freeradius-server-python-3.0.16-3.6.1 4 > $
A p ^|pp9|} FqՋq(#i|ׅH AZ-) 3Up.loCJTb}w7n1gP;#+5Zʰc"I$Cn87$!ME=ã'Et+6&^A|-d!I
j_{ˠL\>M$
!l1ា *`s"1ӕh 'km ?=rW-M4:bݣLBMӥ΅od9f0d1a2ac50ffe7dbb0015b899767a706c9a6c1 5b3db4e43a77233ba58135ae3f43b2a5f24299d206ba25c0a434c8dc3ab3a8fa ^|pp9|AU[v$ W>q˴r>W[" qXT HwI[6#ceMĆZ gOW 0W% tcq
ZG1~Qʝ zJn ETO{ɂDP8O@_elR}3 Lw PYV>#@52hir,͈@VDrpO,rUkU@`?.l#[h)ԍm1SlWϴmwÚFSE[ # ( > p > ? d " ( F t x
% + 4 @ F
L X
4 @ | ( 8 9 h : F 8 G T H ` I l X p Y x \ ] ^ b c d ; e @ f C l E u X v d w 4 x @ y L z d t x ~ C freeradius-server-python 3.0.16 3.6.1 Python support for freeradius FreeRADIUS plugin providing Python support. ^|pFibs-centriq-5 SUSE Linux Enterprise 15 SUSE LLC GPL-2.0-only AND LGPL-2.1-only https://www.suse.com/ System/Daemons http://www.freeradius.org/ linux aarch64 A ^|p^|p^|p6 04739c5db8eacda59c3f3e85a824fd1437151fd6936e2f6585597c9f5b4464ab 6b633d96557f028e77bc5e427785ab4a1b435f407f5aa2d262b1bdc59c74e62f root root root radiusd root root freeradius-server-3.0.16-3.6.1.src.rpm freeradius-server-python freeradius-server-python(aarch-64) @ @ @ @ @ @
/usr/bin/env freeradius-server ld-linux-aarch64.so.1()(64bit) ld-linux-aarch64.so.1(GLIBC_2.17)(64bit) libc.so.6()(64bit) libc.so.6(GLIBC_2.17)(64bit) libpython2.7.so.1.0()(64bit) rpmlib(CompressedFileNames) rpmlib(FileDigests) rpmlib(PayloadFilesHavePrefix) rpmlib(PayloadIsXz) 3.0.16 3.0.4-1 4.6.0-1 4.0-1 5.2-1 4.14.1 ^{G]c\["
- Complain if the detail file reader does not have permission
to read the "detail.work" file. Fixes #1398
- Fixed SoH. Attributes were not being copied to the virtual
server.
- Used a wrong list to global statistics in "stats".
- Create EAP-PWD identity correctly. Prevents segfaults.
- Dynamically validate authentication types for PEAP and
EAP-MSCHAPv2.
- Fix includes in installed headers.
- OpenSSL 1.0.1f and 1.0.1g do NOT calculate TLS 1.2 keys
correctly. See raddb/mods-available/eap, "disable_tlsv1_2"
- Allow password change to work for MS-CHAP. This requires
'r=0', because password changes are not retries.
- Fix home server fail-over for home servers using TCP and/or
RadSec.
- Special characters in expanded regexes are now escaped e.g.
User-Name containing '.', and comparing /%{User-Name}/, the
'.' will now be escaped. See src/tests/keywords/regex-escape.
- Use correct authentication vector when sending Access-Reject
replies for RadSec.
- Set FreeRADIUS-Proxied-To in TTLS again. You should use the
"inner-tunnel" virtual server, instead of relying on this
attribute.
- Fix debugging constants in rlm_perl. Patch from Herwin
Weststrate.
- Add samba-dev / samba4-dev to debian builds so that
rlm_mschap can automatically use the new winbind API.
