] = (word1)[0] | (word2)[0], \ + (ret)[1] = (word1)[1] | (word2)[1] ) + +/* + * Define 64-bit XOR + */ +#define SHA512_XOR(word1, word2, ret) ( \ + (ret)[0] = (word1)[0] ^ (word2)[0], \ + (ret)[1] = (word1)[1] ^ (word2)[1] ) + +/* + * Define 64-bit AND + */ +#define SHA512_AND(word1, word2, ret) ( \ + (ret)[0] = (word1)[0] & (word2)[0], \ + (ret)[1] = (word1)[1] & (word2)[1] ) + +/* + * Define 64-bit TILDA + */ +#define SHA512_TILDA(word, ret) \ + ( (ret)[0] = ~(word)[0], (ret)[1] = ~(word)[1] ) + +/* + * Define 64-bit ADD + */ +#define SHA512_ADD(word1, word2, ret) ( \ + (ret)[1] = (word1)[1], (ret)[1] += (word2)[1], \ + (ret)[0] = (word1)[0] + (word2)[0] + ((ret)[1] < (word1)[1]) ) + +/* + * Add the 4word value in word2 to word1. + */ +static uint32_t ADDTO4_temp, ADDTO4_temp2; +#define SHA512_ADDTO4(word1, word2) ( \ + ADDTO4_temp = (word1)[3], \ + (word1)[3] += (word2)[3], \ + ADDTO4_temp2 = (word1)[2], \ + (word1)[2] += (word2)[2] + ((word1)[3] < ADDTO4_temp), \ + ADDTO4_temp = (word1)[1], \ + + + +Eastlake 3rd & Hansen Informational [Page 47] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + (word1)[1] += (word2)[1] + ((word1)[2] < ADDTO4_temp2), \ + (word1)[0] += (word2)[0] + ((word1)[1] < ADDTO4_temp) ) + +/* + * Add the 2word value in word2 to word1. + */ +static uint32_t ADDTO2_temp; +#define SHA512_ADDTO2(word1, word2) ( \ + ADDTO2_temp = (word1)[1], \ + (word1)[1] += (word2)[1], \ + (word1)[0] += (word2)[0] + ((word1)[1] < ADDTO2_temp) ) + +/* + * SHA rotate ((word >> bits) | (word << (64-bits))) + */ +static uint32_t ROTR_temp1[2], ROTR_temp2[2]; +#define SHA512_ROTR(bits, word, ret) ( \ + SHA512_SHR((bits), (word), ROTR_temp1), \ + SHA512_SHL(64-(bits), (word), ROTR_temp2), \ + SHA512_OR(ROTR_temp1, ROTR_temp2, (ret)) ) + +/* + * Define the SHA SIGMA and sigma macros + * SHA512_ROTR(28,word) ^ SHA512_ROTR(34,word) ^ SHA512_ROTR(39,word) + */ +static uint32_t SIGMA0_temp1[2], SIGMA0_temp2[2], + SIGMA0_temp3[2], SIGMA0_temp4[2]; +#define SHA512_SIGMA0(word, ret) ( \ + SHA512_ROTR(28, (word), SIGMA0_temp1), \ + SHA512_ROTR(34, (word), SIGMA0_temp2), \ + SHA512_ROTR(39, (word), SIGMA0_temp3), \ + SHA512_XOR(SIGMA0_temp2, SIGMA0_temp3, SIGMA0_temp4), \ + SHA512_XOR(SIGMA0_temp1, SIGMA0_temp4, (ret)) ) + +/* + * SHA512_ROTR(14,word) ^ SHA512_ROTR(18,word) ^ SHA512_ROTR(41,word) + */ +static uint32_t SIGMA1_temp1[2], SIGMA1_temp2[2], + SIGMA1_temp3[2], SIGMA1_temp4[2]; +#define SHA512_SIGMA1(word, ret) ( \ + SHA512_ROTR(14, (word), SIGMA1_temp1), \ + SHA512_ROTR(18, (word), SIGMA1_temp2), \ + SHA512_ROTR(41, (word), SIGMA1_temp3), \ + SHA512_XOR(SIGMA1_temp2, SIGMA1_temp3, SIGMA1_temp4), \ + SHA512_XOR(SIGMA1_temp1, SIGMA1_temp4, (ret)) ) + +/* + * (SHA512_ROTR( 1,word) ^ SHA512_ROTR( 8,word) ^ SHA512_SHR( 7,word)) + + + +Eastlake 3rd & Hansen Informational [Page 48] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + */ +static uint32_t sigma0_temp1[2], sigma0_temp2[2], + sigma0_temp3[2], sigma0_temp4[2]; +#define SHA512_sigma0(word, ret) ( \ + SHA512_ROTR( 1, (word), sigma0_temp1), \ + SHA512_ROTR( 8, (word), sigma0_temp2), \ + SHA512_SHR( 7, (word), sigma0_temp3), \ + SHA512_XOR(sigma0_temp2, sigma0_temp3, sigma0_temp4), \ + SHA512_XOR(sigma0_temp1, sigma0_temp4, (ret)) ) + +/* + * (SHA512_ROTR(19,word) ^ SHA512_ROTR(61,word) ^ SHA512_SHR( 6,word)) + */ +static uint32_t sigma1_temp1[2], sigma1_temp2[2], + sigma1_temp3[2], sigma1_temp4[2]; +#define SHA512_sigma1(word, ret) ( \ + SHA512_ROTR(19, (word), sigma1_temp1), \ + SHA512_ROTR(61, (word), sigma1_temp2), \ + SHA512_SHR( 6, (word), sigma1_temp3), \ + SHA512_XOR(sigma1_temp2, sigma1_temp3, sigma1_temp4), \ + SHA512_XOR(sigma1_temp1, sigma1_temp4, (ret)) ) + +#undef SHA_Ch +#undef SHA_Maj + +#ifndef USE_MODIFIED_MACROS +/* + * These definitions are the ones used in FIPS-180-2, section 4.1.3 + * Ch(x,y,z) ((x & y) ^ (~x & z)) + */ +static uint32_t Ch_temp1[2], Ch_temp2[2], Ch_temp3[2]; +#define SHA_Ch(x, y, z, ret) ( \ + SHA512_AND(x, y, Ch_temp1), \ + SHA512_TILDA(x, Ch_temp2), \ + SHA512_AND(Ch_temp2, z, Ch_temp3), \ + SHA512_XOR(Ch_temp1, Ch_temp3, (ret)) ) +/* + * Maj(x,y,z) (((x)&(y)) ^ ((x)&(z)) ^ ((y)&(z))) + */ +static uint32_t Maj_temp1[2], Maj_temp2[2], + Maj_temp3[2], Maj_temp4[2]; +#define SHA_Maj(x, y, z, ret) ( \ + SHA512_AND(x, y, Maj_temp1), \ + SHA512_AND(x, z, Maj_temp2), \ + SHA512_AND(y, z, Maj_temp3), \ + SHA512_XOR(Maj_temp2, Maj_temp3, Maj_temp4), \ + SHA512_XOR(Maj_temp1, Maj_temp4, (ret)) ) + + + + +Eastlake 3rd & Hansen Informational [Page 49] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +#else /* !USE_32BIT_ONLY */ +/* + * These definitions are potentially faster equivalents for the ones + * used in FIPS-180-2, section 4.1.3. + * ((x & y) ^ (~x & z)) becomes + * ((x & (y ^ z)) ^ z) + */ +#define SHA_Ch(x, y, z, ret) ( \ + (ret)[0] = (((x)[0] & ((y)[0] ^ (z)[0])) ^ (z)[0]), \ + (ret)[1] = (((x)[1] & ((y)[1] ^ (z)[1])) ^ (z)[1]) ) + +/* + * ((x & y) ^ (x & z) ^ (y & z)) becomes + * ((x & (y | z)) | (y & z)) + */ +#define SHA_Maj(x, y, z, ret) ( \ + ret[0] = (((x)[0] & ((y)[0] | (z)[0])) | ((y)[0] & (z)[0])), \ + ret[1] = (((x)[1] & ((y)[1] | (z)[1])) | ((y)[1] & (z)[1])) ) +#endif /* USE_MODIFIED_MACROS */ + +/* + * add "length" to the length + */ +static uint32_t addTemp[4] = { 0, 0, 0, 0 }; +#define SHA384_512AddLength(context, length) ( \ + addTemp[3] = (length), SHA512_ADDTO4((context)->Length, addTemp), \ + (context)->Corrupted = (((context)->Length[3] == 0) && \ + ((context)->Length[2] == 0) && ((context)->Length[1] == 0) && \ + ((context)->Length[0] < 8)) ? 1 : 0 ) + +/* Local Function Prototypes */ +static void SHA384_512Finalize(SHA512Context *context, + uint8_t Pad_Byte); +static void SHA384_512PadMessage(SHA512Context *context, + uint8_t Pad_Byte); +static void SHA384_512ProcessMessageBlock(SHA512Context *context); +static int SHA384_512Reset(SHA512Context *context, uint32_t H0[]); +static int SHA384_512ResultN( SHA512Context *context, + uint8_t Message_Digest[], int HashSize); + +/* Initial Hash Values: FIPS-180-2 sections 5.3.3 and 5.3.4 */ +static uint32_t SHA384_H0[SHA512HashSize/4] = { + 0xCBBB9D5D, 0xC1059ED8, 0x629A292A, 0x367CD507, 0x9159015A, + 0x3070DD17, 0x152FECD8, 0xF70E5939, 0x67332667, 0xFFC00B31, + 0x8EB44A87, 0x68581511, 0xDB0C2E0D, 0x64F98FA7, 0x47B5481D, + 0xBEFA4FA4 +}; + + + + +Eastlake 3rd & Hansen Informational [Page 50] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +static uint32_t SHA512_H0[SHA512HashSize/4] = { + 0x6A09E667, 0xF3BCC908, 0xBB67AE85, 0x84CAA73B, 0x3C6EF372, + 0xFE94F82B, 0xA54FF53A, 0x5F1D36F1, 0x510E527F, 0xADE682D1, + 0x9B05688C, 0x2B3E6C1F, 0x1F83D9AB, 0xFB41BD6B, 0x5BE0CD19, + 0x137E2179 +}; + +#else /* !USE_32BIT_ONLY */ + +/* Define the SHA shift, rotate left and rotate right macro */ +#define SHA512_SHR(bits,word) (((uint64_t)(word)) >> (bits)) +#define SHA512_ROTR(bits,word) ((((uint64_t)(word)) >> (bits)) | \ + (((uint64_t)(word)) << (64-(bits)))) + +/* Define the SHA SIGMA and sigma macros */ +#define SHA512_SIGMA0(word) \ + (SHA512_ROTR(28,word) ^ SHA512_ROTR(34,word) ^ SHA512_ROTR(39,word)) +#define SHA512_SIGMA1(word) \ + (SHA512_ROTR(14,word) ^ SHA512_ROTR(18,word) ^ SHA512_ROTR(41,word)) +#define SHA512_sigma0(word) \ + (SHA512_ROTR( 1,word) ^ SHA512_ROTR( 8,word) ^ SHA512_SHR( 7,word)) +#define SHA512_sigma1(word) \ + (SHA512_ROTR(19,word) ^ SHA512_ROTR(61,word) ^ SHA512_SHR( 6,word)) + +/* + * add "length" to the length + */ +static uint64_t addTemp; +#define SHA384_512AddLength(context, length) \ + (addTemp = context->Length_Low, context->Corrupted = \ + ((context->Length_Low += length) < addTemp) && \ + (++context->Length_High == 0) ? 1 : 0) + +/* Local Function Prototypes */ +static void SHA384_512Finalize(SHA512Context *context, + uint8_t Pad_Byte); +static void SHA384_512PadMessage(SHA512Context *context, + uint8_t Pad_Byte); +static void SHA384_512ProcessMessageBlock(SHA512Context *context); +static int SHA384_512Reset(SHA512Context *context, uint64_t H0[]); +static int SHA384_512ResultN(SHA512Context *context, + uint8_t Message_Digest[], int HashSize); + +/* Initial Hash Values: FIPS-180-2 sections 5.3.3 and 5.3.4 */ +static uint64_t SHA384_H0[] = { + 0xCBBB9D5DC1059ED8ll, 0x629A292A367CD507ll, 0x9159015A3070DD17ll, + 0x152FECD8F70E5939ll, 0x67332667FFC00B31ll, 0x8EB44A8768581511ll, + 0xDB0C2E0D64F98FA7ll, 0x47B5481DBEFA4FA4ll + + + +Eastlake 3rd & Hansen Informational [Page 51] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +}; +static uint64_t SHA512_H0[] = { + 0x6A09E667F3BCC908ll, 0xBB67AE8584CAA73Bll, 0x3C6EF372FE94F82Bll, + 0xA54FF53A5F1D36F1ll, 0x510E527FADE682D1ll, 0x9B05688C2B3E6C1Fll, + 0x1F83D9ABFB41BD6Bll, 0x5BE0CD19137E2179ll +}; + +#endif /* USE_32BIT_ONLY */ + +/* + * SHA384Reset + * + * Description: + * This function will initialize the SHA384Context in preparation + * for computing a new SHA384 message digest. + * + * Parameters: + * context: [in/out] + * The context to reset. + * + * Returns: + * sha Error Code. + * + */ +int SHA384Reset(SHA384Context *context) +{ + return SHA384_512Reset(context, SHA384_H0); +} + +/* + * SHA384Input + * + * Description: + * This function accepts an array of octets as the next portion + * of the message. + * + * Parameters: + * context: [in/out] + * The SHA context to update + * message_array: [in] + * An array of characters representing the next portion of + * the message. + * length: [in] + * The length of the message in message_array + * + * Returns: + * sha Error Code. + * + + + +Eastlake 3rd & Hansen Informational [Page 52] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + */ +int SHA384Input(SHA384Context *context, + const uint8_t *message_array, unsigned int length) +{ + return SHA512Input(context, message_array, length); +} + +/* + * SHA384FinalBits + * + * Description: + * This function will add in any final bits of the message. + * + * Parameters: + * context: [in/out] + * The SHA context to update + * message_bits: [in] + * The final bits of the message, in the upper portion of the + * byte. (Use 0b###00000 instead of 0b00000### to input the + * three bits ###.) + * length: [in] + * The number of bits in message_bits, between 1 and 7. + * + * Returns: + * sha Error Code. + * + */ +int SHA384FinalBits(SHA384Context *context, + const uint8_t message_bits, unsigned int length) +{ + return SHA512FinalBits(context, message_bits, length); +} + +/* + * SHA384Result + * + * Description: + * This function will return the 384-bit message + * digest into the Message_Digest array provided by the caller. + * NOTE: The first octet of hash is stored in the 0th element, + * the last octet of hash in the 48th element. + * + * Parameters: + * context: [in/out] + * The context to use to calculate the SHA hash. + * Message_Digest: [out] + * Where the digest is returned. + * + + + +Eastlake 3rd & Hansen Informational [Page 53] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * Returns: + * sha Error Code. + * + */ +int SHA384Result(SHA384Context *context, + uint8_t Message_Digest[SHA384HashSize]) +{ + return SHA384_512ResultN(context, Message_Digest, SHA384HashSize); +} + +/* + * SHA512Reset + * + * Description: + * This function will initialize the SHA512Context in preparation + * for computing a new SHA512 message digest. + * + * Parameters: + * context: [in/out] + * The context to reset. + * + * Returns: + * sha Error Code. + * + */ +int SHA512Reset(SHA512Context *context) +{ + return SHA384_512Reset(context, SHA512_H0); +} + +/* + * SHA512Input + * + * Description: + * This function accepts an array of octets as the next portion + * of the message. + * + * Parameters: + * context: [in/out] + * The SHA context to update + * message_array: [in] + * An array of characters representing the next portion of + * the message. + * length: [in] + * The length of the message in message_array + * + * Returns: + * sha Error Code. + + + +Eastlake 3rd & Hansen Informational [Page 54] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * + */ +int SHA512Input(SHA512Context *context, + const uint8_t *message_array, + unsigned int length) +{ + if (!length) + return shaSuccess; + + if (!context || !message_array) + return shaNull; + + if (context->Computed) { + context->Corrupted = shaStateError; + return shaStateError; + } + + if (context->Corrupted) + return context->Corrupted; + + while (length-- && !context->Corrupted) { + context->Message_Block[context->Message_Block_Index++] = + (*message_array & 0xFF); + + if (!SHA384_512AddLength(context, 8) && + (context->Message_Block_Index == SHA512_Message_Block_Size)) + SHA384_512ProcessMessageBlock(context); + + message_array++; + } + + return shaSuccess; +} + +/* + * SHA512FinalBits + * + * Description: + * This function will add in any final bits of the message. + * + * Parameters: + * context: [in/out] + * The SHA context to update + * message_bits: [in] + * The final bits of the message, in the upper portion of the + * byte. (Use 0b###00000 instead of 0b00000### to input the + * three bits ###.) + * length: [in] + + + +Eastlake 3rd & Hansen Informational [Page 55] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * The number of bits in message_bits, between 1 and 7. + * + * Returns: + * sha Error Code. + * + */ +int SHA512FinalBits(SHA512Context *context, + const uint8_t message_bits, unsigned int length) +{ + uint8_t masks[8] = { + /* 0 0b00000000 */ 0x00, /* 1 0b10000000 */ 0x80, + /* 2 0b11000000 */ 0xC0, /* 3 0b11100000 */ 0xE0, + /* 4 0b11110000 */ 0xF0, /* 5 0b11111000 */ 0xF8, + /* 6 0b11111100 */ 0xFC, /* 7 0b11111110 */ 0xFE + }; + uint8_t markbit[8] = { + /* 0 0b10000000 */ 0x80, /* 1 0b01000000 */ 0x40, + /* 2 0b00100000 */ 0x20, /* 3 0b00010000 */ 0x10, + /* 4 0b00001000 */ 0x08, /* 5 0b00000100 */ 0x04, + /* 6 0b00000010 */ 0x02, /* 7 0b00000001 */ 0x01 + }; + + if (!length) + return shaSuccess; + + if (!context) + return shaNull; + + if ((context->Computed) || (length >= 8) || (length == 0)) { + context->Corrupted = shaStateError; + return shaStateError; + } + + if (context->Corrupted) + return context->Corrupted; + + SHA384_512AddLength(context, length); + SHA384_512Finalize(context, (uint8_t) + ((message_bits & masks[length]) | markbit[length])); + + return shaSuccess; +} + +/* + * SHA384_512Finalize + * + * Description: + * This helper function finishes off the digest calculations. + + + +Eastlake 3rd & Hansen Informational [Page 56] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * + * Parameters: + * context: [in/out] + * The SHA context to update + * Pad_Byte: [in] + * The last byte to add to the digest before the 0-padding + * and length. This will contain the last bits of the message + * followed by another single bit. If the message was an + * exact multiple of 8-bits long, Pad_Byte will be 0x80. + * + * Returns: + * sha Error Code. + * + */ +static void SHA384_512Finalize(SHA512Context *context, + uint8_t Pad_Byte) +{ + int_least16_t i; + SHA384_512PadMessage(context, Pad_Byte); + /* message may be sensitive, clear it out */ + for (i = 0; i < SHA512_Message_Block_Size; ++i) + context->Message_Block[i] = 0; +#ifdef USE_32BIT_ONLY /* and clear length */ + context->Length[0] = context->Length[1] = 0; + context->Length[2] = context->Length[3] = 0; +#else /* !USE_32BIT_ONLY */ + context->Length_Low = 0; + context->Length_High = 0; +#endif /* USE_32BIT_ONLY */ + context->Computed = 1; +} + +/* + * SHA512Result + * + * Description: + * This function will return the 512-bit message + * digest into the Message_Digest array provided by the caller. + * NOTE: The first octet of hash is stored in the 0th element, + * the last octet of hash in the 64th element. + * + * Parameters: + * context: [in/out] + * The context to use to calculate the SHA hash. + * Message_Digest: [out] + * Where the digest is returned. + * + * Returns: + + + +Eastlake 3rd & Hansen Informational [Page 57] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * sha Error Code. + * + */ +int SHA512Result(SHA512Context *context, + uint8_t Message_Digest[SHA512HashSize]) +{ + return SHA384_512ResultN(context, Message_Digest, SHA512HashSize); +} + +/* + * SHA384_512PadMessage + * + * Description: + * According to the standard, the message must be padded to an + * even 1024 bits. The first padding bit must be a '1'. The + * last 128 bits represent the length of the original message. + * All bits in between should be 0. This helper function will + * pad the message according to those rules by filling the + * Message_Block array accordingly. When it returns, it can be + * assumed that the message digest has been computed. + * + * Parameters: + * context: [in/out] + * The context to pad + * Pad_Byte: [in] + * The last byte to add to the digest before the 0-padding + * and length. This will contain the last bits of the message + * followed by another single bit. If the message was an + * exact multiple of 8-bits long, Pad_Byte will be 0x80. + * + * Returns: + * Nothing. + * + */ +static void SHA384_512PadMessage(SHA512Context *context, + uint8_t Pad_Byte) +{ + /* + * Check to see if the current message block is too small to hold + * the initial padding bits and length. If so, we will pad the + * block, process it, and then continue padding into a second + * block. + */ + if (context->Message_Block_Index >= (SHA512_Message_Block_Size-16)) { + context->Message_Block[context->Message_Block_Index++] = Pad_Byte; + while (context->Message_Block_Index < SHA512_Message_Block_Size) + context->Message_Block[context->Message_Block_Index++] = 0; + + + + +Eastlake 3rd & Hansen Informational [Page 58] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + SHA384_512ProcessMessageBlock(context); + } else + context->Message_Block[context->Message_Block_Index++] = Pad_Byte; + + while (context->Message_Block_Index < (SHA512_Message_Block_Size-16)) + context->Message_Block[context->Message_Block_Index++] = 0; + + /* + * Store the message length as the last 16 octets + */ +#ifdef USE_32BIT_ONLY + context->Message_Block[112] = (uint8_t)(context->Length[0] >> 24); + context->Message_Block[113] = (uint8_t)(context->Length[0] >> 16); + context->Message_Block[114] = (uint8_t)(context->Length[0] >> 8); + context->Message_Block[115] = (uint8_t)(context->Length[0]); + context->Message_Block[116] = (uint8_t)(context->Length[1] >> 24); + context->Message_Block[117] = (uint8_t)(context->Length[1] >> 16); + context->Message_Block[118] = (uint8_t)(context->Length[1] >> 8); + context->Message_Block[119] = (uint8_t)(context->Length[1]); + + context->Message_Block[120] = (uint8_t)(context->Length[2] >> 24); + context->Message_Block[121] = (uint8_t)(context->Length[2] >> 16); + context->Message_Block[122] = (uint8_t)(context->Length[2] >> 8); + context->Message_Block[123] = (uint8_t)(context->Length[2]); + context->Message_Block[124] = (uint8_t)(context->Length[3] >> 24); + context->Message_Block[125] = (uint8_t)(context->Length[3] >> 16); + context->Message_Block[126] = (uint8_t)(context->Length[3] >> 8); + context->Message_Block[127] = (uint8_t)(context->Length[3]); +#else /* !USE_32BIT_ONLY */ + context->Message_Block[112] = (uint8_t)(context->Length_High >> 56); + context->Message_Block[113] = (uint8_t)(context->Length_High >> 48); + context->Message_Block[114] = (uint8_t)(context->Length_High >> 40); + context->Message_Block[115] = (uint8_t)(context->Length_High >> 32); + context->Message_Block[116] = (uint8_t)(context->Length_High >> 24); + context->Message_Block[117] = (uint8_t)(context->Length_High >> 16); + context->Message_Block[118] = (uint8_t)(context->Length_High >> 8); + context->Message_Block[119] = (uint8_t)(context->Length_High); + + context->Message_Block[120] = (uint8_t)(context->Length_Low >> 56); + context->Message_Block[121] = (uint8_t)(context->Length_Low >> 48); + context->Message_Block[122] = (uint8_t)(context->Length_Low >> 40); + context->Message_Block[123] = (uint8_t)(context->Length_Low >> 32); + context->Message_Block[124] = (uint8_t)(context->Length_Low >> 24); + context->Message_Block[125] = (uint8_t)(context->Length_Low >> 16); + context->Message_Block[126] = (uint8_t)(context->Length_Low >> 8); + context->Message_Block[127] = (uint8_t)(context->Length_Low); +#endif /* USE_32BIT_ONLY */ + + + + +Eastlake 3rd & Hansen Informational [Page 59] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + SHA384_512ProcessMessageBlock(context); +} + +/* + * SHA384_512ProcessMessageBlock + * + * Description: + * This helper function will process the next 1024 bits of the + * message stored in the Message_Block array. + * + * Parameters: + * context: [in/out] + * The SHA context to update + * + * Returns: + * Nothing. + * + * Comments: + * Many of the variable names in this code, especially the + * single character names, were used because those were the + * names used in the publication. + * + * + */ +static void SHA384_512ProcessMessageBlock(SHA512Context *context) +{ + /* Constants defined in FIPS-180-2, section 4.2.3 */ +#ifdef USE_32BIT_ONLY + static const uint32_t K[80*2] = { + 0x428A2F98, 0xD728AE22, 0x71374491, 0x23EF65CD, 0xB5C0FBCF, + 0xEC4D3B2F, 0xE9B5DBA5, 0x8189DBBC, 0x3956C25B, 0xF348B538, + 0x59F111F1, 0xB605D019, 0x923F82A4, 0xAF194F9B, 0xAB1C5ED5, + 0xDA6D8118, 0xD807AA98, 0xA3030242, 0x12835B01, 0x45706FBE, + 0x243185BE, 0x4EE4B28C, 0x550C7DC3, 0xD5FFB4E2, 0x72BE5D74, + 0xF27B896F, 0x80DEB1FE, 0x3B1696B1, 0x9BDC06A7, 0x25C71235, + 0xC19BF174, 0xCF692694, 0xE49B69C1, 0x9EF14AD2, 0xEFBE4786, + 0x384F25E3, 0x0FC19DC6, 0x8B8CD5B5, 0x240CA1CC, 0x77AC9C65, + 0x2DE92C6F, 0x592B0275, 0x4A7484AA, 0x6EA6E483, 0x5CB0A9DC, + 0xBD41FBD4, 0x76F988DA, 0x831153B5, 0x983E5152, 0xEE66DFAB, + 0xA831C66D, 0x2DB43210, 0xB00327C8, 0x98FB213F, 0xBF597FC7, + 0xBEEF0EE4, 0xC6E00BF3, 0x3DA88FC2, 0xD5A79147, 0x930AA725, + 0x06CA6351, 0xE003826F, 0x14292967, 0x0A0E6E70, 0x27B70A85, + 0x46D22FFC, 0x2E1B2138, 0x5C26C926, 0x4D2C6DFC, 0x5AC42AED, + 0x53380D13, 0x9D95B3DF, 0x650A7354, 0x8BAF63DE, 0x766A0ABB, + 0x3C77B2A8, 0x81C2C92E, 0x47EDAEE6, 0x92722C85, 0x1482353B, + 0xA2BFE8A1, 0x4CF10364, 0xA81A664B, 0xBC423001, 0xC24B8B70, + 0xD0F89791, 0xC76C51A3, 0x0654BE30, 0xD192E819, 0xD6EF5218, + 0xD6990624, 0x5565A910, 0xF40E3585, 0x5771202A, 0x106AA070, + + + +Eastlake 3rd & Hansen Informational [Page 60] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + 0x32BBD1B8, 0x19A4C116, 0xB8D2D0C8, 0x1E376C08, 0x5141AB53, + 0x2748774C, 0xDF8EEB99, 0x34B0BCB5, 0xE19B48A8, 0x391C0CB3, + 0xC5C95A63, 0x4ED8AA4A, 0xE3418ACB, 0x5B9CCA4F, 0x7763E373, + 0x682E6FF3, 0xD6B2B8A3, 0x748F82EE, 0x5DEFB2FC, 0x78A5636F, + 0x43172F60, 0x84C87814, 0xA1F0AB72, 0x8CC70208, 0x1A6439EC, + 0x90BEFFFA, 0x23631E28, 0xA4506CEB, 0xDE82BDE9, 0xBEF9A3F7, + 0xB2C67915, 0xC67178F2, 0xE372532B, 0xCA273ECE, 0xEA26619C, + 0xD186B8C7, 0x21C0C207, 0xEADA7DD6, 0xCDE0EB1E, 0xF57D4F7F, + 0xEE6ED178, 0x06F067AA, 0x72176FBA, 0x0A637DC5, 0xA2C898A6, + 0x113F9804, 0xBEF90DAE, 0x1B710B35, 0x131C471B, 0x28DB77F5, + 0x23047D84, 0x32CAAB7B, 0x40C72493, 0x3C9EBE0A, 0x15C9BEBC, + 0x431D67C4, 0x9C100D4C, 0x4CC5D4BE, 0xCB3E42B6, 0x597F299C, + 0xFC657E2A, 0x5FCB6FAB, 0x3AD6FAEC, 0x6C44198C, 0x4A475817 + }; + int t, t2, t8; /* Loop counter */ + uint32_t temp1[2], temp2[2], /* Temporary word values */ + temp3[2], temp4[2], temp5[2]; + uint32_t W[2*80]; /* Word sequence */ + uint32_t A[2], B[2], C[2], D[2], /* Word buffers */ + E[2], F[2], G[2], H[2]; + + /* Initialize the first 16 words in the array W */ + for (t = t2 = t8 = 0; t < 16; t++, t8 += 8) { + W[t2++] = ((((uint32_t)context->Message_Block[t8 ])) << 24) | + ((((uint32_t)context->Message_Block[t8 + 1])) << 16) | + ((((uint32_t)context->Message_Block[t8 + 2])) << 8) | + ((((uint32_t)context->Message_Block[t8 + 3]))); + W[t2++] = ((((uint32_t)context->Message_Block[t8 + 4])) << 24) | + ((((uint32_t)context->Message_Block[t8 + 5])) << 16) | + ((((uint32_t)context->Message_Block[t8 + 6])) << 8) | + ((((uint32_t)context->Message_Block[t8 + 7]))); + } + + for (t = 16; t < 80; t++, t2 += 2) { + /* W[t] = SHA512_sigma1(W[t-2]) + W[t-7] + + SHA512_sigma0(W[t-15]) + W[t-16]; */ + uint32_t *Wt2 = &W[t2-2*2]; + uint32_t *Wt7 = &W[t2-7*2]; + uint32_t *Wt15 = &W[t2-15*2]; + uint32_t *Wt16 = &W[t2-16*2]; + SHA512_sigma1(Wt2, temp1); + SHA512_ADD(temp1, Wt7, temp2); + SHA512_sigma0(Wt15, temp1); + SHA512_ADD(temp1, Wt16, temp3); + SHA512_ADD(temp2, temp3, &W[t2]); + } + + A[0] = context->Intermediate_Hash[0]; + + + +Eastlake 3rd & Hansen Informational [Page 61] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + A[1] = context->Intermediate_Hash[1]; + B[0] = context->Intermediate_Hash[2]; + B[1] = context->Intermediate_Hash[3]; + C[0] = context->Intermediate_Hash[4]; + C[1] = context->Intermediate_Hash[5]; + D[0] = context->Intermediate_Hash[6]; + D[1] = context->Intermediate_Hash[7]; + E[0] = context->Intermediate_Hash[8]; + E[1] = context->Intermediate_Hash[9]; + F[0] = context->Intermediate_Hash[10]; + F[1] = context->Intermediate_Hash[11]; + G[0] = context->Intermediate_Hash[12]; + G[1] = context->Intermediate_Hash[13]; + H[0] = context->Intermediate_Hash[14]; + H[1] = context->Intermediate_Hash[15]; + + for (t = t2 = 0; t < 80; t++, t2 += 2) { + /* + * temp1 = H + SHA512_SIGMA1(E) + SHA_Ch(E,F,G) + K[t] + W[t]; + */ + SHA512_SIGMA1(E,temp1); + SHA512_ADD(H, temp1, temp2); + SHA_Ch(E,F,G,temp3); + SHA512_ADD(temp2, temp3, temp4); + SHA512_ADD(&K[t2], &W[t2], temp5); + SHA512_ADD(temp4, temp5, temp1); + /* + * temp2 = SHA512_SIGMA0(A) + SHA_Maj(A,B,C); + */ + SHA512_SIGMA0(A,temp3); + SHA_Maj(A,B,C,temp4); + SHA512_ADD(temp3, temp4, temp2); + H[0] = G[0]; H[1] = G[1]; + G[0] = F[0]; G[1] = F[1]; + F[0] = E[0]; F[1] = E[1]; + SHA512_ADD(D, temp1, E); + D[0] = C[0]; D[1] = C[1]; + C[0] = B[0]; C[1] = B[1]; + B[0] = A[0]; B[1] = A[1]; + SHA512_ADD(temp1, temp2, A); + } + + SHA512_ADDTO2(&context->Intermediate_Hash[0], A); + SHA512_ADDTO2(&context->Intermediate_Hash[2], B); + SHA512_ADDTO2(&context->Intermediate_Hash[4], C); + SHA512_ADDTO2(&context->Intermediate_Hash[6], D); + SHA512_ADDTO2(&context->Intermediate_Hash[8], E); + SHA512_ADDTO2(&context->Intermediate_Hash[10], F); + + + +Eastlake 3rd & Hansen Informational [Page 62] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + SHA512_ADDTO2(&context->Intermediate_Hash[12], G); + SHA512_ADDTO2(&context->Intermediate_Hash[14], H); + +#else /* !USE_32BIT_ONLY */ + static const uint64_t K[80] = { + 0x428A2F98D728AE22ll, 0x7137449123EF65CDll, 0xB5C0FBCFEC4D3B2Fll, + 0xE9B5DBA58189DBBCll, 0x3956C25BF348B538ll, 0x59F111F1B605D019ll, + 0x923F82A4AF194F9Bll, 0xAB1C5ED5DA6D8118ll, 0xD807AA98A3030242ll, + 0x12835B0145706FBEll, 0x243185BE4EE4B28Cll, 0x550C7DC3D5FFB4E2ll, + 0x72BE5D74F27B896Fll, 0x80DEB1FE3B1696B1ll, 0x9BDC06A725C71235ll, + 0xC19BF174CF692694ll, 0xE49B69C19EF14AD2ll, 0xEFBE4786384F25E3ll, + 0x0FC19DC68B8CD5B5ll, 0x240CA1CC77AC9C65ll, 0x2DE92C6F592B0275ll, + 0x4A7484AA6EA6E483ll, 0x5CB0A9DCBD41FBD4ll, 0x76F988DA831153B5ll, + 0x983E5152EE66DFABll, 0xA831C66D2DB43210ll, 0xB00327C898FB213Fll, + 0xBF597FC7BEEF0EE4ll, 0xC6E00BF33DA88FC2ll, 0xD5A79147930AA725ll, + 0x06CA6351E003826Fll, 0x142929670A0E6E70ll, 0x27B70A8546D22FFCll, + 0x2E1B21385C26C926ll, 0x4D2C6DFC5AC42AEDll, 0x53380D139D95B3DFll, + 0x650A73548BAF63DEll, 0x766A0ABB3C77B2A8ll, 0x81C2C92E47EDAEE6ll, + 0x92722C851482353Bll, 0xA2BFE8A14CF10364ll, 0xA81A664BBC423001ll, + 0xC24B8B70D0F89791ll, 0xC76C51A30654BE30ll, 0xD192E819D6EF5218ll, + 0xD69906245565A910ll, 0xF40E35855771202All, 0x106AA07032BBD1B8ll, + 0x19A4C116B8D2D0C8ll, 0x1E376C085141AB53ll, 0x2748774CDF8EEB99ll, + 0x34B0BCB5E19B48A8ll, 0x391C0CB3C5C95A63ll, 0x4ED8AA4AE3418ACBll, + 0x5B9CCA4F7763E373ll, 0x682E6FF3D6B2B8A3ll, 0x748F82EE5DEFB2FCll, + 0x78A5636F43172F60ll, 0x84C87814A1F0AB72ll, 0x8CC702081A6439ECll, + 0x90BEFFFA23631E28ll, 0xA4506CEBDE82BDE9ll, 0xBEF9A3F7B2C67915ll, + 0xC67178F2E372532Bll, 0xCA273ECEEA26619Cll, 0xD186B8C721C0C207ll, + 0xEADA7DD6CDE0EB1Ell, 0xF57D4F7FEE6ED178ll, 0x06F067AA72176FBAll, + 0x0A637DC5A2C898A6ll, 0x113F9804BEF90DAEll, 0x1B710B35131C471Bll, + 0x28DB77F523047D84ll, 0x32CAAB7B40C72493ll, 0x3C9EBE0A15C9BEBCll, + 0x431D67C49C100D4Cll, 0x4CC5D4BECB3E42B6ll, 0x597F299CFC657E2All, + 0x5FCB6FAB3AD6FAECll, 0x6C44198C4A475817ll + }; + int t, t8; /* Loop counter */ + uint64_t temp1, temp2; /* Temporary word value */ + uint64_t W[80]; /* Word sequence */ + uint64_t A, B, C, D, E, F, G, H; /* Word buffers */ + + /* + * Initialize the first 16 words in the array W + */ + for (t = t8 = 0; t < 16; t++, t8 += 8) + W[t] = ((uint64_t)(context->Message_Block[t8 ]) << 56) | + ((uint64_t)(context->Message_Block[t8 + 1]) << 48) | + ((uint64_t)(context->Message_Block[t8 + 2]) << 40) | + ((uint64_t)(context->Message_Block[t8 + 3]) << 32) | + ((uint64_t)(context->Message_Block[t8 + 4]) << 24) | + ((uint64_t)(context->Message_Block[t8 + 5]) << 16) | + + + +Eastlake 3rd & Hansen Informational [Page 63] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + ((uint64_t)(context->Message_Block[t8 + 6]) << 8) | + ((uint64_t)(context->Message_Block[t8 + 7])); + + for (t = 16; t < 80; t++) + W[t] = SHA512_sigma1(W[t-2]) + W[t-7] + + SHA512_sigma0(W[t-15]) + W[t-16]; + + A = context->Intermediate_Hash[0]; + B = context->Intermediate_Hash[1]; + C = context->Intermediate_Hash[2]; + D = context->Intermediate_Hash[3]; + E = context->Intermediate_Hash[4]; + F = context->Intermediate_Hash[5]; + G = context->Intermediate_Hash[6]; + H = context->Intermediate_Hash[7]; + + for (t = 0; t < 80; t++) { + temp1 = H + SHA512_SIGMA1(E) + SHA_Ch(E,F,G) + K[t] + W[t]; + temp2 = SHA512_SIGMA0(A) + SHA_Maj(A,B,C); + H = G; + G = F; + F = E; + E = D + temp1; + D = C; + C = B; + B = A; + A = temp1 + temp2; + } + + context->Intermediate_Hash[0] += A; + context->Intermediate_Hash[1] += B; + context->Intermediate_Hash[2] += C; + context->Intermediate_Hash[3] += D; + context->Intermediate_Hash[4] += E; + context->Intermediate_Hash[5] += F; + context->Intermediate_Hash[6] += G; + context->Intermediate_Hash[7] += H; +#endif /* USE_32BIT_ONLY */ + + context->Message_Block_Index = 0; +} + +/* + * SHA384_512Reset + * + * Description: + * This helper function will initialize the SHA512Context in + * preparation for computing a new SHA384 or SHA512 message + + + +Eastlake 3rd & Hansen Informational [Page 64] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * digest. + * + * Parameters: + * context: [in/out] + * The context to reset. + * H0 + * The initial hash value to use. + * + * Returns: + * sha Error Code. + * + */ +#ifdef USE_32BIT_ONLY +static int SHA384_512Reset(SHA512Context *context, uint32_t H0[]) +#else /* !USE_32BIT_ONLY */ +static int SHA384_512Reset(SHA512Context *context, uint64_t H0[]) +#endif /* USE_32BIT_ONLY */ +{ + int i; + if (!context) + return shaNull; + + context->Message_Block_Index = 0; + +#ifdef USE_32BIT_ONLY + context->Length[0] = context->Length[1] = 0; + context->Length[2] = context->Length[3] = 0; + + for (i = 0; i < SHA512HashSize/4; i++) + context->Intermediate_Hash[i] = H0[i]; +#else /* !USE_32BIT_ONLY */ + context->Length_High = context->Length_Low = 0; + + for (i = 0; i < SHA512HashSize/8; i++) + context->Intermediate_Hash[i] = H0[i]; +#endif /* USE_32BIT_ONLY */ + + context->Computed = 0; + context->Corrupted = 0; + + return shaSuccess; +} + +/* + * SHA384_512ResultN + * + * Description: + * This helper function will return the 384-bit or 512-bit message + + + +Eastlake 3rd & Hansen Informational [Page 65] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * digest into the Message_Digest array provided by the caller. + * NOTE: The first octet of hash is stored in the 0th element, + * the last octet of hash in the 48th/64th element. + * + * Parameters: + * context: [in/out] + * The context to use to calculate the SHA hash. + * Message_Digest: [out] + * Where the digest is returned. + * HashSize: [in] + * The size of the hash, either 48 or 64. + * + * Returns: + * sha Error Code. + * + */ +static int SHA384_512ResultN(SHA512Context *context, + uint8_t Message_Digest[], int HashSize) +{ + int i; + +#ifdef USE_32BIT_ONLY + int i2; +#endif /* USE_32BIT_ONLY */ + + if (!context || !Message_Digest) + return shaNull; + + if (context->Corrupted) + return context->Corrupted; + + if (!context->Computed) + SHA384_512Finalize(context, 0x80); + +#ifdef USE_32BIT_ONLY + for (i = i2 = 0; i < HashSize; ) { + Message_Digest[i++]=(uint8_t)(context->Intermediate_Hash[i2]>>24); + Message_Digest[i++]=(uint8_t)(context->Intermediate_Hash[i2]>>16); + Message_Digest[i++]=(uint8_t)(context->Intermediate_Hash[i2]>>8); + Message_Digest[i++]=(uint8_t)(context->Intermediate_Hash[i2++]); + Message_Digest[i++]=(uint8_t)(context->Intermediate_Hash[i2]>>24); + Message_Digest[i++]=(uint8_t)(context->Intermediate_Hash[i2]>>16); + Message_Digest[i++]=(uint8_t)(context->Intermediate_Hash[i2]>>8); + Message_Digest[i++]=(uint8_t)(context->Intermediate_Hash[i2++]); + } +#else /* !USE_32BIT_ONLY */ + for (i = 0; i < HashSize; ++i) + Message_Digest[i] = (uint8_t) + + + +Eastlake 3rd & Hansen Informational [Page 66] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + (context->Intermediate_Hash[i>>3] >> 8 * ( 7 - ( i % 8 ) )); +#endif /* USE_32BIT_ONLY */ + + return shaSuccess; +} + +8.2.4. usha.c + +/**************************** usha.c ****************************/ +/******************** See RFC 4634 for details ******************/ +/* + * Description: + * This file implements a unified interface to the SHA algorithms. + */ + +#include "sha.h" + +/* + * USHAReset + * + * Description: + * This function will initialize the SHA Context in preparation + * for computing a new SHA message digest. + * + * Parameters: + * context: [in/out] + * The context to reset. + * whichSha: [in] + * Selects which SHA reset to call + * + * Returns: + * sha Error Code. + * + */ +int USHAReset(USHAContext *ctx, enum SHAversion whichSha) +{ + if (ctx) { + ctx->whichSha = whichSha; + switch (whichSha) { + case SHA1: return SHA1Reset((SHA1Context*)&ctx->ctx); + case SHA224: return SHA224Reset((SHA224Context*)&ctx->ctx); + case SHA256: return SHA256Reset((SHA256Context*)&ctx->ctx); + case SHA384: return SHA384Reset((SHA384Context*)&ctx->ctx); + case SHA512: return SHA512Reset((SHA512Context*)&ctx->ctx); + default: return shaBadParam; + } + } else { + return shaNull; + + + +Eastlake 3rd & Hansen Informational [Page 67] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + } +} + +/* + * USHAInput + * + * Description: + * This function accepts an array of octets as the next portion + * of the message. + * + * Parameters: + * context: [in/out] + * The SHA context to update + * message_array: [in] + * An array of characters representing the next portion of + * the message. + * length: [in] + * The length of the message in message_array + * + * Returns: + * sha Error Code. + * + */ +int USHAInput(USHAContext *ctx, + const uint8_t *bytes, unsigned int bytecount) +{ + if (ctx) { + switch (ctx->whichSha) { + case SHA1: + return SHA1Input((SHA1Context*)&ctx->ctx, bytes, bytecount); + case SHA224: + return SHA224Input((SHA224Context*)&ctx->ctx, bytes, + bytecount); + case SHA256: + return SHA256Input((SHA256Context*)&ctx->ctx, bytes, + bytecount); + case SHA384: + return SHA384Input((SHA384Context*)&ctx->ctx, bytes, + bytecount); + case SHA512: + return SHA512Input((SHA512Context*)&ctx->ctx, bytes, + bytecount); + default: return shaBadParam; + } + } else { + return shaNull; + } +} + + + +Eastlake 3rd & Hansen Informational [Page 68] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +/* + * USHAFinalBits + * + * Description: + * This function will add in any final bits of the message. + * + * Parameters: + * context: [in/out] + * The SHA context to update + * message_bits: [in] + * The final bits of the message, in the upper portion of the + * byte. (Use 0b###00000 instead of 0b00000### to input the + * three bits ###.) + * length: [in] + * The number of bits in message_bits, between 1 and 7. + * + * Returns: + * sha Error Code. + */ +int USHAFinalBits(USHAContext *ctx, + const uint8_t bits, unsigned int bitcount) +{ + if (ctx) { + switch (ctx->whichSha) { + case SHA1: + return SHA1FinalBits((SHA1Context*)&ctx->ctx, bits, bitcount); + case SHA224: + return SHA224FinalBits((SHA224Context*)&ctx->ctx, bits, + bitcount); + case SHA256: + return SHA256FinalBits((SHA256Context*)&ctx->ctx, bits, + bitcount); + case SHA384: + return SHA384FinalBits((SHA384Context*)&ctx->ctx, bits, + bitcount); + case SHA512: + return SHA512FinalBits((SHA512Context*)&ctx->ctx, bits, + bitcount); + default: return shaBadParam; + } + } else { + return shaNull; + } +} + +/* + * USHAResult + * + + + +Eastlake 3rd & Hansen Informational [Page 69] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * Description: + * This function will return the 160-bit message digest into the + * Message_Digest array provided by the caller. + * NOTE: The first octet of hash is stored in the 0th element, + * the last octet of hash in the 19th element. + * + * Parameters: + * context: [in/out] + * The context to use to calculate the SHA-1 hash. + * Message_Digest: [out] + * Where the digest is returned. + * + * Returns: + * sha Error Code. + * + */ +int USHAResult(USHAContext *ctx, + uint8_t Message_Digest[USHAMaxHashSize]) +{ + if (ctx) { + switch (ctx->whichSha) { + case SHA1: + return SHA1Result((SHA1Context*)&ctx->ctx, Message_Digest); + case SHA224: + return SHA224Result((SHA224Context*)&ctx->ctx, Message_Digest); + case SHA256: + return SHA256Result((SHA256Context*)&ctx->ctx, Message_Digest); + case SHA384: + return SHA384Result((SHA384Context*)&ctx->ctx, Message_Digest); + case SHA512: + return SHA512Result((SHA512Context*)&ctx->ctx, Message_Digest); + default: return shaBadParam; + } + } else { + return shaNull; + } +} + +/* + * USHABlockSize + * + * Description: + * This function will return the blocksize for the given SHA + * algorithm. + * + * Parameters: + * whichSha: + * which SHA algorithm to query + + + +Eastlake 3rd & Hansen Informational [Page 70] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * + * Returns: + * block size + * + */ +int USHABlockSize(enum SHAversion whichSha) +{ + switch (whichSha) { + case SHA1: return SHA1_Message_Block_Size; + case SHA224: return SHA224_Message_Block_Size; + case SHA256: return SHA256_Message_Block_Size; + case SHA384: return SHA384_Message_Block_Size; + default: + case SHA512: return SHA512_Message_Block_Size; + } +} + +/* + * USHAHashSize + * + * Description: + * This function will return the hashsize for the given SHA + * algorithm. + * + * Parameters: + * whichSha: + * which SHA algorithm to query + * + * Returns: + * hash size + * + */ +int USHAHashSize(enum SHAversion whichSha) +{ + switch (whichSha) { + case SHA1: return SHA1HashSize; + case SHA224: return SHA224HashSize; + case SHA256: return SHA256HashSize; + case SHA384: return SHA384HashSize; + default: + case SHA512: return SHA512HashSize; + } +} + +/* + * USHAHashSizeBits + * + * Description: + + + +Eastlake 3rd & Hansen Informational [Page 71] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * This function will return the hashsize for the given SHA + * algorithm, expressed in bits. + * + * Parameters: + * whichSha: + * which SHA algorithm to query + * + * Returns: + * hash size in bits + * + */ +int USHAHashSizeBits(enum SHAversion whichSha) +{ + switch (whichSha) { + case SHA1: return SHA1HashSizeBits; + case SHA224: return SHA224HashSizeBits; + case SHA256: return SHA256HashSizeBits; + case SHA384: return SHA384HashSizeBits; + default: + case SHA512: return SHA512HashSizeBits; + } +} + +8.2.5. sha-private.h + +/*************************** sha-private.h ***************************/ +/********************** See RFC 4634 for details *********************/ +#ifndef _SHA_PRIVATE__H +#define _SHA_PRIVATE__H +/* + * These definitions are defined in FIPS-180-2, section 4.1. + * Ch() and Maj() are defined identically in sections 4.1.1, + * 4.1.2 and 4.1.3. + * + * The definitions used in FIPS-180-2 are as follows: + */ + +#ifndef USE_MODIFIED_MACROS +#define SHA_Ch(x,y,z) (((x) & (y)) ^ ((~(x)) & (z))) +#define SHA_Maj(x,y,z) (((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z))) + +#else /* USE_MODIFIED_MACROS */ +/* + * The following definitions are equivalent and potentially faster. + */ + +#define SHA_Ch(x, y, z) (((x) & ((y) ^ (z))) ^ (z)) +#define SHA_Maj(x, y, z) (((x) & ((y) | (z))) | ((y) & (z))) + + + +Eastlake 3rd & Hansen Informational [Page 72] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +#endif /* USE_MODIFIED_MACROS */ + +#define SHA_Parity(x, y, z) ((x) ^ (y) ^ (z)) + +#endif /* _SHA_PRIVATE__H */ + +8.3 The HMAC Code + +/**************************** hmac.c ****************************/ +/******************** See RFC 4634 for details ******************/ +/* + * Description: + * This file implements the HMAC algorithm (Keyed-Hashing for + * Message Authentication, RFC2104), expressed in terms of the + * various SHA algorithms. + */ + +#include "sha.h" + +/* + * hmac + * + * Description: + * This function will compute an HMAC message digest. + * + * Parameters: + * whichSha: [in] + * One of SHA1, SHA224, SHA256, SHA384, SHA512 + * key: [in] + * The secret shared key. + * key_len: [in] + * The length of the secret shared key. + * message_array: [in] + * An array of characters representing the message. + * length: [in] + * The length of the message in message_array + * digest: [out] + * Where the digest is returned. + * NOTE: The length of the digest is determined by + * the value of whichSha. + * + * Returns: + * sha Error Code. + * + */ +int hmac(SHAversion whichSha, const unsigned char *text, int text_len, + const unsigned char *key, int key_len, + uint8_t digest[USHAMaxHashSize]) + + + +Eastlake 3rd & Hansen Informational [Page 73] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +{ + HMACContext ctx; + return hmacReset(&ctx, whichSha, key, key_len) || + hmacInput(&ctx, text, text_len) || + hmacResult(&ctx, digest); +} + +/* + * hmacReset + * + * Description: + * This function will initialize the hmacContext in preparation + * for computing a new HMAC message digest. + * + * Parameters: + * context: [in/out] + * The context to reset. + * whichSha: [in] + * One of SHA1, SHA224, SHA256, SHA384, SHA512 + * key: [in] + * The secret shared key. + * key_len: [in] + * The length of the secret shared key. + * + * Returns: + * sha Error Code. + * + */ +int hmacReset(HMACContext *ctx, enum SHAversion whichSha, + const unsigned char *key, int key_len) +{ + int i, blocksize, hashsize; + + /* inner padding - key XORd with ipad */ + unsigned char k_ipad[USHA_Max_Message_Block_Size]; + + /* temporary buffer when keylen > blocksize */ + unsigned char tempkey[USHAMaxHashSize]; + + if (!ctx) return shaNull; + + blocksize = ctx->blockSize = USHABlockSize(whichSha); + hashsize = ctx->hashSize = USHAHashSize(whichSha); + + ctx->whichSha = whichSha; + + /* + * If key is longer than the hash blocksize, + + + +Eastlake 3rd & Hansen Informational [Page 74] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * reset it to key = HASH(key). + */ + if (key_len > blocksize) { + USHAContext tctx; + int err = USHAReset(&tctx, whichSha) || + USHAInput(&tctx, key, key_len) || + USHAResult(&tctx, tempkey); + if (err != shaSuccess) return err; + + key = tempkey; + key_len = hashsize; + } + + /* + * The HMAC transform looks like: + * + * SHA(K XOR opad, SHA(K XOR ipad, text)) + * + * where K is an n byte key. + * ipad is the byte 0x36 repeated blocksize times + * opad is the byte 0x5c repeated blocksize times + * and text is the data being protected. + */ + + /* store key into the pads, XOR'd with ipad and opad values */ + for (i = 0; i < key_len; i++) { + k_ipad[i] = key[i] ^ 0x36; + ctx->k_opad[i] = key[i] ^ 0x5c; + } + /* remaining pad bytes are '\0' XOR'd with ipad and opad values */ + for ( ; i < blocksize; i++) { + k_ipad[i] = 0x36; + ctx->k_opad[i] = 0x5c; + } + + /* perform inner hash */ + /* init context for 1st pass */ + return USHAReset(&ctx->shaContext, whichSha) || + /* and start with inner pad */ + USHAInput(&ctx->shaContext, k_ipad, blocksize); +} + +/* + * hmacInput + * + * Description: + * This function accepts an array of octets as the next portion + * of the message. + + + +Eastlake 3rd & Hansen Informational [Page 75] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * + * Parameters: + * context: [in/out] + * The HMAC context to update + * message_array: [in] + * An array of characters representing the next portion of + * the message. + * length: [in] + * The length of the message in message_array + * + * Returns: + * sha Error Code. + * + */ +int hmacInput(HMACContext *ctx, const unsigned char *text, + int text_len) +{ + if (!ctx) return shaNull; + /* then text of datagram */ + return USHAInput(&ctx->shaContext, text, text_len); +} + +/* + * HMACFinalBits + * + * Description: + * This function will add in any final bits of the message. + * + * Parameters: + * context: [in/out] + * The HMAC context to update + * message_bits: [in] + * The final bits of the message, in the upper portion of the + * byte. (Use 0b###00000 instead of 0b00000### to input the + * three bits ###.) + * length: [in] + * The number of bits in message_bits, between 1 and 7. + * + * Returns: + * sha Error Code. + */ +int hmacFinalBits(HMACContext *ctx, + const uint8_t bits, + unsigned int bitcount) +{ + if (!ctx) return shaNull; + /* then final bits of datagram */ + return USHAFinalBits(&ctx->shaContext, bits, bitcount); + + + +Eastlake 3rd & Hansen Informational [Page 76] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +} + +/* + * HMACResult + * + * Description: + * This function will return the N-byte message digest into the + * Message_Digest array provided by the caller. + * NOTE: The first octet of hash is stored in the 0th element, + * the last octet of hash in the Nth element. + * + * Parameters: + * context: [in/out] + * The context to use to calculate the HMAC hash. + * digest: [out] + * Where the digest is returned. + * NOTE 2: The length of the hash is determined by the value of + * whichSha that was passed to hmacReset(). + * + * Returns: + * sha Error Code. + * + */ +int hmacResult(HMACContext *ctx, uint8_t *digest) +{ + if (!ctx) return shaNull; + + /* finish up 1st pass */ + /* (Use digest here as a temporary buffer.) */ + return USHAResult(&ctx->shaContext, digest) || + + /* perform outer SHA */ + /* init context for 2nd pass */ + USHAReset(&ctx->shaContext, ctx->whichSha) || + + /* start with outer pad */ + USHAInput(&ctx->shaContext, ctx->k_opad, ctx->blockSize) || + + /* then results of 1st hash */ + USHAInput(&ctx->shaContext, digest, ctx->hashSize) || + + /* finish up 2nd pass */ + USHAResult(&ctx->shaContext, digest); +} + + + + + + + +Eastlake 3rd & Hansen Informational [Page 77] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +8.4. The Test Driver + + The following code is a main program test driver to exercise the code + in sha1.c, sha224-256.c, and sha384-512.c. The test driver can also + be used as a stand-alone program for generating the hashes. + + See also [RFC2202], [RFC4231], and [SHAVS]. + +/**************************** shatest.c ****************************/ +/********************* See RFC 4634 for details ********************/ +/* + * Description: + * This file will exercise the SHA code performing + * the three tests documented in FIPS PUB 180-2 + * (http://csrc.nist.gov/publications/fips/ + * fips180-2/fips180-2withchangenotice.pdf) + * one that calls SHAInput with an exact multiple of 512 bits + * the seven tests documented for each algorithm in + * "The Secure Hash Algorithm Validation System (SHAVS)", + * three of which are bit-level tests + * (http://csrc.nist.gov/cryptval/shs/SHAVS.pdf) + * + * This file will exercise the HMAC SHA1 code performing + * the seven tests documented in RFCs 2202 and 4231. + * + * To run the tests and just see PASSED/FAILED, use the -p option. + * + * Other options exercise: + * hashing an arbitrary string + * hashing a file's contents + * a few error test checks + * printing the results in raw format + * + * Portability Issues: + * None. + * + */ + +#include <stdint.h> +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <ctype.h> +#include "sha.h" + +static int xgetopt(int argc, char **argv, const char *optstring); +extern char *xoptarg; +static int scasecmp(const char *s1, const char *s2); + + + +Eastlake 3rd & Hansen Informational [Page 78] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +/* + * Define patterns for testing + */ +#define TEST1 "abc" +#define TEST2_1 \ + "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq" +#define TEST2_2a \ + "abcdefghbcdefghicdefghijdefghijkefghijklfghijklmghijklmn" +#define TEST2_2b \ + "hijklmnoijklmnopjklmnopqklmnopqrlmnopqrsmnopqrstnopqrstu" +#define TEST2_2 TEST2_2a TEST2_2b +#define TEST3 "a" /* times 1000000 */ +#define TEST4a "01234567012345670123456701234567" +#define TEST4b "01234567012345670123456701234567" + /* an exact multiple of 512 bits */ +#define TEST4 TEST4a TEST4b /* times 10 */ + +#define TEST7_1 \ + "\x49\xb2\xae\xc2\x59\x4b\xbe\x3a\x3b\x11\x75\x42\xd9\x4a\xc8" +#define TEST8_1 \ + "\x9a\x7d\xfd\xf1\xec\xea\xd0\x6e\xd6\x46\xaa\x55\xfe\x75\x71\x46" +#define TEST9_1 \ + "\x65\xf9\x32\x99\x5b\xa4\xce\x2c\xb1\xb4\xa2\xe7\x1a\xe7\x02\x20" \ + "\xaa\xce\xc8\x96\x2d\xd4\x49\x9c\xbd\x7c\x88\x7a\x94\xea\xaa\x10" \ + "\x1e\xa5\xaa\xbc\x52\x9b\x4e\x7e\x43\x66\x5a\x5a\xf2\xcd\x03\xfe" \ + "\x67\x8e\xa6\xa5\x00\x5b\xba\x3b\x08\x22\x04\xc2\x8b\x91\x09\xf4" \ + "\x69\xda\xc9\x2a\xaa\xb3\xaa\x7c\x11\xa1\xb3\x2a" +#define TEST10_1 \ + "\xf7\x8f\x92\x14\x1b\xcd\x17\x0a\xe8\x9b\x4f\xba\x15\xa1\xd5\x9f" \ + "\x3f\xd8\x4d\x22\x3c\x92\x51\xbd\xac\xbb\xae\x61\xd0\x5e\xd1\x15" \ + "\xa0\x6a\x7c\xe1\x17\xb7\xbe\xea\xd2\x44\x21\xde\xd9\xc3\x25\x92" \ + "\xbd\x57\xed\xea\xe3\x9c\x39\xfa\x1f\xe8\x94\x6a\x84\xd0\xcf\x1f" \ + "\x7b\xee\xad\x17\x13\xe2\xe0\x95\x98\x97\x34\x7f\x67\xc8\x0b\x04" \ + "\x00\xc2\x09\x81\x5d\x6b\x10\xa6\x83\x83\x6f\xd5\x56\x2a\x56\xca" \ + "\xb1\xa2\x8e\x81\xb6\x57\x66\x54\x63\x1c\xf1\x65\x66\xb8\x6e\x3b" \ + "\x33\xa1\x08\xb0\x53\x07\xc0\x0a\xff\x14\xa7\x68\xed\x73\x50\x60" \ + "\x6a\x0f\x85\xe6\xa9\x1d\x39\x6f\x5b\x5c\xbe\x57\x7f\x9b\x38\x80" \ + "\x7c\x7d\x52\x3d\x6d\x79\x2f\x6e\xbc\x24\xa4\xec\xf2\xb3\xa4\x27" \ + "\xcd\xbb\xfb" +#define TEST7_224 \ + "\xf0\x70\x06\xf2\x5a\x0b\xea\x68\xcd\x76\xa2\x95\x87\xc2\x8d" +#define TEST8_224 \ + "\x18\x80\x40\x05\xdd\x4f\xbd\x15\x56\x29\x9d\x6f\x9d\x93\xdf\x62" +#define TEST9_224 \ + "\xa2\xbe\x6e\x46\x32\x81\x09\x02\x94\xd9\xce\x94\x82\x65\x69\x42" \ + "\x3a\x3a\x30\x5e\xd5\xe2\x11\x6c\xd4\xa4\xc9\x87\xfc\x06\x57\x00" \ + "\x64\x91\xb1\x49\xcc\xd4\xb5\x11\x30\xac\x62\xb1\x9d\xc2\x48\xc7" \ + "\x44\x54\x3d\x20\xcd\x39\x52\xdc\xed\x1f\x06\xcc\x3b\x18\xb9\x1f" \ + + + +Eastlake 3rd & Hansen Informational [Page 79] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + "\x3f\x55\x63\x3e\xcc\x30\x85\xf4\x90\x70\x60\xd2" +#define TEST10_224 \ + "\x55\xb2\x10\x07\x9c\x61\xb5\x3a\xdd\x52\x06\x22\xd1\xac\x97\xd5" \ + "\xcd\xbe\x8c\xb3\x3a\xa0\xae\x34\x45\x17\xbe\xe4\xd7\xba\x09\xab" \ + "\xc8\x53\x3c\x52\x50\x88\x7a\x43\xbe\xbb\xac\x90\x6c\x2e\x18\x37" \ + "\xf2\x6b\x36\xa5\x9a\xe3\xbe\x78\x14\xd5\x06\x89\x6b\x71\x8b\x2a" \ + "\x38\x3e\xcd\xac\x16\xb9\x61\x25\x55\x3f\x41\x6f\xf3\x2c\x66\x74" \ + "\xc7\x45\x99\xa9\x00\x53\x86\xd9\xce\x11\x12\x24\x5f\x48\xee\x47" \ + "\x0d\x39\x6c\x1e\xd6\x3b\x92\x67\x0c\xa5\x6e\xc8\x4d\xee\xa8\x14" \ + "\xb6\x13\x5e\xca\x54\x39\x2b\xde\xdb\x94\x89\xbc\x9b\x87\x5a\x8b" \ + "\xaf\x0d\xc1\xae\x78\x57\x36\x91\x4a\xb7\xda\xa2\x64\xbc\x07\x9d" \ + "\x26\x9f\x2c\x0d\x7e\xdd\xd8\x10\xa4\x26\x14\x5a\x07\x76\xf6\x7c" \ + "\x87\x82\x73" +#define TEST7_256 \ + "\xbe\x27\x46\xc6\xdb\x52\x76\x5f\xdb\x2f\x88\x70\x0f\x9a\x73" +#define TEST8_256 \ + "\xe3\xd7\x25\x70\xdc\xdd\x78\x7c\xe3\x88\x7a\xb2\xcd\x68\x46\x52" +#define TEST9_256 \ + "\x3e\x74\x03\x71\xc8\x10\xc2\xb9\x9f\xc0\x4e\x80\x49\x07\xef\x7c" \ + "\xf2\x6b\xe2\x8b\x57\xcb\x58\xa3\xe2\xf3\xc0\x07\x16\x6e\x49\xc1" \ + "\x2e\x9b\xa3\x4c\x01\x04\x06\x91\x29\xea\x76\x15\x64\x25\x45\x70" \ + "\x3a\x2b\xd9\x01\xe1\x6e\xb0\xe0\x5d\xeb\xa0\x14\xeb\xff\x64\x06" \ + "\xa0\x7d\x54\x36\x4e\xff\x74\x2d\xa7\x79\xb0\xb3" +#define TEST10_256 \ + "\x83\x26\x75\x4e\x22\x77\x37\x2f\x4f\xc1\x2b\x20\x52\x7a\xfe\xf0" \ + "\x4d\x8a\x05\x69\x71\xb1\x1a\xd5\x71\x23\xa7\xc1\x37\x76\x00\x00" \ + "\xd7\xbe\xf6\xf3\xc1\xf7\xa9\x08\x3a\xa3\x9d\x81\x0d\xb3\x10\x77" \ + "\x7d\xab\x8b\x1e\x7f\x02\xb8\x4a\x26\xc7\x73\x32\x5f\x8b\x23\x74" \ + "\xde\x7a\x4b\x5a\x58\xcb\x5c\x5c\xf3\x5b\xce\xe6\xfb\x94\x6e\x5b" \ + "\xd6\x94\xfa\x59\x3a\x8b\xeb\x3f\x9d\x65\x92\xec\xed\xaa\x66\xca" \ + "\x82\xa2\x9d\x0c\x51\xbc\xf9\x33\x62\x30\xe5\xd7\x84\xe4\xc0\xa4" \ + "\x3f\x8d\x79\xa3\x0a\x16\x5c\xba\xbe\x45\x2b\x77\x4b\x9c\x71\x09" \ + "\xa9\x7d\x13\x8f\x12\x92\x28\x96\x6f\x6c\x0a\xdc\x10\x6a\xad\x5a" \ + "\x9f\xdd\x30\x82\x57\x69\xb2\xc6\x71\xaf\x67\x59\xdf\x28\xeb\x39" \ + "\x3d\x54\xd6" +#define TEST7_384 \ + "\x8b\xc5\x00\xc7\x7c\xee\xd9\x87\x9d\xa9\x89\x10\x7c\xe0\xaa" +#define TEST8_384 \ + "\xa4\x1c\x49\x77\x79\xc0\x37\x5f\xf1\x0a\x7f\x4e\x08\x59\x17\x39" +#define TEST9_384 \ + "\x68\xf5\x01\x79\x2d\xea\x97\x96\x76\x70\x22\xd9\x3d\xa7\x16\x79" \ + "\x30\x99\x20\xfa\x10\x12\xae\xa3\x57\xb2\xb1\x33\x1d\x40\xa1\xd0" \ + "\x3c\x41\xc2\x40\xb3\xc9\xa7\x5b\x48\x92\xf4\xc0\x72\x4b\x68\xc8" \ + "\x75\x32\x1a\xb8\xcf\xe5\x02\x3b\xd3\x75\xbc\x0f\x94\xbd\x89\xfe" \ + "\x04\xf2\x97\x10\x5d\x7b\x82\xff\xc0\x02\x1a\xeb\x1c\xcb\x67\x4f" \ + "\x52\x44\xea\x34\x97\xde\x26\xa4\x19\x1c\x5f\x62\xe5\xe9\xa2\xd8" \ + "\x08\x2f\x05\x51\xf4\xa5\x30\x68\x26\xe9\x1c\xc0\x06\xce\x1b\xf6" \ + "\x0f\xf7\x19\xd4\x2f\xa5\x21\xc8\x71\xcd\x23\x94\xd9\x6e\xf4\x46" \ + + + +Eastlake 3rd & Hansen Informational [Page 80] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + "\x8f\x21\x96\x6b\x41\xf2\xba\x80\xc2\x6e\x83\xa9" +#define TEST10_384 \ + "\x39\x96\x69\xe2\x8f\x6b\x9c\x6d\xbc\xbb\x69\x12\xec\x10\xff\xcf" \ + "\x74\x79\x03\x49\xb7\xdc\x8f\xbe\x4a\x8e\x7b\x3b\x56\x21\xdb\x0f" \ + "\x3e\x7d\xc8\x7f\x82\x32\x64\xbb\xe4\x0d\x18\x11\xc9\xea\x20\x61" \ + "\xe1\xc8\x4a\xd1\x0a\x23\xfa\xc1\x72\x7e\x72\x02\xfc\x3f\x50\x42" \ + "\xe6\xbf\x58\xcb\xa8\xa2\x74\x6e\x1f\x64\xf9\xb9\xea\x35\x2c\x71" \ + "\x15\x07\x05\x3c\xf4\xe5\x33\x9d\x52\x86\x5f\x25\xcc\x22\xb5\xe8" \ + "\x77\x84\xa1\x2f\xc9\x61\xd6\x6c\xb6\xe8\x95\x73\x19\x9a\x2c\xe6" \ + "\x56\x5c\xbd\xf1\x3d\xca\x40\x38\x32\xcf\xcb\x0e\x8b\x72\x11\xe8" \ + "\x3a\xf3\x2a\x11\xac\x17\x92\x9f\xf1\xc0\x73\xa5\x1c\xc0\x27\xaa" \ + "\xed\xef\xf8\x5a\xad\x7c\x2b\x7c\x5a\x80\x3e\x24\x04\xd9\x6d\x2a" \ + "\x77\x35\x7b\xda\x1a\x6d\xae\xed\x17\x15\x1c\xb9\xbc\x51\x25\xa4" \ + "\x22\xe9\x41\xde\x0c\xa0\xfc\x50\x11\xc2\x3e\xcf\xfe\xfd\xd0\x96" \ + "\x76\x71\x1c\xf3\xdb\x0a\x34\x40\x72\x0e\x16\x15\xc1\xf2\x2f\xbc" \ + "\x3c\x72\x1d\xe5\x21\xe1\xb9\x9b\xa1\xbd\x55\x77\x40\x86\x42\x14" \ + "\x7e\xd0\x96" +#define TEST7_512 \ + "\x08\xec\xb5\x2e\xba\xe1\xf7\x42\x2d\xb6\x2b\xcd\x54\x26\x70" +#define TEST8_512 \ + "\x8d\x4e\x3c\x0e\x38\x89\x19\x14\x91\x81\x6e\x9d\x98\xbf\xf0\xa0" +#define TEST9_512 \ + "\x3a\xdd\xec\x85\x59\x32\x16\xd1\x61\x9a\xa0\x2d\x97\x56\x97\x0b" \ + "\xfc\x70\xac\xe2\x74\x4f\x7c\x6b\x27\x88\x15\x10\x28\xf7\xb6\xa2" \ + "\x55\x0f\xd7\x4a\x7e\x6e\x69\xc2\xc9\xb4\x5f\xc4\x54\x96\x6d\xc3" \ + "\x1d\x2e\x10\xda\x1f\x95\xce\x02\xbe\xb4\xbf\x87\x65\x57\x4c\xbd" \ + "\x6e\x83\x37\xef\x42\x0a\xdc\x98\xc1\x5c\xb6\xd5\xe4\xa0\x24\x1b" \ + "\xa0\x04\x6d\x25\x0e\x51\x02\x31\xca\xc2\x04\x6c\x99\x16\x06\xab" \ + "\x4e\xe4\x14\x5b\xee\x2f\xf4\xbb\x12\x3a\xab\x49\x8d\x9d\x44\x79" \ + "\x4f\x99\xcc\xad\x89\xa9\xa1\x62\x12\x59\xed\xa7\x0a\x5b\x6d\xd4" \ + "\xbd\xd8\x77\x78\xc9\x04\x3b\x93\x84\xf5\x49\x06" +#define TEST10_512 \ + "\xa5\x5f\x20\xc4\x11\xaa\xd1\x32\x80\x7a\x50\x2d\x65\x82\x4e\x31" \ + "\xa2\x30\x54\x32\xaa\x3d\x06\xd3\xe2\x82\xa8\xd8\x4e\x0d\xe1\xde" \ + "\x69\x74\xbf\x49\x54\x69\xfc\x7f\x33\x8f\x80\x54\xd5\x8c\x26\xc4" \ + "\x93\x60\xc3\xe8\x7a\xf5\x65\x23\xac\xf6\xd8\x9d\x03\xe5\x6f\xf2" \ + "\xf8\x68\x00\x2b\xc3\xe4\x31\xed\xc4\x4d\xf2\xf0\x22\x3d\x4b\xb3" \ + "\xb2\x43\x58\x6e\x1a\x7d\x92\x49\x36\x69\x4f\xcb\xba\xf8\x8d\x95" \ + "\x19\xe4\xeb\x50\xa6\x44\xf8\xe4\xf9\x5e\xb0\xea\x95\xbc\x44\x65" \ + "\xc8\x82\x1a\xac\xd2\xfe\x15\xab\x49\x81\x16\x4b\xbb\x6d\xc3\x2f" \ + "\x96\x90\x87\xa1\x45\xb0\xd9\xcc\x9c\x67\xc2\x2b\x76\x32\x99\x41" \ + "\x9c\xc4\x12\x8b\xe9\xa0\x77\xb3\xac\xe6\x34\x06\x4e\x6d\x99\x28" \ + "\x35\x13\xdc\x06\xe7\x51\x5d\x0d\x73\x13\x2e\x9a\x0d\xc6\xd3\xb1" \ + "\xf8\xb2\x46\xf1\xa9\x8a\x3f\xc7\x29\x41\xb1\xe3\xbb\x20\x98\xe8" \ + "\xbf\x16\xf2\x68\xd6\x4f\x0b\x0f\x47\x07\xfe\x1e\xa1\xa1\x79\x1b" \ + "\xa2\xf3\xc0\xc7\x58\xe5\xf5\x51\x86\x3a\x96\xc9\x49\xad\x47\xd7" \ + "\xfb\x40\xd2" +#define SHA1_SEED "\xd0\x56\x9c\xb3\x66\x5a\x8a\x43\xeb\x6e\xa2\x3d" \ + + + +Eastlake 3rd & Hansen Informational [Page 81] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + "\x75\xa3\xc4\xd2\x05\x4a\x0d\x7d" +#define SHA224_SEED "\xd0\x56\x9c\xb3\x66\x5a\x8a\x43\xeb\x6e\xa2" \ + "\x3d\x75\xa3\xc4\xd2\x05\x4a\x0d\x7d\x66\xa9\xca\x99\xc9\xce\xb0" \ + "\x27" +#define SHA256_SEED "\xf4\x1e\xce\x26\x13\xe4\x57\x39\x15\x69\x6b" \ + "\x5a\xdc\xd5\x1c\xa3\x28\xbe\x3b\xf5\x66\xa9\xca\x99\xc9\xce\xb0" \ + "\x27\x9c\x1c\xb0\xa7" +#define SHA384_SEED "\x82\x40\xbc\x51\xe4\xec\x7e\xf7\x6d\x18\xe3" \ + "\x52\x04\xa1\x9f\x51\xa5\x21\x3a\x73\xa8\x1d\x6f\x94\x46\x80\xd3" \ + "\x07\x59\x48\xb7\xe4\x63\x80\x4e\xa3\xd2\x6e\x13\xea\x82\x0d\x65" \ + "\xa4\x84\xbe\x74\x53" +#define SHA512_SEED "\x47\x3f\xf1\xb9\xb3\xff\xdf\xa1\x26\x69\x9a" \ + "\xc7\xef\x9e\x8e\x78\x77\x73\x09\x58\x24\xc6\x42\x55\x7c\x13\x99" \ + "\xd9\x8e\x42\x20\x44\x8d\xc3\x5b\x99\xbf\xdd\x44\x77\x95\x43\x92" \ + "\x4c\x1c\xe9\x3b\xc5\x94\x15\x38\x89\x5d\xb9\x88\x26\x1b\x00\x77" \ + "\x4b\x12\x27\x20\x39" + +#define TESTCOUNT 10 +#define HASHCOUNT 5 +#define RANDOMCOUNT 4 +#define HMACTESTCOUNT 7 + +#define PRINTNONE 0 +#define PRINTTEXT 1 +#define PRINTRAW 2 +#define PRINTHEX 3 +#define PRINTBASE64 4 + +#define PRINTPASSFAIL 1 +#define PRINTFAIL 2 + +#define length(x) (sizeof(x)-1) + +/* Test arrays for hashes. */ +struct hash { + const char *name; + SHAversion whichSha; + int hashsize; + struct { + const char *testarray; + int length; + long repeatcount; + int extrabits; + int numberExtrabits; + const char *resultarray; + } tests[TESTCOUNT]; + const char *randomtest; + const char *randomresults[RANDOMCOUNT]; + + + +Eastlake 3rd & Hansen Informational [Page 82] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +} hashes[HASHCOUNT] = { + { "SHA1", SHA1, SHA1HashSize, + { + /* 1 */ { TEST1, length(TEST1), 1, 0, 0, + "A9993E364706816ABA3E25717850C26C9CD0D89D" }, + /* 2 */ { TEST2_1, length(TEST2_1), 1, 0, 0, + "84983E441C3BD26EBAAE4AA1F95129E5E54670F1" }, + /* 3 */ { TEST3, length(TEST3), 1000000, 0, 0, + "34AA973CD4C4DAA4F61EEB2BDBAD27316534016F" }, + /* 4 */ { TEST4, length(TEST4), 10, 0, 0, + "DEA356A2CDDD90C7A7ECEDC5EBB563934F460452" }, + /* 5 */ { "", 0, 0, 0x98, 5, + "29826B003B906E660EFF4027CE98AF3531AC75BA" }, + /* 6 */ { "\x5e", 1, 1, 0, 0, + "5E6F80A34A9798CAFC6A5DB96CC57BA4C4DB59C2" }, + /* 7 */ { TEST7_1, length(TEST7_1), 1, 0x80, 3, + "6239781E03729919C01955B3FFA8ACB60B988340" }, + /* 8 */ { TEST8_1, length(TEST8_1), 1, 0, 0, + "82ABFF6605DBE1C17DEF12A394FA22A82B544A35" }, + /* 9 */ { TEST9_1, length(TEST9_1), 1, 0xE0, 3, + "8C5B2A5DDAE5A97FC7F9D85661C672ADBF7933D4" }, + /* 10 */ { TEST10_1, length(TEST10_1), 1, 0, 0, + "CB0082C8F197D260991BA6A460E76E202BAD27B3" } + }, SHA1_SEED, { "E216836819477C7F78E0D843FE4FF1B6D6C14CD4", + "A2DBC7A5B1C6C0A8BCB7AAA41252A6A7D0690DBC", + "DB1F9050BB863DFEF4CE37186044E2EEB17EE013", + "127FDEDF43D372A51D5747C48FBFFE38EF6CDF7B" + } }, + { "SHA224", SHA224, SHA224HashSize, + { + /* 1 */ { TEST1, length(TEST1), 1, 0, 0, + "23097D223405D8228642A477BDA255B32AADBCE4BDA0B3F7E36C9DA7" }, + /* 2 */ { TEST2_1, length(TEST2_1), 1, 0, 0, + "75388B16512776CC5DBA5DA1FD890150B0C6455CB4F58B1952522525" }, + /* 3 */ { TEST3, length(TEST3), 1000000, 0, 0, + "20794655980C91D8BBB4C1EA97618A4BF03F42581948B2EE4EE7AD67" }, + /* 4 */ { TEST4, length(TEST4), 10, 0, 0, + "567F69F168CD7844E65259CE658FE7AADFA25216E68ECA0EB7AB8262" }, + /* 5 */ { "", 0, 0, 0x68, 5, + "E3B048552C3C387BCAB37F6EB06BB79B96A4AEE5FF27F51531A9551C" }, + /* 6 */ { "\x07", 1, 1, 0, 0, + "00ECD5F138422B8AD74C9799FD826C531BAD2FCABC7450BEE2AA8C2A" }, + /* 7 */ { TEST7_224, length(TEST7_224), 1, 0xA0, 3, + "1B01DB6CB4A9E43DED1516BEB3DB0B87B6D1EA43187462C608137150" }, + /* 8 */ { TEST8_224, length(TEST8_224), 1, 0, 0, + "DF90D78AA78821C99B40BA4C966921ACCD8FFB1E98AC388E56191DB1" }, + /* 9 */ { TEST9_224, length(TEST9_224), 1, 0xE0, 3, + "54BEA6EAB8195A2EB0A7906A4B4A876666300EEFBD1F3B8474F9CD57" }, + + + +Eastlake 3rd & Hansen Informational [Page 83] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + /* 10 */ { TEST10_224, length(TEST10_224), 1, 0, 0, + "0B31894EC8937AD9B91BDFBCBA294D9ADEFAA18E09305E9F20D5C3A4" } + }, SHA224_SEED, { "100966A5B4FDE0B42E2A6C5953D4D7F41BA7CF79FD" + "2DF431416734BE", "1DCA396B0C417715DEFAAE9641E10A2E99D55A" + "BCB8A00061EB3BE8BD", "1864E627BDB2319973CD5ED7D68DA71D8B" + "F0F983D8D9AB32C34ADB34", "A2406481FC1BCAF24DD08E6752E844" + "709563FB916227FED598EB621F" + } }, + { "SHA256", SHA256, SHA256HashSize, + { + /* 1 */ { TEST1, length(TEST1), 1, 0, 0, "BA7816BF8F01CFEA4141" + "40DE5DAE2223B00361A396177A9CB410FF61F20015AD" }, + /* 2 */ { TEST2_1, length(TEST2_1), 1, 0, 0, "248D6A61D20638B8" + "E5C026930C3E6039A33CE45964FF2167F6ECEDD419DB06C1" }, + /* 3 */ { TEST3, length(TEST3), 1000000, 0, 0, "CDC76E5C9914FB92" + "81A1C7E284D73E67F1809A48A497200E046D39CCC7112CD0" }, + /* 4 */ { TEST4, length(TEST4), 10, 0, 0, "594847328451BDFA" + "85056225462CC1D867D877FB388DF0CE35F25AB5562BFBB5" }, + /* 5 */ { "", 0, 0, 0x68, 5, "D6D3E02A31A84A8CAA9718ED6C2057BE" + "09DB45E7823EB5079CE7A573A3760F95" }, + /* 6 */ { "\x19", 1, 1, 0, 0, "68AA2E2EE5DFF96E3355E6C7EE373E3D" + "6A4E17F75F9518D843709C0C9BC3E3D4" }, + /* 7 */ { TEST7_256, length(TEST7_256), 1, 0x60, 3, "77EC1DC8" + "9C821FF2A1279089FA091B35B8CD960BCAF7DE01C6A7680756BEB972" }, + /* 8 */ { TEST8_256, length(TEST8_256), 1, 0, 0, "175EE69B02BA" + "9B58E2B0A5FD13819CEA573F3940A94F825128CF4209BEABB4E8" }, + /* 9 */ { TEST9_256, length(TEST9_256), 1, 0xA0, 3, "3E9AD646" + "8BBBAD2AC3C2CDC292E018BA5FD70B960CF1679777FCE708FDB066E9" }, + /* 10 */ { TEST10_256, length(TEST10_256), 1, 0, 0, "97DBCA7D" + "F46D62C8A422C941DD7E835B8AD3361763F7E9B2D95F4F0DA6E1CCBC" }, + }, SHA256_SEED, { "83D28614D49C3ADC1D6FC05DB5F48037C056F8D2A4CE44" + "EC6457DEA5DD797CD1", "99DBE3127EF2E93DD9322D6A07909EB33B6399" + "5E529B3F954B8581621BB74D39", "8D4BE295BB64661CA3C7EFD129A2F7" + "25B33072DBDDE32385B9A87B9AF88EA76F", "40AF5D3F9716B040DF9408" + "E31536B70FF906EC51B00447CA97D7DD97C12411F4" + } }, + { "SHA384", SHA384, SHA384HashSize, + { + /* 1 */ { TEST1, length(TEST1), 1, 0, 0, + "CB00753F45A35E8BB5A03D699AC65007272C32AB0EDED163" + "1A8B605A43FF5BED8086072BA1E7CC2358BAECA134C825A7" }, + /* 2 */ { TEST2_2, length(TEST2_2), 1, 0, 0, + "09330C33F71147E83D192FC782CD1B4753111B173B3B05D2" + "2FA08086E3B0F712FCC7C71A557E2DB966C3E9FA91746039" }, + /* 3 */ { TEST3, length(TEST3), 1000000, 0, 0, + "9D0E1809716474CB086E834E310A4A1CED149E9C00F24852" + "7972CEC5704C2A5B07B8B3DC38ECC4EBAE97DDD87F3D8985" }, + /* 4 */ { TEST4, length(TEST4), 10, 0, 0, + + + +Eastlake 3rd & Hansen Informational [Page 84] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + "2FC64A4F500DDB6828F6A3430B8DD72A368EB7F3A8322A70" + "BC84275B9C0B3AB00D27A5CC3C2D224AA6B61A0D79FB4596" }, + /* 5 */ { "", 0, 0, 0x10, 5, + "8D17BE79E32B6718E07D8A603EB84BA0478F7FCFD1BB9399" + "5F7D1149E09143AC1FFCFC56820E469F3878D957A15A3FE4" }, + /* 6 */ { "\xb9", 1, 1, 0, 0, + "BC8089A19007C0B14195F4ECC74094FEC64F01F90929282C" + "2FB392881578208AD466828B1C6C283D2722CF0AD1AB6938" }, + /* 7 */ { TEST7_384, length(TEST7_384), 1, 0xA0, 3, + "D8C43B38E12E7C42A7C9B810299FD6A770BEF30920F17532" + "A898DE62C7A07E4293449C0B5FA70109F0783211CFC4BCE3" }, + /* 8 */ { TEST8_384, length(TEST8_384), 1, 0, 0, + "C9A68443A005812256B8EC76B00516F0DBB74FAB26D66591" + "3F194B6FFB0E91EA9967566B58109CBC675CC208E4C823F7" }, + /* 9 */ { TEST9_384, length(TEST9_384), 1, 0xE0, 3, + "5860E8DE91C21578BB4174D227898A98E0B45C4C760F0095" + "49495614DAEDC0775D92D11D9F8CE9B064EEAC8DAFC3A297" }, + /* 10 */ { TEST10_384, length(TEST10_384), 1, 0, 0, + "4F440DB1E6EDD2899FA335F09515AA025EE177A79F4B4AAF" + "38E42B5C4DE660F5DE8FB2A5B2FBD2A3CBFFD20CFF1288C0" } + }, SHA384_SEED, { "CE44D7D63AE0C91482998CF662A51EC80BF6FC68661A3C" + "57F87566112BD635A743EA904DEB7D7A42AC808CABE697F38F", "F9C6D2" + "61881FEE41ACD39E67AA8D0BAD507C7363EB67E2B81F45759F9C0FD7B503" + "DF1A0B9E80BDE7BC333D75B804197D", "D96512D8C9F4A7A4967A366C01" + "C6FD97384225B58343A88264847C18E4EF8AB7AEE4765FFBC3E30BD485D3" + "638A01418F", "0CA76BD0813AF1509E170907A96005938BC985628290B2" + "5FEF73CF6FAD68DDBA0AC8920C94E0541607B0915A7B4457F7" + } }, + { "SHA512", SHA512, SHA512HashSize, + { + /* 1 */ { TEST1, length(TEST1), 1, 0, 0, + "DDAF35A193617ABACC417349AE20413112E6FA4E89A97EA2" + "0A9EEEE64B55D39A2192992A274FC1A836BA3C23A3FEEBBD" + "454D4423643CE80E2A9AC94FA54CA49F" }, + /* 2 */ { TEST2_2, length(TEST2_2), 1, 0, 0, + "8E959B75DAE313DA8CF4F72814FC143F8F7779C6EB9F7FA1" + "7299AEADB6889018501D289E4900F7E4331B99DEC4B5433A" + "C7D329EEB6DD26545E96E55B874BE909" }, + /* 3 */ { TEST3, length(TEST3), 1000000, 0, 0, + "E718483D0CE769644E2E42C7BC15B4638E1F98B13B204428" + "5632A803AFA973EBDE0FF244877EA60A4CB0432CE577C31B" + "EB009C5C2C49AA2E4EADB217AD8CC09B" }, + /* 4 */ { TEST4, length(TEST4), 10, 0, 0, + "89D05BA632C699C31231DED4FFC127D5A894DAD412C0E024" + "DB872D1ABD2BA8141A0F85072A9BE1E2AA04CF33C765CB51" + "0813A39CD5A84C4ACAA64D3F3FB7BAE9" }, + /* 5 */ { "", 0, 0, 0xB0, 5, + "D4EE29A9E90985446B913CF1D1376C836F4BE2C1CF3CADA0" + + + +Eastlake 3rd & Hansen Informational [Page 85] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + "720A6BF4857D886A7ECB3C4E4C0FA8C7F95214E41DC1B0D2" + "1B22A84CC03BF8CE4845F34DD5BDBAD4" }, + /* 6 */ { "\xD0", 1, 1, 0, 0, + "9992202938E882E73E20F6B69E68A0A7149090423D93C81B" + "AB3F21678D4ACEEEE50E4E8CAFADA4C85A54EA8306826C4A" + "D6E74CECE9631BFA8A549B4AB3FBBA15" }, + /* 7 */ { TEST7_512, length(TEST7_512), 1, 0x80, 3, + "ED8DC78E8B01B69750053DBB7A0A9EDA0FB9E9D292B1ED71" + "5E80A7FE290A4E16664FD913E85854400C5AF05E6DAD316B" + "7359B43E64F8BEC3C1F237119986BBB6" }, + /* 8 */ { TEST8_512, length(TEST8_512), 1, 0, 0, + "CB0B67A4B8712CD73C9AABC0B199E9269B20844AFB75ACBD" + "D1C153C9828924C3DDEDAAFE669C5FDD0BC66F630F677398" + "8213EB1B16F517AD0DE4B2F0C95C90F8" }, + /* 9 */ { TEST9_512, length(TEST9_512), 1, 0x80, 3, + "32BA76FC30EAA0208AEB50FFB5AF1864FDBF17902A4DC0A6" + "82C61FCEA6D92B783267B21080301837F59DE79C6B337DB2" + "526F8A0A510E5E53CAFED4355FE7C2F1" }, + /* 10 */ { TEST10_512, length(TEST10_512), 1, 0, 0, + "C665BEFB36DA189D78822D10528CBF3B12B3EEF726039909" + "C1A16A270D48719377966B957A878E720584779A62825C18" + "DA26415E49A7176A894E7510FD1451F5" } + }, SHA512_SEED, { "2FBB1E7E00F746BA514FBC8C421F36792EC0E11FF5EFC3" + "78E1AB0C079AA5F0F66A1E3EDBAEB4F9984BE14437123038A452004A5576" + "8C1FD8EED49E4A21BEDCD0", "25CBE5A4F2C7B1D7EF07011705D50C62C5" + "000594243EAFD1241FC9F3D22B58184AE2FEE38E171CF8129E29459C9BC2" + "EF461AF5708887315F15419D8D17FE7949", "5B8B1F2687555CE2D7182B" + "92E5C3F6C36547DA1C13DBB9EA4F73EA4CBBAF89411527906D35B1B06C1B" + "6A8007D05EC66DF0A406066829EAB618BDE3976515AAFC", "46E36B007D" + "19876CDB0B29AD074FE3C08CDD174D42169D6ABE5A1414B6E79707DF5877" + "6A98091CF431854147BB6D3C66D43BFBC108FD715BDE6AA127C2B0E79F" + } + } +}; + +/* Test arrays for HMAC. */ +struct hmachash { + const char *keyarray[5]; + int keylength[5]; + const char *dataarray[5]; + int datalength[5]; + const char *resultarray[5]; + int resultlength[5]; +} hmachashes[HMACTESTCOUNT] = { + { /* 1 */ { + "\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b" + "\x0b\x0b\x0b\x0b\x0b" + }, { 20 }, { + + + +Eastlake 3rd & Hansen Informational [Page 86] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + "\x48\x69\x20\x54\x68\x65\x72\x65" /* "Hi There" */ + }, { 8 }, { + /* HMAC-SHA-1 */ + "B617318655057264E28BC0B6FB378C8EF146BE00", + /* HMAC-SHA-224 */ + "896FB1128ABBDF196832107CD49DF33F47B4B1169912BA4F53684B22", + /* HMAC-SHA-256 */ + "B0344C61D8DB38535CA8AFCEAF0BF12B881DC200C9833DA726E9376C2E32" + "CFF7", + /* HMAC-SHA-384 */ + "AFD03944D84895626B0825F4AB46907F15F9DADBE4101EC682AA034C7CEB" + "C59CFAEA9EA9076EDE7F4AF152E8B2FA9CB6", + /* HMAC-SHA-512 */ + "87AA7CDEA5EF619D4FF0B4241A1D6CB02379F4E2CE4EC2787AD0B30545E1" + "7CDEDAA833B7D6B8A702038B274EAEA3F4E4BE9D914EEB61F1702E696C20" + "3A126854" + }, { SHA1HashSize, SHA224HashSize, SHA256HashSize, + SHA384HashSize, SHA512HashSize } + }, + { /* 2 */ { + "\x4a\x65\x66\x65" /* "Jefe" */ + }, { 4 }, { + "\x77\x68\x61\x74\x20\x64\x6f\x20\x79\x61\x20\x77\x61\x6e\x74" + "\x20\x66\x6f\x72\x20\x6e\x6f\x74\x68\x69\x6e\x67\x3f" + /* "what do ya want for nothing?" */ + }, { 28 }, { + /* HMAC-SHA-1 */ + "EFFCDF6AE5EB2FA2D27416D5F184DF9C259A7C79", + /* HMAC-SHA-224 */ + "A30E01098BC6DBBF45690F3A7E9E6D0F8BBEA2A39E6148008FD05E44", + /* HMAC-SHA-256 */ + "5BDCC146BF60754E6A042426089575C75A003F089D2739839DEC58B964EC" + "3843", + /* HMAC-SHA-384 */ + "AF45D2E376484031617F78D2B58A6B1B9C7EF464F5A01B47E42EC3736322" + "445E8E2240CA5E69E2C78B3239ECFAB21649", + /* HMAC-SHA-512 */ + "164B7A7BFCF819E2E395FBE73B56E0A387BD64222E831FD610270CD7EA25" + "05549758BF75C05A994A6D034F65F8F0E6FDCAEAB1A34D4A6B4B636E070A" + "38BCE737" + }, { SHA1HashSize, SHA224HashSize, SHA256HashSize, + SHA384HashSize, SHA512HashSize } + }, + { /* 3 */ + { + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa" + }, { 20 }, { + + + +Eastlake 3rd & Hansen Informational [Page 87] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + "\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd" + "\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd" + "\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd" + "\xdd\xdd\xdd\xdd\xdd" + }, { 50 }, { + /* HMAC-SHA-1 */ + "125D7342B9AC11CD91A39AF48AA17B4F63F175D3", + /* HMAC-SHA-224 */ + "7FB3CB3588C6C1F6FFA9694D7D6AD2649365B0C1F65D69D1EC8333EA", + /* HMAC-SHA-256 */ + "773EA91E36800E46854DB8EBD09181A72959098B3EF8C122D9635514CED5" + "65FE", + /* HMAC-SHA-384 */ + "88062608D3E6AD8A0AA2ACE014C8A86F0AA635D947AC9FEBE83EF4E55966" + "144B2A5AB39DC13814B94E3AB6E101A34F27", + /* HMAC-SHA-512 */ + "FA73B0089D56A284EFB0F0756C890BE9B1B5DBDD8EE81A3655F83E33B227" + "9D39BF3E848279A722C806B485A47E67C807B946A337BEE8942674278859" + "E13292FB" + }, { SHA1HashSize, SHA224HashSize, SHA256HashSize, + SHA384HashSize, SHA512HashSize } + }, + { /* 4 */ { + "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f" + "\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19" + }, { 25 }, { + "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd" + "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd" + "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd" + "\xcd\xcd\xcd\xcd\xcd" + }, { 50 }, { + /* HMAC-SHA-1 */ + "4C9007F4026250C6BC8414F9BF50C86C2D7235DA", + /* HMAC-SHA-224 */ + "6C11506874013CAC6A2ABC1BB382627CEC6A90D86EFC012DE7AFEC5A", + /* HMAC-SHA-256 */ + "82558A389A443C0EA4CC819899F2083A85F0FAA3E578F8077A2E3FF46729" + "665B", + /* HMAC-SHA-384 */ + "3E8A69B7783C25851933AB6290AF6CA77A9981480850009CC5577C6E1F57" + "3B4E6801DD23C4A7D679CCF8A386C674CFFB", + /* HMAC-SHA-512 */ + "B0BA465637458C6990E5A8C5F61D4AF7E576D97FF94B872DE76F8050361E" + "E3DBA91CA5C11AA25EB4D679275CC5788063A5F19741120C4F2DE2ADEBEB" + "10A298DD" + }, { SHA1HashSize, SHA224HashSize, SHA256HashSize, + SHA384HashSize, SHA512HashSize } + }, + + + +Eastlake 3rd & Hansen Informational [Page 88] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + { /* 5 */ { + "\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c" + "\x0c\x0c\x0c\x0c\x0c" + }, { 20 }, { + "Test With Truncation" + }, { 20 }, { + /* HMAC-SHA-1 */ + "4C1A03424B55E07FE7F27BE1", + /* HMAC-SHA-224 */ + "0E2AEA68A90C8D37C988BCDB9FCA6FA8", + /* HMAC-SHA-256 */ + "A3B6167473100EE06E0C796C2955552B", + /* HMAC-SHA-384 */ + "3ABF34C3503B2A23A46EFC619BAEF897", + /* HMAC-SHA-512 */ + "415FAD6271580A531D4179BC891D87A6" + }, { 12, 16, 16, 16, 16 } + }, + { /* 6 */ { + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + }, { 80, 131 }, { + "Test Using Larger Than Block-Size Key - Hash Key First" + }, { 54 }, { + /* HMAC-SHA-1 */ + "AA4AE5E15272D00E95705637CE8A3B55ED402112", + /* HMAC-SHA-224 */ + "95E9A0DB962095ADAEBE9B2D6F0DBCE2D499F112F2D2B7273FA6870E", + /* HMAC-SHA-256 */ + "60E431591EE0B67F0D8A26AACBF5B77F8E0BC6213728C5140546040F0EE3" + "7F54", + /* HMAC-SHA-384 */ + "4ECE084485813E9088D2C63A041BC5B44F9EF1012A2B588F3CD11F05033A" + "C4C60C2EF6AB4030FE8296248DF163F44952", + /* HMAC-SHA-512 */ + "80B24263C7C1A3EBB71493C1DD7BE8B49B46D1F41B4AEEC1121B013783F8" + "F3526B56D037E05F2598BD0FD2215D6A1E5295E64F73F63F0AEC8B915A98" + "5D786598" + }, { SHA1HashSize, SHA224HashSize, SHA256HashSize, + SHA384HashSize, SHA512HashSize } + }, + + + +Eastlake 3rd & Hansen Informational [Page 89] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + { /* 7 */ { + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + }, { 80, 131 }, { + "Test Using Larger Than Block-Size Key and " + "Larger Than One Block-Size Data", + "\x54\x68\x69\x73\x20\x69\x73\x20\x61\x20\x74\x65\x73\x74\x20" + "\x75\x73\x69\x6e\x67\x20\x61\x20\x6c\x61\x72\x67\x65\x72\x20" + "\x74\x68\x61\x6e\x20\x62\x6c\x6f\x63\x6b\x2d\x73\x69\x7a\x65" + "\x20\x6b\x65\x79\x20\x61\x6e\x64\x20\x61\x20\x6c\x61\x72\x67" + "\x65\x72\x20\x74\x68\x61\x6e\x20\x62\x6c\x6f\x63\x6b\x2d\x73" + "\x69\x7a\x65\x20\x64\x61\x74\x61\x2e\x20\x54\x68\x65\x20\x6b" + "\x65\x79\x20\x6e\x65\x65\x64\x73\x20\x74\x6f\x20\x62\x65\x20" + "\x68\x61\x73\x68\x65\x64\x20\x62\x65\x66\x6f\x72\x65\x20\x62" + "\x65\x69\x6e\x67\x20\x75\x73\x65\x64\x20\x62\x79\x20\x74\x68" + "\x65\x20\x48\x4d\x41\x43\x20\x61\x6c\x67\x6f\x72\x69\x74\x68" + "\x6d\x2e" + /* "This is a test using a larger than block-size key and a " + "larger than block-size data. The key needs to be hashed " + "before being used by the HMAC algorithm." */ + }, { 73, 152 }, { + /* HMAC-SHA-1 */ + "E8E99D0F45237D786D6BBAA7965C7808BBFF1A91", + /* HMAC-SHA-224 */ + "3A854166AC5D9F023F54D517D0B39DBD946770DB9C2B95C9F6F565D1", + /* HMAC-SHA-256 */ + "9B09FFA71B942FCB27635FBCD5B0E944BFDC63644F0713938A7F51535C3A" + "35E2", + /* HMAC-SHA-384 */ + "6617178E941F020D351E2F254E8FD32C602420FEB0B8FB9ADCCEBB82461E" + "99C5A678CC31E799176D3860E6110C46523E", + /* HMAC-SHA-512 */ + "E37B6A775DC87DBAA4DFA9F96E5E3FFDDEBD71F8867289865DF5A32D20CD" + "C944B6022CAC3C4982B10D5EEB55C3E4DE15134676FB6DE0446065C97440" + "FA8C6A58" + }, { SHA1HashSize, SHA224HashSize, SHA256HashSize, + SHA384HashSize, SHA512HashSize } + } +}; + +/* + + + +Eastlake 3rd & Hansen Informational [Page 90] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * Check the hash value against the expected string, expressed in hex + */ +static const char hexdigits[] = "0123456789ABCDEF"; +int checkmatch(const unsigned char *hashvalue, + const char *hexstr, int hashsize) +{ + int i; + for (i = 0; i < hashsize; ++i) { + if (*hexstr++ != hexdigits[(hashvalue[i] >> 4) & 0xF]) + return 0; + if (*hexstr++ != hexdigits[hashvalue[i] & 0xF]) return 0; + } + return 1; +} + +/* + * Print the string, converting non-printable characters to "." + */ +void printstr(const char *str, int len) +{ + for ( ; len-- > 0; str++) + putchar(isprint((unsigned char)*str) ? *str : '.'); +} + +/* + * Print the string, converting non-printable characters to hex "## ". + */ +void printxstr(const char *str, int len) +{ + for ( ; len-- > 0; str++) + printf("%c%c ", hexdigits[(*str >> 4) & 0xF], + hexdigits[*str & 0xF]); +} + +/* + * Print a usage message. + */ +void usage(const char *argv0) +{ + fprintf(stderr, + "Usage:\n" + "Common options: [-h hash] [-w|-x] [-H]\n" + "Standard tests:\n" + "\t%s [-m] [-l loopcount] [-t test#] [-e]\n" + "\t\t[-r randomseed] [-R randomloop-count] " + "[-p] [-P|-X]\n" + "Hash a string:\n" + "\t%s [-S expectedresult] -s hashstr [-k key]\n" + + + +Eastlake 3rd & Hansen Informational [Page 91] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + "Hash a file:\n" + "\t%s [-S expectedresult] -f file [-k key]\n" + "Hash a file, ignoring whitespace:\n" + "\t%s [-S expectedresult] -F file [-k key]\n" + "Additional bits to add in: [-B bitcount -b bits]\n" + "-h\thash to test: " + "0|SHA1, 1|SHA224, 2|SHA256, 3|SHA384, 4|SHA512\n" + "-m\tperform hmac test\n" + "-k\tkey for hmac test\n" + "-t\ttest case to run, 1-10\n" + "-l\thow many times to run the test\n" + "-e\ttest error returns\n" + "-p\tdo not print results\n" + "-P\tdo not print PASSED/FAILED\n" + "-X\tprint FAILED, but not PASSED\n" + "-r\tseed for random test\n" + "-R\thow many times to run random test\n" + "-s\tstring to hash\n" + "-S\texpected result of hashed string, in hex\n" + "-w\toutput hash in raw format\n" + "-x\toutput hash in hex format\n" + "-B\t# extra bits to add in after string or file input\n" + "-b\textra bits to add (high order bits of #, 0# or 0x#)\n" + "-H\tinput hashstr or randomseed is in hex\n" + , argv0, argv0, argv0, argv0); + exit(1); +} + +/* + * Print the results and PASS/FAIL. + */ +void printResult(uint8_t *Message_Digest, int hashsize, + const char *hashname, const char *testtype, const char *testname, + const char *resultarray, int printResults, int printPassFail) +{ + int i, k; + if (printResults == PRINTTEXT) { + putchar('\t'); + for (i = 0; i < hashsize ; ++i) { + putchar(hexdigits[(Message_Digest[i] >> 4) & 0xF]); + putchar(hexdigits[Message_Digest[i] & 0xF]); + putchar(' '); + } + putchar('\n'); + } else if (printResults == PRINTRAW) { + fwrite(Message_Digest, 1, hashsize, stdout); + } else if (printResults == PRINTHEX) { + for (i = 0; i < hashsize ; ++i) { + + + +Eastlake 3rd & Hansen Informational [Page 92] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + putchar(hexdigits[(Message_Digest[i] >> 4) & 0xF]); + putchar(hexdigits[Message_Digest[i] & 0xF]); + } + putchar('\n'); + } + + if (printResults && resultarray) { + printf(" Should match:\n\t"); + for (i = 0, k = 0; i < hashsize; i++, k += 2) { + putchar(resultarray[k]); + putchar(resultarray[k+1]); + putchar(' '); + } + putchar('\n'); + } + + if (printPassFail && resultarray) { + int ret = checkmatch(Message_Digest, resultarray, hashsize); + if ((printPassFail == PRINTPASSFAIL) || !ret) + printf("%s %s %s: %s\n", hashname, testtype, testname, + ret ? "PASSED" : "FAILED"); + } +} + +/* + * Exercise a hash series of functions. The input is the testarray, + * repeated repeatcount times, followed by the extrabits. If the + * result is known, it is in resultarray in uppercase hex. + */ +int hash(int testno, int loopno, int hashno, + const char *testarray, int length, long repeatcount, + int numberExtrabits, int extrabits, const unsigned char *keyarray, + int keylen, const char *resultarray, int hashsize, int printResults, + int printPassFail) +{ + USHAContext sha; + HMACContext hmac; + int err, i; + uint8_t Message_Digest[USHAMaxHashSize]; + char buf[20]; + + if (printResults == PRINTTEXT) { + printf("\nTest %d: Iteration %d, Repeat %ld\n\t'", testno+1, + loopno, repeatcount); + printstr(testarray, length); + printf("'\n\t'"); + printxstr(testarray, length); + printf("'\n"); + + + +Eastlake 3rd & Hansen Informational [Page 93] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + printf(" Length=%d bytes (%d bits), ", length, length * 8); + printf("ExtraBits %d: %2.2x\n", numberExtrabits, extrabits); + } + + memset(&sha, '\343', sizeof(sha)); /* force bad data into struct */ + memset(&hmac, '\343', sizeof(hmac)); + err = keyarray ? hmacReset(&hmac, hashes[hashno].whichSha, + keyarray, keylen) : + USHAReset(&sha, hashes[hashno].whichSha); + if (err != shaSuccess) { + fprintf(stderr, "hash(): %sReset Error %d.\n", + keyarray ? "hmac" : "sha", err); + return err; + } + + for (i = 0; i < repeatcount; ++i) { + err = keyarray ? hmacInput(&hmac, (const uint8_t *) testarray, + length) : + USHAInput(&sha, (const uint8_t *) testarray, + length); + if (err != shaSuccess) { + fprintf(stderr, "hash(): %sInput Error %d.\n", + keyarray ? "hmac" : "sha", err); + return err; + } + } + + if (numberExtrabits > 0) { + err = keyarray ? hmacFinalBits(&hmac, (uint8_t) extrabits, + numberExtrabits) : + USHAFinalBits(&sha, (uint8_t) extrabits, + numberExtrabits); + if (err != shaSuccess) { + fprintf(stderr, "hash(): %sFinalBits Error %d.\n", + keyarray ? "hmac" : "sha", err); + return err; + } + } + + err = keyarray ? hmacResult(&hmac, Message_Digest) : + USHAResult(&sha, Message_Digest); + if (err != shaSuccess) { + fprintf(stderr, "hash(): %s Result Error %d, could not " + "compute message digest.\n", keyarray ? "hmac" : "sha", err); + return err; + } + + sprintf(buf, "%d", testno+1); + + + +Eastlake 3rd & Hansen Informational [Page 94] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + printResult(Message_Digest, hashsize, hashes[hashno].name, + keyarray ? "hmac standard test" : "sha standard test", buf, + resultarray, printResults, printPassFail); + + return err; +} + +/* + * Exercise a hash series of functions. The input is a filename. + * If the result is known, it is in resultarray in uppercase hex. + */ +int hashfile(int hashno, const char *hashfilename, int bits, + int bitcount, int skipSpaces, const unsigned char *keyarray, + int keylen, const char *resultarray, int hashsize, + int printResults, int printPassFail) +{ + USHAContext sha; + HMACContext hmac; + int err, nread, c; + unsigned char buf[4096]; + uint8_t Message_Digest[USHAMaxHashSize]; + unsigned char cc; + FILE *hashfp = (strcmp(hashfilename, "-") == 0) ? stdin : + fopen(hashfilename, "r"); + + if (!hashfp) { + fprintf(stderr, "cannot open file '%s'\n", hashfilename); + return shaStateError; + } + + memset(&sha, '\343', sizeof(sha)); /* force bad data into struct */ + memset(&hmac, '\343', sizeof(hmac)); + err = keyarray ? hmacReset(&hmac, hashes[hashno].whichSha, + keyarray, keylen) : + USHAReset(&sha, hashes[hashno].whichSha); + + if (err != shaSuccess) { + fprintf(stderr, "hashfile(): %sReset Error %d.\n", + keyarray ? "hmac" : "sha", err); + return err; + } + + if (skipSpaces) + while ((c = getc(hashfp)) != EOF) { + if (!isspace(c)) { + cc = (unsigned char)c; + err = keyarray ? hmacInput(&hmac, &cc, 1) : + USHAInput(&sha, &cc, 1); + + + +Eastlake 3rd & Hansen Informational [Page 95] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + if (err != shaSuccess) { + fprintf(stderr, "hashfile(): %sInput Error %d.\n", + keyarray ? "hmac" : "sha", err); + if (hashfp != stdin) fclose(hashfp); + return err; + } + } + } + else + while ((nread = fread(buf, 1, sizeof(buf), hashfp)) > 0) { + err = keyarray ? hmacInput(&hmac, buf, nread) : + USHAInput(&sha, buf, nread); + if (err != shaSuccess) { + fprintf(stderr, "hashfile(): %s Error %d.\n", + keyarray ? "hmacInput" : "shaInput", err); + if (hashfp != stdin) fclose(hashfp); + return err; + } + } + + if (bitcount > 0) + err = keyarray ? hmacFinalBits(&hmac, bits, bitcount) : + USHAFinalBits(&sha, bits, bitcount); + if (err != shaSuccess) { + fprintf(stderr, "hashfile(): %s Error %d.\n", + keyarray ? "hmacResult" : "shaResult", err); + if (hashfp != stdin) fclose(hashfp); + return err; + } + + err = keyarray ? hmacResult(&hmac, Message_Digest) : + USHAResult(&sha, Message_Digest); + if (err != shaSuccess) { + fprintf(stderr, "hashfile(): %s Error %d.\n", + keyarray ? "hmacResult" : "shaResult", err); + if (hashfp != stdin) fclose(hashfp); + return err; + } + + printResult(Message_Digest, hashsize, hashes[hashno].name, "file", + hashfilename, resultarray, printResults, printPassFail); + + if (hashfp != stdin) fclose(hashfp); + return err; +} + +/* + * Exercise a hash series of functions through multiple permutations. + + + +Eastlake 3rd & Hansen Informational [Page 96] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * The input is an initial seed. That seed is replicated 3 times. + * For 1000 rounds, the previous three results are used as the input. + * This result is then checked, and used to seed the next cycle. + * If the result is known, it is in resultarrays in uppercase hex. + */ +void randomtest(int hashno, const char *seed, int hashsize, + const char **resultarrays, int randomcount, + int printResults, int printPassFail) +{ + int i, j; char buf[20]; + unsigned char SEED[USHAMaxHashSize], MD[1003][USHAMaxHashSize]; + + /* INPUT: Seed - A random seed n bits long */ + memcpy(SEED, seed, hashsize); + if (printResults == PRINTTEXT) { + printf("%s random test seed= '", hashes[hashno].name); + printxstr(seed, hashsize); + printf("'\n"); + } + + for (j = 0; j < randomcount; j++) { + /* MD0 = MD1 = MD2 = Seed; */ + memcpy(MD[0], SEED, hashsize); + memcpy(MD[1], SEED, hashsize); + memcpy(MD[2], SEED, hashsize); + for (i=3; i<1003; i++) { + /* Mi = MDi-3 || MDi-2 || MDi-1; */ + USHAContext Mi; + memset(&Mi, '\343', sizeof(Mi)); /* force bad data into struct */ + USHAReset(&Mi, hashes[hashno].whichSha); + USHAInput(&Mi, MD[i-3], hashsize); + USHAInput(&Mi, MD[i-2], hashsize); + USHAInput(&Mi, MD[i-1], hashsize); + /* MDi = SHA(Mi); */ + USHAResult(&Mi, MD[i]); + } + + /* MDj = Seed = MDi; */ + memcpy(SEED, MD[i-1], hashsize); + + /* OUTPUT: MDj */ + sprintf(buf, "%d", j); + printResult(SEED, hashsize, hashes[hashno].name, "random test", + buf, resultarrays ? resultarrays[j] : 0, printResults, + (j < RANDOMCOUNT) ? printPassFail : 0); + } +} + + + + +Eastlake 3rd & Hansen Informational [Page 97] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +/* + * Look up a hash name. + */ +int findhash(const char *argv0, const char *opt) +{ + int i; + const char *names[HASHCOUNT][2] = { + { "0", "sha1" }, { "1", "sha224" }, { "2", "sha256" }, + { "3", "sha384" }, { "4", "sha512" } + }; + + for (i = 0; i < HASHCOUNT; i++) + if ((strcmp(opt, names[i][0]) == 0) || + (scasecmp(opt, names[i][1]) == 0)) + return i; + + fprintf(stderr, "%s: Unknown hash name: '%s'\n", argv0, opt); + usage(argv0); + return 0; +} + +/* + * Run some tests that should invoke errors. + */ +void testErrors(int hashnolow, int hashnohigh, int printResults, + int printPassFail) +{ + USHAContext usha; + uint8_t Message_Digest[USHAMaxHashSize]; + int hashno, err; + + for (hashno = hashnolow; hashno <= hashnohigh; hashno++) { + memset(&usha, '\343', sizeof(usha)); /* force bad data */ + USHAReset(&usha, hashno); + USHAResult(&usha, Message_Digest); + err = USHAInput(&usha, (const unsigned char *)"foo", 3); + if (printResults == PRINTTEXT) + printf ("\nError %d. Should be %d.