From f12728223265c97b5be072a56031333d7c4cdfb1 Mon Sep 17 00:00:00 2001
From: Jouni Malinen
-Project source code and related files are maintained in a version
-control system. The first version up to and including 0.5.x were
-maintained in a CVS repository. Starting from 0.6.x, repositories
-moved to using GIT. In addition, Host AP driver is now maintained with
-the rest of the Linux kernel tree (which is also using GIT).
- Using git protocol: git://w1.fi/srv/git/hostap.git Using HTTP (if git protocol is firewalled): http://w1.fi/hostap.git (e.g., to get a clone of the repository you can use git with
-" WWW interface (gitweb) to the repository:
-http://w1.fi/gitweb/gitweb.cgiHost AP / hostapd / wpa_supplicant - anonymous CVS/GIT access
-
-GIT
-
-git clone git://w1.fi/srv/git/hostap.git
").
-Anonymous read-only CVS access to the Host AP driver, hostapd, and -wpa_supplicant CVS repository is available using CVS pserver: -
- -export CVSROOT=":pserver:anonymous@hostap.epitest.fi:/cvs"
cvs login
Password is empty, so just hit enter when prompted for a password.
- -After you have logged in once, you can checkout the source:
- -cvs checkout hostap
-If you want to compress the stream to save bandwidth, you can add -z3
-option to the command (cvs -z3 checkout hostap
).
-
-Also other CVS commands like update
and log
can
-be used.
-
hostapd is a user space daemon for access point and authentication -servers. It implements IEEE 802.11 access point management, IEEE -802.1X/WPA/WPA2/EAP Authenticators, RADIUS client, EAP server, and -RADIUS authentication server. The current version supports Linux (Host -AP, madwifi, mac80211-based drivers) and FreeBSD (net80211).
- -hostapd is designed to be a "daemon" program that runs in the -background and acts as the backend component controlling -authentication. hostapd supports separate frontend programs and an -example text-based frontend, hostapd_cli, is included with -hostapd.
- -Following methods are also supported, but since they do not generate keying -material, they cannot be used with WPA or IEEE 802.1X WEP keying.
- -More information about EAP methods and interoperability testing is -available in eap_testing.txt.
- - -
-hostapd
-Copyright (c) 2002-2011, Jouni Malinen <j@w1.fi>
-and contributors.
-
-This program is free software; you can redistribute it and/or modify -it under the terms of the GNU General Public License version 2 as -published by the Free Software Foundation. See -COPYING -for more details. -
- -Alternatively, this software may be distributed, used, and modified -under the terms of BSD license. See README -for more details.
- --Please see -README -for the current documentation.
- - -The original security mechanism of IEEE 802.11 standard was not -designed to be strong and has proven to be insufficient for most -networks that require some kind of security. Task group I (Security) -of IEEE 802.11 working group -has worked to address the flaws of the base standard and in -practice completed its work in May 2004. The IEEE 802.11i amendment to -the IEEE 802.11 standard was approved in June 2004 and published in -July 2004.
- -Wi-Fi Alliance used a draft -version of the IEEE 802.11i work (draft 3.0) to define a subset of the -security enhancements that can be implemented with existing wlan -hardware. This is called Wi-Fi Protected Access (WPA). This has -now become a mandatory component of interoperability testing and -certification done by Wi-Fi Alliance. Wi-Fi has -information -about WPA at its web site.
- -IEEE 802.11 standard defined wired equivalent privacy (WEP) algorithm -for protecting wireless networks. WEP uses RC4 with 40-bit keys, -24-bit initialization vector (IV), and CRC32 to protect against packet -forgery. All these choices have proven to be insufficient: key space is -too small against current attacks, RC4 key scheduling is insufficient -(beginning of the pseudorandom stream should be skipped), IV space is -too small and IV reuse makes attacks easier, there is no replay -protection, and non-keyed authentication does not protect against bit -flipping packet data.
- -WPA is an intermediate solution for the security issues. It uses -Temporal Key Integrity Protocol (TKIP) to replace WEP. TKIP is a -compromise on strong security and possibility to use existing -hardware. It still uses RC4 for the encryption like WEP, but with -per-packet RC4 keys. In addition, it implements replay protection, -keyed packet authentication mechanism (Michael MIC).
- -Keys can be managed using two different mechanisms. WPA can either use -an external authentication server (e.g., RADIUS) and EAP just like -IEEE 802.1X is using or pre-shared keys without need for additional -servers. Wi-Fi calls these "WPA-Enterprise" and "WPA-Personal", -respectively. Both mechanisms will generate a master session key for -the Authenticator (AP) and Supplicant (client station).
- -WPA implements a new key handshake (4-Way Handshake and Group Key -Handshake) for generating and exchanging data encryption keys between -the Authenticator and Supplicant. This handshake is also used to -verify that both Authenticator and Supplicant know the master session -key. These handshakes are identical regardless of the selected key -management mechanism (only the method for generating master session -key changes).
- - -The design for parts of IEEE 802.11i that were not included in WPA -has finished (May 2004) and this amendment to IEEE 802.11 was approved -in June 2004. Wi-Fi Alliance is using the final IEEE 802.11i as a new -version of WPA called WPA2. This included, e.g., support for more -robust encryption algorithm (CCMP: AES in Counter mode with CBC-MAC) -to replace TKIP, optimizations for handoff (reduced number of messages -in initial key handshake, pre-authentication, and PMKSA caching).
- -hostapd is configured using a text file that lists all the configuration -parameters. See an example configuration file, -hostapd.conf, -for detailed information about the configuration format and supported -fields.
- --Any comments, reports on success/failure, ideas for further -improvement, feature requests, etc. are welcome at j@w1.fi. -Please note, that I often receive more email than I have time to answer. -Unfortunately, some messages may not get a reply, but I'll try to go -through my mail whenever time permits. -
- --Host AP mailing list can also be used for topics related to -hostapd. Since this list has a broader audience, your likelihood of -getting responses is higher. This list is recommended for general -questions about hostapd and its development. In addition, I -will send release notes to it whenever a new version is available. -
- --The mailing list information and web archive is at http://lists.shmoo.com/mailman/listinfo/hostap. -Messages to hostap@shmoo.com will be delivered to the -subscribers. Please note, that due to large number of spam and virus -messages sent to the list address, the list is configured to accept -messages only from subscribed addresses. Messages from unsubscribed addresses -may be accepted manually, but their delivery will be delayed. -
- --If you want to make sure your bug report of feature request does not -get lost, please report it through the bug tracking system as -a new -bug/feature request. -
- -This project includes three main components:
--Host AP is a Linux driver for wireless LAN cards based on Intersil's -Prism2/2.5/3 chipset. The driver supports a so called Host AP mode, i.e., it -takes care of IEEE 802.11 management functions in the host computer -and acts as an access point. This does not require any special -firmware for the wireless LAN card. In addition to this, it has -support for normal station operations in BSS and possible also in -IBSS. WPA and RSN (WPA2) is supported when used with accompanied tools, -wpa_supplicant (WPA/RSN Supplicant) and hostapd (WPA/RSN Authenticator). All -these programs have been designed for both desktop/laptop computers and -embedded systems. -
- --Intersil's station firmware for Prism2 chipset supports a so called -Host AP mode in which the firmware takes care of time critical tasks -like beacon sending and frame acknowledging, but leaves other -management tasks to host computer driver. This driver implements basic -functionality needed to initialize and configure Prism2-based cards, -to send and receive frames, and to gather statistics. In addition, it -includes an implementation of following IEEE 802.11 functions: -authentication (and deauthentication), association (reassociation, and -disassociation), data transmission between two wireless stations, -power saving (PS) mode signaling and frame buffering for PS -stations. The driver has also various features for development -debugging and for researching IEEE 802.11 environments like access to -hardware configuration records, I/O registers, and frames with 802.11 -headers. -
- --When used with a user space daemon, the combination of the Host AP -driver and hostapd daemon includes additional features. These include -support for IEEE 802.1X and dynamic WEP rekeying, RADIUS Accounting, -RADIUS-based ACL for IEEE 802.11 authentication, minimal IAPP (IEEE -802.11f), WPA, IEEE 802.11i/RSN/WPA2. -
- --Linux -Wireless LAN Howto has some useful information about wireless LAN support -in Linux. In addition, it includes information about which cards are -Prism2-based (and can thus be used in Host AP mode). -
- -More information is available on wpa_supplicant's own page.
- -Supported WPA/IEEE 802.11i features:
-Supported drivers:
-More information is available on hostapd's own page.
- -Supported WPA/IEEE 802.11i features:
-Supported drivers:
-
-Host AP driver
-Copyright (c) 2001-2002, SSH Communications Security Corp and
-Jouni Malinen.
-Copyright (c) 2002-2007, Jouni Malinen and contributors.
-
-Author: Jouni Malinen <j@w1.fi>
-
-Host AP utils
-Copyright (c) 2002-2005, Jouni Malinen <j@w1.fi>
-and contributors.
-
-hostapd
-Copyright (c) 2002-2011, Jouni Malinen <j@w1.fi>
-and contributors.
-
-wpa_supplicant
-Copyright (c) 2003-2011, Jouni Malinen <j@w1.fi>
-and contributors.
-
-This program is free software; you can redistribute it and/or modify -it under the terms of the GNU General Public License version 2 as -published by the Free Software Foundation. See -COPYING -for more details. hostapd and wpa_supplicant are alternatively -available under BSD license. -
- - --Please see -README -for updated documentation of the driver. -Please also check FAQ before sending problem reports. -
- - --Note! -Host AP driver was added into the main kernel tree in Linux -v2.6.14. The version in the kernel tree should be used instead of this -external hostap-driver package. The external releases are only for -older kernel versions and all the future development will be in the -main kernel tree. -
- - --Please, note that you will need quite recent version of Wireless Tools -to use some features of the Host AP driver. Using the -latest -version of the tools is recommended. Some features might also require latest beta version. -
- --Any comments, reports on success/failure, ideas for further -improvement, feature requests, etc. are welcome at j@w1.fi. -Please note, that I often receive more email than I have time to answer. -Unfortunately, some messages may not get a reply, but I'll try to go -through my mail whenever time permits. -
- --There is also a mailing list for Host AP related messages. -Since this list has a broader audience, your likelihood of getting -responses is higher. This list is recommended for general questions -about Host AP driver and its development. In addition, I will send -release notes to it whenever a new version is available. -
- --The mailing list information and web archive is at http://lists.shmoo.com/mailman/listinfo/hostap. -Messages to hostap@shmoo.com will be delivered to the -subscribers. Please note, that due to large number of spam and virus -messages sent to the list address, the list is configured to accept -messages only from subscribed addresses. Messages from unsubscribed addresses -may be accepted manually, but their delivery will be delayed. -
- --If you want to make sure your bug report of feature request does not -get lost, please report it through the bug tracking system as -a new bug/feature request. -
- --Here are some miscellaneous links to pages related to Host AP mode, -driver, etc. Please send any corrections or additions to Jouni Malinen (j@w1.fi). -
- - -- -Host AP driver / -wpa_supplicant / -hostapd releases - -
- -
-
-
-
-
TODO
- -wpa_supplicant supports large range of security -modes and authentication types. Just looking at the reference -information of available configuration options may not provide enough -high level understanding to select which options are needed. This page -provides information about configuring wpa_supplicant and a wizard for -generating example configuration files to make it easier to understand -different security policies and how they should be configured for -wpa_supplicant.
