From 2bc7a8174b466928594abb4d7969b697ed2d6d48 Mon Sep 17 00:00:00 2001 From: mzz2017 <2017@duck.com> Date: Sat, 25 Mar 2023 21:12:26 +0800 Subject: [PATCH] docs: add 'how it works'. --- README.md | 4 +++ docs/how_it_works_zh.md | 53 ++++++++++++++++++++++++++++++++++++++++ docs/netstack-path.webp | Bin 0 -> 33876 bytes 3 files changed, 57 insertions(+) create mode 100644 docs/how_it_works_zh.md create mode 100644 docs/netstack-path.webp diff --git a/README.md b/README.md index c5c2d97..f212e92 100644 --- a/README.md +++ b/README.md @@ -27,6 +27,10 @@ Please refer to [Quick Start Guide](./docs/getting-started) to start using `dae` 1. If you setup dae and also a shadowsocks server (or any UDP servers) on the same machine in public network, such as a VPS, don't forget to add `l4proto(udp) && sport(your server ports) -> must_direct` rule for your UDP server port. Because states of UDP are hard to maintain, all outgoing UDP packets will potentially be proxied (depends on your routing), including traffic to your client. This behaviour is not what we want to see. `must_direct` makes all traffic from this port including DNS traffic direct. 1. If users in mainland China find that the first screen time is very long when they visit some domestic websites for the first time, please check whether you use foreign DNS to handle some domestic domain in DNS routing. Sometimes this is hard to spot. For example, `ocsp.digicert.cn` is included in `geosite:geolocation-!cn` unexpectedly, which will cause some tls handshakes to take a long time. Be careful to use such domain sets in DNS routing. +## How it works + +[dae 的工作原理](docs/how_it_works_zh.md) + ## TODO - [ ] Automatically check dns upstream and source loop (whether upstream is also a client of us) and remind the user to add sip rule. diff --git a/docs/how_it_works_zh.md b/docs/how_it_works_zh.md new file mode 100644 index 0000000..ac1bf75 --- /dev/null +++ b/docs/how_it_works_zh.md @@ -0,0 +1,53 @@ +# dae 的工作原理 + +dae 通过 [eBPF](https://en.wikipedia.org/wiki/EBPF) 在 Linux 内核的 tc (traffic control) 挂载点加载一个程序,通过该程序在流量进入 TCP/IP 网络栈之前进行流量分流。tc 在 linux 网络协议栈中的位置见下图所示(图为收包路径,发包路径方向相反),其中 netfilter 是 iptables/nftables 的位置。 + +![](netstack-path.webp) + +## 分流原理 + +### 分流信息 + +dae 支持以域名、源 IP、目的 IP、源端口、目的端口、TCP/UDP、IPv4/IPv6、进程名、MAC 地址等对流量进行分流。 + +其中,源 IP、目的 IP、源端口、目的端口、TCP/UDP、IPv4/IPv6、MAC 地址均可解析 MACv2 帧而得到。 + +**进程名**通过在 cgroupv2 挂载点侦听本地进程的 socket、connect、sendmsg 系统调用,并读取和解析进程控制块中的命令行来得到的。这种方式会比 clash 等用户态程序对传入的 socket 扫描整个 procfs 来得到进程信息要快得多。 + +**域名**通过劫持 DNS 请求,将 DNS 请求的域名与所查 IP 进行关联来得到。尽管这种方式有一些问题: + +1. 可能会出现误判。例如需要分流到国内和国外的两个网站拥有同一个 IP,且在短时间内同时被访问,或浏览器有 DNS 缓存。 +2. 用户的 DNS 请求必须通过 dae。例如将 dae 设为 DNS,或在 dae 作为网关的情况下使用公共 DNS。 + +但相比其他方案,这种方案已经是较优解了。例如 Fake IP 方案存在无法通过 IP 分流且存在严重的缓存污染问题,而域名嗅探方案存在只能嗅探 TLS/HTTP 等流量的问题。实际上,通过 SNI 嗅探来进行分流是更优选择,但由于 eBPF 对程序复杂度的限制,以及对循环的支持不友好,我们无法在内核空间实现域名嗅探。 + +因此,当 DNS 请求无法通过 dae 时,基于 domain 的分流将会失效。 + +> 为了降低 DNS 污染,以及获得更好的 CDN 连接速度,dae 在用户空间实现了域名嗅探。在 `dial_mode` 为 domain 或 domain 的变体,且流量需要被代理时,将嗅探的 domain 发送给代理服务器,而不是发送 IP,这样在代理服务器侧会对域名重新进行解析并使用最优 IP 进行连接,从而解决了 DNS 污染的问题,并获得了更好的 CDN 连接速度。 +> +> 同时,当高级用户已经使用了其他的分流方案,且不希望将 DNS 请求通过 dae,但希望被代理的那部分流量可以基于域名进行分流(例如基于目标域名,一部分分流到奈飞节点,一部分分流到下载节点,当然,也可以一部分通过 core 直连),可以通过 `dial_mode: domain++` 来强制使用嗅探的域名重新分流。 + +### 代理原理 + +dae 的代理原理和其他程序近似。区别是在绑定 LAN 接口时, dae 通过 eBPF 将 tc 挂载点的需代理流量的 socket buffer 直接关联至 dae 的 tproxy 侦听端口的 socket;在绑定 WAN 接口时,dae 将需代理流量 socket buffer 从网卡出队列移动至网卡的入队列,禁用其 checksum,并修改目的地址为 tproxy 侦听端口。 + +以 benchmark 来看,dae 的代理性能比其他代理程序好一些,但不多。 + +### 直连原理 + +一直以来,为了分流,流量需要经过代理程序,经过分流模块之后,再决定是直连还是代理。这样流量需要经过网络栈的解析、处理、拷贝,传入代理程序,再通过网络栈拷贝、处理、封装,然后传出,消耗大量资源。特别是对于 BT 下载等场景,尽管设置了直连,仍然会占用大量连接数、端口、内存、CPU 资源。甚至对于游戏的场景,会由于代理程序的处理不当而影响 NAT 类型,导致连接出错。 + +dae 在内核的较早路径上就对流量进行了分流,直连流量将直接进行三层路由转发,节省了大量内核态到用户态的切换和拷贝开销,此时 Linux 相当于一个纯粹的交换机或路由器。 + +> 为了让直连生效,对于高级拓扑的用户,请确保按 [kernel-parameters](getting-started/kernel-parameters.md) 配置后,在**关闭** dae 的情况下,其他设备将 dae 所在设备设为网关时,网络是畅通的。例如访问 223.5.5.5 能够得到正确响应,且在 dae 所在设备进行 tcpdump 可以看到客户端设备的请求报文。 + +因此,对于直连流量,dae 不会进行 SNAT,对于“旁路由”用户,这将形成非对称路由,即客户端设备发包时流量通过 dae 设备发送到网关,收包时由网关直接发给客户端设备,绕过 dae 设备。 + +> 这里的旁路由定义为代理程序的设备和上层路由器属同一个网段和链路。例如笔记本电脑在 192.168.0.3,旁路由在 192.168.0.2,路由器在 192.168.0.1。三层逻辑拓扑为:笔记本电脑 -> 旁路由 -> 路由器。 + +这一情况将带来一个优点和一个可能的问题: + +1. 会带来性能提升。由于回包不经过 dae,减少了路径,直连性能将变得和没有旁路由一样快。 +2. 会导致高级防火墙的状态维护失效从而丢包(例如 Sophos Firewall)。这一问题在家用网络中一般不会出现。 + +以 benchmark 来看,dae 的直连性能和其他代理程序相比就像个怪物。 \ No newline at end of file diff --git a/docs/netstack-path.webp b/docs/netstack-path.webp new file mode 100644 index 0000000000000000000000000000000000000000..0224ef4974be8e59793373c444432fc79b108105 GIT binary patch literal 33876 zcmV)wK$O2yNk&FYga80nMM6+kP&il$0000G0000t1OS`?06|PpNEliG00I9eBuMc8 zcxyzY?%@yH|3ymw|GUk0(A_B|rC_0;hyf;cw_@5AHIJHqOAK)ecBFy<@xW_t9AfdJ^oJJ z#sx66?EClc-`@`dz}fnpn&bTWm8JmPcZX9avjO;D3J(ttzw8fyJt>^J+Z}-E%5dsZLja!p!l~mZO+7eu*3|v# ziNV~$b18k)>!1m>!T5si8PA9E>z++NWy*M9w|B8JtQ!b2Q_i2||-^T?%`) zzpmb-a$i(Ae_C1xO|!KXy|DIqcTHhX&QL9lt_Aam(DzfdwP(I=Q%7$K*|O>kkM7n3 zTIck_+GtDQMwkFl+ke40^o1HAez}G&`ZlaOcP3{-MS#oQO0I4OAXt9EIP^RKyx2~c zdH2P2%Z9ydQguehw`u{6A6Ihy6b}$>yI>p|13>*{2we`48g9y3PN8u1-h5`*U_UT(e!@ujID(~DzVFqUpO`CNmGP=PoA?f;}joLFB|`x z0I&{CyfS=mJ4`=l0>Et5!zUr;Kxk=T^!@qjz_j}o|0ptJe9JqVAxQ`Hmqi2+Mz!SPrgshhk1}#WjrBKw`>a8vWjwIr~`do`2q-% zuJ}<*Oiavty|RS>bX-MMR_DB`Y;LSl1Iwn5wPn#9A$aGc(cO8*3^3^CDtvHM3z+`E z?%x8UaralY3p|zR&DoPNrNff9(r~)OZtc=xLw0Xo(37R@hbFBTZ^>+JXgwS_t$FtZd3X7`od&d(Zk z%i8R@hgdBMGd?3KG=CZ zxl`>E$5fk8InjA|O^>H@Hj&>fVWQCX#$Gd?>8hEU^a(mDtQ~Q9yGg7XF{aFmKCKJK zT3cHWENt2M(Kt?voc^Hs0aBxO#9&2to@#{qL=*Z1zK*_f<;vZ6y(q2oyV8tva|O9JM-oHZPY07U81Wu97e^HDp3F2tbM3%Pa8^j+C>0ov`qcX^y9cmuCp0x#fb z)Q+a0t#ERj2Wm&PhBW7>NDxy}TM@L8YoV>Emc-%hCb5bH0t@f^aTGx9skpTxTUCNT z`CZajEoQUTs7+C+6!p)3A8ibPEfQ0C6t0*m;s7A{Vych@fF%%91r)YOOyyFzVycJ( zfZ&U%LKXm)P;B0QV@4>uZW;*Nbw{)Tw0TWZLn%{8YRM1)`uj*~QX>Fvu_X1H7=Zr= zk|fDLODOY6YC&HB#z#qNyej~Y$K-#X3gf4;>Zk!6Ef#?K+m2BCQraJ(ZuJJBKJo~4 zxitXu#Yc`DIdNwpAAswwBS(%LIn;yFjv|n2v zwb!PHM(|ZuxZ~c=5PRkR-_r<9{$r{X>%E z_gTb07j!d8k|Zl)?Ebkh=@*6kID@FAvM*RGQcbabLQ1~pR!e1eVzfXtWoTlyhB7yC>sSSZcTJvnT(f;eV65jWzm5!=x|G{?T9?s8fr@HPujI zAy}xTHfr6rZ4h~+ZQHgD*s3YD)M_@;&fxMWW+#Nn1H8DxFT+ z*HS@n@E7H)6;xEmy=_ukg%$-QNtUl+sjAdwb5D^ZndyRmFt+$f{$8T?F9zNvGNn23 zZvcYJ7YOOx@$-6JA$B?gSR=v>|vpK1bCKUy zB7@yH3_zGo%PNdIe~h`$M5KS(<;j-=meq{B3X%L$0c7$X8!c*{<;7$ z9fZx#k&K@_LW=>!0e3#chn+aa*q3A9q>R#G5Pr|NUtc4(ELp(ZtBz&<`Eb~fJ~p8_ z6(rN&9ilCN=EsX7hS;frx%sAkI|?6k;nB~0*GEzj=J%x!%XMQR$?VUU8CRWfSV}qb zk!5Rj~Tkwq%NKUdAG$o$lAQXy76@s%@|Te)sve%-|MwoK8z{AF7L3UF7&4Rczs z$CZ)_GO50NnLf(3f+Ez~_p>G4LP&*~)`}h)r~fDd^80G_D&dYM73Oh6xe_n?GK8Z5 z(6sD?0YhB-zFY)FX!xqAKP@b-mn#Z#23xLr6$C>u`sZz;+jYfJ)Snidv2RJmm=nmZ z3azt>m{jpLI z+_)UN{Zbs{GFr6DR2WJ2Rbl#Far_=ESKdEovK0c+`S(bMATO}wr`>gD8o`5HM2l(V zisO$^u6B?HRn#s-8jYpPbYvB9x?zd$pjq;&J4)xVh>B(pu_-z8ox4Nqg>UX0SZB zlZDHXWNqVP;l37LCxhMMkGoj-=ggt#-q|LC)AP|LS8uwT`zGvAW-1hlfj-}kFF2Ut zZQ*`#yYAtfAZz!t*KBOl_tv-QTsQ#(Ure#Fo^{K4Kw4nv^S%P8q-|%z;m#Iqk=QS@ zr|0t^7Fc4@=y#1pBDIhV%|1md-zT=_E&g(`1PlGd{DCTV-2TD(cYQ`ounj}Q;-nHvQ={)a(?w|&L z*|lreuDh@5_bF3lm3WVpQ=-oSa?%WyRmDdm8c(h&lc_($1F-33puFkK#FzW5m zojZ5#+-_cz;Pqq}0M|acm4$xXNnPx8_>>NyA80k8aKyY4U)449>-+hD$1*3!hanm; zIJ9@%o2CGN*epJUGve;`NHN+y?+x&JE)!O72%4GPJuZa$)_Z!D4Jq;f1mh;EElu$N zr*E3qfV7rISHq1|CcIYaDp{O9=?8|4k9=;eHZy(oz}=|>_4XwN_gP!8op!>QhA1~;M=dr01{0UKUU(5+18Ox*lFn~RpP8{CT;Iz91(!GN@u@Ge{? zkU!q6raYxWvzbQC3BjRL&|7Qe$?VE%Ho)r;R+xRrhfQdYd6<8vuK-$W9~UIe(Lj$Z zPk^(o&=i2$?6`s_%S}jPeu=sdWA)!22UQX;KV%3nSPn&PSp^eytqdYNd^&p)jKcDb3 zAn3x3bV(%1?`M7W*~)^|9rAZ{4^wuHh{k3zcafurCi)HedU<9)0P61AwG$*+cCfS2E+vE{KOE>`#!?zc^3#QZMl~cPnLNuwNQ*uREK<_l~ny}WLDZHSTlzKtdl-5CP%9Oqo)7gzF zEobXUK~@wVidP_|o}Qk~+O(~-ORvg@230y{+Ux~|6tbe|%&~F&t)|vs$Wxj!XJEq1Mu4`LNvkIvV3I!q)sElYDF=QE zDJ2nN!oxlEIfu!FF5elUI zPgN?C@;~&ikVKY0UQUn5VFb|Yxvx}4z?x(uP)#G(h(_jERzKDVC|V{2#YmUJGf|^R zt8nN}srZ-@B*G2_QVcrs!