From f3a4dad2c8e8fb6b39d2b9e54050b7747c8f2f0f Mon Sep 17 00:00:00 2001 From: Wouter Wijngaards Date: Fri, 1 Oct 2010 12:14:05 +0000 Subject: [PATCH] no override time, works on Minix and not needed for the tpkg. git-svn-id: file:///svn/unbound/trunk@2271 be551aaa-1e26-0410-a405-d3ace91eadb9 --- doc/unbound-anchor.8.in | 4 +-- smallapp/unbound-anchor.c | 53 +++++++------------------------- testdata/10-unbound-anchor.tpkg | Bin 12567 -> 12046 bytes 3 files changed, 12 insertions(+), 45 deletions(-) diff --git a/doc/unbound-anchor.8.in b/doc/unbound-anchor.8.in index 0c87bf7a1..a98cd0f83 100644 --- a/doc/unbound-anchor.8.in +++ b/doc/unbound-anchor.8.in @@ -108,9 +108,7 @@ errors by default; in that case the original root anchor file is simply left undisturbed, so that a recursive server can start right after it. .TP .B \-C \fIunbound.conf -Debug option to read unbound.conf into the resolution process used. For tests. -The validator date override option makes it possible to run a test on a -different date. +Debug option to read unbound.conf into the resolver process used. .TP .B \-P \fIport Set the port number to use for the https connection. The default is 443. diff --git a/smallapp/unbound-anchor.c b/smallapp/unbound-anchor.c index 5c4bb5985..1550e72bb 100644 --- a/smallapp/unbound-anchor.c +++ b/smallapp/unbound-anchor.c @@ -296,32 +296,6 @@ create_unbound_context(char* res_conf, char* root_hints, char* debugconf, return ctx; } -/** - * Get current time. - * @param debugconf: with override time for tests - */ -static time_t -get_time_now(char* debugconf) -{ - if(debugconf) { - FILE* in = fopen(debugconf, "r"); - char line[1024]; - if(!in) { - if(verb) printf("%s: %s\n", debugconf, strerror(errno)); - return (time_t)time(NULL); - } - /* must be ^val-override-date: 1234567$ formatted */ - while(fgets(line, (int)sizeof(line), in)) { - if(strncmp(line, "val-override-date: ", 19) == 0) { - fclose(in); - return (time_t)atoi(line+19); - } - } - fclose(in); - } - return (time_t)time(NULL); -} - /** printout certificate in detail */ static void verb_cert(char* msg, X509* x) @@ -1482,7 +1456,7 @@ xml_parse(BIO* xml, time_t now) /** verify a PKCS7 signature, false on failure */ static int -verify_p7sig(BIO* data, BIO* p7s, STACK_OF(X509)* trust, time_t now) +verify_p7sig(BIO* data, BIO* p7s, STACK_OF(X509)* trust) { X509_VERIFY_PARAM* param = X509_VERIFY_PARAM_new(); PKCS7* p7; @@ -1511,9 +1485,6 @@ verify_p7sig(BIO* data, BIO* p7s, STACK_OF(X509)* trust, time_t now) if(verb >= 2) printf("parsed the PKCS7 signature\n"); /* convert trust to trusted certificate store */ - /* set current time */ - if(verb >= 2) printf("time set to %u %s", (unsigned)now, ctime(&now)); - X509_VERIFY_PARAM_set_time(param, now); /* do the selfcheck on the root certificate; it checks that the * input is valid */ #ifdef