- -The wizard goes through steps to select suitable options based on -your input. An example configuration file is updated at each -step. This example can be seen at the bottom of this page.
- -wpa_supplicant can be used with multiple operating systems and -network drivers. Most of the configuration parameters do not depend on -this, but some of the parameters may need to be changed based on -OS/driver capabilities.
- - - - - - --Wireless networks have a "network name" (SSID = Service Set -Identifier). This is a sequence of up to 32 characters. This name is -used to select which access points (AP) can be used and as such, it -must match with the SSID configured for the desired AP. -
- --Some APs allow SSIDs to be "hidden" which requires that the client is -specifically searching for the configured to SSID to be able to -connect. This may require some additional options in wpa_supplicant -configuration, so enable those here by checking "hidden SSID" if your -AP is configured to hide the SSID. This may show up as "brodcast SSID -disabled" or "hidden SSID" or something similar in the AP -configuration. Hidden SSID configuration does not prevent -wpa_supplicant from connecting to APs that do not hide SSID, so it can -be enabled for all cases. -
- - - - -TODO: write explanation for different modes
- - - - - - -TODO: different group cipher for WPA/WPA2
- - - - - - --Static WEP keys requires that at least one key is configured. Up to -four keys can be configured and one of them needs to be selected to be -used for transmitted frames. All configured keys can be used when -decrypting received frames. -
- --WEP can be used with different key length. In most cases, either -40-bit or 104-bit keys are used. These key lengths may also be shown -as 64-bit and 128-bit in some cases since WEP adds 24-bit -initialization vector into the keys. 40-bit keys can be entered as -five character string surrounded with double quotation marks, e.g., -"abcde". Alternatively, they can be entered as a hex string of ten -characters without quotation marks, e.g., 6162636465. Both of these -options configure the same key. 104-bit keys are entered similarly, -with 13-character text string or 26-character hex string. -
- --wpa_supplicant uses indexes 0 .. 3 for the WEP keys. Some other user -interfaces may use indexes 1 .. 4, so this needs to be taken into -account when determining which index to use here. -
- - --Passphrase (string of 8 to 63 characters) needs to be configured for -WPA/WPA2-Personal. This passphrase is then converted into a 256-bit -pre-shared key (PSK). Alternatively, a 256-bit PSK can be entered as -64-character hex string into the PSK field. Only one of these options -should be used. -
- -TODO: write introduction text for each EAP method
- --This configuration file can be copied to a text file that -wpa_supplicant will then be asked to use with -c<full path to -configuration file> command line option. -
- -Note: Invalid PSK
"; - t.style.visibility = "visible"; - } else if (psk.length == 0 && passphrase.length && - (passphrase.length < 8 || passphrase.length > 63)) { - t.innerHTML = "Note: Invalid passphrase
"; - t.style.visibility = "visible"; - } else { - t.innerHTML = ""; - t.style.visibility = "hidden"; - } - - if (psk.length) { - document.cred_psk_form.passphrase.disabled = true; - document.cred_psk_form.psk.disabled = false; - } else if (passphrase.length) { - document.cred_psk_form.passphrase.disabled = false; - document.cred_psk_form.psk.disabled = true; - } else { - document.cred_psk_form.passphrase.disabled = false; - document.cred_psk_form.psk.disabled = false; - } - - update_conf(); -} - - -function is_hex(s) -{ - if (s.length % 2) - return false; - - for (i = 0; i < s.length; i++) { - if (s[i] >= 'a' && s[i] <= 'f') - continue; - if (s[i] >= 'A' && s[i] <= 'F') - continue; - if (s[i] >= '0' && s[i] <= '9') - continue; - return false; - } - - return true; -} - - -function valid_wep_key(key) -{ - if (key.length == 0) - return true; - - if (key[0] == '"') { - if (key[key.length - 1] != '"') - return false; - return (key.length == 5 + 2 || key.length == 13 + 2 || - key.length == 16 + 2); - } - - return (is_hex(key) && - (key.length == 10 || key.length == 26 || key.length == 32)); -} - - -function configure_wep() -{ - var t = document.getElementById("cred_desc"); - var txt = ""; - var wep; - - wep = document.cred_wep_form.wep0.value; - if (!valid_wep_key(wep)) - txt += "Note: Invalid WEP key: " + wep + "
\n"; - wep = document.cred_wep_form.wep1.value; - if (!valid_wep_key(wep)) - txt += "Note: Invalid WEP key: " + wep + "
\n"; - wep = document.cred_wep_form.wep2.value; - if (!valid_wep_key(wep)) - txt += "Note: Invalid WEP key: " + wep + "
\n"; - wep = document.cred_wep_form.wep3.value; - if (!valid_wep_key(wep)) - txt += "Note: Invalid WEP key: " + wep + "
\n"; - - if (txt.length) { - t.innerHTML = txt; - t.style.visibility = "visible"; - } else if (t.style.visibility != "hidden") - t.style.visibility = "hidden"; - - update_conf(); -} - - -function update_eap() -{ - var eap = document.cred_eap_form.eap.value; - var n = 0; - - if (eap == "PEAP" || eap == "TTLS" || eap == "FAST") { - document.cred_eap_form.phase2[n++] = new Option("EAP-MSCHAPv2", "MSCHAPV2"); - document.cred_eap_form.phase2.selectedIndex = n - 1; - if (eap != "FAST") { - document.cred_eap_form.phase2[n++] = new Option("EAP-GTC", "GTC"); - document.cred_eap_form.phase2[n++] = new Option("EAP-MD5", "MD5"); - document.cred_eap_form.phase2[n++] = new Option("EAP-TLS", "TLS"); - document.cred_eap_form.phase2[n++] = new Option("EAP-OTP", "OTP"); - } - if (eap == "TTLS") { - document.cred_eap_form.phase2[n++] = new Option("MSCHAPv2", "_MSCHAPV2"); - document.cred_eap_form.phase2.selectedIndex = n - 1; - document.cred_eap_form.phase2[n++] = new Option("MSCHAP", "_MSCHAP"); - document.cred_eap_form.phase2[n++] = new Option("PAP", "_PAP"); - document.cred_eap_form.phase2[n++] = new Option("CHAP", "_CHAP"); - } - document.cred_eap_form.phase2.disabled = false; - } else { - document.cred_eap_form.phase2.disabled = true; - } - - for (i = 20; i >= n; i--) - document.cred_eap_form.phase2[i] = null; - - update_eap2(); -} - - -function update_eap2() -{ - var eap = document.cred_eap_form.eap.value; - var password = false; - var ca_cert = false; - var user_cert = false; - - if (eap == "PEAP" || eap == "TTLS") { - ca_cert = true; - if (document.cred_eap_form.phase2.value == "TLS") - user_cert = true; - else - password = true; - } else if (eap == "FAST") { - password = true; - } else if (eap == "GTC") { - password = true; - } else if (eap == "LEAP" || eap == "MD5" || eap == "MSCHAPV2") { - password = true; - } else if (eap == "TLS") { - ca_cert = true; - user_cert = true; - } - - if (eap == "TTLS") { - document.cred_eap_form.anon_identity.disabled = false; - document.cred_eap_form.anon_identity.value = "anonymous"; - } else if (eap == "FAST") { - document.cred_eap_form.anon_identity.disabled = false; - document.cred_eap_form.anon_identity.value = "FAST-000000000000"; - } else { - document.cred_eap_form.anon_identity.disabled = true; - } - document.cred_eap_form.password.disabled = !password; - if (ca_cert) { - document.cred_eap_form.ca_cert.disabled = false; - if (document.cred_eap_form.ca_cert.value.length == 0) - document.cred_eap_form.ca_cert.value = "/etc/ca.pem"; - } else { - document.cred_eap_form.ca_cert.disabled = true; - } - document.cred_eap_form.client_cert.disabled = !user_cert; - document.cred_eap_form.private_key.disabled = !user_cert; - document.cred_eap_form.private_key_passwd.disabled = !user_cert; - - if (eap == "FAST") { - document.cred_eap_form.pac_file.disabled = false; - if (document.cred_eap_form.pac_file.value.length == 0) - document.cred_eap_form.pac_file.value = "/etc/fast.pac"; - } else { - document.cred_eap_form.pac_file.disabled = true; - } - - configure_eap(); -} - - -function configure_eap() -{ - update_conf(); -} - - -function update_conf() -{ - var t = document.getElementById("exampleconf"); - var txt = ""; - var indent = " "; - var ap_scan = conf_ap_scan; - var drv = document.os_driver.driver.value; - - update_cred(); - - if (document.network.hidden_ssid.checked && ap_scan == 1 && - drv != "hostap" && drv != "madwifi") { - /* if the selected driver does not support scan_ssid, must use - * ap_scan=2 mode with hidden SSIDs */ - txt += "# this driver requires ap_scan=2 mode when using hidden SSIDsTODO
- -TODO
- -TODO
- - - -4kU#X*^9cudHEiMAY)B}mr<~UF3J(lm?+)rcO7by%^HG`c8fQn0 zl(DQh&}aUhutdK?V-mYGuZ~3C54{;td(g0$DA8WOiBqMm-=k0$_7gjpf}C-vdMz73f0FlI^QZ zp^50-s24r<_OZKB` <^uxq|**H2)NIse0Y;QOJ zdApd<&G}ut+xAtfc9&u`sQvQ$o9}JHRNC=5X_(>Hn7-x7v{9PM Eh3o^0W z8FKPQo3ILC#NYU6;k%v|6Umd4*fE%UWZs{<>|?q|6sFrkf~uJi$elkm9d5JBr-?82 z SvGUrw}tjbX*g~wP`IpvhIZ+gYu+4E(+}PP@{KY@41A}xfbvn z>H{_2U{LZ&@Ho_9&hD0v;hP&>kL>5}fT;^?-3a=+Vo%7VBU7TAhs?$BV%jYNgP p!n49>qc;!3O-VU&x++Zcd9bozqs52sqQ`hxYe^$E+;bQp zgHj#Elbs6L1Znqk)33UPU|BbH{}={+iXR90)93f8Uorc>kW*vf(rSjEn|R9%n^HwL zQ9IGS`4;C81oLsFe9n=(r1>pQA=1n85;rKD+BIc`-Od#P@7`SR=>=#18_s6I_NZ8Y z>a3j}IP{d}ic_(T9yeF_TPz&?6asY&3H#BKWqqPhjm@!gA<06K5iXoF7HL`AG7r!y zVW&ZymsjueZXklD-M(|H^mqx)zdv|xL~XdW7DL-83Qd02RuE0wKIgH;|2sZ&0)PHw zksPOZT0}4AzO>5hMA8H+zoWa6#5Q^|J`zd>DI7XNL(9fJS9?`AS>aKJ?WI3QSAuyZ zKnhPKR)G`Tu3`eKt-jaPu-Zw$wRk$ENr YaQUc __cBj@-$taA%JGf< zn}z!W#21*G7-;FMFG02`SKj_~*gR>UDCKw0Zxn!iqQ+B#dgyFw7C!SakxBw!Z#DWm zJvO(5@<*zv-^J&J{I^@CVmN!j8`%f0)8p@Bu0TtP_TFoG2Q98VMJo&Dr}u$G?-d5v z&kzrnKzLD&hWGw3D?}i0!1!P#uw^TFMlLCvcVHuMcG6*pHRY>7Ng;&6WEe>_kIY1# zvhfl&@#VK1{hIYr^*bS6fN&0Bs9oz?EKv4}wf+)l1vG{$0x72HEkumNk}Iou{b)g6 z9-d5&!3nvA5pXFranRuAPJ8(RKn|N;^c_9Y-+MSizDnE@YMrf(Cn8VDrGN{#2D)8^ zxmjvkI{~sep0gote$Xd05ceMY6w&W5vuD9bd%h#aY;QoA+}Xr=UAT%PO9eddk+-bV zACK1PwlTx)Mxo|d-^lnaunTE{I`*zNg~+i|S6@hthX&rNcH8;X?zgo)>@b*l|Ebj8 zPpP0sC^s^7M!9wmpq%#S5J3lvUpXP>jwQDg1=3O$b>izU5^k;)SV^SPfO|(~;m=1* z-n6*7)?rZ6m%9FX;`?8Tq6a;b^d)>7Pk}Rv79OKFf@bbB9X0w$PVd!^lKM77reN*{ zwHzvD{?yj`JPWUd5sP@g`9Cqd7r8D!m+Ju%KgH+wp&2c8lJ%uN>q~ov-|t*$zBS)$ zeP}@a@!*v3I0ha_e<$NXfS+P+-bEq~7+U@QH+R;J7V55o&c>VDCnuQW$Vb%zzm$6h zJ%wANw&uGBh|87xxKha2M9gbqdh!B9Y;V $0maqQ cvO1J7HKxr}$D!G|w(R^oANVW@xg_IUUW`|-VbHB0DXzXBp_F5k!O|EBLzRx0= zu^+ PJO*qKgawivq1E&CwJ!y9mZ z%Xss6zfW9m0;jU4@*b`-W2V^!BSNp_e;KHetfyoub>%Ic8GfL(o7#!FgK+flvi}b7 zrS5Bjh+`g-)tl3WUHQjIDXq1sPDk?(yvdy(w|a6NHSz(LQu^vCV=)&{%lO96l?2yL zWw*MeeP>R$qdG$u{dc}_MEX kTT5E?s=bp6^!tL%vnqeSn5vzI z?4`>+_ke6ya+>#XtGLfvLi?nD7`7M!!0mp=N6vyZQYh-C$uWpRma@VPXCP3!*>Q-s zfdbgZ8v3U4I6fVZ3p{QTj(t7JHp1FghUQjzbLFlfVWOFAM`&wDXWxEB?P^t lyK&h(_CcJBxkcg7BpKi)<4UDI(`x7{Oo=3<=67l%0bvP %rcbBS0_1cU5T(63JEltNf{sW G?N%a}= z>8j*Ff>N#I0oBr}3#4#J7@xw|xJw%l63<5xDTwdR$@cDtq!1T_i(!R80Hg7zD!S?M zKX@mHNJ!8#0`D9J#HQDV?&NV|AbLNBgXyxx+oW-KJJ5O!8(i~3QQ ucJ;>!fte0P zMc=LhgyE5;vR7B2N9`8t+~@3FS>*TXyon4N?bu-q?=EPUU;oHg@(R=N7gkLF-zzJZ zmW6BqlrUgQ)8S9m-jMbYQ21YdwFYpxY9NpojH{)jh~SGD37*1Oot%rVmb+aekZLa! zT)wJC)7NP^%TgRJmx*eRs=Nu1< h;fdts&7}H}}hT8X=)<8 at|&*uRxo^(dM)-x;^- zd#3(H?tTmTv^mWR4wXEM$Nu1|So7oF3dyN8Blfq?Ci=AZNl^|d`^g^JYGC)Y5LsB5 zBmkjg7Xifea@wedi<-j`0$zDI_OW1qblaAD+am6#z7eOrW1BAfx8R+6)|>qHB2W=% z))=v ?RG2%#myN7w`L!zv$z-_49kUFxfv|*)^Jfk zX=8_6xl!$`cPQQ8oaU!CQl58fRFo4IscVH`p+5m}Xhxs(8i+jeOKEM@cjfMw)a$}0 zAtT2FzVLA+G{NyC-k%XcYBRl~Z)ifLYkZfWIFdHd7sow$r;?h;k#;mL&3^kewqa<3 za_`pf#Y(a2RlzHgl@OEmI_YunSI4{iM)1(;Z@>(47sWG3sT`%Me)aipViU2)TnB^N zj}SUxlP>?%7RFuCr)Y@TX?%W_yZ`c7`M%r6-oD#5P~@nc<`rV#BkOn8Nw!8mDk3a@ z2o^vXtsQsOPB#KsP}=-b@J#t~P|;SvFF!hbJhxF)deIXLTzG}ZKaW-cjoo1Tap{lX z*NYigR~n#}-s^kgyDj~5$fZk0iE7rQX3dHKW0#-b`OVzyZtDur809?ub6gOz@#ifr zHl+U3P3^1D#UIzd{l0pF^~Xn--~Qe8eVI@V;t6!;b3%LSZYgAUOu9a(|Hn8VP0S$m zJJ69{kVI|uotkvc9zyE+3zavKZFY^0Kt|H{$ZT9PdYjE3>6(Vzu7vyUv-a-4=TL0= z+n%-IVR=Ft-&?)B4^_dZi$wn&>ZI9$XelUREI91GptVkW`{T22gu0SD5&?G#A(#0v zLVIJtqbDd%A{Xi8f<1ftjqqs4LS^s8X*}kp!uyVd^(98bu!GD@T=ZIdyTWGO?`h#h zn;Ii^`?xp@Z!!_hY}ysd_G=#mKNCH9K2$}u_4B(>YKDhhqow=?uq1ZV<4xtJ9+fwk zF`Se8^qJj+asux*Afe3dbY=qrS-F7!#x%aWAp33w3rld#cIOBLN!r;JI@rmD=6z!S z+jt%`e)i0}I~2RgJMv3ilRi6$TybFhD(YrS%hovO>03`%PnBhN{N4BHEnM6}s>@5^ zPs4e7(SIBD LD_nPIA;PYHmt=@SP>Ahn>mzT?TYbElz6FFwdC(7%Dl*}T!OS0N=`}4OhkyB-% zsSA)@m|LB)7@=f+_R~Cj{bTwpS!5Zl@9pDeq8YJfEo?YD$Xpq@&IcjhHqWrl4hRW5 z_O9s050j >L_1#ZJBGWuG2hdR5)w!w<&%I^NY91<+EGsz ztbQMhCXrj2*oyS(ZO%$qeQ9;lDe3dth#g!nG1yX+=?cMZXcyENDQ8~Fx<8kjG)c!U z{n=JB##3HUG8RW_^K;Tw&+-Y!@?J;WC*1=U?C+U)kJ0-xwbkHq{B;vKY?2CmwFsJK z#WHUFD^EeB6n8 tpW>U xTAw5GN#y5Om>uQCXCQ3WBQXu{Wl*0M<1ole1#?BV<(HxXji%(gC@xIghdeYLk z4clsK>p}2%(TyL6jI^?!y&shxy_jy+2zY)B?NG20lf4 1Q>RT2CEB@-X9;DsjJJ`jJA7oFNjiMl0!axWU|Pi&t-ed%b3$SS zuRHzzsbew(Wq!CBX!J}e$W!#>kE2^NsX9q{n$@n6C(!kCS94nAT)T3?s|tpBRtNh4 z({A@f-0U>W*Zn&lN`B=`Z`e4JVybqJw!wJaXDQZ#E8lHN~&`dq^-sov? z&qpEYtd@yD4ydj1{W6crLM Q^5A8c>n&$v1NXc(B|%6Z7Y$@!Ph$0 zfu&xbZF*_7ERf;kBB{u<_enZ?c>CXJuS>6@J+iBl^0h<^Q% }eZ*DW075 nw9jwT-3Ggvr8{ogZBbk+zY7JXr$_1pX+-2{kffqmVvzB_K!tx zH{9Sm&^2*$2(90`9<#n9Gg3EaPue_%SPl3OJT87{IYt2B$+M2uLzys_SFkkkodpDY zD8YM&y81Tz?