From 5836e01885ba606550eff59ac855ea0bee2434ab Mon Sep 17 00:00:00 2001 From: Celestino Rey Date: Wed, 31 May 2023 12:18:39 +0200 Subject: [PATCH] Primer commit con todo funcionando --- client.conf | 174 +++++++++++++++++++++ generaClavesCliente.sh | 13 ++ make-config.sh | 19 +++ openvpn-20230517.tar.gz | Bin 0 -> 86180 bytes openvpnInstrucciones.txt | 147 ++++++++++++++++++ plantilla.conf | 46 ++++++ server.conf | 319 +++++++++++++++++++++++++++++++++++++++ sysctl.conf | 68 +++++++++ verEstado.sh | 1 + verLogs.sh | 1 + 10 files changed, 788 insertions(+) create mode 100644 client.conf create mode 100755 generaClavesCliente.sh create mode 100755 make-config.sh create mode 100644 openvpn-20230517.tar.gz create mode 100644 openvpnInstrucciones.txt create mode 100644 plantilla.conf create mode 100644 server.conf create mode 100644 sysctl.conf create mode 100644 verEstado.sh create mode 100644 verLogs.sh diff --git a/client.conf b/client.conf new file mode 100644 index 0000000..f51cca8 --- /dev/null +++ b/client.conf @@ -0,0 +1,174 @@ +############################################## +# Sample client-side OpenVPN 2.0 config file # +# for connecting to multi-client server. # +# # +# This configuration can be used by multiple # +# clients, however each client should have # +# its own cert and key files. # +# # +# On Windows, you might want to rename this # +# file so it has a .ovpn extension # +############################################## + +# Specify that we are a client and that we +# will be pulling certain config file directives +# from the server. +client + +# Use the same setting as you are using on +# the server. +# On most systems, the VPN will not function +# unless you partially or fully disable +# the firewall for the TUN/TAP interface. +;dev tap +dev tun + +# Windows needs the TAP-Win32 adapter name +# from the Network Connections panel +# if you have more than one. On XP SP2, +# you may need to disable the firewall +# for the TAP adapter. +;dev-node MyTap + +# Are we connecting to a TCP or +# UDP server? Use the same setting as +# on the server. +;proto tcp +proto udp + +# The hostname/IP and port of the server. +# You can have multiple remote entries +# to load balance between the servers. +remote reymota.ddns.net 1194 +;remote my-server-2 1194 + +# Choose a random host from the remote +# list for load-balancing. Otherwise +# try hosts in the order specified. +;remote-random + +# Keep trying indefinitely to resolve the +# host name of the OpenVPN server. Very useful +# on machines which are not permanently connected +# to the internet such as laptops. +resolv-retry infinite + +# Most clients don't need to bind to +# a specific local port number. +nobind + +# Downgrade privileges after initialization (non-Windows only) +user nobody +group nobody + +# Try to preserve some state across restarts. +persist-key +persist-tun + +# If you are connecting through an +# HTTP proxy to reach the actual OpenVPN +# server, put the proxy server/IP and +# port number here. See the man page +# if your proxy server requires +# authentication. +;http-proxy-retry # retry on connection failures +;http-proxy [proxy server] [proxy port #] + +# Wireless networks often produce a lot +# of duplicate packets. Set this flag +# to silence duplicate packet warnings. +;mute-replay-warnings + +# SSL/TLS parms. +# See the server config file for more +# description. It's best to use +# a separate .crt/.key file pair +# for each client. A single ca +# file can be used for all clients. +;ca ca.crt +;cert client.crt +;key client.key + +# Verify server certificate by checking that the +# certificate has the correct key usage set. +# This is an important precaution to protect against +# a potential attack discussed here: +# http://openvpn.net/howto.html#mitm +# +# To use this feature, you will need to generate +# your server certificates with the keyUsage set to +# digitalSignature, keyEncipherment +# and the extendedKeyUsage to +# serverAuth +# EasyRSA can do this for you. +remote-cert-tls server + +# If a tls-auth key is used on the server +# then every client must also have the key. +tls-auth ta.key 1 +client +dev tun +proto udp +remote reymota.ddns.net 1194 +resolv-retry infinite +nobind +user nobody +group nobody +persist-key +persist-tun + +# Verify server certificate by checking that the +# certificate has the correct key usage set. +# This is an important precaution to protect against +# a potential attack discussed here: +# http://openvpn.net/howto.html#mitm +# +# To use this feature, you will need to generate +# your server certificates with the keyUsage set to +# digitalSignature, keyEncipherment +# and the extendedKeyUsage to +# serverAuth +# EasyRSA can do this for you. +remote-cert-tls server + +# If a tls-auth key is used on the server +# then every client must also have the key. +tls-auth ta.key 1 + +# Select a cryptographic cipher. +# If the cipher option is used on the server +# then you must also specify it here. +# Note that v2.4 client/server will automatically +# negotiate AES-256-GCM in TLS mode. +# See also the data-ciphers option in the manpage +cipher AES-256-GCM + +# Enable compression on the VPN link. +# Don't enable this unless it is also +# enabled in the server config file. +#comp-lzo + +# Set log file verbosity. +verb 3 + +# Silence repeating messages +;mute 20 + +# Select a cryptographic cipher. +# If the cipher option is used on the server +# then you must also specify it here. +# Note that v2.4 client/server will automatically +# negotiate AES-256-GCM in TLS mode. +# See also the data-ciphers option in the manpage +cipher AES-256-GCM + +# Enable compression on the VPN link. +# Don't enable this unless it is also +# enabled in the server config file. +#comp-lzo + +# Set log file verbosity. +verb 3 + +# Silence repeating messages +;mute 20 diff --git a/generaClavesCliente.sh b/generaClavesCliente.sh new file mode 100755 index 0000000..5b920c7 --- /dev/null +++ b/generaClavesCliente.sh @@ -0,0 +1,13 @@ +#!/bin/bash + +if [ -z "$1" ] +then + echo "Falta nombre del cliente" + exit 1 +fi + +./easyrsa gen-req $1 nopass +./easyrsa sign-req client $1 +cp /etc/openvpn/easy-rsa/pki/issued/$1.crt /etc/openvpn/client/keys +cp /etc/openvpn/easy-rsa/pki/private/$1.key /etc/openvpn/client/keys + diff --git a/make-config.sh b/make-config.sh new file mode 100755 index 0000000..e3d5ce8 --- /dev/null +++ b/make-config.sh @@ -0,0 +1,19 @@ +#!/bin/bash + +# primer argumento: Identificador de cliente + +KEY_DIR=/etc/openvpn/client/keys +OUTPUT_DIR=/etc/openvpn/client/files +BASE_CONFIG=/etc/openvpn/client/plantilla.conf + +cat ${BASE_CONFIG} \ + <(echo -e '') \ + ${KEY_DIR}/ca.crt \ + <(echo -e '\n') \ + ${KEY_DIR}/${1}.crt \ + <(echo -e '\n') \ + ${KEY_DIR}/${1}.key \ + <(echo -e '\n') \ + ${KEY_DIR}/ta.key \ + <(echo -e '') \ + > ${OUTPUT_DIR}/${1}.ovpn diff --git a/openvpn-20230517.tar.gz b/openvpn-20230517.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..9f02cb7abd3a82ccc78254ee6cbafa36bfa18b42 GIT binary patch literal 86180 zcmV(-K-|9{iwFP!000001MFE@bK5w!&NF|7s`_Q7Jc$4T+)&fEiko&y)@ChlAP7p- zZi+G`{rY>LB#x8V>DyJ4o|-#BIUz*?2jAJga|C^;zWeC|!LSVDc7^fn^>&XbB^YDf zxXrUHtiP)mKOfq=cc){)^GfAizTX!=n)gTV|3k-z>QUxTGXI%j@PGEdj&+^FbBF_s ze)<2e7|;F}{Da7Uj)uy?=J$U8eARW6e$IbGH%;)rPB3{_K|ck}H{-wD|L@iC!g{k? z@x#HWS!??4D7-z@qGmG~UVYzP^%ic~^xQ>r+@Lx~eXHu|tIQi8z1g@Y{HIgmZD(cB zpS9Zid2{(Bx^6%0XkOnfYpZY^dCj_u$Dv!6ox!Abl|wunqj1qjVcA%UZnTQZ?kFTt zu!gH^Ow_Y$RBG@LJwIHzlW5Q{!^JFk==X!bEo!rA*XTU7M*X1|^hbbn*!&8G1~5E8 z5iAzry&J%U{@#as&utYGJPV$-{%O3P%pF>tkks0qs_A}wsh`MNFX?!S4_YtFmeog- z2ICSh8|B@0XvSi@?Miw+R5zlEo@mcAJFS*`SptYoIqSmq#lQLb!!$-aPlxOoRu5Pw|*?PEZjoOVn{aoEo?9tl7Pn=w|(Zz30 zuf?ETp0j#qTf5$MH}ms#?`^AcziaE&={EGoU9fQNTBE+(o}R8b#?A8JOofkI+Jn3# zZojtedLwVNDBSa`vs+kUBRKp1Fb&+N@VGEJZ(iD)0X{A0>d}>C`+%<_Y&X{%qTQ9v ze4ULBCv=z7i#Y8^wR!KMSRT7hFw9nVIVbgt{t9?JYzN|m? zXOTBM*8+E_Ht^gi^3lUmkaaQMbiHQS^%l#1x|-($EqJOD-fPx|Wo_9v%J!Xs>hqNw z-H;8U&>Ojd3$6oLDpHf6?1w7ky_E}6){ok9ozUQs^etbo{toq`i1i zw^u8io89A5@1Gpm+K#}185%b_c4Ar!I@PxNc1gPBEFVose{dD~GV6EEL+@cWI-fha z`4r%&oDS(0^Kf-{+VD=haVgUMwcgaL^Y&DGIPT2zhFnc=aW{?avr#ttMZe|ujDVk( zc*cbWVXUr)aMPYm0$BBiBPtSI`t@;RCy-nrM({aH->ka z*!I!dpyROLEf4ecfE4Ap(d}#o>xZD+42~$)X0^RBxfT!gJh?BQtnx12Upj|PvXx$d z!Y6l96~Wp)$mYiDMzi2#?JZ%p_IUsiyu7P!wP@bS0%9MUVKlAoW~P4EoVA=V9UeTh z)tOEG`|Em;UDln&@4ss|4hp-$_q_D)=FI<3`J;=&b+!`NdG?8Q)a8 zr)@0rFZ0zPIx_?#36mCcEM_7mD6?Yb#LSdT#tc)IrYv?C*BLgyh|Cr{UYv4SaW{*7 zo)yb2s~neHH_Qoq7!2KTC-Tdo06@=+n#bb_095?$?;$^4-ovbl?|#A0H(8Pum#+YJ z_eI5%={}dN67fp~TNUImj2WdB9qFV}k4E1uaMMEO6;^RiiwbtWT3~#&V0emGQWQ5x z-zL?!lPdS8c$0}rTV5*7UAq6;kS|`outEm zIUU(|FVsMY$&}fWQSc#RX2J}Man2B7G-bNYY|3;;c^F*!x`c$Kg2mu}&Wwa5f*Bx3 zFvn&H{4beqG67;aOZe*&sAQ?lVuP8O5tAXxBxcfJF;#Xq2qO?mHp7C6H!wilIVt0m z5y33VC}z6FaKd!XB&Y`Xxq6=9H?_ddZ31C7R*HiK5?F{71`Dw?Rv#1Cg{Yu@T>@co z!U!zanXWTSG6zhNDs@terBZ=OQYOL9^mPdY5(VbNTCj%BgjDK-O*l9xRcQncGIWI# zyz{yQ*oZS~GK(miLw1_55N;rXEv8d-gTSZY8uN7t;Kz@D0G`~Im;hU64pK;La41op z0!tF~hBqm5OyzxWqAe5#upv*B`?#%wAu*YBlwSbGTXrx3Drk*vH>Sc2kSxJ;$%Lbf z0P=Ogr2Ym5=Vp0e9l}yWnH}9C)3OvEa52Klq_JSO@wx;^3Ii+H;0qcv%9UG92ttQB zfZSwete%4+)*D*DUJ$x44Q@c?7(4<5X{i{4aJ3Ugi4p~7agsMAaF*WE6R6bDS*oiH z0;{UflFV|HMqDZ*<2N!35);%1Ga9y9qS9G1juDd=fi#{cR-z{VGv7I9IP6IFZ4Avkn=<;@?6NB zs!QJx*r(SXKLTy~@Vdx(wkwXT^4(s(%W7_C7{0dtGdbT_IRQXWAXSa|P6!GZ_89S* z6DmRk+qpFs7|hd|4|IcWfdw(@D*Ce_EOZqmp2=#j?(3e4rDFNZAMd=Dmn>013*2IZ zDxP8_-bye8j4)L#1Aem%MWK+nikHxh9%EHsVx+1DwZ1Heatv>Qtc+Xzg2WfP z+7ar4e&cE(RGkINf>qE|fcN{~~fQdNm?s;XoHNT_N;^+eH>QvXG1z_I!$O+}bMWx(XrPTRG3t4=^y4HDQ2%DRP>Sk-b6)tNwRfuypYA(c|k z%YiKcymjk~jQCRzV1Ny89R>8uz_C!-p&AOVY{L6l8Y-vzb6c%eH82Oa{3S4OjxWGJ986U+s5SuLc>`%qH=73czGQGe0lK%D}! z16s>ep`~I*DANI8xB)AHN1%q{n|T3=>OEd82ju+LeL;2T!XtS;P93t_N$kQnB&6mYx9(B4j+kru+M>lI)V*F~Q+Tz} z{b?aCx}P3`GwKgT(molj-flG5o;L{5+Wli;xJ4tdNa2snbI;MDaWhK~=hVAT@7hJR zFoL_PyUQ-uWo?<$YL(Vn$i1fKV0Yh*wpFJ$5bIt)YkIjPg;5f%RnLd(dc6}`(?Jvt zC)-{RYYxVR5AEP3rS|OiCiOHrx4JvliytH(4Xczf1Js5^Y+GbRLy5dDGlkKLt zILz<-gE^r6=0(JZG_`a$*L$1JzB>=rliicMh&yIwre=d)Dp+r!j9dzPwwdzkvhS?cJ9Y&Z@fT-)Aa zk$a1<=JiFOxg)pp5w;Bx75N@_%X)c(H}E_N^L?`~^oL8b-K=BMEX4M~h$jx3jectVkY zRHNba&~RP;7~9q1qIsN-*Zs*DhZD*VgYM}ps(0eiGr8_<7p3i>^{sF#J{FFWZ;P+pQtuMd- z68iD?U!wmy|NSe*Z`yB_&&Pz7-a+mj?zR8dL*o)-(rhxyE z!I5D(QZo_>LS;%U*aN4wa7-$>L8PFGod}@`E@87IO|fM|WKwu$NfE=M1PK#c8lgCi zO>R3Wu_cXVYD$sBLXuRbx{edDL&^b#LoFU-!HFrU9$N-7QesfTg~mb8#FR-YY@SL` zn8&)~I5s7z#dREOiIX^-rv#;XLMi;?DNQVa^wa?iB-LcX9ZV7fQDo^@5URsxBgFza zFi8-QAPmFOIW}!w*g~mhS~}?HB)XOAjz&^U9cWW%?8wxn64Xp>WMLwuG%dKJh<6kYvFBgrZ;k|Cfy4{_KEyG349BMm}e@{sC1~ z*kp@Jn!)pQpT9f?Q!BQoO_9A9n@sMC%BM*C_PFfp6@PB16{BT#{0Kl@0YkBrpZ2O8 zvqXNsVxLxcWy^P$Psomyf4={p%6=!`e_Hmx>|9w><4UrA*RQB>KL7z^D2zUr9`>P(2>)W1HTCnd+84opph0O#k;4?7f@kwA|fUthwWb>C!3WbOAbc`^f|n(4+O z^7P2Dq7!D7?9$Ia?xWEB`TO@Mr5m{=Xy>^g zc^{MZPIrWBSkTa0U zkv!6|)7GW0N(A$dLk?D97-&iX_gupj+C#)e{efCfsLv8&v)ZTmn!tB6_R!w+E@Cjh-*7J7tYt;q4@Si-1K zz(t>%Rza@CjbyVWhjpj($t_8{;xU^izClMjKVU)+rGQHc^e}c|gIhG7d4hkKZlnYB zKsy{mNg&<%H@p5Nm99y{(sGE0CLM{6jS-6Fv<4on2l!YE0w6SdMMCiPPp5 z`*pL8ky>4v0(`3c2l z8vd4!TS+*;&wz_8i8zv?