freeradius-server-utils-3.0.21-3.6.1 >  A `,ޝp9|~wT3T@CPtW,B`)=fIRw)3 :cYݲK-zB.&8?7֛\"ltDWbKI_M bmo壒ڸ '1\~ {AP%TJ4:zS@>V se{{J|r؞6M3\l1I, ?>p"&,?<~(h ]ay3WLHz~<jQa9b75b59d7695055aa027768d1c9d8995ccf4212de7574a36c84e913280c9c62eb0b1a85abaed6f9f9eb2b32da0ef43e81187918`,ޝp9|ҩG5)ΡvWNSHyx*cT5P!Blfr$± TJ{ウc]->_碠6]baʏK=! lHtQzy.ٽA$ӷQj\ZшVT2DCa&6]h{h~jx4Q, ,&`J_}b :'12mIC>aSM6W@)y#])xӟ6 >p>?d! ' :`dpt  %+4   T l  \   \   (8 &9&:g&FGH0IXY\],^Fbecdefluv wx`y^z8HLRCfreeradius-server-utils3.0.213.6.1FreeRADIUS ClientsCollection of FreeRADIUS utilities.`,ibs-arm-1 TSUSE Linux Enterprise 15SUSE LLC GPL-2.0-only AND LGPL-2.1-onlyhttps://www.suse.com/Productivity/Networking/Radius/Clientshttp://www.freeradius.org/linuxaarch64 H   ~Xq $    O6*w큤`,`,`,ڬ`,`,`,گ`,`,گ`,`,گ`,گ`,`,گ`,`,`,ڝ`,ڝ`,ڝ`,ڝ`,ڜ`,ڜ`,ڜ`,ڜ`,ڜe59f8838f16dde101087d0f00a37ebd8772e5e552141b567f715609eb8a39fbf67e7a95ba443bbc86be555c5ce5f39e142ba608c4e8374c0f16b37b8504d23d7ef8ec2f344d438d0fa7f1918130c8459fa4a9cbd45b105519437e451e4aa1242cdeaf4bfd5f407a568f7528a33ebb48dcb17ae78404a1c5a8688f8f9273fabd80c4e275e4da53cd912d040e4dd2c786086e77896d90c8bc8b19e035270d3a2e3b697cf1626be74fb2144b692de899dc5d9b1643e98fe12c33bf2f9aaa78a4aedbbccb7bcfeecda1fac3b5e873bd962623f1d7a461c0cae18a65fef8fbfe5d127a9bf299c72d458ef397164d802379e00f132b00d8ca2de7ce54c19a7fd379b66ca574b8d80c5d73056a0f332958eeb0e262c0576f29f52eba9f49049d7837927ac75b5c19d977fe528dc805d1f136ba06dd96c43732dbf95aefa2b45a0bdc17be5431156ad54e262fc3f082773d20c81f02a4cede8ef978b46a7de3552dad16120f32ef8e6bd4be22f39b6d386142429d2ac5ee0ef86bb80a4e1a1fe4d72ce62590bf323cbf624d85728e22a9fdee9064246bf3e2b0bdc44a6b02f524b1186bd99f5ba4ca8131c659c177d1aecc15e8273b9adf5a49bb37e9f18caffc32f14740ce0e4d24281831ceae779dad67699d11f9c1174b50e4954de9102657de6d4d72ef1e2f35bf523934869919af2b2177c9ee9e9c0ab6ad52af5b57614b12c2d08bc0e0beb9bee88c9ae9e70ab53b4a5b3de2966aef097e016549c494e4d961771435c618ffe1369697e5f228e99401687c6e2276f9ea75d7ab76232060ef0b549eaad978fa290c5fdce3b0dbb5763b122358d6f2c1056ec755663a4015c8a4d00f0114e9efa73dbea5a5d35fb6b9e20f1942dcece8c48adabb1c4649de10440217dbe6b5b6389623779e0eb9b098e59c0525cc1cd59dd1109cada0e1fc87c00bebcbd784ee828b1cdc019207e918c356a8b51f58ad9a44c364b43c6fe8e4e40d9d7dce30598dc43bf317f3d4d6f29d947c5427c63a93797c274d2b685fc8661f939f4849d961e2bcaa4094c331fa34c28ae5869cd58bbde8e3f59d364d9f342f1rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootfreeradius-server-3.0.21-3.6.1.src.rpmfreeradius-server-utilsfreeradius-server-utils(aarch-64)@@@@@@@@@@@@@@@@@@@@@    /bin/sh/usr/bin/perlfreeradius-server-libsld-linux-aarch64.so.1()(64bit)ld-linux-aarch64.so.1(GLIBC_2.17)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.17)(64bit)libcrypto.so.1.1()(64bit)libcrypto.so.1.1(OPENSSL_1_1_0)(64bit)libfreeradius-dhcp.so()(64bit)libfreeradius-eap.so()(64bit)libfreeradius-radius.so()(64bit)libfreeradius-server.so()(64bit)libgdbm.so.4()(64bit)libpcap.so.1()(64bit)libpthread.so.0()(64bit)libpthread.so.0(GLIBC_2.17)(64bit)libssl.so.1.1()(64bit)libssl.so.1.1(OPENSSL_1_1_0)(64bit)libssl.so.1.1(OPENSSL_1_1_1)(64bit)libtalloc.so.2()(64bit)libtalloc.so.2(TALLOC_2.0.2)(64bit)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)3.0.213.0.4-14.6.0-14.0-15.2-14.14.1_@_FN^y@^p^h^@\\v{\u*@[<[2*ZZWQYY@YlY, @XO@X@X*Xh@X.@W@WiV@V.Vf@UĝU@U@UU8U7@TZ@TTT~@T|X@adam.majer@suse.deadam.majer@suse.deadam.majer@suse.deadam.majer@suse.deadam.majer@suse.dejcnengel@gmail.commichael@stroeder.comadam.majer@suse.demichael@stroeder.comadam.majer@suse.demichael@stroeder.commichael@stroeder.commichael@stroeder.comadam.majer@suse.devarkoly@suse.commichael@stroeder.comadam.majer@suse.demichael@stroeder.comkukuk@suse.deadam.majer@suse.dejengelh@inai.deadam.majer@suse.demichael@stroeder.comadam.majer@suse.demichael@stroeder.comjkeil@suse.demichael@stroeder.comjkeil@suse.dejkeil@suse.dejkeil@suse.demichael@stroeder.comvcizek@suse.commichael@stroeder.comtchvatal@suse.comvcizek@suse.comdimstar@opensuse.orgvcizek@suse.commeissner@suse.com- freeradius-server-radiusd-logrotate.patch: move logrotate options into specific parts for each log as "global" options will persist past and clobber global options in the main logrotate config (bsc#1180525)- freeradius-server-radiusd-logrotate.patch: fix permissions in logrotate global section (bsc#1170505, bsc#1174905)- update to 3.0.21 (jsc#SLE-11896) Feature Improvements * New stored procedure for allocating IPs with PostgreSQL Rates of 1500 IPs per second are now possible See raddb/mods-config/sql/ippool/postgresql/procedure.sql * Add SQL IP pool support for Microsoft SQL Server See raddb/mods-config/sql/ippool/mssql/ * Added RCNTEC dictionary. Closes #3168. * Added Pica8 dictionary. Closes #3179. * Add TLS-Client-Cert-Valid-Since attribute holding not Before date Patch from Boris Lytochkin. Fixes #3157. * Generate attributes containing unknown OIDs See raddb/sites-available/tls * Update the WiMAX dictionary. * Added ability to rlm_python(Python2) show a stacktrace from errors. #2979. * Add WiFi Alliance Policy OIDs. See raddb/certs/xpextensions * radmin now shows coa stats, too. * Sample schema extensions for summarizing data in SQL See mods-config/sql/main/*/process-radacct.sql * Update dictionary.aerohive, dictionary.fortinet, dictionary.arista and dictionary.erx. * Added VAS Experts dictionary. * Many updates to RPM and jenkins builds from Matthew Newton. * Added %C (time now in seconds) and %c (microsecond component of now) back-ported from the "master" branch. * Add reload capability to systemd unit file in Debian and RedHat. * Increase timestamp precision in postauth to maximum supported by each database and simplify (and make more consistent between drivers) the timestamps in SQL queries by using expansions. * Option to set dictionary path in raduat script. Bug Fixes * Various fixes found by PVS-Studio. * Set permissions of certificates in bootstrap shell script Fixes #3132. * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141. * Skip processing proxy reply if there are no home servers available. * Update SQLite IPPool queries. Fixes #3177 * rlm_sql_unixodbc fixes. Fixes #2822. * Fixes when building with LibreSSL. * Fix the rlm_python3 build. Note that this module is experimental. #3183. * The rlm_python should append the 'python_path' paths in 'sys.path'. It fixes the expected behavior to use the existing Python modules Fixes #3180. * Fix rlm_python to print the script errors properly. * Bound total query time for PostgreSQL. Fixes #3253. * Many fixes to Oracle sqlippool. It now does 500 IPs per second without any tuning. Fixes #3270. * Reference sqlippool by it's correct name. Fixes #3272. * Revert 3.0.20 patch which caused crashes on duplicate clients. * Update WiMAX-MSK attribute. Fixes #3280. * Fix crash when trying to access non-existant regex capture group. * Use timestamps (request or server) rather than SQL NOW() in accounting queries so that these are stable when replayed from a file buffer. - freeradius-python3_patches.patch: upstreamed- update to 3.0.20 (bsc#1146848) Feature Improvements * Added Force10 dictionary. * Update dictionary.hp with new attributes. #2690. * Update dictionary.aruba with new attributes. #2696. * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456) * Relax OpenSSL version checks, now that their API is both public, and stable. * Note that tls_min_version/tls_max_version also support "1.3" Since there is no standard yet for EAP with TLS 1.3, it will not work. * Added tripplite dictionary from #2760. * Switch to the async interface for rlm_sql_postgresql so that we can enforce query_timeout. * Added new LDAP option 'allow_dangling_group_ref'. * Updated documentation and functionality for EAP session caching See "cache" section of mods-available/eap. * Tighten systemd unit file security. Fixes #2637. * Disable TLS 1.0 and TLS 1.1 support in the default configuration We STRONGLY recommend doing this for all installations. * Add expansions for *outgoing* Radsec connections "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and TLS-Cert-* attributes. Fixes #2839. * Add %{listen:tls} which returns "yes" or "no" for TLS or non-TLS connections. * Update dictionary.lancom with new attributes. #2847. * Added rlm_sql_mongo. See raddb/mods-available/sql. Note that this module is experimental. * Added more documentation in sites-available/robust-proxy-accounting. * sqlippool now re-allocates unexpired leases, to prevent IP pool exhaustion when clients perform multiple reauthentication attempts * Add support to radmin keep the history in ~/.radmin_history. * Add support for ENV and LD_PRELOAD in radiusd.conf. See the new ENV sub-section of radiusd.conf. * Update dictionary.aptilo. #3002. * Update dictionary.airespace. #3039. * Add sites-available/coa-relay, which makes CoA easier #3045. * Add example stored procedure for IP Pools in MySQL See mods-config/sql/ippool/mysql/procedure.sql * Update dictionary.dhcp dictionary with the recent hardware types. * Add experimental rlm_python3. This should largely work the same as rlm_python, which was Python2 only. * Add Dockerfiles for Debian10 and CentOS8. * Add RPM spec file compatibility for RHEL/CentOS 8. * Notes on certificate constraints. See raddb/certs/server.cnf. * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585. Bug Fixes * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627 * ERX-Acct-Request-Reason is "integer". Closes #2635. * Fix a slow memory leak in the file management code. * Try to fix file permissions if they get modified while the server is running * Fix slow memory leak with clients. * Fix request and connection timeouts in rlm_rest. * Fix systemd issues. * Fixes from clang analyzer. * Fix missing include for the dictionaries: alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn, audiocodes,avaya,bristol, columbia_university,freedhcp,garderos, infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus. * Fix internal sanity check when running with "-Xx". * Allow "inner-tunnel" virtual servers to work better with "accept" and "reject" policies. * Fix dictionary.huawei data types for Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address. * Framed-Interface-ID in postgresql/queries.conf is string, not inet Fixes #2817. * Fix rlm_cache to complain on unknown attributes in the "update" section of its configuration. * Add configure checks for -latomic. This helps on armel, mips and mipsel. Fixes #2828. * Add support to Oracle 19 and 18. Via #2857. * Add support for decoding tags in rlm_rest. Fixes #2848. * Use correct passwords when updating CRLs in raddb/certs/. * Properly separate "originate-coa" packets when accounting packets are read from the detail file reader. * Use the correct virtual server for pre/post-proxy. * radsqlrelay fixes backported from "master" branch * Fix DoS issues due to multithreaded BN_CTX access (bsc#1166847, CVE-2019-17185) - disable python2 for SLE15 and Factory - freeradius-server-enable-python3.patch: enable Python3 module - freeradius-python3_patches.patch: backport python3 fixes from upstream - freeradius-server-opensslversion.patch: updated- Enable memcached driver on SLE15- Add missing BuildRequire on samba-core-devel required for windbind support in rlm_mschap.- update to 3.0.19 (jira#SLE-5890) Feature improvements * Update dictionary.cisco * Update sqlippool to allow for stored procedures with PostgreSQL. This increases performance substantially. Patch from Nathan Ward. Fixes #2540. * Re-added "show client config" command to radmin. * Cleaned up mods-available/sql example so that it is easier to understand. * Added pfSense dictionary. Closes #2581 * Update dictionary.h3c Closes #2592 * Update elasticsearch/logstash config for v6.7.0. * EAP-PWD security fixes from Mathy Vanhoef. See http://freeradius.org/security/ (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664) Bug fixes * Update dynamic_client module and server core so that the functionality works. This has been broken since at least v2. * Fix crash in sqlippool due to escaping changes. Patch from Nathan Ward. Fixes #2532, #2533. * Fix systemd notify, watchdog and unit files. Fixes #2541, #2499. * Fix erroneous length check in EAP-FAST. * Update documentation to remove old "ignore_null" configuration. Fixes #2578. * Fix default POD port. Should be 3799. Fixes #2591 * Correctly encode vendor-specific "encrypted" attributes. Fixes #2600- reformat changelog mostly by wrapping lines - add missing bug numbers for security fixes- update to 3.0.18 * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss. * Do-Not-Respond policies can now be set in the "post-auth" section. * Encode / Decode ADSL Forum DHCP options. * Fix module ordering issues. e.g. when "sqlippool" needs "sql". See the "instantiate" section of radiusd.conf. * Add Big Switch dictionary. Fixes #2252. * Add sql_session_start policy (raddb/policy.d/accounting) This minimizes race conditions when using Simultaneous-Use (#2257). * For rlm_perl, all variables are now tainted by default. See raddb/mods-available/perl, and the "perl_flags" configuration item. This change should only affect people who are using variables in insecure ways. * Allow "sqlcounter" module to be listed in "post-auth". * Add support for IPv6 attributes in SQL. Fixes #2280 * The server is better at handling fail-over for outbound RadSec and TCP connections. Fixes #2284. * The server is now more aggressive about retrying failed outbound RadSec and TCP connections. Fixes #2284. * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list. * Add expansion for Radsec connections. "%{listen:TLS-...