$^|+@pOSH@JoR#gY2CikRRd9)IFZk6Wuy{a6G#GFk;ARD6hYz)+o8x8MA+jE;LIjzQMNoX}nTY36> zxk$b-*?|oxAs5p_y?Ib3-W=*}K%l1N>+OlQ1Zb1`Y@*Mk_&MUgseki=fBWqTo-jQ0 z`XN`z2~M$=5FBq)oe~8)av+gj1|91$9;dsv1|%y7Hj}y;L1InFn&`3hS)kJ8_JyQJ zOHJ`N9G?p*DL4BGz!_6IgH;u;u)QgskuYF2C!I^z7S%g-TF`go@e*+knoJJ^4!0 zu%dCklX4~_IK^>x@@yRhe?8x~%caNeH5sPM@}}5!cssjY$9->_V9VR{UHeBoa!SW{$PzC5d7myX?Fm@ zw*`P!(zY58u&vrmIQ_mqww%%cY+{#dtSo$TWr#6UHRM}Su}p%_Wxv_M3I5bK{GL4! ze2WceChVy3XqcGu;@07J{jueMx&%VaJ0!6vp|$Fqtvegq>t5Igr&u@2UM5CxvI}7U za%PRk^%Q3T+LZLimJ|!H{GJZh@X!ZZ6)abso0HO~vG1uUo!}H}(VV2NoZzzcKHmH9 zyVYoP%o}GKnbN*d*Yh9xV+*;uY5UW6tX=MH^6{9EK0**>|r67cRz@{FC<+uK05`r{7PAeX!7^x-+R9hlAsG(i{qcr?Wf|XSVD_#uM|d}YgHJR zD2}gv<*Hd(us|WOdVCwq5T(!B&_LU(Qa7&ruvh;#ix$0$6vtD(T#YFmT2+L#SEW|+ zRX_bI-QpET*=Slg-&GhVjjKX0R&l)QAXhFa2Mra1U`|mWLmdCMR9JP*u2#BPOMVP< z^Lx_5?SbOh#F48;>EUWs#2J6J($R!;0~V>#iaV_=h;F+T$BWLi5QcnJ5buL{RUryh z95)=~%3xnsOO_(Ah>3J!h_)Y}dJ|P9GOg5*EkB{Z&l=G}yy~l>$n_=UO0=zP1W`4F zj%lSjkmn{3pIFju;2(t%<46lQMVBjt-zP0ml`P*EisJojpPk#LG=J3W1n7dVI?(dwLpl`s#Z_HP+%La1K?iBm^ z)|jRZn7dJzjh|jD)C2vwU1NVTUq#sobgfHe(TU&!61g8geQ$b7Cmb>7!Sbe=P@g8}4Ky;<*Ri)dYuv54Ly{Ox(5w|b*tQx{eB;)q|B z{EAw-h|UuSxC%f|mUZ`u^A|DqlmTu+FeBHY&yYW`{v!( zFgwWO{Wnlj%P&9)?DSkx#pC8IsGM^becgpV(mr1hqeY`WKp$OV}uaL5VP%djIpKz6JysP$i>t1{) z3ULy#ppvRA2%VR{D>&4c1IDZY;25{w_WA9D1?B`)Rh0vl&7?=~!uqI#L92a)1xBsrv0P@{eEVWoA490LDgmsf2l5M-HsGVih~vH{{$uV6 zZ#@=NcL>dZ&37{Lm^$m;o?f~vwnfOxFQ*%d2-Fa<_@0N0KBdnv6%kN%tr9_#h%dQM z6Pf!-&gZyZW3%2zc432gt7|;VUSU6qA_ize6?V}#*=dY=@p4ToBNiCjz$-ZA*MEsq zjKRd!Gk(K~cRpsF=&k|P*y$f-#vV`@(@hP`&hw4_wpoZ8BC+?a6U9^S?~yK>>F8x=WjBSSF^XrjJTZO-)S& z)h15I8?V2|4KWu$l~#83Ze6v4BGfvV+JbRn$V!WCt4CtHajD;5oodB{immLLq-B`sTE|=rd~a1+^s`PTY(CT@AqjOg+O%sHH2~W zZc2LAj8L*Hr(Ayd;Ww!Oe}Bvgn{7|1th6P^K{0kDM=%a&;AhJ3)tXSMINqnr9<3ZZ zKp~D@7W?6HJD%!CK(zxlVU#pKLb>wEDhY8?=RhHH)a>RLpkOtQ7kkw`fYGf&S16}(_pD_!>0@sw+>Rd>*FnJ0HEbno^G|EVWAf#& zY8-pio3gU9vaJ39bT*Vx&u-ZpaF9rb6oE}9zVhg}@R}^(C#qoAj zR8-WBF#tF{qp0Wo0BFyPq8>5>V16Kqx|ZS=MZG>80Jot#U$LDhA-6lTp(VqJ*36=UB?SO03-dTXVl_v=f>%m>l* zH`@iumDS>~n-dKswL3dn1!qXfU)&*o<}J115_EAm+b{Ix!x5U`2ONL;@^Vi$^j1H8 zcBLDSunb9kai%ky5lrtFIztiaANkx|sj8pwc*B~UiUoNJv8dE4bPN{1JiffE8B1ev%BkfYOuz_(Pa4o+=xCtbYU;G+tiNa#OdAEsAdyP}Xl^>7 zxAW7P$BWffbC!3JcES@$rR!(Yr7M8JB`y}5ZztZmTsj7NqmDk$x!0619dY8t^NXz* zLED^7hs#mGk`Lz&9z1qGsjGBmm%dd~?(gFP`o|CG?R;q-obE%Y&{kf*qs*ZBncNU~GY>tsx5#+iMe?J~uYKrjJmhc=XNr zas!(?sr&cj9k;~JEWkf^E@w)*t7=d9lWm>^K%>l?C!?=6WsT2{IUEt0K1Z}5?Z)Y- z=*F6}l5d{4bF~!|(bQJ~m$&Kw9h17Soz6}hR7{^yGZoL!+vA-D@&fbehffXH2S#lI z1i>4$x<#n=824|tNguFA#hpqBDCVgPm%jp%SOK@psP>;Y+qex`glJ=ElUouSt6_Xwm4eBFo+%~~s_ zFINVc6R5jm?*y2+@}&@Xm_o9S2LSCuo^()*fA`~BPjfaP2fTg3Rbabg2%p{JTwG5= zwPjGT(xYL>qC=INM42fkeJ->XvOuMu;Ng)fa5y_bV1DQBe0Qj}bkA3MLW}hnz_T}@ zoT#%1v>5Hp*XlHGY#R{(`$3b2IP)YJ zbQwFTzas%nzp>-Hm;q`X#*OP{4BZ}{rb{vo_YWM*1JJ9js!i*k(>V%(=>FeerD63! zC1qdgrE8=0LZ93Xe>5BLy_9_U-nAB@heu$v=l-RLXOVj1F^{f?rEW08^rY}>PYw!Q zqUJQbQTlk}k~}9sD{H>0O|#uuTm z;u4*QN8n%F!OCXjn?4S=*4o=lkMh#ZSZQlBEz8O!YK~Tm=qbiFuSNrH^XjYG)VmpJ zrx0|GCO5C~Naq3G4=E&-xf@ z8L(ZV<_N7L27)+tO_z1%GD~%3l8nR)K27E+f<9$CbmfQV-h>B$Fl<3>=B!OX-J?Z| z7A+dvimDZ90Fs|?-@bi&!L7hotw0q}T>H)46ZK;(r~BQ4f&;y@(IKTU|6pHnW$65* zP5sOOsIDxL5nONO_$mO0jHKqM>XD~3W!5P1gC_uX(6@~E`1qvwRmSkjeivqth*mOWQr`q)Pb(|Zf2 zBMV!<~#(Jj5Q8w#9}qNA7Ver8L%o?BZYYB zwa8Um)f=df$;;i^QiEVFVS{BEALeL5eoZf|T=US9lGqdg+~U>{UfF{I!1u)jS#&D& zuA-y2l^M6E7sm`dR?<~CBO|o`mh?gD5079+>4JWXV}6dcy%asE-`4bjrjKur8?dP? zKnkLL#=ACz3JwGfB0rbpf}eN!j@r0L$xqR&hi(KEz`a3+@kA7u?