freeradius-server-python-3.0.16-3.6.1 4 > $
A p ^|pp9| ! XS1Ҟ [2
62@=[:5 h|9~Zb#¬P, P>WH!_9|3sAdv4 d. $8 jcş* )n횫 YYP0}
a9~,ϚqMuպ-05æU9mZmPf\(I8tr4&"l;wje?Mω/ŧ{cf3dc094c79c59c9d3913b5cf205eeea22eb2640 a57a060b808846164d26dd067540cdda5e112a52d818687f34fe2a06ea1d6b9e 8 ^|pp9|g 6+5:HMA>>- E vЭVT wq~yrYM8Ϡl՞mP!jZܚ(Y$^ƑT61b4kG6ZcvkAZI6.K IgWr0BbG:t6'=dOЯòGfG0maÙ i}Z)"]Tg_q92ϿQ:<ƫ2"|4CP/3[!:N6,='# > p > ? d " ( F t x ! ' 0 < B
H T
0 < x ( 8 9 L : o F G 0 H < I H X L Y T \ p ] | ^ b c d e f l ! u 4 v @ w $ x 0 y < z T d h n C freeradius-server-python 3.0.16 3.6.1 Python support for freeradius FreeRADIUS plugin providing Python support. ^|onebbiolo SUSE Linux Enterprise 15 SUSE LLC GPL-2.0-only AND LGPL-2.1-only https://www.suse.com/ System/Daemons http://www.freeradius.org/ linux ppc64le A ^|o^|o^|o 04739c5db8eacda59c3f3e85a824fd1437151fd6936e2f6585597c9f5b4464ab f0f06f3cc56c274b206e5092f37867b96cdc3cc33e00326361e3789c87864f23 root root root radiusd root root freeradius-server-3.0.16-3.6.1.src.rpm freeradius-server-python freeradius-server-python(ppc-64) @ @ @ @ @ @
/usr/bin/env freeradius-server ld64.so.2()(64bit) ld64.so.2(GLIBC_2.22)(64bit) libc.so.6()(64bit) libc.so.6(GLIBC_2.17)(64bit) libpython2.7.so.1.0()(64bit) rpmlib(CompressedFileNames) rpmlib(FileDigests) rpmlib(PayloadFilesHavePrefix) rpmlib(PayloadIsXz) 3.0.16 3.0.4-1 4.6.0-1 4.0-1 5.2-1 4.14.1 ^{G]c\["
- Complain if the detail file reader does not have permission
to read the "detail.work" file. Fixes #1398
- Fixed SoH. Attributes were not being copied to the virtual
server.
- Used a wrong list to global statistics in "stats".
- Create EAP-PWD identity correctly. Prevents segfaults.
- Dynamically validate authentication types for PEAP and
EAP-MSCHAPv2.
- Fix includes in installed headers.
- OpenSSL 1.0.1f and 1.0.1g do NOT calculate TLS 1.2 keys
correctly. See raddb/mods-available/eap, "disable_tlsv1_2"
- Allow password change to work for MS-CHAP. This requires
'r=0', because password changes are not retries.
- Fix home server fail-over for home servers using TCP and/or
RadSec.
- Special characters in expanded regexes are now escaped e.g.
User-Name containing '.', and comparing /%{User-Name}/, the
'.' will now be escaped. See src/tests/keywords/regex-escape.
- Use correct authentication vector when sending Access-Reject
replies for RadSec.
- Set FreeRADIUS-Proxied-To in TTLS again. You should use the
"inner-tunnel" virtual server, instead of relying on this
attribute.
- Fix debugging constants in rlm_perl. Patch from Herwin
Weststrate.
- Add samba-dev / samba4-dev to debian builds so that
rlm_mschap can automatically use the new winbind API.
- Automatically skip zero-length attributes when sending
packets, instead of erroring out. - fix bsc#951404
* Rebuild of freeradius-server package fails
* fix source url
- ftp://ftp.freeradius.org/pub/freeradius/
+ ftp://ftp.freeradius.org/pub/freeradius/old/ - update to 3.0.10
* Changes of version 3.0.10
+ Feature improvements
- Do more optimization of unlang policies. This makes run-time
a bit faster.