- Automatically skip zero-length attributes when sending
packets, instead of erroring out. - fix bsc#951404
* Rebuild of freeradius-server package fails
* fix source url
- ftp://ftp.freeradius.org/pub/freeradius/
+ ftp://ftp.freeradius.org/pub/freeradius/old/ - update to 3.0.10
* Changes of version 3.0.10
+ Feature improvements
- Do more optimization of unlang policies. This makes run-time
a bit faster.
- Re-name most of the functions in src/lib. Third-party module
authors will have to do the same.
- More documentation on contributing and how to write modules.
- Update radiusd.service for systemd.
- Open IPv6 proxy socket if the server is listening on IPV6
auth / acct / coa packets.
- Create debian packages for DHCP. Fixes #1125.
- Add more tests for "update" section parsing.
- Update "man" pages.
- Update attributes for Alcatel 7750
- Add dictionary for Boingo Wi-Fi
- Add support for DHCP lease queries.
See raddb/sites-available/dhcp
- On HUP, check all modules for config files which have
changed. And only re-load those modules.
- Allow FreeRADIUS-Response-Delay(-USec) to be set for RADIUS
packets. Patch from Herwin Weststrate.
- Documentation fixes from Alan Buxey and Matthew Newton.
- Update "logrotate" script.
- Added more RFCs to doc/rfc for new standards implemented by
FreeRADIUS.
- Don't crash when doing "radmin -e "help hup". Patch from
Matthew Newton.
- The dictionary parser now does more sanity checks, which
prevents run-time problems with invalid attributes.
- Update debian packages. Patches from Christopher Hoskin.
- Many other debian packaging fixes from Matthew Netwon and
Herwin Weststrate.
- Add "session-state" to Perl. Patch from Herwin Weststrate.
+ Bug Fixes
- Fix rlm_files so that there are no collisions when loading
10's of 1000's of users.
- Fix radclient to use our internal v4/v6 parsing functions.
v6 addresses with ports now work correctly.
- Fix sending/receiving packet messages to wrap v6 addresses
in square brackets '[]'.
- Check for sasl/sasl.h when building rlm_ldap, and disable
SASL functionality if unavailable.
- Fix issue which caused a non \0 terminated buffer to be
assigned to attributes if the value being assigned contained
an invalid escape sequence.
- Fix deadlock when reconnecting connections in the connection
pool.
- Fix potential overrun in functions that used fr_utf8_char
with a non nul terminated buffer.
- Fix decoding issue for Tunnel-Password type attributes which
were very long. Found by Denis Andzakovic.
- Fix radclient issue with TCP sockets on FreeBSD.
- The server now creates ${run_dir} and ${logdir} directories
in daemon mode, when running as "root".
- Handle tags when using maps. Fixes #1191.
- Fix crash when CoA packets time out.
- Fix parse error in rediswho
- Fix regex support in SQL radcheck the "users" file and
radsniff.
- Register listen xlat earlier, so that it's available when
the virtual servers are being parsed.
- Parse Ascend-Data-Filter when given as "0x..."
- Print Ascend-Data-Filter correctly. Add test cases for both.
- Allow old-style clients again. They will be disallowed for
3.1.0 and following.
- Complain instead of crash when "else" and "elsif" are in the
wrong place.
- Clean up memory more aggressively. This lowers the maximum
memory used, most typically for TLS based EAP methods.
- Prevent the server from unlinking the control socket of an
already running instance.
- Fallback to using the configured OCSP URL if one exists, and
no URL is provided in the certificate.
- Return CoA-NAK if proxying CoA fails. Based on patch from
Jorge Pereira.
- Lower peak memory usage by decreasing size of internal
memory pools.
- The control socket is now left in place if a second copy of
the server is accidentally started.
- Allow virtual attributes in "switch", "case", etc. Fixes
[#1240] and #1265.
- Many spell check / typo fixes in comments and example
configuration files.
- Better handle multiple DHCP listeners.
