owncloud / client

🖥️ Desktop Syncing Client for ownCloud
GNU General Public License v2.0
1.4k stars 664 forks source link

[Wizard] Token endpoint with self-signed certificate doesn't raise TLS error and accept page #10102

Open michaelstingl opened 2 years ago

michaelstingl commented 2 years ago

Pre-submission Checks

Describe the bug

While debugging some stuff using mitmproxy, I encountered an issue where the host from the ownCloud instance is different from the token endpoint. (Keycloak IdP in this case)

Expected behavior

ownCloud desktop sync client should raise a new TLS error and accept window for the new host.

Steps to reproduce the issue

  1. Connect 3.0-daily to ocis.ocis-keycloak.latest.owncloud.works
  2. Enter credentials einstein:relativity

Screenshots

tls1 tls2
ocis.ocis-keycloak.latest.owncloud.works keycloak.ocis-keycloak.latest.owncloud.works

Logs

09-12 15:42:03:102 [ info sync.httplogger ]:    "13e2c69e-dbae-4664-94b5-8b2825fc5758: Request: GET https://ocis.ocis-keycloak.latest.owncloud.works/.well-known/openid-configuration Header: { User-Agent: Mozilla/5.0 (Macintosh) mirall/3.0.0.8522-daily20220912 (testpilotcloud, osx-21.6.0 ClientArchitecture: x86_64 OsArchitecture: x86_64), Accept: */*, X-Request-ID: 13e2c69e-dbae-4664-94b5-8b2825fc5758, Original-Request-ID: 13e2c69e-dbae-4664-94b5-8b2825fc5758, } Data: []"
09-12 15:42:03:102 [ debug setupwizard.controller ] [ OCC::Wizard::SetupWizardController::changeStateTo ]:  Current wizard state: OCC::Wizard::SetupWizardState::CredentialsState
09-12 15:42:03:109 [ warning default ]: setActivationPolicy 0 failed
09-12 15:42:03:189 [ info sync.httplogger ]:    "13e2c69e-dbae-4664-94b5-8b2825fc5758: Response: GET 200 () https://ocis.ocis-keycloak.latest.owncloud.works/.well-known/openid-configuration Header: { Cache-Control: no-cache, must-revalidate, no-transform, no-store, Content-Length: 6537, Content-Type: application/json, Date: Mon, 12 Sep 2022 13:42:03 GMT, Referrer-Policy: no-referrer, Strict-Transport-Security: max-age=31536000; includeSubDomains, X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, X-Xss-Protection: 1; mode=block, } Data: [{\"issuer\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS\",\"authorization_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/auth\",\"token_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/token\",\"introspection_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/token/introspect\",\"userinfo_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/userinfo\",\"end_session_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/logout\",\"frontchannel_logout_session_supported\":true,\"frontchannel_logout_supported\":true,\"jwks_uri\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/certs\",\"check_session_iframe\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/login-status-iframe.html\",\"grant_types_supported\":[\"authorization_code\",\"implicit\",\"refresh_token\",\"password\",\"client_credentials\",\"urn:ietf:params:oauth:grant-type:device_code\",\"urn:openid:params:grant-type:ciba\"],\"acr_values_supported\":[\"0\",\"1\"],\"response_types_supported\":[\"code\",\"none\",\"id_token\",\"token\",\"id_token token\",\"code id_token\",\"code token\",\"code id_token token\"],\"subject_types_supported\":[\"public\",\"pairwise\"],\"id_token_signing_alg_values_supported\":[\"PS384\",\"ES384\",\"RS384\",\"HS256\",\"HS512\",\"ES256\",\"RS256\",\"HS384\",\"ES512\",\"PS256\",\"PS512\",\"RS512\"],\"id_token_encryption_alg_values_supported\":[\"RSA-OAEP\",\"RSA-OAEP-256\",\"RSA1_5\"],\"id_token_encryption_enc_values_supported\":[\"A256GCM\",\"A192GCM\",\"A128GCM\",\"A128CBC-HS256\",\"A192CBC-HS384\",\"A256CBC-HS512\"],\"userinfo_signing_alg_values_supported\":[\"PS384\",\"ES384\",\"RS384\",\"HS256\",\"HS512\",\"ES256\",\"RS256\",\"HS384\",\"ES512\",\"PS256\",\"PS512\",\"RS512\",\"none\"],\"userinfo_encryption_alg_values_supported\":[\"RSA-OAEP\",\"RSA-OAEP-256\",\"RSA1_5\"],\"userinfo_encryption_enc_values_supported\":[\"A256GCM\",\"A192GCM\",\"A128GCM\",\"A128CBC-HS256\",\"A192CBC-HS384\",\"A256CBC-HS512\"],\"request_object_signing_alg_values_supported\":[\"PS384\",\"ES384\",\"RS384\",\"HS256\",\"HS512\",\"ES256\",\"RS256\",\"HS384\",\"ES512\",\"PS256\",\"PS512\",\"RS512\",\"none\"],\"request_object_encryption_alg_values_supported\":[\"RSA-OAEP\",\"RSA-OAEP-256\",\"RSA1_5\"],\"request_object_encryption_enc_values_supported\":[\"A256GCM\",\"A192GCM\",\"A128GCM\",\"A128CBC-HS256\",\"A192CBC-HS384\",\"A256CBC-HS512\"],\"response_modes_supported\":[\"query\",\"fragment\",\"form_post\",\"query.jwt\",\"fragment.jwt\",\"form_post.jwt\",\"jwt\"],\"registration_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/clients-registrations/openid-connect\",\"token_endpoint_auth_methods_supported\":[\"private_key_jwt\",\"client_secret_basic\",\"client_secret_post\",\"tls_client_auth\",\"client_secret_jwt\"],\"token_endpoint_auth_signing_alg_values_supported\":[\"PS384\",\"ES384\",\"RS384\",\"HS256\",\"HS512\",\"ES256\",\"RS256\",\"HS384\",\"ES512\",\"PS256\",\"PS512\",\"RS512\"],\"introspection_endpoint_auth_methods_supported\":[\"private_key_jwt\",\"client_secret_basic\",\"client_secret_post\",\"tls_client_auth\",\"client_secret_jwt\"],\"introspection_endpoint_auth_signing_alg_values_supported\":[\"PS384\",\"ES384\",\"RS384\",\"HS256\",\"HS512\",\"ES256\",\"RS256\",\"HS384\",\"ES512\",\"PS256\",\"PS512\",\"RS512\"],\"authorization_signing_alg_values_supported\":[\"PS384\",\"ES384\",\"RS384\",\"HS256\",\"HS512\",\"ES256\",\"RS256\",\"HS384\",\"ES512\",\"PS256\",\"PS512\",\"RS512\"],\"authorization_encryption_alg_values_supported\":[\"RSA-OAEP\",\"RSA-OAEP-256\",\"RSA1_5\"],\"authorization_encryption_enc_values_supported\":[\"A256GCM\",\"A192GCM\",\"A128GCM\",\"A128CBC-HS256\",\"A192CBC-HS384\",\"A256CBC-HS512\"],\"claims_supported\":[\"aud\",\"sub\",\"iss\",\"auth_time\",\"name\",\"given_name\",\"family_name\",\"preferred_username\",\"email\",\"acr\"],\"claim_types_supported\":[\"normal\"],\"claims_parameter_supported\":true,\"scopes_supported\":[\"openid\",\"email\",\"address\",\"offline_access\",\"profile\",\"acr\",\"phone\",\"roles\",\"web-origins\",\"microprofile-jwt\"],\"request_parameter_supported\":true,\"request_uri_parameter_supported\":true,\"require_request_uri_registration\":true,\"code_challenge_methods_supported\":[\"plain\",\"S256\"],\"tls_client_certificate_bound_access_tokens\":true,\"revocation_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/revoke\",\"revocation_endpoint_auth_methods_supported\":[\"private_key_jwt\",\"client_secret_basic\",\"client_secret_post\",\"tls_client_auth\",\"client_secret_jwt\"],\"revocation_endpoint_auth_signing_alg_values_supported\":[\"PS384\",\"ES384\",\"RS384\",\"HS256\",\"HS512\",\"ES256\",\"RS256\",\"HS384\",\"ES512\",\"PS256\",\"PS512\",\"RS512\"],\"backchannel_logout_supported\":true,\"backchannel_logout_session_supported\":true,\"device_authorization_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/auth/device\",\"backchannel_token_delivery_modes_supported\":[\"poll\",\"ping\"],\"backchannel_authentication_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/ext/ciba/auth\",\"backchannel_authentication_request_signing_alg_values_supported\":[\"PS384\",\"ES384\",\"RS384\",\"ES256\",\"RS256\",\"ES512\",\"PS256\",\"PS512\",\"RS512\"],\"require_pushed_authorization_requests\":false,\"pushed_authorization_request_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/ext/par/request\",\"mtls_endpoint_aliases\":{\"token_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/token\",\"revocation_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/revoke\",\"introspection_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/token/introspect\",\"device_authorization_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/auth/device\",\"registration_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/clients-registrations/openid-connect\",\"userinfo_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/userinfo\",\"pushed_authorization_request_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/ext/par/request\",\"backchannel_authentication_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/ext/ciba/auth\"}}]"
09-12 15:42:03:191 [ info sync.httplogger ]:    "43f5ad8a-8502-40f6-b1ff-677b7cddc3ea: Request: POST https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/clients-registrations/openid-connect Header: { Content-Type: application/json, User-Agent: Mozilla/5.0 (Macintosh) mirall/3.0.0.8522-daily20220912 (testpilotcloud, osx-21.6.0 ClientArchitecture: x86_64 OsArchitecture: x86_64), Accept: */*, X-Request-ID: 43f5ad8a-8502-40f6-b1ff-677b7cddc3ea, Original-Request-ID: 43f5ad8a-8502-40f6-b1ff-677b7cddc3ea, Content-Length: 211, } Data: [{\n    \"application_type\": \"native\",\n    \"client_name\": \"ownCloud Testpilot Edition 3.0.0.8522\",\n    \"redirect_uris\": [\n        \"http://127.0.0.1\"\n    ],\n    \"token_endpoint_auth_method\": \"client_secret_basic\"\n}\n]"