- Re-name most of the functions in src/lib. Third-party module
authors will have to do the same.
- More documentation on contributing and how to write modules.
- Update radiusd.service for systemd.
- Open IPv6 proxy socket if the server is listening on IPV6
auth / acct / coa packets.
- Create debian packages for DHCP. Fixes #1125.
- Add more tests for "update" section parsing.
- Update "man" pages.
- Update attributes for Alcatel 7750
- Add dictionary for Boingo Wi-Fi
- Add support for DHCP lease queries.
See raddb/sites-available/dhcp
- On HUP, check all modules for config files which have
changed. And only re-load those modules.
- Allow FreeRADIUS-Response-Delay(-USec) to be set for RADIUS
packets. Patch from Herwin Weststrate.
- Documentation fixes from Alan Buxey and Matthew Newton.
- Update "logrotate" script.
- Added more RFCs to doc/rfc for new standards implemented by
FreeRADIUS.
- Don't crash when doing "radmin -e "help hup". Patch from
Matthew Newton.
- The dictionary parser now does more sanity checks, which
prevents run-time problems with invalid attributes.
- Update debian packages. Patches from Christopher Hoskin.
- Many other debian packaging fixes from Matthew Netwon and
Herwin Weststrate.
- Add "session-state" to Perl. Patch from Herwin Weststrate.
+ Bug Fixes
- Fix rlm_files so that there are no collisions when loading
10's of 1000's of users.
- Fix radclient to use our internal v4/v6 parsing functions.
v6 addresses with ports now work correctly.
- Fix sending/receiving packet messages to wrap v6 addresses
in square brackets '[]'.
- Check for sasl/sasl.h when building rlm_ldap, and disable
SASL functionality if unavailable.
- Fix issue which caused a non \0 terminated buffer to be
assigned to attributes if the value being assigned contained
an invalid escape sequence.
- Fix deadlock when reconnecting connections in the connection
pool.
- Fix potential overrun in functions that used fr_utf8_char
with a non nul terminated buffer.
- Fix decoding issue for Tunnel-Password type attributes which
were very long. Found by Denis Andzakovic.
- Fix radclient issue with TCP sockets on FreeBSD.
- The server now creates ${run_dir} and ${logdir} directories
in daemon mode, when running as "root".
- Handle tags when using maps. Fixes #1191.
- Fix crash when CoA packets time out.
- Fix parse error in rediswho
- Fix regex support in SQL radcheck the "users" file and
radsniff.
- Register listen xlat earlier, so that it's available when
the virtual servers are being parsed.
- Parse Ascend-Data-Filter when given as "0x..."
- Print Ascend-Data-Filter correctly. Add test cases for both.
- Allow old-style clients again. They will be disallowed for
3.1.0 and following.
- Complain instead of crash when "else" and "elsif" are in the
wrong place.
- Clean up memory more aggressively. This lowers the maximum
memory used, most typically for TLS based EAP methods.
- Prevent the server from unlinking the control socket of an
already running instance.
- Fallback to using the configured OCSP URL if one exists, and
no URL is provided in the certificate.
- Return CoA-NAK if proxying CoA fails. Based on patch from
Jorge Pereira.
- Lower peak memory usage by decreasing size of internal
memory pools.
- The control socket is now left in place if a second copy of
the server is accidentally started.
- Allow virtual attributes in "switch", "case", etc. Fixes
[#1240] and #1265.
- Many spell check / typo fixes in comments and example
configuration files.
- Better handle multiple DHCP listeners.
- Don't print secrets for old-style realms. Fixes #1267.
- Don't fall through in empty "case" statements. Fixes #1274.
- Update EAP-TTLS so that MPPE keys are correctly calculated
with TLSv1.2.
- Always delete MS-MPPE-* from the TTLS inner tunnel. This
allows TTLS / EAP-MSCHAPv2 to work. Fixes #1206.
- Fix off by one error that caused some MSCHAP-Error messages
to be sent without the password change version (V=3) and the
textual message component (M=).