$$4iMPHmR*oD41#XA+1%>NUsgN419QSn4r?nvylDGy;JY zf`t)PYf4mjl_sk_I9cuSIC2vF{#{)Ns%*H}E3MQ&Jh`W+=n}M*>)j(GYJS zFu4|UEYA}Y181e)+46~H?DHB~m8c?c}l0Ci# z>ku}NA(TcW9t%o1#6x@V&iJ%)!rT%VzRt?06&64jF&0j8W6gC4^~BStEjvW$1T_)w z0j_hTsin*1YQ%~Jug$yPsGNl3tCciEu3v&SnCIaCLq^{%ofB>yro#2sslj}ej7wG0OKuFOd|EqLsI+y$bru*3|wD* zs#YpTCM774I|p@}CxQBomp*?3>ysKZebIU+HOl;9=YNgG@P{3}@#%fW4> z+)0=;$jO4VGzBPC3Ck!If)U&z>F)QX&_EOi$*q`c;lso@C$4PA95O;GHBD%Ds33jU zNipVPh2wjh0(k_u{eqaKTCbI=7gu22`;npWeZ$%}4Kbi{39~E;ECV@U&M<|T)eWp! zNp)kK#lqbePY1>U=B%WKbumF>gvc>hCFx2kMsg&MLd7;pM^Ew`JDFt+x?mWlNb{66 z<<^z2rBO7C1ikz|wgRohi2vFcjQXvgY>dPx%3G?)t#Dg(Eti`Zf?Z>>#tH!89``X? z6;Q`wH@N?3iJ8Oh-eqA;$_qhQl}A*Tt5kIcpjErtF^(FrN9fWikcxp)I6_>@YAm=Qkn#y7`wAB&*Ud4f!gwR_M?v_hP zqVKIGUr~{DjGUNIcpISFXxKTV2Z9D3TPND6^!XpCQw+81*R}JSQY6fpi?|q>cXTP0 zmvSpa4YfM;M~yP|)Iq>^^ZT}ZqR44w59z$B8the<$OE$ypba|+WG0-Egb76qR3KzV z43aR1o3zZs>JfYVuJ&l^7WiXyg2j)tk|?XWG>0e|q^tV2Xd~OFg-GgH7DF>VfcOvA z3C8JdQE7*@BX-y@S6K2ik62TAi%94xhuH!?0A2v!l0!r2bm!aM8WJ!qu!#UxPr4EE zQcFR4oJlK_&{%+)Z1xq}FerPL9{R#U(Z$M~b*5YIVgAy5gT zVid3yH}W`NfccQ?@%^DuMUyY_Q^D;{5p39)Xmo;+=Sch3q2e)J5S-Y>w8)gTYmykW zq3xorSfRIt5F?|o6i`tK0z_10vuyxjw`e*>Kw%hP0mMvBlBYDbrD6oKj(~>tArmbe zUhG1uBMT%TBC)NP?)OBp*?4X>Cg@mB90xzkDuXJ)bmh7JQF7v?_XAgFKy=pQNT%Ky zFPK>f;Gs1aH7LsD=(RU29Hf&*D36tk$0D;Wl}k)NDjAr|OOk?f6vcT3^{Z8`N*9-< zTCIlPg@4+tg5M;$Xa4yjY@V5#qqmJnA*IQ-PCp)!35qct-#4D0U zj0&v6u<}!U)AU5vaCZqMEjAB0JIIB6iaGHQPyfT^?L{e<1NhONiOq;)!Qg%fa588Wu2$}e-yOEt{nG@?;0c~{z5b8eGI|k|Skbn5#sXnfbDv zNRj9sa#tJUDAs+@lt-u}3&z|69l(Mq_f3EqS!$q>Lx_teLf?t~kHK7tEcu>PX=v zcQjY%3>wYUiwYuR0}2$d86@2ccEiU^k7GPpCPAjBqH_o`rYH~P%fP$UU%*UOEZUZj z)#liXih6<`L)B;P$8Nzgt-VWwPERFBCI%0-qACwUgx*=TljM{ZrE_KMgUW%How#O` z98?d~)wIC*Yj1I^!uB55ko9nEM=w69T_FFXvm#t1-oP{Uz=7B#-qI>*yH5?ccs@XT zn_;>Xxat%)f8LOLRD~kF=c!tQQ0uBzI+Kmd`FbzxfG_bOHp#7g%jPj6C2O?C#oGBr z@wPd@@QepbSg$B);$Vgl7FXayAQ1~^GM>1;D#Ie30u&W@)qu_GrnYwp=Fmu%<4)te zN))*zm@vRyK;?SwD;0<%bzitCMKgiqa`xRi#vyL}n2_>B^3f3Ppi{5JzX6CSj!^hL zg0;%|nD=>BT-8*#+`C**j+9>>{tc3xd9n<|Ju@x;N0fqNi=y|*we$p8@_k6-k*McR zh*7+V*Xe!N|AW3uV$n3NH1VarahJ(bJr95x0r$bzF;qjukim$2JPp8BnuAbmhf!ga z^cfVuSts&NY|k&Gh_si3E?xND~AF%@4V zeFWX|1h@y)=48R1JWr1W@8v+9eH*4m(j&UlgEbb#8X%&R>wm1a2=|a2cA%N2W^7sIX2s}&Ihg7$u z$sxbg{N?YWxL<->+8$|xOIhqBIbzNr+z#}Cw-32I(@CE$fCvT)^C|U+#L4Z-#fm%h z+U7=)xK`ME)<`{S1cT>JfsfRKAvhy_ZpVQiTCHwzRm#525WzMGx+bm7_9BS8Qj8uUkR!H z!+d--h`JBpt95tOJ9TiZAt*Si}#PVKY3OsWm{<8csMjn?%3Sg&4d7q!+}Z&k+q_xauQ z{hY6E_}ymOwj6yh)lCU8)#c%0i~@|3UbGiNgfjdmLC*W1qQbUf>?H^a){b#Q4~M)c6TwjXXb!MJSOXT00# zz1my%VWXW--&Xg-rPpphUwrrtXZqGXoqWz;P8;{{$M+wVL3{Q#I38B`)T~zOi*R|h zZf~a-qrrLddfL%@nwtziDy@}yu?ek??K-E{C+|ImX8mm3OT1ot;BT$LfL{-X&E@$` zXZ-a37W2LlmEZjr=kp@eF8MisSn{_`d~BNKaJal2x5uABqav1E-#*Xp+O>u2jNgZm zVJ|)}?DArB{n;;%d!0_j*B-C#E1yrDi{WTIyK;^V?>OYs$^CKi-n@#RdRI&SS*=&& zyVb}UgjZ#Vu+Q_(!>4<7&-=^axT8&sBx($Y@9Q)3V>GXN_VMP{A_X>R-D1@+|aI^v(d6SxW0RSy@+Y*RLNg!uLV@=|y|JeSN>Y`>6Td z>g@4(X@1UcUp}s?we4!=-yKgvr`J2{1l@R2eY^b#o?FdfB{;6HSLeM8{kXR*YxZVw zS&wF&W~)>0mnSb}Yj}Qf-8Jw0&1O~|RVVkgzTJ3t8vORU(X(Qwf6*9y4&Ljv(dP4Q zGS&L?sCNA^tMxXm`$eP|*)~*FUXhWJamV%jQKfxzGpn2xKNmlJcuanN z|8}=>*gZbaPs)|E_lGyB+G+WH_S5KQXYx7UdkVdemu9h}gfqRJo$u_`pFYLi`up?t z{K7f63CsJm>JO(EZ_Bg6$>F>-N#;`N+k>0iX7T2+n7izEh@?IBDhH?C>4$pMzVFua zqxbpS;b7`T4KCe9|J(QE|EoWdsPY*8<1)a1L;n9%B9TJ=clzV6{O^CpkFo#wh5r5V zV?4Y6i9{xzP5SFU#FMd9<}d#L&-i)uQ?%V5Mco@#B&)n{No#A%Dq2mrrEj%u*XdfN zqIEix{--cqjVDi2w%5HbZIa+0&%p+wRGC{%Rt0*V640uQCqtou8x9d@!&ZhOhq`ds zm(;z^rv3JOHlAvy-X6Q?Nu6%#29BbKV`&+Yy8kW|9s`HxNgq2?rLeXVN~f_`JGJ(X z4}W0|cBy`R2~(O3)u4_J`yFHy99>6^xCvzunM}u=^Q|W%b7;EqYg*XM?hk~Q&b~94 zL|LYm zm4YQtsr65(o&7Hh=Ds4`ng5jiZmBn+P|<)azhlcNw4x)S#*e^ceC^ESLI6KKG%KVy zb|fTQzk^;9xv(ONScs403__t@jx@oT01geSRLHCWk{imd_^`~hIR~#$6sZB`t`jhT z>?Rc2hmTI*l~%@urFri4Y*f$+;iu8eeuTBK58Q~b))Cvjfxb8NcG&H)u-F40yw3s_ z-X2@5gWsCm_3794yg%q}b!aE7&X9rbTK`4QuL=FTH}aRM^U3-*3|@M{yz+Ct;-n^l)hN6tnGhTlDcy|m!hL4kq;sC z8P2WtV4$M32^{wH+I`0lUDd@qVF7vQyTW+o8dO+y8KRxL!eeot%$&#Bc9e46)|S;Bvx&$VNsj?= z2SpK=DeYHmED^5}FQ&S1=WUt=y6`+T*pq4KblCz2BZ z-4c{+9VEcFiiC=|8Vs1|y8=JT&BL|I`_^j_7`U}B0s}XV$Uvhrn%Y8dFCduaShyr- zv`BjZ-Qks>;jh!mwUBV$wf*!XQ7vf>P-2Y*zDk>5)tE_c8c5(m-ogy zYePEG>EBA~4N^9A>Q(a zFAzi#DK~Yx!b4?BFVPQdq;i>xIAaA2{iJESz?Q%ev9WJIUFP zER|+NrQODm;s%#CcOi1X7X~4*JtIH&e541_&j?B-_$Q5rbo1(`rDDKCIEoKM5UY?z zyT;7|*A!%8@sb_GjE-;XJrahe{#510!uQ96ZdgK-?m!lz<^3pg36{uoLu zdHRLhNpSfK=cv>;l#Mj|Z!|MS0{oov-_j|*>pUXp)}lu?7UVl$iUVV}1s&EUatN^N zC-N6~y-6n@qV#>#lu=vgOHaV_R9Bc1P=41EhE(xsFMLBWODF|Wbtz#K_}8Hi zc8Z4w2yeKrLj{}tIYEV{W_S7KmZ}P+7I;Tc?F{B!5%=(M}OF(l^rlX;u)EK0PMH(1^ALX2C4bueQY2(XgKa`7^N z1XA9>b$r7byvx>P#lKk)#ZQ%6tzcXD!WOY~zM~-{YbJswctk?@ah`hwb_%Y z14dMYIvR|f?%Y|Lr&8A_WVG;xLr3_siKvOm++#u#@)E8aP>H(Zp%dlE-e`N=zEb$c zJj=K(Ve84#25et0V2i0pm?DV?=Md=+jDTfz@%xDDLbt*9H3S4rR|S$t{TC+_QSg@n zR;fut3v@L40O<|v!=%kYeJsEy8vvfKYBZLilU)FgK=?laHre21d zGJyN1ugz5Y{BCGDnhXiIS|ob` zX%&IGQd_)*32SzQm0~_-#HS_`0q$iO3^& zM08R=OUh@jB?h^;$)q>F>P}$VQg=zDrNHMjDdBAI?>H98$hQLd8iy%2Feq4ex_DV?mSzdyrjf@(Hk2f?W#u9#B7@lxc|eZ6J% zxR8helj8AYB$3z8ogo3!Yx|!@TZv_osoa#L^GcXq_*FQ}PmL#U49q(nvBpJl`UPua zJ-%VRp0Tg;>;_Q~TKC)2rYX~AB*hiSwL7fx?)Kfuz!q$gaLA^yv~qbJe-VZMr?oYr zzd*La)_+-l``2yGpw+#$;Abl-&#rs51IvnPS(B5qXLFQi<_kva@{bcWaw_ClYGMeNBY>tLuoZkYaPyV%(C z+RKL)9s+qJ^^ji^ZpqJ$uYqs@pWpS7JYl#yUDk|HArpUm@dV)h&l3tUmR&$J=_$vWATwrvMi^rh ziM9S_H55^n8^9^uT-G4k9g)v3Ds+twbt*P=6T8&4pWN+NzFiVPkWz%8+%j{JUoi2) zv(O3p>R;0wwu^^y$HdAj-A*U9^DDbFugW<d!)Dz^O2>5MCz+{_#OA3f=n+F}Q-@Gz zWX05AqN@<6M9~+Q%{i9)9hp8%cwdPp-#Bc*h^ilqNoX1+9EGiYt3PsqjhsAT$gIfg z@kH8k>4v3Q&_yxnPaLFKYjCG7k!$8f`lAW6shmyIMYr!Pkxg_oerF}*Z=zcf42_^j z>Ju3abozIfgAu2)YeE{4rH@+y`fSXRuOlJ*;qHnC8jYn#S|E-lV)0C9jXo8*dbT%0 zB24JF>RzqhsFaG$$~Fx&-A;T7{U%RuzxSGle7zof7aonno7DdlUjbddcsf1vGn$C} zE~dWwV!;ReH^#B)mkpi;ZJM5o#y4Xj0uN?7;#=YaUr|VwGan&6jDnC74+L8X2+
wdl4;T=@nTa#zM{QdXPn#5wB zMu}aDFs8JfVlm?>iO+^3>Bhi zoewSqAbVH>)Ii&-2aL{!lgI`Cghd0$Birk*!3hSxu+&0i{FQ|Wa^FYkIy3?!iKS zwY;#c?%W*HT-=&EhvBgG58uR$Z+d+?Bg6!o@6~DXpNJ5Xt0DWOVq}r;2poEsSR)_} zE<1L-LN+`3i#|u6zm6``p|v&bJ@*~;Djeh17rqcqazp#haqS)g&U>54Msy|Q=kF=2Y^NWsYE-W7RhliMiF&ZA!9nHns#*PD&dz)E!$v9B%#UlU zKWtP^u1fXOTB~tswD3KBuIX{3epaoODhqAB$Ip&iZ7mJTkDhB(Z|p6!;U~{FIbCdV z`jv^*7N_+U2v&}Y)x(80@|kSr`EYyZukaR~MgRNN&)&12qf;yB;D6y>JVHc=kanoH zD{kB%awu4~wFR0Z{eFU5gfyqIM1+aqFmDQz`gJBNXJE{?xLXku2ECk4x7U9qqD%M0 zi?0Ehj`x|d{?qK6i5f2Y-l`VMuMK!>85rL7i+qYwafhIhmah0$%qgfyrxLRboPAe% z&KlHfiQQ-SagUMx7&2Zcs{+S&aaWpc3K$){)0s0xju;(nBs7K0x5 zDom$~oI2F}ir-y19kC+5!UOin>Bu51A~&~3I8PgA72u}kel)tsC6;(>e*;k^3M!`v zCmvRIOFatAL}F$_%K;Z8JEUw|Uab}J3B)paw~75wN#<3DoS9QXW=Yhjl)w@CM5N`H z-j>ND#&gzG%4fAg6DLq+C1;!H?9 zO?NI5TXQCQ1d~inC6$5ogs7G7gFWq9B?Ijjkh-gpnrNNVO{CNDypX9D7RrzcfDbKj z!tO{=`qL6_hE}D_-2|e%2Ww}b22G`M|N4;B$yWx1*d>nKR}NelV3c42i5&FXmZD}7 zwhMF8=3FFVM|Q3WCk#{yPsu%-;utQi`hj_O+}i^};nxA{l~%e&u{eg&p%sl zzR38VHOYA|O3l5%yCX7{)6L0f zwdKB36-eq>C5A zb86~b&jJ~Hz355wTIaB)e%{QJtRO4L@sBl z0tfVO5qmb9DtAnYD^by2VhhvppZrwDLm9fQ`0XU>{HV4v4P2Ku;u#Q0;>^03%r*6hAYc!cCdeT8+cSIdL;uy zl<;)kft5G(>~dp)$9JJK*F3_)1yFcCT(#-2@NQyd-+7n`s5Hj+!Bm6Oc>$N^8f@Ca z+14jj7_ekCE^@0oqi!LDCpb=gk}+Jh=cA8;biY%U7Uj0};3)0xYxk}{QH}~e6V|5U zO`IhH?+LZC+i*$#!WwCNP_RhSgyqf(ht7+QTD7+K(@#HzLYJ}zj=&7gaV#|0UnA>6 z5vwQ(Vit%t+z3kJOdXEGfLZxL_1Fh>Ut3aP^ZeD8H^gMs#mnK!%$-Msh!G_k$^}G3 z(pDL(tEDBlJTKy4z%>$JH&WQQQrU^=hz!N*uq?<03d7b|9ukd~wFuVhb;(KbpPO94 zkh4y=$JZ#BB#iH__1fW6#ohyR*XhksLPD576dL@rnt@{CX1kQMW2DqG~fC{yIekUlNUNI5g-7q8MVA&M>~B^;ZTGgt&jI>qK9zqhP+ ztX3Vag-U$5<@&8POB16HL}yZO1tc>Kp{k-Y`i)q}%6VU9 z4;GHeaEl<|JENb%OOvE+mY`k&FG?+_JOY|V@)IJY$^azOAh`23J>*|SM1e?-z&>f) z;Vs*76X^_+P;jnlsf&s;_2YBBkVavR1N=8F*=<}3N9?_~^i&MEDMK0bW0Ir-dSX{d>#tL!@WA+x=u$P-vw>fs?WQDpLdxW66VY& zURCElj@)#~Ez#}I=ECtpWiNtmLk7|yXTlbJq_u1X*4}WG+qR#2a_kxLU-WNSd_I>JRRvm!3G_(WtCFdr|XDN0}k;=WC@P z)0IWnk!@RN*m&m?Q-r&aR1^v(!}f(dNwuk{ykPrxogn={^HQW#lECEv$(@?#l)`-d@#zjjN!AB^LkKi}x za&%=H3k`VzGcV%bm1PztI%SAnnsi^yh7+hb7u*4!VUd^o z0TdDc0bQY{(#(r1WSc%yCcc^ELGkVr8IZ`pc)h62JuWtz_0yIVH3ME&Yk0TmyNm!4 z^!WqUvL+clg^Cr>W~(MB)&UX3V;!|wz~!~(XR53_{CByVhO_luJte%Z0+B5dPp6bN zCA`i}gaJUb7E*)~Bi206=&<+oKfL=u1CaqC_)&2)cyo1C;4S-{MwC88Ug8R@Uiv6O z{)?3+v4@IZywY6dB2IXsviae<_$#bdx&mW#W8oDmOd@`Jh+xjtmy4koL4#h2gUZum zolyX=%sv=w-`Fvv`lC>Vz%d z^o=ZXVjBu?^@^6a=*z-P=|!V>)a3K|QRA9v^mG>Zk+5g&TEU-x_mZ`FvOiiiO;sLF z&Ni@<9}lzd0nYPyzxEO#Y4f4Pu^is%*f(t34n36 zCPC~ws&Z)>#tS#Th{_ZI#A=53ixcwXBIB($E${E}q9EmgNh;-sftM;avMJTss!Wt5 z;mcCCrD^vkLnY`gEp@37Wh6{KTAH!`(mryu&Fv%PsIjul<{X{ z?y768)bSnF0G+tPIfaj$lF39!dZ65BCPY^BQ*u2VUSLU%I^*-K2%tnw8{$`zo^cD470>EnT~qW@-)@?n4#2{ z^p9FD&T8A3jl5?i=KlbQNuvHkRFT?ESTcOKWt-9!hu5A*A*8S zWO?frH%JLvzDamAT)y>9NB`;L!VZiK(n0AvmCVtN2w6&d&J{q#3YO|LL_-%m!oGq( zV-^eyT8G&wEdxnDErh>4K8?hsD`c*dEQdxR4A~zAax)3Z&7kQr$0JNi_=;_=K-~r{ zd^`l_*%YQ7k>+PfN7yLV%2&-=*!qdkb~N^Rn)G>AYr={W7N`w2h0UmYpeEiW^aYU_GQ%%r3b zk)ROLZhr}q`UocLui#AM_#9q6c7IcbqA;t06b(k2eNkh|^l76T9bqRt-Kn3K5#cE6 zIQf^M6WHldHuRSp@{9zh`q!MJIFJ5rYhy11FtdH??&K^F;Gq*6!LHY;8T;qSt_2(< zCn}Opa0Lvd=+N8AQv?O~X61Li4@^!hxw4V9 zPqmSWuDDMj-fhjsoaI?|XRbMMtak(xR(tyFWcj&0h(X;6sxm-gcD8OPgqM@MwV(D7-;{!df!JQAi)nzoa$Afrr%$yGnnTcM@)Qwl&ksk*)L*X?u8Ht6vPMCn@ zwJs$IB@y`R9AFagta$tp%-(Oz;TDBtB-Ie3C$67XugUN*y89%x-V{mrX7c20F;I-m zS0X}wnb?T#!Yki<#E7TEdB6cOU)SdSTRKKtf2vEg^2b38SL!{+Husd#l*sTrO?N_=S}qykl+~P>+p$epE0xDPC?%yXQm8VO!I&u&N6dBYDFWrBvY7eTOWfOeGK~;01ZKT`I{w9HjPdRn>g*zwq<^yls&T9=GrqY z^tT<^dEmDlf4?1jRiEylR1Euh59T_AFB&6067uuVs+!nB%3vrtbhUza+|=%N*(*+_ zlUz9Co-W$NJXN4axpM@*l|_5}z6vs}OOP7lck6oUOsuU>3zKHIQZ}ai3W3Lpi5_*A zYs3a^d!&v2TBL3Km8V0YFQf;B(TM{20>HK{{+vHi>TzQEg#PtPER=`T!|@j!N-6%U zwun@c< zzOg|{Vll>5=^7qqya;3Y!oxKjbgPD?g5i5?nWhY_L`+!*@U_msEoy9ty@4T(nF-EA zDmb1^B}MyIqW?6L7AWYOb~}S{@GKYwOEnLYkUiEL%TT3OUlI(d~DkU}hfOv}SMzKh~t-6Z&}ona1upBZdN$Sy05jxcsz>I3yl_vcZXv z2-qG+$k*eFLNkGG97m%gxA41MLM<6nx=Rfnx@Ke(fG@RX@fi3px0k`U|H0yud))X`?1?J(({*BDF5b~0XZgt z1D%wSX)mf47cx7wM6A?51LA4@V2|+U*i5=u)P7dQct!#Mf7sTFPJ{rqkZt#sCvh5` zh<4%S&jTL)y<`7lS=#akm@GDl$~G_Qosie)-@5_>I#r*(pj*NnqgMlymU>lRE_eE6 z$!~oH;C1Mn9|JhWAy)xZcdYpHyKc{5kAOet_EgdGe7h~F$JON)SE}y?gA8B%o`1M$ z=jlubSF)fXU&P?M{R%gZRuX98*SL8hAQHxMwL*nw>fMym%~w|CbfgrfA*u8msStEI zmMju2v?^XKO#4Zd(ZHopt`+>6GofY{@nE`Wqp3PmnlRbMyrkqpW(&GRt!MIdYf{!( z)C~E7wNf=?l+j}?r>A!<_^z2n#cL4A5rkyURoUVrR%zj}hPUQb6_CHdjnNYfX~uHLa4hSvNXrMrSEIqu9pa#Jfq^yj za;16+iyYk^*Izw?+ND@)u`fi!n-O3uWAf?dVq2QnQAAqFvXsIFX)+kwT~U%!`5qGT z_olWNrrk%HURgj%Mq5ker2c+ zQ+jEAGuibay+?H;Tqg0y&|lB#Qrm&FW%MOhnWf2!ii#^|s6TjSc3N2^?S{zYD~te! zjaL<}GD+jsKjb&t$SX~|OYaPu=^~{QVY*Dc)Glm|#z3Df(P%R)Xt|bGWM6Q7oME&F zM?}wwd>^Q`Oh5eAKlu7@#$T^qz1jXEaZg7dE(R9+gBhdiMthlw&evR>xh3=qjI{K3 z=OOt^yITsW^mpi;hnIHfkHqx%CXdc5PURqMOzKE*swU5xxtP91ezqd@p!vmf%@=|9 z_3oBhJlp*eFkdjha+_y|@PqdS{Vz1|Zr~0~81T@M5!kwll)jqz>TnI^TYseVZcEr8 zI_49kj~F@?F5|4y6AqYu0tKmDd&r3H1CcGLd#-I7*u9|gX7}oe_-#e^#>ACdnWLkl zT>aL?WB3*|0=1E+VH@fwL7C&Bw^Ezy2ztlm%6k@~hM`vqF8~Tyb@~_22M2 z(VEB?R(MOMQzp9CYh3gR|Au3}t_Cxc85zW~i?{@#LN#b~-?K-W(b|&bSmQ7fAF}xB zs0cpC&t(W95Z+#%3`l?dB?5+(!1o>U9#?|@zbEd|v|cRfVF~{hf}Vu+kC5|(6BJMb~Fk%W3#+0Dk!|3^U?983F>>n$!p=VJ*CYF|NbVt(=3NKm!gXoCd}h+ z-2&VjKew%)yVlPw>*q`B=MNif;nClQt+zkB0o}2nbH!V+)aQNpt&t2EHm*jcRyqID zUDeqyzZlQf-UNK{N>))HPw%+E(>YNV613pWGJYrPfe8>HB_?Q(@Efz)%c{?HK|4_H zZqdYF2AuA{2ncGw0u1)k3jiTYSp0Kw7Fz=-4;M%EpA{4R6#^3`4n=uUd$i!!!_#8C zCMt|BMM*Cq%xZ-~1)l1%+NA1SkYtv<)%lTpJdA{30{Dw>J|U?3s*eZmnJB!|?vt2= z$l?N{#3|RUkN!6Lg$|JQCK|o|W%A3HFdrXTd1QGm!Y&nV9X73Vr)>$p0;@R3JuvGF z{e>uj%Wc^N{jIl^-{D{(L*t0ekh6fYd1CNQ9S46g`ON-WUt zg(y9;43q#)toeL4z|t*bRPh!Fn_s}XL#sSGzL-ik&X)5MrCXrR?Ul7#y*R2AtfO%k zNu0ETo(p@TKca#lf`W+_gE4!EtsogitL?-qskT!