X509_V_FLAG_CHECK_SS_SIGNATURE @@ -1598,20 +1569,19 @@ write_root_anchor(char* root_anchor_file, BIO* ds) /** Perform the verification and update of the trustanchor file */ static void -verify_and_update_anchor(char* root_anchor_file, char* debugconf, - BIO* xml, BIO* p7s, STACK_OF(X509)* cert) +verify_and_update_anchor(char* root_anchor_file, BIO* xml, BIO* p7s, + STACK_OF(X509)* cert) { - time_t now = get_time_now(debugconf); BIO* ds; /* verify xml file */ - if(!verify_p7sig(xml, p7s, cert, now)) { + if(!verify_p7sig(xml, p7s, cert)) { printf("the PKCS7 signature failed\n"); exit(0); } /* parse the xml file into DS records */ - ds = xml_parse(xml, now); + ds = xml_parse(xml, time(NULL)); if(!ds) { /* the root zone is unsigned now */ write_unsigned_root(root_anchor_file); @@ -1645,7 +1615,7 @@ do_certupdate(char* root_anchor_file, char* root_cert_file, p7s = https(ip_list, p7sname, urlname); /* verify and update the root anchor */ - verify_and_update_anchor(root_anchor_file, debugconf, xml, p7s, cert); + verify_and_update_anchor(root_anchor_file, xml, p7s, cert); if(verb) printf("success: the anchor has been updated " "using the cert\n"); @@ -1831,18 +1801,17 @@ read_last_success_time(char* file) * and the failure cannot be solved with a certupdate. * The debugconf is to validation-override the date for testing. * @param root_anchor_file: filename of root key - * @param debugconf: debug unbound.conf (with override date) or NULL. * @return true if certupdate is ok. */ static int -probe_date_allows_certupdate(char* root_anchor_file, char* debugconf) +probe_date_allows_certupdate(char* root_anchor_file) { int32_t last_success = read_last_success_time(root_anchor_file); - int32_t now = (int32_t)get_time_now(debugconf); + int32_t now = (int32_t)time(NULL); int32_t leeway = 30 * 24 * 3600; /* 30 days leeway */ /* if the date is before 2010-07-15:00.00.00 then the root has not * been signed yet, and thus we refuse to take action. */ - if(get_time_now(debugconf) < xml_convertdate("2010-07-15T00:00:00")) { + if(time(NULL) < xml_convertdate("2010-07-15T00:00:00")) { if(verb) printf("the date is before the root was first signed," " please correct the clock\n"); return 0; @@ -1894,8 +1863,8 @@ do_root_update_work(char* root_anchor_file, char* root_cert_file, if(force && verb) printf("debug cert update forced\n"); /* if not (and NOERROR): check date and do certupdate */ - if((dnskey->rcode == 0 && probe_date_allows_certupdate(root_anchor_file, - debugconf)) || force) { + if((dnskey->rcode == 0 && + probe_date_allows_certupdate(root_anchor_file)) || force) { if(do_certupdate(root_anchor_file, root_cert_file, urlname, xmlname, p7sname, res_conf, root_hints, debugconf, ip4only, ip6only, port, dnskey)) diff --git a/testdata/10-unbound-anchor.tpkg b/testdata/10-unbound-anchor.tpkg index 0049021329741dcd9fc85263b9ae7130d576cb42..aa768eff3e66814b73e384c184bbc8d72cd7d417 100644 GIT binary patch literal 12046 zc-noIRZtuZl&q295Q4i)aCdhd9D;iw5Zs-?HMqN5aEIV9xVyW%JIw6A5BF{BR&`bP z`>8%(lSLy!kpkOcb^pmpWQlBbcaoX)gS1O&IQsOUeBw^?SLDDcGEUYAm@gX5% zdkkE&5I;=KLuZu^ANOA*xhwd;G?NoMv&TJ@bCZzdHOQhold$U{eKB2ri6U>N3f*rt zq5Yx99nagO&mG%kcTuJ7ER)Vc^A<*GT*FSA+WGH(gD>v%4I4_(o?0~0q{TpytGq{u zDDwmFC1iL>XylIXec6)>{^~P$v!