+k^S$q0g!O!Qh~srE zui)k&Etb!PyyBbvdCoUx2&}I317LYR!W^nNfXIJqL}C(S-`o?Z33*mubInTa;#qyL zgEEFRY}lyRm3$vaAVh;+4U$6RdRFL|8|h9qtKP3{t8=tq&FJILS`so*jIujb!Ihm{ zTc4XQr~>x4FclW%(5)+9Mvk{;@;SqkTY(+)Ju5lwzc=T)3E-8zbHIQh^W$$CO3|~V z2Vk7BhSRCg8y(U{abPyZkE3*K{AtHPBA4+unxhI0zZ_C=TmN2PHte47FDzev@XI^_ zJ18^AtM#Vz@gl%0`^k+PH!g;_vZUCW+u6s*=jtte%7jceD0bP6`!JY+%)(=*t5-$G z4+~V>c8~_LQQ!0I=+UFclftaoL5WQP{2e85>jc|2qd(9 zG1^$i_31u=|EtdGjqYzU*YA@uh$EBOVnuN7v8Rl{z4vmc7NIx@^*))YT2RRoMqO2> z2sgiVl?2=HTnnkjWi*t)UXU7oIO#@9)QgRt!5f?yb|!wiDHPV>r{1zci=^T$UOFtr zz|!yxDR|m}rQ*>cM@iFI*aZ^37dtneU`|2%CGHl}8&>9fP7=gj=B}LL0Pq4=3|x{czi-mx=h!knQ?NQf&+Ml&J8>jVgqL*K2$%IAo*o; zK)2Nk6rPH86|r<(o3{;M>UJ&MjW~>^q^g#!s{(Go_V~gdBvbz?PCnRIgC0Cz+qy}6 zWv4UmS>e%zV@EUg{Qb{!*IUrSJ?)GSm+ABj>SFAdna-ZF$c{!r0*oy%@HtZ!VMYi2 z&1Fv)yNMW#ZQSQ(D8KFqZ|=Lznk+Cop+5Q34iOEY)-CScyN7lFEFY9ocN+lc^0bsX zfe&CoK`FHn; zR=bPppy`ZDd=oLso(;w(EC+@arp_>~b7r`q_`xJA0?ckU>dxDPmUYbRkAFPl$p_&0yQG@6Etzd)r?dX!b`BKf;!g*R>sW=n z>>@LMP|;~qC`{c0Z>EdtR?W@tDYJTsu}xTtgK)k5)Lr%CTrI(Zx6}EMt>0!71_F0f z$vTe8$94HL-ZO)!`O$wJWd#`rU4YnCEvzvNN zO1+m?*nefWGd4QzT03@7*`ZtUxhuu64^4`G6c(s?=v`rqAp_u0aYGdnjddhRR=mA1 zP=hw&dFi*VJ$SQ$2+Y5I;eg4Qm|GVfo@j_^g$E)cGD9?KQ2Lcl#ouyAKN{@b_4Z0} z(6@uF8*eCVB3k`ogln6#$@bon$6IijV92{ssvd97Q_t+)wr$(qRFe9qeyng-mn*@^lnSFvLi=J8m_V+gsfqCu0 zpAy%U0B`n_2GcU#2#B8Su0aX??(|o%Jy}!|Ho%+}l;a3AEa}-Kp#uRJJetQC)}OYk zdPIP$V`yk-SkK+v`=o?#nfpB2(j+uoAK+iuKm@*Q1OAMQ<^Tr9HJla)fE#n72IbHn z&A)?2%jMDeXUwJP&H_vlm_y_1Y1I!YwYHHY`QPI;J_68X#eHKy{Yqsw9ROBPQp0J9 zY5+HRe+|lc5`WF}Y^?^-!i;8>+27fx0d`>SAjZJAa5||s=rU;ZgbBU`fcj%6OqeiX zj1vHs?*wXpQvh0BCr~@71F#r0f$B|h89!mdgbAY@0C3w(p!PKepxb@Igb5SIv=`SJ zRiw^qE(T~b>Un3NkUtq=s1n2zWtKH&Moy zlO#!g90Wjoh@>XB0N@%;k|g=(q){!=)~B;PgrL&J>_*0fX?MR!g5~-2xq}Yoj^|DL z^6G_1#} z?cuvv@Cne0Fk79KI_K(2qGL)cfMvZXJujk%5Yuv&KFZ#2LDcAg5a}Bmsk0$6-~e1h z0l?EUHdJQ;0s~{V=CnQvgJ1z*i3DsgGXX&Fa8^5_mPcy3$b4G59cWvFQPmdfS||*w z_B!}`v5OH=1%`I8a^+U0?Wrb#WopWj36($m`HM!iFXjogG$wsTib6dkw}lKmA5P@T zPPAzrHYMm+*0rRu1m3XCrZNLD`1NI@S{I$zS{g>Ai*I_k3C%j((1+h(;orgR*ch(N zz}x(GG)pDGrj@wXNHo8!ABSEV7iU6xDOeL9Xvz*wMW>BxUlN&!*0mnym!h2@J>k4N z{pzB}6V;dPT%0 zoS*cn0@0lD`tmj`<%QCpGE~`mTB9~Azn8M*`h2JEU%1~-ownj-#YBxApN>!U^?G?{ z+Qg?ZuGpC$yJ%U~T{ZTaTN=Qo1cS~+dq-_5UW~3K&-YBc{htSb8)vG32`^QoDE;IG zRfeFFA#!Hg)j-iS{4PGQ z(abm>9&6@MbS;?%G>NLdaW(TjR2SE zi5fdDn?Mk~jRWW&JfOETk`M6TE-|?jBA^)fB}J?mXwO5}lE#4jv&jG^73kEdag6S) z&>E%<{R^EPJ9PoG%auef1)#aPy*Ommd%gEc}O+?6|V}cS2U|F zYV&6Tp%^+>46musp8U8teZ5_$tnv?=b&WS?zlj~GMj;GmK7I3aj5?fN_CH*Zzd@bh zWH>N)ilNz}&yv_vvIgnvjd>M>ouz~Ij8;9f=kGfyrWh~0?5=AV9OEk0wkYt;wFw!u zu9#3;DFUbL%T_fMXb}^CdPYMLD082Q0rYs~68Nf> zPuc2@9Xrj->FSg>96;(ph7&sK{FSVCWEFuU;4RRS*rI4Wk=e;_J!C`9d24_2xPgwO!!O zdbeJW&2TKush@X?QA5Gf(BTV>*Jm`NOnYwwu&3oY1iot3B)`A9n!1UNNI|q9r_&@P zx-w$KM%i#i&Cvi@Toz>PT{f!L2nGk9Jl)Y5X2u|GXK*jF1h7vMVf9W%U<8qjiVYXKS!8Qa5xfYl%qa2 zwdcc$jN=yGg*n#$Cl_ypH8Ag0gIbdlnd1;CpQ5@iCd1dx8Wum1%W|BucDWB9Aet=L zu%HP6!=54Q=lhD`Fw|m?Pkbcm%-{i9`fI2t*>0h|Lmkg#v;Qh(tVq!{>-ZJc1_@uv9|&zZ)Z! z(2T<<{R>?ggV4|TE@}(OJPo5(QEN5*bNm6` zzAJ{xox!s)641NE@~?z*ui6IX&reyY<9a+L@l7+Z8%8B%{`bPmCpRSSxIv36iJ1qr zG3L&^hnW{z?tL8Jg{unE_UjC(TrUo`!Yr!HU-Hqq!;^2w7YuYH=^ z{k4Y#k=Mjkhi|@JtLdLo58!PLH=~zFY%gUZdD5Uw3C0ricO>!t${~D@;4;M;aGthumIoU~LEapQd-oDTzhCgmu4({WrY#*fwTL+cbN@Ws z;=`7W)|L}SfWxhcMjx-vr#AO5ZV4bD$nU|GrBlbx9t1 zeqwrRdk*1~wN}&r{R|%LQbV}(VnAlOY6{M_Xa}df72Uf#ao`fWt$X+O1`^U|b?;;e z1Z5in!?FbcB37APoXGWv>kgln%>bAjxNxCl8OFpq!07M-0a~WFu6~)#K6Nkc8B?c3 z?C7CW6%8(DJbU)+*+NRMXVlo<05ldqqh9s^V0-u(b)P1HX7`^_XHW(|quvixR%S`n z<^xHR%L&F-E5Ax3I-BgOXMa6Lnx4-m8R-YT2*kcDSAD1Z@0mk5mn2E@ zd*&)L;_u*aJ8M>G){lvTZkbo6%*cv%W{rGzaQwyBtw+5-IW8pa>sn3!iu^T`V&k1* zd%L?5M|4Z_a?0xns!Qw$RNCiJV^Af%)B_N=%I13MvnRnKN$e-<937*pb!?+KpG$Kx zGnhN;)#v0M8Zu!~>P2KwCG^ao#`K~r%Aj77a43ViS5gLbx`YhsJ&M4=n5}f=7fMWz zfAr|lvp=N7ujkTaAYOLU4seN*rumCWy1Keu3tLvEcmB46uCBw)ZH{TP0Sqak-H*b` zU!^~iGVrg3}qBECJj2;Yu8PPE@_Bb9&hw@W>5lezu#FlbyOGkHXf_i>l7C8=rrBqo0ic z%&paUaq_EB9U1U_Z2+*@V8r?{XWUuJ#>4aHuUx-={dz=nbo7(ol742C%0MGD%my$x zB29<R4J=>e#T^W(nUO zEN~|vhf)|GvZGO>$9dGS{)D5*kfY1E4;B#fmXp1m1E7 z`aNl8HQgLQgB2@!_iuy7qxGQH)0YFQ$u`w0;ez4?nqYjwD)Ob@Us)U}3}g`KZFoCH z36awO14&k7EpMWU^D^KBJqzTp0-nzot&DL5_GS3iOIrb;!