*pE3Mb6rG;wNggEj3R;gptEpTV zqM#lv>nK<25z$~lg~;xm@LPDWN3#XRw8B>f)G>#YqF^cY18*dqIk)Rf2IHp}ss@=Q zHZ+3_O+z#20sfEF4Du*{X$F6gW>D$$tDt38;ek z*KA0hjaDPX6MxjH@SW-S3k@YNl+n-?a=iz8Un&>`5hA}& zIplfH<1T+i(sA{>$mISl&gMuAuX+rJb!vF(R6ggN=HZ2$@!nwJ@DF!4XY`O>^TG#M zPSC7I7A(vnBrlMbjyi*R*HH=16eF;%F;Rtkyp~0-_(XG2dmI~pNlu@5sUzbPuTYCN zl+YaDh^iM6Ue~`{TNqvB1k;~NLDM6&t}llA8^v~cMvRqlIy#R;Y#8)mLm!X@X*Qx4 z$>3UEq!8dGI_a?lTG9F3)DT!5Y~f8KLM@n2G z!yYtcHn%rFG13&hljy+7ju!DjWOg?pC8rzmg4b4{1^4KNjd(S=79OAIU1&wBVx4<+ zk<~-zw2lQ0Lw_VvMk+XN$zeF6Q!;~U-@=wL!*BD;{PtX|N)sohLy`<{BD0VM&haPW zuzDQaF<|~smmKB7IIwDiq)f8U;GQDfChBF|;bn+tza8MjZ6+{m7Q4y3wLa_K2K*m{ zbN2hdoZD3Ab?dV{vJ1(kOi_eL{T4$*?4l7`@gtb zxo_PqVH>3_lU6Q|(QIm-Qh|^LFz*f4_Ht4m@m^YJWLi|8i$ln$L8%}W#54L>K`@Q3 zGZSfjb%q~jCJX7T63alrFu`|T+^)*5MXThiw2N>uQ1wn+>&$ z0vtGi{88QqHQ7k0Nw~nNVI&vhak(-%hqOpf?5XQ4@MEqQ$oMZ59+Hfq?m=;dnCPYg zm;3dK?A#fJ) z`HJ9C!?`92)tNfoYB}1V|2I5Gf?P)woP_@e0(OC-a?^yMS+3E2(i=nnWOIl)=J-x2 zVd+xt37zchhSgi1Gv#yp?QPIELrrDqV*ekyjEJNUW_=F3ht6gx^9hfPL3QC$Bjd>e zz8FbOzqS*`r{Ly12&!XX0z#T3MBXTss#?1$y#T07*;S<0P5_j(VxwROHBOEB5-_^X z{25e_Pg@Qf)gb^2l22i7&##Q=Qw+$UCPM9Mz5g{@DF3{x13D zV`Swo>l-Vh;^VpaS5Nnn8xx%ZOhli}Ro|6sP5Gf0q8)pgU0+Su8fe2zD~;t=VI=mklaQ6_u4={*}nL{;jS&%7xy{ z{t=MbJiN938P3CRrkLWkIf8CvPHkg+(*FE-L=FCQ(yez#Vp?BrKzKN6e z+OJ6XQAXDNAty|rJ%bU8WiA~G;3Yw$*WqQwtYRqEy!{H)#QcVx_@XipsQrYV(>qy9 z>C#v9DJ*TWM`44}J&Hf2s#R8dH&QdOHK6ZmzaD8?5KETAg&cG#jU{nrH`clqnUz%r z*d=W;D#-;#Q1#@4a$Cy0Cqn2@!}&G9^6Z+^G3|A#hXuzcZ+2$KK4rj-2vrbYsv`=l zmvfK!dv|B!snBxj4nqO7Mom{x8a-u`DdE&lOV{g?$7G#)M5b-1Kj4PLq0M71`l2I9 zbPfkWMKo0+9(E;JQWk-)QYBrycg1l>FF)+8bDw`y-2r_zgO8CmN%>FXUkB$~4^GGa z_d7MZV$Z!jbwxd8`eUD%e2ep|vYnXr1+O)}GKClhZo)dHK29LUyW;7nL)e-=p(9p2fkj3^k0GpVok3 zbj1+9*Q_m;NUwGK3$sPR*Bu0NR|-|ccGQ`v(*Rqx`oshJcfNtpEOuzp|AK5nSyo}o(;+cSIGXRg8D z0h|aH`tTfkbj5FRdxGT6r30Nvp%<~5GjZ#?aI|Ed08}KhI!|y@^D6roq8phr^dbsu zOQp_}zLI^J2xf+|=`^JtBHlW>>W+uss}jm3Q7Kmk#}y9`D~;{Awb}|7kL6?ZHlm;y z^3~)UBmPAcx79V87nVk|Em-RdxYcxK`lfj&Dg9JPebPfq=5=+A(?>F#GXs{Y?SWcN z(ZKN1TctBvQ|jWS59pXv50VZBbWpCXbw*e430{83xyb6LwN~SDEqvMxXpJw98}+kl ztyEbHmxw>1%^LOX6`z)>E$XRhkF4FPJ?iw`&UnR_^~N5p9QAJo4vDm8EM#d_o61qK zdbl=p{?mE1Q2-<|a+cvKdOxMkkDjdh^x7WvKl3iy1M8GH(15;Ce`Rfrn4#rYs^HsN zB8I9li?6xp3$&Y^Nivt3#+SdSl#p87)SZIel@)5;fXS4KGS}={GLw!4y!W!vuH_PG z&iDJERc^$4Bs12K&eDy$wxTfylCC9#`feOvm5Z0nwRkSzt(U@^PEX)#nS6WAt9AZ5 z8Hq)5n>wd_*WBrV)we1~#|$tZyjEdbZEdZ@R*54g0P(APm1Ya#h|LA77vHNAA`4q1 z589UGk0YH?FJSm)akmoG+O>Pm*IOTyOSFLE;SrsH{bFsea#V>_E{aFThm{DyP?i^! z5n!H$0yGzL5huKN&1BLXPAIOS#gGWEfqC~Vp{YoLzlf(sV_5_gM7C8g*9#)ln^>AT zG65^v-i=tOyZ~VqHY0c5pDCG^c(Kl%eGLNtq6zp1ms%9_$f}Y_US(9!W0VkJfnh`s z2GTETa6ML9BviP2uE)uI#yL zoYz)&9?(matDz8Nw$|4p7yKj26nRBbCC5+eAj}$*G^n|Kk;#B<=qlC*kC93bijOV2 zozaB|LfV=HE<%@uvqxwvE#*reTCcrq>%WRhM?ZeeoK|<*3z}!hSI?T*AZB(Xr@~ZG zWdJ0Gb9_B_S(ilLxYldOoj9F769*E^Aqa6v#ZeOOo6;r7?8!KLn&t}ncse0Lq09K0 zjAaTct?)WnZnX&g5&o z1WX~o6o!C7+(6)7JyV^j#*kVTAu`x}%-IQut5ylD=FE^lV^niu>E{<~NR0a6NqSPb z(5BEK(Eae&eNp{L#yV)Z31|Qqd+sW%JP0w~xCm31VH1MbKnk$AC8EL-Okd=v)@uY6 z5bY9TSV-O=(xt$jZm-9cNBbIgMyP{w!VdjGQ>pJ36P(Dpuw->@a{!4b&^gfsDUOmH2#Dt*8RlGlJe6YeLv=n8ve zjEFWBsE4f|_CuXnR$K%$*X4-2yav^F1s{ZNOLE4q0a+tBt8{NZ37;ex^< zy{sVtf>x`y_N%o$PtqTZ5l0iMG#d2=39#|dkAn`uC$u}CLWXDEKq2(zU)Z=;j`$;y z+`@WXnzQ&IX(_<(lJHk4|5#9hJUkNR%FE*)xZMH??wx5H@meZBdwBh<(%7jtE7HWE zZPknEz~Q`L^ltQ{JBGmkIf95s(D((wLa#jpz7yh^oreFR%q8W@ zZt?W6Wg%w}$j!p_7lD#ROKz2OTuFvHPN)(VZY}wlmvVj?TH(cEmy*z{PFByHzIim{?N)(}SFZ%TLqw`uRxSam&a)(ma7V`rDqYoddG1D=Z=bu_IAHGegYe=* zi>{VF3NVNi3V-uT#tP#rWEkdUP)*c{ES}hf1L`}tlCv=m?+RFwsMx5~T6`{8D;SX; z(kw~i`p3ObvtTZ#KSZ@osFw|;a-(ttj-J)V8~=?PXTyYPrIBFR@TP7Woe!{QA|{i? zKUF{%9|&>%(;T_<3RZbvOP@5+QZpXEI;xjX4+-Uqt$p?AxLON&#beO`Vu@~uU!-1< ze^(krY%{;Bw#18iV~_u3&7Nph<9}+!BhgL$RLB2UdOfhG_r!^6l%WY7#b78S8y&raujve&SvE zMu@6bFshdfR5x)&HY5_Hx_Bwhmjr4qV;+fKF8|dZncXfU{Q`0aB7VnSf%m(-lA<6M zuk<)9C%Ce-WqN^=lR+z@EYf}SIJ*_+M` zOFe@_kZ^}ix7x(v{DXFMOxrcX8DNw;+NyvcEp znml?&Bk8Lgc0c~le@EVIf3!aS&&U6{<}*ocnN-)O$0%w%>NwvvNj{7N4t))?c{t@)LP zi>Tl=rknN~+Ikyn^l4$S@Xn(@`XqNVoi^t}kPJ9OO0%N9&Wx5LOg#=1n$Z!_pd zDEhL6Xo-Rc3qT8{2Y;E5om3NgoCM4MW>z_#lJIlVH>Ri8H^j)Vw1Cc4XOMoQYjo4{ zL=|jdC;}@f9OAr;(sZW6yR4r#&W9a%A+7?o=ZLnNNf3-cC}{SQLs&TYKTH)N_zU(! z<2(BS6+FQJ!o%Pj3kAK*5$*+kaBDAdgtPqEDe}}vSHeFITE-p*Y?RnRc&*MSFA#5b z_(P3aU@L`W6JYD`1n`v%+)|_YTn=&*S#VZ9mkAFW7KIEYPQ9}_Zl+g7Q0f~B{AZ3V&eqt`D{VmvEKU?19Y z!(|0omLZlqHgGH$l?0lJUY68fWfId1I?0|$z9&j?KxS7%3p<62aO9%i&2qhyZlk_fdwF8&%WyI3xBUY94;Rp^50Wtf|V`TO?iy)(~OpQms z8ZgtJs0^m!dNG>Xv)NRFjSqpkhXAYvJK0NM=R3F5iSOtNP2hI`&ZKCIu+wV|cibrg zKTx<~;tV58$uq;W@`ykj`UA1k5~akwJc%c~2jNN1{3F{|4JE8_jNvK)Jw*TKpCjx} zyH>6=*?EGW$^?jPEg!fBXv1&9k#*HU*!qX%1zjcn@wd2VKlg3OLaPPTRwK(KBQM$} zqdUX2zDRE@;g(k$8{bQ%9lI|oBlI)dx>C4rjl1Ilr~2En>QgUnQAEAtxhU5M6&Yul zT%24D!SRF%ffR6&_$?DSLHHzmJmx6SNbEN)EYUd01I}*j#nWZRN^HzW{ZDh}O3C%x zbjCLn@48fI*58lGmuipIPr+S2-w}17P>dBUtLGcmo$J2CLh;fagFM}^^T?VPA1H7^ z;!;rOelvm_(3zou5q=GI+~f~^mB3CWrsIkuIQ&TNp{$zsNot^3bNGb@gU2L|VqQAg zpU0SkZKu=pN*04*{jK6B#yvfzoQx~>e#Ll#36}Bzi%CmdWkAF5QuW%UoqQ3`AT8eA z#YMB}JC=FtJ0|Kl@V8g=?G=B!$R|iH{R$?PV0Kh--7=QLXQ`mI1RGqQasBhPWfzpd z#=)L{J`T@kukp3^zgle!S#WV#Z27`{0r^^h5(~hq$l0Q;=+%<1%?bc43s-&*l|cIA z1M-qoys(TW_4V>)m>v5y21d8S&TPmZtH$|S|048y;Tl-LUxC}4-dBPuaV0|_T+Iu& zm@|`E`lJy@nBjzYySV8`&;zLMEZrTg2r~@eVYq|@A{NCj-5dD}r#OsCnEQo_dvv%%LkkWSN*12cLt6ni?GFz>2)kSM7#6ngVe(+!x1_v*Xmp_+en9zQKXM0ooB^xO>nM|Ibi z;h1;woe;E$CxI&HHFjWA59}ue5QN#qRCr#4X>Acd4wqA*ldaX8#j}c1r%FT9aBpl^g4JQ#Z#ZH*>wl6z0aQkJ?h@eiBFYYuM+$o8p0iBYV@xo52 z{c@-0jaopb57W^LJEisj`vQ;oaiuTiTmAEl>*T9fizV1z^rPFJ7aO%|ji_U5zuL6; zaGw{OR`Ik|KPtAW2q3$(_A0eXqu8RG-`7_E&_`CY(rQsh)U;8tiY@A|VpVEotG>&> za?e3+zj@Bz4Xco!cQ3wspmhYMzfz7@aisDd&^Mv3x3mTD(qh3Nqy&?21BT z3rMjl)Jo`a@LTxnjf@C3>!Z(1_c8p!=ALtk-$wW14%nOJqi3UgaYJ~&eAMQ-7dI2m zG9L}|+RH~g)dQXeHQHDm^Ce748((iyu36#n^!g>AHj1_KRg=CanREGb%trS!L(IxXrFw#l~KxrHu@c zLI2(n`u;`nccp>D?D@MvqB{th zACJUr>vbZQh(%-ZXe_rGUjDjud0dexD%Go9VnNG1J9cu?Ijq=bpprvK3czWs0G_A^ zV^7Z^bA|+3U`nu1*?kVLvpH+HHJkQDeberkH>jW!hZs7DfLX@P=L}Wh{FCH2syswR zn>#$E1@^sGZ-~OF{1+|fe?+w1|3nsMEFS-hb4o0{G4W*E>v?U(DKI|KL99!9XuTIE z>{rZjaf;{FTEhQgVTMa%gr1wM`E}Tw@A~q5tgVp)$2l*u6s|}jfvI;X>qJ6cz;_*y zuwn~2KDXEJ_;FHHI$=$tB-}yRqIF<_uM;LP*+)tq3!ec@&+{GdOoo2|uN3w~d{Fr2 ziC}wPJP~jGVn%X09Ni5~>^)p4LioiCrQ>|U)KA3l_$|cB z(}01@2ruGq*#plWL2!~|dl|NZ_I3$E2$uUE5WQq=9Ha4q#Tn*rUY~EvbVi+OpEyn{JVT$1Enf)<*mKBWOynzD3 z5T#z1WMnH>qNvqdz}JUqe?};|={YioMQTgcia%zX2RlJ<@f7uHJiT+Royu;#QGwN& zOP+WUv=J>*`FX`KdNY%4{zPg0)Iz1> zZA5(4M&PrcjX19!9gv!Hp2qGF9qOuyWgRe(h zJJ2x2-wd@l&op#Mi=B2U?5U6`}M)nQO#%FLP(%P@rG_YS8k;{x?DU#%fkd z^;+2k@AAPyk{Np>l6GLKj)sZ?11^rALa)z3W7#$@J%jPjcs>JY0uLDg^S^$`E`vzB zvEjaRrZ@xkp_XSy;#4veDyoH#drSC%n-y*v=B?mqBvwxMja5B@+Pzq78FP+DtjqeT zb#zK3k7F|~t=4|Ag@+CHPnA+T-!RoC3|6PdR;k`-R7$PG%TOX>Rd=}ySg=l;*n46^ z%k}f7*KwuRJf*kXvGUuYzH~3hEl{mh%9wk#riOg2qQpggE|-LE>lOV^<_Qz;I2Dyn z5+#bKB5SSFMf#YT=MIOwt&nR4^AF;U@Z$pdTah7=Ci5{|DnyTE0#Wu_j!HMDt#f1; zinjYB<>VD{9-WV2IYm|b!toOKz83zcyW=VGJj8emZ1=|6h;A71H9T9aWkRd{zNz6p z51dpe8A13gc(HeySCN$(_^#7M1Nfe6KS?MFC+^w9SXU7!Fp5PK$Doswzdkd1d-C|` zKJ5vuO;oDob#5;7ph}Owem!+Iw+!!DRVI7$N3u3yLy3+7Tg0JrrV_)RjEzLSMvop}+rqztX7atNKh{FjX&2YUoVy zVEExgh#{Q^5f9Iao;00_W#z4Sx{%HnQfaGHZduSbg@8AQ{kCYl{#qSGIg!oK9vznw zL9;)jPkQl$6N@?NWINSMu*nL6oIPluZ0^?QnY|v;k&v z2M$pk$c{2UJIq+qK1css^P%nDg_bk!o*osO2U6PRZ>(50i{6g80-dTnCz9e9L@Iow zp+YLonR+iI3y$C~a0nor>f=BEyv?rm^ql{eq5sZsGJCoj-=Xx}E31OPR8c=Aim+0J z_IW-Uz*OKob{v#y^Xk~r5F!o#)>hYkayJ>+oZd+-&B*x4%Bw**;G5!CzmT~-y$_JH ze+zl(wz~akz_=o_3O=^Pr*qfYLMp|8Z;@%x|1oOI_CGrT-zxLI|9jf)`=GBm!J_}u z?r3W`?go8auKB-&vtefx@S#W_y3lQ(c$-;JubfFVplAM8;Xr)FD8e0KxwRbXE6tTR zLcr)mMPD?5YAay$@$~v7jq8oQ<+dE?`;yk|oDeYf{6#~b`df}%4#f@FAJ0i)xdkVo z{wk!s+_nB5+6WQ;T4UDSY{z92QI#&}IB{Zb*}wNK^T~l9*H2r%uibgOV{Z+dpw648 zJ46BwD+?$M&Me?-ohW|c2#zODTh8NGp;bC&e>$~dsmCMIFypA$fC0U#blc&Nq4nj* zp`{X5zGbLOPr8Vxt49*CH+a#WI`$oZFN@B;vU>K+mWlR7q#y}*BF!N3z$3j*zpL}N z|75MJHH$0cH&)~EEVeCCJ_SBh^4{U+|MiRY#h-sw6@JpGQ&pK1rt?zcCXy5iS4&)n zGiNX$+C%b!Oc;**9WoOm_%M4u8*dH9HuBmQjH(o9t?J=f>`M(1WMow?s;$s$YEP`N zd>R(dURmb=L$kWKe|r25|5j@){`cgxDt;;MG+I0;{oblHj^2g1*zurGjC6!S&V01h0w;Q~0l zo=Ppzn~%h95t}k09s`=kP-oZ`W^ic@cMtMdtAAB^GRS6JhAx3d+_XCreyTnRrkhtOcYr?hgZGP2%G%7a<|7f z_YGI>SqKs(ylADDI`{_dY zs|}pejfe%US-t?6RuudMt2uweCO+e9!&bIa~q?!$J@nz{6!(b$=V{^PHo|NWnc z7J+?<41eetG5X1*Qv5IdEc}~@CzI*_h^JD?cs!m+r_=utizl<$#D7?^A3BQ_KXZg4 zS=N6{$K%;^-+k@sUSuv+fyzpTW$xF{tybMSZC1Sa ziO?%qtxe|!m5IAW&>iCVEcwP&EE>Z^!7suouUXy9^?%L9dv)H}ieryhH7rWfBG(5O z#Rw=q6j6K89aDd_@^@&*b}VU71S1XIT!(GkNbD!%0-<0v0=g9?kMKgPGnE!&BjI;`zDIIEbpoLMFPAs8Fi<9LN@sUV%s%;-Aw0EO!H$o}tJ1&A1Spz4^Jqa%L zm3HLc0DdwEhQyz`Y+zM7aCK3N)C9;|=yk60Q&U&NaaZJ3Yzu^j8=Kn5jVUr*PiS#c z3n+o~PF9ZMO;J!_&YeN#Ws@h^^k=SW7EyP~ zeZyPbGfe@G`wos2Dox4&g&^hx)Gf#D*b^=|2$PWf)_M)0aIn+|L*A&A71j|OZ?uE3{k}+D%w_{fJ+#_8$C+>pV!2-1 zXjzqVwIxn}vr=lod*GE7GD##!VsHrrB~fM7Mp8I3yp1Gz8axqFS}$>53@sN35#_#& zf*-=Y4djGS#j&T7Qs~N&_Q;#3c`m}%KmL|b&08|X!wAJ4>9kIbqb{qBB5#;b=0>ch zBhbv1Qo4{1eLZgM6VGc>2@JYH-P$7JVm6+r<0f!!2)7iOxKm9|m%@hL;1z9#u=HU& zn$}L`5TqHqa$F}tp1m+QTZAgi(04V##E_f>NM8lxUH}bs`8e@$gy1hj`7P@RlQUfd zMPL_CTt5~aymlhjk#|dFmQeBm!RzCDR7vYfpy;FdiYM>Yju!`bEFGoI6=5ajA{fV% zajP@!PjHpev3CZ&chWD2U9{=ydtkB=T)IviMp+zCR=ATO;G1WX_|*=Jbd<`1-DuO9O|2zNzX`sOJ?qCr)BRCutB$D^&;c&m;4 z1|m2C0h*dyq!YgLByLc3!S+2r6|cOY^|~J+Bm~5T+oL;gd$o|nVMI6j5%7%@w#`-f zm;Pu|;*N^SRa!1FUKjOJWhlm227Y+`(IG~{28;blnb%{y^p;bSJN%4DP3!cvl?jfU&gKdS|u~$JuHh@ zggJ4l)EJugNEn0~&JQZ7lqJhY3NWJCLRCc`1U{<571KN(N2g;{?~UZXVS8A&aDF>;uA2+q?RRoQl zPor$6ic*KNob&RIlxu5YISt;1;DxNMScmo$?5#AVgXrDKPl zxcbVqDy0%?Q!u&e;0>>XyT+mFb4Q94VzZ3pfie>JY=dD%>81x~x&@06Xo>X(a}~ch z9rV(ybgaKwj7nXHgstV?mg?KGy^;-MjAdQUvn=)& zqd*x5KQb^E&f|pc!(W4X^_RGPrcZspB*j#*t4}cSNJ2F*fPJGIuR1a!EzC>sJq0@t6(1P)V?tG~z8fzrxJb}=JO++11 z434fav=m@Cnj>IEW+mRGRfUG4P2;{c&>fTAa>y|9&!ufCMdeBNr7uRr$=CUmfy9fg7x92m06?->8GROBo zZ_g1&k1hB~%@0w3LTe&8mLNvkC{&GEhm_xgk<3J9#`G2;RW#s%aA>++Pi?X^qA2~& zEtub8KaU~Hei4hE;f;~hFd~JiIf&#QSFB*UmiCGo+N`_tvhgTc!JPrg+30E(ik@?Y zdh8WMAK%?5FcKoPse2x~Ga-ln0ut@q!)oDw=^7(2J3I>S9dg|WE1tb_KKmDX_G{y2+ zkyy>LRX>LEGC+0q$~rzQURvkX);>}>9a+k$zJ6Y_8r9~3=n$@{)A1dS09;+Peup?% zTA!<}K{D!O0A35_yv#OIAr5tzbQbb4^2haN^n$9MC8+l53t|@t_sp3E|(x7(CL(3>hWP4C4mKP`xILh)X3yk7Ssctm{1`pp9k` zkAI^6{MCbbcJDNmX*)EPKF~#6k!-y{v0vjnixGsg6;?}F01cs;8%N{uhF2zj1F#~5 zzEnc4scM#PRR;!lnIUZLe}viBv9%2ylqd1_|B8azbAN@zj`eA)YFsU)ht4Mqaqd z)alWj5Lc(P&nyI)`e$LRc7=zc059+Z6u~ypD5xMNen9(~J;(QBt$2!%w4ZO3v_sDP3)f`vAjik&Q z266r;iABJL@>oP$a}%FE$25a8 zAHV=tCNtteW=|+^siYv-*`YM((}qZnUJ{#vHSDHoXKw5`|2L7&h<_6){+Fau{x=;@ z1nKwKai3NtTJoB9xat!t>8wN6qe&GrR|V>tGl%kQBrNQZ_BA8s`NKlE7+G!Ir8dw@ zi~Up-`FUr__)uxIf~*Ej$$0L1P5~}RvEsO>4{8TPBirb;K!JYQ-In=I#Kh1`p}BC4 zc?4}SV+z57pzy!#T=Q@6WB7kf?)uR`WDIzDWtaTE^uPSO^#97FVwwMl#S;no$4dVp zvsw80|GEFy!v2dgEI$|xzJ33b=~&{g{r@w5g7<%DcgC=ojZx0%Umk<~KUeO5JeEnM z^!_K{Crbas(|`GY{uw`pibX_Fm+hHd&>_b)YQ3+h6$0=AxBtONoRxDpg z#0#kyVv>{A-cf6*L6H^W1*}cGb59V$mFd;)MRXh;yG-2vdy2_gSx9#Zv1B2eDdf6^?us6=cA=9kBzuKes*viUtDKF| zX(736A)hRC=z|`%uWbkSkZ}q&P1Px6x#Q7P`q5bI9W4q%#0QCy9j+1gIYzr#$w> zw)vRl3bAf*59wr~m&Tw3&se-*cd-lUJid?Tv5IcH(C!sFyfwl2&@QCo05!t)X{s^& z(n(?Te5cS(6uMaq5vM0ka1VB>khHPg9oo2dArUL2df3f&yAY?X>CyQwn>%rU2DuCx66grK@?C%;MQCXQPl8uL(@j@X{JHSV$*bunBZ+G$(>iM~U!?kR;Z_ zj!@^TdWh$j-c%kZVnZ;ET2WQ}sFQ^WYXiw_`{oTvgJGM(?vqZ0FQ=6n( zw_q)eRVo&Ci-*lhPMSRqgU-7S=Naq?+{^YmqgkRWK>;+&*uRu+79(;!l@^sLG%{r7hmeJ+@HcBst{dqg{mK6;Y6Rgav@(Vl;ee1 zrLemT01(1d=u8n7?EtZX?a4x(X2mnimkTjM-AvHZE7(yeTe0#}#F7Op8qON$PTP_( zj{p}yB$O&ay*}4jxqsb<#a6Q${KYpjA6|nqkwioFPXsp^=gYE#8;DK_oeH}7hyv29 z6ceCM8&rd?0U`l(;4=pOrSIuVphHFEhVETLGXiVZ2EmFa3wErK%;LNyW1u5+{^>x{ zsn*Tu=C<=pTl0l1lV%X9Ea*OwOZtWGLL$~gRp|=1`2sLUPv#2U1e#=$_@J99veFW5TPWJ zK{IR{v?d<|VWK4v`qFv{tLW}0a5)JOwGIe{=0+1BdQJ21 zwLxn0{2W(NjJb*qZZ$eKL^m@A2Vi$FF@iSjTAPh4OHqn(v69Z3> z3UT4@oyuOdX2H*+x?3$3TNQp9I;vL7=jBqVcvreEK2&##*VRVxu$_3HxXWMP*Y-a5 zo5cg?)Q)u@9?B<|?