From 3121b759aa3ea18fd6deea4ec9aace488f4bcc40 Mon Sep 17 00:00:00 2001 From: Kevin Quinn Date: Wed, 18 May 2022 22:25:21 +0100 Subject: [PATCH] TELCODOCS-419 first commit for setting interface sysctls --- _topic_maps/_topic_map.yml | 2 + .../264_OpenShift_CNI_plugin_chain_0622.png | Bin 0 -> 44267 bytes .../264_OpenShift_CNI_plugin_chain_0722.png | Bin 0 -> 44555 bytes ...des-containers-start-pod-safe-sysctls.adoc | 114 ++++++++++++ modules/nodes-containers-sysctls-about.adoc | 91 +--------- modules/nodes-containers-sysctls-setting.adoc | 58 +++--- modules/nodes-containers-sysctls-unsafe.adoc | 165 +++++++++++------- .../nodes-namespaced-nodelevel-sysctls.adoc | 31 ++++ modules/nodes-safe-sysctls-list.adoc | 118 +++++++++++++ modules/nw-cfg-tuning-interface-cni.adoc | 158 +++++++++++++++++ ...tting-interface-level-network-sysctls.adoc | 26 +++ .../containers/nodes-containers-sysctls.adoc | 29 ++- 12 files changed, 614 insertions(+), 178 deletions(-) create mode 100644 images/264_OpenShift_CNI_plugin_chain_0622.png create mode 100644 images/264_OpenShift_CNI_plugin_chain_0722.png create mode 100644 modules/nodes-containers-start-pod-safe-sysctls.adoc create mode 100644 modules/nodes-namespaced-nodelevel-sysctls.adoc create mode 100644 modules/nodes-safe-sysctls-list.adoc create mode 100644 modules/nw-cfg-tuning-interface-cni.adoc create mode 100644 networking/setting-interface-level-network-sysctls.adoc diff --git a/_topic_maps/_topic_map.yml b/_topic_maps/_topic_map.yml index 5150121470..e7ab828df9 100644 --- a/_topic_maps/_topic_map.yml +++ b/_topic_maps/_topic_map.yml @@ -982,6 +982,8 @@ Topics: File: configuring-node-port-service-range - Name: Configuring IP failover File: configuring-ipfailover +- Name: Configuring interface-level network sysctls + File: setting-interface-level-network-sysctls - Name: Using SCTP File: using-sctp Distros: openshift-enterprise,openshift-origin diff --git a/images/264_OpenShift_CNI_plugin_chain_0622.png b/images/264_OpenShift_CNI_plugin_chain_0622.png new file mode 100644 index 0000000000000000000000000000000000000000..06bb772db181d2e4180787de226825422408d033 GIT binary patch literal 44267 zcmeFZRa{lw+ct^?kEkG0(uhijbcaevOE(BeH!QkTL?i^I8|g0T1_413knZm8j`iK> z^MAj6u-|>~{r1`Wd7#V5oMVkS#$DHSUjyHlGGceo3DHqdQ0|Do5SB+lxv_wAwYc@LwLg*7~lg2E^0WUZ@jW`H2qGcYo-(tfQ11zDcKWs^)(8_TOY+MRb@i<55&RS|*}rdLVf|mjTH5`) zQm|%BPP*1i%#2Si-|9a%N=yHL-)dp;Uw7Lf%IgEWze&!MNF+$_!9YGS$R|pDH?y ztc{~N;q-s^**0ey-V=I;w)_q!^^j3oNXSH9N$AR3%p2WiSL946K4#S8E?<2|{`G~J z3w!9B7vf8gLib*uZa6x$RON|NQ|O6KOztlX$MM@O{CZMlw@_DPgkxF8`^N=QP<9eu zWB>iwdh0F5pHFXo-Cg?k((V6y>AzozfRkyp{`c?Svl?~2HZ&ACo(nl^y!PkzWBKxN zOP@w&_mjQd#V&kWMdPNASP}*Y?G6~EeC5{D-@ktS+TevICL;0^p_JgdQ6b`wS7JVF zJ6>u3UqkF@Ce9*w@R_vTmVQ4dQMX_tM7u*6n){on?u^A^q`07 z)~i>qI{h6tjC<3hpMSWmR_$b?tUMrCl|>uo=V|rl$t|WWpEp0&9n#a%Fo-zlA3vV= zV5oof#JFUnzFsJ~yLAEe&uvGm9%MMf^S1pNazG_qloleQv}OzTaXhAKw@*GRoJi=sA=}AP}A0`8sus=$z(51sY|RU4lqASgp}g3nFan zS-K}iov|zZ*+C?{1Fu=satHFXs+6;prKPxSW}429cg+TJhU+{%brg$D`?CnyP5bh7 zbgF5k#igX&Rx;Ct3mbhfB^82$gS9=54GM+j!XnG;R|lk{*{~$Ht-`434Ko$eJ1@>p zVdMMKq=}f@Kina*)pBOeS2fO6FX6BlNqI>|)gCVlGp5?3q=r{R)y}&x?#%3L-SI*U zY!RAM{+H$PD#vHfzSp{+B6!AoWd%v@-P7ZU0b8Cdx0&6ZZSnuElBY?dSzbU*k7vq8 z*qqJlxZ$=|*mAY{A+t`kQ{gjjbXmUb_fFBVv17R!oP|wb@P-}HA|fIr{4R>21bj}` zrlu=f(~YSgXu>3Fw3!I`>=vZt(p59YEiv!h>8Mzc45ugHL1c6o#;}?6e8hS0^KR%^OgsB(2dJ5~*6bj~X zu-t3Z9?q~?d%CeR-`=dbUag#?T4=wj9P)E-+J{VH`{f(Q(0RRPzc@ip0S=B*@KG8X z8n9zUCtpHT3}R~1wb8OJ(-P$@Me!54exn5UQs>=;t*tFzY^sCxQ5BqWkMk3lCagV? zoLvZ|bPA5RUfF06nc&5^hwy7GH zpYYSd>1JJmfV)fQRdI1~v%x&2OvU`_9ly|pe?HKIN5*Z zOPpyJ$MdTG4GFIUy-w|!7p8!5Pm1r)*S1yTwJJ=S<<|3UxXd;%lf|xt2yJ<496W!K zTxF_9k7BuOo}CQ$S@dPASk1SEogQxD2Q`2DWoQTEi+C3qcJR3DWn`QU>UiG4z{rzJ z{$S;sw4eynnjlvF!iCT?hGC^GVXMEks_iv4ng=I|1tGQsoW_;@ivRz`*trepFq zfqhOEyv|em_N@|aKLn#7u=ta`Wvqvyw@G;VkQDeu5e=_C`ubuSxCyr2E5c{g zR*h)6F_^8w#Km>AHe3|Js5Me#B>VE^%f=6Pn&ndpt-d!l&d$uxg4vgvt4-bulSqwx ztii7*N+W5@MXa7Xz^TR8QSnmlxr<9BHNAv(t=sUr11lcOpDq3z2lJ6h?>#Jk@r5FU zN_JzUWcBSev>!oao1T)JZpS+!!orUzDLu}%Te|pm13C;t(j>j6K1$f4^7KevD71w$ zfO#(~q{}d9l&&pxCqo!z)UGb?H@$P~)@YGYkVGoXp+8HBHA<@XG3BF2O)V{hIcmLi zq|D9pw!T*{OgeK_>BBF>C9M43Qg@M27YE@dz5bz_|61Ug?(H}*i4#GK{;dAb51!{J zuY!}Gr{mKp=a>(FbErCpu&YcP_7thl5_R?3H7_r(bEd^Fd6PC=#247!pFe*F`{j!3 z%&$FJ`SFPef|wFD4tQXedP$b*Sny-XVs#5I)H`mH^eTC=8LvBIxz*IvY9&f7MoaZu zFiOt4%4-&lKdi3ZK14D;7$LWW56UYo`WNvqfiO<%{CNFD;JA`Z*D)|$AnFoPmq*8;o@%!wpEgx*U!>YB3H%_Ee-*g7~r8ml={P{PyY%2%?Vr zEB&yw4p5%3u_;DtCyRbUy+f!9#kwCMhxPUJ%sDh*KB<#NzCYM3$G8Lp1Rgz_gT-Vw z8@P>$Y2@?wjhqv{BR%F0DVyo|`1lqXGS0MW-MH&{tGCAkwB1~P{`?sg6(uJpH~eG% zn67;GZ_4@XfBK(#cMrd&j_^L8iL8sXfW+o2D_WZEQc)CG=XL_tSPx7R!u%F5g9<5?#N%>y6<2n!V(Q z=J}t9u`7>vSEYDxN3VM_mGSm{bxBq8@E( z)D>$pT$u>gDNodKnM@IeiV13w>iK;pk{!FrwN zuLZI^|1%;A3iiwqdMAvsl zeTM(W1s?!i6}IydP(P)~#6`!)Te3ujO2~YEK(&^CxukD=zDT4>h>H_&T56VAj)ybp z8x%2V0J^e71wtL%Mwed==?4vi_zB^s+d0?N$p1zOzP>$|8s+Tq z0^R3;S;T@!-2u*i{Ys8H@RU^S@18jg(cqvbcN>?D)}8INcgFET)wige&Hm)c=ePEs zjS9{F0J*6|`AjKF1wFl)QLDP~60<=v&ojB??xlT~(%U=a|3)H@^loE#SI8JAhnvVA zNv7r>Kcb~5nZGc2@p(^PzZ~dD1uK09Ah0X$^Z`t*;Z?cxmF=wddG#8X{Xi1lc);sW zJmbe>vM*jF#l z9w?74A>uX-O<=kC9h7>(7sS3$A3X?^AkKZ`c_oQ>?6FBxEbqpXBvpX)Zf<8#^bh9i z2pY77e*SznueU)kPzVi~^8WqxZSEt$1$=(^T+mpSX=Ew_T8v1>-C`n_>C9Em zZlBjvm^y%b4+sqaV3W})2`hjeA<>chFwzfX?Lfv2PrQ+e?Y4>OFst)*@_P0Lo+==J~$PPc|KN!--^Y@-qefnRH z@Nii`85n^3JP2cehfO$1#I67QW!I(>XKgE_D0?HB_2WHGmVf{Los&cVq5W<3zhwt0 zk3&@rAcq>)!_r~%v0!4`f2Zqozhd07X!w`I8!4Kjzj!E z#L$ha#qB5yh@94p7P%?V!Mpf^vdR8al?SzNg$Es`s%ZCzD@Qp|5V~jAVj)dthO+h0RWUm2q3;ZjsHik@2kK`1 zZEOy3u&@%ljfYxME{21WQI^q3a{})c@ns_J90?edd3XlTiGOLsgti`eLY3+^KlBlTxUh zOJT*9wcg+#7%|7NI+$;@#BMcF9h*O5UV7ykYG0Pp>THmpp~iHg$fZwT@GF{@bZ4k! z?vAmyN~Fps_g_fsJX{7%`Kht!WbzlVS8F1dpt8UUxz6*6*1NOcaz2D|}7&S@rJ|aT->h z4Ig`_Tk(~?8jg#~q|esUs~}dP@~C>~W3FCSDYrX7=FU9%>WRcG(^*jyO^dI-*aRW- zmfP7dfnCI)ns3{S#m#>yQ_x*pyPQyihJKV|o2~N^f>o{Du9{ z8*S8@&Os6tGq#!h_GJW@hriV?JhSs39fWKa;bG1RS4qNX&kaX1Ls~2xTJos^(^Au} zqoU4x8$ZvKPkBT|@`?MaawcHh^E|$wJa&{b`@g{!kT!4#`v6CYILwDC?ad~$X9|LI ztB(R|9M(r57X=Y>2Y>$jij7b*jJ6-x+3i7<1*kjt?N=0`ei<#Zs? z-}P`K>HDu=zhGEWE^DFeeh!l!;n1I@ALr)gl(Lo2&vv^Eizzb<1q5+-7~Gq$syawGCK`&UpTq zurOQ_60K}yhC)Verd=F{S3~bK#!D`egKQPXVT;m&f{(3d-Hc^aeFf1S z%@U!A@w&MN-7>L-F2S{Z=In4r6{7I z&6@TIrcKDwK-^|4X37Jx(k!W-%Rx_1uOT4-l)B@j`ynvVdZOFTbR7b~TS19YEFHrk zAN4Q)4xh&>>=vQH;Lb|QZ96v~p|dfVKM93QYS1dM_jSwj*`7c_CP_(21?)92h6}i# zAiAq3YFtm-KJv7DB8rHP&Kg`L(SGpYK^(8+#nEgKlxeVbrz_d{etKZ&lOCt*!0o0~ zG*#Zd|Kt^vF+EJJc{+6yz!7$T4+yxe(;=E%2%H=cRd@G~DE)o}+-KGs%+ul+wIaKK zitZB;rw8)7aj<$W-a3|r5RF&e96jm9clwrvF!=z)etqZVr6_3 z$p=f1sn~nCy{O5<9~t7xLR?yv8Eif3S}H?yy)L7|v72zuzBp08CKPW_G>nc*yVos7 z1_kxT-g56lvA|eC&sz0dWhVnV%}Rs`bD`a0Cv;!@0s?@<51@7f9tOx(K3G(F4; zqc#E~E&LNGsE>8fD+~Da36^}L(tZ^foJt_t0|EjFSPh$+o1ycO34~RDwhBILJeN%p zI1O;fRzOMtBQE@y4#-z=@h5!8K^~R719E@ za@=6UE(vdFgaKJ5`ibyyZoYAVaqtkmo&hv}w338xG8^Qo_+XHv2rcH8P2AI90_xcO z{pGt@Pz{ulE=i_XyP`#ZpsdvE2_qO}_Y1vbs3ac^x%c zB9u0{f7x6)n@!);G;4HTnHpC;cVlBQcxlfC7|q?2lDQbp9WnfW{67{%G7u~;Cqbtq z{pB1>WMQ*8p8wrdB4R?lvSDmSoo}kYx^JN0@V>6bP&%4IRZAek>W00ZgkB|``O=i% zUttUkpbZRwG~&w_Iaqb*;6cQ*1?KaTa)&*zWl+o4t~ozFJk@d9SxOGVAm-W{tFU8c zX0Bc4h{=^tm4JTBty{OSWzG6Bx?ykrG&AH4n*DI)cjT*`wxNA#U|_I5UZsMLpp=Td zOGc(s=i%OsYVrfRXtjGil3**)GSJ&y=#ZxD{TV_fVg^GnMAI@z_VF42{yH`F3fT}N zQj%YHQK|ZH*-;i6CQ0$o;gQKv2mW3noSp{5Ey4XD>WI!T)NmQX4FtG-Xl6n8bh%$e zC(Q6{$_rB_L4X7om)-Tid@`sTB0c%QA@mdQgD^??sH5@k-{ek~ z_EE>TA2M4IDPkdg(PlC^ul1y)J-XwR=iWYoTc^dRBDIHWHn_E|qZdSfVXE9>$gZRyD@Kuy;bP)k^Io!?=UHplL$v+%k+i4zfgM$)7JJKc zhbl}uW2JKama^=X){HW35@*hMoVM0Qga$3=i^#xcVz*3{7DkJe!?oWzi@hBSUD4AH zXc>JKK`*Cbv)U z6cT=qQJq?9hihERM3a{X^AjSw9gT?q5G6kI24L*~tqGLPFm}_D6CiG}sbs*MjP&%9 zsPRZh;?|$tw_!6MuPm{`iGjA8&Fqi)t^}RX$pT$3D?MxLg2nP>gkN0}YWJgvb_0%> z)b6D`?Hce)Wnh<~1Bp!ZRxdX0hGy*YHm2a&=kRdlLOl^V(O;{_=*{z4YDI?N)J?O% z78mIJBvDyHsn@Z;I6Ky=a_EN~u3D&9fj3lY5wrAoj`-`wrZrSSR0(c7A+iF?BPDc5 zw$@V|bnkJ?s`$veQ#At3j%t2OHk9MlHVoUQ%F1bMal-lKc1`> zaGx1E>%P&W5WLQjy~Mv*U8CoE(fuj|78AtkMC zmAG@Kg9LVSo1YTK@nptb$6;EzhMHXVDl!!Axbm!iSY|%kxfhz6V*ud?@^un+Kg?T} zxi0slg0tZoH1&cbD`mWVdg5zVTKK-`4k_9F`%C9rXXjpWZWxk9FA}mLDgz(lVr{(z z*}#55nh=Wleh1wzs$S!rbX7(ETZWJ9;3RXjl~M zcpQrm3*5VR4|aB1!$7VPGE|cnG`Ao($$J3b(GVxX|Wc!w!UZo zt(jI*kXa!+)NwM)Rn-h$!j@a~NMO|upGiRX`+F#0Hb=`g8!-h#MFkFI?L>i`GwFGh ztE>U-Q)qG}@H$!ok};Lq}xs@=QfJYr03pVns1e$AZ-WsUV>~ItD4bq2A&~ zm!V;$FjINUEb*!jL)b&eH%Qa>E zn@NdRDzGYh=f6#Oe4XU&uz$6QQ8liecBbE`|FUc5lV_ z6}+P6=>j7|Rf=8j63a=oOvUDwxLUXE@BA$lo|#IA)ww9-o3S~xVJ6xa*ptqSaS$~r zsi=$$4Nr7l+3qe#%dt>UBtga9gKuJ5QYjV1GGmihMsucs4$uKew1{?gsL-JjK2A$d zPluA~D1y)9tbEuUV~dg(jBgpR(C{|{k!xpyt|DdDz~j}X>xujbByk0!0XA)+BL>aM zXAR5qGP|d8Uzv!p6A=?TrBbM+ghlSED}@?^Nvl%PWenUNWKW<1z!W&DuloWqVNDB( zk%GXy)x|!|Q_`_O@P4N@Artj%bEdx90p+gQdR619d-^U$)WWfGr|T*PfelYwk8G8d z4&|a%on81BMyyKxLS9D3m{@$;(@FN@3&vaJ?e05=^z)vM*mbk<4yP5C+I5uZ?>~5> zMI#87!!;KxEmCF=n5YAbz5T=QTB%DaD=QoR;IF%Rp_jektZ_w18xIGE&ExC{5aOv$ z#X}q#`4lK|BbanNpp^>1oD>(=9@^GXtVV|I?i<6N7rP0N`G^HQsv$yx>(Z%xn}e_j zOX~!M59Fo(JS~mTVE{WtT>=^qY5~b8f(XU!AFH8)X{djbIv{E7DH%MuKjE^P3u+jM zw!ifX&j8YZ(cUBLhQ|B7UB9b^w9pGvB>$>CNte8Ui9UG`=IB=zdQT4*`%g3UIiP=3sLYxj(4mxH@3*E0TGv zG*$@h@KeKAl`N0df7Fp&65&D0>Al7{S2j>07Gs1~wSG`vG7Sr#^nEY|lvCB6gi~fc zUh^dJW^@~u@ObyqocLcc4O`qORyI4Rf1yqzM?N@^)lV3wJ%6seTjpBjM_ZzviVStN zjOU7~wq1T^{UVZvdg;QDXF|cOKheFadA2RcRW!yiWO=F!INX^fy1-s2MrR6#mO)N- zHsjCa7x+<8h&Xc6ZMOp?A)tzyfjG+NypzIp;@5Z#lsU*~mUP0n)R`cmbVRf3g#+&n z`^b6OD;|zsqWcxYDZ6(K_JAUA41Vr9?Tw$Z>DGjC)__I^DEvA73k1{I;s^+;@O9jn zP5Y?3qdup7B=udo4_hq7mnWav1{)^g)2O0t>HxhCD3DK2R`dP!^d=y%?=l5e%^|Cr z(TI73Mey%#euJd(ODfy=$EMfAv2kvpQvaS(J)5|m5bIwee z!hcKxbOAO$m6}|^T_Bm(E*4~C+XKA<;Iy}%^YEsZA&qm=?V&W5w@BH_C(en_@fd_` z#y%0$;ewtX-5%Wyy~b=aPeCb@PpT8*0j(Swg|st=?-~6A8FI-GUwV4WCOt+i%RGYRUzbVOU;SWjVnQ>su9fj(JFDMxc)irTnT^n5 zZTk7Pk*x1VoVHblT>9IF`%Wzx&u~hI>GehL3~!xhQOcIa?G0+w*iU zC{PL89mM(b>X!|_d;Y9VIb+Xhf28|H(l5NKcGstGi{)v4ayC-z^qUOz&DYGw>v*cT zPmc{JGovARYE&b>PQ7Gq|2dSL?#aIqGh;h0$!pKE&Q#bk;jy2(yKR)#b)4ql^qQuW+DOtn*NZ`(7rM&9p+T% zQr#iqsD^)FU4?zfN6R>qLb|IQt(dLA^fZc%AH)OvaqmtNnJL!>x@a5g0mh0|&3?G5 z#AP{Q6bt$~5LmijJ8}nUY0{!%srfLJ41Thtg<~Mjq*pDdceJ|EJpy{95AWZ*fqY5N z>|?Vp>1|%rjTeL_^2As39&7g-U!ylnRnL{545FLc)NZEj@AF@bKY4tR{z5Co;u8g z=I0Fk^Sy47>DV%YW69jBC{fv(6_?UbMi&}LD(%NBfY+LIXCT;t7HL0$`a}g7rMRVs zCM6@l5&7qJ0<-|djEIGN)MC7A9>_tHB0Vj7gu4@Wq=8K!W_kSrfX7nqF{R&CAZB&G zz5WS0Odw}z2$ezSftYIAStVWD^9Sqv^lY=^Ge@JS3A35$4zP1%6fU z$4H5pzf2rrlJP0x7L{~#A7EmL^Dj7&mrTXdT@KT}kM7WTI;8n6M@xd&QhakW{v&_R zKQF^+H9Q*HK0R%Ca1qh-@i2EdmfK~pk7_C7fMe|~=D%pJ;w?!ebREer6mz^WI zm~oq#q3Pnj(E9qXb@!H*?wst}7#T_@RNJ2)a$0GZsq+bHk#rIkNTr=hmtLg| za_!}8Hm!+ppsjI4<#w}9kjTB@^{{$8;(Ri<4e|M7OS()`>BjFb?)PWhq=+3sNBDU) z8`z&i66I^vI&>D0?0l)>w@89Czz9<%@w=z*1D1Hh>BCO=X|Xdd2Br#>O$rN;2E<&} zQ;Wb-3}{%18+ie5aRCZXKq3!a9>^=HxCHU`T$WJ8aXLN0G^})vnQrmiRkifn69ZZC9x-Kw7No81ASP$YipripD!SAvc$zc(Vco39P z3ba#_Yavw6CMbg4Yrsu(XGa2sWu;cXUZJ`1yP!Zw;WIa#*~OYHow7%@b$8Ot%l-KP z8Wlz@#cZ-B;~9sTWak(R$%PK^jIAR_ZB`?LKC`iBnTi%_$X*p4seaR9M=tu6{X!p1 zX=2_qg|Z3VX)GHfna=o&?zjBB#e_f<)?AbRp@}KnedAVk|B8+*u?E|s|Aspnb(mkA zhGVW~>C4@^=Hc~?x*o_DRkYe=d~fBcKinn=wsU#TgrrGonL)A*n)%qt;P97$+b_}+ z;Ncwv59V6ND}5Dui(hS7=b)Uu4}xkk;5>7oDEe@MnM98RD($`db{4@)6cZjc`!z$E z{~)#;FZ7)(yH<{y<;F5~JT!OL?YiogTCI=v@!19Qv~5@pjKBVzv*r@+uBs*;zvPaC zTnzen|8mE}OIN+uFh=<~dtUWzPL}L;Ac?Fu)=ajs@UXt*D^`d}KW$K9(hA^p-|1s2 zoSh){FrMrz6Nn`wBqi7y4ax%MQ-3B>&VV#mHN#pCxm_>ZqL@>NtaP%JKW(8ojI5vz z>$%VA*&=evkv*H)Io{PA=fJf_Qh9(QJM8+vVZ^HLe86$sJWxS7g3ItU9u*C3Fhj1f zP6&3tJ&dl*sEZWY=mz|fn@Qkrz?y)KHpVIxTwIoZCtk`QA>D0lzWXT9l$~F@GI?9h z90(B@veffCMb}Zh=Ze!XTVpjbcI!B7bnaOcYBh zw0r?}9gc@SprFtL`%Ow`2jiZ6;R>AsD7RC%TlcjaQTD8u z=f?Q*&!lF_N17G%7^u@&Um}>|54F-ClD<$GH>$Fw(&&g!-e?e1KhFClhp(0?S8UWO9Tp6r zys2}l+*UC(YC;`LIR7mD+403;gIqQ{daCL28FHdLe(v-@o9~5WyDE!kc>DT2_olIp z$k}6p+Qk8PP>G~t&!6AoTI)RMLL}6@UN7Q5-@NnDBDWoEE-Uw0p)fJF1O;kY0Bh z*)J2ngHk^w9rT=7RvJ3@9;tr=@i5>g$%u(Zj~@dNRm|7sXJ+0mCbJ>bggP}>qwIuf z?~53zuBTAvwb+SQPf$@!ZO?LAdz0h*wbJLd5E<9B`#4w>lr+X(e5YkO1 z%}@0jk0T;|o%?*>&6y`X*6H!u^_8-vqnXQu8om$S%U910mp34DpRM_sU$dL2YO~BA zlS`oNzrP(_GKq9DT>cj1=hXszI_x}c(&Nq}87)^|FW({M9-FNV4SOrIJ19!?$~7r7HY7mA2pUqIf%q z+g~PE?zLfLzIFv-S3Rlo)m`_tt=1P+7Ujo>BXcC%TdHLhg?b2l{ zZFV)sqUwbdwu4he1iQjd?