- Always include C= V= and M= in MSCHAPv2 errors. RFC 2759
does not say that any of these fields are optional, and not
including V= caused errors with wpa_supplicant.
- Do not include M= in MSCHAPv1 errors. It's not supported. - Fix boo#912714: freeradius can't use ntlm_auth
* Create winbind group
* Add radiusd to winbind group - Remove gpg signature file
* The gpg signature checking is broken and doesn't work - Fix bsc#935573: Insufficent CRL application for intermediate certificates
* CVE-2015-4680
* freeradius-server-CVE-2015-4680.patch based on
https://github.com/FreeRADIUS/freeradius-server/commit/a03814af310bb3bee74ea012546d99c48b0ea5c3 - update to 3.0.9
* Changes of version 3.0.9
+ Feature improvements
- Make "pool" configurations more consistent, and update
documentation for them.
- Move connection pool logic to "most recently started",
instead of MRU. This should help with pool stability.
- More VSAs for 3GPP2
- Added examples of multi-value attributes to rlm_perl.
- LDAP-Group and SQL-Group attributes are now dynamically
allocated.
- Only the "sql" module registers SQL-Group. Other instances
register "instance-name-SQL-Group", similarly to "ldap".
- Unknown attributes are now complained about more often when
used in unlang statements. e.g. if (Foo-Bar == 3) used to be
a string to string comparison. It is now a parse error.
- Rename RLM_COMPONENT_* to MOD_* in the code. This makes many
things easier.
- Move to C99 initializers for modules.
- Load modules in raddb/mods-enabled. This allows attributes
like "LDAP-Group" to be used in the "files" module, without
explicit ordering or listing in "instantiate".
- Added 'bootstrap' section to modules. Third-party modules
will need to be updated.
- When adding clients from a DB, add them to a virtual server
if that virtual server has a "listen" section. Otherwise,
add the clients to the global list.
- When reading dynamic clients from a file, don't expire them
if the underlying file is unchanged.
- Allow the server to originate CoA requests from the
post-auth stage.
- The server creates ${run_dir} and ${logdir} in daemon mode,
if they do not already exist.
- Add dictionary for Wi-Fi Alliance Hotspot 2.0. The server
now supports all mandatory and optional attributes for this
specification.
- HUP now re-loads the configuration only if the files have
changed. If all files are unchanged, HUP re-opens the log
file, and does nothing else.
- Much better debug messages for EAP-TLS, including which
attributes are cached, and when they are retrieved.
- Increase default max_requests to 16384. Memory is cheap now.
- Added "stats memory" commands to radmin. Debug build only.
- Aptilo controller dictionary updates.
- SQL modules now use Acct-Unique-Session-Id everywhere.
- The redis modules are now stable.
- The LDAP module now supports SASL "interactive bind" method.
This allows Kerberos based administrator and user binds.
- DHCP code is now in libfreeradius-dhcp.
- More DHCP encoding / decoding unit tests.
- rlm_replicate can now be listed in the "accounting" section.
- Better sqlite debugging output.
- Remove "required" option from many sql_ippool directives.
- Set default CA "basic constraints" to "critical". Fixes #1073
- Updates to help / man pages from Jorge Pereira.
- Added more tests.
+ Bug Fixes
- Be more careful about unused config item warnings when
using -Xx.
- Move more defines to be auto-generated.
- Allow virtual servers in proxy fallback.
- Allow %{module:} to work.
- Don't crash in RadSec. Closes #980.
- Return better errors when a unix group / user is not found.
- Re-enable detail module "locking" parameter.
- Don't crash when logging replies from Status-Server packets.
- The couchbase module now uses "update" instead of "map", for
consistent with the rest of the server.
See raddb/mods-available/couchbase
- Don't require NT-Password for MS-CHAP password changes.
- Be a bit more careful about decrypting MS-CHAP-MPPE-Key
attributes. Closes #1013. There is no perfect fix, tho.
- Fix security issues with EAP-PWD.
See http://freeradius.org/security.html#eap-pwd-2015
- Fix dynamic clients read from SQL in non-debug mode
- MS-CHAP now allows retries (i.e. password change) when
passwords are expired.