#_Dua1MvregsTA_G9?QX8#Oi@7Xe))3JE^BUMn3@e@e^^c4qOg)gAq zZ6-YWbx&huFua`TR`(Nmy?Kz0H0hwQJc+cwkk}&S>80QPD=Pd|R{{nAkRK?X_JzDa z{(j{OPwbUy6<*;@;f;@X0HDaE9tM!dXQiaL1M>#rWF@(|t;Ut7xoH8G-t=65FA5~j zqGETdQy56|Kk`u#K~E* >oN7toY9&bRT*_ zYPkfnc}xhbv#dOQ__hepKI-awLGS$d{H;W1OnLgpXO;m~;PY+y%W=Rn**2_=K5Xs+ zT0;`j^Y7-w(4^~}Fc#t=TX(Hs#w*?`-$WPx9x7aG1DPkd>G!`oC9lZdk+qpA50_u) z) d5ThOe)>y-@ms7rOi*(~0*+dFwp8W&L&Hh+&FuP{;5&*_UO% z =HD0O6QiBlua?yxD=%r?WhQ7NVax8T5>_l)Yz2^X;>Rg1WTYyB781H)pHN1 z8c#fzn>flVVAHQMJQ9yG{$i?O3|(Hz8P&73E;5?+&Hbcc|Kt|%ga&qSn4flMT7ruj zve7$cY&fYdC>I>>T3B9kx&*FJ-uJ1{+36v}-3oCd$}<+v%Dyz}B+0AiFM W!hw(>N|XKRIq1_om3CX$_`))nBX(sdp{bYI^i5dyJByC;VAa$~WrFZC+&2 v1?rNA3uVYd 7nVJ;z`+r G_u@sg?@j!6BPfd&(3b0i zC^a&!`@DvE9Q{l})uVQvvYZ*#PgP3l*EA7z-khnQ{}KQb@kJV%i(bU+N^ylIeX6K) z4mA$NX2F(>=clfD@P0L)-OOwYu7Wp7`7QCDZL&}p8ktGxu2%Mo^@x3^jQ{d>Kl=4S zP0^R$T+Btj>oHNZ0K91!asT57b>(BNs^^zQpY@;Uwz1F*e9~m- A0Q@e>ekdEeSQ_AZ@t0& zM5s0sn&9u(ljD*g;(qp z<9nAwt3dvBz0WhBIpauU4vO3qx%YL1@%r;x%fqY;DCU`mST@5b602WXkymM8Z#2>T zdBAbAQgoFf*iD_+jCnvv{4Bs0pD~AQ960%SqQ>1f(czJAgd}{d^DS^!;%jx9_eTCj zjM#UCp2iijP_&M?v)i<(#+S+KA8tSRO0$(oN?mms$0v2-AGP^gC>CuDf4sjLo^z@R zwk_ziJ-=N_%4CL^O5Jlse(;6f33M=p(=Q ?J5Lh<&qOlB}A(=ran3=Dd!ODrG!d$q|}M zPtVYrj9nedF1G5xn;RA>Fx?lJuxCxgZS?J-va3#}wTtgY>XBWilV|F$BY#&|St!1D zi(%_N@arPq;|231>$Mc;PLuJHsupl~Wl@P&7!J+r>t&=ZVzGKcBDb-^?3s;3s{?yI zhVpLj_SzXm%H!gujmkdZm7$qp)h|j0&dW>B)AA%%!2W$kmefq^gE~Lwf%40ghWLjy z3T!PH*6^0?cbZV+o0z>_v!pURMTU7M*%G~arhKGVvbv#R-sc_~e jTs?{qr~IhCJhK&hY#Ih*Mx)=@-YY`HPBQ z9&M(&9Mqp9Wj=B~M5mr={lZb_%iQQBn?xSr46$0h>=B&6Sm%%f!I#UiVKXz}ui9|k z)b#CmKfSDsN6cF5E6NJUq=~ppTy5sS!0DZVUm1@$hn&<8YK|?uYfuIND@L%|wY+a$ zWf7&D-!F_9{C;&=Y>j`v ~J=NEw%*B$BU@( zj-m|G#fHjUziSixUfK&jYcqh!S0y1-l`UmU9A>+%L=e365&IM7W#uB&Wq*r3*bwDj zPts(~@&>7P*49OLnEMm4?3=>vzQM&9H>aUqev_gP(xRUCI*^T_?4H=oWoQ_xHG>SP z&b1Q>wAZRns);|@kQXzCy-!%*8hfdI0Ty82MC~$p6`uG-3O=QqOB|Dp8FQnofw?IO zmk+jPimwyPjTD0C68ghHd>d9y@3U)0zk2H-oC}W*_oXxH%Cj#R8Tv^WCT7yl5!rUm z$KpTE0r>RDV_Y;&rS~w$xpn>!mrl+sFrNEb-0)`H%wS=O4#qNj!GGkQ{v$tG76?NE zZ>a%n4Wf5g!kTObVAPiaEG!2JsbxLr h_KG zAwZHz9tDJ$!3|-_A!Q0Mn*Gh21y;Qa%JRcD7J~!UO|9;tIY57V-g6Zlg>bQ#DD$uR zhl9xFv&J0-28sU+AmeVL^H12K0 z1(#Q{IDChbs{DumO!aYV9ARN;Z>?6ICIcdb=LJ~va|8~P#G$`!EfHJ1+ASA#p}h_* zONMmYNdkiz=qCBfCU`Q>Rtcce=Nr*y7xI&+RvnC|_cOLB0|~Sv(b~0Nb;M=+fl+T| zd$~g^7}MXKPf``wWv%jt*A)v`xx{Qdl|8IFP7CoXViXj73~72XURoJq_V!c Ry<^MHJ(SkazILkhx5O zwFgc?=e)_z)`m*f{-$6nbgwYUS@(G_IJC5UkOy!SF2K|^ po@O>0p-=#gC^Zl-GJ#S^@*)9H#}`vuP(2 zaCJSbgSYj_5tAYgmq=#x9JG-o#Z7{H ^BvPfsE&V2{Y!eXAe7jCvbWWEi;Bl|pyjrQW@I4g8CNUn^jC`l7gl znhN{wJ^M7^=6hMdBLDZE!#V 4m-w}7Lz6_3Zi;S zsvCx|eF#zSQm3*!3c9~9hg5uHWOFNMZNI gHZ =i2PGfA} dQ*?#ju{%(sY5rne<(C`p8B$fA!nmXEo|LivojGu~^4; zaYgiip)>Du5#>yWFFv)mOgTMFKz!`+VvZPly*^C#utzce^52<2 WGL zy2TKwMK`u~c`h-6hh^uUTkT7_keDC9DROth%BzSkYHVNd35h9tTYK7{uxW|%y!6RR zjK18ZXjY_COz$P8x53!8w$Q7J3Hc!k`N0v#H1oGL8ABG!XB}~al&O26b|)pM0lDYi zv5!ksVScwR4VnaA6>@Ie%)Dy{4`Dn^O=%;Fb9AR(@enA)jfS>Jd28h8!xZ7DE%1D1 zvmfT0h{-Esv~&Ngzo>yQZZ$DgF17~VYNgDYayBy~OBBB~U2B~NT0R)Nhom%WvFE>a z(hmjFV8+0WXIb4DpT4v`Zka9zAwJhjc=}v8?$?OjFumt z8__bZDDuVYx11TDyO0xj05_Er-hO&Qfr8EB_Z@y(#4h#ZZHe-9DYJC>HJ}Uf2{yk4 zg}=g%c4v0~WFBj}CmPComBq1r0`AAq$(R4qX3@Abaw(gvSSyO`!N2~DT3%_e<0EcE z&d07u+d_A41N$M8H}on|D@0-7d&L(~L}HohFjK` h~19M2G&!bFgm(fH&tT#L@!~WX PZy-qUrD01mq!0L;FPql=mL_Qhb^hoVA GLuwU|OKUVP`5ZfLMMV|vi+$9{Xr>I+;$bl7L< z`8P!2H~r;ji$?SL%H6qQ00nf0OXe_+JTYrsvNQAMy{(sR0Q%pu5Sy6N?7cB$rvTQ| zxNu^r8J2{mk)D(>2ceNkGK}HS8@cXpl}+>ZwWC^BOKrh}k1)#7ZrGAhA&{TrNJolr zoD5C ATlHS;nf&U2BhyC=!?eQK;*}Ew a!(~)t zx0TAWEOn@Fu)nQUnW?W@8-9)2rE^?(0=LBn6cZfja0k547Rf22u&BbHW|+TeE8}sm z7&mQ3kgE&N((mjUoHA5qeuyJ&Ce~mkHR^ P{1r=Aib-0_6Pa`$(#zNne0;6zS;*2-H|%+fTRvx;c21NB4rbxL4R5Mi zeeZO?uKQiZDrBjKZ_rdw4=zI~n@~;4JIKR&284Tt_bzu8Fhs=cxL&Av|J4j=AU0f4 zjM}sxxq~UF!*VE&G#`FV@ghxPY*neMXvj*Vd7$K(h(U{?`f-V(iMq-nyqjf)xT$Rl z$91?^Sd~Y1xuAkrJbY|G9cnR=)0~TWq(sWL64um!8n3MSo;x#&gmass4JgCeX6*P> z@y|6mNrf |Ao#P_U9I+51U}x295gJt~U8$w}v)HznVe@WR;g5zd^3( z8YhDks#4OoN6UI^YLBB$t+}*v;7_Llj&`z{H7ZX(I$vxVAZyXT `!vy{aBO9 z3SBz^m3@O#&33M9@g?e? Pk9@(<;Q zQDs7Vk4l8hj@vf;@}z3R`*D)rA8b!_SROfRWz`*dloS>AKgA}++w;=MP=A6s>%ZX1 zaPd~os+|Xr`*xDWgcR3^WO{b7=eu*|W>q7V=nZWzd(i#2Ar-VazO2eT>mR9of zXdmjFvBeHCNuvf2wXTWBC}xm`__&xrG9s6vpd7s__3Kxy4qCt>iJU~S&zaf%7btmX zKkPyo3P}*NJ>c@PH>jPF2M%StbD39u&0PKMTSnjxRdv8$4L_U&UlaBVZ(&xKJ5c04 zp!k6h#2cY4p`8^wpU GWkzMJR9z zLwH;Iq{T`H9dIj#KP7Uf?1jUXdGZ$9BeB0_*VIm}G`Ql=yoj)i;n67C6dBp?Hi@9i zJ;6&4;e>@XwmR14GwTvp{6pkoOk#|W Ah9 Env5`apqmo}`RUVxIxd}Y8Z zY3R6 )*sDS*HM7rI7;!`|SuFM1$;#I_Fm6>;6*%J4Z{(ZAzBm|UlF6FjxCis2= zdqeQGX4%dM_wmI1U jK!F@EBI4p%GVjf|E{n*?n1)uwoM(%r(>DB(`t-z+G5bUglUM zKV3qe1?bt6sK2?^+2(F=?arIrH%kzq0I{5a1BzdnxmuipI+m*Wurnq|}C#)4YnE zSXlZU6euZDzdo@3pD7xtek(wk0H-E3H*syoF3j66mKVrdJR+VyL>kto!$x1%R)-pp z*9YsPjjwsq<#pBVq%3h8*O{Xc*9yx#+&{Zv-7Or2ZLR75Q3{&u2CHLYPY{PSB3PV` ze9!_p*lTC}ks&PuRn1_OYrc5S(C`x`o%V~4Oswi$K95G;i zgDROj>Qq3#Fd)I^;V8T!%xBJp?1YI@9g^X<^@Z3^0q-1qBp#}^g}Qj3ff1J>R_V-C zkAZ95yrH$zwC%y~tHys~=2L&veg5(;aDCnv6$QgE4pifo4}YVi=J1x&^Yrm z4~AXOSTZpY>!znlEEGT%jW$tJT5H~Y6pbni*Z#&Db@O=f2xr1(Hb2sMS>G6$5lyo? z9JWSY%EpN9txjd#cIpk<-y$~Kbb7CSyE@&Hy1x3>2}HxL! F?`9%vIy=ioVi#7-TjIgTio7xl9B04=ZJ$8 zY2KqdjjDQRv;})|uh>0}y5SA2fN&`)I*IfCN;#K%XHOifeSP-v`y9|{vDi3_bfZjK zRv!4l$HvzmbStW8#~2F(wJ^I1vFEU*-=2Bz8jEL^5TUEycuksov0VbVtBs!RkHM@& z8x{UC15_3YNrhShtC53i#{~^x`Xj|6F^to(*@tpVK4dK&9KD*vr_HPI8ru2AEaj2j zw?z} _T19vYhvx9GYjWsR5R=sV?hL6K7}Y6a9vJ zn?}2cdN%(1CAfITi% bmIBj$QgeAA+$PaMQnR#37WNJ8 z_H>Fp`XR8<{+4yVZGR&>v#k9Tb6$2FR(Y;EL3chqhgNWOz52V)Oa4>!zgz`O47@jW zt?Uqm{%-NdW~?3mMW`MJ{HrDuu?}d@tES?>MnOh@{g>)v0GYdYaLgR(-O&^1gq7qf zMxDnwJ{=9VHI&|eemmg|7f(usKJiV`@V%^V{cH-|=f#1oOopkzDx^DVs5G5ysVuHH zKU2J5m|^b0sX?&Ib<-=a1*cb`tvu2nhs@;*(~DjjA8MufFNeA{+Oo2bwJiQi@Bzom z4BbfT)*x)-tJU%UYZ0g{?*CW>8gi_{m0eqVG+A~{`fRxxU_ZStWt7aqr*by>F!6HY z>(+^LV7zHfA2fPkFSnwrxm_Fhk(!7wG{|_hC6oUZ`%jIv^wW@)@L&-%&OD*xn_cbl zhz;fOAY`^`@G*h*CcEx0-1xlH(2!}mmHi_)Bs8M|&0X=B>~1AN)t0mA74a~x4K|!8 z>e4)E(51n(;S30;65{0WUez$VG+rG0pw_ 9tR@nz5I zjrEDIdifkNN3wPbJLKR+pDG@nNc5Agvj1!AwCGkrcM%PkmYB22gcZ7V{IQ8r>uN7M zxaOu17a$VF89X%;FD~Z!p%FdUPxK5iM~Jp;!yQJ#BdFte2ZHX4^O>N+-}sz9P;4d^ zCFn#f0XCRMGdqM4=KXAcj}xFx1+Q|hrV+OCQJp1!|doZs=kuLIS$|9{kherFFj z&@??ipAz{n7b}AD#m0r(2}; iC(LBcpCii~-^ic7-x8$_@>8k!%LiXUw zD#&Tx;WoSuNKL)<8o!~6@tn;6Qw>NMUO2iM;eM>>(JAtY;Ldjw6$5)(pdsSh1g4Vy z{o477CUn{Hga~cp3}exPj`;V|6hcDHFVCn8M|tnvjl1W{Tl8TlV%L&$3)R(+i_nh& zr}H{a=bMNh)?o9_5Zg3H*Rw4Q#+$zsl-GbKKIkBXOf9A9MLV%PyiXGwskxV(vdh9> zBR0uLG}#0d3#_nx6D88b-QrIMyl`&4BF3;!1uRW}b>N_8sd?s}X?}5pYMVbo8OUW# z;1@lTJUQV8CQnilpA)wpR+bS>wffZMo8097SE7cg_Q}-!A`ptLSz4n43a)HkyG3^8 z32AtHW@owCia~;$OSXZBQ*~aJxG4w^RKd?0WYl`-accRwi48}^_lH3Qythm;|9?^b zNi734 (HH-^=6(S2i~oij<2$sJW4w~YURbs06-q-`_~T6? zAT_#^OA*Eq_S4TMp}aKo0w!L-4=s|d1y1U!MxC4hLHgaMp(lq-S@1=3%&(ty>1C70 zZC3)r-HP7x0~H7L7NE2+0jl@Z`#NI(^>0<#Rr$+v;p&wHxmYWDx#arI@{3N7OY6`% z&5j~Yu4r#kr-hI20JN;Nn6-c|_EK9hEmb9E`$MU0Fy9m~SK0NMR2Q`6mbCB=hc#F5 zWVC~j^QH~-2$4JW;*+ymdd^~qEz!{{@-8VoXU8zTR{87{z)XJx0%nr%e4NpL|3Omr zk8PgoInuA-O?(kzJ23nIw07pvZ0GAA&$ONDR4uJ3U8w4&l&Vr|!<0c$R8y3o)5TUx zP=X}r6je2tmL`^xDz)!Xp%SXbzVDI{TNM#&5KHm aW4XqK_1lv+@4Ksy8nceLy_ zIHinf)V2lG46kq&V}M8+$KA`