\n", err, shaStateError); + if ((printPassFail == PRINTPASSFAIL) || + ((printPassFail == PRINTFAIL) && (err != shaStateError))) + printf("%s se: %s\n", hashes[hashno].name, + (err == shaStateError) ? "PASSED" : "FAILED"); + + err = USHAFinalBits(&usha, 0x80, 3); + if (printResults == PRINTTEXT) + printf ("\nError %d. Should be %d.\n", err, shaStateError); + if ((printPassFail == PRINTPASSFAIL) || + ((printPassFail == PRINTFAIL) && (err != shaStateError))) + + + +Eastlake 3rd & Hansen Informational [Page 98] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + printf("%s se: %s\n", hashes[hashno].name, + (err == shaStateError) ? "PASSED" : "FAILED"); + + err = USHAReset(0, hashes[hashno].whichSha); + if (printResults == PRINTTEXT) + printf("\nError %d. Should be %d.\n", err, shaNull); + if ((printPassFail == PRINTPASSFAIL) || + ((printPassFail == PRINTFAIL) && (err != shaNull))) + printf("%s usha null: %s\n", hashes[hashno].name, + (err == shaNull) ? "PASSED" : "FAILED"); + + switch (hashno) { + case SHA1: err = SHA1Reset(0); break; + case SHA224: err = SHA224Reset(0); break; + case SHA256: err = SHA256Reset(0); break; + case SHA384: err = SHA384Reset(0); break; + case SHA512: err = SHA512Reset(0); break; + } + if (printResults == PRINTTEXT) + printf("\nError %d. Should be %d.\n", err, shaNull); + if ((printPassFail == PRINTPASSFAIL) || + ((printPassFail == PRINTFAIL) && (err != shaNull))) + printf("%s sha null: %s\n", hashes[hashno].name, + (err == shaNull) ? "PASSED" : "FAILED"); + } +} + +/* replace a hex string in place with its value */ +int unhexStr(char *hexstr) +{ + char *o = hexstr; + int len = 0, nibble1 = 0, nibble2 = 0; + if (!hexstr) return 0; + for ( ; *hexstr; hexstr++) { + if (isalpha((int)(unsigned char)(*hexstr))) { + nibble1 = tolower(*hexstr) - 'a' + 10; + } else if (isdigit((int)(unsigned char)(*hexstr))) { + nibble1 = *hexstr - '0'; + } else { + printf("\nError: bad hex character '%c'\n", *hexstr); + } + if (!*++hexstr) break; + if (isalpha((int)(unsigned char)(*hexstr))) { + nibble2 = tolower(*hexstr) - 'a' + 10; + } else if (isdigit((int)(unsigned char)(*hexstr))) { + nibble2 = *hexstr - '0'; + } else { + printf("\nError: bad hex character '%c'\n", *hexstr); + + + +Eastlake 3rd & Hansen Informational [Page 99] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + } + *o++ = (char)((nibble1 << 4) | nibble2); + len++; + } + return len; +} + +int main(int argc, char **argv) +{ + int i, err; + int loopno, loopnohigh = 1; + int hashno, hashnolow = 0, hashnohigh = HASHCOUNT - 1; + int testno, testnolow = 0, testnohigh; + int ntestnohigh = 0; + int printResults = PRINTTEXT; + int printPassFail = 1; + int checkErrors = 0; + char *hashstr = 0; + int hashlen = 0; + const char *resultstr = 0; + char *randomseedstr = 0; + int runHmacTests = 0; + char *hmacKey = 0; + int hmaclen = 0; + int randomcount = RANDOMCOUNT; + const char *hashfilename = 0; + const char *hashFilename = 0; + int extrabits = 0, numberExtrabits = 0; + int strIsHex = 0; + + while ((i = xgetopt(argc, argv, "b:B:ef:F:h:Hk:l:mpPr:R:s:S:t:wxX")) + != -1) + switch (i) { + case 'b': extrabits = strtol(xoptarg, 0, 0); break; + case 'B': numberExtrabits = atoi(xoptarg); break; + case 'e': checkErrors = 1; break; + case 'f': hashfilename = xoptarg; break; + case 'F': hashFilename = xoptarg; break; + case 'h': hashnolow = hashnohigh = findhash(argv[0], xoptarg); + break; + case 'H': strIsHex = 1; break; + case 'k': hmacKey = xoptarg; hmaclen = strlen(xoptarg); break; + case 'l': loopnohigh = atoi(xoptarg); break; + case 'm': runHmacTests = 1; break; + case 'P': printPassFail = 0; break; + case 'p': printResults = PRINTNONE; break; + case 'R': randomcount = atoi(xoptarg); break; + case 'r': randomseedstr = xoptarg; break; + + + +Eastlake 3rd & Hansen Informational [Page 100] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + case 's': hashstr = xoptarg; hashlen = strlen(hashstr); break; + case 'S': resultstr = xoptarg; break; + case 't': testnolow = ntestnohigh = atoi(xoptarg) - 1; break; + case 'w': printResults = PRINTRAW; break; + case 'x': printResults = PRINTHEX; break; + case 'X': printPassFail = 2; break; + default: usage(argv[0]); + } + + if (strIsHex) { + hashlen = unhexStr(hashstr); + unhexStr(randomseedstr); + hmaclen = unhexStr(hmacKey); + } + testnohigh = (ntestnohigh != 0) ? ntestnohigh: + runHmacTests ? (HMACTESTCOUNT-1) : (TESTCOUNT-1); + if ((testnolow < 0) || + (testnohigh >= (runHmacTests ? HMACTESTCOUNT : TESTCOUNT)) || + (hashnolow < 0) || (hashnohigh >= HASHCOUNT) || + (hashstr && (testnolow == testnohigh)) || + (randomcount < 0) || + (resultstr && (!hashstr && !hashfilename && !hashFilename)) || + ((runHmacTests || hmacKey) && randomseedstr) || + (hashfilename && hashFilename)) + usage(argv[0]); + + /* + * Perform SHA/HMAC tests + */ + for (hashno = hashnolow; hashno <= hashnohigh; ++hashno) { + if (printResults == PRINTTEXT) + printf("Hash %s\n", hashes[hashno].name); + err = shaSuccess; + + for (loopno = 1; (loopno <= loopnohigh) && (err == shaSuccess); + ++loopno) { + if (hashstr) + err = hash(0, loopno, hashno, hashstr, hashlen, 1, + numberExtrabits, extrabits, (const unsigned char *)hmacKey, + hmaclen, resultstr, hashes[hashno].hashsize, printResults, + printPassFail); + + else if (randomseedstr) + randomtest(hashno, randomseedstr, hashes[hashno].hashsize, 0, + randomcount, printResults, printPassFail); + + else if (hashfilename) + err = hashfile(hashno, hashfilename, extrabits, + + + +Eastlake 3rd & Hansen Informational [Page 101] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + numberExtrabits, 0, + (const unsigned char *)hmacKey, hmaclen, + resultstr, hashes[hashno].hashsize, + printResults, printPassFail); + + else if (hashFilename) + err = hashfile(hashno, hashFilename, extrabits, + numberExtrabits, 1, + (const unsigned char *)hmacKey, hmaclen, + resultstr, hashes[hashno].hashsize, + printResults, printPassFail); + + else /* standard tests */ { + for (testno = testnolow; + (testno <= testnohigh) && (err == shaSuccess); ++testno) { + if (runHmacTests) { + err = hash(testno, loopno, hashno, + hmachashes[testno].dataarray[hashno] ? + hmachashes[testno].dataarray[hashno] : + hmachashes[testno].dataarray[1] ? + hmachashes[testno].dataarray[1] : + hmachashes[testno].dataarray[0], + hmachashes[testno].datalength[hashno] ? + hmachashes[testno].datalength[hashno] : + hmachashes[testno].datalength[1] ? + hmachashes[testno].datalength[1] : + hmachashes[testno].datalength[0], + 1, 0, 0, + (const unsigned char *)( + hmachashes[testno].keyarray[hashno] ? + hmachashes[testno].keyarray[hashno] : + hmachashes[testno].keyarray[1] ? + hmachashes[testno].keyarray[1] : + hmachashes[testno].keyarray[0]), + hmachashes[testno].keylength[hashno] ? + hmachashes[testno].keylength[hashno] : + hmachashes[testno].keylength[1] ? + hmachashes[testno].keylength[1] : + hmachashes[testno].keylength[0], + hmachashes[testno].resultarray[hashno], + hmachashes[testno].resultlength[hashno], + printResults, printPassFail); + } else { + err = hash(testno, loopno, hashno, + hashes[hashno].tests[testno].testarray, + hashes[hashno].tests[testno].length, + hashes[hashno].tests[testno].repeatcount, + hashes[hashno].tests[testno].numberExtrabits, + + + +Eastlake 3rd & Hansen Informational [Page 102] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + hashes[hashno].tests[testno].extrabits, 0, 0, + hashes[hashno].tests[testno].resultarray, + hashes[hashno].hashsize, + printResults, printPassFail); + } + } + + if (!runHmacTests) { + randomtest(hashno, hashes[hashno].randomtest, + hashes[hashno].hashsize, hashes[hashno].randomresults, + RANDOMCOUNT, printResults, printPassFail); + } + } + } + } + + /* Test some error returns */ + if (checkErrors) { + testErrors(hashnolow, hashnohigh, printResults, printPassFail); + } + + return 0; +} + +/* + * Compare two strings, case independently. + * Equivalent to strcasecmp() found on some systems. + */ +int scasecmp(const char *s1, const char *s2) +{ + for (;;) { + char u1 = tolower(*s1++); + char u2 = tolower(*s2++); + if (u1 != u2) + return u1 - u2; + if (u1 == '\0') + return 0; + } +} + +/* + * This is a copy of getopt provided for those systems that do not + * have it. The name was changed to xgetopt to not conflict on those + * systems that do have it. Similarly, optarg, optind and opterr + * were renamed to xoptarg, xoptind and xopterr. + * + * Copyright 1990, 1991, 1992 by the Massachusetts Institute of + * Technology and UniSoft Group Limited. + + + +Eastlake 3rd & Hansen Informational [Page 103] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + * + * Permission to use, copy, modify, distribute, and sell this software + * and its documentation for any purpose is hereby granted without fee, + * provided that the above copyright notice appear in all copies and + * that both that copyright notice and this permission notice appear in + * supporting documentation, and that the names of MIT and UniSoft not + * be used in advertising or publicity pertaining to distribution of + * the software without specific, written prior permission. MIT and + * UniSoft make no representations about the suitability of this + * software for any purpose. It is provided "as is" without express + * or implied warranty. + * + * $XConsortium: getopt.c,v 1.2 92/07/01 11:59:04 rws Exp $ + * NB: Reformatted to match above style. + */ + +char *xoptarg; +int xoptind = 1; +int xopterr = 1; + +static int xgetopt(int argc, char **argv, const char *optstring) +{ + static int avplace; + char *ap; + char *cp; + int c; + + if (xoptind >= argc) + return EOF; + + ap = argv[xoptind] + avplace; + + /* At beginning of arg but not an option */ + if (avplace == 0) { + if (ap[0] != '-') + return EOF; + else if (ap[1] == '-') { + /* Special end of options option */ + xoptind++; + return EOF; + } else if (ap[1] == '\0') + return EOF; /* single '-' is not allowed */ + } + + /* Get next letter */ + avplace++; + c = *++ap; + + + + +Eastlake 3rd & Hansen Informational [Page 104] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + + cp = strchr(optstring, c); + if (cp == NULL || c == ':') { + if (xopterr) + fprintf(stderr, "Unrecognised option -- %c\n", c); + return '?'; + } + + if (cp[1] == ':') { + /* There should be an option arg */ + avplace = 0; + if (ap[1] == '\0') { + /* It is a separate arg */ + if (++xoptind >= argc) { + if (xopterr) + fprintf(stderr, "Option requires an argument\n"); + return '?'; + } + xoptarg = argv[xoptind++]; + } else { + /* is attached to option letter */ + xoptarg = ap + 1; + ++xoptind; + } + } else { + /* If we are out of letters then go to next arg */ + if (ap[1] == '\0') { + ++xoptind; + avplace = 0; + } + + xoptarg = NULL; + } + return c; +} + + + + + + + + + + + + + + + + + +Eastlake 3rd & Hansen Informational [Page 105] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +9. Security Considerations + + This document is intended to provides the Internet community + convenient access to source code that implements the United States of + America Federal Information Processing Standard Secure Hash + Algorithms (SHAs) [FIPS180-2] and HMACs based upon these one-way hash + functions. See license in Section 1.1. No independent assertion of + the security of this hash function by the authors for any particular + use is intended. + +10. Normative References + + [FIPS180-2] "Secure Hash Standard", United States of America, + National Institute of Standards and Technology, Federal + Information Processing Standard (FIPS) 180-2, + http://csrc.nist.gov/publications/fips/fips180-2/ + fips180-2withchangenotice.pdf. + + [RFC2104] Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed- + Hashing for Message Authentication", RFC 2104, February + 1997. + +11. Informative References + + [RFC2202] Cheng, P. and R. Glenn, "Test Cases for HMAC-MD5 and + HMAC-SHA-1", RFC 2202, September 1997. + + [RFC3174] Eastlake 3rd, D. and P. Jones, "US Secure Hash Algorithm + 1 (SHA1)", RFC 3174, September 2001. + + [RFC3874] Housley, R., "A 224-bit One-way Hash Function: SHA-224", + RFC 3874, September 2004. + + [RFC4086] Eastlake, D., 3rd, Schiller, J., and S. Crocker, + "Randomness Requirements for Security", BCP 106, RFC + 4086, June 2005. + + [RFC4231] Nystrom, M., "Identifiers and Test Vectors for HMAC-SHA- + 224, HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512", RFC + 4231, December 2005. + + [SHAVS] "The Secure Hash Algorithm Validation System (SHAVS)", + http://csrc.nist.gov/cryptval/shs/SHAVS.pdf. + + + + + + + + +Eastlake 3rd & Hansen Informational [Page 106] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +Authors' Addresses + + Donald E. Eastlake, 3rd + Motorola Laboratories + 155 Beaver Street + Milford, MA 01757 USA + + Phone: +1-508-786-7554 (w) + EMail: donald.eastlake@motorola.com + + + Tony Hansen + AT&T Laboratories + 200 Laurel Ave. + Middletown, NJ 07748 USA + + Phone: +1-732-420-8934 (w) + EMail: tony+shs@maillennium.att.com + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +Eastlake 3rd & Hansen Informational [Page 107] + +RFC 4634 SHAs and HMAC-SHAs July 2006 + + +Full Copyright Statement + + Copyright (C) The Internet Society (2006). + + This document is subject to the rights, licenses and restrictions + contained in BCP 78, and except as set forth therein, the authors + retain all their rights. + + This document and the information contained herein are provided on an + "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS + OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET + ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, + INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE + INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED + WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. + +Intellectual Property + + The IETF takes no position regarding the validity or scope of any + Intellectual Property Rights or other rights that might be claimed to + pertain to the implementation or use of the technology described in + this document or the extent to which any license under such rights + might or might not be available; nor does it represent that it has + made any independent effort to identify any such rights. Information + on the procedures with respect to rights in RFC documents can be + found in BCP 78 and BCP 79. + + Copies of IPR disclosures made to the IETF Secretariat and any + assurances of licenses to be made available, or the result of an + attempt made to obtain a general license or permission for the use of + such proprietary rights by implementers or users of this + specification can be obtained from the IETF on-line IPR repository at + http://www.ietf.org/ipr. + + The IETF invites any interested party to bring to its attention any + copyrights, patents or patent applications, or other proprietary + rights that may cover technology that may be required to implement + this standard. Please address the information to the IETF at + ietf-ipr@ietf.org. + +Acknowledgement + + Funding for the RFC Editor function is provided by the IETF + Administrative Support Activity (IASA). + + + + + + + +Eastlake 3rd & Hansen Informational [Page 108] + diff --git a/contrib/bind9/doc/rfc/rfc4641.txt b/contrib/bind9/doc/rfc/rfc4641.txt new file mode 100644 index 0000000..0a013bc --- /dev/null +++ b/contrib/bind9/doc/rfc/rfc4641.txt @@ -0,0 +1,1963 @@ + + + + + + +Network Working Group O. Kolkman +Request for Comments: 4641 R. Gieben +Obsoletes: 2541 NLnet Labs +Category: Informational September 2006 + + + DNSSEC Operational Practices + +Status of This Memo + + This memo provides information for the Internet community. It does + not specify an Internet standard of any kind. Distribution of this + memo is unlimited. + +Copyright Notice + + Copyright (C) The Internet Society (2006). + +Abstract + + This document describes a set of practices for operating the DNS with + security extensions (DNSSEC). The target audience is zone + administrators deploying DNSSEC. + + The document discusses operational aspects of using keys and + signatures in the DNS. It discusses issues of key generation, key + storage, signature generation, key rollover, and related policies. + + This document obsoletes RFC 2541, as it covers more operational + ground and gives more up-to-date requirements with respect to key + sizes and the new DNSSEC specification. + + + + + + + + + + + + + + + + + + + + +Kolkman & Gieben Informational [Page 1] + +RFC 4641 DNSSEC Operational Practices September 2006 + + +Table of Contents + + 1. Introduction ....................................................3 + 1.1. The Use of the Term 'key' ..................................4 + 1.2. Time Definitions ...........................................4 + 2. Keeping the Chain of Trust Intact ...............................5 + 3. Keys Generation and Storage .....................................6 + 3.1. Zone and Key Signing Keys ..................................6 + 3.1.1. Motivations for the KSK and ZSK Separation ..........6 + 3.1.2. KSKs for High-Level Zones ...........................7 + 3.2. Key Generation .............................................8 + 3.3. Key Effectivity Period .....................................8 + 3.4. Key Algorithm ..............................................9 + 3.5. Key Sizes ..................................................9 + 3.6. Private Key Storage .......................................11 + 4. Signature Generation, Key Rollover, and Related Policies .......12 + 4.1. Time in DNSSEC ............................................12 + 4.1.1. Time Considerations ................................12 + 4.2. Key Rollovers .............................................14 + 4.2.1. Zone Signing Key Rollovers .........................14 + 4.2.1.1. Pre-Publish Key Rollover ..................15 + 4.2.1.2. Double Signature Zone Signing Key + Rollover ..................................17 + 4.2.1.3. Pros and Cons of the Schemes ..............18 + 4.2.2. Key Signing Key Rollovers ..........................18 + 4.2.3. Difference Between ZSK and KSK Rollovers ...........20 + 4.2.4. Automated Key Rollovers ............................21 + 4.3. Planning for Emergency Key Rollover .......................21 + 4.3.1. KSK Compromise .....................................22 + 4.3.1.1. Keeping the Chain of Trust Intact .........22 + 4.3.1.2. Breaking the Chain of Trust ...............23 + 4.3.2. ZSK Compromise .....................................23 + 4.3.3. Compromises of Keys Anchored in Resolvers ..........24 + 4.4. Parental Policies .........................................24 + 4.4.1. Initial Key Exchanges and Parental Policies + Considerations .....................................24 + 4.4.2. Storing Keys or Hashes? ............................25 + 4.4.3. Security Lameness ..................................25 + 4.4.4. DS Signature Validity Period .......................26 + 5. Security Considerations ........................................26 + 6. Acknowledgments ................................................26 + 7. References .....................................................27 + 7.1. Normative References ......................................27 + 7.2. Informative References ....................................28 + Appendix A. Terminology ...........................................30 + Appendix B. Zone Signing Key Rollover How-To ......................31 + Appendix C. Typographic Conventions ...............................32 + + + + +Kolkman & Gieben Informational [Page 2] + +RFC 4641 DNSSEC Operational Practices September 2006 + + +1. Introduction + + This document describes how to run a DNS Security (DNSSEC)-enabled + environment. It is intended for operators who have knowledge of the + DNS (see RFC 1034 [1] and RFC 1035 [2]) and want to deploy DNSSEC. + See RFC 4033 [4] for an introduction to DNSSEC, RFC 4034 [5] for the + newly introduced Resource Records (RRs), and RFC 4035 [6] for the + protocol changes. + + During workshops and early operational deployment tests, operators + and system administrators have gained experience about operating the + DNS with security extensions (DNSSEC). This document translates + these experiences into a set of practices for zone administrators. + At the time of writing, there exists very little experience with + DNSSEC in production environments; this document should therefore + explicitly not be seen as representing 'Best Current Practices'. + + The procedures herein are focused on the maintenance of signed zones + (i.e., signing and publishing zones on authoritative servers). It is + intended that maintenance of zones such as re-signing or key + rollovers be transparent to any verifying clients on the Internet. + + The structure of this document is as follows. In Section 2, we + discuss the importance of keeping the "chain of trust" intact. + Aspects of key generation and storage of private keys are discussed + in Section 3; the focus in this section is mainly on the private part + of the key(s). Section 4 describes considerations concerning the + public part of the keys. Since these public keys appear in the DNS + one has to take into account all kinds of timing issues, which are + discussed in Section 4.1. Section 4.2 and Section 4.3 deal with the + rollover, or supercession, of keys. Finally, Section 4.4 discusses + considerations on how parents deal with their children's public keys + in order to maintain chains of trust. + + The typographic conventions used in this document are explained in + Appendix C. + + Since this is a document with operational suggestions and there are + no protocol specifications, the RFC 2119 [7] language does not apply. + + This document obsoletes RFC 2541 [12] to reflect the evolution of the + underlying DNSSEC protocol since then. Changes in the choice of + cryptographic algorithms, DNS record types and type names, and the + parent-child key and signature exchange demanded a major rewrite and + additional information and explanation. + + + + + + +Kolkman & Gieben Informational [Page 3] + +RFC 4641 DNSSEC Operational Practices September 2006 + + +1.1. The Use of the Term 'key' + + It is assumed that the reader is familiar with the concept of + asymmetric keys on which DNSSEC is based (public key cryptography + [17]). Therefore, this document will use the term 'key' rather + loosely. Where it is written that 'a key is used to sign data' it is + assumed that the reader understands that it is the private part of + the key pair that is used for signing. It is also assumed that the + reader understands that the public part of the key pair is published + in the DNSKEY Resource Record and that it is the public part that is + used in key exchanges. + +1.2. Time Definitions + + In this document, we will be using a number of time-related terms. + The following definitions apply: + + o "Signature validity period" The period that a signature is valid. + It starts at the time specified in the signature inception field + of the RRSIG RR and ends at the time specified in the expiration + field of the RRSIG RR. + + o "Signature publication period" Time after which a signature (made + with a specific key) is replaced with a new signature (made with + the same key). This replacement takes place by publishing the + relevant RRSIG in the master zone file. After one stops + publishing an RRSIG in a zone, it may take a while before the + RRSIG has expired from caches and has actually been removed from + the DNS. + + o "Key effectivity period" The period during which a key pair is + expected to be effective. This period is defined as the time + between the first inception time stamp and the last expiration + date of any signature made with this key, regardless of any + discontinuity in the use of the key. The key effectivity period + can span multiple signature validity periods. + + o "Maximum/Minimum Zone Time to Live (TTL)" The maximum or minimum + value of the TTLs from the complete set of RRs in a zone. Note + that the minimum TTL is not the same as the MINIMUM field in the + SOA RR. See [11] for more information. + + + + + + + + + + +Kolkman & Gieben Informational [Page 4] + +RFC 4641 DNSSEC Operational Practices September 2006 + + +2. Keeping the Chain of Trust Intact + + Maintaining a valid chain of trust is important because broken chains + of trust will result in data being marked as Bogus (as defined in [4] + Section 5), which may cause entire (sub)domains to become invisible + to verifying clients. The administrators of secured zones have to + realize that their zone is, to verifying clients, part of a chain of + trust. + + As mentioned in the introduction, the procedures herein are intended + to ensure that maintenance of zones, such as re-signing or key + rollovers, will be transparent to the verifying clients on the + Internet. + + Administrators of secured zones will have to keep in mind that data + published on an authoritative primary server will not be immediately + seen by verifying clients; it may take some time for the data to be + transferred to other secondary authoritative nameservers and clients + may be fetching data from caching non-authoritative servers. In this + light, note that the time for a zone transfer from master to slave is + negligible when using NOTIFY [9] and incremental transfer (IXFR) [8]. + It increases when full zone transfers (AXFR) are used in combination + with NOTIFY. It increases even more if you rely on full zone + transfers based on only the SOA timing parameters for refresh. + + For the verifying clients, it is important that data from secured + zones can be used to build chains of trust regardless of whether the + data came directly from an authoritative server, a caching + nameserver, or some middle box. Only by carefully using the + available timing parameters can a zone administrator ensure that the + data necessary for verification can be obtained. + + The responsibility for maintaining the chain of trust is shared by + administrators of secured zones in the chain of trust. This is most + obvious in the case of a 'key compromise' when a trade-off between + maintaining a valid chain of trust and replacing the compromised keys + as soon as possible must be made. Then zone administrators will have + to make a trade-off, between keeping the chain of trust intact -- + thereby allowing for attacks with the compromised key -- or + deliberately breaking the chain of trust and making secured + subdomains invisible to security-aware resolvers. Also see Section + 4.3. + + + + + + + + + +Kolkman & Gieben Informational [Page 5] + +RFC 4641 DNSSEC Operational Practices September 2006 + + +3. Keys Generation and Storage + + This section describes a number of considerations with respect to the + security of keys. It deals with the generation, effectivity period, + size, and storage of private keys. + +3.1. Zone and Key Signing Keys + + The DNSSEC validation protocol does not distinguish between different + types of DNSKEYs. All DNSKEYs can be used during the validation. In + practice, operators use Key Signing and Zone Signing Keys and use the + so-called Secure Entry Point (SEP) [3] flag to distinguish between + them during operations. The dynamics and considerations are + discussed below. + + To make zone re-signing and key rollover procedures easier to + implement, it is possible to use one or more keys as Key Signing Keys + (KSKs). These keys will only sign the apex DNSKEY RRSet in a zone. + Other keys can be used to sign all the RRSets in a zone and are + referred to as Zone Signing Keys (ZSKs). In this document, we assume + that KSKs are the subset of keys that are used for key exchanges with + the parent and potentially for configuration as trusted anchors -- + the SEP keys. In this document, we assume a one-to-one mapping + between KSK and SEP keys and we assume the SEP flag to be set on all + KSKs. + +3.1.1. Motivations for the KSK and ZSK Separation + + Differentiating between the KSK and ZSK functions has several + advantages: + + o No parent/child interaction is required when ZSKs are updated. + + o The KSK can be made stronger (i.e., using more bits in the key + material). This has little operational impact since it is only + used to sign a small fraction of the zone data. Also, the KSK is + only used to verify the zone's key set, not for other RRSets in + the zone. + + o As the KSK is only used to sign a key set, which is most probably + updated less frequently than other data in the zone, it can be + stored separately from and in a safer location than the ZSK. + + o A KSK can have a longer key effectivity period. + + For almost any method of key management and zone signing, the KSK is + used less frequently than the ZSK. Once a key set is signed with the + KSK, all the keys in the key set can be used as ZSKs. If a ZSK is + + + +Kolkman & Gieben Informational [Page 6] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + compromised, it can be simply dropped from the key set. The new key + set is then re-signed with the KSK. + + Given the assumption that for KSKs the SEP flag is set, the KSK can + be distinguished from a ZSK by examining the flag field in the DNSKEY + RR. If the flag field is an odd number it is a KSK. If it is an + even number it is a ZSK. + + The Zone Signing Key can be used to sign all the data in a zone on a + regular basis. When a Zone Signing Key is to be rolled, no + interaction with the parent is needed. This allows for signature + validity periods on the order of days. + + The Key Signing Key is only to be used to sign the DNSKEY RRs in a + zone. If a Key Signing Key is to be rolled over, there will be + interactions with parties other than the zone administrator. These + can include the registry of the parent zone or administrators of + verifying resolvers that have the particular key configured as secure + entry points. Hence, the key effectivity period of these keys can + and should be made much longer. Although, given a long enough key, + the key effectivity period can be on the order of years, we suggest + planning for a key effectivity on the order of a few months so that a + key rollover remains an operational routine. + +3.1.2. KSKs for High-Level Zones + + Higher-level zones are generally more sensitive than lower-level + zones. Anyone controlling or breaking the security of a zone thereby + obtains authority over all of its subdomains (except in the case of + resolvers that have locally configured the public key of a subdomain, + in which case this, and only this, subdomain wouldn't be affected by + the compromise of the parent zone). Therefore, extra care should be + taken with high-level zones, and strong keys should be used. + + The root zone is the most critical of all zones. Someone controlling + or compromising the security of the root zone would control the + entire DNS namespace of all resolvers using that root zone (except in + the case of resolvers that have locally configured the public key of + a subdomain). Therefore, the utmost care must be taken in the + securing of the root zone. The strongest and most carefully handled + keys should be used. The root zone private key should always be kept + off-line. + + Many resolvers will start at a root server for their access to and + authentication of DNS data. Securely updating the trust anchors in + an enormous population of resolvers around the world will be + extremely difficult. + + + + +Kolkman & Gieben Informational [Page 7] + +RFC 4641 DNSSEC Operational Practices September 2006 + + +3.2. Key Generation + + Careful generation of all keys is a sometimes overlooked but + absolutely essential element in any cryptographically secure system. + The strongest algorithms used with the longest keys are still of no + use if an adversary can guess enough to lower the size of the likely + key space so that it can be exhaustively searched. Technical + suggestions for the generation of random keys will be found in RFC + 4086 [14]. One should carefully assess if the random number + generator used during key generation adheres to these suggestions. + + Keys with a long effectivity period are particularly sensitive as + they will represent a more valuable target and be subject to attack + for a longer time than short-period keys. It is strongly recommended + that long-term key generation occur off-line in a manner isolated + from the network via an air gap or, at a minimum, high-level secure + hardware. + +3.3. Key Effectivity Period + + For various reasons, keys in DNSSEC need to be changed once in a + while. The longer a key is in use, the greater the probability that + it will have been compromised through carelessness, accident, + espionage, or cryptanalysis. Furthermore, when key rollovers are too + rare an event, they will not become part of the operational habit and + there is risk that nobody on-site will remember the procedure for + rollover when the need is there. + + From a purely operational perspective, a reasonable key effectivity + period for Key Signing Keys is 13 months, with the intent to replace + them after 12 months. An intended key effectivity period of a month + is reasonable for Zone Signing Keys. + + For key sizes that match these effectivity periods, see Section 3.5. + + As argued in Section 3.1.2, securely updating trust anchors will be + extremely difficult. On the other hand, the "operational habit" + argument does also apply to trust anchor reconfiguration. If a short + key effectivity period is used and the trust anchor configuration has + to be revisited on a regular basis, the odds that the configuration + tends to be forgotten is smaller. The trade-off is against a system + that is so dynamic that administrators of the validating clients will + not be able to follow the modifications. + + Key effectivity periods can be made very short, as in a few minutes. + But when replacing keys one has to take the considerations from + Section 4.1 and Section 4.2 into account. + + + + +Kolkman & Gieben Informational [Page 8] + +RFC 4641 DNSSEC Operational Practices September 2006 + + +3.4. Key Algorithm + + There are currently three different types of algorithms that can be + used in DNSSEC: RSA, DSA, and elliptic curve cryptography. The + latter is fairly new and has yet to be standardized for usage in + DNSSEC. + + RSA has been developed in an open and transparent manner. As the + patent on RSA expired in 2000, its use is now also free. + + DSA has been developed by the National Institute of Standards and + Technology (NIST). The creation of signatures takes roughly the same + time as with RSA, but is 10 to 40 times as slow for verification + [17]. + + We suggest the use of RSA/SHA-1 as the preferred algorithm for the + key. The current known attacks on RSA can be defeated by making your + key longer. As the MD5 hashing algorithm is showing cracks, we + recommend the usage of SHA-1. + + At the time of publication, it is known that the SHA-1 hash has + cryptanalysis issues. There is work in progress on addressing these + issues. We recommend the use of public key algorithms based on + hashes stronger than SHA-1 (e.g., SHA-256), as soon as these + algorithms are available in protocol specifications (see [19] and + [20]) and implementations. + +3.5. Key Sizes + + When choosing key sizes, zone administrators will need to take into + account how long a key will be used, how much data will be signed + during the key publication period (see Section 8.10 of [17]), and, + optionally, how large the key size of the parent is. As the chain of + trust really is "a chain", there is not much sense in making one of + the keys in the chain several times larger then the others. As + always, it's the weakest link that defines the strength of the entire + chain. Also see Section 3.1.1 for a discussion of how keys serving + different roles (ZSK vs. KSK) may need different key sizes. + + Generating a key of the correct size is a difficult problem; RFC 3766 + [13] tries to deal with that problem. The first part of the + selection procedure in Section 1 of the RFC states: + + 1. Determine the attack resistance necessary to satisfy the + security requirements of the application. Do this by + estimating the minimum number of computer operations that the + attacker will be forced to do in order to compromise the + + + + +Kolkman & Gieben Informational [Page 9] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + security of the system and then take the logarithm base two of + that number. Call that logarithm value "n". + + A 1996 report recommended 90 bits as a good all-around choice + for system security. The 90 bit number should be increased by + about 2/3 bit/year, or about 96 bits in 2005. + + [13] goes on to explain how this number "n" can be used to calculate + the key sizes in public key cryptography. This culminated in the + table given below (slightly modified for our purpose): + + +-------------+-----------+--------------+ + | System | | | + | requirement | Symmetric | RSA or DSA | + | for attack | key size | modulus size | + | resistance | (bits) | (bits) | + | (bits) | | | + +-------------+-----------+--------------+ + | 70 | 70 | 947 | + | 80 | 80 | 1228 | + | 90 | 90 | 1553 | + | 100 | 100 | 1926 | + | 150 | 150 | 4575 | + | 200 | 200 | 8719 | + | 250 | 250 | 14596 | + +-------------+-----------+--------------+ + + The key sizes given are rather large. This is because these keys are + resilient against a trillionaire attacker. Assuming this rich + attacker will not attack your key and that the key is rolled over + once a year, we come to the following recommendations about KSK + sizes: 1024 bits for low-value domains, 1300 bits for medium-value + domains, and 2048 bits for high-value domains. + + Whether a domain is of low, medium, or high value depends solely on + the views of the zone owner. One could, for instance, view leaf + nodes in the DNS as of low value, and top-level domains (TLDs) or the + root zone of high value. The suggested key sizes should be safe for + the next 5 years. + + As ZSKs can be rolled over more easily (and thus more often), the key + sizes can be made smaller. But as said in the introduction of this + paragraph, making the ZSKs' key sizes too small (in relation to the + KSKs' sizes) doesn't make much sense. Try to limit the difference in + size to about 100 bits. + + + + + + +Kolkman & Gieben Informational [Page 10] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + Note that nobody can see into the future and that these key sizes are + only provided here as a guide. Further information can be found in + [16] and Section 7.5 of [17]. It should be noted though that [16] is + already considered overly optimistic about what key sizes are + considered safe. + + One final note concerning key sizes. Larger keys will increase the + sizes of the RRSIG and DNSKEY records and will therefore increase the + chance of DNS UDP packet overflow. Also, the time it takes to + validate and create RRSIGs increases with larger keys, so don't + needlessly double your key sizes. + +3.6. Private Key Storage + + It is recommended that, where possible, zone private keys and the + zone file master copy that is to be signed be kept and used in off- + line, non-network-connected, physically secure machines only. + Periodically, an application can be run to add authentication to a + zone by adding RRSIG and NSEC RRs. Then the augmented file can be + transferred. + + When relying on dynamic update to manage a signed zone [10], be aware + that at least one private key of the zone will have to reside on the + master server. This key is only as secure as the amount of exposure + the server receives to unknown clients and the security of the host. + Although not mandatory, one could administer the DNS in the following + way. The master that processes the dynamic updates is unavailable + from generic hosts on the Internet, it is not listed in the NS RR + set, although its name appears in the SOA RRs MNAME field. The + nameservers in the NS RRSet are able to receive zone updates through + NOTIFY, IXFR, AXFR, or an out-of-band distribution mechanism. This + approach is known as the "hidden master" setup. + + The ideal situation is to have a one-way information flow to the + network to avoid the possibility of tampering from the network. + Keeping the zone master file on-line on the network and simply + cycling it through an off-line signer does not do this. The on-line + version could still be tampered with if the host it resides on is + compromised. For maximum security, the master copy of the zone file + should be off-net and should not be updated based on an unsecured + network mediated communication. + + In general, keeping a zone file off-line will not be practical and + the machines on which zone files are maintained will be connected to + a network. Operators are advised to take security measures to shield + unauthorized access to the master copy. + + + + + +Kolkman & Gieben Informational [Page 11] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + For dynamically updated secured zones [10], both the master copy and + the private key that is used to update signatures on updated RRs will + need to be on-line. + +4. Signature Generation, Key Rollover, and Related Policies + +4.1. Time in DNSSEC + + Without DNSSEC, all times in the DNS are relative. The SOA fields + REFRESH, RETRY, and EXPIRATION are timers used to determine the time + elapsed after a slave server synchronized with a master server. The + Time to Live (TTL) value and the SOA RR minimum TTL parameter [11] + are used to determine how long a forwarder should cache data after it + has been fetched from an authoritative server. By using a signature + validity period, DNSSEC introduces the notion of an absolute time in + the DNS. Signatures in DNSSEC have an expiration date after which + the signature is marked as invalid and the signed data is to be + considered Bogus. + +4.1.1. Time Considerations + + Because of the expiration of signatures, one should consider the + following: + + o We suggest the Maximum Zone TTL of your