- Allow "user=radiusd" when the server is already user
"radiusd"
- suid up/down works on non-Linux systems. This means that the
control socket should have the correct ownership.
- Fix issue which caused the server to sometimes have problems
when a home server was marked zombie.
- Fix format.pl because Perl is now more picky.
- Fix proxy to Packet-Dst-IP-Address, so that it uses the
correct destination port.
- Fix corner case with cursor functions and removal.
- OpenDirectory fixes and documentation.
- Fix leaks in rlm_redis.
- RFC 6929 "evs" attributes are now encoded / decoded properly.
- Fix talloc pool leaks when receiving malformed or
retransmitted Accounting/CoA requests.
- Printed attributes again use double quotes instead of single
quotes.
- Set X509_V_FLAG_CRL_CHECK_ALL, and add "check_all_crl" to
eap.conf. Fixes oCert CVE-2015-4680.
- rlm_expr now errors out correctly on malformed attribute
references instead of triggering an assert.
- Make "break" work in "foreach" loops
- Allow dynamic expansions to work again in the "hints" file.
- Correct minor typos in comments and examples from Alan Buxy.
- Re-urlencode the path portion of ldapi:// urls before
passing it to ldap_initialise.
- freeradius-server-rlm_sql_unixodbc-configure.patch removes
hard-coded directory in configure script of rlm_sql_unixodbc
- install new module rlm_sqlhpwippool.so - minor adjustments/cleanup of spec and changes - update to 3.0.8
* Changes of version 3.0.8
+ Feature improvements
- Allow syslog_severity to be set in rlm_linelog.
- Allow defaults to be set for bulk clients in LDAP and
couchbase.
- Updates to dhcpclient. Patches from Nicolas C.
- rlm_mschap now supports direct connections to winbind,
which is faster than ntlm_auth.
See raddb/mods-available/mschap. Patch from Matthew Newton.
- Recommend /dev/urandom for TLS randomness, instead of
${certdir}/random
- Allow TLSv1 to be disabled via "disable_tlsv1" in tls{}.
- Allow Expanded EAP types where vendor is 0 (IETF) and type
is normal EAP type. Supplicants sending Expanded EAP types
like this are broken.
- Add support for server side sort controls when searching
for user objects in rlm_ldap.
+ Bug Fixes
- Don't complain about "authorize" in "server {}" blocks, but
only if there's no "server" block.
- Fix cosmetic issue where debug from the first packet read by
a detail reader thread would be emited during config parsing.
- Fix ASSERT on truncated detail packets.
- Don't use main server log functions from within panic_action,
as in the case of syslog this would cause deadlocks if the
fault was triggered from within a malloc.
- Fix issue in "switch" when "correct_escapes = false".
Fixes #911.
- Fix sqlcounter configuration to use "%%b" instead of "%b",
otherwise the new syntax validation will fail.
- Allow forward references in configuration items. Modules
aren't always loaded in a sane order.
- Fix more escaping issues. Closes #912.
- Decode MAC addresses correctly for VMPS.
- Fix memory leak with TLS connections.
- Fix state machine threading issues for conflicting packets.
- Fix copy_request_to_tunnel issues for tagged attributes.
- Allow "ok" to over-ride "updated" inside of Auth-Type
sections.
- Update state machine so that post-proxy is run though child
threads for performance, instead of blocking the main thread.
- Allow "netmask" to work again in client definitions.
- Relax restrictions on SQL group queries.
- track outgoing proxy sockets and clean them up more
aggressively.
- track proxy statistics, including CoA and Disconnect.
- If radmin has a connection failure when running a command,
it re-connects and runs the command again.
- mark home servers "unknown" less aggressively.
- Fix potential SEGV in PostgreSQL driver on error.
- Fix issue where fields like nas_type would not be
accessible via the %{client:} xlat, for dynamic clients.
- Set default busy_timeout (of 200ms) in the sqlite driver, so
writes don't cause selects to fail in multithreaded mode.
This is user configurable, and may be increased if required.
- Convert Password-With-Header attributes to binary (from hex
or base64), in the authorize method of rlm_pap.