@05@_58}jW^78pwYzhl$8;+@xmi4xs?)kk1g%ic9}kyS z<+Xr51j-aNodh?RKlgN-wPo z#;0FMm7ABSCMDg9ekZNmzWzh*pmRw+E0nOVy^jQ=>L@{#iMcz1!a0AV+t467U$gqF zVm7){p5GvV?Fuc%F!g!yF&y;le%ggQTiWj)#n~g3>*NXUzrKgr8OP5cBk707L_iQW zX;`wId7e)tBk}zCbG!3TWrxyP`$$qsFcxUSjaEC`2@Ah(c=bY35*l*Bk&zY$u{z@) z?N}$9j*gDtMsw@senPlafzJXtI)Ozr3{QZ%Cs00n`u2tUkL6AX))_Na~jZ-rPgQm`QVMu zh*yD_2Z4RPljBgXzU$uaC3YvIvxR{^ftZH&^VGYT=M53YJE29LpQa^>xyp2G z^m-e=OtQln%zF#{m1nsz*;-)fXn@A@rr%(AuITLtY zf9Ns$@3P4~-yK-jA>J{4^|GMRa*zmNb$hi=zy0JyIzE=gEm>F8ioq&{lDanZh=ygKN1+FX1yj5HsZ$vY;YdfnY;3ZpG$6w(?3 z{kz@~>C(if?S+j=Rb*NP*6DdQ3C?*5NNFM4IJuFl@?y$Tv4X4ZU4j<{!kIk^hKvEf z$QVk)j^5+4|4KL?j>eT_)Zt2hN!zZHGgh-%Z*c44boYWEJO=z7t@aKzsZ>-&hRZt7 z%-i&fj@6hFOU}8H?#%$=gWb0^Gx|JyeBWH_-gfP~iWBaH@Sja~IIkvVo+0;v83bGn zfckV2c~J)KdA;-+=y6B0n?bE;+w#21lYe@8dU<)-aF-;HZTb57;Y7;8XrsRQuGoT^MuG#8&2#jRMfg)`HQ@W8(JB53q}=RqWsGjFNQ3BEFThQ7V!<% zDdwELH&T=FLB2Yh=^u-pE{$YJgVPrMe4O9xd1CeOyt<9i(eZBZnFN*%jTg6JQ%|m{ zUqc~HX(4qr2Q}f$TM)6m5n7xa+`O|iRC1V=dJB_mtZcr8eLZ2BmeNwS$_1Hcp{qO1 ze^R@*dog}NWzQ1_m)1jCYH*F&=KN_t3sz2*G|>TP?ZIquwr_S*pUN}qrIUwBSTJH2 zK*~%$;)ikB@V$I(=KBE&GNkyfM=z(7n&ITp_kMp3jvU+~&q8YhCt;6e^w3G!QAPB^ zrQ$xE?h5l$1b(3=5-ZS?H_@K!+jyGRVgF2t)$FBA?<^0-vpB>@# z%!5cnJtw+%`9AWXRYb@A!N4;%`TW7n6O&$Gi<-Prhz5J)70x-o?g>RxnAY0Ns;_-X zKs#Lj5{pQ7@(qT5t7he0!Rfd!w5eGt$cW9&xKeT*pyh@jd>w7ijux9dl!k*fNVY3H_fo_IhcQM=%v4JCfUqnqECh(SU-K~DWhE1e zK9BSL!6ctTXlIp8xU@S?<}EEP-FqytHeNO8h>bSYMLPD4M8UR0*t}G*`o^~o3iP>Z zq`pv~|M%GV1U%$&1;{iF4Sx_l*P+)e7LNNMjgHG`$YHcTx!=2j>)$Mw(=*$jjE+}1 z+ixVZ$lw*M!QR-bUI#dAdUPXE>9F)NcKv$I;>$=pdgbtz{?Z(`vj4HKx)KqanF+HI zLlh@3YvWo0Z}=~ym7$@bmtk&Jf0pU_Y}bMXM@xuB0_o05OhSi7q4{{{F&(E{je`aR zu05B=%FS>xK^Nil!`Si6KGQIYdd?L8nX*akie~v*^^3-LVMGxZ1vUB+6Y6mrO@)!U zL>|A5?Ff`91v>2>SI}^!NFAe>tza*>koc)e9Q!pRHw9;Jqt14nI(qV$#HMrmxgP%v zQ@zpM8k!O#tu9ca*ErEXiqUa$QuU!jJ+m)b#7;n`&M>v%YfXQ^g~n7F=NtLQrCyti zv@Tu;RaSVO{8r(SJ=OL;-0cH-;~vI8M-rm>hLz1dO{^)9ca{X5iZax!o_To}}`Ww83$X6x!Rv2_-^BI`h2#By!K ze#60dGw<=P5tGKz zImbA-cwLZYDba-e{F&K~*J;BYSF*w$zc(B^^_e`onE()}uY7OUnaj*kcO)-Ij&hCY zwGSBBnS~+S=dU6p?i(XW*|elEUB!t zxLl^v^z?C-a(;iF-Qh>KO;}Zqz6K84 z`&F&Iza5|9Y=<>YJ0U!{XCsPKPcN@*VW*h2(XuN-u-g9AD2RB(lX0Uj)gQl2h1w1i zXbtqj4g49|?7o%G@l$Ab8KgL`I7Vrqcgc?KISNSISFsbWTU`@zMa7iIr<0Q~XZC5F zj{Dwfgq)C-FHz4Q%(ik@VBOAYcy(kU+iMIb6?owI--G8sNWTAAK|w*G?KJHT2Y^qI zr0|PBo-B3*?|Ztnvzhi8gJ|yZI54!mp&Kf!1Xzib)ldp~aehwp(C<P*ISHE4Jeh0Mh`?m(h4!_j|Um@#}Xc>)a!4%jw zoW8V!0}jx>1Fn_e(~ryc*g*&!A0!oU8^RAg0xp?+G!(P~Ik4~`>jMSe4LIHir(7e4 z;KZf*r%dJC5jaCh9S&_V>B1ZqgSI6rtn|)kb~;v8*1=JG6Sio%WYL`s<+UJyn~GpRMK3jb{)%v5X@1lMcEgH6`FOe7FBW z>`?nRuT;E97jFkHV?Q>&#A3CAuSKt)2;q5js6dxb^{94ts~2d&df~v`U>e9 zj>HRhGB8kIVK*J}Y;6ttacz`!ZF8P`xGI3~)6CvaY^oqK2G#PRNO9K6y*1^0@gmEb zsynWBITNp}Ck8tc8ZDXRbC!y__?b>Zw~b_K4i~nd;_`a8#}lWW+`V$gCFG}F?(a9G z>x22{%GsxlR*b^pllpeyHG}?M(WU14ooyo}_Q^A(9v|nD`JA=GuiI%M@5D2 zPkOG}a{1#hXlK0mqKRgX*P%=uww(FXuxOk&vQR$zl-~q>YmB1l9Jv;E!wp9azus!y zVUuy==FJBWgsjW1-cVOZ$8ls*9~;-GW)P9Ip~eu=7#n9O_qluZeffCqB&RD;p#Qz2 zd+JN4$RqEXn&BwUB3D+ciO%Z9*~R>vjxQ;38Uq9hT%oLO328L%$c5!lLjE2+zdRPT z#dPI14^lf+ghwe`>154r50m6;P!wfyvATq$UC#1xQF?Gn;tNFLLc_X-1lRhQ!^ro- zXDu5wb!Tabk9>U&F8Xt&8`;|<#w$J8>G!%*?Tpd_$=JVYtokp?NRzTIb)Q$gU|jVU z)%V+14SvMXahphRoHt?fl>25H!NNjGdr_K{$M#ti^*@J}lZ2e*hu*AIFZ@hL(n1?8Xy|KB$H4^)9{u|cCqoT48&48r zMdX~$rY>@5^vMLv#pKxd!Y^O(&!76bD?_&XOwWAZ>0^_ll1$wnC^;lY1dKL4W~aN* ze`LSR-WB5|8JeYeZk3&6EpvF`yx|3|6}xbKhA#a`Uh7G8#a_a#@;6< zBItP_ey?LGy;D1-clB^%%yxDqwW=(Smz!H5bikN}vZ*O#h*AC92fqckaCZz4s{9bOp~Ab*@YI2FO^g>V_Ir z?1W_}dzQA_(QhO6s2M)!20tQNTcf&QtJ9uc@V&WBhu;x*+}MhbH9dZUVPk)oa{q(V z`c2X7RDur!rV4|Rudcskd5V0Zp~9?8@C`%$;Z}7`^6p+mds>GYh@42!(9%Og=gNof z%T3+7j#{!YEeD5raxUl zsrU2)iTl!$vGL#I(jbZzlpAmtZrT;k321cNCA%^H@%<6k)2a2fwS83HRYHRPyRS~W zBZFguV}(DbB!}FRxl1@K#ac}MPa@_f)uSfnfV@{T_ z*V6v+{coScm&r%C{~+w`=DDAaH+rkngrMt11|}vaCnfNCyfJw)d3F&mFk!=NBQAb3 zrG%NGInmbSgA*8>lJxf-2fM>2YpLKzqx=%fQYcHwdW40M zw;#zB57DqK9oO4bzwDj~k5eO*!}%@9WJMO5x##jc#6O$p!>pki9s{XYH~Cy#m#n^x zy}22KyuoK&tfsZl+iDzX1za-Map;K^Q$A8e=3qVcUF6buThw*e;9Z*CM6E}La*{g! zC(+!v^{AW=@*#4`y+jgW`6+T|1pbr{%}y;SafKryRmG^%ZNsum=|@|BKX¬4W@X z`BB^&pe`$c<-Swl>|B+o@su^Xij%Cy<(SxgetAAl>0()3RXVMAb)A@aLLJm*n{Pb! zFCkZd_8>H=e*_RHB#YiL{`Z$#p*UgIf8AwzhT|RkD5O{2O7vHKNh_miH~51mQi8_AsK@V%$@;fv!A&{0Wz|$(7F(b3Xs%s1 z+f_2jVWt4AzgOIOQMxQgj{4coyq&A7k3>ShJm385@VZDf^V|U3>nLy1OvHm_K+C*6 z(+q__CJ9e5Xo7yzCp;>@`XDKgN5h}vX|P{Q;b5Gg;VcIuk!>VBlaL7Zbzju4^f&6C zbkzO$7?hGq%@C+>d^Y2Z@xO@r%BUc_CR(H$r9nz*q`Q&s?(Xhx5Rfhj>5%U377&o` zZt3onxX1Tf_g?<87K`V^oS8j)?;(=@7l7|gAc9cOnF3f%lGr58cI@@aHG3U0cA8gt z*onES@Ad;a=qoF==rZ3DTQk?ljmi0j#8fC0XmR)AK|q{w^s?e2*V4X%W*)F%IRm6O zKxrl*B+M~=(X zkw6?nI;{}cO#u-Upr>yfAL{@PaE1+|9HV4zd4S<34sUhj>Gvrt1F^hFXjeB321(N{ zE|{XL9j?zK7kLy3la$%|sHAsHz?kMomiAnQ%|t$y=ya-E7S-sewfYiUd8WV*gYep& z3ACHOx+3Y_7g~6s&k7%`1toZAUbW}jzmcU{)}lehd#;TPc0Dui9NDKY@o+9BRfb8v zZELb$yPI$PC@THq-F9XO@^#*CQ}S36nZm>p<50P5#^bY!_x8a$il=?n1D+7b+S%;1 z!yiSNVl&i$?aiGt6bPp-;w?z!6L0t_JYrt`HsJFwwHi})y45HmW3)-C9pa3-ZFz1) zysD|fB<|R7ukmGi(>N6Z-;m7b&;t6yUfWrxc9-8XpoReR7Un8auJJfAPeUF}%5lZu{!af896Ru;N~;N;zEu zb}y!=c;4jHb`GCE-My<x}^AJ$luUbPvKW`uOI75Xi1t3#r?-e`}tdcv%^o7npH z=Oh25{XdJ|;JSQ?MIOvO-z~9+6x@IjR9tM((ke3@!Dkr`q=tjI#11i>sImbC9S}+Z z{`%^dH&Bp}kUuo}k-7OguEwMD9^I{{3a5WdvY0N~EN|t+oG%qzaR^t=JpCyv!x`7( zcW-rD_2Q~m{)Q>~&3=*K%o}pU;&GtY$Tp zD^Eyye4i8y6gJ!zYiCQn{J>&4+iFmAlI!oMLzpk!XtSqHUP;$l;zY4bzpTAQ-i366%zv}o5>qrLojpCb{@|FDOq9?6)(GI^Y@Nm01!50izxk`Z zy%)B`ACRCg@r3RtS%Wt5P2Zt}9JsiIglZWxO}s@Gz6c~kge;gnyvAP+eM2an`}>oB z!TdNB`Wy1;ykBG`A0&rtl0@q?6Gfu@6Gk4-C#am|L{g18E9Y4PNf!CnsQlx}Cebt> zur@dcY9mM~L&P2yD1=3)Si7BTNzQ98r}HEc#~&)SvoI9cDypDqPjeG(ty%L#^}}<+ ztVEQc@4QZm&{-l?a=YG@So{ zYpD5=NLHW|DJ95EWvK^eGGYkRz#45L?v%^A@02K2qqNw5_*;+hzhM3IpA7XI5+k>5 zm0_cbH)}EvP!9k@pP4EO*)$McKeDFRHmo+cwAccz2H-s%rUGgX(A6lo?pVwA zJL-UUW@6`X0N6YL1df-Rdua~ylF0HcV7>xGJ>ldJX5J)FTOPq6VQY+UiyYrc2NlLy zT;ATT`zKQ=esnLpy*^OBewUfgoO!f7Mn(q&VGTeY0N9x6z_<3pGE@*UW}R!c|qV$9<6y<9FY z(VwwZsB*0PjT49Dmx_*oh4&sKGb3@KN}4i;?O~UJ(PL!0IC*^Ul^2iv@8fb|sWe+f z5<9+fqs{%+LcnU39{>Eob@puebh#}hvA)3EuO+h=*}UBV!C;)x)Q9~S-9WNWY88`} z!*^MF{H5WD2to0g++OD^C3$fSAITIiKfRr()=bxOJ(RBf_itHE-F!;sZFg@wo2Zea zuY?ZBi_Jkhy}{%58raosYqXb=lQ|zt?vgx;X*gp4hFON)U_OxK>u(zln$pfLI`>EQ zDE`f(hHmmj;I3^juZl2Iz=H-eJp6@)6m#hWdKdbY?S4tGf@Fk$i)s9n017xgaR<3t{ zpQkKn*Y0gUrE9C!H8oWMHU(gTIXewcWGG``eC)WbTjb0>hL&s4}ny=nnG>V=S*LFqCpbjB1`XqzwDv!FIvd7MGW6^K5_3gSxa_k_>LIYWE^Dw^Y2tB_R30|Kp-&I&TeRQ)c7_2De;^C3c;JjFI-$C zEIv6o*?cpGgz1dHkR{;TE>RQz@+Lqigib|E%X{l^C(>LFnSg6>aPb3qxTyaTn-!Dy ztTUue2UOT6sMfQdfdC{n@QnkXn_^Es{XMfv8PS=&U>h5R_v~~Tw z)|U%G-fnV_mVU#xx+jFViZi^v=-i&yB+I#u1oQ8a_r+->@x9>&N}Q7%#Ei=x*>qM` zlI<33n1>FNK3}WLnz0v|y_d+2$+1OVpmS8LpO}5bE zjXjvnIfw|Z>$02p)jLf2S55TN!V>@c8r8t3#`X(me236{l267(IS{r_PY|_c^wrp|i4V z){0ZD&UPy;?zzp=>mlmVu~1Wu#&mDPZaO)BfSv#TkS*Xi?xex+i@p$S8Z z31rZJNX|Cb#z#zuFRzFer$zUP9?NFLB=Uk+BQ^y4KQvn>Ekxh|Ih5byd;>HNex@aa z;zJ1j>gyNl45L!ZWgWF(v7`7XIl7kVZ)Ld)(*0a&-hzUO^;VR0{9^()+vWT5T_iSuM44tq)8AvSH?;lPmSEML&B)=`#fiC_cj^l_+o( zJ5<}uIb`&w7~NhvJ~vvX18nNurXi+iyERW_;Kt_8bd9#Yl4f2$CcZ}T=Q7mQp6rm| zP`(e;JvK>-nTZ9gDYeu}6@`D;hn1@Mc-YbKZ-k!&8uUrqhRhS;sbD05RbxD1hjUG zGG31T4G$wDAt$HYwq*DIWubVJnc;n5Z+C14Rcy*IIQP>oet9eg-P`+|j(3}zAY6`^ zanUee0ywqdaE1X>=l5Z-_~Hg>yJJ`MRvM@cloA^iuiSXE57Th?koPslXtBSaKpCT` znI_f2>jX1*IfzNK+@#lUb49nlL)J~sAX9lP7t7f&DvBjOo@#qd--hn)LPZ+8YOjlo zEK0t6&%}s4Q1k2S*8#LsN7^zD+=wLFox|M^h(qzIcPfpTMSZ!hIPoMFh}fw8H5`*A ziN1=v^Y5DU)G^qWunP2C6dW#iII_=mN+-DalnaFlR3rBQ^3otN`S~W_-=JHi>|1}@ zcblY&(PEopsplJ0ZNd1Nb{`_on?I@l0&=a)LH;iej+sALMBDSK zg9kQDmdEbnJwkl#?U}l(zv^>JoXF>H5(d!tcsnvyr%dQ2sl#p1#qIb2I=EMZR$p^6#? zk0vbo!ddE{Hq12gAAU$pJ=iFao58lNO%sNJKa3(vt5qx0k33o>E5e0?{BH%mv_m0t z6HD1sz)N$=>-nCD#gmPGBlr}dS;g}DjS(3GgAfb*Q6h=_^-Exk9Q|S!^D|oDj4x|P z99i9ss)=1rfn~I2?-ccrQ%ap zx2Kjlp6qqBF4}zB?jGe(76Oh`8Sq%H)_BVHVplX^jxu^B%KPXLWL32Eb`LJ5#P>MU z#_YTZafwr!CrpMt?zsp~c*=?F-M~WSO{eaZFKtGLhnm$>#uDI8-nD^9bVJ0uG`RSE zt2y+}u0pSs#67f+Agu=3?ba)3HR|CLZ+m-R{l)xbw1b07qm6|(+?tl)j8xKlseyK{ z)aYj#xWMio{}pGRsJJft&;VjeOssa_%L3(5W1aiwL%Cnm)#)FSr4#ATwvt~nKMHE7 zsE*i-$u^)LTouI-rtz97sB9zUC&@k@H0_>ncd~sOC_+(^U}I-ck&O3w_pa0PBmz;j zRK4t`fNDDpFNWkCJb?g|SFcoCP3h^0g}Ijpt`bxcR+G7Xz(E=qMI)eG2E>ilb{m8i z?noja92A~{NBHk!15!~;(?jLn{LN8Hlx3&sbz0uvqvsa8zLTT*Vb#*@gOii3^w*U^ z(tb?To1{4$Ea;NaJ6+5{Vt(-O7-db&9;_m2sstI9_QO*J8-j-$)MCbhREWcwkH zSn#~ge@lMW)Xi8&7xw(Z=gd@(!v0YF6-h-{^rb8EJM-&^= zpBGOJ5l(EJF$TeMkNx!=ddj98j=*?B>+a_V9l*LpccgY}F~9%&r301+){o(*KXld} zaMPtxDF$+{5ReoFvF#BH#*>+=t5cdM^E3&OQLl!Ou%4{O1;Y}Fmr~`q z-OT}E#$ta+9L-LBK;Wu;X~%rTSzufu zQ^gxmD%DCz{K?zr4!X++X-QTNtHnmcEB3lVIo!pny&7RSp-LT{CL__an9*LM)gsz4 zBN0g_H%B~vL#>&z-*&d|UusM&fA4@hPejCGvC*SnWYu74WHYFC*OBBmwbnhx;s0|r z{R4niyZml0Ta*W&^*%!tv!#+nNbO=2iSr^I%^fbEyysYLc6<2!@(k75xZLjM`MS9^ zoLKd{V~x%_{UN=Oarkgb{n|g%E1FbaM23*#`sHMqcK{?LdgoUe4WIldZPn0Ir}3Xz zwv%?3%h87|c^@o%o}nhf+FiFwohcbIcs!58`^JI~*_@_E_Qtc^?9|)=t3+$!8;v3hU^s`subm{&kZTLp!c>(03 z=4`0S?BFNodbU&0j3*#C!DqMUv0bUYDvI@AZfBD{0!`k;bpeB`rJXi+8#5Pfamu}{ z=Mc*V7ag4_ukVAu{VrTPM6DY~{~inwi=kG#JBVy)&5m~+^Lbq7zk7DbsCG+FRI@(9 z)lOo|^tuMx*`<9!zKJW)jk#dsLCt|~98}nC=&EdT0gA37d0dv}qBR3^DM`WJoolXP zEw|&L8XvXPu13RxC1%c;st40mP`J|Fn+^@;!4VJ;nAWxU>{vyoHR+yTnH=2|c*0xt4|A9Xwt22x!%xeVt*;7y9sBI$k7@EH1FDd9{x*Z7w3$0ae*a1R-a>ew2-6$Cw(~js72hLVzHIalqbg} z%Hr~QHs%bv^R31_35wXF@2H(6$aYZP7j9|@CXth2wJKne2}&4SD~x}_{-F4a6_;CW zNY?uDw_f!~kq>M17OqlvoSy{ES{MRZ$f3=?to8>w>;dRV$`Fnh+I2PTDI3eQ4Np8a z!d67;ZnA(n+PfvsH-=}QZMEwB9AaiYar z5aTak7zh3o7Zt-lJ|@V_P{dD+pNf~y=JmwJj;IBknBvf6Z;^ZFnc&ve7Hv8l3uqZh zcK&v69ww%>)!t83&COKj3?F+yXTZfPs2|;uiT&|=_t@IlTDKM}KBk`7*HE37Fz)3Z zQEBk_V|wya2s4Wfq(l{pqn-8-^zXZPkp#p!B$g*@gRX?*&|H8H(C5YD_ zRp2YJX^G!CQfJ^t^FQ1@00|IYP&bKo(nax2tNR{>m3B}!>g*@~0Ela>ac51{L)lrQ zToXyRnid%QiXW;(X@vmR$HRVv_l>kud-+Kcl*P1&?7RpMD?pFi_~HmW?3(Lirks(k zF&rEnC#@PLKwa@vxB3p(bjo3O~QQQ9n68|eZsnb=7nr; zVL)&MZPwpu5Wl{e>0H!}FT0!`oF0%%Itl4q_h?S%=8;zEafbHCUaFSXl@HEWeO}Ko zrY0AQPo13nkj(Jh;?~!}!@(MHHppzteM762n?LwVOU3Y{UsW0u#`E?I_fVh{r&qVK zI_><}zT@p?!|#8n;iNRx=UgO}NS{1DzHTC8IsNe0s=uBu7;7`sZ0DqP|09XBJZITlm<2hdM!g^JpN<)Id$>wu?T3zO7y~bb2)isaVTGzsk zr@ZXDnjS#QfE&RuQ zzcazS7^0Or@8!b$U(m$sPtn@0#W$*av$@y(g~kI>gflp7yGc;ylhJQIi2MY9;6WKo zJV5NDj0CK^GSUi?`tkG*P9t7G+)wY*L$GPrWpQT%}#4Ma-owV)*#J8v?iS zfB5q}EFmu0C1SoVpFg(a?ypUTBeu(nt3fjilo$-j@NjTw9-W^{Yl6JrNB2i$&;D?2 zT{n|GS#MAU_t8|*FuE{tJD+TkR=PGLBQfj+0P6U|L_}#hO|}}-HI|uI<}o<*S|5ug zYDoXOxmw-MUI_nnA*RdD66)#>2&S;3H4-`|unj)W}7M@DRz8AELp z+wv!JkUqC}sd{K302D6KkV~&MWzE&^*8Nhas-%aDf8&semg3Wlr}m>9ur-_iJ+B@J zj{NT6dbI#*$aH(_N*&($OH>T+GJ{k(x)|cM^&HF0=&~ekZY~^Zy~~}*uo@_D7wc7$ zkGxTH)V4QwjVP3;C+~Tx%|Tv=UNCHFDaM`-j^tF)sF~+bilD$VBcd$qkXpG?q0bHv zN7bFxy2A*`>uBmjtfLFcj)zv2Suq$we2_61o$=&~IXn57D;j=+awhC+(1CPqGJGGT~`nkGC=c zg^+|(j52f6&^J5$qytq6Ii`w?ebOOltRln`wK=Qfx8G&Oebka7UDnOg7Bbj{trK!X zm!Sb^rVnd60xgC>B^)uKgC~Qw>Jbf4l3DW517{PnlRx0d)pyAQSK)O>yiop z3}p{s#Nvy-dHd+q@ZDGLApYykXG`Z~l~OH)Ue@*>n#}fdGc~<{X~OI<X zb#W+2qz}(h_U2(R5y)srx(%lG0iX3_gr(X`z_g;f{rR(*No8C7nf-+h`?8o5S+N}~ zeWhH5T$zXUmj$rPrsnG2vnkDfJH(`a-4`1jU9%1I$P{}Jp5`qvCI{Xnn7JLUjZaF( zvi4U`3?TVunlW;cpd^^p+haw^x1oxH2AwV%-da&)vV3RiRWe*Mm8fD`zQ{E2js+c! zAGmfV1r>m_6-&G}?|=W*%$DZ|^q}NWSzkt?XuQgJ0BNXvie9k=6J13&)997?WCu5^ zZl}YXItqT9x0nBPv1jD1Ek~6m$M#>;AhBnS4mZ~ZK~6Plb$dny%wYTkvwZ;I$>S~+ z+4Pl8@6la++7RDJTUbb3H<#6BwASJmcpY266U66|Dq+DjGS21gxRTB6SXdLR+2C#F z$X5@g=o-&b+=^`Fe|ReQVjqu$L4w<3P&hvx%&XvW57vJR0YMBq+bm$Sl9-sE4-$Ei z4zIC6hcHmXTCi3#Zn8rfa<~?Q>pT;iVYMINRN{ky6zAfkm~?<2iRW z+ErO=+j|(7P)JjWXv!j~)BzWJdvzxprrv&A{6Q$Ooc3&GW@}#bHz4V-S7-zofsYA91%c>utKL$_F`ZPp6c2q^PY;Wy}Ie((8fMf#>^zKS@m$1jBxsO@?K1gi7(y35rV3 z*n9c3ikJX+iP(yeHyz7ww!gl0{oCld43chs@5f&}*$k8sNw9HrC?7T7lWjej&*pN~ z%iV1;fVpIM(sC+|E=*B&6Dh=%`fc@Qi}pA8O%5(=FsbXF@{Bcnp7`=OW4y zo9ym7t?sI_Zo22xMg!yEZIqU7{JS>j9?n-Z0=_L=l# zWp)(g-9e`0qt*;PNvd;}F%^BAz(#j;nld(5uS2B8b8k47zNxN`L+jRalhf^Bg*vg> zG?ZTAM7;w2u-5bDJ4~sx9CRI<_K#MPE-%-ep44$b9#&ao4o4_=Eeudl)`E(|q|%T; zSC&;gQ^AhsrDmeO-sFohy@3^W2v@SRBg!Sw3fwT8C$aZq$=}_H{0&mS*~e19&k8@- zUXWT%VR;G_>l*XmZs2`gx|C)Q=e($~JO~kp*i-@YYPyfJ?$7Q4*5kgQl2Cg>SsU~} zh6ew}HuOzFkl5>&)=%(?AP|3hzNV$7Mpy#OL;@qZXcH9J%-Cqa9IIQ*a1PRGrMrL* zcn6*Oyh9}j-pk=M`fQ%r97n>s=pFdpi~Ht)e;~gPje8!;djSeVr2ZtWPgg z*xA9Uk<*Ob3_pM~G;q+e!;(3QC^IVD>qgEtskfFYg4gwW-_$-#vNpoCtxeu69kr`hyZ&1LZ{buO#p@ zdjg&Q9MnwR2IgnP8VcbBmE@v>BhJKvB(`aW6JbL&LWQTHuf&NGFhfLEVHE#0(6TWN zCI*FdR#&-_8cv0V=zN#w#K^*O-8+5wA1>EB@&06vqYW@ACSnb6V++H^Sc)hPv9^n{ zDN1D>6lyS#m5HX%-oYQ`BR zwcZ!DngP_)Va|f?^ATa$@LX7|z4Y~0(BXbo>d$)+F0DfVkm=}wF&trL<|M69d?K6L z+05mBW3FTv020j4QjV6uaN~dYS~S-jtMyPbPz2=Bvo>p#?4;lQ>T6%AH`9C=nl1Iy z(|+QxC0B-XTAtXlm{@Gv8mG)b({?