+?ZwsyFwYTJfZExN}l`2<_fhPLFn~d&T%^rTFl0*f`()>@?%e z(^%#DBvyIYzv!bb5PmSPIpg%l;@+>lBlA zExte9KYnP`ZmW~%`PgYaxw)J9Ff+Os#_ZJL<6-pdJm$Q=JHM!WxHxX5j_T-)RTr~Aus`Rq7;`2J*P`r+n7xiO3-ve9bqVb-{9oV8** z7nS|@PfwwE^z?N9(@Cb&c{r?Aa{c*Z;y77N_jdO_eK?PPPPwPmZ0qlt42i4;3=kZOY>o!6;f?pmX{;c-CJDb?M@q^j*;qJKMmJizF z+UY~I*oenI6t9nVip9O#YrFbz{UP^II-%Wa#9E=9V)da|E_QdWYiIi>smkv4$?5TF zd;TffeahMwZn}|q7)_(SyN7-|e|PtADjMGIRK^d@YVkC5-P${Nn=Bp`-9a(y6sysl zXk}P^e^|9?@cdjeDJ13oT@wRw~ccJ~09HG=v zX(v?-!u2vC*iNzZ@OZNKP}z$gU3@M*?nK>rH&ag?wjb|Xq2k+Fzj1wG7kBE{wWqs> zi*EYhX#O#C8=vQn z-ILIuSh_npI6OMN*lF6Io@zTM&Cj{RX!H8)aenzB);az>YwXWl_r85_vzIup3@@X# z<8uAt?##)~>+}22?&IjDo46~v_t_8S^T&Djvb{HJefn_!wt9AZP)&WV?PW^Y+wACg z)ZIUCwQoANZ;zhF?s0Q^Jnmecger48|MqxvP;>4&N6uyPy#I9lxqtFFIBLGFN6+?S zc0TrDzTdpP&%UkhT^u?)wQ4MuJE_M`wgsg^RjnmD^=ImTg7ts!VCr|r)2*rVG#td$0tluE6nOJz@h>1Pyu28|H9M<-v!E`4x zV9ALkbXfUDa3_h1Bnb!>9dL!gDwi1R3{&8{iK!&Pi{zC!^Rpy%rShzpN`dQKwF=_I z@j((204SL^^AyI(%=s3&Q#3_?hLC45pIfmvLTcJoKHk{-kk|VQ8mO>H`_(3K z5;zF#F~&@iw3003#o_=d38uMpa1V4S(yT|Ny-2kodDFI%kV<%xcOa8x+IUV2$*x!h zjYX(SpV2S0WRfyFL?E-kF+x|8KA|>oSiibLnVDt5on}I$lw@lXvgrgtUUbkfo5zYs zI3^&+SDY;9QPTipI)^4W&JIL0JB{;_OF;E)vx+;lN|DIwUrZp&*xSS86LcJMSUW+$ zX3YWCvO=LsqOH^W_g4eP%7yq&Az6a1j|d{cuDDw$rwcoYLMaZR6^KPRS_JunLM8z$ z*~t`k1IPVK4frxOU{mEwbg z#h5&{alf=;P6ziakt}KzV|ATv5GA^XIzqt~ z<4Yt98cxk&R!g#WjrBm(B+Wd4)A5Ef*&oW<>Zc82@O)zARqQeGIy4mSA?AU;z-SI)5 z=0=mG_0q!I4yH$!U<}rDXi146_t?5bUFDMCyXY=R8*7J2Gy@6`pk>iBU7++Ofs5{C zG)!Ul=}vK2ZAsT+!r*Y|o+7Z*Y_n|X2hMZ=I+`&3LQtX|p*vJ)3TY5?k@wLxd}Ve(-w|8#iqe&C$P@4I`IC7okPDIJ$}j^+E?yX1BI%=uJ| z<;FLqyZrDWnVY32-Q@0$J1n}+dpB-}5_j3u?7WiLsqYVFJG-sp`E}~kFk?x zr+Y9@zpsy4jp5@U7EA3Of10I>v;A^5IV-g?kM(@$=(O7JO&)tY$Gx`)v*;{cej6>0 z`cI#4c5kMsXf(C^K34qP%QQyEwWDD)UvG5o>L>l`&eTcH(hted`@L!NZg20flD%jg zRhs9+`rgsev^m>9xE{vmqj|razdKIt+|{o8$zCb@{&aHfrtSv4l6@RcJ|sJ#?&pJ@ z;^o`ijgxOoFK!N-ckjo0A2NG(?0(|xcUyL{ckbr8qgbL;J4vTHql@W7Hj!!OX49MA zB%KZ=4>Cu4_n+g}yM5=Nnz^2Qcw3re8mW`&Q>Q)Y^|FcLG*KTMj%y#vcju#ft#fSW z9PaVY_S78??%K)ftTQ}Ix6kvj%a%ABA>ZLB)=R~c zO7Upu#;cFFv(fSR?Cevc;zaG+PtDu$?0jmU9JNnQFE09b=e?8e=UFV|9>@377oE<9 z(>Q#%Yo5F>M~|8pll@}R{?yJzo7YwM;`Hw1{4`!UPuY`3ZT{GazCCE&PIsg8UNaur zf80ME)H}0ehNkj#I85%POO3`w{qw2Y=wF`9-hOW0n?1bV?>xMXK4xd7a(ideysdsn z^|Ialr_1{3te!pnkj&0P$JN~Q_CxKod;g))+qt;z9W?7Vjl*H?^h5TueU}-v`{y@D zpFW?DE_TPe&G+u~@b3Kc$zgj?dW=<`hM~*P^V`Z&EoGr?YBDkwk#_CQ0l^Ie>oM|5NAxOlR5uHm=8zc{;ok~l$fNHPZBN8;2S-ta^W zLQ$OL6C0ysSGda29H=1_YB6?L?7?M)T-Git2d93-WXWCAI-2R(Z#AKXKN zmCjHZ=UK{1Ks(S)!chb+*loylklFkWNahcTIwbrgZ1x&tJ!#K|7*Ef0aU5uxe~#4$ z?G+AxgeUNdNkLCR(kZ-3(f~d*p>e!|td+v=xNDx`mZ&2KpksO?k=&@=+KQ(E(VSJm*)5XB?r(nNEIDXSRmt2hB*#sF1#(fu%_nOb&|*~G-O#^O9?~2 zg>w}HmBhuF1et5|;Y@H>N#Q|n;}t>^I=DabhHfv-x~ohchZ*jS4(H?i^_0|{-V&+GbBIufT@Q1N^yx0HLn5+C_KVH3lYyt0 zY=ejsFzKF1vzs7HwMlra(}h8|SDr5(`V&ujP?{zU-5w0oHWaH+MsmnVj~(;#tTk_Q zd_azUIy)Rck!H_YQ={zg-H_+o1q_D`G@$ttnWlyG*e^cS0VwD?Np^hhr?g*C)r+{3 zEC)BRo2;F|^^cn`0a{Pr(8bdg+hkn)J*NA#(L{XWalYddm~E2z9=dpl2NEXeBuC+N z;yx+C>UWbt?%edifTn1zamU*_Q3xi~u9e-mz z4p7Jdn05@EWSMbk8)%bahfyb^4Ac&Gry_W_I_~IeI7;?{Df)JD)3WKgD~+;=^cMx(r>U zrm=@l`{y^Y`Psqr{;{2{yVG20?<{qEH_i>-=eupXJyX@|a&a{7=AI5y{m-}E*!k1s zeI+rU*FwA1R%(B*;T)#>jowi+-H5hs=fnMr{l{po*{t?I-we;MC!brx=4g8Rb|>48 z&-M=P-tHgWkN3_~dv~FW@uWEWoN{M-_nm|O#rtl&;^xnrd(F{)=`?Y4GCH|Aygm9f z-QSzGFCNd{&qs&d54(4r*zx$5?yTncnWCqX*N{sJTb8AJ*oh zXrub+AyzEil}DeCZqDa#>&KtQ?{6+z7n#hYzq>aH?Zo0Yr_-B!vGnP_cR$=uCXP$V zqnrG3>Y{oxbay_@KRJzLeE*vqK;tK+x3Q;Oec11x-`pL>s&?zx8Qksc=EwiO4xneZ z_rp@-cAok0DI1@Sn%!(=-o1FgAA1PBKe@lXJ^XZEy-Yo{o~E~Z^N0Jp!P&sR$kfXH z>d|ig_P+A=Y+9cm?ewx|_mkSuq?&Uocd2UPIyG&D+KuiszCUcdt<-C0Zmv~4{Ct0W zk!;+}FYlX&ljhs^2b1A!f9G+W*tzJO9MrDQ^6Aw5`2EgKt9jV?9Gcy^Ps0l*F}usn zYr`k|bLUg07rk+Y_5Ne-^1SlYZd~3x-VYzscb%KTr?(IGZ6jCd9^IEaIeV1OhVt?B zD7v4>O{RAzcl{69Z1?Q`Q*T%;SE`L+^I*3&=si7@-oLHIlRL@W{dKBcc0Uj6qj9YA zHlECV3Vl9Fr>ofy50$f4BXyC!+`rB@`fx{*UNbSHyq!NB!w|K69pjvi?uT|7TM1>|gr7KjY^Q(EpJT-DZb_qzXlW z3tbA_3jF6ddIhdyNshJggu(yq_;0vSd{g|lYVb__w?0SzHu}H3h}Pv`h@gafi7qgikc!S735vjZmYRa`!GQ`N<{6u{fC)JK zKm*O5KQ?y)SKj9U0 z6xb;wDuq&}u)~gP#d2Y12iliP3>K3TJJAvyA+lB40lCS?g2w$z|M&lp{x8oifOOch zoI0e}VGny7)GEpMnUm*0h!jqHhr@nNjXmA3i8$`OOcv}@lF1ESHq;4GE23Xr_KNG} zWv-UEKl26bK`HD+lC2UM_NpYlE7^tGp9mQd(++EK=$4J!z*RF0IhJJNo?(q+jJ-KI z&jry7x-IAeplLWs=6!5jYzQSbeLB-n2NHq68dJFMlN>mK=3Q1Lrg2*k9U;h2C%r6m zqMib;2TfIiVUo#!N+Lx_moL#Y%nC_PnL&3(oRgB!2c{Ov;fP~si8=sajHxrSa&StE z6ze95Z=f59j%19T8uP~FyBz?kts7>b>7hFOm2>e{XZ>H}#of zSJZ6Ghc*sh4?R|qI-Kk#&SpEtabFAo!%s0Pq;= z7unoQ8;vU}57vj^fXD>i&;GC)`}XMO{3w=cPLg-$ zdv|+ByE~tMi2kqo`Dj`HCmt^A|KgMOaPZVlp2a>~RKH38cey`^p6@ru^@IHT!R_Sp zW4)StTiol%D}$Yb+@uPcK$T}lsY`j)vk-D z@5}Sp-lr3%x7Qqurt$sjoxAew<4*HtzF)~Ds;&5-)tF!8Lz#p957~J0G97!ozu4(r zpSyeZUA@)HTvzJXmA%OD=^)qekI-ntwnYu)I05W6fMC2j}rXYXr$canQQogem2kEZo@=`Q=!IGWk> z{_*6~eD5}vs)XKOkM~a|4d?%3?>u`ON3u2i+58m-W*55+_ig56U_MYHm2;LB3xi1# zB~g?mD*pOg=a8}~x8;UsJno(a3xjEkp;+e)^L|Oac$=ys!p%VmiR&{c&cX-qdySdNsgRao)wzz?u z^*fIpca!Z~rP^Rm*Qk!*(>t#qR!07Dz3eSo<<{P-uj@*W-}R@fM$6ONN29tN8@0-+ zRxi)mi&LSXmP0i(wvO4QoTkNbUBTAEY0h0&^$}<7=JVkx3=Z8stq+`fu2-5Y?46XI zRI1)Y)V-2YSI5lp7hV4YUd9Ve=Rg09AAbKWJn4T590&T3qAaKSkDn5LyUhjbXUI!} zbj#eK@b+16om^G%thG!2rl{XOAW;7yQ`+1AQn8fwgKggYPNp3X@$Z|P7ep)bOria- z$3H)eB!hCi^$ke@?S?i=o9|Z3i@tG#bQO>t-?{5!h;#vOL*`?vkU|*D+jrkQ-4E*E z(K>q!kpV69D4O-+;fKk1J)-sEIU2_dP2iBc6%Fl?N!Q_9cnC>!=NoSEV2smVy88!A zA13LosG_T^<3ltM7w7IMM2mFs^OO}15`R%>rZQu9Ejfs~8;|NBC%0#ces=#0@{59hW- zos$9}l=H!V#aEr_*Aa*1nFL1)I(iZ@^)KQh_TG+=s<83}4}3~1aR)-TzCM#y@qFSm zfU_4~`2BrBf|dF5rr?632^h_nR{(V=z7HB%TvF5$4%E#t*C?z|?OOfVZeG z;V3o@7EVO`#sZ1j`#+39r-k60_8FdXPyP1K=cE6;L3~K9-T`QMK)NunFcTn=1#+x5 z7cs@~yfc(V*X&CoA!Rr*i*#Ym=W}F0M@G>Vhy#QOvjRY!|sG$^K2o9QZ3@MZdgq zS2De?qlu|&mhi>%V%Bitv9as_6QhcwlzZS|tDUfOGN%76p6@sW$u z$p|hn&6k%wca#q|3YQqg3$qYmJ!7sI`O_u7#TnkTT_UwF=17vXE^jyX+FOCAjqKL5 zxdk}ckrbx~prK=o(6hnYO2mu}2ary&8AMlt*l6+$zyt$!Z4ERnGa?T`RGTNlS45E` zaT7c6?Di6KfIkvDgE-lYcLHPgsq7w~x8BJ4skxa_=6P%Gu9}vZ9GX ziYbn-!8ZIxk;ma?AW4eds=&tGS4aXFC-^~K;9C)K8iTvz9ti|3D4;Ng6P}5M&q&=( zxFt@J;~_6B5f|}UHjAu=kg--JN#2EFG@8FeO#zYMQPpV+G-?sA@YM>BQ02(AC-EWu z*2Ebag_EsBB)`Y4!6p{@kF=hjygZeLzc_q*ZOP?>pYitkFT-)t6aPox84>tT@K3t_ z`w8Jk+of&Lu$et+*mMg5XEIHhR=Js%>25N^Zr#rAwob+$ez%Q8foS$SHM7aTnuwa& zr|O;}2brgXGp+yj{wqmoyLgcbiXr>mGQjb-p-(RVDX4xwUIcHyFO4EwP@5eK%{m9X~wKqDk^uo{X zOTD{Nr(C$>4s_60I&+!bnf#IJ9J9s2DQxYh2QOdobEmu7VstnK8J~88WtpP~zLD+L zND1doIU%c+2iwz{WsCcjI#VlS-C8)>+n|#h)qCM|Q&X#IDXe-@ z5Y~&CU@kuvJb9DV_J*dJ^~_w)W@a7Dp_1FA*LOaR@3u+L*HV9UoAkU(N?q9|tzybr zRU^~Ubd6LUNfxwJN8dLMX!4oa8xk}QJ?=jGlX2aeF52)T|DIFI4Ny<#_29|OV_r+$|EM@DWZf>V+H|vfL%h4&Y1FK(lPi9u_ z7~Of9AI{hl(=-cIX?fJB=9N!@iW4e`d_<`i5R*%?E?xisjBxn^;Vr&E__NcLhR+LE`~SyueGEV9|NQg!A94Q|BtGr`pAvdE zoX9Aw%BW=U6-GBVJSS#(-H=sTVzPpqQ8SWZWLP1W%cvU1N;li(d>QPQH}q?KyF_%d zsF3J5iIF*8W{fN^Dmu$)0({(~vV4Y7I3dSeM3<0DevXJ^1%^bFk#Z6zODeA`T#gr{ zticHi!>NYIYC5ZDFCy|yJJ?`6Kf8Q?_3(24|0Dgrb9jgU7wbQXyeOys-)Dp$)c=oq z9lWId!)Ls0|3Uxjh5tv)44>+MeMuDT%arT#$|B5t4Kmiu@SV7On1f3!t$)^%ZS*Y%X`a&|W z3RF3d5CFhz37`_ep@c4|zM}H1zyc*rx&}P8L1aR)0S*k3Un0r`qe_y=gC+#SqcVqc zp*x%mvI#;XJW^H#2cl9?%vVJ0m&&933F;|ZSH#*S7o=}Nhu1-oWfU(KERZk}QFKIB zP~=y-0MaFcfU3Jt6fTH`@TeBW*`SciqtZNx{~|!ZxgsDY$o?*jR3 z34saNm`O8GB)Acj?-A7sYA!sgo?K}UAc&-*{*nk?fMuXYTokjh5Wg#;aWs*S{Avs; z3!*ioK`J~Hf@FgdjN`)pLEuL~sIG(h$k(u~C?+JJhMR*@)GT6!Nr!SoXkZ{;W`Wg~ zt^oubl!TEWBLL}RL6?X@p>WcbNV_79ghATIHTi$Y`~QIa7q7#BW*GNc2Gp-)4pg@^ z@!rVZ8>BxN_ZbG5u$kPwo`arGDp(~~N~95_@?RHO|KF4UA_fBBM|8!q*suU zk61tswIhiE0`)-Df+Qw@xx}xK>m8I%BIZUy(Iir=jtK^fMY%&DaI3%p0I<4?+L{UZ ze=>5LD%w^Rl$wZDwNa&>*nMIy$sc4aB*t1ojI@aZK=SFl5=%u%JnCjj$k}nA>42_3 zjyEPsSMdljAfv3CP+bH#H-iF;3J7@t^P59Vy9*;3i$d}YatSQN8jutw#m7{{ppYyu zN-QA?08tc1Bu33f!w2K21X@@k0%h5R2o>=*$Xx>J5)ykoMn*db=L<1fg%lci6*eME zk(-_r;5TgqCWugL7G~dy@U$!p^Ta10&00lfIgcZ;$X*P4#B>7b1_y)4GD^q_AfuOp z(q3f9=Xp>CBqd3l12P0A^X{VP8EGdZM&3s2ZCXFD3K_BA5$#97!jKT4y{ez!GoCLZ z%!ukrvN=v9oGps3(8>7%^gPiu{$eQvQ*6-dP}KhYrI)w3+qB-->S`uE4m-J zo#RHCZhdJv@EKF694d6L&$y*|e_)ITjgC;Qi`5NfbOu2q@0}RV&Gt4Gy)#ne$!=~x z?uLQhYp|74GqWB|M|#U=IGHYv_hD<+>UEgRz$lcCM~bDp-NIv2vh97PXei$Hz%}@y zIL_rCM}7JvY`R6c(>Ta`&1PgvuY2v9KfpHuIXa z%jZhkyyqBNVf$E_7YAND$cp*CHLM@3{JA9F zW6R;Bk_%cJy=(=w?w;0KEHiqS{8yuEZ69gpD4T|F-g9+5MrJ z-y3Bb~s|} z#wlzS!p&x9m8W^GZ}>yH*3j#NdC!%%_3e(z9hOsvn`bvWd8GFbTW4tH!_MPqcUSDq z%0=N+%S%~#CNCRHr_k?MQ+sw-JqDXbd))}^VUseprh3;{mTT_ZuDV0M?;R&6uX$Kh z+jn)kS71z)8Ep&g*-pMI<_8rwQ!6rz(yTMhU*-MwAFTiVX!-tw*8g7cKRH&A)Ahek z2`T?G<$pehl>Zrpl>Zrpl>Zrpl>Zrpl>Zrrl>eD70H*xUl>eFXKjVr^`JXBOGv$A# z{LhsC`M2hOzFhwkjEto5JjaSkR_7H#Q*}cS6-i|zo)H=Oqu2kU_dm(w#8m(3Q$ouB zO!=SBA?1HYA?1HYA?1HYA?1HYA?1I@A?1Ij>whW#Gv$A#{Ld(){LhsCnesnV{%6Yn z{Co31U#|cCNDbg4*8f;WVxQjsV>t%D|CRW3{qHlvU$Fj1JXR6E93bu(nFA4b%obpt zs9LaAKs+Ggv5s*TX%au~c~bDR-~S`Nq42Kv|IRmDU;q0~ALGSEzw9a?@u+enb2_!YE;&NuPw9b8IO@msCeW8h(W!{axr(dIju-HG^RGMV|n zhb<;d0?GW%z4kfu7@S}RKh(6Mm-%pd4U@((bR!qPWBPygp0!7DB+2_a{uP#HRBcKCMcAq`}}9w!y%!zla2?sOqZjox4)6Znv$H3a9fCj);tmh>Uaq zoZLH}NP)VhK=}r>{<^*HpfM)U2v&4t&;zI#JWzbQ2cYBSuT0|>pb5s?6{r)Re~?Y; zG@`CA;XO~JNY8@FNJP;7@u;eZek0zxMzGm59uDa8UhEp+0gNd0*ilC;vV@EvfiY7c z=nMlSK>uJTkit7Klqu%RxHI8Mh<1*0W{Ji%0*N^uQEJi{ySIIr4#q4R)QSf439KU^ zD;Sm-UP-Poa8M2}QhMhtO4L4tYVZSI*`(1mU?X8T4TshjdQGS)RemR~v_uc?0VE(w z!KMOh8AD5HxJ8*pWxyMOp$JIk-?_&8T13Ud>8X6Rldt|PcRXVC986mb@dRP%D^cC1mRVg2{v zb`q83G=SSG;#!6WV zKyz5@1@VQy3{YCW#7xs5a*5&!4@gkwFRB~@-6Jw-upHfHk?s~~kd^>^iRwj?dDQ{X zX-G8+i+%uwPzRr7APx=d1?B-Z021C8Ufd)I9xQ?!Pb0Gh6vz&L-RG1A)Vp{ZSNZH_ zrO}Bc`r!}U9xUMkD$`vcSeLP(h}4HQh0tTmGIfUUj@1aoKkPr0*3JufRulD#@M_olf|Ci#-@);Av$YIy9|w68)9 zX<@ID92;Y0esd+M&Aw*^%V^mspStt5M`rxNZm3_m9GRQX@oSf3?XcMjD|1SA3MYr_ z>bC4>f}Bc`Ez~QCuOy_M@CH-Zmc(?X7Ak|LmsaZI;eKVE3RNen9l4Qi*`2-A9t2~} zKYAP|)`z=PQqpFvB&5}G@i-_my-CY;qN7t8I=N1oPo-KeuLSPtysocfF`pOfZB98m zMJ*Widw#w=(5&rXD>&6sdlIb@aqBr%W5^4cU@`W&Q&AQb%JYRS9Z98l%iw%Q2M5Jkt4Z)cu zvK?@RYJVh&RxppVQlY5JX}oqKNn(UfvDY}9`BmK|omO!bEpyeVsEMQ2$uc9yDHW8s zFz~uze_7kkg2R)`(Uh~5nPtq)=lGV(v8E+*;QH0LJUeB&a#{<~$eni@=|OyQIWn)4 zY5i4~Bl9|$)?alwGRpYkb9{0+8cNp4D0o_>0&E_(Mpj{ZvVCuB3a!-gr;<4oN`PuP;mrKvXHdU{W6 zZ92MfY^qj4O3YHJyJ}ilE`Kbg)tXs}^i69iIwiY#S_~%Xpfp(urIZ=A8mU2i9GcRM?ex~5k>a_Y%v7U%tD?9DSy z6H~suYmO&dk_?rT?AP`3Y_j0I3>sPiO z#x%ux=BDfC%=N+-E=LoP4}c?dy~{$au4~2welyIkA8=s;bc6i|bIq~-Xc@m?rufI} z{V%^@;(BsR!H#tkVo{gKM-Bfx7^Yyi-S`)P;5W5DeRxn6eF12A9Clg&$81ev!jc1t zPwCnXR;-(_TN0%V-GrS(bR|sKtz)Z`?id~0=80{a9orq-wr$(CI<{@w=ltJYckqwy zy2DykgBrc>uBxZ@W+DgEtX)V(-;v0g2CV9QZRUwWDcLc@?O3<##igTM_ z&l9WljY_(`2C!33;4LqPVpE2I9Uc0b>=z$O>Dfg^wh6nEjhwxIg=-8H>IA8t;l4QnzFt?(2+x*B=g zdpT;wryQ4bxnzmg>g@XUjh2FnHmitE13-ozig{1CxoUdLF{xyZV$?yajaCZ8c z{Y~nZGgz$`-tB7*I>0MU_s87QAnV=tjI@P}B4;G@{>Sok`IzZt63#w1BZAw%AQ*zf zlsE)bzXZI%u>bN{p`ecN>E}14q4Hlp!owm~y!_9JvZ||O*`=;(DJo)F2`kRix!zomw zTF5S)xgi8zupj%xzA;B)3geVU*~-ct{Xc$p0&-CealgMiXP?e9aP*h^Tlx_Qhx&Q9 z^F0MqF0`NGG?4U5++C_7zj?L(%Rq2Yc6kE z;pD$&FJO0l(!B12W{{oqQoMgjQO);X_@pg{ULmE1+0iVJGxDtbs;2CP?>Af^vW~(+ zHte1Ifxswpzin}z6$qDmrWt+K!QVc3a>aieS;eXCivbX^WwL#)qIs0=6gs|X*^5xk z(?YZZ^pwBnq}j({Ar1MwOA88L59qCbqZJSZlmnl{tL%Hn1+AHG;Wssk0ye_p{-f(J z9`kn2_ckFF(y{P?#B@N0xW1_)Ml9I!Qe$v0dXM|J&72DUl4Tz)kjIKod$17r2c4C{ zICdq09(B+pC3wu}psgJm&8K19$Io%mlwt)wNfoLA-~p&6nih+HEHDcwL@dXRHS(49@PFo8j?7^^AqO65Nx*st z+us-i%9T7~p4(|`37kApYW+{GNwru<>E8~XRdB8D*L(hZgCV4G!