zone data to be a fraction + of your signature validity period. + + If the TTL would be of similar order as the signature validity + period, then all RRSets fetched during the validity period + would be cached until the signature expiration time. Section + 7.1 of [4] suggests that "the resolver may use the time + remaining before expiration of the signature validity period of + a signed RRSet as an upper bound for the TTL". As a result, + query load on authoritative servers would peak at signature + expiration time, as this is also the time at which records + simultaneously expire from caches. + + To avoid query load peaks, we suggest the TTL on all the RRs in + your zone to be at least a few times smaller than your + signature validity period. + + o We suggest the signature publication period to end at least one + Maximum Zone TTL duration before the end of the signature validity + period. + + + + + + + +Kolkman & Gieben Informational [Page 12] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + Re-signing a zone shortly before the end of the signature + validity period may cause simultaneous expiration of data from + caches. This in turn may lead to peaks in the load on + authoritative servers. + + o We suggest the Minimum Zone TTL to be long enough to both fetch + and verify all the RRs in the trust chain. In workshop + environments, it has been demonstrated [18] that a low TTL (under + 5 to 10 minutes) caused disruptions because of the following two + problems: + + 1. During validation, some data may expire before the + validation is complete. The validator should be able to + keep all data until it is completed. This applies to all + RRs needed to complete the chain of trust: DSes, DNSKEYs, + RRSIGs, and the final answers, i.e., the RRSet that is + returned for the initial query. + + 2. Frequent verification causes load on recursive nameservers. + Data at delegation points, DSes, DNSKEYs, and RRSIGs + benefit from caching. The TTL on those should be + relatively long. + + o Slave servers will need to be able to fetch newly signed zones + well before the RRSIGs in the zone served by the slave server pass + their signature expiration time. + + When a slave server is out of sync with its master and data in + a zone is signed by expired signatures, it may be better for + the slave server not to give out any answer. + + Normally, a slave server that is not able to contact a master + server for an extended period will expire a zone. When that + happens, the server will respond differently to queries for + that zone. Some servers issue SERVFAIL, whereas others turn + off the 'AA' bit in the answers. The time of expiration is set + in the SOA record and is relative to the last successful + refresh between the master and the slave servers. There exists + no coupling between the signature expiration of RRSIGs in the + zone and the expire parameter in the SOA. + + If the server serves a DNSSEC zone, then it may well happen + that the signatures expire well before the SOA expiration timer + counts down to zero. It is not possible to completely prevent + this from happening by tweaking the SOA parameters. However, + the effects can be minimized where the SOA expiration time is + equal to or shorter than the signature validity period. The + consequence of an authoritative server not being able to update + + + +Kolkman & Gieben Informational [Page 13] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + a zone, whilst that zone includes expired signatures, is that + non-secure resolvers will continue to be able to resolve data + served by the particular slave servers while security-aware + resolvers will experience problems because of answers being + marked as Bogus. + + We suggest the SOA expiration timer being approximately one + third or one fourth of the signature validity period. It will + allow problems with transfers from the master server to be + noticed before the actual signature times out. We also suggest + that operators of nameservers that supply secondary services + develop 'watch dogs' to spot upcoming signature expirations in + zones they slave, and take appropriate action. + + When determining the value for the expiration parameter one has + to take the following into account: What are the chances that + all my secondaries expire the zone? How quickly can I reach an + administrator of secondary servers to load a valid zone? These + questions are not DNSSEC specific but may influence the choice + of your signature validity intervals. + +4.2. Key Rollovers + + A DNSSEC key cannot be used forever (see Section 3.3). So key + rollovers -- or supercessions, as they are sometimes called -- are a + fact of life when using DNSSEC. Zone administrators who are in the + process of rolling their keys have to take into account that data + published in previous versions of their zone still lives in caches. + When deploying DNSSEC, this becomes an important consideration; + ignoring data that may be in caches may lead to loss of service for + clients. + + The most pressing example of this occurs when zone material signed + with an old key is being validated by a resolver that does not have + the old zone key cached. If the old key is no longer present in the + current zone, this validation fails, marking the data "Bogus". + Alternatively, an attempt could be made to validate data that is + signed with a new key against an old key that lives in a local cache, + also resulting in data being marked "Bogus". + +4.2.1. Zone Signing Key Rollovers + + For "Zone Signing Key rollovers", there are two ways to make sure + that during the rollover data still cached can be verified with the + new key sets or newly generated signatures can be verified with the + keys still in caches. One schema, described in Section 4.2.1.2, uses + + + + + +Kolkman & Gieben Informational [Page 14] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + double signatures; the other uses key pre-publication (Section + 4.2.1.1). The pros, cons, and recommendations are described in + Section 4.2.1.3. + +4.2.1.1. Pre-Publish Key Rollover + + This section shows how to perform a ZSK rollover without the need to + sign all the data in a zone twice -- the "pre-publish key rollover". + This method has advantages in the case of a key compromise. If the + old key is compromised, the new key has already been distributed in + the DNS. The zone administrator is then able to quickly switch to + the new key and remove the compromised key from the zone. Another + major advantage is that the zone size does not double, as is the case + with the double signature ZSK rollover. A small "how-to" for this + kind of rollover can be found in Appendix B. + + Pre-publish key rollover involves four stages as follows: + + ---------------------------------------------------------------- + initial new DNSKEY new RRSIGs DNSKEY removal + ---------------------------------------------------------------- + SOA0 SOA1 SOA2 SOA3 + RRSIG10(SOA0) RRSIG10(SOA1) RRSIG11(SOA2) RRSIG11(SOA3) + + DNSKEY1 DNSKEY1 DNSKEY1 DNSKEY1 + DNSKEY10 DNSKEY10 DNSKEY10 DNSKEY11 + DNSKEY11 DNSKEY11 + RRSIG1 (DNSKEY) RRSIG1 (DNSKEY) RRSIG1(DNSKEY) RRSIG1 (DNSKEY) + RRSIG10(DNSKEY) RRSIG10(DNSKEY) RRSIG11(DNSKEY) RRSIG11(DNSKEY) + ---------------------------------------------------------------- + + Pre-Publish Key Rollover + + initial: Initial version of the zone: DNSKEY 1 is the Key Signing + Key. DNSKEY 10 is used to sign all the data of the zone, the Zone + Signing Key. + + new DNSKEY: DNSKEY 11 is introduced into the key set. Note that no + signatures are generated with this key yet, but this does not + secure against brute force attacks on the public key. The minimum + duration of this pre-roll phase is the time it takes for the data + to propagate to the authoritative servers plus TTL value of the + key set. + + new RRSIGs: At the "new RRSIGs" stage (SOA serial 2), DNSKEY 11 is + used to sign the data in the zone exclusively (i.e., all the + signatures from DNSKEY 10 are removed from the zone). DNSKEY 10 + remains published in the key set. This way data that was loaded + + + +Kolkman & Gieben Informational [Page 15] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + into caches from version 1 of the zone can still be verified with + key sets fetched from version 2 of the zone. The minimum time + that the key set including DNSKEY 10 is to be published is the + time that it takes for zone data from the previous version of the + zone to expire from old caches, i.e., the time it takes for this + zone to propagate to all authoritative servers plus the Maximum + Zone TTL value of any of the data in the previous version of the + zone. + + DNSKEY removal: DNSKEY 10 is removed from the zone. The key set, now + only containing DNSKEY 1 and DNSKEY 11, is re-signed with the + DNSKEY 1. + + The above scheme can be simplified by always publishing the "future" + key immediately after the rollover. The scheme would look as follows + (we show two rollovers); the future key is introduced in "new DNSKEY" + as DNSKEY 12 and again a newer one, numbered 13, in "new DNSKEY + (II)": + + ---------------------------------------------------------------- + initial new RRSIGs new DNSKEY + ---------------------------------------------------------------- + SOA0 SOA1 SOA2 + RRSIG10(SOA0) RRSIG11(SOA1) RRSIG11(SOA2) + + DNSKEY1 DNSKEY1 DNSKEY1 + DNSKEY10 DNSKEY10 DNSKEY11 + DNSKEY11 DNSKEY11 DNSKEY12 + RRSIG1(DNSKEY) RRSIG1 (DNSKEY) RRSIG1(DNSKEY) + RRSIG10(DNSKEY) RRSIG11(DNSKEY) RRSIG11(DNSKEY) + ---------------------------------------------------------------- + + ---------------------------------------------------------------- + new RRSIGs (II) new DNSKEY (II) + ---------------------------------------------------------------- + SOA3 SOA4 + RRSIG12(SOA3) RRSIG12(SOA4) + + DNSKEY1 DNSKEY1 + DNSKEY11 DNSKEY12 + DNSKEY12 DNSKEY13 + RRSIG1(DNSKEY) RRSIG1(DNSKEY) + RRSIG12(DNSKEY) RRSIG12(DNSKEY) + ---------------------------------------------------------------- + + Pre-Publish Key Rollover, Showing Two Rollovers + + + + + +Kolkman & Gieben Informational [Page 16] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + Note that the key introduced in the "new DNSKEY" phase is not used + for production yet; the private key can thus be stored in a + physically secure manner and does not need to be 'fetched' every time + a zone needs to be signed. + +4.2.1.2. Double Signature Zone Signing Key Rollover + + This section shows how to perform a ZSK key rollover using the double + zone data signature scheme, aptly named "double signature rollover". + + During the "new DNSKEY" stage the new version of the zone file will + need to propagate to all authoritative servers and the data that + exists in (distant) caches will need to expire, requiring at least + the Maximum Zone TTL. + + Double signature ZSK rollover involves three stages as follows: + + ---------------------------------------------------------------- + initial new DNSKEY DNSKEY removal + ---------------------------------------------------------------- + SOA0 SOA1 SOA2 + RRSIG10(SOA0) RRSIG10(SOA1) RRSIG11(SOA2) + RRSIG11(SOA1) + + DNSKEY1 DNSKEY1 DNSKEY1 + DNSKEY10 DNSKEY10 DNSKEY11 + DNSKEY11 + RRSIG1(DNSKEY) RRSIG1(DNSKEY) RRSIG1(DNSKEY) + RRSIG10(DNSKEY) RRSIG10(DNSKEY) RRSIG11(DNSKEY) + RRSIG11(DNSKEY) + ---------------------------------------------------------------- + + Double Signature Zone Signing Key Rollover + + initial: Initial Version of the zone: DNSKEY 1 is the Key Signing + Key. DNSKEY 10 is used to sign all the data of the zone, the Zone + Signing Key. + + new DNSKEY: At the "New DNSKEY" stage (SOA serial 1) DNSKEY 11 is + introduced into the key set and all the data in the zone is signed + with DNSKEY 10 and DNSKEY 11. The rollover period will need to + continue until all data from version 0 of the zone has expired + from remote caches. This will take at least the Maximum Zone TTL + of version 0 of the zone. + + DNSKEY removal: DNSKEY 10 is removed from the zone. All the + signatures from DNSKEY 10 are removed from the zone. The key set, + now only containing DNSKEY 11, is re-signed with DNSKEY 1. + + + +Kolkman & Gieben Informational [Page 17] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + At every instance, RRSIGs from the previous version of the zone can + be verified with the DNSKEY RRSet from the current version and the + other way around. The data from the current version can be verified + with the data from the previous version of the zone. The duration of + the "new DNSKEY" phase and the period between rollovers should be at + least the Maximum Zone TTL. + + Making sure that the "new DNSKEY" phase lasts until the signature + expiration time of the data in initial version of the zone is + recommended. This way all caches are cleared of the old signatures. + However, this duration could be considerably longer than the Maximum + Zone TTL, making the rollover a lengthy procedure. + + Note that in this example we assumed that the zone was not modified + during the rollover. New data can be introduced in the zone as long + as it is signed with both keys. + +4.2.1.3. Pros and Cons of the Schemes + + Pre-publish key rollover: This rollover does not involve signing the + zone data twice. Instead, before the actual rollover, the new key + is published in the key set and thus is available for + cryptanalysis attacks. A small disadvantage is that this process + requires four steps. Also the pre-publish scheme involves more + parental work when used for KSK rollovers as explained in Section + 4.2.3. + + Double signature ZSK rollover: The drawback of this signing scheme is + that during the rollover the number of signatures in your zone + doubles; this may be prohibitive if you have very big zones. An + advantage is that it only requires three steps. + +4.2.2. Key Signing Key Rollovers + + For the rollover of a Key Signing Key, the same considerations as for + the rollover of a Zone Signing Key apply. However, we can use a + double signature scheme to guarantee that old data (only the apex key + set) in caches can be verified with a new key set and vice versa. + Since only the key set is signed with a KSK, zone size considerations + do not apply. + + + + + + + + + + + +Kolkman & Gieben Informational [Page 18] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + -------------------------------------------------------------------- + initial new DNSKEY DS change DNSKEY removal + -------------------------------------------------------------------- + Parent: + SOA0 --------> SOA1 --------> + RRSIGpar(SOA0) --------> RRSIGpar(SOA1) --------> + DS1 --------> DS2 --------> + RRSIGpar(DS) --------> RRSIGpar(DS) --------> + + + Child: + SOA0 SOA1 --------> SOA2 + RRSIG10(SOA0) RRSIG10(SOA1) --------> RRSIG10(SOA2) + --------> + DNSKEY1 DNSKEY1 --------> DNSKEY2 + DNSKEY2 --------> + DNSKEY10 DNSKEY10 --------> DNSKEY10 + RRSIG1 (DNSKEY) RRSIG1 (DNSKEY) --------> RRSIG2 (DNSKEY) + RRSIG2 (DNSKEY) --------> + RRSIG10(DNSKEY) RRSIG10(DNSKEY) --------> RRSIG10(DNSKEY) + -------------------------------------------------------------------- + + Stages of Deployment for a Double Signature Key Signing Key Rollover + + initial: Initial version of the zone. The parental DS points to + DNSKEY1. Before the rollover starts, the child will have to + verify what the TTL is of the DS RR that points to DNSKEY1 -- it + is needed during the rollover and we refer to the value as TTL_DS. + + new DNSKEY: During the "new DNSKEY" phase, the zone administrator + generates a second KSK, DNSKEY2. The key is provided to the + parent, and the child will have to wait until a new DS RR has been + generated that points to DNSKEY2. After that DS RR has been + published on all servers authoritative for the parent's zone, the + zone administrator has to wait at least TTL_DS to make sure that + the old DS RR has expired from caches. + + DS change: The parent replaces DS1 with DS2. + + DNSKEY removal: DNSKEY1 has been removed. + + The scenario above puts the responsibility for maintaining a valid + chain of trust with the child. It also is based on the premise that + the parent only has one DS RR (per algorithm) per zone. An + alternative mechanism has been considered. Using an established + trust relation, the interaction can be performed in-band, and the + removal of the keys by the child can possibly be signaled by the + parent. In this mechanism, there are periods where there are two DS + + + +Kolkman & Gieben Informational [Page 19] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + RRs at the parent. Since at the moment of writing the protocol for + this interaction has not been developed, further discussion is out of + scope for this document. + +4.2.3. Difference Between ZSK and KSK Rollovers + + Note that KSK rollovers and ZSK rollovers are different in the sense + that a KSK rollover requires interaction with the parent (and + possibly replacing of trust anchors) and the ensuing delay while + waiting for it. + + A zone key rollover can be handled in two different ways: pre-publish + (Section 4.2.1.1) and double signature (Section 4.2.1.2). + + As the KSK is used to validate the key set and because the KSK is not + changed during a ZSK rollover, a cache is able to validate the new + key set of the zone. The pre-publish method would also work for a + KSK rollover. The records that are to be pre-published are the + parental DS RRs. The pre-publish method has some drawbacks for KSKs. + We first describe the rollover scheme and then indicate these + drawbacks. + + -------------------------------------------------------------------- + initial new DS new DNSKEY DS/DNSKEY removal + -------------------------------------------------------------------- + Parent: + SOA0 SOA1 --------> SOA2 + RRSIGpar(SOA0) RRSIGpar(SOA1) --------> RRSIGpar(SOA2) + DS1 DS1 --------> DS2 + DS2 --------> + RRSIGpar(DS) RRSIGpar(DS) --------> RRSIGpar(DS) + + + Child: + SOA0 --------> SOA1 SOA1 + RRSIG10(SOA0) --------> RRSIG10(SOA1) RRSIG10(SOA1) + --------> + DNSKEY1 --------> DNSKEY2 DNSKEY2 + --------> + DNSKEY10 --------> DNSKEY10 DNSKEY10 + RRSIG1 (DNSKEY) --------> RRSIG2(DNSKEY) RRSIG2 (DNSKEY) + RRSIG10(DNSKEY) --------> RRSIG10(DNSKEY) RRSIG10(DNSKEY) + -------------------------------------------------------------------- + + Stages of Deployment for a Pre-Publish Key Signing Key Rollover + + + + + + +Kolkman & Gieben Informational [Page 20] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + When the child zone wants to roll, it notifies the parent during the + "new DS" phase and submits the new key (or the corresponding DS) to + the parent. The parent publishes DS1 and DS2, pointing to DNSKEY1 + and DNSKEY2, respectively. During the rollover ("new DNSKEY" phase), + which can take place as soon as the new DS set propagated through the + DNS, the child replaces DNSKEY1 with DNSKEY2. Immediately after that + ("DS/DNSKEY removal" phase), it can notify the parent that the old DS + record can be deleted. + + The drawbacks of this scheme are that during the "new DS" phase the + parent cannot verify the match between the DS2 RR and DNSKEY2 using + the DNS -- as DNSKEY2 is not yet published. Besides, we introduce a + "security lame" key (see Section 4.4.3). Finally, the child-parent + interaction consists of two steps. The "double signature" method + only needs one interaction. + +4.2.4. Automated Key Rollovers + + As keys must be renewed periodically, there is some motivation to + automate the rollover process. Consider the following: + + o ZSK rollovers are easy to automate as only the child zone is + involved. + + o A KSK rollover needs interaction between parent and child. Data + exchange is needed to provide the new keys to the parent; + consequently, this data must be authenticated and integrity must + be guaranteed in order to avoid attacks on the rollover. + +4.3. Planning for Emergency Key Rollover + + This section deals with preparation for a possible key compromise. + Our advice is to have a documented procedure ready for when a key + compromise is suspected or confirmed. + + When the private material of one of your keys is compromised it can + be used for as long as a valid trust chain exists. A trust chain + remains intact for + + o as long as a signature over the compromised key in the trust chain + is valid, + + o as long as a parental DS RR (and signature) points to the + compromised key, + + o as long as the key is anchored in a resolver and is used as a + starting point for validation (this is generally the hardest to + update). + + + +Kolkman & Gieben Informational [Page 21] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + While a trust chain to your compromised key exists, your namespace is + vulnerable to abuse by anyone who has obtained illegitimate + possession of the key. Zone operators have to make a trade-off if + the abuse of the compromised key is worse than having data in caches + that cannot be validated. If the zone operator chooses to break the + trust chain to the compromised key, data in caches signed with this + key cannot be validated. However, if the zone administrator chooses + to take the path of a regular rollover, the malicious key holder can + spoof data so that it appears to be valid. + +4.3.1. KSK Compromise + + A zone containing a DNSKEY RRSet with a compromised KSK is vulnerable + as long as the compromised KSK is configured as trust anchor or a + parental DS points to it. + + A compromised KSK can be used to sign the key set of an attacker's + zone. That zone could be used to poison the DNS. + + Therefore, when the KSK has been compromised, the trust anchor or the + parental DS should be replaced as soon as possible. It is local + policy whether to break the trust chain during the emergency + rollover. The trust chain would be broken when the compromised KSK + is removed from the child's zone while the parent still has a DS + pointing to the compromised KSK (the assumption is that there is only + one DS at the parent. If there are multiple DSes this does not apply + -- however the chain of trust of this particular key is broken). + + Note that an attacker's zone still uses the compromised KSK and the + presence of a parental DS would cause the data in this zone to appear + as valid. Removing the compromised key would cause the attacker's + zone to appear as valid and the child's zone as Bogus. Therefore, we + advise not to remove the KSK before the parent has a DS to a new KSK + in place. + +4.3.1.1. Keeping the Chain of Trust Intact + + If we follow this advice, the timing of the replacement of the KSK is + somewhat critical. The goal is to remove the compromised KSK as soon + as the new DS RR is available at the parent. And also make sure that + the signature made with a new KSK over the key set with the + compromised KSK in it expires just after the new DS appears at the + parent, thus removing the old cruft in one swoop. + + The procedure is as follows: + + 1. Introduce a new KSK into the key set, keep the compromised KSK in + the key set. + + + +Kolkman & Gieben Informational [Page 22] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + 2. Sign the key set, with a short validity period. The validity + period should expire shortly after the DS is expected to appear + in the parent and the old DSes have expired from caches. + + 3. Upload the DS for this new key to the parent. + + 4. Follow the procedure of the regular KSK rollover: Wait for the DS + to appear in the authoritative servers and then wait as long as + the TTL of the old DS RRs. If necessary re-sign the DNSKEY RRSet + and modify/extend the expiration time. + + 5. Remove the compromised DNSKEY RR from the zone and re-sign the + key set using your "normal" validity interval. + + An additional danger of a key compromise is that the compromised key + could be used to facilitate a legitimate DNSKEY/DS rollover and/or + nameserver changes at the parent. When that happens, the domain may + be in dispute. An authenticated out-of-band and secure notify + mechanism to contact a parent is needed in this case. + + Note that this is only a problem when the DNSKEY and or DS records + are used for authentication at the parent. + +4.3.1.2. Breaking the Chain of Trust + + There are two methods to break the chain of trust. The first method + causes the child zone to appear 'Bogus' to validating resolvers. The + other causes the child zone to appear 'insecure'. These are + described below. + + In the method that causes the child zone to appear 'Bogus' to + validating resolvers, the child zone replaces the current KSK with a + new one and re-signs the key set. Next it sends the DS of the new + key to the parent. Only after the parent has placed the new DS in + the zone is the child's chain of trust repaired. + + An alternative method of breaking the chain of trust is by removing + the DS RRs from the parent zone altogether. As a result, the child + zone would become insecure. + +4.3.2. ZSK Compromise + + Primarily because there is no parental interaction required when a + ZSK is compromised, the situation is less severe than with a KSK + compromise. The zone must still be re-signed with a new ZSK as soon + as possible. As this is a local operation and requires no + communication between the parent and child, this can be achieved + fairly quickly. However, one has to take into account that just as + + + +Kolkman & Gieben Informational [Page 23] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + with a normal rollover the immediate disappearance of the old + compromised key may lead to verification problems. Also note that as + long as the RRSIG over the compromised ZSK is not expired the zone + may be still at risk. + +4.3.3. Compromises of Keys Anchored in Resolvers + + A key can also be pre-configured in resolvers. For instance, if + DNSSEC is successfully deployed the root key may be pre-configured in + most security aware resolvers. + + If trust-anchor keys are compromised, the resolvers using these keys + should be notified of this fact. Zone administrators may consider + setting up a mailing list to communicate the fact that a SEP key is + about to be rolled over. This communication will of course need to + be authenticated, e.g., by using digital signatures. + + End-users faced with the task of updating an anchored key should + always validate the new key. New keys should be authenticated out- + of-band, for example, through the use of an announcement website that + is secured using secure sockets (TLS) [21]. + +4.4. Parental Policies + +4.4.1. Initial Key Exchanges and Parental Policies Considerations + + The initial key exchange is always subject to the policies set by the + parent. When designing a key exchange policy one should take into + account that the authentication and authorization mechanisms used + during a key exchange should be as strong as the authentication and + authorization mechanisms used for the exchange of delegation + information between parent and child. That is, there is no implicit + need in DNSSEC to make the authentication process stronger than it + was in DNS. + + Using the DNS itself as the source for the actual DNSKEY material, + with an out-of-band check on the validity of the DNSKEY, has the + benefit that it reduces the chances of user error. A DNSKEY query + tool can make use of the SEP bit [3] to select the proper key from a + DNSSEC key set, thereby reducing the chance that the wrong DNSKEY is + sent. It can validate the self-signature over a key; thereby + verifying the ownership of the private key material. Fetching the + DNSKEY from the DNS ensures that the chain of trust remains intact + once the parent publishes the DS RR indicating the child is secure. + + Note: the out-of-band verification is still needed when the key + material is fetched via the DNS. The parent can never be sure + whether or not the DNSKEY RRs have been spoofed. + + + +Kolkman & Gieben Informational [Page 24] + +RFC 4641 DNSSEC Operational Practices September 2006 + + +4.4.2. Storing Keys or Hashes? + + When designing a registry system one should consider which of the + DNSKEYs and/or the corresponding DSes to store. Since a child zone + might wish to have a DS published using a message digest algorithm + not yet understood by the registry, the registry can't count on being + able to generate the DS record from a raw DNSKEY. Thus, we recommend + that registry systems at least support storing DS records. + + It may also be useful to store DNSKEYs, since having them may help + during troubleshooting and, as long as the child's chosen message + digest is supported, the overhead of generating DS records from them + is minimal. Having an out-of-band mechanism, such as a registry + directory (e.g., Whois), to find out which keys are used to generate + DS Resource Records for specific owners and/or zones may also help + with troubleshooting. + + The storage considerations also relate to the design of the customer + interface and the method by which data is transferred between + registrant and registry; Will the child zone administrator be able to + upload DS RRs with unknown hash algorithms or does the interface only + allow DNSKEYs? In the registry-registrar model, one can use the + DNSSEC extensions to the Extensible Provisioning Protocol (EPP) [15], + which allows transfer of DS RRs and optionally DNSKEY RRs. + +4.4.3. Security Lameness + + Security lameness is defined as what happens when a parent has a DS + RR pointing to a non-existing DNSKEY RR. When this happens, the + child's zone may be marked "Bogus" by verifying DNS clients. + + As part of a comprehensive delegation check, the parent could, at key + exchange time, verify that the child's key is actually configured in + the DNS. However, if a parent does not understand the hashing + algorithm used by child, the parental checks are limited to only + comparing the key id. + + Child zones should be very careful in removing DNSKEY material, + specifically SEP keys, for which a DS RR exists. + + Once a zone is "security lame", a fix (e.g., removing a DS RR) will + take time to propagate through the DNS. + + + + + + + + + +Kolkman & Gieben Informational [Page 25] + +RFC 4641 DNSSEC Operational Practices September 2006 + + +4.4.4. DS Signature Validity Period + + Since the DS can be replayed as long as it has a valid signature, a + short signature validity period over the DS minimizes the time a + child is vulnerable in the case of a compromise of the child's + KSK(s). A signature validity period that is too short introduces the + possibility that a zone is marked "Bogus" in case of a configuration + error in the signer. There may not be enough time to fix the + problems before signatures expire. Something as mundane as operator + unavailability during weekends shows the need for DS signature + validity periods longer than 2 days. We recommend an absolute + minimum for a DS signature validity period of a few days. + + The maximum signature validity period of the DS record depends on how + long child zones are willing to be vulnerable after a key compromise. + On the other hand, shortening the DS signature validity interval + increases the operational risk for the parent. Therefore, the parent + may have policy to use a signature validity interval that is + considerably longer than the child would hope for. + + A compromise between the operational constraints of the parent and + minimizing damage for the child may result in a DS signature validity + period somewhere between a week and months. + + In addition to the signature validity period, which sets a lower + bound on the number of times the zone owner will need to sign the + zone data and which sets an upper bound to the time a child is + vulnerable after key compromise, there is the TTL value on the DS + RRs. Shortening the TTL means that the authoritative servers will + see more queries. But on the other hand, a short TTL lowers the + persistence of DS RRSets in caches thereby increasing the speed with + which updated DS RRSets propagate through the DNS. + +5. Security Considerations + + DNSSEC adds data integrity to the DNS. This document tries to assess + the operational considerations to maintain a stable and secure DNSSEC + service. Not taking into account the 'data propagation' properties + in the DNS will cause validation failures and may make secured zones + unavailable to security-aware resolvers. + +6. Acknowledgments + + Most of the ideas in this document were the result of collective + efforts during workshops, discussions, and tryouts. + + At the risk of forgetting individuals who were the original + contributors of the ideas, we would like to acknowledge people who + + + +Kolkman & Gieben Informational [Page 26] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + were actively involved in the compilation of this document. In + random order: Rip Loomis, Olafur Gudmundsson, Wesley Griffin, Michael + Richardson, Scott Rose, Rick van Rein, Tim McGinnis, Gilles Guette + Olivier Courtay, Sam Weiler, Jelte Jansen, Niall O'Reilly, Holger + Zuleger, Ed Lewis, Hilarie Orman, Marcos Sanz, and Peter Koch. + + Some material in this document has been copied from RFC 2541 [12]. + + Mike StJohns designed the key exchange between parent and child + mentioned in the last paragraph of Section 4.2.2 + + Section 4.2.4 was supplied by G. Guette and O. Courtay. + + Emma Bretherick, Adrian Bedford, and Lindy Foster corrected many of + the spelling and style issues. + + Kolkman and Gieben take the blame for introducing all miscakes (sic). + + While working on this document, Kolkman was employed by the RIPE NCC + and Gieben was employed by NLnet Labs. + +7. References + +7.1. Normative References + + [1] Mockapetris, P., "Domain names - concepts and facilities", STD + 13, RFC 1034, November 1987. + + [2] Mockapetris, P., "Domain names - implementation and + specification", STD 13, RFC 1035, November 1987. + + [3] Kolkman, O., Schlyter, J., and E. Lewis, "Domain Name System + KEY (DNSKEY) Resource Record (RR) Secure Entry Point (SEP) + Flag", RFC 3757, May 2004. + + [4] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, + "DNS Security Introduction and Requirements", RFC 4033, March + 2005. + + [5] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, + "Resource Records for the DNS Security Extensions", RFC 4034, + March 2005. + + [6] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, + "Protocol Modifications for the DNS Security Extensions", RFC + 4035, March 2005. + + + + + +Kolkman & Gieben Informational [Page 27] + +RFC 4641 DNSSEC Operational Practices September 2006 + + +7.2. Informative References + + [7] Bradner, S., "Key words for use in RFCs to Indicate Requirement + Levels", BCP 14, RFC 2119, March 1997. + + [8] Ohta, M., "Incremental Zone Transfer in DNS", RFC 1995, August + 1996. + + [9] Vixie, P., "A Mechanism for Prompt Notification of Zone Changes + (DNS NOTIFY)", RFC 1996, August 1996. + + [10] Wellington, B., "Secure Domain Name System (DNS) Dynamic + Update", RFC 3007, November 2000. + + [11] Andrews, M., "Negative Caching of DNS Queries (DNS NCACHE)", + RFC 2308, March 1998. + + [12] Eastlake, D., "DNS Security Operational Considerations", RFC + 2541, March 1999. + + [13] Orman, H. and P. Hoffman, "Determining Strengths For Public + Keys Used For Exchanging Symmetric Keys", BCP 86, RFC 3766, + April 2004. + + [14] Eastlake, D., Schiller, J., and S. Crocker, "Randomness + Requirements for Security", BCP 106, RFC 4086, June 2005. + + [15] Hollenbeck, S., "Domain Name System (DNS) Security Extensions + Mapping for the Extensible Provisioning Protocol (EPP)", RFC + 4310, December 2005. + + [16] Lenstra, A. and E. Verheul, "Selecting Cryptographic Key + Sizes", The Journal of Cryptology 14 (255-293), 2001. + + [17] Schneier, B., "Applied Cryptography: Protocols, Algorithms, and + Source Code in C", ISBN (hardcover) 0-471-12845-7, ISBN + (paperback) 0-471-59756-2, Published by John Wiley & Sons Inc., + 1996. + + [18] Rose, S., "NIST DNSSEC workshop notes", June 2001. + + [19] Jansen, J., "Use of RSA/SHA-256 DNSKEY and RRSIG Resource + Records in DNSSEC", Work in Progress, January 2006. + + [20] Hardaker, W., "Use of SHA-256 in DNSSEC Delegation Signer (DS) + Resource Records (RRs)", RFC 4509, May 2006. + + + + + +Kolkman & Gieben Informational [Page 28] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + [21] Blake-Wilson, S., Nystrom, M., Hopwood, D., Mikkelsen, J., and + T. Wright, "Transport Layer Security (TLS) Extensions", RFC + 4366, April 2006. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +Kolkman & Gieben Informational [Page 29] + +RFC 4641 DNSSEC Operational Practices September 2006 + + +Appendix A. Terminology + + In this document, there is some jargon used that is defined in other + documents. In most cases, we have not copied the text from the + documents defining the terms but have given a more elaborate + explanation of the meaning. Note that these explanations should not + be seen as authoritative. + + Anchored key: A DNSKEY configured in resolvers around the globe. + This key is hard to update, hence the term anchored. + + Bogus: Also see Section 5 of [4]. An RRSet in DNSSEC is marked + "Bogus" when a signature of an RRSet does not validate against a + DNSKEY. + + Key Signing Key or KSK: A Key Signing Key (KSK) is a key that is used + exclusively for signing the apex key set. The fact that a key is + a KSK is only relevant to the signing tool. + + Key size: The term 'key size' can be substituted by 'modulus size' + throughout the document. It is mathematically more correct to use + modulus size, but as this is a document directed at operators we + feel more at ease with the term key size. + + Private and public keys: DNSSEC secures the DNS through the use of + public key cryptography. Public key cryptography is based on the + existence of two (mathematically related) keys, a public key and a + private key. The public keys are published in the DNS by use of + the DNSKEY Resource Record (DNSKEY RR). Private keys should + remain private. + + Key rollover: A key rollover (also called key supercession in some + environments) is the act of replacing one key pair with another at + the end of a key effectivity period. + + Secure Entry Point (SEP) key: A KSK that has a parental DS record + pointing to it or is configured as a trust anchor. Although not + required by the protocol, we recommend that the SEP flag [3] is + set on these keys. + + Self-signature: This only applies to signatures over DNSKEYs; a + signature made with DNSKEY x, over DNSKEY x is called a self- + signature. Note: without further information, self-signatures + convey no trust. They are useful to check the authenticity of the + DNSKEY, i.e., they can be used as a hash. + + + + + + +Kolkman & Gieben Informational [Page 30] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + Singing the zone file: The term used for the event where an + administrator joyfully signs its zone file while producing melodic + sound patterns. + + Signer: The system that has access to the private key material and + signs the Resource Record sets in a zone. A signer may be + configured to sign only parts of the zone, e.g., only those RRSets + for which existing signatures are about to expire. + + Zone Signing Key (ZSK): A key that is used for signing all data in a + zone. The fact that a key is a ZSK is only relevant to the + signing tool. + + Zone administrator: The 'role' that is responsible for signing a zone + and publishing it on the primary authoritative server. + +Appendix B. Zone Signing Key Rollover How-To + + Using the pre-published signature scheme and the most conservative + method to assure oneself that data does not live in caches, here + follows the "how-to". + + Step 0: The preparation: Create two keys and publish both in your key + set. Mark one of the keys "active" and the other "published". + Use the "active" key for signing your zone data. Store the + private part of the "published" key, preferably off-line. The + protocol does not provide for attributes to mark a key as active + or published. This is something you have to do on your own, + through the use of a notebook or key management tool. + + Step 1: Determine expiration: At the beginning of the rollover make a + note of the highest expiration time of signatures in your zone + file created with the current key marked as active. Wait until + the expiration time marked in Step 1 has passed. + + Step 2: Then start using the key that was marked "published" to sign + your data (i.e., mark it "active"). Stop using the key that was + marked "active"; mark it "rolled". + + Step 3: It is safe to engage in a new rollover (Step 1) after at + least one signature validity period. + + + + + + + + + + +Kolkman & Gieben Informational [Page 31] + +RFC 4641 DNSSEC Operational Practices September 2006 + + +Appendix C. Typographic Conventions + + The following typographic conventions are used in this document: + + Key notation: A key is denoted by DNSKEYx, where x is a number or an + identifier, x could be thought of as the key id. + + RRSet notations: RRs are only denoted by the type. All other + information -- owner, class, rdata, and TTL--is left out. Thus: + "example.com 3600 IN A 192.0.2.1" is reduced to "A". RRSets are a + list of RRs. A example of this would be "A1, A2", specifying the + RRSet containing two "A" records. This could again be abbreviated to + just "A". + + Signature notation: Signatures are denoted as RRSIGx(RRSet), which + means that RRSet is signed with DNSKEYx. + + Zone representation: Using the above notation we have simplified the + representation of a signed zone by leaving out all unnecessary + details such as the names and by representing all data by "SOAx" + + SOA representation: SOAs are represented as SOAx, where x is the + serial number. + + Using this notation the following signed zone: + + example.net. 86400 IN SOA ns.example.net. bert.example.net. ( + 2006022100 ; serial + 86400 ; refresh ( 24 hours) + 7200 ; retry ( 2 hours) + 3600000 ; expire (1000 hours) + 28800 ) ; minimum ( 8 hours) + 86400 RRSIG SOA 5 2 86400 20130522213204 ( + 20130422213204 14 example.net. + cmL62SI6iAX46xGNQAdQ... ) + 86400 NS a.iana-servers.net. + 86400 NS b.iana-servers.net. + 86400 RRSIG NS 5 2 86400 20130507213204 ( + 20130407213204 14 example.net. + SO5epiJei19AjXoUpFnQ ... ) + 86400 DNSKEY 256 3 5 ( + EtRB9MP5/AvOuVO0I8XDxy0... ) ; id = 14 + 86400 DNSKEY 257 3 5 ( + gsPW/Yy19GzYIY+Gnr8HABU... ) ; id = 15 + 86400 RRSIG DNSKEY 5 2 86400 20130522213204 ( + 20130422213204 14 example.net. + J4zCe8QX4tXVGjV4e1r9... ) + + + + +Kolkman & Gieben Informational [Page 32] + +RFC 4641 DNSSEC Operational Practices September 2006 + + + 86400 RRSIG DNSKEY 5 2 86400 20130522213204 ( + 20130422213204 15 example.net. + keVDCOpsSeDReyV6O... ) + 86400 RRSIG NSEC 5 2 86400 20130507213204 ( + 20130407213204 14 example.net. + obj3HEp1GjnmhRjX... ) + a.example.net. 86400 IN TXT "A label" + 86400 RRSIG TXT 5 3 86400 20130507213204 ( + 20130407213204 14 example.net. + IkDMlRdYLmXH7QJnuF3v... ) + 86400 NSEC b.example.com. TXT RRSIG NSEC + 86400 RRSIG NSEC 5 3 86400 20130507213204 ( + 20130407213204 14 example.net. + bZMjoZ3bHjnEz0nIsPMM... ) + ... + + is reduced to the following representation: + + SOA2006022100 + RRSIG14(SOA2006022100) + DNSKEY14 + DNSKEY15 + + RRSIG14(KEY) + RRSIG15(KEY) + + The rest of the zone data has the same signature as the SOA record, + i.e., an RRSIG created with DNSKEY 14. + + + + + + + + + + + + + + + + + + + + + + + +Kolkman & Gieben Informational [Page 33] + +RFC 4641 DNSSEC Operational Practices September 2006 + + +Authors' Addresses + + Olaf M. Kolkman + NLnet Labs + Kruislaan 419 + Amsterdam 1098 VA + The Netherlands + + EMail: olaf@nlnetlabs.nl + URI: http://www.nlnetlabs.nl + + + R. (Miek) Gieben + + EMail: miek@miek.nl + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +Kolkman & Gieben Informational [Page 34] + +RFC 4641 DNSSEC Operational Practices September 2006 + + +Full Copyright Statement + + Copyright (C) The Internet Society (2006). + + This document is subject to the rights, licenses and restrictions + contained in BCP 78, and except as set forth therein, the authors + retain all their rights. + + This document and the information contained herein are provided on an + "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS + OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET + ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, + INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE + INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED + WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. + +Intellectual Property + + The IETF takes no position regarding the validity or scope of any + Intellectual Property Rights or other rights that might be claimed to + pertain to the implementation or use of the technology described in + this document or the extent to which any license under such rights + might or might not be available; nor does it represent that it has + made any independent effort to identify any such rights. Information + on the procedures with respect to rights in RFC documents can be + found in BCP 78 and BCP 79. + + Copies of IPR disclosures made to the IETF Secretariat and any + assurances of licenses to be made available, or the result of an + attempt made to obtain a general license or permission for the use of + such proprietary rights by implementers or users of this + specification can be obtained from the IETF on-line IPR repository at + http://www.ietf.org/ipr. + + The IETF invites any interested party to bring to its attention any + copyrights, patents or patent applications, or other proprietary + rights that may cover technology that may be required to implement + this standard. Please address the information to the IETF at + ietf-ipr@ietf.org. + +Acknowledgement + + Funding for the RFC Editor function is provided by the IETF + Administrative Support Activity (IASA). + + + + + + + +Kolkman & Gieben Informational [Page 35] + diff --git a/contrib/bind9/lib/bind/api b/contrib/bind9/lib/bind/api index 8701441..a87852a 100644 --- a/contrib/bind9/lib/bind/api +++ b/contrib/bind9/lib/bind/api @@ -1,3 +1,3 @@ LIBINTERFACE = 4 -LIBREVISION = 6 +LIBREVISION = 10 LIBAGE = 0 diff --git a/contrib/bind9/lib/bind/config.h.in b/contrib/bind9/lib/bind/config.h.in index c4d88d3..69ea285 100644 --- a/contrib/bind9/lib/bind/config.h.in +++ b/contrib/bind9/lib/bind/config.h.in @@ -11,6 +11,8 @@ #undef POSIX_GETPWNAM_R #undef POSIX_GETGRGID_R #undef POSIX_GETGRNAM_R +#undef HAVE_MEMMOVE +#undef HAVE_MEMCHR #undef NEED_SETGROUPENT #undef NEED_GETGROUPLIST @@ -38,6 +40,7 @@ #undef HAS_PW_CLASS +#undef ssize_t #undef uintptr_t /* Shut up warnings about sputaux in stdio.h on BSD/OS pre-4.1 */ diff --git a/contrib/bind9/lib/bind/configure b/contrib/bind9/lib/bind/configure index d6171dc..403c09e 100755 --- a/contrib/bind9/lib/bind/configure +++ b/contrib/bind9/lib/bind/configure @@ -1,5 +1,5 @@ #! /bin/sh -# From configure.in Revision: 1.90.18.29 . +# From configure.in Revision: 1.90.18.33 . # Guess values for system-dependent variables and create Makefiles. # Generated by GNU Autoconf 2.59. # @@ -464,7 +464,7 @@ ac_includes_default="\ # include <unistd.h> #endif" -ac_subst_vars='SHELL PATH_SEPARATOR PACKAGE_NAME PACKAGE_TARNAME PACKAGE_VERSION PACKAGE_STRING PACKAGE_BUGREPORT exec_prefix prefix program_transform_name bindir sbindir libexecdir datadir sysconfdir sharedstatedir localstatedir libdir includedir oldincludedir infodir mandir build_alias host_alias target_alias DEFS ECHO_C ECHO_N ECHO_T LIBS build build_cpu build_vendor build_os host host_cpu host_vendor host_os SET_MAKE RANLIB ac_ct_RANLIB INSTALL_PROGRAM INSTALL_SCRIPT INSTALL_DATA STD_CINCLUDES STD_CDEFINES STD_CWARNINGS CCOPT AR ARFLAGS LN ETAGS PERL CC CFLAGS LDFLAGS CPPFLAGS ac_ct_CC EXEEXT OBJEXT CPP EGREP ISC_PLATFORM_NEEDSYSSELECTH WANT_IRS_GR WANT_IRS_GR_OBJS WANT_IRS_PW WANT_IRS_PW_OBJS WANT_IRS_NIS WANT_IRS_NIS_OBJS WANT_IRS_NISGR_OBJS WANT_IRS_NISPW_OBJS WANT_IRS_DBPW_OBJS ALWAYS_DEFINES DO_PTHREADS WANT_IRS_THREADSGR_OBJS WANT_IRS_THREADSPW_OBJS WANT_IRS_THREADS_OBJS WANT_THREADS_OBJS USE_IFNAMELINKID ISC_THREAD_DIR DAEMON_OBJS NEED_DAEMON STRSEP_OBJS NEED_STRSEP NEED_STRERROR MKDEPCC MKDEPCFLAGS MKDEPPROG IRIX_DNSSEC_WARNINGS_HACK purify_path PURIFY LN_S ECHO ac_ct_AR STRIP ac_ct_STRIP CXX CXXFLAGS ac_ct_CXX CXXCPP F77 FFLAGS ac_ct_F77 LIBTOOL O A SA LIBTOOL_MKDEP_SED LIBTOOL_MODE_COMPILE LIBTOOL_MODE_INSTALL LIBTOOL_MODE_LINK HAS_INET6_STRUCTS ISC_PLATFORM_NEEDNETINETIN6H ISC_PLATFORM_NEEDNETINET6IN6H HAS_IN_ADDR6 NEED_IN6ADDR_ANY ISC_PLATFORM_HAVEIN6PKTINFO ISC_PLATFORM_FIXIN6ISADDR ISC_IPV6_H ISC_IPV6_O ISC_ISCIPV6_O ISC_IPV6_C HAVE_SIN6_SCOPE_ID HAVE_SOCKADDR_STORAGE ISC_PLATFORM_NEEDNTOP ISC_PLATFORM_NEEDPTON ISC_PLATFORM_NEEDATON HAVE_SA_LEN HAVE_MINIMUM_IFREQ BSD_COMP SOLARIS_BITTYPES USE_FIONBIO_IOCTL PORT_NONBLOCK PORT_DIR USE_POLL HAVE_MD5 SOLARIS2 PORT_INCLUDE ISC_PLATFORM_MSGHDRFLAVOR ISC_PLATFORM_NEEDPORTT ISC_LWRES_ENDHOSTENTINT ISC_LWRES_SETNETENTINT ISC_LWRES_ENDNETENTINT ISC_LWRES_GETHOSTBYADDRVOID ISC_LWRES_NEEDHERRNO ISC_LWRES_GETIPNODEPROTO ISC_LWRES_GETADDRINFOPROTO ISC_LWRES_GETNAMEINFOPROTO NEED_PSELECT NEED_GETTIMEOFDAY HAVE_STRNDUP ISC_PLATFORM_NEEDSTRSEP ISC_PLATFORM_NEEDVSNPRINTF ISC_EXTRA_OBJS ISC_EXTRA_SRCS USE_SYSERROR_LIST ISC_PLATFORM_QUADFORMAT ISC_SOCKLEN_T GETGROUPLIST_ARGS NET_R_ARGS NET_R_BAD NET_R_COPY NET_R_COPY_ARGS NET_R_OK NET_R_SETANSWER NET_R_RETURN GETNETBYADDR_ADDR_T NETENT_DATA NET_R_ENT_ARGS NET_R_SET_RESULT NET_R_SET_RETURN NET_R_END_RESULT NET_R_END_RETURN GROUP_R_ARGS GROUP_R_BAD GROUP_R_OK GROUP_R_RETURN GROUP_R_END_RESULT GROUP_R_END_RETURN GROUP_R_ENT_ARGS GROUP_R_SET_RESULT GROUP_R_SET_RETURN HOST_R_ARGS HOST_R_BAD HOST_R_COPY HOST_R_COPY_ARGS HOST_R_ERRNO HOST_R_OK HOST_R_RETURN HOST_R_SETANSWER HOSTENT_DATA HOST_R_END_RESULT HOST_R_END_RETURN HOST_R_ENT_ARGS HOST_R_SET_RESULT HOST_R_SET_RETURN SETPWENT_VOID SETGRENT_VOID NGR_R_ARGS NGR_R_BAD NGR_R_COPY NGR_R_COPY_ARGS NGR_R_OK NGR_R_RETURN NGR_R_PRIVATE NGR_R_END_RESULT NGR_R_END_RETURN NGR_R_ENT_ARGS NGR_R_SET_RESULT NGR_R_SET_RETURN PROTO_R_ARGS PROTO_R_BAD PROTO_R_COPY PROTO_R_COPY_ARGS PROTO_R_OK PROTO_R_SETANSWER PROTO_R_RETURN PROTOENT_DATA PROTO_R_END_RESULT PROTO_R_END_RETURN PROTO_R_ENT_ARGS PROTO_R_ENT_UNUSED PROTO_R_SET_RESULT PROTO_R_SET_RETURN PASS_R_ARGS PASS_R_BAD PASS_R_COPY PASS_R_COPY_ARGS PASS_R_OK PASS_R_RETURN PASS_R_END_RESULT PASS_R_END_RETURN PASS_R_ENT_ARGS PASS_R_SET_RESULT PASS_R_SET_RETURN SERV_R_ARGS SERV_R_BAD SERV_R_COPY SERV_R_COPY_ARGS SERV_R_OK SERV_R_SETANSWER SERV_R_RETURN SERVENT_DATA SERV_R_END_RESULT SERV_R_END_RETURN SERV_R_ENT_ARGS SERV_R_ENT_UNUSED SERV_R_SET_RESULT SERV_R_SET_RETURN SETNETGRENT_ARGS INNETGR_ARGS BIND9_TOP_BUILDDIR BIND9_VERSION LIBOBJS LTLIBOBJS' +ac_subst_vars='SHELL PATH_SEPARATOR PACKAGE_NAME PACKAGE_TARNAME PACKAGE_VERSION PACKAGE_STRING PACKAGE_BUGREPORT exec_prefix prefix program_transform_name bindir sbindir libexecdir datadir sysconfdir sharedstatedir localstatedir libdir includedir oldincludedir infodir mandir build_alias host_alias target_alias DEFS ECHO_C ECHO_N ECHO_T LIBS build build_cpu build_vendor build_os host host_cpu host_vendor host_os SET_MAKE RANLIB ac_ct_RANLIB INSTALL_PROGRAM INSTALL_SCRIPT INSTALL_DATA STD_CINCLUDES STD_CDEFINES STD_CWARNINGS CCOPT AR ARFLAGS LN ETAGS PERL CC CFLAGS LDFLAGS CPPFLAGS ac_ct_CC EXEEXT OBJEXT CPP EGREP ISC_PLATFORM_NEEDSYSSELECTH WANT_IRS_GR WANT_IRS_GR_OBJS WANT_IRS_PW WANT_IRS_PW_OBJS WANT_IRS_NIS WANT_IRS_NIS_OBJS WANT_IRS_NISGR_OBJS WANT_IRS_NISPW_OBJS WANT_IRS_DBPW_OBJS ALWAYS_DEFINES DO_PTHREADS WANT_IRS_THREADSGR_OBJS WANT_IRS_THREADSPW_OBJS WANT_IRS_THREADS_OBJS WANT_THREADS_OBJS USE_IFNAMELINKID ISC_THREAD_DIR DAEMON_OBJS NEED_DAEMON STRSEP_OBJS NEED_STRSEP NEED_STRERROR MKDEPCC MKDEPCFLAGS MKDEPPROG IRIX_DNSSEC_WARNINGS_HACK purify_path PURIFY LN_S ECHO ac_ct_AR STRIP ac_ct_STRIP CXX CXXFLAGS ac_ct_CXX CXXCPP F77 FFLAGS ac_ct_F77 LIBTOOL O A SA LIBTOOL_MKDEP_SED LIBTOOL_MODE_COMPILE LIBTOOL_MODE_INSTALL LIBTOOL_MODE_LINK HAS_INET6_STRUCTS ISC_PLATFORM_NEEDNETINETIN6H ISC_PLATFORM_NEEDNETINET6IN6H HAS_IN_ADDR6 NEED_IN6ADDR_ANY ISC_PLATFORM_HAVEIN6PKTINFO ISC_PLATFORM_FIXIN6ISADDR ISC_IPV6_H ISC_IPV6_O ISC_ISCIPV6_O ISC_IPV6_C HAVE_SIN6_SCOPE_ID HAVE_SOCKADDR_STORAGE ISC_PLATFORM_NEEDNTOP ISC_PLATFORM_NEEDPTON ISC_PLATFORM_NEEDATON HAVE_SA_LEN HAVE_MINIMUM_IFREQ BSD_COMP SOLARIS_BITTYPES USE_FIONBIO_IOCTL PORT_NONBLOCK PORT_DIR USE_POLL HAVE_MD5 SOLARIS2 PORT_INCLUDE ISC_PLATFORM_MSGHDRFLAVOR ISC_PLATFORM_NEEDPORTT ISC_PLATFORM_NEEDTIMESPEC ISC_LWRES_ENDHOSTENTINT ISC_LWRES_SETNETENTINT ISC_LWRES_ENDNETENTINT ISC_LWRES_GETHOSTBYADDRVOID ISC_LWRES_NEEDHERRNO ISC_LWRES_GETIPNODEPROTO ISC_LWRES_GETADDRINFOPROTO ISC_LWRES_GETNAMEINFOPROTO NEED_PSELECT NEED_GETTIMEOFDAY HAVE_STRNDUP ISC_PLATFORM_NEEDSTRSEP ISC_PLATFORM_NEEDVSNPRINTF ISC_EXTRA_OBJS ISC_EXTRA_SRCS USE_SYSERROR_LIST ISC_PLATFORM_QUADFORMAT ISC_SOCKLEN_T GETGROUPLIST_ARGS NET_R_ARGS NET_R_BAD NET_R_COPY NET_R_COPY_ARGS NET_R_OK NET_R_SETANSWER NET_R_RETURN GETNETBYADDR_ADDR_T NETENT_DATA NET_R_ENT_ARGS NET_R_SET_RESULT NET_R_SET_RETURN NET_R_END_RESULT NET_R_END_RETURN GROUP_R_ARGS GROUP_R_BAD GROUP_R_OK GROUP_R_RETURN GROUP_R_END_RESULT GROUP_R_END_RETURN GROUP_R_ENT_ARGS GROUP_R_SET_RESULT GROUP_R_SET_RETURN HOST_R_ARGS HOST_R_BAD HOST_R_COPY HOST_R_COPY_ARGS HOST_R_ERRNO HOST_R_OK HOST_R_RETURN HOST_R_SETANSWER HOSTENT_DATA HOST_R_END_RESULT HOST_R_END_RETURN HOST_R_ENT_ARGS HOST_R_SET_RESULT HOST_R_SET_RETURN SETPWENT_VOID SETGRENT_VOID NGR_R_ARGS NGR_R_BAD NGR_R_COPY NGR_R_COPY_ARGS NGR_R_OK NGR_R_RETURN NGR_R_PRIVATE NGR_R_END_RESULT NGR_R_END_RETURN NGR_R_ENT_ARGS NGR_R_SET_RESULT NGR_R_SET_RETURN PROTO_R_ARGS PROTO_R_BAD PROTO_R_COPY PROTO_R_COPY_ARGS PROTO_R_OK PROTO_R_SETANSWER PROTO_R_RETURN PROTOENT_DATA PROTO_R_END_RESULT PROTO_R_END_RETURN PROTO_R_ENT_ARGS PROTO_R_ENT_UNUSED PROTO_R_SET_RESULT PROTO_R_SET_RETURN PASS_R_ARGS PASS_R_BAD PASS_R_COPY PASS_R_COPY_ARGS PASS_R_OK PASS_R_RETURN PASS_R_END_RESULT PASS_R_END_RETURN PASS_R_ENT_ARGS PASS_R_SET_RESULT PASS_R_SET_RETURN SERV_R_ARGS SERV_R_BAD SERV_R_COPY SERV_R_COPY_ARGS SERV_R_OK SERV_R_SETANSWER SERV_R_RETURN SERVENT_DATA SERV_R_END_RESULT SERV_R_END_RETURN SERV_R_ENT_ARGS SERV_R_ENT_UNUSED SERV_R_SET_RESULT SERV_R_SET_RETURN SETNETGRENT_ARGS INNETGR_ARGS BIND9_TOP_BUILDDIR BIND9_VERSION LIBOBJS LTLIBOBJS' ac_subst_files='BIND9_INCLUDES BIND9_MAKE_RULES LIBBIND_API' # Initialize some variables set by options. @@ -3867,6 +3867,72 @@ _ACEOF fi +echo "$as_me:$LINENO: checking for ssize_t" >&5 +echo $ECHO_N "checking for ssize_t... $ECHO_C" >&6 +if test "${ac_cv_type_ssize_t+set}" = set; then + echo $ECHO_N "(cached) $ECHO_C" >&6 +else + cat >conftest.$ac_ext <<_ACEOF +/* confdefs.h. */ +_ACEOF +cat confdefs.h >>conftest.$ac_ext +cat >>conftest.$ac_ext <<_ACEOF +/* end confdefs.h. */ +$ac_includes_default +int +main () +{ +if ((ssize_t *) 0) + return 0; +if (sizeof (ssize_t)) + return 0; + ; + return 0; +} +_ACEOF +rm -f conftest.$ac_objext +if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5 + (eval $ac_compile) 2>conftest.er1 + ac_status=$? + grep -v '^ *+' conftest.er1 >conftest.err + rm -f conftest.er1 + cat conftest.err >&5 + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); } && + { ac_try='test -z "$ac_c_werror_flag" + || test ! -s conftest.err' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; } && + { ac_try='test -s conftest.$ac_objext' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; }; then + ac_cv_type_ssize_t=yes +else + echo "$as_me: failed program was:" >&5 +sed 's/^/| /' conftest.$ac_ext >&5 + +ac_cv_type_ssize_t=no +fi +rm -f conftest.err conftest.$ac_objext conftest.$ac_ext +fi +echo "$as_me:$LINENO: result: $ac_cv_type_ssize_t" >&5 +echo "${ECHO_T}$ac_cv_type_ssize_t" >&6 +if test $ac_cv_type_ssize_t = yes; then + : +else + +cat >>confdefs.h <<_ACEOF +#define ssize_t signed +_ACEOF + +fi + echo "$as_me:$LINENO: checking for uintptr_t" >&5 echo $ECHO_N "checking for uintptr_t... $ECHO_C" >&6 if test "${ac_cv_type_uintptr_t+set}" = set; then @@ -6340,6 +6406,200 @@ _ACEOF fi +echo "$as_me:$LINENO: checking for memmove" >&5 +echo $ECHO_N "checking for memmove... $ECHO_C" >&6 +if test "${ac_cv_func_memmove+set}" = set; then + echo $ECHO_N "(cached) $ECHO_C" >&6 +else + cat >conftest.$ac_ext <<_ACEOF +/* confdefs.h. */ +_ACEOF +cat confdefs.h >>conftest.$ac_ext +cat >>conftest.$ac_ext <<_ACEOF +/* end confdefs.h. */ +/* Define memmove to an innocuous variant, in case <limits.h> declares memmove. + For example, HP-UX 11i <limits.h> declares gettimeofday. */ +#define memmove innocuous_memmove + +/* System header to define __stub macros and hopefully few prototypes, + which can conflict with char memmove (); below. + Prefer <limits.h> to <assert.h> if __STDC__ is defined, since + <limits.h> exists even on freestanding compilers. */ + +#ifdef __STDC__ +# include <limits.h> +#else +# include <assert.h> +#endif + +#undef memmove + +/* Override any gcc2 internal prototype to avoid an error. */ +#ifdef __cplusplus +extern "C" +{ +#endif +/* We use char because int might match the return type of a gcc2 + builtin and then its argument prototype would still apply. */ +char memmove (); +/* The GNU C library defines this for functions which it implements + to always fail with ENOSYS. Some functions are actually named + something starting with __ and the normal name is an alias. */ +#if defined (__stub_memmove) || defined (__stub___memmove) +choke me +#else +char (*f) () = memmove; +#endif +#ifdef __cplusplus +} +#endif + +int +main () +{ +return f != memmove; + ; + return 0; +} +_ACEOF +rm -f conftest.$ac_objext conftest$ac_exeext +if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5 + (eval $ac_link) 2>conftest.er1 + ac_status=$? + grep -v '^ *+' conftest.er1 >conftest.err + rm -f conftest.er1 + cat conftest.err >&5 + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); } && + { ac_try='test -z "$ac_c_werror_flag" + || test ! -s conftest.err' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; } && + { ac_try='test -s conftest$ac_exeext' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; }; then + ac_cv_func_memmove=yes +else + echo "$as_me: failed program was:" >&5 +sed 's/^/| /' conftest.$ac_ext >&5 + +ac_cv_func_memmove=no +fi +rm -f conftest.err conftest.$ac_objext \ + conftest$ac_exeext conftest.$ac_ext +fi +echo "$as_me:$LINENO: result: $ac_cv_func_memmove" >&5 +echo "${ECHO_T}$ac_cv_func_memmove" >&6 +if test $ac_cv_func_memmove = yes; then + cat >>confdefs.h <<\_ACEOF +#define HAVE_MEMMOVE 1 +_ACEOF + +fi + +echo "$as_me:$LINENO: checking for memchr" >&5 +echo $ECHO_N "checking for memchr... $ECHO_C" >&6 +if test "${ac_cv_func_memchr+set}" = set; then + echo $ECHO_N "(cached) $ECHO_C" >&6 +else + cat >conftest.$ac_ext <<_ACEOF +/* confdefs.h. */ +_ACEOF +cat confdefs.h >>conftest.$ac_ext +cat >>conftest.$ac_ext <<_ACEOF +/* end confdefs.h. */ +/* Define memchr to an innocuous variant, in case <limits.h> declares memchr. + For example, HP-UX 11i <limits.h> declares gettimeofday. */ +#define memchr innocuous_memchr + +/* System header to define __stub macros and hopefully few prototypes, + which can conflict with char memchr (); below. + Prefer <limits.h> to <assert.h> if __STDC__ is defined, since + <limits.h> exists even on freestanding compilers. */ + +#ifdef __STDC__ +# include <limits.h> +#else +# include <assert.h> +#endif + +#undef memchr + +/* Override any gcc2 internal prototype to avoid an error. */ +#ifdef __cplusplus +extern "C" +{ +#endif +/* We use char because int might match the return type of a gcc2 + builtin and then its argument prototype would still apply. */ +char memchr (); +/* The GNU C library defines this for functions which it implements + to always fail with ENOSYS. Some functions are actually named + something starting with __ and the normal name is an alias. */ +#if defined (__stub_memchr) || defined (__stub___memchr) +choke me +#else +char (*f) () = memchr; +#endif +#ifdef __cplusplus +} +#endif + +int +main () +{ +return f != memchr; + ; + return 0; +} +_ACEOF +rm -f conftest.$ac_objext conftest$ac_exeext +if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5 + (eval $ac_link) 2>conftest.er1 + ac_status=$? + grep -v '^ *+' conftest.er1 >conftest.err + rm -f conftest.er1 + cat conftest.err >&5 + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); } && + { ac_try='test -z "$ac_c_werror_flag" + || test ! -s conftest.err' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; } && + { ac_try='test -s conftest$ac_exeext' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; }; then + ac_cv_func_memchr=yes +else + echo "$as_me: failed program was:" >&5 +sed 's/^/| /' conftest.$ac_ext >&5 + +ac_cv_func_memchr=no +fi +rm -f conftest.err conftest.$ac_objext \ + conftest$ac_exeext conftest.$ac_ext +fi +echo "$as_me:$LINENO: result: $ac_cv_func_memchr" >&5 +echo "${ECHO_T}$ac_cv_func_memchr" >&6 +if test $ac_cv_func_memchr = yes; then + cat >>confdefs.h <<\_ACEOF +#define HAVE_MEMCHR 1 +_ACEOF + +fi + echo "$as_me:$LINENO: checking for if_nametoindex" >&5 echo $ECHO_N "checking for if_nametoindex... $ECHO_C" >&6 @@ -8126,7 +8386,7 @@ ia64-*-hpux*) ;; *-*-irix6*) # Find out which ABI we are using. - echo '#line 8129 "configure"' > conftest.$ac_ext + echo '#line 8389 "configure"' > conftest.$ac_ext if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5 (eval $ac_compile) 2>&5 ac_status=$? @@ -9123,7 +9383,7 @@ fi # Provide some information about the compiler. -echo "$as_me:9126:" \ +echo "$as_me:9386:" \ "checking for Fortran 77 compiler version" >&5 ac_compiler=`set X $ac_compile; echo $2` { (eval echo "$as_me:$LINENO: \"$ac_compiler --version </dev/null >&5\"") >&5 @@ -10184,11 +10444,11 @@ else -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` - (eval echo "\"\$as_me:10187: $lt_compile\"" >&5) + (eval echo "\"\$as_me:10447: $lt_compile\"" >&5) (eval "$lt_compile" 2>conftest.err) ac_status=$? cat conftest.err >&5 - echo "$as_me:10191: \$? = $ac_status" >&5 + echo "$as_me:10451: \$? = $ac_status" >&5 if (exit $ac_status) && test -s "$ac_outfile"; then # The compiler can only warn and ignore the option if not recognized # So say no if there are warnings @@ -10427,11 +10687,11 @@ else -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` - (eval echo "\"\$as_me:10430: $lt_compile\"" >&5) + (eval echo "\"\$as_me:10690: $lt_compile\"" >&5) (eval "$lt_compile" 2>conftest.err) ac_status=$? cat conftest.err >&5 - echo "$as_me:10434: \$? = $ac_status" >&5 + echo "$as_me:10694: \$? = $ac_status" >&5 if (exit $ac_status) && test -s "$ac_outfile"; then # The compiler can only warn and ignore the option if not recognized # So say no if there are warnings @@ -10487,11 +10747,11 @@ else -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` - (eval echo "\"\$as_me:10490: $lt_compile\"" >&5) + (eval echo "\"\$as_me:10750: $lt_compile\"" >&5) (eval "$lt_compile" 2>out/conftest.err) ac_status=$? cat out/conftest.err >&5 - echo "$as_me:10494: \$? = $ac_status" >&5 + echo "$as_me:10754: \$? = $ac_status" >&5 if (exit $ac_status) && test -s out/conftest2.$ac_objext then # The compiler can only warn and ignore the option if not recognized @@ -12672,7 +12932,7 @@ else lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2 lt_status=$lt_dlunknown cat > conftest.$ac_ext <<EOF -#line 12675 "configure" +#line 12935 "configure" #include "confdefs.h" #if HAVE_DLFCN_H @@ -12770,7 +13030,7 @@ else lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2 lt_status=$lt_dlunknown cat > conftest.$ac_ext <<EOF -#line 12773 "configure" +#line 13033 "configure" #include "confdefs.h" #if HAVE_DLFCN_H @@ -14967,11 +15227,11 @@ else -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` - (eval echo "\"\$as_me:14970: $lt_compile\"" >&5) + (eval echo "\"\$as_me:15230: $lt_compile\"" >&5) (eval "$lt_compile" 2>conftest.err) ac_status=$? cat conftest.err >&5 - echo "$as_me:14974: \$? = $ac_status" >&5 + echo "$as_me:15234: \$? = $ac_status" >&5 if (exit $ac_status) && test -s "$ac_outfile"; then # The compiler can only warn and ignore the option if not recognized # So say no if there are warnings @@ -15027,11 +15287,11 @@ else -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` - (eval echo "\"\$as_me:15030: $lt_compile\"" >&5) + (eval echo "\"\$as_me:15290: $lt_compile\"" >&5) (eval "$lt_compile" 2>out/conftest.err) ac_status=$? cat out/conftest.err >&5 - echo "$as_me:15034: \$? = $ac_status" >&5 + echo "$as_me:15294: \$? = $ac_status" >&5 if (exit $ac_status) && test -s out/conftest2.$ac_objext then # The compiler can only warn and ignore the option if not recognized @@ -16388,7 +16648,7 @@ else lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2 lt_status=$lt_dlunknown cat > conftest.$ac_ext <<EOF -#line 16391 "configure" +#line 16651 "configure" #include "confdefs.h" #if HAVE_DLFCN_H @@ -16486,7 +16746,7 @@ else lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2 lt_status=$lt_dlunknown cat > conftest.$ac_ext <<EOF -#line 16489 "configure" +#line 16749 "configure" #include "confdefs.h" #if HAVE_DLFCN_H @@ -17323,11 +17583,11 @@ else -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` - (eval echo "\"\$as_me:17326: $lt_compile\"" >&5) + (eval echo "\"\$as_me:17586: $lt_compile\"" >&5) (eval "$lt_compile" 2>conftest.err) ac_status=$? cat conftest.err >&5 - echo "$as_me:17330: \$? = $ac_status" >&5 + echo "$as_me:17590: \$? = $ac_status" >&5 if (exit $ac_status) && test -s "$ac_outfile"; then # The compiler can only warn and ignore the option if not recognized # So say no if there are warnings @@ -17383,11 +17643,11 @@ else -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` - (eval echo "\"\$as_me:17386: $lt_compile\"" >&5) + (eval echo "\"\$as_me:17646: $lt_compile\"" >&5) (eval "$lt_compile" 2>out/conftest.err) ac_status=$? cat out/conftest.err >&5 - echo "$as_me:17390: \$? = $ac_status" >&5 + echo "$as_me:17650: \$? = $ac_status" >&5 if (exit $ac_status) && test -s out/conftest2.$ac_objext then # The compiler can only warn and ignore the option if not recognized @@ -19422,11 +19682,11 @@ else -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` - (eval echo "\"\$as_me:19425: $lt_compile\"" >&5) + (eval echo "\"\$as_me:19685: $lt_compile\"" >&5) (eval "$lt_compile" 2>conftest.err) ac_status=$? cat conftest.err >&5 - echo "$as_me:19429: \$? = $ac_status" >&5 + echo "$as_me:19689: \$? = $ac_status" >&5 if (exit $ac_status) && test -s "$ac_outfile"; then # The compiler can only warn and ignore the option if not recognized # So say no if there are warnings @@ -19665,11 +19925,11 @@ else -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` - (eval echo "\"\$as_me:19668: $lt_compile\"" >&5) + (eval echo "\"\$as_me:19928: $lt_compile\"" >&5) (eval "$lt_compile" 2>conftest.err) ac_status=$? cat conftest.err >&5 - echo "$as_me:19672: \$? = $ac_status" >&5 + echo "$as_me:19932: \$? = $ac_status" >&5 if (exit $ac_status) && test -s "$ac_outfile"; then # The compiler can only warn and ignore the option if not recognized # So say no if there are warnings @@ -19725,11 +19985,11 @@ else -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` - (eval echo "\"\$as_me:19728: $lt_compile\"" >&5) + (eval echo "\"\$as_me:19988: $lt_compile\"" >&5) (eval "$lt_compile" 2>out/conftest.err) ac_status=$? cat out/conftest.err >&5 - echo "$as_me:19732: \$? = $ac_status" >&5 + echo "$as_me:19992: \$? = $ac_status" >&5 if (exit $ac_status) && test -s out/conftest2.$ac_objext then # The compiler can only warn and ignore the option if not recognized @@ -21910,7 +22170,7 @@ else lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2 lt_status=$lt_dlunknown cat > conftest.$ac_ext <<EOF -#line 21913 "configure" +#line 22173 "configure" #include "confdefs.h" #if HAVE_DLFCN_H @@ -22008,7 +22268,7 @@ else lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2 lt_status=$lt_dlunknown cat > conftest.$ac_ext <<EOF -#line 22011 "configure" +#line 22271 "configure" #include "confdefs.h" #if HAVE_DLFCN_H @@ -23473,10 +23733,22 @@ echo "${ECHO_T}no -- disabling runtime ipv6 support" >&6 ISC_PLATFORM_HAVEIN6PKTINFO="#undef ISC_PLATFORM_HAVEIN6PKTINFO" fi rm -f conftest.err conftest.$ac_objext conftest.$ac_ext + ;; + no) + HAS_INET6_STRUCTS="#undef HAS_INET6_STRUCTS" + NEED_IN6ADDR_ANY="#undef NEED_IN6ADDR_ANY" + ISC_PLATFORM_HAVEIN6PKTINFO="#undef ISC_PLATFORM_HAVEIN6PKTINFO" + HAVE_SIN6_SCOPE_ID="#define HAVE_SIN6_SCOPE_ID 1" + ISC_IPV6_H="ipv6.h" + ISC_IPV6_O="ipv6.$O" + ISC_ISCIPV6_O="unix/ipv6.$O" + ISC_IPV6_C="ipv6.c" + ;; +esac - echo "$as_me:$LINENO: checking for sockaddr_storage" >&5 +echo "$as_me:$LINENO: checking for sockaddr_storage" >&5 echo $ECHO_N "checking for sockaddr_storage... $ECHO_C" >&6 - cat >conftest.$ac_ext <<_ACEOF +cat >conftest.$ac_ext <<_ACEOF /* confdefs.h. */ _ACEOF cat confdefs.h >>conftest.$ac_ext @@ -23486,8 +23758,6 @@ cat >>conftest.$ac_ext <<_ACEOF #include <sys/types.h> #include <sys/socket.h> #include <netinet/in.h> -$isc_netinetin6_hack -$isc_netinet6in6_hack int main () @@ -23521,29 +23791,16 @@ if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5 (exit $ac_status); }; }; then echo "$as_me:$LINENO: result: yes" >&5 echo "${ECHO_T}yes" >&6 - HAVE_SOCKADDR_STORAGE="#define HAVE_SOCKADDR_STORAGE 1" + HAVE_SOCKADDR_STORAGE="#define HAVE_SOCKADDR_STORAGE 1" else echo "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 echo "$as_me:$LINENO: result: no" >&5 echo "${ECHO_T}no" >&6 - HAVE_SOCKADDR_STORAGE="#undef HAVE_SOCKADDR_STORAGE" + HAVE_SOCKADDR_STORAGE="#undef HAVE_SOCKADDR_STORAGE" fi rm -f conftest.err conftest.$ac_objext conftest.$ac_ext - ;; - no) - HAS_INET6_STRUCTS="#undef HAS_INET6_STRUCTS" - NEED_IN6ADDR_ANY="#undef NEED_IN6ADDR_ANY" - ISC_PLATFORM_HAVEIN6PKTINFO="#undef ISC_PLATFORM_HAVEIN6PKTINFO" - HAVE_SIN6_SCOPE_ID="#define HAVE_SIN6_SCOPE_ID 1" - HAVE_SOCKADDR_STORAGE="#undef HAVE_SOCKADDR_STORAGE" - ISC_IPV6_H="ipv6.h" - ISC_IPV6_O="ipv6.$O" - ISC_ISCIPV6_O="unix/ipv6.$O" - ISC_IPV6_C="ipv6.c" - ;; -esac @@ -24022,6 +24279,61 @@ fi rm -f conftest.err conftest.$ac_objext conftest.$ac_ext +echo "$as_me:$LINENO: checking for struct timespec" >&5 +echo $ECHO_N "checking for struct timespec... $ECHO_C" >&6 +cat >conftest.$ac_ext <<_ACEOF +/* confdefs.h. */ +_ACEOF +cat confdefs.h >>conftest.$ac_ext +cat >>conftest.$ac_ext <<_ACEOF +/* end confdefs.h. */ + +#include <sys/types.h> +#include <time.h> +int +main () +{ +struct timespec ts = { 0, 0 }; return (0); + ; + return 0; +} +_ACEOF +rm -f conftest.$ac_objext +if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5 + (eval $ac_compile) 2>conftest.er1 + ac_status=$? + grep -v '^ *+' conftest.er1 >conftest.err + rm -f conftest.er1 + cat conftest.err >&5 + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); } && + { ac_try='test -z "$ac_c_werror_flag" + || test ! -s conftest.err' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; } && + { ac_try='test -s conftest.$ac_objext' + { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5 + (eval $ac_try) 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); }; }; then + echo "$as_me:$LINENO: result: yes" >&5 +echo "${ECHO_T}yes" >&6 + ISC_PLATFORM_NEEDTIMESPEC="#undef ISC_PLATFORM_NEEDTIMESPEC" +else + echo "$as_me: failed program was:" >&5 +sed 's/^/| /' conftest.$ac_ext >&5 + +echo "$as_me:$LINENO: result: no" >&5 +echo "${ECHO_T}no" >&6 + ISC_PLATFORM_NEEDTIMESPEC="#define ISC_PLATFORM_NEEDTIMESPEC 1" +fi +rm -f conftest.err conftest.$ac_objext conftest.$ac_ext + + # # Check for addrinfo # @@ -32893,6 +33205,7 @@ s,@SOLARIS2@,$SOLARIS2,;t t s,@PORT_INCLUDE@,$PORT_INCLUDE,;t t s,@ISC_PLATFORM_MSGHDRFLAVOR@,$ISC_PLATFORM_MSGHDRFLAVOR,;t t s,@ISC_PLATFORM_NEEDPORTT@,$ISC_PLATFORM_NEEDPORTT,;t t +s,@ISC_PLATFORM_NEEDTIMESPEC@,$ISC_PLATFORM_NEEDTIMESPEC,;t t s,@ISC_LWRES_ENDHOSTENTINT@,$ISC_LWRES_ENDHOSTENTINT,;t t s,@ISC_LWRES_SETNETENTINT@,$ISC_LWRES_SETNETENTINT,;t t s,@ISC_LWRES_ENDNETENTINT@,$ISC_LWRES_ENDNETENTINT,;t t diff --git a/contrib/bind9/lib/bind/configure.in b/contrib/bind9/lib/bind/configure.in index 3431818..82bea78 100644 --- a/contrib/bind9/lib/bind/configure.in +++ b/contrib/bind9/lib/bind/configure.in @@ -1,7 +1,7 @@ # Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 2001, 2003 Internet Software Consortium. # -# Permission to use, copy, modify, and distribute this software for any +# Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above # copyright notice and this permission notice appear in all copies. # @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -AC_REVISION($Revision: 1.90.18.31 $) +AC_REVISION($Revision: 1.90.18.34 $) AC_INIT(resolv/herror.c) AC_PREREQ(2.13) @@ -174,6 +174,7 @@ AC_CHECK_HEADERS(fcntl.h db.h paths.h sys/time.h unistd.h sys/sockio.h sys/selec AC_C_CONST AC_C_INLINE AC_TYPE_SIZE_T +AC_CHECK_TYPE(ssize_t,signed) AC_CHECK_TYPE(uintptr_t,unsigned long) AC_HEADER_TIME # @@ -458,6 +459,8 @@ AC_SUBST(WANT_IRS_THREADS_OBJS) AC_SUBST(WANT_THREADS_OBJS) AC_CHECK_FUNC(strlcat, AC_DEFINE(HAVE_STRLCAT)) +AC_CHECK_FUNC(memmove, AC_DEFINE(HAVE_MEMMOVE)) +AC_CHECK_FUNC(memchr, AC_DEFINE(HAVE_MEMCHR)) AC_CHECK_FUNC(if_nametoindex, [USE_IFNAMELINKID="#define USE_IFNAMELINKID 1"], @@ -879,27 +882,12 @@ $isc_netinet6in6_hack ISC_PLATFORM_HAVEIN6PKTINFO="#define ISC_PLATFORM_HAVEIN6PKTINFO 1"], [AC_MSG_RESULT(no -- disabling runtime ipv6 support) ISC_PLATFORM_HAVEIN6PKTINFO="#undef ISC_PLATFORM_HAVEIN6PKTINFO"]) - - AC_MSG_CHECKING(for sockaddr_storage) - AC_TRY_COMPILE([ -#include <sys/types.h> -#include <sys/socket.h> -#include <netinet/in.h> -$isc_netinetin6_hack -$isc_netinet6in6_hack -], - [struct sockaddr_storage xyzzy; return (0);], - [AC_MSG_RESULT(yes) - HAVE_SOCKADDR_STORAGE="#define HAVE_SOCKADDR_STORAGE 1"], - [AC_MSG_RESULT(no) - HAVE_SOCKADDR_STORAGE="#undef HAVE_SOCKADDR_STORAGE"]) ;; no) HAS_INET6_STRUCTS="#undef HAS_INET6_STRUCTS" NEED_IN6ADDR_ANY="#undef NEED_IN6ADDR_ANY" ISC_PLATFORM_HAVEIN6PKTINFO="#undef ISC_PLATFORM_HAVEIN6PKTINFO" HAVE_SIN6_SCOPE_ID="#define HAVE_SIN6_SCOPE_ID 1" - HAVE_SOCKADDR_STORAGE="#undef HAVE_SOCKADDR_STORAGE" ISC_IPV6_H="ipv6.h" ISC_IPV6_O="ipv6.$O" ISC_ISCIPV6_O="unix/ipv6.$O" @@ -907,6 +895,18 @@ $isc_netinet6in6_hack ;; esac +AC_MSG_CHECKING(for sockaddr_storage) +AC_TRY_COMPILE([ +#include <sys/types.h> +#include <sys/socket.h> +#include <netinet/in.h> +], +[struct sockaddr_storage xyzzy; return (0);], + [AC_MSG_RESULT(yes) + HAVE_SOCKADDR_STORAGE="#define HAVE_SOCKADDR_STORAGE 1"], + [AC_MSG_RESULT(no) + HAVE_SOCKADDR_STORAGE="#undef HAVE_SOCKADDR_STORAGE"]) + AC_SUBST(HAS_INET6_STRUCTS) AC_SUBST(ISC_PLATFORM_NEEDNETINETIN6H) AC_SUBST(ISC_PLATFORM_NEEDNETINET6IN6H) @@ -1117,6 +1117,17 @@ AC_TRY_COMPILE([ ISC_PLATFORM_NEEDPORTT="#define ISC_PLATFORM_NEEDPORTT 1"]) AC_SUBST(ISC_PLATFORM_NEEDPORTT) +AC_MSG_CHECKING(for struct timespec) +AC_TRY_COMPILE([ +#include <sys/types.h> +#include <time.h>], +[struct timespec ts = { 0, 0 }; return (0);], + [AC_MSG_RESULT(yes) + ISC_PLATFORM_NEEDTIMESPEC="#undef ISC_PLATFORM_NEEDTIMESPEC"], + [AC_MSG_RESULT(no) + ISC_PLATFORM_NEEDTIMESPEC="#define ISC_PLATFORM_NEEDTIMESPEC 1"]) +AC_SUBST(ISC_PLATFORM_NEEDTIMESPEC) + # # Check for addrinfo # diff --git a/contrib/bind9/lib/bind/dst/dst_api.c b/contrib/bind9/lib/bind/dst/dst_api.c index bc730dc..a622ae3 100644 --- a/contrib/bind9/lib/bind/dst/dst_api.c +++ b/contrib/bind9/lib/bind/dst/dst_api.c @@ -1,5 +1,5 @@ #ifndef LINT -static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/dst_api.c,v 1.10.332.5 2006/03/10 00:20:08 marka Exp $"; +static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/dst_api.c,v 1.10.332.7 2007/09/26 04:41:47 each Exp $"; #endif /* @@ -359,7 +359,7 @@ dst_read_key(const char *in_keyname, const u_int16_t in_id, pubkey->dk_alg) == 0) dg_key = dst_free_key(dg_key); - pubkey = dst_free_key(pubkey); + (void)dst_free_key(pubkey); return (dg_key); } @@ -434,6 +434,7 @@ dst_s_write_private_key(const DST_KEY *key) if ((nn = fwrite(encoded_block, 1, len, fp)) != len) { EREPORT(("dst_write_private_key(): Write failure on %s %d != %d errno=%d\n", file, len, nn, errno)); + fclose(fp); return (-5); } fclose(fp); diff --git a/contrib/bind9/lib/bind/dst/hmac_link.c b/contrib/bind9/lib/bind/dst/hmac_link.c index d4f0a2a..b97a996 100644 --- a/contrib/bind9/lib/bind/dst/hmac_link.c +++ b/contrib/bind9/lib/bind/dst/hmac_link.c @@ -1,6 +1,6 @@ #ifdef HMAC_MD5 #ifndef LINT -static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/hmac_link.c,v 1.3.164.3 2006/03/10 00:20:08 marka Exp $"; +static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/hmac_link.c,v 1.3.164.5 2007/09/26 04:41:47 each Exp $"; #endif /* * Portions Copyright (c) 1995-1998 by Trusted Information Systems, Inc. @@ -223,6 +223,7 @@ dst_buffer_to_hmac_md5(DST_KEY *dkey, const u_char *key, const int keylen) HMAC_Key *hkey = NULL; MD5_CTX ctx; int local_keylen = keylen; + u_char tk[MD5_LEN]; if (dkey == NULL || key == NULL || keylen < 0) return (-1); @@ -235,7 +236,6 @@ dst_buffer_to_hmac_md5(DST_KEY *dkey, const u_char *key, const int keylen) /* if key is longer than HMAC_LEN bytes reset it to key=MD5(key) */ if (keylen > HMAC_LEN) { - u_char tk[MD5_LEN]; MD5Init(&ctx); MD5Update(&ctx, key, keylen); MD5Final(tk, &ctx); @@ -276,13 +276,18 @@ dst_hmac_md5_key_to_file_format(const DST_KEY *dkey, char *buff, const int buff_len) { char *bp; - int len, b_len, i, key_len; + int len, i, key_len; u_char key[HMAC_LEN]; HMAC_Key *hkey; if (dkey == NULL || dkey->dk_KEY_struct == NULL) return (0); - if (buff == NULL || buff_len <= (int) strlen(key_file_fmt_str)) + /* + * Using snprintf() would be so much simpler here. + */ + if (buff == NULL || + buff_len <= (int)(strlen(key_file_fmt_str) + + strlen(KEY_FILE_FORMAT) + 4)) return (-1); /*%< no OR not enough space in output area */ hkey = (HMAC_Key *) dkey->dk_KEY_struct; memset(buff, 0, buff_len); /*%< just in case */ @@ -290,7 +295,6 @@ dst_hmac_md5_key_to_file_format(const DST_KEY *dkey, char *buff, sprintf(buff, key_file_fmt_str, KEY_FILE_FORMAT, KEY_HMAC_MD5, "HMAC"); bp = buff + strlen(buff); - b_len = buff_len - (bp - buff); memset(key, 0, HMAC_LEN); for (i = 0; i < HMAC_LEN; i++) @@ -300,19 +304,21 @@ dst_hmac_md5_key_to_file_format(const DST_KEY *dkey, char *buff, break; key_len = i + 1; + if (buff_len - (bp - buff) < 6) + return (-1); strcat(bp, "Key: "); bp += strlen("Key: "); - b_len = buff_len - (bp - buff); - len = b64_ntop(key, key_len, bp, b_len); + len = b64_ntop(key, key_len, bp, buff_len - (bp - buff)); if (len < 0) return (-1); bp += len; + if (buff_len - (bp - buff) < 2) + return (-1); *(bp++) = '\n'; *bp = '\0'; - b_len = buff_len - (bp - buff); - return (buff_len - b_len); + return (bp - buff); } diff --git a/contrib/bind9/lib/bind/irs/gai_strerror.c b/contrib/bind9/lib/bind/irs/gai_strerror.c index 29196a0..9ca1c4b 100644 --- a/contrib/bind9/lib/bind/irs/gai_strerror.c +++ b/contrib/bind9/lib/bind/irs/gai_strerror.c @@ -68,8 +68,10 @@ gai_strerror(int ecode) { if (pthread_mutex_lock(&lock) != 0) goto unknown; if (!once) { - if (pthread_key_create(&key, free) != 0) + if (pthread_key_create(&key, free) != 0) { + (void)pthread_mutex_unlock(&lock); goto unknown; + } once = 1; } if (pthread_mutex_unlock(&lock) != 0) diff --git a/contrib/bind9/lib/bind/irs/irs_data.c b/contrib/bind9/lib/bind/irs/irs_data.c index b71bc33..ed94614 100644 --- a/contrib/bind9/lib/bind/irs/irs_data.c +++ b/contrib/bind9/lib/bind/irs/irs_data.c @@ -16,7 +16,7 @@ */ #if !defined(LINT) && !defined(CODECENTER) -static const char rcsid[] = "$Id: irs_data.c,v 1.7.18.3 2006/03/10 00:20:08 marka Exp $"; +static const char rcsid[] = "$Id: irs_data.c,v 1.7.18.5 2007/08/27 03:34:24 marka Exp $"; #endif #include "port_before.h" @@ -132,8 +132,10 @@ net_data_init(const char *conf_file) { if (pthread_mutex_lock(&keylock) != 0) return (NULL); if (!once) { - if (pthread_key_create(&key, net_data_destroy) != 0) + if (pthread_key_create(&key, net_data_destroy) != 0) { + (void)pthread_mutex_unlock(&keylock); return (NULL); + } once = 1; } if (pthread_mutex_unlock(&keylock) != 0) diff --git a/contrib/bind9/lib/bind/isc/ctl_clnt.c b/contrib/bind9/lib/bind/isc/ctl_clnt.c index 7dcf1be..eca8e7f 100644 --- a/contrib/bind9/lib/bind/isc/ctl_clnt.c +++ b/contrib/bind9/lib/bind/isc/ctl_clnt.c @@ -1,5 +1,5 @@ #if !defined(lint) && !defined(SABER) -static const char rcsid[] = "$Id: ctl_clnt.c,v 1.7.18.1 2005/04/27 05:01:05 sra Exp $"; +static const char rcsid[] = "$Id: ctl_clnt.c,v 1.7.18.2 2007/05/18 06:24:39 marka Exp $"; #endif /* not lint */ /* @@ -114,6 +114,19 @@ static void touch_timer(struct ctl_cctx *); static void timer(evContext, void *, struct timespec, struct timespec); +#ifndef HAVE_MEMCHR +static void * +memchr(const void *b, int c, size_t len) { + const unsigned char *p = b; + size_t i; + + for (i = 0; i < len; i++, p++) + if (*p == (unsigned char)c) + return ((void *)p); + return (NULL); +} +#endif + /* Private data. */ static const char * const state_names[] = { diff --git a/contrib/bind9/lib/bind/make/rules.in b/contrib/bind9/lib/bind/make/rules.in index 888e6ad..5033b15 100644 --- a/contrib/bind9/lib/bind/make/rules.in +++ b/contrib/bind9/lib/bind/make/rules.in @@ -1,7 +1,7 @@ # Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 2001, 2002 Internet Software Consortium. # -# Permission to use, copy, modify, and distribute this software for any +# Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above # copyright notice and this permission notice appear in all copies. # @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: rules.in,v 1.9.18.3 2007/01/18 00:06:11 marka Exp $ +# $Id: rules.in,v 1.9.18.4 2007/08/28 07:20:04 tbox Exp $ ### ### Common Makefile rules for BIND 9. diff --git a/contrib/bind9/lib/bind/nameser/ns_parse.c b/contrib/bind9/lib/bind/nameser/ns_parse.c index 5e7998d..c4658d8 100644 --- a/contrib/bind9/lib/bind/nameser/ns_parse.c +++ b/contrib/bind9/lib/bind/nameser/ns_parse.c @@ -16,7 +16,7 @@ */ #ifndef lint -static const char rcsid[] = "$Id: ns_parse.c,v 1.5.18.3 2005/10/11 00:25:10 marka Exp $"; +static const char rcsid[] = "$Id: ns_parse.c,v 1.5.18.4 2007/08/27 03:34:24 marka Exp $"; #endif /* Import. */ @@ -40,7 +40,7 @@ static void setsection(ns_msg *msg, ns_sect sect); /* Macros. */ -#ifndef SOLARIS2 +#if !defined(SOLARIS2) || defined(__COVERITY__) #define RETERR(err) do { errno = (err); return (-1); } while (0) #else #define RETERR(err) \ diff --git a/contrib/bind9/lib/bind/port_before.h.in b/contrib/bind9/lib/bind/port_before.h.in index 79cf277..1f6ff1a 100644 --- a/contrib/bind9/lib/bind/port_before.h.in +++ b/contrib/bind9/lib/bind/port_before.h.in @@ -12,6 +12,16 @@ struct timezone; /* silence warning */ #endif #include <limits.h> +#ifdef ISC_PLATFORM_NEEDTIMESPEC +#include <time.h> /* For time_t */ +struct timespec { + time_t tv_sec; /* seconds */ + long tv_nsec; /* nanoseconds */ +}; +#endif +#ifndef HAVE_MEMMOVE +#define memmove(a,b,c) bcopy(b,a,c) +#endif @WANT_IRS_GR@ @WANT_IRS_NIS@ diff --git a/contrib/bind9/lib/bind/resolv/res_data.c b/contrib/bind9/lib/bind/resolv/res_data.c index e3dcbf0..736315c 100644 --- a/contrib/bind9/lib/bind/resolv/res_data.c +++ b/contrib/bind9/lib/bind/resolv/res_data.c @@ -16,7 +16,7 @@ */ #if defined(LIBC_SCCS) && !defined(lint) -static const char rcsid[] = "$Id: res_data.c,v 1.3.18.1 2005/04/27 05:01:10 sra Exp $"; +static const char rcsid[] = "$Id: res_data.c,v 1.3.18.2 2007/09/14 05:35:47 marka Exp $"; #endif /* LIBC_SCCS and not lint */ #include "port_before.h" @@ -40,7 +40,6 @@ static const char rcsid[] = "$Id: res_data.c,v 1.3.18.1 2005/04/27 05:01:10 sra #include <unistd.h> #include "port_after.h" -#undef _res const char *_res_opcodes[] = { "QUERY", @@ -70,6 +69,7 @@ const char *_res_sectioncodes[] = { }; #endif +#undef _res #ifndef __BIND_NOSTATIC struct __res_state _res # if defined(__BIND_RES_TEXT) @@ -77,6 +77,10 @@ struct __res_state _res # endif ; +#if defined(DO_PTHREADS) || defined(__linux) +#define _res (*__res_state()) +#endif + /* Proto. */ int res_ourserver_p(const res_state, const struct sockaddr_in *); diff --git a/contrib/bind9/lib/bind/resolv/res_init.c b/contrib/bind9/lib/bind/resolv/res_init.c index 013a3ca..f580b9c 100644 --- a/contrib/bind9/lib/bind/resolv/res_init.c +++ b/contrib/bind9/lib/bind/resolv/res_init.c @@ -70,7 +70,7 @@ #if defined(LIBC_SCCS) && !defined(lint) static const char sccsid[] = "@(#)res_init.c 8.1 (Berkeley) 6/7/93"; -static const char rcsid[] = "$Id: res_init.c,v 1.16.18.5 2006/08/30 23:23:13 marka Exp $"; +static const char rcsid[] = "$Id: res_init.c,v 1.16.18.7 2007/07/09 01:52:58 marka Exp $"; #endif /* LIBC_SCCS and not lint */ #include "port_before.h" @@ -166,7 +166,9 @@ __res_vinit(res_state statp, int preinit) { #endif int dots; union res_sockaddr_union u[2]; + int maxns = MAXNS; + RES_SET_H_ERRNO(statp, 0); if (statp->_u._ext.ext != NULL) res_ndestroy(statp); @@ -216,8 +218,22 @@ __res_vinit(res_state statp, int preinit) { statp->_u._ext.ext->nsaddrs[0].sin = statp->nsaddr; strcpy(statp->_u._ext.ext->nsuffix, "ip6.arpa"); strcpy(statp->_u._ext.ext->nsuffix2, "ip6.int"); - } else - return (-1); + } else { + /* + * Historically res_init() rarely, if at all, failed. + * Examples and applications exist which do not check + * our return code. Furthermore several applications + * simply call us to get the systems domainname. So + * rather then immediately fail here we store the + * failure, which is returned later, in h_errno. And + * prevent the collection of 'nameserver' information + * by setting maxns to 0. Thus applications that fail + * to check our return code wont be able to make + * queries anyhow. + */ + RES_SET_H_ERRNO(statp, NETDB_INTERNAL); + maxns = 0; + } #ifdef RESOLVSORT statp->nsort = 0; #endif @@ -238,9 +254,9 @@ __res_vinit(res_state statp, int preinit) { buf[0] = '.'; cp = strchr(buf, '.'); cp = (cp == NULL) ? buf : (cp + 1); - if (strlen(cp) >= sizeof(statp->defdname)) - goto freedata; - strcpy(statp->defdname, cp); + strncpy(statp->defdname, cp, + sizeof(statp->defdname) - 1); + statp->defdname[sizeof(statp->defdname) - 1] = '\0'; } } #endif /* SOLARIS2 */ @@ -346,7 +362,7 @@ __res_vinit(res_state statp, int preinit) { continue; } /* read nameservers to query */ - if (MATCH(buf, "nameserver") && nserv < MAXNS) { + if (MATCH(buf, "nameserver") && nserv < maxns) { struct addrinfo hints, *ai; char sbuf[NI_MAXSERV]; const size_t minsiz = @@ -482,16 +498,7 @@ __res_vinit(res_state statp, int preinit) { if ((cp = getenv("RES_OPTIONS")) != NULL) res_setoptions(statp, cp, "env"); statp->options |= RES_INIT; - return (0); - -#ifdef SOLARIS2 - freedata: - if (statp->_u._ext.ext != NULL) { - free(statp->_u._ext.ext); - statp->_u._ext.ext = NULL; - } - return (-1); -#endif + return (statp->res_h_errno); } static void diff --git a/contrib/bind9/lib/bind9/api b/contrib/bind9/lib/bind9/api index aba393a..93632d1 100644 --- a/contrib/bind9/lib/bind9/api +++ b/contrib/bind9/lib/bind9/api @@ -1,3 +1,3 @@ -LIBINTERFACE = 30 -LIBREVISION = 3 -LIBAGE = 0 +LIBINTERFACE = 31 +LIBREVISION = 0 +LIBAGE = 1 diff --git a/contrib/bind9/lib/bind9/check.c b/contrib/bind9/lib/bind9/check.c index 3144e65..6cfdc93 100644 --- a/contrib/bind9/lib/bind9/check.c +++ b/contrib/bind9/lib/bind9/check.