}H+}KEow2Oj=6lg!Q$5C&JP~~UA*Yr>U3lFi8 z@FtgZ@59R*!K#nIDDyUo%&91o&f1Vs@h!YiFC+3OquF9P$G&#`nbXBc_^h-asU*1y zyAm=r;vVPiY?;IZ-*a_}>J56`J*-&j##b;{Qxd_!j>-8v<6Lue2~Zf)UWa4d?ZE4! z^mXz*X3khPKM@hORXDdj>goXPzuIDT;sj$&r ztI2Bc$v(XywarF&{0*rBT<6(YMV^LcWk|{@p-cp`zuW{(@`(xbyx43Hi+gR}?sPuY6V`DFu57R(FDPtd` zphHlkxsqiWwZMu%HaONjHedC#&zZ8xb_MsX%CD3R9Z(g=kfzmJ`S0Fu4jRMqdp`Z} zOGxtS(3Mfy?q?g;>+tEcIB^pf$B`|iOs2JkZtQ`FJkuwsHk!qk-hBqt=_;ukEs4o? zmzTpN*H68@LeEc7bPWjvgqZ{K>8p2b*t%MCN0aUn2Z*Zi2^gS^?DX6DL-ZUHox+-F z8r+1KG**OW{pUTKz4yswu&2Ot*pSssZbfAJ002?Tu*ah#!}adwCwoMZ%$L;mdzzAh zwVsB(q8sgX02+0E28Vogec^rav^crb7MEsiT`P$9cbDOF+^<{NGQtc3S!xP(_gEp( zh=ru#w6B2una%I!F|;5!PMYPX+QlSl2{<3wuU97S3}-K-loliQyr0aMj-5hmQ7}b= z`P*MvuN9}~GJpOXX!6tB;cy|~OJHzFROa#N0qr@yWFr6TWxCo)m#{xVpwIkGsi)~^ zwd$lGh$KV&C*fXi5xMGs#kn!|*YKSR4(Xr8qRQjHh+ZpxSz+w08^6y+S)chN97E zb{xBEoy&XaD_(-w(jt#j20BNn^7xBw=TUf~qRM&(e3ICi${&q5h9bGQGA6M_*3nOF+zbc5o3<|6ZceAeb-* zSY|f9&cn_=7gMGn2-NysfyS2m6{LXSEIWpy}4FNnQf zXcsd2F}1ajm7IKWZ0*g>Y(M6^XhAd0TQuaf1`Be0zZT?lw`tSw^raSsf?_PE2}5F~ zY>Y;a?abEMP3$pb5tXM|b;;!iiH@sm~$*r!hL8EYq-l9ykCypa)=UCsx>t~(u_h+QGYxu44$y=&rWv`Yka0UW-_>W$OkH1{7kyA4OE-1iG$Ox( z!&G52MyIaE#3RCXJG+erX}XUeutLXicXDII<6@K1^3g$7GLJ(|rgy@AjM&mpX{C`l zR5y!G%JIzdcetBN5Jw}($cXq(wRL*%aBPVyW&a5+&sZY~$=8E{=8}Ar@dXCaYj2n` zg1L0kT3FRB&~(WTTF}Ds(Dc_8i2iXSr$l-%h}g^v2NUF)4XUWaLOs*S&&(hHoK_qS z4u%H^c7tl&K(cljz%f-f#EJL)_-VRi9i;$2)@ zE+mM9G@DAif0@5O zPK6xOUl{?fiP$Ym+O(@QL%L=0H!)kRc~~%-n4*!{Y(uoxoG}fOpBcHOHpmqd9SHI) zBh+JHmK_mYPvfcH<^Q=(QD?8Gc?c7-VrC0i`_g22E^Fg5lkF|fr5lA*kekhH^Caf7h#Z@a9J_%J^dF@H}9sQKB*KsG`RJM?N z;zwx09<*t1?Vprv^l!yg^Kdye@hmlTN2<<_&g;$A*@MNj+bUNgc@fNE`L4QAVu;A< zPQrrC!Ep(9-Yw!0l38M(!Y8k7TSF~)s} zvywjaX3eCw220$F>%o5A0X|=!HQJS*2=N~$+gD3@KC&ss|3YphHDxk{KfsiVR}ypY zvoqQ%?yEfw5?Ug`Zz0nRVs2WU_&Ot!@Axs8IU(7bGX}91(YWkVi&fY3G2ep=TU1+j zjy;uJjJA;JQ)ItlZ4`rC-855r%H?rUyj13EYCr^Z79%|&A`BKUr zMPvFNPgk+KL27l9D^iKxRI5^pKq(iCi=3?J+t{6K;bhl&^wu&5FuCv=Kx0~S2j`J1FI?=Y7 z?WxLcmWuBdPx}@|+zEPc;;(d%ZuYF$P?Pd7PePdR|QI>rabYCq3J&Gc{^T}Fv^)`jQPXTqFIqh4_#nlM)^#&7W?5f-V* zYHsGDvJF~~4O;kE1GR;q%>pXn#ySq0d*cTXu)BykdnO0_nCA?*`FuZ-ZCBA9+3B?P zINJmS2IDtar~_#oYxxiE&IZSF26ZJ{Znu$?0N>lQwNBSpJYoTV_#@O_Y}|iSKl#1V zp;!fpVt&QTu#7ZQ*F{l-?zwANbc`6Wa#uWg)>b(zWlkGFQmDG~OAi5cUN zUUm8BrPBDka8(oO_p7|qjYFQA5)z4Yr8q;Ho=jG8>lt%zgXD61qNyVwtcFd%Y0)Xo z;7y)Pa4a0PYowm6rHs_zw0?ZViVTTLS1Q%vs@?^SCCks>pvUU~aR6_jLv}yt?;98- z9!^eM&8}M8pfrEl)T&u4>WGNgNW4qmP(T+P=o7=C(_9)`bL?hN=H__i-X0?FXEyr7 z8JC!HewT!@-@^peB_9^cpqzs)`0dKLDd)kQGqxempC+rZqA>Jo*kAjuT0@A zEhDkn^?9hRsR~%jNkm9VNfE5=@u=)?h28<86FZ(V1?m}(p~gC(t$yYAGg#CtOSJI* z-fz??&i9m+sU1VGU@BX8HSRiqcJiL3dLYsq2>p{tB$cF%lgF}-7aJ#QguQ*AE|beN zux2ezM~EL?EwP?y;&UZf@yUQBbfBMvE3RHbPE{q+=6=Vy=yk1CFf~xC@s64Mv5M|J z59`Avkl=LqTw>9y{ke^{=38QYGQHGbji)jsSYP5KOLeoDX0@5bZkPqV>%{&4b^d*} zzo2Ed!;D@P z*1%|IfPvUh{;c^^;;n#ucD?EI5D-_opDwNs4w8hWQN|JhViQf?v@xe$Qh{c|0MTlf z_hUwZ?2^mG5dtf(9>2ex!#FCqUfOlf-|`abmQ)XsLjc`GF14;%s)1(6jzX`_;&gm^ zAa>z=ApQ;Mz{CA+c9&6toP4A8wXDrd8O$ek7Ox<(2(pr6*V*^SR8rRL)-w~)bwx4j zV2K@-{cTrELi6&7!Z9EBySFEUJYuGm>aF~mpsi#&hOjf`#u>S-{}EBQLT_&gxf?y( z#2Ba^y-d)GWqi60YL~%a&A9QE&DJMFiMYL_kM~ybnX!t89x{#2Ox5R&#RPF}*F#8o>VGAb&ozsbMPPfsg-IFk8wM5- z4{)%WYb^oxm?T)N(c(@@N&OHL7YqeC};rc-zweCYS)3&XYnW_ zT<}3V8ub33yYa4)IqaA5rY(f%!N3hi*QQS4CASk=X(u6GYi1`^D-}Er*V|t2CU^UF z8B1k-9t7U`AC_gMY^7x6PE@I6soIT4=o-c6eRY(xohoY8oHaGHHHoIwTeZq`vY`9d zY&lw6*#UP)z^PDHpc)q#iSy|9Q$o8}9CcHp5fl+1qa3*sGJ-5q{Pis(L)Xghp&>H} zYTQy|ZUiZ<>OCt0JdM-NAI%$@NDrxE;mC!Osls7AWfzz$K(Dq)1Ew5zPcWB27E%1i zE7S1z0Wu4i9y&|yJ%>KK`5krT4_S+5yGDwJcjiaC%7gdVnzcpO>sqylGv9Q{7 zNIk2=Ll=N+FoIuU->4*(glbOP-`~6Gde_i0nAgMt(%iVes>O=%O871QPvUx-rrQ?|zDE0?KXvrLtLsYeZ zy-Z!*j&|St`NFreKa8De%~xI{^UxVGK1kF`mfb>DDf+@{i%e-`;C0EfK?O!g+5|A3v zGKAjXe8&Iw5>0_+#&pHm34Tk=u$dFv;rra~b9o`eeP&!DY`CBI_cUvb9>8w0iFT6l zK*hM);gc0AAS)$N>s~MK{++_rlN5~2GL8}Px?CU?4o{;sD%gWAfNE+<%q?zS*k7Ec zB;u(aFfbqAccDnAFk%N4!2ESyt$ut;smUDeBM1xIn0vb|GM+X-vIVo1WXb)^{Zw1ICHUytE zM%Mk5J&`dJlWQ-nfs~zcud%xW-V?=e3es^$&f8n8p)-5}I927h50a#h*<6k$PxV~i z`O5;fL}XlMHlO{8SG(SOCmZAzn<3}rSyE6lG38}3wvkRUrj43mTPc(ISAUluh%s}Vx;14=bV@V zXEONxCMFjL1%7OJA5V*tQ;<{aBg67|i))7X{@ZMbb4RFu=qLDb!pp+pFVk!jNkv5R z%knv!^M#`fF~jZ1nmpJC1R2q_efVLY%=1;nv4or-THhEMC8jlPzm= zdkBuFf1i0?^Z!5i9}y{IKt9u!8NaQ*ya^b5+3U6W?Eb2eB!zRccGCqp+FN`8BY1vw_X_CgER?bG1ao(X1(EN@v+UNJ zEg!#b@{VhMR4~=cAUS`4g8ZaX*=X`2&%<#hAt|}5aeIBSB@ly;OLV)?3NMjF#sk;p zMc7m_*o**B5y-Y@HDQ0ay^{2oU`L8w>y27hnTU4Tq8QXZNm$_a$2) z3q0J8<>8YD%kC$ut;+6MfYMc|+_m|~mB&o}y+FCVIS)^0;y*z8Zm^5iW_iau#<%VT zy6GGJtIW8G|CEV|wg2;IZo~54ND8N&guOQ$9P&V!O4V%M>-mMSw>HB&kCO2TCV~Mw z-LAupwM=kc?TOd*g2XAu(u~?cs={Tmh>T76dUen5}ssMM4CMrO^d zR&_Hw;i&u!1*wSQb7cQ)`WxBfPZ z?ut|^3N{TV=Cfda`p?dQmg%0#zy;abh?uYWJ=Q~DA>QlHA3mLaxl~9(r5$2L#_#Lhke^sVIj&V^l%jR)3B^ z2N-m{m<+0803Sa{7=V^*_V%)*o$O}WEoZW>M;>)v0kZZiUayUf?XUEJ9fatQ9%0DY zI+3PSRzTX5t<&bB$36@MCl5HZUuUWp_AQdwJUu+Mja5q4B71wYzVdleAqL8KKD`N! z_y#@bc+A5Vqx7*NIy}Nk@viPq!O)m~jU=Y1!ysDkT#>Af4#9vUE;1HaxT!CKKma}w z6%dO6>O7YXPC>;)boHU~II>0bL!M~r01|j~@}G&&xl}pOmaJIFz<$O>P3j0bCAS`b zSd22AC9&UV>-URRh@r`1)aH-~8sP-1o6Bnss%%$Un~N?`)u;r;+-MP$h?|)bV-LOY z6&WYy9uuRn_H`8UR1*~}i8%?j&j-bU(m|Zaq|M^U_d|EQ+24)63WCLs@IsQ|`B*UB zb9b_+@8KF43&<&vkD7e9(r)~T=`;&@hilJGda7?M{|hBANI#Q4{R=G+mri;#(gex6 zpUDS>)Yj8R&9b(bvzpj;+WAS_Z?s%?pAIl!kYIoa=}x8?p>R8-X92<&82 zXZHD}w20bxn(0Tx)D{LY%IVq9n4;H|##o7oui{%9(1P*XXLaV4x{VG`*IWg|$sC1W z*x(?(s4yb;I_ik65|=MQeTjVwAc22B=h&(>y%TAs{3&5##g8B!L-~ot@o2 zMBw_HpW<*fEszi!0&mK7UroNyssH@@i4T_|q6g?TQID7Wj{3jfFKA@^^nFHTwOj1e z+rqB3X}s}#8dSkM@IvxW-96j{Aew#vPOT;~%+Kl@>WhFT9YxFn0AE8m9|q#6Jcic9 z8er4TXQ9uOO(kc~S3RZZvmZ${lT63An)M7b<7S+UXhsRw(CbWL|U_`Wtke&PLG zH6I!rOb4d2tatjx#l;1Z7^GZwt{5;v!@#(Lsa{~T4W_8+_4&o@V3tJjzfbBoasvDk zVDgEBjvgrTZ@wTH0Ml){c|-{D#h=dLe{=5t9V`zx+>jP9EDiWBd?Y0$Bqa3AN;c&J zF5rWM2Vfo)7zZ(H)qp7q1d5erqiI0ZTvwUd?Wn`{44Tr=Trtw-M}k~=taJ8?QZD^} zAZ1K6)f&cgp}jhY2p5)@-y_2&qJJ;QQmj&{`v?!2sg5FpFHOa#JJ$-jWH z;J3X=eDZ{~(Jde#00;|3CU`zI{idcS0DC51u-63y{kL=#AZHYto1NQFp?XgKg6?$$ zm5M#|@rgrO@@+w=Omz!s#sE$z-2D>5(!wI&C~pCr-?ZaVV26oD4}no!`X>CilI4tw zX*z4yItLF=1(p#I_qDf|2+-Kwmvfci=WTwgGrbq$j--IM>gD=>9^L3JU5q=eKQ6qh zId)fTAnBygolBZ66Otb-_$N{!baPj!LHC%Hzw159@nOT;3?2a=5b5fb(a)q)4 zBmnSuv9Y%o`s;B)!8Fj5M2+(^`D}j-3@|-bMn@L`rNrd?D2QvujJ!z62G2=(2vqoE zfe0N#s;$LBc;75{tanSUbh!=IkbrBt67L7rlF&H-JTqaMY8}?+USD8h0p{l~U0j;# zYPl+5XG6ulE6n%;K%}<>{lR+rg~w5JIUMTxv5jPd`5C=kMPbjTn0GX4iG% zspHeILAXKyu5t)POk7ONW3sHAoJo;|FOVAnd!}c)yV4OF3hZJlqWc*~4x?7M8j@Zx z?Dj_>W6!_Z${ep>oclk4QDgmLwMoI4Y!NV8xR6F6(b1;0xYL@4pJM1!fA6*#7=b(l zPeFMADJ|*mRR|t+j97%W0GX55as#|OGxkfp98;cZj_(s!wDikthbJEbkGS@~ zYi)0L1)7^MNB84ITqU9LmPGmmVGd6TIXMiNbC&)&-5?t03mOKVAON}HJbc(1AI{Z( zK_d`2qsl(>EM0%&qTB%uTmLzf1KcA|@bZReUEcdr9IXUAQ2G^;Rk7BC;ksR(U0}<< zj|&-x`UKD}CJt*V=2S@ZK^Ed4JLiMU&a$w;rMC)~yk~o3P6G-x{c}v&<9t|7iMkYj9kJ+k2`=(13PwGNj^w}vPzqLAW{pD0p6Ig zj(E7jCtz>P*yU$GQ7T_0KXB@bR^H>x%hjp^A9hEaT7UC`W$)h|f{xecgZMZEI`|G; zmZSwGz7Ex=;bJ;5k7T}ws8@IH6My>oi%!WU4ScqlR@H?ndHJ%c3yX}4Lf0C4XJ=4x z%Z$!;AqL~t@>kzBkG925%kd<5p`=B5s>Grh>pgJiuMgaibCkEJxqg5*gKU&-a|fOi zIN;Lt-3NUqT3cI5bi6AGtW&WoRYPh?JeHpN1zlk)*p2?7?CflyQv0+ku6+I}FpztD z$v1C;6f@~p%~*)9J*Ei#YzJa1mwogg@K)wN?h}uQJ^>)4V*gnunnUtdj5dmiMXP0O zG5w1gr-AIc)m0ookCOkb(Z90PSGzL!FyoFV^~(zZVEp{9Q)9Ja*?B(6mZ@mlH@n=~ z*}1f|)VwCR#m^eAl~wh-avH9a=@ZSw0>(tqzR=v1mazcF#t`mo#YZ$()ewAy{Fa+L(L+w z!4Fb{m6pynQ=oX27jfsXyr_IhOlW7Cs8z zrE*BoNQ^tFbsT`N0bRzXtzW+q`e$2ERnCo3V3j`?70sl>f!t@?t7WkY2?=HN0@6)N ziryeoLz_@$tbJK*i68k+BoZ;C)W?~GUr5Z6GbA}^>BE_l#^2S8ZCP1apk@0|?@#t= z(t#&jntI-)k08=^B)G8zz&>m6Ar}`m!`@21AqpRW3xT)tSyx}} z;&NHKRF8#Wo{_C;Udr~@eLgn3nZFs}pYQ9b@q(NA0t3k-%*g?wtUJ*{JY6F^!eHTu za$8$lcB6i|IUW|*<>t}G#Ws2IE>}n`d*JMm3^R}4SC_6CxR!oB*Q5Zw`jH2i={11l z%fkD%$xRn7`Oz?>nzqwfD}UurUUCgic`;#EDEY>=WEGe$%1hr=s2K!PUG{{i6N+-* ztjl_5&X&cD*X{j>x%8VAdsX=Z$_zVwb0|#4&d!dBHm z5Zm*?Zsf8yIZ;KiO$cHzN?qOC`%X~q1~p8k_0A%_7`t^0@H4E{>#5B*~VJw#rlW_uGK z^_eWJV-5~o3kwThzg|neZEJf@R`hp7?m_s?>$qYJmrkR!U84@oAKBq-7n0xSWw`N@_Cq7Xq z6vS%X9%)Xj>YfqK(a}+wpcTS@se|9O`g~t6WObwRHq9U}?hcFM@^?GzS_@kJ>ebO! z;GDnt_4KJ&cz8I|1zay+A(m#~k+Jk>m6}NQXcLH5aEJLP&H2xTpEp6`Y)dB5 z`>Hel6T{z}rD4&>G#>Z%n=(wRWNdGQ*V_^;in<)Zy*Tk#4B=89C5I8g8syOP%e!VV1-m(l zXl!Tz6%>cYudS_t$k<>o>&>FYo0PO|qdcR4<+8M`pNFs^C`B-{=iuOQup8fgX`1S! zXs;)K21^S^SFepH*>&m%Or&^cH(J*dYc>Yv8uDC;V=o8WzKQbh*8S^WwKdiS1pqm# zS;;_bO%_%C2J8ErzFDutYC}}~(DJ(q|J6^3nvpP3ZXTYScoU-e+Q^ln*6XVY5QpQ~l{ZpY-k z3VWT$t=5&f*8FNLP|7PmJoFT3pP^yUqjuTR2oSts<6=zL_wQzj(UbxO;8M!SKry=w z5NU}31;*wgdTYv5Pfst$kxFIa<-^oR8gu>HE>5U6fpzBoiOG%({q*a?sy5ZxcPLLj zA+Vb?=DMe?tqoLiFG-*ASN7_ywk5pwp(wR-)0zbwBp?G~^hK&us(F-5x%pW|55=}4 zXTV4YHW;<19UDSl#>Z!v()i}k%cb%4EDw`p8o%>LswXS5aRq@AhaUX==={@M#O(g$ zQ+z)rRjLC2*)12ykPy^{7v-CU)XYESG}A>D^A&2WKvO~2jbp?8l+a?_lulgk;Vw4m zauJ+XUO$yGsNWH=5^XKSzM=AF$*dsv+lHiKGxD}vo&sG+F`%G!%&JUaz}QIt?14qNlHaMErkxmb=0>}P%NFmgnbzSPb6~u_Gufw}7qpUwkV&jghii+lIB;rE7Y;c2qZ~iu&x2ZRe6@ zDbK$jQGQ_mNEx~7QkcNsO603^C>S`}w073JQh3ZG<6PB`5JsW=y_yLY_?N@k6D$l4tjK05v-e-PlTI;T|I6L}Kc6Q~X4J6A8iU$Y zM@2;y-M~|*s^zfOk{<}_{w)+{SlF8uYo~!7$xzSGN8%RNHlK$}-?s+O8R;Z_D`8G} zO01``((PgRY^X*`d?TN0r-k>~#l*xi@BcH{=uM{;;n1sl^10Z9fKED^#Y=0&1_US} z^>lRZ3CG>AvWnuUcOpF3m6Vp|-nwYqq`Q;}7x~TcR@kt5TTc zYZ3PTAZb_-r46SnAGE4#5-thJaYtT7V0!W`P{n-R`)mEFrQ&DLW+5m!G`ag|6Z}bL zNC(CO{j{~Mt-(n=J!EcH({L?-DmCLO%Letnbx-f z*s6R!v>~JVTY1~>`uaQob(Xjjj}>=R#1WnQ2ziVMr@WB_DC4#PLz8&8vw%208=gH_znkuK1>dQz})bN?9@1h^O`++Hi?tDA6k^1x>WHtKlg?hw<*e3+t(sOF49w_!gV<9!+b=Z>E#_M%&{u# zy+*9lkm)otH%D@Z(@6flzQp(l&MLNp5z&t2=IPhJf1AO1T1zTzUe*_>o;>6U`8DMj zmvd4?>3Bkk1lY8_efwM@O12&EF;2;T~e}aC5_mQI?*^iTzq!BQ&|CU)Ly89%ksw=@CXa?z(=yjsJL3Lc-*q9Ibaeyu74a$28CEv)tON>nT4gAA6@bQ@wf2-Lyd7jR+1-?YNNdo@sKyFWJ(sOykC4JzxUOcsw(p`vDIi$!VhSZI zo+%Z@Xg|&;$K6HuAa~Zn;W&qK^Df5+&d$!m+5tHf5$x4j6^AH-?*ICZ-rA*hdD0UPdQ=RP6+R-{5MHWr>t` z#SO;nG(#9=9k-IB%xYrtA4SOPaH#;PO~1}-b`Ix7vXpwK!G9#DNosL%k!C(OWvqdK zVntRV@wkMC(AgZm)UwP0`}LfI2aakpHY5$Rv8v+Zy%QZ>ygvJdP^N_H)G>YWAWuU~ zbm>%lOmW;Lyzd5E_q{B6*T~33q|HOetrtG z$IBL`{rhgo#J8xWxDypmJZ}xUO!vH63U&E&{C}9f+nR z;imE3;%sJk6G~aGNq{7Iz-EGT@VzJ6a5;Xyqx@R+9qUiCrgHk4_rwN1BIxGE7-YSj>IbhEkJv8)ok06w9CMaw=!z zwQ zZ+kj)*(~!E6}~M!{fr|e`cY1hQOBYbYer}A_D0N!a;3MY9b5Z(5NbbddoBrO@OSjh zv*)f@mlII#Gy*!m>h{J*aZ7qNfrXAzcj<+OFaQUM)f(Nxn_ KExKa;_#?&O1E@_K6H1NZbcfDZj?qq8l(-7ZUO1;mUw8+MECFg z&KT#s-yh!?=bS&z$Jl#p_Tzou&$`!|YtCz4*R>3KswjnlMudiff`TC zzr2RU-Nqj7MnMr2akqbNWM$$^fiN+%uoa@(s%@mAurL;)(&SQL zQ?M5^F}INRbTm=*R8%wav@+r|rV?s6g+$^T-@9y2qP{8ClkdZwnvXx*|=EQ z_?X#v`5$rdb8%7p`$Gj^=xA)puOcq_@7KZq2~n9lJKOWKvbwpsvAA)t*g2Z9vh(rr zv9dj4ee{SKu3&cZuyua!&TQ*M{hud@n>ZOcTG%^V*x6ECKJhui&c#`X3I_Z4Eo|)n z>#?>@|IQT58LRtqdscQ9w#&Er&xHyK|MN?2Z2s$NCubFt|1sYG+Xp+TdDxq^wZ|>=I&6B-uIncqApb*g3c* zxwtt0bFa9ak&BIqt@D5GHU1y>ivPFwUIv7XJ$$pciKB(9iLs=koejmGx8}F_@5l1^ zzkS}n_Zt8AV}arSH}Am;gJHc~+yB#A|K}qJpvzzXD|q35{ww@VY$4_yA-I*M<`Pg) zK6=QAKUQ-eU7tYpzP~WnvQt1~k!btgD7;UB?+|O^sE46B?_4?i{f`fAJuPy^=}!18o|z$I!5Cp}KY{yko*?YFsGCxmxdX zXTwixK(PAX-zZqG^Z)(rk=Xlde}1Fj_}?G>Pi7*q#Y}l_cD6f3Anx6}olcIPZ7i%m z^ENNH;#j@zda^!J#%fR(FXDHOO)Z(Lrp-FW=e*n-`B3iawQHzYWF*+wlmikz=SNF% zEc&B$9=rQ%!@K`^M2C-m`1cvDO6!rC?*UvyVPBsSaGF1jeUhV?lE`JHVQy|-Wjk?h z`TjmWewF3m$AKKB#)DBSiC`R$*CC0Ci45nf`<~~6S1!l%qTtMxJ-o58vCrt+>)Y_f zohs59eap@@FJ8P@$KM(sSnNs)xI69-3`^Gd&ZzQ+FU?yfHmKEB&RdrX;Gk0mEjTn8>LZcKFayghHK=PLb9 zU!iUl6%`d4J_{2rcY=IhU*FAFkL9Imq9sFruN5_BXJ-dLYCw9V@Hs8EzN4n6r-#?h zQ_EBNq*v{|7L}Und%S0{lMb(=Q+SY*=3C>wgE%?Z*j?=M8aod8hQLD@;4*6bTyeI( z`)BkNODA(^q-7)HB}OgyhTeS(j$LUY7qwdrFib+i1fR|%9=qUgusB;og=6Tfb-kY* z=7tJ&r6eRg(3!M~-^29JwM6g`h2e!{Sq*V(h2&8h=yB8 zdF`L|zJFY(Q*kfDdi?WFB|7U5T#iEJj32OUF|rSJ|3>Irf00kU4%K>!IlEmvQ{$C3 zV+}qhKSBvrOAyWJ5+T76SFc_z4ULVD|CJ#Xp^(JA(35tN6=(1piJU4m>G%;wY-D8A zcz(QwhRZ-FINZ9oIU&HpVta9Z#-Fk|VwQ%1i3uy=@q6ClSMf}yOqBQxyeTf-Q&Ai| z4laT_vjh6It}%?7iZd%gN52<3OxmOK^r}nUlcJ-47V7e_w|x2Xg+?J!TwI()z*Rn) zP|)38RJTt0WBjft>O)3=Y6aHHbyWXYt;dZC+kp zzIp@g0WB>#zq9lTWj34rwCD~3<^mSj`{;MSf;ze1=}s)O?zeB>vgH%{tLzMwr(rdy zB|{I7*NU2>iMcEvWJ%vk>T;cJ3fgMCXn+vu*WHrpkKtV#E`q1##y1eeaiactrPdCc zR2_9#CY~wpfu5eN0CL}WAurd1t3g3QFl5#I!J>xakI{>_ZlL2O3;TFNl)J9~nyI&u zow*&9d8Zjs;*Pr55mzLi@CeZgi{3N_E1W9qQ{%YM-W-B20<);6mrOwCqgG|BZxPO@ z`3YxWWiVf}(f2I#_F{L6*J5YFL)mC)X=$w*=R7-%X89@4HD>xQY;UiFz7^-OD!VQC zS5_9y0`t#!-%@wk1Yi=dJzMHd$=4`Md# zy;I5KOzI*EqhVp$oNtTjw^4Odh8(ulaI*R3<+a(0__#LX)v>Cg_-ROh;iLjIH0Q9z zZ{D~8nW9TTihT!uP=oiPFSobt zclw0P^k8J~-@o5o>M^W#G})T0fBEty?0bBtcgGF4(a}SKg7Thzc#@}*Rp+FZr-q1T z8o;KO)sCF79k#5PoSC&bNC>9S%*qP-mOc*?tj~h)L-}`ijvT4JpR?z!D?-O(;Gze4+@BzySux$_h~302fy2Am0r)I>pCPewCvD^xHK^pNy=>$l3cGUU%Hzk68{&4Qhqr!hxK6!%VsCHX9E?kf zd6_;PAZAA^tQce3XPZMbKdQ-e+CoOqDXcW8_nhR5WzpA>H~#w1jf8}R$sp^g1|Ntb zqOff3GE-z(dH=-o?{6@?juzsYe?nAp_#8WPUp5>lC={%IXwKegHy;vmn9A?34%QD( zOP`*eN`?