- Don't print secrets for old-style realms. Fixes #1267.
- Don't fall through in empty "case" statements. Fixes #1274.
- Update EAP-TTLS so that MPPE keys are correctly calculated
with TLSv1.2.
- Always delete MS-MPPE-* from the TTLS inner tunnel. This
allows TTLS / EAP-MSCHAPv2 to work. Fixes #1206.
- Fix off by one error that caused some MSCHAP-Error messages
to be sent without the password change version (V=3) and the
textual message component (M=).
- Always include C= V= and M= in MSCHAPv2 errors. RFC 2759
does not say that any of these fields are optional, and not
including V= caused errors with wpa_supplicant.
- Do not include M= in MSCHAPv1 errors. It's not supported. - Fix boo#912714: freeradius can't use ntlm_auth
* Create winbind group
* Add radiusd to winbind group - Remove gpg signature file
* The gpg signature checking is broken and doesn't work - Fix bsc#935573: Insufficent CRL application for intermediate certificates
* CVE-2015-4680
* freeradius-server-CVE-2015-4680.patch based on
https://github.com/FreeRADIUS/freeradius-server/commit/a03814af310bb3bee74ea012546d99c48b0ea5c3 - update to 3.0.9
* Changes of version 3.0.9
+ Feature improvements
- Make "pool" configurations more consistent, and update
documentation for them.
- Move connection pool logic to "most recently started",
instead of MRU. This should help with pool stability.
- More VSAs for 3GPP2
- Added examples of multi-value attributes to rlm_perl.
- LDAP-Group and SQL-Group attributes are now dynamically
allocated.
- Only the "sql" module registers SQL-Group. Other instances
register "instance-name-SQL-Group", similarly to "ldap".
- Unknown attributes are now complained about more often when
used in unlang statements. e.g. if (Foo-Bar == 3) used to be
a string to string comparison. It is now a parse error.
- Rename RLM_COMPONENT_* to MOD_* in the code. This makes many
things easier.
- Move to C99 initializers for modules.
- Load modules in raddb/mods-enabled. This allows attributes
like "LDAP-Group" to be used in the "files" module, without
explicit ordering or listing in "instantiate".
- Added 'bootstrap' section to modules. Third-party modules
will need to be updated.
- When adding clients from a DB, add them to a virtual server
if that virtual server has a "listen" section. Otherwise,
add the clients to the global list.
- When reading dynamic clients from a file, don't expire them
if the underlying file is unchanged.
- Allow the server to originate CoA requests from the
post-auth stage.
- The server creates ${run_dir} and ${logdir} in daemon mode,
if they do not already exist.
- Add dictionary for Wi-Fi Alliance Hotspot 2.0. The server
now supports all mandatory and optional attributes for this
specification.
- HUP now re-loads the configuration only if the files have
changed. If all files are unchanged, HUP re-opens the log
file, and does nothing else.
- Much better debug messages for EAP-TLS, including which
attributes are cached, and when they are retrieved.
- Increase default max_requests to 16384. Memory is cheap now.
- Added "stats memory" commands to radmin. Debug build only.
- Aptilo controller dictionary updates.
- SQL modules now use Acct-Unique-Session-Id everywhere.
- The redis modules are now stable.
- The LDAP module now supports SASL "interactive bind" method.
This allows Kerberos based administrator and user binds.
- DHCP code is now in libfreeradius-dhcp.
- More DHCP encoding / decoding unit tests.
- rlm_replicate can now be listed in the "accounting" section.
- Better sqlite debugging output.
- Remove "required" option from many sql_ippool directives.
- Set default CA "basic constraints" to "critical". Fixes #1073
- Updates to help / man pages from Jorge Pereira.
- Added more tests.
+ Bug Fixes
- Be more careful about unused config item warnings when
using -Xx.
- Move more defines to be auto-generated.
- Allow virtual servers in proxy fallback.