09-12 15:42:03:500 [ info sync.httplogger ]:    "43f5ad8a-8502-40f6-b1ff-677b7cddc3ea: Response: POST 0 (Error: SSL handshake failed,) https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/clients-registrations/openid-connect Header: { } Data: []"
09-12 15:42:03:500 [ warning sync.credentials.oauth ]:  Failed to register the client "illegal value" ""
09-12 15:42:03:501 [ warning sync.credentials.oauth ]:  Failed to dynamically register the client, try the default client id "illegal value"
09-12 15:42:07:454 [ debug sync.credentials.oauth ] [ isUrlValid ]: Checking URL for validity: QUrl("https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/auth?response_type=code&client_id=xdXOt13JKxym1B1QcEncf2XDkLAexMBFwiT9j6EfhhHFJhs2KM9jbjTmf8JBXE69&redirect_uri=http://127.0.0.1:58401&code_challenge=eYswQ-AxH3N42Tio7Fy0TsnIy9-utPnItwOs6xKycsY&code_challenge_method=S256&scope=openid offline_access email profile&prompt=select_account consent&state=_UGjhtemsH2eagFTSsVd8qUnsNE-aGJ1J40rlwWfkug%3D")
09-12 15:42:07:731 [ debug sync.credentials.oauth ] [ ()::(anonymous class)::operator()():: ]:  Server provided: "GET /?state=_UGjhtemsH2eagFTSsVd8qUnsNE-aGJ1J40rlwWfkug%3D&session_state=3f1093d2-568e-453d-b0e1-a26ce6bc7943&code=136e2c6b-69ce-433c-858c-d3730a67cbbe.3f1093d2-568e-453d-b0e1-a26ce6bc7943.fc7d8a8e-cb92-4cb0-b404-d723c07d8d4f HTTP/1.1\r\nHost: 127.0.0.1:58401\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nCookie: _xsrf=2|d07dfebb|8d604eccc451d3985a25270e3f47445e|1662661147\r\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.1 Safari/605.1.15\r\nAccept-Language: en-GB,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br\r\nConnection: keep-alive\r\n\r\n"
09-12 15:42:07:731 [ debug sync.credentials.oauth ] [ ()::(anonymous class)::operator()():: ]:  Received the first valid response, closing server socket
09-12 15:42:07:731 [ info sync.httplogger ]:    "5541f9f9-9431-4313-9107-d3ecefe97b9a: Request: POST https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/token Header: { Authorization: Basic [redacted], Content-Type: application/x-www-form-urlencoded; charset=UTF-8, User-Agent: Mozilla/5.0 (Macintosh) mirall/3.0.0.8522-daily20220912 (testpilotcloud, osx-21.6.0 ClientArchitecture: x86_64 OsArchitecture: x86_64), Accept: */*, X-Request-ID: 5541f9f9-9431-4313-9107-d3ecefe97b9a, Original-Request-ID: 5541f9f9-9431-4313-9107-d3ecefe97b9a, Content-Length: 526, } Data: [client_id=xdXOt13JKxym1B1QcEncf2XDkLAexMBFwiT9j6EfhhHFJhs2KM9jbjTmf8JBXE69&client_secret=UBntmLjC2yYCeHwsyj73Uwo9TAaecAetRwMw0xYcvNL9yRdLSUi0hUAHfvCHFeFh&scope=openid%20offline_access%20email%20profile&grant_type=authorization_code&code=136e2c6b-69ce-433c-858c-d3730a67cbbe.3f1093d2-568e-453d-b0e1-a26ce6bc7943.fc7d8a8e-cb92-4cb0-b404-d723c07d8d4f&redirect_uri=http://127.0.0.1:58401&code_verifier=Q71F1SkGKG3Jhct6dxx8WLIwT1pkCTYnjjutro0X8DbcvbSVXoddUGc5vNQmwC8CGR4Ha7ALqIbsAH8mSmVLp-d-pfNUxU4-LBl1t803tZCxzzmuuqEEWhS2dVlZAdZT]"
09-12 15:42:07:819 [ info sync.httplogger ]:    "5541f9f9-9431-4313-9107-d3ecefe97b9a: Response: POST 0 (Error: SSL handshake failed,) https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/token Header: { } Data: []"
09-12 15:42:07:819 [ warning sync.credentials.oauth ]:  Error when getting the accessToken "There was an error accessing the 'token' endpoint: <br><em>SSL handshake failed</em>"
09-12 15:42:07:858 [ debug sync.credentials.oauth ] [ (anonymous namespace)::httpReplyAndClose ]:   "HTTP/1.1 500 Internal Server Error\r\nContent-Type: text/html; charset=utf-8\r\nConnection: close\r\nContent-Length: 38921\r\n\r\n<!DOCTYPE html>\n\n<html lang=\"en\">\n\n<head>\n<title>Login Error</title>\n<style>\nhtml, body {\n    height: 100%;\n    width: 100%;\n    margin: 0;\n}\n\nbody {\n    background-color: #ffffee;\n    color: #000000;\n    font-family: \"Noto Sans\", OpenSans, Verdana, Helvetica, Arial, sans-serif;\n    display: flex;\n    flex-direction: column;\n    align-items: center;\n}\n\n.row {\n    display: flex;\n    flex-direction: row;\n    align-items: center;\n    height: 100%;\n}\n\n.content {\n    text-align: center;\n}\n</style>\n</head>\n\n<body>\n<div class=\"row\">\n    <div class=\"content\">\n        <img src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAgAAAAIACAYAAAD0eNT6AAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nOzdd3xUVdoH8N+ZzKQnJCGEkIQWOqEJiB2wYcMuCivY27prWV3buip2cXUtvK6uBVwVBRGlCIhKL9J7C4RAem8zk0ySmcx5/5hBKZk79d5z753n+/nwed/dezP39/pizjPnnvMcBkKIqnHOjQBST/mTAiAJQLL7fyYCiHf/iT3hTzSAyBP+GAEYTvgDAM4T/jgAtJ7wpxlA0wl/rO4/ZgD1AOrc/7MWQPWJfxhjjtD/0yCEhAoTHYCQcMY5TwTQ7YQ/mQCyAGQASHf/ScUfg7VWOOEqBMrdf0oBFAMoAVB4/A9jzCwsISFhjgoAQmTGOU8D0BdAbwD9AGS7//SAa3APZ9UAjgHId//JBZAH4BBjrFJgLkJ0jwoAQkKEc54BYBCAgQAGA+jv/pMiMpeG1QI46P6zB8B+AHsZY6VCUxGiE1QAEOInzrkBroF9OIAzAAwDMAT0bV4p1QB2A9gJYAeA7QAOMsacQlMRojFUABDiBec8G8AoAGcBGAnXwB8rNBQ5VRNchcBWAJsAbGaM5YuNRIi6UQFAyAk455FwDfLnAjgPwNlwLcQj2lMOYCOA9QA2ANjKGGsVG4kQ9aACgIQ1znk0XIP8hQBGw/VNn77d61MTgM0A1gBYCWAjY6xZbCRCxKECgIQV9/v7kQAuAXAxXIM/DfjhqQmuGYLlAH6Fa4aA1hGQsEEFANE99+r8cQCugGvgp1X5pD21cBUCSwH8TLsNiN5RAUB0iXN+NoCrAVwJ1yp9Qvy1E8ASAIsYYxtFhyEk1KgAILrAOY8FcBGA6wGMB5AmNhHRmUoAPwL4AcAKxliT4DyEBI0KAKJZnPN4uL7hTwBwOVx98AmRmxXATwDmAljCGLMKzkNIQKgAIJpywqA/Ca73+rSAj4jUBOBnAN+AigGiMVQAENVz780fB+BWuKb36Zs+USMrXK8JZsG1iJB6DhBVowKAqBbnfBSAKQAmgtrsEm2pBjAbwJeMsc2iwxDSHioAiKpwztMB3AHXwD9QbBpCQmI/gC8BfM4YKxcdhpDjqAAgwnHOjXC9178XrsV8RrGJCJGFA67Fg5/AtV7AITgPCXNUABBhOOfdANwP4C5Qv30SXsoBzADwX8ZYoegwJDxRAUAUxzm/HMBDcH3bNwiOQ4hITrhmBaYzxn4SHYaEFyoAiCI450lwfdP/M4DeguMQokZ5AD4EMIMxVi86DNE/KgCIrDjnfeH6tn8bgETBcQjRAjOAL+CaFTgkOgzRLyoAiCw452MBPA7Xvn1CSGB+BPA2Y2yV6CBEf6gAICHFOb8BwFMARonOQoiObAYwjTH2veggRD+oACBB45xHwzXF/wTo/T4hcsoD8C8AXzDGmkWHIdpGBQAJmLsv/31wTfVnCI5DSDgpBfA2gI/p/AESKCoAiN8454kAHoBr4KdjdwkRpxKuQuAjxphZdBiiLVQAEJ+5v/E/CBr4CVGb44XAf2hGgPiKCgDiFec8Fq5v/E+AOvYRomblcK0R+Igx1iQ6DFE3KgCIR+4e/XcBeA5AluA4hBDfFQN4Ga6mQnTmAGkXFQCkXZzz6wBMA9BXdBZCSMAOAXiKMTZfdBCiPlQAkJNwzs+HawrxbNFZCCEhsxHAE4yxdaKDEPWgAoAAADjnveFaRHSN6CyEENksBPA4YyxPdBAiHhUAYY5zngLgWQB/BRApOA4hRH6tAP4PwKuMsVrRYYg4VACEKc65Aa4tfc+BtvQREo4q4Voo+B/GmFN0GKI8KgDCEOd8NIDpAIaIzkIIEW43gIcYY2tEByHKMogOQJTDOc/gnH8JYDVo8CeEuAwBsJpz/iXnnFp6hxEqAMIA59zAOX8UwD4Ak0XnIYSo0mQA+zjnj7pfERKdo1cAOsc5HwngEwDDRGchhGjGTgD3Msa2ig5C5ENVnk5xzpM45+8A2AIa/Akh/hkGYAvn/B3OeZLoMEQeNAOgQ5zzKwH8F9S+lxASvGIA9zPGlogOQkKLZgB0hHOe5l7ktxg0+BNCQiMLwGL3IkHaMqwjNAOgE5zziQDeAZ3WRwiRTzmAvzHGZosOQoJHBYDGuSvy6QBuFp2FEBI2voWrd0Cl6CAkcFQAaBjn/AYAH4C+9RNClFcO4C+Mse9FByGBoTUAGuRe4f8ZgHmgwZ8QIkY6gHmc889op4A20QyAxriP650FoJvoLIQQ4lYI4FY6blhbaAZAIzjnRs75qwDWggZ/Qoi6dAOwlnP+KufcKDoM8Q3NAGgA5zwbwBwAI0VnIYQQL7YCuIUxli86CJFGMwAqxzm/A8A20OBPCNGGkQC2uX93ERWjGQCV4pzHA3gbwH2isxBCSIA+BvA4Y8wqOgg5HRUAKsQ57wtgEYC+orMQQkiQDgG4mjF2SHQQcjJ6BaAy7mmzLaDBnxCiD33hOljoDtFByMmoAFAJznk05/w9ADMBJIrOQwghIZQIYCbn/D3OebToMMSFXgGoAOe8G4AfAAwXnYUQQmS2HcD1jLFC0UHCHc0ACMY5Hw1gE2jwJ4SEh+EANrl/9xGBqAAQiHP+GIDloHa+hJDwkg5guft3IBGEXgEI4H4H9h5oix8hhHwM4BHGWLPoIOGGCgCFcc4zACwANfYhhJDjtgK4ljFWKjpIOKECQEGc80EAFoN6+RNCyKkKAVzFGNsrOki4oDUACuGc3wRgPWjwJ4SQ9nQDsN79u5IogAoABXDOnwQwF7S/nxBCpCQCmOv+nUlkRq8AZMQ5NwB4B8DDorMQQojGvA/gb4wxp+ggekUFgEw454kAZgEYLzoLIYRo1I8AbmWMmUUH0SMqAGTAOU8HsAzAENFZCCFE43YDuIwxVi46iN5QARBinPNsAL8AyBadhRBCdCIfwKWMsXzRQfSECoAQcm/z+wXU2Y8QQkKtHK4igLYJhgjtAggRzvlFANaCBn9CCJFDOoC17t+1JASoAAgBzvnNcDX4SRKdhRBCdCwJwGL371wSJCoAgsQ5fwDANwDojGtCCJFfNIBv3L97SRCoAAiC+ySrD0H/HAkhREkGAB/SaYLBoYErQJzzfwB4W3QOQggJY2+7fxeTAFABEADO+YsAXhWdgxBCCF51/04mfqJtgH7inL8KgCpOQghRl9cYY8+KDqElVAD4gXP+OoCnRecghBDSrjcYY8+IDqEVVAD4iAZ/QgjRBCoCfERrAHzgnvanwZ8QQtTvaffvbOIFFQBeuBeX0Dt/QgjRjn/QwkDv6BWABPf2EqokCSFEm55ljL0mOoRaUQHggbvBBO3zJ4QQbXucMfZv0SHUiAqAdrhbTH4oOgchhJCQ+DNj7CPRIdSGCoBTuA+Z+Aa0PoIQQvTCCWASY+xb0UHUhAqAE7iPmVwMOtiHEEL0phnAVYyxFaKDqAUVAG6c80EA1oKO9CWEEL2qB3ABY2yv6CBqQAUAAM55NoD1ANJFZyGEECKrcgDnMcbyRQcRLewLAM55OlyDf7boLIQQQhSRD1cRUC46iEhhvdCNc54IYBlo8CeEkHCSDWCZewwIW2FbAHDODQBmARgiOgshhBDFDQEwyz0WhKWw/T8cwDsAxosOQQghRJjxcI0FYSksCwDO+ZMAHhadgxBCiHAPu8eEsBN2iwA55zcBmCs6ByGEEFWZwBj7TnQIJYVVAeDe678eQFgv/CCEEHIaM1w7A8KmR0DYFACc8wwAvwHoJjoLIYQQVSoEcA5jrFR0ECWExRoAznk0gAWgwZ8QQohn3QAscI8ZuhcWBQCA9wCMFB2CEEKI6o2Ea8zQPd0XAJzzxwDcJzoHIYQQzbjPPXbomq7XAHDORwNYDsAoOgshhBBNcQC4mDG2RnQQuei2AOCcdwOwCXTADyGEkMCUAziLMVYoOogcdPkKwL2A4wfQ4E8IISRw6QB+0OuiQF0WAACmARguOgQhhBDNGw7XmKI7unsFwDm/A8BM0TkIIYToyp2Msc9FhwglXRUAnPO+ALaAOv0RQggJLTOAMxljh0QHCRXdFACc83gA2wD0FZ2FEEKILh0CMIIxZhUdJBT0tAbgbdDgTwghRD594RprdEEXMwD03p8QQoiCdLEeQPMFAOc