- Fix invalid assert in state.c, that could cause abort in
post-auth.
- Fix double free when -m flag is used, and connection pools
are referenced by multiple modules.
- RADIUS over TLS accounting uses the same port as
authentication.
- Regularized return codes from radmin commands.
- Fix RHEL spec file so it works correctly for Centos7 which
uses systemd, and didn't like the SystemV init script.
- radwho and radlast now have a -D option to load dictionaries
- DHCP packets are no longer checked for duplicates.
- Don't crash in sql module group comparisons in corner case.
- Calculate MPPE keys correctly when using TLS 1.2.
- Fix load-balance sections. Closes #945
- TLS certificates are available again in the post-auth
section. They are not available for session resumption.
- radclient encodes CHAP-Password properly when using -c
Closes #955.
- Fix issue in rlm_cache_memcached driver that caused variable
length values to be truncated.
- Fix track functionality in detail reader, so it no longer
fails with a "Failed marking detail request as done: Bad
file descriptor" error.
- Actually add the peer identity (as User-Name) to the inner
tunnel in EAP-PWD requests, so it's available for lookups.
- Fixes to PostgreSQL queries. Patches from Santiago Gimeno.
- new set of consolidated patch files:
deleted:
* freeradius-server-2.1.1-logrotate_su.patch
* freeradius-server-2.1.6-rcradiusd.patch
* freeradius-server-initscript-pidfile.patch
* freeradius-server-radius-reload-logrotate.patch
* freeradius-server-var_run.patch
added:
* freeradius-server-radiusd-logrotate.patch
* freeradius-server-rcradiusd.patch
* freeradius-server-tmpfiles.patch - Do not disable as-needed build
- Remove the with_sysconfig switch and just stick with versions - update to 3.0.6
- fixes a segmentation fault in PEAP module (bnc#912588)
Feature improvements:
* radmin / raddebug conditional errors are printed to the output, instead of being discarded.
* raddebug will exit if condition set with -c was invalid.
* radmin auto-reconnects if the connection to the server has gone away.
* rlm_cache now has submodule support. See raddb/mods-available/cache
* New memcached driver for rlm_cache. See raddb/mods-available/cache
* Add support for &Attribute-Name[*] in conditions. See "man unlang" for details.
* Add &Attribute-Name[n] which gets the last instance of an attribute e.g. Module-Failure-Message[n].
* Allow for redundant string expansions. See the "instantiate" section of radiusd.conf.
* When checking IP addresses in conditions, make the right side be parsed as an IP prefix.
* Support JIT compilation of compiled regular expressions when built with libpcre.
* Support named capture groups with "%{regex:}" when built with libpcre.
* Increase regular expression capture groups from 8 to 32.
* Emit error markers for badly formed regular expressions.
* Allow 'm' flag to enable multiline mode in regular expressions.
* Support limited implicit attribute conversion in update sections.
* Support casting between IPv6 and IPv4 where the IPv6 address has the v4/v6 mapping prefix (::ffff:). - Drop .keyring and .sig file: freeradius-server still uses MD5
signatures, which are no longer validated/accepted by GPG 2.1. - update to 3.0.5
Some of the new features:
* Allow LDAP to specify arbitrary attributes for dynamic
clients.
* Allow one level of backslashes (finally). See radiusd.conf,
"correct_escapes" setting.
* When supported by OpenSSL, allow TLS 1.1 and TLS 1.2
in EAP methods.
* Allow multiple new connections to be spawned simultaneously
in the connection pool, to cope with spikes in traffic.
* Use kqueue on systems which support it. This allows for
better scaling when using many sockets.
* Home server "response_window" can now take fractions of a
second. See proxy.conf.
* radmin now supports "show module status", as thee counterpart
to "set module status"
* "ipaddr" will now use v6 if no v4 address is present. You should
use "ipv4addr" or "ipv6addr" to force v4/v6 addresses.
* "client" sections will allow "ipaddr = 192.192.0/24". The old
"netmask" is still accepted, but the new format is preferred.