*&bjJ4=LUoN!oo{e64D zd`&;iTh|T1-}qK8WGt9VlH~8`N$z~er4(vjpmA$*qVgbzqY~X9oDt~^d9NlozYVj2 zB5eNQoX%fxM}7%WXA(HvFSb-_D)JV%s{t~B)v2d*=0Ey2U)1C4`LRcmGJHA13J;E6 zoE|6CJ^FgZ)SE?zbzJT|m_77%Rxcvp{ly7~^546n*BwK~NDHzQKu$HBH6+nnxzpK} z`Zy)bk5}D_ER#)Weh)$+5L;e${tM%?aSg$!#Lze6l^DNA6Aam)%7ieTn|f<*)O?|M z;_w3!7Ko4Y762HL1p zCK8=*&liH$Y8Ooyfo-CTN=@f9R=xsX$;Dx=Trs86b)w8jCa=kgEk{b-GZF1d}(a?DFZZ-t66xu1*=qWRdSVthxKW<@0gk%9 zp`M5Zo~}UKK!-y&29!=&uikV@`CW9V+ue8(71{ZFTxp_O&ho;f}Dmj|=Vv zaA2}3JvVKYj0+QC0_-tCtu1JqOtjAp-`;o0rQ?Y;qS*Dmz#xF~m#$nD$R zsU3FbjX-ebhz`N812xwb@9#1`Gd-m9f|uhkBCk=0#7k{76xoa9nw`c)qyNS|>gK?1 z`(nLCJBoJn8u&QEoVz1ycE=exgI(?%@78g3&Sakd_q$WN?#=6^T7ZtPTA|ykK5Xdq za%92u%pq;JPqX;2d$t@0n>Zt=uvXJQ-5ucVxMo7H=0(G6%k)E@P{ZN<-vZhQdn9jeE^sh+^3>uOxix8IB?KB6T6#7# z1T@^lj!j&(2teJjaU)X>z%p#m$Yzm35Qkj10R)a#;>tW<4Pk@7>&CdeQ6f0qS*z)v z*OdkBh(l_$;!P>)QOo6QHAI zIrSIN;$fsx;YhBejm_0B1+jKf=dUGrw>We^;n|%YToms(9hbG=9)4LhqapizpnT- zn3dTRwAQ$o*sOL((@DLm%&w)al~Dg^_PuL|B5xa3hW6Kzqhc>MmjP!{?nRp(1ubYI zV~%rUp-d*f*QZ6703}V>GkHr3yX2SwZOt~{?$NC0-3u0Y|8%a;$Y=Y+epxX=-g9$i z@dhNX^$j?4%>jGUhPIqg#z=(Er2#zYM1ya|M8_U*5mknICm-LB+h*A4O2)k_M_xrqpZMs8g2J?&h*V|Zpkvo(CjwrxyoPi#Ax*tTtZV%whBwr$%szdYxhS6}_> zeeL$HRlTdbR_o8I!jWIDSK#EBlgoi;sG5!cjhCQk*~}Pi_C)T3nC?#k+3jnursU3p zpNfhK@%eM#GQ;sA{C$AsSgSz+&o-Si41P>Vl4tJKk>rHP1>y9>Xi~qK4#}_HumC=> z?)10>QKG}IW*hl7Dg4#?sp(=(3f_r<_C#Ufx?%7|tz$h@4*kl?ckoLt8KdbG1T>>x zUu9^|ZUtH03O*FDVg((l@|lX@SG3P-Br~L~h6)e1lQX|XKMvG07n>Yg6HCBM{<5lA z6W{^>XFzeCYDd96H9N_f$A4fyr4qfAEg+32jZEQ!Nh>k8h2vCgzujNARJufB3~pV= zQ%7boH9pqmxR=Ob$jnmBWSWOO-U|YJ52jm$zwLEYmbBMwI*at`0q}I19>?oIYC9&V zPA5^$3QfQ+ft(D<%`RTN%JDO9Q)|hu=67VXxEh`wAI;YaN8?O?{GW%T%-zf}7geLw z-d{@+;F;M7{otiCG%ItSZgbAm(5`Ry(Va`E@o#62IW}jk*P}f4{Qd+pO}S+>PR@zE zp?i%(G>yu3`{!J6`CLSFgnUs)InEDjO9ndo^iR*uSdSUfkY@l1~kLi0OX6Z&1t8cCh z2fjUhKVJe1*UQ#j zn%}Cz;KL)u^zlv8&Dbo8&rm< zMz6$w{>*FL5(@+jZA49Y4lfnI?rv^6N|X_W+>CQMaUb?N;hD*GBxE|67P8SS@kqvQ zBq|~h*``6_G6JfsNgvDD0VUj|kHvI=Zshp35T@|LE_`TyTY3o@8`vJ!kiw7(AhYjm zQi(dRU&eG2K9lW@Gyjso0g=P|;fo6_4UOD~5|mJ{_L1_KmPDPVXsFM?dJaN@^8;5j zgoI+<#;@;tdwX?!+Orqt$NsGvi_n5KT`=2Q0K$cf&CDnkJk}eNtk#M^@ST*!lI)7A zRKP$oT{XI(-%PDz{an*=FJ<^&(mI*V(kBCe7Y=(l9FCucH+wmw$aJ)ZE)HOLBHDri zn6UI%w9y1e-qoc5TM>3+BlA*bF>DRTT=OvQ;5hNmP^DZmzbz{a(FAOo%!3Onf}Jm8 z?4E-!Bf-Tg!DEIA?2+Ruc#|Ne?v}SBUxfzIJbMMBUn3j;0TT>TwO|FhJ#xvYphO9x3N&X=~ z=4e6vR0Z4oW0}kMb=Ar00;p6K9h_vcdEV)MhE$j@cV|B);Px$#MRLD1dp^AEy{xPRPl*CuNq|};3tF$d z6|JnSW(^}#QQ|-%FTbJ;jTM?l4h~-Fsx+HzE=j%WA^AyKTWNc3IzE>Up}=c-R)KoDIB&Es z8~2w)huZ>>Ylp*w3Z%;nfN0ysrHEDMXosXa>O;}6?-N$Q$1@Znh6rs5G zgk+_Y6oPeIm6F+UGRRsQc&HYfjS3pVgIT-zS-Tk(_2mhw9*gf?M0&t!jvg5+ zo~&J%;o-Wa*Ivo*{&GGJZBDlKtrt1@Z_n(5gyeP|5i^&|UmO4lO$J z50pkRt;{S9yy?_55$^3Bwd$ti8&FegB9?CT zfLzGsD*bE(Xk35lsueC})leUCjg}cKchRvwTO``u?{?)MXMjlj}irG#EGGl#H6i}89P||4uF|1a<9JzCLw6uFHAFpx- zo#E|<#^tlFt`7Q&iv;$!l73eo$&JPE(;?w*dtUxaLhx;Y)xU%({k3vi!y?#kMJkhr zn=HCwY-_N)II7{BbVap$aC~xd;wkcX%hd#l|8s)M?9<1`+1NK&>jUXaCerzwJR|>e zoQ}z@70v9~N;K!+Al!kOuJ9w-akaX@!guEf{YH1?0do|?akb*Y>*GZ?GHu&AWGcPmAVRAtDZiW zd|x<<2*A;K0o>0l@n>5H&fLz_T3u35itWm#arN`od!jUE6)v~+O=OOQ-RIp>LeABK z=%IISAyY*#_BZ4GI~Hvyrd!)6c2HDR6}tM|g$?7+I+8;QZktJz~O-f>fc zsNvI2x+ElbKE?Q>+uvmy1R@X?Xg)0zURoJqh~^OF^4ZJ|hxWIFQz>IE`|*oK4P(Kq zRR%3$?GUaRvk-wszbmfpA$*V9(QT5?IiB%g+LOLsv}k)tNt>qR8W#9^hGPpH6Y|+T zyAD&|W>rt{KL79qc!&LLwcVv9%K&gTR$%R0zm~$jnon(5<|Hs63kIg8Z{!hfhITyn zcvIG@0A`(K!bgM?_?>t{PD`mG8?qRqYEA(l>ssGQDD*p@t2i6``c)0~+KauvR20Nt zQPcfbx@ZNlnLmCUZ``shM^*JsjU#9Y+Tq%nT5?d@zr0%w~;{6=uukI}DdMt}q z3$c06^3H(L(}iIglV0Efe2+r*Zk-l$Oz>sRqX`~EVS2^{w#(G3Vcs|MJidq;uJ;uB z>mnV_?4j+eC$a96@@x}(*c_1^((JbMpVQFaeXiJdT+yvIf8FaN;<;X_J8ie?m1LD=6!^1n)2pEhH_E)<@4W*Y`I z+cG%&^F)HV{rzM4#T0F-YJjQShi5+D6z1n^+ZuXyeWBuyMX;PN>gIeN+7jM5u${NI z%r*sBy@wJ93tMzQq3*Hq@$qlw;)6t`f(9TK@AvoN_MmJnN|{Qw)v{>F;9cAdjFIZu z9Sw(GyhM}hhq_2vFJB4@F=6ZvKx9IN)Nj9@ zJ-WduTRtU^5BdtGl|@fUi@VLmR;_``2JYMPT3H$v5*;AI4j`4{G{Jg5KPke{m9y9L zjSebxP4u8g4icj)X95ILBI$WeFLfCT6ZrOBFnMf`=jAxnJj)6^sG{EspgCW75@@-> z%J+cGoFRErQtzK2Mq9ea9OCI|uk$0%%2`hAyDKww(6*V?aQGi#c2e2kPB@KN_TjHl zW;Ox>&nlFK`*{mQ=RL!6;FbF<%!