}" for TLS-Client-Cert-* and TLS-Cert-* attributes. * Add notes on running "ldapsearch" using the parameters from the LDAP module. * "ipaddr" attributes can now be cast to "integer" type attributes in an "update" section. * Move main thread queue to using atomic queues. This should help with contention in high load scenarios. * Add "recv_buff" setting to listeners. For more details, see sites-available/default. * The sqlippool module can now use attributes other than "Pool-Name" to assign IP pools. The "Pool-Name" attribute is still the default. * The "unpack" expansion can now unpack substrings. See mods-available/unpack for documentation and examples. * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE. * Allow for -LDAP-UserDN. See mods-available/ldap for more information. * Add sanitizing of control list for moonshot. Fixes #2318. * Update rlm_sql_mysql to be compatible with MySQL 8 Fixes https://bugs.launchpad.net/bugs/1795310. * Allow logging of only Access-Accept or Access-Reject messages See radiusd.conf, "auth_accept" and "auth_reject". * Removed Connect-Rate comparison. It was unused and broken. * Add dictionary.infinera. * Use OpenSSL HMAC functions instead of local ones. * Some SQL modules can now use "auto_escape" to escape unsafe strings See mods-config/sql/main/mysql/queries.conf. * Add wispr2date conversion in mods-available/date. * Implement dictionary-based handling in rlm_python. Fixes #2334 See mods-available/python for details. * Add support for SKIP LOCKED in sqlippool. This can improve performance by an order of magnitude or more. See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383 * Allow PSK and certificates at the same time Except for TLS 1.3 which does not support that. * Update docker scripts. Fixes #2306 Patch from Matthew Newton. * Add crypt xlat. * MySQL connections can now skip verifying the server certificate. Fixes #2481. See mods-available/sql. * Add better mechanism to detect MariaDB (Old MySQL). * Add RFC 7532 "bang path" support for realms Fixes #2492. * Update dictionary.ukerna documentation. Fixes #2493. * Add support for systemd service and watchdogs Fixes #2499. * Check for openss/rand.h, and allow building without OpenSSL engine. Patch from Eneas U de Queiroz Fixes #2517. * The default PosgtreSQL queries now use "ON CONFLICT" to better deal with issues. This requires PostgreSQL 9.5 or later. Please use a recent version of PostgreSQL, or edit the default queries to remove "ON CONFLICT". BUG FIXES * The session-state list is no longer cleaned in the inner-tunnel. This lets the outer Access-Reject section access session-state. * Fix typo in lock initialization for TLS sockets Found by Sergio NNX. * Add check for crash when home server down Fixes #2233. * Add username key for postauth table. * Better libpcap checks, when the header files or libraries are missing. Fixes #2245. * Allow building with old versions of OpenSSL Fixes #2247. * Allow non-FreeRADIUS State attributes to be used with the "session-state" list. i.e. State length != 16. * Be more aggressive about cleaning up zombie children when running in debug mode. * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries exporting LDAP API functions. * unlock files when asked to unlock them. * return error instead of asserting in map code. * Don't write 0 bytes to SSL. Fixes #2270. * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262. * Various dictionary cleanups and consistency checks Fixes #2281. * rlm_python has stronger thread locking to prevent reported issues. Performance may be affected. * Don't allow Message-Authenticator to overflow past the end of a large packet. * Fix crash in sqlippool when SQL server goes away Fixes #2300. * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303. * Fix crash with CoA packets/ Fixes #2304. * Fix crash in rlm_exec with CoA. Fixes #2328. * Print errors while parsing the log config, and don't quit when deprecated log settings are found. * Fix DHCP encoder xlat so that it can be used with a list of attributes. It previously only encoded the first member of the list, and now encodes all members. * The "expr" module now skips more whitespace. * Remove internal FreeRADIUS-Response-Delay attributes from attr_filter Access-Reject. * Don't send junk to redis when maximum args reached. * Small updates to IPv6 for accounting schema Fixes #2364. * Fix OpenDirectory integration in rlm_mschap. * Fix slow memory leak with dynamic clients. * Don't artificially truncate debug output for long strings. * Fix memory leak in EAP-PWD. * Fix crash in "hints" file with Fall-Through = yes. * Fix crash / timer issues with many CoA packets. * Fix attr_filter so that it does not treat vendor attributes of number 26 as Vendor-Specific. * Fix reconnect correctly in rlm_sql_mysql. * Fix rlm_cache to properly use Cache-TTL < 0 Fixes #2485. * Fix rare occurance of bad xlat expansion. * Check for rare race condition when a proxy reply arrives too late.- install license as %license instead of documentation- also fix ownership of /var/log/radius in systemd unit- update to 3.0.17 Feature Improvements * Add CURLOPT_CAINFO. Patch from Nicolas C #2167. * "stats home server" now supports "src IPADDR", to specify home server also by source IP. Fixes #2169. * Add Dockerfiles for a selection of common systems. * Increase number of permitted file descriptors, for systems with many home servers. * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs Patch from Isaac Boukris. Fixes #2205. * Update main READMEs. Patches from Matthew Newton. * Added dictionary.mimosa. Bug Fixes * Don't call post-proxy twice when proxying to a virtual server. Matthew Newton, #2161. * Use "raw" string value for shared secrets and dynamic clients It now parses strings with backslashes and "special characters" correctly. Fixes #2168. * Fix RuntimeDirectory for RedHat, from Alan Buxey. * Relax checks in 'if' parser from Isaac Bourkis. * Minor cleanups for %{debug_attr:&request} from Isaac Boukris. * Be more aggressive about cleaning up cached certificate attributes, due to deficiencies in OpenSSL. Reported by Nicolas Reich. * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall. * Fix double free in rlm_sql. Fixes #2180. * rlm_detail now writes empty Access-Accept packets. * rlm_python can now create tagged attributes. * Don't crash on duplicate realm + authhost / accthost * Allow partial certificate chain to trusted CA. Fixes #2162. * Treat SSL_read() returning zero as error. Fixes #2164. * detail writer now checks if the file was renamed or deleted. * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name. * RedHat Systemd updates. Fixes #2184. * Use correct API for State variable in rlm_securid. * Remove broken radclient option "-i". * Fix "users" file (and hints, etc). So that it does not get confused about entry ordering with multiple $INCLUDEs. * Fix rlm_sql to expand the un-escaped string, not the raw string. * Link default and inner-tunnel only if they exist. Fixes #2206. * Don't use both IP_PKTINFO and IP_SENDSRCADDR. * Always install signal handler for SIGINT (needed by Docker). * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs which are not self-signed will now be checked. * sqlippool now returns "fail" if it fails IP allocation. * Fix rlm_yubikey to look for correct attribute in replay attack check.- update to 3.0.16 Feature improvements * rlm_python now supports multiple lists. From #2031. * Add trust router re-keying. From #2007. * Add support for Samba / AD LDAP schema. See doc/schemas/ldap/samba/README.txt and doc/schemas/ldap/samba/ * Add "tls_min_version" and "tls_max_version" to EAP module for Debian OpenSSL issues. * Better documentation for client certificates in PEAP and TTLS: it usually doesn't work. Fixes #2068. * Distinguish login failure from AD unavailable. Fixes #2069. * Update RH spec files. Fixes #2070. * Run Post-Proxy-Type if all home servers are dead. Fixes #2072. * Print offending IP addresses when EAP sessions come from two upstream home servers, and rate-limit the messages. * Minor packaging updates. * Better documentation for rlm_rest. * EAP-FAST now has it's own "cipher_list", so that it is easier to configure. * EAP-FAST now forcibly disables TLS1.2, until such time as we implement the new keying mechanism from TLS1.2. * Add documentation for allow_expired_crl. * Update Debian logrotation. #2093 and #2101. * DHCP relay can now drop responses. #2095. * rlm_sqlippool can now assign Delegated-IPv6-Prefix. It also now can assign any IPv4 or IPv6 address. Based on patches from maximumG. #2094. See raddb/mods-available/sqlippool for changes. * radeapclient can now use EAP-SIM-Ki to dynamically create the necessary triplets. * Explain why many LDAP connections are closed. Fixes #1969. * Debian build / package issues fixed by Matthew Newton. * dictionary.patton updates from Brice Schaffner. Fixes #2137. * Added scripts to build "inner-server.pem", and updated mods-config/inner-eap and certs/README to match. * Added provisions for using an external CA. See raddb/certs/ * Include dhcpclient binary in freeradius-dhcp debian packge. Bug fixes * Bind the lifetime of program name and python path to the module FR-AD-002 (redone) * Pass correct statement length into sqlite3_prepare[_v2] FR-AD-003 (redone) * Allow 100-Continue responses with additional headers in rlm_rest. * fix corner case where detail files were not being locked correctly. * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group. Fixes #1947 * Clean up exfile code. Which should help to avoid issues with reading / writing 100's of detail files. * Fix build for winbind. Patch from Alex Clouter. * Fix checkrad for Mikrotik. Patch from Muchael Ducharme. * Fix home server stats lookup. Patch from Phil Mayers. * Add libjson-c3 as an optional dependency. * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking against NSS, which breaks the server. Fixes #2040. * rlm_python fixes. Fixes #2041 * Typos in "man" pages. Fixes #2045 * Expand "next" in %{%{...}:-%{...}}. Fixes #2048 * Don't add TLS attributes twice. Fixes #2050. * Fix memory allocation in rlm_rest. Fixes #2051. * Update trustrouter for new API. Fixes #2059. * Fix SQLite issues on FreeBSD. Fixes #2060 * Don't do debug logging of bad passwords. Fixes #2064. (bsc#1099802) * More graceful handling of "die" in rlm_perl. Fixes #2073. * Fix occasional crash when using cisco_accounting_username_bug = yes * EAP-FAST fixes from Isaac Boukris. [#2078], #2076, and #2082, #2126. * DHCP fixes, relay, #2092, add run-time check, #2028 * Decode multiple RADIUS packets at a time in highly loaded RadSec connections. Patch from Jan Tomasek. #2106. * TunnelPassword is not "single value" in LDAP schema. Fixes #2061. * sql log now opens the expanded filename, not the input one. This was a regression introduced in 3.0.15. * Remove unnecessary UNIQUE constrain in Oracle schemas. * Fix SSL thread and locking issues when modules also use SSL. Fixes #2125 and #2129. * Re-add dhcpclient "raw packet" changes. Patches from Nicolas Chaigne and Matthew Newton. Fixes #2155.