wskU8_?9KJb3hU=4O^5s |?q}ns#ql(De1Y3NVV@ zO1jxUJXG!aXd^K$EN$w!9?kHKrpn#+)F(g{!?7tpeC@XGr5s&|Ja6lpA@6+t-pwAk zHQuHEth0ZVMALZ9Fx=WHFh=C>l8^~9FRnc~EYX`@kmtPO(=nnc(wHfLo_awsl|`tS z82;oI rybMM1vP!eee%0Cb#@k^e@xL6S1p%BOgUIP z8v`Q@I@Gvd6f$yATYaRSmKLMuOa~sW76a=>Y6f5WJ0i0wtf@3hNNv2vz;6mV8Zla$ z)#KuEw 0*PE2xg(ikSy~6W9n_@W zbEh^k*Ib~{*)ldkyL;m(3W-_lSU+wA95KD7Y}*kj5{}L^^^uE3jl_vGkNS?#y!GBP zukpBabr|_j&ga&tu8~17pZJr)F~5TR&pa%O4_n8dZ`t2`>MAQ~I$=sq_59+^w?Wu= zYT< >?_S*nZ3BPb$$H1BszT#Ncl)_#l!z7w0`4OTw%?>sUa?YH zH~;sT7N{tDB9)ZF!;z##|1AC&L1;S``De<#6r$aEpY^h?wE*@;uJr~!)twb@G8&hI z%IGZT&kT%_+Al(m;mN+0<2l@}Yf|tewkb4x!}%5tT992!JbVDR&IJSl)VX9%?^V&c zunzQIF*?28J bX|-7BSvgozgM2RtWlAT&KJE({coeU41qKpTur znM(yZOh`D!$Mb3KK+iPYog`$?RbFP^K}X(*>bcL?um3ki2%3((*yPi;;(cEgy1Eus zFIkb%Sa`D^l}Uec9U1v674Ap9F ALDJz2B$a zaoK0Qr4(x;CuQIP6U~e}Hb5su=3iApgc|U?C4Er%m&VBpp{pH5=~}mK63gJx2Z)LA z&5?Id#RNqRPINi%7aFji`JrJ5`h$0c4u}u^*KTUmcI)P+cEVp2EZEX^pUs`9;3(HT zcZ-ZO;t-$(d$3yjAC{IT8zk?5wr)vXXxN3!$6K;ceS#cu{XtuPJJYV~VMYP+xGI*U z&+O|(nmfNkq2_ZMYT>a8S(z47kD&T#^+$E87++dK4W$&AfB7#A+@?tXLKiHPjBQ*q zeM|Z!9@qqgj!t7oJMf3r|IqI*r-;b-Xv$?m6@6qKGgI7$sui4YW+e>`{kPJ2*3*h7 zgKd*?O1`N=tBYC#^Gz1d_4Q|^1sBZ+GDyIDBx|C{x{F9GlW^|c1B4+@i+$*~wn@(5 zA`b?6A{QiWuirE|*%D-1kc=QNPD5q+3BELLxS{%m7Yz0Q0#W ~caK z+U-WNK;P9r9U-}L$#JJcOKbtZ@0wH!&r8ekWMEo@=L=@tl43;ir?ii3Sj_+`A=Z6W z0YdrOjs+sL_5gCbUBbdaU8NN+w@S!}N@k}YP3$WFftHZoY#7pD5u>1Kvy@q~f%67_ zhnS!|=)Ko(cnC)tj^dvAo|$nn^Ut_ta1E_sPFT1!ShlF&5Tq_4l^Is=cQUPq&1~;6 zvZE6TVG25%=8Dd*p^oX({AT3!th>{YQ(tYeH%e~j{UbJAa{iF=LII5q^U!GRNevTu zQP(<8HKE^7u#sl0)bn-(V{6EUnDM{Hvvk{L_-SXkMX})d-eBy2cv`fcPvo#7I((R1`S4e-U?XA;!Q+{snao#agMs|Z8Ar=Tbx_{Rk5~mQD*G( zO0D_Kdc&Hl_1!Cup39*09pnyE-iz0dsiOJ4VE;+bHP~vBJfr;vM{L}ReK19q*q-*m{mS(ts` z$lK2kCE|Qd%e(K1D|o2teyy6;Ak&kfVMQ9gCwGoXL5c&>AMZ%k`n{xjXJ=r3N5&*f zNQ}C(v6)~(L2sTn45NCu0`FQM*0a>-O`o;$qh_jX6z=xxM#1vqP-Beb)GWoD79@)3 zUtO>S?8aTAbfP%Kq=wVXJ!tfHzcIq)*-EFwAn;Cabwi%7wppsEbPhbUR~0-u5p#L| zffC$|AtE9Y*BE|o?SeG>Kg&bFoMErBSoj|J%lUp&xX;d{FTfId7|eH>kghl204*(z zQ)j=KU~l^ezepFkLh E%#)Y}>%jl%c+sk|^km|0^gViuFj>;zP$uMgb zR9;(kY{ra=pnbhUAIb4ch?Z}659q +Y1>K$NZA)0cpQV6Yx7r6*#|(FbIL1i6&i1Y7jPI z|1n%w^aJE-=0vAg{hs4tAblN?8#+My)+YwZ*Uq{8OWzYIsgK`H|NnJF_kS_X`+s|> zQon%T`j=sKEA@zPqrbnY=+XqNOVMZg{&E5nU!|dy`e#Krff|5eBgy%T$`XWa%i@P4 z|1?+peQ%W>f8SN%ith I8P6k%e|g0}JTezE`)%AesQ2)mwxeZk1?B6@p?m`_ z$aK&{;XH~;Hke+UE2{)E#d5bfYRK}1i_PBb #nek zl@^!A{rhT4GRIk9S8i+;NWHL0)}$uPQY#$1#2yzFpA5W}h}znyXsvLPwenp2jHQ2( zB57qYZjCTdF1*)`QQyZN%aQsrHIpO#N_FG;h`$>{&(YN*)y-#SXnEfL6S_{73jnWH zS(W-=d^x-SeQW7F-@t7PQWsn#$NJCJnMD^hZ&oKWWCk<08ZVB zgV?(3`ikFjeTbv_p(ejg_p?G;c>m$L)Xmw57N`Kg6lerCsN#iiRg^YDTd_NRHzxM=Sh!Y<3Q|MZF(vk zpg!97dffOE45JGgyo-1;Jk0weXVw{9A_;IIQ~$N@pw*DIBNeNF#hB;CsIMfB je7k!!9BN^nO&oo#Tg%5M{%mSv9z zXaU&UZVq5#$Ns{{O8|QkOnxl_o{E 0gfLqVkvv7FfQy*dDZfXX$C5*Fks$Bmp3Xh2~Sh0ZFwp1LV&O z%sO;(aD1LRKxfE3wH)4MHzPd)19%X>vr6ZJ%K)6E|0uG^luIPtB%NjJwKPFF$ob^^ zhbM5JV30AGm-&;O;Fcfx!x0WI=pi9&dZ@(Kt5j&I(z-S0(qm+AWaW&j6>o15+Pz4@ z!o&GV%+Ku@Q>(GXqA#Ds)a`1Ayn01FlAGUd9PMv=< a?h|qz_ztod`?bJQaD1C aI*`Y?JFEXEp-nZQ2wRZVX3ctoanV|JryRB*ZimE9h(kqGFtqQ_h1b~|M z)vQJBWKQ+?uMqmJ4x6!pR`YAMnh&I|kjzwOnvF3szLs?Cd*^}8>#bPs4X*fX#Y)(f zLl~)I*Vk$E1CGPe CMD`6W#t|#Wz`kG zqcFxO`CB4&x@>u&gZO*lkM#quH;ye$(hy<0Y3y*T8aqn_SHI5tmnyhbBW$Rj`F7NQ z?E!#sE=azXI_`XM4-wu;8eJKn-+sE$FjS#6;a=p^`%_P)%|V~OT#d9<;mw;!C0%?# zs5+nnoExhg{lkk2o9`)ZxoXCkAkoIa+f_(E53E5AiD D66RJ$C-HoB{Uam8kM#`(RH?eUEwQvX%Er&mVSU!|H@>QemfO+`N27Q0pK5B6PBv zT}#Cm@lrwpHX>EgmjueLZr@K;%=(=Xm)_q&+nxRO-rMdpB07FnwX$k3+ahU$$f3rc zWCtRMTAEL*pYglTp79czX_=muI|3OX=O|CGvf1>F_Q7H1njJn}{RG|Ltlj$0^6>D- zM`e#_=&RSz)z_}Eeq6cP2c@NYP{M=oFA`+cI^3hM>~Z!o*ABqF278^ObfhVeFFa^{ zXccS=-o7sc7s@|ebgNZjk_;Uh3*;9SeW>!@QXx-~TCUl(6$UOCwPLv*P2tbcd2^km zo&3*W^uLG?JBTeAGA)GO(7y&8`e7HZqy4YDnBbna&`e;)pVx5<+ce>I^Tg0stT$T} z)nflJuCkj?_m--1k6Q4-ZC>e(T k zF0h?%3-C&(e7HQp%20`r-(XX99xvs=9Ctal@rG-cYp15n?9+ntN{l+O?0XN_xv|G5 z9F~;l%Qqb~_ZTC%bdFk0$N?x*h2FBx5Z^~@R`y^0gTM1@O#b1q{pnHHT6x2}X#n8) zst+w}rLVxO4XsaZuy6IA?OZ4wd!>W(6!ECBOIBAVkW*Jo^HSmIcIhmpd)qn37)gnU zrNEXg#LZ+U2XR9g@SAV0BpUQR+gc+bT m_d^?vi%uS_aUB>L-bBsg>lKU<(`rTD6=lJ_ER3I`{y^J8_O-LL+!&~^PhNP z*&$0G?WgfqiZ4?OvWbRYUJ4*y^+n%SV$V*Eh~mV^?!&a(w=cJBN5}9z97LE?(%OfT zL8lRSfI%Fy#tcW`Ne?|)lX&v{VdYuu&c$`}Iqd}}Uqp##_U{-Oa}JY>`zwqHaH^0a z;1GS~4uK^gsQCTLJMkQhHe<84srs ?7md3|fMvEZFqgdaDLxp{l5-upb^SD+ z;JQ~q;h=_!*YtBSQ+&BDQqq2Gyb#`Zz8NO-%71wIBZtoR6sy~?@=)xJT)WPgk5*`c zTSO`Me&Lq^v(+}rQUlSO6F5bqT g!5OISu56GVJW7_Mrz zokM6ZrnRx=>O&L_c>xEKLnr~p4m&yu(Ms!o*&y~6R>(;$rF6EO9v6%X4=4kmT>#=M4Hu;P>@9+-*Qg=_U$(d$ z>OUJIKJ&_Yy-D=grnluLSYr49h^?nGLHOjP>pF$A87v}aGaB6eC#VfVLM`9J^sXbg zQOvS^z=f!q=Hr&ftdGzyc-=m nEB!gcTfaAE*4p{H0_SVTnH)G=1+*goD9o@D@z6^sM_!1b+Vm-9pS>g +va}`;{9hAGOV!UK_KF2w zmhnZr$7GeBnt}ZTq5bVIwfJdJk*qIPvE*9Tr*P`1b%J|9v1MY;3H^Dspsfx1_I$Z% bev{9sxHe;#e{llmu - - - Linux WPA Supplicant (IEEE 802.1X, WPA, WPA2, RSN, IEEE 802.11i) - - - - - - -Linux WPA/WPA2/IEEE 802.1X Supplicant
- -wpa_supplicant is a WPA Supplicant for Linux, BSD, Mac OS X, and -Windows with -support for WPA and WPA2 (IEEE 802.11i / RSN). It is suitable for both -desktop/laptop computers and embedded systems. Supplicant is the IEEE -802.1X/WPA component that is used in the client stations. It -implements key negotiation with a WPA Authenticator and it controls -the roaming and IEEE 802.11 authentication/association of the wlan -driver.
- -wpa_supplicant is designed to be a "daemon" program that runs in the -background and acts as the backend component controlling the wireless -connection. wpa_supplicant supports separate frontend programs and a -text-based frontend (wpa_cli) and a GUI (wpa_gui) are included with -wpa_supplicant.