- Allow %{module:} to work.
- Don't crash in RadSec. Closes #980.
- Return better errors when a unix group / user is not found.
- Re-enable detail module "locking" parameter.
- Don't crash when logging replies from Status-Server packets.
- The couchbase module now uses "update" instead of "map", for
consistent with the rest of the server.
See raddb/mods-available/couchbase
- Don't require NT-Password for MS-CHAP password changes.
- Be a bit more careful about decrypting MS-CHAP-MPPE-Key
attributes. Closes #1013. There is no perfect fix, tho.
- Fix security issues with EAP-PWD.
See http://freeradius.org/security.html#eap-pwd-2015
- Fix dynamic clients read from SQL in non-debug mode
- MS-CHAP now allows retries (i.e. password change) when
passwords are expired.
- Allow "user=radiusd" when the server is already user
"radiusd"
- suid up/down works on non-Linux systems. This means that the
control socket should have the correct ownership.
- Fix issue which caused the server to sometimes have problems
when a home server was marked zombie.
- Fix format.pl because Perl is now more picky.
- Fix proxy to Packet-Dst-IP-Address, so that it uses the
correct destination port.
- Fix corner case with cursor functions and removal.
- OpenDirectory fixes and documentation.
- Fix leaks in rlm_redis.
- RFC 6929 "evs" attributes are now encoded / decoded properly.
- Fix talloc pool leaks when receiving malformed or
retransmitted Accounting/CoA requests.
- Printed attributes again use double quotes instead of single
quotes.
- Set X509_V_FLAG_CRL_CHECK_ALL, and add "check_all_crl" to
eap.conf. Fixes oCert CVE-2015-4680.
- rlm_expr now errors out correctly on malformed attribute
references instead of triggering an assert.
- Make "break" work in "foreach" loops
- Allow dynamic expansions to work again in the "hints" file.
- Correct minor typos in comments and examples from Alan Buxy.
- Re-urlencode the path portion of ldapi:// urls before
passing it to ldap_initialise.
- freeradius-server-rlm_sql_unixodbc-configure.patch removes
hard-coded directory in configure script of rlm_sql_unixodbc
- install new module rlm_sqlhpwippool.so - minor adjustments/cleanup of spec and changes - update to 3.0.8
* Changes of version 3.0.8
+ Feature improvements
- Allow syslog_severity to be set in rlm_linelog.
- Allow defaults to be set for bulk clients in LDAP and
couchbase.
- Updates to dhcpclient. Patches from Nicolas C.
- rlm_mschap now supports direct connections to winbind,
which is faster than ntlm_auth.
See raddb/mods-available/mschap. Patch from Matthew Newton.
- Recommend /dev/urandom for TLS randomness, instead of
${certdir}/random
- Allow TLSv1 to be disabled via "disable_tlsv1" in tls{}.
- Allow Expanded EAP types where vendor is 0 (IETF) and type
is normal EAP type. Supplicants sending Expanded EAP types
like this are broken.
- Add support for server side sort controls when searching
for user objects in rlm_ldap.
+ Bug Fixes
- Don't complain about "authorize" in "server {}" blocks, but
only if there's no "server" block.
- Fix cosmetic issue where debug from the first packet read by
a detail reader thread would be emited during config parsing.
- Fix ASSERT on truncated detail packets.
- Don't use main server log functions from within panic_action,
as in the case of syslog this would cause deadlocks if the
fault was triggered from within a malloc.
- Fix issue in "switch" when "correct_escapes = false".
Fixes #911.
- Fix sqlcounter configuration to use "%%b" instead of "%b",
otherwise the new syntax validation will fail.
- Allow forward references in configuration items. Modules
aren't always loaded in a sane order.
- Fix more escaping issues. Closes #912.
- Decode MAC addresses correctly for VMPS.
- Fix memory leak with TLS connections.
- Fix state machine threading issues for conflicting packets.