* Allow custom HTTP headers to be set for rlm_rest requests using
control:REST-HTTP-Header (attributes consumed after use).
* Extend format of %{rest:} expansion to allow HTTP method and POST
data to be specified
and urlquoting.
* Add support for aliases in rlm_ldap.
* Add support for connection pool sharing to all modules that use
the connection pool (pool = ).
* "tls" sections now have a "psk_query" configuration item, for dynamic
queries to discover a key from a PSK identity.
* Preliminary support for EAP channel bindings.
* Foundational work for dynamic home servers. They do not yet work,
but this is now only a matter of updating the "realm" module in
a future release.
* Support &attr[*] syntax to copy all instances of an attribute when
used with the += operator in an update section. May be qualified with
a tag.
* The logintime and expiration modules can now be listed in the
post-auth section. This makes some configurations simpler.
* rlm_sqlippool is now IPV6 capable. Set "ipv6 = yes" to get
Framed-IPv6-Prefix returned. The SQL queries have NOT been updated.
Please submit patches.
and numerous; bugfixes
- remove gpg-offline
- create /run/radiusd after install
- drop freeradius-server-opensslversion.patch (upstream) - freeradius-server-opensslversion.patch: do not check the minor
version of openssl, minor versions are supposed to be compatible.
bnc#906682 nebbiolo 1585213431 3.0.16-3.6.1 3.0.16-3.6.1 python example.py rlm_python.so /etc/raddb/mods-config/ /etc/raddb/mods-config/python/ /usr/lib64/freeradius/ -fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -g obs://build.suse.de/SUSE:Maintenance:14500/SUSE_SLE-15_Update/04f921ee0dbe7d4ce2443b589609e23c-freeradius-server.SUSE_SLE-15_Update cpio xz 5 ppc64le-suse-linux directory a /usr/bin/env python script, ASCII text executable ELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=4cf8c64992b367d3566e13a8d199e4d21b9980b9, stripped R R R R R R bHG\+ qh utf-8 7ecb3dbddf4d684c0e840ac07fb1c991499138a0392b3655c6e2b57cfbbeb526 ? 7zXZ