{P-o0DwvAYN}x;av|1i1%-q$j~ zFZHAumKwLcxN^;QqDCEJfJMJ%eCev3CS^Tx(kp$DCdy*`vjeQ}Gl4%NMtSsG_q`E! z5>&+lQCbR$XON7)e*K!4mq!!THm0u_MWaBYm`s3!v$s(-CA{0o0dJMBn$r!h4Y}|9 zJC?|y;s;oGsBPE-X@VY(U5Q-HfiSpt!XIJR^_j~nDt0IF6!FwTO8)SDMp{P3V>XDk zDR6S7+`Mmg!fk4BZ66U1cik^r8_4OYc3NtWrr%x3Nqh6=jcl_x28U3oh^4+~XYAha z)YQdXgb3aMb_bVv?|UeY|CMc@Htu!{Kuv*EZCOzRZw@iku0mxuSqIN+@ICW{yfs>7 zM}F@f6-E*4(0b4PPSdh3YAUL9Ski%P1+Rk12Ihd3u_<9B9*%ydqz9 zZ+ZGTMek*cvz?ZHN}7Ka>$z1&=?49;z3t-Ofd605_WyOeO_vCgYvh&dFt1&4oOq#q z<8l#Rv}_t{WyvZkh6e@RzIChDoU`C=s~xfFpA|wO2;~$yy=CZ(Ao;2>#C(1Blp&^ou=VQSjX%wv)n^_mIR|LMz-NCj z&cJhJ`s=HkuU>|`P@w;17hbd^8WaJ5BIdDOpR7NLXE*v}P)|faAl<^>I`eO4jS$FE zv0x*x<{pD0Fqx;Cqa=I;@aOvV>%AqIj!fJNm#>2|{?oDozAYlcZ>_MZ#&zR(KuP52 z=xAl%bLfsE#Z}Tj7oATpE#cq2dlwgXu+i@#&d`^SpMTVxGx%iz;XK{={YykNEh3Q| zoIhxps{XomU~T{W{M?P6LfC~r#cHTv1j^HHkH}P!VdLr1ZjwAr!1u4CVv3^gUrDuD zR@hE82vJkNB38YE67jZUq2ICsIzEg$cjnD+w5F)!$tx*UjaXmj|12OP(kK_l!k5xr zYt4Y@A-{X~*`oy0p458Zv*Rn*ZkAgOD;5opZMbSsknvq56_kZ*eHLOgn+#M)9H2hD zkdh_|0)RvvE=yAQ;sPa|WSlmyCE3fCEnN$!AZzP&m}DL(fsB4Sc1Rf&tRA zuqdvhLIZI6Q&p)%>^h1d152D-mdfBK{iF=sZE_05Zf3lYffZx*>CK;(F3_Q!pPe)} zoTVm&k67dRja69jJo|!@(bszOP4Wv-)ClL30drWAvL0apMAI!OIWIDBU-*gZ=p;5H zX81|RQxtOqd{5m0;cd8{=vU%7+`5~j3SbZ@h;gX*A|fJDZS#)RS})!A6mT@IkntV7 zK|u-EKskSmiFK89+)1GN#GgC;MVoOuAR>T@UVF>$7&TdZS21O2~(1IM*?!uU}Pi@qnc-2HQHD=esdg#Siz$)Ynq2M34KLi;61681S3 zmy|U1EH-@`h5Z*Ckf}~?I`X@&^THoP@0HMHx>@oM)4z3(Ose0h0JaD>FhGD>gDA!M z-eUg^$uCANE6zk=KOE+M2%W5#QBqO@IChS^=0W)2K_&moaOVHD8#xQE3O?aZ8a%=O6FH8;aUIRFFM1B%OIPvY z&;)$@pr)nI9Wb!)HSwi*p4z$BeK%BoLcE-=85KJ1LHArWS(BjBm|Elt>v?u!isFIi zp&M2uT82TEa!Jk!t2BoIiQWvLulR7A|X&5_h9qD-Gp)VNqd zdW7cI4p^;s)KaD1tB%#-FJ)Izx0;@0I@yNM4yAce#qp(PT87iR z;=H*$-V@>C-+~w50RW6=Y&=nyXZB!Y)D9W%lY_p8E<3ivb*Kf8OjXU5sqK zK_m3v&|=&Do^LC-`vw0p9UtmCdv+a_HDVI?b{H1zRyK0^`py;&%oLCLh1kiP%1yjc zSmm;fOxVG?!EfoJ^JFz)fVP19q=+^mEBgWJ_3MkTx1VHb(9k|43*paIwn|o9`kvx~ zsZWctjq*3w%0<(an06&Xu^)m;Z_*Jvsno1YBj-`lQ4eVv7^QGBAtHQyGd6-?eAda2 z>Wn+Xx{G6WjY3X~ol#1{BS1$0#brBIX@g(^0&``uzBc}uq~woaTt-YX!Q4U1ONy}F zI6*>1r62l!zoP~Gs5Z5aYV^wQjoTu%+t-0|1Hu~U2$dU6P5EkhR6fo?5G-`Wh2Z;~ z9N-F=DZd2r99ns9>tDq%Qtep%&P&D$Xo{ZBPH18alr!FF#jb1m1Sfi5oFM}+No8eZ z+R{WC>4wTJR4a5gbS34@=6-~M_JDT#cAjpPZ4$RlDb5S|%WC$bv3cbw!PTqn(ac4= zNVlqDT-ksL*RxUFq(LGgqEtqu%z*_=E+!h)ne^u53%$x`RU?iIZ5-?S4*8niBc(n| zt=>mA+*X*{wCP_92UhI78g`1>+t#k5oHMLYYFv_k(3K;BV|JWx1}l)6odd&JLP+_(H2FURnk;?2guIT!<~LoV;;N7^}+nO+~=O2 zHE!)UUwtrY35ONO9@xRei6LZ1Gyxk|I5c%|02~!B{C3RIvLs6o`%vb2mmVwB%4KFxp? zO_tc`WANdnnnJlI2&@H^wXI?Ma3hjJG6@?D&Ajf^8MRqNrQN9`@tjD z!JSDWY`ndQ%E^c1JK=O6XGqQOM-^+U%f<`|2`pS2W(a94Q$(T2kx^1A(y3U5_6*=_ zh3Eb%v|xauDXW;Zfi=H|ig{?@{u}xV3=-b$Z~o{|j3#F^@+&|ufrjG_1_rKOzIy%; zOdj-kY6V(5Np=nIBIBqef}Pifm;qKp0aJO;0SeQvU%zTx)`Iz^sa-cl_ZQ*}Qw7{M zfyPhdwgIhBDNUH!Qn$=hL0R3x0MY*HCI%WB+V71zZTW-!VMBbm2NTHX_;|YP-81A= zh{RfdmK-pYO%B_a{H9-XU_YIZ*Mapwc2|$c1qcp{!v(}KIIc12be&%a#RWGHUKwJaa2|0|Fn@xL;UK3?|ioe9Q z+IF&zUgu^3n&3P}&+{q)l72r-yBy}!nc%56V;hPAVp~N54xArd>Vs!RcAnJj8;knV zw*_5GwHvN89kGjJ#<^DCJUZlethU!@V%WLXn|UlZF}k;T*!i}hC*@>6v-^HXAi^$! zWIR{)_73vAC6eII@qH;jLato9VU2xH7xU2ymsb(l^;M>Wr9&7DE>;86{r&{>7&{B8 z6S-d%KE@<&`&|f-xhyXjkk*uc94qsQO6}p+7PJfR$a-pJJN59ToA{2VjVrdPy$d)lT0Y8ib+NiCMlCbcrGMkaA| zWMpJrbCc8!G@Q3j2oP`~Ju9j;=@4=;%&3-^TS>qyi zT7OZp?wT}d*l36BRxaAB_Fnl%F$WzDQ$hAKpI7^#;5(0j$S7-#5OWr@#(2ZTl*6s* zRMOfi8(Br!J7~ArlQ@(}LhfDY^ZIS>yXDZ?A>aO9-;cf-?2j8la_Yr%7fU1Gt9wm& z_%<=^3lg8%kA0vZEQ4*Y$Yd!gHg>RnoXPokq2S(s}XbnhX^oR?z1tXNYBYvZXSsIQ1) zD7b*WN=ix)@9NR1&_Wo32KynS2o#n>)d1D3k(fjh`&}E z0BABR$Rbd>a(I^~>3a!9eCv2;$@ra@DX;UV%TO*#G!nGVB!oM2$;MhgDVOz0`q+r; zR9(Qm_RVexpG5`S3r35X4pS_K&c{vfHi-S!N0%i0mp-gmW}R%EMJzb-Mcunk(UOgC4*zmxOk^@{$SPv+KRRD46CiUZ{M5@Lxp(! z4$Ae%xLI@$EwVmxjk<0+jv3gN{u~(lh!?^%fyh?Q-z?LZEy@)eLSw+itW{mTdUR#z z_DjqcBwnrCn{PvK=pRA&Pu6>FO*I0}n~L)kK2UH1v5CWFRjp7%7Ze#mkKcNq?JuRZ zN%KXPQl4ZzGVRG=1n9|ku&|JCsMD{)5|`@~_P;6z5Y%`$8v=fStzRW`f3+w)bzF>Q z;IROIeKhY&chi>7i|m(&O*#pN2>_vZ5FdKgj);cz6nY}}hMABmRqhoEM_m;{Kfepw zH1B?%PxtJgfYTCvLh5kr~k{ob#+-;y5s_;E&y!phIH>d-qm<_8DvA96;l$&knS zZbgxFs)ZV7ZX)p}RUw3YRJ#(akaP3q&F)05d|+i}Rcj|2j9M^vj<+s)W5BpTPiYCrA0m2FrT-b*9gjxx(q`m|Xv3{}l`Y#vi?qJ9uaR_vIl{art-g^JuLAF+Oz#xz`RQd_Q;)Mbflr;vbFKY1~!?pR&U zpVE=VmelE5%S=6y%;;v`;hLhx;9}i5k{`z^Wbf-GQlXNMo0r#?aTB>Vu#$jZTXAqc z3}vKw*L2N!)X!bv>KAH3ZBR#ryips@4uCNnRsd_QVn; zGw8KTGu?f9maa{zzPx$^GQxs0zgc&($6_bp)^>S$`RC8PQ<1ca$)F0LDV3@gKl=)( zES5oCR_%+M8DpZqfb05p11|a_-_t`-yBFJI@+}6k(UjtZX6+!sXK_l+c<^c(8)w=* zS}43s6W%$l(_dafs7n{=mYZWkBST6mkI@`pMk|KUaeli z3v?U?hK8&~@Lq-Pp-!%Dqv#1oj)_S^Aabh<70A-#I zd)X{HXcyU_ke^}z^d9bbx*#($yd2o-d{>+08&TgbM zOA8lx+{4xUA^?Qkw&T2Hx{B{#p)PF|Y3BJ^-O@Q9XO4~2$l2XhWza**If)bP@cBUp zga-S}&<=G#yL!Prywr|!C1d{duS-iy4Q5j_cbT8~OK$k`7dHRS`68XM14fusz3g>F=G+f@Y(u-%pT%!?>xg zZo*qs17GzM@sPkHZlkqLR?Fzf7H;w7Ks za^Bkt7xFdZbetD~$ZL#xkg%lLSq^;t4GNfxaVqFO>!lfGwcFDU@ zU&#!1VPS&;gR7*V$Jie~o2qp1v9v5b6kcN0%2bIVQjvPoaC%zaCxzLPDngy;=2`Do zp|gLAaRnL5ApSgmP|$YoZJ0=b?VkKv9y#mJ6XN8NgI9h*8aek}gq>8>%r5-now)P4 z=y*S?CHz*>EF?_e`DR?nH=&7Y&H@PTw3X6dZpXPo=Lj9|w?bEaNOE-i)A^uT6Gjbe zyJotajEI!8{nv^)_;UCJIJ3^e(n2o$8+prfcJ&9pn}0c#;d|?s8ThDXAALBp3eIRA z!Vn21`6*TBYxiS((S|?1%ar?fORs)-Ajl9ri&4Jy^nkBZ_+9?_=N|+DA$&Of>eBHB zMG&kJPu*Fjz%)@|t{#Y=?$Qri6Z~e1Kpp`?fPXq-7~?oonwpv*SqD>I!Un^}^R6Tw zNJz{?*R_4?vBN?Et%NuLi!)iE&9QUo%>sQ3w`Kp*?jiJsH#dS*K%+BDCW@wk8Y=7> z*!w0iPa6(r(fb_1~%4bVbBMQ^mRnoiXchU4*y3BeeLA6iB?l{jT$92U*mfgwE&;PqC zxz9Dm7}r{b4D2w|6!#AURs#bH#6v!e-Gpd(42g}RAI8o@sT#PzmBYm+ldKUaSxuLG zR!xO8%pY?Z&2pwc_nx_n(y9%6*}(72rBAjEQt*KiDhAPma3XN-IjO6z%S(55>0up@F=UHh;!6g7Pjugdbj%@4z%Oh4a z3bY&`1w%tF1a6}SCwwuWS*Q~&Tf#~2=cpm5U>ESYtVWx62fazyq7?lY86O^RWNG=4 z;F1VUSEd!JlDpgW4YXGv+2GL?{ofm9W0~lQUW1wH88LM)$h!OtF%#BlTt_KUeNxeA z>N_e*zDE<;U*12PlCx;SA2e{{`Ihv& z+A$;x9lghl=`4nZnwPU6}sOt z0WmspFaRx(CssaMPme6{7yx@qk?!Mw>%a^ac(VnXC)`x6p=WHDa2xm}u))4-?}Q)# z+>r*%<*yQ>tf=qoMn6su=OTdSyjytJLIs*raD*g&R-Gvv2zC&GRk4 z3$M-UB`B#?(0dja7sJ4Ow!fkx3>sdBn{$GFPQRS{+xPFyV`nEwEHc5*u*m>DMzYLf zM{P{hR+$?BeWttmMM+J7j!wFq0nDniDfn-hhwc4ezqv_pO(7v6WXVsh^4q`-G~9au zAA6SM8(kMlC3o3su&T5-6m%;L8_Xy3mZ_sA$t>FCiw24lc-?I#ws-N7@VbVM34^}SFDFsg*^N-Q$I?=$xm@_+_bsTN84 zUWMMxX6$UD{h@DTPq(SlgkPb1BHFr!EMxcgvDQKmP~o*YyTW15lE z>DYp+ugBmKC+D6?gn*DBBk-rJp5s0%;8g^jUkDgs0o+@+Z|`h~Yt!j{E;eVMtdva; zaz~B~?mx?*>isHGb1)HM<}&4g5F;!*hc!Y zk3qQYC7&JS?y@)bhtEE9dgrk_wmyXVDYNmh-!tSVo(rDoZ%1W_G+eUOTKAQl(3g*g zi}b?zypB8bmT%i(iq!cH|3aEc&UaCdrXYe&G2Uz>`5vCmCA^XfXE!-rIj1gZC90^+ zCr+azD#6_JTiJ~Nn5(A3%8k{?ijv%(ZbPtbTDRDKip+1 z@X96Fs1j-O^yyRB{od&15EEdmhc;wisMBqwzd32~7Bt_;J}1R4hKHpen)|AsnuM8kwACHL8TXMW!ssx>e;!GVF`-~SHG8LNJcTJBTI zyiTC#n}<41t*-f^P#n{L_j zmKw4lDzxN;)hiu#EAwN09AFNLx5@?oRFKR9AlLE)7X(@-Wh#|^y;g)AtJRd z9DOHF_3rNy6C1pD1ams*M+2+8#KTXxy^&?dd!B`gwCyK&#bYEJ{BCKD-V;tjC!-sf z{vATB6#;7Ub-h6c*&1HR?yKT2f9)7*IcG*OCJLB11!lnbZsCsx$x^hd-mQgVZEM$_|6-kQoMS4UAHEg zf2>0Jj%_oo?$MK<0_Q03p&cp(P=6rXjeK^<*sBDNc2;*?;U95@OOh1Srj`CA00g9pQvjC(3Uc&F*UHP&6?;>oG0yLYGKHY%yy?hj>=><^vH#^1xi ziHwYPUyl>Z>d;6Q^m@D*C|#2O^E6d2us%2bpF`G;4GGWs_|iTB6L#4bjg6Z~0gNpt zCe`d}#S9v9Q1v~MFke3YO5Y}Pl9nx;@qguX6 zzNf;g(+$1bdJBvi6Z^Z_B1=sCVQG)3C!EhlV_p;Q@ca4oW#8$D=`h`ORbH2sQ@CGf z8dXbcB(g%%v+m)W+CAYtKszb>`L7g^sdc+AvTXAFUDhU@#b#$)9HJ+rKdt}gy%J`N0G7_-D?dD25GUetB(AGMEgQT7x)7uT1<#`w4R63{W6Dk zPMUdFuZGPw`|p}H%gBA8YIc;EFVQJjZ@TbmswBO4&vDGFPH0NIaO(#-Ik^a^guu~4 zwmCUD$;r-+Wi>Ro)A`8rU@L@|a2GQ)EDZ2vQI$xFK$y$scy()Q>w0rj>f<|&-bbZ_ zmbioYVA_ZF5)N!|yKg^BQLF+Ao5QTz8!D;F48YJt`E2NYx$Gv#-Hs9HN{Wgs>K~&g zY>}ySqZ@je2cPeciP}s58fVoUBgJ&+WKUumLHqU36R{Shlh0dUp0~-|{`&QUe@M*T zq=A66qPtT0FJ7QnL_biFn0Au&D`su~rp5GUdU9=AZ;J3x zKMN*$A&(lJeZt+?YB9nx`Uji^qBDAoc+8DRmeF12<=%RujW-I-oBDMuPd}S$xyLsn zqALB^L)HiH`XyD^8dgY7pqDH~qnVsP@!u7fd_YUXV>u~FVtMtISf&GcoyKHco3Y0< zgy*5Ahi}>to%=V6Th8aiO%{Gx3|vp1e8=xjsqkEg)F7=fKO3j@rHS$wEcKtg^HG0p zF)Nj+%4Lo}jf20dZJBzE`@Gn#B^G_DC!veR0YQ`93k*`+n>xI^1jbb(d*?MgZ}z9E zUBo6Nd*stx6K{ zoU?uLy&(*%K_Z2UQHZe0hcexMD4a;=sRa4=pM<=rzc6ffu0!wt?2(kp+VIG#{ZO?fB2Zg=k+HYLYOA{k zx$ASQ)kZ3M=*3Sp+-vwfC#O+_TlmZdh~x2x)xX7qT^_pTAC_>$uZY=?9sPN-@cB53ira zhM1f8y*7%A^(Ia*yc?!Euwrc}1DwXIa~P)lY|BOj?Wey0r|1L9C70C@&Y1m^C*Obo zfS%s7N33?s8IBb7_xHfgya%m#b-0)B9L_M@2S9 zg+yG?qLw+%3`f~um10UMKdd#$5beeJufygBPEA_}-d#n$2TXboCu@@Xu~&s#A}c3< zM(@3+n7iMM?ulhf8$s?+BbN1Ldb+oEZ(vJU#jK{to?iDush0s}t)1EF?7*1%cN6Y} zu&-Zn^FOEQtrZJ2(VgFX#m**;W1qv9itx+Pn5-7r=D&h+n%^G72-}f+=ZU8vpXmEt za&sgDzw<`DXLBTVz=7SFg-va@e)E^GwIPyU^+KGS1yWOSKHI!4x+^)i0A1SdK z%Wis|lxm2tfWTHH5%Qin9qF5+nK<}VvTh|x6rb=8&+W|e*|wdJT!@4d?|RfEQN><} zQnSi+f@}MpXPap}r99licewyoua+7ww)e z-G{(Obn92+2pnxFTgKFAUTBgnI(>edp;zN<0ZsTNT?q6B=L23|cYt>tvCL&!=iegc zp`Q*42^j-Q4+I*Y0JAm?%b&SB&`obn)(gm$fEWv>;h;D1tlH+b8O32xTZWTB_n1TB z2w@nhz|hI~CrGzIu5ON1^_<*AolZrqVrq#VTg22@ORGF$$_TtVl6H~X>WUlx-N$Oj zkW8*n!^}9dk$o@gs(cPh7`OLh7QcV7#+Q{!s+xzFo zCiDpGa(;bB#FMq~iJJXQ@>Bt&e|*`lnP2hAQkNXQw@QiZK6grL?S@)e!OJNX2Dhp% z-^tqCz4Ot95IpY+^HhTV_ZA)as93COnadT7n)p2z<^vH^aw+#^td#Nxg9Z$yj_4*7 zJaT@DpZn~eJM3h}7fnuyY>vjn1w^d;s*i|YVm(2Ik+QRGjt<(zv04t~S&52LGzJQ% zs*%B}DSpbNjh5?)s!@W*KKHK*X8Va-O+v?hXyOVkCYrabqScV+^}kA>|YCkN5c(3m!+p|>8D z>oiV`A#JA0g{e85cFf3c-0%-P^Kgu;<)~%gTCL+hwo!_+*N$L8klS%5k+8r~%{jyo zYCibSDSE$VQ0kakR-}7Py%gZSz=4AEwO-)WKVq00V}$pJ7;b+2sV#OFS;j|2Wk}BR zcrM4DulaTimEYItm)~2~$0~%FxfY;@i^(7UJW#jJJ@)0f5rcZ++eAdieL}Wpzt+55 zZR;J`7srcoY;`A-6IOojRm}LZ3>sR9j&4*=zy0#guKvQY$E?V(UeM;0n4DRUkigiz zSlyUCDSzlAaxyf61e4uFs^O}KoUnGKAJP@!Qm9i|Y>{8->34QbUZYUu;lr!~z0xl$ z_CIq6>{naR|M}+{v#FH$WSvAvk1%qr4aBa@#ad9PaDAEmrJYcG8z2Cg0 zvO(lRbccXnp7T6KQFAU<0dvFeJSri|b|SP9+pS(a@9EW)i~cGthv6LD!vkMUpxePK z)c`g+&<1Ax4}CYlA_L?mXsIe#P4}cKt)_7Ne4jdqihe1#7yvq=7f20o5&~(&{_vp* z=mS9T-5b~oXT)8D6LImwAk7-Uak#_7!ye%iYmgp5AbUPiYT}b~ak|^X3Ixa`h}tJe zr0}LJw32av-{1uKIvfE7Is_8~qaGa6&{JFfncPa#1!vXBw)+Ki+!jS0z@FCQ;3XkZsPNf&~J@+Bsjep!EJ zu1ZGi2~~=^T%7lLiDHqGf}-tMbpV0;Sb)x2uI$87}S3GG%PI?xnaWo%&P+Z#5R^If?9<#3AeO+OV9Pj&%%F>iv?ReB5 zWg;v5#rUjTwqzYp`bVxr#fg*a0XMUAYI3$X`C>M8$M*U?@^lKN6%@$$a<`y2_CC?% zHZgYIJeqAvNE^?ZOh2`okgiSpnNP1*{#h#x%<3Gk!+X!gyi~#@i-xT>PjNWvYcJ?7 zrnm(~8o@P(NiOUS79B7+Aquv)x8Zc=4s6VZD%6|TuN(WxmKa>*td~B1brb4?7dY-D zLkX}62JWR_L5vTE2i<0Kbg^2$bLe(kX<~#RS~e@wuxL`55z}2rN6c>pyLJKR=H8LAZjK zKS;&>EafnJmCLm3OtCs>5aDCdDjlP<;LO{+Mxw$9?pQdw@TVdYpuS^@RFaL_kHpmopz>8 zPK}^`lju!aTVs;R##+byk5$Z0IkrI)35stjtcvh~LM+=HTL@X|`J`U-Ve*-Kulin2 zZo91}4wD`nflX+tw(zWx-KQA9K~H%XoA@p^TP2Tb7uWt5?#OWGR?eF50;77H=KHr> zGNtBP_$)f|IBI#(ZWf6r=jgH>@9QG`Xj8^c_147*;{r$dat%J3(^HC-=)WqD@yl^nq(a{lh7|8!rH^BnR zCTH?dE$=rFVL^N}4;}=1fROP>j(Z-OnmRCpjtPJ2=;^WBTkd0RI7B!*J9~P1&V2KS z9(>~@>$7Ub%VZgEMupU=+fB-%MQ&1`W}il-`bP9N%@hkH%QiQp(jD+k3=~PU9*3!USuy&owpRITG5%eu!RjW!fz`L>=MU-LIY&$Ii{ujCJo|vZxWKofAQ}9PY_isA>i~ni@ddfr`OrtPq>mMr zRVzPDr{mM$D0sX2oD$CUix=L^V{Q`MCciRJqkh~84hgEPGBZ#7K*yEwe0@E-;)zJP zRk`0VH&@DP_E&qshkS%*GmAnxf-OhKCzzx>U44BklN)PFWD^%}HwYGOWFO>ZZhdvo z%P>(<`E^!X)s{Y=#@ahPB{J}$OWOKDs4)AaInL7zf;agVyQRrI(&=q2BBI(!)G`89 z1ss`lp9s}N6jZN24ou&!WO{>rJ>fj!LD>ibJh1=y@j&HuK9`^iac0oW+is3q#;O;! z<6xG|8;nj|)S83s`9MbE-Lg1%Gpb@%+Fso$^$eosmwr|0w>Dw3&IhV9PW(NCL;SlK)DM9#K`BoTbWaOXe}A`y`G| zf%uWEx*~}%o2_&aM@v$*hr52G_xbFIYC1)(yd8BTT}+ZSo^=vqNnNYt8)xZAagI^? zGJK2j(RzWZ@j6dfMPfKHj+4brfDyFgKoiq8Fjm|1)}i72WqLdV!||}I*?rFrCj`=0 z?2`e%*UC7(`sn;ZWqk*l{D_f1YwF2vO-u+0X-ZV&Jw%3K2F<9;=3uc0@lfkPD8D|c z@={Xern^0|GJ1ZVPqk%hwB}uA>rzi@&F7ko`-NQ&k{=`jx`84;wCXsvA->@CH7}}v zB^Fxk=p{wVy=tOZWO8#qd)O~r0R2C4fP%7hU1Rw)s+Y6Nyu5PERV$WJw}j!iOh45~ z@qLDb3HzO>2ij(4A~Q=zF2r1NvhrHh=9{79QjqSJN6m`!YiXO=nv$g1EV;Va%5_p| zeq5)%rFQ%HyR}%emPxB8arBqngYfQwMV2IfGm99a3R03}ICwKRhmd%QbqCX8@Wa?_ zg@AzT$(7sm9kMTsCDh)?;CD&kNT5o!D2trUuHlQSSdJ~Kc*V`&=<>!g8+;rOy}>vx zRQJ>@?55cH)eqD(=Yoh?=R4n3sWEakD9plTI4y>#)KvWQHYXd-Pqh!vTe$yRVC-u#faQJB#^Ejh#M1VKGH2in&{Ah132EDbhxV!r=YPF=05M9xyzF2nT z@;hQBc*@!t%4yMoXaf8KQ4eB1J&8=8H8Ofi7{*;u%~LPey^0eSyE0VMH&gF7_-WXD zqnosd>i&1K2`T0y)SI<6)xVRU$rPJRF2#I!MUee`Ies}lM~Mu<(8+4}A}7Ml+q%vm zOE-JpELG5cEiPs3+QIxq~o&~x|%^*yGKQ+tCZts#Za=o ze{G(=R0elCeJJ;9$QhOs03U!Z2XF!de7@p37mnd}sUOW8NEqY4utL4NqbsV>)Iu#6 z+7TjU-sQo6ze{o({=kqixH`Js#I3%C=%^Zz3UKjSOzTCNuwW3D>{FVE7 z+Qw|Cud&O@7>q~Wew*dRj&6J={ozUQvr^gU2dQ(`Rc|cHbp%jR_hich6Y+kQmxUzR zI1NpjxC9rHh2D&j%x6@t{6{v(jA@i#yEiAn`R@P0)K^AT`9yo8qBJNXozmT1(jnd5 zNOw1a(s}5Xlt#KiMLG}Zp^@(Hy2Jn8cdhq>Yn>0GoadR@v-hti%fyT*D|0}txSY*_ zMC`kzoBKsfj6;%@#`E#)#P>H>EnZ%&xgSN?OMM!NJN?g}`>k!SXC*iZn(l6&<-EOz z`x)>oh!hBN#zAB9H187&K4lnvd;5Ru?h5W_?y2JY2;NyJ`S1QDc|MDKcm2YG|(TZ^Ux-fG0}+mUd~T5TPliV-1Xfm#(0Y; zW9IP6W#2ShTZ9X{(EsT_csn_q888Ld(&N$Pic*dB_zN={$Zky zLI%jgnn1i0AU#7+@l<{oi6{+PAXR<{gQWUpI|NZAy*72|c|JrHp~toML(3pAO_e0? znC9a%7P<4P<5_YmTG{ATT>KHw?BFWOr*GxU6)1*qr5P+|lFTVfwZ7D*RS>emGw9Un zVJqZpbO?RnqpznwWzEM*HezX(m6_#@fu~xjlH?l04hQFK9#R6lv)T`!