_9H^YYf?eV$9@_JT30pn~NYS#?``(IE}u_zr}r z_d#wTXAZ{Zl7U}mLyl+-tN4RWB82H+rw?ZvSBSWWwL(jexKU*<>;I*MC{%=QPv{Sn zWc>nFpzFH9Cj+@q+Dtz47&*UBBw2u>QQj>ijKH+8;vWnrmKdTdY(}XmrYhkyGm+?{?8Jme_J;-qsWIc5jeIMu)nf_P*%C|!h^j43X5_v*q~z(ikw#Yd zeVWFk!x?$mk9<4_`fi8#D;AZn=l-&!^Ix;d>zj;_Qk&>9q%1T8XQ#rI<4SQmGjeCF zc?8+9w6mTzXgcP2>Tr`a1^8O)NlJ;^%ZKE64i!D>s^DGgh{%{NT}o-kLP#24Z9OYQ zfbeZx?t*~n;qb;em zsI6qyiq9+2$#N;n!3l00H7+p+*35K!U57SlmlTSz?ZY<1jWg&Iq)ox6eI8{k4r7Mi zs-ql0aoN`y!#|Jm{5)eAqC^IbxqZs{v2#sWwC%oZLzVaTE_&!##c_&{?);9DzW{d0 zhD}KVOWs_hDX@1if_*T`FVgjOLCP4`F3uE5KYVfI{3uD7P7;d^$?VTW)B%lxt>}L_ zYE`1oBa(D{IKd<{Js2v{u&0>fA026*X?K?|+f3KSUF4Hw(|xCqiJ}+?@nhL-o_YH5 z%l5ubr%Jw8riK3ygiK9@t0ZPwOscdR6$fLj+>VAz8Y7%nEyRT`it{$z*dCDhcRcuu zo2f_VMcl5Hsv1o8WVmV&r`?birh)vFEp5SAMa1LWh66P|D&yH-`MS!@9j&zFO80rg z4fg@NKbAhmYh2JqC9n%2Iai3PjYy{SQedle>!{8}a&FA(@ey^NDlSPhZA5rd2^D0HY>-=xZa_xGPf`4w3cEV?V_HBbVT+~NXWhT~-^--x-3>N5$M}Rw z5hr8KvW_nBP%w-EU(iq!9dpONCyBgn&ijgRag#FG`^mj6ogV%9XJO}g3R)xdNfj?a zk@i0LHvefitZd&gNrPr<(bDL%iPFI{XX6#Ia6hUy1p}miD>b5(b@RBxd^{tOH_tGR zrpFpLGz;tpyVq-CA1E9IaHBo(U8>jy=G6&a0Svtp`=WUL)TdJv@~ZBNm-!FExCK(% zJ&|N3gO2Ygeom!Xw`D6MkCLEmnuq^%PRgzJdc%gVnNBF+F(#xr%cMV+THlgpZlU>C zr93|xzhX2ITu+QH%eX#&cfmR9&G&T>`0xgNj{2xST)ze0t@I&v&C}KlyAY<@lYX2F zfk(l4yE<=*AJ=Xbv|vu5Pfjo-f}@M*d4RoKbZ7H()UM_6fl9L1Dy`VGThtG<-tAEe z$4oGHjl_H#T|Ocbq-Xque(DKKw_yB9GZML=n|ZcuD})E1CUkz8{F9GUP`iC!u!<0L z!&4f}#(_s=O|}kacf&i1^Q1>+NpffPy>VaY%yQ11b^70<7!i5VM(LrtF|us#TCC|B ziCbCmsAZP2R7|_oxdbadYlG6Lk?$M}qrW3YhH9KcHlE#;ILm!!C;lxAGemBX}dPI)6{QL98dkG8D8_kG}%3Yd=POSXqci7lhdI~n(0)N*#pDwpJ)Li_mJBC>J z=t}TTEn@#sHfsWSe}q$7OYQoW$T?PP&nHmTq<%IxJo2QUw^v@n)2&7kd0*=lr5k|k z$L5Ats$u3^HTbkkF?dfVp7xU%qxm?;lLe14Wr^YyR~b% z0Cmp$sB?@xnDz{Nh`th!xrM)vTMD&LI{(UrhaO9^u*^6t*kBqWhHsRxS28A!>?maC zB|EYYt2(b@I-MB}AplCcS&%X+*0+;-;f3@Cffl+Y*T?OC7DNMa+N}tGG*c$FekEDL zJL3bO9;Wn6mOWa)CD>2VYI^oOF z(hzqp1Ca97J^6;LDfJZgH>R&?u$VEI0V$<;lYMJYnQZZphirG_YzW2xk8nX}lBpg!09 zKC~I3Rh765Cz2)Dp0O#Iu57Zx3bwWs*rhy&WqAdA;XgUy zPx1_BF{RtI34+<};d&<%NoP>j+hgICFu z=BeM};k=x{+MXY7;4*?RGvhtcao%l+H`C+){*=3MU_ut#P>0hV-X7kKQj(~p&kghr z1Km__gXYWyl0>J*Fv4clC-n>Zyq>z5bIrVC>vW&swXg}@UkH>d_mHNhN0KlMzI6WO zw3s&pd?MO{b?KKL$h3Ntk_8X7oaFLtKaBDbMhIp{l=EhQNo7DOAzU7HV+BDvY*+-{ zM!!zaUXS-KrvX7V^p(^^Ez8(e9&nKS;z7d}i7;~`fN)Abao>w@%tbFrrhV6ywGV`* z#gdlC84?Ugc^I%%4~yiQR~84~>N}f`wobz|Z;Pp{EY~%(N5k1!{mUvwT~o>R$ls$z z@7jUJ8Y4ob1XNPo_SY?*KhK$j86E5;*}W;*Hozy>#(SnhGoIk-)LgT|d#X>Vbnb=3 zIWu>osn@HRePC^*1!1}8aJd#;z@09MU4m*sz&UyJes{h3OcDnTe7O0nSTo}EN71n%FA=Knmj^AMl*$p$s z%B@D{Y8n9FDzm`u{eW=sDDjhepEF4)28 zqKnN+yRp!