{Yn#!XSSDJO+K* zX^BidXkh*u=dQ*X*CMN@&Z9*Amv#5`j%)$!4))RY|BFZ#X{t&gN2btS(pnrvjJ`86 z=&-np!Qmhjx=k!V5gJ32=^=~=#RGw7ibzu@rl3>6gJ1X|^%cG_6`H!AR);pNELwJ- z`xvmHD3b&s3wMG8{BmTVBjOOk-M1L+m=Lf0Q9KlJMON4Y zY!w8!S@EN3Vv;^=)C~K4LWCTecR&RjS?I)OzsC{k$JXc;Y7d0E9W6Hu10#+#7RW$1 zSYr@^+W&wA^U!FTq%btl{8>o09YkZ+WoXuShR8NPTt&kLkSu&fW~r zbI|D94RBTuSZ597ti4+VeTvlPy&Hg<>NsEh04(p9e%~$M1_i;721hbmv+p2MhJG-$JRGAuSg!|4F|Wm}*OkqZw8fO% zQ>4j%j|nvq#C(eT<=uaavzBXrN>`PzWGCv}u!yjY&Q}Or#5dLNRK53Z!DWsbD)UyC zF3(ui;)x{u~HQhJvFbpj{;y(3GNW*j1(yf|`Y#%>P-Vzm{>ekL( zhKVKCh_Fvi@?}n6<6f*rot%0p%;BywrC=@Kw^R>t+KJ>@c*suWpJ%u+3z2v2RM+uj zR+y~Fy^TFkE3ZWMSg#2KI=QaJ$K>Q;;WlxzQqH(#(v#TRY})y?O}M6+8Z1)!)T|); zwAA92c{|gdnk}j{raiXQ4tS7LE{asNUnJ}B9nQ!EZ0`k|mbiv!BvS8xpOT zMJjEv=@B#2SC}&fR(LWn=p-s9pKc^n;kT=tA!B=x*_Rrb{CIVH^mN^}oYiSk_Hjdb zQd2nmuv=4Y7EaHiqg`<7(GjcsCEMOXXc6MAzB6Haa@2arQ(^6B2Z$VYtMZM1-F{cy zHs!s^hVKfTO@U&!&d}R+8Wt&WtvvnkcHYp3@2%yql67XiQf61$`H-uHH=UYRr50vqn_lJkT=CO( zW!l+jKhOG<#In731^qui)|N&acG@@s%E%30(}uc}E>pQ$=4W{U)e~rH_gdtkV`VD* zFjy%Xugh)2A`5BjOvc9*<8GYy@7$?hv?>L3E0GaZ(2Hhz|0JRZI9cTgJR>;s-aZO`)uTL}8dW&Hv3=JAHUVO!pi?P)zMc6r2 zvQQK}i;DHnN8aTqQ>9Y@ww#X@%g;x0iuP3}6<%kd+%lWCW79)6|DYDy51%wnT^cm7 za!RIP6EIn7OO)nl++`M#-%3}o#h=iF?=+4&#KL%(d zEf?`8C!5x0S{xVbq$DJt#WBGRMW%$$6!gjJ!D1a zxZqHn%p>Pj`g6rgYrkltm47)_U5>t@k)F%W)h)F9BSL^D zD(<$j4Kp-E5X4No``t+Xz)8qRP;%wv?K0PYBg!DY+n#;k9U}lpo51*Zd!D6Ib8o)tA!qlr{3!@$;K}RJ` z+bLUWN%`fIg7fF$4&jvv;Xlr$_=7DhSnmFf5eh&u9@r;0|K zy;{K&r)AOk;dA4yN3!@|5Yd%!+6;%5icMH@8|k3`wEE`rzD4on1}}P)F`qiclG9CR zb$69K9^glqEX!udBCeA4b^cq4H`6y_A1~U{&s`Nu($^IB1l%CUe;X4}$I!fy188n?0B3Ac!=vfA4*Eo)`GZe2xSB#JxDA75j6>SUYqI zovE&6X0)6O%alL1XwVf!=yA#N(RNcPvC|n1tm!&SXk#eyyJYY@s+l_5?flzyZQtKEhcL9BJ-Xzrwr1ZJ!8A|@x*95<E-b*l>ecNgcmBKI6-ss;PTbmaAjR~^(+)~zqQ&2fwQ|~Se z*^rc~bH`tb`vtOW3_KAHMQv)B(Pa+8m+FgxM1%o6OquGb@he#`u%s-mSi#ed^06N> zO;jQUPBzz882YUEsK?Tqi9aZ^Lo3f`#JzQ&gRIW*gXmp_to(u_ym*`@)2m>}JDfPa zuBd3$g>B9Lnn-M=YbUI-y#%uH{ETFAZe2`bc@%MtMm&X9-o$ffjPR1XOKYsc9dRMh zvpsjI?P4&uru^Xpsc@aBU-GvPAkhO~8u#>Ha?GM_3CZTO$L<_oj-L9rX&+Ad{tnh0 zGUK#J5?H>)(oF2wGF+E9apv+A!VuL#HO{D+!1l+AWAr%635zau(v|VnzvUZ-#`ARRduwH>Tt3ox z2}d)kv6EKST~B-&HQH92_8L=G^he7pq&SC1lN15rm)FJuIBcuyo@N_=hzJx{+DAxp zM0CU%-Ss`BWLFYKJgAY^DWg(t7pLpURkk+4p-(aUvQ7u=`-_49|^Bp;psK$*R*89H+!kLe>m^uvf6 zCKPHC?bkhi5D12QlqjsI4I8L)21%{C+W`(1(%T2}|72330# zxyGdRRii4G^f?Y|t_`xCL08W~^g>z4LDO-PySdV8-Ty9RHtv#~_3N_I%TZ{FbL7jg zoNTJu8g89GCpezXgzQjAi|&v|_`^e3Y7k&8SF=0gRqVTU#7+-;hn1t!_ja0QQ9xNm zl^}uhUtd@m>WO}oZ?9f=MBMl;yP!R?`&f{#s3!)aGF zRAMJm9H{>P9O{dc_U-p&jO&Y$(>__Qp&i*sL$K$wPo&J(Fg-u}VCIiDOCxV~BS>1w zN-pX-o=NW4MzbPVQ@WVo)}XK-=BZZAD;ecS9aP#S<#-Xkw=fVU-8*pQ8l*Jnk#;3m zA3N5cWDJoUtTi#b9GN*Vn=-{&T)%ph&0}a)WBf z(n+#VvDwH6P(f2?B^l#fy>1i_mujjg2n(4-3p8wFV9=GajJ-6xiO%@LjAH*N7$oj| zxfsWJ9*an{Mfs7mz#$*bF{Eg@b9E{$nPP57r3>ZlpvkcOY&-NK<{{DaCG<=~4<= z{dug^qnzs+0nWHFpJgP*o4>2}9nt8ICC)sE5M3{x!@US_BqIL%lqwtFLua-&qhsl_E9-x)tzMQiQk|u`7 zN(APZfRjVWgqQ>`j~9Q8rqVSGSqKd`M`C;oP7!F-bR3tIr*uohj{nha2{WQXOoJ9o zcv9oPm^5^Kz+cX_MOh%nTm4bTn4NmaIAm1HkZz{MZX!<`+1cBw^C$K~O2y9o8oBYo z(?dxyyDzq0h_!}fXu0Hape`hsL1{W&LYU3$t!AGdWiYf!UE+^zOHA_&_>^K~w0;>j z$1hr}l33Yrc&_WjvJ{VmL{-YAUplhgPWo`?hV3Sl$8hWuNCl?ik|UOG@>u36_oXsH zcPvto2h)Lk+4WVVGp>(LqBSL(tJR~r)qG}lkN?mYps!`oJmYWV&HZ*eA;q)~li2Q# z(4)7z{BI;niK+sasVKfn=*B({L@#PrXJ4F&;7A239>@drg-;7H@CakrU9(L0YwPcu zcv#82>Y4##$9+<4G}&?a)b? z(K^TpF;0;2!7^An*@%Hae#VKWQfABj@O)ql3orM6bvzmS->573uVKQqN(^^EoGHGH zvk;FgX^iAMfe3w^Ee=a=ty(pH<(i=@am%GVh43VLg0fQJS_O9#qj?Z6n;Z~(YbXM zW=7#YjoHX&`4yw;jeXT3)Ph4fM*3|uEu5$rcv*yKV+ZBZiNnuuc+)vKfAnCM1Tly9 z5`W?No_sZt++rTr+K_iOhFz9sR{8Li4qFA(CZz=8*EIep3z4xWfzD~p{_!zjqYyJJ z^{?sJuJ5&-Wb4n0{s^+=g>H;#`wQibOII2#1^-O~d7FNzszK6)v9*zx{l?X$!yx0O z;~IyPJkbeW%pH5-5|*5z`OyR(eGyZ0QSU{^n{Rl06cy_Aeeklz2TK&}g-0^eLUqd~ z9eyYmacM$GtAFM z*U6=Li{MlU(rl!*?uc&BRRWu{_l=45GfQ_!f|~R{4RPVrR4H!GC26BNn&$70g;?Q| zc-y{5Nd|ozq9z-p#m#5a8f+!_Y|G#}v4 z>?12BpvTg_9}8_w!2E`1D=Qt;--<)tcMvP=?8Cnw`AbS|oO~HpAc0SIs!iU;ppcd* zDEWd(A5I{)?$o{YPXRqf4hMitkaSBLp>ZR_Zu?T&oX7#aZgo$#)D29*N~zJsE+6)A zMj;^Ur^y5N&P63?_)qEay56GQ`WPszMG= zkZZyagU#KydM|}ro_0{NFL{a#zl?C4SowS6^4T=$jTKi6KHghMDzjYK(>ulpQD=J+_Z0!&sZG*6VT)Ie4lMCise%d3kf< ziKeA!Cq`4|KwIt;z~G5yFMa4Dt&_*eXAM~>TMM#`Y;1@$DaK~~x<1s8NIm;UQ?;JY ztsJDgLSOJ-Slk9bJ@e5Lk*?Y(7gr@A9<5TWtj*?vpT{fc`|Sw<`1!T7(T4~PMER14 zhinJ&5~7CQzTHX`-(G^eJea8-Hm39Yo{bfcTC#-vE=TgmtvQ2$D^WrTt9CHoHCRC; zb=ycEI*c%4`a4LTyP)G=8YSu-Bw1kn+rE>p=!uqiY6h)2dXpdh1>M_e~zJ7 z)UNG|;q5a|i$uv|%48GEv$H8>J9%WoVgQJP9T%TNRcI;L1iE07t`<9*MHHjIkK*g( zeDfI;Znn5$5+h|!Vu-nVJ6L3S!I~r)&`s8JjZGAbmK@v7g&8IL{N) zr(n+KUzwW4J_HU~#~c2js|$ja~I#~Cm^ zEm&VM!FZ|n|E(};AoF`>*ehNc9h7E$M++!>8}JvW^i&Ti6Ohty8Z~^^SKBd6aciB1 z6~#9fv(%1qdsbI!>9ZN`HN6{|&O7-<>CvXm-P!EbmDYwR3J^#pAaTDo}i z>3@Qe8E0{2s6-;~YX;QjfZ!*!@Zjp2iFAB|Q2p!A`H9Gh6Fvj3uaB9ze#=2zufd(p zhqM6-vTsfiL|^mqHrespwf8wj;>`3|+M4;o<*;o6_b6u2^4x^{NNh&!CSq#cX_rZd zyBkIR16cG&{;iVXPnxMjImbxs98928$#-aJbUy@1jq7`eoq3q+ZuQkOS+0V-QhLu} zA5pHrkY9%LMBnWg05l6)eg&+3z5)OgKDOU^1VE@h5RhZ1A7of_Z+;56zX2+=18?6z zM0vf0L-}p{zj8EMD0%(2b2L*|24q5Np<`e%0e}+boU%(#qnnH)F8q)eHo7>blK`4t zIO+(npn#6C_fHIdWUTo)q`~t3g{`rgcL@MV!jC79ZN6GpOB=vC9zKNAMKYhIZSrtwj(Xk?^nh zcCG5z9J%1yOxDz?HDh+2z-s+#^E{57coU4uB42Io7FeOB!1#wJv!iolfxUiGHq$ry+@EhW!Sqr`7FOG6 z*6Em@K4y;K)L&0hWK8CI+%!s{RW8stmh8v6;1uU-8xqWgG;x_Y zxe3B&^8u2bh*o(g7{oYJLYc`!+YXDGcuh={6YYDJq9sp>2+U8N8^K|U+zgLVattY! z8*Q{dS0Ne2P=5v$8uSQ($aTJ(wEAQWl0dT@Am8RMzbz16^zJR_jriPa9CXM)H~rn+ z_?k7x^G)~;c+LJEuE!!wKrYrXh|?sXo18#qU=dRMi*<0hU~hxxwC31m+(RIx`1AUv`IfXdwDMATE{@Wjzp_ZF zJcnV_)r^8yZaVv&1Jzcm>nzOk8bzI~2`(0Cw4RW?O>aR)-G|IUwr!17#ypeg$&k2} zl$uK$I~L|MM#5mag%EjWNDOaPN$Mv?$+X0~aMg)7B2-hj_;?7D>9h*TO4GXHZ~1+a z_;<%{S@ScCy}e=)6qS+68r%95h5L8T3BPNuR~F2?!uRlbluTcgZn|w-MzcU7yyyyz zQ(@MXr8hP@8u)=W&%bn;&!dbsFOqtX-3znXfFCG{h6f1s1m-hq*LmYpZXIm!KOe)_ z7TrFy8KS12xg-?L$5MEcOktYOoUa1rrbsW1P;w-o#WJ+q_$e=r`|Eo4gXdw0(_%WD zI|j-&m^VUm{pUh=gEy(|mNZ=iEK)Tk6M6+~FW(Qp$wvhMemgtbsm_YuT62A%EoURN6=ZwmD6n zN)BJDR9j0OBuSRqPNc5w1Z!8S1~mwo`1I^%32MJaR?Bjf#x(ZN_CPhqpvC>&TN0pO z+7}VZ=pB&K>B|@R8dkhZ2V$oJy=Q%${&gLhi+k|%-GVP8WkCM7T@K-abKjJ1Hf}ov zHfmdFksk1jsfSe7jDIR;so5nd3LeZe_RDr$+c6gXx?c9X*WW0*MTLs&=VrdZH7T>0 zf|oXK?iKR7F10@EMo5&NnK@0;h>3RTT6uaZUCB#>Ei)pD@S1GfDtM%WZUsFKA!!H2 z1f}v-h(s$P(l&bo{xs&ggOJIFsIBV;J}$4R166V3?o4@!9a8H@@D2&`qPEArF@#9& z>b=cKYc!o%hfiknrB73b=w_sF8blYNE_GO;`GTjWLDJ)dg9Ht|G8u`TnZ(YqhOpL5 z+Oh+U_5h8*3^%2Uy4{LH{<@ zu++B9PCzE_t~zUwt?Ykkzdt5yHJqk5UsQi^*DK2kFDhhW2UKGJ`*^607=U%GVZUVtw0j%zNl zjzKq(wz8mTxdqvyDk0_ggG64uZ9*54r;(7nw}U>uM(;Vx#I#~-o=Y~1G_$ChM@72# z>d>OsP&EMWdBT|%>iOj24@*R3Hpc*I{*Pc~KBRap-I5GkZ3|+93mo_P$Lsxc-Oyvv ztdztklcw)#8z*akcw4#D>8X`F8Per2T!QxxD5CWoD&uCZGjUxEbKZ_>3QfxibfxLH z??1G6Wfyb_;3KSF-qsIZlbbBf975(d4z3Pa7vb^uGX@)p<*^g+?%E|=D?iT4wJ}Od zpB!6{&yw+D-s>dhKI}J552aG z3N>&u3m65iF7Q6R0y1YkT<0gcS&o0*IJ%>!td=s1hc0!Nxv~0pti1I{lR_}g+=pX9 z;_xRHbc$ca3c3zI0aGTCuBlV(eOc;dzPpPiAxR(SONB7k4FGKT8Wv+Q`^cXruyNd% zHkgPbOinfR@1Crj$b;pZ#?18$SB|j1+o@1fdO6iXuNF#EJ<7$e*cIEB@TESy(wgwR zQ||s*ZXuZ1XmjzE(?6g%I*qHck=e*jUPXA=hSr*eV`F{RT&wE3%BIn?&_T1sn$XHv zH8I|vZD&i$V{t@Bh-J@sf3Vq4IxN&7wX#U|Jk>vXn(!=hPb1ZD!D~~l*QhO=~e8?s27x+b&T(4y1;MT&hxP{(Vc+bTf6?u8Mak@o~0fXf8&u`FG_yld@#a6TmQ4KXrkeWsnQH~l5k;I z^&&j_QBw1@o_aj{mwP*ASf~-#u7s9FIk<Iighi&!1pKOZ~vE$ z)```u^q0TS#ktHT7YS|xQJv4I<8NrTw&!Ojb%QKNv0 zN;hW8ec_&iF+W%SyN&O<-KH4MBalC~4(dwb8CHC)Ff{K!ND%~|?{jdssPN`6 ze1H$gjh+CPiOzr*dEg8B5!f$#Ml23g9X;i$ILtH5e`6fX0#w=Y6$-kFI580(9D>gt zkVX!LvVs5WxrZ9c0B0u)9*DXSu;t^gvVbcGR~?Rr;D*XaJS{Kq#~_?XtyBJd>L+kZ3VSIC|7LvDWgUStJ^?Q042&x!1M!M1OL2x5GvfVU1% zk49W5hkm`cAmHKR>S|w<$o=-l*%3gfyA$|U_W2(mi3;?61%cw9ob6FlzdhE-u`9}S z{Ekx4Q0vAP&U{!?#cwYg*g8vX$Mn4scIMa_&7~Ys-`?nIg9!c#8HF-si(oCDW8KBZ z(dTn#BZ&vSk;@;%B&E6;?ih;!n<(E5_W6!CP z>doQ%6AQHORNO3ZWrX8P zb8B#Ui|4mAF5sB6&$!LqV>N;EVir)x2imL&!lrt25BOhbCtLaPYkr@5`>WUD>iaHBpE;iW zJ%Ah6Hx?ur?R^R&O3**_n+hgAAu|lz4ixhvhBd@@!Zu?9x5sw*^GP)R}0%0LxPEh$tsc)H)z#Gp3k=^dUZyJ7+ zvNCk#2biG*?GK!J+d&j545??2MlaMyCA$BoH{114$~r2<(*fJl+Xv;G>%8S%TkPH1AKHR$Pd`B4U%PSAyC)!EUo6huRE@+f z=D@35-5Kb1_`U6^6$lyxQjXs4g1+OQ7^^^j7;Sydue({jGoUNa7Hyf`s+hL7JnSEN zk06IPU*Ka{G2{C#RBQJ(ZDKAYoBd{x`tLVn&VYOg!JyH0JV9DK?LBqP!L99F$25YI zuC(_OL>oVw0=#~@A&9jH`JE^X!`ZPN$Z{FFn^fTZdCGf@(wt`<%MkjJw|>Fy@#FO5 zdr4YaD(bag)0h*>8|2a--g!CEU-_x4Ul4tPKpm}dXosvr&B19B?v5!oA5!22me_}N zpWo~^8n2i;8G{u-`vj8e4WPWjcL*YbCW{Xv+Jn6N9EjY$T^wzDCmMoTJN@uuBinff zp-KT>q58Z0KRsO)-}1iP--f`h-`tVQh1Jsd*yk;h*+U89B(0L*PCdf_BET_%4F6 zl6}l6>CvdNA8J)KKB#Gv0R+Px@bbT_`iFEP=)T_87A{R2?^NJ7>16!}v%Mk|BwU0h z#@u^uj40EH;@2twZZ&Sm+cMjP_?vNUaJThWK4+X7)X97Kdo^9Ca1S<%pb7*k=%_r; z*ASy~EK10mX92U`?<@Y=LNzm-e&?Rg!}jRd{%WX0ZyGS5uVl_y6#A7}#Fjnz7hL?F z$xB*5yjH>*xg)FfD*!(^S^#)%BcX3XprX9;2x5C-CGIlPxQSu zULXEO;&S9AQ(kv+BrN!kZ6Z(Ottote|3d@Mmc_^H!pnfQf{R?OpQXpUPt+E8bd<%N zSVNrv!QA#)7_KkGi!g~5z=N08)}7&XV@*ZkIO{gWR+W+yUfwW(u{j?}(;fo#!zJX;zJh?o) z@*6VK_=5=Y5DQaodj&zWtFTDWit9Nyx5e47Rsb+G$Un*u$^SE7fdhJMijv5=tIAS$?k-hiqU?)<_p_^n_mCvm%j zcHW|ag+7;cVSkPO-~EMd<hG(fJEUj@tVMckyj-VfZsw#9MpbL3*tU5 z*zz1atDvOaEo%0YW6Q~3$);8nE-k2&UQ(JnFb9=CJHcR-0qd}8{3klmAt4S?c@CWa{8x- z+?wwSuD{RSa+CP&-~V*F>fLpy>k)K_9~Qb_%BTVPL)s+xpTqs2o$raL)!o`?gZYC8 zQ=o$G>o&RUsj3Hh3*#Tzu-F?~$bm9QG~_oWZo%?o$J0`9mLJlZbF1xXI$H6f{$rV9=+6)gahODO$d0jL}G`En||v)<|3xG#okV9MLs zKfx?b^C=WL(a7?cc;YGZc&q(9hm5`#ISEz(KHEkyTgl6d-Vi!x>wBON*&3m#hf_i( z(pN!q!AU3MuA;{;jiajX_bE=#$29wFA`jh8$~f&mW~Vc$NC@pnoQR}U!1UJxutQq@P;n{k?Sij=3mZ$vL-# znItZCOpnee)mT^$6gF6d#}(7wl92lD(%8m3OGu4bL93h=0w&eDN&C_?9cn*13zG0sJgS%S|P6xt1gxFlffd_10L@h z8T@}g#+Mi&_Gf#DBgG5cj;_S~Tv6oh<8wtR_@MnHPw)u64Tyw&cBRbvHK{EXcGM^KBRG*NKBiSN zp=@7vtol2lPa_Kf!2_uLT{=&{w^{QNVAZQ%JfS2AXdeshKM7m*I_B5*5A=4JcQXsR z%X^Ilu5Jf?r+n>A`+eoT?Go3%Sq%WbC|?ZfFhfEFjhK#Br-Xk$r8L$fQE3Oi!_rzW z)^Ykq^***77*M|wJxai6P~Z_p?3 zzmDIx8LDb;er10I0mdB<=Md#UE7P+-l<&UyyA1<^$?LRK`T#rAr>!Ok4(xhwsOD=M z-_JjJ(-cH-eyV_pYSZ}7P5^l-I&TI8?9XmX>JG0nr$s(*erT6RzkJizj){gq4s-h| zAy^Sb#bH(pk`T|IA$co)?;6&=rrXQ*Hbi6I3L(FI_MgzX27EXo8H+v_>+2kC5y7mP zl=&)i`p{;AW6QJAZ&)p$UbT=Z&&{&-YosOlHnqFI2v@y5b3I^MM15b9Q)oQMo#z4n z(fcxftg}Ir0i#)28E{f7`E4bN_>TNB!l4VXL{hV zp1NUhcqT(o+4L@~n~`kl1}AhEAxd}iY|9{8Z6aMjX*ot722=W1TrblA2m~K6g?ppf z=IQ2kubkZ3u%n-@i8)?ZIYRlXyzC~hH@i@rcpao;ROc^Y;HH!fkQS&&zKpM`9&d=_ zYxA+|ZpiK@@3vfwFwW+~UUh_@&UoWtT;P1&R_siKXDYCA0ndIDO=b!vrc5RdBV6yj zNT9CQjfVgmsW0OJV73{&%aIPX(`Qxlq68zt)AT^bd6bicWsbrD@O-8W`nDI5PHV#|=*Up@-gZr7(0DgEeGIc^nigQI@Y#PG^wEm#of z?T6PwWCtyPWY3sydrK*Wf^*pGfz$=G68RxZ{ z+NcdIW6bE3oBWJ5+FL`7(|dQYMs_mLktF6%bqK-cOo=$wE9dHN2L1q@ z-81H_Mf|&#?79@k?M&pPKLO^xrq1Cf?OL0}?Sd`QSAr)vb_i%!SD-DU-ZSU&Qyi=9 z`U93s-cVi>2UfH>E#t-ZlL(Fo^+vKYe%CO_f1PN18-z)DA0{CX(naPc%ri?;PTQa} zJeA1e^964CcmnOYr2{jFh3?UYW2mhK0fq1vvLBL<5&VP-HVO!y%lG%|lL7l?hJh<< zHe(XD#>22T-#gPX6KO*#^OHxo2C8hOIT9V|tJmrGq3yLVc;V|wMrTR~e@_!C)O{XB z<)*XJ>Mk(9ezF`@dl3`wZ@!_*i?EA9lHr(=cAz`>Af}wqd>d3Bi)~%ggq`_M$D!B4aV!_JU!WtfxigO2{;i2 z?f>V?Q#;d@>N+Vi_XHC;662Jj{`*s8riZ|kTO`LUWm^kHa<)&n-W5>e(T3Tz zmjccaJvXJOP9?+vESj%%O6l~8Yn(>2q_l;>gdor`OOlF=C@ zg5f-V7b~yeNdSa$d|D=gYmn{Mw|ak-^t!1o*QNqldUKDb*}jtR758xod9?#;2r1xG zy$g@m1UoG}-m~rL??h10tvJqEjR7ER=qc#F(Uf|fw=FZd74Z?wt?a@pTqE`M5(VV3 zeQ^G|TwNZ}i|?Ze?<3aQwS3KS^W(gB8|1rEuUUPUM+YNR2K(#T1`gQrTu2aq-Sgc$ z-OM=`d{ZI13G3z2LB80}~8K1knMz9pl8wE}X;mz4eD zDu>G0eGf|4>)-7Lh3$((2fqSP!|s5muit%s-XAvKyk!Tkc84*~l(3}Tn;<+?aS^Aj zYY_6p>n+Gn@YBy0Mn&q=Qg;k#H>bim&>wunPD$gwOFa2Gdv)z!gO9~!uxjBS^49x-ox{6p?g(~ z@?-9R?XQr-GhwEe1&fXx>&Qum$QLgXbB0>eX^tq;CL#)6>DUfmwMJRiN~ChSURnYUSGX>lvm(3|C; z&7HT1RX6+ol_MhE(xJUiJi+>^=sj*iC!jrXTk!TbQwOVKkKrGQ#Mm(5bL|UvnV#FmhC?