! t/))]
crt:bHW yfuO6s %?r8 e7Om[pB^ 4˫CJ9pNoٹ_@PcA3^Ex$~ofe/A08eʰ 9IM)B˟콉^:A
sl 2r\@D GʊҖyn#!f pPrA4lpNidnҒJ#;%j\[$JArHh5q/p/i= ^hDnڽ JHx6]{*i"VY=q!FPs_/2 rqWP*і _X 2Y8g#bzRTG3*uP\z>Ka @ (%|o%A}藄P]X(xN v0afʒ&g`Ә.8𦪡l^e]! 6!!YEk>JL9íl7|VnH'Խ8{[أǎQ`U
1 >8GM}P<0#*J|܈2ܫ>ͱ`/K-D]#jw_ԃ-0ȥd/*ZM١7$`N_F +&E MS|m6 iيt7S b2q zm%ҙӳ M y|<AY顕&!K /#(|ǖMƕ9&FI! yFʴu#z wuGYq
mۑkc?g1|VT5+"۲RZ
w*rg
D oMO
ιeF p22cmwd!ٻHÿ
_5h w| n@S;M \嗙qV=\162k>,/-kޥ\ʸwPEjw5ʅ5~j 2'܉.:wkn2 &ȎH{mHf)R! qEW:}xhn.EGw6>ez"eS}{8F`"Pon?JØ. V_#._!$|Av-s$Y[iFЖL diJ? P9܃ W2+6\r)RktCѕnpT}#
Zqt4TW&w;}ZvفPlɭ3bv
cD94S0̹xyRL`̫SJ'LS^ bk\.'j b
?h @mm:d!ˆ\LpA"#8mIrb?0}.I10$"˻VxU009 X5S 7T D٤ߺWGV> F ?9,[Q[ T4hx{uhv|?$Ex*볁J%7 'ab8he/c'axU My\? "X'_- aZS<1}i4,;]x)L6kq
7kؐD8MBj,X?328 ΏLjjC(c cx P" -J\:L+e+t"ozp9jvmbzS gA|-8 U UG3&'LR HZ1܁mڀj ZB7J[k8CK/4]+S* ,` ۓQ$I퉼^*.}߹o0,>1_xa $ށ+#]%7L?zP9bVZ Ee8$"- 'q;CbwTeC'7yΠ,T.f07Z>U00@X:xQt܊Qyurju(U@8ԜB2 E<~Y$ Q
wVɉ `8 +Ygݰ5^ /r 0, HyS*mшHQT
CPb9p) _3FxkH*D8];_TJ( 읿G~kh.xJd\lo~Bj]1 L"
<$ aHG3!#Վd;uq'¶1f1wLeCR0? ok8P`;V` u9Aҵ~%|L, CY=OB*8e؝keEW:5\S_92
Bǩr,zK`b.@woy如MuUһpKUdcW w>*ʝ
_2|^kqeTzШVj0rK_ sYv̷ V3}~PɻvF!@x=7v,4sQ`CU#: τPS+6eʜ[OmȷSV*U:|o]|{}w-ty% `KhF6ɢ3RV, #rVjUs=3-|Z@
[ d8t_l CGm@[bѺNgcO@:: u][w%6ePI*94 % }
:"1#[ Z,tq/FVҪ4zuvajןi^@D#ݯŌh ϛ.j4`y0TJc%!: Y?7 >{_"
a{:_eb{ fE
AI $)U
>_ָ72j`(#$< B@;4Օ~R7L?g:T7غCn=;'-{x;B.\"v5" vebaM A+ 5_쁬W፵wU lPA* )Otkm X MU`Rv
L I1b 9-4k8^
nu(* 4#` ʝm*>P {GF}#`
s0xS;) Ɉºw6h2O}i1Wp:٘*Q(*ՄTQ-9u(ݣ3YlQ$ab(x&E,'5(:/F $ 955.V&=
1̭蟗4QM8HVȎh =}foMAzEb6fF߱r ?}wEe&s^%˫|y=]s@+L=!E^,,3x&|5f@՟$rqǪEQ!܍oعp(hZ !0lf~/hB2 e6t=$ѓbXok}bٛ } ",loYWexN
Ι@-t$ޔb G+tUO5SR<0Z6 Y( e tID1Ez1jkyYX8BVcX`+~:Y)Abe
f8=U/G#ɸaÐE*dsVh v\Kc hQ?R L5{ROY8scYAb>GZ<{n}81Y
|}b_if#W},j]ّKh ̄[Q0 xYm! {X%#a^gNVVl߽W X)p7_?D}_Hx:HdP^ .wC@;L= QwB %@q
Ũ&t-X0
.ڹ 'FWKu"ϟ{a g NG\(N dN۠2noEu%[4 Ϊv 5ە4SD=4?k
=+n/+hSuzeN,.t Hb[|Z4dJ6b 2~ gV?ߪiu
m^\`'EP肇*?;45Kr OdAm