(A(RB)_xY}MY`0~aGf+P+O{-8?34zCWLR&5_vg zI6eP_0c){Qj7VkqsLl(P;{DPgT6o0=2yY6NCQJZfMnmPn?}OB8q9P+B*VW+_8ACc( za|0fKPPRi00i?-;vn?no9 z*@1T6{C-yTAZEIv@uYvcqL@Mp(VrmnoKg$PTR_ZG`4ww!&OC0~27TLk2gU`6*l;kP zSdDYzcn#12|FS?-a`F%P8y7))*c@^-pa3_txTPjEfISa*<=+u8Ad9LXfZ-K?i&2Q4 zW~bbAWB@kz@-F5RSy>GLI$`~F_c;x>ZAA>s|5nB}*&W51^}^wbohX+dYB?-llx0@u z*@WpH2~StMxwL?Y>!XPPC|DA-tF2G~#-&DWxG@c3Aiqu|zYU8QEOa4PFIZEjxg>b& z3d8z`FYt)bHS64D;%fsRdij0dLW6@8pCyR+V4C_$f!*+#UTCo3{t=WGyCaoe9`fP| zLxYJxOk3zjvMMxOvV(xX&}Csh{bS_g&3mjn?cbj+*V!BQ7o!=oR!i6P@MRUL=~j`Q z4K(8BE8tMNqzL)s_P#WGxgslB7FE&4KSu2fu%SDvmtco=b#)XZURA51lO-lZDzGD# z4unGtPPsU_xw+SyM~I7PtPGAXexy*WR32*^zP?I-Ugw5^@kcBkPN9EI!L}!)rlw*x zFZh9@2UhB@iy{2}IA8n6b&#+S5w-=E)Om&_A?dZ4r34l?? zwJS)pT4k2a)FK0Zc*--d{m@4*qhBpcC1)Xcr{Z6#tj+3~)}bHfZR8J&LB{(b+K(L0 zg4B&l`pOU+sqz`ZBFrcrm)ets3G0Qo0>q+0^2Bq?Mh(MR7pdI$K>9qsv81k&VKipO zQj35K@`y~++J9o3X{npC@ugx`ikH0BY8#?fnC#tIQ*C&2M496!Q547a0}D`oK62vF zt1lI-KW6mxe>me-h`TC+982_E9RWB%;Z+MRNb-NKPrG$x)5iuF9^#2^97{~06uBuYW=4Wx0?TRjz;n7qxc*fnY#SY-r0Vx zi5@>DmhC49)!)fuPiwG^w5u7*g;7fi z{%K#)AKA!?vG}6gZ`Pd3aw|4+D^taQ29uoM3q+UNgO#6)$LJ4xeK-niIE4ZTiy&?8f+LtHe{HRSbXM~aaei$DdV zRFIVML-FkUEYeZi>EZKQGrf1({TsT?uh!Xf68!f-4rRMD`L!BtNZEgE;gi4Xr;CgY z?v@JZDUdN=&z{=2-GRpMud1rrAhRb}(c^v?w|qTV6fb0CYp|nd<>uMcJ@{g_-3Wan zyFd$CFu3Usy>Vc_gDMw~>%ni|j2plw=EUkzk?CKW3p1yl#YfT9fTc)3b&AQ`XF!u- zZD5TG`VCiKhu?3Tv}OW$D%eWlIyDrPQ`6$&?B4GV$IE=hE!@{qDX~9v`U54#Y-q!# zgVLO7;6c}t#3i{*ASadd*>>oo%&lH5Dj@f~3vg{|k@LpHxyb1&sW5SWR~FRMk6~@} zwg##v4z{}VWIhK@P6eL|c~6pPMkWSZO+>j0FV-!#On}bU>vntp;Dg~v$DO3O!{J=) zPe{i56WIiQ-Ln^$A}A)dWRWkII-%B!tZLBZl#GX#3VQDPsMHT><4-9$U6}~hP-(Bo`Xpj3W^dP`p{R5M$jbuK?-9Za+SFn)Ao}2 zJ}MtZh*FF$#Vm(?V!*IkVCQ^*c2;J<9q@u6ow{9tOKwC}3ac@t&M-;Ik8`duPZRr> zv1*3%ek{YD~!6Cj2 zl#Ogpu_Y4dwiAASm6POWyp5RvxCuiaYDYh6gYT0uSF(~Nx*ON3M|UWa2?ESS%Va#qg2c?11)x z1!?0J{6YKKxgU)5?DI+l$rQ!ObCu&~aky1~CQ7dK>jFk(#s%brBU_=<>vV94gVut) zK`Lt$YRir4UKT{(vzY7FRm$b?dUIvajbQ+}5k{Y`cY2q)e2LHk!Dftux>IYIqx>*A z8oHY?8a{Xz9*C`BAbu z6{dFJM)5{|cDZe#rM=i!cn#{oTLNub1G)Ly%(zfdZLe*i4u%Cnsn^+GsDIr~!^@~t z9ZDp?s^`uH&$Hhzg%}Q6E`&$Bm&BNe58g?*wYbZD=`%Y`b+Nuer3YE+(!|LJ-V6&@yhY3C@Ed@CZd+H zdDfbnx3M=W(uF9sU|kR^VqxH#gZHc5Jc0@Jv;<`8i^V)9SIVVzmw0{hLo9j-c( zL;<ECLS+( z*=)N?iRlI-!O}@F84M^%`w?@P<^pJoAsawAJ$4r=^*dWb}*soK~;%-BN)hl`behN0Yb z%3~qPGV(m1W5rY`8v?ssQ4j&NfBhuWjE@YNMG6QW$HK`$Q{+K|)MKZ;#%e6ULwq-i z%G4K@d@{k)xolmPK&4CThB^PBT8*pX(%f^tB3ZByc^qgzBQfEsMJk1Y(4|PxJu@Fu zg2xCnCy=qHBeVFwHFPw%XJdmpLg9+m)TpHdYTN4j_$(CNL*MRIr3?~1a^_a0e{aUd zLfivIad>B2NdEE6ZWF-s8}+|mm<0w@#b%W>8318=9`UHe)*bRVCt(B51CPu4UjV={ zIo-(jT>pT2LD7zrzM#?I_$MhIUd0rNe8yH!Dg=J$9x`s(Jskm7Z?T13ipUZc<@kX2 zWm4x7Y(M=R@iRg;zu(>B<(!9D65gdCxxJe4Z91TO9~gJe7a!nW3_Io5g>&D(gEqGy_ls$2oVtR2^;y z-%LLBcg?rg4Z7uC1n;p=K*}jvM&EOCmwa75avx*ghTq(Gj)#0teDb;rId^=kzIg9N z?r~pvpMhV;uitKRuQ^wI2c9cmoo7HF6|dKyzE*PYTO-}O-XeS{-vtkw-z8tyyE#wm zPq90$kJn!%$KN9mxe!Wxir@X;vR66p+lOlTyaL_=m(w*m{BO4l?}vO=e1_-!&)aw1 zhP?3~mEYV87>l~+Jd(a+?}WEC3p~BvQ}3}KzRg8Jw;Vmj3H zZp_b2+gT*L!o`>2i+!K4$YAoCAwE-_2Vt%Mu3&>P*7pCc=;PS}QUuk1UGjgIEbq2| zb9nrJ^88l=76>^@GSq{ztp~-1h$9XE{;!s-hQ_Lv82wM_|I^f%rJRk0g^T}PId_bJ zpPjhzYv_CUjF7hO^){G)?B$}q1btqT`6h}xt=P+8rDPQ1pvk^HVc{p1edE$hh5gnTwJ8#PvdRQX9Ngmo0Ix5{LrSN_- zGy1&h1K(vV_*AJ>FMZ@VSGO`IV5TzJ;!#I{MXOdVm`9jGw~@cs*g^--eaqT#ht%<1 zv8(qFL=f?cftbGjL1+ca--!wP5fOP3^!fKLt9Gch6Z_G&d;Yti z+b*HPMEzjMmFd)PMvKyVcfPT%YqnK#YN<;c3Y|h*eUvBA6Q1dT+m}$mHhhzQLNtw? zkHd3f@jH}yr%C#%5t1uR1`fWz1b~O~Gm0Z;*F3T9Y$kmhHhP0mp*3oGnG<=bm!T?CZ8> z?}*ZTm5hnvmxc2LTGg?fH2t`Iz|%6@*dTFNBl}O|)tkSLWuSwiz|)?>6vcoTlwx_{ zt$Sc8ooMN4>er7&-4Wlli&gCQbti0b1U%45uM=r#^^}32CMeRjqo>WpUfkxq8-SyGW04yA`hoHSsB$0n3ks&Phk%A8P+(-~hE$!Ga!ronTc-P#kwZCbf zsjUVPqW@Ys;2RMzgXS#2=@~f;kAI#0YfiFVhukH=Gx%Tn{6D%IaDqdg;kRdS5w$wL zVWWo^@U3$JSwerIL63n}(-57Nk{rQbWhXa68{~s zvv3jVi>I(3fE(I(Mg1xAKQQQf0icoR!