- Fix permissions of radiusd.service (bnc#1053654)- bsc#1055679 - freeradius-server does not provide winbind/AD auth Added libwbclient-devel as buildrequires- update to 3.0.15 with security fixes for issues found via fuzzing by Guido Vranken (bsc#1049086) https://freeradius.org/security/fuzzer-2017.html * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret() * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63 * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax() * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp() * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions() * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly * FR-AD-002 (v3) String lifetime issues in rlm_python * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare- update to 3.0.14 (still FATE#322416) Feature improvements * Enforce TLS client certificate expiration on session resumption, and Session-Timeout. See CVE-2017-9148 (bnc#1041445) * Updated dictionary.cisco.vpn3000, dictionary.patton * Added dictionary.dellemc * Lowered the log output for failed PEAP sessions. * ALlow utc in rlm_date. * The internal OpenSSL session cache has been disabled. Please see mods-available/eap * Update detail reader documentation. * Make outgoing RadSec connections non-blocking. * Add SQL backing to Moonshot-*-TargetedId generation. Bug Fixes * radtest uses Cleartext-Password for EAP, not User-Password. * Update documentation for mods-enabled/ linking. * Enhanced checks for moonshot salt. * Allow session resumption for RadSec connections. * Update "huntgroups" file to note that port ranges are not supported * Fix OpenSSL permissions issues on default key files. * Certificates are not required when PSK is used. * Allow SubjectAltName as first extension in cert. * Fixed talloc issue with TLS session resumption. * "&Attr-26 := 0x01" now produces useful error messages. * Handle connection error in rlm_ldap_cacheable_groupobj. * Fix endian issues in DHCP. * Multiple minor fixes for Coverity complaints. * Handle unexpected regex. * Fix minor issues in dictionaries. * Fix typos and grammar. Patches from Alan Buxey. * Fix erroneous VP creation in rlm_preproces. * Fix MIB. Patch from Jeff Gehlbach. * Trust router updates from Alejandro Perez. * Allow build with LibreSSL. * Use correct packet for channel bindings. * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us a test license. Please see the git commit history for more info. * Fix incorrect length check in EAP-PWD. This may be exploitable. * Stop rotating session database files (radutmp, radwtmp) since these are not logfiles. - freeradius-server-radiusd-logrotate.patch: updated- removed obsolete freeradius-server-fix-cert-bootstrap.patch because recent /etc/raddb/certs/bootstrap simply works - update to 3.0.13 (still FATE#322416) Feature improvements * Add dictionary.rfc7930. Note that we do not implement the RFC. * Added 'cipher_server_preference' to mods-available/eap Patch from #1797. * OpenSSL 1.1.0 compatibility fixes. * rlm_perl: radiusd::xlat to evaluate xlat string within perl script * Allow authentication retry in winbind. Patch from Herwin Weststrate. See raddb/mods-available/mschap. * Added "recv-coa" method to rlm_rest. It behaves the same as "authorize". * Document Trust Router tr_port option. Patch from Stefan Paetow. * Update elasticsearch/logstash examples so that they work with elastic stack v5. Patch from Matthew Newton. * Print information about packets, replies, and contents in the detail file reader. * Update abfab-tr policy. Pull request #1893 from Stefan Paetow. * Reject packets which contain User-Password and EAP-Message. * Add example for filtering Access-Challenge. See sites-enabled/default. * Pull symlink fixes from v4.0.x. Fixes #1859. * Add systemd reload. Not everything is reloaded, but some is. Fixes #1662. * Better documentation for listen "ipaddr". Fixes #1921 * Add dictionary.cnergee, updated dictionary.nomadix. * radclient no longer needs -x to print statistics with -s. Bug fixes * Minor typos. Fixes #1763 * Fix typo in RPM build. Closes #1767. * rlm_mschap check for password expiry only if password was correct. Fixes #1762. * Update debian build. * update rlm_counter "man" page. Fixes #1775. * Remove erroneous assert. Fixes #1778. * fix mschap password change test. Fixes #1792. * Cleanup config file on data remove. Fixes #1795. * passwd module returns "notfound" if not found. * Check for old OpenSSL, and don't build rlm_eap_fast if it necessary. Fixes #1803 * Cleanup memory better after ldap version query. Patch from Aleksey Katargin. * Rename lt_* functions to avoid linker issues with libtool. Fixes #1277 * Many miscellaneous fixes and typos. * Allow long strings in %{%{foo} bar:-%{baz} blah". Fixes #1866 * Fix filtering operators, along with more documentation and more tests for them. * Fix OpenSSL fixes. Fixes #1876. * Finish SQL select queries even when SELECT returns no rows. Fixes #1879. * Set Module-Failure-Message for more EAP errors. * Correct typo in dictionary.rfc5580. Fixes #1882 * Remove obselete systemd syslog.target. * Client-Port-Balance load-balancing now uses client port. * Radrelay examples fixed from Alex Clouter. * Update systemd target. Pull request #1896. * Trim starting whitespace in xlat strings. * Get MySQL result lengths using normal API. * suid down after fchown(). Fixes #1914. * Fix cases of comparing pointer to NUL character. Fixes #1915. * OpenSSL v1.1 fixes. Pull request #1921. * Better Handle v4/v6 host names. Pull request #1919. * Remove "Auth-Type = System" from docs and examples. * Don't crash on malformed %{home_server}. Fixes #1922 * fix erroneous use of talloc destructor in rlm_eap * Issue trigger modules.sql.fail. Fixes #1923 * Document python_path gotcha's. Fixes #1845 * dlopen() the specific version of Python. Fixes #1592- Don't require insserv if we use systemd - Remove require for unused fillup- Merge changes from SLE to openSUSE (FATE#322416): * freeradius-server-radclient-init-error-buffer.patch - make sure we initialize error buffer. bsc#911886: radclient error free() invalid pointer * freeradius-server-opensslversion.patch: remove OpenSSL version check and assume we know what we are doing. (bnc#1013311) * merge .changes file, mostly. - do not attempt to detect "vulnerable" OpenSSL versions. SUSE security fixes do not necessarily bump version numbers as does upstream OpenSSL (bnc#1021375) - do not generate certificates in %post. End-user needs to do this manually. - keep FreeTDS disabled on SLE12 - we never shipped it enabled - require OpenSSL 1.0+ - use pkgconfig(systemd) instead of plain systemd as BuildRequires - don't list manual pages as %doc- Remove --with-pic which is for static libs only. - Use SUSE RPM group names. Trim filler words from description. - Do not hide errors from groupadd/useradd.- Add upstream keyring - 2 new modules: rlm_sql_freetds and rlm_eap_fast- update to 3.0.12 - still fate#320481 The focus of this release is stability. * Feature improvements + Add support for =~ and !~ in update sections. See "man unlang" + Add dictionary.checkpoint. + Simultaneous-Use prints out more information. + Print WARNING in debug mode when packets may be truncated. + Added expansions %{home_server:state} and %{home_server_pool:state}, which show the state of the server / pool. + Mark rlm_sql_freetds as stable. + Make rlm_perl less fragile. Patch from Herwin Weststrate. + Allow extended attributes to have "encrypt=2" + Update dictionary.aruba. + Add support for EAP-FAST. This is an isolated feature which does not affect anything else. + Update OpenSSL vulnerability list. Use a version of OpenSSL released after September 20, 2016. + EAP certificate verification is now done when "verify" is enabled and "ocsp" is disabled. + New dhcpclient and rlm_rad_counter man pages. + Minor abfab and moonshot additions. + Pass CFLAGS through from environment in RPM builds. Allows more custom builds. + Build with Heimdal in addtion to libkrb5. * Bug Fixes + Use correct typedef for older versions of sqlite. + Update mssql schema to add priority + don't complain on /dev/urandom in ldap + fix == operator in update sections + Don't create DHCP strings with many trailing zeros. + Allow MS-CHAP change passwords instead of complaining on large buffer. + Allow assignment or equality operator on SQL. + Update aclocal tests for FreeBSD 10. + Remove occasional hang in rlm_linelog. + Copy VSAs to inner tunnel for TTLS and PEAP. Fixes #1544 + A few minor bugfixes caught in v3.1.x cleanup, and back-ported to v3.0.x. + do_not_respond again works in post-proxy + Allow realm "~^.*$" {} and User-Name with no realm. + Fix leak when creating unknown attributes + Fix Debian / logrotate. + Make OpenSSL error functions thread-safe. + Fix crash with rlm_sql and updating SQL-User-Name. + Debian build updates. + Allow regular expression comparisons in radclient. + Fix memory leak on unknown attributes in detail file reader. + Update example paths in "man" pages when installing them + Build fixes for rlm_mschap. Fixes #1489. + BSD build fixes. Patch from issue #1583. + Be more careful about /lib/ when building. Fixes #1585. + Correct ifdef placement error. Fixes #1572. + Allow for more files in internal "exfile" API So it will be possible to open more than 64 "detail" files at the same time. + Remove support for statically built EAP modules. Fixes #1591. + Many fixes to rlm_python from Guillaume Pannatier. + Use correct week adjustment in SQLcounter. Fixes #1608 + Minor fixes to allow compilation without DHCP, VMPS, or TCP. + Fix checks for module / config file change on HUP. + Compile regex comparisons when sent via "debug condition". + Update filenames in documentation and examples. + Don't crash if SQL connection becomes unavailable. + Disallow originate_coa when proxy_requests = no. + Free rad_perlconf_hv in correct perl context. + Multiple fixes for Debian builds. #1510, among others. + Set OpenSSL FIPS compatibility flag when necessary. + Pulled fixes for the build system over from other branches. + Fix OCSP for RADIUS over TLS. + Fix skip_if_ocsp_ok behavior. + Better fixes for systems without closefrom() but which have /proc. + Minor build fixes back-ported from v4.0.x. + build --whout-ascend-binary. Fixes #1761. + Be more aggressive about not opening new connections in debug mode after CTRL-C. Address #1604.- use %{with} macro for conditional inclusions instead of hardcoding version numbers - improved package descriptions - fixed builds on SLE12 and SLE11SP4- removed installation of experimental module rlm_sqlhpwippool.so - update to 3.0.11 (fate#320481, bsc#961479, CVE-2015-8763, bsc#935573, CVE-2015-4680) * Changes of version 3.0.11 + Feature improvements - "unlang" comparisons of IP addresses to IP prefixes are now detected, and types automatically cast. - Allow shorthand form of ipv4prefix values e.g. 127/8. - Add "auto_chain" to raddb/mods-available/eap, tls subsection. This allows the disabling of OpenSSL auto-chaining of certificates. Which might be wrong. - Added printing of coa and disconnect stats (radmin). - radclient defaults to expecting Access-Accept responses to Status-Server. - Updated dictionary.lancom, dictionary.starent. - Portability fixes for Solaris. - More errors from ntlm_auth gets passed to MS-CHAP. - Update abfab-tr-idp virtual server. - Added "filter_password" in policy.d/filter. This removes embedded zero bytes in User-Password, for compatibility with broken clients. - The server now issues a WARNING message if duplicate configuration items are found. - TLS can skip the "verify" section if OCSP returns OK. See raddb/mods-available/eap, "skip_if_ocsp_ok". - Set TLS-OCSP-Cert-Valid = yes / no / skipped, which is the result from the OCSP check. - Interoperate with AD and "LmCompatibiltyLevel = 5", by always setting WBC_MSV1_0_ALLOW_MSVCHAPV2 for native winbind in rlm_mschap. - TTLS and PEAP now require "virtual_server" to be a real server. - Print WARNING when TTLS or PEAP identities are spoofed or not properly anonymized. See RFC 7542 for requirements. - Various rlm_python fixes from Herwin Weststrate. - Allow setting Response-Packet-Type in "Post-Proxy-Type Fail", which is useful when the home server does not respond. - elasticsearch updates from Matthew Newton + Bug Fixes - Fix issue where field nas_type would not be accessible via the %{client:} xlat, for clients loaded from SQL. - Fix compatiblity issues with OpenSSL 1.0.2. Ignore calls to msg_callback with 'pseudo' content types. - Data type "ipv4prefix" is parsed correctly. - Use correct talloc context in rlm_exec. Fixes #1338. - Complain in unlang if "else" is used with no previous "if" or "elsif". - Send accounting status packets to the accounting port. Fixes #1364. - Print out CFLAGS when doing "radiusd -Xxv" - Fixed bug with coa/acct stats value #1339. Based on patch from Jorge Pereira. - Fixes for LEAP proxying. Don't use LEAP! - Fix issue with "directory already exists" seen when doing "make install". - Fixed bug with radmin related to the option "stats detail " - Complain if the detail file reader does not have permission to read the "detail.work" file. Fixes #1398 - Fixed SoH. Attributes were not being copied to the virtual server. - Used a wrong list to global statistics in "stats". - Create EAP-PWD identity correctly. Prevents segfaults. - Dynamically validate authentication types for PEAP and EAP-MSCHAPv2. - Fix includes in installed headers. - OpenSSL 1.0.1f and 1.0.1g do NOT calculate TLS 1.2 keys correctly. See raddb/mods-available/eap, "disable_tlsv1_2" - Allow password change to work for MS-CHAP. This requires 'r=0', because password changes are not retries. - Fix home server fail-over for home servers using TCP and/or RadSec. - Special characters in expanded regexes are now escaped e.g. User-Name containing '.', and comparing /%{User-Name}/, the '.' will now be escaped. See src/tests/keywords/regex-escape. - Use correct authentication vector when sending Access-Reject replies for RadSec. - Set FreeRADIUS-Proxied-To in TTLS again. You should use the "inner-tunnel" virtual server, instead of relying on this attribute. - Fix debugging constants in rlm_perl. Patch from Herwin Weststrate. - Add samba-dev / samba4-dev to debian builds so that rlm_mschap can automatically use the new winbind API. - Automatically skip zero-length attributes when sending packets, instead of erroring out.