8G66p/yTRWQghhISFerheBeSLDhIMTb8C4JwbAcwBDf6EEEKUkwRgjnsM0ixNFwAAXgQd8kMIIUR5I+EagzRLs68AOOfnA1grOgchhJCwdgFjbJ3oEIHQZAHAOU8CsAuus5sJIYQQUQoBDGWM1YsO4i+tvr94GzT4E41zOhw4vHEFNu89iCPltbDbGlG0ZyvM9bVoarTil92nry/qmZaEnB4ZSOyQjE7deyMpswcA4KbRI9HnzPMRlUDLYQhRWDe4xqS7RQfxl+ZmADjnNwCYJzoHIf46sOYnzFmxESX7tmLF2g3Ir6iT5Tl/Gnce+pxzCa47dyiGjbtelmcQQk5zI2Pse9Eh/KGpAoBzngbX1D+d8kdUr67kGN775HMc2bIGXy1ZKSzH9eedgSGXXIO/3nkrUrv3EZaDEJ0rh+tVQKXoIL7SWgEwB8DNonMQ4kldSQHe+2QmvvviM+w7Wiw6zmlyemTgptvvxcN334aUrtmi4xCiN98yxm4RHcJXmikAOOcTAXwjOgch7fn+q5lY8N0cfLFgmegoPrvtmnG45qZbcOOUu0RHIURPJjHGZosO4QtNFAA09U/UyOlwYNYn/8HLr7yCw6VVouMErG9mGv75z2dx6z0PwmDU6rpgQlRDM68CtFIAfAlgsugchABAW2sLnnv2Gbz+1juio4TcjHfewO0P/R2GiAjRUQjRsq8YY1NEh/BG9Z0AOedXggZ/ohKz/jsdfbLSdTn4A8Bdf3savTNS8fUnH4iOQoiWTXaPXaqm6hkAd8OfPQCyRGch4W3RnK/w9FNPYn9BmegoisnpmYk33nwL42+aKDoKIVpUDGCwmhsEqX0G4AXQ4E8Eqi44jLtuuR7XTJwSVoM/AOw7WoKrJ0zCPZNuRG2Rpg89I0SELLjGMNVS7QwA53wkgC2ic5Dw9d3/PsWEO+4VHUM15n05AzdMvlN0DEK05kzG2FbRIdqjyhkAzrkBwCeic5DwVF9WhLFjx9Lgf4obp9yFu26+Hk212t3xQIgAn7jHNNVRZSgADwMYJjoECT+rVq3CqJEjsHr1atFRVGnm3PkYMWwIVq1aJToKIVoxDK4xTXVU9wqAc54BYB8AOtWEKOrzt1/BnX9/TnQMzZj72Ye46a4HRMcgRAvqAeQwxkpFBzmRGmcApoEGf6KweybdSIO/nybc/We8+dj9omMQogVJcI1tqqKqGQDO+WgANPdKFON0OHDRJZfQlH8QxowZQ68ECPHNGMbYGtEhjlPNDIB7kcR00TlI+GgoL8I5I4bR4B+k1atXY+zYsXC0NIuOQojaTVfTgkDVBAHwIIAhokOQ8FBXfBRjx47F5t37REfRhdWrV+PCCy+kIoAQaUPgGutUQRWvADjnKQAOAEgTnYXoX0N5EUZfcAF25xWIjqI7559zNtZu+E10DELUrBLAAMZYreggapkBeBY0+BMF2G2NGHfZFTT4y2TdbxsxduxY0TEIUbM0uMY84YTPAHDOe8O17S9SdBaif2PHjqV3/gq4c8K1mPHtfNExCFGrVri2BeaJDKGGGYC3QYM/UcDdt9xAg79CZs5dgPeffVR0DELUKhKusU8ooTMAnPPzAawVmYGEh49f+yfuf/ZV0THCzqK539BpgoR4dgFjbJ2oh4suAH4DcLbIDET/Vq1ahQsvvFB0jLBVkrsHGX0HiY5BiBptZIydI+rhwl4BcM6vAw3+RGa1xUdxz6QbRccIa1eOv1p0BELU6mz3WCiEkAKAc26ECtsiEv25YfKdOFIufLdNWNt1+BgevP1PomMQolbT3GOi4kTNANwFoK+gZ5Mw8fV/p9OiP5X48ItvsHLFctExCFGjvnCNiYpTfA0A5zwWQC6ALKWfTcJHRX4u0nv1Fx2DnCCnRwb2Hi0RHYMQNSoG0I8x1qTkQ0VMOzwAGvx1y36kCJbaasl74qLjETW4j6w5brnzPlk/n/hv37FSPPbA3fj3R5+JjkKI2mTBNTb+W8mHKjoDwDmPB3AYQLqSzyXyaTx4BM31dbBu3ws7c/r980n9+8EYF4sOZw4DY6H56/jDrM9xw+Q7Q/JZJPTK8g7Q7AwhpysH0IcxZlXqgUoXAE+CFv9pnqO4HPX5R1G/70BIPzcuPR2JA/ohrn+voD6nb2YaDpdWhSgVCbW7brken83+XnQMQtToKcbYm0o9TLECgHOeCNe3f+r5r1G2kjLUbt0BW2m5rM8xcQNSRp6BhFFD/f7ZGf9+DXc/roo220TCiuW/4sKLLhYdgxC1qYRrFsCsxMOULADo279GORssqFixFo3l8g78pzIxI1LHjUFcdnef7m+qrUJcR6ovteCckcOxYcs20TEIUSPFZgEU2Qbofvf/uBLPIqFl3ZuL/K/nKj74A4CdO1C2bDlKFixBW533gvjlV19TIBUJhd+2bseyxQtFxyBEjR53j5myU6oPwH2gqX/NKVmwBOVr14uOAVtpOep27Ja8x25rxBv/flehRCQUZs/8VHQEQtQoDa4xU3ayFwCc82jQt39NcZRXo2jWPNnf9fsjtncPyeuzP6fBRGs+n7cIZXmhXUhKiE487h47ZaXEDMBtADIUeA4JgZbiMhTPW4QWc4PoKL8zOhliu0m3jniVpv816Y1ptCyIkHZkwDV2ykr2RYCc88MAesv9HBK8luIyFC1aKjrGaVJGnoGUM8/weP2Hr2bihilCOmmSEGiz22EwCmmFToia5THGZO2YJusMAOf8BtDgrwmOsiqUL/hJdIx2JWZmSl5fvGiBQkmIHObM/Fh0BELUqLd7DJWN3K8AnpL580mIlK1eB7uBi45xGhM3wJjhef2ouaIYn31LBYCWzftqpugIhKiVrGOobAUA53wsgFFyfT4JnZIFS9BSVyc6RrsSzpRuBjR/3ncKJSFymbdmK+pLC0XHIESNRrnHUlnIOQNAK/81wLo3V1Wr/U8V3SlV8vrb79DWPz1YOJ9aAxPigWxjqSwFAOe8L4Dxcnw2CZ22ihpV7POXEtujq8dr5opi7M4rUDANkcvi72aLjkCIWo13j6khJ9cMwEMyfS4JofKNm0RHkJTY1fPgDwAL5/+gUBIit29XbgLn6luDQohKyDKmhrwA4JwnQYH9iyQ4TUUlqp76BwBjZ+np/w3r1T17Qfwz74vPREcgRK1uc4+tISXHDMBdABJl+FwSQjXrN4uO4FVipnTznw+/nKNQEqKEXblHREcgRK0S4RpbQ0qOAuDPMnwmCaHGvGOqXfV/ImNGJ4/XivfRSXJ6s2vFj6IjEKJmIR9bQ1oAcM4vBzX+Ub26PXtFR/AqKiZW8vqncxcplIQoZdEm9f+9JESg3u4xNmRCPQNAi/9UzlFejebyStExvIrL6Sd5vaGM9o3r0eHflouOQIiahXSMDVkBwDnvBiCk1QkJPXNRkegIIbF0yWLREYgMZi1bKzoCIWp2uXusDYlQnsBxP5Q5XZAEwbJllwJHQAUvPqmj5PXcYvXPYhD/2W2NktcdeUdh3r7b43UjAFN8HCK6ZSFyUP8QpyNEOANcY+2zofiwkBQAnHMjZFihSELL2WCFnTlFx/BJZB/PRW7Z/h0KJiFKOrJNemsnB1A717+zH2KTOiDyvFEwxsQgblB/mHKoMCCadhfn/AXGmCPYDwrVDMCVANJD9FlEJvWHDouOEBKr1v8mOgKRyZY9ByWvm3r39Pszm+ob0LT4FwBA9XcLAQBx3bIQddYIJI4aDqNEt0lCVCgdrjF3YbAfFKoC4N4QfQ6REbfbRUfwjZeOcLklNP2vV/mV3renGiMi4GhrC+o5jYXFaCwsRu3cBTBGRiLhiouROHIYTP1lPX6dkFC5F2ooADjn6aDFf5pg3XVAdASfxHdIkbze1tqiUBIiQovVjKh4z73EIlNT4KioCtnzHK2tqFuwFHULlsIUG4Pkq8Yh/tIxMCSHvPEaIaFyOec8nTEWVDvXUCzauwOhXUxIZGJHcN+alGLqmSl5vWi3+rsYksAV7d0qeV3Ob+n2Jhsq5y5A/n2PoXLa+7Dn5sn2LEKCYIRr7A36Q4I1JQSfQcjvmMkkeb2hrkahJEQEq7le8npEmucOkaFk3roT5q07EZ/dA4kTr0PsGUMUeS4hPpoC4I1gPiCoGQDO+SgAA4P5DKIM3qaN1f++2H2EmgDp2Z78YtERTmLNP4bS195F2TMvo2XPftFxCDluoHsMDliwrwDo279GcGuT6Aghk1+h/nMMSOCOlNeKjtCuxryjKHrpLVS8/DYcR6kIJaoQ1BgccAHAOY8EMDGYhxMFaaD5DyFaYNm9D8eenIq66Z+KjkLIRPdYHJBgZgDGAZA+sJ2oBouTPlyHEOKfmjUbUHDHQ7Dtk+5dQIiMUuEaiwMSTAFwaxA/SxTGIqhLMyGhZm9sRMnUN1H9xvuio5DwFfBYHNCowDmPBzA+0IcSQkig2uqkdwmIUL9tJwrufgT2A4dERyHhZ7x7TPZboF8LrwQQ0AOJOFEx9BqAaF+bShfg2c0WFDz/BizLVoiOQsJLPFxjst8CLQAmBfhzRKC4nH6iI3gVBSOiqAMbkeCsUecugeMqPv0K1S+9JToGCS8Bjcl+NwJyTzUEvOiAiBMZHS06AmIiYxA9oNfvzX7iouMQ2a8nWKR0858T9UxLwtFK9U0Di9Y3oxNGDuqHboNGIiqhw+//fXZaEvpkdkJUZBSMJhOcbW3g3NUXoqWlFYdKKpF/wj/PxuoylB85iNrqSizZqvwCt16dpVtBt9abFUoSuPo9+9HywjR0efR+ailMlDCOcx7PGLP680OBdAK8EgDNJWtQ/OABwDr5T9IzcQPicvrCEBsDAwfiu3WFMT10G0ZyemSEdQHwp3Hno885F6NX5xScNXQgeo8aC4Mx8KaeZ/twT/nBnVi17jccLK6AuaIYR3ZswsJNewN+ppSBPTIkrzsgfViUWtj256Lob88h47nHYerVQ3Qcom+xcI3N3/rzQ4H81pgQwM8QlUjs3h3mgoKQfZ6JGxB/Rg6Y0YjErqEd6D1JSgmf3adXnzUIQy8aj0G9e+Cqa65FfKqYU7fT+w/DxP7DTvvvKw7twS8rV+NAfgH2rF6KRZv2Bf2shMQO3m/SCHtjI0r++Royn/87TAP6io5D9G0C5CwAOOexoJP/NC1h6MCgCgCDE+gwfDAiTVFIGCmmN3rXQSOAn9YIebbc+mSk4uprrsNZo87ETVPuhMHo+6sRETr3HYzJfQe7/9O/AAAH1izFnBWbsHflYsxbI32wT3uyBgz1eM1+8HAgMYVyOBwoef4NZE59CiYNrMMhmnU55zyWMeZz21d/ZwAuAq3+17SYzC6IyUiHrdT3UyRNzIiEEYORmJUFYxdlDmKREhnn+ahYLerfNR0Tbr8b9068AV1zhouOE7QBo6/A1NFXAFOnAgB2/TIfs39aje/nfI1DJZVefz42Jc3jNa224HUAKH7hDWS9+DQVAUQu8XCN0T/6+gN+NYjlnH8G4C4/QxGVsZWUoWThUq/3JQ/JQWL37jBliZl29uTrjz/Arff/VXSMoPRMS8INN07Aow/9RfIbr97UFB7B9Blf4odZn2N3XvszUZx7fsdf++181M5dKFM6+RnBkPnKMzD16y06CtGnGYyxu3292d8CoAKA5/KcaEbV4l/RUHj6tymTMRIdhuYgadQZAlL55ti2deg58gLRMQIyefzFuO7mSbhxis//jupWfWkhFs7/Hu++Px07cvMBANeeMwTzN+zy+DO13y5A7dwFSkWUhSkqCpmv/APGHl1FRyH6U8kY6+zrzT4XAJzzswHIv4ScKKZozny01Lr2VEdGRSPlzDNcOwU0gDFtnW70yL134h/PPI20nsosBLPn5qGtqBROswXNDodPPxPBOSKjo8GSOsDUrxci0pWr9WuL8vH+Z18gK7oN9zz9ssf7qv4zAw0r1ymWSy6RyUno+tFbYAZq0U1C7hzG2EZfbvSnAHgVwD8CjkRUx1FSicL5P6LTqBFIOFPeaWj7vly0lZTBabai2dnW7j0RACJjY2BIToJpUH8YOnh+19+/azpyiytkShsa2Z2Tceu9D+LJR/4qy+p9e24eVq1ahfVlxbAfOAxHbh7e3LX5pHseGjgMDw8MbjYnJjYWppx+MPboBmOkCTGDBwrb1lb6wN/RpPJGQL6KHdAXGS89LToG0Z/XGGPP+nKjPwXADgCn7wMixI23tKB59W+w1TfAUVAM+579sNlsAX1WTGwsMv/3fx6vP/bne/DOR58FGlVW2WnJmDp1Kqb8+eGQfabT2ogVc+Zi3dEjaF6+BtM2+rYLIisyGiuvkadxZ0xSB0RfdAFMcbGIH3seDIkJsjznRMduuQcOp1P25yil47mjkPy3B0THIPqykzHmU9Xv0y4AznkGaPAnp+BtbbAu+RUtFZWwrt4AR3NLyD7b1iS9k2X4MHUunJvx7jTc/tfHYYiICPqzmpevwesrlmH5V99gfeHRgD6juLU56Bye2OobYPveteC48stvYYqORvylYxCT2hGxV14iyzP1NPgDQM2GzYgeNxYxOf1FRyH6MYxznsEYK/V2o08zAJzzOwDMDDYV0b622jo0rlgH6+oNaCqXdwo+64E7EH3x6Hav1ZUUICWrh6zP98df75qCV197DYmds4L6nF//9xVWr16FV2aGbnZj8fmXo296l5B9nq8Shw9B9MB+SLjqUrAgOhWeKG+C/jYhGSMikPXWizBmSXdAJMQPdzLGPvd2k68FwBwANwebiGiXZfEvaFy/GdbDRxR7ZsqEa5Fy87Uer/fL6uzTvnI5jRkzBt988h906TMw4M9o+W0rXvn0Y7wy45MQJvtDKNYBBCtxxFDEDB2EhCsuDupzLIt/Qc3/ZsMhsVVQi6qgxGkAACAASURBVBJy+qPz1CdFxyD68S1j7BZvN3ktADjnBgBVAKRP6CC64ygqRf2vq2Bd8it8W0ceWjGJicj87F2P1595/G9449+er8upT0YnvPmvf+G6P90e0M87LY1Y/sVXePHNaQFP7/vq7h598fTI82R9hq+MjCH+8ouRdNEFAW+Dc5otqP5wJsxbd4Y4nVid75mMhMsuEh2D6EMtgE6MMcl3Zr4UAKMAbApVKqJ+9ryjqJu3SBW/YLP/938wxLZ/9tSBtT9h4OgrFE4EPHj7JEz/7MuA3vM78o7ixddewyszP5UhWfuiDQbsuSGwQkVOCTn9EX/R+YgbfW5AP2/bexCVb30Ae2NjiJOJYQRDt0/egSFJX50uiTBnMcY2S93gyyZUeVbzENWxHzmGitfeRcEzL6ti8AcA67JVHq8NuOBy9MlQ7mCgnJ5ZWLlyJT74/Gu/B3/7voP456TJMPXJVnTwB4BmlS6cs+w7iLLpn6Lg7kdgWfKr3z8fM6g/un8+HcmjtN8+GXCdclj93/+JjkH0w+vY7UsBENxLO6J6beWVqHzrAxQ8/RIsO3aLjnMS227p0+UmTL5DkRwPTJmIvflFGDt2rF8/Z9+fi00PP4XIQQPw6uxZ8oTzweL8Q8Ke7Y3dbEHFzK9RcMdDARUCHZ/4KzKnPgljdJQM6ZRl3rpDkwceEVXyOnZLvgLgnEcDqIHrrGGiQ+YFS1Hz5bdoU3FnPanXAFXHDiGtp3yHq/RO74iP/jcLF4+7zK+fsx/OR+0338OyZz94Wxv6/vCFTAl9o4aFgL4yJSSg4603If5i/9o989ZWVL7+Hix7D8iUTBm0IJCESBOAjowxj3uBvc0AnA0a/HXJfuAwCh96BpVfzVX14A8A1p9WeLzWqUdf3HHDVbI8d8yYMdiyfYdfg7+z3uyaTfnHK7Ds2Q8AYCHoCRCsgppq0RF8ZrdYUP7RTJT+41XYD/j+bZhFRqLzC08g7Tavi59VzbLvIFr3aLuIIaoQC9cY7pG3AuDC0GUhalE3/VMUPP86WmXexx8qdV6mhW+cdGvIn/nB1CexatUqJHXxfaW65cefUXjvozBv2nbatUlde4Uynt8WVhQLfX4gmg4fQcHzr6PyzelwWn1f6Jd49WXo/uJTMEVHy5hOXrXfavvAI6IakmO4twKg/S4sRJPsR46h+KkXUbNmg+gofrE3mGE/lO/x+vibJmFYv+yQPKtXegpWrlyJB1+Y5vPP2HPzUPTEVFT8b7bH7ZKpCfK3yfWmJcC2zKKZt+xA4T2PwrJspc8/YxrYD1nvvYqYgfK9HpKT9eAh2PPk3R5KwoLkGO6xAOCcRwIYFfI4RIjG37ai4KkX0Zzf/hnsale36CfJ6y+/8mrQzxgxoA/Wb9jg10K/ug8/R8E/X0PLsdOPVj7RuQni22jMLlSuiVOoOdraUPHpl6h4YRocRSU+/UxESjIyX3wKycMGy5xOHnULloqOQLRvlHssb5fUDMBI0Pt/Xah9czrK/v0fQOXv+qWYN26Fs97s8fr4myZi9PmBN7u58+brsHX/IXT2cUGhPTcPRQ8/g5oVvh3KM7Jr94CzhUpDm110hKBZ9uei+LHnYF2+1uef6fjs39DpGuX7RQTLvHEruM46HhLFxcI1lrdLqgAIrDsHUQ3eakfJC9NQu2WH6Cgh0bD4Z8nr33z2UUCf++4/HsWMOT/4fL9l0c+ub/1l/q2h6GTyWIgrYuUxz69RtMQBoPyjmah4+S2ff6bDlAnI1ODKessC6ZkvQnzgcSyXKgDU0TuUBMSRX4DCvzwJ2/5c0VFCpsHLlGhG30F4+B7/Ot59/+VneOTVd3y