^}PVC^OGV) z(1(wYFX+>Qwq*#bIqRm>rKD_hcu>UZ-%LYuu&@4^X6esM*A7yZIUiTEZoN8O-iy+q zmR6~tqU=w+Z|4r}K0(w@&NJ+Ec6FAt?*GeNAW0|{f$99v^d4hhz$LTe*2A8PlIkxn z&l>aV8w|eR|Gk+${V-s+-q8-nA;W!kRF!$Ya#hy1iH?qLPOnC*TOE;z(^K8AmM7ON z3Z%2VymPQQo4VP%mnfQL*KUt1Z}IDGsSyQmJ8}@V==iJTXV#nqO21G3SroWHRUA^MO>di5`r5pWU9hnJSu@fAWNaa3K|=1j**{ z3#n2f^c?uZp0== zs%XOc{!VSz(aCk=^ZxLDMp~6SG!JA}w}+jEK%fa)c6zm9IP2?FQj}omnC?s!9(%Dx zKDHgbzp{LT_8(&fDw=yXtF!oEpTXp+v)+b#)cpQ%A0qYJ6EATUQC}`>)EgQ~-fLhr zipb4ZDX}^k%kIR!L(haA@4b=Ibpz%A#zB%{*NxdDUIbO8rJ>68X^5th8A#{Ak_S4a5@>@5%`IgnNaCS48na>OH%Wj*Lk);;@Lhp*IDgyzZ>-p_; zx1EhKMG+M&k&do$rMx|(5NP=3 zo8=YTVPSw=HAKnI0dnU>Kv_GzF;X=`m9HdwUg(J>O3Oa6Z{_w+{pyNY2A5gy0 z(3PFzC;#NjqhZpivjj$R0CfQqNu);E%fj{j!=T*5g^v5xuxFgRzT95ZqM4)SaN{*$Yita@2G#Q(1l;j()m=Lmre-rVu zZrh&~R<)kBH`qZNRvX@>2V<|slFYaI9uwk+3}w7wS5_$6{Ip2RzL7!~OeSGrp@>-k zB^`hyRxWtBvxJ)0V4^-ffIxwlguo4YM@{N@cQef2CK77^$^eMxq1oqP8xD5mVC>)W zh#M;44~r<|f1`f>m?Cl{;Gp{|3rzFuL;g#Q7okaHLu(QQWzgkB>TGxrJ(IodgpRV?pgkfzTi(>Qq2WZ97r7>M0`H zPO8o}ZUeDRpPEtL>yYlOSH4$$d@Du z&kOSwSAoC$L|Y7Dk5sGad{bf*kZ3Opv5X!Gz9}qH?u?rj52CP2H_?8ko?59YZ7cWn zSit7E`Wu9zFf&p|gpJ00(adPb7-5Pd+Dythk8R6UP4-v?CUD(n!1DAqz#$6CP8=3NS`W0}})TiF_uH6MzaVxy*N4om^bzfYtZm?wU~ws6M8?iM;qo zV`#$~vkC;X;R=myes@<+;3x!=JzIS;5~WwrMu#PEaKo4sSaDGS1FG}G=<~U>!k>p9 zY?k=pR1N`;_Z|S*b#Al)D_zV1Dnd8W+_5h=J_LYWpgJ7~P~i3HCVBOWP3CT~)%pIe zCdL5_>hZVf=W?K#U`8&S)6L&pP3G(wn|aY>bq!oe|B4`YX4)PjC_W-Q8)E+vr|5qGh}c#nR)j=mAq8B80)PS!ZrU z*wg!3OHWN2S8Z<+8oa4M1pY_ba7ciWQgBg)&15BY|2V%NpLF4_CX<)zqe2duX{MeY z(sL~acxVN6^1{Edy}x?ZO{l*y)o z?S4w1Z=!Xr-S{F;>3x1J_x>05viuY#(MMzkQv=$xw2xHM1Hj}uH8ph;4-zwg@!VDr z-%{4p$-3jg$&p3!d(hAeM5mPqvQJaYarly9m zdo%lM&=-bkW!eoUNvSi+A93z#PDkt6vCA1$b1`kq7?Td~ZBY0$b5fVL*KZ}xbv*11 zbU7?;U~fZlDi=5Y?NG_o^i#+av0sf}PZ;`MtAAxKjSOFTaLbD#?M=ZA6XM<>rc{zqlEy-GxU-kpUYv;l2utrztz>t=&~Un z!Bw~Q^hZK%S)p^Z2EoG`w9f0}pgKdSF`bAKqdtqzN%1cN4Msd3>o!Xx8ORQ=Wnyr? z>Sxj1MEtBg@9Xys7PnON*dq@`{-zkrIeYaHYswQG*6Z?m1YpLCjEufG9_991WaIZ) z-#BgB3?!N5))ugkJg@3FKOWTlE>inxU&q0q-QF?wLV8NwT1{dhkwV!?KmJeMaTjR8 zE^kS6ZG2UwDm0wRt>=0;$#2}w&ra~JCr}g0T?a;f9sh~H-@=>|NMlfGw^ z{>`#Tr3vjukT*}w1~}n1KZGd(@|ONva}K8JKm80p(1#4O*CKrj{C z^WtAB>vSPls7dm4F{*efat1<`OPp5sY;5n@-e=~8T~5`~AQBr05w%>9C2`8i=Kp&6 zT({v6|CmAG{T;2$8>)n;n*xTyUy1VZ$@X-{wL|w{Q=k5f7oN6JK?qOJEI0GBov9bQ zWomD_PgsvVh?K z7RiwV7bvFk8s?B%X}zy>osN?7?C1E6%e+bE3bO21SKxljaC8yNaUS)M2`F7PG zKbMU@hmznu?T06zf#x-Q&A3c$E^XhBb3xTay|%c7cW}-m9PJ=XIyW~LnChPrQn^~I z1Ls}0jGD+OVR4YW0o&okbSgy>;WGe{0J!xqW2*Xw-_ganxasc}dv9#r&R?0=KfYXP z`Kg#Z1m!|9M{p8)0xksvhPnplU{msP8R>MI&icZBCw*NLgD^(V(%xa<4sw%s6U)bzbT@-)SsT7fUrObj3K1k#tMLlm%B$U;h@wZC4oz&lyd9FbFRC$C3VL z!c~&_D`neAjPQ*2?akxWpy)s*gMb@Pms39U>9hpE6NlxZtUMGoU*eqNPwy(Mg`Y4p z6OEQup!c8F0dt~@t1}lq>efRh6B6HO_*Rp~cT*1hgv=!3#THLXN$?auulRLTO?G4m_-J8KH3gH;>HOU_s4JHdK%|d|AZ2kH(r~$)MI^4n zW~jt>ab9M7r^)*o^%dvSQ|WU7uo|mUnN_=x)8UBVl(oO9#bMx3R-eU6W2GUJMooDv z2q_qVH|A0Y=MeX>tl4M|pS$Jw)@P_PbG$a!@#a!`{r=I2IB^blAE`P_K#5Z3#N6!9 zMm_z2dZ|ufk7iz+jXh7$PteP+{M#|8mQ@!+MiItd7XAvgETAa`sR+PjLT}KUp`(}k+?oK*O31vfG#_w(&Gy|{1l#~?T;AT_ zUrjlj?|Hr*o6fV|UY}eZ>ozU+P6YOi>5z{p7;g z)^Uc@{8vxD-n|Se=l2`iy4ZTSm%6m)wp>guqNPRfuqW)jxNo288nn2pYi2rN5}?o1 zK*1idke1O9ki1C_x0SvA#Vp<20O;=J5t|XN$ZJSqMx=L~6E*>npw|#-wrRl4`X%h+^gDX> zkjF8WXE_K1?ieoC78#M!#PhW-i$ndOJA)*VKG!<9yF+}g-J?5QvA5W;5`XXG=8k%2 z5cr5FFuHqw1Jn_AV4McJisj*JsW^&$*wj=%Z2e$=7m{c%_B#E-VfE$1+^gXzNy=zH z{HRg~0xleh369`{;yfA#U6zE^W~vH)X%huO5{JVhs*lq6>vno_u1pJ8wFKT~378^jP?`nt z>F1+JNuA|*I;gaE^9fS%QLkv9Q#9xRtYT+RQF{?2UUJFH^Vam>FwG}&7G53mTOjS*- zP)>S_g4!Fu!fE<1EWGP>95qW9Qw8h#?6^zn^3eUp_(K^wqs@%XYeG!A@W%yQKCqZq zcM30}tryzd!=YmipHNhyt9I+R|JJ*VKI6*8elRqX5q+D!eVUw7rDpe`vEh3RvBU(y z)f8L~_m)u6%&woWFUVl54S0M28TEk*5451}SyVA0qe9O zxG9znS4lReuXrIrqg+IY4+U$Pai^PJhJ(`aAa8&|@+I+@BO+!+r`d66-20w|%naVku9rLxsYBA#Z<}MdK@vDTF?3?BK$NW~c zkiNv}?VQ{Oj+{^GS_*IbrPgs?f010PAkfU>_gb0nH&q<=XPT^f^VXux^PyaIf-hsH zQsTwL)W^-_p`3*_g>_JPSsbE1%ki7<>);zZkBLn8<(I)qq?TTG$`Oy%FMM8Ttu*ZT z0TSg$7(0ldRVbLRx{e5u{|h$$u*gUF;iVUnWNH6P;Rn~1p>PSC#sJk$dlk&@0&i+< z*?QHs8*X$VDq4Dibn4bI$TrU?(F>vAff0K!I|ThKFJT?8vrsiIBGE?IF{H0wmc=rY zNzBaDOX~e0$+RDyT$4&!V48gIOI}MC*#rkeOt#BPwpKlGzwanu?vmGCu>DR)L}6_y#;^$wwus~XeqR< z4yQ{e4@Ksc&UR7ct2Pm!Xa<7dohcyDz^FTp4L-0koUy4hp86MQp~z)5HCxjhlGk_o zUGa;s*QBv53BQk>tn@-I=}$X#)eab49eyzlQ_J#;8&i)q;A_?A6F*nyDJU6gvV<68P-hZ)oQ;leGYC)uV1GPJe^)?L|v(Dop+Q~8yLcwhu!_GkA6}H{(4UZ<%m@P-O?T}?dPsGUhfBjX4K&^O{UDP{5j93n?!<}3q|j-z06O#0D^D>-4UoLFA{ z$|}S-x+mGKtfi^hVZMIUNQt-?Ci%X=O7d$71DTIix}>}lp^d2$CT`5fJaKkwGael_ z`)|SS7n3FV-<9iYQz~tyax0*uk$GWJycCd=FKDVx<)nj{5acWxWC&@&F{f4xJu#W` zA2nR>in@&H_4sz9G{tL6{9abGAaY<{&wKM$8ujCk+{PAB4Tcz`4QW(|Rqc*4Ml%>d zI#1bDi1<+Oeo=g`Ww@mBd}e(3!A_^vU+L04<1)Kcr#7NOG)}@k!(-Z6nMFcEI)^R2 zku-eV>kosqR04@Br`I!mg*SN9@Zl{9MX3tCdY#UNZuiV{?%TYdPM9B$;UvAj*s8p2 zD(1A-O1@GwMATNmpg?97y%g?bf5#ulzFCT9{TQNl;RgR$Fjer2EdPb*_F$VKxUl`67_Rh|R z{kh(^H!PH}qpiiPf&zFCjHCQBjW0?odlNI+vpErqmfeejk1x1e*yO-%ttKl)Cq@gi99dn{Rm{5_e;m^AXC@9{GAvnsX`8EzZcG-6_UyT$Wy zEIsQ5c0P1@Ob(_1EeMF*M;*CClE_!r{i4oB*0nTjAll zAG|v3p=*t5mb}Hb&5(6ahC9MMH#WA_3p{DF6sR*&j~jM zSa0^jcJs>{q^71Oki(?J1_$@Jw~t83=Y_(i8+v}=ym7TsfiTkI<*k#VU*NJ87IY@? zZ~L%Q;juv^Vfp!2?9uyc=zVJ+8`EQVN(KM9>nc!Va6?k~2P zj1Vu+!-HhBGJAveKh@>m8x_y1cBgD63AH!r5_Ya#BsAUdIcQ(&xLzbWT^`Ku&AWU! zZOGz@39!(W&Mr=2Rv-~}Jy?TkGLy$2T|W=%w3)sc)N!Mb$(x*9%qnJ{%QKW(034Pt zWw*yCWoZx%l`Y_Xa=W+9*;#q%b}uQ=tJ~s!x-*p(P$}^>-ijEPaQvIsoOS(9pF^gQ z^gh6P(0uN`&HRj)0xfsDU4jrTw3pd1KY8EASAXW8viI&pwP_FPUT|Xb`cG|FGWhIJ z!`E6pa6GO;&vl4gfZfz!p8x}ozi{d3O~1E!OUzq%nYcU}v)XFJUZ+7CBR3aa!UOov z8AF2@Zzv>;Kat4uF+-dQRr?__EK)2*H1+k2wU>nI^o4`Cf#`WH>aza!cnf5;bRiT{ z>nxO&ex<0}goJ6?<}f?6+bDPv}(Yi&l*cmbkXUk~mk; zGZx#=Vj#zqw2Fw2MSAUB9~hDaPKLs}45#e2Ru2<~sqhJ@&tzm;8y#+3?n_yNy@A;D z#854tGkxik{Ps+txt<({IhQe7Poi170arhSfqFM#EC(8w$9A}qi|0KT!by}qDHO2b z`RjMLDDper8VAkZB1014I>UV9p=k>L_1`ctpGO_O$4wv(LHLSwc8sFrj)@dRJY~v} znv(V-**gB^5X)6z?RW162j`os+`#2HWJ5I%cels=lzu<{#;_P~8I^)=(RJR{zrO?# z&Mk4?JQNtkn}9OF&sAl0uYaBtxtX40Y;uUjFj3Nd+;uz0UDEC}r6NVW37GayZ#>>l zA1*5^cBCY~OyEms1~|+){u}FHec>(M8AGR06P5nSEMYs#j?4!j{nW9SBKxSS##0Ll$L2LUZ zL*4rqK@rIer^}1`B(t2^*Q?SK87~ow*XkoTFKm|t{C@wiBY2?EYO<_WF|RZfT52_& zkS|Nod2v=SYgbb$Qp+V1j}?*PnSB#OKU|tS;9j(l3D_mp71LvP+=vpZ-9Ysp+;}Af$>yVDBs~Zc-lX< zMq60eCrqTBV^rxH2jcAUlee{{6<8}Ww-`&|IW69dk879Jim7oC9cz0rjr*lr8LQ4B zSAd&PSPN)QzN>Z=8b-W|ig;yfGx+~4xa!HsZYR8UUKq;%c8CTqSY1!#YO#)w7ArvA zn6mae9huLve5it2brB1u@_ER79eBqg*Nsw2dHP8nkKMJal=6jSOs$7wI+q6?TM9_` z+xWN9;X9!bEFvmN$o7_&)9v~W<|O75px+4nle5|E)BFt?Fft_LwG&4jSu^*395hXE zHC1))EvZ|@VMjmIbuV7Mx^*IC`xkB3`Izgo)bTwg+giUENB*4CKjK0`rfqbY4+ar!IHtmKr$ScXB6OrmklX|2mkA{_I*@QCI*F+iiGw?&b7~A?SzUx+} z$yW$BZ=2|tnAR_~RdI&WcXmm}wnG>D-b+z(^6Bf@)_re0OoT=56JcSDblnE~G&tOW zatfNfj3UA8LHH4Hm_K?Aa+>#+y*=yQxoI+KyjdbkcM8rBXf#q|8Fq6*5!YDb)U>)SxRUISXR+Ls`Z~3HjV;mX{CxBZl*+FK+I;!k4?jXVRQUNYRalDEZ|&bo zp2d3NCo{8*?Tp2XL#GzNZK-S9s|Y<<*j-K&{6wF@n`nO40*$BOU9oU|Jfle3XZO?? z{7UdO8R%woB{6K5S}2l$wer>a^kO(vp|Q4>JN43Qg~uJpTh*E*Zb$m| z8a*i)1~(XE8I%m2-=|j0JwK=1INznm8S%ZIYNV7+k(D*8U`P8>Sit#4#^~WWBy}gk zyQ(2>?S{hdZ~iUeptW1emZ-*+N%{xpBT9=I zAAgbY1Q!^mFhDOLx?Vc%PfO&PfJ9sZqELQsJ7;P;ot^;%MhWnWYdcI&XJue453k7O z_~(3o@kV-SWdKdZ-Ji)-%>)wzkdUlsQf?XmB9mdU(X455ydHgpbC`;+aYf=_IWfq8 zy2WeDk58Ia_X(!BV4g87go-)6z9l{f$`A_vX1|s?Uo-q^UKzv)6$DzaB)lp4^sy z6`6tOl$rqgch>gIR60rtFO${ftt(?mxDa}J@7HucfNC<3cECsUHGIpau$QA^PGWIw zEe7I9)tZWCLY~>bW<}C?u3;8S@pUb-iKDJZ4B4XR<`|r2Z=Wui3LHgt+*%{6JUAd6 z)bSu&Pj0u{CC3zp&dtp9axZ1+&b0g8I}yH>&_*gZbvIj1mBlKQo6t3TAyIO;)b0il zf`=~Zx}8ZXUKyn5?fu=iI!#x<1o|NxvCP-(c*2ISKnlvMy_tve2P3G+ zfJ`~7-Lz8o6ns;Ft=SJ%_h={d9?aJeFNlgoCTewfDf;e}$=f6+RcIBSq;PfzOlYtT zez4E*CPd@&@wmI@*i$ZxSs)@LbYYEpBeEQNdB6W}N26mL=hX`o!~gE8xv~x1>+_QS zpwzbu`u!YX>hO7JtrsII74mbDV%!jbkWysS@!6faXEA5rWC)qW3Sn=D zKM`es5g~R$ciW$#>d(rQJh`$8)AUFq!}jReZ##+&YQ?vaPXn&E4~BhW6e3u3vffW# zPxO-i?i%9FT~uUAVA$QO10IZaztfxX>&{|Y(eJ9I^^F!lMh_VKG27EmRAmgCO^gY= z?$MZ7usv2~hV84SR9AFv4*EEGIvFfnNvKN;kxDUJmcm?tTdz$Dv#n0MoQ0GXM?_{! z%-MBq*)$tkY*ZtQJ7G(`hs7 zeNclYc!MFuedHJ5kR^EE+sy8tNV&a~kn~EG7%r~i(u?DOg6hw3CWm)VY(8_AVE7Hh z#+_K?2ScmX`S^hyJ|Tadp+)ac&Htn&LIg%%6%5E^ipKIN_xAR{27&}#(v3?FK6qfcxGU+d`QFn?q5T>I!UWSx$Znwscuz2E&n_X4oB2sz;oB7*~0 zUyfwD4^WO9v+F3Q{trm?PnHH8?pUA3$|@ZJZXvEu3x-lC*i5MRFkY{FnG=M~nLqbNUnC%J7I;6Aqopu`vII8xOl$&;1M8sZs*t ztp9Gy0+eLmtIwM+#E?mA_W+Ble~bDXX`IUdHD;AU=C5RqGF$hjzpG-eflxlCRP0g+ zP~$|<#rX3>Q;mG#9p zQgo5XtjMDn208NagzZKY^Iydf|6S;wBFZY8fN@&G9{Rg{rYk;3lIwPy;6%O;S|7hw#=T+XvnqZO3W|Pds)8rGXVUYqUXV$2Z z>oi{V^SzfKbJ3@z1|V2WLg`E;zx&SKl7E)-zat?8DJfTtl9MDLKn4mknQ7`qfnFR& z?G~@r5rA6&Qi+@SX!ZLrqfTC&T`PovHR{vNo%t`am)sTl51X^^22=uKDm2PQ;#d<- zU%smDQPbsBt=GlMKG0?@>_I=gMVZoT)2jg~df@-`;;k=+=jxdVUy4|`l2kM}+aqNMVRC^vC6)8(+V^tN+K(Ukq zp*jpHxnvPBNNHlStPe-AiG2FkUt)<`Q@G| z%IzVOh^T_(Jw#8SljJQmX3szeyVLR*Wi04PJg%zObM@b^1YFdkRD;XjZigi_1 zl*F|=mv6Za)eoisHTzg#fc z`ChoLR<33X2|3`{FT=~kTQ1ty6UC>|$e6sEi)U+P`QrMDQie9a^&fXN(xi#Or3jhL z>u5blxoFayy`|`<_cc86B5D0yf`n3N+Fz?Vy@r!3+5A-U2qW_<7;SWiGRd)3(-I|C zi?wc5{q9AIeXY0J>Pv4(kVByGAr*IMPM*} znlPVjp@$!&A-Fq81t>Ecj&bOho52p#>zQ=g5-CRn3pHFAS}it{fdV!6IetZhY;+Yt zqwOKE)#wD~WlMblr(eFpJ=L$5D2!R$rz`iZThlrZk<7YoTN@h(;T><@tQdEWro|i- zr;KF%^QtsS+S$_BTg|9iIy#0{8Qu%|ct_7JO;^s1?d>UP+jjyPwXnAlH-47i=}SNr zkrgPdELkYtR?3ti8~TRZ&um}^Gzfllf;rCr^I~^(M;E+7^HcrQ!+lPGgUZO|GkXR6 zBknuUPVG7Ln}Rid?y78ow#Vsnddd7}Zq3g1I?=kh#Mj@B$ytTmp_zEBP-Q?nYLr<` z5)R_~-9Pt6!#B66nmg(}0rHxA7Ne&8gh;RQUmQ9&7w5YHcG@1Nv+uG^U!3At{%x}Z z4m;?Npqnd&buE(0f*aSpROkzD(46}1KClZtJd2wq3So47YE*nrgb$jmla1`K|bf0zbx+<0}f zj~NRBs`~3~j1&~5*ykuy}JOGN;3sgSRqbD*4(f< z%f$oM?jnkBEBAnE8!^_jkC^Z0z+~ zR3*_Mhok)RvKUGod$7rjYt2z0hdXU?HzqX4U5Vs#GS*hBVFkTlNP_vr9vp$Z3tnfV zl=`6&;Ta;~I)}5s1Lhnl;C_#ykl~Eh=kuwN$_VL2-# zh}3trSN51bEDIJze)#y0?fD~5A1;oB|9GGAt|lWfi}O>+nKroq^Gmp8mk-)MrC+mu zm!GfkUmtUt;5*;iTq}4hJ~h!B>z~016fdlV-2LO_GNv&HOM-SI<2@B~HudoM#Gr}g zE|$6lP*Ww$zYp3Eb1s|Qas_US3;_$LLb{~H1-UkB=zQ8l58BdEFXVx|=jLiXqthfo z@?(SDm7U(%?n`wE(b)sm zH^$fLnwxmFG+veKcQ~s(R?cx%9&mbo3C^E5yQb#}&Q))>W;!6If0#Gs2%|FhE2EJa zsI-pOu+UcezNRrL0IhoozfO**Zfkq;+pvh?&MiGQC!qJBo#J?5pjsfd z`sb;M^snE*yken9YzM1m_xUNvry%OtP;fuFWqrc*EDa39zMWc%J?N1DoaA$LsAO8IwEa;@E{qyfnBsWq`oZ+*w#`}G8~Dtc)9wvz zo#kheo7f+2zH6^z%<0uDpf|S)0?ZVYHFOfF{r#}Q8_gx)syoVzFqd!pc2nfP3I-NU zrtJDmb8JN!H%n}O^;uU=(})Tqoq9`j`H6&2_u0%WhBes|L^IZ|!M%5C6`%GwKL$j` zc-w_H=d?T9vPwz0qoATA`JDYs{cXa7`vjK39a+6Fz3%-P_dA(R*XiP)+x7EPlpsXp zXACr|7zw3^Kb-7Z&&;$9MogY0gFnAp7%cxSJf()(RY=@2QPFbZX4ZHltqwtlDNr@_ zc>_Z7CYLzvx?Si7Lp0P#d1XL6u%vYEdoY6kD8V3?Mt)bjXY|f<5h#fU=cK$>k*j%J zZ4CzTE+79DccWM!LTu-2vVN8^um%smFB$q3C0vjpLiUwHnX>cE;yf}_h8j4WG?}wn z{jYz6whO;vWMpyCNLr@-bgs|ZY0C^Ni8MU5cm^;O#m8>#%g?V>A*wHqjs>LH)c{+U zBhW%}v6ag^ve=rGfbOAqXyykIqJ7qjbd~o6;QpjWvu(bSb|kbhFhJjB4&)%cC6K3+ zGuiO+1#3-6|NZZ5&)aJNY@dj>Y?+pb8UI~HILKaPvM0`yPqvqVWM=L!0MWd-zy$Tq zKGFU}R-vr^Vp!qF*;MlQY@y@6u{^p+y=`8R=FfAPvdU_{dP93wZ)1r5=GWF*aNy@d zmD*gJfe!;m^DRS0hCW-TDofIQJnn3T$-&ReUP6ubgNqLbqK!SQ~{E2r`-2~EB{Ft{u1Q~ky z=;!)qzvl-D&&y_w3Ms<#Q&EwmMWr1uA>l{pwN)6EfxylV6A zF_TK08t@YWtzi*o0}};hdy5@w0&iP1O;|%V4TPe0DPLT95|mG%=@|1l+G^0B^|`)j z_3^?1aj}PS)z{C1+1C)cjkS`Q$dy^VuCH!x5Hf|_$BdQ{f6p>W#+6R=V({_tgOc+Y z=+{y#0UA2V@3plaiROPd|10?e3XvR+`{UQbGv#A2 zEKH+}!5_x_1;(3S7_{~uN>f4ZuX76p2wNr~ZZu@jDf80@* z4OF!>ZfZo|j&IA(@5&g`9#2Px`9Wd=Z?Yh;ohgzdh<_2TW_k{x>>v3xG9$eFkd*;a zxx6l?qX#z?P&UH28s62Ej{&TQ4=w$k!}@0;YkrjhU%+k8R8lAN&Qxv*082XGydA=9 z3w2i8;1mbdW;9!%Qmq0T{=aK*14rS)o}6+Z59q*@qvlVgY3AeyI-j0W6sjk3orb^Z~F~5sVLdNBsQQ9vZd5Nj&OM} z34{6EUY!$i&{<8J&DqIrrze=FK`ndab8aX49=dMboLo+SA_4yym+j)kO8XoH;G~89 z1=dUTm-_^oA?MfGMQL$CUsLSnzgpK+C_yMB%d)DCuJd3M+*SG=PUk8?6x#W@*3ng= zQCXO;v4-%qUF}Dbg1=4vjrVJfqX0|3Z(&OD=~2MlksE=x{J+@`qt>AM_{PhZ!r|0Q zq77mSdySc0X%qG$Q)!tT$^5j$o$hQI|^eTU)bHTJ96giF8tYOF{PbQMn z&MJelfprZI=Re(&KDReG%<6Z)w@>9eD>+WeU1z>PE(Jjs%;$V=pS_B#-WA24~M|P{L{;Gx@BRbJ;GY?y=+<*{++6(WR5>ff3vSNbn4UJC-FmQ(uXpdRaTkuiD5ekoL>^fUdzf*RL~$cR695q z6BZcD%Eyq*dffJKJ`JdCYTC)>D;Y>#)0=2d#;hx5INi$sR!85UR|$iYo;y+!1-rJN zHCviz%%JD|bkgZY*wKg!G#;o5L2$s%#Lt(delq%fm8lcIgIW zOXY6q&9FOgiR5NpC}Tl|@mjwn-U%lL0}%?Ob2Pi!9roL4Vk413cRKF*A|V`{$}ix# zaKc-7Fq$HU^9}lcwe1n!y8dQ6K?-oaQp}*8d#6(%?(96?PmaKp#m{Lu84Ch*f1u5u zdIfG+<@G7z30m$)EZw4!ER{$FO!swhKZ6ULEFqPVg<#>}Y;J6X7<@S4hr3z}WYm0e zG6&Z0=AeON@5(VBp-Wu3$!UH3v;LgJQXAwoPUzdFoB$($zwU5ZGYwMBrS|5?r^Ht@ z9;K925`+8FF5h^PWppcnu#cR#BwmB>B$Tb|XCX!-HOnvSADr&UQ}JpqHGHey%0Qwb zBMHEzL*VWwaDiznxW6o)DNqrZ;;TOsKY5%2%~5?tpKKk%7D60i318@F`+wr2Sz-c1 zMR5_581iMaJ-1TcQL3rHsenUJ2|mzp;R&US0Vmd5_&3c@{0lx~F z(cpi42i)VkG22ki^iwV6#Nb&O^O)rX2!rpUzDD+(m<~N$--|jOJ5SFm5ZrmOKZo<~ z9VO!P5Zci}kohewEe)a_bQ)}Bl+}6=4IhPz$+VMaDs(-7))`zv0Bqux-4X93^N(NH zzrjvB6_tjAJHh{NatHlvj#zTRM_tR} z1FX^%DXw&+386O&WeEy~PG~ktr~;vvh%O=oL6M?