- Fix copy_request_to_tunnel issues for tagged attributes.
- Allow "ok" to over-ride "updated" inside of Auth-Type
sections.
- Update state machine so that post-proxy is run though child
threads for performance, instead of blocking the main thread.
- Allow "netmask" to work again in client definitions.
- Relax restrictions on SQL group queries.
- track outgoing proxy sockets and clean them up more
aggressively.
- track proxy statistics, including CoA and Disconnect.
- If radmin has a connection failure when running a command,
it re-connects and runs the command again.
- mark home servers "unknown" less aggressively.
- Fix potential SEGV in PostgreSQL driver on error.
- Fix issue where fields like nas_type would not be
accessible via the %{client:} xlat, for dynamic clients.
- Set default busy_timeout (of 200ms) in the sqlite driver, so
writes don't cause selects to fail in multithreaded mode.
This is user configurable, and may be increased if required.
- Convert Password-With-Header attributes to binary (from hex
or base64), in the authorize method of rlm_pap.
- Fix invalid assert in state.c, that could cause abort in
post-auth.
- Fix double free when -m flag is used, and connection pools
are referenced by multiple modules.
- RADIUS over TLS accounting uses the same port as
authentication.
- Regularized return codes from radmin commands.
- Fix RHEL spec file so it works correctly for Centos7 which
uses systemd, and didn't like the SystemV init script.
- radwho and radlast now have a -D option to load dictionaries
- DHCP packets are no longer checked for duplicates.
- Don't crash in sql module group comparisons in corner case.
- Calculate MPPE keys correctly when using TLS 1.2.
- Fix load-balance sections. Closes #945
- TLS certificates are available again in the post-auth
section. They are not available for session resumption.
- radclient encodes CHAP-Password properly when using -c
Closes #955.
- Fix issue in rlm_cache_memcached driver that caused variable
length values to be truncated.
- Fix track functionality in detail reader, so it no longer
fails with a "Failed marking detail request as done: Bad
file descriptor" error.
- Actually add the peer identity (as User-Name) to the inner
tunnel in EAP-PWD requests, so it's available for lookups.
- Fixes to PostgreSQL queries. Patches from Santiago Gimeno.
- new set of consolidated patch files:
deleted:
* freeradius-server-2.1.1-logrotate_su.patch
* freeradius-server-2.1.6-rcradiusd.patch
* freeradius-server-initscript-pidfile.patch
* freeradius-server-radius-reload-logrotate.patch
* freeradius-server-var_run.patch
added:
* freeradius-server-radiusd-logrotate.patch
* freeradius-server-rcradiusd.patch
* freeradius-server-tmpfiles.patch - Do not disable as-needed build
- Remove the with_sysconfig switch and just stick with versions - update to 3.0.6
- fixes a segmentation fault in PEAP module (bnc#912588)
Feature improvements:
* radmin / raddebug conditional errors are printed to the output, instead of being discarded.
* raddebug will exit if condition set with -c was invalid.
* radmin auto-reconnects if the connection to the server has gone away.
* rlm_cache now has submodule support. See raddb/mods-available/cache
* New memcached driver for rlm_cache. See raddb/mods-available/cache
* Add support for &Attribute-Name[*] in conditions. See "man unlang" for details.
* Add &Attribute-Name[n] which gets the last instance of an attribute e.g. Module-Failure-Message[n].
* Allow for redundant string expansions. See the "instantiate" section of radiusd.conf.
* When checking IP addresses in conditions, make the right side be parsed as an IP prefix.
* Support JIT compilation of compiled regular expressions when built with libpcre.
* Support named capture groups with "%{regex:}" when built with libpcre.
* Increase regular expression capture groups from 8 to 32.
* Emit error markers for badly formed regular expressions.
* Allow 'm' flag to enable multiline mode in regular expressions.
* Support limited implicit attribute conversion in update sections.