~;8~y&G^1D!Zev)EC7l^^UGywMWV4Mp9q4 z%?D?q2zd3pON}&^Wq`=57%JNTndCRT3afz)YIgdXtz1kHfYxS1;YubquQo8j_00jd zgrrf=-*-+J9|p6vU+-BzC!wTI@gWE)i;luS2>3MQ2P+|WWC8rmqRFfzA|An`$EgngKng705 z@2Lfo);8ANX}?N01YUUf>A`&eM!e*{*SmX4q|%>XaCRZIVW@-z^?n=pPtWE3S-gr@ zZ&b-v{s;5d6zTsL*0VS)2&lv8WYcQdlZ2B!_|jlMN!QaZc>09a%!{ob*Qj!IAN)6F z|8($w+nrJ)AK3BE&e;dY1!A4VKW4p`OrR_1KQGlII?xmSg2x|Hc@x5Hh}$rZM;lB9 z{T~CB{a*_9UslRwz*~x#TGpzY8Bx&>V}jWr`y@${11h?Dq-nqfAZG(Z=XJCFB*FFD z)JWhVn(k4=fj#l!~^=P2&e(%qPZmPNi!#ggzeYdP@6hV7N8vLg3@^ z1Fkau7idt&qlVlej2O&SGGp100Cxs}R^iTcU}&H!eO{@PtkT#KcLAx0-#%*98EIf& zeuL8q;6;KC)wD4u8*@hi2(3;-iZFi`Y=YJMnTOG+q`y6Eo7-I9x6`9Kq#>@3STo;~ zNOk)4_5j-cm2JVO)v-{3wl6Uw&7ncNeQjIB)Ls=W#SDa@LJEhyPm;NO&u?fyL0V{} z;&PBW=sC$um;hnEE#B}0Zy)YPgnQZNG*H#=L`pV?!QOCQ_(pzT&{4iXglIMz`$V!& z(*JUnZyi<0L--nO8xmj78t<&5*E-m4>`6p%UU+2eZe*9y?w{HZ*f&XUFFtWc5$AN_Hb!c@3%9KD{z<-D)&?kG51NTx@iVguf&4qXcGA?c zsZzY+#Tqbr(>4k3BmWynG~8#@$OA?(Nu-cVvaY@fHbNymSo1*d&FsHeFFEoNv|%zy z>#v#BCIZg<*~oht^5qE)P0qSH3Rxe`PkkwANG>-vG*GA~ntLSbIsLP62QifJ?AR*~ z#5X@ZaINcX>cNrh= zLn8YxCo=`fqZ`N_C(9ZQ#bG`Uv+=>b@mG`zs$GSjJjsORJpF~^D(EG_08-n$^>xmK zQ>b}PZv~H`?o@f0_W@SYxluzS@oOK|S5^@RAIFo~5BEdVJZSry)TJ8OpPh4W0m&dI zE29uwV|zk91rN(8jTwDdOBR}kN1#n-2BNL@`t}8nv+sd?%QT;3BPf44dC*}qDR?A7 zL{m$f*`;f!xtcOTYQI>Y72v4F_4i#aC2E=!0M)c*#aUTQo}|6woS51wqjkl?bF`HP z)NKSz&}YyP;DWhX+E$@*h2as6AZMQ>?jqu$ywuKIu_&mL=q=29ZJ(*7$@_GS30u7K zI~otGBcr!vv>HSyXz0-!#dHRfJTQ9u@dA&4YBw8k-uJ#PY`F-D+fnfc2B zWQf9&vanP+G-eN0nlV-l-mWTiQ^>-eXWu>)lXe8=C_xA7R8Nsw^w%+gomdBmpoX=> zqW1HcR=lAkeMcc71|oB*2cIMxh1FS_G+=$yIoDPFQ)#UVC{p9+jzgRu~+4N0^5QS1{# z@xP2k{?T!cOKOW_cY9i1j-e{7^mqBs?8{gP!%3?f)3|ru2~1f>?}xAx)wW-H^PYfX z!j~8KZoF(KCzGmyQH~ngOmYgg<1s%i2%L)ZHz}R=VsF=*2*ZZ&E+A+?OK8;eYXTgM#T30@Is;=KG^;l)>pgV z&+E6Xm_siHd`R!fqu%FD%dYmaqdBtxwGLaYzLe>w_bYn0z^i^{^DAt7`%<00M5#lF zJ%;a^X8ncwBSqXi<;nNk;)+3^S4J-LxTN0Reny3jOXcT^gG4nc4uCq65AiHH`TGLP z>$t-1Dq$^gsZRk{TBD=+hpmBk8<+~ZlLQx?BKP==i|sN!R%jbErX< z-?hrnHk7h^y2Aq)E|Y5hzBFca?#C&>$Ua_`dWtQRUI~9a&bAm5-^m;EhRX5%8?zMC zs`{7f+O-gHqyk(5N{N=#oIZC_Nj4(9QYjqwyH)d79*C!U4)FvT1-q96L$Z(XH_;YJF7KN*7gj$NmQw99w{r&(g=I^~55$CDh)DqV|ac7JU z?rQv9UAueI^7w&Ql)362!0;#mgb-MZuItw_q(l6E+aNehQlIiO_3@IIF0Y{I@Cbf; z3mRj6*RO6Pk1}(z=d@mh(QD=3*7e)fn|uoZTENMsgva|LW0e+%D=&$dEagRODj~kO z+!DU6$&)x-Bg%=nitx46aA4$0Zkf6?-jeYysdSQB)Y%tZ1mPX?h%Y{?G-FVN zGkM5XJ`=VR7D)InPLO7DiJvogRQeKjS+@%5yyxOf1xd76F=-+0kKDjzhXKcPkXUFx2_lv`V=MwVZ1nJ9J}*vCO->~ILJo_N(2Nc z90jA|lg>cG$HGk*|+SCU3E_EVnXpRZ9$)yoa0( zJCDkzZyszpemWIe%vf2->vwizK30~06?@j0$ia1l3z-b{Te!8k?=xx5PWB04vS9AD zj?|uYwmw|am1r!@kotq4c8u#*77zq$Tnd!K0eoVb+T&#*)&OYmh*)2}lzDTycJ8cJ zN^AqMk+)y_j>ucadf$X_;ddFOKHag5eR~x8oU+%TOf%obj8AFaji9Z}Ps}|6 z?)}4B-lQQb2-k5{Q`Suj9zE!3WDstPN`()UgRF&!lpLqOnAzy#d**R)t0D+y=3sMh z{chxA1@E4pTOkBRRrwDZiCGSqdai12ns{)<{OrmU=^8Sqt+UFagDI;0AI`Z>$BJlz zGAp8URt956VV5?T)VpuZYU_ng&@JgioAm}1*`Ec3EHdRe`#%@>K#||a8~b8u^6Qs zYGLXw79pMW$Tsl)N7oZJYmFmfNX}+Tfa^Ih!F(ONiSHh(fIbU`M6L49`Nme_U(5J% zc4(aRTAt+cU;Mpzl)uWL&6=6I|0b>&{LXPN3rq)5+$6*? zwt0uX#($rcDj8wxVIvYC8Kyg=yn<%K-3-O`dE9XqjSq9y*C3x~OWzoCj~x%4q22!_ zJU$G+~mJDB*z7_jv06L+sv$1r zcCp*anS3w6ie*@lvQ-^ELfcyU;P%=%oPFablF&;z--cT!?K@$`hMoYqR z2O`XbjO=$Xo#1fWF?-#=(h%v8NemRPH|l67rOIpwF%a|niy2QgklbLB9o&9gg>RbW z0VFwoeDM9tm127^zyTSl=X`Vi`c#)?;`oK&&&Zp9r7a!jBTU6$ZDNr*g0dCEyu-YLA zq@GpzWfIThuExXLgu(CehvBkHXR}I&#>`(?cQ3?zc&f-N$m^g?BK0OfD6Zq?8FM;J zfVAl?kkYT2=k$DHkQxm66rllZWbh!5Y25FX=7uiD$agrX=-DdYNnNc?{MTh^SAF}B zD05C5S4I5JX2~%~ip%f@&35OxcNbsukj^-_$9o#1vfwuDm_J#1$B~n2hRhmt9U(Lr zwx8HG+qTC`Bkm60$C*)+RlZsGU$3;UgtGV@ravFG{q+!x)obvF!&fxpd@C77RX~G0 zDQaz2g|Q7xTy+u6E-=?How-n)fa(kbt!a@3J8Wyc^FKu5`|mAff7|I%9IjCHdkX{(-HN}6!g*8krf2o|v(972-amg(;R$du(+*?CDNR{rfb4Pe~A@vHu541~; zg64bg&>`2zQb|+KpRw(<&z~@2NHei!A;an}tPV_9KCH27KKnpC7_)?Hs zWBy34<0z(Cdo(b}3vPE>mq9!iU}fY)hOyX;;e%p3Tccx2TD4x$AaXDZ7Gd5)p2Ndg-6z2$uY=wiA`;$0XlJN&GFs}6rvG?;Um^tiHa>ZB z1J3UBb&p7`C)&TEZrxfWKsD?