6l7e2omLqm6j4YrZfzzjulh59A/q5UNnb5HkGRYssu/ej4M6HYD/gW4+DmJz+yJz6JCI09K26cfV60RGI9nkcy6UKAMntA0S97Ll5KH7uddjrG0RHCSkH5zDPWyR5z3uffI4hvX2bbl+5ciWun+zb6XL2A4dReN/jsOw76NP97WGm0JyIF4wys77+TtitjSh4/g1Yf1nt0/0xOf2R9dIzMBp86YEmXmNxKbhNviOdSVjwOJa3+28B5zwbQLpscYhs7PtyUfLc63C0toqOIgtftkctWih9T6/0FBTs2+HzYr/GLTtQ8PzrQfecnyh4KyAAzC3Wx2uAU5V//D/Uvv6eT/eaBvZF5otPwaiC/gy+sPzs++4HQtqR7h7TT+OpDKbV/xpk35eLkqnTdHdU6okcTifMXoqAbgOG4vsvZ7R7rX/Xzli7Zg26DRzm0/Pq3v8EZW9O9ztne9ISxB/y4mzRZ2EIALXbd6HkhWngrd4XO5r699FMEeBthwkhPmh3TPdUAJwlYxAig98Hf9FBFFDz7Xw4LdLfxq+ffCemPXb/Sf9dTs8srF69Bl365Pj0nIqpb6Jm7W8B52zPmQnJIf08f80pzBP6fLnZ9uei8C9PwnGsyOu9pn69kfnCk6p/HdC48fTGUoT4qd0x3dPffI/bBoj62A/no+Tlt8Ji8AeANsZQ/Yn33vpPvv0RxowZAwAY3KsbVq1cibSe3hficc5R8sK0oN73e3K24O2A1Xb9zgAcZ69vQPE/X/XpUB3TgD7IfP4JGFQ8a+ZwOPzqhEhIO9od008rADjnBgD6OF8zDDiKSlD68ttwtLWJjqIo829b4DhyzOt9q1atwqP33YnVq1YhtXtvr/e3Vdei+Impsu2eSBW8FRAANhcdEx1Bdo6WVpQ89wbsPhRxppx+6PLiUwqkClzrhi2iIxBtG+4e20/S3gxAf1ADIM0o/3Am7Bpt8Rqsmi+/9em+d/47A8lZPb3e5ygsQfHTL6GlwPv0caAmdusj22f7aqOlTnQERTjAUfTCNNh8KAJicvoj49m/KZAqME0629FDFBcL19h+kvYKAPr2rxEVU99E82F9rur2hWXfQTSu2xiSz3IUlqBk6jTYG+TdK2+IEj8DUGOxiI6gGCdjKJn6pk9FQOywwUi93OsR6kJwne7qIYo6bWxvrwDQxqHhYa7hy7myvKPWmur/el8L4I2juNQ1+FusIUjk3S1ZoTm4KFDfFGn3TIBAlb0wDS17vR+xm3T3rUgaPFCBRP5p3b5bdASifaeN7e0VAL7tjyLC2PYeRNVCOigEAOzNzah79+OAf95ptqD0pbcUG/wBIC1R7HZADoA7nUIzKM3JGMpe/JdPXQNTn/+76k4RdNbWi45AtO+0sb29AmCIAkFIgJyWRlS8/q7oGKpSs36jTyu+21M6bTpa65T95XpGfJKiz2vPvHz9tIj2lQNAyUtvweHDiZjp998OY6T41zXH8abwXOdDQuq0sf2kAoBzngEgVbE4xG9V//6Pbrv8BaP8v//z+2dKXpiG5kPK74u/oJv3BYlyK20Nz/ayDocDJa/8G06z9DqIiIx0ZDzziEKpvGvm4TVjQ2SR6h7jf3fqDMAgBcMQP1mWrYDFh/eY4ailuBTmOfN9vr/m5beFHpSUYjQJezYA7CstEfp8kewWC8re/o/X+yIHDUDapBsVSESIYk4a408tANS3+oUAANoqq1Hz2SzRMVTNlnfUp/vqP5+Nut37ZE4jbVJ3sdsBV9RXCX2+aLb9uah+yftxwok3XIUEFawHiHKqt1ER0ZSTxvhTC4DBCgYhfqj++Atd9/gPltFoRKeH7vF6n23fQVQv/lmBRNLUsB3QEuThRlpXv2c/zD8s8Xpfp8cfhFHw/78MsTFCn09046Qx/tQC4LRGAUS85r0HYNm1V3QMVev08H0wJCZI3uPIO4qKqW8qlEjaBMFbAQFgls7PBfBF5dffodXLazVDYgI6P/OoQokAY0QEEoYPRcqEa5E55Rb0ePtlZH7p/ZUFIT44aYw/9YByKgBUqPL9T0RHULWEITmIO8f78RVl73+smvMSuiR2EB0BrbSwDABQ+sZ76Prea4jomOLxnpic/kgaMQz123aG/PlxvXoiavgQxCYnIeqS0WCMhfwZhLi1XwBwztMAeP43gAhh+fFnxbepaYkRQOrdt3q9r/LVd9BSViF/ID8MjeuAXY3iWrz+mH8IDw+kvl+OllZUvf8J0r2cB5D69MNovOMh2IN8dRLXLQtRZ41AfP8+iBxCy66IolI452mMsUrg5BkA78ekEcXVzP5edARV63j7RERkpEve07hhC8w79yiUyHeju/fErv2h/0bpq6PNTcKerTbW/bmwLFqGhKsvk7wv7e9/QcmL/r1GMoIh9twzEdO3FxKuujSYmISEQl8ApxUA3o9KI4oyf/8jHC2059+TqC6dkTB+nOQ9jsISVL3zoUKJ/JMseCsgAORXVyI7NU10DFWo+GIOovv3gamP5/UZMYP6I3HEUJi37ZL8LMY5Es4dhcQhOYi+ZHSooxISjN4A1gEnLwIUv9eFnKR27kLREVQt/f47vN5T+emXqnnvf6pJ3cTX3D9Whm8/gPZUfPaV13s6PfZnGCMi2r0W3zsbne+YhF7fzUTaY3+mwZ+o0e9j/YkzAOKXJZPfmRcshcOh1qFLvIRhg2HKka5ZLUt+RZMPvd9FMUZHi46AFmoxe5LmI8dg/n4xEm+4yuM9LDISHW+fiIoZrr4cRgDxV12KpItGw9gtU6GkhATs97GeCgCVqvthsegIqtZx8gTJ646iElTPmAWofEX1DZk98X2Jbw2M5PB10RE8MfJcYc9Xo8pv5iF2xBAYu3f1eE/CFRfDtnMvogf0QeJ1V8qeyWGzwnJ0PxyWOtijSwHmuSdIRGMKjDHJiO2SjZjOnv9vIGGr3QKgh/I5SHua1vwGeyMt0PIk8byzYOyeJXlPzeffoE3lgz8AZHboAAichbe20SxTe2o+n43OLzwheU+aDGcFWAsOwFq1C20RZtQf2IyW5kLwqAB/F5zQ7NLUnIX4njmITs2EqaUrknPOhjFWum8G0a0ex/8XIwBwzhNBhwCphmXtRtER1ItzpN4xSfKWxk3bYdm9X6FAwRkUK/ZoYAD49VgeLukhfj2Cmlj2HkD8pu2IO2u4rM8x5+2CtWkb6g9shs3RTrOvqNA8xx5djLqyYqDM9Z8LDwGG1ngk9TgfMQl9kJw9BlEp0rtpiG6kcs4TGWPm4zMA3YTGIb9rq66FRYVb1tQi+cpLYUiSHjSrP5ypUJrgXdSjF7B1jdAM+5ssuERoAnWq/mimLAVA1Z6FsFTuRF3pL4BBXHtvZ6QVtaU/AfgJJbnTEdGWhE6DxiMxZTQSelB/Ap3rBmAvFQAq07hiregI6sU5km++VvIW8/c/Bt2oRWmJEUaYBU7FlzSIa0akZnZrI8wLliLx2iuC/ixLwQFUHfkOdWXL/vgvT23ELlhbRD3KD3yFcnwFw6oEpA25FikZVyAmvbvoaCT0ugHYazjhPxAVqFu6XHQE1Uq67CIY4uM8Xnc2mFHztfYaJ/1J8HZAkYsQ1a7263ngQRzCVbH9O+z6+jocWnfvyYO/yjlNFpQf+Ar7l9+KvXMno3KX70dtE03oBvxRg9LeFRVwFJbAbrWKjqFayV66qLkW/ikUJoRMMeK3Azqp4VS7HE4nzF/P8+tn2lpbULpzBrbPuAzFB96Fg1fLlE4ZLa3HULT3Lez4/HKUbfsKTjv9XdGBTOCPAkB6STVRhOW3LaIjqFbiWSMkW/46ikrRsG6TgolC5/ou4qdYZxccFh1BtWp/WAze6tugV7ppFnZ+fQXK9s0Aj9LWqyhvnCYrSg9+hB2zL0bx1v/A0WQRHYkELgv4owDIEBiEuNlWrhcdQbVSvOy1rp27QKEkodc1WfwZXNUO+lbnSRtjaJjj/e9X4cb3UJb3IWDS+T9LA0dF7tfY9d1VKNv8jeg0JDAZwB99AGj/R4A453DkF8NSWwXA8/yzyRSJhGE5kp/TVFMjQ0Lti+veFcbePT1edxSXwazx2ZO+MfE4ZBP3+mdjUQGdDCihfuFSJE2Rbj6V1OkiVB2Zq1AiFYhwovTwByg/8CWyRv4FnXI8d08kqpMOUAHgF6e1CfUHcsE5R+Oeg2htbfb5Z5MG9INU2w3b4l+CD6hT8RddIHm97kftLK7y5LKevXFI4MmAWyx1wp6tBQ4A5nk/IvHG8R7vSew1GBHrO6AtIrx2VTiNZhTufB21JcvQddCjiM2gprIa4CoAOOdGUBMgj6x7DqC5vgH1e4NrLGOIi5W83kw92dtlNBiQcKXnXeq8tRUNy8Xuow+FhAij95tkVm0xIzVBfGMitaqbv0SyAACAtGE3omzPDIUSqYu1ajsOrLwNGX0eRJdRfxIdh0hL5ZwbDXAN/irbkSpW4+GjqPppJfI+nIHydb8FPfgDgNEpvTy9+dfVQT9Dj+KvuFjyumXBTwolkZforYCA61wA4pm9uRmWZSsk70lKk/77Gg5KD/8HB5fej6Yy2l6qYgYAqccLgLDnbG5B7ZYdyP9gBsp+XYmGo6H9yxvXS3qld1NdfUifpxdJo6UPqqldsEShJPKKiokRHQFoc4pOoHqN6zZLXo9N744ILn5Rp2iNtftw4NfbUJsnXTARoagAcBRXoGrxr8ifOQu1W3fAKdNcSERqsucMBcXyPFTjTAnxMGZ7LpwsP6+CQ0f716/rIrYf13dH1Xt0slpYDx7y+u9r2pDrFEqjcgaOo5uex5FFL4lOQtoXvgWAo7gCFT/8hGOLFqOhsFBolqYd1Pu/PYmXXSR5vWnLDoWSKEP0dsAyPxa1hrMGLztOkuk1wEnqzT8j95eH0FJbLjoKOVmqAUBYzVc5rU2oXLgMxxYthqW8VJFnmrj0tILDxyYj4Sbh3DM9XmurrNbdoUm9o+NFR8DukiLREVTPskh610lMencY7HTU7omslTtwYPG9aCymhlMqkmIAkCQ6hVLqN+9A/pezYS5R9gD2WC/v/530/v80pvh4GLt67lDduEp/TZOuzO4jOgJWNWi7ba0SHK2taNm0XfKejgMuVyiNdrQZ6nDw1/thqdDXzJ2GJRkAeH45rRO2kjIUfTUX1dvE/MWLSJGusVrpFcBpErys/q/7SZ+Li+IMEUKf32DVV/tauZi37ZK8Hhs5QKEkGmNqxaFfH6IiQB2SdT8DUPXzapQsXIoWi3r7VrfSDMBpEoZ47proKCyGXcX//wyG6O2AXxflCX2+VjSulp6BSj1jnEJJtImKAFVIMgDQZeePluIyFM2ah4Yj6t/b7HDS9qsTGQ0GmPp7HgjNG7cpmEZZ0bFitwM6gjj6Npw4nE60bJZ+DRAbOUShNNpERYBwiQYA4lcehVjjgcMoWrQULebwasmpF7FnjZC8btPp9D8AXN1Z/MGcC47kio6gCdb8AsnrHfqNVCiJdlERIFS87gqAsvlLULZqregYJzFIfKni9I3rNNE9Pe+Hd9abYdPp9D8A9OzYSXQEFLQ0iY6gCdalv0peT4jzvIuF/OHQzw/DWkhFpwDxBgDSTeo1wmlpRMmCJWgsU99e0xhDpMdrzppaBZNoQ5zEDIB15ToFk4iRHR0n9Pl5VRVCn68V9iYb2mo9H6KU0Guwgmk0zMCRt/JvsFXQFlSFxeqiAGgpLkfRV9/BVqq+wR8AWJTJ47W2SjoC+ETGiAhEZHg+nLI5/5hyYQS5SvB2wKVVZUKfryWNq3+TvB7NaDeAL9qMZhzd9JzoGOFG+wWAraQMRYuWwI420VE8MiRJNAVppu5rJ4odNVzyetMm/S4APE70VkAAaG6i1wC+aCmVLpaSB52jUBLts1nycHjJM6JjhJNYA4Bo0SkCZSspQ8nCpaJjBIXb7aIjqIoxq4vHa46i0rBYpT6pWy/RETCrUP27Z9SgcYN0W2Bjq+fZLHI6c91aVO5ZKDpGuIg2APD8glrF9DD4AwCLF/u+V23iMjM8Xmvysu1KL2Jjxf+daHQ6REfQBEdrK3hLi8frKTljFEyjD0W736SWwcqI1GQBoLXBnzd77vXPIjX3j19WUeeN8ngtnBomXdXJcyGkhGVHqSGQr5qXe16YaoyJA+z077i/jm56QXSEcKC9AkBrgz8AOC2e36dGdBX7i15NjEaj5PWWtRsVSiJedqc0oc8/ZLMKfb6W2KzS/6zi4j13tSTta2kuxNEl/xIdQ+8iDQCkf+uqSFtNPSrn/yQ6ht+a7Z4X+hmiNbsEI+RiBkuvmLaF0cK0noK3AgJAUR1tUfWF/ZD0eonEvmcolERfausWwFp0SHQMPTMaAEifVasiZavWwi7VVUel2jTzT1gsU+9sj9e8/ZLVm6uz+4qOgB/KpDvdERfb3gOS1w0tmt5oJVTB9ldFR9Azg2YKgJIFS9BcWSU6BpGRMcLz9jfbvvDrFBbFxP6r2dbseXEb+YOjTXoLcnSC2AOetKzZegQVO+aJjqFX2igAzL9tV22Tn1CINmlqGYZsotI9v/d2hOF2ycndxQ4cswtpIaCv7IfzPV7rQK8AglK86wM4bHRMtQwMqh/8bSVlqNy5U3QMWUV0ThUdQRUiz/T8i7ItDGd/YmPFTh3XOsKv6AqU/aDnbWtMBY2dNM3UisIN/xadQpcMAFR9Fm3lkuWiIwTNUSY9eEWOHKZQEnVjkZ5bJtt37VMwiTpc0dFzUySlrCs8KjqCJjTbpDt6RjSLP+RJy+rKl8FWUSg6ht44VV0AVC5cBrvD8x56rWgqKpG8zkyeB75wYfQyGdVaF35HO/fpLL6L3HZr+PRekFN0clfRETSvdPdnoiPojXoLAFtJGcwl0gOnVji87FyIoW6AiExOkrzuYAoFUZluUTFCn19pMQt9vlY48qV3TMR3p0OBglVfuRy2ctqZEkJOAwBV9vys+nWN6AghxSV62NMrAEieACj1z07vru3VT+jz5xR5XtxG/uAoLJa8bjBFKZRE38r2fyE6gp44DABUN8dev3kHWpv0teqzeb/nFdURabQI0Njf84p3h8QKa72LFLwVEAC4XZXfEVTFGUZtqkWqK1uGtpbwaQgms1bVFQDc7kD1th2iY4ScrUm6XWhsakeFkqgTg+c5/raK8NsBcNzkbuL3kH97jLqxedPskC6SWIvYVzl6Urn3e9ER9EJ9BUDN+k2iI8iCe/kFEXXheQol0R7eGL4Vf3yc+PUhFXZqCBQsIw/vAj+Uyvd9IzqCXrQaAEjvX1GQs6kZ9Qf02fHNukN6G1tkDH1D8ISHeUe6ccmdhT5/R3GR0OfrQYQKznbQC2dEA2pytb89XAWaDQBU8/Wqbscu0RFkY2fSmy3iLjxfoSTqZJRY6Mdbw7shTb8uYvsBrDPXCH2+HhiiaBFgKNUX6GuRuCBN6ioAduu72UvjAc/dwgzxcTDFhO/JgEapXghhvAsAALoK3goIAPVejrwl0iKiaAYglOqraAYgBNRTANRu0d/Cv1O1ePklGn/ZRQolUSHmeRFguPYAOO76Xv1FR8DXRXQuQDBMCdJ9Loj/Knf9IDqC1jUZAKiitLfs1Pe3fwCwejnRLrZT+G4HZBInARrCfAYAAIwSBZISHPT/A6Iylgr9f2mUmVUVBYCtpEwXLX+9abU1gTs8Hx0aM26scmHURqIAiFD/mVWy+1NXsdsBf8g7KPT5hJyqvmqF6AhaZzUAEN7rs9FLG009adi+W/J64lkjFEqiIZF0XHIHwe2ii1tVs1lIk5wt9M9PDrW714uOoGVmAwDhLazq9+4XHUExreWVktdjcsS/7xWBt3qeAWJhvDjyuEuS0kRHwOGKctERNMvRZBEdQZeaQTNTQag3AKgTmaDxUHi1efV2wFHCFRcjIgzft0q1mzXExSqYRJ0GZmSKjoClNWWiI2iWw0YFgBxqttFrgCDUCZ8BaK4Jvz3Gli3S/Q7iLzhboSTqYeee+yRE9OymYBL1yogUOxPS1KSKDUOa5GyxiY6gS62R4fP6WAb1BgC1IhPU7ZB+J65H5lLpWYCkKy5VKIl6OCVWuRslTgoMJzf2Fvt66OvCI0Kfr2bRRqPk9TaHvg43U5PaPbQOIEC1BgDVop7eVlMvuf9br2yl5XBaPX+bMvXNhimpg4KJiBZESByYpASb0/MOlnBn8PLva1ts+M10KqWZ67N9vAKqhRYADflHRT1aOG9nHqRce4VCSbTBKHjwUwM1nAy4OJ9OBmyPsXtX0RHClt0qdBmbloktANqqhL59EKp2y3bJ6wnjx8HoZVpRT7ydlhjZMVmhJOrVIT5edAQcaaap7PYYs7t7uSP8FvYqpf7gb6IjaNXvBYD0STUyaSgI4wUcjMG6Y6/kLSk3Xa1QGPEcXnpBRJ4xWKEk6ja2g9hukUV14Vu0B8N67IDoCLrliKLtqQFwAqg2MsYcnPNqAIpuNOYt+u/8503dvgOIP2OQx+uJN16N2m8XwOEUUp+FTHRkFIzdMmEaNgiMMTDOER0dDZYYD2YyAUaj129QhmTqpQ4AgzOzsKpB2KQd5pcV4l/Cnq5eMbHSBzY1VRwDaDerbJyOVhiM1DDMD9WMMcfxOeZyKFwAWHdTA4cWiwVNx4oQ28Pz+8OUW65D5TffK5gqOKaYGMRfMhqmxATEDsnxYWrUN1Gm8HkdIkX0VkAAaLXZEBkj/oRCNTH27yN5vS2WvqXKqeHQDiQPPEt