* Support casting between IPv6 and IPv4 where the IPv6 address has the v4/v6 mapping prefix (::ffff:). - Drop .keyring and .sig file: freeradius-server still uses MD5
signatures, which are no longer validated/accepted by GPG 2.1. - update to 3.0.5
Some of the new features:
* Allow LDAP to specify arbitrary attributes for dynamic
clients.
* Allow one level of backslashes (finally). See radiusd.conf,
"correct_escapes" setting.
* When supported by OpenSSL, allow TLS 1.1 and TLS 1.2
in EAP methods.
* Allow multiple new connections to be spawned simultaneously
in the connection pool, to cope with spikes in traffic.
* Use kqueue on systems which support it. This allows for
better scaling when using many sockets.
* Home server "response_window" can now take fractions of a
second. See proxy.conf.
* radmin now supports "show module status", as thee counterpart
to "set module status"
* "ipaddr" will now use v6 if no v4 address is present. You should
use "ipv4addr" or "ipv6addr" to force v4/v6 addresses.
* "client" sections will allow "ipaddr = 192.192.0/24". The old
"netmask" is still accepted, but the new format is preferred.
* Allow custom HTTP headers to be set for rlm_rest requests using
control:REST-HTTP-Header (attributes consumed after use).
* Extend format of %{rest:} expansion to allow HTTP method and POST
data to be specified
and urlquoting.
* Add support for aliases in rlm_ldap.
* Add support for connection pool sharing to all modules that use
the connection pool (pool = ).
* "tls" sections now have a "psk_query" configuration item, for dynamic
queries to discover a key from a PSK identity.
* Preliminary support for EAP channel bindings.
* Foundational work for dynamic home servers. They do not yet work,
but this is now only a matter of updating the "realm" module in
a future release.
* Support &attr[*] syntax to copy all instances of an attribute when
used with the += operator in an update section. May be qualified with
a tag.
* The logintime and expiration modules can now be listed in the
post-auth section. This makes some configurations simpler.
* rlm_sqlippool is now IPV6 capable. Set "ipv6 = yes" to get
Framed-IPv6-Prefix returned. The SQL queries have NOT been updated.
Please submit patches.
and numerous; bugfixes
- remove gpg-offline
- create /run/radiusd after install
- drop freeradius-server-opensslversion.patch (upstream) - freeradius-server-opensslversion.patch: do not check the minor
version of openssl, minor versions are supposed to be compatible.