$YNE%MbaEh1TY0{J0~cQl1-^77OQD9{V2Z1&m5ciT zD&UlMWnYnqNW>#PgR~YkvhK5wS}yxT{Lu@6sou*_1BU39`F=%lF8!187fzdiF#ej~ z>6xG1*bM1J9cG2d(dX+9LY+XD zX zntkBt(Yj*%NCqU-aJc$AiX-3Gdx{hmj8+3&Pd9$WV(p5aS50Yt`fsEoRA9Ob^Jw~A}FZI#PU2r+5Pj6A` zCX?K@-Vw2#aVh)zH?mqiWhiUa@kl@{UEL zl*;6~rV_7~)SD&b2Gvp8(OU<9AUknwru5AFooB#j_a?3%bo<3G5=MEM$|+2{bBnh} znoVbC2i&Bh-Y0)rlbNd!8w*_JZZ|@l2h_;MF3+_?D<)7??K&-ngbdUL9$14^8I7&m zWXR+lb<6$5p(xSD$K}+|3XSoKPUSz2I4Td1lE`{RagmPX3o&6slX3k{&pTewmCx1H zw{}2d7qk2HTMLh{rJ*LmJUt5^Sr~D*Og>IjTVAjHp;dhPVJQL?y$LG6e4T{aiYM6c z;#~-eSMAMRS?gLE%b~87$hS8{3~LY8#9ST#PIzW%XiXd@yADfLCOjuNv1+8xzlGq{ ztW(QXrzKN50SE6?eiPzoy>4k>YE}KE4NBiF=#QSrPEfr|);(x~O4BA3a$u(Xgs7LY z5D&zn$gK~iv88Eeoy;H@*3dWA;5M*|`t|n&US^9DjkavwU9llhH!8}}W=urSLIk+I z?2koB7WLw#d%!eHH6O2$fx$Ykv48;{j62h+bu?~)!ecsTM_A6p+&bFP8+4!As}z5A z;4E#yz*a6)Es#mr3=t6Tjflfevv8z`qa>=;-Fh80UUzw-6JUEzy{hGHutEs;J4^>5%BvQe_y zyZH}{4#{3kitC=|qfzB<9+%UYi&Ye7&iqpYrOLdPVS5J%k{e7Gv2GsoE(pe1z_2|= z2$&w1Mc|ry6Kbo0q&xdbi?z9H9M9ZbRpYjVuC6XpX;6nnea&a_mXuK6_N-m0s`3uD zDB@u9D2-`2-Ii~a*a~&`=Yjb`P5P92YkcEIKKJR2tVzgejMfxduVQbFE0J{>*yC2TMKhuOEZ4kKt6dXJC zoAMksis&269OZwxWnY#A6@R62qI7^_La?Pll-9J0r|i*;mHp)~!0Q}gZ#x9&PmsxH zpm@M(fA_dMHS06PhjL|$$!3~A|H6GM3Yf0Y=`^cB^sq@`* ziK#g;sDI`9U6F-ki?7wOeZmMzHEy@Nf7nK8dT<1OLql(9-vNp|r+HpGDas*8n@mg~ z#x&hT>;NE{p8WFY??e^%P%=9WL4qCxn4fPu+YpAD-A*;8H6GP|FrlO`}r1{-Z|&5Q&t6np_bmA%6*SwsZ8RnM&HEGlNbF<(W3 zgKYt@wm;*pilKg9S^D(I3`*EJ6aL1^3>e+PqP%9lq~t14uA;dDlBcBGN6v9ss!Lzj zbb|MIN5D09(M`{tkcO+w91}GG%x|N+`*of(#X$4|V8VR@9F4;i3*2g}twh!^^0NYw zg-B#5LB?}~XYk7VntKO1=Mp5oGILn6{{@|!XDX&ODtG0hyn9QdXIdjcmz>g77u$IH zl^|?@&kirTkw7SWdzX*l)vVaYl7c+ZY_vKf;!Tg*%QvUX^&1iREFcD^{kg=%GriVw zc#V@HNUHDfZwugmbb68VH1vV7{z_Js>eP@bvmoD?oya-q;%nK$=f6^xDNsp3W_oAJ z5#-=fT>*rfK5y5d^6+twtr+oWmeMc^?z4nDo44^?m@0_%4LxbB%7a!Ga*b6o@+yvG zY$ah23rFbsLX%lRgt(j&#(zZ28jS#D4&#V2dW7r%HE`5(p@U8*^pc56RDEBtayB27 ze%j(=iZJB%F~e9@BVXh`-Js*kE{HjoK{F5j8Btnf&`NRNRW_t#xJ^-0@SoD~lIME` zp(R&dfq*#Qa%Vf4vTjXd2LN&MR3m4jS)M+`^bs{Bp&ViCO#ODXzo2aKV)!>LZJ(J@ zGopcCA2*5qV7t)LfPeYLweRH7I>fZjkTPk!v7ae}w_?dn(u)9BDEmh?5 zcJ{nJoyn~bKt?U`0v@$7fV?|ChI@ z{7j!Mf>(Oh{jJda^r45|EIH%Az|9f*V&Ah>Z5Hxf(MH+bca@xz3dD8vxxg6-UNT`j zXISXCG3OiTTNN6{u`4z!z4xaeu;Z>R0*ZY*9^n2fv@G3FA6z1%vGW5M$nH=y>qzdO z`9^fftoHh=ln(=Tw#=dp&hm*~D>Q;v9}2nf=lC}aKCT}#yBzFR>j>d~*ZOyebsI6+ zu46%w$sQ2CLlG>(U%+e%q)PzVe&@H9y!b=SnhP`WT{EgPv1%$?Bc*W9V8N-Uc@9wL zgN>Pd*S~;~!9P;EXufx%ELJ&kYRcJXpvmIDAS2EWKk%{U#uf>c=)pUY_C% zlV~`L35R&cQA657aF<3_*LzYn`m4NORpVd4wQ^cWMZ+=S8_1C! z)CKCh5z8iqjI7bmCSdXB0A!yS+Za;bVA^H*;RY6-0d;@z_YSy zn0=p%UGH4_&2q1s^t?JaB0C3oJDMbpU-f4|Z@%3Tu|<-k>5f*c$1jp-cPZ~z97FrM zZ0R0ske;RsNX_wVGhg}}N!<(iitn8(o>P!BeYxBRfZXTAOFP+du01-%IyArDJF<)K zU#12#>-TOO|0pgnB_JT;`tDCVw=l+HdnrsR9#k}i=YUG0+_2$v`kDrjhjwHw)b}x? zy;MnT*4hr`5@}Ot)C!IQ5g~5t)S$}WrP+PP9t+hCLWRFf*O;)`H_?`N8KW{?2ws(j zI<=d%g+ev98K&4n0>^@W^kQqdO?aOq8iYApM8)x~9~FGU9eVtd0~PjOv8gD3UW!Iy z2l`g9*B@gDq|tJ=kgH3R%8Bgj4MItBKMkAXiECoNMZgO@TkKbk9E{JeSw!(2w0oUq zw((pX))-t#6i#BV1`=`|69CVluHE!fO2uu$;6`6Z_L)vhx=7iY)Rt5blj_j4_X_)tI9KWPgNw z3c$3hz)P_H#jah$AxeV3hFjBnnPs?`TOF9Dq^zSn(z6eL(%xJVN(h!FiRiivg9@61 zz?=-=RCILB++cW&2H*V_Nc8SaEW-2yKn)P=mL19d+u#_sN2pm!F|8pI(utmVYQPQo zBo4DPf~xUCU$a<2yzMqW@OuMwU(uL`p@YJr7+1e>^CTIB#eZU<9Ug#9q&~jg)DvU| zhPOTshUhNPHjzqAZ8fLLTMdp7?fM{vog@uaUFnF_)%d0O{{@Nyb^TOo6o)B*Xlg_e z+0c?kDQ)=+*PNW=5>n{1ZUTP$#TZMf^xoGHVPXnIE?5cVC5b4O_`0(54ZN9T{S-~I zvlH1dIS3|AjUBG4FNWe>cbI?~LXha4`*c@%G&HldpVOyaMF>vv-}{a*=8j8+WHOHI zKf69qFac8aC%Ks3zyPvY1imw=-{yo-=#{{v>Oo?U2ejNDwg~3*w)y!WM+HDk&On2& zqEjv=4nP{C0fpdb4HEUxY6$=<4&$Ye(#B{7(Z0XYqUEeo&qZ5(ZxpSjMk{efpZ(zU zh!1N4uIk3{mM~MV5Gh^ftQ=LX3mBwr;S)+n#!F6=8wJ6yJMOU-7G7r!#S6GYEXq3- zA~2fX3yH=N1RzYPqa{5~;~%7L!$}Rbs{PqVT@xgXN}QerHne;^A|w~jLt~33XaI4R z;<}Ox3hZl-X^Y1298oEb^f>rbU_E&js}Qzka&a|xF1NnVKBKb{ozxOw`^$nUCi3~e z==lF}8IO1?+B%FWm%PueYw!?gNBicK>pnD4)o#=)CT`+kPEN*N?EfFXA0>rXyUn; z=iCyElkP4MF^?Tv^kS6ep>Tfc1EP&OL=`YNhYf{1(Y00cINTqc=7>2xjY+59@V8a$ z0JoQY9IY!%|GsOr+D8En5tXB`OC}!ph^|8ZSQ7L-{>5z19J>Ny%8x_TQ3v%vxI3u# z8uCJe*RzMZvM!10b<^O%Fm31b)-$HeZ&^bw*Za(g5