}oj{vlit)0kMwPC}{ifz1)f)n4BmSY7iKicX!9b4syHc6DuUh{Yw*IX# z*aX>W4*Qsai@pAIBbyKxCdN6@ERsQ!i&~gxd)Ez?9O0Cw?q~U5W<{(RM@hz~Wn>s= zQ}w?va5$S8CO9;MQiYo*cj{Q|jyhbA&^j8_3`%g!7)!93l?Z@lB;hdof>mPlflaX> zLSoawtxtYRX3`b9y$vZnsv36C&#HEl)hOXs419vHg(zE!c{Qn@elUMcn@uK}9|F8q z>P)x3^~vqp8{i$K{&!7z`hPJ17ZJM}=FVXmBNNR!@HdrIJW4!7F(2S3 zSr$TPAEHnv^?JmD5$`A>k}gln?XQLrbq)m~UdrGNpRFLS#+xVxM?@6<#ZE;Z} zjk5!B@&Dz%Oi&ill^a+T=xTe~pJ_d!gs*Bq_z zZt4L|5!dWfgYA6scX1|ZxuVPBoW(d-!c%c-5B$noqL_oDld%DX=|2pKC5eO*?}aJ$ zQtdE&E(c^O9w2MC zWmM)9p&X4Lcm){63XqGjjETTIp?=p(U9Y^SgGFl3dhw_dR z@s1-H&1#F0%y#Rj3yoo zE{{DadBIG|H>SA(OAqeQ=5x_gX1Zv{26IjDJ7U253_4s)$D!Bg^xbWs!X}OWA%OVk&jr6k^JwV91*n@V(eq zXv*Jn%{gxfgEZnbXfZ91)bJc#EPZiTBbtt>e=J96{oG0B6Hwe-)3~}){C9J8IDx&> zp7Y)Gj>w_rW%d}B&FsFUSjFc9P2SkwTYD}o29jD_3;&^&D3Vq3wQ+w~ATsJE@Zdew zlMmCRY4M`x?~OAF-s7mKOd}c4Ag=GJXIL8uCo=GUJX#5M&3hQH6nZ%gA5DY7(h%e= zVuYd1<*PZ)TyVnw5NaRJ8&dNJKXE&ffn(5taHV$YxN{57;m2*z07~JC&yqTa{`>k9 zyh)h|k!0}eeBIpmM21-e;{@zzN_KrC%!V1 zlG@jS$BU%?C_)|=9~?e*^FEL?IkWQC7+yaw*kaVj_^$5no{e!Ho4`vgS~|b;2{6+ydS1IxX#b&L9FNcM_cOQhx#OQzjVlq_>bQXrZ4Kh}CJ1wOJfv@kYE@-K6Fe9V>d&17c{yq%G}v2I~8VC~2o@oVWV8-;AB@z=Mj zq0f6_g@=F#zivQAbB(niBtS5gOQ!}T6odG)6pT^?%!WWnr=#C$OEoy9v7VCabM2O% z(g<(P+RK8dCu6cM zR-ui!OYzlVjjmlA@i?f+uzkNq9iQAv;m`o6Z#_ndDMsZGvvk-PE!-r$`4CD)`@Po* z4`4B2sBX*6gd4H-cL}k-EvCmpp;Kp#_T}>L`UFo2U7>RUDh%Xxb>Zd{grPHW*%2qf3;g zQe8WLERU+mJ51v%0X*Qli?!Ek#h7=8y%pa5&+0$k)|}dJ5o}!0+0SYtJOSG9bREn3D`UH%E7h&GwAgR(HEc>!mVZH(~ z55t?a1-rsB1SMDDZ9uNgYRFNhxa!eg+8O&JdAD6{+z5i}4F1v7>5f@WU&i(wBL9jm z$6$)wQv5s%Fm8#MQm5OJF0(*?EgUtz&0)^9f|oBu?M9~GsHe|AZJ0nJ42rTn38v9W z*c zwHlLIZWrTBfd6o06rE4KZtD{}WVO$fKq`Ctxip@Mwh9xSInwKL_ylVhsIWQ5P>Ztu z^E9(-PNj15loau%s4DD?@ z6&b@wQ};ZDW0Dh96L=P2-kfzv>;30<&#hVr-sGc|Jt;}}*I zX@l+2dqpt8M@tD&=L`Za-(V8I6xlblP}?Tm%uOa98~m()wHO+5=IMX(|jDL&>OV&d2N{iC(`99s$b zOO=Ke&fjofajRj|+B?Z!Ek0;mBT7%Meoi>T#2Xg)yBkkI6AM}UHDdd>%b0c5=qhG} z$s}hpCk8$?;=(WOdvi2mI2Adpu;4E?6$yu3#6!I$I+st#nFydoH9e-rl0t?M{SFJR zCT48<6%ROZ^|UOp{GcA^Am}-{VLgQ=?OMvQFLl)YHA`BJdO3>l7|BYCwNV_-TI{6< z8d-OiogNFC2|gJisFB9GiXK zd^L??Ob-q}ev>svaW88@(Si>Hp(S>ITfg3^e*U%F>^w1KFLRyn3R?-Qo1iA00-}-? zl4YbHQ7jV}Ih7G8DlzX1G$#9UxzUqf>(XHiW|}5)pCsZMK$uU{3m@(>hN!u}=d!EI z!wP1(5QCMqiB+}bDw!nGG?RSr)}RkOzm}Pi|7EP>PkrBzJ)bie_~&qAUnkx?NgdjB zG4hbC_vTwB_#H(d)KCfKK_tdJAfsdLjoQe7qr%Zqct3DdhgB+DD$ktTzi@U+okGUipM*TtV(^EehSrM9qN?fMtBxxQh zu4j?RPF0~muJMLppq1*#Wq09(g9jmcisdjRQ5pvVDI&4rwyZETdaGPRjqiiAT*;}Ta ze@IIdtoid22fGCG7qn=Xq8Vi_gEz`ppoHmMVnV`+yrobvq5ZmA9PkGFE~LLFHJ@{9 zjS;wO6MLu?@J`NHHhr_H3~o(5UNlANMNJYj)4)0YDY?KRw7}p(VK*V)mL$$_9=zjf zU26vW8!