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2001-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,14 +15,13 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: check.c,v 1.44.18.31 2006/08/21 00:09:52 marka Exp $ */ +/* $Id: check.c,v 1.44.18.35 2007/09/13 05:04:01 each Exp $ */ /*! \file */ #include <config.h> #include <stdlib.h> -#include <string.h> #include <isc/buffer.h> #include <isc/log.h> @@ -32,6 +31,7 @@ #include <isc/region.h> #include <isc/result.h> #include <isc/sockaddr.h> +#include <isc/string.h> #include <isc/symtab.h> #include <isc/util.h> @@ -46,6 +46,10 @@ #include <bind9/check.h> +#ifndef DNS_RDATASET_FIXED +#define DNS_RDATASET_FIXED 1 +#endif + static void freekey(char *key, unsigned int type, isc_symvalue_t value, void *userarg) { UNUSED(type); @@ -121,8 +125,12 @@ check_orderent(const cfg_obj_t *ent, isc_log_t *logctx) { cfg_obj_log(ent, logctx, ISC_LOG_ERROR, "rrset-order: missing ordering"); result = ISC_R_FAILURE; - } else if (strcasecmp(cfg_obj_asstring(obj), "fixed") != 0 && - strcasecmp(cfg_obj_asstring(obj), "random") != 0 && + } else if (strcasecmp(cfg_obj_asstring(obj), "fixed") == 0) { +#if !DNS_RDATASET_FIXED + cfg_obj_log(obj, logctx, ISC_LOG_WARNING, + "rrset-order: order 'fixed' not fully implemented"); +#endif + } else if (strcasecmp(cfg_obj_asstring(obj), "random") != 0 && strcasecmp(cfg_obj_asstring(obj), "cyclic") != 0) { cfg_obj_log(obj, logctx, ISC_LOG_ERROR, "rrset-order: invalid order '%s'", diff --git a/contrib/bind9/lib/dns/adb.c b/contrib/bind9/lib/dns/adb.c index 714df96..c65c474 100644 --- a/contrib/bind9/lib/dns/adb.c +++ b/contrib/bind9/lib/dns/adb.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: adb.c,v 1.215.18.13 2006/08/30 23:49:57 marka Exp $ */ +/* $Id: adb.c,v 1.215.18.17 2007/09/11 02:23:26 marka Exp $ */ /*! \file * @@ -2987,7 +2987,7 @@ dbfind_name(dns_adbname_t *adbname, isc_stdtime_t now, dns_rdatatype_t rdtype) adbname->fetch6_err = FIND_ERR_UNEXPECTED; result = dns_view_find(adb->view, &adbname->name, rdtype, now, - NAME_GLUEOK(adbname), + NAME_GLUEOK(adbname) ? DNS_DBFIND_GLUEOK : 0, ISC_TF(NAME_HINTOK(adbname)), NULL, NULL, fname, &rdataset, NULL); @@ -3471,7 +3471,9 @@ dns_adb_findaddrinfo(dns_adb_t *adb, isc_sockaddr_t *sa, port = isc_sockaddr_getport(sa); addr = new_adbaddrinfo(adb, entry, port); - if (addr != NULL) { + if (addr == NULL) { + result = ISC_R_NOMEMORY; + } else { inc_entry_refcnt(adb, entry, ISC_FALSE); *addrp = addr; } diff --git a/contrib/bind9/lib/dns/api b/contrib/bind9/lib/dns/api index 5798ebc..f830d6c 100644 --- a/contrib/bind9/lib/dns/api +++ b/contrib/bind9/lib/dns/api @@ -1,3 +1,3 @@ -LIBINTERFACE = 33 -LIBREVISION = 1 -LIBAGE = 1 +LIBINTERFACE = 34 +LIBREVISION = 2 +LIBAGE = 2 diff --git a/contrib/bind9/lib/dns/dispatch.c b/contrib/bind9/lib/dns/dispatch.c index bad6ff0..f3ef091 100644 --- a/contrib/bind9/lib/dns/dispatch.c +++ b/contrib/bind9/lib/dns/dispatch.c @@ -2,7 +2,7 @@ * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dispatch.c,v 1.116.18.13.10.4 2007/06/27 04:17:45 marka Exp $ */ +/* $Id: dispatch.c,v 1.116.18.19 2007/08/28 07:20:04 tbox Exp $ */ /*! \file */ @@ -1615,8 +1615,10 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, isc_socket_t *sock, DNS_EVENT_DISPATCHCONTROL, destroy_disp, disp, sizeof(isc_event_t)); - if (disp->ctlevent == NULL) + if (disp->ctlevent == NULL) { + result = ISC_R_NOMEMORY; goto kill_task; + } isc_task_setname(disp->task, "tcpdispatch", disp); @@ -1797,8 +1799,10 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr, DNS_EVENT_DISPATCHCONTROL, destroy_disp, disp, sizeof(isc_event_t)); - if (disp->ctlevent == NULL) + if (disp->ctlevent == NULL) { + result = ISC_R_NOMEMORY; goto kill_task; + } isc_task_setname(disp->task, "udpdispatch", disp); diff --git a/contrib/bind9/lib/dns/dnssec.c b/contrib/bind9/lib/dns/dnssec.c index c0339a1..75ca440 100644 --- a/contrib/bind9/lib/dns/dnssec.c +++ b/contrib/bind9/lib/dns/dnssec.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -16,7 +16,7 @@ */ /* - * $Id: dnssec.c,v 1.81.18.6 2006/03/07 00:34:53 marka Exp $ + * $Id: dnssec.c,v 1.81.18.10 2007/09/14 04:35:42 marka Exp $ */ /*! \file */ @@ -406,16 +406,11 @@ dns_dnssec_verify2(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key, */ dns_fixedname_init(&fnewname); labels = dns_name_countlabels(name) - 1; - if (labels - sig.labels > 0) { - dns_name_split(name, sig.labels + 1, NULL, - dns_fixedname_name(&fnewname)); - RUNTIME_CHECK(dns_name_downcase(dns_fixedname_name(&fnewname), - dns_fixedname_name(&fnewname), - NULL) - == ISC_R_SUCCESS); - } - else - dns_name_downcase(name, dns_fixedname_name(&fnewname), NULL); + RUNTIME_CHECK(dns_name_downcase(name, dns_fixedname_name(&fnewname), + NULL) == ISC_R_SUCCESS); + if (labels - sig.labels > 0) + dns_name_split(dns_fixedname_name(&fnewname), sig.labels + 1, + NULL, dns_fixedname_name(&fnewname)); dns_name_toregion(dns_fixedname_name(&fnewname), &r); @@ -531,6 +526,9 @@ dns_dnssec_findzonekeys2(dns_db_t *db, dns_dbversion_t *ver, dst_key_t *pubkey = NULL; unsigned int count = 0; + REQUIRE(nkeys != NULL); + REQUIRE(keys != NULL); + *nkeys = 0; dns_rdataset_init(&rdataset); RETERR(dns_db_findrdataset(db, node, ver, dns_rdatatype_dnskey, 0, 0, @@ -540,7 +538,8 @@ dns_dnssec_findzonekeys2(dns_db_t *db, dns_dbversion_t *ver, pubkey = NULL; dns_rdataset_current(&rdataset, &rdata); RETERR(dns_dnssec_keyfromrdata(name, &rdata, mctx, &pubkey)); - if (!is_zone_key(pubkey)) + if (!is_zone_key(pubkey) || + (dst_key_flags(pubkey) & DNS_KEYTYPE_NOAUTH) != 0) goto next; keys[count] = NULL; result = dst_key_fromfile(dst_key_name(pubkey), @@ -549,17 +548,23 @@ dns_dnssec_findzonekeys2(dns_db_t *db, dns_dbversion_t *ver, DST_TYPE_PUBLIC|DST_TYPE_PRIVATE, directory, mctx, &keys[count]); - if (result == ISC_R_FILENOTFOUND) + if (result == ISC_R_FILENOTFOUND) { + keys[count] = pubkey; + pubkey = NULL; + count++; goto next; + } if (result != ISC_R_SUCCESS) goto failure; if ((dst_key_flags(keys[count]) & DNS_KEYTYPE_NOAUTH) != 0) { + /* We should never get here. */ dst_key_free(&keys[count]); goto next; } count++; next: - dst_key_free(&pubkey); + if (pubkey != NULL) + dst_key_free(&pubkey); dns_rdata_reset(&rdata); result = dns_rdataset_next(&rdataset); } @@ -575,6 +580,9 @@ dns_dnssec_findzonekeys2(dns_db_t *db, dns_dbversion_t *ver, dns_rdataset_disassociate(&rdataset); if (pubkey != NULL) dst_key_free(&pubkey); + if (result != ISC_R_SUCCESS) + while (count > 0) + dst_key_free(&keys[--count]); *nkeys = count; return (result); } diff --git a/contrib/bind9/lib/dns/include/dns/db.h b/contrib/bind9/lib/dns/include/dns/db.h index a791a2e..b03ae57 100644 --- a/contrib/bind9/lib/dns/include/dns/db.h +++ b/contrib/bind9/lib/dns/include/dns/db.h @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: db.h,v 1.76.18.7 2005/10/13 02:12:25 marka Exp $ */ +/* $Id: db.h,v 1.76.18.10 2007/08/28 07:20:05 tbox Exp $ */ #ifndef DNS_DB_H #define DNS_DB_H 1 @@ -860,7 +860,7 @@ dns_db_attachnode(dns_db_t *db, dns_dbnode_t *source, dns_dbnode_t **targetp); * * \li 'source' is a valid node. * - * \li 'targetp' points to a NULL dns_node_t *. + * \li 'targetp' points to a NULL dns_dbnode_t *. * * Ensures: * diff --git a/contrib/bind9/lib/dns/include/dns/dispatch.h b/contrib/bind9/lib/dns/include/dns/dispatch.h index b9e9612..3938f94 100644 --- a/contrib/bind9/lib/dns/include/dns/dispatch.h +++ b/contrib/bind9/lib/dns/include/dns/dispatch.h @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dispatch.h,v 1.48.18.2.22.1 2007/06/26 02:58:54 marka Exp $ */ +/* $Id: dispatch.h,v 1.48.18.5 2007/08/28 07:20:05 tbox Exp $ */ #ifndef DNS_DISPATCH_H #define DNS_DISPATCH_H 1 diff --git a/contrib/bind9/lib/dns/include/dns/validator.h b/contrib/bind9/lib/dns/include/dns/validator.h index acce76e..c94fc3a 100644 --- a/contrib/bind9/lib/dns/include/dns/validator.h +++ b/contrib/bind9/lib/dns/include/dns/validator.h @@ -2,7 +2,7 @@ * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: validator.h,v 1.27.18.8 2007/01/08 02:42:00 marka Exp $ */ +/* $Id: validator.h,v 1.27.18.10 2007/09/26 04:39:45 each Exp $ */ #ifndef DNS_VALIDATOR_H #define DNS_VALIDATOR_H 1 @@ -81,11 +81,24 @@ typedef struct dns_validatorevent { ISC_EVENT_COMMON(struct dns_validatorevent); dns_validator_t * validator; isc_result_t result; + /* + * Name and type of the response to be validated. + */ dns_name_t * name; dns_rdatatype_t type; + /* + * Rdata and RRSIG (if any) for positive responses. + */ dns_rdataset_t * rdataset; dns_rdataset_t * sigrdataset; + /* + * The full response. Required for negative responses. + * Also required for positive wildcard responses. + */ dns_message_t * message; + /* + * Proofs to be cached. + */ dns_name_t * proofs[3]; } dns_validatorevent_t; diff --git a/contrib/bind9/lib/dns/journal.c b/contrib/bind9/lib/dns/journal.c index 1f208c8..6cfb5af 100644 --- a/contrib/bind9/lib/dns/journal.c +++ b/contrib/bind9/lib/dns/journal.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2002 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,12 +15,13 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: journal.c,v 1.86.18.8 2005/11/03 23:02:23 marka Exp $ */ +/* $Id: journal.c,v 1.86.18.12 2007/09/07 05:21:41 marka Exp $ */ #include <config.h> #include <stdlib.h> #include <unistd.h> +#include <errno.h> #include <isc/file.h> #include <isc/mem.h> @@ -670,7 +671,23 @@ journal_open(isc_mem_t *mctx, const char *filename, isc_boolean_t write, isc_result_t dns_journal_open(isc_mem_t *mctx, const char *filename, isc_boolean_t write, dns_journal_t **journalp) { - return (journal_open(mctx, filename, write, write, journalp)); + isc_result_t result; + int namelen; + char backup[1024]; + + result = journal_open(mctx, filename, write, write, journalp); + if (result == ISC_R_NOTFOUND) { + namelen = strlen(filename); + if (namelen > 4 && strcmp(filename + namelen - 4, ".jnl") == 0) + namelen -= 4; + + result = isc_string_printf(backup, sizeof(backup), "%.*s.jbk", + namelen, filename); + if (result != ISC_R_SUCCESS) + return (result); + result = journal_open(mctx, backup, write, write, journalp); + } + return (result); } /* @@ -1612,6 +1629,8 @@ read_one_rr(dns_journal_t *j) { /* * Parse the rdata. */ + if (isc_buffer_remaininglength(&j->it.source) != rdlen) + FAIL(DNS_R_FORMERR); isc_buffer_setactive(&j->it.source, rdlen); dns_rdata_reset(&j->it.rdata); CHECK(dns_rdata_fromwire(&j->it.rdata, rdclass, @@ -1927,15 +1946,39 @@ dns_journal_compact(isc_mem_t *mctx, char *filename, isc_uint32_t serial, journal_pos_t best_guess; journal_pos_t current_pos; dns_journal_t *j = NULL; + dns_journal_t *new = NULL; journal_rawheader_t rawheader; unsigned int copy_length; - unsigned int len; + int namelen; char *buf = NULL; unsigned int size = 0; isc_result_t result; unsigned int indexend; + char newname[1024]; + char backup[1024]; + isc_boolean_t is_backup = ISC_FALSE; + + namelen = strlen(filename); + if (namelen > 4 && strcmp(filename + namelen - 4, ".jnl") == 0) + namelen -= 4; + + result = isc_string_printf(newname, sizeof(newname), "%.*s.jnw", + namelen, filename); + if (result != ISC_R_SUCCESS) + return (result); + + result = isc_string_printf(backup, sizeof(backup), "%.*s.jbk", + namelen, filename); + if (result != ISC_R_SUCCESS) + return (result); - CHECK(journal_open(mctx, filename, ISC_TRUE, ISC_FALSE, &j)); + result = journal_open(mctx, filename, ISC_FALSE, ISC_FALSE, &j); + if (result == ISC_R_NOTFOUND) { + is_backup = ISC_TRUE; + result = journal_open(mctx, backup, ISC_FALSE, ISC_FALSE, &j); + } + if (result != ISC_R_SUCCESS) + return (result); if (JOURNAL_EMPTY(&j->header)) { dns_journal_destroy(&j); @@ -1963,6 +2006,8 @@ dns_journal_compact(isc_mem_t *mctx, char *filename, isc_uint32_t serial, dns_journal_destroy(&j); return (ISC_R_SUCCESS); } + + CHECK(journal_open(mctx, newname, ISC_TRUE, ISC_TRUE, &new)); /* * Remove overhead so space test below can succeed. @@ -2003,47 +2048,12 @@ dns_journal_compact(isc_mem_t *mctx, char *filename, isc_uint32_t serial, CHECK(journal_next(j, &best_guess)); /* - * Enough space to proceed? + * We should now be roughly half target_size provided + * we did not reach 'serial'. If not we will just copy + * all uncommitted deltas regardless of the size. */ - if ((isc_uint32_t) (j->header.end.offset - best_guess.offset) > - (isc_uint32_t) (best_guess.offset - indexend)) { - dns_journal_destroy(&j); - return (ISC_R_NOSPACE); - } - copy_length = j->header.end.offset - best_guess.offset; - /* - * Invalidate entire index, will be rebuilt at end. - */ - for (i = 0; i < j->header.index_size; i++) { - if (POS_VALID(j->index[i])) - POS_INVALIDATE(j->index[i]); - } - - /* - * Convert the index into on-disk format and write - * it to disk. - */ - CHECK(index_to_disk(j)); - CHECK(journal_fsync(j)); - - /* - * Update the journal header. - */ - if (copy_length == 0) { - j->header.begin.serial = 0; - j->header.end.serial = 0; - j->header.begin.offset = 0; - j->header.end.offset = 0; - } else { - j->header.begin = best_guess; - } - journal_header_encode(&j->header, &rawheader); - CHECK(journal_seek(j, 0)); - CHECK(journal_write(j, &rawheader, sizeof(rawheader))); - CHECK(journal_fsync(j)); - if (copy_length != 0) { /* * Copy best_guess to end into space just freed. @@ -2057,56 +2067,90 @@ dns_journal_compact(isc_mem_t *mctx, char *filename, isc_uint32_t serial, goto failure; } + CHECK(journal_seek(j, best_guess.offset)); + CHECK(journal_seek(new, indexend)); for (i = 0; i < copy_length; i += size) { - len = (copy_length - i) > size ? size : + unsigned int len = (copy_length - i) > size ? size : (copy_length - i); - CHECK(journal_seek(j, best_guess.offset + i)); CHECK(journal_read(j, buf, len)); - CHECK(journal_seek(j, indexend + i)); - CHECK(journal_write(j, buf, len)); + CHECK(journal_write(new, buf, len)); } - CHECK(journal_fsync(j)); + CHECK(journal_fsync(new)); /* * Compute new header. */ - j->header.begin.offset = indexend; - j->header.end.offset = indexend + copy_length; + new->header.begin.serial = best_guess.serial; + new->header.begin.offset = indexend; + new->header.end.serial = j->header.end.serial; + new->header.end.offset = indexend + copy_length; + /* * Update the journal header. */ - journal_header_encode(&j->header, &rawheader); - CHECK(journal_seek(j, 0)); - CHECK(journal_write(j, &rawheader, sizeof(rawheader))); - CHECK(journal_fsync(j)); + journal_header_encode(&new->header, &rawheader); + CHECK(journal_seek(new, 0)); + CHECK(journal_write(new, &rawheader, sizeof(rawheader))); + CHECK(journal_fsync(new)); /* * Build new index. */ - current_pos = j->header.begin; - while (current_pos.serial != j->header.end.serial) { - index_add(j, ¤t_pos); - CHECK(journal_next(j, ¤t_pos)); + current_pos = new->header.begin; + while (current_pos.serial != new->header.end.serial) { + index_add(new, ¤t_pos); + CHECK(journal_next(new, ¤t_pos)); } /* * Write index. */ - CHECK(index_to_disk(j)); - CHECK(journal_fsync(j)); + CHECK(index_to_disk(new)); + CHECK(journal_fsync(new)); + + indexend = new->header.end.offset; + } + dns_journal_destroy(&new); - indexend = j->header.end.offset; + /* + * With a UFS file system this should just succeed and be atomic. + * Any IXFR outs will just continue and the old journal will be + * removed on final close. + * + * With MSDOS / NTFS we need to do a two stage rename triggered + * bu EEXISTS. Hopefully all IXFR's that were active at the last + * rename are now complete. + */ + if (rename(newname, filename) == -1) { + if (errno == EACCES && !is_backup) { + result = isc_file_remove(backup); + if (result != ISC_R_SUCCESS && + result != ISC_R_FILENOTFOUND) + goto failure; + if (rename(filename, backup) == -1) + goto maperrno; + if (rename(newname, filename) == -1) + goto maperrno; + (void)isc_file_remove(backup); + } else { + maperrno: + result = ISC_R_FAILURE; + goto failure; + } } + dns_journal_destroy(&j); - (void)isc_file_truncate(filename, (isc_offset_t)indexend); result = ISC_R_SUCCESS; failure: + (void)isc_file_remove(newname); if (buf != NULL) isc_mem_put(mctx, buf, size); if (j != NULL) dns_journal_destroy(&j); + if (new != NULL) + dns_journal_destroy(&new); return (result); } diff --git a/contrib/bind9/lib/dns/lookup.c b/contrib/bind9/lib/dns/lookup.c index 642a434..a3ddad4 100644 --- a/contrib/bind9/lib/dns/lookup.c +++ b/contrib/bind9/lib/dns/lookup.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001, 2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: lookup.c,v 1.14.18.4 2005/11/30 03:44:39 marka Exp $ */ +/* $Id: lookup.c,v 1.14.18.7 2007/08/28 07:20:04 tbox Exp $ */ /*! \file */ @@ -181,7 +181,7 @@ static void lookup_find(dns_lookup_t *lookup, dns_fetchevent_t *event) { isc_result_t result; isc_boolean_t want_restart; - isc_boolean_t send_event = ISC_FALSE; + isc_boolean_t send_event; dns_name_t *name, *fname, *prefix; dns_fixedname_t foundname, fixed; dns_rdata_t rdata = DNS_RDATA_INIT; @@ -201,6 +201,7 @@ lookup_find(dns_lookup_t *lookup, dns_fetchevent_t *event) { do { lookup->restarts++; want_restart = ISC_FALSE; + send_event = ISC_TRUE; if (event == NULL && !lookup->canceled) { dns_fixedname_init(&foundname); @@ -208,6 +209,15 @@ lookup_find(dns_lookup_t *lookup, dns_fetchevent_t *event) { INSIST(!dns_rdataset_isassociated(&lookup->rdataset)); INSIST(!dns_rdataset_isassociated (&lookup->sigrdataset)); + /* + * If we have restarted then clear the old node. */ + if (lookup->event->node != NULL) { + INSIST(lookup->event->db != NULL); + dns_db_detachnode(lookup->event->db, + &lookup->event->node); + } + if (lookup->event->db != NULL) + dns_db_detach(&lookup->event->db); result = view_find(lookup, fname); if (result == ISC_R_NOTFOUND) { /* @@ -222,8 +232,8 @@ lookup_find(dns_lookup_t *lookup, dns_fetchevent_t *event) { if (lookup->event->db != NULL) dns_db_detach(&lookup->event->db); result = start_fetch(lookup); - if (result != ISC_R_SUCCESS) - send_event = ISC_TRUE; + if (result == ISC_R_SUCCESS) + send_event = ISC_FALSE; goto done; } } else if (event != NULL) { @@ -244,7 +254,6 @@ lookup_find(dns_lookup_t *lookup, dns_fetchevent_t *event) { switch (result) { case ISC_R_SUCCESS: result = build_event(lookup); - send_event = ISC_TRUE; if (event == NULL) break; if (event->db != NULL) @@ -269,8 +278,10 @@ lookup_find(dns_lookup_t *lookup, dns_fetchevent_t *event) { break; result = dns_name_copy(&cname.cname, name, NULL); dns_rdata_freestruct(&cname); - if (result == ISC_R_SUCCESS) + if (result == ISC_R_SUCCESS) { want_restart = ISC_TRUE; + send_event = ISC_FALSE; + } break; case DNS_R_DNAME: namereln = dns_name_fullcompare(name, fname, &order, @@ -296,8 +307,10 @@ lookup_find(dns_lookup_t *lookup, dns_fetchevent_t *event) { result = dns_name_concatenate(prefix, &dname.dname, name, NULL); dns_rdata_freestruct(&dname); - if (result == ISC_R_SUCCESS) + if (result == ISC_R_SUCCESS) { want_restart = ISC_TRUE; + send_event = ISC_FALSE; + } break; default: send_event = ISC_TRUE; @@ -368,7 +381,6 @@ levent_destroy(isc_event_t *event) { isc_mem_put(mctx, event, event->ev_size); } - isc_result_t dns_lookup_create(isc_mem_t *mctx, dns_name_t *name, dns_rdatatype_t type, dns_view_t *view, unsigned int options, isc_task_t *task, diff --git a/contrib/bind9/lib/dns/master.c b/contrib/bind9/lib/dns/master.c index 8eb1f2d..aa04be0 100644 --- a/contrib/bind9/lib/dns/master.c +++ b/contrib/bind9/lib/dns/master.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: master.c,v 1.148.18.13 2006/12/07 23:57:58 marka Exp $ */ +/* $Id: master.c,v 1.148.18.18 2007/08/28 07:20:04 tbox Exp $ */ /*! \file */ @@ -276,7 +276,8 @@ loadctx_destroy(dns_loadctx_t *lctx); #define MANYERRS(lctx, result) \ ((result != ISC_R_SUCCESS) && \ - ((lctx)->options & DNS_MASTER_MANYERRORS) != 0) + (result != ISC_R_IOERROR) && \ + ((lctx)->options & DNS_MASTER_MANYERRORS) != 0) #define SETRESULT(lctx, r) \ do { \ @@ -1474,7 +1475,7 @@ load_text(dns_loadctx_t *lctx) { } else { UNEXPECTED_ERROR(__FILE__, __LINE__, "%s:%lu: isc_lex_gettoken() returned " - "unexpeced token type (%d)", + "unexpected token type (%d)", source, line, token.type); result = ISC_R_UNEXPECTED; if (MANYERRS(lctx, result)) { @@ -2348,8 +2349,7 @@ dns_master_loadfile2(const char *master_file, dns_name_t *top, INSIST(result != DNS_R_CONTINUE); cleanup: - if (lctx != NULL) - dns_loadctx_detach(&lctx); + dns_loadctx_detach(&lctx); return (result); } @@ -2396,8 +2396,7 @@ dns_master_loadfileinc2(const char *master_file, dns_name_t *top, } cleanup: - if (lctx != NULL) - dns_loadctx_detach(&lctx); + dns_loadctx_detach(&lctx); return (result); } @@ -2491,8 +2490,7 @@ dns_master_loadbuffer(isc_buffer_t *buffer, dns_name_t *top, INSIST(result != DNS_R_CONTINUE); cleanup: - if (lctx != NULL) - dns_loadctx_detach(&lctx); + dns_loadctx_detach(&lctx); return (result); } @@ -2528,8 +2526,7 @@ dns_master_loadbufferinc(isc_buffer_t *buffer, dns_name_t *top, } cleanup: - if (lctx != NULL) - dns_loadctx_detach(&lctx); + dns_loadctx_detach(&lctx); return (result); } diff --git a/contrib/bind9/lib/dns/message.c b/contrib/bind9/lib/dns/message.c index a4a1f87..e8e4948 100644 --- a/contrib/bind9/lib/dns/message.c +++ b/contrib/bind9/lib/dns/message.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: message.c,v 1.222.18.10 2006/03/02 23:19:20 marka Exp $ */ +/* $Id: message.c,v 1.222.18.14 2007/08/28 07:20:04 tbox Exp $ */ /*! \file */ @@ -1308,6 +1308,11 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx, rdata->type = rdtype; rdata->flags = DNS_RDATA_UPDATE; result = ISC_R_SUCCESS; + } else if (rdclass == dns_rdataclass_none && + msg->opcode == dns_opcode_update && + sectionid == DNS_SECTION_UPDATE) { + result = getrdata(source, msg, dctx, msg->rdclass, + rdtype, rdatalen, rdata); } else result = getrdata(source, msg, dctx, rdclass, rdtype, rdatalen, rdata); @@ -3007,8 +3012,7 @@ dns_message_sectiontotext(dns_message_t *msg, dns_section_t section, ADD_STRING(target, ";; "); if (msg->opcode != dns_opcode_update) { ADD_STRING(target, sectiontext[section]); - } - else { + } else { ADD_STRING(target, updsectiontext[section]); } ADD_STRING(target, " SECTION:\n"); @@ -3130,7 +3134,12 @@ dns_message_totext(dns_message_t *msg, const dns_master_style_t *style, ADD_STRING(target, ";; ->>HEADER<<- opcode: "); ADD_STRING(target, opcodetext[msg->opcode]); ADD_STRING(target, ", status: "); - ADD_STRING(target, rcodetext[msg->rcode]); + if (msg->rcode < (sizeof(rcodetext)/sizeof(rcodetext[0]))) { + ADD_STRING(target, rcodetext[msg->rcode]); + } else { + snprintf(buf, sizeof(buf), "%4u", msg->rcode); + ADD_STRING(target, buf); + } ADD_STRING(target, ", id: "); snprintf(buf, sizeof(buf), "%6u", msg->id); ADD_STRING(target, buf); diff --git a/contrib/bind9/lib/dns/openssl_link.c b/contrib/bind9/lib/dns/openssl_link.c index fda610a..bb76e0e 100644 --- a/contrib/bind9/lib/dns/openssl_link.c +++ b/contrib/bind9/lib/dns/openssl_link.c @@ -1,9 +1,9 @@ /* - * Portions Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Portions Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Portions Copyright (C) 1999-2003 Internet Software Consortium. * Portions Copyright (C) 1995-2000 by Network Associates, Inc. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -18,7 +18,7 @@ /* * Principal Author: Brian Wellington - * $Id: openssl_link.c,v 1.1.6.9 2006/05/23 23:51:04 marka Exp $ + * $Id: openssl_link.c,v 1.1.6.12 2007/08/28 07:20:04 tbox Exp $ */ #ifdef OPENSSL @@ -178,6 +178,7 @@ dst__openssl_init() { mem_free(rm); #endif cleanup_mutexinit: + CRYPTO_set_locking_callback(NULL); DESTROYMUTEXBLOCK(locks, nlocks); cleanup_mutexalloc: mem_free(locks); @@ -221,16 +222,17 @@ dst__openssl_destroy() { } #endif #endif - if (locks != NULL) { - DESTROYMUTEXBLOCK(locks, nlocks); - mem_free(locks); - } if (rm != NULL) { #if OPENSSL_VERSION_NUMBER >= 0x00907000L RAND_cleanup(); #endif mem_free(rm); } + if (locks != NULL) { + CRYPTO_set_locking_callback(NULL); + DESTROYMUTEXBLOCK(locks, nlocks); + mem_free(locks); + } } isc_result_t diff --git a/contrib/bind9/lib/dns/openssldh_link.c b/contrib/bind9/lib/dns/openssldh_link.c index 6f2e987..8f47482 100644 --- a/contrib/bind9/lib/dns/openssldh_link.c +++ b/contrib/bind9/lib/dns/openssldh_link.c @@ -3,7 +3,7 @@ * Portions Copyright (C) 1999-2002 Internet Software Consortium. * Portions Copyright (C) 1995-2000 by Network Associates, Inc. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -18,7 +18,7 @@ /* * Principal Author: Brian Wellington - * $Id: openssldh_link.c,v 1.1.6.9 2007/01/08 02:52:39 marka Exp $ + * $Id: openssldh_link.c,v 1.1.6.10 2007/08/28 07:20:04 tbox Exp $ */ #ifdef OPENSSL diff --git a/contrib/bind9/lib/dns/openssldsa_link.c b/contrib/bind9/lib/dns/openssldsa_link.c index 64e6159..d2b0833 100644 --- a/contrib/bind9/lib/dns/openssldsa_link.c +++ b/contrib/bind9/lib/dns/openssldsa_link.c @@ -3,7 +3,7 @@ * Portions Copyright (C) 1999-2002 Internet Software Consortium. * Portions Copyright (C) 1995-2000 by Network Associates, Inc. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -16,7 +16,7 @@ * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: openssldsa_link.c,v 1.1.6.8 2007/01/08 03:03:48 marka Exp $ */ +/* $Id: openssldsa_link.c,v 1.1.6.9 2007/08/28 07:20:04 tbox Exp $ */ #ifdef OPENSSL diff --git a/contrib/bind9/lib/dns/rbtdb.c b/contrib/bind9/lib/dns/rbtdb.c index cd25608..1d729d0 100644 --- a/contrib/bind9/lib/dns/rbtdb.c +++ b/contrib/bind9/lib/dns/rbtdb.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: rbtdb.c,v 1.196.18.41 2006/10/26 06:04:29 marka Exp $ */ +/* $Id: rbtdb.c,v 1.196.18.48 2007/08/28 07:20:04 tbox Exp $ */ /*! \file */ @@ -179,6 +179,10 @@ typedef isc_mutex_t nodelock_t; #define NODE_WEAKDOWNGRADE(l) ((void)0) #endif +#ifndef DNS_RDATASET_FIXED +#define DNS_RDATASET_FIXED 1 +#endif + /* * Allow clients with a virtual time of upto 5 minutes in the past to see * records that would have otherwise have expired. @@ -495,6 +499,19 @@ typedef struct rbtdb_dbiterator { static void free_rbtdb(dns_rbtdb_t *rbtdb, isc_boolean_t log, isc_event_t *event); +/*% + * 'init_count' is used to initialize 'newheader->count' which inturn + * is used to determine where in the cycle rrset-order cyclic starts. + * We don't lock this as we don't care about simultanious updates. + * + * Note: + * Both init_count and header->count can be ISC_UINT32_MAX. + * The count on the returned rdataset however can't be as + * that indicates that the database does not implement cyclic + * processing. + */ +static unsigned int init_count; + /* * Locking * @@ -889,7 +906,7 @@ free_noqname(isc_mem_t *mctx, struct noqname **noqname) { if ((*noqname)->nsec != NULL) isc_mem_put(mctx, (*noqname)->nsec, dns_rdataslab_size((*noqname)->nsec, 0)); - if ((*noqname)->nsec != NULL) + if ((*noqname)->nsecsig != NULL) isc_mem_put(mctx, (*noqname)->nsecsig, dns_rdataslab_size((*noqname)->nsecsig, 0)); isc_mem_put(mctx, *noqname, sizeof(**noqname)); @@ -1857,8 +1874,8 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node, raw = (unsigned char *)header + sizeof(*header); rdataset->private3 = raw; rdataset->count = header->count++; - if (header->count == ISC_UINT32_MAX) - header->count = 0; + if (rdataset->count == ISC_UINT32_MAX) + rdataset->count = 0; /* * Reset iterator state. @@ -1964,12 +1981,20 @@ valid_glue(rbtdb_search_t *search, dns_name_t *name, rbtdb_rdatatype_t type, header = search->zonecut_rdataset; raw = (unsigned char *)header + sizeof(*header); count = raw[0] * 256 + raw[1]; +#if DNS_RDATASET_FIXED raw += 2 + (4 * count); +#else + raw += 2; +#endif while (count > 0) { count--; size = raw[0] * 256 + raw[1]; +#if DNS_RDATASET_FIXED raw += 4; +#else + raw += 2; +#endif region.base = raw; region.length = size; raw += size; @@ -3298,7 +3323,8 @@ find_coveringnsec(rbtdb_search_t *search, dns_dbnode_t **nodep, header_prev = header; continue; } - if (NONEXISTENT(header) || NXDOMAIN(header)) { + if (NONEXISTENT(header) || + RBTDB_RDATATYPE_BASE(header->type) == 0) { header_prev = header; continue; } @@ -3324,7 +3350,7 @@ find_coveringnsec(rbtdb_search_t *search, dns_dbnode_t **nodep, result = DNS_R_COVERINGNSEC; } else if (!empty_node) { result = ISC_R_NOTFOUND; - }else + } else result = dns_rbtnodechain_prev(&search->chain, NULL, NULL); unlock_node: @@ -4825,7 +4851,7 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version, rdataset->covers); newheader->attributes = 0; newheader->noqname = NULL; - newheader->count = 0; + newheader->count = init_count++; newheader->trust = rdataset->trust; newheader->additional_auth = NULL; newheader->additional_glue = NULL; @@ -4910,7 +4936,7 @@ subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version, newheader->serial = rbtversion->serial; newheader->trust = 0; newheader->noqname = NULL; - newheader->count = 0; + newheader->count = init_count++; newheader->additional_auth = NULL; newheader->additional_glue = NULL; @@ -5161,7 +5187,7 @@ loading_addrdataset(void *arg, dns_name_t *name, dns_rdataset_t *rdataset) { newheader->trust = rdataset->trust; newheader->serial = 1; newheader->noqname = NULL; - newheader->count = 0; + newheader->count = init_count++; newheader->additional_auth = NULL; newheader->additional_glue = NULL; @@ -5636,9 +5662,11 @@ rdataset_first(dns_rdataset_t *rdataset) { return (ISC_R_NOMORE); } +#if DNS_RDATASET_FIXED if ((rdataset->attributes & DNS_RDATASETATTR_LOADORDER) == 0) raw += 2 + (4 * count); else +#endif raw += 2; /* @@ -5673,11 +5701,17 @@ rdataset_next(dns_rdataset_t *rdataset) { * Skip forward one record (length + 4) or one offset (4). */ raw = rdataset->private5; +#if DNS_RDATASET_FIXED if ((rdataset->attributes & DNS_RDATASETATTR_LOADORDER) == 0) { +#endif length = raw[0] * 256 + raw[1]; raw += length; +#if DNS_RDATASET_FIXED } - rdataset->private5 = raw + 4; + rdataset->private5 = raw + 4; /* length(2) + order(2) */ +#else + rdataset->private5 = raw + 2; /* length(2) */ +#endif return (ISC_R_SUCCESS); } @@ -5685,7 +5719,9 @@ rdataset_next(dns_rdataset_t *rdataset) { static void rdataset_current(dns_rdataset_t *rdataset, dns_rdata_t *rdata) { unsigned char *raw = rdataset->private5; /* RDATASLAB */ +#if DNS_RDATASET_FIXED unsigned int offset; +#endif isc_region_t r; REQUIRE(raw != NULL); @@ -5694,14 +5730,21 @@ rdataset_current(dns_rdataset_t *rdataset, dns_rdata_t *rdata) { * Find the start of the record if not already in private5 * then skip the length and order fields. */ +#if DNS_RDATASET_FIXED if ((rdataset->attributes & DNS_RDATASETATTR_LOADORDER) != 0) { offset = (raw[0] << 24) + (raw[1] << 16) + (raw[2] << 8) + raw[3]; raw = rdataset->private3; raw += offset; } +#endif r.length = raw[0] * 256 + raw[1]; + +#if DNS_RDATASET_FIXED raw += 4; +#else + raw += 2; +#endif r.base = raw; dns_rdata_fromregion(rdata, rdataset->rdclass, rdataset->type, &r); } diff --git a/contrib/bind9/lib/dns/rdata/generic/dlv_32769.c b/contrib/bind9/lib/dns/rdata/generic/dlv_32769.c index fa22580..c0bb348 100644 --- a/contrib/bind9/lib/dns/rdata/generic/dlv_32769.c +++ b/contrib/bind9/lib/dns/rdata/generic/dlv_32769.c @@ -1,7 +1,7 @@ /* - * Copyright (C) 2004, 2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2006, 2007 Internet Systems Consortium, Inc. ("ISC") * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -14,7 +14,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dlv_32769.c,v 1.2.2.2 2006/02/19 06:50:47 marka Exp $ */ +/* $Id: dlv_32769.c,v 1.2.2.5 2007/08/28 07:20:06 tbox Exp $ */ /* draft-ietf-dnsext-delegation-signer-05.txt */ @@ -23,9 +23,17 @@ #define RRTYPE_DLV_ATTRIBUTES 0 +#include <isc/sha1.h> +#include <isc/sha2.h> + +#include <dns/ds.h> + + static inline isc_result_t fromtext_dlv(ARGS_FROMTEXT) { isc_token_t token; + unsigned char c; + int length; REQUIRE(type == 32769); @@ -61,11 +69,17 @@ fromtext_dlv(ARGS_FROMTEXT) { if (token.value.as_ulong > 0xffU) RETTOK(ISC_R_RANGE); RETERR(uint8_tobuffer(token.value.as_ulong, target)); - type = (isc_uint16_t) token.value.as_ulong; + c = (unsigned char) token.value.as_ulong; /* * Digest. */ + if (c == DNS_DSDIGEST_SHA1) + length = ISC_SHA1_DIGESTLENGTH; + else if (c == DNS_DSDIGEST_SHA256) + length = ISC_SHA256_DIGESTLENGTH; + else + length = -1; return (isc_hex_tobuffer(lexer, target, -1)); } @@ -130,9 +144,27 @@ fromwire_dlv(ARGS_FROMWIRE) { UNUSED(options); isc_buffer_activeregion(source, &sr); - if (sr.length < 4) + + /* + * Check digest lengths if we know them. + */ + if (sr.length < 4 || + (sr.base[3] == DNS_DSDIGEST_SHA1 && + sr.length < 4 + ISC_SHA1_DIGESTLENGTH) || + (sr.base[3] == DNS_DSDIGEST_SHA256 && + sr.length < 4 + ISC_SHA256_DIGESTLENGTH)) return (ISC_R_UNEXPECTEDEND); + /* + * Only copy digest lengths if we know them. + * If there is extra data dns_rdata_fromwire() will + * detect that. + */ + if (sr.base[3] == DNS_DSDIGEST_SHA1) + sr.length = 4 + ISC_SHA1_DIGESTLENGTH; + else if (sr.base[3] == DNS_DSDIGEST_SHA256) + sr.length = 4 + ISC_SHA256_DIGESTLENGTH; + isc_buffer_forward(source, sr.length); return (mem_tobuffer(target, sr.base, sr.length)); } @@ -174,6 +206,14 @@ fromstruct_dlv(ARGS_FROMSTRUCT) { REQUIRE(source != NULL); REQUIRE(dlv->common.rdtype == type); REQUIRE(dlv->common.rdclass == rdclass); + switch (dlv->digest_type) { + case DNS_DSDIGEST_SHA1: + REQUIRE(dlv->length == ISC_SHA1_DIGESTLENGTH); + break; + case DNS_DSDIGEST_SHA256: + REQUIRE(dlv->length == ISC_SHA256_DIGESTLENGTH); + break; + } UNUSED(type); UNUSED(rdclass); diff --git a/contrib/bind9/lib/dns/rdata/generic/ds_43.c b/contrib/bind9/lib/dns/rdata/generic/ds_43.c index b9a3a3e..212a56f 100644 --- a/contrib/bind9/lib/dns/rdata/generic/ds_43.c +++ b/contrib/bind9/lib/dns/rdata/generic/ds_43.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2002 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: ds_43.c,v 1.7.18.2 2005/09/06 07:29:32 marka Exp $ */ +/* $Id: ds_43.c,v 1.7.18.5 2007/08/28 07:20:06 tbox Exp $ */ /* draft-ietf-dnsext-delegation-signer-05.txt */ @@ -25,10 +25,16 @@ #define RRTYPE_DS_ATTRIBUTES \ (DNS_RDATATYPEATTR_DNSSEC|DNS_RDATATYPEATTR_ATPARENT) +#include <isc/sha1.h> +#include <isc/sha2.h> + +#include <dns/ds.h> + static inline isc_result_t fromtext_ds(ARGS_FROMTEXT) { isc_token_t token; unsigned char c; + int length; REQUIRE(type == 43); @@ -63,12 +69,18 @@ fromtext_ds(ARGS_FROMTEXT) { if (token.value.as_ulong > 0xffU) RETTOK(ISC_R_RANGE); RETERR(uint8_tobuffer(token.value.as_ulong, target)); - type = (isc_uint16_t) token.value.as_ulong; + c = (unsigned char) token.value.as_ulong; /* * Digest. */ - return (isc_hex_tobuffer(lexer, target, -1)); + if (c == DNS_DSDIGEST_SHA1) + length = ISC_SHA1_DIGESTLENGTH; + else if (c == DNS_DSDIGEST_SHA256) + length = ISC_SHA256_DIGESTLENGTH; + else + length = -1; + return (isc_hex_tobuffer(lexer, target, length)); } static inline isc_result_t @@ -132,9 +144,27 @@ fromwire_ds(ARGS_FROMWIRE) { UNUSED(options); isc_buffer_activeregion(source, &sr); - if (sr.length < 4) + + /* + * Check digest lengths if we know them. + */ + if (sr.length < 4 || + (sr.base[3] == DNS_DSDIGEST_SHA1 && + sr.length < 4 + ISC_SHA1_DIGESTLENGTH) || + (sr.base[3] == DNS_DSDIGEST_SHA256 && + sr.length < 4 + ISC_SHA256_DIGESTLENGTH)) return (ISC_R_UNEXPECTEDEND); + /* + * Only copy digest lengths if we know them. + * If there is extra data dns_rdata_fromwire() will + * detect that. + */ + if (sr.base[3] == DNS_DSDIGEST_SHA1) + sr.length = 4 + ISC_SHA1_DIGESTLENGTH; + else if (sr.base[3] == DNS_DSDIGEST_SHA256) + sr.length = 4 + ISC_SHA256_DIGESTLENGTH; + isc_buffer_forward(source, sr.length); return (mem_tobuffer(target, sr.base, sr.length)); } @@ -176,6 +206,14 @@ fromstruct_ds(ARGS_FROMSTRUCT) { REQUIRE(source != NULL); REQUIRE(ds->common.rdtype == type); REQUIRE(ds->common.rdclass == rdclass); + switch (ds->digest_type) { + case DNS_DSDIGEST_SHA1: + REQUIRE(ds->length == ISC_SHA1_DIGESTLENGTH); + break; + case DNS_DSDIGEST_SHA256: + REQUIRE(ds->length == ISC_SHA256_DIGESTLENGTH); + break; + } UNUSED(type); UNUSED(rdclass); diff --git a/contrib/bind9/lib/dns/rdataslab.c b/contrib/bind9/lib/dns/rdataslab.c index 3b5ab2d..5d89d01 100644 --- a/contrib/bind9/lib/dns/rdataslab.c +++ b/contrib/bind9/lib/dns/rdataslab.