_fC8Zx1%ebQQjCfa39u|(Kx(Mc zi*P4Adq4N}y>IUGHX+HGIdkUBIsE7M1tyIvf+rUYf7`cn@9NaGI=w*%BYP4?z} zBGI;Z!LQkCz!?EO_fs&QTorr!;dR^C=H(DjOauOIthPHXOCK7TD7Oq z4{?wQI?yD`VE+L<$J8_-GgFYdTq+4|h{`G|wZQFzE<_h{N=7b_NX&rk2Z*S@$nwgu z);3xa%gmQz$7q{D*V}SqR!vM#@?D5zVz){nZ#bb26q)1g{_gLmV^vL0k{wiTsk9n% zUixjSvgLi2Tn?@5@vPvn`|0V!Al=J;@+4@4smLeYxR`V>Y2r!w)Y+hL%{DA2o6F(E zOM7sq*5XF|n7fMQJg4$>XG)>)*Ms-=1pe_D!-nr1yp+S20Ic}|;1ayNyvni5>+1pv zE~beRW@6DuL&G76IMDMydGaJfbOCuxofL+=Fsl20f zRX;up1Y0tAzFKp0Cj+Ylo}gR-3C1H2-czY1Al{c7W_pD4V#`;nsfd}2C&8x=i0y{_w)mZzFzK?NSjtfhn94$~+sb|vw=g>Se~?jS4QKl93TFZFWg3h+h@Q;st6W(0f`Lx~-@>4)7RYU!79(a|;Nl6pL0Rvhux9bWe$lJevOsSfJpnQr2Tp zSilZ~&dEzbVB7u;au=Yw4A2xG0KkDNZgaCX+!pcbTfe**zBER$$TMznMw|;YOxM%^ znQ@^bs$M{FhS9y{zw|@Wwt5BN*$|^W^wnQ30rV2Ssu-22%Z2-G=7dWS2oV8d7YF_O zNF=kw*wmCI^yS0boKk3nE&Eg<{51&j29JME{6jRC0AfWtPVakuW!e?k-?jeju_q?7 z|5Edv;h-)igeR3JECdIUE+7#x#o_VehsL1OEW4Cn7Q_A%0IyN8pL zpTA?6{lrJY=A1*dHS>58mHqjbI-jBCwB`0YZ_!&dv^KM>0oTR&2rC zy?eJa`&#{iW80q4kmyalS^7B)S)fV=;3%bQU_PEe8DMA2eq9;h| zvZrq}0|_`__6@}`^b?jp>PX0Dt9{t_r+OK2UaPq`0eE9!>)QWmoO9Nt}f`}FBk zFmN=<+9RqnxDRD8ylmWBCfKnNu$x#CB8)DDHZKZ)uw*fR(ICiuE>VE4I_N(fI=t~g zX|%g?OFSpF6f{8hb|$qz`8ApXq|_a{{oa;uk8N_&!l#*fp!;Qlz%qDWkJqa?gK%W_ zFoVqAz>}qLE2V7$RG~o|mbN59Jboy-b)4W)Jq;#DH7F*ZHqDxocY z+u*5Jk%k(pU4@P4qP5-i`n~A$#i!1kfo-j`vs1DAKDQy`AGNQKjE#+H%uS=}RY87Me_>^Q2 z5|QIzZ{RXvIJKKAS##mtvaX(9re0oJ`y9lpu~B0wae4xwSPA=r?u;*xC;g(z4;oVYk_qBm zc)+_cmLJi7XmhrVnoSC1h0&MS2awUW4)O8smpEBIn*Ti=sQCe@A(4oT)7sqt&vhDL zic&db0XyZ2idYTOAUF!Qg@<0=_c97h_pj88C!R zC05tg!syn+TQF~-K)KNiht<*1(ZPX-{#uRCSxe#(mv2I;k=HmfGUAZqAsif|MKe~I z)~~Xu16&U7$FuZi9fp(3tu{=IG*-dHg=Y?~8Ba6am$K}DHn&=`w-~8qQ_xMjn>Dpy z)9-4(jeeH@twm%%R}=-+h5-aQ9av5beH;OSVUUUv)!O_7913FK#0!9-L$Its&e~vP zM0AnvClFcRdUAzTWwpx$i0AV#Tm}fLqTfRe{ji-h!6!y&eJi}QN!9TQ!d z-c>uz>_*y0LB)C2vFvnPB}haYsZM7(>klNk#jq`&V=&B_3e5o>uSiI?58GsjKK)3B zMvIuMMn<@41N*Ic|9Uk90@1CgtbB^1kcf2f_AV_c@dV}# zy6D4GklWpv^TchhtgL_nRLQ#^pN()^oe)n&=5$6*rFd7pd;R*l7>DNa3u>zOXK~DZ zhE24TaxTk$_ojhrTP2WZn&D3;Fg%o|;M^ zK*~aG+&?ZIFn->CvkkTyh_CY;%$RP1(z_8BfxQh16|$4qYivQ`Je-8Kht})n`ri)w z^}8>*%61 z+WFA>@Y$E-tPNv!zp1`=w|L?W1KagvvMHjbYQfejMd9$9Q`!&@uk)L4(Bgastmz~ zgE_)DFX3UacDPuDGl~F9B!y_#)*ijpkNd^i>$SWPvLCGzKHFWMX!aRPTk1+H|7q^j zW<}PRvob|V`U1c~TW+s64+NE_IZt{S$F?ZAnJpEv)q$B~s-@*>^IF z48p6bsuYObF65*^KJ{3cd>2d`K7Vd*&UWpxLBULdqRcRT_n^$5T>|i_vrfP4%Y3K^ z?%&pZJk2Num@c*-V<^QidFwJVHPaJ$#$E!2{eDtm`X0jw-~YFdMla#c@49NNAG`a~ zWs}eUY%O8vdPBO@S_s>q_BW<=o0ldt^f{T;wbkk~4F?K(XQo%J=P#n9S1OSEe`jtg z#(^Xmmk^HeehsoNGB*ie*^$|)qt7i-s}D^Cv)u#)3_7&_ zvz_vPn8m9dQVi>ULI;`xp>1ersIIP#+isSG`O-Qv(QE($@HW!i%n^x(aX#F{znu{? zt3kXnTzJU&+gX8LQO+ZHe`>N6aKRa0avSz7KR-WMboKTf_!g+g17__c>$=&>i&n;Q z>+^$4KXG^N+`0DZYBf?_mu2ZT)F3z<&c*>Jtkw|^`N|nlx|V<>IUB1x9?s6mft!oB z#xL0iqpVM?|6XI^Weqij=_z6~h5O``c2mX==PQ0CM~)sXvlO*^Tv3GeKq#X*Bi1(# zOc`I?583TYA*d4bf~CQ*yLV;z32lx==7f|Ko-=1!z+9_tFS>h_F&go91AVRamS z+MTW*|6w8~F3$g<2r7_QrlP1c(8~wLiIA)n@2KFYX%0?SD729-!4{Y_t-;Xj{(EQz z-O(~LuyOQ01v2wSHUIDkg+eL&b|WZARp*q|n~e)BXe&j@+#WjW?3vCtJYIhRha4et z99ddGSwfOZ#SR3%ff=jx$TJ0l=<59I`Q`CZ|y_acgV)^ab-{rPjxq%$ixI9Ba1kIq z=Zhqo+jo}=Cc;hh^u@G!%ZgseT05iTe`$xeFUjOZpl+hcqT?KSyJ>456UzU!C{Y8obvjw7E&Q{G_!G;&0T zYf4)l3VyVjN^Fi;mU)2`ddmrx0aPM+d8h!O0AR5Qyc_Loa@YG@p*Bf;ib*ktUWSa- zERE#uwaPJ`6`DO7ST2u_H`KrO7@zInL2F1V=QW}(k6~#~(td2MnuhlM zNI`5ypYxZD8wJ}8|L*7Tcap$-$U1SZ_wD-SS5LCF!DSr3bkSE`$e?XoEv6AgF^e6y z;`lAA04v_v)01re-4-iL@ZpfTW@Ka`kr)*fW!mj#?R1~r-H_g%W!D^q34bm*_^2*t zQTVg=xR(c3!cbrTn(9(j;yrvz`)fg#;!o)Kq~}ovPH)ehPmRrb=vy4hP90;_+MX@z zcwR^jes}vk%ZOD_rkr>aS~ae)l`&FRMse4$%RSr;XGFlct2W(7)Qi_OlmMloTq;5Y z&SOOSY}QTj;5YRf{7172vwZOL3H4bA+a}r%}FFG&V7FPw%K6J zU3}$}VgNHHX-rj&b;bLNzCdC#Qp4=c4ZN% zr=5Y{s~qg@8ipo2y1c7+2VbP5M5kEDYs|Df@zb#PdzG3H;%gYu>Tv@(Y#tAkdf~%rPP_$phK3)y zO;|7`OB)xYPSkoHA`VqxBWq+t6SC$;Om3HkejQ`gX7LI^J>qH^9g-&W%q|`JT6^yV zqq=%6&}{KD;o+a{V<21O<|fIqG6j|EBz!lF2lGe|O%m?U4HkAyN#Ib3i;K&7ul##| z%)9Gi%@Ij_&d(mQl5&NS+1>7?BAob^u35N%$W`aW%N5w1P(d1Ay_(f5bcb&Nqo+fh zrj-uPs#lgb&;-TrM#bhtnRfipIHH@!k{8jDi5PU7F3eq-$d+nY8-<}Y?4|}VS}ym> zXiuIv*h_HXi6<^{SUVfgnHMg2{P93}?ba!SK79#Wv9<4Zk!1nF?~z>6sZ zmy1<4cH`z&UPV(kkabBK=b0sIuKtkFVhR@fca$D7V^&BC#Vk}1k>Txt9!07|sIAdt z_n(VkwZsG_J4B{JA)V-WsOq-Np4$E~{oWz-H + runAsGroup: 3000 <2> + allowPrivilegeEscalation: false <3> + capabilities: <4> + drop: ["ALL"] + securityContext: + runAsNonRoot: true <5> + seccompProfile: <6> + type: RuntimeDefault + sysctls: + - name: kernel.shm_rmid_forced + value: "1" + - name: net.ipv4.ip_local_port_range + value: "32770 60666" + - name: net.ipv4.tcp_syncookies + value: "0" + - name: net.ipv4.ping_group_range + value: "0 200000000" +---- +<1> `runAsUser` controls which user ID the container is run with. +<2> `runAsGroup` controls which primary group ID the containers is run with. +<3> `allowPrivilegeEscalation` determines if a pod can request to allow privilege escalation. If unspecified, it defaults to true. This boolean directly controls whether the `no_new_privs` flag gets set on the container process. +<4> `capabilities` permit privileged actions without giving full root access. This policy ensures all capabilities are dropped from the pod. +<5> `runAsNonRoot: true` requires that the container will run with a user with any UID other than 0. +<6> `RuntimeDefault` enables the default seccomp profile for a pod or container workload. + +. Create the pod by running the following command: ++ +[source,terminal] +---- +$ oc apply -f sysctl_pod.yaml +---- ++ +. Verify that the pod is created by running the following command: ++ +[source,terminal] +---- +$ oc get pod +---- ++ +.Example output +[source,terminal] +---- +NAME READY STATUS RESTARTS AGE +sysctl-example 1/1 Running 0 14s +---- + +. Log in to the pod by running the following command: ++ +[source,terminal] +---- +$ oc rsh sysctl-example +---- + +. Verify the values of the configured sysctl flags. For example, find the value `kernel.shm_rmid_forced` by running the following command: ++ +[source,terminal] +---- +sh-4.4# sysctl kernel.shm_rmid_forced +---- ++ +.Expected output +[source,terminal] +---- +kernel.shm_rmid_forced = 1 +---- diff --git a/modules/nodes-containers-sysctls-about.adoc b/modules/nodes-containers-sysctls-about.adoc index 5119966f92..0b61b954b1 100644 --- a/modules/nodes-containers-sysctls-about.adoc +++ b/modules/nodes-containers-sysctls-about.adoc @@ -6,94 +6,17 @@ [id="nodes-containers-sysctls-about_{context}"] = About sysctls -In Linux, the sysctl interface allows an administrator to modify kernel -parameters at runtime. Parameters are available via the *_/proc/sys/_* virtual -process file system. The parameters cover various subsystems, such as: +In Linux, the sysctl interface allows an administrator to modify kernel parameters at runtime. Parameters are available from the `_/proc/sys/_` virtual process file system. The parameters cover various subsystems, such as: -- kernel (common prefix: *_kernel._*) -- networking (common prefix: *_net._*) -- virtual memory (common prefix: *_vm._*) -- MDADM (common prefix: *_dev._*) +- kernel (common prefix: `_kernel._`) +- networking (common prefix: `_net._`) +- virtual memory (common prefix: `_vm._`) +- MDADM (common prefix: `_dev._`) -More subsystems are described in -link:https://www.kernel.org/doc/Documentation/sysctl/README[Kernel documentation]. +More subsystems are described in link:https://www.kernel.org/doc/Documentation/sysctl/README[Kernel documentation]. To get a list of all parameters, run: [source,terminal] ---- $ sudo sysctl -a ----- - -[[namespaced-vs-node-level-sysctls]] -== Namespaced versus node-level sysctls - -A number of sysctls are _namespaced_ in the Linux kernels. This means that -you can set them independently for each pod on a node. Being namespaced is a -requirement for sysctls to be accessible in a pod context within Kubernetes. - -The following sysctls are known to be namespaced: - -- *_kernel.shm*_* -- *_kernel.msg*_* -- *_kernel.sem_* -- *_fs.mqueue.*_* - -Additionally, most of the sysctls in the *net.** group are known -to be namespaced. Their namespace adoption differs based on the kernel -version and distributor. - -Sysctls that are not namespaced are called _node-level_ and must be set -manually by the cluster administrator, either by means of the underlying Linux -distribution of the nodes, such as by modifying the *_/etc/sysctls.conf_* file, -or by using a daemon set with privileged containers. You can use -the Node Tuning Operator to set _node-level_ sysctls. - - -[NOTE] -==== -Consider marking nodes with special sysctls as tainted. Only schedule pods onto -them that need those sysctl settings. Use the taints and toleration feature to mark the nodes. -==== - -[[safe-vs-unsafe-sysclts]] -== Safe versus unsafe sysctls - -Sysctls are grouped into _safe_ and _unsafe_ sysctls. - -For a sysctl to be considered safe, it must use proper -namespacing and must be properly isolated between pods on the same -node. This means that if you set a sysctl for one pod it must not: - -- Influence any other pod on the node -- Harm the node's health -- Gain CPU or memory resources outside of the resource limits of a pod - -{product-title} supports, or whitelists, the following sysctls -in the safe set: - -- *_kernel.shm_rmid_forced_* -- *_net.ipv4.ip_local_port_range_* -- *_net.ipv4.tcp_syncookies_* -- *_net.ipv4.ping_group_range_* - -All safe sysctls are enabled by default. You can use a sysctl in a pod by modifying -the `Pod` spec. - -Any sysctl not whitelisted by {product-title} is considered unsafe for {product-title}. -Note that being namespaced alone is not sufficient for the sysctl to be considered safe. - -All unsafe sysctls are disabled by default, and the cluster administrator must -manually enable them on a per-node basis. Pods with disabled unsafe sysctls -are scheduled but do not launch. - -[source,terminal] ----- -$ oc get pod ----- - -.Example output -[source,terminal] ----- -NAME READY STATUS RESTARTS AGE -hello-pod 0/1 SysctlForbidden 0 14s ----- +---- \ No newline at end of file diff --git a/modules/nodes-containers-sysctls-setting.adoc b/modules/nodes-containers-sysctls-setting.adoc index 2c6e2f6c48..a8865c964c 100644 --- a/modules/nodes-containers-sysctls-setting.adoc +++ b/modules/nodes-containers-sysctls-setting.adoc @@ -3,43 +3,45 @@ // * nodes/containers/nodes-containers-sysctls.adoc :_content-type: PROCEDURE -[id="nodes-containers-sysctls-setting_{context}"] -= Setting sysctls for a pod +[id="nodes-containers-starting-pod-with-unsafe-sysctls_{context}"] += Starting a pod with unsafe sysctls -You can set sysctls on pods using the pod's `securityContext`. The `securityContext` -applies to all containers in the same pod. +A pod with unsafe sysctls fails to launch on any node unless the cluster administrator explicitly enables unsafe sysctls for that node. As with node-level sysctls, use the taints and toleration feature or labels on nodes to schedule those pods onto the right nodes. -Safe sysctls are allowed by default. A pod with unsafe sysctls fails -to launch on any node unless the cluster administrator explicitly enables unsafe sysctls for -that node. As with node-level sysctls, use the taints and toleration feature -or labels on nodes to schedule those pods onto the right nodes. - -The following example uses the pod `securityContext` to set a safe sysctl -`kernel.shm_rmid_forced` and two unsafe sysctls, `net.core.somaxconn` and -`kernel.msgmax`. There is no distinction between _safe_ and _unsafe_ sysctls in -the specification. +The following example uses the pod `securityContext` to set a safe sysctl `kernel.shm_rmid_forced` and two unsafe sysctls, `net.core.somaxconn` and `kernel.msgmax`. There is no distinction between _safe_ and _unsafe_ sysctls in the specification. [WARNING] ==== -To avoid destabilizing your operating system, modify sysctl parameters only -after you understand their effects. +To avoid destabilizing your operating system, modify sysctl parameters only after you understand their effects. ==== +The following example illustrates what happens when you