0DC0pBwDDif9BSXbQimIAqN2+U/J64g3jYYoW/0tfSuKo4eg85Rb0mvURun/xATredgsSr7syZIM/AEQN9TxTEk5uzO4nOgK+oe2ApzH17unxmrNNen0LCV6rpUJ0BK0pB4DjX6tKlX6600a9sQGguaLK+yzA5JtQ8elXCqbyLq57V8SPPQ8J48cp8rxQFhNaxgwGMIhdUtbQZhf4dPUxmkyS1xv2b1YoSfhqixH3WkyjSoE/ZgCKlX564z7aTnRczcYtktcTLrsIMV6mGJWSOGo4erz+HLq89aJig/9xMXFiD8RRi1sFbwdcVRBe7bu9iRkyUPK6rY1+1xHVKQb+mAGQbk0nA3oF8IeWunpYd+yVXBCYNuVmFDz7qoKpTpY4yViSBwAAIABJREFUchhSbrkeRomZCrlFjTkHtiW/Cnu+WiQL3g64p1H4AaKqYsruIXmdc1rwrAZtNfWwHDkKp5eWIvGJKYjsp/sZxxLgjwKgUGAQAqByw2bJAsDUtxdSL7sI1cuUPfwiulcPdL5jEkwqmIGI7JAoOoIqnJ/YEdMFZygzN6BLInWrBIAYL10Aa3etBaTfEpAgcS/rLGq37EDt1h0+fVYtAKwAwDmSBvaHMTYWHUYOBTMYvPykphQCf7wCULQAkDr5LVw5DUD1inWS9yTdMxlRXZU7Fa7z7ROR9cbzqhj8ASB21HDREVRheJb4w5HmFtNrgOOiL75A8nqrKXw7nirFbpXhTDvGUH8gF9XbduDIfz9H2fwlsO7RTT+HQkDQDICjhFZstqc+9xAS+vZCVFYXj/ekP3gXCp55WdYcUVkZSH/wLpj6ZIfk89qam2DO24XWpkq0RZ/eE93QGgejIQ2xXXogtovn1dTGrAwYGYMjDI9LPlW6KQrl9hZhz+d2WggIAKboaLCICI/Xm8po8FcCV2BhamNZORrLymFY8xuSRg1Dypma/kLyRwHAGDO7mwEp0masrZK6iXlStXkrsrI8dwA09e6J9IfvQ/n7H8vy/MQhA5H23N8D/nmHzYqag8tgb6tA7Z71sPtzXOcBoFPvCeh21iMeb4k9awTMG7cGnE8vJmT3w/RccSdpzj52GI8MHSXs+WoRN+ZcyesNpXRSnd44DUDt1p0wb96F1DHnIn6Q+K25fqpmjJmBP2YAAOAYFCoAmhi9AvCkuaIK9Zt3IGnUGR7vib/gbKRs2OLzOy1fpY67EEn3TvH751rqq1BTuAhV+36Ew1n5x4UAGnPV5P4sWQBEZ3enAgAAIsS+j6y208I2AIjq3Enyuq2BZgD0ymHgKF+7HjFHjqDzmSNhzFC0l14wjh3/X078LUIv9VSietsOtBSXSd6T8tRDiBkYusqzyxN/9XvwbyjYhryfnsXexdejbM+Mkwf/ADkjGtBSX+Xxetzoc4J+hh7c2lX8yYBbi2ntcPylYySvNxRIr+shoWGKF3dYmK20HMcW/IimY0XCMvjp97GeCgCVqlzn/YSrzBefQlSP4BeEZU59EnF+LLCzlO/EgSX3IW/dI2ioWR30809Vd2Slx2sRHVMQqYJT8UTrmJAgOgI2mMP7jPuYhAQwiS6dtsoiOCPp9EQlGLy0yPZ22mgolC79BdXzl8n+nBBotwCQPqCeKKqlrh6V83/yel/ms48hslPHgJ+T8Y9HEZPT36d7mytLcHjJMzi0/K9oqtsf8DO9sVRKt0eOv+Ji2Z6tJecmpgh9fp3VKvT5osVcfpHk9bryXxRKQrxpK1emU2B9WQlKFixR5FlB+H2sP7EAyBMQhEgwl5V6nVYyJCUi85+PI9LLu8j2pF5xCWLPGOLTvVV7f8S+ZRNhrlvr93P8Za5dI3k98UzP6yPCyQjB2wFnFYb3r4yEEUMlr1vy9yiUhHhjK1Vu55mttFztRcDv/+KeWABQv0oVKl36i9f1ABEZ6ej61ot+rQlIHjoISXf9yad7Dy95BoW73gAMym2/q9q7yOM1Y89uMMXR2aqdTVFCnx/OmzFNUVEw9erh8TrnHNZG6RbfJHQMrdJtwu0GZY9UV3kR8PtY/3sBwBirhLsJktyiued9s+R05UuXe22exKKjkfniU0gYNMDr50X3yUbHfz7m9T5bZRH2L7xTkW/9p7JUSL8GSLjyUoWSqNfNPfqKjoDv8nTTGMUv8VdeInm9ctd8hZIQADAZ00VHOI2ttBy1Sz2vZxKk1j3WAzh5BgAADiqRwBTAdHU4sztaUbrkZ5/u7fzCE+h0/XiP140A0u+7zevnNJXmI3fZg7BZDvsaM6TqyqUX0ySec6ZCSdSLmYzeb5JZaWt4nurZ4eyRktetVdIFLAmthOzBHq8psQDQk9pjR2ErkZ7BVdhJY7yQAsCYSQWAv2yl5SiZ79uUUoc/3YDuU5+CqZ3V8qkP3Amjl50DTWVHkfvLQ2gz1AWUNVSq9v7o8ZqxawbivRzCEg4mde0l9Pm5Zar65aYIU0K81+Op6yuXK5SGAECkxIJY2x6xb7dLFi6F06Ka3SCSBYAiq1aYUfw3Fy2ylZWjfrFvU0qmnH7oPvN9dDz/7N//u4TBAxHvpW95S10lDi1/FE5jQ1BZQ8FcKv0OlXoCAKmCtwP+XBd+bb2TvUz/V+yYp1ASAgCGVultwc0OcS2zjytbEfrt0gE6aYw/tQCQb28XCYnqwqOw7Njr8/3Jj9yHHm9OReLIM9Dx7lu93n9sy1S0MXXs766vWg6nxClfCVddCqO+Tujy26gEcQ1QjrM2qubbjSLiL5fehlpPzX8UFd9Z/buCbKXlamkUdNIYf+pvT99HliCZGM0CBKpi42Y0FRb7fL+xZzekPfUQjJmeDxkCgCNLX4S1Slx/+fZU7vpB8nrCNZcrlESdzu7aQ3QEfB1G2wETRw2HId7zinNbZTGt/ldYXJb0aaUtuepox1z1iypmAU4a408qABhjpQAU6ZgQlyN+BbOWlS7+OaSLSxpKNqG+Vn2NSypyv5G8nnTh+QolUa9UUwCHLoRQM1d2i5VIyV4KztpS1W790i2jQ7oRWqNFhqOCA2B3tMKyVegXrGr3GP+79uZPFUloiBa7h1kPShYuDUkRwNvakL/8pRAkCj2HsxKNRZ53IkRkpCPRjzbGejSxh/Q3ILn9mB8eLUSiM9Jh6id9BkPlzu8VSkOOS+nvuSMjb1XXsdW123aJfPxpY3t7BYAi+1dMBnoFEAolC5eiKd+PI3fbcXT1a3BGiF/050lF7teS15Nv8LztMRwwk0no8482Nwl9vlI6XCXde6Jqz0I4TeHdHllpBnsijLGeF8Jad6lrWZvdaUfjQWGvzE4b29srAEJ7xqwH8UO8N6whvildtjzgqSVbRSHqytR9gEVdxS+wWz0XKKZePZAwzPM+YL2bKHgrIAAcq1Gm17oopoR4JIy7UPKeikNzFEpDjkvOlj6N0Q71vZ4yHxQ2Y3ba2N5eAbBdgSCqaGKiJxVbtqJuvv/v8Et3fSZDmtCrOvKd5PWUCdcqlER90hISRUfAwgpVrHCWTcpN10hetxzdh5bm4GbiiP9iEqRfyVh3q69TZWNZudfOrjI5bWxvrwA4CECROb2kfrQQMJRqyor86j/dXFWC+iptNCwp3/6t5HVT32wk+HiwkR6NjE8S+vxWm03o8+Vkio9Dgre9/wdnKZSGnCh14BWS11tV2qmybqfiiwGb0E6jv9MKAMaYEwrNAhgSpA9wIP47fggFd7R5vbemeLECiUKDRzaifPtcyXs6TrpeoTTqc063HkKfP6vwiNDnyyllovTfq6aSI2jwcoIlCT1TWwYiojwfCmbZuU/BNP5xVCjea2W7e2w/iacuKltlDgMASMqhdQBysJWWo2b9Jq/3Ve7S1orlsj2fS1439uyORC892vUq1Sh2K6BVomGTlkV16YyEyzyvMgeA0j0zFUpDTpQ6THpLZmuTehtUmYsUf2XW7pjuqQDwPnqEgCE2GiaD2BXMemWIjZG8XrN/heZWLDuNDajwss0q9b7bYQRTKJF6TOwudisgAKw4pr9ZgLR7p0hebyw5goaaVcqEISdJ6XKZ5PW6nYp0tg9YW51Zyce1O6Z7KgA2yxjkJAnDByn1qLBi8HJYe6NZXR3/fFW661PJ64aEOHSccrNCadTDECV2BgAA9jYp+gtNdglDchA1eKDkPd7+PhJ5mAxpiO6U6fG6o6QSYOr+ItCQp2jB3O6Y3m4BwBjLB1Auaxy3xC7S7WlJYOK7dZW8XnNQ3Vv/PHEazSjfJr0gMOGayxDVpbNCidRjQlZPoc8vNau3l0QgOt52i+R1a+FBmOvWKpSGnCit70TJ6+bSEoWSaEK5e0w/jdRJKhtlCnMSY1Y6vQaQgTE91eO1ltpyOE0WBdOEVunuj9HWIr26N/2BO5QJoyLpiR2EPn9esTp6rodCp5uugbF7luQ9xfveUSgNOVXa0Oskr1s2K9LPLihOm2I7FDyO5VIFwHoZgrSLXgMoq+6otr+18MhmFKz/l+Q9poH9kHTWCIUSqcOwOLEFAAA4W1pFRwhaZHISOtwiPcBU7f0RjbXqXWWuZ0lpl8Agsei1pbgMdm/vQFXAnntMqUd5HMulCoANMgRpF+0GCC0Tlz4iV8vf/o+rK1uGpjLpb5ypf/8LTPHSZ4Xryeju2aIjYHah53MbtKLLo/d7vad4+4cKJCHtSR8wWfK6Jf+YMkGC1OhQrHeGx7FcaqTYCoUaAhlio5GYTmsBQiW6c5rkdfNhoQdShEzx7ne93tPl8T8rkEQ9UoxiX6dV27U9A9DxvLNgGthP8p6ilR+p+uwMPYuNzUFclnT3v/p96uv+J1ATJLb1eywAGGOtUHA3QPyZQ5V6lO4ZM6ULAFuDPk5vs1RvQ03uz5L3RA4agI4XnKNQIvEmdZP+5Si3zUXabYcb1aUzkr18+28q/f/27jy+qvrO//jrmw0IISQBQsgGAoIIiOBKqdYNVBTROq32V9s6ba3Oz6p1HMVKx6qtdhs7rXaxtr+2P2vbqdPpokjVurTWKiKoIHUBjBbIQkACSUgCJPnOH+fGUprcJbnnfM+59/18PO6DPzg5501I7vdzv2sdzQ33B5RIDjVuxvvj/n3bC5nx4SaNVsfa8n7F7yuGwLa3KqyuZFhpaVCPy2gmNzfu3/cOi/4QQJ8tz3+T3gSb0JRefRnDp7ltGIPi+pjt59tanD5/KCo+fVnCa7Zq4p8zBQVVjD0i/tr/3W/2O9k9m8VtwxMVAE+lMUhCZfPUCyCp6c3dw1tP3JbwuorLPpIVGwRdWOV2KSDAzrbo7Qcw/pOXkD8t/hyKHa88SHtzIIelSj8mzP543L/vrG9kX0t0CtCcYA4qjNuGJyoAVhHQPACAkdMmM8zxUiaJnt07nqRte/w35rxJNYy/5fqAErlTNdrtoUAAP9sarR0BRx01M+F2v53NW9my9usBJZJDFZbMSPzpf3W0irNC/9u6DhIs549bABhjuhLdIN3GvOe4IB8nGeLNx25OOBQwYuYRWTEfYFah4+OBe8J3BvtAhlVXMv7fr0t43da1X4f8zDzvIApqZsf/PzqwbTt7mwLZuy5t8qfW+v2IVbE2fECJegAAAj0vtvCwWkZUVgT5SMkAPTkt1D16c8LrSq++jKIEs7yj7tRJbpcD/s9b0ZhkmpeTw4SrP5XwuuZXHqRt1wsBJJL+jC47maLaI+Je07ImWp/+AUxent+PSNh2J1MAPJ6GICkpO3Zu0I+UDLCn5Wl2bXoy4XUVty5jWM3A+4hHXUmu26WADSE9g/1Q4//938g7LP6nsI6GOrau/2pAieQf9Bqqj70y7iX7tjXR2tgQUKD0SbRfSxokbLuTSbAG2DX0LMkbUTWB4om+d49kLLs//lrsvI7M3XPhrdU309GQeCbwhM9cQV4IDtDxw8W1U1xHYEPDNtcR4prwb59mxKz4nyoB3n4h8QRT8U/1rM/EPfQHYOfaFwNKk14j5/i6Ad4u4qz/75OwADDG9OKgF6B88RlBzZLMOAc2xz9rurDSfQPhp7dW35LwmrzaKqo+dx2+d8I5UDAi/lHQQXhy9w7XEQY05vSTGXnCvITX1T30ZTrbNweQSPozsmwm4+deGPeazvpGOhuiNfbfx+cTPB+Ptd3xMyR5s98NMcygVCxZ5OKxkdee4FjWkTXTAkriRtfeOjat/GzC6/KPOJwJn8/MlQEXVE1y+vy2vXudPn8gZcfNpTSJg6L2bF1FS+sK/wPJgGrnLEt4zc5n+j3mPvRKZvg+DympNjvZAiD+dms+KaytZmSFJgSmW26P+6Vifmtt+RMNq36a8Lphs2ZQdcsNASQKVrXj5YA/3RK+T86ls2dSdsNVCa/raHiLzU/cFEAiGUjNrH+jsDL+ZNa2NevZtyvQ0em0GTbK95U6SbXZSRUAxpgGwMn5ihMuWExBvtvdzaKot23gT2Blh58eYBJ3Gt/8bsL9AcBbHphpRcCRhaOcPv+ADddpbKUzZzDm5sTL/QDqnlsO+dE+0yDKikcvSHjcb29HF9tfSDjEHVqjjpnt5+1fjrXZCaUyDXHlIMMM2biz42/SIf+o9bWBl2LlF43Oil4AgI2Pfoa92xJ/Gs20IuCMSe63Pn7wzTdcRwBijX+Sm0BtXHED+7q2+JxIBpLHGKaefXvC6xofS7zaJ6xGH+b7bp1Jt9WpFAAPDSJIWoyomsCE097n6vGR1Jtg19txs84NJohruT1seupaunbUJ7w004qAUblupzi+vS+wTUQHVHr07KQb/y1PfJu2PYGdgi79mHryf2AS/Nx2/HUrnY3RnPgHUDQ78eqTIUq6rU66ADDGrAKaBxUnDUZOn8KoikpXj4+c9pc2xP37USXvDSiJez05LdQ9tzzhToHgFQE1n78+I84N+D+OlwPW7XD2dgF4R/uOWX5tUte2NrzAjqaf+5xI4jn81P9kZM3hca/p7dpHw8NOpqSlxbAxZYyo8nUZdnOsrU5KqjsROJ0WO/6Cs7RLYJL29xzAHhi4wSuePIvc3uwYBgDobNvMpieTawyGzZpB1Rc/S/6I4T6n8pfr5YAP73C3OUv5xe9PeLRvn/Ytr7PpqeR+NsQf5ZWXUFyZeBv4xkefABPd4rxs3tF+PyKlNjrVAuDXKV6fdlVLFzN8wnjXMSKh5eX1cf++/Kj4a2wzTXvzS3Q2J7dBTf70qVTdvpzhUyb5G8pHF0yY6DoCXR0BDwNYS9UtN1B8YfJDXG8msYW0+Ke0eAk1p16R8Lq2ta9Eds0/wPBxYxk5dZLfj0mpjU61AHgSaE/xa9KuavEinRqYhH318X9Zxk+/KKAk4VAy7jRGlFcnfX1eTRXVX76ZUTN9H7PzRU1pmesI/DzAkwHzCwuZ+MWbGJHi/9eUs74IBzJzV8iwGz3yNCYvSbzev7O+ke2ro30ew5j5vh90147XRictpQLAGNMBPJLK1/jBFORTuXghBYUjXUcJtb2NTfR2DLwve+7wQsbULAkwkVsTZv3zoL5u/C03MPb0k9OcJhjTRhQ5fX5bEvMu0mHEkdOpuftL5B8Rfwy5P0U105h+xt2JZ85KWo0aPZ+p5yfearl3336aH4zuuD9A8YQqv8f+AR6JtdFJG8xpBP89iK9Ju9zSYqovXKKegAR2/+W1uH8/4aiPB5TErZJxp1FYOfjlNyVXXErVLTeQl5ubxlT+O/Mwt8sBf/+W/xsCjTn5PVTduoyc4sHvfVBUPZPpp96jnoCAFBeewrRzv5bUtY2PPM4BenxO5J/83hzKzz8ziEel3DYPpgBYCbhf3wPkFBVS/cGlmhgYx+7V8TfCGVYyjorDPhlQGneq5iY3ISyeETOPoPqrtzAiQscJu14K+HqnfyOGefn5VN1yA6VXpefnt6h6JtNPv4ecA243Ucp0paPO4fALvpjUtY2//l2kx/2BoBr/DgaxV0/KBYAxph1HWwP3x+TnUbV0sYqAAfTmQNuL8ZcEVr3nUnLtmIASBa9q+tUJTxRLVl5tFVW3LmPsOdE4p+JDNe43BNq6Z3fa7zlq1gxq7/mPlMf7Eymqmcb0Rd8hj7Fpva94xpZfxOTzEp/TAdD6x+fZ29TocyJ/lc+aFUTXP8BjsbY5JYM9kDh0C2arli6mpKrGdYxQ2vX82oTXTFl4i/9BHCgsmUHFsR9M+31LLr2YibfdSEFpuJdSDi90fzLgr+vfStu98oyh4lMfY/znrx9Sl388hZWHceT591FUPteX+2erKe/9ChMXJj6LoU/b7nd8TOO/EZUVFJ90fFCPG1SbPNgCYCUhWA1wqLHnLaTyrDNcxwidA/TQtnpd3GtGjZ9LWcl5ASUKTu3RN/p27/wZ06i99+uMOT3cu1SeNz75lQ9+6O3al5b7jJozk5q7vkTRQv+/3/kji5m+8G5GF2fHuRl+yu0pYfpJP6Bk4oKUvi7KPbsjKiuoWro4qMe1M8it+gdVAMS6GkJ5VmbhYbXULDlbkwMPsX3tWmx3/BnZh51zQ0Z96pk4dzkjq/zfDa/0io8x8Y7PMWJGOI9ZnjjGbXf2z4d4MmB+URGVN13L+M9dR25FeZpSJWfqklupneNfEZnpisbN83pTagc3VBPFIiDgxh9gxWC6/2HwPQAAic9adWRY9QRqPnwho2trXUcJla7tOxJeM3HeTeT2lgaQxl+lo85h7JFnB/a8/MMnU3XbjYz/5EfIKwjXTPIpw90ul93VfWBQX5drLeUfej8Tf3QXhXN9PT0trnGzzuWI9/2YggK3PSlRM2Hy5UxfdBcFxUPbj6Jq6WKKKwIZRx8yB40/DKEtHvTCV2ttAVAP4Z4t01nfyI5Hn2L/voHXw2e6ERMqmLDoNHIKk9vadu+2zbzx+yuxBQMfKRxmReVzmb7wbqcZ9tz3ADsecr5lxrsO/+WPnD7/R8efwntrk1+GWTz/OMb+84fICdkci7qVd9DS4uxg1EgoKKjisBO/QFFNenvE9r62icY//Cmt90yncUccyehTTwz6sTuBKmPMoM6vHtLOF9bau4FPD+UeQXnnuRdoefkV1zEClU8u4849g8Ka1GfAt9VvYOPjV0He4D69uRKGxr9Pz85dvPOTB2h9drXrKMz51X109LpbS33VkUdz9ZGJh5eKj59H2QeWkjcpvBN62+pfoe6PN9NtE/eoZZux5RelNNEvVfu2NdL87PPse2eXb89IVU4vTDj/7KBm+x/qW8aYQX/Dh1oAHA88P5R7BKln+zvsfHY1bRFfWpKMsmOPpuy4eUO6x96tG9n4xNX05oduvme/wtT4H6y7vomWX/6WPc+4+1X56ppn+f7bbzh7/kU1k/niCQNP3iuefxxlFy4hb2J0utm3Pf0Dtm/9sesYoVA0bh41M6+hMIA5NwC7nlvDrgRnnQRhZEUFFecuwuQ722/jBGPMoD9hDHnvS2vtX4Ajh3qfIHXWN7JrzUuR32CiP6VzZlF2/DxMXnp+IDsa32bzH/6VA71uj3ZNpLj0JA5f/CXXMeLq3d1Ky4pHaXvoUbp7ewN99l2vvsTdr74c6DMPtemf/n4r5rycHIrPX8zoRaeQO8b9uQWD0dm8lfq132XPrqddR3Ei15ZRfcy/MHZGcPNt+vTs2MU7f15Na2Pwp04OKy1l7EknuvrU3+dVY8zModwgHQXAjUC433kH0FnfSOvqdbQ1uTu2NF3Kjp1L6ZxZmIL8tN/bWsum391AW8tzab93OlRM+iRVCy51HSMlrQ8+wu4Vj7G/Jf2b5PSnbmczZ/7h4UCeNZCNF3wUk5vLyKpKis44mVHnRmMzpWS0b91Iw7of0LbnWddRAmH2F1F19GWMn+v+RNHubdvZ9dI6Wrcld9LnUAwrHk3ZvKMYOSP1Myd88FljzJeHcoN0FAAVwFbA7Z6jQ9DT0sruNzbS8pL7LqVUDBtVzKhpUyg5Ppile82vPMjW9V8N5FnJyO0tZcqi2xg1PrpLFw9sqmP37//I3if/RLfPZ9G4nAi4oKqWuz53M0edtSjU4/tD1bblFZo2/IzWlvBOVhuKnO7RTJh1KRXHfMB1lH9g9x+gZd0G2te9yv4D6dl7os/oqVMoOnKa60/8B+sGaowxQ+rGTstbjrX2ISD5A7hDrH3DG3TUvU1rfb3rKAMqPXo2RTXVDKsO/oexc/tWtq39jvM3uNLxC5l8xuedZki3tkeepPMvr9O6ao0v91+04he81RXcMR4LKms4/UMXsfziSyg4dk5gzw2DjoY6ml79CS3bf+86SloUFFQzftpFlM+5wHWUpPS0tLJn85t073iH1r9uSfnr800eo46ZTUHhSIpmhnJ/jxXGmCEf5ZquAuA84LfpuFeYtL2wjn2te9i90f8TzeLJtzmMOm4Ow8vHURiSSVJ76ldTv/a7dLZtCvS5xSXvpXLOJxlZ7X6Pez91PvoUe7fW0/7UM3TvH9QKn38QxDyAZSefwfBTF7D8ko+RP3Xwpy9mip79+9ix/jdsf+NndBOxrW17DWU1Z1M+9YOR/32z1nLgtTra97YOeE2+zaFwykRyx4Rr6ekAlhpjHhzqTdJVAOThDQNEa8umFHQ37aR161Z6W9t8LwjyyaVo7kxyc3IpnjOTnGHh2ljmYHvefoEdr/+GPe/80dfnjB5zChVHfoSi2uicxJcu3dsa6Xh+Dfu2NbB31Vq6E+zoOJDvv76er25IfC5EKm48ZRHD3jefZfPfx4gzT03rvTNNR+PbtDQ9RvMrv6U3d4/rOAMqKT+DUePnUn7UUtdRpH9NeN3/g3sjOEjaRh2ttbcDN6XrflGw/423aW9tAaB3bwf7N/6Vjp4kNxyylqLRZeRPro7N2LcUT5xEXnk0Z0Pva2nmnS0Ps3PDYxxga1rumWfGMW7WEsZULWbYmIytLVNm9+2j6w/P0rmnle76Rg68uJ7OrsQ/dx0de5mz8oFBPXPBhBreN38++bNnsKCyhlPPPDNSS/bCpnP7Flq2P86eN9bSsT/+OR1+y+0tZezMcxiWX8242Rkxkpvp7jDGLE/HjdJZANQCbzG07YUlA/Ts38c7r62k27TQsuFZuuzrSX1dwf5JlM5+D/k55ZRNW0h+kc5zSIXt6mL/mnX0NO+kK9ZLYLu76alvpKdhO3b/fu5e98LfvsAYyM/DDB9Obk0luePLIcd7S7hk6gyqa2opmHcUOaPcbiWcDfa8sZa9+9bRtbOePVuepTe/zbdnDWc6pbMXkGdLKTv8DPIK/TlVUXzRCxxmjEl9YkM/0jrv2Fr7MBD4RsgSDQf27qGj/i16uryNhXLyChgxvlaf7kX6sXfbZtqbX6Ynzxu37ty+ha7mrfR07qU75x3ssM6//4IDBeR2lZA3ooj8knGMrJ5KTv4wzL4RDCuopmTmCeQLBRpdAAAPY0lEQVTkhXc4UZKy0hhzTrpulu4C4Czgd+m8p4iIiABwtjEmbYeMpH3lsbV2ExDtKaMiIiLhstkYk9YdiPwYr/+uD/cUERHJZmlvW/3oASgB/goUp/veIiIiWagVmGiMSeve4WnvAYgFvC/d9xUREclS96W78QcfegAArLXTAHdnj4qIiGSO6caYjem+qS9r9mNBV/hxbxERkSyywo/GH/zdtOdOH+8tIiKSDXxrS309gNRa+zxwvJ/PEBERyVCrjTEn+HVzv7ft/YrP9xcREclUvrahvvYAgDYGEhERGYS0b/xzqCAO7vlaAM8QERHJJL63nUH0AAwH3gQq/X6WiIhIBmgAphhjkjxffnB87wGI/QO0IkBERCQ5d/rd+EMAPQAA1toivF6A8iCeJyIiElHNeJ/+2/1+UBBzAIj9Q9QLICIiEt+dQTT+EFAPAIC1thjYhHoBRERE+tMMHG6MaQ3iYYH0AADE/kHqBRAREenfnUE1/hBgDwC8OxdgE1AR5HNFRERCrgnv038g3f8QYA8AvDsXQPsCiIiI/L2vBdn4Q8A9AADW2kK8o4Krg362iIhICG3DO/K3I8iHBtoDABD7B34h6OeKiIiE1BeCbvzBQQ8AgLU2D/gLMM3F80VEREJiIzDTGNMd9IMD7wEAiP1Dl7l4toiISIgsc9H4g6MegD7W2ueAE11mEBERcWSVMWa+q4c76QE4yPWOny8iIuKK0zbQaQFgjHkGeNBlBhEREQcejLWBzjgdAgCw1k7FmxBY4DqLiIhIAPbjTfzb7DKE6yEAYt+Ab7nOISIiEpBvuW78IQQ9AADW2jLgNXRQkIiIZLZmYIYxZpfrIM57AABi3whtDiQiIpnuC2Fo/CEkPQAA1toc4CXgKNdZREREfLAemGuM6XUdBELSAwAQ+4Zc5TqHiIiIT64KS+MPISoAAIwxTwP3u84hIiKSZvfH2rjQCM0QQB9rbSXessAS11lERETSYDfesr8G10EOFqoeAIDYN+hW1zlERETS5NawNf4Qwh4AeHdC4FrgaNdZREREhuBl4Jgwjf33CV0PALw7IfAy1zlERESG6LIwNv4Q0gIAwBizBviG6xwiIiKD9I1YWxZKoRwC6GOtLQFeAapdZxEREUnBNmC2MWa36yADCW0PAEDsG3e56xwiIiIpujzMjT+EvAAAMMasRHsDiIhIdNwfa7tCLdRDAH2steXAOqDCdRYREZE4moA5xphm10ESCX0PAEDsG3mt6xwiIiIJXBuFxh8i0gPQx1r7C+CDrnOIiIj04wFjzEWuQyQragWAhgJERCSMItP13ycSQwB9Yt/YK13nEBEROcSVUWr8IWIFAIAx5lfAD13nEBERiflhrG2KlEgNAfSJbRC0Dqh1nUVERLLaFryu/1Cv+e9P5HoA4N0Ngj7sOoeIiGS9D0ex8YeIFgAAxphngDtc5xARkax1R6wtiqRIDgH0sdbmAc8Bx7rOIiIiWWUNMN8Y0+06yGBFugAAsNZOBtYCJa6ziIhIVtgNHGOMqXMdZCgiOwTQJ/YfoF0CRUQkKNdGvfGHDCgAAIwxPwbudZ1DREQy3r2xNifyIj8E0MdaW4Q3FDDNdRYREclIG/G6/ttdB0mHjOgBAIj9hywBWl1nERGRjNMKLMmUxh8yqAAAMMZsBK5xnUNERDLONbE2JmNkVAEA784HuMt1DhERyRh3Zcq4/8EyZg7Away1w4E/A/NcZxERkUh7EVhgjOlyHSTdMrIAALDW1gLPo6ODRURkcJqAE4wxW1wH8UPGDQH0if2HXQREdpcmERFxphu4KFMbf8jgAgDAGPM0sMx1DhERiZxlsTYkY2XsEMDBrLXfAz7lOoeIiETCvcaYy12H8Fu2FADDgT+hQ4NERCS+NcBJmTjp71BZUQAAWGsr8U4OrHWdRUREQmkL3gl/Da6DBCGj5wAcLPYfeg7aKVBERP5RK3BOtjT+kEUFAIAxZgPwCdc5REQkdD4RayOyRlYVAADGmF+ilQEiIvI3y2JtQ1bJmjkAh7LWfhO42nUOERFx6i5jTFaeIZPNBUAO8FvgXNdZRETEiRXAUmNMr+sgLmRtAQBgrS3GWx54lOssIiISqPV4y/2ydmJ4VhcAANbaCryDgya7ziIiIoGowzvgp8l1EJeyvgAAsNZOxisCdHCQiEhma8Jr/OtcB3Et61YB9Cf2g7AQ2O06i4iI+GY3sFCNv0cFQExs/eeFQMZv/ygikoW6gAuzba1/PCoADmKMeRL4GJCVM0JFRDJUL/Cx2Hu8xKgAOIQx5gHgStc5REQkba6MvbfLQVQA9MMYcw9wnescIiIyZNfF3tPlECoABmCM+Tqw3HUOEREZtOWx93LphwqAOIwxdwC3uc4hIiIpuy32Hi4D0D4ASbDW3g7c5DqHiIgk5Q5jjHpwE1ABkCRr7ZeAG13nEBGRuL5sjPms6xBRoAIgBSoCRERCTY1/CjQHIAWxHyyNKYmIhM8davxTowIgRbFxJU0MFBEJj9s05p86DQEMkrX2JuB21zlERLLccs32HxwVAENgrf1X4E7XOUREstR1Wuc/eCoAhshaewXwbTScIiISlF687X21w98QqABIA2vtB4H/Dwx3nUVEJMN14R3so739h0gFQJpYa08D/gcocZ1FRCRD7cY70len+qWBCoA0stbOAn4PVLjOIiKSYZqAhcaYDa6DZAoVAGlmrZ2MVwRMdp1FRCRD1OE1/nWug2QSTVxLs9gP6AJgvessIiIZYD2wQI1/+qkA8IExpgk4CVjhOouISIStAE6KvadKmqkA8IkxphVYCtzlOouISATdBSyNvZeKD1QA+MgY02uMuQZY5jqLiEiELDPGXGOM6XUdJJNpEmBArLX/BPw/oNh1FhGRkGoFPmGM+aXrINlABUCAYssEHwZqXWcREQmZLcA5WuYXHA0BBCj2gz0fWOM6i4hIiKwB5qvxD5YKgIAZYxrwVgjc6zqLiEgI3Is307/BdZBsowLAAWNMlzHmcuA6oNt1HhERB7rxTvO73BjT5TpMNtIcAMestScDv0DbB4tI9mgCLjLGPO06SDZTARAC1tpa4NfAPNdZRER89iJwgTFmi+sg2U5DACEQ+0VYgDYNEpHMdhfetr5q/ENAPQAhY629FPgm2i9ARDJHK3CNMebHroPI36gACCFr7TTgIWCa6ywiIkO0EVhijNnoOoj8PQ0BhFDsF+UYtFRQRKLtXuAYNf7hpB6AkIsNCfwnUOI4iohIsnYD16rLP9xUAESAtXYy3lLBY11nERFJYA3eEr8610EkPg0BREDsF2k+cIfrLCIicdyBt6WvGv8IUA9AxFhr3wv8FB0oJCLhsQX4sDHmGddBJHnqAYiY2C/YHOCHrrOIiOC9F81R4x896gGIMGvt+4Fvo22ERSR4TcCVxphfuQ4ig6MegAiL/eLNAR5wnUVEssoDeJ/61fhHmHoAMoS19mK85YLqDRARvzThLe/7L9dBZOjUA5AhYr+Qc4D7XWcRkYx0P96nfjX+GUI9ABnIWrsY+B5Q7TqLiETeNuByY8xK10EkvdQDkIFiv6izgW+4ziIikfYNYLYa/8ykHoAMZ609Fvg+cLTrLCISGS8Dlxlj1rgOIv5RD0CGi/0CHwNci7c/t4jIQHbjvVcco8Y/86kHIItYayuBrwCXuM4iIqFzP7DMGNPgOogEQwVAFrLWngzcDRzlOouIOLceuMoY87TrIBIsDQFkodgv+lzgKqDZcRwRcaMZ7z1grhr/7KQegCxnrS0DlgOfBgocxxER/+0HvgXcbozZ5TqMuKMCQACw1k4F7gTOc51FRHzzIHCdMWaz6yDingoA+Tux44a/BpzoOouIpM0q4Hqd2CcHUwEg/bLWno+3YmCa6ywiMmgb8Wb2/8Z1EAkfTQKUfsXeMGYCl+NtBSoi0bEN73d3php/GYh6ACQha20hcAVwPTptUCTMmvCG8O4xxnS4DiPhpgJAkmatLQL+L3AdUO44joj8TTPeJN7vGGPaXYeRaFABICmz1hbj9QioEBBxq6/hv8cY0+o6jESLCgAZtFiPwKfwCoFKx3FEskkDXsN/rz7xy2CpAJAhs9YOBz6KN0dgquM4IplsM94Y/33GmC7XYSTaVABIWllr3w8sA453nUUkg6wGvmKM+ZXrIJI5VACIL6y1p+ANDZzrOIpIlK0A7jTG/MF1EMk8KgDEV9baaXgHjnwUKHYcRyQKWoH7gLuNMRtdh5HMpQJAAmGtLQE+DvwLmicg0p/NwHeBHxpjdrsOI5lPBYAEzlp7Fl6vwFloN0rJbr3AI3if9h9xHUayiwoAccZaW4u3XenH0Q6Dkl2agB8C3zPGbHEdRrKTCgBxzlqbBywGLsPrFchzm0jEF914n/a/D6w0xnQ7ziNZTgWAhIq1tgK4FPgIcKTbNCJp8SrwE+DHxpgm12FE+qgAkNCy1h6PVwhcDIx1HEckFTuB/wJ+YoxZ7TqMSH9UAEjoWWsLgEXAh/H2FShym0ikX+146/Z/CjxmjNnvOI9IXCoAJFJi5w8sBj6EVxQUuk0kWa4DeAz4Od64vvbll8hQASCRdVAx8AG8yYPqGZAgtONN5vtv1OhLhKkAkIxgrS0ETgMuwBsm0DHFkk7NeN37vwaeNMZ0OM4jMmQqACQjWWtPBJbg9RAc7TiORNPLwErgIWPMKtdhRNJNBYBkPGttJd58gbOBM4Ayt4kkpHYBjwO/w5vE1+A4j4ivVABIVrHW5gDH4hUCpwMnoomE2aoDWAU8gdfwrzHG9LqNJBIcFQCS1ay1w/GKgFOBk4HjUUGQqTqA1cDTwFPAKmNMl9tIIu6oABA5SGzPgWOB9wAL8IoDnVMQTU14n/D/DDyL9wlfa/NFYlQAiCRgrZ2M1zNwAl5xMA/1EoRNB/AisAZ4HlhtjKlzG0kk3FQAiKQoNo/gCLxCYC7eKoOj0HbFQdkJrMebpf8SXsP/usbvRVKjAkAkTWKrDWbhHWI0G69IOAKtOhisXcDrsdcreIfqbNDsfJH0UAEg4jNrbTkwDZgKTAcmx16TUK/BTuBtoC72egPYDGw0xjQ7zCWS8VQAiDhkrS0Gag96VQHVQCXe5MMKvCIhx1XGQerFa9ybYq8GYBtQD2zpexljWp0lFMlyKgBEQs5am4dXBBz8KgNKgNLYn8V4ZyEU4U1Q7HsNBwoOeuXhFRN9L/Aa675XN7D/oFcX3gS7vld77NUK7AZaYn/uwmvw330ZY7rT/90QkXT5X61nJYqs538cAAAAAElFTkSuQmCC\" />\n        <h1>Login Error</h1><p>There was an error accessing the 'token' endpoint: <br><em>SSL handshake failed</em></p>\n    </div>\n</div>\n</body>\n"
09-12 15:42:07:868 [ debug default ]    [ OCC::BasicLoginWidget::BasicLoginWidget ]:    true
09-12 15:42:07:868 [ debug default ]    [ OCC::BasicLoginWidget::BasicLoginWidget ]:    true
09-12 15:42:07:870 [ info sync.httplogger ]:    "cc9d0d93-bd3c-4ec4-b803-13ded862943c: Request: GET https://ocis.ocis-keycloak.latest.owncloud.works/.well-known/openid-configuration Header: { User-Agent: Mozilla/5.0 (Macintosh) mirall/3.0.0.8522-daily20220912 (testpilotcloud, osx-21.6.0 ClientArchitecture: x86_64 OsArchitecture: x86_64), Accept: */*, X-Request-ID: cc9d0d93-bd3c-4ec4-b803-13ded862943c, Original-Request-ID: cc9d0d93-bd3c-4ec4-b803-13ded862943c, } Data: []"