- fix bsc#951404 * Rebuild of freeradius-server package fails * fix source url - ftp://ftp.freeradius.org/pub/freeradius/ + ftp://ftp.freeradius.org/pub/freeradius/old/- update to 3.0.10 * Changes of version 3.0.10 + Feature improvements - Do more optimization of unlang policies. This makes run-time a bit faster. - Re-name most of the functions in src/lib. Third-party module authors will have to do the same. - More documentation on contributing and how to write modules. - Update radiusd.service for systemd. - Open IPv6 proxy socket if the server is listening on IPV6 auth / acct / coa packets. - Create debian packages for DHCP. Fixes #1125. - Add more tests for "update" section parsing. - Update "man" pages. - Update attributes for Alcatel 7750 - Add dictionary for Boingo Wi-Fi - Add support for DHCP lease queries. See raddb/sites-available/dhcp - On HUP, check all modules for config files which have changed. And only re-load those modules. - Allow FreeRADIUS-Response-Delay(-USec) to be set for RADIUS packets. Patch from Herwin Weststrate. - Documentation fixes from Alan Buxey and Matthew Newton. - Update "logrotate" script. - Added more RFCs to doc/rfc for new standards implemented by FreeRADIUS. - Don't crash when doing "radmin -e "help hup". Patch from Matthew Newton. - The dictionary parser now does more sanity checks, which prevents run-time problems with invalid attributes. - Update debian packages. Patches from Christopher Hoskin. - Many other debian packaging fixes from Matthew Netwon and Herwin Weststrate. - Add "session-state" to Perl. Patch from Herwin Weststrate. + Bug Fixes - Fix rlm_files so that there are no collisions when loading 10's of 1000's of users. - Fix radclient to use our internal v4/v6 parsing functions. v6 addresses with ports now work correctly. - Fix sending/receiving packet messages to wrap v6 addresses in square brackets '[]'. - Check for sasl/sasl.h when building rlm_ldap, and disable SASL functionality if unavailable. - Fix issue which caused a non \0 terminated buffer to be assigned to attributes if the value being assigned contained an invalid escape sequence. - Fix deadlock when reconnecting connections in the connection pool. - Fix potential overrun in functions that used fr_utf8_char with a non nul terminated buffer. - Fix decoding issue for Tunnel-Password type attributes which were very long. Found by Denis Andzakovic. - Fix radclient issue with TCP sockets on FreeBSD. - The server now creates ${run_dir} and ${logdir} directories in daemon mode, when running as "root". - Handle tags when using maps. Fixes #1191. - Fix crash when CoA packets time out. - Fix parse error in rediswho - Fix regex support in SQL radcheck the "users" file and radsniff. - Register listen xlat earlier, so that it's available when the virtual servers are being parsed. - Parse Ascend-Data-Filter when given as "0x..." - Print Ascend-Data-Filter correctly. Add test cases for both. - Allow old-style clients again. They will be disallowed for 3.1.0 and following. - Complain instead of crash when "else" and "elsif" are in the wrong place. - Clean up memory more aggressively. This lowers the maximum memory used, most typically for TLS based EAP methods. - Prevent the server from unlinking the control socket of an already running instance. - Fallback to using the configured OCSP URL if one exists, and no URL is provided in the certificate. - Return CoA-NAK if proxying CoA fails. Based on patch from Jorge Pereira. - Lower peak memory usage by decreasing size of internal memory pools. - The control socket is now left in place if a second copy of the server is accidentally started. - Allow virtual attributes in "switch", "case", etc. Fixes [#1240] and #1265. - Many spell check / typo fixes in comments and example configuration files. - Better handle multiple DHCP listeners. - Don't print secrets for old-style realms. Fixes #1267. - Don't fall through in empty "case" statements. Fixes #1274. - Update EAP-TTLS so that MPPE keys are correctly calculated with TLSv1.2. - Always delete MS-MPPE-* from the TTLS inner tunnel. This allows TTLS / EAP-MSCHAPv2 to work. Fixes #1206. - Fix off by one error that caused some MSCHAP-Error messages to be sent without the password change version (V=3) and the textual message component (M=). - Always include C= V= and M= in MSCHAPv2 errors. RFC 2759 does not say that any of these fields are optional, and not including V= caused errors with wpa_supplicant. - Do not include M= in MSCHAPv1 errors. It's not supported.- Fix boo#912714: freeradius can't use ntlm_auth * Create winbind group * Add radiusd to winbind group- Remove gpg signature file * The gpg signature checking is broken and doesn't work- Fix bsc#935573: Insufficent CRL application for intermediate certificates * CVE-2015-4680 * freeradius-server-CVE-2015-4680.patch based on https://github.com/FreeRADIUS/freeradius-server/commit/a03814af310bb3bee74ea012546d99c48b0ea5c3- update to 3.0.9 * Changes of version 3.0.9 + Feature improvements - Make "pool" configurations more consistent, and update documentation for them. - Move connection pool logic to "most recently started", instead of MRU. This should help with pool stability. - More VSAs for 3GPP2 - Added examples of multi-value attributes to rlm_perl. - LDAP-Group and SQL-Group attributes are now dynamically allocated. - Only the "sql" module registers SQL-Group. Other instances register "instance-name-SQL-Group", similarly to "ldap". - Unknown attributes are now complained about more often when used in unlang statements. e.g. if (Foo-Bar == 3) used to be a string to string comparison. It is now a parse error. - Rename RLM_COMPONENT_* to MOD_* in the code. This makes many things easier. - Move to C99 initializers for modules. - Load modules in raddb/mods-enabled. This allows attributes like "LDAP-Group" to be used in the "files" module, without explicit ordering or listing in "instantiate". - Added 'bootstrap' section to modules. Third-party modules will need to be updated. - When adding clients from a DB, add them to a virtual server if that virtual server has a "listen" section. Otherwise, add the clients to the global list. - When reading dynamic clients from a file, don't expire them if the underlying file is unchanged. - Allow the server to originate CoA requests from the post-auth stage. - The server creates ${run_dir} and ${logdir} in daemon mode, if they do not already exist. - Add dictionary for Wi-Fi Alliance Hotspot 2.0. The server now supports all mandatory and optional attributes for this specification. - HUP now re-loads the configuration only if the files have changed. If all files are unchanged, HUP re-opens the log file, and does nothing else. - Much better debug messages for EAP-TLS, including which attributes are cached, and when they are retrieved. - Increase default max_requests to 16384. Memory is cheap now. - Added "stats memory" commands to radmin. Debug build only. - Aptilo controller dictionary updates. - SQL modules now use Acct-Unique-Session-Id everywhere. - The redis modules are now stable. - The LDAP module now supports SASL "interactive bind" method. This allows Kerberos based administrator and user binds. - DHCP code is now in libfreeradius-dhcp. - More DHCP encoding / decoding unit tests. - rlm_replicate can now be listed in the "accounting" section. - Better sqlite debugging output. - Remove "required" option from many sql_ippool directives. - Set default CA "basic constraints" to "critical". Fixes #1073 - Updates to help / man pages from Jorge Pereira. - Added more tests. + Bug Fixes - Be more careful about unused config item warnings when using -Xx. - Move more defines to be auto-generated. - Allow virtual servers in proxy fallback. - Allow %{module:} to work. - Don't crash in RadSec. Closes #980. - Return better errors when a unix group / user is not found. - Re-enable detail module "locking" parameter. - Don't crash when logging replies from Status-Server packets. - The couchbase module now uses "update" instead of "map", for consistent with the rest of the server. See raddb/mods-available/couchbase - Don't require NT-Password for MS-CHAP password changes. - Be a bit more careful about decrypting MS-CHAP-MPPE-Key attributes. Closes #1013. There is no perfect fix, tho. - Fix security issues with EAP-PWD. See http://freeradius.org/security.html#eap-pwd-2015 - Fix dynamic clients read from SQL in non-debug mode - MS-CHAP now allows retries (i.e. password change) when passwords are expired. - Allow "user=radiusd" when the server is already user "radiusd" - suid up/down works on non-Linux systems. This means that the control socket should have the correct ownership. - Fix issue which caused the server to sometimes have problems when a home server was marked zombie. - Fix format.pl because Perl is now more picky. - Fix proxy to Packet-Dst-IP-Address, so that it uses the correct destination port. - Fix corner case with cursor functions and removal. - OpenDirectory fixes and documentation. - Fix leaks in rlm_redis. - RFC 6929 "evs" attributes are now encoded / decoded properly. - Fix talloc pool leaks when receiving malformed or retransmitted Accounting/CoA requests. - Printed attributes again use double quotes instead of single quotes. - Set X509_V_FLAG_CRL_CHECK_ALL, and add "check_all_crl" to eap.conf. Fixes oCert CVE-2015-4680. - rlm_expr now errors out correctly on malformed attribute references instead of triggering an assert. - Make "break" work in "foreach" loops - Allow dynamic expansions to work again in the "hints" file. - Correct minor typos in comments and examples from Alan Buxy. - Re-urlencode the path portion of ldapi:// urls before passing it to ldap_initialise. - freeradius-server-rlm_sql_unixodbc-configure.patch removes hard-coded directory in configure script of rlm_sql_unixodbc - install new module rlm_sqlhpwippool.so- minor adjustments/cleanup of spec and changes- update to 3.0.8 * Changes of version 3.0.8 + Feature improvements - Allow syslog_severity to be set in rlm_linelog. - Allow defaults to be set for bulk clients in LDAP and couchbase. - Updates to dhcpclient. Patches from Nicolas C. - rlm_mschap now supports direct connections to winbind, which is faster than ntlm_auth. See raddb/mods-available/mschap. Patch from Matthew Newton. - Recommend /dev/urandom for TLS randomness, instead of ${certdir}/random - Allow TLSv1 to be disabled via "disable_tlsv1" in tls{}. - Allow Expanded EAP types where vendor is 0 (IETF) and type is normal EAP type. Supplicants sending Expanded EAP types like this are broken. - Add support for server side sort controls when searching for user objects in rlm_ldap. + Bug Fixes - Don't complain about "authorize" in "server {}" blocks, but only if there's no "server" block. - Fix cosmetic issue where debug from the first packet read by a detail reader thread would be emited during config parsing. - Fix ASSERT on truncated