- -wpa_supplicant uses a flexible build configuration that can be used -to select which features are included. This allows minimal code size -(from ca. 50 kB binary for WPA/WPA2-Personal and 130 kB binary for -WPA/WPA2-Enterprise without debugging code to 450 kB with most -features and full debugging support; these example sizes are from a -build for x86 target).
- - -Supported WPA/IEEE 802.11i features
- --
- -- WPA-PSK ("WPA-Personal")
-- WPA with EAP (e.g., with RADIUS authentication server) ("WPA-Enterprise")
-- key management for CCMP, TKIP, WEP104, WEP40
-- WPA and full IEEE 802.11i/RSN/WPA2
-- RSN: PMKSA caching, pre-authentication
-- IEEE 802.11r
-- IEEE 802.11w
-- Wi-Fi Protected Setup (WPS)
-Supported EAP methods (IEEE 802.1X Supplicant)
- --
- -- EAP-TLS
-- EAP-PEAP/MSCHAPv2 (both PEAPv0 and PEAPv1)
-- EAP-PEAP/TLS (both PEAPv0 and PEAPv1)
-- EAP-PEAP/GTC (both PEAPv0 and PEAPv1)
-- EAP-PEAP/OTP (both PEAPv0 and PEAPv1)
-- EAP-PEAP/MD5-Challenge (both PEAPv0 and PEAPv1)
-- EAP-TTLS/EAP-MD5-Challenge
-- EAP-TTLS/EAP-GTC
-- EAP-TTLS/EAP-OTP
-- EAP-TTLS/EAP-MSCHAPv2
-- EAP-TTLS/EAP-TLS
-- EAP-TTLS/MSCHAPv2
-- EAP-TTLS/MSCHAP
-- EAP-TTLS/PAP
-- EAP-TTLS/CHAP
-- EAP-SIM
-- EAP-AKA
-- EAP-AKA'
-- EAP-PSK
-- EAP-FAST
-- EAP-PAX
-- EAP-SAKE
-- EAP-IKEv2
-- EAP-GPSK
-- LEAP (note: requires special support from the driver)
-Following methods are also supported, but since they do not generate keying -material, they cannot be used with WPA or IEEE 802.1X WEP keying.
- --
- -- EAP-MD5-Challenge
-- EAP-MSCHAPv2
-- EAP-GTC
-- EAP-OTP
-- EAP-TNC (Trusted Network Connect; TNCC, IF-IMC, IF-T, IF-TNCCS)
-More information about EAP methods and interoperability testing is -available in eap_testing.txt.
- - -Supported TLS/crypto libraries
- --
- -- OpenSSL (default)
-- GnuTLS
-Internal TLS/crypto implementation (optional)
- --
- -- can be used in place of an external TLS/crypto library
-- TLSv1
-- X.509 certificate processing
-- PKCS #1
-- ASN.1
-- RSA
-- bignum
-- minimal size (ca. 50 kB binary, parts of which are already needed for WPA; - TLSv1/X.509/ASN.1/RSA/bignum parts are about 25 kB on x86)
-Supported wireless cards/drivers
- --
- -- Linux drivers that support nl80211/cfg80211 (most new drivers)
-- Linux drivers that support Linux Wireless Extensions v19 or newer with -WPA/WPA2 extensions
-- Host AP driver for Prism2/2.5/3 (WPA and WPA2)
-- Linuxant DriverLoader with Windows NDIS driver supporting WPA/WPA2
-- Agere Systems Inc. Linux Driver (Hermes-I/Hermes-II chipset) (WPA, but not WPA2)
-- madwifi (Atheros ar521x)
-- ATMEL AT76C5XXx
-- Linux ndiswrapper
-- Broadcom wl.o driver
-- Intel ipw2100
-- Intel ipw2200
-- Wired Ethernet drivers
-- BSD net80211 layer (e.g., Atheros driver) (FreeBSD 6-CURRENT and NetBSD current)
-- Windows NDIS drivers (Windows; at least XP and 2000, others not tested)
-wpa_supplicant was designed to be portable for different drivers and -operating systems. Hopefully, support for more wlan cards and OSes will be -added in the future. See developers' documentation -for more information about the design of wpa_supplicant and porting to -other drivers.
- -Download
- --wpa_supplicant
- -
-Copyright (c) 2003-2011, Jouni Malinen <j@w1.fi> -and contributors. --This program is free software; you can redistribute it and/or modify -it under the terms of the GNU General Public License version 2 as -published by the Free Software Foundation. See -COPYING -for more details. -
- -Alternatively, this software may be distributed, used, and modified -under the terms of BSD license. See README -for more details.
- --Please see -README -for the current documentation.
- - -
-README-Windows.txt -has some more information about the Windows port of wpa_supplicant.-
- -- Release graph
-- Latest stable release: -
-
-- wpa_supplicant-0.7.3.tar.gz (source code for all versions)
-- wpa_supplicant-0.7.3.exe (binary installer for Windows)
-- wpa_supplicant-windows-bin-0.7.3.zip (binaries for Windows)
-- Previous stable release: -
-
- -- wpa_supplicant-0.6.10.tar.gz (source code for all versions)
-- wpa_supplicant-0.6.10.exe (binary installer for Windows)
-- wpa_supplicant-windows-bin-0.6.10.zip (binaries for Windows)
-- wpa_gui-qt433-windows-dll.zip (Qt4 libraries from wpa_gui/Windows)
-- ChangeLog: - -
- Old releases
-- Mailing list
-- New mailing list archives
-- Web interface to GIT repository (0.6.x and newer)
-- Web interface to CVS repository (0.5.x and older)
-- Snapshot releases from all active branches -
- GIT and read-only anonymous CVS access (pserver)
-- Bug and feature request tracking
-- Developers' documentation for wpa_supplicant 0.6.x
-- wpa_gui screenshots
-WPA
- -The original security mechanism of IEEE 802.11 standard was not -designed to be strong and has proven to be insufficient for most -networks that require some kind of security. Task group I (Security) -of IEEE 802.11 working group -has worked to address the flaws of the base standard and in -practice completed its work in May 2004. The IEEE 802.11i amendment to -the IEEE 802.11 standard was approved in June 2004 and published in -July 2004.
- -Wi-Fi Alliance used a draft -version of the IEEE 802.11i work (draft 3.0) to define a subset of the -security enhancements that can be implemented with existing wlan -hardware. This is called Wi-Fi Protected Access (WPA). This has -now become a mandatory component of interoperability testing and -certification done by Wi-Fi Alliance. Wi-Fi has -information -about WPA at its web site.
- -IEEE 802.11 standard defined wired equivalent privacy (WEP) algorithm -for protecting wireless networks. WEP uses RC4 with 40-bit keys, -24-bit initialization vector (IV), and CRC32 to protect against packet -forgery. All these choices have proven to be insufficient: key space is -too small against current attacks, RC4 key scheduling is insufficient -(beginning of the pseudorandom stream should be skipped), IV space is -too small and IV reuse makes attacks easier, there is no replay -protection, and non-keyed authentication does not protect against bit -flipping packet data.
- -WPA is an intermediate solution for the security issues. It uses -Temporal Key Integrity Protocol (TKIP) to replace WEP. TKIP is a -compromise on strong security and possibility to use existing -hardware. It still uses RC4 for the encryption like WEP, but with -per-packet RC4 keys. In addition, it implements replay protection, -keyed packet authentication mechanism (Michael MIC).