bnc#906682 ibs-centriq-5 1585213510 3.0.16-3.6.1 3.0.16-3.6.1 python example.py rlm_python.so /etc/raddb/mods-config/ /etc/raddb/mods-config/python/ /usr/lib64/freeradius/ -fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -g obs://build.suse.de/SUSE:Maintenance:14500/SUSE_SLE-15_Update/04f921ee0dbe7d4ce2443b589609e23c-freeradius-server.SUSE_SLE-15_Update cpio xz 5 aarch64-suse-linux directory a /usr/bin/env python script, ASCII text executable ELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, BuildID[sha1]=e4543de1cf5b42b4b2c4800fb9ea52bc6cba6dba, stripped R R R R R R ~lEoم4w utf-8 97002e61f56da941792e9a75add1fe03ce5e0fac46be52fec50c036efc07814e ? 7zXZ
! t/'%]
crt:bHW P~kIN
1)t;b״HO79P}Rt̝BZ(h1Qp"c&U's]՝86L6=ǯ3|_ Yܒ#7
w|ExWQ2s ބY
`2y ˡ[:iKwOVyD k RJdz_1g_ \ЍJHC K$,5=R2
9(.wl /U(mIcP1D85\x3`dM O;K{TZ}b@ dEѰot=灃\ PkdSm5-ތhu=Nmqs#K;zE;]k肎lNjU/{* I(^)ͷ[W0/e4/*A_L2HlY^䷒Grdn
L8d@kӿA+/o Ż>T挞 4 NCe xo7 ӯݱ~0|>(ԖRMtbCX^hLS ef2Gs{9[B|& вMVkժI
q1q+ Y' OVo=*d㿼%Byb>M.}J::Yؕdg0X]$o\Asb3|k|#9YhFUn"
5Q;C㨮HIXB~{'l6QBo5
vIk6ycD vi F_LBMNAE V~ 1]L 襐M15d9'TZ?]RuD|Vm@= N? M
v,̰/onr4=.*g%.ҌJ #^sؗ3kb{֛77x|Iģ1K@ʯJb !J׀%8bCZ[#,݄cgnV[ܿ59 p -ܭVhgy9 yXC1δEdž ǏjӬޜdHWD? 6+-jqco^q# 71 .r5gÜYêb WaFF `AJU ?AE# ď\%oD
j$cH fx;Bs>G1oB
o@_~ۍb ZA&^ xQ?ES lMT43 wTj3,_1Y7D So0*cЫϧKNlnnS$
b[#艝uE_x y3K`( p(
w͖)6`Ar|);GǙ}NB\S|k P\4 ! +] ^]o!SV ⌕ YH"-M,$[/01_BRߠ35`˹l˞l{ ^ܶs qٖ۬s7n Ar) fvUQR T)6-x՟5Zp]);x`|vH
Kd}sr[r+*ՖnK*?$":wRxaf] '*>°ȁvQh82
3a@hNmMb\_h#! :7},,KhM ۄ 5< !4G[)Se XkaSXg]Ynx~[2DgZ':r` Ӫ=͍" /Kz'%jwj yѼ ,aAKmw@ǽm Ӓ 9mr{xwp>&nhy$(s"@ºz})F/ ŹDJl
=NG82-/)fͷ)"_@{g;[K 6 _@5dM:Y I`!>
0v e!Hɖդj 29)Eb*oCvȄD
5$'kj'Me
a
{hwPN ae]v )&CnMc60f+=`o\-Q؊H o%%!tlX/g#.4P`w%@Q`qz|]
͒J`&IVtմGZKC̽c?.&]QSҍKV^eE*!rwg `N=^ ,KoYKîyhbu(Q P4
dȃ?i
' ̏۬VР5~E2%٭
OfN0 X)1B/ _SfFMs1ϓ00wN'ٟ1zV pʲvB50 `Qieu㟽oB" C0O
L~Lxaz4X8I[&g@ Kq TJeuݝ(FZ'n f%u{簊5k s#iE㯭 ss,"Kk?ߥv?0a9z0.z
W (UѼP
uQtm
#Rj}M ?f] ~|hܢ 'ɟ9ؿzd5ohdoOO&i =?{O!$ً.z%P=e+`\5}%"ƋhhLه#`ZziB& Hz#oi爰gdC܍8]#r)sC;qwEDW"04 3f krjaP' Mw2TM%-gv]lq,kc|{6+0X.R[٢4w.DLΟ4عM xumP4([p R8B.]CiM]|f@DYJX oG Vz ]ߦ*Ґ~ "2g59Z)i y 0 N G u&)z3FG ݝr9d?FUpV 7 F#3`LӶwzb}cjtM~e/ uba_/Tm^HTͺ?!bG{m]s$`vBr ږ넱Z]`{,fI#"|xCeeIixI-~(D&\`\%hyޝ`\#m+wqDgXmZa6ƫ]e), Q̫̽ Xb h7 ~8.Suu)>+"i'Ȼ a/1o L.b ,/M(ғ;@`=hZ@b?1PVj: 2)JЩ(Gp%~n]G;@;J5KO'mIjv^^0tDYKB27$HuxnIfQmGW9b=u/oφvk jmy?_KMs'nqh Ӡnﻵ5w!6IwT+!ؑT~&7K9 (7ed7' lf
ݕD3Dvt֝C|} 1Lú'TI>q#pK}D;lW_Az2XJx 3HMA!jH$7-)E8 NqÓk0t>3磑AeUBS(7fiwa[ 懤 ڠ k>wXBkEc1sW,IH2+lX
QW(4cWIPq]@RCdpז!Η@^`GQ0ETk
%2}|6kMeyp!_Y
G7Kh}Ư.=Edң\zG7pZ,3KDJs*[JO-A uR H݉Y!&{ }NyV.- Fsvm>s%<( _Y6u
(_ژ<怤>KݐXD*#DLWd kbe%z6JxK`O!"t Ro0mJ 1-IzD, WHOjTgeR3Id@@@5LբIxO-X(79*')^CC&ݩ]z?8E qs TN2_
2t $o#OJT 7ZEtdI4o_p q1ضs(8%v-ٝl ȹn6FT.uSiT<
tTb$
G ܼDJvtβ
P7q)ZP]Pw! 5g%߉R܅xmy7zyl \ ;,h x[ۊ#9U"?