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: rdataslab.c,v 1.35.18.5 2006/03/05 23:58:51 marka Exp $ */ +/* $Id: rdataslab.c,v 1.35.18.8 2007/08/28 07:20:05 tbox Exp $ */ /*! \file */ @@ -33,6 +33,10 @@ #include <dns/rdataset.h> #include <dns/rdataslab.h> +#ifndef DNS_RDATASET_FIXED +#define DNS_RDATASET_FIXED 1 +#endif + /* * The rdataslab structure allows iteration to occur in both load order * and DNSSEC order. The structure is as follows: @@ -45,10 +49,19 @@ * order (2 bytes) * data (data length bytes) * + * If DNS_RDATASET_FIXED is defined to be zero (0) the format of a + * rdataslab is as follows: + * + * header (reservelen bytes) + * record count (2 bytes) + * data records + * data length (2 bytes) + * data (data length bytes) + * * Offsets are from the end of the header. * * Load order traversal is performed by walking the offset table to find - * the start of the record. + * the start of the record (DNS_RDATASET_FIXED = 1). * * DNSSEC order traversal is performed by walking the data records. * @@ -79,6 +92,7 @@ compare_rdata(const void *p1, const void *p2) { return (dns_rdata_compare(&x1->rdata, &x2->rdata)); } +#if DNS_RDATASET_FIXED static void fillin_offsets(unsigned char *offsetbase, unsigned int *offsettable, unsigned length) @@ -108,6 +122,7 @@ fillin_offsets(unsigned char *offsetbase, unsigned int *offsettable, *raw = j++ & 0xff; } } +#endif isc_result_t dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx, @@ -115,13 +130,17 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx, { struct xrdata *x; unsigned char *rawbuf; +#if DNS_RDATASET_FIXED unsigned char *offsetbase; +#endif unsigned int buflen; isc_result_t result; unsigned int nitems; unsigned int nalloc; unsigned int i; +#if DNS_RDATASET_FIXED unsigned int *offsettable; +#endif buflen = reservelen + 2; @@ -147,7 +166,9 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx, INSIST(result == ISC_R_SUCCESS); dns_rdata_init(&x[i].rdata); dns_rdataset_current(rdataset, &x[i].rdata); +#if DNS_RDATASET_FIXED x[i].order = i; +#endif result = dns_rdataset_next(rdataset); } if (result != ISC_R_NOMORE) @@ -179,20 +200,30 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx, if (compare_rdata(&x[i-1].rdata, &x[i].rdata) == 0) { x[i-1].rdata.data = NULL; x[i-1].rdata.length = 0; +#if DNS_RDATASET_FIXED /* * Preserve the least order so A, B, A -> A, B * after duplicate removal. */ if (x[i-1].order < x[i].order) x[i].order = x[i-1].order; +#endif nitems--; } else +#if DNS_RDATASET_FIXED buflen += (8 + x[i-1].rdata.length); +#else + buflen += (2 + x[i-1].rdata.length); +#endif } /* * Don't forget the last item! */ +#if DNS_RDATASET_FIXED buflen += (8 + x[i-1].rdata.length); +#else + buflen += (2 + x[i-1].rdata.length); +#endif /* * Ensure that singleton types are actually singletons. @@ -216,6 +247,7 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx, goto free_rdatas; } +#if DNS_RDATASET_FIXED /* Allocate temporary offset table. */ offsettable = isc_mem_get(mctx, nalloc * sizeof(unsigned int)); if (offsettable == NULL) { @@ -224,33 +256,43 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx, goto free_rdatas; } memset(offsettable, 0, nalloc * sizeof(unsigned int)); +#endif region->base = rawbuf; region->length = buflen; rawbuf += reservelen; +#if DNS_RDATASET_FIXED offsetbase = rawbuf; +#endif *rawbuf++ = (nitems & 0xff00) >> 8; *rawbuf++ = (nitems & 0x00ff); +#if DNS_RDATASET_FIXED /* Skip load order table. Filled in later. */ rawbuf += nitems * 4; +#endif for (i = 0; i < nalloc; i++) { if (x[i].rdata.data == NULL) continue; +#if DNS_RDATASET_FIXED offsettable[x[i].order] = rawbuf - offsetbase; +#endif *rawbuf++ = (x[i].rdata.length & 0xff00) >> 8; *rawbuf++ = (x[i].rdata.length & 0x00ff); +#if DNS_RDATASET_FIXED rawbuf += 2; /* filled in later */ +#endif memcpy(rawbuf, x[i].rdata.data, x[i].rdata.length); rawbuf += x[i].rdata.length; } +#if DNS_RDATASET_FIXED fillin_offsets(offsetbase, offsettable, nalloc); - isc_mem_put(mctx, offsettable, nalloc * sizeof(unsigned int)); +#endif result = ISC_R_SUCCESS; @@ -274,7 +316,11 @@ rdataset_first(dns_rdataset_t *rdataset) { rdataset->private5 = NULL; return (ISC_R_NOMORE); } +#if DNS_RDATASET_FIXED raw += 2 + (4 * count); +#else + raw += 2; +#endif /* * The privateuint4 field is the number of rdata beyond the cursor * position, so we decrement the total count by one before storing @@ -300,7 +346,11 @@ rdataset_next(dns_rdataset_t *rdataset) { rdataset->privateuint4 = count; raw = rdataset->private5; length = raw[0] * 256 + raw[1]; +#if DNS_RDATASET_FIXED raw += length + 4; +#else + raw += length + 2; +#endif rdataset->private5 = raw; return (ISC_R_SUCCESS); @@ -314,7 +364,11 @@ rdataset_current(dns_rdataset_t *rdataset, dns_rdata_t *rdata) { REQUIRE(raw != NULL); r.length = raw[0] * 256 + raw[1]; +#if DNS_RDATASET_FIXED raw += 4; +#else + raw += 2; +#endif r.base = raw; dns_rdata_fromregion(rdata, rdataset->rdclass, rdataset->type, &r); } @@ -390,12 +444,18 @@ dns_rdataslab_size(unsigned char *slab, unsigned int reservelen) { current = slab + reservelen; count = *current++ * 256; count += *current++; +#if DNS_RDATASET_FIXED current += (4 * count); +#endif while (count > 0) { count--; length = *current++ * 256; length += *current++; +#if DNS_RDATASET_FIXED current += length + 2; +#else + current += length; +#endif } return ((unsigned int)(current - slab)); @@ -417,7 +477,9 @@ rdata_from_slab(unsigned char **current, region.length = *tcurrent++ * 256; region.length += *tcurrent++; +#if DNS_RDATASET_FIXED tcurrent += 2; +#endif region.base = tcurrent; tcurrent += region.length; dns_rdata_fromregion(rdata, rdclass, type, ®ion); @@ -443,7 +505,9 @@ rdata_in_slab(unsigned char *slab, unsigned int reservelen, count = *current++ * 256; count += *current++; +#if DNS_RDATASET_FIXED current += (4 * count); +#endif for (i = 0; i < count; i++) { rdata_from_slab(¤t, rdclass, type, &trdata); @@ -473,11 +537,13 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab, unsigned int oadded = 0; unsigned int nadded = 0; unsigned int nncount = 0; +#if DNS_RDATASET_FIXED unsigned int oncount; unsigned int norder = 0; unsigned int oorder = 0; unsigned char *offsetbase; unsigned int *offsettable; +#endif /* * XXX Need parameter to allow "delete rdatasets in nslab" merge, @@ -490,15 +556,21 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab, ocurrent = oslab + reservelen; ocount = *ocurrent++ * 256; ocount += *ocurrent++; +#if DNS_RDATASET_FIXED ocurrent += (4 * ocount); +#endif ostart = ocurrent; ncurrent = nslab + reservelen; ncount = *ncurrent++ * 256; ncount += *ncurrent++; +#if DNS_RDATASET_FIXED ncurrent += (4 * ncount); +#endif INSIST(ocount > 0 && ncount > 0); +#if DNS_RDATASET_FIXED oncount = ncount; +#endif /* * Yes, this is inefficient! @@ -511,8 +583,13 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab, for (count = 0; count < ocount; count++) { length = *ocurrent++ * 256; length += *ocurrent++; +#if DNS_RDATASET_FIXED olength += length + 8; ocurrent += length + 2; +#else + olength += length + 2; + ocurrent += length; +#endif } /* @@ -528,7 +605,9 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab, do { nregion.length = *ncurrent++ * 256; nregion.length += *ncurrent++; - ncurrent += 2; +#if DNS_RDATASET_FIXED + ncurrent += 2; /* Skip order. */ +#endif nregion.base = ncurrent; dns_rdata_init(&nrdata); dns_rdata_fromregion(&nrdata, rdclass, type, &nregion); @@ -537,7 +616,11 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab, /* * This rdata isn't in the old slab. */ +#if DNS_RDATASET_FIXED tlength += nregion.length + 8; +#else + tlength += nregion.length + 2; +#endif tcount++; nncount++; added_something = ISC_TRUE; @@ -576,7 +659,9 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab, return (ISC_R_NOMEMORY); memcpy(tstart, nslab, reservelen); tcurrent = tstart + reservelen; +#if DNS_RDATASET_FIXED offsetbase = tcurrent; +#endif /* * Write the new count. @@ -584,6 +669,7 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab, *tcurrent++ = (tcount & 0xff00) >> 8; *tcurrent++ = (tcount & 0x00ff); +#if DNS_RDATASET_FIXED /* * Skip offset table. */ @@ -596,25 +682,33 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab, return (ISC_R_NOMEMORY); } memset(offsettable, 0, (ocount + oncount) * sizeof(unsigned int)); +#endif /* * Merge the two slabs. */ ocurrent = ostart; INSIST(ocount != 0); +#if DNS_RDATASET_FIXED oorder = ocurrent[2] * 256 + ocurrent[3]; INSIST(oorder < ocount); +#endif rdata_from_slab(&ocurrent, rdclass, type, &ordata); ncurrent = nslab + reservelen + 2; +#if DNS_RDATASET_FIXED ncurrent += (4 * oncount); +#endif if (ncount > 0) { do { dns_rdata_reset(&nrdata); +#if DNS_RDATASET_FIXED norder = ncurrent[2] * 256 + ncurrent[3]; + INSIST(norder < oncount); - rdata_from_slab(&ncurrent, rdclass, type, &nrdata); +#endif + rdata_from_slab(&ncurrent, rdclass, type, &nrdata); } while (rdata_in_slab(oslab, reservelen, rdclass, type, &nrdata)); } @@ -628,36 +722,48 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab, else fromold = ISC_TF(compare_rdata(&ordata, &nrdata) < 0); if (fromold) { +#if DNS_RDATASET_FIXED offsettable[oorder] = tcurrent - offsetbase; +#endif length = ordata.length; *tcurrent++ = (length & 0xff00) >> 8; *tcurrent++ = (length & 0x00ff); +#if DNS_RDATASET_FIXED tcurrent += 2; /* fill in later */ +#endif memcpy(tcurrent, ordata.data, length); tcurrent += length; oadded++; if (oadded < ocount) { dns_rdata_reset(&ordata); +#if DNS_RDATASET_FIXED oorder = ocurrent[2] * 256 + ocurrent[3]; INSIST(oorder < ocount); - rdata_from_slab(&ocurrent, rdclass, type, +#endif + rdata_from_slab(&ocurrent, rdclass, type, &ordata); } } else { +#if DNS_RDATASET_FIXED offsettable[ocount + norder] = tcurrent - offsetbase; +#endif length = nrdata.length; *tcurrent++ = (length & 0xff00) >> 8; *tcurrent++ = (length & 0x00ff); +#if DNS_RDATASET_FIXED tcurrent += 2; /* fill in later */ +#endif memcpy(tcurrent, nrdata.data, length); tcurrent += length; nadded++; if (nadded < ncount) { do { dns_rdata_reset(&nrdata); +#if DNS_RDATASET_FIXED norder = ncurrent[2] * 256 + ncurrent[3]; INSIST(norder < oncount); - rdata_from_slab(&ncurrent, rdclass, +#endif + rdata_from_slab(&ncurrent, rdclass, type, &nrdata); } while (rdata_in_slab(oslab, reservelen, rdclass, type, @@ -666,10 +772,12 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab, } } +#if DNS_RDATASET_FIXED fillin_offsets(offsetbase, offsettable, ocount + oncount); isc_mem_put(mctx, offsettable, (ocount + oncount) * sizeof(unsigned int)); +#endif INSIST(tcurrent == tstart + tlength); @@ -688,8 +796,10 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab, unsigned int mcount, scount, rcount ,count, tlength, tcount, i; dns_rdata_t srdata = DNS_RDATA_INIT; dns_rdata_t mrdata = DNS_RDATA_INIT; +#if DNS_RDATASET_FIXED unsigned char *offsetbase; unsigned int *offsettable; +#endif unsigned int order; REQUIRE(tslabp != NULL && *tslabp == NULL); @@ -714,8 +824,10 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab, tcount = 0; rcount = 0; +#if DNS_RDATASET_FIXED mcurrent += 4 * mcount; scurrent += 4 * scount; +#endif sstart = scurrent; /* @@ -744,11 +856,13 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab, dns_rdata_reset(&mrdata); } +#if DNS_RDATASET_FIXED tlength += (4 * tcount); +#endif /* * Check that all the records originally existed. The numeric - * check only works as rdataslabs do not contain duplicates. + * check only works as rdataslabs do not contain duplicates. */ if (((flags & DNS_RDATASLAB_EXACT) != 0) && (rcount != scount)) return (DNS_R_NOTEXACT); @@ -773,6 +887,7 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab, return (ISC_R_NOMEMORY); memcpy(tstart, mslab, reservelen); tcurrent = tstart + reservelen; +#if DNS_RDATASET_FIXED offsetbase = tcurrent; offsettable = isc_mem_get(mctx, mcount * sizeof(unsigned int)); @@ -781,6 +896,7 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab, return (ISC_R_NOMEMORY); } memset(offsettable, 0, mcount * sizeof(unsigned int)); +#endif /* * Write the new count. @@ -788,7 +904,9 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab, *tcurrent++ = (tcount & 0xff00) >> 8; *tcurrent++ = (tcount & 0x00ff); +#if DNS_RDATASET_FIXED tcurrent += (4 * tcount); +#endif /* * Copy the parts of mslab not in sslab. @@ -796,11 +914,15 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab, mcurrent = mslab + reservelen; mcount = *mcurrent++ * 256; mcount += *mcurrent++; +#if DNS_RDATASET_FIXED mcurrent += (4 * mcount); +#endif for (i = 0; i < mcount; i++) { unsigned char *mrdatabegin = mcurrent; +#if DNS_RDATASET_FIXED order = mcurrent[2] * 256 + mcurrent[3]; INSIST(order < mcount); +#endif rdata_from_slab(&mcurrent, rdclass, type, &mrdata); scurrent = sstart; for (count = 0; count < scount; count++) { @@ -815,16 +937,20 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab, * copied to the tslab. */ unsigned int length = mcurrent - mrdatabegin; +#if DNS_RDATASET_FIXED offsettable[order] = tcurrent - offsetbase; +#endif memcpy(tcurrent, mrdatabegin, length); tcurrent += length; } dns_rdata_reset(&mrdata); } +#if DNS_RDATASET_FIXED fillin_offsets(offsetbase, offsettable, mcount); isc_mem_put(mctx, offsettable, mcount * sizeof(unsigned int)); +#endif INSIST(tcurrent == tstart + tlength); @@ -852,8 +978,10 @@ dns_rdataslab_equal(unsigned char *slab1, unsigned char *slab2, if (count1 != count2) return (ISC_FALSE); +#if DNS_RDATASET_FIXED current1 += (4 * count1); current2 += (4 * count2); +#endif while (count1 > 0) { length1 = *current1++ * 256; @@ -862,8 +990,10 @@ dns_rdataslab_equal(unsigned char *slab1, unsigned char *slab2, length2 = *current2++ * 256; length2 += *current2++; +#if DNS_RDATASET_FIXED current1 += 2; current2 += 2; +#endif if (length1 != length2 || memcmp(current1, current2, length1) != 0) @@ -898,8 +1028,10 @@ dns_rdataslab_equalx(unsigned char *slab1, unsigned char *slab2, if (count1 != count2) return (ISC_FALSE); +#if DNS_RDATASET_FIXED current1 += (4 * count1); current2 += (4 * count2); +#endif while (count1-- > 0) { rdata_from_slab(¤t1, rdclass, type, &rdata1); diff --git a/contrib/bind9/lib/dns/resolver.c b/contrib/bind9/lib/dns/resolver.c index 7312841..5b57005 100644 --- a/contrib/bind9/lib/dns/resolver.c +++ b/contrib/bind9/lib/dns/resolver.c @@ -2,7 +2,7 @@ * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: resolver.c,v 1.284.18.57 2007/02/14 23:41:01 marka Exp $ */ +/* $Id: resolver.c,v 1.284.18.66 2007/11/01 13:53:27 shane Exp $ */ /*! \file */ @@ -192,6 +192,7 @@ struct fetchctx { isc_sockaddrlist_t bad; isc_sockaddrlist_t edns; isc_sockaddrlist_t edns512; + dns_validator_t *validator; ISC_LIST(dns_validator_t) validators; dns_db_t * cache; dns_adb_t * adb; @@ -250,7 +251,7 @@ struct fetchctx { #define ADDRWAIT(f) (((f)->attributes & FCTX_ATTR_ADDRWAIT) != \ 0) #define SHUTTINGDOWN(f) (((f)->attributes & FCTX_ATTR_SHUTTINGDOWN) \ - != 0) + != 0) #define WANTCACHE(f) (((f)->attributes & FCTX_ATTR_WANTCACHE) != 0) #define WANTNCACHE(f) (((f)->attributes & FCTX_ATTR_WANTNCACHE) != 0) #define NEEDEDNS0(f) (((f)->attributes & FCTX_ATTR_NEEDEDNS0) != 0) @@ -353,6 +354,8 @@ struct dns_resolver { #define NXDOMAIN(r) (((r)->attributes & DNS_RDATASETATTR_NXDOMAIN) != 0) +#define dns_db_transfernode(a,b,c) do { (*c) = (*b); (*b) = NULL; } while (0) + static void destroy(dns_resolver_t *res); static void empty_bucket(dns_resolver_t *res); static isc_result_t resquery_send(resquery_t *query); @@ -394,9 +397,13 @@ valcreate(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, dns_name_t *name, sigrdataset, fctx->rmessage, valoptions, task, validated, valarg, &validator); - if (result == ISC_R_SUCCESS) + if (result == ISC_R_SUCCESS) { + if ((valoptions & DNS_VALIDATOR_DEFER) == 0) { + INSIST(fctx->validator == NULL); + fctx->validator = validator; + } ISC_LIST_APPEND(fctx->validators, validator, link); - else + } else isc_mem_put(fctx->res->buckets[fctx->bucketnum].mctx, valarg, sizeof(*valarg)); return (result); @@ -793,6 +800,15 @@ fctx_sendevents(fetchctx_t *fctx, isc_result_t result) { fctx->type == dns_rdatatype_any || fctx->type == dns_rdatatype_rrsig || fctx->type == dns_rdatatype_sig); + + /* + * Negative results must be indicated in event->result. + */ + if (dns_rdataset_isassociated(event->rdataset) && + event->rdataset->type == dns_rdatatype_none) { + INSIST(event->result == DNS_R_NCACHENXDOMAIN || + event->result == DNS_R_NCACHENXRRSET); + } isc_task_sendanddetach(&task, ISC_EVENT_PTR(&event)); count++; @@ -802,17 +818,17 @@ fctx_sendevents(fetchctx_t *fctx, isc_result_t result) { fctx->spilled && (count < fctx->res->spillatmax || fctx->res->spillatmax == 0)) { LOCK(&fctx->res->lock); - if (count == fctx->res->spillat && !fctx->res->exiting) { + if (count == fctx->res->spillat && !fctx->res->exiting) { fctx->res->spillat += 5; if (fctx->res->spillat > fctx->res->spillatmax && fctx->res->spillatmax != 0) fctx->res->spillat = fctx->res->spillatmax; + logit = ISC_TRUE; isc_interval_set(&i, 20 * 60, 0); result = isc_timer_reset(fctx->res->spillattimer, isc_timertype_ticker, NULL, &i, ISC_TRUE); RUNTIME_CHECK(result == ISC_R_SUCCESS); - logit = ISC_TRUE; } UNLOCK(&fctx->res->lock); if (logit) @@ -1067,7 +1083,7 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, isc_netaddr_t dstip; isc_netaddr_fromsockaddr(&dstip, &addrinfo->sockaddr); result = dns_peerlist_peerbyaddr(res->view->peers, - &dstip, &peer); + &dstip, &peer); if (result == ISC_R_SUCCESS) { result = dns_peer_getquerysource(peer, &addr); if (result == ISC_R_SUCCESS) @@ -1433,7 +1449,7 @@ resquery_send(resquery_t *query) { FCTXTRACE("too many timeouts, disabling EDNS0"); } else if ((triededns(fctx, &query->addrinfo->sockaddr) || fctx->timeouts >= MAX_EDNS0_TIMEOUTS) && - (query->options & DNS_FETCHOPT_NOEDNS0) == 0) { + (query->options & DNS_FETCHOPT_NOEDNS0) == 0) { query->options |= DNS_FETCHOPT_EDNS512; FCTXTRACE("too many timeouts, setting EDNS size to 512"); } @@ -1841,7 +1857,7 @@ mark_bad(fetchctx_t *fctx) { } static void -add_bad(fetchctx_t *fctx, isc_sockaddr_t *address, isc_result_t reason) { +add_bad(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, isc_result_t reason) { char namebuf[DNS_NAME_FORMATSIZE]; char addrbuf[ISC_SOCKADDR_FORMATSIZE]; char classbuf[64]; @@ -1850,6 +1866,7 @@ add_bad(fetchctx_t *fctx, isc_sockaddr_t *address, isc_result_t reason) { isc_buffer_t b; isc_sockaddr_t *sa; const char *sep1, *sep2; + isc_sockaddr_t *address = &addrinfo->sockaddr; if (bad_server(fctx, address)) { /* @@ -1870,6 +1887,11 @@ add_bad(fetchctx_t *fctx, isc_sockaddr_t *address, isc_result_t reason) { if (reason == DNS_R_LAME) /* already logged */ return; + if (reason == DNS_R_UNEXPECTEDRCODE && + fctx->rmessage->opcode == dns_rcode_servfail && + ISFORWARDER(addrinfo)) + return; + if (reason == DNS_R_UNEXPECTEDRCODE) { isc_buffer_init(&b, code, sizeof(code) - 1); dns_rcode_totext(fctx->rmessage->rcode, &b); @@ -2957,6 +2979,7 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type, ISC_LIST_INIT(fctx->edns); ISC_LIST_INIT(fctx->edns512); ISC_LIST_INIT(fctx->validators); + fctx->validator = NULL; fctx->find = NULL; fctx->altfind = NULL; fctx->pending = 0; @@ -3166,7 +3189,7 @@ is_lame(fetchctx_t *fctx) { if (rdataset->type != dns_rdatatype_ns) continue; namereln = dns_name_fullcompare(name, &fctx->domain, - &order, &labels); + &order, &labels); if (namereln == dns_namereln_equal && (message->flags & DNS_MESSAGEFLAG_AA) != 0) return (ISC_FALSE); @@ -3295,7 +3318,7 @@ maybe_destroy(fetchctx_t *fctx) { unsigned int bucketnum; isc_boolean_t bucket_empty = ISC_FALSE; dns_resolver_t *res = fctx->res; - dns_validator_t *validator; + dns_validator_t *validator, *next_validator; REQUIRE(SHUTTINGDOWN(fctx)); @@ -3303,16 +3326,22 @@ maybe_destroy(fetchctx_t *fctx) { return; for (validator = ISC_LIST_HEAD(fctx->validators); - validator != NULL; - validator = ISC_LIST_HEAD(fctx->validators)) { - ISC_LIST_UNLINK(fctx->validators, validator, link); + validator != NULL; validator = next_validator) { + next_validator = ISC_LIST_NEXT(validator, link); dns_validator_cancel(validator); + /* + * If this is a active validator wait for the cancel + * to complete before calling dns_validator_destroy(). + */ + if (validator == fctx->validator) + continue; + ISC_LIST_UNLINK(fctx->validators, validator, link); dns_validator_destroy(&validator); } bucketnum = fctx->bucketnum; LOCK(&res->buckets[bucketnum].lock); - if (fctx->references == 0) + if (fctx->references == 0 && ISC_LIST_EMPTY(fctx->validators)) bucket_empty = fctx_destroy(fctx); UNLOCK(&res->buckets[bucketnum].lock); @@ -3359,6 +3388,7 @@ validated(isc_task_t *task, isc_event_t *event) { FCTXTRACE("received validation completion event"); ISC_LIST_UNLINK(fctx->validators, vevent->validator, link); + fctx->validator = NULL; /* * Destroy the validator early so that we can @@ -3441,12 +3471,14 @@ validated(isc_task_t *task, isc_event_t *event) { if (result == ISC_R_SUCCESS) dns_db_detachnode(fctx->cache, &node); result = vevent->result; - add_bad(fctx, &addrinfo->sockaddr, result); + add_bad(fctx, addrinfo, result); isc_event_free(&event); UNLOCK(&fctx->res->buckets[fctx->bucketnum].lock); - if (!ISC_LIST_EMPTY(fctx->validators)) - dns_validator_send(ISC_LIST_HEAD(fctx->validators)); - else if (sentresponse) + INSIST(fctx->validator == NULL); + fctx->validator = ISC_LIST_HEAD(fctx->validators); + if (fctx->validator != NULL) { + dns_validator_send(fctx->validator); + } else if (sentresponse) fctx_done(fctx, result); /* Locks bucket. */ else fctx_try(fctx); /* Locks bucket. */ @@ -3514,7 +3546,12 @@ validated(isc_task_t *task, isc_event_t *event) { if (result != ISC_R_SUCCESS && result != DNS_R_UNCHANGED) goto noanswer_response; - if (vevent->sigrdataset != NULL) { + if (ardataset != NULL && ardataset->type == 0) { + if (NXDOMAIN(ardataset)) + eresult = DNS_R_NCACHENXDOMAIN; + else + eresult = DNS_R_NCACHENXRRSET; + } else if (vevent->sigrdataset != NULL) { result = dns_db_addrdataset(fctx->cache, node, NULL, now, vevent->sigrdataset, 0, asigrdataset); @@ -3528,6 +3565,7 @@ validated(isc_task_t *task, isc_event_t *event) { * If we only deferred the destroy because we wanted to cache * the data, destroy now. */ + dns_db_detachnode(fctx->cache, &node); UNLOCK(&fctx->res->buckets[fctx->bucketnum].lock); if (SHUTTINGDOWN(fctx)) maybe_destroy(fctx); /* Locks bucket. */ @@ -3544,6 +3582,7 @@ validated(isc_task_t *task, isc_event_t *event) { * more rdatasets that still need to * be validated. */ + dns_db_detachnode(fctx->cache, &node); UNLOCK(&fctx->res->buckets[fctx->bucketnum].lock); dns_validator_send(ISC_LIST_HEAD(fctx->validators)); goto cleanup_event; @@ -3609,8 +3648,7 @@ validated(isc_task_t *task, isc_event_t *event) { dns_fixedname_name(&hevent->foundname), NULL) == ISC_R_SUCCESS); dns_db_attach(fctx->cache, &hevent->db); - hevent->node = node; - node = NULL; + dns_db_transfernode(fctx->cache, &node, &hevent->node); clone_results(fctx); } @@ -3623,12 +3661,14 @@ validated(isc_task_t *task, isc_event_t *event) { fctx_done(fctx, result); /* Locks bucket. */ cleanup_event: + INSIST(node == NULL); isc_event_free(&event); } static inline isc_result_t cache_name(fetchctx_t *fctx, dns_name_t *name, dns_adbaddrinfo_t *addrinfo, - isc_stdtime_t now) { + isc_stdtime_t now) +{ dns_rdataset_t *rdataset, *sigrdataset; dns_rdataset_t *addedrdataset, *ardataset, *asigrdataset; dns_rdataset_t *valrdataset = NULL, *valsigrdataset = NULL; @@ -3742,8 +3782,10 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_adbaddrinfo_t *addrinfo, fail ? "failure" : "warning", namebuf, typebuf, classbuf); if (fail) { - if (ANSWER(rdataset)) + if (ANSWER(rdataset)) { + dns_db_detachnode(fctx->cache, &node); return (DNS_R_BADNAME); + } continue; } } @@ -3808,8 +3850,29 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_adbaddrinfo_t *addrinfo, result = dns_db_addrdataset(fctx->cache, node, NULL, now, rdataset, 0, addedrdataset); - if (result == DNS_R_UNCHANGED) + if (result == DNS_R_UNCHANGED) { result = ISC_R_SUCCESS; + if (!need_validation && + ardataset != NULL && + ardataset->type == 0) { + /* + * The answer in the cache is better + * than the answer we found, and is + * a negative cache entry, so we + * must set eresult appropriately. + */ + if (NXDOMAIN(ardataset)) + eresult = DNS_R_NCACHENXDOMAIN; + else + eresult = DNS_R_NCACHENXRRSET; + /* + * We have a negative response from + * the cache so don't attempt to + * add the RRSIG rrset. + */ + continue; + } + } if (result != ISC_R_SUCCESS) break; if (sigrdataset != NULL) { @@ -3926,12 +3989,10 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_adbaddrinfo_t *addrinfo, * a negative cache entry, so we * must set eresult appropriately. */ - if (NXDOMAIN(ardataset)) - eresult = - DNS_R_NCACHENXDOMAIN; - else - eresult = - DNS_R_NCACHENXRRSET; + if (NXDOMAIN(ardataset)) + eresult = DNS_R_NCACHENXDOMAIN; + else + eresult = DNS_R_NCACHENXRRSET; } result = ISC_R_SUCCESS; } else if (result != ISC_R_SUCCESS) @@ -3942,15 +4003,22 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_adbaddrinfo_t *addrinfo, if (valrdataset != NULL) result = valcreate(fctx, addrinfo, name, fctx->type, valrdataset, valsigrdataset, valoptions, - task); + task); if (result == ISC_R_SUCCESS && have_answer) { fctx->attributes |= FCTX_ATTR_HAVEANSWER; if (event != NULL) { + /* + * Negative results must be indicated in event->result. + */ + if (dns_rdataset_isassociated(event->rdataset) && + event->rdataset->type == dns_rdatatype_none) { + INSIST(eresult == DNS_R_NCACHENXDOMAIN || + eresult == DNS_R_NCACHENXRRSET); + } event->result = eresult; dns_db_attach(fctx->cache, adbp); - *anodep = node; - node = NULL; + dns_db_transfernode(fctx->cache, &node, anodep); clone_results(fctx); } } @@ -4190,8 +4258,7 @@ ncache_message(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, if (event != NULL) { event->result = eresult; dns_db_attach(fctx->cache, adbp); - *anodep = node; - node = NULL; + dns_db_transfernode(fctx->cache, &node, anodep); clone_results(fctx); } } @@ -5830,7 +5897,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) { * Add this server to the list of bad servers for * this fctx. */ - add_bad(fctx, &addrinfo->sockaddr, broken_server); + add_bad(fctx, addrinfo, broken_server); } if (get_nameservers) { @@ -5912,7 +5979,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) { fctx_done(fctx, result); } else if (result == DNS_R_CHASEDSSERVERS) { unsigned int n; - add_bad(fctx, &addrinfo->sockaddr, result); + add_bad(fctx, addrinfo, result); fctx_cancelqueries(fctx, ISC_TRUE); fctx_cleanupfinds(fctx); fctx_cleanupforwaddrs(fctx); @@ -7024,7 +7091,7 @@ static isc_boolean_t yes = ISC_TRUE, no = ISC_FALSE; isc_result_t dns_resolver_setmustbesecure(dns_resolver_t *resolver, dns_name_t *name, - isc_boolean_t value) + isc_boolean_t value) { isc_result_t result; diff --git a/contrib/bind9/lib/dns/rootns.c b/contrib/bind9/lib/dns/rootns.c index 1c038a4..f20a49d 100644 --- a/contrib/bind9/lib/dns/rootns.c +++ b/contrib/bind9/lib/dns/rootns.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2002 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: rootns.c,v 1.26.18.3 2005/04/27 05:01:26 sra Exp $ */ +/* $Id: rootns.c,v 1.26.18.5 2007/10/31 03:02:45 tbox Exp $ */ /*! \file */ @@ -72,7 +72,7 @@ static char root_ns[] = "I.ROOT-SERVERS.NET. 3600000 IN A 192.36.148.17\n" "J.ROOT-SERVERS.NET. 3600000 IN A 192.58.128.30\n" "K.ROOT-SERVERS.NET. 3600000 IN A 193.0.14.129\n" -"L.ROOT-SERVERS.NET. 3600000 IN A 198.32.64.12\n" +"L.ROOT-SERVERS.NET. 3600000 IN A 199.7.83.42\n" "M.ROOT-SERVERS.NET. 3600000 IN A 202.12.27.33\n"; static isc_result_t diff --git a/contrib/bind9/lib/dns/sdb.c b/contrib/bind9/lib/dns/sdb.c index 79ddef2..fe53778 100644 --- a/contrib/bind9/lib/dns/sdb.c +++ b/contrib/bind9/lib/dns/sdb.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001, 2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: sdb.c,v 1.45.18.10 2006/12/07 23:57:58 marka Exp $ */ +/* $Id: sdb.c,v 1.45.18.13 2007/08/28 07:20:05 tbox Exp $ */ /*! \file */ @@ -121,6 +121,10 @@ typedef struct sdb_rdatasetiter { /* This is a reasonable value */ #define SDB_DEFAULT_TTL (60 * 60 * 24) +#ifdef __COVERITY__ +#define MAYBE_LOCK(sdb) LOCK(&sdb->implementation->driverlock) +#define MAYBE_UNLOCK(sdb) UNLOCK(&sdb->implementation->driverlock) +#else #define MAYBE_LOCK(sdb) \ do { \ unsigned int flags = sdb->implementation->flags; \ @@ -134,6 +138,7 @@ typedef struct sdb_rdatasetiter { if ((flags & DNS_SDBFLAG_THREADSAFE) == 0) \ UNLOCK(&sdb->implementation->driverlock); \ } while (0) +#endif static int dummy; diff --git a/contrib/bind9/lib/dns/sdlz.c b/contrib/bind9/lib/dns/sdlz.c index 2c6ba8d..b91f825 100644 --- a/contrib/bind9/lib/dns/sdlz.c +++ b/contrib/bind9/lib/dns/sdlz.c @@ -2,7 +2,7 @@ * Portions Copyright (C) 2005-2007 Internet Systems Consortium, Inc. ("ISC") * Portions Copyright (C) 1999-2001 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -50,7 +50,7 @@ * USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: sdlz.c,v 1.2.2.9 2007/02/14 23:45:43 marka Exp $ */ +/* $Id: sdlz.c,v 1.2.2.11 2007/08/28 07:20:05 tbox Exp $ */ /*! \file */ @@ -166,6 +166,10 @@ typedef struct sdlz_rdatasetiter { static int dummy; +#ifdef __COVERITY__ +#define MAYBE_LOCK(imp) LOCK(&imp->driverlock) +#define MAYBE_UNLOCK(imp) UNLOCK(&imp->driverlock) +#else #define MAYBE_LOCK(imp) \ do { \ unsigned int flags = imp->flags; \ @@ -179,6 +183,7 @@ static int dummy; if ((flags & DNS_SDLZFLAG_THREADSAFE) == 0) \ UNLOCK(&imp->driverlock); \ } while (0) +#endif /* * Forward references. Try to keep these to a minimum. diff --git a/contrib/bind9/lib/dns/tsig.c b/contrib/bind9/lib/dns/tsig.c index c5107b5..cca1f99 100644 --- a/contrib/bind9/lib/dns/tsig.c +++ b/contrib/bind9/lib/dns/tsig.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2002 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -16,7 +16,7 @@ */ /* - * $Id: tsig.c,v 1.117.18.9 2006/05/02 04:23:12 marka Exp $ + * $Id: tsig.c,v 1.117.18.11 2007/09/26 23:46:34 tbox Exp $ */ /*! \file */ #include <config.h> @@ -1429,8 +1429,10 @@ dns_tsigkeyring_create(isc_mem_t *mctx, dns_tsig_keyring_t **ringp) { return (ISC_R_NOMEMORY); result = isc_rwlock_init(&ring->lock, 0, 0); - if (result != ISC_R_SUCCESS) + if (result != ISC_R_SUCCESS) { + isc_mem_put(mctx, ring, sizeof(dns_tsig_keyring_t)); return (result); + } ring->keys = NULL; result = dns_rbt_create(mctx, free_tsignode, NULL, &ring->keys); diff --git a/contrib/bind9/lib/dns/validator.c b/contrib/bind9/lib/dns/validator.c index a92d647..9538b302 100644 --- a/contrib/bind9/lib/dns/validator.c +++ b/contrib/bind9/lib/dns/validator.c @@ -2,7 +2,7 @@ * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: validator.c,v 1.119.18.29 2007/01/08 02:41:59 marka Exp $ */ +/* $Id: validator.c,v 1.119.18.35 2007/09/26 04:39:45 each Exp $ */ /*! \file */ @@ -26,6 +26,7 @@ #include <isc/string.h> #include <isc/task.h> #include <isc/util.h> +#include <isc/sha2.h> #include <dns/db.h> #include <dns/ds.h> @@ -88,6 +89,7 @@ #define VALID_VALIDATOR(v) ISC_MAGIC_VALID(v, VALIDATOR_MAGIC) #define VALATTR_SHUTDOWN 0x0001 /*%< Shutting down. */ +#define VALATTR_CANCELED 0x0002 /*%< Cancelled. */ #define VALATTR_TRIEDVERIFY 0x0004 /*%< We have found a key and * have attempted a verify. */ #define VALATTR_INSECURITY 0x0010 /*%< Attempting proveunsecure. */ @@ -113,6 +115,7 @@ #define DLVTRIED(val) ((val->attributes & VALATTR_DLVTRIED) != 0) #define SHUTDOWN(v) (((v)->attributes & VALATTR_SHUTDOWN) != 0) +#define CANCELED(v) (((v)->attributes & VALATTR_CANCELED) != 0) static void destroy(dns_validator_t *val); @@ -279,7 +282,9 @@ fetch_callback_validator(isc_task_t *task, isc_event_t *event) { validator_log(val, ISC_LOG_DEBUG(3), "in fetch_callback_validator"); LOCK(&val->lock); - if (eresult == ISC_R_SUCCESS) { + if (CANCELED(val)) { + validator_done(val, ISC_R_CANCELED); + } else if (eresult == ISC_R_SUCCESS) { validator_log(val, ISC_LOG_DEBUG(3), "keyset with trust %d", rdataset->trust); /* @@ -343,7 +348,9 @@ dsfetched(isc_task_t *task, isc_event_t *event) { validator_log(val, ISC_LOG_DEBUG(3), "in dsfetched"); LOCK(&val->lock); - if (eresult == ISC_R_SUCCESS) { + if (CANCELED(val)) { + validator_done(val, ISC_R_CANCELED); + } else if (eresult == ISC_R_SUCCESS) { validator_log(val, ISC_LOG_DEBUG(3), "dsset with trust %d", rdataset->trust); val->dsset = &val->frdataset; @@ -351,10 +358,12 @@ dsfetched(isc_task_t *task, isc_event_t *event) { if (result != DNS_R_WAIT) validator_done(val, result); } else if (eresult == DNS_R_NXRRSET || - eresult == DNS_R_NCACHENXRRSET) + eresult == DNS_R_NCACHENXRRSET || + eresult == DNS_R_SERVFAIL) /* RFC 1034 parent? */ { validator_log(val, ISC_LOG_DEBUG(3), - "falling back to insecurity proof"); + "falling back to insecurity proof (%s)", + dns_result_totext(eresult)); val->attributes |= VALATTR_INSECURITY; result = proveunsecure(val, ISC_FALSE); if (result != DNS_R_WAIT) @@ -414,7 +423,9 @@ dsfetched2(isc_task_t *task, isc_event_t *event) { validator_log(val, ISC_LOG_DEBUG(3), "in dsfetched2: %s", dns_result_totext(eresult)); LOCK(&val->lock); - if (eresult == DNS_R_NXRRSET || eresult == DNS_R_NCACHENXRRSET) { + if (CANCELED(val)) { + validator_done(val, ISC_R_CANCELED); + } else if (eresult == DNS_R_NXRRSET || eresult == DNS_R_NCACHENXRRSET) { /* * There is no DS. If this is a delegation, we're done. */ @@ -489,7 +500,9 @@ keyvalidated(isc_task_t *task, isc_event_t *event) { validator_log(val, ISC_LOG_DEBUG(3), "in keyvalidated"); LOCK(&val->lock); - if (eresult == ISC_R_SUCCESS) { + if (CANCELED(val)) { + validator_done(val, ISC_R_CANCELED); + } else if (eresult == ISC_R_SUCCESS) { validator_log(val, ISC_LOG_DEBUG(3), "keyset with trust %d", val->frdataset.trust); /* @@ -539,7 +552,9 @@ dsvalidated(isc_task_t *task, isc_event_t *event) { validator_log(val, ISC_LOG_DEBUG(3), "in dsvalidated"); LOCK(&val->lock); - if (eresult == ISC_R_SUCCESS) { + if (CANCELED(val)) { + validator_done(val, ISC_R_CANCELED); + } else if (eresult == ISC_R_SUCCESS) { validator_log(val, ISC_LOG_DEBUG(3), "dsset with trust %d", val->frdataset.trust); if ((val->attributes & VALATTR_INSECURITY) != 0) @@ -748,7 +763,9 @@ authvalidated(isc_task_t *task, isc_event_t *event) { validator_log(val, ISC_LOG_DEBUG(3), "in authvalidated"); LOCK(&val->lock); - if (result != ISC_R_SUCCESS) { + if (CANCELED(val)) { + validator_done(val, ISC_R_CANCELED); + } else if (result != ISC_R_SUCCESS) { validator_log(val, ISC_LOG_DEBUG(3), "authvalidated: got %s", isc_result_totext(result)); @@ -1504,7 +1521,8 @@ dlv_validatezonekey(dns_validator_t *val) { dlv.algorithm)) continue; - if (dlv.digest_type == DNS_DSDIGEST_SHA256) { + if (dlv.digest_type == DNS_DSDIGEST_SHA256 && + dlv.length == ISC_SHA256_DIGESTLENGTH) { digest_type = DNS_DSDIGEST_SHA256; break; } @@ -1837,7 +1855,8 @@ validatezonekey(dns_validator_t *val) { ds.algorithm)) continue; - if (ds.digest_type == DNS_DSDIGEST_SHA256) { + if (ds.digest_type == DNS_DSDIGEST_SHA256 && + ds.length == ISC_SHA256_DIGESTLENGTH) { digest_type = DNS_DSDIGEST_SHA256; break; } @@ -2373,6 +2392,10 @@ finddlvsep(dns_validator_t *val, isc_boolean_t resume) { dns_fixedname_init(&val->dlvsep); dlvsep = dns_fixedname_name(&val->dlvsep); dns_name_copy(val->event->name, dlvsep, NULL); + /* + * If this is a response to a DS query, we need to look in + * the parent zone for the trust anchor. + */ if (val->event->type == dns_rdatatype_ds) { labels = dns_name_countlabels(dlvsep); if (labels == 0) @@ -2475,9 +2498,16 @@ proveunsecure(dns_validator_t *val, isc_boolean_t resume) { if (val->havedlvsep) dns_name_copy(dns_fixedname_name(&val->dlvsep), secroot, NULL); else { + dns_name_copy(val->event->name, secroot, NULL); + /* + * If this is a response to a DS query, we need to look in + * the parent zone for the trust anchor. + */ + if (val->event->type == dns_rdatatype_ds && + dns_name_countlabels(secroot) > 1U) + dns_name_split(secroot, 1, NULL, secroot); result = dns_keytable_finddeepestmatch(val->keytable, - val->event->name, - secroot); + secroot, secroot); if (result == ISC_R_NOTFOUND) { validator_log(val, ISC_LOG_DEBUG(3), @@ -2814,7 +2844,6 @@ dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type, dns_validatorevent_t *event; REQUIRE(name != NULL); - REQUIRE(type != 0); REQUIRE(rdataset != NULL || (rdataset == NULL && sigrdataset == NULL && message != NULL)); REQUIRE(validatorp != NULL && *validatorp == NULL); @@ -2930,6 +2959,7 @@ dns_validator_cancel(dns_validator_t *validator) { isc_event_free((isc_event_t **)&validator->event); isc_task_detach(&task); } + validator->attributes |= VALATTR_CANCELED; } UNLOCK(&validator->lock); } diff --git a/contrib/bind9/lib/dns/view.c b/contrib/bind9/lib/dns/view.c index 4938597..d5a78d5 100644 --- a/contrib/bind9/lib/dns/view.c +++ b/contrib/bind9/lib/dns/view.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: view.c,v 1.126.18.11 2006/03/09 23:38:21 marka Exp $ */ +/* $Id: view.c,v 1.126.18.14 2007/08/28 07:20:05 tbox Exp $ */ /*! \file */ @@ -703,6 +703,7 @@ dns_view_find(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type, REQUIRE(view->frozen); REQUIRE(type != dns_rdatatype_rrsig); REQUIRE(rdataset != NULL); /* XXXBEW - remove this */ + REQUIRE(nodep == NULL || *nodep == NULL); /* * Initialize. diff --git a/contrib/bind9/lib/dns/xfrin.c b/contrib/bind9/lib/dns/xfrin.c index bec8501..dd7801d 100644 --- a/contrib/bind9/lib/dns/xfrin.c +++ b/contrib/bind9/lib/dns/xfrin.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: xfrin.c,v 1.135.18.11 2006/07/19 00:58:01 marka Exp $ */ +/* $Id: xfrin.c,v 1.135.18.16 2007/10/31 01:59:47 marka Exp $ */ /*! \file */ @@ -722,6 +722,11 @@ xfrin_fail(dns_xfrin_ctx_t *xfr, isc_result_t result, const char *msg) { result = DNS_R_BADIXFR; } xfrin_cancelio(xfr); + /* + * Close the journal. + */ + if (xfr->ixfr.journal != NULL) + dns_journal_destroy(&xfr->ixfr.journal); if (xfr->done != NULL) { (xfr->done)(xfr->zone, result); xfr->done = NULL; @@ -1043,6 +1048,7 @@ xfrin_send_request(dns_xfrin_ctx_t *xfr) { xfr->checkid = ISC_TRUE; xfr->id++; + xfr->nmsg = 0; msg->id = xfr->id; CHECK(render(msg, xfr->mctx, &xfr->qbuffer)); @@ -1304,6 +1310,11 @@ xfrin_recv_done(isc_task_t *task, isc_event_t *ev) { CHECK(xfrin_send_request(xfr)); } else if (xfr->state == XFRST_END) { /* + * Close the journal. + */ + if (xfr->ixfr.journal != NULL) + dns_journal_destroy(&xfr->ixfr.journal); + /* * Inform the caller we succeeded. */ if (xfr->done != NULL) { diff --git a/contrib/bind9/lib/dns/zone.c b/contrib/bind9/lib/dns/zone.c index 5a73796..fa6ac46 100644 --- a/contrib/bind9/lib/dns/zone.c +++ b/contrib/bind9/lib/dns/zone.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: zone.c,v 1.410.18.47 2006/12/07 06:21:16 marka Exp $ */ +/* $Id: zone.c,v 1.410.18.52 2007/08/30 05:15:03 marka Exp $ */ /*! \file */ @@ -253,6 +253,11 @@ struct dns_zone { isc_uint32_t notifydelay; dns_isselffunc_t isself; void *isselfarg; + + /*% + * Serial number for deferred journal compaction. + */ + isc_uint32_t compact_serial; }; #define DNS_ZONE_FLAG(z,f) (ISC_TF(((z)->flags & (f)) != 0)) @@ -298,6 +303,7 @@ struct dns_zone { #define DNS_ZONEFLG_NOEDNS 0x00400000U #define DNS_ZONEFLG_USEALTXFRSRC 0x00800000U #define DNS_ZONEFLG_SOABEFOREAXFR 0x01000000U +#define DNS_ZONEFLG_NEEDCOMPACT 0x02000000U #define DNS_ZONE_OPTION(z,o) (((z)->options & (o)) != 0) @@ -1138,7 +1144,8 @@ zone_load(dns_zone_t *zone, unsigned int flags) { result = isc_file_getmodtime(zone->masterfile, &filetime); if (result == ISC_R_SUCCESS) { - if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_HASINCLUDE) && + if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADED) && + !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_HASINCLUDE) && isc_time_compare(&filetime, &zone->loadtime) <= 0) { dns_zone_log(zone, ISC_LOG_DEBUG(1), "skipping load: master file " @@ -3193,6 +3200,9 @@ dump_done(void *arg, isc_result_t result) { dns_db_t *db; dns_dbversion_t *version; isc_boolean_t again = ISC_FALSE; + isc_boolean_t compact = ISC_FALSE; + isc_uint32_t serial; + isc_result_t tresult; REQUIRE(DNS_ZONE_VALID(zone)); @@ -3200,8 +3210,6 @@ dump_done(void *arg, isc_result_t result) { if (result == ISC_R_SUCCESS && zone->journal != NULL && zone->journalsize != -1) { - isc_uint32_t serial; - isc_result_t tresult; /* * We don't own these, zone->dctx must stay valid. @@ -3210,7 +3218,11 @@ dump_done(void *arg, isc_result_t result) { version = dns_dumpctx_version(zone->dctx); tresult = dns_db_getsoaserial(db, version, &serial); - if (tresult == ISC_R_SUCCESS) { + /* + * Note: we are task locked here so we can test + * zone->xfr safely. + */ + if (tresult == ISC_R_SUCCESS && zone->xfr == NULL) { tresult = dns_journal_compact(zone->mctx, zone->journal, serial, @@ -3229,11 +3241,16 @@ dump_done(void *arg, isc_result_t result) { dns_result_totext(tresult)); break; } + } else if (tresult == ISC_R_SUCCESS) { + compact = ISC_TRUE; + zone->compact_serial = serial; } } LOCK_ZONE(zone); DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_DUMPING); + if (compact) + DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_NEEDCOMPACT); if (result != ISC_R_SUCCESS && result != ISC_R_CANCELED) { /* * Try again in a short while. @@ -5461,7 +5478,6 @@ notify_createmessage(dns_zone_t *zone, unsigned int flags, REQUIRE(DNS_ZONE_VALID(zone)); REQUIRE(messagep != NULL && *messagep == NULL); - message = NULL; result = dns_message_create(zone->mctx, DNS_MESSAGE_INTENTRENDER, &message); if (result != ISC_R_SUCCESS) @@ -5588,8 +5604,7 @@ notify_createmessage(dns_zone_t *zone, unsigned int flags, dns_message_puttempname(message, &tempname); if (temprdataset != NULL) dns_message_puttemprdataset(message, &temprdataset); - if (message != NULL) - dns_message_destroy(&message); + dns_message_destroy(&message); return (result); } @@ -6627,6 +6642,30 @@ zone_xfrdone(dns_zone_t *zone, isc_result_t result) { dns_tsigkey_detach(&zone->tsigkey); /* + * Handle any deferred journal compaction. + */ + if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDCOMPACT)) { + result = dns_journal_compact(zone->mctx, zone->journal, + zone->compact_serial, + zone->journalsize); + switch (result) { + case ISC_R_SUCCESS: + case ISC_R_NOSPACE: + case ISC_R_NOTFOUND: + dns_zone_log(zone, ISC_LOG_DEBUG(3), + "dns_journal_compact: %s", + dns_result_totext(result)); + break; + default: + dns_zone_log(zone, ISC_LOG_ERROR, + "dns_journal_compact failed: %s", + dns_result_totext(result)); + break; + } + DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_NEEDCOMPACT); + } + + /* * This transfer finishing freed up a transfer quota slot. * Let any other zones waiting for quota have it. */ diff --git a/contrib/bind9/lib/isc/Makefile.in b/contrib/bind9/lib/isc/Makefile.in index c03a3df..71e4252 100644 --- a/contrib/bind9/lib/isc/Makefile.in +++ b/contrib/bind9/lib/isc/Makefile.in @@ -1,7 +1,7 @@ -# Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 1998-2003 Internet Software Consortium. # -# Permission to use, copy, modify, and distribute this software for any +# Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above # copyright notice and this permission notice appear in all copies. # @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: Makefile.in,v 1.81.18.6 2006/01/27 23:57:45 marka Exp $ +# $Id: Makefile.in,v 1.81.18.8 2007/09/14 23:46:18 tbox Exp $ srcdir = @srcdir@ VPATH = @srcdir@ @@ -76,7 +76,7 @@ SRCS = @ISC_EXTRA_SRCS@ \ LIBS = @LIBS@ -SUBDIRS = include unix nls @ISC_THREAD_DIR@ +SUBDIRS = include unix nls @ISC_THREAD_DIR@ @ISC_ARCH_DIR@ TARGETS = timestamp @BIND9_MAKE_RULES@ diff --git a/contrib/bind9/lib/isc/alpha/Makefile.in b/contrib/bind9/lib/isc/alpha/Makefile.in new file mode 100644 index 0000000..c8e77e4 --- /dev/null +++ b/contrib/bind9/lib/isc/alpha/Makefile.in @@ -0,0 +1,24 @@ +# Copyright (C) 2007 Internet Systems Consortium, Inc. ("ISC") +# +# Permission to use, copy, modify, and/or distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +# PERFORMANCE OF THIS SOFTWARE. + +# $Id: Makefile.in,v 1.2.2.1 2007/09/14 04:26:38 marka Exp $ + +srcdir = @srcdir@ +VPATH = @srcdir@ +top_srcdir = @top_srcdir@ + +SUBDIRS = include +TARGETS = + +@BIND9_MAKE_RULES@ diff --git a/contrib/bind9/lib/isc/alpha/include/Makefile.in b/contrib/bind9/lib/isc/alpha/include/Makefile.in new file mode 100644 index 0000000..f4dd2f6 --- /dev/null +++ b/contrib/bind9/lib/isc/alpha/include/Makefile.in @@ -0,0 +1,24 @@ +# Copyright (C) 2007 Internet Systems Consortium, Inc. ("ISC") +# +# Permission to use, copy, modify, and/or distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +# PERFORMANCE OF THIS SOFTWARE. + +# $Id: Makefile.in,v 1.2.2.1 2007/09/14 04:26:38 marka Exp $ + +srcdir = @srcdir@ +VPATH = @srcdir@ +top_srcdir = @top_srcdir@ + +SUBDIRS = isc +TARGETS = + +@BIND9_MAKE_RULES@ diff --git a/contrib/bind9/lib/isc/alpha/include/isc/Makefile.in b/contrib/bind9/lib/isc/alpha/include/isc/Makefile.in new file mode 100644 index 0000000..6760ce6 --- /dev/null +++ b/contrib/bind9/lib/isc/alpha/include/isc/Makefile.in @@ -0,0 +1,36 @@ +# Copyright (C) 2007 Internet Systems Consortium, Inc. ("ISC") +# +# Permission to use, copy, modify, and/or distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +# PERFORMANCE OF THIS SOFTWARE. + +# $Id: Makefile.in,v 1.2.2.1 2007/09/14 04:26:38 marka Exp $ + +srcdir = @srcdir@ +VPATH = @srcdir@ +top_srcdir = @top_srcdir@ + +@BIND9_VERSION@ + +HEADERS = atomic.h + +SUBDIRS = +TARGETS = + +@BIND9_MAKE_RULES@ + +installdirs: + $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${includedir}/isc + +install:: installdirs + for i in ${HEADERS}; do \ + ${INSTALL_DATA} $(srcdir)/$$i ${DESTDIR}${includedir}/isc ; \ + done diff --git a/contrib/bind9/lib/isc/api b/contrib/bind9/lib/isc/api index 759a051..ecadc93 100644 --- a/contrib/bind9/lib/isc/api +++ b/contrib/bind9/lib/isc/api @@ -1,3 +1,3 @@ LIBINTERFACE = 32 -LIBREVISION = 3 +LIBREVISION = 5 LIBAGE = 0 diff --git a/contrib/bind9/lib/isc/hmacsha.c b/contrib/bind9/lib/isc/hmacsha.c index 8ee16af..7ee13f7 100644 --- a/contrib/bind9/lib/isc/hmacsha.c +++ b/contrib/bind9/lib/isc/hmacsha.c @@ -1,7 +1,7 @@ /* - * Copyright (C) 2005, 2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2005-2007 Internet Systems Consortium, Inc. ("ISC") * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -14,7 +14,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: hmacsha.c,v 1.2.2.4 2006/08/16 03:18:14 marka Exp $ */ +/* $Id: hmacsha.c,v 1.2.2.7 2007/08/28 07:20:06 tbox Exp $ */ /* * This code implements the HMAC-SHA1, HMAC-SHA224, HMAC-SHA256, HMAC-SHA384 @@ -112,7 +112,7 @@ isc_boolean_t isc_hmacsha1_verify(isc_hmacsha1_t *ctx, unsigned char *digest, size_t len) { unsigned char newdigest[ISC_SHA1_DIGESTLENGTH]; - REQUIRE(len <= ISC_SHA1_BLOCK_LENGTH); + REQUIRE(len <= ISC_SHA1_DIGESTLENGTH); isc_hmacsha1_sign(ctx, newdigest, ISC_SHA1_DIGESTLENGTH); return (ISC_TF(memcmp(digest, newdigest, len) == 0)); } diff --git a/contrib/bind9/lib/isc/ia64/Makefile.in b/contrib/bind9/lib/isc/ia64/Makefile.in new file mode 100644 index 0000000..c8e77e4 --- /dev/null +++ b/contrib/bind9/lib/isc/ia64/Makefile.in @@ -0,0 +1,24 @@ +# Copyright (C) 2007 Internet Systems Consortium, Inc. ("ISC") +# +# Permission to use, copy, modify, and/or distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +# PERFORMANCE OF THIS SOFTWARE. + +# $Id: Makefile.in,v 1.2.2.1 2007/09/14 04:26:38 marka Exp $ + +srcdir = @srcdir@ +VPATH = @srcdir@ +top_srcdir = @top_srcdir@ + +SUBDIRS = include +TARGETS = + +@BIND9_MAKE_RULES@ diff --git a/contrib/bind9/lib/isc/ia64/include/Makefile.in b/contrib/bind9/lib/isc/ia64/include/Makefile.in new file mode 100644 index 0000000..f4dd2f6 --- /dev/null +++ b/contrib/bind9/lib/isc/ia64/include/Makefile.in @@ -0,0 +1,24 @@ +# Copyright (C) 2007 Internet Systems Consortium, Inc. ("ISC") +# +# Permission to use, copy, modify, and/or distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +# PERFORMANCE OF THIS SOFTWARE. + +# $Id: Makefile.in,v 1.2.2.1 2007/09/14 04:26:38 marka Exp $ + +srcdir = @srcdir@ +VPATH = @srcdir@ +top_srcdir = @top_srcdir@ + +SUBDIRS = isc +TARGETS = + +@BIND9_MAKE_RULES@ diff --git a/contrib/bind9/lib/isc/ia64/include/isc/Makefile.in b/contrib/bind9/lib/isc/ia64/include/isc/Makefile.in new file mode 100644 index 0000000..6760ce6 --- /dev/null +++ b/contrib/bind9/lib/isc/ia64/include/isc/Makefile.in @@ -0,0 +1,36 @@ +# Copyright (C) 2007 Internet Systems Consortium, Inc. ("ISC") +# +# Permission to use, copy, modify, and/or distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +# PERFORMANCE OF THIS SOFTWARE. + +# $Id: Makefile.in,v 1.2.2.1 2007/09/14 04:26:38 marka Exp $ + +srcdir = @srcdir@ +VPATH = @srcdir@ +top_srcdir = @top_srcdir@ + +@BIND9_VERSION@ + +HEADERS = atomic.h + +SUBDIRS = +TARGETS = + +@BIND9_MAKE_RULES@ + +installdirs: + $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${includedir}/isc + +install:: installdirs + for i in ${HEADERS}; do \ + ${INSTALL_DATA} $(srcdir)/$$i ${DESTDIR}${includedir}/isc ; \ + done diff --git a/contrib/bind9/lib/isc/include/isc/platform.h.in b/contrib/bind9/lib/isc/include/isc/platform.h.in index f74fb19..0531edf 100644 --- a/contrib/bind9/lib/isc/include/isc/platform.h.in +++ b/contrib/bind9/lib/isc/include/isc/platform.h.in @@ -2,7 +2,7 @@ * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: platform.h.in,v 1.34.18.7 2007/02/13 00:04:50 marka Exp $ */ +/* $Id: platform.h.in,v 1.34.18.9 2007/09/13 05:04:01 each Exp $ */ #ifndef ISC_PLATFORM_H #define ISC_PLATFORM_H 1 @@ -26,6 +26,11 @@ ***** Platform-dependent defines. *****/ +/* + * Define if the platform has <strings.h>. + */ +@ISC_PLATFORM_HAVESTRINGSH@ + /*** *** Network. ***/ diff --git a/contrib/bind9/lib/isc/include/isc/string.h b/contrib/bind9/lib/isc/include/isc/string.h index 1373cf2..bda71f4 100644 --- a/contrib/bind9/lib/isc/include/isc/string.h +++ b/contrib/bind9/lib/isc/include/isc/string.h @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001, 2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,21 +15,25 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: string.h,v 1.12.18.3 2005/08/16 04:39:05 marka Exp $ */ +/* $Id: string.h,v 1.12.18.6 2007/09/13 05:04:01 each Exp $ */ #ifndef ISC_STRING_H #define ISC_STRING_H 1 /*! \file */ -#include <string.h> - #include <isc/formatcheck.h> #include <isc/int.h> #include <isc/lang.h> #include <isc/platform.h> #include <isc/types.h> +#include <string.h> + +#ifdef ISC_PLATFORM_HAVESTRINGSH +#include <strings.h> +#endif + #define ISC_STRING_MAGIC 0x5e ISC_LANG_BEGINDECLS @@ -134,7 +138,8 @@ isc_string_append_truncate(char *target, size_t size, const char *source); */ isc_result_t -isc_string_printf(char *target, size_t size, const char *format, ...); +isc_string_printf(char *target, size_t size, const char *format, ...) + ISC_FORMAT_PRINTF(3, 4); /* * Print 'format' to 'target' which is a pointer to a string of at least * 'size' bytes. diff --git a/contrib/bind9/lib/isc/mem.c b/contrib/bind9/lib/isc/mem.c index 35918dc..aec6118 100644 --- a/contrib/bind9/lib/isc/mem.c +++ b/contrib/bind9/lib/isc/mem.