_CElUgYQ_gITq0Gv|+#mXAo(~Y8htApjhi>Y=Gh{cT}&L+k+Q}RYf0NCxg zxa9~i>`=w58B;0?2}ZEuFEnRg(Mu)<3I+RsJ=Kb^8ml_KF)L~QVRSz<4lfQPS^0Vd zg@9C+6KsraKFXy@Cla`({0r;Zjzn^cY$xa_EEVf{_Mmk0p8$5wrIwP8b5F zsutaWt05AF(eW;nT*5TT>-~8RXcY-(OU4~Hx$)kC#4R_~HrADlrBPB-$bGm;OOV7O`B!)JU7Ydlzyq37> zImqletX4^_nj-C9a>KU5@@77l|NAJios5=LKsMVK54OLGy#*YKj$7YFSV z2sVwAY`9P^9S}j}`f)&*yxz^j3d1nLGN&u+6s07b8QTWGHHY5z+|YU>l)5Fu)liv~ zGc^gIg|BNG%F7ktqvvW`lt2OgrNc*U_>C{A;9$&)z5>q5EW(n1vs z4kd&G6wg2hdOs1yqNX=-HHSbW#FA_gm+aq$FsYX&!zg9lCI1C5{8a4Qev9XB*sZ?Vm6C5%OTqP0)MM=|irwV^}oyt?`Jb*Z#sOiX`#X%GUFfAMn}-^88*_B+{60 zb&3=k^Y!>kLRJnb`pBwy5(^H=PQzt3=Qn)($mkli&0ec2pDAp@7`V1%+vrt}48&zt zx9JeqMEcy63(3aY1b;I+vdsjC)>-<-(rMwDYeLeo*ohlq!spm3KC>AoFZU^tb&`{q zbOiV!4zk5l?(D50!k@ML=Zb7HX7=tQA`^o`x%E2a!!$$L6CpmmOkW<_Nk>VN_@_4j ztzmg64^|ClU8Cr|lLWYSkNGinji9OA~useHFJxmLTS#etai&pS`EpCH_r+s2w% zU7qWx(vSo(Ue=BytGuGDn5WioxB^x-InYM}v1r0`D}s{7sm@fcB7y7xhUg@`ORg1Q zc+K+CE3H)&o5#~`K)u!+Ub&3tmv=v>DQTW5Rgo0k&Q)B;r*LAhQ<+i?^l>&T$EE{s z%=_g2o7h5522rL0;LK8ZsEYFf5OrHX>c0^`Mmuj_P{%)v)o1`9j!;3*dS_+5Y^|Y z$~cO#(S#hs!ap6bMufDV9lsZ(wO%m*jGPjoxc){Z_nVj|pH+ZJ(TPC4z3(`&Bt2BB zlO20f?a!>rJjqKBJcJhK8f*fJ;ztv7gTtED-D__o6m+wIovi>JPJjQxIA2l8hGVQN zDWjn}-9+?YI`r*pzicY^&7VM&EJ;*J7m6ucTV523mJ_14g%plJRGiS?pXoWwY+ru$<8|JpCg{kL<&Y)*yI&QFCO4bha`5J*Lx!3lYv>%1q73ifB(60CWa zOLKX8i+l}*w~dUqN(OIlkJ@a=4sFmRw@Ot#5^*xX8k4F$^Jm7Cf~DFjn~hIflCF0= zv<{Ue5+56em);zb+AQxR`nwGMEMwvB!)n@B*t2fq&&l`Yh0n#nA{#7+mFrw1pzFKl z_)}ii^fvt3SNkRFZG8_JEK%>X*Ynr^JNl|>+O9GuN~jqy307DUtF{F@=DpMCJVgJkp+UMD%ZN6HyhpxvK;U^J}acxA9lLG zJAkLIdmy0ZZEx$Rxc#f|4p_O+HMPDsS;wu%%Uy0e2S766cQW+mu2Nv3?)H1M{hDL^ z8YJlx_@3vn`E38ZtK`w`)!N8T*bF{AZE0jRyE#p&Y9@(aloK+17hbi16uB4R(o*GUCSlHbyGB^XRa1*S60oabHqblmU8nilQ0hm5?lemGy|zJ0gsS*!Pe z*qAw+`R$GQRFsj4Izd>qf%WGrl8oq(PnDYABCd<`9Re`*?*{|7=3v>PX)d8};M!%# zWA48Jw>bW+XW`GoOIC2*>A`wUt?;9uij41t(eBp#aF5qwqo|+He!c$tKwoXo{U=b4 z`-1p&sbFc_ezpwkIes*~zW;r?eJD<}6P)mf-a^>@(N*Je(7Y}3(d_UWgk${K<#U*& z?Y5A2w#Gwx@9^^d{)Yda;cat1eC=rq5}ag6_MBg`M%m zmY+i`0=*%UU66t;i0U=4{8>~aL#GPd8j=iP=8nyL2iitLFs9z+AVhYW&yZAvtUk*q zn8kAWg75Vvn7A+_UvRcq;-$YRnw^DFdo!Ydluk<9e^kzwV$NeQyOuJ) zw87b~s-u>Vy}#C*SVj;!CByW_9>a-VJ(1g~J(|oZo8XJQCirAfw`^!>{Z+rlI zXBc-m-Mq{Lp>QM`t_&_7An9?x1yvb~$MMgTaIJoc89b{2#_j}TNM{5cKo55fhx}z#@z7@ zdRAyq&evHxBcBn$-J%RMO8-rq#9uqmw`P0kxXC2z66)589yf}g2~+>O7k>40J4sVM z9+X3TbE?;kf{>jj5h;5h-5|^8ygaj7@tOwlHK;|OeU%h|gWMvuD-(^xRGv-`Km^WAf97oS|EmE_!4D3v$vYOa_y+!?{Oz_u+I#-F;V z{!lUhbdX8mjxJKIle(@?QqIU86Y$3MTVnz(c;lkQH_}C znD#1CEY+(2Rvlx&)QIi1N5PZ-HEvywnS;q8Z(DP~v=5aMKiIa%sfZ$1%yJN@&% zz#F11lMpBI%-SEG2svyMD3)EzfBLV743Nq($ltr3zaQ5$4-lg#49CewGCQ4o2;LO# z-;d=6vGro!S+0+l-|9TjnL1PmJrjSR(5aGU)i%Fsho{={D(E#tzw+ z0*<6!Z&3&q7P)l!tMQx+HFPPrP7B-El1;a8N)&r|r=!uFbd&hK8TtJl;m&H->3w32 z5UPXP!0TN)J#anekw*XWVa0i-RImX)*$!zWKGq%FY3;0 ze>90Chz`he7ci00#Smseikb!rYK_+7QyMzDL;}VaP)?DEiq1TA_Y2wBc=?LOAqBAU za;BQMO7X`QR$6P)S7&$Vg;dKdiK_4WcjmKq#tn4`e80zl_^0X+-jn)|@LaVXNE#eo z3M4TUQaeZ14UK?%SJz~_iLB?_0zGUZIs;X-Wd&7TEv1VLnp1aGFgdLa%1dN^05### zd}HWJ$&)u}W&!-!>n1k4t;p2Zgw`Q0Wb^Is51Psm8Al~kQ6C#I5Rl&rK@Me#C}=YA z=or~+Z`f1fr5XH^GnZPwcRc3UPg(E+qY0Co=!UVI?