FZ,|#'rhԹ33 bYTIDn(JJ@/Qz!{/: (0Lu:WTm
O ^H{Ⱥ[ . Jz{>;&
mBӪ+jCk)ݷ|>譅8OvG2/
xO!/qNVQF yGg6cIHXJ>;N$M4^e-7`QH5& :#a! %2qk=q)<]Y4X7*`rWӇ`?R5ojLHу6\`)a4]QyMo=$lvX[vX_~BSnt gLRBk "͠Folusr ^\Pc_~֎hdpȳK-?mÓ[õ#l'`мJu7A7_-u˾&M0Zob_6*bdS>?^_'@9Q5oI6b#:'Kk{Vlx?A9k|jl[GՖiEŝr)Fz7
&9u2*eAv& bI9b="< YpG\ SOJ'o+}Gf9c{!71l;b'UpI`N+Ϥ`msoUd:)5(]ri]շ0L$[+|°v@;I#7/>݅s}Y~xqAq+:xPx8S|( ݏeg\OAu|Iu*iX_OA k
tc^0+ #i# 6/ Raz;ڞ = Cdپw<}vet:A[ @Keja4ɇɷKėoԈ؟&,$tݡp,tbGObQD?1 " <t ]DJM21}Ft[dqȞz1lCc4ߗ6;9 4L5TN4-} C4LjW 2`'#u
k:6'
U{{732˕DmBs$/TRT96BM̿NrSfB2.p~4 Dp0 &Nu\J7ͺU%1ix Zd{$b" K?䖂,;+?5کʿP]GEig'0[Vߌs8~,Ӥb8tԱbtMNz se~GzS~/~W._5 +!w|NNGe_߽zs26){0y(V[]5Fk]{td =G9iRg7p IȧST_B K?!LH1&Ad7lrZ_Q[oNEU̫esԞ*,J$ĶănCѱT; a,TB =Ino6$STr6}3:v+ɬ?g/>p1] |iY
"G <=2ewSDB
n{I1'us]-g^=tLuX
Q&DP^|"PRpF +cZ}ڌ+~vY:uCK^sFs3@5Tfz֪'s-P>8sPǟo[sAe%5)u:n=V*T:> &5 {UV|#T S I [8`܄0B3!R!Da2.B++fAzz H ;|Og
%84($x% D|Tu!V t9Ѧw
SEB*fO(&'Jw'7sF.V,^&d^sO>* Okln{%m|{@ 'JY*J! q# ߏnMK-z ̜daj0nph<\
/ Vma!\)v
cr8]Uլ-1GM@XxF84M+87z,ǼbjxoXZT [ca8r!6cD'_UkBacQs4> CJΜ`}p{ӷ7_uC$gfuE>-%QH g7cn%P M&: } eN8<4K]ȋLਲd)xY'=LN$3/lD~ 9TU>6wiQUDsgf}gdm3y~> tkNni