- -Keys can be managed using two different mechanisms. WPA can either use -an external authentication server (e.g., RADIUS) and EAP just like -IEEE 802.1X is using or pre-shared keys without need for additional -servers. Wi-Fi calls these "WPA-Enterprise" and "WPA-Personal", -respectively. Both mechanisms will generate a master session key for -the Authenticator (AP) and Supplicant (client station).
- -WPA implements a new key handshake (4-Way Handshake and Group Key -Handshake) for generating and exchanging data encryption keys between -the Authenticator and Supplicant. This handshake is also used to -verify that both Authenticator and Supplicant know the master session -key. These handshakes are identical regardless of the selected key -management mechanism (only the method for generating master session -key changes).
- - -IEEE 802.11i / RSN / WPA2
- -The design for parts of IEEE 802.11i that were not included in WPA -has finished (May 2004) and this amendment to IEEE 802.11 was approved -in June 2004. Wi-Fi Alliance is using the final IEEE 802.11i as a new -version of WPA called WPA2. This included, e.g., support for more -robust encryption algorithm (CCMP: AES in Counter mode with CBC-MAC) -to replace TKIP, optimizations for handoff (reduced number of messages -in initial key handshake, pre-authentication, and PMKSA caching).
- -Using wpa_supplicant
- -Following steps are used when associating with an AP using WPA:
-
-
- -- wpa_supplicant requests the kernel driver to scan neighboring BSSes
-- wpa_supplicant selects a BSS based on its configuration
-- wpa_supplicant requests the kernel driver to associate with the chosen - BSS
-- if WPA-EAP: integrated IEEE 802.1X Supplicant completes EAP - authentication with the authentication server (proxied by the - Authenticator in the AP)
-- If WPA-EAP: master key is received from the IEEE 802.1X Supplicant
-- If WPA-PSK: wpa_supplicant uses PSK as the master session key
-- wpa_supplicant completes WPA 4-Way Handshake and Group Key Handshake - with the Authenticator (AP). WPA2 has integrated the initial Group Key - Handshake into the 4-Way Handshake.
-- wpa_supplicant configures encryption keys for unicast and broadcast
-- normal data packets can be transmitted and received
-Configuration file
- -wpa_supplicant is configured using a text file that lists all accepted -networks and security policies, including pre-shared keys. See -example configuration file, -wpa_supplicant.conf, -for detailed information about the configuration format and supported -fields. In addition, simpler example configurations are available for -plaintext, -static WEP, -IEEE 802.1X with dynamic WEP (EAP-PEAP/MSCHAPv2), -WPA-PSK/TKIP, and -WPA2-EAP/CCMP (EAP-TLS). -In addition, wpa_supplicant can use OpenSSL engine to avoid need for -exposing private keys in the file system. This can be used for EAP-TLS -authentication with smartcards and TPM tokens. -Example configuration for using openCryptoki -shows an example network block and related parameters for EAP-TLS -authentication using PKCS#11 TPM token. -
- -Feedback, comments, mailing list
- --Any comments, reports on success/failure, ideas for further -improvement, feature requests, etc. are welcome at j@w1.fi. -Please note, that I often receive more email than I have time to answer. -Unfortunately, some messages may not get a reply, but I'll try to go -through my mail whenever time permits. -
- -Host AP mailing list can also be used for topics related to -wpa_supplicant. Since this list has a broader audience, your likelihood -of getting responses is higher. This list is recommended for general -questions about wpa_supplicant and its development. In addition, I -will send release notes to it whenever a new version is available. -
- --The mailing list information and web archive is at http://lists.shmoo.com/mailman/listinfo/hostap. -Messages to hostap@shmoo.com will be delivered to the -subscribers. Please note, that due to large number of spam and virus -messages sent to the list address, the list is configured to accept -messages only from subscribed addresses. Messages from unsubscribed addresses -may be accepted manually, but their delivery will be delayed. -
- --If you want to make sure your bug report of feature request does not -get lost, please report it through the bug tracking system as -a new -bug/feature request. -
- -
-- Jouni Malinen - - -Last modified: Sun Feb 27 12:48:48 EET 2011 - -- - diff --git a/www/wpa_supplicant/main.png b/www/wpa_supplicant/main.png deleted file mode 100644 index dfbafd608ad78c700bbc1a09f3b3c86b36be265a..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 20852 zcmb4r1yq!4*ESwKA_}5_(x50ELku~DNJ)!yj&y_4FoZ{tk`U<_5RmR>Na+~5JA|RT zYli(5}zZj|f`%NUO(fXuh@#2sA9*S@?LQ|3~kFO<=3sD}E)v%(-Km z6^vWvB=7KW!OnTx`r_%$K(`|WXLV;+=h0zh5q;jHnUhWB*$YvXm#R)_!R!j1U!F?% z Vr7D}_6Mm8=HN62^r=MF#68g1V#0DsODOc9-{pFl)~tVt=q7N`x7aI{ z4UmsLDkjB?4%t9MA*LLnRiGtVS>ltJZA0`BPn9Gnkcc9Jla((bjj`PK$T=Z+R@hX{ z>oDn&zASOZL5q1{RJ>$qNnhHs1)Bs(P?9@8os5fv3-6bww0~+#k4BdtnpkQ^JE4nC zqS1d0+G&tX!*n2ngf9q1j?hKsGf G+bJVw7&^(Xi^ zyM?i(o9-al>sH{ed28R7Q}>mDLVLVVF1DX;DsirHI}X&B5e3TAG;99uhwuKyq%lTW zGD^drN3uI)dN5F3 !<)9lvr z&!g2E>F*&dJZ^qZT+2|0jvYl0u4eY1M_KRu*u)dGOYYQIE>D9yC*Pr2THY_@jqkW~ z;&po*vBJOYu^s^1DNGSKoa%Jl3{8yIO~Kq44BfwWn%^HAF|sgG^@n#sSZ74e;Y6yR z^~mYvR;=LqZ}P1)1NxbGjMSrASu|DR9?2I5av~WbT+{_r1Tri_gE|r4gy+qm52do? zx1)6PVG@D16V@luvs- ~ NOPnI NtcW_mA({j=b+8snKJxw*| zO474)_3m;p^vx2hsm&~nnCsDr>th&H(C6nB@%8qhasRtC==O|HiiJ;(5i$Kxudf$N z+x*?M#m|yP>Vs02KI zI&e|){p0HcF*VFP{#sZ)(@881#`Q9b=5iAh`h2MEI!BE?SPe6eanw1c(IvS)J#`VC zf=)Gh?KT_xh LeC}B6KIY*!Gc4 zGLwy8eE0?B7bDQ?eaCb~{uyvqM^vk&lvpN%(!DYx&0yfGWI})o((Q~{C8JY$(q8JP z6J2k=nXwm(&)MFvLDbxp(B7Rn pjm_ z;$qjgg=$lbHRVZy?TC_u@^k&q`DW?bfUn?|a~7c0W=;>2GNU}5uPSnr-~aq=rJCH| zi)YYFIDl9})gJ1D3N4q58u*GRWe#pG54qf(z8%4Iw~VQ>0dW|SG{?Qu*vQY`bGf@~ z7Q|AS8{QjMpXg3tuV1QHeRaMm8CjH4BMkPl9@+*3Mx;deL%C*CC}uuyuMPJI{cYFA zu6FVgSvxtkW~sqe!lIx;louA;j2_a6v5sV8h*&ClS4Scl+>lt`XhRMhxjXHz>T!5+ zl #-m6q0X~c*dHZaK*ksyJMB{gNGhq#G{F;9b=sk+R)BeX+wG*&7Y zq25u+rpX0SruG*L;6)Ut=_f%_!IZ1`euF#>m^ D6^0h;J_4>-gzF^XyQ>w(~_PC(ux&$xH<-x$~ zk)ibDT92I)5CnA&haF7q%O2}(L^Af}t)|6rfEt_kT2BoskGfCf;Ns6{S1e|JngsvU z6r0eNT`4cKVy~GHq#r+UVB?JuOz~SufJlC=Vo)qkWN&ywvh1rzyq$YxE4BIb2YO#h z`sK53tc!uHN-|b!dh*vE!ke#FJQp|5Wu-{z)5^K`#a(#fRfoD2tltw&PG@lt672uj z9W4`H7FTLaKEFDa$-q;kRq7Xg)abcfa}K|^DM;IR^rd$Ez!dP%I u& z4Qy3TqOOzKR#{HT@i|rWC-<83c`Qt(v$l+Bqpja}!p7MpkObx=@bu5BDc?DAS0@gB z%0Xf%kQ?i%PmgEzyHZn!!&7RK>e_wIwb=PRrAJRofpgMrg449vVRA=ft-9t&i)8M) z1~iq