}@2{f-tS)jb=-MOzE7Os+8g- zg&P{Kc=T-(Lm7AQFeaH(ntP>>6?glW|=5asoh z;`1MzrJCSS*KmVXV5m}LX74GC;vfv@>_y>cl_;6ijsbXu3XV$`(R;u(^uN-i{)k?I z9J8L^d2CWHLGZ31ja6g+v8sFpLT0c2)K-79NLhilG>RJNReooaO9CmZFIs$BgWHV%4NFvnn-i`M0K5B142i2?ow>YrWF|3iTha-6r*rd1 zfdg@Wv5upietx~VzR8Lu_(SX~an>oqRU=}Fi3Vi0t}BN7l{%q&E(Nnv5X4(T}; zK>p}zCoW1oz8;oD`RllrYH2CGxznDC`KfR+ze!@eQZbuAL-Bq7DMBB{vi%?R;eW!< zdfxVk-+J~c9%IV8m}guN_ip-%t&oL#A$IN<#yaGZPaNO}Yv}17Nxz?*LA4-|b5k+YnErj?kT|eaQ0^ULX{dsz;NGPf^wD1((DN0!1;U8h`JDu1 zjaOR8#=ah*@~f9i-n{gDKiSK6i{8i=Qv$VMkXuG%-@={$k%D%I_E`k&%oq|kri>V_ zbnEm|6a1hn4BB1=dU8YV3rz3vBM!v#7ZyWd1uH8XOtg?-f)gn(X* zZ|P!Vjp*#o z&DJyKjr8{5w!+fIp|1EF){_YdF3Dy(!|qUXuENlre^zWc99$~Y*I6@`!*Vb09RHqq z?AqpnPPFS$c8OY!K4Fr=JHR>?^xHe$kxF)gHhwt(GT40}h)tz;R2+x& z%PVg)$N3MWl1MP6`Z^V-D4(_U^!Sm<)UDP_$kC3L5a|hX)wF781#$^z*m*|Gr%emCblZ z_&F7MYf`H;)ufW}Z(|?ug6IL^o>rd6I(ZVxW{~HZv*eRS>aSPbF&#|s)6}Nqx;SsS zX|?2`k}wHp9S+;+4@*oqmRpQ;PAWon>tW5WON!tf;a=bMK$_z?$if?R31toRLRJJ>65D^BRSL(02!{p6LB!*S z{tz=uj87auP}E})oqaDfIlH}iWz@W+Jwp*)3~z5Vd9IjBZuIz6x&(Gr58|FH!$X3rCDj zC%fGqy~t)xZ7h>ghOjZZG_T}snt!uZ;KyBl*MG!b(X}M>KQ@=?XK9bM+Dj2*B^Sb1P> zaas;&Mg21&w=zl!dr}k1exAI`KYc2ydQf)05?kz0Qk@wVU|wQH%rD-yU_G^RE`%P zT_6*M%(Y*B_{2?B`qt{4n4dB==h<#%se;wXKLN4reUVmWO`eZt^Of1AiD|*y9iSL7 z@@hgHcjCpXvyq=+SrENC>`V(RSp)TG9w##GC4f@LkrmJLxSa*_mm1xk_6^S-lwLuI zG98DMqM%n5yjHkMYREoqb}CYV{OL@%Hiydt|_8D;}z0~4mP5& zSE$>LRdNGt*RUhk>ajnXN zY}F|pZQT?tilRR!LpXxV#TyFo0C^^NyKYFY>lo6T)A#53HL0;Z@4JRSdQ9%|J40y9 z0V}IN?@t$de5Z(IJ4u0__DHshM+_GGD$FQX`KmP9)D=FlOiEp3-+{|0AmQS&{D#b3 zrP{#k-Fw$OWZRi`Q8f13c#qTt{yZ_LX1?osF7MHVFh1HH34T+7*P=72X1WgWIjn<1 zeeu<8igx$0p)U`ty$&}yD4&syP1gYR!?e|}9M`)7x(A0v1)QV1%nBE*31O*Z| zj0c-v05!*E`a5s?X=~Awja~EKq?nV2W<#B7%iRWgiK8DnDEtZRuAG({>qN_;AI-#N{CntqBFpAYSGo%xPtMJ>8+)}rzuH{8#EJa*>OnwZ^r(|81ld~X)SOJKHlM|BVS_sud3 zvg_ajx$||uJ$>IL(gqrX?q1RN16_fRH+#KGm*3l<@2JP8FVO!e{vT-jmdZJwdLfc= zBKB$E&r!pZ@C+;FCpt*G{~fqyTJ?WB#Sj>~9mcjBk1>Ec5abB>V%rKu0n-$5hR!Gp zu~0%i%=;;HZgE316qvP|f}ZM{7t!O7yz6}jE~fGgQ&_`RUfi8?jW$RNVIK&+`1vLU zYRa>^8%8vn1KGLbVOuNWC%2$m5Didf^5Rx-|q5#p_o!Tab;x!WNGA+ToC%2u=P zg4dRkaHq1%mu7pwKPK*_AjtLmV^@Ad`~2yTNT1PXv=Up|p){WlcJo5>MdO!d`(U3G zz_RrEn^Ujp2oBDhc}{$5ij+V~Y75*{9K;Sh|{ zWZDK?Pm*0ke5z%uQkd_A#})<`xjuR=e1K;hrJMZW6bUu=+~l=RF@){8ZT#;rnT0ql z??;0(nE;cW9)o=@O@EI{MqiZUbPN=usTE6MG+4co!mtV@CAe`oKN@QM#gv+4Gm@ED zdXhExx*4@thk``bR)n=Ny<=hcS-*8pVLyZwA6K$D_%LJ)w>p+Q@)A#x1H*(5SPXNu ztIUEF3Ro&wcW|&O=cuGAMe@TuJMc){2r)Q9US%v%Sy^q=pp7sxrjBPjB8v#}cT{RQ zuVztnw8GixawDo$S}LZTT2V3CMbkTS0|6MHbVo3in7X|-z$%PDr)fX~6&5yC6^pj= zd=|2XmW~?zMlv%K5EVRJT!k_SAXl-bw~B5gp4SsJs#Z8>b3>Rp^}@Y{Mql2CWq7@v zL$iJulteqDUc`5fC!;ocC|kc~hvAodaCK2f|yHAG`|x z|A1;kvh=lEMpAmBxhY;aRU#ur<**A4?|AnKyEHpoQ!QBR7lu!>iR&QdZBb#-gS#j> zJ_gzENc<1Ku_kVE@$19x9qzAynx!QBhQ=`Oo!U*-2aq%}iB;{Kz|wZ$`$>Qt1Wcwy zpj%?CwE#*}j;Lzw`q#PG>%j8J<^W7guE}M5%;d zqBHaCs7y*AWY6iyKYM& zgf0Rw@!ku5+jktf0;53Q?JXNz9hC&P-;=t}2ng+|H%7KP?6BzWKgk z=AZbsSllukjN}DdrpeWdS~Ccp(#6jS_WB+QRO&_UU>OcUC=}*`BkOmCa6ANye6s9j zN+S8mn zW~Qd;2dij@)Axlych|bwsU^}W0R{o#?d2pE3c64b&hhRIc%;rUhmsJhW1F3jQF0I? zWLG2ur0N-#~=gkgVP zi<9a&j@*ZNzOdB-W?sdhmeM~w8sZ<%2s%#(FA$c&1g8`w_*?P0)~!