detail packets. - Don't use main server log functions from within panic_action, as in the case of syslog this would cause deadlocks if the fault was triggered from within a malloc. - Fix issue in "switch" when "correct_escapes = false". Fixes #911. - Fix sqlcounter configuration to use "%%b" instead of "%b", otherwise the new syntax validation will fail. - Allow forward references in configuration items. Modules aren't always loaded in a sane order. - Fix more escaping issues. Closes #912. - Decode MAC addresses correctly for VMPS. - Fix memory leak with TLS connections. - Fix state machine threading issues for conflicting packets. - Fix copy_request_to_tunnel issues for tagged attributes. - Allow "ok" to over-ride "updated" inside of Auth-Type sections. - Update state machine so that post-proxy is run though child threads for performance, instead of blocking the main thread. - Allow "netmask" to work again in client definitions. - Relax restrictions on SQL group queries. - track outgoing proxy sockets and clean them up more aggressively. - track proxy statistics, including CoA and Disconnect. - If radmin has a connection failure when running a command, it re-connects and runs the command again. - mark home servers "unknown" less aggressively. - Fix potential SEGV in PostgreSQL driver on error. - Fix issue where fields like nas_type would not be accessible via the %{client:} xlat, for dynamic clients. - Set default busy_timeout (of 200ms) in the sqlite driver, so writes don't cause selects to fail in multithreaded mode. This is user configurable, and may be increased if required. - Convert Password-With-Header attributes to binary (from hex or base64), in the authorize method of rlm_pap. - Fix invalid assert in state.c, that could cause abort in post-auth. - Fix double free when -m flag is used, and connection pools are referenced by multiple modules. - RADIUS over TLS accounting uses the same port as authentication. - Regularized return codes from radmin commands. - Fix RHEL spec file so it works correctly for Centos7 which uses systemd, and didn't like the SystemV init script. - radwho and radlast now have a -D option to load dictionaries - DHCP packets are no longer checked for duplicates. - Don't crash in sql module group comparisons in corner case. - Calculate MPPE keys correctly when using TLS 1.2. - Fix load-balance sections. Closes #945 - TLS certificates are available again in the post-auth section. They are not available for session resumption. - radclient encodes CHAP-Password properly when using -c Closes #955. - Fix issue in rlm_cache_memcached driver that caused variable length values to be truncated. - Fix track functionality in detail reader, so it no longer fails with a "Failed marking detail request as done: Bad file descriptor" error. - Actually add the peer identity (as User-Name) to the inner tunnel in EAP-PWD requests, so it's available for lookups. - Fixes to PostgreSQL queries. Patches from Santiago Gimeno. - new set of consolidated patch files: deleted: * freeradius-server-2.1.1-logrotate_su.patch * freeradius-server-2.1.6-rcradiusd.patch * freeradius-server-initscript-pidfile.patch * freeradius-server-radius-reload-logrotate.patch * freeradius-server-var_run.patch added: * freeradius-server-radiusd-logrotate.patch * freeradius-server-rcradiusd.patch * freeradius-server-tmpfiles.patch- Do not disable as-needed build - Remove the with_sysconfig switch and just stick with versions- update to 3.0.6 - fixes a segmentation fault in PEAP module (bnc#912588) Feature improvements: * radmin / raddebug conditional errors are printed to the output, instead of being discarded. * raddebug will exit if condition set with -c was invalid. * radmin auto-reconnects if the connection to the server has gone away. * rlm_cache now has submodule support. See raddb/mods-available/cache * New memcached driver for rlm_cache. See raddb/mods-available/cache * Add support for &Attribute-Name[*] in conditions. See "man unlang" for details. * Add &Attribute-Name[n] which gets the last instance of an attribute e.g. Module-Failure-Message[n]. * Allow for redundant string expansions. See the "instantiate" section of radiusd.conf. * When checking IP addresses in conditions, make the right side be parsed as an IP prefix. * Support JIT compilation of compiled regular expressions when built with libpcre. * Support named capture groups with "%{regex:}" when built with libpcre. * Increase regular expression capture groups from 8 to 32. * Emit error markers for badly formed regular expressions. * Allow 'm' flag to enable multiline mode in regular expressions. * Support limited implicit attribute conversion in update sections. * Support casting between IPv6 and IPv4 where the IPv6 address has the v4/v6 mapping prefix (::ffff:).- Drop .keyring and .sig file: freeradius-server still uses MD5 signatures, which are no longer validated/accepted by GPG 2.1.- update to 3.0.5 Some of the new features: * Allow LDAP to specify arbitrary attributes for dynamic clients. * Allow one level of backslashes (finally). See radiusd.conf, "correct_escapes" setting. * When supported by OpenSSL, allow TLS 1.1 and TLS 1.2 in EAP methods. * Allow multiple new connections to be spawned simultaneously in the connection pool, to cope with spikes in traffic. * Use kqueue on systems which support it. This allows for better scaling when using many sockets. * Home server "response_window" can now take fractions of a second. See proxy.conf. * radmin now supports "show module status", as thee counterpart to "set module status" * "ipaddr" will now use v6 if no v4 address is present. You should use "ipv4addr" or "ipv6addr" to force v4/v6 addresses. * "client" sections will allow "ipaddr = 192.192.0/24". The old "netmask" is still accepted, but the new format is preferred. * Allow custom HTTP headers to be set for rlm_rest requests using control:REST-HTTP-Header (attributes consumed after use). * Extend format of %{rest:} expansion to allow HTTP method and POST data to be specified and urlquoting. * Add support for aliases in rlm_ldap. * Add support for connection pool sharing to all modules that use the connection pool (pool = ). * "tls" sections now have a "psk_query" configuration item, for dynamic queries to discover a key from a PSK identity. * Preliminary support for EAP channel bindings. * Foundational work for dynamic home servers. They do not yet work, but this is now only a matter of updating the "realm" module in a future release. * Support &attr[*] syntax to copy all instances of an attribute when used with the += operator in an update section. May be qualified with a tag. * The logintime and expiration modules can now be listed in the post-auth section. This makes some configurations simpler. * rlm_sqlippool is now IPV6 capable. Set "ipv6 = yes" to get Framed-IPv6-Prefix returned. The SQL queries have NOT been updated. Please submit patches. and numerous; bugfixes - remove gpg-offline - create /run/radiusd after install - drop freeradius-server-opensslversion.patch (upstream)- freeradius-server-opensslversion.patch: do not check the minor version of openssl, minor versions are supposed to be compatible. bnc#906682ibs-arm-1 1613552920 3.0.21-3.6.13.0.21-3.6.1dhcpclientmap_unitrad_counterradattrradclientradcryptradeapclientradlastradsniffradsqlrelayradtestradwhoradzaprlm_ippool_toolsmbencryptdhcpclient.1.gzrad_counter.1.gzradclient.1.gzradeapclient.1.gzradlast.1.gzradtest.1.gzradwho.1.gzradzap.1.gzsmbencrypt.1.gz/usr/bin//usr/share/man/man1/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:18279/SUSE_SLE-15-SP2_Update/9c7f074efad29e98ec7d42bac29d6719-freeradius-server.SUSE_SLE-15-SP2_Updatecpioxz5aarch64-suse-linux ELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, BuildID[sha1]=52294c5080559b5961b8212cb06bc9eca8e3d3ca, for GNU/Linux 3.7.0, strippedELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, BuildID[sha1]=da6bc327c88b7a27392737076319c8da394c4e16, for GNU/Linux 3.7.0, strippedPerl script text executableELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, BuildID[sha1]=04225d8122ebec6181374c54d213d3bf88d2551d, for GNU/Linux 3.7.0, strippedELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, BuildID[sha1]=d8255debb22e759eca8d63e30c8f9cc94c92a459, for GNU/Linux 3.7.0, strippedELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, BuildID[sha1]=214f946988b27814120991bc604de77f14f168d3, for GNU/Linux 3.7.0, strippedPOSIX shell script, ASCII text executableELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, BuildID[sha1]=e0836bc2a7057570fcb136457a4a49f6cd7c1c3e, for GNU/Linux 3.7.0, strippedELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, BuildID[sha1]=7db9ffee1a51a26647f87fc9595a9eb6b466fbe5, for GNU/Linux 3.7.0, strippedELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, BuildID[sha1]=9f0eebf4692c5677b421c7c912636be234a24686, for GNU/Linux 3.7.0, strippedELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, BuildID[sha1]=566f60ee5c617a4bcfaeb2045ee82c4798493da6, for GNU/Linux 3.7.0, strippedtroff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix) ()9:DEFPQY    RRRRR RRRRRRRRR R RRRRRRRRRR R R RRRRRRRRR RRRRRRRRRRRRR R R RRRRRRRRRRRR RRRRRRRRRRRR R RRRRRRRRR RR RRRRR RR_3}׼@NHLutf-829685f0c8ca1d56e2644bb5a5a3d44ecbc8ff121a577874dc73eb8706db7dcf6? 7zXZ !t/] crv9wMs_@U8;65ʖ3 HZVUHG.J­dž=/[bL@nH]UV(.{{nA*ϝ*_p@[AHezt3 m:7d .:Mn8S2";fRxdaݔՅW./r!m$4B?.ӉFl߳:@ՂȲ9_KsC3L T6-ct#J0HC{4j4,)6ǎfӢzr]QZx=voCH"_?)dZIڦYdrx΅O;ޓJLQJZÿ!_AZeHm ,ln]] 5u{O¥+ ܝ1Suc(G9| y "[qmlZ;1xC0QRTGA4 L"e%pвЮ#@_pM@ }"'t=r?C+mʋjd+dpׇُ"m@Zj^;6 x= _䍹} EF1:>ϡl/#.| !XbF">*g(B# ^ͿseGOm17}]kg]̟CS^+wkw!G}f5ބB$E|2E1rl;70$}MB0rwKff`t|^o&R ;]eyMwn`_9henTۊ'Ncw)r£= s328a"l 9e/Gs&Bf2# /)k%i 7G߹%{W/`C ma?1df""~ /.pb:X\Mʓ[6Syb[8nB qC /h&-.} ͉jI~#d: j?E@ yUF0-FH4BC[)>1j[挧M 4Mg3 LQ^n3w@{ZHC?3̚\/6ח2F?>KӴuA~6Lk$:uѦD 7?#r6GT̅ +L[t\ؽ՝ ։XmA\6\G}쀓kK†R؎QmO:E."U4c\moQD 7&#ժE.$i*oD88 Ili=8\\~Wsl EIe?ZFq&w\X=ǁz^W<*0+TUBwl)GZςo |n2;iп֐0@,^lq8ԧ; Oҟ[\EW$~T&O&@Xv':}UkJbtvCn^_f.'s1+DވZ :3Pgؑ z ip s]QBlGpX'|P"ݳ*G OU9޻eF}mtk@YcA I:oBe6pL0szS*@k[t36<'bLh[x%e@K;$.s[ؓ>ge DO[3xsU^ J Lm&_,P0p8f;f z#+#o`)|f/e!ͭ\>l!-(GqG_5Vw31-6)oeҠK12G:ǿ;(9sm9D\ߚHsg$+ir7oFO(wZ*uscibHnw㦂y9l iX~)QYϳ)&b ֫7Y慌5(QcPÎ9QY UtN'w8K/~^9m7筨Efefb$˘:śZuX^e1'XX܆) o@;Gsp(]DcE?hFxƚ([}kF"I$¡Dxo-T*Wh};4efui(os9g1{c- ss Y|IG_FDvd@'Ph7-gi gtI; =.5|t3QѼvTwM;ć0D8Oؽ@v/_=]jn @Y[y& `y>95#EvI6 J73#BL (:HHt^Qx4=+I4E0D4͎TC+xrV^-%6צusg}Z$k]GL)d$.;DҀMka7A9>i?3Olk9k) `h"jnt0^`QUb9IAbqG0bVJԌ-AW., 5+n6!,>ҭQT휯 $8`YTg ʾ:Q? z~<0JE1ϳ$iTWHsFQM9anGYLu#/OP&+2!МۥR7PۆlsQPHj9["3lUU zYjnCwrE0k P&nh<[E:FmGD`{Ww^;t &+eߝMXוGo?(5:!_}ӬNXPxv9]0b'6ږU"@R67@[.lG-!!Oכ4/ZX41+JږNjX&iZDybVmнW#J7r~(6 A2{?hTKKШa/ywEǍsfNPi)e;]L-@4[_bVVs|; lG82>uT*T54AZ^ Hfm @A?Zk-|&K,NrΈ;R-{%Q>4GLrbf>rw8=fDR& '+ -cDw|r3 g`J6fh\[^!;~Zvt5 *7 xn7z/P'2f ø'*-p%ģ@2ҸmuRkbX;Ŵ `=[9⳦HmȰRKTQ|q3\0/>DGQ_Wm*Pq;dBZnNl!(&:vF9_ u$ׯ&Gًt#b\ 5H_A9U262akz8nHǑtܹXBYS o3t=C=_AFi;uo&cwH>I6!.Q-{K@NV\XnKO WDK42$s!`Ҧ:<'6lᤫb;5S'VjN~#?aLĺ|> ~SB.&.$m?eX>|y'[y?&Ź{etg)h?FE7}S-f$ еYrv)J}~ocQ1- @?'miY9Oyg.y"DE +e~K oI~U~D*p`~v1 $, Jz>Vw"}RvC\@E&3(5R-Erj/cp藂d/+ZFpJM_?k蚅Gzґa3b\ݖ?|m4ʏLY"'l o*#z^ltvi,7Ek (zY{$AGߤ͓i MWspGd%R75 ԹMvʍ,$;mv}az[Q&O4V1DVJhBj=9#g$hrSي1>u1=o_7恼{>HƾUߑCu1#߹@M74$،U]-ҖlysZLB̤*YM!lX3CP~j2KQ?Ibx7 u[#{7(z~oO)y4>t%v ku{;Y&D1v}hEU&Wl7{BtQqHSd|RXԞЯǫ1o(!|3Ȱ+`[re|u:9_+AE)K )Ԣg;ğ8cdlH2Va`Fz7*-#STaoyaәS7sj ͂a;#4&?u3t/I4-U1r |njrKB"}sO'޹Et]iyaxQЯon'`2tP@2X0ٞ30@=!G9MFu^p Av88\++U,ͩԯ?m)dg^vk:+5Mqwț\,4t:j qFsQ.9,?aG> Sz̞)|AL蠿`./?EO9c L71iL<_Z#9k^㶄g +M/Q"J' sE1,Y%JG+?ciG,%,R5A,}͵wdA&Z0h{9tLwxz3)Slm]޳M4qM\icp|,2;rlnҔ H>p뮤j4۴+?v[Q[FO./]?91z I_{NՐEݦslɋPv+ !K]#R?!-vNFAX"JrE5pnCmucU6n0Kg^ej)G*F)V*PԒf@Aq顁 ] jeMQ %ڽ]Y8l$Xq9(Y MV,q0UmLAn3&^>(;?Ɉd "E"Rk0lIڴﶝ }ۘ-ޤҒWHK+s2'~T6a$_g IZYgYCz^](}gވ Qn/{,،8~q/Db6|E$x`zMd,LCzBaq܌ŷx=~z[!~ͷ:t{GW0 >wTcSn%ÌMƝI/-Wp1`D-%WLH!H,cŋl!}"-UgxlgDH"~3Äy4TJHI9&nk{r>DQa.13?WX(|}"4TۧVu'4UHRqoea (Ujc/0j|{a؛ܯ)%kp7jүFxFb)=i~kStY]Itқ4*͉p`رNIx2U26Wgg1AI%+fU*>T~/De9IJ[ZC{f,KFZv`0} $<(<^Lheċ%Ćp!_S*>\io-<ۮf0P݀pTVt\&\)|] HB(`4y:Y0@!1&Hޖ#&j(|&]ϒu,:|ghKu6p[]PH*n5<сR}5Y޵m8~ `\WBW8GRv_;av}N+e#s}\E\Un[ycl7|y{4@XHUHهΩ %&3) 1 "%]6ŃďmLQ ,pPr}B 2 Q]dɊ,_9c|ZpS+rUxN"~,[[[|Cx\$J捅NƑ Y^@|2إ ԟ_Zվfa7~E#`T6C)8$ՑGc[ 0])[תC 7Ro]=/U.=$97Z渏5L&n P5*:Uؤ[J*q7@|IVsry'%%b"]1/j5̈́' 27Ӣ困dHxozD"Y{\ө.AŔL7;!h)%8cq6YO'7Sֳ ,kT8㡲^0=(ֶM$*uE{hn[b >{ i韉#rk("[l+3ۘr߼etZ,W81& ;F13CQ4DxvMĂ]MЪ 4XI0]kgj1Zp!!CE\s>RR(1SuD6ddܪG J& dˡĜ$PH$+aO"* MB%0S j ]܃&H5=l%Rq5lhgCW|@2b$U汜Nhϊ/񑬁t؂2Cq 0NlzDhMbg,ڊ> 8l6h环@ǫ\ D7=d:/gpZGvSԀ &WhT].,d/mSayU 稍${$)&QS;)?qm 79]cGV5R.eϕyP+ݮw.k|Vf@"'ǎQh=_#amZ }e7>f˅/ܦe$#"$;SyݬzNc oGD91AY1 a& lWvw[2&Yp3g3o*+B*FDǖgɕ(}q@5t'4m Jr(1 G blJo iF-hb~bz=z(ܠ,|۞5?j4 :z̠FN+S: JìNL;?:-'g3*K%ǧPàiid,X oˌpHsPOtlZP2ybfx4F@zAoei4 7ώ⥋e%t;Upo;sgڷDہ!