JmĔ;aQ Jnl[k|)h2|{Ie*甚 ScPՑwp,Fp:Eձtox W,C>
?0wc7zNx$ܫ*H!c{_4cGK'kR@}bBk>f)
̰s}<}zd4}rx$RQ3u cT+Cg3ʘE^1.Oj!:ݤ:!*[3I>|= D<DctUAɭ-b] r|
QZgsU:P+Dt)3HoX7ybգs ɂBCN@C( %s Ie`?? ObDTؗj JͳVlSג4 2|꽂9L=(L zzԶ&>( rD^IQ
cʮ=6[]
n6SO_ rTқNε̖^l[&" \tl09\z姬|:ikǏ_2U+E!=?G )*t;زK gq Uicaxgփrw 6j%H /.ptF7) ZcX룺աTW84$RϺl`o F7O3 u5e&࣏X#š+3 D3Zݡ` ""(`nUCs%$IFJ&iUעuS%+i'̐1)y#%`; %2H! & w%bӞOQ iR% dr );DfzJBy1n*v2O87Ö`CykLVʍc5}LX&2 rhjU
E$ؐv!iFO73 zOtHL5ʻ1 `sR;E8%<+5;nq.#5p osESLRFoBB=.P<>(4 jH
Jav'c/PMio,-iT Uͩpp6+!7l x0{~c\ɕ4I h%|`M(fc h#j*]o1 kf ~T#&ڌALP5TR!KMX˖5˯X\ g/ Zh)hcoק+JJmi^[
n&
"Ǔ/WCIgpXE&*i?Oz_5rE^qL$Ͽg;_ J bDXc \a: vI fyk@R
0Q56Us_{iћ Qv%~f
0}8J|mh8`w_ϩmu) `<
zWAv[J__F9 HֹDh}0 q'wbu<8uQki-9/`סWh4eD)Hؾ{W`#%t~s* G9:$As :뫺VV+ލԄ6 mݔ<{Ooi|3{ ).#_QhCunɓGȵ52/ިbk/3*vۃy~Mщtnu T 7crmy +Y74!"$ KcPI B?]{o98צ\,"y 7Vƨϥ
á۸ O([1C b:%b% j ?(mcy+YwHR*?+Y.K
F+1QMl :eghƀ/ rWf!mtf *
줁(p( ?8P9e8,:z& ȂU04n@}*ᘍ0P& L#)7 Nyc![-~xЂ<_Tee's@<}Io BB63*'yGl"5s:/bTݯǠM Z+L}f. *wd:䅾dxm 02{o|-wΕ
v┠ G2n9zZù 8p ר9 [o¦ANnA[:kǞ +PZI&,s&bo`ܩAw%W=sRʾ/&tٯ.BлPE *xo1h JwaN<Uz{WYn)ꤵ/C=73IbuR"?IFj(S Q'nɅ[1R
g; Y
ݲX]9?<ޗxzsHGrƔjww6EwbqKwgܡ4w/*$Ǘ<RpW[a t/ZCl8wMh$5F ï:Z Uߡk=1Zæc"ÅݐCαei \x ]Sz
$ \XW
Jk`#0!`ȵژ{ X)2Y\%+!4&6f:1( `I,50 w,cl `+ ) "\k}\Z=͝g<ă ub/:*h%U #aGX6<{&ҞMK NaE#x`?d[ vz2 Qz4pUc,;i+`LJa~; PD،2IH#73*f۰\g1]r[d {#@oph ,.w킶KN#Ü| Ǔ!Vo傅@X`K# ]eLxU3d!w=fk.(L63̲JjNW~X(.8'i2_-3tZ Α
ԷhBJP؉=l mgl4u`w&k=H^/ +3i6!\1X.)ޤooPLIlEI1 =cGj-}.E0.d6 ř˯Ջ-P@!qOkGeCHGwdAo?ԓ,FV[_O, yZ*X 9x}@
RO`L3~E
Z >!7:,&`9WqjHy:É6:ݡq}O #S| .̻;~TCї]B@""oDH0ڊy] d;( r+8)" v.KoPӨ42 z[N**j3.i'BN|_NRc֡qb &;>Q,5:1ˆd7@ IaЊS/m JgAkhƬsIpU5ύ:3QRpHe8 x~^Q)H]` b.yl#AJ(UbwGLS.% 2Q0JUr$9*\ƣJu;r7ez.'rB8v+Hj GC6+C)$7==Qզ04SlsX$^}۳/ 3v1
H 5+#~@6Y+R
D
,>
V`/ŤW8Pј]UY YLz6%Q|q66cz TqO09}=dž^t/6xW00֟RFCQ;@?f!hF|Ewt=;.Aolz/>'֝)ެ"+|{ -MlD-=j%ܥ;l6(|4W؛
`=]Mw@2.(p(s^sk3 HߗOŭ9s G c AԹ0Lt}{%]Ǫ)& ȷ07Š5`V@@Rζ
h[yrPjZ)L#cƠ~OQR9ÝZ v('
s<*sĩG#k~L[1?;@ ;ite/tcPx)g <~ sZsv%;4݀ssݸiQ6>bu7ۄ~YBR }wU9I fYZOrR wߛ9 d&I
i3 "]{/ؚH| ʻ R Z
YZ