add safe and unsafe sysctls to a pod specification: + .Procedure -To use safe and unsafe sysctls: - -. Modify the YAML file that defines the pod and add the `securityContext` spec, as -shown in the following example: +. Create a YAML file `sysctl-example-unsafe.yaml` that defines an example pod and add the `securityContext` specification, as shown in the following example: + [source,yaml] ---- apiVersion: v1 kind: Pod metadata: - name: sysctl-example + name: sysctl-example-unsafe spec: + containers: + - name: podexample + image: centos + command: ["bin/bash", "-c", "sleep INF"] + securityContext: + runAsUser: 2000 + runAsGroup: 3000 + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault sysctls: - name: kernel.shm_rmid_forced value: "0" @@ -47,19 +49,17 @@ spec: value: "1024" - name: kernel.msgmax value: "65536" - ... ---- -. Create the pod: +. Create the pod using the following command: + [source,terminal] ---- -$ oc apply -f .yaml +$ oc apply -f sysctl-example-unsafe.yaml ---- -+ -If the unsafe sysctls are not allowed for the node, the pod is scheduled, -but does not deploy: -+ + +. Verify that the pod is scheduled but does not deploy because unsafe sysctls are not allowed for the node using the following command: ++ [source,terminal] ---- $ oc get pod @@ -68,6 +68,6 @@ $ oc get pod .Example output [source,terminal] ---- -NAME READY STATUS RESTARTS AGE -hello-pod 0/1 SysctlForbidden 0 14s +NAME READY STATUS RESTARTS AGE +sysctl-example-unsafe 0/1 SysctlForbidden 0 14s ---- diff --git a/modules/nodes-containers-sysctls-unsafe.adoc b/modules/nodes-containers-sysctls-unsafe.adoc index 5f972ad4cf..db8e535604 100644 --- a/modules/nodes-containers-sysctls-unsafe.adoc +++ b/modules/nodes-containers-sysctls-unsafe.adoc @@ -26,27 +26,28 @@ containers, resource shortage, or breaking a node. .Procedure -. Add a label to the machine config pool where the containers where containers -with the unsafe sysctls will run: +. List existing MachineConfig objects for your {product-title} cluster to decide how to label your machine config by running the following command: + [source,terminal] ---- -$ oc edit machineconfigpool worker +$ oc get machineconfigpool ---- + -[source,yaml] +.Example output +[source,terminal] ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfigPool -metadata: - creationTimestamp: 2019-02-08T14:52:39Z - generation: 1 - labels: - custom-kubelet: sysctl <1> +NAME CONFIG UPDATED UPDATING DEGRADED MACHINECOUNT READYMACHINECOUNT UPDATEDMACHINECOUNT DEGRADEDMACHINECOUNT AGE +master rendered-master-bfb92f0cd1684e54d8e234ab7423cc96 True False False 3 3 3 0 42m +worker rendered-worker-21b6cb9a0f8919c88caf39db80ac1fce True False False 3 3 3 0 42m ---- -<1> Add a `key: pair` label. -. Create a `KubeletConfig` custom resource (CR): +. Add a label to the machine config pool where the containers with the unsafe sysctls will run by running the following command: ++ +[source,terminal] +---- +$ oc label machineconfigpool worker custom-kubelet=sysctl +---- +. Create a YAML file `set-sysctl-worker.yaml` that defines a `KubeletConfig` custom resource (CR): + [source,yaml] ---- @@ -66,64 +67,108 @@ spec: <1> Specify the label from the machine config pool. <2> List the unsafe sysctls you want to allow. -. Create the object: +. Create the object by running the following command: + [source,terminal] ---- $ oc apply -f set-sysctl-worker.yaml ---- -+ -A new `MachineConfig` object named in the `99-worker-XXXXXX-XXXXX-XXXX-XXXXX-kubelet` format is created. -. Wait for the cluster to reboot usng the `machineconfigpool` object `status` fields: -+ -For example: -+ -[source,yaml] ----- -status: - conditions: - - lastTransitionTime: '2019-08-11T15:32:00Z' - message: >- - All nodes are updating to - rendered-worker-ccbfb5d2838d65013ab36300b7b3dc13 - reason: '' - status: 'True' - type: Updating ----- -+ -A message similar to the following appears when the cluster is ready: -+ -[source,yaml] ----- - - lastTransitionTime: '2019-08-11T16:00:00Z' - message: >- - All nodes are updated with - rendered-worker-ccbfb5d2838d65013ab36300b7b3dc13 - reason: '' - status: 'True' - type: Updated ----- - -. When the cluster is ready, check for the merged `KubeletConfig` object in the new `MachineConfig` object: +. Wait for the Machine Config Operator to generate the new rendered configuration and apply it to the machines by running the following command: + [source,terminal] ---- -$ oc get machineconfig 99-worker-XXXXXX-XXXXX-XXXX-XXXXX-kubelet -o json | grep ownerReference -A7 +$ oc get machineconfigpool worker -w ---- + -[source,json] +After some minutes the `UPDATING` status changes from True to False: ++ +[source,terminal] ---- - "ownerReferences": [ - { - "apiVersion": "machineconfiguration.openshift.io/v1", - "blockOwnerDeletion": true, - "controller": true, - "kind": "KubeletConfig", - "name": "custom-kubelet", - "uid": "3f64a766-bae8-11e9-abe8-0a1a2a4813f2" - } - ] +NAME CONFIG UPDATED UPDATING DEGRADED MACHINECOUNT READYMACHINECOUNT UPDATEDMACHINECOUNT DEGRADEDMACHINECOUNT AGE +worker rendered-worker-f1704a00fc6f30d3a7de9a15fd68a800 False True False 3 2 2 0 71m +worker rendered-worker-f1704a00fc6f30d3a7de9a15fd68a800 False True False 3 2 3 0 72m +worker rendered-worker-0188658afe1f3a183ec8c4f14186f4d5 True False False 3 3 3 0 72m +---- +. Create a YAML file `sysctl-example-safe-unsafe.yaml` that defines an example pod and add the `securityContext` spec, as shown in the following example: ++ +[source,yaml] +---- +apiVersion: v1 +kind: Pod +metadata: + name: sysctl-example-safe-unsafe +spec: + containers: + - name: podexample + image: centos + command: ["bin/bash", "-c", "sleep INF"] + securityContext: + runAsUser: 2000 + runAsGroup: 3000 + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + sysctls: + - name: kernel.shm_rmid_forced + value: "0" + - name: net.core.somaxconn + value: "1024" + - name: kernel.msgmax + value: "65536" +---- + +. Create the pod by running the following command: ++ +[source,terminal] +---- +$ oc apply -f sysctl-example-safe-unsafe.yaml ---- + -You can now add unsafe sysctls to pods as needed. +.Expected output ++ +[source,terminal] +---- +Warning: would violate PodSecurity "restricted:latest": forbidden sysctls (net.core.somaxconn, kernel.msgmax) +pod/sysctl-example-safe-unsafe created +---- + +. Verify that the pod is created by running the following command: ++ +[source,terminal] +---- +$ oc get pod +---- ++ +.Example output +[source,terminal] +---- +NAME READY STATUS RESTARTS AGE +sysctl-example-safe-unsafe 1/1 Running 0 19s +---- + +. Log in to the pod by running the following command: ++ +[source,terminal] +---- +$ oc rsh sysctl-example-safe-unsafe +---- + +. Verify the values of the configured sysctl flags. For example, find the value `net.core.somaxconn` by running the following command: ++ +[source,terminal] +---- +sh-4.4# sysctl net.core.somaxconn +---- ++ +.Expected output +[source,terminal] +---- +net.core.somaxconn = 1024 +---- + +The unsafe sysctl is now allowed and the value is set as defined in the `securityContext` spec of the updated pod specification. diff --git a/modules/nodes-namespaced-nodelevel-sysctls.adoc b/modules/nodes-namespaced-nodelevel-sysctls.adoc new file mode 100644 index 0000000000..7806fb8dff --- /dev/null +++ b/modules/nodes-namespaced-nodelevel-sysctls.adoc @@ -0,0 +1,31 @@ +// Module included in the following assemblies: +// +// * nodes/containers/nodes-containers-sysctls.adoc + +:_content-type: CONCEPT + +[id="namespaced-and-node-level-sysctls"] += Namespaced and node-level sysctls + +A number of sysctls are _namespaced_ in the Linux kernels. This means that you can set them independently for each pod on a node. Being namespaced is a requirement for sysctls to be accessible in a pod context within Kubernetes. + +The following sysctls are known to be namespaced: + +- `_kernel.shm*_` +- `_kernel.msg*_` +- `_kernel.sem_` +- `_fs.mqueue.*_` + +Additionally, most of the sysctls in the `net.*` group are known to be namespaced. Their namespace adoption differs based on the kernel version and distributor. + +Sysctls that are not namespaced are called _node-level_ and must be set +manually by the cluster administrator, either by means of the underlying Linux +distribution of the nodes, such as by modifying the `_/etc/sysctls.conf_` file, +or by using a daemon set with privileged containers. You can use the Node Tuning Operator to set _node-level_ sysctls. + + +[NOTE] +==== +Consider marking nodes with special sysctls as tainted. Only schedule pods onto +them that need those sysctl settings. Use the taints and toleration feature to mark the nodes. +==== diff --git a/modules/nodes-safe-sysctls-list.adoc b/modules/nodes-safe-sysctls-list.adoc new file mode 100644 index 0000000000..15b993ca39 --- /dev/null +++ b/modules/nodes-safe-sysctls-list.adoc @@ -0,0 +1,118 @@ +// Module included in the following assemblies: +// +// * nodes/containers/nodes-containers-sysctls.adoc + +:_content-type: REFERENCE +[id="safe_and_unsafe_sysctls_{context}"] += Safe and unsafe sysctls + +Sysctls are grouped into _safe_ and _unsafe_ sysctls. + +For system-wide sysctls to be considered safe, they must be namespaced. A namespaced sysctl ensures there is isolation between namespaces and therefore pods. If you set a sysctl for one pod it must not add any of the following: + +- Influence any other pod on the node +- Harm the node health +- Gain CPU or memory resources outside of the resource limits of a pod + +[NOTE] +==== +Being namespaced alone is not sufficient for the sysctl to be considered safe. +==== +Any sysctl that is not added to the allowed list on {product-title} is considered unsafe for {product-title}. + +Unsafe sysctls are not allowed by default. For system-wide sysctls the cluster administrator must manually enable them on a per-node basis. Pods with disabled unsafe sysctls are scheduled but do not launch. + +[NOTE] +==== +You cannot manually enable interface-specific unsafe sysctls. +==== + +{product-title} adds the following system-wide and interface-specific safe sysctls to an allowed safe list: + +.System-wide safe sysctls +[cols="30%,70%",options="header"] +|=== +| sysctl | Description + +| `kernel.shm_rmid_forced` +a|When set to `1`, all shared memory objects in current IPC namespace are automatically forced to use IPC_RMID. For more information, see link:https://docs.kernel.org/admin-guide/sysctl/kernel.html?highlight=shm_rmid_forced#shm-rmid-forced[shm_rmid_forced]. + +| `net.ipv4.ip_local_port_range` +a| Defines the local port range that is used by TCP and UDP to choose the local port. The first number is the first port number, and the second number is the last local port number. If possible, it is better if these numbers have different parity (one even and one odd value). They must be greater than or equal to `ip_unprivileged_port_start`. The default values are `32768` and `60999` respectively. For more information, see link:https://docs.kernel.org/networking/ip-sysctl.html?highlight=ip_local_port_range#ip-variables[ip_local_port_range]. + +| `net.ipv4.tcp_syncookies` +|When `net.ipv4.tcp_syncookies` is set, the kernel handles TCP SYN packets normally until the +half-open connection queue is full, at which time, the SYN cookie functionality kicks in. This functionality allows the system to keep accepting valid connections, even if under a denial-of-service attack. For more information, see link:https://docs.kernel.org/networking/ip-sysctl.html?highlight=tcp_syncookies#tcp-variables[tcp_syncookies]. + +| `net.ipv4.ping_group_range` +a| This restricts `ICMP_PROTO` datagram sockets to users in the group range. The default is `1 0`, meaning that nobody, not even root, can create ping sockets. For more information, see link:https://docs.kernel.org/networking/ip-sysctl.html?highlight=ping_group_range#ip-variables[ping_group_range]. + +| `net.ipv4.ip_unprivileged_port_start` +| This defines the first unprivileged port in the network namespace. To disable all privileged ports, set this to `0`. Privileged ports must not overlap with the `ip_local_port_range`. For more