>eZPA5Y7&Nk* z3z!R*$;8|}HFUN5AQ?vy?XXm$lE*zMuKtix5pa>i5!=f8z`xJ zUaq5wLL@wN^{X*u3CEOn)KT%@9id*!# z=y|Rne13b??-2-C_%vmugM1AJ5eK5u*B8?T~-bdm@P6rd~zk(`+>sw6CbF(`dtX?lh4YBKn<^&56s7ETSg2o~)1 z*7bCFzVbL;(SIHSp84}?8r~=mm*TwP;v$Jdlv>;md^WztZ(E>*6o6+5Q_(Z=K3QWq zyp+!@9{WJ0*RSf2yMIq4*++RFEOGniJTHd0-$!4dH!p+bK(0Ih9iXuy?!~U9ePB6A zQ%bgw?(zoy$`?vwzwdvu8ThM`!?+QfRr1a;bf=lJciNf|=Y!ntdizt^_USSf=HH|q zssUt$F3k>xbv=AxX1kc|&Kp~r~c z^ftw$#<=O%vqqaFYD74qd>RhZqNty=;TCEhM%3JWj>{|(POy+Ynnv88k{`9UClTs; zMYY@!L^sep{7t@Q423dN>zDMd7beok7a>Cgx{|(O3$p$4^)khEMCJE9L4eC|I_>ms z2z4M~(F#Yd%LJ>@&uqErX+`zbEqAe=EE-$$Wx1TLMX9hNxc%Nl(RT1&_For9-a-~x z@naguEF%tm<{aAb2b*BW{kZ<%V{aLiLJy6>XnI-3wwLaYd6*A2g=TX(n#7G#2VlXw^ zO+L7A8N!TBoU_?m=_Px|L(^TI&+OxHr=t0_?dqW_U{O&Pi(HYAGk5yX3JJDjpJyGG z#qDj=rUwgo-gF?THY~PWIVA}!qn~+W?m7%s?Iy6bmc^m-89GSL;nglPG`#iKspZy2 z@^&M5#ZNi?QDoE<-&mV!LMI}jg(R7MF5N%fp~SIn+hfH~ohcE|PEsa4VWzpQ4R(o? zzu{MsrV1z>+T>cr8M0q33`6Qz@}(OsMh&>ZEFueG5)gQ5^4wk+bBC_0)h0)wlx74J zo$@=-)QL?j%=>Ad1}?UN19^ACLr($Upff3Y5K2k;WYS^_$g1i%xhoYhe!+K6A z-K%o4@oj=AR?w`MHTnk~GI`*avJ!y~_l!Ov-M+3n|mnO z(8&PI$ap8HUTLv}Kxs0M;QqYABwj4`Yf}?`=Kb|_PbN6WW-&RW+R{y>Uty(6YLr)9 ztt@zqAj*&In@$2z{|Bz|9(||;EuU^aDa?~CDRO)ZoPpnE>C|b-(Q!LM$IPD3DnAV) z_V-Zm0V>r5Rwgrewe*c2-aU<$Ts-652`e=7s7;6FyZ~u^!lFqw6P7yJ_9jzFk$sW$ zP(K4~O7}J-1lCtN24a%r&sEjpJ|8R<>L4mKkG6Wi%B3EARH2=Yk9t~iO$-}V!DbrI zQC~@U%=R>;ne^8qr1Ox)lGjHOP6$DgeS#)iY1K+KjyO8JqDQ&KT;q zL|1@T*CR8ZX89Znmc7N8PK-Ub9Q*>!N%PVcZXd6i^8x1Y$sN8a$@g((6g7GRm8kP=jK-WOe%@!UT&q}u{hF8^yr!L?-t*lQhFPMeBg8$kR38CtX5$kzW~NxckqGw3o+a2(-diEv*JvJMXV$*^Q$)h9$I7zmY>^5LLBFAS>j2u?UpK zc&~HFtfyLe8xH3m?&P7oyz#zX^qpeH0bV`HQ2Z52Ay3jk+GbgjpdD!~?QpT8koQ&BacbN@p9Pz46axMO0G$E%rTO^N@8zj`~ z!ZKQ=okeB5WW}dXYb3guFFyWvgtz@P9*dusWxf+`WnFBd*Tew&Ny&9R=)nrZE6saD z_*IN6S6+l)WI8%VAniu61={o+8W;wFP9g7kjsqtiQ9z&`fjw`a?_2fWky>y^@8uh> z`aV;`hoB;s*K|!l;%}(k$LhDQ#28UIO%q;mIy%oJXnG?#9{061iNF%_A?wUx@X;S~ ziPlFMYA-9dl!RZ&+J-If#$7!I*cvKa8G95n30=y0l*pf4^jFnwq=__RrtK9*0r23( zEOV@)>5P&qv48p=XzJz%{}gI=(!V&}b-{?H3S{yVko_In;JYVhCux0hlCct%0Vli= zk$p**>tFWPSw5?Rt2UEGP8f5guN?7MRqaB$kVgw6lBW$2#DS3fwU3D+q6zM1QP=)C zO^u1JAC`+zbU|0NjSWn*myTEK0B(lAg)Ji-H-p=ya<@Ah!B-F&Hc#mTOb$GK-jYya{|PfTRrJu=d%(!rJ<<+$bi zwW%rPD(uR|_6WU3Z@U?rOuQFhpafdlZTr=sl6TRR2ZN6RGerSO+n2o48&~Qrjla

{hUm1pDH0K|RaIy~>Y?r9T|8dm#N;yCF=7cZA-|WFl7IgHm21hY1U+Mn+0!x6)`?UQ^OPTdM|bHkX<^VjOZ(I9Q_FIGaSJEqJt^4! zSc||k?UTt`DULh2W$DMO2=n5OAUa;ofeD48&-RWj+SqzF@+47m*X@RrFNHAw>O$7o z)c{u0{mUMPFyt5AEa-GCP~qR#T8h!ZSs;j0R8}`Xwkxp1(gQ5utxL8a`bSwMcY-8o(C>La3fNy{4^30L164>ZmF8s$6|8wTmZOQ^r)HA;HIyQzV zEMR(#RMD$uC!Xt+bR@R0Fh3Gi#}RjGEq2pxtqH?(_&Qb6R79pr`$wrKq9QwvAq_QR zY}0##OU|3{M!vFwjuckk)Zc7`AopOLW0$(Xn;kE^X^v8UIJhv=#E)aAC@Q!