=!Fa*?(M=*}jHSFCwdto^5A@}HO13zWeSM3(J)r(Al zrrF${(_|A@*A$_Of2tQ#KR@VDr`Cb%t{el+YocLGB0UL>ry_%ed%7GqVIf((-kZdK zn}2+8;cf9uFIy|#^6TeB=MerQBBJD`=d8l6umRwXX4y&*uR9NZttW6O+*5SL#$vfU zV3<8wDF)~1e3MyN_v9aC^SQUBIBSPa$jL4kQNp#gZMWB9ODq@xzdE}+fL3_s$c>>y z-pdxY)-DFGwNjXFTKuqjp;edf_t>t8uMJduJxY(b5-LJ5qfTpUF0(DCE#VB!*Q1OZ zdG4pyw3h@JuY7$WtA}=T^q|8-Mt`rNl1RJa?uMA;T{uzc5hCRsDxpbUaYZ#O3z~vm z)h?nv<;@>Cy|% z5jg3j_ffY+m*$|*g=LuAprV*Z4Pyd}tyOIthnV0G=G3u<(K98DgD|pb44V@a<;>TP zq#)`8sm)Y>1xBixG{EGtp$nOe(vLz#s?nD&DRYl?rd~AsM!@7zV5XocCE2Io+S)5E zVKJhBd81P|X3~Ld!cZKkm&Ha*A&og>egl}&sDIgW-@jPzr zq^}AX>{_7o>I}lu7QMz&W#`|lbn~8FWp5L#zV_}`e%+q{o<8`uYv@UeJ!?%?5VQ{) zn(;5pT1zVHM86qoZj-#Y`A)Sq;#l(RThEL|SDV>sY3Ii&7z1!zH{h*|)3E}dyHjhO zROuO#xbS23zZ!O6Ne-9t=qTbOJeY3emS`|c5=l<%Y=(0~wqG7o@eTa)mo>ISm^<;K zNAY`MIV$OlKjtP4J#gHxeY?ja*)rLOE}S&GW4|zGI}e7jSBA1~Iy~CN7+l9Tq)#6@ zwi0tYxSoW2SF={v#jB({vfy7kKC@N4*j_JOd7~#5tvLo-e{aMNd|PtZq<+q;#iW>B zmdzTpX821%9BT~nAi&N;*V+XC;H+kL+TnY5{IDAR&xIIJXkmrAHIy|r? zxz61i`Va2@$oX0Ve!d6Zu8XS53Y~u140>1x)#Y>sTgo^7Y-+Yz8Iw$#4~ci!WwwOa z;%-tmvl*9OASCprf$wJfk_!-Y&0IUIvIW61hY1kQij)(ol$%ZicFwM4sXlc`KH}U7 z+yMmwn-0i8uX(7!r0>(!@*WMn&ufo3%)RBQF|sZtI3|FTht~d0DJ8`npI`9j_ZApEoo_Q3X*8dGpaQM$yK^HyFAlu| z3Gc50TPr-|!#!;q{%wQ?71pC2coZ$-c1G*TYar`PtAcDyy9O}7b4JxJhG^F$P{j{ z8<`8xAe&5$aEgOXO4NX2UF?SfFu12BTY6j5b@Vs6Mml?nwH8{PMrvPWoxc2`1q}k} zIg>2Rg;~-Rd&of*^U6Ib%c!GZh;JhosNk6Qda!Vmm`$eom^Jw})Z+7ncOX#i#56;w zJ_JVYBaFXR#9U9@EpSlyP!XcBP+&mE3*EFeyyI7-sRa*CvKI?tdmJbbtmRwwJ5PkLxa^Y)fw}kv$U9*1@PraYeCqP zL__2CsT{}~3@|a$$xG@~WZ+#Meklwf_G$KUK2#9N7xUloq(f+z6XuPt!zHDC5##5h zF##Nhy|ZH&J&mQ=9UQLJy^mOw)5B|J__4E+5 zJ_vp8_O}Zk-%_af5Ehlo)VAkt54Ef`sLi(EV&VSI6r!|oi(12Oz%%C1ZaE(d0KF9) zvE(LrzWnkd9y#Uf%}E4qL?FrfLsc_m+H6#rxm|Z8`;^&II>EJIy;f$%5iY8f{)zbF zh#=(OWcK({obYULG`DNu5N0Bs(L^vDJ@b- zB{ay$&%FIF4uuNK)=kUiJQhdLYrQw0)me8AkwT z{vdcpa1R9p`3P20Rv-;lI)E;0OrH;Gs!o!C2+aRJ;R_93iA2cIcW6VR@+Hj$jJir*|TVg2$0qsSRtHf zgu9@K3G~69>=;TsqaZUWei@gs2s!MSzIuwsp29nPo025gZWfO2%NRuoa9RR(8TR@!4s02eO<*B@h^DtL7*qdbO;e;wE^P&1+;j1$COsT zHu2!U!x0toCr$O7t78)Y5cWxjZi ze272p`50%~9Z28754@?x0aY&*g?Nz=;YQ{Y$`OQG*Fyb9>Vcz``OKATZ%mG%!9-^o z6bs7npm>4)h)W9PxGH63eHpST!c!HF5xXI9F2FTOJ2FR%Si-UL)?*-Iv97c%aQQT{ zl$g42kR+cyKqT9lG8Fj6Q7q+q3A3Tgr;=vND+`$E$)ZV8fP$+P&gL?2ZhTXg;Bg4CkH>g zDu+&r+Z4Ieo*RMfG!34AnEHvq`g&FLqr%kF7oTeM#+&1x@admtVVs|6ST~7|TTLn0 z^&~K@MJ`;F57_aOX1S&J$EEwG!ti8uMj|_ZQej^fX>Su>)jZp%u5L?#3m0B^_F7l| zS@~Kietz8+w$DwFY>z(hj*@#{h^wA_|?}W?g-p3pBd8v5!<`WZtA4`rBZ3hp` znnAl;AFIzakNb4jNRjj^ZJru~+Guz8P5fu*+*1|5xBcZQh3HOTA7GR`H5 z{&v-zks42r=at986@u)zoM+<(#^}Y8<2+OivCDHaJFb{VzV1`IDmd)6))oj;q^ieC zZ~7VIV5QA*ubRWR&1i75mO`_`Yv4&yr=0xY0LdMJ452}BIo}1pp7p8KPDQviQ^FUX zRx>=novHZyvq?5!D+%lPRf470gPEnA6-R*&YOyBE41?oQ`zD?vry6C#M%r7FsK^U0 zjnm)b;cb&dVAX1><+Y1x1AXMews6xZJ6%74mfNmbm3#2h4JY@uKQTG!)a(-D*ta$B zdVL@~Gb?|!p~bzHz4Iw5H!HL8lj5|Q+~ua2wG&glu(r1kIY z6QRXl;_q#nkuT?swl3C41N0@Y(L>XhG`9q?6&fPxxhboPtDw$mUXA17v`=O{jU#70 z3)BVmluGoJK9k21@2Dd2`EO!#znceG^QM%-szpNKH+od2dOBBSl=f$60 zF`chRZyo#y5P1v}=F)TPG+zmgdhunC+1=*-eFX44M!5p+QDVw8&!X*ukul_P-|H2w z3w4L?+MO|L2sTC*uA`s8o<(ez0SC71V1hX8If9Kf< za_&9rnuJ-s>I0qI5Si)t_`8q$Up&t0BFM3WL|7xvhU+&L_l?yn>-^pH z4UUo1EhTbmDU~o}b$`;viAGplI>+7YrpQ^&>%QA@(7SD%a!lKF=?h1Gve=F-=GVXW z%OVr+E>X7UcjC8O$-QYxw-|mO!!|~AiA+V`u{M9XYh^Pz!1bkgM%U%yg(N!@FO*r} z_ny>Q8>yCe#;1F=2|7-az~b{hZD{F=|MmnJK3Z6CGh7DVc8@ta*)AssD79RKj{0!R z=+e0Vt>10aw+UdNN;V1W-`i@9PeLe-q1454X7U8@AHvbKKJPngsH{mQaYdikKJ4Kq zSJ=VNxvael81M2Z$I4+*w+*780;WjKbslbYRGg}HH90OWJ*VcW2t?NZH05q9J{38% zBBRcvKR18rFnj-D^}uRd4{zv#9hraRWwsdqpmlrJQ{SBmAH=7>7?S3@|NBYQm3+E5 z*yy&}0N{-OtXSoK@9}4!GIKy)TAdDI<1xFQPO*A_XwipXRCC1nc+FDG{XS{q;WRtx zO1nJ}3zW~+4s-%gp@QK z&SDEyI9yV5LA3&HuA30tGlVDwgCLU+80spI%7|+-D=a%5{ z;{f1$59oRGH~8vh_}Rq(+(rRjhXJ1lfbYjgfU$`EwpGbi@JPfKyL|o8q$5%5O__E= zoJ+fR4k6Dzfc8rOZe8@7=BxJ>&Tks<*`xoSRsdiUX+S%IcWfqzYTFuOXKmk>R&6)1 zLzKFeS~gIuF2nt;n*c;d-a3IIW8bLLwDDZ+mJ8h=N9ypF&NyNhCAk8+NV*Dji6$r5 zSgm>^cDbcqUt~LfM6uKVnKphz&MQx5kU*-8TFw60k7zAT3~G^>0yKyL_)}#D)&5NP zx}Owjs+52sXL)Q3g6R08%hETOO@9px!!DN#`3JTxm2>w^Z#Xd8w+XP(}N}PxT%naV>T+ za^m?{M;f+FVy-FOMWRAN*#m~W=`DKgSwhJb2vYkjpa4vqbXrvTjheXZWki4einB$D zxb+ohG+l3cHPG!ZdDoffuGN&rz`iPU)9MzMccbb*+^B&Y(}%Ti2}F+K-o zTp~a*Y)6O#3KSF75xn9JkKi+KvOYCX@ou+EfOp1%b|3a0SL z;QTiXp;|1IEUP$KyGXSqIZ*5!g~z!GH)Y}xGn8axF$yfb6@Ns$09p4R$(>-*8|3pN z1TsnHaCIgwSFYrt|qs*?r0cAHpJWZD`VdWsmU@_vej#vVPZy+a_g1c28_M#q~C^T6|=x`$GGjwee` zU;(8Ty{oY@j+vGbCzhizFx6Pby2S{pm(ji~sD`6Hdw>q1j9FT#6U9 z&`VJY*-_fd-w068$DsuBfcq$Q63Zs(RjTZ_YN*&_uIz70P`z?T13E-AQcnAeu5l9N z+=r9sHbzDPH-Ie;mq<{<%mn3`_X5OCw%9EV;V@>Ysw*_6A8$ok4~K31&INNviV7JI zvbzaCI9&k)O`G`CUf~1L8pL`hs9bFKR~a-L;vDj#@h#`nDTQ3f=njqay!8WG93@(= zLRg}@12jzVBosv0kAGjUhqc0bFJ=mEJ1{q~e6~`lrh-g8fw4cM?7;3%#yQWi5Fx5s zLqoYVithY7>1-YHz|yX@zX!pHuwSl_B;=1}&15jJmoz+g!k5Qgz*ATJM4teruOs;s zwxmWGv0D#A7GZIqaRWJ_f65QX?*YwAOCFj|i60vlw+`cprJ}EJWHoC4d!wmF4y@GW z!Sw5O{@lsC{G8Gq1*W-FFocuZ#7lz8`3a$yY z=_*JoPaHdm#)u30F1OQnRYhNJySy-nQ!`8t7Zu(nVECt|<2;SWk0{;JKrSrasfGOt zERN4Cr>2@)P>WCQn(iZRWy-f%!p_1T-I~09mi8Os!<$y_8T(WZ`A*KTPQ!XE0-O$k zxU_GHD~2I!ba`(KR}8SlQf8v4{j+(ZShgtc@#`V&GVjTO6(<)vw?h+Fy2}};^2%OO z0FLb8fv!R>xsL90f)YOcvx|nku}$meYB3-suE4;H|AJ0GCQPRnJz}21=&MZuwbX4h zx&hpI%MYE;{g`;Zv-`l)n&GuJClp46?2BGseE)4X>2uKqU0=KG_nnps8YxlP2}CdxQ6VOYwhRvGCLuWF$}MD!f0}oqOL@WO3khmTgj!PnP4XKA6~DFWN3bui5DE>NuO|st{zb zNvr$Oj6p2!rMHStWXF4k>Aat@d)Z%D&qvbZkx;Tn4G&Sr$Ke+@JHTz3D6|05OOM$e~55H;hd5T&PLlcS@l7qZ{B zyR6$=`AZi;{zR}K)`87Z!?3H1V4&a4%l)f)b^kbeC33TVQD@baoqzu;=BKqgpIGJu z;_bEUl);$#)TBDe*2A}PRBOq0=A`V?5u?<~PhUKUb%+1rl35?_B^>hasC7#*)l`U3 zgZtc775qO~^A;q-D-$*JW9TA%T!S8SmYXIn!wtf9cIM+pqh~=s8|tQBlALla}Q zTw^Ozt))^ET5IvL_B``a^Jil9YNMAb$Higpdi9w<++#=jV^yz#zMex89$Zrt$4^Unn|t-m)2SIBjCIM5bd9A*P`yHyePt<&w!us^Nc9sv7pIAA$@UfXg3~(e zZ0m22?mX4uhuhhd7J{Z3z1eooS|?t-if%jd5h?Gc$Qg{rscx#O*vuWRMf$^nsa zmisa`n}X?uzA=uy&ukwXOFRE}nu4^9`H5y1I*fbyCGN zj(Wjrx|33N;3hZtkD2?$4I$utKhZReasuIRP5nk;8WgvRTdWPQ>?O*N;kN#X8}cli znJ(vmGVU|$?#)V+MFo7AuWb(ddOpx*BTE@d{j*V*Rs}~TK0HL2mAj4XVwInk%Lk)_;<)*JjDIn%Q!-hwI#?J}8`mr6=~E9q zU(0SeZlsyu!#CJwJnNQikn|c9Ss~MCrYAva7lV4W z4{yetSAB;mtT$b~xqGY1pLf4Ga+0&2s64CiU{>d!n-CE;HEE>_RYQ>;`N8ieuP^ z*=5B3cutX&$)h6SET5)*ajrCro2!d1&rCv0GVnIq+b1iyg$5oBOQ;?ygqC$1t61|P z$_tu657p*dWw~rlq7e#O1vN`39|!>2om7Yq1X3w}SBne}%oc5DCQuZO57U->nm9of z5G?LX%s@_rb2NVka*SBmm z1@?=x?lGH<5FL+G7pX&Fpdp~lzni3@d7zj!ovPF7i(5X+XKfAw& z!b!5Jhz1PifSOOpI`Aiug9T&(xi68hwup6zRy6jiX?X^p}pBEkenpXr*xfqVY| z#NURBv@c*YwlEy zBVQGnPv0Jtgc~5oT8nDn@d2z5U(Kh`XEm-a8;vQ- zYQf-b@COH8B6JtwDA^4W_`+pUPhjm8iGPI7)J9Tyg_z+< znd4<2)rR3zwRl77Kd?jw$Jp9gDh~)D!VWZMu#SEy(g^|sEmDp(ze*Vy1yQb-`XMoo zSL)K~l7L_GNj98k+6&$XDgR-uLMMy^nhX$%zl@SFd9!uhT5ZR&NC7I{=|U*-BLfV;l&`{UnQs znE3+;L5-y977M1e*4i3qW+0I1lh;j%TvGj|R}7{1SPfC?#1%32LoA`Tj4nk`@*jXd zF|cs6_4%NFzN$2%s^bZpS4a(8s{)LGrhX~&_U7i*oDpE6aFXd2rwfG1)u)F2PLZTt z3B$WnYr(j9HTDnU?#~S#NaFGVme%_y2j!`5h~0u#$0%FK9u!3|azOtRxOAZ+8Kmq8 zzxEM4d#>^bR*2^VMhoYnO%OVv9*!1FQ1reM3p^F9+l<-I0b)q-!2%Rs{qd)Ai`9{p zR*BcvHvmsCP(dT?q|%4b(pL}%SoY~1I@#EcQe${xw+e9Tem=}CfiCWe&=8R?@F#HiY5XDh8LPSGArZO4wCRNgl3hZNQN8Wq@aXR5P4%pG%BogA{7r*7 zvo4s1V}Q@v?%axjG;gw9O50oyhs@C4jwsSLZ6`aqOxjy^({$!O{wDbsuCDAZ7VMNHK>uSjx8P@ z=8jto($ww(NvcZu8|$|(Cj_c|W+$X=LFZa^S zAr~b^bRtrBN9E0-qGgkN@09n)H16Df(M#6moB-&uvb)r!3hQ?kkf5G4{dty}7qBY$ zfqL_n=Vl8=Bd0x}2`Ha_^{2X0v7D(&%qGKxENP2z<-gGmus zXQpAVvX#UhT|PjCXmx$$%L8_^+d`oIBEK>-!2GPIjy`;Wo7E{MsGtqvu)!0CvOM>@ zus}2n7v;&0@n2&#r-CXT^4R5ZK{U`bO(i$<-raow%PeZq4K1J6a?oMZi&`svtMKX_ z^jNB=G^-#rvn@q<7yuIliqv?p?Ef(=6V1FGOR*&Ga}gQaES)ua+1VL#-Onle+_ULS z#3g`x$3{f@w~)7f0) ztj0*l5nzIMZffy!^Oay7)g_$_(^C2P?cLUa z^Fv2=-L7sDyYiMr3$KK$p}dRV!TT~cq#jAewE3OEkizIDzMn80PIWyE8TRqA6vl1x*<*3q%y$8q$Njm4i0RDdI#paaZL^tMQ>Kw(DjU$?=-W(@iUCT)*okw( z_M}(0{Cd9KjOh(UqHZHnHE>LZqBzN z&nFb>luQopQ`M-Kc~?WelMPi1NCW~Gl9qYxv51omcPVVs$1*W_5MkrTgJiv`VcP~C`Y~5wIqjSEplj<@4M$Sy3rmbi4?uc@ z@dnQXe@IqtBM#ReQO(WHi2Ej1m*AAP>(x&=j@GC-?NNX|3jT#VGJ#2kx~Wr z7S;0wh)xWt>D`@yoqy&>iXZ*xo$VZ_(H<@XXj?yB1bJka82z?q{21^zMR%dU(-n@5 zOzCsU`9oghb{q5$PD&+W7K7UKBQ-q;Sw@_%l72&Rnk^S}_}VL$X6DxVJ`P;mtwc{k zgZ+Iwqu*+&NnG&9`&i*Y45Mly_*HoQUUWW`_V#p=)2%dLMo=2g$A!x@ckG?pz&*!% z%Fc!wcJnA%fyLA}LWv+9ll6fcq2RpEX1=G(f!_#qTWm6RDoz`-?U<@En+b1LZ<82( z{@zHWe6h&qwxtQ92w*5(N997kSs%%g(FgM=YB)+zlpV*)oz9Qed)#p|@#W^#RL-UI z^3L~w*IeC-Nc&*I{+#0^oSip%w%WSVbrEm>5Ytc zX1Ci>Lj#o(kazFhkxof$Up2WMpGUVVb|S8SqHX!>6iQv$LAiG(cWSAGY6-B3-g3Bm zZBo>uY9`@h30BCGvpDGxAD=MepAAlE;0-!qp10l2E(YNr&5#U0PP0+Rayc zr!Syk=gRgkw=tyXVX5G%_IxtOgiq1?IAq58$!(?FDtGJpM(()v8Y~VQfjC+g3%oa% zP*0ZYc{2k8d91FY?S1f(rbj=Vg~4-D?FY-f8sH}TJ-y;P{-F<)QRapsJ;jaRYA!#ea46@&=SQ*2!C)AL#_ zux7UhbrJ$g{_STZ{b|UHLiAf@VEw=u)*tzN{O5dXlZJS=!7DE zQXlcXuD!lrX(owKk2|J&`ABHy@A*wwVj(B>W+ud18dwg&PTSw^WSBWKlp%hR8iQtT zAbe$ieXZw5SBAlChcMmV=y&O{1M$zjC%ohgZB*PywaS6s2_&s_&RJH6ZQN$ajNw!ow0S7KQ0 zt5^ajZ>oH@B*iaj&S|q6F~%MAHr7ZJU7ATkn^(8zOFOw>cFGAt?aHL7@lAMdBvSY7 zvq64nJ%!CkxHIIOy00_CPGf(^c1oJI;z&!4#>5=VBR{3Bity}dN6Rgg^CG~p?BF-I zlp2I|^&h>Gp$IqUODRQ49g8VoF6i3L)uhr^H%^i2hvZx?xzr4I#!-xOe3=pX3_RDE zo06XrlEzVUaA;wjB45D8fn!~7qA~={OTpufSLopLb=EyHO}9+BY-Ro~uo${h&3Lc| z$8OaZTbDifDHQv3a?a2NQ@9n2K@wZ(g2xnLlP7CTC*3bdiPMlqhIFr;f<3p}>?}TA z(<(`F-wtAD*U$FyF&<0T2+MpNcpsc-XZ7HBRd-GFg))BDrCu4xit>U=I~V;kLvTTx zei69U@Fp_G1iao9RW1?4+l4x*V_Lz#t$j|)MAq?4nxyDzM^Clj-vcGmM?N?{`LV(5 zz$4kIdvgZ*n`RfHl4{!sokV$yo@i#&A!hYEQ7@Yep>WmByV(UN<(5ncrMVO~PBO>o zd~ghO0g<{Ok9FTFK_wqItFwd_wb6u2h>zoZPs3E=!DFu;(ifg-?r9%IdvtQ~@LY@8 z6cowe_coV9W8X~TEecLDe?#p+PlQB=4fxJw;jq8PIb+^wmhadvvsrS;+)_;ub86hdkvk$5qIXW zrqSnILd+JyqSPKJ^A#^2QPI))UtZDe`4ZG z^<#Xs_HNfv{!Z~6BUqktXs~;2n;A`;ks$}^pl7Vw$+v>FxQ_|Vwy^bu+gMxhfPv{$ z@~W-UR~5ofBqlm2th`2TKK6nOjNQ{-fW6N9u4d1_f-UfKD6t@T_7%tQEs(fZw);kq zTUY=Xb%ect0r-h~PO9`Cm;2K=cwWRkq?Z0r{@WOA?$as6Oz7l(to}RlvncI4F5i7v z`tK`#|M}v-Vge$CZ-S){0C?kqO)<@F(^w4<#V{BTDqFdQmbFlrtCl!f|h?f5@V!5@cDh zCtq3+uP=mHSuZeH4TeZ&LJ%JorqdB|h>>W3%wW#FuTfqK$|e8h3s0QK)sZJuf?~iG0%v$Y zZi5U^1dQ^8)W-Q;GPp#l{R1PAlR$k6dlYlv`FMi2j0R8SqzF{u1;C^shV-F)AP_(S zocW%>!DI=>KmiO_7!JVdco0mgyx>jxtA;6gtTAU0( zu#p}`9H@ghAc|;2L{N^EKvqa!?>hPJU;t1d3dm=IzAxznNfgUIMBrV7cxfLcNKRy8 zsChvd;jdt@P!Qlkqq{%(I{lZRny_=dcWAz0N0IrAa?wYTipTGm{1{KahV-F>L-YS0 zGH4^a0G~x+T7d`rI)Bm_gVKjvf=QeL&fYeB@Dl_2Q;GS5(ED`=)d&7dM^62x8Awtq zL^PeUzaO|13lhsZB@nEB=*y<&Cn^o`T3$G+KK|#b-2vpTHv-6XUm3iFQlbw{SCViN zaz%HnWjMYc1IZO4Rd1~LZjM$dk6mD|i+GP38jb=ktsPNL9%ei8XH5utPr=cK`p=8V zmncw!WPdQqzG@7ITYxo5Qtp)QOEu8gfE<}HJJj3`_Dzt zHtN91{#wIwSmQ-W|@O^;w*Fu+b;NE-qsNR1yE?Q-#U zhzYKN@De~_z-0o-OGHF}p;E=j|HuJPLF4&~2>kg05h4Cwb3d9tK`)d7h0pZ2e5Y(% z2?79zQv95iD1-`#UGgtY7ZA?F*ztx81;p=y!Xn%S_HpncCk0JQ`ZZ2S5V?Tow}xfA zQ3i_-$|>$qGljQ=JTO`AiCHS%A8-r^=JWM4ixPKpQ|gHiK-P!9ktsI`4fl`0LV2Lz zbJ6dY8VwQ-Ahzhkc1Fk;-WEw(!o9dc(ZOlz72F|$3glY|@Z`_2i8lBT8KjjmHI#+3 zgKAx=V=T+KWf65k`9pbp`;RYDHa$ytX2vl9C>2!T1IgVeZfj8jOm9(Ld*;DL!;>Ys zcCNpiG76vT;y-*?#udOF##9qSFYRtj@E4Iq8hKAd-8GxPF(0zLX{MS%O$_XXt-_t4 zswnl% zueaYQUJ2dtVC<;G%3G2VU4wXL?Z#>8HLzTuYD$12P|_K@vR$63jfJo_(AsuwS*YZl8(6>#5JmO7QlMJG^MDSWcIXZ{IvAWOevxs!e4zn>}}>--s?fUDmVjAYY$9 zdSE~bIC6_cNvbQKIW_TPg63P>l=4hayMLJ_140lpn06N%&B4y~(alNM=vZS(9SXqO z?4g`0S@ktvQ?M&=74fG+FxzulIjE{tt3N~gnzQd{&VC5%X<2EeC!GkHFORl*)ohE> z`K@*BXl8Iwba29={G*Uw_z=8{UWe8LO!qm(g_lNaa9){sWYfa3!dnUg4yZ}pK{EUU|QQq zMz(Zq=FOGo!O#CBr+xlQY*%eYx_QC{`vk&1p-J|a??`aeXXA#hL-3!Zra8k|y2*<# zD@FKEyuz0ShX+A_Oz7dUs$eX~$G~he=ff-=(+5Hsfej*A&-NFSbTw@-%^NR2w}{qw`M? zPQ2C@>16`5yWxKlyV!r@zT%#n`ZN6W_MJPj?C_DPz$V0LiyCXQbJRqu@KN`7AzBJw zvDG72?W>BL&-vjw`8j_NLF%^_QOq`Gm~QhbOcTwlG3A->{7wVuH8H7iaKdeBj2v!