09-12 15:42:07:870 [ debug setupwizard.controller ] [ OCC::Wizard::SetupWizardController::changeStateTo ]:  Current wizard state: OCC::Wizard::SetupWizardState::CredentialsState
09-12 15:42:07:875 [ warning default ]: setActivationPolicy 0 failed
09-12 15:42:08:018 [ info sync.httplogger ]:    "cc9d0d93-bd3c-4ec4-b803-13ded862943c: Response: GET 200 () https://ocis.ocis-keycloak.latest.owncloud.works/.well-known/openid-configuration Header: { Cache-Control: no-cache, must-revalidate, no-transform, no-store, Content-Length: 6537, Content-Type: application/json, Date: Mon, 12 Sep 2022 13:42:08 GMT, Referrer-Policy: no-referrer, Strict-Transport-Security: max-age=31536000; includeSubDomains, X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, X-Xss-Protection: 1; mode=block, } Data: [{\"issuer\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS\",\"authorization_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/auth\",\"token_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/token\",\"introspection_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/token/introspect\",\"userinfo_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/userinfo\",\"end_session_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/logout\",\"frontchannel_logout_session_supported\":true,\"frontchannel_logout_supported\":true,\"jwks_uri\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/certs\",\"check_session_iframe\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/login-status-iframe.html\",\"grant_types_supported\":[\"authorization_code\",\"implicit\",\"refresh_token\",\"password\",\"client_credentials\",\"urn:ietf:params:oauth:grant-type:device_code\",\"urn:openid:params:grant-type:ciba\"],\"acr_values_supported\":[\"0\",\"1\"],\"response_types_supported\":[\"code\",\"none\",\"id_token\",\"token\",\"id_token token\",\"code id_token\",\"code token\",\"code id_token token\"],\"subject_types_supported\":[\"public\",\"pairwise\"],\"id_token_signing_alg_values_supported\":[\"PS384\",\"ES384\",\"RS384\",\"HS256\",\"HS512\",\"ES256\",\"RS256\",\"HS384\",\"ES512\",\"PS256\",\"PS512\",\"RS512\"],\"id_token_encryption_alg_values_supported\":[\"RSA-OAEP\",\"RSA-OAEP-256\",\"RSA1_5\"],\"id_token_encryption_enc_values_supported\":[\"A256GCM\",\"A192GCM\",\"A128GCM\",\"A128CBC-HS256\",\"A192CBC-HS384\",\"A256CBC-HS512\"],\"userinfo_signing_alg_values_supported\":[\"PS384\",\"ES384\",\"RS384\",\"HS256\",\"HS512\",\"ES256\",\"RS256\",\"HS384\",\"ES512\",\"PS256\",\"PS512\",\"RS512\",\"none\"],\"userinfo_encryption_alg_values_supported\":[\"RSA-OAEP\",\"RSA-OAEP-256\",\"RSA1_5\"],\"userinfo_encryption_enc_values_supported\":[\"A256GCM\",\"A192GCM\",\"A128GCM\",\"A128CBC-HS256\",\"A192CBC-HS384\",\"A256CBC-HS512\"],\"request_object_signing_alg_values_supported\":[\"PS384\",\"ES384\",\"RS384\",\"HS256\",\"HS512\",\"ES256\",\"RS256\",\"HS384\",\"ES512\",\"PS256\",\"PS512\",\"RS512\",\"none\"],\"request_object_encryption_alg_values_supported\":[\"RSA-OAEP\",\"RSA-OAEP-256\",\"RSA1_5\"],\"request_object_encryption_enc_values_supported\":[\"A256GCM\",\"A192GCM\",\"A128GCM\",\"A128CBC-HS256\",\"A192CBC-HS384\",\"A256CBC-HS512\"],\"response_modes_supported\":[\"query\",\"fragment\",\"form_post\",\"query.jwt\",\"fragment.jwt\",\"form_post.jwt\",\"jwt\"],\"registration_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/clients-registrations/openid-connect\",\"token_endpoint_auth_methods_supported\":[\"private_key_jwt\",\"client_secret_basic\",\"client_secret_post\",\"tls_client_auth\",\"client_secret_jwt\"],\"token_endpoint_auth_signing_alg_values_supported\":[\"PS384\",\"ES384\",\"RS384\",\"HS256\",\"HS512\",\"ES256\",\"RS256\",\"HS384\",\"ES512\",\"PS256\",\"PS512\",\"RS512\"],\"introspection_endpoint_auth_methods_supported\":[\"private_key_jwt\",\"client_secret_basic\",\"client_secret_post\",\"tls_client_auth\",\"client_secret_jwt\"],\"introspection_endpoint_auth_signing_alg_values_supported\":[\"PS384\",\"ES384\",\"RS384\",\"HS256\",\"HS512\",\"ES256\",\"RS256\",\"HS384\",\"ES512\",\"PS256\",\"PS512\",\"RS512\"],\"authorization_signing_alg_values_supported\":[\"PS384\",\"ES384\",\"RS384\",\"HS256\",\"HS512\",\"ES256\",\"RS256\",\"HS384\",\"ES512\",\"PS256\",\"PS512\",\"RS512\"],\"authorization_encryption_alg_values_supported\":[\"RSA-OAEP\",\"RSA-OAEP-256\",\"RSA1_5\"],\"authorization_encryption_enc_values_supported\":[\"A256GCM\",\"A192GCM\",\"A128GCM\",\"A128CBC-HS256\",\"A192CBC-HS384\",\"A256CBC-HS512\"],\"claims_supported\":[\"aud\",\"sub\",\"iss\",\"auth_time\",\"name\",\"given_name\",\"family_name\",\"preferred_username\",\"email\",\"acr\"],\"claim_types_supported\":[\"normal\"],\"claims_parameter_supported\":true,\"scopes_supported\":[\"openid\",\"email\",\"address\",\"offline_access\",\"profile\",\"acr\",\"phone\",\"roles\",\"web-origins\",\"microprofile-jwt\"],\"request_parameter_supported\":true,\"request_uri_parameter_supported\":true,\"require_request_uri_registration\":true,\"code_challenge_methods_supported\":[\"plain\",\"S256\"],\"tls_client_certificate_bound_access_tokens\":true,\"revocation_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/revoke\",\"revocation_endpoint_auth_methods_supported\":[\"private_key_jwt\",\"client_secret_basic\",\"client_secret_post\",\"tls_client_auth\",\"client_secret_jwt\"],\"revocation_endpoint_auth_signing_alg_values_supported\":[\"PS384\",\"ES384\",\"RS384\",\"HS256\",\"HS512\",\"ES256\",\"RS256\",\"HS384\",\"ES512\",\"PS256\",\"PS512\",\"RS512\"],\"backchannel_logout_supported\":true,\"backchannel_logout_session_supported\":true,\"device_authorization_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/auth/device\",\"backchannel_token_delivery_modes_supported\":[\"poll\",\"ping\"],\"backchannel_authentication_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/ext/ciba/auth\",\"backchannel_authentication_request_signing_alg_values_supported\":[\"PS384\",\"ES384\",\"RS384\",\"ES256\",\"RS256\",\"ES512\",\"PS256\",\"PS512\",\"RS512\"],\"require_pushed_authorization_requests\":false,\"pushed_authorization_request_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/ext/par/request\",\"mtls_endpoint_aliases\":{\"token_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/token\",\"revocation_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/revoke\",\"introspection_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/token/introspect\",\"device_authorization_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/auth/device\",\"registration_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/clients-registrations/openid-connect\",\"userinfo_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/userinfo\",\"pushed_authorization_request_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/ext/par/request\",\"backchannel_authentication_endpoint\":\"https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/protocol/openid-connect/ext/ciba/auth\"}}]"
09-12 15:42:08:018 [ info sync.httplogger ]:    "0c1f9439-608c-4d91-8c2e-ef21184c6098: Request: POST https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/clients-registrations/openid-connect Header: { Content-Type: application/json, User-Agent: Mozilla/5.0 (Macintosh) mirall/3.0.0.8522-daily20220912 (testpilotcloud, osx-21.6.0 ClientArchitecture: x86_64 OsArchitecture: x86_64), Accept: */*, X-Request-ID: 0c1f9439-608c-4d91-8c2e-ef21184c6098, Original-Request-ID: 0c1f9439-608c-4d91-8c2e-ef21184c6098, Content-Length: 211, } Data: [{\n    \"application_type\": \"native\",\n    \"client_name\": \"ownCloud Testpilot Edition 3.0.0.8522\",\n    \"redirect_uris\": [\n        \"http://127.0.0.1\"\n    ],\n    \"token_endpoint_auth_method\": \"client_secret_basic\"\n}\n]"
09-12 15:42:08:101 [ info sync.httplogger ]:    "0c1f9439-608c-4d91-8c2e-ef21184c6098: Response: POST 0 (Error: SSL handshake failed,) https://keycloak.ocis-keycloak.latest.owncloud.works/auth/realms/oCIS/clients-registrations/openid-connect Header: { } Data: []"
09-12 15:42:08:101 [ warning sync.credentials.oauth ]:  Failed to register the client "illegal value" ""
09-12 15:42:08:101 [ warning sync.credentials.oauth ]:  Failed to dynamically register the client, try the default client id "illegal value"
09-12 15:43:38:836 [ debug setupwizard.controller ] [ OCC::Wizard::SetupWizardController::SetupWizardController(OCC::SettingsDialog *)::(anonymous class)::operator() ]:    wizard window closed
09-12 15:43:38:837 [ info gui.folder.manager ]: void OCC::FolderMan::setSyncEnabled(bool) true
09-12 15:43:41:742 [ info gui.account.manager ]:    Saved all account settings, status: QSettings::NoError
09-12 15:43:41:788 [ debug gui.socketapi ]  [ OCC::SocketApi::~SocketApi ]: dtor