ʂu6d2[BK^#"V34?do  v3Zxݼ.Fqg-J|'AsJZUku`_-u~| TJ$9!HX,j4[u-YҦT 3A0P@X5u63h<[RʖQvkgةj y`ܯٞt\?4I~Űv~o,!_CӈD=RL0'iTwʾ:4nߓ1A)?_7MℏD,\MD'Νٖ¿vD.$Gx- |1xO&ErU`x SVnTMkobTbN阷"F]'N1Ac b:f\ux٪Y3ʕA=f aRNPj}k:B=@n}bǿ;~_ NmY>dSęj\s.*`31XOOǒԽאelW0 R}$n'^0׬2Րvymrg#d|0DVa(O&Οvy2dtkw XuR<=+ )pc햠V/68׫k.]c[M^Oڝ ,wQ_\@!~-{,Vd9 6(b? 0':?'ApʹZK=,4w7.cAJ MsB&jkMM"xϱB17W9A% JVLMV'ke`cj?r.oЗY1ݜWT_ΨW ĨU0BPhr%W==}7<)xeFܜ oOQ^S<?RxPqgGvn{2a qDk2֏(e+0I7eO{F|g)8rZy"`B :,(H4JHn|+.;(8M_L -JѰO4~{8h<Qqq|L8~Cyw6yWBs'gJߪ<誎Y]5K3iAxsJ)s,G@4xG߂(>Zm{:EbǺ8ÀP =Y[8H;C4{uݕƦ%2bKX.?ص(r27 .Ѣ&vۥ{p8baOR1WS޳GثQfaTr0 b j{\cyB?, Q}ʲ:ѻ D$K/I&]XV]j"[&:auC'-2']a-^igiٷbW]@͛J| @oD?`pD:<,.bhZꖿ%@l ǥʕ_nR1y2,wkƖ{ML%lBտ9?b^&=?o--<*>r'93Rcr,~azYGs"C~kFBDy=w*!d[IDcNN}#MyѸ$խJyEcSʙr4_!GN}..HZXOFmp^Fb:rP a%8.i4Mn, ^CUq֮t@ _D]}յ)?=F75Zy {niGtB$ÉkH+`.P6bdC1w1a<#_uZHI|m59[Smܫ⦐5e1~Ѿ(I;XFknx5M#&e?? =w5hGO(&H(B d\ڛl)N5/2p0p%G|iFm__+8|1h@֭I ~zE}g$ V=Xe\:p݇'4cMݒش- O}OH< 0Pcd=2η6YG4rLa[ҁssyA\309"r 47jTHWC!;~å+[a@& nӲJ9% )Co\(a+Og ܘ*"EQlT:Fn^^5ƒ&O׳@\cz'ILa hghI߹A{O-*)0fo\aI $*v$;'wcT.4U?AnT"M4hk6-QoPvPb", # [QeWzRш(X1gG1pB>Z:kI_)rB=buGll!꾊, 6V_b\a6.(IR&#*mF=d_>iu6[% l4J|^׾Vf@9h@a3&Jyk`нFeOH/[{'̬^`RXrfb م{HתSm`I{21OΆh&'LO?rQ!Xj&`#˾[Dm@&Y.kz=,֫$X.{L4*~FK ?de_~WX#dJq!$ Fnt!UG-׳HkX]cI'MŃ'z*)&M-[Bjd (s$jz'Ѷv",='/§k.g ͓;d p풾ce\`~hLNOık\ڕkuKP/|_S?~ںr6m<`vAPqE4%FC{SQ{BNW͍RhpNGDme\rdIg?s2 J)*$-4~!@Ӧy=E O^$(2_g5F!X? EfVs4:20꓎MV[˟9BE7T)ȹVɉDj5@LWaoe@ Uxybq: wI C4QK$}FPfFX7%-%Dp$V5K$e<*3ӿN+]"wW;]qІTe<JeuPatixէ[ˍGfA_#\R;5d:ItY|/Lë&֮z@ĶsUgJCl, 9v{޼^nPa>-7hÉjזqd:L8A8#0rKXӣcRޒ3 lB87폳:V8=E$f$ . Jq-j?cTFvuƖ C\7e_a!BMwǀ*>3\}'uZfzIa9 |mLw ә69hxFC۱o-##6dm>O˰mf*DzVTOf- ZX9 b$gQ(=oQ+廁j$S[|?IA8jAReģŞcR1?͌_N]9"GMN$z3{U)Utu~|} ^mS|%`V8^w\ʺoE U"Xŷl-ɝ-ݹ~q6*%j_fBY4Va$a0kήgO-))feX0 B@NTBX!(Ka[sf`%`oPrbI՞)钧9yZQI|8Я$ҨEflEV8`.PTǨ IKqf!@^!-(~v9 =31UP8=B" |0[Y \A.6Lyiׯ*a~Uu =hn0b}Aȓ k!fhe>O"*_L8kX]cK驽m M:mucaj_1j^lQź%Bj!QT'pU~M`i~C5td@fqq'MEZ hg6"a zuCJgG]-.JS8dVϐ5Y>rgG:`kz} ҳ9bt׫$Sf{wA0wCPLD1AZ W% }dR)ĩCpUđ.QrG,,m$/<#q3c'շcWKG@a]Ҿ9FeЅyXa:%u}#"y?sNGն{^vYLk UhXf%W8sΡH*; ρۡ~f8D~`gIkϤ}m]V(zt`p1d(?7B<ճWf)E8PpS/qF-1$ f9: q:RGn*iɓtTF%ӕtAP"}s7*ziD/@^v)܋WvnV9̣gLwdJcj=k>TrV93%-F9){Oܖz7 'EY3(b3BӛK\1B tI-~J6&:@UkmS'7*wBd$I~c];O f}]xl }ڲ#9=Up9pX4ia\4"FH]H`%ǖBg.N- GX (Qm` Z~]*FU lG" ͙goR6+FXN m\k'$Xe" |#G]Y'x)ͨ +khe}Q8h蘶35N.Z\G_X TUHy;9X .U[վ>Ϭ1-+}8GCRXm!pk23oyǦFOE (%Uae/r)tScw8%P/?s uլ|A$c޶ JQp~섃u67>dv䵹#^>JS ns%8tz!“uEKpi uw,D5ڔJ|:u$dmBT[0h@fI][nťK{bk8,$?FsHYD$~y4ۀ@@+ʔ,=dgg )/pYe\ߊtVC 'WL}GE-Q}˥idqI$8{Dϔ\S$5#@20JMd+lu)Fv3zR--x9-Q9 \0A w ' č-jopx,R=ǐ=al OX%O4)M:5_J9[AT i&TAt{%_ۤCA[UbCd h\)^%z(7\|VK(d[VٵAOMiS6c,<35&Dm,y螼J)k Y*J*05rM E']l!-k GEw??Qv̼H_ZYS3ԩ4^rg%`0,&Hl5cptpC=2kAY:@~HG[8.fjwv]XR$i:`P|!/m_Atvy- ;R3h{cg¢ؿu6U^ƬYxóc*_ Q ; ,}v 4'4'8`:y^B{F)`3B-1 =4dhu5 gx?5< QRǁ 3rb*,d3AeΞGr4bsc;Ш \ߋ(I_ c%dG׍la"gEAQ8HP\rw|ލ7G5D~(msyս:\낔0/^8Nl w{B,)e4dP? T: Ք=,!vlx^Q<d0Bflz_S]ȗ 1y!K1Z${ޭ$&VK ؃hTVsB|Z_G .}~Qkc3`,v|?&ENI܎쥏<~.s5(D$⨍\ Q,~vFIPYzh$2 4x= es%Nsl {\~v2/v:Q @%{0#AYh^ ̏19^ w/,+h׷rRs/\+tH_i t{VIi,84yڥ2E \Rp4 oB2;\(>#'Iɽ^tVQG0WNneV5 0H@/;/`^`5oUR3.>ze1,H7[G9՟ڇ7ku廒t8S4=T8i;?T3c8`CRrghDɍ:fZ\X@as(V=qG4?(x E4Ur[a!^Z<%CrB&r%gxȇwL29yC\{LbvAe\/iQN7s#TwZ j@:ܤ=5u_T.S5a;ac[!;Sg0ZU9_UyH¥hxdïzQfgo8XǑc'$I?y.s)Np룸#5d .|b>J` 'Qm1d*tQ];pHτg{3(4Ult]pTNo-3\U|B$7׉,Օ3[c~j:I@ݺmGLjASaR8oeG+ */:,IE&j[zDnquz h(RS#|d&)мF:v7=i"Ғ3 J' ~vZҡlPQVǽU|v.2mcJ5 w@E&_?r6Iګ ) Ke!~Rb<WB+x_= +̵|VZD\×EfКU ('ZW%:,]LSXv}nig?4Hݫ2hdXu޷uM2ۣ4fUխcWEj:9b |)0nlI<`uL^f]u˱$qdiYu9{%Dƒ$5 IInĬT4RJ)M >?1"F<Wq  C ۰$779K.i%KvZ6׈Hl\ ^BE'8hm[O8ś_h =lM4,%6"ډ:aM28QKYtUmcPo(?YpM=W.+⃔&X/''S>:G-$PVK++8נt. N ۃT^$S%b(4U4&Evtm~@B)RjB=37JmӀ/FMMyȹأ ߝ.ю4&ŻTnXw݅B ؘ wf\t+fM_,$;=Hd[| ޷ضW%z´c' C, $A{LZ{\-XsOǣg6aAxDI#N ~J&|/Бz~ ^Ŋ)V D|h0(g) ߖ BmmWǔQ8g^nT~'F;VVp@m3"P>Pʘ -V0#O) WHb  8z-}cRw!Cx൮ RőžmY[KUIQ#dL!dhtz˃iG.>LucAàdЊz}5ms=Tz!Iψa&yr_jp ;h U}3" "_W:ߑ FOފ160g3 |=$HFݤwKO/Q&jٟӴS@7*mr..v<_YNF6cZTn N APJIR!rO~Ttb G$b]L!G,3߆QB]W dK*A}L:ZŮB  Y2Edߞci5Nz-XHVBԄv/sx*9wꗑ})s] Fͦ$kt{FeINR&q8m@08 Z3ө|y:zLO14>D̸L^z7b fDP<|HY/ (71rq`6 Dhghk5U]>gvUO}PvXŞ5$ITαoE‚7%4SA!E"dC*YpMЗ>!t A( ӽL?-KZZ \7icjXOu@Q1VDb{dRba]=7<$qD-)cZWgg 9rGyc/aQ=9+Z)""ߒI<ũeLd7XvOUq* A|?Z0;3sa>y}W$X i?RWqښ& h,&6 D^A)9P]Y0$^_h'aTCgZ/,ghf ccTuEwl/YtJ0N(~LJAAD.37 ' K]:%q{9=`jOu>828%YU8g0x3@GH6smbSm\D7ljX>>yc({224LsϚ1hUq!ϰNk݌63:"0*z~Ry)2:7#5((m>W]Փ{GeU0g7LՎKF-W5FUa^9˦]|V@? "Td(Y'?#ZdNRM01 =l$_,I#U!u>hAh+%_Dy֩ \k@tKHyLz|er _lIՁ"6oeYkwZɨ$tp诏 7`2Uvf:cH* =KOny-~ y8!uQjpL*1Uq (k@:Ah|mY~PƀED7v"?05uNbBڈ)Ǣ 1N!9 ;=Υ4#]{UBZɛIGʕ6kH')OZ]OSqΘώ|^"P$h|m<װwn q,cs6< =$O>P`kTƺeod `Mmư$vdAbf ,MFr4AWh^6Ҍir_g&q"c-xέvDY `G-jS5YE>5w_ɦ<+ڊjtͰ/lp*Ґ {I8G 4D^w:ǥEO)xGML:=-+h1Ӿǔay# ೥_Dm$:x66Y'g'lHhx8\OžrYւyEc[E}yAP9!vN)QҊ4#FVyTmGgaQNzh<576ԛd7ܺ%d$(`v~КNJcż k/ko誸@ Lۇx Sz<[h.6dr$ln>AE5> U6nќd}Ix-@/Utd.J~eV pbB%dUUN~3YOB8S^\塑 o@ .} _q ;_ }`ln1ӟ#qVpQ˼7+N׹+ yj`BomfPt'|9ι G$qX4[}󳠃gvOTFBApJit`e*RSvW!pQqNxX"nIZFVJ@LtaDYX MTp|D =G-B`F`BVn0y g) ORى8mcowo{8'K{vd{t5Q轟z壔NըగsCզht>I]PU" C*UsfXv:F;nv4Hx#C$3= nm 37H{Upx4A-)~j:*OD0C,WqosLgfRWy]Fս or鿐Q;riFT=.#śoH@Τc o;h+bXȍ~BM2z >N7Aq]3z˴:J@"h"h9z&q*yv#EVq:zRw*gCi4 |)o#bZ{߸τ؞ON Eӣ6ck.m9\^{b"}(N [L2.Zj7>qm^<³~?K\0ǻ2^{7<w~ztzlτ\1v:%/2hhO i?(䭗": !n5 u}Oޛ$O{$]RL#kFC~@5S;8Q(3j/I 4SR1%t~tĪtքߙ^.<:FUWZG:+/ GsvL,|2TOGj4I0Tox?m^D!yiְb<ޭp9,7IjEj/GLXԮ5r`H?0El99!lBW@W<(S\ܢ#h}O9lLAYwy`i1z]2$ǎI\ Y7p.l7"i''?uEg1<߶9Ns<43[OXBOk@VN;O3AT+T|k)#ltAiNJׇ|QT:6O K皘8 [;îBH$kKn JZK⣮X73NF/-;*75ЌLi}UJ{@iUx% K5EaՁ2f5 tSᱡPFW=j%4Uߑ}'<^ʻKS$Qe&l4ghϪEn_㿯$y Vʎ*S.VtrWϫ_0]-ٹۑ5_g1Mm r ]+S\K8>ֻI|;uKtyC#7րꨕ3v C#x7gfN#iE,zHI|exwApW*؜{WR@ڟOvKϹ 8{v\Dz$T=Jՙ /7!ZKAu\ G{9NT Y"{OEzφ1ё=WG:Mw@I8qpBKXz'_;b[W5YrJh8=FV 2)o/Ķˬ0D .400oCç f"2C&:f_j <+o>@kmeTsS7+H͞2oHANAJn!O<t Wx\Q Cڃj* z9>ZIj5]+<8& }6|a$3(0H\8jluXͪҸovcmJ>atBgŬxd2J 9-0O-&IYu!풙+on*]T%AsNV${FHQЫPqo-+{f?u/Yň_.R"?1ߞ]jPI 1# K䖻!ail:qst(|מ)G鶶߼mOZO wI ] 4$b@BU'ܩ_ѯ)B@p馟Em)d!h-2Y 7fRΗJX9̈ +mzɆbiDŽt;}&EuPʧr%M &ZIl:AOٸةـT }˯eL%+5XIleNTHF>u wCP̂Q*{ w M#Aa J=r 92(K^3 Q*2%|c,O >CB'@vZ+إ|Ъ*5D+D=y![] h$ qM"TԧĞFiۉ=o#Y.kx RY haH:YHUJρ|m򙬨ڄ8Tc8t1"IJ>6IuC Α@]]^a8XH9\gc?Ll]X {Ia2I{ixSMOAߧf#Q^<.`l櫷4ύmZX)}d?>9gF XG$>82axF "?3Gw9K~qQ910uôdaf{E=I;e)=f!6堃]]Aaccl)Z񋴭b{3C~#XyͶȿplmб"Nc }J%S\HNN D Fk#W S3g :KjƣSpܣ&Mҙo;^Kjiɽ>? 1߇ǫXDˁԱ{hrEʗYYGC[B@NBM^xnn@PZ'u0:lWdm&*H4VTRR{SS4 Y}*Y4J݈*~ K)ߐ/=))d׾mAʴ?za-]jN6d|E E'”@6n%+jb76]cCv`62 9kͥPO!!R[*"L)O G]yB(+~>N4Pg|ݢu{z̉U!d[y]$ׁIv֌N5Y mdȦsV;C!9&£cnEOL3d%?ǣ}&C}hx%k]܃\}Qh珚 rrU`H\꺊u2|n33YB:c!et"P;6KB Qu,O`-&CL_;A=}O1,^d+(8U}u٨s Ii*Ðo M ~67~^  `ʩ`D-.d2~\8c=~dv$dyĐWDߘnZtO_h\ ,&)3}u!u1,].[8fC Q k^ZlQ mJNޤ^ t i~[HS!7MbjP.sz,DU 5=T?m8[un`[8hc ͘CCCmz !<+HAU&+~U<7oe F JeqCrE_HC,/|#e0iD$ S.qy6+i{*.U\<{\г/l^lɫ:'SP"8>>N?ʺFIq#ѲA4`rlŇ;b@1ܾt-p8ؤKpT'zp}]eXD B!@D!!={5/.g=13~\Ϋo13jir@9Dnk~U)Uv ǹ4KZ%ĻM:u߼iG ^דOQiD* ˶Va g.KK3i(Y).ljѼå^1;'ЪI,Qa!fS)VǟR-1Ϲ.:B+>Kh06IZN;hAݎ)eٕfZ5q03"|pmKn.nl++SO聾ڹNX<Tpl2 -LGw /a1/CK1|Ή?:.e>p1D7S?JW 1|t.b)>>C8;-;pRZk_Ln9YhqE0%ED?(χ'4G?k?FOwNSQPu[:*b#O])aՖ7fjwXvC*0?ԠHSk&mbb$E5T߲>`Ʈ|1 %RwOF W[lEvt=6$l Ek \+D CO[Qmub+=|fL갼{#å}B}k;^$ۜ hxOJ^'6W8d<mywl m n8σ4 {hAayYs]̴01/7O9a;6'a\U GoղYma:v5wYByoB"[ȕX"؁T0V6qK"Ĺ?jח'B9yW 5@Ms#@pJ`2 NR mRYPqhl^&)N-QN聆O<sʢ&ϻelS==C!aʼիh ގb 鞢g^"՝ƈy˘%3' GŲ#/+Vm#Xxda|Z _) |@\?mf>p'݁RO<) 22+ p#JqHujʴ[iMwMj"㐲&)w4Md50%s9N6p)N(l)P6NKަ^8Y3%0|7#kUV~ό/'rmE N)`{dIulr^n,S[2.cM cJV;NֿVF$; bՂ]*ca%T$Q^S0D$Ar7,hsM^BʽZ $ccqn\U1QrI;J N[c5$(F#HhjT"MSSӶ Dy!{O=zA*#3lr㰝z7';Up\N :Tw k~ ojmtfNERi 3֊E:-w~>UBI"f+Mf,-.IcѴ""I[c맟ZynVrgӺs2-w:JUQ$*`-&H T18EN&|z^f;^LC3;;ƽץȼ]}Iz̀߃ r޿N zok:U]^b}Ƽ`^C^Rr1|{ VJS=lم}5[xi@f Oc8\jw_{}AYVve 1ڊ70Z1쇢Ig`Y>3';}9oׂ%q4bs.Kxl& i3D DTĊZ3K\<d㠣xuwy|LI k&-m^R-25:Ws2P;b},^/$d]v󈷪^(ancxJ8;Wg*>A4ڋ[Bwt튙?c4._ʅ4Ne#<f(Õ&3:9!f[DsvP;AXPsi G=/<ݪIe ЏƲ9L-\5L7*ɠ#Ӎ o8Q16#)gNl>Up<)7y3X*m1m:!$"adlФjLWKR5&`t-i~נ()diqH?(VTH!HU}mt'FRcGOus%W_A_~4f FҌt(hEowV.D]9;Fُ]wk}VKȵ ϫA~.akRNKfXA6Sd/V}+RMx<n$Q@R!ÁVusZM Lɛ8Ե2wDN3m>.<Cs>3֌O2Y ߣ-5[Y2Ł^M} q&DH]\ k\[BdڗAR4'1?a. ,DhQ3/qOc'rCTvʑ揾W,Yo_ adIN6MtD2]Hf6oSP搳 <)w[>''ܷ9"v,XYՐ8vvdGx>w1OO!b>|}4ë;49:b351'X9ǵgC2G ]KfF6x^ͪ1焬%kٔgr P t ܟ#f'6#͊2y}O4^KSA*a2x:7[j!# ajUsz^r4L;хX];B1NXMxh:Nd3D&h<=TD:.O1~mCjO!kAU4kºG~9nzfKh|4؉n<}ciAoY-X#!#꿠J6:LP:zGD( 8 .>> )߲(# qm:um3tq}E5x?.*N$$**n]2\ꇕ{M)\ӅxDv${_cmWTb4XeLdTgx{hj/ԩMpDNVE$~ZR\_a"WΪErLͨa:n5QvxJux6hxتQq5K@>Q%%ix($c)lyN8T}6UnVʠB/yIY!Hii:~PG+&m?nz z7.w%]\~EZұu:63=,Tw˧#md% 8B v)s_'˯/Y)( rWPT0B=b 1Î|"7\sA纇ʌ-Ύ)T4|gD;kA39Ņ8UdqBE A.I<5)BFԇ!qJй/8ʪ*bQy;Biђ`[)5&h>'9dyN(hfa&}I5JJѺ*ì-c+y[lQU&ylSC `K޷ ˃#幸-w2`Х#lL̮Bg٥e`sm}u9vLFCBP}59}H@6eCoҿޱڎQiNO\N^|}̂''h7B9n㦧UYˎԨ/H'1,s˰@+6HĮiF 0U1Ju6e3a2m-g "Co sݏw6T7@܉t1|+LWJA~{NJ@0"v{rXMsXvq Ln9#c׎BF0o<9 ԑEAgHSaޤ-䳲ww!!;tMJ8]_LBtO(Dg~PdίI:DAk<*4^]wj[5)Fˬvοu ݵGV.%,Z^bY2Zm_Q/ W]j@6WI$ HcV޽AyvxȤ=\Tt32G N2nj?{ @2JÙrhanIU!LƼ"b31bUؾE>IAɍIy,C쭡ZҺf\@Cl8,f _/]"K:7r3߬X%BiTGxpgLKi:`|*ܪܾa֮OKJĈY.? #d z/pXF=V;YGoWςXlIthz>m+. |tdFe˂bQbҘEꝢ s"N[5V\ f6"X; 9~adS3`q|ۙ/xRzβFL}G}#\!O7=aipQ$k0<*!qCeY![q-NBxBc"->q^#@}a'3#{>`O;R+/2Ғqgwqٹ'E0<$E?r93vk2ud_un~+O U2 tTk[>CN%#mj6euS [VՉ t:Є'mY Nޥo@ 2@|8`-=qKV(:aGy`{ѫs[V-X,E*~{4-pLW[(,!`FB͇*еȏ7?4wb`߲Dʎ(WR y+ *f&b-)4Uވ\jƳCZI%c]c "Vz`-=i6,::|f!B⣏"],3ʃ_H *n!mްX%;@esn]oY{IݜE@p 7-(9>z .Hf]g_gE|IP(Eʦ6y#ʵ~z sR0\Ofl#/vV<ЩƦ煃Uꩃyn;'xklRŨR3#ba]'4p=K'ѮHLՁ-|R88ГK}w.5$n«@p tߗs&]Qp(6 A|ۖʴqA}v]C}Z57xM.VSQnGl{ dPA7;L*hOͶWhJ;$ٯI됚K{EݱDtp_Ko i͂rn0#vbSvu4>#EKXn؉W<7r5Bg!F)I;mv/މfYZLAy$, ;j(XAV< п-f|>Ml)nH >O`Q3 L$39m2!r-/B|-Ldz f#K_wnQ 6ډc; Y  P"aIO9a/%qIecyMvj5&No~߈Fcw [0K* 4 p#(jt\rC6B,hZv9[)@<Dfh団oЖf.8$*Ce)|׽>208^v\h@6!okOiW PWS}jG`/X>b]CsuLn>85/,AAhG+U\{rd>rϴKw6O7oN!UU|/6=&y+p֌Gum1 wIRJ@O I1 Da&!Yn^=;<im>dzv(G Ґi쿅:ƛi.k\Aq"&⇼* <ZcJޑNԍbrGEx(>q%*D1]<>sᝀ`vj/6: baqFl)u,6Z/?@ 83q*j-׉߁2<aj`Ob~]}drT]JVƥ ,UHqO-AKZ7qx[v9N&h{].`d&]vFmy-iUt^ ,5wgwĆg<)I+ABfsה θ#ٌj\ZfTkc(%5i"(ו8"s7kU7j-%=5&q]UB'>YH-(-}>(9jy2D(oTzb@hih 13p@%I|CuSbLsB"bvӗ9syX45av? kk^z\њf}1#e'b=<5%(RBfw+j aeڧ3W=oH5t)+g>46~OCG%/ #N҉tΥo+NӀe9m*unn =sP[6.gL?VEg&wV"GngT"P?۴r| LQDH=!LqFc$T˞f`&[(a±|ϻr`ɾ7 1i\+{-Mkr{ڿe$oGx" _d>&*.TL Ee=-< VW jpxBF2rC BprVjd[{sUcѣFy_B3T/v1X6a9ޭ9gs~A(*C|oN7}_x'QF!T {t !hvǻfF>qH߼=ڧ5X%GwoKU⡆Ĉ\XQ.I=BδiԩLqQf?Sqt î+79ɬV%O[u~0sRT尋i0LQntPT頟mU N` ȃgbK^S~E1 />.~4cpOЈt}#L@KQ8.skPJGG\lHj8ͣ'aZ)ya{FYMȷ-:]:+%Ot1B9n3};I=ag¼Gݘ>-O2r669Vۅm=4 z:GGPo6)/d=%{<GO4H] e]-X~ \CPUCKy&:GEҤCчK#F|:*LFܿ~>)a9;X_Q׼4Siռ܉9,D\mkr7/#:B @dd}ǧ|e;<\E=Lk¬tktٔrL82`(dA *Q 8/2Z( 0庎K-C۬9ػ X]'=ۡSJN5%s-~{Z,Դՙ\^RUc5Ȑ2(ADh yRa;nALP%EWB$#fܬme@8Skbc!p!hlo bRVZqK%ã>N*W8bo%_A<تCԭ('e6zuiS)Ig% 1]a+p /ga)<.ikz D,!Ǐ:ud,6I#@?@PnPqi!m$\%ƽ= "F.LmQx[8T<b龋p7¯7$<>aÏ':ZӀaAU%StwK;:+^U]Ho .|H|$Dnv9 7P]6!c繬Rh;d;ꂸi7`5@<(URk`&p"L1|*N1/L;iRG @ӘQͷՁ]#<`f,\u*BTu1)R%9ԁ,{O$YkO"0^o`ʧ®3 jjqÏ?z@nNE1a=L29%ȶ~?ZV}MX 8e` 5!dbߏ( 4'ڶB=&c.U[PcF3r|P-(שc5oqSw`35N#'Z/BQ@?wvҖɅݨӶn_/t)k+hOl^szJGQ2QZRJnTJa}A F0FގCFn4^ YXÆd/ɵK=G[/u@Hߍp0HP3qLhVI'ZVuڞZ5V4Sε_BcgdQ Lm_(8Cho4WjL[?iwl:#|$$q.pJ}+,[pZ6 Gn=5Ff\QY3E#Q=_؆ %7jf۽Wm]d}_$8g 7qru cܦ;[v8)mk^+Eq(CG\)}:n~kJP-WۜFc=K9_^viE(GNC3N3FC×t+`bܳ3MS][t}"Pk&SwYw@/X%Az9; e+,o#u[s͹?<bmZuͲKyȦCݩ C=4ch\n7eL2sQt]r4rKOHw^(uBU'VhZbOVh[FaZ4Gi)Ɇ#u/4 9nW(蔨dnI}tݏ;ieYzħ QIU&[g? b*WvWIZNOp͈dONn%mАm"̪*rZOwYb :+08LH50+hj0bwb]^:8XW6Oƒ:W(>R62H90I:<ϑ͟vw &7\38P Q9_~27LXXT{l9ZbJhGvuEe5&E x)GjU ]p*m֐P6YYin.]Kt!YVNugTS8ݱ,Bn"$$WԂL)^L :WvKҞNs,gU.tK/6OXB[5m:gwَ'x┄|h+(A](zo,zA9BsA^L>s.\t4' H|q~=_ͻrowcdZV,qQΉ~q)թ{s][eGaUdA7?[N IRe&}~(bBPoBYep9=(nЗ5 SD$䭴11 xy[ANR'rj,D;d}Q!ech|WhR,(lxU`8\{.cP H>bә! Gf`[DեhM烖'kp}浒 s]{DRaqU+HX*(d ȘyT :/4R㚍 ZN-QܪmdH#1 3׀}U]bA$@1!69~u ~6z[ק8b[s/l Јhyl?9+2Kf{@J'Pd0sxٯI%jʶ"(X~^PkE44GQkBX)Y 12dTLH:<;o[E5^d$o81,_374#VtOɭx}Tb2mqbӅl[^ߩ F5xCNJ&̰Xʬ%JӒ0-~s0W`"\_E#Q3ȨKO1r`'eHv-U )#RߦKv1K 6rh.ߎ]~ ]`LP9 3κʄ,J>%BnG(a_5AEQeS7ˡ᫋[5ܒ)⟎}j7L}$5}85wnΈԋP2!UTҒ;M]Ɏٲ` s^5ׂ`!)ws0qG SBMM,tf \gY$yȗ*tR / R͆-5,61 3YY!;;~œMۻЫ2 s~^)]E,49F4bȢs.s2DAMQ2K-$#]%]I 7to&jw ܖye+S)c b -"OzI֩8L4|2īw2HmK,K ԁdzv" `Q}vyŮs@2E73&qF4JRʔTOB֠Mx:DkOE#g@?Q܆qD1>(I׽6W넚TZpרuEAo4 (x5z`k+d4/DžZ\_lwj̲1<9W^;'_OJ© Pܐu4g^\'">=K($ NS9xF: ۺ\='" {~k`bTW HԉAQ__*JiTWsѩJ@2$$ĕ5gËQ!$1KtNe,G]gi %eToL:yQƌ6r;T wm3AuL[" y5v+&eG5,hmR'Y #KZ4H9TW>$^U>r~ \ULVt"&& ]vNhk՟9&$TdDlN.OfoYZ%C ytE+xguc6a&j%xX&ג(E%;הZa[w Zɚ̸wNgs ,?vi?j#ppcِ -%*ƽ}zmК˨0i`+0>^7^ Y@[C@9U%t-2@:Fͭy YPSI"E~o]lh0teoؗhi@f3vENX_օ''~|)ӣqRjmD{25 A,|'.7@9TLtcsL8$Y| m'b_'5ޠLm ͸ky(@qO`b׆>N-Rҥ?j/cY[,WړDkMQ3K8]iMD7^_gL5U@:2y6 /c,1__BaEdh/)9Us81m̺?bGFеp $@[Mm,1Si.S`) k|+k,ȅGo(+e{30J6EE6\W[5_LmU;Mѝ+syBHd'ƿ&\7pY#n7R;,?p{ nUmsly꣨:Uo`xljhYB+ԕ{sÁ utqf 5N&+r1J `BhoHaVQ9URڋYȗu' ikKݟ⇹K ͇!*&+=ͩ%c7dz NW @aIZmbĐ3R SH62{"A*p|@UQ&'¨YxhrJ*枬#k}fUP?*&ێOX|p+$m`8.Z7sǧqZum]@\j*BH \aZd`dq.)l2+kPX ۼBH9~/i0e '9[do~ӤK[_ sae^TЎ҉pcxUmCp)Y<9'w8B.¦y:w ZY]G\XޢfzWjO~Uw^輶łmŐc BHu>:Wvَ,԰N.puySc64(E_Ag2A-5a)#ndDUV6A29É\ZIqF=Ej#3+eJBQW/t ;a 7HEa鞞`T+U/K'0Pbc-14ZH$LDד{ae.Aёј<ʠQ|SzД ΍EQVoHf , K jK{j(.SvYYm^IPL{8_D}̦N|͔Y.7Aq:/.z=u.bYFo" u`=D\]b05=^Z1*a胡?єՁDi_pWzds3AVB/`bmݹ)l/ eqC ;[ SUf[]3V+V]&#xgF'ƉAq*d%E9p+D۷v:Od~R4`^l{[VƟ͈ݮ;uѓ9DӣLdQpoƧF xwДB{,ZcʹX8!ߐk7 BMD Фcp#`{{= uE\.