~VT+?4 zNE|r0?nsdKlgOAicQbeL;nsQDDhm!d70BkPw0v`uMA*u2?eX%{QgEn>xW{|h7SDWK z^mh4r(9G@+>yEuF|Bu;DT%z-RsrYC&0lq^NEekIfKx|asLY0tQOa*!WGtOsD1MbOZ zpuacN;D^_TI5JqxH^}c}U_Atwm1tXFs6w&-O!U?}nO32S9M7 z^5HHiKk}KebWhX=e-VXLABhgq`bQ}TnZMIdkuQ`|P{gyZbc5&zjdUdG4q_G5qK~wD zlE$y<;AaCS5yJ3i=+X)@eVFLrXa0%dk|bo254uu*vTxKyrX(Q5VtSH=O!}H{zmba& z?*F3#wR%%3@(Q=2S-Lj=L7s^+RMqbF z)grq0%w1-X`)cl?XK~Tq5og*|JVYMCx!GVJaC;*7k&)5;VrLQ z?y=Ff!lH&fel4MOiHNGlvNgLKs05Kg7fcCojKbgo`X7K|2r87XIPBICy|0ZyZpU53 z-dPbABkL1x{E}sP=*z#QdmW^rcYJGk<1F`Gl6BFuQ9?)81kt9!qJ-hXHAg zs-q^IV5NaX%`QgzBWSJOCmgIiQ)!vtKhnx6UP0o^7}BHPqcJ9SqY)@9RZ!h*^uc6G zJW(~H|b44qx z%;I){&_w6^jq3dy>RlR>s(C85(Tyl{^(HD0J@&-Uk3aZvyLyERe8$NK9#|4wPvUa; zyxHCHLcu{dDp0Db1Ho>+a`^(?XCQ}~`ClNS*VU8@9;+Tt_gxwT{AUY)S7FFAHD9ov z`Io*CYm14l-4|6>j!5W)jaso1fX6Z2(HzFoKz4CvnC=*>X-lQiX$#NuQDBPr zgS1gRb}};(rqMmB?3U?j^OEydD8qrh8GIA>en>8Y?Xfi(LFPp9(GjvaOi7)M{>0kDDuCK*<2&m0<}v5#XXlCfu~1L zQ3KnamCUc@-yc<6k?r!_cJE~;=jujJK%Y=x$qEanB#PkUvc#A43(Bpq;|z(e0?cc^ zM8E&hvo$|S;7Q&9Fw>X$YbGZ@qsB9rfBECjj-^L#zo8Oxw=aA7m9Y11^bX5_=I7t? z?&Gq#Q-zZ6O9o8+LY=Os$4;m%(n1MS zX1(D0hV%Qh{+k1G-m3O^FYuJ4f9HK78*mArFSb!EU-{KPlJWPg0Lj9GKa)S7xA}H| zw=eNJ&~N{axO(7bzn>p4;P)&i<++T!z36kmz(VLp<+ERQYx`?Yun5Po|14d>?z-~C`T?xr&#@?5>_xjW`&u@fJukb*La1K&vzdp)`{wH{QVRI2iL(7*bXM2V?|QTHNewVN+q5+>3Xr<1_JPxg zKQksO?)S6H#$L-3h1zO);=Ani)3CBRKZKXk*K*QUY>;e=lH40=3^bQNQu7~j$Me5! zZW(wOU}+Wfz8{D2jO%?~5DWA>sz-467n3)IX`rJJS%q4?u+`wI3CA^E&5g5{tLyh$ zA(=t(_xDO|>E+|v%F4! zhUf-rPx!v>jyq<$|GnP#UH6PrQ*hDa!D^)EwSXz~PD?|XM96#Xbf@F%-$DED9c$xU z&NLE`65s*_3SkX2*2p>BTl$CVMCa-nMn0${%{Y z4HS4$S8kJpgnP1uh$|bqXqz!!%N)(8vm0m zoC0FaX#~zuiS(I>=KrW1IgnP2QQ@@HPQ(HuBLkh}8gY;vK@c{pQf71P5GO{Vfpb$~ zmYa0wBXQYU3lb>LI`~fNv|P$0ojn&$P+Uh*3?4j#01Xw@n280csQ`D zhA=`KO-v-fHGkwQA<1g1n82g0+gBGorf{Z3DSFeo&_;e$EvJY3XrgVjnPIw za5Vo@?*FdQUy8Q%W044d0jYl95yET@WV0Q<4p0t$>@@*BYe7U;fh;#5IU!e^J}5nB zpcLNIE6L2%7fJ%Q*SDoi;aa0bOo*WyzPq`|a2D^sE=vem9(FW*ZaXf^v9ZeA1dlVf z9$UYpOZGX%e>cPJK}xT0GOzWoWR|42Y~qpchy-$PX8%;^xH$#zI1_$1*2wED$~*nt za=f}#%Fea0tf={Yzok_Yd6^^a{V9l?&E@)h?c~$jFp1RjAgQ!yTj*6kjCyn7^a^#jxLg5zHZ937{FwVUVSaP2aYdt720%1=qvxaAqQ4i3R4<&x}jN!~<4 zXGv&ia{0`LioNU5Z}G&v4C_65e$nBUJOdSOe96T;#g1`7dmDTOo(0iHSDU1V@yhx- zeLI>QTqlK!I*rB?*<=`v!d9q8XL_Nw3lrYCT&#VL%@M%2=J&uYTLKS=AFr7N79kT9 z^d#K!6U33@^l1oh^m(@qx`A+RB=W2X(@#N&c_bh{!0%(>xc{DO zowTzkHp&1kA_~#?FFYDjdZPc=uiRfs^9T!_`D!=6xKr^B7A4BU9DdSG;OT1t?!y<# z%{iiE&3>gU31zR%$f|(%%*gm}$F|BbkMQ#5qk4fS1{Bs4qrU()8hTiu^^(m z3%@_Vf{N5tH7RSB0DIDNRFo_xn$ofhC12)U$A$6le2Iq;C~gq*V@O>^Q%Q4#q1dfy zlcW+Z64(L_V7qqb%j*nQULp%e;^#kNz5w#{b7%e$-MPxmfh0z%r)UykJKu>UJFmdksdrl5CF(-jC& z?C2qoPPr8*T&c3wi4|QBRm~mrJsOvWTJF|FNtkKOpOa3#zn6x(1Qk{|coky8im@C% znnrm=?I*%kn>w1tS{3^NA*4M{V>yB+a3dV9b^cY5sFdqOi1h}-bq)9~U}ty=j2ONN zl$pPcMd+K-{9rRzM6S^>E=d%=7wQV)?5x@*JFms_kZ%X5MEkPFEzU~U{?l)y=cY$JMUqewn`^dSMGimc{g zqz-wlBa0xZ_?8f*doZJi*!Tff)Hi6mWFuj;B$0Cnnhs=yw$z^|E?-5Cgw2N9U9^F~ zaB;f~SGDr+_TxB&*>z>cZzp(~`dnut_Z=Is(=qyLp$(JvAz95e#3doZy712G92 AC;$Ke -- 2.47.2