Client version number

% /Applications/testpilotcloud.app/Contents/MacOS/testpilotcloud --version                 
testpilotcloud testpilotcloud 3.0.0.8522-daily20220912
dff38d
Libraries Qt 5.15.5, OpenSSL 1.1.1q  5 Jul 2022
Using virtual files plugin: suffix
osx-21.6.0

Desktop environment (Linux only)

No response

Client package version and origin (Linux only)

No response

Installation path (Windows only)

No response

Server information

https://owncloud.dev/ocis/deployment/continuous_deployment/#ocis-with-keycloak

Additional context

@fmoc please have a look

fmoc commented 2 years ago

Could not reproduce this with the server you mentioned, they ship valid URLs apparently. However, a local deployment of the ocis_keycloak example allows me to reproduce the problem. Working on a solution.

TheOneRing commented 2 years ago

Did you try it with mitmproxy? Mitmproxy usually adds another layer of self signed certs.

michaelstingl commented 2 years ago

Yes, in my case, both hosts had perfectly fine certificates, but using mitmproxy broke them (of course), and I didn't install the mitmproxy hacky-hacky certificates on my machine. (I forgot mitmproxy in the "Steps to reproduc", sorry)

fmoc commented 2 years ago

Ah, I see. Yeah, makes sense. I'll use my current setup for testing for now.

fmoc commented 2 years ago

For the record, it looks like the ocis_keycloak example is perfectly supported. The error I see is coming from the oCIS server, it returns a 500 response when fetching the user information. The custom TLS certificate handling works as expected. I'd ignore this one for now, seems like a bug within a development release of oCIS.

This issue can be reproduced with mitmproxy 8.x only, 6.x behaves differently. Apparently, mitmproxy 8 uses host-specific certificates, whereas version 6 uses one certificate for all hosts. The latter works well with the current system. Supporting a second custom certificate per account however is anything but trivial currently, since we have to mix libsync and gui code (FetchUserInfoJobFactory needs to display such a dialog). I started working on a "chain-of-responsibility"-based fix, but overall, I'm not sure it's worth the effort...

michaelstingl commented 2 years ago

The error I see is coming from the oCIS server, it returns a 500 response when fetching the user information.

I'll open a separate issue…

michaelstingl commented 2 years ago

Supporting a second custom certificate per account however is anything but trivial currently, since we have to mix libsync and gui code (FetchUserInfoJobFactory needs to display such a dialog).

No urgency for now.

michaelstingl commented 2 years ago

The error I see is coming from the oCIS server, it returns a 500 response when fetching the user information.

I'll open a separate issue…

Here we go… https://github.com/owncloud/ocis/issues/4616