[_kܥ8L`f@Z?s>i9Wn_#pޑ*2 {-bwtV@=/rg΍ vU=:9X֤n4Y4>oXEMI}ѯ!LNam)ΐYuxbg)ޞ\j59 ' h<\<) y M_Uuܰu"Gp`}^f l wfH"K,ZSߡpv6}8||ZݵUڀgޢ.? {ovӜ\e|$RlʍPl JJ$,,2cwAM6,hS lNљ[n*ڻpث5CCvو9N(/)3O6+ߘzj_EGyVa/d1] djsb-Lz]UeV˘铉1 dGfz$rWK 1XEfI]T-sFOYy`3&[Mk[(qqqh[0#x/\k: ;Ǯb jPZv"^ꫯյ" =hhY^e4Ƅ"\+PLAR[~.FJvtaVГ--: *& P \߂|8ͮX疣MuqXj?c(f119Jmi2C=lcć|5;p67q,|ޑ+D&'dpR91uiNu 59.l#n5SC!biA9B%\g:{=yR;wXpX>)\u3O]ȊI-Z%W. WiR$sGCYS Cۮ^<@0FǘJkEI>ԧ_O^(c'0s}[pk 7N@OIvڣ%ffxh*\_" ΧjQ(&>)h*! ^/$r奈(eA~=wN=;^\\5ZgtCDA&1so{$J`a"8C>jm`yPb קcwq/hN< o'I-a瘟s6~ 5mCX{2n@9uzsį&_O`Ju C3ńZ0lqjK h!ڑ3:uNoaUNZoo!2ݑd]VDfL_岔]i|0f0*@F)U?k'ވfV:KdUEIMQ4W^=,]Knq?YFlF'((P߷ӷs"`Z"%XCq.ViMDuEns:\Ni{0C,ԻOT氼]Sa/f6/%>5='uh|ju5@:HX#.M%rĻo2|琰AdFR?Q2>pטjJ;?cx9<Q3՞Yb$3Vwp\sH*Lg_@*w+ztʧ@4;W-Ȭ֝ hao!Z>Ө>KUKuD7/X|3>}h7^`Jz -uaaDX}]FZȔKqs]QF_w]KW4SC-i9קox^P M#}+"uW =q 0cCPH<_ pë쳑UM(+VSE}́ .1ٳ8%]>KªWDV.`%V,'D}Q:[L"dKRa?e-aY[տtM Räa\a(!m3ZNGHkz%lK=%}hy3 ե,"qr``nGcH2jU{(O7;`$uCd_xnF5qb ( Iyqy^('AUp?+=c:;`?F֗y=63Q(9&ecG87T5?t $e 6$51j6ރE/-8{!>*g{b`L ѱlK-\~|κ5 *W8ܒ y!HQS \zT XΓceɯ[r ( 4>Uz.~g($65\ 'C 8-dԸlc!.(jOi]TҬٙ&5yN˖$ tbrDA`Zek&alPi1ޞ7䲢v?WCgcOuҚ{U 2dqrhZ'(T {5$~xK^QhZ Ѭ[pNԌ$ׄy1@i 2d1!Cdr9jlRާO+-m$pJȍpq>i \ˆ{ȫ͉eF!?tFxg~|(yε־86IBo |i=^s9d ܴoefF1/*U [<1Pkz0d(iӵ7lQ,E4(4/~kk"*{o&`Ih3> rR]. B'JXN6̈́EyA䯾aIrSoHMjn","(̻_A-|^2F#=y ccw4l•guBI0 v#X"&1 Z>~2K"uS[{\JPՑf)ضO8Јq2D`/BEʘm F"pP FlC0| AZ}?9qB@ BSjuPO"c .$HΡt LDG>ѣIn v{.e) *-t\<ɠd#6c{/ab GRGG#ku5YpnPeJa!c.sP cQ֫b˵"w{D)FHʃ@M3;.$cK q|:Xd_b%t X ,-v얫٠tXywD'-6E^cY3;]7 G qn-S@XrYa:rWm9@ֵq74}%@E 6c=YN ##oU[+ ErJ6CmMX@CoiMעq} MR-:"㴫nƠ;gq:A]|-)wQIL&c2˓wޯH=awFlX Kyċ(68"Lnd[CꜭrZvvjIZ'ǒv M ^D*+ _KJ 1mV$b.ĥmW\'63wyyiN`R|>P۠ٝαha2K51 *e|K%GuZ2L]R)t@&_S퉂""K]}D.y8;@aNSRǡm%g)pjh8udT;q(Up|8<%=h2[C p5]|c>rϙ0x,a1~fzF8(Syoƛ1%A{`=ǬlT(j"o@<7Oa^$/O 湇uQFKD3t"Gdvt_H=B6Rʼn,ʏB)O#K)Fv=bfTco:ς\xOtIdiU՞6A[DSpCܑ?DZܖu@WL=3 z0@MR\:4}εf^X;^Pc&&W RsT-M%^_1ꯡiLjT}Uc{ҨOqt3 ?Ѫq>AOtu>0I=Tr]ڼ@W uN4`+tFHbV#jZNKP{F{=W 0iCmhnWl9&MS&x+a˴~#$&JGhgr!.w_'Cq \=feԡg?S#wkh.IJK#]9,$ݺX#9p7]b<@f%~k"E#h굿61NUX4Ӭ閠oGRXb4QOI{juhVRMTM:/9geE-aU<Iuo>glU7-30Hz'\ 2bcL|k4Dt? amxgf彛Dr~O"%q6:Wyuԅl>/n=TCNY4xѢh :/a V 1{iմ{$dw*;'uh-$[&TхB6>;D)x^eYCJ"5tgRqՍ)= 2|Ѥ s[yU'/JEK+b8։Dm2-&]  H+>"zȂV+ف9԰p2ݗzChc4p^죕d?96:?;ϊ,dVZ0wB4Ŭ'b #.QUͧG-vXZ*(Vqw)32= Z \*{bg ;/ADC7lN.cdI7g'Sjy>U4|iKߵ8־m':ģ&ǑT*uS,+熹s6"7ķ*+~İ:w[p!+aVi$5doqܣ&9i0Bo(JSqw+P&c}*h]ۤ%"p2v<#*Uuf|2$fnS.7OP*H@iD'H='j⹶6QL[Ni 88K^î+vH8;9_NtGo#(NAᰉ»C@>c+9hܝxr2Hr]I~vNQ$(|E(;WtH:틃ڶPl{UV ?DC3)fL׭] R;s$ 2hQnTH\{&`>f.նܺrV XՁTkVby9G3QBw_l_!)T9 $kE8- a],a8F*`};joI}UȘ`x|z|JЇ6͇r5'XsLwr8gs`p.(P_pnqҴTBB5,_VGߛES(׀#"O9CGj&&@:"^3~~0R1aផv73bvy^uH,įui}tYۙrrq%eȀfCiFKdV%-H}a:.Pԡi›oXA'RS$g,tn. f{F#v7DXq|H3-c6a$.XԤG>[,3a`7v&CܦLmOGo'*nBKqRw[r$=C^}XHUk&%dOOQ;S k?WQ^n{ť+rcy&ݛS:UAJযaC`ZCVT\0) eE(ξ0k1JljtK%z" %_v"ɏ hjg8 '^oBKʶ9?k ]Ԣ3QiǺXWW~;^(BcA7uYc]Q6x95ŋ[=.Zp@|8쎞Flq$U˖LnwnF[=- f4s$AD3&+u6c h>a Tl\L-V!qQȥŌm:iFpy`jLbt~Y>FH3(:O9|B,P6@[P=B\꩑@N*sUL3*gY$ fI4Z PX~i>dŶsz2C ԸBhSVQJ)]3DN QDI%Ґ&|a׿Ӎam\B2ޗeG8p~j{7?DYM!~ ʯ/]ƅ1Z#[veX8_x]k y-N `tCdM>PNy3r@)WQ'Rsy2p7 ad@H "Жt1  KQ>S{ց0<,ݮb~#iA"{%njFUl?1TG (y%pOcp1V.6l 2;,COx'јDT(up?旵aGq+iqP%b\PAٶ5w777촕ׁɥUC Ig=fz⬭=s%xhjYZNZ ~~Nվz/ei-Qjgo[߷rw\%٠2qGWbTyYβ؂.ۆ`A<sk#h֘Ktsy\Dž2-J"H*xY/~"R xTe߫jT$#-2s.bzK F N{yBKNTIt&8O)e8]ǚƍX&XGf;k6F׋m#QݸSdžԊ(1xn(:YL%nz/,V+vϵMӒm0$BXi6Ưt_~t[a\2Y>G(؅:.9P9tX{z@;"%2]!{5E?.q)CB~M!N:<,X^,Ge0ՅC-n$L{by+yʚz9XS/8Q@k/vn դи&Wѳ0yCޚH+@3C_ w2-"Wqp6{A؉~uV ǘ'D,Zh,܏"4xqkw/b,|!V<~!Lh ~mA}&aP0J6],S. ݌dFSw6Sg6 /|98{H绾5mD! ;m GM皅f0[<9#8#Y Q=rr7S׻cƃ,HX?[ޢv0u K+me#Z5Ϋ@fc7rx#8DixʢG (ϼƢ/PrWn}T)X߲;sUvU\TFp10ǽ5{IOblg{&#ZܬR^\ o4&Q$L={E ) |1>'#a(}~NqRsexP ^3@ߚr˝ṙ8 ʜE/܃VV,f8$çrz %[74,U0[TbtFA9/G$f$aBmj ?{*X!(pV-OA+CJeCzes)9 'Ud<L0Zaslj%L )bLBZnEO Ԏa3:J IMБ=Ģ.sExޱCH~|:t̊˄&@ՙ9Mky;[4, _"|])^&UGwh'p]S'Wb >{x еh,?2_b0s ?gU7m|búְfjѱtI&_qG|ij􃚕K31RD†;窱ᓺ bW!`osEkL=ϼ9Prxn "%^0Frd5nrN'$TV z5''߄=(WzkkI(1҆,3/~0p!bѱA2`Db/j`U(᭗lca}kսj㜾M6p`R=ث2 )NE;K"{Zs|bc4-8 ޥ@T%!uD묫$g"35 DMz [}FLٹq𪰳)6So>8IiM)i,Yto/\>P=X\sIw8`UzW_׍n5Us4х<Չx{P, - {_z+sjKv! <4bJPZiLvI= ]ƧD s||fOK~8iA*hM):M6pLb[{q&JJR L9Ι*'LUw9#F]GϠT2SiGaN : G }qr=}ڠu4HF2=fYڮi" uY(Dp;s:1*x6RBtT-vP+=(nOK@0Ajf}Q0X2 (X h,7` ;(mm=uxԛXiNrSKL5 rZYMYUa G☿KUカj_k{$mu~37^zoze`ZՑLLlf^ůC>"YZk;ӋI(P]\8)Z ™4ZjUjrY~tx,R#3TUoV/2J%ڼ)peH*,EKS})wYacڏF4*\yho$uWYUի=3d?i?d06|޾Ӓ#d1Tj|G@;S~*1r+l `1,|v%LY(#>q=U#ZAb~)QKz%)/]{AxAzݚR֟OOрNjI_KqC۩h=U0nrxǹPD^1\o(Yoc"Klg6`/-Xx;jB-` 5KP \Q֩8g\y1}H{Ѩivv nP]J|b:G9_ {Zt=Lķ%'*U8|rRuS~g?B:˟=)NcpVS_,,>(V;Y%+q8xsNmٕ̩ԓ`[dsCE:UЄ|qT*q9`ϲˢ ̪7.A֋wCS|f#.z=yvmu+) ac":U}+[a4~ʢ9AmIc7HZ$Id H!o'NbuW.-܎] O4=DF/lRk13s?jǰf8waP_x/ESFejFAyСޡkFn`Ά@iN* Ҋ`'F;9 '8TAt}GR?q"S`4&j;x V`7+Y[7j } .; ]7Z(7~f(9Z.%jҊN=xgV XD6fD? *]%*`j0, ۅ`ߤWxN '=эxov,!큄/(x% N!)o,||5Ļÿ$ k:&U/u-b#|ΜXׇa|v'CĄR8I R,7weG '"V,e2vw6P)p F%A+"-qG 8^\t2EuֱZ{TT*+gp&U++# lbwFtbzpBێ=qj*,fŃ"n!-]0Z]rX&`DI i!f+#WbU|F:5BXSÚNaA#{ŏECnW(<^D_ F좳W`qw\ iC,D' ;ƺ-RTHZC]Sb?&U]w 拘񣖲֎rT: u\#{&Ua`mI Vٯ(}&id*dNpY e&Rldt'0V편[WV=7[PA_ ƏJ9/8'-NV@@ 2I_Ok&;aǴ~o<$^% MxpY2C_$߫L/|s/1,BftqMbϾ#p~35zjTB'^`jk38Dcpb<43S@n2/D%Cy %~yLCCpîC%84I. J]>c-*L 5u7+E?BlSɓ*b@nSXK>ڢuq0Mgcm% Ơy31U٥'mÆq>&7 O ǎYD={^|5j)BK@Y`c3 L5,bDט/~b1[]4svf@:I J[j URu{~ZZs]: ƒEiKD8kQLMȷ7?0pMkL(qOPNw _.܋Z1z D^L爘S D]DAѲۂ*<DJ8r㸓Vsqp4Nk5JG->Tod{Gi;PըG+7pw=-iq\d+ɣg9O1Ӫ(5'fsH4lyT,C3L.S,wFR-!wԾ +*fwQ*1M1Q&_I B(X2Y.tuˊ%{!x聐MǕ5RC4= w@mDM'̸tlz]+d>6uKi^2z/NbС iS+j9˘TߗXb:4O5g/)6& 5fig'mf<e Diӕ 'H;u_'&=x>wheT㱋Mx$MۜhdOHiӱUQ|fɲj=잷Q '{ԻQ~&SfFm.~B.'+51e$ݦ/6Uy fV^J|2yZ}FPiNF~eX}gY.Q?GMɺ)ȒVbՉm‹j1 ~8ꋍ)*ʥڎ ٔNO+vvH /qE%_ YZ'+*γhϐWќ^Ť{W])T*%\R3jm8wӯ.0*q =~ W<{{ѹ/=Bnrb<,=}󚃘˸ARE'Fh͎J?4f QLuM5ן"Pj8U ][BhA7կ baim=PB~qGĠCVPd=G|Z6mKZG)ֈ TWiw땨 ƃ,z8FH%|Wz^Y Ƥ z}rDQA{ p(LP_>`?0ž0M>: ?`cOEHq|D> "38USAj1+M%¡swa[~ sC~.QfڬoIOGw *8$ e(~qmj[Tw DSk $}:p.xH*5,jc'apq*|H_"Qъ"uNw}y8 g$krC?%0_5ǵL?иv*:HԵӊy2߸h/Q 2ԭK}CյIlZړ|ډEQ:aEG6a&Bcغ5AFщBR" ߳%~:\6;Zɝ|"'T5">2ϸ: s[ !c(+r \w1@; rP}EF"(INuv*9ᆋ:yq/l'ԣy%L;ɛ):z#-?EP~5yn癣 K?S"̺I]+ q e",t/҆Twf!8*F:|Dqkn k݆9D,}؂o0 0EL4tS3]J PGw1~}ԅoU̒#EiMJS/ >c68DQЩb(8NI& l RpE[q(Y݌,UB`0%G)4ɧO67Nھ|h5zjEsfXik8;/T|βzDRK$ C_v6!!:rqToa6/xB :%pUX%+8\,n'JEj\h mpUR%[uFقZ8gCUI`ߵ¯薎-l $(2 rS|,GV_<0g7WGw1$p5W@Wh^ū'  N3/4nJYDM'Uk`%clMm qKSՀke <D5[<}1 !:H?SҰDPw@q\eTGd,cZ!p?jlq#-5̋\/Q&HwV^T?10}]Fvo@aC7ҮUP㻇Y$7\xJV,eCN\:c/o+*S\%Bz[eez Ɨ=?6l. 5"`I'?H IIQj˘) "$Вb c;/ &[Om GQ^bhzv6::vB~p~9G8}^ll@wcAk/fhh d1by'dIfڛCqhq?@}U0}v$Nd:@4JoOK=Y DB Xb|$Y\FQwe:(Z|P: ]".B^N]Xv)N.k\>گ`Ǐ+8.ײz 4es qCkb{!z=rSh!@bp6{q|HFO뒛2ޖ3`2e{2&cDR?O5\O 5(>ntO C *98!tHaϨ $@yޠm㟀:Wu8 I ODA88Kۥ$Џ@hN;4CoET(Ұc41to- [b>O<C-e4cc-ŴxdBϮ֋izYGdC#1e'SSvyBZp E+IQ&G?<=JΟIR6QVC+ og7lˌϩ/Au#'vW8^F&]jmDj7#6hJ%tJ/XSxƥ&2' h:W'neofNIdvZޣ5G>{O[VG2D 'b f<J-D6-)E{ce޽ f7Z_$7; н~yQ!. e/PvKf ǻs ~r1+"ݱ'?ָZP|>H a8`b'ODCmlAi1EvXԾwS<5y_n&z@`]LfJ)eD'yTK'*=+#3vM1U"yN$ C6sB0r"[2RLUȋ*7`givJW8?b>G %#q^z|#Д߾OeY.L-}td]ݔͱyRU4pK||kGZg8jfXoGc(AӅq .4$ e&IEzIݼpy8H<^{Tdj,lyr] :fp:]@iEO+MGVL)Kۢ׌61mS ƃ,TT\ hTռ749+- ܬjފ J1eg6c~}SDoZ'Pv FIMSu2$9pw0xPH9!ܺ X"ϙv>F ϣMALq@0ICU C|$;Q!i^~<ѕV`Bq@Q3摗yI+/}2:Mj *X5_|@=Q`߃1' 1;=~͵{نDyQR|<[_57l V]#0,rXmbE)pݠJǁv jl\dS,6鋲m}ݾ+ N"ft~ޭ7.#:9ZKYy7—*1MƜi6,.{ NH6dMhߐg>;&_BV Bl6XHS1Q)Lv:1OQVp| (|0QvyԏL.I(E'+u-A`z qB!:9G<[y'*봵JqȺ S <6}`b}Dqnt :&$6"ՙxʧg4ѪcWcK~N|`rظWt,D6.peiܰ(7Gyb#堀rJ]]lxJ) ^Paa犻 %om+FH(1"OD ϡU%1A~v9Ź Qg>+2i 4wp$j%,9 ˱y& _abf%G3K{:[#/wUNkV=NZ^rɺf<6H~'5uSOFU37a?|dڂ|QʤABRFZs_BfA7oo}/e CǎG}vtkBgB6B}Z,x ^5=RXE)WGs2V?RSBKm,E s,$$="^k!מ5)vmkK-n끌>/c5Љ@QqqUH{ AQyK@ M; +EQʴ6`s فaI}I͕Jf7~W} GGRA|koP FG ;S2N{ l Zn XI#ZbىɧpP{@9kGyAq_0a9|5nށ͂V}i4!\!#[Xc0 K'BN+qMQfQƠQkP&~4G> Ө%̒ Y5Ƅm8]w75p#q<zyuseU'߯ )us'gUY.ו,.Vg]ƌrt: FS;Up.nfZ$\+v+BsE7 `5{eVtRqP7Wrء&xuꫛP'2"o*8EBO(p4sH;\*19D.~ZZ۞{ާ2u\} LZM^La l: ׉v63Ԡoр<ňT>Ž}u-"P?k;(c})6j;w έEx-ֳycyӱ $}3r&朽>;v\;ja=Zl͕C^4|S6)dweVc}1?g8/$R_%0c[_+:H*A $f}t,]~O}Z&qZճ`t%)*@̱b سpƚLYZ[KɀXդoD'|7DueC~1dGаlX5pqsR} |KUeGi)lPf_6ߑ2:@]N}+RQ9v~c*Yɭ:4!:HY΋P^[6kj#BX5 k4wQ« zBHQhvb҂]_Ȃ~͍pndaNQ%/Lr( (rsm \[@ Vʿ5`W[VS/v,P#윈[/@၇쌉}r߉8twD鱻PŊLEmK-xזEFyǘTx Qѩ?Y\6V#q@\"F9TmRԆWOmwbʹ7vst" M/ ["i Tԇ|LSUN|浂r,lMi jըjA욷 O҇4af_+DG9ѭӯsۿlN+$Pm ^G+L:ۡT_Fk\v(2N}> 4\S9dUW1Mw\OR501â^UCЉubPcS}%cpE-%,W<LUEa-yQ5(a͙wȹKV 8b.MçN= 4 uw`yF ۥy+hd#̾e4:9!5%:{Wy(t:n9rK˲GPID]O!H5 /J nֳ`-sYjN2z:Uy3{{ο@qe!Ӯu^^x$N,C!o^fC 폣 }03@a/̴ 3,;  M?(R{@>l9(+ϥ{: 6h}tteL1HԚZ@#+u!ʈvoHɫ\|{h$e6š:](8hN˳ YR2Dhh>sRz48F hBβ q^n)M]?8`g'_Gs(NC_")>^k;. /vs1A iD0%weX^~ںjDy$BJU:QmEG?oA&<чhWC((]ѨK s^PZcߥs_s<=pYC&)ψ`i%3djDY az]y?UIdD ζq}\(0coaܲxIk]X FjWkBbyL 3!I^mGػYρ,[ds İ5:JYN#@ȧo\ @EGTTOPA]2Ԧ#ВQQ[ڗH5%ѐe"%6.2!B='צFEy KGeY rBYW6asJ.4M澠{g-qmi}S0:2J ߗ :e7IweOl` rtηTv,-̜Raf]N_`@:M qYmQQ̝JmT#hPG_ N==/d-[a!cڱɸޔZک-#;kB9&s2瑍S0\Hby kM8@-:J'mUVU]`Mؐ? >;wR1'3E<׸<2mҴlw9˯iTK~Z:gGV| 9Z]P^ty!(E%n/B@뛯b@/ q|lװįo<(dnQ!Y8fWHy֢ ʻ*j&1F}0ۅ/Pa,!i1OF ת7dw<[t/VDY lG0qON1n8(@10vZnk`庐Wj] ߙyj&*(oLl]kBOw3M*Jֿ4$O0`J^amrQ2hv^ZZ3; /*7>OyCq5JAwҬ :YgWx>Z&qhb-@4"\>QED<J77I%#! I\-Gg$k_aVoi9@p_m?^pTح'jUVEU.uS`\CN`CM>D&fB +Bgڬ"ryШm4w @jiNnj  rM)%y:iA7Cԭud)hY zC歙uJH:=+8s"5Ix ;-{jɻbiEQ8Mz q䒂k5L7FWD8֌.6d̚}yX-`)je`N!NvbdG%)^"ȢVEAΥQ9KKG8lp!-@g y"AQuıixv;ƽ}': V 0g ߒD?. 2S>pԅ<4w3Q}#z|P # (j=i 81i:{nX*s'AI%wvw˹!OT%Xi#ȡK);~T?cB -iw,)(?o3Ӂ7LU%|3ˌvfs'ҩgS(&֘Yrg_"4[~%gY)DžPʁE(>j'_&rVFZ:W͵WوǜhA ,Ht"DYfK.bYfIW $B !.O2k(!pw`D5J¢iZlcJ]ؔB7FHx ƾ3([E2E>4,NWuN/xK6¿ 1Fq/S$ٿJr`uƁy r-#Rd].K,zI3XcwZ-BW8Y}q&#Y|[A^eqtVz# ?&9JWddb9Φq$!1B"~d6~skJ6[+t§CjyҀ(pgМ\#j8T6i޷{p>DD"&ɷj6̊Cu[9r_CVYc«?*q} ~۪`Ō6=7q*i}VFھZQNJ{-Sfʇȱ>#"R:x ^U"gg>W/ypdDGk`VX }65&7-wۯӏS۳BsYIJS7`$~y207b|^evfJ@_R3`vnC[S(XOec%ͯΩ5R3#)&SQ*$6]-3UuP75T6۶nz€$\qsEefc*Ft0`$V ͸Nebώ2'ߑcv/NDB{1Rw:U.BR.|ɪM('%o@'@%ߡ]3g& MEbfEƚGu@U O;d9D_uY$E7[dtjI8IA9#ټ>O0=j&`5N!J;6"p _]8bS6YP%,@$%5J*ג =y{ "E^ݿo{=eo5/(6cmL$+ҐZkU}1KA7XD2>ٺ:xQ.~-"PPEXޘvc:VEcA&s+zUTdzK~BWZ4^4Z HOnȁS+C^Ôb' ৿"JVС݊܅_EDsZ}b4I Q{ 2g/"  .`=˵78>ƂMTӁˋf5 O+]OVȥT$Q)#7(.n)iz9J=[kCJzfx4s+G+[k4H!vFt3_AMJ`]j^:9-ϕgԕXeP=l V7Y1iJ1Bȯrg[\+HM7)"߼6.&SCdg-av}0<&,g3n7rﴛ#ymmMo|2tߤK!$:gyd.9ʾCפ,JWc\F_E”'+M2$ŭմO1\kܙe3lo ձ Q,2PŵAv`l>k0 c*tB7qg ]^l^hkJ>||1wZ ݸ#njWz&;kwH]A\CF$‹ DlGáJNP6#.!_!Tf6&M^_)]~\=|=WD1}}G~*X B<$2vK2NʅNY--%E MxM>\C=)n3AJ~<h>p,_xayܞR )&1ğz'=٪YڡoKY!aP)!h]~sH ,CliWꑩ"TL`q5^v'T2]%' o*lեG9 sYB1&+V<:5eiR5Z՛{Ypaw[`I퟾Ԏeݗ gg+4Wኃݜhoiv|X!~xy[j;x[HtAs(e#)DlTJHG2׻;չH;u]Xb~G,NJ(gXRfXȐNѕȷ_R]Tw=nnӧ\ڒBloA.@3]?^{Ii\ⳘN2_+ߠ׮?PT6 iO)Ǹ؃Kq|+7A`W|mw1L5*"*!:<>ȖaG޴?;y"?F℉Wy~ )(H'2^{qX c0"K"d޽(鴄h qdwy ո N1H;2ը~Ώ Sޟ4V@R{K6$Ц ( M+meB'Z{wxRLFbǐ/YD!OIM2|PٿEj Ve"h5?y ‡#њtPAWjB}P\WwqU~lƵ)cQ԰@Qh+&jkKגBYM)哳;/qz[+@p B\J- hJU,1Z譡a[7wTӚ!Dk:Xf<LliR9AGBY1: +K5Gxa<)621wϟ^/il 9GreWz)F >R)8QNZ4RՂ/2"UAqZ꽚]Cg:1)JXy 8+B]\2Q1QoA՚7.Mp)*6 N0{}?\>44B6b ^LL*$|ö<- QȮ$mKe,{Ly93IpF#8 13D6j:zP[;㤝ͬAdk{rcSf)VB|lDssh?E$\lpe}Ba}†y vI [`ytXA4z4rTa~j"9/¶T@6i%ofMxNbv$'3' s&ڗфB~&\VI…y-!Z /mu]?jc vTd<ҟ]EH- Xnd}-f;y^*:zcFP5; ͆] ~RkYJaA b-Ur\`O,_M7LcZ\bt|1䘸@gb-%VI01NВ΢ΨLkALuQ&8m9Jv&@A2잿':Ƃ8`U:nZzR߮ fy .tKu<&s.h^ @p2[ϙ.89Au4?cCV5TS"g8f}]]}$Ð_!e`+vjYsr'M^@ "K A)`:9.ab8Vqw>SY34&DD#9HR IHT^3C, 5HiKS4 /Vn]IJɶEbAe|gpII0)wt2:|F..F)Ϡ PXV; /,>bߡz&ukdl ˦-rFxi_#S$8N# c7A3R1ƭ-̝"P_`ɆoGaӦH0iY}h^ ²G9Jfw7~#ɒ/CZ@3 Di4:3&3!JC3n8O2 *:Jl)xBZSFF9 iZ!c砈s؇sOYcX$hYVxQgvm4?B==ɮ!su:7B i4?k06Ʋ/=?@fbJ{*ś.vဃT{w !",~n?U7gYB'Der?tI4T0h jF0#Om )vY(HCGy +wSB نac쁮cv[EᬮlAe+1n2 CŽ* vxv>#f'jDLf8<6_Fg='Z4 Ky9r=~'y|w`{~mqSgBa]is[G*Se5x˯ϱ#McB; ܥ/mP¡Szo3w׊(` Q O ;X=Cž:!0 A}AR}JjCUh7T\? kbۜư,,03հC/\Gf$x/2U Rݻmh!M (pEߏtо6᧋yE>s : 7f~RtbA= ACJ#'l#,n4$8uXwZ)bGd?ժ&1i )ljF0PI_^xKҵޢM0$(z|C]:+NU(CFjCQC OhWQ'qԕ+^H'I`wT*oE p~e"m(u0 JB]? :K'@cűguyTT *O^ǑJu E ~WZi3F[/ZᤐQk?[0uL@_&Eź4옗1ˣW]*v$C v.8]]aS {F̄|Y!GV*o\r"9 @ w}Zpm輄k3mT%0gl|0I)}Z_0=dܑ ?vXLp=!dxgʧ/W~6p$_NLLt$c/%-B.V``Nr2@"VqgYgSd)"E\f G%6d(z?6ëja_{$;h 3Z:#C>6֘Dٷ9NMz}7aqt)?|ڦH A7šYJ?^Fhfh9^}3C,.PZ鉝r-ڪuHڏ܌apآ]? /SYݝSL 8%40LB(p mFJ*_FZAm0jSC?MdظRHX#?W#}cHuBщ]W|D^>6݆(1:=G!@ज़gLa47=p+Hr '(̷4%W@(#_ųi]eh?[_~ L3+@w'v2 .ݓ֕r_;.)h=U7Yš\)UCG|g*e-J&(03."BOm<A2ol'wkN"G#41R:_|²P:Eܬd2PB,.Q'8ٱ= JݒA3!][kaɱGu: W)HٝSm'$@s=+rwRXL?#تy P=mv-UW:/ #41퍃-c24t+o] O(N{o67%T|eԹRF"&z5'~n"ۑ e~c (\gS*KcoE*RC6Dn^MTG`_?t@9sjMhp~`@@͗ [*_=6eqdo; ItVHg ğ4LU쎕lk\S%ɫކuY8*ѕ8bwlX$WTW]r%Wޱdm_Qw2?+"򓳈H0.@ '>.-+e~,+K:F6P;bLE Bhג2@L۱ەL^cڄ5b,@hO0i^<8F]K SXP{a5yXR3=RZ_+O%N-]"3$2ޫ~$Fޘkr(pVᐦ5ɺKя5`̩hک X3i~]=O! '{OIT/5<D1uL̔ƞܱ H`` rDw "Ff ;x&6v76v)886(͞qNý>=mpùT򂇱 7E$|MZy. d:,tse{;H]Iw69gtC\lVmQ_]G8+I%p8~Anu~FoTFi.k4 ڣvje৑R#7/}|.!uܭzSΥ8/XaXQ[b}M]HpCȾ|T]ѱO:Mt#;QvT/Y4< I*N1`ZѼ. R1rfzpk=z psy`ŮR+5#^wNwF{(y2N]ۆ:+~ g}qنEHlCg2Um;G`J7 `a [x>&-L_q!R!!BUJ,GFouJRq]Y3~19&a@͔y2%>iUN 9bU+ u[Z =XE(*8N?6hJpA^ԏJ%Ra;6dKd, L ./% _Cہ͎︋kk B5e}RFϚcw\KհuC3V{GLSPx )snD>ꖕ][@ VcDZK $+7ԈHqfԀfz^c,dI(y) ʼT@ByU IIo5F,4WEPFu˶9H?AF|x} rVA,$T Y}wylS3G'; O'iߐ?G9a tLIiLu4 ³\2NrlYRL ! ܶBS+tLB unC5\߂"/m/$O]Qdh0DvZF:R<ſt6׸vlyKSIYQRe1x,HmI@wRcz3"$()~:2g(聊`=7Iɵr{\zx~#b;W^_P-vѧ|ɸ-k]}kF<|a՛y=^ {( g7&"Hkc&tr/) N D0lmST8[#ʄh~K佤hjxDnֶRd~(8ɁJWs^n|/yG1NHâ+P?;ٛlY9Ѹ+Kp{Mڅ"=1bMϺ$TC,E)C$İY!Z,_=R hGtЪ&uDiFT1p )@-b VGL1Ɍ;+x4xn.?Q$ ,LҲ59tt0vZ5+Nw͢@nlܨ`q e̾&K8ڻ%`0қm.܊OG)Dgrx͉PcL9̦Eh(h1a-b$-hu0u3<|ֺ4z - _n(!Áy)zMt'&'GNs?SDQ5wB248,Q ~7|/I:pٍ5eH .poWWXUCQ EL˛"*eE 68s]zW*Cg 93[ZBJg0}(?҆EviP}km:pWWK&A3"=5*Hiq@g͚|"Vc]v,}>W*ԈҢ BwwT!(9dڗWbؕ9ݾ;/,XO=J agwbBGL5&+unrn#iб&s84) NN՜[A)ctZ gu*apBrܓiғGK^>wuZ7+N`G`h0J}QybqY?: HFht EnVҚW^A3+~Cd6j>2)?