- zP32wH#+`Xj^s8D?vSTOVdKfl7`-K*V7pJ#e)9O3J5wyo~Ii4_nZP#i>InN+Y&Sgf8 zp3KItKj|{KyKzGLq`HJe=w8+Izx+I+pjSZUqip&yN48{ORJ z-}qv(9^RIa8ERgZ=B#Y*w8;7FV#Q(-8KuEI1y7IxeUbdKv0gloW$}4vsQjGfF_O@^z92AUeag$YbK>6|#nS`Ooh^F5}dzer`AAq`U+H<(R)ym-x!1 zJ1z?;xb1VUlFcj~{{C~ST`nusa!Pa)FX$iUZa0p*tdFa7zp)9^GdzB zUfya_8TGf!y1>#IJ|qxGPb;=z;7Cj~QQcKgXA0y-lxX5uDX@=(~={vJsH zS6c5oPwGC~ms&$N*cOD`9w*IUuR*e=GQQQL?JZ+T=5%iVPq3J=-U%z}!CrpWkcP(I zl`n0B&FRbB+i8%!Lpua>rb%m`e%3mEVe+`cPclx`eNqI!@e^wET46yk?8~G_JLcpI zcLppeHPUOTeORpRu*KO`WxS1UHOVnu&ZcpfqC*oU5DlJLZw zlSuSSRO1FD&$N}tT+jK}NklbHj&ue>_N;hyUpwCtzcd=dKur=~KnIgL4g=1xf4Yn| z8@j|KgEM{E%b}s%rFq|XDpl5R*x00f{IHA~Dh2b)ZB^VwP$JIiDV<|{W34LF$@!C4 z9{80s)VB|fO?!4?Dm5K<`wWVk^sBs%9*rw>1v`7REiKzMBuJUQQ(wQRQp&tuZu1?EXd8ir6YjjBbV5A?PJ-OH zDr%e0@%gCs6t$omO_jz&1g9O+v~{wq9E51pXlAS6HQJS`AL|womAFWcc7&|^iKo(L zZJW#$$FAO;%SNC5h%j!Q+*@F^_qeUy5{mEo}j#cj)l%Z4-drKMAxG#Z=?jJz(12Vv3_a8-l2#}`m2FNm0y;5VnsQiDHP0J;Ouim9o z1>a46-D+Gc`*J5Bh^x^}6}P_)GkUdrhdnE+ez?49RWD-nlB>V6x9M|#52T7HmuNuW zDg+G20lp2iU8sV{?&AJ2An-%b$e zZ{O*nG&B}K&K71Zk(}-grAKtW6_tCLcYahWyRRh}#fp=vcaGX~&xXr4YX>cMHlAJ& z$1aUIA<8VLeq%Y`VJ39J*dd=DHSeVY1tv7aLX(9!G!#g$Vfk;ibgGc8D$BBX(M}5c z67ZSmz-*fdmB&bbPN}AJP&G zBwim-5~~kSn&_P&YKl_&CN8!gl)=WhM*El!(!s zxwBBwS8(qhRnOfYc-He%C`?|ardKJqS-+FZJp09;hGnoFn$Kh!5Pb=p-tI6>uowHM zr8v7Cjx9P>E@TPwE*4YS41*+jTa()XVK=*ETP(lH=Yns~2ZvPEtP7^UL)MTeTt&7^ z!~YXVy2>q@sbkCY>iOj>UGQlz?}&OnzI zQL1iClxQS)AO5+=3_W$}gWc+m+1}^$RYZ^6WYfu3&!v@$);4%Ax8YNG&)+G6-~ALX zR`069{jzmcc8{{eGtRQauAat|#WJ!vREQyE>sD|gN|sSBE>5Od5i;4fPIFp$3`=(% z5vhj0;KblTM`%M&vel|~t?pi`j3TkfJZI6e(OPzGJ&*@~mvtG0%S4Qua%qVhF>IbO zB~dp;iTwr5$&ai=5G8XXM^(RVZ&}Z8;Rd?T4ve;64Q?a+jn$?_} z5Hu{={_Ku2n8j?RYhJpy+U;z)`S2Eg9@Y3%z4mKhs{66utN}MOFRI(Xrf zYgDdXLu?V+_kvdZXp31ZrswENxuj>kW_j&q3+rRbU*?>y#o6tje)ehbQdKzi0NxE* zDpBqgyVlcRc^&k@QVXxq~xpne%BiLNBF)so;2E~BxCh{SKR&k z7~>)9m;SInfIIJpiD=IXM5KDJUH2@z5j7_*wXPQe5Kl1r@Q*dh@Z8=vI0crTOEt$R zNp+%xs|0IOV`!=h0vaOw&!D6J;g|C^UP8F?gtiE)RP%#aW<4w>ce(H$#&9TnMvdpddY_R@uOY`H7R)Z{&=pW>8q*!FhnBv){e@`N^P}e1umSA z0O&PaSkOVx7Gg8>;yb6XKl4n{6N6{8B7N)};0cppsYDCyGV9{FsJw#=ieS}21;&DK zX>*A95(;ySK-M&^e|GItsuOkn1;+ncyR&kStpQbt9P;he%^1lgJ$MNnHesaI62sC?yk5M-4Gv zZ5DuKrCX{FjETE~;)e;|zcT8}s$CpV>ZZVRsu1Xcv@7x@yA6cSSpQrOauX8bk9M>>Cmm9uYYOMBUBBgt5+V$9&~4j$5YN#2FuC zgy!^%5g9k-ig-#~W79iYi4cgQP3jD>BS$!9N$x9KbMJwr$s>9Xh@(PVuBQUNi1y&% z%(6?aGhL&T*|IPxt(qo|;>qhmBKmhrg4+=OgeG*tp~WSZ?LvYY*G4?jPj<>7g18Q) z1>6Mm1*(;|x=oMRM>RkX3{J1u%M8`28G083<34zc^zBnMZ`45h7#Fe*<~w75=;ICA zgrL_z@g6O2rRZQjRAd&t7aaX11zd&%te!<9jS#EIRv#!5R>>QECIeRgp}^umbnZ># z!hm;Qk&e(qqfLaZ(Gmy^MZh~mH5C6%n|(#p>ExYmORVQ}gh+Uu8A}I||T_^AzlHh6X9C#xOM<|ViS(wix1t_)m>{<$W zak-U9CD;Dxm4b)~9C}t^v#S}No`I9c2U8@mTEMYErb7>Ri@i(gB{FzL5EG$P8trI= zyd)(bCM%sRe^Oe5gCp8uNA3rIDkJq)AoV2*V~yOu zA>}Lq!@)?WDV02D2E(nK8P4$qgALaXmPil@T_I)%N-O}m!Cpj=Dr1b`6=XO z?pvUjpF&>dz6E;uDdc7DTcDSpLSE*+1$ucMd3ikyoWnTq$HKtp6EmC!p>cYpwoJQq zbf+Il=5=##w6~4}!C@SD^|W;-^=|B8^HlWGyKr)1y;Uwxhl7LX!@#*R!GRDQjnd0j z(~o9}+#EG}Cj+&8zA$eG&xC=OX&JsD4E&&ftu>ndz*O3!L06SWGyO#Hs@!2eot|gI z=D@uYYU5;l)*L&tZoS#6DZOkejSuzd;X$a{xBF+~VU}Gs{KmC&doCT>B+_5GSLS^ zu5oeLxyut-?Ve|;>ADxDG*1r}H~m(%aUt|X{jJg;G>ip4R;1B%2K@_C%G-v7ej{p8f|F5P{_i{Ee?5)=uRh5CsS3)={_lr;{u};ZhGs)c#*_R7 z6saqt_1Pk`r$XqZhJg42h_(6$`+ryP|K(lrH{pMMsqh5;|Cjajr*Zxo1zN9%CTEe* zUj=gX6gEh-COT-%l{Ywd5LBI&;JvnrhEi1^7b+P|5pJFl7C+fjA8$d#$0-D1<49v8jR<_V;Zf`*E(j0<=Agp}HCLCkJ6IRJA$`~3=5msJ6d+MVtc!W=4kf9m@ z?u!u-Hj_*k&M+d;M)VJHgS*gi(M1AXRSkk7(a`Gb5#}?3h#6=|RtcJiZE&=~kTnmD z)1r=cZuAC-XkNu35IhSbuc$ykX^*!+cuzLjo;C7L>M9bJ2_<@zMNaJz01{aQ zbM1P_rH^xzMW`$ep?}-xs|DVZT;yb6Dp+@xMm$fbDUb65LkK^FXS4_fOhW%4BGAcr zVNoL@xu={>0SO8&UYp#+jBvJf@}8r?o^m{3z7P%Rpls+v4WVQH{LWtlvo7Lb%w4Iq z+t7AR1$|`o=B{ZX`cg|k*M6gh>kZ@xh^>Z+;>Hjjd+rPV*I&r_YfzXDx+y7jjOXB* zM;Ig85lQ5wf+>Ne2&>&8*!NY$K7+!oK<8;XZl7clH=t~wks5jTKzZ1d1g6NKnJSXUm)KCG) z_9-^7!}m_AY?5PH=z6wN=!v8L;teWq5%fPgf)yknEc;cqVWb{B zf=FYO>_{ZoPQ>pN%A^hoh4p~4hYL`3*2)gdC0Mtbi`oTIS{)ShnCwMIWKD(U)TMwD z=z~DP0Pf1>3Ai1q2owWU5Xz<`7QlXp=1)5Y=!r~NZ16^)Dr@0`xJA>+@h##+qlz+c z>jQKE1#i)WIs_jETOZg)0Et#JP%+w25@OwN#{U|m)^*1}?+8jik;muzfp>uaI(XK`2kq!eJYpw9Q8}xn z#~`51TBOKfeSk^eV505WytH<0x39GZ9tsY&4i!?f$^gi@%gKpZb zoyoIvKRM|I&Hkd*iM-bFQF7e&$Pzqs1uCTW^h>R8lJHDpTqx3CKl|dCKGGNi6ig3KI0ku z2T79U!u}_TqNY>+PpI%>|N9Z2V)i+g&G>v8aY-8IF+X(^E@feyGd^Vt_}|)b-6-3M zSk8;0p}?0}JegHemZu9oh`b;Qa>hlm9YiiSg%<@Lu48w>jna6UEdNN*n3&}i#FbcH z<3qXEXlD$(1-@d;pt5ssl;rIN@A%9a2hoVneJh7w3@WS^@vRK+@=lzl`1Xbv15@1m zLworS6dw3N#>0;l@j;lxX%4K;Cs5X!;&z^gA>+WYt~G-9#w>?Q7N5W^SQGH7VCA{x zjCnW6oN1Q9%ZkrZ*zv#Sc|XsS-D)*XSTsu_q)^q5Z}WJ^&%?>*(`aFo!{s2MGIj99*VD6@F%_x;_ILTq;uo4|8a`l+bLP3 zg59g+ldPCf|Xv%ncFN;U1mH6=bUyOFA=mzlx-QZ(-cYC@gI3@QT$P(rt zTLw8zI5v5Vi-P!YChaI?pR46W(PYAq;}EeftjS~nHSmlhFcDO%xB3-$oviFPI7!Yvg`@2i4Yh) zLzBsJ#E8Z*38FDRw;4xoa-J1sX?Ca41d8L3alt^Bpj7d_yX?f0EkRENBi;)pI0Sr9 zWpWpDG@6{B#Kl)U6t&|l$YBccl9#Cjd=oh+UJ_UhxVA%hDvT`S-i1@3l_b2l{C>n| zr#el5-&my->EB)X|6i&9Rdu8O*9iYf5;aATbcyhvWbMWO_d`Cff2xAguG&_H;vRlZ ztTY2P(`+|RO4$PvKaE4aRB@=M3YOsumZAOPy^2F^1p4^RG=qD!68ccEDDl@tHry%s&R+PmNO2?zXVG*`81x1;X?At#c^7|)8J3NW(>NHEMnQx`63i2Mt2V;*^2n{#a1`qxk-f>pMxMQ~=H6J}(;b zjw0_!`i>||Zyv8EJzY)SP)&YNt=p*|9P>8Yu_I^4@u3#S1s?wk{}W%C^VJNQW`(Bz z=HHP5C6f$@{t=LC>z5MyX?Jas7|qhZ`7i*j1cD!0vOxPkY;x-zwZ-P3iG+8Y7jWD! z{ML3cc^~sd!nWY4zy4a5pf6z;yMB|)l1Y$%45B>#m{@6^{o`lu6ZZ-)#rIp=;#P4j z!L?Lg%Wy4kai2NPv4EW)JTbr#PLrRxSI3=x@2uBmb /proc/sys/net/ipv4/ip_forward +exit + +root@creylopez-iMac:/etc/openvpn# ip ad +1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 + link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 + inet 127.0.0.1/8 scope host lo + valid_lft forever preferred_lft forever + inet6 ::1/128 scope host + valid_lft forever preferred_lft forever +2: enp2s0: mtu 1500 qdisc mq state UP group default qlen 1000 + link/ether c8:2a:14:24:2d:64 brd ff:ff:ff:ff:ff:ff + inet 192.168.1.136/24 brd 192.168.1.255 scope global dynamic noprefixroute enp2s0 + valid_lft 50957sec preferred_lft 50957sec + inet6 fe80::a1f8:2602:3fee:4caf/64 scope link noprefixroute + valid_lft forever preferred_lft forever + +# Añadir reglas al cortafuego +sudo iptables -t nat -I POSTROUTING 1 -s 10.8.0.0/24 -o enp2s0 -j MASQUERADE +sudo iptables -I INPUT 1 -i tun0 -j ACCEPT +sudo iptables -I FORWARD 1 -i enp2s0 -o tun0 -j ACCEPT +sudo iptables -I FORWARD 1 -i tun0 -o enp2so -j ACCEPT +sudo iptables -I INPUT 1 -i enp2s0 -p udp --dport 1194 -j ACCEPT + +# para ver si las reglas del cortafuegos están puestas +sudo iptables -L -nv +# para ver las reglas nat +sudo iptables -t nat -L -nv +# Guardar las reglas permanentemente + +sudo apt install iptables-persistent -y +sudo netfilter-persistent save + +# Configurar OpenVPN para que se inicie en el arranque +sudo systemctl -f enable openvpn-server@server.service +# iniciar OpenVPN +service openvpn-server@server start +# comprobar +sudo service openvpn-server@server status + +# 9. CREAR LOS FICHEROS ovpn +# ver la estructura de los ficheros vpn + +# copiar el fichero plantilla.conf +cp ./plantilla.conf /etc/openvpn/client/plantilla.conf +# shell script para crear el ovpn +cp ./make_config.sh /etc/openvpn/client + +# Generar el fichero ovpn +sudo ./make_config.sh iphonetino + + + diff --git a/plantilla.conf b/plantilla.conf new file mode 100644 index 0000000..ded8645 --- /dev/null +++ b/plantilla.conf @@ -0,0 +1,46 @@ +client +dev tun +proto udp +remote reymota.ddns.net 1194 +resolv-retry infinite +nobind +user nobody +group nobody +persist-key +persist-tun + +# Verify server certificate by checking that the +# certificate has the correct key usage set. +# This is an important precaution to protect against +# a potential attack discussed here: +# http://openvpn.net/howto.html#mitm +# +# To use this feature, you will need to generate +# your server certificates with the keyUsage set to +# digitalSignature, keyEncipherment +# and the extendedKeyUsage to +# serverAuth +# EasyRSA can do this for you. +remote-cert-tls server + +# If a tls-auth key is used on the server +# then every client must also have the key. +key-direction 1 +# Select a cryptographic cipher. +# If the cipher option is used on the server +# then you must also specify it here. +# Note that v2.4 client/server will automatically +# negotiate AES-256-GCM in TLS mode. +# See also the data-ciphers option in the manpage +cipher AES-256-GCM + +# Enable compression on the VPN link. +# Don't enable this unless it is also +# enabled in the server config file. +#comp-lzo + +# Set log file verbosity. +verb 3 + +# Silence repeating messages +;mute 20 diff --git a/server.conf b/server.conf new file mode 100644 index 0000000..f380b30 --- /dev/null +++ b/server.conf @@ -0,0 +1,319 @@ +################################################# +# Sample OpenVPN 2.0 config file for # +# multi-client server. # +# # +# This file is for the server side # +# of a many-clients <-> one-server # +# OpenVPN configuration. # +# # +# OpenVPN also supports # +# single-machine <-> single-machine # +# configurations (See the Examples page # +# on the web site for more info). # +# # +# This config should work on Windows # +# or Linux/BSD systems. Remember on # +# Windows to quote pathnames and use # +# double backslashes, e.g.: # +# "C:\\Program Files\\OpenVPN\\config\\foo.key" # +# # +# Comments are preceded with '#' or ';' # +################################################# + +# Which local IP address should OpenVPN +# listen on? (optional) +;local a.b.c.d + +# Which TCP/UDP port should OpenVPN listen on? +# If you want to run multiple OpenVPN instances +# on the same machine, use a different port +# number for each one. You will need to +# open up this port on your firewall. +port 1194 + +# TCP or UDP server? +;proto tcp +proto udp + +# "dev tun" will create a routed IP tunnel, +# "dev tap" will create an ethernet tunnel. +# Use "dev tap0" if you are ethernet bridging +# and have precreated a tap0 virtual interface +# and bridged it with your ethernet interface. +# If you want to control access policies +# over the VPN, you must create firewall +# rules for the the TUN/TAP interface. +# On non-Windows systems, you can give +# an explicit unit number, such as tun0. +# On Windows, use "dev-node" for this. +# On most systems, the VPN will not function +# unless you partially or fully disable +# the firewall for the TUN/TAP interface. +;dev tap +dev tun + +# Windows needs the TAP-Win32 adapter name +# from the Network Connections panel if you +# have more than one. On XP SP2 or higher, +# you may need to selectively disable the +# Windows firewall for the TAP adapter. +# Non-Windows systems usually don't need this. +;dev-node MyTap + +# SSL/TLS root certificate (ca), certificate +# (cert), and private key (key). Each client +# and the server must have their own cert and +# key file. The server and all clients will +# use the same ca file. +# +# See the "easy-rsa" directory for a series +# of scripts for generating RSA certificates +# and private keys. Remember to use +# a unique Common Name for the server +# and each of the client certificates. +# +# Any X509 key management system can be used. +# OpenVPN can also use a PKCS #12 formatted key file +# (see "pkcs12" directive in man page). +ca ca.crt +cert reymota.crt +key reymota.key # This file should be kept secret + +# Diffie hellman parameters. +# Generate your own with: +# openssl dhparam -out dh2048.pem 2048 +;dh dh2048.pem +dh none + +# Network topology +# Should be subnet (addressing via IP) +# unless Windows clients v2.0.9 and lower have to +# be supported (then net30, i.e. a /30 per client) +# Defaults to net30 (not recommended) +topology subnet + +# Configure server mode and supply a VPN subnet +# for OpenVPN to draw client addresses from. +# The server will take 10.8.0.1 for itself, +# the rest will be made available to clients. +# Each client will be able to reach the server +# on 10.8.0.1. Comment this line out if you are +# ethernet bridging. See the man page for more info. +server 10.8.0.0 255.255.255.0 + +# Maintain a record of client <-> virtual IP address +# associations in this file. If OpenVPN goes down or +# is restarted, reconnecting clients can be assigned +# the same virtual IP address from the pool that was +# previously assigned. +ifconfig-pool-persist /var/log/openvpn/ipp.txt + +# Configure server mode for ethernet bridging. +# You must first use your OS's bridging capability +# to bridge the TAP interface with the ethernet +# NIC interface. Then you must manually set the +# IP/netmask on the bridge interface, here we +# assume 10.8.0.4/255.255.255.0. Finally we +# must set aside an IP range in this subnet +# (start=10.8.0.50 end=10.8.0.100) to allocate +# to connecting clients. Leave this line commented +# out unless you are ethernet bridging. +;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100 + +# Configure server mode for ethernet bridging +# using a DHCP-proxy, where clients talk +# to the OpenVPN server-side DHCP server +# to receive their IP address allocation +# and DNS server addresses. You must first use +# your OS's bridging capability to bridge the TAP +# interface with the ethernet NIC interface. +# Note: this mode only works on clients (such as +# Windows), where the client-side TAP adapter is +# bound to a DHCP client. +;server-bridge + +# Push routes to the client to allow it +# to reach other private subnets behind +# the server. Remember that these +# private subnets will also need +# to know to route the OpenVPN client +# address pool (10.8.0.0/255.255.255.0) +# back to the OpenVPN server. +;push "route 192.168.10.0 255.255.255.0" +;push "route 192.168.20.0 255.255.255.0" + +# To assign specific IP addresses to specific +# clients or if a connecting client has a private +# subnet behind it that should also have VPN access, +# use the subdirectory "ccd" for client-specific +# configuration files (see man page for more info). + +# EXAMPLE: Suppose the client +# having the certificate common name "Thelonious" +# also has a small subnet behind his connecting +# machine, such as 192.168.40.128/255.255.255.248. +# First, uncomment out these lines: +;client-config-dir ccd +;route 192.168.40.128 255.255.255.248 +# Then create a file ccd/Thelonious with this line: +# iroute 192.168.40.128 255.255.255.248 +# This will allow Thelonious' private subnet to +# access the VPN. This example will only work +# if you are routing, not bridging, i.e. you are +# using "dev tun" and "server" directives. + +# EXAMPLE: Suppose you want to give +# Thelonious a fixed VPN IP address of 10.9.0.1. +# First uncomment out these lines: +;client-config-dir ccd +;route 10.9.0.0 255.255.255.252 +# Then add this line to ccd/Thelonious: +# ifconfig-push 10.9.0.1 10.9.0.2 + +# Suppose that you want to enable different +# firewall access policies for different groups +# of clients. There are two methods: +# (1) Run multiple OpenVPN daemons, one for each +# group, and firewall the TUN/TAP interface +# for each group/daemon appropriately. +# (2) (Advanced) Create a script to dynamically +# modify the firewall in response to access +# from different clients. See man +# page for more info on learn-address script. +;learn-address ./script + +# If enabled, this directive will configure +# all clients to redirect their default +# network gateway through the VPN, causing +# all IP traffic such as web browsing and +# and DNS lookups to go through the VPN +# (The OpenVPN server machine may need to NAT +# or bridge the TUN/TAP interface to the internet +# in order for this to work properly). +push "redirect-gateway def1 bypass-dhcp" + +# Certain Windows-specific network settings +# can be pushed to clients, such as DNS +# or WINS server addresses. CAVEAT: +# http://openvpn.net/faq.html#dhcpcaveats +# The addresses below refer to the public +# DNS servers provided by opendns.com. +;push "dhcp-option DNS 208.67.222.222" +;push "dhcp-option DNS 208.67.220.220" + +# Uncomment this directive to allow different +# clients to be able to "see" each other. +# By default, clients will only see the server. +# To force clients to only see the server, you +# will also need to appropriately firewall the +# server's TUN/TAP interface. +;client-to-client + +# Uncomment this directive if multiple clients +# might connect with the same certificate/key +# files or common names. This is recommended +# only for testing purposes. For production use, +# each client should have its own certificate/key +# pair. +# +# IF YOU HAVE NOT GENERATED INDIVIDUAL +# CERTIFICATE/KEY PAIRS FOR EACH CLIENT, +# EACH HAVING ITS OWN UNIQUE "COMMON NAME", +# UNCOMMENT THIS LINE OUT. +;duplicate-cn + +# The keepalive directive causes ping-like +# messages to be sent back and forth over +# the link so that each side knows when +# the other side has gone down. +# Ping every 10 seconds, assume that remote +# peer is down if no ping received during +# a 120 second time period. +keepalive 10 120 + +# For extra security beyond that provided +# by SSL/TLS, create an "HMAC firewall" +# to help block DoS attacks and UDP port flooding. +# +# Generate with: +# openvpn --genkey tls-auth ta.key +# +# The server and each client must have +# a copy of this key. +# The second parameter should be '0' +# on the server and '1' on the clients. +;tls-auth ta.key 0 # This file is secret +tls-crypt tls.key + +# Select a cryptographic cipher. +# This config item must be copied to +# the client config file as well. +# Note that v2.4 client/server will automatically +# negotiate AES-256-GCM in TLS mode. +# See also the ncp-cipher option in the manpage +;cipher AES-256-CBC +cipher AES-256-GCM +auth SHA512 + +# Enable compression on the VPN link and push the +# option to the client (v2.4+ only, for earlier +# versions see below) +;compress lz4-v2 +;push "compress lz4-v2" + +# For compression compatible with older clients use comp-lzo +# If you enable it here, you must also +# enable it in the client config file. +;comp-lzo + +# The maximum number of concurrently connected +# clients we want to allow. +;max-clients 100 + +# It's a good idea to reduce the OpenVPN +# daemon's privileges after initialization. +# +# You can uncomment this out on +# non-Windows systems. +user nobody +group nobody + +# The persist options will try to avoid +# accessing certain resources on restart +# that may no longer be accessible because +# of the privilege downgrade. +persist-key +persist-tun + +# Output a short status file showing +# current connections, truncated +# and rewritten every minute. +status /var/log/openvpn/openvpn-status.log + +# By default, log messages will go to the syslog (or +# on Windows, if running as a service, they will go to +# the "\Program Files\OpenVPN\log" directory). +# Use log or log-append to override this default. +# "log" will truncate the log file on OpenVPN startup, +# while "log-append" will append to it. Use one +# or the other (but not both). +;log /var/log/openvpn/openvpn.log +;log-append /var/log/openvpn/openvpn.log + +# Set the appropriate level of log +# file verbosity. +# +# 0 is silent, except for fatal errors +# 4 is reasonable for general usage +# 5 and 6 can help to debug connection problems +# 9 is extremely verbose +verb 3 + +# Silence repeating messages. At most 20 +# sequential messages of the same message +# category will be output to the log. +;mute 20 + +# Notify the client that when the server restarts so it +# can automatically reconnect. +explicit-exit-notify 1 diff --git a/sysctl.conf b/sysctl.conf new file mode 100644 index 0000000..1fa03b9 --- /dev/null +++ b/sysctl.conf @@ -0,0 +1,68 @@ +# +# /etc/sysctl.conf - Configuration file for setting system variables +# See /etc/sysctl.d/ for additional system variables. +# See sysctl.conf (5) for information. +# + +#kernel.domainname = example.com + +# Uncomment the following to stop low-level messages on console +#kernel.printk = 3 4 1 3 + +################################################################### +# Functions previously found in netbase +# + +# Uncomment the next two lines to enable Spoof protection (reverse-path filter) +# Turn on Source Address Verification in all interfaces to +# prevent some spoofing attacks +#net.ipv4.conf.default.rp_filter=1 +#net.ipv4.conf.all.rp_filter=1 + +# Uncomment the next line to enable TCP/IP SYN cookies +# See http://lwn.net/Articles/277146/ +# Note: This may impact IPv6 TCP sessions too +#net.ipv4.tcp_syncookies=1 + +# Uncomment the next line to enable packet forwarding for IPv4 +net.ipv4.ip_forward=1 + +# Uncomment the next line to enable packet forwarding for IPv6 +# Enabling this option disables Stateless Address Autoconfiguration +# based on Router Advertisements for this host +#net.ipv6.conf.all.forwarding=1 + + +################################################################### +# Additional settings - these settings can improve the network +# security of the host and prevent against some network attacks +# including spoofing attacks and man in the middle attacks through +# redirection. Some network environments, however, require that these +# settings are disabled so review and enable them as needed. +# +# Do not accept ICMP redirects (prevent MITM attacks) +#net.ipv4.conf.all.accept_redirects = 0 +#net.ipv6.conf.all.accept_redirects = 0 +# _or_ +# Accept ICMP redirects only for gateways listed in our default +# gateway list (enabled by default) +# net.ipv4.conf.all.secure_redirects = 1 +# +# Do not send ICMP redirects (we are not a router) +#net.ipv4.conf.all.send_redirects = 0 +# +# Do not accept IP source route packets (we are not a router) +#net.ipv4.conf.all.accept_source_route = 0 +#net.ipv6.conf.all.accept_source_route = 0 +# +# Log Martian Packets +#net.ipv4.conf.all.log_martians = 1 +# + +################################################################### +# Magic system request Key +# 0=disable, 1=enable all, >1 bitmask of sysrq functions +# See https://www.kernel.org/doc/html/latest/admin-guide/sysrq.html +# for what other values do +#kernel.sysrq=438 + diff --git a/verEstado.sh b/verEstado.sh new file mode 100644 index 0000000..047a959 --- /dev/null +++ b/verEstado.sh @@ -0,0 +1 @@ +service openvpn-server@server status diff --git a/verLogs.sh b/verLogs.sh new file mode 100644 index 0000000..fc2e41f --- /dev/null +++ b/verLogs.sh @@ -0,0 +1 @@ +journalctl -u openvpn-server@server