information, see link:https://docs.kernel.org/networking/ip-sysctl.html?highlight=ip_unprivileged_port_start#ip-variables#ip-variables[ip_unprivileged_port_start]. +|=== + + +.Interface-specific safe sysctls +[cols="30%,70%",options="header"] +|=== +| sysctl | Description + +| `net.ipv4.conf.IFNAME.accept_ra` +a|Accept IPv4 Router Advertisements; autoconfigure using them. It also determines whether or not to transmit router solicitations. Router solicitations are transmitted only if the functional setting is to accept router advertisements. + +| `net.ipv4.conf.IFNAME.accept_redirects` +a| Accept IPv4 ICMP redirect messages. + +| `net.ipv4.conf.IFNAME.accept_source_route` +|Accept IPv4 packets with strict source route (SRR) option. + +| `net.ipv4.conf.IFNAME.arp_accept` +a| Define behavior for gratuitous ARP frames with an IPv4 address that is not already present in the ARP table: + +* `0` - Do not create new entries in the ARP table. + +* `1` - Create new entries in the ARP table. + +| `net.ipv4.conf.IFNAME.arp_notify` +| Define mode for notification of IPv4 address and device changes. + +| `net.ipv4.conf.IFNAME.disable_policy` +a| Disable IPSEC policy (SPD) for this IPv4 interface. + +| `net.ipv4.conf.IFNAME.secure_redirects` +a| Accept ICMP redirect messages only to gateways listed in the interface’s current gateway list. + +| `net.ipv4.conf.IFNAME.send_redirects` +| Send redirects is enabled only if the node acts as a router. That is, a host should not send an ICMP redirect message. It is used by routers to notify the host about a better routing path that is available for a particular destination. + +| `net.ipv6.conf.IFNAME.accept_ra` +a| Accept IPv6 Router advertisements; autoconfigure using them. It also determines whether or not to transmit router solicitations. Router solicitations are transmitted only if the functional setting is to accept router advertisements. + +| `net.ipv6.conf.IFNAME.accept_redirects` +a| Accept IPv6 ICMP redirect messages. + +| `net.ipv6.conf.IFNAME.accept_source_route` +a| Accept IPv6 packets with SRR option. + +| `net.ipv6.conf.IFNAME.arp_accept` +a| Define behavior for gratuitous ARP frames with an IPv6 address that is not already present in the ARP table: + +* `0` - Do not create new entries in the ARP table. + +* `1` - Create new entries in the ARP table. + +| `net.ipv6.conf.IFNAME.arp_notify` +| Define mode for notification of IPv6 address and device changes. + +| `net.ipv6.neigh.IFNAME.base_reachable_time_ms` +| This parameter controls the hardware address to IP mapping lifetime in the neighbour table for IPv6. + +| `net.ipv6.neigh.IFNAME.retrans_time_ms` +| Set the retransmit timer for neighbor discovery messages. + +|=== + +[NOTE] +==== +The interface name is represented by the `IFNAME` token, and is replaced with the actual name of the interface at runtime. +==== diff --git a/modules/nw-cfg-tuning-interface-cni.adoc b/modules/nw-cfg-tuning-interface-cni.adoc new file mode 100644 index 0000000000..98c656bece --- /dev/null +++ b/modules/nw-cfg-tuning-interface-cni.adoc @@ -0,0 +1,158 @@ +// Module included in the following assemblies: +// +// * networking/setting-interface-level-network-sysctls.adoc +:_content-type: PROCEDURE +[id="nw-configuring-tuning-cni_{context}"] += Configuring the tuning CNI + +The following procedure configures the tuning CNI to change the interface-level network `net.ipv4.conf.IFNAME.accept_redirects` sysctl. This example enables accepting and sending ICMP-redirected packets. + +.Procedure + +. Create a network attachment definition, such as `tuning-example.yaml`, with the following content: ++ +[source,yaml] +---- +apiVersion: "k8s.cni.cncf.io/v1" +kind: NetworkAttachmentDefinition +metadata: + name: <1> + namespace: default <2> +spec: + config: '{ + "cniVersion": "0.4.0", <3> + "name": "", <4> + "plugins": [{ + "type": "" <5> + }, + { + "type": "tuning", <6> + "sysctl": { + "net.ipv4.conf.IFNAME.accept_redirects": "1" <7> + } + } + ] +} +---- +<1> Specifies the name for the additional network attachment to create. The name must be unique within the specified namespace. +<2> Specifies the namespace that the object is associated with. +<3> Specifies the CNI specification version. +<4> Specifies the name for the configuration. It is recommended to match the configuration name to the name value of the network attachment definition. +<5> Specifies the name of the main CNI plug-in to configure. +<6> Specifies the name of the CNI meta plug-in. +<7> Specifies the sysctl to set. ++ +An example yaml file is shown here: ++ +[source,yaml] +---- +apiVersion: "k8s.cni.cncf.io/v1" +kind: NetworkAttachmentDefinition +metadata: + name: tuningnad + namespace: default +spec: + config: '{ + "cniVersion": "0.4.0", + "name": "tuningnad", + "plugins": [{ + "type": "bridge" + }, + { + "type": "tuning", + "sysctl": { + "net.ipv4.conf.IFNAME.accept_redirects": "1" + } + } + ] +}' +---- + +. Apply the yaml by running the following command: ++ +[source,terminal] +---- +$ oc apply -f tuning-example.yaml +---- ++ +.Example output +[source,terminal] +---- +networkattachmentdefinition.k8.cni.cncf.io/tuningnad created +---- + +. Create a pod such as `examplepod.yaml` with the network attachment definition similar to the following: ++ +[source,yaml] +---- +apiVersion: v1 +kind: Pod +metadata: + name: tunepod + namespace: default + annotations: + k8s.v1.cni.cncf.io/networks: tuningnad <1> +spec: + containers: + - name: podexample + image: centos + command: ["/bin/bash", "-c", "sleep INF"] + securityContext: + runAsUser: 2000 <2> + runAsGroup: 3000 <3> + allowPrivilegeEscalation: false <4> + capabilities: <5> + drop: ["ALL"] + securityContext: + runAsNonRoot: true <6> + seccompProfile: <7> + type: RuntimeDefault +---- +<1> Specify the name of the configured `NetworkAttachmentDefinition`. +<2> `runAsUser` controls which user ID the container is run with. +<3> `runAsGroup` controls which primary group ID the containers is run with. +<4> `allowPrivilegeEscalation` determines if a pod can request to allow privilege escalation. If unspecified, it defaults to true. This boolean directly controls whether the `no_new_privs` flag gets set on the container process. +<5> `capabilities` permit privileged actions without giving full root access. This policy ensures all capabilities are dropped from the pod. +<6> `runAsNonRoot: true` requires that the container will run with a user with any UID other than 0. +<7> `RuntimeDefault` enables the default seccomp profile for a pod or container workload. + +. Apply the yaml by running the following command: ++ +[source,terminal] +---- +$ oc apply -f examplepod.yaml +---- + +. Verify that the pod is created by running the following command: ++ +[source,terminal] +---- +$ oc get pod +---- ++ +.Example output +[source,terminal] +---- +NAME READY STATUS RESTARTS AGE +tunepod 1/1 Running 0 47s +---- + +. Log in to the pod by running the following command: ++ +[source,terminal] +---- +$ oc rsh tunepod +---- + +. Verify the values of the configured sysctl flags. For example, find the value `net.ipv4.conf.net1.accept_redirects` by running the following command: ++ +[source,terminal] +---- +sh-4.4# sysctl net.ipv4.conf.net1.accept_redirects +---- ++ +.Expected output +[source,terminal] +---- +net.ipv4.conf.net1.accept_redirects = 1 +---- diff --git a/networking/setting-interface-level-network-sysctls.adoc b/networking/setting-interface-level-network-sysctls.adoc new file mode 100644 index 0000000000..effdd91ee7 --- /dev/null +++ b/networking/setting-interface-level-network-sysctls.adoc @@ -0,0 +1,26 @@ +:_content-type: ASSEMBLY +:context: set-networkinterface-sysctls +[id="nodes-setting-interface-level-network-sysctls"] += Configuring interface-level network sysctls +include::_attributes/common-attributes.adoc[] + +toc::[] + +In Linux, sysctl allows an administrator to modify kernel parameters at runtime. You can modify interface-level network sysctls using the tuning Container Network Interface (CNI) meta plug-in. The tuning CNI meta plug-in operates in a chain with a main CNI plug-in as illustrated. + +image::264_OpenShift_CNI_plugin_chain_0722.png[CNI plug-in] + +The main CNI plug-in assigns the interface and passes this to the tuning CNI meta plug-in at runtime. You can change some sysctls and several interface attributes (promiscuous mode, all-multicast mode, MTU, and MAC address) in the network namespace by using the tuning CNI meta plug-in. In the tuning CNI meta plug-in configuration, the interface name is represented by the `IFNAME` token, and is replaced with the actual name of the interface at runtime. + +[NOTE] +==== +In {product-title}, the tuning CNI meta plug-in only supports changing interface-level network sysctls. +==== + +include::modules/nw-cfg-tuning-interface-cni.adoc[leveloffset=+1] + +[role="_additional-resources"] +[id="additional-resources_nodes-setting-interface-level-network-sysctls"] +== Additional resources + +* xref:../nodes/containers/nodes-containers-sysctls.adoc#nodes-containers-sysctls[Using sysctls in containers] \ No newline at end of file diff --git a/nodes/containers/nodes-containers-sysctls.adoc b/nodes/containers/nodes-containers-sysctls.adoc index 3da9f71207..30d91a276f 100644 --- a/nodes/containers/nodes-containers-sysctls.adoc +++ b/nodes/containers/nodes-containers-sysctls.adoc @@ -6,18 +6,21 @@ include::_attributes/common-attributes.adoc[] toc::[] +Sysctl settings are exposed through Kubernetes, allowing users to modify certain kernel parameters at runtime. Only sysctls that are namespaced can be set independently on pods. If a sysctl is not namespaced, called _node-level_, you must use another method of setting the sysctl, such as by using the Node Tuning Operator. +Network sysctls are a special category of sysctl. Network sysctls include: +* System-wide sysctls, for example `net.ipv4.ip_local_port_range`, that are valid for all networking. You can set these independently for each pod on a node. +* Interface-specific sysctls, for example `net.ipv4.conf.eth0.accept_local`, that only apply to a specific interface. You cannot set these independently for each pod on a node. You set these by using a configuration in the `tuning-cni` after the network interfaces are created. -Sysctl settings are exposed via Kubernetes, allowing users to modify certain -kernel parameters at runtime for namespaces within a container. Only sysctls -that are namespaced can be set independently on pods. If a sysctl is not -namespaced, called _node-level_, you must use another method of setting the sysctl, such as the -xref:../../scalability_and_performance/using-node-tuning-operator.adoc#using-node-tuning-operator[Node Tuning Operator]. Moreover, only those sysctls considered _safe_ are whitelisted by default; you can manually enable other _unsafe_ sysctls on the node to be available to the user. +[role="_additional-resources"] +.Additional resources + +* xref:../../scalability_and_performance/using-node-tuning-operator.adoc#using-node-tuning-operator[Node Tuning Operator] // The following include statements pull in the module files that comprise // the assembly. Include any combination of concept, procedure, or reference @@ -26,6 +29,22 @@ user. include::modules/nodes-containers-sysctls-about.adoc[leveloffset=+1] +include::modules/nodes-namespaced-nodelevel-sysctls.adoc[leveloffset=+1] + +include::modules/nodes-safe-sysctls-list.adoc[leveloffset=+1] + +[role="_additional-resources"] +.Additional resources +* link:https://docs.kernel.org/networking/ip-sysctl.html[Linux networking documentation] + +include::modules/nodes-containers-start-pod-safe-sysctls.adoc[leveloffset=+1] + include::modules/nodes-containers-sysctls-setting.adoc[leveloffset=+1] include::modules/nodes-containers-sysctls-unsafe.adoc[leveloffset=+1] + +[role="_additional-resources"] +[id="additional-resources_nodes-containers-sysctls"] +== Additional resources + +* xref:../../networking/setting-interface-level-network-sysctls.adoc#nodes-setting-interface-level-network-sysctls[Setting interface-level network sysctls] \ No newline at end of file