kxO7Lq&ooPD@eaF+ z{~1ngACT0r(Ui!b;3XguTXB)NVmivdxw1+m?W1*Cb$z_Oyx?U{l*xn_nKHAGe9L1E zmIF+Tm=frM%MN~}QbKS+j{tQ4fgp5$ FXh>pX~GQxFII4=z5Is`VRyTrYHh2zdElfX?P zct-=LZ{{awPD<@aa
zt&n@>;HkB%w-dWN1-ZH|ZUU)jVZ2qe_p=&@3^6AKtyPCL6g zHk#xEX7r~tYjc?crHNy2@i +tZH z%|lN$cw#I~MF1g3J>2mW#I=RMMTR|VXO75TNnK1sof@wa Kcp_f|zGqlj7U-u zhJro3#$cAJ z6bZ0)+)08~MF@O%EB^trrBpwglI?mIFj)_`R+@xFr0kf28_G(#B2x0N6WBZvDtM0h z(1h&cbv133O&r8*%&zDBvJ0!jp7%TDKSYk|M_l=;>htT($a8l*5iR|HHqMRv?~uE* z$9Nz_>v=#;?jD<41%TqVG!}AbU1;|@H#=jr3mhntkMKBVcZF`Hzz%fYtbUj`dtUTj zU@yI2 DK}YIUfaHg>m| zP2*gb@%USrs?%@-`lwHiJL|h3tvVqG+%-B^KOw2SF+|(EsNxAQa5Z;x)6K+8TgpfB zamHow(6t0&ihTHJp~Icx!%2ge#0=1Scy#mdc~`b+{8-U-Ymk>=JsYyvK-n7w3OZU| z%j+u%NeWMDmp{8WLlHNyX@gQUcXutRP#TV}o^SGhoJ|4=>sRNG)KylT%DXi`A^gBt zs%=+D_y);r*)jZMes^z#kZ`-px`R<)Fo%%fJs^TbW9t3@%AJdBq0_XZu|EBsc++&b zu_{%M0#coV(}6pOaaR?tXZ&R)lO?Xhxu$_>Y4aZIu^smg4{TB{AI5sM#lQVZZO1z; zr+PFC=z#LPD>NwW6>FA(5(@t4rmtKT!D+cWDdX *bp+3AYyFq1i8Tp0>ZBTN}|$nm7h*^p`ylw@^90TTH>$uH-i zdWaD^L=|C7ECRD)nwMMJJGR{U#3@h<7vMO_O5?G!XjClWIAZ$rJ?BvY>IY<+r_L(N z)se`p@d=?nW9j58lWW?_r!p>MyC7;B{)UdO!+V!1&O7Ss1u2kljO317Q?HS=4zqr; z%~yG`u>o}{j})Yx=<(#l*3cX-FhE@p`k;EL;C<|d!+6#rVWmE(uOM~|lfmh;zg#gA zx^JRHPXESf+lD)9O>RoCyU57^B!jsXRwZ6c& 7t(&Ea}^5VvzOgrIHCvHtW zQ>r#Cmw&oH5RULhAYjzp#(#C^&K(`3^SafjXz&f%iW(R BB|6qkS)j{DTfmeKb`wrnY|Y*2=UY$ 2{RuFLi5lsQeS84PGt#EfM{piuJH zXT29ILw)DoN2j`t(1P2s&X^(wQJcq+yHwM5)K6T~QRe(IQ2Mk($(=Bk>pkmXxz&aP z-+iie$*9QriFfd)9VKvFWXw~!3W2W>CAOSPRM8 WW zYt4drQudV;jDBm=Q;` z=FuY0R`OlVi{+o4u5k7?_Y!K+d(*|^X9vtYS5GIKR`9pDta8npzuPE6N!m1BMCpjy zX7ghp#|O(s-26#{h0-~xOnAfGfL;En@^b0;QxJ*1tTn=9XM}KA?sS6?{cWSA%G1C? z@1&OvT7w3ILbR)sdNK@Nu~Oa8u>WS{h}Y>`IejuT*IN|}Dqt&8PYP^5Ax{)JcHnkh zM~GqaRx4HA#~pVIT88H4uL2CBysKAfoJie{R!OsF)~k|r8^Ft+?vj$_f}q`4O6UGJ zDn`4Vb4PY3Kpxqv<6mEy_{eM<>5yl`;sLmX;6nJQLsyauU$inx8O<3z?$8n+;Y{ZW zirdRL>{8$mJufXg )FNPDf=uC<=h7!xu5Np z&?j F5B6FGu*&4A3MikKAlWl3|K<=a*V`*Gk@+On ~bk&vVBXa`TsWaULWaO&ToySrjO$gL!L= z(%^ReIccIa7{H^$5ig&th&o3ygdx_Q#c%-XFrCHx@oYuMT%Eg@;rZ9g=*ZDfrGWKz zW)T+iN{;bR==G0==Eq5VIRFmGJZK^BXrSyOOv! ku9d5XKqArAf9X zJ`$L2wDrn+7hgq}+SM8voZKDm?Z}q39Hru{G8%3U{=~#3_gAJu)#VL 0|8Zw^QhdR-mCJ5|RsD~DJ%=j+aQe6$*zI8kaP zfeJ9=G_A3U9#Ev9WZOTS=%vgYGR9z1d(y!DHCb1gc#AdeVbpNRh4bkdEeGu{D%Bq! zK`T}ldou&IT^K%EG$ZqUt?x~1wdX(FD@KQ+#Cs#Rax1GBCa8TZ7E4%pD0;?MC+@<% z{k?(G{iGCwerNFe=!0)a;Y6oBcLXKLR%oibnVl7Dw5yBB6FgV+049dItfyAe;Hr=Q zRm^S#)zrG{4tzYFE$UP0>&M+Mwd+}|L6@7fl3}SirvqmM8QYt+k>>Th<6C+{>KdSa zWS&ns{bp>Ys>eSkFy+OXo_7q42!r#xm1}4yih`ajRc#oldGR0ObG!aN$$WC13>Np~ zH;cUIpi)hfu*Kk0xxGICz8}- -H6q2Kf=km~=<*aA;BZB*x0$oXWsmIRQ^1$o!CEUc(-2BtX z`t?ZQUZp;1S0zd9{Vw-ZW2}YF5-AGcpP^{9)uu?%f+OJ=f8=H_^`zecPmoaFzlmM_ zv9h3)RzN#Bw<#-gr;|k?VeFi>L1!io;Wb+s<1+>A&@nwU;*6SgoZSiy$4hS)3J@GC z!iYP+JMJyeyms6z|8G)`IC1#dvi$ULVUw}fhsl=R3(ZLz#i)GY2VxCjqh*bytia42 zZJ7c|)@j| mvC$*4G9Kb^X}|3Y|wFS1B)x*pYBQB2Y z?NhW36&YS;Wy~BjUTjYv*`$ugU6O%>T@9DDCng^s%yXXO>ia7teTGul+qO`#5_{Tw zVN20O3%Y2A|DLRXrm3a1y*CHIv&f*pSMhk<4=2(eU_i%IrqXwB?5rWE#>jcaI&KnY ziJ!<1Gm8N8`?qm8lbK3QAlHpHC>e)xwF)Mb9`8q^*4Di95`|GCNXOl%|0X r_ z0?gJ<_qF4yVTDeCMjk4>@l5gfgB#M
*iaj0=xq-1PQj;M0Dg{>nA=#BAQuX4gHUhbf7soutJLd$-yPs09#bMdgT zJ}Dtz0$WSM8Av%RkchN68n`n&*U)IQ`o8PeR K>oglERcrldBp*!(lls0Ur!yE7rD7@_|Gw7 A*&XB00k%gUxO OfB4=8cW|HBLo`Y_ zi76t|G;KQGD6uMIUe{8XUC8pi{}v#cOQU(yqdcu;2qNk_o?n6w>*W&&mO_?X&*4p} zI~i)Q8DfzH9pC%FsnCh~ NyT0MX?S4q z4du@h+{bV~f=60QnxzP?h|(|1RJRMUSI}zTngQ+@EdtgGxGm}K20SA-l{U#IW(5_N zM1U63=zZzB nH|2|!jRJQH+(@XE|bfHe-+?OPk^-iIk$PIi}6() zq`$cQ5CVU@DZrCC6XI6dRnnlo`mBarj}fS=5;zD4r_8uth0w1e8BTg12&Vg+3NuA1 zs=LYrSITt&r+L{di8pZvvcz!ON+zmTacA(omGJXh;pdm+B4`trG@gf1Yn@6N{!i zB?M?DY?&7gDnmSAbFI`9^!M-N)$= I?(Ad_A_ijO+6IaTiQA7NR4+1OkG+}eEvG;k&_XlD94)FpwrU6( zi@n~Ai8x4hSz~Ez>&2$b!?(pf9!f19=Z3~2Ez%+LB?irF*f1m5z^!~#?D=4P0;snj z!ZLpjANm;bH_RMli$7PWkWh-0_?)`0^z+uG@k=YGq_umH&1uowdc2;!yN-W$Kz_ zE=Li?dMB=7a~|$NlU!4+vbNc|@#((BV>O1&ddrExAP+Vy#w5(u<2${lB-S%5V&E0$ zd4}S2-v;9K7tNSqhz#$^$xh(65$OQmq9m*I+bW2^@B3M9Jxa7r_8~)m9}UE<&i$}p zHRi-@wE?|-Z@PH~Filh8YFo;#nSCA|B_upfe&ws6sTwlc`owK%Dk4WYS)eHSaHZ~Y zq+T}+(PH_LcRTAA&WGx<`qJY9c=Y~cP)d03MVH~h{$@P6egC>m& GdzqPLA zbE~gvw^c4R;A7qqp3yIToFMi*)F4Irx1`URI)So~yDcYjZ=+?I__osS){)x$^rgFn z+H9^DisX=tqOmK1lbC;dc|Q8DnJf%fl`@^Gu2BDTmhn1J9|d?T=)H#MYbQFydwy?) zPM(}zF>WV?jRkO1N4F(~xh=|ga~RxDYx(82<(Ew8@ZPnSivfu8*!w)mTiBV)oqdA8 z !`+>1E*vf}oIB)#F~x5AF|Dsz<7--p^tI4rGQ;4nUd4~U z=gnh^&z5Ghl*GI@91e6gB1fc-sgR`xqA|nZJl`arbWC4MKQQl<#CBHt&x;L2HDcH$ zbjoi0dJG0W%Ov!%fKHp@Gi2}KVgtYD_3n53xoMc!Nm$cj2t`R)Dju;a5moA&+8bX% zi~<=@kH+x!mMBU+xid#{{P4ajh}gvllRjoL+$983_pO3hB0WrKbAU<6Ua39hWM2qO zwK>Q1j9};q@T&;19Ao5XIEWlhRMnkSjN$nVeDpTg P6VpZsE`~JQ*0e^;`2RpItkOE=`(~+Y^9|E395_MV` zHsk9`)6QO-BIjY7Kf7kuHizvoGKM>(NzotO+trYk=G26t zo>5nP3#X4if?xS!e^rJ_R>o7n+dbHx1dTYT54V_Ly&&4%#nEeMREFL9>U7vArj7w- zx)E;seNIBP sO|41l{2ra#m+m>4IlaQ~7n!O&R-v;5`>pLf&qqE*Tawn^P3#b*ge zCpJ>gzwY4Dg{`Nr30vWJ3W48#sXn?oy*?Q_1c_7?Th9zSOiijKYo@>7@-kH$t)PNg z=uEcZ0T{+@jB#8U#hAsPC5E)S=$d6qX*46EpMH?ZMD$R7tF&v7r_!)!+srWw`cQiP zpx>a*{k_SHvD6#B;w;z8gu~r-m1lA)#Q=&>QFrz2OQP10YJGGch-c;Ur!f7KrfMH| z7P-Obg#3`)nlek2c@gQS7|Ool^C7`aIy0EyUl 38rTSU zL^wQ|MWY@zEN%eNI{Ep6(2Go@@b-~~6vpEu%(ZN$l!PQ7Ku_^1$BQ9pjz`b0QS_LY zlR^;Nc4)uSm2iR6m^tl|v&D<+FSAJ)PY0FpOtF5u6{YL7;d9r!hm^#Lhkbp8LC+&% zREN5fjMpCQGtLYtDFal8i^oTri#r~_u#$<0Ph78uX5qNRkHRU>BvvCpCyiz|ljR zJeR~T2lC;*R?-pNw_!=qzM85vF3a^6PT$Ba{62brf*gQ|)C^(>Zx%7c)etTvD-xi2 zfvEI(D&XS*34=)|JZ6@IK=UTIj!L7R2$t-zq(@un#Oo!Uoi7`i?YoMSC8`5drVd9z zl80clrZa}9@_l$?_F3Bi{;a!2{3r{=_8^jyxb5IP1%JwX`kN}%L~~5~!-`pvt%_1a zY{mFVsU+&nBpWRmKPEh2lMkTz_B^ssi&ihfHAYf2l?&MCQp0jDUKv0jUp1Y#^K+~0 zyE&^2rs9f2wpIYdf>K%UO&lkU0Z|75Vyuc_jPA~4@;?{oue~HX8VDF)`gNgx&G63n zw+=T0awGtRt$H}{?oO6v%Wn{j`6L3a;j4(&5HyGs0e5U<5$ Mg?+4S~^1(N6Dj*t<)wV@DsW^j_)`5Pk}D6^d6>*cmA*9_rVS7bTUx;ix>V> ziY_`Ng||%rh#F kN19rWP}P*WAAus{IQsVqohIpkqX1i&H!RCT`PBOsFkR1 {k7~B02(L-Qfo)iPw zx8aWMPI1$y^(cP%VTCF$8McL#kocA3R {r=U#p&J{ZuSebFbkxS4pUV|RwHqI14MX