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1997-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: mem.c,v 1.116.18.12 2006/12/08 05:07:59 marka Exp $ */ +/* $Id: mem.c,v 1.116.18.18 2007/10/30 23:31:43 marka Exp $ */ /*! \file */ @@ -690,7 +690,8 @@ default_memfree(void *arg, void *ptr) { static void initialize_action(void) { - RUNTIME_CHECK(isc_mutex_init(&lock) == ISC_R_SUCCESS); + RUNTIME_CHECK(isc_mutex_init(&lock) == ISC_R_SUCCESS); + ISC_LIST_INIT(contexts); } /* @@ -1948,7 +1949,7 @@ isc_mem_checkdestroyed(FILE *file) { } fflush(file); #endif - INSIST(1); + INSIST(0); } UNLOCK(&lock); } diff --git a/contrib/bind9/lib/isc/mips/Makefile.in b/contrib/bind9/lib/isc/mips/Makefile.in new file mode 100644 index 0000000..c8e77e4 --- /dev/null +++ b/contrib/bind9/lib/isc/mips/Makefile.in @@ -0,0 +1,24 @@ +# Copyright (C) 2007 Internet Systems Consortium, Inc. ("ISC") +# +# Permission to use, copy, modify, and/or distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +# PERFORMANCE OF THIS SOFTWARE. + +# $Id: Makefile.in,v 1.2.2.1 2007/09/14 04:26:38 marka Exp $ + +srcdir = @srcdir@ +VPATH = @srcdir@ +top_srcdir = @top_srcdir@ + +SUBDIRS = include +TARGETS = + +@BIND9_MAKE_RULES@ diff --git a/contrib/bind9/lib/isc/mips/include/Makefile.in b/contrib/bind9/lib/isc/mips/include/Makefile.in new file mode 100644 index 0000000..f4dd2f6 --- /dev/null +++ b/contrib/bind9/lib/isc/mips/include/Makefile.in @@ -0,0 +1,24 @@ +# Copyright (C) 2007 Internet Systems Consortium, Inc. ("ISC") +# +# Permission to use, copy, modify, and/or distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +# PERFORMANCE OF THIS SOFTWARE. + +# $Id: Makefile.in,v 1.2.2.1 2007/09/14 04:26:38 marka Exp $ + +srcdir = @srcdir@ +VPATH = @srcdir@ +top_srcdir = @top_srcdir@ + +SUBDIRS = isc +TARGETS = + +@BIND9_MAKE_RULES@ diff --git a/contrib/bind9/lib/isc/mips/include/isc/Makefile.in b/contrib/bind9/lib/isc/mips/include/isc/Makefile.in new file mode 100644 index 0000000..6760ce6 --- /dev/null +++ b/contrib/bind9/lib/isc/mips/include/isc/Makefile.in @@ -0,0 +1,36 @@ +# Copyright (C) 2007 Internet Systems Consortium, Inc. ("ISC") +# +# Permission to use, copy, modify, and/or distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +# PERFORMANCE OF THIS SOFTWARE. + +# $Id: Makefile.in,v 1.2.2.1 2007/09/14 04:26:38 marka Exp $ + +srcdir = @srcdir@ +VPATH = @srcdir@ +top_srcdir = @top_srcdir@ + +@BIND9_VERSION@ + +HEADERS = atomic.h + +SUBDIRS = +TARGETS = + +@BIND9_MAKE_RULES@ + +installdirs: + $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${includedir}/isc + +install:: installdirs + for i in ${HEADERS}; do \ + ${INSTALL_DATA} $(srcdir)/$$i ${DESTDIR}${includedir}/isc ; \ + done diff --git a/contrib/bind9/lib/isc/noatomic/Makefile.in b/contrib/bind9/lib/isc/noatomic/Makefile.in new file mode 100644 index 0000000..c8e77e4 --- /dev/null +++ b/contrib/bind9/lib/isc/noatomic/Makefile.in @@ -0,0 +1,24 @@ +# Copyright (C) 2007 Internet Systems Consortium, Inc. ("ISC") +# +# Permission to use, copy, modify, and/or distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +# PERFORMANCE OF THIS SOFTWARE. + +# $Id: Makefile.in,v 1.2.2.1 2007/09/14 04:26:38 marka Exp $ + +srcdir = @srcdir@ +VPATH = @srcdir@ +top_srcdir = @top_srcdir@ + +SUBDIRS = include +TARGETS = + +@BIND9_MAKE_RULES@ diff --git a/contrib/bind9/lib/isc/noatomic/include/Makefile.in b/contrib/bind9/lib/isc/noatomic/include/Makefile.in new file mode 100644 index 0000000..f4dd2f6 --- /dev/null +++ b/contrib/bind9/lib/isc/noatomic/include/Makefile.in @@ -0,0 +1,24 @@ +# Copyright (C) 2007 Internet Systems Consortium, Inc. ("ISC") +# +# Permission to use, copy, modify, and/or distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +# PERFORMANCE OF THIS SOFTWARE. + +# $Id: Makefile.in,v 1.2.2.1 2007/09/14 04:26:38 marka Exp $ + +srcdir = @srcdir@ +VPATH = @srcdir@ +top_srcdir = @top_srcdir@ + +SUBDIRS = isc +TARGETS = + +@BIND9_MAKE_RULES@ diff --git a/contrib/bind9/lib/isc/noatomic/include/isc/Makefile.in b/contrib/bind9/lib/isc/noatomic/include/isc/Makefile.in new file mode 100644 index 0000000..6760ce6 --- /dev/null +++ b/contrib/bind9/lib/isc/noatomic/include/isc/Makefile.in @@ -0,0 +1,36 @@ +# Copyright (C) 2007 Internet Systems Consortium, Inc. ("ISC") +# +# Permission to use, copy, modify, and/or distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +# PERFORMANCE OF THIS SOFTWARE. + +# $Id: Makefile.in,v 1.2.2.1 2007/09/14 04:26:38 marka Exp $ + +srcdir = @srcdir@ +VPATH = @srcdir@ +top_srcdir = @top_srcdir@ + +@BIND9_VERSION@ + +HEADERS = atomic.h + +SUBDIRS = +TARGETS = + +@BIND9_MAKE_RULES@ + +installdirs: + $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${includedir}/isc + +install:: installdirs + for i in ${HEADERS}; do \ + ${INSTALL_DATA} $(srcdir)/$$i ${DESTDIR}${includedir}/isc ; \ + done diff --git a/contrib/bind9/lib/isc/powerpc/Makefile.in b/contrib/bind9/lib/isc/powerpc/Makefile.in new file mode 100644 index 0000000..c8e77e4 --- /dev/null +++ b/contrib/bind9/lib/isc/powerpc/Makefile.in @@ -0,0 +1,24 @@ +# Copyright (C) 2007 Internet Systems Consortium, Inc. ("ISC") +# +# Permission to use, copy, modify, and/or distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +# PERFORMANCE OF THIS SOFTWARE. + +# $Id: Makefile.in,v 1.2.2.1 2007/09/14 04:26:38 marka Exp $ + +srcdir = @srcdir@ +VPATH = @srcdir@ +top_srcdir = @top_srcdir@ + +SUBDIRS = include +TARGETS = + +@BIND9_MAKE_RULES@ diff --git a/contrib/bind9/lib/isc/powerpc/include/Makefile.in b/contrib/bind9/lib/isc/powerpc/include/Makefile.in new file mode 100644 index 0000000..f4dd2f6 --- /dev/null +++ b/contrib/bind9/lib/isc/powerpc/include/Makefile.in @@ -0,0 +1,24 @@ +# Copyright (C) 2007 Internet Systems Consortium, Inc. ("ISC") +# +# Permission to use, copy, modify, and/or distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +# PERFORMANCE OF THIS SOFTWARE. + +# $Id: Makefile.in,v 1.2.2.1 2007/09/14 04:26:38 marka Exp $ + +srcdir = @srcdir@ +VPATH = @srcdir@ +top_srcdir = @top_srcdir@ + +SUBDIRS = isc +TARGETS = + +@BIND9_MAKE_RULES@ diff --git a/contrib/bind9/lib/isc/powerpc/include/isc/Makefile.in b/contrib/bind9/lib/isc/powerpc/include/isc/Makefile.in new file mode 100644 index 0000000..6760ce6 --- /dev/null +++ b/contrib/bind9/lib/isc/powerpc/include/isc/Makefile.in @@ -0,0 +1,36 @@ +# Copyright (C) 2007 Internet Systems Consortium, Inc. ("ISC") +# +# Permission to use, copy, modify, and/or distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +# PERFORMANCE OF THIS SOFTWARE. + +# $Id: Makefile.in,v 1.2.2.1 2007/09/14 04:26:38 marka Exp $ + +srcdir = @srcdir@ +VPATH = @srcdir@ +top_srcdir = @top_srcdir@ + +@BIND9_VERSION@ + +HEADERS = atomic.h + +SUBDIRS = +TARGETS = + +@BIND9_MAKE_RULES@ + +installdirs: + $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${includedir}/isc + +install:: installdirs + for i in ${HEADERS}; do \ + ${INSTALL_DATA} $(srcdir)/$$i ${DESTDIR}${includedir}/isc ; \ + done diff --git a/contrib/bind9/lib/isc/powerpc/include/isc/atomic.h b/contrib/bind9/lib/isc/powerpc/include/isc/atomic.h index 2af9835..30db328 100644 --- a/contrib/bind9/lib/isc/powerpc/include/isc/atomic.h +++ b/contrib/bind9/lib/isc/powerpc/include/isc/atomic.h @@ -1,7 +1,7 @@ /* * Copyright (C) 2005, 2007 Internet Systems Consortium, Inc. ("ISC") * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -14,7 +14,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: atomic.h,v 1.1.6.5 2007/02/13 00:04:50 marka Exp $ */ +/* $Id: atomic.h,v 1.1.6.6 2007/08/28 07:20:06 tbox Exp $ */ #ifndef ISC_ATOMIC_H #define ISC_ATOMIC_H 1 diff --git a/contrib/bind9/lib/isc/sparc64/Makefile.in b/contrib/bind9/lib/isc/sparc64/Makefile.in new file mode 100644 index 0000000..c8e77e4 --- /dev/null +++ b/contrib/bind9/lib/isc/sparc64/Makefile.in @@ -0,0 +1,24 @@ +# Copyright (C) 2007 Internet Systems Consortium, Inc. ("ISC") +# +# Permission to use, copy, modify, and/or distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +# PERFORMANCE OF THIS SOFTWARE. + +# $Id: Makefile.in,v 1.2.2.1 2007/09/14 04:26:38 marka Exp $ + +srcdir = @srcdir@ +VPATH = @srcdir@ +top_srcdir = @top_srcdir@ + +SUBDIRS = include +TARGETS = + +@BIND9_MAKE_RULES@ diff --git a/contrib/bind9/lib/isc/sparc64/include/Makefile.in b/contrib/bind9/lib/isc/sparc64/include/Makefile.in new file mode 100644 index 0000000..f4dd2f6 --- /dev/null +++ b/contrib/bind9/lib/isc/sparc64/include/Makefile.in @@ -0,0 +1,24 @@ +# Copyright (C) 2007 Internet Systems Consortium, Inc. ("ISC") +# +# Permission to use, copy, modify, and/or distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +# PERFORMANCE OF THIS SOFTWARE. + +# $Id: Makefile.in,v 1.2.2.1 2007/09/14 04:26:38 marka Exp $ + +srcdir = @srcdir@ +VPATH = @srcdir@ +top_srcdir = @top_srcdir@ + +SUBDIRS = isc +TARGETS = + +@BIND9_MAKE_RULES@ diff --git a/contrib/bind9/lib/isc/sparc64/include/isc/Makefile.in b/contrib/bind9/lib/isc/sparc64/include/isc/Makefile.in new file mode 100644 index 0000000..6760ce6 --- /dev/null +++ b/contrib/bind9/lib/isc/sparc64/include/isc/Makefile.in @@ -0,0 +1,36 @@ +# Copyright (C) 2007 Internet Systems Consortium, Inc. ("ISC") +# +# Permission to use, copy, modify, and/or distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +# PERFORMANCE OF THIS SOFTWARE. + +# $Id: Makefile.in,v 1.2.2.1 2007/09/14 04:26:38 marka Exp $ + +srcdir = @srcdir@ +VPATH = @srcdir@ +top_srcdir = @top_srcdir@ + +@BIND9_VERSION@ + +HEADERS = atomic.h + +SUBDIRS = +TARGETS = + +@BIND9_MAKE_RULES@ + +installdirs: + $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${includedir}/isc + +install:: installdirs + for i in ${HEADERS}; do \ + ${INSTALL_DATA} $(srcdir)/$$i ${DESTDIR}${includedir}/isc ; \ + done diff --git a/contrib/bind9/lib/isc/timer.c b/contrib/bind9/lib/isc/timer.c index 4b96fa5..f67d091 100644 --- a/contrib/bind9/lib/isc/timer.c +++ b/contrib/bind9/lib/isc/timer.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1998-2002 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: timer.c,v 1.73.18.5 2005/11/30 03:44:39 marka Exp $ */ +/* $Id: timer.c,v 1.73.18.7 2007/10/24 23:46:26 tbox Exp $ */ /*! \file */ @@ -581,6 +581,7 @@ dispatch(isc_timermgr_t *manager, isc_time_t *now) { isc_eventtype_t type = 0; isc_timer_t *timer; isc_result_t result; + isc_boolean_t idle; /*! * The caller must be holding the manager lock. @@ -612,23 +613,33 @@ dispatch(isc_timermgr_t *manager, isc_time_t *now) { type = ISC_TIMEREVENT_LIFE; post_event = ISC_TRUE; need_schedule = ISC_FALSE; - } else if (!isc_time_isepoch(&timer->idle) && - isc_time_compare(now, - &timer->idle) >= 0) { - type = ISC_TIMEREVENT_IDLE; - post_event = ISC_TRUE; - need_schedule = ISC_FALSE; } else { - /* - * Idle timer has been touched; reschedule. - */ - XTRACEID(isc_msgcat_get(isc_msgcat, - ISC_MSGSET_TIMER, - ISC_MSG_IDLERESCHED, - "idle reschedule"), - timer); - post_event = ISC_FALSE; - need_schedule = ISC_TRUE; + idle = ISC_FALSE; + + LOCK(&timer->lock); + if (!isc_time_isepoch(&timer->idle) && + isc_time_compare(now, + &timer->idle) >= 0) { + idle = ISC_TRUE; + } + UNLOCK(&timer->lock); + if (idle) { + type = ISC_TIMEREVENT_IDLE; + post_event = ISC_TRUE; + need_schedule = ISC_FALSE; + } else { + /* + * Idle timer has been touched; + * reschedule. + */ + XTRACEID(isc_msgcat_get(isc_msgcat, + ISC_MSGSET_TIMER, + ISC_MSG_IDLERESCHED, + "idle reschedule"), + timer); + post_event = ISC_FALSE; + need_schedule = ISC_TRUE; + } } if (post_event) { diff --git a/contrib/bind9/lib/isc/unix/ifiter_getifaddrs.c b/contrib/bind9/lib/isc/unix/ifiter_getifaddrs.c index 7e359aa..3599a89 100644 --- a/contrib/bind9/lib/isc/unix/ifiter_getifaddrs.c +++ b/contrib/bind9/lib/isc/unix/ifiter_getifaddrs.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: ifiter_getifaddrs.c,v 1.4.18.2 2005/04/29 00:17:08 marka Exp $ */ +/* $Id: ifiter_getifaddrs.c,v 1.4.18.5 2007/08/28 07:20:06 tbox Exp $ */ /*! \file * \brief @@ -111,7 +111,9 @@ internal_current(isc_interfaceiter_t *iter) { INSIST(ifa != NULL); INSIST(ifa->ifa_name != NULL); - INSIST(ifa->ifa_addr != NULL); + + if (ifa->ifa_addr == NULL) + return (ISC_R_IGNORE); family = ifa->ifa_addr->sa_family; if (family != AF_INET && family != AF_INET6) diff --git a/contrib/bind9/lib/isc/unix/ifiter_ioctl.c b/contrib/bind9/lib/isc/unix/ifiter_ioctl.c index 5ebcef8..ce63de7 100644 --- a/contrib/bind9/lib/isc/unix/ifiter_ioctl.c +++ b/contrib/bind9/lib/isc/unix/ifiter_ioctl.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: ifiter_ioctl.c,v 1.44.18.11 2006/02/03 23:51:38 marka Exp $ */ +/* $Id: ifiter_ioctl.c,v 1.44.18.13 2007/08/31 23:46:25 tbox Exp $ */ /*! \file * \brief @@ -905,7 +905,8 @@ internal_next4(isc_interfaceiter_t *iter) { struct ifreq *ifrp; #endif - REQUIRE (iter->pos < (unsigned int) iter->ifc.ifc_len); + REQUIRE(iter->ifc.ifc_len == 0 || + iter->pos < (unsigned int) iter->ifc.ifc_len); #ifdef __linux if (linux_if_inet6_next(iter) == ISC_R_SUCCESS) @@ -913,6 +914,10 @@ internal_next4(isc_interfaceiter_t *iter) { if (!iter->first) return (ISC_R_SUCCESS); #endif + + if (iter->ifc.ifc_len == 0) + return (ISC_R_NOMORE); + #ifdef ISC_PLATFORM_HAVESALEN ifrp = (struct ifreq *)((char *) iter->ifc.ifc_req + iter->pos); diff --git a/contrib/bind9/lib/isc/unix/net.c b/contrib/bind9/lib/isc/unix/net.c index 6169c2b..1de6b32 100644 --- a/contrib/bind9/lib/isc/unix/net.c +++ b/contrib/bind9/lib/isc/unix/net.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: net.c,v 1.29.18.4 2005/03/16 01:22:50 marka Exp $ */ +/* $Id: net.c,v 1.29.18.6 2007/09/13 23:46:26 tbox Exp $ */ #include <config.h> @@ -30,17 +30,26 @@ #include <isc/string.h> #include <isc/util.h> -#if defined(ISC_PLATFORM_HAVEIPV6) && defined(ISC_PLATFORM_NEEDIN6ADDRANY) +#if defined(ISC_PLATFORM_HAVEIPV6) +# if defined(ISC_PLATFORM_NEEDIN6ADDRANY) const struct in6_addr isc_net_in6addrany = IN6ADDR_ANY_INIT; -#endif +# endif -#if defined(ISC_PLATFORM_HAVEIPV6) && defined(ISC_PLATFORM_NEEDIN6ADDRLOOPBACK) +# if defined(ISC_PLATFORM_NEEDIN6ADDRLOOPBACK) const struct in6_addr isc_net_in6addrloop = IN6ADDR_LOOPBACK_INIT; -#endif +# endif -static isc_once_t once = ISC_ONCE_INIT; +# if defined(WANT_IPV6) static isc_once_t once_ipv6only = ISC_ONCE_INIT; +# endif + +# if defined(ISC_PLATFORM_HAVEIN6PKTINFO) static isc_once_t once_ipv6pktinfo = ISC_ONCE_INIT; +# endif +#endif /* ISC_PLATFORM_HAVEIPV6 */ + +static isc_once_t once = ISC_ONCE_INIT; + static isc_result_t ipv4_result = ISC_R_NOTFOUND; static isc_result_t ipv6_result = ISC_R_NOTFOUND; static isc_result_t unix_result = ISC_R_NOTFOUND; @@ -245,7 +254,7 @@ initialize_ipv6only(void) { RUNTIME_CHECK(isc_once_do(&once_ipv6only, try_ipv6only) == ISC_R_SUCCESS); } -#endif /* IPV6_V6ONLY */ +#endif /* WANT_IPV6 */ #ifdef ISC_PLATFORM_HAVEIN6PKTINFO static void @@ -301,7 +310,7 @@ initialize_ipv6pktinfo(void) { try_ipv6pktinfo) == ISC_R_SUCCESS); } #endif /* ISC_PLATFORM_HAVEIN6PKTINFO */ -#endif /* WANT_IPV6 */ +#endif /* ISC_PLATFORM_HAVEIPV6 */ isc_result_t isc_net_probe_ipv6only(void) { diff --git a/contrib/bind9/lib/isc/unix/socket.c b/contrib/bind9/lib/isc/unix/socket.c index 6b4c34c..e0b9021 100644 --- a/contrib/bind9/lib/isc/unix/socket.c +++ b/contrib/bind9/lib/isc/unix/socket.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1998-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: socket.c,v 1.237.18.24 2006/06/06 00:56:09 marka Exp $ */ +/* $Id: socket.c,v 1.237.18.29 2007/08/28 07:20:06 tbox Exp $ */ /*! \file */ @@ -48,6 +48,7 @@ #include <isc/msgs.h> #include <isc/mutex.h> #include <isc/net.h> +#include <isc/once.h> #include <isc/platform.h> #include <isc/print.h> #include <isc/region.h> @@ -71,6 +72,11 @@ #define ISC_SOCKADDR_LEN_T unsigned int #endif + +#if defined(SO_BSDCOMPAT) && defined(__linux__) +#include <sys/utsname.h> +#endif + /*% * Define what the possible "soft" errors can be. These are non-fatal returns * of various network related functions, like recv() and so on. @@ -1386,7 +1392,45 @@ free_socket(isc_socket_t **socketp) { *socketp = NULL; } +#ifdef SO_BSDCOMPAT /* + * This really should not be necessary to do. Having to workout + * which kernel version we are on at run time so that we don't cause + * the kernel to issue a warning about us using a deprecated socket option. + * Such warnings should *never* be on by default in production kernels. + * + * We can't do this a build time because executables are moved between + * machines and hence kernels. + * + * We can't just not set SO_BSDCOMAT because some kernels require it. + */ + +static isc_once_t bsdcompat_once = ISC_ONCE_INIT; +isc_boolean_t bsdcompat = ISC_TRUE; + +static void +clear_bsdcompat(void) { +#ifdef __linux__ + struct utsname buf; + char *endp; + long int major; + long int minor; + + uname(&buf); /* Can only fail if buf is bad in Linux. */ + + /* Paranoia in parsing can be increased, but we trust uname(). */ + major = strtol(buf.release, &endp, 10); + if (*endp == '.') { + minor = strtol(endp+1, &endp, 10); + if ((major > 2) || ((major == 2) && (minor >= 4))) { + bsdcompat = ISC_FALSE; + } + } +#endif /* __linux __ */ +} +#endif + +/*% * Create a new 'type' socket managed by 'manager'. Events * will be posted to 'task' and when dispatched 'action' will be * called with 'arg' as the arg value. The new socket is returned @@ -1407,6 +1451,7 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type, #endif char strbuf[ISC_STRERRORSIZE]; const char *err = "socket"; + int try = 0; REQUIRE(VALID_MANAGER(manager)); REQUIRE(socketp != NULL && *socketp == NULL); @@ -1416,6 +1461,7 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type, return (result); sock->pf = pf; + again: switch (type) { case isc_sockettype_udp: sock->fd = socket(pf, SOCK_DGRAM, IPPROTO_UDP); @@ -1427,6 +1473,8 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type, sock->fd = socket(pf, SOCK_STREAM, 0); break; } + if (sock->fd == -1 && errno == EINTR && try++ < 42) + goto again; #ifdef F_DUPFD /* @@ -1493,7 +1541,9 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type, } #ifdef SO_BSDCOMPAT - if (type != isc_sockettype_unix && + RUNTIME_CHECK(isc_once_do(&bsdcompat_once, + clear_bsdcompat) == ISC_R_SUCCESS); + if (type != isc_sockettype_unix && bsdcompat && setsockopt(sock->fd, SOL_SOCKET, SO_BSDCOMPAT, (void *)&on, sizeof(on)) < 0) { isc__strerror(errno, strbuf, sizeof(strbuf)); @@ -1540,7 +1590,7 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type, } #ifdef ISC_PLATFORM_HAVEIN6PKTINFO #ifdef IPV6_RECVPKTINFO - /* 2292bis */ + /* RFC 3542 */ if ((pf == AF_INET6) && (setsockopt(sock->fd, IPPROTO_IPV6, IPV6_RECVPKTINFO, (void *)&on, sizeof(on)) < 0)) { @@ -1555,7 +1605,7 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type, strbuf); } #else - /* 2292 */ + /* RFC 2292 */ if ((pf == AF_INET6) && (setsockopt(sock->fd, IPPROTO_IPV6, IPV6_PKTINFO, (void *)&on, sizeof(on)) < 0)) { @@ -1571,7 +1621,7 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type, } #endif /* IPV6_RECVPKTINFO */ #endif /* ISC_PLATFORM_HAVEIN6PKTINFO */ -#ifdef IPV6_USE_MIN_MTU /*2292bis, not too common yet*/ +#ifdef IPV6_USE_MIN_MTU /* RFC 3542, not too common yet*/ /* use minimum MTU */ if (pf == AF_INET6) { (void)setsockopt(sock->fd, IPPROTO_IPV6, diff --git a/contrib/bind9/lib/isc/unix/syslog.c b/contrib/bind9/lib/isc/unix/syslog.c index cc99339..ae67399 100644 --- a/contrib/bind9/lib/isc/unix/syslog.c +++ b/contrib/bind9/lib/isc/unix/syslog.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2001 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,17 +15,17 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: syslog.c,v 1.3.18.2 2005/04/29 00:17:09 marka Exp $ */ +/* $Id: syslog.c,v 1.3.18.4 2007/09/13 23:46:26 tbox Exp $ */ /*! \file */ #include <config.h> #include <stdlib.h> -#include <string.h> #include <syslog.h> #include <isc/result.h> +#include <isc/string.h> #include <isc/syslog.h> #include <isc/util.h> diff --git a/contrib/bind9/lib/isc/x86_32/Makefile.in b/contrib/bind9/lib/isc/x86_32/Makefile.in new file mode 100644 index 0000000..c8e77e4 --- /dev/null +++ b/contrib/bind9/lib/isc/x86_32/Makefile.in @@ -0,0 +1,24 @@ +# Copyright (C) 2007 Internet Systems Consortium, Inc. ("ISC") +# +# Permission to use, copy, modify, and/or distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +# PERFORMANCE OF THIS SOFTWARE. + +# $Id: Makefile.in,v 1.2.2.1 2007/09/14 04:26:38 marka Exp $ + +srcdir = @srcdir@ +VPATH = @srcdir@ +top_srcdir = @top_srcdir@ + +SUBDIRS = include +TARGETS = + +@BIND9_MAKE_RULES@ diff --git a/contrib/bind9/lib/isc/x86_32/include/Makefile.in b/contrib/bind9/lib/isc/x86_32/include/Makefile.in new file mode 100644 index 0000000..b68a765 --- /dev/null +++ b/contrib/bind9/lib/isc/x86_32/include/Makefile.in @@ -0,0 +1,24 @@ +# Copyright (C) 2007 Internet Systems Consortium, Inc. ("ISC") +# +# Permission to use, copy, modify, and/or distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +# PERFORMANCE OF THIS SOFTWARE. + +# $Id: Makefile.in,v 1.2.2.1 2007/09/14 04:26:39 marka Exp $ + +srcdir = @srcdir@ +VPATH = @srcdir@ +top_srcdir = @top_srcdir@ + +SUBDIRS = isc +TARGETS = + +@BIND9_MAKE_RULES@ diff --git a/contrib/bind9/lib/isc/x86_32/include/isc/Makefile.in b/contrib/bind9/lib/isc/x86_32/include/isc/Makefile.in new file mode 100644 index 0000000..4ce057a --- /dev/null +++ b/contrib/bind9/lib/isc/x86_32/include/isc/Makefile.in @@ -0,0 +1,36 @@ +# Copyright (C) 2007 Internet Systems Consortium, Inc. ("ISC") +# +# Permission to use, copy, modify, and/or distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +# PERFORMANCE OF THIS SOFTWARE. + +# $Id: Makefile.in,v 1.2.2.1 2007/09/14 04:26:39 marka Exp $ + +srcdir = @srcdir@ +VPATH = @srcdir@ +top_srcdir = @top_srcdir@ + +@BIND9_VERSION@ + +HEADERS = atomic.h + +SUBDIRS = +TARGETS = + +@BIND9_MAKE_RULES@ + +installdirs: + $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${includedir}/isc + +install:: installdirs + for i in ${HEADERS}; do \ + ${INSTALL_DATA} $(srcdir)/$$i ${DESTDIR}${includedir}/isc ; \ + done diff --git a/contrib/bind9/lib/isc/x86_64/Makefile.in b/contrib/bind9/lib/isc/x86_64/Makefile.in new file mode 100644 index 0000000..de577a9 --- /dev/null +++ b/contrib/bind9/lib/isc/x86_64/Makefile.in @@ -0,0 +1,24 @@ +# Copyright (C) 2007 Internet Systems Consortium, Inc. ("ISC") +# +# Permission to use, copy, modify, and/or distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +# PERFORMANCE OF THIS SOFTWARE. + +# $Id: Makefile.in,v 1.2.2.1 2007/09/14 04:26:39 marka Exp $ + +srcdir = @srcdir@ +VPATH = @srcdir@ +top_srcdir = @top_srcdir@ + +SUBDIRS = include +TARGETS = + +@BIND9_MAKE_RULES@ diff --git a/contrib/bind9/lib/isc/x86_64/include/Makefile.in b/contrib/bind9/lib/isc/x86_64/include/Makefile.in new file mode 100644 index 0000000..b68a765 --- /dev/null +++ b/contrib/bind9/lib/isc/x86_64/include/Makefile.in @@ -0,0 +1,24 @@ +# Copyright (C) 2007 Internet Systems Consortium, Inc. ("ISC") +# +# Permission to use, copy, modify, and/or distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +# PERFORMANCE OF THIS SOFTWARE. + +# $Id: Makefile.in,v 1.2.2.1 2007/09/14 04:26:39 marka Exp $ + +srcdir = @srcdir@ +VPATH = @srcdir@ +top_srcdir = @top_srcdir@ + +SUBDIRS = isc +TARGETS = + +@BIND9_MAKE_RULES@ diff --git a/contrib/bind9/lib/isc/x86_64/include/isc/Makefile.in b/contrib/bind9/lib/isc/x86_64/include/isc/Makefile.in new file mode 100644 index 0000000..4ce057a --- /dev/null +++ b/contrib/bind9/lib/isc/x86_64/include/isc/Makefile.in @@ -0,0 +1,36 @@ +# Copyright (C) 2007 Internet Systems Consortium, Inc. ("ISC") +# +# Permission to use, copy, modify, and/or distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +# PERFORMANCE OF THIS SOFTWARE. + +# $Id: Makefile.in,v 1.2.2.1 2007/09/14 04:26:39 marka Exp $ + +srcdir = @srcdir@ +VPATH = @srcdir@ +top_srcdir = @top_srcdir@ + +@BIND9_VERSION@ + +HEADERS = atomic.h + +SUBDIRS = +TARGETS = + +@BIND9_MAKE_RULES@ + +installdirs: + $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${includedir}/isc + +install:: installdirs + for i in ${HEADERS}; do \ + ${INSTALL_DATA} $(srcdir)/$$i ${DESTDIR}${includedir}/isc ; \ + done diff --git a/contrib/bind9/lib/isccc/symtab.c b/contrib/bind9/lib/isccc/symtab.c index 2c259d7..7ec6d55 100644 --- a/contrib/bind9/lib/isccc/symtab.c +++ b/contrib/bind9/lib/isccc/symtab.c @@ -1,9 +1,9 @@ /* - * Portions Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC") + * Portions Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") * Portions Copyright (C) 2001 Internet Software Consortium. * Portions Copyright (C) 2001 Nominum, Inc. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -16,7 +16,7 @@ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: symtab.c,v 1.5.18.2 2005/04/29 00:17:12 marka Exp $ */ +/* $Id: symtab.c,v 1.5.18.4 2007/09/13 23:46:26 tbox Exp $ */ /*! \file */ @@ -24,10 +24,10 @@ #include <ctype.h> #include <stdlib.h> -#include <string.h> #include <isc/assertions.h> #include <isc/magic.h> +#include <isc/string.h> #include <isccc/result.h> #include <isccc/symtab.h> diff --git a/contrib/bind9/lib/isccfg/api b/contrib/bind9/lib/isccfg/api index 7560ffd..aba393a 100644 --- a/contrib/bind9/lib/isccfg/api +++ b/contrib/bind9/lib/isccfg/api @@ -1,3 +1,3 @@ LIBINTERFACE = 30 -LIBREVISION = 2 +LIBREVISION = 3 LIBAGE = 0 diff --git a/contrib/bind9/lib/lwres/api b/contrib/bind9/lib/lwres/api index d94beab..510e9a9 100644 --- a/contrib/bind9/lib/lwres/api +++ b/contrib/bind9/lib/lwres/api @@ -1,3 +1,3 @@ LIBINTERFACE = 30 -LIBREVISION = 4 +LIBREVISION = 5 LIBAGE = 0 diff --git a/contrib/bind9/lib/lwres/context.c b/contrib/bind9/lib/lwres/context.c index 0da426b..c731bb7 100644 --- a/contrib/bind9/lib/lwres/context.c +++ b/contrib/bind9/lib/lwres/context.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001, 2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: context.c,v 1.45.18.3 2005/04/29 00:17:16 marka Exp $ */ +/* $Id: context.c,v 1.45.18.7 2007/08/28 07:20:06 tbox Exp $ */ /*! \file context.c lwres_context_create() creates a #lwres_context_t structure for use in @@ -209,6 +209,9 @@ lwres_context_destroy(lwres_context_t **contextp) { *contextp = NULL; if (ctx->sock != -1) { +#ifdef WIN32 + DestroySockets(); +#endif (void)close(ctx->sock); ctx->sock = -1; } @@ -315,19 +318,34 @@ context_connect(lwres_context_t *ctx) { } else return (LWRES_R_IOERROR); +#ifdef WIN32 + InitSockets(); +#endif s = socket(domain, SOCK_DGRAM, IPPROTO_UDP); - if (s < 0) + if (s < 0) { +#ifdef WIN32 + DestroySockets(); +#endif return (LWRES_R_IOERROR); + } ret = connect(s, sa, salen); if (ret != 0) { +#ifdef WIN32 + DestroySockets(); +#endif (void)close(s); return (LWRES_R_IOERROR); } MAKE_NONBLOCKING(s, ret); - if (ret < 0) + if (ret < 0) { +#ifdef WIN32 + DestroySockets(); +#endif + (void)close(s); return (LWRES_R_IOERROR); + } ctx->sock = s; diff --git a/contrib/bind9/lib/lwres/getaddrinfo.c b/contrib/bind9/lib/lwres/getaddrinfo.c index e06ca29..6056f24 100644 --- a/contrib/bind9/lib/lwres/getaddrinfo.c +++ b/contrib/bind9/lib/lwres/getaddrinfo.c @@ -1,11 +1,11 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2001 Internet Software Consortium. * * This code is derived from software contributed to ISC by * Berkeley Software Design, Inc. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -18,7 +18,7 @@ * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: getaddrinfo.c,v 1.43.18.6 2006/11/14 01:07:28 marka Exp $ */ +/* $Id: getaddrinfo.c,v 1.43.18.8 2007/09/13 23:46:26 tbox Exp $ */ /*! \file */ @@ -133,9 +133,10 @@ #include <config.h> -#include <string.h> #include <errno.h> +#include <isc/string.h> + #include <lwres/lwres.h> #include <lwres/net.h> #include <lwres/netdb.h> diff --git a/contrib/bind9/lib/lwres/getipnode.c b/contrib/bind9/lib/lwres/getipnode.c index 46eed14..ab49814 100644 --- a/contrib/bind9/lib/lwres/getipnode.c +++ b/contrib/bind9/lib/lwres/getipnode.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: getipnode.c,v 1.37.18.3 2005/04/29 00:17:18 marka Exp $ */ +/* $Id: getipnode.c,v 1.37.18.7 2007/08/28 07:20:06 tbox Exp $ */ /*! \file */ @@ -671,13 +671,20 @@ scan_interfaces(int *have_v4, int *have_v6) { int s, n; size_t cpsize; +#ifdef WIN32 + InitSockets(); +#endif #if defined(SIOCGLIFCONF) && defined(SIOCGLIFADDR) && \ !defined(IRIX_EMUL_IOCTL_SIOCGIFCONF) /* * Try to scan the interfaces using IPv6 ioctls(). */ - if (!scan_interfaces6(have_v4, have_v6)) + if (!scan_interfaces6(have_v4, have_v6)) { +#ifdef WIN32 + DestroySockets(); +#endif return (0); + } #endif /* @@ -802,13 +809,20 @@ scan_interfaces(int *have_v4, int *have_v6) { } if (buf != NULL) free(buf); +#ifdef WIN32 + DestroySockets(); +#endif close(s); return (0); + err_ret: if (buf != NULL) free(buf); if (s != -1) close(s); +#ifdef WIN32 + DestroySockets(); +#endif return (-1); #endif } diff --git a/contrib/bind9/lib/lwres/lwres_gnba.c b/contrib/bind9/lib/lwres/lwres_gnba.c index 5f41648..7627385 100644 --- a/contrib/bind9/lib/lwres/lwres_gnba.c +++ b/contrib/bind9/lib/lwres/lwres_gnba.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000-2002 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: lwres_gnba.c,v 1.23.18.2 2005/04/29 00:17:20 marka Exp $ */ +/* $Id: lwres_gnba.c,v 1.23.18.4 2007/09/26 23:46:34 tbox Exp $ */ /*! \file lwres_gnba.c These are low-level routines for creating and parsing lightweight @@ -126,7 +126,6 @@ lwres_gnbarequest_render(lwres_context_t *ctx, lwres_gnbarequest_t *req, REQUIRE(req != NULL); REQUIRE(req->addr.family != 0); REQUIRE(req->addr.length != 0); - REQUIRE(req->addr.address != NULL); REQUIRE(pkt != NULL); REQUIRE(b != NULL); diff --git a/contrib/bind9/lib/lwres/man/lwres.docbook b/contrib/bind9/lib/lwres/man/lwres.docbook index 2a94ec8..cf1c154 100644 --- a/contrib/bind9/lib/lwres/man/lwres.docbook +++ b/contrib/bind9/lib/lwres/man/lwres.docbook @@ -5,7 +5,7 @@ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: lwres.docbook,v 1.4.18.5 2007/01/29 23:57:21 marka Exp $ --> +<!-- $Id: lwres.docbook,v 1.4.18.6 2007/08/28 07:20:06 tbox Exp $ --> <refentry> <refentryinfo> diff --git a/contrib/bind9/lib/lwres/man/lwres_buffer.docbook b/contrib/bind9/lib/lwres/man/lwres_buffer.docbook index ab0c560..f0b7a9f 100644 --- a/contrib/bind9/lib/lwres/man/lwres_buffer.docbook +++ b/contrib/bind9/lib/lwres/man/lwres_buffer.docbook @@ -5,7 +5,7 @@ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: lwres_buffer.docbook,v 1.4.18.5 2007/01/29 23:57:21 marka Exp $ --> +<!-- $Id: lwres_buffer.docbook,v 1.4.18.6 2007/08/28 07:20:06 tbox Exp $ --> <refentry> <refentryinfo> <date>Jun 30, 2000</date> diff --git a/contrib/bind9/lib/lwres/man/lwres_config.docbook b/contrib/bind9/lib/lwres/man/lwres_config.docbook index 13113d3..eba0c44 100644 --- a/contrib/bind9/lib/lwres/man/lwres_config.docbook +++ b/contrib/bind9/lib/lwres/man/lwres_config.docbook @@ -5,7 +5,7 @@ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: lwres_config.docbook,v 1.3.18.5 2007/01/29 23:57:21 marka Exp $ --> +<!-- $Id: lwres_config.docbook,v 1.3.18.6 2007/08/28 07:20:06 tbox Exp $ --> <refentry> <refentryinfo> diff --git a/contrib/bind9/lib/lwres/man/lwres_context.docbook b/contrib/bind9/lib/lwres/man/lwres_context.docbook index 65f157c..b965374 100644 --- a/contrib/bind9/lib/lwres/man/lwres_context.docbook +++ b/contrib/bind9/lib/lwres/man/lwres_context.docbook @@ -5,7 +5,7 @@ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001, 2003 Internet Software Consortium. - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: lwres_context.docbook,v 1.5.18.5 2007/01/29 23:57:21 marka Exp $ --> +<!-- $Id: lwres_context.docbook,v 1.5.18.6 2007/08/28 07:20:06 tbox Exp $ --> <refentry> <refentryinfo> diff --git a/contrib/bind9/lib/lwres/man/lwres_gabn.docbook b/contrib/bind9/lib/lwres/man/lwres_gabn.docbook index 3b81acf..c719420 100644 --- a/contrib/bind9/lib/lwres/man/lwres_gabn.docbook +++ b/contrib/bind9/lib/lwres/man/lwres_gabn.docbook @@ -5,7 +5,7 @@ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: lwres_gabn.docbook,v 1.4.18.5 2007/01/29 23:57:21 marka Exp $ --> +<!-- $Id: lwres_gabn.docbook,v 1.4.18.6 2007/08/28 07:20:06 tbox Exp $ --> <refentry> <refentryinfo> diff --git a/contrib/bind9/lib/lwres/man/lwres_gai_strerror.docbook b/contrib/bind9/lib/lwres/man/lwres_gai_strerror.docbook index 77a211b..0b0338b 100644 --- a/contrib/bind9/lib/lwres/man/lwres_gai_strerror.docbook +++ b/contrib/bind9/lib/lwres/man/lwres_gai_strerror.docbook @@ -5,7 +5,7 @@ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: lwres_gai_strerror.docbook,v 1.4.18.5 2007/01/29 23:57:21 marka Exp $ --> +<!-- $Id: lwres_gai_strerror.docbook,v 1.4.18.6 2007/08/28 07:20:06 tbox Exp $ --> <refentry> <refentryinfo> diff --git a/contrib/bind9/lib/lwres/man/lwres_getaddrinfo.docbook b/contrib/bind9/lib/lwres/man/lwres_getaddrinfo.docbook index fa7c086..52d9387 100644 --- a/contrib/bind9/lib/lwres/man/lwres_getaddrinfo.docbook +++ b/contrib/bind9/lib/lwres/man/lwres_getaddrinfo.docbook @@ -5,7 +5,7 @@ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001, 2003 Internet Software Consortium. - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: lwres_getaddrinfo.docbook,v 1.7.18.5 2007/01/29 23:57:21 marka Exp $ --> +<!-- $Id: lwres_getaddrinfo.docbook,v 1.7.18.6 2007/08/28 07:20:06 tbox Exp $ --> <refentry> <refentryinfo> diff --git a/contrib/bind9/lib/lwres/man/lwres_gethostent.docbook b/contrib/bind9/lib/lwres/man/lwres_gethostent.docbook index 41a3bc3..4ed7393 100644 --- a/contrib/bind9/lib/lwres/man/lwres_gethostent.docbook +++ b/contrib/bind9/lib/lwres/man/lwres_gethostent.docbook @@ -5,7 +5,7 @@ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2001 Internet Software Consortium. - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: lwres_gethostent.docbook,v 1.6.18.4 2007/01/29 23:57:21 marka Exp $ --> +<!-- $Id: lwres_gethostent.docbook,v 1.6.18.5 2007/08/28 07:20:06 tbox Exp $ --> <refentry> <refentryinfo> diff --git a/contrib/bind9/lib/lwres/man/lwres_getipnode.docbook b/contrib/bind9/lib/lwres/man/lwres_getipnode.docbook index 6bd4803..a748920 100644 --- a/contrib/bind9/lib/lwres/man/lwres_getipnode.docbook +++ b/contrib/bind9/lib/lwres/man/lwres_getipnode.docbook @@ -5,7 +5,7 @@ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001, 2003 Internet Software Consortium. - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: lwres_getipnode.docbook,v 1.6.18.5 2007/01/29 23:57:21 marka Exp $ --> +<!-- $Id: lwres_getipnode.docbook,v 1.6.18.6 2007/08/28 07:20:06 tbox Exp $ --> <refentry> <refentryinfo> diff --git a/contrib/bind9/lib/lwres/man/lwres_getnameinfo.docbook b/contrib/bind9/lib/lwres/man/lwres_getnameinfo.docbook index 4886196..d0b0df5 100644 --- a/contrib/bind9/lib/lwres/man/lwres_getnameinfo.docbook +++ b/contrib/bind9/lib/lwres/man/lwres_getnameinfo.docbook @@ -5,7 +5,7 @@ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: lwres_getnameinfo.docbook,v 1.4.18.5 2007/01/29 23:57:21 marka Exp $ --> +<!-- $Id: lwres_getnameinfo.docbook,v 1.4.18.6 2007/08/28 07:20:06 tbox Exp $ --> <refentry> <refentryinfo> diff --git a/contrib/bind9/lib/lwres/man/lwres_getrrsetbyname.docbook b/contrib/bind9/lib/lwres/man/lwres_getrrsetbyname.docbook index 2fd996b..746d8bf 100644 --- a/contrib/bind9/lib/lwres/man/lwres_getrrsetbyname.docbook +++ b/contrib/bind9/lib/lwres/man/lwres_getrrsetbyname.docbook @@ -5,7 +5,7 @@ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: lwres_getrrsetbyname.docbook,v 1.4.18.5 2007/01/29 23:57:21 marka Exp $ --> +<!-- $Id: lwres_getrrsetbyname.docbook,v 1.4.18.6 2007/08/28 07:20:06 tbox Exp $ --> <refentry> <refentryinfo> diff --git a/contrib/bind9/lib/lwres/man/lwres_gnba.docbook b/contrib/bind9/lib/lwres/man/lwres_gnba.docbook index 5a76889..a22ce89 100644 --- a/contrib/bind9/lib/lwres/man/lwres_gnba.docbook +++ b/contrib/bind9/lib/lwres/man/lwres_gnba.docbook @@ -5,7 +5,7 @@ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: lwres_gnba.docbook,v 1.5.18.5 2007/01/29 23:57:21 marka Exp $ --> +<!-- $Id: lwres_gnba.docbook,v 1.5.18.6 2007/08/28 07:20:06 tbox Exp $ --> <refentry> <refentryinfo> diff --git a/contrib/bind9/lib/lwres/man/lwres_hstrerror.docbook b/contrib/bind9/lib/lwres/man/lwres_hstrerror.docbook index 8150e8c..aae00a9 100644 --- a/contrib/bind9/lib/lwres/man/lwres_hstrerror.docbook +++ b/contrib/bind9/lib/lwres/man/lwres_hstrerror.docbook @@ -5,7 +5,7 @@ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: lwres_hstrerror.docbook,v 1.5.18.5 2007/01/29 23:57:21 marka Exp $ --> +<!-- $Id: lwres_hstrerror.docbook,v 1.5.18.6 2007/08/28 07:20:06 tbox Exp $ --> <refentry> <refentryinfo> diff --git a/contrib/bind9/lib/lwres/man/lwres_inetntop.docbook b/contrib/bind9/lib/lwres/man/lwres_inetntop.docbook index 7b80fe4..db2c652 100644 --- a/contrib/bind9/lib/lwres/man/lwres_inetntop.docbook +++ b/contrib/bind9/lib/lwres/man/lwres_inetntop.docbook @@ -5,7 +5,7 @@ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: lwres_inetntop.docbook,v 1.4.18.5 2007/01/29 23:57:21 marka Exp $ --> +<!-- $Id: lwres_inetntop.docbook,v 1.4.18.6 2007/08/28 07:20:06 tbox Exp $ --> <refentry> <refentryinfo> diff --git a/contrib/bind9/lib/lwres/man/lwres_noop.docbook b/contrib/bind9/lib/lwres/man/lwres_noop.docbook index cef6d87..a2b0699 100644 --- a/contrib/bind9/lib/lwres/man/lwres_noop.docbook +++ b/contrib/bind9/lib/lwres/man/lwres_noop.docbook @@ -5,7 +5,7 @@ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: lwres_noop.docbook,v 1.5.18.5 2007/01/29 23:57:21 marka Exp $ --> +<!-- $Id: lwres_noop.docbook,v 1.5.18.6 2007/08/28 07:20:06 tbox Exp $ --> <refentry> <refentryinfo> diff --git a/contrib/bind9/lib/lwres/man/lwres_packet.docbook b/contrib/bind9/lib/lwres/man/lwres_packet.docbook index 71b3e1b..d588f21 100644 --- a/contrib/bind9/lib/lwres/man/lwres_packet.docbook +++ b/contrib/bind9/lib/lwres/man/lwres_packet.docbook @@ -5,7 +5,7 @@ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: lwres_packet.docbook,v 1.7.18.5 2007/01/29 23:57:21 marka Exp $ --> +<!-- $Id: lwres_packet.docbook,v 1.7.18.6 2007/08/28 07:20:06 tbox Exp $ --> <refentry> <refentryinfo> diff --git a/contrib/bind9/lib/lwres/man/lwres_resutil.docbook b/contrib/bind9/lib/lwres/man/lwres_resutil.docbook index 3b60f06..b568629 100644 --- a/contrib/bind9/lib/lwres/man/lwres_resutil.docbook +++ b/contrib/bind9/lib/lwres/man/lwres_resutil.docbook @@ -5,7 +5,7 @@ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - - Permission to use, copy, modify, and distribute this software for any + - Permission to use, copy, modify, and/or distribute this software for any - purpose with or without fee is hereby granted, provided that the above - copyright notice and this permission notice appear in all copies. - @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: lwres_resutil.docbook,v 1.6.18.5 2007/01/29 23:57:21 marka Exp $ --> +<!-- $Id: lwres_resutil.docbook,v 1.6.18.6 2007/08/28 07:20:06 tbox Exp $ --> <refentry> <refentryinfo> diff --git a/contrib/bind9/make/rules.in b/contrib/bind9/make/rules.in index 9a860a3..a1ae551 100644 --- a/contrib/bind9/make/rules.in +++ b/contrib/bind9/make/rules.in @@ -1,7 +1,7 @@ # Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 1998-2003 Internet Software Consortium. # -# Permission to use, copy, modify, and distribute this software for any +# Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above # copyright notice and this permission notice appear in all copies. # @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: rules.in,v 1.47.18.12 2007/01/29 23:57:21 marka Exp $ +# $Id: rules.in,v 1.47.18.13 2007/08/28 07:20:06 tbox Exp $ ### ### Common Makefile rules for BIND 9. diff --git a/contrib/bind9/version b/contrib/bind9/version index da1d9cc..5962eee 100644 --- a/contrib/bind9/version +++ b/contrib/bind9/version @@ -1,10 +1,10 @@ -# $Id: version,v 1.29.134.13.8.2 2007/06/27 02:10:22 marka Exp $ +# $Id: version,v 1.29.134.18 2007/11/19 15:25:23 each Exp $ # # This file must follow /bin/sh rules. It is imported directly via # configure. # MAJORVER=9 MINORVER=4 -PATCHVER=1 -RELEASETYPE=-P -RELEASEVER=1 +PATCHVER=2 +RELEASETYPE= +RELEASEVER= |