͇@&sޓ\6oP7C,J~xGi[E,E:wKK%SWX}d\=%cy>ϏM|v>t%trcZ/(Q5!N˂$Zr &7$ȐȿBC[IVvN]jM\ܤrR*!Kj^FI`;e};YA?5H4ָ3$pZ !O%$:/G;e7ABGrs 囈de[b?k>p0Bw!EHm]?u&p|I'Dq㴠XW/̬3Y C<7y7!󜾷`m;_ 9N\#.^$Tv +&]5<[OC^E$)7iE>5IJ@ﺉZi0 c .F$ǃW&'qcpˉ4P.l\*yYd"iHˊyqp=]auZ뺛:%, \klk 9zZT3N*5AҒ07q8; y}DRzZ%f`Mz'@ۈaT_aRǫּd~]-PnGxיshn:*V?0 ab}8eY IeXKVeg|. ϕ!J# jgI#?0g錽XyV@q?}mZPO1hӕ.w]Jod^&`C KށPJx:Qw2 .ǧG=l=GQUF^ D[y9ȍA tYp6yS:O>7݁cC;Y+k퐒nK=|7iF`9aafm 7g:O+oغͼtAqp(#\m?drwo+n^ vz~,j\;LYXן G/O\99ХcX:CҖFihu2 ӼF%tԃk[nP+ bw4X^tBCFPLUw"٘ 6&ScOj q5 Qķ*Ol[㏢uG@}6[^\7!3A)iڴQn{fyE!|`78ƦfΰAadc S=Nb+*-%zoiԇKTLDq~_ I~f)GVd~MߺJ@.2VyQ9!e2?:!!?F>O$:PÔbg8yML)م* ДtJ.hHM(>%:FI]I=q҄z~mPno=§#-G7׬H஌\\ъmMTTDBo⬕ʉ+kߚJ&zgޡŇLi] _ލwLv۴J+uy-&%98#/`2#!# ڊxcY>W a;JWe41i&%ךe*p#d1fE؁_]K=XԜK4 =s/`j$8mc^isupx,Q\,G*!|q]A.@^96/w޷[yUΥnc=Bb^3Κڌ"a9J[Bq -Z:[ҥO5n9ʚo 9Ղkx55&tMVRir =ppk*hHp?5SB+.~“=j0T)6Fsp|6%FqH*oJy! w5C9}bfx1R imtG_&b.`ar. ᐙ7 =I^?S,ocܔ-89;?ļ@ٔT#Bf@=LVZ R2ؼ[(\Z<ðookc1y;d6'yAUPPfRzQjձWh?jP 6B),u@Bܖ`˓*V2hGfEL5J8Sü[XOl&߇V9,GKՎzN?Az"})%Ð 4]pL |aiU 9q#"9Č&cР񛘱m`u% U 0^l >[I0,Ѡ%-+ڑlSا R zahF; ?ŲߜM7|b]Lckhq'*&i9[*Ѥ2 P1QV@ST7U7}{#$n$׾>+H83C2tax0#;!Pݎ.JnP'D:A9=K$z CaIIʖ]Ň׸!, z\,cK"Ƥ22S"ZH/S5(CVɂݛ z-B8rU5[x&9uO(7J2#EZƯbĘe ,Id-g*PW,`2]@-]ŅES= F˭a%q4OgF W5o}?: HwW q=-PCГDWYLno˦\k0$$)L.7pLu Z`䴩*车КY>XGY\,` ^Kv#Q%@\&d2p:oN(a?DzRJn ю%Iǽ[:Sr <]IiDcboF@?/3d{ʞHIȥ2\v70zEq숪\}!}z< ~e1'4}1)v_v8IMҥ3wO@ƪ?^q̀ v/qR2ZE@M?퀵Ǫ)+ە?.Ѵ>GQ @/W /ouⳍc]rJCPM ]\8~} An9 ;t0RĂv9;0 >y4N7*A0H}/|;zرRa3, V?ٺ[!iH}^`=U?<:Mɜ@NCgR+kT%dW1F;k|/2O16iMTS;@qUMaby`:>ApJytc 9g}98LM*,/I]\.݃ʲ[}}7E0H~!CMA6͹Q'Z2]ݴ-LҁBm߼.dC54 @1QAi^hT$s㨙@Pu {oP90S H+$-aa>'^C9C[oykI]ue!`xI @;&T䠕FkhMYbo;G9Yr*{S=LZW u#x-LJJ4z\H-dӔ}؈r>Ifk06E>5odd\(2+iiP߼~H^J'䛡(O[1) hIt\U P^ X1;[Lj*ZoD{yB0-5–4끔+lRfMFM R.=b| <<_0`,{-ʖ>Z6tZiu7٨>_9@cX/1FtȅP)(ޡPLyVMHZHzQtL{ќ^榇\&4%AyqK3tT(W}+W-h0h-qyO9L<3d/;2(n/Dk|;fŽ2N{-TAM+xN#$sbv%yWA"A ,+x iihQLQuwhpOVZ;LJ@)1] [p9>򰛐E?! h;ORC iE'bK_۬T7`AjL~.'ґb䣃1ɬNX#9O)󷧉3ؙbt/oI {PfT&r!Kg cv0IA OOa2&fj(Ob6;Dʂem4QEe@mCxI.3dURS(ݹ"ag1ZiwF{m{ xFXr74q*@^RpJXhXº9ɑS8v4oYrb p3Yt/M:DIuRg.eǢꘫ B!58γ.bGV'xk ' AOldΧSOG 5ƈZz|p8pi3!لvPXI*1ݹ ZW~vav{L#9YG(Qghn^SnF |z\1. Qw/K)Lj5XY&a[V[˾-\m", ay(?`D`<{6 UkwiATQK~w13Ul剶l3>OtX.](ClyCl 6$ ~^lU:mۂO]l}̾fdҊ&'hdw12)\{$^k}VrdR5"% li.k vᰝ+7nJ#26[$X/nQQSt3L=ˣ@c()Er(J;OԐ+Avҙ塥ܒư93Ml ZibAjĝuIsX_,S>Ug?uGw0pL.""ޑba5Ӂ!7чU>=?AjZwTM?Ξ"߀'vA>,Y0=񶲄¼0dQq@I pl( %۟Q4SՁ翯K!1mH¤bXbGxtHBԊU3@x=R"u2ijDfLZ#Dz kWH):+P Q̿;[S'м :uC3'M"V` T4Gg?T:ʀl>]4a}%E4J6}H\h a.tX:*&G&NnF~=ۃ*3b]tgŀpITxlQ5a0t5,"Y7“U7v^`PH. Yj[qT^+~Hc'B+RHVG8 .x2]e/å [ۤZwa~m.Tϓ0/]Zo8By}=X/lOiybY-!>Z٩'T p7AFbcϴYЪѐ]Ϙʏ[X"\L]2ZFz z)J&/h jf]ԆU+pʼn蠲|oe^eꁝ޲Zq.9W]ʧuZgNՉ 8 -PG:M Eǘh;@Y/Є)Raյ)Bb\Wر92x EN h:^6EzCzMwGi$g<#Jv/i\z%)0г'<_oY%c,D!`j `&Bneu gSZ`$/Z'Tz-kBd* (&'YO8䢼n?M ǏVe2$rI]d &Ɵ1hgnG1f<#[QYĆےiѠ'?-j2!&"{U{jHwehH@> /"NjЪ`eӹY<ĊsJk Ġdl@ڎ+f*lz0=sϯa=M@lӕL[c&6dy3z{ɊS7} } (kwt"r"'vuL>ϧk]sqSs]JtlTB p*5fTxiVCa)*OgZג_ ރ]Qx}]\Kz[TDys~쬷x*ViZOeY1%G/e9L;`OU> "8(kߋu?h'=!>ɐĥI֞A EOq\$1*;mċ;|\|=Tc?{UFn '>%S{*HWcHaЊ !(kkBl|ߘwzPKr[x (X a$+'H;"%6&GCdRel;/xC!-4̋L[~7Khiaom5yȉk/W=// <ՙY[, mEX⠶%15f.G!j,ug&77C#馆 ?nhxsYE1c[ۨMK{Š[V~4[sp=-qa$t K?ޮ:Q=' D8. ؒ kk9ݪ(֦Z(V8d/=0@@0PylqdcyP u{rI n= G$InQ)#sBGbROUOp~.Xr ]1Yg`n ֌. ]>^aL@~Zܚtv8QޒyPelygeXjelQI t[-k[](V[ng7:??ŸnY7=K4ӃC131C2Jpq2@1)~ fT~-W)s:{w8X܂7v Itp̈ty}u@%o5ϴn[~sR Y*,*3_Fpr*YӶ}+^K I6ۺ#㕵1GS/"#jB'"$1lQwdkXimX}?-FfrB8P.zFSezFEǯ<mngV_b\j@V{bhh0 1{oBy/y^'P^|D-E(k~oz&V؃ڿ F G0.eJ.ޟa\qب+F훆)$|'89v4tw&)n#,JcNՇ.Ovp0Z ,yy}Qן~l{vSKgΎu_z8zXDaeU\y8<вESvť8E7&+{!V Km !^W0U}t̔tonmO0&O4 Tz͊uXlĞ)YAR~`iIOWVW"1vIvTzhŶ_0kI@8X9\$+SVRZ픺CA^Pxi)SiC?8]ެ)oE*/+lg Ƥ)Jl6nYe}%=li9;=N-sJ YN66]bP&-#ߗc^V7 *3 |^g VA,V<d n=&R},L7|S&T'SS!ŏG"">ݦS5CWqTzfP_1\4FG xr`3وp0qPN@a$WSĤW,j7"[ ]A䟠0"@iSGFbk7Ņ4Ȕv~LD1ĝ\"cN-4Iӹ"~M놞܃4#ޥ1-_'[9FXYJD1/%'TۘVʅٹ=eL  Fո,PB96ߦjIa1; Z/y 0vS/Y*9M DJF<24›\1l@bg91l"wgdXYv!#j^Xk%};S猱ٻ7v@qǸ8A(D{ ?b3]k:I=YΠ)i:7U>?RJh-- WޔFyR(w$xC&pp#FI6 ۠#BZ?__PҬx!Wv@sʷxzON['ӞtV??zg -ӛV%"H >vydχ?UpQ4v83K7iI1bBHuAUOu"q\ȥ;SǧYvAlwR3?'T[\b#inIXd׎$Wˍ*@ү3exH58đ{M5I2Wgd;G9(qU;tt.*e\1}/Lp,Tk ;C I.zOQ^V@XlV[Ho<;8ĉS2גhv X&O"*F`a lB˞8[_]_C u5sJ8B3s#,@yn;+N}ߋ}GёH $r~*)ʠC ƺBcܺ3^qc_Ml`!mn>ɍni'+(R Uzy4H\8դoAs8- "xĉ_JJttb?"ǔ#E"-M(g^߸v ls=ʩM]}0۩,+SߪҧP7: އ8=.Ĩc(@Dl%w\--^5o}R\d+Q vÁ'wb@nh+x7:].y>V()B%8. nL/Zj9OT/mSpWJ]qNr YEflQ w" %)c%?rK^8"3>祿&p)|B 8gHhgJW#Vz'%U,p{td6&$y!mL5_Q[I}l{O1] P0e{$pƙȧj6 ʥݰXoڔگ[=c-3ѹcBלuѡ쎦1*i' 7ZW/N>v3NS^܆Ŭq8F*es!kvΧ%$|IBѭN|KG$KeVʐSD}gpڐI.X<< U6*@VeK9=3GP6Q O}yiqCPJ%R>J " #T?2ٙ]LF[4bڑ6Սx`@|B8p 2D eD_kFpwe% k-9nށ[B; ֆw]A4 e<2C1r8nVǩ}ϞQ %s 0 gfi.zq=4fFY_[X\_admCɒbَQj*DŽ^k BAgxpYwq= Ȇ)`pq66G%`Rtw3O8)r~?{eW@0pCW(T7G];XgM2(E% P"$\Q4L!16̒( Xۗa `=kt<3' zlRb_t {/5mS%Mq mN @}\E_;rG,;( ˞gX +Yd u u y–a`^)BGW_zhaȮ8 Q kIѐmm%X9]{ߖn<(]5ڡO$F@$Ǝ ͲPY JKbLoVԐP<*|~1Dp<ցeș ޴ȨvL_50U)ٖ;0s{냼|Prݗ8~hȋr~'p-8W 'K=Pǰuxo{0C`k)ݒ@u{(ee?wd:Uwqe%T\_P#h YYz -yVn&fcFXFbdžKSG/$[\cIXl.vֻpeM 'YZp3ͬ6[]xF_Ę\,'{U*yf3՘iH\CdfM# 䊵%9 8Tb Ch^kIcԊysvYygƍf8xܱH98 UP>HFaLw.ky祵k|{< GI&?F~;*`1^q4#~&\?vvAV4`y/6j0rPL̃YқWO96Pm \DI_H.]АV yfs)($iY[n7/nыaѰle n/b#ۜqog6<*]kGrR]R렷AJxTb-"/(o:Ja}p{⎺O zݘ|h<T^Wtod`8miz2i:Y'>~jwV0t5q5ɜQmDUoeLJ(U⭖q͂!WWR; ӶcpIDwߒolA^$Jl){-y*4;K;4ofm̕P-2*xA- wc=R>V΋u ]ىKip=sn{ /#"AW-joK kQ{BRYw%  ("BQkB%4|THm qR\P۷44Q=RbP9{c\)Ժx+0f0j{0=\*/p*+p6FwP G섾 EC5Z.c9y?v<~5hxn%r~ ]"[/A,HZh캶6ʋ/ #Btα0r$, bc/GbRD%`M)uQ&ENy1ţf]\3ViJWFtYy q(]YqoaZp1Z! Y噔ؖOc ͢s&g\ OԿ.TjJwb4<6wP%lc*[$w@"=[]x Sش%#-!㼜D>՝-&J9TuAth«y=H0i"*T9`mqozj5Zi#<_JM*6MiV!gTV۳ @\J1c1+jN iW3; =hRq YDޘ`+_,`!.Z@?hpܠS Bt| R~ZNc{WEqx~s* Z맷&f -J{O3ކ%12r7k߮] ojIV&"݅}a-r ;M c1{rFi6' aUd\!)'tF~Hu尶]=*;2?۠7ɠ:ㆲFƛ%s/)" H)J>(^xGADk+'$=s$l-d52@:jxXwHv7<,tLlz؋"b'j@~>'9RcG{:ذ+{FYLRMyY݃ncAOZ.BѕL؏.L" חq9 OWAyϤ:wλPn/]tP&ȇۅ44(pvʫcdX1[*ULp捛`GLez! n3pճ`$8?ݬdn,s-fr%ZFb~xtCx.hRc d!;gB+:xS0zRX1EV=9"#\g^G1R /_k_~/ Nph韟zN8Ke7FpCFg"-7He,[t0!di;!#90c"eaFM"I|9pBA݂m wo:UfXWzWRjn9[._᲏#T0p}OsZ| .G;Nw%kŰmK>hxaenȜה6k_^ǴnӀ |;y_U'{o})d?(J2Et&8`܊*˛ܺLYmX#Y)|/a{#C_!?jwUzʎ S$1bskV_Vp|qu¸.l4DY'<=M54qk-v-Y(ιA1>J<U˅'OhB +*r_)W5* `zu>o+J'5X(4i_~{s"E Gl` OJ~7̺OCL=b11:ܥ͍V|SWb##l-< .=_+;z݆t)hsŪR 'WW8ssQxS׻gO 4rs&:PxUhC۽Tt\lN~^U[5  OTPQ黤J׵'V9Dka+,7<1],K "˯Lq-zKatMp|2Fr8IX`D[i4]w*ω`dW+4ʔ'v(Ha8P(kwVLԵU 9ց'bl9, 7-]ݶM 8~:Y}@xhv`PTuq3b ıw,n.$Gi@͆$"1 Q]Z㤤/P@C,4rhPLOUyo:\g4ΰja(@ bZyz7PPi40035M9n;a/"yB/d VAP16١NWelBZm{ 9JzfΣʔMBaӮzW5dm\kdȪQvC`9&DV/XhsΪ9ˏ*ެ#!Ywgt.)럢:Qv|r;N)  mg-84ROIm\ֹh?V8>ʢNf]iM|rTeH'el,pFՇ;ao\Pͯj:KaNLqܶ ฟw \) jcF6˦޴({(tlkRk(rMq$J>ٲ!D8癀f_YG0ჳ a-RyH-ǘ9醑|{aBz,7IHGAq{ +П@6 go<6R7gpO]8HAҼZ xPY%sg"/Zk̺Z]~'4vDhLdWz*~n|Rϳ2% 4!aLHf-,dP/9K&b(eup̈́L3^ #c>>#*Ɣw#2Ֆ4%SdF oGKnf)A LҮdS0D6znVgn7uZ_T-/CO)wi$cT4u>YkGF{`$D4$x~[NXf( 4BԖZiUqڨhlpS^`~Yǽb‚\yI^ɲK 9P!AvpA,ѝh K]ZI >PҞLF >|C#m/.9 ]7lQ`N_:<<=%ƃy/b܈VR1QmzmSt>&Okf?6{ lؚfOt8_;r',sױ}Uh'SJ׾l+Ϲ${O9:;%8*ޡS$0$t/juϴ89b{" ~ZMz55 koGHs8?X7HlV%?qU`_NÔ Rޢ#ikP|/7R&gwu*U-햷v^sWCJ57Focpz.QmLNW~|s!85cm#C__= ?C!@BqoO|݇aɲZyg\HgvTdеYKE6SNWRl.oh;E,|e!M=*gI$k(NP.7Ϲw ύfbOwm 9;Eii BI^ 2i @^!Q=3lʒeJMUr&gm `եg1_\  ʔ̡v\ߘ&_oy1t.ǹ1&o7^[Ι M րBk9l>>[0VZ]=A[LKZx }-𚴪%;Vf5E \٫ϹP 7)i*Tsn3Z_vbxlt ³JEh0myTq@zji*Ӄ()TWʑQS}`DmJ y]YlCHTË"u7$zE2I~NiEё Ds>`ě_8եH5~(o1(~BMt`UI/P}SLH 0v kX<C| ޅIlN̩I@Oj}8<^$#n:"uT'*<p ˰qQ^WK'Y@P% 06;8㲯ndDQuD[AvQ u NׂޖtT敬 "n2uhtI;v_ʼnd 9o3c!ʹ|T^P{s?lY⢓B #"q#`neH3#ƉʗmS`vkF5u3pFL$"RQmJvƿ+j, dMRB'I7xR{';-p,ps"s^[v [y H"]KY>\Dq{[E 6R\6c^x\`T ^XF%0G!a%%(qX_8tKGde\tu kXY\k~0NiM͉}Ѥq^7rOLphC Ȑ*Ib*;O%o"cOMؒe?W񪯴߷^H*u$Ghl\qL~+E  MV@x\Ǜ{ϲe?i~[am 5aJWSŶ5( ۖ$@Amd R=PWN)}mjr`vu*I59ZܘCݼvʋ5χ|E!~$X-]y{\?nG h;(]f<9#W& "39 51X@\!X@ 9Z=Xw^^Y\L" 00⑬d- @eCVٽ^^借Jw"؆"嬰WoƜCwť>#XŬ7GyCߺp1ޟ; \@);@ۥİ ykMauN4 Vt_+RQ.X4UbDfL,ahC95نyG#ڦ/MЯHG;a,4ME6qX\pi3[ e!W h~,kыFݳK,jgGv3mRiD⏞nǬs6τP=D `(C+,-x&Nͦz55uO&v_ɓ|+.;#Zr+(WPW*)pwzmno:WqtxLjC|K~,)4,#ClǝC3Yf 68x[>\Tn;nڡӫ@ܽl\P/ .t,^N <r数qXOw٤}f{PL&x8o 2-K#O͌%*E*A\?|{ (@+D}7]d 'F͸WxO9w'_ʢ&+Z bd r F[8Ψp܈ $d= >eqC8j|Aӗ6[~ aSh%ҙ1,%qkVJ iٞBz8lo2Cgx ?^:"-J'}%@e痒Cf~Ȫi$}qw7< &iǹu~xdކ扏|,ZL[LNM`bHY*hZ?;]XRUrmIW;ӭ!\* #'@eg L)PzYe.\w҈tikcg<jhNAG~KwsĘ~!CàgFH5[<|E].ל}>_IAAM~j]! qR͆äOwZc^/-( gm EC6. k 1B V( _(i&`e!]uc ;&ӛYl}j`bV!|=SQ~f77&0614"I^_]j^AGnL{P-icÑA>g_P ;C)?_ͮ|囟loBP{1R֬g@K^ԑY,VЉʘDG.Cz ߹C1+*9(vb?";}:4MXJjd@y_/Gk:a1$GfZAlU5|<[l qA`%j؅iRMGSAtQ~"se?ԮJO4PΤ$pI9_heK +Z4K(V(+76N ҽ;}>++Ӗ7`)5Zx 1bjKwx!XʅgvGWX+w\K퇫{a/v_g$ q{Wߋ-감 dP ➈܋D+vA_.( E;µTH,[MD/q`ڗ|gOnMa3[PZC55R7k-uxĮ|~xEVUT9;I#ڟpg;vڊ3~gì"n9h;lʤp3gx5`^'Ƽ[.?Q:glfA G#PRTMm9?gOFk|SR!J&/Ti'q{{wF{N'򚴽7˶d@/7x<-b?Aezdo 0h8B5(" FftƇ?!F+BbO34Բs _^<`d4v 9ٟO$oLMX [b^?05B<^Ò*>ȉfjZGV6jf4xG;/Y1= lIzBh߁B[tיx&6Tv(CC 9c6cגMP8$7Ky 7&hljd"*`~/UqTt܋ RV_o#CPdnGZzb$'%s)uEBրGYWQ2:>e?W=:WN y0ۙOݚ MmN<C̪o \|B\_an;I{ 3u#W]3Uob-^'pr{8%ty[o9Dq;B346QLX>9G?BMʺ SR5#ݐhf/[U;LmaG/TX"rfv˒ѧ%WRֿcLz" N*t/%B%Q2!g OZ?k"p;$'6;&+B7Y [0; m.5KkաmC4aP$JZve_[I8'!mwl =rSٶPR§.p9wU,cȕ?}Cre,s աI+qxɫU5x aQ QM5703n2}M3ȊjNQ ";S{zZX#f58!`xCgm*Taok V334wdnnW6.d%;K/C+:booY%NK#$U![~*|kvաr41w) 5C$.As̞^sv8: w*د=-ޣwWd]0wJ,7sXhTe8AapPtL~tq܊Qs/G _`N%fصJ31((b>֌k1s ɛx¯`z~**4yzucL/ |룰[dk L„@+^/YI~/=&BֵI6bbgd`o߸TC7fqzQ$*`to'cE0> Tú`9o`cX 9mHCj`$O4=xY z-7I1O#*'by䪛4[KU)]j!-˾ Ŷ3M 7 @_Q*DFrhXJ@b5SĐFkS bd!٦g3/csv੪ӡ7CN^b/cBDdVgOXs >xK!}4ml^A8sZπ$'ذiUZvP>8nۇHFņC2 >wKt,w },>'NqV.Ue[XZhEfݎ#q[fE8a*PR1-_  z_i$kZ իo#@U((%Ϲ]n$ z%9y ߀Zc1$vDK< L!3E`ۨ9C|k-,io7 3_^%\8( _w5a~8HB23؇Bh/ٿ0*7Gthݤtv'ԓҊ|uHt'}IJsB@?c-hI+#B$(.^k p$%aZܰ^t;+(u!wa/lӱiKZzmF~h&'$m~-5?NkE2+ymœÙ{:׏c3;:.=p80ƿ &ʈdҟ'GC۽PQԌϺl[>EkAcP(*=ނE{pf<-5BZ̎寀̔o@tnv jxBM]Bk+sUuyL9:,ug(b5 ( . h~!%*mW=hK:w셏<(cWQV~k:{MOUx(?!?F7k);BʞRo~,,wɾl+̾͞/rCSX,]M8 3zWe=MbGQpi+23e 7_2.)Xjp2@\ s(TGæchHEd-u?ezeyaAg3:9UM3o1tC*Z8\^@DݠX U (C6 yF4*k#5LP8JZKl6IlAlWXÿ$ƛq~|$1'9E's5t>Dxfm/N?UI3YpK1sTKix18-sʶ6Zir TYNs2l4 74_W7aDȱ:b(Wt6#LRKlnc읖UcC /޾v2N=n".\{N)IU ~CjmHRKyW3M 3m}gm\\[`ſYnAߗoxjײJO{12U4тyHf5Ww edXW#]Yz3U@ Xd7|S<| M8b2+PC =F:1,M4-0ю`|w-ّ>v6n' E2B^ pkן݀B{q,ɣuQ_+y3rzM KQSVkpĩ%8q4 eǥ`v*neFBQ6`b?RwW9ne[r5[i姫eTNs) Ʒ0?×w,:p\x-}&]3E-sפ(_>w/*El4= OW Ѐ.6lsjkPq^Qjl=y8(U}ZI Ί c/op0@4g5ϛ2U+ :(` )ϖNpab/+hg= y`c~ԅ!.:Owvs+f̷f*,'S'ߛoPeMQ{h&cOnfLq::#\׸ȨXoj=?kS(ٕ.cV썂ۚ:%r"WTdf?ȿ0 1t]!YzfcvT+gx{&$0T smLsbWfc{y!>ߪʫ͚heu|6T9|Y LO0¾w@24Eoə2},ܸf:0#RrօdȑMQE|tQ1#dJ<˳pem~ m'lRu=~HfVLSOH1R}ʘ^Kq8, GLU-xI2~A]M5_e=J} f+/DYMQN$Q"?i6nwkKh[J[%,sϵ `z5Ve0\ 3 2Mˬ5ׁƟO!ά3?jc 1wPp{߹Fnыʚ" d Aگ]eo&Zo1;.tӋ٧A]+q렔f\HSS[끯tSd}#č DrpT[쾠Ndg?9`2h_~⽤Ѫaمr!W^uZZ=\u 'gtjC&/6j~Gڞt fSDJ"y&j <v%pY+KêUg.dVxz+Zd(CʹȤ8tTG7GQE(nW;vCHM(iFoĩq&UhDf퐭.ٞŜqN4oSprI8;qz0CuRҧǽ0 OndI!F'H7G -zIV䞑+<\}߮C] /<:/32 W *+2K*A= XD N{?M9 9\l 6 $M,nACX k}ޢ2UQ60ƀ9ގH^^[UKK"dqtag[Ŕz%31Q֊Քҁ `Uͭ;g|`s.^<&#0LNvDHlLƳh'a4R.',BeMP̝%7Cw&[Gh,wW z"2I5{yq\Iv+k聚]];[Ux,qI0+l;XyxKrE4&kmCPIJ=&/MVX3 E[Nj3cҐpMgMY?YӢ@b$G[K+%Hg 9@:1SL/HUl)1Gi; o k'A933ZLͨ_A-NklS>,QO)#0d>"gVvdKT!VO嚢"4uL6SttKunyP5mڃÝ0h;%2循q~x&mCӼ+"M&]LcMer aĠ]Nq@4 ;-Cﳝ[q*W{{`cp fo(h8-#N@2jN{g@AIkܸ>C5 =r_6K9j$U̮f>8$k3qZ(.}(/Fkaמ~j.<"7Ij?GQbF(,`+t6#C=+?;8<\%X/9^vb} N{} t lH{0O#W*߭9]w/;Go] :])6R#TPj%b}cyVAÎ8l/kod~Ɵ+e}c4U)b; B"0".vXފ&68$/PEжH2fPe]T 7;u~ib%_SWL+q91uFnQ?FDFiUB! qsKG^ainޒVߕצJu^;2Os?ظ$7x/.ҚA-v@xl"*]3g/n֊ z3Qf*dJi](T yx˸\=" &%@Ǫo~K`?qπIq듷HvB{z 驝> O8f&hbYlLau҇Epx8;x&*Η nG9S&\FS#hCTPLT[`ķ}"`}|*WnCɝ^}Y:7{]X~[tx.Jߢ ]W1a]p=l9P P)\)Wr[6Cr(b t- վG7dԥȰ*R<.<U^u#( Ǽ,Z톱hv)H2]ÂHB՜V``,ą,0'N}7cl̈́p2'%Sn8̓!Sinl_F*ɔTyywx#:+*+ K$ojg孜#T6,g1x9/Ң{ :Il h2W !]>L\ ',] h]b7 v}mCap,] t1 Kee%BqrK2%ϑ=!،Ύ$['o?H?D'ӤWN) +/iż@ quI*[An]:#:ʩ8oV)Wl%Ge=$V6c0MJ A>郎jAോ&x{50=OQs)^!yҜE-b@@}KƂ /2O|\Q DQ׳|*S~\27 B$$JyQS9Lʂ8L 0U4Dɒu>P*S ="4qIzWPh#{vgkl3shrd8iTo:dVm)J H(@͘g յ#'w&k & Q;JbN950"&BHB0)^) x `2 52\cqt EWG%X Ӄ:,n]OوOAwڱܴF3بQ3z3lR|T`H*ƼV26=Z\(T,Gۮs_}5d4!hi6[t*$ҵsCETC/B4I3%G6W_(nO*֎_F2$xe՜uDXWPJ.)F ;9iB>7o؊]7ԥYeGIĮ.Fӗ9\C2e==ǶdY<<VbQ+TAɂu5-ʬ' x2 5D{%쯈|k!w?^j^-H0:ȯ|7J1ʛ?m:Y-W%fP _wpZKs%w!)( ic /i}'ߕq'H;HV"f*Z2P{sbEACNI sڻ >GeJ+!|O 6`&qZ{3ychү fay \$"EwAl>-ȇhb=pWQPyỳ}t4%W~itRN-&g {O);^/T [/bg<}quLܷ('o%a`I9& =`h,2|0f b*A'Yj 4f^x(7'])C4ZvOh&xRhu \7R/ldoiBnj6٠qꃐl'nd݄ntZIwI*~=f3D9YO5x1oa[;UbNvz +Ӿyd"Jt: )jW wbvhli{Tjzƪ͘9$L< vPѰqN'ݞU;iTyp0d,^c,7 wT%~uo}O,L 5"S>uE?.uRUEU-IL}5j$U,Q쏁Y9BOBRDm$k[ݤߣC&jY2xlO{, ,N|EU`P0%["&eeă*(y+ A6.ˁƇ:X- k87L4wX䳞sBʔ/4t尹ɲ}ɳQHNvW5ZKnNu lhp!{& x.=w=sw!hVk3^4Jj%O#0qWr] ߬RHqSDz~ăUޗOKn )J~#6{5*7,`,x%J'X ޫjя'p UI [%rVG_ ?V$uZ_ƈjl{8Ͻe3{?=Nd\Y5*);BmA! t7Qq®TSJp/QmCp#2~@)QB'2o RXShKU΃mCv8MisVxQႥ; h89嘫){({{sddHMm$w?U> hGW\KA\+)HzfQ/Ph׆0ū|d& &xb%W b5d9YþzoH10jbz ."Dbƶ1:{շJķu ۔gh;.E\tCs罈i=|Ck?ЃrRn#GT+g4oCfE!$/sx| M U^ghc;;E1"{Z:4.AN!djP)桬B$XSdk'}ON794uPMɴCO(INk#ACy^?n`MA<J*k˅}ٯkE\2c8}/^rhiA8[l%9]-= >T^ @͏,:L c'nϘHWnS-DSljگurFaڋ#(,ꚀE0oz21_Q5(E G`Z&ՔM=xJV95 ` ӥ1ATx[CCKD>#aޕ)G~;D}w;śˀ^NLD4[`z#G=ԍOЏ<=?P]ʁ0bMG[0dcZ &axX&JFא4s:MZñUzޔ0kV^vf]~ZQbȪ2fg;d1Cppha-s`.Xt )-8!T*׿ /nET2/Fȗ {|*|uLl`48M351_i2X`1td]Ev[=9Jd\\Z帰neAaNHJm`Z}bI#dXsfMV4:'%dN]P^V%' ud!cm?xXH^d eS|g$7ppȻ]'rHzYG),vGǬ[۰g90AWe8 Z:A|ICۀ H :OpŅt@TԬlvH٠L\%db[ 0 /sȖ_o~ Vm@lЀyh@5#L6$1?^"x GRPv[D֢al{)) z;~KmIZd"/-jP%2>[E( Mt8˂ZSkl,I/P1}]gͺ>]YO60BL<dR #%d[s'(]w P`U2{,fgzp2):ȟY]47C"Du om(]T}8otȍR([kPc'&/cɩ%{5a 7OCJ?`SA=IԊk>1ý&C kd_o ix5|FP'klUc#b5DՂ,_Nѥz氥QⓍe |.%:ӂj`.`pj)r!|^3k- @9l$I+L+qY,g9(-hjlM6["UP?Cm[#df-37fUfsT%%/+~ YZ